From b7d45096957a8c94d3d5db5bafb3d4efea8daca1 Mon Sep 17 00:00:00 2001 From: Igor Pecovnik Date: Thu, 23 Aug 2018 09:09:53 +0200 Subject: [PATCH] Espressobin bump to more recent BSP kernel 4.14.y, add upstream patches, boot log: http://ix.io/1l0m --- config/kernel/linux-mvebu64-default.config | 2798 ++- config/sources/mvebu64.conf | 4 +- .../0004-patch-4.14.22-23.patch | 1575 ++ .../0004-patch-4.14.23-24.patch | 3869 ++++ .../0004-patch-4.14.24-25.patch | 4194 ++++ .../0004-patch-4.14.25-26.patch | 561 + .../0004-patch-4.14.26-27.patch | 6245 ++++++ .../0004-patch-4.14.27-28.patch | 3101 +++ .../0004-patch-4.14.28-29.patch | 1579 ++ .../0004-patch-4.14.29-30.patch | 2536 +++ .../0004-patch-4.14.30-31.patch | 3861 ++++ .../0004-patch-4.14.31-32.patch | 1401 ++ .../0004-patch-4.14.32-33.patch | 2353 +++ .../0004-patch-4.14.33-34.patch | 5392 +++++ .../0004-patch-4.14.34-35.patch | 1801 ++ .../0004-patch-4.14.35-36.patch | 6386 ++++++ .../0004-patch-4.14.36-37.patch | 9466 +++++++++ .../0004-patch-4.14.37-38.patch | 4524 +++++ .../0004-patch-4.14.38-39.patch | 3551 ++++ ...-132.patch => 0004-patch-4.14.39-40.patch} | 2844 ++- .../0004-patch-4.14.40-41.patch | 2289 +++ .../0004-patch-4.14.41-42.patch | 1534 ++ .../0004-patch-4.14.42-43.patch | 3826 ++++ .../0004-patch-4.14.43-44.patch | 6489 ++++++ .../0004-patch-4.14.44-45.patch | 16561 ++++++++++++++++ .../0004-patch-4.14.45-46.patch | 850 + ...-135.patch => 0004-patch-4.14.46-47.patch} | 17 +- .../0004-patch-4.14.47-48.patch | 2503 +++ .../0004-patch-4.14.48-49.patch | 1356 ++ .../0004-patch-4.14.49-50.patch | 2447 +++ .../0004-patch-4.14.50-51.patch | 6337 ++++++ .../0004-patch-4.14.51-52.patch | 1921 ++ .../0004-patch-4.14.52-53.patch | 7251 +++++++ .../0004-patch-4.14.53-54.patch | 2835 +++ .../0004-patch-4.14.54-55.patch | 2167 ++ .../0004-patch-4.14.55-56.patch | 5019 +++++ .../0004-patch-4.14.56-57.patch | 4939 +++++ .../0004-patch-4.14.57-58.patch | 1431 ++ .../0004-patch-4.14.58-59.patch | 2213 +++ .../0004-patch-4.14.59-60.patch | 7461 +++++++ .../0004-patch-4.14.60-61.patch | 909 + .../0004-patch-4.14.61-62.patch | 797 + .../0004-patch-4.14.62-63.patch | 5609 ++++++ .../0004-patch-4.14.63-64.patch | 1527 ++ .../0004-patch-4.14.64-65.patch | 37 + .../0004-patch-4.14.65-66.patch | 683 + ...911.patch => 0005-aufs4.14-20171218.patch} | 4995 +++-- .../mvebu64-default/03-patch-4.4.52-53.patch | 8420 -------- .../mvebu64-default/03-patch-4.4.53-54.patch | 1611 -- .../mvebu64-default/03-patch-4.4.54-55.patch | 1203 -- .../mvebu64-default/03-patch-4.4.55-56.patch | 2116 -- .../mvebu64-default/03-patch-4.4.56-57.patch | 1096 - .../mvebu64-default/03-patch-4.4.57-58.patch | 2653 --- .../mvebu64-default/03-patch-4.4.58-59.patch | 548 - .../mvebu64-default/03-patch-4.4.59-60.patch | 1175 -- .../mvebu64-default/03-patch-4.4.60-61.patch | 1527 -- .../mvebu64-default/03-patch-4.4.61-62.patch | 839 - .../mvebu64-default/03-patch-4.4.62-63.patch | 1801 -- .../mvebu64-default/03-patch-4.4.63-64.patch | 1016 - .../mvebu64-default/03-patch-4.4.64-65.patch | 920 - .../mvebu64-default/03-patch-4.4.65-66.patch | 1309 -- .../mvebu64-default/03-patch-4.4.66-67.patch | 948 - .../mvebu64-default/03-patch-4.4.67-68.patch | 2093 -- .../mvebu64-default/03-patch-4.4.68-69.patch | 2887 --- .../mvebu64-default/03-patch-4.4.69-70.patch | 3652 ---- .../mvebu64-default/03-patch-4.4.70-71.patch | 2203 -- .../mvebu64-default/03-patch-4.4.71-72.patch | 3301 --- .../mvebu64-default/03-patch-4.4.72-73.patch | 2192 -- .../mvebu64-default/03-patch-4.4.73-74.patch | 1488 -- .../mvebu64-default/03-patch-4.4.74-75.patch | 1018 - .../mvebu64-default/03-patch-4.4.75-76.patch | 2853 --- .../mvebu64-default/03-patch-4.4.76-77.patch | 1575 -- .../mvebu64-default/03-patch-4.4.77-78.patch | 3019 --- .../mvebu64-default/03-patch-4.4.78-79.patch | 2607 --- .../mvebu64-default/03-patch-4.4.79-80.patch | 3274 --- .../mvebu64-default/03-patch-4.4.80-81.patch | 2082 -- .../mvebu64-default/03-patch-4.4.81-82.patch | 330 - .../mvebu64-default/03-patch-4.4.82-83.patch | 476 - .../mvebu64-default/03-patch-4.4.83-84.patch | 761 - .../mvebu64-default/03-patch-4.4.84-85.patch | 1511 -- .../mvebu64-default/03-patch-4.4.85-86.patch | 393 - .../mvebu64-default/03-patch-4.4.86-87.patch | 408 - .../mvebu64-default/03-patch-4.4.87-88.patch | 1154 -- .../mvebu64-default/03-patch-4.4.88-89.patch | 2770 --- .../mvebu64-default/03-patch-4.4.89-90.patch | 1208 -- .../mvebu64-default/03-patch-4.4.90-91.patch | 2284 --- .../mvebu64-default/03-patch-4.4.91-92.patch | 1750 -- .../mvebu64-default/03-patch-4.4.92-93.patch | 933 - .../mvebu64-default/03-patch-4.4.93-94.patch | 1367 -- .../mvebu64-default/03-patch-4.4.94-95.patch | 1587 -- .../mvebu64-default/03-patch-4.4.95-96.patch | 809 - .../mvebu64-default/03-patch-4.4.96-97.patch | 1525 -- .../mvebu64-default/03-patch-4.4.97-98.patch | 1881 -- .../mvebu64-default/03-patch-4.4.98-99.patch | 1260 -- .../mvebu64-default/03-patch-4.4.99-100.patch | 2132 -- .../04-patch-4.4.100-101.patch | 718 - .../04-patch-4.4.101-102.patch | 43 - .../04-patch-4.4.102-103.patch | 3056 --- .../04-patch-4.4.103-104.patch | 1469 -- .../04-patch-4.4.104-105.patch | 1339 -- .../04-patch-4.4.105-106.patch | 3409 ---- .../04-patch-4.4.106-107.patch | 3188 --- .../04-patch-4.4.107-108.patch | 2623 --- .../04-patch-4.4.108-109.patch | 2275 --- .../04-patch-4.4.109-110.patch | 2814 --- .../04-patch-4.4.110-111.patch | 772 - .../04-patch-4.4.111-112.patch | 4343 ---- .../04-patch-4.4.112-113.patch | 2220 --- .../04-patch-4.4.113-114.patch | 3477 ---- .../04-patch-4.4.114-115.patch | 1942 -- .../04-patch-4.4.115-116.patch | 5357 ----- .../04-patch-4.4.116-117.patch | 929 - .../04-patch-4.4.117-118.patch | 9662 --------- .../04-patch-4.4.118-119.patch | 696 - .../04-patch-4.4.119-120.patch | 1104 - .../04-patch-4.4.120-121.patch | 1085 - .../04-patch-4.4.121-122.patch | 2177 -- .../04-patch-4.4.122-123.patch | 3500 ---- .../04-patch-4.4.123-124.patch | 3077 --- .../04-patch-4.4.124-125.patch | 1326 -- .../04-patch-4.4.125-126.patch | 455 - .../04-patch-4.4.126-127.patch | 2344 --- .../04-patch-4.4.127-128.patch | 5345 ----- .../04-patch-4.4.128-129.patch | 3460 ---- .../04-patch-4.4.129-130.patch | 2698 --- .../04-patch-4.4.130-131.patch | 1558 -- .../04-patch-4.4.132-133.patch | 3963 ---- .../04-patch-4.4.133-134.patch | 7578 ------- .../04-patch-4.4.135-136.patch | 1421 -- .../04-patch-4.4.136-137.patch | 625 - .../04-patch-4.4.137-138.patch | 1561 -- .../04-patch-4.4.138-139.patch | 2867 --- .../arm64-set-default-target-to-Image.patch | 13 + ..._DMA_block_memory_allocation_to_2048.patch | 13 - .../bash_to_afterinstall.patch | 11 + .../espressobin_enable_SPI_flash.patch | 64 - ..._DMA_block_memory_allocation_to_2048.patch | 13 + ...scripts.patch => packaging-4.x-next.patch} | 149 +- ...me-espressobin-dtb-for-compatibility.patch | 17 + ...lock_atheros_regulatory_restrictions.patch | 70 - ...02-realtek-881xAU-adding-kernel-4.14.patch | 26 + ...002-realtek-881xAU-adding-kernel-4.4.patch | 26 - ...-disable-8814au-broken-on-K4.4-arm64.patch | 24 - ...ealtek-8188EU-kconfig-makefile-4.14.patch} | 24 +- .../sunxi-next/packaging-4.x-next.patch | 24 +- 145 files changed, 157613 insertions(+), 187346 deletions(-) create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.22-23.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.23-24.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.24-25.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.25-26.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.26-27.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.27-28.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.28-29.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.29-30.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.30-31.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.31-32.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.32-33.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.33-34.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.34-35.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.35-36.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.36-37.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.37-38.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.38-39.patch rename patch/kernel/mvebu64-default/{04-patch-4.4.131-132.patch => 0004-patch-4.14.39-40.patch} (52%) create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.40-41.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.41-42.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.42-43.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.43-44.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.44-45.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.45-46.patch rename patch/kernel/mvebu64-default/{04-patch-4.4.134-135.patch => 0004-patch-4.14.46-47.patch} (59%) create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.47-48.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.48-49.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.49-50.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.50-51.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.51-52.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.52-53.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.53-54.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.54-55.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.55-56.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.56-57.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.57-58.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.58-59.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.59-60.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.60-61.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.61-62.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.62-63.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.63-64.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.64-65.patch create mode 100644 patch/kernel/mvebu64-default/0004-patch-4.14.65-66.patch rename patch/kernel/mvebu64-default/{0001-aufs4.4-20170911.patch => 0005-aufs4.14-20171218.patch} (89%) delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.52-53.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.53-54.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.54-55.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.55-56.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.56-57.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.57-58.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.58-59.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.59-60.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.60-61.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.61-62.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.62-63.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.63-64.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.64-65.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.65-66.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.66-67.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.67-68.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.68-69.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.69-70.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.70-71.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.71-72.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.72-73.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.73-74.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.74-75.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.75-76.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.76-77.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.77-78.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.78-79.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.79-80.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.80-81.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.81-82.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.82-83.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.83-84.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.84-85.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.85-86.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.86-87.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.87-88.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.88-89.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.89-90.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.90-91.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.91-92.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.92-93.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.93-94.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.94-95.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.95-96.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.96-97.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.97-98.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.98-99.patch delete mode 100644 patch/kernel/mvebu64-default/03-patch-4.4.99-100.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.100-101.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.101-102.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.102-103.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.103-104.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.104-105.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.105-106.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.106-107.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.107-108.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.108-109.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.109-110.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.110-111.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.111-112.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.112-113.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.113-114.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.114-115.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.115-116.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.116-117.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.117-118.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.118-119.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.119-120.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.120-121.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.121-122.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.122-123.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.123-124.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.124-125.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.125-126.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.126-127.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.127-128.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.128-129.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.129-130.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.130-131.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.132-133.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.133-134.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.135-136.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.136-137.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.137-138.patch delete mode 100644 patch/kernel/mvebu64-default/04-patch-4.4.138-139.patch create mode 100644 patch/kernel/mvebu64-default/arm64-set-default-target-to-Image.patch delete mode 100644 patch/kernel/mvebu64-default/arm64_espressobin_increasing_DMA_block_memory_allocation_to_2048.patch create mode 100644 patch/kernel/mvebu64-default/bash_to_afterinstall.patch delete mode 100644 patch/kernel/mvebu64-default/espressobin_enable_SPI_flash.patch create mode 100644 patch/kernel/mvebu64-default/increasing_DMA_block_memory_allocation_to_2048.patch rename patch/kernel/mvebu64-default/{packaging-4.x-with-postinstall-scripts.patch => packaging-4.x-next.patch} (60%) create mode 100644 patch/kernel/mvebu64-default/rename-espressobin-dtb-for-compatibility.patch delete mode 100644 patch/kernel/mvebu64-default/unlock_atheros_regulatory_restrictions.patch create mode 100644 patch/kernel/mvebu64-default/wifi-0002-realtek-881xAU-adding-kernel-4.14.patch delete mode 100644 patch/kernel/mvebu64-default/wifi-0002-realtek-881xAU-adding-kernel-4.4.patch delete mode 100644 patch/kernel/mvebu64-default/wifi-0004-realtek-881xAU-disable-8814au-broken-on-K4.4-arm64.patch rename patch/kernel/mvebu64-default/{wifi-0011-realtek-8188EU-kconfig-makefile-4-4.patch => wifi-0011-realtek-8188EU-kconfig-makefile-4.14.patch} (52%) diff --git a/config/kernel/linux-mvebu64-default.config b/config/kernel/linux-mvebu64-default.config index c38ff8f22097..cdd3182a4572 100644 --- a/config/kernel/linux-mvebu64-default.config +++ b/config/kernel/linux-mvebu64-default.config @@ -1,11 +1,17 @@ # # Automatically generated file; DO NOT EDIT. -# Linux/arm64 4.4.138 Kernel Configuration +# Linux/arm64 4.14.66 Kernel Configuration # CONFIG_ARM64=y CONFIG_64BIT=y CONFIG_ARCH_PHYS_ADDR_T_64BIT=y CONFIG_MMU=y +CONFIG_ARM64_PAGE_SHIFT=12 +CONFIG_ARM64_CONT_SHIFT=4 +CONFIG_ARCH_MMAP_RND_BITS_MIN=18 +CONFIG_ARCH_MMAP_RND_BITS_MAX=24 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MIN=11 +CONFIG_ARCH_MMAP_RND_COMPAT_BITS_MAX=16 CONFIG_STACKTRACE_SUPPORT=y CONFIG_ILLEGAL_POINTER_VALUE=0xdead000000000000 CONFIG_LOCKDEP_SUPPORT=y @@ -17,7 +23,7 @@ CONFIG_GENERIC_HWEIGHT=y CONFIG_GENERIC_CSUM=y CONFIG_GENERIC_CALIBRATE_DELAY=y CONFIG_ZONE_DMA=y -CONFIG_HAVE_GENERIC_RCU_GUP=y +CONFIG_HAVE_GENERIC_GUP=y CONFIG_ARCH_DMA_ADDR_T_64BIT=y CONFIG_NEED_DMA_MAP_STATE=y CONFIG_NEED_SG_DMA_LENGTH=y @@ -27,9 +33,12 @@ CONFIG_IOMMU_HELPER=y CONFIG_KERNEL_MODE_NEON=y CONFIG_FIX_EARLYCON_MEM=y CONFIG_PGTABLE_LEVELS=3 +CONFIG_ARCH_SUPPORTS_UPROBES=y +CONFIG_ARCH_PROC_KCORE_TEXT=y CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config" CONFIG_IRQ_WORK=y CONFIG_BUILDTIME_EXTABLE_SORT=y +CONFIG_THREAD_INFO_IN_TASK=y # # General setup @@ -60,6 +69,7 @@ CONFIG_AUDIT_TREE=y CONFIG_GENERIC_IRQ_PROBE=y CONFIG_GENERIC_IRQ_SHOW=y CONFIG_GENERIC_IRQ_SHOW_LEVEL=y +CONFIG_GENERIC_IRQ_EFFECTIVE_AFF_MASK=y CONFIG_GENERIC_IRQ_MIGRATION=y CONFIG_HARDIRQS_SW_RESEND=y CONFIG_GENERIC_IRQ_CHIP=y @@ -71,6 +81,8 @@ CONFIG_HANDLE_DOMAIN_IRQ=y # CONFIG_IRQ_DOMAIN_DEBUG is not set CONFIG_IRQ_FORCED_THREADING=y CONFIG_SPARSE_IRQ=y +# CONFIG_GENERIC_IRQ_DEBUGFS is not set +CONFIG_ARCH_CLOCKSOURCE_DATA=y CONFIG_GENERIC_TIME_VSYSCALL=y CONFIG_GENERIC_CLOCKEVENTS=y CONFIG_ARCH_HAS_TICK_BROADCAST=y @@ -106,39 +118,44 @@ CONFIG_TASK_IO_ACCOUNTING=y CONFIG_PREEMPT_RCU=y # CONFIG_RCU_EXPERT is not set CONFIG_SRCU=y -# CONFIG_TASKS_RCU is not set +CONFIG_TREE_SRCU=y +CONFIG_TASKS_RCU=y CONFIG_RCU_STALL_COMMON=y -# CONFIG_TREE_RCU_TRACE is not set -# CONFIG_RCU_EXPEDITE_BOOT is not set +CONFIG_RCU_NEED_SEGCBLIST=y CONFIG_BUILD_BIN2C=y CONFIG_IKCONFIG=y CONFIG_IKCONFIG_PROC=y -CONFIG_LOG_BUF_SHIFT=14 +CONFIG_LOG_BUF_SHIFT=18 CONFIG_LOG_CPU_MAX_BUF_SHIFT=12 +CONFIG_PRINTK_SAFE_LOG_BUF_SHIFT=13 CONFIG_GENERIC_SCHED_CLOCK=y +CONFIG_ARCH_SUPPORTS_NUMA_BALANCING=y +# CONFIG_NUMA_BALANCING is not set CONFIG_CGROUPS=y -# CONFIG_CGROUP_DEBUG is not set -CONFIG_CGROUP_FREEZER=y -CONFIG_CGROUP_PIDS=y -CONFIG_CGROUP_DEVICE=y -CONFIG_CPUSETS=y -CONFIG_PROC_PID_CPUSET=y -CONFIG_CGROUP_CPUACCT=y CONFIG_PAGE_COUNTER=y CONFIG_MEMCG=y CONFIG_MEMCG_SWAP=y CONFIG_MEMCG_SWAP_ENABLED=y -CONFIG_MEMCG_KMEM=y -CONFIG_CGROUP_HUGETLB=y -CONFIG_CGROUP_PERF=y +CONFIG_BLK_CGROUP=y +# CONFIG_DEBUG_BLK_CGROUP is not set +CONFIG_CGROUP_WRITEBACK=y CONFIG_CGROUP_SCHED=y CONFIG_FAIR_GROUP_SCHED=y CONFIG_CFS_BANDWIDTH=y CONFIG_RT_GROUP_SCHED=y -CONFIG_BLK_CGROUP=y -# CONFIG_DEBUG_BLK_CGROUP is not set -CONFIG_CGROUP_WRITEBACK=y -# CONFIG_CHECKPOINT_RESTORE is not set +CONFIG_CGROUP_PIDS=y +CONFIG_CGROUP_RDMA=y +CONFIG_CGROUP_FREEZER=y +CONFIG_CGROUP_HUGETLB=y +CONFIG_CPUSETS=y +CONFIG_PROC_PID_CPUSET=y +CONFIG_CGROUP_DEVICE=y +CONFIG_CGROUP_CPUACCT=y +CONFIG_CGROUP_PERF=y +CONFIG_CGROUP_BPF=y +# CONFIG_CGROUP_DEBUG is not set +CONFIG_SOCK_CGROUP_DATA=y +CONFIG_CHECKPOINT_RESTORE=y CONFIG_NAMESPACES=y CONFIG_UTS_NS=y CONFIG_IPC_NS=y @@ -169,13 +186,17 @@ CONFIG_MULTIUSER=y CONFIG_SGETMASK_SYSCALL=y CONFIG_SYSFS_SYSCALL=y CONFIG_SYSCTL_SYSCALL=y +CONFIG_POSIX_TIMERS=y CONFIG_KALLSYMS=y CONFIG_KALLSYMS_ALL=y +# CONFIG_KALLSYMS_ABSOLUTE_PERCPU is not set +CONFIG_KALLSYMS_BASE_RELATIVE=y CONFIG_PRINTK=y CONFIG_BUG=y CONFIG_ELF_CORE=y CONFIG_BASE_FULL=y CONFIG_FUTEX=y +CONFIG_FUTEX_PI=y CONFIG_EPOLL=y CONFIG_SIGNALFD=y CONFIG_TIMERFD=y @@ -190,7 +211,7 @@ CONFIG_PCI_QUIRKS=y CONFIG_MEMBARRIER=y CONFIG_EMBEDDED=y CONFIG_HAVE_PERF_EVENTS=y -CONFIG_PERF_USE_VMALLOC=y +# CONFIG_PC104 is not set # # Kernel Performance Events And Counters @@ -199,23 +220,34 @@ CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_VM_EVENT_COUNTERS=y CONFIG_SLUB_DEBUG=y +# CONFIG_SLUB_MEMCG_SYSFS_ON is not set # CONFIG_COMPAT_BRK is not set # CONFIG_SLAB is not set CONFIG_SLUB=y # CONFIG_SLOB is not set +CONFIG_SLAB_MERGE_DEFAULT=y +# CONFIG_SLAB_FREELIST_RANDOM is not set +# CONFIG_SLAB_FREELIST_HARDENED is not set CONFIG_SLUB_CPU_PARTIAL=y # CONFIG_SYSTEM_DATA_VERIFICATION is not set CONFIG_PROFILING=y +CONFIG_CRASH_CORE=y +CONFIG_KEXEC_CORE=y +# CONFIG_KPROBES is not set CONFIG_JUMP_LABEL=y # CONFIG_STATIC_KEYS_SELFTEST is not set # CONFIG_UPROBES is not set # CONFIG_HAVE_64BIT_ALIGNED_ACCESS is not set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y +CONFIG_HAVE_KPROBES=y +CONFIG_HAVE_KRETPROBES=y CONFIG_HAVE_ARCH_TRACEHOOK=y -CONFIG_HAVE_DMA_ATTRS=y CONFIG_HAVE_DMA_CONTIGUOUS=y CONFIG_GENERIC_SMP_IDLE_THREAD=y CONFIG_GENERIC_IDLE_POLL_SETUP=y +CONFIG_ARCH_HAS_FORTIFY_SOURCE=y +CONFIG_ARCH_HAS_SET_MEMORY=y +CONFIG_HAVE_REGS_AND_STACK_ACCESS_API=y CONFIG_HAVE_CLK=y CONFIG_HAVE_DMA_API_DEBUG=y CONFIG_HAVE_HW_BREAKPOINT=y @@ -229,20 +261,40 @@ CONFIG_HAVE_CMPXCHG_DOUBLE=y CONFIG_ARCH_WANT_COMPAT_IPC_PARSE_VERSION=y CONFIG_HAVE_ARCH_SECCOMP_FILTER=y CONFIG_SECCOMP_FILTER=y +CONFIG_HAVE_GCC_PLUGINS=y +# CONFIG_GCC_PLUGINS is not set CONFIG_HAVE_CC_STACKPROTECTOR=y # CONFIG_CC_STACKPROTECTOR is not set CONFIG_CC_STACKPROTECTOR_NONE=y # CONFIG_CC_STACKPROTECTOR_REGULAR is not set # CONFIG_CC_STACKPROTECTOR_STRONG is not set +CONFIG_THIN_ARCHIVES=y CONFIG_HAVE_CONTEXT_TRACKING=y CONFIG_HAVE_VIRT_CPU_ACCOUNTING_GEN=y CONFIG_HAVE_IRQ_TIME_ACCOUNTING=y CONFIG_HAVE_ARCH_TRANSPARENT_HUGEPAGE=y +CONFIG_HAVE_ARCH_HUGE_VMAP=y CONFIG_MODULES_USE_ELF_RELA=y CONFIG_ARCH_HAS_ELF_RANDOMIZE=y +CONFIG_HAVE_ARCH_MMAP_RND_BITS=y +CONFIG_ARCH_MMAP_RND_BITS=18 +CONFIG_HAVE_ARCH_MMAP_RND_COMPAT_BITS=y +CONFIG_ARCH_MMAP_RND_COMPAT_BITS=11 +# CONFIG_HAVE_ARCH_HASH is not set +# CONFIG_ISA_BUS_API is not set CONFIG_CLONE_BACKWARDS=y CONFIG_OLD_SIGSUSPEND3=y CONFIG_COMPAT_OLD_SIGACTION=y +# CONFIG_CPU_NO_EFFICIENT_FFS is not set +CONFIG_HAVE_ARCH_VMAP_STACK=y +CONFIG_VMAP_STACK=y +# CONFIG_ARCH_OPTIONAL_KERNEL_RWX is not set +# CONFIG_ARCH_OPTIONAL_KERNEL_RWX_DEFAULT is not set +CONFIG_ARCH_HAS_STRICT_KERNEL_RWX=y +CONFIG_STRICT_KERNEL_RWX=y +CONFIG_ARCH_HAS_STRICT_MODULE_RWX=y +CONFIG_STRICT_MODULE_RWX=y +# CONFIG_REFCOUNT_FULL is not set # # GCOV-based kernel profiling @@ -261,39 +313,30 @@ CONFIG_MODULE_UNLOAD=y # CONFIG_MODULE_SRCVERSION_ALL is not set # CONFIG_MODULE_SIG is not set # CONFIG_MODULE_COMPRESS is not set +# CONFIG_TRIM_UNUSED_KSYMS is not set CONFIG_MODULES_TREE_LOOKUP=y CONFIG_BLOCK=y +CONFIG_BLK_SCSI_REQUEST=y CONFIG_BLK_DEV_BSG=y CONFIG_BLK_DEV_BSGLIB=y CONFIG_BLK_DEV_INTEGRITY=y +# CONFIG_BLK_DEV_ZONED is not set CONFIG_BLK_DEV_THROTTLING=y +# CONFIG_BLK_DEV_THROTTLING_LOW is not set CONFIG_BLK_CMDLINE_PARSER=y +# CONFIG_BLK_WBT is not set +CONFIG_BLK_DEBUG_FS=y +# CONFIG_BLK_SED_OPAL is not set # # Partition Types # -CONFIG_PARTITION_ADVANCED=y -# CONFIG_ACORN_PARTITION is not set -# CONFIG_AIX_PARTITION is not set -# CONFIG_OSF_PARTITION is not set -# CONFIG_AMIGA_PARTITION is not set -# CONFIG_ATARI_PARTITION is not set -CONFIG_MAC_PARTITION=y +# CONFIG_PARTITION_ADVANCED is not set CONFIG_MSDOS_PARTITION=y -CONFIG_BSD_DISKLABEL=y -CONFIG_MINIX_SUBPARTITION=y -CONFIG_SOLARIS_X86_PARTITION=y -CONFIG_UNIXWARE_DISKLABEL=y -CONFIG_LDM_PARTITION=y -# CONFIG_LDM_DEBUG is not set -# CONFIG_SGI_PARTITION is not set -# CONFIG_ULTRIX_PARTITION is not set -# CONFIG_SUN_PARTITION is not set -# CONFIG_KARMA_PARTITION is not set CONFIG_EFI_PARTITION=y -# CONFIG_SYSV68_PARTITION is not set -# CONFIG_CMDLINE_PARTITION is not set CONFIG_BLOCK_COMPAT=y +CONFIG_BLK_MQ_PCI=y +CONFIG_BLK_MQ_VIRTIO=y # # IO Schedulers @@ -306,6 +349,10 @@ CONFIG_CFQ_GROUP_IOSCHED=y CONFIG_DEFAULT_CFQ=y # CONFIG_DEFAULT_NOOP is not set CONFIG_DEFAULT_IOSCHED="cfq" +CONFIG_MQ_IOSCHED_DEADLINE=y +CONFIG_MQ_IOSCHED_KYBER=y +CONFIG_IOSCHED_BFQ=y +CONFIG_BFQ_GROUP_IOSCHED=y CONFIG_PREEMPT_NOTIFIERS=y CONFIG_UNINLINE_SPIN_UNLOCK=y CONFIG_ARCH_SUPPORTS_ATOMIC_RMW=y @@ -317,23 +364,35 @@ CONFIG_FREEZER=y # # Platform selection # -CONFIG_ARCH_MVEBU=y -# CONFIG_ARCH_MVEBU_PD is not set +# CONFIG_ARCH_ACTIONS is not set +# CONFIG_ARCH_SUNXI is not set +# CONFIG_ARCH_ALPINE is not set +# CONFIG_ARCH_BCM2835 is not set # CONFIG_ARCH_BCM_IPROC is not set # CONFIG_ARCH_BERLIN is not set -# CONFIG_ARCH_EXYNOS7 is not set +# CONFIG_ARCH_BRCMSTB is not set +# CONFIG_ARCH_EXYNOS is not set # CONFIG_ARCH_LAYERSCAPE is not set +# CONFIG_ARCH_LG1K is not set # CONFIG_ARCH_HISI is not set # CONFIG_ARCH_MEDIATEK is not set +# CONFIG_ARCH_MESON is not set +CONFIG_ARCH_MVEBU=y # CONFIG_ARCH_QCOM is not set +# CONFIG_ARCH_REALTEK is not set # CONFIG_ARCH_ROCKCHIP is not set # CONFIG_ARCH_SEATTLE is not set +# CONFIG_ARCH_RENESAS is not set # CONFIG_ARCH_STRATIX10 is not set # CONFIG_ARCH_TEGRA is not set # CONFIG_ARCH_SPRD is not set # CONFIG_ARCH_THUNDER is not set +# CONFIG_ARCH_THUNDER2 is not set +# CONFIG_ARCH_UNIPHIER is not set # CONFIG_ARCH_VEXPRESS is not set +# CONFIG_ARCH_VULCAN is not set # CONFIG_ARCH_XGENE is not set +# CONFIG_ARCH_ZX is not set # CONFIG_ARCH_ZYNQMP is not set # @@ -343,40 +402,59 @@ CONFIG_PCI=y CONFIG_PCI_DOMAINS=y CONFIG_PCI_DOMAINS_GENERIC=y CONFIG_PCI_SYSCALL=y +CONFIG_PCIEPORTBUS=y +CONFIG_PCIEAER=y +# CONFIG_PCIE_ECRC is not set +# CONFIG_PCIEAER_INJECT is not set +CONFIG_PCIEASPM=y +# CONFIG_PCIEASPM_DEBUG is not set +CONFIG_PCIEASPM_DEFAULT=y +# CONFIG_PCIEASPM_POWERSAVE is not set +# CONFIG_PCIEASPM_POWER_SUPERSAVE is not set +# CONFIG_PCIEASPM_PERFORMANCE is not set +CONFIG_PCIE_PME=y +# CONFIG_PCIE_DPC is not set +# CONFIG_PCIE_PTM is not set CONFIG_PCI_BUS_ADDR_T_64BIT=y CONFIG_PCI_MSI=y CONFIG_PCI_MSI_IRQ_DOMAIN=y # CONFIG_PCI_DEBUG is not set # CONFIG_PCI_REALLOC_ENABLE_AUTO is not set # CONFIG_PCI_STUB is not set -CONFIG_PCI_ATS=y -CONFIG_PCI_IOV=y +CONFIG_PCI_ECAM=y +# CONFIG_PCI_IOV is not set # CONFIG_PCI_PRI is not set # CONFIG_PCI_PASID is not set CONFIG_PCI_LABEL=y +# CONFIG_HOTPLUG_PCI is not set # -# PCI host controller drivers +# DesignWare PCI Core Support # -# CONFIG_PCI_MVEBU is not set -CONFIG_IGNORE_ASYNC_ABORT=y -CONFIG_PCIE_DW=y -CONFIG_PCI_HOST_GENERIC=y -CONFIG_PCIE_IPROC=y +# CONFIG_PCIE_DW_PLAT is not set # CONFIG_PCI_HISI is not set -CONFIG_PCIE_ARMADA_8K=y +# CONFIG_PCIE_ARMADA_8K is not set +# CONFIG_PCIE_KIRIN is not set + +# +# PCI host controller drivers +# CONFIG_PCI_AARDVARK=y -CONFIG_PCIEPORTBUS=y -CONFIG_PCIEAER=y -# CONFIG_PCIE_ECRC is not set -# CONFIG_PCIEAER_INJECT is not set -CONFIG_PCIEASPM=y -# CONFIG_PCIEASPM_DEBUG is not set -CONFIG_PCIEASPM_DEFAULT=y -# CONFIG_PCIEASPM_POWERSAVE is not set -# CONFIG_PCIEASPM_PERFORMANCE is not set -CONFIG_PCIE_PME=y -# CONFIG_HOTPLUG_PCI is not set +CONFIG_PCI_HOST_COMMON=y +CONFIG_PCI_HOST_GENERIC=y +# CONFIG_PCI_XGENE is not set +# CONFIG_PCI_HOST_THUNDER_PEM is not set +# CONFIG_PCI_HOST_THUNDER_ECAM is not set + +# +# PCI Endpoint +# +# CONFIG_PCI_ENDPOINT is not set + +# +# PCI switch controller drivers +# +# CONFIG_PCI_SW_SWITCHTEC is not set # # Kernel Features @@ -393,9 +471,16 @@ CONFIG_ARM64_ERRATUM_832075=y CONFIG_ARM64_ERRATUM_834220=y CONFIG_ARM64_ERRATUM_845719=y CONFIG_ARM64_ERRATUM_843419=y +CONFIG_ARM64_ERRATUM_1024718=y CONFIG_CAVIUM_ERRATUM_22375=y +CONFIG_CAVIUM_ERRATUM_23144=y CONFIG_CAVIUM_ERRATUM_23154=y CONFIG_CAVIUM_ERRATUM_27456=y +CONFIG_CAVIUM_ERRATUM_30115=y +CONFIG_QCOM_FALKOR_ERRATUM_1003=y +CONFIG_QCOM_FALKOR_ERRATUM_1009=y +CONFIG_QCOM_QDF2400_ERRATUM_0065=y +CONFIG_QCOM_FALKOR_ERRATUM_E1041=y CONFIG_ARM64_4K_PAGES=y # CONFIG_ARM64_16K_PAGES is not set # CONFIG_ARM64_64K_PAGES is not set @@ -403,22 +488,27 @@ CONFIG_ARM64_VA_BITS_39=y # CONFIG_ARM64_VA_BITS_48 is not set CONFIG_ARM64_VA_BITS=39 # CONFIG_CPU_BIG_ENDIAN is not set -# CONFIG_MMIO_64BIT is not set CONFIG_SCHED_MC=y # CONFIG_SCHED_SMT is not set CONFIG_NR_CPUS=64 CONFIG_HOTPLUG_CPU=y +CONFIG_NUMA=y +CONFIG_NODES_SHIFT=2 +CONFIG_USE_PERCPU_NUMA_NODE_ID=y +CONFIG_HAVE_SETUP_PER_CPU_AREA=y +CONFIG_NEED_PER_CPU_EMBED_FIRST_CHUNK=y +CONFIG_HOLES_IN_ZONE=y # CONFIG_PREEMPT_NONE is not set # CONFIG_PREEMPT_VOLUNTARY is not set CONFIG_PREEMPT=y CONFIG_PREEMPT_COUNT=y -# CONFIG_HZ_20 is not set # CONFIG_HZ_100 is not set -# CONFIG_HZ_250 is not set +CONFIG_HZ_250=y # CONFIG_HZ_300 is not set -CONFIG_HZ_1000=y -CONFIG_HZ=1000 +# CONFIG_HZ_1000 is not set +CONFIG_HZ=250 CONFIG_SCHED_HRTICK=y +CONFIG_ARCH_SUPPORTS_DEBUG_PAGEALLOC=y CONFIG_ARCH_HAS_HOLES_MEMORYMODEL=y CONFIG_ARCH_SPARSEMEM_ENABLE=y CONFIG_ARCH_SPARSEMEM_DEFAULT=y @@ -426,17 +516,18 @@ CONFIG_ARCH_SELECT_MEMORY_MODEL=y CONFIG_HAVE_ARCH_PFN_VALID=y CONFIG_HW_PERF_EVENTS=y CONFIG_SYS_SUPPORTS_HUGETLBFS=y -CONFIG_ARCH_WANT_GENERAL_HUGETLB=y CONFIG_ARCH_WANT_HUGE_PMD_SHARE=y CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y CONFIG_SELECT_MEMORY_MODEL=y CONFIG_SPARSEMEM_MANUAL=y CONFIG_SPARSEMEM=y +CONFIG_NEED_MULTIPLE_NODES=y CONFIG_HAVE_MEMORY_PRESENT=y CONFIG_SPARSEMEM_EXTREME=y CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y CONFIG_SPARSEMEM_VMEMMAP=y CONFIG_HAVE_MEMBLOCK=y +CONFIG_HAVE_MEMBLOCK_NODE_MAP=y CONFIG_NO_BOOTMEM=y CONFIG_MEMORY_ISOLATION=y # CONFIG_HAVE_BOOTMEM_INFO_NODE is not set @@ -446,14 +537,17 @@ CONFIG_BALLOON_COMPACTION=y CONFIG_COMPACTION=y CONFIG_MIGRATION=y CONFIG_PHYS_ADDR_T_64BIT=y -CONFIG_ZONE_DMA_FLAG=1 CONFIG_BOUNCE=y CONFIG_MMU_NOTIFIER=y CONFIG_KSM=y CONFIG_DEFAULT_MMAP_MIN_ADDR=4096 +CONFIG_ARCH_SUPPORTS_MEMORY_FAILURE=y +# CONFIG_MEMORY_FAILURE is not set CONFIG_TRANSPARENT_HUGEPAGE=y CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y # CONFIG_TRANSPARENT_HUGEPAGE_MADVISE is not set +# CONFIG_ARCH_WANTS_THP_SWAP is not set +CONFIG_TRANSPARENT_HUGE_PAGECACHE=y # CONFIG_CLEANCACHE is not set # CONFIG_FRONTSWAP is not set CONFIG_CMA=y @@ -462,17 +556,26 @@ CONFIG_CMA=y CONFIG_CMA_AREAS=7 CONFIG_ZPOOL=y CONFIG_ZBUD=m +# CONFIG_Z3FOLD is not set CONFIG_ZSMALLOC=m CONFIG_PGTABLE_MAPPING=y # CONFIG_ZSMALLOC_STAT is not set CONFIG_GENERIC_EARLY_IOREMAP=y # CONFIG_IDLE_PAGE_TRACKING is not set -CONFIG_FRAME_VECTOR=y +# CONFIG_PERCPU_STATS is not set CONFIG_SECCOMP=y -# CONFIG_XEN is not set +CONFIG_PARAVIRT=y +# CONFIG_PARAVIRT_TIME_ACCOUNTING is not set +CONFIG_KEXEC=y +CONFIG_CRASH_DUMP=y +CONFIG_XEN_DOM0=y +CONFIG_XEN=y CONFIG_FORCE_MAX_ZONEORDER=11 +CONFIG_UNMAP_KERNEL_AT_EL0=y CONFIG_HARDEN_BRANCH_PREDICTOR=y +CONFIG_ARM64_SSBD=y # CONFIG_ARMV8_DEPRECATED is not set +# CONFIG_ARM64_SW_TTBR0_PAN is not set # # ARMv8.1 architectural features @@ -480,10 +583,20 @@ CONFIG_HARDEN_BRANCH_PREDICTOR=y CONFIG_ARM64_HW_AFDBM=y CONFIG_ARM64_PAN=y # CONFIG_ARM64_LSE_ATOMICS is not set +CONFIG_ARM64_VHE=y + +# +# ARMv8.2 architectural features +# +CONFIG_ARM64_UAO=y +# CONFIG_ARM64_PMEM is not set +CONFIG_ARM64_MODULE_CMODEL_LARGE=y +# CONFIG_RANDOMIZE_BASE is not set # # Boot options # +# CONFIG_ARM64_ACPI_PARKING_PROTOCOL is not set CONFIG_CMDLINE="console=ttyAMA0" # CONFIG_CMDLINE_FORCE is not set CONFIG_EFI_STUB=y @@ -495,6 +608,7 @@ CONFIG_DMI=y # CONFIG_BINFMT_ELF=y CONFIG_COMPAT_BINFMT_ELF=y +CONFIG_ELFCORE=y # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set CONFIG_BINFMT_SCRIPT=y # CONFIG_HAVE_AOUT is not set @@ -509,6 +623,9 @@ CONFIG_SYSVIPC_COMPAT=y CONFIG_SUSPEND=y CONFIG_SUSPEND_FREEZER=y # CONFIG_SUSPEND_SKIP_SYNC is not set +CONFIG_HIBERNATE_CALLBACKS=y +CONFIG_HIBERNATION=y +CONFIG_PM_STD_PARTITION="" CONFIG_PM_SLEEP=y CONFIG_PM_SLEEP_SMP=y # CONFIG_PM_AUTOSLEEP is not set @@ -517,8 +634,13 @@ CONFIG_PM=y # CONFIG_PM_DEBUG is not set CONFIG_PM_OPP=y CONFIG_PM_CLK=y +CONFIG_PM_GENERIC_DOMAINS=y # CONFIG_WQ_POWER_EFFICIENT_DEFAULT is not set +CONFIG_PM_GENERIC_DOMAINS_SLEEP=y +CONFIG_PM_GENERIC_DOMAINS_OF=y CONFIG_CPU_PM=y +CONFIG_ARCH_HIBERNATION_POSSIBLE=y +CONFIG_ARCH_HIBERNATION_HEADER=y CONFIG_ARCH_SUSPEND_POSSIBLE=y # @@ -529,6 +651,7 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y # CPU Idle # CONFIG_CPU_IDLE=y +CONFIG_CPU_IDLE_MULTIPLE_DRIVERS=y CONFIG_CPU_IDLE_GOV_LADDER=y CONFIG_CPU_IDLE_GOV_MENU=y CONFIG_DT_IDLE_STATES=y @@ -543,32 +666,37 @@ CONFIG_ARM_CPUIDLE=y # CPU Frequency scaling # CONFIG_CPU_FREQ=y +CONFIG_CPU_FREQ_GOV_ATTR_SET=y CONFIG_CPU_FREQ_GOV_COMMON=y CONFIG_CPU_FREQ_STAT=y -CONFIG_CPU_FREQ_STAT_DETAILS=y # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_POWERSAVE is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE is not set CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y # CONFIG_CPU_FREQ_DEFAULT_GOV_CONSERVATIVE is not set +# CONFIG_CPU_FREQ_DEFAULT_GOV_SCHEDUTIL is not set CONFIG_CPU_FREQ_GOV_PERFORMANCE=y CONFIG_CPU_FREQ_GOV_POWERSAVE=y CONFIG_CPU_FREQ_GOV_USERSPACE=y CONFIG_CPU_FREQ_GOV_ONDEMAND=y CONFIG_CPU_FREQ_GOV_CONSERVATIVE=y +CONFIG_CPU_FREQ_GOV_SCHEDUTIL=y # # CPU frequency scaling drivers # CONFIG_CPUFREQ_DT=y -# CONFIG_ARM_BIG_LITTLE_CPUFREQ is not set +CONFIG_CPUFREQ_DT_PLATDEV=y +CONFIG_ACPI_CPPC_CPUFREQ=y +CONFIG_ARM_ARMADA_37XX_CPUFREQ=y +CONFIG_ARM_BIG_LITTLE_CPUFREQ=y +CONFIG_ARM_DT_BL_CPUFREQ=y # CONFIG_ARM_KIRKWOOD_CPUFREQ is not set -CONFIG_ARM_ARMADA3700_CPUFREQ=y -CONFIG_ARM_ARMADA_8K_CPUFREQ=y -CONFIG_ACPI_CPPC_CPUFREQ=m +# CONFIG_QORIQ_CPUFREQ is not set CONFIG_NET=y CONFIG_COMPAT_NETLINK_MESSAGES=y CONFIG_NET_INGRESS=y +CONFIG_NET_EGRESS=y # # Networking options @@ -577,6 +705,7 @@ CONFIG_PACKET=y CONFIG_PACKET_DIAG=m CONFIG_UNIX=y CONFIG_UNIX_DIAG=m +# CONFIG_TLS is not set CONFIG_XFRM=y CONFIG_XFRM_ALGO=m CONFIG_XFRM_USER=m @@ -614,16 +743,18 @@ CONFIG_NET_FOU=m CONFIG_NET_FOU_IP_TUNNELS=y CONFIG_INET_AH=m CONFIG_INET_ESP=m +# CONFIG_INET_ESP_OFFLOAD is not set CONFIG_INET_IPCOMP=m CONFIG_INET_XFRM_TUNNEL=m CONFIG_INET_TUNNEL=m CONFIG_INET_XFRM_MODE_TRANSPORT=m CONFIG_INET_XFRM_MODE_TUNNEL=m CONFIG_INET_XFRM_MODE_BEET=m -CONFIG_INET_LRO=m CONFIG_INET_DIAG=m CONFIG_INET_TCP_DIAG=m CONFIG_INET_UDP_DIAG=m +# CONFIG_INET_RAW_DIAG is not set +# CONFIG_INET_DIAG_DESTROY is not set CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BIC=m CONFIG_TCP_CONG_CUBIC=m @@ -632,6 +763,7 @@ CONFIG_TCP_CONG_HTCP=m CONFIG_TCP_CONG_HSTCP=m CONFIG_TCP_CONG_HYBLA=m CONFIG_TCP_CONG_VEGAS=m +# CONFIG_TCP_CONG_NV is not set CONFIG_TCP_CONG_SCALABLE=m CONFIG_TCP_CONG_LP=m CONFIG_TCP_CONG_VENO=m @@ -639,6 +771,7 @@ CONFIG_TCP_CONG_YEAH=m CONFIG_TCP_CONG_ILLINOIS=m CONFIG_TCP_CONG_DCTCP=m CONFIG_TCP_CONG_CDG=m +# CONFIG_TCP_CONG_BBR is not set CONFIG_DEFAULT_RENO=y CONFIG_DEFAULT_TCP_CONG="reno" CONFIG_TCP_MD5SIG=y @@ -648,6 +781,7 @@ CONFIG_IPV6_ROUTE_INFO=y CONFIG_IPV6_OPTIMISTIC_DAD=y CONFIG_INET6_AH=m CONFIG_INET6_ESP=m +# CONFIG_INET6_ESP_OFFLOAD is not set CONFIG_INET6_IPCOMP=m CONFIG_IPV6_MIP6=m CONFIG_IPV6_ILA=m @@ -663,17 +797,20 @@ CONFIG_IPV6_SIT_6RD=y CONFIG_IPV6_NDISC_NODETYPE=y CONFIG_IPV6_TUNNEL=m CONFIG_IPV6_GRE=m +CONFIG_IPV6_FOU=m +CONFIG_IPV6_FOU_TUNNEL=m CONFIG_IPV6_MULTIPLE_TABLES=y CONFIG_IPV6_SUBTREES=y CONFIG_IPV6_MROUTE=y CONFIG_IPV6_MROUTE_MULTIPLE_TABLES=y CONFIG_IPV6_PIMSM_V2=y -CONFIG_NETLABEL=y +# CONFIG_IPV6_SEG6_LWTUNNEL is not set +# CONFIG_IPV6_SEG6_HMAC is not set +# CONFIG_NETLABEL is not set CONFIG_NETWORK_SECMARK=y CONFIG_NET_PTP_CLASSIFY=y CONFIG_NETWORK_PHY_TIMESTAMPING=y CONFIG_NETFILTER=y -# CONFIG_NETFILTER_DEBUG is not set CONFIG_NETFILTER_ADVANCED=y CONFIG_BRIDGE_NETFILTER=m @@ -687,6 +824,7 @@ CONFIG_NETFILTER_NETLINK_QUEUE=m CONFIG_NETFILTER_NETLINK_LOG=m CONFIG_NF_CONNTRACK=m CONFIG_NF_LOG_COMMON=m +# CONFIG_NF_LOG_NETDEV is not set CONFIG_NF_CONNTRACK_MARK=y CONFIG_NF_CONNTRACK_SECMARK=y CONFIG_NF_CONNTRACK_ZONES=y @@ -695,10 +833,10 @@ CONFIG_NF_CONNTRACK_EVENTS=y CONFIG_NF_CONNTRACK_TIMEOUT=y CONFIG_NF_CONNTRACK_TIMESTAMP=y CONFIG_NF_CONNTRACK_LABELS=y -CONFIG_NF_CT_PROTO_DCCP=m +CONFIG_NF_CT_PROTO_DCCP=y CONFIG_NF_CT_PROTO_GRE=m -CONFIG_NF_CT_PROTO_SCTP=m -CONFIG_NF_CT_PROTO_UDPLITE=m +CONFIG_NF_CT_PROTO_SCTP=y +CONFIG_NF_CT_PROTO_UDPLITE=y CONFIG_NF_CONNTRACK_AMANDA=m CONFIG_NF_CONNTRACK_FTP=m CONFIG_NF_CONNTRACK_H323=m @@ -716,9 +854,9 @@ CONFIG_NF_CT_NETLINK_HELPER=m CONFIG_NETFILTER_NETLINK_GLUE_CT=y CONFIG_NF_NAT=m CONFIG_NF_NAT_NEEDED=y -CONFIG_NF_NAT_PROTO_DCCP=m -CONFIG_NF_NAT_PROTO_UDPLITE=m -CONFIG_NF_NAT_PROTO_SCTP=m +CONFIG_NF_NAT_PROTO_DCCP=y +CONFIG_NF_NAT_PROTO_UDPLITE=y +CONFIG_NF_NAT_PROTO_SCTP=y CONFIG_NF_NAT_AMANDA=m CONFIG_NF_NAT_FTP=m CONFIG_NF_NAT_IRC=m @@ -731,19 +869,31 @@ CONFIG_NF_TABLES_INET=m CONFIG_NF_TABLES_NETDEV=m CONFIG_NFT_EXTHDR=m CONFIG_NFT_META=m +# CONFIG_NFT_RT is not set +# CONFIG_NFT_NUMGEN is not set CONFIG_NFT_CT=m -CONFIG_NFT_RBTREE=m -CONFIG_NFT_HASH=m +# CONFIG_NFT_SET_RBTREE is not set +# CONFIG_NFT_SET_HASH is not set +# CONFIG_NFT_SET_BITMAP is not set CONFIG_NFT_COUNTER=m CONFIG_NFT_LOG=m CONFIG_NFT_LIMIT=m CONFIG_NFT_MASQ=m CONFIG_NFT_REDIR=m CONFIG_NFT_NAT=m +# CONFIG_NFT_OBJREF is not set CONFIG_NFT_QUEUE=m +# CONFIG_NFT_QUOTA is not set CONFIG_NFT_REJECT=m CONFIG_NFT_REJECT_INET=m CONFIG_NFT_COMPAT=m +CONFIG_NFT_HASH=m +CONFIG_NFT_FIB=m +CONFIG_NFT_FIB_INET=m +# CONFIG_NF_DUP_NETDEV is not set +# CONFIG_NFT_DUP_NETDEV is not set +# CONFIG_NFT_FWD_NETDEV is not set +CONFIG_NFT_FIB_NETDEV=m CONFIG_NETFILTER_XTABLES=m # @@ -842,6 +992,7 @@ CONFIG_IP_SET_HASH_IPMARK=m CONFIG_IP_SET_HASH_IPPORT=m CONFIG_IP_SET_HASH_IPPORTIP=m CONFIG_IP_SET_HASH_IPPORTNET=m +# CONFIG_IP_SET_HASH_IPMAC is not set CONFIG_IP_SET_HASH_MAC=m CONFIG_IP_SET_HASH_NETPORTNET=m CONFIG_IP_SET_HASH_NET=m @@ -897,11 +1048,12 @@ CONFIG_IP_VS_PE_SIP=m # CONFIG_NF_DEFRAG_IPV4=m CONFIG_NF_CONNTRACK_IPV4=m -CONFIG_NF_CONNTRACK_PROC_COMPAT=y +CONFIG_NF_SOCKET_IPV4=m CONFIG_NF_TABLES_IPV4=m CONFIG_NFT_CHAIN_ROUTE_IPV4=m CONFIG_NFT_REJECT_IPV4=m CONFIG_NFT_DUP_IPV4=m +CONFIG_NFT_FIB_IPV4=m CONFIG_NF_TABLES_ARP=m CONFIG_NF_DUP_IPV4=m CONFIG_NF_LOG_ARP=m @@ -943,18 +1095,20 @@ CONFIG_IP_NF_ARP_MANGLE=m # CONFIG_NF_DEFRAG_IPV6=m CONFIG_NF_CONNTRACK_IPV6=m +CONFIG_NF_SOCKET_IPV6=m CONFIG_NF_TABLES_IPV6=m CONFIG_NFT_CHAIN_ROUTE_IPV6=m +CONFIG_NFT_CHAIN_NAT_IPV6=m +CONFIG_NFT_MASQ_IPV6=m +CONFIG_NFT_REDIR_IPV6=m CONFIG_NFT_REJECT_IPV6=m CONFIG_NFT_DUP_IPV6=m +CONFIG_NFT_FIB_IPV6=m CONFIG_NF_DUP_IPV6=m CONFIG_NF_REJECT_IPV6=m CONFIG_NF_LOG_IPV6=m CONFIG_NF_NAT_IPV6=m -CONFIG_NFT_CHAIN_NAT_IPV6=m CONFIG_NF_NAT_MASQUERADE_IPV6=m -CONFIG_NFT_MASQ_IPV6=m -CONFIG_NFT_REDIR_IPV6=m CONFIG_IP6_NF_IPTABLES=m CONFIG_IP6_NF_MATCH_AH=m CONFIG_IP6_NF_MATCH_EUI64=m @@ -1027,6 +1181,7 @@ CONFIG_SCTP_DEFAULT_COOKIE_HMAC_MD5=y # CONFIG_SCTP_DEFAULT_COOKIE_HMAC_NONE is not set CONFIG_SCTP_COOKIE_HMAC_MD5=y CONFIG_SCTP_COOKIE_HMAC_SHA1=y +CONFIG_INET_SCTP_DIAG=m CONFIG_RDS=m CONFIG_RDS_TCP=m # CONFIG_RDS_DEBUG is not set @@ -1052,9 +1207,10 @@ CONFIG_BRIDGE_IGMP_SNOOPING=y # CONFIG_BRIDGE_VLAN_FILTERING is not set CONFIG_HAVE_NET_DSA=y CONFIG_NET_DSA=y -CONFIG_NET_DSA_HWMON=y CONFIG_NET_DSA_TAG_DSA=y CONFIG_NET_DSA_TAG_EDSA=y +CONFIG_NET_DSA_TAG_LAN9303=y +CONFIG_NET_DSA_TAG_MTK=y CONFIG_VLAN_8021Q=m CONFIG_VLAN_8021Q_GVRP=y CONFIG_VLAN_8021Q_MVRP=y @@ -1072,6 +1228,7 @@ CONFIG_X25=m CONFIG_LAPB=m CONFIG_PHONET=m CONFIG_6LOWPAN=m +# CONFIG_6LOWPAN_DEBUGFS is not set CONFIG_6LOWPAN_NHC=m CONFIG_6LOWPAN_NHC_DEST=m CONFIG_6LOWPAN_NHC_FRAGMENT=m @@ -1080,6 +1237,12 @@ CONFIG_6LOWPAN_NHC_IPV6=m CONFIG_6LOWPAN_NHC_MOBILITY=m CONFIG_6LOWPAN_NHC_ROUTING=m CONFIG_6LOWPAN_NHC_UDP=m +# CONFIG_6LOWPAN_GHC_EXT_HDR_HOP is not set +# CONFIG_6LOWPAN_GHC_UDP is not set +# CONFIG_6LOWPAN_GHC_ICMPV6 is not set +# CONFIG_6LOWPAN_GHC_EXT_HDR_DEST is not set +# CONFIG_6LOWPAN_GHC_EXT_HDR_FRAG is not set +# CONFIG_6LOWPAN_GHC_EXT_HDR_ROUTE is not set CONFIG_IEEE802154=m CONFIG_IEEE802154_NL802154_EXPERIMENTAL=y CONFIG_IEEE802154_SOCKET=m @@ -1115,6 +1278,7 @@ CONFIG_NET_SCH_HHF=m CONFIG_NET_SCH_PIE=m CONFIG_NET_SCH_INGRESS=m CONFIG_NET_SCH_PLUG=m +# CONFIG_NET_SCH_DEFAULT is not set # # Classification @@ -1133,6 +1297,7 @@ CONFIG_NET_CLS_FLOW=m CONFIG_NET_CLS_CGROUP=m CONFIG_NET_CLS_BPF=m CONFIG_NET_CLS_FLOWER=m +# CONFIG_NET_CLS_MATCHALL is not set CONFIG_NET_EMATCH=y CONFIG_NET_EMATCH_STACK=32 CONFIG_NET_EMATCH_CMP=m @@ -1147,6 +1312,7 @@ CONFIG_NET_ACT_POLICE=m CONFIG_NET_ACT_GACT=m CONFIG_GACT_PROB=y CONFIG_NET_ACT_MIRRED=m +# CONFIG_NET_ACT_SAMPLE is not set CONFIG_NET_ACT_IPT=m CONFIG_NET_ACT_NAT=m CONFIG_NET_ACT_PEDIT=m @@ -1156,38 +1322,46 @@ CONFIG_NET_ACT_CSUM=m CONFIG_NET_ACT_VLAN=m CONFIG_NET_ACT_BPF=m CONFIG_NET_ACT_CONNMARK=m +# CONFIG_NET_ACT_SKBMOD is not set +# CONFIG_NET_ACT_IFE is not set +# CONFIG_NET_ACT_TUNNEL_KEY is not set CONFIG_NET_CLS_IND=y CONFIG_NET_SCH_FIFO=y CONFIG_DCB=y CONFIG_DNS_RESOLVER=y CONFIG_BATMAN_ADV=m +# CONFIG_BATMAN_ADV_BATMAN_V is not set CONFIG_BATMAN_ADV_BLA=y CONFIG_BATMAN_ADV_DAT=y CONFIG_BATMAN_ADV_NC=y CONFIG_BATMAN_ADV_MCAST=y +CONFIG_BATMAN_ADV_DEBUGFS=y # CONFIG_BATMAN_ADV_DEBUG is not set CONFIG_OPENVSWITCH=m CONFIG_OPENVSWITCH_GRE=m CONFIG_OPENVSWITCH_VXLAN=m CONFIG_OPENVSWITCH_GENEVE=m CONFIG_VSOCKETS=m +# CONFIG_VIRTIO_VSOCKETS is not set CONFIG_NETLINK_DIAG=m CONFIG_MPLS=y CONFIG_NET_MPLS_GSO=m CONFIG_MPLS_ROUTING=m CONFIG_MPLS_IPTUNNEL=m +CONFIG_NET_NSH=m CONFIG_HSR=m CONFIG_NET_SWITCHDEV=y CONFIG_NET_L3_MASTER_DEV=y +# CONFIG_NET_NCSI is not set CONFIG_RPS=y CONFIG_RFS_ACCEL=y CONFIG_XPS=y -CONFIG_HWBM=y CONFIG_CGROUP_NET_PRIO=y CONFIG_CGROUP_NET_CLASSID=y CONFIG_NET_RX_BUSY_POLL=y CONFIG_BQL=y CONFIG_BPF_JIT=y +# CONFIG_BPF_STREAM_PARSER is not set CONFIG_NET_FLOW_LIMIT=y # @@ -1204,12 +1378,22 @@ CONFIG_CAN_GW=m # CAN Device Drivers # CONFIG_CAN_VCAN=m +CONFIG_CAN_VXCAN=m CONFIG_CAN_SLCAN=m CONFIG_CAN_DEV=m CONFIG_CAN_CALC_BITTIMING=y CONFIG_CAN_LEDS=y CONFIG_CAN_GRCAN=m CONFIG_CAN_XILINXCAN=m +CONFIG_CAN_C_CAN=m +CONFIG_CAN_C_CAN_PLATFORM=m +CONFIG_CAN_C_CAN_PCI=m +CONFIG_CAN_CC770=m +CONFIG_CAN_CC770_ISA=m +CONFIG_CAN_CC770_PLATFORM=m +# CONFIG_CAN_IFI_CANFD is not set +CONFIG_CAN_M_CAN=m +CONFIG_CAN_PEAK_PCIEFD=m CONFIG_CAN_SJA1000=m CONFIG_CAN_SJA1000_ISA=m CONFIG_CAN_SJA1000_PLATFORM=m @@ -1218,17 +1402,12 @@ CONFIG_CAN_PEAK_PCI=m CONFIG_CAN_PEAK_PCIEC=y CONFIG_CAN_KVASER_PCI=m CONFIG_CAN_PLX_PCI=m -CONFIG_CAN_C_CAN=m -CONFIG_CAN_C_CAN_PLATFORM=m -CONFIG_CAN_C_CAN_PCI=m -CONFIG_CAN_M_CAN=m -CONFIG_CAN_CC770=m -CONFIG_CAN_CC770_ISA=m -CONFIG_CAN_CC770_PLATFORM=m +CONFIG_CAN_SOFTING=m # # CAN SPI interfaces # +CONFIG_CAN_HI311X=m CONFIG_CAN_MCP251X=m # @@ -1240,59 +1419,8 @@ CONFIG_CAN_GS_USB=m CONFIG_CAN_KVASER_USB=m CONFIG_CAN_PEAK_USB=m CONFIG_CAN_8DEV_USB=m -CONFIG_CAN_SOFTING=m +CONFIG_CAN_MCBA_USB=m # CONFIG_CAN_DEBUG_DEVICES is not set -CONFIG_IRDA=m - -# -# IrDA protocols -# -CONFIG_IRLAN=m -CONFIG_IRNET=m -CONFIG_IRCOMM=m -CONFIG_IRDA_ULTRA=y - -# -# IrDA options -# -CONFIG_IRDA_CACHE_LAST_LSAP=y -CONFIG_IRDA_FAST_RR=y -# CONFIG_IRDA_DEBUG is not set - -# -# Infrared-port device drivers -# - -# -# SIR device drivers -# -CONFIG_IRTTY_SIR=m - -# -# Dongle support -# -CONFIG_DONGLE=y -CONFIG_ESI_DONGLE=m -CONFIG_ACTISYS_DONGLE=m -CONFIG_TEKRAM_DONGLE=m -CONFIG_TOIM3232_DONGLE=m -CONFIG_LITELINK_DONGLE=m -CONFIG_MA600_DONGLE=m -CONFIG_GIRBIL_DONGLE=m -CONFIG_MCP2120_DONGLE=m -CONFIG_OLD_BELKIN_DONGLE=m -CONFIG_ACT200L_DONGLE=m -CONFIG_KINGSUN_DONGLE=m -CONFIG_KSDAZZLE_DONGLE=m -CONFIG_KS959_DONGLE=m - -# -# FIR device drivers -# -CONFIG_USB_IRDA=m -CONFIG_SIGMATEL_FIR=m -CONFIG_VLSI_FIR=m -CONFIG_MCS_FIR=m CONFIG_BT=m CONFIG_BT_BREDR=y CONFIG_BT_RFCOMM=m @@ -1304,6 +1432,7 @@ CONFIG_BT_HIDP=m CONFIG_BT_HS=y CONFIG_BT_LE=y CONFIG_BT_6LOWPAN=m +# CONFIG_BT_LEDS is not set # CONFIG_BT_SELFTEST is not set # CONFIG_BT_DEBUGFS is not set @@ -1322,11 +1451,11 @@ CONFIG_BT_HCIUART=m CONFIG_BT_HCIUART_H4=y CONFIG_BT_HCIUART_BCSP=y CONFIG_BT_HCIUART_ATH3K=y -CONFIG_BT_HCIUART_LL=y CONFIG_BT_HCIUART_3WIRE=y CONFIG_BT_HCIUART_INTEL=y -CONFIG_BT_HCIUART_BCM=y CONFIG_BT_HCIUART_QCA=y +# CONFIG_BT_HCIUART_AG6XX is not set +# CONFIG_BT_HCIUART_MRVL is not set CONFIG_BT_HCIBCM203X=m CONFIG_BT_HCIBPA10X=m CONFIG_BT_HCIBFUSB=m @@ -1335,8 +1464,12 @@ CONFIG_BT_MRVL=m CONFIG_BT_MRVL_SDIO=m CONFIG_BT_ATH3K=m CONFIG_AF_RXRPC=m +# CONFIG_AF_RXRPC_IPV6 is not set +# CONFIG_AF_RXRPC_INJECT_LOSS is not set # CONFIG_AF_RXRPC_DEBUG is not set -CONFIG_RXKAD=m +# CONFIG_RXKAD is not set +# CONFIG_AF_KCM is not set +# CONFIG_STREAM_PARSER is not set CONFIG_FIB_RULES=y CONFIG_WIRELESS=y CONFIG_WIRELESS_EXT=y @@ -1347,7 +1480,6 @@ CONFIG_WEXT_PRIV=y CONFIG_CFG80211=m # CONFIG_NL80211_TESTMODE is not set # CONFIG_CFG80211_DEVELOPER_WARNINGS is not set -# CONFIG_CFG80211_REG_DEBUG is not set CONFIG_CFG80211_CERTIFICATION_ONUS=y CONFIG_CFG80211_REG_CELLULAR_HINTS=y CONFIG_CFG80211_REG_RELAX_NO_IR=y @@ -1380,10 +1512,10 @@ CONFIG_WIMAX_DEBUG_LEVEL=8 CONFIG_RFKILL=m CONFIG_RFKILL_LEDS=y CONFIG_RFKILL_INPUT=y -CONFIG_RFKILL_REGULATOR=m CONFIG_RFKILL_GPIO=m CONFIG_NET_9P=m CONFIG_NET_9P_VIRTIO=m +CONFIG_NET_9P_XEN=m # CONFIG_NET_9P_DEBUG is not set # CONFIG_CAIF is not set CONFIG_CEPH_LIB=m @@ -1400,7 +1532,6 @@ CONFIG_NFC_SHDLC=y # # Near Field Communication (NFC) devices # -CONFIG_NFC_PN533=m CONFIG_NFC_TRF7970A=m CONFIG_NFC_SIM=m CONFIG_NFC_PORT100=m @@ -1408,6 +1539,8 @@ CONFIG_NFC_FDP=m CONFIG_NFC_FDP_I2C=m CONFIG_NFC_PN544=m CONFIG_NFC_PN544_I2C=m +# CONFIG_NFC_PN533_USB is not set +# CONFIG_NFC_PN533_I2C is not set CONFIG_NFC_MICROREAD=m CONFIG_NFC_MICROREAD_I2C=m CONFIG_NFC_MRVL=m @@ -1424,16 +1557,21 @@ CONFIG_NFC_NXP_NCI=m CONFIG_NFC_NXP_NCI_I2C=m CONFIG_NFC_S3FWRN5=m CONFIG_NFC_S3FWRN5_I2C=m +# CONFIG_NFC_ST95HF is not set +# CONFIG_PSAMPLE is not set +# CONFIG_NET_IFE is not set CONFIG_LWTUNNEL=y +CONFIG_LWTUNNEL_BPF=y CONFIG_DST_CACHE=y -CONFIG_HAVE_BPF_JIT=y +CONFIG_GRO_CELLS=y +# CONFIG_NET_DEVLINK is not set +CONFIG_MAY_USE_DEVLINK=y CONFIG_HAVE_EBPF_JIT=y # # Device Drivers # CONFIG_ARM_AMBA=y -# CONFIG_TEGRA_AHB is not set # # Generic Driver Options @@ -1453,43 +1591,52 @@ CONFIG_ALLOW_DEV_COREDUMP=y CONFIG_DEV_COREDUMP=y # CONFIG_DEBUG_DRIVER is not set # CONFIG_DEBUG_DEVRES is not set -# CONFIG_SYS_HYPERVISOR is not set +# CONFIG_DEBUG_TEST_DRIVER_REMOVE is not set +# CONFIG_TEST_ASYNC_DRIVER_PROBE is not set +CONFIG_SYS_HYPERVISOR=y # CONFIG_GENERIC_CPU_DEVICES is not set CONFIG_GENERIC_CPU_AUTOPROBE=y CONFIG_REGMAP=y CONFIG_REGMAP_I2C=y -CONFIG_REGMAP_SPI=m +CONFIG_REGMAP_SPI=y CONFIG_REGMAP_MMIO=y -CONFIG_REGMAP_IRQ=y CONFIG_DMA_SHARED_BUFFER=y -# CONFIG_FENCE_TRACE is not set +# CONFIG_DMA_FENCE_TRACE is not set CONFIG_DMA_CMA=y # # Default contiguous memory area size: # -CONFIG_CMA_SIZE_MBYTES=16 +CONFIG_CMA_SIZE_MBYTES=256 CONFIG_CMA_SIZE_SEL_MBYTES=y # CONFIG_CMA_SIZE_SEL_PERCENTAGE is not set # CONFIG_CMA_SIZE_SEL_MIN is not set # CONFIG_CMA_SIZE_SEL_MAX is not set CONFIG_CMA_ALIGNMENT=8 +CONFIG_GENERIC_ARCH_TOPOLOGY=y # # Bus devices # # CONFIG_ARM_CCI400_PMU is not set -# CONFIG_ARM_CCI500_PMU is not set +# CONFIG_ARM_CCI5xx_PMU is not set # CONFIG_ARM_CCN is not set +# CONFIG_BRCMSTB_GISB_ARB is not set +# CONFIG_SIMPLE_PM_BUS is not set CONFIG_VEXPRESS_CONFIG=y -CONFIG_CONNECTOR=m +# CONFIG_CONNECTOR is not set CONFIG_MTD=y # CONFIG_MTD_TESTS is not set # CONFIG_MTD_REDBOOT_PARTS is not set CONFIG_MTD_CMDLINE_PARTS=y +# CONFIG_MTD_AFS_PARTS is not set CONFIG_MTD_OF_PARTS=y # CONFIG_MTD_AR7_PARTS is not set +# +# Partition parsers +# + # # User Modules And Translation Layers # @@ -1537,6 +1684,7 @@ CONFIG_MTD_CFI_I2=y # CONFIG_MTD_PMC551 is not set # CONFIG_MTD_DATAFLASH is not set CONFIG_MTD_M25P80=y +# CONFIG_MTD_MCHP23K256 is not set # CONFIG_MTD_SST25L is not set # CONFIG_MTD_SLRAM is not set # CONFIG_MTD_PHRAM is not set @@ -1556,16 +1704,15 @@ CONFIG_MTD_NAND=y # CONFIG_MTD_NAND_DENALI_DT is not set # CONFIG_MTD_NAND_GPIO is not set # CONFIG_MTD_NAND_OMAP_BCH_BUILD is not set -CONFIG_MTD_NAND_IDS=y # CONFIG_MTD_NAND_RICOH is not set # CONFIG_MTD_NAND_DISKONCHIP is not set # CONFIG_MTD_NAND_DOCG4 is not set # CONFIG_MTD_NAND_CAFE is not set -CONFIG_MTD_NAND_PXA3xx=y +# CONFIG_MTD_NAND_PXA3xx is not set +CONFIG_MTD_NAND_MARVELL=m # CONFIG_MTD_NAND_NANDSIM is not set # CONFIG_MTD_NAND_BRCMNAND is not set # CONFIG_MTD_NAND_PLATFORM is not set -# CONFIG_MTD_NAND_HISI504 is not set # CONFIG_MTD_ONENAND is not set # @@ -1573,6 +1720,7 @@ CONFIG_MTD_NAND_PXA3xx=y # # CONFIG_MTD_LPDDR is not set CONFIG_MTD_SPI_NOR=y +# CONFIG_MTD_MT81xx_NOR is not set CONFIG_MTD_SPI_NOR_USE_4K_SECTORS=y CONFIG_MTD_UBI=y CONFIG_MTD_UBI_WL_THRESHOLD=4096 @@ -1585,6 +1733,7 @@ CONFIG_OF=y # CONFIG_OF_UNITTEST is not set CONFIG_OF_FLATTREE=y CONFIG_OF_EARLY_FLATTREE=y +CONFIG_OF_DYNAMIC=y CONFIG_OF_ADDRESS=y CONFIG_OF_ADDRESS_PCI=y CONFIG_OF_IRQ=y @@ -1592,9 +1741,9 @@ CONFIG_OF_NET=y CONFIG_OF_MDIO=y CONFIG_OF_PCI=y CONFIG_OF_PCI_IRQ=y -CONFIG_OF_MTD=y CONFIG_OF_RESERVED_MEM=y # CONFIG_OF_OVERLAY is not set +CONFIG_OF_NUMA=y # CONFIG_PARPORT is not set CONFIG_PNP=y CONFIG_PNP_DEBUG_MESSAGES=y @@ -1607,29 +1756,32 @@ CONFIG_BLK_DEV=y # CONFIG_BLK_DEV_NULL_BLK is not set # CONFIG_BLK_DEV_PCIESSD_MTIP32XX is not set CONFIG_ZRAM=m -CONFIG_ZRAM_LZ4_COMPRESS=y -# CONFIG_BLK_CPQ_CISS_DA is not set +# CONFIG_ZRAM_WRITEBACK is not set # CONFIG_BLK_DEV_DAC960 is not set # CONFIG_BLK_DEV_UMEM is not set # CONFIG_BLK_DEV_COW_COMMON is not set CONFIG_BLK_DEV_LOOP=y CONFIG_BLK_DEV_LOOP_MIN_COUNT=8 -CONFIG_BLK_DEV_CRYPTOLOOP=m -CONFIG_BLK_DEV_DRBD=m -# CONFIG_DRBD_FAULT_INJECTION is not set -CONFIG_BLK_DEV_NBD=m +# CONFIG_BLK_DEV_CRYPTOLOOP is not set +# CONFIG_BLK_DEV_DRBD is not set +# CONFIG_BLK_DEV_NBD is not set # CONFIG_BLK_DEV_SKD is not set -CONFIG_BLK_DEV_OSD=m # CONFIG_BLK_DEV_SX8 is not set CONFIG_BLK_DEV_RAM=y CONFIG_BLK_DEV_RAM_COUNT=1 CONFIG_BLK_DEV_RAM_SIZE=48000 # CONFIG_CDROM_PKTCDVD is not set CONFIG_ATA_OVER_ETH=m +CONFIG_XEN_BLKDEV_FRONTEND=m +CONFIG_XEN_BLKDEV_BACKEND=m CONFIG_VIRTIO_BLK=y +# CONFIG_VIRTIO_BLK_SCSI is not set # CONFIG_BLK_DEV_RBD is not set # CONFIG_BLK_DEV_RSXX is not set +CONFIG_NVME_CORE=y CONFIG_BLK_DEV_NVME=y +# CONFIG_NVME_FC is not set +# CONFIG_NVME_TARGET is not set # # Misc devices @@ -1647,22 +1799,16 @@ CONFIG_BLK_DEV_NVME=y # CONFIG_ISL29003 is not set # CONFIG_ISL29020 is not set # CONFIG_SENSORS_TSL2550 is not set -# CONFIG_SENSORS_BH1780 is not set # CONFIG_SENSORS_BH1770 is not set # CONFIG_SENSORS_APDS990X is not set # CONFIG_HMC6352 is not set # CONFIG_DS1682 is not set # CONFIG_TI_DAC7512 is not set -CONFIG_BMP085=m -CONFIG_BMP085_I2C=m -CONFIG_BMP085_SPI=m # CONFIG_USB_SWITCH_FSA9480 is not set # CONFIG_LATTICE_ECP3_CONFIG is not set -CONFIG_SRAM=y +# CONFIG_SRAM is not set CONFIG_VEXPRESS_SYSCFG=y -CONFIG_MVEBU_A8K_DEBUGFS=y -CONFIG_MVEBU_SOC_INFO=y -CONFIG_MVEBU_A8K_SAR=y +CONFIG_PCI_ENDPOINT_TEST=m # CONFIG_C2PORT is not set # @@ -1674,6 +1820,7 @@ CONFIG_EEPROM_AT24=y # CONFIG_EEPROM_MAX6875 is not set CONFIG_EEPROM_93CX6=m # CONFIG_EEPROM_93XX46 is not set +# CONFIG_EEPROM_IDT_89HPESX is not set # CONFIG_CB710_CORE is not set # @@ -1695,6 +1842,10 @@ CONFIG_EEPROM_93CX6=m # SCIF Bus Driver # +# +# VOP Bus Driver +# + # # Intel MIC Host Driver # @@ -1710,11 +1861,15 @@ CONFIG_EEPROM_93CX6=m # # Intel MIC Coprocessor State Management (COSM) Drivers # + +# +# VOP Driver +# # CONFIG_GENWQE is not set # CONFIG_ECHO is not set # CONFIG_CXL_BASE is not set -# CONFIG_CXL_KERNEL_API is not set -# CONFIG_CXL_EEH is not set +# CONFIG_CXL_AFU_DRIVER_OPS is not set +# CONFIG_CXL_LIB is not set # # SCSI device support @@ -1733,10 +1888,9 @@ CONFIG_SCSI_DMA=y CONFIG_BLK_DEV_SD=y # CONFIG_CHR_DEV_ST is not set # CONFIG_CHR_DEV_OSST is not set -CONFIG_BLK_DEV_SR=y -CONFIG_BLK_DEV_SR_VENDOR=y -CONFIG_CHR_DEV_SG=y -CONFIG_CHR_DEV_SCH=y +# CONFIG_BLK_DEV_SR is not set +# CONFIG_CHR_DEV_SG is not set +# CONFIG_CHR_DEV_SCH is not set # CONFIG_SCSI_CONSTANTS is not set # CONFIG_SCSI_LOGGING is not set # CONFIG_SCSI_SCAN_ASYNC is not set @@ -1768,6 +1922,7 @@ CONFIG_ISCSI_BOOT_SYSFS=m # CONFIG_SCSI_AIC7XXX is not set # CONFIG_SCSI_AIC79XX is not set # CONFIG_SCSI_AIC94XX is not set +# CONFIG_SCSI_HISI_SAS is not set CONFIG_SCSI_MVSAS=m # CONFIG_SCSI_MVSAS_DEBUG is not set CONFIG_SCSI_MVSAS_TASKLET=y @@ -1780,8 +1935,10 @@ CONFIG_SCSI_MVUMI=m # CONFIG_MEGARAID_SAS is not set # CONFIG_SCSI_MPT3SAS is not set # CONFIG_SCSI_MPT2SAS is not set +# CONFIG_SCSI_SMARTPQI is not set # CONFIG_SCSI_UFSHCD is not set # CONFIG_SCSI_HPTIOP is not set +CONFIG_XEN_SCSI_FRONTEND=m # CONFIG_SCSI_SNIC is not set # CONFIG_SCSI_DMX3191D is not set # CONFIG_SCSI_FUTURE_DOMAIN is not set @@ -1840,6 +1997,7 @@ CONFIG_ATA_BMDMA=y # SATA SFF controllers with BMDMA # # CONFIG_ATA_PIIX is not set +# CONFIG_SATA_DWC is not set # CONFIG_SATA_MV is not set # CONFIG_SATA_NV is not set # CONFIG_SATA_PROMISE is not set @@ -1914,41 +2072,32 @@ CONFIG_MD_RAID10=y CONFIG_MD_RAID456=y # CONFIG_MD_MULTIPATH is not set # CONFIG_MD_FAULTY is not set -CONFIG_BCACHE=m -# CONFIG_BCACHE_DEBUG is not set -# CONFIG_BCACHE_CLOSURES_DEBUG is not set +# CONFIG_BCACHE is not set CONFIG_BLK_DEV_DM_BUILTIN=y -CONFIG_BLK_DEV_DM=m +CONFIG_BLK_DEV_DM=y # CONFIG_DM_MQ_DEFAULT is not set # CONFIG_DM_DEBUG is not set -CONFIG_DM_BUFIO=m -CONFIG_DM_BIO_PRISON=m -CONFIG_DM_PERSISTENT_DATA=m -# CONFIG_DM_DEBUG_BLOCK_STACK_TRACING is not set -CONFIG_DM_CRYPT=m -CONFIG_DM_SNAPSHOT=m -CONFIG_DM_THIN_PROVISIONING=m +CONFIG_DM_BUFIO=y +# CONFIG_DM_DEBUG_BLOCK_MANAGER_LOCKING is not set +CONFIG_DM_BIO_PRISON=y +CONFIG_DM_PERSISTENT_DATA=y +CONFIG_DM_CRYPT=y +# CONFIG_DM_SNAPSHOT is not set +CONFIG_DM_THIN_PROVISIONING=y # CONFIG_DM_CACHE is not set # CONFIG_DM_ERA is not set -CONFIG_DM_MIRROR=m -CONFIG_DM_LOG_USERSPACE=m -CONFIG_DM_RAID=m -CONFIG_DM_ZERO=m -CONFIG_DM_MULTIPATH=m -CONFIG_DM_MULTIPATH_QL=m -CONFIG_DM_MULTIPATH_ST=m -CONFIG_DM_DELAY=m -CONFIG_DM_UEVENT=y -CONFIG_DM_FLAKEY=m -CONFIG_DM_VERITY=m +# CONFIG_DM_MIRROR is not set +# CONFIG_DM_RAID is not set +# CONFIG_DM_ZERO is not set +# CONFIG_DM_MULTIPATH is not set +# CONFIG_DM_DELAY is not set +# CONFIG_DM_UEVENT is not set +# CONFIG_DM_FLAKEY is not set +# CONFIG_DM_VERITY is not set # CONFIG_DM_SWITCH is not set -CONFIG_DM_LOG_WRITES=m -CONFIG_TARGET_CORE=m -CONFIG_TCM_IBLOCK=m -CONFIG_TCM_FILEIO=m -CONFIG_TCM_PSCSI=m -CONFIG_LOOPBACK_TARGET=m -CONFIG_ISCSI_TARGET=m +# CONFIG_DM_LOG_WRITES is not set +CONFIG_DM_INTEGRITY=m +# CONFIG_TARGET_CORE is not set # CONFIG_FUSION is not set # @@ -1959,25 +2108,29 @@ CONFIG_ISCSI_TARGET=m CONFIG_NETDEVICES=y CONFIG_MII=y CONFIG_NET_CORE=y -CONFIG_BONDING=m -CONFIG_DUMMY=m -CONFIG_EQUALIZER=m +CONFIG_BONDING=y +CONFIG_DUMMY=y +# CONFIG_EQUALIZER is not set # CONFIG_NET_FC is not set CONFIG_IFB=m # CONFIG_NET_TEAM is not set CONFIG_MACVLAN=y CONFIG_MACVTAP=y CONFIG_IPVLAN=m +# CONFIG_IPVTAP is not set CONFIG_VXLAN=m CONFIG_GENEVE=m +# CONFIG_GTP is not set +# CONFIG_MACSEC is not set # CONFIG_NETCONSOLE is not set # CONFIG_NETPOLL is not set # CONFIG_NET_POLL_CONTROLLER is not set CONFIG_TUN=y +CONFIG_TAP=y # CONFIG_TUN_VNET_CROSS_LE is not set -CONFIG_VETH=m +CONFIG_VETH=y CONFIG_VIRTIO_NET=y -CONFIG_NLMON=m +# CONFIG_NLMON is not set CONFIG_NET_VRF=m # CONFIG_ARCNET is not set CONFIG_ATM_DRIVERS=y @@ -1995,19 +2148,22 @@ CONFIG_ATM_DRIVERS=y # # CAIF transport drivers # -CONFIG_VHOST_NET=y -# CONFIG_VHOST_SCSI is not set -CONFIG_VHOST_RING=y -CONFIG_VHOST=y -# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set # # Distributed Switch Architecture drivers # +# CONFIG_B53 is not set +# CONFIG_NET_DSA_BCM_SF2 is not set +CONFIG_NET_DSA_LOOP=m +CONFIG_NET_DSA_MT7530=m # CONFIG_NET_DSA_MV88E6060 is not set +# CONFIG_MICROCHIP_KSZ is not set CONFIG_NET_DSA_MV88E6XXX=y -# CONFIG_NET_DSA_BCM_SF2 is not set -CONFIG_DSA_MVMDIO=m +CONFIG_NET_DSA_MV88E6XXX_GLOBAL2=y +# CONFIG_NET_DSA_QCA8K is not set +CONFIG_NET_DSA_SMSC_LAN9303=m +CONFIG_NET_DSA_SMSC_LAN9303_I2C=m +CONFIG_NET_DSA_SMSC_LAN9303_MDIO=m CONFIG_ETHERNET=y CONFIG_MDIO=y CONFIG_NET_VENDOR_3COM=y @@ -2017,16 +2173,19 @@ CONFIG_NET_VENDOR_ADAPTEC=y # CONFIG_ADAPTEC_STARFIRE is not set CONFIG_NET_VENDOR_AGERE=y # CONFIG_ET131X is not set +CONFIG_NET_VENDOR_ALACRITECH=y +# CONFIG_SLICOSS is not set CONFIG_NET_VENDOR_ALTEON=y # CONFIG_ACENIC is not set # CONFIG_ALTERA_TSE is not set +CONFIG_NET_VENDOR_AMAZON=y CONFIG_NET_VENDOR_AMD=y # CONFIG_AMD8111_ETH is not set # CONFIG_PCNET32 is not set # CONFIG_AMD_XGBE is not set +# CONFIG_AMD_XGBE_HAVE_ECC is not set +CONFIG_NET_VENDOR_AQUANTIA=y CONFIG_NET_VENDOR_ARC=y -# CONFIG_ARC_EMAC is not set -# CONFIG_EMAC_ROCKCHIP is not set CONFIG_NET_VENDOR_ATHEROS=y # CONFIG_ATL2 is not set # CONFIG_ATL1 is not set @@ -2051,7 +2210,9 @@ CONFIG_NET_VENDOR_CAVIUM=y # CONFIG_THUNDER_NIC_PF is not set # CONFIG_THUNDER_NIC_VF is not set # CONFIG_THUNDER_NIC_BGX is not set +# CONFIG_THUNDER_NIC_RGX is not set # CONFIG_LIQUIDIO is not set +# CONFIG_LIQUIDIO_VF is not set CONFIG_NET_VENDOR_CHELSIO=y # CONFIG_CHELSIO_T1 is not set # CONFIG_CHELSIO_T3 is not set @@ -2074,12 +2235,15 @@ CONFIG_NET_VENDOR_EXAR=y # CONFIG_VXGE is not set CONFIG_NET_VENDOR_HISILICON=y # CONFIG_HIX5HD2_GMAC is not set +# CONFIG_HISI_FEMAC is not set # CONFIG_HIP04_ETH is not set # CONFIG_HNS is not set # CONFIG_HNS_DSAF is not set # CONFIG_HNS_ENET is not set +# CONFIG_HNS3 is not set CONFIG_NET_VENDOR_HP=y # CONFIG_HP100 is not set +CONFIG_NET_VENDOR_HUAWEI=y CONFIG_NET_VENDOR_INTEL=y # CONFIG_E100 is not set # CONFIG_E1000 is not set @@ -2099,21 +2263,17 @@ CONFIG_NET_VENDOR_I825XX=y # CONFIG_JME is not set CONFIG_NET_VENDOR_MARVELL=y CONFIG_MVMDIO=y -CONFIG_MVXMDIO=y -CONFIG_MVNETA_BM=y CONFIG_MVNETA=y -CONFIG_MVPP2=m -CONFIG_MVPP2X=y +# CONFIG_MVPP2 is not set # CONFIG_SKGE is not set CONFIG_SKY2=y # CONFIG_SKY2_DEBUG is not set -# CONFIG_MVNET_COMPLEX is not set -# CONFIG_MVPP3 is not set CONFIG_NET_VENDOR_MELLANOX=y # CONFIG_MLX4_EN is not set # CONFIG_MLX4_CORE is not set # CONFIG_MLX5_CORE is not set # CONFIG_MLXSW_CORE is not set +# CONFIG_MLXFW is not set CONFIG_NET_VENDOR_MICREL=y # CONFIG_KS8842 is not set # CONFIG_KS8851 is not set @@ -2128,6 +2288,8 @@ CONFIG_NET_VENDOR_MYRI=y CONFIG_NET_VENDOR_NATSEMI=y # CONFIG_NATSEMI is not set # CONFIG_NS83820 is not set +CONFIG_NET_VENDOR_NETRONOME=y +# CONFIG_NFP is not set CONFIG_NET_VENDOR_8390=y # CONFIG_NE2K_PCI is not set CONFIG_NET_VENDOR_NVIDIA=y @@ -2144,15 +2306,13 @@ CONFIG_NET_VENDOR_QLOGIC=y # CONFIG_NETXEN_NIC is not set # CONFIG_QED is not set CONFIG_NET_VENDOR_QUALCOMM=y -# CONFIG_QCA7000 is not set +# CONFIG_QCA7000_SPI is not set +# CONFIG_QCOM_EMAC is not set +# CONFIG_RMNET is not set CONFIG_NET_VENDOR_REALTEK=y -CONFIG_8139CP=m -CONFIG_8139TOO=m -CONFIG_8139TOO_PIO=y -CONFIG_8139TOO_TUNE_TWISTER=y -CONFIG_8139TOO_8129=y -CONFIG_8139_OLD_RX_RESET=y -CONFIG_R8169=m +# CONFIG_8139CP is not set +# CONFIG_8139TOO is not set +# CONFIG_R8169 is not set CONFIG_NET_VENDOR_RENESAS=y CONFIG_NET_VENDOR_RDC=y # CONFIG_R6040 is not set @@ -2166,7 +2326,9 @@ CONFIG_NET_VENDOR_SILAN=y CONFIG_NET_VENDOR_SIS=y # CONFIG_SIS900 is not set # CONFIG_SIS190 is not set +CONFIG_NET_VENDOR_SOLARFLARE=y # CONFIG_SFC is not set +# CONFIG_SFC_FALCON is not set CONFIG_NET_VENDOR_SMSC=y CONFIG_SMC91X=y # CONFIG_EPIC100 is not set @@ -2180,8 +2342,6 @@ CONFIG_NET_VENDOR_SUN=y # CONFIG_SUNGEM is not set # CONFIG_CASSINI is not set # CONFIG_NIU is not set -CONFIG_NET_VENDOR_SYNOPSYS=y -# CONFIG_SYNOPSYS_DWC_ETH_QOS is not set CONFIG_NET_VENDOR_TEHUTI=y # CONFIG_TEHUTI is not set CONFIG_NET_VENDOR_TI=y @@ -2193,49 +2353,61 @@ CONFIG_NET_VENDOR_VIA=y CONFIG_NET_VENDOR_WIZNET=y # CONFIG_WIZNET_W5100 is not set # CONFIG_WIZNET_W5300 is not set -CONFIG_FDDI=m -CONFIG_DEFXX=m -# CONFIG_DEFXX_MMIO is not set -CONFIG_SKFP=m +CONFIG_NET_VENDOR_SYNOPSYS=y +# CONFIG_DWC_XLGMAC is not set +# CONFIG_FDDI is not set # CONFIG_HIPPI is not set # CONFIG_NET_SB1000 is not set +CONFIG_MDIO_DEVICE=y +CONFIG_MDIO_BUS=y +CONFIG_MDIO_BCM_UNIMAC=m +CONFIG_MDIO_BITBANG=m +CONFIG_MDIO_BUS_MUX=m +CONFIG_MDIO_BUS_MUX_GPIO=m +CONFIG_MDIO_BUS_MUX_MMIOREG=m +CONFIG_MDIO_CAVIUM=m +CONFIG_MDIO_GPIO=m +# CONFIG_MDIO_HISI_FEMAC is not set +CONFIG_MDIO_OCTEON=m +# CONFIG_MDIO_THUNDER is not set CONFIG_PHYLIB=y +CONFIG_SWPHY=y +# CONFIG_LED_TRIGGER_PHY is not set # # MII PHY device drivers # +# CONFIG_AMD_PHY is not set # CONFIG_AQUANTIA_PHY is not set # CONFIG_AT803X_PHY is not set -# CONFIG_AMD_PHY is not set -CONFIG_MARVELL_PHY=y -# CONFIG_DAVICOM_PHY is not set -# CONFIG_QSEMI_PHY is not set -# CONFIG_LXT_PHY is not set -# CONFIG_CICADA_PHY is not set -# CONFIG_VITESSE_PHY is not set -# CONFIG_TERANETICS_PHY is not set -# CONFIG_SMSC_PHY is not set -CONFIG_BCM_NET_PHYLIB=m -# CONFIG_BROADCOM_PHY is not set CONFIG_BCM7XXX_PHY=m # CONFIG_BCM87XX_PHY is not set +CONFIG_BCM_NET_PHYLIB=m +# CONFIG_BROADCOM_PHY is not set +# CONFIG_CICADA_PHY is not set +# CONFIG_CORTINA_PHY is not set +# CONFIG_DAVICOM_PHY is not set +# CONFIG_DP83848_PHY is not set +# CONFIG_DP83867_PHY is not set +CONFIG_FIXED_PHY=y # CONFIG_ICPLUS_PHY is not set -# CONFIG_REALTEK_PHY is not set -# CONFIG_NATIONAL_PHY is not set -# CONFIG_STE10XP is not set +# CONFIG_INTEL_XWAY_PHY is not set # CONFIG_LSI_ET1011C_PHY is not set +# CONFIG_LXT_PHY is not set +CONFIG_MARVELL_PHY=y +CONFIG_MARVELL_10G_PHY=m # CONFIG_MICREL_PHY is not set -# CONFIG_DP83848_PHY is not set -# CONFIG_DP83867_PHY is not set CONFIG_MICROCHIP_PHY=m -CONFIG_FIXED_PHY=y -CONFIG_MDIO_BITBANG=m -CONFIG_MDIO_GPIO=m -CONFIG_MDIO_OCTEON=m -CONFIG_MDIO_BUS_MUX=m -CONFIG_MDIO_BUS_MUX_GPIO=m -CONFIG_MDIO_BUS_MUX_MMIOREG=m -CONFIG_MDIO_BCM_UNIMAC=m +# CONFIG_MICROSEMI_PHY is not set +# CONFIG_NATIONAL_PHY is not set +# CONFIG_QSEMI_PHY is not set +CONFIG_REALTEK_PHY=m +# CONFIG_ROCKCHIP_PHY is not set +# CONFIG_SMSC_PHY is not set +# CONFIG_STE10XP is not set +# CONFIG_TERANETICS_PHY is not set +# CONFIG_VITESSE_PHY is not set +# CONFIG_XILINX_GMII2RGMII is not set CONFIG_MICREL_KS8995MA=m CONFIG_PPP=m CONFIG_PPP_BSDCOMP=m @@ -2299,23 +2471,11 @@ CONFIG_USB_SIERRA_NET=m CONFIG_USB_VL600=m CONFIG_USB_NET_CH9200=m CONFIG_WLAN=y -CONFIG_LIBERTAS_THINFIRM=m -# CONFIG_LIBERTAS_THINFIRM_DEBUG is not set -CONFIG_LIBERTAS_THINFIRM_USB=m -CONFIG_ATMEL=m -CONFIG_PCI_ATMEL=m -CONFIG_AT76C50X_USB=m -# CONFIG_PRISM54 is not set -CONFIG_USB_ZD1201=m -CONFIG_USB_NET_RNDIS_WLAN=m +# CONFIG_WIRELESS_WDS is not set +CONFIG_WLAN_VENDOR_ADMTEK=y CONFIG_ADM8211=m -CONFIG_RTL8180=m -CONFIG_RTL8187=m -CONFIG_RTL8187_LEDS=y -CONFIG_MAC80211_HWSIM=m -CONFIG_MWL8K=m CONFIG_ATH_COMMON=m -CONFIG_ATH_CARDS=m +CONFIG_WLAN_VENDOR_ATH=y # CONFIG_ATH_DEBUG is not set CONFIG_ATH_REG_DYNAMIC_USER_REG_HINTS=y # CONFIG_ATH_REG_DYNAMIC_USER_CERT_TESTING is not set @@ -2338,6 +2498,7 @@ CONFIG_ATH9K_CHANNEL_CONTEXT=y CONFIG_ATH9K_PCOEM=y CONFIG_ATH9K_HTC=m # CONFIG_ATH9K_HTC_DEBUGFS is not set +# CONFIG_ATH9K_HWRNG is not set CONFIG_CARL9170=m CONFIG_CARL9170_LEDS=y CONFIG_CARL9170_WPC=y @@ -2350,14 +2511,23 @@ CONFIG_ATH6KL_REGDOMAIN=y CONFIG_AR5523=m CONFIG_WIL6210=m CONFIG_WIL6210_ISR_COR=y +CONFIG_WIL6210_DEBUGFS=y CONFIG_ATH10K=m CONFIG_ATH10K_PCI=m +# CONFIG_ATH10K_AHB is not set +CONFIG_ATH10K_SDIO=m +# CONFIG_ATH10K_USB is not set # CONFIG_ATH10K_DEBUG is not set # CONFIG_ATH10K_DEBUGFS is not set CONFIG_ATH10K_DFS_CERTIFIED=y CONFIG_WCN36XX=m # CONFIG_WCN36XX_DEBUGFS is not set CONFIG_RTL8188EU=m +CONFIG_WLAN_VENDOR_ATMEL=y +CONFIG_ATMEL=m +CONFIG_PCI_ATMEL=m +CONFIG_AT76C50X_USB=m +CONFIG_WLAN_VENDOR_BROADCOM=y CONFIG_B43=m CONFIG_B43_BCMA=y CONFIG_B43_SSB=y @@ -2397,7 +2567,8 @@ CONFIG_BRCMFMAC_USB=y CONFIG_BRCMFMAC_PCIE=y CONFIG_BRCM_TRACING=y # CONFIG_BRCMDBG is not set -# CONFIG_HOSTAP is not set +CONFIG_WLAN_VENDOR_CISCO=y +CONFIG_WLAN_VENDOR_INTEL=y CONFIG_IPW2100=m CONFIG_IPW2100_MONITOR=y # CONFIG_IPW2100_DEBUG is not set @@ -2409,35 +2580,51 @@ CONFIG_IPW2200_QOS=y # CONFIG_IPW2200_DEBUG is not set CONFIG_LIBIPW=m # CONFIG_LIBIPW_DEBUG is not set +CONFIG_IWLEGACY=m +CONFIG_IWL4965=m +CONFIG_IWL3945=m + +# +# iwl3945 / iwl4965 Debugging Options +# +# CONFIG_IWLEGACY_DEBUG is not set CONFIG_IWLWIFI=m CONFIG_IWLWIFI_LEDS=y CONFIG_IWLDVM=m CONFIG_IWLMVM=m CONFIG_IWLWIFI_OPMODE_MODULAR=y CONFIG_IWLWIFI_BCAST_FILTERING=y -CONFIG_IWLWIFI_UAPSD=y +# CONFIG_IWLWIFI_PCIE_RTPM is not set # # Debugging Options # # CONFIG_IWLWIFI_DEBUG is not set -CONFIG_IWLEGACY=m -CONFIG_IWL4965=m -CONFIG_IWL3945=m - -# -# iwl3945 / iwl4965 Debugging Options -# -# CONFIG_IWLEGACY_DEBUG is not set +CONFIG_WLAN_VENDOR_INTERSIL=y +# CONFIG_HOSTAP is not set +# CONFIG_HERMES is not set +# CONFIG_P54_COMMON is not set +# CONFIG_PRISM54 is not set +CONFIG_WLAN_VENDOR_MARVELL=y CONFIG_LIBERTAS=m CONFIG_LIBERTAS_USB=m CONFIG_LIBERTAS_SDIO=m CONFIG_LIBERTAS_SPI=m # CONFIG_LIBERTAS_DEBUG is not set CONFIG_LIBERTAS_MESH=y +CONFIG_LIBERTAS_THINFIRM=m +# CONFIG_LIBERTAS_THINFIRM_DEBUG is not set +CONFIG_LIBERTAS_THINFIRM_USB=m +CONFIG_MWIFIEX=m +CONFIG_MWIFIEX_SDIO=m +CONFIG_MWIFIEX_PCIE=m +CONFIG_MWIFIEX_USB=m +CONFIG_MWL8K=m CONFIG_RTL8812AU=m -# CONFIG_HERMES is not set -# CONFIG_P54_COMMON is not set +CONFIG_RTL8814AU=m +CONFIG_WLAN_VENDOR_MEDIATEK=y +CONFIG_MT7601U=m +CONFIG_WLAN_VENDOR_RALINK=y CONFIG_RT2X00=m CONFIG_RT2400PCI=m CONFIG_RT2500PCI=m @@ -2466,8 +2653,10 @@ CONFIG_RT2X00_LIB_FIRMWARE=y CONFIG_RT2X00_LIB_CRYPTO=y CONFIG_RT2X00_LIB_LEDS=y # CONFIG_RT2X00_DEBUG is not set -CONFIG_WL_MEDIATEK=y -CONFIG_MT7601U=m +CONFIG_WLAN_VENDOR_REALTEK=y +CONFIG_RTL8180=m +CONFIG_RTL8187=m +CONFIG_RTL8187_LEDS=y CONFIG_RTL_CARDS=m CONFIG_RTL8192CE=m CONFIG_RTL8192SE=m @@ -2487,9 +2676,18 @@ CONFIG_RTL8723_COMMON=m CONFIG_RTLBTCOEXIST=m CONFIG_RTL8XXXU=m # CONFIG_RTL8XXXU_UNTESTED is not set -CONFIG_WL_TI=y -CONFIG_WL1251=m -CONFIG_WL1251_SPI=m +CONFIG_WLAN_VENDOR_RSI=y +CONFIG_RSI_91X=m +# CONFIG_RSI_DEBUGFS is not set +CONFIG_RSI_SDIO=m +CONFIG_RSI_USB=m +CONFIG_WLAN_VENDOR_ST=y +CONFIG_CW1200=m +CONFIG_CW1200_WLAN_SDIO=m +CONFIG_CW1200_WLAN_SPI=m +CONFIG_WLAN_VENDOR_TI=y +CONFIG_WL1251=m +CONFIG_WL1251_SPI=m CONFIG_WL1251_SDIO=m CONFIG_WL12XX=m CONFIG_WL18XX=m @@ -2497,19 +2695,14 @@ CONFIG_WLCORE=m CONFIG_WLCORE_SPI=m CONFIG_WLCORE_SDIO=m CONFIG_WILINK_PLATFORM_DATA=y +CONFIG_WLAN_VENDOR_ZYDAS=y +CONFIG_USB_ZD1201=m CONFIG_ZD1211RW=m # CONFIG_ZD1211RW_DEBUG is not set -CONFIG_MWIFIEX=m -CONFIG_MWIFIEX_SDIO=m -CONFIG_MWIFIEX_PCIE=m -CONFIG_MWIFIEX_USB=m -CONFIG_CW1200=m -CONFIG_CW1200_WLAN_SDIO=m -CONFIG_CW1200_WLAN_SPI=m -CONFIG_RSI_91X=m -# CONFIG_RSI_DEBUGFS is not set -CONFIG_RSI_SDIO=m -CONFIG_RSI_USB=m +CONFIG_WLAN_VENDOR_QUANTENNA=y +# CONFIG_QTNFMAC_PEARL_PCIE is not set +CONFIG_MAC80211_HWSIM=m +CONFIG_USB_NET_RNDIS_WLAN=m # # WiMAX Wireless Broadband devices @@ -2517,40 +2710,24 @@ CONFIG_RSI_USB=m CONFIG_WIMAX_I2400M=m CONFIG_WIMAX_I2400M_USB=m CONFIG_WIMAX_I2400M_DEBUG_LEVEL=8 -CONFIG_WAN=y -CONFIG_HDLC=m -CONFIG_HDLC_RAW=m -CONFIG_HDLC_RAW_ETH=m -CONFIG_HDLC_CISCO=m -CONFIG_HDLC_FR=m -CONFIG_HDLC_PPP=m -CONFIG_HDLC_X25=m -CONFIG_PCI200SYN=m -CONFIG_WANXL=m -CONFIG_PC300TOO=m -CONFIG_FARSYNC=m -CONFIG_DSCC4=m -CONFIG_DSCC4_PCISYNC=y -CONFIG_DSCC4_PCI_RST=y -CONFIG_DLCI=m -CONFIG_DLCI_MAX=8 -CONFIG_LAPBETHER=m -CONFIG_X25_ASY=m +# CONFIG_WAN is not set # CONFIG_IEEE802154_DRIVERS is not set +CONFIG_XEN_NETDEV_FRONTEND=m +CONFIG_XEN_NETDEV_BACKEND=m # CONFIG_VMXNET3 is not set CONFIG_FUJITSU_ES=m # CONFIG_ISDN is not set CONFIG_NVM=y # CONFIG_NVM_DEBUG is not set -CONFIG_NVM_GENNVM=m CONFIG_NVM_RRPC=m +CONFIG_NVM_PBLK=m # # Input device support # CONFIG_INPUT=y CONFIG_INPUT_LEDS=y -CONFIG_INPUT_FF_MEMLESS=m +# CONFIG_INPUT_FF_MEMLESS is not set # CONFIG_INPUT_POLLDEV is not set # CONFIG_INPUT_SPARSEKMAP is not set # CONFIG_INPUT_MATRIXKMAP is not set @@ -2575,6 +2752,7 @@ CONFIG_INPUT_KEYBOARD=y CONFIG_KEYBOARD_ATKBD=y # CONFIG_KEYBOARD_QT1070 is not set # CONFIG_KEYBOARD_QT2160 is not set +CONFIG_KEYBOARD_DLINK_DIR685=m # CONFIG_KEYBOARD_LKKBD is not set CONFIG_KEYBOARD_GPIO=y # CONFIG_KEYBOARD_GPIO_POLLED is not set @@ -2592,20 +2770,24 @@ CONFIG_KEYBOARD_GPIO=y # CONFIG_KEYBOARD_STOWAWAY is not set # CONFIG_KEYBOARD_SUNKBD is not set # CONFIG_KEYBOARD_OMAP4 is not set +# CONFIG_KEYBOARD_TM2_TOUCHKEY is not set # CONFIG_KEYBOARD_XTKBD is not set # CONFIG_KEYBOARD_CAP11XX is not set # CONFIG_KEYBOARD_BCM is not set CONFIG_INPUT_MOUSE=y CONFIG_MOUSE_PS2=y CONFIG_MOUSE_PS2_ALPS=y +CONFIG_MOUSE_PS2_BYD=y CONFIG_MOUSE_PS2_LOGIPS2PP=y CONFIG_MOUSE_PS2_SYNAPTICS=y +CONFIG_MOUSE_PS2_SYNAPTICS_SMBUS=y CONFIG_MOUSE_PS2_CYPRESS=y CONFIG_MOUSE_PS2_TRACKPOINT=y # CONFIG_MOUSE_PS2_ELANTECH is not set # CONFIG_MOUSE_PS2_SENTELIC is not set # CONFIG_MOUSE_PS2_TOUCHKIT is not set CONFIG_MOUSE_PS2_FOCALTECH=y +CONFIG_MOUSE_PS2_SMBUS=y # CONFIG_MOUSE_SERIAL is not set # CONFIG_MOUSE_APPLETOUCH is not set # CONFIG_MOUSE_BCM5974 is not set @@ -2619,6 +2801,7 @@ CONFIG_MOUSE_PS2_FOCALTECH=y # CONFIG_INPUT_TABLET is not set # CONFIG_INPUT_TOUCHSCREEN is not set # CONFIG_INPUT_MISC is not set +# CONFIG_RMI4_CORE is not set # # Hardware I/O ports @@ -2633,6 +2816,7 @@ CONFIG_SERIO_LIBPS2=y # CONFIG_SERIO_PS2MULT is not set # CONFIG_SERIO_ARC_PS2 is not set # CONFIG_SERIO_APBPS2 is not set +# CONFIG_SERIO_GPIO_PS2 is not set # CONFIG_USERIO is not set # CONFIG_GAMEPORT is not set @@ -2647,7 +2831,6 @@ CONFIG_VT_CONSOLE_SLEEP=y CONFIG_HW_CONSOLE=y CONFIG_VT_HW_CONSOLE_BINDING=y CONFIG_UNIX98_PTYS=y -CONFIG_DEVPTS_MULTIPLE_INSTANCES=y CONFIG_LEGACY_PTYS=y CONFIG_LEGACY_PTY_COUNT=16 # CONFIG_SERIAL_NONSTANDARD is not set @@ -2655,7 +2838,6 @@ CONFIG_LEGACY_PTY_COUNT=16 # CONFIG_N_GSM is not set # CONFIG_TRACE_SINK is not set CONFIG_DEVMEM=y -CONFIG_DEVKMEM=y # # Serial drivers @@ -2664,18 +2846,20 @@ CONFIG_SERIAL_EARLYCON=y CONFIG_SERIAL_8250=y CONFIG_SERIAL_8250_DEPRECATED_OPTIONS=y CONFIG_SERIAL_8250_PNP=y +# CONFIG_SERIAL_8250_FINTEK is not set CONFIG_SERIAL_8250_CONSOLE=y CONFIG_SERIAL_8250_DMA=y CONFIG_SERIAL_8250_PCI=y +CONFIG_SERIAL_8250_EXAR=y CONFIG_SERIAL_8250_NR_UARTS=4 CONFIG_SERIAL_8250_RUNTIME_UARTS=4 # CONFIG_SERIAL_8250_EXTENDED is not set +CONFIG_SERIAL_8250_ASPEED_VUART=m CONFIG_SERIAL_8250_FSL=y CONFIG_SERIAL_8250_DW=y # CONFIG_SERIAL_8250_RT288X is not set -# CONFIG_SERIAL_8250_FINTEK is not set -# CONFIG_SERIAL_8250_INGENIC is not set -# CONFIG_SERIAL_8250_MID is not set +# CONFIG_SERIAL_8250_MOXA is not set +CONFIG_SERIAL_OF_PLATFORM=y # # Non-8250 serial port support @@ -2690,7 +2874,6 @@ CONFIG_SERIAL_AMBA_PL011_CONSOLE=y CONFIG_SERIAL_CORE=y CONFIG_SERIAL_CORE_CONSOLE=y # CONFIG_SERIAL_JSM is not set -CONFIG_SERIAL_OF_PLATFORM=y # CONFIG_SERIAL_SCCNXP is not set # CONFIG_SERIAL_SC16IS7XX is not set # CONFIG_SERIAL_ALTERA_JTAGUART is not set @@ -2704,8 +2887,12 @@ CONFIG_SERIAL_XILINX_PS_UART_CONSOLE=y # CONFIG_SERIAL_CONEXANT_DIGICOLOR is not set CONFIG_SERIAL_MVEBU_UART=y CONFIG_SERIAL_MVEBU_CONSOLE=y +# CONFIG_SERIAL_DEV_BUS is not set CONFIG_TTY_PRINTK=m CONFIG_HVC_DRIVER=y +CONFIG_HVC_IRQ=y +CONFIG_HVC_XEN=y +CONFIG_HVC_XEN_FRONTEND=y # CONFIG_HVC_DCC is not set CONFIG_VIRTIO_CONSOLE=y # CONFIG_IPMI_HANDLER is not set @@ -2713,6 +2900,7 @@ CONFIG_HW_RANDOM=y # CONFIG_HW_RANDOM_TIMERIOMEM is not set CONFIG_HW_RANDOM_OMAP=y # CONFIG_HW_RANDOM_VIRTIO is not set +CONFIG_HW_RANDOM_CAVIUM=y # CONFIG_R3964 is not set # CONFIG_APPLICOM is not set @@ -2740,10 +2928,14 @@ CONFIG_I2C_MUX=m # CONFIG_I2C_ARB_GPIO_CHALLENGE=m CONFIG_I2C_MUX_GPIO=m +CONFIG_I2C_MUX_GPMUX=m +CONFIG_I2C_MUX_LTC4306=m CONFIG_I2C_MUX_PCA9541=m CONFIG_I2C_MUX_PCA954x=m CONFIG_I2C_MUX_PINCTRL=m CONFIG_I2C_MUX_REG=m +CONFIG_I2C_DEMUX_PINCTRL=m +# CONFIG_I2C_MUX_MLXCPLD is not set CONFIG_I2C_HELPER_AUTO=y CONFIG_I2C_SMBUS=m CONFIG_I2C_ALGOBIT=y @@ -2783,6 +2975,7 @@ CONFIG_I2C_CADENCE=m CONFIG_I2C_CBUS_GPIO=m CONFIG_I2C_DESIGNWARE_CORE=m CONFIG_I2C_DESIGNWARE_PLATFORM=m +# CONFIG_I2C_DESIGNWARE_SLAVE is not set CONFIG_I2C_DESIGNWARE_PCI=m CONFIG_I2C_EMEV2=m CONFIG_I2C_GPIO=m @@ -2794,6 +2987,7 @@ CONFIG_I2C_PCA_PLATFORM=m # CONFIG_I2C_PXA_PCI is not set CONFIG_I2C_RK3X=m CONFIG_I2C_SIMTEC=m +# CONFIG_I2C_THUNDERX is not set CONFIG_I2C_XILINX=m # @@ -2823,8 +3017,10 @@ CONFIG_SPI_MASTER=y # # CONFIG_SPI_ALTERA is not set CONFIG_SPI_ARMADA_3700=y +# CONFIG_SPI_AXI_SPI_ENGINE is not set # CONFIG_SPI_BITBANG is not set # CONFIG_SPI_CADENCE is not set +# CONFIG_SPI_DESIGNWARE is not set # CONFIG_SPI_GPIO is not set # CONFIG_SPI_FSL_SPI is not set # CONFIG_SPI_OC_TINY is not set @@ -2834,25 +3030,22 @@ CONFIG_SPI_PL022=y # CONFIG_SPI_PXA2XX_PCI is not set # CONFIG_SPI_ROCKCHIP is not set # CONFIG_SPI_SC18IS602 is not set +# CONFIG_SPI_THUNDERX is not set # CONFIG_SPI_XCOMM is not set # CONFIG_SPI_XILINX is not set # CONFIG_SPI_ZYNQMP_GQSPI is not set -# CONFIG_SPI_DESIGNWARE is not set # # SPI Protocol Masters # # CONFIG_SPI_SPIDEV is not set +# CONFIG_SPI_LOOPBACK_TEST is not set # CONFIG_SPI_TLE62X0 is not set +# CONFIG_SPI_SLAVE is not set # CONFIG_SPMI is not set # CONFIG_HSI is not set - -# -# PPS support -# CONFIG_PPS=y # CONFIG_PPS_DEBUG is not set -# CONFIG_NTP_PPS is not set # # PPS clients support @@ -2880,23 +3073,19 @@ CONFIG_PINCONF=y CONFIG_GENERIC_PINCONF=y # CONFIG_DEBUG_PINCTRL is not set # CONFIG_PINCTRL_AMD is not set +CONFIG_PINCTRL_MCP23S08=m # CONFIG_PINCTRL_SINGLE is not set -# CONFIG_PINCTRL_BAYTRAIL is not set -# CONFIG_PINCTRL_CHERRYVIEW is not set -# CONFIG_PINCTRL_BROXTON is not set -# CONFIG_PINCTRL_SUNRISEPOINT is not set +# CONFIG_PINCTRL_SX150X is not set CONFIG_PINCTRL_MVEBU=y CONFIG_PINCTRL_ARMADA_AP806=y CONFIG_PINCTRL_ARMADA_CP110=y CONFIG_PINCTRL_ARMADA_37XX=y -CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y CONFIG_GPIOLIB=y -CONFIG_GPIO_DEVRES=y CONFIG_OF_GPIO=y CONFIG_GPIO_ACPI=y CONFIG_GPIOLIB_IRQCHIP=y # CONFIG_DEBUG_GPIO is not set -# CONFIG_GPIO_SYSFS is not set +CONFIG_GPIO_SYSFS=y CONFIG_GPIO_GENERIC=y # @@ -2906,15 +3095,16 @@ CONFIG_GPIO_GENERIC=y # CONFIG_GPIO_ALTERA is not set CONFIG_GPIO_AMDPT=m # CONFIG_GPIO_DWAPB is not set +# CONFIG_GPIO_EXAR is not set +# CONFIG_GPIO_FTGPIO010 is not set CONFIG_GPIO_GENERIC_PLATFORM=y # CONFIG_GPIO_GRGPIO is not set +# CONFIG_GPIO_MOCKUP is not set CONFIG_GPIO_MVEBU=y CONFIG_GPIO_PL061=y # CONFIG_GPIO_SYSCON is not set -# CONFIG_GPIO_VX855 is not set CONFIG_GPIO_XGENE=y # CONFIG_GPIO_XILINX is not set -# CONFIG_GPIO_ZX is not set # # I2C GPIO expanders @@ -2927,18 +3117,18 @@ CONFIG_GPIO_PCA953X=y # CONFIG_GPIO_PCA953X_IRQ is not set # CONFIG_GPIO_PCF857X is not set # CONFIG_GPIO_SX150X is not set +# CONFIG_GPIO_TPIC2810 is not set # # MFD GPIO expanders # -CONFIG_GPIO_UCB1400=m +# CONFIG_GPIO_LP87565 is not set # # PCI GPIO expanders # -# CONFIG_GPIO_AMD8111 is not set # CONFIG_GPIO_BT8XX is not set -# CONFIG_GPIO_ML_IOH is not set +# CONFIG_GPIO_PCI_IDIO_16 is not set # CONFIG_GPIO_RDC321X is not set # @@ -2947,16 +3137,25 @@ CONFIG_GPIO_UCB1400=m # CONFIG_GPIO_74X164 is not set # CONFIG_GPIO_MAX7301 is not set # CONFIG_GPIO_MC33880 is not set - -# -# SPI or I2C GPIO expanders -# -# CONFIG_GPIO_MCP23S08 is not set +# CONFIG_GPIO_PISOSR is not set +CONFIG_GPIO_XRA1403=m # # USB GPIO expanders # # CONFIG_W1 is not set +# CONFIG_POWER_AVS is not set +CONFIG_POWER_RESET=y +# CONFIG_POWER_RESET_BRCMSTB is not set +# CONFIG_POWER_RESET_GPIO is not set +# CONFIG_POWER_RESET_GPIO_RESTART is not set +# CONFIG_POWER_RESET_LTC2952 is not set +# CONFIG_POWER_RESET_RESTART is not set +CONFIG_POWER_RESET_VEXPRESS=y +CONFIG_POWER_RESET_XGENE=y +CONFIG_POWER_RESET_SYSCON=y +# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set +# CONFIG_SYSCON_REBOOT_MODE is not set CONFIG_POWER_SUPPLY=y # CONFIG_POWER_SUPPLY_DEBUG is not set # CONFIG_PDA_POWER is not set @@ -2965,6 +3164,7 @@ CONFIG_POWER_SUPPLY=y # CONFIG_BATTERY_DS2781 is not set # CONFIG_BATTERY_DS2782 is not set # CONFIG_BATTERY_SBS is not set +# CONFIG_CHARGER_SBS is not set # CONFIG_BATTERY_BQ27XXX is not set # CONFIG_BATTERY_MAX17040 is not set # CONFIG_BATTERY_MAX17042 is not set @@ -2973,24 +3173,16 @@ CONFIG_POWER_SUPPLY=y # CONFIG_CHARGER_LP8727 is not set # CONFIG_CHARGER_GPIO is not set # CONFIG_CHARGER_MANAGER is not set +# CONFIG_CHARGER_LTC3651 is not set +# CONFIG_CHARGER_DETECTOR_MAX14656 is not set # CONFIG_CHARGER_BQ2415X is not set # CONFIG_CHARGER_BQ24190 is not set -CONFIG_CHARGER_BQ24257=m +# CONFIG_CHARGER_BQ24257 is not set # CONFIG_CHARGER_BQ24735 is not set # CONFIG_CHARGER_BQ25890 is not set # CONFIG_CHARGER_SMB347 is not set # CONFIG_BATTERY_GAUGE_LTC2941 is not set # CONFIG_CHARGER_RT9455 is not set -CONFIG_POWER_RESET=y -# CONFIG_POWER_RESET_GPIO is not set -# CONFIG_POWER_RESET_GPIO_RESTART is not set -# CONFIG_POWER_RESET_LTC2952 is not set -# CONFIG_POWER_RESET_RESTART is not set -CONFIG_POWER_RESET_VEXPRESS=y -CONFIG_POWER_RESET_XGENE=y -CONFIG_POWER_RESET_SYSCON=y -# CONFIG_POWER_RESET_SYSCON_POWEROFF is not set -# CONFIG_POWER_AVS is not set CONFIG_HWMON=y CONFIG_HWMON_VID=m # CONFIG_HWMON_DEBUG_CHIP is not set @@ -3016,6 +3208,7 @@ CONFIG_SENSORS_ADT7470=m CONFIG_SENSORS_ADT7475=m CONFIG_SENSORS_ASC7621=m CONFIG_SENSORS_ARM_SCPI=m +CONFIG_SENSORS_ASPEED=m CONFIG_SENSORS_ATXP1=m CONFIG_SENSORS_DS620=m CONFIG_SENSORS_DS1621=m @@ -3034,6 +3227,7 @@ CONFIG_SENSORS_JC42=m CONFIG_SENSORS_POWR1220=m CONFIG_SENSORS_LINEAGE=m CONFIG_SENSORS_LTC2945=m +CONFIG_SENSORS_LTC2990=m CONFIG_SENSORS_LTC4151=m CONFIG_SENSORS_LTC4215=m CONFIG_SENSORS_LTC4222=m @@ -3045,13 +3239,14 @@ CONFIG_SENSORS_MAX16065=m CONFIG_SENSORS_MAX1619=m CONFIG_SENSORS_MAX1668=m CONFIG_SENSORS_MAX197=m +CONFIG_SENSORS_MAX31722=m CONFIG_SENSORS_MAX6639=m CONFIG_SENSORS_MAX6642=m CONFIG_SENSORS_MAX6650=m CONFIG_SENSORS_MAX6697=m CONFIG_SENSORS_MAX31790=m -CONFIG_SENSORS_HTU21=m CONFIG_SENSORS_MCP3021=m +CONFIG_SENSORS_TC654=m CONFIG_SENSORS_ADCXX=m CONFIG_SENSORS_LM63=m CONFIG_SENSORS_LM70=m @@ -3080,19 +3275,25 @@ CONFIG_SENSORS_PCF8591=m CONFIG_PMBUS=m CONFIG_SENSORS_PMBUS=m CONFIG_SENSORS_ADM1275=m +# CONFIG_SENSORS_IBM_CFFPS is not set +CONFIG_SENSORS_IR35221=m CONFIG_SENSORS_LM25066=m CONFIG_SENSORS_LTC2978=m # CONFIG_SENSORS_LTC2978_REGULATOR is not set +CONFIG_SENSORS_LTC3815=m CONFIG_SENSORS_MAX16064=m CONFIG_SENSORS_MAX20751=m CONFIG_SENSORS_MAX34440=m CONFIG_SENSORS_MAX8688=m CONFIG_SENSORS_TPS40422=m +# CONFIG_SENSORS_TPS53679 is not set CONFIG_SENSORS_UCD9000=m CONFIG_SENSORS_UCD9200=m CONFIG_SENSORS_ZL6100=m +CONFIG_SENSORS_PWM_FAN=m CONFIG_SENSORS_SHT15=m CONFIG_SENSORS_SHT21=m +CONFIG_SENSORS_SHT3x=m CONFIG_SENSORS_SHTC1=m CONFIG_SENSORS_SIS5595=m CONFIG_SENSORS_DME1737=m @@ -3103,6 +3304,7 @@ CONFIG_SENSORS_SMSC47M1=m CONFIG_SENSORS_SMSC47M192=m CONFIG_SENSORS_SMSC47B397=m # CONFIG_SENSORS_SCH56XX_COMMON is not set +CONFIG_SENSORS_STTS751=m CONFIG_SENSORS_SMM665=m CONFIG_SENSORS_ADC128D818=m CONFIG_SENSORS_ADS1015=m @@ -3111,10 +3313,12 @@ CONFIG_SENSORS_ADS7871=m CONFIG_SENSORS_AMC6821=m CONFIG_SENSORS_INA209=m CONFIG_SENSORS_INA2XX=m +CONFIG_SENSORS_INA3221=m CONFIG_SENSORS_TC74=m CONFIG_SENSORS_THMC50=m CONFIG_SENSORS_TMP102=m CONFIG_SENSORS_TMP103=m +CONFIG_SENSORS_TMP108=m CONFIG_SENSORS_TMP401=m CONFIG_SENSORS_TMP421=m CONFIG_SENSORS_VEXPRESS=m @@ -3131,12 +3335,14 @@ CONFIG_SENSORS_W83L785TS=m CONFIG_SENSORS_W83L786NG=m CONFIG_SENSORS_W83627HF=m CONFIG_SENSORS_W83627EHF=m +CONFIG_SENSORS_XGENE=m # # ACPI drivers # CONFIG_SENSORS_ACPI_POWER=m CONFIG_THERMAL=y +CONFIG_THERMAL_EMERGENCY_POWEROFF_DELAY_MS=0 CONFIG_THERMAL_HWMON=y CONFIG_THERMAL_OF=y # CONFIG_THERMAL_WRITABLE_TRIPS is not set @@ -3152,7 +3358,12 @@ CONFIG_THERMAL_GOV_STEP_WISE=y # CONFIG_CPU_THERMAL is not set # CONFIG_CLOCK_THERMAL is not set # CONFIG_THERMAL_EMULATION is not set +# CONFIG_QORIQ_THERMAL is not set CONFIG_ARMADA_THERMAL=y + +# +# ACPI INT340X thermal drivers +# # CONFIG_WATCHDOG is not set CONFIG_SSB_POSSIBLE=y @@ -3167,17 +3378,12 @@ CONFIG_SSB_PCIHOST=y CONFIG_SSB_B43_PCI_BRIDGE=y CONFIG_SSB_SDIOHOST_POSSIBLE=y CONFIG_SSB_SDIOHOST=y -# CONFIG_SSB_HOST_SOC is not set # CONFIG_SSB_SILENT is not set # CONFIG_SSB_DEBUG is not set CONFIG_SSB_DRIVER_PCICORE_POSSIBLE=y CONFIG_SSB_DRIVER_PCICORE=y # CONFIG_SSB_DRIVER_GPIO is not set CONFIG_BCMA_POSSIBLE=y - -# -# Broadcom specific AMBA -# CONFIG_BCMA=m CONFIG_BCMA_BLOCKIO=y CONFIG_BCMA_HOST_PCI_POSSIBLE=y @@ -3192,6 +3398,7 @@ CONFIG_BCMA_DRIVER_PCI=y # Multifunction device drivers # CONFIG_MFD_CORE=y +# CONFIG_MFD_ACT8945A is not set # CONFIG_MFD_AS3711 is not set # CONFIG_MFD_AS3722 is not set # CONFIG_PMIC_ADP5520 is not set @@ -3199,7 +3406,9 @@ CONFIG_MFD_CORE=y # CONFIG_MFD_ATMEL_FLEXCOM is not set # CONFIG_MFD_ATMEL_HLCDC is not set # CONFIG_MFD_BCM590XX is not set -# CONFIG_MFD_AXP20X is not set +# CONFIG_MFD_BD9571MWV is not set +# CONFIG_MFD_AXP20X_I2C is not set +# CONFIG_MFD_CROS_EC is not set # CONFIG_PMIC_DA903X is not set # CONFIG_MFD_DA9052_SPI is not set # CONFIG_MFD_DA9052_I2C is not set @@ -3215,13 +3424,13 @@ CONFIG_MFD_CORE=y # CONFIG_HTC_I2CPLD is not set # CONFIG_LPC_ICH is not set CONFIG_LPC_SCH=m -# CONFIG_INTEL_SOC_PMIC is not set # CONFIG_MFD_JANZ_CMODIO is not set # CONFIG_MFD_KEMPLD is not set # CONFIG_MFD_88PM800 is not set # CONFIG_MFD_88PM805 is not set # CONFIG_MFD_88PM860X is not set # CONFIG_MFD_MAX14577 is not set +# CONFIG_MFD_MAX77620 is not set # CONFIG_MFD_MAX77686 is not set # CONFIG_MFD_MAX77693 is not set # CONFIG_MFD_MAX77843 is not set @@ -3232,10 +3441,10 @@ CONFIG_LPC_SCH=m # CONFIG_MFD_MT6397 is not set # CONFIG_MFD_MENF21BMC is not set # CONFIG_EZX_PCAP is not set +# CONFIG_MFD_CPCAP is not set # CONFIG_MFD_VIPERBOARD is not set # CONFIG_MFD_RETU is not set # CONFIG_MFD_PCF50633 is not set -CONFIG_UCB1400_CORE=m # CONFIG_MFD_RDC321X is not set # CONFIG_MFD_RTSX_PCI is not set # CONFIG_MFD_RT5033 is not set @@ -3254,16 +3463,20 @@ CONFIG_MFD_SYSCON=y # CONFIG_MFD_TI_AM335X_TSCADC is not set # CONFIG_MFD_LP3943 is not set # CONFIG_MFD_LP8788 is not set +# CONFIG_MFD_TI_LMU is not set # CONFIG_MFD_PALMAS is not set # CONFIG_TPS6105X is not set # CONFIG_TPS65010 is not set # CONFIG_TPS6507X is not set +# CONFIG_MFD_TPS65086 is not set # CONFIG_MFD_TPS65090 is not set # CONFIG_MFD_TPS65217 is not set +# CONFIG_MFD_TPS68470 is not set +# CONFIG_MFD_TI_LP873X is not set +CONFIG_MFD_TI_LP87565=m # CONFIG_MFD_TPS65218 is not set # CONFIG_MFD_TPS6586X is not set # CONFIG_MFD_TPS65910 is not set -# CONFIG_MFD_TPS65912 is not set # CONFIG_MFD_TPS65912_I2C is not set # CONFIG_MFD_TPS65912_SPI is not set # CONFIG_MFD_TPS80031 is not set @@ -3300,7 +3513,9 @@ CONFIG_REGULATOR_GPIO=y # CONFIG_REGULATOR_LP3972 is not set # CONFIG_REGULATOR_LP872X is not set # CONFIG_REGULATOR_LP8755 is not set +# CONFIG_REGULATOR_LP87565 is not set # CONFIG_REGULATOR_LTC3589 is not set +# CONFIG_REGULATOR_LTC3676 is not set # CONFIG_REGULATOR_MAX1586 is not set # CONFIG_REGULATOR_MAX8649 is not set # CONFIG_REGULATOR_MAX8660 is not set @@ -3308,564 +3523,33 @@ CONFIG_REGULATOR_GPIO=y # CONFIG_REGULATOR_MAX8973 is not set # CONFIG_REGULATOR_MT6311 is not set # CONFIG_REGULATOR_PFUZE100 is not set +# CONFIG_REGULATOR_PV88060 is not set +# CONFIG_REGULATOR_PV88080 is not set +# CONFIG_REGULATOR_PV88090 is not set +CONFIG_REGULATOR_PWM=m # CONFIG_REGULATOR_TPS51632 is not set # CONFIG_REGULATOR_TPS62360 is not set # CONFIG_REGULATOR_TPS65023 is not set # CONFIG_REGULATOR_TPS6507X is not set +# CONFIG_REGULATOR_TPS65132 is not set # CONFIG_REGULATOR_TPS6524X is not set +# CONFIG_REGULATOR_VCTRL is not set # CONFIG_REGULATOR_VEXPRESS is not set -CONFIG_REGULATOR_ARMADA3700=y -CONFIG_MEDIA_SUPPORT=m - -# -# Multimedia core support -# -CONFIG_MEDIA_CAMERA_SUPPORT=y -CONFIG_MEDIA_ANALOG_TV_SUPPORT=y -CONFIG_MEDIA_DIGITAL_TV_SUPPORT=y -CONFIG_MEDIA_RADIO_SUPPORT=y -CONFIG_MEDIA_SDR_SUPPORT=y -CONFIG_MEDIA_RC_SUPPORT=y -CONFIG_MEDIA_CONTROLLER=y -CONFIG_VIDEO_DEV=m -CONFIG_VIDEO_V4L2_SUBDEV_API=y -CONFIG_VIDEO_V4L2=m -# CONFIG_VIDEO_ADV_DEBUG is not set -# CONFIG_VIDEO_FIXED_MINOR_RANGES is not set -CONFIG_VIDEO_TUNER=m -CONFIG_VIDEOBUF_GEN=m -CONFIG_VIDEOBUF_VMALLOC=m -CONFIG_VIDEOBUF_DVB=m -CONFIG_VIDEOBUF2_CORE=m -CONFIG_VIDEOBUF2_MEMOPS=m -CONFIG_VIDEOBUF2_DMA_CONTIG=m -CONFIG_VIDEOBUF2_VMALLOC=m -CONFIG_VIDEOBUF2_DMA_SG=m -CONFIG_DVB_CORE=m -CONFIG_DVB_NET=y -CONFIG_TTPCI_EEPROM=m -CONFIG_DVB_MAX_ADAPTERS=8 -CONFIG_DVB_DYNAMIC_MINORS=y - -# -# Media drivers -# -CONFIG_RC_CORE=m -CONFIG_RC_MAP=m +CONFIG_RC_CORE=y +CONFIG_RC_MAP=y CONFIG_RC_DECODERS=y -CONFIG_LIRC=m -CONFIG_IR_LIRC_CODEC=m -CONFIG_IR_NEC_DECODER=m -CONFIG_IR_RC5_DECODER=m -CONFIG_IR_RC6_DECODER=m -CONFIG_IR_JVC_DECODER=m -CONFIG_IR_SONY_DECODER=m -CONFIG_IR_SANYO_DECODER=m -CONFIG_IR_SHARP_DECODER=m -CONFIG_IR_MCE_KBD_DECODER=m -CONFIG_IR_XMP_DECODER=m -CONFIG_RC_DEVICES=y -CONFIG_RC_ATI_REMOTE=m -CONFIG_IR_ENE=m -CONFIG_IR_HIX5HD2=m -CONFIG_IR_IMON=m -CONFIG_IR_MCEUSB=m -CONFIG_IR_ITE_CIR=m -CONFIG_IR_FINTEK=m -CONFIG_IR_NUVOTON=m -CONFIG_IR_REDRAT3=m -CONFIG_IR_STREAMZAP=m -CONFIG_IR_IGORPLUGUSB=m -CONFIG_IR_IGUANA=m -CONFIG_IR_TTUSBIR=m -CONFIG_RC_LOOPBACK=m -CONFIG_IR_GPIO_CIR=m -CONFIG_MEDIA_USB_SUPPORT=y - -# -# Webcam devices -# -CONFIG_USB_VIDEO_CLASS=m -CONFIG_USB_VIDEO_CLASS_INPUT_EVDEV=y -CONFIG_USB_GSPCA=m -CONFIG_USB_M5602=m -CONFIG_USB_STV06XX=m -CONFIG_USB_GL860=m -CONFIG_USB_GSPCA_BENQ=m -CONFIG_USB_GSPCA_CONEX=m -CONFIG_USB_GSPCA_CPIA1=m -CONFIG_USB_GSPCA_DTCS033=m -CONFIG_USB_GSPCA_ETOMS=m -CONFIG_USB_GSPCA_FINEPIX=m -CONFIG_USB_GSPCA_JEILINJ=m -CONFIG_USB_GSPCA_JL2005BCD=m -CONFIG_USB_GSPCA_KINECT=m -CONFIG_USB_GSPCA_KONICA=m -CONFIG_USB_GSPCA_MARS=m -CONFIG_USB_GSPCA_MR97310A=m -CONFIG_USB_GSPCA_NW80X=m -CONFIG_USB_GSPCA_OV519=m -CONFIG_USB_GSPCA_OV534=m -CONFIG_USB_GSPCA_OV534_9=m -CONFIG_USB_GSPCA_PAC207=m -CONFIG_USB_GSPCA_PAC7302=m -CONFIG_USB_GSPCA_PAC7311=m -CONFIG_USB_GSPCA_SE401=m -CONFIG_USB_GSPCA_SN9C2028=m -CONFIG_USB_GSPCA_SN9C20X=m -CONFIG_USB_GSPCA_SONIXB=m -CONFIG_USB_GSPCA_SONIXJ=m -CONFIG_USB_GSPCA_SPCA500=m -CONFIG_USB_GSPCA_SPCA501=m -CONFIG_USB_GSPCA_SPCA505=m -CONFIG_USB_GSPCA_SPCA506=m -CONFIG_USB_GSPCA_SPCA508=m -CONFIG_USB_GSPCA_SPCA561=m -CONFIG_USB_GSPCA_SPCA1528=m -CONFIG_USB_GSPCA_SQ905=m -CONFIG_USB_GSPCA_SQ905C=m -CONFIG_USB_GSPCA_SQ930X=m -CONFIG_USB_GSPCA_STK014=m -CONFIG_USB_GSPCA_STK1135=m -CONFIG_USB_GSPCA_STV0680=m -CONFIG_USB_GSPCA_SUNPLUS=m -CONFIG_USB_GSPCA_T613=m -CONFIG_USB_GSPCA_TOPRO=m -CONFIG_USB_GSPCA_TOUPTEK=m -CONFIG_USB_GSPCA_TV8532=m -CONFIG_USB_GSPCA_VC032X=m -CONFIG_USB_GSPCA_VICAM=m -CONFIG_USB_GSPCA_XIRLINK_CIT=m -CONFIG_USB_GSPCA_ZC3XX=m -CONFIG_USB_PWC=m -# CONFIG_USB_PWC_DEBUG is not set -CONFIG_USB_PWC_INPUT_EVDEV=y -CONFIG_VIDEO_CPIA2=m -CONFIG_USB_ZR364XX=m -CONFIG_USB_STKWEBCAM=m -CONFIG_USB_S2255=m -# CONFIG_VIDEO_USBTV is not set - -# -# Analog TV USB devices -# -CONFIG_VIDEO_PVRUSB2=m -CONFIG_VIDEO_PVRUSB2_SYSFS=y -CONFIG_VIDEO_PVRUSB2_DVB=y -# CONFIG_VIDEO_PVRUSB2_DEBUGIFC is not set -CONFIG_VIDEO_HDPVR=m -CONFIG_VIDEO_USBVISION=m -CONFIG_VIDEO_STK1160_COMMON=m -CONFIG_VIDEO_STK1160_AC97=y -CONFIG_VIDEO_STK1160=m -# CONFIG_VIDEO_GO7007 is not set - -# -# Analog/digital TV USB devices -# -CONFIG_VIDEO_AU0828=m -CONFIG_VIDEO_AU0828_V4L2=y -CONFIG_VIDEO_AU0828_RC=y -CONFIG_VIDEO_CX231XX=m -CONFIG_VIDEO_CX231XX_RC=y -# CONFIG_VIDEO_CX231XX_ALSA is not set -CONFIG_VIDEO_CX231XX_DVB=m -CONFIG_VIDEO_TM6000=m -# CONFIG_VIDEO_TM6000_ALSA is not set -CONFIG_VIDEO_TM6000_DVB=m - -# -# Digital TV USB devices -# -CONFIG_DVB_USB=m -# CONFIG_DVB_USB_DEBUG is not set -CONFIG_DVB_USB_A800=m -CONFIG_DVB_USB_DIBUSB_MB=m -CONFIG_DVB_USB_DIBUSB_MB_FAULTY=y -CONFIG_DVB_USB_DIBUSB_MC=m -CONFIG_DVB_USB_DIB0700=m -CONFIG_DVB_USB_UMT_010=m -CONFIG_DVB_USB_CXUSB=m -CONFIG_DVB_USB_M920X=m -CONFIG_DVB_USB_DIGITV=m -CONFIG_DVB_USB_VP7045=m -CONFIG_DVB_USB_VP702X=m -CONFIG_DVB_USB_GP8PSK=m -CONFIG_DVB_USB_NOVA_T_USB2=m -CONFIG_DVB_USB_TTUSB2=m -CONFIG_DVB_USB_DTT200U=m -CONFIG_DVB_USB_OPERA1=m -CONFIG_DVB_USB_AF9005=m -CONFIG_DVB_USB_AF9005_REMOTE=m -CONFIG_DVB_USB_PCTV452E=m -CONFIG_DVB_USB_DW2102=m -CONFIG_DVB_USB_CINERGY_T2=m -CONFIG_DVB_USB_DTV5100=m -CONFIG_DVB_USB_FRIIO=m -CONFIG_DVB_USB_AZ6027=m -CONFIG_DVB_USB_TECHNISAT_USB2=m -CONFIG_DVB_USB_V2=m -CONFIG_DVB_USB_AF9015=m -CONFIG_DVB_USB_AF9035=m -CONFIG_DVB_USB_ANYSEE=m -CONFIG_DVB_USB_AU6610=m -CONFIG_DVB_USB_AZ6007=m -CONFIG_DVB_USB_CE6230=m -CONFIG_DVB_USB_EC168=m -CONFIG_DVB_USB_GL861=m -CONFIG_DVB_USB_LME2510=m -CONFIG_DVB_USB_MXL111SF=m -CONFIG_DVB_USB_RTL28XXU=m -CONFIG_DVB_USB_DVBSKY=m -CONFIG_DVB_TTUSB_BUDGET=m -CONFIG_DVB_TTUSB_DEC=m -CONFIG_SMS_USB_DRV=m -CONFIG_DVB_B2C2_FLEXCOP_USB=m -CONFIG_DVB_B2C2_FLEXCOP_USB_DEBUG=y -CONFIG_DVB_AS102=m - -# -# Webcam, TV (analog/digital) USB devices -# -CONFIG_VIDEO_EM28XX=m -CONFIG_VIDEO_EM28XX_V4L2=m -CONFIG_VIDEO_EM28XX_ALSA=m -CONFIG_VIDEO_EM28XX_DVB=m -CONFIG_VIDEO_EM28XX_RC=m - -# -# Software defined radio USB devices -# -CONFIG_USB_AIRSPY=m -CONFIG_USB_HACKRF=m -CONFIG_USB_MSI2500=m -CONFIG_MEDIA_PCI_SUPPORT=y - -# -# Media capture support -# -# CONFIG_VIDEO_SOLO6X10 is not set -# CONFIG_VIDEO_TW68 is not set - -# -# Media capture/analog TV support -# -# CONFIG_VIDEO_IVTV is not set -# CONFIG_VIDEO_HEXIUM_GEMINI is not set -# CONFIG_VIDEO_HEXIUM_ORION is not set -# CONFIG_VIDEO_MXB is not set -# CONFIG_VIDEO_DT3155 is not set - -# -# Media capture/analog/hybrid TV support -# -# CONFIG_VIDEO_CX18 is not set -# CONFIG_VIDEO_CX23885 is not set -# CONFIG_VIDEO_CX25821 is not set -# CONFIG_VIDEO_CX88 is not set -# CONFIG_VIDEO_BT848 is not set -# CONFIG_VIDEO_SAA7134 is not set -# CONFIG_VIDEO_SAA7164 is not set - -# -# Media digital TV PCI Adapters -# -# CONFIG_DVB_AV7110 is not set -# CONFIG_DVB_BUDGET_CORE is not set -# CONFIG_DVB_B2C2_FLEXCOP_PCI is not set -# CONFIG_DVB_PLUTO2 is not set -# CONFIG_DVB_DM1105 is not set -# CONFIG_DVB_PT1 is not set -# CONFIG_DVB_PT3 is not set -# CONFIG_MANTIS_CORE is not set -# CONFIG_DVB_NGENE is not set -# CONFIG_DVB_DDBRIDGE is not set -# CONFIG_DVB_SMIPCIE is not set -# CONFIG_DVB_NETUP_UNIDVB is not set -CONFIG_V4L_PLATFORM_DRIVERS=y -CONFIG_VIDEO_CAFE_CCIC=m -CONFIG_SOC_CAMERA=m -CONFIG_SOC_CAMERA_PLATFORM=m -# CONFIG_VIDEO_XILINX is not set -# CONFIG_V4L_MEM2MEM_DRIVERS is not set -# CONFIG_V4L_TEST_DRIVERS is not set -CONFIG_DVB_PLATFORM_DRIVERS=y - -# -# Supported MMC/SDIO adapters -# -# CONFIG_SMS_SDIO_DRV is not set -CONFIG_RADIO_ADAPTERS=y -CONFIG_RADIO_TEA575X=m -CONFIG_RADIO_SI470X=y -CONFIG_USB_SI470X=m -# CONFIG_I2C_SI470X is not set -CONFIG_RADIO_SI4713=m -CONFIG_USB_SI4713=m -# CONFIG_PLATFORM_SI4713 is not set -CONFIG_I2C_SI4713=m -CONFIG_USB_MR800=m -CONFIG_USB_DSBR=m -# CONFIG_RADIO_MAXIRADIO is not set -CONFIG_RADIO_SHARK=m -CONFIG_RADIO_SHARK2=m -CONFIG_USB_KEENE=m -CONFIG_USB_RAREMONO=m -CONFIG_USB_MA901=m -# CONFIG_RADIO_TEA5764 is not set -# CONFIG_RADIO_SAA7706H is not set -# CONFIG_RADIO_TEF6862 is not set -# CONFIG_RADIO_WL1273 is not set - -# -# Texas Instruments WL128x FM driver (ST based) -# -CONFIG_MEDIA_COMMON_OPTIONS=y - -# -# common driver options -# -CONFIG_VIDEO_CX2341X=m -CONFIG_VIDEO_TVEEPROM=m -CONFIG_CYPRESS_FIRMWARE=m -CONFIG_DVB_B2C2_FLEXCOP=m -CONFIG_DVB_B2C2_FLEXCOP_DEBUG=y -CONFIG_SMS_SIANO_MDTV=m -CONFIG_SMS_SIANO_RC=y - -# -# Media ancillary drivers (tuners, sensors, i2c, frontends) -# -CONFIG_MEDIA_SUBDRV_AUTOSELECT=y -CONFIG_MEDIA_ATTACH=y -CONFIG_VIDEO_IR_I2C=m - -# -# Audio decoders, processors and mixers -# -CONFIG_VIDEO_MSP3400=m -CONFIG_VIDEO_CS53L32A=m -CONFIG_VIDEO_WM8775=m - -# -# RDS decoders -# - -# -# Video decoders -# -CONFIG_VIDEO_SAA711X=m -CONFIG_VIDEO_TVP5150=m - -# -# Video and audio decoders -# -CONFIG_VIDEO_CX25840=m - -# -# Video encoders -# - -# -# Camera sensor devices -# -CONFIG_VIDEO_OV7670=m -CONFIG_VIDEO_MT9V011=m - -# -# Flash devices -# - -# -# Video improvement chips -# - -# -# Audio/Video compression chips -# - -# -# Miscellaneous helper chips -# - -# -# Sensors used on soc_camera driver -# - -# -# soc_camera sensor drivers -# -# CONFIG_SOC_CAMERA_IMX074 is not set -# CONFIG_SOC_CAMERA_MT9M001 is not set -# CONFIG_SOC_CAMERA_MT9M111 is not set -# CONFIG_SOC_CAMERA_MT9T031 is not set -# CONFIG_SOC_CAMERA_MT9T112 is not set -# CONFIG_SOC_CAMERA_MT9V022 is not set -# CONFIG_SOC_CAMERA_OV2640 is not set -# CONFIG_SOC_CAMERA_OV5642 is not set -# CONFIG_SOC_CAMERA_OV6650 is not set -# CONFIG_SOC_CAMERA_OV772X is not set -# CONFIG_SOC_CAMERA_OV9640 is not set -# CONFIG_SOC_CAMERA_OV9740 is not set -# CONFIG_SOC_CAMERA_RJ54N1 is not set -# CONFIG_SOC_CAMERA_TW9910 is not set -CONFIG_MEDIA_TUNER=m -CONFIG_MEDIA_TUNER_SIMPLE=m -CONFIG_MEDIA_TUNER_TDA8290=m -CONFIG_MEDIA_TUNER_TDA827X=m -CONFIG_MEDIA_TUNER_TDA18271=m -CONFIG_MEDIA_TUNER_TDA9887=m -CONFIG_MEDIA_TUNER_TEA5761=m -CONFIG_MEDIA_TUNER_TEA5767=m -CONFIG_MEDIA_TUNER_MSI001=m -CONFIG_MEDIA_TUNER_MT20XX=m -CONFIG_MEDIA_TUNER_MT2060=m -CONFIG_MEDIA_TUNER_MT2063=m -CONFIG_MEDIA_TUNER_MT2266=m -CONFIG_MEDIA_TUNER_QT1010=m -CONFIG_MEDIA_TUNER_XC2028=m -CONFIG_MEDIA_TUNER_XC5000=m -CONFIG_MEDIA_TUNER_XC4000=m -CONFIG_MEDIA_TUNER_MXL5005S=m -CONFIG_MEDIA_TUNER_MXL5007T=m -CONFIG_MEDIA_TUNER_MC44S803=m -CONFIG_MEDIA_TUNER_MAX2165=m -CONFIG_MEDIA_TUNER_TDA18218=m -CONFIG_MEDIA_TUNER_FC0011=m -CONFIG_MEDIA_TUNER_FC0012=m -CONFIG_MEDIA_TUNER_FC0013=m -CONFIG_MEDIA_TUNER_TDA18212=m -CONFIG_MEDIA_TUNER_E4000=m -CONFIG_MEDIA_TUNER_FC2580=m -CONFIG_MEDIA_TUNER_TUA9001=m -CONFIG_MEDIA_TUNER_SI2157=m -CONFIG_MEDIA_TUNER_IT913X=m -CONFIG_MEDIA_TUNER_R820T=m - -# -# Multistandard (satellite) frontends -# -CONFIG_DVB_STB0899=m -CONFIG_DVB_STB6100=m -CONFIG_DVB_STV090x=m -CONFIG_DVB_STV6110x=m -CONFIG_DVB_M88DS3103=m - -# -# Multistandard (cable + terrestrial) frontends -# -CONFIG_DVB_DRXK=m -CONFIG_DVB_TDA18271C2DD=m -CONFIG_DVB_SI2165=m - -# -# DVB-S (satellite) frontends -# -CONFIG_DVB_CX24123=m -CONFIG_DVB_MT312=m -CONFIG_DVB_ZL10039=m -CONFIG_DVB_S5H1420=m -CONFIG_DVB_STV0288=m -CONFIG_DVB_STB6000=m -CONFIG_DVB_STV0299=m -CONFIG_DVB_STV6110=m -CONFIG_DVB_STV0900=m -CONFIG_DVB_TDA8083=m -CONFIG_DVB_TDA10086=m -CONFIG_DVB_TUNER_ITD1000=m -CONFIG_DVB_TUNER_CX24113=m -CONFIG_DVB_TDA826X=m -CONFIG_DVB_CX24116=m -CONFIG_DVB_CX24120=m -CONFIG_DVB_SI21XX=m -CONFIG_DVB_TS2020=m -CONFIG_DVB_DS3000=m -CONFIG_DVB_TDA10071=m - -# -# DVB-T (terrestrial) frontends -# -CONFIG_DVB_CX22700=m -CONFIG_DVB_CX22702=m -CONFIG_DVB_DRXD=m -CONFIG_DVB_TDA1004X=m -CONFIG_DVB_NXT6000=m -CONFIG_DVB_MT352=m -CONFIG_DVB_ZL10353=m -CONFIG_DVB_DIB3000MB=m -CONFIG_DVB_DIB3000MC=m -CONFIG_DVB_DIB7000M=m -CONFIG_DVB_DIB7000P=m -CONFIG_DVB_TDA10048=m -CONFIG_DVB_AF9013=m -CONFIG_DVB_EC100=m -CONFIG_DVB_CXD2820R=m -CONFIG_DVB_RTL2830=m -CONFIG_DVB_RTL2832=m -CONFIG_DVB_RTL2832_SDR=m -CONFIG_DVB_SI2168=m -CONFIG_DVB_AS102_FE=m - -# -# DVB-C (cable) frontends -# -CONFIG_DVB_VES1820=m -CONFIG_DVB_TDA10023=m -CONFIG_DVB_STV0297=m - -# -# ATSC (North American/Korean Terrestrial/Cable DTV) frontends -# -CONFIG_DVB_NXT200X=m -CONFIG_DVB_BCM3510=m -CONFIG_DVB_LGDT330X=m -CONFIG_DVB_LGDT3305=m -CONFIG_DVB_LGDT3306A=m -CONFIG_DVB_LG2160=m -CONFIG_DVB_S5H1409=m -CONFIG_DVB_AU8522=m -CONFIG_DVB_AU8522_DTV=m -CONFIG_DVB_AU8522_V4L=m -CONFIG_DVB_S5H1411=m - -# -# ISDB-T (terrestrial) frontends -# -CONFIG_DVB_S921=m -CONFIG_DVB_DIB8000=m -CONFIG_DVB_MB86A20S=m - -# -# ISDB-S (satellite) & ISDB-T (terrestrial) frontends -# - -# -# Digital terrestrial only tuners/PLL -# -CONFIG_DVB_PLL=m -CONFIG_DVB_TUNER_DIB0070=m -CONFIG_DVB_TUNER_DIB0090=m - -# -# SEC control devices for DVB-S -# -CONFIG_DVB_DRX39XYJ=m -CONFIG_DVB_LNBP21=m -CONFIG_DVB_LNBP22=m -CONFIG_DVB_ISL6421=m -CONFIG_DVB_ISL6423=m -CONFIG_DVB_A8293=m -CONFIG_DVB_SP2=m -CONFIG_DVB_LGS8GXX=m -CONFIG_DVB_ATBM8830=m -CONFIG_DVB_IX2505V=m -CONFIG_DVB_M88RS2000=m -CONFIG_DVB_AF9033=m - -# -# Tools to develop new frontends -# -# CONFIG_DVB_DUMMY_FE is not set +# CONFIG_LIRC is not set +CONFIG_IR_NEC_DECODER=y +CONFIG_IR_RC5_DECODER=y +CONFIG_IR_RC6_DECODER=y +CONFIG_IR_JVC_DECODER=y +CONFIG_IR_SONY_DECODER=y +CONFIG_IR_SANYO_DECODER=y +CONFIG_IR_SHARP_DECODER=y +CONFIG_IR_MCE_KBD_DECODER=y +CONFIG_IR_XMP_DECODER=y +# CONFIG_RC_DEVICES is not set +# CONFIG_MEDIA_SUPPORT is not set # # Graphics support @@ -3874,12 +3558,18 @@ CONFIG_VGA_ARB=y CONFIG_VGA_ARB_MAX_GPUS=16 # CONFIG_DRM is not set +# +# ACP (Audio CoProcessor) Configuration +# +# CONFIG_DRM_LIB_RANDOM is not set + # # Frame buffer Devices # CONFIG_FB=y # CONFIG_FIRMWARE_EDID is not set CONFIG_FB_CMDLINE=y +CONFIG_FB_NOTIFY=y # CONFIG_FB_DDC is not set # CONFIG_FB_BOOT_VESA_SUPPORT is not set CONFIG_FB_CFB_FILLRECT=y @@ -3889,12 +3579,13 @@ CONFIG_FB_CFB_IMAGEBLIT=y CONFIG_FB_SYS_FILLRECT=m CONFIG_FB_SYS_COPYAREA=m CONFIG_FB_SYS_IMAGEBLIT=m +# CONFIG_FB_PROVIDE_GET_FB_UNMAPPED_AREA is not set # CONFIG_FB_FOREIGN_ENDIAN is not set CONFIG_FB_SYS_FOPS=m CONFIG_FB_DEFERRED_IO=y # CONFIG_FB_SVGALIB is not set # CONFIG_FB_MACMODES is not set -CONFIG_FB_BACKLIGHT=y +# CONFIG_FB_BACKLIGHT is not set CONFIG_FB_MODE_HELPERS=y # CONFIG_FB_TILEBLITTING is not set @@ -3907,7 +3598,7 @@ CONFIG_FB_ARMCLCD=y # CONFIG_FB_CYBER2000 is not set # CONFIG_FB_ASILIANT is not set # CONFIG_FB_IMSTT is not set -CONFIG_FB_UVESA=m +# CONFIG_FB_EFI is not set # CONFIG_FB_OPENCORES is not set # CONFIG_FB_S1D13XXX is not set # CONFIG_FB_NVIDIA is not set @@ -3933,6 +3624,7 @@ CONFIG_FB_UVESA=m # CONFIG_FB_UDL is not set # CONFIG_FB_IBM_GXT4500 is not set # CONFIG_FB_VIRTUAL is not set +CONFIG_XEN_FBDEV_FRONTEND=m # CONFIG_FB_METRONOME is not set # CONFIG_FB_MB862XX is not set # CONFIG_FB_BROADSHEET is not set @@ -3943,27 +3635,31 @@ CONFIG_FB_UVESA=m CONFIG_BACKLIGHT_LCD_SUPPORT=y CONFIG_LCD_CLASS_DEVICE=m # CONFIG_LCD_L4F00242T03 is not set -CONFIG_LCD_LMS283GF05=m -CONFIG_LCD_LTV350QV=m -CONFIG_LCD_ILI922X=m -CONFIG_LCD_ILI9320=m -CONFIG_LCD_TDO24M=m -CONFIG_LCD_VGG2432A4=m -CONFIG_LCD_PLATFORM=m -CONFIG_LCD_S6E63M0=m -CONFIG_LCD_LD9040=m -CONFIG_LCD_AMS369FG06=m -CONFIG_LCD_LMS501KF03=m -CONFIG_LCD_HX8357=m +# CONFIG_LCD_LMS283GF05 is not set +# CONFIG_LCD_LTV350QV is not set +# CONFIG_LCD_ILI922X is not set +# CONFIG_LCD_ILI9320 is not set +# CONFIG_LCD_TDO24M is not set +# CONFIG_LCD_VGG2432A4 is not set +# CONFIG_LCD_PLATFORM is not set +# CONFIG_LCD_S6E63M0 is not set +# CONFIG_LCD_LD9040 is not set +# CONFIG_LCD_AMS369FG06 is not set +# CONFIG_LCD_LMS501KF03 is not set +# CONFIG_LCD_HX8357 is not set CONFIG_BACKLIGHT_CLASS_DEVICE=y -CONFIG_BACKLIGHT_GENERIC=m -CONFIG_BACKLIGHT_PM8941_WLED=m -CONFIG_BACKLIGHT_ADP8860=m -CONFIG_BACKLIGHT_ADP8870=m -CONFIG_BACKLIGHT_LM3639=m -CONFIG_BACKLIGHT_GPIO=m -CONFIG_BACKLIGHT_LV5207LP=m -CONFIG_BACKLIGHT_BD6107=m +CONFIG_BACKLIGHT_GENERIC=y +CONFIG_BACKLIGHT_PWM=m +# CONFIG_BACKLIGHT_PM8941_WLED is not set +# CONFIG_BACKLIGHT_ADP8860 is not set +# CONFIG_BACKLIGHT_ADP8870 is not set +CONFIG_BACKLIGHT_LM3630A=m +# CONFIG_BACKLIGHT_LM3639 is not set +CONFIG_BACKLIGHT_LP855X=m +# CONFIG_BACKLIGHT_GPIO is not set +# CONFIG_BACKLIGHT_LV5207LP is not set +# CONFIG_BACKLIGHT_BD6107 is not set +# CONFIG_BACKLIGHT_ARCXCNN is not set # CONFIG_VGASTATE is not set CONFIG_VIDEOMODE_HELPERS=y @@ -3976,245 +3672,109 @@ CONFIG_DUMMY_CONSOLE_ROWS=25 CONFIG_FRAMEBUFFER_CONSOLE=y # CONFIG_FRAMEBUFFER_CONSOLE_DETECT_PRIMARY is not set # CONFIG_FRAMEBUFFER_CONSOLE_ROTATION is not set -# CONFIG_LOGO is not set -CONFIG_SOUND=m -CONFIG_SOUND_OSS_CORE=y -CONFIG_SOUND_OSS_CORE_PRECLAIM=y -CONFIG_SND=m -CONFIG_SND_TIMER=m -CONFIG_SND_PCM=m -CONFIG_SND_HWDEP=m -CONFIG_SND_RAWMIDI=m -CONFIG_SND_SEQUENCER=m -# CONFIG_SND_SEQ_DUMMY is not set -CONFIG_SND_OSSEMUL=y -CONFIG_SND_MIXER_OSS=m -CONFIG_SND_PCM_OSS=m -CONFIG_SND_PCM_OSS_PLUGINS=y -CONFIG_SND_PCM_TIMER=y -# CONFIG_SND_SEQUENCER_OSS is not set -CONFIG_SND_HRTIMER=m -CONFIG_SND_SEQ_HRTIMER_DEFAULT=y -# CONFIG_SND_DYNAMIC_MINORS is not set -CONFIG_SND_SUPPORT_OLD_API=y -CONFIG_SND_PROC_FS=y -CONFIG_SND_VERBOSE_PROCFS=y -# CONFIG_SND_VERBOSE_PRINTK is not set -# CONFIG_SND_DEBUG is not set -CONFIG_SND_VMASTER=y -CONFIG_SND_RAWMIDI_SEQ=m -# CONFIG_SND_OPL3_LIB_SEQ is not set -# CONFIG_SND_OPL4_LIB_SEQ is not set -# CONFIG_SND_SBAWE_SEQ is not set -# CONFIG_SND_EMU10K1_SEQ is not set -CONFIG_SND_AC97_CODEC=m -CONFIG_SND_DRIVERS=y -# CONFIG_SND_DUMMY is not set -# CONFIG_SND_ALOOP is not set -# CONFIG_SND_VIRMIDI is not set -# CONFIG_SND_MTPAV is not set -# CONFIG_SND_SERIAL_U16550 is not set -# CONFIG_SND_MPU401 is not set -# CONFIG_SND_AC97_POWER_SAVE is not set -CONFIG_SND_PCI=y -# CONFIG_SND_AD1889 is not set -# CONFIG_SND_ALS300 is not set -# CONFIG_SND_ALI5451 is not set -# CONFIG_SND_ATIIXP is not set -# CONFIG_SND_ATIIXP_MODEM is not set -# CONFIG_SND_AU8810 is not set -# CONFIG_SND_AU8820 is not set -# CONFIG_SND_AU8830 is not set -# CONFIG_SND_AW2 is not set -# CONFIG_SND_AZT3328 is not set -# CONFIG_SND_BT87X is not set -# CONFIG_SND_CA0106 is not set -# CONFIG_SND_CMIPCI is not set -# CONFIG_SND_OXYGEN is not set -# CONFIG_SND_CS4281 is not set -# CONFIG_SND_CS46XX is not set -# CONFIG_SND_CTXFI is not set -# CONFIG_SND_DARLA20 is not set -# CONFIG_SND_GINA20 is not set -# CONFIG_SND_LAYLA20 is not set -# CONFIG_SND_DARLA24 is not set -# CONFIG_SND_GINA24 is not set -# CONFIG_SND_LAYLA24 is not set -# CONFIG_SND_MONA is not set -# CONFIG_SND_MIA is not set -# CONFIG_SND_ECHO3G is not set -# CONFIG_SND_INDIGO is not set -# CONFIG_SND_INDIGOIO is not set -# CONFIG_SND_INDIGODJ is not set -# CONFIG_SND_INDIGOIOX is not set -# CONFIG_SND_INDIGODJX is not set -# CONFIG_SND_EMU10K1 is not set -# CONFIG_SND_EMU10K1X is not set -# CONFIG_SND_ENS1370 is not set -# CONFIG_SND_ENS1371 is not set -# CONFIG_SND_ES1938 is not set -# CONFIG_SND_ES1968 is not set -# CONFIG_SND_FM801 is not set -# CONFIG_SND_HDSP is not set -# CONFIG_SND_HDSPM is not set -# CONFIG_SND_ICE1712 is not set -# CONFIG_SND_ICE1724 is not set -# CONFIG_SND_INTEL8X0 is not set -# CONFIG_SND_INTEL8X0M is not set -# CONFIG_SND_KORG1212 is not set -# CONFIG_SND_LOLA is not set -# CONFIG_SND_LX6464ES is not set -# CONFIG_SND_MAESTRO3 is not set -# CONFIG_SND_MIXART is not set -# CONFIG_SND_NM256 is not set -# CONFIG_SND_PCXHR is not set -# CONFIG_SND_RIPTIDE is not set -# CONFIG_SND_RME32 is not set -# CONFIG_SND_RME96 is not set -# CONFIG_SND_RME9652 is not set -# CONFIG_SND_SE6X is not set -# CONFIG_SND_SONICVIBES is not set -# CONFIG_SND_TRIDENT is not set -# CONFIG_SND_VIA82XX is not set -# CONFIG_SND_VIA82XX_MODEM is not set -# CONFIG_SND_VIRTUOSO is not set -# CONFIG_SND_VX222 is not set -# CONFIG_SND_YMFPCI is not set - -# -# HD-Audio -# -# CONFIG_SND_HDA_INTEL is not set -CONFIG_SND_HDA_PREALLOC_SIZE=64 -CONFIG_SND_SPI=y -CONFIG_SND_USB=y -CONFIG_SND_USB_AUDIO=m -CONFIG_SND_USB_UA101=m -CONFIG_SND_USB_CAIAQ=m -CONFIG_SND_USB_CAIAQ_INPUT=y -CONFIG_SND_USB_6FIRE=m -CONFIG_SND_USB_HIFACE=m -CONFIG_SND_BCD2000=m -CONFIG_SND_USB_LINE6=m -CONFIG_SND_USB_POD=m -CONFIG_SND_USB_PODHD=m -CONFIG_SND_USB_TONEPORT=m -CONFIG_SND_USB_VARIAX=m -# CONFIG_SND_SOC is not set -# CONFIG_SOUND_PRIME is not set -CONFIG_AC97_BUS=m +CONFIG_LOGO=y +# CONFIG_LOGO_LINUX_MONO is not set +# CONFIG_LOGO_LINUX_VGA16 is not set +CONFIG_LOGO_LINUX_CLUT224=y +# CONFIG_SOUND is not set # # HID support # CONFIG_HID=y -CONFIG_HID_BATTERY_STRENGTH=y -CONFIG_HIDRAW=y -CONFIG_UHID=m -CONFIG_HID_GENERIC=m +# CONFIG_HID_BATTERY_STRENGTH is not set +# CONFIG_HIDRAW is not set +# CONFIG_UHID is not set +CONFIG_HID_GENERIC=y # # Special HID drivers # -CONFIG_HID_A4TECH=m -CONFIG_HID_ACRUX=m -CONFIG_HID_ACRUX_FF=y -CONFIG_HID_APPLE=m -CONFIG_HID_APPLEIR=m -CONFIG_HID_AUREAL=m -CONFIG_HID_BELKIN=m -CONFIG_HID_BETOP_FF=m -CONFIG_HID_CHERRY=m -CONFIG_HID_CHICONY=m -CONFIG_HID_CORSAIR=m -CONFIG_HID_PRODIKEYS=m -CONFIG_HID_CP2112=m -CONFIG_HID_CYPRESS=m -CONFIG_HID_DRAGONRISE=m -CONFIG_DRAGONRISE_FF=y -CONFIG_HID_EMS_FF=m -CONFIG_HID_ELECOM=m -CONFIG_HID_ELO=m -CONFIG_HID_EZKEY=m -CONFIG_HID_GEMBIRD=m -CONFIG_HID_GFRM=m -CONFIG_HID_HOLTEK=m -CONFIG_HOLTEK_FF=y -CONFIG_HID_GT683R=m -CONFIG_HID_KEYTOUCH=m -CONFIG_HID_KYE=m -CONFIG_HID_UCLOGIC=m -CONFIG_HID_WALTOP=m -CONFIG_HID_GYRATION=m -CONFIG_HID_ICADE=m -CONFIG_HID_TWINHAN=m -CONFIG_HID_KENSINGTON=m -CONFIG_HID_LCPOWER=m -CONFIG_HID_LENOVO=m -CONFIG_HID_LOGITECH=m -CONFIG_HID_LOGITECH_DJ=m -CONFIG_HID_LOGITECH_HIDPP=m -CONFIG_LOGITECH_FF=y -CONFIG_LOGIRUMBLEPAD2_FF=y -CONFIG_LOGIG940_FF=y -CONFIG_LOGIWHEELS_FF=y -CONFIG_HID_MAGICMOUSE=m -CONFIG_HID_MICROSOFT=m -CONFIG_HID_MONTEREY=m -CONFIG_HID_MULTITOUCH=m -CONFIG_HID_NTRIG=m -CONFIG_HID_ORTEK=m -CONFIG_HID_PANTHERLORD=m -CONFIG_PANTHERLORD_FF=y -CONFIG_HID_PENMOUNT=m -CONFIG_HID_PETALYNX=m -CONFIG_HID_PICOLCD=m -CONFIG_HID_PICOLCD_FB=y -CONFIG_HID_PICOLCD_BACKLIGHT=y -CONFIG_HID_PICOLCD_LCD=y -CONFIG_HID_PICOLCD_LEDS=y -CONFIG_HID_PICOLCD_CIR=y -CONFIG_HID_PLANTRONICS=m -CONFIG_HID_PRIMAX=m -CONFIG_HID_ROCCAT=m -CONFIG_HID_SAITEK=m -CONFIG_HID_SAMSUNG=m -CONFIG_HID_SONY=m -CONFIG_SONY_FF=y -CONFIG_HID_SPEEDLINK=m -CONFIG_HID_STEELSERIES=m -CONFIG_HID_SUNPLUS=m -CONFIG_HID_RMI=m -CONFIG_HID_GREENASIA=m -CONFIG_GREENASIA_FF=y -CONFIG_HID_SMARTJOYPLUS=m -CONFIG_SMARTJOYPLUS_FF=y -CONFIG_HID_TIVO=m -CONFIG_HID_TOPSEED=m -CONFIG_HID_THINGM=m -CONFIG_HID_THRUSTMASTER=m -CONFIG_THRUSTMASTER_FF=y -CONFIG_HID_WACOM=m -CONFIG_HID_WIIMOTE=m -CONFIG_HID_XINMO=m -CONFIG_HID_ZEROPLUS=m -CONFIG_ZEROPLUS_FF=y -CONFIG_HID_ZYDACRON=m -CONFIG_HID_SENSOR_HUB=m -CONFIG_HID_SENSOR_CUSTOM_SENSOR=m +CONFIG_HID_A4TECH=y +# CONFIG_HID_ACCUTOUCH is not set +# CONFIG_HID_ACRUX is not set +CONFIG_HID_APPLE=y +# CONFIG_HID_APPLEIR is not set +# CONFIG_HID_ASUS is not set +# CONFIG_HID_AUREAL is not set +CONFIG_HID_BELKIN=y +# CONFIG_HID_BETOP_FF is not set +CONFIG_HID_CHERRY=y +CONFIG_HID_CHICONY=y +# CONFIG_HID_CORSAIR is not set +# CONFIG_HID_CMEDIA is not set +CONFIG_HID_CYPRESS=y +# CONFIG_HID_DRAGONRISE is not set +# CONFIG_HID_EMS_FF is not set +# CONFIG_HID_ELECOM is not set +# CONFIG_HID_ELO is not set +CONFIG_HID_EZKEY=y +# CONFIG_HID_GEMBIRD is not set +# CONFIG_HID_GFRM is not set +# CONFIG_HID_HOLTEK is not set +# CONFIG_HID_GT683R is not set +# CONFIG_HID_KEYTOUCH is not set +# CONFIG_HID_KYE is not set +# CONFIG_HID_UCLOGIC is not set +# CONFIG_HID_WALTOP is not set +# CONFIG_HID_GYRATION is not set +# CONFIG_HID_ICADE is not set +CONFIG_HID_ITE=m +# CONFIG_HID_TWINHAN is not set +CONFIG_HID_KENSINGTON=y +# CONFIG_HID_LCPOWER is not set +# CONFIG_HID_LED is not set +# CONFIG_HID_LENOVO is not set +CONFIG_HID_LOGITECH=y +# CONFIG_HID_LOGITECH_HIDPP is not set +# CONFIG_LOGITECH_FF is not set +# CONFIG_LOGIRUMBLEPAD2_FF is not set +# CONFIG_LOGIG940_FF is not set +# CONFIG_LOGIWHEELS_FF is not set +# CONFIG_HID_MAGICMOUSE is not set +# CONFIG_HID_MAYFLASH is not set +CONFIG_HID_MICROSOFT=y +CONFIG_HID_MONTEREY=y +# CONFIG_HID_MULTITOUCH is not set +# CONFIG_HID_NTI is not set +# CONFIG_HID_NTRIG is not set +# CONFIG_HID_ORTEK is not set +# CONFIG_HID_PANTHERLORD is not set +# CONFIG_HID_PENMOUNT is not set +# CONFIG_HID_PETALYNX is not set +# CONFIG_HID_PICOLCD is not set +# CONFIG_HID_PLANTRONICS is not set +# CONFIG_HID_PRIMAX is not set +CONFIG_HID_RETRODE=m +# CONFIG_HID_ROCCAT is not set +# CONFIG_HID_SAITEK is not set +# CONFIG_HID_SAMSUNG is not set +# CONFIG_HID_SONY is not set +# CONFIG_HID_SPEEDLINK is not set +# CONFIG_HID_STEELSERIES is not set +# CONFIG_HID_SUNPLUS is not set +# CONFIG_HID_RMI is not set +# CONFIG_HID_GREENASIA is not set +# CONFIG_HID_SMARTJOYPLUS is not set +# CONFIG_HID_TIVO is not set +# CONFIG_HID_TOPSEED is not set +# CONFIG_HID_THINGM is not set +# CONFIG_HID_THRUSTMASTER is not set +# CONFIG_HID_UDRAW_PS3 is not set +# CONFIG_HID_WACOM is not set +# CONFIG_HID_WIIMOTE is not set +# CONFIG_HID_XINMO is not set +# CONFIG_HID_ZEROPLUS is not set +# CONFIG_HID_ZYDACRON is not set +# CONFIG_HID_SENSOR_HUB is not set +# CONFIG_HID_ALPS is not set # # USB HID support # -CONFIG_USB_HID=m -CONFIG_HID_PID=y -CONFIG_USB_HIDDEV=y - -# -# USB HID Boot Protocol drivers -# -CONFIG_USB_KBD=m -CONFIG_USB_MOUSE=m +CONFIG_USB_HID=y +# CONFIG_HID_PID is not set +# CONFIG_USB_HIDDEV is not set # # I2C HID support @@ -4225,6 +3785,7 @@ CONFIG_USB_SUPPORT=y CONFIG_USB_COMMON=y CONFIG_USB_ARCH_HAS_HCD=y CONFIG_USB=y +CONFIG_USB_PCI=y CONFIG_USB_ANNOUNCE_NEW_DEVICES=y # @@ -4235,7 +3796,7 @@ CONFIG_USB_DEFAULT_PERSIST=y # CONFIG_USB_OTG is not set # CONFIG_USB_OTG_WHITELIST is not set # CONFIG_USB_OTG_BLACKLIST_HUB is not set -# CONFIG_USB_ULPI_BUS is not set +# CONFIG_USB_LEDS_TRIGGER_USBPORT is not set # CONFIG_USB_MON is not set # CONFIG_USB_WUSB_CBAF is not set @@ -4248,7 +3809,7 @@ CONFIG_USB_XHCI_PCI=y CONFIG_USB_XHCI_PLATFORM=y CONFIG_USB_XHCI_MVEBU=y CONFIG_USB_EHCI_HCD=y -CONFIG_USB_EHCI_ROOT_HUB_TT=y +# CONFIG_USB_EHCI_ROOT_HUB_TT is not set CONFIG_USB_EHCI_TT_NEWSCHED=y CONFIG_USB_EHCI_PCI=y CONFIG_USB_EHCI_HCD_ORION=y @@ -4262,7 +3823,6 @@ CONFIG_USB_OHCI_HCD=y CONFIG_USB_OHCI_HCD_PCI=y CONFIG_USB_OHCI_HCD_PLATFORM=y # CONFIG_USB_UHCI_HCD is not set -CONFIG_USB_U132_HCD=m # CONFIG_USB_SL811_HCD is not set # CONFIG_USB_R8A66597_HCD is not set CONFIG_USB_HCD_BCMA=m @@ -4286,185 +3846,78 @@ CONFIG_USB_WDM=m # CONFIG_USB_STORAGE=y # CONFIG_USB_STORAGE_DEBUG is not set -CONFIG_USB_STORAGE_REALTEK=y -CONFIG_REALTEK_AUTOPM=y -CONFIG_USB_STORAGE_DATAFAB=y -CONFIG_USB_STORAGE_FREECOM=y -CONFIG_USB_STORAGE_ISD200=y -CONFIG_USB_STORAGE_USBAT=y -CONFIG_USB_STORAGE_SDDR09=y -CONFIG_USB_STORAGE_SDDR55=y -CONFIG_USB_STORAGE_JUMPSHOT=y -CONFIG_USB_STORAGE_ALAUDA=y -CONFIG_USB_STORAGE_ONETOUCH=y -CONFIG_USB_STORAGE_KARMA=y -CONFIG_USB_STORAGE_CYPRESS_ATACB=y -CONFIG_USB_STORAGE_ENE_UB6250=y +# CONFIG_USB_STORAGE_REALTEK is not set +# CONFIG_USB_STORAGE_DATAFAB is not set +# CONFIG_USB_STORAGE_FREECOM is not set +# CONFIG_USB_STORAGE_ISD200 is not set +# CONFIG_USB_STORAGE_USBAT is not set +# CONFIG_USB_STORAGE_SDDR09 is not set +# CONFIG_USB_STORAGE_SDDR55 is not set +# CONFIG_USB_STORAGE_JUMPSHOT is not set +# CONFIG_USB_STORAGE_ALAUDA is not set +# CONFIG_USB_STORAGE_ONETOUCH is not set +# CONFIG_USB_STORAGE_KARMA is not set +# CONFIG_USB_STORAGE_CYPRESS_ATACB is not set +# CONFIG_USB_STORAGE_ENE_UB6250 is not set CONFIG_USB_UAS=m # # USB Imaging devices # -CONFIG_USB_MDC800=m -CONFIG_USB_MICROTEK=m -CONFIG_USBIP_CORE=m -CONFIG_USBIP_VHCI_HCD=m -CONFIG_USBIP_HOST=m -# CONFIG_USBIP_DEBUG is not set -CONFIG_USB_MUSB_HDRC=m -CONFIG_USB_MUSB_HOST=y -# CONFIG_USB_MUSB_GADGET is not set -# CONFIG_USB_MUSB_DUAL_ROLE is not set - -# -# Platform Glue Layer -# - -# -# MUSB DMA mode -# -# CONFIG_MUSB_PIO_ONLY is not set -CONFIG_USB_DWC3=y -CONFIG_USB_DWC3_HOST=y -# CONFIG_USB_DWC3_GADGET is not set -# CONFIG_USB_DWC3_DUAL_ROLE is not set - -# -# Platform Glue Driver Support -# -CONFIG_USB_DWC3_PCI=y -CONFIG_USB_DWC2=y -CONFIG_USB_DWC2_HOST=y - -# -# Gadget/Dual-role mode requires USB Gadget support to be enabled -# -# CONFIG_USB_DWC2_PERIPHERAL is not set -# CONFIG_USB_DWC2_DUAL_ROLE is not set -# CONFIG_USB_DWC2_PCI is not set -# CONFIG_USB_DWC2_DEBUG is not set -# CONFIG_USB_DWC2_TRACK_MISSED_SOFS is not set -CONFIG_USB_CHIPIDEA=y -CONFIG_USB_CHIPIDEA_OF=y -CONFIG_USB_CHIPIDEA_PCI=y -# CONFIG_USB_CHIPIDEA_UDC is not set -CONFIG_USB_CHIPIDEA_HOST=y -# CONFIG_USB_CHIPIDEA_DEBUG is not set +# CONFIG_USB_MDC800 is not set +# CONFIG_USB_MICROTEK is not set +# CONFIG_USBIP_CORE is not set +# CONFIG_USB_MUSB_HDRC is not set +# CONFIG_USB_DWC3 is not set +# CONFIG_USB_DWC2 is not set +# CONFIG_USB_CHIPIDEA is not set CONFIG_USB_ISP1760=y CONFIG_USB_ISP1760_HCD=y -CONFIG_USB_ISP1760_HOST_ROLE=y +CONFIG_USB_ISP1761_UDC=y +# CONFIG_USB_ISP1760_HOST_ROLE is not set # CONFIG_USB_ISP1760_GADGET_ROLE is not set -# CONFIG_USB_ISP1760_DUAL_ROLE is not set +CONFIG_USB_ISP1760_DUAL_ROLE=y # # USB port drivers # -CONFIG_USB_SERIAL=m -CONFIG_USB_SERIAL_GENERIC=y -CONFIG_USB_SERIAL_SIMPLE=m -CONFIG_USB_SERIAL_AIRCABLE=m -CONFIG_USB_SERIAL_ARK3116=m -CONFIG_USB_SERIAL_BELKIN=m -CONFIG_USB_SERIAL_CH341=m -CONFIG_USB_SERIAL_WHITEHEAT=m -CONFIG_USB_SERIAL_DIGI_ACCELEPORT=m -CONFIG_USB_SERIAL_CP210X=m -CONFIG_USB_SERIAL_CYPRESS_M8=m -CONFIG_USB_SERIAL_EMPEG=m -CONFIG_USB_SERIAL_FTDI_SIO=m -CONFIG_USB_SERIAL_VISOR=m -CONFIG_USB_SERIAL_IPAQ=m -CONFIG_USB_SERIAL_IR=m -CONFIG_USB_SERIAL_EDGEPORT=m -CONFIG_USB_SERIAL_EDGEPORT_TI=m -CONFIG_USB_SERIAL_F81232=m -CONFIG_USB_SERIAL_GARMIN=m -CONFIG_USB_SERIAL_IPW=m -CONFIG_USB_SERIAL_IUU=m -CONFIG_USB_SERIAL_KEYSPAN_PDA=m -CONFIG_USB_SERIAL_KEYSPAN=m -CONFIG_USB_SERIAL_KEYSPAN_MPR=y -CONFIG_USB_SERIAL_KEYSPAN_USA28=y -CONFIG_USB_SERIAL_KEYSPAN_USA28X=y -CONFIG_USB_SERIAL_KEYSPAN_USA28XA=y -CONFIG_USB_SERIAL_KEYSPAN_USA28XB=y -CONFIG_USB_SERIAL_KEYSPAN_USA19=y -CONFIG_USB_SERIAL_KEYSPAN_USA18X=y -CONFIG_USB_SERIAL_KEYSPAN_USA19W=y -CONFIG_USB_SERIAL_KEYSPAN_USA19QW=y -CONFIG_USB_SERIAL_KEYSPAN_USA19QI=y -CONFIG_USB_SERIAL_KEYSPAN_USA49W=y -CONFIG_USB_SERIAL_KEYSPAN_USA49WLC=y -CONFIG_USB_SERIAL_KLSI=m -CONFIG_USB_SERIAL_KOBIL_SCT=m -CONFIG_USB_SERIAL_MCT_U232=m -CONFIG_USB_SERIAL_METRO=m -CONFIG_USB_SERIAL_MOS7720=m -CONFIG_USB_SERIAL_MOS7840=m -CONFIG_USB_SERIAL_MXUPORT=m -CONFIG_USB_SERIAL_NAVMAN=m -CONFIG_USB_SERIAL_PL2303=m -CONFIG_USB_SERIAL_OTI6858=m -CONFIG_USB_SERIAL_QCAUX=m -CONFIG_USB_SERIAL_QUALCOMM=m -CONFIG_USB_SERIAL_SPCP8X5=m -CONFIG_USB_SERIAL_SAFE=m -# CONFIG_USB_SERIAL_SAFE_PADDED is not set -CONFIG_USB_SERIAL_SIERRAWIRELESS=m -CONFIG_USB_SERIAL_SYMBOL=m -CONFIG_USB_SERIAL_TI=m -CONFIG_USB_SERIAL_CYBERJACK=m -CONFIG_USB_SERIAL_XIRCOM=m -CONFIG_USB_SERIAL_WWAN=m -CONFIG_USB_SERIAL_OPTION=m -CONFIG_USB_SERIAL_OMNINET=m -CONFIG_USB_SERIAL_OPTICON=m -CONFIG_USB_SERIAL_XSENS_MT=m -CONFIG_USB_SERIAL_WISHBONE=m -CONFIG_USB_SERIAL_SSU100=m -CONFIG_USB_SERIAL_QT2=m -# CONFIG_USB_SERIAL_DEBUG is not set +# CONFIG_USB_SERIAL is not set # # USB Miscellaneous drivers # -CONFIG_USB_EMI62=m -CONFIG_USB_EMI26=m -CONFIG_USB_ADUTUX=m -CONFIG_USB_SEVSEG=m -CONFIG_USB_RIO500=m -CONFIG_USB_LEGOTOWER=m -CONFIG_USB_LCD=m -CONFIG_USB_LED=m -CONFIG_USB_CYPRESS_CY7C63=m -CONFIG_USB_CYTHERM=m -CONFIG_USB_IDMOUSE=m -CONFIG_USB_FTDI_ELAN=m -CONFIG_USB_APPLEDISPLAY=m -CONFIG_USB_SISUSBVGA=m -CONFIG_USB_SISUSBVGA_CON=y -CONFIG_USB_LD=m -CONFIG_USB_TRANCEVIBRATOR=m -CONFIG_USB_IOWARRIOR=m -CONFIG_USB_TEST=m -CONFIG_USB_EHSET_TEST_FIXTURE=m -CONFIG_USB_ISIGHTFW=m -CONFIG_USB_YUREX=m -CONFIG_USB_EZUSB_FX2=m -CONFIG_USB_HSIC_USB3503=y +# CONFIG_USB_EMI62 is not set +# CONFIG_USB_EMI26 is not set +# CONFIG_USB_ADUTUX is not set +# CONFIG_USB_SEVSEG is not set +# CONFIG_USB_RIO500 is not set +# CONFIG_USB_LEGOTOWER is not set +# CONFIG_USB_LCD is not set +# CONFIG_USB_CYPRESS_CY7C63 is not set +# CONFIG_USB_CYTHERM is not set +# CONFIG_USB_IDMOUSE is not set +# CONFIG_USB_FTDI_ELAN is not set +# CONFIG_USB_APPLEDISPLAY is not set +# CONFIG_USB_SISUSBVGA is not set +# CONFIG_USB_LD is not set +# CONFIG_USB_TRANCEVIBRATOR is not set +# CONFIG_USB_IOWARRIOR is not set +# CONFIG_USB_TEST is not set +# CONFIG_USB_EHSET_TEST_FIXTURE is not set +# CONFIG_USB_ISIGHTFW is not set +# CONFIG_USB_YUREX is not set +# CONFIG_USB_EZUSB_FX2 is not set +# CONFIG_USB_HUB_USB251XB is not set +# CONFIG_USB_HSIC_USB3503 is not set +# CONFIG_USB_HSIC_USB4604 is not set # CONFIG_USB_LINK_LAYER_TEST is not set -CONFIG_USB_CHAOSKEY=m -CONFIG_USB_ATM=m -CONFIG_USB_SPEEDTOUCH=m -CONFIG_USB_CXACRU=m -CONFIG_USB_UEAGLEATM=m -CONFIG_USB_XUSBATM=m +# CONFIG_USB_CHAOSKEY is not set +# CONFIG_USB_ATM is not set # # USB Physical Layer drivers # CONFIG_USB_PHY=y -CONFIG_USB_A3700_PHY=y CONFIG_NOP_USB_XCEIV=y # CONFIG_USB_GPIO_VBUS is not set # CONFIG_USB_ISP1301 is not set @@ -4486,7 +3939,8 @@ CONFIG_USB_GADGET_STORAGE_NUM_BUFFERS=2 # CONFIG_USB_PXA27X is not set CONFIG_USB_MV_UDC=y # CONFIG_USB_MV_U3D is not set -CONFIG_USB_MVEBU_U3D=y +CONFIG_USB_SNP_CORE=m +CONFIG_USB_SNP_UDC_PLAT=m # CONFIG_USB_M66592 is not set # CONFIG_USB_BDC_UDC is not set # CONFIG_USB_AMD5536UDC is not set @@ -4498,21 +3952,14 @@ CONFIG_USB_MVEBU_U3D=y # CONFIG_USB_DUMMY_HCD is not set CONFIG_USB_LIBCOMPOSITE=m CONFIG_USB_F_MASS_STORAGE=m -CONFIG_USB_F_UAC2=m -CONFIG_USB_F_UVC=m -CONFIG_USB_F_MIDI=m # CONFIG_USB_CONFIGFS is not set # CONFIG_USB_ZERO is not set -CONFIG_USB_AUDIO=m -# CONFIG_GADGET_UAC1 is not set # CONFIG_USB_ETH is not set # CONFIG_USB_G_NCM is not set # CONFIG_USB_GADGETFS is not set # CONFIG_USB_FUNCTIONFS is not set CONFIG_USB_MASS_STORAGE=m -# CONFIG_USB_GADGET_TARGET is not set # CONFIG_USB_G_SERIAL is not set -CONFIG_USB_MIDI_GADGET=m # CONFIG_USB_G_PRINTER is not set # CONFIG_USB_CDC_COMPOSITE is not set # CONFIG_USB_G_NOKIA is not set @@ -4520,24 +3967,28 @@ CONFIG_USB_MIDI_GADGET=m # CONFIG_USB_G_MULTI is not set # CONFIG_USB_G_HID is not set # CONFIG_USB_G_DBGP is not set -CONFIG_USB_G_WEBCAM=m -# CONFIG_USB_LED_TRIG is not set -# CONFIG_UWB is not set -CONFIG_MMC=y -# CONFIG_MMC_DEBUG is not set # -# MMC/SD/SDIO Card Drivers +# USB Power Delivery and Type-C drivers # +CONFIG_TYPEC=m +# CONFIG_TYPEC_UCSI is not set +# CONFIG_USB_LED_TRIG is not set +# CONFIG_USB_ULPI_BUS is not set +# CONFIG_UWB is not set +CONFIG_MMC=y +CONFIG_PWRSEQ_EMMC=y +# CONFIG_PWRSEQ_SD8787 is not set +CONFIG_PWRSEQ_SIMPLE=y CONFIG_MMC_BLOCK=y CONFIG_MMC_BLOCK_MINORS=8 -CONFIG_MMC_BLOCK_BOUNCE=y # CONFIG_SDIO_UART is not set # CONFIG_MMC_TEST is not set # # MMC/SD/SDIO Host Controller Drivers # +# CONFIG_MMC_DEBUG is not set CONFIG_MMC_ARMMMCI=y CONFIG_MMC_SDHCI=y # CONFIG_MMC_SDHCI_PCI is not set @@ -4545,12 +3996,14 @@ CONFIG_MMC_SDHCI_ACPI=m CONFIG_MMC_SDHCI_PLTFM=y # CONFIG_MMC_SDHCI_OF_ARASAN is not set # CONFIG_MMC_SDHCI_OF_AT91 is not set +# CONFIG_MMC_SDHCI_CADENCE is not set # CONFIG_MMC_SDHCI_PXAV3 is not set # CONFIG_MMC_SDHCI_F_SDH30 is not set # CONFIG_MMC_TIFM_SD is not set # CONFIG_MMC_SPI is not set # CONFIG_MMC_CB710 is not set # CONFIG_MMC_VIA_SDMMC is not set +# CONFIG_MMC_CAVIUM_THUNDERX is not set # CONFIG_MMC_DW is not set # CONFIG_MMC_VUB300 is not set # CONFIG_MMC_USHC is not set @@ -4562,6 +4015,7 @@ CONFIG_MMC_SDHCI_XENON=y CONFIG_NEW_LEDS=y CONFIG_LEDS_CLASS=y # CONFIG_LEDS_CLASS_FLASH is not set +# CONFIG_LEDS_BRIGHTNESS_HW_CHANGED is not set # # LED drivers @@ -4573,6 +4027,7 @@ CONFIG_LEDS_CLASS=y # CONFIG_LEDS_PCA9532 is not set # CONFIG_LEDS_GPIO is not set # CONFIG_LEDS_LP3944 is not set +# CONFIG_LEDS_LP3952 is not set # CONFIG_LEDS_LP5521 is not set # CONFIG_LEDS_LP5523 is not set # CONFIG_LEDS_LP5562 is not set @@ -4581,19 +4036,22 @@ CONFIG_LEDS_CLASS=y # CONFIG_LEDS_PCA955X is not set # CONFIG_LEDS_PCA963X is not set # CONFIG_LEDS_DAC124S085 is not set +CONFIG_LEDS_PWM=m # CONFIG_LEDS_REGULATOR is not set # CONFIG_LEDS_BD2802 is not set -# CONFIG_LEDS_INTEL_SS4200 is not set # CONFIG_LEDS_LT3593 is not set # CONFIG_LEDS_TCA6507 is not set # CONFIG_LEDS_TLC591XX is not set # CONFIG_LEDS_LM355x is not set +# CONFIG_LEDS_IS31FL319X is not set +# CONFIG_LEDS_IS31FL32XX is not set # # LED driver for blink(1) USB RGB LED is under Special HID drivers (HID_THINGM) # # CONFIG_LEDS_BLINKM is not set CONFIG_LEDS_SYSCON=y +# CONFIG_LEDS_USER is not set # # LED Triggers @@ -4601,6 +4059,8 @@ CONFIG_LEDS_SYSCON=y CONFIG_LEDS_TRIGGERS=y # CONFIG_LEDS_TRIGGER_TIMER is not set # CONFIG_LEDS_TRIGGER_ONESHOT is not set +# CONFIG_LEDS_TRIGGER_DISK is not set +# CONFIG_LEDS_TRIGGER_MTD is not set CONFIG_LEDS_TRIGGER_HEARTBEAT=y # CONFIG_LEDS_TRIGGER_BACKLIGHT is not set CONFIG_LEDS_TRIGGER_CPU=y @@ -4612,6 +4072,7 @@ CONFIG_LEDS_TRIGGER_CPU=y # # CONFIG_LEDS_TRIGGER_TRANSIENT is not set # CONFIG_LEDS_TRIGGER_CAMERA is not set +# CONFIG_LEDS_TRIGGER_PANIC is not set # CONFIG_ACCESSIBILITY is not set # CONFIG_INFINIBAND is not set CONFIG_EDAC_SUPPORT=y @@ -4623,6 +4084,7 @@ CONFIG_RTC_HCTOSYS_DEVICE="rtc0" CONFIG_RTC_SYSTOHC=y CONFIG_RTC_SYSTOHC_DEVICE="rtc0" # CONFIG_RTC_DEBUG is not set +CONFIG_RTC_NVMEM=y # # RTC interfaces @@ -4641,27 +4103,24 @@ CONFIG_RTC_INTF_DEV=y # CONFIG_RTC_DRV_DS1307 is not set # CONFIG_RTC_DRV_DS1374 is not set # CONFIG_RTC_DRV_DS1672 is not set -# CONFIG_RTC_DRV_DS3232 is not set # CONFIG_RTC_DRV_HYM8563 is not set # CONFIG_RTC_DRV_MAX6900 is not set # CONFIG_RTC_DRV_RS5C372 is not set # CONFIG_RTC_DRV_ISL1208 is not set # CONFIG_RTC_DRV_ISL12022 is not set -# CONFIG_RTC_DRV_ISL12057 is not set # CONFIG_RTC_DRV_X1205 is not set -# CONFIG_RTC_DRV_PCF2127 is not set # CONFIG_RTC_DRV_PCF8523 is not set -# CONFIG_RTC_DRV_PCF8563 is not set # CONFIG_RTC_DRV_PCF85063 is not set +# CONFIG_RTC_DRV_PCF8563 is not set # CONFIG_RTC_DRV_PCF8583 is not set # CONFIG_RTC_DRV_M41T80 is not set # CONFIG_RTC_DRV_BQ32K is not set # CONFIG_RTC_DRV_S35390A is not set # CONFIG_RTC_DRV_FM3130 is not set +# CONFIG_RTC_DRV_RX8010 is not set # CONFIG_RTC_DRV_RX8581 is not set # CONFIG_RTC_DRV_RX8025 is not set # CONFIG_RTC_DRV_EM3027 is not set -# CONFIG_RTC_DRV_RV3029C2 is not set # CONFIG_RTC_DRV_RV8803 is not set # @@ -4669,17 +4128,27 @@ CONFIG_RTC_INTF_DEV=y # # CONFIG_RTC_DRV_M41T93 is not set # CONFIG_RTC_DRV_M41T94 is not set +# CONFIG_RTC_DRV_DS1302 is not set # CONFIG_RTC_DRV_DS1305 is not set # CONFIG_RTC_DRV_DS1343 is not set # CONFIG_RTC_DRV_DS1347 is not set # CONFIG_RTC_DRV_DS1390 is not set -# CONFIG_RTC_DRV_MAX6902 is not set +# CONFIG_RTC_DRV_MAX6916 is not set # CONFIG_RTC_DRV_R9701 is not set +# CONFIG_RTC_DRV_RX4581 is not set +# CONFIG_RTC_DRV_RX6110 is not set # CONFIG_RTC_DRV_RS5C348 is not set -# CONFIG_RTC_DRV_DS3234 is not set +# CONFIG_RTC_DRV_MAX6902 is not set # CONFIG_RTC_DRV_PCF2123 is not set -# CONFIG_RTC_DRV_RX4581 is not set # CONFIG_RTC_DRV_MCP795 is not set +CONFIG_RTC_I2C_AND_SPI=y + +# +# SPI and I2C RTC drivers +# +# CONFIG_RTC_DRV_DS3232 is not set +# CONFIG_RTC_DRV_PCF2127 is not set +# CONFIG_RTC_DRV_RV3029C2 is not set # # Platform RTC drivers @@ -4708,7 +4177,9 @@ CONFIG_RTC_DRV_EFI=y # CONFIG_RTC_DRV_PL031 is not set # CONFIG_RTC_DRV_MV is not set CONFIG_RTC_DRV_ARMADA38X=y +# CONFIG_RTC_DRV_FTRTC010 is not set # CONFIG_RTC_DRV_SNVS is not set +# CONFIG_RTC_DRV_R7301 is not set # # HID Sensor RTC drivers @@ -4724,12 +4195,18 @@ CONFIG_ASYNC_TX_ENABLE_CHANNEL_SWITCH=y CONFIG_DMA_ENGINE=y CONFIG_DMA_ACPI=y CONFIG_DMA_OF=y +# CONFIG_ALTERA_MSGDMA is not set # CONFIG_AMBA_PL08X is not set +CONFIG_BCM_SBA_RAID=m # CONFIG_FSL_EDMA is not set # CONFIG_INTEL_IDMA64 is not set CONFIG_MV_XOR=y CONFIG_MV_XOR_V2=y # CONFIG_PL330_DMA is not set +# CONFIG_XILINX_DMA is not set +# CONFIG_XILINX_ZYNQMP_DMA is not set +# CONFIG_QCOM_HIDMA_MGMT is not set +# CONFIG_QCOM_HIDMA is not set # CONFIG_DW_DMAC is not set # CONFIG_DW_DMAC_PCI is not set @@ -4739,21 +4216,25 @@ CONFIG_MV_XOR_V2=y CONFIG_ASYNC_TX_DMA=y CONFIG_DMATEST=y CONFIG_DMA_ENGINE_RAID=y + +# +# DMABUF options +# +# CONFIG_SYNC_FILE is not set # CONFIG_AUXDISPLAY is not set # CONFIG_UIO is not set CONFIG_VFIO_IOMMU_TYPE1=y CONFIG_VFIO_VIRQFD=y CONFIG_VFIO=y +# CONFIG_VFIO_NOIOMMU is not set CONFIG_VFIO_PCI=y CONFIG_VFIO_PCI_MMAP=y CONFIG_VFIO_PCI_INTX=y CONFIG_VFIO_PLATFORM=y # CONFIG_VFIO_AMBA is not set # CONFIG_VFIO_PLATFORM_CALXEDAXGMAC_RESET is not set -CONFIG_VFIO_PLATFORM_XHCI_RESET=y -CONFIG_VFIO_PLATFORM_XOR_V2_RESET=y -CONFIG_VFIO_PLATFORM_AHCI_RESET=y # CONFIG_VFIO_PLATFORM_AMDXGBE_RESET is not set +# CONFIG_VFIO_MDEV is not set CONFIG_IRQ_BYPASS_MANAGER=y CONFIG_VIRT_DRIVERS=y CONFIG_VIRTIO=y @@ -4771,21 +4252,87 @@ CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES=y # # Microsoft Hyper-V guest support # +# CONFIG_HYPERV_TSCPAGE is not set + +# +# Xen driver support +# +CONFIG_XEN_BALLOON=y +CONFIG_XEN_SCRUB_PAGES=y +CONFIG_XEN_DEV_EVTCHN=m +CONFIG_XEN_BACKEND=y +CONFIG_XENFS=m +CONFIG_XEN_COMPAT_XENFS=y +CONFIG_XEN_SYS_HYPERVISOR=y +CONFIG_XEN_XENBUS_FRONTEND=y +CONFIG_XEN_GNTDEV=m +CONFIG_XEN_GRANT_DEV_ALLOC=m +CONFIG_SWIOTLB_XEN=y +# CONFIG_XEN_PVCALLS_BACKEND is not set +CONFIG_XEN_PRIVCMD=m +CONFIG_XEN_EFI=y +CONFIG_XEN_AUTO_XLATE=y CONFIG_STAGING=y +CONFIG_IRDA=m + +# +# IrDA protocols +# +CONFIG_IRLAN=m +CONFIG_IRNET=m +CONFIG_IRCOMM=m +CONFIG_IRDA_ULTRA=y + +# +# IrDA options +# +CONFIG_IRDA_CACHE_LAST_LSAP=y +CONFIG_IRDA_FAST_RR=y +# CONFIG_IRDA_DEBUG is not set + +# +# Infrared-port device drivers +# + +# +# SIR device drivers +# +CONFIG_IRTTY_SIR=m + +# +# Dongle support +# +CONFIG_DONGLE=y +CONFIG_ESI_DONGLE=m +CONFIG_ACTISYS_DONGLE=m +CONFIG_TEKRAM_DONGLE=m +CONFIG_TOIM3232_DONGLE=m +CONFIG_LITELINK_DONGLE=m +CONFIG_MA600_DONGLE=m +CONFIG_GIRBIL_DONGLE=m +CONFIG_MCP2120_DONGLE=m +CONFIG_OLD_BELKIN_DONGLE=m +CONFIG_ACT200L_DONGLE=m +CONFIG_KINGSUN_DONGLE=m +CONFIG_KSDAZZLE_DONGLE=m +CONFIG_KS959_DONGLE=m + +# +# FIR device drivers +# +CONFIG_USB_IRDA=m +CONFIG_SIGMATEL_FIR=m +CONFIG_VLSI_FIR=m +CONFIG_MCS_FIR=m # CONFIG_PRISM2_USB is not set # CONFIG_COMEDI is not set -CONFIG_RTL8192U=m -CONFIG_RTLLIB=m -CONFIG_RTLLIB_CRYPTO_CCMP=m -CONFIG_RTLLIB_CRYPTO_TKIP=m -CONFIG_RTLLIB_CRYPTO_WEP=m -CONFIG_RTL8192E=m -CONFIG_R8712U=m +# CONFIG_RTL8192U is not set +# CONFIG_RTLLIB is not set +CONFIG_RTL8723BS=m +# CONFIG_R8712U is not set CONFIG_R8188EU=m CONFIG_88EU_AP_MODE=y -CONFIG_R8723AU=m -CONFIG_8723AU_AP_MODE=y -CONFIG_8723AU_BT_COEXIST=y +# CONFIG_R8822BE is not set # CONFIG_RTS5208 is not set CONFIG_VT6655=m CONFIG_VT6656=m @@ -4796,58 +4343,35 @@ CONFIG_VT6656=m # Speakup console speech # # CONFIG_SPEAKUP is not set -# CONFIG_TOUCHSCREEN_SYNAPTICS_I2C_RMI4 is not set # CONFIG_STAGING_MEDIA is not set # # Android # # CONFIG_STAGING_BOARD is not set -# CONFIG_WIMAX_GDM72XX is not set # CONFIG_LTE_GDM724X is not set CONFIG_MTD_SPINAND_MT29F=y CONFIG_MTD_SPINAND_ONDIEECC=y -# CONFIG_MTD_SPINAND_GD5F is not set -# CONFIG_LUSTRE_FS is not set +# CONFIG_LNET is not set # CONFIG_DGNC is not set -# CONFIG_DGAP is not set # CONFIG_GS_FPGABOOT is not set # CONFIG_COMMON_CLK_XLNX_CLKWZRD is not set -CONFIG_FB_TFT=m -CONFIG_FB_TFT_AGM1264K_FL=m -CONFIG_FB_TFT_BD663474=m -CONFIG_FB_TFT_HX8340BN=m -CONFIG_FB_TFT_HX8347D=m -CONFIG_FB_TFT_HX8353D=m -CONFIG_FB_TFT_HX8357D=m -CONFIG_FB_TFT_ILI9163=m -CONFIG_FB_TFT_ILI9320=m -CONFIG_FB_TFT_ILI9325=m -CONFIG_FB_TFT_ILI9340=m -CONFIG_FB_TFT_ILI9341=m -CONFIG_FB_TFT_ILI9481=m -CONFIG_FB_TFT_ILI9486=m -CONFIG_FB_TFT_PCD8544=m -CONFIG_FB_TFT_RA8875=m -CONFIG_FB_TFT_S6D02A1=m -CONFIG_FB_TFT_S6D1121=m -CONFIG_FB_TFT_SSD1289=m -CONFIG_FB_TFT_SSD1306=m -CONFIG_FB_TFT_SSD1331=m -CONFIG_FB_TFT_SSD1351=m -CONFIG_FB_TFT_ST7735R=m -CONFIG_FB_TFT_ST7789V=m -CONFIG_FB_TFT_TINYLCD=m -CONFIG_FB_TFT_TLS8204=m -CONFIG_FB_TFT_UC1611=m -CONFIG_FB_TFT_UC1701=m -CONFIG_FB_TFT_UPD161704=m -CONFIG_FB_TFT_WATTEROTT=m -CONFIG_FB_FLEX=m -CONFIG_FB_TFT_FBTFT_DEVICE=m -# CONFIG_FSL_MC_BUS is not set -# CONFIG_WILC1000_DRIVER is not set +# CONFIG_FB_TFT is not set +# CONFIG_WILC1000_SDIO is not set +# CONFIG_WILC1000_SPI is not set # CONFIG_MOST is not set +# CONFIG_KS7010 is not set +# CONFIG_GREYBUS is not set +CONFIG_CRYPTO_DEV_CCREE=m + +# +# USB Power Delivery and Type-C drivers +# +CONFIG_TYPEC_TCPM=m +CONFIG_TYPEC_TCPCI=m +CONFIG_TYPEC_FUSB302=m +# CONFIG_PI433 is not set +# CONFIG_GOLDFISH is not set # CONFIG_CHROME_PLATFORMS is not set CONFIG_CLKDEV_LOOKUP=y CONFIG_HAVE_CLK_PREPARE=y @@ -4859,49 +4383,54 @@ CONFIG_COMMON_CLK=y CONFIG_COMMON_CLK_VERSATILE=y CONFIG_CLK_SP810=y CONFIG_CLK_VEXPRESS_OSC=y +# CONFIG_CLK_HSDK is not set # CONFIG_COMMON_CLK_SCPI is not set # CONFIG_COMMON_CLK_SI5351 is not set # CONFIG_COMMON_CLK_SI514 is not set # CONFIG_COMMON_CLK_SI570 is not set +# CONFIG_COMMON_CLK_CDCE706 is not set # CONFIG_COMMON_CLK_CDCE925 is not set +# CONFIG_COMMON_CLK_CS2000_CP is not set # CONFIG_CLK_QORIQ is not set CONFIG_COMMON_CLK_XGENE=y +# CONFIG_COMMON_CLK_NXP is not set +CONFIG_COMMON_CLK_PWM=m # CONFIG_COMMON_CLK_PXA is not set -# CONFIG_COMMON_CLK_CDCE706 is not set -CONFIG_MVEBU_CLK_COMMON=y +# CONFIG_COMMON_CLK_PIC32 is not set +# CONFIG_COMMON_CLK_VC5 is not set CONFIG_ARMADA_37XX_CLK=y -CONFIG_ARMADA_CP110_SYSCON=y CONFIG_ARMADA_AP806_SYSCON=y -CONFIG_ARMADA_AP806_CORE_CLK=y -CONFIG_ARMADA_AP806_RING_CLK=y -CONFIG_ARMADA_AP806_CPU_CLK=y -CONFIG_ARMADA_37XX_PM_CLK=y - -# -# Hardware Spinlock drivers -# +CONFIG_ARMADA_CP110_SYSCON=y +CONFIG_HWSPINLOCK=m # # Clock Source drivers # -CONFIG_CLKSRC_OF=y -CONFIG_CLKSRC_ACPI=y -CONFIG_CLKSRC_PROBE=y +CONFIG_TIMER_OF=y +CONFIG_TIMER_ACPI=y +CONFIG_TIMER_PROBE=y CONFIG_CLKSRC_MMIO=y CONFIG_ARM_ARCH_TIMER=y CONFIG_ARM_ARCH_TIMER_EVTSTREAM=y +CONFIG_ARM_ARCH_TIMER_OOL_WORKAROUND=y +CONFIG_FSL_ERRATUM_A008585=y +CONFIG_HISILICON_ERRATUM_161010101=y +CONFIG_ARM64_ERRATUM_858921=y # CONFIG_ARM_TIMER_SP804 is not set # CONFIG_ATMEL_PIT is not set # CONFIG_SH_TIMER_CMT is not set # CONFIG_SH_TIMER_MTU2 is not set # CONFIG_SH_TIMER_TMU is not set # CONFIG_EM_TIMER_STI is not set +CONFIG_CLKSRC_VERSATILE=y CONFIG_MAILBOX=y CONFIG_ARM_MHU=m +# CONFIG_PLATFORM_MHU is not set # CONFIG_PL320_MBOX is not set CONFIG_PCC=y # CONFIG_ALTERA_MBOX is not set # CONFIG_MAILBOX_TEST is not set +# CONFIG_BCM_FLEXRM_MBOX is not set CONFIG_IOMMU_API=y CONFIG_IOMMU_SUPPORT=y @@ -4911,6 +4440,7 @@ CONFIG_IOMMU_SUPPORT=y CONFIG_IOMMU_IO_PGTABLE=y CONFIG_IOMMU_IO_PGTABLE_LPAE=y # CONFIG_IOMMU_IO_PGTABLE_LPAE_SELFTEST is not set +# CONFIG_IOMMU_IO_PGTABLE_ARMV7S is not set CONFIG_IOMMU_IOVA=y CONFIG_OF_IOMMU=y CONFIG_IOMMU_DMA=y @@ -4920,15 +4450,36 @@ CONFIG_ARM_SMMU=y # # Remoteproc drivers # -# CONFIG_STE_MODEM_RPROC is not set +# CONFIG_REMOTEPROC is not set # # Rpmsg drivers # +CONFIG_RPMSG=m +# CONFIG_RPMSG_CHAR is not set +CONFIG_RPMSG_QCOM_GLINK_NATIVE=m +CONFIG_RPMSG_QCOM_GLINK_RPM=m # # SOC (System On Chip) specific Drivers # + +# +# Amlogic SoC drivers +# + +# +# Broadcom SoC drivers +# +# CONFIG_SOC_BRCMSTB is not set + +# +# i.MX SoC drivers +# + +# +# Qualcomm SoC drivers +# # CONFIG_SUNXI_SRAM is not set # CONFIG_SOC_TI is not set # CONFIG_PM_DEVFREQ is not set @@ -4937,43 +4488,56 @@ CONFIG_EXTCON=y # # Extcon Device Drivers # -CONFIG_EXTCON_GPIO=m -CONFIG_EXTCON_RT8973A=m -CONFIG_EXTCON_SM5502=m -CONFIG_EXTCON_USB_GPIO=m +# CONFIG_EXTCON_GPIO is not set +# CONFIG_EXTCON_MAX3355 is not set +# CONFIG_EXTCON_RT8973A is not set +# CONFIG_EXTCON_SM5502 is not set +# CONFIG_EXTCON_USB_GPIO is not set # CONFIG_MEMORY is not set # CONFIG_IIO is not set # CONFIG_NTB is not set # CONFIG_VME_BUS is not set -# CONFIG_PWM is not set +CONFIG_PWM=y +CONFIG_PWM_SYSFS=y +CONFIG_PWM_FSL_FTM=m +CONFIG_PWM_PCA9685=m CONFIG_IRQCHIP=y CONFIG_ARM_GIC=y +CONFIG_ARM_GIC_MAX_NR=1 CONFIG_ARM_GIC_V2M=y CONFIG_ARM_GIC_V3=y CONFIG_ARM_GIC_V3_ITS=y +CONFIG_MVEBU_GICP=y +CONFIG_MVEBU_ICU=y +CONFIG_MVEBU_ODMI=y CONFIG_MVEBU_PIC=y -CONFIG_MVEBU_SEI_IRQ=y -CONFIG_MVEBU_ICU_IRQ=y +CONFIG_PARTITION_PERCPU=y # CONFIG_IPACK_BUS is not set CONFIG_RESET_CONTROLLER=y +# CONFIG_RESET_ATH79 is not set +# CONFIG_RESET_BERLIN is not set +# CONFIG_RESET_IMX7 is not set +# CONFIG_RESET_LANTIQ is not set +# CONFIG_RESET_LPC18XX is not set +# CONFIG_RESET_MESON is not set +# CONFIG_RESET_PISTACHIO is not set +# CONFIG_RESET_SOCFPGA is not set +# CONFIG_RESET_STM32 is not set +# CONFIG_RESET_SUNXI is not set +# CONFIG_RESET_TI_SYSCON is not set +# CONFIG_RESET_ZYNQ is not set +# CONFIG_RESET_TEGRA_BPMP is not set # CONFIG_FMC is not set # # PHY Subsystem # CONFIG_GENERIC_PHY=y +CONFIG_PHY_XGENE=y +# CONFIG_BCM_KONA_USB2_PHY is not set +# CONFIG_PHY_MVEBU_CP110_COMPHY is not set # CONFIG_PHY_PXA_28NM_HSIC is not set # CONFIG_PHY_PXA_28NM_USB2 is not set -CONFIG_PHY_MVEBU_COMPHY=y -CONFIG_PHY_MVEBU_COMPHY_CP110=y -CONFIG_PHY_MVEBU_COMPHY_A3700=y -CONFIG_PHY_MVEBU_UTMI=y -# CONFIG_BCM_KONA_USB2_PHY is not set -CONFIG_PHY_SAMSUNG_USB2=m -# CONFIG_PHY_EXYNOS4210_USB2 is not set -# CONFIG_PHY_EXYNOS4X12_USB2 is not set -# CONFIG_PHY_EXYNOS5250_USB2 is not set -CONFIG_PHY_XGENE=y # CONFIG_POWERCAP is not set # CONFIG_MCB is not set @@ -4981,41 +4545,53 @@ CONFIG_PHY_XGENE=y # Performance monitor support # CONFIG_ARM_PMU=y -CONFIG_MVEBU_SPMU=y +CONFIG_ARM_PMU_ACPI=y CONFIG_RAS=y -CONFIG_PHONE=y -CONFIG_MVEBU_PHONE=y - -# -# Marvell Telephony options -# -# CONFIG_THUNDERBOLT is not set # # Android # # CONFIG_ANDROID is not set # CONFIG_LIBNVDIMM is not set -# CONFIG_NVMEM is not set +CONFIG_DAX=y +# CONFIG_DEV_DAX is not set +CONFIG_NVMEM=y # CONFIG_STM is not set -# CONFIG_STM_DUMMY is not set -# CONFIG_STM_SOURCE_CONSOLE is not set # CONFIG_INTEL_TH is not set +# CONFIG_FPGA is not set # -# FPGA Configuration Support +# FSI support # -# CONFIG_FPGA is not set +# CONFIG_FSI is not set +CONFIG_TEE=m + +# +# TEE drivers +# +CONFIG_OPTEE=m +CONFIG_MULTIPLEXER=m + +# +# Multiplexer drivers +# +# CONFIG_MUX_ADG792A is not set +# CONFIG_MUX_GPIO is not set +# CONFIG_MUX_MMIO is not set # # Firmware Drivers # CONFIG_ARM_PSCI_FW=y +# CONFIG_ARM_PSCI_CHECKER is not set CONFIG_ARM_SCPI_PROTOCOL=m +CONFIG_ARM_SCPI_POWER_DOMAIN=m # CONFIG_FIRMWARE_MEMMAP is not set CONFIG_DMIID=y # CONFIG_DMI_SYSFS is not set +# CONFIG_FW_CFG_SYSFS is not set CONFIG_HAVE_ARM_SMCCC=y +# CONFIG_GOOGLE_FIRMWARE is not set # # EFI (Extensible Firmware Interface) Support @@ -5025,51 +4601,68 @@ CONFIG_EFI_ESRT=y CONFIG_EFI_PARAMS_FROM_FDT=y CONFIG_EFI_RUNTIME_WRAPPERS=y CONFIG_EFI_ARMSTUB=y +# CONFIG_EFI_CAPSULE_LOADER is not set +# CONFIG_EFI_TEST is not set +# CONFIG_RESET_ATTACK_MITIGATION is not set +# CONFIG_EFI_DEV_PATH_PARSER is not set +# CONFIG_MESON_SM is not set + +# +# Tegra firmware driver +# CONFIG_ACPI=y CONFIG_ACPI_GENERIC_GSI=y CONFIG_ACPI_CCA_REQUIRED=y # CONFIG_ACPI_DEBUGGER is not set +CONFIG_ACPI_SPCR_TABLE=y # CONFIG_ACPI_EC_DEBUGFS is not set CONFIG_ACPI_BUTTON=y CONFIG_ACPI_FAN=y # CONFIG_ACPI_DOCK is not set +CONFIG_ACPI_PROCESSOR_IDLE=y +CONFIG_ACPI_MCFG=y CONFIG_ACPI_CPPC_LIB=y CONFIG_ACPI_PROCESSOR=y CONFIG_ACPI_HOTPLUG_CPU=y CONFIG_ACPI_THERMAL=y +CONFIG_ACPI_NUMA=y # CONFIG_ACPI_CUSTOM_DSDT is not set +CONFIG_ARCH_HAS_ACPI_TABLE_UPGRADE=y +CONFIG_ACPI_TABLE_UPGRADE=y # CONFIG_ACPI_DEBUG is not set # CONFIG_ACPI_PCI_SLOT is not set CONFIG_ACPI_CONTAINER=y # CONFIG_ACPI_HED is not set # CONFIG_ACPI_CUSTOM_METHOD is not set +# CONFIG_ACPI_BGRT is not set CONFIG_ACPI_REDUCED_HARDWARE_ONLY=y +CONFIG_HAVE_ACPI_APEI=y +# CONFIG_ACPI_APEI is not set # CONFIG_PMIC_OPREGION is not set +# CONFIG_ACPI_CONFIGFS is not set +CONFIG_ACPI_IORT=y +CONFIG_ACPI_GTDT=y # # File systems # CONFIG_DCACHE_WORD_ACCESS=y -# CONFIG_EXT2_FS is not set -# CONFIG_EXT3_FS is not set +CONFIG_EXT2_FS=y +# CONFIG_EXT2_FS_XATTR is not set +CONFIG_EXT3_FS=y +CONFIG_EXT3_FS_POSIX_ACL=y +CONFIG_EXT3_FS_SECURITY=y CONFIG_EXT4_FS=y -CONFIG_EXT4_USE_FOR_EXT2=y CONFIG_EXT4_FS_POSIX_ACL=y CONFIG_EXT4_FS_SECURITY=y -CONFIG_EXT4_ENCRYPTION=y -CONFIG_EXT4_FS_ENCRYPTION=y +# CONFIG_EXT4_ENCRYPTION is not set # CONFIG_EXT4_DEBUG is not set CONFIG_JBD2=y # CONFIG_JBD2_DEBUG is not set CONFIG_FS_MBCACHE=y # CONFIG_REISERFS_FS is not set # CONFIG_JFS_FS is not set -CONFIG_XFS_FS=y -CONFIG_XFS_QUOTA=y -CONFIG_XFS_POSIX_ACL=y -CONFIG_XFS_RT=y -# CONFIG_XFS_WARN is not set -# CONFIG_XFS_DEBUG is not set +# CONFIG_XFS_FS is not set # CONFIG_GFS2_FS is not set # CONFIG_OCFS2_FS is not set CONFIG_BTRFS_FS=y @@ -5079,62 +4672,53 @@ CONFIG_BTRFS_FS_POSIX_ACL=y # CONFIG_BTRFS_DEBUG is not set # CONFIG_BTRFS_ASSERT is not set # CONFIG_NILFS2_FS is not set -CONFIG_F2FS_FS=y -CONFIG_F2FS_STAT_FS=y -CONFIG_F2FS_FS_XATTR=y -CONFIG_F2FS_FS_POSIX_ACL=y -CONFIG_F2FS_FS_SECURITY=y -# CONFIG_F2FS_CHECK_FS is not set -CONFIG_F2FS_FS_ENCRYPTION=y +# CONFIG_F2FS_FS is not set # CONFIG_FS_DAX is not set CONFIG_FS_POSIX_ACL=y CONFIG_EXPORTFS=y +# CONFIG_EXPORTFS_BLOCK_OPS is not set CONFIG_FILE_LOCKING=y +CONFIG_MANDATORY_FILE_LOCKING=y +# CONFIG_FS_ENCRYPTION is not set CONFIG_FSNOTIFY=y CONFIG_DNOTIFY=y CONFIG_INOTIFY_USER=y CONFIG_FANOTIFY=y CONFIG_FANOTIFY_ACCESS_PERMISSIONS=y CONFIG_QUOTA=y -# CONFIG_QUOTA_NETLINK_INTERFACE is not set +CONFIG_QUOTA_NETLINK_INTERFACE=y CONFIG_PRINT_QUOTA_WARNING=y # CONFIG_QUOTA_DEBUG is not set -CONFIG_QUOTA_TREE=m # CONFIG_QFMT_V1 is not set -CONFIG_QFMT_V2=m +# CONFIG_QFMT_V2 is not set CONFIG_QUOTACTL=y CONFIG_AUTOFS4_FS=m CONFIG_FUSE_FS=m CONFIG_CUSE=m CONFIG_OVERLAY_FS=m +# CONFIG_OVERLAY_FS_REDIRECT_DIR is not set +# CONFIG_OVERLAY_FS_INDEX is not set # # Caches # -CONFIG_FSCACHE=m -# CONFIG_FSCACHE_STATS is not set -# CONFIG_FSCACHE_HISTOGRAM is not set -# CONFIG_FSCACHE_DEBUG is not set -# CONFIG_FSCACHE_OBJECT_LIST is not set -# CONFIG_CACHEFILES is not set +# CONFIG_FSCACHE is not set # # CD-ROM/DVD Filesystems # -CONFIG_ISO9660_FS=m -CONFIG_JOLIET=y -CONFIG_ZISOFS=y -CONFIG_UDF_FS=m -CONFIG_UDF_NLS=y +# CONFIG_ISO9660_FS is not set +# CONFIG_UDF_FS is not set # # DOS/FAT/NT Filesystems # CONFIG_FAT_FS=y -CONFIG_MSDOS_FS=y +# CONFIG_MSDOS_FS is not set CONFIG_VFAT_FS=y CONFIG_FAT_DEFAULT_CODEPAGE=437 CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" +# CONFIG_FAT_DEFAULT_UTF8 is not set # CONFIG_NTFS_FS is not set # @@ -5142,6 +4726,7 @@ CONFIG_FAT_DEFAULT_IOCHARSET="iso8859-1" # CONFIG_PROC_FS=y # CONFIG_PROC_KCORE is not set +CONFIG_PROC_VMCORE=y CONFIG_PROC_SYSCTL=y CONFIG_PROC_PAGE_MONITOR=y CONFIG_PROC_CHILDREN=y @@ -5152,9 +4737,11 @@ CONFIG_TMPFS_POSIX_ACL=y CONFIG_TMPFS_XATTR=y CONFIG_HUGETLBFS=y CONFIG_HUGETLB_PAGE=y +CONFIG_ARCH_HAS_GIGANTIC_PAGE=y CONFIG_CONFIGFS_FS=y CONFIG_EFIVAR_FS=y CONFIG_MISC_FILESYSTEMS=y +# CONFIG_ORANGEFS_FS is not set # CONFIG_ADFS_FS is not set # CONFIG_AFFS_FS is not set # CONFIG_ECRYPT_FS is not set @@ -5179,7 +4766,8 @@ CONFIG_UBIFS_FS=y CONFIG_UBIFS_FS_LZO=y CONFIG_UBIFS_FS_ZLIB=y # CONFIG_UBIFS_ATIME_SUPPORT is not set -# CONFIG_LOGFS is not set +# CONFIG_UBIFS_FS_ENCRYPTION is not set +CONFIG_UBIFS_FS_SECURITY=y # CONFIG_CRAMFS is not set # CONFIG_SQUASHFS is not set # CONFIG_VXFS_FS is not set @@ -5205,6 +4793,7 @@ CONFIG_AUFS_SBILIST=y # CONFIG_AUFS_XATTR is not set # CONFIG_AUFS_FHSM is not set # CONFIG_AUFS_RDU is not set +# CONFIG_AUFS_DIRREN is not set # CONFIG_AUFS_SHWH is not set # CONFIG_AUFS_BR_RAMFS is not set # CONFIG_AUFS_BR_FUSE is not set @@ -5217,27 +4806,15 @@ CONFIG_NFS_V2=y CONFIG_NFS_V3=y CONFIG_NFS_V3_ACL=y CONFIG_NFS_V4=y -CONFIG_NFS_SWAP=y -CONFIG_NFS_V4_1=y -CONFIG_NFS_V4_2=y -CONFIG_PNFS_FILE_LAYOUT=y -CONFIG_PNFS_BLOCK=m -CONFIG_PNFS_OBJLAYOUT=m -CONFIG_PNFS_FLEXFILE_LAYOUT=m -CONFIG_NFS_V4_1_IMPLEMENTATION_ID_DOMAIN="kernel.org" -CONFIG_NFS_V4_1_MIGRATION=y -CONFIG_NFS_V4_SECURITY_LABEL=y +# CONFIG_NFS_SWAP is not set +# CONFIG_NFS_V4_1 is not set CONFIG_ROOT_NFS=y # CONFIG_NFS_USE_LEGACY_DNS is not set CONFIG_NFS_USE_KERNEL_DNS=y -CONFIG_NFSD=m -CONFIG_NFSD_V2_ACL=y +CONFIG_NFSD=y CONFIG_NFSD_V3=y -CONFIG_NFSD_V3_ACL=y -CONFIG_NFSD_V4=y -CONFIG_NFSD_PNFS=y -CONFIG_NFSD_V4_SECURITY_LABEL=y -CONFIG_NFSD_FAULT_INJECTION=y +# CONFIG_NFSD_V3_ACL is not set +# CONFIG_NFSD_V4 is not set CONFIG_GRACE_PERIOD=y CONFIG_LOCKD=y CONFIG_LOCKD_V4=y @@ -5245,30 +4822,13 @@ CONFIG_NFS_ACL_SUPPORT=y CONFIG_NFS_COMMON=y CONFIG_SUNRPC=y CONFIG_SUNRPC_GSS=y -CONFIG_SUNRPC_BACKCHANNEL=y -CONFIG_SUNRPC_SWAP=y -CONFIG_RPCSEC_GSS_KRB5=m # CONFIG_SUNRPC_DEBUG is not set -CONFIG_CEPH_FS=m -CONFIG_CEPH_FSCACHE=y -CONFIG_CEPH_FS_POSIX_ACL=y -CONFIG_CIFS=m -# CONFIG_CIFS_STATS is not set -CONFIG_CIFS_WEAK_PW_HASH=y -CONFIG_CIFS_UPCALL=y -CONFIG_CIFS_XATTR=y -CONFIG_CIFS_POSIX=y -CONFIG_CIFS_ACL=y -# CONFIG_CIFS_DEBUG is not set -CONFIG_CIFS_DFS_UPCALL=y -CONFIG_CIFS_SMB2=y -CONFIG_CIFS_SMB311=y -CONFIG_CIFS_FSCACHE=y +# CONFIG_CEPH_FS is not set +# CONFIG_CIFS is not set # CONFIG_NCP_FS is not set # CONFIG_CODA_FS is not set # CONFIG_AFS_FS is not set CONFIG_9P_FS=m -# CONFIG_9P_FSCACHE is not set # CONFIG_9P_FS_POSIX_ACL is not set # CONFIG_9P_FS_SECURITY is not set CONFIG_NLS=y @@ -5323,19 +4883,25 @@ CONFIG_NLS_ISO8859_1=y # CONFIG_NLS_MAC_TURKISH is not set # CONFIG_NLS_UTF8 is not set # CONFIG_DLM is not set -CONFIG_SPLICE_FROM_SOCKET=y +CONFIG_HAVE_KVM_IRQCHIP=y CONFIG_HAVE_KVM_IRQFD=y +CONFIG_HAVE_KVM_IRQ_ROUTING=y CONFIG_HAVE_KVM_EVENTFD=y CONFIG_KVM_MMIO=y +CONFIG_HAVE_KVM_MSI=y CONFIG_HAVE_KVM_CPU_RELAX_INTERCEPT=y CONFIG_KVM_VFIO=y CONFIG_HAVE_KVM_ARCH_TLB_FLUSH_ALL=y CONFIG_KVM_GENERIC_DIRTYLOG_READ_PROTECT=y CONFIG_KVM_COMPAT=y CONFIG_VIRTUALIZATION=y -CONFIG_KVM_ARM_VGIC_V3=y CONFIG_KVM=y CONFIG_KVM_ARM_HOST=y +CONFIG_KVM_ARM_PMU=y +CONFIG_VHOST_NET=y +# CONFIG_VHOST_VSOCK is not set +CONFIG_VHOST=y +# CONFIG_VHOST_CROSS_ENDIAN_LEGACY is not set # # Kernel hacking @@ -5345,6 +4911,7 @@ CONFIG_KVM_ARM_HOST=y # printk and dmesg options # CONFIG_PRINTK_TIME=y +CONFIG_CONSOLE_LOGLEVEL_DEFAULT=7 CONFIG_MESSAGE_LOGLEVEL_DEFAULT=4 # CONFIG_BOOT_PRINTK_DELAY is not set # CONFIG_DYNAMIC_DEBUG is not set @@ -5369,6 +4936,7 @@ CONFIG_FRAME_POINTER=y # CONFIG_DEBUG_FORCE_WEAK_PER_CPU is not set CONFIG_MAGIC_SYSRQ=y CONFIG_MAGIC_SYSRQ_DEFAULT_ENABLE=0x1 +CONFIG_MAGIC_SYSRQ_SERIAL=y CONFIG_DEBUG_KERNEL=y # @@ -5376,6 +4944,8 @@ CONFIG_DEBUG_KERNEL=y # # CONFIG_PAGE_EXTENSION is not set # CONFIG_DEBUG_PAGEALLOC is not set +# CONFIG_PAGE_POISONING is not set +# CONFIG_DEBUG_RODATA_TEST is not set # CONFIG_DEBUG_OBJECTS is not set # CONFIG_SLUB_DEBUG_ON is not set # CONFIG_SLUB_STATS is not set @@ -5383,22 +4953,25 @@ CONFIG_HAVE_DEBUG_KMEMLEAK=y # CONFIG_DEBUG_KMEMLEAK is not set # CONFIG_DEBUG_STACK_USAGE is not set # CONFIG_DEBUG_VM is not set +CONFIG_ARCH_HAS_DEBUG_VIRTUAL=y +# CONFIG_DEBUG_VIRTUAL is not set CONFIG_DEBUG_MEMORY_INIT=y # CONFIG_DEBUG_PER_CPU_MAPS is not set CONFIG_HAVE_ARCH_KASAN=y # CONFIG_KASAN is not set +CONFIG_ARCH_HAS_KCOV=y +# CONFIG_KCOV is not set # CONFIG_DEBUG_SHIRQ is not set # # Debug Lockups and Hangs # -CONFIG_LOCKUP_DETECTOR=y -# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set -CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0 +# CONFIG_SOFTLOCKUP_DETECTOR is not set CONFIG_DETECT_HUNG_TASK=y CONFIG_DEFAULT_HUNG_TASK_TIMEOUT=120 # CONFIG_BOOTPARAM_HUNG_TASK_PANIC is not set CONFIG_BOOTPARAM_HUNG_TASK_PANIC_VALUE=0 +# CONFIG_WQ_WATCHDOG is not set # CONFIG_PANIC_ON_OOPS is not set CONFIG_PANIC_ON_OOPS_VALUE=0 CONFIG_PANIC_TIMEOUT=0 @@ -5407,7 +4980,6 @@ CONFIG_SCHED_INFO=y # CONFIG_SCHEDSTATS is not set # CONFIG_SCHED_STACK_END_CHECK is not set # CONFIG_DEBUG_TIMEKEEPING is not set -# CONFIG_TIMER_STATS is not set # CONFIG_DEBUG_PREEMPT is not set # @@ -5423,7 +4995,9 @@ CONFIG_SCHED_INFO=y # CONFIG_DEBUG_ATOMIC_SLEEP is not set # CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set # CONFIG_LOCK_TORTURE_TEST is not set +# CONFIG_WW_MUTEX_SELFTEST is not set # CONFIG_STACKTRACE is not set +# CONFIG_WARN_ALL_UNSEEDED_RANDOM is not set # CONFIG_DEBUG_KOBJECT is not set CONFIG_HAVE_DEBUG_BUGVERBOSE=y CONFIG_DEBUG_BUGVERBOSE=y @@ -5437,15 +5011,18 @@ CONFIG_DEBUG_BUGVERBOSE=y # RCU Debugging # # CONFIG_PROVE_RCU is not set -# CONFIG_SPARSE_RCU_POINTER is not set # CONFIG_TORTURE_TEST is not set +# CONFIG_RCU_PERF_TEST is not set # CONFIG_RCU_TORTURE_TEST is not set CONFIG_RCU_CPU_STALL_TIMEOUT=21 # CONFIG_RCU_TRACE is not set # CONFIG_RCU_EQS_DEBUG is not set +# CONFIG_DEBUG_WQ_FORCE_RR_CPU is not set # CONFIG_DEBUG_BLOCK_EXT_DEVT is not set +# CONFIG_CPU_HOTPLUG_STATE_CONTROL is not set # CONFIG_NOTIFIER_ERROR_INJECTION is not set # CONFIG_FAULT_INJECTION is not set +# CONFIG_LATENCYTOP is not set CONFIG_HAVE_FUNCTION_TRACER=y CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y CONFIG_HAVE_DYNAMIC_FTRACE=y @@ -5454,12 +5031,14 @@ CONFIG_HAVE_SYSCALL_TRACEPOINTS=y CONFIG_HAVE_C_RECORDMCOUNT=y CONFIG_TRACING_SUPPORT=y # CONFIG_FTRACE is not set +# CONFIG_DMA_API_DEBUG is not set # # Runtime Testing # # CONFIG_LKDTM is not set # CONFIG_TEST_LIST_SORT is not set +# CONFIG_TEST_SORT is not set # CONFIG_BACKTRACE_SELF_TEST is not set # CONFIG_RBTREE_TEST is not set # CONFIG_INTERVAL_TREE_TEST is not set @@ -5470,32 +5049,44 @@ CONFIG_TRACING_SUPPORT=y # CONFIG_TEST_STRING_HELPERS is not set # CONFIG_TEST_KSTRTOX is not set # CONFIG_TEST_PRINTF is not set +# CONFIG_TEST_BITMAP is not set +# CONFIG_TEST_UUID is not set # CONFIG_TEST_RHASHTABLE is not set -# CONFIG_DMA_API_DEBUG is not set +# CONFIG_TEST_HASH is not set # CONFIG_TEST_LKM is not set # CONFIG_TEST_USER_COPY is not set # CONFIG_TEST_BPF is not set # CONFIG_TEST_FIRMWARE is not set +# CONFIG_TEST_SYSCTL is not set # CONFIG_TEST_UDELAY is not set -CONFIG_MEMTEST=y # CONFIG_TEST_STATIC_KEYS is not set +# CONFIG_TEST_KMOD is not set +CONFIG_MEMTEST=y +# CONFIG_BUG_ON_DATA_CORRUPTION is not set # CONFIG_SAMPLES is not set CONFIG_HAVE_ARCH_KGDB=y # CONFIG_KGDB is not set -CONFIG_ARM64_PTDUMP=y +CONFIG_ARCH_HAS_UBSAN_SANITIZE_ALL=y +# CONFIG_ARCH_WANTS_UBSAN_NO_NULL is not set +# CONFIG_UBSAN is not set +CONFIG_ARCH_HAS_DEVMEM_IS_ALLOWED=y # CONFIG_STRICT_DEVMEM is not set +# CONFIG_ARM64_PTDUMP_CORE is not set +# CONFIG_ARM64_PTDUMP_DEBUGFS is not set # CONFIG_PID_IN_CONTEXTIDR is not set # CONFIG_ARM64_RANDOMIZE_TEXT_OFFSET is not set -# CONFIG_DEBUG_SET_MODULE_RONX is not set -# CONFIG_DEBUG_RODATA is not set +# CONFIG_DEBUG_WX is not set +# CONFIG_DEBUG_ALIGN_RODATA is not set +CONFIG_ARM64_RELOC_TEST=m CONFIG_CORESIGHT=y CONFIG_CORESIGHT_LINKS_AND_SINKS=y CONFIG_CORESIGHT_LINK_AND_SINK_TMC=y # CONFIG_CORESIGHT_SINK_TPIU is not set # CONFIG_CORESIGHT_SINK_ETBV10 is not set CONFIG_CORESIGHT_SOURCE_ETM4X=y -CONFIG_CORESIGHT_SOURCE_AXIM=y -# CONFIG_CORESIGHT_QCOM_REPLICATOR is not set +# CONFIG_CORESIGHT_DYNAMIC_REPLICATOR is not set +# CONFIG_CORESIGHT_STM is not set +CONFIG_CORESIGHT_CPU_DEBUG=m # # Security options @@ -5504,15 +5095,22 @@ CONFIG_KEYS=y CONFIG_KEYS_COMPAT=y # CONFIG_PERSISTENT_KEYRINGS is not set # CONFIG_BIG_KEYS is not set -CONFIG_ENCRYPTED_KEYS=y +# CONFIG_ENCRYPTED_KEYS is not set +# CONFIG_KEY_DH_OPERATIONS is not set # CONFIG_SECURITY_DMESG_RESTRICT is not set CONFIG_SECURITY=y +# CONFIG_SECURITY_WRITABLE_HOOKS is not set # CONFIG_SECURITYFS is not set # CONFIG_SECURITY_NETWORK is not set # CONFIG_SECURITY_PATH is not set +CONFIG_HAVE_HARDENED_USERCOPY_ALLOCATOR=y +# CONFIG_HARDENED_USERCOPY is not set +# CONFIG_FORTIFY_SOURCE is not set +# CONFIG_STATIC_USERMODEHELPER is not set # CONFIG_SECURITY_SMACK is not set # CONFIG_SECURITY_TOMOYO is not set # CONFIG_SECURITY_APPARMOR is not set +# CONFIG_SECURITY_LOADPIN is not set # CONFIG_SECURITY_YAMA is not set CONFIG_INTEGRITY=y # CONFIG_INTEGRITY_SIGNATURE is not set @@ -5527,6 +5125,8 @@ CONFIG_ASYNC_MEMCPY=y CONFIG_ASYNC_XOR=y CONFIG_ASYNC_PQ=y CONFIG_ASYNC_RAID6_RECOV=y +CONFIG_ASYNC_TX_DISABLE_PQ_VAL_DMA=y +CONFIG_ASYNC_TX_DISABLE_XOR_VAL_DMA=y CONFIG_CRYPTO=y # @@ -5542,17 +5142,20 @@ CONFIG_CRYPTO_HASH=y CONFIG_CRYPTO_HASH2=y CONFIG_CRYPTO_RNG=y CONFIG_CRYPTO_RNG2=y -CONFIG_CRYPTO_RNG_DEFAULT=y -CONFIG_CRYPTO_PCOMP=m -CONFIG_CRYPTO_PCOMP2=y +CONFIG_CRYPTO_RNG_DEFAULT=m CONFIG_CRYPTO_AKCIPHER2=y +CONFIG_CRYPTO_KPP2=y +CONFIG_CRYPTO_KPP=m +CONFIG_CRYPTO_ACOMP2=y # CONFIG_CRYPTO_RSA is not set +# CONFIG_CRYPTO_DH is not set +CONFIG_CRYPTO_ECDH=m CONFIG_CRYPTO_MANAGER=y CONFIG_CRYPTO_MANAGER2=y # CONFIG_CRYPTO_USER is not set CONFIG_CRYPTO_MANAGER_DISABLE_TESTS=y CONFIG_CRYPTO_GF128MUL=y -CONFIG_CRYPTO_NULL=y +CONFIG_CRYPTO_NULL=m CONFIG_CRYPTO_NULL2=y # CONFIG_CRYPTO_PCRYPT is not set CONFIG_CRYPTO_WORKQUEUE=y @@ -5560,7 +5163,8 @@ CONFIG_CRYPTO_CRYPTD=y # CONFIG_CRYPTO_MCRYPTD is not set CONFIG_CRYPTO_AUTHENC=m # CONFIG_CRYPTO_TEST is not set -CONFIG_CRYPTO_ABLK_HELPER=y +CONFIG_CRYPTO_SIMD=y +CONFIG_CRYPTO_ENGINE=m # # Authenticated Encryption with Associated Data @@ -5568,26 +5172,26 @@ CONFIG_CRYPTO_ABLK_HELPER=y CONFIG_CRYPTO_CCM=m CONFIG_CRYPTO_GCM=m # CONFIG_CRYPTO_CHACHA20POLY1305 is not set -CONFIG_CRYPTO_SEQIV=y +CONFIG_CRYPTO_SEQIV=m CONFIG_CRYPTO_ECHAINIV=m # # Block modes # CONFIG_CRYPTO_CBC=y -CONFIG_CRYPTO_CTR=y -CONFIG_CRYPTO_CTS=y -CONFIG_CRYPTO_ECB=y +CONFIG_CRYPTO_CTR=m +# CONFIG_CRYPTO_CTS is not set +CONFIG_CRYPTO_ECB=m # CONFIG_CRYPTO_LRW is not set CONFIG_CRYPTO_PCBC=m -CONFIG_CRYPTO_XTS=y +CONFIG_CRYPTO_XTS=m # CONFIG_CRYPTO_KEYWRAP is not set # # Hash modes # CONFIG_CRYPTO_CMAC=m -CONFIG_CRYPTO_HMAC=y +CONFIG_CRYPTO_HMAC=m # CONFIG_CRYPTO_XCBC is not set # CONFIG_CRYPTO_VMAC is not set @@ -5599,16 +5203,17 @@ CONFIG_CRYPTO_CRC32C=y CONFIG_CRYPTO_CRCT10DIF=y CONFIG_CRYPTO_GHASH=m # CONFIG_CRYPTO_POLY1305 is not set -CONFIG_CRYPTO_MD4=m +# CONFIG_CRYPTO_MD4 is not set CONFIG_CRYPTO_MD5=y CONFIG_CRYPTO_MICHAEL_MIC=m # CONFIG_CRYPTO_RMD128 is not set # CONFIG_CRYPTO_RMD160 is not set # CONFIG_CRYPTO_RMD256 is not set # CONFIG_CRYPTO_RMD320 is not set -CONFIG_CRYPTO_SHA1=m -CONFIG_CRYPTO_SHA256=y +CONFIG_CRYPTO_SHA1=y +CONFIG_CRYPTO_SHA256=m CONFIG_CRYPTO_SHA512=m +# CONFIG_CRYPTO_SHA3 is not set # CONFIG_CRYPTO_TGR192 is not set # CONFIG_CRYPTO_WP512 is not set @@ -5616,11 +5221,11 @@ CONFIG_CRYPTO_SHA512=m # Ciphers # CONFIG_CRYPTO_AES=y +# CONFIG_CRYPTO_AES_TI is not set # CONFIG_CRYPTO_ANUBIS is not set CONFIG_CRYPTO_ARC4=m -CONFIG_CRYPTO_BLOWFISH=m -CONFIG_CRYPTO_BLOWFISH_COMMON=m -CONFIG_CRYPTO_CAMELLIA=m +# CONFIG_CRYPTO_BLOWFISH is not set +# CONFIG_CRYPTO_CAMELLIA is not set # CONFIG_CRYPTO_CAST5 is not set # CONFIG_CRYPTO_CAST6 is not set CONFIG_CRYPTO_DES=m @@ -5637,7 +5242,6 @@ CONFIG_CRYPTO_FCRYPT=m # Compression # CONFIG_CRYPTO_DEFLATE=y -CONFIG_CRYPTO_ZLIB=m CONFIG_CRYPTO_LZO=y # CONFIG_CRYPTO_842 is not set CONFIG_CRYPTO_LZ4=m @@ -5647,35 +5251,46 @@ CONFIG_CRYPTO_LZ4=m # Random Number Generation # CONFIG_CRYPTO_ANSI_CPRNG=y -CONFIG_CRYPTO_DRBG_MENU=y +CONFIG_CRYPTO_DRBG_MENU=m CONFIG_CRYPTO_DRBG_HMAC=y # CONFIG_CRYPTO_DRBG_HASH is not set # CONFIG_CRYPTO_DRBG_CTR is not set -CONFIG_CRYPTO_DRBG=y -CONFIG_CRYPTO_JITTERENTROPY=y +CONFIG_CRYPTO_DRBG=m +CONFIG_CRYPTO_JITTERENTROPY=m # CONFIG_CRYPTO_USER_API_HASH is not set # CONFIG_CRYPTO_USER_API_SKCIPHER is not set # CONFIG_CRYPTO_USER_API_RNG is not set # CONFIG_CRYPTO_USER_API_AEAD is not set CONFIG_CRYPTO_HW=y -CONFIG_CRYPTO_DEV_MARVELL_CESA=m +# CONFIG_CRYPTO_DEV_MARVELL_CESA is not set +# CONFIG_CRYPTO_DEV_FSL_CAAM_CRYPTO_API_DESC is not set # CONFIG_CRYPTO_DEV_CCP is not set +CONFIG_CRYPTO_DEV_NITROX=m +CONFIG_CRYPTO_DEV_NITROX_CNN55XX=m +CONFIG_CRYPTO_DEV_CAVIUM_ZIP=m +CONFIG_CRYPTO_DEV_VIRTIO=m CONFIG_CRYPTO_DEV_SAFEXCEL=m # CONFIG_ASYMMETRIC_KEY_TYPE is not set # # Certificates for signature checking # -# CONFIG_SYSTEM_TRUSTED_KEYRING is not set +# CONFIG_SYSTEM_BLACKLIST_KEYRING is not set CONFIG_ARM64_CRYPTO=y +CONFIG_CRYPTO_SHA256_ARM64=y +# CONFIG_CRYPTO_SHA512_ARM64 is not set CONFIG_CRYPTO_SHA1_ARM64_CE=y CONFIG_CRYPTO_SHA2_ARM64_CE=y CONFIG_CRYPTO_GHASH_ARM64_CE=y +# CONFIG_CRYPTO_CRCT10DIF_ARM64_CE is not set +# CONFIG_CRYPTO_CRC32_ARM64_CE is not set +CONFIG_CRYPTO_AES_ARM64=y CONFIG_CRYPTO_AES_ARM64_CE=y CONFIG_CRYPTO_AES_ARM64_CE_CCM=y CONFIG_CRYPTO_AES_ARM64_CE_BLK=y CONFIG_CRYPTO_AES_ARM64_NEON_BLK=y -CONFIG_CRYPTO_CRC32_ARM64=y +# CONFIG_CRYPTO_CHACHA20_NEON is not set +# CONFIG_CRYPTO_AES_ARM64_BS is not set # CONFIG_BINARY_PRINTF is not set # @@ -5701,9 +5316,11 @@ CONFIG_CRC32_SLICEBY8=y # CONFIG_CRC32_SLICEBY4 is not set # CONFIG_CRC32_SARWATE is not set # CONFIG_CRC32_BIT is not set +# CONFIG_CRC4 is not set CONFIG_CRC7=m CONFIG_LIBCRC32C=y -# CONFIG_CRC8 is not set +CONFIG_CRC8=m +CONFIG_XXHASH=y CONFIG_AUDIT_GENERIC=y CONFIG_AUDIT_ARCH_COMPAT_GENERIC=y CONFIG_AUDIT_COMPAT_GENERIC=y @@ -5714,6 +5331,8 @@ CONFIG_LZO_COMPRESS=y CONFIG_LZO_DECOMPRESS=y CONFIG_LZ4_COMPRESS=m CONFIG_LZ4_DECOMPRESS=y +CONFIG_ZSTD_COMPRESS=y +CONFIG_ZSTD_DECOMPRESS=y CONFIG_XZ_DEC=y CONFIG_XZ_DEC_X86=y CONFIG_XZ_DEC_POWERPC=y @@ -5734,19 +5353,21 @@ CONFIG_TEXTSEARCH=y CONFIG_TEXTSEARCH_KMP=m CONFIG_TEXTSEARCH_BM=m CONFIG_TEXTSEARCH_FSM=m +CONFIG_RADIX_TREE_MULTIORDER=y CONFIG_ASSOCIATIVE_ARRAY=y CONFIG_HAS_IOMEM=y CONFIG_HAS_IOPORT_MAP=y CONFIG_HAS_DMA=y +# CONFIG_DMA_NOOP_OPS is not set +# CONFIG_DMA_VIRT_OPS is not set CONFIG_CPU_RMAP=y CONFIG_DQL=y CONFIG_GLOB=y # CONFIG_GLOB_SELFTEST is not set CONFIG_NLATTR=y -CONFIG_ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE=y -CONFIG_LRU_CACHE=m CONFIG_CORDIC=m # CONFIG_DDR is not set +# CONFIG_IRQ_POLL is not set CONFIG_LIBFDT=y CONFIG_OID_REGISTRY=y CONFIG_UCS2_STRING=y @@ -5755,4 +5376,7 @@ CONFIG_FONT_SUPPORT=y CONFIG_FONT_8x8=y CONFIG_FONT_8x16=y # CONFIG_SG_SPLIT is not set +CONFIG_SG_POOL=y CONFIG_ARCH_HAS_SG_CHAIN=y +CONFIG_SBITMAP=y +# CONFIG_STRING_SELFTEST is not set diff --git a/config/sources/mvebu64.conf b/config/sources/mvebu64.conf index 7a0193ad4cc1..9625ec574afb 100644 --- a/config/sources/mvebu64.conf +++ b/config/sources/mvebu64.conf @@ -14,14 +14,14 @@ BOOTENV_FILE='clearfog-default.txt' ATFSOURCE='https://github.com/MarvellEmbeddedProcessors/atf-marvell' ATFDIR='arm-trusted-firmware-espressobin' -ATFBRANCH='branch:atf-v1.3-armada-17.10' +ATFBRANCH='branch:atf-v1.4-armada-18.06' ATF_USE_GCC='== 4.9' ATF_COMPILER='arm-linux-gnueabi-' ATF_TARGET_MAP='DEBUG=1 USE_COHERENT_MEM=0 LOG_LEVEL=20 SECURE=0 CLOCKSPRESET=CPU_800_DDR_800 DDR_TOPOLOGY=2 BOOTDEV=SPINOR PARTNUM=0 PLAT=a3700;;build/a3700/debug/bl31.bin' case $BRANCH in default) KERNELSOURCE='https://github.com/MarvellEmbeddedProcessors/linux-marvell.git' - KERNELBRANCH='branch:linux-4.4.52-armada-17.10' + KERNELBRANCH='branch:linux-4.14.22-armada-18.06' KERNELDIR='linux-marvell' KERNEL_USE_GCC='> 6.3' diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.22-23.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.22-23.patch new file mode 100644 index 000000000000..479bcb6c4a3d --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.22-23.patch @@ -0,0 +1,1575 @@ +diff --git a/Makefile b/Makefile +index 03d41143900c..169f3199274f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 22 ++SUBLEVEL = 23 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 582142ae92e1..345d4e521191 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -175,9 +175,11 @@ static const struct arm64_ftr_bits ftr_id_aa64mmfr2[] = { + }; + + static const struct arm64_ftr_bits ftr_ctr[] = { +- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RAO */ ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_EXACT, 31, 1, 1), /* RES1 */ ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 29, 1, 1), /* DIC */ ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 28, 1, 1), /* IDC */ + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 24, 4, 0), /* CWG */ +- ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 20, 4, 0), /* ERG */ ++ ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_HIGHER_SAFE, 20, 4, 0), /* ERG */ + ARM64_FTR_BITS(FTR_VISIBLE, FTR_STRICT, FTR_LOWER_SAFE, 16, 4, 1), /* DminLine */ + /* + * Linux can handle differing I-cache policies. Userspace JITs will +diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c +index 8383af15a759..4fc0e958770b 100644 +--- a/arch/arm64/kernel/traps.c ++++ b/arch/arm64/kernel/traps.c +@@ -56,7 +56,7 @@ static const char *handler[]= { + "Error" + }; + +-int show_unhandled_signals = 1; ++int show_unhandled_signals = 0; + + /* + * Dump out the contents of some kernel memory nicely... +@@ -573,14 +573,6 @@ asmlinkage long do_ni_syscall(struct pt_regs *regs) + } + #endif + +- if (show_unhandled_signals_ratelimited()) { +- pr_info("%s[%d]: syscall %d\n", current->comm, +- task_pid_nr(current), regs->syscallno); +- dump_instr("", regs); +- if (user_mode(regs)) +- __show_regs(regs); +- } +- + return sys_ni_syscall(); + } + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 329a1c43365e..139320a7f7a2 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -155,7 +155,7 @@ ENDPROC(cpu_do_switch_mm) + + .macro __idmap_cpu_set_reserved_ttbr1, tmp1, tmp2 + adrp \tmp1, empty_zero_page +- msr ttbr1_el1, \tmp2 ++ msr ttbr1_el1, \tmp1 + isb + tlbi vmalle1 + dsb nsh +diff --git a/arch/m32r/Kconfig b/arch/m32r/Kconfig +index 0d9446c37ae8..498398d915c1 100644 +--- a/arch/m32r/Kconfig ++++ b/arch/m32r/Kconfig +@@ -196,8 +196,8 @@ config TIMER_DIVIDE + default "128" + + config CPU_BIG_ENDIAN +- bool "Generate big endian code" +- default n ++ bool ++ default !CPU_LITTLE_ENDIAN + + config CPU_LITTLE_ENDIAN + bool "Generate little endian code" +diff --git a/arch/microblaze/Makefile b/arch/microblaze/Makefile +index 830ee7d42fa0..d269dd4b8279 100644 +--- a/arch/microblaze/Makefile ++++ b/arch/microblaze/Makefile +@@ -36,16 +36,21 @@ endif + CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_DIV) += -mno-xl-soft-div + CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_BARREL) += -mxl-barrel-shift + CPUFLAGS-$(CONFIG_XILINX_MICROBLAZE0_USE_PCMP_INSTR) += -mxl-pattern-compare +-CPUFLAGS-$(CONFIG_BIG_ENDIAN) += -mbig-endian +-CPUFLAGS-$(CONFIG_LITTLE_ENDIAN) += -mlittle-endian ++ ++ifdef CONFIG_CPU_BIG_ENDIAN ++KBUILD_CFLAGS += -mbig-endian ++KBUILD_AFLAGS += -mbig-endian ++LD += -EB ++else ++KBUILD_CFLAGS += -mlittle-endian ++KBUILD_AFLAGS += -mlittle-endian ++LD += -EL ++endif + + CPUFLAGS-1 += $(call cc-option,-mcpu=v$(CPU_VER)) + + # r31 holds current when in kernel mode +-KBUILD_CFLAGS += -ffixed-r31 $(CPUFLAGS-1) $(CPUFLAGS-2) +- +-LDFLAGS := +-LDFLAGS_vmlinux := ++KBUILD_CFLAGS += -ffixed-r31 $(CPUFLAGS-y) $(CPUFLAGS-1) $(CPUFLAGS-2) + + head-y := arch/microblaze/kernel/head.o + libs-y += arch/microblaze/lib/ +diff --git a/arch/mips/boot/Makefile b/arch/mips/boot/Makefile +index 1bd5c4f00d19..c22da16d67b8 100644 +--- a/arch/mips/boot/Makefile ++++ b/arch/mips/boot/Makefile +@@ -126,6 +126,7 @@ $(obj)/vmlinux.its.S: $(addprefix $(srctree)/arch/mips/$(PLATFORM)/,$(ITS_INPUTS + + quiet_cmd_cpp_its_S = ITS $@ + cmd_cpp_its_S = $(CPP) $(cpp_flags) -P -C -o $@ $< \ ++ -D__ASSEMBLY__ \ + -DKERNEL_NAME="\"Linux $(KERNELRELEASE)\"" \ + -DVMLINUX_BINARY="\"$(3)\"" \ + -DVMLINUX_COMPRESSION="\"$(2)\"" \ +diff --git a/arch/mips/include/asm/compat.h b/arch/mips/include/asm/compat.h +index 49691331ada4..08ec0762ca50 100644 +--- a/arch/mips/include/asm/compat.h ++++ b/arch/mips/include/asm/compat.h +@@ -86,7 +86,6 @@ struct compat_flock { + compat_off_t l_len; + s32 l_sysid; + compat_pid_t l_pid; +- short __unused; + s32 pad[4]; + }; + +diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c +index ffdbc4836b4f..abff76bda9e6 100644 +--- a/arch/x86/oprofile/nmi_int.c ++++ b/arch/x86/oprofile/nmi_int.c +@@ -460,7 +460,7 @@ static int nmi_setup(void) + goto fail; + + for_each_possible_cpu(cpu) { +- if (!cpu) ++ if (!IS_ENABLED(CONFIG_SMP) || !cpu) + continue; + + memcpy(per_cpu(cpu_msrs, cpu).counters, +diff --git a/arch/xtensa/mm/init.c b/arch/xtensa/mm/init.c +index 720fe4e8b497..8dad076661fc 100644 +--- a/arch/xtensa/mm/init.c ++++ b/arch/xtensa/mm/init.c +@@ -79,19 +79,75 @@ void __init zones_init(void) + free_area_init_node(0, zones_size, ARCH_PFN_OFFSET, NULL); + } + ++#ifdef CONFIG_HIGHMEM ++static void __init free_area_high(unsigned long pfn, unsigned long end) ++{ ++ for (; pfn < end; pfn++) ++ free_highmem_page(pfn_to_page(pfn)); ++} ++ ++static void __init free_highpages(void) ++{ ++ unsigned long max_low = max_low_pfn; ++ struct memblock_region *mem, *res; ++ ++ reset_all_zones_managed_pages(); ++ /* set highmem page free */ ++ for_each_memblock(memory, mem) { ++ unsigned long start = memblock_region_memory_base_pfn(mem); ++ unsigned long end = memblock_region_memory_end_pfn(mem); ++ ++ /* Ignore complete lowmem entries */ ++ if (end <= max_low) ++ continue; ++ ++ if (memblock_is_nomap(mem)) ++ continue; ++ ++ /* Truncate partial highmem entries */ ++ if (start < max_low) ++ start = max_low; ++ ++ /* Find and exclude any reserved regions */ ++ for_each_memblock(reserved, res) { ++ unsigned long res_start, res_end; ++ ++ res_start = memblock_region_reserved_base_pfn(res); ++ res_end = memblock_region_reserved_end_pfn(res); ++ ++ if (res_end < start) ++ continue; ++ if (res_start < start) ++ res_start = start; ++ if (res_start > end) ++ res_start = end; ++ if (res_end > end) ++ res_end = end; ++ if (res_start != start) ++ free_area_high(start, res_start); ++ start = res_end; ++ if (start == end) ++ break; ++ } ++ ++ /* And now free anything which remains */ ++ if (start < end) ++ free_area_high(start, end); ++ } ++} ++#else ++static void __init free_highpages(void) ++{ ++} ++#endif ++ + /* + * Initialize memory pages. + */ + + void __init mem_init(void) + { +-#ifdef CONFIG_HIGHMEM +- unsigned long tmp; +- +- reset_all_zones_managed_pages(); +- for (tmp = max_low_pfn; tmp < max_pfn; tmp++) +- free_highmem_page(pfn_to_page(tmp)); +-#endif ++ free_highpages(); + + max_mapnr = max_pfn - ARCH_PFN_OFFSET; + high_memory = (void *)__va(max_low_pfn << PAGE_SHIFT); +diff --git a/crypto/asymmetric_keys/pkcs7_verify.c b/crypto/asymmetric_keys/pkcs7_verify.c +index 986033e64a83..a18295651077 100644 +--- a/crypto/asymmetric_keys/pkcs7_verify.c ++++ b/crypto/asymmetric_keys/pkcs7_verify.c +@@ -273,7 +273,7 @@ static int pkcs7_verify_sig_chain(struct pkcs7_message *pkcs7, + sinfo->index); + return 0; + } +- ret = public_key_verify_signature(p->pub, p->sig); ++ ret = public_key_verify_signature(p->pub, x509->sig); + if (ret < 0) + return ret; + x509->signer = p; +@@ -369,8 +369,7 @@ static int pkcs7_verify_one(struct pkcs7_message *pkcs7, + * + * (*) -EBADMSG if some part of the message was invalid, or: + * +- * (*) 0 if no signature chains were found to be blacklisted or to contain +- * unsupported crypto, or: ++ * (*) 0 if a signature chain passed verification, or: + * + * (*) -EKEYREJECTED if a blacklisted key was encountered, or: + * +@@ -426,8 +425,11 @@ int pkcs7_verify(struct pkcs7_message *pkcs7, + + for (sinfo = pkcs7->signed_infos; sinfo; sinfo = sinfo->next) { + ret = pkcs7_verify_one(pkcs7, sinfo); +- if (sinfo->blacklisted && actual_ret == -ENOPKG) +- actual_ret = -EKEYREJECTED; ++ if (sinfo->blacklisted) { ++ if (actual_ret == -ENOPKG) ++ actual_ret = -EKEYREJECTED; ++ continue; ++ } + if (ret < 0) { + if (ret == -ENOPKG) { + sinfo->unsupported_crypto = true; +diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c +index 3cd6e12cfc46..d1af69d2ff85 100644 +--- a/crypto/asymmetric_keys/public_key.c ++++ b/crypto/asymmetric_keys/public_key.c +@@ -93,9 +93,11 @@ int public_key_verify_signature(const struct public_key *pkey, + + BUG_ON(!pkey); + BUG_ON(!sig); +- BUG_ON(!sig->digest); + BUG_ON(!sig->s); + ++ if (!sig->digest) ++ return -ENOPKG; ++ + alg_name = sig->pkey_algo; + if (strcmp(sig->pkey_algo, "rsa") == 0) { + /* The data wangled by the RSA algorithm is typically padded +diff --git a/crypto/asymmetric_keys/restrict.c b/crypto/asymmetric_keys/restrict.c +index 86fb68508952..7c93c7728454 100644 +--- a/crypto/asymmetric_keys/restrict.c ++++ b/crypto/asymmetric_keys/restrict.c +@@ -67,8 +67,9 @@ __setup("ca_keys=", ca_keys_setup); + * + * Returns 0 if the new certificate was accepted, -ENOKEY if we couldn't find a + * matching parent certificate in the trusted list, -EKEYREJECTED if the +- * signature check fails or the key is blacklisted and some other error if +- * there is a matching certificate but the signature check cannot be performed. ++ * signature check fails or the key is blacklisted, -ENOPKG if the signature ++ * uses unsupported crypto, or some other error if there is a matching ++ * certificate but the signature check cannot be performed. + */ + int restrict_link_by_signature(struct key *dest_keyring, + const struct key_type *type, +@@ -88,6 +89,8 @@ int restrict_link_by_signature(struct key *dest_keyring, + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; ++ if (!sig) ++ return -ENOPKG; + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + +@@ -139,6 +142,8 @@ static int key_or_keyring_common(struct key *dest_keyring, + return -EOPNOTSUPP; + + sig = payload->data[asym_auth]; ++ if (!sig) ++ return -ENOPKG; + if (!sig->auth_ids[0] && !sig->auth_ids[1]) + return -ENOKEY; + +@@ -222,9 +227,9 @@ static int key_or_keyring_common(struct key *dest_keyring, + * + * Returns 0 if the new certificate was accepted, -ENOKEY if we + * couldn't find a matching parent certificate in the trusted list, +- * -EKEYREJECTED if the signature check fails, and some other error if +- * there is a matching certificate but the signature check cannot be +- * performed. ++ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses ++ * unsupported crypto, or some other error if there is a matching certificate ++ * but the signature check cannot be performed. + */ + int restrict_link_by_key_or_keyring(struct key *dest_keyring, + const struct key_type *type, +@@ -249,9 +254,9 @@ int restrict_link_by_key_or_keyring(struct key *dest_keyring, + * + * Returns 0 if the new certificate was accepted, -ENOKEY if we + * couldn't find a matching parent certificate in the trusted list, +- * -EKEYREJECTED if the signature check fails, and some other error if +- * there is a matching certificate but the signature check cannot be +- * performed. ++ * -EKEYREJECTED if the signature check fails, -ENOPKG if the signature uses ++ * unsupported crypto, or some other error if there is a matching certificate ++ * but the signature check cannot be performed. + */ + int restrict_link_by_key_or_keyring_chain(struct key *dest_keyring, + const struct key_type *type, +diff --git a/drivers/extcon/extcon-intel-int3496.c b/drivers/extcon/extcon-intel-int3496.c +index 1a45e745717d..a6661097b2f9 100644 +--- a/drivers/extcon/extcon-intel-int3496.c ++++ b/drivers/extcon/extcon-intel-int3496.c +@@ -153,8 +153,9 @@ static int int3496_probe(struct platform_device *pdev) + return ret; + } + +- /* queue initial processing of id-pin */ ++ /* process id-pin so that we start with the right status */ + queue_delayed_work(system_wq, &data->work, 0); ++ flush_delayed_work(&data->work); + + platform_set_drvdata(pdev, data); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +index c13c51af0b68..c53095b3b0fb 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -14,6 +14,16 @@ + + #include "amd_acpi.h" + ++#define AMDGPU_PX_QUIRK_FORCE_ATPX (1 << 0) ++ ++struct amdgpu_px_quirk { ++ u32 chip_vendor; ++ u32 chip_device; ++ u32 subsys_vendor; ++ u32 subsys_device; ++ u32 px_quirk_flags; ++}; ++ + struct amdgpu_atpx_functions { + bool px_params; + bool power_cntl; +@@ -35,6 +45,7 @@ struct amdgpu_atpx { + static struct amdgpu_atpx_priv { + bool atpx_detected; + bool bridge_pm_usable; ++ unsigned int quirks; + /* handle for device - and atpx */ + acpi_handle dhandle; + acpi_handle other_handle; +@@ -205,13 +216,19 @@ static int amdgpu_atpx_validate(struct amdgpu_atpx *atpx) + + atpx->is_hybrid = false; + if (valid_bits & ATPX_MS_HYBRID_GFX_SUPPORTED) { +- printk("ATPX Hybrid Graphics\n"); +- /* +- * Disable legacy PM methods only when pcie port PM is usable, +- * otherwise the device might fail to power off or power on. +- */ +- atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable; +- atpx->is_hybrid = true; ++ if (amdgpu_atpx_priv.quirks & AMDGPU_PX_QUIRK_FORCE_ATPX) { ++ printk("ATPX Hybrid Graphics, forcing to ATPX\n"); ++ atpx->functions.power_cntl = true; ++ atpx->is_hybrid = false; ++ } else { ++ printk("ATPX Hybrid Graphics\n"); ++ /* ++ * Disable legacy PM methods only when pcie port PM is usable, ++ * otherwise the device might fail to power off or power on. ++ */ ++ atpx->functions.power_cntl = !amdgpu_atpx_priv.bridge_pm_usable; ++ atpx->is_hybrid = true; ++ } + } + + atpx->dgpu_req_power_for_displays = false; +@@ -547,6 +564,31 @@ static const struct vga_switcheroo_handler amdgpu_atpx_handler = { + .get_client_id = amdgpu_atpx_get_client_id, + }; + ++static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = { ++ /* HG _PR3 doesn't seem to work on this A+A weston board */ ++ { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX }, ++ { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX }, ++ { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX }, ++ { 0, 0, 0, 0, 0 }, ++}; ++ ++static void amdgpu_atpx_get_quirks(struct pci_dev *pdev) ++{ ++ const struct amdgpu_px_quirk *p = amdgpu_px_quirk_list; ++ ++ /* Apply PX quirks */ ++ while (p && p->chip_device != 0) { ++ if (pdev->vendor == p->chip_vendor && ++ pdev->device == p->chip_device && ++ pdev->subsystem_vendor == p->subsys_vendor && ++ pdev->subsystem_device == p->subsys_device) { ++ amdgpu_atpx_priv.quirks |= p->px_quirk_flags; ++ break; ++ } ++ ++p; ++ } ++} ++ + /** + * amdgpu_atpx_detect - detect whether we have PX + * +@@ -570,6 +612,7 @@ static bool amdgpu_atpx_detect(void) + + parent_pdev = pci_upstream_bridge(pdev); + d3_supported |= parent_pdev && parent_pdev->bridge_d3; ++ amdgpu_atpx_get_quirks(pdev); + } + + while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) { +@@ -579,6 +622,7 @@ static bool amdgpu_atpx_detect(void) + + parent_pdev = pci_upstream_bridge(pdev); + d3_supported |= parent_pdev && parent_pdev->bridge_d3; ++ amdgpu_atpx_get_quirks(pdev); + } + + if (has_atpx && vga_count == 2) { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +index e630d918fefc..bc746a6e0ecc 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c +@@ -2076,8 +2076,6 @@ int amdgpu_device_init(struct amdgpu_device *adev, + * ignore it */ + vga_client_register(adev->pdev, adev, NULL, amdgpu_vga_set_decode); + +- if (amdgpu_runtime_pm == 1) +- runtime = true; + if (amdgpu_device_is_px(ddev)) + runtime = true; + if (!pci_is_thunderbolt_attached(adev->pdev)) +diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +index d63873f3f574..a2aeb643ac51 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -3465,6 +3465,11 @@ static void si_apply_state_adjust_rules(struct amdgpu_device *adev, + (adev->pdev->device == 0x6667)) { + max_sclk = 75000; + } ++ if ((adev->pdev->revision == 0xC3) || ++ (adev->pdev->device == 0x6665)) { ++ max_sclk = 60000; ++ max_mclk = 80000; ++ } + } else if (adev->asic_type == CHIP_OLAND) { + if ((adev->pdev->revision == 0xC7) || + (adev->pdev->revision == 0x80) || +diff --git a/drivers/gpu/drm/amd/amdgpu/soc15.c b/drivers/gpu/drm/amd/amdgpu/soc15.c +index 3e59c766722c..ff7d4827385e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/soc15.c ++++ b/drivers/gpu/drm/amd/amdgpu/soc15.c +@@ -661,8 +661,8 @@ static int soc15_common_early_init(void *handle) + AMD_CG_SUPPORT_MC_LS | + AMD_CG_SUPPORT_SDMA_MGCG | + AMD_CG_SUPPORT_SDMA_LS; +- adev->pg_flags = AMD_PG_SUPPORT_SDMA | +- AMD_PG_SUPPORT_MMHUB; ++ adev->pg_flags = AMD_PG_SUPPORT_SDMA; ++ + adev->external_rev_id = 0x1; + break; + default: +diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c +index 9ff69b90df36..4968b6bb9466 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -448,14 +448,19 @@ static bool vi_read_bios_from_rom(struct amdgpu_device *adev, + + static void vi_detect_hw_virtualization(struct amdgpu_device *adev) + { +- uint32_t reg = RREG32(mmBIF_IOV_FUNC_IDENTIFIER); +- /* bit0: 0 means pf and 1 means vf */ +- /* bit31: 0 means disable IOV and 1 means enable */ +- if (reg & 1) +- adev->virt.caps |= AMDGPU_SRIOV_CAPS_IS_VF; +- +- if (reg & 0x80000000) +- adev->virt.caps |= AMDGPU_SRIOV_CAPS_ENABLE_IOV; ++ uint32_t reg = 0; ++ ++ if (adev->asic_type == CHIP_TONGA || ++ adev->asic_type == CHIP_FIJI) { ++ reg = RREG32(mmBIF_IOV_FUNC_IDENTIFIER); ++ /* bit0: 0 means pf and 1 means vf */ ++ /* bit31: 0 means disable IOV and 1 means enable */ ++ if (reg & 1) ++ adev->virt.caps |= AMDGPU_SRIOV_CAPS_IS_VF; ++ ++ if (reg & 0x80000000) ++ adev->virt.caps |= AMDGPU_SRIOV_CAPS_ENABLE_IOV; ++ } + + if (reg == 0) { + if (is_virtual_machine()) /* passthrough mode exclus sr-iov mode */ +diff --git a/drivers/gpu/drm/cirrus/cirrus_mode.c b/drivers/gpu/drm/cirrus/cirrus_mode.c +index a4c4a465b385..130483f2cd7f 100644 +--- a/drivers/gpu/drm/cirrus/cirrus_mode.c ++++ b/drivers/gpu/drm/cirrus/cirrus_mode.c +@@ -294,22 +294,7 @@ static void cirrus_crtc_prepare(struct drm_crtc *crtc) + { + } + +-/* +- * This is called after a mode is programmed. It should reverse anything done +- * by the prepare function +- */ +-static void cirrus_crtc_commit(struct drm_crtc *crtc) +-{ +-} +- +-/* +- * The core can pass us a set of gamma values to program. We actually only +- * use this for 8-bit mode so can't perform smooth fades on deeper modes, +- * but it's a requirement that we provide the function +- */ +-static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green, +- u16 *blue, uint32_t size, +- struct drm_modeset_acquire_ctx *ctx) ++static void cirrus_crtc_load_lut(struct drm_crtc *crtc) + { + struct drm_device *dev = crtc->dev; + struct cirrus_device *cdev = dev->dev_private; +@@ -317,7 +302,7 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green, + int i; + + if (!crtc->enabled) +- return 0; ++ return; + + r = crtc->gamma_store; + g = r + crtc->gamma_size; +@@ -330,6 +315,27 @@ static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green, + WREG8(PALETTE_DATA, *g++ >> 8); + WREG8(PALETTE_DATA, *b++ >> 8); + } ++} ++ ++/* ++ * This is called after a mode is programmed. It should reverse anything done ++ * by the prepare function ++ */ ++static void cirrus_crtc_commit(struct drm_crtc *crtc) ++{ ++ cirrus_crtc_load_lut(crtc); ++} ++ ++/* ++ * The core can pass us a set of gamma values to program. We actually only ++ * use this for 8-bit mode so can't perform smooth fades on deeper modes, ++ * but it's a requirement that we provide the function ++ */ ++static int cirrus_crtc_gamma_set(struct drm_crtc *crtc, u16 *red, u16 *green, ++ u16 *blue, uint32_t size, ++ struct drm_modeset_acquire_ctx *ctx) ++{ ++ cirrus_crtc_load_lut(crtc); + + return 0; + } +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index fc7946eb6665..d52c9758d8cf 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -111,6 +111,9 @@ static const struct edid_quirk { + /* AEO model 0 reports 8 bpc, but is a 6 bpc panel */ + { "AEO", 0, EDID_QUIRK_FORCE_6BPC }, + ++ /* CPT panel of Asus UX303LA reports 8 bpc, but is a 6 bpc panel */ ++ { "CPT", 0x17df, EDID_QUIRK_FORCE_6BPC }, ++ + /* Belinea 10 15 55 */ + { "MAX", 1516, EDID_QUIRK_PREFER_LARGE_60 }, + { "MAX", 0x77e, EDID_QUIRK_PREFER_LARGE_60 }, +diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c +index 61a1c8ea74bc..1acf3b1479a1 100644 +--- a/drivers/gpu/drm/drm_mm.c ++++ b/drivers/gpu/drm/drm_mm.c +@@ -834,9 +834,24 @@ struct drm_mm_node *drm_mm_scan_color_evict(struct drm_mm_scan *scan) + if (!mm->color_adjust) + return NULL; + +- hole = list_first_entry(&mm->hole_stack, typeof(*hole), hole_stack); +- hole_start = __drm_mm_hole_node_start(hole); +- hole_end = hole_start + hole->hole_size; ++ /* ++ * The hole found during scanning should ideally be the first element ++ * in the hole_stack list, but due to side-effects in the driver it ++ * may not be. ++ */ ++ list_for_each_entry(hole, &mm->hole_stack, hole_stack) { ++ hole_start = __drm_mm_hole_node_start(hole); ++ hole_end = hole_start + hole->hole_size; ++ ++ if (hole_start <= scan->hit_start && ++ hole_end >= scan->hit_end) ++ break; ++ } ++ ++ /* We should only be called after we found the hole previously */ ++ DRM_MM_BUG_ON(&hole->hole_stack == &mm->hole_stack); ++ if (unlikely(&hole->hole_stack == &mm->hole_stack)) ++ return NULL; + + DRM_MM_BUG_ON(hole_start > scan->hit_start); + DRM_MM_BUG_ON(hole_end < scan->hit_end); +diff --git a/drivers/gpu/drm/i915/intel_breadcrumbs.c b/drivers/gpu/drm/i915/intel_breadcrumbs.c +index 4e00e5cb9fa1..5095c095da04 100644 +--- a/drivers/gpu/drm/i915/intel_breadcrumbs.c ++++ b/drivers/gpu/drm/i915/intel_breadcrumbs.c +@@ -541,29 +541,16 @@ void intel_engine_remove_wait(struct intel_engine_cs *engine, + spin_unlock_irq(&b->rb_lock); + } + +-static bool signal_valid(const struct drm_i915_gem_request *request) +-{ +- return intel_wait_check_request(&request->signaling.wait, request); +-} +- + static bool signal_complete(const struct drm_i915_gem_request *request) + { + if (!request) + return false; + +- /* If another process served as the bottom-half it may have already +- * signalled that this wait is already completed. +- */ +- if (intel_wait_complete(&request->signaling.wait)) +- return signal_valid(request); +- +- /* Carefully check if the request is complete, giving time for the ++ /* ++ * Carefully check if the request is complete, giving time for the + * seqno to be visible or if the GPU hung. + */ +- if (__i915_request_irq_complete(request)) +- return true; +- +- return false; ++ return __i915_request_irq_complete(request); + } + + static struct drm_i915_gem_request *to_signaler(struct rb_node *rb) +@@ -606,9 +593,13 @@ static int intel_breadcrumbs_signaler(void *arg) + request = i915_gem_request_get_rcu(request); + rcu_read_unlock(); + if (signal_complete(request)) { +- local_bh_disable(); +- dma_fence_signal(&request->fence); +- local_bh_enable(); /* kick start the tasklets */ ++ if (!test_bit(DMA_FENCE_FLAG_SIGNALED_BIT, ++ &request->fence.flags)) { ++ local_bh_disable(); ++ dma_fence_signal(&request->fence); ++ GEM_BUG_ON(!i915_gem_request_completed(request)); ++ local_bh_enable(); /* kick start the tasklets */ ++ } + + spin_lock_irq(&b->rb_lock); + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 5744eb729d24..ca2fbe56635a 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -2716,6 +2716,9 @@ static const struct hid_device_id hid_ignore_list[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index be2e005c3c51..ff539c0b4637 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -634,6 +634,9 @@ + #define USB_DEVICE_ID_LD_MICROCASSYTIME 0x1033 + #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE 0x1035 + #define USB_DEVICE_ID_LD_MICROCASSYPH 0x1038 ++#define USB_DEVICE_ID_LD_POWERANALYSERCASSY 0x1040 ++#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY 0x1042 ++#define USB_DEVICE_ID_LD_MACHINETESTCASSY 0x1043 + #define USB_DEVICE_ID_LD_JWM 0x1080 + #define USB_DEVICE_ID_LD_DMMP 0x1081 + #define USB_DEVICE_ID_LD_UMIP 0x1090 +diff --git a/drivers/i2c/busses/i2c-bcm2835.c b/drivers/i2c/busses/i2c-bcm2835.c +index cd07a69e2e93..44deae78913e 100644 +--- a/drivers/i2c/busses/i2c-bcm2835.c ++++ b/drivers/i2c/busses/i2c-bcm2835.c +@@ -50,6 +50,9 @@ + #define BCM2835_I2C_S_CLKT BIT(9) + #define BCM2835_I2C_S_LEN BIT(10) /* Fake bit for SW error reporting */ + ++#define BCM2835_I2C_FEDL_SHIFT 16 ++#define BCM2835_I2C_REDL_SHIFT 0 ++ + #define BCM2835_I2C_CDIV_MIN 0x0002 + #define BCM2835_I2C_CDIV_MAX 0xFFFE + +@@ -81,7 +84,7 @@ static inline u32 bcm2835_i2c_readl(struct bcm2835_i2c_dev *i2c_dev, u32 reg) + + static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev) + { +- u32 divider; ++ u32 divider, redl, fedl; + + divider = DIV_ROUND_UP(clk_get_rate(i2c_dev->clk), + i2c_dev->bus_clk_rate); +@@ -100,6 +103,22 @@ static int bcm2835_i2c_set_divider(struct bcm2835_i2c_dev *i2c_dev) + + bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DIV, divider); + ++ /* ++ * Number of core clocks to wait after falling edge before ++ * outputting the next data bit. Note that both FEDL and REDL ++ * can't be greater than CDIV/2. ++ */ ++ fedl = max(divider / 16, 1u); ++ ++ /* ++ * Number of core clocks to wait after rising edge before ++ * sampling the next incoming data bit. ++ */ ++ redl = max(divider / 4, 1u); ++ ++ bcm2835_i2c_writel(i2c_dev, BCM2835_I2C_DEL, ++ (fedl << BCM2835_I2C_FEDL_SHIFT) | ++ (redl << BCM2835_I2C_REDL_SHIFT)); + return 0; + } + +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 418c233075d3..13e849bf9aa0 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -207,7 +207,7 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev) + i2c_dw_disable_int(dev); + + /* Enable the adapter */ +- __i2c_dw_enable(dev, true); ++ __i2c_dw_enable_and_wait(dev, true); + + /* Clear and enable interrupts */ + dw_readl(dev, DW_IC_CLR_INTR); +diff --git a/drivers/iio/adc/stm32-adc.c b/drivers/iio/adc/stm32-adc.c +index 172753b14a4f..04be8bd951be 100644 +--- a/drivers/iio/adc/stm32-adc.c ++++ b/drivers/iio/adc/stm32-adc.c +@@ -764,8 +764,6 @@ static int stm32h7_adc_enable(struct stm32_adc *adc) + int ret; + u32 val; + +- /* Clear ADRDY by writing one, then enable ADC */ +- stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY); + stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN); + + /* Poll for ADRDY to be set (after adc startup time) */ +@@ -773,8 +771,11 @@ static int stm32h7_adc_enable(struct stm32_adc *adc) + val & STM32H7_ADRDY, + 100, STM32_ADC_TIMEOUT_US); + if (ret) { +- stm32_adc_clr_bits(adc, STM32H7_ADC_CR, STM32H7_ADEN); ++ stm32_adc_set_bits(adc, STM32H7_ADC_CR, STM32H7_ADDIS); + dev_err(&indio_dev->dev, "Failed to enable ADC\n"); ++ } else { ++ /* Clear ADRDY by writing one */ ++ stm32_adc_set_bits(adc, STM32H7_ADC_ISR, STM32H7_ADRDY); + } + + return ret; +diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c +index f53e9a803a0e..93b99bd93738 100644 +--- a/drivers/iio/imu/adis_trigger.c ++++ b/drivers/iio/imu/adis_trigger.c +@@ -47,6 +47,10 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev) + if (adis->trig == NULL) + return -ENOMEM; + ++ adis->trig->dev.parent = &adis->spi->dev; ++ adis->trig->ops = &adis_trigger_ops; ++ iio_trigger_set_drvdata(adis->trig, adis); ++ + ret = request_irq(adis->spi->irq, + &iio_trigger_generic_data_rdy_poll, + IRQF_TRIGGER_RISING, +@@ -55,9 +59,6 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev) + if (ret) + goto error_free_trig; + +- adis->trig->dev.parent = &adis->spi->dev; +- adis->trig->ops = &adis_trigger_ops; +- iio_trigger_set_drvdata(adis->trig, adis); + ret = iio_trigger_register(adis->trig); + + indio_dev->trig = iio_trigger_get(adis->trig); +diff --git a/drivers/iio/industrialio-buffer.c b/drivers/iio/industrialio-buffer.c +index d2b465140a6b..78482d456c3b 100644 +--- a/drivers/iio/industrialio-buffer.c ++++ b/drivers/iio/industrialio-buffer.c +@@ -175,7 +175,7 @@ unsigned int iio_buffer_poll(struct file *filp, + struct iio_dev *indio_dev = filp->private_data; + struct iio_buffer *rb = indio_dev->buffer; + +- if (!indio_dev->info) ++ if (!indio_dev->info || rb == NULL) + return 0; + + poll_wait(filp, &rb->pollq, wait); +diff --git a/drivers/iio/proximity/Kconfig b/drivers/iio/proximity/Kconfig +index ae070950f920..c03de24d3c51 100644 +--- a/drivers/iio/proximity/Kconfig ++++ b/drivers/iio/proximity/Kconfig +@@ -58,6 +58,8 @@ config SX9500 + + config SRF08 + tristate "Devantech SRF02/SRF08/SRF10 ultrasonic ranger sensor" ++ select IIO_BUFFER ++ select IIO_TRIGGERED_BUFFER + depends on I2C + help + Say Y here to build a driver for Devantech SRF02/SRF08/SRF10 +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 85b5ee4defa4..4e1f76730855 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -196,7 +196,15 @@ static struct ib_uobject *lookup_get_idr_uobject(const struct uverbs_obj_type *t + goto free; + } + +- uverbs_uobject_get(uobj); ++ /* ++ * The idr_find is guaranteed to return a pointer to something that ++ * isn't freed yet, or NULL, as the free after idr_remove goes through ++ * kfree_rcu(). However the object may still have been released and ++ * kfree() could be called at any time. ++ */ ++ if (!kref_get_unless_zero(&uobj->ref)) ++ uobj = ERR_PTR(-ENOENT); ++ + free: + rcu_read_unlock(); + return uobj; +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 93c1a57dbff1..186dce6bba8f 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -565,9 +565,10 @@ ssize_t ib_uverbs_open_xrcd(struct ib_uverbs_file *file, + if (f.file) + fdput(f); + ++ mutex_unlock(&file->device->xrcd_tree_mutex); ++ + uobj_alloc_commit(&obj->uobject); + +- mutex_unlock(&file->device->xrcd_tree_mutex); + return in_len; + + err_copy: +@@ -606,10 +607,8 @@ ssize_t ib_uverbs_close_xrcd(struct ib_uverbs_file *file, + + uobj = uobj_get_write(uobj_get_type(xrcd), cmd.xrcd_handle, + file->ucontext); +- if (IS_ERR(uobj)) { +- mutex_unlock(&file->device->xrcd_tree_mutex); ++ if (IS_ERR(uobj)) + return PTR_ERR(uobj); +- } + + ret = uobj_remove_commit(uobj); + return ret ?: in_len; +@@ -1982,8 +1981,15 @@ static int modify_qp(struct ib_uverbs_file *file, + goto release_qp; + } + ++ if ((cmd->base.attr_mask & IB_QP_AV) && ++ !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { ++ ret = -EINVAL; ++ goto release_qp; ++ } ++ + if ((cmd->base.attr_mask & IB_QP_ALT_PATH) && +- !rdma_is_port_valid(qp->device, cmd->base.alt_port_num)) { ++ (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) || ++ !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) { + ret = -EINVAL; + goto release_qp; + } +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index dc2aed6fb21b..0f70ff91276e 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -647,12 +647,21 @@ static int verify_command_mask(struct ib_device *ib_dev, __u32 command) + return -1; + } + ++static bool verify_command_idx(u32 command, bool extended) ++{ ++ if (extended) ++ return command < ARRAY_SIZE(uverbs_ex_cmd_table); ++ ++ return command < ARRAY_SIZE(uverbs_cmd_table); ++} ++ + static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + size_t count, loff_t *pos) + { + struct ib_uverbs_file *file = filp->private_data; + struct ib_device *ib_dev; + struct ib_uverbs_cmd_hdr hdr; ++ bool extended_command; + __u32 command; + __u32 flags; + int srcu_key; +@@ -685,6 +694,15 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + } + + command = hdr.command & IB_USER_VERBS_CMD_COMMAND_MASK; ++ flags = (hdr.command & ++ IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT; ++ ++ extended_command = flags & IB_USER_VERBS_CMD_FLAG_EXTENDED; ++ if (!verify_command_idx(command, extended_command)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + if (verify_command_mask(ib_dev, command)) { + ret = -EOPNOTSUPP; + goto out; +@@ -696,12 +714,8 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + goto out; + } + +- flags = (hdr.command & +- IB_USER_VERBS_CMD_FLAGS_MASK) >> IB_USER_VERBS_CMD_FLAGS_SHIFT; +- + if (!flags) { +- if (command >= ARRAY_SIZE(uverbs_cmd_table) || +- !uverbs_cmd_table[command]) { ++ if (!uverbs_cmd_table[command]) { + ret = -EINVAL; + goto out; + } +@@ -722,8 +736,7 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + struct ib_udata uhw; + size_t written_count = count; + +- if (command >= ARRAY_SIZE(uverbs_ex_cmd_table) || +- !uverbs_ex_cmd_table[command]) { ++ if (!uverbs_ex_cmd_table[command]) { + ret = -ENOSYS; + goto out; + } +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 3b35271114ee..ae9ff72e83ee 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -660,7 +660,7 @@ static void gic_raise_softirq(const struct cpumask *mask, unsigned int irq) + * Ensure that stores to Normal memory are visible to the + * other CPUs before issuing the IPI. + */ +- smp_wmb(); ++ wmb(); + + for_each_cpu(cpu, mask) { + unsigned long cluster_id = cpu_logical_map(cpu) & ~0xffUL; +diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c +index c90976d7e53c..a9f300efce54 100644 +--- a/drivers/irqchip/irq-mips-gic.c ++++ b/drivers/irqchip/irq-mips-gic.c +@@ -427,8 +427,6 @@ static int gic_shared_irq_domain_map(struct irq_domain *d, unsigned int virq, + spin_lock_irqsave(&gic_lock, flags); + write_gic_map_pin(intr, GIC_MAP_PIN_MAP_TO_PIN | gic_cpu_pin); + write_gic_map_vp(intr, BIT(mips_cm_vp_id(cpu))); +- gic_clear_pcpu_masks(intr); +- set_bit(intr, per_cpu_ptr(pcpu_masks, cpu)); + irq_data_update_effective_affinity(data, cpumask_of(cpu)); + spin_unlock_irqrestore(&gic_lock, flags); + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +index b65ce26ff72f..1802debbd3c7 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +@@ -2632,7 +2632,6 @@ void t4_get_regs(struct adapter *adap, void *buf, size_t buf_size) + } + + #define EEPROM_STAT_ADDR 0x7bfc +-#define VPD_SIZE 0x800 + #define VPD_BASE 0x400 + #define VPD_BASE_OLD 0 + #define VPD_LEN 1024 +@@ -2670,15 +2669,6 @@ int t4_get_raw_vpd_params(struct adapter *adapter, struct vpd_params *p) + if (!vpd) + return -ENOMEM; + +- /* We have two VPD data structures stored in the adapter VPD area. +- * By default, Linux calculates the size of the VPD area by traversing +- * the first VPD area at offset 0x0, so we need to tell the OS what +- * our real VPD size is. +- */ +- ret = pci_set_vpd_size(adapter->pdev, VPD_SIZE); +- if (ret < 0) +- goto out; +- + /* Card information normally starts at VPD_BASE but early cards had + * it at 0. + */ +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 4c3feb96f391..d18824772f6c 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3412,22 +3412,29 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PORT_RIDGE, + + static void quirk_chelsio_extend_vpd(struct pci_dev *dev) + { +- pci_set_vpd_size(dev, 8192); +-} +- +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x20, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x21, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x22, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x23, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x24, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x25, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x26, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x30, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x31, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x32, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x35, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x36, quirk_chelsio_extend_vpd); +-DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, 0x37, quirk_chelsio_extend_vpd); ++ int chip = (dev->device & 0xf000) >> 12; ++ int func = (dev->device & 0x0f00) >> 8; ++ int prod = (dev->device & 0x00ff) >> 0; ++ ++ /* ++ * If this is a T3-based adapter, there's a 1KB VPD area at offset ++ * 0xc00 which contains the preferred VPD values. If this is a T4 or ++ * later based adapter, the special VPD is at offset 0x400 for the ++ * Physical Functions (the SR-IOV Virtual Functions have no VPD ++ * Capabilities). The PCI VPD Access core routines will normally ++ * compute the size of the VPD by parsing the VPD Data Structure at ++ * offset 0x000. This will result in silent failures when attempting ++ * to accesses these other VPD areas which are beyond those computed ++ * limits. ++ */ ++ if (chip == 0x0 && prod >= 0x20) ++ pci_set_vpd_size(dev, 8192); ++ else if (chip >= 0x4 && func < 0x8) ++ pci_set_vpd_size(dev, 2048); ++} ++ ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_CHELSIO, PCI_ANY_ID, ++ quirk_chelsio_extend_vpd); + + #ifdef CONFIG_ACPI + /* +diff --git a/drivers/scsi/ibmvscsi/ibmvfc.h b/drivers/scsi/ibmvscsi/ibmvfc.h +index 9a0696f68f37..b81a53c4a9a8 100644 +--- a/drivers/scsi/ibmvscsi/ibmvfc.h ++++ b/drivers/scsi/ibmvscsi/ibmvfc.h +@@ -367,7 +367,7 @@ enum ibmvfc_fcp_rsp_info_codes { + }; + + struct ibmvfc_fcp_rsp_info { +- __be16 reserved; ++ u8 reserved[3]; + u8 rsp_code; + u8 reserved2[4]; + }__attribute__((packed, aligned (2))); +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index c05c4f877750..774c97bb1c08 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -225,6 +225,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1a0a, 0x0200), .driver_info = + USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, + ++ /* Corsair K70 RGB */ ++ { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Corsair Strafe RGB */ + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, + +diff --git a/drivers/usb/dwc3/ep0.c b/drivers/usb/dwc3/ep0.c +index 75e6cb044eb2..89fe53c846ef 100644 +--- a/drivers/usb/dwc3/ep0.c ++++ b/drivers/usb/dwc3/ep0.c +@@ -884,7 +884,12 @@ static void dwc3_ep0_complete_data(struct dwc3 *dwc, + trb++; + trb->ctrl &= ~DWC3_TRB_CTRL_HWO; + trace_dwc3_complete_trb(ep0, trb); +- ep0->trb_enqueue = 0; ++ ++ if (r->direction) ++ dwc->eps[1]->trb_enqueue = 0; ++ else ++ dwc->eps[0]->trb_enqueue = 0; ++ + dwc->ep0_bounced = false; + } + +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 97e52c0d1a72..0ebdb313bb00 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -2774,6 +2774,8 @@ static void dwc3_gadget_conndone_interrupt(struct dwc3 *dwc) + break; + } + ++ dwc->eps[1]->endpoint.maxpacket = dwc->gadget.ep0->maxpacket; ++ + /* Enable USB2 LPM Capability */ + + if ((dwc->revision > DWC3_REVISION_194A) && +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index c0491dd73f53..a9c9ab01592b 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1856,44 +1856,20 @@ static int ffs_func_eps_enable(struct ffs_function *func) + + spin_lock_irqsave(&func->ffs->eps_lock, flags); + while(count--) { +- struct usb_endpoint_descriptor *ds; +- struct usb_ss_ep_comp_descriptor *comp_desc = NULL; +- int needs_comp_desc = false; +- int desc_idx; +- +- if (ffs->gadget->speed == USB_SPEED_SUPER) { +- desc_idx = 2; +- needs_comp_desc = true; +- } else if (ffs->gadget->speed == USB_SPEED_HIGH) +- desc_idx = 1; +- else +- desc_idx = 0; +- +- /* fall-back to lower speed if desc missing for current speed */ +- do { +- ds = ep->descs[desc_idx]; +- } while (!ds && --desc_idx >= 0); +- +- if (!ds) { +- ret = -EINVAL; +- break; +- } +- + ep->ep->driver_data = ep; +- ep->ep->desc = ds; + +- if (needs_comp_desc) { +- comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + +- USB_DT_ENDPOINT_SIZE); +- ep->ep->maxburst = comp_desc->bMaxBurst + 1; +- ep->ep->comp_desc = comp_desc; ++ ret = config_ep_by_speed(func->gadget, &func->function, ep->ep); ++ if (ret) { ++ pr_err("%s: config_ep_by_speed(%s) returned %d\n", ++ __func__, ep->ep->name, ret); ++ break; + } + + ret = usb_ep_enable(ep->ep); + if (likely(!ret)) { + epfile->ep = ep; +- epfile->in = usb_endpoint_dir_in(ds); +- epfile->isoc = usb_endpoint_xfer_isoc(ds); ++ epfile->in = usb_endpoint_dir_in(ep->ep->desc); ++ epfile->isoc = usb_endpoint_xfer_isoc(ep->ep->desc); + } else { + break; + } +@@ -2980,10 +2956,8 @@ static int _ffs_func_bind(struct usb_configuration *c, + struct ffs_data *ffs = func->ffs; + + const int full = !!func->ffs->fs_descs_count; +- const int high = gadget_is_dualspeed(func->gadget) && +- func->ffs->hs_descs_count; +- const int super = gadget_is_superspeed(func->gadget) && +- func->ffs->ss_descs_count; ++ const int high = !!func->ffs->hs_descs_count; ++ const int super = !!func->ffs->ss_descs_count; + + int fs_len, hs_len, ss_len, ret, i; + struct ffs_ep *eps_ptr; +diff --git a/drivers/usb/host/ehci-hub.c b/drivers/usb/host/ehci-hub.c +index df169c8e7225..37ef2ac9cdae 100644 +--- a/drivers/usb/host/ehci-hub.c ++++ b/drivers/usb/host/ehci-hub.c +@@ -787,12 +787,12 @@ static struct urb *request_single_step_set_feature_urb( + atomic_inc(&urb->use_count); + atomic_inc(&urb->dev->urbnum); + urb->setup_dma = dma_map_single( +- hcd->self.controller, ++ hcd->self.sysdev, + urb->setup_packet, + sizeof(struct usb_ctrlrequest), + DMA_TO_DEVICE); + urb->transfer_dma = dma_map_single( +- hcd->self.controller, ++ hcd->self.sysdev, + urb->transfer_buffer, + urb->transfer_buffer_length, + DMA_FROM_DEVICE); +diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c +index 44924824fa41..1099465b27f0 100644 +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -73,6 +73,7 @@ static const char hcd_name [] = "ohci_hcd"; + + #define STATECHANGE_DELAY msecs_to_jiffies(300) + #define IO_WATCHDOG_DELAY msecs_to_jiffies(275) ++#define IO_WATCHDOG_OFF 0xffffff00 + + #include "ohci.h" + #include "pci-quirks.h" +@@ -230,7 +231,7 @@ static int ohci_urb_enqueue ( + } + + /* Start up the I/O watchdog timer, if it's not running */ +- if (!timer_pending(&ohci->io_watchdog) && ++ if (ohci->prev_frame_no == IO_WATCHDOG_OFF && + list_empty(&ohci->eds_in_use) && + !(ohci->flags & OHCI_QUIRK_QEMU)) { + ohci->prev_frame_no = ohci_frame_no(ohci); +@@ -501,6 +502,7 @@ static int ohci_init (struct ohci_hcd *ohci) + + setup_timer(&ohci->io_watchdog, io_watchdog_func, + (unsigned long) ohci); ++ ohci->prev_frame_no = IO_WATCHDOG_OFF; + + ohci->hcca = dma_alloc_coherent (hcd->self.controller, + sizeof(*ohci->hcca), &ohci->hcca_dma, GFP_KERNEL); +@@ -730,7 +732,7 @@ static void io_watchdog_func(unsigned long _ohci) + u32 head; + struct ed *ed; + struct td *td, *td_start, *td_next; +- unsigned frame_no; ++ unsigned frame_no, prev_frame_no = IO_WATCHDOG_OFF; + unsigned long flags; + + spin_lock_irqsave(&ohci->lock, flags); +@@ -835,7 +837,7 @@ static void io_watchdog_func(unsigned long _ohci) + } + } + if (!list_empty(&ohci->eds_in_use)) { +- ohci->prev_frame_no = frame_no; ++ prev_frame_no = frame_no; + ohci->prev_wdh_cnt = ohci->wdh_cnt; + ohci->prev_donehead = ohci_readl(ohci, + &ohci->regs->donehead); +@@ -845,6 +847,7 @@ static void io_watchdog_func(unsigned long _ohci) + } + + done: ++ ohci->prev_frame_no = prev_frame_no; + spin_unlock_irqrestore(&ohci->lock, flags); + } + +@@ -973,6 +976,7 @@ static void ohci_stop (struct usb_hcd *hcd) + if (quirk_nec(ohci)) + flush_work(&ohci->nec_work); + del_timer_sync(&ohci->io_watchdog); ++ ohci->prev_frame_no = IO_WATCHDOG_OFF; + + ohci_writel (ohci, OHCI_INTR_MIE, &ohci->regs->intrdisable); + ohci_usb_reset(ohci); +diff --git a/drivers/usb/host/ohci-hub.c b/drivers/usb/host/ohci-hub.c +index 248eb7702463..aca57bcb9afe 100644 +--- a/drivers/usb/host/ohci-hub.c ++++ b/drivers/usb/host/ohci-hub.c +@@ -310,8 +310,10 @@ static int ohci_bus_suspend (struct usb_hcd *hcd) + rc = ohci_rh_suspend (ohci, 0); + spin_unlock_irq (&ohci->lock); + +- if (rc == 0) ++ if (rc == 0) { + del_timer_sync(&ohci->io_watchdog); ++ ohci->prev_frame_no = IO_WATCHDOG_OFF; ++ } + return rc; + } + +diff --git a/drivers/usb/host/ohci-q.c b/drivers/usb/host/ohci-q.c +index 641fed609911..24edb7674710 100644 +--- a/drivers/usb/host/ohci-q.c ++++ b/drivers/usb/host/ohci-q.c +@@ -1018,6 +1018,8 @@ static void finish_unlinks(struct ohci_hcd *ohci) + * have modified this list. normally it's just prepending + * entries (which we'd ignore), but paranoia won't hurt. + */ ++ *last = ed->ed_next; ++ ed->ed_next = NULL; + modified = 0; + + /* unlink urbs as requested, but rescan the list after +@@ -1076,21 +1078,22 @@ static void finish_unlinks(struct ohci_hcd *ohci) + goto rescan_this; + + /* +- * If no TDs are queued, take ED off the ed_rm_list. ++ * If no TDs are queued, ED is now idle. + * Otherwise, if the HC is running, reschedule. +- * If not, leave it on the list for further dequeues. ++ * If the HC isn't running, add ED back to the ++ * start of the list for later processing. + */ + if (list_empty(&ed->td_list)) { +- *last = ed->ed_next; +- ed->ed_next = NULL; + ed->state = ED_IDLE; + list_del(&ed->in_use_list); + } else if (ohci->rh_state == OHCI_RH_RUNNING) { +- *last = ed->ed_next; +- ed->ed_next = NULL; + ed_schedule(ohci, ed); + } else { +- last = &ed->ed_next; ++ ed->ed_next = ohci->ed_rm_list; ++ ohci->ed_rm_list = ed; ++ /* Don't loop on the same ED */ ++ if (last == &ohci->ed_rm_list) ++ last = &ed->ed_next; + } + + if (modified) +diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c +index 680bddb3ce05..6635a3c990f6 100644 +--- a/drivers/usb/misc/ldusb.c ++++ b/drivers/usb/misc/ldusb.c +@@ -46,6 +46,9 @@ + #define USB_DEVICE_ID_LD_MICROCASSYTIME 0x1033 /* USB Product ID of Micro-CASSY Time (reserved) */ + #define USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE 0x1035 /* USB Product ID of Micro-CASSY Temperature */ + #define USB_DEVICE_ID_LD_MICROCASSYPH 0x1038 /* USB Product ID of Micro-CASSY pH */ ++#define USB_DEVICE_ID_LD_POWERANALYSERCASSY 0x1040 /* USB Product ID of Power Analyser CASSY */ ++#define USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY 0x1042 /* USB Product ID of Converter Controller CASSY */ ++#define USB_DEVICE_ID_LD_MACHINETESTCASSY 0x1043 /* USB Product ID of Machine Test CASSY */ + #define USB_DEVICE_ID_LD_JWM 0x1080 /* USB Product ID of Joule and Wattmeter */ + #define USB_DEVICE_ID_LD_DMMP 0x1081 /* USB Product ID of Digital Multimeter P (reserved) */ + #define USB_DEVICE_ID_LD_UMIP 0x1090 /* USB Product ID of UMI P */ +@@ -88,6 +91,9 @@ static const struct usb_device_id ld_usb_table[] = { + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTIME) }, + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYTEMPERATURE) }, + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MICROCASSYPH) }, ++ { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_POWERANALYSERCASSY) }, ++ { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_CONVERTERCONTROLLERCASSY) }, ++ { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_MACHINETESTCASSY) }, + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_JWM) }, + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_DMMP) }, + { USB_DEVICE(USB_VENDOR_ID_LD, USB_DEVICE_ID_LD_UMIP) }, +diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c +index b17450a59882..b5cc08d8aa22 100644 +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -418,13 +418,7 @@ static void musb_advance_schedule(struct musb *musb, struct urb *urb, + } + } + +- /* +- * The pipe must be broken if current urb->status is set, so don't +- * start next urb. +- * TODO: to minimize the risk of regression, only check urb->status +- * for RX, until we have a test case to understand the behavior of TX. +- */ +- if ((!status || !is_in) && qh && qh->is_ready) { ++ if (qh != NULL && qh->is_ready) { + musb_dbg(musb, "... next ep%d %cX urb %p", + hw_ep->epnum, is_in ? 'R' : 'T', next_urb(qh)); + musb_start_urb(musb, is_in, qh); +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index 50285b01da92..5d369b38868a 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -998,6 +998,10 @@ static int usbhsf_dma_prepare_pop_with_usb_dmac(struct usbhs_pkt *pkt, + if ((uintptr_t)pkt->buf & (USBHS_USB_DMAC_XFER_SIZE - 1)) + goto usbhsf_pio_prepare_pop; + ++ /* return at this time if the pipe is running */ ++ if (usbhs_pipe_is_running(pipe)) ++ return 0; ++ + usbhs_pipe_config_change_bfre(pipe, 1); + + ret = usbhsf_fifo_select(pipe, fifo, 0); +@@ -1188,6 +1192,7 @@ static int usbhsf_dma_pop_done_with_usb_dmac(struct usbhs_pkt *pkt, + usbhsf_fifo_clear(pipe, fifo); + pkt->actual = usbhs_dma_calc_received_size(pkt, chan, rcv_len); + ++ usbhs_pipe_running(pipe, 0); + usbhsf_dma_stop(pipe, fifo); + usbhsf_dma_unmap(pkt); + usbhsf_fifo_unselect(pipe, pipe->fifo); +diff --git a/drivers/xen/tmem.c b/drivers/xen/tmem.c +index bf13d1ec51f3..04e7b3b29bac 100644 +--- a/drivers/xen/tmem.c ++++ b/drivers/xen/tmem.c +@@ -284,6 +284,10 @@ static int tmem_frontswap_store(unsigned type, pgoff_t offset, + int pool = tmem_frontswap_poolid; + int ret; + ++ /* THP isn't supported */ ++ if (PageTransHuge(page)) ++ return -1; ++ + if (pool < 0) + return -1; + if (ind64 != ind) +diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h +index fec5076eda91..dcde9471897d 100644 +--- a/include/linux/kconfig.h ++++ b/include/linux/kconfig.h +@@ -4,6 +4,12 @@ + + #include + ++#ifdef CONFIG_CPU_BIG_ENDIAN ++#define __BIG_ENDIAN 4321 ++#else ++#define __LITTLE_ENDIAN 1234 ++#endif ++ + #define __ARG_PLACEHOLDER_1 0, + #define __take_second_arg(__ignored, val, ...) val + +@@ -64,4 +70,7 @@ + */ + #define IS_ENABLED(option) __or(IS_BUILTIN(option), IS_MODULE(option)) + ++/* Make sure we always have all types and struct attributes defined. */ ++#include ++ + #endif /* __LINUX_KCONFIG_H */ +diff --git a/mm/zswap.c b/mm/zswap.c +index d39581a076c3..597008a44f70 100644 +--- a/mm/zswap.c ++++ b/mm/zswap.c +@@ -970,6 +970,12 @@ static int zswap_frontswap_store(unsigned type, pgoff_t offset, + u8 *src, *dst; + struct zswap_header *zhdr; + ++ /* THP isn't supported */ ++ if (PageTransHuge(page)) { ++ ret = -EINVAL; ++ goto reject; ++ } ++ + if (!zswap_enabled || !tree) { + ret = -ENODEV; + goto reject; +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index c7df4969f80a..f56aab54e0c8 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -1563,10 +1563,7 @@ int ip_getsockopt(struct sock *sk, int level, + if (get_user(len, optlen)) + return -EFAULT; + +- lock_sock(sk); +- err = nf_getsockopt(sk, PF_INET, optname, optval, +- &len); +- release_sock(sk); ++ err = nf_getsockopt(sk, PF_INET, optname, optval, &len); + if (err >= 0) + err = put_user(len, optlen); + return err; +@@ -1598,9 +1595,7 @@ int compat_ip_getsockopt(struct sock *sk, int level, int optname, + if (get_user(len, optlen)) + return -EFAULT; + +- lock_sock(sk); + err = compat_nf_getsockopt(sk, PF_INET, optname, optval, &len); +- release_sock(sk); + if (err >= 0) + err = put_user(len, optlen); + return err; +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index 24b69384bdbf..1276d5bd5675 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -1355,10 +1355,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname, + if (get_user(len, optlen)) + return -EFAULT; + +- lock_sock(sk); +- err = nf_getsockopt(sk, PF_INET6, optname, optval, +- &len); +- release_sock(sk); ++ err = nf_getsockopt(sk, PF_INET6, optname, optval, &len); + if (err >= 0) + err = put_user(len, optlen); + } +@@ -1397,10 +1394,7 @@ int compat_ipv6_getsockopt(struct sock *sk, int level, int optname, + if (get_user(len, optlen)) + return -EFAULT; + +- lock_sock(sk); +- err = compat_nf_getsockopt(sk, PF_INET6, +- optname, optval, &len); +- release_sock(sk); ++ err = compat_nf_getsockopt(sk, PF_INET6, optname, optval, &len); + if (err >= 0) + err = put_user(len, optlen); + } +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index fb15d3b97cb2..84f757c5d91a 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2863,7 +2863,7 @@ cfg80211_beacon_dup(struct cfg80211_beacon_data *beacon) + } + if (beacon->probe_resp_len) { + new_beacon->probe_resp_len = beacon->probe_resp_len; +- beacon->probe_resp = pos; ++ new_beacon->probe_resp = pos; + memcpy(pos, beacon->probe_resp, beacon->probe_resp_len); + pos += beacon->probe_resp_len; + } diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.23-24.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.23-24.patch new file mode 100644 index 000000000000..8255ecea41f5 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.23-24.patch @@ -0,0 +1,3869 @@ +diff --git a/Makefile b/Makefile +index 169f3199274f..38acc6047d7d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 23 ++SUBLEVEL = 24 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/ls1021a-qds.dts b/arch/arm/boot/dts/ls1021a-qds.dts +index 940875316d0f..67b4de0e3439 100644 +--- a/arch/arm/boot/dts/ls1021a-qds.dts ++++ b/arch/arm/boot/dts/ls1021a-qds.dts +@@ -215,7 +215,7 @@ + reg = <0x2a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts +index a8b148ad1dd2..44715c8ef756 100644 +--- a/arch/arm/boot/dts/ls1021a-twr.dts ++++ b/arch/arm/boot/dts/ls1021a-twr.dts +@@ -187,7 +187,7 @@ + reg = <0x0a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + +diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S +index 1712f132b80d..b83fdc06286a 100644 +--- a/arch/arm/lib/csumpartialcopyuser.S ++++ b/arch/arm/lib/csumpartialcopyuser.S +@@ -85,7 +85,11 @@ + .pushsection .text.fixup,"ax" + .align 4 + 9001: mov r4, #-EFAULT ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ ldr r5, [sp, #9*4] @ *err_ptr ++#else + ldr r5, [sp, #8*4] @ *err_ptr ++#endif + str r4, [r5] + ldmia sp, {r1, r2} @ retrieve dst, len + add r2, r2, r1 +diff --git a/arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts b/arch/arm64/boot/dts/marvell/armada-8040-mcbin.dts +index 2b6b792dab93..e6ee7443b530 100644 +diff --git a/arch/arm64/boot/dts/renesas/ulcb.dtsi b/arch/arm64/boot/dts/renesas/ulcb.dtsi +index 1b868df2393f..e95d99265af9 100644 +--- a/arch/arm64/boot/dts/renesas/ulcb.dtsi ++++ b/arch/arm64/boot/dts/renesas/ulcb.dtsi +@@ -145,7 +145,6 @@ + &avb { + pinctrl-0 = <&avb_pins>; + pinctrl-names = "default"; +- renesas,no-ether-link; + phy-handle = <&phy0>; + status = "okay"; + +diff --git a/arch/ia64/kernel/time.c b/arch/ia64/kernel/time.c +index aa7be020a904..c954523d00fe 100644 +--- a/arch/ia64/kernel/time.c ++++ b/arch/ia64/kernel/time.c +@@ -88,7 +88,7 @@ void vtime_flush(struct task_struct *tsk) + } + + if (ti->softirq_time) { +- delta = cycle_to_nsec(ti->softirq_time)); ++ delta = cycle_to_nsec(ti->softirq_time); + account_system_index_time(tsk, delta, CPUTIME_SOFTIRQ); + } + +diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile +index 78c2affeabf8..e84e12655fa8 100644 +--- a/arch/mips/lib/Makefile ++++ b/arch/mips/lib/Makefile +@@ -16,4 +16,5 @@ obj-$(CONFIG_CPU_R3000) += r3k_dump_tlb.o + obj-$(CONFIG_CPU_TX39XX) += r3k_dump_tlb.o + + # libgcc-style stuff needed in the kernel +-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o ++obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \ ++ ucmpdi2.o +diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h +index 28002ed90c2c..199a7f96282f 100644 +--- a/arch/mips/lib/libgcc.h ++++ b/arch/mips/lib/libgcc.h +@@ -10,10 +10,18 @@ typedef int word_type __attribute__ ((mode (__word__))); + struct DWstruct { + int high, low; + }; ++ ++struct TWstruct { ++ long long high, low; ++}; + #elif defined(__LITTLE_ENDIAN) + struct DWstruct { + int low, high; + }; ++ ++struct TWstruct { ++ long long low, high; ++}; + #else + #error I feel sick. + #endif +@@ -23,4 +31,13 @@ typedef union { + long long ll; + } DWunion; + ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) ++typedef int ti_type __attribute__((mode(TI))); ++ ++typedef union { ++ struct TWstruct s; ++ ti_type ti; ++} TWunion; ++#endif ++ + #endif /* __ASM_LIBGCC_H */ +diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c +new file mode 100644 +index 000000000000..111ad475aa0c +--- /dev/null ++++ b/arch/mips/lib/multi3.c +@@ -0,0 +1,54 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++ ++#include "libgcc.h" ++ ++/* ++ * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that ++ * specific case only we'll implement it here. ++ * ++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981 ++ */ ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7) ++ ++/* multiply 64-bit values, low 64-bits returned */ ++static inline long long notrace dmulu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmulu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 64-bit unsigned values, high 64-bits of 128-bit result returned */ ++static inline long long notrace dmuhu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmuhu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 128-bit values, low 128-bits returned */ ++ti_type notrace __multi3(ti_type a, ti_type b) ++{ ++ TWunion res, aa, bb; ++ ++ aa.ti = a; ++ bb.ti = b; ++ ++ /* ++ * a * b = (a.lo * b.lo) ++ * + 2^64 * (a.hi * b.lo + a.lo * b.hi) ++ * [+ 2^128 * (a.hi * b.hi)] ++ */ ++ res.s.low = dmulu(aa.s.low, bb.s.low); ++ res.s.high = dmuhu(aa.s.low, bb.s.low); ++ res.s.high += dmulu(aa.s.high, bb.s.low); ++ res.s.high += dmulu(aa.s.low, bb.s.high); ++ ++ return res.ti; ++} ++EXPORT_SYMBOL(__multi3); ++ ++#endif /* 64BIT && CPU_MIPSR6 && GCC7 */ +diff --git a/arch/parisc/include/asm/thread_info.h b/arch/parisc/include/asm/thread_info.h +index c980a02a52bc..598c8d60fa5e 100644 +--- a/arch/parisc/include/asm/thread_info.h ++++ b/arch/parisc/include/asm/thread_info.h +@@ -35,7 +35,12 @@ struct thread_info { + + /* thread information allocation */ + ++#ifdef CONFIG_IRQSTACKS ++#define THREAD_SIZE_ORDER 2 /* PA-RISC requires at least 16k stack */ ++#else + #define THREAD_SIZE_ORDER 3 /* PA-RISC requires at least 32k stack */ ++#endif ++ + /* Be sure to hunt all references to this down when you change the size of + * the kernel stack */ + #define THREAD_SIZE (PAGE_SIZE << THREAD_SIZE_ORDER) +diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c +index e45b5f10645a..e9149d05d30b 100644 +--- a/arch/powerpc/platforms/pseries/dlpar.c ++++ b/arch/powerpc/platforms/pseries/dlpar.c +@@ -586,11 +586,26 @@ static ssize_t dlpar_show(struct class *class, struct class_attribute *attr, + + static CLASS_ATTR_RW(dlpar); + +-static int __init pseries_dlpar_init(void) ++int __init dlpar_workqueue_init(void) + { ++ if (pseries_hp_wq) ++ return 0; ++ + pseries_hp_wq = alloc_workqueue("pseries hotplug workqueue", +- WQ_UNBOUND, 1); ++ WQ_UNBOUND, 1); ++ ++ return pseries_hp_wq ? 0 : -ENOMEM; ++} ++ ++static int __init dlpar_sysfs_init(void) ++{ ++ int rc; ++ ++ rc = dlpar_workqueue_init(); ++ if (rc) ++ return rc; ++ + return sysfs_create_file(kernel_kobj, &class_attr_dlpar.attr); + } +-machine_device_initcall(pseries, pseries_dlpar_init); ++machine_device_initcall(pseries, dlpar_sysfs_init); + +diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h +index 4470a3194311..1ae1d9f4dbe9 100644 +--- a/arch/powerpc/platforms/pseries/pseries.h ++++ b/arch/powerpc/platforms/pseries/pseries.h +@@ -98,4 +98,6 @@ static inline unsigned long cmo_get_page_size(void) + return CMO_PageSize; + } + ++int dlpar_workqueue_init(void); ++ + #endif /* _PSERIES_PSERIES_H */ +diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c +index 4923ffe230cf..5e1ef9150182 100644 +--- a/arch/powerpc/platforms/pseries/ras.c ++++ b/arch/powerpc/platforms/pseries/ras.c +@@ -48,6 +48,28 @@ static irqreturn_t ras_epow_interrupt(int irq, void *dev_id); + static irqreturn_t ras_error_interrupt(int irq, void *dev_id); + + ++/* ++ * Enable the hotplug interrupt late because processing them may touch other ++ * devices or systems (e.g. hugepages) that have not been initialized at the ++ * subsys stage. ++ */ ++int __init init_ras_hotplug_IRQ(void) ++{ ++ struct device_node *np; ++ ++ /* Hotplug Events */ ++ np = of_find_node_by_path("/event-sources/hot-plug-events"); ++ if (np != NULL) { ++ if (dlpar_workqueue_init() == 0) ++ request_event_sources_irqs(np, ras_hotplug_interrupt, ++ "RAS_HOTPLUG"); ++ of_node_put(np); ++ } ++ ++ return 0; ++} ++machine_late_initcall(pseries, init_ras_hotplug_IRQ); ++ + /* + * Initialize handlers for the set of interrupts caused by hardware errors + * and power system events. +@@ -66,14 +88,6 @@ static int __init init_ras_IRQ(void) + of_node_put(np); + } + +- /* Hotplug Events */ +- np = of_find_node_by_path("/event-sources/hot-plug-events"); +- if (np != NULL) { +- request_event_sources_irqs(np, ras_hotplug_interrupt, +- "RAS_HOTPLUG"); +- of_node_put(np); +- } +- + /* EPOW Events */ + np = of_find_node_by_path("/event-sources/epow-events"); + if (np != NULL) { +diff --git a/arch/sh/boards/mach-se/770x/setup.c b/arch/sh/boards/mach-se/770x/setup.c +index 77c35350ee77..b7fa7a87e946 100644 +--- a/arch/sh/boards/mach-se/770x/setup.c ++++ b/arch/sh/boards/mach-se/770x/setup.c +@@ -9,6 +9,7 @@ + */ + #include + #include ++#include + #include + #include + #include +@@ -115,6 +116,11 @@ static struct platform_device heartbeat_device = { + #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\ + defined(CONFIG_CPU_SUBTYPE_SH7712) + /* SH771X Ethernet driver */ ++static struct sh_eth_plat_data sh_eth_plat = { ++ .phy = PHY_ID, ++ .phy_interface = PHY_INTERFACE_MODE_MII, ++}; ++ + static struct resource sh_eth0_resources[] = { + [0] = { + .start = SH_ETH0_BASE, +@@ -132,7 +138,7 @@ static struct platform_device sh_eth0_device = { + .name = "sh771x-ether", + .id = 0, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth0_resources), + .resource = sh_eth0_resources, +@@ -155,7 +161,7 @@ static struct platform_device sh_eth1_device = { + .name = "sh771x-ether", + .id = 1, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth1_resources), + .resource = sh_eth1_resources, +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 1c2558430cf0..56457cb73448 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3847,6 +3847,8 @@ static struct attribute *intel_pmu_attrs[] = { + + __init int intel_pmu_init(void) + { ++ struct attribute **extra_attr = NULL; ++ struct attribute **to_free = NULL; + union cpuid10_edx edx; + union cpuid10_eax eax; + union cpuid10_ebx ebx; +@@ -3854,7 +3856,6 @@ __init int intel_pmu_init(void) + unsigned int unused; + struct extra_reg *er; + int version, i; +- struct attribute **extra_attr = NULL; + char *name; + + if (!cpu_has(&boot_cpu_data, X86_FEATURE_ARCH_PERFMON)) { +@@ -4294,6 +4295,7 @@ __init int intel_pmu_init(void) + extra_attr = boot_cpu_has(X86_FEATURE_RTM) ? + hsw_format_attr : nhm_format_attr; + extra_attr = merge_attr(extra_attr, skl_format_attr); ++ to_free = extra_attr; + x86_pmu.cpu_events = get_hsw_events_attrs(); + intel_pmu_pebs_data_source_skl( + boot_cpu_data.x86_model == INTEL_FAM6_SKYLAKE_X); +@@ -4401,6 +4403,7 @@ __init int intel_pmu_init(void) + pr_cont("full-width counters, "); + } + ++ kfree(to_free); + return 0; + } + +diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h +index 219faaec51df..386a6900e206 100644 +--- a/arch/x86/include/asm/asm.h ++++ b/arch/x86/include/asm/asm.h +@@ -136,6 +136,7 @@ + #endif + + #ifndef __ASSEMBLY__ ++#ifndef __BPF__ + /* + * This output constraint should be used for any inline asm which has a "call" + * instruction. Otherwise the asm may be inserted before the frame pointer +@@ -145,5 +146,6 @@ + register unsigned long current_stack_pointer asm(_ASM_SP); + #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer) + #endif ++#endif + + #endif /* _ASM_X86_ASM_H */ +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index e84cb4c75cd0..c54361a22f59 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -928,9 +928,6 @@ void __init setup_arch(char **cmdline_p) + set_bit(EFI_BOOT, &efi.flags); + set_bit(EFI_64BIT, &efi.flags); + } +- +- if (efi_enabled(EFI_BOOT)) +- efi_memblock_x86_reserve_range(); + #endif + + x86_init.oem.arch_setup(); +@@ -984,6 +981,8 @@ void __init setup_arch(char **cmdline_p) + + parse_early_param(); + ++ if (efi_enabled(EFI_BOOT)) ++ efi_memblock_x86_reserve_range(); + #ifdef CONFIG_MEMORY_HOTPLUG + /* + * Memory used by the kernel cannot be hot-removed because Linux +diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c +index 60244bfaf88f..4565f31bd398 100644 +--- a/arch/x86/kernel/stacktrace.c ++++ b/arch/x86/kernel/stacktrace.c +@@ -160,8 +160,12 @@ int save_stack_trace_tsk_reliable(struct task_struct *tsk, + { + int ret; + ++ /* ++ * If the task doesn't have a stack (e.g., a zombie), the stack is ++ * "reliably" empty. ++ */ + if (!try_get_task_stack(tsk)) +- return -EINVAL; ++ return 0; + + ret = __save_stack_trace_reliable(trace, tsk); + +diff --git a/arch/x86/platform/intel-mid/device_libs/platform_bt.c b/arch/x86/platform/intel-mid/device_libs/platform_bt.c +index dc036e511f48..5a0483e7bf66 100644 +--- a/arch/x86/platform/intel-mid/device_libs/platform_bt.c ++++ b/arch/x86/platform/intel-mid/device_libs/platform_bt.c +@@ -60,7 +60,7 @@ static int __init tng_bt_sfi_setup(struct bt_sfi_data *ddata) + return 0; + } + +-static const struct bt_sfi_data tng_bt_sfi_data __initdata = { ++static struct bt_sfi_data tng_bt_sfi_data __initdata = { + .setup = tng_bt_sfi_setup, + }; + +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index d669e9d89001..c9081c6671f0 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -1,8 +1,12 @@ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++#include ++#endif + #include + #include + + #include + #include ++#include + + #include + #include +@@ -331,3 +335,80 @@ void xen_arch_unregister_cpu(int num) + } + EXPORT_SYMBOL(xen_arch_unregister_cpu); + #endif ++ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++void __init arch_xen_balloon_init(struct resource *hostmem_resource) ++{ ++ struct xen_memory_map memmap; ++ int rc; ++ unsigned int i, last_guest_ram; ++ phys_addr_t max_addr = PFN_PHYS(max_pfn); ++ struct e820_table *xen_e820_table; ++ const struct e820_entry *entry; ++ struct resource *res; ++ ++ if (!xen_initial_domain()) ++ return; ++ ++ xen_e820_table = kmalloc(sizeof(*xen_e820_table), GFP_KERNEL); ++ if (!xen_e820_table) ++ return; ++ ++ memmap.nr_entries = ARRAY_SIZE(xen_e820_table->entries); ++ set_xen_guest_handle(memmap.buffer, xen_e820_table->entries); ++ rc = HYPERVISOR_memory_op(XENMEM_machine_memory_map, &memmap); ++ if (rc) { ++ pr_warn("%s: Can't read host e820 (%d)\n", __func__, rc); ++ goto out; ++ } ++ ++ last_guest_ram = 0; ++ for (i = 0; i < memmap.nr_entries; i++) { ++ if (xen_e820_table->entries[i].addr >= max_addr) ++ break; ++ if (xen_e820_table->entries[i].type == E820_TYPE_RAM) ++ last_guest_ram = i; ++ } ++ ++ entry = &xen_e820_table->entries[last_guest_ram]; ++ if (max_addr >= entry->addr + entry->size) ++ goto out; /* No unallocated host RAM. */ ++ ++ hostmem_resource->start = max_addr; ++ hostmem_resource->end = entry->addr + entry->size; ++ ++ /* ++ * Mark non-RAM regions between the end of dom0 RAM and end of host RAM ++ * as unavailable. The rest of that region can be used for hotplug-based ++ * ballooning. ++ */ ++ for (; i < memmap.nr_entries; i++) { ++ entry = &xen_e820_table->entries[i]; ++ ++ if (entry->type == E820_TYPE_RAM) ++ continue; ++ ++ if (entry->addr >= hostmem_resource->end) ++ break; ++ ++ res = kzalloc(sizeof(*res), GFP_KERNEL); ++ if (!res) ++ goto out; ++ ++ res->name = "Unavailable host RAM"; ++ res->start = entry->addr; ++ res->end = (entry->addr + entry->size < hostmem_resource->end) ? ++ entry->addr + entry->size : hostmem_resource->end; ++ rc = insert_resource(hostmem_resource, res); ++ if (rc) { ++ pr_warn("%s: Can't insert [%llx - %llx) (%d)\n", ++ __func__, res->start, res->end, rc); ++ kfree(res); ++ goto out; ++ } ++ } ++ ++ out: ++ kfree(xen_e820_table); ++} ++#endif /* CONFIG_XEN_BALLOON_MEMORY_HOTPLUG */ +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index 899a22a02e95..f896c2975545 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -88,6 +88,8 @@ + #include "multicalls.h" + #include "pmu.h" + ++#include "../kernel/cpu/cpu.h" /* get_cpu_cap() */ ++ + void *xen_initial_gdt; + + static int xen_cpu_up_prepare_pv(unsigned int cpu); +@@ -1257,6 +1259,7 @@ asmlinkage __visible void __init xen_start_kernel(void) + __userpte_alloc_gfp &= ~__GFP_HIGHMEM; + + /* Work out if we support NX */ ++ get_cpu_cap(&boot_cpu_data); + x86_configure_nx(); + + /* Get mfn list */ +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index d0b943a6b117..042e9c422b21 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -1902,6 +1902,18 @@ void __init xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn) + /* Graft it onto L4[511][510] */ + copy_page(level2_kernel_pgt, l2); + ++ /* ++ * Zap execute permission from the ident map. Due to the sharing of ++ * L1 entries we need to do this in the L2. ++ */ ++ if (__supported_pte_mask & _PAGE_NX) { ++ for (i = 0; i < PTRS_PER_PMD; ++i) { ++ if (pmd_none(level2_ident_pgt[i])) ++ continue; ++ level2_ident_pgt[i] = pmd_set_flags(level2_ident_pgt[i], _PAGE_NX); ++ } ++ } ++ + /* Copy the initial P->M table mappings if necessary. */ + i = pgd_index(xen_start_info->mfn_list); + if (i && i < pgd_index(__START_KERNEL_map)) +diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c +index c114ca767b3b..6e0d2086eacb 100644 +--- a/arch/x86/xen/setup.c ++++ b/arch/x86/xen/setup.c +@@ -808,7 +808,6 @@ char * __init xen_memory_setup(void) + addr = xen_e820_table.entries[0].addr; + size = xen_e820_table.entries[0].size; + while (i < xen_e820_table.nr_entries) { +- bool discard = false; + + chunk_size = size; + type = xen_e820_table.entries[i].type; +@@ -824,11 +823,10 @@ char * __init xen_memory_setup(void) + xen_add_extra_mem(pfn_s, n_pfns); + xen_max_p2m_pfn = pfn_s + n_pfns; + } else +- discard = true; ++ type = E820_TYPE_UNUSABLE; + } + +- if (!discard) +- xen_align_and_add_e820_region(addr, chunk_size, type); ++ xen_align_and_add_e820_region(addr, chunk_size, type); + + addr += chunk_size; + size -= chunk_size; +diff --git a/block/blk-core.c b/block/blk-core.c +index f3750389e351..95b7ea996ac2 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -531,6 +531,13 @@ static void __blk_drain_queue(struct request_queue *q, bool drain_all) + } + } + ++void blk_drain_queue(struct request_queue *q) ++{ ++ spin_lock_irq(q->queue_lock); ++ __blk_drain_queue(q, true); ++ spin_unlock_irq(q->queue_lock); ++} ++ + /** + * blk_queue_bypass_start - enter queue bypass mode + * @q: queue of interest +@@ -655,8 +662,6 @@ void blk_cleanup_queue(struct request_queue *q) + */ + blk_freeze_queue(q); + spin_lock_irq(lock); +- if (!q->mq_ops) +- __blk_drain_queue(q, true); + queue_flag_set(QUEUE_FLAG_DEAD, q); + spin_unlock_irq(lock); + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 98a18609755e..b60798a30ea2 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -159,6 +159,8 @@ void blk_freeze_queue(struct request_queue *q) + * exported to drivers as the only user for unfreeze is blk_mq. + */ + blk_freeze_queue_start(q); ++ if (!q->mq_ops) ++ blk_drain_queue(q); + blk_mq_freeze_queue_wait(q); + } + +diff --git a/block/blk.h b/block/blk.h +index 85be8b232b37..b2c287c2c6a3 100644 +--- a/block/blk.h ++++ b/block/blk.h +@@ -362,4 +362,6 @@ static inline void blk_queue_bounce(struct request_queue *q, struct bio **bio) + } + #endif /* CONFIG_BOUNCE */ + ++extern void blk_drain_queue(struct request_queue *q); ++ + #endif /* BLK_INTERNAL_H */ +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 53b7fa4cf4ab..4e4640bb82b9 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -693,7 +693,7 @@ void af_alg_free_areq_sgls(struct af_alg_async_req *areq) + unsigned int i; + + list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) { +- ctx->rcvused -= rsgl->sg_num_bytes; ++ atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused); + af_alg_free_sg(&rsgl->sgl); + list_del(&rsgl->list); + if (rsgl != &areq->first_rsgl) +@@ -1192,7 +1192,7 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, + + areq->last_rsgl = rsgl; + len += err; +- ctx->rcvused += err; ++ atomic_add(err, &ctx->rcvused); + rsgl->sg_num_bytes = err; + iov_iter_advance(&msg->msg_iter, err); + } +diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c +index 782cb8fec323..f138af18b500 100644 +--- a/crypto/algif_aead.c ++++ b/crypto/algif_aead.c +@@ -571,7 +571,7 @@ static int aead_accept_parent_nokey(void *private, struct sock *sk) + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; + ctx->used = 0; +- ctx->rcvused = 0; ++ atomic_set(&ctx->rcvused, 0); + ctx->more = 0; + ctx->merge = 0; + ctx->enc = 0; +diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c +index 7a3e663d54d5..90bc4e0f0785 100644 +--- a/crypto/algif_skcipher.c ++++ b/crypto/algif_skcipher.c +@@ -391,7 +391,7 @@ static int skcipher_accept_parent_nokey(void *private, struct sock *sk) + INIT_LIST_HEAD(&ctx->tsgl_list); + ctx->len = len; + ctx->used = 0; +- ctx->rcvused = 0; ++ atomic_set(&ctx->rcvused, 0); + ctx->more = 0; + ctx->merge = 0; + ctx->enc = 0; +diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c +index 6775f2c74e25..c7568869284e 100644 +--- a/drivers/dma/fsl-edma.c ++++ b/drivers/dma/fsl-edma.c +@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit( + } + } + +-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma) ++static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks) + { + int i; + +- for (i = 0; i < DMAMUX_NR; i++) ++ for (i = 0; i < nr_clocks; i++) + clk_disable_unprepare(fsl_edma->muxclk[i]); + } + +@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i); + fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(fsl_edma->muxbase[i])) ++ if (IS_ERR(fsl_edma->muxbase[i])) { ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxbase[i]); ++ } + + sprintf(clkname, "dmamux%d", i); + fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname); + if (IS_ERR(fsl_edma->muxclk[i])) { + dev_err(&pdev->dev, "Missing DMAMUX block clock.\n"); ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxclk[i]); + } + + ret = clk_prepare_enable(fsl_edma->muxclk[i]); +- if (ret) { +- /* disable only clks which were enabled on error */ +- for (; i >= 0; i--) +- clk_disable_unprepare(fsl_edma->muxclk[i]); +- +- dev_err(&pdev->dev, "DMAMUX clk block failed.\n"); +- return ret; +- } ++ if (ret) ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + + } + +@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, + "Can't register Freescale eDMA engine. (%d)\n", ret); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "Can't register Freescale eDMA of_dma. (%d)\n", ret); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev) + fsl_edma_cleanup_vchan(&fsl_edma->dma_dev); + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + + return 0; + } +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 46485692db48..059db50109bc 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -13240,7 +13240,7 @@ intel_primary_plane_create(struct drm_i915_private *dev_priv, enum pipe pipe) + primary->frontbuffer_bit = INTEL_FRONTBUFFER_PRIMARY(pipe); + primary->check_plane = intel_check_primary_plane; + +- if (INTEL_GEN(dev_priv) >= 10 || IS_GEMINILAKE(dev_priv)) { ++ if (INTEL_GEN(dev_priv) >= 10) { + intel_primary_formats = skl_primary_formats; + num_formats = ARRAY_SIZE(skl_primary_formats); + modifiers = skl_format_modifiers_ccs; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +index a4cb82495cee..245c946ea661 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev) + return ret; + + pci->irq = pdev->irq; ++ ++ /* Ensure MSI interrupts are armed, for the case where there are ++ * already interrupts pending (for whatever reason) at load time. ++ */ ++ if (pci->msi) ++ pci->func->msi_rearm(pci); ++ + return ret; + } + +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c +index 871599826773..91f9263f3c3b 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -821,6 +821,8 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages) + pr_info("Initializing pool allocator\n"); + + _manager = kzalloc(sizeof(*_manager), GFP_KERNEL); ++ if (!_manager) ++ return -ENOMEM; + + ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc"); + +diff --git a/drivers/infiniband/core/core_priv.h b/drivers/infiniband/core/core_priv.h +index a1d687a664f8..66f0268f37a6 100644 +--- a/drivers/infiniband/core/core_priv.h ++++ b/drivers/infiniband/core/core_priv.h +@@ -314,7 +314,7 @@ static inline int ib_mad_enforce_security(struct ib_mad_agent_private *map, + } + #endif + +-struct ib_device *__ib_device_get_by_index(u32 ifindex); ++struct ib_device *ib_device_get_by_index(u32 ifindex); + /* RDMA device netlink */ + void nldev_init(void); + void nldev_exit(void); +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index b4b28ff8b7dc..d7d042a20ab4 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -134,7 +134,7 @@ static int ib_device_check_mandatory(struct ib_device *device) + return 0; + } + +-struct ib_device *__ib_device_get_by_index(u32 index) ++static struct ib_device *__ib_device_get_by_index(u32 index) + { + struct ib_device *device; + +@@ -145,6 +145,22 @@ struct ib_device *__ib_device_get_by_index(u32 index) + return NULL; + } + ++/* ++ * Caller is responsible to return refrerence count by calling put_device() ++ */ ++struct ib_device *ib_device_get_by_index(u32 index) ++{ ++ struct ib_device *device; ++ ++ down_read(&lists_rwsem); ++ device = __ib_device_get_by_index(index); ++ if (device) ++ get_device(&device->dev); ++ ++ up_read(&lists_rwsem); ++ return device; ++} ++ + static struct ib_device *__ib_device_get_by_name(const char *name) + { + struct ib_device *device; +diff --git a/drivers/infiniband/core/nldev.c b/drivers/infiniband/core/nldev.c +index 9a05245a1acf..0dcd1aa6f683 100644 +--- a/drivers/infiniband/core/nldev.c ++++ b/drivers/infiniband/core/nldev.c +@@ -142,27 +142,34 @@ static int nldev_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + + index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); + +- device = __ib_device_get_by_index(index); ++ device = ib_device_get_by_index(index); + if (!device) + return -EINVAL; + + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); +- if (!msg) +- return -ENOMEM; ++ if (!msg) { ++ err = -ENOMEM; ++ goto err; ++ } + + nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, + RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), + 0, 0); + + err = fill_dev_info(msg, device); +- if (err) { +- nlmsg_free(msg); +- return err; +- } ++ if (err) ++ goto err_free; + + nlmsg_end(msg, nlh); + ++ put_device(&device->dev); + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); ++ ++err_free: ++ nlmsg_free(msg); ++err: ++ put_device(&device->dev); ++ return err; + } + + static int _nldev_get_dumpit(struct ib_device *device, +@@ -220,31 +227,40 @@ static int nldev_port_get_doit(struct sk_buff *skb, struct nlmsghdr *nlh, + return -EINVAL; + + index = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); +- device = __ib_device_get_by_index(index); ++ device = ib_device_get_by_index(index); + if (!device) + return -EINVAL; + + port = nla_get_u32(tb[RDMA_NLDEV_ATTR_PORT_INDEX]); +- if (!rdma_is_port_valid(device, port)) +- return -EINVAL; ++ if (!rdma_is_port_valid(device, port)) { ++ err = -EINVAL; ++ goto err; ++ } + + msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); +- if (!msg) +- return -ENOMEM; ++ if (!msg) { ++ err = -ENOMEM; ++ goto err; ++ } + + nlh = nlmsg_put(msg, NETLINK_CB(skb).portid, nlh->nlmsg_seq, + RDMA_NL_GET_TYPE(RDMA_NL_NLDEV, RDMA_NLDEV_CMD_GET), + 0, 0); + + err = fill_port_info(msg, device, port); +- if (err) { +- nlmsg_free(msg); +- return err; +- } ++ if (err) ++ goto err_free; + + nlmsg_end(msg, nlh); ++ put_device(&device->dev); + + return rdma_nl_unicast(msg, NETLINK_CB(skb).portid); ++ ++err_free: ++ nlmsg_free(msg); ++err: ++ put_device(&device->dev); ++ return err; + } + + static int nldev_port_get_dumpit(struct sk_buff *skb, +@@ -265,7 +281,7 @@ static int nldev_port_get_dumpit(struct sk_buff *skb, + return -EINVAL; + + ifindex = nla_get_u32(tb[RDMA_NLDEV_ATTR_DEV_INDEX]); +- device = __ib_device_get_by_index(ifindex); ++ device = ib_device_get_by_index(ifindex); + if (!device) + return -EINVAL; + +@@ -299,7 +315,9 @@ static int nldev_port_get_dumpit(struct sk_buff *skb, + nlmsg_end(skb, nlh); + } + +-out: cb->args[0] = idx; ++out: ++ put_device(&device->dev); ++ cb->args[0] = idx; + return skb->len; + } + +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index e6f77f63da75..e80a7f764a74 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + goto err_free_mr; + + mr->max_pages = max_num_sg; +- + err = mlx4_mr_enable(dev->dev, &mr->mmr); + if (err) + goto err_free_pl; +@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + return &mr->ibmr; + + err_free_pl: ++ mr->ibmr.device = pd->device; + mlx4_free_priv_pages(mr); + err_free_mr: + (void) mlx4_mr_free(dev->dev, &mr->mmr); +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 37bbc543847a..231b043e2806 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1637,6 +1637,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd, + MLX5_SET(mkc, mkc, access_mode, mr->access_mode); + MLX5_SET(mkc, mkc, umr_en, 1); + ++ mr->ibmr.device = pd->device; + err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen); + if (err) + goto err_destroy_psv; +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +index ed34d5a581fa..d7162f2b7979 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_qp.c +@@ -406,6 +406,13 @@ static void pvrdma_free_qp(struct pvrdma_qp *qp) + atomic_dec(&qp->refcnt); + wait_event(qp->wait, !atomic_read(&qp->refcnt)); + ++ if (!qp->is_kernel) { ++ if (qp->rumem) ++ ib_umem_release(qp->rumem); ++ if (qp->sumem) ++ ib_umem_release(qp->sumem); ++ } ++ + pvrdma_page_dir_cleanup(dev, &qp->pdir); + + kfree(qp); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index dcc77014018d..f6935811ef3f 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -903,8 +903,8 @@ static int path_rec_start(struct net_device *dev, + return 0; + } + +-static void neigh_add_path(struct sk_buff *skb, u8 *daddr, +- struct net_device *dev) ++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr, ++ struct net_device *dev) + { + struct ipoib_dev_priv *priv = ipoib_priv(dev); + struct rdma_netdev *rn = netdev_priv(dev); +@@ -918,7 +918,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + spin_unlock_irqrestore(&priv->lock, flags); + ++dev->stats.tx_dropped; + dev_kfree_skb_any(skb); +- return; ++ return NULL; ++ } ++ ++ /* To avoid race condition, make sure that the ++ * neigh will be added only once. ++ */ ++ if (unlikely(!list_empty(&neigh->list))) { ++ spin_unlock_irqrestore(&priv->lock, flags); ++ return neigh; + } + + path = __path_find(dev, daddr + 4); +@@ -957,7 +965,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + path->ah->last_send = rn->send(dev, skb, path->ah->ah, + IPOIB_QPN(daddr)); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + } + } else { + neigh->ah = NULL; +@@ -974,7 +982,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + + err_path: + ipoib_neigh_free(neigh); +@@ -984,6 +992,8 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); ++ ++ return NULL; + } + + static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, +@@ -1092,8 +1102,9 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev) + case htons(ETH_P_TIPC): + neigh = ipoib_neigh_get(dev, phdr->hwaddr); + if (unlikely(!neigh)) { +- neigh_add_path(skb, phdr->hwaddr, dev); +- return NETDEV_TX_OK; ++ neigh = neigh_add_path(skb, phdr->hwaddr, dev); ++ if (likely(!neigh)) ++ return NETDEV_TX_OK; + } + break; + case htons(ETH_P_ARP): +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index 93e149efc1f5..9b3f47ae2016 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -816,7 +816,10 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb) + spin_lock_irqsave(&priv->lock, flags); + if (!neigh) { + neigh = ipoib_neigh_alloc(daddr, dev); +- if (neigh) { ++ /* Make sure that the neigh will be added only ++ * once to mcast list. ++ */ ++ if (neigh && list_empty(&neigh->list)) { + kref_get(&mcast->ah->ref); + neigh->ah = mcast->ah; + list_add_tail(&neigh->list, &mcast->neigh_list); +diff --git a/drivers/input/misc/xen-kbdfront.c b/drivers/input/misc/xen-kbdfront.c +index 6bf56bb5f8d9..d91f3b1c5375 100644 +--- a/drivers/input/misc/xen-kbdfront.c ++++ b/drivers/input/misc/xen-kbdfront.c +@@ -326,8 +326,6 @@ static int xenkbd_probe(struct xenbus_device *dev, + 0, width, 0, 0); + input_set_abs_params(mtouch, ABS_MT_POSITION_Y, + 0, height, 0, 0); +- input_set_abs_params(mtouch, ABS_MT_PRESSURE, +- 0, 255, 0, 0); + + ret = input_mt_init_slots(mtouch, num_cont, INPUT_MT_DIRECT); + if (ret) { +diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c +index ef1360445413..9ce6b32f52a1 100644 +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -189,6 +189,7 @@ void led_blink_set(struct led_classdev *led_cdev, + { + del_timer_sync(&led_cdev->blink_timer); + ++ clear_bit(LED_BLINK_SW, &led_cdev->work_flags); + clear_bit(LED_BLINK_ONESHOT, &led_cdev->work_flags); + clear_bit(LED_BLINK_ONESHOT_STOP, &led_cdev->work_flags); + +diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c +index edf24c148fa6..2a978d9832a7 100644 +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -1763,7 +1763,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip, + err = brcmstb_nand_verify_erased_page(mtd, chip, buf, + addr); + /* erased page bitflips corrected */ +- if (err > 0) ++ if (err >= 0) + return err; + } + +diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +index 50f8d4a1b983..d4d824ef64e9 100644 +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1067,9 +1067,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + return ret; + } + +- /* handle the block mark swapping */ +- block_mark_swapping(this, payload_virt, auxiliary_virt); +- + /* Loop over status bytes, accumulating ECC status. */ + status = auxiliary_virt + nfc_geo->auxiliary_status_offset; + +@@ -1158,6 +1155,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + max_bitflips = max_t(unsigned int, max_bitflips, *status); + } + ++ /* handle the block mark swapping */ ++ block_mark_swapping(this, buf, auxiliary_virt); ++ + if (oob_required) { + /* + * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob() +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index c4d1140116ea..ed8a2a7ce500 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -526,7 +526,7 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + data = be32_to_cpup((__be32 *)&cf->data[0]); + flexcan_write(data, &priv->tx_mb->data[0]); + } +- if (cf->can_dlc > 3) { ++ if (cf->can_dlc > 4) { + data = be32_to_cpup((__be32 *)&cf->data[4]); + flexcan_write(data, &priv->tx_mb->data[1]); + } +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index c6bd5e24005d..67df5053dc30 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1565,7 +1565,7 @@ static int ena_rss_configure(struct ena_adapter *adapter) + + static int ena_up_complete(struct ena_adapter *adapter) + { +- int rc, i; ++ int rc; + + rc = ena_rss_configure(adapter); + if (rc) +@@ -1584,17 +1584,6 @@ static int ena_up_complete(struct ena_adapter *adapter) + + ena_napi_enable_all(adapter); + +- /* Enable completion queues interrupt */ +- for (i = 0; i < adapter->num_queues; i++) +- ena_unmask_interrupt(&adapter->tx_ring[i], +- &adapter->rx_ring[i]); +- +- /* schedule napi in case we had pending packets +- * from the last time we disable napi +- */ +- for (i = 0; i < adapter->num_queues; i++) +- napi_schedule(&adapter->ena_napi[i].napi); +- + return 0; + } + +@@ -1731,7 +1720,7 @@ static int ena_create_all_io_rx_queues(struct ena_adapter *adapter) + + static int ena_up(struct ena_adapter *adapter) + { +- int rc; ++ int rc, i; + + netdev_dbg(adapter->netdev, "%s\n", __func__); + +@@ -1774,6 +1763,17 @@ static int ena_up(struct ena_adapter *adapter) + + set_bit(ENA_FLAG_DEV_UP, &adapter->flags); + ++ /* Enable completion queues interrupt */ ++ for (i = 0; i < adapter->num_queues; i++) ++ ena_unmask_interrupt(&adapter->tx_ring[i], ++ &adapter->rx_ring[i]); ++ ++ /* schedule napi in case we had pending packets ++ * from the last time we disable napi ++ */ ++ for (i = 0; i < adapter->num_queues; i++) ++ napi_schedule(&adapter->ena_napi[i].napi); ++ + return rc; + + err_up: +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h +index 0207927dc8a6..4ebd53b3c7da 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_hw.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_hw.h +@@ -85,7 +85,9 @@ struct aq_hw_ops { + void (*destroy)(struct aq_hw_s *self); + + int (*get_hw_caps)(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps); ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device); + + int (*hw_ring_tx_xmit)(struct aq_hw_s *self, struct aq_ring_s *aq_ring, + unsigned int frags); +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index 483e97691eea..c93e5613d4cc 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -222,7 +222,7 @@ static struct net_device *aq_nic_ndev_alloc(void) + + struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + const struct ethtool_ops *et_ops, +- struct device *dev, ++ struct pci_dev *pdev, + struct aq_pci_func_s *aq_pci_func, + unsigned int port, + const struct aq_hw_ops *aq_hw_ops) +@@ -242,7 +242,7 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + ndev->netdev_ops = ndev_ops; + ndev->ethtool_ops = et_ops; + +- SET_NETDEV_DEV(ndev, dev); ++ SET_NETDEV_DEV(ndev, &pdev->dev); + + ndev->if_port = port; + self->ndev = ndev; +@@ -254,7 +254,8 @@ struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + + self->aq_hw = self->aq_hw_ops.create(aq_pci_func, self->port, + &self->aq_hw_ops); +- err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps); ++ err = self->aq_hw_ops.get_hw_caps(self->aq_hw, &self->aq_hw_caps, ++ pdev->device, pdev->subsystem_device); + if (err < 0) + goto err_exit; + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +index 4309983acdd6..3c9f8db03d5f 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.h ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.h +@@ -71,7 +71,7 @@ struct aq_nic_cfg_s { + + struct aq_nic_s *aq_nic_alloc_cold(const struct net_device_ops *ndev_ops, + const struct ethtool_ops *et_ops, +- struct device *dev, ++ struct pci_dev *pdev, + struct aq_pci_func_s *aq_pci_func, + unsigned int port, + const struct aq_hw_ops *aq_hw_ops); +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +index cadaa646c89f..58c29d04b186 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_pci_func.c +@@ -51,7 +51,8 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops, + pci_set_drvdata(pdev, self); + self->pdev = pdev; + +- err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps); ++ err = aq_hw_ops->get_hw_caps(NULL, &self->aq_hw_caps, pdev->device, ++ pdev->subsystem_device); + if (err < 0) + goto err_exit; + +@@ -59,7 +60,7 @@ struct aq_pci_func_s *aq_pci_func_alloc(struct aq_hw_ops *aq_hw_ops, + + for (port = 0; port < self->ports; ++port) { + struct aq_nic_s *aq_nic = aq_nic_alloc_cold(ndev_ops, eth_ops, +- &pdev->dev, self, ++ pdev, self, + port, aq_hw_ops); + + if (!aq_nic) { +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +index 07b3c49a16a4..b0abd187cead 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_a0.c +@@ -18,9 +18,20 @@ + #include "hw_atl_a0_internal.h" + + static int hw_atl_a0_get_hw_caps(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps) ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device) + { + memcpy(aq_hw_caps, &hw_atl_a0_hw_caps_, sizeof(*aq_hw_caps)); ++ ++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001) ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G; ++ ++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) { ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_10G; ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_A0_RATE_5G; ++ } ++ + return 0; + } + +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index ec68c20efcbd..36fddb199160 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -16,11 +16,23 @@ + #include "hw_atl_utils.h" + #include "hw_atl_llh.h" + #include "hw_atl_b0_internal.h" ++#include "hw_atl_llh_internal.h" + + static int hw_atl_b0_get_hw_caps(struct aq_hw_s *self, +- struct aq_hw_caps_s *aq_hw_caps) ++ struct aq_hw_caps_s *aq_hw_caps, ++ unsigned short device, ++ unsigned short subsystem_device) + { + memcpy(aq_hw_caps, &hw_atl_b0_hw_caps_, sizeof(*aq_hw_caps)); ++ ++ if (device == HW_ATL_DEVICE_ID_D108 && subsystem_device == 0x0001) ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G; ++ ++ if (device == HW_ATL_DEVICE_ID_D109 && subsystem_device == 0x0001) { ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_10G; ++ aq_hw_caps->link_speed_msk &= ~HW_ATL_B0_RATE_5G; ++ } ++ + return 0; + } + +@@ -357,6 +369,7 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self, + }; + + int err = 0; ++ u32 val; + + self->aq_nic_cfg = aq_nic_cfg; + +@@ -374,6 +387,16 @@ static int hw_atl_b0_hw_init(struct aq_hw_s *self, + hw_atl_b0_hw_rss_set(self, &aq_nic_cfg->aq_rss); + hw_atl_b0_hw_rss_hash_set(self, &aq_nic_cfg->aq_rss); + ++ /* Force limit MRRS on RDM/TDM to 2K */ ++ val = aq_hw_read_reg(self, pci_reg_control6_adr); ++ aq_hw_write_reg(self, pci_reg_control6_adr, (val & ~0x707) | 0x404); ++ ++ /* TX DMA total request limit. B0 hardware is not capable to ++ * handle more than (8K-MRRS) incoming DMA data. ++ * Value 24 in 256byte units ++ */ ++ aq_hw_write_reg(self, tx_dma_total_req_limit_adr, 24); ++ + err = aq_hw_err_from_flags(self); + if (err < 0) + goto err_exit; +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +index 5527fc0e5942..93450ec930e8 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +@@ -2343,6 +2343,9 @@ + #define tx_dma_desc_base_addrmsw_adr(descriptor) \ + (0x00007c04u + (descriptor) * 0x40) + ++/* tx dma total request limit */ ++#define tx_dma_total_req_limit_adr 0x00007b20u ++ + /* tx interrupt moderation control register definitions + * Preprocessor definitions for TX Interrupt Moderation Control Register + * Base Address: 0x00008980 +@@ -2369,6 +2372,9 @@ + /* default value of bitfield reg_res_dsbl */ + #define pci_reg_res_dsbl_default 0x1 + ++/* PCI core control register */ ++#define pci_reg_control6_adr 0x1014u ++ + /* global microprocessor scratch pad definitions */ + #define glb_cpu_scratch_scp_adr(scratch_scp) (0x00000300u + (scratch_scp) * 0x4) + +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index 3241af1ce718..5b422be56165 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- pktlen = info & LEN_MASK; +- stats->rx_packets++; +- stats->rx_bytes += pktlen; +- skb = rx_buff->skb; +- skb_put(skb, pktlen); +- skb->dev = ndev; +- skb->protocol = eth_type_trans(skb, ndev); +- +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), +- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); +- +- /* Prepare the BD for next cycle */ +- rx_buff->skb = netdev_alloc_skb_ip_align(ndev, +- EMAC_BUFFER_SIZE); +- if (unlikely(!rx_buff->skb)) { ++ /* Prepare the BD for next cycle. netif_receive_skb() ++ * only if new skb was allocated and mapped to avoid holes ++ * in the RX fifo. ++ */ ++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE); ++ if (unlikely(!skb)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "cannot allocate skb\n"); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; +- /* Because receive_skb is below, increment rx_dropped */ + stats->rx_dropped++; + continue; + } + +- /* receive_skb only if new skb was allocated to avoid holes */ +- netif_receive_skb(skb); +- +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(&ndev->dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, addr)) { + if (net_ratelimit()) +- netdev_err(ndev, "cannot dma map\n"); +- dev_kfree_skb(rx_buff->skb); ++ netdev_err(ndev, "cannot map dma buffer\n"); ++ dev_kfree_skb(skb); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; ++ stats->rx_dropped++; + continue; + } ++ ++ /* unmap previosly mapped skb */ ++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); ++ ++ pktlen = info & LEN_MASK; ++ stats->rx_packets++; ++ stats->rx_bytes += pktlen; ++ skb_put(rx_buff->skb, pktlen); ++ rx_buff->skb->dev = ndev; ++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev); ++ ++ netif_receive_skb(rx_buff->skb); ++ ++ rx_buff->skb = skb; + dma_unmap_addr_set(rx_buff, addr, addr); + dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE); + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 1216c1f1e052..6465414dad74 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3030,7 +3030,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + + del_timer_sync(&bp->timer); + +- if (IS_PF(bp)) { ++ if (IS_PF(bp) && !BP_NOMCP(bp)) { + /* Set ALWAYS_ALIVE bit in shmem */ + bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE; + bnx2x_drv_pulse(bp); +@@ -3116,7 +3116,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + bp->cnic_loaded = false; + + /* Clear driver version indication in shmem */ +- if (IS_PF(bp)) ++ if (IS_PF(bp) && !BP_NOMCP(bp)) + bnx2x_update_mng_version(bp); + + /* Check if there are pending parity attentions. If there are - set +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index c12b4d3e946e..e855a271db48 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp) + + do { + bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR); ++ ++ /* If we read all 0xFFs, means we are in PCI error state and ++ * should bail out to avoid crashes on adapter's FW reads. ++ */ ++ if (bp->common.shmem_base == 0xFFFFFFFF) { ++ bp->flags |= NO_MCP_FLAG; ++ return -ENODEV; ++ } ++ + if (bp->common.shmem_base) { + val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]); + if (val & SHR_MEM_VALIDITY_MB) +@@ -14315,7 +14324,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) + BNX2X_ERR("IO slot reset --> driver unload\n"); + + /* MCP should have been reset; Need to wait for validity */ +- bnx2x_init_shmem(bp); ++ if (bnx2x_init_shmem(bp)) { ++ rtnl_unlock(); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } + + if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) { + u32 v; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index 5ee18660bc33..c9617675f934 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -70,7 +70,7 @@ static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id) + netdev_err(bp->dev, "vf ndo called though sriov is disabled\n"); + return -EINVAL; + } +- if (vf_id >= bp->pf.max_vfs) { ++ if (vf_id >= bp->pf.active_vfs) { + netdev_err(bp->dev, "Invalid VF id %d\n", vf_id); + return -EINVAL; + } +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +index 7dd3d131043a..6a185344b378 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_tc.c +@@ -327,7 +327,7 @@ static int bnxt_hwrm_cfa_flow_alloc(struct bnxt *bp, struct bnxt_tc_flow *flow, + } + + /* If all IP and L4 fields are wildcarded then this is an L2 flow */ +- if (is_wildcard(&l3_mask, sizeof(l3_mask)) && ++ if (is_wildcard(l3_mask, sizeof(*l3_mask)) && + is_wildcard(&flow->l4_mask, sizeof(flow->l4_mask))) { + flow_flags |= CFA_FLOW_ALLOC_REQ_FLAGS_FLOWTYPE_L2; + } else { +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index aef3fcf2f5b9..48738eb27806 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -10052,6 +10052,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy) + + tw32(GRC_MODE, tp->grc_mode | val); + ++ /* On one of the AMD platform, MRRS is restricted to 4000 because of ++ * south bridge limitation. As a workaround, Driver is setting MRRS ++ * to 2048 instead of default 4096. ++ */ ++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && ++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { ++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; ++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); ++ } ++ + /* Setup the timer prescalar register. Clock is always 66Mhz. */ + val = tr32(GRC_MISC_CFG); + val &= ~0xff; +@@ -14229,7 +14239,8 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + */ + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || +- tg3_asic_rev(tp) == ASIC_REV_5719) ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); +diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h +index c2d02d02d1e6..b057f71aed48 100644 +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -96,6 +96,7 @@ + #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106 + #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109 + #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a ++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0 + #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a +@@ -281,6 +282,9 @@ + #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */ + #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */ + /* 0xa8 --> 0xb8 unused */ ++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4 ++#define MAX_READ_REQ_SIZE_2048 0x00004000 ++#define MAX_READ_REQ_MASK 0x00007000 + #define TG3PCI_DUAL_MAC_CTRL 0x000000b8 + #define DUAL_MAC_CTRL_CH_MASK 0x00000003 + #define DUAL_MAC_CTRL_ID 0x00000004 +diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c +index 544114281ea7..9f8d4f8e57e3 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -319,11 +319,10 @@ static int ptp_gianfar_adjtime(struct ptp_clock_info *ptp, s64 delta) + now = tmr_cnt_read(etsects); + now += delta; + tmr_cnt_write(etsects, now); ++ set_fipers(etsects); + + spin_unlock_irqrestore(&etsects->lock, flags); + +- set_fipers(etsects); +- + return 0; + } + +diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h +index d7bdea79e9fa..8fd2458060a0 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000.h ++++ b/drivers/net/ethernet/intel/e1000/e1000.h +@@ -331,7 +331,8 @@ struct e1000_adapter { + enum e1000_state_t { + __E1000_TESTING, + __E1000_RESETTING, +- __E1000_DOWN ++ __E1000_DOWN, ++ __E1000_DISABLED + }; + + #undef pr_fmt +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index 1982f7917a8d..3dd4aeb2706d 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -945,7 +945,7 @@ static int e1000_init_hw_struct(struct e1000_adapter *adapter, + static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; +- struct e1000_adapter *adapter; ++ struct e1000_adapter *adapter = NULL; + struct e1000_hw *hw; + + static int cards_found; +@@ -955,6 +955,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + u16 tmp = 0; + u16 eeprom_apme_mask = E1000_EEPROM_APME; + int bars, need_ioport; ++ bool disable_dev = false; + + /* do not allocate ioport bars when not needed */ + need_ioport = e1000_is_need_ioport(pdev); +@@ -1259,11 +1260,13 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +- pci_disable_device(pdev); ++ if (!adapter || disable_dev) ++ pci_disable_device(pdev); + return err; + } + +@@ -1281,6 +1284,7 @@ static void e1000_remove(struct pci_dev *pdev) + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ bool disable_dev; + + e1000_down_and_stop(adapter); + e1000_release_manageability(adapter); +@@ -1299,9 +1303,11 @@ static void e1000_remove(struct pci_dev *pdev) + iounmap(hw->flash_address); + pci_release_selected_regions(pdev, adapter->bars); + ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + +- pci_disable_device(pdev); ++ if (disable_dev) ++ pci_disable_device(pdev); + } + + /** +@@ -5156,7 +5162,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake) + if (netif_running(netdev)) + e1000_free_irq(adapter); + +- pci_disable_device(pdev); ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + return 0; + } +@@ -5200,6 +5207,10 @@ static int e1000_resume(struct pci_dev *pdev) + pr_err("Cannot enable PCI device from suspend\n"); + return err; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +@@ -5274,7 +5285,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev, + + if (netif_running(netdev)) + e1000_down(adapter); +- pci_disable_device(pdev); ++ ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + /* Request a slot slot reset. */ + return PCI_ERS_RESULT_NEED_RESET; +@@ -5302,6 +5315,10 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev) + pr_err("Cannot re-enable PCI device after reset.\n"); + return PCI_ERS_RESULT_DISCONNECT; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index b2cde9b16d82..b1cde1b051a4 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -1553,11 +1553,18 @@ static int i40e_set_mac(struct net_device *netdev, void *p) + else + netdev_info(netdev, "set new mac address %pM\n", addr->sa_data); + ++ /* Copy the address first, so that we avoid a possible race with ++ * .set_rx_mode(). If we copy after changing the address in the filter ++ * list, we might open ourselves to a narrow race window where ++ * .set_rx_mode could delete our dev_addr filter and prevent traffic ++ * from passing. ++ */ ++ ether_addr_copy(netdev->dev_addr, addr->sa_data); ++ + spin_lock_bh(&vsi->mac_filter_hash_lock); + i40e_del_mac_filter(vsi, netdev->dev_addr); + i40e_add_mac_filter(vsi, addr->sa_data); + spin_unlock_bh(&vsi->mac_filter_hash_lock); +- ether_addr_copy(netdev->dev_addr, addr->sa_data); + if (vsi->type == I40E_VSI_MAIN) { + i40e_status ret; + +@@ -1739,6 +1746,14 @@ static int i40e_addr_unsync(struct net_device *netdev, const u8 *addr) + struct i40e_netdev_priv *np = netdev_priv(netdev); + struct i40e_vsi *vsi = np->vsi; + ++ /* Under some circumstances, we might receive a request to delete ++ * our own device address from our uc list. Because we store the ++ * device address in the VSI's MAC/VLAN filter list, we need to ignore ++ * such requests and not delete our device address from this list. ++ */ ++ if (ether_addr_equal(addr, netdev->dev_addr)) ++ return 0; ++ + i40e_del_mac_filter(vsi, addr); + + return 0; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 3c07ff171ddc..542c00b1c823 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -3048,10 +3048,30 @@ bool __i40e_chk_linearize(struct sk_buff *skb) + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -3059,7 +3079,7 @@ bool __i40e_chk_linearize(struct sk_buff *skb) + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; +diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +index 07a4e6e13925..7368b0dc3af8 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +@@ -2014,10 +2014,30 @@ bool __i40evf_chk_linearize(struct sk_buff *skb) + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -2025,7 +2045,7 @@ bool __i40evf_chk_linearize(struct sk_buff *skb) + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 5e81a7263654..3fd71cf5cd60 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -1959,11 +1959,12 @@ static int mtk_hw_init(struct mtk_eth *eth) + /* set GE2 TUNE */ + regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0); + +- /* GE1, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0)); +- +- /* GE2, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1)); ++ /* Set linkdown as the default for each GMAC. Its own MCR would be set ++ * up with the more appropriate value when mtk_phy_link_adjust call is ++ * being invoked. ++ */ ++ for (i = 0; i < MTK_MAC_COUNT; i++) ++ mtk_w32(eth, 0, MTK_MAC_MCR(i)); + + /* Indicates CDM to parse the MTK special tag from CPU + * which also is working out for untag packets. +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +index 51c4cc00a186..9d64d0759ee9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_dcbnl.c +@@ -259,6 +259,7 @@ int mlx5e_dcbnl_ieee_setets_core(struct mlx5e_priv *priv, struct ieee_ets *ets) + static int mlx5e_dbcnl_validate_ets(struct net_device *netdev, + struct ieee_ets *ets) + { ++ bool have_ets_tc = false; + int bw_sum = 0; + int i; + +@@ -273,11 +274,14 @@ static int mlx5e_dbcnl_validate_ets(struct net_device *netdev, + } + + /* Validate Bandwidth Sum */ +- for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) +- if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) ++ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) { ++ if (ets->tc_tsa[i] == IEEE_8021QAZ_TSA_ETS) { ++ have_ets_tc = true; + bw_sum += ets->tc_tx_bw[i]; ++ } ++ } + +- if (bw_sum != 0 && bw_sum != 100) { ++ if (have_ets_tc && bw_sum != 100) { + netdev_err(netdev, + "Failed to validate ETS: BW sum is illegal\n"); + return -EINVAL; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eq.c b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +index fc606bfd1d6e..eb91de86202b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eq.c +@@ -776,7 +776,7 @@ int mlx5_start_eqs(struct mlx5_core_dev *dev) + return err; + } + +-int mlx5_stop_eqs(struct mlx5_core_dev *dev) ++void mlx5_stop_eqs(struct mlx5_core_dev *dev) + { + struct mlx5_eq_table *table = &dev->priv.eq_table; + int err; +@@ -785,22 +785,26 @@ int mlx5_stop_eqs(struct mlx5_core_dev *dev) + if (MLX5_CAP_GEN(dev, pg)) { + err = mlx5_destroy_unmap_eq(dev, &table->pfault_eq); + if (err) +- return err; ++ mlx5_core_err(dev, "failed to destroy page fault eq, err(%d)\n", ++ err); + } + #endif + + err = mlx5_destroy_unmap_eq(dev, &table->pages_eq); + if (err) +- return err; ++ mlx5_core_err(dev, "failed to destroy pages eq, err(%d)\n", ++ err); + +- mlx5_destroy_unmap_eq(dev, &table->async_eq); ++ err = mlx5_destroy_unmap_eq(dev, &table->async_eq); ++ if (err) ++ mlx5_core_err(dev, "failed to destroy async eq, err(%d)\n", ++ err); + mlx5_cmd_use_polling(dev); + + err = mlx5_destroy_unmap_eq(dev, &table->cmd_eq); + if (err) +- mlx5_cmd_use_events(dev); +- +- return err; ++ mlx5_core_err(dev, "failed to destroy command eq, err(%d)\n", ++ err); + } + + int mlx5_core_eq_query(struct mlx5_core_dev *dev, struct mlx5_eq *eq, +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci.c b/drivers/net/ethernet/mellanox/mlxsw/pci.c +index 23f7d828cf67..6ef20e5cc77d 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci.c +@@ -1643,7 +1643,12 @@ static int mlxsw_pci_sw_reset(struct mlxsw_pci *mlxsw_pci, + return 0; + } + +- wmb(); /* reset needs to be written before we read control register */ ++ /* Reset needs to be written before we read control register, and ++ * we must wait for the HW to become responsive once again ++ */ ++ wmb(); ++ msleep(MLXSW_PCI_SW_RESET_WAIT_MSECS); ++ + end = jiffies + msecs_to_jiffies(MLXSW_PCI_SW_RESET_TIMEOUT_MSECS); + do { + u32 val = mlxsw_pci_read32(mlxsw_pci, FW_READY); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h +index a6441208e9d9..fb082ad21b00 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/pci_hw.h +@@ -59,6 +59,7 @@ + #define MLXSW_PCI_SW_RESET 0xF0010 + #define MLXSW_PCI_SW_RESET_RST_BIT BIT(0) + #define MLXSW_PCI_SW_RESET_TIMEOUT_MSECS 5000 ++#define MLXSW_PCI_SW_RESET_WAIT_MSECS 100 + #define MLXSW_PCI_FW_READY 0xA1844 + #define MLXSW_PCI_FW_READY_MASK 0xFFFF + #define MLXSW_PCI_FW_READY_MAGIC 0x5E +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +index e118b5f23996..8d53a593fb27 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c +@@ -568,6 +568,7 @@ nfp_net_aux_irq_request(struct nfp_net *nn, u32 ctrl_offset, + return err; + } + nn_writeb(nn, ctrl_offset, entry->entry); ++ nfp_net_irq_unmask(nn, entry->entry); + + return 0; + } +@@ -582,6 +583,7 @@ static void nfp_net_aux_irq_free(struct nfp_net *nn, u32 ctrl_offset, + unsigned int vector_idx) + { + nn_writeb(nn, ctrl_offset, 0xff); ++ nn_pci_flush(nn); + free_irq(nn->irq_entries[vector_idx].vector, nn); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/common.h b/drivers/net/ethernet/stmicro/stmmac/common.h +index e82b4b70b7be..627fec210e2f 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/common.h ++++ b/drivers/net/ethernet/stmicro/stmmac/common.h +@@ -409,7 +409,7 @@ struct stmmac_desc_ops { + /* get timestamp value */ + u64(*get_timestamp) (void *desc, u32 ats); + /* get rx timestamp status */ +- int (*get_rx_timestamp_status) (void *desc, u32 ats); ++ int (*get_rx_timestamp_status)(void *desc, void *next_desc, u32 ats); + /* Display ring */ + void (*display_ring)(void *head, unsigned int size, bool rx); + /* set MSS via context descriptor */ +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +index 4b286e27c4ca..7e089bf906b4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c +@@ -258,7 +258,8 @@ static int dwmac4_rx_check_timestamp(void *desc) + return ret; + } + +-static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats) ++static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc, ++ u32 ats) + { + struct dma_desc *p = (struct dma_desc *)desc; + int ret = -EINVAL; +@@ -270,7 +271,7 @@ static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats) + + /* Check if timestamp is OK from context descriptor */ + do { +- ret = dwmac4_rx_check_timestamp(desc); ++ ret = dwmac4_rx_check_timestamp(next_desc); + if (ret < 0) + goto exit; + i++; +diff --git a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +index 7546b3664113..2a828a312814 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/enh_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/enh_desc.c +@@ -400,7 +400,8 @@ static u64 enh_desc_get_timestamp(void *desc, u32 ats) + return ns; + } + +-static int enh_desc_get_rx_timestamp_status(void *desc, u32 ats) ++static int enh_desc_get_rx_timestamp_status(void *desc, void *next_desc, ++ u32 ats) + { + if (ats) { + struct dma_extended_desc *p = (struct dma_extended_desc *)desc; +diff --git a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +index f817f8f36569..db4cee57bb24 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/norm_desc.c ++++ b/drivers/net/ethernet/stmicro/stmmac/norm_desc.c +@@ -265,7 +265,7 @@ static u64 ndesc_get_timestamp(void *desc, u32 ats) + return ns; + } + +-static int ndesc_get_rx_timestamp_status(void *desc, u32 ats) ++static int ndesc_get_rx_timestamp_status(void *desc, void *next_desc, u32 ats) + { + struct dma_desc *p = (struct dma_desc *)desc; + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +index 721b61655261..08c19ebd5306 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -34,6 +34,7 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr, + { + u32 value = readl(ioaddr + PTP_TCR); + unsigned long data; ++ u32 reg_value; + + /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second + * formula = (1/ptp_clock) * 1000000000 +@@ -50,10 +51,11 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr, + + data &= PTP_SSIR_SSINC_MASK; + ++ reg_value = data; + if (gmac4) +- data = data << GMAC4_PTP_SSIR_SSINC_SHIFT; ++ reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT; + +- writel(data, ioaddr + PTP_SSIR); ++ writel(reg_value, ioaddr + PTP_SSIR); + + return data; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 0ad12c81a9e4..d0cc73795056 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -489,7 +489,7 @@ static void stmmac_get_rx_hwtstamp(struct stmmac_priv *priv, struct dma_desc *p, + desc = np; + + /* Check if timestamp is available */ +- if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) { ++ if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) { + ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts); + netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns); + shhwtstamp = skb_hwtstamps(skb); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index fb1c9e095d0c..176fc0906bfe 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1441,9 +1441,14 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev, + return 0; + + unregister_netdev: ++ /* macvlan_uninit would free the macvlan port */ + unregister_netdevice(dev); ++ return err; + destroy_macvlan_port: +- if (create) ++ /* the macvlan port may be freed by macvlan_uninit when fail to register. ++ * so we destroy the macvlan port only when it's valid. ++ */ ++ if (create && macvlan_port_get_rtnl(dev)) + macvlan_port_destroy(port->dev); + return err; + } +diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c +index 135296508a7e..6425ce04d3f9 100644 +--- a/drivers/net/phy/mdio-sun4i.c ++++ b/drivers/net/phy/mdio-sun4i.c +@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platform_device *pdev) + + data->regulator = devm_regulator_get(&pdev->dev, "phy"); + if (IS_ERR(data->regulator)) { +- if (PTR_ERR(data->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_out_free_mdiobus; ++ } + + dev_info(&pdev->dev, "no regulator found\n"); + data->regulator = NULL; +diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c +index bfd3090fb055..07c6048200c6 100644 +--- a/drivers/net/phy/mdio-xgene.c ++++ b/drivers/net/phy/mdio-xgene.c +@@ -194,8 +194,11 @@ static int xgene_mdio_reset(struct xgene_mdio_pdata *pdata) + } + + ret = xgene_enet_ecc_init(pdata); +- if (ret) ++ if (ret) { ++ if (pdata->dev->of_node) ++ clk_disable_unprepare(pdata->clk); + return ret; ++ } + xgene_gmac_reset(pdata); + + return 0; +@@ -388,8 +391,10 @@ static int xgene_mdio_probe(struct platform_device *pdev) + return ret; + + mdio_bus = mdiobus_alloc(); +- if (!mdio_bus) +- return -ENOMEM; ++ if (!mdio_bus) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } + + mdio_bus->name = "APM X-Gene MDIO bus"; + +@@ -418,7 +423,7 @@ static int xgene_mdio_probe(struct platform_device *pdev) + mdio_bus->phy_mask = ~0; + ret = mdiobus_register(mdio_bus); + if (ret) +- goto out; ++ goto out_mdiobus; + + acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1, + acpi_register_phy, NULL, mdio_bus, NULL); +@@ -426,16 +431,20 @@ static int xgene_mdio_probe(struct platform_device *pdev) + } + + if (ret) +- goto out; ++ goto out_mdiobus; + + pdata->mdio_bus = mdio_bus; + xgene_mdio_status = true; + + return 0; + +-out: ++out_mdiobus: + mdiobus_free(mdio_bus); + ++out_clk: ++ if (dev->of_node) ++ clk_disable_unprepare(pdata->clk); ++ + return ret; + } + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 8d9f02b7a71f..b1632294174f 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1100,6 +1100,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ + {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ +@@ -1211,6 +1212,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ ++ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1201, 2)}, /* Telit LE920, LE920A4 */ + {QMI_FIXED_INTF(0x1c9e, 0x9801, 3)}, /* Telewell TW-3G HSPA+ */ +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 9e9202b50e73..bb44f0c6891f 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2155,6 +2155,13 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + } + + ndst = &rt->dst; ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(ndst) - VXLAN_HEADROOM; ++ ++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, ++ skb, mtu); ++ } ++ + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip4_dst_hoplimit(&rt->dst); + err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr), +@@ -2190,6 +2197,13 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + goto out_unlock; + } + ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM; ++ ++ skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, ++ skb, mtu); ++ } ++ + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); + ttl = ttl ? : ip6_dst_hoplimit(ndst); + skb_scrub_packet(skb, xnet); +diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c +index b83f01d6e3dd..af37c19dbfd7 100644 +--- a/drivers/net/wireless/ath/wcn36xx/main.c ++++ b/drivers/net/wireless/ath/wcn36xx/main.c +@@ -384,6 +384,18 @@ static int wcn36xx_config(struct ieee80211_hw *hw, u32 changed) + } + } + ++ if (changed & IEEE80211_CONF_CHANGE_PS) { ++ list_for_each_entry(tmp, &wcn->vif_list, list) { ++ vif = wcn36xx_priv_to_vif(tmp); ++ if (hw->conf.flags & IEEE80211_CONF_PS) { ++ if (vif->bss_conf.ps) /* ps allowed ? */ ++ wcn36xx_pmc_enter_bmps_state(wcn, vif); ++ } else { ++ wcn36xx_pmc_exit_bmps_state(wcn, vif); ++ } ++ } ++ } ++ + mutex_unlock(&wcn->conf_mutex); + + return 0; +@@ -747,17 +759,6 @@ static void wcn36xx_bss_info_changed(struct ieee80211_hw *hw, + vif_priv->dtim_period = bss_conf->dtim_period; + } + +- if (changed & BSS_CHANGED_PS) { +- wcn36xx_dbg(WCN36XX_DBG_MAC, +- "mac bss PS set %d\n", +- bss_conf->ps); +- if (bss_conf->ps) { +- wcn36xx_pmc_enter_bmps_state(wcn, vif); +- } else { +- wcn36xx_pmc_exit_bmps_state(wcn, vif); +- } +- } +- + if (changed & BSS_CHANGED_BSSID) { + wcn36xx_dbg(WCN36XX_DBG_MAC, "mac bss changed_bssid %pM\n", + bss_conf->bssid); +diff --git a/drivers/net/wireless/ath/wcn36xx/pmc.c b/drivers/net/wireless/ath/wcn36xx/pmc.c +index 589fe5f70971..1976b80c235f 100644 +--- a/drivers/net/wireless/ath/wcn36xx/pmc.c ++++ b/drivers/net/wireless/ath/wcn36xx/pmc.c +@@ -45,8 +45,10 @@ int wcn36xx_pmc_exit_bmps_state(struct wcn36xx *wcn, + struct wcn36xx_vif *vif_priv = wcn36xx_vif_to_priv(vif); + + if (WCN36XX_BMPS != vif_priv->pw_state) { +- wcn36xx_err("Not in BMPS mode, no need to exit from BMPS mode!\n"); +- return -EINVAL; ++ /* Unbalanced call or last BMPS enter failed */ ++ wcn36xx_dbg(WCN36XX_DBG_PMC, ++ "Not in BMPS mode, no need to exit\n"); ++ return -EALREADY; + } + wcn36xx_smd_exit_bmps(wcn, vif); + vif_priv->pw_state = WCN36XX_FULL_POWER; +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 052e67bce6b3..710efe7b65f9 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3220,7 +3220,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) + if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info))) + continue; + +- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); ++ skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); + if (!skb) { + res = -ENOMEM; + goto out_err; +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 391432e2725d..c980cdbd6e53 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1326,6 +1326,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + + netif_carrier_off(netdev); + ++ xenbus_switch_state(dev, XenbusStateInitialising); + return netdev; + + exit: +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 0655f45643d9..dd956311a85a 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1515,7 +1515,8 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl, + blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors); + blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX)); + } +- if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) ++ if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) && ++ is_power_of_2(ctrl->max_hw_sectors)) + blk_queue_chunk_sectors(q, ctrl->max_hw_sectors); + blk_queue_virt_boundary(q, ctrl->page_size - 1); + if (ctrl->vwc & NVME_CTRL_VWC_PRESENT) +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 555c976cc2ee..8cd42544c90e 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -74,6 +74,7 @@ static struct nvmf_host *nvmf_host_default(void) + return NULL; + + kref_init(&host->ref); ++ uuid_gen(&host->id); + snprintf(host->nqn, NVMF_NQN_SIZE, + "nqn.2014-08.org.nvmexpress:uuid:%pUb", &host->id); + +diff --git a/drivers/nvme/host/fc.c b/drivers/nvme/host/fc.c +index 3148d760d825..7deb7b5d8683 100644 +--- a/drivers/nvme/host/fc.c ++++ b/drivers/nvme/host/fc.c +@@ -2876,7 +2876,6 @@ nvme_fc_init_ctrl(struct device *dev, struct nvmf_ctrl_options *opts, + + /* initiate nvme ctrl ref counting teardown */ + nvme_uninit_ctrl(&ctrl->ctrl); +- nvme_put_ctrl(&ctrl->ctrl); + + /* Remove core ctrl ref. */ + nvme_put_ctrl(&ctrl->ctrl); +diff --git a/drivers/of/of_mdio.c b/drivers/of/of_mdio.c +index 98258583abb0..8c1819230ed2 100644 +--- a/drivers/of/of_mdio.c ++++ b/drivers/of/of_mdio.c +@@ -228,7 +228,12 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + rc = of_mdiobus_register_phy(mdio, child, addr); + else + rc = of_mdiobus_register_device(mdio, child, addr); +- if (rc) ++ ++ if (rc == -ENODEV) ++ dev_err(&mdio->dev, ++ "MDIO device at address %d is missing.\n", ++ addr); ++ else if (rc) + goto unregister; + } + +@@ -252,7 +257,7 @@ int of_mdiobus_register(struct mii_bus *mdio, struct device_node *np) + + if (of_mdiobus_child_is_phy(child)) { + rc = of_mdiobus_register_phy(mdio, child, addr); +- if (rc) ++ if (rc && rc != -ENODEV) + goto unregister; + } + } +diff --git a/drivers/phy/motorola/phy-cpcap-usb.c b/drivers/phy/motorola/phy-cpcap-usb.c +index accaaaccb662..6601ad0dfb3a 100644 +--- a/drivers/phy/motorola/phy-cpcap-usb.c ++++ b/drivers/phy/motorola/phy-cpcap-usb.c +@@ -310,7 +310,7 @@ static int cpcap_usb_init_irq(struct platform_device *pdev, + int irq, error; + + irq = platform_get_irq_byname(pdev, name); +- if (!irq) ++ if (irq < 0) + return -ENODEV; + + error = devm_request_threaded_irq(ddata->dev, irq, NULL, +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index c94b606e0df8..ee14d8e45c97 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2803,6 +2803,16 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr) + erp = dasd_3990_erp_handle_match_erp(cqr, erp); + } + ++ ++ /* ++ * For path verification work we need to stick with the path that was ++ * originally chosen so that the per path configuration data is ++ * assigned correctly. ++ */ ++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) { ++ erp->lpm = cqr->lpm; ++ } ++ + if (device->features & DASD_FEATURE_ERPLOG) { + /* print current erp_chain */ + dev_err(&device->cdev->dev, +diff --git a/drivers/scsi/aacraid/aacraid.h b/drivers/scsi/aacraid/aacraid.h +index 403a639574e5..b0b290f7b8dc 100644 +--- a/drivers/scsi/aacraid/aacraid.h ++++ b/drivers/scsi/aacraid/aacraid.h +@@ -1724,6 +1724,7 @@ struct aac_dev + #define FIB_CONTEXT_FLAG_NATIVE_HBA (0x00000010) + #define FIB_CONTEXT_FLAG_NATIVE_HBA_TMF (0x00000020) + #define FIB_CONTEXT_FLAG_SCSI_CMD (0x00000040) ++#define FIB_CONTEXT_FLAG_EH_RESET (0x00000080) + + /* + * Define the command values +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index c9252b138c1f..509fe23fafe1 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -1037,7 +1037,7 @@ static int aac_eh_bus_reset(struct scsi_cmnd* cmd) + info = &aac->hba_map[bus][cid]; + if (bus >= AAC_MAX_BUSES || cid >= AAC_MAX_TARGETS || + info->devtype != AAC_DEVTYPE_NATIVE_RAW) { +- fib->flags |= FIB_CONTEXT_FLAG_TIMED_OUT; ++ fib->flags |= FIB_CONTEXT_FLAG_EH_RESET; + cmd->SCp.phase = AAC_OWNER_ERROR_HANDLER; + } + } +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index c17ccb913fde..a3e480e7a257 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -952,10 +952,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + case TEST_UNIT_READY: + break; + default: +- set_host_byte(scmnd, DID_TARGET_FAILURE); ++ set_host_byte(scmnd, DID_ERROR); + } + break; + case SRB_STATUS_INVALID_LUN: ++ set_host_byte(scmnd, DID_NO_CONNECT); + do_work = true; + process_err_fn = storvsc_remove_lun; + break; +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index f95da364c283..669470971023 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1661,12 +1661,12 @@ static int atmel_spi_remove(struct platform_device *pdev) + pm_runtime_get_sync(&pdev->dev); + + /* reset the hardware and block queue progress */ +- spin_lock_irq(&as->lock); + if (as->use_dma) { + atmel_spi_stop_dma(master); + atmel_spi_release_dma(master); + } + ++ spin_lock_irq(&as->lock); + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ + spi_readl(as, SR); +diff --git a/drivers/staging/android/ion/Kconfig b/drivers/staging/android/ion/Kconfig +index a517b2d29f1b..8f6494158d3d 100644 +--- a/drivers/staging/android/ion/Kconfig ++++ b/drivers/staging/android/ion/Kconfig +@@ -37,7 +37,7 @@ config ION_CHUNK_HEAP + + config ION_CMA_HEAP + bool "Ion CMA heap support" +- depends on ION && CMA ++ depends on ION && DMA_CMA + help + Choose this option to enable CMA heaps with Ion. This heap is backed + by the Contiguous Memory Allocator (CMA). If your system has these +diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c +index dd5545d9990a..86196ffd2faf 100644 +--- a/drivers/staging/android/ion/ion_cma_heap.c ++++ b/drivers/staging/android/ion/ion_cma_heap.c +@@ -39,9 +39,15 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, + struct ion_cma_heap *cma_heap = to_cma_heap(heap); + struct sg_table *table; + struct page *pages; ++ unsigned long size = PAGE_ALIGN(len); ++ unsigned long nr_pages = size >> PAGE_SHIFT; ++ unsigned long align = get_order(size); + int ret; + +- pages = cma_alloc(cma_heap->cma, len, 0, GFP_KERNEL); ++ if (align > CONFIG_CMA_ALIGNMENT) ++ align = CONFIG_CMA_ALIGNMENT; ++ ++ pages = cma_alloc(cma_heap->cma, nr_pages, align, GFP_KERNEL); + if (!pages) + return -ENOMEM; + +@@ -53,7 +59,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, + if (ret) + goto free_mem; + +- sg_set_page(table->sgl, pages, len, 0); ++ sg_set_page(table->sgl, pages, size, 0); + + buffer->priv_virt = pages; + buffer->sg_table = table; +@@ -62,7 +68,7 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, + free_mem: + kfree(table); + err: +- cma_release(cma_heap->cma, pages, buffer->size); ++ cma_release(cma_heap->cma, pages, nr_pages); + return -ENOMEM; + } + +@@ -70,9 +76,10 @@ static void ion_cma_free(struct ion_buffer *buffer) + { + struct ion_cma_heap *cma_heap = to_cma_heap(buffer->heap); + struct page *pages = buffer->priv_virt; ++ unsigned long nr_pages = PAGE_ALIGN(buffer->size) >> PAGE_SHIFT; + + /* release memory */ +- cma_release(cma_heap->cma, pages, buffer->size); ++ cma_release(cma_heap->cma, pages, nr_pages); + /* release sg table */ + sg_free_table(buffer->sg_table); + kfree(buffer->sg_table); +diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c +index f77e499afddd..065f0b607373 100644 +--- a/drivers/xen/balloon.c ++++ b/drivers/xen/balloon.c +@@ -257,10 +257,25 @@ static void release_memory_resource(struct resource *resource) + kfree(resource); + } + ++/* ++ * Host memory not allocated to dom0. We can use this range for hotplug-based ++ * ballooning. ++ * ++ * It's a type-less resource. Setting IORESOURCE_MEM will make resource ++ * management algorithms (arch_remove_reservations()) look into guest e820, ++ * which we don't want. ++ */ ++static struct resource hostmem_resource = { ++ .name = "Host RAM", ++}; ++ ++void __attribute__((weak)) __init arch_xen_balloon_init(struct resource *res) ++{} ++ + static struct resource *additional_memory_resource(phys_addr_t size) + { +- struct resource *res; +- int ret; ++ struct resource *res, *res_hostmem; ++ int ret = -ENOMEM; + + res = kzalloc(sizeof(*res), GFP_KERNEL); + if (!res) +@@ -269,13 +284,42 @@ static struct resource *additional_memory_resource(phys_addr_t size) + res->name = "System RAM"; + res->flags = IORESOURCE_SYSTEM_RAM | IORESOURCE_BUSY; + +- ret = allocate_resource(&iomem_resource, res, +- size, 0, -1, +- PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); +- if (ret < 0) { +- pr_err("Cannot allocate new System RAM resource\n"); +- kfree(res); +- return NULL; ++ res_hostmem = kzalloc(sizeof(*res), GFP_KERNEL); ++ if (res_hostmem) { ++ /* Try to grab a range from hostmem */ ++ res_hostmem->name = "Host memory"; ++ ret = allocate_resource(&hostmem_resource, res_hostmem, ++ size, 0, -1, ++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); ++ } ++ ++ if (!ret) { ++ /* ++ * Insert this resource into iomem. Because hostmem_resource ++ * tracks portion of guest e820 marked as UNUSABLE noone else ++ * should try to use it. ++ */ ++ res->start = res_hostmem->start; ++ res->end = res_hostmem->end; ++ ret = insert_resource(&iomem_resource, res); ++ if (ret < 0) { ++ pr_err("Can't insert iomem_resource [%llx - %llx]\n", ++ res->start, res->end); ++ release_memory_resource(res_hostmem); ++ res_hostmem = NULL; ++ res->start = res->end = 0; ++ } ++ } ++ ++ if (ret) { ++ ret = allocate_resource(&iomem_resource, res, ++ size, 0, -1, ++ PAGES_PER_SECTION * PAGE_SIZE, NULL, NULL); ++ if (ret < 0) { ++ pr_err("Cannot allocate new System RAM resource\n"); ++ kfree(res); ++ return NULL; ++ } + } + + #ifdef CONFIG_SPARSEMEM +@@ -287,6 +331,7 @@ static struct resource *additional_memory_resource(phys_addr_t size) + pr_err("New System RAM resource outside addressable RAM (%lu > %lu)\n", + pfn, limit); + release_memory_resource(res); ++ release_memory_resource(res_hostmem); + return NULL; + } + } +@@ -765,6 +810,8 @@ static int __init balloon_init(void) + set_online_page_callback(&xen_online_page); + register_memory_notifier(&xen_memory_nb); + register_sysctl_table(xen_root); ++ ++ arch_xen_balloon_init(&hostmem_resource); + #endif + + #ifdef CONFIG_XEN_PV +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 57efbd3b053b..bd56653b9bbc 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -380,10 +380,8 @@ static int unmap_grant_pages(struct grant_map *map, int offset, int pages) + } + range = 0; + while (range < pages) { +- if (map->unmap_ops[offset+range].handle == -1) { +- range--; ++ if (map->unmap_ops[offset+range].handle == -1) + break; +- } + range++; + } + err = __unmap_grant_pages(map, offset, range); +@@ -1073,8 +1071,10 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) ++ if (use_ptemod) { + map->vma = NULL; ++ unmap_grant_pages(map, 0, map->count); ++ } + gntdev_put_map(priv, map); + return err; + } +diff --git a/fs/afs/write.c b/fs/afs/write.c +index 106e43db1115..926d4d68f791 100644 +--- a/fs/afs/write.c ++++ b/fs/afs/write.c +@@ -282,7 +282,7 @@ int afs_write_end(struct file *file, struct address_space *mapping, + ret = afs_fill_page(vnode, key, pos + copied, + len - copied, page); + if (ret < 0) +- return ret; ++ goto out; + } + SetPageUptodate(page); + } +@@ -290,10 +290,12 @@ int afs_write_end(struct file *file, struct address_space *mapping, + set_page_dirty(page); + if (PageDirty(page)) + _debug("dirtied"); ++ ret = copied; ++ ++out: + unlock_page(page); + put_page(page); +- +- return copied; ++ return ret; + } + + /* +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 4006b2a1233d..bc534fafacf9 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -236,7 +236,6 @@ static struct btrfs_device *__alloc_device(void) + kfree(dev); + return ERR_PTR(-ENOMEM); + } +- bio_get(dev->flush_bio); + + INIT_LIST_HEAD(&dev->dev_list); + INIT_LIST_HEAD(&dev->dev_alloc_list); +diff --git a/fs/exec.c b/fs/exec.c +index acec119fcc31..0da4d748b4e6 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1216,15 +1216,14 @@ static int de_thread(struct task_struct *tsk) + return -EAGAIN; + } + +-char *get_task_comm(char *buf, struct task_struct *tsk) ++char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) + { +- /* buf must be at least sizeof(tsk->comm) in size */ + task_lock(tsk); +- strncpy(buf, tsk->comm, sizeof(tsk->comm)); ++ strncpy(buf, tsk->comm, buf_size); + task_unlock(tsk); + return buf; + } +-EXPORT_SYMBOL_GPL(get_task_comm); ++EXPORT_SYMBOL_GPL(__get_task_comm); + + /* + * These functions flushes out all traces of the currently running executable +diff --git a/fs/super.c b/fs/super.c +index 994db21f59bf..79d7fc5e0ddd 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -522,7 +522,11 @@ struct super_block *sget_userns(struct file_system_type *type, + hlist_add_head(&s->s_instances, &type->fs_supers); + spin_unlock(&sb_lock); + get_filesystem(type); +- register_shrinker(&s->s_shrink); ++ err = register_shrinker(&s->s_shrink); ++ if (err) { ++ deactivate_locked_super(s); ++ s = ERR_PTR(err); ++ } + return s; + } + +diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c +index 010a13a201aa..659ed6f8c484 100644 +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -48,7 +48,7 @@ + STATIC int xfs_qm_init_quotainos(xfs_mount_t *); + STATIC int xfs_qm_init_quotainfo(xfs_mount_t *); + +- ++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi); + STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp); + /* + * We use the batch lookup interface to iterate over the dquots as it +@@ -695,9 +695,17 @@ xfs_qm_init_quotainfo( + qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan; + qinf->qi_shrinker.seeks = DEFAULT_SEEKS; + qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE; +- register_shrinker(&qinf->qi_shrinker); ++ ++ error = register_shrinker(&qinf->qi_shrinker); ++ if (error) ++ goto out_free_inos; ++ + return 0; + ++out_free_inos: ++ mutex_destroy(&qinf->qi_quotaofflock); ++ mutex_destroy(&qinf->qi_tree_lock); ++ xfs_qm_destroy_quotainos(qinf); + out_free_lru: + list_lru_destroy(&qinf->qi_lru); + out_free_qinf: +@@ -706,7 +714,6 @@ xfs_qm_init_quotainfo( + return error; + } + +- + /* + * Gets called when unmounting a filesystem or when all quotas get + * turned off. +@@ -723,19 +730,8 @@ xfs_qm_destroy_quotainfo( + + unregister_shrinker(&qi->qi_shrinker); + list_lru_destroy(&qi->qi_lru); +- +- if (qi->qi_uquotaip) { +- IRELE(qi->qi_uquotaip); +- qi->qi_uquotaip = NULL; /* paranoia */ +- } +- if (qi->qi_gquotaip) { +- IRELE(qi->qi_gquotaip); +- qi->qi_gquotaip = NULL; +- } +- if (qi->qi_pquotaip) { +- IRELE(qi->qi_pquotaip); +- qi->qi_pquotaip = NULL; +- } ++ xfs_qm_destroy_quotainos(qi); ++ mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); + mp->m_quotainfo = NULL; +@@ -1599,6 +1595,24 @@ xfs_qm_init_quotainos( + return error; + } + ++STATIC void ++xfs_qm_destroy_quotainos( ++ xfs_quotainfo_t *qi) ++{ ++ if (qi->qi_uquotaip) { ++ IRELE(qi->qi_uquotaip); ++ qi->qi_uquotaip = NULL; /* paranoia */ ++ } ++ if (qi->qi_gquotaip) { ++ IRELE(qi->qi_gquotaip); ++ qi->qi_gquotaip = NULL; ++ } ++ if (qi->qi_pquotaip) { ++ IRELE(qi->qi_pquotaip); ++ qi->qi_pquotaip = NULL; ++ } ++} ++ + STATIC void + xfs_qm_dqfree_one( + struct xfs_dquot *dqp) +diff --git a/include/crypto/if_alg.h b/include/crypto/if_alg.h +index aeec003a566b..ac0eae8372ab 100644 +--- a/include/crypto/if_alg.h ++++ b/include/crypto/if_alg.h +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -155,7 +156,7 @@ struct af_alg_ctx { + struct af_alg_completion completion; + + size_t used; +- size_t rcvused; ++ atomic_t rcvused; + + bool more; + bool merge; +@@ -228,7 +229,7 @@ static inline int af_alg_rcvbuf(struct sock *sk) + struct af_alg_ctx *ctx = ask->private; + + return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) - +- ctx->rcvused, 0); ++ atomic_read(&ctx->rcvused), 0); + } + + /** +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index ae15864c8708..8f9fc6e5539a 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -1017,7 +1017,7 @@ int mlx5_create_map_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq, u8 vecidx, + enum mlx5_eq_type type); + int mlx5_destroy_unmap_eq(struct mlx5_core_dev *dev, struct mlx5_eq *eq); + int mlx5_start_eqs(struct mlx5_core_dev *dev); +-int mlx5_stop_eqs(struct mlx5_core_dev *dev); ++void mlx5_stop_eqs(struct mlx5_core_dev *dev); + int mlx5_vector2eqn(struct mlx5_core_dev *dev, int vector, int *eqn, + unsigned int *irqn); + int mlx5_core_attach_mcg(struct mlx5_core_dev *dev, union ib_gid *mgid, u32 qpn); +diff --git a/include/linux/sched.h b/include/linux/sched.h +index fdf74f27acf1..41354690e4e3 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1502,7 +1502,11 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from) + __set_task_comm(tsk, from, false); + } + +-extern char *get_task_comm(char *to, struct task_struct *tsk); ++extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk); ++#define get_task_comm(buf, tsk) ({ \ ++ BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN); \ ++ __get_task_comm(buf, sizeof(buf), tsk); \ ++}) + + #ifdef CONFIG_SMP + void scheduler_ipi(void); +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 236bfe5b2ffe..6073e8bae025 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -273,7 +273,6 @@ struct tcf_chain { + + struct tcf_block { + struct list_head chain_list; +- struct work_struct work; + }; + + static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz) +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index e015e164bac0..db99efb2d1d0 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -1570,6 +1570,9 @@ int xfrm_init_state(struct xfrm_state *x); + int xfrm_prepare_input(struct xfrm_state *x, struct sk_buff *skb); + int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type); + int xfrm_input_resume(struct sk_buff *skb, int nexthdr); ++int xfrm_trans_queue(struct sk_buff *skb, ++ int (*finish)(struct net *, struct sock *, ++ struct sk_buff *)); + int xfrm_output_resume(struct sk_buff *skb, int err); + int xfrm_output(struct sock *sk, struct sk_buff *skb); + int xfrm_inner_extract_output(struct xfrm_state *x, struct sk_buff *skb); +diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h +index 282875cf8056..8254c937c9f4 100644 +--- a/include/uapi/linux/libc-compat.h ++++ b/include/uapi/linux/libc-compat.h +@@ -168,46 +168,99 @@ + + /* If we did not see any headers from any supported C libraries, + * or we are being included in the kernel, then define everything +- * that we need. */ ++ * that we need. Check for previous __UAPI_* definitions to give ++ * unsupported C libraries a way to opt out of any kernel definition. */ + #else /* !defined(__GLIBC__) */ + + /* Definitions for if.h */ ++#ifndef __UAPI_DEF_IF_IFCONF + #define __UAPI_DEF_IF_IFCONF 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFMAP + #define __UAPI_DEF_IF_IFMAP 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFNAMSIZ + #define __UAPI_DEF_IF_IFNAMSIZ 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFREQ + #define __UAPI_DEF_IF_IFREQ 1 ++#endif + /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1 ++#endif + /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 ++#endif + + /* Definitions for in.h */ ++#ifndef __UAPI_DEF_IN_ADDR + #define __UAPI_DEF_IN_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN_IPPROTO + #define __UAPI_DEF_IN_IPPROTO 1 ++#endif ++#ifndef __UAPI_DEF_IN_PKTINFO + #define __UAPI_DEF_IN_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP_MREQ + #define __UAPI_DEF_IP_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN + #define __UAPI_DEF_SOCKADDR_IN 1 ++#endif ++#ifndef __UAPI_DEF_IN_CLASS + #define __UAPI_DEF_IN_CLASS 1 ++#endif + + /* Definitions for in6.h */ ++#ifndef __UAPI_DEF_IN6_ADDR + #define __UAPI_DEF_IN6_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN6_ADDR_ALT + #define __UAPI_DEF_IN6_ADDR_ALT 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN6 + #define __UAPI_DEF_SOCKADDR_IN6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_MREQ + #define __UAPI_DEF_IPV6_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_IPPROTO_V6 + #define __UAPI_DEF_IPPROTO_V6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_OPTIONS + #define __UAPI_DEF_IPV6_OPTIONS 1 ++#endif ++#ifndef __UAPI_DEF_IN6_PKTINFO + #define __UAPI_DEF_IN6_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP6_MTUINFO + #define __UAPI_DEF_IP6_MTUINFO 1 ++#endif + + /* Definitions for ipx.h */ ++#ifndef __UAPI_DEF_SOCKADDR_IPX + #define __UAPI_DEF_SOCKADDR_IPX 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION + #define __UAPI_DEF_IPX_ROUTE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION + #define __UAPI_DEF_IPX_INTERFACE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_CONFIG_DATA + #define __UAPI_DEF_IPX_CONFIG_DATA 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEF + #define __UAPI_DEF_IPX_ROUTE_DEF 1 ++#endif + + /* Definitions for xattr.h */ ++#ifndef __UAPI_DEF_XATTR + #define __UAPI_DEF_XATTR 1 ++#endif + + #endif /* __GLIBC__ */ + +diff --git a/include/uapi/linux/netfilter/nf_conntrack_common.h b/include/uapi/linux/netfilter/nf_conntrack_common.h +index 3fea7709a441..57ccfb32e87f 100644 +--- a/include/uapi/linux/netfilter/nf_conntrack_common.h ++++ b/include/uapi/linux/netfilter/nf_conntrack_common.h +@@ -36,7 +36,7 @@ enum ip_conntrack_info { + + #define NF_CT_STATE_INVALID_BIT (1 << 0) + #define NF_CT_STATE_BIT(ctinfo) (1 << ((ctinfo) % IP_CT_IS_REPLY + 1)) +-#define NF_CT_STATE_UNTRACKED_BIT (1 << (IP_CT_UNTRACKED + 1)) ++#define NF_CT_STATE_UNTRACKED_BIT (1 << 6) + + /* Bitset representing status of connection. */ + enum ip_conntrack_status { +diff --git a/include/xen/balloon.h b/include/xen/balloon.h +index 4914b93a23f2..61f410fd74e4 100644 +--- a/include/xen/balloon.h ++++ b/include/xen/balloon.h +@@ -44,3 +44,8 @@ static inline void xen_balloon_init(void) + { + } + #endif ++ ++#ifdef CONFIG_XEN_BALLOON_MEMORY_HOTPLUG ++struct resource; ++void arch_xen_balloon_init(struct resource *hostmem_resource); ++#endif +diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c +index dbd7b322a86b..1890be7ea9cd 100644 +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -588,8 +588,15 @@ static void sock_map_free(struct bpf_map *map) + + write_lock_bh(&sock->sk_callback_lock); + psock = smap_psock_sk(sock); +- smap_list_remove(psock, &stab->sock_map[i]); +- smap_release_sock(psock, sock); ++ /* This check handles a racing sock event that can get the ++ * sk_callback_lock before this case but after xchg happens ++ * causing the refcnt to hit zero and sock user data (psock) ++ * to be null and queued for garbage collection. ++ */ ++ if (likely(psock)) { ++ smap_list_remove(psock, &stab->sock_map[i]); ++ smap_release_sock(psock, sock); ++ } + write_unlock_bh(&sock->sk_callback_lock); + } + rcu_read_unlock(); +diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c +index 024085daab1a..a2c05d2476ac 100644 +--- a/kernel/cgroup/cgroup-v1.c ++++ b/kernel/cgroup/cgroup-v1.c +@@ -123,7 +123,11 @@ int cgroup_transfer_tasks(struct cgroup *to, struct cgroup *from) + */ + do { + css_task_iter_start(&from->self, 0, &it); +- task = css_task_iter_next(&it); ++ ++ do { ++ task = css_task_iter_next(&it); ++ } while (task && (task->flags & PF_EXITING)); ++ + if (task) + get_task_struct(task); + css_task_iter_end(&it); +diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h +index 17f05ef8f575..e4d3819a91cc 100644 +--- a/kernel/irq/debug.h ++++ b/kernel/irq/debug.h +@@ -12,6 +12,11 @@ + + static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc) + { ++ static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); ++ ++ if (!__ratelimit(&ratelimit)) ++ return; ++ + printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n", + irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled); + printk("->handle_irq(): %p, ", desc->handle_irq); +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 052773df9f03..d00e85ac10d6 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1106,7 +1106,12 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id, + + cpu_base = raw_cpu_ptr(&hrtimer_bases); + +- if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS) ++ /* ++ * POSIX magic: Relative CLOCK_REALTIME timers are not affected by ++ * clock modifications, so they needs to become CLOCK_MONOTONIC to ++ * ensure POSIX compliance. ++ */ ++ if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL) + clock_id = CLOCK_MONOTONIC; + + base = hrtimer_clockid_to_base(clock_id); +diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h +index 57fd45ab7af1..08c60d10747f 100644 +--- a/lib/mpi/longlong.h ++++ b/lib/mpi/longlong.h +@@ -671,7 +671,23 @@ do { \ + ************** MIPS/64 ************** + ***************************************/ + #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64 +-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) ++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 ++/* ++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C ++ * code below, so we special case MIPS64r6 until the compiler can do better. ++ */ ++#define umul_ppmm(w1, w0, u, v) \ ++do { \ ++ __asm__ ("dmulu %0,%1,%2" \ ++ : "=d" ((UDItype)(w0)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++ __asm__ ("dmuhu %0,%1,%2" \ ++ : "=d" ((UDItype)(w1)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++} while (0) ++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) + #define umul_ppmm(w1, w0, u, v) \ + do { \ + typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \ +diff --git a/mm/frame_vector.c b/mm/frame_vector.c +index 297c7238f7d4..c64dca6e27c2 100644 +--- a/mm/frame_vector.c ++++ b/mm/frame_vector.c +@@ -62,8 +62,10 @@ int get_vaddr_frames(unsigned long start, unsigned int nr_frames, + * get_user_pages_longterm() and disallow it for filesystem-dax + * mappings. + */ +- if (vma_is_fsdax(vma)) +- return -EOPNOTSUPP; ++ if (vma_is_fsdax(vma)) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } + + if (!(vma->vm_flags & (VM_IO | VM_PFNMAP))) { + vec->got_ref = true; +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 045331204097..1933654007c4 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -1274,6 +1274,7 @@ static const struct net_device_ops erspan_netdev_ops = { + static void ipgre_tap_setup(struct net_device *dev) + { + ether_setup(dev); ++ dev->max_mtu = 0; + dev->netdev_ops = &gre_tap_netdev_ops; + dev->priv_flags &= ~IFF_TX_SKB_SHARING; + dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; +diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c +index e50b7fea57ee..bcfc00e88756 100644 +--- a/net/ipv4/xfrm4_input.c ++++ b/net/ipv4/xfrm4_input.c +@@ -23,6 +23,12 @@ int xfrm4_extract_input(struct xfrm_state *x, struct sk_buff *skb) + return xfrm4_extract_header(skb); + } + ++static int xfrm4_rcv_encap_finish2(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ return dst_input(skb); ++} ++ + static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk, + struct sk_buff *skb) + { +@@ -33,7 +39,11 @@ static inline int xfrm4_rcv_encap_finish(struct net *net, struct sock *sk, + iph->tos, skb->dev)) + goto drop; + } +- return dst_input(skb); ++ ++ if (xfrm_trans_queue(skb, xfrm4_rcv_encap_finish2)) ++ goto drop; ++ ++ return 0; + drop: + kfree_skb(skb); + return NET_RX_DROP; +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 5b4870caf268..e8ab306794d8 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1335,6 +1335,7 @@ static void ip6gre_tap_setup(struct net_device *dev) + + ether_setup(dev); + ++ dev->max_mtu = 0; + dev->netdev_ops = &ip6gre_tap_netdev_ops; + dev->needs_free_netdev = true; + dev->priv_destructor = ip6gre_dev_free; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 3f46121ad139..1161fd5630c1 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1131,8 +1131,13 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + max_headroom += 8; + mtu -= 8; + } +- if (mtu < IPV6_MIN_MTU) +- mtu = IPV6_MIN_MTU; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ } else if (mtu < 576) { ++ mtu = 576; ++ } ++ + if (skb_dst(skb) && !t->parms.collect_md) + skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { +@@ -1679,11 +1684,11 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu) + { + struct ip6_tnl *tnl = netdev_priv(dev); + +- if (tnl->parms.proto == IPPROTO_IPIP) { +- if (new_mtu < ETH_MIN_MTU) ++ if (tnl->parms.proto == IPPROTO_IPV6) { ++ if (new_mtu < IPV6_MIN_MTU) + return -EINVAL; + } else { +- if (new_mtu < IPV6_MIN_MTU) ++ if (new_mtu < ETH_MIN_MTU) + return -EINVAL; + } + if (new_mtu > 0xFFF8 - dev->hard_header_len) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index ca8d3266e92e..a4a865c8a23c 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1755,6 +1755,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, + } + + rt->dst.flags |= DST_HOST; ++ rt->dst.input = ip6_input; + rt->dst.output = ip6_output; + rt->rt6i_gateway = fl6->daddr; + rt->rt6i_dst.addr = fl6->daddr; +diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c +index fe04e23af986..841f4a07438e 100644 +--- a/net/ipv6/xfrm6_input.c ++++ b/net/ipv6/xfrm6_input.c +@@ -32,6 +32,14 @@ int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi, + } + EXPORT_SYMBOL(xfrm6_rcv_spi); + ++static int xfrm6_transport_finish2(struct net *net, struct sock *sk, ++ struct sk_buff *skb) ++{ ++ if (xfrm_trans_queue(skb, ip6_rcv_finish)) ++ __kfree_skb(skb); ++ return -1; ++} ++ + int xfrm6_transport_finish(struct sk_buff *skb, int async) + { + struct xfrm_offload *xo = xfrm_offload(skb); +@@ -56,7 +64,7 @@ int xfrm6_transport_finish(struct sk_buff *skb, int async) + + NF_HOOK(NFPROTO_IPV6, NF_INET_PRE_ROUTING, + dev_net(skb->dev), NULL, skb, skb->dev, NULL, +- ip6_rcv_finish); ++ xfrm6_transport_finish2); + return -1; + } + +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 70e9d2ca8bbe..4daafb07602f 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3632,6 +3632,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + } + return true; + case NL80211_IFTYPE_MESH_POINT: ++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) ++ return false; + if (multicast) + return true; + return ether_addr_equal(sdata->vif.addr, hdr->addr1); +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 64e1ee091225..5b504aa653f5 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2072,7 +2072,7 @@ static int nf_tables_dump_rules(struct sk_buff *skb, + continue; + + list_for_each_entry_rcu(chain, &table->chains, list) { +- if (ctx && ctx->chain[0] && ++ if (ctx && ctx->chain && + strcmp(ctx->chain, chain->name) != 0) + continue; + +@@ -4596,8 +4596,10 @@ static int nf_tables_dump_obj_done(struct netlink_callback *cb) + { + struct nft_obj_filter *filter = cb->data; + +- kfree(filter->table); +- kfree(filter); ++ if (filter) { ++ kfree(filter->table); ++ kfree(filter); ++ } + + return 0; + } +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index ecbb019efcbd..934c239cf98d 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -197,21 +197,26 @@ static struct tcf_chain *tcf_chain_create(struct tcf_block *block, + + static void tcf_chain_flush(struct tcf_chain *chain) + { +- struct tcf_proto *tp; ++ struct tcf_proto *tp = rtnl_dereference(chain->filter_chain); + + if (chain->p_filter_chain) + RCU_INIT_POINTER(*chain->p_filter_chain, NULL); +- while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) { ++ while (tp) { + RCU_INIT_POINTER(chain->filter_chain, tp->next); +- tcf_chain_put(chain); + tcf_proto_destroy(tp); ++ tp = rtnl_dereference(chain->filter_chain); ++ tcf_chain_put(chain); + } + } + + static void tcf_chain_destroy(struct tcf_chain *chain) + { ++ struct tcf_block *block = chain->block; ++ + list_del(&chain->list); + kfree(chain); ++ if (list_empty(&block->chain_list)) ++ kfree(block); + } + + static void tcf_chain_hold(struct tcf_chain *chain) +@@ -275,22 +280,8 @@ int tcf_block_get(struct tcf_block **p_block, + } + EXPORT_SYMBOL(tcf_block_get); + +-static void tcf_block_put_final(struct work_struct *work) +-{ +- struct tcf_block *block = container_of(work, struct tcf_block, work); +- struct tcf_chain *chain, *tmp; +- +- rtnl_lock(); +- /* Only chain 0 should be still here. */ +- list_for_each_entry_safe(chain, tmp, &block->chain_list, list) +- tcf_chain_put(chain); +- rtnl_unlock(); +- kfree(block); +-} +- + /* XXX: Standalone actions are not allowed to jump to any chain, and bound +- * actions should be all removed after flushing. However, filters are now +- * destroyed in tc filter workqueue with RTNL lock, they can not race here. ++ * actions should be all removed after flushing. + */ + void tcf_block_put(struct tcf_block *block) + { +@@ -299,15 +290,22 @@ void tcf_block_put(struct tcf_block *block) + if (!block) + return; + +- list_for_each_entry_safe(chain, tmp, &block->chain_list, list) ++ /* Hold a refcnt for all chains, so that they don't disappear ++ * while we are iterating. ++ */ ++ list_for_each_entry(chain, &block->chain_list, list) ++ tcf_chain_hold(chain); ++ ++ list_for_each_entry(chain, &block->chain_list, list) + tcf_chain_flush(chain); + +- INIT_WORK(&block->work, tcf_block_put_final); +- /* Wait for RCU callbacks to release the reference count and make +- * sure their works have been queued before this. +- */ +- rcu_barrier(); +- tcf_queue_work(&block->work); ++ /* At this point, all the chains should have refcnt >= 1. */ ++ list_for_each_entry_safe(chain, tmp, &block->chain_list, list) ++ tcf_chain_put(chain); ++ ++ /* Finally, put chain 0 and allow block to be freed. */ ++ chain = list_first_entry(&block->chain_list, struct tcf_chain, list); ++ tcf_chain_put(chain); + } + EXPORT_SYMBOL(tcf_block_put); + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 3c8b92667866..6b3a862706de 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -3494,6 +3494,8 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk, + + if (optlen < sizeof(struct sctp_hmacalgo)) + return -EINVAL; ++ optlen = min_t(unsigned int, optlen, sizeof(struct sctp_hmacalgo) + ++ SCTP_AUTH_NUM_HMACS * sizeof(u16)); + + hmacs = memdup_user(optval, optlen); + if (IS_ERR(hmacs)) +@@ -3532,6 +3534,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk, + + if (optlen <= sizeof(struct sctp_authkey)) + return -EINVAL; ++ /* authkey->sca_keylength is u16, so optlen can't be bigger than ++ * this. ++ */ ++ optlen = min_t(unsigned int, optlen, USHRT_MAX + ++ sizeof(struct sctp_authkey)); + + authkey = memdup_user(optval, optlen); + if (IS_ERR(authkey)) +@@ -3889,6 +3896,9 @@ static int sctp_setsockopt_reset_streams(struct sock *sk, + + if (optlen < sizeof(*params)) + return -EINVAL; ++ /* srs_number_streams is u16, so optlen can't be bigger than this. */ ++ optlen = min_t(unsigned int, optlen, USHRT_MAX + ++ sizeof(__u16) * sizeof(*params)); + + params = memdup_user(optval, optlen); + if (IS_ERR(params)) +@@ -4947,7 +4957,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv + len = sizeof(int); + if (put_user(len, optlen)) + return -EFAULT; +- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) ++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) + return -EFAULT; + return 0; + } +@@ -5578,6 +5588,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, + err = -EFAULT; + goto out; + } ++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, ++ * but we can't change it anymore. ++ */ + if (put_user(bytes_copied, optlen)) + err = -EFAULT; + out: +@@ -6014,7 +6027,7 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len, + params.assoc_id = 0; + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); +- if (copy_from_user(¶ms, optval, sizeof(params))) ++ if (copy_from_user(¶ms, optval, len)) + return -EFAULT; + } else + return -EINVAL; +@@ -6184,7 +6197,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + + if (len < sizeof(struct sctp_authkeyid)) + return -EINVAL; +- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) ++ ++ len = sizeof(struct sctp_authkeyid); ++ if (copy_from_user(&val, optval, len)) + return -EFAULT; + + asoc = sctp_id2assoc(sk, val.scact_assoc_id); +@@ -6196,7 +6211,6 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + else + val.scact_keynumber = ep->active_key_id; + +- len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) + return -EFAULT; + if (copy_to_user(optval, &val, len)) +@@ -6222,7 +6236,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +@@ -6267,7 +6281,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c +index a71be33f3afe..e36ec5dd64c6 100644 +--- a/net/sctp/ulpqueue.c ++++ b/net/sctp/ulpqueue.c +@@ -1084,29 +1084,21 @@ void sctp_ulpq_partial_delivery(struct sctp_ulpq *ulpq, + void sctp_ulpq_renege(struct sctp_ulpq *ulpq, struct sctp_chunk *chunk, + gfp_t gfp) + { +- struct sctp_association *asoc; +- __u16 needed, freed; +- +- asoc = ulpq->asoc; ++ struct sctp_association *asoc = ulpq->asoc; ++ __u32 freed = 0; ++ __u16 needed; + +- if (chunk) { +- needed = ntohs(chunk->chunk_hdr->length); +- needed -= sizeof(struct sctp_data_chunk); +- } else +- needed = SCTP_DEFAULT_MAXWINDOW; +- +- freed = 0; ++ needed = ntohs(chunk->chunk_hdr->length) - ++ sizeof(struct sctp_data_chunk); + + if (skb_queue_empty(&asoc->base.sk->sk_receive_queue)) { + freed = sctp_ulpq_renege_order(ulpq, needed); +- if (freed < needed) { ++ if (freed < needed) + freed += sctp_ulpq_renege_frags(ulpq, needed - freed); +- } + } + /* If able to free enough room, accept this chunk. */ +- if (chunk && (freed >= needed)) { +- int retval; +- retval = sctp_ulpq_tail_data(ulpq, chunk, gfp); ++ if (freed >= needed) { ++ int retval = sctp_ulpq_tail_data(ulpq, chunk, gfp); + /* + * Enter partial delivery if chunk has not been + * delivered; otherwise, drain the reassembly queue. +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 47ec121574ce..c8001471da6c 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -324,6 +324,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (res) { + pr_warn("Bearer <%s> rejected, enable failure (%d)\n", + name, -res); ++ kfree(b); + return -EINVAL; + } + +@@ -347,8 +348,10 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (skb) + tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); + +- if (tipc_mon_create(net, bearer_id)) ++ if (tipc_mon_create(net, bearer_id)) { ++ bearer_disable(net, b); + return -ENOMEM; ++ } + + pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n", + name, +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index 9e109bb1a207..0fcfb3916dcf 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, int bearer_id) + { + struct tipc_net *tn = tipc_net(net); + struct tipc_monitor *mon = tipc_monitor(net, bearer_id); +- struct tipc_peer *self = get_self(net, bearer_id); ++ struct tipc_peer *self; + struct tipc_peer *peer, *tmp; + ++ if (!mon) ++ return; ++ ++ self = get_self(net, bearer_id); + write_lock_bh(&mon->lock); + tn->monitors[bearer_id] = NULL; + list_for_each_entry_safe(peer, tmp, &self->list, list) { +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 81bef0676e1d..ea28aa505302 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -11301,7 +11301,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb, + break; + case NL80211_NAN_FUNC_FOLLOW_UP: + if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || +- !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { + err = -EINVAL; + goto out; + } +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index da6447389ffb..3f6f6f8c9fa5 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -8,15 +8,29 @@ + * + */ + ++#include ++#include + #include + #include + #include ++#include + #include + #include + #include + #include + #include + ++struct xfrm_trans_tasklet { ++ struct tasklet_struct tasklet; ++ struct sk_buff_head queue; ++}; ++ ++struct xfrm_trans_cb { ++ int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb); ++}; ++ ++#define XFRM_TRANS_SKB_CB(__skb) ((struct xfrm_trans_cb *)&((__skb)->cb[0])) ++ + static struct kmem_cache *secpath_cachep __read_mostly; + + static DEFINE_SPINLOCK(xfrm_input_afinfo_lock); +@@ -25,6 +39,8 @@ static struct xfrm_input_afinfo const __rcu *xfrm_input_afinfo[AF_INET6 + 1]; + static struct gro_cells gro_cells; + static struct net_device xfrm_napi_dev; + ++static DEFINE_PER_CPU(struct xfrm_trans_tasklet, xfrm_trans_tasklet); ++ + int xfrm_input_register_afinfo(const struct xfrm_input_afinfo *afinfo) + { + int err = 0; +@@ -477,9 +493,41 @@ int xfrm_input_resume(struct sk_buff *skb, int nexthdr) + } + EXPORT_SYMBOL(xfrm_input_resume); + ++static void xfrm_trans_reinject(unsigned long data) ++{ ++ struct xfrm_trans_tasklet *trans = (void *)data; ++ struct sk_buff_head queue; ++ struct sk_buff *skb; ++ ++ __skb_queue_head_init(&queue); ++ skb_queue_splice_init(&trans->queue, &queue); ++ ++ while ((skb = __skb_dequeue(&queue))) ++ XFRM_TRANS_SKB_CB(skb)->finish(dev_net(skb->dev), NULL, skb); ++} ++ ++int xfrm_trans_queue(struct sk_buff *skb, ++ int (*finish)(struct net *, struct sock *, ++ struct sk_buff *)) ++{ ++ struct xfrm_trans_tasklet *trans; ++ ++ trans = this_cpu_ptr(&xfrm_trans_tasklet); ++ ++ if (skb_queue_len(&trans->queue) >= netdev_max_backlog) ++ return -ENOBUFS; ++ ++ XFRM_TRANS_SKB_CB(skb)->finish = finish; ++ skb_queue_tail(&trans->queue, skb); ++ tasklet_schedule(&trans->tasklet); ++ return 0; ++} ++EXPORT_SYMBOL(xfrm_trans_queue); ++ + void __init xfrm_input_init(void) + { + int err; ++ int i; + + init_dummy_netdev(&xfrm_napi_dev); + err = gro_cells_init(&gro_cells, &xfrm_napi_dev); +@@ -490,4 +538,13 @@ void __init xfrm_input_init(void) + sizeof(struct sec_path), + 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, + NULL); ++ ++ for_each_possible_cpu(i) { ++ struct xfrm_trans_tasklet *trans; ++ ++ trans = &per_cpu(xfrm_trans_tasklet, i); ++ __skb_queue_head_init(&trans->queue); ++ tasklet_init(&trans->tasklet, xfrm_trans_reinject, ++ (unsigned long)trans); ++ } + } +diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c +index 714ce17da717..e853a6dfd33b 100644 +--- a/sound/soc/codecs/nau8825.c ++++ b/sound/soc/codecs/nau8825.c +@@ -905,6 +905,7 @@ static int nau8825_adc_event(struct snd_soc_dapm_widget *w, + + switch (event) { + case SND_SOC_DAPM_POST_PMU: ++ msleep(125); + regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL, + NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC); + break; +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index 938baff86ef2..2684a2ba33cd 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -216,7 +216,7 @@ int rsnd_adg_set_cmd_timsel_gen2(struct rsnd_mod *cmd_mod, + NULL, &val, NULL); + + val = val << shift; +- mask = 0xffff << shift; ++ mask = 0x0f1f << shift; + + rsnd_mod_bset(adg_mod, CMDOUT_TIMSEL, mask, val); + +@@ -244,7 +244,7 @@ int rsnd_adg_set_src_timesel_gen2(struct rsnd_mod *src_mod, + + in = in << shift; + out = out << shift; +- mask = 0xffff << shift; ++ mask = 0x0f1f << shift; + + switch (id / 2) { + case 0: +@@ -374,7 +374,7 @@ int rsnd_adg_ssi_clk_try_start(struct rsnd_mod *ssi_mod, unsigned int rate) + ckr = 0x80000000; + } + +- rsnd_mod_bset(adg_mod, BRGCKR, 0x80FF0000, adg->ckr | ckr); ++ rsnd_mod_bset(adg_mod, BRGCKR, 0x80770000, adg->ckr | ckr); + rsnd_mod_write(adg_mod, BRRA, adg->rbga); + rsnd_mod_write(adg_mod, BRRB, adg->rbgb); + diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.24-25.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.24-25.patch new file mode 100644 index 000000000000..ebf9d89fbb74 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.24-25.patch @@ -0,0 +1,4194 @@ +diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt +index 77f4de59dc9c..d499676890d8 100644 +--- a/Documentation/networking/ip-sysctl.txt ++++ b/Documentation/networking/ip-sysctl.txt +@@ -508,7 +508,7 @@ tcp_rmem - vector of 3 INTEGERs: min, default, max + min: Minimal size of receive buffer used by TCP sockets. + It is guaranteed to each TCP socket, even under moderate memory + pressure. +- Default: 1 page ++ Default: 4K + + default: initial size of receive buffer used by TCP sockets. + This value overrides net.core.rmem_default used by other protocols. +@@ -666,7 +666,7 @@ tcp_window_scaling - BOOLEAN + tcp_wmem - vector of 3 INTEGERs: min, default, max + min: Amount of memory reserved for send buffers for TCP sockets. + Each TCP socket has rights to use it due to fact of its birth. +- Default: 1 page ++ Default: 4K + + default: initial size of send buffer used by TCP sockets. This + value overrides net.core.wmem_default used by other protocols. +diff --git a/Makefile b/Makefile +index 38acc6047d7d..0fdae0f455ef 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 24 ++SUBLEVEL = 25 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi +index 4f2c5ec75714..e262fa9ef334 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -97,6 +97,8 @@ + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -215,7 +217,12 @@ + >; + }; + +- ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ >; ++ }; + }; + + &omap3_pmx_wkup { +diff --git a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +index 6d89736c7b44..cf22b35f0a28 100644 +--- a/arch/arm/boot/dts/logicpd-torpedo-som.dtsi ++++ b/arch/arm/boot/dts/logicpd-torpedo-som.dtsi +@@ -104,6 +104,8 @@ + }; + + &i2c1 { ++ pinctrl-names = "default"; ++ pinctrl-0 = <&i2c1_pins>; + clock-frequency = <2600000>; + + twl: twl@48 { +@@ -211,6 +213,12 @@ + OMAP3_CORE1_IOPAD(0x21b8, PIN_INPUT | MUX_MODE0) /* hsusb0_data7.hsusb0_data7 */ + >; + }; ++ i2c1_pins: pinmux_i2c1_pins { ++ pinctrl-single,pins = < ++ OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ ++ OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ >; ++ }; + }; + + &uart2 { +diff --git a/arch/arm/boot/dts/rk3288-phycore-som.dtsi b/arch/arm/boot/dts/rk3288-phycore-som.dtsi +index 99cfae875e12..5eae4776ffde 100644 +--- a/arch/arm/boot/dts/rk3288-phycore-som.dtsi ++++ b/arch/arm/boot/dts/rk3288-phycore-som.dtsi +@@ -110,26 +110,6 @@ + }; + }; + +-&cpu0 { +- cpu0-supply = <&vdd_cpu>; +- operating-points = < +- /* KHz uV */ +- 1800000 1400000 +- 1608000 1350000 +- 1512000 1300000 +- 1416000 1200000 +- 1200000 1100000 +- 1008000 1050000 +- 816000 1000000 +- 696000 950000 +- 600000 900000 +- 408000 900000 +- 312000 900000 +- 216000 900000 +- 126000 900000 +- >; +-}; +- + &emmc { + status = "okay"; + bus-width = <8>; +diff --git a/arch/arm/kvm/hyp/Makefile b/arch/arm/kvm/hyp/Makefile +index 5638ce0c9524..63d6b404d88e 100644 +--- a/arch/arm/kvm/hyp/Makefile ++++ b/arch/arm/kvm/hyp/Makefile +@@ -7,6 +7,8 @@ ccflags-y += -fno-stack-protector -DDISABLE_BRANCH_PROFILING + + KVM=../../../../virt/kvm + ++CFLAGS_ARMV7VE :=$(call cc-option, -march=armv7ve) ++ + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v2-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/vgic-v3-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += $(KVM)/arm/hyp/timer-sr.o +@@ -15,7 +17,10 @@ obj-$(CONFIG_KVM_ARM_HOST) += tlb.o + obj-$(CONFIG_KVM_ARM_HOST) += cp15-sr.o + obj-$(CONFIG_KVM_ARM_HOST) += vfp.o + obj-$(CONFIG_KVM_ARM_HOST) += banked-sr.o ++CFLAGS_banked-sr.o += $(CFLAGS_ARMV7VE) ++ + obj-$(CONFIG_KVM_ARM_HOST) += entry.o + obj-$(CONFIG_KVM_ARM_HOST) += hyp-entry.o + obj-$(CONFIG_KVM_ARM_HOST) += switch.o ++CFLAGS_switch.o += $(CFLAGS_ARMV7VE) + obj-$(CONFIG_KVM_ARM_HOST) += s2-setup.o +diff --git a/arch/arm/kvm/hyp/banked-sr.c b/arch/arm/kvm/hyp/banked-sr.c +index 111bda8cdebd..be4b8b0a40ad 100644 +--- a/arch/arm/kvm/hyp/banked-sr.c ++++ b/arch/arm/kvm/hyp/banked-sr.c +@@ -20,6 +20,10 @@ + + #include + ++/* ++ * gcc before 4.9 doesn't understand -march=armv7ve, so we have to ++ * trick the assembler. ++ */ + __asm__(".arch_extension virt"); + + void __hyp_text __banked_save_state(struct kvm_cpu_context *ctxt) +diff --git a/arch/arm/mach-mvebu/Kconfig b/arch/arm/mach-mvebu/Kconfig +index 9b49867154bf..63fa79f9f121 100644 +--- a/arch/arm/mach-mvebu/Kconfig ++++ b/arch/arm/mach-mvebu/Kconfig +@@ -42,7 +42,7 @@ config MACH_ARMADA_375 + depends on ARCH_MULTI_V7 + select ARMADA_370_XP_IRQ + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARMADA_375_CLK + select HAVE_ARM_SCU +@@ -58,7 +58,7 @@ config MACH_ARMADA_38X + bool "Marvell Armada 380/385 boards" + depends on ARCH_MULTI_V7 + select ARM_ERRATA_720789 +- select ARM_ERRATA_753970 ++ select PL310_ERRATA_753970 + select ARM_GIC + select ARM_GLOBAL_TIMER + select CLKSRC_ARM_GLOBAL_TIMER_SCHED_CLOCK +diff --git a/arch/arm/plat-orion/common.c b/arch/arm/plat-orion/common.c +index aff6994950ba..a2399fd66e97 100644 +--- a/arch/arm/plat-orion/common.c ++++ b/arch/arm/plat-orion/common.c +@@ -472,28 +472,27 @@ void __init orion_ge11_init(struct mv643xx_eth_platform_data *eth_data, + /***************************************************************************** + * Ethernet switch + ****************************************************************************/ +-static __initconst const char *orion_ge00_mvmdio_bus_name = "orion-mii"; +-static __initdata struct mdio_board_info +- orion_ge00_switch_board_info; ++static __initdata struct mdio_board_info orion_ge00_switch_board_info = { ++ .bus_id = "orion-mii", ++ .modalias = "mv88e6085", ++}; + + void __init orion_ge00_switch_init(struct dsa_chip_data *d) + { +- struct mdio_board_info *bd; + unsigned int i; + + if (!IS_BUILTIN(CONFIG_PHYLIB)) + return; + +- for (i = 0; i < ARRAY_SIZE(d->port_names); i++) +- if (!strcmp(d->port_names[i], "cpu")) ++ for (i = 0; i < ARRAY_SIZE(d->port_names); i++) { ++ if (!strcmp(d->port_names[i], "cpu")) { ++ d->netdev[i] = &orion_ge00.dev; + break; ++ } ++ } + +- bd = &orion_ge00_switch_board_info; +- bd->bus_id = orion_ge00_mvmdio_bus_name; +- bd->mdio_addr = d->sw_addr; +- d->netdev[i] = &orion_ge00.dev; +- strcpy(bd->modalias, "mv88e6085"); +- bd->platform_data = d; ++ orion_ge00_switch_board_info.mdio_addr = d->sw_addr; ++ orion_ge00_switch_board_info.platform_data = d; + + mdiobus_register_board_info(&orion_ge00_switch_board_info, 1); + } +diff --git a/arch/parisc/include/asm/cacheflush.h b/arch/parisc/include/asm/cacheflush.h +index 3742508cc534..bd5ce31936f5 100644 +--- a/arch/parisc/include/asm/cacheflush.h ++++ b/arch/parisc/include/asm/cacheflush.h +@@ -26,6 +26,7 @@ void flush_user_icache_range_asm(unsigned long, unsigned long); + void flush_kernel_icache_range_asm(unsigned long, unsigned long); + void flush_user_dcache_range_asm(unsigned long, unsigned long); + void flush_kernel_dcache_range_asm(unsigned long, unsigned long); ++void purge_kernel_dcache_range_asm(unsigned long, unsigned long); + void flush_kernel_dcache_page_asm(void *); + void flush_kernel_icache_page(void *); + +diff --git a/arch/parisc/include/asm/processor.h b/arch/parisc/include/asm/processor.h +index 0e6ab6e4a4e9..2dbe5580a1a4 100644 +--- a/arch/parisc/include/asm/processor.h ++++ b/arch/parisc/include/asm/processor.h +@@ -316,6 +316,8 @@ extern int _parisc_requires_coherency; + #define parisc_requires_coherency() (0) + #endif + ++extern int running_on_qemu; ++ + #endif /* __ASSEMBLY__ */ + + #endif /* __ASM_PARISC_PROCESSOR_H */ +diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c +index 19c0c141bc3f..79089778725b 100644 +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -465,10 +465,10 @@ EXPORT_SYMBOL(copy_user_page); + int __flush_tlb_range(unsigned long sid, unsigned long start, + unsigned long end) + { +- unsigned long flags, size; ++ unsigned long flags; + +- size = (end - start); +- if (size >= parisc_tlb_flush_threshold) { ++ if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && ++ end - start >= parisc_tlb_flush_threshold) { + flush_tlb_all(); + return 1; + } +@@ -539,13 +539,11 @@ void flush_cache_mm(struct mm_struct *mm) + struct vm_area_struct *vma; + pgd_t *pgd; + +- /* Flush the TLB to avoid speculation if coherency is required. */ +- if (parisc_requires_coherency()) +- flush_tlb_all(); +- + /* Flushing the whole cache on each cpu takes forever on + rp3440, etc. So, avoid it if the mm isn't too big. */ +- if (mm_total_size(mm) >= parisc_cache_flush_threshold) { ++ if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && ++ mm_total_size(mm) >= parisc_cache_flush_threshold) { ++ flush_tlb_all(); + flush_cache_all(); + return; + } +@@ -553,9 +551,9 @@ void flush_cache_mm(struct mm_struct *mm) + if (mm->context == mfsp(3)) { + for (vma = mm->mmap; vma; vma = vma->vm_next) { + flush_user_dcache_range_asm(vma->vm_start, vma->vm_end); +- if ((vma->vm_flags & VM_EXEC) == 0) +- continue; +- flush_user_icache_range_asm(vma->vm_start, vma->vm_end); ++ if (vma->vm_flags & VM_EXEC) ++ flush_user_icache_range_asm(vma->vm_start, vma->vm_end); ++ flush_tlb_range(vma, vma->vm_start, vma->vm_end); + } + return; + } +@@ -581,14 +579,9 @@ void flush_cache_mm(struct mm_struct *mm) + void flush_cache_range(struct vm_area_struct *vma, + unsigned long start, unsigned long end) + { +- BUG_ON(!vma->vm_mm->context); +- +- /* Flush the TLB to avoid speculation if coherency is required. */ +- if (parisc_requires_coherency()) ++ if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && ++ end - start >= parisc_cache_flush_threshold) { + flush_tlb_range(vma, start, end); +- +- if ((end - start) >= parisc_cache_flush_threshold +- || vma->vm_mm->context != mfsp(3)) { + flush_cache_all(); + return; + } +@@ -596,6 +589,7 @@ void flush_cache_range(struct vm_area_struct *vma, + flush_user_dcache_range_asm(start, end); + if (vma->vm_flags & VM_EXEC) + flush_user_icache_range_asm(start, end); ++ flush_tlb_range(vma, start, end); + } + + void +@@ -604,8 +598,7 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long + BUG_ON(!vma->vm_mm->context); + + if (pfn_valid(pfn)) { +- if (parisc_requires_coherency()) +- flush_tlb_page(vma, vmaddr); ++ flush_tlb_page(vma, vmaddr); + __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn)); + } + } +@@ -613,21 +606,33 @@ flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long + void flush_kernel_vmap_range(void *vaddr, int size) + { + unsigned long start = (unsigned long)vaddr; ++ unsigned long end = start + size; + +- if ((unsigned long)size > parisc_cache_flush_threshold) ++ if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && ++ (unsigned long)size >= parisc_cache_flush_threshold) { ++ flush_tlb_kernel_range(start, end); + flush_data_cache(); +- else +- flush_kernel_dcache_range_asm(start, start + size); ++ return; ++ } ++ ++ flush_kernel_dcache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + } + EXPORT_SYMBOL(flush_kernel_vmap_range); + + void invalidate_kernel_vmap_range(void *vaddr, int size) + { + unsigned long start = (unsigned long)vaddr; ++ unsigned long end = start + size; + +- if ((unsigned long)size > parisc_cache_flush_threshold) ++ if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && ++ (unsigned long)size >= parisc_cache_flush_threshold) { ++ flush_tlb_kernel_range(start, end); + flush_data_cache(); +- else +- flush_kernel_dcache_range_asm(start, start + size); ++ return; ++ } ++ ++ purge_kernel_dcache_range_asm(start, end); ++ flush_tlb_kernel_range(start, end); + } + EXPORT_SYMBOL(invalidate_kernel_vmap_range); +diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S +index 2d40c4ff3f69..67b0f7532e83 100644 +--- a/arch/parisc/kernel/pacache.S ++++ b/arch/parisc/kernel/pacache.S +@@ -1110,6 +1110,28 @@ ENTRY_CFI(flush_kernel_dcache_range_asm) + .procend + ENDPROC_CFI(flush_kernel_dcache_range_asm) + ++ENTRY_CFI(purge_kernel_dcache_range_asm) ++ .proc ++ .callinfo NO_CALLS ++ .entry ++ ++ ldil L%dcache_stride, %r1 ++ ldw R%dcache_stride(%r1), %r23 ++ ldo -1(%r23), %r21 ++ ANDCM %r26, %r21, %r26 ++ ++1: cmpb,COND(<<),n %r26, %r25,1b ++ pdc,m %r23(%r26) ++ ++ sync ++ syncdma ++ bv %r0(%r2) ++ nop ++ .exit ++ ++ .procend ++ENDPROC_CFI(purge_kernel_dcache_range_asm) ++ + ENTRY_CFI(flush_user_icache_range_asm) + .proc + .callinfo NO_CALLS +diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c +index 4b8fd6dc22da..f7e684560186 100644 +--- a/arch/parisc/kernel/time.c ++++ b/arch/parisc/kernel/time.c +@@ -76,10 +76,10 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id) + next_tick = cpuinfo->it_value; + + /* Calculate how many ticks have elapsed. */ ++ now = mfctl(16); + do { + ++ticks_elapsed; + next_tick += cpt; +- now = mfctl(16); + } while (next_tick - now > cpt); + + /* Store (in CR16 cycles) up to when we are accounting right now. */ +@@ -103,16 +103,17 @@ irqreturn_t __irq_entry timer_interrupt(int irq, void *dev_id) + * if one or the other wrapped. If "now" is "bigger" we'll end up + * with a very large unsigned number. + */ +- while (next_tick - mfctl(16) > cpt) ++ now = mfctl(16); ++ while (next_tick - now > cpt) + next_tick += cpt; + + /* Program the IT when to deliver the next interrupt. + * Only bottom 32-bits of next_tick are writable in CR16! + * Timer interrupt will be delivered at least a few hundred cycles +- * after the IT fires, so if we are too close (<= 500 cycles) to the ++ * after the IT fires, so if we are too close (<= 8000 cycles) to the + * next cycle, simply skip it. + */ +- if (next_tick - mfctl(16) <= 500) ++ if (next_tick - now <= 8000) + next_tick += cpt; + mtctl(next_tick, 16); + +@@ -248,7 +249,7 @@ static int __init init_cr16_clocksource(void) + * different sockets, so mark them unstable and lower rating on + * multi-socket SMP systems. + */ +- if (num_online_cpus() > 1) { ++ if (num_online_cpus() > 1 && !running_on_qemu) { + int cpu; + unsigned long cpu0_loc; + cpu0_loc = per_cpu(cpu_data, 0).cpu_loc; +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c +index a832ad031cee..5185be314661 100644 +--- a/arch/s390/kvm/interrupt.c ++++ b/arch/s390/kvm/interrupt.c +@@ -173,8 +173,15 @@ static int ckc_interrupts_enabled(struct kvm_vcpu *vcpu) + + static int ckc_irq_pending(struct kvm_vcpu *vcpu) + { +- if (vcpu->arch.sie_block->ckc >= kvm_s390_get_tod_clock_fast(vcpu->kvm)) ++ const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm); ++ const u64 ckc = vcpu->arch.sie_block->ckc; ++ ++ if (vcpu->arch.sie_block->gcr[0] & 0x0020000000000000ul) { ++ if ((s64)ckc >= (s64)now) ++ return 0; ++ } else if (ckc >= now) { + return 0; ++ } + return ckc_interrupts_enabled(vcpu); + } + +@@ -1004,13 +1011,19 @@ int kvm_cpu_has_pending_timer(struct kvm_vcpu *vcpu) + + static u64 __calculate_sltime(struct kvm_vcpu *vcpu) + { +- u64 now, cputm, sltime = 0; ++ const u64 now = kvm_s390_get_tod_clock_fast(vcpu->kvm); ++ const u64 ckc = vcpu->arch.sie_block->ckc; ++ u64 cputm, sltime = 0; + + if (ckc_interrupts_enabled(vcpu)) { +- now = kvm_s390_get_tod_clock_fast(vcpu->kvm); +- sltime = tod_to_ns(vcpu->arch.sie_block->ckc - now); +- /* already expired or overflow? */ +- if (!sltime || vcpu->arch.sie_block->ckc <= now) ++ if (vcpu->arch.sie_block->gcr[0] & 0x0020000000000000ul) { ++ if ((s64)now < (s64)ckc) ++ sltime = tod_to_ns((s64)ckc - (s64)now); ++ } else if (now < ckc) { ++ sltime = tod_to_ns(ckc - now); ++ } ++ /* already expired */ ++ if (!sltime) + return 0; + if (cpu_timer_interrupts_enabled(vcpu)) { + cputm = kvm_s390_get_cpu_timer(vcpu); +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 6e3d80b2048e..f4f12ecd0cec 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -169,6 +169,28 @@ int kvm_arch_hardware_enable(void) + static void kvm_gmap_notifier(struct gmap *gmap, unsigned long start, + unsigned long end); + ++static void kvm_clock_sync_scb(struct kvm_s390_sie_block *scb, u64 delta) ++{ ++ u8 delta_idx = 0; ++ ++ /* ++ * The TOD jumps by delta, we have to compensate this by adding ++ * -delta to the epoch. ++ */ ++ delta = -delta; ++ ++ /* sign-extension - we're adding to signed values below */ ++ if ((s64)delta < 0) ++ delta_idx = -1; ++ ++ scb->epoch += delta; ++ if (scb->ecd & ECD_MEF) { ++ scb->epdx += delta_idx; ++ if (scb->epoch < delta) ++ scb->epdx += 1; ++ } ++} ++ + /* + * This callback is executed during stop_machine(). All CPUs are therefore + * temporarily stopped. In order not to change guest behavior, we have to +@@ -184,13 +206,17 @@ static int kvm_clock_sync(struct notifier_block *notifier, unsigned long val, + unsigned long long *delta = v; + + list_for_each_entry(kvm, &vm_list, vm_list) { +- kvm->arch.epoch -= *delta; + kvm_for_each_vcpu(i, vcpu, kvm) { +- vcpu->arch.sie_block->epoch -= *delta; ++ kvm_clock_sync_scb(vcpu->arch.sie_block, *delta); ++ if (i == 0) { ++ kvm->arch.epoch = vcpu->arch.sie_block->epoch; ++ kvm->arch.epdx = vcpu->arch.sie_block->epdx; ++ } + if (vcpu->arch.cputm_enabled) + vcpu->arch.cputm_start += *delta; + if (vcpu->arch.vsie_block) +- vcpu->arch.vsie_block->epoch -= *delta; ++ kvm_clock_sync_scb(vcpu->arch.vsie_block, ++ *delta); + } + } + return NOTIFY_OK; +@@ -888,12 +914,9 @@ static int kvm_s390_set_tod_ext(struct kvm *kvm, struct kvm_device_attr *attr) + if (copy_from_user(>od, (void __user *)attr->addr, sizeof(gtod))) + return -EFAULT; + +- if (test_kvm_facility(kvm, 139)) +- kvm_s390_set_tod_clock_ext(kvm, >od); +- else if (gtod.epoch_idx == 0) +- kvm_s390_set_tod_clock(kvm, gtod.tod); +- else ++ if (!test_kvm_facility(kvm, 139) && gtod.epoch_idx) + return -EINVAL; ++ kvm_s390_set_tod_clock(kvm, >od); + + VM_EVENT(kvm, 3, "SET: TOD extension: 0x%x, TOD base: 0x%llx", + gtod.epoch_idx, gtod.tod); +@@ -918,13 +941,14 @@ static int kvm_s390_set_tod_high(struct kvm *kvm, struct kvm_device_attr *attr) + + static int kvm_s390_set_tod_low(struct kvm *kvm, struct kvm_device_attr *attr) + { +- u64 gtod; ++ struct kvm_s390_vm_tod_clock gtod = { 0 }; + +- if (copy_from_user(>od, (void __user *)attr->addr, sizeof(gtod))) ++ if (copy_from_user(>od.tod, (void __user *)attr->addr, ++ sizeof(gtod.tod))) + return -EFAULT; + +- kvm_s390_set_tod_clock(kvm, gtod); +- VM_EVENT(kvm, 3, "SET: TOD base: 0x%llx", gtod); ++ kvm_s390_set_tod_clock(kvm, >od); ++ VM_EVENT(kvm, 3, "SET: TOD base: 0x%llx", gtod.tod); + return 0; + } + +@@ -2359,6 +2383,7 @@ void kvm_arch_vcpu_postcreate(struct kvm_vcpu *vcpu) + mutex_lock(&vcpu->kvm->lock); + preempt_disable(); + vcpu->arch.sie_block->epoch = vcpu->kvm->arch.epoch; ++ vcpu->arch.sie_block->epdx = vcpu->kvm->arch.epdx; + preempt_enable(); + mutex_unlock(&vcpu->kvm->lock); + if (!kvm_is_ucontrol(vcpu->kvm)) { +@@ -2945,8 +2970,8 @@ static int kvm_s390_handle_requests(struct kvm_vcpu *vcpu) + return 0; + } + +-void kvm_s390_set_tod_clock_ext(struct kvm *kvm, +- const struct kvm_s390_vm_tod_clock *gtod) ++void kvm_s390_set_tod_clock(struct kvm *kvm, ++ const struct kvm_s390_vm_tod_clock *gtod) + { + struct kvm_vcpu *vcpu; + struct kvm_s390_tod_clock_ext htod; +@@ -2958,10 +2983,12 @@ void kvm_s390_set_tod_clock_ext(struct kvm *kvm, + get_tod_clock_ext((char *)&htod); + + kvm->arch.epoch = gtod->tod - htod.tod; +- kvm->arch.epdx = gtod->epoch_idx - htod.epoch_idx; +- +- if (kvm->arch.epoch > gtod->tod) +- kvm->arch.epdx -= 1; ++ kvm->arch.epdx = 0; ++ if (test_kvm_facility(kvm, 139)) { ++ kvm->arch.epdx = gtod->epoch_idx - htod.epoch_idx; ++ if (kvm->arch.epoch > gtod->tod) ++ kvm->arch.epdx -= 1; ++ } + + kvm_s390_vcpu_block_all(kvm); + kvm_for_each_vcpu(i, vcpu, kvm) { +@@ -2974,22 +3001,6 @@ void kvm_s390_set_tod_clock_ext(struct kvm *kvm, + mutex_unlock(&kvm->lock); + } + +-void kvm_s390_set_tod_clock(struct kvm *kvm, u64 tod) +-{ +- struct kvm_vcpu *vcpu; +- int i; +- +- mutex_lock(&kvm->lock); +- preempt_disable(); +- kvm->arch.epoch = tod - get_tod_clock(); +- kvm_s390_vcpu_block_all(kvm); +- kvm_for_each_vcpu(i, vcpu, kvm) +- vcpu->arch.sie_block->epoch = kvm->arch.epoch; +- kvm_s390_vcpu_unblock_all(kvm); +- preempt_enable(); +- mutex_unlock(&kvm->lock); +-} +- + /** + * kvm_arch_fault_in_page - fault-in guest page if necessary + * @vcpu: The corresponding virtual cpu +diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h +index 9f8fdd7b2311..e22d94f494a7 100644 +--- a/arch/s390/kvm/kvm-s390.h ++++ b/arch/s390/kvm/kvm-s390.h +@@ -272,9 +272,8 @@ int kvm_s390_handle_sigp_pei(struct kvm_vcpu *vcpu); + int handle_sthyi(struct kvm_vcpu *vcpu); + + /* implemented in kvm-s390.c */ +-void kvm_s390_set_tod_clock_ext(struct kvm *kvm, +- const struct kvm_s390_vm_tod_clock *gtod); +-void kvm_s390_set_tod_clock(struct kvm *kvm, u64 tod); ++void kvm_s390_set_tod_clock(struct kvm *kvm, ++ const struct kvm_s390_vm_tod_clock *gtod); + long kvm_arch_fault_in_page(struct kvm_vcpu *vcpu, gpa_t gpa, int writable); + int kvm_s390_store_status_unloaded(struct kvm_vcpu *vcpu, unsigned long addr); + int kvm_s390_vcpu_store_status(struct kvm_vcpu *vcpu, unsigned long addr); +diff --git a/arch/s390/kvm/priv.c b/arch/s390/kvm/priv.c +index 7bd3a59232f0..734283a21677 100644 +--- a/arch/s390/kvm/priv.c ++++ b/arch/s390/kvm/priv.c +@@ -84,9 +84,10 @@ int kvm_s390_handle_e3(struct kvm_vcpu *vcpu) + /* Handle SCK (SET CLOCK) interception */ + static int handle_set_clock(struct kvm_vcpu *vcpu) + { ++ struct kvm_s390_vm_tod_clock gtod = { 0 }; + int rc; + u8 ar; +- u64 op2, val; ++ u64 op2; + + if (vcpu->arch.sie_block->gpsw.mask & PSW_MASK_PSTATE) + return kvm_s390_inject_program_int(vcpu, PGM_PRIVILEGED_OP); +@@ -94,12 +95,12 @@ static int handle_set_clock(struct kvm_vcpu *vcpu) + op2 = kvm_s390_get_base_disp_s(vcpu, &ar); + if (op2 & 7) /* Operand must be on a doubleword boundary */ + return kvm_s390_inject_program_int(vcpu, PGM_SPECIFICATION); +- rc = read_guest(vcpu, op2, ar, &val, sizeof(val)); ++ rc = read_guest(vcpu, op2, ar, >od.tod, sizeof(gtod.tod)); + if (rc) + return kvm_s390_inject_prog_cond(vcpu, rc); + +- VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", val); +- kvm_s390_set_tod_clock(vcpu->kvm, val); ++ VCPU_EVENT(vcpu, 3, "SCK: setting guest TOD to 0x%llx", gtod.tod); ++ kvm_s390_set_tod_clock(vcpu->kvm, >od); + + kvm_s390_set_psw_cc(vcpu, 0); + return 0; +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index 8b8f1f14a0bf..5c790e93657d 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -350,14 +350,14 @@ static inline pmd_t pmd_set_flags(pmd_t pmd, pmdval_t set) + { + pmdval_t v = native_pmd_val(pmd); + +- return __pmd(v | set); ++ return native_make_pmd(v | set); + } + + static inline pmd_t pmd_clear_flags(pmd_t pmd, pmdval_t clear) + { + pmdval_t v = native_pmd_val(pmd); + +- return __pmd(v & ~clear); ++ return native_make_pmd(v & ~clear); + } + + static inline pmd_t pmd_mkold(pmd_t pmd) +@@ -409,14 +409,14 @@ static inline pud_t pud_set_flags(pud_t pud, pudval_t set) + { + pudval_t v = native_pud_val(pud); + +- return __pud(v | set); ++ return native_make_pud(v | set); + } + + static inline pud_t pud_clear_flags(pud_t pud, pudval_t clear) + { + pudval_t v = native_pud_val(pud); + +- return __pud(v & ~clear); ++ return native_make_pud(v & ~clear); + } + + static inline pud_t pud_mkold(pud_t pud) +diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h +index e55466760ff8..b3ec519e3982 100644 +--- a/arch/x86/include/asm/pgtable_32.h ++++ b/arch/x86/include/asm/pgtable_32.h +@@ -32,6 +32,7 @@ extern pmd_t initial_pg_pmd[]; + static inline void pgtable_cache_init(void) { } + static inline void check_pgt_cache(void) { } + void paging_init(void); ++void sync_initial_page_table(void); + + /* + * Define this if things work differently on an i386 and an i486: +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index 81462e9a34f6..1149d2112b2e 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -28,6 +28,7 @@ extern pgd_t init_top_pgt[]; + #define swapper_pg_dir init_top_pgt + + extern void paging_init(void); ++static inline void sync_initial_page_table(void) { } + + #define pte_ERROR(e) \ + pr_err("%s:%d: bad pte %p(%016lx)\n", \ +diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h +index 3696398a9475..246f15b4e64c 100644 +--- a/arch/x86/include/asm/pgtable_types.h ++++ b/arch/x86/include/asm/pgtable_types.h +@@ -323,6 +323,11 @@ static inline pudval_t native_pud_val(pud_t pud) + #else + #include + ++static inline pud_t native_make_pud(pudval_t val) ++{ ++ return (pud_t) { .p4d.pgd = native_make_pgd(val) }; ++} ++ + static inline pudval_t native_pud_val(pud_t pud) + { + return native_pgd_val(pud.p4d.pgd); +@@ -344,6 +349,11 @@ static inline pmdval_t native_pmd_val(pmd_t pmd) + #else + #include + ++static inline pmd_t native_make_pmd(pmdval_t val) ++{ ++ return (pmd_t) { .pud.p4d.pgd = native_make_pgd(val) }; ++} ++ + static inline pmdval_t native_pmd_val(pmd_t pmd) + { + return native_pgd_val(pmd.pud.p4d.pgd); +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index c54361a22f59..efbcf5283520 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -1238,20 +1238,13 @@ void __init setup_arch(char **cmdline_p) + + kasan_init(); + +-#ifdef CONFIG_X86_32 +- /* sync back kernel address range */ +- clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- KERNEL_PGD_PTRS); +- + /* +- * sync back low identity map too. It is used for example +- * in the 32-bit EFI stub. ++ * Sync back kernel address range. ++ * ++ * FIXME: Can the later sync in setup_cpu_entry_areas() replace ++ * this call? + */ +- clone_pgd_range(initial_page_table, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); +-#endif ++ sync_initial_page_table(); + + tboot_probe(); + +diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c +index 497aa766fab3..ea554f812ee1 100644 +--- a/arch/x86/kernel/setup_percpu.c ++++ b/arch/x86/kernel/setup_percpu.c +@@ -287,24 +287,15 @@ void __init setup_per_cpu_areas(void) + /* Setup cpu initialized, callin, callout masks */ + setup_cpu_local_masks(); + +-#ifdef CONFIG_X86_32 + /* + * Sync back kernel address range again. We already did this in + * setup_arch(), but percpu data also needs to be available in + * the smpboot asm. We can't reliably pick up percpu mappings + * using vmalloc_fault(), because exception dispatch needs + * percpu data. ++ * ++ * FIXME: Can the later sync in setup_cpu_entry_areas() replace ++ * this call? + */ +- clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- KERNEL_PGD_PTRS); +- +- /* +- * sync back low identity map too. It is used for example +- * in the 32-bit EFI stub. +- */ +- clone_pgd_range(initial_page_table, +- swapper_pg_dir + KERNEL_PGD_BOUNDARY, +- min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); +-#endif ++ sync_initial_page_table(); + } +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index ef03efba1c23..8cfdb6484fd0 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1944,14 +1944,13 @@ void kvm_lapic_set_base(struct kvm_vcpu *vcpu, u64 value) + + void kvm_lapic_reset(struct kvm_vcpu *vcpu, bool init_event) + { +- struct kvm_lapic *apic; ++ struct kvm_lapic *apic = vcpu->arch.apic; + int i; + +- apic_debug("%s\n", __func__); ++ if (!apic) ++ return; + +- ASSERT(vcpu); +- apic = vcpu->arch.apic; +- ASSERT(apic != NULL); ++ apic_debug("%s\n", __func__); + + /* Stop the timer in case it's a reset to an active apic */ + hrtimer_cancel(&apic->lapic_timer.timer); +@@ -2107,7 +2106,6 @@ int kvm_create_lapic(struct kvm_vcpu *vcpu) + */ + vcpu->arch.apic_base = MSR_IA32_APICBASE_ENABLE; + static_key_slow_inc(&apic_sw_disabled.key); /* sw disabled at reset */ +- kvm_lapic_reset(vcpu, false); + kvm_iodevice_init(&apic->dev, &apic_mmio_ops); + + return 0; +@@ -2511,7 +2509,6 @@ void kvm_apic_accept_events(struct kvm_vcpu *vcpu) + + pe = xchg(&apic->pending_events, 0); + if (test_bit(KVM_APIC_INIT, &pe)) { +- kvm_lapic_reset(vcpu, true); + kvm_vcpu_reset(vcpu, true); + if (kvm_vcpu_is_bsp(apic->vcpu)) + vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE; +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index ca000fc644bc..2b6f8a4f2731 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -150,6 +150,20 @@ module_param(dbg, bool, 0644); + /* make pte_list_desc fit well in cache line */ + #define PTE_LIST_EXT 3 + ++/* ++ * Return values of handle_mmio_page_fault and mmu.page_fault: ++ * RET_PF_RETRY: let CPU fault again on the address. ++ * RET_PF_EMULATE: mmio page fault, emulate the instruction directly. ++ * ++ * For handle_mmio_page_fault only: ++ * RET_PF_INVALID: the spte is invalid, let the real page fault path update it. ++ */ ++enum { ++ RET_PF_RETRY = 0, ++ RET_PF_EMULATE = 1, ++ RET_PF_INVALID = 2, ++}; ++ + struct pte_list_desc { + u64 *sptes[PTE_LIST_EXT]; + struct pte_list_desc *more; +@@ -2794,13 +2808,13 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep, + return ret; + } + +-static bool mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access, +- int write_fault, int level, gfn_t gfn, kvm_pfn_t pfn, +- bool speculative, bool host_writable) ++static int mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access, ++ int write_fault, int level, gfn_t gfn, kvm_pfn_t pfn, ++ bool speculative, bool host_writable) + { + int was_rmapped = 0; + int rmap_count; +- bool emulate = false; ++ int ret = RET_PF_RETRY; + + pgprintk("%s: spte %llx write_fault %d gfn %llx\n", __func__, + *sptep, write_fault, gfn); +@@ -2830,12 +2844,12 @@ static bool mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access, + if (set_spte(vcpu, sptep, pte_access, level, gfn, pfn, speculative, + true, host_writable)) { + if (write_fault) +- emulate = true; ++ ret = RET_PF_EMULATE; + kvm_make_request(KVM_REQ_TLB_FLUSH, vcpu); + } + + if (unlikely(is_mmio_spte(*sptep))) +- emulate = true; ++ ret = RET_PF_EMULATE; + + pgprintk("%s: setting spte %llx\n", __func__, *sptep); + pgprintk("instantiating %s PTE (%s) at %llx (%llx) addr %p\n", +@@ -2855,7 +2869,7 @@ static bool mmu_set_spte(struct kvm_vcpu *vcpu, u64 *sptep, unsigned pte_access, + + kvm_release_pfn_clean(pfn); + +- return emulate; ++ return ret; + } + + static kvm_pfn_t pte_prefetch_gfn_to_pfn(struct kvm_vcpu *vcpu, gfn_t gfn, +@@ -2994,17 +3008,16 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn) + * Do not cache the mmio info caused by writing the readonly gfn + * into the spte otherwise read access on readonly gfn also can + * caused mmio page fault and treat it as mmio access. +- * Return 1 to tell kvm to emulate it. + */ + if (pfn == KVM_PFN_ERR_RO_FAULT) +- return 1; ++ return RET_PF_EMULATE; + + if (pfn == KVM_PFN_ERR_HWPOISON) { + kvm_send_hwpoison_signal(kvm_vcpu_gfn_to_hva(vcpu, gfn), current); +- return 0; ++ return RET_PF_RETRY; + } + +- return -EFAULT; ++ return RET_PF_EMULATE; + } + + static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu, +@@ -3286,13 +3299,13 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code, + } + + if (fast_page_fault(vcpu, v, level, error_code)) +- return 0; ++ return RET_PF_RETRY; + + mmu_seq = vcpu->kvm->mmu_notifier_seq; + smp_rmb(); + + if (try_async_pf(vcpu, prefault, gfn, v, &pfn, write, &map_writable)) +- return 0; ++ return RET_PF_RETRY; + + if (handle_abnormal_pfn(vcpu, v, gfn, pfn, ACC_ALL, &r)) + return r; +@@ -3312,7 +3325,7 @@ static int nonpaging_map(struct kvm_vcpu *vcpu, gva_t v, u32 error_code, + out_unlock: + spin_unlock(&vcpu->kvm->mmu_lock); + kvm_release_pfn_clean(pfn); +- return 0; ++ return RET_PF_RETRY; + } + + +@@ -3659,54 +3672,38 @@ walk_shadow_page_get_mmio_spte(struct kvm_vcpu *vcpu, u64 addr, u64 *sptep) + return reserved; + } + +-/* +- * Return values of handle_mmio_page_fault: +- * RET_MMIO_PF_EMULATE: it is a real mmio page fault, emulate the instruction +- * directly. +- * RET_MMIO_PF_INVALID: invalid spte is detected then let the real page +- * fault path update the mmio spte. +- * RET_MMIO_PF_RETRY: let CPU fault again on the address. +- * RET_MMIO_PF_BUG: a bug was detected (and a WARN was printed). +- */ +-enum { +- RET_MMIO_PF_EMULATE = 1, +- RET_MMIO_PF_INVALID = 2, +- RET_MMIO_PF_RETRY = 0, +- RET_MMIO_PF_BUG = -1 +-}; +- + static int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct) + { + u64 spte; + bool reserved; + + if (mmio_info_in_cache(vcpu, addr, direct)) +- return RET_MMIO_PF_EMULATE; ++ return RET_PF_EMULATE; + + reserved = walk_shadow_page_get_mmio_spte(vcpu, addr, &spte); + if (WARN_ON(reserved)) +- return RET_MMIO_PF_BUG; ++ return -EINVAL; + + if (is_mmio_spte(spte)) { + gfn_t gfn = get_mmio_spte_gfn(spte); + unsigned access = get_mmio_spte_access(spte); + + if (!check_mmio_spte(vcpu, spte)) +- return RET_MMIO_PF_INVALID; ++ return RET_PF_INVALID; + + if (direct) + addr = 0; + + trace_handle_mmio_page_fault(addr, gfn, access); + vcpu_cache_mmio_info(vcpu, addr, gfn, access); +- return RET_MMIO_PF_EMULATE; ++ return RET_PF_EMULATE; + } + + /* + * If the page table is zapped by other cpus, let CPU fault again on + * the address. + */ +- return RET_MMIO_PF_RETRY; ++ return RET_PF_RETRY; + } + EXPORT_SYMBOL_GPL(handle_mmio_page_fault); + +@@ -3756,7 +3753,7 @@ static int nonpaging_page_fault(struct kvm_vcpu *vcpu, gva_t gva, + pgprintk("%s: gva %lx error %x\n", __func__, gva, error_code); + + if (page_fault_handle_page_track(vcpu, error_code, gfn)) +- return 1; ++ return RET_PF_EMULATE; + + r = mmu_topup_memory_caches(vcpu); + if (r) +@@ -3877,7 +3874,7 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code, + MMU_WARN_ON(!VALID_PAGE(vcpu->arch.mmu.root_hpa)); + + if (page_fault_handle_page_track(vcpu, error_code, gfn)) +- return 1; ++ return RET_PF_EMULATE; + + r = mmu_topup_memory_caches(vcpu); + if (r) +@@ -3894,13 +3891,13 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code, + } + + if (fast_page_fault(vcpu, gpa, level, error_code)) +- return 0; ++ return RET_PF_RETRY; + + mmu_seq = vcpu->kvm->mmu_notifier_seq; + smp_rmb(); + + if (try_async_pf(vcpu, prefault, gfn, gpa, &pfn, write, &map_writable)) +- return 0; ++ return RET_PF_RETRY; + + if (handle_abnormal_pfn(vcpu, 0, gfn, pfn, ACC_ALL, &r)) + return r; +@@ -3920,7 +3917,7 @@ static int tdp_page_fault(struct kvm_vcpu *vcpu, gva_t gpa, u32 error_code, + out_unlock: + spin_unlock(&vcpu->kvm->mmu_lock); + kvm_release_pfn_clean(pfn); +- return 0; ++ return RET_PF_RETRY; + } + + static void nonpaging_init_context(struct kvm_vcpu *vcpu, +@@ -4919,25 +4916,25 @@ int kvm_mmu_page_fault(struct kvm_vcpu *vcpu, gva_t cr2, u64 error_code, + vcpu->arch.gpa_val = cr2; + } + ++ r = RET_PF_INVALID; + if (unlikely(error_code & PFERR_RSVD_MASK)) { + r = handle_mmio_page_fault(vcpu, cr2, direct); +- if (r == RET_MMIO_PF_EMULATE) { ++ if (r == RET_PF_EMULATE) { + emulation_type = 0; + goto emulate; + } +- if (r == RET_MMIO_PF_RETRY) +- return 1; +- if (r < 0) +- return r; +- /* Must be RET_MMIO_PF_INVALID. */ + } + +- r = vcpu->arch.mmu.page_fault(vcpu, cr2, lower_32_bits(error_code), +- false); ++ if (r == RET_PF_INVALID) { ++ r = vcpu->arch.mmu.page_fault(vcpu, cr2, lower_32_bits(error_code), ++ false); ++ WARN_ON(r == RET_PF_INVALID); ++ } ++ ++ if (r == RET_PF_RETRY) ++ return 1; + if (r < 0) + return r; +- if (!r) +- return 1; + + /* + * Before emulating the instruction, check if the error code +diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h +index f18d1f8d332b..5abae72266b7 100644 +--- a/arch/x86/kvm/paging_tmpl.h ++++ b/arch/x86/kvm/paging_tmpl.h +@@ -593,7 +593,7 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, + struct kvm_mmu_page *sp = NULL; + struct kvm_shadow_walk_iterator it; + unsigned direct_access, access = gw->pt_access; +- int top_level, emulate; ++ int top_level, ret; + + direct_access = gw->pte_access; + +@@ -659,15 +659,15 @@ static int FNAME(fetch)(struct kvm_vcpu *vcpu, gva_t addr, + } + + clear_sp_write_flooding_count(it.sptep); +- emulate = mmu_set_spte(vcpu, it.sptep, gw->pte_access, write_fault, +- it.level, gw->gfn, pfn, prefault, map_writable); ++ ret = mmu_set_spte(vcpu, it.sptep, gw->pte_access, write_fault, ++ it.level, gw->gfn, pfn, prefault, map_writable); + FNAME(pte_prefetch)(vcpu, gw, it.sptep); + +- return emulate; ++ return ret; + + out_gpte_changed: + kvm_release_pfn_clean(pfn); +- return 0; ++ return RET_PF_RETRY; + } + + /* +@@ -762,12 +762,12 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code, + if (!prefault) + inject_page_fault(vcpu, &walker.fault); + +- return 0; ++ return RET_PF_RETRY; + } + + if (page_fault_handle_page_track(vcpu, error_code, walker.gfn)) { + shadow_page_table_clear_flood(vcpu, addr); +- return 1; ++ return RET_PF_EMULATE; + } + + vcpu->arch.write_fault_to_shadow_pgtable = false; +@@ -789,7 +789,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code, + + if (try_async_pf(vcpu, prefault, walker.gfn, addr, &pfn, write_fault, + &map_writable)) +- return 0; ++ return RET_PF_RETRY; + + if (handle_abnormal_pfn(vcpu, addr, walker.gfn, pfn, walker.pte_access, &r)) + return r; +@@ -834,7 +834,7 @@ static int FNAME(page_fault)(struct kvm_vcpu *vcpu, gva_t addr, u32 error_code, + out_unlock: + spin_unlock(&vcpu->kvm->mmu_lock); + kvm_release_pfn_clean(pfn); +- return 0; ++ return RET_PF_RETRY; + } + + static gpa_t FNAME(get_level1_sp_gpa)(struct kvm_mmu_page *sp) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index e0bc3ad0f6cd..9fb0daf628cb 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -5015,7 +5016,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) + * being speculatively taken. + */ + if (svm->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); + + asm volatile ( + "push %%" _ASM_BP "; \n\t" +@@ -5124,11 +5125,11 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) + * If the L02 MSR bitmap does not intercept the MSR, then we need to + * save it. + */ +- if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) +- rdmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); ++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) ++ svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (svm->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); + + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 5ffde16253cb..315fccb2684b 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -51,6 +51,7 @@ + #include + #include + #include ++#include + #include + + #include "trace.h" +@@ -9431,7 +9432,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + * being speculatively taken. + */ + if (vmx->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); + + vmx->__launched = vmx->loaded_vmcs->launched; + asm( +@@ -9566,11 +9567,11 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + * If the L02 MSR bitmap does not intercept the MSR, then we need to + * save it. + */ +- if (!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL)) +- rdmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); ++ if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) ++ vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + + if (vmx->spec_ctrl) +- wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); + + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 0dcd7bf45dc1..b9afb4784d12 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7482,13 +7482,13 @@ EXPORT_SYMBOL_GPL(kvm_task_switch); + + int kvm_valid_sregs(struct kvm_vcpu *vcpu, struct kvm_sregs *sregs) + { +- if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG_BIT)) { ++ if ((sregs->efer & EFER_LME) && (sregs->cr0 & X86_CR0_PG)) { + /* + * When EFER.LME and CR0.PG are set, the processor is in + * 64-bit mode (though maybe in a 32-bit code segment). + * CR4.PAE and EFER.LMA must be set. + */ +- if (!(sregs->cr4 & X86_CR4_PAE_BIT) ++ if (!(sregs->cr4 & X86_CR4_PAE) + || !(sregs->efer & EFER_LMA)) + return -EINVAL; + } else { +@@ -7821,6 +7821,8 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) + + void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + { ++ kvm_lapic_reset(vcpu, init_event); ++ + vcpu->arch.hflags = 0; + + vcpu->arch.smi_pending = 0; +@@ -8249,10 +8251,8 @@ int __x86_set_memory_region(struct kvm *kvm, int id, gpa_t gpa, u32 size) + return r; + } + +- if (!size) { +- r = vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); +- WARN_ON(r < 0); +- } ++ if (!size) ++ vm_munmap(old.userspace_addr, old.npages * PAGE_SIZE); + + return 0; + } +diff --git a/arch/x86/mm/cpu_entry_area.c b/arch/x86/mm/cpu_entry_area.c +index b9283cc27622..476d810639a8 100644 +--- a/arch/x86/mm/cpu_entry_area.c ++++ b/arch/x86/mm/cpu_entry_area.c +@@ -163,4 +163,10 @@ void __init setup_cpu_entry_areas(void) + + for_each_possible_cpu(cpu) + setup_cpu_entry_area(cpu); ++ ++ /* ++ * This is the last essential update to swapper_pgdir which needs ++ * to be synchronized to initial_page_table on 32bit. ++ */ ++ sync_initial_page_table(); + } +diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c +index 135c9a7898c7..3141e67ec24c 100644 +--- a/arch/x86/mm/init_32.c ++++ b/arch/x86/mm/init_32.c +@@ -453,6 +453,21 @@ static inline void permanent_kmaps_init(pgd_t *pgd_base) + } + #endif /* CONFIG_HIGHMEM */ + ++void __init sync_initial_page_table(void) ++{ ++ clone_pgd_range(initial_page_table + KERNEL_PGD_BOUNDARY, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ KERNEL_PGD_PTRS); ++ ++ /* ++ * sync back low identity map too. It is used for example ++ * in the 32-bit EFI stub. ++ */ ++ clone_pgd_range(initial_page_table, ++ swapper_pg_dir + KERNEL_PGD_BOUNDARY, ++ min(KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY)); ++} ++ + void __init native_pagetable_init(void) + { + unsigned long pfn, va; +diff --git a/arch/x86/platform/intel-mid/intel-mid.c b/arch/x86/platform/intel-mid/intel-mid.c +index 86676cec99a1..09dd7f3cf621 100644 +--- a/arch/x86/platform/intel-mid/intel-mid.c ++++ b/arch/x86/platform/intel-mid/intel-mid.c +@@ -79,7 +79,7 @@ static void intel_mid_power_off(void) + + static void intel_mid_reboot(void) + { +- intel_scu_ipc_simple_command(IPCMSG_COLD_BOOT, 0); ++ intel_scu_ipc_simple_command(IPCMSG_COLD_RESET, 0); + } + + static unsigned long __init intel_mid_calibrate_tsc(void) +diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c +index 92bf5ecb6baf..3e3a58ea669e 100644 +--- a/arch/x86/xen/suspend.c ++++ b/arch/x86/xen/suspend.c +@@ -1,12 +1,15 @@ + // SPDX-License-Identifier: GPL-2.0 + #include + #include ++#include + + #include + #include + #include + #include + ++#include ++#include + #include + #include + #include +@@ -15,6 +18,8 @@ + #include "mmu.h" + #include "pmu.h" + ++static DEFINE_PER_CPU(u64, spec_ctrl); ++ + void xen_arch_pre_suspend(void) + { + if (xen_pv_domain()) +@@ -31,6 +36,9 @@ void xen_arch_post_suspend(int cancelled) + + static void xen_vcpu_notify_restore(void *data) + { ++ if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL)) ++ wrmsrl(MSR_IA32_SPEC_CTRL, this_cpu_read(spec_ctrl)); ++ + /* Boot processor notified via generic timekeeping_resume() */ + if (smp_processor_id() == 0) + return; +@@ -40,7 +48,15 @@ static void xen_vcpu_notify_restore(void *data) + + static void xen_vcpu_notify_suspend(void *data) + { ++ u64 tmp; ++ + tick_suspend_local(); ++ ++ if (xen_pv_domain() && boot_cpu_has(X86_FEATURE_SPEC_CTRL)) { ++ rdmsrl(MSR_IA32_SPEC_CTRL, tmp); ++ this_cpu_write(spec_ctrl, tmp); ++ wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ } + } + + void xen_arch_resume(void) +diff --git a/block/blk-core.c b/block/blk-core.c +index 95b7ea996ac2..c01f4907dbbc 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -2277,7 +2277,7 @@ blk_qc_t submit_bio(struct bio *bio) + unsigned int count; + + if (unlikely(bio_op(bio) == REQ_OP_WRITE_SAME)) +- count = queue_logical_block_size(bio->bi_disk->queue); ++ count = queue_logical_block_size(bio->bi_disk->queue) >> 9; + else + count = bio_sectors(bio); + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index b60798a30ea2..f1fb126a3be5 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -638,7 +638,6 @@ static void __blk_mq_requeue_request(struct request *rq) + + trace_block_rq_requeue(q, rq); + wbt_requeue(q->rq_wb, &rq->issue_stat); +- blk_mq_sched_requeue_request(rq); + + if (test_and_clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags)) { + if (q->dma_drain_size && blk_rq_bytes(rq)) +@@ -650,6 +649,9 @@ void blk_mq_requeue_request(struct request *rq, bool kick_requeue_list) + { + __blk_mq_requeue_request(rq); + ++ /* this request will be re-inserted to io scheduler queue */ ++ blk_mq_sched_requeue_request(rq); ++ + BUG_ON(blk_queued_rq(rq)); + blk_mq_add_to_requeue_list(rq, true, kick_requeue_list); + } +diff --git a/block/kyber-iosched.c b/block/kyber-iosched.c +index f58cab82105b..09cd5cf2e459 100644 +--- a/block/kyber-iosched.c ++++ b/block/kyber-iosched.c +@@ -814,6 +814,7 @@ static struct elevator_type kyber_sched = { + .limit_depth = kyber_limit_depth, + .prepare_request = kyber_prepare_request, + .finish_request = kyber_finish_request, ++ .requeue_request = kyber_finish_request, + .completed_request = kyber_completed_request, + .dispatch_request = kyber_dispatch_request, + .has_work = kyber_has_work, +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index 4d0979e02a28..b6d58cc58f5f 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -66,10 +66,37 @@ static int set_copy_dsdt(const struct dmi_system_id *id) + return 0; + } + #endif ++static int set_gbl_term_list(const struct dmi_system_id *id) ++{ ++ acpi_gbl_parse_table_as_term_list = 1; ++ return 0; ++} + +-static const struct dmi_system_id dsdt_dmi_table[] __initconst = { ++static const struct dmi_system_id acpi_quirks_dmi_table[] __initconst = { ++ /* ++ * Touchpad on Dell XPS 9570/Precision M5530 doesn't work under I2C ++ * mode. ++ * https://bugzilla.kernel.org/show_bug.cgi?id=198515 ++ */ ++ { ++ .callback = set_gbl_term_list, ++ .ident = "Dell Precision M5530", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "Precision M5530"), ++ }, ++ }, ++ { ++ .callback = set_gbl_term_list, ++ .ident = "Dell XPS 15 9570", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "XPS 15 9570"), ++ }, ++ }, + /* + * Invoke DSDT corruption work-around on all Toshiba Satellite. ++ * DSDT will be copied to memory. + * https://bugzilla.kernel.org/show_bug.cgi?id=14679 + */ + { +@@ -83,7 +110,7 @@ static const struct dmi_system_id dsdt_dmi_table[] __initconst = { + {} + }; + #else +-static const struct dmi_system_id dsdt_dmi_table[] __initconst = { ++static const struct dmi_system_id acpi_quirks_dmi_table[] __initconst = { + {} + }; + #endif +@@ -1001,11 +1028,8 @@ void __init acpi_early_init(void) + + acpi_permanent_mmap = true; + +- /* +- * If the machine falls into the DMI check table, +- * DSDT will be copied to memory +- */ +- dmi_check_system(dsdt_dmi_table); ++ /* Check machine-specific quirks */ ++ dmi_check_system(acpi_quirks_dmi_table); + + status = acpi_reallocate_root_table(); + if (ACPI_FAILURE(status)) { +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index d54c3f6f728c..673698c7b143 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -21,6 +21,7 @@ + * + */ + ++#include + #include + #include + #include +@@ -381,6 +382,21 @@ static const struct usb_device_id blacklist_table[] = { + { } /* Terminating entry */ + }; + ++/* The Bluetooth USB module build into some devices needs to be reset on resume, ++ * this is a problem with the platform (likely shutting off all power) not with ++ * the module itself. So we use a DMI list to match known broken platforms. ++ */ ++static const struct dmi_system_id btusb_needs_reset_resume_table[] = { ++ { ++ /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"), ++ }, ++ }, ++ {} ++}; ++ + #define BTUSB_MAX_ISOC_FRAMES 10 + + #define BTUSB_INTR_RUNNING 0 +@@ -3013,6 +3029,9 @@ static int btusb_probe(struct usb_interface *intf, + hdev->send = btusb_send_frame; + hdev->notify = btusb_notify; + ++ if (dmi_check_system(btusb_needs_reset_resume_table)) ++ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; ++ + #ifdef CONFIG_PM + err = btusb_config_oob_wake(hdev); + if (err) +@@ -3099,12 +3118,6 @@ static int btusb_probe(struct usb_interface *intf, + if (id->driver_info & BTUSB_QCA_ROME) { + data->setup_on_usb = btusb_setup_qca; + hdev->set_bdaddr = btusb_set_bdaddr_ath3012; +- +- /* QCA Rome devices lose their updated firmware over suspend, +- * but the USB hub doesn't notice any status change. +- * explicitly request a device reset on resume. +- */ +- interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; + } + + #ifdef CONFIG_BT_HCIBTUSB_RTL +diff --git a/drivers/char/tpm/st33zp24/st33zp24.c b/drivers/char/tpm/st33zp24/st33zp24.c +index 4d1dc8b46877..f95b9c75175b 100644 +--- a/drivers/char/tpm/st33zp24/st33zp24.c ++++ b/drivers/char/tpm/st33zp24/st33zp24.c +@@ -457,7 +457,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, + size_t count) + { + int size = 0; +- int expected; ++ u32 expected; + + if (!chip) + return -EBUSY; +@@ -474,7 +474,7 @@ static int st33zp24_recv(struct tpm_chip *chip, unsigned char *buf, + } + + expected = be32_to_cpu(*(__be32 *)(buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < TPM_HEADER_SIZE) { + size = -EIO; + goto out; + } +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 1d6729be4cd6..3cec403a80b3 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -1228,6 +1228,10 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) + break; + + recd = be32_to_cpu(tpm_cmd.params.getrandom_out.rng_data_len); ++ if (recd > num_bytes) { ++ total = -EFAULT; ++ break; ++ } + + rlength = be32_to_cpu(tpm_cmd.header.out.length); + if (rlength < offsetof(struct tpm_getrandom_out, rng_data) + +diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c +index e1a41b788f08..44a3d16231f6 100644 +--- a/drivers/char/tpm/tpm2-cmd.c ++++ b/drivers/char/tpm/tpm2-cmd.c +@@ -683,6 +683,10 @@ static int tpm2_unseal_cmd(struct tpm_chip *chip, + if (!rc) { + data_len = be16_to_cpup( + (__be16 *) &buf.data[TPM_HEADER_SIZE + 4]); ++ if (data_len < MIN_KEY_SIZE || data_len > MAX_KEY_SIZE + 1) { ++ rc = -EFAULT; ++ goto out; ++ } + + rlength = be32_to_cpu(((struct tpm2_cmd *)&buf) + ->header.out.length); +diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c +index 79d6bbb58e39..d5b44cadac56 100644 +--- a/drivers/char/tpm/tpm_i2c_infineon.c ++++ b/drivers/char/tpm/tpm_i2c_infineon.c +@@ -473,7 +473,8 @@ static int recv_data(struct tpm_chip *chip, u8 *buf, size_t count) + static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + int size = 0; +- int expected, status; ++ int status; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + size = -EIO; +@@ -488,7 +489,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + expected = be32_to_cpu(*(__be32 *)(buf + 2)); +- if ((size_t) expected > count) { ++ if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) { + size = -EIO; + goto out; + } +diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c +index c6428771841f..caa86b19c76d 100644 +--- a/drivers/char/tpm/tpm_i2c_nuvoton.c ++++ b/drivers/char/tpm/tpm_i2c_nuvoton.c +@@ -281,7 +281,11 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) + struct device *dev = chip->dev.parent; + struct i2c_client *client = to_i2c_client(dev); + s32 rc; +- int expected, status, burst_count, retries, size = 0; ++ int status; ++ int burst_count; ++ int retries; ++ int size = 0; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + i2c_nuvoton_ready(chip); /* return to idle */ +@@ -323,7 +327,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) + * to machine native + */ + expected = be32_to_cpu(*(__be32 *) (buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < size) { + dev_err(dev, "%s() expected > count\n", __func__); + size = -EIO; + continue; +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index 7e55aa9ce680..ebd0e75a3e4d 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -223,7 +223,7 @@ static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len, + } + + static int tpm_tcg_write_bytes(struct tpm_tis_data *data, u32 addr, u16 len, +- u8 *value) ++ const u8 *value) + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 63bc6c3b949e..083578b2517e 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -202,7 +202,8 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + int size = 0; +- int expected, status; ++ int status; ++ u32 expected; + + if (count < TPM_HEADER_SIZE) { + size = -EIO; +@@ -217,7 +218,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + } + + expected = be32_to_cpu(*(__be32 *) (buf + 2)); +- if (expected > count) { ++ if (expected > count || expected < TPM_HEADER_SIZE) { + size = -EIO; + goto out; + } +@@ -252,7 +253,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) + * tpm.c can skip polling for the data to be available as the interrupt is + * waited for here + */ +-static int tpm_tis_send_data(struct tpm_chip *chip, u8 *buf, size_t len) ++static int tpm_tis_send_data(struct tpm_chip *chip, const u8 *buf, size_t len) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + int rc, status, burstcnt; +@@ -343,7 +344,7 @@ static void disable_interrupts(struct tpm_chip *chip) + * tpm.c can skip polling for the data to be available as the interrupt is + * waited for here + */ +-static int tpm_tis_send_main(struct tpm_chip *chip, u8 *buf, size_t len) ++static int tpm_tis_send_main(struct tpm_chip *chip, const u8 *buf, size_t len) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + int rc; +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index e2212f021a02..6bbac319ff3b 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -98,7 +98,7 @@ struct tpm_tis_phy_ops { + int (*read_bytes)(struct tpm_tis_data *data, u32 addr, u16 len, + u8 *result); + int (*write_bytes)(struct tpm_tis_data *data, u32 addr, u16 len, +- u8 *value); ++ const u8 *value); + int (*read16)(struct tpm_tis_data *data, u32 addr, u16 *result); + int (*read32)(struct tpm_tis_data *data, u32 addr, u32 *result); + int (*write32)(struct tpm_tis_data *data, u32 addr, u32 src); +@@ -128,7 +128,7 @@ static inline int tpm_tis_read32(struct tpm_tis_data *data, u32 addr, + } + + static inline int tpm_tis_write_bytes(struct tpm_tis_data *data, u32 addr, +- u16 len, u8 *value) ++ u16 len, const u8 *value) + { + return data->phy_ops->write_bytes(data, addr, len, value); + } +diff --git a/drivers/char/tpm/tpm_tis_spi.c b/drivers/char/tpm/tpm_tis_spi.c +index 88fe72ae967f..8ab0bd8445f6 100644 +--- a/drivers/char/tpm/tpm_tis_spi.c ++++ b/drivers/char/tpm/tpm_tis_spi.c +@@ -46,9 +46,7 @@ + struct tpm_tis_spi_phy { + struct tpm_tis_data priv; + struct spi_device *spi_device; +- +- u8 tx_buf[4]; +- u8 rx_buf[4]; ++ u8 *iobuf; + }; + + static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy(struct tpm_tis_data *data) +@@ -57,7 +55,7 @@ static inline struct tpm_tis_spi_phy *to_tpm_tis_spi_phy(struct tpm_tis_data *da + } + + static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, +- u8 *buffer, u8 direction) ++ u8 *in, const u8 *out) + { + struct tpm_tis_spi_phy *phy = to_tpm_tis_spi_phy(data); + int ret = 0; +@@ -71,14 +69,14 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + while (len) { + transfer_len = min_t(u16, len, MAX_SPI_FRAMESIZE); + +- phy->tx_buf[0] = direction | (transfer_len - 1); +- phy->tx_buf[1] = 0xd4; +- phy->tx_buf[2] = addr >> 8; +- phy->tx_buf[3] = addr; ++ phy->iobuf[0] = (in ? 0x80 : 0) | (transfer_len - 1); ++ phy->iobuf[1] = 0xd4; ++ phy->iobuf[2] = addr >> 8; ++ phy->iobuf[3] = addr; + + memset(&spi_xfer, 0, sizeof(spi_xfer)); +- spi_xfer.tx_buf = phy->tx_buf; +- spi_xfer.rx_buf = phy->rx_buf; ++ spi_xfer.tx_buf = phy->iobuf; ++ spi_xfer.rx_buf = phy->iobuf; + spi_xfer.len = 4; + spi_xfer.cs_change = 1; + +@@ -88,9 +86,9 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + if (ret < 0) + goto exit; + +- if ((phy->rx_buf[3] & 0x01) == 0) { ++ if ((phy->iobuf[3] & 0x01) == 0) { + // handle SPI wait states +- phy->tx_buf[0] = 0; ++ phy->iobuf[0] = 0; + + for (i = 0; i < TPM_RETRY; i++) { + spi_xfer.len = 1; +@@ -99,7 +97,7 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + ret = spi_sync_locked(phy->spi_device, &m); + if (ret < 0) + goto exit; +- if (phy->rx_buf[0] & 0x01) ++ if (phy->iobuf[0] & 0x01) + break; + } + +@@ -113,12 +111,12 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + spi_xfer.len = transfer_len; + spi_xfer.delay_usecs = 5; + +- if (direction) { ++ if (in) { + spi_xfer.tx_buf = NULL; +- spi_xfer.rx_buf = buffer; +- } else { +- spi_xfer.tx_buf = buffer; ++ } else if (out) { + spi_xfer.rx_buf = NULL; ++ memcpy(phy->iobuf, out, transfer_len); ++ out += transfer_len; + } + + spi_message_init(&m); +@@ -127,8 +125,12 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + if (ret < 0) + goto exit; + ++ if (in) { ++ memcpy(in, phy->iobuf, transfer_len); ++ in += transfer_len; ++ } ++ + len -= transfer_len; +- buffer += transfer_len; + } + + exit: +@@ -139,13 +141,13 @@ static int tpm_tis_spi_transfer(struct tpm_tis_data *data, u32 addr, u16 len, + static int tpm_tis_spi_read_bytes(struct tpm_tis_data *data, u32 addr, + u16 len, u8 *result) + { +- return tpm_tis_spi_transfer(data, addr, len, result, 0x80); ++ return tpm_tis_spi_transfer(data, addr, len, result, NULL); + } + + static int tpm_tis_spi_write_bytes(struct tpm_tis_data *data, u32 addr, +- u16 len, u8 *value) ++ u16 len, const u8 *value) + { +- return tpm_tis_spi_transfer(data, addr, len, value, 0); ++ return tpm_tis_spi_transfer(data, addr, len, NULL, value); + } + + static int tpm_tis_spi_read16(struct tpm_tis_data *data, u32 addr, u16 *result) +@@ -194,6 +196,10 @@ static int tpm_tis_spi_probe(struct spi_device *dev) + + phy->spi_device = dev; + ++ phy->iobuf = devm_kmalloc(&dev->dev, MAX_SPI_FRAMESIZE, GFP_KERNEL); ++ if (!phy->iobuf) ++ return -ENOMEM; ++ + return tpm_tis_core_init(&dev->dev, &phy->priv, -1, &tpm_spi_phy_ops, + NULL); + } +diff --git a/drivers/cpufreq/s3c24xx-cpufreq.c b/drivers/cpufreq/s3c24xx-cpufreq.c +index 7b596fa38ad2..6bebc1f9f55a 100644 +--- a/drivers/cpufreq/s3c24xx-cpufreq.c ++++ b/drivers/cpufreq/s3c24xx-cpufreq.c +@@ -351,7 +351,13 @@ struct clk *s3c_cpufreq_clk_get(struct device *dev, const char *name) + static int s3c_cpufreq_init(struct cpufreq_policy *policy) + { + policy->clk = clk_arm; +- return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency); ++ ++ policy->cpuinfo.transition_latency = cpu_cur.info->latency; ++ ++ if (ftab) ++ return cpufreq_table_validate_and_show(policy, ftab); ++ ++ return 0; + } + + static int __init s3c_cpufreq_initclks(void) +diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c +index cd9d6ba03579..0dc0d595c47c 100644 +--- a/drivers/edac/sb_edac.c ++++ b/drivers/edac/sb_edac.c +@@ -279,7 +279,7 @@ static const u32 correrrthrsld[] = { + * sbridge structs + */ + +-#define NUM_CHANNELS 4 /* Max channels per MC */ ++#define NUM_CHANNELS 6 /* Max channels per MC */ + #define MAX_DIMMS 3 /* Max DIMMS per channel */ + #define KNL_MAX_CHAS 38 /* KNL max num. of Cache Home Agents */ + #define KNL_MAX_CHANNELS 6 /* KNL max num. of PCI channels */ +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 6bf093cef958..e058c209bbcf 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -8522,6 +8522,10 @@ static int remove_and_add_spares(struct mddev *mddev, + int removed = 0; + bool remove_some = false; + ++ if (this && test_bit(MD_RECOVERY_RUNNING, &mddev->recovery)) ++ /* Mustn't remove devices when resync thread is running */ ++ return 0; ++ + rdev_for_each(rdev, mddev) { + if ((this == NULL || rdev == this) && + rdev->raid_disk >= 0 && +diff --git a/drivers/media/dvb-frontends/m88ds3103.c b/drivers/media/dvb-frontends/m88ds3103.c +index 50bce68ffd66..65d157fe76d1 100644 +--- a/drivers/media/dvb-frontends/m88ds3103.c ++++ b/drivers/media/dvb-frontends/m88ds3103.c +@@ -1262,11 +1262,12 @@ static int m88ds3103_select(struct i2c_mux_core *muxc, u32 chan) + * New users must use I2C client binding directly! + */ + struct dvb_frontend *m88ds3103_attach(const struct m88ds3103_config *cfg, +- struct i2c_adapter *i2c, struct i2c_adapter **tuner_i2c_adapter) ++ struct i2c_adapter *i2c, ++ struct i2c_adapter **tuner_i2c_adapter) + { + struct i2c_client *client; + struct i2c_board_info board_info; +- struct m88ds3103_platform_data pdata; ++ struct m88ds3103_platform_data pdata = {}; + + pdata.clk = cfg->clock; + pdata.i2c_wr_max = cfg->i2c_wr_max; +@@ -1409,6 +1410,8 @@ static int m88ds3103_probe(struct i2c_client *client, + case M88DS3103_CHIP_ID: + break; + default: ++ ret = -ENODEV; ++ dev_err(&client->dev, "Unknown device. Chip_id=%02x\n", dev->chip_id); + goto err_kfree; + } + +diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c +index 35026795be28..fa41d9422d57 100644 +--- a/drivers/mmc/host/dw_mmc-exynos.c ++++ b/drivers/mmc/host/dw_mmc-exynos.c +@@ -487,6 +487,7 @@ static unsigned long exynos_dwmmc_caps[4] = { + + static const struct dw_mci_drv_data exynos_drv_data = { + .caps = exynos_dwmmc_caps, ++ .num_caps = ARRAY_SIZE(exynos_dwmmc_caps), + .init = dw_mci_exynos_priv_init, + .set_ios = dw_mci_exynos_set_ios, + .parse_dt = dw_mci_exynos_parse_dt, +diff --git a/drivers/mmc/host/dw_mmc-k3.c b/drivers/mmc/host/dw_mmc-k3.c +index 64cda84b2302..864e7fcaffaf 100644 +--- a/drivers/mmc/host/dw_mmc-k3.c ++++ b/drivers/mmc/host/dw_mmc-k3.c +@@ -135,6 +135,9 @@ static int dw_mci_hi6220_parse_dt(struct dw_mci *host) + if (priv->ctrl_id < 0) + priv->ctrl_id = 0; + ++ if (priv->ctrl_id >= TIMING_MODE) ++ return -EINVAL; ++ + host->priv = priv; + return 0; + } +@@ -207,6 +210,7 @@ static int dw_mci_hi6220_execute_tuning(struct dw_mci_slot *slot, u32 opcode) + + static const struct dw_mci_drv_data hi6220_data = { + .caps = dw_mci_hi6220_caps, ++ .num_caps = ARRAY_SIZE(dw_mci_hi6220_caps), + .switch_voltage = dw_mci_hi6220_switch_voltage, + .set_ios = dw_mci_hi6220_set_ios, + .parse_dt = dw_mci_hi6220_parse_dt, +diff --git a/drivers/mmc/host/dw_mmc-rockchip.c b/drivers/mmc/host/dw_mmc-rockchip.c +index a3f1c2b30145..339295212935 100644 +--- a/drivers/mmc/host/dw_mmc-rockchip.c ++++ b/drivers/mmc/host/dw_mmc-rockchip.c +@@ -319,6 +319,7 @@ static const struct dw_mci_drv_data rk2928_drv_data = { + + static const struct dw_mci_drv_data rk3288_drv_data = { + .caps = dw_mci_rk3288_dwmmc_caps, ++ .num_caps = ARRAY_SIZE(dw_mci_rk3288_dwmmc_caps), + .set_ios = dw_mci_rk3288_set_ios, + .execute_tuning = dw_mci_rk3288_execute_tuning, + .parse_dt = dw_mci_rk3288_parse_dt, +diff --git a/drivers/mmc/host/dw_mmc-zx.c b/drivers/mmc/host/dw_mmc-zx.c +index d38e94ae2b85..c06b5393312f 100644 +--- a/drivers/mmc/host/dw_mmc-zx.c ++++ b/drivers/mmc/host/dw_mmc-zx.c +@@ -195,6 +195,7 @@ static unsigned long zx_dwmmc_caps[3] = { + + static const struct dw_mci_drv_data zx_drv_data = { + .caps = zx_dwmmc_caps, ++ .num_caps = ARRAY_SIZE(zx_dwmmc_caps), + .execute_tuning = dw_mci_zx_execute_tuning, + .prepare_hs400_tuning = dw_mci_zx_prepare_hs400_tuning, + .parse_dt = dw_mci_zx_parse_dt, +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 4f2806720c5c..60341a814055 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -165,6 +165,8 @@ static int dw_mci_regs_show(struct seq_file *s, void *v) + { + struct dw_mci *host = s->private; + ++ pm_runtime_get_sync(host->dev); ++ + seq_printf(s, "STATUS:\t0x%08x\n", mci_readl(host, STATUS)); + seq_printf(s, "RINTSTS:\t0x%08x\n", mci_readl(host, RINTSTS)); + seq_printf(s, "CMD:\t0x%08x\n", mci_readl(host, CMD)); +@@ -172,6 +174,8 @@ static int dw_mci_regs_show(struct seq_file *s, void *v) + seq_printf(s, "INTMASK:\t0x%08x\n", mci_readl(host, INTMASK)); + seq_printf(s, "CLKENA:\t0x%08x\n", mci_readl(host, CLKENA)); + ++ pm_runtime_put_autosuspend(host->dev); ++ + return 0; + } + +@@ -2758,12 +2762,57 @@ static irqreturn_t dw_mci_interrupt(int irq, void *dev_id) + return IRQ_HANDLED; + } + ++static int dw_mci_init_slot_caps(struct dw_mci_slot *slot) ++{ ++ struct dw_mci *host = slot->host; ++ const struct dw_mci_drv_data *drv_data = host->drv_data; ++ struct mmc_host *mmc = slot->mmc; ++ int ctrl_id; ++ ++ if (host->pdata->caps) ++ mmc->caps = host->pdata->caps; ++ ++ /* ++ * Support MMC_CAP_ERASE by default. ++ * It needs to use trim/discard/erase commands. ++ */ ++ mmc->caps |= MMC_CAP_ERASE; ++ ++ if (host->pdata->pm_caps) ++ mmc->pm_caps = host->pdata->pm_caps; ++ ++ if (host->dev->of_node) { ++ ctrl_id = of_alias_get_id(host->dev->of_node, "mshc"); ++ if (ctrl_id < 0) ++ ctrl_id = 0; ++ } else { ++ ctrl_id = to_platform_device(host->dev)->id; ++ } ++ ++ if (drv_data && drv_data->caps) { ++ if (ctrl_id >= drv_data->num_caps) { ++ dev_err(host->dev, "invalid controller id %d\n", ++ ctrl_id); ++ return -EINVAL; ++ } ++ mmc->caps |= drv_data->caps[ctrl_id]; ++ } ++ ++ if (host->pdata->caps2) ++ mmc->caps2 = host->pdata->caps2; ++ ++ /* Process SDIO IRQs through the sdio_irq_work. */ ++ if (mmc->caps & MMC_CAP_SDIO_IRQ) ++ mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD; ++ ++ return 0; ++} ++ + static int dw_mci_init_slot(struct dw_mci *host) + { + struct mmc_host *mmc; + struct dw_mci_slot *slot; +- const struct dw_mci_drv_data *drv_data = host->drv_data; +- int ctrl_id, ret; ++ int ret; + u32 freq[2]; + + mmc = mmc_alloc_host(sizeof(struct dw_mci_slot), host->dev); +@@ -2797,38 +2846,13 @@ static int dw_mci_init_slot(struct dw_mci *host) + if (!mmc->ocr_avail) + mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34; + +- if (host->pdata->caps) +- mmc->caps = host->pdata->caps; +- +- /* +- * Support MMC_CAP_ERASE by default. +- * It needs to use trim/discard/erase commands. +- */ +- mmc->caps |= MMC_CAP_ERASE; +- +- if (host->pdata->pm_caps) +- mmc->pm_caps = host->pdata->pm_caps; +- +- if (host->dev->of_node) { +- ctrl_id = of_alias_get_id(host->dev->of_node, "mshc"); +- if (ctrl_id < 0) +- ctrl_id = 0; +- } else { +- ctrl_id = to_platform_device(host->dev)->id; +- } +- if (drv_data && drv_data->caps) +- mmc->caps |= drv_data->caps[ctrl_id]; +- +- if (host->pdata->caps2) +- mmc->caps2 = host->pdata->caps2; +- + ret = mmc_of_parse(mmc); + if (ret) + goto err_host_allocated; + +- /* Process SDIO IRQs through the sdio_irq_work. */ +- if (mmc->caps & MMC_CAP_SDIO_IRQ) +- mmc->caps2 |= MMC_CAP2_SDIO_IRQ_NOTHREAD; ++ ret = dw_mci_init_slot_caps(slot); ++ if (ret) ++ goto err_host_allocated; + + /* Useful defaults if platform data is unset. */ + if (host->use_dma == TRANS_MODE_IDMAC) { +diff --git a/drivers/mmc/host/dw_mmc.h b/drivers/mmc/host/dw_mmc.h +index 34474ad731aa..044c87ce6725 100644 +--- a/drivers/mmc/host/dw_mmc.h ++++ b/drivers/mmc/host/dw_mmc.h +@@ -542,6 +542,7 @@ struct dw_mci_slot { + /** + * dw_mci driver data - dw-mshc implementation specific driver data. + * @caps: mmc subsystem specified capabilities of the controller(s). ++ * @num_caps: number of capabilities specified by @caps. + * @init: early implementation specific initialization. + * @set_ios: handle bus specific extensions. + * @parse_dt: parse implementation specific device tree properties. +@@ -553,6 +554,7 @@ struct dw_mci_slot { + */ + struct dw_mci_drv_data { + unsigned long *caps; ++ u32 num_caps; + int (*init)(struct dw_mci *host); + void (*set_ios)(struct dw_mci *host, struct mmc_ios *ios); + int (*parse_dt)(struct dw_mci *host); +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 67d787fa3306..070f5da06fd2 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -594,9 +594,36 @@ static void byt_read_dsm(struct sdhci_pci_slot *slot) + slot->chip->rpm_retune = intel_host->d3_retune; + } + +-static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) ++static int intel_execute_tuning(struct mmc_host *mmc, u32 opcode) ++{ ++ int err = sdhci_execute_tuning(mmc, opcode); ++ struct sdhci_host *host = mmc_priv(mmc); ++ ++ if (err) ++ return err; ++ ++ /* ++ * Tuning can leave the IP in an active state (Buffer Read Enable bit ++ * set) which prevents the entry to low power states (i.e. S0i3). Data ++ * reset will clear it. ++ */ ++ sdhci_reset(host, SDHCI_RESET_DATA); ++ ++ return 0; ++} ++ ++static void byt_probe_slot(struct sdhci_pci_slot *slot) + { ++ struct mmc_host_ops *ops = &slot->host->mmc_host_ops; ++ + byt_read_dsm(slot); ++ ++ ops->execute_tuning = intel_execute_tuning; ++} ++ ++static int byt_emmc_probe_slot(struct sdhci_pci_slot *slot) ++{ ++ byt_probe_slot(slot); + slot->host->mmc->caps |= MMC_CAP_8_BIT_DATA | MMC_CAP_NONREMOVABLE | + MMC_CAP_HW_RESET | MMC_CAP_1_8V_DDR | + MMC_CAP_CMD_DURING_TFR | +@@ -651,7 +678,7 @@ static int ni_byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + { + int err; + +- byt_read_dsm(slot); ++ byt_probe_slot(slot); + + err = ni_set_max_freq(slot); + if (err) +@@ -664,7 +691,7 @@ static int ni_byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + + static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + { +- byt_read_dsm(slot); ++ byt_probe_slot(slot); + slot->host->mmc->caps |= MMC_CAP_POWER_OFF_CARD | MMC_CAP_NONREMOVABLE | + MMC_CAP_WAIT_WHILE_BUSY; + return 0; +@@ -672,7 +699,7 @@ static int byt_sdio_probe_slot(struct sdhci_pci_slot *slot) + + static int byt_sd_probe_slot(struct sdhci_pci_slot *slot) + { +- byt_read_dsm(slot); ++ byt_probe_slot(slot); + slot->host->mmc->caps |= MMC_CAP_WAIT_WHILE_BUSY | + MMC_CAP_AGGRESSIVE_PM | MMC_CAP_CD_WAKE; + slot->cd_idx = 0; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 608693d11bd7..75c4455e2271 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -595,7 +595,7 @@ static void xgbe_isr_task(unsigned long data) + + reissue_mask = 1 << 0; + if (!pdata->per_channel_irq) +- reissue_mask |= 0xffff < 4; ++ reissue_mask |= 0xffff << 4; + + XP_IOWRITE(pdata, XP_INT_REISSUE_EN, reissue_mask); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +index 3e5833cf1fab..eb23f9ba1a9a 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +@@ -426,6 +426,8 @@ static int xgbe_pci_resume(struct pci_dev *pdev) + struct net_device *netdev = pdata->netdev; + int ret = 0; + ++ XP_IOWRITE(pdata, XP_INT_EN, 0x1fffff); ++ + pdata->lpm_ctrl &= ~MDIO_CTRL1_LPOWER; + XMDIO_WRITE(pdata, MDIO_MMD_PCS, MDIO_CTRL1, pdata->lpm_ctrl); + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 879a9c4cef59..29f600fd6977 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -1877,6 +1877,14 @@ static void ixgbe_dma_sync_frag(struct ixgbe_ring *rx_ring, + ixgbe_rx_pg_size(rx_ring), + DMA_FROM_DEVICE, + IXGBE_RX_DMA_ATTR); ++ } else if (ring_uses_build_skb(rx_ring)) { ++ unsigned long offset = (unsigned long)(skb->data) & ~PAGE_MASK; ++ ++ dma_sync_single_range_for_cpu(rx_ring->dev, ++ IXGBE_CB(skb)->dma, ++ offset, ++ skb_headlen(skb), ++ DMA_FROM_DEVICE); + } else { + struct skb_frag_struct *frag = &skb_shinfo(skb)->frags[0]; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 3cdb932cae76..a863572882b2 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -1918,13 +1918,16 @@ static void mlx5e_build_rq_param(struct mlx5e_priv *priv, + param->wq.linear = 1; + } + +-static void mlx5e_build_drop_rq_param(struct mlx5e_rq_param *param) ++static void mlx5e_build_drop_rq_param(struct mlx5_core_dev *mdev, ++ struct mlx5e_rq_param *param) + { + void *rqc = param->rqc; + void *wq = MLX5_ADDR_OF(rqc, rqc, wq); + + MLX5_SET(wq, wq, wq_type, MLX5_WQ_TYPE_LINKED_LIST); + MLX5_SET(wq, wq, log_wq_stride, ilog2(sizeof(struct mlx5e_rx_wqe))); ++ ++ param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev); + } + + static void mlx5e_build_sq_param_common(struct mlx5e_priv *priv, +@@ -2778,6 +2781,9 @@ static int mlx5e_alloc_drop_cq(struct mlx5_core_dev *mdev, + struct mlx5e_cq *cq, + struct mlx5e_cq_param *param) + { ++ param->wq.buf_numa_node = dev_to_node(&mdev->pdev->dev); ++ param->wq.db_numa_node = dev_to_node(&mdev->pdev->dev); ++ + return mlx5e_alloc_cq_common(mdev, param, cq); + } + +@@ -2789,7 +2795,7 @@ static int mlx5e_open_drop_rq(struct mlx5_core_dev *mdev, + struct mlx5e_cq *cq = &drop_rq->cq; + int err; + +- mlx5e_build_drop_rq_param(&rq_param); ++ mlx5e_build_drop_rq_param(mdev, &rq_param); + + err = mlx5e_alloc_drop_cq(mdev, cq, &cq_param); + if (err) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 91b1b0938931..3476f594c195 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + #include "en.h" + #include "en_tc.h" + #include "eswitch.h" +@@ -546,20 +547,33 @@ bool mlx5e_post_rx_mpwqes(struct mlx5e_rq *rq) + return true; + } + ++static void mlx5e_lro_update_tcp_hdr(struct mlx5_cqe64 *cqe, struct tcphdr *tcp) ++{ ++ u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe); ++ u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) || ++ (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA); ++ ++ tcp->check = 0; ++ tcp->psh = get_cqe_lro_tcppsh(cqe); ++ ++ if (tcp_ack) { ++ tcp->ack = 1; ++ tcp->ack_seq = cqe->lro_ack_seq_num; ++ tcp->window = cqe->lro_tcp_win; ++ } ++} ++ + static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, + u32 cqe_bcnt) + { + struct ethhdr *eth = (struct ethhdr *)(skb->data); + struct tcphdr *tcp; + int network_depth = 0; ++ __wsum check; + __be16 proto; + u16 tot_len; + void *ip_p; + +- u8 l4_hdr_type = get_cqe_l4_hdr_type(cqe); +- u8 tcp_ack = (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_NO_DATA) || +- (l4_hdr_type == CQE_L4_HDR_TYPE_TCP_ACK_AND_DATA); +- + skb->mac_len = ETH_HLEN; + proto = __vlan_get_protocol(skb, eth->h_proto, &network_depth); + +@@ -577,23 +591,30 @@ static void mlx5e_lro_update_hdr(struct sk_buff *skb, struct mlx5_cqe64 *cqe, + ipv4->check = 0; + ipv4->check = ip_fast_csum((unsigned char *)ipv4, + ipv4->ihl); ++ ++ mlx5e_lro_update_tcp_hdr(cqe, tcp); ++ check = csum_partial(tcp, tcp->doff * 4, ++ csum_unfold((__force __sum16)cqe->check_sum)); ++ /* Almost done, don't forget the pseudo header */ ++ tcp->check = csum_tcpudp_magic(ipv4->saddr, ipv4->daddr, ++ tot_len - sizeof(struct iphdr), ++ IPPROTO_TCP, check); + } else { ++ u16 payload_len = tot_len - sizeof(struct ipv6hdr); + struct ipv6hdr *ipv6 = ip_p; + + tcp = ip_p + sizeof(struct ipv6hdr); + skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; + + ipv6->hop_limit = cqe->lro_min_ttl; +- ipv6->payload_len = cpu_to_be16(tot_len - +- sizeof(struct ipv6hdr)); +- } +- +- tcp->psh = get_cqe_lro_tcppsh(cqe); +- +- if (tcp_ack) { +- tcp->ack = 1; +- tcp->ack_seq = cqe->lro_ack_seq_num; +- tcp->window = cqe->lro_tcp_win; ++ ipv6->payload_len = cpu_to_be16(payload_len); ++ ++ mlx5e_lro_update_tcp_hdr(cqe, tcp); ++ check = csum_partial(tcp, tcp->doff * 4, ++ csum_unfold((__force __sum16)cqe->check_sum)); ++ /* Almost done, don't forget the pseudo header */ ++ tcp->check = csum_ipv6_magic(&ipv6->saddr, &ipv6->daddr, payload_len, ++ IPPROTO_TCP, check); + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +index 5a4608281f38..707976482c09 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c +@@ -216,7 +216,8 @@ mlx5e_test_loopback_validate(struct sk_buff *skb, + if (iph->protocol != IPPROTO_UDP) + goto out; + +- udph = udp_hdr(skb); ++ /* Don't assume skb_transport_header() was set */ ++ udph = (struct udphdr *)((u8 *)iph + 4 * iph->ihl); + if (udph->dest != htons(9)) + goto out; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index 1d6925d4369a..eea7f931cad3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -155,7 +155,7 @@ static inline u16 mlx5e_calc_min_inline(enum mlx5_inline_modes mode, + default: + hlen = mlx5e_skb_l2_header_offset(skb); + } +- return min_t(u16, hlen, skb->len); ++ return min_t(u16, hlen, skb_headlen(skb)); + } + + static inline void mlx5e_tx_skb_pull_inline(unsigned char **skb_data, +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +index 7bef80676464..516e63244606 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +@@ -729,26 +729,29 @@ static struct mlxsw_sp_fib *mlxsw_sp_vr_fib(const struct mlxsw_sp_vr *vr, + static struct mlxsw_sp_vr *mlxsw_sp_vr_create(struct mlxsw_sp *mlxsw_sp, + u32 tb_id) + { ++ struct mlxsw_sp_fib *fib4; ++ struct mlxsw_sp_fib *fib6; + struct mlxsw_sp_vr *vr; + int err; + + vr = mlxsw_sp_vr_find_unused(mlxsw_sp); + if (!vr) + return ERR_PTR(-EBUSY); +- vr->fib4 = mlxsw_sp_fib_create(vr, MLXSW_SP_L3_PROTO_IPV4); +- if (IS_ERR(vr->fib4)) +- return ERR_CAST(vr->fib4); +- vr->fib6 = mlxsw_sp_fib_create(vr, MLXSW_SP_L3_PROTO_IPV6); +- if (IS_ERR(vr->fib6)) { +- err = PTR_ERR(vr->fib6); ++ fib4 = mlxsw_sp_fib_create(vr, MLXSW_SP_L3_PROTO_IPV4); ++ if (IS_ERR(fib4)) ++ return ERR_CAST(fib4); ++ fib6 = mlxsw_sp_fib_create(vr, MLXSW_SP_L3_PROTO_IPV6); ++ if (IS_ERR(fib6)) { ++ err = PTR_ERR(fib6); + goto err_fib6_create; + } ++ vr->fib4 = fib4; ++ vr->fib6 = fib6; + vr->tb_id = tb_id; + return vr; + + err_fib6_create: +- mlxsw_sp_fib_destroy(vr->fib4); +- vr->fib4 = NULL; ++ mlxsw_sp_fib_destroy(fib4); + return ERR_PTR(err); + } + +@@ -3029,6 +3032,9 @@ mlxsw_sp_fib4_entry_offload_unset(struct mlxsw_sp_fib_entry *fib_entry) + struct mlxsw_sp_nexthop_group *nh_grp = fib_entry->nh_group; + int i; + ++ if (!list_is_singular(&nh_grp->fib_list)) ++ return; ++ + for (i = 0; i < nh_grp->count; i++) { + struct mlxsw_sp_nexthop *nh = &nh_grp->nexthops[i]; + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index f5863e5bec81..42a6afcaae03 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -1098,6 +1098,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + bool dynamic) + { + char *sfd_pl; ++ u8 num_rec; + int err; + + sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); +@@ -1107,9 +1108,16 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); + mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), + mac, fid, action, local_port); ++ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); +- kfree(sfd_pl); ++ if (err) ++ goto out; ++ ++ if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) ++ err = -EBUSY; + ++out: ++ kfree(sfd_pl); + return err; + } + +@@ -1134,6 +1142,7 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, + bool adding, bool dynamic) + { + char *sfd_pl; ++ u8 num_rec; + int err; + + sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); +@@ -1144,9 +1153,16 @@ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, + mlxsw_reg_sfd_uc_lag_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), + mac, fid, MLXSW_REG_SFD_REC_ACTION_NOP, + lag_vid, lag_id); ++ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); +- kfree(sfd_pl); ++ if (err) ++ goto out; ++ ++ if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) ++ err = -EBUSY; + ++out: ++ kfree(sfd_pl); + return err; + } + +@@ -1191,6 +1207,7 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr, + u16 fid, u16 mid, bool adding) + { + char *sfd_pl; ++ u8 num_rec; + int err; + + sfd_pl = kmalloc(MLXSW_REG_SFD_LEN, GFP_KERNEL); +@@ -1200,7 +1217,15 @@ static int mlxsw_sp_port_mdb_op(struct mlxsw_sp *mlxsw_sp, const char *addr, + mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); + mlxsw_reg_sfd_mc_pack(sfd_pl, 0, addr, fid, + MLXSW_REG_SFD_REC_ACTION_NOP, mid); ++ num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); ++ if (err) ++ goto out; ++ ++ if (num_rec != mlxsw_reg_sfd_num_rec_get(sfd_pl)) ++ err = -EBUSY; ++ ++out: + kfree(sfd_pl); + return err; + } +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index db8a4bcfc6c7..14b646b3b084 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1618,6 +1618,7 @@ static netdev_tx_t cpsw_ndo_start_xmit(struct sk_buff *skb, + q_idx = q_idx % cpsw->tx_ch_num; + + txch = cpsw->txv[q_idx].ch; ++ txq = netdev_get_tx_queue(ndev, q_idx); + ret = cpsw_tx_packet_submit(priv, skb, txch); + if (unlikely(ret != 0)) { + cpsw_err(priv, tx_err, "desc submit failed\n"); +@@ -1628,15 +1629,26 @@ static netdev_tx_t cpsw_ndo_start_xmit(struct sk_buff *skb, + * tell the kernel to stop sending us tx frames. + */ + if (unlikely(!cpdma_check_free_tx_desc(txch))) { +- txq = netdev_get_tx_queue(ndev, q_idx); + netif_tx_stop_queue(txq); ++ ++ /* Barrier, so that stop_queue visible to other cpus */ ++ smp_mb__after_atomic(); ++ ++ if (cpdma_check_free_tx_desc(txch)) ++ netif_tx_wake_queue(txq); + } + + return NETDEV_TX_OK; + fail: + ndev->stats.tx_dropped++; +- txq = netdev_get_tx_queue(ndev, skb_get_queue_mapping(skb)); + netif_tx_stop_queue(txq); ++ ++ /* Barrier, so that stop_queue visible to other cpus */ ++ smp_mb__after_atomic(); ++ ++ if (cpdma_check_free_tx_desc(txch)) ++ netif_tx_wake_queue(txq); ++ + return NETDEV_TX_BUSY; + } + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 2b1e67bc1e73..3d860de5e342 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -842,7 +842,7 @@ void phy_start(struct phy_device *phydev) + break; + case PHY_HALTED: + /* make sure interrupts are re-enabled for the PHY */ +- if (phydev->irq != PHY_POLL) { ++ if (phy_interrupt_is_valid(phydev)) { + err = phy_enable_interrupts(phydev); + if (err < 0) + break; +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 8c6b8918ec31..38cd2e8fae23 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -3158,6 +3158,15 @@ ppp_connect_channel(struct channel *pch, int unit) + goto outl; + + ppp_lock(ppp); ++ spin_lock_bh(&pch->downl); ++ if (!pch->chan) { ++ /* Don't connect unregistered channels */ ++ spin_unlock_bh(&pch->downl); ++ ppp_unlock(ppp); ++ ret = -ENOTCONN; ++ goto outl; ++ } ++ spin_unlock_bh(&pch->downl); + if (pch->file.hdrlen > ppp->file.hdrlen) + ppp->file.hdrlen = pch->file.hdrlen; + hdrlen = pch->file.hdrlen + 2; /* for protocol bytes */ +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index fa51b7b0e9ea..bc38d54e37b9 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1315,6 +1315,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + else + *skb_xdp = 0; + ++ preempt_disable(); + rcu_read_lock(); + xdp_prog = rcu_dereference(tun->xdp_prog); + if (xdp_prog && !*skb_xdp) { +@@ -1333,9 +1334,11 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + get_page(alloc_frag->page); + alloc_frag->offset += buflen; + err = xdp_do_redirect(tun->dev, &xdp, xdp_prog); ++ xdp_do_flush_map(); + if (err) + goto err_redirect; + rcu_read_unlock(); ++ preempt_enable(); + return NULL; + case XDP_TX: + xdp_xmit = true; +@@ -1357,6 +1360,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + skb = build_skb(buf, buflen); + if (!skb) { + rcu_read_unlock(); ++ preempt_enable(); + return ERR_PTR(-ENOMEM); + } + +@@ -1369,10 +1373,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + skb->dev = tun->dev; + generic_xdp_tx(skb, xdp_prog); + rcu_read_unlock(); ++ preempt_enable(); + return NULL; + } + + rcu_read_unlock(); ++ preempt_enable(); + + return skb; + +@@ -1380,6 +1386,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + put_page(alloc_frag->page); + err_xdp: + rcu_read_unlock(); ++ preempt_enable(); + this_cpu_inc(tun->pcpu_stats->rx_dropped); + return NULL; + } +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 7927e28f5336..6a785595b9b8 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1995,8 +1995,9 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + } + + /* Make sure NAPI is not using any XDP TX queues for RX. */ +- for (i = 0; i < vi->max_queue_pairs; i++) +- napi_disable(&vi->rq[i].napi); ++ if (netif_running(dev)) ++ for (i = 0; i < vi->max_queue_pairs; i++) ++ napi_disable(&vi->rq[i].napi); + + netif_set_real_num_rx_queues(dev, curr_qp + xdp_qp); + err = _virtnet_set_queues(vi, curr_qp + xdp_qp); +@@ -2015,7 +2016,8 @@ static int virtnet_xdp_set(struct net_device *dev, struct bpf_prog *prog, + } + if (old_prog) + bpf_prog_put(old_prog); +- virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi); ++ if (netif_running(dev)) ++ virtnet_napi_enable(vi->rq[i].vq, &vi->rq[i].napi); + } + + return 0; +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index 0d2e00ece804..f3c1d5245978 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -574,7 +574,10 @@ static void ppp_timer(unsigned long arg) + ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, + 0, NULL); + proto->restart_counter--; +- } else ++ } else if (netif_carrier_ok(proto->dev)) ++ ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0, ++ 0, NULL); ++ else + ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0, + 0, NULL); + break; +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 33d4431c2b4b..93a082e0bdd4 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -88,7 +88,6 @@ enum nvme_rdma_queue_flags { + + struct nvme_rdma_queue { + struct nvme_rdma_qe *rsp_ring; +- atomic_t sig_count; + int queue_size; + size_t cmnd_capsule_len; + struct nvme_rdma_ctrl *ctrl; +@@ -521,7 +520,6 @@ static int nvme_rdma_alloc_queue(struct nvme_rdma_ctrl *ctrl, + queue->cmnd_capsule_len = sizeof(struct nvme_command); + + queue->queue_size = queue_size; +- atomic_set(&queue->sig_count, 0); + + queue->cm_id = rdma_create_id(&init_net, nvme_rdma_cm_handler, queue, + RDMA_PS_TCP, IB_QPT_RC); +@@ -1232,21 +1230,9 @@ static void nvme_rdma_send_done(struct ib_cq *cq, struct ib_wc *wc) + nvme_end_request(rq, req->status, req->result); + } + +-/* +- * We want to signal completion at least every queue depth/2. This returns the +- * largest power of two that is not above half of (queue size + 1) to optimize +- * (avoid divisions). +- */ +-static inline bool nvme_rdma_queue_sig_limit(struct nvme_rdma_queue *queue) +-{ +- int limit = 1 << ilog2((queue->queue_size + 1) / 2); +- +- return (atomic_inc_return(&queue->sig_count) & (limit - 1)) == 0; +-} +- + static int nvme_rdma_post_send(struct nvme_rdma_queue *queue, + struct nvme_rdma_qe *qe, struct ib_sge *sge, u32 num_sge, +- struct ib_send_wr *first, bool flush) ++ struct ib_send_wr *first) + { + struct ib_send_wr wr, *bad_wr; + int ret; +@@ -1255,31 +1241,12 @@ static int nvme_rdma_post_send(struct nvme_rdma_queue *queue, + sge->length = sizeof(struct nvme_command), + sge->lkey = queue->device->pd->local_dma_lkey; + +- qe->cqe.done = nvme_rdma_send_done; +- + wr.next = NULL; + wr.wr_cqe = &qe->cqe; + wr.sg_list = sge; + wr.num_sge = num_sge; + wr.opcode = IB_WR_SEND; +- wr.send_flags = 0; +- +- /* +- * Unsignalled send completions are another giant desaster in the +- * IB Verbs spec: If we don't regularly post signalled sends +- * the send queue will fill up and only a QP reset will rescue us. +- * Would have been way to obvious to handle this in hardware or +- * at least the RDMA stack.. +- * +- * Always signal the flushes. The magic request used for the flush +- * sequencer is not allocated in our driver's tagset and it's +- * triggered to be freed by blk_cleanup_queue(). So we need to +- * always mark it as signaled to ensure that the "wr_cqe", which is +- * embedded in request's payload, is not freed when __ib_process_cq() +- * calls wr_cqe->done(). +- */ +- if (nvme_rdma_queue_sig_limit(queue) || flush) +- wr.send_flags |= IB_SEND_SIGNALED; ++ wr.send_flags = IB_SEND_SIGNALED; + + if (first) + first->next = ≀ +@@ -1329,6 +1296,12 @@ static struct blk_mq_tags *nvme_rdma_tagset(struct nvme_rdma_queue *queue) + return queue->ctrl->tag_set.tags[queue_idx - 1]; + } + ++static void nvme_rdma_async_done(struct ib_cq *cq, struct ib_wc *wc) ++{ ++ if (unlikely(wc->status != IB_WC_SUCCESS)) ++ nvme_rdma_wr_error(cq, wc, "ASYNC"); ++} ++ + static void nvme_rdma_submit_async_event(struct nvme_ctrl *arg, int aer_idx) + { + struct nvme_rdma_ctrl *ctrl = to_rdma_ctrl(arg); +@@ -1350,10 +1323,12 @@ static void nvme_rdma_submit_async_event(struct nvme_ctrl *arg, int aer_idx) + cmd->common.flags |= NVME_CMD_SGL_METABUF; + nvme_rdma_set_sg_null(cmd); + ++ sqe->cqe.done = nvme_rdma_async_done; ++ + ib_dma_sync_single_for_device(dev, sqe->dma, sizeof(*cmd), + DMA_TO_DEVICE); + +- ret = nvme_rdma_post_send(queue, sqe, &sge, 1, NULL, false); ++ ret = nvme_rdma_post_send(queue, sqe, &sge, 1, NULL); + WARN_ON_ONCE(ret); + } + +@@ -1639,7 +1614,6 @@ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx, + struct nvme_rdma_request *req = blk_mq_rq_to_pdu(rq); + struct nvme_rdma_qe *sqe = &req->sqe; + struct nvme_command *c = sqe->data; +- bool flush = false; + struct ib_device *dev; + blk_status_t ret; + int err; +@@ -1668,13 +1642,13 @@ static blk_status_t nvme_rdma_queue_rq(struct blk_mq_hw_ctx *hctx, + goto err; + } + ++ sqe->cqe.done = nvme_rdma_send_done; ++ + ib_dma_sync_single_for_device(dev, sqe->dma, + sizeof(struct nvme_command), DMA_TO_DEVICE); + +- if (req_op(rq) == REQ_OP_FLUSH) +- flush = true; + err = nvme_rdma_post_send(queue, sqe, req->sge, req->num_sge, +- req->mr->need_inval ? &req->reg_wr.wr : NULL, flush); ++ req->mr->need_inval ? &req->reg_wr.wr : NULL); + if (unlikely(err)) { + nvme_rdma_unmap_data(queue, rq); + goto err; +diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c +index cae54f8320be..633e55c57b13 100644 +--- a/drivers/pci/pcie/aspm.c ++++ b/drivers/pci/pcie/aspm.c +@@ -803,10 +803,14 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev) + + /* + * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe +- * hierarchies. ++ * hierarchies. Note that some PCIe host implementations omit ++ * the root ports entirely, in which case a downstream port on ++ * a switch may become the root of the link state chain for all ++ * its subordinate endpoints. + */ + if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT || +- pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) { ++ pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE || ++ !pdev->bus->parent->self) { + link->root = link; + } else { + struct pcie_link_state *parent; +diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h +index 92dd4aef21a3..6b1e83539a9d 100644 +--- a/drivers/s390/net/qeth_core.h ++++ b/drivers/s390/net/qeth_core.h +@@ -580,6 +580,11 @@ struct qeth_cmd_buffer { + void (*callback) (struct qeth_channel *, struct qeth_cmd_buffer *); + }; + ++static inline struct qeth_ipa_cmd *__ipa_cmd(struct qeth_cmd_buffer *iob) ++{ ++ return (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE); ++} ++ + /** + * definition of a qeth channel, used for read and write + */ +@@ -834,7 +839,7 @@ struct qeth_trap_id { + */ + static inline int qeth_get_elements_for_range(addr_t start, addr_t end) + { +- return PFN_UP(end - 1) - PFN_DOWN(start); ++ return PFN_UP(end) - PFN_DOWN(start); + } + + static inline int qeth_get_micros(void) +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 7c7a244b6684..145b57762d8f 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -2073,7 +2073,7 @@ int qeth_send_control_data(struct qeth_card *card, int len, + unsigned long flags; + struct qeth_reply *reply = NULL; + unsigned long timeout, event_timeout; +- struct qeth_ipa_cmd *cmd; ++ struct qeth_ipa_cmd *cmd = NULL; + + QETH_CARD_TEXT(card, 2, "sendctl"); + +@@ -2087,23 +2087,27 @@ int qeth_send_control_data(struct qeth_card *card, int len, + } + reply->callback = reply_cb; + reply->param = reply_param; +- if (card->state == CARD_STATE_DOWN) +- reply->seqno = QETH_IDX_COMMAND_SEQNO; +- else +- reply->seqno = card->seqno.ipa++; ++ + init_waitqueue_head(&reply->wait_q); +- spin_lock_irqsave(&card->lock, flags); +- list_add_tail(&reply->list, &card->cmd_waiter_list); +- spin_unlock_irqrestore(&card->lock, flags); + QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN); + + while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ; +- qeth_prepare_control_data(card, len, iob); + +- if (IS_IPA(iob->data)) ++ if (IS_IPA(iob->data)) { ++ cmd = __ipa_cmd(iob); ++ cmd->hdr.seqno = card->seqno.ipa++; ++ reply->seqno = cmd->hdr.seqno; + event_timeout = QETH_IPA_TIMEOUT; +- else ++ } else { ++ reply->seqno = QETH_IDX_COMMAND_SEQNO; + event_timeout = QETH_TIMEOUT; ++ } ++ qeth_prepare_control_data(card, len, iob); ++ ++ spin_lock_irqsave(&card->lock, flags); ++ list_add_tail(&reply->list, &card->cmd_waiter_list); ++ spin_unlock_irqrestore(&card->lock, flags); ++ + timeout = jiffies + event_timeout; + + QETH_CARD_TEXT(card, 6, "noirqpnd"); +@@ -2128,9 +2132,8 @@ int qeth_send_control_data(struct qeth_card *card, int len, + + /* we have only one long running ipassist, since we can ensure + process context of this command we can sleep */ +- cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE); +- if ((cmd->hdr.command == IPA_CMD_SETIP) && +- (cmd->hdr.prot_version == QETH_PROT_IPV4)) { ++ if (cmd && cmd->hdr.command == IPA_CMD_SETIP && ++ cmd->hdr.prot_version == QETH_PROT_IPV4) { + if (!wait_event_timeout(reply->wait_q, + atomic_read(&reply->received), event_timeout)) + goto time_err; +@@ -2894,7 +2897,7 @@ static void qeth_fill_ipacmd_header(struct qeth_card *card, + memset(cmd, 0, sizeof(struct qeth_ipa_cmd)); + cmd->hdr.command = command; + cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST; +- cmd->hdr.seqno = card->seqno.ipa; ++ /* cmd->hdr.seqno is set by qeth_send_control_data() */ + cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type); + cmd->hdr.rel_adapter_no = (__u8) card->info.portno; + if (card->options.layer2) +@@ -3859,10 +3862,12 @@ EXPORT_SYMBOL_GPL(qeth_get_elements_for_frags); + int qeth_get_elements_no(struct qeth_card *card, + struct sk_buff *skb, int extra_elems, int data_offset) + { +- int elements = qeth_get_elements_for_range( +- (addr_t)skb->data + data_offset, +- (addr_t)skb->data + skb_headlen(skb)) + +- qeth_get_elements_for_frags(skb); ++ addr_t end = (addr_t)skb->data + skb_headlen(skb); ++ int elements = qeth_get_elements_for_frags(skb); ++ addr_t start = (addr_t)skb->data + data_offset; ++ ++ if (start != end) ++ elements += qeth_get_elements_for_range(start, end); + + if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) { + QETH_DBF_MESSAGE(2, "Invalid size of IP packet " +diff --git a/drivers/s390/net/qeth_l3.h b/drivers/s390/net/qeth_l3.h +index e5833837b799..8727b9517de8 100644 +--- a/drivers/s390/net/qeth_l3.h ++++ b/drivers/s390/net/qeth_l3.h +@@ -40,8 +40,40 @@ struct qeth_ipaddr { + unsigned int pfxlen; + } a6; + } u; +- + }; ++ ++static inline bool qeth_l3_addr_match_ip(struct qeth_ipaddr *a1, ++ struct qeth_ipaddr *a2) ++{ ++ if (a1->proto != a2->proto) ++ return false; ++ if (a1->proto == QETH_PROT_IPV6) ++ return ipv6_addr_equal(&a1->u.a6.addr, &a2->u.a6.addr); ++ return a1->u.a4.addr == a2->u.a4.addr; ++} ++ ++static inline bool qeth_l3_addr_match_all(struct qeth_ipaddr *a1, ++ struct qeth_ipaddr *a2) ++{ ++ /* Assumes that the pair was obtained via qeth_l3_addr_find_by_ip(), ++ * so 'proto' and 'addr' match for sure. ++ * ++ * For ucast: ++ * - 'mac' is always 0. ++ * - 'mask'/'pfxlen' for RXIP/VIPA is always 0. For NORMAL, matching ++ * values are required to avoid mixups in takeover eligibility. ++ * ++ * For mcast, ++ * - 'mac' is mapped from the IP, and thus always matches. ++ * - 'mask'/'pfxlen' is always 0. ++ */ ++ if (a1->type != a2->type) ++ return false; ++ if (a1->proto == QETH_PROT_IPV6) ++ return a1->u.a6.pfxlen == a2->u.a6.pfxlen; ++ return a1->u.a4.mask == a2->u.a4.mask; ++} ++ + static inline u64 qeth_l3_ipaddr_hash(struct qeth_ipaddr *addr) + { + u64 ret = 0; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 36dee176f8e2..96576e729222 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -149,6 +149,24 @@ int qeth_l3_string_to_ipaddr(const char *buf, enum qeth_prot_versions proto, + return -EINVAL; + } + ++static struct qeth_ipaddr *qeth_l3_find_addr_by_ip(struct qeth_card *card, ++ struct qeth_ipaddr *query) ++{ ++ u64 key = qeth_l3_ipaddr_hash(query); ++ struct qeth_ipaddr *addr; ++ ++ if (query->is_multicast) { ++ hash_for_each_possible(card->ip_mc_htable, addr, hnode, key) ++ if (qeth_l3_addr_match_ip(addr, query)) ++ return addr; ++ } else { ++ hash_for_each_possible(card->ip_htable, addr, hnode, key) ++ if (qeth_l3_addr_match_ip(addr, query)) ++ return addr; ++ } ++ return NULL; ++} ++ + static void qeth_l3_convert_addr_to_bits(u8 *addr, u8 *bits, int len) + { + int i, j; +@@ -202,34 +220,6 @@ static bool qeth_l3_is_addr_covered_by_ipato(struct qeth_card *card, + return rc; + } + +-inline int +-qeth_l3_ipaddrs_is_equal(struct qeth_ipaddr *addr1, struct qeth_ipaddr *addr2) +-{ +- return addr1->proto == addr2->proto && +- !memcmp(&addr1->u, &addr2->u, sizeof(addr1->u)) && +- !memcmp(&addr1->mac, &addr2->mac, sizeof(addr1->mac)); +-} +- +-static struct qeth_ipaddr * +-qeth_l3_ip_from_hash(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) +-{ +- struct qeth_ipaddr *addr; +- +- if (tmp_addr->is_multicast) { +- hash_for_each_possible(card->ip_mc_htable, addr, +- hnode, qeth_l3_ipaddr_hash(tmp_addr)) +- if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr)) +- return addr; +- } else { +- hash_for_each_possible(card->ip_htable, addr, +- hnode, qeth_l3_ipaddr_hash(tmp_addr)) +- if (qeth_l3_ipaddrs_is_equal(tmp_addr, addr)) +- return addr; +- } +- +- return NULL; +-} +- + int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + { + int rc = 0; +@@ -244,23 +234,18 @@ int qeth_l3_delete_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8); + } + +- addr = qeth_l3_ip_from_hash(card, tmp_addr); +- if (!addr) ++ addr = qeth_l3_find_addr_by_ip(card, tmp_addr); ++ if (!addr || !qeth_l3_addr_match_all(addr, tmp_addr)) + return -ENOENT; + + addr->ref_counter--; +- if (addr->ref_counter > 0 && (addr->type == QETH_IP_TYPE_NORMAL || +- addr->type == QETH_IP_TYPE_RXIP)) ++ if (addr->type == QETH_IP_TYPE_NORMAL && addr->ref_counter > 0) + return rc; + if (addr->in_progress) + return -EINPROGRESS; + +- if (!qeth_card_hw_is_reachable(card)) { +- addr->disp_flag = QETH_DISP_ADDR_DELETE; +- return 0; +- } +- +- rc = qeth_l3_deregister_addr_entry(card, addr); ++ if (qeth_card_hw_is_reachable(card)) ++ rc = qeth_l3_deregister_addr_entry(card, addr); + + hash_del(&addr->hnode); + kfree(addr); +@@ -272,6 +257,7 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + { + int rc = 0; + struct qeth_ipaddr *addr; ++ char buf[40]; + + QETH_CARD_TEXT(card, 4, "addip"); + +@@ -282,8 +268,20 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + QETH_CARD_HEX(card, 4, ((char *)&tmp_addr->u.a6.addr) + 8, 8); + } + +- addr = qeth_l3_ip_from_hash(card, tmp_addr); +- if (!addr) { ++ addr = qeth_l3_find_addr_by_ip(card, tmp_addr); ++ if (addr) { ++ if (tmp_addr->type != QETH_IP_TYPE_NORMAL) ++ return -EADDRINUSE; ++ if (qeth_l3_addr_match_all(addr, tmp_addr)) { ++ addr->ref_counter++; ++ return 0; ++ } ++ qeth_l3_ipaddr_to_string(tmp_addr->proto, (u8 *)&tmp_addr->u, ++ buf); ++ dev_warn(&card->gdev->dev, ++ "Registering IP address %s failed\n", buf); ++ return -EADDRINUSE; ++ } else { + addr = qeth_l3_get_addr_buffer(tmp_addr->proto); + if (!addr) + return -ENOMEM; +@@ -323,19 +321,15 @@ int qeth_l3_add_ip(struct qeth_card *card, struct qeth_ipaddr *tmp_addr) + (rc == IPA_RC_LAN_OFFLINE)) { + addr->disp_flag = QETH_DISP_ADDR_DO_NOTHING; + if (addr->ref_counter < 1) { +- qeth_l3_delete_ip(card, addr); ++ qeth_l3_deregister_addr_entry(card, addr); ++ hash_del(&addr->hnode); + kfree(addr); + } + } else { + hash_del(&addr->hnode); + kfree(addr); + } +- } else { +- if (addr->type == QETH_IP_TYPE_NORMAL || +- addr->type == QETH_IP_TYPE_RXIP) +- addr->ref_counter++; + } +- + return rc; + } + +@@ -403,11 +397,7 @@ static void qeth_l3_recover_ip(struct qeth_card *card) + spin_lock_bh(&card->ip_lock); + + hash_for_each_safe(card->ip_htable, i, tmp, addr, hnode) { +- if (addr->disp_flag == QETH_DISP_ADDR_DELETE) { +- qeth_l3_deregister_addr_entry(card, addr); +- hash_del(&addr->hnode); +- kfree(addr); +- } else if (addr->disp_flag == QETH_DISP_ADDR_ADD) { ++ if (addr->disp_flag == QETH_DISP_ADDR_ADD) { + if (addr->proto == QETH_PROT_IPV4) { + addr->in_progress = 1; + spin_unlock_bh(&card->ip_lock); +@@ -723,12 +713,7 @@ int qeth_l3_add_vipa(struct qeth_card *card, enum qeth_prot_versions proto, + return -ENOMEM; + + spin_lock_bh(&card->ip_lock); +- +- if (qeth_l3_ip_from_hash(card, ipaddr)) +- rc = -EEXIST; +- else +- qeth_l3_add_ip(card, ipaddr); +- ++ rc = qeth_l3_add_ip(card, ipaddr); + spin_unlock_bh(&card->ip_lock); + + kfree(ipaddr); +@@ -791,12 +776,7 @@ int qeth_l3_add_rxip(struct qeth_card *card, enum qeth_prot_versions proto, + return -ENOMEM; + + spin_lock_bh(&card->ip_lock); +- +- if (qeth_l3_ip_from_hash(card, ipaddr)) +- rc = -EEXIST; +- else +- qeth_l3_add_ip(card, ipaddr); +- ++ rc = qeth_l3_add_ip(card, ipaddr); + spin_unlock_bh(&card->ip_lock); + + kfree(ipaddr); +@@ -1404,8 +1384,9 @@ qeth_l3_add_mc_to_hash(struct qeth_card *card, struct in_device *in4_dev) + memcpy(tmp->mac, buf, sizeof(tmp->mac)); + tmp->is_multicast = 1; + +- ipm = qeth_l3_ip_from_hash(card, tmp); ++ ipm = qeth_l3_find_addr_by_ip(card, tmp); + if (ipm) { ++ /* for mcast, by-IP match means full match */ + ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING; + } else { + ipm = qeth_l3_get_addr_buffer(QETH_PROT_IPV4); +@@ -1488,8 +1469,9 @@ qeth_l3_add_mc6_to_hash(struct qeth_card *card, struct inet6_dev *in6_dev) + sizeof(struct in6_addr)); + tmp->is_multicast = 1; + +- ipm = qeth_l3_ip_from_hash(card, tmp); ++ ipm = qeth_l3_find_addr_by_ip(card, tmp); + if (ipm) { ++ /* for mcast, by-IP match means full match */ + ipm->disp_flag = QETH_DISP_ADDR_DO_NOTHING; + continue; + } +@@ -2633,11 +2615,12 @@ static void qeth_tso_fill_header(struct qeth_card *card, + static int qeth_l3_get_elements_no_tso(struct qeth_card *card, + struct sk_buff *skb, int extra_elems) + { +- addr_t tcpdptr = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb); +- int elements = qeth_get_elements_for_range( +- tcpdptr, +- (addr_t)skb->data + skb_headlen(skb)) + +- qeth_get_elements_for_frags(skb); ++ addr_t start = (addr_t)tcp_hdr(skb) + tcp_hdrlen(skb); ++ addr_t end = (addr_t)skb->data + skb_headlen(skb); ++ int elements = qeth_get_elements_for_frags(skb); ++ ++ if (start != end) ++ elements += qeth_get_elements_for_range(start, end); + + if ((elements + extra_elems) > QETH_MAX_BUFFER_ELEMENTS(card)) { + QETH_DBF_MESSAGE(2, +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index 92155cce926d..fb4e6a7ee521 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -338,11 +338,12 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + { + struct page *page[1]; + struct vm_area_struct *vma; ++ struct vm_area_struct *vmas[1]; + int ret; + + if (mm == current->mm) { +- ret = get_user_pages_fast(vaddr, 1, !!(prot & IOMMU_WRITE), +- page); ++ ret = get_user_pages_longterm(vaddr, 1, !!(prot & IOMMU_WRITE), ++ page, vmas); + } else { + unsigned int flags = 0; + +@@ -351,7 +352,18 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + + down_read(&mm->mmap_sem); + ret = get_user_pages_remote(NULL, mm, vaddr, 1, flags, page, +- NULL, NULL); ++ vmas, NULL); ++ /* ++ * The lifetime of a vaddr_get_pfn() page pin is ++ * userspace-controlled. In the fs-dax case this could ++ * lead to indefinite stalls in filesystem operations. ++ * Disallow attempts to pin fs-dax pages via this ++ * interface. ++ */ ++ if (ret > 0 && vma_is_fsdax(vmas[0])) { ++ ret = -EOPNOTSUPP; ++ put_page(page[0]); ++ } + up_read(&mm->mmap_sem); + } + +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index 883881b16c86..4447e0fe9b55 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -422,7 +422,7 @@ static ssize_t btrfs_nodesize_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->super_copy->nodesize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->nodesize); + } + + BTRFS_ATTR(nodesize, btrfs_nodesize_show); +@@ -432,8 +432,7 @@ static ssize_t btrfs_sectorsize_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", +- fs_info->super_copy->sectorsize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize); + } + + BTRFS_ATTR(sectorsize, btrfs_sectorsize_show); +@@ -443,8 +442,7 @@ static ssize_t btrfs_clone_alignment_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", +- fs_info->super_copy->sectorsize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize); + } + + BTRFS_ATTR(clone_alignment, btrfs_clone_alignment_show); +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index f615d59b0489..46bda13e5727 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1722,19 +1722,23 @@ static void update_super_roots(struct btrfs_fs_info *fs_info) + + super = fs_info->super_copy; + ++ /* update latest btrfs_super_block::chunk_root refs */ + root_item = &fs_info->chunk_root->root_item; +- super->chunk_root = root_item->bytenr; +- super->chunk_root_generation = root_item->generation; +- super->chunk_root_level = root_item->level; ++ btrfs_set_super_chunk_root(super, root_item->bytenr); ++ btrfs_set_super_chunk_root_generation(super, root_item->generation); ++ btrfs_set_super_chunk_root_level(super, root_item->level); + ++ /* update latest btrfs_super_block::root refs */ + root_item = &fs_info->tree_root->root_item; +- super->root = root_item->bytenr; +- super->generation = root_item->generation; +- super->root_level = root_item->level; ++ btrfs_set_super_root(super, root_item->bytenr); ++ btrfs_set_super_generation(super, root_item->generation); ++ btrfs_set_super_root_level(super, root_item->level); ++ + if (btrfs_test_opt(fs_info, SPACE_CACHE)) +- super->cache_generation = root_item->generation; ++ btrfs_set_super_cache_generation(super, root_item->generation); + if (test_bit(BTRFS_FS_UPDATE_UUID_TREE_GEN, &fs_info->flags)) +- super->uuid_tree_generation = root_item->generation; ++ btrfs_set_super_uuid_tree_generation(super, ++ root_item->generation); + } + + int btrfs_transaction_in_commit(struct btrfs_fs_info *info) +diff --git a/fs/direct-io.c b/fs/direct-io.c +index b53e66d9abd7..625a84aa6484 100644 +--- a/fs/direct-io.c ++++ b/fs/direct-io.c +@@ -1252,8 +1252,7 @@ do_blockdev_direct_IO(struct kiocb *iocb, struct inode *inode, + */ + if (dio->is_async && iov_iter_rw(iter) == WRITE) { + retval = 0; +- if ((iocb->ki_filp->f_flags & O_DSYNC) || +- IS_SYNC(iocb->ki_filp->f_mapping->host)) ++ if (iocb->ki_flags & IOCB_DSYNC) + retval = dio_set_defer_completion(dio); + else if (!dio->inode->i_sb->s_dio_done_wq) { + /* +diff --git a/include/linux/fs.h b/include/linux/fs.h +index 440281f8564d..d54f41a63dbf 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -3185,7 +3185,7 @@ static inline bool vma_is_fsdax(struct vm_area_struct *vma) + if (!vma_is_dax(vma)) + return false; + inode = file_inode(vma->vm_file); +- if (inode->i_mode == S_IFCHR) ++ if (S_ISCHR(inode->i_mode)) + return false; /* device-dax */ + return true; + } +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index fbc98e2c8228..132e3f5a2e0d 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -72,7 +72,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ + \ +- _i &= _mask; \ +- _i; \ ++ (typeof(_i)) (_i & _mask); \ + }) + #endif /* _LINUX_NOSPEC_H */ +diff --git a/include/net/udplite.h b/include/net/udplite.h +index 81bdbf97319b..9185e45b997f 100644 +--- a/include/net/udplite.h ++++ b/include/net/udplite.h +@@ -64,6 +64,7 @@ static inline int udplite_checksum_init(struct sk_buff *skb, struct udphdr *uh) + UDP_SKB_CB(skb)->cscov = cscov; + if (skb->ip_summed == CHECKSUM_COMPLETE) + skb->ip_summed = CHECKSUM_NONE; ++ skb->csum_valid = 0; + } + + return 0; +diff --git a/kernel/time/timer.c b/kernel/time/timer.c +index db5e6daadd94..9fe525f410bf 100644 +--- a/kernel/time/timer.c ++++ b/kernel/time/timer.c +@@ -1834,6 +1834,12 @@ int timers_dead_cpu(unsigned int cpu) + raw_spin_lock_irq(&new_base->lock); + raw_spin_lock_nested(&old_base->lock, SINGLE_DEPTH_NESTING); + ++ /* ++ * The current CPUs base clock might be stale. Update it ++ * before moving the timers over. ++ */ ++ forward_timer_base(new_base); ++ + BUG_ON(old_base->running_timer); + + for (i = 0; i < WHEEL_SIZE; i++) +diff --git a/net/bridge/br_sysfs_if.c b/net/bridge/br_sysfs_if.c +index 5d5d413a6cf8..a097a8613a02 100644 +--- a/net/bridge/br_sysfs_if.c ++++ b/net/bridge/br_sysfs_if.c +@@ -235,6 +235,9 @@ static ssize_t brport_show(struct kobject *kobj, + struct brport_attribute *brport_attr = to_brport_attr(attr); + struct net_bridge_port *p = to_brport(kobj); + ++ if (!brport_attr->show) ++ return -EINVAL; ++ + return brport_attr->show(p, buf); + } + +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index 233a30040c91..9b8a53568b0f 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -157,6 +157,8 @@ static struct net_bridge_vlan *br_vlan_get_master(struct net_bridge *br, u16 vid + masterv = br_vlan_find(vg, vid); + if (WARN_ON(!masterv)) + return NULL; ++ refcount_set(&masterv->refcnt, 1); ++ return masterv; + } + refcount_inc(&masterv->refcnt); + +diff --git a/net/core/dev.c b/net/core/dev.c +index d33bbed640b1..c75ef9d8105a 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2343,8 +2343,11 @@ EXPORT_SYMBOL(netdev_set_num_tc); + */ + int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) + { ++ bool disabling; + int rc; + ++ disabling = txq < dev->real_num_tx_queues; ++ + if (txq < 1 || txq > dev->num_tx_queues) + return -EINVAL; + +@@ -2360,15 +2363,19 @@ int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq) + if (dev->num_tc) + netif_setup_tc(dev, txq); + +- if (txq < dev->real_num_tx_queues) { ++ dev->real_num_tx_queues = txq; ++ ++ if (disabling) { ++ synchronize_net(); + qdisc_reset_all_tx_gt(dev, txq); + #ifdef CONFIG_XPS + netif_reset_xps_queues_gt(dev, txq); + #endif + } ++ } else { ++ dev->real_num_tx_queues = txq; + } + +- dev->real_num_tx_queues = txq; + return 0; + } + EXPORT_SYMBOL(netif_set_real_num_tx_queues); +diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c +index 00ecec4891f3..7f980bd7426e 100644 +--- a/net/core/gen_estimator.c ++++ b/net/core/gen_estimator.c +@@ -66,6 +66,7 @@ struct net_rate_estimator { + static void est_fetch_counters(struct net_rate_estimator *e, + struct gnet_stats_basic_packed *b) + { ++ memset(b, 0, sizeof(*b)); + if (e->stats_lock) + spin_lock(e->stats_lock); + +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index aff3751df950..1ee6c0d8dde4 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -654,6 +654,11 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi, + fi->fib_nh, cfg, extack)) + return 1; + } ++#ifdef CONFIG_IP_ROUTE_CLASSID ++ if (cfg->fc_flow && ++ cfg->fc_flow != fi->fib_nh->nh_tclassid) ++ return 1; ++#endif + if ((!cfg->fc_oif || cfg->fc_oif == fi->fib_nh->nh_oif) && + (!cfg->fc_gw || cfg->fc_gw == fi->fib_nh->nh_gw)) + return 0; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 0ba88efca7ad..9ff06c5051ae 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -128,10 +128,13 @@ static int ip_rt_redirect_silence __read_mostly = ((HZ / 50) << (9 + 1)); + static int ip_rt_error_cost __read_mostly = HZ; + static int ip_rt_error_burst __read_mostly = 5 * HZ; + static int ip_rt_mtu_expires __read_mostly = 10 * 60 * HZ; +-static int ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; ++static u32 ip_rt_min_pmtu __read_mostly = 512 + 20 + 20; + static int ip_rt_min_advmss __read_mostly = 256; + + static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; ++ ++static int ip_min_valid_pmtu __read_mostly = IPV4_MIN_MTU; ++ + /* + * Interface to generic destination cache. + */ +@@ -1829,6 +1832,8 @@ int fib_multipath_hash(const struct fib_info *fi, const struct flowi4 *fl4, + return skb_get_hash_raw(skb) >> 1; + memset(&hash_keys, 0, sizeof(hash_keys)); + skb_flow_dissect_flow_keys(skb, &keys, flag); ++ ++ hash_keys.control.addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS; + hash_keys.addrs.v4addrs.src = keys.addrs.v4addrs.src; + hash_keys.addrs.v4addrs.dst = keys.addrs.v4addrs.dst; + hash_keys.ports.src = keys.ports.src; +@@ -2934,7 +2939,8 @@ static struct ctl_table ipv4_route_table[] = { + .data = &ip_rt_min_pmtu, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec, ++ .proc_handler = proc_dointvec_minmax, ++ .extra1 = &ip_min_valid_pmtu, + }, + { + .procname = "min_adv_mss", +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index d9d215e27b8a..14474acea0bb 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2013,11 +2013,6 @@ void tcp_enter_loss(struct sock *sk) + /* F-RTO RFC5682 sec 3.1 step 1: retransmit SND.UNA if no previous + * loss recovery is underway except recurring timeout(s) on + * the same SND.UNA (sec 3.2). Disable F-RTO on path MTU probing +- * +- * In theory F-RTO can be used repeatedly during loss recovery. +- * In practice this interacts badly with broken middle-boxes that +- * falsely raise the receive window, which results in repeated +- * timeouts and stop-and-go behavior. + */ + tp->frto = sysctl_tcp_frto && + (new_recovery || icsk->icsk_retransmits) && +@@ -2699,18 +2694,14 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack, + tcp_try_undo_loss(sk, false)) + return; + +- /* The ACK (s)acks some never-retransmitted data meaning not all +- * the data packets before the timeout were lost. Therefore we +- * undo the congestion window and state. This is essentially +- * the operation in F-RTO (RFC5682 section 3.1 step 3.b). Since +- * a retransmitted skb is permantly marked, we can apply such an +- * operation even if F-RTO was not used. +- */ +- if ((flag & FLAG_ORIG_SACK_ACKED) && +- tcp_try_undo_loss(sk, tp->undo_marker)) +- return; +- + if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */ ++ /* Step 3.b. A timeout is spurious if not all data are ++ * lost, i.e., never-retransmitted data are (s)acked. ++ */ ++ if ((flag & FLAG_ORIG_SACK_ACKED) && ++ tcp_try_undo_loss(sk, true)) ++ return; ++ + if (after(tp->snd_nxt, tp->high_seq)) { + if (flag & FLAG_DATA_SACKED || is_dupack) + tp->frto = 0; /* Step 3.a. loss was real */ +@@ -4020,6 +4011,7 @@ void tcp_reset(struct sock *sk) + /* This barrier is coupled with smp_rmb() in tcp_poll() */ + smp_wmb(); + ++ tcp_write_queue_purge(sk); + tcp_done(sk); + + if (!sock_flag(sk, SOCK_DEAD)) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index cd3d60bb7cc8..83d11cd2eb65 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -1681,7 +1681,7 @@ u32 tcp_tso_autosize(const struct sock *sk, unsigned int mss_now, + */ + segs = max_t(u32, bytes / mss_now, min_tso_segs); + +- return min_t(u32, segs, sk->sk_gso_max_segs); ++ return segs; + } + EXPORT_SYMBOL(tcp_tso_autosize); + +@@ -1693,8 +1693,10 @@ static u32 tcp_tso_segs(struct sock *sk, unsigned int mss_now) + const struct tcp_congestion_ops *ca_ops = inet_csk(sk)->icsk_ca_ops; + u32 tso_segs = ca_ops->tso_segs_goal ? ca_ops->tso_segs_goal(sk) : 0; + +- return tso_segs ? : +- tcp_tso_autosize(sk, mss_now, sysctl_tcp_min_tso_segs); ++ if (!tso_segs) ++ tso_segs = tcp_tso_autosize(sk, mss_now, ++ sysctl_tcp_min_tso_segs); ++ return min_t(u32, tso_segs, sk->sk_gso_max_segs); + } + + /* Returns the portion of skb which can be sent right away */ +@@ -1973,6 +1975,24 @@ static inline void tcp_mtu_check_reprobe(struct sock *sk) + } + } + ++static bool tcp_can_coalesce_send_queue_head(struct sock *sk, int len) ++{ ++ struct sk_buff *skb, *next; ++ ++ skb = tcp_send_head(sk); ++ tcp_for_write_queue_from_safe(skb, next, sk) { ++ if (len <= skb->len) ++ break; ++ ++ if (unlikely(TCP_SKB_CB(skb)->eor)) ++ return false; ++ ++ len -= skb->len; ++ } ++ ++ return true; ++} ++ + /* Create a new MTU probe if we are ready. + * MTU probe is regularly attempting to increase the path MTU by + * deliberately sending larger packets. This discovers routing +@@ -2045,6 +2065,9 @@ static int tcp_mtu_probe(struct sock *sk) + return 0; + } + ++ if (!tcp_can_coalesce_send_queue_head(sk, probe_size)) ++ return -1; ++ + /* We're allowed to probe. Build it now. */ + nskb = sk_stream_alloc_skb(sk, probe_size, GFP_ATOMIC, false); + if (!nskb) +@@ -2080,6 +2103,10 @@ static int tcp_mtu_probe(struct sock *sk) + /* We've eaten all the data from this skb. + * Throw it away. */ + TCP_SKB_CB(nskb)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags; ++ /* If this is the last SKB we copy and eor is set ++ * we need to propagate it to the new skb. ++ */ ++ TCP_SKB_CB(nskb)->eor = TCP_SKB_CB(skb)->eor; + tcp_unlink_write_queue(skb, sk); + sk_wmem_free_skb(sk, skb); + } else { +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index ebfbccae62fd..c79fa6f6b758 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2032,6 +2032,11 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, + err = udplite_checksum_init(skb, uh); + if (err) + return err; ++ ++ if (UDP_SKB_CB(skb)->partial_cov) { ++ skb->csum = inet_compute_pseudo(skb, proto); ++ return 0; ++ } + } + + /* Note, we are only interested in != 0 or == 0, thus the +diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c +index ec43d18b5ff9..547515e8450a 100644 +--- a/net/ipv6/ip6_checksum.c ++++ b/net/ipv6/ip6_checksum.c +@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto) + err = udplite_checksum_init(skb, uh); + if (err) + return err; ++ ++ if (UDP_SKB_CB(skb)->partial_cov) { ++ skb->csum = ip6_compute_pseudo(skb, proto); ++ return 0; ++ } + } + + /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels) +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index e79854cc5790..cac815cc8600 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -176,7 +176,7 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn) + #ifdef CONFIG_IPV6_SIT_6RD + struct ip_tunnel *t = netdev_priv(dev); + +- if (t->dev == sitn->fb_tunnel_dev) { ++ if (dev == sitn->fb_tunnel_dev) { + ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0); + t->ip6rd.relay_prefix = 0; + t->ip6rd.prefixlen = 16; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 533fd0503ba0..9219bc134109 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2276,7 +2276,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, + if (cb->start) { + ret = cb->start(cb); + if (ret) +- goto error_unlock; ++ goto error_put; + } + + nlk->cb_running = true; +@@ -2296,6 +2296,8 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, + */ + return -EINTR; + ++error_put: ++ module_put(control->module); + error_unlock: + sock_put(sk); + mutex_unlock(nlk->cb_mutex); +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index d444daf1ac04..6f02499ef007 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1081,6 +1081,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + { + struct sk_buff *tmp; + struct net *net, *prev = NULL; ++ bool delivered = false; + int err; + + for_each_net_rcu(net) { +@@ -1092,14 +1093,21 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + } + err = nlmsg_multicast(prev->genl_sock, tmp, + portid, group, flags); +- if (err) ++ if (!err) ++ delivered = true; ++ else if (err != -ESRCH) + goto error; + } + + prev = net; + } + +- return nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); ++ err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags); ++ if (!err) ++ delivered = true; ++ else if (err != -ESRCH) ++ goto error; ++ return delivered ? 0 : -ESRCH; + error: + kfree_skb(skb); + return err; +diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c +index 71e6f713fbe7..5b67cb5d47f0 100644 +--- a/net/rxrpc/output.c ++++ b/net/rxrpc/output.c +@@ -395,7 +395,7 @@ int rxrpc_send_data_packet(struct rxrpc_call *call, struct sk_buff *skb, + (char *)&opt, sizeof(opt)); + if (ret == 0) { + ret = kernel_sendmsg(conn->params.local->socket, &msg, +- iov, 1, iov[0].iov_len); ++ iov, 2, len); + + opt = IPV6_PMTUDISC_DO; + kernel_setsockopt(conn->params.local->socket, +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 934c239cf98d..c2fab4bcb8be 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -871,13 +871,18 @@ static int tc_dump_tfilter(struct sk_buff *skb, struct netlink_callback *cb) + if (tca[TCA_CHAIN] && + nla_get_u32(tca[TCA_CHAIN]) != chain->index) + continue; +- if (!tcf_chain_dump(chain, skb, cb, index_start, &index)) ++ if (!tcf_chain_dump(chain, skb, cb, index_start, &index)) { ++ err = -EMSGSIZE; + break; ++ } + } + + cb->args[0] = index; + + out: ++ /* If we did no progress, the error (EMSGSIZE) is real */ ++ if (skb->len == 0 && err) ++ return err; + return skb->len; + } + +diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c +index b58eccb21f03..ba37d8f57e68 100644 +--- a/net/sched/cls_u32.c ++++ b/net/sched/cls_u32.c +@@ -398,10 +398,12 @@ static int u32_init(struct tcf_proto *tp) + static int u32_destroy_key(struct tcf_proto *tp, struct tc_u_knode *n, + bool free_pf) + { ++ struct tc_u_hnode *ht = rtnl_dereference(n->ht_down); ++ + tcf_exts_destroy(&n->exts); + tcf_exts_put_net(&n->exts); +- if (n->ht_down) +- n->ht_down->refcnt--; ++ if (ht && --ht->refcnt == 0) ++ kfree(ht); + #ifdef CONFIG_CLS_U32_PERF + if (free_pf) + free_percpu(n->pf); +@@ -649,16 +651,15 @@ static void u32_destroy(struct tcf_proto *tp) + + hlist_del(&tp_c->hnode); + +- for (ht = rtnl_dereference(tp_c->hlist); +- ht; +- ht = rtnl_dereference(ht->next)) { +- ht->refcnt--; +- u32_clear_hnode(tp, ht); +- } +- + while ((ht = rtnl_dereference(tp_c->hlist)) != NULL) { ++ u32_clear_hnode(tp, ht); + RCU_INIT_POINTER(tp_c->hlist, ht->next); +- kfree_rcu(ht, rcu); ++ ++ /* u32_destroy_key() will later free ht for us, if it's ++ * still referenced by some knode ++ */ ++ if (--ht->refcnt == 0) ++ kfree_rcu(ht, rcu); + } + + kfree(tp_c); +@@ -927,7 +928,8 @@ static int u32_change(struct net *net, struct sk_buff *in_skb, + if (TC_U32_KEY(n->handle) == 0) + return -EINVAL; + +- if (n->flags != flags) ++ if ((n->flags ^ flags) & ++ ~(TCA_CLS_FLAGS_IN_HW | TCA_CLS_FLAGS_NOT_IN_HW)) + return -EINVAL; + + new = u32_init_knode(tp, n); +diff --git a/net/sctp/input.c b/net/sctp/input.c +index 141c9c466ec1..0247cc432e02 100644 +--- a/net/sctp/input.c ++++ b/net/sctp/input.c +@@ -897,15 +897,12 @@ int sctp_hash_transport(struct sctp_transport *t) + rhl_for_each_entry_rcu(transport, tmp, list, node) + if (transport->asoc->ep == t->asoc->ep) { + rcu_read_unlock(); +- err = -EEXIST; +- goto out; ++ return -EEXIST; + } + rcu_read_unlock(); + + err = rhltable_insert_key(&sctp_transport_hashtable, &arg, + &t->node, sctp_hash_params); +- +-out: + if (err) + pr_err_once("insert transport fail, errno %d\n", err); + +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 3b18085e3b10..f27a9718554c 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -326,8 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); + bdst = ip6_dst_lookup_flow(sk, fl6, final_p); + +- if (!IS_ERR(bdst) && +- ipv6_chk_addr(dev_net(bdst->dev), ++ if (IS_ERR(bdst)) ++ continue; ++ ++ if (ipv6_chk_addr(dev_net(bdst->dev), + &laddr->a.v6.sin6_addr, bdst->dev, 1)) { + if (!IS_ERR_OR_NULL(dst)) + dst_release(dst); +@@ -336,8 +338,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + } + + bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); +- if (matchlen > bmatchlen) ++ if (matchlen > bmatchlen) { ++ dst_release(bdst); + continue; ++ } + + if (!IS_ERR_OR_NULL(dst)) + dst_release(dst); +diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c +index fcd80feb293f..df22a9c352ad 100644 +--- a/net/sctp/protocol.c ++++ b/net/sctp/protocol.c +@@ -514,22 +514,20 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr, + if (IS_ERR(rt)) + continue; + +- if (!dst) +- dst = &rt->dst; +- + /* Ensure the src address belongs to the output + * interface. + */ + odev = __ip_dev_find(sock_net(sk), laddr->a.v4.sin_addr.s_addr, + false); + if (!odev || odev->ifindex != fl4->flowi4_oif) { +- if (&rt->dst != dst) ++ if (!dst) ++ dst = &rt->dst; ++ else + dst_release(&rt->dst); + continue; + } + +- if (dst != &rt->dst) +- dst_release(dst); ++ dst_release(dst); + dst = &rt->dst; + break; + } +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c +index 514465b03829..e4a400f88168 100644 +--- a/net/sctp/sm_make_chunk.c ++++ b/net/sctp/sm_make_chunk.c +@@ -1378,9 +1378,14 @@ static struct sctp_chunk *_sctp_make_chunk(const struct sctp_association *asoc, + struct sctp_chunk *retval; + struct sk_buff *skb; + struct sock *sk; ++ int chunklen; ++ ++ chunklen = SCTP_PAD4(sizeof(*chunk_hdr) + paylen); ++ if (chunklen > SCTP_MAX_CHUNK_LEN) ++ goto nodata; + + /* No need to allocate LL here, as this is only a chunk. */ +- skb = alloc_skb(SCTP_PAD4(sizeof(*chunk_hdr) + paylen), gfp); ++ skb = alloc_skb(chunklen, gfp); + if (!skb) + goto nodata; + +diff --git a/sound/core/control.c b/sound/core/control.c +index 56b3e2d49c82..af7e6165e21e 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -888,7 +888,7 @@ static int snd_ctl_elem_read(struct snd_card *card, + + index_offset = snd_ctl_get_ioff(kctl, &control->id); + vd = &kctl->vd[index_offset]; +- if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) && kctl->get == NULL) ++ if (!(vd->access & SNDRV_CTL_ELEM_ACCESS_READ) || kctl->get == NULL) + return -EPERM; + + snd_ctl_build_ioff(&control->id, kctl, index_offset); +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index c71dcacea807..96143df19b21 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -181,7 +181,7 @@ static const struct kernel_param_ops param_ops_xint = { + }; + #define param_check_xint param_check_int + +-static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; ++static int power_save = -1; + module_param(power_save, xint, 0644); + MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " + "(in second, 0 = disable)."); +@@ -2186,6 +2186,24 @@ static int azx_probe(struct pci_dev *pci, + return err; + } + ++#ifdef CONFIG_PM ++/* On some boards setting power_save to a non 0 value leads to clicking / ++ * popping sounds when ever we enter/leave powersaving mode. Ideally we would ++ * figure out how to avoid these sounds, but that is not always feasible. ++ * So we keep a list of devices where we disable powersaving as its known ++ * to causes problems on these devices. ++ */ ++static struct snd_pci_quirk power_save_blacklist[] = { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ ++ SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ ++ SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), ++ /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ ++ SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), ++ {} ++}; ++#endif /* CONFIG_PM */ ++ + /* number of codec slots for each chipset: 0 = default slots (i.e. 4) */ + static unsigned int azx_max_codecs[AZX_NUM_DRIVERS] = { + [AZX_DRIVER_NVIDIA] = 8, +@@ -2198,6 +2216,7 @@ static int azx_probe_continue(struct azx *chip) + struct hdac_bus *bus = azx_bus(chip); + struct pci_dev *pci = chip->pci; + int dev = chip->dev_index; ++ int val; + int err; + + hda->probe_continued = 1; +@@ -2278,7 +2297,22 @@ static int azx_probe_continue(struct azx *chip) + + chip->running = 1; + azx_add_card_list(chip); +- snd_hda_set_power_save(&chip->bus, power_save * 1000); ++ ++ val = power_save; ++#ifdef CONFIG_PM ++ if (val == -1) { ++ const struct snd_pci_quirk *q; ++ ++ val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; ++ q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); ++ if (q && val) { ++ dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", ++ q->subvendor, q->subdevice); ++ val = 0; ++ } ++ } ++#endif /* CONFIG_PM */ ++ snd_hda_set_power_save(&chip->bus, val * 1000); + if (azx_has_pm_runtime(chip) || hda->use_vga_switcheroo) + pm_runtime_put_autosuspend(&pci->dev); + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b7acffdf16a4..454476b47b79 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4852,13 +4852,14 @@ static void alc_fixup_tpt470_dock(struct hda_codec *codec, + + if (action == HDA_FIXUP_ACT_PRE_PROBE) { + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; ++ snd_hda_apply_pincfgs(codec, pincfgs); ++ } else if (action == HDA_FIXUP_ACT_INIT) { + /* Enable DOCK device */ + snd_hda_codec_write(codec, 0x17, 0, + AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0); + /* Enable DOCK device */ + snd_hda_codec_write(codec, 0x19, 0, + AC_VERB_SET_CONFIG_DEFAULT_BYTES_3, 0); +- snd_hda_apply_pincfgs(codec, pincfgs); + } + } + +diff --git a/sound/usb/quirks-table.h b/sound/usb/quirks-table.h +index 8a59d4782a0f..69bf5cf1e91e 100644 +--- a/sound/usb/quirks-table.h ++++ b/sound/usb/quirks-table.h +@@ -3277,4 +3277,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge", "HVR-950Q"), + } + }, + ++{ ++ /* ++ * Bower's & Wilkins PX headphones only support the 48 kHz sample rate ++ * even though it advertises more. The capture interface doesn't work ++ * even on windows. ++ */ ++ USB_DEVICE(0x19b5, 0x0021), ++ .driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) { ++ .ifnum = QUIRK_ANY_INTERFACE, ++ .type = QUIRK_COMPOSITE, ++ .data = (const struct snd_usb_audio_quirk[]) { ++ { ++ .ifnum = 0, ++ .type = QUIRK_AUDIO_STANDARD_MIXER, ++ }, ++ /* Capture */ ++ { ++ .ifnum = 1, ++ .type = QUIRK_IGNORE_INTERFACE, ++ }, ++ /* Playback */ ++ { ++ .ifnum = 2, ++ .type = QUIRK_AUDIO_FIXED_ENDPOINT, ++ .data = &(const struct audioformat) { ++ .formats = SNDRV_PCM_FMTBIT_S16_LE, ++ .channels = 2, ++ .iface = 2, ++ .altsetting = 1, ++ .altset_idx = 1, ++ .attributes = UAC_EP_CS_ATTR_FILL_MAX | ++ UAC_EP_CS_ATTR_SAMPLE_RATE, ++ .endpoint = 0x03, ++ .ep_attr = USB_ENDPOINT_XFER_ISOC, ++ .rates = SNDRV_PCM_RATE_48000, ++ .rate_min = 48000, ++ .rate_max = 48000, ++ .nr_rates = 1, ++ .rate_table = (unsigned int[]) { ++ 48000 ++ } ++ } ++ }, ++ } ++ } ++}, ++ + #undef USB_DEVICE_VENDOR_SPEC +diff --git a/sound/x86/intel_hdmi_audio.c b/sound/x86/intel_hdmi_audio.c +index a0951505c7f5..697872d8308e 100644 +--- a/sound/x86/intel_hdmi_audio.c ++++ b/sound/x86/intel_hdmi_audio.c +@@ -1827,6 +1827,8 @@ static int hdmi_lpe_audio_probe(struct platform_device *pdev) + ctx->port = port; + ctx->pipe = -1; + ++ spin_lock_init(&ctx->had_spinlock); ++ mutex_init(&ctx->mutex); + INIT_WORK(&ctx->hdmi_audio_wq, had_audio_wq); + + ret = snd_pcm_new(card, INTEL_HAD, port, MAX_PB_STREAMS, +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 8401774f5aeb..d81af263f50b 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -975,8 +975,7 @@ int __kvm_set_memory_region(struct kvm *kvm, + /* Check for overlaps */ + r = -EEXIST; + kvm_for_each_memslot(slot, __kvm_memslots(kvm, as_id)) { +- if ((slot->id >= KVM_USER_MEM_SLOTS) || +- (slot->id == id)) ++ if (slot->id == id) + continue; + if (!((base_gfn + npages <= slot->base_gfn) || + (base_gfn >= slot->base_gfn + slot->npages))) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.25-26.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.25-26.patch new file mode 100644 index 000000000000..66b15666e3db --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.25-26.patch @@ -0,0 +1,561 @@ +diff --git a/Documentation/virtual/kvm/cpuid.txt b/Documentation/virtual/kvm/cpuid.txt +index 3c65feb83010..a81c97a4b4a5 100644 +--- a/Documentation/virtual/kvm/cpuid.txt ++++ b/Documentation/virtual/kvm/cpuid.txt +@@ -54,6 +54,10 @@ KVM_FEATURE_PV_UNHALT || 7 || guest checks this feature bit + || || before enabling paravirtualized + || || spinlock support. + ------------------------------------------------------------------------------ ++KVM_FEATURE_ASYNC_PF_VMEXIT || 10 || paravirtualized async PF VM exit ++ || || can be enabled by setting bit 2 ++ || || when writing to msr 0x4b564d02 ++------------------------------------------------------------------------------ + KVM_FEATURE_CLOCKSOURCE_STABLE_BIT || 24 || host will warn if no guest-side + || || per-cpu warps are expected in + || || kvmclock. +diff --git a/Documentation/virtual/kvm/msr.txt b/Documentation/virtual/kvm/msr.txt +index 1ebecc115dc6..f3f0d57ced8e 100644 +--- a/Documentation/virtual/kvm/msr.txt ++++ b/Documentation/virtual/kvm/msr.txt +@@ -170,7 +170,8 @@ MSR_KVM_ASYNC_PF_EN: 0x4b564d02 + when asynchronous page faults are enabled on the vcpu 0 when + disabled. Bit 1 is 1 if asynchronous page faults can be injected + when vcpu is in cpl == 0. Bit 2 is 1 if asynchronous page faults +- are delivered to L1 as #PF vmexits. ++ are delivered to L1 as #PF vmexits. Bit 2 can be set only if ++ KVM_FEATURE_ASYNC_PF_VMEXIT is present in CPUID. + + First 4 byte of 64 byte memory location will be written to by + the hypervisor at the time of asynchronous page fault (APF) +diff --git a/Makefile b/Makefile +index 0fdae0f455ef..666182dda187 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 25 ++SUBLEVEL = 26 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c +index bb32f7f6dd0f..be155f70f108 100644 +--- a/arch/arm64/net/bpf_jit_comp.c ++++ b/arch/arm64/net/bpf_jit_comp.c +@@ -238,8 +238,9 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) + off = offsetof(struct bpf_array, map.max_entries); + emit_a64_mov_i64(tmp, off, ctx); + emit(A64_LDR32(tmp, r2, tmp), ctx); ++ emit(A64_MOV(0, r3, r3), ctx); + emit(A64_CMP(0, r3, tmp), ctx); +- emit(A64_B_(A64_COND_GE, jmp_offset), ctx); ++ emit(A64_B_(A64_COND_CS, jmp_offset), ctx); + + /* if (tail_call_cnt > MAX_TAIL_CALL_CNT) + * goto out; +@@ -247,7 +248,7 @@ static int emit_bpf_tail_call(struct jit_ctx *ctx) + */ + emit_a64_mov_i64(tmp, MAX_TAIL_CALL_CNT, ctx); + emit(A64_CMP(1, tcc, tmp), ctx); +- emit(A64_B_(A64_COND_GT, jmp_offset), ctx); ++ emit(A64_B_(A64_COND_HI, jmp_offset), ctx); + emit(A64_ADD_I(1, tcc, tcc, 1), ctx); + + /* prog = array->ptrs[index]; +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index 5d115bd32539..bd0786c23109 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -241,6 +241,7 @@ static void bpf_jit_emit_tail_call(u32 *image, struct codegen_context *ctx, u32 + * goto out; + */ + PPC_LWZ(b2p[TMP_REG_1], b2p_bpf_array, offsetof(struct bpf_array, map.max_entries)); ++ PPC_RLWINM(b2p_index, b2p_index, 0, 0, 31); + PPC_CMPLW(b2p_index, b2p[TMP_REG_1]); + PPC_BCC(COND_GE, out); + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 76b058533e47..81a1be326571 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -177,4 +177,41 @@ static inline void indirect_branch_prediction_barrier(void) + } + + #endif /* __ASSEMBLY__ */ ++ ++/* ++ * Below is used in the eBPF JIT compiler and emits the byte sequence ++ * for the following assembly: ++ * ++ * With retpolines configured: ++ * ++ * callq do_rop ++ * spec_trap: ++ * pause ++ * lfence ++ * jmp spec_trap ++ * do_rop: ++ * mov %rax,(%rsp) ++ * retq ++ * ++ * Without retpolines configured: ++ * ++ * jmp *%rax ++ */ ++#ifdef CONFIG_RETPOLINE ++# define RETPOLINE_RAX_BPF_JIT_SIZE 17 ++# define RETPOLINE_RAX_BPF_JIT() \ ++ EMIT1_off32(0xE8, 7); /* callq do_rop */ \ ++ /* spec_trap: */ \ ++ EMIT2(0xF3, 0x90); /* pause */ \ ++ EMIT3(0x0F, 0xAE, 0xE8); /* lfence */ \ ++ EMIT2(0xEB, 0xF9); /* jmp spec_trap */ \ ++ /* do_rop: */ \ ++ EMIT4(0x48, 0x89, 0x04, 0x24); /* mov %rax,(%rsp) */ \ ++ EMIT1(0xC3); /* retq */ ++#else ++# define RETPOLINE_RAX_BPF_JIT_SIZE 2 ++# define RETPOLINE_RAX_BPF_JIT() \ ++ EMIT2(0xFF, 0xE0); /* jmp *%rax */ ++#endif ++ + #endif /* _ASM_X86_NOSPEC_BRANCH_H_ */ +diff --git a/arch/x86/include/uapi/asm/kvm_para.h b/arch/x86/include/uapi/asm/kvm_para.h +index 554aa8f24f91..341db0462b85 100644 +--- a/arch/x86/include/uapi/asm/kvm_para.h ++++ b/arch/x86/include/uapi/asm/kvm_para.h +@@ -25,6 +25,7 @@ + #define KVM_FEATURE_STEAL_TIME 5 + #define KVM_FEATURE_PV_EOI 6 + #define KVM_FEATURE_PV_UNHALT 7 ++#define KVM_FEATURE_ASYNC_PF_VMEXIT 10 + + /* The last 8 bits are used to indicate how to interpret the flags field + * in pvclock structure. If no bits are set, all flags are ignored. +diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c +index a94de09edbed..652bdd867782 100644 +--- a/arch/x86/kernel/kvm.c ++++ b/arch/x86/kernel/kvm.c +@@ -341,10 +341,10 @@ static void kvm_guest_cpu_init(void) + #endif + pa |= KVM_ASYNC_PF_ENABLED; + +- /* Async page fault support for L1 hypervisor is optional */ +- if (wrmsr_safe(MSR_KVM_ASYNC_PF_EN, +- (pa | KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT) & 0xffffffff, pa >> 32) < 0) +- wrmsrl(MSR_KVM_ASYNC_PF_EN, pa); ++ if (kvm_para_has_feature(KVM_FEATURE_ASYNC_PF_VMEXIT)) ++ pa |= KVM_ASYNC_PF_DELIVERY_AS_PF_VMEXIT; ++ ++ wrmsrl(MSR_KVM_ASYNC_PF_EN, pa); + __this_cpu_write(apf_reason.enabled, 1); + printk(KERN_INFO"KVM setup async PF for cpu %d\n", + smp_processor_id()); +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 13f5d4217e4f..4f544f2a7b06 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -597,7 +597,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + (1 << KVM_FEATURE_ASYNC_PF) | + (1 << KVM_FEATURE_PV_EOI) | + (1 << KVM_FEATURE_CLOCKSOURCE_STABLE_BIT) | +- (1 << KVM_FEATURE_PV_UNHALT); ++ (1 << KVM_FEATURE_PV_UNHALT) | ++ (1 << KVM_FEATURE_ASYNC_PF_VMEXIT); + + if (sched_info_on()) + entry->eax |= (1 << KVM_FEATURE_STEAL_TIME); +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 0554e8aef4d5..940aac70b4da 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + + int bpf_jit_enable __read_mostly; +@@ -287,7 +288,7 @@ static void emit_bpf_tail_call(u8 **pprog) + EMIT2(0x89, 0xD2); /* mov edx, edx */ + EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ + offsetof(struct bpf_array, map.max_entries)); +-#define OFFSET1 43 /* number of bytes to jump */ ++#define OFFSET1 (41 + RETPOLINE_RAX_BPF_JIT_SIZE) /* number of bytes to jump */ + EMIT2(X86_JBE, OFFSET1); /* jbe out */ + label1 = cnt; + +@@ -296,7 +297,7 @@ static void emit_bpf_tail_call(u8 **pprog) + */ + EMIT2_off32(0x8B, 0x85, 36); /* mov eax, dword ptr [rbp + 36] */ + EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */ +-#define OFFSET2 32 ++#define OFFSET2 (30 + RETPOLINE_RAX_BPF_JIT_SIZE) + EMIT2(X86_JA, OFFSET2); /* ja out */ + label2 = cnt; + EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */ +@@ -310,7 +311,7 @@ static void emit_bpf_tail_call(u8 **pprog) + * goto out; + */ + EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */ +-#define OFFSET3 10 ++#define OFFSET3 (8 + RETPOLINE_RAX_BPF_JIT_SIZE) + EMIT2(X86_JE, OFFSET3); /* je out */ + label3 = cnt; + +@@ -323,7 +324,7 @@ static void emit_bpf_tail_call(u8 **pprog) + * rdi == ctx (1st arg) + * rax == prog->bpf_func + prologue_size + */ +- EMIT2(0xFF, 0xE0); /* jmp rax */ ++ RETPOLINE_RAX_BPF_JIT(); + + /* out: */ + BUILD_BUG_ON(cnt - label1 != OFFSET1); +diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c +index a4ae1ca44a57..f57d0bdf3c9e 100644 +--- a/kernel/bpf/arraymap.c ++++ b/kernel/bpf/arraymap.c +@@ -23,8 +23,10 @@ static void bpf_array_free_percpu(struct bpf_array *array) + { + int i; + +- for (i = 0; i < array->map.max_entries; i++) ++ for (i = 0; i < array->map.max_entries; i++) { + free_percpu(array->pptrs[i]); ++ cond_resched(); ++ } + } + + static int bpf_array_alloc_percpu(struct bpf_array *array) +@@ -40,6 +42,7 @@ static int bpf_array_alloc_percpu(struct bpf_array *array) + return -ENOMEM; + } + array->pptrs[i] = ptr; ++ cond_resched(); + } + + return 0; +@@ -49,11 +52,11 @@ static int bpf_array_alloc_percpu(struct bpf_array *array) + static struct bpf_map *array_map_alloc(union bpf_attr *attr) + { + bool percpu = attr->map_type == BPF_MAP_TYPE_PERCPU_ARRAY; +- int numa_node = bpf_map_attr_numa_node(attr); ++ int ret, numa_node = bpf_map_attr_numa_node(attr); + u32 elem_size, index_mask, max_entries; + bool unpriv = !capable(CAP_SYS_ADMIN); ++ u64 cost, array_size, mask64; + struct bpf_array *array; +- u64 array_size, mask64; + + /* check sanity of attributes */ + if (attr->max_entries == 0 || attr->key_size != 4 || +@@ -97,8 +100,19 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) + array_size += (u64) max_entries * elem_size; + + /* make sure there is no u32 overflow later in round_up() */ +- if (array_size >= U32_MAX - PAGE_SIZE) ++ cost = array_size; ++ if (cost >= U32_MAX - PAGE_SIZE) + return ERR_PTR(-ENOMEM); ++ if (percpu) { ++ cost += (u64)attr->max_entries * elem_size * num_possible_cpus(); ++ if (cost >= U32_MAX - PAGE_SIZE) ++ return ERR_PTR(-ENOMEM); ++ } ++ cost = round_up(cost, PAGE_SIZE) >> PAGE_SHIFT; ++ ++ ret = bpf_map_precharge_memlock(cost); ++ if (ret < 0) ++ return ERR_PTR(ret); + + /* allocate all map elements and zero-initialize them */ + array = bpf_map_area_alloc(array_size, numa_node); +@@ -114,20 +128,13 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) + array->map.max_entries = attr->max_entries; + array->map.map_flags = attr->map_flags; + array->map.numa_node = numa_node; ++ array->map.pages = cost; + array->elem_size = elem_size; + +- if (!percpu) +- goto out; +- +- array_size += (u64) attr->max_entries * elem_size * num_possible_cpus(); +- +- if (array_size >= U32_MAX - PAGE_SIZE || +- bpf_array_alloc_percpu(array)) { ++ if (percpu && bpf_array_alloc_percpu(array)) { + bpf_map_area_free(array); + return ERR_PTR(-ENOMEM); + } +-out: +- array->map.pages = round_up(array_size, PAGE_SIZE) >> PAGE_SHIFT; + + return &array->map; + } +diff --git a/kernel/bpf/lpm_trie.c b/kernel/bpf/lpm_trie.c +index 1b767844a76f..c28c584b734e 100644 +--- a/kernel/bpf/lpm_trie.c ++++ b/kernel/bpf/lpm_trie.c +@@ -470,7 +470,10 @@ static void trie_free(struct bpf_map *map) + struct lpm_trie_node __rcu **slot; + struct lpm_trie_node *node; + +- raw_spin_lock(&trie->lock); ++ /* Wait for outstanding programs to complete ++ * update/lookup/delete/get_next_key and free the trie. ++ */ ++ synchronize_rcu(); + + /* Always start at the root and walk down to a node that has no + * children. Then free that node, nullify its reference in the parent +@@ -481,10 +484,9 @@ static void trie_free(struct bpf_map *map) + slot = &trie->root; + + for (;;) { +- node = rcu_dereference_protected(*slot, +- lockdep_is_held(&trie->lock)); ++ node = rcu_dereference_protected(*slot, 1); + if (!node) +- goto unlock; ++ goto out; + + if (rcu_access_pointer(node->child[0])) { + slot = &node->child[0]; +@@ -502,8 +504,8 @@ static void trie_free(struct bpf_map *map) + } + } + +-unlock: +- raw_spin_unlock(&trie->lock); ++out: ++ kfree(trie); + } + + static int trie_get_next_key(struct bpf_map *map, void *key, void *next_key) +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index b5ae6488b890..3ceb269c0ebd 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -993,6 +993,13 @@ static bool is_ctx_reg(struct bpf_verifier_env *env, int regno) + return reg->type == PTR_TO_CTX; + } + ++static bool is_pkt_reg(struct bpf_verifier_env *env, int regno) ++{ ++ const struct bpf_reg_state *reg = &env->cur_state.regs[regno]; ++ ++ return reg->type == PTR_TO_PACKET; ++} ++ + static int check_pkt_ptr_alignment(const struct bpf_reg_state *reg, + int off, int size, bool strict) + { +@@ -1050,10 +1057,10 @@ static int check_generic_ptr_alignment(const struct bpf_reg_state *reg, + } + + static int check_ptr_alignment(struct bpf_verifier_env *env, +- const struct bpf_reg_state *reg, +- int off, int size) ++ const struct bpf_reg_state *reg, int off, ++ int size, bool strict_alignment_once) + { +- bool strict = env->strict_alignment; ++ bool strict = env->strict_alignment || strict_alignment_once; + const char *pointer_desc = ""; + + switch (reg->type) { +@@ -1109,9 +1116,9 @@ static void coerce_reg_to_size(struct bpf_reg_state *reg, int size) + * if t==write && value_regno==-1, some unknown value is stored into memory + * if t==read && value_regno==-1, don't care what we read from memory + */ +-static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, int off, +- int bpf_size, enum bpf_access_type t, +- int value_regno) ++static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, ++ int off, int bpf_size, enum bpf_access_type t, ++ int value_regno, bool strict_alignment_once) + { + struct bpf_verifier_state *state = &env->cur_state; + struct bpf_reg_state *reg = &state->regs[regno]; +@@ -1122,7 +1129,7 @@ static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regn + return size; + + /* alignment checks will add in reg->off themselves */ +- err = check_ptr_alignment(env, reg, off, size); ++ err = check_ptr_alignment(env, reg, off, size, strict_alignment_once); + if (err) + return err; + +@@ -1265,21 +1272,23 @@ static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_ins + return -EACCES; + } + +- if (is_ctx_reg(env, insn->dst_reg)) { +- verbose("BPF_XADD stores into R%d context is not allowed\n", +- insn->dst_reg); ++ if (is_ctx_reg(env, insn->dst_reg) || ++ is_pkt_reg(env, insn->dst_reg)) { ++ verbose("BPF_XADD stores into R%d %s is not allowed\n", ++ insn->dst_reg, is_ctx_reg(env, insn->dst_reg) ? ++ "context" : "packet"); + return -EACCES; + } + + /* check whether atomic_add can read the memory */ + err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, +- BPF_SIZE(insn->code), BPF_READ, -1); ++ BPF_SIZE(insn->code), BPF_READ, -1, true); + if (err) + return err; + + /* check whether atomic_add can write into the same memory */ + return check_mem_access(env, insn_idx, insn->dst_reg, insn->off, +- BPF_SIZE(insn->code), BPF_WRITE, -1); ++ BPF_SIZE(insn->code), BPF_WRITE, -1, true); + } + + /* Does this register contain a constant zero? */ +@@ -1735,7 +1744,8 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx) + * is inferred from register state. + */ + for (i = 0; i < meta.access_size; i++) { +- err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B, BPF_WRITE, -1); ++ err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B, ++ BPF_WRITE, -1, false); + if (err) + return err; + } +@@ -3801,7 +3811,7 @@ static int do_check(struct bpf_verifier_env *env) + */ + err = check_mem_access(env, insn_idx, insn->src_reg, insn->off, + BPF_SIZE(insn->code), BPF_READ, +- insn->dst_reg); ++ insn->dst_reg, false); + if (err) + return err; + +@@ -3853,7 +3863,7 @@ static int do_check(struct bpf_verifier_env *env) + /* check that memory (dst_reg + off) is writeable */ + err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, + BPF_SIZE(insn->code), BPF_WRITE, +- insn->src_reg); ++ insn->src_reg, false); + if (err) + return err; + +@@ -3888,7 +3898,7 @@ static int do_check(struct bpf_verifier_env *env) + /* check that memory (dst_reg + off) is writeable */ + err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off, + BPF_SIZE(insn->code), BPF_WRITE, +- -1); ++ -1, false); + if (err) + return err; + +diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c +index c55d265489ca..9167ee976314 100644 +--- a/tools/testing/selftests/bpf/test_verifier.c ++++ b/tools/testing/selftests/bpf/test_verifier.c +@@ -2257,6 +2257,32 @@ static struct bpf_test tests[] = { + .result_unpriv = REJECT, + .result = ACCEPT, + }, ++ { ++ "runtime/jit: pass negative index to tail_call", ++ .insns = { ++ BPF_MOV64_IMM(BPF_REG_3, -1), ++ BPF_LD_MAP_FD(BPF_REG_2, 0), ++ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, ++ BPF_FUNC_tail_call), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ .fixup_prog = { 1 }, ++ .result = ACCEPT, ++ }, ++ { ++ "runtime/jit: pass > 32bit index to tail_call", ++ .insns = { ++ BPF_LD_IMM64(BPF_REG_3, 0x100000000ULL), ++ BPF_LD_MAP_FD(BPF_REG_2, 0), ++ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, ++ BPF_FUNC_tail_call), ++ BPF_MOV64_IMM(BPF_REG_0, 0), ++ BPF_EXIT_INSN(), ++ }, ++ .fixup_prog = { 2 }, ++ .result = ACCEPT, ++ }, + { + "stack pointer arithmetic", + .insns = { +@@ -7854,6 +7880,64 @@ static struct bpf_test tests[] = { + .prog_type = BPF_PROG_TYPE_XDP, + .flags = F_NEEDS_EFFICIENT_UNALIGNED_ACCESS, + }, ++ { ++ "xadd/w check unaligned stack", ++ .insns = { ++ BPF_MOV64_IMM(BPF_REG_0, 1), ++ BPF_STX_MEM(BPF_DW, BPF_REG_10, BPF_REG_0, -8), ++ BPF_STX_XADD(BPF_W, BPF_REG_10, BPF_REG_0, -7), ++ BPF_LDX_MEM(BPF_DW, BPF_REG_0, BPF_REG_10, -8), ++ BPF_EXIT_INSN(), ++ }, ++ .result = REJECT, ++ .errstr = "misaligned stack access off", ++ .prog_type = BPF_PROG_TYPE_SCHED_CLS, ++ }, ++ { ++ "xadd/w check unaligned map", ++ .insns = { ++ BPF_ST_MEM(BPF_DW, BPF_REG_10, -8, 0), ++ BPF_MOV64_REG(BPF_REG_2, BPF_REG_10), ++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_2, -8), ++ BPF_LD_MAP_FD(BPF_REG_1, 0), ++ BPF_RAW_INSN(BPF_JMP | BPF_CALL, 0, 0, 0, ++ BPF_FUNC_map_lookup_elem), ++ BPF_JMP_IMM(BPF_JNE, BPF_REG_0, 0, 1), ++ BPF_EXIT_INSN(), ++ BPF_MOV64_IMM(BPF_REG_1, 1), ++ BPF_STX_XADD(BPF_W, BPF_REG_0, BPF_REG_1, 3), ++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_0, 3), ++ BPF_EXIT_INSN(), ++ }, ++ .fixup_map1 = { 3 }, ++ .result = REJECT, ++ .errstr = "misaligned value access off", ++ .prog_type = BPF_PROG_TYPE_SCHED_CLS, ++ }, ++ { ++ "xadd/w check unaligned pkt", ++ .insns = { ++ BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, ++ offsetof(struct xdp_md, data)), ++ BPF_LDX_MEM(BPF_W, BPF_REG_3, BPF_REG_1, ++ offsetof(struct xdp_md, data_end)), ++ BPF_MOV64_REG(BPF_REG_1, BPF_REG_2), ++ BPF_ALU64_IMM(BPF_ADD, BPF_REG_1, 8), ++ BPF_JMP_REG(BPF_JLT, BPF_REG_1, BPF_REG_3, 2), ++ BPF_MOV64_IMM(BPF_REG_0, 99), ++ BPF_JMP_IMM(BPF_JA, 0, 0, 6), ++ BPF_MOV64_IMM(BPF_REG_0, 1), ++ BPF_ST_MEM(BPF_W, BPF_REG_2, 0, 0), ++ BPF_ST_MEM(BPF_W, BPF_REG_2, 3, 0), ++ BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 1), ++ BPF_STX_XADD(BPF_W, BPF_REG_2, BPF_REG_0, 2), ++ BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_2, 1), ++ BPF_EXIT_INSN(), ++ }, ++ .result = REJECT, ++ .errstr = "BPF_XADD stores into R2 packet", ++ .prog_type = BPF_PROG_TYPE_XDP, ++ }, + }; + + static int probe_filter_length(const struct bpf_insn *fp) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.26-27.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.26-27.patch new file mode 100644 index 000000000000..955999e4a0c5 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.26-27.patch @@ -0,0 +1,6245 @@ +diff --git a/Documentation/devicetree/bindings/power/mti,mips-cpc.txt b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt +new file mode 100644 +index 000000000000..c6b82511ae8a +--- /dev/null ++++ b/Documentation/devicetree/bindings/power/mti,mips-cpc.txt +@@ -0,0 +1,8 @@ ++Binding for MIPS Cluster Power Controller (CPC). ++ ++This binding allows a system to specify where the CPC registers are ++located. ++ ++Required properties: ++compatible : Should be "mti,mips-cpc". ++regs: Should describe the address & size of the CPC register region. +diff --git a/Documentation/sphinx/kerneldoc.py b/Documentation/sphinx/kerneldoc.py +index 39aa9e8697cc..fbedcc39460b 100644 +--- a/Documentation/sphinx/kerneldoc.py ++++ b/Documentation/sphinx/kerneldoc.py +@@ -36,8 +36,7 @@ import glob + + from docutils import nodes, statemachine + from docutils.statemachine import ViewList +-from docutils.parsers.rst import directives +-from sphinx.util.compat import Directive ++from docutils.parsers.rst import directives, Directive + from sphinx.ext.autodoc import AutodocReporter + + __version__ = '1.0' +diff --git a/MAINTAINERS b/MAINTAINERS +index 76ea063d8083..546beb6b0176 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -9001,6 +9001,7 @@ MIPS GENERIC PLATFORM + M: Paul Burton + L: linux-mips@linux-mips.org + S: Supported ++F: Documentation/devicetree/bindings/power/mti,mips-cpc.txt + F: arch/mips/generic/ + F: arch/mips/tools/generic-board-config.sh + +diff --git a/Makefile b/Makefile +index 666182dda187..00e969db94b8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 26 ++SUBLEVEL = 27 + EXTRAVERSION = + NAME = Petit Gorille + +@@ -11,6 +11,10 @@ NAME = Petit Gorille + # Comments in this file are targeted only to the developer, do not + # expect to learn how to build the kernel reading this file. + ++# That's our default target when none is given on the command line ++PHONY := _all ++_all: ++ + # o Do not use make's built-in rules and variables + # (this increases performance and avoids hard-to-debug behaviour); + # o Look for make include files relative to root of kernel src +@@ -117,10 +121,6 @@ ifeq ("$(origin O)", "command line") + KBUILD_OUTPUT := $(O) + endif + +-# That's our default target when none is given on the command line +-PHONY := _all +-_all: +- + # Cancel implicit rules on top Makefile + $(CURDIR)/Makefile Makefile: ; + +@@ -187,15 +187,6 @@ ifeq ("$(origin M)", "command line") + KBUILD_EXTMOD := $(M) + endif + +-# If building an external module we do not care about the all: rule +-# but instead _all depend on modules +-PHONY += all +-ifeq ($(KBUILD_EXTMOD),) +-_all: all +-else +-_all: modules +-endif +- + ifeq ($(KBUILD_SRC),) + # building in the source tree + srctree := . +@@ -207,6 +198,9 @@ else + srctree := $(KBUILD_SRC) + endif + endif ++ ++export KBUILD_CHECKSRC KBUILD_EXTMOD KBUILD_SRC ++ + objtree := . + src := $(srctree) + obj := $(objtree) +@@ -215,6 +209,74 @@ VPATH := $(srctree)$(if $(KBUILD_EXTMOD),:$(KBUILD_EXTMOD)) + + export srctree objtree VPATH + ++# To make sure we do not include .config for any of the *config targets ++# catch them early, and hand them over to scripts/kconfig/Makefile ++# It is allowed to specify more targets when calling make, including ++# mixing *config targets and build targets. ++# For example 'make oldconfig all'. ++# Detect when mixed targets is specified, and make a second invocation ++# of make so .config is not included in this case either (for *config). ++ ++version_h := include/generated/uapi/linux/version.h ++old_version_h := include/linux/version.h ++ ++no-dot-config-targets := clean mrproper distclean \ ++ cscope gtags TAGS tags help% %docs check% coccicheck \ ++ $(version_h) headers_% archheaders archscripts \ ++ kernelversion %src-pkg ++ ++config-targets := 0 ++mixed-targets := 0 ++dot-config := 1 ++ ++ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),) ++ ifeq ($(filter-out $(no-dot-config-targets), $(MAKECMDGOALS)),) ++ dot-config := 0 ++ endif ++endif ++ ++ifeq ($(KBUILD_EXTMOD),) ++ ifneq ($(filter config %config,$(MAKECMDGOALS)),) ++ config-targets := 1 ++ ifneq ($(words $(MAKECMDGOALS)),1) ++ mixed-targets := 1 ++ endif ++ endif ++endif ++# install and modules_install need also be processed one by one ++ifneq ($(filter install,$(MAKECMDGOALS)),) ++ ifneq ($(filter modules_install,$(MAKECMDGOALS)),) ++ mixed-targets := 1 ++ endif ++endif ++ ++ifeq ($(mixed-targets),1) ++# =========================================================================== ++# We're called with mixed targets (*config and build targets). ++# Handle them one by one. ++ ++PHONY += $(MAKECMDGOALS) __build_one_by_one ++ ++$(filter-out __build_one_by_one, $(MAKECMDGOALS)): __build_one_by_one ++ @: ++ ++__build_one_by_one: ++ $(Q)set -e; \ ++ for i in $(MAKECMDGOALS); do \ ++ $(MAKE) -f $(srctree)/Makefile $$i; \ ++ done ++ ++else ++ ++# We need some generic definitions (do not try to remake the file). ++scripts/Kbuild.include: ; ++include scripts/Kbuild.include ++ ++# Read KERNELRELEASE from include/config/kernel.release (if it exists) ++KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null) ++KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION) ++export VERSION PATCHLEVEL SUBLEVEL KERNELRELEASE KERNELVERSION ++ + # SUBARCH tells the usermode build what the underlying arch is. That is set + # first, and if a usermode build is happening, the "ARCH=um" on the command + # line overrides the setting of ARCH below. If a native build is happening, +@@ -312,40 +374,6 @@ HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \ + -Wno-missing-field-initializers -fno-delete-null-pointer-checks + endif + +-# Decide whether to build built-in, modular, or both. +-# Normally, just do built-in. +- +-KBUILD_MODULES := +-KBUILD_BUILTIN := 1 +- +-# If we have only "make modules", don't compile built-in objects. +-# When we're building modules with modversions, we need to consider +-# the built-in objects during the descend as well, in order to +-# make sure the checksums are up to date before we record them. +- +-ifeq ($(MAKECMDGOALS),modules) +- KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1) +-endif +- +-# If we have "make modules", compile modules +-# in addition to whatever we do anyway. +-# Just "make" or "make all" shall build modules as well +- +-ifneq ($(filter all _all modules,$(MAKECMDGOALS)),) +- KBUILD_MODULES := 1 +-endif +- +-ifeq ($(MAKECMDGOALS),) +- KBUILD_MODULES := 1 +-endif +- +-export KBUILD_MODULES KBUILD_BUILTIN +-export KBUILD_CHECKSRC KBUILD_SRC KBUILD_EXTMOD +- +-# We need some generic definitions (do not try to remake the file). +-scripts/Kbuild.include: ; +-include scripts/Kbuild.include +- + # Make variables (CC, etc...) + AS = $(CROSS_COMPILE)as + LD = $(CROSS_COMPILE)ld +@@ -405,11 +433,6 @@ KBUILD_CFLAGS_MODULE := -DMODULE + KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds + GCC_PLUGINS_CFLAGS := + +-# Read KERNELRELEASE from include/config/kernel.release (if it exists) +-KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null) +-KERNELVERSION = $(VERSION)$(if $(PATCHLEVEL),.$(PATCHLEVEL)$(if $(SUBLEVEL),.$(SUBLEVEL)))$(EXTRAVERSION) +- +-export VERSION PATCHLEVEL SUBLEVEL KERNELRELEASE KERNELVERSION + export ARCH SRCARCH CONFIG_SHELL HOSTCC HOSTCFLAGS CROSS_COMPILE AS LD CC + export CPP AR NM STRIP OBJCOPY OBJDUMP HOSTLDFLAGS HOST_LOADLIBES + export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE +@@ -459,73 +482,23 @@ ifneq ($(KBUILD_SRC),) + $(srctree) $(objtree) $(VERSION) $(PATCHLEVEL) + endif + +-# Support for using generic headers in asm-generic +-PHONY += asm-generic uapi-asm-generic +-asm-generic: uapi-asm-generic +- $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \ +- src=asm obj=arch/$(SRCARCH)/include/generated/asm +-uapi-asm-generic: +- $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \ +- src=uapi/asm obj=arch/$(SRCARCH)/include/generated/uapi/asm +- +-# To make sure we do not include .config for any of the *config targets +-# catch them early, and hand them over to scripts/kconfig/Makefile +-# It is allowed to specify more targets when calling make, including +-# mixing *config targets and build targets. +-# For example 'make oldconfig all'. +-# Detect when mixed targets is specified, and make a second invocation +-# of make so .config is not included in this case either (for *config). +- +-version_h := include/generated/uapi/linux/version.h +-old_version_h := include/linux/version.h +- +-no-dot-config-targets := clean mrproper distclean \ +- cscope gtags TAGS tags help% %docs check% coccicheck \ +- $(version_h) headers_% archheaders archscripts \ +- kernelversion %src-pkg +- +-config-targets := 0 +-mixed-targets := 0 +-dot-config := 1 +- +-ifneq ($(filter $(no-dot-config-targets), $(MAKECMDGOALS)),) +- ifeq ($(filter-out $(no-dot-config-targets), $(MAKECMDGOALS)),) +- dot-config := 0 +- endif ++ifeq ($(cc-name),clang) ++ifneq ($(CROSS_COMPILE),) ++CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%)) ++GCC_TOOLCHAIN := $(realpath $(dir $(shell which $(LD)))/..) + endif +- +-ifeq ($(KBUILD_EXTMOD),) +- ifneq ($(filter config %config,$(MAKECMDGOALS)),) +- config-targets := 1 +- ifneq ($(words $(MAKECMDGOALS)),1) +- mixed-targets := 1 +- endif +- endif ++ifneq ($(GCC_TOOLCHAIN),) ++CLANG_GCC_TC := --gcc-toolchain=$(GCC_TOOLCHAIN) + endif +-# install and modules_install need also be processed one by one +-ifneq ($(filter install,$(MAKECMDGOALS)),) +- ifneq ($(filter modules_install,$(MAKECMDGOALS)),) +- mixed-targets := 1 +- endif ++KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) ++KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) + endif + +-ifeq ($(mixed-targets),1) +-# =========================================================================== +-# We're called with mixed targets (*config and build targets). +-# Handle them one by one. +- +-PHONY += $(MAKECMDGOALS) __build_one_by_one ++RETPOLINE_CFLAGS_GCC := -mindirect-branch=thunk-extern -mindirect-branch-register ++RETPOLINE_CFLAGS_CLANG := -mretpoline-external-thunk ++RETPOLINE_CFLAGS := $(call cc-option,$(RETPOLINE_CFLAGS_GCC),$(call cc-option,$(RETPOLINE_CFLAGS_CLANG))) ++export RETPOLINE_CFLAGS + +-$(filter-out __build_one_by_one, $(MAKECMDGOALS)): __build_one_by_one +- @: +- +-__build_one_by_one: +- $(Q)set -e; \ +- for i in $(MAKECMDGOALS); do \ +- $(MAKE) -f $(srctree)/Makefile $$i; \ +- done +- +-else + ifeq ($(config-targets),1) + # =========================================================================== + # *config targets only - make sure prerequisites are updated, and descend +@@ -548,6 +521,44 @@ else + # Build targets only - this includes vmlinux, arch specific targets, clean + # targets and others. In general all targets except *config targets. + ++# If building an external module we do not care about the all: rule ++# but instead _all depend on modules ++PHONY += all ++ifeq ($(KBUILD_EXTMOD),) ++_all: all ++else ++_all: modules ++endif ++ ++# Decide whether to build built-in, modular, or both. ++# Normally, just do built-in. ++ ++KBUILD_MODULES := ++KBUILD_BUILTIN := 1 ++ ++# If we have only "make modules", don't compile built-in objects. ++# When we're building modules with modversions, we need to consider ++# the built-in objects during the descend as well, in order to ++# make sure the checksums are up to date before we record them. ++ ++ifeq ($(MAKECMDGOALS),modules) ++ KBUILD_BUILTIN := $(if $(CONFIG_MODVERSIONS),1) ++endif ++ ++# If we have "make modules", compile modules ++# in addition to whatever we do anyway. ++# Just "make" or "make all" shall build modules as well ++ ++ifneq ($(filter all _all modules,$(MAKECMDGOALS)),) ++ KBUILD_MODULES := 1 ++endif ++ ++ifeq ($(MAKECMDGOALS),) ++ KBUILD_MODULES := 1 ++endif ++ ++export KBUILD_MODULES KBUILD_BUILTIN ++ + ifeq ($(KBUILD_EXTMOD),) + # Additional helpers built in scripts/ + # Carefully list dependencies so we do not try to build scripts twice +@@ -699,15 +710,6 @@ endif + KBUILD_CFLAGS += $(stackp-flag) + + ifeq ($(cc-name),clang) +-ifneq ($(CROSS_COMPILE),) +-CLANG_TARGET := --target=$(notdir $(CROSS_COMPILE:%-=%)) +-GCC_TOOLCHAIN := $(realpath $(dir $(shell which $(LD)))/..) +-endif +-ifneq ($(GCC_TOOLCHAIN),) +-CLANG_GCC_TC := --gcc-toolchain=$(GCC_TOOLCHAIN) +-endif +-KBUILD_CFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) +-KBUILD_AFLAGS += $(CLANG_TARGET) $(CLANG_GCC_TC) + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) +@@ -1076,6 +1078,15 @@ prepare0: archprepare gcc-plugins + # All the preparing.. + prepare: prepare0 prepare-objtool + ++# Support for using generic headers in asm-generic ++PHONY += asm-generic uapi-asm-generic ++asm-generic: uapi-asm-generic ++ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \ ++ src=asm obj=arch/$(SRCARCH)/include/generated/asm ++uapi-asm-generic: ++ $(Q)$(MAKE) -f $(srctree)/scripts/Makefile.asm-generic \ ++ src=uapi/asm obj=arch/$(SRCARCH)/include/generated/uapi/asm ++ + PHONY += prepare-objtool + prepare-objtool: $(objtool_target) + +diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c +index 9ff92050053c..fa7f308c9027 100644 +--- a/arch/arm/mach-omap2/omap-secure.c ++++ b/arch/arm/mach-omap2/omap-secure.c +@@ -73,6 +73,7 @@ phys_addr_t omap_secure_ram_mempool_base(void) + return omap_secure_memblock_base; + } + ++#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM) + u32 omap3_save_secure_ram(void __iomem *addr, int size) + { + u32 ret; +@@ -91,6 +92,7 @@ u32 omap3_save_secure_ram(void __iomem *addr, int size) + + return ret; + } ++#endif + + /** + * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index fa20124c19d5..01bc0688d47d 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -107,7 +107,7 @@ static bool pgattr_change_is_safe(u64 old, u64 new) + * The following mapping attributes may be updated in live + * kernel mappings without the need for break-before-make. + */ +- static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE; ++ static const pteval_t mask = PTE_PXN | PTE_RDONLY | PTE_WRITE | PTE_NG; + + /* creating or taking down mappings is always safe */ + if (old == 0 || new == 0) +@@ -117,9 +117,9 @@ static bool pgattr_change_is_safe(u64 old, u64 new) + if ((old | new) & PTE_CONT) + return false; + +- /* Transitioning from Global to Non-Global is safe */ +- if (((old ^ new) == PTE_NG) && (new & PTE_NG)) +- return true; ++ /* Transitioning from Non-Global to Global is unsafe */ ++ if (old & ~new & PTE_NG) ++ return false; + + return ((old ^ new) & ~mask) == 0; + } +diff --git a/arch/mips/ath25/board.c b/arch/mips/ath25/board.c +index 9ab48ff80c1c..6d11ae581ea7 100644 +--- a/arch/mips/ath25/board.c ++++ b/arch/mips/ath25/board.c +@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t base, unsigned long size) + } + + board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL); ++ if (!board_data) ++ goto error; + ath25_board.config = (struct ath25_boarddata *)board_data; + memcpy_fromio(board_data, bcfg, 0x100); + if (broken_boarddata) { +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index 5b3a3f6a9ad3..d99f5242169e 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -2277,6 +2277,8 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + } + + host_data = kzalloc(sizeof(*host_data), GFP_KERNEL); ++ if (!host_data) ++ return -ENOMEM; + raw_spin_lock_init(&host_data->lock); + + addr = of_get_address(ciu_node, 0, NULL, NULL); +diff --git a/arch/mips/kernel/mips-cpc.c b/arch/mips/kernel/mips-cpc.c +index 19c88d770054..fcf9af492d60 100644 +--- a/arch/mips/kernel/mips-cpc.c ++++ b/arch/mips/kernel/mips-cpc.c +@@ -10,6 +10,8 @@ + + #include + #include ++#include ++#include + #include + + #include +@@ -22,6 +24,17 @@ static DEFINE_PER_CPU_ALIGNED(unsigned long, cpc_core_lock_flags); + + phys_addr_t __weak mips_cpc_default_phys_base(void) + { ++ struct device_node *cpc_node; ++ struct resource res; ++ int err; ++ ++ cpc_node = of_find_compatible_node(of_root, NULL, "mti,mips-cpc"); ++ if (cpc_node) { ++ err = of_address_to_resource(cpc_node, 0, &res); ++ if (!err) ++ return res.start; ++ } ++ + return 0; + } + +diff --git a/arch/mips/kernel/smp-bmips.c b/arch/mips/kernel/smp-bmips.c +index 87dcac2447c8..382d12eb88f0 100644 +--- a/arch/mips/kernel/smp-bmips.c ++++ b/arch/mips/kernel/smp-bmips.c +@@ -168,11 +168,11 @@ static void bmips_prepare_cpus(unsigned int max_cpus) + return; + } + +- if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi0", NULL)) ++ if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL)) + panic("Can't request IPI0 interrupt"); +- if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU, +- "smp_ipi1", NULL)) ++ if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, ++ IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL)) + panic("Can't request IPI1 interrupt"); + } + +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index f4f12ecd0cec..0fa3a788dd20 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -2119,6 +2119,7 @@ static void sca_add_vcpu(struct kvm_vcpu *vcpu) + /* we still need the basic sca for the ipte control */ + vcpu->arch.sie_block->scaoh = (__u32)(((__u64)sca) >> 32); + vcpu->arch.sie_block->scaol = (__u32)(__u64)sca; ++ return; + } + read_lock(&vcpu->kvm->arch.sca_lock); + if (vcpu->kvm->arch.use_esca) { +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 559b37bf5a2e..7483cd514c32 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -431,6 +431,7 @@ config GOLDFISH + config RETPOLINE + bool "Avoid speculative indirect branches in kernel" + default y ++ select STACK_VALIDATION if HAVE_STACK_VALIDATION + help + Compile kernel with the retpoline compiler options to guard against + kernel-to-user data leaks by avoiding speculative indirect +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index fad55160dcb9..498c1b812300 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -232,10 +232,9 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables + + # Avoid indirect branches in kernel to deal with Spectre + ifdef CONFIG_RETPOLINE +- RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register) +- ifneq ($(RETPOLINE_CFLAGS),) +- KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE +- endif ++ifneq ($(RETPOLINE_CFLAGS),) ++ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE ++endif + endif + + archscripts: scripts_basic +diff --git a/arch/x86/entry/calling.h b/arch/x86/entry/calling.h +index dce7092ab24a..5d10b7a85cad 100644 +--- a/arch/x86/entry/calling.h ++++ b/arch/x86/entry/calling.h +@@ -97,7 +97,7 @@ For 32-bit we have the following conventions - kernel is built with + + #define SIZEOF_PTREGS 21*8 + +-.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax ++.macro PUSH_AND_CLEAR_REGS rdx=%rdx rax=%rax save_ret=0 + /* + * Push registers and sanitize registers of values that a + * speculation attack might otherwise want to exploit. The +@@ -105,32 +105,41 @@ For 32-bit we have the following conventions - kernel is built with + * could be put to use in a speculative execution gadget. + * Interleave XOR with PUSH for better uop scheduling: + */ ++ .if \save_ret ++ pushq %rsi /* pt_regs->si */ ++ movq 8(%rsp), %rsi /* temporarily store the return address in %rsi */ ++ movq %rdi, 8(%rsp) /* pt_regs->di (overwriting original return address) */ ++ .else + pushq %rdi /* pt_regs->di */ + pushq %rsi /* pt_regs->si */ ++ .endif + pushq \rdx /* pt_regs->dx */ + pushq %rcx /* pt_regs->cx */ + pushq \rax /* pt_regs->ax */ + pushq %r8 /* pt_regs->r8 */ +- xorq %r8, %r8 /* nospec r8 */ ++ xorl %r8d, %r8d /* nospec r8 */ + pushq %r9 /* pt_regs->r9 */ +- xorq %r9, %r9 /* nospec r9 */ ++ xorl %r9d, %r9d /* nospec r9 */ + pushq %r10 /* pt_regs->r10 */ +- xorq %r10, %r10 /* nospec r10 */ ++ xorl %r10d, %r10d /* nospec r10 */ + pushq %r11 /* pt_regs->r11 */ +- xorq %r11, %r11 /* nospec r11*/ ++ xorl %r11d, %r11d /* nospec r11*/ + pushq %rbx /* pt_regs->rbx */ + xorl %ebx, %ebx /* nospec rbx*/ + pushq %rbp /* pt_regs->rbp */ + xorl %ebp, %ebp /* nospec rbp*/ + pushq %r12 /* pt_regs->r12 */ +- xorq %r12, %r12 /* nospec r12*/ ++ xorl %r12d, %r12d /* nospec r12*/ + pushq %r13 /* pt_regs->r13 */ +- xorq %r13, %r13 /* nospec r13*/ ++ xorl %r13d, %r13d /* nospec r13*/ + pushq %r14 /* pt_regs->r14 */ +- xorq %r14, %r14 /* nospec r14*/ ++ xorl %r14d, %r14d /* nospec r14*/ + pushq %r15 /* pt_regs->r15 */ +- xorq %r15, %r15 /* nospec r15*/ ++ xorl %r15d, %r15d /* nospec r15*/ + UNWIND_HINT_REGS ++ .if \save_ret ++ pushq %rsi /* return address on top of stack */ ++ .endif + .endm + + .macro POP_REGS pop_rdi=1 skip_r11rcx=0 +diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S +index 2a35b1e0fb90..60c4c342316c 100644 +--- a/arch/x86/entry/entry_32.S ++++ b/arch/x86/entry/entry_32.S +@@ -252,8 +252,7 @@ ENTRY(__switch_to_asm) + * exist, overwrite the RSB with entries which capture + * speculative execution to prevent attack. + */ +- /* Clobbers %ebx */ +- FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW ++ FILL_RETURN_BUFFER %ebx, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW + #endif + + /* restore callee-saved registers */ +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 68a2d76e4f8f..6f3cc15e0c73 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -360,8 +360,7 @@ ENTRY(__switch_to_asm) + * exist, overwrite the RSB with entries which capture + * speculative execution to prevent attack. + */ +- /* Clobbers %rbx */ +- FILL_RETURN_BUFFER RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW ++ FILL_RETURN_BUFFER %r12, RSB_CLEAR_LOOPS, X86_FEATURE_RSB_CTXSW + #endif + + /* restore callee-saved registers */ +@@ -867,12 +866,8 @@ ENTRY(\sym) + pushq $-1 /* ORIG_RAX: no syscall to restart */ + .endif + +- /* Save all registers in pt_regs */ +- PUSH_AND_CLEAR_REGS +- ENCODE_FRAME_POINTER +- + .if \paranoid < 2 +- testb $3, CS(%rsp) /* If coming from userspace, switch stacks */ ++ testb $3, CS-ORIG_RAX(%rsp) /* If coming from userspace, switch stacks */ + jnz .Lfrom_usermode_switch_stack_\@ + .endif + +@@ -1117,13 +1112,15 @@ idtentry machine_check do_mce has_error_code=0 paranoid=1 + #endif + + /* +- * Switch gs if needed. ++ * Save all registers in pt_regs, and switch gs if needed. + * Use slow, but surefire "are we in kernel?" check. + * Return: ebx=0: need swapgs on exit, ebx=1: otherwise + */ + ENTRY(paranoid_entry) + UNWIND_HINT_FUNC + cld ++ PUSH_AND_CLEAR_REGS save_ret=1 ++ ENCODE_FRAME_POINTER 8 + movl $1, %ebx + movl $MSR_GS_BASE, %ecx + rdmsr +@@ -1168,12 +1165,14 @@ ENTRY(paranoid_exit) + END(paranoid_exit) + + /* +- * Switch gs if needed. ++ * Save all registers in pt_regs, and switch GS if needed. + * Return: EBX=0: came from user mode; EBX=1: otherwise + */ + ENTRY(error_entry) +- UNWIND_HINT_REGS offset=8 ++ UNWIND_HINT_FUNC + cld ++ PUSH_AND_CLEAR_REGS save_ret=1 ++ ENCODE_FRAME_POINTER 8 + testb $3, CS+8(%rsp) + jz .Lerror_kernelspace + +@@ -1564,8 +1563,6 @@ end_repeat_nmi: + * frame to point back to repeat_nmi. + */ + pushq $-1 /* ORIG_RAX: no syscall to restart */ +- PUSH_AND_CLEAR_REGS +- ENCODE_FRAME_POINTER + + /* + * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit +diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S +index fd65e016e413..364ea4a207be 100644 +--- a/arch/x86/entry/entry_64_compat.S ++++ b/arch/x86/entry/entry_64_compat.S +@@ -85,25 +85,25 @@ ENTRY(entry_SYSENTER_compat) + pushq %rcx /* pt_regs->cx */ + pushq $-ENOSYS /* pt_regs->ax */ + pushq $0 /* pt_regs->r8 = 0 */ +- xorq %r8, %r8 /* nospec r8 */ ++ xorl %r8d, %r8d /* nospec r8 */ + pushq $0 /* pt_regs->r9 = 0 */ +- xorq %r9, %r9 /* nospec r9 */ ++ xorl %r9d, %r9d /* nospec r9 */ + pushq $0 /* pt_regs->r10 = 0 */ +- xorq %r10, %r10 /* nospec r10 */ ++ xorl %r10d, %r10d /* nospec r10 */ + pushq $0 /* pt_regs->r11 = 0 */ +- xorq %r11, %r11 /* nospec r11 */ ++ xorl %r11d, %r11d /* nospec r11 */ + pushq %rbx /* pt_regs->rbx */ + xorl %ebx, %ebx /* nospec rbx */ + pushq %rbp /* pt_regs->rbp (will be overwritten) */ + xorl %ebp, %ebp /* nospec rbp */ + pushq $0 /* pt_regs->r12 = 0 */ +- xorq %r12, %r12 /* nospec r12 */ ++ xorl %r12d, %r12d /* nospec r12 */ + pushq $0 /* pt_regs->r13 = 0 */ +- xorq %r13, %r13 /* nospec r13 */ ++ xorl %r13d, %r13d /* nospec r13 */ + pushq $0 /* pt_regs->r14 = 0 */ +- xorq %r14, %r14 /* nospec r14 */ ++ xorl %r14d, %r14d /* nospec r14 */ + pushq $0 /* pt_regs->r15 = 0 */ +- xorq %r15, %r15 /* nospec r15 */ ++ xorl %r15d, %r15d /* nospec r15 */ + cld + + /* +@@ -224,25 +224,25 @@ GLOBAL(entry_SYSCALL_compat_after_hwframe) + pushq %rbp /* pt_regs->cx (stashed in bp) */ + pushq $-ENOSYS /* pt_regs->ax */ + pushq $0 /* pt_regs->r8 = 0 */ +- xorq %r8, %r8 /* nospec r8 */ ++ xorl %r8d, %r8d /* nospec r8 */ + pushq $0 /* pt_regs->r9 = 0 */ +- xorq %r9, %r9 /* nospec r9 */ ++ xorl %r9d, %r9d /* nospec r9 */ + pushq $0 /* pt_regs->r10 = 0 */ +- xorq %r10, %r10 /* nospec r10 */ ++ xorl %r10d, %r10d /* nospec r10 */ + pushq $0 /* pt_regs->r11 = 0 */ +- xorq %r11, %r11 /* nospec r11 */ ++ xorl %r11d, %r11d /* nospec r11 */ + pushq %rbx /* pt_regs->rbx */ + xorl %ebx, %ebx /* nospec rbx */ + pushq %rbp /* pt_regs->rbp (will be overwritten) */ + xorl %ebp, %ebp /* nospec rbp */ + pushq $0 /* pt_regs->r12 = 0 */ +- xorq %r12, %r12 /* nospec r12 */ ++ xorl %r12d, %r12d /* nospec r12 */ + pushq $0 /* pt_regs->r13 = 0 */ +- xorq %r13, %r13 /* nospec r13 */ ++ xorl %r13d, %r13d /* nospec r13 */ + pushq $0 /* pt_regs->r14 = 0 */ +- xorq %r14, %r14 /* nospec r14 */ ++ xorl %r14d, %r14d /* nospec r14 */ + pushq $0 /* pt_regs->r15 = 0 */ +- xorq %r15, %r15 /* nospec r15 */ ++ xorl %r15d, %r15d /* nospec r15 */ + + /* + * User mode is traced as though IRQs are on, and SYSENTER +@@ -298,9 +298,9 @@ sysret32_from_system_call: + */ + SWITCH_TO_USER_CR3_NOSTACK scratch_reg=%r8 scratch_reg2=%r9 + +- xorq %r8, %r8 +- xorq %r9, %r9 +- xorq %r10, %r10 ++ xorl %r8d, %r8d ++ xorl %r9d, %r9d ++ xorl %r10d, %r10d + swapgs + sysretl + END(entry_SYSCALL_compat) +@@ -358,25 +358,25 @@ ENTRY(entry_INT80_compat) + pushq %rcx /* pt_regs->cx */ + pushq $-ENOSYS /* pt_regs->ax */ + pushq $0 /* pt_regs->r8 = 0 */ +- xorq %r8, %r8 /* nospec r8 */ ++ xorl %r8d, %r8d /* nospec r8 */ + pushq $0 /* pt_regs->r9 = 0 */ +- xorq %r9, %r9 /* nospec r9 */ ++ xorl %r9d, %r9d /* nospec r9 */ + pushq $0 /* pt_regs->r10 = 0 */ +- xorq %r10, %r10 /* nospec r10 */ ++ xorl %r10d, %r10d /* nospec r10 */ + pushq $0 /* pt_regs->r11 = 0 */ +- xorq %r11, %r11 /* nospec r11 */ ++ xorl %r11d, %r11d /* nospec r11 */ + pushq %rbx /* pt_regs->rbx */ + xorl %ebx, %ebx /* nospec rbx */ + pushq %rbp /* pt_regs->rbp */ + xorl %ebp, %ebp /* nospec rbp */ + pushq %r12 /* pt_regs->r12 */ +- xorq %r12, %r12 /* nospec r12 */ ++ xorl %r12d, %r12d /* nospec r12 */ + pushq %r13 /* pt_regs->r13 */ +- xorq %r13, %r13 /* nospec r13 */ ++ xorl %r13d, %r13d /* nospec r13 */ + pushq %r14 /* pt_regs->r14 */ +- xorq %r14, %r14 /* nospec r14 */ ++ xorl %r14d, %r14d /* nospec r14 */ + pushq %r15 /* pt_regs->r15 */ +- xorq %r15, %r15 /* nospec r15 */ ++ xorl %r15d, %r15d /* nospec r15 */ + cld + + /* +diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h +index 4d4015ddcf26..c356098b6fb9 100644 +--- a/arch/x86/include/asm/apm.h ++++ b/arch/x86/include/asm/apm.h +@@ -7,6 +7,8 @@ + #ifndef _ASM_X86_MACH_DEFAULT_APM_H + #define _ASM_X86_MACH_DEFAULT_APM_H + ++#include ++ + #ifdef APM_ZERO_SEGS + # define APM_DO_ZERO_SEGS \ + "pushl %%ds\n\t" \ +@@ -32,6 +34,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, + * N.B. We do NOT need a cld after the BIOS call + * because we always save and restore the flags. + */ ++ firmware_restrict_branch_speculation_start(); + __asm__ __volatile__(APM_DO_ZERO_SEGS + "pushl %%edi\n\t" + "pushl %%ebp\n\t" +@@ -44,6 +47,7 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, + "=S" (*esi) + : "a" (func), "b" (ebx_in), "c" (ecx_in) + : "memory", "cc"); ++ firmware_restrict_branch_speculation_end(); + } + + static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, +@@ -56,6 +60,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, + * N.B. We do NOT need a cld after the BIOS call + * because we always save and restore the flags. + */ ++ firmware_restrict_branch_speculation_start(); + __asm__ __volatile__(APM_DO_ZERO_SEGS + "pushl %%edi\n\t" + "pushl %%ebp\n\t" +@@ -68,6 +73,7 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, + "=S" (si) + : "a" (func), "b" (ebx_in), "c" (ecx_in) + : "memory", "cc"); ++ firmware_restrict_branch_speculation_end(); + return error; + } + +diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h +index 4d111616524b..1908214b9125 100644 +--- a/arch/x86/include/asm/asm-prototypes.h ++++ b/arch/x86/include/asm/asm-prototypes.h +@@ -38,7 +38,4 @@ INDIRECT_THUNK(dx) + INDIRECT_THUNK(si) + INDIRECT_THUNK(di) + INDIRECT_THUNK(bp) +-asmlinkage void __fill_rsb(void); +-asmlinkage void __clear_rsb(void); +- + #endif /* CONFIG_RETPOLINE */ +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 73b5fff159a4..66c14347c502 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -211,6 +211,7 @@ + #define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ + + #define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ ++#define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ + + /* Virtualization flags: Linux defined, word 8 */ + #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ +diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h +index 85f6ccb80b91..a399c1ebf6f0 100644 +--- a/arch/x86/include/asm/efi.h ++++ b/arch/x86/include/asm/efi.h +@@ -6,6 +6,7 @@ + #include + #include + #include ++#include + + /* + * We map the EFI regions needed for runtime services non-contiguously, +@@ -36,8 +37,18 @@ + + extern asmlinkage unsigned long efi_call_phys(void *, ...); + +-#define arch_efi_call_virt_setup() kernel_fpu_begin() +-#define arch_efi_call_virt_teardown() kernel_fpu_end() ++#define arch_efi_call_virt_setup() \ ++({ \ ++ kernel_fpu_begin(); \ ++ firmware_restrict_branch_speculation_start(); \ ++}) ++ ++#define arch_efi_call_virt_teardown() \ ++({ \ ++ firmware_restrict_branch_speculation_end(); \ ++ kernel_fpu_end(); \ ++}) ++ + + /* + * Wrap all the virtual calls in a way that forces the parameters on the stack. +@@ -73,6 +84,7 @@ struct efi_scratch { + efi_sync_low_kernel_mappings(); \ + preempt_disable(); \ + __kernel_fpu_begin(); \ ++ firmware_restrict_branch_speculation_start(); \ + \ + if (efi_scratch.use_pgd) { \ + efi_scratch.prev_cr3 = __read_cr3(); \ +@@ -91,6 +103,7 @@ struct efi_scratch { + __flush_tlb_all(); \ + } \ + \ ++ firmware_restrict_branch_speculation_end(); \ + __kernel_fpu_end(); \ + preempt_enable(); \ + }) +diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h +index c931b88982a0..1de72ce514cd 100644 +--- a/arch/x86/include/asm/mmu_context.h ++++ b/arch/x86/include/asm/mmu_context.h +@@ -74,6 +74,7 @@ static inline void *ldt_slot_va(int slot) + return (void *)(LDT_BASE_ADDR + LDT_SLOT_STRIDE * slot); + #else + BUG(); ++ return (void *)fix_to_virt(FIX_HOLE); + #endif + } + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index 81a1be326571..d0dabeae0505 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -8,6 +8,50 @@ + #include + #include + ++/* ++ * Fill the CPU return stack buffer. ++ * ++ * Each entry in the RSB, if used for a speculative 'ret', contains an ++ * infinite 'pause; lfence; jmp' loop to capture speculative execution. ++ * ++ * This is required in various cases for retpoline and IBRS-based ++ * mitigations for the Spectre variant 2 vulnerability. Sometimes to ++ * eliminate potentially bogus entries from the RSB, and sometimes ++ * purely to ensure that it doesn't get empty, which on some CPUs would ++ * allow predictions from other (unwanted!) sources to be used. ++ * ++ * We define a CPP macro such that it can be used from both .S files and ++ * inline assembly. It's possible to do a .macro and then include that ++ * from C via asm(".include ") but let's not go there. ++ */ ++ ++#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */ ++#define RSB_FILL_LOOPS 16 /* To avoid underflow */ ++ ++/* ++ * Google experimented with loop-unrolling and this turned out to be ++ * the optimal version — two calls, each with their own speculation ++ * trap should their return address end up getting used, in a loop. ++ */ ++#define __FILL_RETURN_BUFFER(reg, nr, sp) \ ++ mov $(nr/2), reg; \ ++771: \ ++ call 772f; \ ++773: /* speculation trap */ \ ++ pause; \ ++ lfence; \ ++ jmp 773b; \ ++772: \ ++ call 774f; \ ++775: /* speculation trap */ \ ++ pause; \ ++ lfence; \ ++ jmp 775b; \ ++774: \ ++ dec reg; \ ++ jnz 771b; \ ++ add $(BITS_PER_LONG/8) * nr, sp; ++ + #ifdef __ASSEMBLY__ + + /* +@@ -23,6 +67,18 @@ + .popsection + .endm + ++/* ++ * This should be used immediately before an indirect jump/call. It tells ++ * objtool the subsequent indirect jump/call is vouched safe for retpoline ++ * builds. ++ */ ++.macro ANNOTATE_RETPOLINE_SAFE ++ .Lannotate_\@: ++ .pushsection .discard.retpoline_safe ++ _ASM_PTR .Lannotate_\@ ++ .popsection ++.endm ++ + /* + * These are the bare retpoline primitives for indirect jmp and call. + * Do not use these directly; they only exist to make the ALTERNATIVE +@@ -59,9 +115,9 @@ + .macro JMP_NOSPEC reg:req + #ifdef CONFIG_RETPOLINE + ANNOTATE_NOSPEC_ALTERNATIVE +- ALTERNATIVE_2 __stringify(jmp *\reg), \ ++ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; jmp *\reg), \ + __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \ +- __stringify(lfence; jmp *\reg), X86_FEATURE_RETPOLINE_AMD ++ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; jmp *\reg), X86_FEATURE_RETPOLINE_AMD + #else + jmp *\reg + #endif +@@ -70,18 +126,25 @@ + .macro CALL_NOSPEC reg:req + #ifdef CONFIG_RETPOLINE + ANNOTATE_NOSPEC_ALTERNATIVE +- ALTERNATIVE_2 __stringify(call *\reg), \ ++ ALTERNATIVE_2 __stringify(ANNOTATE_RETPOLINE_SAFE; call *\reg), \ + __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\ +- __stringify(lfence; call *\reg), X86_FEATURE_RETPOLINE_AMD ++ __stringify(lfence; ANNOTATE_RETPOLINE_SAFE; call *\reg), X86_FEATURE_RETPOLINE_AMD + #else + call *\reg + #endif + .endm + +-/* This clobbers the BX register */ +-.macro FILL_RETURN_BUFFER nr:req ftr:req ++ /* ++ * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP ++ * monstrosity above, manually. ++ */ ++.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req + #ifdef CONFIG_RETPOLINE +- ALTERNATIVE "", "call __clear_rsb", \ftr ++ ANNOTATE_NOSPEC_ALTERNATIVE ++ ALTERNATIVE "jmp .Lskip_rsb_\@", \ ++ __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \ ++ \ftr ++.Lskip_rsb_\@: + #endif + .endm + +@@ -93,6 +156,12 @@ + ".long 999b - .\n\t" \ + ".popsection\n\t" + ++#define ANNOTATE_RETPOLINE_SAFE \ ++ "999:\n\t" \ ++ ".pushsection .discard.retpoline_safe\n\t" \ ++ _ASM_PTR " 999b\n\t" \ ++ ".popsection\n\t" ++ + #if defined(CONFIG_X86_64) && defined(RETPOLINE) + + /* +@@ -102,6 +171,7 @@ + # define CALL_NOSPEC \ + ANNOTATE_NOSPEC_ALTERNATIVE \ + ALTERNATIVE( \ ++ ANNOTATE_RETPOLINE_SAFE \ + "call *%[thunk_target]\n", \ + "call __x86_indirect_thunk_%V[thunk_target]\n", \ + X86_FEATURE_RETPOLINE) +@@ -156,26 +226,54 @@ extern char __indirect_thunk_end[]; + static inline void vmexit_fill_RSB(void) + { + #ifdef CONFIG_RETPOLINE +- alternative_input("", +- "call __fill_rsb", +- X86_FEATURE_RETPOLINE, +- ASM_NO_INPUT_CLOBBER(_ASM_BX, "memory")); ++ unsigned long loops; ++ ++ asm volatile (ANNOTATE_NOSPEC_ALTERNATIVE ++ ALTERNATIVE("jmp 910f", ++ __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)), ++ X86_FEATURE_RETPOLINE) ++ "910:" ++ : "=r" (loops), ASM_CALL_CONSTRAINT ++ : : "memory" ); + #endif + } + ++#define alternative_msr_write(_msr, _val, _feature) \ ++ asm volatile(ALTERNATIVE("", \ ++ "movl %[msr], %%ecx\n\t" \ ++ "movl %[val], %%eax\n\t" \ ++ "movl $0, %%edx\n\t" \ ++ "wrmsr", \ ++ _feature) \ ++ : : [msr] "i" (_msr), [val] "i" (_val) \ ++ : "eax", "ecx", "edx", "memory") ++ + static inline void indirect_branch_prediction_barrier(void) + { +- asm volatile(ALTERNATIVE("", +- "movl %[msr], %%ecx\n\t" +- "movl %[val], %%eax\n\t" +- "movl $0, %%edx\n\t" +- "wrmsr", +- X86_FEATURE_USE_IBPB) +- : : [msr] "i" (MSR_IA32_PRED_CMD), +- [val] "i" (PRED_CMD_IBPB) +- : "eax", "ecx", "edx", "memory"); ++ alternative_msr_write(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, ++ X86_FEATURE_USE_IBPB); + } + ++/* ++ * With retpoline, we must use IBRS to restrict branch prediction ++ * before calling into firmware. ++ * ++ * (Implemented as CPP macros due to header hell.) ++ */ ++#define firmware_restrict_branch_speculation_start() \ ++do { \ ++ preempt_disable(); \ ++ alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS, \ ++ X86_FEATURE_USE_IBRS_FW); \ ++} while (0) ++ ++#define firmware_restrict_branch_speculation_end() \ ++do { \ ++ alternative_msr_write(MSR_IA32_SPEC_CTRL, 0, \ ++ X86_FEATURE_USE_IBRS_FW); \ ++ preempt_enable(); \ ++} while (0) ++ + #endif /* __ASSEMBLY__ */ + + /* +diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h +index 554841fab717..c83a2f418cea 100644 +--- a/arch/x86/include/asm/paravirt.h ++++ b/arch/x86/include/asm/paravirt.h +@@ -7,6 +7,7 @@ + #ifdef CONFIG_PARAVIRT + #include + #include ++#include + + #include + +@@ -879,23 +880,27 @@ extern void default_banner(void); + + #define INTERRUPT_RETURN \ + PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_iret), CLBR_NONE, \ +- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret)) ++ ANNOTATE_RETPOLINE_SAFE; \ ++ jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_iret);) + + #define DISABLE_INTERRUPTS(clobbers) \ + PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_disable), clobbers, \ + PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \ ++ ANNOTATE_RETPOLINE_SAFE; \ + call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_disable); \ + PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);) + + #define ENABLE_INTERRUPTS(clobbers) \ + PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_enable), clobbers, \ + PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \ ++ ANNOTATE_RETPOLINE_SAFE; \ + call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_enable); \ + PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);) + + #ifdef CONFIG_X86_32 + #define GET_CR0_INTO_EAX \ + push %ecx; push %edx; \ ++ ANNOTATE_RETPOLINE_SAFE; \ + call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \ + pop %edx; pop %ecx + #else /* !CONFIG_X86_32 */ +@@ -917,21 +922,25 @@ extern void default_banner(void); + */ + #define SWAPGS \ + PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_swapgs), CLBR_NONE, \ +- call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs) \ ++ ANNOTATE_RETPOLINE_SAFE; \ ++ call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs); \ + ) + + #define GET_CR2_INTO_RAX \ +- call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2) ++ ANNOTATE_RETPOLINE_SAFE; \ ++ call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr2); + + #define USERGS_SYSRET64 \ + PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret64), \ + CLBR_NONE, \ +- jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64)) ++ ANNOTATE_RETPOLINE_SAFE; \ ++ jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_usergs_sysret64);) + + #ifdef CONFIG_DEBUG_ENTRY + #define SAVE_FLAGS(clobbers) \ + PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_save_fl), clobbers, \ + PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE); \ ++ ANNOTATE_RETPOLINE_SAFE; \ + call PARA_INDIRECT(pv_irq_ops+PV_IRQ_save_fl); \ + PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);) + #endif +diff --git a/arch/x86/include/asm/paravirt_types.h b/arch/x86/include/asm/paravirt_types.h +index f624f1f10316..180bc0bff0fb 100644 +--- a/arch/x86/include/asm/paravirt_types.h ++++ b/arch/x86/include/asm/paravirt_types.h +@@ -43,6 +43,7 @@ + #include + #include + #include ++#include + + struct page; + struct thread_struct; +@@ -392,7 +393,9 @@ int paravirt_disable_iospace(void); + * offset into the paravirt_patch_template structure, and can therefore be + * freely converted back into a structure offset. + */ +-#define PARAVIRT_CALL "call *%c[paravirt_opptr];" ++#define PARAVIRT_CALL \ ++ ANNOTATE_RETPOLINE_SAFE \ ++ "call *%c[paravirt_opptr];" + + /* + * These macros are intended to wrap calls through one of the paravirt +diff --git a/arch/x86/include/asm/refcount.h b/arch/x86/include/asm/refcount.h +index 4e44250e7d0d..d65171120e90 100644 +--- a/arch/x86/include/asm/refcount.h ++++ b/arch/x86/include/asm/refcount.h +@@ -67,13 +67,13 @@ static __always_inline __must_check + bool refcount_sub_and_test(unsigned int i, refcount_t *r) + { + GEN_BINARY_SUFFIXED_RMWcc(LOCK_PREFIX "subl", REFCOUNT_CHECK_LT_ZERO, +- r->refs.counter, "er", i, "%0", e); ++ r->refs.counter, "er", i, "%0", e, "cx"); + } + + static __always_inline __must_check bool refcount_dec_and_test(refcount_t *r) + { + GEN_UNARY_SUFFIXED_RMWcc(LOCK_PREFIX "decl", REFCOUNT_CHECK_LT_ZERO, +- r->refs.counter, "%0", e); ++ r->refs.counter, "%0", e, "cx"); + } + + static __always_inline __must_check +diff --git a/arch/x86/include/asm/rmwcc.h b/arch/x86/include/asm/rmwcc.h +index f91c365e57c3..4914a3e7c803 100644 +--- a/arch/x86/include/asm/rmwcc.h ++++ b/arch/x86/include/asm/rmwcc.h +@@ -2,8 +2,7 @@ + #ifndef _ASM_X86_RMWcc + #define _ASM_X86_RMWcc + +-#define __CLOBBERS_MEM "memory" +-#define __CLOBBERS_MEM_CC_CX "memory", "cc", "cx" ++#define __CLOBBERS_MEM(clb...) "memory", ## clb + + #if !defined(__GCC_ASM_FLAG_OUTPUTS__) && defined(CC_HAVE_ASM_GOTO) + +@@ -40,18 +39,19 @@ do { \ + #endif /* defined(__GCC_ASM_FLAG_OUTPUTS__) || !defined(CC_HAVE_ASM_GOTO) */ + + #define GEN_UNARY_RMWcc(op, var, arg0, cc) \ +- __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM) ++ __GEN_RMWcc(op " " arg0, var, cc, __CLOBBERS_MEM()) + +-#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc) \ ++#define GEN_UNARY_SUFFIXED_RMWcc(op, suffix, var, arg0, cc, clobbers...)\ + __GEN_RMWcc(op " " arg0 "\n\t" suffix, var, cc, \ +- __CLOBBERS_MEM_CC_CX) ++ __CLOBBERS_MEM(clobbers)) + + #define GEN_BINARY_RMWcc(op, var, vcon, val, arg0, cc) \ + __GEN_RMWcc(op __BINARY_RMWcc_ARG arg0, var, cc, \ +- __CLOBBERS_MEM, vcon (val)) ++ __CLOBBERS_MEM(), vcon (val)) + +-#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc) \ ++#define GEN_BINARY_SUFFIXED_RMWcc(op, suffix, var, vcon, val, arg0, cc, \ ++ clobbers...) \ + __GEN_RMWcc(op __BINARY_RMWcc_ARG arg0 "\n\t" suffix, var, cc, \ +- __CLOBBERS_MEM_CC_CX, vcon (val)) ++ __CLOBBERS_MEM(clobbers), vcon (val)) + + #endif /* _ASM_X86_RMWcc */ +diff --git a/arch/x86/include/asm/sections.h b/arch/x86/include/asm/sections.h +index d6baf23782bc..5c019d23d06b 100644 +--- a/arch/x86/include/asm/sections.h ++++ b/arch/x86/include/asm/sections.h +@@ -10,6 +10,7 @@ extern struct exception_table_entry __stop___ex_table[]; + + #if defined(CONFIG_X86_64) + extern char __end_rodata_hpage_align[]; ++extern char __entry_trampoline_start[], __entry_trampoline_end[]; + #endif + + #endif /* _ASM_X86_SECTIONS_H */ +diff --git a/arch/x86/include/uapi/asm/mce.h b/arch/x86/include/uapi/asm/mce.h +index 91723461dc1f..435db58a7bad 100644 +--- a/arch/x86/include/uapi/asm/mce.h ++++ b/arch/x86/include/uapi/asm/mce.h +@@ -30,6 +30,7 @@ struct mce { + __u64 synd; /* MCA_SYND MSR: only valid on SMCA systems */ + __u64 ipid; /* MCA_IPID MSR: only valid on SMCA systems */ + __u64 ppin; /* Protected Processor Inventory Number */ ++ __u32 microcode;/* Microcode revision */ + }; + + #define MCE_GET_RECORD_LEN _IOR('M', 1, int) +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index d71c8b54b696..bfca937bdcc3 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -300,6 +300,15 @@ static void __init spectre_v2_select_mitigation(void) + setup_force_cpu_cap(X86_FEATURE_USE_IBPB); + pr_info("Spectre v2 mitigation: Enabling Indirect Branch Prediction Barrier\n"); + } ++ ++ /* ++ * Retpoline means the kernel is safe because it has no indirect ++ * branches. But firmware isn't, so use IBRS to protect that. ++ */ ++ if (boot_cpu_has(X86_FEATURE_IBRS)) { ++ setup_force_cpu_cap(X86_FEATURE_USE_IBRS_FW); ++ pr_info("Enabling Restricted Speculation for firmware calls\n"); ++ } + } + + #undef pr_fmt +@@ -326,8 +335,9 @@ ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, c + if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) + return sprintf(buf, "Not affected\n"); + +- return sprintf(buf, "%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ++ return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], + boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "", ++ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", + spectre_v2_module_string()); + } + #endif +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index d19e903214b4..4aa9fd379390 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -144,6 +144,13 @@ static bool bad_spectre_microcode(struct cpuinfo_x86 *c) + { + int i; + ++ /* ++ * We know that the hypervisor lie to us on the microcode version so ++ * we may as well hope that it is running the correct version. ++ */ ++ if (cpu_has(c, X86_FEATURE_HYPERVISOR)) ++ return false; ++ + for (i = 0; i < ARRAY_SIZE(spectre_bad_microcodes); i++) { + if (c->x86_model == spectre_bad_microcodes[i].model && + c->x86_stepping == spectre_bad_microcodes[i].stepping) +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 73237aa271ea..e13d652fc30a 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -57,6 +57,9 @@ + + static DEFINE_MUTEX(mce_log_mutex); + ++/* sysfs synchronization */ ++static DEFINE_MUTEX(mce_sysfs_mutex); ++ + #define CREATE_TRACE_POINTS + #include + +@@ -131,6 +134,8 @@ void mce_setup(struct mce *m) + + if (this_cpu_has(X86_FEATURE_INTEL_PPIN)) + rdmsrl(MSR_PPIN, m->ppin); ++ ++ m->microcode = boot_cpu_data.microcode; + } + + DEFINE_PER_CPU(struct mce, injectm); +@@ -263,7 +268,7 @@ static void __print_mce(struct mce *m) + */ + pr_emerg(HW_ERR "PROCESSOR %u:%x TIME %llu SOCKET %u APIC %x microcode %x\n", + m->cpuvendor, m->cpuid, m->time, m->socketid, m->apicid, +- cpu_data(m->extcpu).microcode); ++ m->microcode); + } + + static void print_mce(struct mce *m) +@@ -2081,6 +2086,7 @@ static ssize_t set_ignore_ce(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.ignore_ce ^ !!new) { + if (new) { + /* disable ce features */ +@@ -2093,6 +2099,8 @@ static ssize_t set_ignore_ce(struct device *s, + on_each_cpu(mce_enable_ce, (void *)1, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2105,6 +2113,7 @@ static ssize_t set_cmci_disabled(struct device *s, + if (kstrtou64(buf, 0, &new) < 0) + return -EINVAL; + ++ mutex_lock(&mce_sysfs_mutex); + if (mca_cfg.cmci_disabled ^ !!new) { + if (new) { + /* disable cmci */ +@@ -2116,6 +2125,8 @@ static ssize_t set_cmci_disabled(struct device *s, + on_each_cpu(mce_enable_ce, NULL, 1); + } + } ++ mutex_unlock(&mce_sysfs_mutex); ++ + return size; + } + +@@ -2123,8 +2134,19 @@ static ssize_t store_int_with_restart(struct device *s, + struct device_attribute *attr, + const char *buf, size_t size) + { +- ssize_t ret = device_store_int(s, attr, buf, size); ++ unsigned long old_check_interval = check_interval; ++ ssize_t ret = device_store_ulong(s, attr, buf, size); ++ ++ if (check_interval == old_check_interval) ++ return ret; ++ ++ if (check_interval < 1) ++ check_interval = 1; ++ ++ mutex_lock(&mce_sysfs_mutex); + mce_restart(); ++ mutex_unlock(&mce_sysfs_mutex); ++ + return ret; + } + +diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S +index 04a625f0fcda..0f545b3cf926 100644 +--- a/arch/x86/kernel/head_64.S ++++ b/arch/x86/kernel/head_64.S +@@ -23,6 +23,7 @@ + #include + #include "../entry/calling.h" + #include ++#include + + #ifdef CONFIG_PARAVIRT + #include +@@ -134,6 +135,7 @@ ENTRY(secondary_startup_64) + + /* Ensure I am executing from virtual addresses */ + movq $1f, %rax ++ ANNOTATE_RETPOLINE_SAFE + jmp *%rax + 1: + UNWIND_HINT_EMPTY +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index 0742491cbb73..ce06ec9c2323 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -1149,10 +1149,18 @@ NOKPROBE_SYMBOL(longjmp_break_handler); + + bool arch_within_kprobe_blacklist(unsigned long addr) + { ++ bool is_in_entry_trampoline_section = false; ++ ++#ifdef CONFIG_X86_64 ++ is_in_entry_trampoline_section = ++ (addr >= (unsigned long)__entry_trampoline_start && ++ addr < (unsigned long)__entry_trampoline_end); ++#endif + return (addr >= (unsigned long)__kprobes_text_start && + addr < (unsigned long)__kprobes_text_end) || + (addr >= (unsigned long)__entry_text_start && +- addr < (unsigned long)__entry_text_end); ++ addr < (unsigned long)__entry_text_end) || ++ is_in_entry_trampoline_section; + } + + int __init arch_init_kprobes(void) +diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S +index 9b138a06c1a4..b854ebf5851b 100644 +--- a/arch/x86/kernel/vmlinux.lds.S ++++ b/arch/x86/kernel/vmlinux.lds.S +@@ -118,9 +118,11 @@ SECTIONS + + #ifdef CONFIG_X86_64 + . = ALIGN(PAGE_SIZE); ++ VMLINUX_SYMBOL(__entry_trampoline_start) = .; + _entry_trampoline = .; + *(.entry_trampoline) + . = ALIGN(PAGE_SIZE); ++ VMLINUX_SYMBOL(__entry_trampoline_end) = .; + ASSERT(. - _entry_trampoline == PAGE_SIZE, "entry trampoline is too big"); + #endif + +diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile +index d0a3170e6804..d435c89875c1 100644 +--- a/arch/x86/lib/Makefile ++++ b/arch/x86/lib/Makefile +@@ -27,7 +27,6 @@ lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o + lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o + lib-$(CONFIG_RANDOMIZE_BASE) += kaslr.o + lib-$(CONFIG_RETPOLINE) += retpoline.o +-OBJECT_FILES_NON_STANDARD_retpoline.o :=y + + obj-y += msr.o msr-reg.o msr-reg-export.o hweight.o + +diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S +index 480edc3a5e03..c909961e678a 100644 +--- a/arch/x86/lib/retpoline.S ++++ b/arch/x86/lib/retpoline.S +@@ -7,7 +7,6 @@ + #include + #include + #include +-#include + + .macro THUNK reg + .section .text.__x86.indirect_thunk +@@ -47,58 +46,3 @@ GENERATE_THUNK(r13) + GENERATE_THUNK(r14) + GENERATE_THUNK(r15) + #endif +- +-/* +- * Fill the CPU return stack buffer. +- * +- * Each entry in the RSB, if used for a speculative 'ret', contains an +- * infinite 'pause; lfence; jmp' loop to capture speculative execution. +- * +- * This is required in various cases for retpoline and IBRS-based +- * mitigations for the Spectre variant 2 vulnerability. Sometimes to +- * eliminate potentially bogus entries from the RSB, and sometimes +- * purely to ensure that it doesn't get empty, which on some CPUs would +- * allow predictions from other (unwanted!) sources to be used. +- * +- * Google experimented with loop-unrolling and this turned out to be +- * the optimal version - two calls, each with their own speculation +- * trap should their return address end up getting used, in a loop. +- */ +-.macro STUFF_RSB nr:req sp:req +- mov $(\nr / 2), %_ASM_BX +- .align 16 +-771: +- call 772f +-773: /* speculation trap */ +- pause +- lfence +- jmp 773b +- .align 16 +-772: +- call 774f +-775: /* speculation trap */ +- pause +- lfence +- jmp 775b +- .align 16 +-774: +- dec %_ASM_BX +- jnz 771b +- add $((BITS_PER_LONG/8) * \nr), \sp +-.endm +- +-#define RSB_FILL_LOOPS 16 /* To avoid underflow */ +- +-ENTRY(__fill_rsb) +- STUFF_RSB RSB_FILL_LOOPS, %_ASM_SP +- ret +-END(__fill_rsb) +-EXPORT_SYMBOL_GPL(__fill_rsb) +- +-#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */ +- +-ENTRY(__clear_rsb) +- STUFF_RSB RSB_CLEAR_LOOPS, %_ASM_SP +- ret +-END(__clear_rsb) +-EXPORT_SYMBOL_GPL(__clear_rsb) +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 9150fe2c9b26..4c155ee0f89e 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -1252,10 +1252,6 @@ __do_page_fault(struct pt_regs *regs, unsigned long error_code, + tsk = current; + mm = tsk->mm; + +- /* +- * Detect and handle instructions that would cause a page fault for +- * both a tracked kernel page and a userspace page. +- */ + prefetchw(&mm->mmap_sem); + + if (unlikely(kmmio_fault(regs, address))) +diff --git a/arch/x86/mm/mem_encrypt_boot.S b/arch/x86/mm/mem_encrypt_boot.S +index 01f682cf77a8..40a6085063d6 100644 +--- a/arch/x86/mm/mem_encrypt_boot.S ++++ b/arch/x86/mm/mem_encrypt_boot.S +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + .text + .code64 +@@ -59,6 +60,7 @@ ENTRY(sme_encrypt_execute) + movq %rax, %r8 /* Workarea encryption routine */ + addq $PAGE_SIZE, %r8 /* Workarea intermediate copy buffer */ + ++ ANNOTATE_RETPOLINE_SAFE + call *%rax /* Call the encryption routine */ + + pop %r12 +diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S +index de53bd15df5a..24bb7598774e 100644 +--- a/arch/x86/realmode/rm/trampoline_64.S ++++ b/arch/x86/realmode/rm/trampoline_64.S +@@ -102,7 +102,7 @@ ENTRY(startup_32) + * don't we'll eventually crash trying to execute encrypted + * instructions. + */ +- bt $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags ++ btl $TH_FLAGS_SME_ACTIVE_BIT, pa_tr_flags + jnc .Ldone + movl $MSR_K8_SYSCFG, %ecx + rdmsr +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index a2a0dce5114e..19858a146f30 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -266,7 +266,7 @@ static int lo_write_bvec(struct file *file, struct bio_vec *bvec, loff_t *ppos) + struct iov_iter i; + ssize_t bw; + +- iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len); ++ iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len); + + file_start_write(file); + bw = vfs_iter_write(file, &i, ppos, 0); +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 3cec403a80b3..5294442505cb 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -413,6 +413,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + if (chip->dev.parent) + pm_runtime_get_sync(chip->dev.parent); + ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, true); ++ + /* Store the decision as chip->locality will be changed. */ + need_locality = chip->locality == -1; + +@@ -489,6 +492,9 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + chip->locality = -1; + } + out_no_locality: ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); ++ + if (chip->dev.parent) + pm_runtime_put_sync(chip->dev.parent); + +diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c +index ebd0e75a3e4d..50b59a69dc33 100644 +--- a/drivers/char/tpm/tpm_tis.c ++++ b/drivers/char/tpm/tpm_tis.c +@@ -132,93 +132,14 @@ static int check_acpi_tpm2(struct device *dev) + } + #endif + +-#ifdef CONFIG_X86 +-#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000 +-#define ILB_REMAP_SIZE 0x100 +-#define LPC_CNTRL_REG_OFFSET 0x84 +-#define LPC_CLKRUN_EN (1 << 2) +- +-static void __iomem *ilb_base_addr; +- +-static inline bool is_bsw(void) +-{ +- return ((boot_cpu_data.x86_model == INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0); +-} +- +-/** +- * tpm_platform_begin_xfer() - clear LPC CLKRUN_EN i.e. clocks will be running +- */ +-static void tpm_platform_begin_xfer(void) +-{ +- u32 clkrun_val; +- +- if (!is_bsw()) +- return; +- +- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET); +- +- /* Disable LPC CLKRUN# */ +- clkrun_val &= ~LPC_CLKRUN_EN; +- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET); +- +- /* +- * Write any random value on port 0x80 which is on LPC, to make +- * sure LPC clock is running before sending any TPM command. +- */ +- outb(0xCC, 0x80); +- +-} +- +-/** +- * tpm_platform_end_xfer() - set LPC CLKRUN_EN i.e. clocks can be turned off +- */ +-static void tpm_platform_end_xfer(void) +-{ +- u32 clkrun_val; +- +- if (!is_bsw()) +- return; +- +- clkrun_val = ioread32(ilb_base_addr + LPC_CNTRL_REG_OFFSET); +- +- /* Enable LPC CLKRUN# */ +- clkrun_val |= LPC_CLKRUN_EN; +- iowrite32(clkrun_val, ilb_base_addr + LPC_CNTRL_REG_OFFSET); +- +- /* +- * Write any random value on port 0x80 which is on LPC, to make +- * sure LPC clock is running before sending any TPM command. +- */ +- outb(0xCC, 0x80); +- +-} +-#else +-static inline bool is_bsw(void) +-{ +- return false; +-} +- +-static void tpm_platform_begin_xfer(void) +-{ +-} +- +-static void tpm_platform_end_xfer(void) +-{ +-} +-#endif +- + static int tpm_tcg_read_bytes(struct tpm_tis_data *data, u32 addr, u16 len, + u8 *result) + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +- tpm_platform_begin_xfer(); +- + while (len--) + *result++ = ioread8(phy->iobase + addr); + +- tpm_platform_end_xfer(); +- + return 0; + } + +@@ -227,13 +148,9 @@ static int tpm_tcg_write_bytes(struct tpm_tis_data *data, u32 addr, u16 len, + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +- tpm_platform_begin_xfer(); +- + while (len--) + iowrite8(*value++, phy->iobase + addr); + +- tpm_platform_end_xfer(); +- + return 0; + } + +@@ -241,12 +158,8 @@ static int tpm_tcg_read16(struct tpm_tis_data *data, u32 addr, u16 *result) + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +- tpm_platform_begin_xfer(); +- + *result = ioread16(phy->iobase + addr); + +- tpm_platform_end_xfer(); +- + return 0; + } + +@@ -254,12 +167,8 @@ static int tpm_tcg_read32(struct tpm_tis_data *data, u32 addr, u32 *result) + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +- tpm_platform_begin_xfer(); +- + *result = ioread32(phy->iobase + addr); + +- tpm_platform_end_xfer(); +- + return 0; + } + +@@ -267,12 +176,8 @@ static int tpm_tcg_write32(struct tpm_tis_data *data, u32 addr, u32 value) + { + struct tpm_tis_tcg_phy *phy = to_tpm_tis_tcg_phy(data); + +- tpm_platform_begin_xfer(); +- + iowrite32(value, phy->iobase + addr); + +- tpm_platform_end_xfer(); +- + return 0; + } + +@@ -460,11 +365,6 @@ static int __init init_tis(void) + if (rc) + goto err_force; + +-#ifdef CONFIG_X86 +- if (is_bsw()) +- ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR, +- ILB_REMAP_SIZE); +-#endif + rc = platform_driver_register(&tis_drv); + if (rc) + goto err_platform; +@@ -483,10 +383,6 @@ static int __init init_tis(void) + err_platform: + if (force_pdev) + platform_device_unregister(force_pdev); +-#ifdef CONFIG_X86 +- if (is_bsw()) +- iounmap(ilb_base_addr); +-#endif + err_force: + return rc; + } +@@ -496,10 +392,6 @@ static void __exit cleanup_tis(void) + pnp_unregister_driver(&tis_pnp_driver); + platform_driver_unregister(&tis_drv); + +-#ifdef CONFIG_X86 +- if (is_bsw()) +- iounmap(ilb_base_addr); +-#endif + if (force_pdev) + platform_device_unregister(force_pdev); + } +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index 083578b2517e..a21e31c2b952 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -31,6 +31,8 @@ + #include "tpm.h" + #include "tpm_tis_core.h" + ++static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value); ++ + /* Before we attempt to access the TPM we must see that the valid bit is set. + * The specification says that this bit is 0 at reset and remains 0 until the + * 'TPM has gone through its self test and initialization and has established +@@ -422,19 +424,28 @@ static bool tpm_tis_update_timeouts(struct tpm_chip *chip, + int i, rc; + u32 did_vid; + ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, true); ++ + rc = tpm_tis_read32(priv, TPM_DID_VID(0), &did_vid); + if (rc < 0) +- return rc; ++ goto out; + + for (i = 0; i != ARRAY_SIZE(vendor_timeout_overrides); i++) { + if (vendor_timeout_overrides[i].did_vid != did_vid) + continue; + memcpy(timeout_cap, vendor_timeout_overrides[i].timeout_us, + sizeof(vendor_timeout_overrides[i].timeout_us)); +- return true; ++ rc = true; + } + +- return false; ++ rc = false; ++ ++out: ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); ++ ++ return rc; + } + + /* +@@ -654,14 +665,73 @@ void tpm_tis_remove(struct tpm_chip *chip) + u32 interrupt; + int rc; + ++ tpm_tis_clkrun_enable(chip, true); ++ + rc = tpm_tis_read32(priv, reg, &interrupt); + if (rc < 0) + interrupt = 0; + + tpm_tis_write32(priv, reg, ~TPM_GLOBAL_INT_ENABLE & interrupt); ++ ++ tpm_tis_clkrun_enable(chip, false); ++ ++ if (priv->ilb_base_addr) ++ iounmap(priv->ilb_base_addr); + } + EXPORT_SYMBOL_GPL(tpm_tis_remove); + ++/** ++ * tpm_tis_clkrun_enable() - Keep clkrun protocol disabled for entire duration ++ * of a single TPM command ++ * @chip: TPM chip to use ++ * @value: 1 - Disable CLKRUN protocol, so that clocks are free running ++ * 0 - Enable CLKRUN protocol ++ * Call this function directly in tpm_tis_remove() in error or driver removal ++ * path, since the chip->ops is set to NULL in tpm_chip_unregister(). ++ */ ++static void tpm_tis_clkrun_enable(struct tpm_chip *chip, bool value) ++{ ++ struct tpm_tis_data *data = dev_get_drvdata(&chip->dev); ++ u32 clkrun_val; ++ ++ if (!IS_ENABLED(CONFIG_X86) || !is_bsw() || ++ !data->ilb_base_addr) ++ return; ++ ++ if (value) { ++ data->clkrun_enabled++; ++ if (data->clkrun_enabled > 1) ++ return; ++ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET); ++ ++ /* Disable LPC CLKRUN# */ ++ clkrun_val &= ~LPC_CLKRUN_EN; ++ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET); ++ ++ /* ++ * Write any random value on port 0x80 which is on LPC, to make ++ * sure LPC clock is running before sending any TPM command. ++ */ ++ outb(0xCC, 0x80); ++ } else { ++ data->clkrun_enabled--; ++ if (data->clkrun_enabled) ++ return; ++ ++ clkrun_val = ioread32(data->ilb_base_addr + LPC_CNTRL_OFFSET); ++ ++ /* Enable LPC CLKRUN# */ ++ clkrun_val |= LPC_CLKRUN_EN; ++ iowrite32(clkrun_val, data->ilb_base_addr + LPC_CNTRL_OFFSET); ++ ++ /* ++ * Write any random value on port 0x80 which is on LPC, to make ++ * sure LPC clock is running before sending any TPM command. ++ */ ++ outb(0xCC, 0x80); ++ } ++} ++ + static const struct tpm_class_ops tpm_tis = { + .flags = TPM_OPS_AUTO_STARTUP, + .status = tpm_tis_status, +@@ -674,6 +744,7 @@ static const struct tpm_class_ops tpm_tis = { + .req_canceled = tpm_tis_req_canceled, + .request_locality = request_locality, + .relinquish_locality = release_locality, ++ .clk_enable = tpm_tis_clkrun_enable, + }; + + int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, +@@ -681,6 +752,7 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + acpi_handle acpi_dev_handle) + { + u32 vendor, intfcaps, intmask; ++ u32 clkrun_val; + u8 rid; + int rc, probe; + struct tpm_chip *chip; +@@ -701,6 +773,23 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + priv->phy_ops = phy_ops; + dev_set_drvdata(&chip->dev, priv); + ++ if (is_bsw()) { ++ priv->ilb_base_addr = ioremap(INTEL_LEGACY_BLK_BASE_ADDR, ++ ILB_REMAP_SIZE); ++ if (!priv->ilb_base_addr) ++ return -ENOMEM; ++ ++ clkrun_val = ioread32(priv->ilb_base_addr + LPC_CNTRL_OFFSET); ++ /* Check if CLKRUN# is already not enabled in the LPC bus */ ++ if (!(clkrun_val & LPC_CLKRUN_EN)) { ++ iounmap(priv->ilb_base_addr); ++ priv->ilb_base_addr = NULL; ++ } ++ } ++ ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, true); ++ + if (wait_startup(chip, 0) != 0) { + rc = -ENODEV; + goto out_err; +@@ -791,9 +880,20 @@ int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + } + } + +- return tpm_chip_register(chip); ++ rc = tpm_chip_register(chip); ++ if (rc) ++ goto out_err; ++ ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); ++ ++ return 0; + out_err: ++ if ((chip->ops != NULL) && (chip->ops->clk_enable != NULL)) ++ chip->ops->clk_enable(chip, false); ++ + tpm_tis_remove(chip); ++ + return rc; + } + EXPORT_SYMBOL_GPL(tpm_tis_core_init); +@@ -805,22 +905,31 @@ static void tpm_tis_reenable_interrupts(struct tpm_chip *chip) + u32 intmask; + int rc; + ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, true); ++ + /* reenable interrupts that device may have lost or + * BIOS/firmware may have disabled + */ + rc = tpm_tis_write8(priv, TPM_INT_VECTOR(priv->locality), priv->irq); + if (rc < 0) +- return; ++ goto out; + + rc = tpm_tis_read32(priv, TPM_INT_ENABLE(priv->locality), &intmask); + if (rc < 0) +- return; ++ goto out; + + intmask |= TPM_INTF_CMD_READY_INT + | TPM_INTF_LOCALITY_CHANGE_INT | TPM_INTF_DATA_AVAIL_INT + | TPM_INTF_STS_VALID_INT | TPM_GLOBAL_INT_ENABLE; + + tpm_tis_write32(priv, TPM_INT_ENABLE(priv->locality), intmask); ++ ++out: ++ if (chip->ops->clk_enable != NULL) ++ chip->ops->clk_enable(chip, false); ++ ++ return; + } + + int tpm_tis_resume(struct device *dev) +diff --git a/drivers/char/tpm/tpm_tis_core.h b/drivers/char/tpm/tpm_tis_core.h +index 6bbac319ff3b..d5c6a2e952b3 100644 +--- a/drivers/char/tpm/tpm_tis_core.h ++++ b/drivers/char/tpm/tpm_tis_core.h +@@ -79,6 +79,11 @@ enum tis_defaults { + #define TPM_DID_VID(l) (0x0F00 | ((l) << 12)) + #define TPM_RID(l) (0x0F04 | ((l) << 12)) + ++#define LPC_CNTRL_OFFSET 0x84 ++#define LPC_CLKRUN_EN (1 << 2) ++#define INTEL_LEGACY_BLK_BASE_ADDR 0xFED08000 ++#define ILB_REMAP_SIZE 0x100 ++ + enum tpm_tis_flags { + TPM_TIS_ITPM_WORKAROUND = BIT(0), + }; +@@ -89,6 +94,8 @@ struct tpm_tis_data { + int irq; + bool irq_tested; + unsigned int flags; ++ void __iomem *ilb_base_addr; ++ u16 clkrun_enabled; + wait_queue_head_t int_queue; + wait_queue_head_t read_queue; + const struct tpm_tis_phy_ops *phy_ops; +@@ -144,6 +151,15 @@ static inline int tpm_tis_write32(struct tpm_tis_data *data, u32 addr, + return data->phy_ops->write32(data, addr, value); + } + ++static inline bool is_bsw(void) ++{ ++#ifdef CONFIG_X86 ++ return ((boot_cpu_data.x86_model == INTEL_FAM6_ATOM_AIRMONT) ? 1 : 0); ++#else ++ return false; ++#endif ++} ++ + void tpm_tis_remove(struct tpm_chip *chip); + int tpm_tis_core_init(struct device *dev, struct tpm_tis_data *priv, int irq, + const struct tpm_tis_phy_ops *phy_ops, +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +index 57afad79f55d..8fa850a070e0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_acpi.c +@@ -540,6 +540,9 @@ int amdgpu_acpi_pcie_performance_request(struct amdgpu_device *adev, + size_t size; + u32 retry = 3; + ++ if (amdgpu_acpi_pcie_notify_device_ready(adev)) ++ return -EINVAL; ++ + /* Get the device handle */ + handle = ACPI_HANDLE(&adev->pdev->dev); + if (!handle) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 8d1cf2d3e663..848242821ef3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -739,9 +739,11 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct amdgpu_encoder *amdgpu_encoder = to_amdgpu_encoder(encoder); +@@ -760,8 +762,12 @@ amdgpu_connector_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + amdgpu_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -871,9 +877,11 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = amdgpu_connector_best_single_encoder(connector); + if (!encoder) +@@ -927,8 +935,10 @@ amdgpu_connector_vga_detect(struct drm_connector *connector, bool force) + amdgpu_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -991,9 +1001,11 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1118,8 +1130,10 @@ amdgpu_connector_dvi_detect(struct drm_connector *connector, bool force) + amdgpu_connector_update_scratch_regs(connector, ret); + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1362,9 +1376,11 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + struct drm_encoder *encoder = amdgpu_connector_best_single_encoder(connector); + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && amdgpu_connector_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1432,8 +1448,10 @@ amdgpu_connector_dp_detect(struct drm_connector *connector, bool force) + + amdgpu_connector_update_scratch_regs(connector, ret); + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +index e19928dae8e3..17deca0f6255 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_uvd.c +@@ -293,12 +293,15 @@ int amdgpu_uvd_suspend(struct amdgpu_device *adev) + if (adev->uvd.vcpu_bo == NULL) + return 0; + +- for (i = 0; i < adev->uvd.max_handles; ++i) +- if (atomic_read(&adev->uvd.handles[i])) +- break; ++ /* only valid for physical mode */ ++ if (adev->asic_type < CHIP_POLARIS10) { ++ for (i = 0; i < adev->uvd.max_handles; ++i) ++ if (atomic_read(&adev->uvd.handles[i])) ++ break; + +- if (i == AMDGPU_MAX_UVD_HANDLES) +- return 0; ++ if (i == adev->uvd.max_handles) ++ return 0; ++ } + + cancel_delayed_work_sync(&adev->uvd.idle_work); + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +index 00868764a0dd..6f76b2646465 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v7_0.c +@@ -4387,34 +4387,8 @@ static void gfx_v7_0_gpu_early_init(struct amdgpu_device *adev) + case CHIP_KAVERI: + adev->gfx.config.max_shader_engines = 1; + adev->gfx.config.max_tile_pipes = 4; +- if ((adev->pdev->device == 0x1304) || +- (adev->pdev->device == 0x1305) || +- (adev->pdev->device == 0x130C) || +- (adev->pdev->device == 0x130F) || +- (adev->pdev->device == 0x1310) || +- (adev->pdev->device == 0x1311) || +- (adev->pdev->device == 0x131C)) { +- adev->gfx.config.max_cu_per_sh = 8; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1309) || +- (adev->pdev->device == 0x130A) || +- (adev->pdev->device == 0x130D) || +- (adev->pdev->device == 0x1313) || +- (adev->pdev->device == 0x131D)) { +- adev->gfx.config.max_cu_per_sh = 6; +- adev->gfx.config.max_backends_per_se = 2; +- } else if ((adev->pdev->device == 0x1306) || +- (adev->pdev->device == 0x1307) || +- (adev->pdev->device == 0x130B) || +- (adev->pdev->device == 0x130E) || +- (adev->pdev->device == 0x1315) || +- (adev->pdev->device == 0x131B)) { +- adev->gfx.config.max_cu_per_sh = 4; +- adev->gfx.config.max_backends_per_se = 1; +- } else { +- adev->gfx.config.max_cu_per_sh = 3; +- adev->gfx.config.max_backends_per_se = 1; +- } ++ adev->gfx.config.max_cu_per_sh = 8; ++ adev->gfx.config.max_backends_per_se = 2; + adev->gfx.config.max_sh_per_se = 1; + adev->gfx.config.max_texture_channel_caches = 4; + adev->gfx.config.max_gprs = 256; +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 8284d5dbfc30..4c178feeb4bd 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -31,6 +31,7 @@ + #include "amdgpu_uvd.h" + #include "amdgpu_vce.h" + #include "atom.h" ++#include "amd_pcie.h" + #include "amdgpu_powerplay.h" + #include "sid.h" + #include "si_ih.h" +@@ -1461,8 +1462,8 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + { + struct pci_dev *root = adev->pdev->bus->self; + int bridge_pos, gpu_pos; +- u32 speed_cntl, mask, current_data_rate; +- int ret, i; ++ u32 speed_cntl, current_data_rate; ++ int i; + u16 tmp16; + + if (pci_is_root_bus(adev->pdev->bus)) +@@ -1474,23 +1475,20 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + if (adev->flags & AMD_IS_APU) + return; + +- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask); +- if (ret != 0) +- return; +- +- if (!(mask & (DRM_PCIE_SPEED_50 | DRM_PCIE_SPEED_80))) ++ if (!(adev->pm.pcie_gen_mask & (CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2 | ++ CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3))) + return; + + speed_cntl = RREG32_PCIE_PORT(PCIE_LC_SPEED_CNTL); + current_data_rate = (speed_cntl & LC_CURRENT_DATA_RATE_MASK) >> + LC_CURRENT_DATA_RATE_SHIFT; +- if (mask & DRM_PCIE_SPEED_80) { ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { + if (current_data_rate == 2) { + DRM_INFO("PCIE gen 3 link speeds already enabled\n"); + return; + } + DRM_INFO("enabling PCIE gen 3 link speeds, disable with amdgpu.pcie_gen2=0\n"); +- } else if (mask & DRM_PCIE_SPEED_50) { ++ } else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) { + if (current_data_rate == 1) { + DRM_INFO("PCIE gen 2 link speeds already enabled\n"); + return; +@@ -1506,7 +1504,7 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + if (!gpu_pos) + return; + +- if (mask & DRM_PCIE_SPEED_80) { ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) { + if (current_data_rate != 2) { + u16 bridge_cfg, gpu_cfg; + u16 bridge_cfg2, gpu_cfg2; +@@ -1589,9 +1587,9 @@ static void si_pcie_gen3_enable(struct amdgpu_device *adev) + + pci_read_config_word(adev->pdev, gpu_pos + PCI_EXP_LNKCTL2, &tmp16); + tmp16 &= ~0xf; +- if (mask & DRM_PCIE_SPEED_80) ++ if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN3) + tmp16 |= 3; +- else if (mask & DRM_PCIE_SPEED_50) ++ else if (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_GEN2) + tmp16 |= 2; + else + tmp16 |= 1; +diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +index a2aeb643ac51..abb0a2341a41 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -26,6 +26,7 @@ + #include "amdgpu_pm.h" + #include "amdgpu_dpm.h" + #include "amdgpu_atombios.h" ++#include "amd_pcie.h" + #include "sid.h" + #include "r600_dpm.h" + #include "si_dpm.h" +@@ -3332,29 +3333,6 @@ static void btc_apply_voltage_delta_rules(struct amdgpu_device *adev, + } + } + +-static enum amdgpu_pcie_gen r600_get_pcie_gen_support(struct amdgpu_device *adev, +- u32 sys_mask, +- enum amdgpu_pcie_gen asic_gen, +- enum amdgpu_pcie_gen default_gen) +-{ +- switch (asic_gen) { +- case AMDGPU_PCIE_GEN1: +- return AMDGPU_PCIE_GEN1; +- case AMDGPU_PCIE_GEN2: +- return AMDGPU_PCIE_GEN2; +- case AMDGPU_PCIE_GEN3: +- return AMDGPU_PCIE_GEN3; +- default: +- if ((sys_mask & DRM_PCIE_SPEED_80) && (default_gen == AMDGPU_PCIE_GEN3)) +- return AMDGPU_PCIE_GEN3; +- else if ((sys_mask & DRM_PCIE_SPEED_50) && (default_gen == AMDGPU_PCIE_GEN2)) +- return AMDGPU_PCIE_GEN2; +- else +- return AMDGPU_PCIE_GEN1; +- } +- return AMDGPU_PCIE_GEN1; +-} +- + static void r600_calculate_u_and_p(u32 i, u32 r_c, u32 p_b, + u32 *p, u32 *u) + { +@@ -5028,10 +5006,11 @@ static int si_populate_smc_acpi_state(struct amdgpu_device *adev, + table->ACPIState.levels[0].vddc.index, + &table->ACPIState.levels[0].std_vddc); + } +- table->ACPIState.levels[0].gen2PCIE = (u8)r600_get_pcie_gen_support(adev, +- si_pi->sys_pcie_mask, +- si_pi->boot_pcie_gen, +- AMDGPU_PCIE_GEN1); ++ table->ACPIState.levels[0].gen2PCIE = ++ (u8)amdgpu_get_pcie_gen_support(adev, ++ si_pi->sys_pcie_mask, ++ si_pi->boot_pcie_gen, ++ AMDGPU_PCIE_GEN1); + + if (si_pi->vddc_phase_shed_control) + si_populate_phase_shedding_value(adev, +@@ -7162,10 +7141,10 @@ static void si_parse_pplib_clock_info(struct amdgpu_device *adev, + pl->vddc = le16_to_cpu(clock_info->si.usVDDC); + pl->vddci = le16_to_cpu(clock_info->si.usVDDCI); + pl->flags = le32_to_cpu(clock_info->si.ulFlags); +- pl->pcie_gen = r600_get_pcie_gen_support(adev, +- si_pi->sys_pcie_mask, +- si_pi->boot_pcie_gen, +- clock_info->si.ucPCIEGen); ++ pl->pcie_gen = amdgpu_get_pcie_gen_support(adev, ++ si_pi->sys_pcie_mask, ++ si_pi->boot_pcie_gen, ++ clock_info->si.ucPCIEGen); + + /* patch up vddc if necessary */ + ret = si_get_leakage_voltage_from_leakage_index(adev, pl->vddc, +@@ -7320,7 +7299,6 @@ static int si_dpm_init(struct amdgpu_device *adev) + struct si_power_info *si_pi; + struct atom_clock_dividers dividers; + int ret; +- u32 mask; + + si_pi = kzalloc(sizeof(struct si_power_info), GFP_KERNEL); + if (si_pi == NULL) +@@ -7330,11 +7308,9 @@ static int si_dpm_init(struct amdgpu_device *adev) + eg_pi = &ni_pi->eg; + pi = &eg_pi->rv7xx; + +- ret = drm_pcie_get_speed_cap_mask(adev->ddev, &mask); +- if (ret) +- si_pi->sys_pcie_mask = 0; +- else +- si_pi->sys_pcie_mask = mask; ++ si_pi->sys_pcie_mask = ++ (adev->pm.pcie_gen_mask & CAIL_PCIE_LINK_SPEED_SUPPORT_MASK) >> ++ CAIL_PCIE_LINK_SPEED_SUPPORT_SHIFT; + si_pi->force_pcie_gen = AMDGPU_PCIE_GEN_INVALID; + si_pi->boot_pcie_gen = si_get_current_pcie_speed(adev); + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +index b526f49be65d..336fdd8c7db0 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_hwmgr.c +@@ -2788,10 +2788,13 @@ static int smu7_apply_state_adjust_rules(struct pp_hwmgr *hwmgr, + PHM_PlatformCaps_DisableMclkSwitchingForFrameLock); + + +- disable_mclk_switching = ((1 < info.display_count) || +- disable_mclk_switching_for_frame_lock || +- smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) || +- (mode_info.refresh_rate > 120)); ++ if (info.display_count == 0) ++ disable_mclk_switching = false; ++ else ++ disable_mclk_switching = ((1 < info.display_count) || ++ disable_mclk_switching_for_frame_lock || ++ smu7_vblank_too_short(hwmgr, mode_info.vblank_time_us) || ++ (mode_info.refresh_rate > 120)); + + sclk = smu7_ps->performance_levels[0].engine_clock; + mclk = smu7_ps->performance_levels[0].memory_clock; +@@ -4576,13 +4579,6 @@ static int smu7_set_power_profile_state(struct pp_hwmgr *hwmgr, + int tmp_result, result = 0; + uint32_t sclk_mask = 0, mclk_mask = 0; + +- if (hwmgr->chip_id == CHIP_FIJI) { +- if (request->type == AMD_PP_GFX_PROFILE) +- smu7_enable_power_containment(hwmgr); +- else if (request->type == AMD_PP_COMPUTE_PROFILE) +- smu7_disable_power_containment(hwmgr); +- } +- + if (hwmgr->dpm_level != AMD_DPM_FORCED_LEVEL_AUTO) + return -EINVAL; + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +index f8f02e70b8bc..ca232a9e2334 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/vega10_hwmgr.c +@@ -3243,10 +3243,13 @@ static int vega10_apply_state_adjust_rules(struct pp_hwmgr *hwmgr, + force_mclk_high = phm_cap_enabled(hwmgr->platform_descriptor.platformCaps, + PHM_PlatformCaps_ForceMclkHigh); + +- disable_mclk_switching = (info.display_count > 1) || +- disable_mclk_switching_for_frame_lock || +- disable_mclk_switching_for_vr || +- force_mclk_high; ++ if (info.display_count == 0) ++ disable_mclk_switching = false; ++ else ++ disable_mclk_switching = (info.display_count > 1) || ++ disable_mclk_switching_for_frame_lock || ++ disable_mclk_switching_for_vr || ++ force_mclk_high; + + sclk = vega10_ps->performance_levels[0].gfx_clock; + mclk = vega10_ps->performance_levels[0].mem_clock; +diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c +index af279844d7ce..dd4727489b84 100644 +--- a/drivers/gpu/drm/drm_framebuffer.c ++++ b/drivers/gpu/drm/drm_framebuffer.c +@@ -118,6 +118,10 @@ int drm_mode_addfb(struct drm_device *dev, + r.pixel_format = drm_mode_legacy_fb_format(or->bpp, or->depth); + r.handles[0] = or->handle; + ++ if (r.pixel_format == DRM_FORMAT_XRGB2101010 && ++ dev->driver->driver_features & DRIVER_PREFER_XBGR_30BPP) ++ r.pixel_format = DRM_FORMAT_XBGR2101010; ++ + ret = drm_mode_addfb2(dev, &r, file_priv); + if (ret) + return ret; +diff --git a/drivers/gpu/drm/drm_probe_helper.c b/drivers/gpu/drm/drm_probe_helper.c +index 904966cde32b..d29fd8443fed 100644 +--- a/drivers/gpu/drm/drm_probe_helper.c ++++ b/drivers/gpu/drm/drm_probe_helper.c +@@ -671,6 +671,26 @@ static void output_poll_execute(struct work_struct *work) + schedule_delayed_work(delayed_work, DRM_OUTPUT_POLL_PERIOD); + } + ++/** ++ * drm_kms_helper_is_poll_worker - is %current task an output poll worker? ++ * ++ * Determine if %current task is an output poll worker. This can be used ++ * to select distinct code paths for output polling versus other contexts. ++ * ++ * One use case is to avoid a deadlock between the output poll worker and ++ * the autosuspend worker wherein the latter waits for polling to finish ++ * upon calling drm_kms_helper_poll_disable(), while the former waits for ++ * runtime suspend to finish upon calling pm_runtime_get_sync() in a ++ * connector ->detect hook. ++ */ ++bool drm_kms_helper_is_poll_worker(void) ++{ ++ struct work_struct *work = current_work(); ++ ++ return work && work->func == output_poll_execute; ++} ++EXPORT_SYMBOL(drm_kms_helper_is_poll_worker); ++ + /** + * drm_kms_helper_poll_disable - disable output polling + * @dev: drm_device +diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c +index 5c5cb2ceee49..562220ec9d41 100644 +--- a/drivers/gpu/drm/i915/i915_drv.c ++++ b/drivers/gpu/drm/i915/i915_drv.c +@@ -1806,6 +1806,8 @@ static int i915_drm_resume_early(struct drm_device *dev) + if (IS_GEN9_LP(dev_priv) || + !(dev_priv->suspended_to_idle && dev_priv->csr.dmc_payload)) + intel_power_domains_init_hw(dev_priv, true); ++ else ++ intel_display_set_init_power(dev_priv, true); + + i915_gem_sanitize(dev_priv); + +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index 83876a1c8d98..de8ca5f1dd2e 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -499,6 +499,8 @@ eb_add_vma(struct i915_execbuffer *eb, unsigned int i, struct i915_vma *vma) + list_add_tail(&vma->exec_link, &eb->unbound); + if (drm_mm_node_allocated(&vma->node)) + err = i915_vma_unbind(vma); ++ if (unlikely(err)) ++ vma->exec_flags = NULL; + } + return err; + } +@@ -2408,7 +2410,7 @@ i915_gem_do_execbuffer(struct drm_device *dev, + if (out_fence) { + if (err == 0) { + fd_install(out_fence_fd, out_fence->file); +- args->rsvd2 &= GENMASK_ULL(0, 31); /* keep in-fence */ ++ args->rsvd2 &= GENMASK_ULL(31, 0); /* keep in-fence */ + args->rsvd2 |= (u64)out_fence_fd << 32; + out_fence_fd = -1; + } else { +diff --git a/drivers/gpu/drm/i915/i915_perf.c b/drivers/gpu/drm/i915/i915_perf.c +index 370b9d248fed..3e49317f3ec3 100644 +--- a/drivers/gpu/drm/i915/i915_perf.c ++++ b/drivers/gpu/drm/i915/i915_perf.c +@@ -1300,9 +1300,8 @@ static void i915_oa_stream_destroy(struct i915_perf_stream *stream) + */ + mutex_lock(&dev_priv->drm.struct_mutex); + dev_priv->perf.oa.exclusive_stream = NULL; +- mutex_unlock(&dev_priv->drm.struct_mutex); +- + dev_priv->perf.oa.ops.disable_metric_set(dev_priv); ++ mutex_unlock(&dev_priv->drm.struct_mutex); + + free_oa_buffer(dev_priv); + +@@ -1754,22 +1753,13 @@ static int gen8_switch_to_updated_kernel_context(struct drm_i915_private *dev_pr + * Note: it's only the RCS/Render context that has any OA state. + */ + static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv, +- const struct i915_oa_config *oa_config, +- bool interruptible) ++ const struct i915_oa_config *oa_config) + { + struct i915_gem_context *ctx; + int ret; + unsigned int wait_flags = I915_WAIT_LOCKED; + +- if (interruptible) { +- ret = i915_mutex_lock_interruptible(&dev_priv->drm); +- if (ret) +- return ret; +- +- wait_flags |= I915_WAIT_INTERRUPTIBLE; +- } else { +- mutex_lock(&dev_priv->drm.struct_mutex); +- } ++ lockdep_assert_held(&dev_priv->drm.struct_mutex); + + /* Switch away from any user context. */ + ret = gen8_switch_to_updated_kernel_context(dev_priv, oa_config); +@@ -1817,8 +1807,6 @@ static int gen8_configure_all_contexts(struct drm_i915_private *dev_priv, + } + + out: +- mutex_unlock(&dev_priv->drm.struct_mutex); +- + return ret; + } + +@@ -1862,7 +1850,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv, + * to make sure all slices/subslices are ON before writing to NOA + * registers. + */ +- ret = gen8_configure_all_contexts(dev_priv, oa_config, true); ++ ret = gen8_configure_all_contexts(dev_priv, oa_config); + if (ret) + return ret; + +@@ -1877,7 +1865,7 @@ static int gen8_enable_metric_set(struct drm_i915_private *dev_priv, + static void gen8_disable_metric_set(struct drm_i915_private *dev_priv) + { + /* Reset all contexts' slices/subslices configurations. */ +- gen8_configure_all_contexts(dev_priv, NULL, false); ++ gen8_configure_all_contexts(dev_priv, NULL); + + I915_WRITE(GDT_CHICKEN_BITS, (I915_READ(GDT_CHICKEN_BITS) & + ~GT_NOA_ENABLE)); +@@ -2127,6 +2115,10 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream, + if (ret) + goto err_oa_buf_alloc; + ++ ret = i915_mutex_lock_interruptible(&dev_priv->drm); ++ if (ret) ++ goto err_lock; ++ + ret = dev_priv->perf.oa.ops.enable_metric_set(dev_priv, + stream->oa_config); + if (ret) +@@ -2134,23 +2126,17 @@ static int i915_oa_stream_init(struct i915_perf_stream *stream, + + stream->ops = &i915_oa_stream_ops; + +- /* Lock device for exclusive_stream access late because +- * enable_metric_set() might lock as well on gen8+. +- */ +- ret = i915_mutex_lock_interruptible(&dev_priv->drm); +- if (ret) +- goto err_lock; +- + dev_priv->perf.oa.exclusive_stream = stream; + + mutex_unlock(&dev_priv->drm.struct_mutex); + + return 0; + +-err_lock: ++err_enable: + dev_priv->perf.oa.ops.disable_metric_set(dev_priv); ++ mutex_unlock(&dev_priv->drm.struct_mutex); + +-err_enable: ++err_lock: + free_oa_buffer(dev_priv); + + err_oa_buf_alloc: +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 059db50109bc..cf648c526e12 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -14498,6 +14498,8 @@ static void sanitize_watermarks(struct drm_device *dev) + + cs->wm.need_postvbl_update = true; + dev_priv->display.optimize_watermarks(intel_state, cs); ++ ++ to_intel_crtc_state(crtc->state)->wm = cs->wm; + } + + put_state: +diff --git a/drivers/gpu/drm/i915/intel_hdmi.c b/drivers/gpu/drm/i915/intel_hdmi.c +index 3fed1d3ecded..1b292d5f1a68 100644 +--- a/drivers/gpu/drm/i915/intel_hdmi.c ++++ b/drivers/gpu/drm/i915/intel_hdmi.c +@@ -1563,12 +1563,20 @@ intel_hdmi_set_edid(struct drm_connector *connector) + struct intel_hdmi *intel_hdmi = intel_attached_hdmi(connector); + struct edid *edid; + bool connected = false; ++ struct i2c_adapter *i2c; + + intel_display_power_get(dev_priv, POWER_DOMAIN_GMBUS); + +- edid = drm_get_edid(connector, +- intel_gmbus_get_adapter(dev_priv, +- intel_hdmi->ddc_bus)); ++ i2c = intel_gmbus_get_adapter(dev_priv, intel_hdmi->ddc_bus); ++ ++ edid = drm_get_edid(connector, i2c); ++ ++ if (!edid && !intel_gmbus_is_forced_bit(i2c)) { ++ DRM_DEBUG_KMS("HDMI GMBUS EDID read failed, retry using GPIO bit-banging\n"); ++ intel_gmbus_force_bit(i2c, true); ++ edid = drm_get_edid(connector, i2c); ++ intel_gmbus_force_bit(i2c, false); ++ } + + intel_hdmi_dp_dual_mode_detect(connector, edid != NULL); + +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c +index 51cb5293bf43..bcccacba1ec6 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -1844,6 +1844,7 @@ void intel_display_power_put(struct drm_i915_private *dev_priv, + CNL_DISPLAY_POWERWELL_2_POWER_DOMAINS | \ + BIT_ULL(POWER_DOMAIN_MODESET) | \ + BIT_ULL(POWER_DOMAIN_AUX_A) | \ ++ BIT_ULL(POWER_DOMAIN_GMBUS) | \ + BIT_ULL(POWER_DOMAIN_INIT)) + + static const struct i915_power_well_ops i9xx_always_on_power_well_ops = { +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 70d8e0d69ad5..c902a851eb51 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -570,9 +570,15 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + nv_connector->edid = NULL; + } + +- ret = pm_runtime_get_sync(connector->dev->dev); +- if (ret < 0 && ret != -EACCES) +- return conn_status; ++ /* Outputs are only polled while runtime active, so acquiring a ++ * runtime PM ref here is unnecessary (and would deadlock upon ++ * runtime suspend because it waits for polling to finish). ++ */ ++ if (!drm_kms_helper_is_poll_worker()) { ++ ret = pm_runtime_get_sync(connector->dev->dev); ++ if (ret < 0 && ret != -EACCES) ++ return conn_status; ++ } + + nv_encoder = nouveau_connector_ddc_detect(connector); + if (nv_encoder && (i2c = nv_encoder->i2c) != NULL) { +@@ -647,8 +653,10 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + + out: + +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return conn_status; + } +diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c +index fb47d46050ec..6e196bc01118 100644 +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -4426,6 +4426,7 @@ nv50_display_create(struct drm_device *dev) + nouveau_display(dev)->fini = nv50_display_fini; + disp->disp = &nouveau_display(dev)->disp; + dev->mode_config.funcs = &nv50_disp_func; ++ dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP; + if (nouveau_atomic) + dev->driver->driver_features |= DRIVER_ATOMIC; + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index 3cb6c55b268d..ce8b353b5753 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -3229,35 +3229,8 @@ static void cik_gpu_init(struct radeon_device *rdev) + case CHIP_KAVERI: + rdev->config.cik.max_shader_engines = 1; + rdev->config.cik.max_tile_pipes = 4; +- if ((rdev->pdev->device == 0x1304) || +- (rdev->pdev->device == 0x1305) || +- (rdev->pdev->device == 0x130C) || +- (rdev->pdev->device == 0x130F) || +- (rdev->pdev->device == 0x1310) || +- (rdev->pdev->device == 0x1311) || +- (rdev->pdev->device == 0x131C)) { +- rdev->config.cik.max_cu_per_sh = 8; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1309) || +- (rdev->pdev->device == 0x130A) || +- (rdev->pdev->device == 0x130D) || +- (rdev->pdev->device == 0x1313) || +- (rdev->pdev->device == 0x131D)) { +- rdev->config.cik.max_cu_per_sh = 6; +- rdev->config.cik.max_backends_per_se = 2; +- } else if ((rdev->pdev->device == 0x1306) || +- (rdev->pdev->device == 0x1307) || +- (rdev->pdev->device == 0x130B) || +- (rdev->pdev->device == 0x130E) || +- (rdev->pdev->device == 0x1315) || +- (rdev->pdev->device == 0x1318) || +- (rdev->pdev->device == 0x131B)) { +- rdev->config.cik.max_cu_per_sh = 4; +- rdev->config.cik.max_backends_per_se = 1; +- } else { +- rdev->config.cik.max_cu_per_sh = 3; +- rdev->config.cik.max_backends_per_se = 1; +- } ++ rdev->config.cik.max_cu_per_sh = 8; ++ rdev->config.cik.max_backends_per_se = 2; + rdev->config.cik.max_sh_per_se = 1; + rdev->config.cik.max_texture_channel_caches = 4; + rdev->config.cik.max_gprs = 256; +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 2f642cbefd8e..c0da44742988 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -900,9 +900,11 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (encoder) { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +@@ -925,8 +927,12 @@ radeon_lvds_detect(struct drm_connector *connector, bool force) + /* check acpi lid status ??? */ + + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1040,9 +1046,11 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + int r; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1109,8 +1117,10 @@ radeon_vga_detect(struct drm_connector *connector, bool force) + radeon_connector_update_scratch_regs(connector, ret); + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1174,9 +1184,11 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (!radeon_connector->dac_load_detect) + return ret; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + encoder = radeon_best_single_encoder(connector); + if (!encoder) +@@ -1188,8 +1200,12 @@ radeon_tv_detect(struct drm_connector *connector, bool force) + if (ret == connector_status_connected) + ret = radeon_connector_analog_encoder_conflict_solve(connector, encoder, ret, false); + radeon_connector_update_scratch_regs(connector, ret); +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } ++ + return ret; + } + +@@ -1252,9 +1268,11 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) + enum drm_connector_status ret = connector_status_disconnected; + bool dret = false, broken_edid = false; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (radeon_connector->detected_hpd_without_ddc) { + force = true; +@@ -1437,8 +1455,10 @@ radeon_dvi_detect(struct drm_connector *connector, bool force) + } + + exit: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +@@ -1689,9 +1709,11 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + if (radeon_dig_connector->is_mst) + return connector_status_disconnected; + +- r = pm_runtime_get_sync(connector->dev->dev); +- if (r < 0) +- return connector_status_disconnected; ++ if (!drm_kms_helper_is_poll_worker()) { ++ r = pm_runtime_get_sync(connector->dev->dev); ++ if (r < 0) ++ return connector_status_disconnected; ++ } + + if (!force && radeon_check_hpd_status_unchanged(connector)) { + ret = connector->status; +@@ -1778,8 +1800,10 @@ radeon_dp_detect(struct drm_connector *connector, bool force) + } + + out: +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); ++ if (!drm_kms_helper_is_poll_worker()) { ++ pm_runtime_mark_last_busy(connector->dev->dev); ++ pm_runtime_put_autosuspend(connector->dev->dev); ++ } + + return ret; + } +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index ffc10cadcf34..32b577c776b9 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -1397,6 +1397,10 @@ int radeon_device_init(struct radeon_device *rdev, + if ((rdev->flags & RADEON_IS_PCI) && + (rdev->family <= CHIP_RS740)) + rdev->need_dma32 = true; ++#ifdef CONFIG_PPC64 ++ if (rdev->family == CHIP_CEDAR) ++ rdev->need_dma32 = true; ++#endif + + dma_bits = rdev->need_dma32 ? 32 : 40; + r = pci_set_dma_mask(rdev->pdev, DMA_BIT_MASK(dma_bits)); +diff --git a/drivers/gpu/drm/radeon/radeon_pm.c b/drivers/gpu/drm/radeon/radeon_pm.c +index 326ad068c15a..4b6542538ff9 100644 +--- a/drivers/gpu/drm/radeon/radeon_pm.c ++++ b/drivers/gpu/drm/radeon/radeon_pm.c +@@ -47,7 +47,6 @@ static bool radeon_pm_in_vbl(struct radeon_device *rdev); + static bool radeon_pm_debug_check_in_vbl(struct radeon_device *rdev, bool finish); + static void radeon_pm_update_profile(struct radeon_device *rdev); + static void radeon_pm_set_clocks(struct radeon_device *rdev); +-static void radeon_pm_compute_clocks_dpm(struct radeon_device *rdev); + + int radeon_pm_get_type_index(struct radeon_device *rdev, + enum radeon_pm_state_type ps_type, +@@ -80,8 +79,6 @@ void radeon_pm_acpi_event_handler(struct radeon_device *rdev) + radeon_dpm_enable_bapm(rdev, rdev->pm.dpm.ac_power); + } + mutex_unlock(&rdev->pm.mutex); +- /* allow new DPM state to be picked */ +- radeon_pm_compute_clocks_dpm(rdev); + } else if (rdev->pm.pm_method == PM_METHOD_PROFILE) { + if (rdev->pm.profile == PM_PROFILE_AUTO) { + mutex_lock(&rdev->pm.mutex); +@@ -885,8 +882,7 @@ static struct radeon_ps *radeon_dpm_pick_power_state(struct radeon_device *rdev, + dpm_state = POWER_STATE_TYPE_INTERNAL_3DPERF; + /* balanced states don't exist at the moment */ + if (dpm_state == POWER_STATE_TYPE_BALANCED) +- dpm_state = rdev->pm.dpm.ac_power ? +- POWER_STATE_TYPE_PERFORMANCE : POWER_STATE_TYPE_BATTERY; ++ dpm_state = POWER_STATE_TYPE_PERFORMANCE; + + restart_search: + /* Pick the best power state based on current conditions */ +diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c +index d7d042a20ab4..4dff06ab771e 100644 +--- a/drivers/infiniband/core/device.c ++++ b/drivers/infiniband/core/device.c +@@ -534,14 +534,14 @@ int ib_register_device(struct ib_device *device, + ret = device->query_device(device, &device->attrs, &uhw); + if (ret) { + pr_warn("Couldn't query the device attributes\n"); +- goto cache_cleanup; ++ goto cg_cleanup; + } + + ret = ib_device_register_sysfs(device, port_callback); + if (ret) { + pr_warn("Couldn't register device %s with driver model\n", + device->name); +- goto cache_cleanup; ++ goto cg_cleanup; + } + + device->reg_state = IB_DEV_REGISTERED; +@@ -557,6 +557,8 @@ int ib_register_device(struct ib_device *device, + mutex_unlock(&device_mutex); + return 0; + ++cg_cleanup: ++ ib_device_unregister_rdmacg(device); + cache_cleanup: + ib_cache_cleanup_one(device); + ib_cache_release_one(device); +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 4e1f76730855..9cb801d1fe54 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -407,13 +407,13 @@ static int __must_check remove_commit_fd_uobject(struct ib_uobject *uobj, + return ret; + } + +-static void lockdep_check(struct ib_uobject *uobj, bool exclusive) ++static void assert_uverbs_usecnt(struct ib_uobject *uobj, bool exclusive) + { + #ifdef CONFIG_LOCKDEP + if (exclusive) +- WARN_ON(atomic_read(&uobj->usecnt) > 0); ++ WARN_ON(atomic_read(&uobj->usecnt) != -1); + else +- WARN_ON(atomic_read(&uobj->usecnt) == -1); ++ WARN_ON(atomic_read(&uobj->usecnt) <= 0); + #endif + } + +@@ -452,7 +452,7 @@ int __must_check rdma_remove_commit_uobject(struct ib_uobject *uobj) + WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n"); + return 0; + } +- lockdep_check(uobj, true); ++ assert_uverbs_usecnt(uobj, true); + ret = _rdma_remove_commit_uobject(uobj, RDMA_REMOVE_DESTROY); + + up_read(&ucontext->cleanup_rwsem); +@@ -482,7 +482,7 @@ int rdma_explicit_destroy(struct ib_uobject *uobject) + WARN(true, "ib_uverbs: Cleanup is running while removing an uobject\n"); + return 0; + } +- lockdep_check(uobject, true); ++ assert_uverbs_usecnt(uobject, true); + ret = uobject->type->type_class->remove_commit(uobject, + RDMA_REMOVE_DESTROY); + if (ret) +@@ -569,7 +569,7 @@ static void lookup_put_fd_uobject(struct ib_uobject *uobj, bool exclusive) + + void rdma_lookup_put_uobject(struct ib_uobject *uobj, bool exclusive) + { +- lockdep_check(uobj, exclusive); ++ assert_uverbs_usecnt(uobj, exclusive); + uobj->type->type_class->lookup_put(uobj, exclusive); + /* + * In order to unlock an object, either decrease its usecnt for +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index eb85b546e223..c8b3a45e9edc 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1148,6 +1148,9 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (cmd.qp_state > IB_QPS_ERR) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -1293,6 +1296,9 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) ++ return -EINVAL; ++ + optval = memdup_user((void __user *) (unsigned long) cmd.optval, + cmd.optlen); + if (IS_ERR(optval)) { +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index 2aa53f427685..faedc080a5e6 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -1154,7 +1154,12 @@ static int resize_user(struct mlx5_ib_dev *dev, struct mlx5_ib_cq *cq, + if (ucmd.reserved0 || ucmd.reserved1) + return -EINVAL; + +- umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size, ++ /* check multiplication overflow */ ++ if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1) ++ return -EINVAL; ++ ++ umem = ib_umem_get(context, ucmd.buf_addr, ++ (size_t)ucmd.cqe_size * entries, + IB_ACCESS_LOCAL_WRITE, 1); + if (IS_ERR(umem)) { + err = PTR_ERR(umem); +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 231b043e2806..000937fe53ec 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1813,7 +1813,6 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr, + + mr->ibmr.iova = sg_dma_address(sg) + sg_offset; + mr->ibmr.length = 0; +- mr->ndescs = sg_nents; + + for_each_sg(sgl, sg, sg_nents, i) { + if (unlikely(i >= mr->max_descs)) +@@ -1825,6 +1824,7 @@ mlx5_ib_sg_to_klms(struct mlx5_ib_mr *mr, + + sg_offset = 0; + } ++ mr->ndescs = i; + + if (sg_offset_p) + *sg_offset_p = sg_offset; +diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c +index 1f316d66e6f7..41614c185918 100644 +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -218,8 +218,10 @@ static void matrix_keypad_stop(struct input_dev *dev) + { + struct matrix_keypad *keypad = input_get_drvdata(dev); + ++ spin_lock_irq(&keypad->lock); + keypad->stopped = true; +- mb(); ++ spin_unlock_irq(&keypad->lock); ++ + flush_work(&keypad->work.work); + /* + * matrix_keypad_scan() will leave IRQs enabled; +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 25bf003fb198..9417170f180a 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -938,6 +938,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; + char buf[BDEVNAME_SIZE]; ++ struct cached_dev *exist_dc, *t; + + bdevname(dc->bdev, buf); + +@@ -961,6 +962,16 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + return -EINVAL; + } + ++ /* Check whether already attached */ ++ list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) { ++ if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) { ++ pr_err("Tried to attach %s but duplicate UUID already attached", ++ buf); ++ ++ return -EINVAL; ++ } ++ } ++ + u = uuid_find(c, dc->sb.uuid); + + if (u && +@@ -1181,7 +1192,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page, + + return; + err: +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ pr_notice("error %s: %s", bdevname(bdev, name), err); + bcache_device_stop(&dc->disk); + } + +@@ -1849,6 +1860,8 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + const char *err = NULL; /* must be set for any error case */ + int ret = 0; + ++ bdevname(bdev, name); ++ + memcpy(&ca->sb, sb, sizeof(struct cache_sb)); + ca->bdev = bdev; + ca->bdev->bd_holder = ca; +@@ -1857,11 +1870,12 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + ca->sb_bio.bi_io_vec[0].bv_page = sb_page; + get_page(sb_page); + +- if (blk_queue_discard(bdev_get_queue(ca->bdev))) ++ if (blk_queue_discard(bdev_get_queue(bdev))) + ca->discard = CACHE_DISCARD(&ca->sb); + + ret = cache_alloc(ca); + if (ret != 0) { ++ blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL); + if (ret == -ENOMEM) + err = "cache_alloc(): -ENOMEM"; + else +@@ -1884,14 +1898,14 @@ static int register_cache(struct cache_sb *sb, struct page *sb_page, + goto out; + } + +- pr_info("registered cache device %s", bdevname(bdev, name)); ++ pr_info("registered cache device %s", name); + + out: + kobject_put(&ca->kobj); + + err: + if (err) +- pr_notice("error opening %s: %s", bdevname(bdev, name), err); ++ pr_notice("error %s: %s", name, err); + + return ret; + } +@@ -1980,6 +1994,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, + if (err) + goto err_close; + ++ err = "failed to register device"; + if (SB_IS_BDEV(sb)) { + struct cached_dev *dc = kzalloc(sizeof(*dc), GFP_KERNEL); + if (!dc) +@@ -1994,7 +2009,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, + goto err_close; + + if (register_cache(sb, sb_page, bdev, ca) != 0) +- goto err_close; ++ goto err; + } + out: + if (sb_page) +@@ -2007,7 +2022,7 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, + err_close: + blkdev_put(bdev, FMODE_READ|FMODE_WRITE|FMODE_EXCL); + err: +- pr_info("error opening %s: %s", path, err); ++ pr_info("error %s: %s", path, err); + ret = -EINVAL; + goto out; + } +diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c +index 6d416fdc25cb..1e17e6421da3 100644 +--- a/drivers/md/dm-bufio.c ++++ b/drivers/md/dm-bufio.c +@@ -386,9 +386,6 @@ static void __cache_size_refresh(void) + static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask, + enum data_mode *data_mode) + { +- unsigned noio_flag; +- void *ptr; +- + if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) { + *data_mode = DATA_MODE_SLAB; + return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask); +@@ -412,16 +409,15 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask, + * all allocations done by this process (including pagetables) are done + * as if GFP_NOIO was specified. + */ ++ if (gfp_mask & __GFP_NORETRY) { ++ unsigned noio_flag = memalloc_noio_save(); ++ void *ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); + +- if (gfp_mask & __GFP_NORETRY) +- noio_flag = memalloc_noio_save(); +- +- ptr = __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); +- +- if (gfp_mask & __GFP_NORETRY) + memalloc_noio_restore(noio_flag); ++ return ptr; ++ } + +- return ptr; ++ return __vmalloc(c->block_size, gfp_mask, PAGE_KERNEL); + } + + /* +diff --git a/drivers/pci/dwc/pcie-designware-host.c b/drivers/pci/dwc/pcie-designware-host.c +index 81e2157a7cfb..bc3e2d8d0cce 100644 +--- a/drivers/pci/dwc/pcie-designware-host.c ++++ b/drivers/pci/dwc/pcie-designware-host.c +@@ -607,7 +607,7 @@ void dw_pcie_setup_rc(struct pcie_port *pp) + /* setup bus numbers */ + val = dw_pcie_readl_dbi(pci, PCI_PRIMARY_BUS); + val &= 0xff000000; +- val |= 0x00010100; ++ val |= 0x00ff0100; + dw_pcie_writel_dbi(pci, PCI_PRIMARY_BUS, val); + + /* setup command register */ +diff --git a/drivers/regulator/stm32-vrefbuf.c b/drivers/regulator/stm32-vrefbuf.c +index 72c8b3e1022b..e0a9c445ed67 100644 +--- a/drivers/regulator/stm32-vrefbuf.c ++++ b/drivers/regulator/stm32-vrefbuf.c +@@ -51,7 +51,7 @@ static int stm32_vrefbuf_enable(struct regulator_dev *rdev) + * arbitrary timeout. + */ + ret = readl_poll_timeout(priv->base + STM32_VREFBUF_CSR, val, +- !(val & STM32_VRR), 650, 10000); ++ val & STM32_VRR, 650, 10000); + if (ret) { + dev_err(&rdev->dev, "stm32 vrefbuf timed out!\n"); + val = readl_relaxed(priv->base + STM32_VREFBUF_CSR); +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index 57bf43e34863..dd9464920456 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -328,8 +328,6 @@ static void scsi_host_dev_release(struct device *dev) + if (shost->work_q) + destroy_workqueue(shost->work_q); + +- destroy_rcu_head(&shost->rcu); +- + if (shost->shost_state == SHOST_CREATED) { + /* + * Free the shost_dev device name here if scsi_host_alloc() +@@ -404,7 +402,6 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) + INIT_LIST_HEAD(&shost->starved_list); + init_waitqueue_head(&shost->host_wait); + mutex_init(&shost->scan_mutex); +- init_rcu_head(&shost->rcu); + + index = ida_simple_get(&host_index_ida, 0, 0, GFP_KERNEL); + if (index < 0) +diff --git a/drivers/scsi/qla2xxx/qla_def.h b/drivers/scsi/qla2xxx/qla_def.h +index 486c075998f6..67b305531ec3 100644 +--- a/drivers/scsi/qla2xxx/qla_def.h ++++ b/drivers/scsi/qla2xxx/qla_def.h +@@ -315,6 +315,29 @@ struct srb_cmd { + /* To identify if a srb is of T10-CRC type. @sp => srb_t pointer */ + #define IS_PROT_IO(sp) (sp->flags & SRB_CRC_CTX_DSD_VALID) + ++/* ++ * 24 bit port ID type definition. ++ */ ++typedef union { ++ uint32_t b24 : 24; ++ ++ struct { ++#ifdef __BIG_ENDIAN ++ uint8_t domain; ++ uint8_t area; ++ uint8_t al_pa; ++#elif defined(__LITTLE_ENDIAN) ++ uint8_t al_pa; ++ uint8_t area; ++ uint8_t domain; ++#else ++#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!" ++#endif ++ uint8_t rsvd_1; ++ } b; ++} port_id_t; ++#define INVALID_PORT_ID 0xFFFFFF ++ + struct els_logo_payload { + uint8_t opcode; + uint8_t rsvd[3]; +@@ -332,6 +355,7 @@ struct ct_arg { + u32 rsp_size; + void *req; + void *rsp; ++ port_id_t id; + }; + + /* +@@ -480,6 +504,7 @@ typedef struct srb { + const char *name; + int iocbs; + struct qla_qpair *qpair; ++ struct list_head elem; + u32 gen1; /* scratch */ + u32 gen2; /* scratch */ + union { +@@ -2144,28 +2169,6 @@ struct imm_ntfy_from_isp { + #define REQUEST_ENTRY_SIZE (sizeof(request_t)) + + +-/* +- * 24 bit port ID type definition. +- */ +-typedef union { +- uint32_t b24 : 24; +- +- struct { +-#ifdef __BIG_ENDIAN +- uint8_t domain; +- uint8_t area; +- uint8_t al_pa; +-#elif defined(__LITTLE_ENDIAN) +- uint8_t al_pa; +- uint8_t area; +- uint8_t domain; +-#else +-#error "__BIG_ENDIAN or __LITTLE_ENDIAN must be defined!" +-#endif +- uint8_t rsvd_1; +- } b; +-} port_id_t; +-#define INVALID_PORT_ID 0xFFFFFF + + /* + * Switch info gathering structure. +@@ -4082,6 +4085,7 @@ typedef struct scsi_qla_host { + #define LOOP_READY 5 + #define LOOP_DEAD 6 + ++ unsigned long relogin_jif; + unsigned long dpc_flags; + #define RESET_MARKER_NEEDED 0 /* Send marker to ISP. */ + #define RESET_ACTIVE 1 +@@ -4223,6 +4227,7 @@ typedef struct scsi_qla_host { + wait_queue_head_t fcport_waitQ; + wait_queue_head_t vref_waitq; + uint8_t min_link_speed_feat; ++ struct list_head gpnid_list; + } scsi_qla_host_t; + + struct qla27xx_image_status { +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index bc3db6abc9a0..59ecc4eda6cd 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -175,6 +175,9 @@ qla2x00_chk_ms_status(scsi_qla_host_t *vha, ms_iocb_entry_t *ms_pkt, + set_bit(LOCAL_LOOP_UPDATE, &vha->dpc_flags); + } + break; ++ case CS_TIMEOUT: ++ rval = QLA_FUNCTION_TIMEOUT; ++ /* drop through */ + default: + ql_dbg(ql_dbg_disc, vha, 0x2033, + "%s failed, completion status (%x) on port_id: " +@@ -2833,7 +2836,7 @@ void qla24xx_handle_gidpn_event(scsi_qla_host_t *vha, struct event_arg *ea) + } + } else { /* fcport->d_id.b24 != ea->id.b24 */ + fcport->d_id.b24 = ea->id.b24; +- if (fcport->deleted == QLA_SESS_DELETED) { ++ if (fcport->deleted != QLA_SESS_DELETED) { + ql_dbg(ql_dbg_disc, vha, 0x2021, + "%s %d %8phC post del sess\n", + __func__, __LINE__, fcport->port_name); +@@ -2889,9 +2892,22 @@ static void qla2x00_async_gidpn_sp_done(void *s, int res) + ea.rc = res; + ea.event = FCME_GIDPN_DONE; + +- ql_dbg(ql_dbg_disc, vha, 0x204f, +- "Async done-%s res %x, WWPN %8phC ID %3phC \n", +- sp->name, res, fcport->port_name, id); ++ if (res == QLA_FUNCTION_TIMEOUT) { ++ ql_dbg(ql_dbg_disc, sp->vha, 0xffff, ++ "Async done-%s WWPN %8phC timed out.\n", ++ sp->name, fcport->port_name); ++ qla24xx_post_gidpn_work(sp->vha, fcport); ++ sp->free(sp); ++ return; ++ } else if (res) { ++ ql_dbg(ql_dbg_disc, sp->vha, 0xffff, ++ "Async done-%s fail res %x, WWPN %8phC\n", ++ sp->name, res, fcport->port_name); ++ } else { ++ ql_dbg(ql_dbg_disc, vha, 0x204f, ++ "Async done-%s good WWPN %8phC ID %3phC\n", ++ sp->name, fcport->port_name, id); ++ } + + qla2x00_fcport_event_handler(vha, &ea); + +@@ -3205,11 +3221,18 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res) + (struct ct_sns_rsp *)sp->u.iocb_cmd.u.ctarg.rsp; + struct event_arg ea; + struct qla_work_evt *e; ++ unsigned long flags; + +- ql_dbg(ql_dbg_disc, vha, 0x2066, +- "Async done-%s res %x ID %3phC. %8phC\n", +- sp->name, res, ct_req->req.port_id.port_id, +- ct_rsp->rsp.gpn_id.port_name); ++ if (res) ++ ql_dbg(ql_dbg_disc, vha, 0x2066, ++ "Async done-%s fail res %x rscn gen %d ID %3phC. %8phC\n", ++ sp->name, res, sp->gen1, ct_req->req.port_id.port_id, ++ ct_rsp->rsp.gpn_id.port_name); ++ else ++ ql_dbg(ql_dbg_disc, vha, 0x2066, ++ "Async done-%s good rscn gen %d ID %3phC. %8phC\n", ++ sp->name, sp->gen1, ct_req->req.port_id.port_id, ++ ct_rsp->rsp.gpn_id.port_name); + + memset(&ea, 0, sizeof(ea)); + memcpy(ea.port_name, ct_rsp->rsp.gpn_id.port_name, WWN_SIZE); +@@ -3220,6 +3243,22 @@ static void qla2x00_async_gpnid_sp_done(void *s, int res) + ea.rc = res; + ea.event = FCME_GPNID_DONE; + ++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags); ++ list_del(&sp->elem); ++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); ++ ++ if (res) { ++ if (res == QLA_FUNCTION_TIMEOUT) ++ qla24xx_post_gpnid_work(sp->vha, &ea.id); ++ sp->free(sp); ++ return; ++ } else if (sp->gen1) { ++ /* There was anoter RSNC for this Nport ID */ ++ qla24xx_post_gpnid_work(sp->vha, &ea.id); ++ sp->free(sp); ++ return; ++ } ++ + qla2x00_fcport_event_handler(vha, &ea); + + e = qla2x00_alloc_work(vha, QLA_EVT_GPNID_DONE); +@@ -3253,8 +3292,9 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id) + { + int rval = QLA_FUNCTION_FAILED; + struct ct_sns_req *ct_req; +- srb_t *sp; ++ srb_t *sp, *tsp; + struct ct_sns_pkt *ct_sns; ++ unsigned long flags; + + if (!vha->flags.online) + goto done; +@@ -3265,8 +3305,22 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id) + + sp->type = SRB_CT_PTHRU_CMD; + sp->name = "gpnid"; ++ sp->u.iocb_cmd.u.ctarg.id = *id; ++ sp->gen1 = 0; + qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha) + 2); + ++ spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags); ++ list_for_each_entry(tsp, &vha->gpnid_list, elem) { ++ if (tsp->u.iocb_cmd.u.ctarg.id.b24 == id->b24) { ++ tsp->gen1++; ++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); ++ sp->free(sp); ++ goto done; ++ } ++ } ++ list_add_tail(&sp->elem, &vha->gpnid_list); ++ spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); ++ + sp->u.iocb_cmd.u.ctarg.req = dma_alloc_coherent(&vha->hw->pdev->dev, + sizeof(struct ct_sns_pkt), &sp->u.iocb_cmd.u.ctarg.req_dma, + GFP_KERNEL); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index b5b48ddca962..9603886737b5 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -864,6 +864,7 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea) + int rval = ea->rc; + fc_port_t *fcport = ea->fcport; + unsigned long flags; ++ u16 opt = ea->sp->u.iocb_cmd.u.mbx.out_mb[10]; + + fcport->flags &= ~FCF_ASYNC_SENT; + +@@ -894,7 +895,8 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea) + } + + spin_lock_irqsave(&vha->hw->tgt.sess_lock, flags); +- ea->fcport->login_gen++; ++ if (opt != PDO_FORCE_ADISC) ++ ea->fcport->login_gen++; + ea->fcport->deleted = 0; + ea->fcport->logout_on_delete = 1; + +@@ -918,6 +920,13 @@ void qla24xx_handle_gpdb_event(scsi_qla_host_t *vha, struct event_arg *ea) + + qla24xx_post_gpsc_work(vha, fcport); + } ++ } else if (ea->fcport->login_succ) { ++ /* ++ * We have an existing session. A late RSCN delivery ++ * must have triggered the session to be re-validate. ++ * session is still valid. ++ */ ++ fcport->disc_state = DSC_LOGIN_COMPLETE; + } + spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); + } /* gpdb event */ +@@ -964,7 +973,7 @@ int qla24xx_fcport_handle_login(struct scsi_qla_host *vha, fc_port_t *fcport) + ql_dbg(ql_dbg_disc, vha, 0x20bd, + "%s %d %8phC post gnl\n", + __func__, __LINE__, fcport->port_name); +- qla24xx_async_gnl(vha, fcport); ++ qla24xx_post_gnl_work(vha, fcport); + } else { + ql_dbg(ql_dbg_disc, vha, 0x20bf, + "%s %d %8phC post login\n", +@@ -1133,7 +1142,7 @@ void qla24xx_handle_relogin_event(scsi_qla_host_t *vha, + ql_dbg(ql_dbg_disc, vha, 0x20e9, "%s %d %8phC post gidpn\n", + __func__, __LINE__, fcport->port_name); + +- qla24xx_async_gidpn(vha, fcport); ++ qla24xx_post_gidpn_work(vha, fcport); + return; + } + +@@ -1348,6 +1357,7 @@ qla24xx_abort_sp_done(void *ptr, int res) + srb_t *sp = ptr; + struct srb_iocb *abt = &sp->u.iocb_cmd; + ++ del_timer(&sp->u.iocb_cmd.timer); + complete(&abt->u.abt.comp); + } + +@@ -1445,6 +1455,8 @@ static void + qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + { + port_id_t cid; /* conflict Nport id */ ++ u16 lid; ++ struct fc_port *conflict_fcport; + + switch (ea->data[0]) { + case MBS_COMMAND_COMPLETE: +@@ -1460,8 +1472,12 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + qla24xx_post_prli_work(vha, ea->fcport); + } else { + ql_dbg(ql_dbg_disc, vha, 0x20ea, +- "%s %d %8phC post gpdb\n", +- __func__, __LINE__, ea->fcport->port_name); ++ "%s %d %8phC LoopID 0x%x in use with %06x. post gnl\n", ++ __func__, __LINE__, ea->fcport->port_name, ++ ea->fcport->loop_id, ea->fcport->d_id.b24); ++ ++ set_bit(ea->fcport->loop_id, vha->hw->loop_id_map); ++ ea->fcport->loop_id = FC_NO_LOOP_ID; + ea->fcport->chip_reset = vha->hw->base_qpair->chip_reset; + ea->fcport->logout_on_delete = 1; + ea->fcport->send_els_logo = 0; +@@ -1506,8 +1522,38 @@ qla24xx_handle_plogi_done_event(struct scsi_qla_host *vha, struct event_arg *ea) + ea->fcport->d_id.b.domain, ea->fcport->d_id.b.area, + ea->fcport->d_id.b.al_pa); + +- qla2x00_clear_loop_id(ea->fcport); +- qla24xx_post_gidpn_work(vha, ea->fcport); ++ lid = ea->iop[1] & 0xffff; ++ qlt_find_sess_invalidate_other(vha, ++ wwn_to_u64(ea->fcport->port_name), ++ ea->fcport->d_id, lid, &conflict_fcport); ++ ++ if (conflict_fcport) { ++ /* ++ * Another fcport share the same loop_id/nport id. ++ * Conflict fcport needs to finish cleanup before this ++ * fcport can proceed to login. ++ */ ++ conflict_fcport->conflict = ea->fcport; ++ ea->fcport->login_pause = 1; ++ ++ ql_dbg(ql_dbg_disc, vha, 0x20ed, ++ "%s %d %8phC NPortId %06x inuse with loopid 0x%x. post gidpn\n", ++ __func__, __LINE__, ea->fcport->port_name, ++ ea->fcport->d_id.b24, lid); ++ qla2x00_clear_loop_id(ea->fcport); ++ qla24xx_post_gidpn_work(vha, ea->fcport); ++ } else { ++ ql_dbg(ql_dbg_disc, vha, 0x20ed, ++ "%s %d %8phC NPortId %06x inuse with loopid 0x%x. sched delete\n", ++ __func__, __LINE__, ea->fcport->port_name, ++ ea->fcport->d_id.b24, lid); ++ ++ qla2x00_clear_loop_id(ea->fcport); ++ set_bit(lid, vha->hw->loop_id_map); ++ ea->fcport->loop_id = lid; ++ ea->fcport->keep_nport_handle = 0; ++ qlt_schedule_sess_for_deletion(ea->fcport, false); ++ } + break; + } + return; +@@ -8047,9 +8093,6 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair) + int ret = QLA_FUNCTION_FAILED; + struct qla_hw_data *ha = qpair->hw; + +- if (!vha->flags.qpairs_req_created && !vha->flags.qpairs_rsp_created) +- goto fail; +- + qpair->delete_in_progress = 1; + while (atomic_read(&qpair->ref_count)) + msleep(500); +@@ -8057,6 +8100,7 @@ int qla2xxx_delete_qpair(struct scsi_qla_host *vha, struct qla_qpair *qpair) + ret = qla25xx_delete_req_que(vha, qpair->req); + if (ret != QLA_SUCCESS) + goto fail; ++ + ret = qla25xx_delete_rsp_que(vha, qpair->rsp); + if (ret != QLA_SUCCESS) + goto fail; +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 2f94159186d7..63bea6a65d51 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2392,26 +2392,13 @@ qla2x00_els_dcmd_iocb_timeout(void *data) + srb_t *sp = data; + fc_port_t *fcport = sp->fcport; + struct scsi_qla_host *vha = sp->vha; +- struct qla_hw_data *ha = vha->hw; + struct srb_iocb *lio = &sp->u.iocb_cmd; +- unsigned long flags = 0; + + ql_dbg(ql_dbg_io, vha, 0x3069, + "%s Timeout, hdl=%x, portid=%02x%02x%02x\n", + sp->name, sp->handle, fcport->d_id.b.domain, fcport->d_id.b.area, + fcport->d_id.b.al_pa); + +- /* Abort the exchange */ +- spin_lock_irqsave(&ha->hardware_lock, flags); +- if (ha->isp_ops->abort_command(sp)) { +- ql_dbg(ql_dbg_io, vha, 0x3070, +- "mbx abort_command failed.\n"); +- } else { +- ql_dbg(ql_dbg_io, vha, 0x3071, +- "mbx abort_command success.\n"); +- } +- spin_unlock_irqrestore(&ha->hardware_lock, flags); +- + complete(&lio->u.els_logo.comp); + } + +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 9d9668aac6f6..d95b879c2bca 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -1569,7 +1569,7 @@ qla24xx_els_ct_entry(scsi_qla_host_t *vha, struct req_que *req, + /* borrowing sts_entry_24xx.comp_status. + same location as ct_entry_24xx.comp_status + */ +- res = qla2x00_chk_ms_status(vha, (ms_iocb_entry_t *)pkt, ++ res = qla2x00_chk_ms_status(sp->vha, (ms_iocb_entry_t *)pkt, + (struct ct_sns_rsp *)sp->u.iocb_cmd.u.ctarg.rsp, + sp->name); + sp->done(sp, res); +@@ -2341,7 +2341,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + int res = 0; + uint16_t state_flags = 0; + uint16_t retry_delay = 0; +- uint8_t no_logout = 0; + + sts = (sts_entry_t *) pkt; + sts24 = (struct sts_entry_24xx *) pkt; +@@ -2612,7 +2611,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + break; + + case CS_PORT_LOGGED_OUT: +- no_logout = 1; + case CS_PORT_CONFIG_CHG: + case CS_PORT_BUSY: + case CS_INCOMPLETE: +@@ -2643,9 +2641,6 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + port_state_str[atomic_read(&fcport->state)], + comp_status); + +- if (no_logout) +- fcport->logout_on_delete = 0; +- + qla2x00_mark_device_lost(fcport->vha, fcport, 1, 1); + qlt_schedule_sess_for_deletion_lock(fcport); + } +diff --git a/drivers/scsi/qla2xxx/qla_mbx.c b/drivers/scsi/qla2xxx/qla_mbx.c +index 99502fa90810..2d909e12e23a 100644 +--- a/drivers/scsi/qla2xxx/qla_mbx.c ++++ b/drivers/scsi/qla2xxx/qla_mbx.c +@@ -6078,8 +6078,7 @@ int __qla24xx_parse_gpdb(struct scsi_qla_host *vha, fc_port_t *fcport, + } + + /* Check for logged in state. */ +- if (current_login_state != PDS_PRLI_COMPLETE && +- last_login_state != PDS_PRLI_COMPLETE) { ++ if (current_login_state != PDS_PRLI_COMPLETE) { + ql_dbg(ql_dbg_mbx, vha, 0x119a, + "Unable to verify login-state (%x/%x) for loop_id %x.\n", + current_login_state, last_login_state, fcport->loop_id); +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index c0f8f6c17b79..78df7cfca568 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -343,15 +343,21 @@ qla2x00_do_dpc_vp(scsi_qla_host_t *vha) + "FCPort update end.\n"); + } + +- if ((test_and_clear_bit(RELOGIN_NEEDED, &vha->dpc_flags)) && +- !test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags) && +- atomic_read(&vha->loop_state) != LOOP_DOWN) { +- +- ql_dbg(ql_dbg_dpc, vha, 0x4018, +- "Relogin needed scheduled.\n"); +- qla2x00_relogin(vha); +- ql_dbg(ql_dbg_dpc, vha, 0x4019, +- "Relogin needed end.\n"); ++ if (test_bit(RELOGIN_NEEDED, &vha->dpc_flags) && ++ !test_bit(LOOP_RESYNC_NEEDED, &vha->dpc_flags) && ++ atomic_read(&vha->loop_state) != LOOP_DOWN) { ++ ++ if (!vha->relogin_jif || ++ time_after_eq(jiffies, vha->relogin_jif)) { ++ vha->relogin_jif = jiffies + HZ; ++ clear_bit(RELOGIN_NEEDED, &vha->dpc_flags); ++ ++ ql_dbg(ql_dbg_dpc, vha, 0x4018, ++ "Relogin needed scheduled.\n"); ++ qla2x00_relogin(vha); ++ ql_dbg(ql_dbg_dpc, vha, 0x4019, ++ "Relogin needed end.\n"); ++ } + } + + if (test_and_clear_bit(RESET_MARKER_NEEDED, &vha->dpc_flags) && +@@ -569,14 +575,15 @@ qla25xx_free_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) + int + qla25xx_delete_req_que(struct scsi_qla_host *vha, struct req_que *req) + { +- int ret = -1; ++ int ret = QLA_SUCCESS; + +- if (req) { ++ if (req && vha->flags.qpairs_req_created) { + req->options |= BIT_0; + ret = qla25xx_init_req_que(vha, req); ++ if (ret != QLA_SUCCESS) ++ return QLA_FUNCTION_FAILED; + } +- if (ret == QLA_SUCCESS) +- qla25xx_free_req_que(vha, req); ++ qla25xx_free_req_que(vha, req); + + return ret; + } +@@ -584,14 +591,15 @@ qla25xx_delete_req_que(struct scsi_qla_host *vha, struct req_que *req) + int + qla25xx_delete_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) + { +- int ret = -1; ++ int ret = QLA_SUCCESS; + +- if (rsp) { ++ if (rsp && vha->flags.qpairs_rsp_created) { + rsp->options |= BIT_0; + ret = qla25xx_init_rsp_que(vha, rsp); ++ if (ret != QLA_SUCCESS) ++ return QLA_FUNCTION_FAILED; + } +- if (ret == QLA_SUCCESS) +- qla25xx_free_rsp_que(vha, rsp); ++ qla25xx_free_rsp_que(vha, rsp); + + return ret; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 6eaaa326e508..cfe7654f6bd3 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3003,9 +3003,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + base_vha = qla2x00_create_host(sht, ha); + if (!base_vha) { + ret = -ENOMEM; +- qla2x00_mem_free(ha); +- qla2x00_free_req_que(ha, req); +- qla2x00_free_rsp_que(ha, rsp); + goto probe_hw_failed; + } + +@@ -3066,7 +3063,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + /* Set up the irqs */ + ret = qla2x00_request_irqs(ha, rsp); + if (ret) +- goto probe_init_failed; ++ goto probe_hw_failed; + + /* Alloc arrays of request and response ring ptrs */ + if (!qla2x00_alloc_queues(ha, req, rsp)) { +@@ -3177,10 +3174,11 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + host->can_queue, base_vha->req, + base_vha->mgmt_svr_loop_id, host->sg_tablesize); + ++ ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0); ++ + if (ha->mqenable) { + bool mq = false; + bool startit = false; +- ha->wq = alloc_workqueue("qla2xxx_wq", WQ_MEM_RECLAIM, 0); + + if (QLA_TGT_MODE_ENABLED()) { + mq = true; +@@ -3374,6 +3372,9 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + scsi_host_put(base_vha->host); + + probe_hw_failed: ++ qla2x00_mem_free(ha); ++ qla2x00_free_req_que(ha, req); ++ qla2x00_free_rsp_que(ha, rsp); + qla2x00_clear_drv_active(ha); + + iospace_config_failed: +@@ -4498,6 +4499,7 @@ struct scsi_qla_host *qla2x00_create_host(struct scsi_host_template *sht, + INIT_LIST_HEAD(&vha->qp_list); + INIT_LIST_HEAD(&vha->gnl.fcports); + INIT_LIST_HEAD(&vha->nvme_rport_list); ++ INIT_LIST_HEAD(&vha->gpnid_list); + + spin_lock_init(&vha->work_lock); + spin_lock_init(&vha->cmd_list_lock); +@@ -4732,11 +4734,11 @@ void qla24xx_create_new_sess(struct scsi_qla_host *vha, struct qla_work_evt *e) + } else { + list_add_tail(&fcport->list, &vha->vp_fcports); + +- if (pla) { +- qlt_plogi_ack_link(vha, pla, fcport, +- QLT_PLOGI_LINK_SAME_WWN); +- pla->ref_count--; +- } ++ } ++ if (pla) { ++ qlt_plogi_ack_link(vha, pla, fcport, ++ QLT_PLOGI_LINK_SAME_WWN); ++ pla->ref_count--; + } + } + spin_unlock_irqrestore(&vha->hw->tgt.sess_lock, flags); +@@ -4858,7 +4860,7 @@ void qla2x00_relogin(struct scsi_qla_host *vha) + */ + if (atomic_read(&fcport->state) != FCS_ONLINE && + fcport->login_retry && !(fcport->flags & FCF_ASYNC_SENT)) { +- fcport->login_retry--; ++ + if (fcport->flags & FCF_FABRIC_DEVICE) { + ql_dbg(ql_dbg_disc, fcport->vha, 0x2108, + "%s %8phC DS %d LS %d\n", __func__, +@@ -4869,6 +4871,7 @@ void qla2x00_relogin(struct scsi_qla_host *vha) + ea.fcport = fcport; + qla2x00_fcport_event_handler(vha, &ea); + } else { ++ fcport->login_retry--; + status = qla2x00_local_device_login(vha, + fcport); + if (status == QLA_SUCCESS) { +@@ -5851,16 +5854,21 @@ qla2x00_do_dpc(void *data) + } + + /* Retry each device up to login retry count */ +- if ((test_and_clear_bit(RELOGIN_NEEDED, +- &base_vha->dpc_flags)) && ++ if (test_bit(RELOGIN_NEEDED, &base_vha->dpc_flags) && + !test_bit(LOOP_RESYNC_NEEDED, &base_vha->dpc_flags) && + atomic_read(&base_vha->loop_state) != LOOP_DOWN) { + +- ql_dbg(ql_dbg_dpc, base_vha, 0x400d, +- "Relogin scheduled.\n"); +- qla2x00_relogin(base_vha); +- ql_dbg(ql_dbg_dpc, base_vha, 0x400e, +- "Relogin end.\n"); ++ if (!base_vha->relogin_jif || ++ time_after_eq(jiffies, base_vha->relogin_jif)) { ++ base_vha->relogin_jif = jiffies + HZ; ++ clear_bit(RELOGIN_NEEDED, &base_vha->dpc_flags); ++ ++ ql_dbg(ql_dbg_dpc, base_vha, 0x400d, ++ "Relogin scheduled.\n"); ++ qla2x00_relogin(base_vha); ++ ql_dbg(ql_dbg_dpc, base_vha, 0x400e, ++ "Relogin end.\n"); ++ } + } + loop_resync_check: + if (test_and_clear_bit(LOOP_RESYNC_NEEDED, +@@ -6591,9 +6599,14 @@ qla83xx_disable_laser(scsi_qla_host_t *vha) + + static int qla2xxx_map_queues(struct Scsi_Host *shost) + { ++ int rc; + scsi_qla_host_t *vha = (scsi_qla_host_t *)shost->hostdata; + +- return blk_mq_pci_map_queues(&shost->tag_set, vha->hw->pdev); ++ if (USER_CTRL_IRQ(vha->hw)) ++ rc = blk_mq_map_queues(&shost->tag_set); ++ else ++ rc = blk_mq_pci_map_queues(&shost->tag_set, vha->hw->pdev); ++ return rc; + } + + static const struct pci_error_handlers qla2xxx_err_handler = { +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index f05cfc83c9c8..040a76011ffa 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -665,7 +665,7 @@ int qla24xx_async_notify_ack(scsi_qla_host_t *vha, fc_port_t *fcport, + qla2x00_init_timer(sp, qla2x00_get_async_timeout(vha)+2); + + sp->u.iocb_cmd.u.nack.ntfy = ntfy; +- ++ sp->u.iocb_cmd.timeout = qla2x00_async_iocb_timeout; + sp->done = qla2x00_async_nack_sp_done; + + rval = qla2x00_start_sp(sp); +@@ -974,7 +974,7 @@ static void qlt_free_session_done(struct work_struct *work) + qlt_send_first_logo(vha, &logo); + } + +- if (sess->logout_on_delete) { ++ if (sess->logout_on_delete && sess->loop_id != FC_NO_LOOP_ID) { + int rc; + + rc = qla2x00_post_async_logout_work(vha, sess, NULL); +@@ -1033,8 +1033,7 @@ static void qlt_free_session_done(struct work_struct *work) + sess->login_succ = 0; + } + +- if (sess->chip_reset != ha->base_qpair->chip_reset) +- qla2x00_clear_loop_id(sess); ++ qla2x00_clear_loop_id(sess); + + if (sess->conflict) { + sess->conflict->login_pause = 0; +@@ -1205,7 +1204,8 @@ void qlt_schedule_sess_for_deletion(struct fc_port *sess, + ql_dbg(ql_dbg_tgt, sess->vha, 0xe001, + "Scheduling sess %p for deletion\n", sess); + +- schedule_work(&sess->del_work); ++ INIT_WORK(&sess->del_work, qla24xx_delete_sess_fn); ++ queue_work(sess->vha->hw->wq, &sess->del_work); + } + + void qlt_schedule_sess_for_deletion_lock(struct fc_port *sess) +@@ -1560,8 +1560,11 @@ static void qlt_release(struct qla_tgt *tgt) + + btree_destroy64(&tgt->lun_qpair_map); + +- if (ha->tgt.tgt_ops && ha->tgt.tgt_ops->remove_target) +- ha->tgt.tgt_ops->remove_target(vha); ++ if (vha->vp_idx) ++ if (ha->tgt.tgt_ops && ++ ha->tgt.tgt_ops->remove_target && ++ vha->vha_tgt.target_lport_ptr) ++ ha->tgt.tgt_ops->remove_target(vha); + + vha->vha_tgt.qla_tgt = NULL; + +@@ -3708,7 +3711,7 @@ static int qlt_term_ctio_exchange(struct qla_qpair *qpair, void *ctio, + term = 1; + + if (term) +- qlt_term_ctio_exchange(qpair, ctio, cmd, status); ++ qlt_send_term_exchange(qpair, cmd, &cmd->atio, 1, 0); + + return term; + } +@@ -4584,9 +4587,9 @@ qlt_find_sess_invalidate_other(scsi_qla_host_t *vha, uint64_t wwn, + "Invalidating sess %p loop_id %d wwn %llx.\n", + other_sess, other_sess->loop_id, other_wwn); + +- + other_sess->keep_nport_handle = 1; +- *conflict_sess = other_sess; ++ if (other_sess->disc_state != DSC_DELETED) ++ *conflict_sess = other_sess; + qlt_schedule_sess_for_deletion(other_sess, + true); + } +@@ -5755,7 +5758,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha, + unsigned long flags; + u8 newfcport = 0; + +- fcport = kzalloc(sizeof(*fcport), GFP_KERNEL); ++ fcport = qla2x00_alloc_fcport(vha, GFP_KERNEL); + if (!fcport) { + ql_dbg(ql_dbg_tgt_mgt, vha, 0xf06f, + "qla_target(%d): Allocation of tmp FC port failed", +@@ -5784,6 +5787,7 @@ static fc_port_t *qlt_get_port_database(struct scsi_qla_host *vha, + tfcp->port_type = fcport->port_type; + tfcp->supported_classes = fcport->supported_classes; + tfcp->flags |= fcport->flags; ++ tfcp->scan_state = QLA_FCPORT_FOUND; + + del = fcport; + fcport = tfcp; +diff --git a/drivers/scsi/scsi_error.c b/drivers/scsi/scsi_error.c +index fa504ba83ade..cf70f0bb8375 100644 +--- a/drivers/scsi/scsi_error.c ++++ b/drivers/scsi/scsi_error.c +@@ -222,7 +222,8 @@ static void scsi_eh_reset(struct scsi_cmnd *scmd) + + static void scsi_eh_inc_host_failed(struct rcu_head *head) + { +- struct Scsi_Host *shost = container_of(head, typeof(*shost), rcu); ++ struct scsi_cmnd *scmd = container_of(head, typeof(*scmd), rcu); ++ struct Scsi_Host *shost = scmd->device->host; + unsigned long flags; + + spin_lock_irqsave(shost->host_lock, flags); +@@ -258,7 +259,7 @@ void scsi_eh_scmd_add(struct scsi_cmnd *scmd) + * Ensure that all tasks observe the host state change before the + * host_failed change. + */ +- call_rcu(&shost->rcu, scsi_eh_inc_host_failed); ++ call_rcu(&scmd->rcu, scsi_eh_inc_host_failed); + } + + /** +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 0d3696e9dddd..359386730523 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -670,6 +670,7 @@ static bool scsi_end_request(struct request *req, blk_status_t error, + if (!blk_rq_is_scsi(req)) { + WARN_ON_ONCE(!(cmd->flags & SCMD_INITIALIZED)); + cmd->flags &= ~SCMD_INITIALIZED; ++ destroy_rcu_head(&cmd->rcu); + } + + if (req->mq_ctx) { +@@ -1150,6 +1151,7 @@ void scsi_initialize_rq(struct request *rq) + struct scsi_cmnd *cmd = blk_mq_rq_to_pdu(rq); + + scsi_req_init(&cmd->req); ++ init_rcu_head(&cmd->rcu); + cmd->jiffies_at_alloc = jiffies; + cmd->retries = 0; + } +diff --git a/drivers/virtio/virtio_ring.c b/drivers/virtio/virtio_ring.c +index eb30f3e09a47..71458f493cf8 100644 +--- a/drivers/virtio/virtio_ring.c ++++ b/drivers/virtio/virtio_ring.c +@@ -428,8 +428,6 @@ static inline int virtqueue_add(struct virtqueue *_vq, + i = virtio16_to_cpu(_vq->vdev, vq->vring.desc[i].next); + } + +- vq->vq.num_free += total_sg; +- + if (indirect) + kfree(desc); + +diff --git a/drivers/watchdog/hpwdt.c b/drivers/watchdog/hpwdt.c +index 67fbe35ce7cf..b0a158073abd 100644 +--- a/drivers/watchdog/hpwdt.c ++++ b/drivers/watchdog/hpwdt.c +@@ -28,16 +28,7 @@ + #include + #include + #include +-#ifdef CONFIG_HPWDT_NMI_DECODING +-#include +-#include +-#include +-#include +-#include +-#include +-#endif /* CONFIG_HPWDT_NMI_DECODING */ + #include +-#include + + #define HPWDT_VERSION "1.4.0" + #define SECS_TO_TICKS(secs) ((secs) * 1000 / 128) +@@ -48,10 +39,14 @@ + static unsigned int soft_margin = DEFAULT_MARGIN; /* in seconds */ + static unsigned int reload; /* the computed soft_margin */ + static bool nowayout = WATCHDOG_NOWAYOUT; ++#ifdef CONFIG_HPWDT_NMI_DECODING ++static unsigned int allow_kdump = 1; ++#endif + static char expect_release; + static unsigned long hpwdt_is_open; + + static void __iomem *pci_mem_addr; /* the PCI-memory address */ ++static unsigned long __iomem *hpwdt_nmistat; + static unsigned long __iomem *hpwdt_timer_reg; + static unsigned long __iomem *hpwdt_timer_con; + +@@ -62,373 +57,6 @@ static const struct pci_device_id hpwdt_devices[] = { + }; + MODULE_DEVICE_TABLE(pci, hpwdt_devices); + +-#ifdef CONFIG_HPWDT_NMI_DECODING +-#define PCI_BIOS32_SD_VALUE 0x5F32335F /* "_32_" */ +-#define CRU_BIOS_SIGNATURE_VALUE 0x55524324 +-#define PCI_BIOS32_PARAGRAPH_LEN 16 +-#define PCI_ROM_BASE1 0x000F0000 +-#define ROM_SIZE 0x10000 +- +-struct bios32_service_dir { +- u32 signature; +- u32 entry_point; +- u8 revision; +- u8 length; +- u8 checksum; +- u8 reserved[5]; +-}; +- +-/* type 212 */ +-struct smbios_cru64_info { +- u8 type; +- u8 byte_length; +- u16 handle; +- u32 signature; +- u64 physical_address; +- u32 double_length; +- u32 double_offset; +-}; +-#define SMBIOS_CRU64_INFORMATION 212 +- +-/* type 219 */ +-struct smbios_proliant_info { +- u8 type; +- u8 byte_length; +- u16 handle; +- u32 power_features; +- u32 omega_features; +- u32 reserved; +- u32 misc_features; +-}; +-#define SMBIOS_ICRU_INFORMATION 219 +- +- +-struct cmn_registers { +- union { +- struct { +- u8 ral; +- u8 rah; +- u16 rea2; +- }; +- u32 reax; +- } u1; +- union { +- struct { +- u8 rbl; +- u8 rbh; +- u8 reb2l; +- u8 reb2h; +- }; +- u32 rebx; +- } u2; +- union { +- struct { +- u8 rcl; +- u8 rch; +- u16 rec2; +- }; +- u32 recx; +- } u3; +- union { +- struct { +- u8 rdl; +- u8 rdh; +- u16 red2; +- }; +- u32 redx; +- } u4; +- +- u32 resi; +- u32 redi; +- u16 rds; +- u16 res; +- u32 reflags; +-} __attribute__((packed)); +- +-static unsigned int hpwdt_nmi_decoding; +-static unsigned int allow_kdump = 1; +-static unsigned int is_icru; +-static unsigned int is_uefi; +-static DEFINE_SPINLOCK(rom_lock); +-static void *cru_rom_addr; +-static struct cmn_registers cmn_regs; +- +-extern asmlinkage void asminline_call(struct cmn_registers *pi86Regs, +- unsigned long *pRomEntry); +- +-#ifdef CONFIG_X86_32 +-/* --32 Bit Bios------------------------------------------------------------ */ +- +-#define HPWDT_ARCH 32 +- +-asm(".text \n\t" +- ".align 4 \n\t" +- ".globl asminline_call \n" +- "asminline_call: \n\t" +- "pushl %ebp \n\t" +- "movl %esp, %ebp \n\t" +- "pusha \n\t" +- "pushf \n\t" +- "push %es \n\t" +- "push %ds \n\t" +- "pop %es \n\t" +- "movl 8(%ebp),%eax \n\t" +- "movl 4(%eax),%ebx \n\t" +- "movl 8(%eax),%ecx \n\t" +- "movl 12(%eax),%edx \n\t" +- "movl 16(%eax),%esi \n\t" +- "movl 20(%eax),%edi \n\t" +- "movl (%eax),%eax \n\t" +- "push %cs \n\t" +- "call *12(%ebp) \n\t" +- "pushf \n\t" +- "pushl %eax \n\t" +- "movl 8(%ebp),%eax \n\t" +- "movl %ebx,4(%eax) \n\t" +- "movl %ecx,8(%eax) \n\t" +- "movl %edx,12(%eax) \n\t" +- "movl %esi,16(%eax) \n\t" +- "movl %edi,20(%eax) \n\t" +- "movw %ds,24(%eax) \n\t" +- "movw %es,26(%eax) \n\t" +- "popl %ebx \n\t" +- "movl %ebx,(%eax) \n\t" +- "popl %ebx \n\t" +- "movl %ebx,28(%eax) \n\t" +- "pop %es \n\t" +- "popf \n\t" +- "popa \n\t" +- "leave \n\t" +- "ret \n\t" +- ".previous"); +- +- +-/* +- * cru_detect +- * +- * Routine Description: +- * This function uses the 32-bit BIOS Service Directory record to +- * search for a $CRU record. +- * +- * Return Value: +- * 0 : SUCCESS +- * <0 : FAILURE +- */ +-static int cru_detect(unsigned long map_entry, +- unsigned long map_offset) +-{ +- void *bios32_map; +- unsigned long *bios32_entrypoint; +- unsigned long cru_physical_address; +- unsigned long cru_length; +- unsigned long physical_bios_base = 0; +- unsigned long physical_bios_offset = 0; +- int retval = -ENODEV; +- +- bios32_map = ioremap(map_entry, (2 * PAGE_SIZE)); +- +- if (bios32_map == NULL) +- return -ENODEV; +- +- bios32_entrypoint = bios32_map + map_offset; +- +- cmn_regs.u1.reax = CRU_BIOS_SIGNATURE_VALUE; +- +- set_memory_x((unsigned long)bios32_map, 2); +- asminline_call(&cmn_regs, bios32_entrypoint); +- +- if (cmn_regs.u1.ral != 0) { +- pr_warn("Call succeeded but with an error: 0x%x\n", +- cmn_regs.u1.ral); +- } else { +- physical_bios_base = cmn_regs.u2.rebx; +- physical_bios_offset = cmn_regs.u4.redx; +- cru_length = cmn_regs.u3.recx; +- cru_physical_address = +- physical_bios_base + physical_bios_offset; +- +- /* If the values look OK, then map it in. */ +- if ((physical_bios_base + physical_bios_offset)) { +- cru_rom_addr = +- ioremap(cru_physical_address, cru_length); +- if (cru_rom_addr) { +- set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK, +- (cru_length + PAGE_SIZE - 1) >> PAGE_SHIFT); +- retval = 0; +- } +- } +- +- pr_debug("CRU Base Address: 0x%lx\n", physical_bios_base); +- pr_debug("CRU Offset Address: 0x%lx\n", physical_bios_offset); +- pr_debug("CRU Length: 0x%lx\n", cru_length); +- pr_debug("CRU Mapped Address: %p\n", &cru_rom_addr); +- } +- iounmap(bios32_map); +- return retval; +-} +- +-/* +- * bios_checksum +- */ +-static int bios_checksum(const char __iomem *ptr, int len) +-{ +- char sum = 0; +- int i; +- +- /* +- * calculate checksum of size bytes. This should add up +- * to zero if we have a valid header. +- */ +- for (i = 0; i < len; i++) +- sum += ptr[i]; +- +- return ((sum == 0) && (len > 0)); +-} +- +-/* +- * bios32_present +- * +- * Routine Description: +- * This function finds the 32-bit BIOS Service Directory +- * +- * Return Value: +- * 0 : SUCCESS +- * <0 : FAILURE +- */ +-static int bios32_present(const char __iomem *p) +-{ +- struct bios32_service_dir *bios_32_ptr; +- int length; +- unsigned long map_entry, map_offset; +- +- bios_32_ptr = (struct bios32_service_dir *) p; +- +- /* +- * Search for signature by checking equal to the swizzled value +- * instead of calling another routine to perform a strcmp. +- */ +- if (bios_32_ptr->signature == PCI_BIOS32_SD_VALUE) { +- length = bios_32_ptr->length * PCI_BIOS32_PARAGRAPH_LEN; +- if (bios_checksum(p, length)) { +- /* +- * According to the spec, we're looking for the +- * first 4KB-aligned address below the entrypoint +- * listed in the header. The Service Directory code +- * is guaranteed to occupy no more than 2 4KB pages. +- */ +- map_entry = bios_32_ptr->entry_point & ~(PAGE_SIZE - 1); +- map_offset = bios_32_ptr->entry_point - map_entry; +- +- return cru_detect(map_entry, map_offset); +- } +- } +- return -ENODEV; +-} +- +-static int detect_cru_service(void) +-{ +- char __iomem *p, *q; +- int rc = -1; +- +- /* +- * Search from 0x0f0000 through 0x0fffff, inclusive. +- */ +- p = ioremap(PCI_ROM_BASE1, ROM_SIZE); +- if (p == NULL) +- return -ENOMEM; +- +- for (q = p; q < p + ROM_SIZE; q += 16) { +- rc = bios32_present(q); +- if (!rc) +- break; +- } +- iounmap(p); +- return rc; +-} +-/* ------------------------------------------------------------------------- */ +-#endif /* CONFIG_X86_32 */ +-#ifdef CONFIG_X86_64 +-/* --64 Bit Bios------------------------------------------------------------ */ +- +-#define HPWDT_ARCH 64 +- +-asm(".text \n\t" +- ".align 4 \n\t" +- ".globl asminline_call \n\t" +- ".type asminline_call, @function \n\t" +- "asminline_call: \n\t" +- FRAME_BEGIN +- "pushq %rax \n\t" +- "pushq %rbx \n\t" +- "pushq %rdx \n\t" +- "pushq %r12 \n\t" +- "pushq %r9 \n\t" +- "movq %rsi, %r12 \n\t" +- "movq %rdi, %r9 \n\t" +- "movl 4(%r9),%ebx \n\t" +- "movl 8(%r9),%ecx \n\t" +- "movl 12(%r9),%edx \n\t" +- "movl 16(%r9),%esi \n\t" +- "movl 20(%r9),%edi \n\t" +- "movl (%r9),%eax \n\t" +- "call *%r12 \n\t" +- "pushfq \n\t" +- "popq %r12 \n\t" +- "movl %eax, (%r9) \n\t" +- "movl %ebx, 4(%r9) \n\t" +- "movl %ecx, 8(%r9) \n\t" +- "movl %edx, 12(%r9) \n\t" +- "movl %esi, 16(%r9) \n\t" +- "movl %edi, 20(%r9) \n\t" +- "movq %r12, %rax \n\t" +- "movl %eax, 28(%r9) \n\t" +- "popq %r9 \n\t" +- "popq %r12 \n\t" +- "popq %rdx \n\t" +- "popq %rbx \n\t" +- "popq %rax \n\t" +- FRAME_END +- "ret \n\t" +- ".previous"); +- +-/* +- * dmi_find_cru +- * +- * Routine Description: +- * This function checks whether or not a SMBIOS/DMI record is +- * the 64bit CRU info or not +- */ +-static void dmi_find_cru(const struct dmi_header *dm, void *dummy) +-{ +- struct smbios_cru64_info *smbios_cru64_ptr; +- unsigned long cru_physical_address; +- +- if (dm->type == SMBIOS_CRU64_INFORMATION) { +- smbios_cru64_ptr = (struct smbios_cru64_info *) dm; +- if (smbios_cru64_ptr->signature == CRU_BIOS_SIGNATURE_VALUE) { +- cru_physical_address = +- smbios_cru64_ptr->physical_address + +- smbios_cru64_ptr->double_offset; +- cru_rom_addr = ioremap(cru_physical_address, +- smbios_cru64_ptr->double_length); +- set_memory_x((unsigned long)cru_rom_addr & PAGE_MASK, +- smbios_cru64_ptr->double_length >> PAGE_SHIFT); +- } +- } +-} +- +-static int detect_cru_service(void) +-{ +- cru_rom_addr = NULL; +- +- dmi_walk(dmi_find_cru, NULL); +- +- /* if cru_rom_addr has been set then we found a CRU service */ +- return ((cru_rom_addr != NULL) ? 0 : -ENODEV); +-} +-/* ------------------------------------------------------------------------- */ +-#endif /* CONFIG_X86_64 */ +-#endif /* CONFIG_HPWDT_NMI_DECODING */ + + /* + * Watchdog operations +@@ -475,32 +103,22 @@ static int hpwdt_time_left(void) + } + + #ifdef CONFIG_HPWDT_NMI_DECODING ++static int hpwdt_my_nmi(void) ++{ ++ return ioread8(hpwdt_nmistat) & 0x6; ++} ++ + /* + * NMI Handler + */ + static int hpwdt_pretimeout(unsigned int ulReason, struct pt_regs *regs) + { +- unsigned long rom_pl; +- static int die_nmi_called; +- +- if (!hpwdt_nmi_decoding) ++ if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi()) + return NMI_DONE; + +- spin_lock_irqsave(&rom_lock, rom_pl); +- if (!die_nmi_called && !is_icru && !is_uefi) +- asminline_call(&cmn_regs, cru_rom_addr); +- die_nmi_called = 1; +- spin_unlock_irqrestore(&rom_lock, rom_pl); +- + if (allow_kdump) + hpwdt_stop(); + +- if (!is_icru && !is_uefi) { +- if (cmn_regs.u1.ral == 0) { +- nmi_panic(regs, "An NMI occurred, but unable to determine source.\n"); +- return NMI_HANDLED; +- } +- } + nmi_panic(regs, "An NMI occurred. Depending on your system the reason " + "for the NMI is logged in any one of the following " + "resources:\n" +@@ -666,84 +284,11 @@ static struct miscdevice hpwdt_miscdev = { + * Init & Exit + */ + +-#ifdef CONFIG_HPWDT_NMI_DECODING +-#ifdef CONFIG_X86_LOCAL_APIC +-static void hpwdt_check_nmi_decoding(struct pci_dev *dev) +-{ +- /* +- * If nmi_watchdog is turned off then we can turn on +- * our nmi decoding capability. +- */ +- hpwdt_nmi_decoding = 1; +-} +-#else +-static void hpwdt_check_nmi_decoding(struct pci_dev *dev) +-{ +- dev_warn(&dev->dev, "NMI decoding is disabled. " +- "Your kernel does not support a NMI Watchdog.\n"); +-} +-#endif /* CONFIG_X86_LOCAL_APIC */ +- +-/* +- * dmi_find_icru +- * +- * Routine Description: +- * This function checks whether or not we are on an iCRU-based server. +- * This check is independent of architecture and needs to be made for +- * any ProLiant system. +- */ +-static void dmi_find_icru(const struct dmi_header *dm, void *dummy) +-{ +- struct smbios_proliant_info *smbios_proliant_ptr; +- +- if (dm->type == SMBIOS_ICRU_INFORMATION) { +- smbios_proliant_ptr = (struct smbios_proliant_info *) dm; +- if (smbios_proliant_ptr->misc_features & 0x01) +- is_icru = 1; +- if (smbios_proliant_ptr->misc_features & 0x408) +- is_uefi = 1; +- } +-} + + static int hpwdt_init_nmi_decoding(struct pci_dev *dev) + { ++#ifdef CONFIG_HPWDT_NMI_DECODING + int retval; +- +- /* +- * On typical CRU-based systems we need to map that service in +- * the BIOS. For 32 bit Operating Systems we need to go through +- * the 32 Bit BIOS Service Directory. For 64 bit Operating +- * Systems we get that service through SMBIOS. +- * +- * On systems that support the new iCRU service all we need to +- * do is call dmi_walk to get the supported flag value and skip +- * the old cru detect code. +- */ +- dmi_walk(dmi_find_icru, NULL); +- if (!is_icru && !is_uefi) { +- +- /* +- * We need to map the ROM to get the CRU service. +- * For 32 bit Operating Systems we need to go through the 32 Bit +- * BIOS Service Directory +- * For 64 bit Operating Systems we get that service through SMBIOS. +- */ +- retval = detect_cru_service(); +- if (retval < 0) { +- dev_warn(&dev->dev, +- "Unable to detect the %d Bit CRU Service.\n", +- HPWDT_ARCH); +- return retval; +- } +- +- /* +- * We know this is the only CRU call we need to make so lets keep as +- * few instructions as possible once the NMI comes in. +- */ +- cmn_regs.u1.rah = 0x0D; +- cmn_regs.u1.ral = 0x02; +- } +- + /* + * Only one function can register for NMI_UNKNOWN + */ +@@ -771,44 +316,25 @@ static int hpwdt_init_nmi_decoding(struct pci_dev *dev) + dev_warn(&dev->dev, + "Unable to register a die notifier (err=%d).\n", + retval); +- if (cru_rom_addr) +- iounmap(cru_rom_addr); + return retval; ++#endif /* CONFIG_HPWDT_NMI_DECODING */ ++ return 0; + } + + static void hpwdt_exit_nmi_decoding(void) + { ++#ifdef CONFIG_HPWDT_NMI_DECODING + unregister_nmi_handler(NMI_UNKNOWN, "hpwdt"); + unregister_nmi_handler(NMI_SERR, "hpwdt"); + unregister_nmi_handler(NMI_IO_CHECK, "hpwdt"); +- if (cru_rom_addr) +- iounmap(cru_rom_addr); +-} +-#else /* !CONFIG_HPWDT_NMI_DECODING */ +-static void hpwdt_check_nmi_decoding(struct pci_dev *dev) +-{ +-} +- +-static int hpwdt_init_nmi_decoding(struct pci_dev *dev) +-{ +- return 0; ++#endif + } + +-static void hpwdt_exit_nmi_decoding(void) +-{ +-} +-#endif /* CONFIG_HPWDT_NMI_DECODING */ +- + static int hpwdt_init_one(struct pci_dev *dev, + const struct pci_device_id *ent) + { + int retval; + +- /* +- * Check if we can do NMI decoding or not +- */ +- hpwdt_check_nmi_decoding(dev); +- + /* + * First let's find out if we are on an iLO2+ server. We will + * not run on a legacy ASM box. +@@ -842,6 +368,7 @@ static int hpwdt_init_one(struct pci_dev *dev, + retval = -ENOMEM; + goto error_pci_iomap; + } ++ hpwdt_nmistat = pci_mem_addr + 0x6e; + hpwdt_timer_reg = pci_mem_addr + 0x70; + hpwdt_timer_con = pci_mem_addr + 0x72; + +@@ -912,6 +439,6 @@ MODULE_PARM_DESC(nowayout, "Watchdog cannot be stopped once started (default=" + #ifdef CONFIG_HPWDT_NMI_DECODING + module_param(allow_kdump, int, 0); + MODULE_PARM_DESC(allow_kdump, "Start a kernel dump after NMI occurs"); +-#endif /* !CONFIG_HPWDT_NMI_DECODING */ ++#endif /* CONFIG_HPWDT_NMI_DECODING */ + + module_pci_driver(hpwdt_driver); +diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c +index 8c10b0562e75..621c517b325c 100644 +--- a/fs/nfs/direct.c ++++ b/fs/nfs/direct.c +@@ -86,10 +86,10 @@ struct nfs_direct_req { + struct nfs_direct_mirror mirrors[NFS_PAGEIO_DESCRIPTOR_MIRROR_MAX]; + int mirror_count; + ++ loff_t io_start; /* Start offset for I/O */ + ssize_t count, /* bytes actually processed */ + max_count, /* max expected count */ + bytes_left, /* bytes left to be sent */ +- io_start, /* start of IO */ + error; /* any reported error */ + struct completion completion; /* wait for i/o completion */ + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 5f2f852ef506..7b34534210ce 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -292,8 +292,11 @@ pnfs_detach_layout_hdr(struct pnfs_layout_hdr *lo) + void + pnfs_put_layout_hdr(struct pnfs_layout_hdr *lo) + { +- struct inode *inode = lo->plh_inode; ++ struct inode *inode; + ++ if (!lo) ++ return; ++ inode = lo->plh_inode; + pnfs_layoutreturn_before_put_layout_hdr(lo); + + if (atomic_dec_and_lock(&lo->plh_refcount, &inode->i_lock)) { +@@ -1223,10 +1226,12 @@ bool pnfs_roc(struct inode *ino, + spin_lock(&ino->i_lock); + lo = nfsi->layout; + if (!lo || !pnfs_layout_is_valid(lo) || +- test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) ++ test_bit(NFS_LAYOUT_BULK_RECALL, &lo->plh_flags)) { ++ lo = NULL; + goto out_noroc; ++ } ++ pnfs_get_layout_hdr(lo); + if (test_bit(NFS_LAYOUT_RETURN_LOCK, &lo->plh_flags)) { +- pnfs_get_layout_hdr(lo); + spin_unlock(&ino->i_lock); + wait_on_bit(&lo->plh_flags, NFS_LAYOUT_RETURN, + TASK_UNINTERRUPTIBLE); +@@ -1294,10 +1299,12 @@ bool pnfs_roc(struct inode *ino, + struct pnfs_layoutdriver_type *ld = NFS_SERVER(ino)->pnfs_curr_ld; + if (ld->prepare_layoutreturn) + ld->prepare_layoutreturn(args); ++ pnfs_put_layout_hdr(lo); + return true; + } + if (layoutreturn) + pnfs_send_layoutreturn(lo, &stateid, iomode, true); ++ pnfs_put_layout_hdr(lo); + return false; + } + +diff --git a/fs/nfs/write.c b/fs/nfs/write.c +index 76da415be39a..19e6ea89ad26 100644 +--- a/fs/nfs/write.c ++++ b/fs/nfs/write.c +@@ -1877,40 +1877,43 @@ int nfs_generic_commit_list(struct inode *inode, struct list_head *head, + return status; + } + +-int nfs_commit_inode(struct inode *inode, int how) ++static int __nfs_commit_inode(struct inode *inode, int how, ++ struct writeback_control *wbc) + { + LIST_HEAD(head); + struct nfs_commit_info cinfo; + int may_wait = how & FLUSH_SYNC; +- int error = 0; +- int res; ++ int ret, nscan; + + nfs_init_cinfo_from_inode(&cinfo, inode); + nfs_commit_begin(cinfo.mds); +- res = nfs_scan_commit(inode, &head, &cinfo); +- if (res) +- error = nfs_generic_commit_list(inode, &head, how, &cinfo); ++ for (;;) { ++ ret = nscan = nfs_scan_commit(inode, &head, &cinfo); ++ if (ret <= 0) ++ break; ++ ret = nfs_generic_commit_list(inode, &head, how, &cinfo); ++ if (ret < 0) ++ break; ++ ret = 0; ++ if (wbc && wbc->sync_mode == WB_SYNC_NONE) { ++ if (nscan < wbc->nr_to_write) ++ wbc->nr_to_write -= nscan; ++ else ++ wbc->nr_to_write = 0; ++ } ++ if (nscan < INT_MAX) ++ break; ++ cond_resched(); ++ } + nfs_commit_end(cinfo.mds); +- if (res == 0) +- return res; +- if (error < 0) +- goto out_error; +- if (!may_wait) +- goto out_mark_dirty; +- error = wait_on_commit(cinfo.mds); +- if (error < 0) +- return error; +- return res; +-out_error: +- res = error; +- /* Note: If we exit without ensuring that the commit is complete, +- * we must mark the inode as dirty. Otherwise, future calls to +- * sync_inode() with the WB_SYNC_ALL flag set will fail to ensure +- * that the data is on the disk. +- */ +-out_mark_dirty: +- __mark_inode_dirty(inode, I_DIRTY_DATASYNC); +- return res; ++ if (ret || !may_wait) ++ return ret; ++ return wait_on_commit(cinfo.mds); ++} ++ ++int nfs_commit_inode(struct inode *inode, int how) ++{ ++ return __nfs_commit_inode(inode, how, NULL); + } + EXPORT_SYMBOL_GPL(nfs_commit_inode); + +@@ -1920,11 +1923,11 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc) + int flags = FLUSH_SYNC; + int ret = 0; + +- /* no commits means nothing needs to be done */ +- if (!atomic_long_read(&nfsi->commit_info.ncommit)) +- return ret; +- + if (wbc->sync_mode == WB_SYNC_NONE) { ++ /* no commits means nothing needs to be done */ ++ if (!atomic_long_read(&nfsi->commit_info.ncommit)) ++ goto check_requests_outstanding; ++ + /* Don't commit yet if this is a non-blocking flush and there + * are a lot of outstanding writes for this mapping. + */ +@@ -1935,16 +1938,16 @@ int nfs_write_inode(struct inode *inode, struct writeback_control *wbc) + flags = 0; + } + +- ret = nfs_commit_inode(inode, flags); +- if (ret >= 0) { +- if (wbc->sync_mode == WB_SYNC_NONE) { +- if (ret < wbc->nr_to_write) +- wbc->nr_to_write -= ret; +- else +- wbc->nr_to_write = 0; +- } +- return 0; +- } ++ ret = __nfs_commit_inode(inode, flags, wbc); ++ if (!ret) { ++ if (flags & FLUSH_SYNC) ++ return 0; ++ } else if (atomic_long_read(&nfsi->commit_info.ncommit)) ++ goto out_mark_dirty; ++ ++check_requests_outstanding: ++ if (!atomic_read(&nfsi->commit_info.rpcs_out)) ++ return ret; + out_mark_dirty: + __mark_inode_dirty(inode, I_DIRTY_DATASYNC); + return ret; +diff --git a/include/drm/drm_crtc_helper.h b/include/drm/drm_crtc_helper.h +index 76e237bd989b..6914633037a5 100644 +--- a/include/drm/drm_crtc_helper.h ++++ b/include/drm/drm_crtc_helper.h +@@ -77,5 +77,6 @@ void drm_kms_helper_hotplug_event(struct drm_device *dev); + + void drm_kms_helper_poll_disable(struct drm_device *dev); + void drm_kms_helper_poll_enable(struct drm_device *dev); ++bool drm_kms_helper_is_poll_worker(void); + + #endif +diff --git a/include/drm/drm_drv.h b/include/drm/drm_drv.h +index 71bbaaec836d..305304965b89 100644 +--- a/include/drm/drm_drv.h ++++ b/include/drm/drm_drv.h +@@ -55,6 +55,7 @@ struct drm_mode_create_dumb; + #define DRIVER_ATOMIC 0x10000 + #define DRIVER_KMS_LEGACY_CONTEXT 0x20000 + #define DRIVER_SYNCOBJ 0x40000 ++#define DRIVER_PREFER_XBGR_30BPP 0x80000 + + /** + * struct drm_driver - DRM driver structure +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index 3b609edffa8f..be3aef6839f6 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -19,3 +19,8 @@ + + #define randomized_struct_fields_start struct { + #define randomized_struct_fields_end }; ++ ++/* Clang doesn't have a way to turn it off per-function, yet. */ ++#ifdef __noretpoline ++#undef __noretpoline ++#endif +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index bf09213895f7..a1ffbf25873f 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -93,6 +93,10 @@ + #define __weak __attribute__((weak)) + #define __alias(symbol) __attribute__((alias(#symbol))) + ++#ifdef RETPOLINE ++#define __noretpoline __attribute__((indirect_branch("keep"))) ++#endif ++ + /* + * it doesn't make sense on ARM (currently the only user of __naked) + * to trace naked functions because then mcount is called without +diff --git a/include/linux/init.h b/include/linux/init.h +index 943139a563e3..07cab8a053af 100644 +--- a/include/linux/init.h ++++ b/include/linux/init.h +@@ -6,10 +6,10 @@ + #include + + /* Built-in __init functions needn't be compiled with retpoline */ +-#if defined(RETPOLINE) && !defined(MODULE) +-#define __noretpoline __attribute__((indirect_branch("keep"))) ++#if defined(__noretpoline) && !defined(MODULE) ++#define __noinitretpoline __noretpoline + #else +-#define __noretpoline ++#define __noinitretpoline + #endif + + /* These macros are used to mark some functions or +@@ -47,7 +47,7 @@ + + /* These are for everybody (although not all archs will actually + discard it in modules) */ +-#define __init __section(.init.text) __cold __inittrace __latent_entropy __noretpoline ++#define __init __section(.init.text) __cold __inittrace __latent_entropy __noinitretpoline + #define __initdata __section(.init.data) + #define __initconst __section(.init.rodata) + #define __exitdata __section(.exit.data) +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index 132e3f5a2e0d..e791ebc65c9c 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -5,6 +5,7 @@ + + #ifndef _LINUX_NOSPEC_H + #define _LINUX_NOSPEC_H ++#include + + /** + * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise +@@ -29,26 +30,6 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + } + #endif + +-/* +- * Warn developers about inappropriate array_index_nospec() usage. +- * +- * Even if the CPU speculates past the WARN_ONCE branch, the +- * sign bit of @index is taken into account when generating the +- * mask. +- * +- * This warning is compiled out when the compiler can infer that +- * @index and @size are less than LONG_MAX. +- */ +-#define array_index_mask_nospec_check(index, size) \ +-({ \ +- if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX, \ +- "array_index_nospec() limited to range of [0, LONG_MAX]\n")) \ +- _mask = 0; \ +- else \ +- _mask = array_index_mask_nospec(index, size); \ +- _mask; \ +-}) +- + /* + * array_index_nospec - sanitize an array index after a bounds check + * +@@ -67,7 +48,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + ({ \ + typeof(index) _i = (index); \ + typeof(size) _s = (size); \ +- unsigned long _mask = array_index_mask_nospec_check(_i, _s); \ ++ unsigned long _mask = array_index_mask_nospec(_i, _s); \ + \ + BUILD_BUG_ON(sizeof(_i) > sizeof(long)); \ + BUILD_BUG_ON(sizeof(_s) > sizeof(long)); \ +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index 5a090f5ab335..881312d85574 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -50,6 +50,7 @@ struct tpm_class_ops { + unsigned long *timeout_cap); + int (*request_locality)(struct tpm_chip *chip, int loc); + void (*relinquish_locality)(struct tpm_chip *chip, int loc); ++ void (*clk_enable)(struct tpm_chip *chip, bool value); + }; + + #if defined(CONFIG_TCG_TPM) || defined(CONFIG_TCG_TPM_MODULE) +diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h +index 0eae11fc7a23..1c527abb1ae5 100644 +--- a/include/linux/workqueue.h ++++ b/include/linux/workqueue.h +@@ -467,6 +467,7 @@ extern bool cancel_delayed_work_sync(struct delayed_work *dwork); + + extern void workqueue_set_max_active(struct workqueue_struct *wq, + int max_active); ++extern struct work_struct *current_work(void); + extern bool current_is_workqueue_rescuer(void); + extern bool workqueue_congested(int cpu, struct workqueue_struct *wq); + extern unsigned int work_busy(struct work_struct *work); +diff --git a/include/scsi/scsi_cmnd.h b/include/scsi/scsi_cmnd.h +index 7fb57e905526..7bc752fc98de 100644 +--- a/include/scsi/scsi_cmnd.h ++++ b/include/scsi/scsi_cmnd.h +@@ -69,6 +69,9 @@ struct scsi_cmnd { + struct list_head list; /* scsi_cmnd participates in queue lists */ + struct list_head eh_entry; /* entry for the host eh_cmd_q */ + struct delayed_work abort_work; ++ ++ struct rcu_head rcu; ++ + int eh_eflags; /* Used by error handlr */ + + /* +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index 1a1df0d21ee3..a8b7bf879ced 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -571,8 +571,6 @@ struct Scsi_Host { + struct blk_mq_tag_set tag_set; + }; + +- struct rcu_head rcu; +- + atomic_t host_busy; /* commands actually active on low-level */ + atomic_t host_blocked; + +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 8365a52a74c5..d0c6b50792c8 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -4184,6 +4184,22 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active) + } + EXPORT_SYMBOL_GPL(workqueue_set_max_active); + ++/** ++ * current_work - retrieve %current task's work struct ++ * ++ * Determine if %current task is a workqueue worker and what it's working on. ++ * Useful to find out the context that the %current task is running in. ++ * ++ * Return: work struct if %current task is a workqueue worker, %NULL otherwise. ++ */ ++struct work_struct *current_work(void) ++{ ++ struct worker *worker = current_wq_worker(); ++ ++ return worker ? worker->current_work : NULL; ++} ++EXPORT_SYMBOL(current_work); ++ + /** + * current_is_workqueue_rescuer - is %current workqueue rescuer? + * +diff --git a/lib/bug.c b/lib/bug.c +index 1e094408c893..d2c9a099561a 100644 +--- a/lib/bug.c ++++ b/lib/bug.c +@@ -150,6 +150,8 @@ enum bug_trap_type report_bug(unsigned long bugaddr, struct pt_regs *regs) + return BUG_TRAP_TYPE_NONE; + + bug = find_bug(bugaddr); ++ if (!bug) ++ return BUG_TRAP_TYPE_NONE; + + file = NULL; + line = 0; +diff --git a/mm/memblock.c b/mm/memblock.c +index 91205780e6b1..6dd303717a4d 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -1107,7 +1107,7 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn, + struct memblock_type *type = &memblock.memory; + unsigned int right = type->cnt; + unsigned int mid, left = 0; +- phys_addr_t addr = PFN_PHYS(pfn + 1); ++ phys_addr_t addr = PFN_PHYS(++pfn); + + do { + mid = (right + left) / 2; +@@ -1118,15 +1118,15 @@ unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn, + type->regions[mid].size)) + left = mid + 1; + else { +- /* addr is within the region, so pfn + 1 is valid */ +- return min(pfn + 1, max_pfn); ++ /* addr is within the region, so pfn is valid */ ++ return pfn; + } + } while (left < right); + + if (right == type->cnt) +- return max_pfn; ++ return -1UL; + else +- return min(PHYS_PFN(type->regions[right].base), max_pfn); ++ return PHYS_PFN(type->regions[right].base); + } + + /** +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 279527f8b1fe..59baaecd3e54 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb, struct xt_action_param *par) + return true; + } + ++static bool poolsize_invalid(const struct ebt_mac_wormhash *w) ++{ ++ return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; + const struct ebt_entry_match *em = + container_of(par->matchinfo, const struct ebt_entry_match, data); +- int expected_length = sizeof(struct ebt_among_info); ++ unsigned int expected_length = sizeof(struct ebt_among_info); + const struct ebt_mac_wormhash *wh_dst, *wh_src; + int err; + ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); +- wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_dst)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_dst); ++ if (expected_length > em->match_size) ++ return -EINVAL; ++ ++ wh_src = ebt_among_wh_src(info); ++ if (poolsize_invalid(wh_src)) ++ return -EINVAL; ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 3b3dcf719e07..16eb99458df4 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -2053,7 +2053,9 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (match_kern) + match_kern->match_size = ret; + +- WARN_ON(type == EBT_COMPAT_TARGET && size_left); ++ if (WARN_ON(type == EBT_COMPAT_TARGET && size_left)) ++ return -EINVAL; ++ + match32 = (struct compat_ebt_entry_mwt *) buf; + } + +@@ -2109,6 +2111,15 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + * + * offsets are relative to beginning of struct ebt_entry (i.e., 0). + */ ++ for (i = 0; i < 4 ; ++i) { ++ if (offsets[i] >= *total) ++ return -EINVAL; ++ if (i == 0) ++ continue; ++ if (offsets[i-1] > offsets[i]) ++ return -EINVAL; ++ } ++ + for (i = 0, j = 1 ; j < 4 ; j++, i++) { + struct compat_ebt_entry_mwt *match32; + unsigned int size; +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index 9e2770fd00be..aa4c3b7f7da4 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -257,6 +257,10 @@ unsigned int arpt_do_table(struct sk_buff *skb, + } + if (table_base + v + != arpt_next_entry(e)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 39286e543ee6..cadb82a906b8 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -335,8 +335,13 @@ ipt_do_table(struct sk_buff *skb, + continue; + } + if (table_base + v != ipt_next_entry(e) && +- !(e->ip.flags & IPT_F_GOTO)) ++ !(e->ip.flags & IPT_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; ++ } + + e = get_entry(table_base, v); + continue; +diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c +index 24a8c2e63e3d..c07e9db95ccc 100644 +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -107,12 +107,6 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c) + + local_bh_disable(); + if (refcount_dec_and_lock(&c->entries, &cn->lock)) { +- list_del_rcu(&c->list); +- spin_unlock(&cn->lock); +- local_bh_enable(); +- +- unregister_netdevice_notifier(&c->notifier); +- + /* In case anyone still accesses the file, the open/close + * functions are also incrementing the refcount on their own, + * so it's safe to remove the entry even if it's in use. */ +@@ -120,6 +114,12 @@ clusterip_config_entry_put(struct net *net, struct clusterip_config *c) + if (cn->procdir) + proc_remove(c->pde); + #endif ++ list_del_rcu(&c->list); ++ spin_unlock(&cn->lock); ++ local_bh_enable(); ++ ++ unregister_netdevice_notifier(&c->notifier); ++ + return; + } + local_bh_enable(); +diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c +index 39970e212ad5..9bf260459f83 100644 +--- a/net/ipv6/netfilter.c ++++ b/net/ipv6/netfilter.c +@@ -21,18 +21,19 @@ + int ip6_route_me_harder(struct net *net, struct sk_buff *skb) + { + const struct ipv6hdr *iph = ipv6_hdr(skb); ++ struct sock *sk = sk_to_full_sk(skb->sk); + unsigned int hh_len; + struct dst_entry *dst; + struct flowi6 fl6 = { +- .flowi6_oif = skb->sk ? skb->sk->sk_bound_dev_if : 0, ++ .flowi6_oif = sk ? sk->sk_bound_dev_if : 0, + .flowi6_mark = skb->mark, +- .flowi6_uid = sock_net_uid(net, skb->sk), ++ .flowi6_uid = sock_net_uid(net, sk), + .daddr = iph->daddr, + .saddr = iph->saddr, + }; + int err; + +- dst = ip6_route_output(net, skb->sk, &fl6); ++ dst = ip6_route_output(net, sk, &fl6); + err = dst->error; + if (err) { + IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES); +@@ -50,7 +51,7 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb) + if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) && + xfrm_decode_session(skb, flowi6_to_flowi(&fl6), AF_INET6) == 0) { + skb_dst_set(skb, NULL); +- dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), skb->sk, 0); ++ dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), sk, 0); + if (IS_ERR(dst)) + return PTR_ERR(dst); + skb_dst_set(skb, dst); +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index 01bd3ee5ebc6..a0a31972fc75 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -357,6 +357,10 @@ ip6t_do_table(struct sk_buff *skb, + } + if (table_base + v != ip6t_next_entry(e) && + !(e->ipv6.flags & IP6T_F_GOTO)) { ++ if (unlikely(stackidx >= private->stacksize)) { ++ verdict = NF_DROP; ++ break; ++ } + jumpstack[stackidx++] = e; + } + +diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +index 46d6dba50698..c5053dbfc391 100644 +--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c ++++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c +@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct sk_buff *skb, + !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff, + target, maniptype)) + return false; ++ ++ /* must reload, offset might have changed */ ++ ipv6h = (void *)skb->data + iphdroff; ++ + manip_addr: + if (maniptype == NF_NAT_MANIP_SRC) + ipv6h->saddr = target->src.u3.in6; +diff --git a/net/netfilter/nf_nat_proto_common.c b/net/netfilter/nf_nat_proto_common.c +index fbce552a796e..7d7466dbf663 100644 +--- a/net/netfilter/nf_nat_proto_common.c ++++ b/net/netfilter/nf_nat_proto_common.c +@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + const struct nf_conn *ct, + u16 *rover) + { +- unsigned int range_size, min, i; ++ unsigned int range_size, min, max, i; + __be16 *portptr; + u_int16_t off; + +@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const struct nf_nat_l3proto *l3proto, + } + } else { + min = ntohs(range->min_proto.all); +- range_size = ntohs(range->max_proto.all) - min + 1; ++ max = ntohs(range->max_proto.all); ++ if (unlikely(max < min)) ++ swap(max, min); ++ range_size = max - min + 1; + } + + if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) { +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index daf45da448fa..bb5d6a058fb7 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -147,11 +147,11 @@ static int idletimer_tg_create(struct idletimer_tg_info *info) + (unsigned long) info->timer); + info->timer->refcnt = 1; + ++ INIT_WORK(&info->timer->work, idletimer_tg_work); ++ + mod_timer(&info->timer->timer, + msecs_to_jiffies(info->timeout * 1000) + jiffies); + +- INIT_WORK(&info->timer->work, idletimer_tg_work); +- + return 0; + + out_free_attr: +@@ -192,7 +192,10 @@ static int idletimer_tg_checkentry(const struct xt_tgchk_param *par) + pr_debug("timeout value is zero\n"); + return -EINVAL; + } +- ++ if (info->timeout >= INT_MAX / 1000) { ++ pr_debug("timeout value is too big\n"); ++ return -EINVAL; ++ } + if (info->label[0] == '\0' || + strnlen(info->label, + MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) { +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 3ba31c194cce..0858fe17e14a 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -141,10 +141,11 @@ static int led_tg_check(const struct xt_tgchk_param *par) + goto exit_alloc; + } + +- /* See if we need to set up a timer */ +- if (ledinfo->delay > 0) +- setup_timer(&ledinternal->timer, led_timeout_callback, +- (unsigned long)ledinternal); ++ /* Since the letinternal timer can be shared between multiple targets, ++ * always set it up, even if the current target does not need it ++ */ ++ setup_timer(&ledinternal->timer, led_timeout_callback, ++ (unsigned long)ledinternal); + + list_add_tail(&ledinternal->list, &xt_led_triggers); + +@@ -181,8 +182,7 @@ static void led_tg_destroy(const struct xt_tgdtor_param *par) + + list_del(&ledinternal->list); + +- if (ledinfo->delay > 0) +- del_timer_sync(&ledinternal->timer); ++ del_timer_sync(&ledinternal->timer); + + led_trigger_unregister(&ledinternal->netfilter_led_trigger); + +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index 5da8746f7b88..b8a3e740ffd4 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -774,7 +774,7 @@ hashlimit_mt_common(const struct sk_buff *skb, struct xt_action_param *par, + if (!dh->rateinfo.prev_window && + (dh->rateinfo.current_rate <= dh->rateinfo.burst)) { + spin_unlock(&dh->lock); +- rcu_read_unlock_bh(); ++ local_bh_enable(); + return !(cfg->mode & XT_HASHLIMIT_INVERT); + } else { + goto overlimit; +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index 745f145d4c4d..a6d604fd9695 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1351,8 +1351,10 @@ static int smc_create(struct net *net, struct socket *sock, int protocol, + smc->use_fallback = false; /* assume rdma capability first */ + rc = sock_create_kern(net, PF_INET, SOCK_STREAM, + IPPROTO_TCP, &smc->clcsock); +- if (rc) ++ if (rc) { + sk_common_release(sk); ++ goto out; ++ } + smc->sk.sk_sndbuf = max(smc->clcsock->sk->sk_sndbuf, SMC_BUF_MIN_SIZE); + smc->sk.sk_rcvbuf = max(smc->clcsock->sk->sk_rcvbuf, SMC_BUF_MIN_SIZE); + +diff --git a/scripts/Makefile.build b/scripts/Makefile.build +index 6bed45dc2cb1..7143da06d702 100644 +--- a/scripts/Makefile.build ++++ b/scripts/Makefile.build +@@ -261,6 +261,8 @@ __objtool_obj := $(objtree)/tools/objtool/objtool + + objtool_args = $(if $(CONFIG_UNWINDER_ORC),orc generate,check) + ++objtool_args += $(if $(part-of-module), --module,) ++ + ifndef CONFIG_FRAME_POINTER + objtool_args += --no-fp + endif +@@ -269,6 +271,12 @@ objtool_args += --no-unreachable + else + objtool_args += $(call cc-ifversion, -lt, 0405, --no-unreachable) + endif ++ifdef CONFIG_RETPOLINE ++ifneq ($(RETPOLINE_CFLAGS),) ++ objtool_args += --retpoline ++endif ++endif ++ + + ifdef CONFIG_MODVERSIONS + objtool_o = $(@D)/.tmp_$(@F) +diff --git a/scripts/Makefile.lib b/scripts/Makefile.lib +index 0b46136a91a8..aac94d962ed6 100644 +--- a/scripts/Makefile.lib ++++ b/scripts/Makefile.lib +@@ -294,11 +294,11 @@ cmd_dt_S_dtb= \ + echo '\#include '; \ + echo '.section .dtb.init.rodata,"a"'; \ + echo '.balign STRUCT_ALIGNMENT'; \ +- echo '.global __dtb_$(*F)_begin'; \ +- echo '__dtb_$(*F)_begin:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_begin'; \ ++ echo '__dtb_$(subst -,_,$(*F))_begin:'; \ + echo '.incbin "$<" '; \ +- echo '__dtb_$(*F)_end:'; \ +- echo '.global __dtb_$(*F)_end'; \ ++ echo '__dtb_$(subst -,_,$(*F))_end:'; \ ++ echo '.global __dtb_$(subst -,_,$(*F))_end'; \ + echo '.balign STRUCT_ALIGNMENT'; \ + ) > $@ + +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index dea11d1babf5..1f3aa466ac9b 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -906,7 +906,8 @@ int snd_seq_dispatch_event(struct snd_seq_event_cell *cell, int atomic, int hop) + static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + struct snd_seq_event *event, + struct file *file, int blocking, +- int atomic, int hop) ++ int atomic, int hop, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + int err; +@@ -944,7 +945,8 @@ static int snd_seq_client_enqueue_event(struct snd_seq_client *client, + return -ENXIO; /* queue is not allocated */ + + /* allocate an event cell */ +- err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file); ++ err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, ++ file, mutexp); + if (err < 0) + return err; + +@@ -1013,12 +1015,11 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + return -ENXIO; + + /* allocate the pool now if the pool is not allocated yet */ ++ mutex_lock(&client->ioctl_mutex); + if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { +- mutex_lock(&client->ioctl_mutex); + err = snd_seq_pool_init(client->pool); +- mutex_unlock(&client->ioctl_mutex); + if (err < 0) +- return -ENOMEM; ++ goto out; + } + + /* only process whole events */ +@@ -1069,7 +1070,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + /* ok, enqueue it */ + err = snd_seq_client_enqueue_event(client, &event, file, + !(file->f_flags & O_NONBLOCK), +- 0, 0); ++ 0, 0, &client->ioctl_mutex); + if (err < 0) + break; + +@@ -1080,6 +1081,8 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, + written += len; + } + ++ out: ++ mutex_unlock(&client->ioctl_mutex); + return written ? written : err; + } + +@@ -1834,6 +1837,9 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client, + (! snd_seq_write_pool_allocated(client) || + info->output_pool != client->pool->size)) { + if (snd_seq_write_pool_allocated(client)) { ++ /* is the pool in use? */ ++ if (atomic_read(&client->pool->counter)) ++ return -EBUSY; + /* remove all existing cells */ + snd_seq_pool_mark_closing(client->pool); + snd_seq_queue_client_leave_cells(client->number); +@@ -2256,7 +2262,8 @@ static int kernel_client_enqueue(int client, struct snd_seq_event *ev, + if (! cptr->accept_output) + result = -EPERM; + else /* send it */ +- result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop); ++ result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, ++ atomic, hop, NULL); + + snd_seq_client_unlock(cptr); + return result; +diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c +index a8c2822e0198..72c0302a55d2 100644 +--- a/sound/core/seq/seq_fifo.c ++++ b/sound/core/seq/seq_fifo.c +@@ -125,7 +125,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, + return -EINVAL; + + snd_use_lock_use(&f->use_lock); +- err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */ ++ err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */ + if (err < 0) { + if ((err == -ENOMEM) || (err == -EAGAIN)) + atomic_inc(&f->overflow); +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index f763682584a8..ab1112e90f88 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -220,7 +220,8 @@ void snd_seq_cell_free(struct snd_seq_event_cell * cell) + */ + static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + struct snd_seq_event_cell **cellp, +- int nonblock, struct file *file) ++ int nonblock, struct file *file, ++ struct mutex *mutexp) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -244,7 +245,11 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + set_current_state(TASK_INTERRUPTIBLE); + add_wait_queue(&pool->output_sleep, &wait); + spin_unlock_irq(&pool->lock); ++ if (mutexp) ++ mutex_unlock(mutexp); + schedule(); ++ if (mutexp) ++ mutex_lock(mutexp); + spin_lock_irq(&pool->lock); + remove_wait_queue(&pool->output_sleep, &wait); + /* interrupted? */ +@@ -287,7 +292,7 @@ static int snd_seq_cell_alloc(struct snd_seq_pool *pool, + */ + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + struct snd_seq_event_cell **cellp, int nonblock, +- struct file *file) ++ struct file *file, struct mutex *mutexp) + { + int ncells, err; + unsigned int extlen; +@@ -304,7 +309,7 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + if (ncells >= pool->total_elements) + return -ENOMEM; + +- err = snd_seq_cell_alloc(pool, &cell, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp); + if (err < 0) + return err; + +@@ -330,7 +335,8 @@ int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, + int size = sizeof(struct snd_seq_event); + if (len < size) + size = len; +- err = snd_seq_cell_alloc(pool, &tmp, nonblock, file); ++ err = snd_seq_cell_alloc(pool, &tmp, nonblock, file, ++ mutexp); + if (err < 0) + goto __error; + if (cell->event.data.ext.ptr == NULL) +diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h +index 32f959c17786..3abe306c394a 100644 +--- a/sound/core/seq/seq_memory.h ++++ b/sound/core/seq/seq_memory.h +@@ -66,7 +66,8 @@ struct snd_seq_pool { + void snd_seq_cell_free(struct snd_seq_event_cell *cell); + + int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event, +- struct snd_seq_event_cell **cellp, int nonblock, struct file *file); ++ struct snd_seq_event_cell **cellp, int nonblock, ++ struct file *file, struct mutex *mutexp); + + /* return number of unused (free) cells */ + static inline int snd_seq_unused_cells(struct snd_seq_pool *pool) +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 37e1cf8218ff..5b4dbcec6de8 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -957,6 +957,8 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 454476b47b79..3d19efd2783a 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5129,6 +5129,16 @@ static void alc298_fixup_speaker_volume(struct hda_codec *codec, + } + } + ++/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */ ++static void alc295_fixup_disable_dac3(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ if (action == HDA_FIXUP_ACT_PRE_PROBE) { ++ hda_nid_t conn[2] = { 0x02, 0x03 }; ++ snd_hda_override_conn_list(codec, 0x17, 2, conn); ++ } ++} ++ + /* Hook to update amp GPIO4 for automute */ + static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec, + struct hda_jack_callback *jack) +@@ -5321,6 +5331,7 @@ enum { + ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, + ALC255_FIXUP_DELL_SPK_NOISE, + ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ ALC295_FIXUP_DISABLE_DAC3, + ALC280_FIXUP_HP_HEADSET_MIC, + ALC221_FIXUP_HP_FRONT_MIC, + ALC292_FIXUP_TPT460, +@@ -5335,10 +5346,12 @@ enum { + ALC233_FIXUP_EAPD_COEF_AND_MIC_NO_PRESENCE, + ALC233_FIXUP_LENOVO_MULTI_CODECS, + ALC294_FIXUP_LENOVO_MIC_LOCATION, ++ ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE, + ALC700_FIXUP_INTEL_REFERENCE, + ALC274_FIXUP_DELL_BIND_DACS, + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, + ALC298_FIXUP_TPT470_DOCK, ++ ALC255_FIXUP_DUMMY_LINEOUT_VERB, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6053,6 +6066,10 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, + }, ++ [ALC295_FIXUP_DISABLE_DAC3] = { ++ .type = HDA_FIXUP_FUNC, ++ .v.func = alc295_fixup_disable_dac3, ++ }, + [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -6138,6 +6155,18 @@ static const struct hda_fixup alc269_fixups[] = { + { } + }, + }, ++ [ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x16, 0x0101102f }, /* Rear Headset HP */ ++ { 0x19, 0x02a1913c }, /* use as Front headset mic, without its own jack detect */ ++ { 0x1a, 0x01a19030 }, /* Rear Headset MIC */ ++ { 0x1b, 0x02011020 }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC ++ }, + [ALC700_FIXUP_INTEL_REFERENCE] = { + .type = HDA_FIXUP_VERBS, + .v.verbs = (const struct hda_verb[]) { +@@ -6174,6 +6203,15 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE + }, ++ [ALC255_FIXUP_DUMMY_LINEOUT_VERB] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x14, 0x0201101f }, ++ { } ++ }, ++ .chained = true, ++ .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6222,10 +6260,13 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), + SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), ++ SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3), + SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), ++ SND_PCI_QUIRK(0x1028, 0x080c, "Dell WYSE", ALC225_FIXUP_DELL_WYSE_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), +@@ -6363,9 +6404,11 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x2245, "Thinkpad T470", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2246, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2247, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x2249, "Thinkpad", ALC292_FIXUP_TPT460), + SND_PCI_QUIRK(0x17aa, 0x224b, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224c, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), + SND_PCI_QUIRK(0x17aa, 0x224d, "Thinkpad", ALC298_FIXUP_TPT470_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x225d, "Thinkpad T480", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +@@ -6722,7 +6765,7 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60120}, + {0x14, 0x90170110}, + {0x21, 0x0321101f}), +- SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, ++ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC269_FIXUP_DELL4_MIC_NO_PRESENCE, + {0x12, 0xb7a60130}, + {0x14, 0x90170110}, + {0x21, 0x04211020}), +diff --git a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +index 88ff54220007..69ab55956492 100644 +--- a/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c ++++ b/sound/soc/intel/boards/kbl_rt5663_rt5514_max98927.c +@@ -604,6 +604,8 @@ static int kabylake_card_late_probe(struct snd_soc_card *card) + + list_for_each_entry(pcm, &ctx->hdmi_pcm_list, head) { + codec = pcm->codec_dai->codec; ++ snprintf(jack_name, sizeof(jack_name), ++ "HDMI/DP,pcm=%d Jack", pcm->device); + err = snd_soc_card_jack_new(card, jack_name, + SND_JACK_AVOUT, &ctx->kabylake_hdmi[i], + NULL, 0); +diff --git a/tools/objtool/builtin-check.c b/tools/objtool/builtin-check.c +index 57254f5b2779..694abc628e9b 100644 +--- a/tools/objtool/builtin-check.c ++++ b/tools/objtool/builtin-check.c +@@ -29,7 +29,7 @@ + #include "builtin.h" + #include "check.h" + +-bool no_fp, no_unreachable; ++bool no_fp, no_unreachable, retpoline, module; + + static const char * const check_usage[] = { + "objtool check [] file.o", +@@ -39,6 +39,8 @@ static const char * const check_usage[] = { + const struct option check_options[] = { + OPT_BOOLEAN('f', "no-fp", &no_fp, "Skip frame pointer validation"), + OPT_BOOLEAN('u', "no-unreachable", &no_unreachable, "Skip 'unreachable instruction' warnings"), ++ OPT_BOOLEAN('r', "retpoline", &retpoline, "Validate retpoline assumptions"), ++ OPT_BOOLEAN('m', "module", &module, "Indicates the object will be part of a kernel module"), + OPT_END(), + }; + +@@ -53,5 +55,5 @@ int cmd_check(int argc, const char **argv) + + objname = argv[0]; + +- return check(objname, no_fp, no_unreachable, false); ++ return check(objname, false); + } +diff --git a/tools/objtool/builtin-orc.c b/tools/objtool/builtin-orc.c +index 91e8e19ff5e0..77ea2b97117d 100644 +--- a/tools/objtool/builtin-orc.c ++++ b/tools/objtool/builtin-orc.c +@@ -25,7 +25,6 @@ + */ + + #include +-#include + #include "builtin.h" + #include "check.h" + +@@ -36,9 +35,6 @@ static const char *orc_usage[] = { + NULL, + }; + +-extern const struct option check_options[]; +-extern bool no_fp, no_unreachable; +- + int cmd_orc(int argc, const char **argv) + { + const char *objname; +@@ -54,7 +50,7 @@ int cmd_orc(int argc, const char **argv) + + objname = argv[0]; + +- return check(objname, no_fp, no_unreachable, true); ++ return check(objname, true); + } + + if (!strcmp(argv[0], "dump")) { +diff --git a/tools/objtool/builtin.h b/tools/objtool/builtin.h +index dd526067fed5..28ff40e19a14 100644 +--- a/tools/objtool/builtin.h ++++ b/tools/objtool/builtin.h +@@ -17,6 +17,11 @@ + #ifndef _BUILTIN_H + #define _BUILTIN_H + ++#include ++ ++extern const struct option check_options[]; ++extern bool no_fp, no_unreachable, retpoline, module; ++ + extern int cmd_check(int argc, const char **argv); + extern int cmd_orc(int argc, const char **argv); + +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index c7fb5c2392ee..9d01d0b1084e 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -18,6 +18,7 @@ + #include + #include + ++#include "builtin.h" + #include "check.h" + #include "elf.h" + #include "special.h" +@@ -33,7 +34,6 @@ struct alternative { + }; + + const char *objname; +-static bool no_fp; + struct cfi_state initial_func_cfi; + + struct instruction *find_insn(struct objtool_file *file, +@@ -496,6 +496,7 @@ static int add_jump_destinations(struct objtool_file *file) + * disguise, so convert them accordingly. + */ + insn->type = INSN_JUMP_DYNAMIC; ++ insn->retpoline_safe = true; + continue; + } else { + /* sibling call */ +@@ -547,7 +548,8 @@ static int add_call_destinations(struct objtool_file *file) + if (!insn->call_dest && !insn->ignore) { + WARN_FUNC("unsupported intra-function call", + insn->sec, insn->offset); +- WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); ++ if (retpoline) ++ WARN("If this is a retpoline, please patch it in with alternatives and annotate it with ANNOTATE_NOSPEC_ALTERNATIVE."); + return -1; + } + +@@ -922,7 +924,11 @@ static struct rela *find_switch_table(struct objtool_file *file, + if (find_symbol_containing(file->rodata, text_rela->addend)) + continue; + +- return find_rela_by_dest(file->rodata, text_rela->addend); ++ rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend); ++ if (!rodata_rela) ++ continue; ++ ++ return rodata_rela; + } + + return NULL; +@@ -1107,6 +1113,41 @@ static int read_unwind_hints(struct objtool_file *file) + return 0; + } + ++static int read_retpoline_hints(struct objtool_file *file) ++{ ++ struct section *sec; ++ struct instruction *insn; ++ struct rela *rela; ++ ++ sec = find_section_by_name(file->elf, ".rela.discard.retpoline_safe"); ++ if (!sec) ++ return 0; ++ ++ list_for_each_entry(rela, &sec->rela_list, list) { ++ if (rela->sym->type != STT_SECTION) { ++ WARN("unexpected relocation symbol type in %s", sec->name); ++ return -1; ++ } ++ ++ insn = find_insn(file, rela->sym->sec, rela->addend); ++ if (!insn) { ++ WARN("bad .discard.retpoline_safe entry"); ++ return -1; ++ } ++ ++ if (insn->type != INSN_JUMP_DYNAMIC && ++ insn->type != INSN_CALL_DYNAMIC) { ++ WARN_FUNC("retpoline_safe hint not an indirect jump/call", ++ insn->sec, insn->offset); ++ return -1; ++ } ++ ++ insn->retpoline_safe = true; ++ } ++ ++ return 0; ++} ++ + static int decode_sections(struct objtool_file *file) + { + int ret; +@@ -1145,6 +1186,10 @@ static int decode_sections(struct objtool_file *file) + if (ret) + return ret; + ++ ret = read_retpoline_hints(file); ++ if (ret) ++ return ret; ++ + return 0; + } + +@@ -1890,6 +1935,38 @@ static int validate_unwind_hints(struct objtool_file *file) + return warnings; + } + ++static int validate_retpoline(struct objtool_file *file) ++{ ++ struct instruction *insn; ++ int warnings = 0; ++ ++ for_each_insn(file, insn) { ++ if (insn->type != INSN_JUMP_DYNAMIC && ++ insn->type != INSN_CALL_DYNAMIC) ++ continue; ++ ++ if (insn->retpoline_safe) ++ continue; ++ ++ /* ++ * .init.text code is ran before userspace and thus doesn't ++ * strictly need retpolines, except for modules which are ++ * loaded late, they very much do need retpoline in their ++ * .init.text ++ */ ++ if (!strcmp(insn->sec->name, ".init.text") && !module) ++ continue; ++ ++ WARN_FUNC("indirect %s found in RETPOLINE build", ++ insn->sec, insn->offset, ++ insn->type == INSN_JUMP_DYNAMIC ? "jump" : "call"); ++ ++ warnings++; ++ } ++ ++ return warnings; ++} ++ + static bool is_kasan_insn(struct instruction *insn) + { + return (insn->type == INSN_CALL && +@@ -2021,13 +2098,12 @@ static void cleanup(struct objtool_file *file) + elf_close(file->elf); + } + +-int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc) ++int check(const char *_objname, bool orc) + { + struct objtool_file file; + int ret, warnings = 0; + + objname = _objname; +- no_fp = _no_fp; + + file.elf = elf_open(objname, orc ? O_RDWR : O_RDONLY); + if (!file.elf) +@@ -2051,6 +2127,13 @@ int check(const char *_objname, bool _no_fp, bool no_unreachable, bool orc) + if (list_empty(&file.insn_list)) + goto out; + ++ if (retpoline) { ++ ret = validate_retpoline(&file); ++ if (ret < 0) ++ return ret; ++ warnings += ret; ++ } ++ + ret = validate_functions(&file); + if (ret < 0) + goto out; +diff --git a/tools/objtool/check.h b/tools/objtool/check.h +index 23a1d065cae1..c6b68fcb926f 100644 +--- a/tools/objtool/check.h ++++ b/tools/objtool/check.h +@@ -45,6 +45,7 @@ struct instruction { + unsigned char type; + unsigned long immediate; + bool alt_group, visited, dead_end, ignore, hint, save, restore, ignore_alts; ++ bool retpoline_safe; + struct symbol *call_dest; + struct instruction *jump_dest; + struct instruction *first_jump_src; +@@ -63,7 +64,7 @@ struct objtool_file { + bool ignore_unreachables, c_file, hints; + }; + +-int check(const char *objname, bool no_fp, bool no_unreachable, bool orc); ++int check(const char *objname, bool orc); + + struct instruction *find_insn(struct objtool_file *file, + struct section *sec, unsigned long offset); +diff --git a/tools/perf/util/trigger.h b/tools/perf/util/trigger.h +index 370138e7e35c..88223bc7c82b 100644 +--- a/tools/perf/util/trigger.h ++++ b/tools/perf/util/trigger.h +@@ -12,7 +12,7 @@ + * States and transits: + * + * +- * OFF--(on)--> READY --(hit)--> HIT ++ * OFF--> ON --> READY --(hit)--> HIT + * ^ | + * | (ready) + * | | +@@ -27,8 +27,9 @@ struct trigger { + volatile enum { + TRIGGER_ERROR = -2, + TRIGGER_OFF = -1, +- TRIGGER_READY = 0, +- TRIGGER_HIT = 1, ++ TRIGGER_ON = 0, ++ TRIGGER_READY = 1, ++ TRIGGER_HIT = 2, + } state; + const char *name; + }; +@@ -50,7 +51,7 @@ static inline bool trigger_is_error(struct trigger *t) + static inline void trigger_on(struct trigger *t) + { + TRIGGER_WARN_ONCE(t, TRIGGER_OFF); +- t->state = TRIGGER_READY; ++ t->state = TRIGGER_ON; + } + + static inline void trigger_ready(struct trigger *t) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.27-28.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.27-28.patch new file mode 100644 index 000000000000..ab9664f81741 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.27-28.patch @@ -0,0 +1,3101 @@ +diff --git a/Documentation/devicetree/bindings/usb/usb-xhci.txt b/Documentation/devicetree/bindings/usb/usb-xhci.txt +index 2d80b60eeabe..7a69b8b47b97 100644 +--- a/Documentation/devicetree/bindings/usb/usb-xhci.txt ++++ b/Documentation/devicetree/bindings/usb/usb-xhci.txt +@@ -12,6 +12,7 @@ Required properties: + - "renesas,xhci-r8a7793" for r8a7793 SoC + - "renesas,xhci-r8a7795" for r8a7795 SoC + - "renesas,xhci-r8a7796" for r8a7796 SoC ++ - "renesas,xhci-r8a77965" for r8a77965 SoC + - "renesas,rcar-gen2-xhci" for a generic R-Car Gen2 compatible device + - "renesas,rcar-gen3-xhci" for a generic R-Car Gen3 compatible device + - "xhci-platform" (deprecated) +diff --git a/Makefile b/Makefile +index 00e969db94b8..9ae370a47ff9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 27 ++SUBLEVEL = 28 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 03c7d77023c6..9fb7426070ce 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/exynos4412-trats2.dts b/arch/arm/boot/dts/exynos4412-trats2.dts +index bceb919ac637..65602cd51a4e 100644 +--- a/arch/arm/boot/dts/exynos4412-trats2.dts ++++ b/arch/arm/boot/dts/exynos4412-trats2.dts +@@ -395,7 +395,7 @@ + reg = <0>; + vdd3-supply = <&lcd_vdd3_reg>; + vci-supply = <&ldo25_reg>; +- reset-gpios = <&gpy4 5 GPIO_ACTIVE_HIGH>; ++ reset-gpios = <&gpf2 1 GPIO_ACTIVE_HIGH>; + power-on-delay= <50>; + reset-delay = <100>; + init-delay = <100>; +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index 4acd32a1c4ef..c66ee8432a85 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -558,7 +558,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -575,7 +575,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ ++ reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm/boot/dts/r8a7791-koelsch.dts b/arch/arm/boot/dts/r8a7791-koelsch.dts +index 0ce0b278e1cb..25c3a10d669c 100644 +--- a/arch/arm/boot/dts/r8a7791-koelsch.dts ++++ b/arch/arm/boot/dts/r8a7791-koelsch.dts +@@ -278,6 +278,12 @@ + }; + }; + ++ cec_clock: cec-clock { ++ compatible = "fixed-clock"; ++ #clock-cells = <0>; ++ clock-frequency = <12000000>; ++ }; ++ + hdmi-out { + compatible = "hdmi-connector"; + type = "a"; +@@ -642,12 +648,6 @@ + }; + }; + +- cec_clock: cec-clock { +- compatible = "fixed-clock"; +- #clock-cells = <0>; +- clock-frequency = <12000000>; +- }; +- + hdmi@39 { + compatible = "adi,adv7511w"; + reg = <0x39>; +diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +index d9d885006a8e..9eb11a8d9eda 100644 +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -264,6 +264,7 @@ + reg = <0>; + interrupt-parent = <&gpio2>; + interrupts = <11 IRQ_TYPE_LEVEL_LOW>; ++ reset-gpios = <&gpio2 10 GPIO_ACTIVE_LOW>; + }; + }; + +diff --git a/arch/powerpc/include/asm/code-patching.h b/arch/powerpc/include/asm/code-patching.h +index abef812de7f8..2c895e8d07f7 100644 +--- a/arch/powerpc/include/asm/code-patching.h ++++ b/arch/powerpc/include/asm/code-patching.h +@@ -33,6 +33,7 @@ int patch_branch(unsigned int *addr, unsigned long target, int flags); + int patch_instruction(unsigned int *addr, unsigned int instr); + + int instr_is_relative_branch(unsigned int instr); ++int instr_is_relative_link_branch(unsigned int instr); + int instr_is_branch_to_addr(const unsigned int *instr, unsigned long addr); + unsigned long branch_target(const unsigned int *instr); + unsigned int translate_branch(const unsigned int *dest, +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index 8a8a6d7ddcc6..6f07c687fc05 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -939,9 +939,13 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) + beq 1f + rlwinm r7,r7,0,~PACA_IRQ_HARD_DIS + stb r7,PACAIRQHAPPENED(r13) +-1: li r0,0 +- stb r0,PACASOFTIRQEN(r13); +- TRACE_DISABLE_INTS ++1: ++#if defined(CONFIG_TRACE_IRQFLAGS) && defined(CONFIG_BUG) ++ /* The interrupt should not have soft enabled. */ ++ lbz r7,PACASOFTIRQEN(r13) ++1: tdnei r7,0 ++ EMIT_BUG_ENTRY 1b,__FILE__,__LINE__,BUGFLAG_WARNING ++#endif + b .Ldo_restore + + /* +diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c +index 0b0f89685b67..2a1b1273a312 100644 +--- a/arch/powerpc/kernel/module_64.c ++++ b/arch/powerpc/kernel/module_64.c +@@ -486,7 +486,17 @@ static bool is_early_mcount_callsite(u32 *instruction) + restore r2. */ + static int restore_r2(u32 *instruction, struct module *me) + { +- if (is_early_mcount_callsite(instruction - 1)) ++ u32 *prev_insn = instruction - 1; ++ ++ if (is_early_mcount_callsite(prev_insn)) ++ return 1; ++ ++ /* ++ * Make sure the branch isn't a sibling call. Sibling calls aren't ++ * "link" branches and they don't return, so they don't need the r2 ++ * restore afterwards. ++ */ ++ if (!instr_is_relative_link_branch(*prev_insn)) + return 1; + + if (*instruction != PPC_INST_NOP) { +diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c +index d469224c4ada..096d4e4d31e6 100644 +--- a/arch/powerpc/lib/code-patching.c ++++ b/arch/powerpc/lib/code-patching.c +@@ -302,6 +302,11 @@ int instr_is_relative_branch(unsigned int instr) + return instr_is_branch_iform(instr) || instr_is_branch_bform(instr); + } + ++int instr_is_relative_link_branch(unsigned int instr) ++{ ++ return instr_is_relative_branch(instr) && (instr & BRANCH_SET_LINK); ++} ++ + static unsigned long branch_iform_target(const unsigned int *instr) + { + signed long imm; +diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c +index 1f790cf9d38f..3b7427aa7d85 100644 +--- a/arch/x86/kernel/machine_kexec_64.c ++++ b/arch/x86/kernel/machine_kexec_64.c +@@ -542,6 +542,7 @@ int arch_kexec_apply_relocations_add(const Elf64_Ehdr *ehdr, + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + value -= (u64)address; + *(u32 *)location = value; + break; +diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c +index da0c160e5589..f58336af095c 100644 +--- a/arch/x86/kernel/module.c ++++ b/arch/x86/kernel/module.c +@@ -191,6 +191,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs, + goto overflow; + break; + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + if (*(u32 *)loc != 0) + goto invalid_relocation; + val -= (u64)loc; +diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c +index 5d73c443e778..220e97841e49 100644 +--- a/arch/x86/tools/relocs.c ++++ b/arch/x86/tools/relocs.c +@@ -770,9 +770,12 @@ static int do_reloc64(struct section *sec, Elf_Rel *rel, ElfW(Sym) *sym, + break; + + case R_X86_64_PC32: ++ case R_X86_64_PLT32: + /* + * PC relative relocations don't need to be adjusted unless + * referencing a percpu symbol. ++ * ++ * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32. + */ + if (is_percpu_sym(sym, symname)) + add_reloc(&relocs32neg, offset); +diff --git a/crypto/ecc.c b/crypto/ecc.c +index 633a9bcdc574..18f32f2a5e1c 100644 +--- a/crypto/ecc.c ++++ b/crypto/ecc.c +@@ -964,7 +964,7 @@ int ecc_gen_privkey(unsigned int curve_id, unsigned int ndigits, u64 *privkey) + * DRBG with a security strength of 256. + */ + if (crypto_get_default_rng()) +- err = -EFAULT; ++ return -EFAULT; + + err = crypto_rng_get_bytes(crypto_default_rng, (u8 *)priv, nbytes); + crypto_put_default_rng(); +diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig +index 2415ad9f6dd4..49fd50fccd48 100644 +--- a/drivers/base/Kconfig ++++ b/drivers/base/Kconfig +@@ -249,6 +249,7 @@ config DMA_SHARED_BUFFER + bool + default n + select ANON_INODES ++ select IRQ_WORK + help + This option enables the framework for buffer-sharing between + multiple drivers. A buffer is associated with a file using driver +diff --git a/drivers/char/agp/intel-gtt.c b/drivers/char/agp/intel-gtt.c +index 9b6b6023193b..dde7caac7f9f 100644 +--- a/drivers/char/agp/intel-gtt.c ++++ b/drivers/char/agp/intel-gtt.c +@@ -872,6 +872,8 @@ void intel_gtt_insert_sg_entries(struct sg_table *st, + } + } + wmb(); ++ if (intel_private.driver->chipset_flush) ++ intel_private.driver->chipset_flush(); + } + EXPORT_SYMBOL(intel_gtt_insert_sg_entries); + +diff --git a/drivers/clk/meson/gxbb.c b/drivers/clk/meson/gxbb.c +index b2d1e8ed7152..92168348ffa6 100644 +--- a/drivers/clk/meson/gxbb.c ++++ b/drivers/clk/meson/gxbb.c +@@ -1139,7 +1139,7 @@ static MESON_GATE(gxbb_pl301, HHI_GCLK_MPEG0, 6); + static MESON_GATE(gxbb_periphs, HHI_GCLK_MPEG0, 7); + static MESON_GATE(gxbb_spicc, HHI_GCLK_MPEG0, 8); + static MESON_GATE(gxbb_i2c, HHI_GCLK_MPEG0, 9); +-static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG0, 10); ++static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG0, 10); + static MESON_GATE(gxbb_smart_card, HHI_GCLK_MPEG0, 11); + static MESON_GATE(gxbb_rng0, HHI_GCLK_MPEG0, 12); + static MESON_GATE(gxbb_uart0, HHI_GCLK_MPEG0, 13); +@@ -1190,7 +1190,7 @@ static MESON_GATE(gxbb_usb0_ddr_bridge, HHI_GCLK_MPEG2, 9); + static MESON_GATE(gxbb_mmc_pclk, HHI_GCLK_MPEG2, 11); + static MESON_GATE(gxbb_dvin, HHI_GCLK_MPEG2, 12); + static MESON_GATE(gxbb_uart2, HHI_GCLK_MPEG2, 15); +-static MESON_GATE(gxbb_sana, HHI_GCLK_MPEG2, 22); ++static MESON_GATE(gxbb_sar_adc, HHI_GCLK_MPEG2, 22); + static MESON_GATE(gxbb_vpu_intr, HHI_GCLK_MPEG2, 25); + static MESON_GATE(gxbb_sec_ahb_ahb3_bridge, HHI_GCLK_MPEG2, 26); + static MESON_GATE(gxbb_clk81_a53, HHI_GCLK_MPEG2, 29); +diff --git a/drivers/clk/qcom/gcc-msm8916.c b/drivers/clk/qcom/gcc-msm8916.c +index 3410ee68d4bc..2057809219f4 100644 +--- a/drivers/clk/qcom/gcc-msm8916.c ++++ b/drivers/clk/qcom/gcc-msm8916.c +@@ -1438,6 +1438,7 @@ static const struct freq_tbl ftbl_codec_clk[] = { + + static struct clk_rcg2 codec_digcodec_clk_src = { + .cmd_rcgr = 0x1c09c, ++ .mnd_width = 8, + .hid_width = 5, + .parent_map = gcc_xo_gpll1_emclk_sleep_map, + .freq_tbl = ftbl_codec_clk, +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index ea43b147a7fe..bb1e148ebfd4 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -631,6 +631,8 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } ++ if (t && !try_module_get(t->owner)) ++ t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -759,6 +761,10 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); ++ ++ if (new_policy.governor) ++ module_put(new_policy.governor->owner); ++ + return ret ? ret : count; + } + +diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c +index 2eefc4a26bc2..b648e31673f9 100644 +--- a/drivers/crypto/caam/caamalg_qi.c ++++ b/drivers/crypto/caam/caamalg_qi.c +@@ -668,7 +668,7 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req, + qm_sg_ents = 1 + !!ivsize + mapped_src_nents + + (mapped_dst_nents > 1 ? mapped_dst_nents : 0); + if (unlikely(qm_sg_ents > CAAM_QI_MAX_AEAD_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_AEAD_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, op_type, 0, 0); +@@ -905,7 +905,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + + qm_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0; + if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, op_type, 0, 0); +@@ -1058,7 +1058,7 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + } + + if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %lu\n", ++ dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", + qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); + caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, + iv_dma, ivsize, GIVENCRYPT, 0, 0); +diff --git a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +index 169e66231bcf..b0ba4331944b 100644 +--- a/drivers/crypto/cavium/cpt/cptvf_reqmanager.c ++++ b/drivers/crypto/cavium/cpt/cptvf_reqmanager.c +@@ -459,7 +459,8 @@ int process_request(struct cpt_vf *cptvf, struct cpt_request_info *req) + info->completion_addr = kzalloc(sizeof(union cpt_res_s), GFP_KERNEL); + if (unlikely(!info->completion_addr)) { + dev_err(&pdev->dev, "Unable to allocate memory for completion_addr\n"); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto request_cleanup; + } + + result = (union cpt_res_s *)info->completion_addr; +diff --git a/drivers/dma-buf/dma-fence-array.c b/drivers/dma-buf/dma-fence-array.c +index 0350829ba62e..dd1edfb27b61 100644 +--- a/drivers/dma-buf/dma-fence-array.c ++++ b/drivers/dma-buf/dma-fence-array.c +@@ -31,6 +31,14 @@ static const char *dma_fence_array_get_timeline_name(struct dma_fence *fence) + return "unbound"; + } + ++static void irq_dma_fence_array_work(struct irq_work *wrk) ++{ ++ struct dma_fence_array *array = container_of(wrk, typeof(*array), work); ++ ++ dma_fence_signal(&array->base); ++ dma_fence_put(&array->base); ++} ++ + static void dma_fence_array_cb_func(struct dma_fence *f, + struct dma_fence_cb *cb) + { +@@ -39,8 +47,9 @@ static void dma_fence_array_cb_func(struct dma_fence *f, + struct dma_fence_array *array = array_cb->array; + + if (atomic_dec_and_test(&array->num_pending)) +- dma_fence_signal(&array->base); +- dma_fence_put(&array->base); ++ irq_work_queue(&array->work); ++ else ++ dma_fence_put(&array->base); + } + + static bool dma_fence_array_enable_signaling(struct dma_fence *fence) +@@ -136,6 +145,7 @@ struct dma_fence_array *dma_fence_array_create(int num_fences, + spin_lock_init(&array->lock); + dma_fence_init(&array->base, &dma_fence_array_ops, &array->lock, + context, seqno); ++ init_irq_work(&array->work, irq_dma_fence_array_work); + + array->num_fences = num_fences; + atomic_set(&array->num_pending, signal_on_any ? 1 : num_fences); +diff --git a/drivers/dma/qcom/hidma_ll.c b/drivers/dma/qcom/hidma_ll.c +index 4999e266b2de..7c6e2ff212a2 100644 +--- a/drivers/dma/qcom/hidma_ll.c ++++ b/drivers/dma/qcom/hidma_ll.c +@@ -393,6 +393,8 @@ static int hidma_ll_reset(struct hidma_lldev *lldev) + */ + static void hidma_ll_int_handler_internal(struct hidma_lldev *lldev, int cause) + { ++ unsigned long irqflags; ++ + if (cause & HIDMA_ERR_INT_MASK) { + dev_err(lldev->dev, "error 0x%x, disabling...\n", + cause); +@@ -410,6 +412,10 @@ static void hidma_ll_int_handler_internal(struct hidma_lldev *lldev, int cause) + return; + } + ++ spin_lock_irqsave(&lldev->lock, irqflags); ++ writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG); ++ spin_unlock_irqrestore(&lldev->lock, irqflags); ++ + /* + * Fine tuned for this HW... + * +@@ -421,9 +427,6 @@ static void hidma_ll_int_handler_internal(struct hidma_lldev *lldev, int cause) + * Try to consume as many EVREs as possible. + */ + hidma_handle_tre_completion(lldev); +- +- /* We consumed TREs or there are pending TREs or EVREs. */ +- writel_relaxed(cause, lldev->evca + HIDMA_EVCA_IRQ_CLR_REG); + } + + irqreturn_t hidma_ll_inthandler(int chirq, void *arg) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +index 5432af39a674..f7fa7675215c 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.c +@@ -265,6 +265,9 @@ uint32_t get_max_engine_clock_in_mhz(struct kgd_dev *kgd) + { + struct amdgpu_device *adev = (struct amdgpu_device *)kgd; + +- /* The sclk is in quantas of 10kHz */ +- return adev->pm.dpm.dyn_state.max_clock_voltage_on_ac.sclk / 100; ++ /* the sclk is in quantas of 10kHz */ ++ if (amdgpu_sriov_vf(adev)) ++ return adev->clock.default_sclk / 100; ++ ++ return amdgpu_dpm_get_sclk(adev, false) / 100; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c +index b9ee9073cb0d..f3f93b6b51ef 100644 +--- a/drivers/gpu/drm/amd/amdgpu/dce_virtual.c ++++ b/drivers/gpu/drm/amd/amdgpu/dce_virtual.c +@@ -437,6 +437,8 @@ static int dce_virtual_sw_fini(void *handle) + drm_kms_helper_poll_fini(adev->ddev); + + drm_mode_config_cleanup(adev->ddev); ++ /* clear crtcs pointer to avoid dce irq finish routine access freed data */ ++ memset(adev->mode_info.crtcs, 0, sizeof(adev->mode_info.crtcs[0]) * AMDGPU_MAX_CRTCS); + adev->mode_info.mode_config_initialized = false; + return 0; + } +@@ -723,7 +725,7 @@ static void dce_virtual_set_crtc_vblank_interrupt_state(struct amdgpu_device *ad + int crtc, + enum amdgpu_interrupt_state state) + { +- if (crtc >= adev->mode_info.num_crtc) { ++ if (crtc >= adev->mode_info.num_crtc || !adev->mode_info.crtcs[crtc]) { + DRM_DEBUG("invalid crtc %d\n", crtc); + return; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +index 2812d88a8bdd..9b7b01333fc0 100644 +--- a/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c ++++ b/drivers/gpu/drm/amd/amdgpu/mxgpu_ai.c +@@ -276,9 +276,17 @@ static int xgpu_ai_mailbox_rcv_irq(struct amdgpu_device *adev, + /* see what event we get */ + r = xgpu_ai_mailbox_rcv_msg(adev, IDH_FLR_NOTIFICATION); + +- /* only handle FLR_NOTIFY now */ +- if (!r) +- schedule_work(&adev->virt.flr_work); ++ /* sometimes the interrupt is delayed to inject to VM, so under such case ++ * the IDH_FLR_NOTIFICATION is overwritten by VF FLR from GIM side, thus ++ * above recieve message could be failed, we should schedule the flr_work ++ * anyway ++ */ ++ if (r) { ++ DRM_ERROR("FLR_NOTIFICATION is missed\n"); ++ xgpu_ai_mailbox_send_ack(adev); ++ } ++ ++ schedule_work(&adev->virt.flr_work); + } + + return 0; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +index 19ce59028d6b..e0b78fd9804d 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_topology.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_topology.c +@@ -501,11 +501,17 @@ static ssize_t sysprops_show(struct kobject *kobj, struct attribute *attr, + return ret; + } + ++static void kfd_topology_kobj_release(struct kobject *kobj) ++{ ++ kfree(kobj); ++} ++ + static const struct sysfs_ops sysprops_ops = { + .show = sysprops_show, + }; + + static struct kobj_type sysprops_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &sysprops_ops, + }; + +@@ -541,6 +547,7 @@ static const struct sysfs_ops iolink_ops = { + }; + + static struct kobj_type iolink_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &iolink_ops, + }; + +@@ -568,6 +575,7 @@ static const struct sysfs_ops mem_ops = { + }; + + static struct kobj_type mem_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &mem_ops, + }; + +@@ -607,6 +615,7 @@ static const struct sysfs_ops cache_ops = { + }; + + static struct kobj_type cache_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &cache_ops, + }; + +@@ -729,6 +738,7 @@ static const struct sysfs_ops node_ops = { + }; + + static struct kobj_type node_type = { ++ .release = kfd_topology_kobj_release, + .sysfs_ops = &node_ops, + }; + +diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c +index d52c9758d8cf..1f1fd3139c5b 100644 +--- a/drivers/gpu/drm/drm_edid.c ++++ b/drivers/gpu/drm/drm_edid.c +@@ -3823,8 +3823,7 @@ EXPORT_SYMBOL(drm_edid_get_monitor_name); + * @edid: EDID to parse + * + * Fill the ELD (EDID-Like Data) buffer for passing to the audio driver. The +- * Conn_Type, HDCP and Port_ID ELD fields are left for the graphics driver to +- * fill in. ++ * HDCP and Port_ID ELD fields are left for the graphics driver to fill in. + */ + void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + { +@@ -3905,6 +3904,12 @@ void drm_edid_to_eld(struct drm_connector *connector, struct edid *edid) + } + eld[5] |= total_sad_count << 4; + ++ if (connector->connector_type == DRM_MODE_CONNECTOR_DisplayPort || ++ connector->connector_type == DRM_MODE_CONNECTOR_eDP) ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_DP; ++ else ++ eld[DRM_ELD_SAD_COUNT_CONN_TYPE] |= DRM_ELD_CONN_TYPE_HDMI; ++ + eld[DRM_ELD_BASELINE_ELD_LEN] = + DIV_ROUND_UP(drm_eld_calc_baseline_block_size(eld), 4); + +diff --git a/drivers/gpu/drm/etnaviv/Kconfig b/drivers/gpu/drm/etnaviv/Kconfig +index 38b477b5fbf9..4df3c48adcec 100644 +--- a/drivers/gpu/drm/etnaviv/Kconfig ++++ b/drivers/gpu/drm/etnaviv/Kconfig +@@ -6,6 +6,7 @@ config DRM_ETNAVIV + depends on MMU + select SHMEM + select SYNC_FILE ++ select THERMAL if DRM_ETNAVIV_THERMAL + select TMPFS + select IOMMU_API + select IOMMU_SUPPORT +@@ -15,6 +16,14 @@ config DRM_ETNAVIV + help + DRM driver for Vivante GPUs. + ++config DRM_ETNAVIV_THERMAL ++ bool "enable ETNAVIV thermal throttling" ++ depends on DRM_ETNAVIV ++ default y ++ help ++ Compile in support for thermal throttling. ++ Say Y unless you want to risk burning your SoC. ++ + config DRM_ETNAVIV_REGISTER_LOGGING + bool "enable ETNAVIV register logging" + depends on DRM_ETNAVIV +diff --git a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +index fc9a6a83dfc7..a1562f89c3d7 100644 +--- a/drivers/gpu/drm/etnaviv/etnaviv_gpu.c ++++ b/drivers/gpu/drm/etnaviv/etnaviv_gpu.c +@@ -1622,7 +1622,7 @@ static int etnaviv_gpu_bind(struct device *dev, struct device *master, + struct etnaviv_gpu *gpu = dev_get_drvdata(dev); + int ret; + +- if (IS_ENABLED(CONFIG_THERMAL)) { ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) { + gpu->cooling = thermal_of_cooling_device_register(dev->of_node, + (char *)dev_name(dev), gpu, &cooling_ops); + if (IS_ERR(gpu->cooling)) +@@ -1635,7 +1635,8 @@ static int etnaviv_gpu_bind(struct device *dev, struct device *master, + ret = etnaviv_gpu_clk_enable(gpu); + #endif + if (ret < 0) { +- thermal_cooling_device_unregister(gpu->cooling); ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) ++ thermal_cooling_device_unregister(gpu->cooling); + return ret; + } + +@@ -1692,7 +1693,8 @@ static void etnaviv_gpu_unbind(struct device *dev, struct device *master, + + gpu->drm = NULL; + +- thermal_cooling_device_unregister(gpu->cooling); ++ if (IS_ENABLED(CONFIG_DRM_ETNAVIV_THERMAL)) ++ thermal_cooling_device_unregister(gpu->cooling); + gpu->cooling = NULL; + } + +diff --git a/drivers/gpu/drm/i915/intel_guc_loader.c b/drivers/gpu/drm/i915/intel_guc_loader.c +index 8b0ae7fce7f2..67a7d6eafd31 100644 +--- a/drivers/gpu/drm/i915/intel_guc_loader.c ++++ b/drivers/gpu/drm/i915/intel_guc_loader.c +@@ -61,9 +61,6 @@ + #define KBL_FW_MAJOR 9 + #define KBL_FW_MINOR 14 + +-#define GLK_FW_MAJOR 10 +-#define GLK_FW_MINOR 56 +- + #define GUC_FW_PATH(platform, major, minor) \ + "i915/" __stringify(platform) "_guc_ver" __stringify(major) "_" __stringify(minor) ".bin" + +@@ -76,8 +73,6 @@ MODULE_FIRMWARE(I915_BXT_GUC_UCODE); + #define I915_KBL_GUC_UCODE GUC_FW_PATH(kbl, KBL_FW_MAJOR, KBL_FW_MINOR) + MODULE_FIRMWARE(I915_KBL_GUC_UCODE); + +-#define I915_GLK_GUC_UCODE GUC_FW_PATH(glk, GLK_FW_MAJOR, GLK_FW_MINOR) +- + + static u32 get_gttype(struct drm_i915_private *dev_priv) + { +@@ -406,10 +401,6 @@ int intel_guc_select_fw(struct intel_guc *guc) + guc->fw.path = I915_KBL_GUC_UCODE; + guc->fw.major_ver_wanted = KBL_FW_MAJOR; + guc->fw.minor_ver_wanted = KBL_FW_MINOR; +- } else if (IS_GEMINILAKE(dev_priv)) { +- guc->fw.path = I915_GLK_GUC_UCODE; +- guc->fw.major_ver_wanted = GLK_FW_MAJOR; +- guc->fw.minor_ver_wanted = GLK_FW_MINOR; + } else { + DRM_ERROR("No GuC firmware known for platform with GuC!\n"); + return -ENOENT; +diff --git a/drivers/gpu/drm/i915/intel_huc.c b/drivers/gpu/drm/i915/intel_huc.c +index 6145fa0d6773..82224efe1ad8 100644 +--- a/drivers/gpu/drm/i915/intel_huc.c ++++ b/drivers/gpu/drm/i915/intel_huc.c +@@ -52,10 +52,6 @@ + #define KBL_HUC_FW_MINOR 00 + #define KBL_BLD_NUM 1810 + +-#define GLK_HUC_FW_MAJOR 02 +-#define GLK_HUC_FW_MINOR 00 +-#define GLK_BLD_NUM 1748 +- + #define HUC_FW_PATH(platform, major, minor, bld_num) \ + "i915/" __stringify(platform) "_huc_ver" __stringify(major) "_" \ + __stringify(minor) "_" __stringify(bld_num) ".bin" +@@ -72,9 +68,6 @@ MODULE_FIRMWARE(I915_BXT_HUC_UCODE); + KBL_HUC_FW_MINOR, KBL_BLD_NUM) + MODULE_FIRMWARE(I915_KBL_HUC_UCODE); + +-#define I915_GLK_HUC_UCODE HUC_FW_PATH(glk, GLK_HUC_FW_MAJOR, \ +- GLK_HUC_FW_MINOR, GLK_BLD_NUM) +- + /** + * huc_ucode_xfer() - DMA's the firmware + * @dev_priv: the drm_i915_private device +@@ -171,10 +164,6 @@ void intel_huc_select_fw(struct intel_huc *huc) + huc->fw.path = I915_KBL_HUC_UCODE; + huc->fw.major_ver_wanted = KBL_HUC_FW_MAJOR; + huc->fw.minor_ver_wanted = KBL_HUC_FW_MINOR; +- } else if (IS_GEMINILAKE(dev_priv)) { +- huc->fw.path = I915_GLK_HUC_UCODE; +- huc->fw.major_ver_wanted = GLK_HUC_FW_MAJOR; +- huc->fw.minor_ver_wanted = GLK_HUC_FW_MINOR; + } else { + DRM_ERROR("No HuC firmware known for platform with HuC!\n"); + return; +diff --git a/drivers/gpu/drm/sun4i/sun8i_mixer.h b/drivers/gpu/drm/sun4i/sun8i_mixer.h +index 4785ac090b8c..c142fbb8661e 100644 +--- a/drivers/gpu/drm/sun4i/sun8i_mixer.h ++++ b/drivers/gpu/drm/sun4i/sun8i_mixer.h +@@ -80,7 +80,7 @@ + + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_EN BIT(0) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_MASK GENMASK(2, 1) +-#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(11, 8) ++#define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_MASK GENMASK(12, 8) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MASK GENMASK(31, 24) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_ALPHA_MODE_DEF (1 << 1) + #define SUN8I_MIXER_CHAN_UI_LAYER_ATTR_FBFMT_ARGB8888 (0 << 8) +diff --git a/drivers/hid/hid-elo.c b/drivers/hid/hid-elo.c +index 0cd4f7216239..5eea6fe0d7bd 100644 +--- a/drivers/hid/hid-elo.c ++++ b/drivers/hid/hid-elo.c +@@ -42,6 +42,12 @@ static int elo_input_configured(struct hid_device *hdev, + { + struct input_dev *input = hidinput->input; + ++ /* ++ * ELO devices have one Button usage in GenDesk field, which makes ++ * hid-input map it to BTN_LEFT; that confuses userspace, which then ++ * considers the device to be a mouse/touchpad instead of touchscreen. ++ */ ++ clear_bit(BTN_LEFT, input->keybit); + set_bit(BTN_TOUCH, input->keybit); + set_bit(ABS_PRESSURE, input->absbit); + input_set_abs_params(input, ABS_PRESSURE, 0, 256, 0, 0); +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 9e8c4d2ba11d..6598501c1ad0 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -738,9 +738,11 @@ static int mt_touch_event(struct hid_device *hid, struct hid_field *field, + } + + static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, +- struct hid_usage *usage, __s32 value) ++ struct hid_usage *usage, __s32 value, ++ bool first_packet) + { + struct mt_device *td = hid_get_drvdata(hid); ++ __s32 cls = td->mtclass.name; + __s32 quirks = td->mtclass.quirks; + struct input_dev *input = field->hidinput->input; + +@@ -794,6 +796,15 @@ static void mt_process_mt_event(struct hid_device *hid, struct hid_field *field, + break; + + default: ++ /* ++ * For Win8 PTP touchpads we should only look at ++ * non finger/touch events in the first_packet of ++ * a (possible) multi-packet frame. ++ */ ++ if ((cls == MT_CLS_WIN_8 || cls == MT_CLS_WIN_8_DUAL) && ++ !first_packet) ++ return; ++ + if (usage->type) + input_event(input, usage->type, usage->code, + value); +@@ -813,6 +824,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) + { + struct mt_device *td = hid_get_drvdata(hid); + struct hid_field *field; ++ bool first_packet; + unsigned count; + int r, n; + +@@ -831,6 +843,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) + td->num_expected = value; + } + ++ first_packet = td->num_received == 0; + for (r = 0; r < report->maxfield; r++) { + field = report->field[r]; + count = field->report_count; +@@ -840,7 +853,7 @@ static void mt_touch_report(struct hid_device *hid, struct hid_report *report) + + for (n = 0; n < count; n++) + mt_process_mt_event(hid, field, &field->usage[n], +- field->value[n]); ++ field->value[n], first_packet); + } + + if (td->num_received >= td->num_expected) +diff --git a/drivers/iio/adc/ina2xx-adc.c b/drivers/iio/adc/ina2xx-adc.c +index f387b972e4f4..59f99b3a180d 100644 +--- a/drivers/iio/adc/ina2xx-adc.c ++++ b/drivers/iio/adc/ina2xx-adc.c +@@ -44,7 +44,6 @@ + + #define INA226_MASK_ENABLE 0x06 + #define INA226_CVRF BIT(3) +-#define INA219_CNVR BIT(1) + + #define INA2XX_MAX_REGISTERS 8 + +@@ -79,6 +78,11 @@ + #define INA226_ITS_MASK GENMASK(5, 3) + #define INA226_SHIFT_ITS(val) ((val) << 3) + ++/* INA219 Bus voltage register, low bits are flags */ ++#define INA219_OVF BIT(0) ++#define INA219_CNVR BIT(1) ++#define INA219_BUS_VOLTAGE_SHIFT 3 ++ + /* Cosmetic macro giving the sampling period for a full P=UxI cycle */ + #define SAMPLING_PERIOD(c) ((c->int_time_vbus + c->int_time_vshunt) \ + * c->avg) +@@ -112,7 +116,7 @@ struct ina2xx_config { + u16 config_default; + int calibration_factor; + int shunt_div; +- int bus_voltage_shift; ++ int bus_voltage_shift; /* position of lsb */ + int bus_voltage_lsb; /* uV */ + int power_lsb; /* uW */ + enum ina2xx_ids chip_id; +@@ -135,7 +139,7 @@ static const struct ina2xx_config ina2xx_config[] = { + .config_default = INA219_CONFIG_DEFAULT, + .calibration_factor = 40960000, + .shunt_div = 100, +- .bus_voltage_shift = 3, ++ .bus_voltage_shift = INA219_BUS_VOLTAGE_SHIFT, + .bus_voltage_lsb = 4000, + .power_lsb = 20000, + .chip_id = ina219, +@@ -170,6 +174,9 @@ static int ina2xx_read_raw(struct iio_dev *indio_dev, + else + *val = regval; + ++ if (chan->address == INA2XX_BUS_VOLTAGE) ++ *val >>= chip->config->bus_voltage_shift; ++ + return IIO_VAL_INT; + + case IIO_CHAN_INFO_OVERSAMPLING_RATIO: +@@ -203,9 +210,9 @@ static int ina2xx_read_raw(struct iio_dev *indio_dev, + return IIO_VAL_FRACTIONAL; + + case INA2XX_BUS_VOLTAGE: +- /* processed (mV) = raw*lsb (uV) / (1000 << shift) */ ++ /* processed (mV) = raw * lsb (uV) / 1000 */ + *val = chip->config->bus_voltage_lsb; +- *val2 = 1000 << chip->config->bus_voltage_shift; ++ *val2 = 1000; + return IIO_VAL_FRACTIONAL; + + case INA2XX_POWER: +@@ -532,7 +539,7 @@ static ssize_t ina2xx_shunt_resistor_store(struct device *dev, + * Sampling Freq is a consequence of the integration times of + * the Voltage channels. + */ +-#define INA219_CHAN_VOLTAGE(_index, _address) { \ ++#define INA219_CHAN_VOLTAGE(_index, _address, _shift) { \ + .type = IIO_VOLTAGE, \ + .address = (_address), \ + .indexed = 1, \ +@@ -544,7 +551,8 @@ static ssize_t ina2xx_shunt_resistor_store(struct device *dev, + .scan_index = (_index), \ + .scan_type = { \ + .sign = 'u', \ +- .realbits = 16, \ ++ .shift = _shift, \ ++ .realbits = 16 - _shift, \ + .storagebits = 16, \ + .endianness = IIO_LE, \ + } \ +@@ -579,8 +587,8 @@ static const struct iio_chan_spec ina226_channels[] = { + }; + + static const struct iio_chan_spec ina219_channels[] = { +- INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE), +- INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE), ++ INA219_CHAN_VOLTAGE(0, INA2XX_SHUNT_VOLTAGE, 0), ++ INA219_CHAN_VOLTAGE(1, INA2XX_BUS_VOLTAGE, INA219_BUS_VOLTAGE_SHIFT), + INA219_CHAN(IIO_POWER, 2, INA2XX_POWER), + INA219_CHAN(IIO_CURRENT, 3, INA2XX_CURRENT), + IIO_CHAN_SOFT_TIMESTAMP(4), +diff --git a/drivers/iio/health/max30102.c b/drivers/iio/health/max30102.c +index 9fb4bc73a6bc..3ac25b21cbfc 100644 +--- a/drivers/iio/health/max30102.c ++++ b/drivers/iio/health/max30102.c +@@ -329,20 +329,31 @@ static int max30102_read_temp(struct max30102_data *data, int *val) + return 0; + } + +-static int max30102_get_temp(struct max30102_data *data, int *val) ++static int max30102_get_temp(struct max30102_data *data, int *val, bool en) + { + int ret; + ++ if (en) { ++ ret = max30102_set_powermode(data, true); ++ if (ret) ++ return ret; ++ } ++ + /* start acquisition */ + ret = regmap_update_bits(data->regmap, MAX30102_REG_TEMP_CONFIG, + MAX30102_REG_TEMP_CONFIG_TEMP_EN, + MAX30102_REG_TEMP_CONFIG_TEMP_EN); + if (ret) +- return ret; ++ goto out; + + msleep(35); ++ ret = max30102_read_temp(data, val); ++ ++out: ++ if (en) ++ max30102_set_powermode(data, false); + +- return max30102_read_temp(data, val); ++ return ret; + } + + static int max30102_read_raw(struct iio_dev *indio_dev, +@@ -355,20 +366,19 @@ static int max30102_read_raw(struct iio_dev *indio_dev, + switch (mask) { + case IIO_CHAN_INFO_RAW: + /* +- * Temperature reading can only be acquired while engine +- * is running ++ * Temperature reading can only be acquired when not in ++ * shutdown; leave shutdown briefly when buffer not running + */ + mutex_lock(&indio_dev->mlock); +- + if (!iio_buffer_enabled(indio_dev)) +- ret = -EBUSY; +- else { +- ret = max30102_get_temp(data, val); +- if (!ret) +- ret = IIO_VAL_INT; +- } +- ++ ret = max30102_get_temp(data, val, true); ++ else ++ ret = max30102_get_temp(data, val, false); + mutex_unlock(&indio_dev->mlock); ++ if (ret) ++ return ret; ++ ++ ret = IIO_VAL_INT; + break; + case IIO_CHAN_INFO_SCALE: + *val = 1000; /* 62.5 */ +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 000937fe53ec..cef05ab83496 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1206,6 +1206,9 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + int err; + bool use_umr = true; + ++ if (!IS_ENABLED(CONFIG_INFINIBAND_USER_MEM)) ++ return ERR_PTR(-EINVAL); ++ + mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n", + start, virt_addr, length, access_flags); + +diff --git a/drivers/leds/leds-pm8058.c b/drivers/leds/leds-pm8058.c +index a52674327857..8988ba3b2d65 100644 +--- a/drivers/leds/leds-pm8058.c ++++ b/drivers/leds/leds-pm8058.c +@@ -106,7 +106,7 @@ static int pm8058_led_probe(struct platform_device *pdev) + if (!led) + return -ENOMEM; + +- led->ledtype = (u32)of_device_get_match_data(&pdev->dev); ++ led->ledtype = (u32)(unsigned long)of_device_get_match_data(&pdev->dev); + + map = dev_get_regmap(pdev->dev.parent, NULL); + if (!map) { +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index ddf0a4341ae2..2704a55f8b6e 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -1941,8 +1941,9 @@ static int multipath_busy(struct dm_target *ti) + *---------------------------------------------------------------*/ + static struct target_type multipath_target = { + .name = "multipath", +- .version = {1, 12, 0}, +- .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE, ++ .version = {1, 13, 0}, ++ .features = DM_TARGET_SINGLETON | DM_TARGET_IMMUTABLE | ++ DM_TARGET_PASSES_INTEGRITY, + .module = THIS_MODULE, + .ctr = multipath_ctr, + .dtr = multipath_dtr, +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index a25eebd98996..33834db7c0a0 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -675,15 +675,11 @@ static struct raid_type *get_raid_type_by_ll(const int level, const int layout) + return NULL; + } + +-/* +- * Conditionally change bdev capacity of @rs +- * in case of a disk add/remove reshape +- */ +-static void rs_set_capacity(struct raid_set *rs) ++/* Adjust rdev sectors */ ++static void rs_set_rdev_sectors(struct raid_set *rs) + { + struct mddev *mddev = &rs->md; + struct md_rdev *rdev; +- struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table)); + + /* + * raid10 sets rdev->sector to the device size, which +@@ -692,8 +688,16 @@ static void rs_set_capacity(struct raid_set *rs) + rdev_for_each(rdev, mddev) + if (!test_bit(Journal, &rdev->flags)) + rdev->sectors = mddev->dev_sectors; ++} + +- set_capacity(gendisk, mddev->array_sectors); ++/* ++ * Change bdev capacity of @rs in case of a disk add/remove reshape ++ */ ++static void rs_set_capacity(struct raid_set *rs) ++{ ++ struct gendisk *gendisk = dm_disk(dm_table_get_md(rs->ti->table)); ++ ++ set_capacity(gendisk, rs->md.array_sectors); + revalidate_disk(gendisk); + } + +@@ -1674,8 +1678,11 @@ static void do_table_event(struct work_struct *ws) + struct raid_set *rs = container_of(ws, struct raid_set, md.event_work); + + smp_rmb(); /* Make sure we access most actual mddev properties */ +- if (!rs_is_reshaping(rs)) ++ if (!rs_is_reshaping(rs)) { ++ if (rs_is_raid10(rs)) ++ rs_set_rdev_sectors(rs); + rs_set_capacity(rs); ++ } + dm_table_event(rs->ti->table); + } + +@@ -3845,11 +3852,10 @@ static int raid_preresume(struct dm_target *ti) + mddev->resync_min = mddev->recovery_cp; + } + +- rs_set_capacity(rs); +- + /* Check for any reshape request unless new raid set */ + if (test_and_clear_bit(RT_FLAG_RESHAPE_RS, &rs->runtime_flags)) { + /* Initiate a reshape. */ ++ rs_set_rdev_sectors(rs); + mddev_lock_nointr(mddev); + r = rs_start_reshape(rs); + mddev_unlock(mddev); +@@ -3878,6 +3884,10 @@ static void raid_resume(struct dm_target *ti) + mddev->ro = 0; + mddev->in_sync = 0; + ++ /* Only reduce raid set size before running a disk removing reshape. */ ++ if (mddev->delta_disks < 0) ++ rs_set_capacity(rs); ++ + /* + * Keep the RAID set frozen if reshape/rebuild flags are set. + * The RAID set is unfrozen once the next table load/resume, +diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c +index 0ef36cec21d1..233622bef4a5 100644 +--- a/drivers/media/platform/davinci/vpif_capture.c ++++ b/drivers/media/platform/davinci/vpif_capture.c +@@ -1545,6 +1545,8 @@ vpif_capture_get_pdata(struct platform_device *pdev) + sizeof(*chan->inputs) * + VPIF_CAPTURE_NUM_CHANNELS, + GFP_KERNEL); ++ if (!chan->inputs) ++ return NULL; + + chan->input_count++; + chan->inputs[i].input.type = V4L2_INPUT_TYPE_CAMERA; +diff --git a/drivers/media/platform/vsp1/vsp1_drv.c b/drivers/media/platform/vsp1/vsp1_drv.c +index 962e4c304076..eed9516e25e1 100644 +--- a/drivers/media/platform/vsp1/vsp1_drv.c ++++ b/drivers/media/platform/vsp1/vsp1_drv.c +@@ -571,7 +571,13 @@ static int __maybe_unused vsp1_pm_suspend(struct device *dev) + { + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + +- vsp1_pipelines_suspend(vsp1); ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_suspend(vsp1); ++ + pm_runtime_force_suspend(vsp1->dev); + + return 0; +@@ -582,7 +588,13 @@ static int __maybe_unused vsp1_pm_resume(struct device *dev) + struct vsp1_device *vsp1 = dev_get_drvdata(dev); + + pm_runtime_force_resume(vsp1->dev); +- vsp1_pipelines_resume(vsp1); ++ ++ /* ++ * When used as part of a display pipeline, the VSP is stopped and ++ * restarted explicitly by the DU. ++ */ ++ if (!vsp1->drm) ++ vsp1_pipelines_resume(vsp1); + + return 0; + } +diff --git a/drivers/media/usb/cpia2/cpia2_v4l.c b/drivers/media/usb/cpia2/cpia2_v4l.c +index 3dedd83f0b19..a1c59f19cf2d 100644 +--- a/drivers/media/usb/cpia2/cpia2_v4l.c ++++ b/drivers/media/usb/cpia2/cpia2_v4l.c +@@ -808,7 +808,7 @@ static int cpia2_querybuf(struct file *file, void *fh, struct v4l2_buffer *buf) + struct camera_data *cam = video_drvdata(file); + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + buf->m.offset = cam->buffers[buf->index].data - cam->frame_buffer; +@@ -859,7 +859,7 @@ static int cpia2_qbuf(struct file *file, void *fh, struct v4l2_buffer *buf) + + if(buf->type != V4L2_BUF_TYPE_VIDEO_CAPTURE || + buf->memory != V4L2_MEMORY_MMAP || +- buf->index > cam->num_frames) ++ buf->index >= cam->num_frames) + return -EINVAL; + + DBG("QBUF #%d\n", buf->index); +diff --git a/drivers/mmc/core/mmc_test.c b/drivers/mmc/core/mmc_test.c +index 478869805b96..789afef66fce 100644 +--- a/drivers/mmc/core/mmc_test.c ++++ b/drivers/mmc/core/mmc_test.c +@@ -2328,10 +2328,17 @@ static int mmc_test_reset(struct mmc_test_card *test) + int err; + + err = mmc_hw_reset(host); +- if (!err) ++ if (!err) { ++ /* ++ * Reset will re-enable the card's command queue, but tests ++ * expect it to be disabled. ++ */ ++ if (card->ext_csd.cmdq_en) ++ mmc_cmdq_disable(card); + return RESULT_OK; +- else if (err == -EOPNOTSUPP) ++ } else if (err == -EOPNOTSUPP) { + return RESULT_UNSUP_HOST; ++ } + + return RESULT_FAIL; + } +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index 9e03bac7f34c..bbdd68a54d68 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -916,6 +916,13 @@ static int fsl_ifc_chip_init(struct fsl_ifc_mtd *priv) + if (ctrl->version >= FSL_IFC_VERSION_1_1_0) + fsl_ifc_sram_init(priv); + ++ /* ++ * As IFC version 2.0.0 has 16KB of internal SRAM as compared to older ++ * versions which had 8KB. Hence bufnum mask needs to be updated. ++ */ ++ if (ctrl->version >= FSL_IFC_VERSION_2_0_0) ++ priv->bufnum_mask = (priv->bufnum_mask * 2) + 1; ++ + return 0; + } + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index b66689a6eac0..807cf75f0a98 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1698,12 +1698,16 @@ static int bnxt_async_event_process(struct bnxt *bp, + + if (BNXT_VF(bp)) + goto async_event_process_exit; +- if (data1 & 0x20000) { ++ ++ /* print unsupported speed warning in forced speed mode only */ ++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED) && ++ (data1 & 0x20000)) { + u16 fw_speed = link_info->force_link_speed; + u32 speed = bnxt_fw_to_ethtool_speed(fw_speed); + +- netdev_warn(bp->dev, "Link speed %d no longer supported\n", +- speed); ++ if (speed != SPEED_UNKNOWN) ++ netdev_warn(bp->dev, "Link speed %d no longer supported\n", ++ speed); + } + set_bit(BNXT_LINK_SPEED_CHNG_SP_EVENT, &bp->sp_event); + /* fall thru */ +diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +index 805ab45e9b5a..2237ef8e4344 100644 +--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c ++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c +@@ -1832,6 +1832,11 @@ static int nicvf_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + nic->pdev = pdev; + nic->pnicvf = nic; + nic->max_queues = qcount; ++ /* If no of CPUs are too low, there won't be any queues left ++ * for XDP_TX, hence double it. ++ */ ++ if (!nic->t88) ++ nic->max_queues *= 2; + + /* MAP VF's configuration registers */ + nic->reg_base = pcim_iomap(pdev, PCI_CFG_REG_BAR_NUM, 0); +diff --git a/drivers/net/ieee802154/adf7242.c b/drivers/net/ieee802154/adf7242.c +index 3e4c8b21403c..46b42de13d76 100644 +--- a/drivers/net/ieee802154/adf7242.c ++++ b/drivers/net/ieee802154/adf7242.c +@@ -888,7 +888,7 @@ static const struct ieee802154_ops adf7242_ops = { + .set_cca_ed_level = adf7242_set_cca_ed_level, + }; + +-static void adf7242_debug(u8 irq1) ++static void adf7242_debug(struct adf7242_local *lp, u8 irq1) + { + #ifdef DEBUG + u8 stat; +@@ -932,7 +932,7 @@ static irqreturn_t adf7242_isr(int irq, void *data) + dev_err(&lp->spi->dev, "%s :ERROR IRQ1 = 0x%X\n", + __func__, irq1); + +- adf7242_debug(irq1); ++ adf7242_debug(lp, irq1); + + xmit = test_bit(FLAG_XMIT, &lp->flags); + +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index c23dea48ad0f..71ff6bd4be9f 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -304,6 +304,10 @@ static int ipvlan_rcv_frame(struct ipvl_addr *addr, struct sk_buff **pskb, + if (dev_forward_skb(ipvlan->dev, skb) == NET_RX_SUCCESS) + success = true; + } else { ++ if (!ether_addr_equal_64bits(eth_hdr(skb)->h_dest, ++ ipvlan->phy_dev->dev_addr)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + ret = RX_HANDLER_ANOTHER; + success = true; + } +diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c +index 5f93e6add563..e911e4990b20 100644 +--- a/drivers/net/phy/at803x.c ++++ b/drivers/net/phy/at803x.c +@@ -239,14 +239,10 @@ static int at803x_resume(struct phy_device *phydev) + { + int value; + +- mutex_lock(&phydev->lock); +- + value = phy_read(phydev, MII_BMCR); + value &= ~(BMCR_PDOWN | BMCR_ISOLATE); + phy_write(phydev, MII_BMCR, value); + +- mutex_unlock(&phydev->lock); +- + return 0; + } + +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 3d860de5e342..39de77a8bb63 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -828,7 +828,6 @@ EXPORT_SYMBOL(phy_stop); + */ + void phy_start(struct phy_device *phydev) + { +- bool do_resume = false; + int err = 0; + + mutex_lock(&phydev->lock); +@@ -841,6 +840,9 @@ void phy_start(struct phy_device *phydev) + phydev->state = PHY_UP; + break; + case PHY_HALTED: ++ /* if phy was suspended, bring the physical link up again */ ++ __phy_resume(phydev); ++ + /* make sure interrupts are re-enabled for the PHY */ + if (phy_interrupt_is_valid(phydev)) { + err = phy_enable_interrupts(phydev); +@@ -849,17 +851,12 @@ void phy_start(struct phy_device *phydev) + } + + phydev->state = PHY_RESUMING; +- do_resume = true; + break; + default: + break; + } + mutex_unlock(&phydev->lock); + +- /* if phy was suspended, bring the physical link up again */ +- if (do_resume) +- phy_resume(phydev); +- + phy_trigger_machine(phydev, true); + } + EXPORT_SYMBOL(phy_start); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 67f25ac29025..d312b314825e 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1152,11 +1152,13 @@ int phy_suspend(struct phy_device *phydev) + } + EXPORT_SYMBOL(phy_suspend); + +-int phy_resume(struct phy_device *phydev) ++int __phy_resume(struct phy_device *phydev) + { + struct phy_driver *phydrv = to_phy_driver(phydev->mdio.dev.driver); + int ret = 0; + ++ WARN_ON(!mutex_is_locked(&phydev->lock)); ++ + if (phydev->drv && phydrv->resume) + ret = phydrv->resume(phydev); + +@@ -1167,6 +1169,18 @@ int phy_resume(struct phy_device *phydev) + + return ret; + } ++EXPORT_SYMBOL(__phy_resume); ++ ++int phy_resume(struct phy_device *phydev) ++{ ++ int ret; ++ ++ mutex_lock(&phydev->lock); ++ ret = __phy_resume(phydev); ++ mutex_unlock(&phydev->lock); ++ ++ return ret; ++} + EXPORT_SYMBOL(phy_resume); + + int phy_loopback(struct phy_device *phydev, bool enable) +@@ -1639,13 +1653,9 @@ int genphy_resume(struct phy_device *phydev) + { + int value; + +- mutex_lock(&phydev->lock); +- + value = phy_read(phydev, MII_BMCR); + phy_write(phydev, MII_BMCR, value & ~BMCR_PDOWN); + +- mutex_unlock(&phydev->lock); +- + return 0; + } + EXPORT_SYMBOL(genphy_resume); +diff --git a/drivers/net/veth.c b/drivers/net/veth.c +index f5438d0978ca..a69ad39ee57e 100644 +--- a/drivers/net/veth.c ++++ b/drivers/net/veth.c +@@ -410,6 +410,9 @@ static int veth_newlink(struct net *src_net, struct net_device *dev, + if (ifmp && (dev->ifindex != 0)) + peer->ifindex = ifmp->ifi_index; + ++ peer->gso_max_size = dev->gso_max_size; ++ peer->gso_max_segs = dev->gso_max_segs; ++ + err = register_netdevice(peer); + put_net(net); + net = NULL; +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 6a785595b9b8..b0a038e6fda0 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -260,9 +260,12 @@ static void virtqueue_napi_complete(struct napi_struct *napi, + int opaque; + + opaque = virtqueue_enable_cb_prepare(vq); +- if (napi_complete_done(napi, processed) && +- unlikely(virtqueue_poll(vq, opaque))) +- virtqueue_napi_schedule(napi, vq); ++ if (napi_complete_done(napi, processed)) { ++ if (unlikely(virtqueue_poll(vq, opaque))) ++ virtqueue_napi_schedule(napi, vq); ++ } else { ++ virtqueue_disable_cb(vq); ++ } + } + + static void skb_xmit_done(struct virtqueue *vq) +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 5683f1a5330e..35b752353aee 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -6183,6 +6183,16 @@ static int ath10k_sta_state(struct ieee80211_hw *hw, + "mac vdev %d peer delete %pM sta %pK (sta gone)\n", + arvif->vdev_id, sta->addr, sta); + ++ if (sta->tdls) { ++ ret = ath10k_mac_tdls_peer_update(ar, arvif->vdev_id, ++ sta, ++ WMI_TDLS_PEER_STATE_TEARDOWN); ++ if (ret) ++ ath10k_warn(ar, "failed to update tdls peer state for %pM state %d: %i\n", ++ sta->addr, ++ WMI_TDLS_PEER_STATE_TEARDOWN, ret); ++ } ++ + ret = ath10k_peer_delete(ar, arvif->vdev_id, sta->addr); + if (ret) + ath10k_warn(ar, "failed to delete peer %pM for vdev %d: %i\n", +diff --git a/drivers/net/wireless/ath/ath10k/wmi.h b/drivers/net/wireless/ath/ath10k/wmi.h +index 7a3606dde227..bab876cf25fe 100644 +--- a/drivers/net/wireless/ath/ath10k/wmi.h ++++ b/drivers/net/wireless/ath/ath10k/wmi.h +@@ -5235,7 +5235,8 @@ enum wmi_10_4_vdev_param { + #define WMI_VDEV_PARAM_TXBF_MU_TX_BFER BIT(3) + + #define WMI_TXBF_STS_CAP_OFFSET_LSB 4 +-#define WMI_TXBF_STS_CAP_OFFSET_MASK 0xf0 ++#define WMI_TXBF_STS_CAP_OFFSET_MASK 0x70 ++#define WMI_TXBF_CONF_IMPLICIT_BF BIT(7) + #define WMI_BF_SOUND_DIM_OFFSET_LSB 8 + #define WMI_BF_SOUND_DIM_OFFSET_MASK 0xf00 + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +index 0fe723ca844e..d22cef7381ba 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -1881,12 +1881,10 @@ static int rs_switch_to_column(struct iwl_mvm *mvm, + struct rs_rate *rate = &search_tbl->rate; + const struct rs_tx_column *column = &rs_tx_columns[col_id]; + const struct rs_tx_column *curr_column = &rs_tx_columns[tbl->column]; +- u32 sz = (sizeof(struct iwl_scale_tbl_info) - +- (sizeof(struct iwl_rate_scale_data) * IWL_RATE_COUNT)); + unsigned long rate_mask = 0; + u32 rate_idx = 0; + +- memcpy(search_tbl, tbl, sz); ++ memcpy(search_tbl, tbl, offsetof(struct iwl_scale_tbl_info, win)); + + rate->sgi = column->sgi; + rate->ant = column->ant; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +index 0ae7624eac9d..43ab172d31cb 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -603,6 +603,12 @@ static void iwl_mvm_dump_lmac_error_log(struct iwl_mvm *mvm, u32 base) + + void iwl_mvm_dump_nic_error_log(struct iwl_mvm *mvm) + { ++ if (!test_bit(STATUS_DEVICE_ENABLED, &mvm->trans->status)) { ++ IWL_ERR(mvm, ++ "DEVICE_ENABLED bit is not set. Aborting dump.\n"); ++ return; ++ } ++ + iwl_mvm_dump_lmac_error_log(mvm, mvm->error_event_table[0]); + + if (mvm->error_event_table[1]) +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 710efe7b65f9..d148dbf3beeb 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -727,16 +727,21 @@ static int hwsim_fops_ps_write(void *dat, u64 val) + val != PS_MANUAL_POLL) + return -EINVAL; + +- old_ps = data->ps; +- data->ps = val; +- +- local_bh_disable(); + if (val == PS_MANUAL_POLL) { ++ if (data->ps != PS_ENABLED) ++ return -EINVAL; ++ local_bh_disable(); + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_ps_poll, data); +- data->ps_poll_pending = true; +- } else if (old_ps == PS_DISABLED && val != PS_DISABLED) { ++ local_bh_enable(); ++ return 0; ++ } ++ old_ps = data->ps; ++ data->ps = val; ++ ++ local_bh_disable(); ++ if (old_ps == PS_DISABLED && val != PS_DISABLED) { + ieee80211_iterate_active_interfaces_atomic( + data->hw, IEEE80211_IFACE_ITER_NORMAL, + hwsim_send_nullfunc_ps, data); +diff --git a/drivers/net/wireless/marvell/mwifiex/cfg80211.c b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +index 32c5074da84c..68aa0c7a8139 100644 +--- a/drivers/net/wireless/marvell/mwifiex/cfg80211.c ++++ b/drivers/net/wireless/marvell/mwifiex/cfg80211.c +@@ -1116,6 +1116,12 @@ mwifiex_cfg80211_change_virtual_intf(struct wiphy *wiphy, + struct mwifiex_private *priv = mwifiex_netdev_get_priv(dev); + enum nl80211_iftype curr_iftype = dev->ieee80211_ptr->iftype; + ++ if (priv->scan_request) { ++ mwifiex_dbg(priv->adapter, ERROR, ++ "change virtual interface: scan in process\n"); ++ return -EBUSY; ++ } ++ + switch (curr_iftype) { + case NL80211_IFTYPE_ADHOC: + switch (type) { +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +index 10bd35f8c894..c01ef02d326b 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c +@@ -4826,6 +4826,10 @@ static const char * const can0_groups[] = { + "can0_data_d", + "can0_data_e", + "can0_data_f", ++ /* ++ * Retained for backwards compatibility, use can_clk_groups in new ++ * designs. ++ */ + "can_clk", + "can_clk_b", + "can_clk_c", +@@ -4837,6 +4841,21 @@ static const char * const can1_groups[] = { + "can1_data_b", + "can1_data_c", + "can1_data_d", ++ /* ++ * Retained for backwards compatibility, use can_clk_groups in new ++ * designs. ++ */ ++ "can_clk", ++ "can_clk_b", ++ "can_clk_c", ++ "can_clk_d", ++}; ++ ++/* ++ * can_clk_groups allows for independent configuration, use can_clk function ++ * in new designs. ++ */ ++static const char * const can_clk_groups[] = { + "can_clk", + "can_clk_b", + "can_clk_c", +@@ -5308,7 +5327,7 @@ static const char * const vin2_groups[] = { + }; + + static const struct { +- struct sh_pfc_function common[56]; ++ struct sh_pfc_function common[57]; + struct sh_pfc_function r8a779x[2]; + } pinmux_functions = { + .common = { +@@ -5316,6 +5335,7 @@ static const struct { + SH_PFC_FUNCTION(avb), + SH_PFC_FUNCTION(can0), + SH_PFC_FUNCTION(can1), ++ SH_PFC_FUNCTION(can_clk), + SH_PFC_FUNCTION(du), + SH_PFC_FUNCTION(du0), + SH_PFC_FUNCTION(du1), +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c b/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c +index 95fd0994893a..ad037534aa13 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7795-es1.c +@@ -1397,7 +1397,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP16_27_24, AUDIO_CLKOUT_B, SEL_ADG_1), + PINMUX_IPSR_MSEL(IP16_27_24, SSI_SCK2_B, SEL_SSI_1), + PINMUX_IPSR_MSEL(IP16_27_24, TS_SDEN1_D, SEL_TSIF1_3), +- PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_2), ++ PINMUX_IPSR_MSEL(IP16_27_24, STP_ISEN_1_D, SEL_SSP1_1_3), + PINMUX_IPSR_MSEL(IP16_27_24, STP_OPWM_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP16_27_24, RIF3_D0_B, SEL_DRIF3_1), + PINMUX_IPSR_MSEL(IP16_27_24, TCLK2_B, SEL_TIMER_TMU_1), +diff --git a/drivers/power/supply/ab8500_charger.c b/drivers/power/supply/ab8500_charger.c +index 4ebbcce45c48..5a76c6d343de 100644 +--- a/drivers/power/supply/ab8500_charger.c ++++ b/drivers/power/supply/ab8500_charger.c +@@ -3218,11 +3218,13 @@ static int ab8500_charger_init_hw_registers(struct ab8500_charger *di) + } + + /* Enable backup battery charging */ +- abx500_mask_and_set_register_interruptible(di->dev, ++ ret = abx500_mask_and_set_register_interruptible(di->dev, + AB8500_RTC, AB8500_RTC_CTRL_REG, + RTC_BUP_CH_ENA, RTC_BUP_CH_ENA); +- if (ret < 0) ++ if (ret < 0) { + dev_err(di->dev, "%s mask and set failed\n", __func__); ++ goto out; ++ } + + if (is_ab8540(di->parent)) { + ret = abx500_mask_and_set_register_interruptible(di->dev, +diff --git a/drivers/pwm/pwm-stmpe.c b/drivers/pwm/pwm-stmpe.c +index e464582a390a..3439f1e902cb 100644 +--- a/drivers/pwm/pwm-stmpe.c ++++ b/drivers/pwm/pwm-stmpe.c +@@ -145,7 +145,7 @@ static int stmpe_24xx_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + break; + + case 2: +- offset = STMPE24XX_PWMIC1; ++ offset = STMPE24XX_PWMIC2; + break; + + default: +diff --git a/drivers/rtc/rtc-brcmstb-waketimer.c b/drivers/rtc/rtc-brcmstb-waketimer.c +index 796ac792a381..6cee61201c30 100644 +--- a/drivers/rtc/rtc-brcmstb-waketimer.c ++++ b/drivers/rtc/rtc-brcmstb-waketimer.c +@@ -253,7 +253,7 @@ static int brcmstb_waketmr_probe(struct platform_device *pdev) + ret = devm_request_irq(dev, timer->irq, brcmstb_waketmr_irq, 0, + "brcmstb-waketimer", timer); + if (ret < 0) +- return ret; ++ goto err_clk; + + timer->reboot_notifier.notifier_call = brcmstb_waketmr_reboot; + register_reboot_notifier(&timer->reboot_notifier); +@@ -262,12 +262,21 @@ static int brcmstb_waketmr_probe(struct platform_device *pdev) + &brcmstb_waketmr_ops, THIS_MODULE); + if (IS_ERR(timer->rtc)) { + dev_err(dev, "unable to register device\n"); +- unregister_reboot_notifier(&timer->reboot_notifier); +- return PTR_ERR(timer->rtc); ++ ret = PTR_ERR(timer->rtc); ++ goto err_notifier; + } + + dev_info(dev, "registered, with irq %d\n", timer->irq); + ++ return 0; ++ ++err_notifier: ++ unregister_reboot_notifier(&timer->reboot_notifier); ++ ++err_clk: ++ if (timer->clk) ++ clk_disable_unprepare(timer->clk); ++ + return ret; + } + +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index b19b00adacb2..cfc095f45e26 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -181,7 +181,7 @@ static struct { + {"HITACHI", "6586-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HITACHI", "6588-", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, + {"HP", "A6189A", NULL, BLIST_SPARSELUN | BLIST_LARGELUN}, /* HP VA7400 */ +- {"HP", "OPEN-", "*", BLIST_REPORTLUN2}, /* HP XP Arrays */ ++ {"HP", "OPEN-", "*", BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES}, /* HP XP Arrays */ + {"HP", "NetRAID-4M", NULL, BLIST_FORCELUN}, + {"HP", "HSV100", NULL, BLIST_REPORTLUN2 | BLIST_NOSTARTONADD}, + {"HP", "C1557A", NULL, BLIST_FORCELUN}, +@@ -595,17 +595,12 @@ int scsi_get_device_flags_keyed(struct scsi_device *sdev, + int key) + { + struct scsi_dev_info_list *devinfo; +- int err; + + devinfo = scsi_dev_info_list_find(vendor, model, key); + if (!IS_ERR(devinfo)) + return devinfo->flags; + +- err = PTR_ERR(devinfo); +- if (err != -ENOENT) +- return err; +- +- /* nothing found, return nothing */ ++ /* key or device not found: return nothing */ + if (key != SCSI_DEVINFO_GLOBAL) + return 0; + +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index 84addee05be6..a5e30e9449ef 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -56,10 +56,13 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { + {"IBM", "1815", "rdac", }, + {"IBM", "1818", "rdac", }, + {"IBM", "3526", "rdac", }, ++ {"IBM", "3542", "rdac", }, ++ {"IBM", "3552", "rdac", }, + {"SGI", "TP9", "rdac", }, + {"SGI", "IS", "rdac", }, +- {"STK", "OPENstorage D280", "rdac", }, ++ {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, ++ {"STK", "BladeCtlr", "rdac", }, + {"SUN", "CSM", "rdac", }, + {"SUN", "LCSM100", "rdac", }, + {"SUN", "STK6580_6780", "rdac", }, +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index 11826c5c2dd4..62f04c0511cf 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -615,13 +615,16 @@ static void ses_enclosure_data_process(struct enclosure_device *edev, + } + + static void ses_match_to_enclosure(struct enclosure_device *edev, +- struct scsi_device *sdev) ++ struct scsi_device *sdev, ++ int refresh) + { ++ struct scsi_device *edev_sdev = to_scsi_device(edev->edev.parent); + struct efd efd = { + .addr = 0, + }; + +- ses_enclosure_data_process(edev, to_scsi_device(edev->edev.parent), 0); ++ if (refresh) ++ ses_enclosure_data_process(edev, edev_sdev, 0); + + if (scsi_is_sas_rphy(sdev->sdev_target->dev.parent)) + efd.addr = sas_get_address(sdev); +@@ -652,7 +655,7 @@ static int ses_intf_add(struct device *cdev, + struct enclosure_device *prev = NULL; + + while ((edev = enclosure_find(&sdev->host->shost_gendev, prev)) != NULL) { +- ses_match_to_enclosure(edev, sdev); ++ ses_match_to_enclosure(edev, sdev, 1); + prev = edev; + } + return -ENODEV; +@@ -768,7 +771,7 @@ static int ses_intf_add(struct device *cdev, + shost_for_each_device(tmp_sdev, sdev->host) { + if (tmp_sdev->lun != 0 || scsi_device_enclosure(tmp_sdev)) + continue; +- ses_match_to_enclosure(edev, tmp_sdev); ++ ses_match_to_enclosure(edev, tmp_sdev, 0); + } + + return 0; +diff --git a/drivers/spi/spi-sun6i.c b/drivers/spi/spi-sun6i.c +index fb38234249a8..8533f4edd00a 100644 +--- a/drivers/spi/spi-sun6i.c ++++ b/drivers/spi/spi-sun6i.c +@@ -541,7 +541,7 @@ static int sun6i_spi_probe(struct platform_device *pdev) + + static int sun6i_spi_remove(struct platform_device *pdev) + { +- pm_runtime_disable(&pdev->dev); ++ pm_runtime_force_suspend(&pdev->dev); + + return 0; + } +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index e7541dc90473..d9941b0c468d 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -334,24 +334,23 @@ static loff_t ashmem_llseek(struct file *file, loff_t offset, int origin) + mutex_lock(&ashmem_mutex); + + if (asma->size == 0) { +- ret = -EINVAL; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EINVAL; + } + + if (!asma->file) { +- ret = -EBADF; +- goto out; ++ mutex_unlock(&ashmem_mutex); ++ return -EBADF; + } + ++ mutex_unlock(&ashmem_mutex); ++ + ret = vfs_llseek(asma->file, offset, origin); + if (ret < 0) +- goto out; ++ return ret; + + /** Copy f_pos from backing file, since f_ops->llseek() sets it */ + file->f_pos = asma->file->f_pos; +- +-out: +- mutex_unlock(&ashmem_mutex); + return ret; + } + +diff --git a/drivers/staging/comedi/drivers.c b/drivers/staging/comedi/drivers.c +index 0b43db6371c6..c11c22bd6d13 100644 +--- a/drivers/staging/comedi/drivers.c ++++ b/drivers/staging/comedi/drivers.c +@@ -484,8 +484,7 @@ unsigned int comedi_nsamples_left(struct comedi_subdevice *s, + struct comedi_cmd *cmd = &async->cmd; + + if (cmd->stop_src == TRIG_COUNT) { +- unsigned int nscans = nsamples / cmd->scan_end_arg; +- unsigned int scans_left = __comedi_nscans_left(s, nscans); ++ unsigned int scans_left = __comedi_nscans_left(s, cmd->stop_arg); + unsigned int scan_pos = + comedi_bytes_to_samples(s, async->scan_progress); + unsigned long long samples_left = 0; +diff --git a/drivers/staging/rtlwifi/rtl8822be/fw.c b/drivers/staging/rtlwifi/rtl8822be/fw.c +index a2cc54866e79..acabb2470d55 100644 +--- a/drivers/staging/rtlwifi/rtl8822be/fw.c ++++ b/drivers/staging/rtlwifi/rtl8822be/fw.c +@@ -464,6 +464,8 @@ bool rtl8822b_halmac_cb_write_data_rsvd_page(struct rtl_priv *rtlpriv, u8 *buf, + int count; + + skb = dev_alloc_skb(size); ++ if (!skb) ++ return false; + memcpy((u8 *)skb_put(skb, size), buf, size); + + if (!_rtl8822be_send_bcn_or_cmd_packet(rtlpriv->hw, skb, BEACON_QUEUE)) +diff --git a/drivers/staging/typec/fusb302/fusb302.c b/drivers/staging/typec/fusb302/fusb302.c +index fc6a3cf74eb3..7d9f25db1add 100644 +--- a/drivers/staging/typec/fusb302/fusb302.c ++++ b/drivers/staging/typec/fusb302/fusb302.c +@@ -1552,6 +1552,21 @@ static int fusb302_pd_read_message(struct fusb302_chip *chip, + fusb302_log(chip, "PD message header: %x", msg->header); + fusb302_log(chip, "PD message len: %d", len); + ++ /* ++ * Check if we've read off a GoodCRC message. If so then indicate to ++ * TCPM that the previous transmission has completed. Otherwise we pass ++ * the received message over to TCPM for processing. ++ * ++ * We make this check here instead of basing the reporting decision on ++ * the IRQ event type, as it's possible for the chip to report the ++ * TX_SUCCESS and GCRCSENT events out of order on occasion, so we need ++ * to check the message type to ensure correct reporting to TCPM. ++ */ ++ if ((!len) && (pd_header_type_le(msg->header) == PD_CTRL_GOOD_CRC)) ++ tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS); ++ else ++ tcpm_pd_receive(chip->tcpm_port, msg); ++ + return ret; + } + +@@ -1659,13 +1674,12 @@ static irqreturn_t fusb302_irq_intn(int irq, void *dev_id) + + if (interrupta & FUSB_REG_INTERRUPTA_TX_SUCCESS) { + fusb302_log(chip, "IRQ: PD tx success"); +- /* read out the received good CRC */ + ret = fusb302_pd_read_message(chip, &pd_msg); + if (ret < 0) { +- fusb302_log(chip, "cannot read in GCRC, ret=%d", ret); ++ fusb302_log(chip, ++ "cannot read in PD message, ret=%d", ret); + goto done; + } +- tcpm_pd_transmit_complete(chip->tcpm_port, TCPC_TX_SUCCESS); + } + + if (interrupta & FUSB_REG_INTERRUPTA_HARDRESET) { +@@ -1686,7 +1700,6 @@ static irqreturn_t fusb302_irq_intn(int irq, void *dev_id) + "cannot read in PD message, ret=%d", ret); + goto done; + } +- tcpm_pd_receive(chip->tcpm_port, &pd_msg); + } + done: + mutex_unlock(&chip->lock); +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index d4e7be88e0da..908110b5cf10 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -4700,6 +4700,17 @@ static const struct pci_device_id serial_pci_tbl[] = { + { PCI_VENDOR_ID_INTASHIELD, PCI_DEVICE_ID_INTASHIELD_IS400, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, /* 135a.0dc0 */ + pbn_b2_4_115200 }, ++ /* ++ * BrainBoxes UC-260 ++ */ ++ { PCI_VENDOR_ID_INTASHIELD, 0x0D21, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, ++ { PCI_VENDOR_ID_INTASHIELD, 0x0E34, ++ PCI_ANY_ID, PCI_ANY_ID, ++ PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00, ++ pbn_b2_4_115200 }, + /* + * Perle PCI-RAS cards + */ +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index 7551cab438ff..a0b24bc09783 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1763,6 +1763,7 @@ static void atmel_get_ip_name(struct uart_port *port) + switch (version) { + case 0x302: + case 0x10213: ++ case 0x10302: + dev_dbg(port->dev, "This version is usart\n"); + atmel_port->has_frac_baudrate = true; + atmel_port->has_hw_timer = true; +diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c +index 98928f082d87..17dba0af5ee9 100644 +--- a/drivers/tty/serial/earlycon.c ++++ b/drivers/tty/serial/earlycon.c +@@ -253,11 +253,12 @@ int __init of_setup_earlycon(const struct earlycon_id *match, + } + port->mapbase = addr; + port->uartclk = BASE_BAUD * 16; +- port->membase = earlycon_map(port->mapbase, SZ_4K); + + val = of_get_flat_dt_prop(node, "reg-offset", NULL); + if (val) + port->mapbase += be32_to_cpu(*val); ++ port->membase = earlycon_map(port->mapbase, SZ_4K); ++ + val = of_get_flat_dt_prop(node, "reg-shift", NULL); + if (val) + port->regshift = be32_to_cpu(*val); +diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c +index 7948acf14601..c8cb0b398cb1 100644 +--- a/drivers/tty/serial/serial_core.c ++++ b/drivers/tty/serial/serial_core.c +@@ -1157,6 +1157,8 @@ static int uart_do_autoconfig(struct tty_struct *tty,struct uart_state *state) + uport->ops->config_port(uport, flags); + + ret = uart_startup(tty, state, 1); ++ if (ret == 0) ++ tty_port_set_initialized(port, true); + if (ret > 0) + ret = 0; + } +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 761b9f5f1491..22f60239026c 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -886,6 +886,8 @@ static void sci_receive_chars(struct uart_port *port) + /* Tell the rest of the system the news. New characters! */ + tty_flip_buffer_push(tport); + } else { ++ /* TTY buffers full; read from RX reg to prevent lockup */ ++ serial_port_in(port, SCxRDR); + serial_port_in(port, SCxSR); /* dummy read */ + sci_clear_SCxSR(port, SCxSR_RDxF_CLEAR(port)); + } +diff --git a/drivers/usb/core/ledtrig-usbport.c b/drivers/usb/core/ledtrig-usbport.c +index 1af877942110..2de0444c95a8 100644 +--- a/drivers/usb/core/ledtrig-usbport.c ++++ b/drivers/usb/core/ledtrig-usbport.c +@@ -140,11 +140,17 @@ static bool usbport_trig_port_observed(struct usbport_trig_data *usbport_data, + if (!led_np) + return false; + +- /* Get node of port being added */ ++ /* ++ * Get node of port being added ++ * ++ * FIXME: This is really the device node of the connected device ++ */ + port_np = usb_of_get_child_node(usb_dev->dev.of_node, port1); + if (!port_np) + return false; + ++ of_node_put(port_np); ++ + /* Amount of trigger sources for this LED */ + count = of_count_phandle_with_args(led_np, "trigger-sources", + "#trigger-source-cells"); +diff --git a/drivers/usb/core/message.c b/drivers/usb/core/message.c +index 371a07d874a3..dd29e6ec1c43 100644 +--- a/drivers/usb/core/message.c ++++ b/drivers/usb/core/message.c +@@ -150,6 +150,10 @@ int usb_control_msg(struct usb_device *dev, unsigned int pipe, __u8 request, + + ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout); + ++ /* Linger a bit, prior to the next control message. */ ++ if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG) ++ msleep(200); ++ + kfree(dr); + + return ret; +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 774c97bb1c08..4f1c6f8d4352 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -229,7 +229,8 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, + + /* Corsair Strafe RGB */ +- { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, ++ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, + + /* Corsair K70 LUX */ + { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 03474d3575ab..3219d8157f5b 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -186,7 +186,7 @@ void dwc3_set_mode(struct dwc3 *dwc, u32 mode) + dwc->desired_dr_role = mode; + spin_unlock_irqrestore(&dwc->lock, flags); + +- queue_work(system_power_efficient_wq, &dwc->drd_work); ++ queue_work(system_freezable_wq, &dwc->drd_work); + } + + u32 dwc3_core_fifo_space(struct dwc3_ep *dep, u8 type) +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index a9c9ab01592b..0904cb6ce4de 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -1539,7 +1539,6 @@ ffs_fs_kill_sb(struct super_block *sb) + if (sb->s_fs_info) { + ffs_release_dev(sb->s_fs_info); + ffs_data_closed(sb->s_fs_info); +- ffs_data_put(sb->s_fs_info); + } + } + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index abb8f19ae40f..3fb57cf8abb8 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -134,6 +134,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info()) + xhci->quirks |= XHCI_AMD_PLL_FIX; + ++ if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb) ++ xhci->quirks |= XHCI_SUSPEND_DELAY; ++ + if (pdev->vendor == PCI_VENDOR_ID_AMD) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + +diff --git a/drivers/usb/host/xhci-rcar.c b/drivers/usb/host/xhci-rcar.c +index 198bc188ab25..97f23cc31f4c 100644 +--- a/drivers/usb/host/xhci-rcar.c ++++ b/drivers/usb/host/xhci-rcar.c +@@ -86,6 +86,10 @@ static const struct soc_device_attribute rcar_quirks_match[] = { + .soc_id = "r8a7796", + .data = (void *)RCAR_XHCI_FIRMWARE_V3, + }, ++ { ++ .soc_id = "r8a77965", ++ .data = (void *)RCAR_XHCI_FIRMWARE_V3, ++ }, + { /* sentinel */ }, + }; + +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index e5677700dea4..bad76a7c7f2f 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -887,6 +887,9 @@ int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup) + clear_bit(HCD_FLAG_POLL_RH, &xhci->shared_hcd->flags); + del_timer_sync(&xhci->shared_hcd->rh_timer); + ++ if (xhci->quirks & XHCI_SUSPEND_DELAY) ++ usleep_range(1000, 1500); ++ + spin_lock_irq(&xhci->lock); + clear_bit(HCD_FLAG_HW_ACCESSIBLE, &hcd->flags); + clear_bit(HCD_FLAG_HW_ACCESSIBLE, &xhci->shared_hcd->flags); +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2b48aa4f6b76..2eaf6e1f12ee 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -728,11 +728,12 @@ struct xhci_ep_ctx { + /* bits 10:14 are Max Primary Streams */ + /* bit 15 is Linear Stream Array */ + /* Interval - period between requests to an endpoint - 125u increments. */ +-#define EP_INTERVAL(p) (((p) & 0xff) << 16) +-#define EP_INTERVAL_TO_UFRAMES(p) (1 << (((p) >> 16) & 0xff)) +-#define CTX_TO_EP_INTERVAL(p) (((p) >> 16) & 0xff) +-#define EP_MAXPSTREAMS_MASK (0x1f << 10) +-#define EP_MAXPSTREAMS(p) (((p) << 10) & EP_MAXPSTREAMS_MASK) ++#define EP_INTERVAL(p) (((p) & 0xff) << 16) ++#define EP_INTERVAL_TO_UFRAMES(p) (1 << (((p) >> 16) & 0xff)) ++#define CTX_TO_EP_INTERVAL(p) (((p) >> 16) & 0xff) ++#define EP_MAXPSTREAMS_MASK (0x1f << 10) ++#define EP_MAXPSTREAMS(p) (((p) << 10) & EP_MAXPSTREAMS_MASK) ++#define CTX_TO_EP_MAXPSTREAMS(p) (((p) & EP_MAXPSTREAMS_MASK) >> 10) + /* Endpoint is set up with a Linear Stream Array (vs. Secondary Stream Array) */ + #define EP_HAS_LSA (1 << 15) + /* hosts with LEC=1 use bits 31:24 as ESIT high bits. */ +@@ -1830,6 +1831,7 @@ struct xhci_hcd { + #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) + /* Reserved. It was XHCI_U2_DISABLE_WAKE */ + #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28) ++#define XHCI_SUSPEND_DELAY (1 << 30) + + unsigned int num_active_eps; + unsigned int limit_active_eps; +@@ -2539,21 +2541,22 @@ static inline const char *xhci_decode_ep_context(u32 info, u32 info2, u64 deq, + u8 burst; + u8 cerr; + u8 mult; +- u8 lsa; +- u8 hid; ++ ++ bool lsa; ++ bool hid; + + esit = CTX_TO_MAX_ESIT_PAYLOAD_HI(info) << 16 | + CTX_TO_MAX_ESIT_PAYLOAD(tx_info); + + ep_state = info & EP_STATE_MASK; +- max_pstr = info & EP_MAXPSTREAMS_MASK; ++ max_pstr = CTX_TO_EP_MAXPSTREAMS(info); + interval = CTX_TO_EP_INTERVAL(info); + mult = CTX_TO_EP_MULT(info) + 1; +- lsa = info & EP_HAS_LSA; ++ lsa = !!(info & EP_HAS_LSA); + + cerr = (info2 & (3 << 1)) >> 1; + ep_type = CTX_TO_EP_TYPE(info2); +- hid = info2 & (1 << 7); ++ hid = !!(info2 & (1 << 7)); + burst = CTX_TO_MAX_BURST(info2); + maxp = MAX_PACKET_DECODED(info2); + +diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c +index f5e1bb5e5217..984f7e12a6a5 100644 +--- a/drivers/usb/mon/mon_text.c ++++ b/drivers/usb/mon/mon_text.c +@@ -85,6 +85,8 @@ struct mon_reader_text { + + wait_queue_head_t wait; + int printf_size; ++ size_t printf_offset; ++ size_t printf_togo; + char *printf_buf; + struct mutex printf_lock; + +@@ -376,75 +378,103 @@ static int mon_text_open(struct inode *inode, struct file *file) + return rc; + } + +-/* +- * For simplicity, we read one record in one system call and throw out +- * what does not fit. This means that the following does not work: +- * dd if=/dbg/usbmon/0t bs=10 +- * Also, we do not allow seeks and do not bother advancing the offset. +- */ ++static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp, ++ char __user * const buf, const size_t nbytes) ++{ ++ const size_t togo = min(nbytes, rp->printf_togo); ++ ++ if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo)) ++ return -EFAULT; ++ rp->printf_togo -= togo; ++ rp->printf_offset += togo; ++ return togo; ++} ++ ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_t(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- ep = mon_text_read_wait(rp, file); +- if (IS_ERR(ep)) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; +- +- mon_text_read_head_t(rp, &ptr, ep); +- mon_text_read_statset(rp, &ptr, ep); +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); +- +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_t(rp, &ptr, ep); ++ mon_text_read_statset(rp, &ptr, ep); ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); ++ } ++ ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + ++/* ppos is not advanced since the llseek operation is not permitted. */ + static ssize_t mon_text_read_u(struct file *file, char __user *buf, +- size_t nbytes, loff_t *ppos) ++ size_t nbytes, loff_t *ppos) + { + struct mon_reader_text *rp = file->private_data; + struct mon_event_text *ep; + struct mon_text_ptr ptr; ++ ssize_t ret; + +- ep = mon_text_read_wait(rp, file); +- if (IS_ERR(ep)) +- return PTR_ERR(ep); + mutex_lock(&rp->printf_lock); +- ptr.cnt = 0; +- ptr.pbuf = rp->printf_buf; +- ptr.limit = rp->printf_size; + +- mon_text_read_head_u(rp, &ptr, ep); +- if (ep->type == 'E') { +- mon_text_read_statset(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { +- mon_text_read_isostat(rp, &ptr, ep); +- mon_text_read_isodesc(rp, &ptr, ep); +- } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { +- mon_text_read_intstat(rp, &ptr, ep); +- } else { +- mon_text_read_statset(rp, &ptr, ep); ++ if (rp->printf_togo == 0) { ++ ++ ep = mon_text_read_wait(rp, file); ++ if (IS_ERR(ep)) { ++ mutex_unlock(&rp->printf_lock); ++ return PTR_ERR(ep); ++ } ++ ptr.cnt = 0; ++ ptr.pbuf = rp->printf_buf; ++ ptr.limit = rp->printf_size; ++ ++ mon_text_read_head_u(rp, &ptr, ep); ++ if (ep->type == 'E') { ++ mon_text_read_statset(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) { ++ mon_text_read_isostat(rp, &ptr, ep); ++ mon_text_read_isodesc(rp, &ptr, ep); ++ } else if (ep->xfertype == USB_ENDPOINT_XFER_INT) { ++ mon_text_read_intstat(rp, &ptr, ep); ++ } else { ++ mon_text_read_statset(rp, &ptr, ep); ++ } ++ ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ++ " %d", ep->length); ++ mon_text_read_data(rp, &ptr, ep); ++ ++ rp->printf_togo = ptr.cnt; ++ rp->printf_offset = 0; ++ ++ kmem_cache_free(rp->e_slab, ep); + } +- ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, +- " %d", ep->length); +- mon_text_read_data(rp, &ptr, ep); + +- if (copy_to_user(buf, rp->printf_buf, ptr.cnt)) +- ptr.cnt = -EFAULT; ++ ret = mon_text_copy_to_user(rp, buf, nbytes); + mutex_unlock(&rp->printf_lock); +- kmem_cache_free(rp->e_slab, ep); +- return ptr.cnt; ++ return ret; + } + + static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp, +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 0bc8543e96b1..25a281f876b5 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -1076,7 +1076,7 @@ static int uas_post_reset(struct usb_interface *intf) + return 0; + + err = uas_configure_endpoints(devinfo); +- if (err && err != ENODEV) ++ if (err && err != -ENODEV) + shost_printk(KERN_ERR, shost, + "%s: alloc streams error %d after reset", + __func__, err); +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 9af39644561f..52b3e6da0745 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2137,6 +2137,13 @@ UNUSUAL_DEV( 0x152d, 0x2566, 0x0114, 0x0114, + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_BROKEN_FUA ), + ++/* Reported by Teijo Kinnunen */ ++UNUSUAL_DEV( 0x152d, 0x2567, 0x0117, 0x0117, ++ "JMicron", ++ "USB to ATA/ATAPI Bridge", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_BROKEN_FUA ), ++ + /* Reported-by George Cherian */ + UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, + "JMicron", +diff --git a/drivers/usb/usbip/vudc_sysfs.c b/drivers/usb/usbip/vudc_sysfs.c +index 0f98f2c7475f..7efa374a4970 100644 +--- a/drivers/usb/usbip/vudc_sysfs.c ++++ b/drivers/usb/usbip/vudc_sysfs.c +@@ -117,10 +117,14 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr, + if (rv != 0) + return -EINVAL; + ++ if (!udc) { ++ dev_err(dev, "no device"); ++ return -ENODEV; ++ } + spin_lock_irqsave(&udc->lock, flags); + /* Don't export what we don't have */ +- if (!udc || !udc->driver || !udc->pullup) { +- dev_err(dev, "no device or gadget not bound"); ++ if (!udc->driver || !udc->pullup) { ++ dev_err(dev, "gadget not bound"); + ret = -ENODEV; + goto unlock; + } +diff --git a/drivers/video/hdmi.c b/drivers/video/hdmi.c +index 1cf907ecded4..111a0ab6280a 100644 +--- a/drivers/video/hdmi.c ++++ b/drivers/video/hdmi.c +@@ -321,6 +321,17 @@ int hdmi_vendor_infoframe_init(struct hdmi_vendor_infoframe *frame) + } + EXPORT_SYMBOL(hdmi_vendor_infoframe_init); + ++static int hdmi_vendor_infoframe_length(const struct hdmi_vendor_infoframe *frame) ++{ ++ /* for side by side (half) we also need to provide 3D_Ext_Data */ ++ if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) ++ return 6; ++ else if (frame->vic != 0 || frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) ++ return 5; ++ else ++ return 4; ++} ++ + /** + * hdmi_vendor_infoframe_pack() - write a HDMI vendor infoframe to binary buffer + * @frame: HDMI infoframe +@@ -341,19 +352,11 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + u8 *ptr = buffer; + size_t length; + +- /* empty info frame */ +- if (frame->vic == 0 && frame->s3d_struct == HDMI_3D_STRUCTURE_INVALID) +- return -EINVAL; +- + /* only one of those can be supplied */ + if (frame->vic != 0 && frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) + return -EINVAL; + +- /* for side by side (half) we also need to provide 3D_Ext_Data */ +- if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) +- frame->length = 6; +- else +- frame->length = 5; ++ frame->length = hdmi_vendor_infoframe_length(frame); + + length = HDMI_INFOFRAME_HEADER_SIZE + frame->length; + +@@ -372,14 +375,16 @@ ssize_t hdmi_vendor_infoframe_pack(struct hdmi_vendor_infoframe *frame, + ptr[5] = 0x0c; + ptr[6] = 0x00; + +- if (frame->vic) { +- ptr[7] = 0x1 << 5; /* video format */ +- ptr[8] = frame->vic; +- } else { ++ if (frame->s3d_struct != HDMI_3D_STRUCTURE_INVALID) { + ptr[7] = 0x2 << 5; /* video format */ + ptr[8] = (frame->s3d_struct & 0xf) << 4; + if (frame->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) + ptr[9] = (frame->s3d_ext_data & 0xf) << 4; ++ } else if (frame->vic) { ++ ptr[7] = 0x1 << 5; /* video format */ ++ ptr[8] = frame->vic; ++ } else { ++ ptr[7] = 0x0 << 5; /* video format */ + } + + hdmi_infoframe_set_checksum(buffer, length); +@@ -1165,7 +1170,7 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + if (ptr[0] != HDMI_INFOFRAME_TYPE_VENDOR || + ptr[1] != 1 || +- (ptr[2] != 5 && ptr[2] != 6)) ++ (ptr[2] != 4 && ptr[2] != 5 && ptr[2] != 6)) + return -EINVAL; + + length = ptr[2]; +@@ -1193,16 +1198,22 @@ hdmi_vendor_any_infoframe_unpack(union hdmi_vendor_any_infoframe *frame, + + hvf->length = length; + +- if (hdmi_video_format == 0x1) { +- hvf->vic = ptr[4]; +- } else if (hdmi_video_format == 0x2) { ++ if (hdmi_video_format == 0x2) { ++ if (length != 5 && length != 6) ++ return -EINVAL; + hvf->s3d_struct = ptr[4] >> 4; + if (hvf->s3d_struct >= HDMI_3D_STRUCTURE_SIDE_BY_SIDE_HALF) { +- if (length == 6) +- hvf->s3d_ext_data = ptr[5] >> 4; +- else ++ if (length != 6) + return -EINVAL; ++ hvf->s3d_ext_data = ptr[5] >> 4; + } ++ } else if (hdmi_video_format == 0x1) { ++ if (length != 5) ++ return -EINVAL; ++ hvf->vic = ptr[4]; ++ } else { ++ if (length != 4) ++ return -EINVAL; + } + + return 0; +diff --git a/fs/btrfs/sysfs.c b/fs/btrfs/sysfs.c +index 4447e0fe9b55..883881b16c86 100644 +--- a/fs/btrfs/sysfs.c ++++ b/fs/btrfs/sysfs.c +@@ -422,7 +422,7 @@ static ssize_t btrfs_nodesize_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->nodesize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->super_copy->nodesize); + } + + BTRFS_ATTR(nodesize, btrfs_nodesize_show); +@@ -432,7 +432,8 @@ static ssize_t btrfs_sectorsize_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", ++ fs_info->super_copy->sectorsize); + } + + BTRFS_ATTR(sectorsize, btrfs_sectorsize_show); +@@ -442,7 +443,8 @@ static ssize_t btrfs_clone_alignment_show(struct kobject *kobj, + { + struct btrfs_fs_info *fs_info = to_fs_info(kobj); + +- return snprintf(buf, PAGE_SIZE, "%u\n", fs_info->sectorsize); ++ return snprintf(buf, PAGE_SIZE, "%u\n", ++ fs_info->super_copy->sectorsize); + } + + BTRFS_ATTR(clone_alignment, btrfs_clone_alignment_show); +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index 46bda13e5727..f615d59b0489 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1722,23 +1722,19 @@ static void update_super_roots(struct btrfs_fs_info *fs_info) + + super = fs_info->super_copy; + +- /* update latest btrfs_super_block::chunk_root refs */ + root_item = &fs_info->chunk_root->root_item; +- btrfs_set_super_chunk_root(super, root_item->bytenr); +- btrfs_set_super_chunk_root_generation(super, root_item->generation); +- btrfs_set_super_chunk_root_level(super, root_item->level); ++ super->chunk_root = root_item->bytenr; ++ super->chunk_root_generation = root_item->generation; ++ super->chunk_root_level = root_item->level; + +- /* update latest btrfs_super_block::root refs */ + root_item = &fs_info->tree_root->root_item; +- btrfs_set_super_root(super, root_item->bytenr); +- btrfs_set_super_generation(super, root_item->generation); +- btrfs_set_super_root_level(super, root_item->level); +- ++ super->root = root_item->bytenr; ++ super->generation = root_item->generation; ++ super->root_level = root_item->level; + if (btrfs_test_opt(fs_info, SPACE_CACHE)) +- btrfs_set_super_cache_generation(super, root_item->generation); ++ super->cache_generation = root_item->generation; + if (test_bit(BTRFS_FS_UPDATE_UUID_TREE_GEN, &fs_info->flags)) +- btrfs_set_super_uuid_tree_generation(super, +- root_item->generation); ++ super->uuid_tree_generation = root_item->generation; + } + + int btrfs_transaction_in_commit(struct btrfs_fs_info *info) +diff --git a/fs/namei.c b/fs/namei.c +index 62a0db6e6725..cbe24e367a70 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -1133,9 +1133,6 @@ static int follow_automount(struct path *path, struct nameidata *nd, + path->dentry->d_inode) + return -EISDIR; + +- if (path->dentry->d_sb->s_user_ns != &init_user_ns) +- return -EACCES; +- + nd->total_link_count++; + if (nd->total_link_count >= 40) + return -ELOOP; +diff --git a/include/linux/dma-fence-array.h b/include/linux/dma-fence-array.h +index 332a5420243c..bc8940ca280d 100644 +--- a/include/linux/dma-fence-array.h ++++ b/include/linux/dma-fence-array.h +@@ -21,6 +21,7 @@ + #define __LINUX_DMA_FENCE_ARRAY_H + + #include ++#include + + /** + * struct dma_fence_array_cb - callback helper for fence array +@@ -47,6 +48,8 @@ struct dma_fence_array { + unsigned num_fences; + atomic_t num_pending; + struct dma_fence **fences; ++ ++ struct irq_work work; + }; + + extern const struct dma_fence_ops dma_fence_array_ops; +diff --git a/include/linux/phy.h b/include/linux/phy.h +index d78cd01ea513..600076e1ce84 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -817,6 +817,7 @@ void phy_device_remove(struct phy_device *phydev); + int phy_init_hw(struct phy_device *phydev); + int phy_suspend(struct phy_device *phydev); + int phy_resume(struct phy_device *phydev); ++int __phy_resume(struct phy_device *phydev); + int phy_loopback(struct phy_device *phydev, bool enable); + struct phy_device *phy_attach(struct net_device *dev, const char *bus_id, + phy_interface_t interface); +diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h +index 7cd553a3ce05..b6ce4c2eb40b 100644 +--- a/include/linux/usb/quirks.h ++++ b/include/linux/usb/quirks.h +@@ -57,4 +57,7 @@ + */ + #define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) + ++/* Device needs a pause after every control message. */ ++#define USB_QUIRK_DELAY_CTRL_MSG BIT(13) ++ + #endif /* __LINUX_USB_QUIRKS_H */ +diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c +index f24582d4dad3..6dca260eeccf 100644 +--- a/kernel/locking/locktorture.c ++++ b/kernel/locking/locktorture.c +@@ -715,8 +715,7 @@ static void __torture_print_stats(char *page, + { + bool fail = 0; + int i, n_stress; +- long max = 0; +- long min = statp[0].n_lock_acquired; ++ long max = 0, min = statp ? statp[0].n_lock_acquired : 0; + long long sum = 0; + + n_stress = write ? cxt.nrealwriters_stress : cxt.nrealreaders_stress; +@@ -823,7 +822,7 @@ static void lock_torture_cleanup(void) + * such, only perform the underlying torture-specific cleanups, + * and avoid anything related to locktorture. + */ +- if (!cxt.lwsa) ++ if (!cxt.lwsa && !cxt.lrsa) + goto end; + + if (writer_tasks) { +@@ -898,6 +897,13 @@ static int __init lock_torture_init(void) + firsterr = -EINVAL; + goto unwind; + } ++ ++ if (nwriters_stress == 0 && nreaders_stress == 0) { ++ pr_alert("lock-torture: must run at least one locking thread\n"); ++ firsterr = -EINVAL; ++ goto unwind; ++ } ++ + if (cxt.cur_ops->init) + cxt.cur_ops->init(); + +@@ -921,17 +927,19 @@ static int __init lock_torture_init(void) + #endif + + /* Initialize the statistics so that each run gets its own numbers. */ ++ if (nwriters_stress) { ++ lock_is_write_held = 0; ++ cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); ++ if (cxt.lwsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + +- lock_is_write_held = 0; +- cxt.lwsa = kmalloc(sizeof(*cxt.lwsa) * cxt.nrealwriters_stress, GFP_KERNEL); +- if (cxt.lwsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lwsa: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; +- } +- for (i = 0; i < cxt.nrealwriters_stress; i++) { +- cxt.lwsa[i].n_lock_fail = 0; +- cxt.lwsa[i].n_lock_acquired = 0; ++ for (i = 0; i < cxt.nrealwriters_stress; i++) { ++ cxt.lwsa[i].n_lock_fail = 0; ++ cxt.lwsa[i].n_lock_acquired = 0; ++ } + } + + if (cxt.cur_ops->readlock) { +@@ -948,19 +956,21 @@ static int __init lock_torture_init(void) + cxt.nrealreaders_stress = cxt.nrealwriters_stress; + } + +- lock_is_read_held = 0; +- cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); +- if (cxt.lrsa == NULL) { +- VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); +- firsterr = -ENOMEM; +- kfree(cxt.lwsa); +- cxt.lwsa = NULL; +- goto unwind; +- } +- +- for (i = 0; i < cxt.nrealreaders_stress; i++) { +- cxt.lrsa[i].n_lock_fail = 0; +- cxt.lrsa[i].n_lock_acquired = 0; ++ if (nreaders_stress) { ++ lock_is_read_held = 0; ++ cxt.lrsa = kmalloc(sizeof(*cxt.lrsa) * cxt.nrealreaders_stress, GFP_KERNEL); ++ if (cxt.lrsa == NULL) { ++ VERBOSE_TOROUT_STRING("cxt.lrsa: Out of memory"); ++ firsterr = -ENOMEM; ++ kfree(cxt.lwsa); ++ cxt.lwsa = NULL; ++ goto unwind; ++ } ++ ++ for (i = 0; i < cxt.nrealreaders_stress; i++) { ++ cxt.lrsa[i].n_lock_fail = 0; ++ cxt.lrsa[i].n_lock_acquired = 0; ++ } + } + } + +@@ -990,12 +1000,14 @@ static int __init lock_torture_init(void) + goto unwind; + } + +- writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), +- GFP_KERNEL); +- if (writer_tasks == NULL) { +- VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); +- firsterr = -ENOMEM; +- goto unwind; ++ if (nwriters_stress) { ++ writer_tasks = kzalloc(cxt.nrealwriters_stress * sizeof(writer_tasks[0]), ++ GFP_KERNEL); ++ if (writer_tasks == NULL) { ++ VERBOSE_TOROUT_ERRSTRING("writer_tasks: Out of memory"); ++ firsterr = -ENOMEM; ++ goto unwind; ++ } + } + + if (cxt.cur_ops->readlock) { +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 55062461b2fd..8cf36b30a006 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -506,7 +506,8 @@ void resched_cpu(int cpu) + unsigned long flags; + + raw_spin_lock_irqsave(&rq->lock, flags); +- resched_curr(rq); ++ if (cpu_online(cpu) || cpu == smp_processor_id()) ++ resched_curr(rq); + raw_spin_unlock_irqrestore(&rq->lock, flags); + } + +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 298f62b8662d..470a0c9e93de 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2218,7 +2218,7 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p) + if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) + queue_push_tasks(rq); + #endif /* CONFIG_SMP */ +- if (p->prio < rq->curr->prio) ++ if (p->prio < rq->curr->prio && cpu_online(cpu_of(rq))) + resched_curr(rq); + } + } +diff --git a/lib/usercopy.c b/lib/usercopy.c +index 15e2e6fb060e..3744b2a8e591 100644 +--- a/lib/usercopy.c ++++ b/lib/usercopy.c +@@ -20,7 +20,7 @@ EXPORT_SYMBOL(_copy_from_user); + #endif + + #ifndef INLINE_COPY_TO_USER +-unsigned long _copy_to_user(void *to, const void __user *from, unsigned long n) ++unsigned long _copy_to_user(void __user *to, const void *from, unsigned long n) + { + might_fault(); + if (likely(access_ok(VERIFY_WRITE, to, n))) { +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index f75029abf728..e4912858b72c 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1493,7 +1493,7 @@ static void ieee80211_setup_sdata(struct ieee80211_sub_if_data *sdata, + break; + case NL80211_IFTYPE_UNSPECIFIED: + case NUM_NL80211_IFTYPES: +- BUG(); ++ WARN_ON(1); + break; + } + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index bf8c81e07c70..79549baf5804 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -743,10 +743,6 @@ struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue, + root_lock = qdisc_lock(oqdisc); + spin_lock_bh(root_lock); + +- /* Prune old scheduler */ +- if (oqdisc && refcount_read(&oqdisc->refcnt) <= 1) +- qdisc_reset(oqdisc); +- + /* ... and graft new one */ + if (qdisc == NULL) + qdisc = &noop_qdisc; +@@ -897,6 +893,16 @@ static bool some_qdisc_is_busy(struct net_device *dev) + return false; + } + ++static void dev_qdisc_reset(struct net_device *dev, ++ struct netdev_queue *dev_queue, ++ void *none) ++{ ++ struct Qdisc *qdisc = dev_queue->qdisc_sleeping; ++ ++ if (qdisc) ++ qdisc_reset(qdisc); ++} ++ + /** + * dev_deactivate_many - deactivate transmissions on several devices + * @head: list of devices to deactivate +@@ -907,7 +913,6 @@ static bool some_qdisc_is_busy(struct net_device *dev) + void dev_deactivate_many(struct list_head *head) + { + struct net_device *dev; +- bool sync_needed = false; + + list_for_each_entry(dev, head, close_list) { + netdev_for_each_tx_queue(dev, dev_deactivate_queue, +@@ -917,20 +922,25 @@ void dev_deactivate_many(struct list_head *head) + &noop_qdisc); + + dev_watchdog_down(dev); +- sync_needed |= !dev->dismantle; + } + + /* Wait for outstanding qdisc-less dev_queue_xmit calls. + * This is avoided if all devices are in dismantle phase : + * Caller will call synchronize_net() for us + */ +- if (sync_needed) +- synchronize_net(); ++ synchronize_net(); + + /* Wait for outstanding qdisc_run calls. */ +- list_for_each_entry(dev, head, close_list) ++ list_for_each_entry(dev, head, close_list) { + while (some_qdisc_is_busy(dev)) + yield(); ++ /* The new qdisc is assigned at this point so we can safely ++ * unwind stale skb lists and qdisc statistics ++ */ ++ netdev_for_each_tx_queue(dev, dev_qdisc_reset, NULL); ++ if (dev_ingress_queue(dev)) ++ dev_qdisc_reset(dev, dev_ingress_queue(dev), NULL); ++ } + } + + void dev_deactivate(struct net_device *dev) +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 22f5da66357b..7d17c207fc8a 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1257,7 +1257,7 @@ EXPORT_SYMBOL(xfrm_policy_delete); + + int xfrm_sk_policy_insert(struct sock *sk, int dir, struct xfrm_policy *pol) + { +- struct net *net = xp_net(pol); ++ struct net *net = sock_net(sk); + struct xfrm_policy *old_pol; + + #ifdef CONFIG_XFRM_SUB_POLICY +diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c +index 8b23c5bcf8e8..02501817227b 100644 +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -666,7 +666,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff + if (unlikely(oseq < replay_esn->oseq)) { + XFRM_SKB_CB(skb)->seq.output.hi = ++oseq_hi; + xo->seq.hi = oseq_hi; +- ++ replay_esn->oseq_hi = oseq_hi; + if (replay_esn->oseq_hi == 0) { + replay_esn->oseq--; + replay_esn->oseq_hi--; +@@ -678,7 +678,6 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff + } + + replay_esn->oseq = oseq; +- replay_esn->oseq_hi = oseq_hi; + + if (xfrm_aevent_is_on(net)) + x->repl->notify(x, XFRM_REPLAY_UPDATE); +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 58be0e7f4c7d..bab20c626943 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2050,6 +2050,13 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++ if (!optval && !optlen) { ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); ++ xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); ++ __sk_dst_reset(sk); ++ return 0; ++ } ++ + if (optlen <= 0 || optlen > PAGE_SIZE) + return -EMSGSIZE; + +diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c +index 7d769b948de8..348db9b78681 100644 +--- a/security/integrity/ima/ima_appraise.c ++++ b/security/integrity/ima/ima_appraise.c +@@ -223,7 +223,8 @@ int ima_appraise_measurement(enum ima_hooks func, + if (opened & FILE_CREATED) + iint->flags |= IMA_NEW_FILE; + if ((iint->flags & IMA_NEW_FILE) && +- !(iint->flags & IMA_DIGSIG_REQUIRED)) ++ (!(iint->flags & IMA_DIGSIG_REQUIRED) || ++ (inode->i_size == 0))) + status = INTEGRITY_PASS; + goto out; + } +diff --git a/sound/soc/codecs/rt5651.c b/sound/soc/codecs/rt5651.c +index da60b28ba3df..57c2add323c4 100644 +--- a/sound/soc/codecs/rt5651.c ++++ b/sound/soc/codecs/rt5651.c +@@ -1694,6 +1694,7 @@ static const struct regmap_config rt5651_regmap = { + .num_reg_defaults = ARRAY_SIZE(rt5651_reg), + .ranges = rt5651_ranges, + .num_ranges = ARRAY_SIZE(rt5651_ranges), ++ .use_single_rw = true, + }; + + #if defined(CONFIG_OF) +diff --git a/sound/soc/codecs/sgtl5000.c b/sound/soc/codecs/sgtl5000.c +index f2bb4feba3b6..0b11a2e01b2f 100644 +--- a/sound/soc/codecs/sgtl5000.c ++++ b/sound/soc/codecs/sgtl5000.c +@@ -871,15 +871,26 @@ static int sgtl5000_pcm_hw_params(struct snd_pcm_substream *substream, + static int sgtl5000_set_bias_level(struct snd_soc_codec *codec, + enum snd_soc_bias_level level) + { ++ struct sgtl5000_priv *sgtl = snd_soc_codec_get_drvdata(codec); ++ int ret; ++ + switch (level) { + case SND_SOC_BIAS_ON: + case SND_SOC_BIAS_PREPARE: + case SND_SOC_BIAS_STANDBY: ++ regcache_cache_only(sgtl->regmap, false); ++ ret = regcache_sync(sgtl->regmap); ++ if (ret) { ++ regcache_cache_only(sgtl->regmap, true); ++ return ret; ++ } ++ + snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, + SGTL5000_REFTOP_POWERUP, + SGTL5000_REFTOP_POWERUP); + break; + case SND_SOC_BIAS_OFF: ++ regcache_cache_only(sgtl->regmap, true); + snd_soc_update_bits(codec, SGTL5000_CHIP_ANA_POWER, + SGTL5000_REFTOP_POWERUP, 0); + break; +diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c +index 66e32f5d2917..989d093abda7 100644 +--- a/sound/soc/codecs/wm_adsp.c ++++ b/sound/soc/codecs/wm_adsp.c +@@ -1204,12 +1204,14 @@ static int wmfw_add_ctl(struct wm_adsp *dsp, struct wm_coeff_ctl *ctl) + kcontrol->put = wm_coeff_put_acked; + break; + default: +- kcontrol->get = wm_coeff_get; +- kcontrol->put = wm_coeff_put; +- +- ctl->bytes_ext.max = ctl->len; +- ctl->bytes_ext.get = wm_coeff_tlv_get; +- ctl->bytes_ext.put = wm_coeff_tlv_put; ++ if (kcontrol->access & SNDRV_CTL_ELEM_ACCESS_TLV_CALLBACK) { ++ ctl->bytes_ext.max = ctl->len; ++ ctl->bytes_ext.get = wm_coeff_tlv_get; ++ ctl->bytes_ext.put = wm_coeff_tlv_put; ++ } else { ++ kcontrol->get = wm_coeff_get; ++ kcontrol->put = wm_coeff_put; ++ } + break; + } + +diff --git a/sound/soc/nuc900/nuc900-ac97.c b/sound/soc/nuc900/nuc900-ac97.c +index b6615affe571..fde974d52bb2 100644 +--- a/sound/soc/nuc900/nuc900-ac97.c ++++ b/sound/soc/nuc900/nuc900-ac97.c +@@ -67,7 +67,7 @@ static unsigned short nuc900_ac97_read(struct snd_ac97 *ac97, + + /* polling the AC_R_FINISH */ + while (!(AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_R_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) { +@@ -121,7 +121,7 @@ static void nuc900_ac97_write(struct snd_ac97 *ac97, unsigned short reg, + + /* polling the AC_W_FINISH */ + while ((AUDIO_READ(nuc900_audio->mmio + ACTL_ACCON) & AC_W_FINISH) +- && timeout--) ++ && --timeout) + mdelay(1); + + if (!timeout) +diff --git a/sound/soc/sunxi/sun4i-i2s.c b/sound/soc/sunxi/sun4i-i2s.c +index 04f92583a969..b4af5ce78ecb 100644 +--- a/sound/soc/sunxi/sun4i-i2s.c ++++ b/sound/soc/sunxi/sun4i-i2s.c +@@ -104,7 +104,7 @@ + + #define SUN8I_I2S_CHAN_CFG_REG 0x30 + #define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM_MASK GENMASK(6, 4) +-#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan) (chan - 1) ++#define SUN8I_I2S_CHAN_CFG_RX_SLOT_NUM(chan) ((chan - 1) << 4) + #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM_MASK GENMASK(2, 0) + #define SUN8I_I2S_CHAN_CFG_TX_SLOT_NUM(chan) (chan - 1) + +diff --git a/tools/perf/arch/s390/annotate/instructions.c b/tools/perf/arch/s390/annotate/instructions.c +index c9a81673e8aa..89f0b6c00e3f 100644 +--- a/tools/perf/arch/s390/annotate/instructions.c ++++ b/tools/perf/arch/s390/annotate/instructions.c +@@ -16,7 +16,8 @@ static struct ins_ops *s390__associate_ins_ops(struct arch *arch, const char *na + if (!strcmp(name, "br")) + ops = &ret_ops; + +- arch__associate_ins_ops(arch, name, ops); ++ if (ops) ++ arch__associate_ins_ops(arch, name, ops); + return ops; + } + +diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c +index 41d415707264..dac76ac117c1 100644 +--- a/tools/perf/util/annotate.c ++++ b/tools/perf/util/annotate.c +@@ -323,6 +323,8 @@ static int comment__symbol(char *raw, char *comment, u64 *addrp, char **namep) + return 0; + + *addrp = strtoull(comment, &endptr, 16); ++ if (endptr == comment) ++ return 0; + name = strchr(endptr, '<'); + if (name == NULL) + return -1; +@@ -436,8 +438,8 @@ static int mov__parse(struct arch *arch, struct ins_operands *ops, struct map *m + return 0; + + comment = ltrim(comment); +- comment__symbol(ops->source.raw, comment, &ops->source.addr, &ops->source.name); +- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name); ++ comment__symbol(ops->source.raw, comment + 1, &ops->source.addr, &ops->source.name); ++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name); + + return 0; + +@@ -481,7 +483,7 @@ static int dec__parse(struct arch *arch __maybe_unused, struct ins_operands *ops + return 0; + + comment = ltrim(comment); +- comment__symbol(ops->target.raw, comment, &ops->target.addr, &ops->target.name); ++ comment__symbol(ops->target.raw, comment + 1, &ops->target.addr, &ops->target.name); + + return 0; + } +diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh +index 62f2d6f54929..13ade39fe832 100755 +--- a/tools/testing/selftests/firmware/fw_filesystem.sh ++++ b/tools/testing/selftests/firmware/fw_filesystem.sh +@@ -45,7 +45,10 @@ test_finish() + if [ "$HAS_FW_LOADER_USER_HELPER" = "yes" ]; then + echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout + fi +- echo -n "$OLD_PATH" >/sys/module/firmware_class/parameters/path ++ if [ "$OLD_FWPATH" = "" ]; then ++ OLD_FWPATH=" " ++ fi ++ echo -n "$OLD_FWPATH" >/sys/module/firmware_class/parameters/path + rm -f "$FW" + rmdir "$FWPATH" + } +diff --git a/tools/testing/selftests/rcutorture/bin/configinit.sh b/tools/testing/selftests/rcutorture/bin/configinit.sh +index 3f81a1095206..50a6371b2b2e 100755 +--- a/tools/testing/selftests/rcutorture/bin/configinit.sh ++++ b/tools/testing/selftests/rcutorture/bin/configinit.sh +@@ -51,7 +51,7 @@ then + mkdir $builddir + fi + else +- echo Bad build directory: \"$builddir\" ++ echo Bad build directory: \"$buildloc\" + exit 2 + fi + fi +diff --git a/tools/usb/usbip/src/usbipd.c b/tools/usb/usbip/src/usbipd.c +index 009afb4a3aae..c6dad2a13c80 100644 +--- a/tools/usb/usbip/src/usbipd.c ++++ b/tools/usb/usbip/src/usbipd.c +@@ -456,7 +456,7 @@ static void set_signal(void) + sigaction(SIGTERM, &act, NULL); + sigaction(SIGINT, &act, NULL); + act.sa_handler = SIG_IGN; +- sigaction(SIGCLD, &act, NULL); ++ sigaction(SIGCHLD, &act, NULL); + } + + static const char *pid_file; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.28-29.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.28-29.patch new file mode 100644 index 000000000000..8122364e463c --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.28-29.patch @@ -0,0 +1,1579 @@ +diff --git a/Makefile b/Makefile +index 9ae370a47ff9..4b2aa0dd4043 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 28 ++SUBLEVEL = 29 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c +index 79089778725b..e3b45546d589 100644 +--- a/arch/parisc/kernel/cache.c ++++ b/arch/parisc/kernel/cache.c +@@ -543,7 +543,8 @@ void flush_cache_mm(struct mm_struct *mm) + rp3440, etc. So, avoid it if the mm isn't too big. */ + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && + mm_total_size(mm) >= parisc_cache_flush_threshold) { +- flush_tlb_all(); ++ if (mm->context) ++ flush_tlb_all(); + flush_cache_all(); + return; + } +@@ -571,6 +572,8 @@ void flush_cache_mm(struct mm_struct *mm) + pfn = pte_pfn(*ptep); + if (!pfn_valid(pfn)) + continue; ++ if (unlikely(mm->context)) ++ flush_tlb_page(vma, addr); + __flush_cache_page(vma, addr, PFN_PHYS(pfn)); + } + } +@@ -579,26 +582,46 @@ void flush_cache_mm(struct mm_struct *mm) + void flush_cache_range(struct vm_area_struct *vma, + unsigned long start, unsigned long end) + { ++ pgd_t *pgd; ++ unsigned long addr; ++ + if ((!IS_ENABLED(CONFIG_SMP) || !arch_irqs_disabled()) && + end - start >= parisc_cache_flush_threshold) { +- flush_tlb_range(vma, start, end); ++ if (vma->vm_mm->context) ++ flush_tlb_range(vma, start, end); + flush_cache_all(); + return; + } + +- flush_user_dcache_range_asm(start, end); +- if (vma->vm_flags & VM_EXEC) +- flush_user_icache_range_asm(start, end); +- flush_tlb_range(vma, start, end); ++ if (vma->vm_mm->context == mfsp(3)) { ++ flush_user_dcache_range_asm(start, end); ++ if (vma->vm_flags & VM_EXEC) ++ flush_user_icache_range_asm(start, end); ++ flush_tlb_range(vma, start, end); ++ return; ++ } ++ ++ pgd = vma->vm_mm->pgd; ++ for (addr = vma->vm_start; addr < vma->vm_end; addr += PAGE_SIZE) { ++ unsigned long pfn; ++ pte_t *ptep = get_ptep(pgd, addr); ++ if (!ptep) ++ continue; ++ pfn = pte_pfn(*ptep); ++ if (pfn_valid(pfn)) { ++ if (unlikely(vma->vm_mm->context)) ++ flush_tlb_page(vma, addr); ++ __flush_cache_page(vma, addr, PFN_PHYS(pfn)); ++ } ++ } + } + + void + flush_cache_page(struct vm_area_struct *vma, unsigned long vmaddr, unsigned long pfn) + { +- BUG_ON(!vma->vm_mm->context); +- + if (pfn_valid(pfn)) { +- flush_tlb_page(vma, vmaddr); ++ if (likely(vma->vm_mm->context)) ++ flush_tlb_page(vma, vmaddr); + __flush_cache_page(vma, vmaddr, PFN_PHYS(pfn)); + } + } +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 66c14347c502..23a65439c37c 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -314,6 +314,7 @@ + #define X86_FEATURE_VPCLMULQDQ (16*32+10) /* Carry-Less Multiplication Double Quadword */ + #define X86_FEATURE_AVX512_VNNI (16*32+11) /* Vector Neural Network Instructions */ + #define X86_FEATURE_AVX512_BITALG (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */ ++#define X86_FEATURE_TME (16*32+13) /* Intel Total Memory Encryption */ + #define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */ + #define X86_FEATURE_LA57 (16*32+16) /* 5-level page tables */ + #define X86_FEATURE_RDPID (16*32+22) /* RDPID instruction */ +@@ -326,6 +327,7 @@ + /* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ + #define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ + #define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ ++#define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ + #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ + #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ + #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index d0dabeae0505..f928ad9b143f 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -183,7 +183,10 @@ + * otherwise we'll run out of registers. We don't care about CET + * here, anyway. + */ +-# define CALL_NOSPEC ALTERNATIVE("call *%[thunk_target]\n", \ ++# define CALL_NOSPEC \ ++ ALTERNATIVE( \ ++ ANNOTATE_RETPOLINE_SAFE \ ++ "call *%[thunk_target]\n", \ + " jmp 904f;\n" \ + " .align 16\n" \ + "901: call 903f;\n" \ +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 4aa9fd379390..c3af167d0a70 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -105,7 +105,7 @@ static void probe_xeon_phi_r3mwait(struct cpuinfo_x86 *c) + /* + * Early microcode releases for the Spectre v2 mitigation were broken. + * Information taken from; +- * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/01/microcode-update-guidance.pdf ++ * - https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf + * - https://kb.vmware.com/s/article/52345 + * - Microcode revisions observed in the wild + * - Release note from 20180108 microcode release +@@ -123,7 +123,6 @@ static const struct sku_microcode spectre_bad_microcodes[] = { + { INTEL_FAM6_KABYLAKE_MOBILE, 0x09, 0x80 }, + { INTEL_FAM6_SKYLAKE_X, 0x03, 0x0100013e }, + { INTEL_FAM6_SKYLAKE_X, 0x04, 0x0200003c }, +- { INTEL_FAM6_SKYLAKE_DESKTOP, 0x03, 0xc2 }, + { INTEL_FAM6_BROADWELL_CORE, 0x04, 0x28 }, + { INTEL_FAM6_BROADWELL_GT3E, 0x01, 0x1b }, + { INTEL_FAM6_BROADWELL_XEON_D, 0x02, 0x14 }, +diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c +index 5edb27f1a2c4..9d0b5af7db91 100644 +--- a/arch/x86/kernel/vm86_32.c ++++ b/arch/x86/kernel/vm86_32.c +@@ -727,7 +727,8 @@ void handle_vm86_fault(struct kernel_vm86_regs *regs, long error_code) + return; + + check_vip: +- if (VEFLAGS & X86_EFLAGS_VIP) { ++ if ((VEFLAGS & (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) == ++ (X86_EFLAGS_VIP | X86_EFLAGS_VIF)) { + save_v86_state(regs, VM86_STI); + return; + } +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 2b6f8a4f2731..f438e0c4aa8c 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -2758,8 +2758,10 @@ static int set_spte(struct kvm_vcpu *vcpu, u64 *sptep, + else + pte_access &= ~ACC_WRITE_MASK; + ++ if (!kvm_is_mmio_pfn(pfn)) ++ spte |= shadow_me_mask; ++ + spte |= (u64)pfn << PAGE_SHIFT; +- spte |= shadow_me_mask; + + if (pte_access & ACC_WRITE_MASK) { + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 4c155ee0f89e..0133d26f16be 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -330,7 +330,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (!pmd_k) + return -1; + +- if (pmd_huge(*pmd_k)) ++ if (pmd_large(*pmd_k)) + return 0; + + pte_k = pte_offset_kernel(pmd_k, address); +@@ -479,7 +479,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pud_none(*pud) || pud_pfn(*pud) != pud_pfn(*pud_ref)) + BUG(); + +- if (pud_huge(*pud)) ++ if (pud_large(*pud)) + return 0; + + pmd = pmd_offset(pud, address); +@@ -490,7 +490,7 @@ static noinline int vmalloc_fault(unsigned long address) + if (pmd_none(*pmd) || pmd_pfn(*pmd) != pmd_pfn(*pmd_ref)) + BUG(); + +- if (pmd_huge(*pmd)) ++ if (pmd_large(*pmd)) + return 0; + + pte_ref = pte_offset_kernel(pmd_ref, address); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +index 848242821ef3..1eff36a87595 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_connectors.c +@@ -69,25 +69,18 @@ void amdgpu_connector_hotplug(struct drm_connector *connector) + /* don't do anything if sink is not display port, i.e., + * passive dp->(dvi|hdmi) adaptor + */ +- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { +- int saved_dpms = connector->dpms; +- /* Only turn off the display if it's physically disconnected */ +- if (!amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd)) { +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- } else if (amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { +- /* Don't try to start link training before we +- * have the dpcd */ +- if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) +- return; +- +- /* set it to OFF so that drm_helper_connector_dpms() +- * won't return immediately since the current state +- * is ON at this point. +- */ +- connector->dpms = DRM_MODE_DPMS_OFF; +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- } +- connector->dpms = saved_dpms; ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && ++ amdgpu_display_hpd_sense(adev, amdgpu_connector->hpd.hpd) && ++ amdgpu_atombios_dp_needs_link_train(amdgpu_connector)) { ++ /* Don't start link training before we have the DPCD */ ++ if (amdgpu_atombios_dp_get_dpcd(amdgpu_connector)) ++ return; ++ ++ /* Turn the connector off and back on immediately, which ++ * will trigger link training ++ */ ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + } + } + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +index 7171968f261e..837332e84d78 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_gem.c +@@ -36,8 +36,6 @@ void amdgpu_gem_object_free(struct drm_gem_object *gobj) + struct amdgpu_bo *robj = gem_to_amdgpu_bo(gobj); + + if (robj) { +- if (robj->gem_base.import_attach) +- drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg); + amdgpu_mn_unregister(robj); + amdgpu_bo_unref(&robj); + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index ffe483980362..4d08957d2108 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -46,6 +46,8 @@ static void amdgpu_ttm_bo_destroy(struct ttm_buffer_object *tbo) + + amdgpu_bo_kunmap(bo); + ++ if (bo->gem_base.import_attach) ++ drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg); + drm_gem_object_release(&bo->gem_base); + amdgpu_bo_unref(&bo->parent); + if (!list_empty(&bo->shadow_list)) { +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index 380f340204e8..f56f60f695e1 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -268,13 +268,13 @@ nouveau_backlight_init(struct drm_device *dev) + struct nvif_device *device = &drm->client.device; + struct drm_connector *connector; + ++ INIT_LIST_HEAD(&drm->bl_connectors); ++ + if (apple_gmux_present()) { + NV_INFO(drm, "Apple GMUX detected: not registering Nouveau backlight interface\n"); + return 0; + } + +- INIT_LIST_HEAD(&drm->bl_connectors); +- + list_for_each_entry(connector, &dev->mode_config.connector_list, head) { + if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && + connector->connector_type != DRM_MODE_CONNECTOR_eDP) +diff --git a/drivers/gpu/drm/radeon/radeon_gem.c b/drivers/gpu/drm/radeon/radeon_gem.c +index 3386452bd2f0..ac467b80edc7 100644 +--- a/drivers/gpu/drm/radeon/radeon_gem.c ++++ b/drivers/gpu/drm/radeon/radeon_gem.c +@@ -34,8 +34,6 @@ void radeon_gem_object_free(struct drm_gem_object *gobj) + struct radeon_bo *robj = gem_to_radeon_bo(gobj); + + if (robj) { +- if (robj->gem_base.import_attach) +- drm_prime_gem_destroy(&robj->gem_base, robj->tbo.sg); + radeon_mn_unregister(robj); + radeon_bo_unref(&robj); + } +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index 093594976126..baadb706c276 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -82,6 +82,8 @@ static void radeon_ttm_bo_destroy(struct ttm_buffer_object *tbo) + mutex_unlock(&bo->rdev->gem.mutex); + radeon_bo_clear_surface_reg(bo); + WARN_ON_ONCE(!list_empty(&bo->va)); ++ if (bo->gem_base.import_attach) ++ drm_prime_gem_destroy(&bo->gem_base, bo->tbo.sg); + drm_gem_object_release(&bo->gem_base); + kfree(bo); + } +diff --git a/drivers/infiniband/sw/rdmavt/mr.c b/drivers/infiniband/sw/rdmavt/mr.c +index 42713511b53b..524e6134642e 100644 +--- a/drivers/infiniband/sw/rdmavt/mr.c ++++ b/drivers/infiniband/sw/rdmavt/mr.c +@@ -489,11 +489,13 @@ static int rvt_check_refs(struct rvt_mregion *mr, const char *t) + unsigned long timeout; + struct rvt_dev_info *rdi = ib_to_rvt(mr->pd->device); + +- if (percpu_ref_is_zero(&mr->refcount)) +- return 0; +- /* avoid dma mr */ +- if (mr->lkey) ++ if (mr->lkey) { ++ /* avoid dma mr */ + rvt_dereg_clean_qps(mr); ++ /* @mr was indexed on rcu protected @lkey_table */ ++ synchronize_rcu(); ++ } ++ + timeout = wait_for_completion_timeout(&mr->comp, 5 * HZ); + if (!timeout) { + rvt_pr_err(rdi, +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index e88395605e32..af57f8473a88 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -1310,7 +1310,7 @@ static struct irq_chip its_irq_chip = { + * This gives us (((1UL << id_bits) - 8192) >> 5) possible allocations. + */ + #define IRQS_PER_CHUNK_SHIFT 5 +-#define IRQS_PER_CHUNK (1 << IRQS_PER_CHUNK_SHIFT) ++#define IRQS_PER_CHUNK (1UL << IRQS_PER_CHUNK_SHIFT) + #define ITS_MAX_LPI_NRBITS 16 /* 64K LPIs */ + + static unsigned long *lpi_bitmap; +@@ -2026,11 +2026,10 @@ static struct its_device *its_create_device(struct its_node *its, u32 dev_id, + + dev = kzalloc(sizeof(*dev), GFP_KERNEL); + /* +- * At least one bit of EventID is being used, hence a minimum +- * of two entries. No, the architecture doesn't let you +- * express an ITT with a single entry. ++ * We allocate at least one chunk worth of LPIs bet device, ++ * and thus that many ITEs. The device may require less though. + */ +- nr_ites = max(2UL, roundup_pow_of_two(nvecs)); ++ nr_ites = max(IRQS_PER_CHUNK, roundup_pow_of_two(nvecs)); + sz = nr_ites * its->ite_size; + sz = max(sz, ITS_ITT_ALIGN) + ITS_ITT_ALIGN - 1; + itt = kzalloc(sz, GFP_KERNEL); +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 9603886737b5..2300c02ab5e6 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -102,11 +102,16 @@ qla2x00_async_iocb_timeout(void *data) + struct srb_iocb *lio = &sp->u.iocb_cmd; + struct event_arg ea; + +- ql_dbg(ql_dbg_disc, fcport->vha, 0x2071, +- "Async-%s timeout - hdl=%x portid=%06x %8phC.\n", +- sp->name, sp->handle, fcport->d_id.b24, fcport->port_name); ++ if (fcport) { ++ ql_dbg(ql_dbg_disc, fcport->vha, 0x2071, ++ "Async-%s timeout - hdl=%x portid=%06x %8phC.\n", ++ sp->name, sp->handle, fcport->d_id.b24, fcport->port_name); + +- fcport->flags &= ~FCF_ASYNC_SENT; ++ fcport->flags &= ~FCF_ASYNC_SENT; ++ } else { ++ pr_info("Async-%s timeout - hdl=%x.\n", ++ sp->name, sp->handle); ++ } + + switch (sp->type) { + case SRB_LOGIN_CMD: +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index 78df7cfca568..d77dde89118e 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -582,8 +582,9 @@ qla25xx_delete_req_que(struct scsi_qla_host *vha, struct req_que *req) + ret = qla25xx_init_req_que(vha, req); + if (ret != QLA_SUCCESS) + return QLA_FUNCTION_FAILED; ++ ++ qla25xx_free_req_que(vha, req); + } +- qla25xx_free_req_que(vha, req); + + return ret; + } +@@ -598,8 +599,9 @@ qla25xx_delete_rsp_que(struct scsi_qla_host *vha, struct rsp_que *rsp) + ret = qla25xx_init_rsp_que(vha, rsp); + if (ret != QLA_SUCCESS) + return QLA_FUNCTION_FAILED; ++ ++ qla25xx_free_rsp_que(vha, rsp); + } +- qla25xx_free_rsp_que(vha, rsp); + + return ret; + } +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index cfe7654f6bd3..1e17175692d3 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -442,7 +442,7 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req, + ha->req_q_map[0] = req; + set_bit(0, ha->rsp_qid_map); + set_bit(0, ha->req_qid_map); +- return 1; ++ return 0; + + fail_qpair_map: + kfree(ha->base_qpair); +@@ -459,6 +459,9 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req, + + static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + { ++ if (!ha->req_q_map) ++ return; ++ + if (IS_QLAFX00(ha)) { + if (req && req->ring_fx00) + dma_free_coherent(&ha->pdev->dev, +@@ -469,14 +472,17 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + (req->length + 1) * sizeof(request_t), + req->ring, req->dma); + +- if (req) ++ if (req) { + kfree(req->outstanding_cmds); +- +- kfree(req); ++ kfree(req); ++ } + } + + static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + { ++ if (!ha->rsp_q_map) ++ return; ++ + if (IS_QLAFX00(ha)) { + if (rsp && rsp->ring) + dma_free_coherent(&ha->pdev->dev, +@@ -487,7 +493,8 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + (rsp->length + 1) * sizeof(response_t), + rsp->ring, rsp->dma); + } +- kfree(rsp); ++ if (rsp) ++ kfree(rsp); + } + + static void qla2x00_free_queues(struct qla_hw_data *ha) +@@ -1710,6 +1717,8 @@ qla2x00_abort_all_cmds(scsi_qla_host_t *vha, int res) + struct qla_tgt_cmd *cmd; + uint8_t trace = 0; + ++ if (!ha->req_q_map) ++ return; + spin_lock_irqsave(&ha->hardware_lock, flags); + for (que = 0; que < ha->max_req_queues; que++) { + req = ha->req_q_map[que]; +@@ -3063,14 +3072,14 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + /* Set up the irqs */ + ret = qla2x00_request_irqs(ha, rsp); + if (ret) +- goto probe_hw_failed; ++ goto probe_failed; + + /* Alloc arrays of request and response ring ptrs */ +- if (!qla2x00_alloc_queues(ha, req, rsp)) { ++ if (qla2x00_alloc_queues(ha, req, rsp)) { + ql_log(ql_log_fatal, base_vha, 0x003d, + "Failed to allocate memory for queue pointers..." + "aborting.\n"); +- goto probe_init_failed; ++ goto probe_failed; + } + + if (ha->mqenable && shost_use_blk_mq(host)) { +@@ -3347,15 +3356,6 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + + return 0; + +-probe_init_failed: +- qla2x00_free_req_que(ha, req); +- ha->req_q_map[0] = NULL; +- clear_bit(0, ha->req_qid_map); +- qla2x00_free_rsp_que(ha, rsp); +- ha->rsp_q_map[0] = NULL; +- clear_bit(0, ha->rsp_qid_map); +- ha->max_req_queues = ha->max_rsp_queues = 0; +- + probe_failed: + if (base_vha->timer_active) + qla2x00_stop_timer(base_vha); +@@ -4435,11 +4435,17 @@ qla2x00_mem_free(struct qla_hw_data *ha) + if (ha->init_cb) + dma_free_coherent(&ha->pdev->dev, ha->init_cb_size, + ha->init_cb, ha->init_cb_dma); +- vfree(ha->optrom_buffer); +- kfree(ha->nvram); +- kfree(ha->npiv_info); +- kfree(ha->swl); +- kfree(ha->loop_id_map); ++ ++ if (ha->optrom_buffer) ++ vfree(ha->optrom_buffer); ++ if (ha->nvram) ++ kfree(ha->nvram); ++ if (ha->npiv_info) ++ kfree(ha->npiv_info); ++ if (ha->swl) ++ kfree(ha->swl); ++ if (ha->loop_id_map) ++ kfree(ha->loop_id_map); + + ha->srb_mempool = NULL; + ha->ctx_mempool = NULL; +@@ -4455,6 +4461,15 @@ qla2x00_mem_free(struct qla_hw_data *ha) + ha->ex_init_cb_dma = 0; + ha->async_pd = NULL; + ha->async_pd_dma = 0; ++ ha->loop_id_map = NULL; ++ ha->npiv_info = NULL; ++ ha->optrom_buffer = NULL; ++ ha->swl = NULL; ++ ha->nvram = NULL; ++ ha->mctp_dump = NULL; ++ ha->dcbx_tlv = NULL; ++ ha->xgmac_data = NULL; ++ ha->sfp_data = NULL; + + ha->s_dma_pool = NULL; + ha->dl_dma_pool = NULL; +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index 040a76011ffa..d6fe08de59a0 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -971,6 +971,7 @@ static void qlt_free_session_done(struct work_struct *work) + + logo.id = sess->d_id; + logo.cmd_count = 0; ++ sess->send_els_logo = 0; + qlt_send_first_logo(vha, &logo); + } + +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index ea910acb4bb0..fc28819253f7 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -166,13 +166,15 @@ + #define DWC3_GDBGFIFOSPACE_TYPE(n) (((n) << 5) & 0x1e0) + #define DWC3_GDBGFIFOSPACE_SPACE_AVAILABLE(n) (((n) >> 16) & 0xffff) + +-#define DWC3_TXFIFOQ 1 +-#define DWC3_RXFIFOQ 3 +-#define DWC3_TXREQQ 5 +-#define DWC3_RXREQQ 7 +-#define DWC3_RXINFOQ 9 +-#define DWC3_DESCFETCHQ 13 +-#define DWC3_EVENTQ 15 ++#define DWC3_TXFIFOQ 0 ++#define DWC3_RXFIFOQ 1 ++#define DWC3_TXREQQ 2 ++#define DWC3_RXREQQ 3 ++#define DWC3_RXINFOQ 4 ++#define DWC3_PSTATQ 5 ++#define DWC3_DESCFETCHQ 6 ++#define DWC3_EVENTQ 7 ++#define DWC3_AUXEVENTQ 8 + + /* Global RX Threshold Configuration Register */ + #define DWC3_GRXTHRCFG_MAXRXBURSTSIZE(n) (((n) & 0x1f) << 19) +diff --git a/drivers/usb/gadget/udc/bdc/bdc_pci.c b/drivers/usb/gadget/udc/bdc/bdc_pci.c +index 02968842b359..708e36f530d8 100644 +--- a/drivers/usb/gadget/udc/bdc/bdc_pci.c ++++ b/drivers/usb/gadget/udc/bdc/bdc_pci.c +@@ -82,6 +82,7 @@ static int bdc_pci_probe(struct pci_dev *pci, const struct pci_device_id *id) + if (ret) { + dev_err(&pci->dev, + "couldn't add resources to bdc device\n"); ++ platform_device_put(bdc); + return ret; + } + +diff --git a/fs/aio.c b/fs/aio.c +index 5a2487217072..c3ace7833a03 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -68,9 +68,9 @@ struct aio_ring { + #define AIO_RING_PAGES 8 + + struct kioctx_table { +- struct rcu_head rcu; +- unsigned nr; +- struct kioctx *table[]; ++ struct rcu_head rcu; ++ unsigned nr; ++ struct kioctx __rcu *table[]; + }; + + struct kioctx_cpu { +@@ -115,7 +115,8 @@ struct kioctx { + struct page **ring_pages; + long nr_pages; + +- struct work_struct free_work; ++ struct rcu_head free_rcu; ++ struct work_struct free_work; /* see free_ioctx() */ + + /* + * signals when all in-flight requests are done +@@ -329,7 +330,7 @@ static int aio_ring_mremap(struct vm_area_struct *vma) + for (i = 0; i < table->nr; i++) { + struct kioctx *ctx; + +- ctx = table->table[i]; ++ ctx = rcu_dereference(table->table[i]); + if (ctx && ctx->aio_ring_file == file) { + if (!atomic_read(&ctx->dead)) { + ctx->user_id = ctx->mmap_base = vma->vm_start; +@@ -588,6 +589,12 @@ static int kiocb_cancel(struct aio_kiocb *kiocb) + return cancel(&kiocb->common); + } + ++/* ++ * free_ioctx() should be RCU delayed to synchronize against the RCU ++ * protected lookup_ioctx() and also needs process context to call ++ * aio_free_ring(), so the double bouncing through kioctx->free_rcu and ++ * ->free_work. ++ */ + static void free_ioctx(struct work_struct *work) + { + struct kioctx *ctx = container_of(work, struct kioctx, free_work); +@@ -601,6 +608,14 @@ static void free_ioctx(struct work_struct *work) + kmem_cache_free(kioctx_cachep, ctx); + } + ++static void free_ioctx_rcufn(struct rcu_head *head) ++{ ++ struct kioctx *ctx = container_of(head, struct kioctx, free_rcu); ++ ++ INIT_WORK(&ctx->free_work, free_ioctx); ++ schedule_work(&ctx->free_work); ++} ++ + static void free_ioctx_reqs(struct percpu_ref *ref) + { + struct kioctx *ctx = container_of(ref, struct kioctx, reqs); +@@ -609,8 +624,8 @@ static void free_ioctx_reqs(struct percpu_ref *ref) + if (ctx->rq_wait && atomic_dec_and_test(&ctx->rq_wait->count)) + complete(&ctx->rq_wait->comp); + +- INIT_WORK(&ctx->free_work, free_ioctx); +- schedule_work(&ctx->free_work); ++ /* Synchronize against RCU protected table->table[] dereferences */ ++ call_rcu(&ctx->free_rcu, free_ioctx_rcufn); + } + + /* +@@ -651,9 +666,9 @@ static int ioctx_add_table(struct kioctx *ctx, struct mm_struct *mm) + while (1) { + if (table) + for (i = 0; i < table->nr; i++) +- if (!table->table[i]) { ++ if (!rcu_access_pointer(table->table[i])) { + ctx->id = i; +- table->table[i] = ctx; ++ rcu_assign_pointer(table->table[i], ctx); + spin_unlock(&mm->ioctx_lock); + + /* While kioctx setup is in progress, +@@ -834,11 +849,11 @@ static int kill_ioctx(struct mm_struct *mm, struct kioctx *ctx, + } + + table = rcu_dereference_raw(mm->ioctx_table); +- WARN_ON(ctx != table->table[ctx->id]); +- table->table[ctx->id] = NULL; ++ WARN_ON(ctx != rcu_access_pointer(table->table[ctx->id])); ++ RCU_INIT_POINTER(table->table[ctx->id], NULL); + spin_unlock(&mm->ioctx_lock); + +- /* percpu_ref_kill() will do the necessary call_rcu() */ ++ /* free_ioctx_reqs() will do the necessary RCU synchronization */ + wake_up_all(&ctx->wait); + + /* +@@ -880,7 +895,8 @@ void exit_aio(struct mm_struct *mm) + + skipped = 0; + for (i = 0; i < table->nr; ++i) { +- struct kioctx *ctx = table->table[i]; ++ struct kioctx *ctx = ++ rcu_dereference_protected(table->table[i], true); + + if (!ctx) { + skipped++; +@@ -1069,7 +1085,7 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) + if (!table || id >= table->nr) + goto out; + +- ctx = table->table[id]; ++ ctx = rcu_dereference(table->table[id]); + if (ctx && ctx->user_id == ctx_id) { + percpu_ref_get(&ctx->users); + ret = ctx; +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index b517ef1477ea..0531cb9a3ba9 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -1252,7 +1252,16 @@ static int find_parent_nodes(struct btrfs_trans_handle *trans, + while (node) { + ref = rb_entry(node, struct prelim_ref, rbnode); + node = rb_next(&ref->rbnode); +- WARN_ON(ref->count < 0); ++ /* ++ * ref->count < 0 can happen here if there are delayed ++ * refs with a node->action of BTRFS_DROP_DELAYED_REF. ++ * prelim_ref_insert() relies on this when merging ++ * identical refs to keep the overall count correct. ++ * prelim_ref_insert() will merge only those refs ++ * which compare identically. Any refs having ++ * e.g. different offsets would not be merged, ++ * and would retain their original ref->count < 0. ++ */ + if (roots && ref->count && ref->root_id && ref->parent == 0) { + if (sc && sc->root_objectid && + ref->root_id != sc->root_objectid) { +@@ -1496,6 +1505,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr) + if (!node) + break; + bytenr = node->val; ++ shared.share_count = 0; + cond_resched(); + } + +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 6154825c30e1..32b186c5694c 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -1348,6 +1348,7 @@ static int find_bio_stripe(struct btrfs_raid_bio *rbio, + stripe_start = stripe->physical; + if (physical >= stripe_start && + physical < stripe_start + rbio->stripe_len && ++ stripe->dev->bdev && + bio->bi_disk == stripe->dev->bdev->bd_disk && + bio->bi_partno == stripe->dev->bdev->bd_partno) { + return i; +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index bc534fafacf9..71b3cd634436 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -589,6 +589,7 @@ void btrfs_free_stale_device(struct btrfs_device *cur_dev) + btrfs_sysfs_remove_fsid(fs_devs); + list_del(&fs_devs->list); + free_fs_devices(fs_devs); ++ break; + } else { + fs_devs->num_devices--; + list_del(&dev->dev_list); +@@ -4733,10 +4734,13 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + ndevs = min(ndevs, devs_max); + + /* +- * the primary goal is to maximize the number of stripes, so use as many +- * devices as possible, even if the stripes are not maximum sized. ++ * The primary goal is to maximize the number of stripes, so use as ++ * many devices as possible, even if the stripes are not maximum sized. ++ * ++ * The DUP profile stores more than one stripe per device, the ++ * max_avail is the total size so we have to adjust. + */ +- stripe_size = devices_info[ndevs-1].max_avail; ++ stripe_size = div_u64(devices_info[ndevs - 1].max_avail, dev_stripes); + num_stripes = ndevs * dev_stripes; + + /* +@@ -4771,8 +4775,6 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans, + stripe_size = devices_info[ndevs-1].max_avail; + } + +- stripe_size = div_u64(stripe_size, dev_stripes); +- + /* align to BTRFS_STRIPE_LEN */ + stripe_size = round_down(stripe_size, BTRFS_STRIPE_LEN); + +@@ -7080,10 +7082,24 @@ int btrfs_run_dev_stats(struct btrfs_trans_handle *trans, + + mutex_lock(&fs_devices->device_list_mutex); + list_for_each_entry(device, &fs_devices->devices, dev_list) { +- if (!device->dev_stats_valid || !btrfs_dev_stats_dirty(device)) ++ stats_cnt = atomic_read(&device->dev_stats_ccnt); ++ if (!device->dev_stats_valid || stats_cnt == 0) + continue; + +- stats_cnt = atomic_read(&device->dev_stats_ccnt); ++ ++ /* ++ * There is a LOAD-LOAD control dependency between the value of ++ * dev_stats_ccnt and updating the on-disk values which requires ++ * reading the in-memory counters. Such control dependencies ++ * require explicit read memory barriers. ++ * ++ * This memory barriers pairs with smp_mb__before_atomic in ++ * btrfs_dev_stat_inc/btrfs_dev_stat_set and with the full ++ * barrier implied by atomic_xchg in ++ * btrfs_dev_stats_read_and_reset ++ */ ++ smp_rmb(); ++ + ret = update_dev_stat_item(trans, fs_info, device); + if (!ret) + atomic_sub(stats_cnt, &device->dev_stats_ccnt); +diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h +index 6108fdfec67f..c5dd48eb7b3d 100644 +--- a/fs/btrfs/volumes.h ++++ b/fs/btrfs/volumes.h +@@ -498,6 +498,12 @@ static inline void btrfs_dev_stat_inc(struct btrfs_device *dev, + int index) + { + atomic_inc(dev->dev_stat_values + index); ++ /* ++ * This memory barrier orders stores updating statistics before stores ++ * updating dev_stats_ccnt. ++ * ++ * It pairs with smp_rmb() in btrfs_run_dev_stats(). ++ */ + smp_mb__before_atomic(); + atomic_inc(&dev->dev_stats_ccnt); + } +@@ -523,6 +529,12 @@ static inline void btrfs_dev_stat_set(struct btrfs_device *dev, + int index, unsigned long val) + { + atomic_set(dev->dev_stat_values + index, val); ++ /* ++ * This memory barrier orders stores updating statistics before stores ++ * updating dev_stats_ccnt. ++ * ++ * It pairs with smp_rmb() in btrfs_run_dev_stats(). ++ */ + smp_mb__before_atomic(); + atomic_inc(&dev->dev_stats_ccnt); + } +diff --git a/fs/dcache.c b/fs/dcache.c +index b8d999a5768b..a1417787e269 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -644,11 +644,16 @@ static inline struct dentry *lock_parent(struct dentry *dentry) + spin_unlock(&parent->d_lock); + goto again; + } +- rcu_read_unlock(); +- if (parent != dentry) ++ if (parent != dentry) { + spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED); +- else ++ if (unlikely(dentry->d_lockref.count < 0)) { ++ spin_unlock(&parent->d_lock); ++ parent = NULL; ++ } ++ } else { + parent = NULL; ++ } ++ rcu_read_unlock(); + return parent; + } + +diff --git a/fs/namei.c b/fs/namei.c +index cbe24e367a70..f839b0750ca3 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -578,9 +578,10 @@ static int __nd_alloc_stack(struct nameidata *nd) + static bool path_connected(const struct path *path) + { + struct vfsmount *mnt = path->mnt; ++ struct super_block *sb = mnt->mnt_sb; + +- /* Only bind mounts can have disconnected paths */ +- if (mnt->mnt_root == mnt->mnt_sb->s_root) ++ /* Bind mounts and multi-root filesystems can have disconnected paths */ ++ if (!(sb->s_iflags & SB_I_MULTIROOT) && (mnt->mnt_root == sb->s_root)) + return true; + + return is_subdir(path->dentry, mnt->mnt_root); +diff --git a/fs/nfs/super.c b/fs/nfs/super.c +index 216f67d628b3..38de09b08e96 100644 +--- a/fs/nfs/super.c ++++ b/fs/nfs/super.c +@@ -2623,6 +2623,8 @@ struct dentry *nfs_fs_mount_common(struct nfs_server *server, + /* initial superblock/root creation */ + mount_info->fill_super(s, mount_info); + nfs_get_cache_cookie(s, mount_info->parsed, mount_info->cloned); ++ if (!(server->flags & NFS_MOUNT_UNSHARED)) ++ s->s_iflags |= SB_I_MULTIROOT; + } + + mntroot = nfs_get_root(s, mount_info->mntfh, dev_name); +diff --git a/include/linux/fs.h b/include/linux/fs.h +index d54f41a63dbf..cc613f20e5a6 100644 +--- a/include/linux/fs.h ++++ b/include/linux/fs.h +@@ -1312,6 +1312,7 @@ extern int send_sigurg(struct fown_struct *fown); + #define SB_I_CGROUPWB 0x00000001 /* cgroup-aware writeback enabled */ + #define SB_I_NOEXEC 0x00000002 /* Ignore executables on this fs */ + #define SB_I_NODEV 0x00000004 /* Ignore devices on this fs */ ++#define SB_I_MULTIROOT 0x00000008 /* Multiple roots to the dentry tree */ + + /* sb->s_iflags to limit user namespace mounts */ + #define SB_I_USERNS_VISIBLE 0x00000010 /* fstype already mounted */ +diff --git a/include/linux/irqchip/arm-gic-v3.h b/include/linux/irqchip/arm-gic-v3.h +index 14b74f22d43c..bacb499c512c 100644 +--- a/include/linux/irqchip/arm-gic-v3.h ++++ b/include/linux/irqchip/arm-gic-v3.h +@@ -501,6 +501,7 @@ + + #define ICH_HCR_EN (1 << 0) + #define ICH_HCR_UIE (1 << 1) ++#define ICH_HCR_NPIE (1 << 3) + #define ICH_HCR_TC (1 << 10) + #define ICH_HCR_TALL0 (1 << 11) + #define ICH_HCR_TALL1 (1 << 12) +diff --git a/include/linux/irqchip/arm-gic.h b/include/linux/irqchip/arm-gic.h +index d3453ee072fc..68d8b1f73682 100644 +--- a/include/linux/irqchip/arm-gic.h ++++ b/include/linux/irqchip/arm-gic.h +@@ -84,6 +84,7 @@ + + #define GICH_HCR_EN (1 << 0) + #define GICH_HCR_UIE (1 << 1) ++#define GICH_HCR_NPIE (1 << 3) + + #define GICH_LR_VIRTUALID (0x3ff << 0) + #define GICH_LR_PHYSID_CPUID_SHIFT (10) +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index c2db7e905f7d..012881461058 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1762,10 +1762,9 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + return -ENOMEM; + _snd_pcm_hw_params_any(params); + err = snd_pcm_hw_refine(substream, params); +- format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT); +- kfree(params); + if (err < 0) +- return err; ++ goto error; ++ format_mask = hw_param_mask_c(params, SNDRV_PCM_HW_PARAM_FORMAT); + for (fmt = 0; fmt < 32; ++fmt) { + if (snd_mask_test(format_mask, fmt)) { + int f = snd_pcm_oss_format_to(fmt); +@@ -1773,7 +1772,10 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + formats |= f; + } + } +- return formats; ++ ++ error: ++ kfree(params); ++ return err < 0 ? err : formats; + } + + static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format) +diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c +index 1f3aa466ac9b..a4c571cb3b87 100644 +--- a/sound/core/seq/seq_clientmgr.c ++++ b/sound/core/seq/seq_clientmgr.c +@@ -255,12 +255,12 @@ static int seq_free_client1(struct snd_seq_client *client) + + if (!client) + return 0; +- snd_seq_delete_all_ports(client); +- snd_seq_queue_client_leave(client->number); + spin_lock_irqsave(&clients_lock, flags); + clienttablock[client->number] = 1; + clienttab[client->number] = NULL; + spin_unlock_irqrestore(&clients_lock, flags); ++ snd_seq_delete_all_ports(client); ++ snd_seq_queue_client_leave(client->number); + snd_use_lock_sync(&client->use_lock); + snd_seq_queue_client_termination(client->number); + if (client->pool) +diff --git a/sound/core/seq/seq_prioq.c b/sound/core/seq/seq_prioq.c +index bc1c8488fc2a..2bc6759e4adc 100644 +--- a/sound/core/seq/seq_prioq.c ++++ b/sound/core/seq/seq_prioq.c +@@ -87,7 +87,7 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo) + if (f->cells > 0) { + /* drain prioQ */ + while (f->cells > 0) +- snd_seq_cell_free(snd_seq_prioq_cell_out(f)); ++ snd_seq_cell_free(snd_seq_prioq_cell_out(f, NULL)); + } + + kfree(f); +@@ -214,8 +214,18 @@ int snd_seq_prioq_cell_in(struct snd_seq_prioq * f, + return 0; + } + ++/* return 1 if the current time >= event timestamp */ ++static int event_is_ready(struct snd_seq_event *ev, void *current_time) ++{ ++ if ((ev->flags & SNDRV_SEQ_TIME_STAMP_MASK) == SNDRV_SEQ_TIME_STAMP_TICK) ++ return snd_seq_compare_tick_time(current_time, &ev->time.tick); ++ else ++ return snd_seq_compare_real_time(current_time, &ev->time.time); ++} ++ + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time) + { + struct snd_seq_event_cell *cell; + unsigned long flags; +@@ -227,6 +237,8 @@ struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f) + spin_lock_irqsave(&f->lock, flags); + + cell = f->head; ++ if (cell && current_time && !event_is_ready(&cell->event, current_time)) ++ cell = NULL; + if (cell) { + f->head = cell->next; + +@@ -252,18 +264,6 @@ int snd_seq_prioq_avail(struct snd_seq_prioq * f) + return f->cells; + } + +- +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq * f) +-{ +- if (f == NULL) { +- pr_debug("ALSA: seq: snd_seq_prioq_cell_in() called with NULL prioq\n"); +- return NULL; +- } +- return f->head; +-} +- +- + static inline int prioq_match(struct snd_seq_event_cell *cell, + int client, int timestamp) + { +diff --git a/sound/core/seq/seq_prioq.h b/sound/core/seq/seq_prioq.h +index d38bb78d9345..2c315ca10fc4 100644 +--- a/sound/core/seq/seq_prioq.h ++++ b/sound/core/seq/seq_prioq.h +@@ -44,14 +44,12 @@ void snd_seq_prioq_delete(struct snd_seq_prioq **fifo); + int snd_seq_prioq_cell_in(struct snd_seq_prioq *f, struct snd_seq_event_cell *cell); + + /* dequeue cell from prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f); ++struct snd_seq_event_cell *snd_seq_prioq_cell_out(struct snd_seq_prioq *f, ++ void *current_time); + + /* return number of events available in prioq */ + int snd_seq_prioq_avail(struct snd_seq_prioq *f); + +-/* peek at cell at the head of the prioq */ +-struct snd_seq_event_cell *snd_seq_prioq_cell_peek(struct snd_seq_prioq *f); +- + /* client left queue */ + void snd_seq_prioq_leave(struct snd_seq_prioq *f, int client, int timestamp); + +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 79e0c5604ef8..1a6dc4ff44a6 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -277,30 +277,20 @@ void snd_seq_check_queue(struct snd_seq_queue *q, int atomic, int hop) + + __again: + /* Process tick queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->tickq)) != NULL) { +- if (snd_seq_compare_tick_time(&q->timer->tick.cur_tick, +- &cell->event.time.tick)) { +- cell = snd_seq_prioq_cell_out(q->tickq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->tickq, ++ &q->timer->tick.cur_tick); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + +- + /* Process time queue... */ +- while ((cell = snd_seq_prioq_cell_peek(q->timeq)) != NULL) { +- if (snd_seq_compare_real_time(&q->timer->cur_time, +- &cell->event.time.time)) { +- cell = snd_seq_prioq_cell_out(q->timeq); +- if (cell) +- snd_seq_dispatch_event(cell, atomic, hop); +- } else { +- /* event remains in the queue */ ++ for (;;) { ++ cell = snd_seq_prioq_cell_out(q->timeq, &q->timer->cur_time); ++ if (!cell) + break; +- } ++ snd_seq_dispatch_event(cell, atomic, hop); + } + + /* free lock */ +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 96143df19b21..d5017adf9feb 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -181,11 +181,15 @@ static const struct kernel_param_ops param_ops_xint = { + }; + #define param_check_xint param_check_int + +-static int power_save = -1; ++static int power_save = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + module_param(power_save, xint, 0644); + MODULE_PARM_DESC(power_save, "Automatic power-saving timeout " + "(in second, 0 = disable)."); + ++static bool pm_blacklist = true; ++module_param(pm_blacklist, bool, 0644); ++MODULE_PARM_DESC(pm_blacklist, "Enable power-management blacklist"); ++ + /* reset the HD-audio controller in power save mode. + * this may give more power-saving, but will take longer time to + * wake up. +@@ -2300,10 +2304,9 @@ static int azx_probe_continue(struct azx *chip) + + val = power_save; + #ifdef CONFIG_PM +- if (val == -1) { ++ if (pm_blacklist) { + const struct snd_pci_quirk *q; + +- val = CONFIG_SND_HDA_POWER_SAVE_DEFAULT; + q = snd_pci_quirk_lookup(chip->pci, power_save_blacklist); + if (q && val) { + dev_info(chip->card->dev, "device %04x:%04x is on the power_save blacklist, forcing power_save to 0\n", +diff --git a/tools/testing/selftests/x86/entry_from_vm86.c b/tools/testing/selftests/x86/entry_from_vm86.c +index d075ea0e5ca1..ade443a88421 100644 +--- a/tools/testing/selftests/x86/entry_from_vm86.c ++++ b/tools/testing/selftests/x86/entry_from_vm86.c +@@ -95,6 +95,31 @@ asm ( + "int3\n\t" + "vmcode_int80:\n\t" + "int $0x80\n\t" ++ "vmcode_popf_hlt:\n\t" ++ "push %ax\n\t" ++ "popf\n\t" ++ "hlt\n\t" ++ "vmcode_umip:\n\t" ++ /* addressing via displacements */ ++ "smsw (2052)\n\t" ++ "sidt (2054)\n\t" ++ "sgdt (2060)\n\t" ++ /* addressing via registers */ ++ "mov $2066, %bx\n\t" ++ "smsw (%bx)\n\t" ++ "mov $2068, %bx\n\t" ++ "sidt (%bx)\n\t" ++ "mov $2074, %bx\n\t" ++ "sgdt (%bx)\n\t" ++ /* register operands, only for smsw */ ++ "smsw %ax\n\t" ++ "mov %ax, (2080)\n\t" ++ "int3\n\t" ++ "vmcode_umip_str:\n\t" ++ "str %eax\n\t" ++ "vmcode_umip_sldt:\n\t" ++ "sldt %eax\n\t" ++ "int3\n\t" + ".size vmcode, . - vmcode\n\t" + "end_vmcode:\n\t" + ".code32\n\t" +@@ -103,7 +128,8 @@ asm ( + + extern unsigned char vmcode[], end_vmcode[]; + extern unsigned char vmcode_bound[], vmcode_sysenter[], vmcode_syscall[], +- vmcode_sti[], vmcode_int3[], vmcode_int80[]; ++ vmcode_sti[], vmcode_int3[], vmcode_int80[], vmcode_popf_hlt[], ++ vmcode_umip[], vmcode_umip_str[], vmcode_umip_sldt[]; + + /* Returns false if the test was skipped. */ + static bool do_test(struct vm86plus_struct *v86, unsigned long eip, +@@ -153,13 +179,75 @@ static bool do_test(struct vm86plus_struct *v86, unsigned long eip, + (VM86_TYPE(ret) == rettype && VM86_ARG(ret) == retarg)) { + printf("[OK]\tReturned correctly\n"); + } else { +- printf("[FAIL]\tIncorrect return reason\n"); ++ printf("[FAIL]\tIncorrect return reason (started at eip = 0x%lx, ended at eip = 0x%lx)\n", eip, v86->regs.eip); + nerrs++; + } + + return true; + } + ++void do_umip_tests(struct vm86plus_struct *vm86, unsigned char *test_mem) ++{ ++ struct table_desc { ++ unsigned short limit; ++ unsigned long base; ++ } __attribute__((packed)); ++ ++ /* Initialize variables with arbitrary values */ ++ struct table_desc gdt1 = { .base = 0x3c3c3c3c, .limit = 0x9999 }; ++ struct table_desc gdt2 = { .base = 0x1a1a1a1a, .limit = 0xaeae }; ++ struct table_desc idt1 = { .base = 0x7b7b7b7b, .limit = 0xf1f1 }; ++ struct table_desc idt2 = { .base = 0x89898989, .limit = 0x1313 }; ++ unsigned short msw1 = 0x1414, msw2 = 0x2525, msw3 = 3737; ++ ++ /* UMIP -- exit with INT3 unless kernel emulation did not trap #GP */ ++ do_test(vm86, vmcode_umip - vmcode, VM86_TRAP, 3, "UMIP tests"); ++ ++ /* Results from displacement-only addressing */ ++ msw1 = *(unsigned short *)(test_mem + 2052); ++ memcpy(&idt1, test_mem + 2054, sizeof(idt1)); ++ memcpy(&gdt1, test_mem + 2060, sizeof(gdt1)); ++ ++ /* Results from register-indirect addressing */ ++ msw2 = *(unsigned short *)(test_mem + 2066); ++ memcpy(&idt2, test_mem + 2068, sizeof(idt2)); ++ memcpy(&gdt2, test_mem + 2074, sizeof(gdt2)); ++ ++ /* Results when using register operands */ ++ msw3 = *(unsigned short *)(test_mem + 2080); ++ ++ printf("[INFO]\tResult from SMSW:[0x%04x]\n", msw1); ++ printf("[INFO]\tResult from SIDT: limit[0x%04x]base[0x%08lx]\n", ++ idt1.limit, idt1.base); ++ printf("[INFO]\tResult from SGDT: limit[0x%04x]base[0x%08lx]\n", ++ gdt1.limit, gdt1.base); ++ ++ if (msw1 != msw2 || msw1 != msw3) ++ printf("[FAIL]\tAll the results of SMSW should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SMSW are identical.\n"); ++ ++ if (memcmp(&gdt1, &gdt2, sizeof(gdt1))) ++ printf("[FAIL]\tAll the results of SGDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SGDT are identical.\n"); ++ ++ if (memcmp(&idt1, &idt2, sizeof(idt1))) ++ printf("[FAIL]\tAll the results of SIDT should be the same.\n"); ++ else ++ printf("[PASS]\tAll the results from SIDT are identical.\n"); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_str - vmcode, VM86_SIGNAL, 0, ++ "STR instruction"); ++ clearhandler(SIGILL); ++ ++ sethandler(SIGILL, sighandler, 0); ++ do_test(vm86, vmcode_umip_sldt - vmcode, VM86_SIGNAL, 0, ++ "SLDT instruction"); ++ clearhandler(SIGILL); ++} ++ + int main(void) + { + struct vm86plus_struct v86; +@@ -180,6 +268,9 @@ int main(void) + v86.regs.ds = load_addr / 16; + v86.regs.es = load_addr / 16; + ++ /* Use the end of the page as our stack. */ ++ v86.regs.esp = 4096; ++ + assert((v86.regs.cs & 3) == 0); /* Looks like RPL = 0 */ + + /* #BR -- should deliver SIG??? */ +@@ -211,6 +302,23 @@ int main(void) + v86.regs.eflags &= ~X86_EFLAGS_IF; + do_test(&v86, vmcode_sti - vmcode, VM86_STI, 0, "STI with VIP set"); + ++ /* POPF with VIP set but IF clear: should not trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = 0; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP set and IF clear"); ++ ++ /* POPF with VIP set and IF set: should trap */ ++ v86.regs.eflags = X86_EFLAGS_VIP; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_STI, 0, "POPF with VIP and IF set"); ++ ++ /* POPF with VIP clear and IF set: should not trap */ ++ v86.regs.eflags = 0; ++ v86.regs.eax = X86_EFLAGS_IF; ++ do_test(&v86, vmcode_popf_hlt - vmcode, VM86_UNKNOWN, 0, "POPF with VIP clear and IF set"); ++ ++ v86.regs.eflags = 0; ++ + /* INT3 -- should cause #BP */ + do_test(&v86, vmcode_int3 - vmcode, VM86_TRAP, 3, "INT3"); + +@@ -218,6 +326,9 @@ int main(void) + v86.regs.eax = (unsigned int)-1; + do_test(&v86, vmcode_int80 - vmcode, VM86_INTx, 0x80, "int80"); + ++ /* UMIP -- should exit with INTx 0x80 unless UMIP was not disabled */ ++ do_umip_tests(&v86, addr); ++ + /* Execute a null pointer */ + v86.regs.cs = 0; + v86.regs.ss = 0; +@@ -231,7 +342,7 @@ int main(void) + clearhandler(SIGSEGV); + + /* Make sure nothing explodes if we fork. */ +- if (fork() > 0) ++ if (fork() == 0) + return 0; + + return (nerrs == 0 ? 0 : 1); +diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c +index 8e89d63005c7..49a7d8c75937 100644 +--- a/virt/kvm/arm/arch_timer.c ++++ b/virt/kvm/arm/arch_timer.c +@@ -602,7 +602,7 @@ int kvm_timer_hyp_init(void) + return err; + } + +- kvm_info("virtual timer IRQ%d\n", host_vtimer_irq); ++ kvm_debug("virtual timer IRQ%d\n", host_vtimer_irq); + + cpuhp_setup_state(CPUHP_AP_KVM_ARM_TIMER_STARTING, + "kvm/arm/timer:starting", kvm_timer_starting_cpu, +diff --git a/virt/kvm/arm/hyp/vgic-v3-sr.c b/virt/kvm/arm/hyp/vgic-v3-sr.c +index 91728faa13fd..f2d1d4e8ae59 100644 +--- a/virt/kvm/arm/hyp/vgic-v3-sr.c ++++ b/virt/kvm/arm/hyp/vgic-v3-sr.c +@@ -215,7 +215,8 @@ void __hyp_text __vgic_v3_save_state(struct kvm_vcpu *vcpu) + * are now visible to the system register interface. + */ + if (!cpu_if->vgic_sre) { +- dsb(st); ++ dsb(sy); ++ isb(); + cpu_if->vgic_vmcr = read_gicreg(ICH_VMCR_EL2); + } + +diff --git a/virt/kvm/arm/mmu.c b/virt/kvm/arm/mmu.c +index 9dea96380339..b69798a7880e 100644 +--- a/virt/kvm/arm/mmu.c ++++ b/virt/kvm/arm/mmu.c +@@ -1760,9 +1760,9 @@ int kvm_mmu_init(void) + */ + BUG_ON((hyp_idmap_start ^ (hyp_idmap_end - 1)) & PAGE_MASK); + +- kvm_info("IDMAP page: %lx\n", hyp_idmap_start); +- kvm_info("HYP VA range: %lx:%lx\n", +- kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL)); ++ kvm_debug("IDMAP page: %lx\n", hyp_idmap_start); ++ kvm_debug("HYP VA range: %lx:%lx\n", ++ kern_hyp_va(PAGE_OFFSET), kern_hyp_va(~0UL)); + + if (hyp_idmap_start >= kern_hyp_va(PAGE_OFFSET) && + hyp_idmap_start < kern_hyp_va(~0UL) && +diff --git a/virt/kvm/arm/vgic/vgic-v2.c b/virt/kvm/arm/vgic/vgic-v2.c +index e4187e52bb26..841d4b27555a 100644 +--- a/virt/kvm/arm/vgic/vgic-v2.c ++++ b/virt/kvm/arm/vgic/vgic-v2.c +@@ -37,6 +37,13 @@ void vgic_v2_init_lrs(void) + vgic_v2_write_lr(i, 0); + } + ++void vgic_v2_set_npie(struct kvm_vcpu *vcpu) ++{ ++ struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2; ++ ++ cpuif->vgic_hcr |= GICH_HCR_NPIE; ++} ++ + void vgic_v2_set_underflow(struct kvm_vcpu *vcpu) + { + struct vgic_v2_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v2; +@@ -63,7 +70,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu) + struct vgic_v2_cpu_if *cpuif = &vgic_cpu->vgic_v2; + int lr; + +- cpuif->vgic_hcr &= ~GICH_HCR_UIE; ++ cpuif->vgic_hcr &= ~(GICH_HCR_UIE | GICH_HCR_NPIE); + + for (lr = 0; lr < vgic_cpu->used_lrs; lr++) { + u32 val = cpuif->vgic_lr[lr]; +@@ -380,7 +387,7 @@ int vgic_v2_probe(const struct gic_kvm_info *info) + kvm_vgic_global_state.type = VGIC_V2; + kvm_vgic_global_state.max_gic_vcpus = VGIC_V2_MAX_CPUS; + +- kvm_info("vgic-v2@%llx\n", info->vctrl.start); ++ kvm_debug("vgic-v2@%llx\n", info->vctrl.start); + + return 0; + out: +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index 502f2100e7bf..9dcc31600a8b 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -25,6 +25,13 @@ static bool group0_trap; + static bool group1_trap; + static bool common_trap; + ++void vgic_v3_set_npie(struct kvm_vcpu *vcpu) ++{ ++ struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; ++ ++ cpuif->vgic_hcr |= ICH_HCR_NPIE; ++} ++ + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu) + { + struct vgic_v3_cpu_if *cpuif = &vcpu->arch.vgic_cpu.vgic_v3; +@@ -45,7 +52,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu) + u32 model = vcpu->kvm->arch.vgic.vgic_model; + int lr; + +- cpuif->vgic_hcr &= ~ICH_HCR_UIE; ++ cpuif->vgic_hcr &= ~(ICH_HCR_UIE | ICH_HCR_NPIE); + + for (lr = 0; lr < vgic_cpu->used_lrs; lr++) { + u64 val = cpuif->vgic_lr[lr]; +diff --git a/virt/kvm/arm/vgic/vgic.c b/virt/kvm/arm/vgic/vgic.c +index da53c6e7d688..c9a8e7b7c300 100644 +--- a/virt/kvm/arm/vgic/vgic.c ++++ b/virt/kvm/arm/vgic/vgic.c +@@ -610,22 +610,37 @@ static inline void vgic_set_underflow(struct kvm_vcpu *vcpu) + vgic_v3_set_underflow(vcpu); + } + ++static inline void vgic_set_npie(struct kvm_vcpu *vcpu) ++{ ++ if (kvm_vgic_global_state.type == VGIC_V2) ++ vgic_v2_set_npie(vcpu); ++ else ++ vgic_v3_set_npie(vcpu); ++} ++ + /* Requires the ap_list_lock to be held. */ +-static int compute_ap_list_depth(struct kvm_vcpu *vcpu) ++static int compute_ap_list_depth(struct kvm_vcpu *vcpu, ++ bool *multi_sgi) + { + struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; + struct vgic_irq *irq; + int count = 0; + ++ *multi_sgi = false; ++ + DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock)); + + list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) { + spin_lock(&irq->irq_lock); + /* GICv2 SGIs can count for more than one... */ +- if (vgic_irq_is_sgi(irq->intid) && irq->source) +- count += hweight8(irq->source); +- else ++ if (vgic_irq_is_sgi(irq->intid) && irq->source) { ++ int w = hweight8(irq->source); ++ ++ count += w; ++ *multi_sgi |= (w > 1); ++ } else { + count++; ++ } + spin_unlock(&irq->irq_lock); + } + return count; +@@ -636,28 +651,43 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu) + { + struct vgic_cpu *vgic_cpu = &vcpu->arch.vgic_cpu; + struct vgic_irq *irq; +- int count = 0; ++ int count; ++ bool npie = false; ++ bool multi_sgi; ++ u8 prio = 0xff; + + DEBUG_SPINLOCK_BUG_ON(!spin_is_locked(&vgic_cpu->ap_list_lock)); + +- if (compute_ap_list_depth(vcpu) > kvm_vgic_global_state.nr_lr) ++ count = compute_ap_list_depth(vcpu, &multi_sgi); ++ if (count > kvm_vgic_global_state.nr_lr || multi_sgi) + vgic_sort_ap_list(vcpu); + ++ count = 0; ++ + list_for_each_entry(irq, &vgic_cpu->ap_list_head, ap_list) { + spin_lock(&irq->irq_lock); + +- if (unlikely(vgic_target_oracle(irq) != vcpu)) +- goto next; +- + /* +- * If we get an SGI with multiple sources, try to get +- * them in all at once. ++ * If we have multi-SGIs in the pipeline, we need to ++ * guarantee that they are all seen before any IRQ of ++ * lower priority. In that case, we need to filter out ++ * these interrupts by exiting early. This is easy as ++ * the AP list has been sorted already. + */ +- do { ++ if (multi_sgi && irq->priority > prio) { ++ spin_unlock(&irq->irq_lock); ++ break; ++ } ++ ++ if (likely(vgic_target_oracle(irq) == vcpu)) { + vgic_populate_lr(vcpu, irq, count++); +- } while (irq->source && count < kvm_vgic_global_state.nr_lr); + +-next: ++ if (irq->source) { ++ npie = true; ++ prio = irq->priority; ++ } ++ } ++ + spin_unlock(&irq->irq_lock); + + if (count == kvm_vgic_global_state.nr_lr) { +@@ -668,6 +698,9 @@ static void vgic_flush_lr_state(struct kvm_vcpu *vcpu) + } + } + ++ if (npie) ++ vgic_set_npie(vcpu); ++ + vcpu->arch.vgic_cpu.used_lrs = count; + + /* Nuke remaining LRs */ +diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h +index bf9ceab67c77..f7450dc41ab3 100644 +--- a/virt/kvm/arm/vgic/vgic.h ++++ b/virt/kvm/arm/vgic/vgic.h +@@ -150,6 +150,7 @@ void vgic_v2_fold_lr_state(struct kvm_vcpu *vcpu); + void vgic_v2_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr); + void vgic_v2_clear_lr(struct kvm_vcpu *vcpu, int lr); + void vgic_v2_set_underflow(struct kvm_vcpu *vcpu); ++void vgic_v2_set_npie(struct kvm_vcpu *vcpu); + int vgic_v2_has_attr_regs(struct kvm_device *dev, struct kvm_device_attr *attr); + int vgic_v2_dist_uaccess(struct kvm_vcpu *vcpu, bool is_write, + int offset, u32 *val); +@@ -179,6 +180,7 @@ void vgic_v3_fold_lr_state(struct kvm_vcpu *vcpu); + void vgic_v3_populate_lr(struct kvm_vcpu *vcpu, struct vgic_irq *irq, int lr); + void vgic_v3_clear_lr(struct kvm_vcpu *vcpu, int lr); + void vgic_v3_set_underflow(struct kvm_vcpu *vcpu); ++void vgic_v3_set_npie(struct kvm_vcpu *vcpu); + void vgic_v3_set_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr); + void vgic_v3_get_vmcr(struct kvm_vcpu *vcpu, struct vgic_vmcr *vmcr); + void vgic_v3_enable(struct kvm_vcpu *vcpu); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.29-30.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.29-30.patch new file mode 100644 index 000000000000..6f5211923a71 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.29-30.patch @@ -0,0 +1,2536 @@ +diff --git a/Documentation/devicetree/bindings/display/panel/toppoly,td028ttec1.txt b/Documentation/devicetree/bindings/display/panel/toppoly,td028ttec1.txt +deleted file mode 100644 +index 7175dc3740ac..000000000000 +--- a/Documentation/devicetree/bindings/display/panel/toppoly,td028ttec1.txt ++++ /dev/null +@@ -1,30 +0,0 @@ +-Toppoly TD028TTEC1 Panel +-======================== +- +-Required properties: +-- compatible: "toppoly,td028ttec1" +- +-Optional properties: +-- label: a symbolic name for the panel +- +-Required nodes: +-- Video port for DPI input +- +-Example +-------- +- +-lcd-panel: td028ttec1@0 { +- compatible = "toppoly,td028ttec1"; +- reg = <0>; +- spi-max-frequency = <100000>; +- spi-cpol; +- spi-cpha; +- +- label = "lcd"; +- port { +- lcd_in: endpoint { +- remote-endpoint = <&dpi_out>; +- }; +- }; +-}; +- +diff --git a/Documentation/devicetree/bindings/display/panel/tpo,td028ttec1.txt b/Documentation/devicetree/bindings/display/panel/tpo,td028ttec1.txt +new file mode 100644 +index 000000000000..ed34253d9fb1 +--- /dev/null ++++ b/Documentation/devicetree/bindings/display/panel/tpo,td028ttec1.txt +@@ -0,0 +1,30 @@ ++Toppoly TD028TTEC1 Panel ++======================== ++ ++Required properties: ++- compatible: "tpo,td028ttec1" ++ ++Optional properties: ++- label: a symbolic name for the panel ++ ++Required nodes: ++- Video port for DPI input ++ ++Example ++------- ++ ++lcd-panel: td028ttec1@0 { ++ compatible = "tpo,td028ttec1"; ++ reg = <0>; ++ spi-max-frequency = <100000>; ++ spi-cpol; ++ spi-cpha; ++ ++ label = "lcd"; ++ port { ++ lcd_in: endpoint { ++ remote-endpoint = <&dpi_out>; ++ }; ++ }; ++}; ++ +diff --git a/Makefile b/Makefile +index 4b2aa0dd4043..29fc3c91f3e4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 29 ++SUBLEVEL = 30 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/alpha/kernel/console.c b/arch/alpha/kernel/console.c +index 8e9a41966881..5476279329a6 100644 +--- a/arch/alpha/kernel/console.c ++++ b/arch/alpha/kernel/console.c +@@ -21,6 +21,7 @@ + struct pci_controller *pci_vga_hose; + static struct resource alpha_vga = { + .name = "alpha-vga+", ++ .flags = IORESOURCE_IO, + .start = 0x3C0, + .end = 0x3DF + }; +diff --git a/arch/arm/boot/dts/aspeed-ast2500-evb.dts b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +index f53e89d63477..c971cc93f42d 100644 +--- a/arch/arm/boot/dts/aspeed-ast2500-evb.dts ++++ b/arch/arm/boot/dts/aspeed-ast2500-evb.dts +@@ -16,7 +16,7 @@ + bootargs = "console=ttyS4,115200 earlyprintk"; + }; + +- memory { ++ memory@80000000 { + reg = <0x80000000 0x20000000>; + }; + }; +diff --git a/drivers/bluetooth/btqcomsmd.c b/drivers/bluetooth/btqcomsmd.c +index bd810d01538a..093fd096f0c8 100644 +--- a/drivers/bluetooth/btqcomsmd.c ++++ b/drivers/bluetooth/btqcomsmd.c +@@ -86,7 +86,8 @@ static int btqcomsmd_send(struct hci_dev *hdev, struct sk_buff *skb) + break; + } + +- kfree_skb(skb); ++ if (!ret) ++ kfree_skb(skb); + + return ret; + } +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 392f412b4575..c9f0ac083a3e 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -933,6 +933,9 @@ static int qca_setup(struct hci_uart *hu) + if (!ret) { + set_bit(STATE_IN_BAND_SLEEP_ENABLED, &qca->flags); + qca_debugfs_init(hdev); ++ } else if (ret == -ENOENT) { ++ /* No patch/nvm-config found, run with original fw/config */ ++ ret = 0; + } + + /* Setup bdaddr */ +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index 970e1242a282..3a70dba2c645 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -107,6 +107,8 @@ static ssize_t read_mem(struct file *file, char __user *buf, + phys_addr_t p = *ppos; + ssize_t read, sz; + void *ptr; ++ char *bounce; ++ int err; + + if (p != *ppos) + return 0; +@@ -129,15 +131,22 @@ static ssize_t read_mem(struct file *file, char __user *buf, + } + #endif + ++ bounce = kmalloc(PAGE_SIZE, GFP_KERNEL); ++ if (!bounce) ++ return -ENOMEM; ++ + while (count > 0) { + unsigned long remaining; + int allowed; + + sz = size_inside_page(p, count); + ++ err = -EPERM; + allowed = page_is_allowed(p >> PAGE_SHIFT); + if (!allowed) +- return -EPERM; ++ goto failed; ++ ++ err = -EFAULT; + if (allowed == 2) { + /* Show zeros for restricted memory. */ + remaining = clear_user(buf, sz); +@@ -149,24 +158,32 @@ static ssize_t read_mem(struct file *file, char __user *buf, + */ + ptr = xlate_dev_mem_ptr(p); + if (!ptr) +- return -EFAULT; +- +- remaining = copy_to_user(buf, ptr, sz); ++ goto failed; + ++ err = probe_kernel_read(bounce, ptr, sz); + unxlate_dev_mem_ptr(p, ptr); ++ if (err) ++ goto failed; ++ ++ remaining = copy_to_user(buf, bounce, sz); + } + + if (remaining) +- return -EFAULT; ++ goto failed; + + buf += sz; + p += sz; + count -= sz; + read += sz; + } ++ kfree(bounce); + + *ppos += read; + return read; ++ ++failed: ++ kfree(bounce); ++ return err; + } + + static ssize_t write_mem(struct file *file, const char __user *buf, +diff --git a/drivers/clk/at91/pmc.c b/drivers/clk/at91/pmc.c +index 775af473fe11..5c2b26de303e 100644 +--- a/drivers/clk/at91/pmc.c ++++ b/drivers/clk/at91/pmc.c +@@ -107,10 +107,20 @@ static int pmc_suspend(void) + return 0; + } + ++static bool pmc_ready(unsigned int mask) ++{ ++ unsigned int status; ++ ++ regmap_read(pmcreg, AT91_PMC_SR, &status); ++ ++ return ((status & mask) == mask) ? 1 : 0; ++} ++ + static void pmc_resume(void) + { +- int i, ret = 0; ++ int i; + u32 tmp; ++ u32 mask = AT91_PMC_MCKRDY | AT91_PMC_LOCKA; + + regmap_read(pmcreg, AT91_PMC_MCKR, &tmp); + if (pmc_cache.mckr != tmp) +@@ -134,13 +144,11 @@ static void pmc_resume(void) + AT91_PMC_PCR_CMD); + } + +- if (pmc_cache.uckr & AT91_PMC_UPLLEN) { +- ret = regmap_read_poll_timeout(pmcreg, AT91_PMC_SR, tmp, +- !(tmp & AT91_PMC_LOCKU), +- 10, 5000); +- if (ret) +- pr_crit("USB PLL didn't lock when resuming\n"); +- } ++ if (pmc_cache.uckr & AT91_PMC_UPLLEN) ++ mask |= AT91_PMC_LOCKU; ++ ++ while (!pmc_ready(mask)) ++ cpu_relax(); + } + + static struct syscore_ops pmc_syscore_ops = { +diff --git a/drivers/clk/clk-axi-clkgen.c b/drivers/clk/clk-axi-clkgen.c +index 5e918e7afaba..95a6e9834392 100644 +--- a/drivers/clk/clk-axi-clkgen.c ++++ b/drivers/clk/clk-axi-clkgen.c +@@ -40,6 +40,10 @@ + #define MMCM_REG_FILTER1 0x4e + #define MMCM_REG_FILTER2 0x4f + ++#define MMCM_CLKOUT_NOCOUNT BIT(6) ++ ++#define MMCM_CLK_DIV_NOCOUNT BIT(12) ++ + struct axi_clkgen { + void __iomem *base; + struct clk_hw clk_hw; +@@ -315,12 +319,27 @@ static unsigned long axi_clkgen_recalc_rate(struct clk_hw *clk_hw, + unsigned int reg; + unsigned long long tmp; + +- axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLKOUT0_1, ®); +- dout = (reg & 0x3f) + ((reg >> 6) & 0x3f); ++ axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLKOUT0_2, ®); ++ if (reg & MMCM_CLKOUT_NOCOUNT) { ++ dout = 1; ++ } else { ++ axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLKOUT0_1, ®); ++ dout = (reg & 0x3f) + ((reg >> 6) & 0x3f); ++ } ++ + axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLK_DIV, ®); +- d = (reg & 0x3f) + ((reg >> 6) & 0x3f); +- axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLK_FB1, ®); +- m = (reg & 0x3f) + ((reg >> 6) & 0x3f); ++ if (reg & MMCM_CLK_DIV_NOCOUNT) ++ d = 1; ++ else ++ d = (reg & 0x3f) + ((reg >> 6) & 0x3f); ++ ++ axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLK_FB2, ®); ++ if (reg & MMCM_CLKOUT_NOCOUNT) { ++ m = 1; ++ } else { ++ axi_clkgen_mmcm_read(axi_clkgen, MMCM_REG_CLK_FB1, ®); ++ m = (reg & 0x3f) + ((reg >> 6) & 0x3f); ++ } + + if (d == 0 || dout == 0) + return 0; +diff --git a/drivers/clk/clk-si5351.c b/drivers/clk/clk-si5351.c +index 20d90769cced..653b0f38d475 100644 +--- a/drivers/clk/clk-si5351.c ++++ b/drivers/clk/clk-si5351.c +@@ -72,7 +72,7 @@ static const char * const si5351_input_names[] = { + "xtal", "clkin" + }; + static const char * const si5351_pll_names[] = { +- "plla", "pllb", "vxco" ++ "si5351_plla", "si5351_pllb", "si5351_vxco" + }; + static const char * const si5351_msynth_names[] = { + "ms0", "ms1", "ms2", "ms3", "ms4", "ms5", "ms6", "ms7" +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index c8d83acda006..60c7fde37d23 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -2470,6 +2470,21 @@ static int __clk_core_init(struct clk_core *core) + rate = 0; + core->rate = core->req_rate = rate; + ++ /* ++ * Enable CLK_IS_CRITICAL clocks so newly added critical clocks ++ * don't get accidentally disabled when walking the orphan tree and ++ * reparenting clocks ++ */ ++ if (core->flags & CLK_IS_CRITICAL) { ++ unsigned long flags; ++ ++ clk_core_prepare(core); ++ ++ flags = clk_enable_lock(); ++ clk_core_enable(core); ++ clk_enable_unlock(flags); ++ } ++ + /* + * walk the list of orphan clocks and reparent any that newly finds a + * parent. +@@ -2478,10 +2493,13 @@ static int __clk_core_init(struct clk_core *core) + struct clk_core *parent = __clk_init_parent(orphan); + + /* +- * we could call __clk_set_parent, but that would result in a +- * redundant call to the .set_rate op, if it exists ++ * We need to use __clk_set_parent_before() and _after() to ++ * to properly migrate any prepare/enable count of the orphan ++ * clock. This is important for CLK_IS_CRITICAL clocks, which ++ * are enabled during init but might not have a parent yet. + */ + if (parent) { ++ /* update the clk tree topology */ + __clk_set_parent_before(orphan, parent); + __clk_set_parent_after(orphan, parent, NULL); + __clk_recalc_accuracies(orphan); +@@ -2500,16 +2518,6 @@ static int __clk_core_init(struct clk_core *core) + if (core->ops->init) + core->ops->init(core->hw); + +- if (core->flags & CLK_IS_CRITICAL) { +- unsigned long flags; +- +- clk_core_prepare(core); +- +- flags = clk_enable_lock(); +- clk_core_enable(core); +- clk_enable_unlock(flags); +- } +- + kref_init(&core->ref); + out: + clk_prepare_unlock(); +diff --git a/drivers/cpufreq/longhaul.c b/drivers/cpufreq/longhaul.c +index d5e27bc7585a..859a62ea6120 100644 +--- a/drivers/cpufreq/longhaul.c ++++ b/drivers/cpufreq/longhaul.c +@@ -894,7 +894,7 @@ static int longhaul_cpu_init(struct cpufreq_policy *policy) + if ((longhaul_version != TYPE_LONGHAUL_V1) && (scale_voltage != 0)) + longhaul_setup_voltagescaling(); + +- policy->cpuinfo.transition_latency = 200000; /* nsec */ ++ policy->transition_delay_us = 200000; /* usec */ + + return cpufreq_table_validate_and_show(policy, longhaul_table); + } +diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c +index 0f9754e07719..6eb5cb92b986 100644 +--- a/drivers/crypto/axis/artpec6_crypto.c ++++ b/drivers/crypto/axis/artpec6_crypto.c +@@ -22,6 +22,7 @@ + #include + + #include ++#include + #include + #include + #include +@@ -1934,7 +1935,7 @@ static int artpec6_crypto_prepare_aead(struct aead_request *areq) + + memcpy(req_ctx->hw_ctx.J0, areq->iv, crypto_aead_ivsize(cipher)); + // The HW omits the initial increment of the counter field. +- crypto_inc(req_ctx->hw_ctx.J0+12, 4); ++ memcpy(req_ctx->hw_ctx.J0 + GCM_AES_IV_SIZE, "\x00\x00\x00\x01", 4); + + ret = artpec6_crypto_setup_out_descr(common, &req_ctx->hw_ctx, + sizeof(struct artpec6_crypto_aead_hw_ctx), false, false); +@@ -2956,7 +2957,7 @@ static struct aead_alg aead_algos[] = { + .setkey = artpec6_crypto_aead_set_key, + .encrypt = artpec6_crypto_aead_encrypt, + .decrypt = artpec6_crypto_aead_decrypt, +- .ivsize = AES_BLOCK_SIZE, ++ .ivsize = GCM_AES_IV_SIZE, + .maxauthsize = AES_BLOCK_SIZE, + + .base = { +diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c +index 7df910e7c348..9272b173c746 100644 +--- a/drivers/dma/ti-dma-crossbar.c ++++ b/drivers/dma/ti-dma-crossbar.c +@@ -54,7 +54,15 @@ struct ti_am335x_xbar_map { + + static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val) + { +- writeb_relaxed(val, iomem + event); ++ /* ++ * TPCC_EVT_MUX_60_63 register layout is different than the ++ * rest, in the sense, that event 63 is mapped to lowest byte ++ * and event 60 is mapped to highest, handle it separately. ++ */ ++ if (event >= 60 && event <= 63) ++ writeb_relaxed(val, iomem + (63 - event % 4)); ++ else ++ writeb_relaxed(val, iomem + event); + } + + static void ti_am335x_xbar_free(struct device *dev, void *route_data) +diff --git a/drivers/dma/xilinx/zynqmp_dma.c b/drivers/dma/xilinx/zynqmp_dma.c +index 1ee1241ca797..5cc8ed31f26b 100644 +--- a/drivers/dma/xilinx/zynqmp_dma.c ++++ b/drivers/dma/xilinx/zynqmp_dma.c +@@ -838,7 +838,8 @@ static void zynqmp_dma_chan_remove(struct zynqmp_dma_chan *chan) + if (!chan) + return; + +- devm_free_irq(chan->zdev->dev, chan->irq, chan); ++ if (chan->irq) ++ devm_free_irq(chan->zdev->dev, chan->irq, chan); + tasklet_kill(&chan->tasklet); + list_del(&chan->common.device_node); + clk_disable_unprepare(chan->clk_apb); +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index ea5bb0e1632c..6e0fb50d0de4 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -93,14 +93,17 @@ static struct page **get_pages(struct drm_gem_object *obj) + return p; + } + ++ msm_obj->pages = p; ++ + msm_obj->sgt = drm_prime_pages_to_sg(p, npages); + if (IS_ERR(msm_obj->sgt)) { ++ void *ptr = ERR_CAST(msm_obj->sgt); ++ + dev_err(dev->dev, "failed to allocate sgt\n"); +- return ERR_CAST(msm_obj->sgt); ++ msm_obj->sgt = NULL; ++ return ptr; + } + +- msm_obj->pages = p; +- + /* For non-cached buffers, ensure the new pages are clean + * because display controller, GPU, etc. are not coherent: + */ +@@ -135,7 +138,10 @@ static void put_pages(struct drm_gem_object *obj) + if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) + dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, + msm_obj->sgt->nents, DMA_BIDIRECTIONAL); +- sg_free_table(msm_obj->sgt); ++ ++ if (msm_obj->sgt) ++ sg_free_table(msm_obj->sgt); ++ + kfree(msm_obj->sgt); + + if (use_pages(obj)) +diff --git a/drivers/gpu/drm/omapdrm/displays/panel-tpo-td028ttec1.c b/drivers/gpu/drm/omapdrm/displays/panel-tpo-td028ttec1.c +index 0a38a0e8c925..a0dfa14f4fab 100644 +--- a/drivers/gpu/drm/omapdrm/displays/panel-tpo-td028ttec1.c ++++ b/drivers/gpu/drm/omapdrm/displays/panel-tpo-td028ttec1.c +@@ -452,6 +452,8 @@ static int td028ttec1_panel_remove(struct spi_device *spi) + } + + static const struct of_device_id td028ttec1_of_match[] = { ++ { .compatible = "omapdss,tpo,td028ttec1", }, ++ /* keep to not break older DTB */ + { .compatible = "omapdss,toppoly,td028ttec1", }, + {}, + }; +@@ -471,6 +473,7 @@ static struct spi_driver td028ttec1_spi_driver = { + + module_spi_driver(td028ttec1_spi_driver); + ++MODULE_ALIAS("spi:tpo,td028ttec1"); + MODULE_ALIAS("spi:toppoly,td028ttec1"); + MODULE_AUTHOR("H. Nikolaus Schaller "); + MODULE_DESCRIPTION("Toppoly TD028TTEC1 panel driver"); +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index c60a85e82c6d..fd05f7e9f43f 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -298,7 +298,12 @@ static int dmm_txn_commit(struct dmm_txn *txn, bool wait) + msecs_to_jiffies(100))) { + dev_err(dmm->dev, "timed out waiting for done\n"); + ret = -ETIMEDOUT; ++ goto cleanup; + } ++ ++ /* Check the engine status before continue */ ++ ret = wait_status(engine, DMM_PATSTATUS_READY | ++ DMM_PATSTATUS_VALID | DMM_PATSTATUS_DONE); + } + + cleanup: +diff --git a/drivers/gpu/drm/tilcdc/tilcdc_regs.h b/drivers/gpu/drm/tilcdc/tilcdc_regs.h +index 9d528c0a67a4..5048ebb86835 100644 +--- a/drivers/gpu/drm/tilcdc/tilcdc_regs.h ++++ b/drivers/gpu/drm/tilcdc/tilcdc_regs.h +@@ -133,7 +133,7 @@ static inline void tilcdc_write64(struct drm_device *dev, u32 reg, u64 data) + struct tilcdc_drm_private *priv = dev->dev_private; + volatile void __iomem *addr = priv->mmio + reg; + +-#ifdef iowrite64 ++#if defined(iowrite64) && !defined(iowrite64_is_nonatomic) + iowrite64(data, addr); + #else + __iowmb(); +diff --git a/drivers/hwtracing/coresight/coresight-tpiu.c b/drivers/hwtracing/coresight/coresight-tpiu.c +index d7a3e453016d..735dca089389 100644 +--- a/drivers/hwtracing/coresight/coresight-tpiu.c ++++ b/drivers/hwtracing/coresight/coresight-tpiu.c +@@ -46,8 +46,11 @@ + #define TPIU_ITATBCTR0 0xef8 + + /** register definition **/ ++/* FFSR - 0x300 */ ++#define FFSR_FT_STOPPED BIT(1) + /* FFCR - 0x304 */ + #define FFCR_FON_MAN BIT(6) ++#define FFCR_STOP_FI BIT(12) + + /** + * @base: memory mapped base address for this component. +@@ -85,10 +88,14 @@ static void tpiu_disable_hw(struct tpiu_drvdata *drvdata) + { + CS_UNLOCK(drvdata->base); + +- /* Clear formatter controle reg. */ +- writel_relaxed(0x0, drvdata->base + TPIU_FFCR); ++ /* Clear formatter and stop on flush */ ++ writel_relaxed(FFCR_STOP_FI, drvdata->base + TPIU_FFCR); + /* Generate manual flush */ +- writel_relaxed(FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ writel_relaxed(FFCR_STOP_FI | FFCR_FON_MAN, drvdata->base + TPIU_FFCR); ++ /* Wait for flush to complete */ ++ coresight_timeout(drvdata->base, TPIU_FFCR, FFCR_FON_MAN, 0); ++ /* Wait for formatter to stop */ ++ coresight_timeout(drvdata->base, TPIU_FFSR, FFSR_FT_STOPPED, 1); + + CS_LOCK(drvdata->base); + } +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index e457dface2d2..6cae00ecc905 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -3017,7 +3017,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list, + continue; + + /* different dest port -> unique */ +- if (!cma_any_port(cur_daddr) && ++ if (!cma_any_port(daddr) && ++ !cma_any_port(cur_daddr) && + (dport != cur_dport)) + continue; + +@@ -3028,7 +3029,8 @@ static int cma_port_is_unique(struct rdma_bind_list *bind_list, + continue; + + /* different dst address -> unique */ +- if (!cma_any_addr(cur_daddr) && ++ if (!cma_any_addr(daddr) && ++ !cma_any_addr(cur_daddr) && + cma_addr_cmp(daddr, cur_daddr)) + continue; + +@@ -3326,13 +3328,13 @@ int rdma_bind_addr(struct rdma_cm_id *id, struct sockaddr *addr) + } + #endif + } ++ daddr = cma_dst_addr(id_priv); ++ daddr->sa_family = addr->sa_family; ++ + ret = cma_get_port(id_priv); + if (ret) + goto err2; + +- daddr = cma_dst_addr(id_priv); +- daddr->sa_family = addr->sa_family; +- + return 0; + err2: + if (id_priv->cma_dev) +@@ -4118,6 +4120,9 @@ int rdma_join_multicast(struct rdma_cm_id *id, struct sockaddr *addr, + struct cma_multicast *mc; + int ret; + ++ if (!id->device) ++ return -EINVAL; ++ + id_priv = container_of(id, struct rdma_id_private, id); + if (!cma_comp(id_priv, RDMA_CM_ADDR_BOUND) && + !cma_comp(id_priv, RDMA_CM_ADDR_RESOLVED)) +@@ -4436,7 +4441,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb) + RDMA_NL_RDMA_CM_ATTR_SRC_ADDR)) + goto out; + if (ibnl_put_attr(skb, nlh, +- rdma_addr_size(cma_src_addr(id_priv)), ++ rdma_addr_size(cma_dst_addr(id_priv)), + cma_dst_addr(id_priv), + RDMA_NL_RDMA_CM_ATTR_DST_ADDR)) + goto out; +diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c +index 3c4faadb8cdd..81528f64061a 100644 +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -654,6 +654,7 @@ int iwpm_send_mapinfo(u8 nl_client, int iwpm_pid) + } + skb_num++; + spin_lock_irqsave(&iwpm_mapinfo_lock, flags); ++ ret = -EINVAL; + for (i = 0; i < IWPM_MAPINFO_HASH_SIZE; i++) { + hlist_for_each_entry(map_info, &iwpm_hash_bucket[i], + hlist_node) { +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index c8b3a45e9edc..77ca9da570a2 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1348,7 +1348,7 @@ static ssize_t ucma_process_join(struct ucma_file *file, + return -ENOSPC; + + addr = (struct sockaddr *) &cmd->addr; +- if (!cmd->addr_size || (cmd->addr_size != rdma_addr_size(addr))) ++ if (cmd->addr_size != rdma_addr_size(addr)) + return -EINVAL; + + if (cmd->join_flags == RDMA_MC_JOIN_FLAG_FULLMEMBER) +@@ -1416,6 +1416,9 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, + join_cmd.uid = cmd.uid; + join_cmd.id = cmd.id; + join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); ++ if (!join_cmd.addr_size) ++ return -EINVAL; ++ + join_cmd.join_flags = RDMA_MC_JOIN_FLAG_FULLMEMBER; + memcpy(&join_cmd.addr, &cmd.addr, join_cmd.addr_size); + +@@ -1431,6 +1434,9 @@ static ssize_t ucma_join_multicast(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size((struct sockaddr *)&cmd.addr)) ++ return -EINVAL; ++ + return ucma_process_join(file, &cmd, out_len); + } + +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 130606c3b07c..9a4e899d94b3 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -352,7 +352,7 @@ int ib_umem_copy_from(void *dst, struct ib_umem *umem, size_t offset, + return -EINVAL; + } + +- ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->nmap, dst, length, ++ ret = sg_pcopy_to_buffer(umem->sg_head.sgl, umem->npages, dst, length, + offset + ib_umem_offset(umem)); + + if (ret < 0) +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 756ece6118c0..c4d8cc1c2b1d 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -1130,7 +1130,7 @@ static void destroy_raw_packet_qp_sq(struct mlx5_ib_dev *dev, + ib_umem_release(sq->ubuffer.umem); + } + +-static int get_rq_pas_size(void *qpc) ++static size_t get_rq_pas_size(void *qpc) + { + u32 log_page_size = MLX5_GET(qpc, qpc, log_page_size) + 12; + u32 log_rq_stride = MLX5_GET(qpc, qpc, log_rq_stride); +@@ -1146,7 +1146,8 @@ static int get_rq_pas_size(void *qpc) + } + + static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev, +- struct mlx5_ib_rq *rq, void *qpin) ++ struct mlx5_ib_rq *rq, void *qpin, ++ size_t qpinlen) + { + struct mlx5_ib_qp *mqp = rq->base.container_mibqp; + __be64 *pas; +@@ -1155,9 +1156,12 @@ static int create_raw_packet_qp_rq(struct mlx5_ib_dev *dev, + void *rqc; + void *wq; + void *qpc = MLX5_ADDR_OF(create_qp_in, qpin, qpc); +- int inlen; ++ size_t rq_pas_size = get_rq_pas_size(qpc); ++ size_t inlen; + int err; +- u32 rq_pas_size = get_rq_pas_size(qpc); ++ ++ if (qpinlen < rq_pas_size + MLX5_BYTE_OFF(create_qp_in, pas)) ++ return -EINVAL; + + inlen = MLX5_ST_SZ_BYTES(create_rq_in) + rq_pas_size; + in = kvzalloc(inlen, GFP_KERNEL); +@@ -1236,7 +1240,7 @@ static void destroy_raw_packet_qp_tir(struct mlx5_ib_dev *dev, + } + + static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp, +- u32 *in, ++ u32 *in, size_t inlen, + struct ib_pd *pd) + { + struct mlx5_ib_raw_packet_qp *raw_packet_qp = &qp->raw_packet_qp; +@@ -1266,7 +1270,7 @@ static int create_raw_packet_qp(struct mlx5_ib_dev *dev, struct mlx5_ib_qp *qp, + + if (qp->flags & MLX5_IB_QP_CVLAN_STRIPPING) + rq->flags |= MLX5_IB_RQ_CVLAN_STRIPPING; +- err = create_raw_packet_qp_rq(dev, rq, in); ++ err = create_raw_packet_qp_rq(dev, rq, in, inlen); + if (err) + goto err_destroy_sq; + +@@ -1781,11 +1785,16 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + qp->flags |= MLX5_IB_QP_LSO; + } + ++ if (inlen < 0) { ++ err = -EINVAL; ++ goto err; ++ } ++ + if (init_attr->qp_type == IB_QPT_RAW_PACKET || + qp->flags & MLX5_IB_QP_UNDERLAY) { + qp->raw_packet_qp.sq.ubuffer.buf_addr = ucmd.sq_buf_addr; + raw_packet_qp_copy_info(qp, &qp->raw_packet_qp); +- err = create_raw_packet_qp(dev, qp, in, pd); ++ err = create_raw_packet_qp(dev, qp, in, inlen, pd); + } else { + err = mlx5_core_create_qp(dev->mdev, &base->mqp, in, inlen); + } +@@ -1825,6 +1834,7 @@ static int create_qp_common(struct mlx5_ib_dev *dev, struct ib_pd *pd, + else if (qp->create_type == MLX5_QP_KERNEL) + destroy_qp_kernel(dev, qp); + ++err: + kvfree(in); + return err; + } +diff --git a/drivers/infiniband/hw/mlx5/srq.c b/drivers/infiniband/hw/mlx5/srq.c +index 6d5fadad9090..3c7522d025f2 100644 +--- a/drivers/infiniband/hw/mlx5/srq.c ++++ b/drivers/infiniband/hw/mlx5/srq.c +@@ -241,8 +241,8 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, + { + struct mlx5_ib_dev *dev = to_mdev(pd->device); + struct mlx5_ib_srq *srq; +- int desc_size; +- int buf_size; ++ size_t desc_size; ++ size_t buf_size; + int err; + struct mlx5_srq_attr in = {0}; + __u32 max_srq_wqes = 1 << MLX5_CAP_GEN(dev->mdev, log_max_srq_sz); +@@ -266,15 +266,18 @@ struct ib_srq *mlx5_ib_create_srq(struct ib_pd *pd, + + desc_size = sizeof(struct mlx5_wqe_srq_next_seg) + + srq->msrq.max_gs * sizeof(struct mlx5_wqe_data_seg); ++ if (desc_size == 0 || srq->msrq.max_gs > desc_size) ++ return ERR_PTR(-EINVAL); + desc_size = roundup_pow_of_two(desc_size); +- desc_size = max_t(int, 32, desc_size); ++ desc_size = max_t(size_t, 32, desc_size); ++ if (desc_size < sizeof(struct mlx5_wqe_srq_next_seg)) ++ return ERR_PTR(-EINVAL); + srq->msrq.max_avail_gather = (desc_size - sizeof(struct mlx5_wqe_srq_next_seg)) / + sizeof(struct mlx5_wqe_data_seg); + srq->msrq.wqe_shift = ilog2(desc_size); + buf_size = srq->msrq.max * desc_size; +- mlx5_ib_dbg(dev, "desc_size 0x%x, req wr 0x%x, srq size 0x%x, max_gs 0x%x, max_avail_gather 0x%x\n", +- desc_size, init_attr->attr.max_wr, srq->msrq.max, srq->msrq.max_gs, +- srq->msrq.max_avail_gather); ++ if (buf_size < desc_size) ++ return ERR_PTR(-EINVAL); + in.type = init_attr->srq_type; + + if (pd->uobject) +diff --git a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +index 66056f9a9700..48a49f8a5014 100644 +--- a/drivers/infiniband/hw/ocrdma/ocrdma_stats.c ++++ b/drivers/infiniband/hw/ocrdma/ocrdma_stats.c +@@ -834,7 +834,7 @@ void ocrdma_add_port_stats(struct ocrdma_dev *dev) + + dev->reset_stats.type = OCRDMA_RESET_STATS; + dev->reset_stats.dev = dev; +- if (!debugfs_create_file("reset_stats", S_IRUSR, dev->dir, ++ if (!debugfs_create_file("reset_stats", 0200, dev->dir, + &dev->reset_stats, &ocrdma_dbg_ops)) + goto err; + +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +index 3562c0c30492..6286b95d77ed 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_cq.c +@@ -114,6 +114,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, + union pvrdma_cmd_resp rsp; + struct pvrdma_cmd_create_cq *cmd = &req.create_cq; + struct pvrdma_cmd_create_cq_resp *resp = &rsp.create_cq_resp; ++ struct pvrdma_create_cq_resp cq_resp = {0}; + struct pvrdma_create_cq ucmd; + + BUILD_BUG_ON(sizeof(struct pvrdma_cqe) != 64); +@@ -198,6 +199,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, + + cq->ibcq.cqe = resp->cqe; + cq->cq_handle = resp->cq_handle; ++ cq_resp.cqn = resp->cq_handle; + spin_lock_irqsave(&dev->cq_tbl_lock, flags); + dev->cq_tbl[cq->cq_handle % dev->dsr->caps.max_cq] = cq; + spin_unlock_irqrestore(&dev->cq_tbl_lock, flags); +@@ -206,7 +208,7 @@ struct ib_cq *pvrdma_create_cq(struct ib_device *ibdev, + cq->uar = &(to_vucontext(context)->uar); + + /* Copy udata back. */ +- if (ib_copy_to_udata(udata, &cq->cq_handle, sizeof(__u32))) { ++ if (ib_copy_to_udata(udata, &cq_resp, sizeof(cq_resp))) { + dev_warn(&dev->pdev->dev, + "failed to copy back udata\n"); + pvrdma_destroy_cq(&cq->ibcq); +diff --git a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +index 48776f5ffb0e..aa533f08e017 100644 +--- a/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c ++++ b/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.c +@@ -444,6 +444,7 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, + union pvrdma_cmd_resp rsp; + struct pvrdma_cmd_create_pd *cmd = &req.create_pd; + struct pvrdma_cmd_create_pd_resp *resp = &rsp.create_pd_resp; ++ struct pvrdma_alloc_pd_resp pd_resp = {0}; + int ret; + void *ptr; + +@@ -472,9 +473,10 @@ struct ib_pd *pvrdma_alloc_pd(struct ib_device *ibdev, + pd->privileged = !context; + pd->pd_handle = resp->pd_handle; + pd->pdn = resp->pd_handle; ++ pd_resp.pdn = resp->pd_handle; + + if (context) { +- if (ib_copy_to_udata(udata, &pd->pdn, sizeof(__u32))) { ++ if (ib_copy_to_udata(udata, &pd_resp, sizeof(pd_resp))) { + dev_warn(&dev->pdev->dev, + "failed to copy back protection domain\n"); + pvrdma_dealloc_pd(&pd->ibpd); +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index f6935811ef3f..a009e943362a 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -776,6 +776,22 @@ static void path_rec_completion(int status, + spin_lock_irqsave(&priv->lock, flags); + + if (!IS_ERR_OR_NULL(ah)) { ++ /* ++ * pathrec.dgid is used as the database key from the LLADDR, ++ * it must remain unchanged even if the SA returns a different ++ * GID to use in the AH. ++ */ ++ if (memcmp(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid))) { ++ ipoib_dbg( ++ priv, ++ "%s got PathRec for gid %pI6 while asked for %pI6\n", ++ dev->name, pathrec->dgid.raw, ++ path->pathrec.dgid.raw); ++ memcpy(pathrec->dgid.raw, path->pathrec.dgid.raw, ++ sizeof(union ib_gid)); ++ } ++ + path->pathrec = *pathrec; + + old_ah = path->ah; +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index 9d4785ba24cb..e770c17cbca9 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -2124,6 +2124,9 @@ isert_rdma_rw_ctx_post(struct isert_cmd *cmd, struct isert_conn *conn, + u32 rkey, offset; + int ret; + ++ if (cmd->ctx_init_done) ++ goto rdma_ctx_post; ++ + if (dir == DMA_FROM_DEVICE) { + addr = cmd->write_va; + rkey = cmd->write_stag; +@@ -2151,11 +2154,15 @@ isert_rdma_rw_ctx_post(struct isert_cmd *cmd, struct isert_conn *conn, + se_cmd->t_data_sg, se_cmd->t_data_nents, + offset, addr, rkey, dir); + } ++ + if (ret < 0) { + isert_err("Cmd: %p failed to prepare RDMA res\n", cmd); + return ret; + } + ++ cmd->ctx_init_done = true; ++ ++rdma_ctx_post: + ret = rdma_rw_ctx_post(&cmd->rw, conn->qp, port_num, cqe, chain_wr); + if (ret < 0) + isert_err("Cmd: %p failed to post RDMA res\n", cmd); +diff --git a/drivers/infiniband/ulp/isert/ib_isert.h b/drivers/infiniband/ulp/isert/ib_isert.h +index d6fd248320ae..3b296bac4f60 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.h ++++ b/drivers/infiniband/ulp/isert/ib_isert.h +@@ -126,6 +126,7 @@ struct isert_cmd { + struct rdma_rw_ctx rw; + struct work_struct comp_work; + struct scatterlist sg; ++ bool ctx_init_done; + }; + + static inline struct isert_cmd *tx_desc_to_cmd(struct iser_tx_desc *desc) +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index f6697e55c2d4..003b4a4d4b78 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -129,6 +129,7 @@ int intel_svm_enable_prq(struct intel_iommu *iommu) + pr_err("IOMMU: %s: Failed to request IRQ for page request queue\n", + iommu->name); + dmar_free_hwirq(irq); ++ iommu->pr_irq = 0; + goto err; + } + dmar_writeq(iommu->reg + DMAR_PQH_REG, 0ULL); +@@ -144,9 +145,11 @@ int intel_svm_finish_prq(struct intel_iommu *iommu) + dmar_writeq(iommu->reg + DMAR_PQT_REG, 0ULL); + dmar_writeq(iommu->reg + DMAR_PQA_REG, 0ULL); + +- free_irq(iommu->pr_irq, iommu); +- dmar_free_hwirq(iommu->pr_irq); +- iommu->pr_irq = 0; ++ if (iommu->pr_irq) { ++ free_irq(iommu->pr_irq, iommu); ++ dmar_free_hwirq(iommu->pr_irq); ++ iommu->pr_irq = 0; ++ } + + free_pages((unsigned long)iommu->prq, PRQ_ORDER); + iommu->prq = NULL; +diff --git a/drivers/media/dvb-frontends/si2168.c b/drivers/media/dvb-frontends/si2168.c +index 172fc367ccaa..24840a2e5a75 100644 +--- a/drivers/media/dvb-frontends/si2168.c ++++ b/drivers/media/dvb-frontends/si2168.c +@@ -14,6 +14,8 @@ + * GNU General Public License for more details. + */ + ++#include ++ + #include "si2168_priv.h" + + static const struct dvb_frontend_ops si2168_ops; +@@ -435,6 +437,7 @@ static int si2168_init(struct dvb_frontend *fe) + if (ret) + goto err; + ++ udelay(100); + memcpy(cmd.args, "\x85", 1); + cmd.wlen = 1; + cmd.rlen = 1; +diff --git a/drivers/media/pci/bt8xx/bt878.c b/drivers/media/pci/bt8xx/bt878.c +index a5f52137d306..d4bc78b4fcb5 100644 +--- a/drivers/media/pci/bt8xx/bt878.c ++++ b/drivers/media/pci/bt8xx/bt878.c +@@ -422,8 +422,7 @@ static int bt878_probe(struct pci_dev *dev, const struct pci_device_id *pci_id) + bt878_num); + if (bt878_num >= BT878_MAX) { + printk(KERN_ERR "bt878: Too many devices inserted\n"); +- result = -ENOMEM; +- goto fail0; ++ return -ENOMEM; + } + if (pci_enable_device(dev)) + return -EIO; +diff --git a/drivers/media/platform/davinci/vpif_capture.c b/drivers/media/platform/davinci/vpif_capture.c +index 233622bef4a5..dc8fc2120b63 100644 +--- a/drivers/media/platform/davinci/vpif_capture.c ++++ b/drivers/media/platform/davinci/vpif_capture.c +@@ -1397,9 +1397,9 @@ static int vpif_async_bound(struct v4l2_async_notifier *notifier, + vpif_obj.config->chan_config->inputs[i].subdev_name = + (char *)to_of_node(subdev->fwnode)->full_name; + vpif_dbg(2, debug, +- "%s: setting input %d subdev_name = %pOF\n", ++ "%s: setting input %d subdev_name = %s\n", + __func__, i, +- to_of_node(subdev->fwnode)); ++ vpif_obj.config->chan_config->inputs[i].subdev_name); + return 0; + } + } +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c +index 1afde5021ca6..8e9531f7f83f 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c +@@ -1315,6 +1315,12 @@ static int s5p_mfc_probe(struct platform_device *pdev) + goto err_dma; + } + ++ /* ++ * Load fails if fs isn't mounted. Try loading anyway. ++ * _open() will load it, it it fails now. Ignore failure. ++ */ ++ s5p_mfc_load_firmware(dev); ++ + mutex_init(&dev->mfc_mutex); + init_waitqueue_head(&dev->queue); + dev->hw_lock = 0; +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h +index 4220914529b2..76119a8cc477 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h +@@ -290,6 +290,8 @@ struct s5p_mfc_priv_buf { + * @mfc_cmds: cmd structure holding HW commands function pointers + * @mfc_regs: structure holding MFC registers + * @fw_ver: loaded firmware sub-version ++ * @fw_get_done flag set when request_firmware() is complete and ++ * copied into fw_buf + * risc_on: flag indicates RISC is on or off + * + */ +@@ -336,6 +338,7 @@ struct s5p_mfc_dev { + struct s5p_mfc_hw_cmds *mfc_cmds; + const struct s5p_mfc_regs *mfc_regs; + enum s5p_mfc_fw_ver fw_ver; ++ bool fw_get_done; + bool risc_on; /* indicates if RISC is on or off */ + }; + +diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c +index 69ef9c23a99a..d94e59e79fe9 100644 +--- a/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c ++++ b/drivers/media/platform/s5p-mfc/s5p_mfc_ctrl.c +@@ -55,6 +55,9 @@ int s5p_mfc_load_firmware(struct s5p_mfc_dev *dev) + * into kernel. */ + mfc_debug_enter(); + ++ if (dev->fw_get_done) ++ return 0; ++ + for (i = MFC_FW_MAX_VERSIONS - 1; i >= 0; i--) { + if (!dev->variant->fw_name[i]) + continue; +@@ -82,6 +85,7 @@ int s5p_mfc_load_firmware(struct s5p_mfc_dev *dev) + } + memcpy(dev->fw_buf.virt, fw_blob->data, fw_blob->size); + wmb(); ++ dev->fw_get_done = true; + release_firmware(fw_blob); + mfc_debug_leave(); + return 0; +@@ -93,6 +97,7 @@ int s5p_mfc_release_firmware(struct s5p_mfc_dev *dev) + /* Before calling this function one has to make sure + * that MFC is no longer processing */ + s5p_mfc_release_priv_buf(dev, &dev->fw_buf); ++ dev->fw_get_done = false; + return 0; + } + +diff --git a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +index 59280ac31937..23d0cedf4d9d 100644 +--- a/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c ++++ b/drivers/media/platform/sti/c8sectpfe/c8sectpfe-core.c +@@ -83,7 +83,7 @@ static void c8sectpfe_timer_interrupt(unsigned long ac8sectpfei) + static void channel_swdemux_tsklet(unsigned long data) + { + struct channel_info *channel = (struct channel_info *)data; +- struct c8sectpfei *fei = channel->fei; ++ struct c8sectpfei *fei; + unsigned long wp, rp; + int pos, num_packets, n, size; + u8 *buf; +@@ -91,6 +91,8 @@ static void channel_swdemux_tsklet(unsigned long data) + if (unlikely(!channel || !channel->irec)) + return; + ++ fei = channel->fei; ++ + wp = readl(channel->irec + DMA_PRDS_BUSWP_TP(0)); + rp = readl(channel->irec + DMA_PRDS_BUSRP_TP(0)); + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index ccb516f18d72..9c6f2ce3b710 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -2387,6 +2387,7 @@ static int mmc_ext_csd_open(struct inode *inode, struct file *filp) + + if (n != EXT_CSD_STR_LEN) { + err = -EINVAL; ++ kfree(ext_csd); + goto out_free; + } + +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 66c9cf49ad2f..29bfff2ed4d3 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -2751,6 +2751,14 @@ static int mmc_pm_notify(struct notifier_block *notify_block, + if (!err) + break; + ++ if (!mmc_card_is_removable(host)) { ++ dev_warn(mmc_dev(host), ++ "pre_suspend failed for non-removable host: " ++ "%d\n", err); ++ /* Avoid removing non-removable hosts */ ++ break; ++ } ++ + /* Calling bus_ops->remove() with a claimed host can deadlock */ + host->bus_ops->remove(host); + mmc_claim_host(host); +diff --git a/drivers/mmc/host/sdhci-xenon.c b/drivers/mmc/host/sdhci-xenon.c +index 0842bbc2d7ad..4d0791f6ec23 100644 +--- a/drivers/mmc/host/sdhci-xenon.c ++++ b/drivers/mmc/host/sdhci-xenon.c +@@ -230,7 +230,14 @@ static void xenon_set_power(struct sdhci_host *host, unsigned char mode, + mmc_regulator_set_ocr(mmc, mmc->supply.vmmc, vdd); + } + ++static void xenon_voltage_switch(struct sdhci_host *host) ++{ ++ /* Wait for 5ms after set 1.8V signal enable bit */ ++ usleep_range(5000, 5500); ++} ++ + static const struct sdhci_ops sdhci_xenon_ops = { ++ .voltage_switch = xenon_voltage_switch, + .set_clock = sdhci_set_clock, + .set_power = xenon_set_power, + .set_bus_width = sdhci_set_bus_width, +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index 5176be76ca7d..4f3afcf92a7c 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -635,14 +635,27 @@ struct nvsp_message { + #define NETVSC_MTU 65535 + #define NETVSC_MTU_MIN ETH_MIN_MTU + +-#define NETVSC_RECEIVE_BUFFER_SIZE (1024*1024*16) /* 16MB */ +-#define NETVSC_RECEIVE_BUFFER_SIZE_LEGACY (1024*1024*15) /* 15MB */ +-#define NETVSC_SEND_BUFFER_SIZE (1024 * 1024 * 15) /* 15MB */ ++/* Max buffer sizes allowed by a host */ ++#define NETVSC_RECEIVE_BUFFER_SIZE (1024 * 1024 * 31) /* 31MB */ ++#define NETVSC_RECEIVE_BUFFER_SIZE_LEGACY (1024 * 1024 * 15) /* 15MB */ ++#define NETVSC_RECEIVE_BUFFER_DEFAULT (1024 * 1024 * 16) ++ ++#define NETVSC_SEND_BUFFER_SIZE (1024 * 1024 * 15) /* 15MB */ ++#define NETVSC_SEND_BUFFER_DEFAULT (1024 * 1024) ++ + #define NETVSC_INVALID_INDEX -1 + + #define NETVSC_SEND_SECTION_SIZE 6144 + #define NETVSC_RECV_SECTION_SIZE 1728 + ++/* Default size of TX buf: 1MB, RX buf: 16MB */ ++#define NETVSC_MIN_TX_SECTIONS 10 ++#define NETVSC_DEFAULT_TX (NETVSC_SEND_BUFFER_DEFAULT \ ++ / NETVSC_SEND_SECTION_SIZE) ++#define NETVSC_MIN_RX_SECTIONS 10 ++#define NETVSC_DEFAULT_RX (NETVSC_RECEIVE_BUFFER_DEFAULT \ ++ / NETVSC_RECV_SECTION_SIZE) ++ + #define NETVSC_RECEIVE_BUFFER_ID 0xcafe + #define NETVSC_SEND_BUFFER_ID 0 + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 8d5077fb0492..a6bafcf55776 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -262,6 +262,11 @@ static int netvsc_init_buf(struct hv_device *device, + buf_size = device_info->recv_sections * device_info->recv_section_size; + buf_size = roundup(buf_size, PAGE_SIZE); + ++ /* Legacy hosts only allow smaller receive buffer */ ++ if (net_device->nvsp_version <= NVSP_PROTOCOL_VERSION_2) ++ buf_size = min_t(unsigned int, buf_size, ++ NETVSC_RECEIVE_BUFFER_SIZE_LEGACY); ++ + net_device->recv_buf = vzalloc(buf_size); + if (!net_device->recv_buf) { + netdev_err(ndev, +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index a32ae02e1b6c..c849de3cb046 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -46,10 +46,6 @@ + #include "hyperv_net.h" + + #define RING_SIZE_MIN 64 +-#define NETVSC_MIN_TX_SECTIONS 10 +-#define NETVSC_DEFAULT_TX 192 /* ~1M */ +-#define NETVSC_MIN_RX_SECTIONS 10 /* ~64K */ +-#define NETVSC_DEFAULT_RX 10485 /* Max ~16M */ + + #define LINKCHANGE_INT (2 * HZ) + #define VF_TAKEOVER_INT (HZ / 10) +diff --git a/drivers/net/phy/meson-gxl.c b/drivers/net/phy/meson-gxl.c +index 1ea69b7585d9..7ddb709f69fc 100644 +--- a/drivers/net/phy/meson-gxl.c ++++ b/drivers/net/phy/meson-gxl.c +@@ -25,27 +25,53 @@ + + static int meson_gxl_config_init(struct phy_device *phydev) + { ++ int ret; ++ + /* Enable Analog and DSP register Bank access by */ +- phy_write(phydev, 0x14, 0x0000); +- phy_write(phydev, 0x14, 0x0400); +- phy_write(phydev, 0x14, 0x0000); +- phy_write(phydev, 0x14, 0x0400); ++ ret = phy_write(phydev, 0x14, 0x0000); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x0400); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x0000); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x0400); ++ if (ret) ++ return ret; + + /* Write Analog register 23 */ +- phy_write(phydev, 0x17, 0x8E0D); +- phy_write(phydev, 0x14, 0x4417); ++ ret = phy_write(phydev, 0x17, 0x8E0D); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x4417); ++ if (ret) ++ return ret; + + /* Enable fractional PLL */ +- phy_write(phydev, 0x17, 0x0005); +- phy_write(phydev, 0x14, 0x5C1B); ++ ret = phy_write(phydev, 0x17, 0x0005); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x5C1B); ++ if (ret) ++ return ret; + + /* Program fraction FR_PLL_DIV1 */ +- phy_write(phydev, 0x17, 0x029A); +- phy_write(phydev, 0x14, 0x5C1D); ++ ret = phy_write(phydev, 0x17, 0x029A); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x5C1D); ++ if (ret) ++ return ret; + + /* Program fraction FR_PLL_DIV1 */ +- phy_write(phydev, 0x17, 0xAAAA); +- phy_write(phydev, 0x14, 0x5C1C); ++ ret = phy_write(phydev, 0x17, 0xAAAA); ++ if (ret) ++ return ret; ++ ret = phy_write(phydev, 0x14, 0x5C1C); ++ if (ret) ++ return ret; + + return 0; + } +diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c +index 8bf10aba7452..3165bc7b8e1e 100644 +--- a/drivers/net/phy/sfp.c ++++ b/drivers/net/phy/sfp.c +@@ -318,12 +318,12 @@ static void sfp_sm_probe_phy(struct sfp *sfp) + msleep(T_PHY_RESET_MS); + + phy = mdiobus_scan(sfp->i2c_mii, SFP_PHY_ADDR); +- if (IS_ERR(phy)) { +- dev_err(sfp->dev, "mdiobus scan returned %ld\n", PTR_ERR(phy)); ++ if (phy == ERR_PTR(-ENODEV)) { ++ dev_info(sfp->dev, "no PHY detected\n"); + return; + } +- if (!phy) { +- dev_info(sfp->dev, "no PHY detected\n"); ++ if (IS_ERR(phy)) { ++ dev_err(sfp->dev, "mdiobus scan returned %ld\n", PTR_ERR(phy)); + return; + } + +@@ -667,20 +667,19 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee, + len = min_t(unsigned int, last, ETH_MODULE_SFF_8079_LEN); + len -= first; + +- ret = sfp->read(sfp, false, first, data, len); ++ ret = sfp_read(sfp, false, first, data, len); + if (ret < 0) + return ret; + + first += len; + data += len; + } +- if (first >= ETH_MODULE_SFF_8079_LEN && +- first < ETH_MODULE_SFF_8472_LEN) { ++ if (first < ETH_MODULE_SFF_8472_LEN && last > ETH_MODULE_SFF_8079_LEN) { + len = min_t(unsigned int, last, ETH_MODULE_SFF_8472_LEN); + len -= first; + first -= ETH_MODULE_SFF_8079_LEN; + +- ret = sfp->read(sfp, true, first, data, len); ++ ret = sfp_read(sfp, true, first, data, len); + if (ret < 0) + return ret; + } +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index b1632294174f..5d3d31f5933b 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -826,7 +826,7 @@ static int qmi_wwan_resume(struct usb_interface *intf) + + static const struct driver_info qmi_wwan_info = { + .description = "WWAN/QMI device", +- .flags = FLAG_WWAN, ++ .flags = FLAG_WWAN | FLAG_SEND_ZLP, + .bind = qmi_wwan_bind, + .unbind = qmi_wwan_unbind, + .manage_power = qmi_wwan_manage_power, +@@ -835,7 +835,7 @@ static const struct driver_info qmi_wwan_info = { + + static const struct driver_info qmi_wwan_info_quirk_dtr = { + .description = "WWAN/QMI device", +- .flags = FLAG_WWAN, ++ .flags = FLAG_WWAN | FLAG_SEND_ZLP, + .bind = qmi_wwan_bind, + .unbind = qmi_wwan_unbind, + .manage_power = qmi_wwan_manage_power, +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 35b752353aee..252c2206cbb5 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -2553,7 +2553,7 @@ static void ath10k_peer_assoc_h_qos(struct ath10k *ar, + } + break; + case WMI_VDEV_TYPE_STA: +- if (vif->bss_conf.qos) ++ if (sta->wme) + arg->peer_flags |= arvif->ar->wmi.peer_flags->qos; + break; + case WMI_VDEV_TYPE_IBSS: +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index ea18aa7afecb..93256f8bc0b5 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -1664,7 +1664,7 @@ int rtl_tx_agg_oper(struct ieee80211_hw *hw, + void rtl_rx_ampdu_apply(struct rtl_priv *rtlpriv) + { + struct rtl_btc_ops *btc_ops = rtlpriv->btcoexist.btc_ops; +- u8 reject_agg, ctrl_agg_size = 0, agg_size; ++ u8 reject_agg = 0, ctrl_agg_size = 0, agg_size = 0; + + if (rtlpriv->cfg->ops->get_btc_status()) + btc_ops->btc_get_ampdu_cfg(rtlpriv, &reject_agg, +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index 08dc8919ef60..d7331225c5f3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -1568,7 +1568,14 @@ int rtl_pci_reset_trx_ring(struct ieee80211_hw *hw) + dev_kfree_skb_irq(skb); + ring->idx = (ring->idx + 1) % ring->entries; + } ++ ++ if (rtlpriv->use_new_trx_flow) { ++ rtlpci->tx_ring[i].cur_tx_rp = 0; ++ rtlpci->tx_ring[i].cur_tx_wp = 0; ++ } ++ + ring->idx = 0; ++ ring->entries = rtlpci->txringcount[i]; + } + } + spin_unlock_irqrestore(&rtlpriv->locks.irq_th_lock, flags); +diff --git a/drivers/pci/dwc/pcie-designware-ep.c b/drivers/pci/dwc/pcie-designware-ep.c +index d53d5f168363..7c621877a939 100644 +--- a/drivers/pci/dwc/pcie-designware-ep.c ++++ b/drivers/pci/dwc/pcie-designware-ep.c +@@ -197,20 +197,14 @@ static int dw_pcie_ep_map_addr(struct pci_epc *epc, phys_addr_t addr, + static int dw_pcie_ep_get_msi(struct pci_epc *epc) + { + int val; +- u32 lower_addr; +- u32 upper_addr; + struct dw_pcie_ep *ep = epc_get_drvdata(epc); + struct dw_pcie *pci = to_dw_pcie_from_ep(ep); + +- val = dw_pcie_readb_dbi(pci, MSI_MESSAGE_CONTROL); +- val = (val & MSI_CAP_MME_MASK) >> MSI_CAP_MME_SHIFT; +- +- lower_addr = dw_pcie_readl_dbi(pci, MSI_MESSAGE_ADDR_L32); +- upper_addr = dw_pcie_readl_dbi(pci, MSI_MESSAGE_ADDR_U32); +- +- if (!(lower_addr || upper_addr)) ++ val = dw_pcie_readw_dbi(pci, MSI_MESSAGE_CONTROL); ++ if (!(val & MSI_CAP_MSI_EN_MASK)) + return -EINVAL; + ++ val = (val & MSI_CAP_MME_MASK) >> MSI_CAP_MME_SHIFT; + return val; + } + +diff --git a/drivers/pci/dwc/pcie-designware.h b/drivers/pci/dwc/pcie-designware.h +index e5d9d77b778e..cb493bcae8b4 100644 +--- a/drivers/pci/dwc/pcie-designware.h ++++ b/drivers/pci/dwc/pcie-designware.h +@@ -101,6 +101,7 @@ + #define MSI_MESSAGE_CONTROL 0x52 + #define MSI_CAP_MMC_SHIFT 1 + #define MSI_CAP_MME_SHIFT 4 ++#define MSI_CAP_MSI_EN_MASK 0x1 + #define MSI_CAP_MME_MASK (7 << MSI_CAP_MME_SHIFT) + #define MSI_MESSAGE_ADDR_L32 0x54 + #define MSI_MESSAGE_ADDR_U32 0x58 +diff --git a/drivers/pci/endpoint/pci-ep-cfs.c b/drivers/pci/endpoint/pci-ep-cfs.c +index 424fdd6ed1ca..16cec66b1d0b 100644 +--- a/drivers/pci/endpoint/pci-ep-cfs.c ++++ b/drivers/pci/endpoint/pci-ep-cfs.c +@@ -109,7 +109,10 @@ static int pci_epc_epf_link(struct config_item *epc_item, + goto err_add_epf; + + func_no = find_first_zero_bit(&epc_group->function_num_map, +- sizeof(epc_group->function_num_map)); ++ BITS_PER_LONG); ++ if (func_no >= BITS_PER_LONG) ++ return -EINVAL; ++ + set_bit(func_no, &epc_group->function_num_map); + epf->func_no = func_no; + +diff --git a/drivers/pci/host/pcie-rcar.c b/drivers/pci/host/pcie-rcar.c +index f09ff4789bb5..8f44a7d14bff 100644 +--- a/drivers/pci/host/pcie-rcar.c ++++ b/drivers/pci/host/pcie-rcar.c +@@ -1141,7 +1141,9 @@ static int rcar_pcie_probe(struct platform_device *pdev) + + INIT_LIST_HEAD(&pcie->resources); + +- rcar_pcie_parse_request_of_pci_ranges(pcie); ++ err = rcar_pcie_parse_request_of_pci_ranges(pcie); ++ if (err) ++ goto err_free_bridge; + + err = rcar_pcie_get_resources(pcie); + if (err < 0) { +@@ -1196,6 +1198,7 @@ static int rcar_pcie_probe(struct platform_device *pdev) + + err_free_resource_list: + pci_free_resource_list(&pcie->resources); ++err_free_bridge: + pci_free_host_bridge(bridge); + + return err; +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index 56fbe4c3e800..c55517312485 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -1189,19 +1189,16 @@ struct pinctrl_state *pinctrl_lookup_state(struct pinctrl *p, + EXPORT_SYMBOL_GPL(pinctrl_lookup_state); + + /** +- * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * pinctrl_commit_state() - select/activate/program a pinctrl state to HW + * @p: the pinctrl handle for the device that requests configuration + * @state: the state handle to select/activate/program + */ +-int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++static int pinctrl_commit_state(struct pinctrl *p, struct pinctrl_state *state) + { + struct pinctrl_setting *setting, *setting2; + struct pinctrl_state *old_state = p->state; + int ret; + +- if (p->state == state) +- return 0; +- + if (p->state) { + /* + * For each pinmux setting in the old state, forget SW's record +@@ -1265,6 +1262,19 @@ int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) + + return ret; + } ++ ++/** ++ * pinctrl_select_state() - select/activate/program a pinctrl state to HW ++ * @p: the pinctrl handle for the device that requests configuration ++ * @state: the state handle to select/activate/program ++ */ ++int pinctrl_select_state(struct pinctrl *p, struct pinctrl_state *state) ++{ ++ if (p->state == state) ++ return 0; ++ ++ return pinctrl_commit_state(p, state); ++} + EXPORT_SYMBOL_GPL(pinctrl_select_state); + + static void devm_pinctrl_release(struct device *dev, void *res) +@@ -1430,7 +1440,7 @@ void pinctrl_unregister_map(const struct pinctrl_map *map) + int pinctrl_force_sleep(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_sleep)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_sleep); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_sleep); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_sleep); +@@ -1442,7 +1452,7 @@ EXPORT_SYMBOL_GPL(pinctrl_force_sleep); + int pinctrl_force_default(struct pinctrl_dev *pctldev) + { + if (!IS_ERR(pctldev->p) && !IS_ERR(pctldev->hog_default)) +- return pinctrl_select_state(pctldev->p, pctldev->hog_default); ++ return pinctrl_commit_state(pctldev->p, pctldev->hog_default); + return 0; + } + EXPORT_SYMBOL_GPL(pinctrl_force_default); +diff --git a/drivers/pinctrl/pinctrl-rockchip.c b/drivers/pinctrl/pinctrl-rockchip.c +index b5cb7858ffdc..a9bc1e01f982 100644 +--- a/drivers/pinctrl/pinctrl-rockchip.c ++++ b/drivers/pinctrl/pinctrl-rockchip.c +@@ -1989,8 +1989,16 @@ static int rockchip_gpio_get_direction(struct gpio_chip *chip, unsigned offset) + { + struct rockchip_pin_bank *bank = gpiochip_get_data(chip); + u32 data; ++ int ret; + ++ ret = clk_enable(bank->clk); ++ if (ret < 0) { ++ dev_err(bank->drvdata->dev, ++ "failed to enable clock for bank %s\n", bank->name); ++ return ret; ++ } + data = readl_relaxed(bank->reg_base + GPIO_SWPORT_DDR); ++ clk_disable(bank->clk); + + return !(data & BIT(offset)); + } +diff --git a/drivers/platform/chrome/cros_ec_proto.c b/drivers/platform/chrome/cros_ec_proto.c +index 8dfa7fcb1248..e7bbdf947bbc 100644 +--- a/drivers/platform/chrome/cros_ec_proto.c ++++ b/drivers/platform/chrome/cros_ec_proto.c +@@ -60,12 +60,14 @@ static int send_command(struct cros_ec_device *ec_dev, + struct cros_ec_command *msg) + { + int ret; ++ int (*xfer_fxn)(struct cros_ec_device *ec, struct cros_ec_command *msg); + + if (ec_dev->proto_version > 2) +- ret = ec_dev->pkt_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->pkt_xfer; + else +- ret = ec_dev->cmd_xfer(ec_dev, msg); ++ xfer_fxn = ec_dev->cmd_xfer; + ++ ret = (*xfer_fxn)(ec_dev, msg); + if (msg->result == EC_RES_IN_PROGRESS) { + int i; + struct cros_ec_command *status_msg; +@@ -88,7 +90,7 @@ static int send_command(struct cros_ec_device *ec_dev, + for (i = 0; i < EC_COMMAND_RETRIES; i++) { + usleep_range(10000, 11000); + +- ret = ec_dev->cmd_xfer(ec_dev, status_msg); ++ ret = (*xfer_fxn)(ec_dev, status_msg); + if (ret < 0) + break; + +diff --git a/drivers/platform/chrome/cros_ec_sysfs.c b/drivers/platform/chrome/cros_ec_sysfs.c +index f3baf9973989..24f1630a8b3f 100644 +--- a/drivers/platform/chrome/cros_ec_sysfs.c ++++ b/drivers/platform/chrome/cros_ec_sysfs.c +@@ -187,7 +187,7 @@ static ssize_t show_ec_version(struct device *dev, + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: EC error %d\n", msg->result); + else { +- msg->data[sizeof(msg->data) - 1] = '\0'; ++ msg->data[EC_HOST_PARAM_SIZE - 1] = '\0'; + count += scnprintf(buf + count, PAGE_SIZE - count, + "Build info: %s\n", msg->data); + } +diff --git a/drivers/rtc/rtc-ac100.c b/drivers/rtc/rtc-ac100.c +index 9e336184491c..0e358d4b6738 100644 +--- a/drivers/rtc/rtc-ac100.c ++++ b/drivers/rtc/rtc-ac100.c +@@ -567,6 +567,12 @@ static int ac100_rtc_probe(struct platform_device *pdev) + return chip->irq; + } + ++ chip->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(chip->rtc)) ++ return PTR_ERR(chip->rtc); ++ ++ chip->rtc->ops = &ac100_rtc_ops; ++ + ret = devm_request_threaded_irq(&pdev->dev, chip->irq, NULL, + ac100_rtc_irq, + IRQF_SHARED | IRQF_ONESHOT, +@@ -586,17 +592,16 @@ static int ac100_rtc_probe(struct platform_device *pdev) + /* clear counter alarm pending interrupts */ + regmap_write(chip->regmap, AC100_ALM_INT_STA, AC100_ALM_INT_ENABLE); + +- chip->rtc = devm_rtc_device_register(&pdev->dev, "rtc-ac100", +- &ac100_rtc_ops, THIS_MODULE); +- if (IS_ERR(chip->rtc)) { +- dev_err(&pdev->dev, "unable to register device\n"); +- return PTR_ERR(chip->rtc); +- } +- + ret = ac100_rtc_register_clks(chip); + if (ret) + return ret; + ++ ret = rtc_register_device(chip->rtc); ++ if (ret) { ++ dev_err(&pdev->dev, "unable to register device\n"); ++ return ret; ++ } ++ + dev_info(&pdev->dev, "RTC enabled\n"); + + return 0; +diff --git a/drivers/scsi/lpfc/lpfc_ct.c b/drivers/scsi/lpfc/lpfc_ct.c +index 33417681f5d4..126723a5bc6f 100644 +--- a/drivers/scsi/lpfc/lpfc_ct.c ++++ b/drivers/scsi/lpfc/lpfc_ct.c +@@ -471,6 +471,7 @@ lpfc_prep_node_fc4type(struct lpfc_vport *vport, uint32_t Did, uint8_t fc4_type) + "Parse GID_FTrsp: did:x%x flg:x%x x%x", + Did, ndlp->nlp_flag, vport->fc_flag); + ++ ndlp->nlp_fc4_type &= ~(NLP_FC4_FCP | NLP_FC4_NVME); + /* By default, the driver expects to support FCP FC4 */ + if (fc4_type == FC_TYPE_FCP) + ndlp->nlp_fc4_type |= NLP_FC4_FCP; +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 3ebf6ccba6e6..91783dbdf10c 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -2088,6 +2088,10 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + ndlp = (struct lpfc_nodelist *) cmdiocb->context1; + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag &= ~NLP_PRLI_SND; ++ ++ /* Driver supports multiple FC4 types. Counters matter. */ ++ vport->fc_prli_sent--; ++ ndlp->fc4_prli_sent--; + spin_unlock_irq(shost->host_lock); + + lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, +@@ -2095,9 +2099,6 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + irsp->ulpStatus, irsp->un.ulpWord[4], + ndlp->nlp_DID); + +- /* Ddriver supports multiple FC4 types. Counters matter. */ +- vport->fc_prli_sent--; +- + /* PRLI completes to NPort */ + lpfc_printf_vlog(vport, KERN_INFO, LOG_ELS, + "0103 PRLI completes to NPort x%06x " +@@ -2111,7 +2112,6 @@ lpfc_cmpl_els_prli(struct lpfc_hba *phba, struct lpfc_iocbq *cmdiocb, + + if (irsp->ulpStatus) { + /* Check for retry */ +- ndlp->fc4_prli_sent--; + if (lpfc_els_retry(phba, cmdiocb, rspiocb)) { + /* ELS command is being retried */ + goto out; +@@ -2190,6 +2190,15 @@ lpfc_issue_els_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + ndlp->nlp_fc4_type |= NLP_FC4_NVME; + local_nlp_type = ndlp->nlp_fc4_type; + ++ /* This routine will issue 1 or 2 PRLIs, so zero all the ndlp ++ * fields here before any of them can complete. ++ */ ++ ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); ++ ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); ++ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ ndlp->nlp_flag &= ~NLP_FIRSTBURST; ++ ndlp->nvme_fb_size = 0; ++ + send_next_prli: + if (local_nlp_type & NLP_FC4_FCP) { + /* Payload is 4 + 16 = 20 x14 bytes. */ +@@ -2298,6 +2307,13 @@ lpfc_issue_els_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + elsiocb->iocb_cmpl = lpfc_cmpl_els_prli; + spin_lock_irq(shost->host_lock); + ndlp->nlp_flag |= NLP_PRLI_SND; ++ ++ /* The vport counters are used for lpfc_scan_finished, but ++ * the ndlp is used to track outstanding PRLIs for different ++ * FC4 types. ++ */ ++ vport->fc_prli_sent++; ++ ndlp->fc4_prli_sent++; + spin_unlock_irq(shost->host_lock); + if (lpfc_sli_issue_iocb(phba, LPFC_ELS_RING, elsiocb, 0) == + IOCB_ERROR) { +@@ -2308,12 +2324,6 @@ lpfc_issue_els_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + return 1; + } + +- /* The vport counters are used for lpfc_scan_finished, but +- * the ndlp is used to track outstanding PRLIs for different +- * FC4 types. +- */ +- vport->fc_prli_sent++; +- ndlp->fc4_prli_sent++; + + /* The driver supports 2 FC4 types. Make sure + * a PRLI is issued for all types before exiting. +diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c +index b6957d944b9a..d489f6827cc1 100644 +--- a/drivers/scsi/lpfc/lpfc_nportdisc.c ++++ b/drivers/scsi/lpfc/lpfc_nportdisc.c +@@ -390,6 +390,11 @@ lpfc_rcv_plogi(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + break; + } + ++ ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); ++ ndlp->nlp_type &= ~(NLP_NVME_TARGET | NLP_NVME_INITIATOR); ++ ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; ++ ndlp->nlp_flag &= ~NLP_FIRSTBURST; ++ + /* Check for Nport to NPort pt2pt protocol */ + if ((vport->fc_flag & FC_PT2PT) && + !(vport->fc_flag & FC_PT2PT_PLOGI)) { +@@ -742,9 +747,6 @@ lpfc_rcv_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + lp = (uint32_t *) pcmd->virt; + npr = (PRLI *) ((uint8_t *) lp + sizeof (uint32_t)); + +- ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); +- ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; +- ndlp->nlp_flag &= ~NLP_FIRSTBURST; + if ((npr->prliType == PRLI_FCP_TYPE) || + (npr->prliType == PRLI_NVME_TYPE)) { + if (npr->initiatorFunc) { +@@ -769,8 +771,12 @@ lpfc_rcv_prli(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + * type. Target mode does not issue gft_id so doesn't get + * the fc4 type set until now. + */ +- if ((phba->nvmet_support) && (npr->prliType == PRLI_NVME_TYPE)) ++ if (phba->nvmet_support && (npr->prliType == PRLI_NVME_TYPE)) { + ndlp->nlp_fc4_type |= NLP_FC4_NVME; ++ lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); ++ } ++ if (npr->prliType == PRLI_FCP_TYPE) ++ ndlp->nlp_fc4_type |= NLP_FC4_FCP; + } + if (rport) { + /* We need to update the rport role values */ +@@ -1552,7 +1558,6 @@ lpfc_rcv_prli_reglogin_issue(struct lpfc_vport *vport, + if (ndlp->nlp_flag & NLP_RPI_REGISTERED) { + lpfc_rcv_prli(vport, ndlp, cmdiocb); + lpfc_els_rsp_prli_acc(vport, cmdiocb, ndlp); +- lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); + } else { + /* RPI registration has not completed. Reject the PRLI + * to prevent an illegal state transition when the +@@ -1564,10 +1569,11 @@ lpfc_rcv_prli_reglogin_issue(struct lpfc_vport *vport, + ndlp->nlp_rpi, ndlp->nlp_state, + ndlp->nlp_flag); + memset(&stat, 0, sizeof(struct ls_rjt)); +- stat.un.b.lsRjtRsnCode = LSRJT_UNABLE_TPC; +- stat.un.b.lsRjtRsnCodeExp = LSEXP_CMD_IN_PROGRESS; ++ stat.un.b.lsRjtRsnCode = LSRJT_LOGICAL_BSY; ++ stat.un.b.lsRjtRsnCodeExp = LSEXP_NOTHING_MORE; + lpfc_els_rsp_reject(vport, stat.un.lsRjtError, cmdiocb, + ndlp, NULL); ++ return ndlp->nlp_state; + } + } else { + /* Initiator mode. */ +@@ -1922,13 +1928,6 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + return ndlp->nlp_state; + } + +- /* Check out PRLI rsp */ +- ndlp->nlp_type &= ~(NLP_FCP_TARGET | NLP_FCP_INITIATOR); +- ndlp->nlp_fcp_info &= ~NLP_FCP_2_DEVICE; +- +- /* NVME or FCP first burst must be negotiated for each PRLI. */ +- ndlp->nlp_flag &= ~NLP_FIRSTBURST; +- ndlp->nvme_fb_size = 0; + if (npr && (npr->acceptRspCode == PRLI_REQ_EXECUTED) && + (npr->prliType == PRLI_FCP_TYPE)) { + lpfc_printf_vlog(vport, KERN_INFO, LOG_NVME_DISC, +@@ -1945,8 +1944,6 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + if (npr->Retry) + ndlp->nlp_fcp_info |= NLP_FCP_2_DEVICE; + +- /* PRLI completed. Decrement count. */ +- ndlp->fc4_prli_sent--; + } else if (nvpr && + (bf_get_be32(prli_acc_rsp_code, nvpr) == + PRLI_REQ_EXECUTED) && +@@ -1991,8 +1988,6 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + be32_to_cpu(nvpr->word5), + ndlp->nlp_flag, ndlp->nlp_fcp_info, + ndlp->nlp_type); +- /* PRLI completed. Decrement count. */ +- ndlp->fc4_prli_sent--; + } + if (!(ndlp->nlp_type & NLP_FCP_TARGET) && + (vport->port_type == LPFC_NPIV_PORT) && +@@ -2016,7 +2011,8 @@ lpfc_cmpl_prli_prli_issue(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp, + ndlp->nlp_prev_state = NLP_STE_PRLI_ISSUE; + if (ndlp->nlp_type & (NLP_FCP_TARGET | NLP_NVME_TARGET)) + lpfc_nlp_set_state(vport, ndlp, NLP_STE_MAPPED_NODE); +- else ++ else if (ndlp->nlp_type & ++ (NLP_FCP_INITIATOR | NLP_NVME_INITIATOR)) + lpfc_nlp_set_state(vport, ndlp, NLP_STE_UNMAPPED_NODE); + } else + lpfc_printf_vlog(vport, +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 11bd2e698b84..4bf406df051b 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -190,36 +190,30 @@ inline void megasas_return_cmd_fusion(struct megasas_instance *instance, + /** + * megasas_fire_cmd_fusion - Sends command to the FW + * @instance: Adapter soft state +- * @req_desc: 32bit or 64bit Request descriptor ++ * @req_desc: 64bit Request descriptor + * +- * Perform PCI Write. Ventura supports 32 bit Descriptor. +- * Prior to Ventura (12G) MR controller supports 64 bit Descriptor. ++ * Perform PCI Write. + */ + + static void + megasas_fire_cmd_fusion(struct megasas_instance *instance, + union MEGASAS_REQUEST_DESCRIPTOR_UNION *req_desc) + { +- if (instance->is_ventura) +- writel(le32_to_cpu(req_desc->u.low), +- &instance->reg_set->inbound_single_queue_port); +- else { + #if defined(writeq) && defined(CONFIG_64BIT) +- u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) | +- le32_to_cpu(req_desc->u.low)); ++ u64 req_data = (((u64)le32_to_cpu(req_desc->u.high) << 32) | ++ le32_to_cpu(req_desc->u.low)); + +- writeq(req_data, &instance->reg_set->inbound_low_queue_port); ++ writeq(req_data, &instance->reg_set->inbound_low_queue_port); + #else +- unsigned long flags; +- spin_lock_irqsave(&instance->hba_lock, flags); +- writel(le32_to_cpu(req_desc->u.low), +- &instance->reg_set->inbound_low_queue_port); +- writel(le32_to_cpu(req_desc->u.high), +- &instance->reg_set->inbound_high_queue_port); +- mmiowb(); +- spin_unlock_irqrestore(&instance->hba_lock, flags); ++ unsigned long flags; ++ spin_lock_irqsave(&instance->hba_lock, flags); ++ writel(le32_to_cpu(req_desc->u.low), ++ &instance->reg_set->inbound_low_queue_port); ++ writel(le32_to_cpu(req_desc->u.high), ++ &instance->reg_set->inbound_high_queue_port); ++ mmiowb(); ++ spin_unlock_irqrestore(&instance->hba_lock, flags); + #endif +- } + } + + /** +@@ -772,7 +766,6 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + const char *sys_info; + MFI_CAPABILITIES *drv_ops; + u32 scratch_pad_2; +- unsigned long flags; + + fusion = instance->ctrl_context; + +@@ -900,14 +893,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + break; + } + +- /* For Ventura also IOC INIT required 64 bit Descriptor write. */ +- spin_lock_irqsave(&instance->hba_lock, flags); +- writel(le32_to_cpu(req_desc.u.low), +- &instance->reg_set->inbound_low_queue_port); +- writel(le32_to_cpu(req_desc.u.high), +- &instance->reg_set->inbound_high_queue_port); +- mmiowb(); +- spin_unlock_irqrestore(&instance->hba_lock, flags); ++ megasas_fire_cmd_fusion(instance, &req_desc); + + wait_and_poll(instance, cmd, MFI_POLL_TIMEOUT_SECS); + +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 87999905bca3..6efa739a1912 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -5659,14 +5659,14 @@ _base_reset_handler(struct MPT3SAS_ADAPTER *ioc, int reset_phase) + } + + /** +- * _wait_for_commands_to_complete - reset controller ++ * mpt3sas_wait_for_commands_to_complete - reset controller + * @ioc: Pointer to MPT_ADAPTER structure + * + * This function waiting(3s) for all pending commands to complete + * prior to putting controller in reset. + */ +-static void +-_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc) ++void ++mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc) + { + u32 ioc_state; + unsigned long flags; +@@ -5745,7 +5745,7 @@ mpt3sas_base_hard_reset_handler(struct MPT3SAS_ADAPTER *ioc, + is_fault = 1; + } + _base_reset_handler(ioc, MPT3_IOC_PRE_RESET); +- _wait_for_commands_to_complete(ioc); ++ mpt3sas_wait_for_commands_to_complete(ioc); + _base_mask_interrupts(ioc); + r = _base_make_ioc_ready(ioc, type); + if (r) +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h +index a77bb7dc12b1..2948cb7e9ae6 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.h ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.h +@@ -1292,6 +1292,9 @@ void mpt3sas_base_update_missing_delay(struct MPT3SAS_ADAPTER *ioc, + + int mpt3sas_port_enable(struct MPT3SAS_ADAPTER *ioc); + ++void ++mpt3sas_wait_for_commands_to_complete(struct MPT3SAS_ADAPTER *ioc); ++ + + /* scsih shared API */ + u8 mpt3sas_scsih_event_callback(struct MPT3SAS_ADAPTER *ioc, u8 msix_index, +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 33ff691878e2..beb4bf8fe9b0 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -2471,7 +2471,8 @@ scsih_abort(struct scsi_cmnd *scmd) + _scsih_tm_display_info(ioc, scmd); + + sas_device_priv_data = scmd->device->hostdata; +- if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { ++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target || ++ ioc->remove_host) { + sdev_printk(KERN_INFO, scmd->device, + "device been deleted! scmd(%p)\n", scmd); + scmd->result = DID_NO_CONNECT << 16; +@@ -2533,7 +2534,8 @@ scsih_dev_reset(struct scsi_cmnd *scmd) + _scsih_tm_display_info(ioc, scmd); + + sas_device_priv_data = scmd->device->hostdata; +- if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { ++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target || ++ ioc->remove_host) { + sdev_printk(KERN_INFO, scmd->device, + "device been deleted! scmd(%p)\n", scmd); + scmd->result = DID_NO_CONNECT << 16; +@@ -2595,7 +2597,8 @@ scsih_target_reset(struct scsi_cmnd *scmd) + _scsih_tm_display_info(ioc, scmd); + + sas_device_priv_data = scmd->device->hostdata; +- if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { ++ if (!sas_device_priv_data || !sas_device_priv_data->sas_target || ++ ioc->remove_host) { + starget_printk(KERN_INFO, starget, "target been deleted! scmd(%p)\n", + scmd); + scmd->result = DID_NO_CONNECT << 16; +@@ -2652,7 +2655,7 @@ scsih_host_reset(struct scsi_cmnd *scmd) + ioc->name, scmd); + scsi_print_command(scmd); + +- if (ioc->is_driver_loading) { ++ if (ioc->is_driver_loading || ioc->remove_host) { + pr_info(MPT3SAS_FMT "Blocking the host reset\n", + ioc->name); + r = FAILED; +@@ -3957,7 +3960,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc) + _scsih_set_satl_pending(scmd, false); + mpt3sas_base_free_smid(ioc, smid); + scsi_dma_unmap(scmd); +- if (ioc->pci_error_recovery) ++ if (ioc->pci_error_recovery || ioc->remove_host) + scmd->result = DID_NO_CONNECT << 16; + else + scmd->result = DID_RESET << 16; +@@ -8240,6 +8243,10 @@ static void scsih_remove(struct pci_dev *pdev) + unsigned long flags; + + ioc->remove_host = 1; ++ ++ mpt3sas_wait_for_commands_to_complete(ioc); ++ _scsih_flush_running_cmds(ioc); ++ + _scsih_fw_event_cleanup_queue(ioc); + + spin_lock_irqsave(&ioc->fw_event_lock, flags); +@@ -8310,6 +8317,10 @@ scsih_shutdown(struct pci_dev *pdev) + unsigned long flags; + + ioc->remove_host = 1; ++ ++ mpt3sas_wait_for_commands_to_complete(ioc); ++ _scsih_flush_running_cmds(ioc); ++ + _scsih_fw_event_cleanup_queue(ioc); + + spin_lock_irqsave(&ioc->fw_event_lock, flags); +diff --git a/drivers/soc/qcom/smsm.c b/drivers/soc/qcom/smsm.c +index 403bea9d546b..50214b620865 100644 +--- a/drivers/soc/qcom/smsm.c ++++ b/drivers/soc/qcom/smsm.c +@@ -496,8 +496,10 @@ static int qcom_smsm_probe(struct platform_device *pdev) + if (!smsm->hosts) + return -ENOMEM; + +- local_node = of_find_node_with_property(of_node_get(pdev->dev.of_node), +- "#qcom,smem-state-cells"); ++ for_each_child_of_node(pdev->dev.of_node, local_node) { ++ if (of_find_property(local_node, "#qcom,smem-state-cells", NULL)) ++ break; ++ } + if (!local_node) { + dev_err(&pdev->dev, "no state entry\n"); + return -EINVAL; +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 837bb95eea62..092a5fc85b9a 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -55,6 +55,8 @@ struct sh_msiof_spi_priv { + void *rx_dma_page; + dma_addr_t tx_dma_addr; + dma_addr_t rx_dma_addr; ++ bool native_cs_inited; ++ bool native_cs_high; + bool slave_aborted; + }; + +@@ -528,8 +530,7 @@ static int sh_msiof_spi_setup(struct spi_device *spi) + { + struct device_node *np = spi->master->dev.of_node; + struct sh_msiof_spi_priv *p = spi_master_get_devdata(spi->master); +- +- pm_runtime_get_sync(&p->pdev->dev); ++ u32 clr, set, tmp; + + if (!np) { + /* +@@ -539,19 +540,31 @@ static int sh_msiof_spi_setup(struct spi_device *spi) + spi->cs_gpio = (uintptr_t)spi->controller_data; + } + +- /* Configure pins before deasserting CS */ +- sh_msiof_spi_set_pin_regs(p, !!(spi->mode & SPI_CPOL), +- !!(spi->mode & SPI_CPHA), +- !!(spi->mode & SPI_3WIRE), +- !!(spi->mode & SPI_LSB_FIRST), +- !!(spi->mode & SPI_CS_HIGH)); +- +- if (spi->cs_gpio >= 0) ++ if (spi->cs_gpio >= 0) { + gpio_set_value(spi->cs_gpio, !(spi->mode & SPI_CS_HIGH)); ++ return 0; ++ } + ++ if (spi_controller_is_slave(p->master)) ++ return 0; + +- pm_runtime_put(&p->pdev->dev); ++ if (p->native_cs_inited && ++ (p->native_cs_high == !!(spi->mode & SPI_CS_HIGH))) ++ return 0; + ++ /* Configure native chip select mode/polarity early */ ++ clr = MDR1_SYNCMD_MASK; ++ set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI; ++ if (spi->mode & SPI_CS_HIGH) ++ clr |= BIT(MDR1_SYNCAC_SHIFT); ++ else ++ set |= BIT(MDR1_SYNCAC_SHIFT); ++ pm_runtime_get_sync(&p->pdev->dev); ++ tmp = sh_msiof_read(p, TMDR1) & ~clr; ++ sh_msiof_write(p, TMDR1, tmp | set); ++ pm_runtime_put(&p->pdev->dev); ++ p->native_cs_high = spi->mode & SPI_CS_HIGH; ++ p->native_cs_inited = true; + return 0; + } + +diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c +index d9941b0c468d..893b2836089c 100644 +--- a/drivers/staging/android/ashmem.c ++++ b/drivers/staging/android/ashmem.c +@@ -709,16 +709,14 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, + size_t pgstart, pgend; + int ret = -EINVAL; + ++ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) ++ return -EFAULT; ++ + mutex_lock(&ashmem_mutex); + + if (unlikely(!asma->file)) + goto out_unlock; + +- if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { +- ret = -EFAULT; +- goto out_unlock; +- } +- + /* per custom, you can pass zero for len to mean "everything onward" */ + if (!pin.len) + pin.len = PAGE_ALIGN(asma->size) - pin.offset; +diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig +index cc2b4d9433ed..b811442c5ce6 100644 +--- a/drivers/tty/Kconfig ++++ b/drivers/tty/Kconfig +@@ -394,10 +394,14 @@ config GOLDFISH_TTY + depends on GOLDFISH + select SERIAL_CORE + select SERIAL_CORE_CONSOLE +- select SERIAL_EARLYCON + help + Console and system TTY driver for the Goldfish virtual platform. + ++config GOLDFISH_TTY_EARLY_CONSOLE ++ bool ++ default y if GOLDFISH_TTY=y ++ select SERIAL_EARLYCON ++ + config DA_TTY + bool "DA TTY" + depends on METAG_DA +diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c +index 381e981dee06..85a500ddbcaa 100644 +--- a/drivers/tty/goldfish.c ++++ b/drivers/tty/goldfish.c +@@ -442,6 +442,7 @@ static int goldfish_tty_remove(struct platform_device *pdev) + return 0; + } + ++#ifdef CONFIG_GOLDFISH_TTY_EARLY_CONSOLE + static void gf_early_console_putchar(struct uart_port *port, int ch) + { + __raw_writel(ch, port->membase); +@@ -465,6 +466,7 @@ static int __init gf_earlycon_setup(struct earlycon_device *device, + } + + OF_EARLYCON_DECLARE(early_gf_tty, "google,goldfish-tty", gf_earlycon_setup); ++#endif + + static const struct of_device_id goldfish_tty_of_match[] = { + { .compatible = "google,goldfish-tty", }, +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 7e638997bfc2..3015789265dd 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -513,7 +513,8 @@ static int dw8250_probe(struct platform_device *pdev) + /* If no clock rate is defined, fail. */ + if (!p->uartclk) { + dev_err(dev, "clock rate not defined\n"); +- return -EINVAL; ++ err = -EINVAL; ++ goto err_clk; + } + + data->pclk = devm_clk_get(dev, "apb_pclk"); +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 908110b5cf10..0d814a87acb2 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -3389,11 +3389,9 @@ static int serial_pci_is_class_communication(struct pci_dev *dev) + /* + * If it is not a communications device or the programming + * interface is greater than 6, give up. +- * +- * (Should we try to make guesses for multiport serial devices +- * later?) + */ + if ((((dev->class >> 8) != PCI_CLASS_COMMUNICATION_SERIAL) && ++ ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MULTISERIAL) && + ((dev->class >> 8) != PCI_CLASS_COMMUNICATION_MODEM)) || + (dev->class & 0xff) > 6) + return -ENODEV; +@@ -3430,6 +3428,12 @@ serial_pci_guess_board(struct pci_dev *dev, struct pciserial_board *board) + { + int num_iomem, num_port, first_port = -1, i; + ++ /* ++ * Should we try to make guesses for multiport serial devices later? ++ */ ++ if ((dev->class >> 8) == PCI_CLASS_COMMUNICATION_MULTISERIAL) ++ return -ENODEV; ++ + num_iomem = num_port = 0; + for (i = 0; i < PCI_NUM_BAR_RESOURCES; i++) { + if (pci_resource_flags(dev, i) & IORESOURCE_IO) { +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 7892d0be8af9..7e77bd2118ad 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -1481,6 +1481,8 @@ static void release_tty(struct tty_struct *tty, int idx) + if (tty->link) + tty->link->port->itty = NULL; + tty_buffer_cancel_work(tty->port); ++ if (tty->link) ++ tty_buffer_cancel_work(tty->link->port); + + tty_kref_put(tty->link); + tty_kref_put(tty); +diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c +index 445b1dc5d441..a17ba1465815 100644 +--- a/drivers/video/console/vgacon.c ++++ b/drivers/video/console/vgacon.c +@@ -422,7 +422,10 @@ static const char *vgacon_startup(void) + vga_video_port_val = VGA_CRT_DM; + if ((screen_info.orig_video_ega_bx & 0xff) != 0x10) { + static struct resource ega_console_resource = +- { .name = "ega", .start = 0x3B0, .end = 0x3BF }; ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_EGAM; + vga_vram_size = 0x8000; + display_desc = "EGA+"; +@@ -430,9 +433,15 @@ static const char *vgacon_startup(void) + &ega_console_resource); + } else { + static struct resource mda1_console_resource = +- { .name = "mda", .start = 0x3B0, .end = 0x3BB }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3B0, ++ .end = 0x3BB }; + static struct resource mda2_console_resource = +- { .name = "mda", .start = 0x3BF, .end = 0x3BF }; ++ { .name = "mda", ++ .flags = IORESOURCE_IO, ++ .start = 0x3BF, ++ .end = 0x3BF }; + vga_video_type = VIDEO_TYPE_MDA; + vga_vram_size = 0x2000; + display_desc = "*MDA"; +@@ -454,15 +463,21 @@ static const char *vgacon_startup(void) + vga_vram_size = 0x8000; + + if (!screen_info.orig_video_isVGA) { +- static struct resource ega_console_resource +- = { .name = "ega", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource ega_console_resource = ++ { .name = "ega", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_EGAC; + display_desc = "EGA"; + request_resource(&ioport_resource, + &ega_console_resource); + } else { +- static struct resource vga_console_resource +- = { .name = "vga+", .start = 0x3C0, .end = 0x3DF }; ++ static struct resource vga_console_resource = ++ { .name = "vga+", ++ .flags = IORESOURCE_IO, ++ .start = 0x3C0, ++ .end = 0x3DF }; + vga_video_type = VIDEO_TYPE_VGAC; + display_desc = "VGA+"; + request_resource(&ioport_resource, +@@ -494,7 +509,10 @@ static const char *vgacon_startup(void) + } + } else { + static struct resource cga_console_resource = +- { .name = "cga", .start = 0x3D4, .end = 0x3D5 }; ++ { .name = "cga", ++ .flags = IORESOURCE_IO, ++ .start = 0x3D4, ++ .end = 0x3D5 }; + vga_video_type = VIDEO_TYPE_CGA; + vga_vram_size = 0x2000; + display_desc = "*CGA"; +diff --git a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c +index 57e9e146ff74..4aeb908f2d1e 100644 +--- a/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c ++++ b/drivers/video/fbdev/omap2/omapfb/displays/panel-tpo-td028ttec1.c +@@ -455,6 +455,8 @@ static int td028ttec1_panel_remove(struct spi_device *spi) + } + + static const struct of_device_id td028ttec1_of_match[] = { ++ { .compatible = "omapdss,tpo,td028ttec1", }, ++ /* keep to not break older DTB */ + { .compatible = "omapdss,toppoly,td028ttec1", }, + {}, + }; +@@ -474,6 +476,7 @@ static struct spi_driver td028ttec1_spi_driver = { + + module_spi_driver(td028ttec1_spi_driver); + ++MODULE_ALIAS("spi:tpo,td028ttec1"); + MODULE_ALIAS("spi:toppoly,td028ttec1"); + MODULE_AUTHOR("H. Nikolaus Schaller "); + MODULE_DESCRIPTION("Toppoly TD028TTEC1 panel driver"); +diff --git a/drivers/watchdog/watchdog_dev.c b/drivers/watchdog/watchdog_dev.c +index 0826e663bd5a..b30fb637ae94 100644 +--- a/drivers/watchdog/watchdog_dev.c ++++ b/drivers/watchdog/watchdog_dev.c +@@ -768,6 +768,7 @@ static int watchdog_open(struct inode *inode, struct file *file) + { + struct watchdog_core_data *wd_data; + struct watchdog_device *wdd; ++ bool hw_running; + int err; + + /* Get the corresponding watchdog device */ +@@ -787,7 +788,8 @@ static int watchdog_open(struct inode *inode, struct file *file) + * If the /dev/watchdog device is open, we don't want the module + * to be unloaded. + */ +- if (!watchdog_hw_running(wdd) && !try_module_get(wdd->ops->owner)) { ++ hw_running = watchdog_hw_running(wdd); ++ if (!hw_running && !try_module_get(wdd->ops->owner)) { + err = -EBUSY; + goto out_clear; + } +@@ -798,7 +800,7 @@ static int watchdog_open(struct inode *inode, struct file *file) + + file->private_data = wd_data; + +- if (!watchdog_hw_running(wdd)) ++ if (!hw_running) + kref_get(&wd_data->kref); + + /* dev/watchdog is a virtual (and thus non-seekable) filesystem */ +@@ -964,14 +966,13 @@ static int watchdog_cdev_register(struct watchdog_device *wdd, dev_t devno) + * and schedule an immediate ping. + */ + if (watchdog_hw_running(wdd)) { +- if (handle_boot_enabled) { +- __module_get(wdd->ops->owner); +- kref_get(&wd_data->kref); ++ __module_get(wdd->ops->owner); ++ kref_get(&wd_data->kref); ++ if (handle_boot_enabled) + queue_delayed_work(watchdog_wq, &wd_data->work, 0); +- } else { ++ else + pr_info("watchdog%d running and kernel based pre-userspace handler disabled\n", +- wdd->id); +- } ++ wdd->id); + } + + return 0; +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 8487486ec496..8ce60986fb75 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1372,14 +1372,14 @@ nfsd4_layoutget(struct svc_rqst *rqstp, + const struct nfsd4_layout_ops *ops; + struct nfs4_layout_stateid *ls; + __be32 nfserr; +- int accmode; ++ int accmode = NFSD_MAY_READ_IF_EXEC; + + switch (lgp->lg_seg.iomode) { + case IOMODE_READ: +- accmode = NFSD_MAY_READ; ++ accmode |= NFSD_MAY_READ; + break; + case IOMODE_RW: +- accmode = NFSD_MAY_READ | NFSD_MAY_WRITE; ++ accmode |= NFSD_MAY_READ | NFSD_MAY_WRITE; + break; + default: + dprintk("%s: invalid iomode %d\n", +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index 8f9fc6e5539a..bfb4a9d962a5 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -432,8 +432,8 @@ struct mlx5_core_srq { + struct mlx5_core_rsc_common common; /* must be first */ + u32 srqn; + int max; +- int max_gs; +- int max_avail_gather; ++ size_t max_gs; ++ size_t max_avail_gather; + int wqe_shift; + void (*event) (struct mlx5_core_srq *, enum mlx5_event); + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 1933654007c4..23e6d5532b5c 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -303,8 +303,10 @@ static int erspan_rcv(struct sk_buff *skb, struct tnl_ptk_info *tpi, + return PACKET_REJECT; + + md = ip_tunnel_info_opts(&tun_dst->u.tun_info); +- if (!md) ++ if (!md) { ++ dst_release((struct dst_entry *)tun_dst); + return PACKET_REJECT; ++ } + + md->index = index; + info = &tun_dst->u.tun_info; +@@ -408,11 +410,13 @@ static int gre_rcv(struct sk_buff *skb) + if (unlikely(tpi.proto == htons(ETH_P_ERSPAN))) { + if (erspan_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) + return 0; ++ goto out; + } + + if (ipgre_rcv(skb, &tpi, hdr_len) == PACKET_RCVD) + return 0; + ++out: + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); + drop: + kfree_skb(skb); +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index bcdc2d557de1..413f01be0c9b 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -626,6 +626,7 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; ++ struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -638,6 +639,25 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; ++ ++ if (p->flags & IP6_TNL_F_CAP_XMIT) { ++ int strict = (ipv6_addr_type(&p->raddr) & ++ (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); ++ struct rt6_info *rt = rt6_lookup(t->net, ++ &p->raddr, &p->laddr, ++ p->link, strict); ++ ++ if (rt) ++ tdev = rt->dst.dev; ++ ip6_rt_put(rt); ++ } ++ ++ if (!tdev && p->link) ++ tdev = __dev_get_by_index(t->net, p->link); ++ ++ if (tdev) ++ dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, ++ IPV6_MIN_MTU); + } + + /** +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 9ffd3dda3889..97769465de13 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -160,12 +160,13 @@ cc-if-fullversion = $(shell [ $(cc-fullversion) $(1) $(2) ] && echo $(3) || echo + # cc-ldoption + # Usage: ldflags += $(call cc-ldoption, -Wl$(comma)--hash-style=both) + cc-ldoption = $(call try-run,\ +- $(CC) $(1) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2)) ++ $(CC) $(1) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -nostdlib -x c /dev/null -o "$$TMP",$(1),$(2)) + + # ld-option + # Usage: LDFLAGS += $(call ld-option, -X) + ld-option = $(call try-run,\ +- $(CC) -x c /dev/null -c -o "$$TMPO" ; $(LD) $(1) "$$TMPO" -o "$$TMP",$(1),$(2)) ++ $(CC) $(KBUILD_CPPFLAGS) $(CC_OPTION_CFLAGS) -x c /dev/null -c -o "$$TMPO"; \ ++ $(LD) $(LDFLAGS) $(1) "$$TMPO" -o "$$TMP",$(1),$(2)) + + # ar-option + # Usage: KBUILD_ARFLAGS := $(call ar-option,D) +diff --git a/security/Kconfig b/security/Kconfig +index b5c2b5d0c6c0..87f2a6f842fd 100644 +--- a/security/Kconfig ++++ b/security/Kconfig +@@ -154,6 +154,7 @@ config HARDENED_USERCOPY + bool "Harden memory copies between kernel and userspace" + depends on HAVE_HARDENED_USERCOPY_ALLOCATOR + select BUG ++ imply STRICT_DEVMEM + help + This option checks for obviously wrong memory regions when + copying memory to/from the kernel (via copy_to_user() and diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.30-31.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.30-31.patch new file mode 100644 index 000000000000..37486ba19e86 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.30-31.patch @@ -0,0 +1,3861 @@ +diff --git a/Documentation/ABI/testing/sysfs-bus-iio b/Documentation/ABI/testing/sysfs-bus-iio +index 7eead5f97e02..64e65450f483 100644 +--- a/Documentation/ABI/testing/sysfs-bus-iio ++++ b/Documentation/ABI/testing/sysfs-bus-iio +@@ -32,7 +32,7 @@ Description: + Description of the physical chip / device for device X. + Typically a part number. + +-What: /sys/bus/iio/devices/iio:deviceX/timestamp_clock ++What: /sys/bus/iio/devices/iio:deviceX/current_timestamp_clock + KernelVersion: 4.5 + Contact: linux-iio@vger.kernel.org + Description: +diff --git a/Makefile b/Makefile +index 29fc3c91f3e4..99e31da48422 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 30 ++SUBLEVEL = 31 + EXTRAVERSION = + NAME = Petit Gorille + +@@ -805,6 +805,15 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) + # disable invalid "can't wrap" optimizations for signed / pointers + KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) + ++# clang sets -fmerge-all-constants by default as optimization, but this ++# is non-conforming behavior for C and in fact breaks the kernel, so we ++# need to disable it here generally. ++KBUILD_CFLAGS += $(call cc-option,-fno-merge-all-constants) ++ ++# for gcc -fno-merge-all-constants disables everything, but it is fine ++# to have actual conforming behavior enabled. ++KBUILD_CFLAGS += $(call cc-option,-fmerge-constants) ++ + # Make sure -fstack-check isn't enabled (like gentoo apparently did) + KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,) + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index 01bc0688d47d..f6b877d2726d 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -937,3 +937,13 @@ int pmd_clear_huge(pmd_t *pmd) + pmd_clear(pmd); + return 1; + } ++ ++int pud_free_pmd_page(pud_t *pud) ++{ ++ return pud_none(*pud); ++} ++ ++int pmd_free_pte_page(pmd_t *pmd) ++{ ++ return pmd_none(*pmd); ++} +diff --git a/arch/h8300/include/asm/byteorder.h b/arch/h8300/include/asm/byteorder.h +index ecff2d1ca5a3..6eaa7ad5fc2c 100644 +--- a/arch/h8300/include/asm/byteorder.h ++++ b/arch/h8300/include/asm/byteorder.h +@@ -2,7 +2,6 @@ + #ifndef __H8300_BYTEORDER_H__ + #define __H8300_BYTEORDER_H__ + +-#define __BIG_ENDIAN __ORDER_BIG_ENDIAN__ + #include + + #endif +diff --git a/arch/mips/lantiq/Kconfig b/arch/mips/lantiq/Kconfig +index 692ae85a3e3d..8e3a1fc2bc39 100644 +--- a/arch/mips/lantiq/Kconfig ++++ b/arch/mips/lantiq/Kconfig +@@ -13,6 +13,8 @@ choice + config SOC_AMAZON_SE + bool "Amazon SE" + select SOC_TYPE_XWAY ++ select MFD_SYSCON ++ select MFD_CORE + + config SOC_XWAY + bool "XWAY" +diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c +index 7611c3013793..c05bed624075 100644 +--- a/arch/mips/lantiq/xway/sysctrl.c ++++ b/arch/mips/lantiq/xway/sysctrl.c +@@ -551,9 +551,9 @@ void __init ltq_soc_init(void) + clkdev_add_static(ltq_ar9_cpu_hz(), ltq_ar9_fpi_hz(), + ltq_ar9_fpi_hz(), CLOCK_250M); + clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P); +- clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0); ++ clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM); + clkdev_add_pmu("1f203034.usb2-phy", "phy", 1, 0, PMU_USB1_P); +- clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1); ++ clkdev_add_pmu("1e106000.usb", "otg", 1, 0, PMU_USB1 | PMU_AHBM); + clkdev_add_pmu("1e180000.etop", "switch", 1, 0, PMU_SWITCH); + clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); +@@ -562,7 +562,7 @@ void __init ltq_soc_init(void) + } else { + clkdev_add_static(ltq_danube_cpu_hz(), ltq_danube_fpi_hz(), + ltq_danube_fpi_hz(), ltq_danube_pp32_hz()); +- clkdev_add_pmu("1f203018.usb2-phy", "ctrl", 1, 0, PMU_USB0); ++ clkdev_add_pmu("1e101000.usb", "otg", 1, 0, PMU_USB0 | PMU_AHBM); + clkdev_add_pmu("1f203018.usb2-phy", "phy", 1, 0, PMU_USB0_P); + clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); + clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); +diff --git a/arch/mips/ralink/mt7621.c b/arch/mips/ralink/mt7621.c +index 1b274742077d..d2718de60b9b 100644 +--- a/arch/mips/ralink/mt7621.c ++++ b/arch/mips/ralink/mt7621.c +@@ -170,6 +170,28 @@ void prom_soc_init(struct ralink_soc_info *soc_info) + u32 n1; + u32 rev; + ++ /* Early detection of CMP support */ ++ mips_cm_probe(); ++ mips_cpc_probe(); ++ ++ if (mips_cps_numiocu(0)) { ++ /* ++ * mips_cm_probe() wipes out bootloader ++ * config for CM regions and we have to configure them ++ * again. This SoC cannot talk to pamlbus devices ++ * witout proper iocu region set up. ++ * ++ * FIXME: it would be better to do this with values ++ * from DT, but we need this very early because ++ * without this we cannot talk to pretty much anything ++ * including serial. ++ */ ++ write_gcr_reg0_base(MT7621_PALMBUS_BASE); ++ write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE | ++ CM_GCR_REGn_MASK_CMTGT_IOCU0); ++ __sync(); ++ } ++ + n0 = __raw_readl(sysc + SYSC_REG_CHIP_NAME0); + n1 = __raw_readl(sysc + SYSC_REG_CHIP_NAME1); + +@@ -194,26 +216,6 @@ void prom_soc_init(struct ralink_soc_info *soc_info) + + rt2880_pinmux_data = mt7621_pinmux_data; + +- /* Early detection of CMP support */ +- mips_cm_probe(); +- mips_cpc_probe(); +- +- if (mips_cps_numiocu(0)) { +- /* +- * mips_cm_probe() wipes out bootloader +- * config for CM regions and we have to configure them +- * again. This SoC cannot talk to pamlbus devices +- * witout proper iocu region set up. +- * +- * FIXME: it would be better to do this with values +- * from DT, but we need this very early because +- * without this we cannot talk to pretty much anything +- * including serial. +- */ +- write_gcr_reg0_base(MT7621_PALMBUS_BASE); +- write_gcr_reg0_mask(~MT7621_PALMBUS_SIZE | +- CM_GCR_REGn_MASK_CMTGT_IOCU0); +- } + + if (!register_cps_smp_ops()) + return; +diff --git a/arch/mips/ralink/reset.c b/arch/mips/ralink/reset.c +index 64543d66e76b..e9531fea23a2 100644 +--- a/arch/mips/ralink/reset.c ++++ b/arch/mips/ralink/reset.c +@@ -96,16 +96,9 @@ static void ralink_restart(char *command) + unreachable(); + } + +-static void ralink_halt(void) +-{ +- local_irq_disable(); +- unreachable(); +-} +- + static int __init mips_reboot_setup(void) + { + _machine_restart = ralink_restart; +- _machine_halt = ralink_halt; + + return 0; + } +diff --git a/arch/x86/Makefile b/arch/x86/Makefile +index 498c1b812300..1c4d012550ec 100644 +--- a/arch/x86/Makefile ++++ b/arch/x86/Makefile +@@ -223,6 +223,15 @@ KBUILD_CFLAGS += $(cfi) $(cfi-sigframe) $(cfi-sections) $(asinstr) $(avx_instr) + + LDFLAGS := -m elf_$(UTS_MACHINE) + ++# ++# The 64-bit kernel must be aligned to 2MB. Pass -z max-page-size=0x200000 to ++# the linker to force 2MB page size regardless of the default page size used ++# by the linker. ++# ++ifdef CONFIG_X86_64 ++LDFLAGS += $(call ld-option, -z max-page-size=0x200000) ++endif ++ + # Speed up the build + KBUILD_CFLAGS += -pipe + # Workaround for a gcc prelease that unfortunately was shipped in a suse release +diff --git a/arch/x86/boot/compressed/misc.c b/arch/x86/boot/compressed/misc.c +index 98761a1576ce..252fee320816 100644 +--- a/arch/x86/boot/compressed/misc.c ++++ b/arch/x86/boot/compressed/misc.c +@@ -309,6 +309,10 @@ static void parse_elf(void *output) + + switch (phdr->p_type) { + case PT_LOAD: ++#ifdef CONFIG_X86_64 ++ if ((phdr->p_align % 0x200000) != 0) ++ error("Alignment of LOAD segment isn't multiple of 2MB"); ++#endif + #ifdef CONFIG_RELOCATABLE + dest = output; + dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR); +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index 6f3cc15e0c73..f7bfa701219b 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -1091,7 +1091,7 @@ apicinterrupt3 HYPERVISOR_CALLBACK_VECTOR \ + #endif /* CONFIG_HYPERV */ + + idtentry debug do_debug has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK +-idtentry int3 do_int3 has_error_code=0 paranoid=1 shift_ist=DEBUG_STACK ++idtentry int3 do_int3 has_error_code=0 + idtentry stack_segment do_stack_segment has_error_code=1 + + #ifdef CONFIG_XEN +diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c +index 577fa8adb785..542392b6aab6 100644 +--- a/arch/x86/entry/vsyscall/vsyscall_64.c ++++ b/arch/x86/entry/vsyscall/vsyscall_64.c +@@ -355,7 +355,7 @@ void __init set_vsyscall_pgtable_user_bits(pgd_t *root) + set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER)); + p4d = p4d_offset(pgd, VSYSCALL_ADDR); + #if CONFIG_PGTABLE_LEVELS >= 5 +- p4d->p4d |= _PAGE_USER; ++ set_p4d(p4d, __p4d(p4d_val(*p4d) | _PAGE_USER)); + #endif + pud = pud_offset(p4d, VSYSCALL_ADDR); + set_pud(pud, __pud(pud_val(*pud) | _PAGE_USER)); +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 56457cb73448..9b18a227fff7 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3194,7 +3194,7 @@ static unsigned bdw_limit_period(struct perf_event *event, unsigned left) + X86_CONFIG(.event=0xc0, .umask=0x01)) { + if (left < 128) + left = 128; +- left &= ~0x3fu; ++ left &= ~0x3fULL; + } + return left; + } +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 95cb19f4e06f..8243fdbb9b9c 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3554,24 +3554,27 @@ static struct intel_uncore_type *skx_msr_uncores[] = { + NULL, + }; + ++/* ++ * To determine the number of CHAs, it should read bits 27:0 in the CAPID6 ++ * register which located at Device 30, Function 3, Offset 0x9C. PCI ID 0x2083. ++ */ ++#define SKX_CAPID6 0x9c ++#define SKX_CHA_BIT_MASK GENMASK(27, 0) ++ + static int skx_count_chabox(void) + { +- struct pci_dev *chabox_dev = NULL; +- int bus, count = 0; ++ struct pci_dev *dev = NULL; ++ u32 val = 0; + +- while (1) { +- chabox_dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x208d, chabox_dev); +- if (!chabox_dev) +- break; +- if (count == 0) +- bus = chabox_dev->bus->number; +- if (bus != chabox_dev->bus->number) +- break; +- count++; +- } ++ dev = pci_get_device(PCI_VENDOR_ID_INTEL, 0x2083, dev); ++ if (!dev) ++ goto out; + +- pci_dev_put(chabox_dev); +- return count; ++ pci_read_config_dword(dev, SKX_CAPID6, &val); ++ val &= SKX_CHA_BIT_MASK; ++out: ++ pci_dev_put(dev); ++ return hweight32(val); + } + + void skx_uncore_cpu_init(void) +@@ -3598,7 +3601,7 @@ static struct intel_uncore_type skx_uncore_imc = { + }; + + static struct attribute *skx_upi_uncore_formats_attr[] = { +- &format_attr_event_ext.attr, ++ &format_attr_event.attr, + &format_attr_umask_ext.attr, + &format_attr_edge.attr, + &format_attr_inv.attr, +diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h +index caec8417539f..7c300299e12e 100644 +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -352,6 +352,7 @@ enum vmcs_field { + #define INTR_TYPE_NMI_INTR (2 << 8) /* NMI */ + #define INTR_TYPE_HARD_EXCEPTION (3 << 8) /* processor exception */ + #define INTR_TYPE_SOFT_INTR (4 << 8) /* software interrupt */ ++#define INTR_TYPE_PRIV_SW_EXCEPTION (5 << 8) /* ICE breakpoint - undocumented */ + #define INTR_TYPE_SOFT_EXCEPTION (6 << 8) /* software exception */ + + /* GUEST_INTERRUPTIBILITY_INFO flags. */ +diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c +index 236917bac5f2..a59624080015 100644 +--- a/arch/x86/kernel/idt.c ++++ b/arch/x86/kernel/idt.c +@@ -160,7 +160,6 @@ static const __initconst struct idt_data early_pf_idts[] = { + */ + static const __initconst struct idt_data dbg_idts[] = { + INTG(X86_TRAP_DB, debug), +- INTG(X86_TRAP_BP, int3), + }; + #endif + +@@ -183,7 +182,6 @@ gate_desc debug_idt_table[IDT_ENTRIES] __page_aligned_bss; + static const __initconst struct idt_data ist_idts[] = { + ISTG(X86_TRAP_DB, debug, DEBUG_STACK), + ISTG(X86_TRAP_NMI, nmi, NMI_STACK), +- SISTG(X86_TRAP_BP, int3, DEBUG_STACK), + ISTG(X86_TRAP_DF, double_fault, DOUBLEFAULT_STACK), + #ifdef CONFIG_X86_MCE + ISTG(X86_TRAP_MC, &machine_check, MCE_STACK), +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index a66428dc92ae..ef4efb931efa 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -571,7 +571,6 @@ do_general_protection(struct pt_regs *regs, long error_code) + } + NOKPROBE_SYMBOL(do_general_protection); + +-/* May run on IST stack. */ + dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + { + #ifdef CONFIG_DYNAMIC_FTRACE +@@ -586,6 +585,13 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + if (poke_int3_handler(regs)) + return; + ++ /* ++ * Use ist_enter despite the fact that we don't use an IST stack. ++ * We can be called from a kprobe in non-CONTEXT_KERNEL kernel ++ * mode or even during context tracking state changes. ++ * ++ * This means that we can't schedule. That's okay. ++ */ + ist_enter(regs); + RCU_LOCKDEP_WARN(!rcu_is_watching(), "entry code didn't wake RCU"); + #ifdef CONFIG_KGDB_LOW_LEVEL_TRAP +@@ -603,15 +609,10 @@ dotraplinkage void notrace do_int3(struct pt_regs *regs, long error_code) + SIGTRAP) == NOTIFY_STOP) + goto exit; + +- /* +- * Let others (NMI) know that the debug stack is in use +- * as we may switch to the interrupt stack. +- */ +- debug_stack_usage_inc(); + cond_local_irq_enable(regs); + do_trap(X86_TRAP_BP, SIGTRAP, "int3", regs, error_code, NULL); + cond_local_irq_disable(regs); +- debug_stack_usage_dec(); ++ + exit: + ist_exit(regs); + } +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 315fccb2684b..ae4803b213d0 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -1071,6 +1071,13 @@ static inline bool is_machine_check(u32 intr_info) + (INTR_TYPE_HARD_EXCEPTION | MC_VECTOR | INTR_INFO_VALID_MASK); + } + ++/* Undocumented: icebp/int1 */ ++static inline bool is_icebp(u32 intr_info) ++{ ++ return (intr_info & (INTR_INFO_INTR_TYPE_MASK | INTR_INFO_VALID_MASK)) ++ == (INTR_TYPE_PRIV_SW_EXCEPTION | INTR_INFO_VALID_MASK); ++} ++ + static inline bool cpu_has_vmx_msr_bitmap(void) + { + return vmcs_config.cpu_based_exec_ctrl & CPU_BASED_USE_MSR_BITMAPS; +@@ -6169,7 +6176,7 @@ static int handle_exception(struct kvm_vcpu *vcpu) + (KVM_GUESTDBG_SINGLESTEP | KVM_GUESTDBG_USE_HW_BP))) { + vcpu->arch.dr6 &= ~15; + vcpu->arch.dr6 |= dr6 | DR6_RTM; +- if (!(dr6 & ~DR6_RESERVED)) /* icebp */ ++ if (is_icebp(intr_info)) + skip_emulated_instruction(vcpu); + + kvm_queue_exception(vcpu, DB_VECTOR); +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 004abf9ebf12..34cda7e0551b 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -702,4 +702,52 @@ int pmd_clear_huge(pmd_t *pmd) + + return 0; + } ++ ++/** ++ * pud_free_pmd_page - Clear pud entry and free pmd page. ++ * @pud: Pointer to a PUD. ++ * ++ * Context: The pud range has been unmaped and TLB purged. ++ * Return: 1 if clearing the entry succeeded. 0 otherwise. ++ */ ++int pud_free_pmd_page(pud_t *pud) ++{ ++ pmd_t *pmd; ++ int i; ++ ++ if (pud_none(*pud)) ++ return 1; ++ ++ pmd = (pmd_t *)pud_page_vaddr(*pud); ++ ++ for (i = 0; i < PTRS_PER_PMD; i++) ++ if (!pmd_free_pte_page(&pmd[i])) ++ return 0; ++ ++ pud_clear(pud); ++ free_page((unsigned long)pmd); ++ ++ return 1; ++} ++ ++/** ++ * pmd_free_pte_page - Clear pmd entry and free pte page. ++ * @pmd: Pointer to a PMD. ++ * ++ * Context: The pmd range has been unmaped and TLB purged. ++ * Return: 1 if clearing the entry succeeded. 0 otherwise. ++ */ ++int pmd_free_pte_page(pmd_t *pmd) ++{ ++ pte_t *pte; ++ ++ if (pmd_none(*pmd)) ++ return 1; ++ ++ pte = (pte_t *)pmd_page_vaddr(*pmd); ++ pmd_clear(pmd); ++ free_page((unsigned long)pte); ++ ++ return 1; ++} + #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 940aac70b4da..bb77606d04e0 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1156,7 +1156,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + * may converge on the last pass. In such case do one more + * pass to emit the final image + */ +- for (pass = 0; pass < 10 || image; pass++) { ++ for (pass = 0; pass < 20 || image; pass++) { + proglen = do_jit(prog, addrs, image, oldproglen, &ctx); + if (proglen <= 0) { + image = NULL; +@@ -1183,6 +1183,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + } + } + oldproglen = proglen; ++ cond_resched(); + } + + if (bpf_jit_enable > 1) +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index ad5d9538f0f9..f7af598c4f55 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -227,7 +227,7 @@ int __init efi_alloc_page_tables(void) + if (!pud) { + if (CONFIG_PGTABLE_LEVELS > 4) + free_page((unsigned long) pgd_page_vaddr(*pgd)); +- free_page((unsigned long)efi_pgd); ++ free_pages((unsigned long)efi_pgd, PGD_ALLOCATION_ORDER); + return -ENOMEM; + } + +diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c +index 11b113f8e367..ebb626ffb5fa 100644 +--- a/drivers/acpi/acpi_watchdog.c ++++ b/drivers/acpi/acpi_watchdog.c +@@ -74,10 +74,10 @@ void __init acpi_watchdog_init(void) + res.start = gas->address; + if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) { + res.flags = IORESOURCE_MEM; +- res.end = res.start + ALIGN(gas->access_width, 4); ++ res.end = res.start + ALIGN(gas->access_width, 4) - 1; + } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { + res.flags = IORESOURCE_IO; +- res.end = res.start + gas->access_width; ++ res.end = res.start + gas->access_width - 1; + } else { + pr_warn("Unsupported address space: %u\n", + gas->space_id); +diff --git a/drivers/acpi/numa.c b/drivers/acpi/numa.c +index 917f1cc0fda4..8fb74d9011da 100644 +--- a/drivers/acpi/numa.c ++++ b/drivers/acpi/numa.c +@@ -103,25 +103,27 @@ int acpi_map_pxm_to_node(int pxm) + */ + int acpi_map_pxm_to_online_node(int pxm) + { +- int node, n, dist, min_dist; ++ int node, min_node; + + node = acpi_map_pxm_to_node(pxm); + + if (node == NUMA_NO_NODE) + node = 0; + ++ min_node = node; + if (!node_online(node)) { +- min_dist = INT_MAX; ++ int min_dist = INT_MAX, dist, n; ++ + for_each_online_node(n) { + dist = node_distance(node, n); + if (dist < min_dist) { + min_dist = dist; +- node = n; ++ min_node = n; + } + } + } + +- return node; ++ return min_node; + } + EXPORT_SYMBOL(acpi_map_pxm_to_online_node); + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index bc013f757d5d..18391d0c0cd7 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -541,7 +541,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { + .driver_data = board_ahci_yes_fbs }, + { PCI_DEVICE(PCI_VENDOR_ID_MARVELL_EXT, 0x9230), + .driver_data = board_ahci_yes_fbs }, +- { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), ++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0642), /* highpoint rocketraid 642L */ ++ .driver_data = board_ahci_yes_fbs }, ++ { PCI_DEVICE(PCI_VENDOR_ID_TTI, 0x0645), /* highpoint rocketraid 644L */ + .driver_data = board_ahci_yes_fbs }, + + /* Promise */ +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index e7ded346d94b..c6fe2974b336 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4520,6 +4520,25 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "PIONEER DVD-RW DVR-212D", NULL, ATA_HORKAGE_NOSETXFER }, + { "PIONEER DVD-RW DVR-216D", NULL, ATA_HORKAGE_NOSETXFER }, + ++ /* Crucial BX100 SSD 500GB has broken LPM support */ ++ { "CT500BX100SSD1", NULL, ATA_HORKAGE_NOLPM }, ++ ++ /* 512GB MX100 with MU01 firmware has both queued TRIM and LPM issues */ ++ { "Crucial_CT512MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ /* 512GB MX100 with newer firmware has only LPM issues */ ++ { "Crucial_CT512MX100*", NULL, ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ ++ /* 480GB+ M500 SSDs have both queued TRIM and LPM issues */ ++ { "Crucial_CT480M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ { "Crucial_CT960M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM | ++ ATA_HORKAGE_NOLPM, }, ++ + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +@@ -4531,7 +4550,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*MX100*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +- { "Samsung SSD 8*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ { "Samsung SSD 840*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, ++ { "Samsung SSD 850*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "FCCT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +@@ -5391,8 +5412,7 @@ void ata_qc_issue(struct ata_queued_cmd *qc) + * We guarantee to LLDs that they will have at least one + * non-zero sg if the command is a data command. + */ +- if (WARN_ON_ONCE(ata_is_data(prot) && +- (!qc->sg || !qc->n_elem || !qc->nbytes))) ++ if (ata_is_data(prot) && (!qc->sg || !qc->n_elem || !qc->nbytes)) + goto sys_err; + + if (ata_is_dma(prot) || (ata_is_pio(prot) && +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 44ba292f2cd7..4ff69f508e95 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3315,6 +3315,12 @@ static unsigned int ata_scsi_pass_thru(struct ata_queued_cmd *qc) + goto invalid_fld; + } + ++ /* We may not issue NCQ commands to devices not supporting NCQ */ ++ if (ata_is_ncq(tf->protocol) && !ata_ncq_enabled(dev)) { ++ fp = 1; ++ goto invalid_fld; ++ } ++ + /* sanity check for pio multi commands */ + if ((cdb[1] & 0xe0) && !is_multi_taskfile(tf)) { + fp = 1; +@@ -4308,7 +4314,9 @@ static inline int __ata_scsi_queuecmd(struct scsi_cmnd *scmd, + if (likely((scsi_op != ATA_16) || !atapi_passthru16)) { + /* relay SCSI command to ATAPI device */ + int len = COMMAND_SIZE(scsi_op); +- if (unlikely(len > scmd->cmd_len || len > dev->cdb_len)) ++ if (unlikely(len > scmd->cmd_len || ++ len > dev->cdb_len || ++ scmd->cmd_len > ATAPI_CDB_LEN)) + goto bad_cdb_len; + + xlat_func = atapi_xlat; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 673698c7b143..b2c0306f97ed 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -235,7 +235,6 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, +- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, +@@ -268,6 +267,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + + /* QCA ROME chipset */ ++ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, +@@ -388,10 +388,10 @@ static const struct usb_device_id blacklist_table[] = { + */ + static const struct dmi_system_id btusb_needs_reset_resume_table[] = { + { +- /* Lenovo Yoga 920 (QCA Rome device 0cf3:e300) */ ++ /* Dell OptiPlex 3060 (QCA ROME device 0cf3:e007) */ + .matches = { +- DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), +- DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo YOGA 920"), ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), + }, + }, + {} +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index 58ce6af8452d..eec52734d6ac 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -479,17 +479,17 @@ struct bcm2835_pll_ana_bits { + static const struct bcm2835_pll_ana_bits bcm2835_ana_default = { + .mask0 = 0, + .set0 = 0, +- .mask1 = (u32)~(A2W_PLL_KI_MASK | A2W_PLL_KP_MASK), ++ .mask1 = A2W_PLL_KI_MASK | A2W_PLL_KP_MASK, + .set1 = (2 << A2W_PLL_KI_SHIFT) | (8 << A2W_PLL_KP_SHIFT), +- .mask3 = (u32)~A2W_PLL_KA_MASK, ++ .mask3 = A2W_PLL_KA_MASK, + .set3 = (2 << A2W_PLL_KA_SHIFT), + .fb_prediv_mask = BIT(14), + }; + + static const struct bcm2835_pll_ana_bits bcm2835_ana_pllh = { +- .mask0 = (u32)~(A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK), ++ .mask0 = A2W_PLLH_KA_MASK | A2W_PLLH_KI_LOW_MASK, + .set0 = (2 << A2W_PLLH_KA_SHIFT) | (2 << A2W_PLLH_KI_LOW_SHIFT), +- .mask1 = (u32)~(A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK), ++ .mask1 = A2W_PLLH_KI_HIGH_MASK | A2W_PLLH_KP_MASK, + .set1 = (6 << A2W_PLLH_KP_SHIFT), + .mask3 = 0, + .set3 = 0, +@@ -653,8 +653,10 @@ static int bcm2835_pll_on(struct clk_hw *hw) + ~A2W_PLL_CTRL_PWRDN); + + /* Take the PLL out of reset. */ ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, data->cm_ctrl_reg, + cprman_read(cprman, data->cm_ctrl_reg) & ~CM_PLL_ANARST); ++ spin_unlock(&cprman->regs_lock); + + /* Wait for the PLL to lock. */ + timeout = ktime_add_ns(ktime_get(), LOCK_TIMEOUT_NS); +@@ -731,9 +733,11 @@ static int bcm2835_pll_set_rate(struct clk_hw *hw, + } + + /* Unmask the reference clock from the oscillator. */ ++ spin_lock(&cprman->regs_lock); + cprman_write(cprman, A2W_XOSC_CTRL, + cprman_read(cprman, A2W_XOSC_CTRL) | + data->reference_enable_mask); ++ spin_unlock(&cprman->regs_lock); + + if (do_ana_setup_first) + bcm2835_pll_write_ana(cprman, data->ana_reg_base, ana); +diff --git a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c +index 241fb13f1c06..40d5f74cb2ac 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun6i-a31.c ++++ b/drivers/clk/sunxi-ng/ccu-sun6i-a31.c +@@ -750,7 +750,7 @@ static struct ccu_mp out_a_clk = { + .features = CCU_FEATURE_FIXED_PREDIV, + .hw.init = CLK_HW_INIT_PARENTS("out-a", + clk_out_parents, +- &ccu_div_ops, ++ &ccu_mp_ops, + 0), + }, + }; +@@ -771,7 +771,7 @@ static struct ccu_mp out_b_clk = { + .features = CCU_FEATURE_FIXED_PREDIV, + .hw.init = CLK_HW_INIT_PARENTS("out-b", + clk_out_parents, +- &ccu_div_ops, ++ &ccu_mp_ops, + 0), + }, + }; +@@ -792,7 +792,7 @@ static struct ccu_mp out_c_clk = { + .features = CCU_FEATURE_FIXED_PREDIV, + .hw.init = CLK_HW_INIT_PARENTS("out-c", + clk_out_parents, +- &ccu_div_ops, ++ &ccu_mp_ops, + 0), + }, + }; +diff --git a/drivers/gpu/drm/drm_framebuffer.c b/drivers/gpu/drm/drm_framebuffer.c +index dd4727489b84..c21e10c780ac 100644 +--- a/drivers/gpu/drm/drm_framebuffer.c ++++ b/drivers/gpu/drm/drm_framebuffer.c +@@ -458,6 +458,12 @@ int drm_mode_getfb(struct drm_device *dev, + if (!fb) + return -ENOENT; + ++ /* Multi-planar framebuffers need getfb2. */ ++ if (fb->format->num_planes > 1) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + r->height = fb->height; + r->width = fb->width; + r->depth = fb->format->depth; +@@ -481,6 +487,7 @@ int drm_mode_getfb(struct drm_device *dev, + ret = -ENODEV; + } + ++out: + drm_framebuffer_put(fb); + + return ret; +diff --git a/drivers/gpu/drm/drm_syncobj.c b/drivers/gpu/drm/drm_syncobj.c +index 0422b8c2c2e7..7bcf5702c91c 100644 +--- a/drivers/gpu/drm/drm_syncobj.c ++++ b/drivers/gpu/drm/drm_syncobj.c +@@ -328,28 +328,11 @@ static const struct file_operations drm_syncobj_file_fops = { + .release = drm_syncobj_file_release, + }; + +-static int drm_syncobj_alloc_file(struct drm_syncobj *syncobj) +-{ +- struct file *file = anon_inode_getfile("syncobj_file", +- &drm_syncobj_file_fops, +- syncobj, 0); +- if (IS_ERR(file)) +- return PTR_ERR(file); +- +- drm_syncobj_get(syncobj); +- if (cmpxchg(&syncobj->file, NULL, file)) { +- /* lost the race */ +- fput(file); +- } +- +- return 0; +-} +- + static int drm_syncobj_handle_to_fd(struct drm_file *file_private, + u32 handle, int *p_fd) + { + struct drm_syncobj *syncobj = drm_syncobj_find(file_private, handle); +- int ret; ++ struct file *file; + int fd; + + if (!syncobj) +@@ -361,46 +344,40 @@ static int drm_syncobj_handle_to_fd(struct drm_file *file_private, + return fd; + } + +- if (!syncobj->file) { +- ret = drm_syncobj_alloc_file(syncobj); +- if (ret) +- goto out_put_fd; ++ file = anon_inode_getfile("syncobj_file", ++ &drm_syncobj_file_fops, ++ syncobj, 0); ++ if (IS_ERR(file)) { ++ put_unused_fd(fd); ++ drm_syncobj_put(syncobj); ++ return PTR_ERR(file); + } +- fd_install(fd, syncobj->file); +- drm_syncobj_put(syncobj); ++ ++ drm_syncobj_get(syncobj); ++ fd_install(fd, file); ++ + *p_fd = fd; + return 0; +-out_put_fd: +- put_unused_fd(fd); +- drm_syncobj_put(syncobj); +- return ret; + } + +-static struct drm_syncobj *drm_syncobj_fdget(int fd) +-{ +- struct file *file = fget(fd); +- +- if (!file) +- return NULL; +- if (file->f_op != &drm_syncobj_file_fops) +- goto err; +- +- return file->private_data; +-err: +- fput(file); +- return NULL; +-}; +- + static int drm_syncobj_fd_to_handle(struct drm_file *file_private, + int fd, u32 *handle) + { +- struct drm_syncobj *syncobj = drm_syncobj_fdget(fd); ++ struct drm_syncobj *syncobj; ++ struct file *file; + int ret; + +- if (!syncobj) ++ file = fget(fd); ++ if (!file) ++ return -EINVAL; ++ ++ if (file->f_op != &drm_syncobj_file_fops) { ++ fput(file); + return -EINVAL; ++ } + + /* take a reference to put in the idr */ ++ syncobj = file->private_data; + drm_syncobj_get(syncobj); + + idr_preload(GFP_KERNEL); +@@ -409,12 +386,14 @@ static int drm_syncobj_fd_to_handle(struct drm_file *file_private, + spin_unlock(&file_private->syncobj_table_lock); + idr_preload_end(); + +- if (ret < 0) { +- fput(syncobj->file); +- return ret; +- } +- *handle = ret; +- return 0; ++ if (ret > 0) { ++ *handle = ret; ++ ret = 0; ++ } else ++ drm_syncobj_put(syncobj); ++ ++ fput(file); ++ return ret; + } + + int drm_syncobj_import_sync_file_fence(struct drm_file *file_private, +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index c0da44742988..424cd1b66575 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -90,25 +90,18 @@ void radeon_connector_hotplug(struct drm_connector *connector) + /* don't do anything if sink is not display port, i.e., + * passive dp->(dvi|hdmi) adaptor + */ +- if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT) { +- int saved_dpms = connector->dpms; +- /* Only turn off the display if it's physically disconnected */ +- if (!radeon_hpd_sense(rdev, radeon_connector->hpd.hpd)) { +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); +- } else if (radeon_dp_needs_link_train(radeon_connector)) { +- /* Don't try to start link training before we +- * have the dpcd */ +- if (!radeon_dp_getdpcd(radeon_connector)) +- return; +- +- /* set it to OFF so that drm_helper_connector_dpms() +- * won't return immediately since the current state +- * is ON at this point. +- */ +- connector->dpms = DRM_MODE_DPMS_OFF; +- drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); +- } +- connector->dpms = saved_dpms; ++ if (dig_connector->dp_sink_type == CONNECTOR_OBJECT_ID_DISPLAYPORT && ++ radeon_hpd_sense(rdev, radeon_connector->hpd.hpd) && ++ radeon_dp_needs_link_train(radeon_connector)) { ++ /* Don't start link training before we have the DPCD */ ++ if (!radeon_dp_getdpcd(radeon_connector)) ++ return; ++ ++ /* Turn the connector off and back on immediately, which ++ * will trigger link training ++ */ ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_OFF); ++ drm_helper_connector_dpms(connector, DRM_MODE_DPMS_ON); + } + } + } +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index b5b335c9b2bb..2ebdc6d5a76e 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -159,10 +159,15 @@ static int udl_fb_mmap(struct fb_info *info, struct vm_area_struct *vma) + { + unsigned long start = vma->vm_start; + unsigned long size = vma->vm_end - vma->vm_start; +- unsigned long offset = vma->vm_pgoff << PAGE_SHIFT; ++ unsigned long offset; + unsigned long page, pos; + +- if (offset + size > info->fix.smem_len) ++ if (vma->vm_pgoff > (~0UL >> PAGE_SHIFT)) ++ return -EINVAL; ++ ++ offset = vma->vm_pgoff << PAGE_SHIFT; ++ ++ if (offset > info->fix.smem_len || size > info->fix.smem_len - offset) + return -EINVAL; + + pos = (unsigned long)info->fix.smem_start + offset; +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +index 184340d486c3..86d25f18aa99 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c +@@ -1337,6 +1337,19 @@ static void __vmw_svga_disable(struct vmw_private *dev_priv) + */ + void vmw_svga_disable(struct vmw_private *dev_priv) + { ++ /* ++ * Disabling SVGA will turn off device modesetting capabilities, so ++ * notify KMS about that so that it doesn't cache atomic state that ++ * isn't valid anymore, for example crtcs turned on. ++ * Strictly we'd want to do this under the SVGA lock (or an SVGA mutex), ++ * but vmw_kms_lost_device() takes the reservation sem and thus we'll ++ * end up with lock order reversal. Thus, a master may actually perform ++ * a new modeset just after we call vmw_kms_lost_device() and race with ++ * vmw_svga_disable(), but that should at worst cause atomic KMS state ++ * to be inconsistent with the device, causing modesetting problems. ++ * ++ */ ++ vmw_kms_lost_device(dev_priv->dev); + ttm_write_lock(&dev_priv->reservation_sem, false); + spin_lock(&dev_priv->svga_lock); + if (dev_priv->bdev.man[TTM_PL_VRAM].use_type) { +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +index 7e5f30e234b1..8c65cc3b0dda 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h +@@ -938,6 +938,7 @@ int vmw_kms_present(struct vmw_private *dev_priv, + int vmw_kms_update_layout_ioctl(struct drm_device *dev, void *data, + struct drm_file *file_priv); + void vmw_kms_legacy_hotspot_clear(struct vmw_private *dev_priv); ++void vmw_kms_lost_device(struct drm_device *dev); + + int vmw_dumb_create(struct drm_file *file_priv, + struct drm_device *dev, +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +index 62c2f4be8012..9e010f8c36a1 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +@@ -31,7 +31,6 @@ + #include + #include + +- + /* Might need a hrtimer here? */ + #define VMWGFX_PRESENT_RATE ((HZ / 60 > 0) ? HZ / 60 : 1) + +@@ -2531,9 +2530,12 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, + * Helper to be used if an error forces the caller to undo the actions of + * vmw_kms_helper_resource_prepare. + */ +-void vmw_kms_helper_resource_revert(struct vmw_resource *res) ++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx) + { +- vmw_kms_helper_buffer_revert(res->backup); ++ struct vmw_resource *res = ctx->res; ++ ++ vmw_kms_helper_buffer_revert(ctx->buf); ++ vmw_dmabuf_unreference(&ctx->buf); + vmw_resource_unreserve(res, false, NULL, 0); + mutex_unlock(&res->dev_priv->cmdbuf_mutex); + } +@@ -2550,10 +2552,14 @@ void vmw_kms_helper_resource_revert(struct vmw_resource *res) + * interrupted by a signal. + */ + int vmw_kms_helper_resource_prepare(struct vmw_resource *res, +- bool interruptible) ++ bool interruptible, ++ struct vmw_validation_ctx *ctx) + { + int ret = 0; + ++ ctx->buf = NULL; ++ ctx->res = res; ++ + if (interruptible) + ret = mutex_lock_interruptible(&res->dev_priv->cmdbuf_mutex); + else +@@ -2572,6 +2578,8 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, + res->dev_priv->has_mob); + if (ret) + goto out_unreserve; ++ ++ ctx->buf = vmw_dmabuf_reference(res->backup); + } + ret = vmw_resource_validate(res); + if (ret) +@@ -2579,7 +2587,7 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, + return 0; + + out_revert: +- vmw_kms_helper_buffer_revert(res->backup); ++ vmw_kms_helper_buffer_revert(ctx->buf); + out_unreserve: + vmw_resource_unreserve(res, false, NULL, 0); + out_unlock: +@@ -2595,11 +2603,13 @@ int vmw_kms_helper_resource_prepare(struct vmw_resource *res, + * @out_fence: Optional pointer to a fence pointer. If non-NULL, a + * ref-counted fence pointer is returned here. + */ +-void vmw_kms_helper_resource_finish(struct vmw_resource *res, +- struct vmw_fence_obj **out_fence) ++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, ++ struct vmw_fence_obj **out_fence) + { +- if (res->backup || out_fence) +- vmw_kms_helper_buffer_finish(res->dev_priv, NULL, res->backup, ++ struct vmw_resource *res = ctx->res; ++ ++ if (ctx->buf || out_fence) ++ vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf, + out_fence, NULL); + + vmw_resource_unreserve(res, false, NULL, 0); +@@ -2865,3 +2875,14 @@ int vmw_kms_set_config(struct drm_mode_set *set, + + return drm_atomic_helper_set_config(set, ctx); + } ++ ++ ++/** ++ * vmw_kms_lost_device - Notify kms that modesetting capabilities will be lost ++ * ++ * @dev: Pointer to the drm device ++ */ ++void vmw_kms_lost_device(struct drm_device *dev) ++{ ++ drm_atomic_helper_shutdown(dev); ++} +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +index cd9da2dd79af..3d2ca280eaa7 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.h +@@ -240,6 +240,11 @@ struct vmw_display_unit { + int set_gui_y; + }; + ++struct vmw_validation_ctx { ++ struct vmw_resource *res; ++ struct vmw_dma_buffer *buf; ++}; ++ + #define vmw_crtc_to_du(x) \ + container_of(x, struct vmw_display_unit, crtc) + #define vmw_connector_to_du(x) \ +@@ -296,9 +301,10 @@ void vmw_kms_helper_buffer_finish(struct vmw_private *dev_priv, + struct drm_vmw_fence_rep __user * + user_fence_rep); + int vmw_kms_helper_resource_prepare(struct vmw_resource *res, +- bool interruptible); +-void vmw_kms_helper_resource_revert(struct vmw_resource *res); +-void vmw_kms_helper_resource_finish(struct vmw_resource *res, ++ bool interruptible, ++ struct vmw_validation_ctx *ctx); ++void vmw_kms_helper_resource_revert(struct vmw_validation_ctx *ctx); ++void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, + struct vmw_fence_obj **out_fence); + int vmw_kms_readback(struct vmw_private *dev_priv, + struct drm_file *file_priv, +@@ -439,5 +445,4 @@ int vmw_kms_stdu_dma(struct vmw_private *dev_priv, + + int vmw_kms_set_config(struct drm_mode_set *set, + struct drm_modeset_acquire_ctx *ctx); +- + #endif +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +index 7ae38a67388c..aacce4753a62 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +@@ -909,12 +909,13 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, + struct vmw_framebuffer_surface *vfbs = + container_of(framebuffer, typeof(*vfbs), base); + struct vmw_kms_sou_surface_dirty sdirty; ++ struct vmw_validation_ctx ctx; + int ret; + + if (!srf) + srf = &vfbs->surface->res; + +- ret = vmw_kms_helper_resource_prepare(srf, true); ++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); + if (ret) + return ret; + +@@ -933,7 +934,7 @@ int vmw_kms_sou_do_surface_dirty(struct vmw_private *dev_priv, + ret = vmw_kms_helper_dirty(dev_priv, framebuffer, clips, vclips, + dest_x, dest_y, num_clips, inc, + &sdirty.base); +- vmw_kms_helper_resource_finish(srf, out_fence); ++ vmw_kms_helper_resource_finish(&ctx, out_fence); + + return ret; + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +index 4dee05b15552..6c576f8df4b2 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_stdu.c +@@ -980,12 +980,13 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, + struct vmw_framebuffer_surface *vfbs = + container_of(framebuffer, typeof(*vfbs), base); + struct vmw_stdu_dirty sdirty; ++ struct vmw_validation_ctx ctx; + int ret; + + if (!srf) + srf = &vfbs->surface->res; + +- ret = vmw_kms_helper_resource_prepare(srf, true); ++ ret = vmw_kms_helper_resource_prepare(srf, true, &ctx); + if (ret) + return ret; + +@@ -1008,7 +1009,7 @@ int vmw_kms_stdu_surface_dirty(struct vmw_private *dev_priv, + dest_x, dest_y, num_clips, inc, + &sdirty.base); + out_finish: +- vmw_kms_helper_resource_finish(srf, out_fence); ++ vmw_kms_helper_resource_finish(&ctx, out_fence); + + return ret; + } +diff --git a/drivers/hv/ring_buffer.c b/drivers/hv/ring_buffer.c +index 12eb8caa4263..3f8dde8d59ba 100644 +--- a/drivers/hv/ring_buffer.c ++++ b/drivers/hv/ring_buffer.c +@@ -394,13 +394,24 @@ __hv_pkt_iter_next(struct vmbus_channel *channel, + } + EXPORT_SYMBOL_GPL(__hv_pkt_iter_next); + ++/* How many bytes were read in this iterator cycle */ ++static u32 hv_pkt_iter_bytes_read(const struct hv_ring_buffer_info *rbi, ++ u32 start_read_index) ++{ ++ if (rbi->priv_read_index >= start_read_index) ++ return rbi->priv_read_index - start_read_index; ++ else ++ return rbi->ring_datasize - start_read_index + ++ rbi->priv_read_index; ++} ++ + /* + * Update host ring buffer after iterating over packets. + */ + void hv_pkt_iter_close(struct vmbus_channel *channel) + { + struct hv_ring_buffer_info *rbi = &channel->inbound; +- u32 orig_write_sz = hv_get_bytes_to_write(rbi); ++ u32 curr_write_sz, pending_sz, bytes_read, start_read_index; + + /* + * Make sure all reads are done before we update the read index since +@@ -408,8 +419,12 @@ void hv_pkt_iter_close(struct vmbus_channel *channel) + * is updated. + */ + virt_rmb(); ++ start_read_index = rbi->ring_buffer->read_index; + rbi->ring_buffer->read_index = rbi->priv_read_index; + ++ if (!rbi->ring_buffer->feature_bits.feat_pending_send_sz) ++ return; ++ + /* + * Issue a full memory barrier before making the signaling decision. + * Here is the reason for having this barrier: +@@ -423,26 +438,29 @@ void hv_pkt_iter_close(struct vmbus_channel *channel) + */ + virt_mb(); + +- /* If host has disabled notifications then skip */ +- if (rbi->ring_buffer->interrupt_mask) ++ pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz); ++ if (!pending_sz) + return; + +- if (rbi->ring_buffer->feature_bits.feat_pending_send_sz) { +- u32 pending_sz = READ_ONCE(rbi->ring_buffer->pending_send_sz); ++ /* ++ * Ensure the read of write_index in hv_get_bytes_to_write() ++ * happens after the read of pending_send_sz. ++ */ ++ virt_rmb(); ++ curr_write_sz = hv_get_bytes_to_write(rbi); ++ bytes_read = hv_pkt_iter_bytes_read(rbi, start_read_index); + +- /* +- * If there was space before we began iteration, +- * then host was not blocked. Also handles case where +- * pending_sz is zero then host has nothing pending +- * and does not need to be signaled. +- */ +- if (orig_write_sz > pending_sz) +- return; ++ /* ++ * If there was space before we began iteration, ++ * then host was not blocked. ++ */ + +- /* If pending write will not fit, don't give false hope. */ +- if (hv_get_bytes_to_write(rbi) < pending_sz) +- return; +- } ++ if (curr_write_sz - bytes_read > pending_sz) ++ return; ++ ++ /* If pending write will not fit, don't give false hope. */ ++ if (curr_write_sz <= pending_sz) ++ return; + + vmbus_setevent(channel); + } +diff --git a/drivers/iio/accel/st_accel_core.c b/drivers/iio/accel/st_accel_core.c +index 379de1829cdb..bef1f96c177c 100644 +--- a/drivers/iio/accel/st_accel_core.c ++++ b/drivers/iio/accel/st_accel_core.c +@@ -794,7 +794,7 @@ int st_accel_common_probe(struct iio_dev *indio_dev) + if (!pdata) + pdata = (struct st_sensors_platform_data *)&default_accel_pdata; + +- err = st_sensors_init_sensor(indio_dev, adata->dev->platform_data); ++ err = st_sensors_init_sensor(indio_dev, pdata); + if (err < 0) + goto st_accel_power_off; + +diff --git a/drivers/iio/adc/meson_saradc.c b/drivers/iio/adc/meson_saradc.c +index 7dc7d297a0fc..11484cb38b84 100644 +--- a/drivers/iio/adc/meson_saradc.c ++++ b/drivers/iio/adc/meson_saradc.c +@@ -462,8 +462,10 @@ static int meson_sar_adc_lock(struct iio_dev *indio_dev) + regmap_read(priv->regmap, MESON_SAR_ADC_DELAY, &val); + } while (val & MESON_SAR_ADC_DELAY_BL30_BUSY && timeout--); + +- if (timeout < 0) ++ if (timeout < 0) { ++ mutex_unlock(&indio_dev->mlock); + return -ETIMEDOUT; ++ } + } + + return 0; +diff --git a/drivers/iio/chemical/ccs811.c b/drivers/iio/chemical/ccs811.c +index 8cfac6d1cec4..9dd0e1cd93dd 100644 +--- a/drivers/iio/chemical/ccs811.c ++++ b/drivers/iio/chemical/ccs811.c +@@ -128,6 +128,9 @@ static int ccs811_start_sensor_application(struct i2c_client *client) + if (ret < 0) + return ret; + ++ if ((ret & CCS811_STATUS_FW_MODE_APPLICATION)) ++ return 0; ++ + if ((ret & CCS811_STATUS_APP_VALID_MASK) != + CCS811_STATUS_APP_VALID_LOADED) + return -EIO; +diff --git a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +index b485540da89e..cce0c93accef 100644 +--- a/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c ++++ b/drivers/iio/imu/st_lsm6dsx/st_lsm6dsx_core.c +@@ -392,7 +392,7 @@ static int st_lsm6dsx_read_oneshot(struct st_lsm6dsx_sensor *sensor, + + st_lsm6dsx_sensor_disable(sensor); + +- *val = (s16)data; ++ *val = (s16)le16_to_cpu(data); + + return IIO_VAL_INT; + } +diff --git a/drivers/iio/pressure/st_pressure_core.c b/drivers/iio/pressure/st_pressure_core.c +index ea075fcd5a6f..ec5ca03529b5 100644 +--- a/drivers/iio/pressure/st_pressure_core.c ++++ b/drivers/iio/pressure/st_pressure_core.c +@@ -617,7 +617,7 @@ int st_press_common_probe(struct iio_dev *indio_dev) + if (!pdata && press_data->sensor_settings->drdy_irq.addr) + pdata = (struct st_sensors_platform_data *)&default_press_pdata; + +- err = st_sensors_init_sensor(indio_dev, press_data->dev->platform_data); ++ err = st_sensors_init_sensor(indio_dev, pdata); + if (err < 0) + goto st_press_power_off; + +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index cef05ab83496..6d48d8a93b62 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -838,7 +838,8 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length, + *umem = ib_umem_get(pd->uobject->context, start, length, + access_flags, 0); + err = PTR_ERR_OR_ZERO(*umem); +- if (err < 0) { ++ if (err) { ++ *umem = NULL; + mlx5_ib_err(dev, "umem get failed (%d)\n", err); + return err; + } +@@ -1415,6 +1416,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, + if (err) { + mlx5_ib_warn(dev, "Failed to rereg UMR\n"); + ib_umem_release(mr->umem); ++ mr->umem = NULL; + clean_mr(dev, mr); + return err; + } +@@ -1498,14 +1500,11 @@ static int clean_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr) + u32 key = mr->mmkey.key; + + err = destroy_mkey(dev, mr); +- kfree(mr); + if (err) { + mlx5_ib_warn(dev, "failed to destroy mkey 0x%x (%d)\n", + key, err); + return err; + } +- } else { +- mlx5_mr_cache_free(dev, mr); + } + + return 0; +@@ -1548,6 +1547,11 @@ static int dereg_mr(struct mlx5_ib_dev *dev, struct mlx5_ib_mr *mr) + atomic_sub(npages, &dev->mdev->priv.reg_pages); + } + ++ if (!mr->allocated_from_cache) ++ kfree(mr); ++ else ++ mlx5_mr_cache_free(dev, mr); ++ + return 0; + } + +diff --git a/drivers/mmc/core/block.c b/drivers/mmc/core/block.c +index 9c6f2ce3b710..4281fdc0a13c 100644 +--- a/drivers/mmc/core/block.c ++++ b/drivers/mmc/core/block.c +@@ -65,6 +65,7 @@ MODULE_ALIAS("mmc:block"); + #define MMC_BLK_TIMEOUT_MS (10 * 60 * 1000) /* 10 minute timeout */ + #define MMC_SANITIZE_REQ_TIMEOUT 240000 + #define MMC_EXTRACT_INDEX_FROM_ARG(x) ((x & 0x00FF0000) >> 16) ++#define MMC_EXTRACT_VALUE_FROM_ARG(x) ((x & 0x0000FF00) >> 8) + + #define mmc_req_rel_wr(req) ((req->cmd_flags & REQ_FUA) && \ + (rq_data_dir(req) == WRITE)) +@@ -538,6 +539,24 @@ static int __mmc_blk_ioctl_cmd(struct mmc_card *card, struct mmc_blk_data *md, + return data.error; + } + ++ /* ++ * Make sure the cache of the PARTITION_CONFIG register and ++ * PARTITION_ACCESS bits is updated in case the ioctl ext_csd write ++ * changed it successfully. ++ */ ++ if ((MMC_EXTRACT_INDEX_FROM_ARG(cmd.arg) == EXT_CSD_PART_CONFIG) && ++ (cmd.opcode == MMC_SWITCH)) { ++ struct mmc_blk_data *main_md = dev_get_drvdata(&card->dev); ++ u8 value = MMC_EXTRACT_VALUE_FROM_ARG(cmd.arg); ++ ++ /* ++ * Update cache so the next mmc_blk_part_switch call operates ++ * on up-to-date data. ++ */ ++ card->ext_csd.part_config = value; ++ main_md->part_curr = value & EXT_CSD_PART_CONFIG_ACC_MASK; ++ } ++ + /* + * According to the SD specs, some commands require a delay after + * issuing the command. +diff --git a/drivers/mmc/core/card.h b/drivers/mmc/core/card.h +index 79a5b985ccf5..9c821eedd156 100644 +--- a/drivers/mmc/core/card.h ++++ b/drivers/mmc/core/card.h +@@ -82,6 +82,7 @@ struct mmc_fixup { + #define CID_MANFID_APACER 0x27 + #define CID_MANFID_KINGSTON 0x70 + #define CID_MANFID_HYNIX 0x90 ++#define CID_MANFID_NUMONYX 0xFE + + #define END_FIXUP { NULL } + +diff --git a/drivers/mmc/core/quirks.h b/drivers/mmc/core/quirks.h +index 75d317623852..5153577754f0 100644 +--- a/drivers/mmc/core/quirks.h ++++ b/drivers/mmc/core/quirks.h +@@ -109,6 +109,12 @@ static const struct mmc_fixup mmc_ext_csd_fixups[] = { + */ + MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_HYNIX, + 0x014a, add_quirk, MMC_QUIRK_BROKEN_HPI, 5), ++ /* ++ * Certain Micron (Numonyx) eMMC 4.5 cards might get broken when HPI ++ * feature is used so disable the HPI feature for such buggy cards. ++ */ ++ MMC_FIXUP_EXT_CSD_REV(CID_NAME_ANY, CID_MANFID_NUMONYX, ++ 0x014e, add_quirk, MMC_QUIRK_BROKEN_HPI, 6), + + END_FIXUP + }; +diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c +index fa41d9422d57..a84aa3f1ae85 100644 +--- a/drivers/mmc/host/dw_mmc-exynos.c ++++ b/drivers/mmc/host/dw_mmc-exynos.c +@@ -165,9 +165,15 @@ static void dw_mci_exynos_set_clksel_timing(struct dw_mci *host, u32 timing) + static int dw_mci_exynos_runtime_resume(struct device *dev) + { + struct dw_mci *host = dev_get_drvdata(dev); ++ int ret; ++ ++ ret = dw_mci_runtime_resume(dev); ++ if (ret) ++ return ret; + + dw_mci_exynos_config_smu(host); +- return dw_mci_runtime_resume(dev); ++ ++ return ret; + } + + /** +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 60341a814055..de31e20dc56c 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -413,7 +413,9 @@ static inline void dw_mci_set_cto(struct dw_mci *host) + cto_div = (mci_readl(host, CLKDIV) & 0xff) * 2; + if (cto_div == 0) + cto_div = 1; +- cto_ms = DIV_ROUND_UP(MSEC_PER_SEC * cto_clks * cto_div, host->bus_hz); ++ ++ cto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * cto_clks * cto_div, ++ host->bus_hz); + + /* add a bit spare time */ + cto_ms += 10; +@@ -562,6 +564,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) + (sizeof(struct idmac_desc_64addr) * + (i + 1))) >> 32; + /* Initialize reserved and buffer size fields to "0" */ ++ p->des0 = 0; + p->des1 = 0; + p->des2 = 0; + p->des3 = 0; +@@ -584,6 +587,7 @@ static int dw_mci_idmac_init(struct dw_mci *host) + i++, p++) { + p->des3 = cpu_to_le32(host->sg_dma + + (sizeof(struct idmac_desc) * (i + 1))); ++ p->des0 = 0; + p->des1 = 0; + } + +@@ -1799,8 +1803,8 @@ static bool dw_mci_reset(struct dw_mci *host) + } + + if (host->use_dma == TRANS_MODE_IDMAC) +- /* It is also recommended that we reset and reprogram idmac */ +- dw_mci_idmac_reset(host); ++ /* It is also required that we reinit idmac */ ++ dw_mci_idmac_init(host); + + ret = true; + +@@ -1947,8 +1951,9 @@ static void dw_mci_set_drto(struct dw_mci *host) + drto_div = (mci_readl(host, CLKDIV) & 0xff) * 2; + if (drto_div == 0) + drto_div = 1; +- drto_ms = DIV_ROUND_UP(MSEC_PER_SEC * drto_clks * drto_div, +- host->bus_hz); ++ ++ drto_ms = DIV_ROUND_UP_ULL((u64)MSEC_PER_SEC * drto_clks * drto_div, ++ host->bus_hz); + + /* add a bit spare time */ + drto_ms += 10; +diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c +index 3568294d4854..b25f444c5914 100644 +--- a/drivers/mtd/mtdchar.c ++++ b/drivers/mtd/mtdchar.c +@@ -487,7 +487,7 @@ static int shrink_ecclayout(struct mtd_info *mtd, + for (i = 0; i < MTD_MAX_ECCPOS_ENTRIES;) { + u32 eccpos; + +- ret = mtd_ooblayout_ecc(mtd, section, &oobregion); ++ ret = mtd_ooblayout_ecc(mtd, section++, &oobregion); + if (ret < 0) { + if (ret != -ERANGE) + return ret; +@@ -534,7 +534,7 @@ static int get_oobinfo(struct mtd_info *mtd, struct nand_oobinfo *to) + for (i = 0; i < ARRAY_SIZE(to->eccpos);) { + u32 eccpos; + +- ret = mtd_ooblayout_ecc(mtd, section, &oobregion); ++ ret = mtd_ooblayout_ecc(mtd, section++, &oobregion); + if (ret < 0) { + if (ret != -ERANGE) + return ret; +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index bbdd68a54d68..4005b427023c 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -173,14 +173,9 @@ static void set_addr(struct mtd_info *mtd, int column, int page_addr, int oob) + + /* returns nonzero if entire page is blank */ + static int check_read_ecc(struct mtd_info *mtd, struct fsl_ifc_ctrl *ctrl, +- u32 *eccstat, unsigned int bufnum) ++ u32 eccstat, unsigned int bufnum) + { +- u32 reg = eccstat[bufnum / 4]; +- int errors; +- +- errors = (reg >> ((3 - bufnum % 4) * 8)) & 15; +- +- return errors; ++ return (eccstat >> ((3 - bufnum % 4) * 8)) & 15; + } + + /* +@@ -193,7 +188,7 @@ static void fsl_ifc_run_command(struct mtd_info *mtd) + struct fsl_ifc_ctrl *ctrl = priv->ctrl; + struct fsl_ifc_nand_ctrl *nctrl = ifc_nand_ctrl; + struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs; +- u32 eccstat[4]; ++ u32 eccstat; + int i; + + /* set the chip select for NAND Transaction */ +@@ -228,19 +223,17 @@ static void fsl_ifc_run_command(struct mtd_info *mtd) + if (nctrl->eccread) { + int errors; + int bufnum = nctrl->page & priv->bufnum_mask; +- int sector = bufnum * chip->ecc.steps; +- int sector_end = sector + chip->ecc.steps - 1; ++ int sector_start = bufnum * chip->ecc.steps; ++ int sector_end = sector_start + chip->ecc.steps - 1; + __be32 *eccstat_regs; + +- if (ctrl->version >= FSL_IFC_VERSION_2_0_0) +- eccstat_regs = ifc->ifc_nand.v2_nand_eccstat; +- else +- eccstat_regs = ifc->ifc_nand.v1_nand_eccstat; ++ eccstat_regs = ifc->ifc_nand.nand_eccstat; ++ eccstat = ifc_in32(&eccstat_regs[sector_start / 4]); + +- for (i = sector / 4; i <= sector_end / 4; i++) +- eccstat[i] = ifc_in32(&eccstat_regs[i]); ++ for (i = sector_start; i <= sector_end; i++) { ++ if (i != sector_start && !(i % 4)) ++ eccstat = ifc_in32(&eccstat_regs[i / 4]); + +- for (i = sector; i <= sector_end; i++) { + errors = check_read_ecc(mtd, ctrl, eccstat, i); + + if (errors == 15) { +@@ -626,6 +619,7 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) + struct fsl_ifc_ctrl *ctrl = priv->ctrl; + struct fsl_ifc_runtime __iomem *ifc = ctrl->rregs; + u32 nand_fsr; ++ int status; + + /* Use READ_STATUS command, but wait for the device to be ready */ + ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | +@@ -640,12 +634,12 @@ static int fsl_ifc_wait(struct mtd_info *mtd, struct nand_chip *chip) + fsl_ifc_run_command(mtd); + + nand_fsr = ifc_in32(&ifc->ifc_nand.nand_fsr); +- ++ status = nand_fsr >> 24; + /* + * The chip always seems to report that it is + * write-protected, even when it is not. + */ +- return nand_fsr | NAND_STATUS_WP; ++ return status | NAND_STATUS_WP; + } + + /* +diff --git a/drivers/net/can/cc770/cc770.c b/drivers/net/can/cc770/cc770.c +index 1e37313054f3..6da69af103e6 100644 +--- a/drivers/net/can/cc770/cc770.c ++++ b/drivers/net/can/cc770/cc770.c +@@ -390,37 +390,23 @@ static int cc770_get_berr_counter(const struct net_device *dev, + return 0; + } + +-static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) ++static void cc770_tx(struct net_device *dev, int mo) + { + struct cc770_priv *priv = netdev_priv(dev); +- struct net_device_stats *stats = &dev->stats; +- struct can_frame *cf = (struct can_frame *)skb->data; +- unsigned int mo = obj2msgobj(CC770_OBJ_TX); ++ struct can_frame *cf = (struct can_frame *)priv->tx_skb->data; + u8 dlc, rtr; + u32 id; + int i; + +- if (can_dropped_invalid_skb(dev, skb)) +- return NETDEV_TX_OK; +- +- if ((cc770_read_reg(priv, +- msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { +- netdev_err(dev, "TX register is still occupied!\n"); +- return NETDEV_TX_BUSY; +- } +- +- netif_stop_queue(dev); +- + dlc = cf->can_dlc; + id = cf->can_id; +- if (cf->can_id & CAN_RTR_FLAG) +- rtr = 0; +- else +- rtr = MSGCFG_DIR; ++ rtr = cf->can_id & CAN_RTR_FLAG ? 0 : MSGCFG_DIR; ++ ++ cc770_write_reg(priv, msgobj[mo].ctrl0, ++ MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); + cc770_write_reg(priv, msgobj[mo].ctrl1, + RMTPND_RES | TXRQST_RES | CPUUPD_SET | NEWDAT_RES); +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_SET | TXIE_SET | RXIE_RES | INTPND_RES); ++ + if (id & CAN_EFF_FLAG) { + id &= CAN_EFF_MASK; + cc770_write_reg(priv, msgobj[mo].config, +@@ -439,22 +425,30 @@ static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) + for (i = 0; i < dlc; i++) + cc770_write_reg(priv, msgobj[mo].data[i], cf->data[i]); + +- /* Store echo skb before starting the transfer */ +- can_put_echo_skb(skb, dev, 0); +- + cc770_write_reg(priv, msgobj[mo].ctrl1, +- RMTPND_RES | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); ++ RMTPND_UNC | TXRQST_SET | CPUUPD_RES | NEWDAT_UNC); ++ cc770_write_reg(priv, msgobj[mo].ctrl0, ++ MSGVAL_SET | TXIE_SET | RXIE_SET | INTPND_UNC); ++} + +- stats->tx_bytes += dlc; ++static netdev_tx_t cc770_start_xmit(struct sk_buff *skb, struct net_device *dev) ++{ ++ struct cc770_priv *priv = netdev_priv(dev); ++ unsigned int mo = obj2msgobj(CC770_OBJ_TX); + ++ if (can_dropped_invalid_skb(dev, skb)) ++ return NETDEV_TX_OK; + +- /* +- * HM: We had some cases of repeated IRQs so make sure the +- * INT is acknowledged I know it's already further up, but +- * doing again fixed the issue +- */ +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); ++ netif_stop_queue(dev); ++ ++ if ((cc770_read_reg(priv, ++ msgobj[mo].ctrl1) & TXRQST_UNC) == TXRQST_SET) { ++ netdev_err(dev, "TX register is still occupied!\n"); ++ return NETDEV_TX_BUSY; ++ } ++ ++ priv->tx_skb = skb; ++ cc770_tx(dev, mo); + + return NETDEV_TX_OK; + } +@@ -680,19 +674,46 @@ static void cc770_tx_interrupt(struct net_device *dev, unsigned int o) + struct cc770_priv *priv = netdev_priv(dev); + struct net_device_stats *stats = &dev->stats; + unsigned int mo = obj2msgobj(o); ++ struct can_frame *cf; ++ u8 ctrl1; ++ ++ ctrl1 = cc770_read_reg(priv, msgobj[mo].ctrl1); + +- /* Nothing more to send, switch off interrupts */ + cc770_write_reg(priv, msgobj[mo].ctrl0, + MSGVAL_RES | TXIE_RES | RXIE_RES | INTPND_RES); +- /* +- * We had some cases of repeated IRQ so make sure the +- * INT is acknowledged ++ cc770_write_reg(priv, msgobj[mo].ctrl1, ++ RMTPND_RES | TXRQST_RES | MSGLST_RES | NEWDAT_RES); ++ ++ if (unlikely(!priv->tx_skb)) { ++ netdev_err(dev, "missing tx skb in tx interrupt\n"); ++ return; ++ } ++ ++ if (unlikely(ctrl1 & MSGLST_SET)) { ++ stats->rx_over_errors++; ++ stats->rx_errors++; ++ } ++ ++ /* When the CC770 is sending an RTR message and it receives a regular ++ * message that matches the id of the RTR message, it will overwrite the ++ * outgoing message in the TX register. When this happens we must ++ * process the received message and try to transmit the outgoing skb ++ * again. + */ +- cc770_write_reg(priv, msgobj[mo].ctrl0, +- MSGVAL_UNC | TXIE_UNC | RXIE_UNC | INTPND_RES); ++ if (unlikely(ctrl1 & NEWDAT_SET)) { ++ cc770_rx(dev, mo, ctrl1); ++ cc770_tx(dev, mo); ++ return; ++ } + ++ cf = (struct can_frame *)priv->tx_skb->data; ++ stats->tx_bytes += cf->can_dlc; + stats->tx_packets++; ++ ++ can_put_echo_skb(priv->tx_skb, dev, 0); + can_get_echo_skb(dev, 0); ++ priv->tx_skb = NULL; ++ + netif_wake_queue(dev); + } + +@@ -804,6 +825,7 @@ struct net_device *alloc_cc770dev(int sizeof_priv) + priv->can.do_set_bittiming = cc770_set_bittiming; + priv->can.do_set_mode = cc770_set_mode; + priv->can.ctrlmode_supported = CAN_CTRLMODE_3_SAMPLES; ++ priv->tx_skb = NULL; + + memcpy(priv->obj_flags, cc770_obj_flags, sizeof(cc770_obj_flags)); + +diff --git a/drivers/net/can/cc770/cc770.h b/drivers/net/can/cc770/cc770.h +index a1739db98d91..95752e1d1283 100644 +--- a/drivers/net/can/cc770/cc770.h ++++ b/drivers/net/can/cc770/cc770.h +@@ -193,6 +193,8 @@ struct cc770_priv { + u8 cpu_interface; /* CPU interface register */ + u8 clkout; /* Clock out register */ + u8 bus_config; /* Bus conffiguration register */ ++ ++ struct sk_buff *tx_skb; + }; + + struct net_device *alloc_cc770dev(int sizeof_priv); +diff --git a/drivers/net/can/ifi_canfd/ifi_canfd.c b/drivers/net/can/ifi_canfd/ifi_canfd.c +index 2772d05ff11c..fedd927ba6ed 100644 +--- a/drivers/net/can/ifi_canfd/ifi_canfd.c ++++ b/drivers/net/can/ifi_canfd/ifi_canfd.c +@@ -30,6 +30,7 @@ + #define IFI_CANFD_STCMD_ERROR_ACTIVE BIT(2) + #define IFI_CANFD_STCMD_ERROR_PASSIVE BIT(3) + #define IFI_CANFD_STCMD_BUSOFF BIT(4) ++#define IFI_CANFD_STCMD_ERROR_WARNING BIT(5) + #define IFI_CANFD_STCMD_BUSMONITOR BIT(16) + #define IFI_CANFD_STCMD_LOOPBACK BIT(18) + #define IFI_CANFD_STCMD_DISABLE_CANFD BIT(24) +@@ -52,7 +53,10 @@ + #define IFI_CANFD_TXSTCMD_OVERFLOW BIT(13) + + #define IFI_CANFD_INTERRUPT 0xc ++#define IFI_CANFD_INTERRUPT_ERROR_BUSOFF BIT(0) + #define IFI_CANFD_INTERRUPT_ERROR_WARNING BIT(1) ++#define IFI_CANFD_INTERRUPT_ERROR_STATE_CHG BIT(2) ++#define IFI_CANFD_INTERRUPT_ERROR_REC_TEC_INC BIT(3) + #define IFI_CANFD_INTERRUPT_ERROR_COUNTER BIT(10) + #define IFI_CANFD_INTERRUPT_TXFIFO_EMPTY BIT(16) + #define IFI_CANFD_INTERRUPT_TXFIFO_REMOVE BIT(22) +@@ -61,6 +65,10 @@ + #define IFI_CANFD_INTERRUPT_SET_IRQ ((u32)BIT(31)) + + #define IFI_CANFD_IRQMASK 0x10 ++#define IFI_CANFD_IRQMASK_ERROR_BUSOFF BIT(0) ++#define IFI_CANFD_IRQMASK_ERROR_WARNING BIT(1) ++#define IFI_CANFD_IRQMASK_ERROR_STATE_CHG BIT(2) ++#define IFI_CANFD_IRQMASK_ERROR_REC_TEC_INC BIT(3) + #define IFI_CANFD_IRQMASK_SET_ERR BIT(7) + #define IFI_CANFD_IRQMASK_SET_TS BIT(15) + #define IFI_CANFD_IRQMASK_TXFIFO_EMPTY BIT(16) +@@ -136,6 +144,8 @@ + #define IFI_CANFD_SYSCLOCK 0x50 + + #define IFI_CANFD_VER 0x54 ++#define IFI_CANFD_VER_REV_MASK 0xff ++#define IFI_CANFD_VER_REV_MIN_SUPPORTED 0x15 + + #define IFI_CANFD_IP_ID 0x58 + #define IFI_CANFD_IP_ID_VALUE 0xD073CAFD +@@ -220,7 +230,10 @@ static void ifi_canfd_irq_enable(struct net_device *ndev, bool enable) + + if (enable) { + enirq = IFI_CANFD_IRQMASK_TXFIFO_EMPTY | +- IFI_CANFD_IRQMASK_RXFIFO_NEMPTY; ++ IFI_CANFD_IRQMASK_RXFIFO_NEMPTY | ++ IFI_CANFD_IRQMASK_ERROR_STATE_CHG | ++ IFI_CANFD_IRQMASK_ERROR_WARNING | ++ IFI_CANFD_IRQMASK_ERROR_BUSOFF; + if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING) + enirq |= IFI_CANFD_INTERRUPT_ERROR_COUNTER; + } +@@ -361,12 +374,13 @@ static int ifi_canfd_handle_lost_msg(struct net_device *ndev) + return 1; + } + +-static int ifi_canfd_handle_lec_err(struct net_device *ndev, const u32 errctr) ++static int ifi_canfd_handle_lec_err(struct net_device *ndev) + { + struct ifi_canfd_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; + struct can_frame *cf; + struct sk_buff *skb; ++ u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR); + const u32 errmask = IFI_CANFD_ERROR_CTR_OVERLOAD_FIRST | + IFI_CANFD_ERROR_CTR_ACK_ERROR_FIRST | + IFI_CANFD_ERROR_CTR_BIT0_ERROR_FIRST | +@@ -449,6 +463,11 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev, + + switch (new_state) { + case CAN_STATE_ERROR_ACTIVE: ++ /* error active state */ ++ priv->can.can_stats.error_warning++; ++ priv->can.state = CAN_STATE_ERROR_ACTIVE; ++ break; ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + priv->can.can_stats.error_warning++; + priv->can.state = CAN_STATE_ERROR_WARNING; +@@ -477,7 +496,7 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev, + ifi_canfd_get_berr_counter(ndev, &bec); + + switch (new_state) { +- case CAN_STATE_ERROR_ACTIVE: ++ case CAN_STATE_ERROR_WARNING: + /* error warning state */ + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] = (bec.txerr > bec.rxerr) ? +@@ -510,22 +529,21 @@ static int ifi_canfd_handle_state_change(struct net_device *ndev, + return 1; + } + +-static int ifi_canfd_handle_state_errors(struct net_device *ndev, u32 stcmd) ++static int ifi_canfd_handle_state_errors(struct net_device *ndev) + { + struct ifi_canfd_priv *priv = netdev_priv(ndev); ++ u32 stcmd = readl(priv->base + IFI_CANFD_STCMD); + int work_done = 0; +- u32 isr; + +- /* +- * The ErrWarn condition is a little special, since the bit is +- * located in the INTERRUPT register instead of STCMD register. +- */ +- isr = readl(priv->base + IFI_CANFD_INTERRUPT); +- if ((isr & IFI_CANFD_INTERRUPT_ERROR_WARNING) && ++ if ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) && ++ (priv->can.state != CAN_STATE_ERROR_ACTIVE)) { ++ netdev_dbg(ndev, "Error, entered active state\n"); ++ work_done += ifi_canfd_handle_state_change(ndev, ++ CAN_STATE_ERROR_ACTIVE); ++ } ++ ++ if ((stcmd & IFI_CANFD_STCMD_ERROR_WARNING) && + (priv->can.state != CAN_STATE_ERROR_WARNING)) { +- /* Clear the interrupt */ +- writel(IFI_CANFD_INTERRUPT_ERROR_WARNING, +- priv->base + IFI_CANFD_INTERRUPT); + netdev_dbg(ndev, "Error, entered warning state\n"); + work_done += ifi_canfd_handle_state_change(ndev, + CAN_STATE_ERROR_WARNING); +@@ -552,18 +570,11 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota) + { + struct net_device *ndev = napi->dev; + struct ifi_canfd_priv *priv = netdev_priv(ndev); +- const u32 stcmd_state_mask = IFI_CANFD_STCMD_ERROR_PASSIVE | +- IFI_CANFD_STCMD_BUSOFF; +- int work_done = 0; +- +- u32 stcmd = readl(priv->base + IFI_CANFD_STCMD); + u32 rxstcmd = readl(priv->base + IFI_CANFD_RXSTCMD); +- u32 errctr = readl(priv->base + IFI_CANFD_ERROR_CTR); ++ int work_done = 0; + + /* Handle bus state changes */ +- if ((stcmd & stcmd_state_mask) || +- ((stcmd & IFI_CANFD_STCMD_ERROR_ACTIVE) == 0)) +- work_done += ifi_canfd_handle_state_errors(ndev, stcmd); ++ work_done += ifi_canfd_handle_state_errors(ndev); + + /* Handle lost messages on RX */ + if (rxstcmd & IFI_CANFD_RXSTCMD_OVERFLOW) +@@ -571,7 +582,7 @@ static int ifi_canfd_poll(struct napi_struct *napi, int quota) + + /* Handle lec errors on the bus */ + if (priv->can.ctrlmode & CAN_CTRLMODE_BERR_REPORTING) +- work_done += ifi_canfd_handle_lec_err(ndev, errctr); ++ work_done += ifi_canfd_handle_lec_err(ndev); + + /* Handle normal messages on RX */ + if (!(rxstcmd & IFI_CANFD_RXSTCMD_EMPTY)) +@@ -592,12 +603,13 @@ static irqreturn_t ifi_canfd_isr(int irq, void *dev_id) + struct net_device_stats *stats = &ndev->stats; + const u32 rx_irq_mask = IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY | + IFI_CANFD_INTERRUPT_RXFIFO_NEMPTY_PER | ++ IFI_CANFD_INTERRUPT_ERROR_COUNTER | ++ IFI_CANFD_INTERRUPT_ERROR_STATE_CHG | + IFI_CANFD_INTERRUPT_ERROR_WARNING | +- IFI_CANFD_INTERRUPT_ERROR_COUNTER; ++ IFI_CANFD_INTERRUPT_ERROR_BUSOFF; + const u32 tx_irq_mask = IFI_CANFD_INTERRUPT_TXFIFO_EMPTY | + IFI_CANFD_INTERRUPT_TXFIFO_REMOVE; +- const u32 clr_irq_mask = ~((u32)(IFI_CANFD_INTERRUPT_SET_IRQ | +- IFI_CANFD_INTERRUPT_ERROR_WARNING)); ++ const u32 clr_irq_mask = ~((u32)IFI_CANFD_INTERRUPT_SET_IRQ); + u32 isr; + + isr = readl(priv->base + IFI_CANFD_INTERRUPT); +@@ -933,7 +945,7 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev) + struct resource *res; + void __iomem *addr; + int irq, ret; +- u32 id; ++ u32 id, rev; + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + addr = devm_ioremap_resource(dev, res); +@@ -947,6 +959,13 @@ static int ifi_canfd_plat_probe(struct platform_device *pdev) + return -EINVAL; + } + ++ rev = readl(addr + IFI_CANFD_VER) & IFI_CANFD_VER_REV_MASK; ++ if (rev < IFI_CANFD_VER_REV_MIN_SUPPORTED) { ++ dev_err(dev, "This block is too old (rev %i), minimum supported is rev %i\n", ++ rev, IFI_CANFD_VER_REV_MIN_SUPPORTED); ++ return -EINVAL; ++ } ++ + ndev = alloc_candev(sizeof(*priv), 1); + if (!ndev) + return -ENOMEM; +diff --git a/drivers/net/can/peak_canfd/peak_canfd.c b/drivers/net/can/peak_canfd/peak_canfd.c +index 55513411a82e..ed8561d4a90f 100644 +--- a/drivers/net/can/peak_canfd/peak_canfd.c ++++ b/drivers/net/can/peak_canfd/peak_canfd.c +@@ -262,7 +262,6 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, + + spin_lock_irqsave(&priv->echo_lock, flags); + can_get_echo_skb(priv->ndev, msg->client); +- spin_unlock_irqrestore(&priv->echo_lock, flags); + + /* count bytes of the echo instead of skb */ + stats->tx_bytes += cf_len; +@@ -271,6 +270,7 @@ static int pucan_handle_can_rx(struct peak_canfd_priv *priv, + /* restart tx queue (a slot is free) */ + netif_wake_queue(priv->ndev); + ++ spin_unlock_irqrestore(&priv->echo_lock, flags); + return 0; + } + +@@ -333,7 +333,6 @@ static int pucan_handle_status(struct peak_canfd_priv *priv, + + /* this STATUS is the CNF of the RX_BARRIER: Tx path can be setup */ + if (pucan_status_is_rx_barrier(msg)) { +- unsigned long flags; + + if (priv->enable_tx_path) { + int err = priv->enable_tx_path(priv); +@@ -342,16 +341,8 @@ static int pucan_handle_status(struct peak_canfd_priv *priv, + return err; + } + +- /* restart network queue only if echo skb array is free */ +- spin_lock_irqsave(&priv->echo_lock, flags); +- +- if (!priv->can.echo_skb[priv->echo_idx]) { +- spin_unlock_irqrestore(&priv->echo_lock, flags); +- +- netif_wake_queue(ndev); +- } else { +- spin_unlock_irqrestore(&priv->echo_lock, flags); +- } ++ /* start network queue (echo_skb array is empty) */ ++ netif_start_queue(ndev); + + return 0; + } +@@ -726,11 +717,6 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb, + */ + should_stop_tx_queue = !!(priv->can.echo_skb[priv->echo_idx]); + +- spin_unlock_irqrestore(&priv->echo_lock, flags); +- +- /* write the skb on the interface */ +- priv->write_tx_msg(priv, msg); +- + /* stop network tx queue if not enough room to save one more msg too */ + if (priv->can.ctrlmode & CAN_CTRLMODE_FD) + should_stop_tx_queue |= (room_left < +@@ -742,6 +728,11 @@ static netdev_tx_t peak_canfd_start_xmit(struct sk_buff *skb, + if (should_stop_tx_queue) + netif_stop_queue(ndev); + ++ spin_unlock_irqrestore(&priv->echo_lock, flags); ++ ++ /* write the skb on the interface */ ++ priv->write_tx_msg(priv, msg); ++ + return NETDEV_TX_OK; + } + +diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c +index 788c3464a3b0..3c51a884db87 100644 +--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c ++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c +@@ -349,8 +349,12 @@ static irqreturn_t pciefd_irq_handler(int irq, void *arg) + priv->tx_pages_free++; + spin_unlock_irqrestore(&priv->tx_lock, flags); + +- /* wake producer up */ +- netif_wake_queue(priv->ucan.ndev); ++ /* wake producer up (only if enough room in echo_skb array) */ ++ spin_lock_irqsave(&priv->ucan.echo_lock, flags); ++ if (!priv->ucan.can.echo_skb[priv->ucan.echo_idx]) ++ netif_wake_queue(priv->ucan.ndev); ++ ++ spin_unlock_irqrestore(&priv->ucan.echo_lock, flags); + } + + /* re-enable Rx DMA transfer for this CAN */ +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +index 2ce675ab40ef..450f2216fac2 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +@@ -462,25 +462,23 @@ static int brcmf_p2p_set_firmware(struct brcmf_if *ifp, u8 *p2p_mac) + * @dev_addr: optional device address. + * + * P2P needs mac addresses for P2P device and interface. If no device +- * address it specified, these are derived from the primary net device, ie. +- * the permanent ethernet address of the device. ++ * address it specified, these are derived from a random ethernet ++ * address. + */ + static void brcmf_p2p_generate_bss_mac(struct brcmf_p2p_info *p2p, u8 *dev_addr) + { +- struct brcmf_if *pri_ifp = p2p->bss_idx[P2PAPI_BSSCFG_PRIMARY].vif->ifp; +- bool local_admin = false; ++ bool random_addr = false; + +- if (!dev_addr || is_zero_ether_addr(dev_addr)) { +- dev_addr = pri_ifp->mac_addr; +- local_admin = true; +- } ++ if (!dev_addr || is_zero_ether_addr(dev_addr)) ++ random_addr = true; + +- /* Generate the P2P Device Address. This consists of the device's +- * primary MAC address with the locally administered bit set. ++ /* Generate the P2P Device Address obtaining a random ethernet ++ * address with the locally administered bit set. + */ +- memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); +- if (local_admin) +- p2p->dev_addr[0] |= 0x02; ++ if (random_addr) ++ eth_random_addr(p2p->dev_addr); ++ else ++ memcpy(p2p->dev_addr, dev_addr, ETH_ALEN); + + /* Generate the P2P Interface Address. If the discovery and connection + * BSSCFGs need to simultaneously co-exist, then this address must be +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 4d47b97adfed..0034ebd3e5ba 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -1123,7 +1123,8 @@ static void _rtl8723be_enable_aspm_back_door(struct ieee80211_hw *hw) + + /* Configuration Space offset 0x70f BIT7 is used to control L0S */ + tmp8 = _rtl8723be_dbi_read(rtlpriv, 0x70f); +- _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7)); ++ _rtl8723be_dbi_write(rtlpriv, 0x70f, tmp8 | BIT(7) | ++ ASPM_L1_LATENCY << 3); + + /* Configuration Space offset 0x719 Bit3 is for L1 + * BIT4 is for clock request +diff --git a/drivers/nvdimm/blk.c b/drivers/nvdimm/blk.c +index 345acca576b3..1bd7b3734751 100644 +--- a/drivers/nvdimm/blk.c ++++ b/drivers/nvdimm/blk.c +@@ -278,8 +278,6 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk) + disk->queue = q; + disk->flags = GENHD_FL_EXT_DEVT; + nvdimm_namespace_disk_name(&nsblk->common, disk->disk_name); +- set_capacity(disk, 0); +- device_add_disk(dev, disk); + + if (devm_add_action_or_reset(dev, nd_blk_release_disk, disk)) + return -ENOMEM; +@@ -292,6 +290,7 @@ static int nsblk_attach_disk(struct nd_namespace_blk *nsblk) + } + + set_capacity(disk, available_disk_size >> SECTOR_SHIFT); ++ device_add_disk(dev, disk); + revalidate_disk(disk); + return 0; + } +diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c +index 09428ebd315b..b2feda35966b 100644 +--- a/drivers/nvdimm/btt.c ++++ b/drivers/nvdimm/btt.c +@@ -1542,8 +1542,6 @@ static int btt_blk_init(struct btt *btt) + queue_flag_set_unlocked(QUEUE_FLAG_NONROT, btt->btt_queue); + btt->btt_queue->queuedata = btt; + +- set_capacity(btt->btt_disk, 0); +- device_add_disk(&btt->nd_btt->dev, btt->btt_disk); + if (btt_meta_size(btt)) { + int rc = nd_integrity_init(btt->btt_disk, btt_meta_size(btt)); + +@@ -1555,6 +1553,7 @@ static int btt_blk_init(struct btt *btt) + } + } + set_capacity(btt->btt_disk, btt->nlba * btt->sector_size >> 9); ++ device_add_disk(&btt->nd_btt->dev, btt->btt_disk); + btt->nd_btt->size = btt->nlba * (u64)btt->sector_size; + revalidate_disk(btt->btt_disk); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index d18824772f6c..05fadcc4f9d2 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3899,6 +3899,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230, + quirk_dma_func1_alias); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0642, + quirk_dma_func1_alias); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_TTI, 0x0645, ++ quirk_dma_func1_alias); + /* https://bugs.gentoo.org/show_bug.cgi?id=497630 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_JMICRON, + PCI_DEVICE_ID_JMICRON_JMB388_ESD, +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c +index 071084d3ee9c..92aeea174a56 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c +@@ -129,7 +129,7 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = { + EXYNOS_PIN_BANK_EINTW(8, 0xc60, "gph3", 0x0c), + }; + +-const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = s5pv210_pin_bank, +@@ -142,6 +142,11 @@ const struct samsung_pin_ctrl s5pv210_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data s5pv210_of_data __initconst = { ++ .ctrl = s5pv210_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s5pv210_pin_ctrl), ++}; ++ + /* Pad retention control code for accessing PMU regmap */ + static atomic_t exynos_shared_retention_refcnt; + +@@ -204,7 +209,7 @@ static const struct samsung_retention_data exynos3250_retention_data __initconst + * Samsung pinctrl driver data for Exynos3250 SoC. Exynos3250 SoC includes + * two gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos3250_pin_banks0, +@@ -225,6 +230,11 @@ const struct samsung_pin_ctrl exynos3250_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos3250_of_data __initconst = { ++ .ctrl = exynos3250_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos3250_pin_ctrl), ++}; ++ + /* pin banks of exynos4210 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos4210_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00), +@@ -308,7 +318,7 @@ static const struct samsung_retention_data exynos4_audio_retention_data __initco + * Samsung pinctrl driver data for Exynos4210 SoC. Exynos4210 SoC includes + * three gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos4210_pin_banks0, +@@ -334,6 +344,11 @@ const struct samsung_pin_ctrl exynos4210_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos4210_of_data __initconst = { ++ .ctrl = exynos4210_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos4210_pin_ctrl), ++}; ++ + /* pin banks of exynos4x12 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos4x12_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00), +@@ -396,7 +411,7 @@ static const struct samsung_pin_bank_data exynos4x12_pin_banks3[] __initconst = + * Samsung pinctrl driver data for Exynos4x12 SoC. Exynos4x12 SoC includes + * four gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos4x12_pin_banks0, +@@ -432,6 +447,11 @@ const struct samsung_pin_ctrl exynos4x12_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos4x12_of_data __initconst = { ++ .ctrl = exynos4x12_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos4x12_pin_ctrl), ++}; ++ + /* pin banks of exynos5250 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos5250_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00), +@@ -492,7 +512,7 @@ static const struct samsung_pin_bank_data exynos5250_pin_banks3[] __initconst = + * Samsung pinctrl driver data for Exynos5250 SoC. Exynos5250 SoC includes + * four gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos5250_pin_banks0, +@@ -528,6 +548,11 @@ const struct samsung_pin_ctrl exynos5250_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos5250_of_data __initconst = { ++ .ctrl = exynos5250_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos5250_pin_ctrl), ++}; ++ + /* pin banks of exynos5260 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos5260_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(4, 0x000, "gpa0", 0x00), +@@ -572,7 +597,7 @@ static const struct samsung_pin_bank_data exynos5260_pin_banks2[] __initconst = + * Samsung pinctrl driver data for Exynos5260 SoC. Exynos5260 SoC includes + * three gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos5260_pin_banks0, +@@ -592,6 +617,11 @@ const struct samsung_pin_ctrl exynos5260_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos5260_of_data __initconst = { ++ .ctrl = exynos5260_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos5260_pin_ctrl), ++}; ++ + /* pin banks of exynos5410 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpa0", 0x00), +@@ -662,7 +692,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks3[] __initconst = + * Samsung pinctrl driver data for Exynos5410 SoC. Exynos5410 SoC includes + * four gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos5410_pin_banks0, +@@ -695,6 +725,11 @@ const struct samsung_pin_ctrl exynos5410_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos5410_of_data __initconst = { ++ .ctrl = exynos5410_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos5410_pin_ctrl), ++}; ++ + /* pin banks of exynos5420 pin-controller 0 */ + static const struct samsung_pin_bank_data exynos5420_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTG(8, 0x000, "gpy7", 0x00), +@@ -779,7 +814,7 @@ static const struct samsung_retention_data exynos5420_retention_data __initconst + * Samsung pinctrl driver data for Exynos5420 SoC. Exynos5420 SoC includes + * four gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos5420_pin_banks0, +@@ -813,3 +848,8 @@ const struct samsung_pin_ctrl exynos5420_pin_ctrl[] __initconst = { + .retention_data = &exynos4_audio_retention_data, + }, + }; ++ ++const struct samsung_pinctrl_of_match_data exynos5420_of_data __initconst = { ++ .ctrl = exynos5420_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos5420_pin_ctrl), ++}; +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c +index 08e9fdb58fd2..0ab88fc268ea 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm64.c +@@ -180,7 +180,7 @@ static const struct samsung_retention_data exynos5433_fsys_retention_data __init + * Samsung pinctrl driver data for Exynos5433 SoC. Exynos5433 SoC includes + * ten gpio/pin-mux/pinconfig controllers. + */ +-const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 data */ + .pin_banks = exynos5433_pin_banks0, +@@ -265,6 +265,11 @@ const struct samsung_pin_ctrl exynos5433_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data exynos5433_of_data __initconst = { ++ .ctrl = exynos5433_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos5433_pin_ctrl), ++}; ++ + /* pin banks of exynos7 pin-controller - ALIVE */ + static const struct samsung_pin_bank_data exynos7_pin_banks0[] __initconst = { + EXYNOS_PIN_BANK_EINTW(8, 0x000, "gpa0", 0x00), +@@ -344,7 +349,7 @@ static const struct samsung_pin_bank_data exynos7_pin_banks9[] __initconst = { + EXYNOS_PIN_BANK_EINTG(4, 0x020, "gpz1", 0x04), + }; + +-const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = { + { + /* pin-controller instance 0 Alive data */ + .pin_banks = exynos7_pin_banks0, +@@ -397,3 +402,8 @@ const struct samsung_pin_ctrl exynos7_pin_ctrl[] __initconst = { + .eint_gpio_init = exynos_eint_gpio_init, + }, + }; ++ ++const struct samsung_pinctrl_of_match_data exynos7_of_data __initconst = { ++ .ctrl = exynos7_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(exynos7_pin_ctrl), ++}; +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +index edf27264b603..67da1cf18b68 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c24xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c24xx.c +@@ -570,7 +570,7 @@ static const struct samsung_pin_bank_data s3c2412_pin_banks[] __initconst = { + PIN_BANK_2BIT(13, 0x080, "gpj"), + }; + +-const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = { + { + .pin_banks = s3c2412_pin_banks, + .nr_banks = ARRAY_SIZE(s3c2412_pin_banks), +@@ -578,6 +578,11 @@ const struct samsung_pin_ctrl s3c2412_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data s3c2412_of_data __initconst = { ++ .ctrl = s3c2412_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s3c2412_pin_ctrl), ++}; ++ + static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = { + PIN_BANK_A(27, 0x000, "gpa"), + PIN_BANK_2BIT(11, 0x010, "gpb"), +@@ -592,7 +597,7 @@ static const struct samsung_pin_bank_data s3c2416_pin_banks[] __initconst = { + PIN_BANK_2BIT(2, 0x100, "gpm"), + }; + +-const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = { + { + .pin_banks = s3c2416_pin_banks, + .nr_banks = ARRAY_SIZE(s3c2416_pin_banks), +@@ -600,6 +605,11 @@ const struct samsung_pin_ctrl s3c2416_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data s3c2416_of_data __initconst = { ++ .ctrl = s3c2416_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s3c2416_pin_ctrl), ++}; ++ + static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = { + PIN_BANK_A(25, 0x000, "gpa"), + PIN_BANK_2BIT(11, 0x010, "gpb"), +@@ -612,7 +622,7 @@ static const struct samsung_pin_bank_data s3c2440_pin_banks[] __initconst = { + PIN_BANK_2BIT(13, 0x0d0, "gpj"), + }; + +-const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = { + { + .pin_banks = s3c2440_pin_banks, + .nr_banks = ARRAY_SIZE(s3c2440_pin_banks), +@@ -620,6 +630,11 @@ const struct samsung_pin_ctrl s3c2440_pin_ctrl[] __initconst = { + }, + }; + ++const struct samsung_pinctrl_of_match_data s3c2440_of_data __initconst = { ++ .ctrl = s3c2440_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s3c2440_pin_ctrl), ++}; ++ + static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = { + PIN_BANK_A(28, 0x000, "gpa"), + PIN_BANK_2BIT(11, 0x010, "gpb"), +@@ -635,10 +650,15 @@ static const struct samsung_pin_bank_data s3c2450_pin_banks[] __initconst = { + PIN_BANK_2BIT(2, 0x100, "gpm"), + }; + +-const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s3c2450_pin_ctrl[] __initconst = { + { + .pin_banks = s3c2450_pin_banks, + .nr_banks = ARRAY_SIZE(s3c2450_pin_banks), + .eint_wkup_init = s3c24xx_eint_init, + }, + }; ++ ++const struct samsung_pinctrl_of_match_data s3c2450_of_data __initconst = { ++ .ctrl = s3c2450_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s3c2450_pin_ctrl), ++}; +diff --git a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +index e63663b32907..0bdc1e683181 100644 +--- a/drivers/pinctrl/samsung/pinctrl-s3c64xx.c ++++ b/drivers/pinctrl/samsung/pinctrl-s3c64xx.c +@@ -794,7 +794,7 @@ static const struct samsung_pin_bank_data s3c64xx_pin_banks0[] __initconst = { + * Samsung pinctrl driver data for S3C64xx SoC. S3C64xx SoC includes + * one gpio/pin-mux/pinconfig controller. + */ +-const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = { ++static const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = { + { + /* pin-controller instance 1 data */ + .pin_banks = s3c64xx_pin_banks0, +@@ -803,3 +803,8 @@ const struct samsung_pin_ctrl s3c64xx_pin_ctrl[] __initconst = { + .eint_wkup_init = s3c64xx_eint_eint0_init, + }, + }; ++ ++const struct samsung_pinctrl_of_match_data s3c64xx_of_data __initconst = { ++ .ctrl = s3c64xx_pin_ctrl, ++ .num_ctrl = ARRAY_SIZE(s3c64xx_pin_ctrl), ++}; +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.c b/drivers/pinctrl/samsung/pinctrl-samsung.c +index e04f7fe0a65d..26e8fab736f1 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.c ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.c +@@ -947,12 +947,33 @@ static int samsung_gpiolib_register(struct platform_device *pdev, + return 0; + } + ++static const struct samsung_pin_ctrl * ++samsung_pinctrl_get_soc_data_for_of_alias(struct platform_device *pdev) ++{ ++ struct device_node *node = pdev->dev.of_node; ++ const struct samsung_pinctrl_of_match_data *of_data; ++ int id; ++ ++ id = of_alias_get_id(node, "pinctrl"); ++ if (id < 0) { ++ dev_err(&pdev->dev, "failed to get alias id\n"); ++ return NULL; ++ } ++ ++ of_data = of_device_get_match_data(&pdev->dev); ++ if (id >= of_data->num_ctrl) { ++ dev_err(&pdev->dev, "invalid alias id %d\n", id); ++ return NULL; ++ } ++ ++ return &(of_data->ctrl[id]); ++} ++ + /* retrieve the soc specific data */ + static const struct samsung_pin_ctrl * + samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, + struct platform_device *pdev) + { +- int id; + struct device_node *node = pdev->dev.of_node; + struct device_node *np; + const struct samsung_pin_bank_data *bdata; +@@ -962,13 +983,9 @@ samsung_pinctrl_get_soc_data(struct samsung_pinctrl_drv_data *d, + void __iomem *virt_base[SAMSUNG_PINCTRL_NUM_RESOURCES]; + unsigned int i; + +- id = of_alias_get_id(node, "pinctrl"); +- if (id < 0) { +- dev_err(&pdev->dev, "failed to get alias id\n"); ++ ctrl = samsung_pinctrl_get_soc_data_for_of_alias(pdev); ++ if (!ctrl) + return ERR_PTR(-ENOENT); +- } +- ctrl = of_device_get_match_data(&pdev->dev); +- ctrl += id; + + d->suspend = ctrl->suspend; + d->resume = ctrl->resume; +@@ -1193,41 +1210,41 @@ static int __maybe_unused samsung_pinctrl_resume(struct device *dev) + static const struct of_device_id samsung_pinctrl_dt_match[] = { + #ifdef CONFIG_PINCTRL_EXYNOS_ARM + { .compatible = "samsung,exynos3250-pinctrl", +- .data = exynos3250_pin_ctrl }, ++ .data = &exynos3250_of_data }, + { .compatible = "samsung,exynos4210-pinctrl", +- .data = exynos4210_pin_ctrl }, ++ .data = &exynos4210_of_data }, + { .compatible = "samsung,exynos4x12-pinctrl", +- .data = exynos4x12_pin_ctrl }, ++ .data = &exynos4x12_of_data }, + { .compatible = "samsung,exynos5250-pinctrl", +- .data = exynos5250_pin_ctrl }, ++ .data = &exynos5250_of_data }, + { .compatible = "samsung,exynos5260-pinctrl", +- .data = exynos5260_pin_ctrl }, ++ .data = &exynos5260_of_data }, + { .compatible = "samsung,exynos5410-pinctrl", +- .data = exynos5410_pin_ctrl }, ++ .data = &exynos5410_of_data }, + { .compatible = "samsung,exynos5420-pinctrl", +- .data = exynos5420_pin_ctrl }, ++ .data = &exynos5420_of_data }, + { .compatible = "samsung,s5pv210-pinctrl", +- .data = s5pv210_pin_ctrl }, ++ .data = &s5pv210_of_data }, + #endif + #ifdef CONFIG_PINCTRL_EXYNOS_ARM64 + { .compatible = "samsung,exynos5433-pinctrl", +- .data = exynos5433_pin_ctrl }, ++ .data = &exynos5433_of_data }, + { .compatible = "samsung,exynos7-pinctrl", +- .data = exynos7_pin_ctrl }, ++ .data = &exynos7_of_data }, + #endif + #ifdef CONFIG_PINCTRL_S3C64XX + { .compatible = "samsung,s3c64xx-pinctrl", +- .data = s3c64xx_pin_ctrl }, ++ .data = &s3c64xx_of_data }, + #endif + #ifdef CONFIG_PINCTRL_S3C24XX + { .compatible = "samsung,s3c2412-pinctrl", +- .data = s3c2412_pin_ctrl }, ++ .data = &s3c2412_of_data }, + { .compatible = "samsung,s3c2416-pinctrl", +- .data = s3c2416_pin_ctrl }, ++ .data = &s3c2416_of_data }, + { .compatible = "samsung,s3c2440-pinctrl", +- .data = s3c2440_pin_ctrl }, ++ .data = &s3c2440_of_data }, + { .compatible = "samsung,s3c2450-pinctrl", +- .data = s3c2450_pin_ctrl }, ++ .data = &s3c2450_of_data }, + #endif + {}, + }; +diff --git a/drivers/pinctrl/samsung/pinctrl-samsung.h b/drivers/pinctrl/samsung/pinctrl-samsung.h +index 9af07af6cad6..ae932e0c05f2 100644 +--- a/drivers/pinctrl/samsung/pinctrl-samsung.h ++++ b/drivers/pinctrl/samsung/pinctrl-samsung.h +@@ -285,6 +285,16 @@ struct samsung_pinctrl_drv_data { + void (*resume)(struct samsung_pinctrl_drv_data *); + }; + ++/** ++ * struct samsung_pinctrl_of_match_data: OF match device specific configuration data. ++ * @ctrl: array of pin controller data. ++ * @num_ctrl: size of array @ctrl. ++ */ ++struct samsung_pinctrl_of_match_data { ++ const struct samsung_pin_ctrl *ctrl; ++ unsigned int num_ctrl; ++}; ++ + /** + * struct samsung_pin_group: represent group of pins of a pinmux function. + * @name: name of the pin group, used to lookup the group. +@@ -313,20 +323,20 @@ struct samsung_pmx_func { + }; + + /* list of all exported SoC specific data */ +-extern const struct samsung_pin_ctrl exynos3250_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos4210_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos4x12_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos5250_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos5260_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos5410_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos5420_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos5433_pin_ctrl[]; +-extern const struct samsung_pin_ctrl exynos7_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s3c64xx_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s3c2412_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s3c2416_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s3c2440_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s3c2450_pin_ctrl[]; +-extern const struct samsung_pin_ctrl s5pv210_pin_ctrl[]; ++extern const struct samsung_pinctrl_of_match_data exynos3250_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos4210_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos4x12_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos5250_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos5260_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos5410_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos5420_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos5433_of_data; ++extern const struct samsung_pinctrl_of_match_data exynos7_of_data; ++extern const struct samsung_pinctrl_of_match_data s3c64xx_of_data; ++extern const struct samsung_pinctrl_of_match_data s3c2412_of_data; ++extern const struct samsung_pinctrl_of_match_data s3c2416_of_data; ++extern const struct samsung_pinctrl_of_match_data s3c2440_of_data; ++extern const struct samsung_pinctrl_of_match_data s3c2450_of_data; ++extern const struct samsung_pinctrl_of_match_data s5pv210_of_data; + + #endif /* __PINCTRL_SAMSUNG_H */ +diff --git a/drivers/staging/android/ion/ion_cma_heap.c b/drivers/staging/android/ion/ion_cma_heap.c +index 86196ffd2faf..fa3e4b7e0c9f 100644 +--- a/drivers/staging/android/ion/ion_cma_heap.c ++++ b/drivers/staging/android/ion/ion_cma_heap.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #include "ion.h" + +@@ -51,6 +52,22 @@ static int ion_cma_allocate(struct ion_heap *heap, struct ion_buffer *buffer, + if (!pages) + return -ENOMEM; + ++ if (PageHighMem(pages)) { ++ unsigned long nr_clear_pages = nr_pages; ++ struct page *page = pages; ++ ++ while (nr_clear_pages > 0) { ++ void *vaddr = kmap_atomic(page); ++ ++ memset(vaddr, 0, PAGE_SIZE); ++ kunmap_atomic(vaddr); ++ page++; ++ nr_clear_pages--; ++ } ++ } else { ++ memset(page_address(pages), 0, size); ++ } ++ + table = kmalloc(sizeof(*table), GFP_KERNEL); + if (!table) + goto err; +diff --git a/drivers/staging/lustre/lustre/ptlrpc/sec.c b/drivers/staging/lustre/lustre/ptlrpc/sec.c +index cd7a5391a574..0a3f832095ea 100644 +--- a/drivers/staging/lustre/lustre/ptlrpc/sec.c ++++ b/drivers/staging/lustre/lustre/ptlrpc/sec.c +@@ -847,7 +847,7 @@ void sptlrpc_request_out_callback(struct ptlrpc_request *req) + if (req->rq_pool || !req->rq_reqbuf) + return; + +- kfree(req->rq_reqbuf); ++ kvfree(req->rq_reqbuf); + req->rq_reqbuf = NULL; + req->rq_reqbuf_len = 0; + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 2ebaba16f785..5a5813d01cf8 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1725,7 +1725,7 @@ static void reset_terminal(struct vc_data *vc, int do_clear) + default_attr(vc); + update_attr(vc); + +- vc->vc_tab_stop[0] = 0x01010100; ++ vc->vc_tab_stop[0] = + vc->vc_tab_stop[1] = + vc->vc_tab_stop[2] = + vc->vc_tab_stop[3] = +@@ -1769,7 +1769,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + vc->vc_pos -= (vc->vc_x << 1); + while (vc->vc_x < vc->vc_cols - 1) { + vc->vc_x++; +- if (vc->vc_tab_stop[vc->vc_x >> 5] & (1 << (vc->vc_x & 31))) ++ if (vc->vc_tab_stop[7 & (vc->vc_x >> 5)] & (1 << (vc->vc_x & 31))) + break; + } + vc->vc_pos += (vc->vc_x << 1); +@@ -1829,7 +1829,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + lf(vc); + return; + case 'H': +- vc->vc_tab_stop[vc->vc_x >> 5] |= (1 << (vc->vc_x & 31)); ++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] |= (1 << (vc->vc_x & 31)); + return; + case 'Z': + respond_ID(tty); +@@ -2022,7 +2022,7 @@ static void do_con_trol(struct tty_struct *tty, struct vc_data *vc, int c) + return; + case 'g': + if (!vc->vc_par[0]) +- vc->vc_tab_stop[vc->vc_x >> 5] &= ~(1 << (vc->vc_x & 31)); ++ vc->vc_tab_stop[7 & (vc->vc_x >> 5)] &= ~(1 << (vc->vc_x & 31)); + else if (vc->vc_par[0] == 3) { + vc->vc_tab_stop[0] = + vc->vc_tab_stop[1] = +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index a2336deb5e36..9762333d8d7f 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -634,7 +634,10 @@ static int xhci_enter_test_mode(struct xhci_hcd *xhci, + xhci_dbg(xhci, "Disable all slots\n"); + spin_unlock_irqrestore(&xhci->lock, *flags); + for (i = 1; i <= HCS_MAX_SLOTS(xhci->hcs_params1); i++) { +- retval = xhci_disable_slot(xhci, NULL, i); ++ if (!xhci->devs[i]) ++ continue; ++ ++ retval = xhci_disable_slot(xhci, i); + if (retval) + xhci_err(xhci, "Failed to disable slot %d, %d. Enter test mode anyway\n", + i, retval); +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index bad76a7c7f2f..bcf315b32bff 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3523,11 +3523,6 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + struct xhci_virt_device *virt_dev; + struct xhci_slot_ctx *slot_ctx; + int i, ret; +- struct xhci_command *command; +- +- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); +- if (!command) +- return; + + #ifndef CONFIG_USB_DEFAULT_PERSIST + /* +@@ -3543,10 +3538,8 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + /* If the host is halted due to driver unload, we still need to free the + * device. + */ +- if (ret <= 0 && ret != -ENODEV) { +- kfree(command); ++ if (ret <= 0 && ret != -ENODEV) + return; +- } + + virt_dev = xhci->devs[udev->slot_id]; + slot_ctx = xhci_get_slot_ctx(xhci, virt_dev->out_ctx); +@@ -3558,26 +3551,21 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); + } + +- xhci_disable_slot(xhci, command, udev->slot_id); ++ xhci_disable_slot(xhci, udev->slot_id); + /* + * Event command completion handler will free any data structures + * associated with the slot. XXX Can free sleep? + */ + } + +-int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command, +- u32 slot_id) ++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id) + { ++ struct xhci_command *command; + unsigned long flags; + u32 state; + int ret = 0; +- struct xhci_virt_device *virt_dev; + +- virt_dev = xhci->devs[slot_id]; +- if (!virt_dev) +- return -EINVAL; +- if (!command) +- command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); ++ command = xhci_alloc_command(xhci, false, false, GFP_KERNEL); + if (!command) + return -ENOMEM; + +@@ -3595,7 +3583,7 @@ int xhci_disable_slot(struct xhci_hcd *xhci, struct xhci_command *command, + slot_id); + if (ret) { + spin_unlock_irqrestore(&xhci->lock, flags); +- xhci_dbg(xhci, "FIXME: allocate a command ring segment\n"); ++ kfree(command); + return ret; + } + xhci_ring_cmd_db(xhci); +@@ -3670,6 +3658,8 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + return 0; + } + ++ xhci_free_command(xhci, command); ++ + if ((xhci->quirks & XHCI_EP_LIMIT_QUIRK)) { + spin_lock_irqsave(&xhci->lock, flags); + ret = xhci_reserve_host_control_ep_resources(xhci); +@@ -3705,18 +3695,12 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) + pm_runtime_get_noresume(hcd->self.controller); + #endif + +- +- xhci_free_command(xhci, command); + /* Is this a LS or FS device under a HS hub? */ + /* Hub or peripherial? */ + return 1; + + disable_slot: +- /* Disable slot, if we can do it without mem alloc */ +- kfree(command->completion); +- command->completion = NULL; +- command->status = 0; +- return xhci_disable_slot(xhci, command, udev->slot_id); ++ return xhci_disable_slot(xhci, udev->slot_id); + } + + /* +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2eaf6e1f12ee..f5fb1f4a092c 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -2014,8 +2014,7 @@ int xhci_run(struct usb_hcd *hcd); + int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks); + void xhci_init_driver(struct hc_driver *drv, + const struct xhci_driver_overrides *over); +-int xhci_disable_slot(struct xhci_hcd *xhci, +- struct xhci_command *command, u32 slot_id); ++int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id); + + int xhci_suspend(struct xhci_hcd *xhci, bool do_wakeup); + int xhci_resume(struct xhci_hcd *xhci, bool hibernated); +diff --git a/drivers/watchdog/wdat_wdt.c b/drivers/watchdog/wdat_wdt.c +index 6d1fbda0f461..0da9943d405f 100644 +--- a/drivers/watchdog/wdat_wdt.c ++++ b/drivers/watchdog/wdat_wdt.c +@@ -392,7 +392,7 @@ static int wdat_wdt_probe(struct platform_device *pdev) + + memset(&r, 0, sizeof(r)); + r.start = gas->address; +- r.end = r.start + gas->access_width; ++ r.end = r.start + gas->access_width - 1; + if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_MEMORY) { + r.flags = IORESOURCE_MEM; + } else if (gas->space_id == ACPI_ADR_SPACE_SYSTEM_IO) { +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index ed113ea17aff..3b293d0d1785 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -118,6 +118,16 @@ static void huge_pagevec_release(struct pagevec *pvec) + pagevec_reinit(pvec); + } + ++/* ++ * Mask used when checking the page offset value passed in via system ++ * calls. This value will be converted to a loff_t which is signed. ++ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the ++ * value. The extra bit (- 1 in the shift value) is to take the sign ++ * bit into account. ++ */ ++#define PGOFF_LOFFT_MAX \ ++ (((1UL << (PAGE_SHIFT + 1)) - 1) << (BITS_PER_LONG - (PAGE_SHIFT + 1))) ++ + static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) + { + struct inode *inode = file_inode(file); +@@ -137,12 +147,13 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) + vma->vm_ops = &hugetlb_vm_ops; + + /* +- * Offset passed to mmap (before page shift) could have been +- * negative when represented as a (l)off_t. ++ * page based offset in vm_pgoff could be sufficiently large to ++ * overflow a (l)off_t when converted to byte offset. + */ +- if (((loff_t)vma->vm_pgoff << PAGE_SHIFT) < 0) ++ if (vma->vm_pgoff & PGOFF_LOFFT_MAX) + return -EINVAL; + ++ /* must be huge page aligned */ + if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT)) + return -EINVAL; + +diff --git a/fs/ncpfs/ncplib_kernel.c b/fs/ncpfs/ncplib_kernel.c +index 804adfebba2f..3e047eb4cc7c 100644 +--- a/fs/ncpfs/ncplib_kernel.c ++++ b/fs/ncpfs/ncplib_kernel.c +@@ -981,6 +981,10 @@ ncp_read_kernel(struct ncp_server *server, const char *file_id, + goto out; + } + *bytes_read = ncp_reply_be16(server, 0); ++ if (*bytes_read > to_read) { ++ result = -EINVAL; ++ goto out; ++ } + source = ncp_reply_data(server, 2 + (offset & 1)); + + memcpy(target, source, *bytes_read); +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index d89e6ccd33ba..3cef6bfa09d4 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -263,6 +263,35 @@ free_blocked_lock(struct nfsd4_blocked_lock *nbl) + kfree(nbl); + } + ++static void ++remove_blocked_locks(struct nfs4_lockowner *lo) ++{ ++ struct nfs4_client *clp = lo->lo_owner.so_client; ++ struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id); ++ struct nfsd4_blocked_lock *nbl; ++ LIST_HEAD(reaplist); ++ ++ /* Dequeue all blocked locks */ ++ spin_lock(&nn->blocked_locks_lock); ++ while (!list_empty(&lo->lo_blocked)) { ++ nbl = list_first_entry(&lo->lo_blocked, ++ struct nfsd4_blocked_lock, ++ nbl_list); ++ list_del_init(&nbl->nbl_list); ++ list_move(&nbl->nbl_lru, &reaplist); ++ } ++ spin_unlock(&nn->blocked_locks_lock); ++ ++ /* Now free them */ ++ while (!list_empty(&reaplist)) { ++ nbl = list_first_entry(&reaplist, struct nfsd4_blocked_lock, ++ nbl_lru); ++ list_del_init(&nbl->nbl_lru); ++ posix_unblock_lock(&nbl->nbl_lock); ++ free_blocked_lock(nbl); ++ } ++} ++ + static int + nfsd4_cb_notify_lock_done(struct nfsd4_callback *cb, struct rpc_task *task) + { +@@ -1854,6 +1883,7 @@ static __be32 mark_client_expired_locked(struct nfs4_client *clp) + static void + __destroy_client(struct nfs4_client *clp) + { ++ int i; + struct nfs4_openowner *oo; + struct nfs4_delegation *dp; + struct list_head reaplist; +@@ -1883,6 +1913,16 @@ __destroy_client(struct nfs4_client *clp) + nfs4_get_stateowner(&oo->oo_owner); + release_openowner(oo); + } ++ for (i = 0; i < OWNER_HASH_SIZE; i++) { ++ struct nfs4_stateowner *so, *tmp; ++ ++ list_for_each_entry_safe(so, tmp, &clp->cl_ownerstr_hashtbl[i], ++ so_strhash) { ++ /* Should be no openowners at this point */ ++ WARN_ON_ONCE(so->so_is_open_owner); ++ remove_blocked_locks(lockowner(so)); ++ } ++ } + nfsd4_return_all_client_layouts(clp); + nfsd4_shutdown_callback(clp); + if (clp->cl_cb_conn.cb_xprt) +@@ -6275,6 +6315,7 @@ nfsd4_release_lockowner(struct svc_rqst *rqstp, + } + spin_unlock(&clp->cl_lock); + free_ol_stateid_reaplist(&reaplist); ++ remove_blocked_locks(lo); + nfs4_put_stateowner(&lo->lo_owner); + + return status; +@@ -7060,6 +7101,8 @@ nfs4_state_destroy_net(struct net *net) + } + } + ++ WARN_ON(!list_empty(&nn->blocked_locks_lru)); ++ + for (i = 0; i < CLIENT_HASH_SIZE; i++) { + while (!list_empty(&nn->unconf_id_hashtbl[i])) { + clp = list_entry(nn->unconf_id_hashtbl[i].next, struct nfs4_client, cl_idhash); +@@ -7126,7 +7169,6 @@ nfs4_state_shutdown_net(struct net *net) + struct nfs4_delegation *dp = NULL; + struct list_head *pos, *next, reaplist; + struct nfsd_net *nn = net_generic(net, nfsd_net_id); +- struct nfsd4_blocked_lock *nbl; + + cancel_delayed_work_sync(&nn->laundromat_work); + locks_end_grace(&nn->nfsd4_manager); +@@ -7147,24 +7189,6 @@ nfs4_state_shutdown_net(struct net *net) + nfs4_put_stid(&dp->dl_stid); + } + +- BUG_ON(!list_empty(&reaplist)); +- spin_lock(&nn->blocked_locks_lock); +- while (!list_empty(&nn->blocked_locks_lru)) { +- nbl = list_first_entry(&nn->blocked_locks_lru, +- struct nfsd4_blocked_lock, nbl_lru); +- list_move(&nbl->nbl_lru, &reaplist); +- list_del_init(&nbl->nbl_list); +- } +- spin_unlock(&nn->blocked_locks_lock); +- +- while (!list_empty(&reaplist)) { +- nbl = list_first_entry(&reaplist, +- struct nfsd4_blocked_lock, nbl_lru); +- list_del_init(&nbl->nbl_lru); +- posix_unblock_lock(&nbl->nbl_lock); +- free_blocked_lock(nbl); +- } +- + nfsd4_client_tracking_exit(net); + nfs4_state_destroy_net(net); + } +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 045a7f52ab3a..77b891a8f191 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -976,6 +976,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot); + int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot); + int pud_clear_huge(pud_t *pud); + int pmd_clear_huge(pmd_t *pmd); ++int pud_free_pmd_page(pud_t *pud); ++int pmd_free_pte_page(pmd_t *pmd); + #else /* !CONFIG_HAVE_ARCH_HUGE_VMAP */ + static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot) + { +@@ -1001,6 +1003,14 @@ static inline int pmd_clear_huge(pmd_t *pmd) + { + return 0; + } ++static inline int pud_free_pmd_page(pud_t *pud) ++{ ++ return 0; ++} ++static inline int pmd_free_pte_page(pmd_t *pmd) ++{ ++ return 0; ++} + #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ + + #ifndef __HAVE_ARCH_FLUSH_PMD_TLB_RANGE +diff --git a/include/drm/drm_syncobj.h b/include/drm/drm_syncobj.h +index c00fee539822..6d45aae47b2e 100644 +--- a/include/drm/drm_syncobj.h ++++ b/include/drm/drm_syncobj.h +@@ -60,11 +60,6 @@ struct drm_syncobj { + * locks cb_list and write-locks fence. + */ + spinlock_t lock; +- /** +- * @file: +- * a file backing for this syncobj. +- */ +- struct file *file; + }; + + typedef void (*drm_syncobj_func_t)(struct drm_syncobj *syncobj, +diff --git a/include/linux/fsl_ifc.h b/include/linux/fsl_ifc.h +index c332f0a45607..3fdfede2f0f3 100644 +--- a/include/linux/fsl_ifc.h ++++ b/include/linux/fsl_ifc.h +@@ -734,11 +734,7 @@ struct fsl_ifc_nand { + u32 res19[0x10]; + __be32 nand_fsr; + u32 res20; +- /* The V1 nand_eccstat is actually 4 words that overlaps the +- * V2 nand_eccstat. +- */ +- __be32 v1_nand_eccstat[2]; +- __be32 v2_nand_eccstat[6]; ++ __be32 nand_eccstat[8]; + u32 res21[0x1c]; + __be32 nanndcr; + u32 res22[0x2]; +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index bae11c7e7bf3..2dec2d4b469b 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -187,7 +187,6 @@ int memblock_search_pfn_nid(unsigned long pfn, unsigned long *start_pfn, + unsigned long *end_pfn); + void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn, + unsigned long *out_end_pfn, int *out_nid); +-unsigned long memblock_next_valid_pfn(unsigned long pfn, unsigned long max_pfn); + + /** + * for_each_mem_pfn_range - early memory pfn range iterator +diff --git a/include/trace/events/mmc.h b/include/trace/events/mmc.h +index 200f731be557..7b706ff21335 100644 +--- a/include/trace/events/mmc.h ++++ b/include/trace/events/mmc.h +@@ -86,8 +86,8 @@ TRACE_EVENT(mmc_request_start, + __entry->stop_flags, __entry->stop_retries, + __entry->sbc_opcode, __entry->sbc_arg, + __entry->sbc_flags, __entry->sbc_retries, +- __entry->blocks, __entry->blk_addr, +- __entry->blksz, __entry->data_flags, __entry->tag, ++ __entry->blocks, __entry->blksz, ++ __entry->blk_addr, __entry->data_flags, __entry->tag, + __entry->can_retune, __entry->doing_retune, + __entry->retune_now, __entry->need_retune, + __entry->hold_retune, __entry->retune_period) +diff --git a/include/uapi/linux/usb/audio.h b/include/uapi/linux/usb/audio.h +index 17a022c5b414..da3315ed1bcd 100644 +--- a/include/uapi/linux/usb/audio.h ++++ b/include/uapi/linux/usb/audio.h +@@ -370,7 +370,7 @@ static inline __u8 uac_processing_unit_bControlSize(struct uac_processing_unit_d + { + return (protocol == UAC_VERSION_1) ? + desc->baSourceID[desc->bNrInPins + 4] : +- desc->baSourceID[desc->bNrInPins + 6]; ++ 2; /* in UAC2, this value is constant */ + } + + static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_descriptor *desc, +@@ -378,7 +378,7 @@ static inline __u8 *uac_processing_unit_bmControls(struct uac_processing_unit_de + { + return (protocol == UAC_VERSION_1) ? + &desc->baSourceID[desc->bNrInPins + 5] : +- &desc->baSourceID[desc->bNrInPins + 7]; ++ &desc->baSourceID[desc->bNrInPins + 6]; + } + + static inline __u8 uac_processing_unit_iProcessing(struct uac_processing_unit_descriptor *desc, +diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c +index 25d074920a00..4e933219fec6 100644 +--- a/kernel/bpf/syscall.c ++++ b/kernel/bpf/syscall.c +@@ -1455,7 +1455,7 @@ SYSCALL_DEFINE3(bpf, int, cmd, union bpf_attr __user *, uattr, unsigned int, siz + union bpf_attr attr = {}; + int err; + +- if (!capable(CAP_SYS_ADMIN) && sysctl_unprivileged_bpf_disabled) ++ if (sysctl_unprivileged_bpf_disabled && !capable(CAP_SYS_ADMIN)) + return -EPERM; + + err = check_uarg_tail_zero(uattr, sizeof(attr), size); +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 030e4286f14c..76c0ef2cb509 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -3148,6 +3148,16 @@ static int cgroup_enable_threaded(struct cgroup *cgrp) + if (cgroup_is_threaded(cgrp)) + return 0; + ++ /* ++ * If @cgroup is populated or has domain controllers enabled, it ++ * can't be switched. While the below cgroup_can_be_thread_root() ++ * test can catch the same conditions, that's only when @parent is ++ * not mixable, so let's check it explicitly. ++ */ ++ if (cgroup_is_populated(cgrp) || ++ cgrp->subtree_control & ~cgrp_dfl_threaded_ss_mask) ++ return -EOPNOTSUPP; ++ + /* we're joining the parent's domain, ensure its validity */ + if (!cgroup_is_valid_domain(dom_cgrp) || + !cgroup_can_be_thread_root(dom_cgrp)) +diff --git a/kernel/events/core.c b/kernel/events/core.c +index f42f7c7a8f84..cecd72eb09b8 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -2322,7 +2322,7 @@ static void ctx_resched(struct perf_cpu_context *cpuctx, + struct perf_event_context *task_ctx, + enum event_type_t event_type) + { +- enum event_type_t ctx_event_type = event_type & EVENT_ALL; ++ enum event_type_t ctx_event_type; + bool cpu_event = !!(event_type & EVENT_CPU); + + /* +@@ -2332,6 +2332,8 @@ static void ctx_resched(struct perf_cpu_context *cpuctx, + if (event_type & EVENT_PINNED) + event_type |= EVENT_FLEXIBLE; + ++ ctx_event_type = event_type & EVENT_ALL; ++ + perf_pmu_disable(cpuctx->ctx.pmu); + if (task_ctx) + task_ctx_sched_out(cpuctx, task_ctx, event_type); +diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c +index ec999f32c840..708992708332 100644 +--- a/kernel/time/posix-timers.c ++++ b/kernel/time/posix-timers.c +@@ -50,6 +50,7 @@ + #include + #include + #include ++#include + + #include "timekeeping.h" + #include "posix-timers.h" +@@ -1346,11 +1347,15 @@ static const struct k_clock * const posix_clocks[] = { + + static const struct k_clock *clockid_to_kclock(const clockid_t id) + { +- if (id < 0) ++ clockid_t idx = id; ++ ++ if (id < 0) { + return (id & CLOCKFD_MASK) == CLOCKFD ? + &clock_posix_dynamic : &clock_posix_cpu; ++ } + +- if (id >= ARRAY_SIZE(posix_clocks) || !posix_clocks[id]) ++ if (id >= ARRAY_SIZE(posix_clocks)) + return NULL; +- return posix_clocks[id]; ++ ++ return posix_clocks[array_index_nospec(idx, ARRAY_SIZE(posix_clocks))]; + } +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index 8a907e12b6b9..f8d3bd974bcc 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -635,7 +635,7 @@ static int create_trace_kprobe(int argc, char **argv) + char *symbol = NULL, *event = NULL, *group = NULL; + int maxactive = 0; + char *arg; +- unsigned long offset = 0; ++ long offset = 0; + void *addr = NULL; + char buf[MAX_EVENT_NAME_LEN]; + +@@ -723,7 +723,7 @@ static int create_trace_kprobe(int argc, char **argv) + symbol = argv[1]; + /* TODO: support .init module functions */ + ret = traceprobe_split_symbol_offset(symbol, &offset); +- if (ret) { ++ if (ret || offset < 0 || offset > UINT_MAX) { + pr_info("Failed to parse either an address or a symbol.\n"); + return ret; + } +diff --git a/kernel/trace/trace_probe.c b/kernel/trace/trace_probe.c +index 52478f033f88..fe4513330412 100644 +--- a/kernel/trace/trace_probe.c ++++ b/kernel/trace/trace_probe.c +@@ -320,7 +320,7 @@ static fetch_func_t get_fetch_size_function(const struct fetch_type *type, + } + + /* Split symbol and offset. */ +-int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) ++int traceprobe_split_symbol_offset(char *symbol, long *offset) + { + char *tmp; + int ret; +@@ -328,13 +328,11 @@ int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset) + if (!offset) + return -EINVAL; + +- tmp = strchr(symbol, '+'); ++ tmp = strpbrk(symbol, "+-"); + if (tmp) { +- /* skip sign because kstrtoul doesn't accept '+' */ +- ret = kstrtoul(tmp + 1, 0, offset); ++ ret = kstrtol(tmp, 0, offset); + if (ret) + return ret; +- + *tmp = '\0'; + } else + *offset = 0; +diff --git a/kernel/trace/trace_probe.h b/kernel/trace/trace_probe.h +index 903273c93e61..dc39472ca9e4 100644 +--- a/kernel/trace/trace_probe.h ++++ b/kernel/trace/trace_probe.h +@@ -354,7 +354,7 @@ extern int traceprobe_conflict_field_name(const char *name, + extern void traceprobe_update_arg(struct probe_arg *arg); + extern void traceprobe_free_probe_arg(struct probe_arg *arg); + +-extern int traceprobe_split_symbol_offset(char *symbol, unsigned long *offset); ++extern int traceprobe_split_symbol_offset(char *symbol, long *offset); + + extern ssize_t traceprobe_probes_write(struct file *file, + const char __user *buffer, size_t count, loff_t *ppos, +diff --git a/lib/ioremap.c b/lib/ioremap.c +index b808a390e4c3..54e5bbaa3200 100644 +--- a/lib/ioremap.c ++++ b/lib/ioremap.c +@@ -91,7 +91,8 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr, + + if (ioremap_pmd_enabled() && + ((next - addr) == PMD_SIZE) && +- IS_ALIGNED(phys_addr + addr, PMD_SIZE)) { ++ IS_ALIGNED(phys_addr + addr, PMD_SIZE) && ++ pmd_free_pte_page(pmd)) { + if (pmd_set_huge(pmd, phys_addr + addr, prot)) + continue; + } +@@ -117,7 +118,8 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr, + + if (ioremap_pud_enabled() && + ((next - addr) == PUD_SIZE) && +- IS_ALIGNED(phys_addr + addr, PUD_SIZE)) { ++ IS_ALIGNED(phys_addr + addr, PUD_SIZE) && ++ pud_free_pmd_page(pud)) { + if (pud_set_huge(pud, phys_addr + addr, prot)) + continue; + } +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index eba34cdfc3e5..a403d29da6fd 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2739,11 +2739,13 @@ static unsigned long deferred_split_scan(struct shrinker *shrink, + + list_for_each_safe(pos, next, &list) { + page = list_entry((void *)pos, struct page, mapping); +- lock_page(page); ++ if (!trylock_page(page)) ++ goto next; + /* split_huge_page() removes page from list on success */ + if (!split_huge_page(page)) + split++; + unlock_page(page); ++next: + put_page(page); + } + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index c539941671b4..b1f841a9edd4 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -4344,6 +4345,12 @@ int hugetlb_reserve_pages(struct inode *inode, + struct resv_map *resv_map; + long gbl_reserve; + ++ /* This should never happen */ ++ if (from > to) { ++ VM_WARN(1, "%s called with a negative range\n", __func__); ++ return -EINVAL; ++ } ++ + /* + * Only apply hugepage reservation if asked. At fault time, an + * attempt will be made for VM_NORESERVE to allocate a page +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 43cb3043311b..2fe26634e1a2 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -530,7 +530,12 @@ static int __collapse_huge_page_isolate(struct vm_area_struct *vma, + goto out; + } + +- VM_BUG_ON_PAGE(PageCompound(page), page); ++ /* TODO: teach khugepaged to collapse THP mapped with pte */ ++ if (PageCompound(page)) { ++ result = SCAN_PAGE_COMPOUND; ++ goto out; ++ } ++ + VM_BUG_ON_PAGE(!PageAnon(page), page); + + /* +diff --git a/mm/memblock.c b/mm/memblock.c +index 6dd303717a4d..e81d12c544e9 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -1101,34 +1101,6 @@ void __init_memblock __next_mem_pfn_range(int *idx, int nid, + *out_nid = r->nid; + } + +-unsigned long __init_memblock memblock_next_valid_pfn(unsigned long pfn, +- unsigned long max_pfn) +-{ +- struct memblock_type *type = &memblock.memory; +- unsigned int right = type->cnt; +- unsigned int mid, left = 0; +- phys_addr_t addr = PFN_PHYS(++pfn); +- +- do { +- mid = (right + left) / 2; +- +- if (addr < type->regions[mid].base) +- right = mid; +- else if (addr >= (type->regions[mid].base + +- type->regions[mid].size)) +- left = mid + 1; +- else { +- /* addr is within the region, so pfn is valid */ +- return pfn; +- } +- } while (left < right); +- +- if (right == type->cnt) +- return -1UL; +- else +- return PHYS_PFN(type->regions[right].base); +-} +- + /** + * memblock_set_node - set node ID on memblock regions + * @base: base of area to set node ID for +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 6627caeeaf82..1d7693c35424 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3532,7 +3532,7 @@ static bool __need_fs_reclaim(gfp_t gfp_mask) + return false; + + /* this guy won't enter reclaim */ +- if ((current->flags & PF_MEMALLOC) && !(gfp_mask & __GFP_NOMEMALLOC)) ++ if (current->flags & PF_MEMALLOC) + return false; + + /* We're only interested __GFP_FS allocations for now */ +@@ -5302,17 +5302,8 @@ void __meminit memmap_init_zone(unsigned long size, int nid, unsigned long zone, + if (context != MEMMAP_EARLY) + goto not_early; + +- if (!early_pfn_valid(pfn)) { +-#ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP +- /* +- * Skip to the pfn preceding the next valid one (or +- * end_pfn), such that we hit a valid pfn (or end_pfn) +- * on our next iteration of the loop. +- */ +- pfn = memblock_next_valid_pfn(pfn, end_pfn) - 1; +-#endif ++ if (!early_pfn_valid(pfn)) + continue; +- } + if (!early_pfn_in_nid(pfn, nid)) + continue; + if (!update_defer_init(pgdat, pfn, end_pfn, &nr_initialised)) +diff --git a/mm/shmem.c b/mm/shmem.c +index 07a1d22807be..f383298b7280 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -493,36 +493,45 @@ static unsigned long shmem_unused_huge_shrink(struct shmem_sb_info *sbinfo, + info = list_entry(pos, struct shmem_inode_info, shrinklist); + inode = &info->vfs_inode; + +- if (nr_to_split && split >= nr_to_split) { +- iput(inode); +- continue; +- } ++ if (nr_to_split && split >= nr_to_split) ++ goto leave; + +- page = find_lock_page(inode->i_mapping, ++ page = find_get_page(inode->i_mapping, + (inode->i_size & HPAGE_PMD_MASK) >> PAGE_SHIFT); + if (!page) + goto drop; + ++ /* No huge page at the end of the file: nothing to split */ + if (!PageTransHuge(page)) { +- unlock_page(page); + put_page(page); + goto drop; + } + ++ /* ++ * Leave the inode on the list if we failed to lock ++ * the page at this time. ++ * ++ * Waiting for the lock may lead to deadlock in the ++ * reclaim path. ++ */ ++ if (!trylock_page(page)) { ++ put_page(page); ++ goto leave; ++ } ++ + ret = split_huge_page(page); + unlock_page(page); + put_page(page); + +- if (ret) { +- /* split failed: leave it on the list */ +- iput(inode); +- continue; +- } ++ /* If split failed leave the inode on the list */ ++ if (ret) ++ goto leave; + + split++; + drop: + list_del_init(&info->shrinklist); + removed++; ++leave: + iput(inode); + } + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 441f346fb5e2..a8a3729bfaa9 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1846,6 +1846,20 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec, + if (stat.nr_writeback && stat.nr_writeback == nr_taken) + set_bit(PGDAT_WRITEBACK, &pgdat->flags); + ++ /* ++ * If dirty pages are scanned that are not queued for IO, it ++ * implies that flushers are not doing their job. This can ++ * happen when memory pressure pushes dirty pages to the end of ++ * the LRU before the dirty limits are breached and the dirty ++ * data has expired. It can also happen when the proportion of ++ * dirty pages grows not through writes but through memory ++ * pressure reclaiming all the clean cache. And in some cases, ++ * the flushers simply cannot keep up with the allocation ++ * rate. Nudge the flusher threads in case they are asleep. ++ */ ++ if (stat.nr_unqueued_dirty == nr_taken) ++ wakeup_flusher_threads(0, WB_REASON_VMSCAN); ++ + /* + * Legacy memcg will stall in page writeback so avoid forcibly + * stalling here. +@@ -1858,22 +1872,9 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec, + if (stat.nr_dirty && stat.nr_dirty == stat.nr_congested) + set_bit(PGDAT_CONGESTED, &pgdat->flags); + +- /* +- * If dirty pages are scanned that are not queued for IO, it +- * implies that flushers are not doing their job. This can +- * happen when memory pressure pushes dirty pages to the end of +- * the LRU before the dirty limits are breached and the dirty +- * data has expired. It can also happen when the proportion of +- * dirty pages grows not through writes but through memory +- * pressure reclaiming all the clean cache. And in some cases, +- * the flushers simply cannot keep up with the allocation +- * rate. Nudge the flusher threads in case they are asleep, but +- * also allow kswapd to start writing pages during reclaim. +- */ +- if (stat.nr_unqueued_dirty == nr_taken) { +- wakeup_flusher_threads(0, WB_REASON_VMSCAN); ++ /* Allow kswapd to start writing pages during reclaim. */ ++ if (stat.nr_unqueued_dirty == nr_taken) + set_bit(PGDAT_DIRTY, &pgdat->flags); +- } + + /* + * If kswapd scans pages marked marked for immediate +diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c +index 386ee829c655..829e2f6bfb73 100644 +--- a/sound/drivers/aloop.c ++++ b/sound/drivers/aloop.c +@@ -192,6 +192,11 @@ static inline void loopback_timer_stop(struct loopback_pcm *dpcm) + dpcm->timer.expires = 0; + } + ++static inline void loopback_timer_stop_sync(struct loopback_pcm *dpcm) ++{ ++ del_timer_sync(&dpcm->timer); ++} ++ + #define CABLE_VALID_PLAYBACK (1 << SNDRV_PCM_STREAM_PLAYBACK) + #define CABLE_VALID_CAPTURE (1 << SNDRV_PCM_STREAM_CAPTURE) + #define CABLE_VALID_BOTH (CABLE_VALID_PLAYBACK|CABLE_VALID_CAPTURE) +@@ -326,6 +331,8 @@ static int loopback_prepare(struct snd_pcm_substream *substream) + struct loopback_cable *cable = dpcm->cable; + int bps, salign; + ++ loopback_timer_stop_sync(dpcm); ++ + salign = (snd_pcm_format_width(runtime->format) * + runtime->channels) / 8; + bps = salign * runtime->rate; +@@ -659,7 +666,9 @@ static void free_cable(struct snd_pcm_substream *substream) + return; + if (cable->streams[!substream->stream]) { + /* other stream is still alive */ ++ spin_lock_irq(&cable->lock); + cable->streams[substream->stream] = NULL; ++ spin_unlock_irq(&cable->lock); + } else { + /* free the cable */ + loopback->cables[substream->number][dev] = NULL; +@@ -699,7 +708,6 @@ static int loopback_open(struct snd_pcm_substream *substream) + loopback->cables[substream->number][dev] = cable; + } + dpcm->cable = cable; +- cable->streams[substream->stream] = dpcm; + + snd_pcm_hw_constraint_integer(runtime, SNDRV_PCM_HW_PARAM_PERIODS); + +@@ -731,6 +739,11 @@ static int loopback_open(struct snd_pcm_substream *substream) + runtime->hw = loopback_pcm_hardware; + else + runtime->hw = cable->hw; ++ ++ spin_lock_irq(&cable->lock); ++ cable->streams[substream->stream] = dpcm; ++ spin_unlock_irq(&cable->lock); ++ + unlock: + if (err < 0) { + free_cable(substream); +@@ -745,7 +758,7 @@ static int loopback_close(struct snd_pcm_substream *substream) + struct loopback *loopback = substream->private_data; + struct loopback_pcm *dpcm = substream->runtime->private_data; + +- loopback_timer_stop(dpcm); ++ loopback_timer_stop_sync(dpcm); + mutex_lock(&loopback->cable_lock); + free_cable(substream); + mutex_unlock(&loopback->cable_lock); +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index d5017adf9feb..c507c69029e3 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -375,6 +375,7 @@ enum { + ((pci)->device == 0x160c)) + + #define IS_BXT(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0x5a98) ++#define IS_CFL(pci) ((pci)->vendor == 0x8086 && (pci)->device == 0xa348) + + static char *driver_short_names[] = { + [AZX_DRIVER_ICH] = "HDA Intel", +@@ -1744,6 +1745,10 @@ static int azx_create(struct snd_card *card, struct pci_dev *pci, + else + chip->bdl_pos_adj = bdl_pos_adj[dev]; + ++ /* Workaround for a communication error on CFL (bko#199007) */ ++ if (IS_CFL(pci)) ++ chip->polling_mode = 1; ++ + err = azx_bus_init(chip, model[dev], &pci_hda_io_ops); + if (err < 0) { + kfree(hda); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 3d19efd2783a..e44a9758f2eb 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3107,6 +3107,8 @@ static void alc256_init(struct hda_codec *codec) + + alc_update_coef_idx(codec, 0x46, 3 << 12, 0); + alc_update_coefex_idx(codec, 0x57, 0x04, 0x0007, 0x4); /* Hight power */ ++ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 1 << 15); /* Clear bit */ ++ alc_update_coefex_idx(codec, 0x53, 0x02, 0x8000, 0 << 15); + } + + static void alc256_shutup(struct hda_codec *codec) +@@ -3486,8 +3488,12 @@ static void alc269_fixup_mic_mute_hook(void *private_data, int enabled) + pinval = snd_hda_codec_get_pin_target(codec, spec->mute_led_nid); + pinval &= ~AC_PINCTL_VREFEN; + pinval |= enabled ? AC_PINCTL_VREF_HIZ : AC_PINCTL_VREF_80; +- if (spec->mute_led_nid) ++ if (spec->mute_led_nid) { ++ /* temporarily power up/down for setting VREF */ ++ snd_hda_power_up_pm(codec); + snd_hda_set_pin_ctl_cache(codec, spec->mute_led_nid, pinval); ++ snd_hda_power_down_pm(codec); ++ } + } + + /* Make sure the led works even in runtime suspend */ +@@ -5352,6 +5358,7 @@ enum { + ALC274_FIXUP_DELL_AIO_LINEOUT_VERB, + ALC298_FIXUP_TPT470_DOCK, + ALC255_FIXUP_DUMMY_LINEOUT_VERB, ++ ALC255_FIXUP_DELL_HEADSET_MIC, + }; + + static const struct hda_fixup alc269_fixups[] = { +@@ -6212,6 +6219,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE + }, ++ [ALC255_FIXUP_DELL_HEADSET_MIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ ++ { } ++ }, ++ }, + }; + + static const struct snd_pci_quirk alc269_fixup_tbl[] = { +@@ -6266,6 +6280,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), + SND_PCI_QUIRK(0x1028, 0x084b, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x084e, "Dell", ALC274_FIXUP_DELL_AIO_LINEOUT_VERB), ++ SND_PCI_QUIRK(0x1028, 0x0871, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), ++ SND_PCI_QUIRK(0x1028, 0x0872, "Dell Precision 3630", ALC255_FIXUP_DELL_HEADSET_MIC), + SND_PCI_QUIRK(0x1028, 0x0873, "Dell Precision 3930", ALC255_FIXUP_DUMMY_LINEOUT_VERB), + SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), +@@ -7004,6 +7020,8 @@ static int patch_alc269(struct hda_codec *codec) + break; + case 0x10ec0257: + spec->codec_variant = ALC269_TYPE_ALC257; ++ spec->shutup = alc256_shutup; ++ spec->init_hook = alc256_init; + spec->gen.mixer_nid = 0; + break; + case 0x10ec0215: +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 69523ed55894..9df0af17e9c2 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -922,7 +922,7 @@ static void print_metric_csv(void *ctx, + char buf[64], *vals, *ends; + + if (unit == NULL || fmt == NULL) { +- fprintf(out, "%s%s%s%s", csv_sep, csv_sep, csv_sep, csv_sep); ++ fprintf(out, "%s%s", csv_sep, csv_sep); + return; + } + snprintf(buf, sizeof(buf), fmt, val); +diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c +index 6cbb83b47150..f15aa5a76fe3 100644 +--- a/tools/testing/selftests/x86/protection_keys.c ++++ b/tools/testing/selftests/x86/protection_keys.c +@@ -250,7 +250,7 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + unsigned long ip; + char *fpregs; + u32 *pkru_ptr; +- u64 si_pkey; ++ u64 siginfo_pkey; + u32 *si_pkey_ptr; + int pkru_offset; + fpregset_t fpregset; +@@ -292,9 +292,9 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset); + dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr); + dump_mem(si_pkey_ptr - 8, 24); +- si_pkey = *si_pkey_ptr; +- pkey_assert(si_pkey < NR_PKEYS); +- last_si_pkey = si_pkey; ++ siginfo_pkey = *si_pkey_ptr; ++ pkey_assert(siginfo_pkey < NR_PKEYS); ++ last_si_pkey = siginfo_pkey; + + if ((si->si_code == SEGV_MAPERR) || + (si->si_code == SEGV_ACCERR) || +@@ -306,7 +306,7 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + dprintf1("signal pkru from xsave: %08x\n", *pkru_ptr); + /* need __rdpkru() version so we do not do shadow_pkru checking */ + dprintf1("signal pkru from pkru: %08x\n", __rdpkru()); +- dprintf1("si_pkey from siginfo: %jx\n", si_pkey); ++ dprintf1("pkey from siginfo: %jx\n", siginfo_pkey); + *(u64 *)pkru_ptr = 0x00000000; + dprintf1("WARNING: set PRKU=0 to allow faulting instruction to continue\n"); + pkru_faults++; +diff --git a/tools/testing/selftests/x86/ptrace_syscall.c b/tools/testing/selftests/x86/ptrace_syscall.c +index 1ae1c5a7392e..6f22238f3217 100644 +--- a/tools/testing/selftests/x86/ptrace_syscall.c ++++ b/tools/testing/selftests/x86/ptrace_syscall.c +@@ -183,8 +183,10 @@ static void test_ptrace_syscall_restart(void) + if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0) + err(1, "PTRACE_TRACEME"); + ++ pid_t pid = getpid(), tid = syscall(SYS_gettid); ++ + printf("\tChild will make one syscall\n"); +- raise(SIGSTOP); ++ syscall(SYS_tgkill, pid, tid, SIGSTOP); + + syscall(SYS_gettid, 10, 11, 12, 13, 14, 15); + _exit(0); +@@ -301,9 +303,11 @@ static void test_restart_under_ptrace(void) + if (ptrace(PTRACE_TRACEME, 0, 0, 0) != 0) + err(1, "PTRACE_TRACEME"); + ++ pid_t pid = getpid(), tid = syscall(SYS_gettid); ++ + printf("\tChild will take a nap until signaled\n"); + setsigign(SIGUSR1, SA_RESTART); +- raise(SIGSTOP); ++ syscall(SYS_tgkill, pid, tid, SIGSTOP); + + syscall(SYS_pause, 0, 0, 0, 0, 0, 0); + _exit(0); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.31-32.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.31-32.patch new file mode 100644 index 000000000000..f72eb490e0f0 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.31-32.patch @@ -0,0 +1,1401 @@ +diff --git a/Makefile b/Makefile +index 99e31da48422..c4c681b53ff0 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 31 ++SUBLEVEL = 32 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/net/ethernet/arc/emac_rockchip.c b/drivers/net/ethernet/arc/emac_rockchip.c +index c6163874e4e7..c770ca37c9b2 100644 +--- a/drivers/net/ethernet/arc/emac_rockchip.c ++++ b/drivers/net/ethernet/arc/emac_rockchip.c +@@ -169,8 +169,10 @@ static int emac_rockchip_probe(struct platform_device *pdev) + /* Optional regulator for PHY */ + priv->regulator = devm_regulator_get_optional(dev, "phy"); + if (IS_ERR(priv->regulator)) { +- if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(priv->regulator) == -EPROBE_DEFER) { ++ err = -EPROBE_DEFER; ++ goto out_clk_disable; ++ } + dev_err(dev, "no regulator found\n"); + priv->regulator = NULL; + } +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index eb441e5e2cd8..1e856e8b9a92 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -855,10 +855,12 @@ static void bcm_sysport_tx_reclaim_one(struct bcm_sysport_tx_ring *ring, + static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, + struct bcm_sysport_tx_ring *ring) + { +- unsigned int c_index, last_c_index, last_tx_cn, num_tx_cbs; + unsigned int pkts_compl = 0, bytes_compl = 0; + struct net_device *ndev = priv->netdev; ++ unsigned int txbds_processed = 0; + struct bcm_sysport_cb *cb; ++ unsigned int txbds_ready; ++ unsigned int c_index; + u32 hw_ind; + + /* Clear status before servicing to reduce spurious interrupts */ +@@ -871,29 +873,23 @@ static unsigned int __bcm_sysport_tx_reclaim(struct bcm_sysport_priv *priv, + /* Compute how many descriptors have been processed since last call */ + hw_ind = tdma_readl(priv, TDMA_DESC_RING_PROD_CONS_INDEX(ring->index)); + c_index = (hw_ind >> RING_CONS_INDEX_SHIFT) & RING_CONS_INDEX_MASK; +- ring->p_index = (hw_ind & RING_PROD_INDEX_MASK); +- +- last_c_index = ring->c_index; +- num_tx_cbs = ring->size; +- +- c_index &= (num_tx_cbs - 1); +- +- if (c_index >= last_c_index) +- last_tx_cn = c_index - last_c_index; +- else +- last_tx_cn = num_tx_cbs - last_c_index + c_index; ++ txbds_ready = (c_index - ring->c_index) & RING_CONS_INDEX_MASK; + + netif_dbg(priv, tx_done, ndev, +- "ring=%d c_index=%d last_tx_cn=%d last_c_index=%d\n", +- ring->index, c_index, last_tx_cn, last_c_index); ++ "ring=%d old_c_index=%u c_index=%u txbds_ready=%u\n", ++ ring->index, ring->c_index, c_index, txbds_ready); + +- while (last_tx_cn-- > 0) { +- cb = ring->cbs + last_c_index; ++ while (txbds_processed < txbds_ready) { ++ cb = &ring->cbs[ring->clean_index]; + bcm_sysport_tx_reclaim_one(ring, cb, &bytes_compl, &pkts_compl); + + ring->desc_count++; +- last_c_index++; +- last_c_index &= (num_tx_cbs - 1); ++ txbds_processed++; ++ ++ if (likely(ring->clean_index < ring->size - 1)) ++ ring->clean_index++; ++ else ++ ring->clean_index = 0; + } + + u64_stats_update_begin(&priv->syncp); +@@ -1406,6 +1402,7 @@ static int bcm_sysport_init_tx_ring(struct bcm_sysport_priv *priv, + netif_tx_napi_add(priv->netdev, &ring->napi, bcm_sysport_tx_poll, 64); + ring->index = index; + ring->size = size; ++ ring->clean_index = 0; + ring->alloc_size = ring->size; + ring->desc_cpu = p; + ring->desc_count = ring->size; +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h +index 82e401df199e..a2006f5fc26f 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.h ++++ b/drivers/net/ethernet/broadcom/bcmsysport.h +@@ -706,7 +706,7 @@ struct bcm_sysport_tx_ring { + unsigned int desc_count; /* Number of descriptors */ + unsigned int curr_desc; /* Current descriptor */ + unsigned int c_index; /* Last consumer index */ +- unsigned int p_index; /* Current producer index */ ++ unsigned int clean_index; /* Current clean index */ + struct bcm_sysport_cb *cbs; /* Transmit control blocks */ + struct dma_desc *desc_cpu; /* CPU view of the descriptor */ + struct bcm_sysport_priv *priv; /* private context backpointer */ +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 42258060f142..4f6e9d3470d5 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2022,7 +2022,6 @@ static inline int dpaa_xmit(struct dpaa_priv *priv, + } + + if (unlikely(err < 0)) { +- percpu_stats->tx_errors++; + percpu_stats->tx_fifo_errors++; + return err; + } +@@ -2292,7 +2291,6 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal, + vaddr = phys_to_virt(addr); + prefetch(vaddr + qm_fd_get_offset(fd)); + +- fd_format = qm_fd_get_format(fd); + /* The only FD types that we may receive are contig and S/G */ + WARN_ON((fd_format != qm_fd_contig) && (fd_format != qm_fd_sg)); + +@@ -2325,8 +2323,10 @@ static enum qman_cb_dqrr_result rx_default_dqrr(struct qman_portal *portal, + + skb_len = skb->len; + +- if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) ++ if (unlikely(netif_receive_skb(skb) == NET_RX_DROP)) { ++ percpu_stats->rx_dropped++; + return qman_cb_dqrr_consume; ++ } + + percpu_stats->rx_packets++; + percpu_stats->rx_bytes += skb_len; +@@ -2860,7 +2860,7 @@ static int dpaa_remove(struct platform_device *pdev) + struct device *dev; + int err; + +- dev = &pdev->dev; ++ dev = pdev->dev.parent; + net_dev = dev_get_drvdata(dev); + + priv = netdev_priv(net_dev); +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 311539c6625f..eb2ea231c7ca 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3565,6 +3565,8 @@ fec_drv_remove(struct platform_device *pdev) + fec_enet_mii_remove(fep); + if (fep->reg_phy) + regulator_disable(fep->reg_phy); ++ pm_runtime_put(&pdev->dev); ++ pm_runtime_disable(&pdev->dev); + if (of_phy_is_fixed_link(np)) + of_phy_deregister_fixed_link(np); + of_node_put(fep->phy_node); +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +index 93728c694e6d..0a9adc5962fb 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_buffers.c +@@ -385,13 +385,13 @@ static const struct mlxsw_sp_sb_cm mlxsw_sp_sb_cms_egress[] = { + + static const struct mlxsw_sp_sb_cm mlxsw_sp_cpu_port_sb_cms[] = { + MLXSW_SP_CPU_PORT_SB_CM, ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), + MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_CPU_PORT_SB_CM, +- MLXSW_SP_SB_CM(10000, 0, 0), ++ MLXSW_SP_SB_CM(MLXSW_PORT_MAX_MTU, 0, 0), + MLXSW_SP_CPU_PORT_SB_CM, + MLXSW_SP_CPU_PORT_SB_CM, + MLXSW_SP_CPU_PORT_SB_CM, +diff --git a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +index 9d989c96278c..e41f28602535 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_iwarp.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_iwarp.c +@@ -1663,6 +1663,13 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, + iph = (struct iphdr *)((u8 *)(ethh) + eth_hlen); + + if (eth_type == ETH_P_IP) { ++ if (iph->protocol != IPPROTO_TCP) { ++ DP_NOTICE(p_hwfn, ++ "Unexpected ip protocol on ll2 %x\n", ++ iph->protocol); ++ return -EINVAL; ++ } ++ + cm_info->local_ip[0] = ntohl(iph->daddr); + cm_info->remote_ip[0] = ntohl(iph->saddr); + cm_info->ip_version = TCP_IPV4; +@@ -1671,6 +1678,14 @@ qed_iwarp_parse_rx_pkt(struct qed_hwfn *p_hwfn, + *payload_len = ntohs(iph->tot_len) - ip_hlen; + } else if (eth_type == ETH_P_IPV6) { + ip6h = (struct ipv6hdr *)iph; ++ ++ if (ip6h->nexthdr != IPPROTO_TCP) { ++ DP_NOTICE(p_hwfn, ++ "Unexpected ip protocol on ll2 %x\n", ++ iph->protocol); ++ return -EINVAL; ++ } ++ + for (i = 0; i < 4; i++) { + cm_info->local_ip[i] = + ntohl(ip6h->daddr.in6_u.u6_addr32[i]); +diff --git a/drivers/net/ethernet/qlogic/qede/qede_main.c b/drivers/net/ethernet/qlogic/qede/qede_main.c +index e5ee9f274a71..6eab2c632c75 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_main.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_main.c +@@ -2066,8 +2066,6 @@ static int qede_load(struct qede_dev *edev, enum qede_load_mode mode, + link_params.link_up = true; + edev->ops->common->set_link(edev->cdev, &link_params); + +- qede_rdma_dev_event_open(edev); +- + edev->state = QEDE_STATE_OPEN; + + DP_INFO(edev, "Ending successfully qede load\n"); +@@ -2168,12 +2166,14 @@ static void qede_link_update(void *dev, struct qed_link_output *link) + DP_NOTICE(edev, "Link is up\n"); + netif_tx_start_all_queues(edev->ndev); + netif_carrier_on(edev->ndev); ++ qede_rdma_dev_event_open(edev); + } + } else { + if (netif_carrier_ok(edev->ndev)) { + DP_NOTICE(edev, "Link is down\n"); + netif_tx_disable(edev->ndev); + netif_carrier_off(edev->ndev); ++ qede_rdma_dev_event_close(edev); + } + } + } +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 14b646b3b084..a5bb7b19040e 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -996,7 +996,8 @@ static void _cpsw_adjust_link(struct cpsw_slave *slave, + /* set speed_in input in case RMII mode is used in 100Mbps */ + if (phy->speed == 100) + mac_control |= BIT(15); +- else if (phy->speed == 10) ++ /* in band mode only works in 10Mbps RGMII mode */ ++ else if ((phy->speed == 10) && phy_interface_is_rgmii(phy)) + mac_control |= BIT(18); /* In Band mode */ + + if (priv->rx_pause) +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 176fc0906bfe..0f35597553f4 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1037,7 +1037,7 @@ static netdev_features_t macvlan_fix_features(struct net_device *dev, + lowerdev_features &= (features | ~NETIF_F_LRO); + features = netdev_increment_features(lowerdev_features, features, mask); + features |= ALWAYS_ON_FEATURES; +- features &= ~NETIF_F_NETNS_LOCAL; ++ features &= (ALWAYS_ON_FEATURES | MACVLAN_FEATURES); + + return features; + } +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index 39de77a8bb63..dba6d17ad885 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -614,6 +614,91 @@ static void phy_error(struct phy_device *phydev) + phy_trigger_machine(phydev, false); + } + ++/** ++ * phy_disable_interrupts - Disable the PHY interrupts from the PHY side ++ * @phydev: target phy_device struct ++ */ ++static int phy_disable_interrupts(struct phy_device *phydev) ++{ ++ int err; ++ ++ /* Disable PHY interrupts */ ++ err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED); ++ if (err) ++ goto phy_err; ++ ++ /* Clear the interrupt */ ++ err = phy_clear_interrupt(phydev); ++ if (err) ++ goto phy_err; ++ ++ return 0; ++ ++phy_err: ++ phy_error(phydev); ++ ++ return err; ++} ++ ++/** ++ * phy_change - Called by the phy_interrupt to handle PHY changes ++ * @phydev: phy_device struct that interrupted ++ */ ++static irqreturn_t phy_change(struct phy_device *phydev) ++{ ++ if (phy_interrupt_is_valid(phydev)) { ++ if (phydev->drv->did_interrupt && ++ !phydev->drv->did_interrupt(phydev)) ++ goto ignore; ++ ++ if (phy_disable_interrupts(phydev)) ++ goto phy_err; ++ } ++ ++ mutex_lock(&phydev->lock); ++ if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state)) ++ phydev->state = PHY_CHANGELINK; ++ mutex_unlock(&phydev->lock); ++ ++ if (phy_interrupt_is_valid(phydev)) { ++ atomic_dec(&phydev->irq_disable); ++ enable_irq(phydev->irq); ++ ++ /* Reenable interrupts */ ++ if (PHY_HALTED != phydev->state && ++ phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED)) ++ goto irq_enable_err; ++ } ++ ++ /* reschedule state queue work to run as soon as possible */ ++ phy_trigger_machine(phydev, true); ++ return IRQ_HANDLED; ++ ++ignore: ++ atomic_dec(&phydev->irq_disable); ++ enable_irq(phydev->irq); ++ return IRQ_NONE; ++ ++irq_enable_err: ++ disable_irq(phydev->irq); ++ atomic_inc(&phydev->irq_disable); ++phy_err: ++ phy_error(phydev); ++ return IRQ_NONE; ++} ++ ++/** ++ * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes ++ * @work: work_struct that describes the work to be done ++ */ ++void phy_change_work(struct work_struct *work) ++{ ++ struct phy_device *phydev = ++ container_of(work, struct phy_device, phy_queue); ++ ++ phy_change(phydev); ++} ++ + /** + * phy_interrupt - PHY interrupt handler + * @irq: interrupt line +@@ -632,9 +717,7 @@ static irqreturn_t phy_interrupt(int irq, void *phy_dat) + disable_irq_nosync(irq); + atomic_inc(&phydev->irq_disable); + +- phy_change(phydev); +- +- return IRQ_HANDLED; ++ return phy_change(phydev); + } + + /** +@@ -651,32 +734,6 @@ static int phy_enable_interrupts(struct phy_device *phydev) + return phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED); + } + +-/** +- * phy_disable_interrupts - Disable the PHY interrupts from the PHY side +- * @phydev: target phy_device struct +- */ +-static int phy_disable_interrupts(struct phy_device *phydev) +-{ +- int err; +- +- /* Disable PHY interrupts */ +- err = phy_config_interrupt(phydev, PHY_INTERRUPT_DISABLED); +- if (err) +- goto phy_err; +- +- /* Clear the interrupt */ +- err = phy_clear_interrupt(phydev); +- if (err) +- goto phy_err; +- +- return 0; +- +-phy_err: +- phy_error(phydev); +- +- return err; +-} +- + /** + * phy_start_interrupts - request and enable interrupts for a PHY device + * @phydev: target phy_device struct +@@ -727,64 +784,6 @@ int phy_stop_interrupts(struct phy_device *phydev) + } + EXPORT_SYMBOL(phy_stop_interrupts); + +-/** +- * phy_change - Called by the phy_interrupt to handle PHY changes +- * @phydev: phy_device struct that interrupted +- */ +-void phy_change(struct phy_device *phydev) +-{ +- if (phy_interrupt_is_valid(phydev)) { +- if (phydev->drv->did_interrupt && +- !phydev->drv->did_interrupt(phydev)) +- goto ignore; +- +- if (phy_disable_interrupts(phydev)) +- goto phy_err; +- } +- +- mutex_lock(&phydev->lock); +- if ((PHY_RUNNING == phydev->state) || (PHY_NOLINK == phydev->state)) +- phydev->state = PHY_CHANGELINK; +- mutex_unlock(&phydev->lock); +- +- if (phy_interrupt_is_valid(phydev)) { +- atomic_dec(&phydev->irq_disable); +- enable_irq(phydev->irq); +- +- /* Reenable interrupts */ +- if (PHY_HALTED != phydev->state && +- phy_config_interrupt(phydev, PHY_INTERRUPT_ENABLED)) +- goto irq_enable_err; +- } +- +- /* reschedule state queue work to run as soon as possible */ +- phy_trigger_machine(phydev, true); +- return; +- +-ignore: +- atomic_dec(&phydev->irq_disable); +- enable_irq(phydev->irq); +- return; +- +-irq_enable_err: +- disable_irq(phydev->irq); +- atomic_inc(&phydev->irq_disable); +-phy_err: +- phy_error(phydev); +-} +- +-/** +- * phy_change_work - Scheduled by the phy_mac_interrupt to handle PHY changes +- * @work: work_struct that describes the work to be done +- */ +-void phy_change_work(struct work_struct *work) +-{ +- struct phy_device *phydev = +- container_of(work, struct phy_device, phy_queue); +- +- phy_change(phydev); +-} +- + /** + * phy_stop - Bring down the PHY link, and stop checking the status + * @phydev: target phy_device struct +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index d312b314825e..a1e7ea4d4b16 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -999,10 +999,17 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev, + err = sysfs_create_link(&phydev->mdio.dev.kobj, &dev->dev.kobj, + "attached_dev"); + if (!err) { +- err = sysfs_create_link(&dev->dev.kobj, &phydev->mdio.dev.kobj, +- "phydev"); +- if (err) +- goto error; ++ err = sysfs_create_link_nowarn(&dev->dev.kobj, ++ &phydev->mdio.dev.kobj, ++ "phydev"); ++ if (err) { ++ dev_err(&dev->dev, "could not add device link to %s err %d\n", ++ kobject_name(&phydev->mdio.dev.kobj), ++ err); ++ /* non-fatal - some net drivers can use one netdevice ++ * with more then one phy ++ */ ++ } + + phydev->sysfs_links = true; + } +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index 38cd2e8fae23..34b24d7e1e2f 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -256,7 +256,7 @@ struct ppp_net { + /* Prototypes. */ + static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf, + struct file *file, unsigned int cmd, unsigned long arg); +-static void ppp_xmit_process(struct ppp *ppp); ++static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb); + static void ppp_send_frame(struct ppp *ppp, struct sk_buff *skb); + static void ppp_push(struct ppp *ppp); + static void ppp_channel_push(struct channel *pch); +@@ -512,13 +512,12 @@ static ssize_t ppp_write(struct file *file, const char __user *buf, + goto out; + } + +- skb_queue_tail(&pf->xq, skb); +- + switch (pf->kind) { + case INTERFACE: +- ppp_xmit_process(PF_TO_PPP(pf)); ++ ppp_xmit_process(PF_TO_PPP(pf), skb); + break; + case CHANNEL: ++ skb_queue_tail(&pf->xq, skb); + ppp_channel_push(PF_TO_CHANNEL(pf)); + break; + } +@@ -1264,8 +1263,8 @@ ppp_start_xmit(struct sk_buff *skb, struct net_device *dev) + put_unaligned_be16(proto, pp); + + skb_scrub_packet(skb, !net_eq(ppp->ppp_net, dev_net(dev))); +- skb_queue_tail(&ppp->file.xq, skb); +- ppp_xmit_process(ppp); ++ ppp_xmit_process(ppp, skb); ++ + return NETDEV_TX_OK; + + outf: +@@ -1417,13 +1416,14 @@ static void ppp_setup(struct net_device *dev) + */ + + /* Called to do any work queued up on the transmit side that can now be done */ +-static void __ppp_xmit_process(struct ppp *ppp) ++static void __ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb) + { +- struct sk_buff *skb; +- + ppp_xmit_lock(ppp); + if (!ppp->closing) { + ppp_push(ppp); ++ ++ if (skb) ++ skb_queue_tail(&ppp->file.xq, skb); + while (!ppp->xmit_pending && + (skb = skb_dequeue(&ppp->file.xq))) + ppp_send_frame(ppp, skb); +@@ -1437,7 +1437,7 @@ static void __ppp_xmit_process(struct ppp *ppp) + ppp_xmit_unlock(ppp); + } + +-static void ppp_xmit_process(struct ppp *ppp) ++static void ppp_xmit_process(struct ppp *ppp, struct sk_buff *skb) + { + local_bh_disable(); + +@@ -1445,7 +1445,7 @@ static void ppp_xmit_process(struct ppp *ppp) + goto err; + + (*this_cpu_ptr(ppp->xmit_recursion))++; +- __ppp_xmit_process(ppp); ++ __ppp_xmit_process(ppp, skb); + (*this_cpu_ptr(ppp->xmit_recursion))--; + + local_bh_enable(); +@@ -1455,6 +1455,8 @@ static void ppp_xmit_process(struct ppp *ppp) + err: + local_bh_enable(); + ++ kfree_skb(skb); ++ + if (net_ratelimit()) + netdev_err(ppp->dev, "recursion detected\n"); + } +@@ -1939,7 +1941,7 @@ static void __ppp_channel_push(struct channel *pch) + if (skb_queue_empty(&pch->file.xq)) { + ppp = pch->ppp; + if (ppp) +- __ppp_xmit_process(ppp); ++ __ppp_xmit_process(ppp, NULL); + } + } + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index ae53e899259f..23cd41c82210 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2394,7 +2394,7 @@ static int team_nl_send_options_get(struct team *team, u32 portid, u32 seq, + if (!nlh) { + err = __send_and_alloc_skb(&skb, team, portid, send_func); + if (err) +- goto errout; ++ return err; + goto send_done; + } + +@@ -2680,7 +2680,7 @@ static int team_nl_send_port_list_get(struct team *team, u32 portid, u32 seq, + if (!nlh) { + err = __send_and_alloc_skb(&skb, team, portid, send_func); + if (err) +- goto errout; ++ return err; + goto send_done; + } + +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 145b57762d8f..939b5b5e97ef 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -526,8 +526,7 @@ static inline int qeth_is_cq(struct qeth_card *card, unsigned int queue) + queue == card->qdio.no_in_queues - 1; + } + +- +-static int qeth_issue_next_read(struct qeth_card *card) ++static int __qeth_issue_next_read(struct qeth_card *card) + { + int rc; + struct qeth_cmd_buffer *iob; +@@ -558,6 +557,17 @@ static int qeth_issue_next_read(struct qeth_card *card) + return rc; + } + ++static int qeth_issue_next_read(struct qeth_card *card) ++{ ++ int ret; ++ ++ spin_lock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ ret = __qeth_issue_next_read(card); ++ spin_unlock_irq(get_ccwdev_lock(CARD_RDEV(card))); ++ ++ return ret; ++} ++ + static struct qeth_reply *qeth_alloc_reply(struct qeth_card *card) + { + struct qeth_reply *reply; +@@ -961,7 +971,7 @@ void qeth_clear_thread_running_bit(struct qeth_card *card, unsigned long thread) + spin_lock_irqsave(&card->thread_mask_lock, flags); + card->thread_running_mask &= ~thread; + spin_unlock_irqrestore(&card->thread_mask_lock, flags); +- wake_up(&card->wait_q); ++ wake_up_all(&card->wait_q); + } + EXPORT_SYMBOL_GPL(qeth_clear_thread_running_bit); + +@@ -1165,6 +1175,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + } + rc = qeth_get_problem(cdev, irb); + if (rc) { ++ card->read_or_write_problem = 1; + qeth_clear_ipacmd_list(card); + qeth_schedule_recovery(card); + goto out; +@@ -1183,7 +1194,7 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm, + return; + if (channel == &card->read && + channel->state == CH_STATE_UP) +- qeth_issue_next_read(card); ++ __qeth_issue_next_read(card); + + iob = channel->iob; + index = channel->buf_no; +@@ -5061,8 +5072,6 @@ static void qeth_core_free_card(struct qeth_card *card) + QETH_DBF_HEX(SETUP, 2, &card, sizeof(void *)); + qeth_clean_channel(&card->read); + qeth_clean_channel(&card->write); +- if (card->dev) +- free_netdev(card->dev); + qeth_free_qdio_buffers(card); + unregister_service_level(&card->qeth_service_level); + kfree(card); +diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c +index 5a973ebcb13c..521293b1f4fa 100644 +--- a/drivers/s390/net/qeth_l2_main.c ++++ b/drivers/s390/net/qeth_l2_main.c +@@ -935,8 +935,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) + qeth_l2_set_offline(cgdev); + + if (card->dev) { +- netif_napi_del(&card->napi); + unregister_netdev(card->dev); ++ free_netdev(card->dev); + card->dev = NULL; + } + return; +diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c +index 96576e729222..1c62cbbaa66f 100644 +--- a/drivers/s390/net/qeth_l3_main.c ++++ b/drivers/s390/net/qeth_l3_main.c +@@ -3046,8 +3046,8 @@ static void qeth_l3_remove_device(struct ccwgroup_device *cgdev) + qeth_l3_set_offline(cgdev); + + if (card->dev) { +- netif_napi_del(&card->napi); + unregister_netdev(card->dev); ++ free_netdev(card->dev); + card->dev = NULL; + } + +diff --git a/drivers/soc/fsl/qbman/qman.c b/drivers/soc/fsl/qbman/qman.c +index 18eefc3f1abe..0c6065dba48a 100644 +--- a/drivers/soc/fsl/qbman/qman.c ++++ b/drivers/soc/fsl/qbman/qman.c +@@ -2414,39 +2414,21 @@ struct cgr_comp { + struct completion completion; + }; + +-static int qman_delete_cgr_thread(void *p) ++static void qman_delete_cgr_smp_call(void *p) + { +- struct cgr_comp *cgr_comp = (struct cgr_comp *)p; +- int ret; +- +- ret = qman_delete_cgr(cgr_comp->cgr); +- complete(&cgr_comp->completion); +- +- return ret; ++ qman_delete_cgr((struct qman_cgr *)p); + } + + void qman_delete_cgr_safe(struct qman_cgr *cgr) + { +- struct task_struct *thread; +- struct cgr_comp cgr_comp; +- + preempt_disable(); + if (qman_cgr_cpus[cgr->cgrid] != smp_processor_id()) { +- init_completion(&cgr_comp.completion); +- cgr_comp.cgr = cgr; +- thread = kthread_create(qman_delete_cgr_thread, &cgr_comp, +- "cgr_del"); +- +- if (IS_ERR(thread)) +- goto out; +- +- kthread_bind(thread, qman_cgr_cpus[cgr->cgrid]); +- wake_up_process(thread); +- wait_for_completion(&cgr_comp.completion); ++ smp_call_function_single(qman_cgr_cpus[cgr->cgrid], ++ qman_delete_cgr_smp_call, cgr, true); + preempt_enable(); + return; + } +-out: ++ + qman_delete_cgr(cgr); + preempt_enable(); + } +diff --git a/fs/sysfs/symlink.c b/fs/sysfs/symlink.c +index aecb15f84557..808f018fa976 100644 +--- a/fs/sysfs/symlink.c ++++ b/fs/sysfs/symlink.c +@@ -107,6 +107,7 @@ int sysfs_create_link_nowarn(struct kobject *kobj, struct kobject *target, + { + return sysfs_do_create_link(kobj, target, name, 0); + } ++EXPORT_SYMBOL_GPL(sysfs_create_link_nowarn); + + /** + * sysfs_delete_link - remove symlink in object's directory. +diff --git a/include/linux/cgroup-defs.h b/include/linux/cgroup-defs.h +index 1dff0a478b45..4e8f77504a57 100644 +--- a/include/linux/cgroup-defs.h ++++ b/include/linux/cgroup-defs.h +@@ -696,13 +696,13 @@ struct sock_cgroup_data { + * updaters and return part of the previous pointer as the prioidx or + * classid. Such races are short-lived and the result isn't critical. + */ +-static inline u16 sock_cgroup_prioidx(struct sock_cgroup_data *skcd) ++static inline u16 sock_cgroup_prioidx(const struct sock_cgroup_data *skcd) + { + /* fallback to 1 which is always the ID of the root cgroup */ + return (skcd->is_data & 1) ? skcd->prioidx : 1; + } + +-static inline u32 sock_cgroup_classid(struct sock_cgroup_data *skcd) ++static inline u32 sock_cgroup_classid(const struct sock_cgroup_data *skcd) + { + /* fallback to 0 which is the unconfigured default classid */ + return (skcd->is_data & 1) ? skcd->classid : 0; +diff --git a/include/linux/phy.h b/include/linux/phy.h +index 600076e1ce84..dca9e926b88f 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -895,7 +895,6 @@ int phy_driver_register(struct phy_driver *new_driver, struct module *owner); + int phy_drivers_register(struct phy_driver *new_driver, int n, + struct module *owner); + void phy_state_machine(struct work_struct *work); +-void phy_change(struct phy_device *phydev); + void phy_change_work(struct work_struct *work); + void phy_mac_interrupt(struct phy_device *phydev, int new_link); + void phy_start_machine(struct phy_device *phydev); +diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h +index 361c08e35dbc..7fd514f36e74 100644 +--- a/include/linux/rhashtable.h ++++ b/include/linux/rhashtable.h +@@ -750,8 +750,10 @@ static inline void *__rhashtable_insert_fast( + if (!key || + (params.obj_cmpfn ? + params.obj_cmpfn(&arg, rht_obj(ht, head)) : +- rhashtable_compare(&arg, rht_obj(ht, head)))) ++ rhashtable_compare(&arg, rht_obj(ht, head)))) { ++ pprev = &head->next; + continue; ++ } + + data = rht_obj(ht, head); + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index 6073e8bae025..f59acacaa265 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -723,6 +723,16 @@ static inline void __qdisc_drop(struct sk_buff *skb, struct sk_buff **to_free) + *to_free = skb; + } + ++static inline void __qdisc_drop_all(struct sk_buff *skb, ++ struct sk_buff **to_free) ++{ ++ if (skb->prev) ++ skb->prev->next = *to_free; ++ else ++ skb->next = *to_free; ++ *to_free = skb; ++} ++ + static inline unsigned int __qdisc_queue_drop_head(struct Qdisc *sch, + struct qdisc_skb_head *qh, + struct sk_buff **to_free) +@@ -843,6 +853,15 @@ static inline int qdisc_drop(struct sk_buff *skb, struct Qdisc *sch, + return NET_XMIT_DROP; + } + ++static inline int qdisc_drop_all(struct sk_buff *skb, struct Qdisc *sch, ++ struct sk_buff **to_free) ++{ ++ __qdisc_drop_all(skb, to_free); ++ qdisc_qstats_drop(sch); ++ ++ return NET_XMIT_DROP; ++} ++ + /* Length to Time (L2T) lookup in a qdisc_rate_table, to determine how + long it will take to send a packet given its size. + */ +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 0a13574134b8..d323d4fa742c 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1600,6 +1600,11 @@ enum tcp_chrono { + void tcp_chrono_start(struct sock *sk, const enum tcp_chrono type); + void tcp_chrono_stop(struct sock *sk, const enum tcp_chrono type); + ++static inline void tcp_init_send_head(struct sock *sk) ++{ ++ sk->sk_send_head = NULL; ++} ++ + /* write queue abstraction */ + static inline void tcp_write_queue_purge(struct sock *sk) + { +@@ -1610,6 +1615,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) + sk_wmem_free_skb(sk, skb); + sk_mem_reclaim(sk); + tcp_clear_all_retrans_hints(tcp_sk(sk)); ++ tcp_init_send_head(sk); + } + + static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk) +@@ -1672,11 +1678,6 @@ static inline void tcp_check_send_head(struct sock *sk, struct sk_buff *skb_unli + tcp_sk(sk)->highest_sack = NULL; + } + +-static inline void tcp_init_send_head(struct sock *sk) +-{ +- sk->sk_send_head = NULL; +-} +- + static inline void __tcp_add_write_queue_tail(struct sock *sk, struct sk_buff *skb) + { + __skb_queue_tail(&sk->sk_write_queue, skb); +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index ddd7dde87c3c..b734ce731a7a 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -537,8 +537,10 @@ static void *rhashtable_lookup_one(struct rhashtable *ht, + if (!key || + (ht->p.obj_cmpfn ? + ht->p.obj_cmpfn(&arg, rht_obj(ht, head)) : +- rhashtable_compare(&arg, rht_obj(ht, head)))) ++ rhashtable_compare(&arg, rht_obj(ht, head)))) { ++ pprev = &head->next; + continue; ++ } + + if (!ht->rhlist) + return rht_obj(ht, head); +diff --git a/net/core/dev.c b/net/core/dev.c +index c75ef9d8105a..387af3415385 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3224,15 +3224,23 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q, + #if IS_ENABLED(CONFIG_CGROUP_NET_PRIO) + static void skb_update_prio(struct sk_buff *skb) + { +- struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap); ++ const struct netprio_map *map; ++ const struct sock *sk; ++ unsigned int prioidx; + +- if (!skb->priority && skb->sk && map) { +- unsigned int prioidx = +- sock_cgroup_prioidx(&skb->sk->sk_cgrp_data); ++ if (skb->priority) ++ return; ++ map = rcu_dereference_bh(skb->dev->priomap); ++ if (!map) ++ return; ++ sk = skb_to_full_sk(skb); ++ if (!sk) ++ return; + +- if (prioidx < map->priomap_len) +- skb->priority = map->priomap[prioidx]; +- } ++ prioidx = sock_cgroup_prioidx(&sk->sk_cgrp_data); ++ ++ if (prioidx < map->priomap_len) ++ skb->priority = map->priomap[prioidx]; + } + #else + #define skb_update_prio(skb) +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 7d430c1d9c3e..5ba973311025 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -1776,7 +1776,7 @@ static int devlink_dpipe_tables_fill(struct genl_info *info, + if (!nlh) { + err = devlink_dpipe_send_and_alloc_skb(&skb, info); + if (err) +- goto err_skb_send_alloc; ++ return err; + goto send_done; + } + +@@ -1785,7 +1785,6 @@ static int devlink_dpipe_tables_fill(struct genl_info *info, + nla_put_failure: + err = -EMSGSIZE; + err_table_put: +-err_skb_send_alloc: + genlmsg_cancel(skb, hdr); + nlmsg_free(skb); + return err; +@@ -2051,7 +2050,7 @@ static int devlink_dpipe_entries_fill(struct genl_info *info, + table->counters_enabled, + &dump_ctx); + if (err) +- goto err_entries_dump; ++ return err; + + send_done: + nlh = nlmsg_put(dump_ctx.skb, info->snd_portid, info->snd_seq, +@@ -2059,16 +2058,10 @@ static int devlink_dpipe_entries_fill(struct genl_info *info, + if (!nlh) { + err = devlink_dpipe_send_and_alloc_skb(&dump_ctx.skb, info); + if (err) +- goto err_skb_send_alloc; ++ return err; + goto send_done; + } + return genlmsg_reply(dump_ctx.skb, info); +- +-err_entries_dump: +-err_skb_send_alloc: +- genlmsg_cancel(dump_ctx.skb, dump_ctx.hdr); +- nlmsg_free(dump_ctx.skb); +- return err; + } + + static int devlink_nl_cmd_dpipe_entries_get(struct sk_buff *skb, +@@ -2207,7 +2200,7 @@ static int devlink_dpipe_headers_fill(struct genl_info *info, + if (!nlh) { + err = devlink_dpipe_send_and_alloc_skb(&skb, info); + if (err) +- goto err_skb_send_alloc; ++ return err; + goto send_done; + } + return genlmsg_reply(skb, info); +@@ -2215,7 +2208,6 @@ static int devlink_dpipe_headers_fill(struct genl_info *info, + nla_put_failure: + err = -EMSGSIZE; + err_table_put: +-err_skb_send_alloc: + genlmsg_cancel(skb, hdr); + nlmsg_free(skb); + return err; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index cc811add68c6..564beb7e6d1c 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4171,7 +4171,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb) + + skb_queue_tail(&sk->sk_error_queue, skb); + if (!sock_flag(sk, SOCK_DEAD)) +- sk->sk_data_ready(sk); ++ sk->sk_error_report(sk); + return 0; + } + EXPORT_SYMBOL(sock_queue_err_skb); +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index 9d43c1f40274..ff3b058cf58c 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -789,6 +789,11 @@ int dccp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_release; + ++ if (sk->sk_state == DCCP_CLOSED) { ++ rc = -ENOTCONN; ++ goto out_discard; ++ } ++ + skb_reserve(skb, sk->sk_prot->max_header); + rc = memcpy_from_msg(skb_put(skb, len), msg, len); + if (rc != 0) +diff --git a/net/ieee802154/6lowpan/core.c b/net/ieee802154/6lowpan/core.c +index 974765b7d92a..e9f0489e4229 100644 +--- a/net/ieee802154/6lowpan/core.c ++++ b/net/ieee802154/6lowpan/core.c +@@ -206,9 +206,13 @@ static inline void lowpan_netlink_fini(void) + static int lowpan_device_event(struct notifier_block *unused, + unsigned long event, void *ptr) + { +- struct net_device *wdev = netdev_notifier_info_to_dev(ptr); ++ struct net_device *ndev = netdev_notifier_info_to_dev(ptr); ++ struct wpan_dev *wpan_dev; + +- if (wdev->type != ARPHRD_IEEE802154) ++ if (ndev->type != ARPHRD_IEEE802154) ++ return NOTIFY_DONE; ++ wpan_dev = ndev->ieee802154_ptr; ++ if (!wpan_dev) + return NOTIFY_DONE; + + switch (event) { +@@ -217,8 +221,8 @@ static int lowpan_device_event(struct notifier_block *unused, + * also delete possible lowpan interfaces which belongs + * to the wpan interface. + */ +- if (wdev->ieee802154_ptr->lowpan_dev) +- lowpan_dellink(wdev->ieee802154_ptr->lowpan_dev, NULL); ++ if (wpan_dev->lowpan_dev) ++ lowpan_dellink(wpan_dev->lowpan_dev, NULL); + break; + default: + return NOTIFY_DONE; +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index af74d0433453..e691705f0a85 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -119,6 +119,9 @@ static void inet_frag_secret_rebuild(struct inet_frags *f) + + static bool inet_fragq_should_evict(const struct inet_frag_queue *q) + { ++ if (!hlist_unhashed(&q->list_evictor)) ++ return false; ++ + return q->net->low_thresh == 0 || + frag_mem_limit(q->net) >= q->net->low_thresh; + } +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index f56aab54e0c8..1e70ed5244ea 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -258,7 +258,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc, + src_info = (struct in6_pktinfo *)CMSG_DATA(cmsg); + if (!ipv6_addr_v4mapped(&src_info->ipi6_addr)) + return -EINVAL; +- ipc->oif = src_info->ipi6_ifindex; ++ if (src_info->ipi6_ifindex) ++ ipc->oif = src_info->ipi6_ifindex; + ipc->addr = src_info->ipi6_addr.s6_addr32[3]; + continue; + } +@@ -288,7 +289,8 @@ int ip_cmsg_send(struct sock *sk, struct msghdr *msg, struct ipcm_cookie *ipc, + if (cmsg->cmsg_len != CMSG_LEN(sizeof(struct in_pktinfo))) + return -EINVAL; + info = (struct in_pktinfo *)CMSG_DATA(cmsg); +- ipc->oif = info->ipi_ifindex; ++ if (info->ipi_ifindex) ++ ipc->oif = info->ipi_ifindex; + ipc->addr = info->ipi_spec_dst.s_addr; + break; + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index fe11128d7df4..38b9a6276a9d 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3445,6 +3445,7 @@ int tcp_abort(struct sock *sk, int err) + + bh_unlock_sock(sk); + local_bh_enable(); ++ tcp_write_queue_purge(sk); + release_sock(sk); + return 0; + } +diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c +index 14ac7df95380..a845b7692c1b 100644 +--- a/net/ipv4/tcp_timer.c ++++ b/net/ipv4/tcp_timer.c +@@ -36,6 +36,7 @@ static void tcp_write_err(struct sock *sk) + sk->sk_err = sk->sk_err_soft ? : ETIMEDOUT; + sk->sk_error_report(sk); + ++ tcp_write_queue_purge(sk); + tcp_done(sk); + __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPABORTONTIMEOUT); + } +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index a1f918713006..287112da3c06 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -146,10 +146,12 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, + struct sockaddr_in6 *usin = (struct sockaddr_in6 *) uaddr; + struct inet_sock *inet = inet_sk(sk); + struct ipv6_pinfo *np = inet6_sk(sk); +- struct in6_addr *daddr; ++ struct in6_addr *daddr, old_daddr; ++ __be32 fl6_flowlabel = 0; ++ __be32 old_fl6_flowlabel; ++ __be16 old_dport; + int addr_type; + int err; +- __be32 fl6_flowlabel = 0; + + if (usin->sin6_family == AF_INET) { + if (__ipv6_only_sock(sk)) +@@ -239,9 +241,13 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, + } + } + ++ /* save the current peer information before updating it */ ++ old_daddr = sk->sk_v6_daddr; ++ old_fl6_flowlabel = np->flow_label; ++ old_dport = inet->inet_dport; ++ + sk->sk_v6_daddr = *daddr; + np->flow_label = fl6_flowlabel; +- + inet->inet_dport = usin->sin6_port; + + /* +@@ -251,11 +257,12 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, + + err = ip6_datagram_dst_update(sk, true); + if (err) { +- /* Reset daddr and dport so that udp_v6_early_demux() +- * fails to find this socket ++ /* Restore the socket peer info, to keep it consistent with ++ * the old socket state + */ +- memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr)); +- inet->inet_dport = 0; ++ sk->sk_v6_daddr = old_daddr; ++ np->flow_label = old_fl6_flowlabel; ++ inet->inet_dport = old_dport; + goto out; + } + +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index 2a937c8d19e9..dd28005efb97 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1546,7 +1546,8 @@ static void ndisc_fill_redirect_hdr_option(struct sk_buff *skb, + *(opt++) = (rd_len >> 3); + opt += 6; + +- memcpy(opt, ipv6_hdr(orig_skb), rd_len - 8); ++ skb_copy_bits(orig_skb, skb_network_offset(orig_skb), opt, ++ rd_len - 8); + } + + void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index bd6cc688bd19..7a78dcfda68a 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -93,7 +93,8 @@ static void set_tun_src(struct net *net, struct net_device *dev, + /* encapsulate an IPv6 packet within an outer IPv6 header with a given SRH */ + int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + { +- struct net *net = dev_net(skb_dst(skb)->dev); ++ struct dst_entry *dst = skb_dst(skb); ++ struct net *net = dev_net(dst->dev); + struct ipv6hdr *hdr, *inner_hdr; + struct ipv6_sr_hdr *isrh; + int hdrlen, tot_len, err; +@@ -134,7 +135,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + isrh->nexthdr = proto; + + hdr->daddr = isrh->segments[isrh->first_segment]; +- set_tun_src(net, skb->dev, &hdr->daddr, &hdr->saddr); ++ set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr); + + #ifdef CONFIG_IPV6_SEG6_HMAC + if (sr_has_hmac(isrh)) { +@@ -418,7 +419,7 @@ static int seg6_build_state(struct nlattr *nla, + + slwt = seg6_lwt_lwtunnel(newts); + +- err = dst_cache_init(&slwt->cache, GFP_KERNEL); ++ err = dst_cache_init(&slwt->cache, GFP_ATOMIC); + if (err) { + kfree(newts); + return err; +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 148533169b1d..ca98276c2709 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -2433,9 +2433,11 @@ static int afiucv_iucv_init(void) + af_iucv_dev->driver = &af_iucv_driver; + err = device_register(af_iucv_dev); + if (err) +- goto out_driver; ++ goto out_iucv_dev; + return 0; + ++out_iucv_dev: ++ put_device(af_iucv_dev); + out_driver: + driver_unregister(&af_iucv_driver); + out_iucv: +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 58d53b907d53..9db49805b7be 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1381,24 +1381,32 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + .parse_msg = kcm_parse_func_strparser, + .read_sock_done = kcm_read_sock_done, + }; +- int err; ++ int err = 0; + + csk = csock->sk; + if (!csk) + return -EINVAL; + ++ lock_sock(csk); ++ + /* Only allow TCP sockets to be attached for now */ + if ((csk->sk_family != AF_INET && csk->sk_family != AF_INET6) || +- csk->sk_protocol != IPPROTO_TCP) +- return -EOPNOTSUPP; ++ csk->sk_protocol != IPPROTO_TCP) { ++ err = -EOPNOTSUPP; ++ goto out; ++ } + + /* Don't allow listeners or closed sockets */ +- if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) +- return -EOPNOTSUPP; ++ if (csk->sk_state == TCP_LISTEN || csk->sk_state == TCP_CLOSE) { ++ err = -EOPNOTSUPP; ++ goto out; ++ } + + psock = kmem_cache_zalloc(kcm_psockp, GFP_KERNEL); +- if (!psock) +- return -ENOMEM; ++ if (!psock) { ++ err = -ENOMEM; ++ goto out; ++ } + + psock->mux = mux; + psock->sk = csk; +@@ -1407,7 +1415,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + err = strp_init(&psock->strp, csk, &cb); + if (err) { + kmem_cache_free(kcm_psockp, psock); +- return err; ++ goto out; + } + + write_lock_bh(&csk->sk_callback_lock); +@@ -1419,7 +1427,8 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + write_unlock_bh(&csk->sk_callback_lock); + strp_done(&psock->strp); + kmem_cache_free(kcm_psockp, psock); +- return -EALREADY; ++ err = -EALREADY; ++ goto out; + } + + psock->save_data_ready = csk->sk_data_ready; +@@ -1455,7 +1464,10 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + /* Schedule RX work in case there are already bytes queued */ + strp_check_rcv(&psock->strp); + +- return 0; ++out: ++ release_sock(csk); ++ ++ return err; + } + + static int kcm_attach_ioctl(struct socket *sock, struct kcm_attach *info) +@@ -1507,6 +1519,7 @@ static void kcm_unattach(struct kcm_psock *psock) + + if (WARN_ON(psock->rx_kcm)) { + write_unlock_bh(&csk->sk_callback_lock); ++ release_sock(csk); + return; + } + +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index af22aa8ae35b..490d7360222e 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1562,9 +1562,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + encap = cfg->encap; + + /* Quick sanity checks */ ++ err = -EPROTONOSUPPORT; ++ if (sk->sk_type != SOCK_DGRAM) { ++ pr_debug("tunl %hu: fd %d wrong socket type\n", ++ tunnel_id, fd); ++ goto err; ++ } + switch (encap) { + case L2TP_ENCAPTYPE_UDP: +- err = -EPROTONOSUPPORT; + if (sk->sk_protocol != IPPROTO_UDP) { + pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", + tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP); +@@ -1572,7 +1577,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + } + break; + case L2TP_ENCAPTYPE_IP: +- err = -EPROTONOSUPPORT; + if (sk->sk_protocol != IPPROTO_L2TP) { + pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n", + tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP); +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index 6f02499ef007..b9ce82c9440f 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -1106,7 +1106,7 @@ static int genlmsg_mcast(struct sk_buff *skb, u32 portid, unsigned long group, + if (!err) + delivered = true; + else if (err != -ESRCH) +- goto error; ++ return err; + return delivered ? 0 : -ESRCH; + error: + kfree_skb(skb); +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 30c96274c638..22bf1a376b91 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -153,6 +153,7 @@ static int tunnel_key_init(struct net *net, struct nlattr *nla, + metadata->u.tun_info.mode |= IP_TUNNEL_INFO_TX; + break; + default: ++ ret = -EINVAL; + goto err_out; + } + +diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c +index b1266e75ca43..8c8df75dbead 100644 +--- a/net/sched/sch_netem.c ++++ b/net/sched/sch_netem.c +@@ -513,7 +513,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch, + } + + if (unlikely(sch->q.qlen >= sch->limit)) +- return qdisc_drop(skb, sch, to_free); ++ return qdisc_drop_all(skb, sch, to_free); + + qdisc_qstats_backlog_inc(sch, skb); + diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.32-33.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.32-33.patch new file mode 100644 index 000000000000..dcd21fd58d88 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.32-33.patch @@ -0,0 +1,2353 @@ +diff --git a/Documentation/devicetree/bindings/serial/8250.txt b/Documentation/devicetree/bindings/serial/8250.txt +index dad3b2ec66d4..aeb6db4e35c3 100644 +--- a/Documentation/devicetree/bindings/serial/8250.txt ++++ b/Documentation/devicetree/bindings/serial/8250.txt +@@ -24,6 +24,7 @@ Required properties: + - "ti,da830-uart" + - "aspeed,ast2400-vuart" + - "aspeed,ast2500-vuart" ++ - "nuvoton,npcm750-uart" + - "serial" if the port type is unknown. + - reg : offset and length of the register set for the device. + - interrupts : should contain uart interrupt. +diff --git a/Makefile b/Makefile +index c4c681b53ff0..00dd6af8eab4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 32 ++SUBLEVEL = 33 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/am335x-pepper.dts b/arch/arm/boot/dts/am335x-pepper.dts +index 9fb7426070ce..03c7d77023c6 100644 +--- a/arch/arm/boot/dts/am335x-pepper.dts ++++ b/arch/arm/boot/dts/am335x-pepper.dts +@@ -139,7 +139,7 @@ + &audio_codec { + status = "okay"; + +- reset-gpios = <&gpio1 16 GPIO_ACTIVE_LOW>; ++ gpio-reset = <&gpio1 16 GPIO_ACTIVE_LOW>; + AVDD-supply = <&ldo3_reg>; + IOVDD-supply = <&ldo3_reg>; + DRVDD-supply = <&ldo3_reg>; +diff --git a/arch/arm/boot/dts/dra76-evm.dts b/arch/arm/boot/dts/dra76-evm.dts +index b024a65c6e27..f64aab450315 100644 +--- a/arch/arm/boot/dts/dra76-evm.dts ++++ b/arch/arm/boot/dts/dra76-evm.dts +@@ -148,6 +148,7 @@ + compatible = "ti,tps65917"; + reg = <0x58>; + ti,system-power-controller; ++ ti,palmas-override-powerhold; + interrupt-controller; + #interrupt-cells = <2>; + +diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts +index c66ee8432a85..4acd32a1c4ef 100644 +--- a/arch/arm/boot/dts/omap3-n900.dts ++++ b/arch/arm/boot/dts/omap3-n900.dts +@@ -558,7 +558,7 @@ + tlv320aic3x: tlv320aic3x@18 { + compatible = "ti,tlv320aic3x"; + reg = <0x18>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + ai3x-gpio-func = < + 0 /* AIC3X_GPIO1_FUNC_DISABLED */ + 5 /* AIC3X_GPIO2_FUNC_DIGITAL_MIC_INPUT */ +@@ -575,7 +575,7 @@ + tlv320aic3x_aux: tlv320aic3x@19 { + compatible = "ti,tlv320aic3x"; + reg = <0x19>; +- reset-gpios = <&gpio2 28 GPIO_ACTIVE_LOW>; /* 60 */ ++ gpio-reset = <&gpio2 28 GPIO_ACTIVE_HIGH>; /* 60 */ + + AVDD-supply = <&vmmc2>; + DRVDD-supply = <&vmmc2>; +diff --git a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +index 51e6f1d21c32..b2758dd8ce43 100644 +--- a/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts ++++ b/arch/arm/boot/dts/sun6i-a31s-sinovoip-bpi-m2.dts +@@ -42,7 +42,6 @@ + + /dts-v1/; + #include "sun6i-a31s.dtsi" +-#include "sunxi-common-regulators.dtsi" + #include + + / { +@@ -99,6 +98,7 @@ + pinctrl-0 = <&gmac_pins_rgmii_a>, <&gmac_phy_reset_pin_bpi_m2>; + phy = <&phy1>; + phy-mode = "rgmii"; ++ phy-supply = <®_dldo1>; + snps,reset-gpio = <&pio 0 21 GPIO_ACTIVE_HIGH>; /* PA21 */ + snps,reset-active-low; + snps,reset-delays-us = <0 10000 30000>; +@@ -118,7 +118,7 @@ + &mmc0 { + pinctrl-names = "default"; + pinctrl-0 = <&mmc0_pins_a>, <&mmc0_cd_pin_bpi_m2>; +- vmmc-supply = <®_vcc3v0>; ++ vmmc-supply = <®_dcdc1>; + bus-width = <4>; + cd-gpios = <&pio 0 4 GPIO_ACTIVE_HIGH>; /* PA4 */ + cd-inverted; +@@ -132,7 +132,7 @@ + &mmc2 { + pinctrl-names = "default"; + pinctrl-0 = <&mmc2_pins_a>; +- vmmc-supply = <®_vcc3v0>; ++ vmmc-supply = <®_aldo1>; + mmc-pwrseq = <&mmc2_pwrseq>; + bus-width = <4>; + non-removable; +@@ -163,6 +163,8 @@ + reg = <0x68>; + interrupt-parent = <&nmi_intc>; + interrupts = <0 IRQ_TYPE_LEVEL_LOW>; ++ eldoin-supply = <®_dcdc1>; ++ x-powers,drive-vbus-en; + }; + }; + +@@ -193,7 +195,28 @@ + + #include "axp22x.dtsi" + ++®_aldo1 { ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-wifi"; ++}; ++ ++®_aldo2 { ++ regulator-always-on; ++ regulator-min-microvolt = <2500000>; ++ regulator-max-microvolt = <2500000>; ++ regulator-name = "vcc-gmac"; ++}; ++ ++®_aldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ regulator-name = "avcc"; ++}; ++ + ®_dc5ldo { ++ regulator-always-on; + regulator-min-microvolt = <700000>; + regulator-max-microvolt = <1320000>; + regulator-name = "vdd-cpus"; +@@ -233,6 +256,40 @@ + regulator-name = "vcc-dram"; + }; + ++®_dldo1 { ++ regulator-min-microvolt = <3000000>; ++ regulator-max-microvolt = <3000000>; ++ regulator-name = "vcc-mac"; ++}; ++ ++®_dldo2 { ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++ regulator-name = "avdd-csi"; ++}; ++ ++®_dldo3 { ++ regulator-always-on; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-name = "vcc-pb"; ++}; ++ ++®_eldo1 { ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-name = "vdd-csi"; ++ status = "okay"; ++}; ++ ++®_ldo_io1 { ++ regulator-always-on; ++ regulator-min-microvolt = <1800000>; ++ regulator-max-microvolt = <1800000>; ++ regulator-name = "vcc-pm-cpus"; ++ status = "okay"; ++}; ++ + &uart0 { + pinctrl-names = "default"; + pinctrl-0 = <&uart0_pins_a>; +diff --git a/arch/arm/crypto/Makefile b/arch/arm/crypto/Makefile +index 30ef8e291271..c9919c2b7ad1 100644 +--- a/arch/arm/crypto/Makefile ++++ b/arch/arm/crypto/Makefile +@@ -54,6 +54,7 @@ crct10dif-arm-ce-y := crct10dif-ce-core.o crct10dif-ce-glue.o + crc32-arm-ce-y:= crc32-ce-core.o crc32-ce-glue.o + chacha20-neon-y := chacha20-neon-core.o chacha20-neon-glue.o + ++ifdef REGENERATE_ARM_CRYPTO + quiet_cmd_perl = PERL $@ + cmd_perl = $(PERL) $(<) > $(@) + +@@ -62,5 +63,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha256-armv4.pl + + $(src)/sha512-core.S_shipped: $(src)/sha512-armv4.pl + $(call cmd,perl) ++endif + + .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S +diff --git a/arch/arm/plat-omap/include/plat/sram.h b/arch/arm/plat-omap/include/plat/sram.h +index fb061cf0d736..30a07730807a 100644 +--- a/arch/arm/plat-omap/include/plat/sram.h ++++ b/arch/arm/plat-omap/include/plat/sram.h +@@ -5,13 +5,4 @@ void omap_map_sram(unsigned long start, unsigned long size, + unsigned long skip, int cached); + void omap_sram_reset(void); + +-extern void *omap_sram_push_address(unsigned long size); +- +-/* Macro to push a function to the internal SRAM, using the fncpy API */ +-#define omap_sram_push(funcp, size) ({ \ +- typeof(&(funcp)) _res = NULL; \ +- void *_sram_address = omap_sram_push_address(size); \ +- if (_sram_address) \ +- _res = fncpy(_sram_address, &(funcp), size); \ +- _res; \ +-}) ++extern void *omap_sram_push(void *funcp, unsigned long size); +diff --git a/arch/arm/plat-omap/sram.c b/arch/arm/plat-omap/sram.c +index a5bc92d7e476..921840acf65c 100644 +--- a/arch/arm/plat-omap/sram.c ++++ b/arch/arm/plat-omap/sram.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + + #include + +@@ -42,7 +43,7 @@ static void __iomem *omap_sram_ceil; + * Note that fncpy requires the returned address to be aligned + * to an 8-byte boundary. + */ +-void *omap_sram_push_address(unsigned long size) ++static void *omap_sram_push_address(unsigned long size) + { + unsigned long available, new_ceil = (unsigned long)omap_sram_ceil; + +@@ -60,6 +61,30 @@ void *omap_sram_push_address(unsigned long size) + return (void *)omap_sram_ceil; + } + ++void *omap_sram_push(void *funcp, unsigned long size) ++{ ++ void *sram; ++ unsigned long base; ++ int pages; ++ void *dst = NULL; ++ ++ sram = omap_sram_push_address(size); ++ if (!sram) ++ return NULL; ++ ++ base = (unsigned long)sram & PAGE_MASK; ++ pages = PAGE_ALIGN(size) / PAGE_SIZE; ++ ++ set_memory_rw(base, pages); ++ ++ dst = fncpy(sram, funcp, size); ++ ++ set_memory_ro(base, pages); ++ set_memory_x(base, pages); ++ ++ return dst; ++} ++ + /* + * The SRAM context is lost during off-idle and stack + * needs to be reset. +@@ -75,6 +100,9 @@ void omap_sram_reset(void) + void __init omap_map_sram(unsigned long start, unsigned long size, + unsigned long skip, int cached) + { ++ unsigned long base; ++ int pages; ++ + if (size == 0) + return; + +@@ -95,4 +123,10 @@ void __init omap_map_sram(unsigned long start, unsigned long size, + */ + memset_io(omap_sram_base + omap_sram_skip, 0, + omap_sram_size - omap_sram_skip); ++ ++ base = (unsigned long)omap_sram_base; ++ pages = PAGE_ALIGN(omap_sram_size) / PAGE_SIZE; ++ ++ set_memory_ro(base, pages); ++ set_memory_x(base, pages); + } +diff --git a/arch/arm/vfp/vfpmodule.c b/arch/arm/vfp/vfpmodule.c +index a71a48e71fff..aa7496be311d 100644 +--- a/arch/arm/vfp/vfpmodule.c ++++ b/arch/arm/vfp/vfpmodule.c +@@ -648,7 +648,7 @@ int vfp_restore_user_hwstate(struct user_vfp __user *ufp, + */ + static int vfp_dying_cpu(unsigned int cpu) + { +- vfp_force_reload(cpu, current_thread_info()); ++ vfp_current_hw_state[cpu] = NULL; + return 0; + } + +diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile +index b5edc5918c28..12fd81af1d1c 100644 +--- a/arch/arm64/crypto/Makefile ++++ b/arch/arm64/crypto/Makefile +@@ -58,6 +58,7 @@ CFLAGS_aes-glue-ce.o := -DUSE_V8_CRYPTO_EXTENSIONS + $(obj)/aes-glue-%.o: $(src)/aes-glue.c FORCE + $(call if_changed_rule,cc_o_c) + ++ifdef REGENERATE_ARM64_CRYPTO + quiet_cmd_perlasm = PERLASM $@ + cmd_perlasm = $(PERL) $(<) void $(@) + +@@ -66,5 +67,6 @@ $(src)/sha256-core.S_shipped: $(src)/sha512-armv8.pl + + $(src)/sha512-core.S_shipped: $(src)/sha512-armv8.pl + $(call cmd,perlasm) ++endif + + .PRECIOUS: $(obj)/sha256-core.S $(obj)/sha512-core.S +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index e91b40aa5417..f9ca4bb3d48e 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -704,7 +704,7 @@ EXC_COMMON_BEGIN(bad_addr_slb) + ld r3, PACA_EXSLB+EX_DAR(r13) + std r3, _DAR(r1) + beq cr6, 2f +- li r10, 0x480 /* fix trap number for I-SLB miss */ ++ li r10, 0x481 /* fix trap number for I-SLB miss */ + std r10, _TRAP(r1) + 2: bl save_nvgprs + addi r3, r1, STACK_FRAME_OVERHEAD +diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c +index 4e65bf82f5e0..0ce8b0e5d7ba 100644 +--- a/arch/powerpc/kernel/irq.c ++++ b/arch/powerpc/kernel/irq.c +@@ -430,6 +430,14 @@ void force_external_irq_replay(void) + */ + WARN_ON(!arch_irqs_disabled()); + ++ /* ++ * Interrupts must always be hard disabled before irq_happened is ++ * modified (to prevent lost update in case of interrupt between ++ * load and store). ++ */ ++ __hard_irq_disable(); ++ local_paca->irq_happened |= PACA_IRQ_HARD_DIS; ++ + /* Indicate in the PACA that we have an interrupt to replay */ + local_paca->irq_happened |= PACA_IRQ_EE; + } +diff --git a/arch/x86/crypto/cast5_avx_glue.c b/arch/x86/crypto/cast5_avx_glue.c +index dbea6020ffe7..575292a33bdf 100644 +--- a/arch/x86/crypto/cast5_avx_glue.c ++++ b/arch/x86/crypto/cast5_avx_glue.c +@@ -66,8 +66,6 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + void (*fn)(struct cast5_ctx *ctx, u8 *dst, const u8 *src); + int err; + +- fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; +- + err = blkcipher_walk_virt(desc, walk); + desc->flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; + +@@ -79,6 +77,7 @@ static int ecb_crypt(struct blkcipher_desc *desc, struct blkcipher_walk *walk, + + /* Process multi-block batch */ + if (nbytes >= bsize * CAST5_PARALLEL_BLOCKS) { ++ fn = (enc) ? cast5_ecb_enc_16way : cast5_ecb_dec_16way; + do { + fn(ctx, wdst, wsrc); + +diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h +index 8ec99a55e6b9..bf253ad93bbc 100644 +--- a/arch/x86/include/asm/hw_irq.h ++++ b/arch/x86/include/asm/hw_irq.h +@@ -34,6 +34,7 @@ extern asmlinkage void kvm_posted_intr_wakeup_ipi(void); + extern asmlinkage void kvm_posted_intr_nested_ipi(void); + extern asmlinkage void error_interrupt(void); + extern asmlinkage void irq_work_interrupt(void); ++extern asmlinkage void uv_bau_message_intr1(void); + + extern asmlinkage void spurious_interrupt(void); + extern asmlinkage void thermal_interrupt(void); +diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c +index a59624080015..0c5256653d6c 100644 +--- a/arch/x86/kernel/idt.c ++++ b/arch/x86/kernel/idt.c +@@ -140,6 +140,9 @@ static const __initconst struct idt_data apic_idts[] = { + # ifdef CONFIG_IRQ_WORK + INTG(IRQ_WORK_VECTOR, irq_work_interrupt), + # endif ++#ifdef CONFIG_X86_UV ++ INTG(UV_BAU_MESSAGE, uv_bau_message_intr1), ++#endif + INTG(SPURIOUS_APIC_VECTOR, spurious_interrupt), + INTG(ERROR_APIC_VECTOR, error_interrupt), + #endif +diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c +index 7d5d53f36a7a..0b530c53de1f 100644 +--- a/arch/x86/platform/uv/tlb_uv.c ++++ b/arch/x86/platform/uv/tlb_uv.c +@@ -2254,8 +2254,6 @@ static int __init uv_bau_init(void) + init_uvhub(uvhub, vector, uv_base_pnode); + } + +- alloc_intr_gate(vector, uv_bau_message_intr1); +- + for_each_possible_blade(uvhub) { + if (uv_blade_nr_possible_cpus(uvhub)) { + unsigned long val; +diff --git a/block/bio.c b/block/bio.c +index 7f978eac9a7a..dbaa82c967f4 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -43,9 +43,9 @@ + * break badly! cannot be bigger than what you can fit into an + * unsigned short + */ +-#define BV(x) { .nr_vecs = x, .name = "biovec-"__stringify(x) } ++#define BV(x, n) { .nr_vecs = x, .name = "biovec-"#n } + static struct biovec_slab bvec_slabs[BVEC_POOL_NR] __read_mostly = { +- BV(1), BV(4), BV(16), BV(64), BV(128), BV(BIO_MAX_PAGES), ++ BV(1, 1), BV(4, 4), BV(16, 16), BV(64, 64), BV(128, 128), BV(BIO_MAX_PAGES, max), + }; + #undef BV + +diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c +index 0af3a3db6fb0..82c44f7df911 100644 +--- a/block/partitions/msdos.c ++++ b/block/partitions/msdos.c +@@ -301,7 +301,9 @@ static void parse_bsd(struct parsed_partitions *state, + continue; + bsd_start = le32_to_cpu(p->p_offset); + bsd_size = le32_to_cpu(p->p_size); +- if (memcmp(flavour, "bsd\0", 4) == 0) ++ /* FreeBSD has relative offset if C partition offset is zero */ ++ if (memcmp(flavour, "bsd\0", 4) == 0 && ++ le32_to_cpu(l->d_partitions[2].p_offset) == 0) + bsd_start += offset; + if (offset == bsd_start && size == bsd_size) + /* full parent partition, we have it already */ +diff --git a/crypto/ahash.c b/crypto/ahash.c +index f75b5c1f7152..3980e9e45289 100644 +--- a/crypto/ahash.c ++++ b/crypto/ahash.c +@@ -92,13 +92,14 @@ int crypto_hash_walk_done(struct crypto_hash_walk *walk, int err) + + if (nbytes && walk->offset & alignmask && !err) { + walk->offset = ALIGN(walk->offset, alignmask + 1); +- walk->data += walk->offset; +- + nbytes = min(nbytes, + ((unsigned int)(PAGE_SIZE)) - walk->offset); + walk->entrylen -= nbytes; + +- return nbytes; ++ if (nbytes) { ++ walk->data += walk->offset; ++ return nbytes; ++ } + } + + if (walk->flags & CRYPTO_ALG_ASYNC) +diff --git a/crypto/lrw.c b/crypto/lrw.c +index eb681e9fe574..fdba6dd6db63 100644 +--- a/crypto/lrw.c ++++ b/crypto/lrw.c +@@ -313,7 +313,7 @@ static void exit_crypt(struct skcipher_request *req) + rctx->left = 0; + + if (rctx->ext) +- kfree(rctx->ext); ++ kzfree(rctx->ext); + } + + static int do_encrypt(struct skcipher_request *req, int err) +diff --git a/crypto/testmgr.h b/crypto/testmgr.h +index d54971d2d1c8..fbc0fab5e79e 100644 +--- a/crypto/testmgr.h ++++ b/crypto/testmgr.h +@@ -548,7 +548,7 @@ static const struct akcipher_testvec rsa_tv_template[] = { + static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = { + { + .key = +- "\x30\x82\x03\x1f\x02\x01\x10\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" ++ "\x30\x82\x03\x1f\x02\x01\x00\x02\x82\x01\x01\x00\xd7\x1e\x77\x82" + "\x8c\x92\x31\xe7\x69\x02\xa2\xd5\x5c\x78\xde\xa2\x0c\x8f\xfe\x28" + "\x59\x31\xdf\x40\x9c\x60\x61\x06\xb9\x2f\x62\x40\x80\x76\xcb\x67" + "\x4a\xb5\x59\x56\x69\x17\x07\xfa\xf9\x4c\xbd\x6c\x37\x7a\x46\x7d" +@@ -597,8 +597,8 @@ static const struct akcipher_testvec pkcs1pad_rsa_tv_template[] = { + "\xfe\xf8\x27\x1b\xd6\x55\x60\x5e\x48\xb7\x6d\x9a\xa8\x37\xf9\x7a" + "\xde\x1b\xcd\x5d\x1a\x30\xd4\xe9\x9e\x5b\x3c\x15\xf8\x9c\x1f\xda" + "\xd1\x86\x48\x55\xce\x83\xee\x8e\x51\xc7\xde\x32\x12\x47\x7d\x46" +- "\xb8\x35\xdf\x41\x02\x01\x30\x02\x01\x30\x02\x01\x30\x02\x01\x30" +- "\x02\x01\x30", ++ "\xb8\x35\xdf\x41\x02\x01\x00\x02\x01\x00\x02\x01\x00\x02\x01\x00" ++ "\x02\x01\x00", + .key_len = 804, + /* + * m is SHA256 hash of following message: +diff --git a/drivers/base/arch_topology.c b/drivers/base/arch_topology.c +index 6df7d6676a48..41be9ff7d70a 100644 +--- a/drivers/base/arch_topology.c ++++ b/drivers/base/arch_topology.c +@@ -166,11 +166,11 @@ bool __init topology_parse_cpu_capacity(struct device_node *cpu_node, int cpu) + } + + #ifdef CONFIG_CPU_FREQ +-static cpumask_var_t cpus_to_visit __initdata; +-static void __init parsing_done_workfn(struct work_struct *work); +-static __initdata DECLARE_WORK(parsing_done_work, parsing_done_workfn); ++static cpumask_var_t cpus_to_visit; ++static void parsing_done_workfn(struct work_struct *work); ++static DECLARE_WORK(parsing_done_work, parsing_done_workfn); + +-static int __init ++static int + init_cpu_capacity_callback(struct notifier_block *nb, + unsigned long val, + void *data) +@@ -206,7 +206,7 @@ init_cpu_capacity_callback(struct notifier_block *nb, + return 0; + } + +-static struct notifier_block init_cpu_capacity_notifier __initdata = { ++static struct notifier_block init_cpu_capacity_notifier = { + .notifier_call = init_cpu_capacity_callback, + }; + +@@ -232,7 +232,7 @@ static int __init register_cpufreq_notifier(void) + } + core_initcall(register_cpufreq_notifier); + +-static void __init parsing_done_workfn(struct work_struct *work) ++static void parsing_done_workfn(struct work_struct *work) + { + cpufreq_unregister_notifier(&init_cpu_capacity_notifier, + CPUFREQ_POLICY_NOTIFIER); +diff --git a/drivers/char/mem.c b/drivers/char/mem.c +index 3a70dba2c645..f11224a5dc5c 100644 +--- a/drivers/char/mem.c ++++ b/drivers/char/mem.c +@@ -137,7 +137,7 @@ static ssize_t read_mem(struct file *file, char __user *buf, + + while (count > 0) { + unsigned long remaining; +- int allowed; ++ int allowed, probe; + + sz = size_inside_page(p, count); + +@@ -160,9 +160,9 @@ static ssize_t read_mem(struct file *file, char __user *buf, + if (!ptr) + goto failed; + +- err = probe_kernel_read(bounce, ptr, sz); ++ probe = probe_kernel_read(bounce, ptr, sz); + unxlate_dev_mem_ptr(p, ptr); +- if (err) ++ if (probe) + goto failed; + + remaining = copy_to_user(buf, bounce, sz); +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index bb1e148ebfd4..ea43b147a7fe 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -631,8 +631,6 @@ static int cpufreq_parse_governor(char *str_governor, unsigned int *policy, + *governor = t; + err = 0; + } +- if (t && !try_module_get(t->owner)) +- t = NULL; + + mutex_unlock(&cpufreq_governor_mutex); + } +@@ -761,10 +759,6 @@ static ssize_t store_scaling_governor(struct cpufreq_policy *policy, + return -EINVAL; + + ret = cpufreq_set_policy(policy, &new_policy); +- +- if (new_policy.governor) +- module_put(new_policy.governor->owner); +- + return ret ? ret : count; + } + +diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c +index e1d4ae1153c4..39f70411f28f 100644 +--- a/drivers/crypto/caam/ctrl.c ++++ b/drivers/crypto/caam/ctrl.c +@@ -813,9 +813,6 @@ static int caam_probe(struct platform_device *pdev) + return 0; + + caam_remove: +-#ifdef CONFIG_DEBUG_FS +- debugfs_remove_recursive(ctrlpriv->dfs_root); +-#endif + caam_remove(pdev); + return ret; + +diff --git a/drivers/crypto/ccp/ccp-crypto-rsa.c b/drivers/crypto/ccp/ccp-crypto-rsa.c +index e6db8672d89c..05850dfd7940 100644 +--- a/drivers/crypto/ccp/ccp-crypto-rsa.c ++++ b/drivers/crypto/ccp/ccp-crypto-rsa.c +@@ -60,10 +60,9 @@ static int ccp_rsa_complete(struct crypto_async_request *async_req, int ret) + + static unsigned int ccp_rsa_maxsize(struct crypto_akcipher *tfm) + { +- if (ccp_version() > CCP_VERSION(3, 0)) +- return CCP5_RSA_MAXMOD; +- else +- return CCP_RSA_MAXMOD; ++ struct ccp_ctx *ctx = akcipher_tfm_ctx(tfm); ++ ++ return ctx->u.rsa.n_len; + } + + static int ccp_rsa_crypt(struct akcipher_request *req, bool encrypt) +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index 4bcef78a08aa..d4c81cb73bee 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -789,7 +789,7 @@ static int safexcel_probe(struct platform_device *pdev) + return PTR_ERR(priv->base); + } + +- priv->clk = of_clk_get(dev->of_node, 0); ++ priv->clk = devm_clk_get(&pdev->dev, NULL); + if (!IS_ERR(priv->clk)) { + ret = clk_prepare_enable(priv->clk); + if (ret) { +diff --git a/drivers/i2c/busses/i2c-stm32f7.c b/drivers/i2c/busses/i2c-stm32f7.c +index d4a6e9c2e9aa..124f9b1cf1b0 100644 +--- a/drivers/i2c/busses/i2c-stm32f7.c ++++ b/drivers/i2c/busses/i2c-stm32f7.c +@@ -887,6 +887,11 @@ static int stm32f7_i2c_probe(struct platform_device *pdev) + } + + setup = of_device_get_match_data(&pdev->dev); ++ if (!setup) { ++ dev_err(&pdev->dev, "Can't get device data\n"); ++ ret = -ENODEV; ++ goto clk_free; ++ } + i2c_dev->setup = *setup; + + ret = device_property_read_u32(i2c_dev->dev, "i2c-scl-rising-time-ns", +diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c +index d2f74721b3ba..40475ebf3a61 100644 +--- a/drivers/infiniband/core/addr.c ++++ b/drivers/infiniband/core/addr.c +@@ -207,6 +207,22 @@ int rdma_addr_size(struct sockaddr *addr) + } + EXPORT_SYMBOL(rdma_addr_size); + ++int rdma_addr_size_in6(struct sockaddr_in6 *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_in6); ++ ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr) ++{ ++ int ret = rdma_addr_size((struct sockaddr *) addr); ++ ++ return ret <= sizeof(*addr) ? ret : 0; ++} ++EXPORT_SYMBOL(rdma_addr_size_kss); ++ + static struct rdma_addr_client self; + + void rdma_addr_register_client(struct rdma_addr_client *client) +@@ -597,6 +613,15 @@ static void process_one_req(struct work_struct *_work) + list_del(&req->list); + mutex_unlock(&lock); + ++ /* ++ * Although the work will normally have been canceled by the ++ * workqueue, it can still be requeued as long as it is on the ++ * req_list, so it could have been requeued before we grabbed &lock. ++ * We need to cancel it after it is removed from req_list to really be ++ * sure it is safe to free. ++ */ ++ cancel_delayed_work(&req->work); ++ + req->callback(req->status, (struct sockaddr *)&req->src_addr, + req->addr, req->context); + put_client(req->client); +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 77ca9da570a2..722235bed075 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -132,7 +132,7 @@ static inline struct ucma_context *_ucma_find_context(int id, + ctx = idr_find(&ctx_idr, id); + if (!ctx) + ctx = ERR_PTR(-ENOENT); +- else if (ctx->file != file) ++ else if (ctx->file != file || !ctx->cm_id) + ctx = ERR_PTR(-EINVAL); + return ctx; + } +@@ -456,6 +456,7 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + struct rdma_ucm_create_id cmd; + struct rdma_ucm_create_id_resp resp; + struct ucma_context *ctx; ++ struct rdma_cm_id *cm_id; + enum ib_qp_type qp_type; + int ret; + +@@ -476,10 +477,10 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + return -ENOMEM; + + ctx->uid = cmd.uid; +- ctx->cm_id = rdma_create_id(current->nsproxy->net_ns, +- ucma_event_handler, ctx, cmd.ps, qp_type); +- if (IS_ERR(ctx->cm_id)) { +- ret = PTR_ERR(ctx->cm_id); ++ cm_id = rdma_create_id(current->nsproxy->net_ns, ++ ucma_event_handler, ctx, cmd.ps, qp_type); ++ if (IS_ERR(cm_id)) { ++ ret = PTR_ERR(cm_id); + goto err1; + } + +@@ -489,14 +490,19 @@ static ssize_t ucma_create_id(struct ucma_file *file, const char __user *inbuf, + ret = -EFAULT; + goto err2; + } ++ ++ ctx->cm_id = cm_id; + return 0; + + err2: +- rdma_destroy_id(ctx->cm_id); ++ rdma_destroy_id(cm_id); + err1: + mutex_lock(&mut); + idr_remove(&ctx_idr, ctx->id); + mutex_unlock(&mut); ++ mutex_lock(&file->mut); ++ list_del(&ctx->list); ++ mutex_unlock(&file->mut); + kfree(ctx); + return ret; + } +@@ -626,6 +632,9 @@ static ssize_t ucma_bind_ip(struct ucma_file *file, const char __user *inbuf, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); +@@ -639,22 +648,21 @@ static ssize_t ucma_bind(struct ucma_file *file, const char __user *inbuf, + int in_len, int out_len) + { + struct rdma_ucm_bind cmd; +- struct sockaddr *addr; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- addr = (struct sockaddr *) &cmd.addr; +- if (cmd.reserved || !cmd.addr_size || (cmd.addr_size != rdma_addr_size(addr))) ++ if (cmd.reserved || !cmd.addr_size || ++ cmd.addr_size != rdma_addr_size_kss(&cmd.addr)) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_bind_addr(ctx->cm_id, addr); ++ ret = rdma_bind_addr(ctx->cm_id, (struct sockaddr *) &cmd.addr); + ucma_put_ctx(ctx); + return ret; + } +@@ -670,13 +678,16 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + ++ if (!rdma_addr_size_in6(&cmd.src_addr) || ++ !rdma_addr_size_in6(&cmd.dst_addr)) ++ return -EINVAL; ++ + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + + ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, +- (struct sockaddr *) &cmd.dst_addr, +- cmd.timeout_ms); ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -686,24 +697,23 @@ static ssize_t ucma_resolve_addr(struct ucma_file *file, + int in_len, int out_len) + { + struct rdma_ucm_resolve_addr cmd; +- struct sockaddr *src, *dst; + struct ucma_context *ctx; + int ret; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- src = (struct sockaddr *) &cmd.src_addr; +- dst = (struct sockaddr *) &cmd.dst_addr; +- if (cmd.reserved || (cmd.src_size && (cmd.src_size != rdma_addr_size(src))) || +- !cmd.dst_size || (cmd.dst_size != rdma_addr_size(dst))) ++ if (cmd.reserved || ++ (cmd.src_size && (cmd.src_size != rdma_addr_size_kss(&cmd.src_addr))) || ++ !cmd.dst_size || (cmd.dst_size != rdma_addr_size_kss(&cmd.dst_addr))) + return -EINVAL; + + ctx = ucma_get_ctx(file, cmd.id); + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_resolve_addr(ctx->cm_id, src, dst, cmd.timeout_ms); ++ ret = rdma_resolve_addr(ctx->cm_id, (struct sockaddr *) &cmd.src_addr, ++ (struct sockaddr *) &cmd.dst_addr, cmd.timeout_ms); + ucma_put_ctx(ctx); + return ret; + } +@@ -1155,6 +1165,11 @@ static ssize_t ucma_init_qp_attr(struct ucma_file *file, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + ++ if (!ctx->cm_id->device) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + resp.qp_attr_mask = 0; + memset(&qp_attr, 0, sizeof qp_attr); + qp_attr.qp_state = cmd.qp_state; +@@ -1320,7 +1335,7 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + { + struct rdma_ucm_notify cmd; + struct ucma_context *ctx; +- int ret; ++ int ret = -EINVAL; + + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; +@@ -1329,7 +1344,9 @@ static ssize_t ucma_notify(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- ret = rdma_notify(ctx->cm_id, (enum ib_event_type) cmd.event); ++ if (ctx->cm_id->device) ++ ret = rdma_notify(ctx->cm_id, (enum ib_event_type)cmd.event); ++ + ucma_put_ctx(ctx); + return ret; + } +@@ -1415,7 +1432,7 @@ static ssize_t ucma_join_ip_multicast(struct ucma_file *file, + join_cmd.response = cmd.response; + join_cmd.uid = cmd.uid; + join_cmd.id = cmd.id; +- join_cmd.addr_size = rdma_addr_size((struct sockaddr *) &cmd.addr); ++ join_cmd.addr_size = rdma_addr_size_in6(&cmd.addr); + if (!join_cmd.addr_size) + return -EINVAL; + +@@ -1434,7 +1451,7 @@ static ssize_t ucma_join_multicast(struct ucma_file *file, + if (copy_from_user(&cmd, inbuf, sizeof(cmd))) + return -EFAULT; + +- if (!rdma_addr_size((struct sockaddr *)&cmd.addr)) ++ if (!rdma_addr_size_kss(&cmd.addr)) + return -EINVAL; + + return ucma_process_join(file, &cmd, out_len); +diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c +index 3d9c294e84db..9a234da8cac2 100644 +--- a/drivers/input/mouse/alps.c ++++ b/drivers/input/mouse/alps.c +@@ -2544,13 +2544,31 @@ static int alps_update_btn_info_ss4_v2(unsigned char otp[][4], + } + + static int alps_update_dual_info_ss4_v2(unsigned char otp[][4], +- struct alps_data *priv) ++ struct alps_data *priv, ++ struct psmouse *psmouse) + { + bool is_dual = false; ++ int reg_val = 0; ++ struct ps2dev *ps2dev = &psmouse->ps2dev; + +- if (IS_SS4PLUS_DEV(priv->dev_id)) ++ if (IS_SS4PLUS_DEV(priv->dev_id)) { + is_dual = (otp[0][0] >> 4) & 0x01; + ++ if (!is_dual) { ++ /* For support TrackStick of Thinkpad L/E series */ ++ if (alps_exit_command_mode(psmouse) == 0 && ++ alps_enter_command_mode(psmouse) == 0) { ++ reg_val = alps_command_mode_read_reg(psmouse, ++ 0xD7); ++ } ++ alps_exit_command_mode(psmouse); ++ ps2_command(ps2dev, NULL, PSMOUSE_CMD_ENABLE); ++ ++ if (reg_val == 0x0C || reg_val == 0x1D) ++ is_dual = true; ++ } ++ } ++ + if (is_dual) + priv->flags |= ALPS_DUALPOINT | + ALPS_DUALPOINT_WITH_PRESSURE; +@@ -2573,7 +2591,7 @@ static int alps_set_defaults_ss4_v2(struct psmouse *psmouse, + + alps_update_btn_info_ss4_v2(otp, priv); + +- alps_update_dual_info_ss4_v2(otp, priv); ++ alps_update_dual_info_ss4_v2(otp, priv, psmouse); + + return 0; + } +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index 6cbbdc6e9687..b353d494ad40 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -530,6 +530,20 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + { } + }; + ++static const struct dmi_system_id i8042_dmi_forcemux_table[] __initconst = { ++ { ++ /* ++ * Sony Vaio VGN-CS series require MUX or the touch sensor ++ * buttons will disturb touchpad operation ++ */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Sony Corporation"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "VGN-CS"), ++ }, ++ }, ++ { } ++}; ++ + /* + * On some Asus laptops, just running self tests cause problems. + */ +@@ -620,6 +634,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "20046"), + }, + }, ++ { ++ /* Lenovo ThinkPad L460 */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L460"), ++ }, ++ }, + { + /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ + .matches = { +@@ -1163,6 +1184,9 @@ static int __init i8042_platform_init(void) + if (dmi_check_system(i8042_dmi_nomux_table)) + i8042_nomux = true; + ++ if (dmi_check_system(i8042_dmi_forcemux_table)) ++ i8042_nomux = false; ++ + if (dmi_check_system(i8042_dmi_notimeout_table)) + i8042_notimeout = true; + +diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c +index 71fb5734995b..68df16b3ce72 100644 +--- a/drivers/media/usb/usbtv/usbtv-core.c ++++ b/drivers/media/usb/usbtv/usbtv-core.c +@@ -112,6 +112,8 @@ static int usbtv_probe(struct usb_interface *intf, + return 0; + + usbtv_audio_fail: ++ /* we must not free at this point */ ++ usb_get_dev(usbtv->udev); + usbtv_video_free(usbtv); + + usbtv_video_fail: +diff --git a/drivers/misc/mei/main.c b/drivers/misc/mei/main.c +index e825f013e54e..22efc039f302 100644 +--- a/drivers/misc/mei/main.c ++++ b/drivers/misc/mei/main.c +@@ -507,7 +507,6 @@ static long mei_ioctl(struct file *file, unsigned int cmd, unsigned long data) + break; + + default: +- dev_err(dev->dev, ": unsupported ioctl %d.\n", cmd); + rets = -ENOIOCTLCMD; + } + +diff --git a/drivers/mtd/chips/jedec_probe.c b/drivers/mtd/chips/jedec_probe.c +index 7c0b27d132b1..b479bd81120b 100644 +--- a/drivers/mtd/chips/jedec_probe.c ++++ b/drivers/mtd/chips/jedec_probe.c +@@ -1889,6 +1889,8 @@ static inline u32 jedec_read_mfr(struct map_info *map, uint32_t base, + do { + uint32_t ofs = cfi_build_cmd_addr(0 + (bank << 8), map, cfi); + mask = (1 << (cfi->device_type * 8)) - 1; ++ if (ofs >= map->size) ++ return 0; + result = map_read(map, base + ofs); + bank++; + } while ((result.x[0] & mask) == CFI_MFR_CONTINUATION); +diff --git a/drivers/mtd/nand/atmel/pmecc.c b/drivers/mtd/nand/atmel/pmecc.c +index 8268636675ef..4124bf91bee6 100644 +--- a/drivers/mtd/nand/atmel/pmecc.c ++++ b/drivers/mtd/nand/atmel/pmecc.c +@@ -426,7 +426,7 @@ static int get_strength(struct atmel_pmecc_user *user) + + static int get_sectorsize(struct atmel_pmecc_user *user) + { +- return user->cache.cfg & PMECC_LOOKUP_TABLE_SIZE_1024 ? 1024 : 512; ++ return user->cache.cfg & PMECC_CFG_SECTOR1024 ? 1024 : 512; + } + + static void atmel_pmecc_gen_syndrome(struct atmel_pmecc_user *user, int sector) +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +index 86944bc3b273..74bd260ca02a 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_gmac.c +@@ -666,7 +666,7 @@ static void hns_gmac_get_strings(u32 stringset, u8 *data) + + static int hns_gmac_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ARRAY_SIZE(g_gmac_stats_string); + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +index b62816c1574e..93e71e27401b 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_ppe.c +@@ -422,7 +422,7 @@ void hns_ppe_update_stats(struct hns_ppe_cb *ppe_cb) + + int hns_ppe_get_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return ETH_PPE_STATIC_NUM; + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +index 6f3570cfb501..e2e28532e4dc 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_rcb.c +@@ -876,7 +876,7 @@ void hns_rcb_get_stats(struct hnae_queue *queue, u64 *data) + */ + int hns_rcb_get_ring_sset_count(int stringset) + { +- if (stringset == ETH_SS_STATS || stringset == ETH_SS_PRIV_FLAGS) ++ if (stringset == ETH_SS_STATS) + return HNS_RING_STATIC_REG_NUM; + + return 0; +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +index 7ea7f8a4aa2a..2e14a3ae1d8b 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ethtool.c +@@ -993,8 +993,10 @@ int hns_get_sset_count(struct net_device *netdev, int stringset) + cnt--; + + return cnt; +- } else { ++ } else if (stringset == ETH_SS_STATS) { + return (HNS_NET_STATS_CNT + ops->get_sset_count(h, stringset)); ++ } else { ++ return -EOPNOTSUPP; + } + } + +diff --git a/drivers/parport/parport_pc.c b/drivers/parport/parport_pc.c +index 489492b608cf..380916bff9e0 100644 +--- a/drivers/parport/parport_pc.c ++++ b/drivers/parport/parport_pc.c +@@ -2646,6 +2646,7 @@ enum parport_pc_pci_cards { + netmos_9901, + netmos_9865, + quatech_sppxp100, ++ wch_ch382l, + }; + + +@@ -2708,6 +2709,7 @@ static struct parport_pc_pci { + /* netmos_9901 */ { 1, { { 0, -1 }, } }, + /* netmos_9865 */ { 1, { { 0, -1 }, } }, + /* quatech_sppxp100 */ { 1, { { 0, 1 }, } }, ++ /* wch_ch382l */ { 1, { { 2, -1 }, } }, + }; + + static const struct pci_device_id parport_pc_pci_tbl[] = { +@@ -2797,6 +2799,8 @@ static const struct pci_device_id parport_pc_pci_tbl[] = { + /* Quatech SPPXP-100 Parallel port PCI ExpressCard */ + { PCI_VENDOR_ID_QUATECH, PCI_DEVICE_ID_QUATECH_SPPXP_100, + PCI_ANY_ID, PCI_ANY_ID, 0, 0, quatech_sppxp100 }, ++ /* WCH CH382L PCI-E single parallel port card */ ++ { 0x1c00, 0x3050, 0x1c00, 0x3050, 0, 0, wch_ch382l }, + { 0, } /* terminate list */ + }; + MODULE_DEVICE_TABLE(pci, parport_pc_pci_tbl); +diff --git a/drivers/phy/qualcomm/phy-qcom-ufs.c b/drivers/phy/qualcomm/phy-qcom-ufs.c +index 43865ef340e2..3afba145f2e6 100644 +--- a/drivers/phy/qualcomm/phy-qcom-ufs.c ++++ b/drivers/phy/qualcomm/phy-qcom-ufs.c +@@ -689,3 +689,8 @@ int ufs_qcom_phy_power_off(struct phy *generic_phy) + return 0; + } + EXPORT_SYMBOL_GPL(ufs_qcom_phy_power_off); ++ ++MODULE_AUTHOR("Yaniv Gardi "); ++MODULE_AUTHOR("Vivek Gautam "); ++MODULE_DESCRIPTION("Universal Flash Storage (UFS) QCOM PHY"); ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c +index 398347fedc47..2cac160993bb 100644 +--- a/drivers/staging/comedi/drivers/ni_mio_common.c ++++ b/drivers/staging/comedi/drivers/ni_mio_common.c +@@ -1284,6 +1284,8 @@ static void ack_a_interrupt(struct comedi_device *dev, unsigned short a_status) + ack |= NISTC_INTA_ACK_AI_START; + if (a_status & NISTC_AI_STATUS1_STOP) + ack |= NISTC_INTA_ACK_AI_STOP; ++ if (a_status & NISTC_AI_STATUS1_OVER) ++ ack |= NISTC_INTA_ACK_AI_ERR; + if (ack) + ni_stc_writew(dev, ack, NISTC_INTA_ACK_REG); + } +diff --git a/drivers/tty/serial/8250/8250_of.c b/drivers/tty/serial/8250/8250_of.c +index 951680640ad5..3613a6aabfb3 100644 +--- a/drivers/tty/serial/8250/8250_of.c ++++ b/drivers/tty/serial/8250/8250_of.c +@@ -321,6 +321,7 @@ static const struct of_device_id of_platform_serial_table[] = { + { .compatible = "mrvl,mmp-uart", + .data = (void *)PORT_XSCALE, }, + { .compatible = "ti,da830-uart", .data = (void *)PORT_DA830, }, ++ { .compatible = "nuvoton,npcm750-uart", .data = (void *)PORT_NPCM, }, + { /* end of list */ }, + }; + MODULE_DEVICE_TABLE(of, of_platform_serial_table); +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index 8dcfd4978a03..fde34c84e707 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -51,6 +51,10 @@ + #define UART_EXAR_SLEEP 0x8b /* Sleep mode */ + #define UART_EXAR_DVID 0x8d /* Device identification */ + ++/* Nuvoton NPCM timeout register */ ++#define UART_NPCM_TOR 7 ++#define UART_NPCM_TOIE BIT(7) /* Timeout Interrupt Enable */ ++ + /* + * Debugging. + */ +@@ -297,6 +301,15 @@ static const struct serial8250_config uart_config[] = { + UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, + .flags = UART_CAP_FIFO, + }, ++ [PORT_NPCM] = { ++ .name = "Nuvoton 16550", ++ .fifo_size = 16, ++ .tx_loadsz = 16, ++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10 | ++ UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, ++ .rxtrig_bytes = {1, 4, 8, 14}, ++ .flags = UART_CAP_FIFO, ++ }, + }; + + /* Uart divisor latch read */ +@@ -2168,6 +2181,15 @@ int serial8250_do_startup(struct uart_port *port) + UART_DA830_PWREMU_MGMT_FREE); + } + ++ if (port->type == PORT_NPCM) { ++ /* ++ * Nuvoton calls the scratch register 'UART_TOR' (timeout ++ * register). Enable it, and set TIOC (timeout interrupt ++ * comparator) to be 0x20 for correct operation. ++ */ ++ serial_port_out(port, UART_NPCM_TOR, UART_NPCM_TOIE | 0x20); ++ } ++ + #ifdef CONFIG_SERIAL_8250_RSA + /* + * If this is an RSA port, see if we can kick it up to the +@@ -2490,6 +2512,15 @@ static unsigned int xr17v35x_get_divisor(struct uart_8250_port *up, + return quot_16 >> 4; + } + ++/* Nuvoton NPCM UARTs have a custom divisor calculation */ ++static unsigned int npcm_get_divisor(struct uart_8250_port *up, ++ unsigned int baud) ++{ ++ struct uart_port *port = &up->port; ++ ++ return DIV_ROUND_CLOSEST(port->uartclk, 16 * baud + 2) - 2; ++} ++ + static unsigned int serial8250_get_divisor(struct uart_8250_port *up, + unsigned int baud, + unsigned int *frac) +@@ -2510,6 +2541,8 @@ static unsigned int serial8250_get_divisor(struct uart_8250_port *up, + quot = 0x8002; + else if (up->port.type == PORT_XR17V35X) + quot = xr17v35x_get_divisor(up, baud, frac); ++ else if (up->port.type == PORT_NPCM) ++ quot = npcm_get_divisor(up, baud); + else + quot = uart_get_divisor(port, baud); + +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 5a5813d01cf8..de67abbda921 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -1352,6 +1352,11 @@ static void csi_m(struct vc_data *vc) + case 3: + vc->vc_italic = 1; + break; ++ case 21: ++ /* ++ * No console drivers support double underline, so ++ * convert it to a single underline. ++ */ + case 4: + vc->vc_underline = 1; + break; +@@ -1387,7 +1392,6 @@ static void csi_m(struct vc_data *vc) + vc->vc_disp_ctrl = 1; + vc->vc_toggle_meta = 1; + break; +- case 21: + case 22: + vc->vc_intensity = 1; + break; +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index c2631145f404..9bd60ec83ac6 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -3277,7 +3277,6 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + dwc2_core_init(hsotg, false); + dwc2_enable_global_interrupts(hsotg); + spin_lock_irqsave(&hsotg->lock, flags); +- dwc2_hsotg_disconnect(hsotg); + dwc2_hsotg_core_init_disconnected(hsotg, false); + spin_unlock_irqrestore(&hsotg->lock, flags); + dwc2_hsotg_core_connect(hsotg); +@@ -3296,8 +3295,12 @@ static void dwc2_conn_id_status_change(struct work_struct *work) + if (count > 250) + dev_err(hsotg->dev, + "Connection id status change timed out\n"); +- hsotg->op_state = OTG_STATE_A_HOST; + ++ spin_lock_irqsave(&hsotg->lock, flags); ++ dwc2_hsotg_disconnect(hsotg); ++ spin_unlock_irqrestore(&hsotg->lock, flags); ++ ++ hsotg->op_state = OTG_STATE_A_HOST; + /* Initialize the Core for Host mode */ + dwc2_core_init(hsotg, false); + dwc2_enable_global_interrupts(hsotg); +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index aed182d24d23..2836acf73a07 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -158,6 +158,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x12B8, 0xEC62) }, /* Link G4+ ECU */ + { USB_DEVICE(0x13AD, 0x9999) }, /* Baltech card reader */ + { USB_DEVICE(0x1555, 0x0004) }, /* Owen AC4 USB-RS485 Converter */ ++ { USB_DEVICE(0x155A, 0x1006) }, /* ELDAT Easywave RX09 */ + { USB_DEVICE(0x166A, 0x0201) }, /* Clipsal 5500PACA C-Bus Pascal Automation Controller */ + { USB_DEVICE(0x166A, 0x0301) }, /* Clipsal 5800PC C-Bus Wireless PC Interface */ + { USB_DEVICE(0x166A, 0x0303) }, /* Clipsal 5500PCU C-Bus USB interface */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index d038e543c246..a2a5232751cb 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -773,6 +773,7 @@ static const struct usb_device_id id_table_combined[] = { + .driver_info = (kernel_ulong_t)&ftdi_NDI_device_quirk }, + { USB_DEVICE(TELLDUS_VID, TELLDUS_TELLSTICK_PID) }, + { USB_DEVICE(NOVITUS_VID, NOVITUS_BONO_E_PID) }, ++ { USB_DEVICE(FTDI_VID, RTSYSTEMS_USB_VX8_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_S03_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_59_PID) }, + { USB_DEVICE(RTSYSTEMS_VID, RTSYSTEMS_USB_57A_PID) }, +@@ -935,6 +936,7 @@ static const struct usb_device_id id_table_combined[] = { + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_LS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_SCIENCESCOPE_HS_LOGBOOK_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_CINTERION_MC55I_PID) }, ++ { USB_DEVICE(FTDI_VID, FTDI_FHE_PID) }, + { USB_DEVICE(FTDI_VID, FTDI_DOTEC_PID) }, + { USB_DEVICE(QIHARDWARE_VID, MILKYMISTONE_JTAGSERIAL_PID), + .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h +index 8b4ecd2bd297..975d02666c5a 100644 +--- a/drivers/usb/serial/ftdi_sio_ids.h ++++ b/drivers/usb/serial/ftdi_sio_ids.h +@@ -923,6 +923,9 @@ + /* + * RT Systems programming cables for various ham radios + */ ++/* This device uses the VID of FTDI */ ++#define RTSYSTEMS_USB_VX8_PID 0x9e50 /* USB-VX8 USB to 7 pin modular plug for Yaesu VX-8 radio */ ++ + #define RTSYSTEMS_VID 0x2100 /* Vendor ID */ + #define RTSYSTEMS_USB_S03_PID 0x9001 /* RTS-03 USB to Serial Adapter */ + #define RTSYSTEMS_USB_59_PID 0x9e50 /* USB-59 USB to 8 pin plug */ +@@ -1441,6 +1444,12 @@ + */ + #define FTDI_CINTERION_MC55I_PID 0xA951 + ++/* ++ * Product: FirmwareHubEmulator ++ * Manufacturer: Harman Becker Automotive Systems ++ */ ++#define FTDI_FHE_PID 0xA9A0 ++ + /* + * Product: Comet Caller ID decoder + * Manufacturer: Crucible Technologies +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 59a01a0844c9..dfa360d18ae2 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1257,6 +1257,8 @@ static noinline int csum_exist_in_range(struct btrfs_fs_info *fs_info, + list_del(&sums->list); + kfree(sums); + } ++ if (ret < 0) ++ return ret; + return 1; + } + +@@ -1389,10 +1391,23 @@ static noinline int run_delalloc_nocow(struct inode *inode, + goto out_check; + if (btrfs_extent_readonly(fs_info, disk_bytenr)) + goto out_check; +- if (btrfs_cross_ref_exist(root, ino, +- found_key.offset - +- extent_offset, disk_bytenr)) ++ ret = btrfs_cross_ref_exist(root, ino, ++ found_key.offset - ++ extent_offset, disk_bytenr); ++ if (ret) { ++ /* ++ * ret could be -EIO if the above fails to read ++ * metadata. ++ */ ++ if (ret < 0) { ++ if (cow_start != (u64)-1) ++ cur_offset = cow_start; ++ goto error; ++ } ++ ++ WARN_ON_ONCE(nolock); + goto out_check; ++ } + disk_bytenr += extent_offset; + disk_bytenr += cur_offset - found_key.offset; + num_bytes = min(end + 1, extent_end) - cur_offset; +@@ -1410,10 +1425,22 @@ static noinline int run_delalloc_nocow(struct inode *inode, + * this ensure that csum for a given extent are + * either valid or do not exist. + */ +- if (csum_exist_in_range(fs_info, disk_bytenr, +- num_bytes)) { ++ ret = csum_exist_in_range(fs_info, disk_bytenr, ++ num_bytes); ++ if (ret) { + if (!nolock) + btrfs_end_write_no_snapshotting(root); ++ ++ /* ++ * ret could be -EIO if the above fails to read ++ * metadata. ++ */ ++ if (ret < 0) { ++ if (cow_start != (u64)-1) ++ cur_offset = cow_start; ++ goto error; ++ } ++ WARN_ON_ONCE(nolock); + goto out_check; + } + if (!btrfs_inc_nocow_writers(fs_info, disk_bytenr)) { +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 5c17125f45c7..0024d3e61bcd 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -635,7 +635,8 @@ static ssize_t ceph_sync_read(struct kiocb *iocb, struct iov_iter *to, + struct ceph_aio_request { + struct kiocb *iocb; + size_t total_len; +- int write; ++ bool write; ++ bool should_dirty; + int error; + struct list_head osd_reqs; + unsigned num_reqs; +@@ -745,7 +746,7 @@ static void ceph_aio_complete_req(struct ceph_osd_request *req) + } + } + +- ceph_put_page_vector(osd_data->pages, num_pages, !aio_req->write); ++ ceph_put_page_vector(osd_data->pages, num_pages, aio_req->should_dirty); + ceph_osdc_put_request(req); + + if (rc < 0) +@@ -842,6 +843,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + size_t count = iov_iter_count(iter); + loff_t pos = iocb->ki_pos; + bool write = iov_iter_rw(iter) == WRITE; ++ bool should_dirty = !write && iter_is_iovec(iter); + + if (write && ceph_snap(file_inode(file)) != CEPH_NOSNAP) + return -EROFS; +@@ -909,6 +911,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + if (aio_req) { + aio_req->iocb = iocb; + aio_req->write = write; ++ aio_req->should_dirty = should_dirty; + INIT_LIST_HEAD(&aio_req->osd_reqs); + if (write) { + aio_req->mtime = mtime; +@@ -966,7 +969,7 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + len = ret; + } + +- ceph_put_page_vector(pages, num_pages, !write); ++ ceph_put_page_vector(pages, num_pages, should_dirty); + + ceph_osdc_put_request(req); + if (ret < 0) +diff --git a/include/linux/bitmap.h b/include/linux/bitmap.h +index 19748a5b0e77..835c2271196a 100644 +--- a/include/linux/bitmap.h ++++ b/include/linux/bitmap.h +@@ -262,12 +262,20 @@ static inline void bitmap_complement(unsigned long *dst, const unsigned long *sr + __bitmap_complement(dst, src, nbits); + } + ++#ifdef __LITTLE_ENDIAN ++#define BITMAP_MEM_ALIGNMENT 8 ++#else ++#define BITMAP_MEM_ALIGNMENT (8 * sizeof(unsigned long)) ++#endif ++#define BITMAP_MEM_MASK (BITMAP_MEM_ALIGNMENT - 1) ++ + static inline int bitmap_equal(const unsigned long *src1, + const unsigned long *src2, unsigned int nbits) + { + if (small_const_nbits(nbits)) + return !((*src1 ^ *src2) & BITMAP_LAST_WORD_MASK(nbits)); +- if (__builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ if (__builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + return !memcmp(src1, src2, nbits / 8); + return __bitmap_equal(src1, src2, nbits); + } +@@ -318,8 +326,10 @@ static __always_inline void bitmap_set(unsigned long *map, unsigned int start, + { + if (__builtin_constant_p(nbits) && nbits == 1) + __set_bit(start, map); +- else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) && +- __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ else if (__builtin_constant_p(start & BITMAP_MEM_MASK) && ++ IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) && ++ __builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + memset((char *)map + start / 8, 0xff, nbits / 8); + else + __bitmap_set(map, start, nbits); +@@ -330,8 +340,10 @@ static __always_inline void bitmap_clear(unsigned long *map, unsigned int start, + { + if (__builtin_constant_p(nbits) && nbits == 1) + __clear_bit(start, map); +- else if (__builtin_constant_p(start & 7) && IS_ALIGNED(start, 8) && +- __builtin_constant_p(nbits & 7) && IS_ALIGNED(nbits, 8)) ++ else if (__builtin_constant_p(start & BITMAP_MEM_MASK) && ++ IS_ALIGNED(start, BITMAP_MEM_ALIGNMENT) && ++ __builtin_constant_p(nbits & BITMAP_MEM_MASK) && ++ IS_ALIGNED(nbits, BITMAP_MEM_ALIGNMENT)) + memset((char *)map + start / 8, 0, nbits / 8); + else + __bitmap_clear(map, start, nbits); +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 33f7530f96b9..8e46c35d654b 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -285,6 +285,8 @@ unsigned int *xt_alloc_entry_offsets(unsigned int size); + bool xt_find_jump_offset(const unsigned int *offsets, + unsigned int target, unsigned int size); + ++int xt_check_proc_name(const char *name, unsigned int size); ++ + int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto, + bool inv_proto); + int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto, +diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h +index b2a10c762304..bec461bd6472 100644 +--- a/include/rdma/ib_addr.h ++++ b/include/rdma/ib_addr.h +@@ -129,6 +129,8 @@ int rdma_copy_addr(struct rdma_dev_addr *dev_addr, struct net_device *dev, + const unsigned char *dst_dev_addr); + + int rdma_addr_size(struct sockaddr *addr); ++int rdma_addr_size_in6(struct sockaddr_in6 *addr); ++int rdma_addr_size_kss(struct __kernel_sockaddr_storage *addr); + + int rdma_addr_find_smac_by_sgid(union ib_gid *sgid, u8 *smac, u16 *vlan_id); + int rdma_addr_find_l2_eth_by_grh(const union ib_gid *sgid, +diff --git a/include/uapi/linux/serial_core.h b/include/uapi/linux/serial_core.h +index 1c8413f93e3d..dce5f9dae121 100644 +--- a/include/uapi/linux/serial_core.h ++++ b/include/uapi/linux/serial_core.h +@@ -76,6 +76,9 @@ + #define PORT_SUNZILOG 38 + #define PORT_SUNSAB 39 + ++/* Nuvoton UART */ ++#define PORT_NPCM 40 ++ + /* Intel EG20 */ + #define PORT_PCH_8LINE 44 + #define PORT_PCH_2LINE 45 +diff --git a/ipc/shm.c b/ipc/shm.c +index bd652755d32c..b469e910f887 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -386,6 +386,17 @@ static int shm_fault(struct vm_fault *vmf) + return sfd->vm_ops->fault(vmf); + } + ++static int shm_split(struct vm_area_struct *vma, unsigned long addr) ++{ ++ struct file *file = vma->vm_file; ++ struct shm_file_data *sfd = shm_file_data(file); ++ ++ if (sfd->vm_ops && sfd->vm_ops->split) ++ return sfd->vm_ops->split(vma, addr); ++ ++ return 0; ++} ++ + #ifdef CONFIG_NUMA + static int shm_set_policy(struct vm_area_struct *vma, struct mempolicy *new) + { +@@ -510,6 +521,7 @@ static const struct vm_operations_struct shm_vm_ops = { + .open = shm_open, /* callback for a new vm-area open */ + .close = shm_close, /* callback for when the vm-area is released */ + .fault = shm_fault, ++ .split = shm_split, + #if defined(CONFIG_NUMA) + .set_policy = shm_set_policy, + .get_policy = shm_get_policy, +diff --git a/kernel/events/hw_breakpoint.c b/kernel/events/hw_breakpoint.c +index 3f8cb1e14588..253ae2da13c3 100644 +--- a/kernel/events/hw_breakpoint.c ++++ b/kernel/events/hw_breakpoint.c +@@ -427,16 +427,9 @@ EXPORT_SYMBOL_GPL(register_user_hw_breakpoint); + * modify_user_hw_breakpoint - modify a user-space hardware breakpoint + * @bp: the breakpoint structure to modify + * @attr: new breakpoint attributes +- * @triggered: callback to trigger when we hit the breakpoint +- * @tsk: pointer to 'task_struct' of the process to which the address belongs + */ + int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *attr) + { +- u64 old_addr = bp->attr.bp_addr; +- u64 old_len = bp->attr.bp_len; +- int old_type = bp->attr.bp_type; +- int err = 0; +- + /* + * modify_user_hw_breakpoint can be invoked with IRQs disabled and hence it + * will not be possible to raise IPIs that invoke __perf_event_disable. +@@ -451,27 +444,18 @@ int modify_user_hw_breakpoint(struct perf_event *bp, struct perf_event_attr *att + bp->attr.bp_addr = attr->bp_addr; + bp->attr.bp_type = attr->bp_type; + bp->attr.bp_len = attr->bp_len; ++ bp->attr.disabled = 1; + +- if (attr->disabled) +- goto end; +- +- err = validate_hw_breakpoint(bp); +- if (!err) +- perf_event_enable(bp); ++ if (!attr->disabled) { ++ int err = validate_hw_breakpoint(bp); + +- if (err) { +- bp->attr.bp_addr = old_addr; +- bp->attr.bp_type = old_type; +- bp->attr.bp_len = old_len; +- if (!bp->attr.disabled) +- perf_event_enable(bp); ++ if (err) ++ return err; + +- return err; ++ perf_event_enable(bp); ++ bp->attr.disabled = 0; + } + +-end: +- bp->attr.disabled = attr->disabled; +- + return 0; + } + EXPORT_SYMBOL_GPL(modify_user_hw_breakpoint); +diff --git a/mm/percpu-km.c b/mm/percpu-km.c +index d2a76642c4ae..0d88d7bd5706 100644 +--- a/mm/percpu-km.c ++++ b/mm/percpu-km.c +@@ -34,7 +34,7 @@ + #include + + static int pcpu_populate_chunk(struct pcpu_chunk *chunk, +- int page_start, int page_end) ++ int page_start, int page_end, gfp_t gfp) + { + return 0; + } +@@ -45,18 +45,18 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, + /* nada */ + } + +-static struct pcpu_chunk *pcpu_create_chunk(void) ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + { + const int nr_pages = pcpu_group_sizes[0] >> PAGE_SHIFT; + struct pcpu_chunk *chunk; + struct page *pages; + int i; + +- chunk = pcpu_alloc_chunk(); ++ chunk = pcpu_alloc_chunk(gfp); + if (!chunk) + return NULL; + +- pages = alloc_pages(GFP_KERNEL, order_base_2(nr_pages)); ++ pages = alloc_pages(gfp | GFP_KERNEL, order_base_2(nr_pages)); + if (!pages) { + pcpu_free_chunk(chunk); + return NULL; +diff --git a/mm/percpu-vm.c b/mm/percpu-vm.c +index 15dab691ea70..f48ff9fc86fe 100644 +--- a/mm/percpu-vm.c ++++ b/mm/percpu-vm.c +@@ -37,7 +37,7 @@ static struct page **pcpu_get_pages(void) + lockdep_assert_held(&pcpu_alloc_mutex); + + if (!pages) +- pages = pcpu_mem_zalloc(pages_size); ++ pages = pcpu_mem_zalloc(pages_size, 0); + return pages; + } + +@@ -73,18 +73,21 @@ static void pcpu_free_pages(struct pcpu_chunk *chunk, + * @pages: array to put the allocated pages into, indexed by pcpu_page_idx() + * @page_start: page index of the first page to be allocated + * @page_end: page index of the last page to be allocated + 1 ++ * @gfp: allocation flags passed to the underlying allocator + * + * Allocate pages [@page_start,@page_end) into @pages for all units. + * The allocation is for @chunk. Percpu core doesn't care about the + * content of @pages and will pass it verbatim to pcpu_map_pages(). + */ + static int pcpu_alloc_pages(struct pcpu_chunk *chunk, +- struct page **pages, int page_start, int page_end) ++ struct page **pages, int page_start, int page_end, ++ gfp_t gfp) + { +- const gfp_t gfp = GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; + unsigned int cpu, tcpu; + int i; + ++ gfp |= GFP_KERNEL | __GFP_HIGHMEM | __GFP_COLD; ++ + for_each_possible_cpu(cpu) { + for (i = page_start; i < page_end; i++) { + struct page **pagep = &pages[pcpu_page_idx(cpu, i)]; +@@ -262,6 +265,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk, + * @chunk: chunk of interest + * @page_start: the start page + * @page_end: the end page ++ * @gfp: allocation flags passed to the underlying memory allocator + * + * For each cpu, populate and map pages [@page_start,@page_end) into + * @chunk. +@@ -270,7 +274,7 @@ static void pcpu_post_map_flush(struct pcpu_chunk *chunk, + * pcpu_alloc_mutex, does GFP_KERNEL allocation. + */ + static int pcpu_populate_chunk(struct pcpu_chunk *chunk, +- int page_start, int page_end) ++ int page_start, int page_end, gfp_t gfp) + { + struct page **pages; + +@@ -278,7 +282,7 @@ static int pcpu_populate_chunk(struct pcpu_chunk *chunk, + if (!pages) + return -ENOMEM; + +- if (pcpu_alloc_pages(chunk, pages, page_start, page_end)) ++ if (pcpu_alloc_pages(chunk, pages, page_start, page_end, gfp)) + return -ENOMEM; + + if (pcpu_map_pages(chunk, pages, page_start, page_end)) { +@@ -325,12 +329,12 @@ static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, + pcpu_free_pages(chunk, pages, page_start, page_end); + } + +-static struct pcpu_chunk *pcpu_create_chunk(void) ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp) + { + struct pcpu_chunk *chunk; + struct vm_struct **vms; + +- chunk = pcpu_alloc_chunk(); ++ chunk = pcpu_alloc_chunk(gfp); + if (!chunk) + return NULL; + +diff --git a/mm/percpu.c b/mm/percpu.c +index a0e0c82c1e4c..c80e796bf35c 100644 +--- a/mm/percpu.c ++++ b/mm/percpu.c +@@ -447,10 +447,12 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits, + /** + * pcpu_mem_zalloc - allocate memory + * @size: bytes to allocate ++ * @gfp: allocation flags + * + * Allocate @size bytes. If @size is smaller than PAGE_SIZE, +- * kzalloc() is used; otherwise, vzalloc() is used. The returned +- * memory is always zeroed. ++ * kzalloc() is used; otherwise, the equivalent of vzalloc() is used. ++ * This is to facilitate passing through whitelisted flags. The ++ * returned memory is always zeroed. + * + * CONTEXT: + * Does GFP_KERNEL allocation. +@@ -458,15 +460,16 @@ static void pcpu_next_fit_region(struct pcpu_chunk *chunk, int alloc_bits, + * RETURNS: + * Pointer to the allocated area on success, NULL on failure. + */ +-static void *pcpu_mem_zalloc(size_t size) ++static void *pcpu_mem_zalloc(size_t size, gfp_t gfp) + { + if (WARN_ON_ONCE(!slab_is_available())) + return NULL; + + if (size <= PAGE_SIZE) +- return kzalloc(size, GFP_KERNEL); ++ return kzalloc(size, gfp | GFP_KERNEL); + else +- return vzalloc(size); ++ return __vmalloc(size, gfp | GFP_KERNEL | __GFP_ZERO, ++ PAGE_KERNEL); + } + + /** +@@ -1154,12 +1157,12 @@ static struct pcpu_chunk * __init pcpu_alloc_first_chunk(unsigned long tmp_addr, + return chunk; + } + +-static struct pcpu_chunk *pcpu_alloc_chunk(void) ++static struct pcpu_chunk *pcpu_alloc_chunk(gfp_t gfp) + { + struct pcpu_chunk *chunk; + int region_bits; + +- chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size); ++ chunk = pcpu_mem_zalloc(pcpu_chunk_struct_size, gfp); + if (!chunk) + return NULL; + +@@ -1168,17 +1171,17 @@ static struct pcpu_chunk *pcpu_alloc_chunk(void) + region_bits = pcpu_chunk_map_bits(chunk); + + chunk->alloc_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits) * +- sizeof(chunk->alloc_map[0])); ++ sizeof(chunk->alloc_map[0]), gfp); + if (!chunk->alloc_map) + goto alloc_map_fail; + + chunk->bound_map = pcpu_mem_zalloc(BITS_TO_LONGS(region_bits + 1) * +- sizeof(chunk->bound_map[0])); ++ sizeof(chunk->bound_map[0]), gfp); + if (!chunk->bound_map) + goto bound_map_fail; + + chunk->md_blocks = pcpu_mem_zalloc(pcpu_chunk_nr_blocks(chunk) * +- sizeof(chunk->md_blocks[0])); ++ sizeof(chunk->md_blocks[0]), gfp); + if (!chunk->md_blocks) + goto md_blocks_fail; + +@@ -1277,9 +1280,10 @@ static void pcpu_chunk_depopulated(struct pcpu_chunk *chunk, + * pcpu_addr_to_page - translate address to physical address + * pcpu_verify_alloc_info - check alloc_info is acceptable during init + */ +-static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size); ++static int pcpu_populate_chunk(struct pcpu_chunk *chunk, int off, int size, ++ gfp_t gfp); + static void pcpu_depopulate_chunk(struct pcpu_chunk *chunk, int off, int size); +-static struct pcpu_chunk *pcpu_create_chunk(void); ++static struct pcpu_chunk *pcpu_create_chunk(gfp_t gfp); + static void pcpu_destroy_chunk(struct pcpu_chunk *chunk); + static struct page *pcpu_addr_to_page(void *addr); + static int __init pcpu_verify_alloc_info(const struct pcpu_alloc_info *ai); +@@ -1421,7 +1425,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, + } + + if (list_empty(&pcpu_slot[pcpu_nr_slots - 1])) { +- chunk = pcpu_create_chunk(); ++ chunk = pcpu_create_chunk(0); + if (!chunk) { + err = "failed to allocate new chunk"; + goto fail; +@@ -1450,7 +1454,7 @@ static void __percpu *pcpu_alloc(size_t size, size_t align, bool reserved, + page_start, page_end) { + WARN_ON(chunk->immutable); + +- ret = pcpu_populate_chunk(chunk, rs, re); ++ ret = pcpu_populate_chunk(chunk, rs, re, 0); + + spin_lock_irqsave(&pcpu_lock, flags); + if (ret) { +@@ -1561,10 +1565,17 @@ void __percpu *__alloc_reserved_percpu(size_t size, size_t align) + * pcpu_balance_workfn - manage the amount of free chunks and populated pages + * @work: unused + * +- * Reclaim all fully free chunks except for the first one. ++ * Reclaim all fully free chunks except for the first one. This is also ++ * responsible for maintaining the pool of empty populated pages. However, ++ * it is possible that this is called when physical memory is scarce causing ++ * OOM killer to be triggered. We should avoid doing so until an actual ++ * allocation causes the failure as it is possible that requests can be ++ * serviced from already backed regions. + */ + static void pcpu_balance_workfn(struct work_struct *work) + { ++ /* gfp flags passed to underlying allocators */ ++ const gfp_t gfp = __GFP_NORETRY | __GFP_NOWARN; + LIST_HEAD(to_free); + struct list_head *free_head = &pcpu_slot[pcpu_nr_slots - 1]; + struct pcpu_chunk *chunk, *next; +@@ -1645,7 +1656,7 @@ static void pcpu_balance_workfn(struct work_struct *work) + chunk->nr_pages) { + int nr = min(re - rs, nr_to_pop); + +- ret = pcpu_populate_chunk(chunk, rs, rs + nr); ++ ret = pcpu_populate_chunk(chunk, rs, rs + nr, gfp); + if (!ret) { + nr_to_pop -= nr; + spin_lock_irq(&pcpu_lock); +@@ -1662,7 +1673,7 @@ static void pcpu_balance_workfn(struct work_struct *work) + + if (nr_to_pop) { + /* ran out of chunks to populate, create a new one and retry */ +- chunk = pcpu_create_chunk(); ++ chunk = pcpu_create_chunk(gfp); + if (chunk) { + spin_lock_irq(&pcpu_lock); + pcpu_chunk_relocate(chunk, -1); +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index a0ef89772c36..a27704ff13a9 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -2287,8 +2287,14 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb) + else + sec_level = authreq_to_seclevel(auth); + +- if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) ++ if (smp_sufficient_security(hcon, sec_level, SMP_USE_LTK)) { ++ /* If link is already encrypted with sufficient security we ++ * still need refresh encryption as per Core Spec 5.0 Vol 3, ++ * Part H 2.4.6 ++ */ ++ smp_ltk_encrypt(conn, hcon->sec_level); + return 0; ++ } + + if (sec_level > hcon->pending_sec_level) + hcon->pending_sec_level = sec_level; +diff --git a/net/bridge/netfilter/ebt_among.c b/net/bridge/netfilter/ebt_among.c +index 59baaecd3e54..0b589a6b365c 100644 +--- a/net/bridge/netfilter/ebt_among.c ++++ b/net/bridge/netfilter/ebt_among.c +@@ -177,6 +177,28 @@ static bool poolsize_invalid(const struct ebt_mac_wormhash *w) + return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple)); + } + ++static bool wormhash_offset_invalid(int off, unsigned int len) ++{ ++ if (off == 0) /* not present */ ++ return false; ++ ++ if (off < (int)sizeof(struct ebt_among_info) || ++ off % __alignof__(struct ebt_mac_wormhash)) ++ return true; ++ ++ off += sizeof(struct ebt_mac_wormhash); ++ ++ return off > len; ++} ++ ++static bool wormhash_sizes_valid(const struct ebt_mac_wormhash *wh, int a, int b) ++{ ++ if (a == 0) ++ a = sizeof(struct ebt_among_info); ++ ++ return ebt_mac_wormhash_size(wh) + a == b; ++} ++ + static int ebt_among_mt_check(const struct xt_mtchk_param *par) + { + const struct ebt_among_info *info = par->matchinfo; +@@ -189,6 +211,10 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (expected_length > em->match_size) + return -EINVAL; + ++ if (wormhash_offset_invalid(info->wh_dst_ofs, em->match_size) || ++ wormhash_offset_invalid(info->wh_src_ofs, em->match_size)) ++ return -EINVAL; ++ + wh_dst = ebt_among_wh_dst(info); + if (poolsize_invalid(wh_dst)) + return -EINVAL; +@@ -201,6 +227,14 @@ static int ebt_among_mt_check(const struct xt_mtchk_param *par) + if (poolsize_invalid(wh_src)) + return -EINVAL; + ++ if (info->wh_src_ofs < info->wh_dst_ofs) { ++ if (!wormhash_sizes_valid(wh_src, info->wh_src_ofs, info->wh_dst_ofs)) ++ return -EINVAL; ++ } else { ++ if (!wormhash_sizes_valid(wh_dst, info->wh_dst_ofs, info->wh_src_ofs)) ++ return -EINVAL; ++ } ++ + expected_length += ebt_mac_wormhash_size(wh_src); + + if (em->match_size != EBT_ALIGN(expected_length)) { +diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +index 997a96896f1a..37fef48c8826 100644 +--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -159,8 +159,20 @@ static unsigned int ipv4_conntrack_local(void *priv, + ip_hdrlen(skb) < sizeof(struct iphdr)) + return NF_ACCEPT; + +- if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */ ++ if (ip_is_fragment(ip_hdr(skb))) { /* IP_NODEFRAG setsockopt set */ ++ enum ip_conntrack_info ctinfo; ++ struct nf_conn *tmpl; ++ ++ tmpl = nf_ct_get(skb, &ctinfo); ++ if (tmpl && nf_ct_is_template(tmpl)) { ++ /* when skipping ct, clear templates to avoid fooling ++ * later targets/matches ++ */ ++ skb->_nfct = 0; ++ nf_ct_put(tmpl); ++ } + return NF_ACCEPT; ++ } + + return nf_conntrack_in(state->net, PF_INET, state->hook, skb); + } +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 413f01be0c9b..bcdc2d557de1 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -626,7 +626,6 @@ static void vti6_link_config(struct ip6_tnl *t) + { + struct net_device *dev = t->dev; + struct __ip6_tnl_parm *p = &t->parms; +- struct net_device *tdev = NULL; + + memcpy(dev->dev_addr, &p->laddr, sizeof(struct in6_addr)); + memcpy(dev->broadcast, &p->raddr, sizeof(struct in6_addr)); +@@ -639,25 +638,6 @@ static void vti6_link_config(struct ip6_tnl *t) + dev->flags |= IFF_POINTOPOINT; + else + dev->flags &= ~IFF_POINTOPOINT; +- +- if (p->flags & IP6_TNL_F_CAP_XMIT) { +- int strict = (ipv6_addr_type(&p->raddr) & +- (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL)); +- struct rt6_info *rt = rt6_lookup(t->net, +- &p->raddr, &p->laddr, +- p->link, strict); +- +- if (rt) +- tdev = rt->dst.dev; +- ip6_rt_put(rt); +- } +- +- if (!tdev && p->link) +- tdev = __dev_get_by_index(t->net, p->link); +- +- if (tdev) +- dev->mtu = max_t(int, tdev->mtu - dev->hard_header_len, +- IPV6_MIN_MTU); + } + + /** +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 490d7360222e..316869df91e8 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -113,6 +113,13 @@ struct l2tp_net { + spinlock_t l2tp_session_hlist_lock; + }; + ++#if IS_ENABLED(CONFIG_IPV6) ++static bool l2tp_sk_is_v6(struct sock *sk) ++{ ++ return sk->sk_family == PF_INET6 && ++ !ipv6_addr_v4mapped(&sk->sk_v6_daddr); ++} ++#endif + + static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk) + { +@@ -1130,7 +1137,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, + /* Queue the packet to IP for output */ + skb->ignore_df = 1; + #if IS_ENABLED(CONFIG_IPV6) +- if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped) ++ if (l2tp_sk_is_v6(tunnel->sock)) + error = inet6_csk_xmit(tunnel->sock, skb, NULL); + else + #endif +@@ -1193,6 +1200,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + goto out_unlock; + } + ++ /* The user-space may change the connection status for the user-space ++ * provided socket at run time: we must check it under the socket lock ++ */ ++ if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) { ++ kfree_skb(skb); ++ ret = NET_XMIT_DROP; ++ goto out_unlock; ++ } ++ + /* Get routing info from the tunnel socket */ + skb_dst_drop(skb); + skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0))); +@@ -1212,7 +1228,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + + /* Calculate UDP checksum if configured to do so */ + #if IS_ENABLED(CONFIG_IPV6) +- if (sk->sk_family == PF_INET6 && !tunnel->v4mapped) ++ if (l2tp_sk_is_v6(sk)) + udp6_set_csum(udp_get_no_check6_tx(sk), + skb, &inet6_sk(sk)->saddr, + &sk->sk_v6_daddr, udp_len); +@@ -1616,24 +1632,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 + if (cfg != NULL) + tunnel->debug = cfg->debug; + +-#if IS_ENABLED(CONFIG_IPV6) +- if (sk->sk_family == PF_INET6) { +- struct ipv6_pinfo *np = inet6_sk(sk); +- +- if (ipv6_addr_v4mapped(&np->saddr) && +- ipv6_addr_v4mapped(&sk->sk_v6_daddr)) { +- struct inet_sock *inet = inet_sk(sk); +- +- tunnel->v4mapped = true; +- inet->inet_saddr = np->saddr.s6_addr32[3]; +- inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3]; +- inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3]; +- } else { +- tunnel->v4mapped = false; +- } +- } +-#endif +- + /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ + tunnel->encap = encap; + if (encap == L2TP_ENCAPTYPE_UDP) { +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 67c79d9b5c6c..9e2f1fda1b03 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -195,9 +195,6 @@ struct l2tp_tunnel { + struct sock *sock; /* Parent socket */ + int fd; /* Parent fd, if tunnel socket + * was created by userspace */ +-#if IS_ENABLED(CONFIG_IPV6) +- bool v4mapped; +-#endif + + struct work_struct del_work; + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 60c92158a2cd..a450a1c8804b 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -423,6 +423,36 @@ textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto) + return buf; + } + ++/** ++ * xt_check_proc_name - check that name is suitable for /proc file creation ++ * ++ * @name: file name candidate ++ * @size: length of buffer ++ * ++ * some x_tables modules wish to create a file in /proc. ++ * This function makes sure that the name is suitable for this ++ * purpose, it checks that name is NUL terminated and isn't a 'special' ++ * name, like "..". ++ * ++ * returns negative number on error or 0 if name is useable. ++ */ ++int xt_check_proc_name(const char *name, unsigned int size) ++{ ++ if (name[0] == '\0') ++ return -EINVAL; ++ ++ if (strnlen(name, size) == size) ++ return -ENAMETOOLONG; ++ ++ if (strcmp(name, ".") == 0 || ++ strcmp(name, "..") == 0 || ++ strchr(name, '/')) ++ return -EINVAL; ++ ++ return 0; ++} ++EXPORT_SYMBOL(xt_check_proc_name); ++ + int xt_check_match(struct xt_mtchk_param *par, + unsigned int size, u_int8_t proto, bool inv_proto) + { +@@ -1008,7 +1038,12 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + if ((size >> PAGE_SHIFT) + 2 > totalram_pages) + return NULL; + +- info = kvmalloc(sz, GFP_KERNEL); ++ /* __GFP_NORETRY is not fully supported by kvmalloc but it should ++ * work reasonably well if sz is too large and bail out rather ++ * than shoot all processes down before realizing there is nothing ++ * more to reclaim. ++ */ ++ info = kvmalloc(sz, GFP_KERNEL | __GFP_NORETRY); + if (!info) + return NULL; + +diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c +index b8a3e740ffd4..0c034597b9b8 100644 +--- a/net/netfilter/xt_hashlimit.c ++++ b/net/netfilter/xt_hashlimit.c +@@ -915,8 +915,9 @@ static int hashlimit_mt_check_v1(const struct xt_mtchk_param *par) + struct hashlimit_cfg3 cfg = {}; + int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + ret = cfg_copy(&cfg, (void *)&info->cfg, 1); + +@@ -933,8 +934,9 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par) + struct hashlimit_cfg3 cfg = {}; + int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + ret = cfg_copy(&cfg, (void *)&info->cfg, 2); + +@@ -948,9 +950,11 @@ static int hashlimit_mt_check_v2(const struct xt_mtchk_param *par) + static int hashlimit_mt_check(const struct xt_mtchk_param *par) + { + struct xt_hashlimit_mtinfo3 *info = par->matchinfo; ++ int ret; + +- if (info->name[sizeof(info->name) - 1] != '\0') +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + return hashlimit_mt_check_common(par, &info->hinfo, &info->cfg, + info->name, 3); +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index 245fa350a7a8..cf96d230e5a3 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -361,9 +361,9 @@ static int recent_mt_check(const struct xt_mtchk_param *par, + info->hit_count, XT_RECENT_MAX_NSTAMPS - 1); + return -EINVAL; + } +- if (info->name[0] == '\0' || +- strnlen(info->name, XT_RECENT_NAME_LEN) == XT_RECENT_NAME_LEN) +- return -EINVAL; ++ ret = xt_check_proc_name(info->name, sizeof(info->name)); ++ if (ret) ++ return ret; + + if (ip_pkt_list_tot && info->hit_count < ip_pkt_list_tot) + nstamp_mask = roundup_pow_of_two(ip_pkt_list_tot) - 1; +diff --git a/net/xfrm/xfrm_ipcomp.c b/net/xfrm/xfrm_ipcomp.c +index ccfdc7115a83..a00ec715aa46 100644 +--- a/net/xfrm/xfrm_ipcomp.c ++++ b/net/xfrm/xfrm_ipcomp.c +@@ -283,7 +283,7 @@ static struct crypto_comp * __percpu *ipcomp_alloc_tfms(const char *alg_name) + struct crypto_comp *tfm; + + /* This can be any valid CPU ID so we don't need locking. */ +- tfm = __this_cpu_read(*pos->tfms); ++ tfm = this_cpu_read(*pos->tfms); + + if (!strcmp(crypto_comp_name(tfm), alg_name)) { + pos->users++; +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index bab20c626943..8f13fb57eab5 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -2050,6 +2050,11 @@ int xfrm_user_policy(struct sock *sk, int optname, u8 __user *optval, int optlen + struct xfrm_mgr *km; + struct xfrm_policy *pol = NULL; + ++#ifdef CONFIG_COMPAT ++ if (in_compat_syscall()) ++ return -EOPNOTSUPP; ++#endif ++ + if (!optval && !optlen) { + xfrm_sk_policy_insert(sk, XFRM_POLICY_IN, NULL); + xfrm_sk_policy_insert(sk, XFRM_POLICY_OUT, NULL); +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 0edf38d2afd9..dbfcfefd6d69 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -121,22 +121,17 @@ static inline int verify_replay(struct xfrm_usersa_info *p, + struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL]; + struct xfrm_replay_state_esn *rs; + +- if (p->flags & XFRM_STATE_ESN) { +- if (!rt) +- return -EINVAL; ++ if (!rt) ++ return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0; + +- rs = nla_data(rt); ++ rs = nla_data(rt); + +- if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) +- return -EINVAL; +- +- if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && +- nla_len(rt) != sizeof(*rs)) +- return -EINVAL; +- } ++ if (rs->bmp_len > XFRMA_REPLAY_ESN_MAX / sizeof(rs->bmp[0]) / 8) ++ return -EINVAL; + +- if (!rt) +- return 0; ++ if (nla_len(rt) < xfrm_replay_state_esn_len(rs) && ++ nla_len(rt) != sizeof(*rs)) ++ return -EINVAL; + + /* As only ESP and AH support ESN feature. */ + if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH)) +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index 012881461058..d6e9a18fd821 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -1326,7 +1326,7 @@ static ssize_t snd_pcm_oss_write2(struct snd_pcm_substream *substream, const cha + static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +@@ -1433,7 +1433,7 @@ static ssize_t snd_pcm_oss_read2(struct snd_pcm_substream *substream, char *buf, + static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __user *buf, size_t bytes) + { + size_t xfer = 0; +- ssize_t tmp; ++ ssize_t tmp = 0; + struct snd_pcm_runtime *runtime = substream->runtime; + + if (atomic_read(&substream->mmap_count)) +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 499f75b18e09..eba2bedcbc81 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -3424,7 +3424,7 @@ int snd_pcm_lib_default_mmap(struct snd_pcm_substream *substream, + area, + substream->runtime->dma_area, + substream->runtime->dma_addr, +- area->vm_end - area->vm_start); ++ substream->runtime->dma_bytes); + #endif /* CONFIG_X86 */ + /* mmap with fault handler */ + area->vm_ops = &snd_pcm_vm_ops_data_fault; +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index ed56cd307059..58f94f399efb 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1177,6 +1177,7 @@ static bool is_teac_dsd_dac(unsigned int id) + switch (id) { + case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */ + case USB_ID(0x0644, 0x8044): /* Esoteric D-05X */ ++ case USB_ID(0x0644, 0x804a): /* TEAC UD-301 */ + return true; + } + return false; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.33-34.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.33-34.patch new file mode 100644 index 000000000000..e16b6b377103 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.33-34.patch @@ -0,0 +1,5392 @@ +diff --git a/Makefile b/Makefile +index 00dd6af8eab4..a6906dfb112e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 33 ++SUBLEVEL = 34 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/ls1021a.dtsi b/arch/arm/boot/dts/ls1021a.dtsi +index 9319e1f0f1d8..379b4a03cfe2 100644 +--- a/arch/arm/boot/dts/ls1021a.dtsi ++++ b/arch/arm/boot/dts/ls1021a.dtsi +@@ -155,7 +155,7 @@ + }; + + esdhc: esdhc@1560000 { +- compatible = "fsl,esdhc"; ++ compatible = "fsl,ls1021a-esdhc", "fsl,esdhc"; + reg = <0x0 0x1560000 0x0 0x10000>; + interrupts = ; + clock-frequency = <0>; +diff --git a/arch/arm64/crypto/Makefile b/arch/arm64/crypto/Makefile +index 12fd81af1d1c..93dbf4889eb6 100644 +--- a/arch/arm64/crypto/Makefile ++++ b/arch/arm64/crypto/Makefile +@@ -24,7 +24,7 @@ obj-$(CONFIG_CRYPTO_CRC32_ARM64_CE) += crc32-ce.o + crc32-ce-y:= crc32-ce-core.o crc32-ce-glue.o + + obj-$(CONFIG_CRYPTO_AES_ARM64_CE) += aes-ce-cipher.o +-CFLAGS_aes-ce-cipher.o += -march=armv8-a+crypto ++aes-ce-cipher-y := aes-ce-core.o aes-ce-glue.o + + obj-$(CONFIG_CRYPTO_AES_ARM64_CE_CCM) += aes-ce-ccm.o + aes-ce-ccm-y := aes-ce-ccm-glue.o aes-ce-ccm-core.o +diff --git a/arch/arm64/crypto/aes-ce-cipher.c b/arch/arm64/crypto/aes-ce-cipher.c +deleted file mode 100644 +index 6a75cd75ed11..000000000000 +--- a/arch/arm64/crypto/aes-ce-cipher.c ++++ /dev/null +@@ -1,281 +0,0 @@ +-/* +- * aes-ce-cipher.c - core AES cipher using ARMv8 Crypto Extensions +- * +- * Copyright (C) 2013 - 2017 Linaro Ltd +- * +- * This program is free software; you can redistribute it and/or modify +- * it under the terms of the GNU General Public License version 2 as +- * published by the Free Software Foundation. +- */ +- +-#include +-#include +-#include +-#include +-#include +-#include +-#include +- +-#include "aes-ce-setkey.h" +- +-MODULE_DESCRIPTION("Synchronous AES cipher using ARMv8 Crypto Extensions"); +-MODULE_AUTHOR("Ard Biesheuvel "); +-MODULE_LICENSE("GPL v2"); +- +-asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); +-asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); +- +-struct aes_block { +- u8 b[AES_BLOCK_SIZE]; +-}; +- +-static int num_rounds(struct crypto_aes_ctx *ctx) +-{ +- /* +- * # of rounds specified by AES: +- * 128 bit key 10 rounds +- * 192 bit key 12 rounds +- * 256 bit key 14 rounds +- * => n byte key => 6 + (n/4) rounds +- */ +- return 6 + ctx->key_length / 4; +-} +- +-static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- struct aes_block *out = (struct aes_block *)dst; +- struct aes_block const *in = (struct aes_block *)src; +- void *dummy0; +- int dummy1; +- +- if (!may_use_simd()) { +- __aes_arm64_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); +- return; +- } +- +- kernel_neon_begin(); +- +- __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.4s}, [%[key]], #16 ;" +- " cmp %w[rounds], #10 ;" +- " bmi 0f ;" +- " bne 3f ;" +- " mov v3.16b, v1.16b ;" +- " b 2f ;" +- "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- "1: aese v0.16b, v2.16b ;" +- " aesmc v0.16b, v0.16b ;" +- "2: ld1 {v1.4s}, [%[key]], #16 ;" +- " aese v0.16b, v3.16b ;" +- " aesmc v0.16b, v0.16b ;" +- "3: ld1 {v2.4s}, [%[key]], #16 ;" +- " subs %w[rounds], %w[rounds], #3 ;" +- " aese v0.16b, v1.16b ;" +- " aesmc v0.16b, v0.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- " bpl 1b ;" +- " aese v0.16b, v2.16b ;" +- " eor v0.16b, v0.16b, v3.16b ;" +- " st1 {v0.16b}, %[out] ;" +- +- : [out] "=Q"(*out), +- [key] "=r"(dummy0), +- [rounds] "=r"(dummy1) +- : [in] "Q"(*in), +- "1"(ctx->key_enc), +- "2"(num_rounds(ctx) - 2) +- : "cc"); +- +- kernel_neon_end(); +-} +- +-static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- struct aes_block *out = (struct aes_block *)dst; +- struct aes_block const *in = (struct aes_block *)src; +- void *dummy0; +- int dummy1; +- +- if (!may_use_simd()) { +- __aes_arm64_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); +- return; +- } +- +- kernel_neon_begin(); +- +- __asm__(" ld1 {v0.16b}, %[in] ;" +- " ld1 {v1.4s}, [%[key]], #16 ;" +- " cmp %w[rounds], #10 ;" +- " bmi 0f ;" +- " bne 3f ;" +- " mov v3.16b, v1.16b ;" +- " b 2f ;" +- "0: mov v2.16b, v1.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- "1: aesd v0.16b, v2.16b ;" +- " aesimc v0.16b, v0.16b ;" +- "2: ld1 {v1.4s}, [%[key]], #16 ;" +- " aesd v0.16b, v3.16b ;" +- " aesimc v0.16b, v0.16b ;" +- "3: ld1 {v2.4s}, [%[key]], #16 ;" +- " subs %w[rounds], %w[rounds], #3 ;" +- " aesd v0.16b, v1.16b ;" +- " aesimc v0.16b, v0.16b ;" +- " ld1 {v3.4s}, [%[key]], #16 ;" +- " bpl 1b ;" +- " aesd v0.16b, v2.16b ;" +- " eor v0.16b, v0.16b, v3.16b ;" +- " st1 {v0.16b}, %[out] ;" +- +- : [out] "=Q"(*out), +- [key] "=r"(dummy0), +- [rounds] "=r"(dummy1) +- : [in] "Q"(*in), +- "1"(ctx->key_dec), +- "2"(num_rounds(ctx) - 2) +- : "cc"); +- +- kernel_neon_end(); +-} +- +-/* +- * aes_sub() - use the aese instruction to perform the AES sbox substitution +- * on each byte in 'input' +- */ +-static u32 aes_sub(u32 input) +-{ +- u32 ret; +- +- __asm__("dup v1.4s, %w[in] ;" +- "movi v0.16b, #0 ;" +- "aese v0.16b, v1.16b ;" +- "umov %w[out], v0.4s[0] ;" +- +- : [out] "=r"(ret) +- : [in] "r"(input) +- : "v0","v1"); +- +- return ret; +-} +- +-int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, +- unsigned int key_len) +-{ +- /* +- * The AES key schedule round constants +- */ +- static u8 const rcon[] = { +- 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, +- }; +- +- u32 kwords = key_len / sizeof(u32); +- struct aes_block *key_enc, *key_dec; +- int i, j; +- +- if (key_len != AES_KEYSIZE_128 && +- key_len != AES_KEYSIZE_192 && +- key_len != AES_KEYSIZE_256) +- return -EINVAL; +- +- ctx->key_length = key_len; +- for (i = 0; i < kwords; i++) +- ctx->key_enc[i] = get_unaligned_le32(in_key + i * sizeof(u32)); +- +- kernel_neon_begin(); +- for (i = 0; i < sizeof(rcon); i++) { +- u32 *rki = ctx->key_enc + (i * kwords); +- u32 *rko = rki + kwords; +- +- rko[0] = ror32(aes_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; +- rko[1] = rko[0] ^ rki[1]; +- rko[2] = rko[1] ^ rki[2]; +- rko[3] = rko[2] ^ rki[3]; +- +- if (key_len == AES_KEYSIZE_192) { +- if (i >= 7) +- break; +- rko[4] = rko[3] ^ rki[4]; +- rko[5] = rko[4] ^ rki[5]; +- } else if (key_len == AES_KEYSIZE_256) { +- if (i >= 6) +- break; +- rko[4] = aes_sub(rko[3]) ^ rki[4]; +- rko[5] = rko[4] ^ rki[5]; +- rko[6] = rko[5] ^ rki[6]; +- rko[7] = rko[6] ^ rki[7]; +- } +- } +- +- /* +- * Generate the decryption keys for the Equivalent Inverse Cipher. +- * This involves reversing the order of the round keys, and applying +- * the Inverse Mix Columns transformation on all but the first and +- * the last one. +- */ +- key_enc = (struct aes_block *)ctx->key_enc; +- key_dec = (struct aes_block *)ctx->key_dec; +- j = num_rounds(ctx); +- +- key_dec[0] = key_enc[j]; +- for (i = 1, j--; j > 0; i++, j--) +- __asm__("ld1 {v0.4s}, %[in] ;" +- "aesimc v1.16b, v0.16b ;" +- "st1 {v1.4s}, %[out] ;" +- +- : [out] "=Q"(key_dec[i]) +- : [in] "Q"(key_enc[j]) +- : "v0","v1"); +- key_dec[i] = key_enc[0]; +- +- kernel_neon_end(); +- return 0; +-} +-EXPORT_SYMBOL(ce_aes_expandkey); +- +-int ce_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, +- unsigned int key_len) +-{ +- struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); +- int ret; +- +- ret = ce_aes_expandkey(ctx, in_key, key_len); +- if (!ret) +- return 0; +- +- tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; +- return -EINVAL; +-} +-EXPORT_SYMBOL(ce_aes_setkey); +- +-static struct crypto_alg aes_alg = { +- .cra_name = "aes", +- .cra_driver_name = "aes-ce", +- .cra_priority = 250, +- .cra_flags = CRYPTO_ALG_TYPE_CIPHER, +- .cra_blocksize = AES_BLOCK_SIZE, +- .cra_ctxsize = sizeof(struct crypto_aes_ctx), +- .cra_module = THIS_MODULE, +- .cra_cipher = { +- .cia_min_keysize = AES_MIN_KEY_SIZE, +- .cia_max_keysize = AES_MAX_KEY_SIZE, +- .cia_setkey = ce_aes_setkey, +- .cia_encrypt = aes_cipher_encrypt, +- .cia_decrypt = aes_cipher_decrypt +- } +-}; +- +-static int __init aes_mod_init(void) +-{ +- return crypto_register_alg(&aes_alg); +-} +- +-static void __exit aes_mod_exit(void) +-{ +- crypto_unregister_alg(&aes_alg); +-} +- +-module_cpu_feature_match(AES, aes_mod_init); +-module_exit(aes_mod_exit); +diff --git a/arch/arm64/crypto/aes-ce-core.S b/arch/arm64/crypto/aes-ce-core.S +new file mode 100644 +index 000000000000..8efdfdade393 +--- /dev/null ++++ b/arch/arm64/crypto/aes-ce-core.S +@@ -0,0 +1,87 @@ ++/* ++ * Copyright (C) 2013 - 2017 Linaro Ltd ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#include ++#include ++ ++ .arch armv8-a+crypto ++ ++ENTRY(__aes_ce_encrypt) ++ sub w3, w3, #2 ++ ld1 {v0.16b}, [x2] ++ ld1 {v1.4s}, [x0], #16 ++ cmp w3, #10 ++ bmi 0f ++ bne 3f ++ mov v3.16b, v1.16b ++ b 2f ++0: mov v2.16b, v1.16b ++ ld1 {v3.4s}, [x0], #16 ++1: aese v0.16b, v2.16b ++ aesmc v0.16b, v0.16b ++2: ld1 {v1.4s}, [x0], #16 ++ aese v0.16b, v3.16b ++ aesmc v0.16b, v0.16b ++3: ld1 {v2.4s}, [x0], #16 ++ subs w3, w3, #3 ++ aese v0.16b, v1.16b ++ aesmc v0.16b, v0.16b ++ ld1 {v3.4s}, [x0], #16 ++ bpl 1b ++ aese v0.16b, v2.16b ++ eor v0.16b, v0.16b, v3.16b ++ st1 {v0.16b}, [x1] ++ ret ++ENDPROC(__aes_ce_encrypt) ++ ++ENTRY(__aes_ce_decrypt) ++ sub w3, w3, #2 ++ ld1 {v0.16b}, [x2] ++ ld1 {v1.4s}, [x0], #16 ++ cmp w3, #10 ++ bmi 0f ++ bne 3f ++ mov v3.16b, v1.16b ++ b 2f ++0: mov v2.16b, v1.16b ++ ld1 {v3.4s}, [x0], #16 ++1: aesd v0.16b, v2.16b ++ aesimc v0.16b, v0.16b ++2: ld1 {v1.4s}, [x0], #16 ++ aesd v0.16b, v3.16b ++ aesimc v0.16b, v0.16b ++3: ld1 {v2.4s}, [x0], #16 ++ subs w3, w3, #3 ++ aesd v0.16b, v1.16b ++ aesimc v0.16b, v0.16b ++ ld1 {v3.4s}, [x0], #16 ++ bpl 1b ++ aesd v0.16b, v2.16b ++ eor v0.16b, v0.16b, v3.16b ++ st1 {v0.16b}, [x1] ++ ret ++ENDPROC(__aes_ce_decrypt) ++ ++/* ++ * __aes_ce_sub() - use the aese instruction to perform the AES sbox ++ * substitution on each byte in 'input' ++ */ ++ENTRY(__aes_ce_sub) ++ dup v1.4s, w0 ++ movi v0.16b, #0 ++ aese v0.16b, v1.16b ++ umov w0, v0.s[0] ++ ret ++ENDPROC(__aes_ce_sub) ++ ++ENTRY(__aes_ce_invert) ++ ld1 {v0.4s}, [x1] ++ aesimc v1.16b, v0.16b ++ st1 {v1.4s}, [x0] ++ ret ++ENDPROC(__aes_ce_invert) +diff --git a/arch/arm64/crypto/aes-ce-glue.c b/arch/arm64/crypto/aes-ce-glue.c +new file mode 100644 +index 000000000000..e6b3227bbf57 +--- /dev/null ++++ b/arch/arm64/crypto/aes-ce-glue.c +@@ -0,0 +1,190 @@ ++/* ++ * aes-ce-cipher.c - core AES cipher using ARMv8 Crypto Extensions ++ * ++ * Copyright (C) 2013 - 2017 Linaro Ltd ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#include "aes-ce-setkey.h" ++ ++MODULE_DESCRIPTION("Synchronous AES cipher using ARMv8 Crypto Extensions"); ++MODULE_AUTHOR("Ard Biesheuvel "); ++MODULE_LICENSE("GPL v2"); ++ ++asmlinkage void __aes_arm64_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++asmlinkage void __aes_arm64_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++ ++struct aes_block { ++ u8 b[AES_BLOCK_SIZE]; ++}; ++ ++asmlinkage void __aes_ce_encrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++asmlinkage void __aes_ce_decrypt(u32 *rk, u8 *out, const u8 *in, int rounds); ++ ++asmlinkage u32 __aes_ce_sub(u32 l); ++asmlinkage void __aes_ce_invert(struct aes_block *out, ++ const struct aes_block *in); ++ ++static int num_rounds(struct crypto_aes_ctx *ctx) ++{ ++ /* ++ * # of rounds specified by AES: ++ * 128 bit key 10 rounds ++ * 192 bit key 12 rounds ++ * 256 bit key 14 rounds ++ * => n byte key => 6 + (n/4) rounds ++ */ ++ return 6 + ctx->key_length / 4; ++} ++ ++static void aes_cipher_encrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ ++ if (!may_use_simd()) { ++ __aes_arm64_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); ++ return; ++ } ++ ++ kernel_neon_begin(); ++ __aes_ce_encrypt(ctx->key_enc, dst, src, num_rounds(ctx)); ++ kernel_neon_end(); ++} ++ ++static void aes_cipher_decrypt(struct crypto_tfm *tfm, u8 dst[], u8 const src[]) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ ++ if (!may_use_simd()) { ++ __aes_arm64_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); ++ return; ++ } ++ ++ kernel_neon_begin(); ++ __aes_ce_decrypt(ctx->key_dec, dst, src, num_rounds(ctx)); ++ kernel_neon_end(); ++} ++ ++int ce_aes_expandkey(struct crypto_aes_ctx *ctx, const u8 *in_key, ++ unsigned int key_len) ++{ ++ /* ++ * The AES key schedule round constants ++ */ ++ static u8 const rcon[] = { ++ 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, ++ }; ++ ++ u32 kwords = key_len / sizeof(u32); ++ struct aes_block *key_enc, *key_dec; ++ int i, j; ++ ++ if (key_len != AES_KEYSIZE_128 && ++ key_len != AES_KEYSIZE_192 && ++ key_len != AES_KEYSIZE_256) ++ return -EINVAL; ++ ++ ctx->key_length = key_len; ++ for (i = 0; i < kwords; i++) ++ ctx->key_enc[i] = get_unaligned_le32(in_key + i * sizeof(u32)); ++ ++ kernel_neon_begin(); ++ for (i = 0; i < sizeof(rcon); i++) { ++ u32 *rki = ctx->key_enc + (i * kwords); ++ u32 *rko = rki + kwords; ++ ++ rko[0] = ror32(__aes_ce_sub(rki[kwords - 1]), 8) ^ rcon[i] ^ rki[0]; ++ rko[1] = rko[0] ^ rki[1]; ++ rko[2] = rko[1] ^ rki[2]; ++ rko[3] = rko[2] ^ rki[3]; ++ ++ if (key_len == AES_KEYSIZE_192) { ++ if (i >= 7) ++ break; ++ rko[4] = rko[3] ^ rki[4]; ++ rko[5] = rko[4] ^ rki[5]; ++ } else if (key_len == AES_KEYSIZE_256) { ++ if (i >= 6) ++ break; ++ rko[4] = __aes_ce_sub(rko[3]) ^ rki[4]; ++ rko[5] = rko[4] ^ rki[5]; ++ rko[6] = rko[5] ^ rki[6]; ++ rko[7] = rko[6] ^ rki[7]; ++ } ++ } ++ ++ /* ++ * Generate the decryption keys for the Equivalent Inverse Cipher. ++ * This involves reversing the order of the round keys, and applying ++ * the Inverse Mix Columns transformation on all but the first and ++ * the last one. ++ */ ++ key_enc = (struct aes_block *)ctx->key_enc; ++ key_dec = (struct aes_block *)ctx->key_dec; ++ j = num_rounds(ctx); ++ ++ key_dec[0] = key_enc[j]; ++ for (i = 1, j--; j > 0; i++, j--) ++ __aes_ce_invert(key_dec + i, key_enc + j); ++ key_dec[i] = key_enc[0]; ++ ++ kernel_neon_end(); ++ return 0; ++} ++EXPORT_SYMBOL(ce_aes_expandkey); ++ ++int ce_aes_setkey(struct crypto_tfm *tfm, const u8 *in_key, ++ unsigned int key_len) ++{ ++ struct crypto_aes_ctx *ctx = crypto_tfm_ctx(tfm); ++ int ret; ++ ++ ret = ce_aes_expandkey(ctx, in_key, key_len); ++ if (!ret) ++ return 0; ++ ++ tfm->crt_flags |= CRYPTO_TFM_RES_BAD_KEY_LEN; ++ return -EINVAL; ++} ++EXPORT_SYMBOL(ce_aes_setkey); ++ ++static struct crypto_alg aes_alg = { ++ .cra_name = "aes", ++ .cra_driver_name = "aes-ce", ++ .cra_priority = 250, ++ .cra_flags = CRYPTO_ALG_TYPE_CIPHER, ++ .cra_blocksize = AES_BLOCK_SIZE, ++ .cra_ctxsize = sizeof(struct crypto_aes_ctx), ++ .cra_module = THIS_MODULE, ++ .cra_cipher = { ++ .cia_min_keysize = AES_MIN_KEY_SIZE, ++ .cia_max_keysize = AES_MAX_KEY_SIZE, ++ .cia_setkey = ce_aes_setkey, ++ .cia_encrypt = aes_cipher_encrypt, ++ .cia_decrypt = aes_cipher_decrypt ++ } ++}; ++ ++static int __init aes_mod_init(void) ++{ ++ return crypto_register_alg(&aes_alg); ++} ++ ++static void __exit aes_mod_exit(void) ++{ ++ crypto_unregister_alg(&aes_alg); ++} ++ ++module_cpu_feature_match(AES, aes_mod_init); ++module_exit(aes_mod_exit); +diff --git a/arch/x86/include/asm/microcode.h b/arch/x86/include/asm/microcode.h +index 55520cec8b27..6cf0e4cb7b97 100644 +--- a/arch/x86/include/asm/microcode.h ++++ b/arch/x86/include/asm/microcode.h +@@ -37,7 +37,13 @@ struct cpu_signature { + + struct device; + +-enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND }; ++enum ucode_state { ++ UCODE_OK = 0, ++ UCODE_NEW, ++ UCODE_UPDATED, ++ UCODE_NFOUND, ++ UCODE_ERROR, ++}; + + struct microcode_ops { + enum ucode_state (*request_microcode_user) (int cpu, +@@ -54,7 +60,7 @@ struct microcode_ops { + * are being called. + * See also the "Synchronization" section in microcode_core.c. + */ +- int (*apply_microcode) (int cpu); ++ enum ucode_state (*apply_microcode) (int cpu); + int (*collect_cpu_info) (int cpu, struct cpu_signature *csig); + }; + +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 15fc074bd628..3222c7746cb1 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -968,4 +968,5 @@ bool xen_set_default_idle(void); + + void stop_this_cpu(void *dummy); + void df_debug(struct pt_regs *regs, long error_code); ++void microcode_check(void); + #endif /* _ASM_X86_PROCESSOR_H */ +diff --git a/arch/x86/kernel/aperture_64.c b/arch/x86/kernel/aperture_64.c +index f5d92bc3b884..2c4d5ece7456 100644 +--- a/arch/x86/kernel/aperture_64.c ++++ b/arch/x86/kernel/aperture_64.c +@@ -30,6 +30,7 @@ + #include + #include + #include ++#include + + /* + * Using 512M as goal, in case kexec will load kernel_big +@@ -56,6 +57,33 @@ int fallback_aper_force __initdata; + + int fix_aperture __initdata = 1; + ++#ifdef CONFIG_PROC_VMCORE ++/* ++ * If the first kernel maps the aperture over e820 RAM, the kdump kernel will ++ * use the same range because it will remain configured in the northbridge. ++ * Trying to dump this area via /proc/vmcore may crash the machine, so exclude ++ * it from vmcore. ++ */ ++static unsigned long aperture_pfn_start, aperture_page_count; ++ ++static int gart_oldmem_pfn_is_ram(unsigned long pfn) ++{ ++ return likely((pfn < aperture_pfn_start) || ++ (pfn >= aperture_pfn_start + aperture_page_count)); ++} ++ ++static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++{ ++ aperture_pfn_start = aper_base >> PAGE_SHIFT; ++ aperture_page_count = (32 * 1024 * 1024) << aper_order >> PAGE_SHIFT; ++ WARN_ON(register_oldmem_pfn_is_ram(&gart_oldmem_pfn_is_ram)); ++} ++#else ++static void exclude_from_vmcore(u64 aper_base, u32 aper_order) ++{ ++} ++#endif ++ + /* This code runs before the PCI subsystem is initialized, so just + access the northbridge directly. */ + +@@ -435,8 +463,16 @@ int __init gart_iommu_hole_init(void) + + out: + if (!fix && !fallback_aper_force) { +- if (last_aper_base) ++ if (last_aper_base) { ++ /* ++ * If this is the kdump kernel, the first kernel ++ * may have allocated the range over its e820 RAM ++ * and fixed up the northbridge ++ */ ++ exclude_from_vmcore(last_aper_base, last_aper_order); ++ + return 1; ++ } + return 0; + } + +@@ -473,6 +509,14 @@ int __init gart_iommu_hole_init(void) + return 0; + } + ++ /* ++ * If this is the kdump kernel _and_ the first kernel did not ++ * configure the aperture in the northbridge, this range may ++ * overlap with the first kernel's memory. We can't access the ++ * range through vmcore even though it should be part of the dump. ++ */ ++ exclude_from_vmcore(aper_alloc, aper_order); ++ + /* Fix up the north bridges */ + for (i = 0; i < amd_nb_bus_dev_ranges[i].dev_limit; i++) { + int bus, dev_base, dev_limit; +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 651b7afed4da..cf6380200dc2 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -1724,3 +1724,33 @@ static int __init init_cpu_syscore(void) + return 0; + } + core_initcall(init_cpu_syscore); ++ ++/* ++ * The microcode loader calls this upon late microcode load to recheck features, ++ * only when microcode has been updated. Caller holds microcode_mutex and CPU ++ * hotplug lock. ++ */ ++void microcode_check(void) ++{ ++ struct cpuinfo_x86 info; ++ ++ perf_check_microcode(); ++ ++ /* Reload CPUID max function as it might've changed. */ ++ info.cpuid_level = cpuid_eax(0); ++ ++ /* ++ * Copy all capability leafs to pick up the synthetic ones so that ++ * memcmp() below doesn't fail on that. The ones coming from CPUID will ++ * get overwritten in get_cpu_cap(). ++ */ ++ memcpy(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability)); ++ ++ get_cpu_cap(&info); ++ ++ if (!memcmp(&info.x86_capability, &boot_cpu_data.x86_capability, sizeof(info.x86_capability))) ++ return; ++ ++ pr_warn("x86/CPU: CPU features have changed after loading microcode, but might not take effect.\n"); ++ pr_warn("x86/CPU: Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); ++} +diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c +index 330b8462d426..48179928ff38 100644 +--- a/arch/x86/kernel/cpu/microcode/amd.c ++++ b/arch/x86/kernel/cpu/microcode/amd.c +@@ -339,7 +339,7 @@ int __init save_microcode_in_initrd_amd(unsigned int cpuid_1_eax) + return -EINVAL; + + ret = load_microcode_amd(true, x86_family(cpuid_1_eax), desc.data, desc.size); +- if (ret != UCODE_OK) ++ if (ret > UCODE_UPDATED) + return -EINVAL; + + return 0; +@@ -498,7 +498,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size, + return patch_size; + } + +-static int apply_microcode_amd(int cpu) ++static enum ucode_state apply_microcode_amd(int cpu) + { + struct cpuinfo_x86 *c = &cpu_data(cpu); + struct microcode_amd *mc_amd; +@@ -512,7 +512,7 @@ static int apply_microcode_amd(int cpu) + + p = find_patch(cpu); + if (!p) +- return 0; ++ return UCODE_NFOUND; + + mc_amd = p->data; + uci->mc = p->data; +@@ -523,13 +523,13 @@ static int apply_microcode_amd(int cpu) + if (rev >= mc_amd->hdr.patch_id) { + c->microcode = rev; + uci->cpu_sig.rev = rev; +- return 0; ++ return UCODE_OK; + } + + if (__apply_microcode_amd(mc_amd)) { + pr_err("CPU%d: update failed for patch_level=0x%08x\n", + cpu, mc_amd->hdr.patch_id); +- return -1; ++ return UCODE_ERROR; + } + pr_info("CPU%d: new patch_level=0x%08x\n", cpu, + mc_amd->hdr.patch_id); +@@ -537,7 +537,7 @@ static int apply_microcode_amd(int cpu) + uci->cpu_sig.rev = mc_amd->hdr.patch_id; + c->microcode = mc_amd->hdr.patch_id; + +- return 0; ++ return UCODE_UPDATED; + } + + static int install_equiv_cpu_table(const u8 *buf) +@@ -683,27 +683,35 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, + static enum ucode_state + load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) + { ++ struct ucode_patch *p; + enum ucode_state ret; + + /* free old equiv table */ + free_equiv_cpu_table(); + + ret = __load_microcode_amd(family, data, size); +- +- if (ret != UCODE_OK) ++ if (ret != UCODE_OK) { + cleanup(); ++ return ret; ++ } + +-#ifdef CONFIG_X86_32 +- /* save BSP's matching patch for early load */ +- if (save) { +- struct ucode_patch *p = find_patch(0); +- if (p) { +- memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); +- memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), +- PATCH_MAX_SIZE)); +- } ++ p = find_patch(0); ++ if (!p) { ++ return ret; ++ } else { ++ if (boot_cpu_data.microcode == p->patch_id) ++ return ret; ++ ++ ret = UCODE_NEW; + } +-#endif ++ ++ /* save BSP's matching patch for early load */ ++ if (!save) ++ return ret; ++ ++ memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); ++ memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), PATCH_MAX_SIZE)); ++ + return ret; + } + +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index e4fc595cd6ea..021c90464cc2 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -22,13 +22,16 @@ + #define pr_fmt(fmt) "microcode: " fmt + + #include ++#include + #include + #include + #include + #include + #include ++#include + #include + #include ++#include + #include + #include + +@@ -64,6 +67,11 @@ LIST_HEAD(microcode_cache); + */ + static DEFINE_MUTEX(microcode_mutex); + ++/* ++ * Serialize late loading so that CPUs get updated one-by-one. ++ */ ++static DEFINE_SPINLOCK(update_lock); ++ + struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; + + struct cpu_info_ctx { +@@ -373,26 +381,23 @@ static int collect_cpu_info(int cpu) + return ret; + } + +-struct apply_microcode_ctx { +- int err; +-}; +- + static void apply_microcode_local(void *arg) + { +- struct apply_microcode_ctx *ctx = arg; ++ enum ucode_state *err = arg; + +- ctx->err = microcode_ops->apply_microcode(smp_processor_id()); ++ *err = microcode_ops->apply_microcode(smp_processor_id()); + } + + static int apply_microcode_on_target(int cpu) + { +- struct apply_microcode_ctx ctx = { .err = 0 }; ++ enum ucode_state err; + int ret; + +- ret = smp_call_function_single(cpu, apply_microcode_local, &ctx, 1); +- if (!ret) +- ret = ctx.err; +- ++ ret = smp_call_function_single(cpu, apply_microcode_local, &err, 1); ++ if (!ret) { ++ if (err == UCODE_ERROR) ++ ret = 1; ++ } + return ret; + } + +@@ -489,31 +494,124 @@ static void __exit microcode_dev_exit(void) + /* fake device for request_firmware */ + static struct platform_device *microcode_pdev; + +-static int reload_for_cpu(int cpu) ++/* ++ * Late loading dance. Why the heavy-handed stomp_machine effort? ++ * ++ * - HT siblings must be idle and not execute other code while the other sibling ++ * is loading microcode in order to avoid any negative interactions caused by ++ * the loading. ++ * ++ * - In addition, microcode update on the cores must be serialized until this ++ * requirement can be relaxed in the future. Right now, this is conservative ++ * and good. ++ */ ++#define SPINUNIT 100 /* 100 nsec */ ++ ++static int check_online_cpus(void) + { +- struct ucode_cpu_info *uci = ucode_cpu_info + cpu; +- enum ucode_state ustate; +- int err = 0; ++ if (num_online_cpus() == num_present_cpus()) ++ return 0; + +- if (!uci->valid) +- return err; ++ pr_err("Not all CPUs online, aborting microcode update.\n"); + +- ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, true); +- if (ustate == UCODE_OK) +- apply_microcode_on_target(cpu); +- else +- if (ustate == UCODE_ERROR) +- err = -EINVAL; +- return err; ++ return -EINVAL; ++} ++ ++static atomic_t late_cpus_in; ++static atomic_t late_cpus_out; ++ ++static int __wait_for_cpus(atomic_t *t, long long timeout) ++{ ++ int all_cpus = num_online_cpus(); ++ ++ atomic_inc(t); ++ ++ while (atomic_read(t) < all_cpus) { ++ if (timeout < SPINUNIT) { ++ pr_err("Timeout while waiting for CPUs rendezvous, remaining: %d\n", ++ all_cpus - atomic_read(t)); ++ return 1; ++ } ++ ++ ndelay(SPINUNIT); ++ timeout -= SPINUNIT; ++ ++ touch_nmi_watchdog(); ++ } ++ return 0; ++} ++ ++/* ++ * Returns: ++ * < 0 - on error ++ * 0 - no update done ++ * 1 - microcode was updated ++ */ ++static int __reload_late(void *info) ++{ ++ int cpu = smp_processor_id(); ++ enum ucode_state err; ++ int ret = 0; ++ ++ /* ++ * Wait for all CPUs to arrive. A load will not be attempted unless all ++ * CPUs show up. ++ * */ ++ if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) ++ return -1; ++ ++ spin_lock(&update_lock); ++ apply_microcode_local(&err); ++ spin_unlock(&update_lock); ++ ++ if (err > UCODE_NFOUND) { ++ pr_warn("Error reloading microcode on CPU %d\n", cpu); ++ return -1; ++ /* siblings return UCODE_OK because their engine got updated already */ ++ } else if (err == UCODE_UPDATED || err == UCODE_OK) { ++ ret = 1; ++ } else { ++ return ret; ++ } ++ ++ /* ++ * Increase the wait timeout to a safe value here since we're ++ * serializing the microcode update and that could take a while on a ++ * large number of CPUs. And that is fine as the *actual* timeout will ++ * be determined by the last CPU finished updating and thus cut short. ++ */ ++ if (__wait_for_cpus(&late_cpus_out, NSEC_PER_SEC * num_online_cpus())) ++ panic("Timeout during microcode update!\n"); ++ ++ return ret; ++} ++ ++/* ++ * Reload microcode late on all CPUs. Wait for a sec until they ++ * all gather together. ++ */ ++static int microcode_reload_late(void) ++{ ++ int ret; ++ ++ atomic_set(&late_cpus_in, 0); ++ atomic_set(&late_cpus_out, 0); ++ ++ ret = stop_machine_cpuslocked(__reload_late, NULL, cpu_online_mask); ++ if (ret > 0) ++ microcode_check(); ++ ++ return ret; + } + + static ssize_t reload_store(struct device *dev, + struct device_attribute *attr, + const char *buf, size_t size) + { ++ enum ucode_state tmp_ret = UCODE_OK; ++ int bsp = boot_cpu_data.cpu_index; + unsigned long val; +- int cpu; +- ssize_t ret = 0, tmp_ret; ++ ssize_t ret = 0; + + ret = kstrtoul(buf, 0, &val); + if (ret) +@@ -522,23 +620,24 @@ static ssize_t reload_store(struct device *dev, + if (val != 1) + return size; + ++ tmp_ret = microcode_ops->request_microcode_fw(bsp, µcode_pdev->dev, true); ++ if (tmp_ret != UCODE_NEW) ++ return size; ++ + get_online_cpus(); +- mutex_lock(µcode_mutex); +- for_each_online_cpu(cpu) { +- tmp_ret = reload_for_cpu(cpu); +- if (tmp_ret != 0) +- pr_warn("Error reloading microcode on CPU %d\n", cpu); + +- /* save retval of the first encountered reload error */ +- if (!ret) +- ret = tmp_ret; +- } +- if (!ret) +- perf_check_microcode(); ++ ret = check_online_cpus(); ++ if (ret) ++ goto put; ++ ++ mutex_lock(µcode_mutex); ++ ret = microcode_reload_late(); + mutex_unlock(µcode_mutex); ++ ++put: + put_online_cpus(); + +- if (!ret) ++ if (ret >= 0) + ret = size; + + return ret; +@@ -606,10 +705,8 @@ static enum ucode_state microcode_init_cpu(int cpu, bool refresh_fw) + if (system_state != SYSTEM_RUNNING) + return UCODE_NFOUND; + +- ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, +- refresh_fw); +- +- if (ustate == UCODE_OK) { ++ ustate = microcode_ops->request_microcode_fw(cpu, µcode_pdev->dev, refresh_fw); ++ if (ustate == UCODE_NEW) { + pr_debug("CPU%d updated upon init\n", cpu); + apply_microcode_on_target(cpu); + } +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index a15db2b4e0d6..32b8e5724f96 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -589,6 +589,23 @@ static int apply_microcode_early(struct ucode_cpu_info *uci, bool early) + if (!mc) + return 0; + ++ /* ++ * Save us the MSR write below - which is a particular expensive ++ * operation - when the other hyperthread has updated the microcode ++ * already. ++ */ ++ rev = intel_get_microcode_revision(); ++ if (rev >= mc->hdr.rev) { ++ uci->cpu_sig.rev = rev; ++ return UCODE_OK; ++ } ++ ++ /* ++ * Writeback and invalidate caches before updating microcode to avoid ++ * internal issues depending on what the microcode is updating. ++ */ ++ native_wbinvd(); ++ + /* write microcode via MSR 0x79 */ + native_wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); + +@@ -772,27 +789,44 @@ static int collect_cpu_info(int cpu_num, struct cpu_signature *csig) + return 0; + } + +-static int apply_microcode_intel(int cpu) ++static enum ucode_state apply_microcode_intel(int cpu) + { ++ struct ucode_cpu_info *uci = ucode_cpu_info + cpu; ++ struct cpuinfo_x86 *c = &cpu_data(cpu); + struct microcode_intel *mc; +- struct ucode_cpu_info *uci; +- struct cpuinfo_x86 *c; + static int prev_rev; + u32 rev; + + /* We should bind the task to the CPU */ + if (WARN_ON(raw_smp_processor_id() != cpu)) +- return -1; ++ return UCODE_ERROR; + +- uci = ucode_cpu_info + cpu; +- mc = uci->mc; ++ /* Look for a newer patch in our cache: */ ++ mc = find_patch(uci); + if (!mc) { +- /* Look for a newer patch in our cache: */ +- mc = find_patch(uci); ++ mc = uci->mc; + if (!mc) +- return 0; ++ return UCODE_NFOUND; + } + ++ /* ++ * Save us the MSR write below - which is a particular expensive ++ * operation - when the other hyperthread has updated the microcode ++ * already. ++ */ ++ rev = intel_get_microcode_revision(); ++ if (rev >= mc->hdr.rev) { ++ uci->cpu_sig.rev = rev; ++ c->microcode = rev; ++ return UCODE_OK; ++ } ++ ++ /* ++ * Writeback and invalidate caches before updating microcode to avoid ++ * internal issues depending on what the microcode is updating. ++ */ ++ native_wbinvd(); ++ + /* write microcode via MSR 0x79 */ + wrmsrl(MSR_IA32_UCODE_WRITE, (unsigned long)mc->bits); + +@@ -801,7 +835,7 @@ static int apply_microcode_intel(int cpu) + if (rev != mc->hdr.rev) { + pr_err("CPU%d update to revision 0x%x failed\n", + cpu, mc->hdr.rev); +- return -1; ++ return UCODE_ERROR; + } + + if (rev != prev_rev) { +@@ -813,12 +847,10 @@ static int apply_microcode_intel(int cpu) + prev_rev = rev; + } + +- c = &cpu_data(cpu); +- + uci->cpu_sig.rev = rev; + c->microcode = rev; + +- return 0; ++ return UCODE_UPDATED; + } + + static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, +@@ -830,6 +862,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + unsigned int leftover = size; + unsigned int curr_mc_size = 0, new_mc_size = 0; + unsigned int csig, cpf; ++ enum ucode_state ret = UCODE_OK; + + while (leftover) { + struct microcode_header_intel mc_header; +@@ -871,6 +904,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + new_mc = mc; + new_mc_size = mc_size; + mc = NULL; /* trigger new vmalloc */ ++ ret = UCODE_NEW; + } + + ucode_ptr += mc_size; +@@ -900,7 +934,7 @@ static enum ucode_state generic_load_microcode(int cpu, void *data, size_t size, + pr_debug("CPU%d found a matching microcode update with version 0x%x (current=0x%x)\n", + cpu, new_rev, uci->cpu_sig.rev); + +- return UCODE_OK; ++ return ret; + } + + static int get_ucode_fw(void *to, const void *from, size_t n) +diff --git a/arch/x86/xen/mmu_hvm.c b/arch/x86/xen/mmu_hvm.c +index 2cfcfe4f6b2a..dd2ad82eee80 100644 +--- a/arch/x86/xen/mmu_hvm.c ++++ b/arch/x86/xen/mmu_hvm.c +@@ -75,6 +75,6 @@ void __init xen_hvm_init_mmu_ops(void) + if (is_pagetable_dying_supported()) + pv_mmu_ops.exit_mmap = xen_hvm_exit_mmap; + #ifdef CONFIG_PROC_VMCORE +- register_oldmem_pfn_is_ram(&xen_oldmem_pfn_is_ram); ++ WARN_ON(register_oldmem_pfn_is_ram(&xen_oldmem_pfn_is_ram)); + #endif + } +diff --git a/block/bfq-cgroup.c b/block/bfq-cgroup.c +index ceefb9a706d6..5d53e504acae 100644 +--- a/block/bfq-cgroup.c ++++ b/block/bfq-cgroup.c +@@ -749,10 +749,11 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) + unsigned long flags; + int i; + ++ spin_lock_irqsave(&bfqd->lock, flags); ++ + if (!entity) /* root group */ +- return; ++ goto put_async_queues; + +- spin_lock_irqsave(&bfqd->lock, flags); + /* + * Empty all service_trees belonging to this group before + * deactivating the group itself. +@@ -783,6 +784,8 @@ static void bfq_pd_offline(struct blkg_policy_data *pd) + } + + __bfq_deactivate_entity(entity, false); ++ ++put_async_queues: + bfq_put_async_queues(bfqd, bfqg); + + spin_unlock_irqrestore(&bfqd->lock, flags); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index f1fb126a3be5..6f899669cbdd 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1928,7 +1928,8 @@ static void blk_mq_exit_hctx(struct request_queue *q, + { + blk_mq_debugfs_unregister_hctx(hctx); + +- blk_mq_tag_idle(hctx); ++ if (blk_mq_hw_queue_mapped(hctx)) ++ blk_mq_tag_idle(hctx); + + if (set->ops->exit_request) + set->ops->exit_request(set, hctx->fq->flush_rq, hctx_idx); +@@ -2314,6 +2315,9 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, + struct blk_mq_hw_ctx **hctxs = q->queue_hw_ctx; + + blk_mq_sysfs_unregister(q); ++ ++ /* protect against switching io scheduler */ ++ mutex_lock(&q->sysfs_lock); + for (i = 0; i < set->nr_hw_queues; i++) { + int node; + +@@ -2358,6 +2362,7 @@ static void blk_mq_realloc_hw_ctxs(struct blk_mq_tag_set *set, + } + } + q->nr_hw_queues = i; ++ mutex_unlock(&q->sysfs_lock); + blk_mq_sysfs_register(q); + } + +@@ -2528,9 +2533,27 @@ static int blk_mq_alloc_rq_maps(struct blk_mq_tag_set *set) + + static int blk_mq_update_queue_map(struct blk_mq_tag_set *set) + { +- if (set->ops->map_queues) ++ if (set->ops->map_queues) { ++ int cpu; ++ /* ++ * transport .map_queues is usually done in the following ++ * way: ++ * ++ * for (queue = 0; queue < set->nr_hw_queues; queue++) { ++ * mask = get_cpu_mask(queue) ++ * for_each_cpu(cpu, mask) ++ * set->mq_map[cpu] = queue; ++ * } ++ * ++ * When we need to remap, the table has to be cleared for ++ * killing stale mapping since one CPU may not be mapped ++ * to any hw queue. ++ */ ++ for_each_possible_cpu(cpu) ++ set->mq_map[cpu] = 0; ++ + return set->ops->map_queues(set); +- else ++ } else + return blk_mq_map_queues(set); + } + +diff --git a/crypto/Makefile b/crypto/Makefile +index da190be60ce2..adaf2c63baeb 100644 +--- a/crypto/Makefile ++++ b/crypto/Makefile +@@ -98,6 +98,7 @@ obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o + obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o + CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 + obj-$(CONFIG_CRYPTO_AES) += aes_generic.o ++CFLAGS_aes_generic.o := $(call cc-ifversion, -ge, 0701, -Os) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=83356 + obj-$(CONFIG_CRYPTO_AES_TI) += aes_ti.o + obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o + obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index 0972ec0e2eb8..f53ccc680238 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -80,8 +80,8 @@ MODULE_PARM_DESC(report_key_events, + static bool device_id_scheme = false; + module_param(device_id_scheme, bool, 0444); + +-static bool only_lcd = false; +-module_param(only_lcd, bool, 0444); ++static int only_lcd = -1; ++module_param(only_lcd, int, 0444); + + static int register_count; + static DEFINE_MUTEX(register_count_mutex); +@@ -2136,6 +2136,16 @@ int acpi_video_register(void) + goto leave; + } + ++ /* ++ * We're seeing a lot of bogus backlight interfaces on newer machines ++ * without a LCD such as desktops, servers and HDMI sticks. Checking ++ * the lcd flag fixes this, so enable this on any machines which are ++ * win8 ready (where we also prefer the native backlight driver, so ++ * normally the acpi_video code should not register there anyways). ++ */ ++ if (only_lcd == -1) ++ only_lcd = acpi_osi_is_win8(); ++ + dmi_check_system(video_dmi_table); + + ret = acpi_bus_register_driver(&acpi_video_bus); +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index df842465634a..6adcda057b36 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1516,7 +1516,7 @@ static int acpi_ec_setup(struct acpi_ec *ec, bool handle_events) + } + + acpi_handle_info(ec->handle, +- "GPE=0x%lx, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", ++ "GPE=0x%x, EC_CMD/EC_SC=0x%lx, EC_DATA=0x%lx\n", + ec->gpe, ec->command_addr, ec->data_addr); + return ret; + } +diff --git a/drivers/acpi/ec_sys.c b/drivers/acpi/ec_sys.c +index 6c7dd7af789e..dd70d6c2bca0 100644 +--- a/drivers/acpi/ec_sys.c ++++ b/drivers/acpi/ec_sys.c +@@ -128,7 +128,7 @@ static int acpi_ec_add_debugfs(struct acpi_ec *ec, unsigned int ec_device_count) + return -ENOMEM; + } + +- if (!debugfs_create_x32("gpe", 0444, dev_dir, (u32 *)&first_ec->gpe)) ++ if (!debugfs_create_x32("gpe", 0444, dev_dir, &first_ec->gpe)) + goto error; + if (!debugfs_create_bool("use_global_lock", 0444, dev_dir, + &first_ec->global_lock)) +diff --git a/drivers/acpi/internal.h b/drivers/acpi/internal.h +index ede83d38beed..2cd2ae152ab7 100644 +--- a/drivers/acpi/internal.h ++++ b/drivers/acpi/internal.h +@@ -159,7 +159,7 @@ static inline void acpi_early_processor_osc(void) {} + -------------------------------------------------------------------------- */ + struct acpi_ec { + acpi_handle handle; +- unsigned long gpe; ++ u32 gpe; + unsigned long command_addr; + unsigned long data_addr; + bool global_lock; +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index b2c0306f97ed..e9dff868c028 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -277,6 +277,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe09f), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0489, 0xe0a2), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, ++ { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, + + /* Broadcom BCM2035 */ +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 5294442505cb..0f1dc35e7078 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -328,7 +328,7 @@ unsigned long tpm_calc_ordinal_duration(struct tpm_chip *chip, + } + EXPORT_SYMBOL_GPL(tpm_calc_ordinal_duration); + +-static bool tpm_validate_command(struct tpm_chip *chip, ++static int tpm_validate_command(struct tpm_chip *chip, + struct tpm_space *space, + const u8 *cmd, + size_t len) +@@ -340,10 +340,10 @@ static bool tpm_validate_command(struct tpm_chip *chip, + unsigned int nr_handles; + + if (len < TPM_HEADER_SIZE) +- return false; ++ return -EINVAL; + + if (!space) +- return true; ++ return 0; + + if (chip->flags & TPM_CHIP_FLAG_TPM2 && chip->nr_commands) { + cc = be32_to_cpu(header->ordinal); +@@ -352,7 +352,7 @@ static bool tpm_validate_command(struct tpm_chip *chip, + if (i < 0) { + dev_dbg(&chip->dev, "0x%04X is an invalid command\n", + cc); +- return false; ++ return -EOPNOTSUPP; + } + + attrs = chip->cc_attrs_tbl[i]; +@@ -362,11 +362,11 @@ static bool tpm_validate_command(struct tpm_chip *chip, + goto err_len; + } + +- return true; ++ return 0; + err_len: + dev_dbg(&chip->dev, + "%s: insufficient command length %zu", __func__, len); +- return false; ++ return -EINVAL; + } + + /** +@@ -391,8 +391,20 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + unsigned long stop; + bool need_locality; + +- if (!tpm_validate_command(chip, space, buf, bufsiz)) +- return -EINVAL; ++ rc = tpm_validate_command(chip, space, buf, bufsiz); ++ if (rc == -EINVAL) ++ return rc; ++ /* ++ * If the command is not implemented by the TPM, synthesize a ++ * response with a TPM2_RC_COMMAND_CODE return for user-space. ++ */ ++ if (rc == -EOPNOTSUPP) { ++ header->length = cpu_to_be32(sizeof(*header)); ++ header->tag = cpu_to_be16(TPM2_ST_NO_SESSIONS); ++ header->return_code = cpu_to_be32(TPM2_RC_COMMAND_CODE | ++ TSS2_RESMGR_TPM_RC_LAYER); ++ return bufsiz; ++ } + + if (bufsiz > TPM_BUFSIZE) + bufsiz = TPM_BUFSIZE; +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 2d5466a72e40..0b5b499f726a 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -93,12 +93,17 @@ enum tpm2_structures { + TPM2_ST_SESSIONS = 0x8002, + }; + ++/* Indicates from what layer of the software stack the error comes from */ ++#define TSS2_RC_LAYER_SHIFT 16 ++#define TSS2_RESMGR_TPM_RC_LAYER (11 << TSS2_RC_LAYER_SHIFT) ++ + enum tpm2_return_codes { + TPM2_RC_SUCCESS = 0x0000, + TPM2_RC_HASH = 0x0083, /* RC_FMT1 */ + TPM2_RC_HANDLE = 0x008B, + TPM2_RC_INITIALIZE = 0x0100, /* RC_VER1 */ + TPM2_RC_DISABLED = 0x0120, ++ TPM2_RC_COMMAND_CODE = 0x0143, + TPM2_RC_TESTING = 0x090A, /* RC_WARN */ + TPM2_RC_REFERENCE_H0 = 0x0910, + }; +diff --git a/drivers/clk/clk-divider.c b/drivers/clk/clk-divider.c +index 4ed516cb7276..b49942b9fe50 100644 +--- a/drivers/clk/clk-divider.c ++++ b/drivers/clk/clk-divider.c +@@ -118,12 +118,11 @@ static unsigned int _get_val(const struct clk_div_table *table, + unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, + unsigned int val, + const struct clk_div_table *table, +- unsigned long flags) ++ unsigned long flags, unsigned long width) + { +- struct clk_divider *divider = to_clk_divider(hw); + unsigned int div; + +- div = _get_div(table, val, flags, divider->width); ++ div = _get_div(table, val, flags, width); + if (!div) { + WARN(!(flags & CLK_DIVIDER_ALLOW_ZERO), + "%s: Zero divisor and CLK_DIVIDER_ALLOW_ZERO not set\n", +@@ -145,7 +144,7 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw, + val &= div_mask(divider->width); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, +- divider->flags); ++ divider->flags, divider->width); + } + + static bool _is_valid_table_div(const struct clk_div_table *table, +diff --git a/drivers/clk/hisilicon/clkdivider-hi6220.c b/drivers/clk/hisilicon/clkdivider-hi6220.c +index a1c1f684ad58..9f46cf9dcc65 100644 +--- a/drivers/clk/hisilicon/clkdivider-hi6220.c ++++ b/drivers/clk/hisilicon/clkdivider-hi6220.c +@@ -56,7 +56,7 @@ static unsigned long hi6220_clkdiv_recalc_rate(struct clk_hw *hw, + val &= div_mask(dclk->width); + + return divider_recalc_rate(hw, parent_rate, val, dclk->table, +- CLK_DIVIDER_ROUND_CLOSEST); ++ CLK_DIVIDER_ROUND_CLOSEST, dclk->width); + } + + static long hi6220_clkdiv_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/clk/meson/clk-mpll.c b/drivers/clk/meson/clk-mpll.c +index 44a5a535ca63..5144360e2c80 100644 +--- a/drivers/clk/meson/clk-mpll.c ++++ b/drivers/clk/meson/clk-mpll.c +@@ -98,7 +98,7 @@ static void params_from_rate(unsigned long requested_rate, + *sdm = SDM_DEN - 1; + } else { + *n2 = div; +- *sdm = DIV_ROUND_UP(rem * SDM_DEN, requested_rate); ++ *sdm = DIV_ROUND_UP_ULL((u64)rem * SDM_DEN, requested_rate); + } + } + +diff --git a/drivers/clk/nxp/clk-lpc32xx.c b/drivers/clk/nxp/clk-lpc32xx.c +index 7b359afd620e..a6438f50e6db 100644 +--- a/drivers/clk/nxp/clk-lpc32xx.c ++++ b/drivers/clk/nxp/clk-lpc32xx.c +@@ -956,7 +956,7 @@ static unsigned long clk_divider_recalc_rate(struct clk_hw *hw, + val &= div_mask(divider->width); + + return divider_recalc_rate(hw, parent_rate, val, divider->table, +- divider->flags); ++ divider->flags, divider->width); + } + + static long clk_divider_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/clk/qcom/clk-regmap-divider.c b/drivers/clk/qcom/clk-regmap-divider.c +index 53484912301e..928fcc16ee27 100644 +--- a/drivers/clk/qcom/clk-regmap-divider.c ++++ b/drivers/clk/qcom/clk-regmap-divider.c +@@ -59,7 +59,7 @@ static unsigned long div_recalc_rate(struct clk_hw *hw, + div &= BIT(divider->width) - 1; + + return divider_recalc_rate(hw, parent_rate, div, NULL, +- CLK_DIVIDER_ROUND_CLOSEST); ++ CLK_DIVIDER_ROUND_CLOSEST, divider->width); + } + + const struct clk_ops clk_regmap_div_ops = { +diff --git a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c +index f8203115a6bc..c10160d7a556 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c ++++ b/drivers/clk/sunxi-ng/ccu-sun8i-a83t.c +@@ -493,8 +493,8 @@ static SUNXI_CCU_MUX_WITH_GATE(tcon0_clk, "tcon0", tcon0_parents, + 0x118, 24, 3, BIT(31), CLK_SET_RATE_PARENT); + + static const char * const tcon1_parents[] = { "pll-video1" }; +-static SUNXI_CCU_MUX_WITH_GATE(tcon1_clk, "tcon1", tcon1_parents, +- 0x11c, 24, 3, BIT(31), CLK_SET_RATE_PARENT); ++static SUNXI_CCU_M_WITH_MUX_GATE(tcon1_clk, "tcon1", tcon1_parents, ++ 0x11c, 0, 4, 24, 2, BIT(31), CLK_SET_RATE_PARENT); + + static SUNXI_CCU_GATE(csi_misc_clk, "csi-misc", "osc24M", 0x130, BIT(16), 0); + +diff --git a/drivers/clk/sunxi-ng/ccu_div.c b/drivers/clk/sunxi-ng/ccu_div.c +index baa3cf96507b..302a18efd39f 100644 +--- a/drivers/clk/sunxi-ng/ccu_div.c ++++ b/drivers/clk/sunxi-ng/ccu_div.c +@@ -71,7 +71,7 @@ static unsigned long ccu_div_recalc_rate(struct clk_hw *hw, + parent_rate); + + val = divider_recalc_rate(hw, parent_rate, val, cd->div.table, +- cd->div.flags); ++ cd->div.flags, cd->div.width); + + if (cd->common.features & CCU_FEATURE_FIXED_POSTDIV) + val /= cd->fixed_post_div; +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index 7e1e5bbcf430..6b3a63545619 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -41,11 +41,9 @@ + #define POWERNV_MAX_PSTATES 256 + #define PMSR_PSAFE_ENABLE (1UL << 30) + #define PMSR_SPR_EM_DISABLE (1UL << 31) +-#define PMSR_MAX(x) ((x >> 32) & 0xFF) ++#define MAX_PSTATE_SHIFT 32 + #define LPSTATE_SHIFT 48 + #define GPSTATE_SHIFT 56 +-#define GET_LPSTATE(x) (((x) >> LPSTATE_SHIFT) & 0xFF) +-#define GET_GPSTATE(x) (((x) >> GPSTATE_SHIFT) & 0xFF) + + #define MAX_RAMP_DOWN_TIME 5120 + /* +@@ -93,6 +91,7 @@ struct global_pstate_info { + }; + + static struct cpufreq_frequency_table powernv_freqs[POWERNV_MAX_PSTATES+1]; ++u32 pstate_sign_prefix; + static bool rebooting, throttled, occ_reset; + + static const char * const throttle_reason[] = { +@@ -147,6 +146,20 @@ static struct powernv_pstate_info { + bool wof_enabled; + } powernv_pstate_info; + ++static inline int extract_pstate(u64 pmsr_val, unsigned int shift) ++{ ++ int ret = ((pmsr_val >> shift) & 0xFF); ++ ++ if (!ret) ++ return ret; ++ ++ return (pstate_sign_prefix | ret); ++} ++ ++#define extract_local_pstate(x) extract_pstate(x, LPSTATE_SHIFT) ++#define extract_global_pstate(x) extract_pstate(x, GPSTATE_SHIFT) ++#define extract_max_pstate(x) extract_pstate(x, MAX_PSTATE_SHIFT) ++ + /* Use following macros for conversions between pstate_id and index */ + static inline int idx_to_pstate(unsigned int i) + { +@@ -277,6 +290,9 @@ static int init_powernv_pstates(void) + + powernv_pstate_info.nr_pstates = nr_pstates; + pr_debug("NR PStates %d\n", nr_pstates); ++ ++ pstate_sign_prefix = pstate_min & ~0xFF; ++ + for (i = 0; i < nr_pstates; i++) { + u32 id = be32_to_cpu(pstate_ids[i]); + u32 freq = be32_to_cpu(pstate_freqs[i]); +@@ -437,17 +453,10 @@ struct powernv_smp_call_data { + static void powernv_read_cpu_freq(void *arg) + { + unsigned long pmspr_val; +- s8 local_pstate_id; + struct powernv_smp_call_data *freq_data = arg; + + pmspr_val = get_pmspr(SPRN_PMSR); +- +- /* +- * The local pstate id corresponds bits 48..55 in the PMSR. +- * Note: Watch out for the sign! +- */ +- local_pstate_id = (pmspr_val >> 48) & 0xFF; +- freq_data->pstate_id = local_pstate_id; ++ freq_data->pstate_id = extract_local_pstate(pmspr_val); + freq_data->freq = pstate_id_to_freq(freq_data->pstate_id); + + pr_debug("cpu %d pmsr %016lX pstate_id %d frequency %d kHz\n", +@@ -521,7 +530,7 @@ static void powernv_cpufreq_throttle_check(void *data) + chip = this_cpu_read(chip_info); + + /* Check for Pmax Capping */ +- pmsr_pmax = (s8)PMSR_MAX(pmsr); ++ pmsr_pmax = extract_max_pstate(pmsr); + pmsr_pmax_idx = pstate_to_idx(pmsr_pmax); + if (pmsr_pmax_idx != powernv_pstate_info.max) { + if (chip->throttled) +@@ -644,8 +653,8 @@ void gpstate_timer_handler(unsigned long data) + * value. Hence, read from PMCR to get correct data. + */ + val = get_pmspr(SPRN_PMCR); +- freq_data.gpstate_id = (s8)GET_GPSTATE(val); +- freq_data.pstate_id = (s8)GET_LPSTATE(val); ++ freq_data.gpstate_id = extract_global_pstate(val); ++ freq_data.pstate_id = extract_local_pstate(val); + if (freq_data.gpstate_id == freq_data.pstate_id) { + reset_gpstates(policy); + spin_unlock(&gpstates->gpstate_lock); +diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c +index 202476fbbc4c..8a411514a7c5 100644 +--- a/drivers/devfreq/devfreq.c ++++ b/drivers/devfreq/devfreq.c +@@ -935,7 +935,8 @@ static ssize_t governor_store(struct device *dev, struct device_attribute *attr, + if (df->governor == governor) { + ret = 0; + goto out; +- } else if (df->governor->immutable || governor->immutable) { ++ } else if ((df->governor && df->governor->immutable) || ++ governor->immutable) { + ret = -EINVAL; + goto out; + } +diff --git a/drivers/edac/mv64x60_edac.c b/drivers/edac/mv64x60_edac.c +index ec5d695bbb72..3c68bb525d5d 100644 +--- a/drivers/edac/mv64x60_edac.c ++++ b/drivers/edac/mv64x60_edac.c +@@ -758,7 +758,7 @@ static int mv64x60_mc_err_probe(struct platform_device *pdev) + /* Non-ECC RAM? */ + printk(KERN_WARNING "%s: No ECC DIMMs discovered\n", __func__); + res = -ENODEV; +- goto err2; ++ goto err; + } + + edac_dbg(3, "init mci\n"); +diff --git a/drivers/gpio/gpio-thunderx.c b/drivers/gpio/gpio-thunderx.c +index 57efb251f9c4..10523ce00c38 100644 +--- a/drivers/gpio/gpio-thunderx.c ++++ b/drivers/gpio/gpio-thunderx.c +@@ -566,8 +566,10 @@ static int thunderx_gpio_probe(struct pci_dev *pdev, + txgpio->irqd = irq_domain_create_hierarchy(irq_get_irq_data(txgpio->msix_entries[0].vector)->domain, + 0, 0, of_node_to_fwnode(dev->of_node), + &thunderx_gpio_irqd_ops, txgpio); +- if (!txgpio->irqd) ++ if (!txgpio->irqd) { ++ err = -ENOMEM; + goto out; ++ } + + /* Push on irq_data and the domain for each line. */ + for (i = 0; i < ngpio; i++) { +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index bdd68ff197dc..b4c8b25453a6 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -3340,7 +3340,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + return desc; + } + +- status = gpiod_request(desc, con_id); ++ /* If a connection label was passed use that, else use the device name as label */ ++ status = gpiod_request(desc, con_id ? con_id : dev_name(dev)); + if (status < 0) + return ERR_PTR(status); + +diff --git a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c +index fe15aa64086f..71fe60e5f01f 100644 +--- a/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c ++++ b/drivers/gpu/drm/msm/dsi/pll/dsi_pll_14nm.c +@@ -698,7 +698,7 @@ static unsigned long dsi_pll_14nm_postdiv_recalc_rate(struct clk_hw *hw, + val &= div_mask(width); + + return divider_recalc_rate(hw, parent_rate, val, NULL, +- postdiv->flags); ++ postdiv->flags, width); + } + + static long dsi_pll_14nm_postdiv_round_rate(struct clk_hw *hw, +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index 62e38fa8cda2..e362a932fe8c 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -95,18 +95,20 @@ enum ina2xx_ids { ina219, ina226 }; + + struct ina2xx_config { + u16 config_default; +- int calibration_factor; ++ int calibration_value; + int registers; + int shunt_div; + int bus_voltage_shift; + int bus_voltage_lsb; /* uV */ +- int power_lsb; /* uW */ ++ int power_lsb_factor; + }; + + struct ina2xx_data { + const struct ina2xx_config *config; + + long rshunt; ++ long current_lsb_uA; ++ long power_lsb_uW; + struct mutex config_lock; + struct regmap *regmap; + +@@ -116,21 +118,21 @@ struct ina2xx_data { + static const struct ina2xx_config ina2xx_config[] = { + [ina219] = { + .config_default = INA219_CONFIG_DEFAULT, +- .calibration_factor = 40960000, ++ .calibration_value = 4096, + .registers = INA219_REGISTERS, + .shunt_div = 100, + .bus_voltage_shift = 3, + .bus_voltage_lsb = 4000, +- .power_lsb = 20000, ++ .power_lsb_factor = 20, + }, + [ina226] = { + .config_default = INA226_CONFIG_DEFAULT, +- .calibration_factor = 5120000, ++ .calibration_value = 2048, + .registers = INA226_REGISTERS, + .shunt_div = 400, + .bus_voltage_shift = 0, + .bus_voltage_lsb = 1250, +- .power_lsb = 25000, ++ .power_lsb_factor = 25, + }, + }; + +@@ -169,12 +171,16 @@ static u16 ina226_interval_to_reg(int interval) + return INA226_SHIFT_AVG(avg_bits); + } + ++/* ++ * Calibration register is set to the best value, which eliminates ++ * truncation errors on calculating current register in hardware. ++ * According to datasheet (eq. 3) the best values are 2048 for ++ * ina226 and 4096 for ina219. They are hardcoded as calibration_value. ++ */ + static int ina2xx_calibrate(struct ina2xx_data *data) + { +- u16 val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- data->rshunt); +- +- return regmap_write(data->regmap, INA2XX_CALIBRATION, val); ++ return regmap_write(data->regmap, INA2XX_CALIBRATION, ++ data->config->calibration_value); + } + + /* +@@ -187,10 +193,6 @@ static int ina2xx_init(struct ina2xx_data *data) + if (ret < 0) + return ret; + +- /* +- * Set current LSB to 1mA, shunt is in uOhms +- * (equation 13 in datasheet). +- */ + return ina2xx_calibrate(data); + } + +@@ -268,15 +270,15 @@ static int ina2xx_get_value(struct ina2xx_data *data, u8 reg, + val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_POWER: +- val = regval * data->config->power_lsb; ++ val = regval * data->power_lsb_uW; + break; + case INA2XX_CURRENT: +- /* signed register, LSB=1mA (selected), in mA */ +- val = (s16)regval; ++ /* signed register, result in mA */ ++ val = regval * data->current_lsb_uA; ++ val = DIV_ROUND_CLOSEST(val, 1000); + break; + case INA2XX_CALIBRATION: +- val = DIV_ROUND_CLOSEST(data->config->calibration_factor, +- regval); ++ val = regval; + break; + default: + /* programmer goofed */ +@@ -304,9 +306,32 @@ static ssize_t ina2xx_show_value(struct device *dev, + ina2xx_get_value(data, attr->index, regval)); + } + +-static ssize_t ina2xx_set_shunt(struct device *dev, +- struct device_attribute *da, +- const char *buf, size_t count) ++/* ++ * In order to keep calibration register value fixed, the product ++ * of current_lsb and shunt_resistor should also be fixed and equal ++ * to shunt_voltage_lsb = 1 / shunt_div multiplied by 10^9 in order ++ * to keep the scale. ++ */ ++static int ina2xx_set_shunt(struct ina2xx_data *data, long val) ++{ ++ unsigned int dividend = DIV_ROUND_CLOSEST(1000000000, ++ data->config->shunt_div); ++ if (val <= 0 || val > dividend) ++ return -EINVAL; ++ ++ mutex_lock(&data->config_lock); ++ data->rshunt = val; ++ data->current_lsb_uA = DIV_ROUND_CLOSEST(dividend, val); ++ data->power_lsb_uW = data->config->power_lsb_factor * ++ data->current_lsb_uA; ++ mutex_unlock(&data->config_lock); ++ ++ return 0; ++} ++ ++static ssize_t ina2xx_store_shunt(struct device *dev, ++ struct device_attribute *da, ++ const char *buf, size_t count) + { + unsigned long val; + int status; +@@ -316,18 +341,9 @@ static ssize_t ina2xx_set_shunt(struct device *dev, + if (status < 0) + return status; + +- if (val == 0 || +- /* Values greater than the calibration factor make no sense. */ +- val > data->config->calibration_factor) +- return -EINVAL; +- +- mutex_lock(&data->config_lock); +- data->rshunt = val; +- status = ina2xx_calibrate(data); +- mutex_unlock(&data->config_lock); ++ status = ina2xx_set_shunt(data, val); + if (status < 0) + return status; +- + return count; + } + +@@ -387,7 +403,7 @@ static SENSOR_DEVICE_ATTR(power1_input, S_IRUGO, ina2xx_show_value, NULL, + + /* shunt resistance */ + static SENSOR_DEVICE_ATTR(shunt_resistor, S_IRUGO | S_IWUSR, +- ina2xx_show_value, ina2xx_set_shunt, ++ ina2xx_show_value, ina2xx_store_shunt, + INA2XX_CALIBRATION); + + /* update interval (ina226 only) */ +@@ -448,10 +464,7 @@ static int ina2xx_probe(struct i2c_client *client, + val = INA2XX_RSHUNT_DEFAULT; + } + +- if (val <= 0 || val > data->config->calibration_factor) +- return -ENODEV; +- +- data->rshunt = val; ++ ina2xx_set_shunt(data, val); + + ina2xx_regmap_config.max_register = data->config->registers; + +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6cae00ecc905..25de7cc9f49f 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -4453,6 +4453,7 @@ static int cma_get_id_stats(struct sk_buff *skb, struct netlink_callback *cb) + id_stats->qp_type = id->qp_type; + + i_id++; ++ nlmsg_end(skb, nlh); + } + + cb->args[1] = 0; +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index 722235bed075..d6fa38f8604f 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -914,13 +914,14 @@ static ssize_t ucma_query_path(struct ucma_context *ctx, + + resp->path_data[i].flags = IB_PATH_GMP | IB_PATH_PRIMARY | + IB_PATH_BIDIRECTIONAL; +- if (rec->rec_type == SA_PATH_REC_TYPE_IB) { +- ib_sa_pack_path(rec, &resp->path_data[i].path_rec); +- } else { ++ if (rec->rec_type == SA_PATH_REC_TYPE_OPA) { + struct sa_path_rec ib; + + sa_convert_path_opa_to_ib(&ib, rec); + ib_sa_pack_path(&ib, &resp->path_data[i].path_rec); ++ ++ } else { ++ ib_sa_pack_path(rec, &resp->path_data[i].path_rec); + } + } + +diff --git a/drivers/infiniband/hw/i40iw/i40iw_cm.c b/drivers/infiniband/hw/i40iw/i40iw_cm.c +index d6a1a308c6a0..b7f1ce5333cb 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_cm.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_cm.c +@@ -125,7 +125,8 @@ static u8 i40iw_derive_hw_ird_setting(u16 cm_ird) + * @conn_ird: connection IRD + * @conn_ord: connection ORD + */ +-static void i40iw_record_ird_ord(struct i40iw_cm_node *cm_node, u16 conn_ird, u16 conn_ord) ++static void i40iw_record_ird_ord(struct i40iw_cm_node *cm_node, u32 conn_ird, ++ u32 conn_ord) + { + if (conn_ird > I40IW_MAX_IRD_SIZE) + conn_ird = I40IW_MAX_IRD_SIZE; +@@ -3841,7 +3842,7 @@ int i40iw_connect(struct iw_cm_id *cm_id, struct iw_cm_conn_param *conn_param) + } + + cm_node->apbvt_set = true; +- i40iw_record_ird_ord(cm_node, (u16)conn_param->ird, (u16)conn_param->ord); ++ i40iw_record_ird_ord(cm_node, conn_param->ird, conn_param->ord); + if (cm_node->send_rdma0_op == SEND_RDMA_READ_ZERO && + !cm_node->ord_size) + cm_node->ord_size = 1; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +index d86f3e670804..472ef4d6e858 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_ctrl.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_ctrl.c +@@ -3875,8 +3875,10 @@ enum i40iw_status_code i40iw_config_fpm_values(struct i40iw_sc_dev *dev, u32 qp_ + hmc_info->hmc_obj[I40IW_HMC_IW_APBVT_ENTRY].cnt = 1; + hmc_info->hmc_obj[I40IW_HMC_IW_MR].cnt = mrwanted; + +- hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt = I40IW_MAX_WQ_ENTRIES * qpwanted; +- hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt = 4 * I40IW_MAX_IRD_SIZE * qpwanted; ++ hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt = ++ roundup_pow_of_two(I40IW_MAX_WQ_ENTRIES * qpwanted); ++ hmc_info->hmc_obj[I40IW_HMC_IW_Q1].cnt = ++ roundup_pow_of_two(2 * I40IW_MAX_IRD_SIZE * qpwanted); + hmc_info->hmc_obj[I40IW_HMC_IW_XFFL].cnt = + hmc_info->hmc_obj[I40IW_HMC_IW_XF].cnt / hmc_fpm_misc->xf_block_size; + hmc_info->hmc_obj[I40IW_HMC_IW_Q1FL].cnt = +diff --git a/drivers/infiniband/hw/i40iw/i40iw_d.h b/drivers/infiniband/hw/i40iw/i40iw_d.h +index 24eabcad5e40..019ad3b939f9 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_d.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_d.h +@@ -93,6 +93,7 @@ + #define RDMA_OPCODE_MASK 0x0f + #define RDMA_READ_REQ_OPCODE 1 + #define Q2_BAD_FRAME_OFFSET 72 ++#define Q2_FPSN_OFFSET 64 + #define CQE_MAJOR_DRV 0x8000 + + #define I40IW_TERM_SENT 0x01 +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c +index 59f70676f0e0..14d38d733cb4 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c +@@ -1376,7 +1376,7 @@ static void i40iw_ieq_handle_exception(struct i40iw_puda_rsrc *ieq, + u32 *hw_host_ctx = (u32 *)qp->hw_host_ctx; + u32 rcv_wnd = hw_host_ctx[23]; + /* first partial seq # in q2 */ +- u32 fps = qp->q2_buf[16]; ++ u32 fps = *(u32 *)(qp->q2_buf + Q2_FPSN_OFFSET); + struct list_head *rxlist = &pfpdu->rxlist; + struct list_head *plist; + +diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c +index 97d71e49c092..88fa4d44ab5f 100644 +--- a/drivers/infiniband/sw/rdmavt/cq.c ++++ b/drivers/infiniband/sw/rdmavt/cq.c +@@ -198,7 +198,7 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev, + return ERR_PTR(-EINVAL); + + /* Allocate the completion queue structure. */ +- cq = kzalloc(sizeof(*cq), GFP_KERNEL); ++ cq = kzalloc_node(sizeof(*cq), GFP_KERNEL, rdi->dparms.node); + if (!cq) + return ERR_PTR(-ENOMEM); + +@@ -214,7 +214,9 @@ struct ib_cq *rvt_create_cq(struct ib_device *ibdev, + sz += sizeof(struct ib_uverbs_wc) * (entries + 1); + else + sz += sizeof(struct ib_wc) * (entries + 1); +- wc = vmalloc_user(sz); ++ wc = udata ? ++ vmalloc_user(sz) : ++ vzalloc_node(sz, rdi->dparms.node); + if (!wc) { + ret = ERR_PTR(-ENOMEM); + goto bail_cq; +@@ -369,7 +371,9 @@ int rvt_resize_cq(struct ib_cq *ibcq, int cqe, struct ib_udata *udata) + sz += sizeof(struct ib_uverbs_wc) * (cqe + 1); + else + sz += sizeof(struct ib_wc) * (cqe + 1); +- wc = vmalloc_user(sz); ++ wc = udata ? ++ vmalloc_user(sz) : ++ vzalloc_node(sz, rdi->dparms.node); + if (!wc) + return -ENOMEM; + +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index b3bbad7d2282..5dafafad6351 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -808,8 +808,10 @@ static int __maybe_unused goodix_suspend(struct device *dev) + int error; + + /* We need gpio pins to suspend/resume */ +- if (!ts->gpiod_int || !ts->gpiod_rst) ++ if (!ts->gpiod_int || !ts->gpiod_rst) { ++ disable_irq(client->irq); + return 0; ++ } + + wait_for_completion(&ts->firmware_loading_complete); + +@@ -849,8 +851,10 @@ static int __maybe_unused goodix_resume(struct device *dev) + struct goodix_ts_data *ts = i2c_get_clientdata(client); + int error; + +- if (!ts->gpiod_int || !ts->gpiod_rst) ++ if (!ts->gpiod_int || !ts->gpiod_rst) { ++ enable_irq(client->irq); + return 0; ++ } + + /* + * Exit sleep mode by outputting HIGH level to INT pin +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index ae9ff72e83ee..848fcdf6a112 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -1297,6 +1297,10 @@ gic_acpi_parse_madt_gicc(struct acpi_subtable_header *header, + u32 size = reg == GIC_PIDR2_ARCH_GICv4 ? SZ_64K * 4 : SZ_64K * 2; + void __iomem *redist_base; + ++ /* GICC entry which has !ACPI_MADT_ENABLED is not unusable so skip */ ++ if (!(gicc->flags & ACPI_MADT_ENABLED)) ++ return 0; ++ + redist_base = ioremap(gicc->gicr_base_address, size); + if (!redist_base) + return -ENOMEM; +@@ -1346,6 +1350,13 @@ static int __init gic_acpi_match_gicc(struct acpi_subtable_header *header, + if ((gicc->flags & ACPI_MADT_ENABLED) && gicc->gicr_base_address) + return 0; + ++ /* ++ * It's perfectly valid firmware can pass disabled GICC entry, driver ++ * should not treat as errors, skip the entry instead of probe fail. ++ */ ++ if (!(gicc->flags & ACPI_MADT_ENABLED)) ++ return 0; ++ + return -ENODEV; + } + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index 934b1fce4ce1..f0dc8e2aee65 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -515,15 +515,21 @@ struct open_bucket { + + /* + * We keep multiple buckets open for writes, and try to segregate different +- * write streams for better cache utilization: first we look for a bucket where +- * the last write to it was sequential with the current write, and failing that +- * we look for a bucket that was last used by the same task. ++ * write streams for better cache utilization: first we try to segregate flash ++ * only volume write streams from cached devices, secondly we look for a bucket ++ * where the last write to it was sequential with the current write, and ++ * failing that we look for a bucket that was last used by the same task. + * + * The ideas is if you've got multiple tasks pulling data into the cache at the + * same time, you'll get better cache utilization if you try to segregate their + * data and preserve locality. + * +- * For example, say you've starting Firefox at the same time you're copying a ++ * For example, dirty sectors of flash only volume is not reclaimable, if their ++ * dirty sectors mixed with dirty sectors of cached device, such buckets will ++ * be marked as dirty and won't be reclaimed, though the dirty data of cached ++ * device have been written back to backend device. ++ * ++ * And say you've starting Firefox at the same time you're copying a + * bunch of files. Firefox will likely end up being fairly hot and stay in the + * cache awhile, but the data you copied might not be; if you wrote all that + * data to the same buckets it'd get invalidated at the same time. +@@ -540,7 +546,10 @@ static struct open_bucket *pick_data_bucket(struct cache_set *c, + struct open_bucket *ret, *ret_task = NULL; + + list_for_each_entry_reverse(ret, &c->data_buckets, list) +- if (!bkey_cmp(&ret->key, search)) ++ if (UUID_FLASH_ONLY(&c->uuids[KEY_INODE(&ret->key)]) != ++ UUID_FLASH_ONLY(&c->uuids[KEY_INODE(search)])) ++ continue; ++ else if (!bkey_cmp(&ret->key, search)) + goto found; + else if (ret->last_write_point == write_point) + ret_task = ret; +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index e9fbf2bcd122..f34ad8720756 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -568,6 +568,7 @@ static void cache_lookup(struct closure *cl) + { + struct search *s = container_of(cl, struct search, iop.cl); + struct bio *bio = &s->bio.bio; ++ struct cached_dev *dc; + int ret; + + bch_btree_op_init(&s->op, -1); +@@ -580,6 +581,27 @@ static void cache_lookup(struct closure *cl) + return; + } + ++ /* ++ * We might meet err when searching the btree, If that happens, we will ++ * get negative ret, in this scenario we should not recover data from ++ * backing device (when cache device is dirty) because we don't know ++ * whether bkeys the read request covered are all clean. ++ * ++ * And after that happened, s->iop.status is still its initial value ++ * before we submit s->bio.bio ++ */ ++ if (ret < 0) { ++ BUG_ON(ret == -EINTR); ++ if (s->d && s->d->c && ++ !UUID_FLASH_ONLY(&s->d->c->uuids[s->d->id])) { ++ dc = container_of(s->d, struct cached_dev, disk); ++ if (dc && atomic_read(&dc->has_dirty)) ++ s->recoverable = false; ++ } ++ if (!s->iop.status) ++ s->iop.status = BLK_STS_IOERR; ++ } ++ + closure_return(cl); + } + +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 9417170f180a..5d0430777dda 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -893,6 +893,12 @@ static void cached_dev_detach_finish(struct work_struct *w) + + mutex_lock(&bch_register_lock); + ++ cancel_delayed_work_sync(&dc->writeback_rate_update); ++ if (!IS_ERR_OR_NULL(dc->writeback_thread)) { ++ kthread_stop(dc->writeback_thread); ++ dc->writeback_thread = NULL; ++ } ++ + memset(&dc->sb.set_uuid, 0, 16); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_NONE); + +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index cb115ba6a1d2..6d9adcaa26ba 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -332,6 +332,10 @@ static int __vb2_queue_alloc(struct vb2_queue *q, enum vb2_memory memory, + struct vb2_buffer *vb; + int ret; + ++ /* Ensure that q->num_buffers+num_buffers is below VB2_MAX_FRAME */ ++ num_buffers = min_t(unsigned int, num_buffers, ++ VB2_MAX_FRAME - q->num_buffers); ++ + for (buffer = 0; buffer < num_buffers; ++buffer) { + /* Allocate videobuf buffer structures */ + vb = kzalloc(q->buf_struct_size, GFP_KERNEL); +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 070f5da06fd2..5bedf4b7f0f7 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -806,6 +806,8 @@ static int intel_mrfld_mmc_probe_slot(struct sdhci_pci_slot *slot) + slot->host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V; + break; + case INTEL_MRFLD_SDIO: ++ /* Advertise 2.0v for compatibility with the SDIO card's OCR */ ++ slot->host->ocr_mask = MMC_VDD_20_21 | MMC_VDD_165_195; + slot->host->mmc->caps |= MMC_CAP_NONREMOVABLE | + MMC_CAP_POWER_OFF_CARD; + break; +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c +index 90cc1977b792..d35deb79965d 100644 +--- a/drivers/mmc/host/sdhci.c ++++ b/drivers/mmc/host/sdhci.c +@@ -1470,6 +1470,13 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode, + if (mode != MMC_POWER_OFF) { + switch (1 << vdd) { + case MMC_VDD_165_195: ++ /* ++ * Without a regulator, SDHCI does not support 2.0v ++ * so we only get here if the driver deliberately ++ * added the 2.0v range to ocr_avail. Map it to 1.8v ++ * for the purpose of turning on the power. ++ */ ++ case MMC_VDD_20_21: + pwr = SDHCI_POWER_180; + break; + case MMC_VDD_29_30: +diff --git a/drivers/mtd/tests/oobtest.c b/drivers/mtd/tests/oobtest.c +index 1cb3f7758fb6..766b2c385682 100644 +--- a/drivers/mtd/tests/oobtest.c ++++ b/drivers/mtd/tests/oobtest.c +@@ -193,6 +193,9 @@ static int verify_eraseblock(int ebnum) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != use_len) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -227,6 +230,9 @@ static int verify_eraseblock(int ebnum) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != mtd->oobavail) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -286,6 +292,9 @@ static int verify_eraseblock_in_one_go(int ebnum) + + /* read entire block's OOB at one go */ + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err || ops.oobretlen != len) { + pr_err("error: readoob failed at %#llx\n", + (long long)addr); +@@ -527,6 +536,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to start read past end of OOB\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, addr0, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -571,6 +583,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to read past end of device\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -615,6 +630,9 @@ static int __init mtd_oobtest_init(void) + pr_info("attempting to read past end of device\n"); + pr_info("an error is expected...\n"); + err = mtd_read_oob(mtd, mtd->size - mtd->writesize, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) { + pr_info("error occurred as expected\n"); + err = 0; +@@ -684,6 +702,9 @@ static int __init mtd_oobtest_init(void) + ops.datbuf = NULL; + ops.oobbuf = readbuf; + err = mtd_read_oob(mtd, addr, &ops); ++ if (mtd_is_bitflip(err)) ++ err = 0; ++ + if (err) + goto out; + if (memcmpshow(addr, readbuf, writebuf, +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index b2db581131b2..82f28ffccddf 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1524,39 +1524,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_close; + } + +- /* If the mode uses primary, then the following is handled by +- * bond_change_active_slave(). +- */ +- if (!bond_uses_primary(bond)) { +- /* set promiscuity level to new slave */ +- if (bond_dev->flags & IFF_PROMISC) { +- res = dev_set_promiscuity(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- /* set allmulti level to new slave */ +- if (bond_dev->flags & IFF_ALLMULTI) { +- res = dev_set_allmulti(slave_dev, 1); +- if (res) +- goto err_close; +- } +- +- netif_addr_lock_bh(bond_dev); +- +- dev_mc_sync_multiple(slave_dev, bond_dev); +- dev_uc_sync_multiple(slave_dev, bond_dev); +- +- netif_addr_unlock_bh(bond_dev); +- } +- +- if (BOND_MODE(bond) == BOND_MODE_8023AD) { +- /* add lacpdu mc addr to mc list */ +- u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; +- +- dev_mc_add(slave_dev, lacpdu_multicast); +- } +- + res = vlan_vids_add_by_dev(slave_dev, bond_dev); + if (res) { + netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", +@@ -1721,6 +1688,40 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_upper_unlink; + } + ++ /* If the mode uses primary, then the following is handled by ++ * bond_change_active_slave(). ++ */ ++ if (!bond_uses_primary(bond)) { ++ /* set promiscuity level to new slave */ ++ if (bond_dev->flags & IFF_PROMISC) { ++ res = dev_set_promiscuity(slave_dev, 1); ++ if (res) ++ goto err_sysfs_del; ++ } ++ ++ /* set allmulti level to new slave */ ++ if (bond_dev->flags & IFF_ALLMULTI) { ++ res = dev_set_allmulti(slave_dev, 1); ++ if (res) { ++ if (bond_dev->flags & IFF_PROMISC) ++ dev_set_promiscuity(slave_dev, -1); ++ goto err_sysfs_del; ++ } ++ } ++ ++ netif_addr_lock_bh(bond_dev); ++ dev_mc_sync_multiple(slave_dev, bond_dev); ++ dev_uc_sync_multiple(slave_dev, bond_dev); ++ netif_addr_unlock_bh(bond_dev); ++ ++ if (BOND_MODE(bond) == BOND_MODE_8023AD) { ++ /* add lacpdu mc addr to mc list */ ++ u8 lacpdu_multicast[ETH_ALEN] = MULTICAST_LACPDU_ADDR; ++ ++ dev_mc_add(slave_dev, lacpdu_multicast); ++ } ++ } ++ + bond->slave_cnt++; + bond_compute_features(bond); + bond_set_carrier(bond); +@@ -1744,6 +1745,9 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + return 0; + + /* Undo stages on error */ ++err_sysfs_del: ++ bond_sysfs_slave_del(new_slave); ++ + err_upper_unlink: + bond_upper_dev_unlink(bond, new_slave); + +@@ -1751,9 +1755,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + netdev_rx_handler_unregister(slave_dev); + + err_detach: +- if (!bond_uses_primary(bond)) +- bond_hw_addr_flush(bond_dev, slave_dev); +- + vlan_vids_del_by_dev(slave_dev, bond_dev); + if (rcu_access_pointer(bond->primary_slave) == new_slave) + RCU_INIT_POINTER(bond->primary_slave, NULL); +diff --git a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +index 05498e7f2840..6246003f9922 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4vf/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb4vf/sge.c +@@ -2619,8 +2619,8 @@ void t4vf_sge_stop(struct adapter *adapter) + int t4vf_sge_init(struct adapter *adapter) + { + struct sge_params *sge_params = &adapter->params.sge; +- u32 fl0 = sge_params->sge_fl_buffer_size[0]; +- u32 fl1 = sge_params->sge_fl_buffer_size[1]; ++ u32 fl_small_pg = sge_params->sge_fl_buffer_size[0]; ++ u32 fl_large_pg = sge_params->sge_fl_buffer_size[1]; + struct sge *s = &adapter->sge; + + /* +@@ -2628,9 +2628,20 @@ int t4vf_sge_init(struct adapter *adapter) + * the Physical Function Driver. Ideally we should be able to deal + * with _any_ configuration. Practice is different ... + */ +- if (fl0 != PAGE_SIZE || (fl1 != 0 && fl1 <= fl0)) { ++ ++ /* We only bother using the Large Page logic if the Large Page Buffer ++ * is larger than our Page Size Buffer. ++ */ ++ if (fl_large_pg <= fl_small_pg) ++ fl_large_pg = 0; ++ ++ /* The Page Size Buffer must be exactly equal to our Page Size and the ++ * Large Page Size Buffer should be 0 (per above) or a power of 2. ++ */ ++ if (fl_small_pg != PAGE_SIZE || ++ (fl_large_pg & (fl_large_pg - 1)) != 0) { + dev_err(adapter->pdev_dev, "bad SGE FL buffer sizes [%d, %d]\n", +- fl0, fl1); ++ fl_small_pg, fl_large_pg); + return -EINVAL; + } + if ((sge_params->sge_control & RXPKTCPLMODE_F) != +@@ -2642,8 +2653,8 @@ int t4vf_sge_init(struct adapter *adapter) + /* + * Now translate the adapter parameters into our internal forms. + */ +- if (fl1) +- s->fl_pg_order = ilog2(fl1) - PAGE_SHIFT; ++ if (fl_large_pg) ++ s->fl_pg_order = ilog2(fl_large_pg) - PAGE_SHIFT; + s->stat_len = ((sge_params->sge_control & EGRSTATUSPAGESIZE_F) + ? 128 : 64); + s->pktshift = PKTSHIFT_G(sge_params->sge_control); +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index a0ef97e7f3c9..ff7a70ffafc6 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -2092,6 +2092,10 @@ static int hclge_get_autoneg(struct hnae3_handle *handle) + { + struct hclge_vport *vport = hclge_get_vport(handle); + struct hclge_dev *hdev = vport->back; ++ struct phy_device *phydev = hdev->hw.mac.phydev; ++ ++ if (phydev) ++ return phydev->autoneg; + + hclge_query_autoneg_result(hdev); + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +index 186772493711..d1e4dcec5db2 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +@@ -1060,6 +1060,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + u64 rx_bytes = 0; + u64 tx_pkts = 0; + u64 rx_pkts = 0; ++ u64 tx_drop = 0; ++ u64 rx_drop = 0; + + for (idx = 0; idx < queue_num; idx++) { + /* fetch the tx stats */ +@@ -1068,6 +1070,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + start = u64_stats_fetch_begin_irq(&ring->syncp); + tx_bytes += ring->stats.tx_bytes; + tx_pkts += ring->stats.tx_pkts; ++ tx_drop += ring->stats.tx_busy; ++ tx_drop += ring->stats.sw_err_cnt; + } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + + /* fetch the rx stats */ +@@ -1076,6 +1080,9 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + start = u64_stats_fetch_begin_irq(&ring->syncp); + rx_bytes += ring->stats.rx_bytes; + rx_pkts += ring->stats.rx_pkts; ++ rx_drop += ring->stats.non_vld_descs; ++ rx_drop += ring->stats.err_pkt_len; ++ rx_drop += ring->stats.l2_err; + } while (u64_stats_fetch_retry_irq(&ring->syncp, start)); + } + +@@ -1091,8 +1098,8 @@ hns3_nic_get_stats64(struct net_device *netdev, struct rtnl_link_stats64 *stats) + stats->rx_missed_errors = netdev->stats.rx_missed_errors; + + stats->tx_errors = netdev->stats.tx_errors; +- stats->rx_dropped = netdev->stats.rx_dropped; +- stats->tx_dropped = netdev->stats.tx_dropped; ++ stats->rx_dropped = rx_drop + netdev->stats.rx_dropped; ++ stats->tx_dropped = tx_drop + netdev->stats.tx_dropped; + stats->collisions = netdev->stats.collisions; + stats->rx_over_errors = netdev->stats.rx_over_errors; + stats->rx_frame_errors = netdev->stats.rx_frame_errors; +@@ -1306,6 +1313,8 @@ static int hns3_nic_change_mtu(struct net_device *netdev, int new_mtu) + return ret; + } + ++ netdev->mtu = new_mtu; ++ + /* if the netdev was running earlier, bring it up again */ + if (if_running && hns3_nic_net_open(netdev)) + ret = -EINVAL; +@@ -2687,8 +2696,12 @@ static int hns3_uninit_all_ring(struct hns3_nic_priv *priv) + h->ae_algo->ops->reset_queue(h, i); + + hns3_fini_ring(priv->ring_data[i].ring); ++ devm_kfree(priv->dev, priv->ring_data[i].ring); + hns3_fini_ring(priv->ring_data[i + h->kinfo.num_tqps].ring); ++ devm_kfree(priv->dev, ++ priv->ring_data[i + h->kinfo.num_tqps].ring); + } ++ devm_kfree(priv->dev, priv->ring_data); + + return 0; + } +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c +index e590d96e434a..a64a5a413d4d 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_ethtool.c +@@ -22,7 +22,8 @@ struct hns3_stats { + #define HNS3_TQP_STAT(_string, _member) { \ + .stats_string = _string, \ + .stats_size = FIELD_SIZEOF(struct ring_stats, _member), \ +- .stats_offset = offsetof(struct hns3_enet_ring, stats), \ ++ .stats_offset = offsetof(struct hns3_enet_ring, stats) +\ ++ offsetof(struct ring_stats, _member), \ + } \ + + static const struct hns3_stats hns3_txq_stats[] = { +@@ -189,13 +190,13 @@ static u64 *hns3_get_stats_tqps(struct hnae3_handle *handle, u64 *data) + struct hnae3_knic_private_info *kinfo = &handle->kinfo; + struct hns3_enet_ring *ring; + u8 *stat; +- u32 i; ++ int i, j; + + /* get stats for Tx */ + for (i = 0; i < kinfo->num_tqps; i++) { + ring = nic_priv->ring_data[i].ring; +- for (i = 0; i < HNS3_TXQ_STATS_COUNT; i++) { +- stat = (u8 *)ring + hns3_txq_stats[i].stats_offset; ++ for (j = 0; j < HNS3_TXQ_STATS_COUNT; j++) { ++ stat = (u8 *)ring + hns3_txq_stats[j].stats_offset; + *data++ = *(u64 *)stat; + } + } +@@ -203,8 +204,8 @@ static u64 *hns3_get_stats_tqps(struct hnae3_handle *handle, u64 *data) + /* get stats for Rx */ + for (i = 0; i < kinfo->num_tqps; i++) { + ring = nic_priv->ring_data[i + kinfo->num_tqps].ring; +- for (i = 0; i < HNS3_RXQ_STATS_COUNT; i++) { +- stat = (u8 *)ring + hns3_rxq_stats[i].stats_offset; ++ for (j = 0; j < HNS3_RXQ_STATS_COUNT; j++) { ++ stat = (u8 *)ring + hns3_rxq_stats[j].stats_offset; + *data++ = *(u64 *)stat; + } + } +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 3b0db01ead1f..3ae02b0620bc 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2209,6 +2209,12 @@ static irqreturn_t ibmvnic_interrupt_rx(int irq, void *instance) + struct ibmvnic_sub_crq_queue *scrq = instance; + struct ibmvnic_adapter *adapter = scrq->adapter; + ++ /* When booting a kdump kernel we can hit pending interrupts ++ * prior to completing driver initialization. ++ */ ++ if (unlikely(adapter->state != VNIC_OPEN)) ++ return IRQ_NONE; ++ + adapter->rx_stats_buffers[scrq->scrq_num].interrupts++; + + if (napi_schedule_prep(&adapter->napi[scrq->scrq_num])) { +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index 1ccad6f30ebf..4eb6ff60e8fc 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -1775,7 +1775,11 @@ static void i40evf_disable_vf(struct i40evf_adapter *adapter) + + adapter->flags |= I40EVF_FLAG_PF_COMMS_FAILED; + +- if (netif_running(adapter->netdev)) { ++ /* We don't use netif_running() because it may be true prior to ++ * ndo_open() returning, so we can't assume it means all our open ++ * tasks have finished, since we're not holding the rtnl_lock here. ++ */ ++ if (adapter->state == __I40EVF_RUNNING) { + set_bit(__I40E_VSI_DOWN, adapter->vsi.state); + netif_carrier_off(adapter->netdev); + netif_tx_disable(adapter->netdev); +@@ -1833,6 +1837,7 @@ static void i40evf_reset_task(struct work_struct *work) + struct i40evf_mac_filter *f; + u32 reg_val; + int i = 0, err; ++ bool running; + + while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, + &adapter->crit_section)) +@@ -1892,7 +1897,13 @@ static void i40evf_reset_task(struct work_struct *work) + } + + continue_reset: +- if (netif_running(netdev)) { ++ /* We don't use netif_running() because it may be true prior to ++ * ndo_open() returning, so we can't assume it means all our open ++ * tasks have finished, since we're not holding the rtnl_lock here. ++ */ ++ running = (adapter->state == __I40EVF_RUNNING); ++ ++ if (running) { + netif_carrier_off(netdev); + netif_tx_stop_all_queues(netdev); + adapter->link_up = false; +@@ -1936,7 +1947,10 @@ static void i40evf_reset_task(struct work_struct *work) + + mod_timer(&adapter->watchdog_timer, jiffies + 2); + +- if (netif_running(adapter->netdev)) { ++ /* We were running when the reset started, so we need to restore some ++ * state here. ++ */ ++ if (running) { + /* allocate transmit descriptors */ + err = i40evf_setup_all_tx_resources(adapter); + if (err) +diff --git a/drivers/net/ethernet/marvell/sky2.c b/drivers/net/ethernet/marvell/sky2.c +index 1145cde2274a..b12e3a4f9439 100644 +--- a/drivers/net/ethernet/marvell/sky2.c ++++ b/drivers/net/ethernet/marvell/sky2.c +@@ -5087,7 +5087,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + INIT_WORK(&hw->restart_work, sky2_restart); + + pci_set_drvdata(pdev, hw); +- pdev->d3_delay = 150; ++ pdev->d3_delay = 200; + + return 0; + +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c +index 5f41dc92aa68..752a72499b4f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_dcb_nl.c +@@ -156,57 +156,63 @@ static int mlx4_en_dcbnl_getnumtcs(struct net_device *netdev, int tcid, u8 *num) + static u8 mlx4_en_dcbnl_set_all(struct net_device *netdev) + { + struct mlx4_en_priv *priv = netdev_priv(netdev); ++ struct mlx4_en_port_profile *prof = priv->prof; + struct mlx4_en_dev *mdev = priv->mdev; ++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp; + + if (!(priv->dcbx_cap & DCB_CAP_DCBX_VER_CEE)) + return 1; + + if (priv->cee_config.pfc_state) { + int tc; ++ rx_ppp = prof->rx_ppp; ++ tx_ppp = prof->tx_ppp; + +- priv->prof->rx_pause = 0; +- priv->prof->tx_pause = 0; + for (tc = 0; tc < CEE_DCBX_MAX_PRIO; tc++) { + u8 tc_mask = 1 << tc; + + switch (priv->cee_config.dcb_pfc[tc]) { + case pfc_disabled: +- priv->prof->tx_ppp &= ~tc_mask; +- priv->prof->rx_ppp &= ~tc_mask; ++ tx_ppp &= ~tc_mask; ++ rx_ppp &= ~tc_mask; + break; + case pfc_enabled_full: +- priv->prof->tx_ppp |= tc_mask; +- priv->prof->rx_ppp |= tc_mask; ++ tx_ppp |= tc_mask; ++ rx_ppp |= tc_mask; + break; + case pfc_enabled_tx: +- priv->prof->tx_ppp |= tc_mask; +- priv->prof->rx_ppp &= ~tc_mask; ++ tx_ppp |= tc_mask; ++ rx_ppp &= ~tc_mask; + break; + case pfc_enabled_rx: +- priv->prof->tx_ppp &= ~tc_mask; +- priv->prof->rx_ppp |= tc_mask; ++ tx_ppp &= ~tc_mask; ++ rx_ppp |= tc_mask; + break; + default: + break; + } + } +- en_dbg(DRV, priv, "Set pfc on\n"); ++ rx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->rx_pause; ++ tx_pause = !!(rx_ppp || tx_ppp) ? 0 : prof->tx_pause; + } else { +- priv->prof->rx_pause = 1; +- priv->prof->tx_pause = 1; +- en_dbg(DRV, priv, "Set pfc off\n"); ++ rx_ppp = 0; ++ tx_ppp = 0; ++ rx_pause = prof->rx_pause; ++ tx_pause = prof->tx_pause; + } + + if (mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- priv->prof->tx_pause, +- priv->prof->tx_ppp, +- priv->prof->rx_pause, +- priv->prof->rx_ppp)) { ++ tx_pause, tx_ppp, rx_pause, rx_ppp)) { + en_err(priv, "Failed setting pause params\n"); + return 1; + } + ++ prof->tx_ppp = tx_ppp; ++ prof->rx_ppp = rx_ppp; ++ prof->tx_pause = tx_pause; ++ prof->rx_pause = rx_pause; ++ + return 0; + } + +@@ -310,6 +316,7 @@ static int mlx4_en_ets_validate(struct mlx4_en_priv *priv, struct ieee_ets *ets) + } + + switch (ets->tc_tsa[i]) { ++ case IEEE_8021QAZ_TSA_VENDOR: + case IEEE_8021QAZ_TSA_STRICT: + break; + case IEEE_8021QAZ_TSA_ETS: +@@ -347,6 +354,10 @@ static int mlx4_en_config_port_scheduler(struct mlx4_en_priv *priv, + /* higher TC means higher priority => lower pg */ + for (i = IEEE_8021QAZ_MAX_TCS - 1; i >= 0; i--) { + switch (ets->tc_tsa[i]) { ++ case IEEE_8021QAZ_TSA_VENDOR: ++ pg[i] = MLX4_EN_TC_VENDOR; ++ tc_tx_bw[i] = MLX4_EN_BW_MAX; ++ break; + case IEEE_8021QAZ_TSA_STRICT: + pg[i] = num_strict++; + tc_tx_bw[i] = MLX4_EN_BW_MAX; +@@ -403,6 +414,7 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev, + struct mlx4_en_priv *priv = netdev_priv(dev); + struct mlx4_en_port_profile *prof = priv->prof; + struct mlx4_en_dev *mdev = priv->mdev; ++ u32 tx_pause, tx_ppp, rx_pause, rx_ppp; + int err; + + en_dbg(DRV, priv, "cap: 0x%x en: 0x%x mbc: 0x%x delay: %d\n", +@@ -411,23 +423,26 @@ static int mlx4_en_dcbnl_ieee_setpfc(struct net_device *dev, + pfc->mbc, + pfc->delay); + +- prof->rx_pause = !pfc->pfc_en; +- prof->tx_pause = !pfc->pfc_en; +- prof->rx_ppp = pfc->pfc_en; +- prof->tx_ppp = pfc->pfc_en; ++ rx_pause = prof->rx_pause && !pfc->pfc_en; ++ tx_pause = prof->tx_pause && !pfc->pfc_en; ++ rx_ppp = pfc->pfc_en; ++ tx_ppp = pfc->pfc_en; + + err = mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- prof->tx_pause, +- prof->tx_ppp, +- prof->rx_pause, +- prof->rx_ppp); +- if (err) ++ tx_pause, tx_ppp, rx_pause, rx_ppp); ++ if (err) { + en_err(priv, "Failed setting pause params\n"); +- else +- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, +- prof->rx_ppp, prof->rx_pause, +- prof->tx_ppp, prof->tx_pause); ++ return err; ++ } ++ ++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, ++ rx_ppp, rx_pause, tx_ppp, tx_pause); ++ ++ prof->tx_ppp = tx_ppp; ++ prof->rx_ppp = rx_ppp; ++ prof->rx_pause = rx_pause; ++ prof->tx_pause = tx_pause; + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index 3d4e4a5d00d1..67f74fcb265e 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1046,27 +1046,32 @@ static int mlx4_en_set_pauseparam(struct net_device *dev, + { + struct mlx4_en_priv *priv = netdev_priv(dev); + struct mlx4_en_dev *mdev = priv->mdev; ++ u8 tx_pause, tx_ppp, rx_pause, rx_ppp; + int err; + + if (pause->autoneg) + return -EINVAL; + +- priv->prof->tx_pause = pause->tx_pause != 0; +- priv->prof->rx_pause = pause->rx_pause != 0; ++ tx_pause = !!(pause->tx_pause); ++ rx_pause = !!(pause->rx_pause); ++ rx_ppp = priv->prof->rx_ppp && !(tx_pause || rx_pause); ++ tx_ppp = priv->prof->tx_ppp && !(tx_pause || rx_pause); ++ + err = mlx4_SET_PORT_general(mdev->dev, priv->port, + priv->rx_skb_size + ETH_FCS_LEN, +- priv->prof->tx_pause, +- priv->prof->tx_ppp, +- priv->prof->rx_pause, +- priv->prof->rx_ppp); +- if (err) +- en_err(priv, "Failed setting pause params\n"); +- else +- mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, +- priv->prof->rx_ppp, +- priv->prof->rx_pause, +- priv->prof->tx_ppp, +- priv->prof->tx_pause); ++ tx_pause, tx_ppp, rx_pause, rx_ppp); ++ if (err) { ++ en_err(priv, "Failed setting pause params, err = %d\n", err); ++ return err; ++ } ++ ++ mlx4_en_update_pfc_stats_bitmap(mdev->dev, &priv->stats_bitmap, ++ rx_ppp, rx_pause, tx_ppp, tx_pause); ++ ++ priv->prof->tx_pause = tx_pause; ++ priv->prof->rx_pause = rx_pause; ++ priv->prof->tx_ppp = tx_ppp; ++ priv->prof->rx_ppp = rx_ppp; + + return err; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_main.c b/drivers/net/ethernet/mellanox/mlx4/en_main.c +index 686e18de9a97..6b2f7122b3ab 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_main.c +@@ -163,9 +163,9 @@ static void mlx4_en_get_profile(struct mlx4_en_dev *mdev) + params->udp_rss = 0; + } + for (i = 1; i <= MLX4_MAX_PORTS; i++) { +- params->prof[i].rx_pause = 1; ++ params->prof[i].rx_pause = !(pfcrx || pfctx); + params->prof[i].rx_ppp = pfcrx; +- params->prof[i].tx_pause = 1; ++ params->prof[i].tx_pause = !(pfcrx || pfctx); + params->prof[i].tx_ppp = pfctx; + params->prof[i].tx_ring_size = MLX4_EN_DEF_TX_RING_SIZE; + params->prof[i].rx_ring_size = MLX4_EN_DEF_RX_RING_SIZE; +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 9c218f1cfc6c..c097eef41a9c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -3335,6 +3335,13 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + priv->msg_enable = MLX4_EN_MSG_LEVEL; + #ifdef CONFIG_MLX4_EN_DCB + if (!mlx4_is_slave(priv->mdev->dev)) { ++ u8 prio; ++ ++ for (prio = 0; prio < IEEE_8021QAZ_MAX_TCS; ++prio) { ++ priv->ets.prio_tc[prio] = prio; ++ priv->ets.tc_tsa[prio] = IEEE_8021QAZ_TSA_VENDOR; ++ } ++ + priv->dcbx_cap = DCB_CAP_DCBX_VER_CEE | DCB_CAP_DCBX_HOST | + DCB_CAP_DCBX_VER_IEEE; + priv->flags |= MLX4_EN_DCB_ENABLED; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index fdb3ad0cbe54..2c1a5ff6acfa 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -476,6 +476,7 @@ struct mlx4_en_frag_info { + #define MLX4_EN_BW_MIN 1 + #define MLX4_EN_BW_MAX 100 /* Utilize 100% of the line */ + ++#define MLX4_EN_TC_VENDOR 0 + #define MLX4_EN_TC_ETS 7 + + enum dcb_pfc_type { +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index fabb53379727..a069fcc823c3 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -5089,6 +5089,7 @@ static void rem_slave_fs_rule(struct mlx4_dev *dev, int slave) + &tracker->res_tree[RES_FS_RULE]); + list_del(&fs_rule->com.list); + spin_unlock_irq(mlx4_tlock(dev)); ++ kfree(fs_rule->mirr_mbox); + kfree(fs_rule); + state = 0; + break; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index a863572882b2..225b2ad3e15f 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2718,6 +2718,9 @@ int mlx5e_open(struct net_device *netdev) + mlx5_set_port_admin_status(priv->mdev, MLX5_PORT_UP); + mutex_unlock(&priv->state_lock); + ++ if (mlx5e_vxlan_allowed(priv->mdev)) ++ udp_tunnel_get_rx_info(netdev); ++ + return err; + } + +@@ -4276,13 +4279,6 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv) + if (netdev->reg_state != NETREG_REGISTERED) + return; + +- /* Device already registered: sync netdev system state */ +- if (mlx5e_vxlan_allowed(mdev)) { +- rtnl_lock(); +- udp_tunnel_get_rx_info(netdev); +- rtnl_unlock(); +- } +- + queue_work(priv->wq, &priv->set_rx_mode_work); + + rtnl_lock(); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 45e03c427faf..5ffd1db4e797 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -43,6 +43,11 @@ + #include "en_tc.h" + #include "fs_core.h" + ++#define MLX5E_REP_PARAMS_LOG_SQ_SIZE \ ++ max(0x6, MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE) ++#define MLX5E_REP_PARAMS_LOG_RQ_SIZE \ ++ max(0x6, MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE) ++ + static const char mlx5e_rep_driver_name[] = "mlx5e_rep"; + + static void mlx5e_rep_get_drvinfo(struct net_device *dev, +@@ -230,7 +235,7 @@ void mlx5e_remove_sqs_fwd_rules(struct mlx5e_priv *priv) + static void mlx5e_rep_neigh_update_init_interval(struct mlx5e_rep_priv *rpriv) + { + #if IS_ENABLED(CONFIG_IPV6) +- unsigned long ipv6_interval = NEIGH_VAR(&ipv6_stub->nd_tbl->parms, ++ unsigned long ipv6_interval = NEIGH_VAR(&nd_tbl.parms, + DELAY_PROBE_TIME); + #else + unsigned long ipv6_interval = ~0UL; +@@ -366,7 +371,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb, + case NETEVENT_NEIGH_UPDATE: + n = ptr; + #if IS_ENABLED(CONFIG_IPV6) +- if (n->tbl != ipv6_stub->nd_tbl && n->tbl != &arp_tbl) ++ if (n->tbl != &nd_tbl && n->tbl != &arp_tbl) + #else + if (n->tbl != &arp_tbl) + #endif +@@ -414,7 +419,7 @@ static int mlx5e_rep_netevent_event(struct notifier_block *nb, + * done per device delay prob time parameter. + */ + #if IS_ENABLED(CONFIG_IPV6) +- if (!p->dev || (p->tbl != ipv6_stub->nd_tbl && p->tbl != &arp_tbl)) ++ if (!p->dev || (p->tbl != &nd_tbl && p->tbl != &arp_tbl)) + #else + if (!p->dev || p->tbl != &arp_tbl) + #endif +@@ -610,7 +615,6 @@ static int mlx5e_rep_open(struct net_device *dev) + struct mlx5e_priv *priv = netdev_priv(dev); + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch_rep *rep = rpriv->rep; +- struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + int err; + + mutex_lock(&priv->state_lock); +@@ -618,8 +622,9 @@ static int mlx5e_rep_open(struct net_device *dev) + if (err) + goto unlock; + +- if (!mlx5_eswitch_set_vport_state(esw, rep->vport, +- MLX5_ESW_VPORT_ADMIN_STATE_UP)) ++ if (!mlx5_modify_vport_admin_state(priv->mdev, ++ MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT, ++ rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_UP)) + netif_carrier_on(dev); + + unlock: +@@ -632,11 +637,12 @@ static int mlx5e_rep_close(struct net_device *dev) + struct mlx5e_priv *priv = netdev_priv(dev); + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch_rep *rep = rpriv->rep; +- struct mlx5_eswitch *esw = priv->mdev->priv.eswitch; + int ret; + + mutex_lock(&priv->state_lock); +- (void)mlx5_eswitch_set_vport_state(esw, rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN); ++ mlx5_modify_vport_admin_state(priv->mdev, ++ MLX5_QUERY_VPORT_STATE_IN_OP_MOD_ESW_VPORT, ++ rep->vport, MLX5_ESW_VPORT_ADMIN_STATE_DOWN); + ret = mlx5e_close_locked(dev); + mutex_unlock(&priv->state_lock); + return ret; +@@ -797,9 +803,9 @@ static void mlx5e_build_rep_params(struct mlx5_core_dev *mdev, + MLX5_CQ_PERIOD_MODE_START_FROM_CQE : + MLX5_CQ_PERIOD_MODE_START_FROM_EQE; + +- params->log_sq_size = MLX5E_PARAMS_MINIMUM_LOG_SQ_SIZE; ++ params->log_sq_size = MLX5E_REP_PARAMS_LOG_SQ_SIZE; + params->rq_wq_type = MLX5_WQ_TYPE_LINKED_LIST; +- params->log_rq_size = MLX5E_PARAMS_MINIMUM_LOG_RQ_SIZE; ++ params->log_rq_size = MLX5E_REP_PARAMS_LOG_RQ_SIZE; + + params->rx_am_enabled = MLX5_CAP_GEN(mdev, cq_moderation); + mlx5e_set_rx_cq_mode_params(params, cq_period_mode); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 9ba1f72060aa..42bab73a9f40 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -484,7 +484,7 @@ void mlx5e_tc_update_neigh_used_value(struct mlx5e_neigh_hash_entry *nhe) + tbl = &arp_tbl; + #if IS_ENABLED(CONFIG_IPV6) + else if (m_neigh->family == AF_INET6) +- tbl = ipv6_stub->nd_tbl; ++ tbl = &nd_tbl; + #endif + else + return; +@@ -2091,19 +2091,19 @@ int mlx5e_configure_flower(struct mlx5e_priv *priv, + if (err != -EAGAIN) + flow->flags |= MLX5E_TC_FLOW_OFFLOADED; + ++ if (!(flow->flags & MLX5E_TC_FLOW_ESWITCH) || ++ !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)) ++ kvfree(parse_attr); ++ + err = rhashtable_insert_fast(&tc->ht, &flow->node, + tc->ht_params); +- if (err) +- goto err_del_rule; ++ if (err) { ++ mlx5e_tc_del_flow(priv, flow); ++ kfree(flow); ++ } + +- if (flow->flags & MLX5E_TC_FLOW_ESWITCH && +- !(flow->esw_attr->action & MLX5_FLOW_CONTEXT_ACTION_ENCAP)) +- kvfree(parse_attr); + return err; + +-err_del_rule: +- mlx5e_tc_del_flow(priv, flow); +- + err_free: + kvfree(parse_attr); + kfree(flow); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/vport.c b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +index a1296a62497d..71153c0f1605 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/vport.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/vport.c +@@ -36,6 +36,9 @@ + #include + #include "mlx5_core.h" + ++/* Mutex to hold while enabling or disabling RoCE */ ++static DEFINE_MUTEX(mlx5_roce_en_lock); ++ + static int _mlx5_query_vport_state(struct mlx5_core_dev *mdev, u8 opmod, + u16 vport, u32 *out, int outlen) + { +@@ -998,17 +1001,35 @@ static int mlx5_nic_vport_update_roce_state(struct mlx5_core_dev *mdev, + + int mlx5_nic_vport_enable_roce(struct mlx5_core_dev *mdev) + { +- if (atomic_inc_return(&mdev->roce.roce_en) != 1) +- return 0; +- return mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_ENABLED); ++ int err = 0; ++ ++ mutex_lock(&mlx5_roce_en_lock); ++ if (!mdev->roce.roce_en) ++ err = mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_ENABLED); ++ ++ if (!err) ++ mdev->roce.roce_en++; ++ mutex_unlock(&mlx5_roce_en_lock); ++ ++ return err; + } + EXPORT_SYMBOL_GPL(mlx5_nic_vport_enable_roce); + + int mlx5_nic_vport_disable_roce(struct mlx5_core_dev *mdev) + { +- if (atomic_dec_return(&mdev->roce.roce_en) != 0) +- return 0; +- return mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_DISABLED); ++ int err = 0; ++ ++ mutex_lock(&mlx5_roce_en_lock); ++ if (mdev->roce.roce_en) { ++ mdev->roce.roce_en--; ++ if (mdev->roce.roce_en == 0) ++ err = mlx5_nic_vport_update_roce_state(mdev, MLX5_VPORT_ROCE_DISABLED); ++ ++ if (err) ++ mdev->roce.roce_en++; ++ } ++ mutex_unlock(&mlx5_roce_en_lock); ++ return err; + } + EXPORT_SYMBOL_GPL(mlx5_nic_vport_disable_roce); + +diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +index 37364555c42b..f88ff3f4b661 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +@@ -68,10 +68,11 @@ + /* CPP address to retrieve the data from */ + #define NSP_BUFFER 0x10 + #define NSP_BUFFER_CPP GENMASK_ULL(63, 40) +-#define NSP_BUFFER_PCIE GENMASK_ULL(39, 38) +-#define NSP_BUFFER_ADDRESS GENMASK_ULL(37, 0) ++#define NSP_BUFFER_ADDRESS GENMASK_ULL(39, 0) + + #define NSP_DFLT_BUFFER 0x18 ++#define NSP_DFLT_BUFFER_CPP GENMASK_ULL(63, 40) ++#define NSP_DFLT_BUFFER_ADDRESS GENMASK_ULL(39, 0) + + #define NSP_DFLT_BUFFER_CONFIG 0x20 + #define NSP_DFLT_BUFFER_SIZE_MB GENMASK_ULL(7, 0) +@@ -412,8 +413,8 @@ static int nfp_nsp_command_buf(struct nfp_nsp *nsp, u16 code, u32 option, + if (err < 0) + return err; + +- cpp_id = FIELD_GET(NSP_BUFFER_CPP, reg) << 8; +- cpp_buf = FIELD_GET(NSP_BUFFER_ADDRESS, reg); ++ cpp_id = FIELD_GET(NSP_DFLT_BUFFER_CPP, reg) << 8; ++ cpp_buf = FIELD_GET(NSP_DFLT_BUFFER_ADDRESS, reg); + + if (in_buf && in_size) { + err = nfp_cpp_write(cpp, cpp_id, cpp_buf, in_buf, in_size); +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index 619a1b7281a0..db553d4e8d22 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -8466,12 +8466,12 @@ static int rtl_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_out_msi_5; + } + ++ pci_set_drvdata(pdev, dev); ++ + rc = register_netdev(dev); + if (rc < 0) + goto err_out_cnt_6; + +- pci_set_drvdata(pdev, dev); +- + netif_info(tp, probe, dev, "%s at 0x%p, %pM, XID %08x IRQ %d\n", + rtl_chip_infos[chipset].name, ioaddr, dev->dev_addr, + (u32)(RTL_R32(TxConfig) & 0x9cf0f8ff), pdev->irq); +diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c +index 6dde9a0cfe76..9b70a3af678e 100644 +--- a/drivers/net/ppp/pptp.c ++++ b/drivers/net/ppp/pptp.c +@@ -464,7 +464,6 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.mtu = dst_mtu(&rt->dst); + if (!po->chan.mtu) + po->chan.mtu = PPP_MRU; +- ip_rt_put(rt); + po->chan.mtu -= PPTP_HEADER_OVERHEAD; + + po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header); +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 23cd41c82210..2a366554c503 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1197,11 +1197,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_dev_open; + } + +- netif_addr_lock_bh(dev); +- dev_uc_sync_multiple(port_dev, dev); +- dev_mc_sync_multiple(port_dev, dev); +- netif_addr_unlock_bh(dev); +- + err = vlan_vids_add_by_dev(port_dev, dev); + if (err) { + netdev_err(dev, "Failed to add vlan ids to device %s\n", +@@ -1241,6 +1236,11 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_option_port_add; + } + ++ netif_addr_lock_bh(dev); ++ dev_uc_sync_multiple(port_dev, dev); ++ dev_mc_sync_multiple(port_dev, dev); ++ netif_addr_unlock_bh(dev); ++ + port->index = -1; + list_add_tail_rcu(&port->list, &team->port_list); + team_port_enable(team, port); +@@ -1265,8 +1265,6 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + vlan_vids_del_by_dev(port_dev, dev); + + err_vids_add: +- dev_uc_unsync(port_dev, dev); +- dev_mc_unsync(port_dev, dev); + dev_close(port_dev); + + err_dev_open: +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index a8dd1c7a08cb..89d82c4ee8df 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2863,8 +2863,7 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + if (ret < 0) { + netdev_warn(dev->net, + "lan78xx_setup_irq_domain() failed : %d", ret); +- kfree(pdata); +- return ret; ++ goto out1; + } + + dev->net->hard_header_len += TX_OVERHEAD; +@@ -2872,14 +2871,32 @@ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf) + + /* Init all registers */ + ret = lan78xx_reset(dev); ++ if (ret) { ++ netdev_warn(dev->net, "Registers INIT FAILED...."); ++ goto out2; ++ } + + ret = lan78xx_mdio_init(dev); ++ if (ret) { ++ netdev_warn(dev->net, "MDIO INIT FAILED....."); ++ goto out2; ++ } + + dev->net->flags |= IFF_MULTICAST; + + pdata->wol = WAKE_MAGIC; + + return ret; ++ ++out2: ++ lan78xx_remove_irq_domain(dev); ++ ++out1: ++ netdev_warn(dev->net, "Bind routine FAILED"); ++ cancel_work_sync(&pdata->set_multicast); ++ cancel_work_sync(&pdata->set_vlan); ++ kfree(pdata); ++ return ret; + } + + static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf) +@@ -2891,6 +2908,8 @@ static void lan78xx_unbind(struct lan78xx_net *dev, struct usb_interface *intf) + lan78xx_remove_mdio(dev); + + if (pdata) { ++ cancel_work_sync(&pdata->set_multicast); ++ cancel_work_sync(&pdata->set_vlan); + netif_dbg(dev, ifdown, dev->net, "free pdata"); + kfree(pdata); + pdata = NULL; +diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c +index 67ecf2425b88..5c6a8ef54aec 100644 +--- a/drivers/net/vrf.c ++++ b/drivers/net/vrf.c +@@ -579,12 +579,13 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + if (!IS_ERR(neigh)) { + sock_confirm_neigh(skb, neigh); + ret = neigh_output(neigh, skb); ++ rcu_read_unlock_bh(); ++ return ret; + } + + rcu_read_unlock_bh(); + err: +- if (unlikely(ret < 0)) +- vrf_tx_error(skb->dev, skb); ++ vrf_tx_error(skb->dev, skb); + return ret; + } + +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +index ecc96312a370..6fe0c6abe0d6 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c +@@ -142,15 +142,25 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, + if (!rt2x00dev->ops->hw->set_rts_threshold && + (tx_info->control.rates[0].flags & (IEEE80211_TX_RC_USE_RTS_CTS | + IEEE80211_TX_RC_USE_CTS_PROTECT))) { +- if (rt2x00queue_available(queue) <= 1) +- goto exit_fail; ++ if (rt2x00queue_available(queue) <= 1) { ++ /* ++ * Recheck for full queue under lock to avoid race ++ * conditions with rt2x00lib_txdone(). ++ */ ++ spin_lock(&queue->tx_lock); ++ if (rt2x00queue_threshold(queue)) ++ rt2x00queue_pause_queue(queue); ++ spin_unlock(&queue->tx_lock); ++ ++ goto exit_free_skb; ++ } + + if (rt2x00mac_tx_rts_cts(rt2x00dev, queue, skb)) +- goto exit_fail; ++ goto exit_free_skb; + } + + if (unlikely(rt2x00queue_write_tx_frame(queue, skb, control->sta, false))) +- goto exit_fail; ++ goto exit_free_skb; + + /* + * Pausing queue has to be serialized with rt2x00lib_txdone(). Note +@@ -164,10 +174,6 @@ void rt2x00mac_tx(struct ieee80211_hw *hw, + + return; + +- exit_fail: +- spin_lock(&queue->tx_lock); +- rt2x00queue_pause_queue(queue); +- spin_unlock(&queue->tx_lock); + exit_free_skb: + ieee80211_free_txskb(hw, skb); + } +diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c +index 6d02c660b4ab..037defd10b91 100644 +--- a/drivers/net/wireless/ti/wl1251/main.c ++++ b/drivers/net/wireless/ti/wl1251/main.c +@@ -1200,8 +1200,7 @@ static void wl1251_op_bss_info_changed(struct ieee80211_hw *hw, + WARN_ON(wl->bss_type != BSS_TYPE_STA_BSS); + + enable = bss_conf->arp_addr_cnt == 1 && bss_conf->assoc; +- wl1251_acx_arp_ip_filter(wl, enable, addr); +- ++ ret = wl1251_acx_arp_ip_filter(wl, enable, addr); + if (ret < 0) + goto out_sleep; + } +diff --git a/drivers/nvme/target/fcloop.c b/drivers/nvme/target/fcloop.c +index 7b75d9de55ab..c0080f6ab2f5 100644 +--- a/drivers/nvme/target/fcloop.c ++++ b/drivers/nvme/target/fcloop.c +@@ -204,6 +204,10 @@ struct fcloop_lport { + struct completion unreg_done; + }; + ++struct fcloop_lport_priv { ++ struct fcloop_lport *lport; ++}; ++ + struct fcloop_rport { + struct nvme_fc_remote_port *remoteport; + struct nvmet_fc_target_port *targetport; +@@ -370,6 +374,7 @@ fcloop_tgt_fcprqst_done_work(struct work_struct *work) + + spin_lock(&tfcp_req->reqlock); + fcpreq = tfcp_req->fcpreq; ++ tfcp_req->fcpreq = NULL; + spin_unlock(&tfcp_req->reqlock); + + if (tport->remoteport && fcpreq) { +@@ -611,11 +616,7 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + + if (!tfcp_req) + /* abort has already been called */ +- return; +- +- if (rport->targetport) +- nvmet_fc_rcv_fcp_abort(rport->targetport, +- &tfcp_req->tgt_fcp_req); ++ goto finish; + + /* break initiator/target relationship for io */ + spin_lock(&tfcp_req->reqlock); +@@ -623,6 +624,11 @@ fcloop_fcp_abort(struct nvme_fc_local_port *localport, + tfcp_req->fcpreq = NULL; + spin_unlock(&tfcp_req->reqlock); + ++ if (rport->targetport) ++ nvmet_fc_rcv_fcp_abort(rport->targetport, ++ &tfcp_req->tgt_fcp_req); ++ ++finish: + /* post the aborted io completion */ + fcpreq->status = -ECANCELED; + schedule_work(&inireq->iniwork); +@@ -657,7 +663,8 @@ fcloop_nport_get(struct fcloop_nport *nport) + static void + fcloop_localport_delete(struct nvme_fc_local_port *localport) + { +- struct fcloop_lport *lport = localport->private; ++ struct fcloop_lport_priv *lport_priv = localport->private; ++ struct fcloop_lport *lport = lport_priv->lport; + + /* release any threads waiting for the unreg to complete */ + complete(&lport->unreg_done); +@@ -697,7 +704,7 @@ static struct nvme_fc_port_template fctemplate = { + .max_dif_sgl_segments = FCLOOP_SGL_SEGS, + .dma_boundary = FCLOOP_DMABOUND_4G, + /* sizes of additional private data for data structures */ +- .local_priv_sz = sizeof(struct fcloop_lport), ++ .local_priv_sz = sizeof(struct fcloop_lport_priv), + .remote_priv_sz = sizeof(struct fcloop_rport), + .lsrqst_priv_sz = sizeof(struct fcloop_lsreq), + .fcprqst_priv_sz = sizeof(struct fcloop_ini_fcpreq), +@@ -728,11 +735,17 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr, + struct fcloop_ctrl_options *opts; + struct nvme_fc_local_port *localport; + struct fcloop_lport *lport; +- int ret; ++ struct fcloop_lport_priv *lport_priv; ++ unsigned long flags; ++ int ret = -ENOMEM; ++ ++ lport = kzalloc(sizeof(*lport), GFP_KERNEL); ++ if (!lport) ++ return -ENOMEM; + + opts = kzalloc(sizeof(*opts), GFP_KERNEL); + if (!opts) +- return -ENOMEM; ++ goto out_free_lport; + + ret = fcloop_parse_options(opts, buf); + if (ret) +@@ -752,23 +765,25 @@ fcloop_create_local_port(struct device *dev, struct device_attribute *attr, + + ret = nvme_fc_register_localport(&pinfo, &fctemplate, NULL, &localport); + if (!ret) { +- unsigned long flags; +- + /* success */ +- lport = localport->private; ++ lport_priv = localport->private; ++ lport_priv->lport = lport; ++ + lport->localport = localport; + INIT_LIST_HEAD(&lport->lport_list); + + spin_lock_irqsave(&fcloop_lock, flags); + list_add_tail(&lport->lport_list, &fcloop_lports); + spin_unlock_irqrestore(&fcloop_lock, flags); +- +- /* mark all of the input buffer consumed */ +- ret = count; + } + + out_free_opts: + kfree(opts); ++out_free_lport: ++ /* free only if we're going to fail */ ++ if (ret) ++ kfree(lport); ++ + return ret ? ret : count; + } + +@@ -790,6 +805,8 @@ __wait_localport_unreg(struct fcloop_lport *lport) + + wait_for_completion(&lport->unreg_done); + ++ kfree(lport); ++ + return ret; + } + +diff --git a/drivers/pinctrl/intel/pinctrl-baytrail.c b/drivers/pinctrl/intel/pinctrl-baytrail.c +index 0f3a02495aeb..beeb7cbb5015 100644 +--- a/drivers/pinctrl/intel/pinctrl-baytrail.c ++++ b/drivers/pinctrl/intel/pinctrl-baytrail.c +@@ -46,6 +46,9 @@ + #define BYT_TRIG_POS BIT(25) + #define BYT_TRIG_LVL BIT(24) + #define BYT_DEBOUNCE_EN BIT(20) ++#define BYT_GLITCH_FILTER_EN BIT(19) ++#define BYT_GLITCH_F_SLOW_CLK BIT(17) ++#define BYT_GLITCH_F_FAST_CLK BIT(16) + #define BYT_PULL_STR_SHIFT 9 + #define BYT_PULL_STR_MASK (3 << BYT_PULL_STR_SHIFT) + #define BYT_PULL_STR_2K (0 << BYT_PULL_STR_SHIFT) +@@ -1579,6 +1582,9 @@ static int byt_irq_type(struct irq_data *d, unsigned int type) + */ + value &= ~(BYT_DIRECT_IRQ_EN | BYT_TRIG_POS | BYT_TRIG_NEG | + BYT_TRIG_LVL); ++ /* Enable glitch filtering */ ++ value |= BYT_GLITCH_FILTER_EN | BYT_GLITCH_F_SLOW_CLK | ++ BYT_GLITCH_F_FAST_CLK; + + writel(value, reg); + +diff --git a/drivers/power/supply/axp288_charger.c b/drivers/power/supply/axp288_charger.c +index d51ebd1da65e..9dc7590e07cb 100644 +--- a/drivers/power/supply/axp288_charger.c ++++ b/drivers/power/supply/axp288_charger.c +@@ -785,6 +785,14 @@ static int charger_init_hw_regs(struct axp288_chrg_info *info) + return 0; + } + ++static void axp288_charger_cancel_work(void *data) ++{ ++ struct axp288_chrg_info *info = data; ++ ++ cancel_work_sync(&info->otg.work); ++ cancel_work_sync(&info->cable.work); ++} ++ + static int axp288_charger_probe(struct platform_device *pdev) + { + int ret, i, pirq; +@@ -836,6 +844,11 @@ static int axp288_charger_probe(struct platform_device *pdev) + return ret; + } + ++ /* Cancel our work on cleanup, register this before the notifiers */ ++ ret = devm_add_action(dev, axp288_charger_cancel_work, info); ++ if (ret) ++ return ret; ++ + /* Register for extcon notification */ + INIT_WORK(&info->cable.work, axp288_charger_extcon_evt_worker); + info->cable.nb[0].notifier_call = axp288_charger_handle_cable0_evt; +diff --git a/drivers/rtc/rtc-ac100.c b/drivers/rtc/rtc-ac100.c +index 0e358d4b6738..8ff9dc3fe5bf 100644 +--- a/drivers/rtc/rtc-ac100.c ++++ b/drivers/rtc/rtc-ac100.c +@@ -137,13 +137,15 @@ static unsigned long ac100_clkout_recalc_rate(struct clk_hw *hw, + div = (reg >> AC100_CLKOUT_PRE_DIV_SHIFT) & + ((1 << AC100_CLKOUT_PRE_DIV_WIDTH) - 1); + prate = divider_recalc_rate(hw, prate, div, +- ac100_clkout_prediv, 0); ++ ac100_clkout_prediv, 0, ++ AC100_CLKOUT_PRE_DIV_WIDTH); + } + + div = (reg >> AC100_CLKOUT_DIV_SHIFT) & + (BIT(AC100_CLKOUT_DIV_WIDTH) - 1); + return divider_recalc_rate(hw, prate, div, NULL, +- CLK_DIVIDER_POWER_OF_TWO); ++ CLK_DIVIDER_POWER_OF_TWO, ++ AC100_CLKOUT_DIV_WIDTH); + } + + static long ac100_clkout_round_rate(struct clk_hw *hw, unsigned long rate, +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index f8dc1601efd5..bddbe2da5283 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -1696,6 +1696,15 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) + */ + switch (session->state) { + case ISCSI_STATE_FAILED: ++ /* ++ * cmds should fail during shutdown, if the session ++ * state is bad, allowing completion to happen ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ reason = FAILURE_SESSION_FAILED; ++ sc->result = DID_NO_CONNECT << 16; ++ break; ++ } + case ISCSI_STATE_IN_RECOVERY: + reason = FAILURE_SESSION_IN_RECOVERY; + sc->result = DID_IMM_RETRY << 16; +@@ -1980,6 +1989,19 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + } + + if (session->state != ISCSI_STATE_LOGGED_IN) { ++ /* ++ * During shutdown, if session is prematurely disconnected, ++ * recovery won't happen and there will be hung cmds. Not ++ * handling cmds would trigger EH, also bad in this case. ++ * Instead, handle cmd, allow completion to happen and let ++ * upper layer to deal with the result. ++ */ ++ if (unlikely(system_state != SYSTEM_RUNNING)) { ++ sc->result = DID_NO_CONNECT << 16; ++ ISCSI_DBG_EH(session, "sc on shutdown, handled\n"); ++ rc = BLK_EH_HANDLED; ++ goto done; ++ } + /* + * We are probably in the middle of iscsi recovery so let + * that complete and handle the error. +@@ -2084,7 +2106,7 @@ enum blk_eh_timer_return iscsi_eh_cmd_timed_out(struct scsi_cmnd *sc) + task->last_timeout = jiffies; + spin_unlock(&session->frwd_lock); + ISCSI_DBG_EH(session, "return %s\n", rc == BLK_EH_RESET_TIMER ? +- "timer reset" : "nh"); ++ "timer reset" : "shutdown or nh"); + return rc; + } + EXPORT_SYMBOL_GPL(iscsi_eh_cmd_timed_out); +diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c +index 324d8d8c62de..e2ea389fbec3 100644 +--- a/drivers/scsi/libsas/sas_expander.c ++++ b/drivers/scsi/libsas/sas_expander.c +@@ -293,6 +293,7 @@ static void sas_set_ex_phy(struct domain_device *dev, int phy_id, void *rsp) + phy->phy->minimum_linkrate = dr->pmin_linkrate; + phy->phy->maximum_linkrate = dr->pmax_linkrate; + phy->phy->negotiated_linkrate = phy->linkrate; ++ phy->phy->enabled = (phy->linkrate != SAS_PHY_DISABLED); + + skip: + if (new_phy) +@@ -686,7 +687,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + res = smp_execute_task(dev, req, RPEL_REQ_SIZE, + resp, RPEL_RESP_SIZE); + +- if (!res) ++ if (res) + goto out; + + phy->invalid_dword_count = scsi_to_u32(&resp[12]); +@@ -695,6 +696,7 @@ int sas_smp_get_phy_events(struct sas_phy *phy) + phy->phy_reset_problem_count = scsi_to_u32(&resp[24]); + + out: ++ kfree(req); + kfree(resp); + return res; + +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index e518dadc8161..4beb4dd2bee8 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -6605,7 +6605,6 @@ static void megasas_detach_one(struct pci_dev *pdev) + u32 pd_seq_map_sz; + + instance = pci_get_drvdata(pdev); +- instance->unload = 1; + host = instance->host; + fusion = instance->ctrl_context; + +@@ -6616,6 +6615,7 @@ static void megasas_detach_one(struct pci_dev *pdev) + if (instance->fw_crash_state != UNAVAILABLE) + megasas_free_host_crash_buffer(instance); + scsi_remove_host(instance->host); ++ instance->unload = 1; + + if (megasas_wait_for_adapter_operational(instance)) + goto skip_firing_dcmds; +diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c +index ecc699a65bac..08945142b9f8 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -168,7 +168,7 @@ static struct MR_LD_SPAN *MR_LdSpanPtrGet(u32 ld, u32 span, + /* + * This function will Populate Driver Map using firmware raid map + */ +-void MR_PopulateDrvRaidMap(struct megasas_instance *instance) ++static int MR_PopulateDrvRaidMap(struct megasas_instance *instance) + { + struct fusion_context *fusion = instance->ctrl_context; + struct MR_FW_RAID_MAP_ALL *fw_map_old = NULL; +@@ -259,7 +259,7 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + ld_count = (u16)le16_to_cpu(fw_map_ext->ldCount); + if (ld_count > MAX_LOGICAL_DRIVES_EXT) { + dev_dbg(&instance->pdev->dev, "megaraid_sas: LD count exposed in RAID map in not valid\n"); +- return; ++ return 1; + } + + pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); +@@ -285,6 +285,12 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + fusion->ld_map[(instance->map_id & 1)]; + pFwRaidMap = &fw_map_old->raidMap; + ld_count = (u16)le32_to_cpu(pFwRaidMap->ldCount); ++ if (ld_count > MAX_LOGICAL_DRIVES) { ++ dev_dbg(&instance->pdev->dev, ++ "LD count exposed in RAID map in not valid\n"); ++ return 1; ++ } ++ + pDrvRaidMap->totalSize = pFwRaidMap->totalSize; + pDrvRaidMap->ldCount = (__le16)cpu_to_le16(ld_count); + pDrvRaidMap->fpPdIoTimeoutSec = pFwRaidMap->fpPdIoTimeoutSec; +@@ -300,6 +306,8 @@ void MR_PopulateDrvRaidMap(struct megasas_instance *instance) + sizeof(struct MR_DEV_HANDLE_INFO) * + MAX_RAIDMAP_PHYSICAL_DEVICES); + } ++ ++ return 0; + } + + /* +@@ -317,8 +325,8 @@ u8 MR_ValidateMapInfo(struct megasas_instance *instance) + u16 ld; + u32 expected_size; + +- +- MR_PopulateDrvRaidMap(instance); ++ if (MR_PopulateDrvRaidMap(instance)) ++ return 0; + + fusion = instance->ctrl_context; + drv_map = fusion->ld_drv_map[(instance->map_id & 1)]; +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index beb4bf8fe9b0..139219c994e9 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -4106,19 +4106,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + return 0; + } + +- /* +- * Bug work around for firmware SATL handling. The loop +- * is based on atomic operations and ensures consistency +- * since we're lockless at this point +- */ +- do { +- if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { +- scmd->result = SAM_STAT_BUSY; +- scmd->scsi_done(scmd); +- return 0; +- } +- } while (_scsih_set_satl_pending(scmd, true)); +- + sas_target_priv_data = sas_device_priv_data->sas_target; + + /* invalid device handle */ +@@ -4144,6 +4131,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + sas_device_priv_data->block) + return SCSI_MLQUEUE_DEVICE_BUSY; + ++ /* ++ * Bug work around for firmware SATL handling. The loop ++ * is based on atomic operations and ensures consistency ++ * since we're lockless at this point ++ */ ++ do { ++ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { ++ scmd->result = SAM_STAT_BUSY; ++ scmd->scsi_done(scmd); ++ return 0; ++ } ++ } while (_scsih_set_satl_pending(scmd, true)); ++ + if (scmd->sc_data_direction == DMA_FROM_DEVICE) + mpi_control = MPI2_SCSIIO_CONTROL_READ; + else if (scmd->sc_data_direction == DMA_TO_DEVICE) +@@ -4170,6 +4170,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (!smid) { + pr_err(MPT3SAS_FMT "%s: failed obtaining a smid\n", + ioc->name, __func__); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); +@@ -4200,6 +4201,7 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) + if (mpi_request->DataLength) { + if (ioc->build_sg_scmd(ioc, scmd, smid)) { + mpt3sas_base_free_smid(ioc, smid); ++ _scsih_set_satl_pending(scmd, false); + goto out; + } + } else +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 092a5fc85b9a..2770fbd4ce49 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -797,11 +797,21 @@ static int sh_msiof_dma_once(struct sh_msiof_spi_priv *p, const void *tx, + goto stop_dma; + } + +- /* wait for tx fifo to be emptied / rx fifo to be filled */ ++ /* wait for tx/rx DMA completion */ + ret = sh_msiof_wait_for_completion(p); + if (ret) + goto stop_reset; + ++ if (!rx) { ++ reinit_completion(&p->done); ++ sh_msiof_write(p, IER, IER_TEOFE); ++ ++ /* wait for tx fifo to be emptied */ ++ ret = sh_msiof_wait_for_completion(p); ++ if (ret) ++ goto stop_reset; ++ } ++ + /* clear status bits */ + sh_msiof_reset_str(p); + +diff --git a/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c b/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c +index 2da051c0d251..a4bb93b440a5 100644 +--- a/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c ++++ b/drivers/staging/lustre/lnet/libcfs/linux/linux-cpu.c +@@ -528,19 +528,20 @@ EXPORT_SYMBOL(cfs_cpt_spread_node); + int + cfs_cpt_current(struct cfs_cpt_table *cptab, int remap) + { +- int cpu = smp_processor_id(); +- int cpt = cptab->ctb_cpu2cpt[cpu]; ++ int cpu; ++ int cpt; + +- if (cpt < 0) { +- if (!remap) +- return cpt; ++ preempt_disable(); ++ cpu = smp_processor_id(); ++ cpt = cptab->ctb_cpu2cpt[cpu]; + ++ if (cpt < 0 && remap) { + /* don't return negative value for safety of upper layer, + * instead we shadow the unknown cpu to a valid partition ID + */ + cpt = cpu % cptab->ctb_nparts; + } +- ++ preempt_enable(); + return cpt; + } + EXPORT_SYMBOL(cfs_cpt_current); +diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c +index 942d094269fb..c4a5fb6f038f 100644 +--- a/drivers/target/target_core_user.c ++++ b/drivers/target/target_core_user.c +@@ -796,6 +796,13 @@ tcmu_queue_cmd_ring(struct tcmu_cmd *tcmu_cmd) + int ret; + DEFINE_WAIT(__wait); + ++ /* ++ * Don't leave commands partially setup because the unmap ++ * thread might need the blocks to make forward progress. ++ */ ++ tcmu_cmd_free_data(tcmu_cmd, tcmu_cmd->dbi_cur); ++ tcmu_cmd_reset_dbi_cur(tcmu_cmd); ++ + prepare_to_wait(&udev->wait_cmdr, &__wait, TASK_INTERRUPTIBLE); + + pr_debug("sleeping for ring space\n"); +diff --git a/drivers/thermal/int340x_thermal/int3400_thermal.c b/drivers/thermal/int340x_thermal/int3400_thermal.c +index 8ee38f55c7f3..43b90fd577e4 100644 +--- a/drivers/thermal/int340x_thermal/int3400_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3400_thermal.c +@@ -319,17 +319,21 @@ static int int3400_thermal_probe(struct platform_device *pdev) + + result = sysfs_create_group(&pdev->dev.kobj, &uuid_attribute_group); + if (result) +- goto free_zone; ++ goto free_rel_misc; + + result = acpi_install_notify_handler( + priv->adev->handle, ACPI_DEVICE_NOTIFY, int3400_notify, + (void *)priv); + if (result) +- goto free_zone; ++ goto free_sysfs; + + return 0; + +-free_zone: ++free_sysfs: ++ sysfs_remove_group(&pdev->dev.kobj, &uuid_attribute_group); ++free_rel_misc: ++ if (!priv->rel_misc_dev_res) ++ acpi_thermal_rel_misc_device_remove(priv->adev->handle); + thermal_zone_device_unregister(priv->thermal); + free_art_trt: + kfree(priv->trts); +diff --git a/drivers/thermal/power_allocator.c b/drivers/thermal/power_allocator.c +index b4d3116cfdaf..3055f9a12a17 100644 +--- a/drivers/thermal/power_allocator.c ++++ b/drivers/thermal/power_allocator.c +@@ -523,6 +523,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + struct thermal_instance *instance; + struct power_allocator_params *params = tz->governor_data; + ++ mutex_lock(&tz->lock); + list_for_each_entry(instance, &tz->thermal_instances, tz_node) { + if ((instance->trip != params->trip_max_desired_temperature) || + (!cdev_is_power_actor(instance->cdev))) +@@ -534,6 +535,7 @@ static void allow_maximum_power(struct thermal_zone_device *tz) + mutex_unlock(&instance->cdev->lock); + thermal_cdev_update(instance->cdev); + } ++ mutex_unlock(&tz->lock); + } + + /** +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 0a3c9665e015..7253e8d2c6d9 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -1463,6 +1463,10 @@ static void gsm_dlci_open(struct gsm_dlci *dlci) + * in which case an opening port goes back to closed and a closing port + * is simply put into closed state (any further frames from the other + * end will get a DM response) ++ * ++ * Some control dlci can stay in ADM mode with other dlci working just ++ * fine. In that case we can just keep the control dlci open after the ++ * DLCI_OPENING retries time out. + */ + + static void gsm_dlci_t1(unsigned long data) +@@ -1476,8 +1480,15 @@ static void gsm_dlci_t1(unsigned long data) + if (dlci->retries) { + gsm_command(dlci->gsm, dlci->addr, SABM|PF); + mod_timer(&dlci->t1, jiffies + gsm->t1 * HZ / 100); +- } else ++ } else if (!dlci->addr && gsm->control == (DM | PF)) { ++ if (debug & 8) ++ pr_info("DLCI %d opening in ADM mode.\n", ++ dlci->addr); ++ gsm_dlci_open(dlci); ++ } else { + gsm_dlci_close(dlci); ++ } ++ + break; + case DLCI_CLOSING: + dlci->retries--; +@@ -1495,8 +1506,8 @@ static void gsm_dlci_t1(unsigned long data) + * @dlci: DLCI to open + * + * Commence opening a DLCI from the Linux side. We issue SABM messages +- * to the modem which should then reply with a UA, at which point we +- * will move into open state. Opening is done asynchronously with retry ++ * to the modem which should then reply with a UA or ADM, at which point ++ * we will move into open state. Opening is done asynchronously with retry + * running off timers and the responses. + */ + +diff --git a/drivers/uio/uio_hv_generic.c b/drivers/uio/uio_hv_generic.c +index 48d5327d38d4..fe5cdda80b2c 100644 +--- a/drivers/uio/uio_hv_generic.c ++++ b/drivers/uio/uio_hv_generic.c +@@ -124,6 +124,13 @@ hv_uio_probe(struct hv_device *dev, + if (ret) + goto fail; + ++ /* Communicating with host has to be via shared memory not hypercall */ ++ if (!dev->channel->offermsg.monitor_allocated) { ++ dev_err(&dev->device, "vmbus channel requires hypercall\n"); ++ ret = -ENOTSUPP; ++ goto fail_close; ++ } ++ + dev->channel->inbound.ring_buffer->interrupt_mask = 1; + set_channel_read_mode(dev->channel, HV_CALL_DIRECT); + +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 082891dffd9d..b0d606b2d06c 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -622,7 +622,7 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk) + + if (!len && vq->busyloop_timeout) { + /* Both tx vq and rx socket were polled here */ +- mutex_lock(&vq->mutex); ++ mutex_lock_nested(&vq->mutex, 1); + vhost_disable_notify(&net->dev, vq); + + preempt_disable(); +@@ -755,7 +755,7 @@ static void handle_rx(struct vhost_net *net) + struct iov_iter fixup; + __virtio16 num_buffers; + +- mutex_lock(&vq->mutex); ++ mutex_lock_nested(&vq->mutex, 0); + sock = vq->private_data; + if (!sock) + goto out; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index a827c1a684a9..c692e0b13242 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -213,8 +213,7 @@ int vhost_poll_start(struct vhost_poll *poll, struct file *file) + if (mask) + vhost_poll_wakeup(&poll->wait, 0, 0, (void *)mask); + if (mask & POLLERR) { +- if (poll->wqh) +- remove_wait_queue(poll->wqh, &poll->wait); ++ vhost_poll_stop(poll); + ret = -EINVAL; + } + +@@ -1253,14 +1252,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, + /* Caller should have vq mutex and device mutex */ + int vhost_vq_access_ok(struct vhost_virtqueue *vq) + { +- if (vq->iotlb) { +- /* When device IOTLB was used, the access validation +- * will be validated during prefetching. +- */ +- return 1; +- } +- return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used) && +- vq_log_access_ok(vq, vq->log_base); ++ int ret = vq_log_access_ok(vq, vq->log_base); ++ ++ if (ret || vq->iotlb) ++ return ret; ++ ++ return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); + } + EXPORT_SYMBOL_GPL(vhost_vq_access_ok); + +diff --git a/drivers/video/backlight/corgi_lcd.c b/drivers/video/backlight/corgi_lcd.c +index d7c239ea3d09..f5574060f9c8 100644 +--- a/drivers/video/backlight/corgi_lcd.c ++++ b/drivers/video/backlight/corgi_lcd.c +@@ -177,7 +177,7 @@ static int corgi_ssp_lcdtg_send(struct corgi_lcd *lcd, int adrs, uint8_t data) + struct spi_message msg; + struct spi_transfer xfer = { + .len = 1, +- .cs_change = 1, ++ .cs_change = 0, + .tx_buf = lcd->buf, + }; + +diff --git a/drivers/video/backlight/tdo24m.c b/drivers/video/backlight/tdo24m.c +index eab1f842f9c0..e4bd63e9db6b 100644 +--- a/drivers/video/backlight/tdo24m.c ++++ b/drivers/video/backlight/tdo24m.c +@@ -369,7 +369,7 @@ static int tdo24m_probe(struct spi_device *spi) + + spi_message_init(m); + +- x->cs_change = 1; ++ x->cs_change = 0; + x->tx_buf = &lcd->buf[0]; + spi_message_add_tail(x, m); + +diff --git a/drivers/video/backlight/tosa_lcd.c b/drivers/video/backlight/tosa_lcd.c +index 6a41ea92737a..4dc5ee8debeb 100644 +--- a/drivers/video/backlight/tosa_lcd.c ++++ b/drivers/video/backlight/tosa_lcd.c +@@ -49,7 +49,7 @@ static int tosa_tg_send(struct spi_device *spi, int adrs, uint8_t data) + struct spi_message msg; + struct spi_transfer xfer = { + .len = 1, +- .cs_change = 1, ++ .cs_change = 0, + .tx_buf = buf, + }; + +diff --git a/drivers/video/fbdev/vfb.c b/drivers/video/fbdev/vfb.c +index da653a080394..54127905bfe7 100644 +--- a/drivers/video/fbdev/vfb.c ++++ b/drivers/video/fbdev/vfb.c +@@ -239,8 +239,23 @@ static int vfb_check_var(struct fb_var_screeninfo *var, + */ + static int vfb_set_par(struct fb_info *info) + { ++ switch (info->var.bits_per_pixel) { ++ case 1: ++ info->fix.visual = FB_VISUAL_MONO01; ++ break; ++ case 8: ++ info->fix.visual = FB_VISUAL_PSEUDOCOLOR; ++ break; ++ case 16: ++ case 24: ++ case 32: ++ info->fix.visual = FB_VISUAL_TRUECOLOR; ++ break; ++ } ++ + info->fix.line_length = get_line_length(info->var.xres_virtual, + info->var.bits_per_pixel); ++ + return 0; + } + +@@ -450,6 +465,8 @@ static int vfb_probe(struct platform_device *dev) + goto err2; + platform_set_drvdata(dev, info); + ++ vfb_set_par(info); ++ + fb_info(info, "Virtual frame buffer device, using %ldK of video memory\n", + videomemorysize >> 10); + return 0; +diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c +index 36be987ff9ef..c2f4ff516230 100644 +--- a/drivers/watchdog/dw_wdt.c ++++ b/drivers/watchdog/dw_wdt.c +@@ -127,14 +127,27 @@ static int dw_wdt_start(struct watchdog_device *wdd) + + dw_wdt_set_timeout(wdd, wdd->timeout); + +- set_bit(WDOG_HW_RUNNING, &wdd->status); +- + writel(WDOG_CONTROL_REG_WDT_EN_MASK, + dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); + + return 0; + } + ++static int dw_wdt_stop(struct watchdog_device *wdd) ++{ ++ struct dw_wdt *dw_wdt = to_dw_wdt(wdd); ++ ++ if (!dw_wdt->rst) { ++ set_bit(WDOG_HW_RUNNING, &wdd->status); ++ return 0; ++ } ++ ++ reset_control_assert(dw_wdt->rst); ++ reset_control_deassert(dw_wdt->rst); ++ ++ return 0; ++} ++ + static int dw_wdt_restart(struct watchdog_device *wdd, + unsigned long action, void *data) + { +@@ -173,6 +186,7 @@ static const struct watchdog_info dw_wdt_ident = { + static const struct watchdog_ops dw_wdt_ops = { + .owner = THIS_MODULE, + .start = dw_wdt_start, ++ .stop = dw_wdt_stop, + .ping = dw_wdt_ping, + .set_timeout = dw_wdt_set_timeout, + .get_timeleft = dw_wdt_get_timeleft, +diff --git a/fs/dcache.c b/fs/dcache.c +index a1417787e269..c28b9c91b5cb 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -468,9 +468,11 @@ static void dentry_lru_add(struct dentry *dentry) + * d_drop() is used mainly for stuff that wants to invalidate a dentry for some + * reason (NFS timeouts or autofs deletes). + * +- * __d_drop requires dentry->d_lock. ++ * __d_drop requires dentry->d_lock ++ * ___d_drop doesn't mark dentry as "unhashed" ++ * (dentry->d_hash.pprev will be LIST_POISON2, not NULL). + */ +-void __d_drop(struct dentry *dentry) ++static void ___d_drop(struct dentry *dentry) + { + if (!d_unhashed(dentry)) { + struct hlist_bl_head *b; +@@ -486,12 +488,17 @@ void __d_drop(struct dentry *dentry) + + hlist_bl_lock(b); + __hlist_bl_del(&dentry->d_hash); +- dentry->d_hash.pprev = NULL; + hlist_bl_unlock(b); + /* After this call, in-progress rcu-walk path lookup will fail. */ + write_seqcount_invalidate(&dentry->d_seq); + } + } ++ ++void __d_drop(struct dentry *dentry) ++{ ++ ___d_drop(dentry); ++ dentry->d_hash.pprev = NULL; ++} + EXPORT_SYMBOL(__d_drop); + + void d_drop(struct dentry *dentry) +@@ -2386,7 +2393,7 @@ EXPORT_SYMBOL(d_delete); + static void __d_rehash(struct dentry *entry) + { + struct hlist_bl_head *b = d_hash(entry->d_name.hash); +- BUG_ON(!d_unhashed(entry)); ++ + hlist_bl_lock(b); + hlist_bl_add_head_rcu(&entry->d_hash, b); + hlist_bl_unlock(b); +@@ -2821,9 +2828,9 @@ static void __d_move(struct dentry *dentry, struct dentry *target, + write_seqcount_begin_nested(&target->d_seq, DENTRY_D_LOCK_NESTED); + + /* unhash both */ +- /* __d_drop does write_seqcount_barrier, but they're OK to nest. */ +- __d_drop(dentry); +- __d_drop(target); ++ /* ___d_drop does write_seqcount_barrier, but they're OK to nest. */ ++ ___d_drop(dentry); ++ ___d_drop(target); + + /* Switch the names.. */ + if (exchange) +@@ -2835,6 +2842,8 @@ static void __d_move(struct dentry *dentry, struct dentry *target, + __d_rehash(dentry); + if (exchange) + __d_rehash(target); ++ else ++ target->d_hash.pprev = NULL; + + /* ... and switch them in the tree */ + if (IS_ROOT(dentry)) { +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 5100ec1b5d55..86eb33f67618 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -412,7 +412,7 @@ extern const struct clk_ops clk_divider_ro_ops; + + unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, + unsigned int val, const struct clk_div_table *table, +- unsigned long flags); ++ unsigned long flags, unsigned long width); + long divider_round_rate_parent(struct clk_hw *hw, struct clk_hw *parent, + unsigned long rate, unsigned long *prate, + const struct clk_div_table *table, +diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h +index bfb4a9d962a5..f2f9e957bf1b 100644 +--- a/include/linux/mlx5/driver.h ++++ b/include/linux/mlx5/driver.h +@@ -794,7 +794,7 @@ struct mlx5_core_dev { + struct mlx5e_resources mlx5e_res; + struct { + struct mlx5_rsvd_gids reserved_gids; +- atomic_t roce_en; ++ u32 roce_en; + } roce; + #ifdef CONFIG_MLX5_FPGA + struct mlx5_fpga_device *fpga; +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c +index f7e83f6d2e64..236452ebbd9e 100644 +--- a/net/8021q/vlan_dev.c ++++ b/net/8021q/vlan_dev.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -665,8 +666,11 @@ static int vlan_ethtool_get_ts_info(struct net_device *dev, + { + const struct vlan_dev_priv *vlan = vlan_dev_priv(dev); + const struct ethtool_ops *ops = vlan->real_dev->ethtool_ops; ++ struct phy_device *phydev = vlan->real_dev->phydev; + +- if (ops->get_ts_info) { ++ if (phydev && phydev->drv && phydev->drv->ts_info) { ++ return phydev->drv->ts_info(phydev, info); ++ } else if (ops->get_ts_info) { + return ops->get_ts_info(vlan->real_dev, info); + } else { + info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE | +diff --git a/net/core/dev.c b/net/core/dev.c +index 387af3415385..4be2a4047640 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1025,7 +1025,7 @@ bool dev_valid_name(const char *name) + { + if (*name == '\0') + return false; +- if (strlen(name) >= IFNAMSIZ) ++ if (strnlen(name, IFNAMSIZ) == IFNAMSIZ) + return false; + if (!strcmp(name, ".") || !strcmp(name, "..")) + return false; +@@ -2696,7 +2696,7 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth) + if (unlikely(!pskb_may_pull(skb, sizeof(struct ethhdr)))) + return 0; + +- eth = (struct ethhdr *)skb_mac_header(skb); ++ eth = (struct ethhdr *)skb->data; + type = eth->h_proto; + } + +diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c +index a1d1f50e0e19..7d9cf26f4bb1 100644 +--- a/net/ipv4/arp.c ++++ b/net/ipv4/arp.c +@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct net_device *dev) + /*unsigned long now; */ + struct net *net = dev_net(dev); + +- rt = ip_route_output(net, sip, tip, 0, 0); ++ rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev)); + if (IS_ERR(rt)) + return 1; + if (rt->dst.dev != dev) { +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 1ee6c0d8dde4..f39955913d3f 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -1755,18 +1755,20 @@ void fib_select_multipath(struct fib_result *res, int hash) + bool first = false; + + for_nexthops(fi) { ++ if (net->ipv4.sysctl_fib_multipath_use_neigh) { ++ if (!fib_good_nh(nh)) ++ continue; ++ if (!first) { ++ res->nh_sel = nhsel; ++ first = true; ++ } ++ } ++ + if (hash > atomic_read(&nh->nh_upper_bound)) + continue; + +- if (!net->ipv4.sysctl_fib_multipath_use_neigh || +- fib_good_nh(nh)) { +- res->nh_sel = nhsel; +- return; +- } +- if (!first) { +- res->nh_sel = nhsel; +- first = true; +- } ++ res->nh_sel = nhsel; ++ return; + } endfor_nexthops(fi); + } + #endif +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 4e90082b23a6..13f7bbc0168d 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_create(struct net *net, + struct net_device *dev; + char name[IFNAMSIZ]; + +- if (parms->name[0]) ++ err = -E2BIG; ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else { +- if (strlen(ops->kind) > (IFNAMSIZ - 3)) { +- err = -E2BIG; ++ } else { ++ if (strlen(ops->kind) > (IFNAMSIZ - 3)) + goto failed; +- } + strlcpy(name, ops->kind, IFNAMSIZ); + strncat(name, "%d", 2); + } +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index e8ab306794d8..4228f3b2f347 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -319,11 +319,13 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net *net, + if (t || !create) + return t; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ return NULL; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "ip6gre%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6gre_tunnel_setup); + if (!dev) +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 3763dc01e374..ffbb81609016 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -138,6 +138,14 @@ static int ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *s + return ret; + } + ++#if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM) ++ /* Policy lookup after SNAT yielded a new policy */ ++ if (skb_dst(skb)->xfrm) { ++ IPCB(skb)->flags |= IPSKB_REROUTED; ++ return dst_output(net, sk, skb); ++ } ++#endif ++ + if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) || + dst_allfrag(skb_dst(skb)) || + (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size)) +@@ -367,6 +375,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb) + static inline int ip6_forward_finish(struct net *net, struct sock *sk, + struct sk_buff *skb) + { ++ struct dst_entry *dst = skb_dst(skb); ++ ++ __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); ++ __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); ++ + return dst_output(net, sk, skb); + } + +@@ -560,8 +573,6 @@ int ip6_forward(struct sk_buff *skb) + + hdr->hop_limit--; + +- __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); +- __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len); + return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, + net, NULL, skb, skb->dev, dst->dev, + ip6_forward_finish); +@@ -1237,7 +1248,7 @@ static int __ip6_append_data(struct sock *sk, + const struct sockcm_cookie *sockc) + { + struct sk_buff *skb, *skb_prev = NULL; +- unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu; ++ unsigned int maxfraglen, fragheaderlen, mtu, orig_mtu, pmtu; + int exthdrlen = 0; + int dst_exthdrlen = 0; + int hh_len; +@@ -1273,6 +1284,12 @@ static int __ip6_append_data(struct sock *sk, + sizeof(struct frag_hdr) : 0) + + rt->rt6i_nfheader_len; + ++ /* as per RFC 7112 section 5, the entire IPv6 Header Chain must fit ++ * the first fragment ++ */ ++ if (headersize + transhdrlen > mtu) ++ goto emsgsize; ++ + if (cork->length + length > mtu - headersize && ipc6->dontfrag && + (sk->sk_protocol == IPPROTO_UDP || + sk->sk_protocol == IPPROTO_RAW)) { +@@ -1288,9 +1305,8 @@ static int __ip6_append_data(struct sock *sk, + + if (cork->length + length > maxnonfragsize - headersize) { + emsgsize: +- ipv6_local_error(sk, EMSGSIZE, fl6, +- mtu - headersize + +- sizeof(struct ipv6hdr)); ++ pmtu = max_t(int, mtu - headersize + sizeof(struct ipv6hdr), 0); ++ ipv6_local_error(sk, EMSGSIZE, fl6, pmtu); + return -EMSGSIZE; + } + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 1161fd5630c1..7e11f6a811f5 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -297,13 +297,16 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct __ip6_tnl_parm *p) + struct net_device *dev; + struct ip6_tnl *t; + char name[IFNAMSIZ]; +- int err = -ENOMEM; ++ int err = -E2BIG; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6tnl%%d"); +- ++ } ++ err = -ENOMEM; + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ip6_tnl_dev_setup); + if (!dev) +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index bcdc2d557de1..7c0f647b5195 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -212,10 +212,13 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, struct __ip6_tnl_parm *p + char name[IFNAMSIZ]; + int err; + +- if (p->name[0]) ++ if (p->name[0]) { ++ if (!dev_valid_name(p->name)) ++ goto failed; + strlcpy(name, p->name, IFNAMSIZ); +- else ++ } else { + sprintf(name, "ip6_vti%%d"); ++ } + + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, vti6_dev_setup); + if (!dev) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index a4a865c8a23c..0126d9bfa670 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -871,6 +871,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net, + struct fib6_node *fn; + struct rt6_info *rt; + ++ if (fl6->flowi6_flags & FLOWI_FLAG_SKIP_NH_OIF) ++ flags &= ~RT6_LOOKUP_F_IFACE; ++ + read_lock_bh(&table->tb6_lock); + fn = fib6_lookup(&table->tb6_root, &fl6->daddr, &fl6->saddr); + restart: +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index 7a78dcfda68a..f343e6f0fc95 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -211,11 +212,6 @@ static int seg6_do_srh(struct sk_buff *skb) + + tinfo = seg6_encap_lwtunnel(dst->lwtstate); + +- if (likely(!skb->encapsulation)) { +- skb_reset_inner_headers(skb); +- skb->encapsulation = 1; +- } +- + switch (tinfo->mode) { + case SEG6_IPTUN_MODE_INLINE: + if (skb->protocol != htons(ETH_P_IPV6)) +@@ -224,10 +220,12 @@ static int seg6_do_srh(struct sk_buff *skb) + err = seg6_do_srh_inline(skb, tinfo->srh); + if (err) + return err; +- +- skb_reset_inner_headers(skb); + break; + case SEG6_IPTUN_MODE_ENCAP: ++ err = iptunnel_handle_offloads(skb, SKB_GSO_IPXIP6); ++ if (err) ++ return err; ++ + if (skb->protocol == htons(ETH_P_IPV6)) + proto = IPPROTO_IPV6; + else if (skb->protocol == htons(ETH_P_IP)) +@@ -239,6 +237,8 @@ static int seg6_do_srh(struct sk_buff *skb) + if (err) + return err; + ++ skb_set_inner_transport_header(skb, skb_transport_offset(skb)); ++ skb_set_inner_protocol(skb, skb->protocol); + skb->protocol = htons(ETH_P_IPV6); + break; + case SEG6_IPTUN_MODE_L2ENCAP: +@@ -262,8 +262,6 @@ static int seg6_do_srh(struct sk_buff *skb) + ipv6_hdr(skb)->payload_len = htons(skb->len - sizeof(struct ipv6hdr)); + skb_set_transport_header(skb, sizeof(struct ipv6hdr)); + +- skb_set_inner_protocol(skb, skb->protocol); +- + return 0; + } + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index cac815cc8600..f03c1a562135 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -244,11 +244,13 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net *net, + if (!create) + goto failed; + +- if (parms->name[0]) ++ if (parms->name[0]) { ++ if (!dev_valid_name(parms->name)) ++ goto failed; + strlcpy(name, parms->name, IFNAMSIZ); +- else ++ } else { + strcpy(name, "sit%d"); +- ++ } + dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, + ipip6_tunnel_setup); + if (!dev) +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index c28223d8092b..fca69c3771f5 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -765,6 +765,8 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || ++ (session->offset && ++ nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || +diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c +index 84f757c5d91a..288640471c2f 100644 +--- a/net/mac80211/cfg.c ++++ b/net/mac80211/cfg.c +@@ -2373,10 +2373,17 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy, + struct ieee80211_sub_if_data *sdata; + enum nl80211_tx_power_setting txp_type = type; + bool update_txp_type = false; ++ bool has_monitor = false; + + if (wdev) { + sdata = IEEE80211_WDEV_TO_SUB_IF(wdev); + ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) { ++ sdata = rtnl_dereference(local->monitor_sdata); ++ if (!sdata) ++ return -EOPNOTSUPP; ++ } ++ + switch (type) { + case NL80211_TX_POWER_AUTOMATIC: + sdata->user_power_level = IEEE80211_UNSET_POWER_LEVEL; +@@ -2415,15 +2422,34 @@ static int ieee80211_set_tx_power(struct wiphy *wiphy, + + mutex_lock(&local->iflist_mtx); + list_for_each_entry(sdata, &local->interfaces, list) { ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) { ++ has_monitor = true; ++ continue; ++ } + sdata->user_power_level = local->user_power_level; + if (txp_type != sdata->vif.bss_conf.txpower_type) + update_txp_type = true; + sdata->vif.bss_conf.txpower_type = txp_type; + } +- list_for_each_entry(sdata, &local->interfaces, list) ++ list_for_each_entry(sdata, &local->interfaces, list) { ++ if (sdata->vif.type == NL80211_IFTYPE_MONITOR) ++ continue; + ieee80211_recalc_txpower(sdata, update_txp_type); ++ } + mutex_unlock(&local->iflist_mtx); + ++ if (has_monitor) { ++ sdata = rtnl_dereference(local->monitor_sdata); ++ if (sdata) { ++ sdata->user_power_level = local->user_power_level; ++ if (txp_type != sdata->vif.bss_conf.txpower_type) ++ update_txp_type = true; ++ sdata->vif.bss_conf.txpower_type = txp_type; ++ ++ ieee80211_recalc_txpower(sdata, update_txp_type); ++ } ++ } ++ + return 0; + } + +diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h +index c7f93fd9ca7a..4d82fe7d627c 100644 +--- a/net/mac80211/driver-ops.h ++++ b/net/mac80211/driver-ops.h +@@ -165,7 +165,8 @@ static inline void drv_bss_info_changed(struct ieee80211_local *local, + if (WARN_ON_ONCE(sdata->vif.type == NL80211_IFTYPE_P2P_DEVICE || + sdata->vif.type == NL80211_IFTYPE_NAN || + (sdata->vif.type == NL80211_IFTYPE_MONITOR && +- !sdata->vif.mu_mimo_owner))) ++ !sdata->vif.mu_mimo_owner && ++ !(changed & BSS_CHANGED_TXPOWER)))) + return; + + if (!check_sdata_in_driver(sdata)) +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 9219bc134109..1b86eccf94b6 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1053,6 +1053,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + if (addr->sa_family != AF_NETLINK) + return -EINVAL; + ++ if (alen < sizeof(struct sockaddr_nl)) ++ return -EINVAL; ++ + if ((nladdr->nl_groups || nladdr->nl_pid) && + !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + return -EPERM; +diff --git a/net/rds/bind.c b/net/rds/bind.c +index 75d43dc8e96b..5aa3a64aa4f0 100644 +--- a/net/rds/bind.c ++++ b/net/rds/bind.c +@@ -114,6 +114,7 @@ static int rds_add_bound(struct rds_sock *rs, __be32 addr, __be16 *port) + rs, &addr, (int)ntohs(*port)); + break; + } else { ++ rs->rs_bound_addr = 0; + rds_sock_put(rs); + ret = -ENOMEM; + break; +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index 8f2c63514956..4444d7e755e6 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -133,8 +133,10 @@ static int tcf_dump_walker(struct tcf_idrinfo *idrinfo, struct sk_buff *skb, + continue; + + nest = nla_nest_start(skb, n_i); +- if (!nest) ++ if (!nest) { ++ index--; + goto nla_put_failure; ++ } + err = tcf_action_dump_1(skb, p, 0, 0); + if (err < 0) { + index--; +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index c0c707eb2c96..2b087623fb1d 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -248,10 +248,14 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, struct tcf_bpf_cfg *cfg) + + static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg) + { +- if (cfg->is_ebpf) +- bpf_prog_put(cfg->filter); +- else +- bpf_prog_destroy(cfg->filter); ++ struct bpf_prog *filter = cfg->filter; ++ ++ if (filter) { ++ if (cfg->is_ebpf) ++ bpf_prog_put(filter); ++ else ++ bpf_prog_destroy(filter); ++ } + + kfree(cfg->bpf_ops); + kfree(cfg->bpf_name); +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index b642ad3d39dd..6d10b3af479b 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -190,7 +190,8 @@ static void tcf_skbmod_cleanup(struct tc_action *a, int bind) + struct tcf_skbmod_params *p; + + p = rcu_dereference_protected(d->skbmod_p, 1); +- kfree_rcu(p, rcu); ++ if (p) ++ kfree_rcu(p, rcu); + } + + static int tcf_skbmod_dump(struct sk_buff *skb, struct tc_action *a, +diff --git a/net/sched/act_tunnel_key.c b/net/sched/act_tunnel_key.c +index 22bf1a376b91..7cb63616805d 100644 +--- a/net/sched/act_tunnel_key.c ++++ b/net/sched/act_tunnel_key.c +@@ -208,11 +208,12 @@ static void tunnel_key_release(struct tc_action *a, int bind) + struct tcf_tunnel_key_params *params; + + params = rcu_dereference_protected(t->params, 1); ++ if (params) { ++ if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) ++ dst_release(¶ms->tcft_enc_metadata->dst); + +- if (params->tcft_action == TCA_TUNNEL_KEY_ACT_SET) +- dst_release(¶ms->tcft_enc_metadata->dst); +- +- kfree_rcu(params, rcu); ++ kfree_rcu(params, rcu); ++ } + } + + static int tunnel_key_dump_addresses(struct sk_buff *skb, +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index f27a9718554c..08b5705e7381 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -728,8 +728,10 @@ static int sctp_v6_addr_to_user(struct sctp_sock *sp, union sctp_addr *addr) + sctp_v6_map_v4(addr); + } + +- if (addr->sa.sa_family == AF_INET) ++ if (addr->sa.sa_family == AF_INET) { ++ memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero)); + return sizeof(struct sockaddr_in); ++ } + return sizeof(struct sockaddr_in6); + } + +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 6b3a862706de..2d6f612f32c3 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -337,11 +337,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, + if (!opt->pf->af_supported(addr->sa.sa_family, opt)) + return NULL; + +- /* V4 mapped address are really of AF_INET family */ +- if (addr->sa.sa_family == AF_INET6 && +- ipv6_addr_v4mapped(&addr->v6.sin6_addr) && +- !opt->pf->af_supported(AF_INET, opt)) +- return NULL; ++ if (addr->sa.sa_family == AF_INET6) { ++ if (len < SIN6_LEN_RFC2133) ++ return NULL; ++ /* V4 mapped address are really of AF_INET family */ ++ if (ipv6_addr_v4mapped(&addr->v6.sin6_addr) && ++ !opt->pf->af_supported(AF_INET, opt)) ++ return NULL; ++ } + + /* If we get this far, af is valid. */ + af = sctp_get_af_specific(addr->sa.sa_family); +diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c +index c5fda15ba319..4a3a3f1331ee 100644 +--- a/net/strparser/strparser.c ++++ b/net/strparser/strparser.c +@@ -60,7 +60,7 @@ static void strp_abort_strp(struct strparser *strp, int err) + struct sock *sk = strp->sk; + + /* Report an error on the lower socket */ +- sk->sk_err = err; ++ sk->sk_err = -err; + sk->sk_error_report(sk); + } + } +@@ -458,7 +458,7 @@ static void strp_msg_timeout(struct work_struct *w) + /* Message assembly timed out */ + STRP_STATS_INCR(strp->stats.msg_timeouts); + strp->cb.lock(strp); +- strp->cb.abort_parser(strp, ETIMEDOUT); ++ strp->cb.abort_parser(strp, -ETIMEDOUT); + strp->cb.unlock(strp); + } + +diff --git a/sound/soc/intel/atom/sst/sst_stream.c b/sound/soc/intel/atom/sst/sst_stream.c +index 83d8dda15233..4eeb9afdc89f 100644 +--- a/sound/soc/intel/atom/sst/sst_stream.c ++++ b/sound/soc/intel/atom/sst/sst_stream.c +@@ -221,7 +221,7 @@ int sst_send_byte_stream_mrfld(struct intel_sst_drv *sst_drv_ctx, + sst_free_block(sst_drv_ctx, block); + out: + test_and_clear_bit(pvt_id, &sst_drv_ctx->pvt_id); +- return 0; ++ return ret; + } + + /* +diff --git a/sound/soc/intel/boards/cht_bsw_rt5645.c b/sound/soc/intel/boards/cht_bsw_rt5645.c +index 5bcde01d15e6..fbfb76ee2346 100644 +--- a/sound/soc/intel/boards/cht_bsw_rt5645.c ++++ b/sound/soc/intel/boards/cht_bsw_rt5645.c +@@ -133,6 +133,7 @@ static const struct snd_soc_dapm_widget cht_dapm_widgets[] = { + SND_SOC_DAPM_HP("Headphone", NULL), + SND_SOC_DAPM_MIC("Headset Mic", NULL), + SND_SOC_DAPM_MIC("Int Mic", NULL), ++ SND_SOC_DAPM_MIC("Int Analog Mic", NULL), + SND_SOC_DAPM_SPK("Ext Spk", NULL), + SND_SOC_DAPM_SUPPLY("Platform Clock", SND_SOC_NOPM, 0, 0, + platform_clock_control, SND_SOC_DAPM_PRE_PMU | SND_SOC_DAPM_POST_PMD), +@@ -143,6 +144,8 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"IN1N", NULL, "Headset Mic"}, + {"DMIC L1", NULL, "Int Mic"}, + {"DMIC R1", NULL, "Int Mic"}, ++ {"IN2P", NULL, "Int Analog Mic"}, ++ {"IN2N", NULL, "Int Analog Mic"}, + {"Headphone", NULL, "HPOL"}, + {"Headphone", NULL, "HPOR"}, + {"Ext Spk", NULL, "SPOL"}, +@@ -150,6 +153,9 @@ static const struct snd_soc_dapm_route cht_rt5645_audio_map[] = { + {"Headphone", NULL, "Platform Clock"}, + {"Headset Mic", NULL, "Platform Clock"}, + {"Int Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "Platform Clock"}, ++ {"Int Analog Mic", NULL, "micbias1"}, ++ {"Int Analog Mic", NULL, "micbias2"}, + {"Ext Spk", NULL, "Platform Clock"}, + }; + +@@ -204,6 +210,7 @@ static const struct snd_kcontrol_new cht_mc_controls[] = { + SOC_DAPM_PIN_SWITCH("Headphone"), + SOC_DAPM_PIN_SWITCH("Headset Mic"), + SOC_DAPM_PIN_SWITCH("Int Mic"), ++ SOC_DAPM_PIN_SWITCH("Int Analog Mic"), + SOC_DAPM_PIN_SWITCH("Ext Spk"), + }; + +diff --git a/sound/soc/intel/skylake/skl-messages.c b/sound/soc/intel/skylake/skl-messages.c +index 89f70133c8e4..b74a6040cd96 100644 +--- a/sound/soc/intel/skylake/skl-messages.c ++++ b/sound/soc/intel/skylake/skl-messages.c +@@ -404,7 +404,11 @@ int skl_resume_dsp(struct skl *skl) + if (skl->skl_sst->is_first_boot == true) + return 0; + ++ /* disable dynamic clock gating during fw and lib download */ ++ ctx->enable_miscbdcge(ctx->dev, false); ++ + ret = skl_dsp_wake(ctx->dsp); ++ ctx->enable_miscbdcge(ctx->dev, true); + if (ret < 0) + return ret; + +diff --git a/sound/soc/intel/skylake/skl-pcm.c b/sound/soc/intel/skylake/skl-pcm.c +index 2b1e513b1680..7fe1e8f273a0 100644 +--- a/sound/soc/intel/skylake/skl-pcm.c ++++ b/sound/soc/intel/skylake/skl-pcm.c +@@ -1332,7 +1332,11 @@ static int skl_platform_soc_probe(struct snd_soc_platform *platform) + return -EIO; + } + ++ /* disable dynamic clock gating during fw and lib download */ ++ skl->skl_sst->enable_miscbdcge(platform->dev, false); ++ + ret = ops->init_fw(platform->dev, skl->skl_sst); ++ skl->skl_sst->enable_miscbdcge(platform->dev, true); + if (ret < 0) { + dev_err(platform->dev, "Failed to boot first fw: %d\n", ret); + return ret; +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index 9d01d0b1084e..c8b8b7101c6f 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -1385,6 +1385,17 @@ static int update_insn_state(struct instruction *insn, struct insn_state *state) + state->vals[op->dest.reg].offset = -state->stack_size; + } + ++ else if (op->src.reg == CFI_BP && op->dest.reg == CFI_SP && ++ cfa->base == CFI_BP) { ++ ++ /* ++ * mov %rbp, %rsp ++ * ++ * Restore the original stack pointer (Clang). ++ */ ++ state->stack_size = -state->regs[CFI_BP].offset; ++ } ++ + else if (op->dest.reg == cfa->base) { + + /* mov %reg, %rsp */ +diff --git a/tools/perf/arch/powerpc/util/sym-handling.c b/tools/perf/arch/powerpc/util/sym-handling.c +index 9c4e23d8c8ce..53d83d7e6a09 100644 +--- a/tools/perf/arch/powerpc/util/sym-handling.c ++++ b/tools/perf/arch/powerpc/util/sym-handling.c +@@ -64,6 +64,14 @@ int arch__compare_symbol_names_n(const char *namea, const char *nameb, + + return strncmp(namea, nameb, n); + } ++ ++const char *arch__normalize_symbol_name(const char *name) ++{ ++ /* Skip over initial dot */ ++ if (name && *name == '.') ++ name++; ++ return name; ++} + #endif + + #if defined(_CALL_ELF) && _CALL_ELF == 2 +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 0c95ffefb6cc..1957abc1c8cf 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -1856,8 +1856,8 @@ int cmd_record(int argc, const char **argv) + goto out; + } + +- /* Enable ignoring missing threads when -u option is defined. */ +- rec->opts.ignore_missing_thread = rec->opts.target.uid != UINT_MAX; ++ /* Enable ignoring missing threads when -u/-p option is defined. */ ++ rec->opts.ignore_missing_thread = rec->opts.target.uid != UINT_MAX || rec->opts.target.pid; + + err = -ENOMEM; + if (perf_evlist__create_maps(rec->evlist, &rec->opts.target) < 0) +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index fae4b0340750..183c3ed56e08 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -162,12 +162,28 @@ static int hist_iter__branch_callback(struct hist_entry_iter *iter, + struct hist_entry *he = iter->he; + struct report *rep = arg; + struct branch_info *bi; ++ struct perf_sample *sample = iter->sample; ++ struct perf_evsel *evsel = iter->evsel; ++ int err; ++ ++ if (!ui__has_annotation()) ++ return 0; ++ ++ hist__account_cycles(sample->branch_stack, al, sample, ++ rep->nonany_branch_mode); + + bi = he->branch_info; ++ err = addr_map_symbol__inc_samples(&bi->from, sample, evsel->idx); ++ if (err) ++ goto out; ++ ++ err = addr_map_symbol__inc_samples(&bi->to, sample, evsel->idx); ++ + branch_type_count(&rep->brtype_stat, &bi->flags, + bi->from.addr, bi->to.addr); + +- return 0; ++out: ++ return err; + } + + static int process_sample_event(struct perf_tool *tool, +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index 1f6beb3d0c68..ac19130c14d8 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -1591,10 +1591,46 @@ static int __open_attr__fprintf(FILE *fp, const char *name, const char *val, + return fprintf(fp, " %-32s %s\n", name, val); + } + ++static void perf_evsel__remove_fd(struct perf_evsel *pos, ++ int nr_cpus, int nr_threads, ++ int thread_idx) ++{ ++ for (int cpu = 0; cpu < nr_cpus; cpu++) ++ for (int thread = thread_idx; thread < nr_threads - 1; thread++) ++ FD(pos, cpu, thread) = FD(pos, cpu, thread + 1); ++} ++ ++static int update_fds(struct perf_evsel *evsel, ++ int nr_cpus, int cpu_idx, ++ int nr_threads, int thread_idx) ++{ ++ struct perf_evsel *pos; ++ ++ if (cpu_idx >= nr_cpus || thread_idx >= nr_threads) ++ return -EINVAL; ++ ++ evlist__for_each_entry(evsel->evlist, pos) { ++ nr_cpus = pos != evsel ? nr_cpus : cpu_idx; ++ ++ perf_evsel__remove_fd(pos, nr_cpus, nr_threads, thread_idx); ++ ++ /* ++ * Since fds for next evsel has not been created, ++ * there is no need to iterate whole event list. ++ */ ++ if (pos == evsel) ++ break; ++ } ++ return 0; ++} ++ + static bool ignore_missing_thread(struct perf_evsel *evsel, ++ int nr_cpus, int cpu, + struct thread_map *threads, + int thread, int err) + { ++ pid_t ignore_pid = thread_map__pid(threads, thread); ++ + if (!evsel->ignore_missing_thread) + return false; + +@@ -1610,11 +1646,18 @@ static bool ignore_missing_thread(struct perf_evsel *evsel, + if (threads->nr == 1) + return false; + ++ /* ++ * We should remove fd for missing_thread first ++ * because thread_map__remove() will decrease threads->nr. ++ */ ++ if (update_fds(evsel, nr_cpus, cpu, threads->nr, thread)) ++ return false; ++ + if (thread_map__remove(threads, thread)) + return false; + + pr_warning("WARNING: Ignored open failure for pid %d\n", +- thread_map__pid(threads, thread)); ++ ignore_pid); + return true; + } + +@@ -1719,7 +1762,7 @@ int perf_evsel__open(struct perf_evsel *evsel, struct cpu_map *cpus, + if (fd < 0) { + err = -errno; + +- if (ignore_missing_thread(evsel, threads, thread, err)) { ++ if (ignore_missing_thread(evsel, cpus->nr, cpu, threads, thread, err)) { + /* + * We just removed 1 thread, so take a step + * back on thread index and lower the upper +diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c +index b7aaf9b2294d..68786bb7790e 100644 +--- a/tools/perf/util/probe-event.c ++++ b/tools/perf/util/probe-event.c +@@ -2625,6 +2625,14 @@ static int get_new_event_name(char *buf, size_t len, const char *base, + + out: + free(nbase); ++ ++ /* Final validation */ ++ if (ret >= 0 && !is_c_func_name(buf)) { ++ pr_warning("Internal error: \"%s\" is an invalid event name.\n", ++ buf); ++ ret = -EINVAL; ++ } ++ + return ret; + } + +@@ -2792,16 +2800,32 @@ static int find_probe_functions(struct map *map, char *name, + int found = 0; + struct symbol *sym; + struct rb_node *tmp; ++ const char *norm, *ver; ++ char *buf = NULL; + + if (map__load(map) < 0) + return 0; + + map__for_each_symbol(map, sym, tmp) { +- if (strglobmatch(sym->name, name)) { ++ norm = arch__normalize_symbol_name(sym->name); ++ if (!norm) ++ continue; ++ ++ /* We don't care about default symbol or not */ ++ ver = strchr(norm, '@'); ++ if (ver) { ++ buf = strndup(norm, ver - norm); ++ if (!buf) ++ return -ENOMEM; ++ norm = buf; ++ } ++ if (strglobmatch(norm, name)) { + found++; + if (syms && found < probe_conf.max_probes) + syms[found - 1] = sym; + } ++ if (buf) ++ zfree(&buf); + } + + return found; +@@ -2847,7 +2871,7 @@ static int find_probe_trace_events_from_map(struct perf_probe_event *pev, + * same name but different addresses, this lists all the symbols. + */ + num_matched_functions = find_probe_functions(map, pp->function, syms); +- if (num_matched_functions == 0) { ++ if (num_matched_functions <= 0) { + pr_err("Failed to find symbol %s in %s\n", pp->function, + pev->target ? : "kernel"); + ret = -ENOENT; +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 6492ef38b090..4e8dd5fd45fd 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -93,6 +93,11 @@ static int prefix_underscores_count(const char *str) + return tail - str; + } + ++const char * __weak arch__normalize_symbol_name(const char *name) ++{ ++ return name; ++} ++ + int __weak arch__compare_symbol_names(const char *namea, const char *nameb) + { + return strcmp(namea, nameb); +diff --git a/tools/perf/util/symbol.h b/tools/perf/util/symbol.h +index 6352022593c6..698c65e603a8 100644 +--- a/tools/perf/util/symbol.h ++++ b/tools/perf/util/symbol.h +@@ -347,6 +347,7 @@ bool elf__needs_adjust_symbols(GElf_Ehdr ehdr); + void arch__sym_update(struct symbol *s, GElf_Sym *sym); + #endif + ++const char *arch__normalize_symbol_name(const char *name); + #define SYMBOL_A 0 + #define SYMBOL_B 1 + +diff --git a/tools/perf/util/util.c b/tools/perf/util/util.c +index 3687b720327a..cc57c246eade 100644 +--- a/tools/perf/util/util.c ++++ b/tools/perf/util/util.c +@@ -196,7 +196,7 @@ int copyfile_offset(int ifd, loff_t off_in, int ofd, loff_t off_out, u64 size) + + size -= ret; + off_in += ret; +- off_out -= ret; ++ off_out += ret; + } + munmap(ptr, off_in + size); + +diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c +index 3ab6ec403905..e11fe84de0fd 100644 +--- a/tools/testing/selftests/net/msg_zerocopy.c ++++ b/tools/testing/selftests/net/msg_zerocopy.c +@@ -259,22 +259,28 @@ static int setup_ip6h(struct ipv6hdr *ip6h, uint16_t payload_len) + return sizeof(*ip6h); + } + +-static void setup_sockaddr(int domain, const char *str_addr, void *sockaddr) ++ ++static void setup_sockaddr(int domain, const char *str_addr, ++ struct sockaddr_storage *sockaddr) + { + struct sockaddr_in6 *addr6 = (void *) sockaddr; + struct sockaddr_in *addr4 = (void *) sockaddr; + + switch (domain) { + case PF_INET: ++ memset(addr4, 0, sizeof(*addr4)); + addr4->sin_family = AF_INET; + addr4->sin_port = htons(cfg_port); +- if (inet_pton(AF_INET, str_addr, &(addr4->sin_addr)) != 1) ++ if (str_addr && ++ inet_pton(AF_INET, str_addr, &(addr4->sin_addr)) != 1) + error(1, 0, "ipv4 parse error: %s", str_addr); + break; + case PF_INET6: ++ memset(addr6, 0, sizeof(*addr6)); + addr6->sin6_family = AF_INET6; + addr6->sin6_port = htons(cfg_port); +- if (inet_pton(AF_INET6, str_addr, &(addr6->sin6_addr)) != 1) ++ if (str_addr && ++ inet_pton(AF_INET6, str_addr, &(addr6->sin6_addr)) != 1) + error(1, 0, "ipv6 parse error: %s", str_addr); + break; + default: +@@ -603,6 +609,7 @@ static void parse_opts(int argc, char **argv) + sizeof(struct tcphdr) - + 40 /* max tcp options */; + int c; ++ char *daddr = NULL, *saddr = NULL; + + cfg_payload_len = max_payload_len; + +@@ -627,7 +634,7 @@ static void parse_opts(int argc, char **argv) + cfg_cpu = strtol(optarg, NULL, 0); + break; + case 'D': +- setup_sockaddr(cfg_family, optarg, &cfg_dst_addr); ++ daddr = optarg; + break; + case 'i': + cfg_ifindex = if_nametoindex(optarg); +@@ -638,7 +645,7 @@ static void parse_opts(int argc, char **argv) + cfg_cork_mixed = true; + break; + case 'p': +- cfg_port = htons(strtoul(optarg, NULL, 0)); ++ cfg_port = strtoul(optarg, NULL, 0); + break; + case 'r': + cfg_rx = true; +@@ -647,7 +654,7 @@ static void parse_opts(int argc, char **argv) + cfg_payload_len = strtoul(optarg, NULL, 0); + break; + case 'S': +- setup_sockaddr(cfg_family, optarg, &cfg_src_addr); ++ saddr = optarg; + break; + case 't': + cfg_runtime_ms = 200 + strtoul(optarg, NULL, 10) * 1000; +@@ -660,6 +667,8 @@ static void parse_opts(int argc, char **argv) + break; + } + } ++ setup_sockaddr(cfg_family, daddr, &cfg_dst_addr); ++ setup_sockaddr(cfg_family, saddr, &cfg_src_addr); + + if (cfg_payload_len > max_payload_len) + error(1, 0, "-s: payload exceeds max (%d)", max_payload_len); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.34-35.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.34-35.patch new file mode 100644 index 000000000000..5d531226bf75 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.34-35.patch @@ -0,0 +1,1801 @@ +diff --git a/Makefile b/Makefile +index a6906dfb112e..995666d5e57b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 34 ++SUBLEVEL = 35 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index d8f77358e2ba..513826a43efd 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -651,6 +651,10 @@ static int match_pci_device(struct device *dev, int index, + (modpath->mod == PCI_FUNC(devfn))); + } + ++ /* index might be out of bounds for bc[] */ ++ if (index >= 6) ++ return 0; ++ + id = PCI_SLOT(pdev->devfn) | (PCI_FUNC(pdev->devfn) << 5); + return (modpath->bc[index] == id); + } +diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S +index 8d072c44f300..781c3b9a3e46 100644 +--- a/arch/parisc/kernel/hpmc.S ++++ b/arch/parisc/kernel/hpmc.S +@@ -84,6 +84,7 @@ END(hpmc_pim_data) + .text + + .import intr_save, code ++ .align 16 + ENTRY_CFI(os_hpmc) + .os_hpmc: + +@@ -300,12 +301,15 @@ os_hpmc_6: + + b . + nop ++ .align 16 /* make function length multiple of 16 bytes */ + ENDPROC_CFI(os_hpmc) + .os_hpmc_end: + + + __INITRODATA ++.globl os_hpmc_size + .align 4 +- .export os_hpmc_size ++ .type os_hpmc_size, @object ++ .size os_hpmc_size, 4 + os_hpmc_size: + .word .os_hpmc_end-.os_hpmc +diff --git a/arch/powerpc/kvm/book3s_hv_rm_mmu.c b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +index 4efe364f1188..4962d537c186 100644 +--- a/arch/powerpc/kvm/book3s_hv_rm_mmu.c ++++ b/arch/powerpc/kvm/book3s_hv_rm_mmu.c +@@ -447,8 +447,6 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues, + for (i = 0; i < npages; ++i) { + asm volatile(PPC_TLBIE_5(%0,%1,0,0,0) : : + "r" (rbvalues[i]), "r" (kvm->arch.lpid)); +- trace_tlbie(kvm->arch.lpid, 0, rbvalues[i], +- kvm->arch.lpid, 0, 0, 0); + } + asm volatile("eieio; tlbsync; ptesync" : : : "memory"); + kvm->arch.tlbie_lock = 0; +@@ -458,8 +456,6 @@ static void do_tlbies(struct kvm *kvm, unsigned long *rbvalues, + for (i = 0; i < npages; ++i) { + asm volatile(PPC_TLBIEL(%0,%1,0,0,0) : : + "r" (rbvalues[i]), "r" (0)); +- trace_tlbie(kvm->arch.lpid, 1, rbvalues[i], +- 0, 0, 0, 0); + } + asm volatile("ptesync" : : : "memory"); + } +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index 8e622bb52f7a..d1a0e2c521d7 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -799,6 +799,7 @@ static ssize_t reipl_generic_loadparm_store(struct ipl_parameter_block *ipb, + /* copy and convert to ebcdic */ + memcpy(ipb->hdr.loadparm, buf, lp_len); + ASCEBC(ipb->hdr.loadparm, LOADPARM_LEN); ++ ipb->hdr.flags |= DIAG308_FLAGS_LP_VALID; + return len; + } + +diff --git a/arch/x86/include/asm/mce.h b/arch/x86/include/asm/mce.h +index b1e8d8db921f..340070415c2c 100644 +--- a/arch/x86/include/asm/mce.h ++++ b/arch/x86/include/asm/mce.h +@@ -346,6 +346,7 @@ enum smca_bank_types { + SMCA_IF, /* Instruction Fetch */ + SMCA_L2_CACHE, /* L2 Cache */ + SMCA_DE, /* Decoder Unit */ ++ SMCA_RESERVED, /* Reserved */ + SMCA_EX, /* Execution Unit */ + SMCA_FP, /* Floating Point */ + SMCA_L3_CACHE, /* L3 Cache */ +@@ -376,6 +377,7 @@ struct smca_bank { + extern struct smca_bank smca_banks[MAX_NR_BANKS]; + + extern const char *smca_get_long_name(enum smca_bank_types t); ++extern bool amd_mce_is_memory_error(struct mce *m); + + extern int mce_threshold_create_device(unsigned int cpu); + extern int mce_threshold_remove_device(unsigned int cpu); +@@ -384,6 +386,7 @@ extern int mce_threshold_remove_device(unsigned int cpu); + + static inline int mce_threshold_create_device(unsigned int cpu) { return 0; }; + static inline int mce_threshold_remove_device(unsigned int cpu) { return 0; }; ++static inline bool amd_mce_is_memory_error(struct mce *m) { return false; }; + + #endif + +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index e13d652fc30a..28d27de08545 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -512,10 +512,8 @@ static int mce_usable_address(struct mce *m) + bool mce_is_memory_error(struct mce *m) + { + if (m->cpuvendor == X86_VENDOR_AMD) { +- /* ErrCodeExt[20:16] */ +- u8 xec = (m->status >> 16) & 0x1f; ++ return amd_mce_is_memory_error(m); + +- return (xec == 0x0 || xec == 0x8); + } else if (m->cpuvendor == X86_VENDOR_INTEL) { + /* + * Intel SDM Volume 3B - 15.9.2 Compound Error Codes +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 486f640b02ef..259c75d7a2a0 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -82,6 +82,7 @@ static struct smca_bank_name smca_names[] = { + [SMCA_IF] = { "insn_fetch", "Instruction Fetch Unit" }, + [SMCA_L2_CACHE] = { "l2_cache", "L2 Cache" }, + [SMCA_DE] = { "decode_unit", "Decode Unit" }, ++ [SMCA_RESERVED] = { "reserved", "Reserved" }, + [SMCA_EX] = { "execution_unit", "Execution Unit" }, + [SMCA_FP] = { "floating_point", "Floating Point Unit" }, + [SMCA_L3_CACHE] = { "l3_cache", "L3 Cache" }, +@@ -110,9 +111,26 @@ const char *smca_get_long_name(enum smca_bank_types t) + } + EXPORT_SYMBOL_GPL(smca_get_long_name); + ++static enum smca_bank_types smca_get_bank_type(unsigned int bank) ++{ ++ struct smca_bank *b; ++ ++ if (bank >= MAX_NR_BANKS) ++ return N_SMCA_BANK_TYPES; ++ ++ b = &smca_banks[bank]; ++ if (!b->hwid) ++ return N_SMCA_BANK_TYPES; ++ ++ return b->hwid->bank_type; ++} ++ + static struct smca_hwid smca_hwid_mcatypes[] = { + /* { bank_type, hwid_mcatype, xec_bitmap } */ + ++ /* Reserved type */ ++ { SMCA_RESERVED, HWID_MCATYPE(0x00, 0x0), 0x0 }, ++ + /* ZN Core (HWID=0xB0) MCA types */ + { SMCA_LS, HWID_MCATYPE(0xB0, 0x0), 0x1FFFEF }, + { SMCA_IF, HWID_MCATYPE(0xB0, 0x1), 0x3FFF }, +@@ -416,7 +434,25 @@ static u32 get_block_address(unsigned int cpu, u32 current_addr, u32 low, u32 hi + { + u32 addr = 0, offset = 0; + ++ if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS)) ++ return addr; ++ ++ /* Get address from already initialized block. */ ++ if (per_cpu(threshold_banks, cpu)) { ++ struct threshold_bank *bankp = per_cpu(threshold_banks, cpu)[bank]; ++ ++ if (bankp && bankp->blocks) { ++ struct threshold_block *blockp = &bankp->blocks[block]; ++ ++ if (blockp) ++ return blockp->address; ++ } ++ } ++ + if (mce_flags.smca) { ++ if (smca_get_bank_type(bank) == SMCA_RESERVED) ++ return addr; ++ + if (!block) { + addr = MSR_AMD64_SMCA_MCx_MISC(bank); + } else { +@@ -738,6 +774,17 @@ int umc_normaddr_to_sysaddr(u64 norm_addr, u16 nid, u8 umc, u64 *sys_addr) + } + EXPORT_SYMBOL_GPL(umc_normaddr_to_sysaddr); + ++bool amd_mce_is_memory_error(struct mce *m) ++{ ++ /* ErrCodeExt[20:16] */ ++ u8 xec = (m->status >> 16) & 0x1f; ++ ++ if (mce_flags.smca) ++ return smca_get_bank_type(m->bank) == SMCA_UMC && xec == 0x0; ++ ++ return m->bank == 4 && xec == 0x8; ++} ++ + static void __log_error(unsigned int bank, u64 status, u64 addr, u64 misc) + { + struct mce m; +@@ -1036,7 +1083,7 @@ static struct kobj_type threshold_ktype = { + + static const char *get_name(unsigned int bank, struct threshold_block *b) + { +- unsigned int bank_type; ++ enum smca_bank_types bank_type; + + if (!mce_flags.smca) { + if (b && bank == 4) +@@ -1045,11 +1092,10 @@ static const char *get_name(unsigned int bank, struct threshold_block *b) + return th_names[bank]; + } + +- if (!smca_banks[bank].hwid) ++ bank_type = smca_get_bank_type(bank); ++ if (bank_type >= N_SMCA_BANK_TYPES) + return NULL; + +- bank_type = smca_banks[bank].hwid->bank_type; +- + if (b && bank_type == SMCA_UMC) { + if (b->block < ARRAY_SIZE(smca_umc_block_names)) + return smca_umc_block_names[b->block]; +diff --git a/block/blk-mq-cpumap.c b/block/blk-mq-cpumap.c +index 9f8cffc8a701..3eb169f15842 100644 +--- a/block/blk-mq-cpumap.c ++++ b/block/blk-mq-cpumap.c +@@ -16,11 +16,6 @@ + + static int cpu_to_queue_index(unsigned int nr_queues, const int cpu) + { +- /* +- * Non present CPU will be mapped to queue index 0. +- */ +- if (!cpu_present(cpu)) +- return 0; + return cpu % nr_queues; + } + +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index f14b4326e855..67a860790560 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -2748,15 +2748,21 @@ static void acpi_nfit_scrub(struct work_struct *work) + static int acpi_nfit_register_regions(struct acpi_nfit_desc *acpi_desc) + { + struct nfit_spa *nfit_spa; +- int rc; + +- list_for_each_entry(nfit_spa, &acpi_desc->spas, list) +- if (nfit_spa_type(nfit_spa->spa) == NFIT_SPA_DCR) { +- /* BLK regions don't need to wait for ars results */ +- rc = acpi_nfit_register_region(acpi_desc, nfit_spa); +- if (rc) +- return rc; +- } ++ list_for_each_entry(nfit_spa, &acpi_desc->spas, list) { ++ int rc, type = nfit_spa_type(nfit_spa->spa); ++ ++ /* PMEM and VMEM will be registered by the ARS workqueue */ ++ if (type == NFIT_SPA_PM || type == NFIT_SPA_VOLATILE) ++ continue; ++ /* BLK apertures belong to BLK region registration below */ ++ if (type == NFIT_SPA_BDW) ++ continue; ++ /* BLK regions don't need to wait for ARS results */ ++ rc = acpi_nfit_register_region(acpi_desc, nfit_spa); ++ if (rc) ++ return rc; ++ } + + acpi_desc->ars_start_flags = 0; + if (!acpi_desc->cancel) +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 19858a146f30..754852156622 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1098,11 +1098,15 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + if (info->lo_encrypt_type) { + unsigned int type = info->lo_encrypt_type; + +- if (type >= MAX_LO_CRYPT) +- return -EINVAL; ++ if (type >= MAX_LO_CRYPT) { ++ err = -EINVAL; ++ goto exit; ++ } + xfer = xfer_funcs[type]; +- if (xfer == NULL) +- return -EINVAL; ++ if (xfer == NULL) { ++ err = -EINVAL; ++ goto exit; ++ } + } else + xfer = NULL; + +diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c +index 73d2d88ddc03..32527bdf4b50 100644 +--- a/drivers/bluetooth/hci_bcm.c ++++ b/drivers/bluetooth/hci_bcm.c +@@ -694,22 +694,6 @@ static const struct acpi_gpio_mapping acpi_bcm_int_first_gpios[] = { + #ifdef CONFIG_ACPI + /* IRQ polarity of some chipsets are not defined correctly in ACPI table. */ + static const struct dmi_system_id bcm_active_low_irq_dmi_table[] = { +- { +- .ident = "Asus T100TA", +- .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, +- "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100TA"), +- }, +- }, +- { +- .ident = "Asus T100CHI", +- .matches = { +- DMI_EXACT_MATCH(DMI_SYS_VENDOR, +- "ASUSTeK COMPUTER INC."), +- DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "T100CHI"), +- }, +- }, + { /* Handle ThinkPad 8 tablets with BCM2E55 chipset ACPI ID */ + .ident = "Lenovo ThinkPad 8", + .matches = { +@@ -730,7 +714,9 @@ static int bcm_resource(struct acpi_resource *ares, void *data) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_EXTENDED_IRQ: + irq = &ares->data.extended_irq; +- dev->irq_active_low = irq->polarity == ACPI_ACTIVE_LOW; ++ if (irq->polarity != ACPI_ACTIVE_LOW) ++ dev_info(&dev->pdev->dev, "ACPI Interrupt resource is active-high, this is usually wrong, treating the IRQ as active-low\n"); ++ dev->irq_active_low = true; + break; + + case ACPI_RESOURCE_TYPE_GPIO: +diff --git a/drivers/edac/mce_amd.c b/drivers/edac/mce_amd.c +index a11a671c7a38..2ab4d61ee47e 100644 +--- a/drivers/edac/mce_amd.c ++++ b/drivers/edac/mce_amd.c +@@ -854,21 +854,24 @@ static void decode_mc6_mce(struct mce *m) + static void decode_smca_error(struct mce *m) + { + struct smca_hwid *hwid; +- unsigned int bank_type; ++ enum smca_bank_types bank_type; + const char *ip_name; + u8 xec = XEC(m->status, xec_mask); + + if (m->bank >= ARRAY_SIZE(smca_banks)) + return; + +- if (x86_family(m->cpuid) >= 0x17 && m->bank == 4) +- pr_emerg(HW_ERR "Bank 4 is reserved on Fam17h.\n"); +- + hwid = smca_banks[m->bank].hwid; + if (!hwid) + return; + + bank_type = hwid->bank_type; ++ ++ if (bank_type == SMCA_RESERVED) { ++ pr_emerg(HW_ERR "Bank %d is reserved.\n", m->bank); ++ return; ++ } ++ + ip_name = smca_get_long_name(bank_type); + + pr_emerg(HW_ERR "%s Extended Error Code: %d\n", ip_name, xec); +diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c +index baadb706c276..b19a54dd18de 100644 +--- a/drivers/gpu/drm/radeon/radeon_object.c ++++ b/drivers/gpu/drm/radeon/radeon_object.c +@@ -240,9 +240,10 @@ int radeon_bo_create(struct radeon_device *rdev, + * may be slow + * See https://bugs.freedesktop.org/show_bug.cgi?id=88758 + */ +- ++#ifndef CONFIG_COMPILE_TEST + #warning Please enable CONFIG_MTRR and CONFIG_X86_PAT for better performance \ + thanks to write-combining ++#endif + + if (bo->flags & RADEON_GEM_GTT_WC) + DRM_INFO_ONCE("Please enable CONFIG_MTRR and CONFIG_X86_PAT for " +diff --git a/drivers/hv/channel_mgmt.c b/drivers/hv/channel_mgmt.c +index 65c6d6bdce4c..1939c0ca3741 100644 +--- a/drivers/hv/channel_mgmt.c ++++ b/drivers/hv/channel_mgmt.c +@@ -71,7 +71,7 @@ static const struct vmbus_device vmbus_devs[] = { + /* PCIE */ + { .dev_type = HV_PCIE, + HV_PCIE_GUID, +- .perf_device = true, ++ .perf_device = false, + }, + + /* Synthetic Frame Buffer */ +diff --git a/drivers/hwmon/ina2xx.c b/drivers/hwmon/ina2xx.c +index e362a932fe8c..e9e6aeabbf84 100644 +--- a/drivers/hwmon/ina2xx.c ++++ b/drivers/hwmon/ina2xx.c +@@ -454,6 +454,7 @@ static int ina2xx_probe(struct i2c_client *client, + + /* set the device type */ + data->config = &ina2xx_config[chip]; ++ mutex_init(&data->config_lock); + + if (of_property_read_u32(dev->of_node, "shunt-resistor", &val) < 0) { + struct ina2xx_platform_data *pdata = dev_get_platdata(dev); +@@ -480,8 +481,6 @@ static int ina2xx_probe(struct i2c_client *client, + return -ENODEV; + } + +- mutex_init(&data->config_lock); +- + data->groups[group++] = &ina2xx_group; + if (id->driver_data == ina226) + data->groups[group++] = &ina226_group; +diff --git a/drivers/media/platform/vsp1/vsp1_dl.c b/drivers/media/platform/vsp1/vsp1_dl.c +index 8b5cbb6b7a70..e5d8d99e124c 100644 +--- a/drivers/media/platform/vsp1/vsp1_dl.c ++++ b/drivers/media/platform/vsp1/vsp1_dl.c +@@ -508,7 +508,8 @@ static bool vsp1_dl_list_hw_update_pending(struct vsp1_dl_manager *dlm) + return !!(vsp1_read(vsp1, VI6_DL_BODY_SIZE) + & VI6_DL_BODY_SIZE_UPD); + else +- return !!(vsp1_read(vsp1, VI6_CMD(dlm->index) & VI6_CMD_UPDHDR)); ++ return !!(vsp1_read(vsp1, VI6_CMD(dlm->index)) ++ & VI6_CMD_UPDHDR); + } + + static void vsp1_dl_list_hw_enqueue(struct vsp1_dl_list *dl) +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index cbeea8343a5c..6730fd08ef03 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -101,7 +101,7 @@ static int get_v4l2_window32(struct v4l2_window __user *kp, + static int put_v4l2_window32(struct v4l2_window __user *kp, + struct v4l2_window32 __user *up) + { +- struct v4l2_clip __user *kclips = kp->clips; ++ struct v4l2_clip __user *kclips; + struct v4l2_clip32 __user *uclips; + compat_caddr_t p; + u32 clipcount; +@@ -116,6 +116,8 @@ static int put_v4l2_window32(struct v4l2_window __user *kp, + if (!clipcount) + return 0; + ++ if (get_user(kclips, &kp->clips)) ++ return -EFAULT; + if (get_user(p, &up->clips)) + return -EFAULT; + uclips = compat_ptr(p); +diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c +index 5782733959f0..f4e93f5fc204 100644 +--- a/drivers/net/slip/slhc.c ++++ b/drivers/net/slip/slhc.c +@@ -509,6 +509,10 @@ slhc_uncompress(struct slcompress *comp, unsigned char *icp, int isize) + if(x < 0 || x > comp->rslot_limit) + goto bad; + ++ /* Check if the cstate is initialized */ ++ if (!comp->rstate[x].initialized) ++ goto bad; ++ + comp->flags &=~ SLF_TOSS; + comp->recv_current = x; + } else { +@@ -673,6 +677,7 @@ slhc_remember(struct slcompress *comp, unsigned char *icp, int isize) + if (cs->cs_tcp.doff > 5) + memcpy(cs->cs_tcpopt, icp + ihl*4 + sizeof(struct tcphdr), (cs->cs_tcp.doff - 5) * 4); + cs->cs_hsize = ihl*2 + cs->cs_tcp.doff*2; ++ cs->initialized = true; + /* Put headers back on packet + * Neither header checksum is recalculated + */ +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index 05dca3e5c93d..178b956501a7 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -895,6 +895,12 @@ static const struct usb_device_id products[] = { + USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&wwan_info, ++}, { ++ /* Cinterion AHS3 modem by GEMALTO */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x1e2d, 0x0055, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&wwan_info, + }, { + USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET, + USB_CDC_PROTO_NONE), +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 89d82c4ee8df..1fb464837b3e 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -928,7 +928,8 @@ static int lan78xx_read_otp(struct lan78xx_net *dev, u32 offset, + offset += 0x100; + else + ret = -EINVAL; +- ret = lan78xx_read_raw_otp(dev, offset, length, data); ++ if (!ret) ++ ret = lan78xx_read_raw_otp(dev, offset, length, data); + } + + return ret; +diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c +index 396bf05c6bf6..d8b041f48ca8 100644 +--- a/drivers/net/wireless/ath/ath9k/xmit.c ++++ b/drivers/net/wireless/ath/ath9k/xmit.c +@@ -2892,6 +2892,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + struct ath_txq *txq; + int tidno; + ++ rcu_read_lock(); ++ + for (tidno = 0; tidno < IEEE80211_NUM_TIDS; tidno++) { + tid = ath_node_to_tid(an, tidno); + txq = tid->txq; +@@ -2909,6 +2911,8 @@ void ath_tx_node_cleanup(struct ath_softc *sc, struct ath_node *an) + if (!an->sta) + break; /* just one multicast ath_atx_tid */ + } ++ ++ rcu_read_unlock(); + } + + #ifdef CONFIG_ATH9K_TX99 +diff --git a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +index 121b94f09714..9a1d15b3ce45 100644 +--- a/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c ++++ b/drivers/net/wireless/realtek/rtl818x/rtl8187/dev.c +@@ -1450,6 +1450,7 @@ static int rtl8187_probe(struct usb_interface *intf, + goto err_free_dev; + } + mutex_init(&priv->io_mutex); ++ mutex_init(&priv->conf_mutex); + + SET_IEEE80211_DEV(dev, &intf->dev); + usb_set_intfdata(intf, dev); +@@ -1625,7 +1626,6 @@ static int rtl8187_probe(struct usb_interface *intf, + printk(KERN_ERR "rtl8187: Cannot register device\n"); + goto err_free_dmabuf; + } +- mutex_init(&priv->conf_mutex); + skb_queue_head_init(&priv->b_tx_status.queue); + + wiphy_info(dev->wiphy, "hwaddr %pM, %s V%d + %s, rfkill mask %d\n", +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 04dac6a42c9f..73b724143be0 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -457,7 +457,6 @@ struct hv_pcibus_device { + spinlock_t device_list_lock; /* Protect lists below */ + void __iomem *cfg_addr; + +- struct semaphore enum_sem; + struct list_head resources_for_children; + + struct list_head children; +@@ -471,6 +470,8 @@ struct hv_pcibus_device { + struct retarget_msi_interrupt retarget_msi_interrupt_params; + + spinlock_t retarget_msi_interrupt_lock; ++ ++ struct workqueue_struct *wq; + }; + + /* +@@ -1604,12 +1605,8 @@ static struct hv_pci_dev *get_pcichild_wslot(struct hv_pcibus_device *hbus, + * It must also treat the omission of a previously observed device as + * notification that the device no longer exists. + * +- * Note that this function is a work item, and it may not be +- * invoked in the order that it was queued. Back to back +- * updates of the list of present devices may involve queuing +- * multiple work items, and this one may run before ones that +- * were sent later. As such, this function only does something +- * if is the last one in the queue. ++ * Note that this function is serialized with hv_eject_device_work(), ++ * because both are pushed to the ordered workqueue hbus->wq. + */ + static void pci_devices_present_work(struct work_struct *work) + { +@@ -1630,11 +1627,6 @@ static void pci_devices_present_work(struct work_struct *work) + + INIT_LIST_HEAD(&removed); + +- if (down_interruptible(&hbus->enum_sem)) { +- put_hvpcibus(hbus); +- return; +- } +- + /* Pull this off the queue and process it if it was the last one. */ + spin_lock_irqsave(&hbus->device_list_lock, flags); + while (!list_empty(&hbus->dr_list)) { +@@ -1651,7 +1643,6 @@ static void pci_devices_present_work(struct work_struct *work) + spin_unlock_irqrestore(&hbus->device_list_lock, flags); + + if (!dr) { +- up(&hbus->enum_sem); + put_hvpcibus(hbus); + return; + } +@@ -1738,7 +1729,6 @@ static void pci_devices_present_work(struct work_struct *work) + break; + } + +- up(&hbus->enum_sem); + put_hvpcibus(hbus); + kfree(dr); + } +@@ -1784,7 +1774,7 @@ static void hv_pci_devices_present(struct hv_pcibus_device *hbus, + spin_unlock_irqrestore(&hbus->device_list_lock, flags); + + get_hvpcibus(hbus); +- schedule_work(&dr_wrk->wrk); ++ queue_work(hbus->wq, &dr_wrk->wrk); + } + + /** +@@ -1862,7 +1852,7 @@ static void hv_pci_eject_device(struct hv_pci_dev *hpdev) + get_pcichild(hpdev, hv_pcidev_ref_pnp); + INIT_WORK(&hpdev->wrk, hv_eject_device_work); + get_hvpcibus(hpdev->hbus); +- schedule_work(&hpdev->wrk); ++ queue_work(hpdev->hbus->wq, &hpdev->wrk); + } + + /** +@@ -2475,13 +2465,18 @@ static int hv_pci_probe(struct hv_device *hdev, + spin_lock_init(&hbus->config_lock); + spin_lock_init(&hbus->device_list_lock); + spin_lock_init(&hbus->retarget_msi_interrupt_lock); +- sema_init(&hbus->enum_sem, 1); + init_completion(&hbus->remove_event); ++ hbus->wq = alloc_ordered_workqueue("hv_pci_%x", 0, ++ hbus->sysdata.domain); ++ if (!hbus->wq) { ++ ret = -ENOMEM; ++ goto free_bus; ++ } + + ret = vmbus_open(hdev->channel, pci_ring_size, pci_ring_size, NULL, 0, + hv_pci_onchannelcallback, hbus); + if (ret) +- goto free_bus; ++ goto destroy_wq; + + hv_set_drvdata(hdev, hbus); + +@@ -2550,6 +2545,8 @@ static int hv_pci_probe(struct hv_device *hdev, + hv_free_config_window(hbus); + close: + vmbus_close(hdev->channel); ++destroy_wq: ++ destroy_workqueue(hbus->wq); + free_bus: + free_page((unsigned long)hbus); + return ret; +@@ -2629,6 +2626,7 @@ static int hv_pci_remove(struct hv_device *hdev) + irq_domain_free_fwnode(hbus->sysdata.fwnode); + put_hvpcibus(hbus); + wait_for_completion(&hbus->remove_event); ++ destroy_workqueue(hbus->wq); + free_page((unsigned long)hbus); + return 0; + } +diff --git a/drivers/s390/cio/qdio_main.c b/drivers/s390/cio/qdio_main.c +index a4ad39ba3873..8941e7caaf4d 100644 +--- a/drivers/s390/cio/qdio_main.c ++++ b/drivers/s390/cio/qdio_main.c +@@ -126,7 +126,7 @@ static inline int qdio_check_ccq(struct qdio_q *q, unsigned int ccq) + static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state, + int start, int count, int auto_ack) + { +- int rc, tmp_count = count, tmp_start = start, nr = q->nr, retried = 0; ++ int rc, tmp_count = count, tmp_start = start, nr = q->nr; + unsigned int ccq = 0; + + qperf_inc(q, eqbs); +@@ -149,14 +149,7 @@ static int qdio_do_eqbs(struct qdio_q *q, unsigned char *state, + qperf_inc(q, eqbs_partial); + DBF_DEV_EVENT(DBF_WARN, q->irq_ptr, "EQBS part:%02x", + tmp_count); +- /* +- * Retry once, if that fails bail out and process the +- * extracted buffers before trying again. +- */ +- if (!retried++) +- goto again; +- else +- return count - tmp_count; ++ return count - tmp_count; + } + + DBF_ERROR("%4x EQBS ERROR", SCH_NO(q)); +@@ -212,7 +205,10 @@ static int qdio_do_sqbs(struct qdio_q *q, unsigned char state, int start, + return 0; + } + +-/* returns number of examined buffers and their common state in *state */ ++/* ++ * Returns number of examined buffers and their common state in *state. ++ * Requested number of buffers-to-examine must be > 0. ++ */ + static inline int get_buf_states(struct qdio_q *q, unsigned int bufnr, + unsigned char *state, unsigned int count, + int auto_ack, int merge_pending) +@@ -223,17 +219,23 @@ static inline int get_buf_states(struct qdio_q *q, unsigned int bufnr, + if (is_qebsm(q)) + return qdio_do_eqbs(q, state, bufnr, count, auto_ack); + +- for (i = 0; i < count; i++) { +- if (!__state) { +- __state = q->slsb.val[bufnr]; +- if (merge_pending && __state == SLSB_P_OUTPUT_PENDING) +- __state = SLSB_P_OUTPUT_EMPTY; +- } else if (merge_pending) { +- if ((q->slsb.val[bufnr] & __state) != __state) +- break; +- } else if (q->slsb.val[bufnr] != __state) +- break; ++ /* get initial state: */ ++ __state = q->slsb.val[bufnr]; ++ if (merge_pending && __state == SLSB_P_OUTPUT_PENDING) ++ __state = SLSB_P_OUTPUT_EMPTY; ++ ++ for (i = 1; i < count; i++) { + bufnr = next_buf(bufnr); ++ ++ /* merge PENDING into EMPTY: */ ++ if (merge_pending && ++ q->slsb.val[bufnr] == SLSB_P_OUTPUT_PENDING && ++ __state == SLSB_P_OUTPUT_EMPTY) ++ continue; ++ ++ /* stop if next state differs from initial state: */ ++ if (q->slsb.val[bufnr] != __state) ++ break; + } + *state = __state; + return i; +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 1e17175692d3..8e7c0626f8b5 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -459,9 +459,6 @@ static int qla2x00_alloc_queues(struct qla_hw_data *ha, struct req_que *req, + + static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + { +- if (!ha->req_q_map) +- return; +- + if (IS_QLAFX00(ha)) { + if (req && req->ring_fx00) + dma_free_coherent(&ha->pdev->dev, +@@ -472,17 +469,14 @@ static void qla2x00_free_req_que(struct qla_hw_data *ha, struct req_que *req) + (req->length + 1) * sizeof(request_t), + req->ring, req->dma); + +- if (req) { ++ if (req) + kfree(req->outstanding_cmds); +- kfree(req); +- } ++ ++ kfree(req); + } + + static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + { +- if (!ha->rsp_q_map) +- return; +- + if (IS_QLAFX00(ha)) { + if (rsp && rsp->ring) + dma_free_coherent(&ha->pdev->dev, +@@ -493,8 +487,7 @@ static void qla2x00_free_rsp_que(struct qla_hw_data *ha, struct rsp_que *rsp) + (rsp->length + 1) * sizeof(response_t), + rsp->ring, rsp->dma); + } +- if (rsp) +- kfree(rsp); ++ kfree(rsp); + } + + static void qla2x00_free_queues(struct qla_hw_data *ha) +@@ -3075,7 +3068,8 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + goto probe_failed; + + /* Alloc arrays of request and response ring ptrs */ +- if (qla2x00_alloc_queues(ha, req, rsp)) { ++ ret = qla2x00_alloc_queues(ha, req, rsp); ++ if (ret) { + ql_log(ql_log_fatal, base_vha, 0x003d, + "Failed to allocate memory for queue pointers..." + "aborting.\n"); +@@ -3368,8 +3362,15 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + } + + qla2x00_free_device(base_vha); +- + scsi_host_put(base_vha->host); ++ /* ++ * Need to NULL out local req/rsp after ++ * qla2x00_free_device => qla2x00_free_queues frees ++ * what these are pointing to. Or else we'll ++ * fall over below in qla2x00_free_req/rsp_que. ++ */ ++ req = NULL; ++ rsp = NULL; + + probe_hw_failed: + qla2x00_mem_free(ha); +@@ -4062,6 +4063,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + (*rsp)->dma = 0; + fail_rsp_ring: + kfree(*rsp); ++ *rsp = NULL; + fail_rsp: + dma_free_coherent(&ha->pdev->dev, ((*req)->length + 1) * + sizeof(request_t), (*req)->ring, (*req)->dma); +@@ -4069,6 +4071,7 @@ qla2x00_mem_alloc(struct qla_hw_data *ha, uint16_t req_len, uint16_t rsp_len, + (*req)->dma = 0; + fail_req_ring: + kfree(*req); ++ *req = NULL; + fail_req: + dma_free_coherent(&ha->pdev->dev, sizeof(struct ct_sns_pkt), + ha->ct_sns, ha->ct_sns_dma); +@@ -4436,16 +4439,11 @@ qla2x00_mem_free(struct qla_hw_data *ha) + dma_free_coherent(&ha->pdev->dev, ha->init_cb_size, + ha->init_cb, ha->init_cb_dma); + +- if (ha->optrom_buffer) +- vfree(ha->optrom_buffer); +- if (ha->nvram) +- kfree(ha->nvram); +- if (ha->npiv_info) +- kfree(ha->npiv_info); +- if (ha->swl) +- kfree(ha->swl); +- if (ha->loop_id_map) +- kfree(ha->loop_id_map); ++ vfree(ha->optrom_buffer); ++ kfree(ha->nvram); ++ kfree(ha->npiv_info); ++ kfree(ha->swl); ++ kfree(ha->loop_id_map); + + ha->srb_mempool = NULL; + ha->ctx_mempool = NULL; +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index c692e0b13242..8e3ca4400766 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -756,7 +756,7 @@ static int vhost_copy_to_user(struct vhost_virtqueue *vq, void __user *to, + struct iov_iter t; + void __user *uaddr = vhost_vq_meta_fetch(vq, + (u64)(uintptr_t)to, size, +- VHOST_ADDR_DESC); ++ VHOST_ADDR_USED); + + if (uaddr) + return __copy_to_user(uaddr, from, size); +@@ -1252,10 +1252,12 @@ static int vq_log_access_ok(struct vhost_virtqueue *vq, + /* Caller should have vq mutex and device mutex */ + int vhost_vq_access_ok(struct vhost_virtqueue *vq) + { +- int ret = vq_log_access_ok(vq, vq->log_base); ++ if (!vq_log_access_ok(vq, vq->log_base)) ++ return 0; + +- if (ret || vq->iotlb) +- return ret; ++ /* Access validation occurs at prefetch time with IOTLB */ ++ if (vq->iotlb) ++ return 1; + + return vq_access_ok(vq, vq->num, vq->desc, vq->avail, vq->used); + } +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index f3b089b7c0b6..d2edbc79384a 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -365,7 +365,7 @@ void xenbus_dev_queue_reply(struct xb_req_data *req) + if (WARN_ON(rc)) + goto out; + } +- } else if (req->msg.type == XS_TRANSACTION_END) { ++ } else if (req->type == XS_TRANSACTION_END) { + trans = xenbus_get_transaction(u, req->msg.tx_id); + if (WARN_ON(!trans)) + goto out; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index bfe6a8ccc3a0..d5021ba69e7a 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -191,8 +191,9 @@ static void select_policy(struct f2fs_sb_info *sbi, int gc_type, + if (gc_type != FG_GC && p->max_search > sbi->max_victim_search) + p->max_search = sbi->max_victim_search; + +- /* let's select beginning hot/small space first */ +- if (type == CURSEG_HOT_DATA || IS_NODESEG(type)) ++ /* let's select beginning hot/small space first in no_heap mode*/ ++ if (test_opt(sbi, NOHEAP) && ++ (type == CURSEG_HOT_DATA || IS_NODESEG(type))) + p->offset = 0; + else + p->offset = SIT_I(sbi)->last_victim[p->gc_mode]; +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index c695ff462ee6..271516db8939 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -1992,7 +1992,8 @@ static unsigned int __get_next_segno(struct f2fs_sb_info *sbi, int type) + if (sbi->segs_per_sec != 1) + return CURSEG_I(sbi, type)->segno; + +- if (type == CURSEG_HOT_DATA || IS_NODESEG(type)) ++ if (test_opt(sbi, NOHEAP) && ++ (type == CURSEG_HOT_DATA || IS_NODESEG(type))) + return 0; + + if (SIT_I(sbi)->last_victim[ALLOC_NEXT]) +diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c +index 3b293d0d1785..2a6ed036d207 100644 +--- a/fs/hugetlbfs/inode.c ++++ b/fs/hugetlbfs/inode.c +@@ -148,10 +148,14 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma) + + /* + * page based offset in vm_pgoff could be sufficiently large to +- * overflow a (l)off_t when converted to byte offset. ++ * overflow a loff_t when converted to byte offset. This can ++ * only happen on architectures where sizeof(loff_t) == ++ * sizeof(unsigned long). So, only check in those instances. + */ +- if (vma->vm_pgoff & PGOFF_LOFFT_MAX) +- return -EINVAL; ++ if (sizeof(unsigned long) == sizeof(loff_t)) { ++ if (vma->vm_pgoff & PGOFF_LOFFT_MAX) ++ return -EINVAL; ++ } + + /* must be huge page aligned */ + if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT)) +diff --git a/fs/namei.c b/fs/namei.c +index f839b0750ca3..0b46b858cd42 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -222,9 +222,10 @@ getname_kernel(const char * filename) + if (len <= EMBEDDED_NAME_MAX) { + result->name = (char *)result->iname; + } else if (len <= PATH_MAX) { ++ const size_t size = offsetof(struct filename, iname[1]); + struct filename *tmp; + +- tmp = kmalloc(sizeof(*tmp), GFP_KERNEL); ++ tmp = kmalloc(size, GFP_KERNEL); + if (unlikely(!tmp)) { + __putname(result); + return ERR_PTR(-ENOMEM); +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 8ce60986fb75..5b6ff168d11a 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -32,6 +32,7 @@ + * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ ++#include + #include + #include + #include +@@ -252,11 +253,13 @@ do_open_lookup(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, stru + * Note: create modes (UNCHECKED,GUARDED...) are the same + * in NFSv4 as in v3 except EXCLUSIVE4_1. + */ ++ current->fs->umask = open->op_umask; + status = do_nfsd_create(rqstp, current_fh, open->op_fname.data, + open->op_fname.len, &open->op_iattr, + *resfh, open->op_createmode, + (u32 *)open->op_verf.data, + &open->op_truncate, &open->op_created); ++ current->fs->umask = 0; + + if (!status && open->op_label.len) + nfsd4_security_inode_setsecctx(*resfh, &open->op_label, open->op_bmval); +@@ -608,6 +611,7 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + if (status) + return status; + ++ current->fs->umask = create->cr_umask; + switch (create->cr_type) { + case NF4LNK: + status = nfsd_symlink(rqstp, &cstate->current_fh, +@@ -616,20 +620,22 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + break; + + case NF4BLK: ++ status = nfserr_inval; + rdev = MKDEV(create->cr_specdata1, create->cr_specdata2); + if (MAJOR(rdev) != create->cr_specdata1 || + MINOR(rdev) != create->cr_specdata2) +- return nfserr_inval; ++ goto out_umask; + status = nfsd_create(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + &create->cr_iattr, S_IFBLK, rdev, &resfh); + break; + + case NF4CHR: ++ status = nfserr_inval; + rdev = MKDEV(create->cr_specdata1, create->cr_specdata2); + if (MAJOR(rdev) != create->cr_specdata1 || + MINOR(rdev) != create->cr_specdata2) +- return nfserr_inval; ++ goto out_umask; + status = nfsd_create(rqstp, &cstate->current_fh, + create->cr_name, create->cr_namelen, + &create->cr_iattr,S_IFCHR, rdev, &resfh); +@@ -673,6 +679,8 @@ nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + fh_dup2(&cstate->current_fh, &resfh); + out: + fh_put(&resfh); ++out_umask: ++ current->fs->umask = 0; + return status; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 2c61c6b8ae09..df2b8849a63b 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -33,7 +33,6 @@ + * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +-#include + #include + #include + #include +@@ -683,7 +682,7 @@ nfsd4_decode_create(struct nfsd4_compoundargs *argp, struct nfsd4_create *create + + status = nfsd4_decode_fattr(argp, create->cr_bmval, &create->cr_iattr, + &create->cr_acl, &create->cr_label, +- ¤t->fs->umask); ++ &create->cr_umask); + if (status) + goto out; + +@@ -928,7 +927,6 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + case NFS4_OPEN_NOCREATE: + break; + case NFS4_OPEN_CREATE: +- current->fs->umask = 0; + READ_BUF(4); + open->op_createmode = be32_to_cpup(p++); + switch (open->op_createmode) { +@@ -936,7 +934,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + case NFS4_CREATE_GUARDED: + status = nfsd4_decode_fattr(argp, open->op_bmval, + &open->op_iattr, &open->op_acl, &open->op_label, +- ¤t->fs->umask); ++ &open->op_umask); + if (status) + goto out; + break; +@@ -951,7 +949,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs *argp, struct nfsd4_open *open) + COPYMEM(open->op_verf.data, NFS4_VERIFIER_SIZE); + status = nfsd4_decode_fattr(argp, open->op_bmval, + &open->op_iattr, &open->op_acl, &open->op_label, +- ¤t->fs->umask); ++ &open->op_umask); + if (status) + goto out; + break; +diff --git a/fs/nfsd/xdr4.h b/fs/nfsd/xdr4.h +index 1e4edbf70052..aa4375eac475 100644 +--- a/fs/nfsd/xdr4.h ++++ b/fs/nfsd/xdr4.h +@@ -118,6 +118,7 @@ struct nfsd4_create { + } u; + u32 cr_bmval[3]; /* request */ + struct iattr cr_iattr; /* request */ ++ int cr_umask; /* request */ + struct nfsd4_change_info cr_cinfo; /* response */ + struct nfs4_acl *cr_acl; + struct xdr_netobj cr_label; +@@ -228,6 +229,7 @@ struct nfsd4_open { + u32 op_why_no_deleg; /* response - DELEG_NONE_EXT only */ + u32 op_create; /* request */ + u32 op_createmode; /* request */ ++ int op_umask; /* request */ + u32 op_bmval[3]; /* request */ + struct iattr op_iattr; /* UNCHECKED4, GUARDED4, EXCLUSIVE4_1 */ + nfs4_verifier op_verf __attribute__((aligned(32))); +diff --git a/fs/overlayfs/namei.c b/fs/overlayfs/namei.c +index 4bb7e4f53ea6..8a10506db993 100644 +--- a/fs/overlayfs/namei.c ++++ b/fs/overlayfs/namei.c +@@ -56,6 +56,15 @@ static int ovl_check_redirect(struct dentry *dentry, struct ovl_lookup_data *d, + if (s == next) + goto invalid; + } ++ /* ++ * One of the ancestor path elements in an absolute path ++ * lookup in ovl_lookup_layer() could have been opaque and ++ * that will stop further lookup in lower layers (d->stop=true) ++ * But we have found an absolute redirect in decendant path ++ * element and that should force continue lookup in lower ++ * layers (reset d->stop). ++ */ ++ d->stop = false; + } else { + if (strchr(buf, '/') != NULL) + goto invalid; +diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h +index 95ccc1eef558..b619a190ff12 100644 +--- a/include/net/bluetooth/hci_core.h ++++ b/include/net/bluetooth/hci_core.h +@@ -895,7 +895,7 @@ struct hci_conn *hci_connect_le_scan(struct hci_dev *hdev, bdaddr_t *dst, + u16 conn_timeout); + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, u8 sec_level, u16 conn_timeout, +- u8 role); ++ u8 role, bdaddr_t *direct_rpa); + struct hci_conn *hci_connect_acl(struct hci_dev *hdev, bdaddr_t *dst, + u8 sec_level, u8 auth_type); + struct hci_conn *hci_connect_sco(struct hci_dev *hdev, int type, bdaddr_t *dst, +diff --git a/include/net/slhc_vj.h b/include/net/slhc_vj.h +index 8716d5942b65..8fcf8908a694 100644 +--- a/include/net/slhc_vj.h ++++ b/include/net/slhc_vj.h +@@ -127,6 +127,7 @@ typedef __u32 int32; + */ + struct cstate { + byte_t cs_this; /* connection id number (xmit) */ ++ bool initialized; /* true if initialized */ + struct cstate *next; /* next in ring (xmit) */ + struct iphdr cs_ip; /* ip/tcp hdr from most recent packet */ + struct tcphdr cs_tcp; +diff --git a/kernel/events/core.c b/kernel/events/core.c +index cecd72eb09b8..e9b0beca830f 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -4199,6 +4199,9 @@ static void _free_event(struct perf_event *event) + if (event->ctx) + put_ctx(event->ctx); + ++ if (event->hw.target) ++ put_task_struct(event->hw.target); ++ + exclusive_event_destroy(event); + module_put(event->pmu->module); + +@@ -9508,6 +9511,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + * and we cannot use the ctx information because we need the + * pmu before we get a ctx. + */ ++ get_task_struct(task); + event->hw.target = task; + } + +@@ -9623,6 +9627,8 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, + perf_detach_cgroup(event); + if (event->ns) + put_pid_ns(event->ns); ++ if (event->hw.target) ++ put_task_struct(event->hw.target); + kfree(event); + + return ERR_PTR(err); +diff --git a/lib/bitmap.c b/lib/bitmap.c +index c82c61b66e16..2a9373ef4054 100644 +--- a/lib/bitmap.c ++++ b/lib/bitmap.c +@@ -605,7 +605,7 @@ static int __bitmap_parselist(const char *buf, unsigned int buflen, + /* if no digit is after '-', it's wrong*/ + if (at_start && in_range) + return -EINVAL; +- if (!(a <= b) || !(used_size <= group_size)) ++ if (!(a <= b) || group_size == 0 || !(used_size <= group_size)) + return -EINVAL; + if (b >= nmaskbits) + return -ERANGE; +diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c +index aa1f2669bdd5..0ddf293cfac3 100644 +--- a/lib/test_bitmap.c ++++ b/lib/test_bitmap.c +@@ -218,6 +218,10 @@ static const struct test_bitmap_parselist parselist_tests[] __initconst = { + {-EINVAL, "-1", NULL, 8, 0}, + {-EINVAL, "-0", NULL, 8, 0}, + {-EINVAL, "10-1", NULL, 8, 0}, ++ {-EINVAL, "0-31:", NULL, 8, 0}, ++ {-EINVAL, "0-31:0", NULL, 8, 0}, ++ {-EINVAL, "0-31:0/0", NULL, 8, 0}, ++ {-EINVAL, "0-31:1/0", NULL, 8, 0}, + {-EINVAL, "0-31:10/1", NULL, 8, 0}, + }; + +diff --git a/mm/gup.c b/mm/gup.c +index e0d82b6706d7..8fc23a60487d 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1816,9 +1816,12 @@ int get_user_pages_fast(unsigned long start, int nr_pages, int write, + len = (unsigned long) nr_pages << PAGE_SHIFT; + end = start + len; + ++ if (nr_pages <= 0) ++ return 0; ++ + if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ, + (void __user *)start, len))) +- return 0; ++ return -EFAULT; + + if (gup_fast_permitted(start, nr_pages, write)) { + local_irq_disable(); +diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c +index dc59eae54717..cc061495f653 100644 +--- a/net/bluetooth/hci_conn.c ++++ b/net/bluetooth/hci_conn.c +@@ -749,18 +749,31 @@ static bool conn_use_rpa(struct hci_conn *conn) + } + + static void hci_req_add_le_create_conn(struct hci_request *req, +- struct hci_conn *conn) ++ struct hci_conn *conn, ++ bdaddr_t *direct_rpa) + { + struct hci_cp_le_create_conn cp; + struct hci_dev *hdev = conn->hdev; + u8 own_addr_type; + +- /* Update random address, but set require_privacy to false so +- * that we never connect with an non-resolvable address. ++ /* If direct address was provided we use it instead of current ++ * address. + */ +- if (hci_update_random_address(req, false, conn_use_rpa(conn), +- &own_addr_type)) +- return; ++ if (direct_rpa) { ++ if (bacmp(&req->hdev->random_addr, direct_rpa)) ++ hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, ++ direct_rpa); ++ ++ /* direct address is always RPA */ ++ own_addr_type = ADDR_LE_DEV_RANDOM; ++ } else { ++ /* Update random address, but set require_privacy to false so ++ * that we never connect with an non-resolvable address. ++ */ ++ if (hci_update_random_address(req, false, conn_use_rpa(conn), ++ &own_addr_type)) ++ return; ++ } + + memset(&cp, 0, sizeof(cp)); + +@@ -825,7 +838,7 @@ static void hci_req_directed_advertising(struct hci_request *req, + + struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + u8 dst_type, u8 sec_level, u16 conn_timeout, +- u8 role) ++ u8 role, bdaddr_t *direct_rpa) + { + struct hci_conn_params *params; + struct hci_conn *conn; +@@ -940,7 +953,7 @@ struct hci_conn *hci_connect_le(struct hci_dev *hdev, bdaddr_t *dst, + hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); + } + +- hci_req_add_le_create_conn(&req, conn); ++ hci_req_add_le_create_conn(&req, conn, direct_rpa); + + create_conn: + err = hci_req_run(&req, create_le_conn_complete); +diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c +index 0b4dba08a14e..01f211e31f47 100644 +--- a/net/bluetooth/hci_event.c ++++ b/net/bluetooth/hci_event.c +@@ -4646,7 +4646,8 @@ static void hci_le_conn_update_complete_evt(struct hci_dev *hdev, + /* This function requires the caller holds hdev->lock */ + static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + bdaddr_t *addr, +- u8 addr_type, u8 adv_type) ++ u8 addr_type, u8 adv_type, ++ bdaddr_t *direct_rpa) + { + struct hci_conn *conn; + struct hci_conn_params *params; +@@ -4697,7 +4698,8 @@ static struct hci_conn *check_pending_le_conn(struct hci_dev *hdev, + } + + conn = hci_connect_le(hdev, addr, addr_type, BT_SECURITY_LOW, +- HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER); ++ HCI_LE_AUTOCONN_TIMEOUT, HCI_ROLE_MASTER, ++ direct_rpa); + if (!IS_ERR(conn)) { + /* If HCI_AUTO_CONN_EXPLICIT is set, conn is already owned + * by higher layer that tried to connect, if no then +@@ -4807,8 +4809,13 @@ static void process_adv_report(struct hci_dev *hdev, u8 type, bdaddr_t *bdaddr, + bdaddr_type = irk->addr_type; + } + +- /* Check if we have been requested to connect to this device */ +- conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type); ++ /* Check if we have been requested to connect to this device. ++ * ++ * direct_addr is set only for directed advertising reports (it is NULL ++ * for advertising reports) and is already verified to be RPA above. ++ */ ++ conn = check_pending_le_conn(hdev, bdaddr, bdaddr_type, type, ++ direct_addr); + if (conn && type == LE_ADV_IND) { + /* Store report for later inclusion by + * mgmt_device_connected +diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c +index fc6615d59165..9b7907ebfa01 100644 +--- a/net/bluetooth/l2cap_core.c ++++ b/net/bluetooth/l2cap_core.c +@@ -7156,7 +7156,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid, + hcon = hci_connect_le(hdev, dst, dst_type, + chan->sec_level, + HCI_LE_CONN_TIMEOUT, +- HCI_ROLE_SLAVE); ++ HCI_ROLE_SLAVE, NULL); + else + hcon = hci_connect_le_scan(hdev, dst, dst_type, + chan->sec_level, +diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c +index cf84f7b37cd9..9d2ce1459cec 100644 +--- a/net/netfilter/ipset/ip_set_core.c ++++ b/net/netfilter/ipset/ip_set_core.c +@@ -2055,6 +2055,7 @@ ip_set_net_exit(struct net *net) + + inst->is_deleted = true; /* flag for ip_set_nfnl_put */ + ++ nfnl_lock(NFNL_SUBSYS_IPSET); + for (i = 0; i < inst->ip_set_max; i++) { + set = ip_set(inst, i); + if (set) { +@@ -2062,6 +2063,7 @@ ip_set_net_exit(struct net *net) + ip_set_destroy_set(set); + } + } ++ nfnl_unlock(NFNL_SUBSYS_IPSET); + kfree(rcu_dereference_protected(inst->ip_set_list, 1)); + } + +diff --git a/net/rds/send.c b/net/rds/send.c +index f72466c63f0c..23f2d81e7967 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2006 Oracle. All rights reserved. ++ * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved. + * + * This software is available to you under a choice of one of two + * licenses. You may choose to be licensed under the terms of the GNU +@@ -986,10 +986,15 @@ static int rds_send_mprds_hash(struct rds_sock *rs, struct rds_connection *conn) + if (conn->c_npaths == 0 && hash != 0) { + rds_send_ping(conn, 0); + +- if (conn->c_npaths == 0) { +- wait_event_interruptible(conn->c_hs_waitq, +- (conn->c_npaths != 0)); +- } ++ /* The underlying connection is not up yet. Need to wait ++ * until it is up to be sure that the non-zero c_path can be ++ * used. But if we are interrupted, we have to use the zero ++ * c_path in case the connection ends up being non-MP capable. ++ */ ++ if (conn->c_npaths == 0) ++ if (wait_event_interruptible(conn->c_hs_waitq, ++ conn->c_npaths != 0)) ++ hash = 0; + if (conn->c_npaths == 1) + hash = 0; + } +diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c +index 12649c9fedab..8654494b4d0a 100644 +--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c ++++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c +@@ -237,9 +237,6 @@ make_checksum_hmac_md5(struct krb5_ctx *kctx, char *header, int hdrlen, + + ahash_request_set_callback(req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL, NULL); + +- err = crypto_ahash_init(req); +- if (err) +- goto out; + err = crypto_ahash_setkey(hmac_md5, cksumkey, kctx->gk5e->keylength); + if (err) + goto out; +diff --git a/security/apparmor/apparmorfs.c b/security/apparmor/apparmorfs.c +index caaf51dda648..0e03377bb83e 100644 +--- a/security/apparmor/apparmorfs.c ++++ b/security/apparmor/apparmorfs.c +@@ -1189,9 +1189,7 @@ static int seq_ns_level_show(struct seq_file *seq, void *v) + static int seq_ns_name_show(struct seq_file *seq, void *v) + { + struct aa_label *label = begin_current_label_crit_section(); +- +- seq_printf(seq, "%s\n", aa_ns_name(labels_ns(label), +- labels_ns(label), true)); ++ seq_printf(seq, "%s\n", labels_ns(label)->base.name); + end_current_label_crit_section(label); + + return 0; +diff --git a/security/apparmor/include/audit.h b/security/apparmor/include/audit.h +index 4ac095118717..2ebc00a579fd 100644 +--- a/security/apparmor/include/audit.h ++++ b/security/apparmor/include/audit.h +@@ -126,6 +126,10 @@ struct apparmor_audit_data { + const char *target; + kuid_t ouid; + } fs; ++ struct { ++ int rlim; ++ unsigned long max; ++ } rlim; + int signal; + }; + }; +@@ -134,10 +138,6 @@ struct apparmor_audit_data { + const char *ns; + long pos; + } iface; +- struct { +- int rlim; +- unsigned long max; +- } rlim; + struct { + const char *src_name; + const char *type; +diff --git a/security/apparmor/include/sig_names.h b/security/apparmor/include/sig_names.h +index 92e62fe95292..5ca47c50dfa7 100644 +--- a/security/apparmor/include/sig_names.h ++++ b/security/apparmor/include/sig_names.h +@@ -2,6 +2,8 @@ + + #define SIGUNKNOWN 0 + #define MAXMAPPED_SIG 35 ++#define MAXMAPPED_SIGNAME (MAXMAPPED_SIG + 1) ++ + /* provide a mapping of arch signal to internal signal # for mediation + * those that are always an alias SIGCLD for SIGCLHD and SIGPOLL for SIGIO + * map to the same entry those that may/or may not get a separate entry +@@ -56,7 +58,7 @@ static const int sig_map[MAXMAPPED_SIG] = { + }; + + /* this table is ordered post sig_map[sig] mapping */ +-static const char *const sig_names[MAXMAPPED_SIG + 1] = { ++static const char *const sig_names[MAXMAPPED_SIGNAME] = { + "unknown", + "hup", + "int", +diff --git a/security/apparmor/ipc.c b/security/apparmor/ipc.c +index b40678f3c1d5..586facd35f7c 100644 +--- a/security/apparmor/ipc.c ++++ b/security/apparmor/ipc.c +@@ -174,7 +174,7 @@ static void audit_signal_cb(struct audit_buffer *ab, void *va) + audit_signal_mask(ab, aad(sa)->denied); + } + } +- if (aad(sa)->signal < MAXMAPPED_SIG) ++ if (aad(sa)->signal < MAXMAPPED_SIGNAME) + audit_log_format(ab, " signal=%s", sig_names[aad(sa)->signal]); + else + audit_log_format(ab, " signal=rtmin+%d", +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index aa1593ce551d..f9157aed1289 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -1378,6 +1378,7 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder) + intel_pt_clear_tx_flags(decoder); + decoder->have_tma = false; + decoder->cbr = 0; ++ decoder->timestamp_insn_cnt = 0; + decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC; + decoder->overflow = true; + return -EOVERFLOW; +@@ -1616,6 +1617,7 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder *decoder) + case INTEL_PT_PWRX: + intel_pt_log("ERROR: Missing TIP after FUP\n"); + decoder->pkt_state = INTEL_PT_STATE_ERR3; ++ decoder->pkt_step = 0; + return -ENOENT; + + case INTEL_PT_OVF: +@@ -2390,14 +2392,6 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) + return &decoder->state; + } + +-static bool intel_pt_at_psb(unsigned char *buf, size_t len) +-{ +- if (len < INTEL_PT_PSB_LEN) +- return false; +- return memmem(buf, INTEL_PT_PSB_LEN, INTEL_PT_PSB_STR, +- INTEL_PT_PSB_LEN); +-} +- + /** + * intel_pt_next_psb - move buffer pointer to the start of the next PSB packet. + * @buf: pointer to buffer pointer +@@ -2486,6 +2480,7 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len) + * @buf: buffer + * @len: size of buffer + * @tsc: TSC value returned ++ * @rem: returns remaining size when TSC is found + * + * Find a TSC packet in @buf and return the TSC value. This function assumes + * that @buf starts at a PSB and that PSB+ will contain TSC and so stops if a +@@ -2493,7 +2488,8 @@ static unsigned char *intel_pt_last_psb(unsigned char *buf, size_t len) + * + * Return: %true if TSC is found, false otherwise. + */ +-static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc) ++static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc, ++ size_t *rem) + { + struct intel_pt_pkt packet; + int ret; +@@ -2504,6 +2500,7 @@ static bool intel_pt_next_tsc(unsigned char *buf, size_t len, uint64_t *tsc) + return false; + if (packet.type == INTEL_PT_TSC) { + *tsc = packet.payload; ++ *rem = len; + return true; + } + if (packet.type == INTEL_PT_PSBEND) +@@ -2554,6 +2551,8 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) + * @len_a: size of first buffer + * @buf_b: second buffer + * @len_b: size of second buffer ++ * @consecutive: returns true if there is data in buf_b that is consecutive ++ * to buf_a + * + * If the trace contains TSC we can look at the last TSC of @buf_a and the + * first TSC of @buf_b in order to determine if the buffers overlap, and then +@@ -2566,33 +2565,41 @@ static int intel_pt_tsc_cmp(uint64_t tsc1, uint64_t tsc2) + static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + size_t len_a, + unsigned char *buf_b, +- size_t len_b) ++ size_t len_b, bool *consecutive) + { + uint64_t tsc_a, tsc_b; + unsigned char *p; +- size_t len; ++ size_t len, rem_a, rem_b; + + p = intel_pt_last_psb(buf_a, len_a); + if (!p) + return buf_b; /* No PSB in buf_a => no overlap */ + + len = len_a - (p - buf_a); +- if (!intel_pt_next_tsc(p, len, &tsc_a)) { ++ if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a)) { + /* The last PSB+ in buf_a is incomplete, so go back one more */ + len_a -= len; + p = intel_pt_last_psb(buf_a, len_a); + if (!p) + return buf_b; /* No full PSB+ => assume no overlap */ + len = len_a - (p - buf_a); +- if (!intel_pt_next_tsc(p, len, &tsc_a)) ++ if (!intel_pt_next_tsc(p, len, &tsc_a, &rem_a)) + return buf_b; /* No TSC in buf_a => assume no overlap */ + } + + while (1) { + /* Ignore PSB+ with no TSC */ +- if (intel_pt_next_tsc(buf_b, len_b, &tsc_b) && +- intel_pt_tsc_cmp(tsc_a, tsc_b) < 0) +- return buf_b; /* tsc_a < tsc_b => no overlap */ ++ if (intel_pt_next_tsc(buf_b, len_b, &tsc_b, &rem_b)) { ++ int cmp = intel_pt_tsc_cmp(tsc_a, tsc_b); ++ ++ /* Same TSC, so buffers are consecutive */ ++ if (!cmp && rem_b >= rem_a) { ++ *consecutive = true; ++ return buf_b + len_b - (rem_b - rem_a); ++ } ++ if (cmp < 0) ++ return buf_b; /* tsc_a < tsc_b => no overlap */ ++ } + + if (!intel_pt_step_psb(&buf_b, &len_b)) + return buf_b + len_b; /* No PSB in buf_b => no data */ +@@ -2606,6 +2613,8 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + * @buf_b: second buffer + * @len_b: size of second buffer + * @have_tsc: can use TSC packets to detect overlap ++ * @consecutive: returns true if there is data in buf_b that is consecutive ++ * to buf_a + * + * When trace samples or snapshots are recorded there is the possibility that + * the data overlaps. Note that, for the purposes of decoding, data is only +@@ -2616,7 +2625,7 @@ static unsigned char *intel_pt_find_overlap_tsc(unsigned char *buf_a, + */ + unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + unsigned char *buf_b, size_t len_b, +- bool have_tsc) ++ bool have_tsc, bool *consecutive) + { + unsigned char *found; + +@@ -2628,7 +2637,8 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + return buf_b; /* No overlap */ + + if (have_tsc) { +- found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b); ++ found = intel_pt_find_overlap_tsc(buf_a, len_a, buf_b, len_b, ++ consecutive); + if (found) + return found; + } +@@ -2643,28 +2653,16 @@ unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + } + + /* Now len_b >= len_a */ +- if (len_b > len_a) { +- /* The leftover buffer 'b' must start at a PSB */ +- while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) { +- if (!intel_pt_step_psb(&buf_a, &len_a)) +- return buf_b; /* No overlap */ +- } +- } +- + while (1) { + /* Potential overlap so check the bytes */ + found = memmem(buf_a, len_a, buf_b, len_a); +- if (found) ++ if (found) { ++ *consecutive = true; + return buf_b + len_a; ++ } + + /* Try again at next PSB in buffer 'a' */ + if (!intel_pt_step_psb(&buf_a, &len_a)) + return buf_b; /* No overlap */ +- +- /* The leftover buffer 'b' must start at a PSB */ +- while (!intel_pt_at_psb(buf_b + len_a, len_b - len_a)) { +- if (!intel_pt_step_psb(&buf_a, &len_a)) +- return buf_b; /* No overlap */ +- } + } + } +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +index 921b22e8ca0e..fc1752d50019 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +@@ -117,7 +117,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder); + + unsigned char *intel_pt_find_overlap(unsigned char *buf_a, size_t len_a, + unsigned char *buf_b, size_t len_b, +- bool have_tsc); ++ bool have_tsc, bool *consecutive); + + int intel_pt__strerror(int code, char *buf, size_t buflen); + +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index b58f9fd1e2ee..d9573c1fa555 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -145,6 +145,7 @@ struct intel_pt_queue { + bool stop; + bool step_through_buffers; + bool use_buffer_pid_tid; ++ bool sync_switch; + pid_t pid, tid; + int cpu; + int switch_state; +@@ -209,14 +210,17 @@ static void intel_pt_dump_event(struct intel_pt *pt, unsigned char *buf, + static int intel_pt_do_fix_overlap(struct intel_pt *pt, struct auxtrace_buffer *a, + struct auxtrace_buffer *b) + { ++ bool consecutive = false; + void *start; + + start = intel_pt_find_overlap(a->data, a->size, b->data, b->size, +- pt->have_tsc); ++ pt->have_tsc, &consecutive); + if (!start) + return -EINVAL; + b->use_size = b->data + b->size - start; + b->use_data = start; ++ if (b->use_size && consecutive) ++ b->consecutive = true; + return 0; + } + +@@ -962,10 +966,12 @@ static int intel_pt_setup_queue(struct intel_pt *pt, + if (pt->timeless_decoding || !pt->have_sched_switch) + ptq->use_buffer_pid_tid = true; + } ++ ++ ptq->sync_switch = pt->sync_switch; + } + + if (!ptq->on_heap && +- (!pt->sync_switch || ++ (!ptq->sync_switch || + ptq->switch_state != INTEL_PT_SS_EXPECTING_SWITCH_EVENT)) { + const struct intel_pt_state *state; + int ret; +@@ -1549,7 +1555,7 @@ static int intel_pt_sample(struct intel_pt_queue *ptq) + if (pt->synth_opts.last_branch) + intel_pt_update_last_branch_rb(ptq); + +- if (!pt->sync_switch) ++ if (!ptq->sync_switch) + return 0; + + if (intel_pt_is_switch_ip(ptq, state->to_ip)) { +@@ -1630,6 +1636,21 @@ static u64 intel_pt_switch_ip(struct intel_pt *pt, u64 *ptss_ip) + return switch_ip; + } + ++static void intel_pt_enable_sync_switch(struct intel_pt *pt) ++{ ++ unsigned int i; ++ ++ pt->sync_switch = true; ++ ++ for (i = 0; i < pt->queues.nr_queues; i++) { ++ struct auxtrace_queue *queue = &pt->queues.queue_array[i]; ++ struct intel_pt_queue *ptq = queue->priv; ++ ++ if (ptq) ++ ptq->sync_switch = true; ++ } ++} ++ + static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + { + const struct intel_pt_state *state = ptq->state; +@@ -1646,7 +1667,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + if (pt->switch_ip) { + intel_pt_log("switch_ip: %"PRIx64" ptss_ip: %"PRIx64"\n", + pt->switch_ip, pt->ptss_ip); +- pt->sync_switch = true; ++ intel_pt_enable_sync_switch(pt); + } + } + } +@@ -1662,9 +1683,9 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + if (state->err) { + if (state->err == INTEL_PT_ERR_NODATA) + return 1; +- if (pt->sync_switch && ++ if (ptq->sync_switch && + state->from_ip >= pt->kernel_start) { +- pt->sync_switch = false; ++ ptq->sync_switch = false; + intel_pt_next_tid(pt, ptq); + } + if (pt->synth_opts.errors) { +@@ -1690,7 +1711,7 @@ static int intel_pt_run_decoder(struct intel_pt_queue *ptq, u64 *timestamp) + state->timestamp, state->est_timestamp); + ptq->timestamp = state->est_timestamp; + /* Use estimated TSC in unknown switch state */ +- } else if (pt->sync_switch && ++ } else if (ptq->sync_switch && + ptq->switch_state == INTEL_PT_SS_UNKNOWN && + intel_pt_is_switch_ip(ptq, state->to_ip) && + ptq->next_tid == -1) { +@@ -1837,7 +1858,7 @@ static int intel_pt_sync_switch(struct intel_pt *pt, int cpu, pid_t tid, + return 1; + + ptq = intel_pt_cpu_to_ptq(pt, cpu); +- if (!ptq) ++ if (!ptq || !ptq->sync_switch) + return 1; + + switch (ptq->switch_state) { diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.35-36.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.35-36.patch new file mode 100644 index 000000000000..f66faf708ca3 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.35-36.patch @@ -0,0 +1,6386 @@ +diff --git a/Makefile b/Makefile +index 995666d5e57b..0a1f941899f4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 35 ++SUBLEVEL = 36 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/at91sam9g25.dtsi b/arch/arm/boot/dts/at91sam9g25.dtsi +index a7da0dd0c98f..0898213f3bb2 100644 +--- a/arch/arm/boot/dts/at91sam9g25.dtsi ++++ b/arch/arm/boot/dts/at91sam9g25.dtsi +@@ -21,7 +21,7 @@ + atmel,mux-mask = < + /* A B C */ + 0xffffffff 0xffe0399f 0xc000001c /* pioA */ +- 0x0007ffff 0x8000fe3f 0x00000000 /* pioB */ ++ 0x0007ffff 0x00047e3f 0x00000000 /* pioB */ + 0x80000000 0x07c0ffff 0xb83fffff /* pioC */ + 0x003fffff 0x003f8000 0x00000000 /* pioD */ + >; +diff --git a/arch/arm/boot/dts/da850-lego-ev3.dts b/arch/arm/boot/dts/da850-lego-ev3.dts +index 413dbd5d9f64..81942ae83e1f 100644 +--- a/arch/arm/boot/dts/da850-lego-ev3.dts ++++ b/arch/arm/boot/dts/da850-lego-ev3.dts +@@ -178,7 +178,7 @@ + */ + battery { + pinctrl-names = "default"; +- pintctrl-0 = <&battery_pins>; ++ pinctrl-0 = <&battery_pins>; + compatible = "lego,ev3-battery"; + io-channels = <&adc 4>, <&adc 3>; + io-channel-names = "voltage", "current"; +@@ -392,7 +392,7 @@ + batt_volt_en { + gpio-hog; + gpios = <6 GPIO_ACTIVE_HIGH>; +- output-low; ++ output-high; + }; + }; + +diff --git a/arch/arm/boot/dts/exynos5250.dtsi b/arch/arm/boot/dts/exynos5250.dtsi +index 8dbeb873e99c..35b1949a3e3c 100644 +--- a/arch/arm/boot/dts/exynos5250.dtsi ++++ b/arch/arm/boot/dts/exynos5250.dtsi +@@ -643,7 +643,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL0>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc0>; ++ iommus = <&sysmmu_gsc0>; + }; + + gsc_1: gsc@13e10000 { +@@ -653,7 +653,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL1>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc1>; ++ iommus = <&sysmmu_gsc1>; + }; + + gsc_2: gsc@13e20000 { +@@ -663,7 +663,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL2>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc2>; ++ iommus = <&sysmmu_gsc2>; + }; + + gsc_3: gsc@13e30000 { +@@ -673,7 +673,7 @@ + power-domains = <&pd_gsc>; + clocks = <&clock CLK_GSCL3>; + clock-names = "gscl"; +- iommu = <&sysmmu_gsc3>; ++ iommus = <&sysmmu_gsc3>; + }; + + hdmi: hdmi@14530000 { +diff --git a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts +index 7bf5aa2237c9..7de704575aee 100644 +--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts ++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts +@@ -39,6 +39,24 @@ + }; + }; + ++ reg_3p3v: regulator-3p3v { ++ compatible = "regulator-fixed"; ++ regulator-name = "fixed-3.3V"; ++ regulator-min-microvolt = <3300000>; ++ regulator-max-microvolt = <3300000>; ++ regulator-boot-on; ++ regulator-always-on; ++ }; ++ ++ reg_5v: regulator-5v { ++ compatible = "regulator-fixed"; ++ regulator-name = "fixed-5V"; ++ regulator-min-microvolt = <5000000>; ++ regulator-max-microvolt = <5000000>; ++ regulator-boot-on; ++ regulator-always-on; ++ }; ++ + gpio_keys { + compatible = "gpio-keys"; + pinctrl-names = "default"; +@@ -468,12 +486,14 @@ + }; + + &usb1 { +- vusb33-supply = <&mt6323_vusb_reg>; ++ vusb33-supply = <®_3p3v>; ++ vbus-supply = <®_5v>; + status = "okay"; + }; + + &usb2 { +- vusb33-supply = <&mt6323_vusb_reg>; ++ vusb33-supply = <®_3p3v>; ++ vbus-supply = <®_5v>; + status = "okay"; + }; + +diff --git a/arch/arm/boot/dts/sama5d4.dtsi b/arch/arm/boot/dts/sama5d4.dtsi +index 2fa36c525957..81b526085097 100644 +--- a/arch/arm/boot/dts/sama5d4.dtsi ++++ b/arch/arm/boot/dts/sama5d4.dtsi +@@ -1365,7 +1365,7 @@ + pinctrl@fc06a000 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "atmel,at91sam9x5-pinctrl", "atmel,at91rm9200-pinctrl", "simple-bus"; ++ compatible = "atmel,sama5d3-pinctrl", "atmel,at91sam9x5-pinctrl", "simple-bus"; + ranges = <0xfc068000 0xfc068000 0x100 + 0xfc06a000 0xfc06a000 0x4000>; + /* WARNING: revisit as pin spec has changed */ +diff --git a/arch/arm/mach-exynos/pm.c b/arch/arm/mach-exynos/pm.c +index 1a7e5b5d08d8..3dbbf1fffead 100644 +--- a/arch/arm/mach-exynos/pm.c ++++ b/arch/arm/mach-exynos/pm.c +@@ -276,11 +276,7 @@ static int exynos_cpu0_enter_aftr(void) + goto fail; + + call_firmware_op(cpu_boot, 1); +- +- if (soc_is_exynos3250()) +- dsb_sev(); +- else +- arch_send_wakeup_ipi_mask(cpumask_of(1)); ++ dsb_sev(); + } + } + fail: +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +index 08b7bb7f5b74..c3c65b06ba76 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxbb-odroidc2.dts +@@ -276,7 +276,7 @@ + pinctrl-names = "default", "clk-gate"; + + bus-width = <8>; +- max-frequency = <200000000>; ++ max-frequency = <100000000>; + non-removable; + disable-wp; + cap-mmc-highspeed; +diff --git a/arch/mips/include/asm/uaccess.h b/arch/mips/include/asm/uaccess.h +index b71306947290..06629011a434 100644 +--- a/arch/mips/include/asm/uaccess.h ++++ b/arch/mips/include/asm/uaccess.h +@@ -654,6 +654,13 @@ __clear_user(void __user *addr, __kernel_size_t size) + { + __kernel_size_t res; + ++#ifdef CONFIG_CPU_MICROMIPS ++/* micromips memset / bzero also clobbers t7 & t8 */ ++#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$15", "$24", "$31" ++#else ++#define bzero_clobbers "$4", "$5", "$6", __UA_t0, __UA_t1, "$31" ++#endif /* CONFIG_CPU_MICROMIPS */ ++ + if (eva_kernel_access()) { + __asm__ __volatile__( + "move\t$4, %1\n\t" +@@ -663,7 +670,7 @@ __clear_user(void __user *addr, __kernel_size_t size) + "move\t%0, $6" + : "=r" (res) + : "r" (addr), "r" (size) +- : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31"); ++ : bzero_clobbers); + } else { + might_fault(); + __asm__ __volatile__( +@@ -674,7 +681,7 @@ __clear_user(void __user *addr, __kernel_size_t size) + "move\t%0, $6" + : "=r" (res) + : "r" (addr), "r" (size) +- : "$4", "$5", "$6", __UA_t0, __UA_t1, "$31"); ++ : bzero_clobbers); + } + + return res; +diff --git a/arch/mips/lib/memset.S b/arch/mips/lib/memset.S +index a1456664d6c2..f7327979a8f8 100644 +--- a/arch/mips/lib/memset.S ++++ b/arch/mips/lib/memset.S +@@ -219,7 +219,7 @@ + 1: PTR_ADDIU a0, 1 /* fill bytewise */ + R10KCBARRIER(0(ra)) + bne t1, a0, 1b +- sb a1, -1(a0) ++ EX(sb, a1, -1(a0), .Lsmall_fixup\@) + + 2: jr ra /* done */ + move a2, zero +@@ -252,13 +252,18 @@ + PTR_L t0, TI_TASK($28) + andi a2, STORMASK + LONG_L t0, THREAD_BUADDR(t0) +- LONG_ADDU a2, t1 ++ LONG_ADDU a2, a0 + jr ra + LONG_SUBU a2, t0 + + .Llast_fixup\@: + jr ra +- andi v1, a2, STORMASK ++ nop ++ ++.Lsmall_fixup\@: ++ PTR_SUBU a2, t1, a0 ++ jr ra ++ PTR_ADDIU a2, 1 + + .endm + +diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h +index 10daa1d56e0a..c7c63959ba91 100644 +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -35,7 +35,8 @@ + #define rmb() __asm__ __volatile__ ("sync" : : : "memory") + #define wmb() __asm__ __volatile__ ("sync" : : : "memory") + +-#ifdef __SUBARCH_HAS_LWSYNC ++/* The sub-arch has lwsync */ ++#if defined(__powerpc64__) || defined(CONFIG_PPC_E500MC) + # define SMPWMB LWSYNC + #else + # define SMPWMB eieio +diff --git a/arch/powerpc/include/asm/opal.h b/arch/powerpc/include/asm/opal.h +index 726c23304a57..8eb3ebca02df 100644 +--- a/arch/powerpc/include/asm/opal.h ++++ b/arch/powerpc/include/asm/opal.h +@@ -21,6 +21,9 @@ + /* We calculate number of sg entries based on PAGE_SIZE */ + #define SG_ENTRIES_PER_NODE ((PAGE_SIZE - 16) / sizeof(struct opal_sg_entry)) + ++/* Default time to sleep or delay between OPAL_BUSY/OPAL_BUSY_EVENT loops */ ++#define OPAL_BUSY_DELAY_MS 10 ++ + /* /sys/firmware/opal */ + extern struct kobject *opal_kobj; + +diff --git a/arch/powerpc/include/asm/synch.h b/arch/powerpc/include/asm/synch.h +index 63e7f5a1f105..6ec546090ba1 100644 +--- a/arch/powerpc/include/asm/synch.h ++++ b/arch/powerpc/include/asm/synch.h +@@ -6,10 +6,6 @@ + #include + #include + +-#if defined(__powerpc64__) || defined(CONFIG_PPC_E500MC) +-#define __SUBARCH_HAS_LWSYNC +-#endif +- + #ifndef __ASSEMBLY__ + extern unsigned int __start___lwsync_fixup, __stop___lwsync_fixup; + extern void do_lwsync_fixups(unsigned long value, void *fixup_start, +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index 7275fed271af..f047ae1b6271 100644 +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -86,6 +86,7 @@ static int hv_mode; + + static struct { + u64 lpcr; ++ u64 lpcr_clear; + u64 hfscr; + u64 fscr; + } system_registers; +@@ -115,6 +116,8 @@ static void cpufeatures_flush_tlb(void) + + static void __restore_cpu_cpufeatures(void) + { ++ u64 lpcr; ++ + /* + * LPCR is restored by the power on engine already. It can be changed + * after early init e.g., by radix enable, and we have no unified API +@@ -127,8 +130,10 @@ static void __restore_cpu_cpufeatures(void) + * The best we can do to accommodate secondary boot and idle restore + * for now is "or" LPCR with existing. + */ +- +- mtspr(SPRN_LPCR, system_registers.lpcr | mfspr(SPRN_LPCR)); ++ lpcr = mfspr(SPRN_LPCR); ++ lpcr |= system_registers.lpcr; ++ lpcr &= ~system_registers.lpcr_clear; ++ mtspr(SPRN_LPCR, lpcr); + if (hv_mode) { + mtspr(SPRN_LPID, 0); + mtspr(SPRN_HFSCR, system_registers.hfscr); +@@ -351,8 +356,9 @@ static int __init feat_enable_mmu_hash_v3(struct dt_cpu_feature *f) + { + u64 lpcr; + ++ system_registers.lpcr_clear |= (LPCR_ISL | LPCR_UPRT | LPCR_HR); + lpcr = mfspr(SPRN_LPCR); +- lpcr &= ~LPCR_ISL; ++ lpcr &= ~(LPCR_ISL | LPCR_UPRT | LPCR_HR); + mtspr(SPRN_LPCR, lpcr); + + cur_cpu_spec->mmu_features |= MMU_FTRS_HASH_BASE; +diff --git a/arch/powerpc/kernel/eeh_pe.c b/arch/powerpc/kernel/eeh_pe.c +index 2e8d1b2b5af4..8545a9523b9b 100644 +--- a/arch/powerpc/kernel/eeh_pe.c ++++ b/arch/powerpc/kernel/eeh_pe.c +@@ -807,7 +807,8 @@ static void eeh_restore_bridge_bars(struct eeh_dev *edev) + eeh_ops->write_config(pdn, 15*4, 4, edev->config_space[15]); + + /* PCI Command: 0x4 */ +- eeh_ops->write_config(pdn, PCI_COMMAND, 4, edev->config_space[1]); ++ eeh_ops->write_config(pdn, PCI_COMMAND, 4, edev->config_space[1] | ++ PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER); + + /* Check the PCIe link is ready */ + eeh_bridge_check_link(edev); +diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c +index bebc3007a793..10b46b35c059 100644 +--- a/arch/powerpc/kernel/kprobes.c ++++ b/arch/powerpc/kernel/kprobes.c +@@ -457,29 +457,33 @@ static int trampoline_probe_handler(struct kprobe *p, struct pt_regs *regs) + } + + kretprobe_assert(ri, orig_ret_address, trampoline_address); +- regs->nip = orig_ret_address; ++ + /* +- * Make LR point to the orig_ret_address. +- * When the 'nop' inside the kretprobe_trampoline +- * is optimized, we can do a 'blr' after executing the +- * detour buffer code. ++ * We get here through one of two paths: ++ * 1. by taking a trap -> kprobe_handler() -> here ++ * 2. by optprobe branch -> optimized_callback() -> opt_pre_handler() -> here ++ * ++ * When going back through (1), we need regs->nip to be setup properly ++ * as it is used to determine the return address from the trap. ++ * For (2), since nip is not honoured with optprobes, we instead setup ++ * the link register properly so that the subsequent 'blr' in ++ * kretprobe_trampoline jumps back to the right instruction. ++ * ++ * For nip, we should set the address to the previous instruction since ++ * we end up emulating it in kprobe_handler(), which increments the nip ++ * again. + */ ++ regs->nip = orig_ret_address - 4; + regs->link = orig_ret_address; + +- reset_current_kprobe(); + kretprobe_hash_unlock(current, &flags); +- preempt_enable_no_resched(); + + hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { + hlist_del(&ri->hlist); + kfree(ri); + } +- /* +- * By returning a non-zero value, we are telling +- * kprobe_handler() that we don't want the post_handler +- * to run (and have re-enabled preemption) +- */ +- return 1; ++ ++ return 0; + } + NOKPROBE_SYMBOL(trampoline_probe_handler); + +diff --git a/arch/powerpc/kernel/machine_kexec_file_64.c b/arch/powerpc/kernel/machine_kexec_file_64.c +index 992c0d258e5d..c66132b145eb 100644 +--- a/arch/powerpc/kernel/machine_kexec_file_64.c ++++ b/arch/powerpc/kernel/machine_kexec_file_64.c +@@ -43,7 +43,7 @@ int arch_kexec_kernel_image_probe(struct kimage *image, void *buf, + + /* We don't support crash kernels yet. */ + if (image->type == KEXEC_TYPE_CRASH) +- return -ENOTSUPP; ++ return -EOPNOTSUPP; + + for (i = 0; i < ARRAY_SIZE(kexec_file_loaders); i++) { + fops = kexec_file_loaders[i]; +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index a95ea007d654..d0c0b8443dcf 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -55,7 +55,7 @@ static int patch_alt_instruction(unsigned int *src, unsigned int *dest, + unsigned int *target = (unsigned int *)branch_target(src); + + /* Branch within the section doesn't need translating */ +- if (target < alt_start || target >= alt_end) { ++ if (target < alt_start || target > alt_end) { + instr = translate_branch(dest, src); + if (!instr) + return 1; +diff --git a/arch/powerpc/mm/hash_utils_64.c b/arch/powerpc/mm/hash_utils_64.c +index 67ec2e927253..87687e46b48b 100644 +--- a/arch/powerpc/mm/hash_utils_64.c ++++ b/arch/powerpc/mm/hash_utils_64.c +@@ -872,6 +872,12 @@ static void __init htab_initialize(void) + /* Using a hypervisor which owns the htab */ + htab_address = NULL; + _SDR1 = 0; ++ /* ++ * On POWER9, we need to do a H_REGISTER_PROC_TBL hcall ++ * to inform the hypervisor that we wish to use the HPT. ++ */ ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ register_process_table(0, 0, 0); + #ifdef CONFIG_FA_DUMP + /* + * If firmware assisted dump is active firmware preserves +diff --git a/arch/powerpc/platforms/powernv/opal-nvram.c b/arch/powerpc/platforms/powernv/opal-nvram.c +index 9db4398ded5d..1bceb95f422d 100644 +--- a/arch/powerpc/platforms/powernv/opal-nvram.c ++++ b/arch/powerpc/platforms/powernv/opal-nvram.c +@@ -11,6 +11,7 @@ + + #define DEBUG + ++#include + #include + #include + #include +@@ -56,9 +57,17 @@ static ssize_t opal_nvram_write(char *buf, size_t count, loff_t *index) + + while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) { + rc = opal_write_nvram(__pa(buf), count, off); +- if (rc == OPAL_BUSY_EVENT) ++ if (rc == OPAL_BUSY_EVENT) { ++ msleep(OPAL_BUSY_DELAY_MS); + opal_poll_events(NULL); ++ } else if (rc == OPAL_BUSY) { ++ msleep(OPAL_BUSY_DELAY_MS); ++ } + } ++ ++ if (rc) ++ return -EIO; ++ + *index += count; + return count; + } +diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c +index 495ba4e7336d..55e97565ed2d 100644 +--- a/arch/powerpc/platforms/pseries/lpar.c ++++ b/arch/powerpc/platforms/pseries/lpar.c +@@ -726,15 +726,18 @@ static int pseries_lpar_resize_hpt(unsigned long shift) + return 0; + } + +-/* Actually only used for radix, so far */ + static int pseries_lpar_register_process_table(unsigned long base, + unsigned long page_size, unsigned long table_size) + { + long rc; +- unsigned long flags = PROC_TABLE_NEW; ++ unsigned long flags = 0; + ++ if (table_size) ++ flags |= PROC_TABLE_NEW; + if (radix_enabled()) + flags |= PROC_TABLE_RADIX | PROC_TABLE_GTSE; ++ else ++ flags |= PROC_TABLE_HPT_SLB; + for (;;) { + rc = plpar_hcall_norets(H_REGISTER_PROC_TBL, flags, base, + page_size, table_size); +@@ -760,6 +763,7 @@ void __init hpte_init_pseries(void) + mmu_hash_ops.flush_hash_range = pSeries_lpar_flush_hash_range; + mmu_hash_ops.hpte_clear_all = pseries_hpte_clear_all; + mmu_hash_ops.hugepage_invalidate = pSeries_lpar_hugepage_invalidate; ++ register_process_table = pseries_lpar_register_process_table; + + if (firmware_has_feature(FW_FEATURE_HPT_RESIZE)) + mmu_hash_ops.resize_hpt = pseries_lpar_resize_hpt; +diff --git a/arch/powerpc/sysdev/xive/native.c b/arch/powerpc/sysdev/xive/native.c +index ebc244b08d67..0f89ee557b04 100644 +--- a/arch/powerpc/sysdev/xive/native.c ++++ b/arch/powerpc/sysdev/xive/native.c +@@ -388,6 +388,10 @@ static void xive_native_setup_cpu(unsigned int cpu, struct xive_cpu *xc) + if (xive_pool_vps == XIVE_INVALID_VP) + return; + ++ /* Check if pool VP already active, if it is, pull it */ ++ if (in_be32(xive_tima + TM_QW2_HV_POOL + TM_WORD2) & TM_QW2W2_VP) ++ in_be64(xive_tima + TM_SPC_PULL_POOL_CTX); ++ + /* Enable the pool VP */ + vp = xive_pool_vps + cpu; + pr_debug("CPU %d setting up pool VP 0x%x\n", cpu, vp); +diff --git a/arch/s390/hypfs/inode.c b/arch/s390/hypfs/inode.c +index cf8a2d92467f..45eb5999110b 100644 +--- a/arch/s390/hypfs/inode.c ++++ b/arch/s390/hypfs/inode.c +@@ -320,7 +320,7 @@ static void hypfs_kill_super(struct super_block *sb) + + if (sb->s_root) + hypfs_delete_tree(sb->s_root); +- if (sb_info->update_file) ++ if (sb_info && sb_info->update_file) + hypfs_remove(sb_info->update_file); + kfree(sb->s_fs_info); + sb->s_fs_info = NULL; +diff --git a/arch/um/os-Linux/file.c b/arch/um/os-Linux/file.c +index 2db18cbbb0ea..c0197097c86e 100644 +--- a/arch/um/os-Linux/file.c ++++ b/arch/um/os-Linux/file.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/um/os-Linux/signal.c b/arch/um/os-Linux/signal.c +index a86d7cc2c2d8..bf0acb8aad8b 100644 +--- a/arch/um/os-Linux/signal.c ++++ b/arch/um/os-Linux/signal.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + + void (*sig_info[NSIG])(int, struct siginfo *, struct uml_pt_regs *) = { + [SIGTRAP] = relay_signal, +@@ -159,7 +160,7 @@ static void (*handlers[_NSIG])(int sig, struct siginfo *si, mcontext_t *mc) = { + + static void hard_handler(int sig, siginfo_t *si, void *p) + { +- struct ucontext *uc = p; ++ ucontext_t *uc = p; + mcontext_t *mc = &uc->uc_mcontext; + unsigned long pending = 1UL << sig; + +diff --git a/arch/x86/um/stub_segv.c b/arch/x86/um/stub_segv.c +index 1518d2805ae8..27361cbb7ca9 100644 +--- a/arch/x86/um/stub_segv.c ++++ b/arch/x86/um/stub_segv.c +@@ -6,11 +6,12 @@ + #include + #include + #include ++#include + + void __attribute__ ((__section__ (".__syscall_stub"))) + stub_segv_handler(int sig, siginfo_t *info, void *p) + { +- struct ucontext *uc = p; ++ ucontext_t *uc = p; + + GET_FAULTINFO_FROM_MC(*((struct faultinfo *) STUB_DATA), + &uc->uc_mcontext); +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index f896c2975545..fcd8789470d1 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1258,10 +1258,6 @@ asmlinkage __visible void __init xen_start_kernel(void) + */ + __userpte_alloc_gfp &= ~__GFP_HIGHMEM; + +- /* Work out if we support NX */ +- get_cpu_cap(&boot_cpu_data); +- x86_configure_nx(); +- + /* Get mfn list */ + xen_build_dynamic_phys_to_machine(); + +@@ -1271,6 +1267,10 @@ asmlinkage __visible void __init xen_start_kernel(void) + */ + xen_setup_gdt(0); + ++ /* Work out if we support NX */ ++ get_cpu_cap(&boot_cpu_data); ++ x86_configure_nx(); ++ + xen_init_irq_ops(); + + /* Let's presume PV guests always boot on vCPU with id 0. */ +diff --git a/drivers/acpi/nfit/core.c b/drivers/acpi/nfit/core.c +index 67a860790560..d56822f58ab1 100644 +--- a/drivers/acpi/nfit/core.c ++++ b/drivers/acpi/nfit/core.c +@@ -1022,8 +1022,11 @@ static ssize_t scrub_show(struct device *dev, + if (nd_desc) { + struct acpi_nfit_desc *acpi_desc = to_acpi_desc(nd_desc); + ++ mutex_lock(&acpi_desc->init_mutex); + rc = sprintf(buf, "%d%s", acpi_desc->scrub_count, +- (work_busy(&acpi_desc->work)) ? "+\n" : "\n"); ++ work_busy(&acpi_desc->work) ++ && !acpi_desc->cancel ? "+\n" : "\n"); ++ mutex_unlock(&acpi_desc->init_mutex); + } + device_unlock(dev); + return rc; +@@ -2313,7 +2316,7 @@ static int acpi_nfit_init_mapping(struct acpi_nfit_desc *acpi_desc, + struct acpi_nfit_system_address *spa = nfit_spa->spa; + struct nd_blk_region_desc *ndbr_desc; + struct nfit_mem *nfit_mem; +- int blk_valid = 0, rc; ++ int rc; + + if (!nvdimm) { + dev_err(acpi_desc->dev, "spa%d dimm: %#x not found\n", +@@ -2333,15 +2336,14 @@ static int acpi_nfit_init_mapping(struct acpi_nfit_desc *acpi_desc, + if (!nfit_mem || !nfit_mem->bdw) { + dev_dbg(acpi_desc->dev, "spa%d %s missing bdw\n", + spa->range_index, nvdimm_name(nvdimm)); +- } else { +- mapping->size = nfit_mem->bdw->capacity; +- mapping->start = nfit_mem->bdw->start_address; +- ndr_desc->num_lanes = nfit_mem->bdw->windows; +- blk_valid = 1; ++ break; + } + ++ mapping->size = nfit_mem->bdw->capacity; ++ mapping->start = nfit_mem->bdw->start_address; ++ ndr_desc->num_lanes = nfit_mem->bdw->windows; + ndr_desc->mapping = mapping; +- ndr_desc->num_mappings = blk_valid; ++ ndr_desc->num_mappings = 1; + ndbr_desc = to_blk_region_desc(ndr_desc); + ndbr_desc->enable = acpi_nfit_blk_region_enable; + ndbr_desc->do_io = acpi_desc->blk_do_io; +diff --git a/drivers/acpi/video_detect.c b/drivers/acpi/video_detect.c +index 601e5d372887..43587ac680e4 100644 +--- a/drivers/acpi/video_detect.c ++++ b/drivers/acpi/video_detect.c +@@ -219,6 +219,15 @@ static const struct dmi_system_id video_detect_dmi_table[] = { + "3570R/370R/470R/450R/510R/4450RV"), + }, + }, ++ { ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1557060 */ ++ .callback = video_detect_force_video, ++ .ident = "SAMSUNG 670Z5E", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "670Z5E"), ++ }, ++ }, + { + /* https://bugzilla.redhat.com/show_bug.cgi?id=1094948 */ + .callback = video_detect_force_video, +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index b9a779a4a739..efdadd153abe 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -1739,7 +1739,7 @@ int regmap_raw_write(struct regmap *map, unsigned int reg, + return -EINVAL; + if (val_len % map->format.val_bytes) + return -EINVAL; +- if (map->max_raw_write && map->max_raw_write > val_len) ++ if (map->max_raw_write && map->max_raw_write < val_len) + return -E2BIG; + + map->lock(map->lock_arg); +diff --git a/drivers/char/random.c b/drivers/char/random.c +index ea0115cf5fc0..58a2ff7df392 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -427,8 +427,9 @@ struct crng_state primary_crng = { + * its value (from 0->1->2). + */ + static int crng_init = 0; +-#define crng_ready() (likely(crng_init > 0)) ++#define crng_ready() (likely(crng_init > 1)) + static int crng_init_cnt = 0; ++static unsigned long crng_global_init_time = 0; + #define CRNG_INIT_CNT_THRESH (2*CHACHA20_KEY_SIZE) + static void _extract_crng(struct crng_state *crng, + __u8 out[CHACHA20_BLOCK_SIZE]); +@@ -732,7 +733,7 @@ static void credit_entropy_bits(struct entropy_store *r, int nbits) + + static int credit_entropy_bits_safe(struct entropy_store *r, int nbits) + { +- const int nbits_max = (int)(~0U >> (ENTROPY_SHIFT + 1)); ++ const int nbits_max = r->poolinfo->poolwords * 32; + + if (nbits < 0) + return -EINVAL; +@@ -786,6 +787,10 @@ static void crng_initialize(struct crng_state *crng) + crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; + } + ++/* ++ * crng_fast_load() can be called by code in the interrupt service ++ * path. So we can't afford to dilly-dally. ++ */ + static int crng_fast_load(const char *cp, size_t len) + { + unsigned long flags; +@@ -793,7 +798,7 @@ static int crng_fast_load(const char *cp, size_t len) + + if (!spin_trylock_irqsave(&primary_crng.lock, flags)) + return 0; +- if (crng_ready()) { ++ if (crng_init != 0) { + spin_unlock_irqrestore(&primary_crng.lock, flags); + return 0; + } +@@ -812,6 +817,51 @@ static int crng_fast_load(const char *cp, size_t len) + return 1; + } + ++/* ++ * crng_slow_load() is called by add_device_randomness, which has two ++ * attributes. (1) We can't trust the buffer passed to it is ++ * guaranteed to be unpredictable (so it might not have any entropy at ++ * all), and (2) it doesn't have the performance constraints of ++ * crng_fast_load(). ++ * ++ * So we do something more comprehensive which is guaranteed to touch ++ * all of the primary_crng's state, and which uses a LFSR with a ++ * period of 255 as part of the mixing algorithm. Finally, we do ++ * *not* advance crng_init_cnt since buffer we may get may be something ++ * like a fixed DMI table (for example), which might very well be ++ * unique to the machine, but is otherwise unvarying. ++ */ ++static int crng_slow_load(const char *cp, size_t len) ++{ ++ unsigned long flags; ++ static unsigned char lfsr = 1; ++ unsigned char tmp; ++ unsigned i, max = CHACHA20_KEY_SIZE; ++ const char * src_buf = cp; ++ char * dest_buf = (char *) &primary_crng.state[4]; ++ ++ if (!spin_trylock_irqsave(&primary_crng.lock, flags)) ++ return 0; ++ if (crng_init != 0) { ++ spin_unlock_irqrestore(&primary_crng.lock, flags); ++ return 0; ++ } ++ if (len > max) ++ max = len; ++ ++ for (i = 0; i < max ; i++) { ++ tmp = lfsr; ++ lfsr >>= 1; ++ if (tmp & 1) ++ lfsr ^= 0xE1; ++ tmp = dest_buf[i % CHACHA20_KEY_SIZE]; ++ dest_buf[i % CHACHA20_KEY_SIZE] ^= src_buf[i % len] ^ lfsr; ++ lfsr += (tmp << 3) | (tmp >> 5); ++ } ++ spin_unlock_irqrestore(&primary_crng.lock, flags); ++ return 1; ++} ++ + static void crng_reseed(struct crng_state *crng, struct entropy_store *r) + { + unsigned long flags; +@@ -830,7 +880,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) + _crng_backtrack_protect(&primary_crng, buf.block, + CHACHA20_KEY_SIZE); + } +- spin_lock_irqsave(&primary_crng.lock, flags); ++ spin_lock_irqsave(&crng->lock, flags); + for (i = 0; i < 8; i++) { + unsigned long rv; + if (!arch_get_random_seed_long(&rv) && +@@ -840,7 +890,7 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) + } + memzero_explicit(&buf, sizeof(buf)); + crng->init_time = jiffies; +- spin_unlock_irqrestore(&primary_crng.lock, flags); ++ spin_unlock_irqrestore(&crng->lock, flags); + if (crng == &primary_crng && crng_init < 2) { + invalidate_batched_entropy(); + crng_init = 2; +@@ -855,8 +905,9 @@ static void _extract_crng(struct crng_state *crng, + { + unsigned long v, flags; + +- if (crng_init > 1 && +- time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL)) ++ if (crng_ready() && ++ (time_after(crng_global_init_time, crng->init_time) || ++ time_after(jiffies, crng->init_time + CRNG_RESEED_INTERVAL))) + crng_reseed(crng, crng == &primary_crng ? &input_pool : NULL); + spin_lock_irqsave(&crng->lock, flags); + if (arch_get_random_long(&v)) +@@ -981,10 +1032,8 @@ void add_device_randomness(const void *buf, unsigned int size) + unsigned long time = random_get_entropy() ^ jiffies; + unsigned long flags; + +- if (!crng_ready()) { +- crng_fast_load(buf, size); +- return; +- } ++ if (!crng_ready() && size) ++ crng_slow_load(buf, size); + + trace_add_device_randomness(size, _RET_IP_); + spin_lock_irqsave(&input_pool.lock, flags); +@@ -1141,7 +1190,7 @@ void add_interrupt_randomness(int irq, int irq_flags) + fast_mix(fast_pool); + add_interrupt_bench(cycles); + +- if (!crng_ready()) { ++ if (unlikely(crng_init == 0)) { + if ((fast_pool->count >= 64) && + crng_fast_load((char *) fast_pool->pool, + sizeof(fast_pool->pool))) { +@@ -1691,6 +1740,7 @@ static int rand_initialize(void) + init_std_data(&input_pool); + init_std_data(&blocking_pool); + crng_initialize(&primary_crng); ++ crng_global_init_time = jiffies; + + #ifdef CONFIG_NUMA + pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL); +@@ -1877,6 +1927,14 @@ static long random_ioctl(struct file *f, unsigned int cmd, unsigned long arg) + input_pool.entropy_count = 0; + blocking_pool.entropy_count = 0; + return 0; ++ case RNDRESEEDCRNG: ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EPERM; ++ if (crng_init < 2) ++ return -ENODATA; ++ crng_reseed(&primary_crng, NULL); ++ crng_global_init_time = jiffies - 1; ++ return 0; + default: + return -EINVAL; + } +@@ -2214,7 +2272,7 @@ void add_hwgenerator_randomness(const char *buffer, size_t count, + { + struct entropy_store *poolp = &input_pool; + +- if (!crng_ready()) { ++ if (unlikely(crng_init == 0)) { + crng_fast_load(buffer, count); + return; + } +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 0f1dc35e7078..1d01a8f77db1 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -971,6 +971,10 @@ int tpm_do_selftest(struct tpm_chip *chip) + loops = jiffies_to_msecs(duration) / delay_msec; + + rc = tpm_continue_selftest(chip); ++ if (rc == TPM_ERR_INVALID_POSTINIT) { ++ chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED; ++ dev_info(&chip->dev, "TPM not ready (%d)\n", rc); ++ } + /* This may fail if there was no TPM driver during a suspend/resume + * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST) + */ +diff --git a/drivers/clk/bcm/clk-bcm2835.c b/drivers/clk/bcm/clk-bcm2835.c +index eec52734d6ac..5f8082d89131 100644 +--- a/drivers/clk/bcm/clk-bcm2835.c ++++ b/drivers/clk/bcm/clk-bcm2835.c +@@ -632,9 +632,7 @@ static void bcm2835_pll_off(struct clk_hw *hw) + const struct bcm2835_pll_data *data = pll->data; + + spin_lock(&cprman->regs_lock); +- cprman_write(cprman, data->cm_ctrl_reg, +- cprman_read(cprman, data->cm_ctrl_reg) | +- CM_PLL_ANARST); ++ cprman_write(cprman, data->cm_ctrl_reg, CM_PLL_ANARST); + cprman_write(cprman, data->a2w_ctrl_reg, + cprman_read(cprman, data->a2w_ctrl_reg) | + A2W_PLL_CTRL_PWRDN); +@@ -670,6 +668,10 @@ static int bcm2835_pll_on(struct clk_hw *hw) + cpu_relax(); + } + ++ cprman_write(cprman, data->a2w_ctrl_reg, ++ cprman_read(cprman, data->a2w_ctrl_reg) | ++ A2W_PLL_CTRL_PRST_DISABLE); ++ + return 0; + } + +diff --git a/drivers/clk/mediatek/clk-mt2701.c b/drivers/clk/mediatek/clk-mt2701.c +index 9598889f972b..ccfe5d30fe10 100644 +--- a/drivers/clk/mediatek/clk-mt2701.c ++++ b/drivers/clk/mediatek/clk-mt2701.c +@@ -148,6 +148,7 @@ static const struct mtk_fixed_factor top_fixed_divs[] = { + FACTOR(CLK_TOP_CLK26M_D8, "clk26m_d8", "clk26m", 1, 8), + FACTOR(CLK_TOP_32K_INTERNAL, "32k_internal", "clk26m", 1, 793), + FACTOR(CLK_TOP_32K_EXTERNAL, "32k_external", "rtc32k", 1, 1), ++ FACTOR(CLK_TOP_AXISEL_D4, "axisel_d4", "axi_sel", 1, 4), + }; + + static const char * const axi_parents[] = { +@@ -857,13 +858,13 @@ static const struct mtk_gate peri_clks[] = { + GATE_PERI0(CLK_PERI_USB1, "usb1_ck", "usb20_sel", 11), + GATE_PERI0(CLK_PERI_USB0, "usb0_ck", "usb20_sel", 10), + GATE_PERI0(CLK_PERI_PWM, "pwm_ck", "axi_sel", 9), +- GATE_PERI0(CLK_PERI_PWM7, "pwm7_ck", "axi_sel", 8), +- GATE_PERI0(CLK_PERI_PWM6, "pwm6_ck", "axi_sel", 7), +- GATE_PERI0(CLK_PERI_PWM5, "pwm5_ck", "axi_sel", 6), +- GATE_PERI0(CLK_PERI_PWM4, "pwm4_ck", "axi_sel", 5), +- GATE_PERI0(CLK_PERI_PWM3, "pwm3_ck", "axi_sel", 4), +- GATE_PERI0(CLK_PERI_PWM2, "pwm2_ck", "axi_sel", 3), +- GATE_PERI0(CLK_PERI_PWM1, "pwm1_ck", "axi_sel", 2), ++ GATE_PERI0(CLK_PERI_PWM7, "pwm7_ck", "axisel_d4", 8), ++ GATE_PERI0(CLK_PERI_PWM6, "pwm6_ck", "axisel_d4", 7), ++ GATE_PERI0(CLK_PERI_PWM5, "pwm5_ck", "axisel_d4", 6), ++ GATE_PERI0(CLK_PERI_PWM4, "pwm4_ck", "axisel_d4", 5), ++ GATE_PERI0(CLK_PERI_PWM3, "pwm3_ck", "axisel_d4", 4), ++ GATE_PERI0(CLK_PERI_PWM2, "pwm2_ck", "axisel_d4", 3), ++ GATE_PERI0(CLK_PERI_PWM1, "pwm1_ck", "axisel_d4", 2), + GATE_PERI0(CLK_PERI_THERM, "therm_ck", "axi_sel", 1), + GATE_PERI0(CLK_PERI_NFI, "nfi_ck", "nfi2x_sel", 0), + +diff --git a/drivers/clk/mvebu/armada-38x.c b/drivers/clk/mvebu/armada-38x.c +index 394aa6f03f01..9ff4ea63932d 100644 +--- a/drivers/clk/mvebu/armada-38x.c ++++ b/drivers/clk/mvebu/armada-38x.c +@@ -46,11 +46,11 @@ static u32 __init armada_38x_get_tclk_freq(void __iomem *sar) + } + + static const u32 armada_38x_cpu_frequencies[] __initconst = { +- 0, 0, 0, 0, +- 1066 * 1000 * 1000, 0, 0, 0, ++ 666 * 1000 * 1000, 0, 800 * 1000 * 1000, 0, ++ 1066 * 1000 * 1000, 0, 1200 * 1000 * 1000, 0, + 1332 * 1000 * 1000, 0, 0, 0, + 1600 * 1000 * 1000, 0, 0, 0, +- 1866 * 1000 * 1000, ++ 1866 * 1000 * 1000, 0, 0, 2000 * 1000 * 1000, + }; + + static u32 __init armada_38x_get_cpu_freq(void __iomem *sar) +@@ -76,11 +76,11 @@ static const struct coreclk_ratio armada_38x_coreclk_ratios[] __initconst = { + }; + + static const int armada_38x_cpu_l2_ratios[32][2] __initconst = { +- {0, 1}, {0, 1}, {0, 1}, {0, 1}, +- {1, 2}, {0, 1}, {0, 1}, {0, 1}, +- {1, 2}, {0, 1}, {0, 1}, {0, 1}, ++ {1, 2}, {0, 1}, {1, 2}, {0, 1}, ++ {1, 2}, {0, 1}, {1, 2}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, ++ {1, 2}, {0, 1}, {0, 1}, {1, 2}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, +@@ -91,7 +91,7 @@ static const int armada_38x_cpu_ddr_ratios[32][2] __initconst = { + {1, 2}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, + {1, 2}, {0, 1}, {0, 1}, {0, 1}, +- {1, 2}, {0, 1}, {0, 1}, {0, 1}, ++ {1, 2}, {0, 1}, {0, 1}, {7, 15}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, + {0, 1}, {0, 1}, {0, 1}, {0, 1}, +diff --git a/drivers/clk/renesas/clk-sh73a0.c b/drivers/clk/renesas/clk-sh73a0.c +index eea38f6ea77e..3892346c4fcc 100644 +--- a/drivers/clk/renesas/clk-sh73a0.c ++++ b/drivers/clk/renesas/clk-sh73a0.c +@@ -46,7 +46,7 @@ struct div4_clk { + unsigned int shift; + }; + +-static struct div4_clk div4_clks[] = { ++static const struct div4_clk div4_clks[] = { + { "zg", "pll0", CPG_FRQCRA, 16 }, + { "m3", "pll1", CPG_FRQCRA, 12 }, + { "b", "pll1", CPG_FRQCRA, 8 }, +@@ -79,7 +79,7 @@ sh73a0_cpg_register_clock(struct device_node *np, struct sh73a0_cpg *cpg, + { + const struct clk_div_table *table = NULL; + unsigned int shift, reg, width; +- const char *parent_name; ++ const char *parent_name = NULL; + unsigned int mult = 1; + unsigned int div = 1; + +@@ -135,7 +135,7 @@ sh73a0_cpg_register_clock(struct device_node *np, struct sh73a0_cpg *cpg, + shift = 24; + width = 5; + } else { +- struct div4_clk *c; ++ const struct div4_clk *c; + + for (c = div4_clks; c->name; c++) { + if (!strcmp(name, c->name)) { +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index a1c3025f9df7..dcb1cb9a4572 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -20,6 +20,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -162,6 +163,8 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy) + policy->cpuinfo.max_freq = cppc_dmi_max_khz; + + policy->cpuinfo.transition_latency = cppc_get_transition_latency(cpu_num); ++ policy->transition_delay_us = cppc_get_transition_latency(cpu_num) / ++ NSEC_PER_USEC; + policy->shared_type = cpu->shared_type; + + if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) +diff --git a/drivers/dma/at_xdmac.c b/drivers/dma/at_xdmac.c +index c00e3923d7d8..94236ec9d410 100644 +--- a/drivers/dma/at_xdmac.c ++++ b/drivers/dma/at_xdmac.c +@@ -1471,10 +1471,10 @@ at_xdmac_tx_status(struct dma_chan *chan, dma_cookie_t cookie, + for (retry = 0; retry < AT_XDMAC_RESIDUE_MAX_RETRIES; retry++) { + check_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc; + rmb(); +- initd = !!(at_xdmac_chan_read(atchan, AT_XDMAC_CC) & AT_XDMAC_CC_INITD); +- rmb(); + cur_ubc = at_xdmac_chan_read(atchan, AT_XDMAC_CUBC); + rmb(); ++ initd = !!(at_xdmac_chan_read(atchan, AT_XDMAC_CC) & AT_XDMAC_CC_INITD); ++ rmb(); + cur_nda = at_xdmac_chan_read(atchan, AT_XDMAC_CNDA) & 0xfffffffc; + rmb(); + +diff --git a/drivers/extcon/extcon-intel-cht-wc.c b/drivers/extcon/extcon-intel-cht-wc.c +index 91a0023074af..60baaf693103 100644 +--- a/drivers/extcon/extcon-intel-cht-wc.c ++++ b/drivers/extcon/extcon-intel-cht-wc.c +@@ -66,6 +66,8 @@ + + #define CHT_WC_VBUS_GPIO_CTLO 0x6e2d + #define CHT_WC_VBUS_GPIO_CTLO_OUTPUT BIT(0) ++#define CHT_WC_VBUS_GPIO_CTLO_DRV_OD BIT(4) ++#define CHT_WC_VBUS_GPIO_CTLO_DIR_OUT BIT(5) + + enum cht_wc_usb_id { + USB_ID_OTG, +@@ -183,14 +185,15 @@ static void cht_wc_extcon_set_5v_boost(struct cht_wc_extcon_data *ext, + { + int ret, val; + +- val = enable ? CHT_WC_VBUS_GPIO_CTLO_OUTPUT : 0; +- + /* + * The 5V boost converter is enabled through a gpio on the PMIC, since + * there currently is no gpio driver we access the gpio reg directly. + */ +- ret = regmap_update_bits(ext->regmap, CHT_WC_VBUS_GPIO_CTLO, +- CHT_WC_VBUS_GPIO_CTLO_OUTPUT, val); ++ val = CHT_WC_VBUS_GPIO_CTLO_DRV_OD | CHT_WC_VBUS_GPIO_CTLO_DIR_OUT; ++ if (enable) ++ val |= CHT_WC_VBUS_GPIO_CTLO_OUTPUT; ++ ++ ret = regmap_write(ext->regmap, CHT_WC_VBUS_GPIO_CTLO, val); + if (ret) + dev_err(ext->dev, "Error writing Vbus GPIO CTLO: %d\n", ret); + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +index c53095b3b0fb..1ae5ae8c45a4 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atpx_handler.c +@@ -569,6 +569,7 @@ static const struct amdgpu_px_quirk amdgpu_px_quirk_list[] = { + { 0x1002, 0x6900, 0x1002, 0x0124, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0x1002, 0x6900, 0x1028, 0x0812, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0x1002, 0x6900, 0x1028, 0x0813, AMDGPU_PX_QUIRK_FORCE_ATPX }, ++ { 0x1002, 0x67DF, 0x1028, 0x0774, AMDGPU_PX_QUIRK_FORCE_ATPX }, + { 0, 0, 0, 0, 0 }, + }; + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +index 59089e027f4d..92be7f6de197 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c +@@ -233,8 +233,10 @@ void amdgpu_bo_list_get_list(struct amdgpu_bo_list *list, + for (i = 0; i < list->num_entries; i++) { + unsigned priority = list->array[i].priority; + +- list_add_tail(&list->array[i].tv.head, +- &bucket[priority]); ++ if (!list->array[i].robj->parent) ++ list_add_tail(&list->array[i].tv.head, ++ &bucket[priority]); ++ + list->array[i].user_pages = NULL; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index b5aa8e6f8e0b..5f892ad6476e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -522,7 +522,7 @@ static int amdgpu_cs_parser_bos(struct amdgpu_cs_parser *p, + INIT_LIST_HEAD(&duplicates); + amdgpu_vm_get_pd_bo(&fpriv->vm, &p->validated, &p->vm_pd); + +- if (p->uf_entry.robj) ++ if (p->uf_entry.robj && !p->uf_entry.robj->parent) + list_add(&p->uf_entry.tv.head, &p->validated); + + if (need_mmap_lock) +diff --git a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +index f508f4d01e4a..11beef7c595f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/cik_sdma.c ++++ b/drivers/gpu/drm/amd/amdgpu/cik_sdma.c +@@ -866,7 +866,7 @@ static void cik_sdma_ring_emit_pipeline_sync(struct amdgpu_ring *ring) + amdgpu_ring_write(ring, addr & 0xfffffffc); + amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); + amdgpu_ring_write(ring, seq); /* reference */ +- amdgpu_ring_write(ring, 0xfffffff); /* mask */ ++ amdgpu_ring_write(ring, 0xffffffff); /* mask */ + amdgpu_ring_write(ring, (0xfff << 16) | 4); /* retry count, poll interval */ + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c +index f2d0710258cb..9928473234a6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v2_4.c +@@ -856,7 +856,7 @@ static void sdma_v2_4_ring_emit_pipeline_sync(struct amdgpu_ring *ring) + amdgpu_ring_write(ring, addr & 0xfffffffc); + amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); + amdgpu_ring_write(ring, seq); /* reference */ +- amdgpu_ring_write(ring, 0xfffffff); /* mask */ ++ amdgpu_ring_write(ring, 0xffffffff); /* mask */ + amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) | + SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(4)); /* retry count, poll interval */ + } +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c +index b1de44f22824..f5db1fad3f05 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v3_0.c +@@ -1099,7 +1099,7 @@ static void sdma_v3_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring) + amdgpu_ring_write(ring, addr & 0xfffffffc); + amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); + amdgpu_ring_write(ring, seq); /* reference */ +- amdgpu_ring_write(ring, 0xfffffff); /* mask */ ++ amdgpu_ring_write(ring, 0xffffffff); /* mask */ + amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) | + SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(4)); /* retry count, poll interval */ + } +diff --git a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +index fd7c72aaafa6..4e5fed7c66bf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/sdma_v4_0.c +@@ -1136,7 +1136,7 @@ static void sdma_v4_0_ring_emit_pipeline_sync(struct amdgpu_ring *ring) + amdgpu_ring_write(ring, addr & 0xfffffffc); + amdgpu_ring_write(ring, upper_32_bits(addr) & 0xffffffff); + amdgpu_ring_write(ring, seq); /* reference */ +- amdgpu_ring_write(ring, 0xfffffff); /* mask */ ++ amdgpu_ring_write(ring, 0xffffffff); /* mask */ + amdgpu_ring_write(ring, SDMA_PKT_POLL_REGMEM_DW5_RETRY_COUNT(0xfff) | + SDMA_PKT_POLL_REGMEM_DW5_INTERVAL(4)); /* retry count, poll interval */ + } +diff --git a/drivers/gpu/drm/amd/amdgpu/si.c b/drivers/gpu/drm/amd/amdgpu/si.c +index 4c178feeb4bd..40520a968eac 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si.c ++++ b/drivers/gpu/drm/amd/amdgpu/si.c +@@ -1231,6 +1231,71 @@ static void si_detect_hw_virtualization(struct amdgpu_device *adev) + adev->virt.caps |= AMDGPU_PASSTHROUGH_MODE; + } + ++static int si_get_pcie_lanes(struct amdgpu_device *adev) ++{ ++ u32 link_width_cntl; ++ ++ if (adev->flags & AMD_IS_APU) ++ return 0; ++ ++ link_width_cntl = RREG32_PCIE_PORT(PCIE_LC_LINK_WIDTH_CNTL); ++ ++ switch ((link_width_cntl & LC_LINK_WIDTH_RD_MASK) >> LC_LINK_WIDTH_RD_SHIFT) { ++ case LC_LINK_WIDTH_X1: ++ return 1; ++ case LC_LINK_WIDTH_X2: ++ return 2; ++ case LC_LINK_WIDTH_X4: ++ return 4; ++ case LC_LINK_WIDTH_X8: ++ return 8; ++ case LC_LINK_WIDTH_X0: ++ case LC_LINK_WIDTH_X16: ++ default: ++ return 16; ++ } ++} ++ ++static void si_set_pcie_lanes(struct amdgpu_device *adev, int lanes) ++{ ++ u32 link_width_cntl, mask; ++ ++ if (adev->flags & AMD_IS_APU) ++ return; ++ ++ switch (lanes) { ++ case 0: ++ mask = LC_LINK_WIDTH_X0; ++ break; ++ case 1: ++ mask = LC_LINK_WIDTH_X1; ++ break; ++ case 2: ++ mask = LC_LINK_WIDTH_X2; ++ break; ++ case 4: ++ mask = LC_LINK_WIDTH_X4; ++ break; ++ case 8: ++ mask = LC_LINK_WIDTH_X8; ++ break; ++ case 16: ++ mask = LC_LINK_WIDTH_X16; ++ break; ++ default: ++ DRM_ERROR("invalid pcie lane request: %d\n", lanes); ++ return; ++ } ++ ++ link_width_cntl = RREG32_PCIE_PORT(PCIE_LC_LINK_WIDTH_CNTL); ++ link_width_cntl &= ~LC_LINK_WIDTH_MASK; ++ link_width_cntl |= mask << LC_LINK_WIDTH_SHIFT; ++ link_width_cntl |= (LC_RECONFIG_NOW | ++ LC_RECONFIG_ARC_MISSING_ESCAPE); ++ ++ WREG32_PCIE_PORT(PCIE_LC_LINK_WIDTH_CNTL, link_width_cntl); ++} ++ + static const struct amdgpu_asic_funcs si_asic_funcs = + { + .read_disabled_bios = &si_read_disabled_bios, +@@ -1241,6 +1306,8 @@ static const struct amdgpu_asic_funcs si_asic_funcs = + .get_xclk = &si_get_xclk, + .set_uvd_clocks = &si_set_uvd_clocks, + .set_vce_clocks = NULL, ++ .get_pcie_lanes = &si_get_pcie_lanes, ++ .set_pcie_lanes = &si_set_pcie_lanes, + .get_config_memsize = &si_get_config_memsize, + }; + +diff --git a/drivers/gpu/drm/amd/amdgpu/si_dpm.c b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +index abb0a2341a41..6f1dea157a77 100644 +--- a/drivers/gpu/drm/amd/amdgpu/si_dpm.c ++++ b/drivers/gpu/drm/amd/amdgpu/si_dpm.c +@@ -6374,9 +6374,9 @@ static void si_set_pcie_lane_width_in_smc(struct amdgpu_device *adev, + { + u32 lane_width; + u32 new_lane_width = +- (amdgpu_new_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT; ++ ((amdgpu_new_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT) + 1; + u32 current_lane_width = +- (amdgpu_current_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT; ++ ((amdgpu_current_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT) + 1; + + if (new_lane_width != current_lane_width) { + amdgpu_set_pcie_lanes(adev, new_lane_width); +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 920c8914cec1..cc70e2470272 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -6159,6 +6159,12 @@ enum { + #define _SPATILEOFF (VLV_DISPLAY_BASE + 0x721a4) + #define _SPACONSTALPHA (VLV_DISPLAY_BASE + 0x721a8) + #define SP_CONST_ALPHA_ENABLE (1<<31) ++#define _SPACLRC0 (VLV_DISPLAY_BASE + 0x721d0) ++#define SP_CONTRAST(x) ((x) << 18) /* u3.6 */ ++#define SP_BRIGHTNESS(x) ((x) & 0xff) /* s8 */ ++#define _SPACLRC1 (VLV_DISPLAY_BASE + 0x721d4) ++#define SP_SH_SIN(x) (((x) & 0x7ff) << 16) /* s4.7 */ ++#define SP_SH_COS(x) (x) /* u3.7 */ + #define _SPAGAMC (VLV_DISPLAY_BASE + 0x721f4) + + #define _SPBCNTR (VLV_DISPLAY_BASE + 0x72280) +@@ -6172,6 +6178,8 @@ enum { + #define _SPBKEYMAXVAL (VLV_DISPLAY_BASE + 0x722a0) + #define _SPBTILEOFF (VLV_DISPLAY_BASE + 0x722a4) + #define _SPBCONSTALPHA (VLV_DISPLAY_BASE + 0x722a8) ++#define _SPBCLRC0 (VLV_DISPLAY_BASE + 0x722d0) ++#define _SPBCLRC1 (VLV_DISPLAY_BASE + 0x722d4) + #define _SPBGAMC (VLV_DISPLAY_BASE + 0x722f4) + + #define _MMIO_VLV_SPR(pipe, plane_id, reg_a, reg_b) \ +@@ -6188,6 +6196,8 @@ enum { + #define SPKEYMAXVAL(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPAKEYMAXVAL, _SPBKEYMAXVAL) + #define SPTILEOFF(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPATILEOFF, _SPBTILEOFF) + #define SPCONSTALPHA(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACONSTALPHA, _SPBCONSTALPHA) ++#define SPCLRC0(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACLRC0, _SPBCLRC0) ++#define SPCLRC1(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPACLRC1, _SPBCLRC1) + #define SPGAMC(pipe, plane_id) _MMIO_VLV_SPR((pipe), (plane_id), _SPAGAMC, _SPBGAMC) + + /* +diff --git a/drivers/gpu/drm/i915/intel_sprite.c b/drivers/gpu/drm/i915/intel_sprite.c +index f8ebeb5ffb96..41e31a454604 100644 +--- a/drivers/gpu/drm/i915/intel_sprite.c ++++ b/drivers/gpu/drm/i915/intel_sprite.c +@@ -345,44 +345,87 @@ skl_plane_get_hw_state(struct intel_plane *plane) + } + + static void +-chv_update_csc(struct intel_plane *plane, uint32_t format) ++chv_update_csc(const struct intel_plane_state *plane_state) + { ++ struct intel_plane *plane = to_intel_plane(plane_state->base.plane); + struct drm_i915_private *dev_priv = to_i915(plane->base.dev); ++ const struct drm_framebuffer *fb = plane_state->base.fb; + enum plane_id plane_id = plane->id; + + /* Seems RGB data bypasses the CSC always */ +- if (!format_is_yuv(format)) ++ if (!format_is_yuv(fb->format->format)) + return; + + /* +- * BT.601 limited range YCbCr -> full range RGB ++ * BT.601 full range YCbCr -> full range RGB + * +- * |r| | 6537 4769 0| |cr | +- * |g| = |-3330 4769 -1605| x |y-64| +- * |b| | 0 4769 8263| |cb | ++ * |r| | 5743 4096 0| |cr| ++ * |g| = |-2925 4096 -1410| x |y | ++ * |b| | 0 4096 7258| |cb| + * +- * Cb and Cr apparently come in as signed already, so no +- * need for any offset. For Y we need to remove the offset. ++ * Cb and Cr apparently come in as signed already, ++ * and we get full range data in on account of CLRC0/1 + */ +- I915_WRITE_FW(SPCSCYGOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(-64)); ++ I915_WRITE_FW(SPCSCYGOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0)); + I915_WRITE_FW(SPCSCCBOFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0)); + I915_WRITE_FW(SPCSCCROFF(plane_id), SPCSC_OOFF(0) | SPCSC_IOFF(0)); + +- I915_WRITE_FW(SPCSCC01(plane_id), SPCSC_C1(4769) | SPCSC_C0(6537)); +- I915_WRITE_FW(SPCSCC23(plane_id), SPCSC_C1(-3330) | SPCSC_C0(0)); +- I915_WRITE_FW(SPCSCC45(plane_id), SPCSC_C1(-1605) | SPCSC_C0(4769)); +- I915_WRITE_FW(SPCSCC67(plane_id), SPCSC_C1(4769) | SPCSC_C0(0)); +- I915_WRITE_FW(SPCSCC8(plane_id), SPCSC_C0(8263)); ++ I915_WRITE_FW(SPCSCC01(plane_id), SPCSC_C1(4096) | SPCSC_C0(5743)); ++ I915_WRITE_FW(SPCSCC23(plane_id), SPCSC_C1(-2925) | SPCSC_C0(0)); ++ I915_WRITE_FW(SPCSCC45(plane_id), SPCSC_C1(-1410) | SPCSC_C0(4096)); ++ I915_WRITE_FW(SPCSCC67(plane_id), SPCSC_C1(4096) | SPCSC_C0(0)); ++ I915_WRITE_FW(SPCSCC8(plane_id), SPCSC_C0(7258)); + +- I915_WRITE_FW(SPCSCYGICLAMP(plane_id), SPCSC_IMAX(940) | SPCSC_IMIN(64)); +- I915_WRITE_FW(SPCSCCBICLAMP(plane_id), SPCSC_IMAX(448) | SPCSC_IMIN(-448)); +- I915_WRITE_FW(SPCSCCRICLAMP(plane_id), SPCSC_IMAX(448) | SPCSC_IMIN(-448)); ++ I915_WRITE_FW(SPCSCYGICLAMP(plane_id), SPCSC_IMAX(1023) | SPCSC_IMIN(0)); ++ I915_WRITE_FW(SPCSCCBICLAMP(plane_id), SPCSC_IMAX(512) | SPCSC_IMIN(-512)); ++ I915_WRITE_FW(SPCSCCRICLAMP(plane_id), SPCSC_IMAX(512) | SPCSC_IMIN(-512)); + + I915_WRITE_FW(SPCSCYGOCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0)); + I915_WRITE_FW(SPCSCCBOCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0)); + I915_WRITE_FW(SPCSCCROCLAMP(plane_id), SPCSC_OMAX(1023) | SPCSC_OMIN(0)); + } + ++#define SIN_0 0 ++#define COS_0 1 ++ ++static void ++vlv_update_clrc(const struct intel_plane_state *plane_state) ++{ ++ struct intel_plane *plane = to_intel_plane(plane_state->base.plane); ++ struct drm_i915_private *dev_priv = to_i915(plane->base.dev); ++ const struct drm_framebuffer *fb = plane_state->base.fb; ++ enum pipe pipe = plane->pipe; ++ enum plane_id plane_id = plane->id; ++ int contrast, brightness, sh_scale, sh_sin, sh_cos; ++ ++ if (format_is_yuv(fb->format->format)) { ++ /* ++ * Expand limited range to full range: ++ * Contrast is applied first and is used to expand Y range. ++ * Brightness is applied second and is used to remove the ++ * offset from Y. Saturation/hue is used to expand CbCr range. ++ */ ++ contrast = DIV_ROUND_CLOSEST(255 << 6, 235 - 16); ++ brightness = -DIV_ROUND_CLOSEST(16 * 255, 235 - 16); ++ sh_scale = DIV_ROUND_CLOSEST(128 << 7, 240 - 128); ++ sh_sin = SIN_0 * sh_scale; ++ sh_cos = COS_0 * sh_scale; ++ } else { ++ /* Pass-through everything. */ ++ contrast = 1 << 6; ++ brightness = 0; ++ sh_scale = 1 << 7; ++ sh_sin = SIN_0 * sh_scale; ++ sh_cos = COS_0 * sh_scale; ++ } ++ ++ /* FIXME these register are single buffered :( */ ++ I915_WRITE_FW(SPCLRC0(pipe, plane_id), ++ SP_CONTRAST(contrast) | SP_BRIGHTNESS(brightness)); ++ I915_WRITE_FW(SPCLRC1(pipe, plane_id), ++ SP_SH_SIN(sh_sin) | SP_SH_COS(sh_cos)); ++} ++ + static u32 vlv_sprite_ctl(const struct intel_crtc_state *crtc_state, + const struct intel_plane_state *plane_state) + { +@@ -476,8 +519,10 @@ vlv_update_plane(struct intel_plane *plane, + + spin_lock_irqsave(&dev_priv->uncore.lock, irqflags); + ++ vlv_update_clrc(plane_state); ++ + if (IS_CHERRYVIEW(dev_priv) && pipe == PIPE_B) +- chv_update_csc(plane, fb->format->format); ++ chv_update_csc(plane_state); + + if (key->flags) { + I915_WRITE_FW(SPKEYMINVAL(pipe, plane_id), key->min_value); +diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c +index 32b577c776b9..58488eac8462 100644 +--- a/drivers/gpu/drm/radeon/radeon_device.c ++++ b/drivers/gpu/drm/radeon/radeon_device.c +@@ -139,6 +139,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = { + * https://bugs.freedesktop.org/show_bug.cgi?id=101491 + */ + { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, ++ /* Asus K73TK laptop with AMD A6-3420M APU and Radeon 7670m GPU ++ * https://bugzilla.kernel.org/show_bug.cgi?id=51381#c52 ++ */ ++ { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2123, RADEON_PX_QUIRK_DISABLE_PX }, + { 0, 0, 0, 0, 0 }, + }; + +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index 97a0a639dad9..90d5b41007bf 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -5912,9 +5912,9 @@ static void si_set_pcie_lane_width_in_smc(struct radeon_device *rdev, + { + u32 lane_width; + u32 new_lane_width = +- (radeon_new_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT; ++ ((radeon_new_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT) + 1; + u32 current_lane_width = +- (radeon_current_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT; ++ ((radeon_current_state->caps & ATOM_PPLIB_PCIE_LINK_WIDTH_MASK) >> ATOM_PPLIB_PCIE_LINK_WIDTH_SHIFT) + 1; + + if (new_lane_width != current_lane_width) { + radeon_set_pcie_lanes(rdev, new_lane_width); +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +index bf9ed0e63973..f1fa8d5c9b52 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_vop.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_vop.c +@@ -1413,6 +1413,9 @@ static int vop_initial(struct vop *vop) + usleep_range(10, 20); + reset_control_deassert(ahb_rst); + ++ VOP_INTR_SET_TYPE(vop, clear, INTR_MASK, 1); ++ VOP_INTR_SET_TYPE(vop, enable, INTR_MASK, 0); ++ + memcpy(vop->regsbak, vop->regs, vop->len); + + VOP_REG_SET(vop, misc, global_regdone_en, 1); +@@ -1568,17 +1571,9 @@ static int vop_bind(struct device *dev, struct device *master, void *data) + + mutex_init(&vop->vsync_mutex); + +- ret = devm_request_irq(dev, vop->irq, vop_isr, +- IRQF_SHARED, dev_name(dev), vop); +- if (ret) +- return ret; +- +- /* IRQ is initially disabled; it gets enabled in power_on */ +- disable_irq(vop->irq); +- + ret = vop_create_crtc(vop); + if (ret) +- goto err_enable_irq; ++ return ret; + + pm_runtime_enable(&pdev->dev); + +@@ -1588,13 +1583,19 @@ static int vop_bind(struct device *dev, struct device *master, void *data) + goto err_disable_pm_runtime; + } + ++ ret = devm_request_irq(dev, vop->irq, vop_isr, ++ IRQF_SHARED, dev_name(dev), vop); ++ if (ret) ++ goto err_disable_pm_runtime; ++ ++ /* IRQ is initially disabled; it gets enabled in power_on */ ++ disable_irq(vop->irq); ++ + return 0; + + err_disable_pm_runtime: + pm_runtime_disable(&pdev->dev); + vop_destroy_crtc(vop); +-err_enable_irq: +- enable_irq(vop->irq); /* To balance out the disable_irq above */ + return ret; + } + +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index ca2fbe56635a..672b0be41d44 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -1390,7 +1390,7 @@ u8 *hid_alloc_report_buf(struct hid_report *report, gfp_t flags) + * of implement() working on 8 byte chunks + */ + +- int len = hid_report_len(report) + 7; ++ u32 len = hid_report_len(report) + 7; + + return kmalloc(len, flags); + } +@@ -1455,7 +1455,7 @@ void __hid_request(struct hid_device *hid, struct hid_report *report, + { + char *buf; + int ret; +- int len; ++ u32 len; + + buf = hid_alloc_report_buf(report, GFP_KERNEL); + if (!buf) +@@ -1481,14 +1481,14 @@ void __hid_request(struct hid_device *hid, struct hid_report *report, + } + EXPORT_SYMBOL_GPL(__hid_request); + +-int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size, ++int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, + int interrupt) + { + struct hid_report_enum *report_enum = hid->report_enum + type; + struct hid_report *report; + struct hid_driver *hdrv; + unsigned int a; +- int rsize, csize = size; ++ u32 rsize, csize = size; + u8 *cdata = data; + int ret = 0; + +@@ -1546,7 +1546,7 @@ EXPORT_SYMBOL_GPL(hid_report_raw_event); + * + * This is data entry for lower layers. + */ +-int hid_input_report(struct hid_device *hid, int type, u8 *data, int size, int interrupt) ++int hid_input_report(struct hid_device *hid, int type, u8 *data, u32 size, int interrupt) + { + struct hid_report_enum *report_enum; + struct hid_driver *hdrv; +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 199f6a01fc62..bb984cc9753b 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -387,7 +387,8 @@ static int hidinput_get_battery_property(struct power_supply *psy, + break; + + case POWER_SUPPLY_PROP_CAPACITY: +- if (dev->battery_report_type == HID_FEATURE_REPORT) { ++ if (dev->battery_status != HID_BATTERY_REPORTED && ++ !dev->battery_avoid_query) { + value = hidinput_query_battery_capacity(dev); + if (value < 0) + return value; +@@ -403,17 +404,17 @@ static int hidinput_get_battery_property(struct power_supply *psy, + break; + + case POWER_SUPPLY_PROP_STATUS: +- if (!dev->battery_reported && +- dev->battery_report_type == HID_FEATURE_REPORT) { ++ if (dev->battery_status != HID_BATTERY_REPORTED && ++ !dev->battery_avoid_query) { + value = hidinput_query_battery_capacity(dev); + if (value < 0) + return value; + + dev->battery_capacity = value; +- dev->battery_reported = true; ++ dev->battery_status = HID_BATTERY_QUERIED; + } + +- if (!dev->battery_reported) ++ if (dev->battery_status == HID_BATTERY_UNKNOWN) + val->intval = POWER_SUPPLY_STATUS_UNKNOWN; + else if (dev->battery_capacity == 100) + val->intval = POWER_SUPPLY_STATUS_FULL; +@@ -486,6 +487,14 @@ static int hidinput_setup_battery(struct hid_device *dev, unsigned report_type, + dev->battery_report_type = report_type; + dev->battery_report_id = field->report->id; + ++ /* ++ * Stylus is normally not connected to the device and thus we ++ * can't query the device and get meaningful battery strength. ++ * We have to wait for the device to report it on its own. ++ */ ++ dev->battery_avoid_query = report_type == HID_INPUT_REPORT && ++ field->physical == HID_DG_STYLUS; ++ + dev->battery = power_supply_register(&dev->dev, psy_desc, &psy_cfg); + if (IS_ERR(dev->battery)) { + error = PTR_ERR(dev->battery); +@@ -530,9 +539,10 @@ static void hidinput_update_battery(struct hid_device *dev, int value) + + capacity = hidinput_scale_battery_capacity(dev, value); + +- if (!dev->battery_reported || capacity != dev->battery_capacity) { ++ if (dev->battery_status != HID_BATTERY_REPORTED || ++ capacity != dev->battery_capacity) { + dev->battery_capacity = capacity; +- dev->battery_reported = true; ++ dev->battery_status = HID_BATTERY_REPORTED; + power_supply_changed(dev->battery); + } + } +@@ -1359,7 +1369,8 @@ static void hidinput_led_worker(struct work_struct *work) + led_work); + struct hid_field *field; + struct hid_report *report; +- int len, ret; ++ int ret; ++ u32 len; + __u8 *buf; + + field = hidinput_get_led_field(hid); +diff --git a/drivers/hid/hid-multitouch.c b/drivers/hid/hid-multitouch.c +index 6598501c1ad0..c3b9bd5dba75 100644 +--- a/drivers/hid/hid-multitouch.c ++++ b/drivers/hid/hid-multitouch.c +@@ -354,7 +354,8 @@ static const struct attribute_group mt_attribute_group = { + static void mt_get_feature(struct hid_device *hdev, struct hid_report *report) + { + struct mt_device *td = hid_get_drvdata(hdev); +- int ret, size = hid_report_len(report); ++ int ret; ++ u32 size = hid_report_len(report); + u8 *buf; + + /* +@@ -1049,7 +1050,7 @@ static void mt_set_input_mode(struct hid_device *hdev) + struct hid_report_enum *re; + struct mt_class *cls = &td->mtclass; + char *buf; +- int report_len; ++ u32 report_len; + + if (td->inputmode < 0) + return; +diff --git a/drivers/hid/hid-rmi.c b/drivers/hid/hid-rmi.c +index ef241d66562e..cf5812188c37 100644 +--- a/drivers/hid/hid-rmi.c ++++ b/drivers/hid/hid-rmi.c +@@ -89,8 +89,8 @@ struct rmi_data { + u8 *writeReport; + u8 *readReport; + +- int input_report_size; +- int output_report_size; ++ u32 input_report_size; ++ u32 output_report_size; + + unsigned long flags; + +diff --git a/drivers/hid/hidraw.c b/drivers/hid/hidraw.c +index 5fbe0f81ab2e..01b5a9f01814 100644 +--- a/drivers/hid/hidraw.c ++++ b/drivers/hid/hidraw.c +@@ -192,6 +192,11 @@ static ssize_t hidraw_get_report(struct file *file, char __user *buffer, size_t + int ret = 0, len; + unsigned char report_number; + ++ if (!hidraw_table[minor] || !hidraw_table[minor]->exist) { ++ ret = -ENODEV; ++ goto out; ++ } ++ + dev = hidraw_table[minor]->hid; + + if (!dev->ll_driver->raw_request) { +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 9145c2129a96..3535073a9a7d 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -143,10 +143,10 @@ struct i2c_hid { + * register of the HID + * descriptor. */ + unsigned int bufsize; /* i2c buffer size */ +- char *inbuf; /* Input buffer */ +- char *rawbuf; /* Raw Input buffer */ +- char *cmdbuf; /* Command buffer */ +- char *argsbuf; /* Command arguments buffer */ ++ u8 *inbuf; /* Input buffer */ ++ u8 *rawbuf; /* Raw Input buffer */ ++ u8 *cmdbuf; /* Command buffer */ ++ u8 *argsbuf; /* Command arguments buffer */ + + unsigned long flags; /* device flags */ + unsigned long quirks; /* Various quirks */ +@@ -450,7 +450,8 @@ static int i2c_hid_hwreset(struct i2c_client *client) + + static void i2c_hid_get_input(struct i2c_hid *ihid) + { +- int ret, ret_size; ++ int ret; ++ u32 ret_size; + int size = le16_to_cpu(ihid->hdesc.wMaxInputLength); + + if (size > ihid->bufsize) +@@ -475,7 +476,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid) + return; + } + +- if (ret_size > size) { ++ if ((ret_size > size) || (ret_size <= 2)) { + dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n", + __func__, size, ret_size); + return; +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 65f1cfbbe7fe..4c337585479e 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -115,7 +115,7 @@ static void wacom_feature_mapping(struct hid_device *hdev, + unsigned int equivalent_usage = wacom_equivalent_usage(usage->hid); + u8 *data; + int ret; +- int n; ++ u32 n; + + switch (equivalent_usage) { + case HID_DG_CONTACTMAX: +@@ -408,7 +408,7 @@ static int wacom_set_device_mode(struct hid_device *hdev, + u8 *rep_data; + struct hid_report *r; + struct hid_report_enum *re; +- int length; ++ u32 length; + int error = -ENOMEM, limit = 0; + + if (wacom_wac->mode_report < 0) +diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c +index 70cbe1e5a3d2..c401b5b63f4c 100644 +--- a/drivers/hid/wacom_wac.c ++++ b/drivers/hid/wacom_wac.c +@@ -689,6 +689,45 @@ static int wacom_intuos_get_tool_type(int tool_id) + return tool_type; + } + ++static void wacom_exit_report(struct wacom_wac *wacom) ++{ ++ struct input_dev *input = wacom->pen_input; ++ struct wacom_features *features = &wacom->features; ++ unsigned char *data = wacom->data; ++ int idx = (features->type == INTUOS) ? (data[1] & 0x01) : 0; ++ ++ /* ++ * Reset all states otherwise we lose the initial states ++ * when in-prox next time ++ */ ++ input_report_abs(input, ABS_X, 0); ++ input_report_abs(input, ABS_Y, 0); ++ input_report_abs(input, ABS_DISTANCE, 0); ++ input_report_abs(input, ABS_TILT_X, 0); ++ input_report_abs(input, ABS_TILT_Y, 0); ++ if (wacom->tool[idx] >= BTN_TOOL_MOUSE) { ++ input_report_key(input, BTN_LEFT, 0); ++ input_report_key(input, BTN_MIDDLE, 0); ++ input_report_key(input, BTN_RIGHT, 0); ++ input_report_key(input, BTN_SIDE, 0); ++ input_report_key(input, BTN_EXTRA, 0); ++ input_report_abs(input, ABS_THROTTLE, 0); ++ input_report_abs(input, ABS_RZ, 0); ++ } else { ++ input_report_abs(input, ABS_PRESSURE, 0); ++ input_report_key(input, BTN_STYLUS, 0); ++ input_report_key(input, BTN_STYLUS2, 0); ++ input_report_key(input, BTN_TOUCH, 0); ++ input_report_abs(input, ABS_WHEEL, 0); ++ if (features->type >= INTUOS3S) ++ input_report_abs(input, ABS_Z, 0); ++ } ++ input_report_key(input, wacom->tool[idx], 0); ++ input_report_abs(input, ABS_MISC, 0); /* reset tool id */ ++ input_event(input, EV_MSC, MSC_SERIAL, wacom->serial[idx]); ++ wacom->id[idx] = 0; ++} ++ + static int wacom_intuos_inout(struct wacom_wac *wacom) + { + struct wacom_features *features = &wacom->features; +@@ -741,36 +780,7 @@ static int wacom_intuos_inout(struct wacom_wac *wacom) + if (!wacom->id[idx]) + return 1; + +- /* +- * Reset all states otherwise we lose the initial states +- * when in-prox next time +- */ +- input_report_abs(input, ABS_X, 0); +- input_report_abs(input, ABS_Y, 0); +- input_report_abs(input, ABS_DISTANCE, 0); +- input_report_abs(input, ABS_TILT_X, 0); +- input_report_abs(input, ABS_TILT_Y, 0); +- if (wacom->tool[idx] >= BTN_TOOL_MOUSE) { +- input_report_key(input, BTN_LEFT, 0); +- input_report_key(input, BTN_MIDDLE, 0); +- input_report_key(input, BTN_RIGHT, 0); +- input_report_key(input, BTN_SIDE, 0); +- input_report_key(input, BTN_EXTRA, 0); +- input_report_abs(input, ABS_THROTTLE, 0); +- input_report_abs(input, ABS_RZ, 0); +- } else { +- input_report_abs(input, ABS_PRESSURE, 0); +- input_report_key(input, BTN_STYLUS, 0); +- input_report_key(input, BTN_STYLUS2, 0); +- input_report_key(input, BTN_TOUCH, 0); +- input_report_abs(input, ABS_WHEEL, 0); +- if (features->type >= INTUOS3S) +- input_report_abs(input, ABS_Z, 0); +- } +- input_report_key(input, wacom->tool[idx], 0); +- input_report_abs(input, ABS_MISC, 0); /* reset tool id */ +- input_event(input, EV_MSC, MSC_SERIAL, wacom->serial[idx]); +- wacom->id[idx] = 0; ++ wacom_exit_report(wacom); + return 2; + } + +@@ -1226,6 +1236,12 @@ static void wacom_intuos_pro2_bt_pen(struct wacom_wac *wacom) + if (!valid) + continue; + ++ if (!prox) { ++ wacom->shared->stylus_in_proximity = false; ++ wacom_exit_report(wacom); ++ input_sync(pen_input); ++ return; ++ } + if (range) { + /* Fix rotation alignment: userspace expects zero at left */ + int16_t rotation = (int16_t)get_unaligned_le16(&frame[9]); +diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c +index 8eac00efadc1..ba8df2fde1b2 100644 +--- a/drivers/i2c/busses/i2c-i801.c ++++ b/drivers/i2c/busses/i2c-i801.c +@@ -965,8 +965,6 @@ static void i801_enable_host_notify(struct i2c_adapter *adapter) + if (!(priv->features & FEATURE_HOST_NOTIFY)) + return; + +- priv->original_slvcmd = inb_p(SMBSLVCMD(priv)); +- + if (!(SMBSLVCMD_HST_NTFY_INTREN & priv->original_slvcmd)) + outb_p(SMBSLVCMD_HST_NTFY_INTREN | priv->original_slvcmd, + SMBSLVCMD(priv)); +@@ -1614,6 +1612,10 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id) + outb_p(inb_p(SMBAUXCTL(priv)) & + ~(SMBAUXCTL_CRC | SMBAUXCTL_E32B), SMBAUXCTL(priv)); + ++ /* Remember original Host Notify setting */ ++ if (priv->features & FEATURE_HOST_NOTIFY) ++ priv->original_slvcmd = inb_p(SMBSLVCMD(priv)); ++ + /* Default timeout in interrupt mode: 200 ms */ + priv->adapter.timeout = HZ / 5; + +@@ -1698,6 +1700,15 @@ static void i801_remove(struct pci_dev *dev) + */ + } + ++static void i801_shutdown(struct pci_dev *dev) ++{ ++ struct i801_priv *priv = pci_get_drvdata(dev); ++ ++ /* Restore config registers to avoid hard hang on some systems */ ++ i801_disable_host_notify(priv); ++ pci_write_config_byte(dev, SMBHSTCFG, priv->original_hstcfg); ++} ++ + #ifdef CONFIG_PM + static int i801_suspend(struct device *dev) + { +@@ -1727,6 +1738,7 @@ static struct pci_driver i801_driver = { + .id_table = i801_ids, + .probe = i801_probe, + .remove = i801_remove, ++ .shutdown = i801_shutdown, + .driver = { + .pm = &i801_pm_ops, + }, +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index d6fa38f8604f..0698d92e2656 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1241,6 +1241,9 @@ static int ucma_set_ib_path(struct ucma_context *ctx, + if (!optlen) + return -EINVAL; + ++ if (!ctx->cm_id->device) ++ return -EINVAL; ++ + memset(&sa_path, 0, sizeof(sa_path)); + + sa_path.rec_type = SA_PATH_REC_TYPE_IB; +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 6d48d8a93b62..538f1784863a 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1220,6 +1220,8 @@ struct ib_mr *mlx5_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + return ERR_PTR(-EINVAL); + + mr = mlx5_ib_alloc_implicit_mr(to_mpd(pd), access_flags); ++ if (IS_ERR(mr)) ++ return ERR_CAST(mr); + return &mr->ibmr; + } + #endif +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index afbf701dc9a7..906bacf365d4 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -712,9 +712,8 @@ static int init_send_wqe(struct rxe_qp *qp, struct ib_send_wr *ibwr, + memcpy(wqe->dma.sge, ibwr->sg_list, + num_sge * sizeof(struct ib_sge)); + +- wqe->iova = (mask & WR_ATOMIC_MASK) ? +- atomic_wr(ibwr)->remote_addr : +- rdma_wr(ibwr)->remote_addr; ++ wqe->iova = mask & WR_ATOMIC_MASK ? atomic_wr(ibwr)->remote_addr : ++ mask & WR_READ_OR_WRITE_MASK ? rdma_wr(ibwr)->remote_addr : 0; + wqe->mask = mask; + wqe->dma.length = length; + wqe->dma.resid = length; +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 60d7b493ed2d..299a97b7e17f 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -2656,9 +2656,11 @@ static int srp_abort(struct scsi_cmnd *scmnd) + ret = FAST_IO_FAIL; + else + ret = FAILED; +- srp_free_req(ch, req, scmnd, 0); +- scmnd->result = DID_ABORT << 16; +- scmnd->scsi_done(scmnd); ++ if (ret == SUCCESS) { ++ srp_free_req(ch, req, scmnd, 0); ++ scmnd->result = DID_ABORT << 16; ++ scmnd->scsi_done(scmnd); ++ } + + return ret; + } +@@ -3428,12 +3430,10 @@ static ssize_t srp_create_target(struct device *dev, + num_online_nodes()); + const int ch_end = ((node_idx + 1) * target->ch_count / + num_online_nodes()); +- const int cv_start = (node_idx * ibdev->num_comp_vectors / +- num_online_nodes() + target->comp_vector) +- % ibdev->num_comp_vectors; +- const int cv_end = ((node_idx + 1) * ibdev->num_comp_vectors / +- num_online_nodes() + target->comp_vector) +- % ibdev->num_comp_vectors; ++ const int cv_start = node_idx * ibdev->num_comp_vectors / ++ num_online_nodes(); ++ const int cv_end = (node_idx + 1) * ibdev->num_comp_vectors / ++ num_online_nodes(); + int cpu_idx = 0; + + for_each_online_cpu(cpu) { +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index 003b4a4d4b78..d7def26ccf79 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -382,6 +382,7 @@ int intel_svm_bind_mm(struct device *dev, int *pasid, int flags, struct svm_dev_ + pasid_max - 1, GFP_KERNEL); + if (ret < 0) { + kfree(svm); ++ kfree(sdev); + goto out; + } + svm->pasid = ret; +diff --git a/drivers/irqchip/irq-gic-common.c b/drivers/irqchip/irq-gic-common.c +index 9ae71804b5dd..1c2ca8d51a70 100644 +--- a/drivers/irqchip/irq-gic-common.c ++++ b/drivers/irqchip/irq-gic-common.c +@@ -21,6 +21,8 @@ + + #include "irq-gic-common.h" + ++static DEFINE_RAW_SPINLOCK(irq_controller_lock); ++ + static const struct gic_kvm_info *gic_kvm_info; + + const struct gic_kvm_info *gic_get_kvm_info(void) +@@ -52,11 +54,13 @@ int gic_configure_irq(unsigned int irq, unsigned int type, + u32 confoff = (irq / 16) * 4; + u32 val, oldval; + int ret = 0; ++ unsigned long flags; + + /* + * Read current configuration register, and insert the config + * for "irq", depending on "type". + */ ++ raw_spin_lock_irqsave(&irq_controller_lock, flags); + val = oldval = readl_relaxed(base + GIC_DIST_CONFIG + confoff); + if (type & IRQ_TYPE_LEVEL_MASK) + val &= ~confmask; +@@ -64,8 +68,10 @@ int gic_configure_irq(unsigned int irq, unsigned int type, + val |= confmask; + + /* If the current configuration is the same, then we are done */ +- if (val == oldval) ++ if (val == oldval) { ++ raw_spin_unlock_irqrestore(&irq_controller_lock, flags); + return 0; ++ } + + /* + * Write back the new configuration, and possibly re-enable +@@ -83,6 +89,7 @@ int gic_configure_irq(unsigned int irq, unsigned int type, + pr_warn("GIC: PPI%d is secure or misconfigured\n", + irq - 16); + } ++ raw_spin_unlock_irqrestore(&irq_controller_lock, flags); + + if (sync_access) + sync_access(); +diff --git a/drivers/md/dm-crypt.c b/drivers/md/dm-crypt.c +index 554d60394c06..f575110454b6 100644 +--- a/drivers/md/dm-crypt.c ++++ b/drivers/md/dm-crypt.c +@@ -148,6 +148,8 @@ struct crypt_config { + mempool_t *tag_pool; + unsigned tag_pool_max_sectors; + ++ struct percpu_counter n_allocated_pages; ++ + struct bio_set *bs; + struct mutex bio_alloc_lock; + +@@ -219,6 +221,12 @@ struct crypt_config { + #define MAX_TAG_SIZE 480 + #define POOL_ENTRY_SIZE 512 + ++static DEFINE_SPINLOCK(dm_crypt_clients_lock); ++static unsigned dm_crypt_clients_n = 0; ++static volatile unsigned long dm_crypt_pages_per_client; ++#define DM_CRYPT_MEMORY_PERCENT 2 ++#define DM_CRYPT_MIN_PAGES_PER_CLIENT (BIO_MAX_PAGES * 16) ++ + static void clone_init(struct dm_crypt_io *, struct bio *); + static void kcryptd_queue_crypt(struct dm_crypt_io *io); + static struct scatterlist *crypt_get_sg_data(struct crypt_config *cc, +@@ -2156,6 +2164,43 @@ static int crypt_wipe_key(struct crypt_config *cc) + return r; + } + ++static void crypt_calculate_pages_per_client(void) ++{ ++ unsigned long pages = (totalram_pages - totalhigh_pages) * DM_CRYPT_MEMORY_PERCENT / 100; ++ ++ if (!dm_crypt_clients_n) ++ return; ++ ++ pages /= dm_crypt_clients_n; ++ if (pages < DM_CRYPT_MIN_PAGES_PER_CLIENT) ++ pages = DM_CRYPT_MIN_PAGES_PER_CLIENT; ++ dm_crypt_pages_per_client = pages; ++} ++ ++static void *crypt_page_alloc(gfp_t gfp_mask, void *pool_data) ++{ ++ struct crypt_config *cc = pool_data; ++ struct page *page; ++ ++ if (unlikely(percpu_counter_compare(&cc->n_allocated_pages, dm_crypt_pages_per_client) >= 0) && ++ likely(gfp_mask & __GFP_NORETRY)) ++ return NULL; ++ ++ page = alloc_page(gfp_mask); ++ if (likely(page != NULL)) ++ percpu_counter_add(&cc->n_allocated_pages, 1); ++ ++ return page; ++} ++ ++static void crypt_page_free(void *page, void *pool_data) ++{ ++ struct crypt_config *cc = pool_data; ++ ++ __free_page(page); ++ percpu_counter_sub(&cc->n_allocated_pages, 1); ++} ++ + static void crypt_dtr(struct dm_target *ti) + { + struct crypt_config *cc = ti->private; +@@ -2182,6 +2227,10 @@ static void crypt_dtr(struct dm_target *ti) + mempool_destroy(cc->req_pool); + mempool_destroy(cc->tag_pool); + ++ if (cc->page_pool) ++ WARN_ON(percpu_counter_sum(&cc->n_allocated_pages) != 0); ++ percpu_counter_destroy(&cc->n_allocated_pages); ++ + if (cc->iv_gen_ops && cc->iv_gen_ops->dtr) + cc->iv_gen_ops->dtr(cc); + +@@ -2196,6 +2245,12 @@ static void crypt_dtr(struct dm_target *ti) + + /* Must zero key material before freeing */ + kzfree(cc); ++ ++ spin_lock(&dm_crypt_clients_lock); ++ WARN_ON(!dm_crypt_clients_n); ++ dm_crypt_clients_n--; ++ crypt_calculate_pages_per_client(); ++ spin_unlock(&dm_crypt_clients_lock); + } + + static int crypt_ctr_ivmode(struct dm_target *ti, const char *ivmode) +@@ -2643,6 +2698,15 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + ti->private = cc; + ++ spin_lock(&dm_crypt_clients_lock); ++ dm_crypt_clients_n++; ++ crypt_calculate_pages_per_client(); ++ spin_unlock(&dm_crypt_clients_lock); ++ ++ ret = percpu_counter_init(&cc->n_allocated_pages, 0, GFP_KERNEL); ++ if (ret < 0) ++ goto bad; ++ + /* Optional parameters need to be read before cipher constructor */ + if (argc > 5) { + ret = crypt_ctr_optional(ti, argc - 5, &argv[5]); +@@ -2697,7 +2761,7 @@ static int crypt_ctr(struct dm_target *ti, unsigned int argc, char **argv) + ALIGN(sizeof(struct dm_crypt_io) + cc->dmreq_start + additional_req_size, + ARCH_KMALLOC_MINALIGN); + +- cc->page_pool = mempool_create_page_pool(BIO_MAX_PAGES, 0); ++ cc->page_pool = mempool_create(BIO_MAX_PAGES, crypt_page_alloc, crypt_page_free, cc); + if (!cc->page_pool) { + ti->error = "Cannot allocate page mempool"; + goto bad; +diff --git a/drivers/media/platform/vivid/vivid-vid-common.c b/drivers/media/platform/vivid/vivid-vid-common.c +index f0f423c7ca41..6f6d4df1e8a8 100644 +--- a/drivers/media/platform/vivid/vivid-vid-common.c ++++ b/drivers/media/platform/vivid/vivid-vid-common.c +@@ -858,7 +858,8 @@ int vidioc_g_edid(struct file *file, void *_fh, + return -EINVAL; + if (edid->start_block + edid->blocks > dev->edid_blocks) + edid->blocks = dev->edid_blocks - edid->start_block; +- cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr); ++ if (adap) ++ cec_set_edid_phys_addr(dev->edid, dev->edid_blocks * 128, adap->phys_addr); + memcpy(edid->edid, dev->edid + edid->start_block * 128, edid->blocks * 128); + return 0; + } +diff --git a/drivers/media/platform/vsp1/vsp1_wpf.c b/drivers/media/platform/vsp1/vsp1_wpf.c +index f7f3b4b2c2de..8bd6b2f1af15 100644 +--- a/drivers/media/platform/vsp1/vsp1_wpf.c ++++ b/drivers/media/platform/vsp1/vsp1_wpf.c +@@ -452,7 +452,7 @@ static void wpf_configure(struct vsp1_entity *entity, + : VI6_WPF_SRCRPF_RPF_ACT_SUB(input->entity.index); + } + +- if (pipe->bru || pipe->num_inputs > 1) ++ if (pipe->bru) + srcrpf |= pipe->bru->type == VSP1_ENTITY_BRU + ? VI6_WPF_SRCRPF_VIRACT_MST + : VI6_WPF_SRCRPF_VIRACT2_MST; +diff --git a/drivers/misc/cxl/cxllib.c b/drivers/misc/cxl/cxllib.c +index dc9bc1807fdf..562a6803d690 100644 +--- a/drivers/misc/cxl/cxllib.c ++++ b/drivers/misc/cxl/cxllib.c +@@ -207,49 +207,74 @@ int cxllib_get_PE_attributes(struct task_struct *task, + } + EXPORT_SYMBOL_GPL(cxllib_get_PE_attributes); + +-int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags) ++static int get_vma_info(struct mm_struct *mm, u64 addr, ++ u64 *vma_start, u64 *vma_end, ++ unsigned long *page_size) + { +- int rc; +- u64 dar; + struct vm_area_struct *vma = NULL; +- unsigned long page_size; +- +- if (mm == NULL) +- return -EFAULT; ++ int rc = 0; + + down_read(&mm->mmap_sem); + + vma = find_vma(mm, addr); + if (!vma) { +- pr_err("Can't find vma for addr %016llx\n", addr); + rc = -EFAULT; + goto out; + } +- /* get the size of the pages allocated */ +- page_size = vma_kernel_pagesize(vma); +- +- for (dar = (addr & ~(page_size - 1)); dar < (addr + size); dar += page_size) { +- if (dar < vma->vm_start || dar >= vma->vm_end) { +- vma = find_vma(mm, addr); +- if (!vma) { +- pr_err("Can't find vma for addr %016llx\n", addr); +- rc = -EFAULT; +- goto out; +- } +- /* get the size of the pages allocated */ +- page_size = vma_kernel_pagesize(vma); ++ *page_size = vma_kernel_pagesize(vma); ++ *vma_start = vma->vm_start; ++ *vma_end = vma->vm_end; ++out: ++ up_read(&mm->mmap_sem); ++ return rc; ++} ++ ++int cxllib_handle_fault(struct mm_struct *mm, u64 addr, u64 size, u64 flags) ++{ ++ int rc; ++ u64 dar, vma_start, vma_end; ++ unsigned long page_size; ++ ++ if (mm == NULL) ++ return -EFAULT; ++ ++ /* ++ * The buffer we have to process can extend over several pages ++ * and may also cover several VMAs. ++ * We iterate over all the pages. The page size could vary ++ * between VMAs. ++ */ ++ rc = get_vma_info(mm, addr, &vma_start, &vma_end, &page_size); ++ if (rc) ++ return rc; ++ ++ for (dar = (addr & ~(page_size - 1)); dar < (addr + size); ++ dar += page_size) { ++ if (dar < vma_start || dar >= vma_end) { ++ /* ++ * We don't hold the mm->mmap_sem semaphore ++ * while iterating, since the semaphore is ++ * required by one of the lower-level page ++ * fault processing functions and it could ++ * create a deadlock. ++ * ++ * It means the VMAs can be altered between 2 ++ * loop iterations and we could theoretically ++ * miss a page (however unlikely). But that's ++ * not really a problem, as the driver will ++ * retry access, get another page fault on the ++ * missing page and call us again. ++ */ ++ rc = get_vma_info(mm, dar, &vma_start, &vma_end, ++ &page_size); ++ if (rc) ++ return rc; + } + + rc = cxl_handle_mm_fault(mm, flags, dar); +- if (rc) { +- pr_err("cxl_handle_mm_fault failed %d", rc); +- rc = -EFAULT; +- goto out; +- } ++ if (rc) ++ return -EFAULT; + } +- rc = 0; +-out: +- up_read(&mm->mmap_sem); +- return rc; ++ return 0; + } + EXPORT_SYMBOL_GPL(cxllib_handle_fault); +diff --git a/drivers/mmc/host/jz4740_mmc.c b/drivers/mmc/host/jz4740_mmc.c +index 7db8c7a8d38d..48b67f552afe 100644 +--- a/drivers/mmc/host/jz4740_mmc.c ++++ b/drivers/mmc/host/jz4740_mmc.c +@@ -362,9 +362,9 @@ static void jz4740_mmc_set_irq_enabled(struct jz4740_mmc_host *host, + host->irq_mask &= ~irq; + else + host->irq_mask |= irq; +- spin_unlock_irqrestore(&host->lock, flags); + + writew(host->irq_mask, host->base + JZ_REG_MMC_IMASK); ++ spin_unlock_irqrestore(&host->lock, flags); + } + + static void jz4740_mmc_clock_enable(struct jz4740_mmc_host *host, +diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c +index 5bedf4b7f0f7..44da037b13ba 100644 +--- a/drivers/mmc/host/sdhci-pci-core.c ++++ b/drivers/mmc/host/sdhci-pci-core.c +@@ -1192,7 +1192,7 @@ static void amd_enable_manual_tuning(struct pci_dev *pdev) + pci_write_config_dword(pdev, AMD_SD_MISC_CONTROL, val); + } + +-static int amd_execute_tuning(struct sdhci_host *host, u32 opcode) ++static int amd_execute_tuning_hs200(struct sdhci_host *host, u32 opcode) + { + struct sdhci_pci_slot *slot = sdhci_priv(host); + struct pci_dev *pdev = slot->chip->pdev; +@@ -1231,6 +1231,27 @@ static int amd_execute_tuning(struct sdhci_host *host, u32 opcode) + return 0; + } + ++static int amd_execute_tuning(struct mmc_host *mmc, u32 opcode) ++{ ++ struct sdhci_host *host = mmc_priv(mmc); ++ ++ /* AMD requires custom HS200 tuning */ ++ if (host->timing == MMC_TIMING_MMC_HS200) ++ return amd_execute_tuning_hs200(host, opcode); ++ ++ /* Otherwise perform standard SDHCI tuning */ ++ return sdhci_execute_tuning(mmc, opcode); ++} ++ ++static int amd_probe_slot(struct sdhci_pci_slot *slot) ++{ ++ struct mmc_host_ops *ops = &slot->host->mmc_host_ops; ++ ++ ops->execute_tuning = amd_execute_tuning; ++ ++ return 0; ++} ++ + static int amd_probe(struct sdhci_pci_chip *chip) + { + struct pci_dev *smbus_dev; +@@ -1265,12 +1286,12 @@ static const struct sdhci_ops amd_sdhci_pci_ops = { + .set_bus_width = sdhci_set_bus_width, + .reset = sdhci_reset, + .set_uhs_signaling = sdhci_set_uhs_signaling, +- .platform_execute_tuning = amd_execute_tuning, + }; + + static const struct sdhci_pci_fixes sdhci_amd = { + .probe = amd_probe, + .ops = &amd_sdhci_pci_ops, ++ .probe_slot = amd_probe_slot, + }; + + static const struct pci_device_id pci_ids[] = { +diff --git a/drivers/mmc/host/tmio_mmc_core.c b/drivers/mmc/host/tmio_mmc_core.c +index 3a6d49f07e22..de1562f27fdb 100644 +--- a/drivers/mmc/host/tmio_mmc_core.c ++++ b/drivers/mmc/host/tmio_mmc_core.c +@@ -911,7 +911,7 @@ static void tmio_mmc_finish_request(struct tmio_mmc_host *host) + host->check_scc_error(host); + + /* If SET_BLOCK_COUNT, continue with main command */ +- if (host->mrq) { ++ if (host->mrq && !mrq->cmd->error) { + tmio_process_mrq(host, mrq); + return; + } +diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c +index b1fc28f63882..d0b63bbf46a7 100644 +--- a/drivers/mtd/ubi/block.c ++++ b/drivers/mtd/ubi/block.c +@@ -244,7 +244,7 @@ static int ubiblock_open(struct block_device *bdev, fmode_t mode) + * in any case. + */ + if (mode & FMODE_WRITE) { +- ret = -EPERM; ++ ret = -EROFS; + goto out_unlock; + } + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index 842550b5712a..defb1cd8d2e1 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -845,6 +845,17 @@ int ubi_attach_mtd_dev(struct mtd_info *mtd, int ubi_num, + return -EINVAL; + } + ++ /* ++ * Both UBI and UBIFS have been designed for SLC NAND and NOR flashes. ++ * MLC NAND is different and needs special care, otherwise UBI or UBIFS ++ * will die soon and you will lose all your data. ++ */ ++ if (mtd->type == MTD_MLCNANDFLASH) { ++ pr_err("ubi: refuse attaching mtd%d - MLC NAND is not supported\n", ++ mtd->index); ++ return -EINVAL; ++ } ++ + if (ubi_num == UBI_DEV_NUM_AUTO) { + /* Search for an empty slot in the @ubi_devices array */ + for (ubi_num = 0; ubi_num < UBI_MAX_DEVICES; ubi_num++) +diff --git a/drivers/mtd/ubi/fastmap-wl.c b/drivers/mtd/ubi/fastmap-wl.c +index 4f0bd6b4422a..69dd21679a30 100644 +--- a/drivers/mtd/ubi/fastmap-wl.c ++++ b/drivers/mtd/ubi/fastmap-wl.c +@@ -362,7 +362,6 @@ static void ubi_fastmap_close(struct ubi_device *ubi) + { + int i; + +- flush_work(&ubi->fm_work); + return_unused_pool_pebs(ubi, &ubi->fm_pool); + return_unused_pool_pebs(ubi, &ubi->fm_wl_pool); + +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c +index c8e7b54a538a..73da5e63a609 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c +@@ -53,6 +53,7 @@ + #include + #include "iwl-config.h" + #include "iwl-agn-hw.h" ++#include "fw/file.h" + + /* Highest firmware API version supported */ + #define IWL9000_UCODE_API_MAX 34 +@@ -264,6 +265,67 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { + .integrated = true, + .soc_latency = 5000, + }; ++ ++const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { ++ .name = "Intel(R) Dual Band Wireless AC 9460", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ ++const struct iwl_cfg iwl9461_2ac_cfg_shared_clk = { ++ .name = "Intel(R) Dual Band Wireless AC 9461", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ ++const struct iwl_cfg iwl9462_2ac_cfg_shared_clk = { ++ .name = "Intel(R) Dual Band Wireless AC 9462", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ ++const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { ++ .name = "Intel(R) Dual Band Wireless AC 9560", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ + MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/file.h b/drivers/net/wireless/intel/iwlwifi/fw/file.h +index e988e4c371c4..1b3ad8ef0c79 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/file.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/file.h +@@ -434,6 +434,7 @@ enum iwl_fw_phy_cfg { + FW_PHY_CFG_TX_CHAIN = 0xf << FW_PHY_CFG_TX_CHAIN_POS, + FW_PHY_CFG_RX_CHAIN_POS = 20, + FW_PHY_CFG_RX_CHAIN = 0xf << FW_PHY_CFG_RX_CHAIN_POS, ++ FW_PHY_CFG_SHARED_CLK = BIT(31), + }; + + #define IWL_UCODE_MAX_CS 1 +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index e226179c32fa..85fe1a928adc 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -394,6 +394,7 @@ struct iwl_cfg { + u8 max_vht_ampdu_exponent; + u8 ucode_api_max; + u8 ucode_api_min; ++ u32 extra_phy_cfg_flags; + }; + + /* +@@ -476,6 +477,10 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc; + extern const struct iwl_cfg iwl9461_2ac_cfg_soc; + extern const struct iwl_cfg iwl9462_2ac_cfg_soc; + extern const struct iwl_cfg iwl9560_2ac_cfg_soc; ++extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk; ++extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk; ++extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk; ++extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk; + extern const struct iwl_cfg iwla000_2ac_cfg_hr; + extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb; + extern const struct iwl_cfg iwla000_2ac_cfg_jf; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +index 83485493a79a..b71a9d11a50f 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/fw.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/fw.c +@@ -435,6 +435,10 @@ static int iwl_send_phy_cfg_cmd(struct iwl_mvm *mvm) + + /* Set parameters */ + phy_cfg_cmd.phy_cfg = cpu_to_le32(iwl_mvm_get_phy_config(mvm)); ++ ++ /* set flags extra PHY configuration flags from the device's cfg */ ++ phy_cfg_cmd.phy_cfg |= cpu_to_le32(mvm->cfg->extra_phy_cfg_flags); ++ + phy_cfg_cmd.calib_control.event_trigger = + mvm->fw->default_calib[ucode_type].event_trigger; + phy_cfg_cmd.calib_control.flow_trigger = +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 0f7bd37bf172..9a8605abb00a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2007 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016-2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -36,6 +37,7 @@ + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * All rights reserved. + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions +@@ -515,9 +517,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x24FD, 0x9074, iwl8265_2ac_cfg)}, + + /* 9000 Series */ +- {IWL_PCI_DEVICE(0x2526, 0x0000, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0014, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x0018, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0030, iwl9560_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0034, iwl9560_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x0038, iwl9560_2ac_cfg)}, +@@ -542,11 +544,15 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x4010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x4030, iwl9560_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)}, +- {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0210, iwl9160_2ac_cfg)}, +@@ -567,38 +573,146 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2720, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x003C, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0060, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0064, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x00A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x023C, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0260, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x02A4, iwl9462_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0064, iwl9461_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x00A0, iwl9462_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x00A4, iwl9462_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0230, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0234, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0238, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x023C, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0260, iwl9461_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_soc)}, +- {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0034, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0038, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x003C, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0060, iwl9460_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0064, iwl9461_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x00A0, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x00A4, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0230, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0234, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0238, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x023C, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0260, iwl9461_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x0264, iwl9461_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x02A0, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x02A4, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x4034, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x40A4, iwl9462_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x4234, iwl9560_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x42A4, iwl9462_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x34F0, 0x0030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x42A4, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0000, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0010, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0030, iwl9560_2ac_cfg_soc)}, +@@ -624,11 +738,44 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x9DF0, 0x0610, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0710, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x0A10, iwl9460_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2A10, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x4030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0038, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x003C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0060, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0064, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x00A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x00A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0230, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0238, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x023C, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0260, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x0264, iwl9461_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x02A0, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4034, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x42A4, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x0038, iwl9560_2ac_cfg_soc)}, +@@ -645,10 +792,16 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0xA370, 0x0264, iwl9461_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x02A0, iwl9462_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x02A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x4034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x40A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x4234, iwl9560_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x42A4, iwl9462_2ac_cfg_soc)}, + + /* a000 Series */ + {IWL_PCI_DEVICE(0x2720, 0x0A10, iwla000_2ac_cfg_hr_cdb)}, +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index c980cdbd6e53..a9ba9fe263ca 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -2008,7 +2008,10 @@ static void netback_changed(struct xenbus_device *dev, + case XenbusStateInitialised: + case XenbusStateReconfiguring: + case XenbusStateReconfigured: ++ break; ++ + case XenbusStateUnknown: ++ wake_up_all(&module_unload_q); + break; + + case XenbusStateInitWait: +@@ -2139,7 +2142,9 @@ static int xennet_remove(struct xenbus_device *dev) + xenbus_switch_state(dev, XenbusStateClosing); + wait_event(module_unload_q, + xenbus_read_driver_state(dev->otherend) == +- XenbusStateClosing); ++ XenbusStateClosing || ++ xenbus_read_driver_state(dev->otherend) == ++ XenbusStateUnknown); + + xenbus_switch_state(dev, XenbusStateClosed); + wait_event(module_unload_q, +diff --git a/drivers/nvdimm/dimm.c b/drivers/nvdimm/dimm.c +index 98466d762c8f..0939f064054d 100644 +--- a/drivers/nvdimm/dimm.c ++++ b/drivers/nvdimm/dimm.c +@@ -65,9 +65,11 @@ static int nvdimm_probe(struct device *dev) + ndd->ns_next = nd_label_next_nsindex(ndd->ns_current); + nd_label_copy(ndd, to_next_namespace_index(ndd), + to_current_namespace_index(ndd)); +- rc = nd_label_reserve_dpa(ndd); +- if (ndd->ns_current >= 0) +- nvdimm_set_aliasing(dev); ++ if (ndd->ns_current >= 0) { ++ rc = nd_label_reserve_dpa(ndd); ++ if (rc == 0) ++ nvdimm_set_aliasing(dev); ++ } + nvdimm_clear_locked(dev); + nvdimm_bus_unlock(dev); + +diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c +index 0af988739a06..228bafa4d322 100644 +--- a/drivers/nvdimm/namespace_devs.c ++++ b/drivers/nvdimm/namespace_devs.c +@@ -1926,7 +1926,7 @@ struct device *create_namespace_pmem(struct nd_region *nd_region, + } + + if (i < nd_region->ndr_mappings) { +- struct nvdimm_drvdata *ndd = to_ndd(&nd_region->mapping[i]); ++ struct nvdimm *nvdimm = nd_region->mapping[i].nvdimm; + + /* + * Give up if we don't find an instance of a uuid at each +@@ -1934,7 +1934,7 @@ struct device *create_namespace_pmem(struct nd_region *nd_region, + * find a dimm with two instances of the same uuid. + */ + dev_err(&nd_region->dev, "%s missing label for %pUb\n", +- dev_name(ndd->dev), nd_label->uuid); ++ nvdimm_name(nvdimm), nd_label->uuid); + rc = -EINVAL; + goto err; + } +diff --git a/drivers/pci/hotplug/acpiphp_glue.c b/drivers/pci/hotplug/acpiphp_glue.c +index 5ed2dcaa8e27..711875afdd70 100644 +--- a/drivers/pci/hotplug/acpiphp_glue.c ++++ b/drivers/pci/hotplug/acpiphp_glue.c +@@ -558,6 +558,7 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot) + { + unsigned long long sta = 0; + struct acpiphp_func *func; ++ u32 dvid; + + list_for_each_entry(func, &slot->funcs, sibling) { + if (func->flags & FUNC_HAS_STA) { +@@ -568,19 +569,27 @@ static unsigned int get_slot_status(struct acpiphp_slot *slot) + if (ACPI_SUCCESS(status) && sta) + break; + } else { +- u32 dvid; +- +- pci_bus_read_config_dword(slot->bus, +- PCI_DEVFN(slot->device, +- func->function), +- PCI_VENDOR_ID, &dvid); +- if (dvid != 0xffffffff) { ++ if (pci_bus_read_dev_vendor_id(slot->bus, ++ PCI_DEVFN(slot->device, func->function), ++ &dvid, 0)) { + sta = ACPI_STA_ALL; + break; + } + } + } + ++ if (!sta) { ++ /* ++ * Check for the slot itself since it may be that the ++ * ACPI slot is a device below PCIe upstream port so in ++ * that case it may not even be reachable yet. ++ */ ++ if (pci_bus_read_dev_vendor_id(slot->bus, ++ PCI_DEVFN(slot->device, 0), &dvid, 0)) { ++ sta = ACPI_STA_ALL; ++ } ++ } ++ + return (unsigned int)sta; + } + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 05fadcc4f9d2..5c5a8af66829 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4806,9 +4806,13 @@ static void quirk_no_ext_tags(struct pci_dev *pdev) + + pci_walk_bus(bridge->bus, pci_configure_extended_tags, NULL); + } ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0132, quirk_no_ext_tags); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0140, quirk_no_ext_tags); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0141, quirk_no_ext_tags); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0142, quirk_no_ext_tags); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0144, quirk_no_ext_tags); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0420, quirk_no_ext_tags); ++DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, 0x0422, quirk_no_ext_tags); + + #ifdef CONFIG_PCI_ATS + /* +diff --git a/drivers/phy/allwinner/phy-sun4i-usb.c b/drivers/phy/allwinner/phy-sun4i-usb.c +index 1161e11fb3cf..afedb8cd1990 100644 +--- a/drivers/phy/allwinner/phy-sun4i-usb.c ++++ b/drivers/phy/allwinner/phy-sun4i-usb.c +@@ -410,11 +410,13 @@ static bool sun4i_usb_phy0_poll(struct sun4i_usb_phy_data *data) + return true; + + /* +- * The A31 companion pmic (axp221) does not generate vbus change +- * interrupts when the board is driving vbus, so we must poll ++ * The A31/A23/A33 companion pmics (AXP221/AXP223) do not ++ * generate vbus change interrupts when the board is driving ++ * vbus using the N_VBUSEN pin on the pmic, so we must poll + * when using the pmic for vbus-det _and_ we're driving vbus. + */ +- if (data->cfg->type == sun6i_a31_phy && ++ if ((data->cfg->type == sun6i_a31_phy || ++ data->cfg->type == sun8i_a33_phy) && + data->vbus_power_supply && data->phys[0].regulator_on) + return true; + +@@ -885,7 +887,7 @@ static const struct sun4i_usb_phy_cfg sun7i_a20_cfg = { + + static const struct sun4i_usb_phy_cfg sun8i_a23_cfg = { + .num_phys = 2, +- .type = sun4i_a10_phy, ++ .type = sun6i_a31_phy, + .disc_thresh = 3, + .phyctl_offset = REG_PHYCTL_A10, + .dedicated_clocks = true, +diff --git a/drivers/pwm/pwm-rcar.c b/drivers/pwm/pwm-rcar.c +index 1c85ecc9e7ac..0fcf94ffad32 100644 +--- a/drivers/pwm/pwm-rcar.c ++++ b/drivers/pwm/pwm-rcar.c +@@ -156,8 +156,12 @@ static int rcar_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, + if (div < 0) + return div; + +- /* Let the core driver set pwm->period if disabled and duty_ns == 0 */ +- if (!pwm_is_enabled(pwm) && !duty_ns) ++ /* ++ * Let the core driver set pwm->period if disabled and duty_ns == 0. ++ * But, this driver should prevent to set the new duty_ns if current ++ * duty_cycle is not set ++ */ ++ if (!pwm_is_enabled(pwm) && !duty_ns && !pwm->state.duty_cycle) + return 0; + + rcar_pwm_update(rp, RCAR_PWMCR_SYNC, RCAR_PWMCR_SYNC, RCAR_PWMCR); +diff --git a/drivers/soc/mediatek/mtk-scpsys.c b/drivers/soc/mediatek/mtk-scpsys.c +index e1ce8b1b5090..fb2a8b1e7979 100644 +--- a/drivers/soc/mediatek/mtk-scpsys.c ++++ b/drivers/soc/mediatek/mtk-scpsys.c +@@ -892,7 +892,7 @@ static int scpsys_probe(struct platform_device *pdev) + + pd_data = &scp->pd_data; + +- for (i = 0, sd = soc->subdomains ; i < soc->num_subdomains ; i++) { ++ for (i = 0, sd = soc->subdomains; i < soc->num_subdomains; i++, sd++) { + ret = pm_genpd_add_subdomain(pd_data->domains[sd->origin], + pd_data->domains[sd->subdomain]); + if (ret && IS_ENABLED(CONFIG_PM)) +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 669470971023..047875861df1 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1489,6 +1489,11 @@ static void atmel_spi_init(struct atmel_spi *as) + { + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ ++ ++ /* It is recommended to enable FIFOs first thing after reset */ ++ if (as->fifo_size) ++ spi_writel(as, CR, SPI_BIT(FIFOEN)); ++ + if (as->caps.has_wdrbt) { + spi_writel(as, MR, SPI_BIT(WDRBT) | SPI_BIT(MODFDIS) + | SPI_BIT(MSTR)); +@@ -1499,9 +1504,6 @@ static void atmel_spi_init(struct atmel_spi *as) + if (as->use_pdc) + spi_writel(as, PTCR, SPI_BIT(RXTDIS) | SPI_BIT(TXTDIS)); + spi_writel(as, CR, SPI_BIT(SPIEN)); +- +- if (as->fifo_size) +- spi_writel(as, CR, SPI_BIT(FIFOEN)); + } + + static int atmel_spi_probe(struct platform_device *pdev) +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 3ff0ee88c467..84dfef4bd6ae 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -779,8 +779,14 @@ static int spi_map_buf(struct spi_controller *ctlr, struct device *dev, + for (i = 0; i < sgs; i++) { + + if (vmalloced_buf || kmap_buf) { +- min = min_t(size_t, +- len, desc_len - offset_in_page(buf)); ++ /* ++ * Next scatterlist entry size is the minimum between ++ * the desc_len and the remaining buffer length that ++ * fits in a page. ++ */ ++ min = min_t(size_t, desc_len, ++ min_t(size_t, len, ++ PAGE_SIZE - offset_in_page(buf))); + if (vmalloced_buf) + vm_page = vmalloc_to_page(buf); + else +@@ -2252,12 +2258,6 @@ void spi_unregister_controller(struct spi_controller *ctlr) + mutex_lock(&board_lock); + found = idr_find(&spi_master_idr, id); + mutex_unlock(&board_lock); +- if (found != ctlr) { +- dev_dbg(&ctlr->dev, +- "attempting to delete unregistered controller [%s]\n", +- dev_name(&ctlr->dev)); +- return; +- } + if (ctlr->queued) { + if (spi_destroy_queue(ctlr)) + dev_err(&ctlr->dev, "queue remove failed\n"); +@@ -2270,7 +2270,8 @@ void spi_unregister_controller(struct spi_controller *ctlr) + device_unregister(&ctlr->dev); + /* free bus id */ + mutex_lock(&board_lock); +- idr_remove(&spi_master_idr, id); ++ if (found == ctlr) ++ idr_remove(&spi_master_idr, id); + mutex_unlock(&board_lock); + } + EXPORT_SYMBOL_GPL(spi_unregister_controller); +diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c +index d8cfed358d55..f1d8cc5a2730 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c ++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_fops.c +@@ -1285,7 +1285,10 @@ const struct v4l2_file_operations atomisp_fops = { + .mmap = atomisp_mmap, + .unlocked_ioctl = video_ioctl2, + #ifdef CONFIG_COMPAT ++ /* ++ * There are problems with this code. Disable this for now. + .compat_ioctl32 = atomisp_compat_ioctl32, ++ */ + #endif + .poll = atomisp_poll, + }; +@@ -1297,7 +1300,10 @@ const struct v4l2_file_operations atomisp_file_fops = { + .mmap = atomisp_file_mmap, + .unlocked_ioctl = video_ioctl2, + #ifdef CONFIG_COMPAT ++ /* ++ * There are problems with this code. Disable this for now. + .compat_ioctl32 = atomisp_compat_ioctl32, ++ */ + #endif + .poll = atomisp_poll, + }; +diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c +index 71af13bd0ebd..e35e1b2160e3 100644 +--- a/drivers/staging/media/lirc/lirc_zilog.c ++++ b/drivers/staging/media/lirc/lirc_zilog.c +@@ -288,7 +288,7 @@ static void release_ir_tx(struct kref *ref) + struct IR_tx *tx = container_of(ref, struct IR_tx, ref); + struct IR *ir = tx->ir; + +- ir->l.features &= ~LIRC_CAN_SEND_LIRCCODE; ++ ir->l.features &= ~LIRC_CAN_SEND_PULSE; + /* Don't put_ir_device(tx->ir) here, so our lock doesn't get freed */ + ir->tx = NULL; + kfree(tx); +@@ -1228,6 +1228,7 @@ static unsigned int poll(struct file *filep, poll_table *wait) + + dev_dbg(ir->l.dev, "%s result = %s\n", __func__, + ret ? "POLLIN|POLLRDNORM" : "none"); ++ put_ir_rx(rx, false); + return ret; + } + +@@ -1267,14 +1268,14 @@ static long ioctl(struct file *filep, unsigned int cmd, unsigned long arg) + if (!(features & LIRC_CAN_SEND_MASK)) + return -ENOTTY; + +- result = put_user(LIRC_MODE_LIRCCODE, uptr); ++ result = put_user(LIRC_MODE_PULSE, uptr); + break; + case LIRC_SET_SEND_MODE: + if (!(features & LIRC_CAN_SEND_MASK)) + return -ENOTTY; + + result = get_user(mode, uptr); +- if (!result && mode != LIRC_MODE_LIRCCODE) ++ if (!result && mode != LIRC_MODE_PULSE) + return -EINVAL; + break; + default: +@@ -1512,7 +1513,7 @@ static int ir_probe(struct i2c_client *client, const struct i2c_device_id *id) + kref_init(&tx->ref); + ir->tx = tx; + +- ir->l.features |= LIRC_CAN_SEND_LIRCCODE; ++ ir->l.features |= LIRC_CAN_SEND_PULSE; + mutex_init(&tx->client_lock); + tx->c = client; + tx->need_boot = 1; +diff --git a/drivers/thermal/imx_thermal.c b/drivers/thermal/imx_thermal.c +index 4798b4b1fd77..41c6154ae856 100644 +--- a/drivers/thermal/imx_thermal.c ++++ b/drivers/thermal/imx_thermal.c +@@ -601,6 +601,9 @@ static int imx_thermal_probe(struct platform_device *pdev) + regmap_write(map, TEMPSENSE0 + REG_CLR, TEMPSENSE0_POWER_DOWN); + regmap_write(map, TEMPSENSE0 + REG_SET, TEMPSENSE0_MEASURE_TEMP); + ++ data->irq_enabled = true; ++ data->mode = THERMAL_DEVICE_ENABLED; ++ + ret = devm_request_threaded_irq(&pdev->dev, data->irq, + imx_thermal_alarm_irq, imx_thermal_alarm_irq_thread, + 0, "imx_thermal", data); +@@ -613,9 +616,6 @@ static int imx_thermal_probe(struct platform_device *pdev) + return ret; + } + +- data->irq_enabled = true; +- data->mode = THERMAL_DEVICE_ENABLED; +- + return 0; + } + +diff --git a/drivers/thunderbolt/icm.c b/drivers/thunderbolt/icm.c +index 53250fc057e1..91830b1bdcaf 100644 +--- a/drivers/thunderbolt/icm.c ++++ b/drivers/thunderbolt/icm.c +@@ -539,14 +539,14 @@ static bool icm_ar_is_supported(struct tb *tb) + static int icm_ar_get_mode(struct tb *tb) + { + struct tb_nhi *nhi = tb->nhi; +- int retries = 5; ++ int retries = 60; + u32 val; + + do { + val = ioread32(nhi->iobase + REG_FW_STS); + if (val & REG_FW_STS_NVM_AUTH_DONE) + break; +- msleep(30); ++ msleep(50); + } while (--retries); + + if (!retries) { +@@ -720,6 +720,9 @@ static int icm_firmware_reset(struct tb *tb, struct tb_nhi *nhi) + struct icm *icm = tb_priv(tb); + u32 val; + ++ if (!icm->upstream_port) ++ return -ENODEV; ++ + /* Put ARC to wait for CIO reset event to happen */ + val = ioread32(nhi->iobase + REG_FW_STS); + val |= REG_FW_STS_CIO_RESET_REQ; +@@ -859,6 +862,9 @@ static int icm_firmware_init(struct tb *tb) + break; + + default: ++ if (ret < 0) ++ return ret; ++ + tb_err(tb, "ICM firmware is in wrong mode: %u\n", ret); + return -ENODEV; + } +diff --git a/drivers/thunderbolt/nhi.c b/drivers/thunderbolt/nhi.c +index 05af126a2435..16c607075ede 100644 +--- a/drivers/thunderbolt/nhi.c ++++ b/drivers/thunderbolt/nhi.c +@@ -846,6 +846,7 @@ static const struct dev_pm_ops nhi_pm_ops = { + * we just disable hotplug, the + * pci-tunnels stay alive. + */ ++ .thaw_noirq = nhi_resume_noirq, + .restore_noirq = nhi_resume_noirq, + .suspend = nhi_suspend, + .freeze = nhi_suspend, +diff --git a/drivers/thunderbolt/switch.c b/drivers/thunderbolt/switch.c +index 3953d17202a8..8bd137109980 100644 +--- a/drivers/thunderbolt/switch.c ++++ b/drivers/thunderbolt/switch.c +@@ -716,6 +716,13 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val) + if (sw->authorized) + goto unlock; + ++ /* ++ * Make sure there is no PCIe rescan ongoing when a new PCIe ++ * tunnel is created. Otherwise the PCIe rescan code might find ++ * the new tunnel too early. ++ */ ++ pci_lock_rescan_remove(); ++ + switch (val) { + /* Approve switch */ + case 1: +@@ -735,6 +742,8 @@ static int tb_switch_set_authorized(struct tb_switch *sw, unsigned int val) + break; + } + ++ pci_unlock_rescan_remove(); ++ + if (!ret) { + sw->authorized = val; + /* Notify status change to the userspace */ +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index faf50df81622..1c70541a1467 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -2182,6 +2182,12 @@ static ssize_t n_tty_read(struct tty_struct *tty, struct file *file, + } + if (tty_hung_up_p(file)) + break; ++ /* ++ * Abort readers for ttys which never actually ++ * get hung up. See __tty_hangup(). ++ */ ++ if (test_bit(TTY_HUPPING, &tty->flags)) ++ break; + if (!timeout) + break; + if (file->f_flags & O_NONBLOCK) { +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 7e77bd2118ad..52627478ab61 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -585,6 +585,14 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session) + return; + } + ++ /* ++ * Some console devices aren't actually hung up for technical and ++ * historical reasons, which can lead to indefinite interruptible ++ * sleep in n_tty_read(). The following explicitly tells ++ * n_tty_read() to abort readers. ++ */ ++ set_bit(TTY_HUPPING, &tty->flags); ++ + /* inuse_filps is protected by the single tty lock, + this really needs to change if we want to flush the + workqueue with the lock held */ +@@ -639,6 +647,7 @@ static void __tty_hangup(struct tty_struct *tty, int exit_session) + * from the ldisc side, which is now guaranteed. + */ + set_bit(TTY_HUPPED, &tty->flags); ++ clear_bit(TTY_HUPPING, &tty->flags); + tty_unlock(tty); + + if (f) +diff --git a/drivers/usb/core/generic.c b/drivers/usb/core/generic.c +index bd3e0c5a6db2..212289c55b6f 100644 +--- a/drivers/usb/core/generic.c ++++ b/drivers/usb/core/generic.c +@@ -210,8 +210,13 @@ static int generic_suspend(struct usb_device *udev, pm_message_t msg) + if (!udev->parent) + rc = hcd_bus_suspend(udev, msg); + +- /* Non-root devices don't need to do anything for FREEZE or PRETHAW */ +- else if (msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_PRETHAW) ++ /* ++ * Non-root USB2 devices don't need to do anything for FREEZE ++ * or PRETHAW. USB3 devices don't support global suspend and ++ * needs to be selectively suspended. ++ */ ++ else if ((msg.event == PM_EVENT_FREEZE || msg.event == PM_EVENT_PRETHAW) ++ && (udev->speed < USB_SPEED_SUPER)) + rc = 0; + else + rc = usb_port_suspend(udev, msg); +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index 3219d8157f5b..c3f3f1a89b0f 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -128,6 +128,9 @@ static void __dwc3_set_mode(struct work_struct *work) + if (dwc->dr_mode != USB_DR_MODE_OTG) + return; + ++ if (dwc->desired_dr_role == DWC3_GCTL_PRTCAP_OTG) ++ return; ++ + switch (dwc->current_dr_role) { + case DWC3_GCTL_PRTCAP_HOST: + dwc3_host_exit(dwc); +diff --git a/drivers/usb/dwc3/dwc3-pci.c b/drivers/usb/dwc3/dwc3-pci.c +index 54343fbd85ee..bc5e91d4fac8 100644 +--- a/drivers/usb/dwc3/dwc3-pci.c ++++ b/drivers/usb/dwc3/dwc3-pci.c +@@ -212,7 +212,7 @@ static int dwc3_pci_probe(struct pci_dev *pci, + ret = platform_device_add_resources(dwc->dwc3, res, ARRAY_SIZE(res)); + if (ret) { + dev_err(dev, "couldn't add resources to dwc3 device\n"); +- return ret; ++ goto err; + } + + dwc->pci = pci; +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index 0ebdb313bb00..fe75e969f5ac 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -174,18 +174,8 @@ static void dwc3_ep_inc_deq(struct dwc3_ep *dep) + dwc3_ep_inc_trb(&dep->trb_dequeue); + } + +-/** +- * dwc3_gadget_giveback - call struct usb_request's ->complete callback +- * @dep: The endpoint to whom the request belongs to +- * @req: The request we're giving back +- * @status: completion code for the request +- * +- * Must be called with controller's lock held and interrupts disabled. This +- * function will unmap @req and call its ->complete() callback to notify upper +- * layers that it has completed. +- */ +-void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, +- int status) ++void dwc3_gadget_del_and_unmap_request(struct dwc3_ep *dep, ++ struct dwc3_request *req, int status) + { + struct dwc3 *dwc = dep->dwc; + +@@ -198,18 +188,35 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, + + if (req->trb) + usb_gadget_unmap_request_by_dev(dwc->sysdev, +- &req->request, req->direction); ++ &req->request, req->direction); + + req->trb = NULL; +- + trace_dwc3_gadget_giveback(req); + ++ if (dep->number > 1) ++ pm_runtime_put(dwc->dev); ++} ++ ++/** ++ * dwc3_gadget_giveback - call struct usb_request's ->complete callback ++ * @dep: The endpoint to whom the request belongs to ++ * @req: The request we're giving back ++ * @status: completion code for the request ++ * ++ * Must be called with controller's lock held and interrupts disabled. This ++ * function will unmap @req and call its ->complete() callback to notify upper ++ * layers that it has completed. ++ */ ++void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, ++ int status) ++{ ++ struct dwc3 *dwc = dep->dwc; ++ ++ dwc3_gadget_del_and_unmap_request(dep, req, status); ++ + spin_unlock(&dwc->lock); + usb_gadget_giveback_request(&dep->endpoint, &req->request); + spin_lock(&dwc->lock); +- +- if (dep->number > 1) +- pm_runtime_put(dwc->dev); + } + + /** +@@ -1233,7 +1240,7 @@ static int __dwc3_gadget_kick_transfer(struct dwc3_ep *dep, u16 cmd_param) + if (req->trb) + memset(req->trb, 0, sizeof(struct dwc3_trb)); + dep->queued_requests--; +- dwc3_gadget_giveback(dep, req, ret); ++ dwc3_gadget_del_and_unmap_request(dep, req, ret); + return ret; + } + +diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c +index 5d3d7941d2c2..71cf552b8828 100644 +--- a/drivers/usb/gadget/function/f_midi.c ++++ b/drivers/usb/gadget/function/f_midi.c +@@ -405,7 +405,8 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt) + if (err) { + ERROR(midi, "%s: couldn't enqueue request: %d\n", + midi->out_ep->name, err); +- free_ep_req(midi->out_ep, req); ++ if (req->buf != NULL) ++ free_ep_req(midi->out_ep, req); + return err; + } + } +diff --git a/drivers/usb/gadget/u_f.h b/drivers/usb/gadget/u_f.h +index 7d53a4773d1a..2f03334c6874 100644 +--- a/drivers/usb/gadget/u_f.h ++++ b/drivers/usb/gadget/u_f.h +@@ -64,7 +64,9 @@ struct usb_request *alloc_ep_req(struct usb_ep *ep, size_t len); + /* Frees a usb_request previously allocated by alloc_ep_req() */ + static inline void free_ep_req(struct usb_ep *ep, struct usb_request *req) + { ++ WARN_ON(req->buf == NULL); + kfree(req->buf); ++ req->buf = NULL; + usb_ep_free_request(ep, req); + } + +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index 794bb4958383..5bab09294a8a 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -249,6 +249,9 @@ EXPORT_SYMBOL_GPL(usb_ep_free_request); + * arranges to poll once per interval, and the gadget driver usually will + * have queued some data to transfer at that time. + * ++ * Note that @req's ->complete() callback must never be called from ++ * within usb_ep_queue() as that can create deadlock situations. ++ * + * Returns zero, or a negative error code. Endpoints that are not enabled + * report errors; errors will also be + * reported when the usb peripheral is disconnected. +diff --git a/drivers/usb/musb/musb_gadget_ep0.c b/drivers/usb/musb/musb_gadget_ep0.c +index 844a309fe895..e85b9c2a4910 100644 +--- a/drivers/usb/musb/musb_gadget_ep0.c ++++ b/drivers/usb/musb/musb_gadget_ep0.c +@@ -114,15 +114,19 @@ static int service_tx_status_request( + } + + is_in = epnum & USB_DIR_IN; +- if (is_in) { +- epnum &= 0x0f; ++ epnum &= 0x0f; ++ if (epnum >= MUSB_C_NUM_EPS) { ++ handled = -EINVAL; ++ break; ++ } ++ ++ if (is_in) + ep = &musb->endpoints[epnum].ep_in; +- } else { ++ else + ep = &musb->endpoints[epnum].ep_out; +- } + regs = musb->endpoints[epnum].regs; + +- if (epnum >= MUSB_C_NUM_EPS || !ep->desc) { ++ if (!ep->desc) { + handled = -EINVAL; + break; + } +diff --git a/drivers/vfio/pci/vfio_pci_config.c b/drivers/vfio/pci/vfio_pci_config.c +index 91335e6de88a..115a36f6f403 100644 +--- a/drivers/vfio/pci/vfio_pci_config.c ++++ b/drivers/vfio/pci/vfio_pci_config.c +@@ -808,6 +808,7 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos, + { + __le16 *ctrl = (__le16 *)(vdev->vconfig + pos - + offset + PCI_EXP_DEVCTL); ++ int readrq = le16_to_cpu(*ctrl) & PCI_EXP_DEVCTL_READRQ; + + count = vfio_default_config_write(vdev, pos, count, perm, offset, val); + if (count < 0) +@@ -833,6 +834,27 @@ static int vfio_exp_config_write(struct vfio_pci_device *vdev, int pos, + pci_try_reset_function(vdev->pdev); + } + ++ /* ++ * MPS is virtualized to the user, writes do not change the physical ++ * register since determining a proper MPS value requires a system wide ++ * device view. The MRRS is largely independent of MPS, but since the ++ * user does not have that system-wide view, they might set a safe, but ++ * inefficiently low value. Here we allow writes through to hardware, ++ * but we set the floor to the physical device MPS setting, so that ++ * we can at least use full TLPs, as defined by the MPS value. ++ * ++ * NB, if any devices actually depend on an artificially low MRRS ++ * setting, this will need to be revisited, perhaps with a quirk ++ * though pcie_set_readrq(). ++ */ ++ if (readrq != (le16_to_cpu(*ctrl) & PCI_EXP_DEVCTL_READRQ)) { ++ readrq = 128 << ++ ((le16_to_cpu(*ctrl) & PCI_EXP_DEVCTL_READRQ) >> 12); ++ readrq = max(readrq, pcie_get_mps(vdev->pdev)); ++ ++ pcie_set_readrq(vdev->pdev, readrq); ++ } ++ + return count; + } + +@@ -851,11 +873,12 @@ static int __init init_pci_cap_exp_perm(struct perm_bits *perm) + * Allow writes to device control fields, except devctl_phantom, + * which could confuse IOMMU, MPS, which can break communication + * with other physical devices, and the ARI bit in devctl2, which +- * is set at probe time. FLR gets virtualized via our writefn. ++ * is set at probe time. FLR and MRRS get virtualized via our ++ * writefn. + */ + p_setw(perm, PCI_EXP_DEVCTL, +- PCI_EXP_DEVCTL_BCR_FLR | PCI_EXP_DEVCTL_PAYLOAD, +- ~PCI_EXP_DEVCTL_PHANTOM); ++ PCI_EXP_DEVCTL_BCR_FLR | PCI_EXP_DEVCTL_PAYLOAD | ++ PCI_EXP_DEVCTL_READRQ, ~PCI_EXP_DEVCTL_PHANTOM); + p_setw(perm, PCI_EXP_DEVCTL2, NO_VIRT, ~PCI_EXP_DEVCTL2_ARI); + return 0; + } +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c +index 8658dba21768..e682bf046e50 100644 +--- a/drivers/watchdog/f71808e_wdt.c ++++ b/drivers/watchdog/f71808e_wdt.c +@@ -496,7 +496,7 @@ static bool watchdog_is_running(void) + + is_running = (superio_inb(watchdog.sioaddr, SIO_REG_ENABLE) & BIT(0)) + && (superio_inb(watchdog.sioaddr, F71808FG_REG_WDT_CONF) +- & F71808FG_FLAG_WD_EN); ++ & BIT(F71808FG_FLAG_WD_EN)); + + superio_exit(watchdog.sioaddr); + +diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c +index 82e8f6edfb48..b12e37f27530 100644 +--- a/fs/autofs4/root.c ++++ b/fs/autofs4/root.c +@@ -749,7 +749,7 @@ static int autofs4_dir_mkdir(struct inode *dir, + + autofs4_del_active(dentry); + +- inode = autofs4_get_inode(dir->i_sb, S_IFDIR | 0555); ++ inode = autofs4_get_inode(dir->i_sb, S_IFDIR | mode); + if (!inode) + return -ENOMEM; + d_add(dentry, inode); +diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig +index d5b2e12b5d02..cb0f1fbe836d 100644 +--- a/fs/cifs/Kconfig ++++ b/fs/cifs/Kconfig +@@ -190,6 +190,7 @@ config CIFS_NFSD_EXPORT + config CIFS_SMB311 + bool "SMB3.1.1 network file system support (Experimental)" + depends on CIFS ++ select CRYPTO_SHA512 + + help + This enables experimental support for the newest, SMB3.1.1, dialect. +diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c +index f2b0a7f124da..a6ef088e057b 100644 +--- a/fs/cifs/cifsencrypt.c ++++ b/fs/cifs/cifsencrypt.c +@@ -36,37 +36,6 @@ + #include + #include + +-static int +-cifs_crypto_shash_md5_allocate(struct TCP_Server_Info *server) +-{ +- int rc; +- unsigned int size; +- +- if (server->secmech.sdescmd5 != NULL) +- return 0; /* already allocated */ +- +- server->secmech.md5 = crypto_alloc_shash("md5", 0, 0); +- if (IS_ERR(server->secmech.md5)) { +- cifs_dbg(VFS, "could not allocate crypto md5\n"); +- rc = PTR_ERR(server->secmech.md5); +- server->secmech.md5 = NULL; +- return rc; +- } +- +- size = sizeof(struct shash_desc) + +- crypto_shash_descsize(server->secmech.md5); +- server->secmech.sdescmd5 = kmalloc(size, GFP_KERNEL); +- if (!server->secmech.sdescmd5) { +- crypto_free_shash(server->secmech.md5); +- server->secmech.md5 = NULL; +- return -ENOMEM; +- } +- server->secmech.sdescmd5->shash.tfm = server->secmech.md5; +- server->secmech.sdescmd5->shash.flags = 0x0; +- +- return 0; +-} +- + int __cifs_calc_signature(struct smb_rqst *rqst, + struct TCP_Server_Info *server, char *signature, + struct shash_desc *shash) +@@ -132,13 +101,10 @@ static int cifs_calc_signature(struct smb_rqst *rqst, + if (!rqst->rq_iov || !signature || !server) + return -EINVAL; + +- if (!server->secmech.sdescmd5) { +- rc = cifs_crypto_shash_md5_allocate(server); +- if (rc) { +- cifs_dbg(VFS, "%s: Can't alloc md5 crypto\n", __func__); +- return -1; +- } +- } ++ rc = cifs_alloc_hash("md5", &server->secmech.md5, ++ &server->secmech.sdescmd5); ++ if (rc) ++ return -1; + + rc = crypto_shash_init(&server->secmech.sdescmd5->shash); + if (rc) { +@@ -663,37 +629,6 @@ CalcNTLMv2_response(const struct cifs_ses *ses, char *ntlmv2_hash) + return rc; + } + +-static int crypto_hmacmd5_alloc(struct TCP_Server_Info *server) +-{ +- int rc; +- unsigned int size; +- +- /* check if already allocated */ +- if (server->secmech.sdeschmacmd5) +- return 0; +- +- server->secmech.hmacmd5 = crypto_alloc_shash("hmac(md5)", 0, 0); +- if (IS_ERR(server->secmech.hmacmd5)) { +- cifs_dbg(VFS, "could not allocate crypto hmacmd5\n"); +- rc = PTR_ERR(server->secmech.hmacmd5); +- server->secmech.hmacmd5 = NULL; +- return rc; +- } +- +- size = sizeof(struct shash_desc) + +- crypto_shash_descsize(server->secmech.hmacmd5); +- server->secmech.sdeschmacmd5 = kmalloc(size, GFP_KERNEL); +- if (!server->secmech.sdeschmacmd5) { +- crypto_free_shash(server->secmech.hmacmd5); +- server->secmech.hmacmd5 = NULL; +- return -ENOMEM; +- } +- server->secmech.sdeschmacmd5->shash.tfm = server->secmech.hmacmd5; +- server->secmech.sdeschmacmd5->shash.flags = 0x0; +- +- return 0; +-} +- + int + setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + { +@@ -757,9 +692,10 @@ setup_ntlmv2_rsp(struct cifs_ses *ses, const struct nls_table *nls_cp) + + mutex_lock(&ses->server->srv_mutex); + +- rc = crypto_hmacmd5_alloc(ses->server); ++ rc = cifs_alloc_hash("hmac(md5)", ++ &ses->server->secmech.hmacmd5, ++ &ses->server->secmech.sdeschmacmd5); + if (rc) { +- cifs_dbg(VFS, "could not crypto alloc hmacmd5 rc %d\n", rc); + goto unlock; + } + +@@ -893,6 +829,11 @@ cifs_crypto_secmech_release(struct TCP_Server_Info *server) + server->secmech.md5 = NULL; + } + ++ if (server->secmech.sha512) { ++ crypto_free_shash(server->secmech.sha512); ++ server->secmech.sha512 = NULL; ++ } ++ + if (server->secmech.hmacmd5) { + crypto_free_shash(server->secmech.hmacmd5); + server->secmech.hmacmd5 = NULL; +@@ -916,4 +857,6 @@ cifs_crypto_secmech_release(struct TCP_Server_Info *server) + server->secmech.sdeschmacmd5 = NULL; + kfree(server->secmech.sdescmd5); + server->secmech.sdescmd5 = NULL; ++ kfree(server->secmech.sdescsha512); ++ server->secmech.sdescsha512 = NULL; + } +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 8c8b75d33f31..dbcd2e066066 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1476,6 +1476,7 @@ MODULE_SOFTDEP("pre: nls"); + MODULE_SOFTDEP("pre: aes"); + MODULE_SOFTDEP("pre: cmac"); + MODULE_SOFTDEP("pre: sha256"); ++MODULE_SOFTDEP("pre: sha512"); + MODULE_SOFTDEP("pre: aead2"); + MODULE_SOFTDEP("pre: ccm"); + module_init(init_cifs) +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index e185b2853eab..33d6eb58ce34 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -130,10 +130,12 @@ struct cifs_secmech { + struct crypto_shash *md5; /* md5 hash function */ + struct crypto_shash *hmacsha256; /* hmac-sha256 hash function */ + struct crypto_shash *cmacaes; /* block-cipher based MAC function */ ++ struct crypto_shash *sha512; /* sha512 hash function */ + struct sdesc *sdeschmacmd5; /* ctxt to generate ntlmv2 hash, CR1 */ + struct sdesc *sdescmd5; /* ctxt to generate cifs/smb signature */ + struct sdesc *sdeschmacsha256; /* ctxt to generate smb2 signature */ + struct sdesc *sdesccmacaes; /* ctxt to generate smb3 signature */ ++ struct sdesc *sdescsha512; /* ctxt to generate smb3.11 signing key */ + struct crypto_aead *ccmaesencrypt; /* smb3 encryption aead */ + struct crypto_aead *ccmaesdecrypt; /* smb3 decryption aead */ + }; +@@ -1449,6 +1451,7 @@ struct dfs_info3_param { + #define CIFS_FATTR_NEED_REVAL 0x4 + #define CIFS_FATTR_INO_COLLISION 0x8 + #define CIFS_FATTR_UNKNOWN_NLINK 0x10 ++#define CIFS_FATTR_FAKE_ROOT_INO 0x20 + + struct cifs_fattr { + u32 cf_flags; +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 4143c9dec463..762d513a5087 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -538,4 +538,9 @@ enum securityEnum cifs_select_sectype(struct TCP_Server_Info *, + struct cifs_aio_ctx *cifs_aio_ctx_alloc(void); + void cifs_aio_ctx_release(struct kref *refcount); + int setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw); ++ ++int cifs_alloc_hash(const char *name, struct crypto_shash **shash, ++ struct sdesc **sdesc); ++void cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc); ++ + #endif /* _CIFSPROTO_H */ +diff --git a/fs/cifs/inode.c b/fs/cifs/inode.c +index 7c732cb44164..0c7b7e2a0919 100644 +--- a/fs/cifs/inode.c ++++ b/fs/cifs/inode.c +@@ -707,6 +707,18 @@ cifs_get_file_info(struct file *filp) + return rc; + } + ++/* Simple function to return a 64 bit hash of string. Rarely called */ ++static __u64 simple_hashstr(const char *str) ++{ ++ const __u64 hash_mult = 1125899906842597L; /* a big enough prime */ ++ __u64 hash = 0; ++ ++ while (*str) ++ hash = (hash + (__u64) *str++) * hash_mult; ++ ++ return hash; ++} ++ + int + cifs_get_inode_info(struct inode **inode, const char *full_path, + FILE_ALL_INFO *data, struct super_block *sb, int xid, +@@ -816,6 +828,14 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, + tmprc); + fattr.cf_uniqueid = iunique(sb, ROOT_I); + cifs_autodisable_serverino(cifs_sb); ++ } else if ((fattr.cf_uniqueid == 0) && ++ strlen(full_path) == 0) { ++ /* some servers ret bad root ino ie 0 */ ++ cifs_dbg(FYI, "Invalid (0) inodenum\n"); ++ fattr.cf_flags |= ++ CIFS_FATTR_FAKE_ROOT_INO; ++ fattr.cf_uniqueid = ++ simple_hashstr(tcon->treeName); + } + } + } else +@@ -832,6 +852,16 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, + &fattr.cf_uniqueid, data); + if (tmprc) + fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; ++ else if ((fattr.cf_uniqueid == 0) && ++ strlen(full_path) == 0) { ++ /* ++ * Reuse existing root inode num since ++ * inum zero for root causes ls of . and .. to ++ * not be returned ++ */ ++ cifs_dbg(FYI, "Srv ret 0 inode num for root\n"); ++ fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; ++ } + } else + fattr.cf_uniqueid = CIFS_I(*inode)->uniqueid; + } +@@ -893,6 +923,9 @@ cifs_get_inode_info(struct inode **inode, const char *full_path, + } + + cgii_exit: ++ if ((*inode) && ((*inode)->i_ino == 0)) ++ cifs_dbg(FYI, "inode number of zero returned\n"); ++ + kfree(buf); + cifs_put_tlink(tlink); + return rc; +diff --git a/fs/cifs/link.c b/fs/cifs/link.c +index 60b5a11ee11b..889a840172eb 100644 +--- a/fs/cifs/link.c ++++ b/fs/cifs/link.c +@@ -50,25 +50,12 @@ static int + symlink_hash(unsigned int link_len, const char *link_str, u8 *md5_hash) + { + int rc; +- unsigned int size; +- struct crypto_shash *md5; +- struct sdesc *sdescmd5; +- +- md5 = crypto_alloc_shash("md5", 0, 0); +- if (IS_ERR(md5)) { +- rc = PTR_ERR(md5); +- cifs_dbg(VFS, "%s: Crypto md5 allocation error %d\n", +- __func__, rc); +- return rc; +- } +- size = sizeof(struct shash_desc) + crypto_shash_descsize(md5); +- sdescmd5 = kmalloc(size, GFP_KERNEL); +- if (!sdescmd5) { +- rc = -ENOMEM; ++ struct crypto_shash *md5 = NULL; ++ struct sdesc *sdescmd5 = NULL; ++ ++ rc = cifs_alloc_hash("md5", &md5, &sdescmd5); ++ if (rc) + goto symlink_hash_err; +- } +- sdescmd5->shash.tfm = md5; +- sdescmd5->shash.flags = 0x0; + + rc = crypto_shash_init(&sdescmd5->shash); + if (rc) { +@@ -85,9 +72,7 @@ symlink_hash(unsigned int link_len, const char *link_str, u8 *md5_hash) + cifs_dbg(VFS, "%s: Could not generate md5 hash\n", __func__); + + symlink_hash_err: +- crypto_free_shash(md5); +- kfree(sdescmd5); +- ++ cifs_free_hash(&md5, &sdescmd5); + return rc; + } + +diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c +index a0dbced4a45c..460084a8eac5 100644 +--- a/fs/cifs/misc.c ++++ b/fs/cifs/misc.c +@@ -848,3 +848,57 @@ setup_aio_ctx_iter(struct cifs_aio_ctx *ctx, struct iov_iter *iter, int rw) + iov_iter_bvec(&ctx->iter, ITER_BVEC | rw, ctx->bv, npages, ctx->len); + return 0; + } ++ ++/** ++ * cifs_alloc_hash - allocate hash and hash context together ++ * ++ * The caller has to make sure @sdesc is initialized to either NULL or ++ * a valid context. Both can be freed via cifs_free_hash(). ++ */ ++int ++cifs_alloc_hash(const char *name, ++ struct crypto_shash **shash, struct sdesc **sdesc) ++{ ++ int rc = 0; ++ size_t size; ++ ++ if (*sdesc != NULL) ++ return 0; ++ ++ *shash = crypto_alloc_shash(name, 0, 0); ++ if (IS_ERR(*shash)) { ++ cifs_dbg(VFS, "could not allocate crypto %s\n", name); ++ rc = PTR_ERR(*shash); ++ *shash = NULL; ++ *sdesc = NULL; ++ return rc; ++ } ++ ++ size = sizeof(struct shash_desc) + crypto_shash_descsize(*shash); ++ *sdesc = kmalloc(size, GFP_KERNEL); ++ if (*sdesc == NULL) { ++ cifs_dbg(VFS, "no memory left to allocate crypto %s\n", name); ++ crypto_free_shash(*shash); ++ *shash = NULL; ++ return -ENOMEM; ++ } ++ ++ (*sdesc)->shash.tfm = *shash; ++ (*sdesc)->shash.flags = 0x0; ++ return 0; ++} ++ ++/** ++ * cifs_free_hash - free hash and hash context together ++ * ++ * Freeing a NULL hash or context is safe. ++ */ ++void ++cifs_free_hash(struct crypto_shash **shash, struct sdesc **sdesc) ++{ ++ kfree(*sdesc); ++ *sdesc = NULL; ++ if (*shash) ++ crypto_free_shash(*shash); ++ *shash = NULL; ++} +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index bdb963d0ba32..eef875da7c0b 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -2060,6 +2060,15 @@ fill_transform_hdr(struct smb2_transform_hdr *tr_hdr, struct smb_rqst *old_rq) + inc_rfc1001_len(tr_hdr, orig_len); + } + ++/* We can not use the normal sg_set_buf() as we will sometimes pass a ++ * stack object as buf. ++ */ ++static inline void smb2_sg_set_buf(struct scatterlist *sg, const void *buf, ++ unsigned int buflen) ++{ ++ sg_set_page(sg, virt_to_page(buf), buflen, offset_in_page(buf)); ++} ++ + static struct scatterlist * + init_sg(struct smb_rqst *rqst, u8 *sign) + { +@@ -2074,16 +2083,16 @@ init_sg(struct smb_rqst *rqst, u8 *sign) + return NULL; + + sg_init_table(sg, sg_len); +- sg_set_buf(&sg[0], rqst->rq_iov[0].iov_base + 24, assoc_data_len); ++ smb2_sg_set_buf(&sg[0], rqst->rq_iov[0].iov_base + 24, assoc_data_len); + for (i = 1; i < rqst->rq_nvec; i++) +- sg_set_buf(&sg[i], rqst->rq_iov[i].iov_base, ++ smb2_sg_set_buf(&sg[i], rqst->rq_iov[i].iov_base, + rqst->rq_iov[i].iov_len); + for (j = 0; i < sg_len - 1; i++, j++) { + unsigned int len = (j < rqst->rq_npages - 1) ? rqst->rq_pagesz + : rqst->rq_tailsz; + sg_set_page(&sg[i], rqst->rq_pages[j], len, 0); + } +- sg_set_buf(&sg[sg_len - 1], sign, SMB2_SIGNATURE_SIZE); ++ smb2_sg_set_buf(&sg[sg_len - 1], sign, SMB2_SIGNATURE_SIZE); + return sg; + } + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 66af1f8a13cc..49779d952cd5 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1773,8 +1773,10 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, + rc = alloc_path_with_tree_prefix(©_path, ©_size, + &name_len, + tcon->treeName, path); +- if (rc) ++ if (rc) { ++ cifs_small_buf_release(req); + return rc; ++ } + req->NameLength = cpu_to_le16(name_len * 2); + uni_path_len = copy_size; + path = copy_path; +@@ -1785,8 +1787,10 @@ SMB2_open(const unsigned int xid, struct cifs_open_parms *oparms, __le16 *path, + if (uni_path_len % 8 != 0) { + copy_size = roundup(uni_path_len, 8); + copy_path = kzalloc(copy_size, GFP_KERNEL); +- if (!copy_path) ++ if (!copy_path) { ++ cifs_small_buf_release(req); + return -ENOMEM; ++ } + memcpy((char *)copy_path, (const char *)path, + uni_path_len); + uni_path_len = copy_size; +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index e9ab5227e7a8..6fe4898f6975 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -203,4 +203,7 @@ extern int smb3_validate_negotiate(const unsigned int, struct cifs_tcon *); + + extern enum securityEnum smb2_select_sectype(struct TCP_Server_Info *, + enum securityEnum); ++#ifdef CONFIG_CIFS_SMB311 ++extern int smb311_crypto_shash_allocate(struct TCP_Server_Info *server); ++#endif + #endif /* _SMB2PROTO_H */ +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index 99493946e2f9..bf49cb73b9e6 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -43,77 +43,62 @@ + static int + smb2_crypto_shash_allocate(struct TCP_Server_Info *server) + { +- int rc; +- unsigned int size; ++ return cifs_alloc_hash("hmac(sha256)", ++ &server->secmech.hmacsha256, ++ &server->secmech.sdeschmacsha256); ++} + +- if (server->secmech.sdeschmacsha256 != NULL) +- return 0; /* already allocated */ ++static int ++smb3_crypto_shash_allocate(struct TCP_Server_Info *server) ++{ ++ struct cifs_secmech *p = &server->secmech; ++ int rc; + +- server->secmech.hmacsha256 = crypto_alloc_shash("hmac(sha256)", 0, 0); +- if (IS_ERR(server->secmech.hmacsha256)) { +- cifs_dbg(VFS, "could not allocate crypto hmacsha256\n"); +- rc = PTR_ERR(server->secmech.hmacsha256); +- server->secmech.hmacsha256 = NULL; +- return rc; +- } ++ rc = cifs_alloc_hash("hmac(sha256)", ++ &p->hmacsha256, ++ &p->sdeschmacsha256); ++ if (rc) ++ goto err; + +- size = sizeof(struct shash_desc) + +- crypto_shash_descsize(server->secmech.hmacsha256); +- server->secmech.sdeschmacsha256 = kmalloc(size, GFP_KERNEL); +- if (!server->secmech.sdeschmacsha256) { +- crypto_free_shash(server->secmech.hmacsha256); +- server->secmech.hmacsha256 = NULL; +- return -ENOMEM; +- } +- server->secmech.sdeschmacsha256->shash.tfm = server->secmech.hmacsha256; +- server->secmech.sdeschmacsha256->shash.flags = 0x0; ++ rc = cifs_alloc_hash("cmac(aes)", &p->cmacaes, &p->sdesccmacaes); ++ if (rc) ++ goto err; + + return 0; ++err: ++ cifs_free_hash(&p->hmacsha256, &p->sdeschmacsha256); ++ return rc; + } + +-static int +-smb3_crypto_shash_allocate(struct TCP_Server_Info *server) ++#ifdef CONFIG_CIFS_SMB311 ++int ++smb311_crypto_shash_allocate(struct TCP_Server_Info *server) + { +- unsigned int size; +- int rc; +- +- if (server->secmech.sdesccmacaes != NULL) +- return 0; /* already allocated */ ++ struct cifs_secmech *p = &server->secmech; ++ int rc = 0; + +- rc = smb2_crypto_shash_allocate(server); ++ rc = cifs_alloc_hash("hmac(sha256)", ++ &p->hmacsha256, ++ &p->sdeschmacsha256); + if (rc) + return rc; + +- server->secmech.cmacaes = crypto_alloc_shash("cmac(aes)", 0, 0); +- if (IS_ERR(server->secmech.cmacaes)) { +- cifs_dbg(VFS, "could not allocate crypto cmac-aes"); +- kfree(server->secmech.sdeschmacsha256); +- server->secmech.sdeschmacsha256 = NULL; +- crypto_free_shash(server->secmech.hmacsha256); +- server->secmech.hmacsha256 = NULL; +- rc = PTR_ERR(server->secmech.cmacaes); +- server->secmech.cmacaes = NULL; +- return rc; +- } ++ rc = cifs_alloc_hash("cmac(aes)", &p->cmacaes, &p->sdesccmacaes); ++ if (rc) ++ goto err; + +- size = sizeof(struct shash_desc) + +- crypto_shash_descsize(server->secmech.cmacaes); +- server->secmech.sdesccmacaes = kmalloc(size, GFP_KERNEL); +- if (!server->secmech.sdesccmacaes) { +- cifs_dbg(VFS, "%s: Can't alloc cmacaes\n", __func__); +- kfree(server->secmech.sdeschmacsha256); +- server->secmech.sdeschmacsha256 = NULL; +- crypto_free_shash(server->secmech.hmacsha256); +- crypto_free_shash(server->secmech.cmacaes); +- server->secmech.hmacsha256 = NULL; +- server->secmech.cmacaes = NULL; +- return -ENOMEM; +- } +- server->secmech.sdesccmacaes->shash.tfm = server->secmech.cmacaes; +- server->secmech.sdesccmacaes->shash.flags = 0x0; ++ rc = cifs_alloc_hash("sha512", &p->sha512, &p->sdescsha512); ++ if (rc) ++ goto err; + + return 0; ++ ++err: ++ cifs_free_hash(&p->cmacaes, &p->sdesccmacaes); ++ cifs_free_hash(&p->hmacsha256, &p->sdeschmacsha256); ++ return rc; + } ++#endif + + static struct cifs_ses * + smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) +@@ -457,7 +442,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) + cifs_dbg(VFS, "%s: Could not init cmac aes\n", __func__); + return rc; + } +- ++ + rc = __cifs_calc_signature(rqst, server, sigptr, + &server->secmech.sdesccmacaes->shash); + +diff --git a/fs/cifs/smbencrypt.c b/fs/cifs/smbencrypt.c +index c12bffefa3c9..a0b80ac651a6 100644 +--- a/fs/cifs/smbencrypt.c ++++ b/fs/cifs/smbencrypt.c +@@ -121,25 +121,12 @@ int + mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len) + { + int rc; +- unsigned int size; +- struct crypto_shash *md4; +- struct sdesc *sdescmd4; +- +- md4 = crypto_alloc_shash("md4", 0, 0); +- if (IS_ERR(md4)) { +- rc = PTR_ERR(md4); +- cifs_dbg(VFS, "%s: Crypto md4 allocation error %d\n", +- __func__, rc); +- return rc; +- } +- size = sizeof(struct shash_desc) + crypto_shash_descsize(md4); +- sdescmd4 = kmalloc(size, GFP_KERNEL); +- if (!sdescmd4) { +- rc = -ENOMEM; ++ struct crypto_shash *md4 = NULL; ++ struct sdesc *sdescmd4 = NULL; ++ ++ rc = cifs_alloc_hash("md4", &md4, &sdescmd4); ++ if (rc) + goto mdfour_err; +- } +- sdescmd4->shash.tfm = md4; +- sdescmd4->shash.flags = 0x0; + + rc = crypto_shash_init(&sdescmd4->shash); + if (rc) { +@@ -156,9 +143,7 @@ mdfour(unsigned char *md4_hash, unsigned char *link_str, int link_len) + cifs_dbg(VFS, "%s: Could not generate md4 hash\n", __func__); + + mdfour_err: +- crypto_free_shash(md4); +- kfree(sdescmd4); +- ++ cifs_free_hash(&md4, &sdescmd4); + return rc; + } + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index d5ddfb96c83c..db5be5e2e6f2 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -243,8 +243,6 @@ static int ext4_init_block_bitmap(struct super_block *sb, + */ + ext4_mark_bitmap_end(num_clusters_in_group(sb, block_group), + sb->s_blocksize * 8, bh->b_data); +- ext4_block_bitmap_csum_set(sb, block_group, gdp, bh); +- ext4_group_desc_csum_set(sb, block_group, gdp); + return 0; + } + +@@ -448,6 +446,7 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) + err = ext4_init_block_bitmap(sb, bh, block_group, desc); + set_bitmap_uptodate(bh); + set_buffer_uptodate(bh); ++ set_buffer_verified(bh); + ext4_unlock_group(sb, block_group); + unlock_buffer(bh); + if (err) { +diff --git a/fs/ext4/ext4_jbd2.c b/fs/ext4/ext4_jbd2.c +index 2d593201cf7a..7c70b08d104c 100644 +--- a/fs/ext4/ext4_jbd2.c ++++ b/fs/ext4/ext4_jbd2.c +@@ -166,13 +166,6 @@ int __ext4_journal_get_write_access(const char *where, unsigned int line, + might_sleep(); + + if (ext4_handle_valid(handle)) { +- struct super_block *sb; +- +- sb = handle->h_transaction->t_journal->j_private; +- if (unlikely(ext4_forced_shutdown(EXT4_SB(sb)))) { +- jbd2_journal_abort_handle(handle); +- return -EIO; +- } + err = jbd2_journal_get_write_access(handle, bh); + if (err) + ext4_journal_abort_handle(where, line, __func__, bh, +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 207588dc803e..7ec55dd8db56 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -66,44 +66,6 @@ void ext4_mark_bitmap_end(int start_bit, int end_bit, char *bitmap) + memset(bitmap + (i >> 3), 0xff, (end_bit - i) >> 3); + } + +-/* Initializes an uninitialized inode bitmap */ +-static int ext4_init_inode_bitmap(struct super_block *sb, +- struct buffer_head *bh, +- ext4_group_t block_group, +- struct ext4_group_desc *gdp) +-{ +- struct ext4_group_info *grp; +- struct ext4_sb_info *sbi = EXT4_SB(sb); +- J_ASSERT_BH(bh, buffer_locked(bh)); +- +- /* If checksum is bad mark all blocks and inodes use to prevent +- * allocation, essentially implementing a per-group read-only flag. */ +- if (!ext4_group_desc_csum_verify(sb, block_group, gdp)) { +- grp = ext4_get_group_info(sb, block_group); +- if (!EXT4_MB_GRP_BBITMAP_CORRUPT(grp)) +- percpu_counter_sub(&sbi->s_freeclusters_counter, +- grp->bb_free); +- set_bit(EXT4_GROUP_INFO_BBITMAP_CORRUPT_BIT, &grp->bb_state); +- if (!EXT4_MB_GRP_IBITMAP_CORRUPT(grp)) { +- int count; +- count = ext4_free_inodes_count(sb, gdp); +- percpu_counter_sub(&sbi->s_freeinodes_counter, +- count); +- } +- set_bit(EXT4_GROUP_INFO_IBITMAP_CORRUPT_BIT, &grp->bb_state); +- return -EFSBADCRC; +- } +- +- memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8); +- ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), sb->s_blocksize * 8, +- bh->b_data); +- ext4_inode_bitmap_csum_set(sb, block_group, gdp, bh, +- EXT4_INODES_PER_GROUP(sb) / 8); +- ext4_group_desc_csum_set(sb, block_group, gdp); +- +- return 0; +-} +- + void ext4_end_bitmap_read(struct buffer_head *bh, int uptodate) + { + if (uptodate) { +@@ -187,17 +149,14 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) + + ext4_lock_group(sb, block_group); + if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) { +- err = ext4_init_inode_bitmap(sb, bh, block_group, desc); ++ memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8); ++ ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), ++ sb->s_blocksize * 8, bh->b_data); + set_bitmap_uptodate(bh); + set_buffer_uptodate(bh); + set_buffer_verified(bh); + ext4_unlock_group(sb, block_group); + unlock_buffer(bh); +- if (err) { +- ext4_error(sb, "Failed to init inode bitmap for group " +- "%u: %d", block_group, err); +- goto out; +- } + return bh; + } + ext4_unlock_group(sb, block_group); +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 0b9f3f284799..09014c3c4207 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3614,7 +3614,6 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter) + { + struct file *file = iocb->ki_filp; + struct inode *inode = file->f_mapping->host; +- struct ext4_inode_info *ei = EXT4_I(inode); + ssize_t ret; + loff_t offset = iocb->ki_pos; + size_t count = iov_iter_count(iter); +@@ -3638,7 +3637,7 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter) + goto out; + } + orphan = 1; +- ei->i_disksize = inode->i_size; ++ ext4_update_i_disksize(inode, inode->i_size); + ext4_journal_stop(handle); + } + +@@ -3746,7 +3745,7 @@ static ssize_t ext4_direct_IO_write(struct kiocb *iocb, struct iov_iter *iter) + if (ret > 0) { + loff_t end = offset + ret; + if (end > inode->i_size) { +- ei->i_disksize = end; ++ ext4_update_i_disksize(inode, end); + i_size_write(inode, end); + /* + * We're going to return a positive `ret' +@@ -4686,6 +4685,12 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + goto bad_inode; + raw_inode = ext4_raw_inode(&iloc); + ++ if ((ino == EXT4_ROOT_INO) && (raw_inode->i_links_count == 0)) { ++ EXT4_ERROR_INODE(inode, "root inode unallocated"); ++ ret = -EFSCORRUPTED; ++ goto bad_inode; ++ } ++ + if (EXT4_INODE_SIZE(inode->i_sb) > EXT4_GOOD_OLD_INODE_SIZE) { + ei->i_extra_isize = le16_to_cpu(raw_inode->i_extra_isize); + if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize > +diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c +index d97f40396765..1eb68e626931 100644 +--- a/fs/ext4/ioctl.c ++++ b/fs/ext4/ioctl.c +@@ -493,15 +493,13 @@ static int ext4_shutdown(struct super_block *sb, unsigned long arg) + set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags); + if (sbi->s_journal && !is_journal_aborted(sbi->s_journal)) { + (void) ext4_force_commit(sb); +- jbd2_journal_abort(sbi->s_journal, 0); ++ jbd2_journal_abort(sbi->s_journal, -ESHUTDOWN); + } + break; + case EXT4_GOING_FLAGS_NOLOGFLUSH: + set_bit(EXT4_FLAGS_SHUTDOWN, &sbi->s_ext4_flags); +- if (sbi->s_journal && !is_journal_aborted(sbi->s_journal)) { +- msleep(100); +- jbd2_journal_abort(sbi->s_journal, 0); +- } ++ if (sbi->s_journal && !is_journal_aborted(sbi->s_journal)) ++ jbd2_journal_abort(sbi->s_journal, -ESHUTDOWN); + break; + default: + return -EINVAL; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 16d247f056e2..3a605c672649 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2330,6 +2330,8 @@ static int ext4_check_descriptors(struct super_block *sb, + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Block bitmap for group %u overlaps " + "superblock", i); ++ if (!sb_rdonly(sb)) ++ return 0; + } + if (block_bitmap < first_block || block_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -2342,6 +2344,8 @@ static int ext4_check_descriptors(struct super_block *sb, + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode bitmap for group %u overlaps " + "superblock", i); ++ if (!sb_rdonly(sb)) ++ return 0; + } + if (inode_bitmap < first_block || inode_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -2354,6 +2358,8 @@ static int ext4_check_descriptors(struct super_block *sb, + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode table for group %u overlaps " + "superblock", i); ++ if (!sb_rdonly(sb)) ++ return 0; + } + if (inode_table < first_block || + inode_table + sbi->s_itb_per_group - 1 > last_block) { +@@ -3490,15 +3496,12 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } + + /* Load the checksum driver */ +- if (ext4_has_feature_metadata_csum(sb) || +- ext4_has_feature_ea_inode(sb)) { +- sbi->s_chksum_driver = crypto_alloc_shash("crc32c", 0, 0); +- if (IS_ERR(sbi->s_chksum_driver)) { +- ext4_msg(sb, KERN_ERR, "Cannot load crc32c driver."); +- ret = PTR_ERR(sbi->s_chksum_driver); +- sbi->s_chksum_driver = NULL; +- goto failed_mount; +- } ++ sbi->s_chksum_driver = crypto_alloc_shash("crc32c", 0, 0); ++ if (IS_ERR(sbi->s_chksum_driver)) { ++ ext4_msg(sb, KERN_ERR, "Cannot load crc32c driver."); ++ ret = PTR_ERR(sbi->s_chksum_driver); ++ sbi->s_chksum_driver = NULL; ++ goto failed_mount; + } + + /* Check superblock checksum */ +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 218a7ba57819..1718354e6322 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -194,10 +194,13 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end, + + /* Check the values */ + while (!IS_LAST_ENTRY(entry)) { +- if (entry->e_value_size != 0 && +- entry->e_value_inum == 0) { ++ u32 size = le32_to_cpu(entry->e_value_size); ++ ++ if (size > EXT4_XATTR_SIZE_MAX) ++ return -EFSCORRUPTED; ++ ++ if (size != 0 && entry->e_value_inum == 0) { + u16 offs = le16_to_cpu(entry->e_value_offs); +- u32 size = le32_to_cpu(entry->e_value_size); + void *value; + + /* +@@ -221,25 +224,36 @@ ext4_xattr_check_entries(struct ext4_xattr_entry *entry, void *end, + } + + static inline int +-ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) ++__ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh, ++ const char *function, unsigned int line) + { +- int error; ++ int error = -EFSCORRUPTED; + + if (buffer_verified(bh)) + return 0; + + if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || + BHDR(bh)->h_blocks != cpu_to_le32(1)) +- return -EFSCORRUPTED; ++ goto errout; ++ error = -EFSBADCRC; + if (!ext4_xattr_block_csum_verify(inode, bh)) +- return -EFSBADCRC; ++ goto errout; + error = ext4_xattr_check_entries(BFIRST(bh), bh->b_data + bh->b_size, + bh->b_data); +- if (!error) ++errout: ++ if (error) ++ __ext4_error_inode(inode, function, line, 0, ++ "corrupted xattr block %llu", ++ (unsigned long long) bh->b_blocknr); ++ else + set_buffer_verified(bh); + return error; + } + ++#define ext4_xattr_check_block(inode, bh) \ ++ __ext4_xattr_check_block((inode), (bh), __func__, __LINE__) ++ ++ + static int + __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header, + void *end, const char *function, unsigned int line) +@@ -261,18 +275,22 @@ __xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header, + __xattr_check_inode((inode), (header), (end), __func__, __LINE__) + + static int +-ext4_xattr_find_entry(struct ext4_xattr_entry **pentry, int name_index, +- const char *name, int sorted) ++xattr_find_entry(struct inode *inode, struct ext4_xattr_entry **pentry, ++ void *end, int name_index, const char *name, int sorted) + { +- struct ext4_xattr_entry *entry; ++ struct ext4_xattr_entry *entry, *next; + size_t name_len; + int cmp = 1; + + if (name == NULL) + return -EINVAL; + name_len = strlen(name); +- entry = *pentry; +- for (; !IS_LAST_ENTRY(entry); entry = EXT4_XATTR_NEXT(entry)) { ++ for (entry = *pentry; !IS_LAST_ENTRY(entry); entry = next) { ++ next = EXT4_XATTR_NEXT(entry); ++ if ((void *) next >= end) { ++ EXT4_ERROR_INODE(inode, "corrupted xattr entries"); ++ return -EFSCORRUPTED; ++ } + cmp = name_index - entry->e_name_index; + if (!cmp) + cmp = name_len - entry->e_name_len; +@@ -494,6 +512,7 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name, + struct buffer_head *bh = NULL; + struct ext4_xattr_entry *entry; + size_t size; ++ void *end; + int error; + struct mb_cache *ea_block_cache = EA_BLOCK_CACHE(inode); + +@@ -510,20 +529,20 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name, + goto cleanup; + ea_bdebug(bh, "b_count=%d, refcount=%d", + atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount)); +- if (ext4_xattr_check_block(inode, bh)) { +- EXT4_ERROR_INODE(inode, "bad block %llu", +- EXT4_I(inode)->i_file_acl); +- error = -EFSCORRUPTED; ++ error = ext4_xattr_check_block(inode, bh); ++ if (error) + goto cleanup; +- } + ext4_xattr_block_cache_insert(ea_block_cache, bh); + entry = BFIRST(bh); +- error = ext4_xattr_find_entry(&entry, name_index, name, 1); ++ end = bh->b_data + bh->b_size; ++ error = xattr_find_entry(inode, &entry, end, name_index, name, 1); + if (error) + goto cleanup; + size = le32_to_cpu(entry->e_value_size); ++ error = -ERANGE; ++ if (unlikely(size > EXT4_XATTR_SIZE_MAX)) ++ goto cleanup; + if (buffer) { +- error = -ERANGE; + if (size > buffer_size) + goto cleanup; + if (entry->e_value_inum) { +@@ -532,8 +551,12 @@ ext4_xattr_block_get(struct inode *inode, int name_index, const char *name, + if (error) + goto cleanup; + } else { +- memcpy(buffer, bh->b_data + +- le16_to_cpu(entry->e_value_offs), size); ++ u16 offset = le16_to_cpu(entry->e_value_offs); ++ void *p = bh->b_data + offset; ++ ++ if (unlikely(p + size > end)) ++ goto cleanup; ++ memcpy(buffer, p, size); + } + } + error = size; +@@ -567,12 +590,14 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, + if (error) + goto cleanup; + entry = IFIRST(header); +- error = ext4_xattr_find_entry(&entry, name_index, name, 0); ++ error = xattr_find_entry(inode, &entry, end, name_index, name, 0); + if (error) + goto cleanup; + size = le32_to_cpu(entry->e_value_size); ++ error = -ERANGE; ++ if (unlikely(size > EXT4_XATTR_SIZE_MAX)) ++ goto cleanup; + if (buffer) { +- error = -ERANGE; + if (size > buffer_size) + goto cleanup; + if (entry->e_value_inum) { +@@ -581,8 +606,12 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, + if (error) + goto cleanup; + } else { +- memcpy(buffer, (void *)IFIRST(header) + +- le16_to_cpu(entry->e_value_offs), size); ++ u16 offset = le16_to_cpu(entry->e_value_offs); ++ void *p = (void *)IFIRST(header) + offset; ++ ++ if (unlikely(p + size > end)) ++ goto cleanup; ++ memcpy(buffer, p, size); + } + } + error = size; +@@ -675,12 +704,9 @@ ext4_xattr_block_list(struct dentry *dentry, char *buffer, size_t buffer_size) + goto cleanup; + ea_bdebug(bh, "b_count=%d, refcount=%d", + atomic_read(&(bh->b_count)), le32_to_cpu(BHDR(bh)->h_refcount)); +- if (ext4_xattr_check_block(inode, bh)) { +- EXT4_ERROR_INODE(inode, "bad block %llu", +- EXT4_I(inode)->i_file_acl); +- error = -EFSCORRUPTED; ++ error = ext4_xattr_check_block(inode, bh); ++ if (error) + goto cleanup; +- } + ext4_xattr_block_cache_insert(EA_BLOCK_CACHE(inode), bh); + error = ext4_xattr_list_entries(dentry, BFIRST(bh), buffer, buffer_size); + +@@ -807,10 +833,9 @@ int ext4_get_inode_usage(struct inode *inode, qsize_t *usage) + goto out; + } + +- if (ext4_xattr_check_block(inode, bh)) { +- ret = -EFSCORRUPTED; ++ ret = ext4_xattr_check_block(inode, bh); ++ if (ret) + goto out; +- } + + for (entry = BFIRST(bh); !IS_LAST_ENTRY(entry); + entry = EXT4_XATTR_NEXT(entry)) +@@ -1792,19 +1817,16 @@ ext4_xattr_block_find(struct inode *inode, struct ext4_xattr_info *i, + ea_bdebug(bs->bh, "b_count=%d, refcount=%d", + atomic_read(&(bs->bh->b_count)), + le32_to_cpu(BHDR(bs->bh)->h_refcount)); +- if (ext4_xattr_check_block(inode, bs->bh)) { +- EXT4_ERROR_INODE(inode, "bad block %llu", +- EXT4_I(inode)->i_file_acl); +- error = -EFSCORRUPTED; ++ error = ext4_xattr_check_block(inode, bs->bh); ++ if (error) + goto cleanup; +- } + /* Find the named attribute. */ + bs->s.base = BHDR(bs->bh); + bs->s.first = BFIRST(bs->bh); + bs->s.end = bs->bh->b_data + bs->bh->b_size; + bs->s.here = bs->s.first; +- error = ext4_xattr_find_entry(&bs->s.here, i->name_index, +- i->name, 1); ++ error = xattr_find_entry(inode, &bs->s.here, bs->s.end, ++ i->name_index, i->name, 1); + if (error && error != -ENODATA) + goto cleanup; + bs->s.not_found = error; +@@ -2163,8 +2185,8 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, + if (error) + return error; + /* Find the named attribute. */ +- error = ext4_xattr_find_entry(&is->s.here, i->name_index, +- i->name, 0); ++ error = xattr_find_entry(inode, &is->s.here, is->s.end, ++ i->name_index, i->name, 0); + if (error && error != -ENODATA) + return error; + is->s.not_found = error; +@@ -2720,13 +2742,9 @@ int ext4_expand_extra_isize_ea(struct inode *inode, int new_extra_isize, + error = -EIO; + if (!bh) + goto cleanup; +- if (ext4_xattr_check_block(inode, bh)) { +- EXT4_ERROR_INODE(inode, "bad block %llu", +- EXT4_I(inode)->i_file_acl); +- error = -EFSCORRUPTED; +- brelse(bh); ++ error = ext4_xattr_check_block(inode, bh); ++ if (error) + goto cleanup; +- } + base = BHDR(bh); + end = bh->b_data + bh->b_size; + min_offs = end - base; +@@ -2883,11 +2901,8 @@ int ext4_xattr_delete_inode(handle_t *handle, struct inode *inode, + goto cleanup; + } + error = ext4_xattr_check_block(inode, bh); +- if (error) { +- EXT4_ERROR_INODE(inode, "bad block %llu (error %d)", +- EXT4_I(inode)->i_file_acl, error); ++ if (error) + goto cleanup; +- } + + if (ext4_has_feature_ea_inode(inode->i_sb)) { + for (entry = BFIRST(bh); !IS_LAST_ENTRY(entry); +diff --git a/fs/ext4/xattr.h b/fs/ext4/xattr.h +index f8cc07588ac9..262b9314119f 100644 +--- a/fs/ext4/xattr.h ++++ b/fs/ext4/xattr.h +@@ -70,6 +70,17 @@ struct ext4_xattr_entry { + EXT4_I(inode)->i_extra_isize)) + #define IFIRST(hdr) ((struct ext4_xattr_entry *)((hdr)+1)) + ++/* ++ * XATTR_SIZE_MAX is currently 64k, but for the purposes of checking ++ * for file system consistency errors, we use a somewhat bigger value. ++ * This allows XATTR_SIZE_MAX to grow in the future, but by using this ++ * instead of INT_MAX for certain consistency checks, we don't need to ++ * worry about arithmetic overflows. (Actually XATTR_SIZE_MAX is ++ * defined in include/uapi/linux/limits.h, so changing it is going ++ * not going to be trivial....) ++ */ ++#define EXT4_XATTR_SIZE_MAX (1 << 24) ++ + /* + * The minimum size of EA value when you start storing it in an external inode + * size of block - size of header - size of 1 entry - 4 null bytes +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 245c430a2e41..8a7ef9378bf6 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -745,11 +745,12 @@ int inode_congested(struct inode *inode, int cong_bits) + */ + if (inode && inode_to_wb_is_valid(inode)) { + struct bdi_writeback *wb; +- bool locked, congested; ++ struct wb_lock_cookie lock_cookie = {}; ++ bool congested; + +- wb = unlocked_inode_to_wb_begin(inode, &locked); ++ wb = unlocked_inode_to_wb_begin(inode, &lock_cookie); + congested = wb_congested(wb, cong_bits); +- unlocked_inode_to_wb_end(inode, locked); ++ unlocked_inode_to_wb_end(inode, &lock_cookie); + return congested; + } + +diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c +index 7d5ef3bf3f3e..61d48f0c41a1 100644 +--- a/fs/jbd2/journal.c ++++ b/fs/jbd2/journal.c +@@ -961,7 +961,7 @@ int __jbd2_update_log_tail(journal_t *journal, tid_t tid, unsigned long block) + } + + /* +- * This is a variaon of __jbd2_update_log_tail which checks for validity of ++ * This is a variation of __jbd2_update_log_tail which checks for validity of + * provided log tail and locks j_checkpoint_mutex. So it is safe against races + * with other threads updating log tail. + */ +@@ -1404,6 +1404,9 @@ int jbd2_journal_update_sb_log_tail(journal_t *journal, tid_t tail_tid, + journal_superblock_t *sb = journal->j_superblock; + int ret; + ++ if (is_journal_aborted(journal)) ++ return -EIO; ++ + BUG_ON(!mutex_is_locked(&journal->j_checkpoint_mutex)); + jbd_debug(1, "JBD2: updating superblock (start %lu, seq %u)\n", + tail_block, tail_tid); +@@ -1470,12 +1473,15 @@ static void jbd2_mark_journal_empty(journal_t *journal, int write_op) + void jbd2_journal_update_sb_errno(journal_t *journal) + { + journal_superblock_t *sb = journal->j_superblock; ++ int errcode; + + read_lock(&journal->j_state_lock); +- jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", +- journal->j_errno); +- sb->s_errno = cpu_to_be32(journal->j_errno); ++ errcode = journal->j_errno; + read_unlock(&journal->j_state_lock); ++ if (errcode == -ESHUTDOWN) ++ errcode = 0; ++ jbd_debug(1, "JBD2: updating superblock error (errno %d)\n", errcode); ++ sb->s_errno = cpu_to_be32(errcode); + + jbd2_write_superblock(journal, REQ_SYNC | REQ_FUA); + } +@@ -2092,12 +2098,22 @@ void __jbd2_journal_abort_hard(journal_t *journal) + * but don't do any other IO. */ + static void __journal_abort_soft (journal_t *journal, int errno) + { +- if (journal->j_flags & JBD2_ABORT) +- return; ++ int old_errno; + +- if (!journal->j_errno) ++ write_lock(&journal->j_state_lock); ++ old_errno = journal->j_errno; ++ if (!journal->j_errno || errno == -ESHUTDOWN) + journal->j_errno = errno; + ++ if (journal->j_flags & JBD2_ABORT) { ++ write_unlock(&journal->j_state_lock); ++ if (!old_errno && old_errno != -ESHUTDOWN && ++ errno == -ESHUTDOWN) ++ jbd2_journal_update_sb_errno(journal); ++ return; ++ } ++ write_unlock(&journal->j_state_lock); ++ + __jbd2_journal_abort_hard(journal); + + if (errno) { +diff --git a/fs/jffs2/super.c b/fs/jffs2/super.c +index 153f1c6eb169..33e01de576d2 100644 +--- a/fs/jffs2/super.c ++++ b/fs/jffs2/super.c +@@ -342,7 +342,7 @@ static void jffs2_put_super (struct super_block *sb) + static void jffs2_kill_sb(struct super_block *sb) + { + struct jffs2_sb_info *c = JFFS2_SB_INFO(sb); +- if (!sb_rdonly(sb)) ++ if (c && !sb_rdonly(sb)) + jffs2_stop_garbage_collect_thread(c); + kill_mtd_super(sb); + kfree(c); +diff --git a/fs/namespace.c b/fs/namespace.c +index adae9ffce91d..62b17aff1908 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -1089,7 +1089,8 @@ static struct mount *clone_mnt(struct mount *old, struct dentry *root, + goto out_free; + } + +- mnt->mnt.mnt_flags = old->mnt.mnt_flags & ~(MNT_WRITE_HOLD|MNT_MARKED); ++ mnt->mnt.mnt_flags = old->mnt.mnt_flags; ++ mnt->mnt.mnt_flags &= ~(MNT_WRITE_HOLD|MNT_MARKED|MNT_INTERNAL); + /* Don't allow unprivileged users to change mount flags */ + if (flag & CL_UNPRIVILEGED) { + mnt->mnt.mnt_flags |= MNT_LOCK_ATIME; +diff --git a/fs/notify/fanotify/fanotify.c b/fs/notify/fanotify/fanotify.c +index 3c7053207297..bd520450c37a 100644 +--- a/fs/notify/fanotify/fanotify.c ++++ b/fs/notify/fanotify/fanotify.c +@@ -90,7 +90,7 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark, + u32 event_mask, + const void *data, int data_type) + { +- __u32 marks_mask, marks_ignored_mask; ++ __u32 marks_mask = 0, marks_ignored_mask = 0; + const struct path *path = data; + + pr_debug("%s: inode_mark=%p vfsmnt_mark=%p mask=%x data=%p" +@@ -106,24 +106,20 @@ static bool fanotify_should_send_event(struct fsnotify_mark *inode_mark, + !d_can_lookup(path->dentry)) + return false; + +- if (inode_mark && vfsmnt_mark) { +- marks_mask = (vfsmnt_mark->mask | inode_mark->mask); +- marks_ignored_mask = (vfsmnt_mark->ignored_mask | inode_mark->ignored_mask); +- } else if (inode_mark) { +- /* +- * if the event is for a child and this inode doesn't care about +- * events on the child, don't send it! +- */ +- if ((event_mask & FS_EVENT_ON_CHILD) && +- !(inode_mark->mask & FS_EVENT_ON_CHILD)) +- return false; +- marks_mask = inode_mark->mask; +- marks_ignored_mask = inode_mark->ignored_mask; +- } else if (vfsmnt_mark) { +- marks_mask = vfsmnt_mark->mask; +- marks_ignored_mask = vfsmnt_mark->ignored_mask; +- } else { +- BUG(); ++ /* ++ * if the event is for a child and this inode doesn't care about ++ * events on the child, don't send it! ++ */ ++ if (inode_mark && ++ (!(event_mask & FS_EVENT_ON_CHILD) || ++ (inode_mark->mask & FS_EVENT_ON_CHILD))) { ++ marks_mask |= inode_mark->mask; ++ marks_ignored_mask |= inode_mark->ignored_mask; ++ } ++ ++ if (vfsmnt_mark) { ++ marks_mask |= vfsmnt_mark->mask; ++ marks_ignored_mask |= vfsmnt_mark->ignored_mask; + } + + if (d_is_dir(path->dentry) && +diff --git a/fs/orangefs/super.c b/fs/orangefs/super.c +index 47ebd9bfd1a1..1997ce49ab46 100644 +--- a/fs/orangefs/super.c ++++ b/fs/orangefs/super.c +@@ -594,6 +594,11 @@ void orangefs_kill_sb(struct super_block *sb) + /* provided sb cleanup */ + kill_anon_super(sb); + ++ if (!ORANGEFS_SB(sb)) { ++ mutex_lock(&orangefs_request_mutex); ++ mutex_unlock(&orangefs_request_mutex); ++ return; ++ } + /* + * issue the unmount to userspace to tell it to remove the + * dynamic mount info it has for this superblock +diff --git a/fs/reiserfs/journal.c b/fs/reiserfs/journal.c +index 69ff280bdfe8..2be907231375 100644 +--- a/fs/reiserfs/journal.c ++++ b/fs/reiserfs/journal.c +@@ -2643,7 +2643,7 @@ static int journal_init_dev(struct super_block *super, + if (IS_ERR(journal->j_dev_bd)) { + result = PTR_ERR(journal->j_dev_bd); + journal->j_dev_bd = NULL; +- reiserfs_warning(super, ++ reiserfs_warning(super, "sh-457", + "journal_init_dev: Cannot open '%s': %i", + jdev_name, result); + return result; +diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c +index 5496b17b959c..e1cd3dcf5a03 100644 +--- a/fs/ubifs/super.c ++++ b/fs/ubifs/super.c +@@ -1739,8 +1739,11 @@ static void ubifs_remount_ro(struct ubifs_info *c) + + dbg_save_space_info(c); + +- for (i = 0; i < c->jhead_cnt; i++) +- ubifs_wbuf_sync(&c->jheads[i].wbuf); ++ for (i = 0; i < c->jhead_cnt; i++) { ++ err = ubifs_wbuf_sync(&c->jheads[i].wbuf); ++ if (err) ++ ubifs_ro_mode(c, err); ++ } + + c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY); + c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS); +@@ -1806,8 +1809,11 @@ static void ubifs_put_super(struct super_block *sb) + int err; + + /* Synchronize write-buffers */ +- for (i = 0; i < c->jhead_cnt; i++) +- ubifs_wbuf_sync(&c->jheads[i].wbuf); ++ for (i = 0; i < c->jhead_cnt; i++) { ++ err = ubifs_wbuf_sync(&c->jheads[i].wbuf); ++ if (err) ++ ubifs_ro_mode(c, err); ++ } + + /* + * We are being cleanly unmounted which means the +diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c +index 695389a4fc23..3a3be23689b3 100644 +--- a/fs/udf/unicode.c ++++ b/fs/udf/unicode.c +@@ -28,6 +28,9 @@ + + #include "udf_sb.h" + ++#define SURROGATE_MASK 0xfffff800 ++#define SURROGATE_PAIR 0x0000d800 ++ + static int udf_uni2char_utf8(wchar_t uni, + unsigned char *out, + int boundlen) +@@ -37,6 +40,9 @@ static int udf_uni2char_utf8(wchar_t uni, + if (boundlen <= 0) + return -ENAMETOOLONG; + ++ if ((uni & SURROGATE_MASK) == SURROGATE_PAIR) ++ return -EINVAL; ++ + if (uni < 0x80) { + out[u_len++] = (unsigned char)uni; + } else if (uni < 0x800) { +diff --git a/include/dt-bindings/clock/mt2701-clk.h b/include/dt-bindings/clock/mt2701-clk.h +index 551f7600ab58..24e93dfcee9f 100644 +--- a/include/dt-bindings/clock/mt2701-clk.h ++++ b/include/dt-bindings/clock/mt2701-clk.h +@@ -176,7 +176,8 @@ + #define CLK_TOP_AUD_EXT1 156 + #define CLK_TOP_AUD_EXT2 157 + #define CLK_TOP_NFI1X_PAD 158 +-#define CLK_TOP_NR 159 ++#define CLK_TOP_AXISEL_D4 159 ++#define CLK_TOP_NR 160 + + /* APMIXEDSYS */ + +diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h +index fff4cfa0c21d..eac387a3bfef 100644 +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -199,6 +199,11 @@ static inline void set_bdi_congested(struct backing_dev_info *bdi, int sync) + set_wb_congested(bdi->wb.congested, sync); + } + ++struct wb_lock_cookie { ++ bool locked; ++ unsigned long flags; ++}; ++ + #ifdef CONFIG_CGROUP_WRITEBACK + + /** +diff --git a/include/linux/backing-dev.h b/include/linux/backing-dev.h +index 16621579a3db..012adec97543 100644 +--- a/include/linux/backing-dev.h ++++ b/include/linux/backing-dev.h +@@ -342,7 +342,7 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode) + /** + * unlocked_inode_to_wb_begin - begin unlocked inode wb access transaction + * @inode: target inode +- * @lockedp: temp bool output param, to be passed to the end function ++ * @cookie: output param, to be passed to the end function + * + * The caller wants to access the wb associated with @inode but isn't + * holding inode->i_lock, mapping->tree_lock or wb->list_lock. This +@@ -350,12 +350,12 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode) + * association doesn't change until the transaction is finished with + * unlocked_inode_to_wb_end(). + * +- * The caller must call unlocked_inode_to_wb_end() with *@lockdep +- * afterwards and can't sleep during transaction. IRQ may or may not be +- * disabled on return. ++ * The caller must call unlocked_inode_to_wb_end() with *@cookie afterwards and ++ * can't sleep during the transaction. IRQs may or may not be disabled on ++ * return. + */ + static inline struct bdi_writeback * +-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) ++unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) + { + rcu_read_lock(); + +@@ -363,10 +363,10 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) + * Paired with store_release in inode_switch_wb_work_fn() and + * ensures that we see the new wb if we see cleared I_WB_SWITCH. + */ +- *lockedp = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; ++ cookie->locked = smp_load_acquire(&inode->i_state) & I_WB_SWITCH; + +- if (unlikely(*lockedp)) +- spin_lock_irq(&inode->i_mapping->tree_lock); ++ if (unlikely(cookie->locked)) ++ spin_lock_irqsave(&inode->i_mapping->tree_lock, cookie->flags); + + /* + * Protected by either !I_WB_SWITCH + rcu_read_lock() or tree_lock. +@@ -378,12 +378,13 @@ unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) + /** + * unlocked_inode_to_wb_end - end inode wb access transaction + * @inode: target inode +- * @locked: *@lockedp from unlocked_inode_to_wb_begin() ++ * @cookie: @cookie from unlocked_inode_to_wb_begin() + */ +-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) ++static inline void unlocked_inode_to_wb_end(struct inode *inode, ++ struct wb_lock_cookie *cookie) + { +- if (unlikely(locked)) +- spin_unlock_irq(&inode->i_mapping->tree_lock); ++ if (unlikely(cookie->locked)) ++ spin_unlock_irqrestore(&inode->i_mapping->tree_lock, cookie->flags); + + rcu_read_unlock(); + } +@@ -430,12 +431,13 @@ static inline struct bdi_writeback *inode_to_wb(struct inode *inode) + } + + static inline struct bdi_writeback * +-unlocked_inode_to_wb_begin(struct inode *inode, bool *lockedp) ++unlocked_inode_to_wb_begin(struct inode *inode, struct wb_lock_cookie *cookie) + { + return inode_to_wb(inode); + } + +-static inline void unlocked_inode_to_wb_end(struct inode *inode, bool locked) ++static inline void unlocked_inode_to_wb_end(struct inode *inode, ++ struct wb_lock_cookie *cookie) + { + } + +diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h +index 1c8a8a2aedf7..91072b68dc38 100644 +--- a/include/linux/blk_types.h ++++ b/include/linux/blk_types.h +@@ -20,8 +20,13 @@ typedef void (bio_end_io_t) (struct bio *); + + /* + * Block error status values. See block/blk-core:blk_errors for the details. ++ * Alpha cannot write a byte atomically, so we need to use 32-bit value. + */ ++#if defined(CONFIG_ALPHA) && !defined(__alpha_bwx__) ++typedef u32 __bitwise blk_status_t; ++#else + typedef u8 __bitwise blk_status_t; ++#endif + #define BLK_STS_OK 0 + #define BLK_STS_NOTSUPP ((__force blk_status_t)1) + #define BLK_STS_TIMEOUT ((__force blk_status_t)2) +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index be3aef6839f6..070f85d92c15 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -17,9 +17,6 @@ + */ + #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) + +-#define randomized_struct_fields_start struct { +-#define randomized_struct_fields_end }; +- + /* Clang doesn't have a way to turn it off per-function, yet. */ + #ifdef __noretpoline + #undef __noretpoline +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index a1ffbf25873f..b78b31af36f8 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -229,6 +229,9 @@ + #ifdef RANDSTRUCT_PLUGIN + #define __randomize_layout __attribute__((randomize_layout)) + #define __no_randomize_layout __attribute__((no_randomize_layout)) ++/* This anon struct can add padding, so only enable it under randstruct. */ ++#define randomized_struct_fields_start struct { ++#define randomized_struct_fields_end } __randomize_layout; + #endif + + #endif /* GCC_VERSION >= 40500 */ +@@ -243,15 +246,6 @@ + */ + #define __visible __attribute__((externally_visible)) + +-/* +- * RANDSTRUCT_PLUGIN wants to use an anonymous struct, but it is only +- * possible since GCC 4.6. To provide as much build testing coverage +- * as possible, this is used for all GCC 4.6+ builds, and not just on +- * RANDSTRUCT_PLUGIN builds. +- */ +-#define randomized_struct_fields_start struct { +-#define randomized_struct_fields_end } __randomize_layout; +- + #endif /* GCC_VERSION >= 40600 */ + + +diff --git a/include/linux/hid.h b/include/linux/hid.h +index ab05a86269dc..06e6e04e6c11 100644 +--- a/include/linux/hid.h ++++ b/include/linux/hid.h +@@ -512,6 +512,12 @@ enum hid_type { + HID_TYPE_USBNONE + }; + ++enum hid_battery_status { ++ HID_BATTERY_UNKNOWN = 0, ++ HID_BATTERY_QUERIED, /* Kernel explicitly queried battery strength */ ++ HID_BATTERY_REPORTED, /* Device sent unsolicited battery strength report */ ++}; ++ + struct hid_driver; + struct hid_ll_driver; + +@@ -554,7 +560,8 @@ struct hid_device { /* device report descriptor */ + __s32 battery_max; + __s32 battery_report_type; + __s32 battery_report_id; +- bool battery_reported; ++ enum hid_battery_status battery_status; ++ bool battery_avoid_query; + #endif + + unsigned int status; /* see STAT flags above */ +@@ -839,7 +846,7 @@ extern int hidinput_connect(struct hid_device *hid, unsigned int force); + extern void hidinput_disconnect(struct hid_device *); + + int hid_set_field(struct hid_field *, unsigned, __s32); +-int hid_input_report(struct hid_device *, int type, u8 *, int, int); ++int hid_input_report(struct hid_device *, int type, u8 *, u32, int); + int hidinput_find_field(struct hid_device *hid, unsigned int type, unsigned int code, struct hid_field **field); + struct hid_field *hidinput_get_led_field(struct hid_device *hid); + unsigned int hidinput_count_leds(struct hid_device *hid); +@@ -1086,13 +1093,13 @@ static inline void hid_hw_wait(struct hid_device *hdev) + * + * @report: the report we want to know the length + */ +-static inline int hid_report_len(struct hid_report *report) ++static inline u32 hid_report_len(struct hid_report *report) + { + /* equivalent to DIV_ROUND_UP(report->size, 8) + !!(report->id > 0) */ + return ((report->size - 1) >> 3) + 1 + (report->id > 0); + } + +-int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, int size, ++int hid_report_raw_event(struct hid_device *hid, int type, u8 *data, u32 size, + int interrupt); + + /* HID quirks API */ +diff --git a/include/linux/hmm.h b/include/linux/hmm.h +index 96e69979f84d..8198faf16ed6 100644 +--- a/include/linux/hmm.h ++++ b/include/linux/hmm.h +@@ -498,23 +498,16 @@ struct hmm_device { + struct hmm_device *hmm_device_new(void *drvdata); + void hmm_device_put(struct hmm_device *hmm_device); + #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */ +-#endif /* IS_ENABLED(CONFIG_HMM) */ + + /* Below are for HMM internal use only! Not to be used by device driver! */ +-#if IS_ENABLED(CONFIG_HMM_MIRROR) + void hmm_mm_destroy(struct mm_struct *mm); + + static inline void hmm_mm_init(struct mm_struct *mm) + { + mm->hmm = NULL; + } +-#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */ +-static inline void hmm_mm_destroy(struct mm_struct *mm) {} +-static inline void hmm_mm_init(struct mm_struct *mm) {} +-#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */ +- +- + #else /* IS_ENABLED(CONFIG_HMM) */ + static inline void hmm_mm_destroy(struct mm_struct *mm) {} + static inline void hmm_mm_init(struct mm_struct *mm) {} ++#endif /* IS_ENABLED(CONFIG_HMM) */ + #endif /* LINUX_HMM_H */ +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 0a6c71e0ad01..47f8af22f216 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -364,6 +364,7 @@ struct tty_file_private { + #define TTY_PTY_LOCK 16 /* pty private */ + #define TTY_NO_WRITE_SPLIT 17 /* Preserve write boundaries to driver */ + #define TTY_HUPPED 18 /* Post driver->hangup() */ ++#define TTY_HUPPING 19 /* Hangup in progress */ + #define TTY_LDISC_HALTED 22 /* Line discipline is halted */ + + /* Values for tty->flow_change */ +diff --git a/include/sound/pcm_oss.h b/include/sound/pcm_oss.h +index 760c969d885d..12bbf8c81112 100644 +--- a/include/sound/pcm_oss.h ++++ b/include/sound/pcm_oss.h +@@ -57,6 +57,7 @@ struct snd_pcm_oss_runtime { + char *buffer; /* vmallocated period */ + size_t buffer_used; /* used length from period buffer */ + struct mutex params_lock; ++ atomic_t rw_ref; /* concurrent read/write accesses */ + #ifdef CONFIG_SND_PCM_OSS_PLUGINS + struct snd_pcm_plugin *plugin_first; + struct snd_pcm_plugin *plugin_last; +diff --git a/include/uapi/linux/random.h b/include/uapi/linux/random.h +index c34f4490d025..26ee91300e3e 100644 +--- a/include/uapi/linux/random.h ++++ b/include/uapi/linux/random.h +@@ -35,6 +35,9 @@ + /* Clear the entropy pool and associated counters. (Superuser only.) */ + #define RNDCLEARPOOL _IO( 'R', 0x06 ) + ++/* Reseed CRNG. (Superuser only.) */ ++#define RNDRESEEDCRNG _IO( 'R', 0x07 ) ++ + struct rand_pool_info { + int entropy_count; + int buf_size; +diff --git a/ipc/shm.c b/ipc/shm.c +index b469e910f887..a9cce632ed48 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -203,6 +203,12 @@ static int __shm_open(struct vm_area_struct *vma) + if (IS_ERR(shp)) + return PTR_ERR(shp); + ++ if (shp->shm_file != sfd->file) { ++ /* ID was reused */ ++ shm_unlock(shp); ++ return -EINVAL; ++ } ++ + shp->shm_atim = ktime_get_real_seconds(); + shp->shm_lprid = task_tgid_vnr(current); + shp->shm_nattch++; +@@ -431,8 +437,9 @@ static int shm_mmap(struct file *file, struct vm_area_struct *vma) + int ret; + + /* +- * In case of remap_file_pages() emulation, the file can represent +- * removed IPC ID: propogate shm_lock() error to caller. ++ * In case of remap_file_pages() emulation, the file can represent an ++ * IPC ID that was removed, and possibly even reused by another shm ++ * segment already. Propagate this case as an error to caller. + */ + ret = __shm_open(vma); + if (ret) +@@ -456,6 +463,7 @@ static int shm_release(struct inode *ino, struct file *file) + struct shm_file_data *sfd = shm_file_data(file); + + put_ipc_ns(sfd->ns); ++ fput(sfd->file); + shm_file_data(file) = NULL; + kfree(sfd); + return 0; +@@ -1391,7 +1399,16 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, + file->f_mapping = shp->shm_file->f_mapping; + sfd->id = shp->shm_perm.id; + sfd->ns = get_ipc_ns(ns); +- sfd->file = shp->shm_file; ++ /* ++ * We need to take a reference to the real shm file to prevent the ++ * pointer from becoming stale in cases where the lifetime of the outer ++ * file extends beyond that of the shm segment. It's not usually ++ * possible, but it can happen during remap_file_pages() emulation as ++ * that unmaps the memory, then does ->mmap() via file reference only. ++ * We'll deny the ->mmap() if the shm segment was since removed, but to ++ * detect shm ID reuse we need to compare the file pointers. ++ */ ++ sfd->file = get_file(shp->shm_file); + sfd->vm_ops = NULL; + + err = security_mmap_file(file, prot, flags); +diff --git a/kernel/resource.c b/kernel/resource.c +index 9b5f04404152..7ee3dd1ad2af 100644 +--- a/kernel/resource.c ++++ b/kernel/resource.c +@@ -633,7 +633,8 @@ static int __find_resource(struct resource *root, struct resource *old, + alloc.start = constraint->alignf(constraint->alignf_data, &avail, + size, constraint->align); + alloc.end = alloc.start + size - 1; +- if (resource_contains(&avail, &alloc)) { ++ if (alloc.start <= alloc.end && ++ resource_contains(&avail, &alloc)) { + new->start = alloc.start; + new->end = alloc.end; + return 0; +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 39c221454186..36f018b15392 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1136,6 +1136,11 @@ static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) + struct buffer_page *bpage, *tmp; + long i; + ++ /* Check if the available memory is there first */ ++ i = si_mem_available(); ++ if (i < nr_pages) ++ return -ENOMEM; ++ + for (i = 0; i < nr_pages; i++) { + struct page *page; + /* +diff --git a/mm/filemap.c b/mm/filemap.c +index 594d73fef8b4..e2e738cc08b1 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -688,7 +688,7 @@ int replace_page_cache_page(struct page *old, struct page *new, gfp_t gfp_mask) + VM_BUG_ON_PAGE(!PageLocked(new), new); + VM_BUG_ON_PAGE(new->mapping, new); + +- error = radix_tree_preload(gfp_mask & ~__GFP_HIGHMEM); ++ error = radix_tree_preload(gfp_mask & GFP_RECLAIM_MASK); + if (!error) { + struct address_space *mapping = old->mapping; + void (*freepage)(struct page *); +@@ -744,7 +744,7 @@ static int __add_to_page_cache_locked(struct page *page, + return error; + } + +- error = radix_tree_maybe_preload(gfp_mask & ~__GFP_HIGHMEM); ++ error = radix_tree_maybe_preload(gfp_mask & GFP_RECLAIM_MASK); + if (error) { + if (!huge) + mem_cgroup_cancel_charge(page, memcg, false); +@@ -1486,8 +1486,7 @@ struct page *pagecache_get_page(struct address_space *mapping, pgoff_t offset, + if (fgp_flags & FGP_ACCESSED) + __SetPageReferenced(page); + +- err = add_to_page_cache_lru(page, mapping, offset, +- gfp_mask & GFP_RECLAIM_MASK); ++ err = add_to_page_cache_lru(page, mapping, offset, gfp_mask); + if (unlikely(err)) { + put_page(page); + page = NULL; +@@ -2275,7 +2274,7 @@ static int page_cache_read(struct file *file, pgoff_t offset, gfp_t gfp_mask) + if (!page) + return -ENOMEM; + +- ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask & GFP_KERNEL); ++ ret = add_to_page_cache_lru(page, mapping, offset, gfp_mask); + if (ret == 0) + ret = mapping->a_ops->readpage(file, page); + else if (ret == -EEXIST) +diff --git a/mm/hmm.c b/mm/hmm.c +index a88a847bccba..81ff1dbbf8a8 100644 +--- a/mm/hmm.c ++++ b/mm/hmm.c +@@ -277,7 +277,8 @@ static int hmm_pfns_bad(unsigned long addr, + unsigned long end, + struct mm_walk *walk) + { +- struct hmm_range *range = walk->private; ++ struct hmm_vma_walk *hmm_vma_walk = walk->private; ++ struct hmm_range *range = hmm_vma_walk->range; + hmm_pfn_t *pfns = range->pfns; + unsigned long i; + +diff --git a/mm/ksm.c b/mm/ksm.c +index 6cb60f46cce5..5b6be9eeb095 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -1133,6 +1133,13 @@ static int replace_page(struct vm_area_struct *vma, struct page *page, + } else { + newpte = pte_mkspecial(pfn_pte(page_to_pfn(kpage), + vma->vm_page_prot)); ++ /* ++ * We're replacing an anonymous page with a zero page, which is ++ * not anonymous. We need to do proper accounting otherwise we ++ * will get wrong values in /proc, and a BUG message in dmesg ++ * when tearing down the mm. ++ */ ++ dec_mm_counter(mm, MM_ANONPAGES); + } + + flush_cache_page(vma, addr, pte_pfn(*ptep)); +diff --git a/mm/page-writeback.c b/mm/page-writeback.c +index 0b9c5cbe8eba..3175ac850a53 100644 +--- a/mm/page-writeback.c ++++ b/mm/page-writeback.c +@@ -2518,13 +2518,13 @@ void account_page_redirty(struct page *page) + if (mapping && mapping_cap_account_dirty(mapping)) { + struct inode *inode = mapping->host; + struct bdi_writeback *wb; +- bool locked; ++ struct wb_lock_cookie cookie = {}; + +- wb = unlocked_inode_to_wb_begin(inode, &locked); ++ wb = unlocked_inode_to_wb_begin(inode, &cookie); + current->nr_dirtied--; + dec_node_page_state(page, NR_DIRTIED); + dec_wb_stat(wb, WB_DIRTIED); +- unlocked_inode_to_wb_end(inode, locked); ++ unlocked_inode_to_wb_end(inode, &cookie); + } + } + EXPORT_SYMBOL(account_page_redirty); +@@ -2630,15 +2630,15 @@ void cancel_dirty_page(struct page *page) + if (mapping_cap_account_dirty(mapping)) { + struct inode *inode = mapping->host; + struct bdi_writeback *wb; +- bool locked; ++ struct wb_lock_cookie cookie = {}; + + lock_page_memcg(page); +- wb = unlocked_inode_to_wb_begin(inode, &locked); ++ wb = unlocked_inode_to_wb_begin(inode, &cookie); + + if (TestClearPageDirty(page)) + account_page_cleaned(page, mapping, wb); + +- unlocked_inode_to_wb_end(inode, locked); ++ unlocked_inode_to_wb_end(inode, &cookie); + unlock_page_memcg(page); + } else { + ClearPageDirty(page); +@@ -2670,7 +2670,7 @@ int clear_page_dirty_for_io(struct page *page) + if (mapping && mapping_cap_account_dirty(mapping)) { + struct inode *inode = mapping->host; + struct bdi_writeback *wb; +- bool locked; ++ struct wb_lock_cookie cookie = {}; + + /* + * Yes, Virginia, this is indeed insane. +@@ -2707,14 +2707,14 @@ int clear_page_dirty_for_io(struct page *page) + * always locked coming in here, so we get the desired + * exclusion. + */ +- wb = unlocked_inode_to_wb_begin(inode, &locked); ++ wb = unlocked_inode_to_wb_begin(inode, &cookie); + if (TestClearPageDirty(page)) { + dec_lruvec_page_state(page, NR_FILE_DIRTY); + dec_zone_page_state(page, NR_ZONE_WRITE_PENDING); + dec_wb_stat(wb, WB_RECLAIMABLE); + ret = 1; + } +- unlocked_inode_to_wb_end(inode, locked); ++ unlocked_inode_to_wb_end(inode, &cookie); + return ret; + } + return TestClearPageDirty(page); +diff --git a/mm/slab.c b/mm/slab.c +index 966839a1ac2c..1bfc3d847a0a 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -4080,7 +4080,8 @@ static void cache_reap(struct work_struct *w) + next_reap_node(); + out: + /* Set up the next iteration */ +- schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_AC)); ++ schedule_delayed_work_on(smp_processor_id(), work, ++ round_jiffies_relative(REAPTIMEOUT_AC)); + } + + #ifdef CONFIG_SLABINFO +diff --git a/net/dsa/tag_brcm.c b/net/dsa/tag_brcm.c +index dbb016434ace..de92fc1fc3be 100644 +--- a/net/dsa/tag_brcm.c ++++ b/net/dsa/tag_brcm.c +@@ -121,6 +121,9 @@ static struct sk_buff *brcm_tag_rcv(struct sk_buff *skb, struct net_device *dev, + if (source_port >= ds->num_ports || !ds->ports[source_port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + /* Remove Broadcom tag and update checksum */ + skb_pull_rcsum(skb, BRCM_TAG_LEN); + +diff --git a/net/dsa/tag_dsa.c b/net/dsa/tag_dsa.c +index fbf9ca954773..b3008a9bacf3 100644 +--- a/net/dsa/tag_dsa.c ++++ b/net/dsa/tag_dsa.c +@@ -107,6 +107,9 @@ static struct sk_buff *dsa_rcv(struct sk_buff *skb, struct net_device *dev, + if (source_port >= ds->num_ports || !ds->ports[source_port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + /* + * Convert the DSA header to an 802.1q header if the 'tagged' + * bit in the DSA header is set. If the 'tagged' bit is clear, +diff --git a/net/dsa/tag_edsa.c b/net/dsa/tag_edsa.c +index 76367ba1b2e2..c86b6d90576d 100644 +--- a/net/dsa/tag_edsa.c ++++ b/net/dsa/tag_edsa.c +@@ -120,6 +120,9 @@ static struct sk_buff *edsa_rcv(struct sk_buff *skb, struct net_device *dev, + if (source_port >= ds->num_ports || !ds->ports[source_port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + /* + * If the 'tagged' bit is set, convert the DSA tag to a 802.1q + * tag and delete the ethertype part. If the 'tagged' bit is +diff --git a/net/dsa/tag_ksz.c b/net/dsa/tag_ksz.c +index 010ca0a336c4..6c894692b9cd 100644 +--- a/net/dsa/tag_ksz.c ++++ b/net/dsa/tag_ksz.c +@@ -92,6 +92,9 @@ static struct sk_buff *ksz_rcv(struct sk_buff *skb, struct net_device *dev, + if (source_port >= ds->num_ports || !ds->ports[source_port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + pskb_trim_rcsum(skb, skb->len - KSZ_EGRESS_TAG_LEN); + + skb->dev = ds->ports[source_port].netdev; +diff --git a/net/dsa/tag_lan9303.c b/net/dsa/tag_lan9303.c +index 0b9826105e42..2d1603009e16 100644 +--- a/net/dsa/tag_lan9303.c ++++ b/net/dsa/tag_lan9303.c +@@ -108,6 +108,9 @@ static struct sk_buff *lan9303_rcv(struct sk_buff *skb, struct net_device *dev, + return NULL; + } + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + if (!ds->ports[source_port].netdev) { + dev_warn_ratelimited(&dev->dev, "Dropping packet due to invalid netdev or device\n"); + return NULL; +diff --git a/net/dsa/tag_mtk.c b/net/dsa/tag_mtk.c +index ec8ee5f43255..5c471854412d 100644 +--- a/net/dsa/tag_mtk.c ++++ b/net/dsa/tag_mtk.c +@@ -81,6 +81,9 @@ static struct sk_buff *mtk_tag_rcv(struct sk_buff *skb, struct net_device *dev, + if (!ds->ports[port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(port))) ++ return NULL; ++ + skb->dev = ds->ports[port].netdev; + + return skb; +diff --git a/net/dsa/tag_qca.c b/net/dsa/tag_qca.c +index 1d4c70711c0f..b8c05f1cf47d 100644 +--- a/net/dsa/tag_qca.c ++++ b/net/dsa/tag_qca.c +@@ -104,6 +104,9 @@ static struct sk_buff *qca_tag_rcv(struct sk_buff *skb, struct net_device *dev, + if (!ds->ports[port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(port))) ++ return NULL; ++ + /* Update skb & forward the frame accordingly */ + skb->dev = ds->ports[port].netdev; + +diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c +index d2fd4923aa3e..fcc9aa72877d 100644 +--- a/net/dsa/tag_trailer.c ++++ b/net/dsa/tag_trailer.c +@@ -76,6 +76,9 @@ static struct sk_buff *trailer_rcv(struct sk_buff *skb, struct net_device *dev, + if (source_port >= ds->num_ports || !ds->ports[source_port].netdev) + return NULL; + ++ if (unlikely(ds->cpu_port_mask & BIT(source_port))) ++ return NULL; ++ + pskb_trim_rcsum(skb, skb->len - 4); + + skb->dev = ds->ports[source_port].netdev; +diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c +index 61a504fb1ae2..34f94052c519 100644 +--- a/net/sunrpc/rpc_pipe.c ++++ b/net/sunrpc/rpc_pipe.c +@@ -1375,6 +1375,7 @@ rpc_gssd_dummy_depopulate(struct dentry *pipe_dentry) + struct dentry *clnt_dir = pipe_dentry->d_parent; + struct dentry *gssd_dir = clnt_dir->d_parent; + ++ dget(pipe_dentry); + __rpc_rmpipe(d_inode(clnt_dir), pipe_dentry); + __rpc_depopulate(clnt_dir, gssd_dummy_info_file, 0, 1); + __rpc_depopulate(gssd_dir, gssd_dummy_clnt_dir, 0, 1); +diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c +index d6e9a18fd821..b4f954e6d2db 100644 +--- a/sound/core/oss/pcm_oss.c ++++ b/sound/core/oss/pcm_oss.c +@@ -823,8 +823,25 @@ static int choose_rate(struct snd_pcm_substream *substream, + return snd_pcm_hw_param_near(substream, params, SNDRV_PCM_HW_PARAM_RATE, best_rate, NULL); + } + +-static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream, +- bool trylock) ++/* parameter locking: returns immediately if tried during streaming */ ++static int lock_params(struct snd_pcm_runtime *runtime) ++{ ++ if (mutex_lock_interruptible(&runtime->oss.params_lock)) ++ return -ERESTARTSYS; ++ if (atomic_read(&runtime->oss.rw_ref)) { ++ mutex_unlock(&runtime->oss.params_lock); ++ return -EBUSY; ++ } ++ return 0; ++} ++ ++static void unlock_params(struct snd_pcm_runtime *runtime) ++{ ++ mutex_unlock(&runtime->oss.params_lock); ++} ++ ++/* call with params_lock held */ ++static int snd_pcm_oss_change_params_locked(struct snd_pcm_substream *substream) + { + struct snd_pcm_runtime *runtime = substream->runtime; + struct snd_pcm_hw_params *params, *sparams; +@@ -838,11 +855,8 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream, + const struct snd_mask *sformat_mask; + struct snd_mask mask; + +- if (trylock) { +- if (!(mutex_trylock(&runtime->oss.params_lock))) +- return -EAGAIN; +- } else if (mutex_lock_interruptible(&runtime->oss.params_lock)) +- return -EINTR; ++ if (!runtime->oss.params) ++ return 0; + sw_params = kzalloc(sizeof(*sw_params), GFP_KERNEL); + params = kmalloc(sizeof(*params), GFP_KERNEL); + sparams = kmalloc(sizeof(*sparams), GFP_KERNEL); +@@ -1068,6 +1082,23 @@ static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream, + kfree(sw_params); + kfree(params); + kfree(sparams); ++ return err; ++} ++ ++/* this one takes the lock by itself */ ++static int snd_pcm_oss_change_params(struct snd_pcm_substream *substream, ++ bool trylock) ++{ ++ struct snd_pcm_runtime *runtime = substream->runtime; ++ int err; ++ ++ if (trylock) { ++ if (!(mutex_trylock(&runtime->oss.params_lock))) ++ return -EAGAIN; ++ } else if (mutex_lock_interruptible(&runtime->oss.params_lock)) ++ return -ERESTARTSYS; ++ ++ err = snd_pcm_oss_change_params_locked(substream); + mutex_unlock(&runtime->oss.params_lock); + return err; + } +@@ -1096,6 +1127,10 @@ static int snd_pcm_oss_get_active_substream(struct snd_pcm_oss_file *pcm_oss_fil + return 0; + } + ++/* call with params_lock held */ ++/* NOTE: this always call PREPARE unconditionally no matter whether ++ * runtime->oss.prepare is set or not ++ */ + static int snd_pcm_oss_prepare(struct snd_pcm_substream *substream) + { + int err; +@@ -1120,14 +1155,35 @@ static int snd_pcm_oss_make_ready(struct snd_pcm_substream *substream) + struct snd_pcm_runtime *runtime; + int err; + +- if (substream == NULL) +- return 0; + runtime = substream->runtime; + if (runtime->oss.params) { + err = snd_pcm_oss_change_params(substream, false); + if (err < 0) + return err; + } ++ if (runtime->oss.prepare) { ++ if (mutex_lock_interruptible(&runtime->oss.params_lock)) ++ return -ERESTARTSYS; ++ err = snd_pcm_oss_prepare(substream); ++ mutex_unlock(&runtime->oss.params_lock); ++ if (err < 0) ++ return err; ++ } ++ return 0; ++} ++ ++/* call with params_lock held */ ++static int snd_pcm_oss_make_ready_locked(struct snd_pcm_substream *substream) ++{ ++ struct snd_pcm_runtime *runtime; ++ int err; ++ ++ runtime = substream->runtime; ++ if (runtime->oss.params) { ++ err = snd_pcm_oss_change_params_locked(substream); ++ if (err < 0) ++ return err; ++ } + if (runtime->oss.prepare) { + err = snd_pcm_oss_prepare(substream); + if (err < 0) +@@ -1332,13 +1388,15 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha + if (atomic_read(&substream->mmap_count)) + return -ENXIO; + +- if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) +- return tmp; ++ atomic_inc(&runtime->oss.rw_ref); + while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } ++ tmp = snd_pcm_oss_make_ready_locked(substream); ++ if (tmp < 0) ++ goto err; + if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { + tmp = bytes; + if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes) +@@ -1394,6 +1452,7 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha + } + tmp = 0; + } ++ atomic_dec(&runtime->oss.rw_ref); + return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; + } + +@@ -1439,13 +1498,15 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use + if (atomic_read(&substream->mmap_count)) + return -ENXIO; + +- if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) +- return tmp; ++ atomic_inc(&runtime->oss.rw_ref); + while (bytes > 0) { + if (mutex_lock_interruptible(&runtime->oss.params_lock)) { + tmp = -ERESTARTSYS; + break; + } ++ tmp = snd_pcm_oss_make_ready_locked(substream); ++ if (tmp < 0) ++ goto err; + if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { + if (runtime->oss.buffer_used == 0) { + tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1); +@@ -1486,6 +1547,7 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use + } + tmp = 0; + } ++ atomic_dec(&runtime->oss.rw_ref); + return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; + } + +@@ -1501,10 +1563,12 @@ static int snd_pcm_oss_reset(struct snd_pcm_oss_file *pcm_oss_file) + continue; + runtime = substream->runtime; + snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); ++ mutex_lock(&runtime->oss.params_lock); + runtime->oss.prepare = 1; + runtime->oss.buffer_used = 0; + runtime->oss.prev_hw_ptr_period = 0; + runtime->oss.period_ptr = 0; ++ mutex_unlock(&runtime->oss.params_lock); + } + return 0; + } +@@ -1590,9 +1654,13 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + goto __direct; + if ((err = snd_pcm_oss_make_ready(substream)) < 0) + return err; ++ atomic_inc(&runtime->oss.rw_ref); ++ if (mutex_lock_interruptible(&runtime->oss.params_lock)) { ++ atomic_dec(&runtime->oss.rw_ref); ++ return -ERESTARTSYS; ++ } + format = snd_pcm_oss_format_from(runtime->oss.format); + width = snd_pcm_format_physical_width(format); +- mutex_lock(&runtime->oss.params_lock); + if (runtime->oss.buffer_used > 0) { + #ifdef OSS_DEBUG + pcm_dbg(substream->pcm, "sync: buffer_used\n"); +@@ -1602,10 +1670,8 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + runtime->oss.buffer + runtime->oss.buffer_used, + size); + err = snd_pcm_oss_sync1(substream, runtime->oss.period_bytes); +- if (err < 0) { +- mutex_unlock(&runtime->oss.params_lock); +- return err; +- } ++ if (err < 0) ++ goto unlock; + } else if (runtime->oss.period_ptr > 0) { + #ifdef OSS_DEBUG + pcm_dbg(substream->pcm, "sync: period_ptr\n"); +@@ -1615,10 +1681,8 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + runtime->oss.buffer, + size * 8 / width); + err = snd_pcm_oss_sync1(substream, size); +- if (err < 0) { +- mutex_unlock(&runtime->oss.params_lock); +- return err; +- } ++ if (err < 0) ++ goto unlock; + } + /* + * The ALSA's period might be a bit large than OSS one. +@@ -1632,7 +1696,11 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + else if (runtime->access == SNDRV_PCM_ACCESS_RW_NONINTERLEAVED) + snd_pcm_lib_writev(substream, NULL, size); + } ++unlock: + mutex_unlock(&runtime->oss.params_lock); ++ atomic_dec(&runtime->oss.rw_ref); ++ if (err < 0) ++ return err; + /* + * finish sync: drain the buffer + */ +@@ -1643,7 +1711,9 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + substream->f_flags = saved_f_flags; + if (err < 0) + return err; ++ mutex_lock(&runtime->oss.params_lock); + runtime->oss.prepare = 1; ++ mutex_unlock(&runtime->oss.params_lock); + } + + substream = pcm_oss_file->streams[SNDRV_PCM_STREAM_CAPTURE]; +@@ -1654,8 +1724,10 @@ static int snd_pcm_oss_sync(struct snd_pcm_oss_file *pcm_oss_file) + err = snd_pcm_kernel_ioctl(substream, SNDRV_PCM_IOCTL_DROP, NULL); + if (err < 0) + return err; ++ mutex_lock(&runtime->oss.params_lock); + runtime->oss.buffer_used = 0; + runtime->oss.prepare = 1; ++ mutex_unlock(&runtime->oss.params_lock); + } + return 0; + } +@@ -1667,6 +1739,8 @@ static int snd_pcm_oss_set_rate(struct snd_pcm_oss_file *pcm_oss_file, int rate) + for (idx = 1; idx >= 0; --idx) { + struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; + struct snd_pcm_runtime *runtime; ++ int err; ++ + if (substream == NULL) + continue; + runtime = substream->runtime; +@@ -1674,10 +1748,14 @@ static int snd_pcm_oss_set_rate(struct snd_pcm_oss_file *pcm_oss_file, int rate) + rate = 1000; + else if (rate > 192000) + rate = 192000; ++ err = lock_params(runtime); ++ if (err < 0) ++ return err; + if (runtime->oss.rate != rate) { + runtime->oss.params = 1; + runtime->oss.rate = rate; + } ++ unlock_params(runtime); + } + return snd_pcm_oss_get_rate(pcm_oss_file); + } +@@ -1702,13 +1780,19 @@ static int snd_pcm_oss_set_channels(struct snd_pcm_oss_file *pcm_oss_file, unsig + for (idx = 1; idx >= 0; --idx) { + struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; + struct snd_pcm_runtime *runtime; ++ int err; ++ + if (substream == NULL) + continue; + runtime = substream->runtime; ++ err = lock_params(runtime); ++ if (err < 0) ++ return err; + if (runtime->oss.channels != channels) { + runtime->oss.params = 1; + runtime->oss.channels = channels; + } ++ unlock_params(runtime); + } + return snd_pcm_oss_get_channels(pcm_oss_file); + } +@@ -1781,6 +1865,7 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file) + static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int format) + { + int formats, idx; ++ int err; + + if (format != AFMT_QUERY) { + formats = snd_pcm_oss_get_formats(pcm_oss_file); +@@ -1794,10 +1879,14 @@ static int snd_pcm_oss_set_format(struct snd_pcm_oss_file *pcm_oss_file, int for + if (substream == NULL) + continue; + runtime = substream->runtime; ++ err = lock_params(runtime); ++ if (err < 0) ++ return err; + if (runtime->oss.format != format) { + runtime->oss.params = 1; + runtime->oss.format = format; + } ++ unlock_params(runtime); + } + } + return snd_pcm_oss_get_format(pcm_oss_file); +@@ -1817,8 +1906,6 @@ static int snd_pcm_oss_set_subdivide1(struct snd_pcm_substream *substream, int s + { + struct snd_pcm_runtime *runtime; + +- if (substream == NULL) +- return 0; + runtime = substream->runtime; + if (subdivide == 0) { + subdivide = runtime->oss.subdivision; +@@ -1842,9 +1929,17 @@ static int snd_pcm_oss_set_subdivide(struct snd_pcm_oss_file *pcm_oss_file, int + + for (idx = 1; idx >= 0; --idx) { + struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; ++ struct snd_pcm_runtime *runtime; ++ + if (substream == NULL) + continue; +- if ((err = snd_pcm_oss_set_subdivide1(substream, subdivide)) < 0) ++ runtime = substream->runtime; ++ err = lock_params(runtime); ++ if (err < 0) ++ return err; ++ err = snd_pcm_oss_set_subdivide1(substream, subdivide); ++ unlock_params(runtime); ++ if (err < 0) + return err; + } + return err; +@@ -1854,8 +1949,6 @@ static int snd_pcm_oss_set_fragment1(struct snd_pcm_substream *substream, unsign + { + struct snd_pcm_runtime *runtime; + +- if (substream == NULL) +- return 0; + runtime = substream->runtime; + if (runtime->oss.subdivision || runtime->oss.fragshift) + return -EINVAL; +@@ -1875,9 +1968,17 @@ static int snd_pcm_oss_set_fragment(struct snd_pcm_oss_file *pcm_oss_file, unsig + + for (idx = 1; idx >= 0; --idx) { + struct snd_pcm_substream *substream = pcm_oss_file->streams[idx]; ++ struct snd_pcm_runtime *runtime; ++ + if (substream == NULL) + continue; +- if ((err = snd_pcm_oss_set_fragment1(substream, val)) < 0) ++ runtime = substream->runtime; ++ err = lock_params(runtime); ++ if (err < 0) ++ return err; ++ err = snd_pcm_oss_set_fragment1(substream, val); ++ unlock_params(runtime); ++ if (err < 0) + return err; + } + return err; +@@ -1961,6 +2062,9 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr + } + if (psubstream) { + runtime = psubstream->runtime; ++ cmd = 0; ++ if (mutex_lock_interruptible(&runtime->oss.params_lock)) ++ return -ERESTARTSYS; + if (trigger & PCM_ENABLE_OUTPUT) { + if (runtime->oss.trigger) + goto _skip1; +@@ -1978,13 +2082,19 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr + cmd = SNDRV_PCM_IOCTL_DROP; + runtime->oss.prepare = 1; + } +- err = snd_pcm_kernel_ioctl(psubstream, cmd, NULL); +- if (err < 0) +- return err; +- } + _skip1: ++ mutex_unlock(&runtime->oss.params_lock); ++ if (cmd) { ++ err = snd_pcm_kernel_ioctl(psubstream, cmd, NULL); ++ if (err < 0) ++ return err; ++ } ++ } + if (csubstream) { + runtime = csubstream->runtime; ++ cmd = 0; ++ if (mutex_lock_interruptible(&runtime->oss.params_lock)) ++ return -ERESTARTSYS; + if (trigger & PCM_ENABLE_INPUT) { + if (runtime->oss.trigger) + goto _skip2; +@@ -1999,11 +2109,14 @@ static int snd_pcm_oss_set_trigger(struct snd_pcm_oss_file *pcm_oss_file, int tr + cmd = SNDRV_PCM_IOCTL_DROP; + runtime->oss.prepare = 1; + } +- err = snd_pcm_kernel_ioctl(csubstream, cmd, NULL); +- if (err < 0) +- return err; +- } + _skip2: ++ mutex_unlock(&runtime->oss.params_lock); ++ if (cmd) { ++ err = snd_pcm_kernel_ioctl(csubstream, cmd, NULL); ++ if (err < 0) ++ return err; ++ } ++ } + return 0; + } + +@@ -2255,6 +2368,7 @@ static void snd_pcm_oss_init_substream(struct snd_pcm_substream *substream, + runtime->oss.maxfrags = 0; + runtime->oss.subdivision = 0; + substream->pcm_release = snd_pcm_oss_release_substream; ++ atomic_set(&runtime->oss.rw_ref, 0); + } + + static int snd_pcm_oss_release_file(struct snd_pcm_oss_file *pcm_oss_file) +diff --git a/sound/core/pcm.c b/sound/core/pcm.c +index 7fea724d093a..e8dc1a5afe66 100644 +--- a/sound/core/pcm.c ++++ b/sound/core/pcm.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -1050,8 +1051,13 @@ void snd_pcm_detach_substream(struct snd_pcm_substream *substream) + snd_free_pages((void*)runtime->control, + PAGE_ALIGN(sizeof(struct snd_pcm_mmap_control))); + kfree(runtime->hw_constraints.rules); +- kfree(runtime); ++ /* Avoid concurrent access to runtime via PCM timer interface */ ++ if (substream->timer) ++ spin_lock_irq(&substream->timer->lock); + substream->runtime = NULL; ++ if (substream->timer) ++ spin_unlock_irq(&substream->timer->lock); ++ kfree(runtime); + put_pid(substream->pid); + substream->pid = NULL; + substream->pstr->substream_opened--; +diff --git a/sound/core/rawmidi_compat.c b/sound/core/rawmidi_compat.c +index f69764d7cdd7..e30e30ba6e39 100644 +--- a/sound/core/rawmidi_compat.c ++++ b/sound/core/rawmidi_compat.c +@@ -36,8 +36,6 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile, + struct snd_rawmidi_params params; + unsigned int val; + +- if (rfile->output == NULL) +- return -EINVAL; + if (get_user(params.stream, &src->stream) || + get_user(params.buffer_size, &src->buffer_size) || + get_user(params.avail_min, &src->avail_min) || +@@ -46,8 +44,12 @@ static int snd_rawmidi_ioctl_params_compat(struct snd_rawmidi_file *rfile, + params.no_active_sensing = val; + switch (params.stream) { + case SNDRV_RAWMIDI_STREAM_OUTPUT: ++ if (!rfile->output) ++ return -EINVAL; + return snd_rawmidi_output_params(rfile->output, ¶ms); + case SNDRV_RAWMIDI_STREAM_INPUT: ++ if (!rfile->input) ++ return -EINVAL; + return snd_rawmidi_input_params(rfile->input, ¶ms); + } + return -EINVAL; +@@ -67,16 +69,18 @@ static int snd_rawmidi_ioctl_status_compat(struct snd_rawmidi_file *rfile, + int err; + struct snd_rawmidi_status status; + +- if (rfile->output == NULL) +- return -EINVAL; + if (get_user(status.stream, &src->stream)) + return -EFAULT; + + switch (status.stream) { + case SNDRV_RAWMIDI_STREAM_OUTPUT: ++ if (!rfile->output) ++ return -EINVAL; + err = snd_rawmidi_output_status(rfile->output, &status); + break; + case SNDRV_RAWMIDI_STREAM_INPUT: ++ if (!rfile->input) ++ return -EINVAL; + err = snd_rawmidi_input_status(rfile->input, &status); + break; + default: +@@ -112,16 +116,18 @@ static int snd_rawmidi_ioctl_status_x32(struct snd_rawmidi_file *rfile, + int err; + struct snd_rawmidi_status status; + +- if (rfile->output == NULL) +- return -EINVAL; + if (get_user(status.stream, &src->stream)) + return -EFAULT; + + switch (status.stream) { + case SNDRV_RAWMIDI_STREAM_OUTPUT: ++ if (!rfile->output) ++ return -EINVAL; + err = snd_rawmidi_output_status(rfile->output, &status); + break; + case SNDRV_RAWMIDI_STREAM_INPUT: ++ if (!rfile->input) ++ return -EINVAL; + err = snd_rawmidi_input_status(rfile->input, &status); + break; + default: +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index c507c69029e3..738e1fe90312 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -1645,7 +1645,8 @@ static void azx_check_snoop_available(struct azx *chip) + */ + u8 val; + pci_read_config_byte(chip->pci, 0x42, &val); +- if (!(val & 0x80) && chip->pci->revision == 0x30) ++ if (!(val & 0x80) && (chip->pci->revision == 0x30 || ++ chip->pci->revision == 0x20)) + snoop = false; + } + +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index e44a9758f2eb..b1b28c6928a7 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6225,6 +6225,8 @@ static const struct hda_fixup alc269_fixups[] = { + { 0x19, 0x01a1913c }, /* use as headset mic, without its own jack detect */ + { } + }, ++ .chained = true, ++ .chain_id = ALC269_FIXUP_HEADSET_MIC + }, + }; + +@@ -6428,6 +6430,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), ++ SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), +diff --git a/sound/soc/codecs/ssm2602.c b/sound/soc/codecs/ssm2602.c +index 9b341c23f62b..5e80867d09ef 100644 +--- a/sound/soc/codecs/ssm2602.c ++++ b/sound/soc/codecs/ssm2602.c +@@ -54,10 +54,17 @@ struct ssm2602_priv { + * using 2 wire for device control, so we cache them instead. + * There is no point in caching the reset register + */ +-static const u16 ssm2602_reg[SSM2602_CACHEREGNUM] = { +- 0x0097, 0x0097, 0x0079, 0x0079, +- 0x000a, 0x0008, 0x009f, 0x000a, +- 0x0000, 0x0000 ++static const struct reg_default ssm2602_reg[SSM2602_CACHEREGNUM] = { ++ { .reg = 0x00, .def = 0x0097 }, ++ { .reg = 0x01, .def = 0x0097 }, ++ { .reg = 0x02, .def = 0x0079 }, ++ { .reg = 0x03, .def = 0x0079 }, ++ { .reg = 0x04, .def = 0x000a }, ++ { .reg = 0x05, .def = 0x0008 }, ++ { .reg = 0x06, .def = 0x009f }, ++ { .reg = 0x07, .def = 0x000a }, ++ { .reg = 0x08, .def = 0x0000 }, ++ { .reg = 0x09, .def = 0x0000 } + }; + + +@@ -620,8 +627,8 @@ const struct regmap_config ssm2602_regmap_config = { + .volatile_reg = ssm2602_register_volatile, + + .cache_type = REGCACHE_RBTREE, +- .reg_defaults_raw = ssm2602_reg, +- .num_reg_defaults_raw = ARRAY_SIZE(ssm2602_reg), ++ .reg_defaults = ssm2602_reg, ++ .num_reg_defaults = ARRAY_SIZE(ssm2602_reg), + }; + EXPORT_SYMBOL_GPL(ssm2602_regmap_config); + +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 01a50413c66f..782c580b7aa3 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -523,6 +523,7 @@ static void remove_widget(struct snd_soc_component *comp, + kfree(se->dobj.control.dtexts[j]); + + kfree(se); ++ kfree(w->kcontrol_news[i].name); + } + kfree(w->kcontrol_news); + } else { +@@ -540,6 +541,7 @@ static void remove_widget(struct snd_soc_component *comp, + */ + kfree((void *)kcontrol->private_value); + snd_ctl_remove(card, kcontrol); ++ kfree(w->kcontrol_news[i].name); + } + kfree(w->kcontrol_news); + } +@@ -1233,7 +1235,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create( + dev_dbg(tplg->dev, " adding DAPM widget mixer control %s at %d\n", + mc->hdr.name, i); + +- kc[i].name = mc->hdr.name; ++ kc[i].name = kstrdup(mc->hdr.name, GFP_KERNEL); ++ if (kc[i].name == NULL) ++ goto err_str; + kc[i].private_value = (long)sm; + kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER; + kc[i].access = mc->hdr.access; +@@ -1278,8 +1282,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create( + err_str: + kfree(sm); + err: +- for (--i; i >= 0; i--) ++ for (--i; i >= 0; i--) { + kfree((void *)kc[i].private_value); ++ kfree(kc[i].name); ++ } + kfree(kc); + return NULL; + } +@@ -1310,7 +1316,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create( + dev_dbg(tplg->dev, " adding DAPM widget enum control %s\n", + ec->hdr.name); + +- kc[i].name = ec->hdr.name; ++ kc[i].name = kstrdup(ec->hdr.name, GFP_KERNEL); ++ if (kc[i].name == NULL) ++ goto err_se; + kc[i].private_value = (long)se; + kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER; + kc[i].access = ec->hdr.access; +@@ -1386,6 +1394,7 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_denum_create( + kfree(se->dobj.control.dtexts[j]); + + kfree(se); ++ kfree(kc[i].name); + } + err: + kfree(kc); +@@ -1424,7 +1433,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create( + "ASoC: adding bytes kcontrol %s with access 0x%x\n", + be->hdr.name, be->hdr.access); + +- kc[i].name = be->hdr.name; ++ kc[i].name = kstrdup(be->hdr.name, GFP_KERNEL); ++ if (kc[i].name == NULL) ++ goto err; + kc[i].private_value = (long)sbe; + kc[i].iface = SNDRV_CTL_ELEM_IFACE_MIXER; + kc[i].access = be->hdr.access; +@@ -1454,8 +1465,10 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dbytes_create( + return kc; + + err: +- for (--i; i >= 0; i--) ++ for (--i; i >= 0; i--) { + kfree((void *)kc[i].private_value); ++ kfree(kc[i].name); ++ } + + kfree(kc); + return NULL; +diff --git a/sound/usb/line6/midi.c b/sound/usb/line6/midi.c +index 1d3a23b02d68..b5d62b5f59ba 100644 +--- a/sound/usb/line6/midi.c ++++ b/sound/usb/line6/midi.c +@@ -125,7 +125,7 @@ static int send_midi_async(struct usb_line6 *line6, unsigned char *data, + } + + usb_fill_int_urb(urb, line6->usbdev, +- usb_sndbulkpipe(line6->usbdev, ++ usb_sndintpipe(line6->usbdev, + line6->properties->ep_ctrl_w), + transfer_buffer, length, midi_sent, line6, + line6->interval); +diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c +index 59ce2fb49821..5a11f4d3972c 100644 +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -309,21 +309,24 @@ static int vgic_copy_lpi_list(struct kvm_vcpu *vcpu, u32 **intid_ptr) + struct vgic_dist *dist = &vcpu->kvm->arch.vgic; + struct vgic_irq *irq; + u32 *intids; +- int irq_count = dist->lpi_list_count, i = 0; ++ int irq_count, i = 0; + + /* +- * We use the current value of the list length, which may change +- * after the kmalloc. We don't care, because the guest shouldn't +- * change anything while the command handling is still running, +- * and in the worst case we would miss a new IRQ, which one wouldn't +- * expect to be covered by this command anyway. ++ * There is an obvious race between allocating the array and LPIs ++ * being mapped/unmapped. If we ended up here as a result of a ++ * command, we're safe (locks are held, preventing another ++ * command). If coming from another path (such as enabling LPIs), ++ * we must be careful not to overrun the array. + */ ++ irq_count = READ_ONCE(dist->lpi_list_count); + intids = kmalloc_array(irq_count, sizeof(intids[0]), GFP_KERNEL); + if (!intids) + return -ENOMEM; + + spin_lock(&dist->lpi_list_lock); + list_for_each_entry(irq, &dist->lpi_list_head, lpi_list) { ++ if (i == irq_count) ++ break; + /* We don't need to "get" the IRQ, as we hold the list lock. */ + if (irq->target_vcpu != vcpu) + continue; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.36-37.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.36-37.patch new file mode 100644 index 000000000000..aba40406ec6a --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.36-37.patch @@ -0,0 +1,9466 @@ +diff --git a/Documentation/device-mapper/thin-provisioning.txt b/Documentation/device-mapper/thin-provisioning.txt +index 1699a55b7b70..ef639960b272 100644 +--- a/Documentation/device-mapper/thin-provisioning.txt ++++ b/Documentation/device-mapper/thin-provisioning.txt +@@ -112,9 +112,11 @@ $low_water_mark is expressed in blocks of size $data_block_size. If + free space on the data device drops below this level then a dm event + will be triggered which a userspace daemon should catch allowing it to + extend the pool device. Only one such event will be sent. +-Resuming a device with a new table itself triggers an event so the +-userspace daemon can use this to detect a situation where a new table +-already exceeds the threshold. ++ ++No special event is triggered if a just resumed device's free space is below ++the low water mark. However, resuming a device always triggers an ++event; a userspace daemon should verify that free space exceeds the low ++water mark when handling this event. + + A low water mark for the metadata device is maintained in the kernel and + will trigger a dm event if free space on the metadata device drops below +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index e63a35fafef0..0f9089416b4c 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1837,6 +1837,7 @@ registers, find a list below: + PPC | KVM_REG_PPC_DBSR | 32 + PPC | KVM_REG_PPC_TIDR | 64 + PPC | KVM_REG_PPC_PSSCR | 64 ++ PPC | KVM_REG_PPC_DEC_EXPIRY | 64 + PPC | KVM_REG_PPC_TM_GPR0 | 64 + ... + PPC | KVM_REG_PPC_TM_GPR31 | 64 +diff --git a/Makefile b/Makefile +index 0a1f941899f4..ee330f5449e6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 36 ++SUBLEVEL = 37 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/include/asm/spinlock.h b/arch/arm64/include/asm/spinlock.h +index 95ad7102b63c..82375b896be5 100644 +--- a/arch/arm64/include/asm/spinlock.h ++++ b/arch/arm64/include/asm/spinlock.h +@@ -89,8 +89,8 @@ static inline int arch_spin_trylock(arch_spinlock_t *lock) + " cbnz %w1, 1f\n" + " add %w1, %w0, %3\n" + " casa %w0, %w1, %2\n" +- " and %w1, %w1, #0xffff\n" +- " eor %w1, %w1, %w0, lsr #16\n" ++ " sub %w1, %w1, %3\n" ++ " eor %w1, %w1, %w0\n" + "1:") + : "=&r" (lockval), "=&r" (tmp), "+Q" (*lock) + : "I" (1 << TICKET_SHIFT) +diff --git a/arch/mips/boot/compressed/Makefile b/arch/mips/boot/compressed/Makefile +index c675eece389a..adce180f3ee4 100644 +--- a/arch/mips/boot/compressed/Makefile ++++ b/arch/mips/boot/compressed/Makefile +@@ -133,4 +133,8 @@ vmlinuz.srec: vmlinuz + uzImage.bin: vmlinuz.bin FORCE + $(call if_changed,uimage,none) + +-clean-files := $(objtree)/vmlinuz $(objtree)/vmlinuz.{32,ecoff,bin,srec} ++clean-files += $(objtree)/vmlinuz ++clean-files += $(objtree)/vmlinuz.32 ++clean-files += $(objtree)/vmlinuz.ecoff ++clean-files += $(objtree)/vmlinuz.bin ++clean-files += $(objtree)/vmlinuz.srec +diff --git a/arch/mips/generic/irq.c b/arch/mips/generic/irq.c +index 394f8161e462..cb7fdaeef426 100644 +--- a/arch/mips/generic/irq.c ++++ b/arch/mips/generic/irq.c +@@ -22,10 +22,10 @@ int get_c0_fdc_int(void) + { + int mips_cpu_fdc_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_fdc_irq = gic_get_c0_fdc_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else if (cp0_fdc_irq >= 0) + mips_cpu_fdc_irq = MIPS_CPU_IRQ_BASE + cp0_fdc_irq; + else +@@ -38,10 +38,10 @@ int get_c0_perfcount_int(void) + { + int mips_cpu_perf_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_perf_irq = gic_get_c0_perfcount_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else if (cp0_perfcount_irq >= 0) + mips_cpu_perf_irq = MIPS_CPU_IRQ_BASE + cp0_perfcount_irq; + else +@@ -54,10 +54,10 @@ unsigned int get_c0_compare_int(void) + { + int mips_cpu_timer_irq; + +- if (cpu_has_veic) +- panic("Unimplemented!"); +- else if (mips_gic_present()) ++ if (mips_gic_present()) + mips_cpu_timer_irq = gic_get_c0_compare_int(); ++ else if (cpu_has_veic) ++ panic("Unimplemented!"); + else + mips_cpu_timer_irq = MIPS_CPU_IRQ_BASE + cp0_compare_irq; + +diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c +index 8b937300fb7f..fd26fadc8617 100644 +--- a/arch/mips/txx9/rbtx4939/setup.c ++++ b/arch/mips/txx9/rbtx4939/setup.c +@@ -186,7 +186,7 @@ static void __init rbtx4939_update_ioc_pen(void) + + #define RBTX4939_MAX_7SEGLEDS 8 + +-#if IS_ENABLED(CONFIG_LEDS_CLASS) ++#if IS_BUILTIN(CONFIG_LEDS_CLASS) + static u8 led_val[RBTX4939_MAX_7SEGLEDS]; + struct rbtx4939_led_data { + struct led_classdev cdev; +@@ -261,7 +261,7 @@ static inline void rbtx4939_led_setup(void) + + static void __rbtx4939_7segled_putc(unsigned int pos, unsigned char val) + { +-#if IS_ENABLED(CONFIG_LEDS_CLASS) ++#if IS_BUILTIN(CONFIG_LEDS_CLASS) + unsigned long flags; + local_irq_save(flags); + /* bit7: reserved for LED class */ +diff --git a/arch/powerpc/include/asm/book3s/64/pgalloc.h b/arch/powerpc/include/asm/book3s/64/pgalloc.h +index 1fcfa425cefa..f326b40b7c7b 100644 +--- a/arch/powerpc/include/asm/book3s/64/pgalloc.h ++++ b/arch/powerpc/include/asm/book3s/64/pgalloc.h +@@ -73,10 +73,16 @@ static inline void radix__pgd_free(struct mm_struct *mm, pgd_t *pgd) + + static inline pgd_t *pgd_alloc(struct mm_struct *mm) + { ++ pgd_t *pgd; ++ + if (radix_enabled()) + return radix__pgd_alloc(mm); +- return kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), +- pgtable_gfp_flags(mm, GFP_KERNEL)); ++ ++ pgd = kmem_cache_alloc(PGT_CACHE(PGD_INDEX_SIZE), ++ pgtable_gfp_flags(mm, GFP_KERNEL)); ++ memset(pgd, 0, PGD_TABLE_SIZE); ++ ++ return pgd; + } + + static inline void pgd_free(struct mm_struct *mm, pgd_t *pgd) +diff --git a/arch/powerpc/include/uapi/asm/kvm.h b/arch/powerpc/include/uapi/asm/kvm.h +index 61d6049f4c1e..8aaec831053a 100644 +--- a/arch/powerpc/include/uapi/asm/kvm.h ++++ b/arch/powerpc/include/uapi/asm/kvm.h +@@ -607,6 +607,8 @@ struct kvm_ppc_rmmu_info { + #define KVM_REG_PPC_TIDR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc) + #define KVM_REG_PPC_PSSCR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd) + ++#define KVM_REG_PPC_DEC_EXPIRY (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe) ++ + /* Transactional Memory checkpointed state: + * This is all GPRs, all VSX regs and a subset of SPRs + */ +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index 13c9dcdcba69..d17007451f62 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -336,7 +336,7 @@ void system_reset_exception(struct pt_regs *regs) + * No debugger or crash dump registered, print logs then + * panic. + */ +- __die("System Reset", regs, SIGABRT); ++ die("System Reset", regs, SIGABRT); + + mdelay(2*MSEC_PER_SEC); /* Wait a little while for others to print */ + add_taint(TAINT_DIE, LOCKDEP_NOW_UNRELIABLE); +diff --git a/arch/powerpc/kvm/book3s_64_mmu_hv.c b/arch/powerpc/kvm/book3s_64_mmu_hv.c +index 2645d484e945..df9b53f40b1e 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_hv.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_hv.c +@@ -1348,12 +1348,8 @@ static unsigned long resize_hpt_rehash_hpte(struct kvm_resize_hpt *resize, + } + + new_pteg = hash & new_hash_mask; +- if (vpte & HPTE_V_SECONDARY) { +- BUG_ON(~pteg != (hash & old_hash_mask)); +- new_pteg = ~new_pteg; +- } else { +- BUG_ON(pteg != (hash & old_hash_mask)); +- } ++ if (vpte & HPTE_V_SECONDARY) ++ new_pteg = ~hash & new_hash_mask; + + new_idx = new_pteg * HPTES_PER_GROUP + (idx % HPTES_PER_GROUP); + new_hptep = (__be64 *)(new->virt + (new_idx << 4)); +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index f48e3379a18a..e094dc90ff1b 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -1497,6 +1497,10 @@ static int kvmppc_get_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_ARCH_COMPAT: + *val = get_reg_val(id, vcpu->arch.vcore->arch_compat); + break; ++ case KVM_REG_PPC_DEC_EXPIRY: ++ *val = get_reg_val(id, vcpu->arch.dec_expires + ++ vcpu->arch.vcore->tb_offset); ++ break; + default: + r = -EINVAL; + break; +@@ -1724,6 +1728,10 @@ static int kvmppc_set_one_reg_hv(struct kvm_vcpu *vcpu, u64 id, + case KVM_REG_PPC_ARCH_COMPAT: + r = kvmppc_set_arch_compat(vcpu, set_reg_val(id, *val)); + break; ++ case KVM_REG_PPC_DEC_EXPIRY: ++ vcpu->arch.dec_expires = set_reg_val(id, *val) - ++ vcpu->arch.vcore->tb_offset; ++ break; + default: + r = -EINVAL; + break; +diff --git a/arch/powerpc/kvm/powerpc.c b/arch/powerpc/kvm/powerpc.c +index 2b02d51d14d8..ecb45361095b 100644 +--- a/arch/powerpc/kvm/powerpc.c ++++ b/arch/powerpc/kvm/powerpc.c +@@ -758,7 +758,7 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) + + hrtimer_init(&vcpu->arch.dec_timer, CLOCK_REALTIME, HRTIMER_MODE_ABS); + vcpu->arch.dec_timer.function = kvmppc_decrementer_wakeup; +- vcpu->arch.dec_expires = ~(u64)0; ++ vcpu->arch.dec_expires = get_tb(); + + #ifdef CONFIG_KVM_EXIT_TIMING + mutex_init(&vcpu->arch.exit_timing_lock); +diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c +index a81279249bfb..9fead0796364 100644 +--- a/arch/powerpc/mm/numa.c ++++ b/arch/powerpc/mm/numa.c +@@ -546,7 +546,7 @@ static int numa_setup_cpu(unsigned long lcpu) + nid = of_node_to_nid_single(cpu); + + out_present: +- if (nid < 0 || !node_online(nid)) ++ if (nid < 0 || !node_possible(nid)) + nid = first_online_node; + + map_cpu_to_node(lcpu, nid); +@@ -887,6 +887,32 @@ static void __init setup_node_data(int nid, u64 start_pfn, u64 end_pfn) + NODE_DATA(nid)->node_spanned_pages = spanned_pages; + } + ++static void __init find_possible_nodes(void) ++{ ++ struct device_node *rtas; ++ u32 numnodes, i; ++ ++ if (min_common_depth <= 0) ++ return; ++ ++ rtas = of_find_node_by_path("/rtas"); ++ if (!rtas) ++ return; ++ ++ if (of_property_read_u32_index(rtas, ++ "ibm,max-associativity-domains", ++ min_common_depth, &numnodes)) ++ goto out; ++ ++ for (i = 0; i < numnodes; i++) { ++ if (!node_possible(i)) ++ node_set(i, node_possible_map); ++ } ++ ++out: ++ of_node_put(rtas); ++} ++ + void __init initmem_init(void) + { + int nid, cpu; +@@ -900,12 +926,15 @@ void __init initmem_init(void) + memblock_dump_all(); + + /* +- * Reduce the possible NUMA nodes to the online NUMA nodes, +- * since we do not support node hotplug. This ensures that we +- * lower the maximum NUMA node ID to what is actually present. ++ * Modify the set of possible NUMA nodes to reflect information ++ * available about the set of online nodes, and the set of nodes ++ * that we expect to make use of for this platform's affinity ++ * calculations. + */ + nodes_and(node_possible_map, node_possible_map, node_online_map); + ++ find_possible_nodes(); ++ + for_each_online_node(nid) { + unsigned long start_pfn, end_pfn; + +@@ -1246,6 +1275,40 @@ static long vphn_get_associativity(unsigned long cpu, + return rc; + } + ++static inline int find_and_online_cpu_nid(int cpu) ++{ ++ __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0}; ++ int new_nid; ++ ++ /* Use associativity from first thread for all siblings */ ++ vphn_get_associativity(cpu, associativity); ++ new_nid = associativity_to_nid(associativity); ++ if (new_nid < 0 || !node_possible(new_nid)) ++ new_nid = first_online_node; ++ ++ if (NODE_DATA(new_nid) == NULL) { ++#ifdef CONFIG_MEMORY_HOTPLUG ++ /* ++ * Need to ensure that NODE_DATA is initialized for a node from ++ * available memory (see memblock_alloc_try_nid). If unable to ++ * init the node, then default to nearest node that has memory ++ * installed. ++ */ ++ if (try_online_node(new_nid)) ++ new_nid = first_online_node; ++#else ++ /* ++ * Default to using the nearest node that has memory installed. ++ * Otherwise, it would be necessary to patch the kernel MM code ++ * to deal with more memoryless-node error conditions. ++ */ ++ new_nid = first_online_node; ++#endif ++ } ++ ++ return new_nid; ++} ++ + /* + * Update the CPU maps and sysfs entries for a single CPU when its NUMA + * characteristics change. This function doesn't perform any locking and is +@@ -1313,7 +1376,6 @@ int numa_update_cpu_topology(bool cpus_locked) + { + unsigned int cpu, sibling, changed = 0; + struct topology_update_data *updates, *ud; +- __be32 associativity[VPHN_ASSOC_BUFSIZE] = {0}; + cpumask_t updated_cpus; + struct device *dev; + int weight, new_nid, i = 0; +@@ -1348,11 +1410,7 @@ int numa_update_cpu_topology(bool cpus_locked) + continue; + } + +- /* Use associativity from first thread for all siblings */ +- vphn_get_associativity(cpu, associativity); +- new_nid = associativity_to_nid(associativity); +- if (new_nid < 0 || !node_online(new_nid)) +- new_nid = first_online_node; ++ new_nid = find_and_online_cpu_nid(cpu); + + if (new_nid == numa_cpu_lookup_table[cpu]) { + cpumask_andnot(&cpu_associativity_changes_mask, +diff --git a/arch/powerpc/platforms/powernv/opal-imc.c b/arch/powerpc/platforms/powernv/opal-imc.c +index b150f4deaccf..6914b289c86b 100644 +--- a/arch/powerpc/platforms/powernv/opal-imc.c ++++ b/arch/powerpc/platforms/powernv/opal-imc.c +@@ -126,9 +126,11 @@ static void disable_nest_pmu_counters(void) + const struct cpumask *l_cpumask; + + get_online_cpus(); +- for_each_online_node(nid) { ++ for_each_node_with_cpus(nid) { + l_cpumask = cpumask_of_node(nid); +- cpu = cpumask_first(l_cpumask); ++ cpu = cpumask_first_and(l_cpumask, cpu_online_mask); ++ if (cpu >= nr_cpu_ids) ++ continue; + opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST, + get_hard_smp_processor_id(cpu)); + } +diff --git a/arch/s390/include/asm/eadm.h b/arch/s390/include/asm/eadm.h +index eb5323161f11..bb63b2afdf6f 100644 +--- a/arch/s390/include/asm/eadm.h ++++ b/arch/s390/include/asm/eadm.h +@@ -4,7 +4,7 @@ + + #include + #include +-#include ++#include + + struct arqb { + u64 data; +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 0fa3a788dd20..0bce918db11a 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -601,7 +601,7 @@ static int kvm_vm_ioctl_enable_cap(struct kvm *kvm, struct kvm_enable_cap *cap) + case KVM_CAP_S390_GS: + r = -EINVAL; + mutex_lock(&kvm->lock); +- if (atomic_read(&kvm->online_vcpus)) { ++ if (kvm->created_vcpus) { + r = -EBUSY; + } else if (test_facility(133)) { + set_kvm_facility(kvm->arch.model.fac_mask, 133); +@@ -1121,7 +1121,7 @@ static int kvm_s390_set_processor_feat(struct kvm *kvm, + return -EINVAL; + + mutex_lock(&kvm->lock); +- if (!atomic_read(&kvm->online_vcpus)) { ++ if (!kvm->created_vcpus) { + bitmap_copy(kvm->arch.cpu_feat, (unsigned long *) data.feat, + KVM_S390_VM_CPU_FEAT_NR_BITS); + ret = 0; +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index b18b5652e5c5..a74204db759b 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -31,7 +31,11 @@ struct vsie_page { + * the same offset as that in struct sie_page! + */ + struct mcck_volatile_info mcck_info; /* 0x0200 */ +- /* the pinned originial scb */ ++ /* ++ * The pinned original scb. Be aware that other VCPUs can modify ++ * it while we read from it. Values that are used for conditions or ++ * are reused conditionally, should be accessed via READ_ONCE. ++ */ + struct kvm_s390_sie_block *scb_o; /* 0x0218 */ + /* the shadow gmap in use by the vsie_page */ + struct gmap *gmap; /* 0x0220 */ +@@ -143,12 +147,13 @@ static int shadow_crycb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; +- u32 crycb_addr = scb_o->crycbd & 0x7ffffff8U; ++ const uint32_t crycbd_o = READ_ONCE(scb_o->crycbd); ++ const u32 crycb_addr = crycbd_o & 0x7ffffff8U; + unsigned long *b1, *b2; + u8 ecb3_flags; + + scb_s->crycbd = 0; +- if (!(scb_o->crycbd & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1)) ++ if (!(crycbd_o & vcpu->arch.sie_block->crycbd & CRYCB_FORMAT1)) + return 0; + /* format-1 is supported with message-security-assist extension 3 */ + if (!test_kvm_facility(vcpu->kvm, 76)) +@@ -186,12 +191,15 @@ static void prepare_ibc(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; ++ /* READ_ONCE does not work on bitfields - use a temporary variable */ ++ const uint32_t __new_ibc = scb_o->ibc; ++ const uint32_t new_ibc = READ_ONCE(__new_ibc) & 0x0fffU; + __u64 min_ibc = (sclp.ibc >> 16) & 0x0fffU; + + scb_s->ibc = 0; + /* ibc installed in g2 and requested for g3 */ +- if (vcpu->kvm->arch.model.ibc && (scb_o->ibc & 0x0fffU)) { +- scb_s->ibc = scb_o->ibc & 0x0fffU; ++ if (vcpu->kvm->arch.model.ibc && new_ibc) { ++ scb_s->ibc = new_ibc; + /* takte care of the minimum ibc level of the machine */ + if (scb_s->ibc < min_ibc) + scb_s->ibc = min_ibc; +@@ -256,6 +264,10 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; ++ /* READ_ONCE does not work on bitfields - use a temporary variable */ ++ const uint32_t __new_prefix = scb_o->prefix; ++ const uint32_t new_prefix = READ_ONCE(__new_prefix); ++ const bool wants_tx = READ_ONCE(scb_o->ecb) & ECB_TE; + bool had_tx = scb_s->ecb & ECB_TE; + unsigned long new_mso = 0; + int rc; +@@ -302,14 +314,14 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->icpua = scb_o->icpua; + + if (!(atomic_read(&scb_s->cpuflags) & CPUSTAT_SM)) +- new_mso = scb_o->mso & 0xfffffffffff00000UL; ++ new_mso = READ_ONCE(scb_o->mso) & 0xfffffffffff00000UL; + /* if the hva of the prefix changes, we have to remap the prefix */ +- if (scb_s->mso != new_mso || scb_s->prefix != scb_o->prefix) ++ if (scb_s->mso != new_mso || scb_s->prefix != new_prefix) + prefix_unmapped(vsie_page); + /* SIE will do mso/msl validity and exception checks for us */ + scb_s->msl = scb_o->msl & 0xfffffffffff00000UL; + scb_s->mso = new_mso; +- scb_s->prefix = scb_o->prefix; ++ scb_s->prefix = new_prefix; + + /* We have to definetly flush the tlb if this scb never ran */ + if (scb_s->ihcpu != 0xffffU) +@@ -321,11 +333,11 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_ESOP)) + scb_s->ecb |= scb_o->ecb & ECB_HOSTPROTINT; + /* transactional execution */ +- if (test_kvm_facility(vcpu->kvm, 73)) { ++ if (test_kvm_facility(vcpu->kvm, 73) && wants_tx) { + /* remap the prefix is tx is toggled on */ +- if ((scb_o->ecb & ECB_TE) && !had_tx) ++ if (!had_tx) + prefix_unmapped(vsie_page); +- scb_s->ecb |= scb_o->ecb & ECB_TE; ++ scb_s->ecb |= ECB_TE; + } + /* SIMD */ + if (test_kvm_facility(vcpu->kvm, 129)) { +@@ -544,9 +556,9 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + gpa_t gpa; + int rc = 0; + +- gpa = scb_o->scaol & ~0xfUL; ++ gpa = READ_ONCE(scb_o->scaol) & ~0xfUL; + if (test_kvm_cpu_feat(vcpu->kvm, KVM_S390_VM_CPU_FEAT_64BSCAO)) +- gpa |= (u64) scb_o->scaoh << 32; ++ gpa |= (u64) READ_ONCE(scb_o->scaoh) << 32; + if (gpa) { + if (!(gpa & ~0x1fffUL)) + rc = set_validity_icpt(scb_s, 0x0038U); +@@ -566,7 +578,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->scaol = (u32)(u64)hpa; + } + +- gpa = scb_o->itdba & ~0xffUL; ++ gpa = READ_ONCE(scb_o->itdba) & ~0xffUL; + if (gpa && (scb_s->ecb & ECB_TE)) { + if (!(gpa & ~0x1fffU)) { + rc = set_validity_icpt(scb_s, 0x0080U); +@@ -581,7 +593,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->itdba = hpa; + } + +- gpa = scb_o->gvrd & ~0x1ffUL; ++ gpa = READ_ONCE(scb_o->gvrd) & ~0x1ffUL; + if (gpa && (scb_s->eca & ECA_VX) && !(scb_s->ecd & ECD_HOSTREGMGMT)) { + if (!(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x1310U); +@@ -599,7 +611,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->gvrd = hpa; + } + +- gpa = scb_o->riccbd & ~0x3fUL; ++ gpa = READ_ONCE(scb_o->riccbd) & ~0x3fUL; + if (gpa && (scb_s->ecb3 & ECB3_RI)) { + if (!(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x0043U); +@@ -617,8 +629,8 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + if ((scb_s->ecb & ECB_GS) && !(scb_s->ecd & ECD_HOSTREGMGMT)) { + unsigned long sdnxc; + +- gpa = scb_o->sdnxo & ~0xfUL; +- sdnxc = scb_o->sdnxo & 0xfUL; ++ gpa = READ_ONCE(scb_o->sdnxo) & ~0xfUL; ++ sdnxc = READ_ONCE(scb_o->sdnxo) & 0xfUL; + if (!gpa || !(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x10b0U); + goto unpin; +@@ -785,7 +797,7 @@ static void retry_vsie_icpt(struct vsie_page *vsie_page) + static int handle_stfle(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; +- __u32 fac = vsie_page->scb_o->fac & 0x7ffffff8U; ++ __u32 fac = READ_ONCE(vsie_page->scb_o->fac) & 0x7ffffff8U; + + if (fac && test_kvm_facility(vcpu->kvm, 7)) { + retry_vsie_icpt(vsie_page); +diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h +index fd9d9bac7cfa..79c3bdaaa0b4 100644 +--- a/arch/sparc/include/asm/pgtable_64.h ++++ b/arch/sparc/include/asm/pgtable_64.h +@@ -980,7 +980,7 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr, + pmd_t *pmd); + + #define __HAVE_ARCH_PMDP_INVALIDATE +-extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, ++extern pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp); + + #define __HAVE_ARCH_PGTABLE_DEPOSIT +diff --git a/arch/sparc/mm/tlb.c b/arch/sparc/mm/tlb.c +index 4ae86bc0d35c..847ddffbf38a 100644 +--- a/arch/sparc/mm/tlb.c ++++ b/arch/sparc/mm/tlb.c +@@ -219,17 +219,28 @@ void set_pmd_at(struct mm_struct *mm, unsigned long addr, + } + } + ++static inline pmd_t pmdp_establish(struct vm_area_struct *vma, ++ unsigned long address, pmd_t *pmdp, pmd_t pmd) ++{ ++ pmd_t old; ++ ++ do { ++ old = *pmdp; ++ } while (cmpxchg64(&pmdp->pmd, old.pmd, pmd.pmd) != old.pmd); ++ ++ return old; ++} ++ + /* + * This routine is only called when splitting a THP + */ +-void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, ++pmd_t pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp) + { +- pmd_t entry = *pmdp; +- +- pmd_val(entry) &= ~_PAGE_VALID; ++ pmd_t old, entry; + +- set_pmd_at(vma->vm_mm, address, pmdp, entry); ++ entry = __pmd(pmd_val(*pmdp) & ~_PAGE_VALID); ++ old = pmdp_establish(vma, address, pmdp, entry); + flush_tlb_range(vma, address, address + HPAGE_PMD_SIZE); + + /* +@@ -240,6 +251,8 @@ void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + if ((pmd_val(entry) & _PAGE_PMD_HUGE) && + !is_huge_zero_page(pmd_page(entry))) + (vma->vm_mm)->context.thp_pte_count--; ++ ++ return old; + } + + void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, +diff --git a/arch/x86/hyperv/hv_init.c b/arch/x86/hyperv/hv_init.c +index a0b86cf486e0..2e9d58cc371e 100644 +--- a/arch/x86/hyperv/hv_init.c ++++ b/arch/x86/hyperv/hv_init.c +@@ -110,12 +110,19 @@ static int hv_cpu_init(unsigned int cpu) + */ + void hyperv_init(void) + { +- u64 guest_id; ++ u64 guest_id, required_msrs; + union hv_x64_msr_hypercall_contents hypercall_msr; + + if (x86_hyper_type != X86_HYPER_MS_HYPERV) + return; + ++ /* Absolutely required MSRs */ ++ required_msrs = HV_X64_MSR_HYPERCALL_AVAILABLE | ++ HV_X64_MSR_VP_INDEX_AVAILABLE; ++ ++ if ((ms_hyperv.features & required_msrs) != required_msrs) ++ return; ++ + /* Allocate percpu VP index */ + hv_vp_index = kmalloc_array(num_possible_cpus(), sizeof(*hv_vp_index), + GFP_KERNEL); +diff --git a/arch/x86/hyperv/mmu.c b/arch/x86/hyperv/mmu.c +index 9cc9e1c1e2db..56c9ebac946f 100644 +--- a/arch/x86/hyperv/mmu.c ++++ b/arch/x86/hyperv/mmu.c +@@ -137,7 +137,12 @@ static void hyperv_flush_tlb_others(const struct cpumask *cpus, + } + + if (info->mm) { ++ /* ++ * AddressSpace argument must match the CR3 with PCID bits ++ * stripped out. ++ */ + flush->address_space = virt_to_phys(info->mm->pgd); ++ flush->address_space &= CR3_ADDR_MASK; + flush->flags = 0; + } else { + flush->address_space = 0; +@@ -219,7 +224,12 @@ static void hyperv_flush_tlb_others_ex(const struct cpumask *cpus, + } + + if (info->mm) { ++ /* ++ * AddressSpace argument must match the CR3 with PCID bits ++ * stripped out. ++ */ + flush->address_space = virt_to_phys(info->mm->pgd); ++ flush->address_space &= CR3_ADDR_MASK; + flush->flags = 0; + } else { + flush->address_space = 0; +@@ -278,8 +288,6 @@ void hyperv_setup_mmu_ops(void) + if (!(ms_hyperv.hints & HV_X64_REMOTE_TLB_FLUSH_RECOMMENDED)) + return; + +- setup_clear_cpu_cap(X86_FEATURE_PCID); +- + if (!(ms_hyperv.hints & HV_X64_EX_PROCESSOR_MASKS_RECOMMENDED)) { + pr_info("Using hypercall for remote TLB flush\n"); + pv_mmu_ops.flush_tlb_others = hyperv_flush_tlb_others; +diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h +index c8376b40e882..5cdcdbd4d892 100644 +--- a/arch/x86/include/asm/i8259.h ++++ b/arch/x86/include/asm/i8259.h +@@ -69,6 +69,11 @@ struct legacy_pic { + extern struct legacy_pic *legacy_pic; + extern struct legacy_pic null_legacy_pic; + ++static inline bool has_legacy_pic(void) ++{ ++ return legacy_pic != &null_legacy_pic; ++} ++ + static inline int nr_legacy_irqs(void) + { + return legacy_pic->nr_legacy_irqs; +diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c +index 9c2a002d9297..6dda3595acf8 100644 +--- a/arch/x86/kernel/acpi/boot.c ++++ b/arch/x86/kernel/acpi/boot.c +@@ -215,6 +215,10 @@ acpi_parse_x2apic(struct acpi_subtable_header *header, const unsigned long end) + apic_id = processor->local_apic_id; + enabled = processor->lapic_flags & ACPI_MADT_ENABLED; + ++ /* Ignore invalid ID */ ++ if (apic_id == 0xffffffff) ++ return 0; ++ + /* + * We need to register disabled CPU as well to permit + * counting disabled CPUs. This allows us to size +diff --git a/arch/x86/kernel/apic/x2apic_uv_x.c b/arch/x86/kernel/apic/x2apic_uv_x.c +index c0b694810ff4..02cfc615e3fb 100644 +--- a/arch/x86/kernel/apic/x2apic_uv_x.c ++++ b/arch/x86/kernel/apic/x2apic_uv_x.c +@@ -1140,16 +1140,25 @@ static void __init decode_gam_rng_tbl(unsigned long ptr) + + uv_gre_table = gre; + for (; gre->type != UV_GAM_RANGE_TYPE_UNUSED; gre++) { ++ unsigned long size = ((unsigned long)(gre->limit - lgre) ++ << UV_GAM_RANGE_SHFT); ++ int order = 0; ++ char suffix[] = " KMGTPE"; ++ ++ while (size > 9999 && order < sizeof(suffix)) { ++ size /= 1024; ++ order++; ++ } ++ + if (!index) { + pr_info("UV: GAM Range Table...\n"); + pr_info("UV: # %20s %14s %5s %4s %5s %3s %2s\n", "Range", "", "Size", "Type", "NASID", "SID", "PN"); + } +- pr_info("UV: %2d: 0x%014lx-0x%014lx %5luG %3d %04x %02x %02x\n", ++ pr_info("UV: %2d: 0x%014lx-0x%014lx %5lu%c %3d %04x %02x %02x\n", + index++, + (unsigned long)lgre << UV_GAM_RANGE_SHFT, + (unsigned long)gre->limit << UV_GAM_RANGE_SHFT, +- ((unsigned long)(gre->limit - lgre)) >> +- (30 - UV_GAM_RANGE_SHFT), /* 64M -> 1G */ ++ size, suffix[order], + gre->type, gre->nasid, gre->sockid, gre->pnode); + + lgre = gre->limit; +diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c +index afbecff161d1..a2d8a3908670 100644 +--- a/arch/x86/kernel/dumpstack.c ++++ b/arch/x86/kernel/dumpstack.c +@@ -109,7 +109,7 @@ void show_trace_log_lvl(struct task_struct *task, struct pt_regs *regs, + struct stack_info stack_info = {0}; + unsigned long visit_mask = 0; + int graph_idx = 0; +- bool partial; ++ bool partial = false; + + printk("%sCall Trace:\n", log_lvl); + +diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c +index 47506567435e..0bf06fa3027e 100644 +--- a/arch/x86/kernel/tsc.c ++++ b/arch/x86/kernel/tsc.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + unsigned int __read_mostly cpu_khz; /* TSC clocks / usec, not used here */ + EXPORT_SYMBOL(cpu_khz); +@@ -316,7 +317,7 @@ static unsigned long calc_hpet_ref(u64 deltatsc, u64 hpet1, u64 hpet2) + hpet2 -= hpet1; + tmp = ((u64)hpet2 * hpet_readl(HPET_PERIOD)); + do_div(tmp, 1000000); +- do_div(deltatsc, tmp); ++ deltatsc = div64_u64(deltatsc, tmp); + + return (unsigned long) deltatsc; + } +@@ -363,6 +364,20 @@ static unsigned long pit_calibrate_tsc(u32 latch, unsigned long ms, int loopmin) + unsigned long tscmin, tscmax; + int pitcnt; + ++ if (!has_legacy_pic()) { ++ /* ++ * Relies on tsc_early_delay_calibrate() to have given us semi ++ * usable udelay(), wait for the same 50ms we would have with ++ * the PIT loop below. ++ */ ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ udelay(10 * USEC_PER_MSEC); ++ return ULONG_MAX; ++ } ++ + /* Set the Gate high, disable speaker */ + outb((inb(0x61) & ~0x02) | 0x01, 0x61); + +@@ -487,6 +502,9 @@ static unsigned long quick_pit_calibrate(void) + u64 tsc, delta; + unsigned long d1, d2; + ++ if (!has_legacy_pic()) ++ return 0; ++ + /* Set the Gate high, disable speaker */ + outb((inb(0x61) & ~0x02) | 0x01, 0x61); + +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index f438e0c4aa8c..43bbece92632 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3019,7 +3019,7 @@ static int kvm_handle_bad_page(struct kvm_vcpu *vcpu, gfn_t gfn, kvm_pfn_t pfn) + return RET_PF_RETRY; + } + +- return RET_PF_EMULATE; ++ return -EFAULT; + } + + static void transparent_hugepage_adjust(struct kvm_vcpu *vcpu, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index ae4803b213d0..bdd84ce4491e 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -6765,7 +6765,21 @@ static int handle_ept_misconfig(struct kvm_vcpu *vcpu) + if (!is_guest_mode(vcpu) && + !kvm_io_bus_write(vcpu, KVM_FAST_MMIO_BUS, gpa, 0, NULL)) { + trace_kvm_fast_mmio(gpa); +- return kvm_skip_emulated_instruction(vcpu); ++ /* ++ * Doing kvm_skip_emulated_instruction() depends on undefined ++ * behavior: Intel's manual doesn't mandate ++ * VM_EXIT_INSTRUCTION_LEN to be set in VMCS when EPT MISCONFIG ++ * occurs and while on real hardware it was observed to be set, ++ * other hypervisors (namely Hyper-V) don't set it, we end up ++ * advancing IP with some random value. Disable fast mmio when ++ * running nested and keep it for real hardware in hope that ++ * VM_EXIT_INSTRUCTION_LEN will always be set correctly. ++ */ ++ if (!static_cpu_has(X86_FEATURE_HYPERVISOR)) ++ return kvm_skip_emulated_instruction(vcpu); ++ else ++ return x86_emulate_instruction(vcpu, gpa, EMULTYPE_SKIP, ++ NULL, 0) == EMULATE_DONE; + } + + ret = kvm_mmu_page_fault(vcpu, gpa, PFERR_RSVD_MASK, NULL, 0); +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b9afb4784d12..3b2c3aa2cd07 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -4225,13 +4225,14 @@ long kvm_arch_vm_ioctl(struct file *filp, + mutex_unlock(&kvm->lock); + break; + case KVM_XEN_HVM_CONFIG: { ++ struct kvm_xen_hvm_config xhc; + r = -EFAULT; +- if (copy_from_user(&kvm->arch.xen_hvm_config, argp, +- sizeof(struct kvm_xen_hvm_config))) ++ if (copy_from_user(&xhc, argp, sizeof(xhc))) + goto out; + r = -EINVAL; +- if (kvm->arch.xen_hvm_config.flags) ++ if (xhc.flags) + goto out; ++ memcpy(&kvm->arch.xen_hvm_config, &xhc, sizeof(xhc)); + r = 0; + break; + } +@@ -5698,7 +5699,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, + * handle watchpoints yet, those would be handled in + * the emulate_ops. + */ +- if (kvm_vcpu_check_breakpoint(vcpu, &r)) ++ if (!(emulation_type & EMULTYPE_SKIP) && ++ kvm_vcpu_check_breakpoint(vcpu, &r)) + return r; + + ctxt->interruptibility = 0; +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index fe85d1204db8..642357aff216 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -1180,8 +1180,7 @@ void __init mem_init(void) + after_bootmem = 1; + + /* Register memory areas for /proc/kcore */ +- kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, +- PAGE_SIZE, KCORE_OTHER); ++ kclist_add(&kcore_vsyscall, (void *)VSYSCALL_ADDR, PAGE_SIZE, KCORE_USER); + + mem_init_print_info(NULL); + } +diff --git a/arch/x86/power/hibernate_32.c b/arch/x86/power/hibernate_32.c +index c35fdb585c68..afc4ed7b1578 100644 +--- a/arch/x86/power/hibernate_32.c ++++ b/arch/x86/power/hibernate_32.c +@@ -145,7 +145,7 @@ static inline void resume_init_first_level_page_table(pgd_t *pg_dir) + #endif + } + +-int swsusp_arch_resume(void) ++asmlinkage int swsusp_arch_resume(void) + { + int error; + +diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c +index f910c514438f..0ef5e5204968 100644 +--- a/arch/x86/power/hibernate_64.c ++++ b/arch/x86/power/hibernate_64.c +@@ -174,7 +174,7 @@ static int relocate_restore_code(void) + return 0; + } + +-int swsusp_arch_resume(void) ++asmlinkage int swsusp_arch_resume(void) + { + int error; + +diff --git a/block/bio.c b/block/bio.c +index dbaa82c967f4..90f19d7df66c 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -1893,7 +1893,7 @@ struct bio *bio_split(struct bio *bio, int sectors, + bio_advance(bio, split->bi_iter.bi_size); + + if (bio_flagged(bio, BIO_TRACE_COMPLETION)) +- bio_set_flag(bio, BIO_TRACE_COMPLETION); ++ bio_set_flag(split, BIO_TRACE_COMPLETION); + + return split; + } +diff --git a/block/blk-core.c b/block/blk-core.c +index c01f4907dbbc..1feeb1a8aad9 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -3065,6 +3065,8 @@ void blk_rq_bio_prep(struct request_queue *q, struct request *rq, + { + if (bio_has_data(bio)) + rq->nr_phys_segments = bio_phys_segments(q, bio); ++ else if (bio_op(bio) == REQ_OP_DISCARD) ++ rq->nr_phys_segments = 1; + + rq->__data_len = bio->bi_iter.bi_size; + rq->bio = rq->biotail = bio; +diff --git a/block/blk-merge.c b/block/blk-merge.c +index f5dedd57dff6..8d60a5bbcef9 100644 +--- a/block/blk-merge.c ++++ b/block/blk-merge.c +@@ -551,6 +551,24 @@ static bool req_no_special_merge(struct request *req) + return !q->mq_ops && req->special; + } + ++static bool req_attempt_discard_merge(struct request_queue *q, struct request *req, ++ struct request *next) ++{ ++ unsigned short segments = blk_rq_nr_discard_segments(req); ++ ++ if (segments >= queue_max_discard_segments(q)) ++ goto no_merge; ++ if (blk_rq_sectors(req) + bio_sectors(next->bio) > ++ blk_rq_get_max_sectors(req, blk_rq_pos(req))) ++ goto no_merge; ++ ++ req->nr_phys_segments = segments + blk_rq_nr_discard_segments(next); ++ return true; ++no_merge: ++ req_set_nomerge(q, req); ++ return false; ++} ++ + static int ll_merge_requests_fn(struct request_queue *q, struct request *req, + struct request *next) + { +@@ -684,9 +702,13 @@ static struct request *attempt_merge(struct request_queue *q, + * If we are allowed to merge, then append bio list + * from next to rq and release next. merge_requests_fn + * will have updated segment counts, update sector +- * counts here. ++ * counts here. Handle DISCARDs separately, as they ++ * have separate settings. + */ +- if (!ll_merge_requests_fn(q, req, next)) ++ if (req_op(req) == REQ_OP_DISCARD) { ++ if (!req_attempt_discard_merge(q, req, next)) ++ return NULL; ++ } else if (!ll_merge_requests_fn(q, req, next)) + return NULL; + + /* +@@ -716,7 +738,8 @@ static struct request *attempt_merge(struct request_queue *q, + + req->__data_len += blk_rq_bytes(next); + +- elv_merge_requests(q, req, next); ++ if (req_op(req) != REQ_OP_DISCARD) ++ elv_merge_requests(q, req, next); + + /* + * 'next' is going away, so update stats accordingly +diff --git a/block/blk-mq-debugfs.c b/block/blk-mq-debugfs.c +index de294d775acf..d95439154556 100644 +--- a/block/blk-mq-debugfs.c ++++ b/block/blk-mq-debugfs.c +@@ -704,7 +704,11 @@ static ssize_t blk_mq_debugfs_write(struct file *file, const char __user *buf, + const struct blk_mq_debugfs_attr *attr = m->private; + void *data = d_inode(file->f_path.dentry->d_parent)->i_private; + +- if (!attr->write) ++ /* ++ * Attributes that only implement .seq_ops are read-only and 'attr' is ++ * the same with 'data' in this case. ++ */ ++ if (attr == data || !attr->write) + return -EPERM; + + return attr->write(data, buf, count, ppos); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 6f899669cbdd..007f96611364 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -1143,9 +1143,27 @@ static void __blk_mq_run_hw_queue(struct blk_mq_hw_ctx *hctx) + /* + * We should be running this queue from one of the CPUs that + * are mapped to it. ++ * ++ * There are at least two related races now between setting ++ * hctx->next_cpu from blk_mq_hctx_next_cpu() and running ++ * __blk_mq_run_hw_queue(): ++ * ++ * - hctx->next_cpu is found offline in blk_mq_hctx_next_cpu(), ++ * but later it becomes online, then this warning is harmless ++ * at all ++ * ++ * - hctx->next_cpu is found online in blk_mq_hctx_next_cpu(), ++ * but later it becomes offline, then the warning can't be ++ * triggered, and we depend on blk-mq timeout handler to ++ * handle dispatched requests to this hctx + */ +- WARN_ON(!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) && +- cpu_online(hctx->next_cpu)); ++ if (!cpumask_test_cpu(raw_smp_processor_id(), hctx->cpumask) && ++ cpu_online(hctx->next_cpu)) { ++ printk(KERN_WARNING "run queue from wrong CPU %d, hctx %s\n", ++ raw_smp_processor_id(), ++ cpumask_empty(hctx->cpumask) ? "inactive": "active"); ++ dump_stack(); ++ } + + /* + * We can't run the queue inline with ints disabled. Ensure that +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 032ae44710e5..a2be3fd2c72b 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -465,6 +465,8 @@ static int acpi_lpss_create_device(struct acpi_device *adev, + acpi_dev_free_resource_list(&resource_list); + + if (!pdata->mmio_base) { ++ /* Avoid acpi_bus_attach() instantiating a pdev for this dev. */ ++ adev->pnp.type.platform_id = 0; + /* Skip the device, but continue the namespace scan. */ + ret = 0; + goto err_out; +diff --git a/drivers/acpi/bus.c b/drivers/acpi/bus.c +index b6d58cc58f5f..f0348e388d01 100644 +--- a/drivers/acpi/bus.c ++++ b/drivers/acpi/bus.c +@@ -146,6 +146,12 @@ int acpi_bus_get_status(struct acpi_device *device) + return 0; + } + ++ /* Battery devices must have their deps met before calling _STA */ ++ if (acpi_device_is_battery(device) && device->dep_unmet) { ++ acpi_set_device_status(device, 0); ++ return 0; ++ } ++ + status = acpi_bus_get_status_handle(device->handle, &sta); + if (ACPI_FAILURE(status)) + return -ENODEV; +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index 6adcda057b36..58bc28aff3aa 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -1927,6 +1927,9 @@ static int acpi_ec_suspend_noirq(struct device *dev) + ec->reference_count >= 1) + acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_DISABLE); + ++ if (acpi_sleep_no_ec_events()) ++ acpi_ec_enter_noirq(ec); ++ + return 0; + } + +@@ -1934,6 +1937,9 @@ static int acpi_ec_resume_noirq(struct device *dev) + { + struct acpi_ec *ec = acpi_driver_data(to_acpi_device(dev)); + ++ if (acpi_sleep_no_ec_events()) ++ acpi_ec_leave_noirq(ec); ++ + if (ec_no_wakeup && test_bit(EC_FLAGS_STARTED, &ec->flags) && + ec->reference_count >= 1) + acpi_set_gpe(NULL, ec->gpe, ACPI_GPE_ENABLE); +diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c +index 18b72eec3507..c7cf48ad5cb9 100644 +--- a/drivers/acpi/processor_perflib.c ++++ b/drivers/acpi/processor_perflib.c +@@ -159,7 +159,7 @@ void acpi_processor_ppc_has_changed(struct acpi_processor *pr, int event_flag) + { + int ret; + +- if (ignore_ppc) { ++ if (ignore_ppc || !pr->performance) { + /* + * Only when it is notification event, the _OST object + * will be evaluated. Otherwise it is skipped. +diff --git a/drivers/acpi/scan.c b/drivers/acpi/scan.c +index 2f2f50322ffb..c0984d33c4c8 100644 +--- a/drivers/acpi/scan.c ++++ b/drivers/acpi/scan.c +@@ -1568,6 +1568,8 @@ void acpi_init_device_object(struct acpi_device *device, acpi_handle handle, + device_initialize(&device->dev); + dev_set_uevent_suppress(&device->dev, true); + acpi_init_coherency(device); ++ /* Assume there are unmet deps until acpi_device_dep_initialize() runs */ ++ device->dep_unmet = 1; + } + + void acpi_device_add_finalize(struct acpi_device *device) +@@ -1591,6 +1593,14 @@ static int acpi_add_single_object(struct acpi_device **child, + } + + acpi_init_device_object(device, handle, type, sta); ++ /* ++ * For ACPI_BUS_TYPE_DEVICE getting the status is delayed till here so ++ * that we can call acpi_bus_get_status() and use its quirk handling. ++ * Note this must be done before the get power-/wakeup_dev-flags calls. ++ */ ++ if (type == ACPI_BUS_TYPE_DEVICE) ++ acpi_bus_get_status(device); ++ + acpi_bus_get_power_flags(device); + acpi_bus_get_wakeup_device_flags(device); + +@@ -1663,9 +1673,11 @@ static int acpi_bus_type_and_status(acpi_handle handle, int *type, + return -ENODEV; + + *type = ACPI_BUS_TYPE_DEVICE; +- status = acpi_bus_get_status_handle(handle, sta); +- if (ACPI_FAILURE(status)) +- *sta = 0; ++ /* ++ * acpi_add_single_object updates this once we've an acpi_device ++ * so that acpi_bus_get_status' quirk handling can be used. ++ */ ++ *sta = 0; + break; + case ACPI_TYPE_PROCESSOR: + *type = ACPI_BUS_TYPE_PROCESSOR; +@@ -1763,6 +1775,8 @@ static void acpi_device_dep_initialize(struct acpi_device *adev) + acpi_status status; + int i; + ++ adev->dep_unmet = 0; ++ + if (!acpi_has_method(adev->handle, "_DEP")) + return; + +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index 70f8904f46a3..b3b78079aa9f 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2206,6 +2206,38 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + return 0; + } + ++static int genpd_iterate_idle_states(struct device_node *dn, ++ struct genpd_power_state *states) ++{ ++ int ret; ++ struct of_phandle_iterator it; ++ struct device_node *np; ++ int i = 0; ++ ++ ret = of_count_phandle_with_args(dn, "domain-idle-states", NULL); ++ if (ret <= 0) ++ return ret; ++ ++ /* Loop over the phandles until all the requested entry is found */ ++ of_for_each_phandle(&it, ret, dn, "domain-idle-states", NULL, 0) { ++ np = it.node; ++ if (!of_match_node(idle_state_match, np)) ++ continue; ++ if (states) { ++ ret = genpd_parse_state(&states[i], np); ++ if (ret) { ++ pr_err("Parsing idle state node %pOF failed with err %d\n", ++ np, ret); ++ of_node_put(np); ++ return ret; ++ } ++ } ++ i++; ++ } ++ ++ return i; ++} ++ + /** + * of_genpd_parse_idle_states: Return array of idle states for the genpd. + * +@@ -2215,49 +2247,31 @@ static int genpd_parse_state(struct genpd_power_state *genpd_state, + * + * Returns the device states parsed from the OF node. The memory for the states + * is allocated by this function and is the responsibility of the caller to +- * free the memory after use. ++ * free the memory after use. If no domain idle states is found it returns ++ * -EINVAL and in case of errors, a negative error code. + */ + int of_genpd_parse_idle_states(struct device_node *dn, + struct genpd_power_state **states, int *n) + { + struct genpd_power_state *st; +- struct device_node *np; +- int i = 0; +- int err, ret; +- int count; +- struct of_phandle_iterator it; +- const struct of_device_id *match_id; ++ int ret; + +- count = of_count_phandle_with_args(dn, "domain-idle-states", NULL); +- if (count <= 0) +- return -EINVAL; ++ ret = genpd_iterate_idle_states(dn, NULL); ++ if (ret <= 0) ++ return ret < 0 ? ret : -EINVAL; + +- st = kcalloc(count, sizeof(*st), GFP_KERNEL); ++ st = kcalloc(ret, sizeof(*st), GFP_KERNEL); + if (!st) + return -ENOMEM; + +- /* Loop over the phandles until all the requested entry is found */ +- of_for_each_phandle(&it, err, dn, "domain-idle-states", NULL, 0) { +- np = it.node; +- match_id = of_match_node(idle_state_match, np); +- if (!match_id) +- continue; +- ret = genpd_parse_state(&st[i++], np); +- if (ret) { +- pr_err +- ("Parsing idle state node %pOF failed with err %d\n", +- np, ret); +- of_node_put(np); +- kfree(st); +- return ret; +- } ++ ret = genpd_iterate_idle_states(dn, st); ++ if (ret <= 0) { ++ kfree(st); ++ return ret < 0 ? ret : -EINVAL; + } + +- *n = i; +- if (!i) +- kfree(st); +- else +- *states = st; ++ *states = st; ++ *n = ret; + + return 0; + } +diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c +index ae0429827f31..67c50738834b 100644 +--- a/drivers/base/power/wakeirq.c ++++ b/drivers/base/power/wakeirq.c +@@ -323,7 +323,8 @@ void dev_pm_arm_wake_irq(struct wake_irq *wirq) + return; + + if (device_may_wakeup(wirq->dev)) { +- if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) + enable_irq(wirq->irq); + + enable_irq_wake(wirq->irq); +@@ -345,7 +346,8 @@ void dev_pm_disarm_wake_irq(struct wake_irq *wirq) + if (device_may_wakeup(wirq->dev)) { + disable_irq_wake(wirq->irq); + +- if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED) ++ if (wirq->status & WAKE_IRQ_DEDICATED_ALLOCATED && ++ !pm_runtime_status_suspended(wirq->dev)) + disable_irq_nosync(wirq->irq); + } + } +diff --git a/drivers/char/ipmi/ipmi_powernv.c b/drivers/char/ipmi/ipmi_powernv.c +index b338a4becbf8..845efa0f724f 100644 +--- a/drivers/char/ipmi/ipmi_powernv.c ++++ b/drivers/char/ipmi/ipmi_powernv.c +@@ -251,8 +251,9 @@ static int ipmi_powernv_probe(struct platform_device *pdev) + ipmi->irq = opal_event_request(prop); + } + +- if (request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH, +- "opal-ipmi", ipmi)) { ++ rc = request_irq(ipmi->irq, ipmi_opal_event, IRQ_TYPE_LEVEL_HIGH, ++ "opal-ipmi", ipmi); ++ if (rc) { + dev_warn(dev, "Unable to request irq\n"); + goto err_dispose; + } +diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c +index 21bffdcb2f20..557ed25b42e3 100644 +--- a/drivers/clocksource/timer-imx-tpm.c ++++ b/drivers/clocksource/timer-imx-tpm.c +@@ -105,7 +105,7 @@ static int tpm_set_next_event(unsigned long delta, + * of writing CNT registers which may cause the min_delta event got + * missed, so we need add a ETIME check here in case it happened. + */ +- return (int)((next - now) <= 0) ? -ETIME : 0; ++ return (int)(next - now) <= 0 ? -ETIME : 0; + } + + static int tpm_set_state_oneshot(struct clock_event_device *evt) +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 93a0e88bef76..20226d4243f2 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -779,6 +779,8 @@ static int intel_pstate_hwp_save_state(struct cpufreq_policy *policy) + return 0; + } + ++static void intel_pstate_hwp_enable(struct cpudata *cpudata); ++ + static int intel_pstate_resume(struct cpufreq_policy *policy) + { + if (!hwp_active) +@@ -786,6 +788,9 @@ static int intel_pstate_resume(struct cpufreq_policy *policy) + + mutex_lock(&intel_pstate_limits_lock); + ++ if (policy->cpu == 0) ++ intel_pstate_hwp_enable(all_cpu_data[policy->cpu]); ++ + all_cpu_data[policy->cpu]->epp_policy = 0; + intel_pstate_hwp_set(policy->cpu); + +diff --git a/drivers/crypto/Kconfig b/drivers/crypto/Kconfig +index fe33c199fc1a..143f8bc403b9 100644 +--- a/drivers/crypto/Kconfig ++++ b/drivers/crypto/Kconfig +@@ -721,7 +721,6 @@ config CRYPTO_DEV_ARTPEC6 + select CRYPTO_HASH + select CRYPTO_SHA1 + select CRYPTO_SHA256 +- select CRYPTO_SHA384 + select CRYPTO_SHA512 + help + Enables the driver for the on-chip crypto accelerator +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c +index 8bf89267dc25..d731b413cb2c 100644 +--- a/drivers/firewire/ohci.c ++++ b/drivers/firewire/ohci.c +@@ -1130,7 +1130,13 @@ static int context_add_buffer(struct context *ctx) + return -ENOMEM; + + offset = (void *)&desc->buffer - (void *)desc; +- desc->buffer_size = PAGE_SIZE - offset; ++ /* ++ * Some controllers, like JMicron ones, always issue 0x20-byte DMA reads ++ * for descriptors, even 0x10-byte ones. This can cause page faults when ++ * an IOMMU is in use and the oversized read crosses a page boundary. ++ * Work around this by always leaving at least 0x10 bytes of padding. ++ */ ++ desc->buffer_size = PAGE_SIZE - offset - 0x10; + desc->buffer_bus = bus_addr + offset; + desc->used = 0; + +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c +index 783041964439..e8db9659a36b 100644 +--- a/drivers/firmware/dmi_scan.c ++++ b/drivers/firmware/dmi_scan.c +@@ -18,7 +18,7 @@ EXPORT_SYMBOL_GPL(dmi_kobj); + * of and an antecedent to, SMBIOS, which stands for System + * Management BIOS. See further: http://www.dmtf.org/standards + */ +-static const char dmi_empty_string[] = " "; ++static const char dmi_empty_string[] = ""; + + static u32 dmi_ver __initdata; + static u32 dmi_len; +@@ -44,25 +44,21 @@ static int dmi_memdev_nr; + static const char * __init dmi_string_nosave(const struct dmi_header *dm, u8 s) + { + const u8 *bp = ((u8 *) dm) + dm->length; ++ const u8 *nsp; + + if (s) { +- s--; +- while (s > 0 && *bp) { ++ while (--s > 0 && *bp) + bp += strlen(bp) + 1; +- s--; +- } +- +- if (*bp != 0) { +- size_t len = strlen(bp)+1; +- size_t cmp_len = len > 8 ? 8 : len; + +- if (!memcmp(bp, dmi_empty_string, cmp_len)) +- return dmi_empty_string; ++ /* Strings containing only spaces are considered empty */ ++ nsp = bp; ++ while (*nsp == ' ') ++ nsp++; ++ if (*nsp != '\0') + return bp; +- } + } + +- return ""; ++ return dmi_empty_string; + } + + static const char * __init dmi_string(const struct dmi_header *dm, u8 s) +diff --git a/drivers/gpu/drm/drm_dp_dual_mode_helper.c b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +index 02a50929af67..e7f4fe2848a5 100644 +--- a/drivers/gpu/drm/drm_dp_dual_mode_helper.c ++++ b/drivers/gpu/drm/drm_dp_dual_mode_helper.c +@@ -350,19 +350,44 @@ int drm_dp_dual_mode_set_tmds_output(enum drm_dp_dual_mode_type type, + { + uint8_t tmds_oen = enable ? 0 : DP_DUAL_MODE_TMDS_DISABLE; + ssize_t ret; ++ int retry; + + if (type < DRM_DP_DUAL_MODE_TYPE2_DVI) + return 0; + +- ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN, +- &tmds_oen, sizeof(tmds_oen)); +- if (ret) { +- DRM_DEBUG_KMS("Failed to %s TMDS output buffers\n", +- enable ? "enable" : "disable"); +- return ret; ++ /* ++ * LSPCON adapters in low-power state may ignore the first write, so ++ * read back and verify the written value a few times. ++ */ ++ for (retry = 0; retry < 3; retry++) { ++ uint8_t tmp; ++ ++ ret = drm_dp_dual_mode_write(adapter, DP_DUAL_MODE_TMDS_OEN, ++ &tmds_oen, sizeof(tmds_oen)); ++ if (ret) { ++ DRM_DEBUG_KMS("Failed to %s TMDS output buffers (%d attempts)\n", ++ enable ? "enable" : "disable", ++ retry + 1); ++ return ret; ++ } ++ ++ ret = drm_dp_dual_mode_read(adapter, DP_DUAL_MODE_TMDS_OEN, ++ &tmp, sizeof(tmp)); ++ if (ret) { ++ DRM_DEBUG_KMS("I2C read failed during TMDS output buffer %s (%d attempts)\n", ++ enable ? "enabling" : "disabling", ++ retry + 1); ++ return ret; ++ } ++ ++ if (tmp == tmds_oen) ++ return 0; + } + +- return 0; ++ DRM_DEBUG_KMS("I2C write value mismatch during TMDS output buffer %s\n", ++ enable ? "enabling" : "disabling"); ++ ++ return -EIO; + } + EXPORT_SYMBOL(drm_dp_dual_mode_set_tmds_output); + +diff --git a/drivers/gpu/drm/i915/gvt/kvmgt.c b/drivers/gpu/drm/i915/gvt/kvmgt.c +index 83e88c70272a..9bf4045cd679 100644 +--- a/drivers/gpu/drm/i915/gvt/kvmgt.c ++++ b/drivers/gpu/drm/i915/gvt/kvmgt.c +@@ -1153,7 +1153,7 @@ static long intel_vgpu_ioctl(struct mdev_device *mdev, unsigned int cmd, + return 0; + } + +- return 0; ++ return -ENOTTY; + } + + static ssize_t +diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h +index 3f818412765c..51411894d2cd 100644 +--- a/drivers/gpu/drm/i915/i915_drv.h ++++ b/drivers/gpu/drm/i915/i915_drv.h +@@ -3995,7 +3995,11 @@ extern void intel_display_print_error_state(struct drm_i915_error_state_buf *e, + struct intel_display_error_state *error); + + int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val); +-int sandybridge_pcode_write(struct drm_i915_private *dev_priv, u32 mbox, u32 val); ++int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, u32 mbox, ++ u32 val, int timeout_us); ++#define sandybridge_pcode_write(dev_priv, mbox, val) \ ++ sandybridge_pcode_write_timeout(dev_priv, mbox, val, 500) ++ + int skl_pcode_request(struct drm_i915_private *dev_priv, u32 mbox, u32 request, + u32 reply_mask, u32 reply, int timeout_base_ms); + +diff --git a/drivers/gpu/drm/i915/i915_gem_execbuffer.c b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +index de8ca5f1dd2e..4cc9ce4b5b16 100644 +--- a/drivers/gpu/drm/i915/i915_gem_execbuffer.c ++++ b/drivers/gpu/drm/i915/i915_gem_execbuffer.c +@@ -722,7 +722,7 @@ static int eb_lookup_vmas(struct i915_execbuffer *eb) + + err = radix_tree_insert(handles_vma, handle, vma); + if (unlikely(err)) { +- kfree(lut); ++ kmem_cache_free(eb->i915->luts, lut); + goto err_obj; + } + +diff --git a/drivers/gpu/drm/i915/intel_audio.c b/drivers/gpu/drm/i915/intel_audio.c +index 27743be5b768..9240fa79de7c 100644 +--- a/drivers/gpu/drm/i915/intel_audio.c ++++ b/drivers/gpu/drm/i915/intel_audio.c +@@ -704,7 +704,7 @@ static void i915_audio_component_codec_wake_override(struct device *kdev, + struct drm_i915_private *dev_priv = kdev_to_i915(kdev); + u32 tmp; + +- if (!IS_GEN9_BC(dev_priv)) ++ if (!IS_GEN9(dev_priv)) + return; + + i915_audio_component_get_power(kdev); +diff --git a/drivers/gpu/drm/i915/intel_cdclk.c b/drivers/gpu/drm/i915/intel_cdclk.c +index 26a8dcd2c549..47ad24229c78 100644 +--- a/drivers/gpu/drm/i915/intel_cdclk.c ++++ b/drivers/gpu/drm/i915/intel_cdclk.c +@@ -1289,10 +1289,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, + break; + } + +- /* Inform power controller of upcoming frequency change */ + mutex_lock(&dev_priv->rps.hw_lock); +- ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, +- 0x80000000); ++ /* ++ * Inform power controller of upcoming frequency change. BSpec ++ * requires us to wait up to 150usec, but that leads to timeouts; ++ * the 2ms used here is based on experiment. ++ */ ++ ret = sandybridge_pcode_write_timeout(dev_priv, ++ HSW_PCODE_DE_WRITE_FREQ_REQ, ++ 0x80000000, 2000); + mutex_unlock(&dev_priv->rps.hw_lock); + + if (ret) { +@@ -1323,8 +1328,15 @@ static void bxt_set_cdclk(struct drm_i915_private *dev_priv, + I915_WRITE(CDCLK_CTL, val); + + mutex_lock(&dev_priv->rps.hw_lock); +- ret = sandybridge_pcode_write(dev_priv, HSW_PCODE_DE_WRITE_FREQ_REQ, +- DIV_ROUND_UP(cdclk, 25000)); ++ /* ++ * The timeout isn't specified, the 2ms used here is based on ++ * experiment. ++ * FIXME: Waiting for the request completion could be delayed until ++ * the next PCODE request based on BSpec. ++ */ ++ ret = sandybridge_pcode_write_timeout(dev_priv, ++ HSW_PCODE_DE_WRITE_FREQ_REQ, ++ DIV_ROUND_UP(cdclk, 25000), 2000); + mutex_unlock(&dev_priv->rps.hw_lock); + + if (ret) { +diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c +index 014e5c08571a..87cccb5f8c5d 100644 +--- a/drivers/gpu/drm/i915/intel_pm.c ++++ b/drivers/gpu/drm/i915/intel_pm.c +@@ -8941,8 +8941,8 @@ int sandybridge_pcode_read(struct drm_i915_private *dev_priv, u32 mbox, u32 *val + return 0; + } + +-int sandybridge_pcode_write(struct drm_i915_private *dev_priv, +- u32 mbox, u32 val) ++int sandybridge_pcode_write_timeout(struct drm_i915_private *dev_priv, ++ u32 mbox, u32 val, int timeout_us) + { + int status; + +@@ -8965,7 +8965,7 @@ int sandybridge_pcode_write(struct drm_i915_private *dev_priv, + + if (__intel_wait_for_register_fw(dev_priv, + GEN6_PCODE_MAILBOX, GEN6_PCODE_READY, 0, +- 500, 0, NULL)) { ++ timeout_us, 0, NULL)) { + DRM_ERROR("timeout waiting for pcode write of 0x%08x to mbox %x to finish for %ps\n", + val, mbox, __builtin_return_address(0)); + return -ETIMEDOUT; +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h +index 53d01fb00a8b..1dbe593e5960 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gf100.fuc3.h +@@ -47,8 +47,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x00000756, +- 0x00000748, ++ 0x00000754, ++ 0x00000746, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x0000075a, + 0x00000758, ++ 0x00000756, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x00000b8a, +- 0x00000a2d, ++ 0x00000b88, ++ 0x00000a2b, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000bb3, +- 0x00000b8c, ++ 0x00000bb1, ++ 0x00000b8a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gf100_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000bbf, + 0x00000bbd, ++ 0x00000bbb, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -237,19 +237,19 @@ static uint32_t gf100_pmu_data[] = { + 0x000005d3, + 0x00000003, + 0x00000002, +- 0x0000069d, ++ 0x0000069b, + 0x00040004, + 0x00000000, +- 0x000006b9, ++ 0x000006b7, + 0x00010005, + 0x00000000, +- 0x000006d6, ++ 0x000006d4, + 0x00010006, + 0x00000000, + 0x0000065b, + 0x00000007, + 0x00000000, +- 0x000006e1, ++ 0x000006df, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1373,432 +1373,432 @@ static uint32_t gf100_pmu_code[] = { + /* 0x065b: memx_func_wait_vblank */ + 0x9800f840, + 0x66b00016, +- 0x130bf400, ++ 0x120bf400, + 0xf40166b0, + 0x0ef4060b, + /* 0x066d: memx_func_wait_vblank_head1 */ +- 0x2077f12e, +- 0x070ef400, +-/* 0x0674: memx_func_wait_vblank_head0 */ +- 0x000877f1, +-/* 0x0678: memx_func_wait_vblank_0 */ +- 0x07c467f1, +- 0xcf0664b6, +- 0x67fd0066, +- 0xf31bf404, +-/* 0x0688: memx_func_wait_vblank_1 */ +- 0x07c467f1, +- 0xcf0664b6, +- 0x67fd0066, +- 0xf30bf404, +-/* 0x0698: memx_func_wait_vblank_fini */ +- 0xf80410b6, +-/* 0x069d: memx_func_wr32 */ +- 0x00169800, +- 0xb6011598, +- 0x60f90810, +- 0xd0fc50f9, +- 0x21f4e0fc, +- 0x0242b640, +- 0xf8e91bf4, +-/* 0x06b9: memx_func_wait */ +- 0x2c87f000, +- 0xcf0684b6, +- 0x1e980088, +- 0x011d9800, +- 0x98021c98, +- 0x10b6031b, +- 0xa321f410, +-/* 0x06d6: memx_func_delay */ +- 0x1e9800f8, +- 0x0410b600, +- 0xf87e21f4, +-/* 0x06e1: memx_func_train */ +-/* 0x06e3: memx_exec */ +- 0xf900f800, +- 0xb9d0f9e0, +- 0xb2b902c1, +-/* 0x06ed: memx_exec_next */ +- 0x00139802, +- 0xe70410b6, +- 0xe701f034, +- 0xb601e033, +- 0x30f00132, +- 0xde35980c, +- 0x12b855f9, +- 0xe41ef406, +- 0x98f10b98, +- 0xcbbbf20c, +- 0xc4b7f102, +- 0x06b4b607, +- 0xfc00bbcf, +- 0xf5e0fcd0, +- 0xf8033621, +-/* 0x0729: memx_info */ +- 0x01c67000, +-/* 0x072f: memx_info_data */ +- 0xf10e0bf4, +- 0xf103ccc7, +- 0xf40800b7, +-/* 0x073a: memx_info_train */ +- 0xc7f10b0e, +- 0xb7f10bcc, +-/* 0x0742: memx_info_send */ +- 0x21f50100, +- 0x00f80336, +-/* 0x0748: memx_recv */ +- 0xf401d6b0, +- 0xd6b0980b, +- 0xd80bf400, +-/* 0x0756: memx_init */ +- 0x00f800f8, +-/* 0x0758: perf_recv */ +-/* 0x075a: perf_init */ ++ 0x2077f02c, ++/* 0x0673: memx_func_wait_vblank_head0 */ ++ 0xf0060ef4, ++/* 0x0676: memx_func_wait_vblank_0 */ ++ 0x67f10877, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x0686: memx_func_wait_vblank_1 */ ++ 0x67f1f31b, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x0696: memx_func_wait_vblank_fini */ ++ 0x10b6f30b, ++/* 0x069b: memx_func_wr32 */ ++ 0x9800f804, ++ 0x15980016, ++ 0x0810b601, ++ 0x50f960f9, ++ 0xe0fcd0fc, ++ 0xb64021f4, ++ 0x1bf40242, ++/* 0x06b7: memx_func_wait */ ++ 0xf000f8e9, ++ 0x84b62c87, ++ 0x0088cf06, ++ 0x98001e98, ++ 0x1c98011d, ++ 0x031b9802, ++ 0xf41010b6, ++ 0x00f8a321, ++/* 0x06d4: memx_func_delay */ ++ 0xb6001e98, ++ 0x21f40410, ++/* 0x06df: memx_func_train */ ++ 0xf800f87e, ++/* 0x06e1: memx_exec */ ++ 0xf9e0f900, ++ 0x02c1b9d0, ++/* 0x06eb: memx_exec_next */ ++ 0x9802b2b9, ++ 0x10b60013, ++ 0xf034e704, ++ 0xe033e701, ++ 0x0132b601, ++ 0x980c30f0, ++ 0x55f9de35, ++ 0xf40612b8, ++ 0x0b98e41e, ++ 0xf20c98f1, ++ 0xf102cbbb, ++ 0xb607c4b7, ++ 0xbbcf06b4, ++ 0xfcd0fc00, ++ 0x3621f5e0, ++/* 0x0727: memx_info */ ++ 0x7000f803, ++ 0x0bf401c6, ++/* 0x072d: memx_info_data */ ++ 0xccc7f10e, ++ 0x00b7f103, ++ 0x0b0ef408, ++/* 0x0738: memx_info_train */ ++ 0x0bccc7f1, ++ 0x0100b7f1, ++/* 0x0740: memx_info_send */ ++ 0x033621f5, ++/* 0x0746: memx_recv */ ++ 0xd6b000f8, ++ 0x980bf401, ++ 0xf400d6b0, ++ 0x00f8d80b, ++/* 0x0754: memx_init */ ++/* 0x0756: perf_recv */ + 0x00f800f8, +-/* 0x075c: i2c_drive_scl */ +- 0xf40036b0, +- 0x07f1110b, +- 0x04b607e0, +- 0x0001d006, +- 0x00f804bd, +-/* 0x0770: i2c_drive_scl_lo */ +- 0x07e407f1, +- 0xd00604b6, +- 0x04bd0001, +-/* 0x077e: i2c_drive_sda */ ++/* 0x0758: perf_init */ ++/* 0x075a: i2c_drive_scl */ + 0x36b000f8, + 0x110bf400, + 0x07e007f1, + 0xd00604b6, +- 0x04bd0002, +-/* 0x0792: i2c_drive_sda_lo */ ++ 0x04bd0001, ++/* 0x076e: i2c_drive_scl_lo */ + 0x07f100f8, + 0x04b607e4, ++ 0x0001d006, ++ 0x00f804bd, ++/* 0x077c: i2c_drive_sda */ ++ 0xf40036b0, ++ 0x07f1110b, ++ 0x04b607e0, + 0x0002d006, + 0x00f804bd, +-/* 0x07a0: i2c_sense_scl */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0431fd00, +- 0xf4060bf4, +-/* 0x07b6: i2c_sense_scl_done */ +- 0x00f80131, +-/* 0x07b8: i2c_sense_sda */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0432fd00, +- 0xf4060bf4, +-/* 0x07ce: i2c_sense_sda_done */ +- 0x00f80131, +-/* 0x07d0: i2c_raise_scl */ +- 0x47f140f9, +- 0x37f00898, +- 0x5c21f501, +-/* 0x07dd: i2c_raise_scl_wait */ +- 0xe8e7f107, +- 0x7e21f403, +- 0x07a021f5, +- 0xb60901f4, +- 0x1bf40142, +-/* 0x07f1: i2c_raise_scl_done */ +- 0xf840fcef, +-/* 0x07f5: i2c_start */ +- 0xa021f500, +- 0x0d11f407, +- 0x07b821f5, +- 0xf40611f4, +-/* 0x0806: i2c_start_rep */ +- 0x37f0300e, +- 0x5c21f500, +- 0x0137f007, +- 0x077e21f5, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0xd021f550, +- 0x0464b607, +-/* 0x0833: i2c_start_send */ +- 0xf01f11f4, ++/* 0x0790: i2c_drive_sda_lo */ ++ 0x07e407f1, ++ 0xd00604b6, ++ 0x04bd0002, ++/* 0x079e: i2c_sense_scl */ ++ 0x32f400f8, ++ 0xc437f101, ++ 0x0634b607, ++ 0xfd0033cf, ++ 0x0bf40431, ++ 0x0131f406, ++/* 0x07b4: i2c_sense_scl_done */ ++/* 0x07b6: i2c_sense_sda */ ++ 0x32f400f8, ++ 0xc437f101, ++ 0x0634b607, ++ 0xfd0033cf, ++ 0x0bf40432, ++ 0x0131f406, ++/* 0x07cc: i2c_sense_sda_done */ ++/* 0x07ce: i2c_raise_scl */ ++ 0x40f900f8, ++ 0x089847f1, ++ 0xf50137f0, ++/* 0x07db: i2c_raise_scl_wait */ ++ 0xf1075a21, ++ 0xf403e8e7, ++ 0x21f57e21, ++ 0x01f4079e, ++ 0x0142b609, ++/* 0x07ef: i2c_raise_scl_done */ ++ 0xfcef1bf4, ++/* 0x07f3: i2c_start */ ++ 0xf500f840, ++ 0xf4079e21, ++ 0x21f50d11, ++ 0x11f407b6, ++ 0x300ef406, ++/* 0x0804: i2c_start_rep */ ++ 0xf50037f0, ++ 0xf0075a21, ++ 0x21f50137, ++ 0x76bb077c, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb607ce21, ++ 0x11f40464, ++/* 0x0831: i2c_start_send */ ++ 0x0037f01f, ++ 0x077c21f5, ++ 0x1388e7f1, ++ 0xf07e21f4, + 0x21f50037, +- 0xe7f1077e, ++ 0xe7f1075a, + 0x21f41388, +- 0x0037f07e, +- 0x075c21f5, +- 0x1388e7f1, +-/* 0x084f: i2c_start_out */ +- 0xf87e21f4, +-/* 0x0851: i2c_stop */ +- 0x0037f000, +- 0x075c21f5, +- 0xf50037f0, +- 0xf1077e21, +- 0xf403e8e7, +- 0x37f07e21, +- 0x5c21f501, +- 0x88e7f107, +- 0x7e21f413, ++/* 0x084d: i2c_start_out */ ++/* 0x084f: i2c_stop */ ++ 0xf000f87e, ++ 0x21f50037, ++ 0x37f0075a, ++ 0x7c21f500, ++ 0xe8e7f107, ++ 0x7e21f403, + 0xf50137f0, +- 0xf1077e21, ++ 0xf1075a21, + 0xf41388e7, +- 0x00f87e21, +-/* 0x0884: i2c_bitw */ +- 0x077e21f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x07d021f5, +- 0xf40464b6, +- 0xe7f11811, +- 0x21f41388, +- 0x0037f07e, +- 0x075c21f5, +- 0x1388e7f1, +-/* 0x08c3: i2c_bitw_out */ +- 0xf87e21f4, +-/* 0x08c5: i2c_bitr */ +- 0x0137f000, +- 0x077e21f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x07d021f5, +- 0xf40464b6, +- 0x21f51b11, +- 0x37f007b8, +- 0x5c21f500, ++ 0x37f07e21, ++ 0x7c21f501, + 0x88e7f107, + 0x7e21f413, +- 0xf4013cf0, +-/* 0x090a: i2c_bitr_done */ +- 0x00f80131, +-/* 0x090c: i2c_get_byte */ +- 0xf00057f0, +-/* 0x0912: i2c_get_byte_next */ +- 0x54b60847, +- 0x0076bb01, ++/* 0x0882: i2c_bitw */ ++ 0x21f500f8, ++ 0xe7f1077c, ++ 0x21f403e8, ++ 0x0076bb7e, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b608c5, +- 0x2b11f404, +- 0xb60553fd, +- 0x1bf40142, +- 0x0137f0d8, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0x8421f550, +- 0x0464b608, +-/* 0x095c: i2c_get_byte_done */ +-/* 0x095e: i2c_put_byte */ +- 0x47f000f8, +-/* 0x0961: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, ++ 0x64b607ce, ++ 0x1811f404, ++ 0x1388e7f1, ++ 0xf07e21f4, ++ 0x21f50037, ++ 0xe7f1075a, ++ 0x21f41388, ++/* 0x08c1: i2c_bitw_out */ ++/* 0x08c3: i2c_bitr */ ++ 0xf000f87e, ++ 0x21f50137, ++ 0xe7f1077c, ++ 0x21f403e8, ++ 0x0076bb7e, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b607ce, ++ 0x1b11f404, ++ 0x07b621f5, ++ 0xf50037f0, ++ 0xf1075a21, ++ 0xf41388e7, ++ 0x3cf07e21, ++ 0x0131f401, ++/* 0x0908: i2c_bitr_done */ ++/* 0x090a: i2c_get_byte */ ++ 0x57f000f8, ++ 0x0847f000, ++/* 0x0910: i2c_get_byte_next */ ++ 0xbb0154b6, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x088421f5, ++ 0x08c321f5, + 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0xc521f550, +- 0x0464b608, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x09b7: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x09b9: i2c_addr */ +- 0x0076bb00, ++ 0x53fd2b11, ++ 0x0142b605, ++ 0xf0d81bf4, ++ 0x76bb0137, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb6088221, ++/* 0x095a: i2c_get_byte_done */ ++ 0x00f80464, ++/* 0x095c: i2c_put_byte */ ++/* 0x095f: i2c_put_byte_next */ ++ 0xb60847f0, ++ 0x54ff0142, ++ 0x0076bb38, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b607f5, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, ++ 0x64b60882, ++ 0x3411f404, ++ 0xf40046b0, ++ 0x76bbd81b, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb6095e21, +-/* 0x09fe: i2c_addr_done */ +- 0x00f80464, +-/* 0x0a00: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b702e4, +- 0xee980d1c, +-/* 0x0a0f: i2c_acquire */ +- 0xf500f800, +- 0xf40a0021, +- 0xd9f00421, +- 0x4021f403, +-/* 0x0a1e: i2c_release */ +- 0x21f500f8, +- 0x21f40a00, +- 0x03daf004, +- 0xf84021f4, +-/* 0x0a2d: i2c_recv */ +- 0x0132f400, +- 0xb6f8c1c7, +- 0x16b00214, +- 0x3a1ff528, +- 0xf413a001, +- 0x0032980c, +- 0x0ccc13a0, +- 0xf4003198, +- 0xd0f90231, +- 0xd0f9e0f9, +- 0x000067f1, +- 0x100063f1, +- 0xbb016792, ++ 0xb608c321, ++ 0x11f40464, ++ 0x0076bb0f, ++ 0xf40136b0, ++ 0x32f4061b, ++/* 0x09b5: i2c_put_byte_done */ ++/* 0x09b7: i2c_addr */ ++ 0xbb00f801, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0a0f21f5, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b31bf5, +- 0xbb0057f0, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x09b921f5, +- 0xf50464b6, +- 0xc700d011, +- 0x76bbe0c5, +- 0x0465b600, +- 0x659450f9, +- 0x0256bb04, +- 0x75fd50bd, +- 0xf550fc04, +- 0xb6095e21, +- 0x11f50464, +- 0x57f000ad, ++ 0x07f321f5, ++ 0xf40464b6, ++ 0xc3e72911, ++ 0x34b6012e, ++ 0x0553fd01, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x5c21f550, ++ 0x0464b609, ++/* 0x09fc: i2c_addr_done */ ++/* 0x09fe: i2c_acquire_addr */ ++ 0xcec700f8, ++ 0x02e4b6f8, ++ 0x0d1ce0b7, ++ 0xf800ee98, ++/* 0x0a0d: i2c_acquire */ ++ 0xfe21f500, ++ 0x0421f409, ++ 0xf403d9f0, ++ 0x00f84021, ++/* 0x0a1c: i2c_release */ ++ 0x09fe21f5, ++ 0xf00421f4, ++ 0x21f403da, ++/* 0x0a2b: i2c_recv */ ++ 0xf400f840, ++ 0xc1c70132, ++ 0x0214b6f8, ++ 0xf52816b0, ++ 0xa0013a1f, ++ 0x980cf413, ++ 0x13a00032, ++ 0x31980ccc, ++ 0x0231f400, ++ 0xe0f9d0f9, ++ 0x67f1d0f9, ++ 0x63f10000, ++ 0x67921000, + 0x0076bb01, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b609b9, +- 0x8a11f504, ++ 0x64b60a0d, ++ 0xb0d0fc04, ++ 0x1bf500d6, ++ 0x57f000b3, + 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b6090c, +- 0x6a11f404, +- 0xbbe05bcb, ++ 0x64b609b7, ++ 0xd011f504, ++ 0xe0c5c700, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x5c21f550, ++ 0x0464b609, ++ 0x00ad11f5, ++ 0xbb0157f0, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x085121f5, +- 0xb90464b6, +- 0x74bd025b, +-/* 0x0b33: i2c_recv_not_rd08 */ +- 0xb0430ef4, +- 0x1bf401d6, +- 0x0057f03d, +- 0x09b921f5, +- 0xc73311f4, +- 0x21f5e0c5, +- 0x11f4095e, +- 0x0057f029, +- 0x09b921f5, +- 0xc71f11f4, +- 0x21f5e0b5, +- 0x11f4095e, +- 0x5121f515, +- 0xc774bd08, +- 0x1bf408c5, +- 0x0232f409, +-/* 0x0b73: i2c_recv_not_wr08 */ +-/* 0x0b73: i2c_recv_done */ +- 0xc7030ef4, +- 0x21f5f8ce, +- 0xe0fc0a1e, +- 0x12f4d0fc, +- 0x027cb90a, +- 0x033621f5, +-/* 0x0b88: i2c_recv_exit */ +-/* 0x0b8a: i2c_init */ +- 0x00f800f8, +-/* 0x0b8c: test_recv */ +- 0x05d817f1, ++ 0x09b721f5, ++ 0xf50464b6, ++ 0xbb008a11, ++ 0x65b60076, ++ 0x9450f904, ++ 0x56bb0465, ++ 0xfd50bd02, ++ 0x50fc0475, ++ 0x090a21f5, ++ 0xf40464b6, ++ 0x5bcb6a11, ++ 0x0076bbe0, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b6084f, ++ 0x025bb904, ++ 0x0ef474bd, ++/* 0x0b31: i2c_recv_not_rd08 */ ++ 0x01d6b043, ++ 0xf03d1bf4, ++ 0x21f50057, ++ 0x11f409b7, ++ 0xe0c5c733, ++ 0x095c21f5, ++ 0xf02911f4, ++ 0x21f50057, ++ 0x11f409b7, ++ 0xe0b5c71f, ++ 0x095c21f5, ++ 0xf51511f4, ++ 0xbd084f21, ++ 0x08c5c774, ++ 0xf4091bf4, ++ 0x0ef40232, ++/* 0x0b71: i2c_recv_not_wr08 */ ++/* 0x0b71: i2c_recv_done */ ++ 0xf8cec703, ++ 0x0a1c21f5, ++ 0xd0fce0fc, ++ 0xb90a12f4, ++ 0x21f5027c, ++/* 0x0b86: i2c_recv_exit */ ++ 0x00f80336, ++/* 0x0b88: i2c_init */ ++/* 0x0b8a: test_recv */ ++ 0x17f100f8, ++ 0x14b605d8, ++ 0x0011cf06, ++ 0xf10110b6, ++ 0xb605d807, ++ 0x01d00604, ++ 0xf104bd00, ++ 0xf1d900e7, ++ 0xf5134fe3, ++ 0xf8025621, ++/* 0x0bb1: test_init */ ++ 0x00e7f100, ++ 0x5621f508, ++/* 0x0bbb: idle_recv */ ++ 0xf800f802, ++/* 0x0bbd: idle */ ++ 0x0031f400, ++ 0x05d417f1, + 0xcf0614b6, + 0x10b60011, +- 0xd807f101, ++ 0xd407f101, + 0x0604b605, + 0xbd0001d0, +- 0x00e7f104, +- 0x4fe3f1d9, +- 0x5621f513, +-/* 0x0bb3: test_init */ +- 0xf100f802, +- 0xf50800e7, +- 0xf8025621, +-/* 0x0bbd: idle_recv */ +-/* 0x0bbf: idle */ +- 0xf400f800, +- 0x17f10031, +- 0x14b605d4, +- 0x0011cf06, +- 0xf10110b6, +- 0xb605d407, +- 0x01d00604, +-/* 0x0bdb: idle_loop */ +- 0xf004bd00, +- 0x32f45817, +-/* 0x0be1: idle_proc */ +-/* 0x0be1: idle_proc_exec */ +- 0xb910f902, +- 0x21f5021e, +- 0x10fc033f, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0bf5: idle_proc_next */ +- 0x5810b6ef, +- 0xf4061fb8, +- 0x02f4e61b, +- 0x0028f4dd, +- 0x00bb0ef4, ++/* 0x0bd9: idle_loop */ ++ 0x5817f004, ++/* 0x0bdf: idle_proc */ ++/* 0x0bdf: idle_proc_exec */ ++ 0xf90232f4, ++ 0x021eb910, ++ 0x033f21f5, ++ 0x11f410fc, ++ 0x0231f409, ++/* 0x0bf3: idle_proc_next */ ++ 0xb6ef0ef4, ++ 0x1fb85810, ++ 0xe61bf406, ++ 0xf4dd02f4, ++ 0x0ef40028, ++ 0x000000bb, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h +index c4edbc79e41a..e0222cb832fb 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gk208.fuc5.h +@@ -47,8 +47,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x000005f3, +- 0x000005e5, ++ 0x000005ee, ++ 0x000005e0, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x000005f7, +- 0x000005f5, ++ 0x000005f2, ++ 0x000005f0, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x000009f8, +- 0x000008a2, ++ 0x000009f3, ++ 0x0000089d, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000a16, +- 0x000009fa, ++ 0x00000a11, ++ 0x000009f5, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gk208_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000a21, +- 0x00000a1f, ++ 0x00000a1c, ++ 0x00000a1a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -234,22 +234,22 @@ static uint32_t gk208_pmu_data[] = { + /* 0x037c: memx_func_next */ + 0x00000002, + 0x00000000, +- 0x000004cf, ++ 0x000004cc, + 0x00000003, + 0x00000002, +- 0x00000546, ++ 0x00000541, + 0x00040004, + 0x00000000, +- 0x00000563, ++ 0x0000055e, + 0x00010005, + 0x00000000, +- 0x0000057d, ++ 0x00000578, + 0x00010006, + 0x00000000, +- 0x00000541, ++ 0x0000053c, + 0x00000007, + 0x00000000, +- 0x00000589, ++ 0x00000584, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1239,454 +1239,454 @@ static uint32_t gk208_pmu_code[] = { + 0x0001f604, + 0x00f804bd, + /* 0x045c: memx_func_enter */ +- 0x162067f1, +- 0xf55d77f1, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90487fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0x0700002d, +- 0x7e6eb2fe, ++ 0x47162046, ++ 0x6eb2f55d, ++ 0x0000047e, ++ 0x87fdd8b2, ++ 0xf960f904, ++ 0xfcd0fc80, ++ 0x002d7ee0, ++ 0xb2fe0700, ++ 0x00047e6e, ++ 0xfdd8b200, ++ 0x60f90487, ++ 0xd0fc80f9, ++ 0x2d7ee0fc, ++ 0xf0460000, ++ 0x7e6eb226, + 0xb2000004, + 0x0487fdd8, + 0x80f960f9, + 0xe0fcd0fc, + 0x00002d7e, +- 0x26f067f1, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90487fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0x0600002d, +- 0x07e04004, +- 0xbd0006f6, +-/* 0x04b9: memx_func_enter_wait */ +- 0x07c04604, +- 0xf00066cf, +- 0x0bf40464, +- 0xcf2c06f7, +- 0x06b50066, +-/* 0x04cf: memx_func_leave */ +- 0x0600f8f1, +- 0x0066cf2c, +- 0x06f206b5, +- 0x07e44004, +- 0xbd0006f6, +-/* 0x04e1: memx_func_leave_wait */ +- 0x07c04604, +- 0xf00066cf, +- 0x1bf40464, +- 0xf067f1f7, ++ 0xe0400406, ++ 0x0006f607, ++/* 0x04b6: memx_func_enter_wait */ ++ 0xc04604bd, ++ 0x0066cf07, ++ 0xf40464f0, ++ 0x2c06f70b, ++ 0xb50066cf, ++ 0x00f8f106, ++/* 0x04cc: memx_func_leave */ ++ 0x66cf2c06, ++ 0xf206b500, ++ 0xe4400406, ++ 0x0006f607, ++/* 0x04de: memx_func_leave_wait */ ++ 0xc04604bd, ++ 0x0066cf07, ++ 0xf40464f0, ++ 0xf046f71b, + 0xb2010726, + 0x00047e6e, + 0xfdd8b200, + 0x60f90587, + 0xd0fc80f9, + 0x2d7ee0fc, +- 0x67f10000, +- 0x6eb21620, +- 0x0000047e, +- 0x87fdd8b2, +- 0xf960f905, +- 0xfcd0fc80, +- 0x002d7ee0, +- 0x0aa24700, +- 0x047e6eb2, +- 0xd8b20000, +- 0xf90587fd, +- 0xfc80f960, +- 0x7ee0fcd0, +- 0xf800002d, +-/* 0x0541: memx_func_wait_vblank */ ++ 0x20460000, ++ 0x7e6eb216, ++ 0xb2000004, ++ 0x0587fdd8, ++ 0x80f960f9, ++ 0xe0fcd0fc, ++ 0x00002d7e, ++ 0xb20aa247, ++ 0x00047e6e, ++ 0xfdd8b200, ++ 0x60f90587, ++ 0xd0fc80f9, ++ 0x2d7ee0fc, ++ 0x00f80000, ++/* 0x053c: memx_func_wait_vblank */ ++ 0xf80410b6, ++/* 0x0541: memx_func_wr32 */ ++ 0x00169800, ++ 0xb6011598, ++ 0x60f90810, ++ 0xd0fc50f9, ++ 0x2d7ee0fc, ++ 0x42b60000, ++ 0xe81bf402, ++/* 0x055e: memx_func_wait */ ++ 0x2c0800f8, ++ 0x980088cf, ++ 0x1d98001e, ++ 0x021c9801, ++ 0xb6031b98, ++ 0x747e1010, ++ 0x00f80000, ++/* 0x0578: memx_func_delay */ ++ 0xb6001e98, ++ 0x587e0410, ++ 0x00f80000, ++/* 0x0584: memx_func_train */ ++/* 0x0586: memx_exec */ ++ 0xe0f900f8, ++ 0xc1b2d0f9, ++/* 0x058e: memx_exec_next */ ++ 0x1398b2b2, + 0x0410b600, +-/* 0x0546: memx_func_wr32 */ +- 0x169800f8, +- 0x01159800, +- 0xf90810b6, +- 0xfc50f960, ++ 0x01f034e7, ++ 0x01e033e7, ++ 0xf00132b6, ++ 0x35980c30, ++ 0xa655f9de, ++ 0xe51ef412, ++ 0x98f10b98, ++ 0xcbbbf20c, ++ 0x07c44b02, ++ 0xfc00bbcf, + 0x7ee0fcd0, +- 0xb600002d, +- 0x1bf40242, +-/* 0x0563: memx_func_wait */ +- 0x0800f8e8, +- 0x0088cf2c, +- 0x98001e98, +- 0x1c98011d, +- 0x031b9802, +- 0x7e1010b6, +- 0xf8000074, +-/* 0x057d: memx_func_delay */ +- 0x001e9800, +- 0x7e0410b6, +- 0xf8000058, +-/* 0x0589: memx_func_train */ +-/* 0x058b: memx_exec */ +- 0xf900f800, +- 0xb2d0f9e0, +-/* 0x0593: memx_exec_next */ +- 0x98b2b2c1, +- 0x10b60013, +- 0xf034e704, +- 0xe033e701, +- 0x0132b601, +- 0x980c30f0, +- 0x55f9de35, +- 0x1ef412a6, +- 0xf10b98e5, +- 0xbbf20c98, +- 0xc44b02cb, +- 0x00bbcf07, +- 0xe0fcd0fc, +- 0x00029f7e, +-/* 0x05ca: memx_info */ +- 0xc67000f8, +- 0x0c0bf401, +-/* 0x05d0: memx_info_data */ +- 0x4b03cc4c, +- 0x0ef40800, +-/* 0x05d9: memx_info_train */ +- 0x0bcc4c09, +-/* 0x05df: memx_info_send */ +- 0x7e01004b, + 0xf800029f, +-/* 0x05e5: memx_recv */ +- 0x01d6b000, +- 0xb0a30bf4, +- 0x0bf400d6, +-/* 0x05f3: memx_init */ +- 0xf800f8dc, +-/* 0x05f5: perf_recv */ +-/* 0x05f7: perf_init */ +- 0xf800f800, +-/* 0x05f9: i2c_drive_scl */ +- 0x0036b000, +- 0x400d0bf4, +- 0x01f607e0, +- 0xf804bd00, +-/* 0x0609: i2c_drive_scl_lo */ +- 0x07e44000, +- 0xbd0001f6, +-/* 0x0613: i2c_drive_sda */ +- 0xb000f804, +- 0x0bf40036, +- 0x07e0400d, +- 0xbd0002f6, +-/* 0x0623: i2c_drive_sda_lo */ +- 0x4000f804, +- 0x02f607e4, +- 0xf804bd00, +-/* 0x062d: i2c_sense_scl */ +- 0x0132f400, +- 0xcf07c443, +- 0x31fd0033, +- 0x060bf404, +-/* 0x063f: i2c_sense_scl_done */ +- 0xf80131f4, +-/* 0x0641: i2c_sense_sda */ +- 0x0132f400, +- 0xcf07c443, +- 0x32fd0033, +- 0x060bf404, +-/* 0x0653: i2c_sense_sda_done */ +- 0xf80131f4, +-/* 0x0655: i2c_raise_scl */ +- 0x4440f900, +- 0x01030898, +- 0x0005f97e, +-/* 0x0660: i2c_raise_scl_wait */ +- 0x7e03e84e, +- 0x7e000058, +- 0xf400062d, +- 0x42b60901, +- 0xef1bf401, +-/* 0x0674: i2c_raise_scl_done */ +- 0x00f840fc, +-/* 0x0678: i2c_start */ +- 0x00062d7e, +- 0x7e0d11f4, +- 0xf4000641, +- 0x0ef40611, +-/* 0x0689: i2c_start_rep */ +- 0x7e00032e, +- 0x030005f9, +- 0x06137e01, ++/* 0x05c5: memx_info */ ++ 0x01c67000, ++/* 0x05cb: memx_info_data */ ++ 0x4c0c0bf4, ++ 0x004b03cc, ++ 0x090ef408, ++/* 0x05d4: memx_info_train */ ++ 0x4b0bcc4c, ++/* 0x05da: memx_info_send */ ++ 0x9f7e0100, ++ 0x00f80002, ++/* 0x05e0: memx_recv */ ++ 0xf401d6b0, ++ 0xd6b0a30b, ++ 0xdc0bf400, ++/* 0x05ee: memx_init */ ++ 0x00f800f8, ++/* 0x05f0: perf_recv */ ++/* 0x05f2: perf_init */ ++ 0x00f800f8, ++/* 0x05f4: i2c_drive_scl */ ++ 0xf40036b0, ++ 0xe0400d0b, ++ 0x0001f607, ++ 0x00f804bd, ++/* 0x0604: i2c_drive_scl_lo */ ++ 0xf607e440, ++ 0x04bd0001, ++/* 0x060e: i2c_drive_sda */ ++ 0x36b000f8, ++ 0x0d0bf400, ++ 0xf607e040, ++ 0x04bd0002, ++/* 0x061e: i2c_drive_sda_lo */ ++ 0xe44000f8, ++ 0x0002f607, ++ 0x00f804bd, ++/* 0x0628: i2c_sense_scl */ ++ 0x430132f4, ++ 0x33cf07c4, ++ 0x0431fd00, ++ 0xf4060bf4, ++/* 0x063a: i2c_sense_scl_done */ ++ 0x00f80131, ++/* 0x063c: i2c_sense_sda */ ++ 0x430132f4, ++ 0x33cf07c4, ++ 0x0432fd00, ++ 0xf4060bf4, ++/* 0x064e: i2c_sense_sda_done */ ++ 0x00f80131, ++/* 0x0650: i2c_raise_scl */ ++ 0x984440f9, ++ 0x7e010308, ++/* 0x065b: i2c_raise_scl_wait */ ++ 0x4e0005f4, ++ 0x587e03e8, ++ 0x287e0000, ++ 0x01f40006, ++ 0x0142b609, ++/* 0x066f: i2c_raise_scl_done */ ++ 0xfcef1bf4, ++/* 0x0673: i2c_start */ ++ 0x7e00f840, ++ 0xf4000628, ++ 0x3c7e0d11, ++ 0x11f40006, ++ 0x2e0ef406, ++/* 0x0684: i2c_start_rep */ ++ 0xf47e0003, ++ 0x01030005, ++ 0x00060e7e, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x06507e50, ++ 0x0464b600, ++/* 0x06af: i2c_start_send */ ++ 0x031d11f4, ++ 0x060e7e00, ++ 0x13884e00, ++ 0x0000587e, ++ 0xf47e0003, ++ 0x884e0005, ++ 0x00587e13, ++/* 0x06c9: i2c_start_out */ ++/* 0x06cb: i2c_stop */ ++ 0x0300f800, ++ 0x05f47e00, ++ 0x7e000300, ++ 0x4e00060e, ++ 0x587e03e8, ++ 0x01030000, ++ 0x0005f47e, ++ 0x7e13884e, ++ 0x03000058, ++ 0x060e7e01, ++ 0x13884e00, ++ 0x0000587e, ++/* 0x06fa: i2c_bitw */ ++ 0x0e7e00f8, ++ 0xe84e0006, ++ 0x00587e03, + 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0x557e50fc, ++ 0x507e50fc, + 0x64b60006, +- 0x1d11f404, +-/* 0x06b4: i2c_start_send */ +- 0x137e0003, +- 0x884e0006, +- 0x00587e13, +- 0x7e000300, +- 0x4e0005f9, +- 0x587e1388, +-/* 0x06ce: i2c_start_out */ +- 0x00f80000, +-/* 0x06d0: i2c_stop */ +- 0xf97e0003, +- 0x00030005, +- 0x0006137e, +- 0x7e03e84e, ++ 0x1711f404, ++ 0x7e13884e, + 0x03000058, +- 0x05f97e01, ++ 0x05f47e00, + 0x13884e00, + 0x0000587e, +- 0x137e0103, +- 0x884e0006, +- 0x00587e13, +-/* 0x06ff: i2c_bitw */ +- 0x7e00f800, +- 0x4e000613, +- 0x587e03e8, +- 0x76bb0000, ++/* 0x0738: i2c_bitw_out */ ++/* 0x073a: i2c_bitr */ ++ 0x010300f8, ++ 0x00060e7e, ++ 0x7e03e84e, ++ 0xbb000058, ++ 0x65b60076, ++ 0x9450f904, ++ 0x56bb0465, ++ 0xfd50bd02, ++ 0x50fc0475, ++ 0x0006507e, ++ 0xf40464b6, ++ 0x3c7e1a11, ++ 0x00030006, ++ 0x0005f47e, ++ 0x7e13884e, ++ 0xf0000058, ++ 0x31f4013c, ++/* 0x077d: i2c_bitr_done */ ++/* 0x077f: i2c_get_byte */ ++ 0x0500f801, ++/* 0x0783: i2c_get_byte_next */ ++ 0xb6080400, ++ 0x76bb0154, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0x7e50fc04, +- 0xb6000655, ++ 0xb600073a, + 0x11f40464, +- 0x13884e17, +- 0x0000587e, +- 0xf97e0003, +- 0x884e0005, +- 0x00587e13, +-/* 0x073d: i2c_bitw_out */ +-/* 0x073f: i2c_bitr */ +- 0x0300f800, +- 0x06137e01, +- 0x03e84e00, +- 0x0000587e, ++ 0x0553fd2a, ++ 0xf40142b6, ++ 0x0103d81b, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0x06557e50, ++ 0x06fa7e50, + 0x0464b600, +- 0x7e1a11f4, +- 0x03000641, +- 0x05f97e00, +- 0x13884e00, +- 0x0000587e, +- 0xf4013cf0, +-/* 0x0782: i2c_bitr_done */ +- 0x00f80131, +-/* 0x0784: i2c_get_byte */ +- 0x08040005, +-/* 0x0788: i2c_get_byte_next */ +- 0xbb0154b6, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x00073f7e, +- 0xf40464b6, +- 0x53fd2a11, +- 0x0142b605, +- 0x03d81bf4, +- 0x0076bb01, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0xff7e50fc, +- 0x64b60006, +-/* 0x07d1: i2c_get_byte_done */ +-/* 0x07d3: i2c_put_byte */ +- 0x0400f804, +-/* 0x07d5: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, ++/* 0x07cc: i2c_get_byte_done */ ++/* 0x07ce: i2c_put_byte */ ++ 0x080400f8, ++/* 0x07d0: i2c_put_byte_next */ ++ 0xff0142b6, ++ 0x76bb3854, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb60006fa, ++ 0x11f40464, ++ 0x0046b034, ++ 0xbbd81bf4, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0006ff7e, ++ 0x00073a7e, + 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, ++ 0x76bb0f11, ++ 0x0136b000, ++ 0xf4061bf4, ++/* 0x0826: i2c_put_byte_done */ ++ 0x00f80132, ++/* 0x0828: i2c_addr */ + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0x073f7e50, ++ 0x06737e50, + 0x0464b600, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x082b: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x082d: i2c_addr */ +- 0x0076bb00, ++ 0xe72911f4, ++ 0xb6012ec3, ++ 0x53fd0134, ++ 0x0076bb05, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0x787e50fc, +- 0x64b60006, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, +- 0x0465b600, +- 0x659450f9, +- 0x0256bb04, +- 0x75fd50bd, +- 0x7e50fc04, +- 0xb60007d3, +-/* 0x0872: i2c_addr_done */ +- 0x00f80464, +-/* 0x0874: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b705e4, +- 0x00f8d014, +-/* 0x0880: i2c_acquire */ +- 0x0008747e, ++ 0xce7e50fc, ++ 0x64b60007, ++/* 0x086d: i2c_addr_done */ ++/* 0x086f: i2c_acquire_addr */ ++ 0xc700f804, ++ 0xe4b6f8ce, ++ 0x14e0b705, ++/* 0x087b: i2c_acquire */ ++ 0x7e00f8d0, ++ 0x7e00086f, ++ 0xf0000004, ++ 0x2d7e03d9, ++ 0x00f80000, ++/* 0x088c: i2c_release */ ++ 0x00086f7e, + 0x0000047e, +- 0x7e03d9f0, ++ 0x7e03daf0, + 0xf800002d, +-/* 0x0891: i2c_release */ +- 0x08747e00, +- 0x00047e00, +- 0x03daf000, +- 0x00002d7e, +-/* 0x08a2: i2c_recv */ +- 0x32f400f8, +- 0xf8c1c701, +- 0xb00214b6, +- 0x1ff52816, +- 0x13b80134, +- 0x98000cf4, +- 0x13b80032, +- 0x98000ccc, +- 0x31f40031, +- 0xf9d0f902, +- 0xd6d0f9e0, +- 0x10000000, +- 0xbb016792, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x0008807e, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b01bf5, +- 0x76bb0005, ++/* 0x089d: i2c_recv */ ++ 0x0132f400, ++ 0xb6f8c1c7, ++ 0x16b00214, ++ 0x341ff528, ++ 0xf413b801, ++ 0x3298000c, ++ 0xcc13b800, ++ 0x3198000c, ++ 0x0231f400, ++ 0xe0f9d0f9, ++ 0x00d6d0f9, ++ 0x92100000, ++ 0x76bb0167, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0x7e50fc04, +- 0xb600082d, +- 0x11f50464, +- 0xc5c700cc, +- 0x0076bbe0, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0xd37e50fc, +- 0x64b60007, +- 0xa911f504, +- 0xbb010500, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x00082d7e, +- 0xf50464b6, +- 0xbb008711, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x0007847e, +- 0xf40464b6, +- 0x5bcb6711, +- 0x0076bbe0, ++ 0xb600087b, ++ 0xd0fc0464, ++ 0xf500d6b0, ++ 0x0500b01b, ++ 0x0076bb00, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, +- 0xd07e50fc, +- 0x64b60006, +- 0xbd5bb204, +- 0x410ef474, +-/* 0x09a4: i2c_recv_not_rd08 */ +- 0xf401d6b0, +- 0x00053b1b, +- 0x00082d7e, +- 0xc73211f4, +- 0xd37ee0c5, +- 0x11f40007, +- 0x7e000528, +- 0xf400082d, +- 0xb5c71f11, +- 0x07d37ee0, +- 0x1511f400, +- 0x0006d07e, +- 0xc5c774bd, +- 0x091bf408, +- 0xf40232f4, +-/* 0x09e2: i2c_recv_not_wr08 */ +-/* 0x09e2: i2c_recv_done */ +- 0xcec7030e, +- 0x08917ef8, +- 0xfce0fc00, +- 0x0912f4d0, +- 0x9f7e7cb2, +-/* 0x09f6: i2c_recv_exit */ +- 0x00f80002, +-/* 0x09f8: i2c_init */ +-/* 0x09fa: test_recv */ +- 0x584100f8, +- 0x0011cf04, +- 0x400110b6, +- 0x01f60458, +- 0xde04bd00, +- 0x134fd900, +- 0x0001de7e, +-/* 0x0a16: test_init */ +- 0x004e00f8, +- 0x01de7e08, +-/* 0x0a1f: idle_recv */ ++ 0x287e50fc, ++ 0x64b60008, ++ 0xcc11f504, ++ 0xe0c5c700, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x07ce7e50, ++ 0x0464b600, ++ 0x00a911f5, ++ 0x76bb0105, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb6000828, ++ 0x11f50464, ++ 0x76bb0087, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0x7e50fc04, ++ 0xb600077f, ++ 0x11f40464, ++ 0xe05bcb67, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x06cb7e50, ++ 0x0464b600, ++ 0x74bd5bb2, ++/* 0x099f: i2c_recv_not_rd08 */ ++ 0xb0410ef4, ++ 0x1bf401d6, ++ 0x7e00053b, ++ 0xf4000828, ++ 0xc5c73211, ++ 0x07ce7ee0, ++ 0x2811f400, ++ 0x287e0005, ++ 0x11f40008, ++ 0xe0b5c71f, ++ 0x0007ce7e, ++ 0x7e1511f4, ++ 0xbd0006cb, ++ 0x08c5c774, ++ 0xf4091bf4, ++ 0x0ef40232, ++/* 0x09dd: i2c_recv_not_wr08 */ ++/* 0x09dd: i2c_recv_done */ ++ 0xf8cec703, ++ 0x00088c7e, ++ 0xd0fce0fc, ++ 0xb20912f4, ++ 0x029f7e7c, ++/* 0x09f1: i2c_recv_exit */ ++/* 0x09f3: i2c_init */ + 0xf800f800, +-/* 0x0a21: idle */ +- 0x0031f400, +- 0xcf045441, +- 0x10b60011, +- 0x04544001, +- 0xbd0001f6, +-/* 0x0a35: idle_loop */ +- 0xf4580104, +-/* 0x0a3a: idle_proc */ +-/* 0x0a3a: idle_proc_exec */ +- 0x10f90232, +- 0xa87e1eb2, +- 0x10fc0002, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0a4d: idle_proc_next */ +- 0x5810b6f0, +- 0x1bf41fa6, +- 0xe002f4e8, +- 0xf40028f4, +- 0x0000c60e, ++/* 0x09f5: test_recv */ ++ 0x04584100, ++ 0xb60011cf, ++ 0x58400110, ++ 0x0001f604, ++ 0x00de04bd, ++ 0x7e134fd9, ++ 0xf80001de, ++/* 0x0a11: test_init */ ++ 0x08004e00, ++ 0x0001de7e, ++/* 0x0a1a: idle_recv */ ++ 0x00f800f8, ++/* 0x0a1c: idle */ ++ 0x410031f4, ++ 0x11cf0454, ++ 0x0110b600, ++ 0xf6045440, ++ 0x04bd0001, ++/* 0x0a30: idle_loop */ ++ 0x32f45801, ++/* 0x0a35: idle_proc */ ++/* 0x0a35: idle_proc_exec */ ++ 0xb210f902, ++ 0x02a87e1e, ++ 0xf410fc00, ++ 0x31f40911, ++ 0xf00ef402, ++/* 0x0a48: idle_proc_next */ ++ 0xa65810b6, ++ 0xe81bf41f, ++ 0xf4e002f4, ++ 0x0ef40028, ++ 0x000000c6, ++ 0x00000000, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h +index 6a2572e8945a..defddf5957ee 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/gt215.fuc3.h +@@ -47,8 +47,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x584d454d, +- 0x0000083a, +- 0x0000082c, ++ 0x00000833, ++ 0x00000825, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -69,8 +69,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x46524550, +- 0x0000083e, +- 0x0000083c, ++ 0x00000837, ++ 0x00000835, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -91,8 +91,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x5f433249, +- 0x00000c6e, +- 0x00000b11, ++ 0x00000c67, ++ 0x00000b0a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -113,8 +113,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x54534554, +- 0x00000c97, +- 0x00000c70, ++ 0x00000c90, ++ 0x00000c69, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -135,8 +135,8 @@ static uint32_t gt215_pmu_data[] = { + 0x00000000, + 0x00000000, + 0x454c4449, +- 0x00000ca3, +- 0x00000ca1, ++ 0x00000c9c, ++ 0x00000c9a, + 0x00000000, + 0x00000000, + 0x00000000, +@@ -234,22 +234,22 @@ static uint32_t gt215_pmu_data[] = { + /* 0x037c: memx_func_next */ + 0x00000002, + 0x00000000, +- 0x000005a0, ++ 0x0000059f, + 0x00000003, + 0x00000002, +- 0x00000632, ++ 0x0000062f, + 0x00040004, + 0x00000000, +- 0x0000064e, ++ 0x0000064b, + 0x00010005, + 0x00000000, +- 0x0000066b, ++ 0x00000668, + 0x00010006, + 0x00000000, +- 0x000005f0, ++ 0x000005ef, + 0x00000007, + 0x00000000, +- 0x00000676, ++ 0x00000673, + /* 0x03c4: memx_func_tail */ + /* 0x03c4: memx_ts_start */ + 0x00000000, +@@ -1305,560 +1305,560 @@ static uint32_t gt215_pmu_code[] = { + 0x67f102d7, + 0x63f1fffc, + 0x76fdffff, +- 0x0267f104, +- 0x0576fd00, +- 0x70f980f9, +- 0xe0fcd0fc, +- 0xf04021f4, ++ 0x0267f004, ++ 0xf90576fd, ++ 0xfc70f980, ++ 0xf4e0fcd0, ++ 0x67f04021, ++ 0xe007f104, ++ 0x0604b607, ++ 0xbd0006d0, ++/* 0x0581: memx_func_enter_wait */ ++ 0xc067f104, ++ 0x0664b607, ++ 0xf00066cf, ++ 0x0bf40464, ++ 0x2c67f0f3, ++ 0xcf0664b6, ++ 0x06800066, ++/* 0x059f: memx_func_leave */ ++ 0xf000f8f1, ++ 0x64b62c67, ++ 0x0066cf06, ++ 0xf0f20680, + 0x07f10467, +- 0x04b607e0, ++ 0x04b607e4, + 0x0006d006, +-/* 0x0582: memx_func_enter_wait */ ++/* 0x05ba: memx_func_leave_wait */ + 0x67f104bd, + 0x64b607c0, + 0x0066cf06, + 0xf40464f0, +- 0x67f0f30b, +- 0x0664b62c, +- 0x800066cf, +- 0x00f8f106, +-/* 0x05a0: memx_func_leave */ +- 0xb62c67f0, +- 0x66cf0664, +- 0xf2068000, +- 0xf10467f0, +- 0xb607e407, +- 0x06d00604, +-/* 0x05bb: memx_func_leave_wait */ +- 0xf104bd00, +- 0xb607c067, +- 0x66cf0664, +- 0x0464f000, +- 0xf1f31bf4, +- 0xb9161087, +- 0x21f4028e, +- 0x02d7b904, +- 0xffcc67f1, +- 0xffff63f1, +- 0xf90476fd, +- 0xfc70f980, +- 0xf4e0fcd0, +- 0x00f84021, +-/* 0x05f0: memx_func_wait_vblank */ +- 0xb0001698, +- 0x0bf40066, +- 0x0166b013, +- 0xf4060bf4, +-/* 0x0602: memx_func_wait_vblank_head1 */ +- 0x77f12e0e, +- 0x0ef40020, +-/* 0x0609: memx_func_wait_vblank_head0 */ +- 0x0877f107, +-/* 0x060d: memx_func_wait_vblank_0 */ +- 0xc467f100, +- 0x0664b607, +- 0xfd0066cf, +- 0x1bf40467, +-/* 0x061d: memx_func_wait_vblank_1 */ +- 0xc467f1f3, +- 0x0664b607, +- 0xfd0066cf, +- 0x0bf40467, +-/* 0x062d: memx_func_wait_vblank_fini */ +- 0x0410b6f3, +-/* 0x0632: memx_func_wr32 */ +- 0x169800f8, +- 0x01159800, +- 0xf90810b6, +- 0xfc50f960, +- 0xf4e0fcd0, +- 0x42b64021, +- 0xe91bf402, +-/* 0x064e: memx_func_wait */ +- 0x87f000f8, +- 0x0684b62c, +- 0x980088cf, +- 0x1d98001e, +- 0x021c9801, +- 0xb6031b98, +- 0x21f41010, +-/* 0x066b: memx_func_delay */ +- 0x9800f8a3, +- 0x10b6001e, +- 0x7e21f404, +-/* 0x0676: memx_func_train */ +- 0x57f100f8, +- 0x77f10003, +- 0x97f10000, +- 0x93f00000, +- 0x029eb970, +- 0xb90421f4, +- 0xe7f102d8, +- 0x21f42710, +-/* 0x0695: memx_func_train_loop_outer */ +- 0x0158e07e, +- 0x0083f101, +- 0xe097f102, +- 0x1193f011, +- 0x80f990f9, ++ 0x87f1f31b, ++ 0x8eb91610, ++ 0x0421f402, ++ 0xf102d7b9, ++ 0xf1ffcc67, ++ 0xfdffff63, ++ 0x80f90476, ++ 0xd0fc70f9, ++ 0x21f4e0fc, ++/* 0x05ef: memx_func_wait_vblank */ ++ 0x9800f840, ++ 0x66b00016, ++ 0x120bf400, ++ 0xf40166b0, ++ 0x0ef4060b, ++/* 0x0601: memx_func_wait_vblank_head1 */ ++ 0x2077f02c, ++/* 0x0607: memx_func_wait_vblank_head0 */ ++ 0xf0060ef4, ++/* 0x060a: memx_func_wait_vblank_0 */ ++ 0x67f10877, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x061a: memx_func_wait_vblank_1 */ ++ 0x67f1f31b, ++ 0x64b607c4, ++ 0x0066cf06, ++ 0xf40467fd, ++/* 0x062a: memx_func_wait_vblank_fini */ ++ 0x10b6f30b, ++/* 0x062f: memx_func_wr32 */ ++ 0x9800f804, ++ 0x15980016, ++ 0x0810b601, ++ 0x50f960f9, + 0xe0fcd0fc, +- 0xf94021f4, +- 0x0067f150, +-/* 0x06b5: memx_func_train_loop_inner */ +- 0x1187f100, +- 0x9068ff11, +- 0xfd109894, +- 0x97f10589, +- 0x93f00720, +- 0xf990f910, +- 0xfcd0fc80, +- 0x4021f4e0, +- 0x008097f1, +- 0xb91093f0, +- 0x21f4029e, +- 0x02d8b904, +- 0xf92088c5, ++ 0xb64021f4, ++ 0x1bf40242, ++/* 0x064b: memx_func_wait */ ++ 0xf000f8e9, ++ 0x84b62c87, ++ 0x0088cf06, ++ 0x98001e98, ++ 0x1c98011d, ++ 0x031b9802, ++ 0xf41010b6, ++ 0x00f8a321, ++/* 0x0668: memx_func_delay */ ++ 0xb6001e98, ++ 0x21f40410, ++/* 0x0673: memx_func_train */ ++ 0xf000f87e, ++ 0x77f00357, ++ 0x0097f100, ++ 0x7093f000, ++ 0xf4029eb9, ++ 0xd8b90421, ++ 0x10e7f102, ++ 0x7e21f427, ++/* 0x0690: memx_func_train_loop_outer */ ++ 0x010158e0, ++ 0x020083f1, ++ 0x11e097f1, ++ 0xf91193f0, ++ 0xfc80f990, ++ 0xf4e0fcd0, ++ 0x50f94021, ++/* 0x06af: memx_func_train_loop_inner */ ++ 0xf10067f0, ++ 0xff111187, ++ 0x98949068, ++ 0x0589fd10, ++ 0x072097f1, ++ 0xf91093f0, + 0xfc80f990, + 0xf4e0fcd0, + 0x97f14021, +- 0x93f0053c, +- 0x0287f110, +- 0x0083f130, +- 0xf990f980, ++ 0x93f00080, ++ 0x029eb910, ++ 0xb90421f4, ++ 0x88c502d8, ++ 0xf990f920, + 0xfcd0fc80, + 0x4021f4e0, +- 0x0560e7f1, +- 0xf110e3f0, +- 0xf10000d7, +- 0x908000d3, +- 0xb7f100dc, +- 0xb3f08480, +- 0xa321f41e, +- 0x000057f1, +- 0xffff97f1, +- 0x830093f1, +-/* 0x0734: memx_func_train_loop_4x */ +- 0x0080a7f1, +- 0xb910a3f0, +- 0x21f402ae, +- 0x02d8b904, +- 0xffdfb7f1, +- 0xffffb3f1, +- 0xf9048bfd, +- 0xfc80f9a0, ++ 0x053c97f1, ++ 0xf11093f0, ++ 0xf1300287, ++ 0xf9800083, ++ 0xfc80f990, + 0xf4e0fcd0, +- 0xa7f14021, +- 0xa3f0053c, +- 0x0287f110, +- 0x0083f130, +- 0xf9a0f980, +- 0xfcd0fc80, +- 0x4021f4e0, +- 0x0560e7f1, +- 0xf110e3f0, +- 0xf10000d7, +- 0xb98000d3, +- 0xb7f102dc, +- 0xb3f02710, +- 0xa321f400, +- 0xf402eeb9, +- 0xddb90421, +- 0x949dff02, ++ 0xe7f14021, ++ 0xe3f00560, ++ 0x00d7f110, ++ 0x00d3f100, ++ 0x00dc9080, ++ 0x8480b7f1, ++ 0xf41eb3f0, ++ 0x57f0a321, ++ 0xff97f100, ++ 0x0093f1ff, ++/* 0x072d: memx_func_train_loop_4x */ ++ 0x80a7f183, ++ 0x10a3f000, ++ 0xf402aeb9, ++ 0xd8b90421, ++ 0xdfb7f102, ++ 0xffb3f1ff, ++ 0x048bfdff, ++ 0x80f9a0f9, ++ 0xe0fcd0fc, ++ 0xf14021f4, ++ 0xf0053ca7, ++ 0x87f110a3, ++ 0x83f13002, ++ 0xa0f98000, ++ 0xd0fc80f9, ++ 0x21f4e0fc, ++ 0x60e7f140, ++ 0x10e3f005, ++ 0x0000d7f1, ++ 0x8000d3f1, ++ 0xf102dcb9, ++ 0xf02710b7, ++ 0x21f400b3, ++ 0x02eeb9a3, ++ 0xb90421f4, ++ 0x9dff02dd, ++ 0x0150b694, ++ 0xf4045670, ++ 0x7aa0921e, ++ 0xa9800bcc, ++ 0x0160b600, ++ 0x700470b6, ++ 0x1ef51066, ++ 0x50fcff01, + 0x700150b6, +- 0x1ef40456, +- 0xcc7aa092, +- 0x00a9800b, +- 0xb60160b6, +- 0x66700470, +- 0x001ef510, +- 0xb650fcff, +- 0x56700150, +- 0xd41ef507, +-/* 0x07c7: memx_exec */ +- 0xf900f8fe, +- 0xb9d0f9e0, +- 0xb2b902c1, +-/* 0x07d1: memx_exec_next */ +- 0x00139802, +- 0xe70410b6, +- 0xe701f034, +- 0xb601e033, +- 0x30f00132, +- 0xde35980c, +- 0x12b855f9, +- 0xe41ef406, +- 0x98f10b98, +- 0xcbbbf20c, +- 0xc4b7f102, +- 0x06b4b607, +- 0xfc00bbcf, +- 0xf5e0fcd0, ++ 0x1ef50756, ++ 0x00f8fed6, ++/* 0x07c0: memx_exec */ ++ 0xd0f9e0f9, ++ 0xb902c1b9, ++/* 0x07ca: memx_exec_next */ ++ 0x139802b2, ++ 0x0410b600, ++ 0x01f034e7, ++ 0x01e033e7, ++ 0xf00132b6, ++ 0x35980c30, ++ 0xb855f9de, ++ 0x1ef40612, ++ 0xf10b98e4, ++ 0xbbf20c98, ++ 0xb7f102cb, ++ 0xb4b607c4, ++ 0x00bbcf06, ++ 0xe0fcd0fc, ++ 0x033621f5, ++/* 0x0806: memx_info */ ++ 0xc67000f8, ++ 0x0e0bf401, ++/* 0x080c: memx_info_data */ ++ 0x03ccc7f1, ++ 0x0800b7f1, ++/* 0x0817: memx_info_train */ ++ 0xf10b0ef4, ++ 0xf10bccc7, ++/* 0x081f: memx_info_send */ ++ 0xf50100b7, + 0xf8033621, +-/* 0x080d: memx_info */ +- 0x01c67000, +-/* 0x0813: memx_info_data */ +- 0xf10e0bf4, +- 0xf103ccc7, +- 0xf40800b7, +-/* 0x081e: memx_info_train */ +- 0xc7f10b0e, +- 0xb7f10bcc, +-/* 0x0826: memx_info_send */ +- 0x21f50100, +- 0x00f80336, +-/* 0x082c: memx_recv */ +- 0xf401d6b0, +- 0xd6b0980b, +- 0xd80bf400, +-/* 0x083a: memx_init */ +- 0x00f800f8, +-/* 0x083c: perf_recv */ +-/* 0x083e: perf_init */ +- 0x00f800f8, +-/* 0x0840: i2c_drive_scl */ +- 0xf40036b0, +- 0x07f1110b, +- 0x04b607e0, +- 0x0001d006, +- 0x00f804bd, +-/* 0x0854: i2c_drive_scl_lo */ +- 0x07e407f1, +- 0xd00604b6, +- 0x04bd0001, +-/* 0x0862: i2c_drive_sda */ +- 0x36b000f8, +- 0x110bf400, +- 0x07e007f1, +- 0xd00604b6, +- 0x04bd0002, +-/* 0x0876: i2c_drive_sda_lo */ +- 0x07f100f8, +- 0x04b607e4, +- 0x0002d006, +- 0x00f804bd, +-/* 0x0884: i2c_sense_scl */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0431fd00, +- 0xf4060bf4, +-/* 0x089a: i2c_sense_scl_done */ +- 0x00f80131, +-/* 0x089c: i2c_sense_sda */ +- 0xf10132f4, +- 0xb607c437, +- 0x33cf0634, +- 0x0432fd00, +- 0xf4060bf4, +-/* 0x08b2: i2c_sense_sda_done */ +- 0x00f80131, +-/* 0x08b4: i2c_raise_scl */ +- 0x47f140f9, +- 0x37f00898, +- 0x4021f501, +-/* 0x08c1: i2c_raise_scl_wait */ ++/* 0x0825: memx_recv */ ++ 0x01d6b000, ++ 0xb0980bf4, ++ 0x0bf400d6, ++/* 0x0833: memx_init */ ++ 0xf800f8d8, ++/* 0x0835: perf_recv */ ++/* 0x0837: perf_init */ ++ 0xf800f800, ++/* 0x0839: i2c_drive_scl */ ++ 0x0036b000, ++ 0xf1110bf4, ++ 0xb607e007, ++ 0x01d00604, ++ 0xf804bd00, ++/* 0x084d: i2c_drive_scl_lo */ ++ 0xe407f100, ++ 0x0604b607, ++ 0xbd0001d0, ++/* 0x085b: i2c_drive_sda */ ++ 0xb000f804, ++ 0x0bf40036, ++ 0xe007f111, ++ 0x0604b607, ++ 0xbd0002d0, ++/* 0x086f: i2c_drive_sda_lo */ ++ 0xf100f804, ++ 0xb607e407, ++ 0x02d00604, ++ 0xf804bd00, ++/* 0x087d: i2c_sense_scl */ ++ 0x0132f400, ++ 0x07c437f1, ++ 0xcf0634b6, ++ 0x31fd0033, ++ 0x060bf404, ++/* 0x0893: i2c_sense_scl_done */ ++ 0xf80131f4, ++/* 0x0895: i2c_sense_sda */ ++ 0x0132f400, ++ 0x07c437f1, ++ 0xcf0634b6, ++ 0x32fd0033, ++ 0x060bf404, ++/* 0x08ab: i2c_sense_sda_done */ ++ 0xf80131f4, ++/* 0x08ad: i2c_raise_scl */ ++ 0xf140f900, ++ 0xf0089847, ++ 0x21f50137, ++/* 0x08ba: i2c_raise_scl_wait */ ++ 0xe7f10839, ++ 0x21f403e8, ++ 0x7d21f57e, ++ 0x0901f408, ++ 0xf40142b6, ++/* 0x08ce: i2c_raise_scl_done */ ++ 0x40fcef1b, ++/* 0x08d2: i2c_start */ ++ 0x21f500f8, ++ 0x11f4087d, ++ 0x9521f50d, ++ 0x0611f408, ++/* 0x08e3: i2c_start_rep */ ++ 0xf0300ef4, ++ 0x21f50037, ++ 0x37f00839, ++ 0x5b21f501, ++ 0x0076bb08, ++ 0xf90465b6, ++ 0x04659450, ++ 0xbd0256bb, ++ 0x0475fd50, ++ 0x21f550fc, ++ 0x64b608ad, ++ 0x1f11f404, ++/* 0x0910: i2c_start_send */ ++ 0xf50037f0, ++ 0xf1085b21, ++ 0xf41388e7, ++ 0x37f07e21, ++ 0x3921f500, ++ 0x88e7f108, ++ 0x7e21f413, ++/* 0x092c: i2c_start_out */ ++/* 0x092e: i2c_stop */ ++ 0x37f000f8, ++ 0x3921f500, ++ 0x0037f008, ++ 0x085b21f5, ++ 0x03e8e7f1, ++ 0xf07e21f4, ++ 0x21f50137, ++ 0xe7f10839, ++ 0x21f41388, ++ 0x0137f07e, ++ 0x085b21f5, ++ 0x1388e7f1, ++ 0xf87e21f4, ++/* 0x0961: i2c_bitw */ ++ 0x5b21f500, + 0xe8e7f108, + 0x7e21f403, +- 0x088421f5, +- 0xb60901f4, +- 0x1bf40142, +-/* 0x08d5: i2c_raise_scl_done */ +- 0xf840fcef, +-/* 0x08d9: i2c_start */ +- 0x8421f500, +- 0x0d11f408, +- 0x089c21f5, +- 0xf40611f4, +-/* 0x08ea: i2c_start_rep */ +- 0x37f0300e, +- 0x4021f500, +- 0x0137f008, +- 0x086221f5, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0xb421f550, ++ 0xad21f550, + 0x0464b608, +-/* 0x0917: i2c_start_send */ +- 0xf01f11f4, +- 0x21f50037, +- 0xe7f10862, +- 0x21f41388, +- 0x0037f07e, +- 0x084021f5, +- 0x1388e7f1, +-/* 0x0933: i2c_start_out */ +- 0xf87e21f4, +-/* 0x0935: i2c_stop */ +- 0x0037f000, +- 0x084021f5, +- 0xf50037f0, +- 0xf1086221, +- 0xf403e8e7, ++ 0xf11811f4, ++ 0xf41388e7, + 0x37f07e21, +- 0x4021f501, ++ 0x3921f500, + 0x88e7f108, + 0x7e21f413, +- 0xf50137f0, +- 0xf1086221, +- 0xf41388e7, +- 0x00f87e21, +-/* 0x0968: i2c_bitw */ +- 0x086221f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x08b421f5, +- 0xf40464b6, +- 0xe7f11811, ++/* 0x09a0: i2c_bitw_out */ ++/* 0x09a2: i2c_bitr */ ++ 0x37f000f8, ++ 0x5b21f501, ++ 0xe8e7f108, ++ 0x7e21f403, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0xad21f550, ++ 0x0464b608, ++ 0xf51b11f4, ++ 0xf0089521, ++ 0x21f50037, ++ 0xe7f10839, + 0x21f41388, +- 0x0037f07e, +- 0x084021f5, +- 0x1388e7f1, +-/* 0x09a7: i2c_bitw_out */ +- 0xf87e21f4, +-/* 0x09a9: i2c_bitr */ +- 0x0137f000, +- 0x086221f5, +- 0x03e8e7f1, +- 0xbb7e21f4, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x08b421f5, +- 0xf40464b6, +- 0x21f51b11, +- 0x37f0089c, +- 0x4021f500, +- 0x88e7f108, +- 0x7e21f413, +- 0xf4013cf0, +-/* 0x09ee: i2c_bitr_done */ +- 0x00f80131, +-/* 0x09f0: i2c_get_byte */ +- 0xf00057f0, +-/* 0x09f6: i2c_get_byte_next */ +- 0x54b60847, ++ 0x013cf07e, ++/* 0x09e7: i2c_bitr_done */ ++ 0xf80131f4, ++/* 0x09e9: i2c_get_byte */ ++ 0x0057f000, ++/* 0x09ef: i2c_get_byte_next */ ++ 0xb60847f0, ++ 0x76bb0154, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb609a221, ++ 0x11f40464, ++ 0x0553fd2b, ++ 0xf40142b6, ++ 0x37f0d81b, + 0x0076bb01, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b609a9, +- 0x2b11f404, +- 0xb60553fd, +- 0x1bf40142, +- 0x0137f0d8, +- 0xb60076bb, +- 0x50f90465, +- 0xbb046594, +- 0x50bd0256, +- 0xfc0475fd, +- 0x6821f550, +- 0x0464b609, +-/* 0x0a40: i2c_get_byte_done */ +-/* 0x0a42: i2c_put_byte */ +- 0x47f000f8, +-/* 0x0a45: i2c_put_byte_next */ +- 0x0142b608, +- 0xbb3854ff, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x096821f5, +- 0xf40464b6, +- 0x46b03411, +- 0xd81bf400, ++ 0x64b60961, ++/* 0x0a39: i2c_get_byte_done */ ++/* 0x0a3b: i2c_put_byte */ ++ 0xf000f804, ++/* 0x0a3e: i2c_put_byte_next */ ++ 0x42b60847, ++ 0x3854ff01, + 0xb60076bb, + 0x50f90465, + 0xbb046594, + 0x50bd0256, + 0xfc0475fd, +- 0xa921f550, ++ 0x6121f550, + 0x0464b609, +- 0xbb0f11f4, +- 0x36b00076, +- 0x061bf401, +-/* 0x0a9b: i2c_put_byte_done */ +- 0xf80132f4, +-/* 0x0a9d: i2c_addr */ +- 0x0076bb00, ++ 0xb03411f4, ++ 0x1bf40046, ++ 0x0076bbd8, + 0xf90465b6, + 0x04659450, + 0xbd0256bb, + 0x0475fd50, + 0x21f550fc, +- 0x64b608d9, +- 0x2911f404, +- 0x012ec3e7, +- 0xfd0134b6, +- 0x76bb0553, ++ 0x64b609a2, ++ 0x0f11f404, ++ 0xb00076bb, ++ 0x1bf40136, ++ 0x0132f406, ++/* 0x0a94: i2c_put_byte_done */ ++/* 0x0a96: i2c_addr */ ++ 0x76bb00f8, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb60a4221, +-/* 0x0ae2: i2c_addr_done */ +- 0x00f80464, +-/* 0x0ae4: i2c_acquire_addr */ +- 0xb6f8cec7, +- 0xe0b702e4, +- 0xee980d1c, +-/* 0x0af3: i2c_acquire */ +- 0xf500f800, +- 0xf40ae421, +- 0xd9f00421, +- 0x4021f403, +-/* 0x0b02: i2c_release */ +- 0x21f500f8, +- 0x21f40ae4, +- 0x03daf004, +- 0xf84021f4, +-/* 0x0b11: i2c_recv */ +- 0x0132f400, +- 0xb6f8c1c7, +- 0x16b00214, +- 0x3a1ff528, +- 0xf413a001, +- 0x0032980c, +- 0x0ccc13a0, +- 0xf4003198, +- 0xd0f90231, +- 0xd0f9e0f9, +- 0x000067f1, +- 0x100063f1, +- 0xbb016792, ++ 0xb608d221, ++ 0x11f40464, ++ 0x2ec3e729, ++ 0x0134b601, ++ 0xbb0553fd, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0af321f5, +- 0xfc0464b6, +- 0x00d6b0d0, +- 0x00b31bf5, +- 0xbb0057f0, ++ 0x0a3b21f5, ++/* 0x0adb: i2c_addr_done */ ++ 0xf80464b6, ++/* 0x0add: i2c_acquire_addr */ ++ 0xf8cec700, ++ 0xb702e4b6, ++ 0x980d1ce0, ++ 0x00f800ee, ++/* 0x0aec: i2c_acquire */ ++ 0x0add21f5, ++ 0xf00421f4, ++ 0x21f403d9, ++/* 0x0afb: i2c_release */ ++ 0xf500f840, ++ 0xf40add21, ++ 0xdaf00421, ++ 0x4021f403, ++/* 0x0b0a: i2c_recv */ ++ 0x32f400f8, ++ 0xf8c1c701, ++ 0xb00214b6, ++ 0x1ff52816, ++ 0x13a0013a, ++ 0x32980cf4, ++ 0xcc13a000, ++ 0x0031980c, ++ 0xf90231f4, ++ 0xf9e0f9d0, ++ 0x0067f1d0, ++ 0x0063f100, ++ 0x01679210, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0xec21f550, ++ 0x0464b60a, ++ 0xd6b0d0fc, ++ 0xb31bf500, ++ 0x0057f000, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x9621f550, ++ 0x0464b60a, ++ 0x00d011f5, ++ 0xbbe0c5c7, + 0x65b60076, + 0x9450f904, + 0x56bb0465, + 0xfd50bd02, + 0x50fc0475, +- 0x0a9d21f5, ++ 0x0a3b21f5, + 0xf50464b6, +- 0xc700d011, +- 0x76bbe0c5, ++ 0xf000ad11, ++ 0x76bb0157, + 0x0465b600, + 0x659450f9, + 0x0256bb04, + 0x75fd50bd, + 0xf550fc04, +- 0xb60a4221, ++ 0xb60a9621, + 0x11f50464, +- 0x57f000ad, +- 0x0076bb01, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0x21f550fc, +- 0x64b60a9d, +- 0x8a11f504, +- 0x0076bb00, +- 0xf90465b6, +- 0x04659450, +- 0xbd0256bb, +- 0x0475fd50, +- 0x21f550fc, +- 0x64b609f0, +- 0x6a11f404, +- 0xbbe05bcb, +- 0x65b60076, +- 0x9450f904, +- 0x56bb0465, +- 0xfd50bd02, +- 0x50fc0475, +- 0x093521f5, +- 0xb90464b6, +- 0x74bd025b, +-/* 0x0c17: i2c_recv_not_rd08 */ +- 0xb0430ef4, +- 0x1bf401d6, +- 0x0057f03d, +- 0x0a9d21f5, +- 0xc73311f4, +- 0x21f5e0c5, +- 0x11f40a42, +- 0x0057f029, +- 0x0a9d21f5, +- 0xc71f11f4, +- 0x21f5e0b5, +- 0x11f40a42, +- 0x3521f515, +- 0xc774bd09, +- 0x1bf408c5, +- 0x0232f409, +-/* 0x0c57: i2c_recv_not_wr08 */ +-/* 0x0c57: i2c_recv_done */ +- 0xc7030ef4, +- 0x21f5f8ce, +- 0xe0fc0b02, +- 0x12f4d0fc, +- 0x027cb90a, +- 0x033621f5, +-/* 0x0c6c: i2c_recv_exit */ +-/* 0x0c6e: i2c_init */ ++ 0x76bb008a, ++ 0x0465b600, ++ 0x659450f9, ++ 0x0256bb04, ++ 0x75fd50bd, ++ 0xf550fc04, ++ 0xb609e921, ++ 0x11f40464, ++ 0xe05bcb6a, ++ 0xb60076bb, ++ 0x50f90465, ++ 0xbb046594, ++ 0x50bd0256, ++ 0xfc0475fd, ++ 0x2e21f550, ++ 0x0464b609, ++ 0xbd025bb9, ++ 0x430ef474, ++/* 0x0c10: i2c_recv_not_rd08 */ ++ 0xf401d6b0, ++ 0x57f03d1b, ++ 0x9621f500, ++ 0x3311f40a, ++ 0xf5e0c5c7, ++ 0xf40a3b21, ++ 0x57f02911, ++ 0x9621f500, ++ 0x1f11f40a, ++ 0xf5e0b5c7, ++ 0xf40a3b21, ++ 0x21f51511, ++ 0x74bd092e, ++ 0xf408c5c7, ++ 0x32f4091b, ++ 0x030ef402, ++/* 0x0c50: i2c_recv_not_wr08 */ ++/* 0x0c50: i2c_recv_done */ ++ 0xf5f8cec7, ++ 0xfc0afb21, ++ 0xf4d0fce0, ++ 0x7cb90a12, ++ 0x3621f502, ++/* 0x0c65: i2c_recv_exit */ ++/* 0x0c67: i2c_init */ ++ 0xf800f803, ++/* 0x0c69: test_recv */ ++ 0xd817f100, ++ 0x0614b605, ++ 0xb60011cf, ++ 0x07f10110, ++ 0x04b605d8, ++ 0x0001d006, ++ 0xe7f104bd, ++ 0xe3f1d900, ++ 0x21f5134f, ++ 0x00f80256, ++/* 0x0c90: test_init */ ++ 0x0800e7f1, ++ 0x025621f5, ++/* 0x0c9a: idle_recv */ + 0x00f800f8, +-/* 0x0c70: test_recv */ +- 0x05d817f1, +- 0xcf0614b6, +- 0x10b60011, +- 0xd807f101, +- 0x0604b605, +- 0xbd0001d0, +- 0x00e7f104, +- 0x4fe3f1d9, +- 0x5621f513, +-/* 0x0c97: test_init */ +- 0xf100f802, +- 0xf50800e7, +- 0xf8025621, +-/* 0x0ca1: idle_recv */ +-/* 0x0ca3: idle */ +- 0xf400f800, +- 0x17f10031, +- 0x14b605d4, +- 0x0011cf06, +- 0xf10110b6, +- 0xb605d407, +- 0x01d00604, +-/* 0x0cbf: idle_loop */ +- 0xf004bd00, +- 0x32f45817, +-/* 0x0cc5: idle_proc */ +-/* 0x0cc5: idle_proc_exec */ +- 0xb910f902, +- 0x21f5021e, +- 0x10fc033f, +- 0xf40911f4, +- 0x0ef40231, +-/* 0x0cd9: idle_proc_next */ +- 0x5810b6ef, +- 0xf4061fb8, +- 0x02f4e61b, +- 0x0028f4dd, +- 0x00bb0ef4, ++/* 0x0c9c: idle */ ++ 0xf10031f4, ++ 0xb605d417, ++ 0x11cf0614, ++ 0x0110b600, ++ 0x05d407f1, ++ 0xd00604b6, ++ 0x04bd0001, ++/* 0x0cb8: idle_loop */ ++ 0xf45817f0, ++/* 0x0cbe: idle_proc */ ++/* 0x0cbe: idle_proc_exec */ ++ 0x10f90232, ++ 0xf5021eb9, ++ 0xfc033f21, ++ 0x0911f410, ++ 0xf40231f4, ++/* 0x0cd2: idle_proc_next */ ++ 0x10b6ef0e, ++ 0x061fb858, ++ 0xf4e61bf4, ++ 0x28f4dd02, ++ 0xbb0ef400, ++ 0x00000000, ++ 0x00000000, + 0x00000000, + 0x00000000, + 0x00000000, +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc +index ec03f9a4290b..1663bf943d77 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pmu/fuc/memx.fuc +@@ -82,15 +82,15 @@ memx_train_tail: + // $r0 - zero + memx_func_enter: + #if NVKM_PPWR_CHIPSET == GT215 +- movw $r8 0x1610 ++ mov $r8 0x1610 + nv_rd32($r7, $r8) + imm32($r6, 0xfffffffc) + and $r7 $r6 +- movw $r6 0x2 ++ mov $r6 0x2 + or $r7 $r6 + nv_wr32($r8, $r7) + #else +- movw $r6 0x001620 ++ mov $r6 0x001620 + imm32($r7, ~0x00000aa2); + nv_rd32($r8, $r6) + and $r8 $r7 +@@ -101,7 +101,7 @@ memx_func_enter: + and $r8 $r7 + nv_wr32($r6, $r8) + +- movw $r6 0x0026f0 ++ mov $r6 0x0026f0 + nv_rd32($r8, $r6) + and $r8 $r7 + nv_wr32($r6, $r8) +@@ -136,19 +136,19 @@ memx_func_leave: + bra nz #memx_func_leave_wait + + #if NVKM_PPWR_CHIPSET == GT215 +- movw $r8 0x1610 ++ mov $r8 0x1610 + nv_rd32($r7, $r8) + imm32($r6, 0xffffffcc) + and $r7 $r6 + nv_wr32($r8, $r7) + #else +- movw $r6 0x0026f0 ++ mov $r6 0x0026f0 + imm32($r7, 0x00000001) + nv_rd32($r8, $r6) + or $r8 $r7 + nv_wr32($r6, $r8) + +- movw $r6 0x001620 ++ mov $r6 0x001620 + nv_rd32($r8, $r6) + or $r8 $r7 + nv_wr32($r6, $r8) +@@ -177,11 +177,11 @@ memx_func_wait_vblank: + bra #memx_func_wait_vblank_fini + + memx_func_wait_vblank_head1: +- movw $r7 0x20 ++ mov $r7 0x20 + bra #memx_func_wait_vblank_0 + + memx_func_wait_vblank_head0: +- movw $r7 0x8 ++ mov $r7 0x8 + + memx_func_wait_vblank_0: + nv_iord($r6, NV_PPWR_INPUT) +@@ -273,13 +273,13 @@ memx_func_train: + // $r5 - outer loop counter + // $r6 - inner loop counter + // $r7 - entry counter (#memx_train_head + $r7) +- movw $r5 0x3 +- movw $r7 0x0 ++ mov $r5 0x3 ++ mov $r7 0x0 + + // Read random memory to wake up... things + imm32($r9, 0x700000) + nv_rd32($r8,$r9) +- movw $r14 0x2710 ++ mov $r14 0x2710 + call(nsec) + + memx_func_train_loop_outer: +@@ -289,9 +289,9 @@ memx_func_train: + nv_wr32($r9, $r8) + push $r5 + +- movw $r6 0x0 ++ mov $r6 0x0 + memx_func_train_loop_inner: +- movw $r8 0x1111 ++ mov $r8 0x1111 + mulu $r9 $r6 $r8 + shl b32 $r8 $r9 0x10 + or $r8 $r9 +@@ -315,7 +315,7 @@ memx_func_train: + + // $r5 - inner inner loop counter + // $r9 - result +- movw $r5 0 ++ mov $r5 0 + imm32($r9, 0x8300ffff) + memx_func_train_loop_4x: + imm32($r10, 0x100080) +diff --git a/drivers/gpu/drm/vc4/vc4_bo.c b/drivers/gpu/drm/vc4/vc4_bo.c +index 3afdbf4bc10b..eff0a8ece8bc 100644 +--- a/drivers/gpu/drm/vc4/vc4_bo.c ++++ b/drivers/gpu/drm/vc4/vc4_bo.c +@@ -173,6 +173,7 @@ static void vc4_bo_destroy(struct vc4_bo *bo) + vc4_bo_set_label(obj, -1); + + if (bo->validated_shader) { ++ kfree(bo->validated_shader->uniform_addr_offsets); + kfree(bo->validated_shader->texture_samples); + kfree(bo->validated_shader); + bo->validated_shader = NULL; +@@ -432,6 +433,7 @@ void vc4_free_object(struct drm_gem_object *gem_bo) + } + + if (bo->validated_shader) { ++ kfree(bo->validated_shader->uniform_addr_offsets); + kfree(bo->validated_shader->texture_samples); + kfree(bo->validated_shader); + bo->validated_shader = NULL; +diff --git a/drivers/gpu/drm/vc4/vc4_validate_shaders.c b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +index d3f15bf60900..7cf82b071de2 100644 +--- a/drivers/gpu/drm/vc4/vc4_validate_shaders.c ++++ b/drivers/gpu/drm/vc4/vc4_validate_shaders.c +@@ -942,6 +942,7 @@ vc4_validate_shader(struct drm_gem_cma_object *shader_obj) + fail: + kfree(validation_state.branch_targets); + if (validated_shader) { ++ kfree(validated_shader->uniform_addr_offsets); + kfree(validated_shader->texture_samples); + kfree(validated_shader); + } +diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c +index 43617fb28b87..317c9c2c0a7c 100644 +--- a/drivers/hid/hid-roccat-kovaplus.c ++++ b/drivers/hid/hid-roccat-kovaplus.c +@@ -37,6 +37,8 @@ static uint kovaplus_convert_event_cpi(uint value) + static void kovaplus_profile_activated(struct kovaplus_device *kovaplus, + uint new_profile_index) + { ++ if (new_profile_index >= ARRAY_SIZE(kovaplus->profile_settings)) ++ return; + kovaplus->actual_profile = new_profile_index; + kovaplus->actual_cpi = kovaplus->profile_settings[new_profile_index].cpi_startup_level; + kovaplus->actual_x_sensitivity = kovaplus->profile_settings[new_profile_index].sensitivity_x; +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 25de7cc9f49f..6c725c435f5d 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -624,11 +624,13 @@ static inline int cma_validate_port(struct ib_device *device, u8 port, + if ((dev_type != ARPHRD_INFINIBAND) && rdma_protocol_ib(device, port)) + return ret; + +- if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) ++ if (dev_type == ARPHRD_ETHER && rdma_protocol_roce(device, port)) { + ndev = dev_get_by_index(&init_net, bound_if_index); +- else ++ if (!ndev) ++ return ret; ++ } else { + gid_type = IB_GID_TYPE_IB; +- ++ } + + ret = ib_find_cached_gid_by_port(device, gid, gid_type, port, + ndev, NULL); +diff --git a/drivers/infiniband/core/cq.c b/drivers/infiniband/core/cq.c +index f2ae75fa3128..757d308bebe8 100644 +--- a/drivers/infiniband/core/cq.c ++++ b/drivers/infiniband/core/cq.c +@@ -17,6 +17,7 @@ + + /* # of WCs to poll for with a single call to ib_poll_cq */ + #define IB_POLL_BATCH 16 ++#define IB_POLL_BATCH_DIRECT 8 + + /* # of WCs to iterate over before yielding */ + #define IB_POLL_BUDGET_IRQ 256 +@@ -25,7 +26,8 @@ + #define IB_POLL_FLAGS \ + (IB_CQ_NEXT_COMP | IB_CQ_REPORT_MISSED_EVENTS) + +-static int __ib_process_cq(struct ib_cq *cq, int budget) ++static int __ib_process_cq(struct ib_cq *cq, int budget, struct ib_wc *wcs, ++ int batch) + { + int i, n, completed = 0; + +@@ -34,10 +36,10 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + * want to bound this call, thus we need unsigned + * minimum here. + */ +- while ((n = ib_poll_cq(cq, min_t(u32, IB_POLL_BATCH, +- budget - completed), cq->wc)) > 0) { ++ while ((n = ib_poll_cq(cq, min_t(u32, batch, ++ budget - completed), wcs)) > 0) { + for (i = 0; i < n; i++) { +- struct ib_wc *wc = &cq->wc[i]; ++ struct ib_wc *wc = &wcs[i]; + + if (wc->wr_cqe) + wc->wr_cqe->done(cq, wc); +@@ -47,8 +49,7 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + + completed += n; + +- if (n != IB_POLL_BATCH || +- (budget != -1 && completed >= budget)) ++ if (n != batch || (budget != -1 && completed >= budget)) + break; + } + +@@ -60,18 +61,20 @@ static int __ib_process_cq(struct ib_cq *cq, int budget) + * @cq: CQ to process + * @budget: number of CQEs to poll for + * +- * This function is used to process all outstanding CQ entries on a +- * %IB_POLL_DIRECT CQ. It does not offload CQ processing to a different +- * context and does not ask for completion interrupts from the HCA. ++ * This function is used to process all outstanding CQ entries. ++ * It does not offload CQ processing to a different context and does ++ * not ask for completion interrupts from the HCA. ++ * Using direct processing on CQ with non IB_POLL_DIRECT type may trigger ++ * concurrent processing. + * + * Note: do not pass -1 as %budget unless it is guaranteed that the number + * of completions that will be processed is small. + */ + int ib_process_cq_direct(struct ib_cq *cq, int budget) + { +- WARN_ON_ONCE(cq->poll_ctx != IB_POLL_DIRECT); ++ struct ib_wc wcs[IB_POLL_BATCH_DIRECT]; + +- return __ib_process_cq(cq, budget); ++ return __ib_process_cq(cq, budget, wcs, IB_POLL_BATCH_DIRECT); + } + EXPORT_SYMBOL(ib_process_cq_direct); + +@@ -85,7 +88,7 @@ static int ib_poll_handler(struct irq_poll *iop, int budget) + struct ib_cq *cq = container_of(iop, struct ib_cq, iop); + int completed; + +- completed = __ib_process_cq(cq, budget); ++ completed = __ib_process_cq(cq, budget, cq->wc, IB_POLL_BATCH); + if (completed < budget) { + irq_poll_complete(&cq->iop); + if (ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0) +@@ -105,7 +108,8 @@ static void ib_cq_poll_work(struct work_struct *work) + struct ib_cq *cq = container_of(work, struct ib_cq, work); + int completed; + +- completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE); ++ completed = __ib_process_cq(cq, IB_POLL_BUDGET_WORKQUEUE, cq->wc, ++ IB_POLL_BATCH); + if (completed >= IB_POLL_BUDGET_WORKQUEUE || + ib_req_notify_cq(cq, IB_POLL_FLAGS) > 0) + queue_work(ib_comp_wq, &cq->work); +diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c +index 5286ad57d903..8f2dc79ad4ec 100644 +--- a/drivers/infiniband/core/uverbs_ioctl.c ++++ b/drivers/infiniband/core/uverbs_ioctl.c +@@ -245,16 +245,13 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev, + uintptr_t data[UVERBS_OPTIMIZE_USING_STACK_SZ / sizeof(uintptr_t)]; + #endif + +- if (hdr->reserved) +- return -EINVAL; +- + object_spec = uverbs_get_object(ib_dev, hdr->object_id); + if (!object_spec) +- return -EOPNOTSUPP; ++ return -EPROTONOSUPPORT; + + method_spec = uverbs_get_method(object_spec, hdr->method_id); + if (!method_spec) +- return -EOPNOTSUPP; ++ return -EPROTONOSUPPORT; + + if ((method_spec->flags & UVERBS_ACTION_FLAG_CREATE_ROOT) ^ !file->ucontext) + return -EINVAL; +@@ -310,6 +307,16 @@ static long ib_uverbs_cmd_verbs(struct ib_device *ib_dev, + + err = uverbs_handle_method(buf, ctx->uattrs, hdr->num_attrs, ib_dev, + file, method_spec, ctx->uverbs_attr_bundle); ++ ++ /* ++ * EPROTONOSUPPORT is ONLY to be returned if the ioctl framework can ++ * not invoke the method because the request is not supported. No ++ * other cases should return this code. ++ */ ++ if (unlikely(err == -EPROTONOSUPPORT)) { ++ WARN_ON_ONCE(err == -EPROTONOSUPPORT); ++ err = -EINVAL; ++ } + out: + #ifdef UVERBS_OPTIMIZE_USING_STACK_SZ + if (ctx_size > UVERBS_OPTIMIZE_USING_STACK_SZ) +@@ -348,7 +355,7 @@ long ib_uverbs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg) + } + + if (hdr.reserved) { +- err = -EOPNOTSUPP; ++ err = -EPROTONOSUPPORT; + goto out; + } + +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 0e17d03ef1cb..82114ba86041 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -8294,8 +8294,8 @@ static irqreturn_t sdma_interrupt(int irq, void *data) + /* handle the interrupt(s) */ + sdma_engine_interrupt(sde, status); + } else { +- dd_dev_err_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n", +- sde->this_idx); ++ dd_dev_info_ratelimited(dd, "SDMA engine %u interrupt, but no status bits set\n", ++ sde->this_idx); + } + return IRQ_HANDLED; + } +@@ -12967,7 +12967,14 @@ static void disable_intx(struct pci_dev *pdev) + pci_intx(pdev, 0); + } + +-static void clean_up_interrupts(struct hfi1_devdata *dd) ++/** ++ * hfi1_clean_up_interrupts() - Free all IRQ resources ++ * @dd: valid device data data structure ++ * ++ * Free the MSI or INTx IRQs and assoicated PCI resources, ++ * if they have been allocated. ++ */ ++void hfi1_clean_up_interrupts(struct hfi1_devdata *dd) + { + int i; + +@@ -13344,7 +13351,7 @@ static int set_up_interrupts(struct hfi1_devdata *dd) + return 0; + + fail: +- clean_up_interrupts(dd); ++ hfi1_clean_up_interrupts(dd); + return ret; + } + +@@ -14770,7 +14777,6 @@ void hfi1_start_cleanup(struct hfi1_devdata *dd) + aspm_exit(dd); + free_cntrs(dd); + free_rcverr(dd); +- clean_up_interrupts(dd); + finish_chip_resources(dd); + } + +@@ -15229,7 +15235,7 @@ struct hfi1_devdata *hfi1_init_dd(struct pci_dev *pdev, + bail_free_cntrs: + free_cntrs(dd); + bail_clear_intr: +- clean_up_interrupts(dd); ++ hfi1_clean_up_interrupts(dd); + bail_cleanup: + hfi1_pcie_ddcleanup(dd); + bail_free: +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index fd28f09b4445..ee2253d06984 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -191,9 +191,6 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) + if (!atomic_inc_not_zero(&dd->user_refcount)) + return -ENXIO; + +- /* Just take a ref now. Not all opens result in a context assign */ +- kobject_get(&dd->kobj); +- + /* The real work is performed later in assign_ctxt() */ + + fd = kzalloc(sizeof(*fd), GFP_KERNEL); +@@ -203,6 +200,7 @@ static int hfi1_file_open(struct inode *inode, struct file *fp) + fd->mm = current->mm; + mmgrab(fd->mm); + fd->dd = dd; ++ kobject_get(&fd->dd->kobj); + fp->private_data = fd; + } else { + fp->private_data = NULL; +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index 3409eee16092..dc9c951ef946 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1954,6 +1954,7 @@ void hfi1_verbs_unregister_sysfs(struct hfi1_devdata *dd); + int qsfp_dump(struct hfi1_pportdata *ppd, char *buf, int len); + + int hfi1_pcie_init(struct pci_dev *pdev, const struct pci_device_id *ent); ++void hfi1_clean_up_interrupts(struct hfi1_devdata *dd); + void hfi1_pcie_cleanup(struct pci_dev *pdev); + int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev); + void hfi1_pcie_ddcleanup(struct hfi1_devdata *); +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index fba77001c3a7..d4fc8795cdf6 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -1039,8 +1039,9 @@ static void shutdown_device(struct hfi1_devdata *dd) + } + dd->flags &= ~HFI1_INITTED; + +- /* mask interrupts, but not errors */ ++ /* mask and clean up interrupts, but not errors */ + set_intr_state(dd, 0); ++ hfi1_clean_up_interrupts(dd); + + for (pidx = 0; pidx < dd->num_pports; ++pidx) { + ppd = dd->pport + pidx; +@@ -1696,6 +1697,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dd_dev_err(dd, "Failed to create /dev devices: %d\n", -j); + + if (initfail || ret) { ++ hfi1_clean_up_interrupts(dd); + stop_timers(dd); + flush_workqueue(ib_wq); + for (pidx = 0; pidx < dd->num_pports; ++pidx) { +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.c b/drivers/infiniband/hw/i40iw/i40iw_puda.c +index 14d38d733cb4..27a2d782f6d9 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.c +@@ -48,7 +48,6 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid); + static void i40iw_ilq_putback_rcvbuf(struct i40iw_sc_qp *qp, u32 wqe_idx); + static enum i40iw_status_code i40iw_puda_replenish_rq(struct i40iw_puda_rsrc + *rsrc, bool initial); +-static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp); + /** + * i40iw_puda_get_listbuf - get buffer from puda list + * @list: list to use for buffers (ILQ or IEQ) +@@ -1480,7 +1479,7 @@ static void i40iw_ieq_tx_compl(struct i40iw_sc_vsi *vsi, void *sqwrid) + * @ieq: ieq resource + * @qp: all pending fpdu buffers + */ +-static void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp) ++void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp) + { + struct i40iw_puda_buf *buf; + struct i40iw_pfpdu *pfpdu = &qp->pfpdu; +diff --git a/drivers/infiniband/hw/i40iw/i40iw_puda.h b/drivers/infiniband/hw/i40iw/i40iw_puda.h +index dba05ce7d392..ebe37f157d90 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_puda.h ++++ b/drivers/infiniband/hw/i40iw/i40iw_puda.h +@@ -186,4 +186,5 @@ enum i40iw_status_code i40iw_cqp_qp_create_cmd(struct i40iw_sc_dev *dev, struct + enum i40iw_status_code i40iw_cqp_cq_create_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq); + void i40iw_cqp_qp_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_qp *qp); + void i40iw_cqp_cq_destroy_cmd(struct i40iw_sc_dev *dev, struct i40iw_sc_cq *cq); ++void i40iw_ieq_cleanup_qp(struct i40iw_puda_rsrc *ieq, struct i40iw_sc_qp *qp); + #endif +diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +index 62be0a41ad0b..b7961f21b555 100644 +--- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c ++++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c +@@ -428,6 +428,7 @@ void i40iw_free_qp_resources(struct i40iw_device *iwdev, + { + struct i40iw_pbl *iwpbl = &iwqp->iwpbl; + ++ i40iw_ieq_cleanup_qp(iwdev->vsi.ieq, &iwqp->sc_qp); + i40iw_dealloc_push_page(iwdev, &iwqp->sc_qp); + if (qp_num) + i40iw_free_resource(iwdev, iwdev->allocated_qps, qp_num); +@@ -1655,6 +1656,7 @@ static struct ib_mr *i40iw_alloc_mr(struct ib_pd *pd, + err_code = -EOVERFLOW; + goto err; + } ++ stag &= ~I40IW_CQPSQ_STAG_KEY_MASK; + iwmr->stag = stag; + iwmr->ibmr.rkey = stag; + iwmr->ibmr.lkey = stag; +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index c4d8cc1c2b1d..464c78f8cec9 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2923,7 +2923,8 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp, + * If we moved a kernel QP to RESET, clean up all old CQ + * entries and reinitialize the QP. + */ +- if (new_state == IB_QPS_RESET && !ibqp->uobject) { ++ if (new_state == IB_QPS_RESET && ++ !ibqp->uobject && ibqp->qp_type != IB_QPT_XRC_TGT) { + mlx5_ib_cq_clean(recv_cq, base->mqp.qpn, + ibqp->srq ? to_msrq(ibqp->srq) : NULL); + if (send_cq != recv_cq) +@@ -4636,13 +4637,10 @@ int mlx5_ib_dealloc_xrcd(struct ib_xrcd *xrcd) + int err; + + err = mlx5_core_xrcd_dealloc(dev->mdev, xrcdn); +- if (err) { ++ if (err) + mlx5_ib_warn(dev, "failed to dealloc xrcdn 0x%x\n", xrcdn); +- return err; +- } + + kfree(xrcd); +- + return 0; + } + +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index a009e943362a..6bc9a768f721 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -2273,6 +2273,9 @@ static struct net_device *ipoib_add_port(const char *format, + priv->ca, ipoib_event); + ib_register_event_handler(&priv->event_handler); + ++ /* call event handler to ensure pkey in sync */ ++ queue_work(ipoib_workqueue, &priv->flush_heavy); ++ + result = register_netdev(priv->dev); + if (result) { + printk(KERN_WARNING "%s: couldn't register ipoib port %d; error %d\n", +diff --git a/drivers/input/mouse/psmouse-base.c b/drivers/input/mouse/psmouse-base.c +index 6a5649e52eed..8ac9e03c05b4 100644 +--- a/drivers/input/mouse/psmouse-base.c ++++ b/drivers/input/mouse/psmouse-base.c +@@ -975,6 +975,21 @@ static void psmouse_apply_defaults(struct psmouse *psmouse) + psmouse->pt_deactivate = NULL; + } + ++static bool psmouse_do_detect(int (*detect)(struct psmouse *, bool), ++ struct psmouse *psmouse, bool allow_passthrough, ++ bool set_properties) ++{ ++ if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU && ++ !allow_passthrough) { ++ return false; ++ } ++ ++ if (set_properties) ++ psmouse_apply_defaults(psmouse); ++ ++ return detect(psmouse, set_properties) == 0; ++} ++ + static bool psmouse_try_protocol(struct psmouse *psmouse, + enum psmouse_type type, + unsigned int *max_proto, +@@ -986,15 +1001,8 @@ static bool psmouse_try_protocol(struct psmouse *psmouse, + if (!proto) + return false; + +- if (psmouse->ps2dev.serio->id.type == SERIO_PS_PSTHRU && +- !proto->try_passthru) { +- return false; +- } +- +- if (set_properties) +- psmouse_apply_defaults(psmouse); +- +- if (proto->detect(psmouse, set_properties) != 0) ++ if (!psmouse_do_detect(proto->detect, psmouse, proto->try_passthru, ++ set_properties)) + return false; + + if (set_properties && proto->init && init_allowed) { +@@ -1027,8 +1035,8 @@ static int psmouse_extensions(struct psmouse *psmouse, + * Always check for focaltech, this is safe as it uses pnp-id + * matching. + */ +- if (psmouse_try_protocol(psmouse, PSMOUSE_FOCALTECH, +- &max_proto, set_properties, false)) { ++ if (psmouse_do_detect(focaltech_detect, ++ psmouse, false, set_properties)) { + if (max_proto > PSMOUSE_IMEX && + IS_ENABLED(CONFIG_MOUSE_PS2_FOCALTECH) && + (!set_properties || focaltech_init(psmouse) == 0)) { +@@ -1074,8 +1082,8 @@ static int psmouse_extensions(struct psmouse *psmouse, + * probing for IntelliMouse. + */ + if (max_proto > PSMOUSE_PS2 && +- psmouse_try_protocol(psmouse, PSMOUSE_SYNAPTICS, &max_proto, +- set_properties, false)) { ++ psmouse_do_detect(synaptics_detect, ++ psmouse, false, set_properties)) { + synaptics_hardware = true; + + if (max_proto > PSMOUSE_IMEX) { +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index ee5466a374bf..a246fc686bb7 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -1280,6 +1280,16 @@ static void set_input_params(struct psmouse *psmouse, + INPUT_MT_POINTER | + (cr48_profile_sensor ? + INPUT_MT_TRACK : INPUT_MT_SEMI_MT)); ++ ++ /* ++ * For semi-mt devices we send ABS_X/Y ourselves instead of ++ * input_mt_report_pointer_emulation. But ++ * input_mt_init_slots() resets the fuzz to 0, leading to a ++ * filtered ABS_MT_POSITION_X but an unfiltered ABS_X ++ * position. Let's re-initialize ABS_X/Y here. ++ */ ++ if (!cr48_profile_sensor) ++ set_abs_position_params(dev, &priv->info, ABS_X, ABS_Y); + } + + if (SYN_CAP_PALMDETECT(info->capabilities)) +diff --git a/drivers/input/touchscreen/stmfts.c b/drivers/input/touchscreen/stmfts.c +index 8c6c6178ec12..025bae3853cc 100644 +--- a/drivers/input/touchscreen/stmfts.c ++++ b/drivers/input/touchscreen/stmfts.c +@@ -687,6 +687,14 @@ static int stmfts_probe(struct i2c_client *client, + + input_set_drvdata(sdata->input, sdata); + ++ /* ++ * stmfts_power_on expects interrupt to be disabled, but ++ * at this point the device is still off and I do not trust ++ * the status of the irq line that can generate some spurious ++ * interrupts. To be on the safe side it's better to not enable ++ * the interrupts during their request. ++ */ ++ irq_set_status_flags(client->irq, IRQ_NOAUTOEN); + err = devm_request_threaded_irq(&client->dev, client->irq, + NULL, stmfts_irq_handler, + IRQF_ONESHOT, +@@ -694,9 +702,6 @@ static int stmfts_probe(struct i2c_client *client, + if (err) + return err; + +- /* stmfts_power_on expects interrupt to be disabled */ +- disable_irq(client->irq); +- + dev_dbg(&client->dev, "initializing ST-Microelectronics FTS...\n"); + + err = stmfts_power_on(sdata); +diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c +index 25c2c75f5332..13485a40dd46 100644 +--- a/drivers/iommu/exynos-iommu.c ++++ b/drivers/iommu/exynos-iommu.c +@@ -1344,8 +1344,15 @@ static const struct iommu_ops exynos_iommu_ops = { + + static int __init exynos_iommu_init(void) + { ++ struct device_node *np; + int ret; + ++ np = of_find_matching_node(NULL, sysmmu_of_match); ++ if (!np) ++ return 0; ++ ++ of_node_put(np); ++ + lv2table_kmem_cache = kmem_cache_create("exynos-iommu-lv2table", + LV2TABLE_SIZE, LV2TABLE_SIZE, 0, NULL); + if (!lv2table_kmem_cache) { +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 83f3d4831f94..e8414bcf8390 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1603,8 +1603,7 @@ static void iommu_flush_iotlb_psi(struct intel_iommu *iommu, + * flush. However, device IOTLB doesn't need to be flushed in this case. + */ + if (!cap_caching_mode(iommu->cap) || !map) +- iommu_flush_dev_iotlb(get_iommu_domain(iommu, did), +- addr, mask); ++ iommu_flush_dev_iotlb(domain, addr, mask); + } + + static void iommu_flush_iova(struct iova_domain *iovad) +diff --git a/drivers/irqchip/irq-gic-v3-its-pci-msi.c b/drivers/irqchip/irq-gic-v3-its-pci-msi.c +index 14a8c0a7e095..25a98de5cfb2 100644 +--- a/drivers/irqchip/irq-gic-v3-its-pci-msi.c ++++ b/drivers/irqchip/irq-gic-v3-its-pci-msi.c +@@ -132,6 +132,8 @@ static int __init its_pci_of_msi_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/irqchip/irq-gic-v3-its-platform-msi.c b/drivers/irqchip/irq-gic-v3-its-platform-msi.c +index 833a90fe33ae..8881a053c173 100644 +--- a/drivers/irqchip/irq-gic-v3-its-platform-msi.c ++++ b/drivers/irqchip/irq-gic-v3-its-platform-msi.c +@@ -154,6 +154,8 @@ static void __init its_pmsi_of_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index af57f8473a88..13f195c9743e 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -3083,6 +3083,8 @@ static int __init its_of_probe(struct device_node *node) + + for (np = of_find_matching_node(node, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) { + pr_warn("%pOF: no msi-controller property, ITS ignored\n", + np); +diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c +index 848fcdf6a112..3d7374655587 100644 +--- a/drivers/irqchip/irq-gic-v3.c ++++ b/drivers/irqchip/irq-gic-v3.c +@@ -645,7 +645,7 @@ static void gic_send_sgi(u64 cluster_id, u16 tlist, unsigned int irq) + MPIDR_TO_SGI_AFFINITY(cluster_id, 1) | + tlist << ICC_SGI1R_TARGET_LIST_SHIFT); + +- pr_debug("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val); ++ pr_devel("CPU%d: ICC_SGI1R_EL1 %llx\n", smp_processor_id(), val); + gic_write_sgi1r(val); + } + +diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c +index f0dc8e2aee65..8c13a9036d07 100644 +--- a/drivers/md/bcache/alloc.c ++++ b/drivers/md/bcache/alloc.c +@@ -287,8 +287,10 @@ do { \ + break; \ + \ + mutex_unlock(&(ca)->set->bucket_lock); \ +- if (kthread_should_stop()) \ ++ if (kthread_should_stop()) { \ ++ set_current_state(TASK_RUNNING); \ + return 0; \ ++ } \ + \ + schedule(); \ + mutex_lock(&(ca)->set->bucket_lock); \ +diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h +index abd31e847f96..e4a3f692057b 100644 +--- a/drivers/md/bcache/bcache.h ++++ b/drivers/md/bcache/bcache.h +@@ -906,7 +906,7 @@ void bcache_write_super(struct cache_set *); + + int bch_flash_dev_create(struct cache_set *c, uint64_t size); + +-int bch_cached_dev_attach(struct cached_dev *, struct cache_set *); ++int bch_cached_dev_attach(struct cached_dev *, struct cache_set *, uint8_t *); + void bch_cached_dev_detach(struct cached_dev *); + void bch_cached_dev_run(struct cached_dev *); + void bcache_device_stop(struct bcache_device *); +diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c +index 1598d1e04989..89d088cf95d9 100644 +--- a/drivers/md/bcache/btree.c ++++ b/drivers/md/bcache/btree.c +@@ -1868,14 +1868,17 @@ void bch_initial_gc_finish(struct cache_set *c) + */ + for_each_cache(ca, c, i) { + for_each_bucket(b, ca) { +- if (fifo_full(&ca->free[RESERVE_PRIO])) ++ if (fifo_full(&ca->free[RESERVE_PRIO]) && ++ fifo_full(&ca->free[RESERVE_BTREE])) + break; + + if (bch_can_invalidate_bucket(ca, b) && + !GC_MARK(b)) { + __bch_invalidate_one_bucket(ca, b); +- fifo_push(&ca->free[RESERVE_PRIO], +- b - ca->buckets); ++ if (!fifo_push(&ca->free[RESERVE_PRIO], ++ b - ca->buckets)) ++ fifo_push(&ca->free[RESERVE_BTREE], ++ b - ca->buckets); + } + } + } +diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c +index 5d0430777dda..fe6e4c319b7c 100644 +--- a/drivers/md/bcache/super.c ++++ b/drivers/md/bcache/super.c +@@ -939,7 +939,8 @@ void bch_cached_dev_detach(struct cached_dev *dc) + cached_dev_put(dc); + } + +-int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) ++int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c, ++ uint8_t *set_uuid) + { + uint32_t rtime = cpu_to_le32(get_seconds()); + struct uuid_entry *u; +@@ -948,7 +949,8 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) + + bdevname(dc->bdev, buf); + +- if (memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16)) ++ if ((set_uuid && memcmp(set_uuid, c->sb.set_uuid, 16)) || ++ (!set_uuid && memcmp(dc->sb.set_uuid, c->sb.set_uuid, 16))) + return -ENOENT; + + if (dc->disk.c) { +@@ -1190,7 +1192,7 @@ static void register_bdev(struct cache_sb *sb, struct page *sb_page, + + list_add(&dc->list, &uncached_devices); + list_for_each_entry(c, &bch_cache_sets, list) +- bch_cached_dev_attach(dc, c); ++ bch_cached_dev_attach(dc, c, NULL); + + if (BDEV_STATE(&dc->sb) == BDEV_STATE_NONE || + BDEV_STATE(&dc->sb) == BDEV_STATE_STALE) +@@ -1712,7 +1714,7 @@ static void run_cache_set(struct cache_set *c) + bcache_write_super(c); + + list_for_each_entry_safe(dc, t, &uncached_devices, list) +- bch_cached_dev_attach(dc, c); ++ bch_cached_dev_attach(dc, c, NULL); + + flash_devs_run(c); + +@@ -1829,6 +1831,7 @@ void bch_cache_release(struct kobject *kobj) + static int cache_alloc(struct cache *ca) + { + size_t free; ++ size_t btree_buckets; + struct bucket *b; + + __module_get(THIS_MODULE); +@@ -1836,9 +1839,19 @@ static int cache_alloc(struct cache *ca) + + bio_init(&ca->journal.bio, ca->journal.bio.bi_inline_vecs, 8); + ++ /* ++ * when ca->sb.njournal_buckets is not zero, journal exists, ++ * and in bch_journal_replay(), tree node may split, ++ * so bucket of RESERVE_BTREE type is needed, ++ * the worst situation is all journal buckets are valid journal, ++ * and all the keys need to replay, ++ * so the number of RESERVE_BTREE type buckets should be as much ++ * as journal buckets ++ */ ++ btree_buckets = ca->sb.njournal_buckets ?: 8; + free = roundup_pow_of_two(ca->sb.nbuckets) >> 10; + +- if (!init_fifo(&ca->free[RESERVE_BTREE], 8, GFP_KERNEL) || ++ if (!init_fifo(&ca->free[RESERVE_BTREE], btree_buckets, GFP_KERNEL) || + !init_fifo_exact(&ca->free[RESERVE_PRIO], prio_buckets(ca), GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_MOVINGGC], free, GFP_KERNEL) || + !init_fifo(&ca->free[RESERVE_NONE], free, GFP_KERNEL) || +diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c +index 234b2f5b286d..5d81cd06af00 100644 +--- a/drivers/md/bcache/sysfs.c ++++ b/drivers/md/bcache/sysfs.c +@@ -193,7 +193,7 @@ STORE(__cached_dev) + { + struct cached_dev *dc = container_of(kobj, struct cached_dev, + disk.kobj); +- ssize_t v = size; ++ ssize_t v; + struct cache_set *c; + struct kobj_uevent_env *env; + +@@ -265,17 +265,20 @@ STORE(__cached_dev) + } + + if (attr == &sysfs_attach) { +- if (bch_parse_uuid(buf, dc->sb.set_uuid) < 16) ++ uint8_t set_uuid[16]; ++ ++ if (bch_parse_uuid(buf, set_uuid) < 16) + return -EINVAL; + ++ v = -ENOENT; + list_for_each_entry(c, &bch_cache_sets, list) { +- v = bch_cached_dev_attach(dc, c); ++ v = bch_cached_dev_attach(dc, c, set_uuid); + if (!v) + return size; + } + + pr_err("Can't attach %s: cache set not found", buf); +- size = v; ++ return v; + } + + if (attr == &sysfs_detach && dc->disk.c) +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index 70454f2ad2fa..f046dedc59ab 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -420,18 +420,21 @@ static int bch_writeback_thread(void *arg) + + while (!kthread_should_stop()) { + down_write(&dc->writeback_lock); ++ set_current_state(TASK_INTERRUPTIBLE); + if (!atomic_read(&dc->has_dirty) || + (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) && + !dc->writeback_running)) { + up_write(&dc->writeback_lock); +- set_current_state(TASK_INTERRUPTIBLE); + +- if (kthread_should_stop()) ++ if (kthread_should_stop()) { ++ set_current_state(TASK_RUNNING); + return 0; ++ } + + schedule(); + continue; + } ++ set_current_state(TASK_RUNNING); + + searched_full_index = refill_dirty(dc); + +diff --git a/drivers/md/dm-mpath.c b/drivers/md/dm-mpath.c +index 2704a55f8b6e..8b7328666eaa 100644 +--- a/drivers/md/dm-mpath.c ++++ b/drivers/md/dm-mpath.c +@@ -502,8 +502,20 @@ static int multipath_clone_and_map(struct dm_target *ti, struct request *rq, + if (queue_dying) { + atomic_inc(&m->pg_init_in_progress); + activate_or_offline_path(pgpath); ++ return DM_MAPIO_DELAY_REQUEUE; + } +- return DM_MAPIO_DELAY_REQUEUE; ++ ++ /* ++ * blk-mq's SCHED_RESTART can cover this requeue, so we ++ * needn't deal with it by DELAY_REQUEUE. More importantly, ++ * we have to return DM_MAPIO_REQUEUE so that blk-mq can ++ * get the queue busy feedback (via BLK_STS_RESOURCE), ++ * otherwise I/O merging can suffer. ++ */ ++ if (q->mq_ops) ++ return DM_MAPIO_REQUEUE; ++ else ++ return DM_MAPIO_DELAY_REQUEUE; + } + clone->bio = clone->biotail = NULL; + clone->rq_disk = bdev->bd_disk; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 7f837006bb6a..3bdeb295514b 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2932,7 +2932,7 @@ static irqreturn_t gfar_transmit(int irq, void *grp_id) + static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + struct sk_buff *skb, bool first) + { +- unsigned int size = lstatus & BD_LENGTH_MASK; ++ int size = lstatus & BD_LENGTH_MASK; + struct page *page = rxb->page; + bool last = !!(lstatus & BD_LFLAG(RXBD_LAST)); + +@@ -2947,11 +2947,16 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + if (last) + size -= skb->len; + +- /* in case the last fragment consisted only of the FCS */ ++ /* Add the last fragment if it contains something other than ++ * the FCS, otherwise drop it and trim off any part of the FCS ++ * that was already received. ++ */ + if (size > 0) + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, + rxb->page_offset + RXBUF_ALIGNMENT, + size, GFAR_RXB_TRUESIZE); ++ else if (size < 0) ++ pskb_trim(skb, skb->len + size); + } + + /* try reuse page */ +diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +index e69d49d91d67..914258310ddd 100644 +--- a/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c ++++ b/drivers/net/ethernet/intel/fm10k/fm10k_netdev.c +@@ -815,8 +815,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set) + if (vid >= VLAN_N_VID) + return -EINVAL; + +- /* Verify we have permission to add VLANs */ +- if (hw->mac.vlan_override) ++ /* Verify that we have permission to add VLANs. If this is a request ++ * to remove a VLAN, we still want to allow the user to remove the ++ * VLAN device. In that case, we need to clear the bit in the ++ * active_vlans bitmask. ++ */ ++ if (set && hw->mac.vlan_override) + return -EACCES; + + /* update active_vlans bitmask */ +@@ -835,6 +839,12 @@ static int fm10k_update_vid(struct net_device *netdev, u16 vid, bool set) + rx_ring->vid &= ~FM10K_VLAN_CLEAR; + } + ++ /* If our VLAN has been overridden, there is no reason to send VLAN ++ * removal requests as they will be silently ignored. ++ */ ++ if (hw->mac.vlan_override) ++ return 0; ++ + /* Do not remove default VLAN ID related entries from VLAN and MAC + * tables + */ +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index 05e89864f781..ef22793d6a03 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2588,16 +2588,16 @@ static int i40e_get_ethtool_fdir_entry(struct i40e_pf *pf, + + no_input_set: + if (input_set & I40E_L3_SRC_MASK) +- fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFF); ++ fsp->m_u.tcp_ip4_spec.ip4src = htonl(0xFFFFFFFF); + + if (input_set & I40E_L3_DST_MASK) +- fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFF); ++ fsp->m_u.tcp_ip4_spec.ip4dst = htonl(0xFFFFFFFF); + + if (input_set & I40E_L4_SRC_MASK) +- fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFFFFFF); ++ fsp->m_u.tcp_ip4_spec.psrc = htons(0xFFFF); + + if (input_set & I40E_L4_DST_MASK) +- fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFFFFFF); ++ fsp->m_u.tcp_ip4_spec.pdst = htons(0xFFFF); + + if (rule->dest_ctl == I40E_FILTER_PROGRAM_DESC_DEST_DROP_PACKET) + fsp->ring_cookie = RX_CLS_FLOW_DISC; +@@ -3648,6 +3648,16 @@ static int i40e_check_fdir_input_set(struct i40e_vsi *vsi, + + i40e_write_fd_input_set(pf, index, new_mask); + ++ /* IP_USER_FLOW filters match both IPv4/Other and IPv4/Fragmented ++ * frames. If we're programming the input set for IPv4/Other, we also ++ * need to program the IPv4/Fragmented input set. Since we don't have ++ * separate support, we'll always assume and enforce that the two flow ++ * types must have matching input sets. ++ */ ++ if (index == I40E_FILTER_PCTYPE_NONF_IPV4_OTHER) ++ i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4, ++ new_mask); ++ + /* Add the new offset and update table, if necessary */ + if (new_flex_offset) { + err = i40e_add_flex_offset(&pf->l4_flex_pit_list, src_offset, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index b1cde1b051a4..d36b799116e4 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -5828,6 +5828,9 @@ static void i40e_fdir_filter_exit(struct i40e_pf *pf) + /* Reprogram the default input set for Other/IPv4 */ + i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_NONF_IPV4_OTHER, + I40E_L3_SRC_MASK | I40E_L3_DST_MASK); ++ ++ i40e_write_fd_input_set(pf, I40E_FILTER_PCTYPE_FRAG_IPV4, ++ I40E_L3_SRC_MASK | I40E_L3_DST_MASK); + } + + /** +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf.h b/drivers/net/ethernet/intel/i40evf/i40evf.h +index 82f69031e5cd..2ef32ab1dfae 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf.h ++++ b/drivers/net/ethernet/intel/i40evf/i40evf.h +@@ -186,6 +186,7 @@ enum i40evf_state_t { + enum i40evf_critical_section_t { + __I40EVF_IN_CRITICAL_TASK, /* cannot be interrupted */ + __I40EVF_IN_CLIENT_TASK, ++ __I40EVF_IN_REMOVE_TASK, /* device being removed */ + }; + + /* board specific private data structure */ +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_main.c b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +index 4eb6ff60e8fc..1b5d204c57c1 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_main.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_main.c +@@ -1839,6 +1839,12 @@ static void i40evf_reset_task(struct work_struct *work) + int i = 0, err; + bool running; + ++ /* When device is being removed it doesn't make sense to run the reset ++ * task, just return in such a case. ++ */ ++ if (test_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section)) ++ return; ++ + while (test_and_set_bit(__I40EVF_IN_CLIENT_TASK, + &adapter->crit_section)) + usleep_range(500, 1000); +@@ -3022,7 +3028,8 @@ static void i40evf_remove(struct pci_dev *pdev) + struct i40evf_mac_filter *f, *ftmp; + struct i40e_hw *hw = &adapter->hw; + int err; +- ++ /* Indicate we are in remove and not to run reset_task */ ++ set_bit(__I40EVF_IN_REMOVE_TASK, &adapter->crit_section); + cancel_delayed_work_sync(&adapter->init_task); + cancel_work_sync(&adapter->reset_task); + cancel_delayed_work_sync(&adapter->client_task); +diff --git a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c +index 85876f4fb1fb..46bf11afba08 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c ++++ b/drivers/net/ethernet/intel/i40evf/i40evf_virtchnl.c +@@ -937,23 +937,34 @@ void i40evf_virtchnl_completion(struct i40evf_adapter *adapter, + if (v_opcode == VIRTCHNL_OP_EVENT) { + struct virtchnl_pf_event *vpe = + (struct virtchnl_pf_event *)msg; ++ bool link_up = vpe->event_data.link_event.link_status; + switch (vpe->event) { + case VIRTCHNL_EVENT_LINK_CHANGE: + adapter->link_speed = + vpe->event_data.link_event.link_speed; +- if (adapter->link_up != +- vpe->event_data.link_event.link_status) { +- adapter->link_up = +- vpe->event_data.link_event.link_status; +- if (adapter->link_up) { +- netif_tx_start_all_queues(netdev); +- netif_carrier_on(netdev); +- } else { +- netif_tx_stop_all_queues(netdev); +- netif_carrier_off(netdev); +- } +- i40evf_print_link_message(adapter); ++ ++ /* we've already got the right link status, bail */ ++ if (adapter->link_up == link_up) ++ break; ++ ++ /* If we get link up message and start queues before ++ * our queues are configured it will trigger a TX hang. ++ * In that case, just ignore the link status message, ++ * we'll get another one after we enable queues and ++ * actually prepared to send traffic. ++ */ ++ if (link_up && adapter->state != __I40EVF_RUNNING) ++ break; ++ ++ adapter->link_up = link_up; ++ if (link_up) { ++ netif_tx_start_all_queues(netdev); ++ netif_carrier_on(netdev); ++ } else { ++ netif_tx_stop_all_queues(netdev); ++ netif_carrier_off(netdev); + } ++ i40evf_print_link_message(adapter); + break; + case VIRTCHNL_EVENT_RESET_IMPENDING: + dev_info(&adapter->pdev->dev, "PF reset warning received\n"); +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index d1a44a84c97e..6ca580cdfd84 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8373,7 +8373,8 @@ static void igb_rar_set_index(struct igb_adapter *adapter, u32 index) + + /* Indicate to hardware the Address is Valid. */ + if (adapter->mac_table[index].state & IGB_MAC_STATE_IN_USE) { +- rar_high |= E1000_RAH_AV; ++ if (is_valid_ether_addr(addr)) ++ rar_high |= E1000_RAH_AV; + + if (hw->mac.type == e1000_82575) + rar_high |= E1000_RAH_POOL_1 * +@@ -8411,17 +8412,36 @@ static int igb_set_vf_mac(struct igb_adapter *adapter, + static int igb_ndo_set_vf_mac(struct net_device *netdev, int vf, u8 *mac) + { + struct igb_adapter *adapter = netdev_priv(netdev); +- if (!is_valid_ether_addr(mac) || (vf >= adapter->vfs_allocated_count)) ++ ++ if (vf >= adapter->vfs_allocated_count) ++ return -EINVAL; ++ ++ /* Setting the VF MAC to 0 reverts the IGB_VF_FLAG_PF_SET_MAC ++ * flag and allows to overwrite the MAC via VF netdev. This ++ * is necessary to allow libvirt a way to restore the original ++ * MAC after unbinding vfio-pci and reloading igbvf after shutting ++ * down a VM. ++ */ ++ if (is_zero_ether_addr(mac)) { ++ adapter->vf_data[vf].flags &= ~IGB_VF_FLAG_PF_SET_MAC; ++ dev_info(&adapter->pdev->dev, ++ "remove administratively set MAC on VF %d\n", ++ vf); ++ } else if (is_valid_ether_addr(mac)) { ++ adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC; ++ dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", ++ mac, vf); ++ dev_info(&adapter->pdev->dev, ++ "Reload the VF driver to make this change effective."); ++ /* Generate additional warning if PF is down */ ++ if (test_bit(__IGB_DOWN, &adapter->state)) { ++ dev_warn(&adapter->pdev->dev, ++ "The VF MAC address has been set, but the PF device is not up.\n"); ++ dev_warn(&adapter->pdev->dev, ++ "Bring the PF device up before attempting to use the VF device.\n"); ++ } ++ } else { + return -EINVAL; +- adapter->vf_data[vf].flags |= IGB_VF_FLAG_PF_SET_MAC; +- dev_info(&adapter->pdev->dev, "setting MAC %pM on VF %d\n", mac, vf); +- dev_info(&adapter->pdev->dev, +- "Reload the VF driver to make this change effective."); +- if (test_bit(__IGB_DOWN, &adapter->state)) { +- dev_warn(&adapter->pdev->dev, +- "The VF MAC address has been set, but the PF device is not up.\n"); +- dev_warn(&adapter->pdev->dev, +- "Bring the PF device up before attempting to use the VF device.\n"); + } + return igb_set_vf_mac(adapter, vf, mac); + } +diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c +index 841c2a083349..0746b19ec6d3 100644 +--- a/drivers/net/ethernet/intel/igb/igb_ptp.c ++++ b/drivers/net/ethernet/intel/igb/igb_ptp.c +@@ -643,6 +643,10 @@ static void igb_ptp_tx_work(struct work_struct *work) + adapter->ptp_tx_skb = NULL; + clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state); + adapter->tx_hwtstamp_timeouts++; ++ /* Clear the tx valid bit in TSYNCTXCTL register to enable ++ * interrupt ++ */ ++ rd32(E1000_TXSTMPH); + dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n"); + return; + } +@@ -717,6 +721,7 @@ void igb_ptp_rx_hang(struct igb_adapter *adapter) + */ + void igb_ptp_tx_hang(struct igb_adapter *adapter) + { ++ struct e1000_hw *hw = &adapter->hw; + bool timeout = time_is_before_jiffies(adapter->ptp_tx_start + + IGB_PTP_TX_TIMEOUT); + +@@ -736,6 +741,10 @@ void igb_ptp_tx_hang(struct igb_adapter *adapter) + adapter->ptp_tx_skb = NULL; + clear_bit_unlock(__IGB_PTP_TX_IN_PROGRESS, &adapter->state); + adapter->tx_hwtstamp_timeouts++; ++ /* Clear the tx valid bit in TSYNCTXCTL register to enable ++ * interrupt ++ */ ++ rd32(E1000_TXSTMPH); + dev_warn(&adapter->pdev->dev, "clearing Tx timestamp hang\n"); + } + } +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 29f600fd6977..9e30cfeac04b 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -3987,11 +3987,15 @@ void ixgbe_configure_rx_ring(struct ixgbe_adapter *adapter, + rxdctl &= ~0x3FFFFF; + rxdctl |= 0x080420; + #if (PAGE_SIZE < 8192) +- } else { ++ /* RXDCTL.RLPML does not work on 82599 */ ++ } else if (hw->mac.type != ixgbe_mac_82599EB) { + rxdctl &= ~(IXGBE_RXDCTL_RLPMLMASK | + IXGBE_RXDCTL_RLPML_EN); + +- /* Limit the maximum frame size so we don't overrun the skb */ ++ /* Limit the maximum frame size so we don't overrun the skb. ++ * This can happen in SRIOV mode when the MTU of the VF is ++ * higher than the MTU of the PF. ++ */ + if (ring_uses_build_skb(ring) && + !test_bit(__IXGBE_RX_3K_BUFFER, &ring->state)) + rxdctl |= IXGBE_MAX_2K_FRAME_BUILD_SKB | +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_main.c b/drivers/net/ethernet/netronome/nfp/nfp_main.c +index f8fa63b66739..a1a15e0c2245 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_main.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_main.c +@@ -492,6 +492,7 @@ static int nfp_pci_probe(struct pci_dev *pdev, + dev_err(&pdev->dev, + "Error: %d VFs already enabled, but loaded FW can only support %d\n", + pf->num_vfs, pf->limit_vfs); ++ err = -EINVAL; + goto err_fw_unload; + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +index 4404650b32c5..8be4b32544ef 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-meson8b.c +@@ -116,7 +116,7 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac) + snprintf(clk_name, sizeof(clk_name), "%s#m250_sel", dev_name(dev)); + init.name = clk_name; + init.ops = &clk_mux_ops; +- init.flags = 0; ++ init.flags = CLK_SET_RATE_PARENT; + init.parent_names = mux_parent_names; + init.num_parents = MUX_CLK_NUM_PARENTS; + +@@ -144,7 +144,9 @@ static int meson8b_init_clk(struct meson8b_dwmac *dwmac) + dwmac->m250_div.shift = PRG_ETH0_CLK_M250_DIV_SHIFT; + dwmac->m250_div.width = PRG_ETH0_CLK_M250_DIV_WIDTH; + dwmac->m250_div.hw.init = &init; +- dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | CLK_DIVIDER_ALLOW_ZERO; ++ dwmac->m250_div.flags = CLK_DIVIDER_ONE_BASED | ++ CLK_DIVIDER_ALLOW_ZERO | ++ CLK_DIVIDER_ROUND_CLOSEST; + + dwmac->m250_div_clk = devm_clk_register(dev, &dwmac->m250_div.hw); + if (WARN_ON(IS_ERR(dwmac->m250_div_clk))) +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +index 2f7d7ec59962..e1d03489ae63 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c +@@ -562,10 +562,12 @@ static int dwmac4_irq_status(struct mac_device_info *hw, + struct stmmac_extra_stats *x) + { + void __iomem *ioaddr = hw->pcsr; +- u32 intr_status; ++ u32 intr_status = readl(ioaddr + GMAC_INT_STATUS); ++ u32 intr_enable = readl(ioaddr + GMAC_INT_EN); + int ret = 0; + +- intr_status = readl(ioaddr + GMAC_INT_STATUS); ++ /* Discard disabled bits */ ++ intr_status &= intr_enable; + + /* Not used events (e.g. MMC interrupts) are not handled. */ + if ((intr_status & mmc_tx_irq)) +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index d148dbf3beeb..d686ba10fecc 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3153,8 +3153,10 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) + if (info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]) { + u32 idx = nla_get_u32(info->attrs[HWSIM_ATTR_REG_CUSTOM_REG]); + +- if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) ++ if (idx >= ARRAY_SIZE(hwsim_world_regdom_custom)) { ++ kfree(hwname); + return -EINVAL; ++ } + param.regd = hwsim_world_regdom_custom[idx]; + } + +@@ -3425,8 +3427,11 @@ static void __net_exit hwsim_exit_net(struct net *net) + continue; + + list_del(&data->list); +- INIT_WORK(&data->destroy_work, destroy_radio); +- schedule_work(&data->destroy_work); ++ spin_unlock_bh(&hwsim_radio_lock); ++ mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), ++ NULL); ++ spin_lock_bh(&hwsim_radio_lock); ++ + } + spin_unlock_bh(&hwsim_radio_lock); + } +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index a9ba9fe263ca..f07b9c9bb5ba 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -351,6 +351,9 @@ static int xennet_open(struct net_device *dev) + unsigned int i = 0; + struct netfront_queue *queue = NULL; + ++ if (!np->queues) ++ return -ENODEV; ++ + for (i = 0; i < num_queues; ++i) { + queue = &np->queues[i]; + napi_enable(&queue->napi); +@@ -1358,18 +1361,8 @@ static int netfront_probe(struct xenbus_device *dev, + #ifdef CONFIG_SYSFS + info->netdev->sysfs_groups[0] = &xennet_dev_group; + #endif +- err = register_netdev(info->netdev); +- if (err) { +- pr_warn("%s: register_netdev err=%d\n", __func__, err); +- goto fail; +- } + + return 0; +- +- fail: +- xennet_free_netdev(netdev); +- dev_set_drvdata(&dev->dev, NULL); +- return err; + } + + static void xennet_end_access(int ref, void *page) +@@ -1738,8 +1731,6 @@ static void xennet_destroy_queues(struct netfront_info *info) + { + unsigned int i; + +- rtnl_lock(); +- + for (i = 0; i < info->netdev->real_num_tx_queues; i++) { + struct netfront_queue *queue = &info->queues[i]; + +@@ -1748,8 +1739,6 @@ static void xennet_destroy_queues(struct netfront_info *info) + netif_napi_del(&queue->napi); + } + +- rtnl_unlock(); +- + kfree(info->queues); + info->queues = NULL; + } +@@ -1765,8 +1754,6 @@ static int xennet_create_queues(struct netfront_info *info, + if (!info->queues) + return -ENOMEM; + +- rtnl_lock(); +- + for (i = 0; i < *num_queues; i++) { + struct netfront_queue *queue = &info->queues[i]; + +@@ -1775,7 +1762,7 @@ static int xennet_create_queues(struct netfront_info *info, + + ret = xennet_init_queue(queue); + if (ret < 0) { +- dev_warn(&info->netdev->dev, ++ dev_warn(&info->xbdev->dev, + "only created %d queues\n", i); + *num_queues = i; + break; +@@ -1789,10 +1776,8 @@ static int xennet_create_queues(struct netfront_info *info, + + netif_set_real_num_tx_queues(info->netdev, *num_queues); + +- rtnl_unlock(); +- + if (*num_queues == 0) { +- dev_err(&info->netdev->dev, "no queues\n"); ++ dev_err(&info->xbdev->dev, "no queues\n"); + return -EINVAL; + } + return 0; +@@ -1829,6 +1814,7 @@ static int talk_to_netback(struct xenbus_device *dev, + goto out; + } + ++ rtnl_lock(); + if (info->queues) + xennet_destroy_queues(info); + +@@ -1839,6 +1825,7 @@ static int talk_to_netback(struct xenbus_device *dev, + info->queues = NULL; + goto out; + } ++ rtnl_unlock(); + + /* Create shared ring, alloc event channel -- for each queue */ + for (i = 0; i < num_queues; ++i) { +@@ -1935,8 +1922,10 @@ static int talk_to_netback(struct xenbus_device *dev, + xenbus_transaction_end(xbt, 1); + destroy_ring: + xennet_disconnect_backend(info); ++ rtnl_lock(); + xennet_destroy_queues(info); + out: ++ rtnl_unlock(); + device_unregister(&dev->dev); + return err; + } +@@ -1966,6 +1955,15 @@ static int xennet_connect(struct net_device *dev) + netdev_update_features(dev); + rtnl_unlock(); + ++ if (dev->reg_state == NETREG_UNINITIALIZED) { ++ err = register_netdev(dev); ++ if (err) { ++ pr_warn("%s: register_netdev err=%d\n", __func__, err); ++ device_unregister(&np->xbdev->dev); ++ return err; ++ } ++ } ++ + /* + * All public and private state should now be sane. Get + * ready to start sending and receiving packets and give the driver +@@ -2156,10 +2154,14 @@ static int xennet_remove(struct xenbus_device *dev) + + xennet_disconnect_backend(info); + +- unregister_netdev(info->netdev); ++ if (info->netdev->reg_state == NETREG_REGISTERED) ++ unregister_netdev(info->netdev); + +- if (info->queues) ++ if (info->queues) { ++ rtnl_lock(); + xennet_destroy_queues(info); ++ rtnl_unlock(); ++ } + xennet_free_netdev(info->netdev); + + return 0; +diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c +index f58d8e305323..18339b7e88a4 100644 +--- a/drivers/ntb/ntb_transport.c ++++ b/drivers/ntb/ntb_transport.c +@@ -998,6 +998,9 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, + mw_base = nt->mw_vec[mw_num].phys_addr; + mw_size = nt->mw_vec[mw_num].phys_size; + ++ if (max_mw_size && mw_size > max_mw_size) ++ mw_size = max_mw_size; ++ + tx_size = (unsigned int)mw_size / num_qps_mw; + qp_offset = tx_size * (qp_num / mw_count); + +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 5c5a8af66829..116127a0accb 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3879,6 +3879,8 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9120, + quirk_dma_func1_alias); + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9123, + quirk_dma_func1_alias); ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9128, ++ quirk_dma_func1_alias); + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c14 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9130, + quirk_dma_func1_alias); +diff --git a/drivers/platform/x86/dell-laptop.c b/drivers/platform/x86/dell-laptop.c +index 7424e53157b0..dd5043a6a114 100644 +--- a/drivers/platform/x86/dell-laptop.c ++++ b/drivers/platform/x86/dell-laptop.c +@@ -1177,6 +1177,7 @@ static u8 kbd_previous_mode_bit; + + static bool kbd_led_present; + static DEFINE_MUTEX(kbd_led_mutex); ++static enum led_brightness kbd_led_level; + + /* + * NOTE: there are three ways to set the keyboard backlight level. +@@ -2020,6 +2021,7 @@ static enum led_brightness kbd_led_level_get(struct led_classdev *led_cdev) + static int kbd_led_level_set(struct led_classdev *led_cdev, + enum led_brightness value) + { ++ enum led_brightness new_value = value; + struct kbd_state state; + struct kbd_state new_state; + u16 num; +@@ -2049,6 +2051,9 @@ static int kbd_led_level_set(struct led_classdev *led_cdev, + } + + out: ++ if (ret == 0) ++ kbd_led_level = new_value; ++ + mutex_unlock(&kbd_led_mutex); + return ret; + } +@@ -2076,6 +2081,9 @@ static int __init kbd_led_init(struct device *dev) + if (kbd_led.max_brightness) + kbd_led.max_brightness--; + } ++ ++ kbd_led_level = kbd_led_level_get(NULL); ++ + ret = led_classdev_register(dev, &kbd_led); + if (ret) + kbd_led_present = false; +@@ -2100,13 +2108,25 @@ static void kbd_led_exit(void) + static int dell_laptop_notifier_call(struct notifier_block *nb, + unsigned long action, void *data) + { ++ bool changed = false; ++ enum led_brightness new_kbd_led_level; ++ + switch (action) { + case DELL_LAPTOP_KBD_BACKLIGHT_BRIGHTNESS_CHANGED: + if (!kbd_led_present) + break; + +- led_classdev_notify_brightness_hw_changed(&kbd_led, +- kbd_led_level_get(&kbd_led)); ++ mutex_lock(&kbd_led_mutex); ++ new_kbd_led_level = kbd_led_level_get(&kbd_led); ++ if (kbd_led_level != new_kbd_led_level) { ++ kbd_led_level = new_kbd_led_level; ++ changed = true; ++ } ++ mutex_unlock(&kbd_led_mutex); ++ ++ if (changed) ++ led_classdev_notify_brightness_hw_changed(&kbd_led, ++ kbd_led_level); + break; + } + +diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c +index 2242d6035d9e..c407d52ef7cf 100644 +--- a/drivers/platform/x86/thinkpad_acpi.c ++++ b/drivers/platform/x86/thinkpad_acpi.c +@@ -214,6 +214,10 @@ enum tpacpi_hkey_event_t { + /* AC-related events */ + TP_HKEY_EV_AC_CHANGED = 0x6040, /* AC status changed */ + ++ /* Further user-interface events */ ++ TP_HKEY_EV_PALM_DETECTED = 0x60b0, /* palm hoveres keyboard */ ++ TP_HKEY_EV_PALM_UNDETECTED = 0x60b1, /* palm removed */ ++ + /* Misc */ + TP_HKEY_EV_RFKILL_CHANGED = 0x7000, /* rfkill switch changed */ + }; +@@ -3973,6 +3977,12 @@ static bool hotkey_notify_6xxx(const u32 hkey, + *send_acpi_ev = false; + break; + ++ case TP_HKEY_EV_PALM_DETECTED: ++ case TP_HKEY_EV_PALM_UNDETECTED: ++ /* palm detected hovering the keyboard, forward to user-space ++ * via netlink for consumption */ ++ return true; ++ + default: + pr_warn("unknown possible thermal alarm or keyboard event received\n"); + known = false; +diff --git a/drivers/scsi/arm/fas216.c b/drivers/scsi/arm/fas216.c +index 24388795ee9a..936e8c735656 100644 +--- a/drivers/scsi/arm/fas216.c ++++ b/drivers/scsi/arm/fas216.c +@@ -2011,7 +2011,7 @@ static void fas216_rq_sns_done(FAS216_Info *info, struct scsi_cmnd *SCpnt, + * have valid data in the sense buffer that could + * confuse the higher levels. + */ +- memset(SCpnt->sense_buffer, 0, sizeof(SCpnt->sense_buffer)); ++ memset(SCpnt->sense_buffer, 0, SCSI_SENSE_BUFFERSIZE); + //printk("scsi%d.%c: sense buffer: ", info->host->host_no, '0' + SCpnt->device->id); + //{ int i; for (i = 0; i < 32; i++) printk("%02x ", SCpnt->sense_buffer[i]); printk("\n"); } + /* +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index 2300c02ab5e6..e24f57946a17 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -115,6 +115,8 @@ qla2x00_async_iocb_timeout(void *data) + + switch (sp->type) { + case SRB_LOGIN_CMD: ++ if (!fcport) ++ break; + /* Retry as needed. */ + lio->u.logio.data[0] = MBS_COMMAND_ERROR; + lio->u.logio.data[1] = lio->u.logio.flags & SRB_LOGIN_RETRIED ? +@@ -128,6 +130,8 @@ qla2x00_async_iocb_timeout(void *data) + qla24xx_handle_plogi_done_event(fcport->vha, &ea); + break; + case SRB_LOGOUT_CMD: ++ if (!fcport) ++ break; + qlt_logo_completion_handler(fcport, QLA_FUNCTION_TIMEOUT); + break; + case SRB_CT_PTHRU_CMD: +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index cfc095f45e26..ea947a7c2596 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -109,8 +109,8 @@ static struct { + * seagate controller, which causes SCSI code to reset bus. + */ + {"HP", "C1750A", "3226", BLIST_NOLUN}, /* scanjet iic */ +- {"HP", "C1790A", "", BLIST_NOLUN}, /* scanjet iip */ +- {"HP", "C2500A", "", BLIST_NOLUN}, /* scanjet iicx */ ++ {"HP", "C1790A", NULL, BLIST_NOLUN}, /* scanjet iip */ ++ {"HP", "C2500A", NULL, BLIST_NOLUN}, /* scanjet iicx */ + {"MEDIAVIS", "CDR-H93MV", "1.31", BLIST_NOLUN}, /* locks up */ + {"MICROTEK", "ScanMaker II", "5.61", BLIST_NOLUN}, /* responds to all lun */ + {"MITSUMI", "CD-R CR-2201CS", "6119", BLIST_NOLUN}, /* locks up */ +@@ -120,7 +120,7 @@ static struct { + {"QUANTUM", "FIREBALL ST4.3S", "0F0C", BLIST_NOLUN}, /* locks up */ + {"RELISYS", "Scorpio", NULL, BLIST_NOLUN}, /* responds to all lun */ + {"SANKYO", "CP525", "6.64", BLIST_NOLUN}, /* causes failed REQ SENSE, extra reset */ +- {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN}, ++ {"TEXEL", "CD-ROM", "1.06", BLIST_NOLUN | BLIST_BORKEN}, + {"transtec", "T5008", "0001", BLIST_NOREPORTLUN }, + {"YAMAHA", "CDR100", "1.00", BLIST_NOLUN}, /* locks up */ + {"YAMAHA", "CDR102", "1.00", BLIST_NOLUN}, /* locks up */ +@@ -255,7 +255,6 @@ static struct { + {"ST650211", "CF", NULL, BLIST_RETRY_HWERROR}, + {"SUN", "T300", "*", BLIST_SPARSELUN}, + {"SUN", "T4", "*", BLIST_SPARSELUN}, +- {"TEXEL", "CD-ROM", "1.06", BLIST_BORKEN}, + {"Tornado-", "F4", "*", BLIST_NOREPORTLUN}, + {"TOSHIBA", "CDROM", NULL, BLIST_ISROM}, + {"TOSHIBA", "CD-ROM", NULL, BLIST_ISROM}, +diff --git a/drivers/spi/spi-armada-3700.c b/drivers/spi/spi-armada-3700.c +index fe3fa1e8517a..4903f15177cf 100644 +--- a/drivers/spi/spi-armada-3700.c ++++ b/drivers/spi/spi-armada-3700.c +@@ -624,6 +624,11 @@ static int a3700_spi_transfer_one(struct spi_master *master, + a3700_spi_header_set(a3700_spi); + + if (xfer->rx_buf) { ++ /* Clear WFIFO, since it's last 2 bytes are shifted out during ++ * a read operation ++ */ ++ spireg_write(a3700_spi, A3700_SPI_DATA_OUT_REG, 0); ++ + /* Set read data length */ + spireg_write(a3700_spi, A3700_SPI_IF_DIN_CNT_REG, + a3700_spi->buf_len); +diff --git a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c +index 123e4af58408..50260cb5056d 100644 +--- a/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c ++++ b/drivers/staging/fsl-mc/bus/irq-gic-v3-its-fsl-mc-msi.c +@@ -75,6 +75,8 @@ int __init its_fsl_mc_msi_init(void) + + for (np = of_find_matching_node(NULL, its_device_id); np; + np = of_find_matching_node(np, its_device_id)) { ++ if (!of_device_is_available(np)) ++ continue; + if (!of_property_read_bool(np, "msi-controller")) + continue; + +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index c55624703fdf..e0aa5f03004c 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -37,6 +37,7 @@ + #define PCI_DEVICE_ID_EXAR_XR17V4358 0x4358 + #define PCI_DEVICE_ID_EXAR_XR17V8358 0x8358 + ++#define UART_EXAR_INT0 0x80 + #define UART_EXAR_8XMODE 0x88 /* 8X sampling rate select */ + + #define UART_EXAR_FCTR 0x08 /* Feature Control Register */ +@@ -124,6 +125,7 @@ struct exar8250_board { + struct exar8250 { + unsigned int nr; + struct exar8250_board *board; ++ void __iomem *virt; + int line[0]; + }; + +@@ -134,12 +136,9 @@ static int default_setup(struct exar8250 *priv, struct pci_dev *pcidev, + const struct exar8250_board *board = priv->board; + unsigned int bar = 0; + +- if (!pcim_iomap_table(pcidev)[bar] && !pcim_iomap(pcidev, bar, 0)) +- return -ENOMEM; +- + port->port.iotype = UPIO_MEM; + port->port.mapbase = pci_resource_start(pcidev, bar) + offset; +- port->port.membase = pcim_iomap_table(pcidev)[bar] + offset; ++ port->port.membase = priv->virt + offset; + port->port.regshift = board->reg_shift; + + return 0; +@@ -423,6 +422,25 @@ static void pci_xr17v35x_exit(struct pci_dev *pcidev) + port->port.private_data = NULL; + } + ++/* ++ * These Exar UARTs have an extra interrupt indicator that could fire for a ++ * few interrupts that are not presented/cleared through IIR. One of which is ++ * a wakeup interrupt when coming out of sleep. These interrupts are only ++ * cleared by reading global INT0 or INT1 registers as interrupts are ++ * associated with channel 0. The INT[3:0] registers _are_ accessible from each ++ * channel's address space, but for the sake of bus efficiency we register a ++ * dedicated handler at the PCI device level to handle them. ++ */ ++static irqreturn_t exar_misc_handler(int irq, void *data) ++{ ++ struct exar8250 *priv = data; ++ ++ /* Clear all PCI interrupts by reading INT0. No effect on IIR */ ++ ioread8(priv->virt + UART_EXAR_INT0); ++ ++ return IRQ_HANDLED; ++} ++ + static int + exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + { +@@ -451,6 +469,9 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + return -ENOMEM; + + priv->board = board; ++ priv->virt = pcim_iomap(pcidev, bar, 0); ++ if (!priv->virt) ++ return -ENOMEM; + + pci_set_master(pcidev); + +@@ -464,6 +485,11 @@ exar_pci_probe(struct pci_dev *pcidev, const struct pci_device_id *ent) + uart.port.irq = pci_irq_vector(pcidev, 0); + uart.port.dev = &pcidev->dev; + ++ rc = devm_request_irq(&pcidev->dev, uart.port.irq, exar_misc_handler, ++ IRQF_SHARED, "exar_uart", priv); ++ if (rc) ++ return rc; ++ + for (i = 0; i < nr_ports && i < maxnr; i++) { + rc = board->setup(priv, pcidev, &uart, i); + if (rc) { +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index fde34c84e707..e32c51d549c3 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -458,7 +458,6 @@ static void io_serial_out(struct uart_port *p, int offset, int value) + } + + static int serial8250_default_handle_irq(struct uart_port *port); +-static int exar_handle_irq(struct uart_port *port); + + static void set_io_from_upio(struct uart_port *p) + { +@@ -1903,26 +1902,6 @@ static int serial8250_default_handle_irq(struct uart_port *port) + return ret; + } + +-/* +- * These Exar UARTs have an extra interrupt indicator that could +- * fire for a few unimplemented interrupts. One of which is a +- * wakeup event when coming out of sleep. Put this here just +- * to be on the safe side that these interrupts don't go unhandled. +- */ +-static int exar_handle_irq(struct uart_port *port) +-{ +- unsigned int iir = serial_port_in(port, UART_IIR); +- int ret = 0; +- +- if (((port->type == PORT_XR17V35X) || (port->type == PORT_XR17D15X)) && +- serial_port_in(port, UART_EXAR_INT0) != 0) +- ret = 1; +- +- ret |= serial8250_handle_irq(port, iir); +- +- return ret; +-} +- + /* + * Newer 16550 compatible parts such as the SC16C650 & Altera 16550 Soft IP + * have a programmable TX threshold that triggers the THRE interrupt in +@@ -3107,11 +3086,6 @@ static void serial8250_config_port(struct uart_port *port, int flags) + if (port->type == PORT_UNKNOWN) + serial8250_release_std_resource(up); + +- /* Fixme: probably not the best place for this */ +- if ((port->type == PORT_XR17V35X) || +- (port->type == PORT_XR17D15X)) +- port->handle_irq = exar_handle_irq; +- + register_dev_spec_attr_grp(up); + up->fcr = uart_config[up->port.type].fcr; + } +diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c +index ff5a1a8989d5..ff17e94ef465 100644 +--- a/drivers/usb/musb/musb_core.c ++++ b/drivers/usb/musb/musb_core.c +@@ -1780,6 +1780,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf) + int vbus; + u8 devctl; + ++ pm_runtime_get_sync(dev); + spin_lock_irqsave(&musb->lock, flags); + val = musb->a_wait_bcon; + vbus = musb_platform_get_vbus_status(musb); +@@ -1793,6 +1794,7 @@ musb_vbus_show(struct device *dev, struct device_attribute *attr, char *buf) + vbus = 0; + } + spin_unlock_irqrestore(&musb->lock, flags); ++ pm_runtime_put_sync(dev); + + return sprintf(buf, "Vbus %s, timeout %lu msec\n", + vbus ? "on" : "off", val); +@@ -2496,11 +2498,11 @@ static int musb_remove(struct platform_device *pdev) + musb_disable_interrupts(musb); + musb_writeb(musb->mregs, MUSB_DEVCTL, 0); + spin_unlock_irqrestore(&musb->lock, flags); ++ musb_platform_exit(musb); + + pm_runtime_dont_use_autosuspend(musb->controller); + pm_runtime_put_sync(musb->controller); + pm_runtime_disable(musb->controller); +- musb_platform_exit(musb); + musb_phy_callback = NULL; + if (musb->dma_controller) + musb_dma_controller_destroy(musb->dma_controller); +@@ -2733,7 +2735,8 @@ static int musb_resume(struct device *dev) + if ((devctl & mask) != (musb->context.devctl & mask)) + musb->port1_status = 0; + +- musb_start(musb); ++ musb_enable_interrupts(musb); ++ musb_platform_enable(musb); + + spin_lock_irqsave(&musb->lock, flags); + error = musb_run_resume_work(musb); +diff --git a/drivers/watchdog/sp5100_tco.h b/drivers/watchdog/sp5100_tco.h +index 1af4dee71337..0e242d1110ce 100644 +--- a/drivers/watchdog/sp5100_tco.h ++++ b/drivers/watchdog/sp5100_tco.h +@@ -55,7 +55,7 @@ + #define SB800_PM_WATCHDOG_CONFIG 0x4C + + #define SB800_PCI_WATCHDOG_DECODE_EN (1 << 0) +-#define SB800_PM_WATCHDOG_DISABLE (1 << 2) ++#define SB800_PM_WATCHDOG_DISABLE (1 << 1) + #define SB800_PM_WATCHDOG_SECOND_RES (3 << 0) + #define SB800_ACPI_MMIO_DECODE_EN (1 << 0) + #define SB800_ACPI_MMIO_SEL (1 << 1) +diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c +index 2c6a9114d332..1fb374466e84 100644 +--- a/drivers/xen/grant-table.c ++++ b/drivers/xen/grant-table.c +@@ -328,7 +328,7 @@ static void gnttab_handle_deferred(unsigned long unused) + if (entry->page) { + pr_debug("freeing g.e. %#x (pfn %#lx)\n", + entry->ref, page_to_pfn(entry->page)); +- __free_page(entry->page); ++ put_page(entry->page); + } else + pr_info("freeing g.e. %#x\n", entry->ref); + kfree(entry); +@@ -384,7 +384,7 @@ void gnttab_end_foreign_access(grant_ref_t ref, int readonly, + if (gnttab_end_foreign_access_ref(ref, readonly)) { + put_free_entry(ref); + if (page != 0) +- free_page(page); ++ put_page(virt_to_page(page)); + } else + gnttab_add_deferred(ref, readonly, + page ? virt_to_page(page) : NULL); +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index e2bb2a065741..21cc27509993 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -2774,6 +2774,8 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root, + * contention with the cow code + */ + if (cow) { ++ bool last_level = (level == (BTRFS_MAX_LEVEL - 1)); ++ + /* + * if we don't really need to cow this block + * then we don't want to set the path blocking, +@@ -2798,9 +2800,13 @@ int btrfs_search_slot(struct btrfs_trans_handle *trans, struct btrfs_root *root, + } + + btrfs_set_path_blocking(p); +- err = btrfs_cow_block(trans, root, b, +- p->nodes[level + 1], +- p->slots[level + 1], &b); ++ if (last_level) ++ err = btrfs_cow_block(trans, root, b, NULL, 0, ++ &b); ++ else ++ err = btrfs_cow_block(trans, root, b, ++ p->nodes[level + 1], ++ p->slots[level + 1], &b); + if (err) { + ret = err; + goto done; +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 167ce43cabe8..79f0f282a0ef 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -4063,9 +4063,11 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info) + btrfs_err(fs_info, "no valid FS found"); + ret = -EINVAL; + } +- if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) +- btrfs_warn(fs_info, "unrecognized super flag: %llu", ++ if (btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP) { ++ btrfs_err(fs_info, "unrecognized or unsupported super flag: %llu", + btrfs_super_flags(sb) & ~BTRFS_SUPER_FLAG_SUPP); ++ ret = -EINVAL; ++ } + if (btrfs_super_root_level(sb) >= BTRFS_MAX_LEVEL) { + btrfs_err(fs_info, "tree_root level too big: %d >= %d", + btrfs_super_root_level(sb), BTRFS_MAX_LEVEL); +diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c +index d564a7049d7f..5690feded0de 100644 +--- a/fs/btrfs/file.c ++++ b/fs/btrfs/file.c +@@ -2018,10 +2018,19 @@ int btrfs_release_file(struct inode *inode, struct file *filp) + static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end) + { + int ret; ++ struct blk_plug plug; + ++ /* ++ * This is only called in fsync, which would do synchronous writes, so ++ * a plug can merge adjacent IOs as much as possible. Esp. in case of ++ * multiple disks using raid profile, a large IO can be split to ++ * several segments of stripe length (currently 64K). ++ */ ++ blk_start_plug(&plug); + atomic_inc(&BTRFS_I(inode)->sync_writers); + ret = btrfs_fdatawrite_range(inode, start, end); + atomic_dec(&BTRFS_I(inode)->sync_writers); ++ blk_finish_plug(&plug); + + return ret; + } +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index dfa360d18ae2..9f21c29d0259 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -42,6 +42,7 @@ + #include + #include + #include ++#include + #include "ctree.h" + #include "disk-io.h" + #include "transaction.h" +@@ -5980,11 +5981,13 @@ static int btrfs_filldir(void *addr, int entries, struct dir_context *ctx) + struct dir_entry *entry = addr; + char *name = (char *)(entry + 1); + +- ctx->pos = entry->offset; +- if (!dir_emit(ctx, name, entry->name_len, entry->ino, +- entry->type)) ++ ctx->pos = get_unaligned(&entry->offset); ++ if (!dir_emit(ctx, name, get_unaligned(&entry->name_len), ++ get_unaligned(&entry->ino), ++ get_unaligned(&entry->type))) + return 1; +- addr += sizeof(struct dir_entry) + entry->name_len; ++ addr += sizeof(struct dir_entry) + ++ get_unaligned(&entry->name_len); + ctx->pos++; + } + return 0; +@@ -6078,14 +6081,15 @@ static int btrfs_real_readdir(struct file *file, struct dir_context *ctx) + } + + entry = addr; +- entry->name_len = name_len; ++ put_unaligned(name_len, &entry->name_len); + name_ptr = (char *)(entry + 1); + read_extent_buffer(leaf, name_ptr, (unsigned long)(di + 1), + name_len); +- entry->type = btrfs_filetype_table[btrfs_dir_type(leaf, di)]; ++ put_unaligned(btrfs_filetype_table[btrfs_dir_type(leaf, di)], ++ &entry->type); + btrfs_dir_item_key_to_cpu(leaf, di, &location); +- entry->ino = location.objectid; +- entry->offset = found_key.offset; ++ put_unaligned(location.objectid, &entry->ino); ++ put_unaligned(found_key.offset, &entry->offset); + entries++; + addr += sizeof(struct dir_entry) + name_len; + total_len += sizeof(struct dir_entry) + name_len; +@@ -7261,19 +7265,12 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, + * existing will always be non-NULL, since there must be + * extent causing the -EEXIST. + */ +- if (existing->start == em->start && +- extent_map_end(existing) >= extent_map_end(em) && +- em->block_start == existing->block_start) { +- /* +- * The existing extent map already encompasses the +- * entire extent map we tried to add. +- */ ++ if (start >= existing->start && ++ start < extent_map_end(existing)) { + free_extent_map(em); + em = existing; + err = 0; +- +- } else if (start >= extent_map_end(existing) || +- start <= existing->start) { ++ } else { + /* + * The existing extent map is the one nearest to + * the [start, start + len) range which overlaps +@@ -7285,10 +7282,6 @@ struct extent_map *btrfs_get_extent(struct btrfs_inode *inode, + free_extent_map(em); + em = NULL; + } +- } else { +- free_extent_map(em); +- em = existing; +- err = 0; + } + } + write_unlock(&em_tree->lock); +diff --git a/fs/btrfs/raid56.c b/fs/btrfs/raid56.c +index 32b186c5694c..2e995e565633 100644 +--- a/fs/btrfs/raid56.c ++++ b/fs/btrfs/raid56.c +@@ -858,10 +858,17 @@ static void __free_raid_bio(struct btrfs_raid_bio *rbio) + kfree(rbio); + } + +-static void free_raid_bio(struct btrfs_raid_bio *rbio) ++static void rbio_endio_bio_list(struct bio *cur, blk_status_t err) + { +- unlock_stripe(rbio); +- __free_raid_bio(rbio); ++ struct bio *next; ++ ++ while (cur) { ++ next = cur->bi_next; ++ cur->bi_next = NULL; ++ cur->bi_status = err; ++ bio_endio(cur); ++ cur = next; ++ } + } + + /* +@@ -871,20 +878,26 @@ static void free_raid_bio(struct btrfs_raid_bio *rbio) + static void rbio_orig_end_io(struct btrfs_raid_bio *rbio, blk_status_t err) + { + struct bio *cur = bio_list_get(&rbio->bio_list); +- struct bio *next; ++ struct bio *extra; + + if (rbio->generic_bio_cnt) + btrfs_bio_counter_sub(rbio->fs_info, rbio->generic_bio_cnt); + +- free_raid_bio(rbio); ++ /* ++ * At this moment, rbio->bio_list is empty, however since rbio does not ++ * always have RBIO_RMW_LOCKED_BIT set and rbio is still linked on the ++ * hash list, rbio may be merged with others so that rbio->bio_list ++ * becomes non-empty. ++ * Once unlock_stripe() is done, rbio->bio_list will not be updated any ++ * more and we can call bio_endio() on all queued bios. ++ */ ++ unlock_stripe(rbio); ++ extra = bio_list_get(&rbio->bio_list); ++ __free_raid_bio(rbio); + +- while (cur) { +- next = cur->bi_next; +- cur->bi_next = NULL; +- cur->bi_status = err; +- bio_endio(cur); +- cur = next; +- } ++ rbio_endio_bio_list(cur, err); ++ if (extra) ++ rbio_endio_bio_list(extra, err); + } + + /* +@@ -2159,11 +2172,21 @@ int raid56_parity_recover(struct btrfs_fs_info *fs_info, struct bio *bio, + } + + /* +- * reconstruct from the q stripe if they are +- * asking for mirror 3 ++ * Loop retry: ++ * for 'mirror == 2', reconstruct from all other stripes. ++ * for 'mirror_num > 2', select a stripe to fail on every retry. + */ +- if (mirror_num == 3) +- rbio->failb = rbio->real_stripes - 2; ++ if (mirror_num > 2) { ++ /* ++ * 'mirror == 3' is to fail the p stripe and ++ * reconstruct from the q stripe. 'mirror > 3' is to ++ * fail a data stripe and reconstruct from p+q stripe. ++ */ ++ rbio->failb = rbio->real_stripes - (mirror_num - 1); ++ ASSERT(rbio->failb > 0); ++ if (rbio->failb <= rbio->faila) ++ rbio->failb--; ++ } + + ret = lock_stripe_add(rbio); + +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index 71b3cd634436..b983e7fb200b 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -5101,7 +5101,14 @@ int btrfs_num_copies(struct btrfs_fs_info *fs_info, u64 logical, u64 len) + else if (map->type & BTRFS_BLOCK_GROUP_RAID5) + ret = 2; + else if (map->type & BTRFS_BLOCK_GROUP_RAID6) +- ret = 3; ++ /* ++ * There could be two corrupted data stripes, we need ++ * to loop retry in order to rebuild the correct data. ++ * ++ * Fail a stripe at a time on every retry except the ++ * stripe under reconstruction. ++ */ ++ ret = map->num_stripes; + else + ret = 1; + free_extent_map(em); +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 35dc5bf01ee2..7fd39ea6e22e 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -6331,9 +6331,7 @@ CIFSSMBSetEA(const unsigned int xid, struct cifs_tcon *tcon, + pSMB->InformationLevel = + cpu_to_le16(SMB_SET_FILE_EA); + +- parm_data = +- (struct fealist *) (((char *) &pSMB->hdr.Protocol) + +- offset); ++ parm_data = (void *)pSMB + offsetof(struct smb_hdr, Protocol) + offset; + pSMB->ParameterOffset = cpu_to_le16(param_offset); + pSMB->DataOffset = cpu_to_le16(offset); + pSMB->SetupCount = 1; +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 81ba6e0d88d8..925844343038 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -684,6 +684,9 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + goto mknod_out; + } + ++ if (!S_ISCHR(mode) && !S_ISBLK(mode)) ++ goto mknod_out; ++ + if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_UNX_EMUL)) + goto mknod_out; + +@@ -692,10 +695,8 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + + buf = kmalloc(sizeof(FILE_ALL_INFO), GFP_KERNEL); + if (buf == NULL) { +- kfree(full_path); + rc = -ENOMEM; +- free_xid(xid); +- return rc; ++ goto mknod_out; + } + + if (backup_cred(cifs_sb)) +@@ -742,7 +743,7 @@ int cifs_mknod(struct inode *inode, struct dentry *direntry, umode_t mode, + pdev->minor = cpu_to_le64(MINOR(device_number)); + rc = tcon->ses->server->ops->sync_write(xid, &fid, &io_parms, + &bytes_written, iov, 1); +- } /* else if (S_ISFIFO) */ ++ } + tcon->ses->server->ops->close(xid, tcon, &fid); + d_drop(direntry); + +diff --git a/fs/dax.c b/fs/dax.c +index 191306cd8b6b..ddb4981ae32e 100644 +--- a/fs/dax.c ++++ b/fs/dax.c +@@ -630,8 +630,8 @@ static void dax_mapping_entry_mkclean(struct address_space *mapping, + set_pmd_at(vma->vm_mm, address, pmdp, pmd); + mmu_notifier_invalidate_range(vma->vm_mm, start, end); + unlock_pmd: +- spin_unlock(ptl); + #endif ++ spin_unlock(ptl); + } else { + if (pfn != pte_pfn(*ptep)) + goto unlock_pte; +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index d5021ba69e7a..e5673a9b2619 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -696,7 +696,12 @@ static void move_data_block(struct inode *inode, block_t bidx, + fio.op = REQ_OP_WRITE; + fio.op_flags = REQ_SYNC; + fio.new_blkaddr = newaddr; +- f2fs_submit_page_write(&fio); ++ err = f2fs_submit_page_write(&fio); ++ if (err) { ++ if (PageWriteback(fio.encrypted_page)) ++ end_page_writeback(fio.encrypted_page); ++ goto put_page_out; ++ } + + f2fs_update_iostat(fio.sbi, FS_GC_DATA_IO, F2FS_BLKSIZE); + +diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c +index e96c6b05e43e..3c96f4bdc549 100644 +--- a/fs/jffs2/fs.c ++++ b/fs/jffs2/fs.c +@@ -362,7 +362,6 @@ struct inode *jffs2_iget(struct super_block *sb, unsigned long ino) + ret = -EIO; + error: + mutex_unlock(&f->sem); +- jffs2_do_clear_inode(c, f); + iget_failed(inode); + return ERR_PTR(ret); + } +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 2241d52710f7..ae8f43d270d6 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -1885,7 +1885,7 @@ static int nfs4_open_reclaim(struct nfs4_state_owner *sp, struct nfs4_state *sta + return ret; + } + +-static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, int err) ++static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct nfs4_state *state, const nfs4_stateid *stateid, struct file_lock *fl, int err) + { + switch (err) { + default: +@@ -1932,7 +1932,11 @@ static int nfs4_handle_delegation_recall_error(struct nfs_server *server, struct + return -EAGAIN; + case -ENOMEM: + case -NFS4ERR_DENIED: +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */ ++ if (fl) { ++ struct nfs4_lock_state *lsp = fl->fl_u.nfs4_fl.owner; ++ if (lsp) ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags); ++ } + return 0; + } + return err; +@@ -1968,7 +1972,7 @@ int nfs4_open_delegation_recall(struct nfs_open_context *ctx, + err = nfs4_open_recover_helper(opendata, FMODE_READ); + } + nfs4_opendata_put(opendata); +- return nfs4_handle_delegation_recall_error(server, state, stateid, err); ++ return nfs4_handle_delegation_recall_error(server, state, stateid, NULL, err); + } + + static void nfs4_open_confirm_prepare(struct rpc_task *task, void *calldata) +@@ -6595,7 +6599,7 @@ int nfs4_lock_delegation_recall(struct file_lock *fl, struct nfs4_state *state, + if (err != 0) + return err; + err = _nfs4_do_setlk(state, F_SETLK, fl, NFS_LOCK_NEW); +- return nfs4_handle_delegation_recall_error(server, state, stateid, err); ++ return nfs4_handle_delegation_recall_error(server, state, stateid, fl, err); + } + + struct nfs_release_lockowner_data { +diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c +index 0378e2257ca7..45873ed92057 100644 +--- a/fs/nfs/nfs4state.c ++++ b/fs/nfs/nfs4state.c +@@ -1447,6 +1447,7 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_ + struct inode *inode = state->inode; + struct nfs_inode *nfsi = NFS_I(inode); + struct file_lock *fl; ++ struct nfs4_lock_state *lsp; + int status = 0; + struct file_lock_context *flctx = inode->i_flctx; + struct list_head *list; +@@ -1487,7 +1488,9 @@ static int nfs4_reclaim_locks(struct nfs4_state *state, const struct nfs4_state_ + case -NFS4ERR_DENIED: + case -NFS4ERR_RECLAIM_BAD: + case -NFS4ERR_RECLAIM_CONFLICT: +- /* kill_proc(fl->fl_pid, SIGLOST, 1); */ ++ lsp = fl->fl_u.nfs4_fl.owner; ++ if (lsp) ++ set_bit(NFS_LOCK_LOST, &lsp->ls_flags); + status = 0; + } + spin_lock(&flctx->flc_lock); +diff --git a/fs/nfs/nfs4sysctl.c b/fs/nfs/nfs4sysctl.c +index 0d91d84e5822..c394e4447100 100644 +--- a/fs/nfs/nfs4sysctl.c ++++ b/fs/nfs/nfs4sysctl.c +@@ -32,7 +32,7 @@ static struct ctl_table nfs4_cb_sysctls[] = { + .data = &nfs_idmap_cache_timeout, + .maxlen = sizeof(int), + .mode = 0644, +- .proc_handler = proc_dointvec_jiffies, ++ .proc_handler = proc_dointvec, + }, + { } + }; +diff --git a/fs/ocfs2/acl.c b/fs/ocfs2/acl.c +index 40b5cc97f7b0..917fadca8a7b 100644 +--- a/fs/ocfs2/acl.c ++++ b/fs/ocfs2/acl.c +@@ -311,7 +311,9 @@ struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) + if (had_lock < 0) + return ERR_PTR(had_lock); + ++ down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, type, di_bh); ++ up_read(&OCFS2_I(inode)->ip_xattr_sem); + + ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); + brelse(di_bh); +@@ -330,7 +332,9 @@ int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) + if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) + return 0; + ++ down_read(&OCFS2_I(inode)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); ++ up_read(&OCFS2_I(inode)->ip_xattr_sem); + if (IS_ERR(acl) || !acl) + return PTR_ERR(acl); + ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); +@@ -361,8 +365,10 @@ int ocfs2_init_acl(handle_t *handle, + + if (!S_ISLNK(inode->i_mode)) { + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { ++ down_read(&OCFS2_I(dir)->ip_xattr_sem); + acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, + dir_bh); ++ up_read(&OCFS2_I(dir)->ip_xattr_sem); + if (IS_ERR(acl)) + return PTR_ERR(acl); + } +diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c +index 36304434eacf..e5dcea6cee5f 100644 +--- a/fs/ocfs2/journal.c ++++ b/fs/ocfs2/journal.c +@@ -666,23 +666,24 @@ static int __ocfs2_journal_access(handle_t *handle, + /* we can safely remove this assertion after testing. */ + if (!buffer_uptodate(bh)) { + mlog(ML_ERROR, "giving me a buffer that's not uptodate!\n"); +- mlog(ML_ERROR, "b_blocknr=%llu\n", +- (unsigned long long)bh->b_blocknr); ++ mlog(ML_ERROR, "b_blocknr=%llu, b_state=0x%lx\n", ++ (unsigned long long)bh->b_blocknr, bh->b_state); + + lock_buffer(bh); + /* +- * A previous attempt to write this buffer head failed. +- * Nothing we can do but to retry the write and hope for +- * the best. ++ * A previous transaction with a couple of buffer heads fail ++ * to checkpoint, so all the bhs are marked as BH_Write_EIO. ++ * For current transaction, the bh is just among those error ++ * bhs which previous transaction handle. We can't just clear ++ * its BH_Write_EIO and reuse directly, since other bhs are ++ * not written to disk yet and that will cause metadata ++ * inconsistency. So we should set fs read-only to avoid ++ * further damage. + */ + if (buffer_write_io_error(bh) && !buffer_uptodate(bh)) { +- clear_buffer_write_io_error(bh); +- set_buffer_uptodate(bh); +- } +- +- if (!buffer_uptodate(bh)) { + unlock_buffer(bh); +- return -EIO; ++ return ocfs2_error(osb->sb, "A previous attempt to " ++ "write this buffer head failed\n"); + } + unlock_buffer(bh); + } +diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c +index 80733496b22a..24ab735d91dd 100644 +--- a/fs/ocfs2/super.c ++++ b/fs/ocfs2/super.c +@@ -474,9 +474,8 @@ static int ocfs2_init_global_system_inodes(struct ocfs2_super *osb) + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num); + if (!new) { + ocfs2_release_system_inodes(osb); +- status = -EINVAL; ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL; + mlog_errno(status); +- /* FIXME: Should ERROR_RO_FS */ + mlog(ML_ERROR, "Unable to load system inode %d, " + "possibly corrupt fs?", i); + goto bail; +@@ -505,7 +504,7 @@ static int ocfs2_init_local_system_inodes(struct ocfs2_super *osb) + new = ocfs2_get_system_file_inode(osb, i, osb->slot_num); + if (!new) { + ocfs2_release_system_inodes(osb); +- status = -EINVAL; ++ status = ocfs2_is_soft_readonly(osb) ? -EROFS : -EINVAL; + mlog(ML_ERROR, "status=%d, sysfile=%d, slot=%d\n", + status, i, osb->slot_num); + goto bail; +diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c +index 5fdf269ba82e..fb0a4eec310c 100644 +--- a/fs/ocfs2/xattr.c ++++ b/fs/ocfs2/xattr.c +@@ -638,9 +638,11 @@ int ocfs2_calc_xattr_init(struct inode *dir, + si->value_len); + + if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { ++ down_read(&OCFS2_I(dir)->ip_xattr_sem); + acl_len = ocfs2_xattr_get_nolock(dir, dir_bh, + OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT, + "", NULL, 0); ++ up_read(&OCFS2_I(dir)->ip_xattr_sem); + if (acl_len > 0) { + a_size = ocfs2_xattr_entry_real_size(0, acl_len); + if (S_ISDIR(mode)) +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 9d357b2ea6cb..2ff11a693360 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -100,6 +100,8 @@ + #include "internal.h" + #include "fd.h" + ++#include "../../lib/kstrtox.h" ++ + /* NOTE: + * Implementing inode permission operations in /proc is almost + * certainly an error. Permission checks need to happen during +@@ -1908,8 +1910,33 @@ bool proc_fill_cache(struct file *file, struct dir_context *ctx, + static int dname_to_vma_addr(struct dentry *dentry, + unsigned long *start, unsigned long *end) + { +- if (sscanf(dentry->d_name.name, "%lx-%lx", start, end) != 2) ++ const char *str = dentry->d_name.name; ++ unsigned long long sval, eval; ++ unsigned int len; ++ ++ len = _parse_integer(str, 16, &sval); ++ if (len & KSTRTOX_OVERFLOW) ++ return -EINVAL; ++ if (sval != (unsigned long)sval) ++ return -EINVAL; ++ str += len; ++ ++ if (*str != '-') + return -EINVAL; ++ str++; ++ ++ len = _parse_integer(str, 16, &eval); ++ if (len & KSTRTOX_OVERFLOW) ++ return -EINVAL; ++ if (eval != (unsigned long)eval) ++ return -EINVAL; ++ str += len; ++ ++ if (*str != '\0') ++ return -EINVAL; ++ ++ *start = sval; ++ *end = eval; + + return 0; + } +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index e8a93bc8285d..d1e82761de81 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -510,6 +510,10 @@ read_kcore(struct file *file, char __user *buffer, size_t buflen, loff_t *fpos) + /* we have to zero-fill user buffer even if no read */ + if (copy_to_user(buffer, buf, tsz)) + return -EFAULT; ++ } else if (m->type == KCORE_USER) { ++ /* User page is handled prior to normal kernel page: */ ++ if (copy_to_user(buffer, (char *)start, tsz)) ++ return -EFAULT; + } else { + if (kern_addr_valid(start)) { + /* +diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c +index 0a213dcba2a1..ba3d0e0f8615 100644 +--- a/fs/ubifs/tnc.c ++++ b/fs/ubifs/tnc.c +@@ -1890,35 +1890,28 @@ static int search_dh_cookie(struct ubifs_info *c, const union ubifs_key *key, + union ubifs_key *dkey; + + for (;;) { +- if (!err) { +- err = tnc_next(c, &znode, n); +- if (err) +- goto out; +- } +- + zbr = &znode->zbranch[*n]; + dkey = &zbr->key; + + if (key_inum(c, dkey) != key_inum(c, key) || + key_type(c, dkey) != key_type(c, key)) { +- err = -ENOENT; +- goto out; ++ return -ENOENT; + } + + err = tnc_read_hashed_node(c, zbr, dent); + if (err) +- goto out; ++ return err; + + if (key_hash(c, key) == key_hash(c, dkey) && + le32_to_cpu(dent->cookie) == cookie) { + *zn = znode; +- goto out; ++ return 0; + } +- } +- +-out: + +- return err; ++ err = tnc_next(c, &znode, n); ++ if (err) ++ return err; ++ } + } + + static int do_lookup_dh(struct ubifs_info *c, const union ubifs_key *key, +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 77b891a8f191..2142bceaeb75 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -309,6 +309,21 @@ extern void pgtable_trans_huge_deposit(struct mm_struct *mm, pmd_t *pmdp, + extern pgtable_t pgtable_trans_huge_withdraw(struct mm_struct *mm, pmd_t *pmdp); + #endif + ++#ifdef CONFIG_TRANSPARENT_HUGEPAGE ++/* ++ * This is an implementation of pmdp_establish() that is only suitable for an ++ * architecture that doesn't have hardware dirty/accessed bits. In this case we ++ * can't race with CPU which sets these bits and non-atomic aproach is fine. ++ */ ++static inline pmd_t generic_pmdp_establish(struct vm_area_struct *vma, ++ unsigned long address, pmd_t *pmdp, pmd_t pmd) ++{ ++ pmd_t old_pmd = *pmdp; ++ set_pmd_at(vma->vm_mm, address, pmdp, pmd); ++ return old_pmd; ++} ++#endif ++ + #ifndef __HAVE_ARCH_PMDP_INVALIDATE + extern void pmdp_invalidate(struct vm_area_struct *vma, unsigned long address, + pmd_t *pmdp); +diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h +index 8d3125c493b2..db461a07bf38 100644 +--- a/include/linux/cpumask.h ++++ b/include/linux/cpumask.h +@@ -165,6 +165,8 @@ static inline unsigned int cpumask_local_spread(unsigned int i, int node) + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask) + #define for_each_cpu_not(cpu, mask) \ + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask) ++#define for_each_cpu_wrap(cpu, mask, start) \ ++ for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)(start)) + #define for_each_cpu_and(cpu, mask, and) \ + for ((cpu) = 0; (cpu) < 1; (cpu)++, (void)mask, (void)and) + #else +diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h +index 2d9f80848d4b..c643cc7fefb5 100644 +--- a/include/linux/etherdevice.h ++++ b/include/linux/etherdevice.h +@@ -31,7 +31,7 @@ + #ifdef __KERNEL__ + struct device; + int eth_platform_get_mac_address(struct device *dev, u8 *mac_addr); +-unsigned char *arch_get_platform_get_mac_address(void); ++unsigned char *arch_get_platform_mac_address(void); + u32 eth_get_headlen(void *data, unsigned int max_len); + __be16 eth_type_trans(struct sk_buff *skb, struct net_device *dev); + extern const struct header_ops eth_header_ops; +diff --git a/include/linux/kcore.h b/include/linux/kcore.h +index 7ff25a808fef..80db19d3a505 100644 +--- a/include/linux/kcore.h ++++ b/include/linux/kcore.h +@@ -10,6 +10,7 @@ enum kcore_type { + KCORE_VMALLOC, + KCORE_RAM, + KCORE_VMEMMAP, ++ KCORE_USER, + KCORE_OTHER, + }; + +diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h +index 8e46c35d654b..54f346a45cd0 100644 +--- a/include/linux/netfilter/x_tables.h ++++ b/include/linux/netfilter/x_tables.h +@@ -301,6 +301,7 @@ int xt_data_to_user(void __user *dst, const void *src, + + void *xt_copy_counters_from_user(const void __user *user, unsigned int len, + struct xt_counters_info *info, bool compat); ++struct xt_counters *xt_counters_alloc(unsigned int counters); + + struct xt_table *xt_register_table(struct net *net, + const struct xt_table *table, +@@ -507,7 +508,7 @@ void xt_compat_unlock(u_int8_t af); + + int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta); + void xt_compat_flush_offsets(u_int8_t af); +-void xt_compat_init_offsets(u_int8_t af, unsigned int number); ++int xt_compat_init_offsets(u8 af, unsigned int number); + int xt_compat_calc_jump(u_int8_t af, unsigned int offset); + + int xt_compat_match_offset(const struct xt_match *match); +diff --git a/include/linux/pci.h b/include/linux/pci.h +index d16a7c037ec0..727e309baa5e 100644 +--- a/include/linux/pci.h ++++ b/include/linux/pci.h +@@ -1688,6 +1688,13 @@ static inline int pci_get_new_domain_nr(void) { return -ENOSYS; } + #define dev_is_pf(d) (false) + static inline bool pci_acs_enabled(struct pci_dev *pdev, u16 acs_flags) + { return false; } ++static inline int pci_irqd_intx_xlate(struct irq_domain *d, ++ struct device_node *node, ++ const u32 *intspec, ++ unsigned int intsize, ++ unsigned long *out_hwirq, ++ unsigned int *out_type) ++{ return -EINVAL; } + #endif /* CONFIG_PCI */ + + /* Include architecture-dependent settings and functions */ +diff --git a/include/linux/property.h b/include/linux/property.h +index 6bebee13c5e0..89d94b349912 100644 +--- a/include/linux/property.h ++++ b/include/linux/property.h +@@ -206,7 +206,7 @@ struct property_entry { + */ + + #define PROPERTY_ENTRY_INTEGER_ARRAY(_name_, _type_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = ARRAY_SIZE(_val_) * sizeof(_type_), \ + .is_array = true, \ +@@ -224,7 +224,7 @@ struct property_entry { + PROPERTY_ENTRY_INTEGER_ARRAY(_name_, u64, _val_) + + #define PROPERTY_ENTRY_STRING_ARRAY(_name_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = ARRAY_SIZE(_val_) * sizeof(const char *), \ + .is_array = true, \ +@@ -233,7 +233,7 @@ struct property_entry { + } + + #define PROPERTY_ENTRY_INTEGER(_name_, _type_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = sizeof(_type_), \ + .is_string = false, \ +@@ -250,7 +250,7 @@ struct property_entry { + PROPERTY_ENTRY_INTEGER(_name_, u64, _val_) + + #define PROPERTY_ENTRY_STRING(_name_, _val_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + .length = sizeof(_val_), \ + .is_string = true, \ +@@ -258,7 +258,7 @@ struct property_entry { + } + + #define PROPERTY_ENTRY_BOOL(_name_) \ +-{ \ ++(struct property_entry) { \ + .name = _name_, \ + } + +diff --git a/include/linux/suspend.h b/include/linux/suspend.h +index d60b0f5c38d5..8544357d92d0 100644 +--- a/include/linux/suspend.h ++++ b/include/linux/suspend.h +@@ -384,6 +384,8 @@ extern int swsusp_page_is_forbidden(struct page *); + extern void swsusp_set_page_free(struct page *); + extern void swsusp_unset_page_free(struct page *); + extern unsigned long get_safe_page(gfp_t gfp_mask); ++extern asmlinkage int swsusp_arch_suspend(void); ++extern asmlinkage int swsusp_arch_resume(void); + + extern void hibernation_set_ops(const struct platform_hibernation_ops *ops); + extern int hibernate(void); +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 6533aa64f009..08f3d8699a27 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -866,6 +866,7 @@ struct ib_mr_status { + __attribute_const__ enum ib_rate mult_to_ib_rate(int mult); + + enum rdma_ah_attr_type { ++ RDMA_AH_ATTR_TYPE_UNDEFINED, + RDMA_AH_ATTR_TYPE_IB, + RDMA_AH_ATTR_TYPE_ROCE, + RDMA_AH_ATTR_TYPE_OPA, +@@ -3762,18 +3763,24 @@ static inline void rdma_ah_set_grh(struct rdma_ah_attr *attr, + grh->traffic_class = traffic_class; + } + +-/*Get AH type */ ++/** ++ * rdma_ah_find_type - Return address handle type. ++ * ++ * @dev: Device to be checked ++ * @port_num: Port number ++ */ + static inline enum rdma_ah_attr_type rdma_ah_find_type(struct ib_device *dev, +- u32 port_num) ++ u8 port_num) + { +- if ((rdma_protocol_roce(dev, port_num)) || +- (rdma_protocol_iwarp(dev, port_num))) ++ if (rdma_protocol_roce(dev, port_num)) + return RDMA_AH_ATTR_TYPE_ROCE; +- else if ((rdma_protocol_ib(dev, port_num)) && +- (rdma_cap_opa_ah(dev, port_num))) +- return RDMA_AH_ATTR_TYPE_OPA; +- else ++ if (rdma_protocol_ib(dev, port_num)) { ++ if (rdma_cap_opa_ah(dev, port_num)) ++ return RDMA_AH_ATTR_TYPE_OPA; + return RDMA_AH_ATTR_TYPE_IB; ++ } ++ ++ return RDMA_AH_ATTR_TYPE_UNDEFINED; + } + + /** +diff --git a/include/trace/events/timer.h b/include/trace/events/timer.h +index 16e305e69f34..c6f728037c53 100644 +--- a/include/trace/events/timer.h ++++ b/include/trace/events/timer.h +@@ -136,6 +136,20 @@ DEFINE_EVENT(timer_class, timer_cancel, + TP_ARGS(timer) + ); + ++#define decode_clockid(type) \ ++ __print_symbolic(type, \ ++ { CLOCK_REALTIME, "CLOCK_REALTIME" }, \ ++ { CLOCK_MONOTONIC, "CLOCK_MONOTONIC" }, \ ++ { CLOCK_BOOTTIME, "CLOCK_BOOTTIME" }, \ ++ { CLOCK_TAI, "CLOCK_TAI" }) ++ ++#define decode_hrtimer_mode(mode) \ ++ __print_symbolic(mode, \ ++ { HRTIMER_MODE_ABS, "ABS" }, \ ++ { HRTIMER_MODE_REL, "REL" }, \ ++ { HRTIMER_MODE_ABS_PINNED, "ABS|PINNED" }, \ ++ { HRTIMER_MODE_REL_PINNED, "REL|PINNED" }) ++ + /** + * hrtimer_init - called when the hrtimer is initialized + * @hrtimer: pointer to struct hrtimer +@@ -162,10 +176,8 @@ TRACE_EVENT(hrtimer_init, + ), + + TP_printk("hrtimer=%p clockid=%s mode=%s", __entry->hrtimer, +- __entry->clockid == CLOCK_REALTIME ? +- "CLOCK_REALTIME" : "CLOCK_MONOTONIC", +- __entry->mode == HRTIMER_MODE_ABS ? +- "HRTIMER_MODE_ABS" : "HRTIMER_MODE_REL") ++ decode_clockid(__entry->clockid), ++ decode_hrtimer_mode(__entry->mode)) + ); + + /** +diff --git a/kernel/bpf/sockmap.c b/kernel/bpf/sockmap.c +index 1890be7ea9cd..53a4787c08d8 100644 +--- a/kernel/bpf/sockmap.c ++++ b/kernel/bpf/sockmap.c +@@ -601,11 +601,6 @@ static void sock_map_free(struct bpf_map *map) + } + rcu_read_unlock(); + +- if (stab->bpf_verdict) +- bpf_prog_put(stab->bpf_verdict); +- if (stab->bpf_parse) +- bpf_prog_put(stab->bpf_parse); +- + sock_map_remove_complete(stab); + } + +@@ -877,6 +872,19 @@ static int sock_map_update_elem(struct bpf_map *map, + return err; + } + ++static void sock_map_release(struct bpf_map *map, struct file *map_file) ++{ ++ struct bpf_stab *stab = container_of(map, struct bpf_stab, map); ++ struct bpf_prog *orig; ++ ++ orig = xchg(&stab->bpf_parse, NULL); ++ if (orig) ++ bpf_prog_put(orig); ++ orig = xchg(&stab->bpf_verdict, NULL); ++ if (orig) ++ bpf_prog_put(orig); ++} ++ + const struct bpf_map_ops sock_map_ops = { + .map_alloc = sock_map_alloc, + .map_free = sock_map_free, +@@ -884,6 +892,7 @@ const struct bpf_map_ops sock_map_ops = { + .map_get_next_key = sock_map_get_next_key, + .map_update_elem = sock_map_update_elem, + .map_delete_elem = sock_map_delete_elem, ++ .map_release = sock_map_release, + }; + + BPF_CALL_4(bpf_sock_map_update, struct bpf_sock_ops_kern *, bpf_sock, +diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c +index 1b2be63c8528..fa4f47a0a631 100644 +--- a/kernel/events/callchain.c ++++ b/kernel/events/callchain.c +@@ -119,19 +119,22 @@ int get_callchain_buffers(int event_max_stack) + goto exit; + } + ++ /* ++ * If requesting per event more than the global cap, ++ * return a different error to help userspace figure ++ * this out. ++ * ++ * And also do it here so that we have &callchain_mutex held. ++ */ ++ if (event_max_stack > sysctl_perf_event_max_stack) { ++ err = -EOVERFLOW; ++ goto exit; ++ } ++ + if (count > 1) { + /* If the allocation failed, give up */ + if (!callchain_cpus_entries) + err = -ENOMEM; +- /* +- * If requesting per event more than the global cap, +- * return a different error to help userspace figure +- * this out. +- * +- * And also do it here so that we have &callchain_mutex held. +- */ +- if (event_max_stack > sysctl_perf_event_max_stack) +- err = -EOVERFLOW; + goto exit; + } + +diff --git a/kernel/events/core.c b/kernel/events/core.c +index e9b0beca830f..cb8274d7824f 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -9750,9 +9750,9 @@ static int perf_copy_attr(struct perf_event_attr __user *uattr, + * __u16 sample size limit. + */ + if (attr->sample_stack_user >= USHRT_MAX) +- ret = -EINVAL; ++ return -EINVAL; + else if (!IS_ALIGNED(attr->sample_stack_user, sizeof(u64))) +- ret = -EINVAL; ++ return -EINVAL; + } + + if (attr->sample_type & PERF_SAMPLE_REGS_INTR) +diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c +index 294294c71ba4..50dc42aeaa56 100644 +--- a/kernel/locking/qspinlock.c ++++ b/kernel/locking/qspinlock.c +@@ -379,6 +379,14 @@ void queued_spin_lock_slowpath(struct qspinlock *lock, u32 val) + tail = encode_tail(smp_processor_id(), idx); + + node += idx; ++ ++ /* ++ * Ensure that we increment the head node->count before initialising ++ * the actual node. If the compiler is kind enough to reorder these ++ * stores, then an IRQ could overwrite our assignments. ++ */ ++ barrier(); ++ + node->locked = 0; + node->next = NULL; + pv_init_node(node); +diff --git a/kernel/power/power.h b/kernel/power/power.h +index f29cd178df90..9e58bdc8a562 100644 +--- a/kernel/power/power.h ++++ b/kernel/power/power.h +@@ -104,9 +104,6 @@ extern int in_suspend; + extern dev_t swsusp_resume_device; + extern sector_t swsusp_resume_block; + +-extern asmlinkage int swsusp_arch_suspend(void); +-extern asmlinkage int swsusp_arch_resume(void); +- + extern int create_basic_memory_bitmaps(void); + extern void free_basic_memory_bitmaps(void); + extern int hibernate_preallocate_memory(void); +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index ec09ce9a6012..639321bf2e39 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -326,6 +326,17 @@ static int alarmtimer_resume(struct device *dev) + } + #endif + ++static void ++__alarm_init(struct alarm *alarm, enum alarmtimer_type type, ++ enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) ++{ ++ timerqueue_init(&alarm->node); ++ alarm->timer.function = alarmtimer_fired; ++ alarm->function = function; ++ alarm->type = type; ++ alarm->state = ALARMTIMER_STATE_INACTIVE; ++} ++ + /** + * alarm_init - Initialize an alarm structure + * @alarm: ptr to alarm to be initialized +@@ -335,13 +346,9 @@ static int alarmtimer_resume(struct device *dev) + void alarm_init(struct alarm *alarm, enum alarmtimer_type type, + enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) + { +- timerqueue_init(&alarm->node); + hrtimer_init(&alarm->timer, alarm_bases[type].base_clockid, +- HRTIMER_MODE_ABS); +- alarm->timer.function = alarmtimer_fired; +- alarm->function = function; +- alarm->type = type; +- alarm->state = ALARMTIMER_STATE_INACTIVE; ++ HRTIMER_MODE_ABS); ++ __alarm_init(alarm, type, function); + } + EXPORT_SYMBOL_GPL(alarm_init); + +@@ -719,6 +726,8 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp, + + __set_current_state(TASK_RUNNING); + ++ destroy_hrtimer_on_stack(&alarm->timer); ++ + if (!alarm->data) + return 0; + +@@ -740,6 +749,15 @@ static int alarmtimer_do_nsleep(struct alarm *alarm, ktime_t absexp, + return -ERESTART_RESTARTBLOCK; + } + ++static void ++alarm_init_on_stack(struct alarm *alarm, enum alarmtimer_type type, ++ enum alarmtimer_restart (*function)(struct alarm *, ktime_t)) ++{ ++ hrtimer_init_on_stack(&alarm->timer, alarm_bases[type].base_clockid, ++ HRTIMER_MODE_ABS); ++ __alarm_init(alarm, type, function); ++} ++ + /** + * alarm_timer_nsleep_restart - restartblock alarmtimer nsleep + * @restart: ptr to restart block +@@ -752,7 +770,7 @@ static long __sched alarm_timer_nsleep_restart(struct restart_block *restart) + ktime_t exp = restart->nanosleep.expires; + struct alarm alarm; + +- alarm_init(&alarm, type, alarmtimer_nsleep_wakeup); ++ alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup); + + return alarmtimer_do_nsleep(&alarm, exp, type); + } +@@ -784,7 +802,7 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, + if (!capable(CAP_WAKE_ALARM)) + return -EPERM; + +- alarm_init(&alarm, type, alarmtimer_nsleep_wakeup); ++ alarm_init_on_stack(&alarm, type, alarmtimer_nsleep_wakeup); + + exp = timespec64_to_ktime(*tsreq); + /* Convert (if necessary) to absolute time */ +diff --git a/lib/test_bpf.c b/lib/test_bpf.c +index 6fbb73f3f531..64701b4c9900 100644 +--- a/lib/test_bpf.c ++++ b/lib/test_bpf.c +@@ -83,6 +83,7 @@ struct bpf_test { + __u32 result; + } test[MAX_SUBTESTS]; + int (*fill_helper)(struct bpf_test *self); ++ int expected_errcode; /* used when FLAG_EXPECTED_FAIL is set in the aux */ + __u8 frag_data[MAX_DATA]; + int stack_depth; /* for eBPF only, since tests don't call verifier */ + }; +@@ -1987,7 +1988,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: div_k_0", +@@ -1997,7 +2000,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: unknown insn", +@@ -2008,7 +2013,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: out of range spill/fill", +@@ -2018,7 +2025,9 @@ static struct bpf_test tests[] = { + }, + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, +- { } ++ { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "JUMPS + HOLES", +@@ -2110,6 +2119,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { + "check: LDX + RET X", +@@ -2120,6 +2131,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { /* Mainly checking JIT here. */ + "M[]: alt STX + LDX", +@@ -2294,6 +2307,8 @@ static struct bpf_test tests[] = { + CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, + { }, + { }, ++ .fill_helper = NULL, ++ .expected_errcode = -EINVAL, + }, + { /* Passes checker but fails during runtime. */ + "LD [SKF_AD_OFF-1]", +@@ -5356,6 +5371,7 @@ static struct bpf_test tests[] = { + { }, + { }, + .fill_helper = bpf_fill_maxinsns4, ++ .expected_errcode = -EINVAL, + }, + { /* Mainly checking JIT here. */ + "BPF_MAXINSNS: Very long jump", +@@ -5411,10 +5427,15 @@ static struct bpf_test tests[] = { + { + "BPF_MAXINSNS: Jump, gap, jump, ...", + { }, ++#ifdef CONFIG_BPF_JIT_ALWAYS_ON ++ CLASSIC | FLAG_NO_DATA | FLAG_EXPECTED_FAIL, ++#else + CLASSIC | FLAG_NO_DATA, ++#endif + { }, + { { 0, 0xababcbac } }, + .fill_helper = bpf_fill_maxinsns11, ++ .expected_errcode = -ENOTSUPP, + }, + { + "BPF_MAXINSNS: ld_abs+get_processor_id", +@@ -6193,7 +6214,7 @@ static struct bpf_prog *generate_filter(int which, int *err) + + *err = bpf_prog_create(&fp, &fprog); + if (tests[which].aux & FLAG_EXPECTED_FAIL) { +- if (*err == -EINVAL) { ++ if (*err == tests[which].expected_errcode) { + pr_cont("PASS\n"); + /* Verifier rejected filter as expected. */ + *err = 0; +diff --git a/mm/fadvise.c b/mm/fadvise.c +index ec70d6e4b86d..767887f5f3bf 100644 +--- a/mm/fadvise.c ++++ b/mm/fadvise.c +@@ -127,7 +127,15 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice) + */ + start_index = (offset+(PAGE_SIZE-1)) >> PAGE_SHIFT; + end_index = (endbyte >> PAGE_SHIFT); +- if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK) { ++ /* ++ * The page at end_index will be inclusively discarded according ++ * by invalidate_mapping_pages(), so subtracting 1 from ++ * end_index means we will skip the last page. But if endbyte ++ * is page aligned or is at the end of file, we should not skip ++ * that page - discarding the last page is safe enough. ++ */ ++ if ((endbyte & ~PAGE_MASK) != ~PAGE_MASK && ++ endbyte != inode->i_size - 1) { + /* First page is tricky as 0 - 1 = -1, but pgoff_t + * is unsigned, so the end_index >= start_index + * check below would be true and we'll discard the whole +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 2fe26634e1a2..29221602d802 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -1679,10 +1679,14 @@ static unsigned int khugepaged_scan_mm_slot(unsigned int pages, + spin_unlock(&khugepaged_mm_lock); + + mm = mm_slot->mm; +- down_read(&mm->mmap_sem); +- if (unlikely(khugepaged_test_exit(mm))) +- vma = NULL; +- else ++ /* ++ * Don't wait for semaphore (to avoid long wait times). Just move to ++ * the next mm on the list. ++ */ ++ vma = NULL; ++ if (unlikely(!down_read_trylock(&mm->mmap_sem))) ++ goto breakouterloop_mmap_sem; ++ if (likely(!khugepaged_test_exit(mm))) + vma = find_vma(mm, khugepaged_scan.address); + + progress++; +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index a2af6d58a68f..2d3077ce50cd 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -1262,6 +1262,7 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + unsigned long maxnode) + { + unsigned long k; ++ unsigned long t; + unsigned long nlongs; + unsigned long endmask; + +@@ -1278,13 +1279,19 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + else + endmask = (1UL << (maxnode % BITS_PER_LONG)) - 1; + +- /* When the user specified more nodes than supported just check +- if the non supported part is all zero. */ ++ /* ++ * When the user specified more nodes than supported just check ++ * if the non supported part is all zero. ++ * ++ * If maxnode have more longs than MAX_NUMNODES, check ++ * the bits in that area first. And then go through to ++ * check the rest bits which equal or bigger than MAX_NUMNODES. ++ * Otherwise, just check bits [MAX_NUMNODES, maxnode). ++ */ + if (nlongs > BITS_TO_LONGS(MAX_NUMNODES)) { + if (nlongs > PAGE_SIZE/sizeof(long)) + return -EINVAL; + for (k = BITS_TO_LONGS(MAX_NUMNODES); k < nlongs; k++) { +- unsigned long t; + if (get_user(t, nmask + k)) + return -EFAULT; + if (k == nlongs - 1) { +@@ -1297,6 +1304,16 @@ static int get_nodes(nodemask_t *nodes, const unsigned long __user *nmask, + endmask = ~0UL; + } + ++ if (maxnode > MAX_NUMNODES && MAX_NUMNODES % BITS_PER_LONG != 0) { ++ unsigned long valid_mask = endmask; ++ ++ valid_mask &= ~((1UL << (MAX_NUMNODES % BITS_PER_LONG)) - 1); ++ if (get_user(t, nmask + nlongs - 1)) ++ return -EFAULT; ++ if (t & valid_mask) ++ return -EINVAL; ++ } ++ + if (copy_from_user(nodes_addr(*nodes), nmask, nlongs*sizeof(unsigned long))) + return -EFAULT; + nodes_addr(*nodes)[nlongs-1] &= endmask; +@@ -1423,10 +1440,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, + goto out_put; + } + +- if (!nodes_subset(*new, node_states[N_MEMORY])) { +- err = -EINVAL; ++ task_nodes = cpuset_mems_allowed(current); ++ nodes_and(*new, *new, task_nodes); ++ if (nodes_empty(*new)) ++ goto out_put; ++ ++ nodes_and(*new, *new, node_states[N_MEMORY]); ++ if (nodes_empty(*new)) + goto out_put; +- } + + err = security_task_movememory(task); + if (err) +diff --git a/mm/vmscan.c b/mm/vmscan.c +index a8a3729bfaa9..b3f5e337b64a 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1436,14 +1436,24 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode) + + if (PageDirty(page)) { + struct address_space *mapping; ++ bool migrate_dirty; + + /* + * Only pages without mappings or that have a + * ->migratepage callback are possible to migrate +- * without blocking ++ * without blocking. However, we can be racing with ++ * truncation so it's necessary to lock the page ++ * to stabilise the mapping as truncation holds ++ * the page lock until after the page is removed ++ * from the page cache. + */ ++ if (!trylock_page(page)) ++ return ret; ++ + mapping = page_mapping(page); +- if (mapping && !mapping->a_ops->migratepage) ++ migrate_dirty = mapping && mapping->a_ops->migratepage; ++ unlock_page(page); ++ if (!migrate_dirty) + return ret; + } + } +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 16eb99458df4..014a73b46064 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1819,10 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info, + { + unsigned int size = info->entries_size; + const void *entries = info->entries; ++ int ret; + + newinfo->entries_size = size; + +- xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries); ++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries); ++ if (ret) ++ return ret; ++ + return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, + entries, newinfo); + } +@@ -2257,7 +2261,9 @@ static int compat_do_replace(struct net *net, void __user *user, + + xt_compat_lock(NFPROTO_BRIDGE); + +- xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); ++ ret = xt_compat_init_offsets(NFPROTO_BRIDGE, tmp.nentries); ++ if (ret < 0) ++ goto out_unlock; + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); + if (ret < 0) + goto out_unlock; +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c +index aa4c3b7f7da4..356ae7da4f16 100644 +--- a/net/ipv4/netfilter/arp_tables.c ++++ b/net/ipv4/netfilter/arp_tables.c +@@ -768,7 +768,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(NFPROTO_ARP, info->number); ++ ret = xt_compat_init_offsets(NFPROTO_ARP, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -883,7 +885,7 @@ static int __do_replace(struct net *net, const char *name, + struct arpt_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1157,7 +1159,7 @@ static int translate_compat_table(struct xt_table_info **pinfo, + struct compat_arpt_entry *iter0; + struct arpt_replace repl; + unsigned int size; +- int ret = 0; ++ int ret; + + info = *pinfo; + entry0 = *pentry0; +@@ -1166,7 +1168,9 @@ static int translate_compat_table(struct xt_table_info **pinfo, + + j = 0; + xt_compat_lock(NFPROTO_ARP); +- xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries); ++ ret = xt_compat_init_offsets(NFPROTO_ARP, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index cadb82a906b8..1a925f2394ad 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -931,7 +931,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(AF_INET, info->number); ++ ret = xt_compat_init_offsets(AF_INET, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -1044,7 +1046,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + struct ipt_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1407,7 +1409,9 @@ translate_compat_table(struct net *net, + + j = 0; + xt_compat_lock(AF_INET); +- xt_compat_init_offsets(AF_INET, compatr->num_entries); ++ ret = xt_compat_init_offsets(AF_INET, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv4/tcp_nv.c b/net/ipv4/tcp_nv.c +index 125fc1450b01..09f8773fd769 100644 +--- a/net/ipv4/tcp_nv.c ++++ b/net/ipv4/tcp_nv.c +@@ -327,7 +327,7 @@ static void tcpnv_acked(struct sock *sk, const struct ack_sample *sample) + */ + cwnd_by_slope = (u32) + div64_u64(((u64)ca->nv_rtt_max_rate) * ca->nv_min_rtt, +- (u64)(80000 * tp->mss_cache)); ++ 80000ULL * tp->mss_cache); + max_win = cwnd_by_slope + nv_pad; + + /* If cwnd > max_win, decrease cwnd +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index a0a31972fc75..c5fe42e6b7f7 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -949,7 +949,9 @@ static int compat_table_info(const struct xt_table_info *info, + memcpy(newinfo, info, offsetof(struct xt_table_info, entries)); + newinfo->initial_entries = 0; + loc_cpu_entry = info->entries; +- xt_compat_init_offsets(AF_INET6, info->number); ++ ret = xt_compat_init_offsets(AF_INET6, info->number); ++ if (ret) ++ return ret; + xt_entry_foreach(iter, loc_cpu_entry, info->size) { + ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo); + if (ret != 0) +@@ -1063,7 +1065,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks, + struct ip6t_entry *iter; + + ret = 0; +- counters = vzalloc(num_counters * sizeof(struct xt_counters)); ++ counters = xt_counters_alloc(num_counters); + if (!counters) { + ret = -ENOMEM; + goto out; +@@ -1415,7 +1417,7 @@ translate_compat_table(struct net *net, + struct compat_ip6t_entry *iter0; + struct ip6t_replace repl; + unsigned int size; +- int ret = 0; ++ int ret; + + info = *pinfo; + entry0 = *pentry0; +@@ -1424,7 +1426,9 @@ translate_compat_table(struct net *net, + + j = 0; + xt_compat_lock(AF_INET6); +- xt_compat_init_offsets(AF_INET6, compatr->num_entries); ++ ret = xt_compat_init_offsets(AF_INET6, compatr->num_entries); ++ if (ret) ++ goto out_unlock; + /* Walk through entries, checking offsets. */ + xt_entry_foreach(iter0, entry0, compatr->size) { + ret = check_compat_entry_size_and_hooks(iter0, info, &size, +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index b263bf3a19f7..64ec23388450 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -230,7 +230,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + + if ((unsigned int)end > IPV6_MAXPLEN) { + pr_debug("offset is too large.\n"); +- return -1; ++ return -EINVAL; + } + + ecn = ip6_frag_ecn(ipv6_hdr(skb)); +@@ -263,7 +263,8 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + * this case. -DaveM + */ + pr_debug("end of fragment not rounded to 8 bytes.\n"); +- return -1; ++ inet_frag_kill(&fq->q, &nf_frags); ++ return -EPROTO; + } + if (end > fq->q.len) { + /* Some bits beyond end -> corruption. */ +@@ -357,7 +358,7 @@ static int nf_ct_frag6_queue(struct frag_queue *fq, struct sk_buff *skb, + discard_fq: + inet_frag_kill(&fq->q, &nf_frags); + err: +- return -1; ++ return -EINVAL; + } + + /* +@@ -566,6 +567,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff) + + int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + { ++ u16 savethdr = skb->transport_header; + struct net_device *dev = skb->dev; + int fhoff, nhoff, ret; + struct frag_hdr *fhdr; +@@ -599,8 +601,12 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + + spin_lock_bh(&fq->q.lock); + +- if (nf_ct_frag6_queue(fq, skb, fhdr, nhoff) < 0) { +- ret = -EINVAL; ++ ret = nf_ct_frag6_queue(fq, skb, fhdr, nhoff); ++ if (ret < 0) { ++ if (ret == -EPROTO) { ++ skb->transport_header = savethdr; ++ ret = 0; ++ } + goto out_unlock; + } + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index a450a1c8804b..8e054c63b54e 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -40,6 +40,7 @@ MODULE_AUTHOR("Harald Welte "); + MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module"); + + #define XT_PCPU_BLOCK_SIZE 4096 ++#define XT_MAX_TABLE_SIZE (512 * 1024 * 1024) + + struct compat_delta { + unsigned int offset; /* offset in kernel */ +@@ -554,14 +555,8 @@ int xt_compat_add_offset(u_int8_t af, unsigned int offset, int delta) + { + struct xt_af *xp = &xt[af]; + +- if (!xp->compat_tab) { +- if (!xp->number) +- return -EINVAL; +- xp->compat_tab = vmalloc(sizeof(struct compat_delta) * xp->number); +- if (!xp->compat_tab) +- return -ENOMEM; +- xp->cur = 0; +- } ++ if (WARN_ON(!xp->compat_tab)) ++ return -ENOMEM; + + if (xp->cur >= xp->number) + return -EINVAL; +@@ -604,10 +599,28 @@ int xt_compat_calc_jump(u_int8_t af, unsigned int offset) + } + EXPORT_SYMBOL_GPL(xt_compat_calc_jump); + +-void xt_compat_init_offsets(u_int8_t af, unsigned int number) ++int xt_compat_init_offsets(u8 af, unsigned int number) + { ++ size_t mem; ++ ++ if (!number || number > (INT_MAX / sizeof(struct compat_delta))) ++ return -EINVAL; ++ ++ if (WARN_ON(xt[af].compat_tab)) ++ return -EINVAL; ++ ++ mem = sizeof(struct compat_delta) * number; ++ if (mem > XT_MAX_TABLE_SIZE) ++ return -ENOMEM; ++ ++ xt[af].compat_tab = vmalloc(mem); ++ if (!xt[af].compat_tab) ++ return -ENOMEM; ++ + xt[af].number = number; + xt[af].cur = 0; ++ ++ return 0; + } + EXPORT_SYMBOL(xt_compat_init_offsets); + +@@ -806,6 +819,9 @@ EXPORT_SYMBOL(xt_check_entry_offsets); + */ + unsigned int *xt_alloc_entry_offsets(unsigned int size) + { ++ if (size > XT_MAX_TABLE_SIZE / sizeof(unsigned int)) ++ return NULL; ++ + return kvmalloc_array(size, sizeof(unsigned int), GFP_KERNEL | __GFP_ZERO); + + } +@@ -1031,7 +1047,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size) + struct xt_table_info *info = NULL; + size_t sz = sizeof(*info) + size; + +- if (sz < sizeof(*info)) ++ if (sz < sizeof(*info) || sz >= XT_MAX_TABLE_SIZE) + return NULL; + + /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */ +@@ -1186,6 +1202,21 @@ static int xt_jumpstack_alloc(struct xt_table_info *i) + return 0; + } + ++struct xt_counters *xt_counters_alloc(unsigned int counters) ++{ ++ struct xt_counters *mem; ++ ++ if (counters == 0 || counters > INT_MAX / sizeof(*mem)) ++ return NULL; ++ ++ counters *= sizeof(*mem); ++ if (counters > XT_MAX_TABLE_SIZE) ++ return NULL; ++ ++ return vzalloc(counters); ++} ++EXPORT_SYMBOL(xt_counters_alloc); ++ + struct xt_table_info * + xt_replace_table(struct xt_table *table, + unsigned int num_counters, +diff --git a/net/netfilter/xt_IDLETIMER.c b/net/netfilter/xt_IDLETIMER.c +index bb5d6a058fb7..1141f08810b6 100644 +--- a/net/netfilter/xt_IDLETIMER.c ++++ b/net/netfilter/xt_IDLETIMER.c +@@ -256,6 +256,7 @@ static struct xt_target idletimer_tg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = idletimer_tg_target, + .targetsize = sizeof(struct idletimer_tg_info), ++ .usersize = offsetof(struct idletimer_tg_info, timer), + .checkentry = idletimer_tg_checkentry, + .destroy = idletimer_tg_destroy, + .me = THIS_MODULE, +diff --git a/net/netfilter/xt_LED.c b/net/netfilter/xt_LED.c +index 0858fe17e14a..2d1c5c169a26 100644 +--- a/net/netfilter/xt_LED.c ++++ b/net/netfilter/xt_LED.c +@@ -198,6 +198,7 @@ static struct xt_target led_tg_reg __read_mostly = { + .family = NFPROTO_UNSPEC, + .target = led_tg, + .targetsize = sizeof(struct xt_led_info), ++ .usersize = offsetof(struct xt_led_info, internal_data), + .checkentry = led_tg_check, + .destroy = led_tg_destroy, + .me = THIS_MODULE, +diff --git a/net/netfilter/xt_limit.c b/net/netfilter/xt_limit.c +index d27b5f1ea619..61403b77361c 100644 +--- a/net/netfilter/xt_limit.c ++++ b/net/netfilter/xt_limit.c +@@ -193,9 +193,8 @@ static struct xt_match limit_mt_reg __read_mostly = { + .compatsize = sizeof(struct compat_xt_rateinfo), + .compat_from_user = limit_mt_compat_from_user, + .compat_to_user = limit_mt_compat_to_user, +-#else +- .usersize = offsetof(struct xt_rateinfo, prev), + #endif ++ .usersize = offsetof(struct xt_rateinfo, prev), + .me = THIS_MODULE, + }; + +diff --git a/net/netfilter/xt_nfacct.c b/net/netfilter/xt_nfacct.c +index cc0518fe598e..6f92d25590a8 100644 +--- a/net/netfilter/xt_nfacct.c ++++ b/net/netfilter/xt_nfacct.c +@@ -62,6 +62,7 @@ static struct xt_match nfacct_mt_reg __read_mostly = { + .match = nfacct_mt, + .destroy = nfacct_mt_destroy, + .matchsize = sizeof(struct xt_nfacct_match_info), ++ .usersize = offsetof(struct xt_nfacct_match_info, nfacct), + .me = THIS_MODULE, + }; + +diff --git a/net/netfilter/xt_statistic.c b/net/netfilter/xt_statistic.c +index 11de55e7a868..8710fdba2ae2 100644 +--- a/net/netfilter/xt_statistic.c ++++ b/net/netfilter/xt_statistic.c +@@ -84,6 +84,7 @@ static struct xt_match xt_statistic_mt_reg __read_mostly = { + .checkentry = statistic_mt_check, + .destroy = statistic_mt_destroy, + .matchsize = sizeof(struct xt_statistic_info), ++ .usersize = offsetof(struct xt_statistic_info, master), + .me = THIS_MODULE, + }; + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index d558e882ca0c..285f8797c26a 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -1097,6 +1097,36 @@ static int ovs_ct_commit(struct net *net, struct sw_flow_key *key, + return 0; + } + ++/* Trim the skb to the length specified by the IP/IPv6 header, ++ * removing any trailing lower-layer padding. This prepares the skb ++ * for higher-layer processing that assumes skb->len excludes padding ++ * (such as nf_ip_checksum). The caller needs to pull the skb to the ++ * network header, and ensure ip_hdr/ipv6_hdr points to valid data. ++ */ ++static int ovs_skb_network_trim(struct sk_buff *skb) ++{ ++ unsigned int len; ++ int err; ++ ++ switch (skb->protocol) { ++ case htons(ETH_P_IP): ++ len = ntohs(ip_hdr(skb)->tot_len); ++ break; ++ case htons(ETH_P_IPV6): ++ len = sizeof(struct ipv6hdr) ++ + ntohs(ipv6_hdr(skb)->payload_len); ++ break; ++ default: ++ len = skb->len; ++ } ++ ++ err = pskb_trim_rcsum(skb, len); ++ if (err) ++ kfree_skb(skb); ++ ++ return err; ++} ++ + /* Returns 0 on success, -EINPROGRESS if 'skb' is stolen, or other nonzero + * value if 'skb' is freed. + */ +@@ -1111,6 +1141,10 @@ int ovs_ct_execute(struct net *net, struct sk_buff *skb, + nh_ofs = skb_network_offset(skb); + skb_pull_rcsum(skb, nh_ofs); + ++ err = ovs_skb_network_trim(skb); ++ if (err) ++ return err; ++ + if (key->ip.frag != OVS_FRAG_TYPE_NONE) { + err = handle_fragments(net, key, info->zone.id, skb); + if (err) +diff --git a/net/rds/ib.c b/net/rds/ib.c +index a0954ace3774..c21eb4850b9d 100644 +--- a/net/rds/ib.c ++++ b/net/rds/ib.c +@@ -346,7 +346,8 @@ static int rds_ib_laddr_check(struct net *net, __be32 addr) + /* Create a CMA ID and try to bind it. This catches both + * IB and iWARP capable NICs. + */ +- cm_id = rdma_create_id(&init_net, NULL, NULL, RDMA_PS_TCP, IB_QPT_RC); ++ cm_id = rdma_create_id(&init_net, rds_rdma_cm_event_handler, ++ NULL, RDMA_PS_TCP, IB_QPT_RC); + if (IS_ERR(cm_id)) + return PTR_ERR(cm_id); + +diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c +index 59a51a56e7c8..0435c4167a1a 100644 +--- a/net/rxrpc/conn_event.c ++++ b/net/rxrpc/conn_event.c +@@ -404,6 +404,7 @@ void rxrpc_process_connection(struct work_struct *work) + case -EKEYEXPIRED: + case -EKEYREJECTED: + goto protocol_error; ++ case -ENOMEM: + case -EAGAIN: + goto requeue_and_leave; + case -ECONNABORTED: +diff --git a/net/rxrpc/rxkad.c b/net/rxrpc/rxkad.c +index c38b3a1de56c..77cb23c7bd0a 100644 +--- a/net/rxrpc/rxkad.c ++++ b/net/rxrpc/rxkad.c +@@ -773,8 +773,7 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, + { + const struct rxrpc_key_token *token; + struct rxkad_challenge challenge; +- struct rxkad_response resp +- __attribute__((aligned(8))); /* must be aligned for crypto */ ++ struct rxkad_response *resp; + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + const char *eproto; + u32 version, nonce, min_level, abort_code; +@@ -818,26 +817,29 @@ static int rxkad_respond_to_challenge(struct rxrpc_connection *conn, + token = conn->params.key->payload.data[0]; + + /* build the response packet */ +- memset(&resp, 0, sizeof(resp)); +- +- resp.version = htonl(RXKAD_VERSION); +- resp.encrypted.epoch = htonl(conn->proto.epoch); +- resp.encrypted.cid = htonl(conn->proto.cid); +- resp.encrypted.securityIndex = htonl(conn->security_ix); +- resp.encrypted.inc_nonce = htonl(nonce + 1); +- resp.encrypted.level = htonl(conn->params.security_level); +- resp.kvno = htonl(token->kad->kvno); +- resp.ticket_len = htonl(token->kad->ticket_len); +- +- resp.encrypted.call_id[0] = htonl(conn->channels[0].call_counter); +- resp.encrypted.call_id[1] = htonl(conn->channels[1].call_counter); +- resp.encrypted.call_id[2] = htonl(conn->channels[2].call_counter); +- resp.encrypted.call_id[3] = htonl(conn->channels[3].call_counter); ++ resp = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); ++ if (!resp) ++ return -ENOMEM; ++ ++ resp->version = htonl(RXKAD_VERSION); ++ resp->encrypted.epoch = htonl(conn->proto.epoch); ++ resp->encrypted.cid = htonl(conn->proto.cid); ++ resp->encrypted.securityIndex = htonl(conn->security_ix); ++ resp->encrypted.inc_nonce = htonl(nonce + 1); ++ resp->encrypted.level = htonl(conn->params.security_level); ++ resp->kvno = htonl(token->kad->kvno); ++ resp->ticket_len = htonl(token->kad->ticket_len); ++ resp->encrypted.call_id[0] = htonl(conn->channels[0].call_counter); ++ resp->encrypted.call_id[1] = htonl(conn->channels[1].call_counter); ++ resp->encrypted.call_id[2] = htonl(conn->channels[2].call_counter); ++ resp->encrypted.call_id[3] = htonl(conn->channels[3].call_counter); + + /* calculate the response checksum and then do the encryption */ +- rxkad_calc_response_checksum(&resp); +- rxkad_encrypt_response(conn, &resp, token->kad); +- return rxkad_send_response(conn, &sp->hdr, &resp, token->kad); ++ rxkad_calc_response_checksum(resp); ++ rxkad_encrypt_response(conn, resp, token->kad); ++ ret = rxkad_send_response(conn, &sp->hdr, resp, token->kad); ++ kfree(resp); ++ return ret; + + protocol_error: + trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); +@@ -1048,8 +1050,7 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + struct sk_buff *skb, + u32 *_abort_code) + { +- struct rxkad_response response +- __attribute__((aligned(8))); /* must be aligned for crypto */ ++ struct rxkad_response *response; + struct rxrpc_skb_priv *sp = rxrpc_skb(skb); + struct rxrpc_crypt session_key; + const char *eproto; +@@ -1061,17 +1062,22 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + + _enter("{%d,%x}", conn->debug_id, key_serial(conn->server_key)); + ++ ret = -ENOMEM; ++ response = kzalloc(sizeof(struct rxkad_response), GFP_NOFS); ++ if (!response) ++ goto temporary_error; ++ + eproto = tracepoint_string("rxkad_rsp_short"); + abort_code = RXKADPACKETSHORT; + if (skb_copy_bits(skb, sizeof(struct rxrpc_wire_header), +- &response, sizeof(response)) < 0) ++ response, sizeof(*response)) < 0) + goto protocol_error; +- if (!pskb_pull(skb, sizeof(response))) ++ if (!pskb_pull(skb, sizeof(*response))) + BUG(); + +- version = ntohl(response.version); +- ticket_len = ntohl(response.ticket_len); +- kvno = ntohl(response.kvno); ++ version = ntohl(response->version); ++ ticket_len = ntohl(response->ticket_len); ++ kvno = ntohl(response->kvno); + _proto("Rx RESPONSE %%%u { v=%u kv=%u tl=%u }", + sp->hdr.serial, version, kvno, ticket_len); + +@@ -1105,31 +1111,31 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + ret = rxkad_decrypt_ticket(conn, skb, ticket, ticket_len, &session_key, + &expiry, _abort_code); + if (ret < 0) +- goto temporary_error_free; ++ goto temporary_error_free_resp; + + /* use the session key from inside the ticket to decrypt the + * response */ +- rxkad_decrypt_response(conn, &response, &session_key); ++ rxkad_decrypt_response(conn, response, &session_key); + + eproto = tracepoint_string("rxkad_rsp_param"); + abort_code = RXKADSEALEDINCON; +- if (ntohl(response.encrypted.epoch) != conn->proto.epoch) ++ if (ntohl(response->encrypted.epoch) != conn->proto.epoch) + goto protocol_error_free; +- if (ntohl(response.encrypted.cid) != conn->proto.cid) ++ if (ntohl(response->encrypted.cid) != conn->proto.cid) + goto protocol_error_free; +- if (ntohl(response.encrypted.securityIndex) != conn->security_ix) ++ if (ntohl(response->encrypted.securityIndex) != conn->security_ix) + goto protocol_error_free; +- csum = response.encrypted.checksum; +- response.encrypted.checksum = 0; +- rxkad_calc_response_checksum(&response); ++ csum = response->encrypted.checksum; ++ response->encrypted.checksum = 0; ++ rxkad_calc_response_checksum(response); + eproto = tracepoint_string("rxkad_rsp_csum"); +- if (response.encrypted.checksum != csum) ++ if (response->encrypted.checksum != csum) + goto protocol_error_free; + + spin_lock(&conn->channel_lock); + for (i = 0; i < RXRPC_MAXCALLS; i++) { + struct rxrpc_call *call; +- u32 call_id = ntohl(response.encrypted.call_id[i]); ++ u32 call_id = ntohl(response->encrypted.call_id[i]); + + eproto = tracepoint_string("rxkad_rsp_callid"); + if (call_id > INT_MAX) +@@ -1153,12 +1159,12 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + + eproto = tracepoint_string("rxkad_rsp_seq"); + abort_code = RXKADOUTOFSEQUENCE; +- if (ntohl(response.encrypted.inc_nonce) != conn->security_nonce + 1) ++ if (ntohl(response->encrypted.inc_nonce) != conn->security_nonce + 1) + goto protocol_error_free; + + eproto = tracepoint_string("rxkad_rsp_level"); + abort_code = RXKADLEVELFAIL; +- level = ntohl(response.encrypted.level); ++ level = ntohl(response->encrypted.level); + if (level > RXRPC_SECURITY_ENCRYPT) + goto protocol_error_free; + conn->params.security_level = level; +@@ -1168,9 +1174,10 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + * as for a client connection */ + ret = rxrpc_get_server_data_key(conn, &session_key, expiry, kvno); + if (ret < 0) +- goto temporary_error_free; ++ goto temporary_error_free_ticket; + + kfree(ticket); ++ kfree(response); + _leave(" = 0"); + return 0; + +@@ -1179,12 +1186,15 @@ static int rxkad_verify_response(struct rxrpc_connection *conn, + protocol_error_free: + kfree(ticket); + protocol_error: ++ kfree(response); + trace_rxrpc_rx_eproto(NULL, sp->hdr.serial, eproto); + *_abort_code = abort_code; + return -EPROTO; + +-temporary_error_free: ++temporary_error_free_ticket: + kfree(ticket); ++temporary_error_free_resp: ++ kfree(response); + temporary_error: + /* Ignore the response packet if we got a temporary error such as + * ENOMEM. We just want to send the challenge again. Note that we +diff --git a/net/sunrpc/xprtrdma/backchannel.c b/net/sunrpc/xprtrdma/backchannel.c +index 823a781ec89c..25e3602aa41f 100644 +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -74,21 +74,13 @@ static int rpcrdma_bc_setup_rqst(struct rpcrdma_xprt *r_xprt, + static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt, + unsigned int count) + { +- struct rpcrdma_rep *rep; + int rc = 0; + + while (count--) { +- rep = rpcrdma_create_rep(r_xprt); +- if (IS_ERR(rep)) { +- pr_err("RPC: %s: reply buffer alloc failed\n", +- __func__); +- rc = PTR_ERR(rep); ++ rc = rpcrdma_create_rep(r_xprt); ++ if (rc) + break; +- } +- +- rpcrdma_recv_buffer_put(rep); + } +- + return rc; + } + +diff --git a/net/sunrpc/xprtrdma/svc_rdma_rw.c b/net/sunrpc/xprtrdma/svc_rdma_rw.c +index 9bd04549a1ad..12b9a7e0b6d2 100644 +--- a/net/sunrpc/xprtrdma/svc_rdma_rw.c ++++ b/net/sunrpc/xprtrdma/svc_rdma_rw.c +@@ -727,12 +727,16 @@ static int svc_rdma_build_normal_read_chunk(struct svc_rqst *rqstp, + head->arg.head[0].iov_len - info->ri_position; + head->arg.head[0].iov_len = info->ri_position; + +- /* Read chunk may need XDR roundup (see RFC 5666, s. 3.7). ++ /* Read chunk may need XDR roundup (see RFC 8166, s. 3.4.5.2). + * +- * NFSv2/3 write decoders need the length of the tail to +- * contain the size of the roundup padding. ++ * If the client already rounded up the chunk length, the ++ * length does not change. Otherwise, the length of the page ++ * list is increased to include XDR round-up. ++ * ++ * Currently these chunks always start at page offset 0, ++ * thus the rounded-up length never crosses a page boundary. + */ +- head->arg.tail[0].iov_len += 4 - (info->ri_chunklen & 3); ++ info->ri_chunklen = XDR_QUADLEN(info->ri_chunklen) << 2; + + head->arg.page_len = info->ri_chunklen; + head->arg.len += info->ri_chunklen; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 9e8e1de19b2e..97b9d4f671ac 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -951,10 +951,17 @@ rpcrdma_create_req(struct rpcrdma_xprt *r_xprt) + return req; + } + +-struct rpcrdma_rep * ++/** ++ * rpcrdma_create_rep - Allocate an rpcrdma_rep object ++ * @r_xprt: controlling transport ++ * ++ * Returns 0 on success or a negative errno on failure. ++ */ ++int + rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt) + { + struct rpcrdma_create_data_internal *cdata = &r_xprt->rx_data; ++ struct rpcrdma_buffer *buf = &r_xprt->rx_buf; + struct rpcrdma_rep *rep; + int rc; + +@@ -979,12 +986,18 @@ rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt) + rep->rr_recv_wr.wr_cqe = &rep->rr_cqe; + rep->rr_recv_wr.sg_list = &rep->rr_rdmabuf->rg_iov; + rep->rr_recv_wr.num_sge = 1; +- return rep; ++ ++ spin_lock(&buf->rb_lock); ++ list_add(&rep->rr_list, &buf->rb_recv_bufs); ++ spin_unlock(&buf->rb_lock); ++ return 0; + + out_free: + kfree(rep); + out: +- return ERR_PTR(rc); ++ dprintk("RPC: %s: reply buffer %d alloc failed\n", ++ __func__, rc); ++ return rc; + } + + int +@@ -1027,17 +1040,10 @@ rpcrdma_buffer_create(struct rpcrdma_xprt *r_xprt) + } + + INIT_LIST_HEAD(&buf->rb_recv_bufs); +- for (i = 0; i < buf->rb_max_requests + RPCRDMA_MAX_BC_REQUESTS; i++) { +- struct rpcrdma_rep *rep; +- +- rep = rpcrdma_create_rep(r_xprt); +- if (IS_ERR(rep)) { +- dprintk("RPC: %s: reply buffer %d alloc failed\n", +- __func__, i); +- rc = PTR_ERR(rep); ++ for (i = 0; i <= buf->rb_max_requests; i++) { ++ rc = rpcrdma_create_rep(r_xprt); ++ if (rc) + goto out; +- } +- list_add(&rep->rr_list, &buf->rb_recv_bufs); + } + + return 0; +diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h +index e26a97d2f922..fcb0b3227ee1 100644 +--- a/net/sunrpc/xprtrdma/xprt_rdma.h ++++ b/net/sunrpc/xprtrdma/xprt_rdma.h +@@ -550,8 +550,8 @@ int rpcrdma_ep_post_recv(struct rpcrdma_ia *, struct rpcrdma_rep *); + * Buffer calls - xprtrdma/verbs.c + */ + struct rpcrdma_req *rpcrdma_create_req(struct rpcrdma_xprt *); +-struct rpcrdma_rep *rpcrdma_create_rep(struct rpcrdma_xprt *); + void rpcrdma_destroy_req(struct rpcrdma_req *); ++int rpcrdma_create_rep(struct rpcrdma_xprt *r_xprt); + int rpcrdma_buffer_create(struct rpcrdma_xprt *); + void rpcrdma_buffer_destroy(struct rpcrdma_buffer *); + +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 8cb40f8ffa5b..30192abfdc3b 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -1069,18 +1069,18 @@ static void xs_udp_data_read_skb(struct rpc_xprt *xprt, + + /* Suck it into the iovec, verify checksum if not done by hw. */ + if (csum_partial_copy_to_xdr(&rovr->rq_private_buf, skb)) { +- __UDPX_INC_STATS(sk, UDP_MIB_INERRORS); + spin_lock(&xprt->recv_lock); ++ __UDPX_INC_STATS(sk, UDP_MIB_INERRORS); + goto out_unpin; + } + +- __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS); + + spin_lock_bh(&xprt->transport_lock); + xprt_adjust_cwnd(xprt, task, copied); + spin_unlock_bh(&xprt->transport_lock); + spin_lock(&xprt->recv_lock); + xprt_complete_rqst(task, copied); ++ __UDPX_INC_STATS(sk, UDP_MIB_INDATAGRAMS); + out_unpin: + xprt_unpin_rqst(rovr); + out_unlock: +diff --git a/samples/bpf/Makefile b/samples/bpf/Makefile +index 9b4a66e3363e..c1dc632d4ea4 100644 +--- a/samples/bpf/Makefile ++++ b/samples/bpf/Makefile +@@ -179,13 +179,16 @@ LLC ?= llc + CLANG ?= clang + + # Trick to allow make to be run from this directory +-all: ++all: $(LIBBPF) + $(MAKE) -C ../../ $(CURDIR)/ + + clean: + $(MAKE) -C ../../ M=$(CURDIR) clean + @rm -f *~ + ++$(LIBBPF): FORCE ++ $(MAKE) -C $(dir $@) $(notdir $@) ++ + $(obj)/syscall_nrs.s: $(src)/syscall_nrs.c + $(call if_changed_dep,cc_s_c) + +diff --git a/scripts/kconfig/expr.c b/scripts/kconfig/expr.c +index cbf4996dd9c1..ed29bad1f03a 100644 +--- a/scripts/kconfig/expr.c ++++ b/scripts/kconfig/expr.c +@@ -113,7 +113,7 @@ void expr_free(struct expr *e) + break; + case E_NOT: + expr_free(e->left.expr); +- return; ++ break; + case E_EQUAL: + case E_GEQ: + case E_GTH: +diff --git a/scripts/kconfig/menu.c b/scripts/kconfig/menu.c +index e9357931b47d..749c2bd5fc51 100644 +--- a/scripts/kconfig/menu.c ++++ b/scripts/kconfig/menu.c +@@ -372,6 +372,7 @@ void menu_finalize(struct menu *parent) + menu->parent = parent; + last_menu = menu; + } ++ expr_free(basedep); + if (last_menu) { + parent->list = parent->next; + parent->next = last_menu->next; +diff --git a/scripts/kconfig/zconf.y b/scripts/kconfig/zconf.y +index c8f396c3b190..20d9caa4be99 100644 +--- a/scripts/kconfig/zconf.y ++++ b/scripts/kconfig/zconf.y +@@ -108,7 +108,27 @@ static struct menu *current_menu, *current_entry; + %% + input: nl start | start; + +-start: mainmenu_stmt stmt_list | stmt_list; ++start: mainmenu_stmt stmt_list | no_mainmenu_stmt stmt_list; ++ ++/* mainmenu entry */ ++ ++mainmenu_stmt: T_MAINMENU prompt nl ++{ ++ menu_add_prompt(P_MENU, $2, NULL); ++}; ++ ++/* Default main menu, if there's no mainmenu entry */ ++ ++no_mainmenu_stmt: /* empty */ ++{ ++ /* ++ * Hack: Keep the main menu title on the heap so we can safely free it ++ * later regardless of whether it comes from the 'prompt' in ++ * mainmenu_stmt or here ++ */ ++ menu_add_prompt(P_MENU, strdup("Linux Kernel Configuration"), NULL); ++}; ++ + + stmt_list: + /* empty */ +@@ -351,13 +371,6 @@ if_block: + | if_block choice_stmt + ; + +-/* mainmenu entry */ +- +-mainmenu_stmt: T_MAINMENU prompt nl +-{ +- menu_add_prompt(P_MENU, $2, NULL); +-}; +- + /* menu entry */ + + menu: T_MENU prompt T_EOL +@@ -502,6 +515,7 @@ word_opt: /* empty */ { $$ = NULL; } + + void conf_parse(const char *name) + { ++ const char *tmp; + struct symbol *sym; + int i; + +@@ -509,7 +523,6 @@ void conf_parse(const char *name) + + sym_init(); + _menu_init(); +- rootmenu.prompt = menu_add_prompt(P_MENU, "Linux Kernel Configuration", NULL); + + if (getenv("ZCONF_DEBUG")) + zconfdebug = 1; +@@ -519,8 +532,10 @@ void conf_parse(const char *name) + if (!modules_sym) + modules_sym = sym_find( "n" ); + ++ tmp = rootmenu.prompt->text; + rootmenu.prompt->text = _(rootmenu.prompt->text); + rootmenu.prompt->text = sym_expand_string_value(rootmenu.prompt->text); ++ free((char*)tmp); + + menu_finalize(&rootmenu); + for_all_symbols(i, sym) { +diff --git a/sound/pci/hda/Kconfig b/sound/pci/hda/Kconfig +index 7f3b5ed81995..f7a492c382d9 100644 +--- a/sound/pci/hda/Kconfig ++++ b/sound/pci/hda/Kconfig +@@ -88,7 +88,6 @@ config SND_HDA_PATCH_LOADER + config SND_HDA_CODEC_REALTEK + tristate "Build Realtek HD-audio codec support" + select SND_HDA_GENERIC +- select INPUT + help + Say Y or M here to include Realtek HD-audio codec support in + snd-hda-intel driver, such as ALC880. +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index b1b28c6928a7..590887d9b7a1 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3721,6 +3721,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec, + } + } + ++#if IS_REACHABLE(INPUT) + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { +@@ -3853,6 +3854,10 @@ static void alc233_fixup_lenovo_line2_mic_hotkey(struct hda_codec *codec, + spec->kb_dev = NULL; + } + } ++#else /* INPUT */ ++#define alc280_fixup_hp_gpio2_mic_hotkey NULL ++#define alc233_fixup_lenovo_line2_mic_hotkey NULL ++#endif /* INPUT */ + + static void alc269_fixup_hp_line1_mic1_led(struct hda_codec *codec, + const struct hda_fixup *fix, int action) +diff --git a/sound/soc/au1x/ac97c.c b/sound/soc/au1x/ac97c.c +index 29a97d52e8ad..66d6c52e7761 100644 +--- a/sound/soc/au1x/ac97c.c ++++ b/sound/soc/au1x/ac97c.c +@@ -91,8 +91,8 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97, + do { + mutex_lock(&ctx->lock); + +- tmo = 5; +- while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--) ++ tmo = 6; ++ while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo) + udelay(21); /* wait an ac97 frame time */ + if (!tmo) { + pr_debug("ac97rd timeout #1\n"); +@@ -105,7 +105,7 @@ static unsigned short au1xac97c_ac97_read(struct snd_ac97 *ac97, + * poll, Forrest, poll... + */ + tmo = 0x10000; +- while ((RD(ctx, AC97_STATUS) & STAT_CP) && tmo--) ++ while ((RD(ctx, AC97_STATUS) & STAT_CP) && --tmo) + asm volatile ("nop"); + data = RD(ctx, AC97_CMDRESP); + +diff --git a/sound/soc/rockchip/rk3399_gru_sound.c b/sound/soc/rockchip/rk3399_gru_sound.c +index 0513fe480353..21ac8d6cce3a 100644 +--- a/sound/soc/rockchip/rk3399_gru_sound.c ++++ b/sound/soc/rockchip/rk3399_gru_sound.c +@@ -387,7 +387,8 @@ static const struct snd_soc_dai_link rockchip_dais[] = { + [DAILINK_RT5514_DSP] = { + .name = "RT5514 DSP", + .stream_name = "Wake on Voice", +- .codec_dai_name = "rt5514-dsp-cpu-dai", ++ .codec_name = "snd-soc-dummy", ++ .codec_dai_name = "snd-soc-dummy-dai", + }, + }; + +@@ -432,7 +433,18 @@ static int rockchip_sound_of_parse_dais(struct device *dev, + if (index < 0) + continue; + +- np_cpu = (index == DAILINK_CDNDP) ? np_cpu1 : np_cpu0; ++ switch (index) { ++ case DAILINK_CDNDP: ++ np_cpu = np_cpu1; ++ break; ++ case DAILINK_RT5514_DSP: ++ np_cpu = np_codec; ++ break; ++ default: ++ np_cpu = np_cpu0; ++ break; ++ } ++ + if (!np_cpu) { + dev_err(dev, "Missing 'rockchip,cpu' for %s\n", + rockchip_dais[index].name); +@@ -442,7 +454,8 @@ static int rockchip_sound_of_parse_dais(struct device *dev, + dai = &card->dai_link[card->num_links++]; + *dai = rockchip_dais[index]; + +- dai->codec_of_node = np_codec; ++ if (!dai->codec_name) ++ dai->codec_of_node = np_codec; + dai->platform_of_node = np_cpu; + dai->cpu_of_node = np_cpu; + } +diff --git a/tools/lib/bpf/Makefile b/tools/lib/bpf/Makefile +index 4555304dc18e..f02448e86d38 100644 +--- a/tools/lib/bpf/Makefile ++++ b/tools/lib/bpf/Makefile +@@ -183,7 +183,7 @@ define do_install + if [ ! -d '$(DESTDIR_SQ)$2' ]; then \ + $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$2'; \ + fi; \ +- $(INSTALL) $1 '$(DESTDIR_SQ)$2' ++ $(INSTALL) $1 $(if $3,-m $3,) '$(DESTDIR_SQ)$2' + endef + + install_lib: all_cmd +diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c +index 35f6dfcdc565..701d29c8364f 100644 +--- a/tools/lib/bpf/libbpf.c ++++ b/tools/lib/bpf/libbpf.c +@@ -661,6 +661,24 @@ bpf_object__init_maps(struct bpf_object *obj) + return bpf_object__validate_maps(obj); + } + ++static bool section_have_execinstr(struct bpf_object *obj, int idx) ++{ ++ Elf_Scn *scn; ++ GElf_Shdr sh; ++ ++ scn = elf_getscn(obj->efile.elf, idx); ++ if (!scn) ++ return false; ++ ++ if (gelf_getshdr(scn, &sh) != &sh) ++ return false; ++ ++ if (sh.sh_flags & SHF_EXECINSTR) ++ return true; ++ ++ return false; ++} ++ + static int bpf_object__elf_collect(struct bpf_object *obj) + { + Elf *elf = obj->efile.elf; +@@ -742,6 +760,14 @@ static int bpf_object__elf_collect(struct bpf_object *obj) + } else if (sh.sh_type == SHT_REL) { + void *reloc = obj->efile.reloc; + int nr_reloc = obj->efile.nr_reloc + 1; ++ int sec = sh.sh_info; /* points to other section */ ++ ++ /* Only do relo for section with exec instructions */ ++ if (!section_have_execinstr(obj, sec)) { ++ pr_debug("skip relo %s(%d) for section(%d)\n", ++ name, idx, sec); ++ continue; ++ } + + reloc = realloc(reloc, + sizeof(*obj->efile.reloc) * nr_reloc); +diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c +index 7ce724fc0544..9a17bc27296e 100644 +--- a/tools/lib/traceevent/event-parse.c ++++ b/tools/lib/traceevent/event-parse.c +@@ -4949,21 +4949,22 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event + else + ls = 2; + +- if (*(ptr+1) == 'F' || *(ptr+1) == 'f' || +- *(ptr+1) == 'S' || *(ptr+1) == 's') { ++ if (isalnum(ptr[1])) + ptr++; ++ ++ if (*ptr == 'F' || *ptr == 'f' || ++ *ptr == 'S' || *ptr == 's') { + show_func = *ptr; +- } else if (*(ptr+1) == 'M' || *(ptr+1) == 'm') { +- print_mac_arg(s, *(ptr+1), data, size, event, arg); +- ptr++; ++ } else if (*ptr == 'M' || *ptr == 'm') { ++ print_mac_arg(s, *ptr, data, size, event, arg); + arg = arg->next; + break; +- } else if (*(ptr+1) == 'I' || *(ptr+1) == 'i') { ++ } else if (*ptr == 'I' || *ptr == 'i') { + int n; + +- n = print_ip_arg(s, ptr+1, data, size, event, arg); ++ n = print_ip_arg(s, ptr, data, size, event, arg); + if (n > 0) { +- ptr += n; ++ ptr += n - 1; + arg = arg->next; + break; + } +diff --git a/tools/lib/traceevent/parse-filter.c b/tools/lib/traceevent/parse-filter.c +index 7c214ceb9386..5e10ba796a6f 100644 +--- a/tools/lib/traceevent/parse-filter.c ++++ b/tools/lib/traceevent/parse-filter.c +@@ -1879,17 +1879,25 @@ static const char *get_field_str(struct filter_arg *arg, struct pevent_record *r + struct pevent *pevent; + unsigned long long addr; + const char *val = NULL; ++ unsigned int size; + char hex[64]; + + /* If the field is not a string convert it */ + if (arg->str.field->flags & FIELD_IS_STRING) { + val = record->data + arg->str.field->offset; ++ size = arg->str.field->size; ++ ++ if (arg->str.field->flags & FIELD_IS_DYNAMIC) { ++ addr = *(unsigned int *)val; ++ val = record->data + (addr & 0xffff); ++ size = addr >> 16; ++ } + + /* + * We need to copy the data since we can't be sure the field + * is null terminated. + */ +- if (*(val + arg->str.field->size - 1)) { ++ if (*(val + size - 1)) { + /* copy it */ + memcpy(arg->str.buffer, val, arg->str.field->size); + /* the buffer is already NULL terminated */ +diff --git a/tools/perf/arch/x86/util/header.c b/tools/perf/arch/x86/util/header.c +index 33027c5e6f92..c6b5204e0280 100644 +--- a/tools/perf/arch/x86/util/header.c ++++ b/tools/perf/arch/x86/util/header.c +@@ -70,7 +70,7 @@ get_cpuid_str(void) + { + char *buf = malloc(128); + +- if (__get_cpuid(buf, 128, "%s-%u-%X$") < 0) { ++ if (buf && __get_cpuid(buf, 128, "%s-%u-%X$") < 0) { + free(buf); + return NULL; + } +diff --git a/tools/perf/builtin-c2c.c b/tools/perf/builtin-c2c.c +index d00aac51130d..3479a1bc7caa 100644 +--- a/tools/perf/builtin-c2c.c ++++ b/tools/perf/builtin-c2c.c +@@ -2393,9 +2393,10 @@ static int setup_callchain(struct perf_evlist *evlist) + enum perf_call_graph_mode mode = CALLCHAIN_NONE; + + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + mode = CALLCHAIN_LBR; + else if (sample_type & PERF_SAMPLE_CALLCHAIN) + mode = CALLCHAIN_FP; +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 1957abc1c8cf..b205c1340456 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -1611,7 +1611,8 @@ static struct option __record_options[] = { + OPT_BOOLEAN_SET('T', "timestamp", &record.opts.sample_time, + &record.opts.sample_time_set, + "Record the sample timestamps"), +- OPT_BOOLEAN('P', "period", &record.opts.period, "Record the sample period"), ++ OPT_BOOLEAN_SET('P', "period", &record.opts.period, &record.opts.period_set, ++ "Record the sample period"), + OPT_BOOLEAN('n', "no-samples", &record.opts.no_samples, + "don't sample"), + OPT_BOOLEAN_SET('N', "no-buildid-cache", &record.no_buildid_cache, +diff --git a/tools/perf/builtin-report.c b/tools/perf/builtin-report.c +index 183c3ed56e08..4ddb0726eebc 100644 +--- a/tools/perf/builtin-report.c ++++ b/tools/perf/builtin-report.c +@@ -328,9 +328,10 @@ static int report__setup_sample_type(struct report *rep) + + if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) { + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + callchain_param.record_mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + callchain_param.record_mode = CALLCHAIN_LBR; + else + callchain_param.record_mode = CALLCHAIN_FP; +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c +index 0fe02758de7d..615fdc63452e 100644 +--- a/tools/perf/builtin-script.c ++++ b/tools/perf/builtin-script.c +@@ -2574,9 +2574,10 @@ static void script__setup_sample_type(struct perf_script *script) + + if (symbol_conf.use_callchain || symbol_conf.cumulate_callchain) { + if ((sample_type & PERF_SAMPLE_REGS_USER) && +- (sample_type & PERF_SAMPLE_STACK_USER)) ++ (sample_type & PERF_SAMPLE_STACK_USER)) { + callchain_param.record_mode = CALLCHAIN_DWARF; +- else if (sample_type & PERF_SAMPLE_BRANCH_STACK) ++ dwarf_callchain_users = true; ++ } else if (sample_type & PERF_SAMPLE_BRANCH_STACK) + callchain_param.record_mode = CALLCHAIN_LBR; + else + callchain_param.record_mode = CALLCHAIN_FP; +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index f75f3dec7485..55086389fc06 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -50,6 +50,7 @@ struct record_opts { + bool sample_time_set; + bool sample_cpu; + bool period; ++ bool period_set; + bool running_time; + bool full_auxtrace; + bool auxtrace_snapshot_mode; +diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c +index ac40e05bcab4..260418969120 100644 +--- a/tools/perf/tests/dwarf-unwind.c ++++ b/tools/perf/tests/dwarf-unwind.c +@@ -173,6 +173,7 @@ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unu + } + + callchain_param.record_mode = CALLCHAIN_DWARF; ++ dwarf_callchain_users = true; + + if (init_live_machine(machine)) { + pr_err("Could not init machine\n"); +diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +index 7a84d73324e3..a2f757da49d9 100755 +--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh ++++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +@@ -22,10 +22,23 @@ trace_libc_inet_pton_backtrace() { + expected[4]="rtt min.*" + expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)" + expected[6]=".*inet_pton[[:space:]]\($libc\)$" +- expected[7]="getaddrinfo[[:space:]]\($libc\)$" +- expected[8]=".*\(.*/bin/ping.*\)$" ++ case "$(uname -m)" in ++ s390x) ++ eventattr='call-graph=dwarf' ++ expected[7]="gaih_inet[[:space:]]\(inlined\)$" ++ expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$" ++ expected[9]="main[[:space:]]\(.*/bin/ping.*\)$" ++ expected[10]="__libc_start_main[[:space:]]\($libc\)$" ++ expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$" ++ ;; ++ *) ++ eventattr='max-stack=3' ++ expected[7]="getaddrinfo[[:space:]]\($libc\)$" ++ expected[8]=".*\(.*/bin/ping.*\)$" ++ ;; ++ esac + +- perf trace --no-syscalls -e probe_libc:inet_pton/max-stack=3/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do ++ perf trace --no-syscalls -e probe_libc:inet_pton/$eventattr/ ping -6 -c 1 ::1 2>&1 | grep -v ^$ | while read line ; do + echo $line + echo "$line" | egrep -q "${expected[$idx]}" + if [ $? -ne 0 ] ; then +@@ -33,7 +46,7 @@ trace_libc_inet_pton_backtrace() { + exit 1 + fi + let idx+=1 +- [ $idx -eq 9 ] && break ++ [ -z "${expected[$idx]}" ] && break + done + } + +diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c +index 6031933d811c..146683b1c28d 100644 +--- a/tools/perf/util/callchain.c ++++ b/tools/perf/util/callchain.c +@@ -37,6 +37,15 @@ struct callchain_param callchain_param = { + CALLCHAIN_PARAM_DEFAULT + }; + ++/* ++ * Are there any events usind DWARF callchains? ++ * ++ * I.e. ++ * ++ * -e cycles/call-graph=dwarf/ ++ */ ++bool dwarf_callchain_users; ++ + struct callchain_param callchain_param_default = { + CALLCHAIN_PARAM_DEFAULT + }; +@@ -265,6 +274,7 @@ int parse_callchain_record(const char *arg, struct callchain_param *param) + ret = 0; + param->record_mode = CALLCHAIN_DWARF; + param->dump_size = default_stack_dump_size; ++ dwarf_callchain_users = true; + + tok = strtok_r(NULL, ",", &saveptr); + if (tok) { +diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h +index f967aa47d0a1..9ba5903c8d3e 100644 +--- a/tools/perf/util/callchain.h ++++ b/tools/perf/util/callchain.h +@@ -89,6 +89,8 @@ enum chain_value { + CCVAL_COUNT, + }; + ++extern bool dwarf_callchain_users; ++ + struct callchain_param { + bool enabled; + enum perf_call_graph_mode record_mode; +diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c +index ac19130c14d8..226a9245d1db 100644 +--- a/tools/perf/util/evsel.c ++++ b/tools/perf/util/evsel.c +@@ -722,26 +722,28 @@ static void apply_config_terms(struct perf_evsel *evsel, + struct perf_evsel_config_term *term; + struct list_head *config_terms = &evsel->config_terms; + struct perf_event_attr *attr = &evsel->attr; +- struct callchain_param param; ++ /* callgraph default */ ++ struct callchain_param param = { ++ .record_mode = callchain_param.record_mode, ++ }; + u32 dump_size = 0; + int max_stack = 0; + const char *callgraph_buf = NULL; + +- /* callgraph default */ +- param.record_mode = callchain_param.record_mode; +- + list_for_each_entry(term, config_terms, list) { + switch (term->type) { + case PERF_EVSEL__CONFIG_TERM_PERIOD: + if (!(term->weak && opts->user_interval != ULLONG_MAX)) { + attr->sample_period = term->val.period; + attr->freq = 0; ++ perf_evsel__reset_sample_bit(evsel, PERIOD); + } + break; + case PERF_EVSEL__CONFIG_TERM_FREQ: + if (!(term->weak && opts->user_freq != UINT_MAX)) { + attr->sample_freq = term->val.freq; + attr->freq = 1; ++ perf_evsel__set_sample_bit(evsel, PERIOD); + } + break; + case PERF_EVSEL__CONFIG_TERM_TIME: +@@ -943,9 +945,6 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + if (target__has_cpu(&opts->target) || opts->sample_cpu) + perf_evsel__set_sample_bit(evsel, CPU); + +- if (opts->period) +- perf_evsel__set_sample_bit(evsel, PERIOD); +- + /* + * When the user explicitly disabled time don't force it here. + */ +@@ -1047,6 +1046,14 @@ void perf_evsel__config(struct perf_evsel *evsel, struct record_opts *opts, + apply_config_terms(evsel, opts); + + evsel->ignore_missing_thread = opts->ignore_missing_thread; ++ ++ /* The --period option takes the precedence. */ ++ if (opts->period_set) { ++ if (opts->period) ++ perf_evsel__set_sample_bit(evsel, PERIOD); ++ else ++ perf_evsel__reset_sample_bit(evsel, PERIOD); ++ } + } + + static int perf_evsel__alloc_fd(struct perf_evsel *evsel, int ncpus, int nthreads) +diff --git a/tools/perf/util/unwind-libunwind-local.c b/tools/perf/util/unwind-libunwind-local.c +index 7a42f703e858..af873044d33a 100644 +--- a/tools/perf/util/unwind-libunwind-local.c ++++ b/tools/perf/util/unwind-libunwind-local.c +@@ -631,9 +631,8 @@ static unw_accessors_t accessors = { + + static int _unwind__prepare_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return 0; +- + thread->addr_space = unw_create_addr_space(&accessors, 0); + if (!thread->addr_space) { + pr_err("unwind: Can't create unwind address space.\n"); +@@ -646,17 +645,15 @@ static int _unwind__prepare_access(struct thread *thread) + + static void _unwind__flush_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return; +- + unw_flush_cache(thread->addr_space, 0, 0); + } + + static void _unwind__finish_access(struct thread *thread) + { +- if (callchain_param.record_mode != CALLCHAIN_DWARF) ++ if (!dwarf_callchain_users) + return; +- + unw_destroy_addr_space(thread->addr_space); + } + +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 50ce52d2013d..8b9470b5af6d 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -463,7 +463,7 @@ static void test_devmap(int task, void *data) + #define SOCKMAP_VERDICT_PROG "./sockmap_verdict_prog.o" + static void test_sockmap(int tasks, void *data) + { +- int one = 1, map_fd_rx, map_fd_tx, map_fd_break, s, sc, rc; ++ int one = 1, map_fd_rx = 0, map_fd_tx = 0, map_fd_break, s, sc, rc; + struct bpf_map *bpf_map_rx, *bpf_map_tx, *bpf_map_break; + int ports[] = {50200, 50201, 50202, 50204}; + int err, i, fd, udp, sfd[6] = {0xdeadbeef}; +@@ -868,9 +868,12 @@ static void test_sockmap(int tasks, void *data) + goto out_sockmap; + } + +- /* Test map close sockets */ +- for (i = 0; i < 6; i++) ++ /* Test map close sockets and empty maps */ ++ for (i = 0; i < 6; i++) { ++ bpf_map_delete_elem(map_fd_tx, &i); ++ bpf_map_delete_elem(map_fd_rx, &i); + close(sfd[i]); ++ } + close(fd); + close(map_fd_rx); + bpf_object__close(obj); +@@ -881,8 +884,13 @@ static void test_sockmap(int tasks, void *data) + printf("Failed to create sockmap '%i:%s'!\n", i, strerror(errno)); + exit(1); + out_sockmap: +- for (i = 0; i < 6; i++) ++ for (i = 0; i < 6; i++) { ++ if (map_fd_tx) ++ bpf_map_delete_elem(map_fd_tx, &i); ++ if (map_fd_rx) ++ bpf_map_delete_elem(map_fd_rx, &i); + close(sfd[i]); ++ } + close(fd); + exit(1); + } +diff --git a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +index 589d52b211b7..27a54a17da65 100644 +--- a/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc ++++ b/tools/testing/selftests/ftrace/test.d/ftrace/func-filter-glob.tc +@@ -29,6 +29,12 @@ ftrace_filter_check '*schedule*' '^.*schedule.*$' + # filter by *, end match + ftrace_filter_check 'schedule*' '^schedule.*$' + ++# filter by *mid*end ++ftrace_filter_check '*aw*lock' '.*aw.*lock$' ++ ++# filter by start*mid* ++ftrace_filter_check 'mutex*try*' '^mutex.*try.*' ++ + # Advanced full-glob matching feature is recently supported. + # Skip the tests if we are sure the kernel does not support it. + if grep -q 'accepts: .* glob-matching-pattern' README ; then +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +index bb16cf91f1b5..e297bd7a2e79 100644 +--- a/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/multiple_kprobes.tc +@@ -12,8 +12,8 @@ case `uname -m` in + *) OFFS=0;; + esac + +-echo "Setup up to 256 kprobes" +-grep t /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \ ++echo "Setup up kprobes on first 256 text symbols" ++grep -i " t " /proc/kallsyms | cut -f3 -d" " | grep -v .*\\..* | \ + head -n 256 | while read i; do echo p ${i}+${OFFS} ; done > kprobe_events ||: + + echo 1 > events/kprobes/enable +diff --git a/tools/testing/selftests/net/reuseport_bpf.c b/tools/testing/selftests/net/reuseport_bpf.c +index 4a8217448f20..cad14cd0ea92 100644 +--- a/tools/testing/selftests/net/reuseport_bpf.c ++++ b/tools/testing/selftests/net/reuseport_bpf.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + + #ifndef ARRAY_SIZE +@@ -190,11 +191,14 @@ static void send_from(struct test_params p, uint16_t sport, char *buf, + struct sockaddr * const saddr = new_any_sockaddr(p.send_family, sport); + struct sockaddr * const daddr = + new_loopback_sockaddr(p.send_family, p.recv_port); +- const int fd = socket(p.send_family, p.protocol, 0); ++ const int fd = socket(p.send_family, p.protocol, 0), one = 1; + + if (fd < 0) + error(1, errno, "failed to create send socket"); + ++ if (setsockopt(fd, SOL_SOCKET, SO_REUSEADDR, &one, sizeof(one))) ++ error(1, errno, "failed to set reuseaddr"); ++ + if (bind(fd, saddr, sockaddr_size())) + error(1, errno, "failed to bind send socket"); + +@@ -433,6 +437,21 @@ void enable_fastopen(void) + } + } + ++static struct rlimit rlim_old, rlim_new; ++ ++static __attribute__((constructor)) void main_ctor(void) ++{ ++ getrlimit(RLIMIT_MEMLOCK, &rlim_old); ++ rlim_new.rlim_cur = rlim_old.rlim_cur + (1UL << 20); ++ rlim_new.rlim_max = rlim_old.rlim_max + (1UL << 20); ++ setrlimit(RLIMIT_MEMLOCK, &rlim_new); ++} ++ ++static __attribute__((destructor)) void main_dtor(void) ++{ ++ setrlimit(RLIMIT_MEMLOCK, &rlim_old); ++} ++ + int main(void) + { + fprintf(stderr, "---- IPv4 UDP ----\n"); +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index d81af263f50b..4f35f0dfe681 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -1434,7 +1434,8 @@ static bool vma_is_valid(struct vm_area_struct *vma, bool write_fault) + + static int hva_to_pfn_remapped(struct vm_area_struct *vma, + unsigned long addr, bool *async, +- bool write_fault, kvm_pfn_t *p_pfn) ++ bool write_fault, bool *writable, ++ kvm_pfn_t *p_pfn) + { + unsigned long pfn; + int r; +@@ -1460,6 +1461,8 @@ static int hva_to_pfn_remapped(struct vm_area_struct *vma, + + } + ++ if (writable) ++ *writable = true; + + /* + * Get a reference here because callers of *hva_to_pfn* and +@@ -1525,7 +1528,7 @@ static kvm_pfn_t hva_to_pfn(unsigned long addr, bool atomic, bool *async, + if (vma == NULL) + pfn = KVM_PFN_ERR_FAULT; + else if (vma->vm_flags & (VM_IO | VM_PFNMAP)) { +- r = hva_to_pfn_remapped(vma, addr, async, write_fault, &pfn); ++ r = hva_to_pfn_remapped(vma, addr, async, write_fault, writable, &pfn); + if (r == -EAGAIN) + goto retry; + if (r < 0) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.37-38.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.37-38.patch new file mode 100644 index 000000000000..4612b61ac698 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.37-38.patch @@ -0,0 +1,4524 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index fb385af482ff..8cfb44ffe853 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -2541,6 +2541,9 @@ + + noalign [KNL,ARM] + ++ noaltinstr [S390] Disables alternative instructions patching ++ (CPU alternatives feature). ++ + noapic [SMP,APIC] Tells the kernel to not make use of any + IOAPICs that may be present in the system. + +diff --git a/Makefile b/Makefile +index ee330f5449e6..27a8d5c37180 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 37 ++SUBLEVEL = 38 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 910628d18add..1fc5060d7027 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -155,17 +155,6 @@ + regulator-min-microvolt = <5000000>; + regulator-max-microvolt = <5000000>; + }; +- +- vdd_log: vdd-log { +- compatible = "pwm-regulator"; +- pwms = <&pwm2 0 25000 0>; +- regulator-name = "vdd_log"; +- regulator-min-microvolt = <800000>; +- regulator-max-microvolt = <1400000>; +- regulator-always-on; +- regulator-boot-on; +- status = "okay"; +- }; + }; + + &cpu_b0 { +diff --git a/arch/microblaze/Kconfig.platform b/arch/microblaze/Kconfig.platform +index 1b3d8c849101..f7f1739c11b9 100644 +--- a/arch/microblaze/Kconfig.platform ++++ b/arch/microblaze/Kconfig.platform +@@ -20,6 +20,7 @@ config OPT_LIB_FUNCTION + config OPT_LIB_ASM + bool "Optimalized lib function ASM" + depends on OPT_LIB_FUNCTION && (XILINX_MICROBLAZE0_USE_BARREL = 1) ++ depends on CPU_BIG_ENDIAN + default n + help + Allows turn on optimalized library function (memcpy and memmove). +diff --git a/arch/microblaze/lib/fastcopy.S b/arch/microblaze/lib/fastcopy.S +index 62021d7e249e..fdc48bb065d8 100644 +--- a/arch/microblaze/lib/fastcopy.S ++++ b/arch/microblaze/lib/fastcopy.S +@@ -29,10 +29,6 @@ + * between mem locations with size of xfer spec'd in bytes + */ + +-#ifdef __MICROBLAZEEL__ +-#error Microblaze LE not support ASM optimized lib func. Disable OPT_LIB_ASM. +-#endif +- + #include + .text + .globl memcpy +diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig +index ae55e715cc74..49fb6614ea8c 100644 +--- a/arch/s390/Kconfig ++++ b/arch/s390/Kconfig +@@ -121,6 +121,7 @@ config S390 + select GENERIC_CLOCKEVENTS + select GENERIC_CPU_AUTOPROBE + select GENERIC_CPU_DEVICES if !SMP ++ select GENERIC_CPU_VULNERABILITIES + select GENERIC_FIND_FIRST_BIT + select GENERIC_SMP_IDLE_THREAD + select GENERIC_TIME_VSYSCALL +@@ -538,6 +539,51 @@ config ARCH_RANDOM + + If unsure, say Y. + ++config KERNEL_NOBP ++ def_bool n ++ prompt "Enable modified branch prediction for the kernel by default" ++ help ++ If this option is selected the kernel will switch to a modified ++ branch prediction mode if the firmware interface is available. ++ The modified branch prediction mode improves the behaviour in ++ regard to speculative execution. ++ ++ With the option enabled the kernel parameter "nobp=0" or "nospec" ++ can be used to run the kernel in the normal branch prediction mode. ++ ++ With the option disabled the modified branch prediction mode is ++ enabled with the "nobp=1" kernel parameter. ++ ++ If unsure, say N. ++ ++config EXPOLINE ++ def_bool n ++ prompt "Avoid speculative indirect branches in the kernel" ++ help ++ Compile the kernel with the expoline compiler options to guard ++ against kernel-to-user data leaks by avoiding speculative indirect ++ branches. ++ Requires a compiler with -mindirect-branch=thunk support for full ++ protection. The kernel may run slower. ++ ++ If unsure, say N. ++ ++choice ++ prompt "Expoline default" ++ depends on EXPOLINE ++ default EXPOLINE_FULL ++ ++config EXPOLINE_OFF ++ bool "spectre_v2=off" ++ ++config EXPOLINE_AUTO ++ bool "spectre_v2=auto" ++ ++config EXPOLINE_FULL ++ bool "spectre_v2=on" ++ ++endchoice ++ + endmenu + + menu "Memory setup" +@@ -812,6 +858,7 @@ config PFAULT + config SHARED_KERNEL + bool "VM shared kernel support" + depends on !JUMP_LABEL ++ depends on !ALTERNATIVES + help + Select this option, if you want to share the text segment of the + Linux kernel between different VM guests. This reduces memory +diff --git a/arch/s390/Makefile b/arch/s390/Makefile +index dac821cfcd43..ec3fa105f448 100644 +--- a/arch/s390/Makefile ++++ b/arch/s390/Makefile +@@ -81,6 +81,16 @@ ifeq ($(call cc-option-yn,-mwarn-dynamicstack),y) + cflags-$(CONFIG_WARN_DYNAMIC_STACK) += -mwarn-dynamicstack + endif + ++ifdef CONFIG_EXPOLINE ++ ifeq ($(call cc-option-yn,$(CC_FLAGS_MARCH) -mindirect-branch=thunk),y) ++ CC_FLAGS_EXPOLINE := -mindirect-branch=thunk ++ CC_FLAGS_EXPOLINE += -mfunction-return=thunk ++ CC_FLAGS_EXPOLINE += -mindirect-branch-table ++ export CC_FLAGS_EXPOLINE ++ cflags-y += $(CC_FLAGS_EXPOLINE) -DCC_USING_EXPOLINE ++ endif ++endif ++ + ifdef CONFIG_FUNCTION_TRACER + # make use of hotpatch feature if the compiler supports it + cc_hotpatch := -mhotpatch=0,3 +diff --git a/arch/s390/include/asm/alternative.h b/arch/s390/include/asm/alternative.h +new file mode 100644 +index 000000000000..a72002056b54 +--- /dev/null ++++ b/arch/s390/include/asm/alternative.h +@@ -0,0 +1,149 @@ ++#ifndef _ASM_S390_ALTERNATIVE_H ++#define _ASM_S390_ALTERNATIVE_H ++ ++#ifndef __ASSEMBLY__ ++ ++#include ++#include ++#include ++ ++struct alt_instr { ++ s32 instr_offset; /* original instruction */ ++ s32 repl_offset; /* offset to replacement instruction */ ++ u16 facility; /* facility bit set for replacement */ ++ u8 instrlen; /* length of original instruction */ ++ u8 replacementlen; /* length of new instruction */ ++} __packed; ++ ++void apply_alternative_instructions(void); ++void apply_alternatives(struct alt_instr *start, struct alt_instr *end); ++ ++/* ++ * |661: |662: |6620 |663: ++ * +-----------+---------------------+ ++ * | oldinstr | oldinstr_padding | ++ * | +----------+----------+ ++ * | | | | ++ * | | >6 bytes |6/4/2 nops| ++ * | |6 bytes jg-----------> ++ * +-----------+---------------------+ ++ * ^^ static padding ^^ ++ * ++ * .altinstr_replacement section ++ * +---------------------+-----------+ ++ * |6641: |6651: ++ * | alternative instr 1 | ++ * +-----------+---------+- - - - - -+ ++ * |6642: |6652: | ++ * | alternative instr 2 | padding ++ * +---------------------+- - - - - -+ ++ * ^ runtime ^ ++ * ++ * .altinstructions section ++ * +---------------------------------+ ++ * | alt_instr entries for each | ++ * | alternative instr | ++ * +---------------------------------+ ++ */ ++ ++#define b_altinstr(num) "664"#num ++#define e_altinstr(num) "665"#num ++ ++#define e_oldinstr_pad_end "663" ++#define oldinstr_len "662b-661b" ++#define oldinstr_total_len e_oldinstr_pad_end"b-661b" ++#define altinstr_len(num) e_altinstr(num)"b-"b_altinstr(num)"b" ++#define oldinstr_pad_len(num) \ ++ "-(((" altinstr_len(num) ")-(" oldinstr_len ")) > 0) * " \ ++ "((" altinstr_len(num) ")-(" oldinstr_len "))" ++ ++#define INSTR_LEN_SANITY_CHECK(len) \ ++ ".if " len " > 254\n" \ ++ "\t.error \"cpu alternatives does not support instructions " \ ++ "blocks > 254 bytes\"\n" \ ++ ".endif\n" \ ++ ".if (" len ") %% 2\n" \ ++ "\t.error \"cpu alternatives instructions length is odd\"\n" \ ++ ".endif\n" ++ ++#define OLDINSTR_PADDING(oldinstr, num) \ ++ ".if " oldinstr_pad_len(num) " > 6\n" \ ++ "\tjg " e_oldinstr_pad_end "f\n" \ ++ "6620:\n" \ ++ "\t.fill (" oldinstr_pad_len(num) " - (6620b-662b)) / 2, 2, 0x0700\n" \ ++ ".else\n" \ ++ "\t.fill " oldinstr_pad_len(num) " / 6, 6, 0xc0040000\n" \ ++ "\t.fill " oldinstr_pad_len(num) " %% 6 / 4, 4, 0x47000000\n" \ ++ "\t.fill " oldinstr_pad_len(num) " %% 6 %% 4 / 2, 2, 0x0700\n" \ ++ ".endif\n" ++ ++#define OLDINSTR(oldinstr, num) \ ++ "661:\n\t" oldinstr "\n662:\n" \ ++ OLDINSTR_PADDING(oldinstr, num) \ ++ e_oldinstr_pad_end ":\n" \ ++ INSTR_LEN_SANITY_CHECK(oldinstr_len) ++ ++#define OLDINSTR_2(oldinstr, num1, num2) \ ++ "661:\n\t" oldinstr "\n662:\n" \ ++ ".if " altinstr_len(num1) " < " altinstr_len(num2) "\n" \ ++ OLDINSTR_PADDING(oldinstr, num2) \ ++ ".else\n" \ ++ OLDINSTR_PADDING(oldinstr, num1) \ ++ ".endif\n" \ ++ e_oldinstr_pad_end ":\n" \ ++ INSTR_LEN_SANITY_CHECK(oldinstr_len) ++ ++#define ALTINSTR_ENTRY(facility, num) \ ++ "\t.long 661b - .\n" /* old instruction */ \ ++ "\t.long " b_altinstr(num)"b - .\n" /* alt instruction */ \ ++ "\t.word " __stringify(facility) "\n" /* facility bit */ \ ++ "\t.byte " oldinstr_total_len "\n" /* source len */ \ ++ "\t.byte " altinstr_len(num) "\n" /* alt instruction len */ ++ ++#define ALTINSTR_REPLACEMENT(altinstr, num) /* replacement */ \ ++ b_altinstr(num)":\n\t" altinstr "\n" e_altinstr(num) ":\n" \ ++ INSTR_LEN_SANITY_CHECK(altinstr_len(num)) ++ ++/* alternative assembly primitive: */ ++#define ALTERNATIVE(oldinstr, altinstr, facility) \ ++ ".pushsection .altinstr_replacement, \"ax\"\n" \ ++ ALTINSTR_REPLACEMENT(altinstr, 1) \ ++ ".popsection\n" \ ++ OLDINSTR(oldinstr, 1) \ ++ ".pushsection .altinstructions,\"a\"\n" \ ++ ALTINSTR_ENTRY(facility, 1) \ ++ ".popsection\n" ++ ++#define ALTERNATIVE_2(oldinstr, altinstr1, facility1, altinstr2, facility2)\ ++ ".pushsection .altinstr_replacement, \"ax\"\n" \ ++ ALTINSTR_REPLACEMENT(altinstr1, 1) \ ++ ALTINSTR_REPLACEMENT(altinstr2, 2) \ ++ ".popsection\n" \ ++ OLDINSTR_2(oldinstr, 1, 2) \ ++ ".pushsection .altinstructions,\"a\"\n" \ ++ ALTINSTR_ENTRY(facility1, 1) \ ++ ALTINSTR_ENTRY(facility2, 2) \ ++ ".popsection\n" ++ ++/* ++ * Alternative instructions for different CPU types or capabilities. ++ * ++ * This allows to use optimized instructions even on generic binary ++ * kernels. ++ * ++ * oldinstr is padded with jump and nops at compile time if altinstr is ++ * longer. altinstr is padded with jump and nops at run-time during patching. ++ * ++ * For non barrier like inlines please define new variants ++ * without volatile and memory clobber. ++ */ ++#define alternative(oldinstr, altinstr, facility) \ ++ asm volatile(ALTERNATIVE(oldinstr, altinstr, facility) : : : "memory") ++ ++#define alternative_2(oldinstr, altinstr1, facility1, altinstr2, facility2) \ ++ asm volatile(ALTERNATIVE_2(oldinstr, altinstr1, facility1, \ ++ altinstr2, facility2) ::: "memory") ++ ++#endif /* __ASSEMBLY__ */ ++ ++#endif /* _ASM_S390_ALTERNATIVE_H */ +diff --git a/arch/s390/include/asm/barrier.h b/arch/s390/include/asm/barrier.h +index 10432607a573..f9eddbca79d2 100644 +--- a/arch/s390/include/asm/barrier.h ++++ b/arch/s390/include/asm/barrier.h +@@ -49,6 +49,30 @@ do { \ + #define __smp_mb__before_atomic() barrier() + #define __smp_mb__after_atomic() barrier() + ++/** ++ * array_index_mask_nospec - generate a mask for array_idx() that is ++ * ~0UL when the bounds check succeeds and 0 otherwise ++ * @index: array element index ++ * @size: number of elements in array ++ */ ++#define array_index_mask_nospec array_index_mask_nospec ++static inline unsigned long array_index_mask_nospec(unsigned long index, ++ unsigned long size) ++{ ++ unsigned long mask; ++ ++ if (__builtin_constant_p(size) && size > 0) { ++ asm(" clgr %2,%1\n" ++ " slbgr %0,%0\n" ++ :"=d" (mask) : "d" (size-1), "d" (index) :"cc"); ++ return mask; ++ } ++ asm(" clgr %1,%2\n" ++ " slbgr %0,%0\n" ++ :"=d" (mask) : "d" (size), "d" (index) :"cc"); ++ return ~mask; ++} ++ + #include + + #endif /* __ASM_BARRIER_H */ +diff --git a/arch/s390/include/asm/facility.h b/arch/s390/include/asm/facility.h +index f040644575b7..2d58478c2745 100644 +--- a/arch/s390/include/asm/facility.h ++++ b/arch/s390/include/asm/facility.h +@@ -15,6 +15,24 @@ + + #define MAX_FACILITY_BIT (sizeof(((struct lowcore *)0)->stfle_fac_list) * 8) + ++static inline void __set_facility(unsigned long nr, void *facilities) ++{ ++ unsigned char *ptr = (unsigned char *) facilities; ++ ++ if (nr >= MAX_FACILITY_BIT) ++ return; ++ ptr[nr >> 3] |= 0x80 >> (nr & 7); ++} ++ ++static inline void __clear_facility(unsigned long nr, void *facilities) ++{ ++ unsigned char *ptr = (unsigned char *) facilities; ++ ++ if (nr >= MAX_FACILITY_BIT) ++ return; ++ ptr[nr >> 3] &= ~(0x80 >> (nr & 7)); ++} ++ + static inline int __test_facility(unsigned long nr, void *facilities) + { + unsigned char *ptr; +diff --git a/arch/s390/include/asm/kvm_host.h b/arch/s390/include/asm/kvm_host.h +index 51375e766e90..d660e784e445 100644 +--- a/arch/s390/include/asm/kvm_host.h ++++ b/arch/s390/include/asm/kvm_host.h +@@ -210,7 +210,8 @@ struct kvm_s390_sie_block { + __u16 ipa; /* 0x0056 */ + __u32 ipb; /* 0x0058 */ + __u32 scaoh; /* 0x005c */ +- __u8 reserved60; /* 0x0060 */ ++#define FPF_BPBC 0x20 ++ __u8 fpf; /* 0x0060 */ + #define ECB_GS 0x40 + #define ECB_TE 0x10 + #define ECB_SRSI 0x04 +diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h +index 917f7344cab6..88a212df0dbc 100644 +--- a/arch/s390/include/asm/lowcore.h ++++ b/arch/s390/include/asm/lowcore.h +@@ -140,7 +140,9 @@ struct lowcore { + /* Per cpu primary space access list */ + __u32 paste[16]; /* 0x0400 */ + +- __u8 pad_0x04c0[0x0e00-0x0440]; /* 0x0440 */ ++ /* br %r1 trampoline */ ++ __u16 br_r1_trampoline; /* 0x0440 */ ++ __u8 pad_0x0442[0x0e00-0x0442]; /* 0x0442 */ + + /* + * 0xe00 contains the address of the IPL Parameter Information +@@ -155,7 +157,8 @@ struct lowcore { + __u8 pad_0x0e20[0x0f00-0x0e20]; /* 0x0e20 */ + + /* Extended facility list */ +- __u64 stfle_fac_list[32]; /* 0x0f00 */ ++ __u64 stfle_fac_list[16]; /* 0x0f00 */ ++ __u64 alt_stfle_fac_list[16]; /* 0x0f80 */ + __u8 pad_0x1000[0x11b0-0x1000]; /* 0x1000 */ + + /* Pointer to the machine check extended save area */ +diff --git a/arch/s390/include/asm/nospec-branch.h b/arch/s390/include/asm/nospec-branch.h +new file mode 100644 +index 000000000000..b4bd8c41e9d3 +--- /dev/null ++++ b/arch/s390/include/asm/nospec-branch.h +@@ -0,0 +1,17 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_S390_EXPOLINE_H ++#define _ASM_S390_EXPOLINE_H ++ ++#ifndef __ASSEMBLY__ ++ ++#include ++ ++extern int nospec_disable; ++ ++void nospec_init_branches(void); ++void nospec_auto_detect(void); ++void nospec_revert(s32 *start, s32 *end); ++ ++#endif /* __ASSEMBLY__ */ ++ ++#endif /* _ASM_S390_EXPOLINE_H */ +diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h +index 9cf92abe23c3..0a39cd102c49 100644 +--- a/arch/s390/include/asm/processor.h ++++ b/arch/s390/include/asm/processor.h +@@ -89,6 +89,7 @@ void cpu_detect_mhz_feature(void); + extern const struct seq_operations cpuinfo_op; + extern int sysctl_ieee_emulation_warnings; + extern void execve_tail(void); ++extern void __bpon(void); + + /* + * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit. +@@ -377,6 +378,9 @@ extern void memcpy_absolute(void *, void *, size_t); + memcpy_absolute(&(dest), &__tmp, sizeof(__tmp)); \ + } while (0) + ++extern int s390_isolate_bp(void); ++extern int s390_isolate_bp_guest(void); ++ + #endif /* __ASSEMBLY__ */ + + #endif /* __ASM_S390_PROCESSOR_H */ +diff --git a/arch/s390/include/asm/thread_info.h b/arch/s390/include/asm/thread_info.h +index 0880a37b6d3b..301b4f70bf31 100644 +--- a/arch/s390/include/asm/thread_info.h ++++ b/arch/s390/include/asm/thread_info.h +@@ -60,6 +60,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src); + #define TIF_GUARDED_STORAGE 4 /* load guarded storage control block */ + #define TIF_PATCH_PENDING 5 /* pending live patching update */ + #define TIF_PGSTE 6 /* New mm's will use 4K page tables */ ++#define TIF_ISOLATE_BP 8 /* Run process with isolated BP */ ++#define TIF_ISOLATE_BP_GUEST 9 /* Run KVM guests with isolated BP */ + + #define TIF_31BIT 16 /* 32bit process */ + #define TIF_MEMDIE 17 /* is terminating due to OOM killer */ +@@ -80,6 +82,8 @@ int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src); + #define _TIF_UPROBE _BITUL(TIF_UPROBE) + #define _TIF_GUARDED_STORAGE _BITUL(TIF_GUARDED_STORAGE) + #define _TIF_PATCH_PENDING _BITUL(TIF_PATCH_PENDING) ++#define _TIF_ISOLATE_BP _BITUL(TIF_ISOLATE_BP) ++#define _TIF_ISOLATE_BP_GUEST _BITUL(TIF_ISOLATE_BP_GUEST) + + #define _TIF_31BIT _BITUL(TIF_31BIT) + #define _TIF_SINGLE_STEP _BITUL(TIF_SINGLE_STEP) +diff --git a/arch/s390/include/uapi/asm/kvm.h b/arch/s390/include/uapi/asm/kvm.h +index 9ad172dcd912..a3938db010f7 100644 +--- a/arch/s390/include/uapi/asm/kvm.h ++++ b/arch/s390/include/uapi/asm/kvm.h +@@ -228,6 +228,7 @@ struct kvm_guest_debug_arch { + #define KVM_SYNC_RICCB (1UL << 7) + #define KVM_SYNC_FPRS (1UL << 8) + #define KVM_SYNC_GSCB (1UL << 9) ++#define KVM_SYNC_BPBC (1UL << 10) + /* length and alignment of the sdnx as a power of two */ + #define SDNXC 8 + #define SDNXL (1UL << SDNXC) +@@ -251,7 +252,9 @@ struct kvm_sync_regs { + }; + __u8 reserved[512]; /* for future vector expansion */ + __u32 fpc; /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */ +- __u8 padding1[52]; /* riccb needs to be 64byte aligned */ ++ __u8 bpbc : 1; /* bp mode */ ++ __u8 reserved2 : 7; ++ __u8 padding1[51]; /* riccb needs to be 64byte aligned */ + __u8 riccb[64]; /* runtime instrumentation controls block */ + __u8 padding2[192]; /* sdnx needs to be 256byte aligned */ + union { +diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile +index 4ce2d05929a7..a3a4cafb6080 100644 +--- a/arch/s390/kernel/Makefile ++++ b/arch/s390/kernel/Makefile +@@ -29,6 +29,7 @@ UBSAN_SANITIZE_early.o := n + # + ifneq ($(CC_FLAGS_MARCH),-march=z900) + CFLAGS_REMOVE_als.o += $(CC_FLAGS_MARCH) ++CFLAGS_REMOVE_als.o += $(CC_FLAGS_EXPOLINE) + CFLAGS_als.o += -march=z900 + AFLAGS_REMOVE_head.o += $(CC_FLAGS_MARCH) + AFLAGS_head.o += -march=z900 +@@ -57,10 +58,13 @@ obj-y += processor.o sys_s390.o ptrace.o signal.o cpcmd.o ebcdic.o nmi.o + obj-y += debug.o irq.o ipl.o dis.o diag.o vdso.o als.o + obj-y += sysinfo.o jump_label.o lgr.o os_info.o machine_kexec.o pgm_check.o + obj-y += runtime_instr.o cache.o fpu.o dumpstack.o guarded_storage.o +-obj-y += entry.o reipl.o relocate_kernel.o kdebugfs.o ++obj-y += entry.o reipl.o relocate_kernel.o kdebugfs.o alternative.o ++obj-y += nospec-branch.o + + extra-y += head.o head64.o vmlinux.lds + ++CFLAGS_REMOVE_nospec-branch.o += $(CC_FLAGS_EXPOLINE) ++ + obj-$(CONFIG_MODULES) += module.o + obj-$(CONFIG_SMP) += smp.o + obj-$(CONFIG_SCHED_TOPOLOGY) += topology.o +diff --git a/arch/s390/kernel/alternative.c b/arch/s390/kernel/alternative.c +new file mode 100644 +index 000000000000..b57b293998dc +--- /dev/null ++++ b/arch/s390/kernel/alternative.c +@@ -0,0 +1,112 @@ ++#include ++#include ++#include ++#include ++ ++#define MAX_PATCH_LEN (255 - 1) ++ ++static int __initdata_or_module alt_instr_disabled; ++ ++static int __init disable_alternative_instructions(char *str) ++{ ++ alt_instr_disabled = 1; ++ return 0; ++} ++ ++early_param("noaltinstr", disable_alternative_instructions); ++ ++struct brcl_insn { ++ u16 opc; ++ s32 disp; ++} __packed; ++ ++static u16 __initdata_or_module nop16 = 0x0700; ++static u32 __initdata_or_module nop32 = 0x47000000; ++static struct brcl_insn __initdata_or_module nop48 = { ++ 0xc004, 0 ++}; ++ ++static const void *nops[] __initdata_or_module = { ++ &nop16, ++ &nop32, ++ &nop48 ++}; ++ ++static void __init_or_module add_jump_padding(void *insns, unsigned int len) ++{ ++ struct brcl_insn brcl = { ++ 0xc0f4, ++ len / 2 ++ }; ++ ++ memcpy(insns, &brcl, sizeof(brcl)); ++ insns += sizeof(brcl); ++ len -= sizeof(brcl); ++ ++ while (len > 0) { ++ memcpy(insns, &nop16, 2); ++ insns += 2; ++ len -= 2; ++ } ++} ++ ++static void __init_or_module add_padding(void *insns, unsigned int len) ++{ ++ if (len > 6) ++ add_jump_padding(insns, len); ++ else if (len >= 2) ++ memcpy(insns, nops[len / 2 - 1], len); ++} ++ ++static void __init_or_module __apply_alternatives(struct alt_instr *start, ++ struct alt_instr *end) ++{ ++ struct alt_instr *a; ++ u8 *instr, *replacement; ++ u8 insnbuf[MAX_PATCH_LEN]; ++ ++ /* ++ * The scan order should be from start to end. A later scanned ++ * alternative code can overwrite previously scanned alternative code. ++ */ ++ for (a = start; a < end; a++) { ++ int insnbuf_sz = 0; ++ ++ instr = (u8 *)&a->instr_offset + a->instr_offset; ++ replacement = (u8 *)&a->repl_offset + a->repl_offset; ++ ++ if (!__test_facility(a->facility, ++ S390_lowcore.alt_stfle_fac_list)) ++ continue; ++ ++ if (unlikely(a->instrlen % 2 || a->replacementlen % 2)) { ++ WARN_ONCE(1, "cpu alternatives instructions length is " ++ "odd, skipping patching\n"); ++ continue; ++ } ++ ++ memcpy(insnbuf, replacement, a->replacementlen); ++ insnbuf_sz = a->replacementlen; ++ ++ if (a->instrlen > a->replacementlen) { ++ add_padding(insnbuf + a->replacementlen, ++ a->instrlen - a->replacementlen); ++ insnbuf_sz += a->instrlen - a->replacementlen; ++ } ++ ++ s390_kernel_write(instr, insnbuf, insnbuf_sz); ++ } ++} ++ ++void __init_or_module apply_alternatives(struct alt_instr *start, ++ struct alt_instr *end) ++{ ++ if (!alt_instr_disabled) ++ __apply_alternatives(start, end); ++} ++ ++extern struct alt_instr __alt_instructions[], __alt_instructions_end[]; ++void __init apply_alternative_instructions(void) ++{ ++ apply_alternatives(__alt_instructions, __alt_instructions_end); ++} +diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c +index f7b280f0ab16..a3219837fa70 100644 +--- a/arch/s390/kernel/early.c ++++ b/arch/s390/kernel/early.c +@@ -329,6 +329,11 @@ static noinline __init void setup_facility_list(void) + { + stfle(S390_lowcore.stfle_fac_list, + ARRAY_SIZE(S390_lowcore.stfle_fac_list)); ++ memcpy(S390_lowcore.alt_stfle_fac_list, ++ S390_lowcore.stfle_fac_list, ++ sizeof(S390_lowcore.alt_stfle_fac_list)); ++ if (!IS_ENABLED(CONFIG_KERNEL_NOBP)) ++ __clear_facility(82, S390_lowcore.alt_stfle_fac_list); + } + + static __init void detect_diag9c(void) +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index 7c6904d616d8..ed9aaa212d4a 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -106,6 +106,7 @@ _PIF_WORK = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART) + aghi %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE) + j 3f + 1: UPDATE_VTIME %r14,%r15,\timer ++ BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP + 2: lg %r15,__LC_ASYNC_STACK # load async stack + 3: la %r11,STACK_FRAME_OVERHEAD(%r15) + .endm +@@ -158,6 +159,130 @@ _PIF_WORK = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART) + tm off+\addr, \mask + .endm + ++ .macro BPOFF ++ .pushsection .altinstr_replacement, "ax" ++660: .long 0xb2e8c000 ++ .popsection ++661: .long 0x47000000 ++ .pushsection .altinstructions, "a" ++ .long 661b - . ++ .long 660b - . ++ .word 82 ++ .byte 4 ++ .byte 4 ++ .popsection ++ .endm ++ ++ .macro BPON ++ .pushsection .altinstr_replacement, "ax" ++662: .long 0xb2e8d000 ++ .popsection ++663: .long 0x47000000 ++ .pushsection .altinstructions, "a" ++ .long 663b - . ++ .long 662b - . ++ .word 82 ++ .byte 4 ++ .byte 4 ++ .popsection ++ .endm ++ ++ .macro BPENTER tif_ptr,tif_mask ++ .pushsection .altinstr_replacement, "ax" ++662: .word 0xc004, 0x0000, 0x0000 # 6 byte nop ++ .word 0xc004, 0x0000, 0x0000 # 6 byte nop ++ .popsection ++664: TSTMSK \tif_ptr,\tif_mask ++ jz . + 8 ++ .long 0xb2e8d000 ++ .pushsection .altinstructions, "a" ++ .long 664b - . ++ .long 662b - . ++ .word 82 ++ .byte 12 ++ .byte 12 ++ .popsection ++ .endm ++ ++ .macro BPEXIT tif_ptr,tif_mask ++ TSTMSK \tif_ptr,\tif_mask ++ .pushsection .altinstr_replacement, "ax" ++662: jnz . + 8 ++ .long 0xb2e8d000 ++ .popsection ++664: jz . + 8 ++ .long 0xb2e8c000 ++ .pushsection .altinstructions, "a" ++ .long 664b - . ++ .long 662b - . ++ .word 82 ++ .byte 8 ++ .byte 8 ++ .popsection ++ .endm ++ ++#ifdef CONFIG_EXPOLINE ++ ++ .macro GEN_BR_THUNK name,reg,tmp ++ .section .text.\name,"axG",@progbits,\name,comdat ++ .globl \name ++ .hidden \name ++ .type \name,@function ++\name: ++ .cfi_startproc ++#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES ++ exrl 0,0f ++#else ++ larl \tmp,0f ++ ex 0,0(\tmp) ++#endif ++ j . ++0: br \reg ++ .cfi_endproc ++ .endm ++ ++ GEN_BR_THUNK __s390x_indirect_jump_r1use_r9,%r9,%r1 ++ GEN_BR_THUNK __s390x_indirect_jump_r1use_r14,%r14,%r1 ++ GEN_BR_THUNK __s390x_indirect_jump_r11use_r14,%r14,%r11 ++ ++ .macro BASR_R14_R9 ++0: brasl %r14,__s390x_indirect_jump_r1use_r9 ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 0b-. ++ .popsection ++ .endm ++ ++ .macro BR_R1USE_R14 ++0: jg __s390x_indirect_jump_r1use_r14 ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 0b-. ++ .popsection ++ .endm ++ ++ .macro BR_R11USE_R14 ++0: jg __s390x_indirect_jump_r11use_r14 ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 0b-. ++ .popsection ++ .endm ++ ++#else /* CONFIG_EXPOLINE */ ++ ++ .macro BASR_R14_R9 ++ basr %r14,%r9 ++ .endm ++ ++ .macro BR_R1USE_R14 ++ br %r14 ++ .endm ++ ++ .macro BR_R11USE_R14 ++ br %r14 ++ .endm ++ ++#endif /* CONFIG_EXPOLINE */ ++ ++ + .section .kprobes.text, "ax" + .Ldummy: + /* +@@ -170,6 +295,11 @@ _PIF_WORK = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART) + */ + nop 0 + ++ENTRY(__bpon) ++ .globl __bpon ++ BPON ++ BR_R1USE_R14 ++ + /* + * Scheduler resume function, called by switch_to + * gpr2 = (task_struct *) prev +@@ -193,9 +323,9 @@ ENTRY(__switch_to) + mvc __LC_CURRENT_PID(4,%r0),__TASK_pid(%r3) # store pid of next + lmg %r6,%r15,__SF_GPRS(%r15) # load gprs of next task + TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_LPP +- bzr %r14 ++ jz 0f + .insn s,0xb2800000,__LC_LPP # set program parameter +- br %r14 ++0: BR_R1USE_R14 + + .L__critical_start: + +@@ -207,9 +337,11 @@ ENTRY(__switch_to) + */ + ENTRY(sie64a) + stmg %r6,%r14,__SF_GPRS(%r15) # save kernel registers ++ lg %r12,__LC_CURRENT + stg %r2,__SF_EMPTY(%r15) # save control block pointer + stg %r3,__SF_EMPTY+8(%r15) # save guest register save area + xc __SF_EMPTY+16(8,%r15),__SF_EMPTY+16(%r15) # reason code = 0 ++ mvc __SF_EMPTY+24(8,%r15),__TI_flags(%r12) # copy thread flags + TSTMSK __LC_CPU_FLAGS,_CIF_FPU # load guest fp/vx registers ? + jno .Lsie_load_guest_gprs + brasl %r14,load_fpu_regs # load guest fp/vx regs +@@ -226,8 +358,12 @@ ENTRY(sie64a) + jnz .Lsie_skip + TSTMSK __LC_CPU_FLAGS,_CIF_FPU + jo .Lsie_skip # exit if fp/vx regs changed ++ BPEXIT __SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST) + .Lsie_entry: + sie 0(%r14) ++.Lsie_exit: ++ BPOFF ++ BPENTER __SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST) + .Lsie_skip: + ni __SIE_PROG0C+3(%r14),0xfe # no longer in SIE + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce +@@ -248,9 +384,15 @@ ENTRY(sie64a) + sie_exit: + lg %r14,__SF_EMPTY+8(%r15) # load guest register save area + stmg %r0,%r13,0(%r14) # save guest gprs 0-13 ++ xgr %r0,%r0 # clear guest registers to ++ xgr %r1,%r1 # prevent speculative use ++ xgr %r2,%r2 ++ xgr %r3,%r3 ++ xgr %r4,%r4 ++ xgr %r5,%r5 + lmg %r6,%r14,__SF_GPRS(%r15) # restore kernel registers + lg %r2,__SF_EMPTY+16(%r15) # return exit reason code +- br %r14 ++ BR_R1USE_R14 + .Lsie_fault: + lghi %r14,-EFAULT + stg %r14,__SF_EMPTY+16(%r15) # set exit reason code +@@ -273,6 +415,7 @@ ENTRY(system_call) + stpt __LC_SYNC_ENTER_TIMER + .Lsysc_stmg: + stmg %r8,%r15,__LC_SAVE_AREA_SYNC ++ BPOFF + lg %r12,__LC_CURRENT + lghi %r13,__TASK_thread + lghi %r14,_PIF_SYSCALL +@@ -281,12 +424,15 @@ ENTRY(system_call) + la %r11,STACK_FRAME_OVERHEAD(%r15) # pointer to pt_regs + .Lsysc_vtime: + UPDATE_VTIME %r8,%r9,__LC_SYNC_ENTER_TIMER ++ BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP + stmg %r0,%r7,__PT_R0(%r11) + mvc __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC + mvc __PT_PSW(16,%r11),__LC_SVC_OLD_PSW + mvc __PT_INT_CODE(4,%r11),__LC_SVC_ILC + stg %r14,__PT_FLAGS(%r11) + .Lsysc_do_svc: ++ # clear user controlled register to prevent speculative use ++ xgr %r0,%r0 + # load address of system call table + lg %r10,__THREAD_sysc_table(%r13,%r12) + llgh %r8,__PT_INT_CODE+2(%r11) +@@ -305,7 +451,7 @@ ENTRY(system_call) + lgf %r9,0(%r8,%r10) # get system call add. + TSTMSK __TI_flags(%r12),_TIF_TRACE + jnz .Lsysc_tracesys +- basr %r14,%r9 # call sys_xxxx ++ BASR_R14_R9 # call sys_xxxx + stg %r2,__PT_R2(%r11) # store return value + + .Lsysc_return: +@@ -317,6 +463,7 @@ ENTRY(system_call) + jnz .Lsysc_work # check for work + TSTMSK __LC_CPU_FLAGS,_CIF_WORK + jnz .Lsysc_work ++ BPEXIT __TI_flags(%r12),_TIF_ISOLATE_BP + .Lsysc_restore: + lg %r14,__LC_VDSO_PER_CPU + lmg %r0,%r10,__PT_R0(%r11) +@@ -481,7 +628,7 @@ ENTRY(system_call) + lmg %r3,%r7,__PT_R3(%r11) + stg %r7,STACK_FRAME_OVERHEAD(%r15) + lg %r2,__PT_ORIG_GPR2(%r11) +- basr %r14,%r9 # call sys_xxx ++ BASR_R14_R9 # call sys_xxx + stg %r2,__PT_R2(%r11) # store return value + .Lsysc_tracenogo: + TSTMSK __TI_flags(%r12),_TIF_TRACE +@@ -505,7 +652,7 @@ ENTRY(ret_from_fork) + lmg %r9,%r10,__PT_R9(%r11) # load gprs + ENTRY(kernel_thread_starter) + la %r2,0(%r10) +- basr %r14,%r9 ++ BASR_R14_R9 + j .Lsysc_tracenogo + + /* +@@ -514,6 +661,7 @@ ENTRY(kernel_thread_starter) + + ENTRY(pgm_check_handler) + stpt __LC_SYNC_ENTER_TIMER ++ BPOFF + stmg %r8,%r15,__LC_SAVE_AREA_SYNC + lg %r10,__LC_LAST_BREAK + lg %r12,__LC_CURRENT +@@ -540,6 +688,7 @@ ENTRY(pgm_check_handler) + aghi %r15,-(STACK_FRAME_OVERHEAD + __PT_SIZE) + j 4f + 2: UPDATE_VTIME %r14,%r15,__LC_SYNC_ENTER_TIMER ++ BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP + lg %r15,__LC_KERNEL_STACK + lgr %r14,%r12 + aghi %r14,__TASK_thread # pointer to thread_struct +@@ -550,6 +699,15 @@ ENTRY(pgm_check_handler) + 3: stg %r10,__THREAD_last_break(%r14) + 4: la %r11,STACK_FRAME_OVERHEAD(%r15) + stmg %r0,%r7,__PT_R0(%r11) ++ # clear user controlled registers to prevent speculative use ++ xgr %r0,%r0 ++ xgr %r1,%r1 ++ xgr %r2,%r2 ++ xgr %r3,%r3 ++ xgr %r4,%r4 ++ xgr %r5,%r5 ++ xgr %r6,%r6 ++ xgr %r7,%r7 + mvc __PT_R8(64,%r11),__LC_SAVE_AREA_SYNC + stmg %r8,%r9,__PT_PSW(%r11) + mvc __PT_INT_CODE(4,%r11),__LC_PGM_ILC +@@ -571,9 +729,9 @@ ENTRY(pgm_check_handler) + nill %r10,0x007f + sll %r10,2 + je .Lpgm_return +- lgf %r1,0(%r10,%r1) # load address of handler routine ++ lgf %r9,0(%r10,%r1) # load address of handler routine + lgr %r2,%r11 # pass pointer to pt_regs +- basr %r14,%r1 # branch to interrupt-handler ++ BASR_R14_R9 # branch to interrupt-handler + .Lpgm_return: + LOCKDEP_SYS_EXIT + tm __PT_PSW+1(%r11),0x01 # returning to user ? +@@ -609,12 +767,23 @@ ENTRY(pgm_check_handler) + ENTRY(io_int_handler) + STCK __LC_INT_CLOCK + stpt __LC_ASYNC_ENTER_TIMER ++ BPOFF + stmg %r8,%r15,__LC_SAVE_AREA_ASYNC + lg %r12,__LC_CURRENT + larl %r13,cleanup_critical + lmg %r8,%r9,__LC_IO_OLD_PSW + SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER + stmg %r0,%r7,__PT_R0(%r11) ++ # clear user controlled registers to prevent speculative use ++ xgr %r0,%r0 ++ xgr %r1,%r1 ++ xgr %r2,%r2 ++ xgr %r3,%r3 ++ xgr %r4,%r4 ++ xgr %r5,%r5 ++ xgr %r6,%r6 ++ xgr %r7,%r7 ++ xgr %r10,%r10 + mvc __PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC + stmg %r8,%r9,__PT_PSW(%r11) + mvc __PT_INT_CODE(12,%r11),__LC_SUBCHANNEL_ID +@@ -649,9 +818,13 @@ ENTRY(io_int_handler) + lg %r14,__LC_VDSO_PER_CPU + lmg %r0,%r10,__PT_R0(%r11) + mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) ++ tm __PT_PSW+1(%r11),0x01 # returning to user ? ++ jno .Lio_exit_kernel ++ BPEXIT __TI_flags(%r12),_TIF_ISOLATE_BP + .Lio_exit_timer: + stpt __LC_EXIT_TIMER + mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER ++.Lio_exit_kernel: + lmg %r11,%r15,__PT_R11(%r11) + lpswe __LC_RETURN_PSW + .Lio_done: +@@ -814,12 +987,23 @@ ENTRY(io_int_handler) + ENTRY(ext_int_handler) + STCK __LC_INT_CLOCK + stpt __LC_ASYNC_ENTER_TIMER ++ BPOFF + stmg %r8,%r15,__LC_SAVE_AREA_ASYNC + lg %r12,__LC_CURRENT + larl %r13,cleanup_critical + lmg %r8,%r9,__LC_EXT_OLD_PSW + SWITCH_ASYNC __LC_SAVE_AREA_ASYNC,__LC_ASYNC_ENTER_TIMER + stmg %r0,%r7,__PT_R0(%r11) ++ # clear user controlled registers to prevent speculative use ++ xgr %r0,%r0 ++ xgr %r1,%r1 ++ xgr %r2,%r2 ++ xgr %r3,%r3 ++ xgr %r4,%r4 ++ xgr %r5,%r5 ++ xgr %r6,%r6 ++ xgr %r7,%r7 ++ xgr %r10,%r10 + mvc __PT_R8(64,%r11),__LC_SAVE_AREA_ASYNC + stmg %r8,%r9,__PT_PSW(%r11) + lghi %r1,__LC_EXT_PARAMS2 +@@ -852,11 +1036,12 @@ ENTRY(psw_idle) + .Lpsw_idle_stcctm: + #endif + oi __LC_CPU_FLAGS+7,_CIF_ENABLED_WAIT ++ BPON + STCK __CLOCK_IDLE_ENTER(%r2) + stpt __TIMER_IDLE_ENTER(%r2) + .Lpsw_idle_lpsw: + lpswe __SF_EMPTY(%r15) +- br %r14 ++ BR_R1USE_R14 + .Lpsw_idle_end: + + /* +@@ -870,7 +1055,7 @@ ENTRY(save_fpu_regs) + lg %r2,__LC_CURRENT + aghi %r2,__TASK_thread + TSTMSK __LC_CPU_FLAGS,_CIF_FPU +- bor %r14 ++ jo .Lsave_fpu_regs_exit + stfpc __THREAD_FPU_fpc(%r2) + lg %r3,__THREAD_FPU_regs(%r2) + TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX +@@ -897,7 +1082,8 @@ ENTRY(save_fpu_regs) + std 15,120(%r3) + .Lsave_fpu_regs_done: + oi __LC_CPU_FLAGS+7,_CIF_FPU +- br %r14 ++.Lsave_fpu_regs_exit: ++ BR_R1USE_R14 + .Lsave_fpu_regs_end: + EXPORT_SYMBOL(save_fpu_regs) + +@@ -915,7 +1101,7 @@ load_fpu_regs: + lg %r4,__LC_CURRENT + aghi %r4,__TASK_thread + TSTMSK __LC_CPU_FLAGS,_CIF_FPU +- bnor %r14 ++ jno .Lload_fpu_regs_exit + lfpc __THREAD_FPU_fpc(%r4) + TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_VX + lg %r4,__THREAD_FPU_regs(%r4) # %r4 <- reg save area +@@ -942,7 +1128,8 @@ load_fpu_regs: + ld 15,120(%r4) + .Lload_fpu_regs_done: + ni __LC_CPU_FLAGS+7,255-_CIF_FPU +- br %r14 ++.Lload_fpu_regs_exit: ++ BR_R1USE_R14 + .Lload_fpu_regs_end: + + .L__critical_end: +@@ -952,6 +1139,7 @@ load_fpu_regs: + */ + ENTRY(mcck_int_handler) + STCK __LC_MCCK_CLOCK ++ BPOFF + la %r1,4095 # revalidate r1 + spt __LC_CPU_TIMER_SAVE_AREA-4095(%r1) # revalidate cpu timer + lmg %r0,%r15,__LC_GPREGS_SAVE_AREA-4095(%r1)# revalidate gprs +@@ -982,6 +1170,16 @@ ENTRY(mcck_int_handler) + .Lmcck_skip: + lghi %r14,__LC_GPREGS_SAVE_AREA+64 + stmg %r0,%r7,__PT_R0(%r11) ++ # clear user controlled registers to prevent speculative use ++ xgr %r0,%r0 ++ xgr %r1,%r1 ++ xgr %r2,%r2 ++ xgr %r3,%r3 ++ xgr %r4,%r4 ++ xgr %r5,%r5 ++ xgr %r6,%r6 ++ xgr %r7,%r7 ++ xgr %r10,%r10 + mvc __PT_R8(64,%r11),0(%r14) + stmg %r8,%r9,__PT_PSW(%r11) + xc __PT_FLAGS(8,%r11),__PT_FLAGS(%r11) +@@ -1007,6 +1205,7 @@ ENTRY(mcck_int_handler) + mvc __LC_RETURN_MCCK_PSW(16),__PT_PSW(%r11) # move return PSW + tm __LC_RETURN_MCCK_PSW+1,0x01 # returning to user ? + jno 0f ++ BPEXIT __TI_flags(%r12),_TIF_ISOLATE_BP + stpt __LC_EXIT_TIMER + mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER + 0: lmg %r11,%r15,__PT_R11(%r11) +@@ -1102,7 +1301,7 @@ cleanup_critical: + jl 0f + clg %r9,BASED(.Lcleanup_table+104) # .Lload_fpu_regs_end + jl .Lcleanup_load_fpu_regs +-0: br %r14 ++0: BR_R11USE_R14 + + .align 8 + .Lcleanup_table: +@@ -1133,11 +1332,12 @@ cleanup_critical: + clg %r9,BASED(.Lsie_crit_mcck_length) + jh 1f + oi __LC_CPU_FLAGS+7, _CIF_MCCK_GUEST +-1: lg %r9,__SF_EMPTY(%r15) # get control block pointer ++1: BPENTER __SF_EMPTY+24(%r15),(_TIF_ISOLATE_BP|_TIF_ISOLATE_BP_GUEST) ++ lg %r9,__SF_EMPTY(%r15) # get control block pointer + ni __SIE_PROG0C+3(%r9),0xfe # no longer in SIE + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce + larl %r9,sie_exit # skip forward to sie_exit +- br %r14 ++ BR_R11USE_R14 + #endif + + .Lcleanup_system_call: +@@ -1175,6 +1375,7 @@ cleanup_critical: + stg %r15,__LC_SYSTEM_TIMER + 0: # update accounting time stamp + mvc __LC_LAST_UPDATE_TIMER(8),__LC_SYNC_ENTER_TIMER ++ BPENTER __TI_flags(%r12),_TIF_ISOLATE_BP + # set up saved register r11 + lg %r15,__LC_KERNEL_STACK + la %r9,STACK_FRAME_OVERHEAD(%r15) +@@ -1190,7 +1391,7 @@ cleanup_critical: + stg %r15,56(%r11) # r15 stack pointer + # set new psw address and exit + larl %r9,.Lsysc_do_svc +- br %r14 ++ BR_R11USE_R14 + .Lcleanup_system_call_insn: + .quad system_call + .quad .Lsysc_stmg +@@ -1202,7 +1403,7 @@ cleanup_critical: + + .Lcleanup_sysc_tif: + larl %r9,.Lsysc_tif +- br %r14 ++ BR_R11USE_R14 + + .Lcleanup_sysc_restore: + # check if stpt has been executed +@@ -1219,14 +1420,14 @@ cleanup_critical: + mvc 0(64,%r11),__PT_R8(%r9) + lmg %r0,%r7,__PT_R0(%r9) + 1: lmg %r8,%r9,__LC_RETURN_PSW +- br %r14 ++ BR_R11USE_R14 + .Lcleanup_sysc_restore_insn: + .quad .Lsysc_exit_timer + .quad .Lsysc_done - 4 + + .Lcleanup_io_tif: + larl %r9,.Lio_tif +- br %r14 ++ BR_R11USE_R14 + + .Lcleanup_io_restore: + # check if stpt has been executed +@@ -1240,7 +1441,7 @@ cleanup_critical: + mvc 0(64,%r11),__PT_R8(%r9) + lmg %r0,%r7,__PT_R0(%r9) + 1: lmg %r8,%r9,__LC_RETURN_PSW +- br %r14 ++ BR_R11USE_R14 + .Lcleanup_io_restore_insn: + .quad .Lio_exit_timer + .quad .Lio_done - 4 +@@ -1293,17 +1494,17 @@ cleanup_critical: + # prepare return psw + nihh %r8,0xfcfd # clear irq & wait state bits + lg %r9,48(%r11) # return from psw_idle +- br %r14 ++ BR_R11USE_R14 + .Lcleanup_idle_insn: + .quad .Lpsw_idle_lpsw + + .Lcleanup_save_fpu_regs: + larl %r9,save_fpu_regs +- br %r14 ++ BR_R11USE_R14 + + .Lcleanup_load_fpu_regs: + larl %r9,load_fpu_regs +- br %r14 ++ BR_R11USE_R14 + + /* + * Integer constants +@@ -1323,7 +1524,6 @@ cleanup_critical: + .Lsie_crit_mcck_length: + .quad .Lsie_skip - .Lsie_entry + #endif +- + .section .rodata, "a" + #define SYSCALL(esame,emu) .long esame + .globl sys_call_table +diff --git a/arch/s390/kernel/ipl.c b/arch/s390/kernel/ipl.c +index d1a0e2c521d7..b565e784bae8 100644 +--- a/arch/s390/kernel/ipl.c ++++ b/arch/s390/kernel/ipl.c +@@ -564,6 +564,7 @@ static struct kset *ipl_kset; + + static void __ipl_run(void *unused) + { ++ __bpon(); + diag308(DIAG308_LOAD_CLEAR, NULL); + if (MACHINE_IS_VM) + __cpcmd("IPL", NULL, 0, NULL); +diff --git a/arch/s390/kernel/module.c b/arch/s390/kernel/module.c +index 1a27f307a920..b441e069e674 100644 +--- a/arch/s390/kernel/module.c ++++ b/arch/s390/kernel/module.c +@@ -31,6 +31,9 @@ + #include + #include + #include ++#include ++#include ++#include + + #if 0 + #define DEBUGP printk +@@ -168,7 +171,11 @@ int module_frob_arch_sections(Elf_Ehdr *hdr, Elf_Shdr *sechdrs, + me->arch.got_offset = me->core_layout.size; + me->core_layout.size += me->arch.got_size; + me->arch.plt_offset = me->core_layout.size; +- me->core_layout.size += me->arch.plt_size; ++ if (me->arch.plt_size) { ++ if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) ++ me->arch.plt_size += PLT_ENTRY_SIZE; ++ me->core_layout.size += me->arch.plt_size; ++ } + return 0; + } + +@@ -322,9 +329,20 @@ static int apply_rela(Elf_Rela *rela, Elf_Addr base, Elf_Sym *symtab, + unsigned int *ip; + ip = me->core_layout.base + me->arch.plt_offset + + info->plt_offset; +- ip[0] = 0x0d10e310; /* basr 1,0; lg 1,10(1); br 1 */ +- ip[1] = 0x100a0004; +- ip[2] = 0x07f10000; ++ ip[0] = 0x0d10e310; /* basr 1,0 */ ++ ip[1] = 0x100a0004; /* lg 1,10(1) */ ++ if (IS_ENABLED(CONFIG_EXPOLINE) && !nospec_disable) { ++ unsigned int *ij; ++ ij = me->core_layout.base + ++ me->arch.plt_offset + ++ me->arch.plt_size - PLT_ENTRY_SIZE; ++ ip[2] = 0xa7f40000 + /* j __jump_r1 */ ++ (unsigned int)(u16) ++ (((unsigned long) ij - 8 - ++ (unsigned long) ip) / 2); ++ } else { ++ ip[2] = 0x07f10000; /* br %r1 */ ++ } + ip[3] = (unsigned int) (val >> 32); + ip[4] = (unsigned int) val; + info->plt_initialized = 1; +@@ -429,6 +447,45 @@ int module_finalize(const Elf_Ehdr *hdr, + const Elf_Shdr *sechdrs, + struct module *me) + { ++ const Elf_Shdr *s; ++ char *secstrings, *secname; ++ void *aseg; ++ ++ if (IS_ENABLED(CONFIG_EXPOLINE) && ++ !nospec_disable && me->arch.plt_size) { ++ unsigned int *ij; ++ ++ ij = me->core_layout.base + me->arch.plt_offset + ++ me->arch.plt_size - PLT_ENTRY_SIZE; ++ if (test_facility(35)) { ++ ij[0] = 0xc6000000; /* exrl %r0,.+10 */ ++ ij[1] = 0x0005a7f4; /* j . */ ++ ij[2] = 0x000007f1; /* br %r1 */ ++ } else { ++ ij[0] = 0x44000000 | (unsigned int) ++ offsetof(struct lowcore, br_r1_trampoline); ++ ij[1] = 0xa7f40000; /* j . */ ++ } ++ } ++ ++ secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset; ++ for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { ++ aseg = (void *) s->sh_addr; ++ secname = secstrings + s->sh_name; ++ ++ if (!strcmp(".altinstructions", secname)) ++ /* patch .altinstructions */ ++ apply_alternatives(aseg, aseg + s->sh_size); ++ ++ if (IS_ENABLED(CONFIG_EXPOLINE) && ++ (!strncmp(".s390_indirect", secname, 14))) ++ nospec_revert(aseg, aseg + s->sh_size); ++ ++ if (IS_ENABLED(CONFIG_EXPOLINE) && ++ (!strncmp(".s390_return", secname, 12))) ++ nospec_revert(aseg, aseg + s->sh_size); ++ } ++ + jump_label_apply_nops(me); + return 0; + } +diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c +new file mode 100644 +index 000000000000..9f3b5b382743 +--- /dev/null ++++ b/arch/s390/kernel/nospec-branch.c +@@ -0,0 +1,169 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++#include ++#include ++#include ++ ++static int __init nobp_setup_early(char *str) ++{ ++ bool enabled; ++ int rc; ++ ++ rc = kstrtobool(str, &enabled); ++ if (rc) ++ return rc; ++ if (enabled && test_facility(82)) { ++ /* ++ * The user explicitely requested nobp=1, enable it and ++ * disable the expoline support. ++ */ ++ __set_facility(82, S390_lowcore.alt_stfle_fac_list); ++ if (IS_ENABLED(CONFIG_EXPOLINE)) ++ nospec_disable = 1; ++ } else { ++ __clear_facility(82, S390_lowcore.alt_stfle_fac_list); ++ } ++ return 0; ++} ++early_param("nobp", nobp_setup_early); ++ ++static int __init nospec_setup_early(char *str) ++{ ++ __clear_facility(82, S390_lowcore.alt_stfle_fac_list); ++ return 0; ++} ++early_param("nospec", nospec_setup_early); ++ ++static int __init nospec_report(void) ++{ ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) ++ pr_info("Spectre V2 mitigation: execute trampolines.\n"); ++ if (__test_facility(82, S390_lowcore.alt_stfle_fac_list)) ++ pr_info("Spectre V2 mitigation: limited branch prediction.\n"); ++ return 0; ++} ++arch_initcall(nospec_report); ++ ++#ifdef CONFIG_SYSFS ++ssize_t cpu_show_spectre_v1(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); ++} ++ ++ssize_t cpu_show_spectre_v2(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) ++ return sprintf(buf, "Mitigation: execute trampolines\n"); ++ if (__test_facility(82, S390_lowcore.alt_stfle_fac_list)) ++ return sprintf(buf, "Mitigation: limited branch prediction.\n"); ++ return sprintf(buf, "Vulnerable\n"); ++} ++#endif ++ ++#ifdef CONFIG_EXPOLINE ++ ++int nospec_disable = IS_ENABLED(CONFIG_EXPOLINE_OFF); ++ ++static int __init nospectre_v2_setup_early(char *str) ++{ ++ nospec_disable = 1; ++ return 0; ++} ++early_param("nospectre_v2", nospectre_v2_setup_early); ++ ++void __init nospec_auto_detect(void) ++{ ++ if (IS_ENABLED(CC_USING_EXPOLINE)) { ++ /* ++ * The kernel has been compiled with expolines. ++ * Keep expolines enabled and disable nobp. ++ */ ++ nospec_disable = 0; ++ __clear_facility(82, S390_lowcore.alt_stfle_fac_list); ++ } ++ /* ++ * If the kernel has not been compiled with expolines the ++ * nobp setting decides what is done, this depends on the ++ * CONFIG_KERNEL_NP option and the nobp/nospec parameters. ++ */ ++} ++ ++static int __init spectre_v2_setup_early(char *str) ++{ ++ if (str && !strncmp(str, "on", 2)) { ++ nospec_disable = 0; ++ __clear_facility(82, S390_lowcore.alt_stfle_fac_list); ++ } ++ if (str && !strncmp(str, "off", 3)) ++ nospec_disable = 1; ++ if (str && !strncmp(str, "auto", 4)) ++ nospec_auto_detect(); ++ return 0; ++} ++early_param("spectre_v2", spectre_v2_setup_early); ++ ++static void __init_or_module __nospec_revert(s32 *start, s32 *end) ++{ ++ enum { BRCL_EXPOLINE, BRASL_EXPOLINE } type; ++ u8 *instr, *thunk, *br; ++ u8 insnbuf[6]; ++ s32 *epo; ++ ++ /* Second part of the instruction replace is always a nop */ ++ memcpy(insnbuf + 2, (char[]) { 0x47, 0x00, 0x00, 0x00 }, 4); ++ for (epo = start; epo < end; epo++) { ++ instr = (u8 *) epo + *epo; ++ if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x04) ++ type = BRCL_EXPOLINE; /* brcl instruction */ ++ else if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x05) ++ type = BRASL_EXPOLINE; /* brasl instruction */ ++ else ++ continue; ++ thunk = instr + (*(int *)(instr + 2)) * 2; ++ if (thunk[0] == 0xc6 && thunk[1] == 0x00) ++ /* exrl %r0, */ ++ br = thunk + (*(int *)(thunk + 2)) * 2; ++ else if (thunk[0] == 0xc0 && (thunk[1] & 0x0f) == 0x00 && ++ thunk[6] == 0x44 && thunk[7] == 0x00 && ++ (thunk[8] & 0x0f) == 0x00 && thunk[9] == 0x00 && ++ (thunk[1] & 0xf0) == (thunk[8] & 0xf0)) ++ /* larl %rx, + ex %r0,0(%rx) */ ++ br = thunk + (*(int *)(thunk + 2)) * 2; ++ else ++ continue; ++ if (br[0] != 0x07 || (br[1] & 0xf0) != 0xf0) ++ continue; ++ switch (type) { ++ case BRCL_EXPOLINE: ++ /* brcl to thunk, replace with br + nop */ ++ insnbuf[0] = br[0]; ++ insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f); ++ break; ++ case BRASL_EXPOLINE: ++ /* brasl to thunk, replace with basr + nop */ ++ insnbuf[0] = 0x0d; ++ insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f); ++ break; ++ } ++ ++ s390_kernel_write(instr, insnbuf, 6); ++ } ++} ++ ++void __init_or_module nospec_revert(s32 *start, s32 *end) ++{ ++ if (nospec_disable) ++ __nospec_revert(start, end); ++} ++ ++extern s32 __nospec_call_start[], __nospec_call_end[]; ++extern s32 __nospec_return_start[], __nospec_return_end[]; ++void __init nospec_init_branches(void) ++{ ++ nospec_revert(__nospec_call_start, __nospec_call_end); ++ nospec_revert(__nospec_return_start, __nospec_return_end); ++} ++ ++#endif /* CONFIG_EXPOLINE */ +diff --git a/arch/s390/kernel/processor.c b/arch/s390/kernel/processor.c +index 5362fd868d0d..6fe2e1875058 100644 +--- a/arch/s390/kernel/processor.c ++++ b/arch/s390/kernel/processor.c +@@ -197,3 +197,21 @@ const struct seq_operations cpuinfo_op = { + .stop = c_stop, + .show = show_cpuinfo, + }; ++ ++int s390_isolate_bp(void) ++{ ++ if (!test_facility(82)) ++ return -EOPNOTSUPP; ++ set_thread_flag(TIF_ISOLATE_BP); ++ return 0; ++} ++EXPORT_SYMBOL(s390_isolate_bp); ++ ++int s390_isolate_bp_guest(void) ++{ ++ if (!test_facility(82)) ++ return -EOPNOTSUPP; ++ set_thread_flag(TIF_ISOLATE_BP_GUEST); ++ return 0; ++} ++EXPORT_SYMBOL(s390_isolate_bp_guest); +diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c +index 164a1e16b53e..98c1f7941142 100644 +--- a/arch/s390/kernel/setup.c ++++ b/arch/s390/kernel/setup.c +@@ -66,6 +66,8 @@ + #include + #include + #include ++#include ++#include + #include "entry.h" + + /* +@@ -338,7 +340,9 @@ static void __init setup_lowcore(void) + lc->preempt_count = S390_lowcore.preempt_count; + lc->stfl_fac_list = S390_lowcore.stfl_fac_list; + memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list, +- MAX_FACILITY_BIT/8); ++ sizeof(lc->stfle_fac_list)); ++ memcpy(lc->alt_stfle_fac_list, S390_lowcore.alt_stfle_fac_list, ++ sizeof(lc->alt_stfle_fac_list)); + if (MACHINE_HAS_VX || MACHINE_HAS_GS) { + unsigned long bits, size; + +@@ -381,6 +385,7 @@ static void __init setup_lowcore(void) + #ifdef CONFIG_SMP + lc->spinlock_lockval = arch_spin_lockval(0); + #endif ++ lc->br_r1_trampoline = 0x07f1; /* br %r1 */ + + set_prefix((u32)(unsigned long) lc); + lowcore_ptr[0] = lc; +@@ -892,6 +897,9 @@ void __init setup_arch(char **cmdline_p) + init_mm.end_data = (unsigned long) &_edata; + init_mm.brk = (unsigned long) &_end; + ++ if (IS_ENABLED(CONFIG_EXPOLINE_AUTO)) ++ nospec_auto_detect(); ++ + parse_early_param(); + #ifdef CONFIG_CRASH_DUMP + /* Deactivate elfcorehdr= kernel parameter */ +@@ -955,6 +963,10 @@ void __init setup_arch(char **cmdline_p) + conmode_default(); + set_preferred_console(); + ++ apply_alternative_instructions(); ++ if (IS_ENABLED(CONFIG_EXPOLINE)) ++ nospec_init_branches(); ++ + /* Setup zfcpdump support */ + setup_zfcpdump(); + +diff --git a/arch/s390/kernel/smp.c b/arch/s390/kernel/smp.c +index 7ffaf9fd6d19..ae5df4177803 100644 +--- a/arch/s390/kernel/smp.c ++++ b/arch/s390/kernel/smp.c +@@ -228,6 +228,7 @@ static int pcpu_alloc_lowcore(struct pcpu *pcpu, int cpu) + lc->mcesad = mcesa_origin | mcesa_bits; + lc->cpu_nr = cpu; + lc->spinlock_lockval = arch_spin_lockval(cpu); ++ lc->br_r1_trampoline = 0x07f1; /* br %r1 */ + if (vdso_alloc_per_cpu(lc)) + goto out; + lowcore_ptr[cpu] = lc; +@@ -282,7 +283,9 @@ static void pcpu_prepare_secondary(struct pcpu *pcpu, int cpu) + __ctl_store(lc->cregs_save_area, 0, 15); + save_access_regs((unsigned int *) lc->access_regs_save_area); + memcpy(lc->stfle_fac_list, S390_lowcore.stfle_fac_list, +- MAX_FACILITY_BIT/8); ++ sizeof(lc->stfle_fac_list)); ++ memcpy(lc->alt_stfle_fac_list, S390_lowcore.alt_stfle_fac_list, ++ sizeof(lc->alt_stfle_fac_list)); + } + + static void pcpu_attach_task(struct pcpu *pcpu, struct task_struct *tsk) +@@ -332,6 +335,7 @@ static void pcpu_delegate(struct pcpu *pcpu, void (*func)(void *), + mem_assign_absolute(lc->restart_fn, (unsigned long) func); + mem_assign_absolute(lc->restart_data, (unsigned long) data); + mem_assign_absolute(lc->restart_source, source_cpu); ++ __bpon(); + asm volatile( + "0: sigp 0,%0,%2 # sigp restart to target cpu\n" + " brc 2,0b # busy, try again\n" +@@ -907,6 +911,7 @@ void __cpu_die(unsigned int cpu) + void __noreturn cpu_die(void) + { + idle_task_exit(); ++ __bpon(); + pcpu_sigp_retry(pcpu_devices + smp_processor_id(), SIGP_STOP, 0); + for (;;) ; + } +diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c +index d9d1f512f019..5007fac01bb5 100644 +--- a/arch/s390/kernel/uprobes.c ++++ b/arch/s390/kernel/uprobes.c +@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline, + return orig; + } + ++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx, ++ struct pt_regs *regs) ++{ ++ if (ctx == RP_CHECK_CHAIN_CALL) ++ return user_stack_pointer(regs) <= ret->stack; ++ else ++ return user_stack_pointer(regs) < ret->stack; ++} ++ + /* Instruction Emulation */ + + static void adjust_psw_addr(psw_t *psw, unsigned long len) +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index 96a713a470e7..85dd3c7bdd86 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -105,6 +105,43 @@ SECTIONS + EXIT_DATA + } + ++ /* ++ * struct alt_inst entries. From the header (alternative.h): ++ * "Alternative instructions for different CPU types or capabilities" ++ * Think locking instructions on spinlocks. ++ * Note, that it is a part of __init region. ++ */ ++ . = ALIGN(8); ++ .altinstructions : { ++ __alt_instructions = .; ++ *(.altinstructions) ++ __alt_instructions_end = .; ++ } ++ ++ /* ++ * And here are the replacement instructions. The linker sticks ++ * them as binary blobs. The .altinstructions has enough data to ++ * get the address and the length of them to patch the kernel safely. ++ * Note, that it is a part of __init region. ++ */ ++ .altinstr_replacement : { ++ *(.altinstr_replacement) ++ } ++ ++ /* ++ * Table with the patch locations to undo expolines ++ */ ++ .nospec_call_table : { ++ __nospec_call_start = . ; ++ *(.s390_indirect*) ++ __nospec_call_end = . ; ++ } ++ .nospec_return_table : { ++ __nospec_return_start = . ; ++ *(.s390_return*) ++ __nospec_return_end = . ; ++ } ++ + /* early.c uses stsi, which requires page aligned data. */ + . = ALIGN(PAGE_SIZE); + INIT_DATA_SECTION(0x100) +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c +index 0bce918db11a..4f6adbea592b 100644 +--- a/arch/s390/kvm/kvm-s390.c ++++ b/arch/s390/kvm/kvm-s390.c +@@ -449,6 +449,9 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) + case KVM_CAP_S390_GS: + r = test_facility(133); + break; ++ case KVM_CAP_S390_BPB: ++ r = test_facility(82); ++ break; + default: + r = 0; + } +@@ -2231,6 +2234,8 @@ int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu) + kvm_s390_set_prefix(vcpu, 0); + if (test_kvm_facility(vcpu->kvm, 64)) + vcpu->run->kvm_valid_regs |= KVM_SYNC_RICCB; ++ if (test_kvm_facility(vcpu->kvm, 82)) ++ vcpu->run->kvm_valid_regs |= KVM_SYNC_BPBC; + if (test_kvm_facility(vcpu->kvm, 133)) + vcpu->run->kvm_valid_regs |= KVM_SYNC_GSCB; + /* fprs can be synchronized via vrs, even if the guest has no vx. With +@@ -2372,6 +2377,7 @@ static void kvm_s390_vcpu_initial_reset(struct kvm_vcpu *vcpu) + current->thread.fpu.fpc = 0; + vcpu->arch.sie_block->gbea = 1; + vcpu->arch.sie_block->pp = 0; ++ vcpu->arch.sie_block->fpf &= ~FPF_BPBC; + vcpu->arch.pfault_token = KVM_S390_PFAULT_TOKEN_INVALID; + kvm_clear_async_pf_completion_queue(vcpu); + if (!kvm_s390_user_cpu_state_ctrl(vcpu->kvm)) +@@ -3318,6 +3324,11 @@ static void sync_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) + vcpu->arch.sie_block->ecd |= ECD_HOSTREGMGMT; + vcpu->arch.gs_enabled = 1; + } ++ if ((kvm_run->kvm_dirty_regs & KVM_SYNC_BPBC) && ++ test_kvm_facility(vcpu->kvm, 82)) { ++ vcpu->arch.sie_block->fpf &= ~FPF_BPBC; ++ vcpu->arch.sie_block->fpf |= kvm_run->s.regs.bpbc ? FPF_BPBC : 0; ++ } + save_access_regs(vcpu->arch.host_acrs); + restore_access_regs(vcpu->run->s.regs.acrs); + /* save host (userspace) fprs/vrs */ +@@ -3364,6 +3375,7 @@ static void store_regs(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run) + kvm_run->s.regs.pft = vcpu->arch.pfault_token; + kvm_run->s.regs.pfs = vcpu->arch.pfault_select; + kvm_run->s.regs.pfc = vcpu->arch.pfault_compare; ++ kvm_run->s.regs.bpbc = (vcpu->arch.sie_block->fpf & FPF_BPBC) == FPF_BPBC; + save_access_regs(vcpu->run->s.regs.acrs); + restore_access_regs(vcpu->arch.host_acrs); + /* Save guest register state */ +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index a74204db759b..eb7b530d1783 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -234,6 +234,12 @@ static void unshadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + memcpy(scb_o->gcr, scb_s->gcr, 128); + scb_o->pp = scb_s->pp; + ++ /* branch prediction */ ++ if (test_kvm_facility(vcpu->kvm, 82)) { ++ scb_o->fpf &= ~FPF_BPBC; ++ scb_o->fpf |= scb_s->fpf & FPF_BPBC; ++ } ++ + /* interrupt intercept */ + switch (scb_s->icptcode) { + case ICPT_PROGI: +@@ -280,6 +286,7 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + scb_s->ecb3 = 0; + scb_s->ecd = 0; + scb_s->fac = 0; ++ scb_s->fpf = 0; + + rc = prepare_cpuflags(vcpu, vsie_page); + if (rc) +@@ -339,6 +346,9 @@ static int shadow_scb(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + prefix_unmapped(vsie_page); + scb_s->ecb |= ECB_TE; + } ++ /* branch prediction */ ++ if (test_kvm_facility(vcpu->kvm, 82)) ++ scb_s->fpf |= scb_o->fpf & FPF_BPBC; + /* SIMD */ + if (test_kvm_facility(vcpu->kvm, 129)) { + scb_s->eca |= scb_o->eca & ECA_VX; +@@ -821,6 +831,7 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + { + struct kvm_s390_sie_block *scb_s = &vsie_page->scb_s; + struct kvm_s390_sie_block *scb_o = vsie_page->scb_o; ++ int guest_bp_isolation; + int rc; + + handle_last_fault(vcpu, vsie_page); +@@ -831,6 +842,20 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + s390_handle_mcck(); + + srcu_read_unlock(&vcpu->kvm->srcu, vcpu->srcu_idx); ++ ++ /* save current guest state of bp isolation override */ ++ guest_bp_isolation = test_thread_flag(TIF_ISOLATE_BP_GUEST); ++ ++ /* ++ * The guest is running with BPBC, so we have to force it on for our ++ * nested guest. This is done by enabling BPBC globally, so the BPBC ++ * control in the SCB (which the nested guest can modify) is simply ++ * ignored. ++ */ ++ if (test_kvm_facility(vcpu->kvm, 82) && ++ vcpu->arch.sie_block->fpf & FPF_BPBC) ++ set_thread_flag(TIF_ISOLATE_BP_GUEST); ++ + local_irq_disable(); + guest_enter_irqoff(); + local_irq_enable(); +@@ -840,6 +865,11 @@ static int do_vsie_run(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + local_irq_disable(); + guest_exit_irqoff(); + local_irq_enable(); ++ ++ /* restore guest state for bp isolation override */ ++ if (!guest_bp_isolation) ++ clear_thread_flag(TIF_ISOLATE_BP_GUEST); ++ + vcpu->srcu_idx = srcu_read_lock(&vcpu->kvm->srcu); + + if (rc == -EINTR) { +diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c +index f53ccc680238..dbdd460a9958 100644 +--- a/drivers/acpi/acpi_video.c ++++ b/drivers/acpi/acpi_video.c +@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void) + return opregion; + } + ++static bool dmi_is_desktop(void) ++{ ++ const char *chassis_type; ++ ++ chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE); ++ if (!chassis_type) ++ return false; ++ ++ if (!strcmp(chassis_type, "3") || /* 3: Desktop */ ++ !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */ ++ !strcmp(chassis_type, "5") || /* 5: Pizza Box */ ++ !strcmp(chassis_type, "6") || /* 6: Mini Tower */ ++ !strcmp(chassis_type, "7") || /* 7: Tower */ ++ !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */ ++ return true; ++ ++ return false; ++} ++ + int acpi_video_register(void) + { + int ret = 0; +@@ -2143,8 +2162,12 @@ int acpi_video_register(void) + * win8 ready (where we also prefer the native backlight driver, so + * normally the acpi_video code should not register there anyways). + */ +- if (only_lcd == -1) +- only_lcd = acpi_osi_is_win8(); ++ if (only_lcd == -1) { ++ if (dmi_is_desktop() && acpi_osi_is_win8()) ++ only_lcd = true; ++ else ++ only_lcd = false; ++ } + + dmi_check_system(video_dmi_table); + +diff --git a/drivers/block/swim.c b/drivers/block/swim.c +index 84434d3ea19b..e88d50f75a4a 100644 +--- a/drivers/block/swim.c ++++ b/drivers/block/swim.c +@@ -110,7 +110,7 @@ struct iwm { + /* Select values for swim_select and swim_readbit */ + + #define READ_DATA_0 0x074 +-#define TWOMEG_DRIVE 0x075 ++#define ONEMEG_DRIVE 0x075 + #define SINGLE_SIDED 0x076 + #define DRIVE_PRESENT 0x077 + #define DISK_IN 0x170 +@@ -118,9 +118,9 @@ struct iwm { + #define TRACK_ZERO 0x172 + #define TACHO 0x173 + #define READ_DATA_1 0x174 +-#define MFM_MODE 0x175 ++#define GCR_MODE 0x175 + #define SEEK_COMPLETE 0x176 +-#define ONEMEG_MEDIA 0x177 ++#define TWOMEG_MEDIA 0x177 + + /* Bits in handshake register */ + +@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs) + struct floppy_struct *g; + fs->disk_in = 1; + fs->write_protected = swim_readbit(base, WRITE_PROT); +- fs->type = swim_readbit(base, ONEMEG_MEDIA); + + if (swim_track00(base)) + printk(KERN_ERR +@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs) + + swim_track00(base); + ++ fs->type = swim_readbit(base, TWOMEG_MEDIA) ? ++ HD_MEDIA : DD_MEDIA; ++ fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2; + get_floppy_geometry(fs, 0, &g); + fs->total_secs = g->size; + fs->secpercyl = g->head * g->sect; +@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) + + swim_write(base, setup, S_IBM_DRIVE | S_FCLK_DIV2); + udelay(10); +- swim_drive(base, INTERNAL_DRIVE); ++ swim_drive(base, fs->location); + swim_motor(base, ON); + swim_action(base, SETMFM); + if (fs->ejected) +@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode) + goto out; + } + ++ set_capacity(fs->disk, fs->total_secs); ++ + if (mode & FMODE_NDELAY) + return 0; + +@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode, + if (copy_to_user((void __user *) param, (void *) &floppy_type, + sizeof(struct floppy_struct))) + return -EFAULT; +- break; +- +- default: +- printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n", +- cmd); +- return -ENOSYS; ++ return 0; + } +- return 0; ++ return -ENOTTY; + } + + static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo) +@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data) + struct swim_priv *swd = data; + int drive = (*part & 3); + +- if (drive > swd->floppy_count) ++ if (drive >= swd->floppy_count) + return NULL; + + *part = 0; +@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location) + + swim_motor(base, OFF); + +- if (swim_readbit(base, SINGLE_SIDED)) +- fs->head_number = 1; +- else +- fs->head_number = 2; ++ fs->type = HD_MEDIA; ++ fs->head_number = 2; ++ + fs->ref_count = 0; + fs->ejected = 1; + +@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd) + /* scan floppy drives */ + + swim_drive(base, INTERNAL_DRIVE); +- if (swim_readbit(base, DRIVE_PRESENT)) ++ if (swim_readbit(base, DRIVE_PRESENT) && ++ !swim_readbit(base, ONEMEG_DRIVE)) + swim_add_floppy(swd, INTERNAL_DRIVE); + swim_drive(base, EXTERNAL_DRIVE); +- if (swim_readbit(base, DRIVE_PRESENT)) ++ if (swim_readbit(base, DRIVE_PRESENT) && ++ !swim_readbit(base, ONEMEG_DRIVE)) + swim_add_floppy(swd, EXTERNAL_DRIVE); + + /* register floppy drives */ +@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd) + &swd->lock); + if (!swd->unit[drive].disk->queue) { + err = -ENOMEM; +- put_disk(swd->unit[drive].disk); + goto exit_put_disks; + } + blk_queue_bounce_limit(swd->unit[drive].disk->queue, +@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev) + goto out; + } + +- swim_base = ioremap(res->start, resource_size(res)); ++ swim_base = (struct swim __iomem *)res->start; + if (!swim_base) { + ret = -ENOMEM; + goto out_release_io; +@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev) + if (!get_swim_mode(swim_base)) { + printk(KERN_INFO "SWIM device not found !\n"); + ret = -ENODEV; +- goto out_iounmap; ++ goto out_release_io; + } + + /* set platform driver data */ +@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev) + swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL); + if (!swd) { + ret = -ENOMEM; +- goto out_iounmap; ++ goto out_release_io; + } + platform_set_drvdata(dev, swd); + +@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev) + + out_kfree: + kfree(swd); +-out_iounmap: +- iounmap(swim_base); + out_release_io: + release_mem_region(res->start, resource_size(res)); + out: +@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev) + for (drive = 0; drive < swd->floppy_count; drive++) + floppy_eject(&swd->unit[drive]); + +- iounmap(swd->base); +- + res = platform_get_resource(dev, IORESOURCE_MEM, 0); + if (res) + release_mem_region(res->start, resource_size(res)); +diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c +index 9f931f8f6b4c..0d7527c6825a 100644 +--- a/drivers/block/swim3.c ++++ b/drivers/block/swim3.c +@@ -148,7 +148,7 @@ struct swim3 { + #define MOTOR_ON 2 + #define RELAX 3 /* also eject in progress */ + #define READ_DATA_0 4 +-#define TWOMEG_DRIVE 5 ++#define ONEMEG_DRIVE 5 + #define SINGLE_SIDED 6 /* drive or diskette is 4MB type? */ + #define DRIVE_PRESENT 7 + #define DISK_IN 8 +@@ -156,9 +156,9 @@ struct swim3 { + #define TRACK_ZERO 10 + #define TACHO 11 + #define READ_DATA_1 12 +-#define MFM_MODE 13 ++#define GCR_MODE 13 + #define SEEK_COMPLETE 14 +-#define ONEMEG_MEDIA 15 ++#define TWOMEG_MEDIA 15 + + /* Definitions of values used in writing and formatting */ + #define DATA_ESCAPE 0x99 +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index e36d160c458f..5f7d86509f2f 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi, + if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT) + return media_changed(cdi, 1); + +- if ((unsigned int)arg >= cdi->capacity) ++ if (arg >= cdi->capacity) + return -EINVAL; + + info = kmalloc(sizeof(*info), GFP_KERNEL); +diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c +index 1d01a8f77db1..dba5259def60 100644 +--- a/drivers/char/tpm/tpm-interface.c ++++ b/drivers/char/tpm/tpm-interface.c +@@ -369,20 +369,40 @@ static int tpm_validate_command(struct tpm_chip *chip, + return -EINVAL; + } + +-/** +- * tmp_transmit - Internal kernel interface to transmit TPM commands. +- * +- * @chip: TPM chip to use +- * @buf: TPM command buffer +- * @bufsiz: length of the TPM command buffer +- * @flags: tpm transmit flags - bitmap +- * +- * Return: +- * 0 when the operation is successful. +- * A negative number for system errors (errno). +- */ +-ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, +- u8 *buf, size_t bufsiz, unsigned int flags) ++static int tpm_request_locality(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ if (!chip->ops->request_locality) ++ return 0; ++ ++ rc = chip->ops->request_locality(chip, 0); ++ if (rc < 0) ++ return rc; ++ ++ chip->locality = rc; ++ ++ return 0; ++} ++ ++static void tpm_relinquish_locality(struct tpm_chip *chip) ++{ ++ int rc; ++ ++ if (!chip->ops->relinquish_locality) ++ return; ++ ++ rc = chip->ops->relinquish_locality(chip, chip->locality); ++ if (rc) ++ dev_err(&chip->dev, "%s: : error %d\n", __func__, rc); ++ ++ chip->locality = -1; ++} ++ ++static ssize_t tpm_try_transmit(struct tpm_chip *chip, ++ struct tpm_space *space, ++ u8 *buf, size_t bufsiz, ++ unsigned int flags) + { + struct tpm_output_header *header = (void *)buf; + int rc; +@@ -422,8 +442,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + if (!(flags & TPM_TRANSMIT_UNLOCKED)) + mutex_lock(&chip->tpm_mutex); + +- if (chip->dev.parent) +- pm_runtime_get_sync(chip->dev.parent); + + if (chip->ops->clk_enable != NULL) + chip->ops->clk_enable(chip, true); +@@ -431,14 +449,15 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + /* Store the decision as chip->locality will be changed. */ + need_locality = chip->locality == -1; + +- if (!(flags & TPM_TRANSMIT_RAW) && +- need_locality && chip->ops->request_locality) { +- rc = chip->ops->request_locality(chip, 0); ++ if (!(flags & TPM_TRANSMIT_RAW) && need_locality) { ++ rc = tpm_request_locality(chip); + if (rc < 0) + goto out_no_locality; +- chip->locality = rc; + } + ++ if (chip->dev.parent) ++ pm_runtime_get_sync(chip->dev.parent); ++ + rc = tpm2_prepare_space(chip, space, ordinal, buf); + if (rc) + goto out; +@@ -499,27 +518,83 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, + rc = tpm2_commit_space(chip, space, ordinal, buf, &len); + + out: +- if (need_locality && chip->ops->relinquish_locality) { +- chip->ops->relinquish_locality(chip, chip->locality); +- chip->locality = -1; +- } ++ if (chip->dev.parent) ++ pm_runtime_put_sync(chip->dev.parent); ++ ++ if (need_locality) ++ tpm_relinquish_locality(chip); ++ + out_no_locality: + if (chip->ops->clk_enable != NULL) + chip->ops->clk_enable(chip, false); + +- if (chip->dev.parent) +- pm_runtime_put_sync(chip->dev.parent); +- + if (!(flags & TPM_TRANSMIT_UNLOCKED)) + mutex_unlock(&chip->tpm_mutex); + return rc ? rc : len; + } + + /** +- * tmp_transmit_cmd - send a tpm command to the device ++ * tpm_transmit - Internal kernel interface to transmit TPM commands. ++ * ++ * @chip: TPM chip to use ++ * @space: tpm space ++ * @buf: TPM command buffer ++ * @bufsiz: length of the TPM command buffer ++ * @flags: tpm transmit flags - bitmap ++ * ++ * A wrapper around tpm_try_transmit that handles TPM2_RC_RETRY ++ * returns from the TPM and retransmits the command after a delay up ++ * to a maximum wait of TPM2_DURATION_LONG. ++ * ++ * Note: TPM1 never returns TPM2_RC_RETRY so the retry logic is TPM2 ++ * only ++ * ++ * Return: ++ * the length of the return when the operation is successful. ++ * A negative number for system errors (errno). ++ */ ++ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space, ++ u8 *buf, size_t bufsiz, unsigned int flags) ++{ ++ struct tpm_output_header *header = (struct tpm_output_header *)buf; ++ /* space for header and handles */ ++ u8 save[TPM_HEADER_SIZE + 3*sizeof(u32)]; ++ unsigned int delay_msec = TPM2_DURATION_SHORT; ++ u32 rc = 0; ++ ssize_t ret; ++ const size_t save_size = min(space ? sizeof(save) : TPM_HEADER_SIZE, ++ bufsiz); ++ ++ /* ++ * Subtlety here: if we have a space, the handles will be ++ * transformed, so when we restore the header we also have to ++ * restore the handles. ++ */ ++ memcpy(save, buf, save_size); ++ ++ for (;;) { ++ ret = tpm_try_transmit(chip, space, buf, bufsiz, flags); ++ if (ret < 0) ++ break; ++ rc = be32_to_cpu(header->return_code); ++ if (rc != TPM2_RC_RETRY) ++ break; ++ delay_msec *= 2; ++ if (delay_msec > TPM2_DURATION_LONG) { ++ dev_err(&chip->dev, "TPM is in retry loop\n"); ++ break; ++ } ++ tpm_msleep(delay_msec); ++ memcpy(buf, save, save_size); ++ } ++ return ret; ++} ++/** ++ * tpm_transmit_cmd - send a tpm command to the device + * The function extracts tpm out header return code + * + * @chip: TPM chip to use ++ * @space: tpm space + * @buf: TPM command buffer + * @bufsiz: length of the buffer + * @min_rsp_body_length: minimum expected length of response body +diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h +index 0b5b499f726a..b83b30a3eea5 100644 +--- a/drivers/char/tpm/tpm.h ++++ b/drivers/char/tpm/tpm.h +@@ -106,6 +106,7 @@ enum tpm2_return_codes { + TPM2_RC_COMMAND_CODE = 0x0143, + TPM2_RC_TESTING = 0x090A, /* RC_WARN */ + TPM2_RC_REFERENCE_H0 = 0x0910, ++ TPM2_RC_RETRY = 0x0922, + }; + + enum tpm2_algorithms { +diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c +index 8f0a98dea327..bb756ad7897e 100644 +--- a/drivers/char/tpm/tpm_crb.c ++++ b/drivers/char/tpm/tpm_crb.c +@@ -117,6 +117,25 @@ struct tpm2_crb_smc { + u32 smc_func_id; + }; + ++static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, ++ unsigned long timeout) ++{ ++ ktime_t start; ++ ktime_t stop; ++ ++ start = ktime_get(); ++ stop = ktime_add(start, ms_to_ktime(timeout)); ++ ++ do { ++ if ((ioread32(reg) & mask) == value) ++ return true; ++ ++ usleep_range(50, 100); ++ } while (ktime_before(ktime_get(), stop)); ++ ++ return ((ioread32(reg) & mask) == value); ++} ++ + /** + * crb_go_idle - request tpm crb device to go the idle state + * +@@ -132,37 +151,24 @@ struct tpm2_crb_smc { + * + * Return: 0 always + */ +-static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv) ++static int crb_go_idle(struct device *dev, struct crb_priv *priv) + { + if ((priv->flags & CRB_FL_ACPI_START) || + (priv->flags & CRB_FL_CRB_SMC_START)) + return 0; + + iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req); +- /* we don't really care when this settles */ + ++ if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req, ++ CRB_CTRL_REQ_GO_IDLE/* mask */, ++ 0, /* value */ ++ TPM2_TIMEOUT_C)) { ++ dev_warn(dev, "goIdle timed out\n"); ++ return -ETIME; ++ } + return 0; + } + +-static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, +- unsigned long timeout) +-{ +- ktime_t start; +- ktime_t stop; +- +- start = ktime_get(); +- stop = ktime_add(start, ms_to_ktime(timeout)); +- +- do { +- if ((ioread32(reg) & mask) == value) +- return true; +- +- usleep_range(50, 100); +- } while (ktime_before(ktime_get(), stop)); +- +- return false; +-} +- + /** + * crb_cmd_ready - request tpm crb device to enter ready state + * +@@ -177,8 +183,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value, + * + * Return: 0 on success -ETIME on timeout; + */ +-static int __maybe_unused crb_cmd_ready(struct device *dev, +- struct crb_priv *priv) ++static int crb_cmd_ready(struct device *dev, struct crb_priv *priv) + { + if ((priv->flags & CRB_FL_ACPI_START) || + (priv->flags & CRB_FL_CRB_SMC_START)) +@@ -196,11 +201,11 @@ static int __maybe_unused crb_cmd_ready(struct device *dev, + return 0; + } + +-static int crb_request_locality(struct tpm_chip *chip, int loc) ++static int __crb_request_locality(struct device *dev, ++ struct crb_priv *priv, int loc) + { +- struct crb_priv *priv = dev_get_drvdata(&chip->dev); + u32 value = CRB_LOC_STATE_LOC_ASSIGNED | +- CRB_LOC_STATE_TPM_REG_VALID_STS; ++ CRB_LOC_STATE_TPM_REG_VALID_STS; + + if (!priv->regs_h) + return 0; +@@ -208,21 +213,45 @@ static int crb_request_locality(struct tpm_chip *chip, int loc) + iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl); + if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value, + TPM2_TIMEOUT_C)) { +- dev_warn(&chip->dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); ++ dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); + return -ETIME; + } + + return 0; + } + +-static void crb_relinquish_locality(struct tpm_chip *chip, int loc) ++static int crb_request_locality(struct tpm_chip *chip, int loc) + { + struct crb_priv *priv = dev_get_drvdata(&chip->dev); + ++ return __crb_request_locality(&chip->dev, priv, loc); ++} ++ ++static int __crb_relinquish_locality(struct device *dev, ++ struct crb_priv *priv, int loc) ++{ ++ u32 mask = CRB_LOC_STATE_LOC_ASSIGNED | ++ CRB_LOC_STATE_TPM_REG_VALID_STS; ++ u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS; ++ + if (!priv->regs_h) +- return; ++ return 0; + + iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl); ++ if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value, ++ TPM2_TIMEOUT_C)) { ++ dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n"); ++ return -ETIME; ++ } ++ ++ return 0; ++} ++ ++static int crb_relinquish_locality(struct tpm_chip *chip, int loc) ++{ ++ struct crb_priv *priv = dev_get_drvdata(&chip->dev); ++ ++ return __crb_relinquish_locality(&chip->dev, priv, loc); + } + + static u8 crb_status(struct tpm_chip *chip) +@@ -466,6 +495,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, + dev_warn(dev, FW_BUG "Bad ACPI memory layout"); + } + ++ ret = __crb_request_locality(dev, priv, 0); ++ if (ret) ++ return ret; ++ + priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address, + sizeof(struct crb_regs_tail)); + if (IS_ERR(priv->regs_t)) +@@ -522,6 +555,8 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv, + + crb_go_idle(dev, priv); + ++ __crb_relinquish_locality(dev, priv, 0); ++ + return ret; + } + +@@ -589,10 +624,14 @@ static int crb_acpi_add(struct acpi_device *device) + chip->acpi_dev_handle = device->handle; + chip->flags = TPM_CHIP_FLAG_TPM2; + +- rc = crb_cmd_ready(dev, priv); ++ rc = __crb_request_locality(dev, priv, 0); + if (rc) + return rc; + ++ rc = crb_cmd_ready(dev, priv); ++ if (rc) ++ goto out; ++ + pm_runtime_get_noresume(dev); + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +@@ -602,12 +641,15 @@ static int crb_acpi_add(struct acpi_device *device) + crb_go_idle(dev, priv); + pm_runtime_put_noidle(dev); + pm_runtime_disable(dev); +- return rc; ++ goto out; + } + +- pm_runtime_put(dev); ++ pm_runtime_put_sync(dev); + +- return 0; ++out: ++ __crb_relinquish_locality(dev, priv, 0); ++ ++ return rc; + } + + static int crb_acpi_remove(struct acpi_device *device) +diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c +index a21e31c2b952..58123df6b5f6 100644 +--- a/drivers/char/tpm/tpm_tis_core.c ++++ b/drivers/char/tpm/tpm_tis_core.c +@@ -77,11 +77,13 @@ static bool check_locality(struct tpm_chip *chip, int l) + return false; + } + +-static void release_locality(struct tpm_chip *chip, int l) ++static int release_locality(struct tpm_chip *chip, int l) + { + struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev); + + tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY); ++ ++ return 0; + } + + static int request_locality(struct tpm_chip *chip, int l) +diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +index bf14214fa464..4db31b89507c 100644 +--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c ++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c +@@ -1634,6 +1634,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi) + * (and possibly on the platform). So far only i.MX6Q (v1.30a) and + * i.MX6DL (v1.31a) have been identified as needing the workaround, with + * 4 and 1 iterations respectively. ++ * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing ++ * the workaround with a single iteration. + */ + + switch (hdmi->version) { +@@ -1641,6 +1643,7 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi) + count = 4; + break; + case 0x131a: ++ case 0x201a: + count = 1; + break; + default: +diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c +index 345f6035599e..f1d93676b0fc 100644 +--- a/drivers/message/fusion/mptsas.c ++++ b/drivers/message/fusion/mptsas.c +@@ -1995,6 +1995,7 @@ static struct scsi_host_template mptsas_driver_template = { + .cmd_per_lun = 7, + .use_clustering = ENABLE_CLUSTERING, + .shost_attrs = mptscsih_host_attrs, ++ .no_write_same = 1, + }; + + static int mptsas_get_linkerrors(struct sas_phy *phy) +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 82f28ffccddf..bf3be2e6d4a8 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1656,8 +1656,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + } /* switch(bond_mode) */ + + #ifdef CONFIG_NET_POLL_CONTROLLER +- slave_dev->npinfo = bond->dev->npinfo; +- if (slave_dev->npinfo) { ++ if (bond->dev->npinfo) { + if (slave_enable_netpoll(new_slave)) { + netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n"); + res = -EBUSY; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +index 7ea72ef11a55..d272dc6984ac 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h +@@ -1321,6 +1321,10 @@ + #define MDIO_VEND2_AN_STAT 0x8002 + #endif + ++#ifndef MDIO_VEND2_PMA_CDR_CONTROL ++#define MDIO_VEND2_PMA_CDR_CONTROL 0x8056 ++#endif ++ + #ifndef MDIO_CTRL1_SPEED1G + #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100) + #endif +@@ -1369,6 +1373,10 @@ + #define XGBE_AN_CL37_TX_CONFIG_MASK 0x08 + #define XGBE_AN_CL37_MII_CTRL_8BIT 0x0100 + ++#define XGBE_PMA_CDR_TRACK_EN_MASK 0x01 ++#define XGBE_PMA_CDR_TRACK_EN_OFF 0x00 ++#define XGBE_PMA_CDR_TRACK_EN_ON 0x01 ++ + /* Bit setting and getting macros + * The get macro will extract the current bit field value from within + * the variable +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c +index 7d128be61310..b91143947ed2 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c +@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata) + "debugfs_create_file failed\n"); + } + ++ if (pdata->vdata->an_cdr_workaround) { ++ pfile = debugfs_create_bool("an_cdr_workaround", 0600, ++ pdata->xgbe_debugfs, ++ &pdata->debugfs_an_cdr_workaround); ++ if (!pfile) ++ netdev_err(pdata->netdev, ++ "debugfs_create_bool failed\n"); ++ ++ pfile = debugfs_create_bool("an_cdr_track_early", 0600, ++ pdata->xgbe_debugfs, ++ &pdata->debugfs_an_cdr_track_early); ++ if (!pfile) ++ netdev_err(pdata->netdev, ++ "debugfs_create_bool failed\n"); ++ } ++ + kfree(buf); + } + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +index d91fa595be98..e31d9d1fb6a6 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c +@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata) + XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1); + + /* Call MDIO/PHY initialization routine */ ++ pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround; + ret = pdata->phy_if.phy_init(pdata); + if (ret) + return ret; +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 072b9f664597..1b45cd73a258 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata) + xgbe_an73_set(pdata, false, false); + xgbe_an73_disable_interrupts(pdata); + ++ pdata->an_start = 0; ++ + netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n"); + } + + static void xgbe_an_restart(struct xgbe_prv_data *pdata) + { ++ if (pdata->phy_if.phy_impl.an_pre) ++ pdata->phy_if.phy_impl.an_pre(pdata); ++ + switch (pdata->an_mode) { + case XGBE_AN_MODE_CL73: + case XGBE_AN_MODE_CL73_REDRV: +@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata) + + static void xgbe_an_disable(struct xgbe_prv_data *pdata) + { ++ if (pdata->phy_if.phy_impl.an_post) ++ pdata->phy_if.phy_impl.an_post(pdata); ++ + switch (pdata->an_mode) { + case XGBE_AN_MODE_CL73: + case XGBE_AN_MODE_CL73_REDRV: +@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata, + XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL, + reg); + +- if (pdata->phy_if.phy_impl.kr_training_post) +- pdata->phy_if.phy_impl.kr_training_post(pdata); +- + netif_dbg(pdata, link, pdata->netdev, + "KR training initiated\n"); ++ ++ if (pdata->phy_if.phy_impl.kr_training_post) ++ pdata->phy_if.phy_impl.kr_training_post(pdata); + } + + return XGBE_AN_PAGE_RECEIVED; +@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata) + return XGBE_AN_NO_LINK; + } + +- xgbe_an73_disable(pdata); ++ xgbe_an_disable(pdata); + + xgbe_switch_mode(pdata); + +- xgbe_an73_restart(pdata); ++ xgbe_an_restart(pdata); + + return XGBE_AN_INCOMPAT_LINK; + } +@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata) + pdata->an_result = pdata->an_state; + pdata->an_state = XGBE_AN_READY; + ++ if (pdata->phy_if.phy_impl.an_post) ++ pdata->phy_if.phy_impl.an_post(pdata); ++ + netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n", + xgbe_state_as_string(pdata->an_result)); + } +@@ -903,6 +914,9 @@ static void xgbe_an73_state_machine(struct xgbe_prv_data *pdata) + pdata->kx_state = XGBE_RX_BPA; + pdata->an_start = 0; + ++ if (pdata->phy_if.phy_impl.an_post) ++ pdata->phy_if.phy_impl.an_post(pdata); ++ + netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n", + xgbe_state_as_string(pdata->an_result)); + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +index eb23f9ba1a9a..82d1f416ee2a 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c +@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = { + .irq_reissue_support = 1, + .tx_desc_prefetch = 5, + .rx_desc_prefetch = 5, ++ .an_cdr_workaround = 1, + }; + + static const struct xgbe_version_data xgbe_v2b = { +@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = { + .irq_reissue_support = 1, + .tx_desc_prefetch = 5, + .rx_desc_prefetch = 5, ++ .an_cdr_workaround = 1, + }; + + static const struct pci_device_id xgbe_pci_table[] = { +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +index 3304a291aa96..aac884314000 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c +@@ -147,6 +147,14 @@ + /* Rate-change complete wait/retry count */ + #define XGBE_RATECHANGE_COUNT 500 + ++/* CDR delay values for KR support (in usec) */ ++#define XGBE_CDR_DELAY_INIT 10000 ++#define XGBE_CDR_DELAY_INC 10000 ++#define XGBE_CDR_DELAY_MAX 100000 ++ ++/* RRC frequency during link status check */ ++#define XGBE_RRC_FREQUENCY 10 ++ + enum xgbe_port_mode { + XGBE_PORT_MODE_RSVD = 0, + XGBE_PORT_MODE_BACKPLANE, +@@ -245,6 +253,10 @@ enum xgbe_sfp_speed { + #define XGBE_SFP_BASE_VENDOR_SN 4 + #define XGBE_SFP_BASE_VENDOR_SN_LEN 16 + ++#define XGBE_SFP_EXTD_OPT1 1 ++#define XGBE_SFP_EXTD_OPT1_RX_LOS BIT(1) ++#define XGBE_SFP_EXTD_OPT1_TX_FAULT BIT(3) ++ + #define XGBE_SFP_EXTD_DIAG 28 + #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE BIT(2) + +@@ -324,6 +336,7 @@ struct xgbe_phy_data { + + unsigned int sfp_gpio_address; + unsigned int sfp_gpio_mask; ++ unsigned int sfp_gpio_inputs; + unsigned int sfp_gpio_rx_los; + unsigned int sfp_gpio_tx_fault; + unsigned int sfp_gpio_mod_absent; +@@ -355,6 +368,10 @@ struct xgbe_phy_data { + unsigned int redrv_addr; + unsigned int redrv_lane; + unsigned int redrv_model; ++ ++ /* KR AN support */ ++ unsigned int phy_cdr_notrack; ++ unsigned int phy_cdr_delay; + }; + + /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */ +@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata) + phy_data->sfp_phy_avail = 1; + } + ++static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data) ++{ ++ u8 *sfp_extd = phy_data->sfp_eeprom.extd; ++ ++ if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS)) ++ return false; ++ ++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) ++ return false; ++ ++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los)) ++ return true; ++ ++ return false; ++} ++ ++static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data) ++{ ++ u8 *sfp_extd = phy_data->sfp_eeprom.extd; ++ ++ if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT)) ++ return false; ++ ++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) ++ return false; ++ ++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault)) ++ return true; ++ ++ return false; ++} ++ ++static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data) ++{ ++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) ++ return false; ++ ++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent)) ++ return true; ++ ++ return false; ++} ++ + static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata) + { + struct xgbe_phy_data *phy_data = pdata->phy_data; +@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata) + if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP) + return; + ++ /* Update transceiver signals (eeprom extd/options) */ ++ phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data); ++ phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data); ++ + if (xgbe_phy_sfp_parse_quirks(pdata)) + return; + +@@ -1184,7 +1248,6 @@ static int xgbe_phy_sfp_read_eeprom(struct xgbe_prv_data *pdata) + static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata) + { + struct xgbe_phy_data *phy_data = pdata->phy_data; +- unsigned int gpio_input; + u8 gpio_reg, gpio_ports[2]; + int ret; + +@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata) + return; + } + +- gpio_input = (gpio_ports[1] << 8) | gpio_ports[0]; +- +- if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) { +- /* No GPIO, just assume the module is present for now */ +- phy_data->sfp_mod_absent = 0; +- } else { +- if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent))) +- phy_data->sfp_mod_absent = 0; +- } +- +- if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) && +- (gpio_input & (1 << phy_data->sfp_gpio_rx_los))) +- phy_data->sfp_rx_los = 1; ++ phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0]; + +- if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) && +- (gpio_input & (1 << phy_data->sfp_gpio_tx_fault))) +- phy_data->sfp_tx_fault = 1; ++ phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data); + } + + static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata) +@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart) + return 1; + + /* No link, attempt a receiver reset cycle */ +- if (phy_data->rrc_count++) { ++ if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) { + phy_data->rrc_count = 0; + xgbe_phy_rrc(pdata); + } +@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata) + return true; + } + ++static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata) ++{ ++ struct xgbe_phy_data *phy_data = pdata->phy_data; ++ ++ if (!pdata->debugfs_an_cdr_workaround) ++ return; ++ ++ if (!phy_data->phy_cdr_notrack) ++ return; ++ ++ usleep_range(phy_data->phy_cdr_delay, ++ phy_data->phy_cdr_delay + 500); ++ ++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL, ++ XGBE_PMA_CDR_TRACK_EN_MASK, ++ XGBE_PMA_CDR_TRACK_EN_ON); ++ ++ phy_data->phy_cdr_notrack = 0; ++} ++ ++static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata) ++{ ++ struct xgbe_phy_data *phy_data = pdata->phy_data; ++ ++ if (!pdata->debugfs_an_cdr_workaround) ++ return; ++ ++ if (phy_data->phy_cdr_notrack) ++ return; ++ ++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL, ++ XGBE_PMA_CDR_TRACK_EN_MASK, ++ XGBE_PMA_CDR_TRACK_EN_OFF); ++ ++ xgbe_phy_rrc(pdata); ++ ++ phy_data->phy_cdr_notrack = 1; ++} ++ ++static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata) ++{ ++ if (!pdata->debugfs_an_cdr_track_early) ++ xgbe_phy_cdr_track(pdata); ++} ++ ++static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata) ++{ ++ if (pdata->debugfs_an_cdr_track_early) ++ xgbe_phy_cdr_track(pdata); ++} ++ ++static void xgbe_phy_an_post(struct xgbe_prv_data *pdata) ++{ ++ struct xgbe_phy_data *phy_data = pdata->phy_data; ++ ++ switch (pdata->an_mode) { ++ case XGBE_AN_MODE_CL73: ++ case XGBE_AN_MODE_CL73_REDRV: ++ if (phy_data->cur_mode != XGBE_MODE_KR) ++ break; ++ ++ xgbe_phy_cdr_track(pdata); ++ ++ switch (pdata->an_result) { ++ case XGBE_AN_READY: ++ case XGBE_AN_COMPLETE: ++ break; ++ default: ++ if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX) ++ phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC; ++ else ++ phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT; ++ break; ++ } ++ break; ++ default: ++ break; ++ } ++} ++ ++static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata) ++{ ++ struct xgbe_phy_data *phy_data = pdata->phy_data; ++ ++ switch (pdata->an_mode) { ++ case XGBE_AN_MODE_CL73: ++ case XGBE_AN_MODE_CL73_REDRV: ++ if (phy_data->cur_mode != XGBE_MODE_KR) ++ break; ++ ++ xgbe_phy_cdr_notrack(pdata); ++ break; ++ default: ++ break; ++ } ++} ++ + static void xgbe_phy_stop(struct xgbe_prv_data *pdata) + { + struct xgbe_phy_data *phy_data = pdata->phy_data; +@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata) + xgbe_phy_sfp_reset(phy_data); + xgbe_phy_sfp_mod_absent(pdata); + ++ /* Reset CDR support */ ++ xgbe_phy_cdr_track(pdata); ++ + /* Power off the PHY */ + xgbe_phy_power_off(pdata); + +@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata) + /* Start in highest supported mode */ + xgbe_phy_set_mode(pdata, phy_data->start_mode); + ++ /* Reset CDR support */ ++ xgbe_phy_cdr_track(pdata); ++ + /* After starting the I2C controller, we can check for an SFP */ + switch (phy_data->port_mode) { + case XGBE_PORT_MODE_SFP: +@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata) + } + } + ++ phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT; ++ + /* Register for driving external PHYs */ + mii = devm_mdiobus_alloc(pdata->dev); + if (!mii) { +@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if) + phy_impl->an_advertising = xgbe_phy_an_advertising; + + phy_impl->an_outcome = xgbe_phy_an_outcome; ++ ++ phy_impl->an_pre = xgbe_phy_an_pre; ++ phy_impl->an_post = xgbe_phy_an_post; ++ ++ phy_impl->kr_training_pre = xgbe_phy_kr_training_pre; ++ phy_impl->kr_training_post = xgbe_phy_kr_training_post; + } +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h +index ad102c8bac7b..95d4b56448c6 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe.h ++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h +@@ -833,6 +833,7 @@ struct xgbe_hw_if { + /* This structure represents implementation specific routines for an + * implementation of a PHY. All routines are required unless noted below. + * Optional routines: ++ * an_pre, an_post + * kr_training_pre, kr_training_post + */ + struct xgbe_phy_impl_if { +@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if { + /* Process results of auto-negotiation */ + enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *); + ++ /* Pre/Post auto-negotiation support */ ++ void (*an_pre)(struct xgbe_prv_data *); ++ void (*an_post)(struct xgbe_prv_data *); ++ + /* Pre/Post KR training enablement support */ + void (*kr_training_pre)(struct xgbe_prv_data *); + void (*kr_training_post)(struct xgbe_prv_data *); +@@ -989,6 +994,7 @@ struct xgbe_version_data { + unsigned int irq_reissue_support; + unsigned int tx_desc_prefetch; + unsigned int rx_desc_prefetch; ++ unsigned int an_cdr_workaround; + }; + + struct xgbe_vxlan_data { +@@ -1257,6 +1263,9 @@ struct xgbe_prv_data { + unsigned int debugfs_xprop_reg; + + unsigned int debugfs_xi2c_reg; ++ ++ bool debugfs_an_cdr_workaround; ++ bool debugfs_an_cdr_track_early; + }; + + /* Function prototypes*/ +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index e368b0237a1b..4a85a24ced1c 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -2781,6 +2781,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) + int ret = 0; + struct hlist_node *h; + int bkt; ++ u8 i; + + /* validate the request */ + if (vf_id >= pf->num_alloc_vfs) { +@@ -2792,6 +2793,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac) + + vf = &(pf->vf[vf_id]); + vsi = pf->vsi[vf->lan_vsi_idx]; ++ ++ /* When the VF is resetting wait until it is done. ++ * It can take up to 200 milliseconds, ++ * but wait for up to 300 milliseconds to be safe. ++ */ ++ for (i = 0; i < 15; i++) { ++ if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) ++ break; ++ msleep(20); ++ } + if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) { + dev_err(&pf->pdev->dev, "VF %d still in reset. Try again.\n", + vf_id); +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index a5bb7b19040e..992c43b1868f 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -124,7 +124,7 @@ do { \ + + #define RX_PRIORITY_MAPPING 0x76543210 + #define TX_PRIORITY_MAPPING 0x33221100 +-#define CPDMA_TX_PRIORITY_MAP 0x01234567 ++#define CPDMA_TX_PRIORITY_MAP 0x76543210 + + #define CPSW_VLAN_AWARE BIT(1) + #define CPSW_ALE_VLAN_AWARE 1 +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index 5aa59f41bf8c..71e2aef6b7a1 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, + lock_sock(sk); + + error = -EINVAL; ++ ++ if (sockaddr_len != sizeof(struct sockaddr_pppox)) ++ goto end; ++ + if (sp->sa_protocol != PX_PROTO_OE) + goto end; + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 2a366554c503..8a222ae5950e 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -261,6 +261,17 @@ static void __team_option_inst_mark_removed_port(struct team *team, + } + } + ++static bool __team_option_inst_tmp_find(const struct list_head *opts, ++ const struct team_option_inst *needle) ++{ ++ struct team_option_inst *opt_inst; ++ ++ list_for_each_entry(opt_inst, opts, tmp_list) ++ if (opt_inst == needle) ++ return true; ++ return false; ++} ++ + static int __team_options_register(struct team *team, + const struct team_option *option, + size_t option_count) +@@ -1061,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port) + } + + #ifdef CONFIG_NET_POLL_CONTROLLER +-static int team_port_enable_netpoll(struct team *team, struct team_port *port) ++static int __team_port_enable_netpoll(struct team_port *port) + { + struct netpoll *np; + int err; + +- if (!team->dev->npinfo) +- return 0; +- + np = kzalloc(sizeof(*np), GFP_KERNEL); + if (!np) + return -ENOMEM; +@@ -1082,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port) + return err; + } + ++static int team_port_enable_netpoll(struct team_port *port) ++{ ++ if (!port->team->dev->npinfo) ++ return 0; ++ ++ return __team_port_enable_netpoll(port); ++} ++ + static void team_port_disable_netpoll(struct team_port *port) + { + struct netpoll *np = port->np; +@@ -1096,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port) + kfree(np); + } + #else +-static int team_port_enable_netpoll(struct team *team, struct team_port *port) ++static int team_port_enable_netpoll(struct team_port *port) + { + return 0; + } +@@ -1204,7 +1220,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev) + goto err_vids_add; + } + +- err = team_port_enable_netpoll(team, port); ++ err = team_port_enable_netpoll(port); + if (err) { + netdev_err(dev, "Failed to enable netpoll on device %s\n", + portname); +@@ -1901,7 +1917,7 @@ static int team_netpoll_setup(struct net_device *dev, + + mutex_lock(&team->lock); + list_for_each_entry(port, &team->port_list, list) { +- err = team_port_enable_netpoll(team, port); ++ err = __team_port_enable_netpoll(port); + if (err) { + __team_netpoll_cleanup(team); + break; +@@ -2561,6 +2577,14 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info) + if (err) + goto team_put; + opt_inst->changed = true; ++ ++ /* dumb/evil user-space can send us duplicate opt, ++ * keep only the last one ++ */ ++ if (__team_option_inst_tmp_find(&opt_inst_list, ++ opt_inst)) ++ continue; ++ + list_add(&opt_inst->tmp_list, &opt_inst_list); + } + if (!opt_found) { +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index b0a038e6fda0..bb15b3012aa5 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -116,6 +116,17 @@ struct receive_queue { + char name[40]; + }; + ++/* Control VQ buffers: protected by the rtnl lock */ ++struct control_buf { ++ struct virtio_net_ctrl_hdr hdr; ++ virtio_net_ctrl_ack status; ++ struct virtio_net_ctrl_mq mq; ++ u8 promisc; ++ u8 allmulti; ++ __virtio16 vid; ++ u64 offloads; ++}; ++ + struct virtnet_info { + struct virtio_device *vdev; + struct virtqueue *cvq; +@@ -164,14 +175,7 @@ struct virtnet_info { + struct hlist_node node; + struct hlist_node node_dead; + +- /* Control VQ buffers: protected by the rtnl lock */ +- struct virtio_net_ctrl_hdr ctrl_hdr; +- virtio_net_ctrl_ack ctrl_status; +- struct virtio_net_ctrl_mq ctrl_mq; +- u8 ctrl_promisc; +- u8 ctrl_allmulti; +- u16 ctrl_vid; +- u64 ctrl_offloads; ++ struct control_buf *ctrl; + + /* Ethtool settings */ + u8 duplex; +@@ -1340,25 +1344,25 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd, + /* Caller should know better */ + BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ)); + +- vi->ctrl_status = ~0; +- vi->ctrl_hdr.class = class; +- vi->ctrl_hdr.cmd = cmd; ++ vi->ctrl->status = ~0; ++ vi->ctrl->hdr.class = class; ++ vi->ctrl->hdr.cmd = cmd; + /* Add header */ +- sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr)); ++ sg_init_one(&hdr, &vi->ctrl->hdr, sizeof(vi->ctrl->hdr)); + sgs[out_num++] = &hdr; + + if (out) + sgs[out_num++] = out; + + /* Add return status. */ +- sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status)); ++ sg_init_one(&stat, &vi->ctrl->status, sizeof(vi->ctrl->status)); + sgs[out_num] = &stat; + + BUG_ON(out_num + 1 > ARRAY_SIZE(sgs)); + virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC); + + if (unlikely(!virtqueue_kick(vi->cvq))) +- return vi->ctrl_status == VIRTIO_NET_OK; ++ return vi->ctrl->status == VIRTIO_NET_OK; + + /* Spin for a response, the kick causes an ioport write, trapping + * into the hypervisor, so the request should be handled immediately. +@@ -1367,7 +1371,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd, + !virtqueue_is_broken(vi->cvq)) + cpu_relax(); + +- return vi->ctrl_status == VIRTIO_NET_OK; ++ return vi->ctrl->status == VIRTIO_NET_OK; + } + + static int virtnet_set_mac_address(struct net_device *dev, void *p) +@@ -1478,8 +1482,8 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs) + if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ)) + return 0; + +- vi->ctrl_mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs); +- sg_init_one(&sg, &vi->ctrl_mq, sizeof(vi->ctrl_mq)); ++ vi->ctrl->mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs); ++ sg_init_one(&sg, &vi->ctrl->mq, sizeof(vi->ctrl->mq)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ, + VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &sg)) { +@@ -1537,22 +1541,22 @@ static void virtnet_set_rx_mode(struct net_device *dev) + if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX)) + return; + +- vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0); +- vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0); ++ vi->ctrl->promisc = ((dev->flags & IFF_PROMISC) != 0); ++ vi->ctrl->allmulti = ((dev->flags & IFF_ALLMULTI) != 0); + +- sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc)); ++ sg_init_one(sg, &vi->ctrl->promisc, sizeof(vi->ctrl->promisc)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX, + VIRTIO_NET_CTRL_RX_PROMISC, sg)) + dev_warn(&dev->dev, "Failed to %sable promisc mode.\n", +- vi->ctrl_promisc ? "en" : "dis"); ++ vi->ctrl->promisc ? "en" : "dis"); + +- sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti)); ++ sg_init_one(sg, &vi->ctrl->allmulti, sizeof(vi->ctrl->allmulti)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX, + VIRTIO_NET_CTRL_RX_ALLMULTI, sg)) + dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n", +- vi->ctrl_allmulti ? "en" : "dis"); ++ vi->ctrl->allmulti ? "en" : "dis"); + + uc_count = netdev_uc_count(dev); + mc_count = netdev_mc_count(dev); +@@ -1598,8 +1602,8 @@ static int virtnet_vlan_rx_add_vid(struct net_device *dev, + struct virtnet_info *vi = netdev_priv(dev); + struct scatterlist sg; + +- vi->ctrl_vid = vid; +- sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid)); ++ vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid); ++ sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN, + VIRTIO_NET_CTRL_VLAN_ADD, &sg)) +@@ -1613,8 +1617,8 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev, + struct virtnet_info *vi = netdev_priv(dev); + struct scatterlist sg; + +- vi->ctrl_vid = vid; +- sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid)); ++ vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid); ++ sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN, + VIRTIO_NET_CTRL_VLAN_DEL, &sg)) +@@ -1912,9 +1916,9 @@ static int virtnet_restore_up(struct virtio_device *vdev) + static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads) + { + struct scatterlist sg; +- vi->ctrl_offloads = cpu_to_virtio64(vi->vdev, offloads); ++ vi->ctrl->offloads = cpu_to_virtio64(vi->vdev, offloads); + +- sg_init_one(&sg, &vi->ctrl_offloads, sizeof(vi->ctrl_offloads)); ++ sg_init_one(&sg, &vi->ctrl->offloads, sizeof(vi->ctrl->offloads)); + + if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS, + VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET, &sg)) { +@@ -2134,6 +2138,7 @@ static void virtnet_free_queues(struct virtnet_info *vi) + + kfree(vi->rq); + kfree(vi->sq); ++ kfree(vi->ctrl); + } + + static void _free_receive_bufs(struct virtnet_info *vi) +@@ -2326,6 +2331,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi) + { + int i; + ++ vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL); ++ if (!vi->ctrl) ++ goto err_ctrl; + vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL); + if (!vi->sq) + goto err_sq; +@@ -2351,6 +2359,8 @@ static int virtnet_alloc_queues(struct virtnet_info *vi) + err_rq: + kfree(vi->sq); + err_sq: ++ kfree(vi->ctrl); ++err_ctrl: + return -ENOMEM; + } + +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index 252c2206cbb5..c1772215702a 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -5955,9 +5955,8 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk) + sta->addr, smps, err); + } + +- if (changed & IEEE80211_RC_SUPP_RATES_CHANGED || +- changed & IEEE80211_RC_NSS_CHANGED) { +- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n", ++ if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) { ++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n", + sta->addr); + + err = ath10k_station_assoc(ar, arvif->vif, sta, true); +diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c +index 72b4527d690f..71df0f70b61f 100644 +--- a/drivers/pinctrl/intel/pinctrl-intel.c ++++ b/drivers/pinctrl/intel/pinctrl-intel.c +@@ -427,18 +427,6 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input) + writel(value, padcfg0); + } + +-static void intel_gpio_set_gpio_mode(void __iomem *padcfg0) +-{ +- u32 value; +- +- /* Put the pad into GPIO mode */ +- value = readl(padcfg0) & ~PADCFG0_PMODE_MASK; +- /* Disable SCI/SMI/NMI generation */ +- value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI); +- value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI); +- writel(value, padcfg0); +-} +- + static int intel_gpio_request_enable(struct pinctrl_dev *pctldev, + struct pinctrl_gpio_range *range, + unsigned pin) +@@ -446,6 +434,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev, + struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev); + void __iomem *padcfg0; + unsigned long flags; ++ u32 value; + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +@@ -455,7 +444,13 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev, + } + + padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0); +- intel_gpio_set_gpio_mode(padcfg0); ++ /* Put the pad into GPIO mode */ ++ value = readl(padcfg0) & ~PADCFG0_PMODE_MASK; ++ /* Disable SCI/SMI/NMI generation */ ++ value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI); ++ value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI); ++ writel(value, padcfg0); ++ + /* Disable TX buffer and enable RX (this will be input) */ + __intel_gpio_set_direction(padcfg0, true); + +@@ -940,8 +935,6 @@ static int intel_gpio_irq_type(struct irq_data *d, unsigned type) + + raw_spin_lock_irqsave(&pctrl->lock, flags); + +- intel_gpio_set_gpio_mode(reg); +- + value = readl(reg); + + value &= ~(PADCFG0_RXEVCFG_MASK | PADCFG0_RXINV); +diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c +index 62f5f04d8f61..5e963fe0e38d 100644 +--- a/drivers/s390/block/dasd_alias.c ++++ b/drivers/s390/block/dasd_alias.c +@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu, + int dasd_alias_add_device(struct dasd_device *device) + { + struct dasd_eckd_private *private = device->private; +- struct alias_lcu *lcu; ++ __u8 uaddr = private->uid.real_unit_addr; ++ struct alias_lcu *lcu = private->lcu; + unsigned long flags; + int rc; + +- lcu = private->lcu; + rc = 0; + spin_lock_irqsave(&lcu->lock, flags); ++ /* ++ * Check if device and lcu type differ. If so, the uac data may be ++ * outdated and needs to be updated. ++ */ ++ if (private->uid.type != lcu->uac->unit[uaddr].ua_type) { ++ lcu->flags |= UPDATE_PENDING; ++ DBF_DEV_EVENT(DBF_WARNING, device, "%s", ++ "uid type mismatch - trigger rescan"); ++ } + if (!(lcu->flags & UPDATE_PENDING)) { + rc = _add_device_to_lcu(lcu, device, device); + if (rc) +diff --git a/drivers/s390/char/Makefile b/drivers/s390/char/Makefile +index 05ac6ba15a53..ecc24a46e71a 100644 +--- a/drivers/s390/char/Makefile ++++ b/drivers/s390/char/Makefile +@@ -17,6 +17,8 @@ CFLAGS_REMOVE_sclp_early_core.o += $(CC_FLAGS_MARCH) + CFLAGS_sclp_early_core.o += -march=z900 + endif + ++CFLAGS_REMOVE_sclp_early_core.o += $(CC_FLAGS_EXPOLINE) ++ + obj-y += ctrlchar.o keyboard.o defkeymap.o sclp.o sclp_rw.o sclp_quiesce.o \ + sclp_cmd.o sclp_config.o sclp_cpi_sys.o sclp_ocf.o sclp_ctl.o \ + sclp_early.o sclp_early_core.o +diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c +index 7b0b295b2313..69687c16a150 100644 +--- a/drivers/s390/cio/chsc.c ++++ b/drivers/s390/cio/chsc.c +@@ -451,6 +451,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area) + + static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area) + { ++ struct channel_path *chp; + struct chp_link link; + struct chp_id chpid; + int status; +@@ -463,10 +464,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area) + chpid.id = sei_area->rsid; + /* allocate a new channel path structure, if needed */ + status = chp_get_status(chpid); +- if (status < 0) +- chp_new(chpid); +- else if (!status) ++ if (!status) + return; ++ ++ if (status < 0) { ++ chp_new(chpid); ++ } else { ++ chp = chpid_to_chp(chpid); ++ mutex_lock(&chp->lock); ++ chp_update_desc(chp); ++ mutex_unlock(&chp->lock); ++ } + memset(&link, 0, sizeof(struct chp_link)); + link.chpid = chpid; + if ((sei_area->vf & 0xc0) != 0) { +diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h +index 3597ef78df4d..ce74278a454a 100644 +--- a/include/linux/fsnotify_backend.h ++++ b/include/linux/fsnotify_backend.h +@@ -217,12 +217,10 @@ struct fsnotify_mark_connector { + union { /* Object pointer [lock] */ + struct inode *inode; + struct vfsmount *mnt; +- }; +- union { +- struct hlist_head list; + /* Used listing heads to free after srcu period expires */ + struct fsnotify_mark_connector *destroy_next; + }; ++ struct hlist_head list; + }; + + /* +diff --git a/include/linux/hmm.h b/include/linux/hmm.h +index 8198faf16ed6..96e69979f84d 100644 +--- a/include/linux/hmm.h ++++ b/include/linux/hmm.h +@@ -498,16 +498,23 @@ struct hmm_device { + struct hmm_device *hmm_device_new(void *drvdata); + void hmm_device_put(struct hmm_device *hmm_device); + #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */ ++#endif /* IS_ENABLED(CONFIG_HMM) */ + + /* Below are for HMM internal use only! Not to be used by device driver! */ ++#if IS_ENABLED(CONFIG_HMM_MIRROR) + void hmm_mm_destroy(struct mm_struct *mm); + + static inline void hmm_mm_init(struct mm_struct *mm) + { + mm->hmm = NULL; + } ++#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */ ++static inline void hmm_mm_destroy(struct mm_struct *mm) {} ++static inline void hmm_mm_init(struct mm_struct *mm) {} ++#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */ ++ ++ + #else /* IS_ENABLED(CONFIG_HMM) */ + static inline void hmm_mm_destroy(struct mm_struct *mm) {} + static inline void hmm_mm_init(struct mm_struct *mm) {} +-#endif /* IS_ENABLED(CONFIG_HMM) */ + #endif /* LINUX_HMM_H */ +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 5e6a2d4dc366..ab927383c99d 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -584,7 +584,7 @@ static inline bool skb_vlan_tagged(const struct sk_buff *skb) + * Returns true if the skb is tagged with multiple vlan headers, regardless + * of whether it is hardware accelerated or not. + */ +-static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb) ++static inline bool skb_vlan_tagged_multi(struct sk_buff *skb) + { + __be16 protocol = skb->protocol; + +@@ -594,6 +594,9 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb) + if (likely(!eth_type_vlan(protocol))) + return false; + ++ if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN))) ++ return false; ++ + veh = (struct vlan_ethhdr *)skb->data; + protocol = veh->h_vlan_encapsulated_proto; + } +@@ -611,7 +614,7 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb) + * + * Returns features without unsafe ones if the skb has multiple tags. + */ +-static inline netdev_features_t vlan_features_check(const struct sk_buff *skb, ++static inline netdev_features_t vlan_features_check(struct sk_buff *skb, + netdev_features_t features) + { + if (skb_vlan_tagged_multi(skb)) { +diff --git a/include/linux/tpm.h b/include/linux/tpm.h +index 881312d85574..2a6c3d96b31f 100644 +--- a/include/linux/tpm.h ++++ b/include/linux/tpm.h +@@ -49,7 +49,7 @@ struct tpm_class_ops { + bool (*update_timeouts)(struct tpm_chip *chip, + unsigned long *timeout_cap); + int (*request_locality)(struct tpm_chip *chip, int loc); +- void (*relinquish_locality)(struct tpm_chip *chip, int loc); ++ int (*relinquish_locality)(struct tpm_chip *chip, int loc); + void (*clk_enable)(struct tpm_chip *chip, bool value); + }; + +diff --git a/include/net/ife.h b/include/net/ife.h +index 44b9c00f7223..e117617e3c34 100644 +--- a/include/net/ife.h ++++ b/include/net/ife.h +@@ -12,7 +12,8 @@ + void *ife_encode(struct sk_buff *skb, u16 metalen); + void *ife_decode(struct sk_buff *skb, u16 *metalen); + +-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen); ++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype, ++ u16 *dlen, u16 *totlen); + int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen, + const void *dval); + +diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h +index fe994d2e5286..ea985aa7a6c5 100644 +--- a/include/net/llc_conn.h ++++ b/include/net/llc_conn.h +@@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb) + + struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, + struct proto *prot, int kern); ++void llc_sk_stop_all_timers(struct sock *sk, bool sync); + void llc_sk_free(struct sock *sk); + + void llc_sk_reset(struct sock *sk); +diff --git a/include/net/tcp.h b/include/net/tcp.h +index d323d4fa742c..fb653736f335 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -1616,6 +1616,7 @@ static inline void tcp_write_queue_purge(struct sock *sk) + sk_mem_reclaim(sk); + tcp_clear_all_retrans_hints(tcp_sk(sk)); + tcp_init_send_head(sk); ++ tcp_sk(sk)->packets_out = 0; + } + + static inline struct sk_buff *tcp_write_queue_head(const struct sock *sk) +diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h +index 7e99999d6236..857bad91c454 100644 +--- a/include/uapi/linux/kvm.h ++++ b/include/uapi/linux/kvm.h +@@ -931,6 +931,7 @@ struct kvm_ppc_resize_hpt { + #define KVM_CAP_PPC_SMT_POSSIBLE 147 + #define KVM_CAP_HYPERV_SYNIC2 148 + #define KVM_CAP_HYPERV_VP_INDEX 149 ++#define KVM_CAP_S390_BPB 152 + + #ifdef KVM_CAP_IRQ_ROUTING + +diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h +index e954ae3d82c0..e3a658bac10f 100644 +--- a/kernel/trace/trace_entries.h ++++ b/kernel/trace/trace_entries.h +@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry, + __field( unsigned int, seqnum ) + ), + +- F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n", ++ F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n", + __entry->seqnum, + __entry->tv_sec, + __entry->tv_nsec, +diff --git a/net/core/dev.c b/net/core/dev.c +index 4be2a4047640..e7d56c5adde6 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2903,7 +2903,7 @@ netdev_features_t passthru_features_check(struct sk_buff *skb, + } + EXPORT_SYMBOL(passthru_features_check); + +-static netdev_features_t dflt_features_check(const struct sk_buff *skb, ++static netdev_features_t dflt_features_check(struct sk_buff *skb, + struct net_device *dev, + netdev_features_t features) + { +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 741ae2554190..514d697d4691 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -55,7 +55,8 @@ static void neigh_timer_handler(unsigned long arg); + static void __neigh_notify(struct neighbour *n, int type, int flags, + u32 pid); + static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid); +-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev); ++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl, ++ struct net_device *dev); + + #ifdef CONFIG_PROC_FS + static const struct file_operations neigh_stat_seq_fops; +@@ -291,8 +292,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev) + { + write_lock_bh(&tbl->lock); + neigh_flush_dev(tbl, dev); +- pneigh_ifdown(tbl, dev); +- write_unlock_bh(&tbl->lock); ++ pneigh_ifdown_and_unlock(tbl, dev); + + del_timer_sync(&tbl->proxy_timer); + pneigh_queue_purge(&tbl->proxy_queue); +@@ -681,9 +681,10 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey, + return -ENOENT; + } + +-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev) ++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl, ++ struct net_device *dev) + { +- struct pneigh_entry *n, **np; ++ struct pneigh_entry *n, **np, *freelist = NULL; + u32 h; + + for (h = 0; h <= PNEIGH_HASHMASK; h++) { +@@ -691,16 +692,23 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev) + while ((n = *np) != NULL) { + if (!dev || n->dev == dev) { + *np = n->next; +- if (tbl->pdestructor) +- tbl->pdestructor(n); +- if (n->dev) +- dev_put(n->dev); +- kfree(n); ++ n->next = freelist; ++ freelist = n; + continue; + } + np = &n->next; + } + } ++ write_unlock_bh(&tbl->lock); ++ while ((n = freelist)) { ++ freelist = n->next; ++ n->next = NULL; ++ if (tbl->pdestructor) ++ tbl->pdestructor(n); ++ if (n->dev) ++ dev_put(n->dev); ++ kfree(n); ++ } + return -ENOENT; + } + +@@ -2323,12 +2331,16 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb, + + err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL); + if (!err) { +- if (tb[NDA_IFINDEX]) ++ if (tb[NDA_IFINDEX]) { ++ if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32)) ++ return -EINVAL; + filter_idx = nla_get_u32(tb[NDA_IFINDEX]); +- +- if (tb[NDA_MASTER]) ++ } ++ if (tb[NDA_MASTER]) { ++ if (nla_len(tb[NDA_MASTER]) != sizeof(u32)) ++ return -EINVAL; + filter_master_idx = nla_get_u32(tb[NDA_MASTER]); +- ++ } + if (filter_idx || filter_master_idx) + flags |= NLM_F_DUMP_FILTERED; + } +diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c +index e1d4d898a007..f0252768ecf4 100644 +--- a/net/dns_resolver/dns_key.c ++++ b/net/dns_resolver/dns_key.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -91,9 +92,9 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) + + next_opt = memchr(opt, '#', end - opt) ?: end; + opt_len = next_opt - opt; +- if (!opt_len) { +- printk(KERN_WARNING +- "Empty option to dns_resolver key\n"); ++ if (opt_len <= 0 || opt_len > 128) { ++ pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n", ++ opt_len); + return -EINVAL; + } + +@@ -127,10 +128,8 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) + } + + bad_option_value: +- printk(KERN_WARNING +- "Option '%*.*s' to dns_resolver key:" +- " bad/missing value\n", +- opt_nlen, opt_nlen, opt); ++ pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n", ++ opt_nlen, opt_nlen, opt); + return -EINVAL; + } while (opt = next_opt + 1, opt < end); + } +diff --git a/net/ife/ife.c b/net/ife/ife.c +index 7d1ec76e7f43..13bbf8cb6a39 100644 +--- a/net/ife/ife.c ++++ b/net/ife/ife.c +@@ -69,6 +69,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen) + int total_pull; + u16 ifehdrln; + ++ if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN)) ++ return NULL; ++ + ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len); + ifehdrln = ntohs(ifehdr->metalen); + total_pull = skb->dev->hard_header_len + ifehdrln; +@@ -92,12 +95,43 @@ struct meta_tlvhdr { + __be16 len; + }; + ++static bool __ife_tlv_meta_valid(const unsigned char *skbdata, ++ const unsigned char *ifehdr_end) ++{ ++ const struct meta_tlvhdr *tlv; ++ u16 tlvlen; ++ ++ if (unlikely(skbdata + sizeof(*tlv) > ifehdr_end)) ++ return false; ++ ++ tlv = (const struct meta_tlvhdr *)skbdata; ++ tlvlen = ntohs(tlv->len); ++ ++ /* tlv length field is inc header, check on minimum */ ++ if (tlvlen < NLA_HDRLEN) ++ return false; ++ ++ /* overflow by NLA_ALIGN check */ ++ if (NLA_ALIGN(tlvlen) < tlvlen) ++ return false; ++ ++ if (unlikely(skbdata + NLA_ALIGN(tlvlen) > ifehdr_end)) ++ return false; ++ ++ return true; ++} ++ + /* Caller takes care of presenting data in network order + */ +-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen) ++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype, ++ u16 *dlen, u16 *totlen) + { +- struct meta_tlvhdr *tlv = (struct meta_tlvhdr *) skbdata; ++ struct meta_tlvhdr *tlv; ++ ++ if (!__ife_tlv_meta_valid(skbdata, ifehdr_end)) ++ return NULL; + ++ tlv = (struct meta_tlvhdr *)skbdata; + *dlen = ntohs(tlv->len) - NLA_HDRLEN; + *attrtype = ntohs(tlv->type); + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 38b9a6276a9d..d023f879e7bb 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2354,7 +2354,6 @@ int tcp_disconnect(struct sock *sk, int flags) + icsk->icsk_backoff = 0; + tp->snd_cwnd = 2; + icsk->icsk_probes_out = 0; +- tp->packets_out = 0; + tp->snd_ssthresh = TCP_INFINITE_SSTHRESH; + tp->snd_cwnd_cnt = 0; + tp->window_clamp = 0; +@@ -2742,8 +2741,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level, + #ifdef CONFIG_TCP_MD5SIG + case TCP_MD5SIG: + case TCP_MD5SIG_EXT: +- /* Read the IP->Key mappings from userspace */ +- err = tp->af_specific->md5_parse(sk, optname, optval, optlen); ++ if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) ++ err = tp->af_specific->md5_parse(sk, optname, optval, optlen); ++ else ++ err = -EINVAL; + break; + #endif + case TCP_USER_TIMEOUT: +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 14474acea0bb..ebbb54bcbcac 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3892,11 +3892,8 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th) + int length = (th->doff << 2) - sizeof(*th); + const u8 *ptr = (const u8 *)(th + 1); + +- /* If the TCP option is too short, we can short cut */ +- if (length < TCPOLEN_MD5SIG) +- return NULL; +- +- while (length > 0) { ++ /* If not enough data remaining, we can short cut */ ++ while (length >= TCPOLEN_MD5SIG) { + int opcode = *ptr++; + int opsize; + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 0126d9bfa670..e04c534b573e 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -2959,6 +2959,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned int mtu) + + static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = { + [RTA_GATEWAY] = { .len = sizeof(struct in6_addr) }, ++ [RTA_PREFSRC] = { .len = sizeof(struct in6_addr) }, + [RTA_OIF] = { .type = NLA_U32 }, + [RTA_IIF] = { .type = NLA_U32 }, + [RTA_PRIORITY] = { .type = NLA_U32 }, +@@ -2970,6 +2971,7 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = { + [RTA_EXPIRES] = { .type = NLA_U32 }, + [RTA_UID] = { .type = NLA_U32 }, + [RTA_MARK] = { .type = NLA_U32 }, ++ [RTA_TABLE] = { .type = NLA_U32 }, + }; + + static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh, +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index f343e6f0fc95..5fe139484919 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -136,7 +136,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + isrh->nexthdr = proto; + + hdr->daddr = isrh->segments[isrh->first_segment]; +- set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr); ++ set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr); + + #ifdef CONFIG_IPV6_SEG6_HMAC + if (sr_has_hmac(isrh)) { +diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c +index 0c2738349442..8bef35aa8786 100644 +--- a/net/l2tp/l2tp_ppp.c ++++ b/net/l2tp/l2tp_ppp.c +@@ -591,6 +591,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, + lock_sock(sk); + + error = -EINVAL; ++ ++ if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) && ++ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) && ++ sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) && ++ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6)) ++ goto end; ++ + if (sp->sa_protocol != PX_PROTO_OL2TP) + goto end; + +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index c38d16f22d2a..cf41d9b4a0b8 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -199,9 +199,19 @@ static int llc_ui_release(struct socket *sock) + llc->laddr.lsap, llc->daddr.lsap); + if (!llc_send_disc(sk)) + llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo); +- if (!sock_flag(sk, SOCK_ZAPPED)) ++ if (!sock_flag(sk, SOCK_ZAPPED)) { ++ struct llc_sap *sap = llc->sap; ++ ++ /* Hold this for release_sock(), so that llc_backlog_rcv() ++ * could still use it. ++ */ ++ llc_sap_hold(sap); + llc_sap_remove_socket(llc->sap, sk); +- release_sock(sk); ++ release_sock(sk); ++ llc_sap_put(sap); ++ } else { ++ release_sock(sk); ++ } + if (llc->dev) + dev_put(llc->dev); + sock_put(sk); +diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c +index ea225bd2672c..f8d4ab8ca1a5 100644 +--- a/net/llc/llc_c_ac.c ++++ b/net/llc/llc_c_ac.c +@@ -1096,14 +1096,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb) + + int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb) + { +- struct llc_sock *llc = llc_sk(sk); +- +- del_timer(&llc->pf_cycle_timer.timer); +- del_timer(&llc->ack_timer.timer); +- del_timer(&llc->rej_sent_timer.timer); +- del_timer(&llc->busy_state_timer.timer); +- llc->ack_must_be_send = 0; +- llc->ack_pf = 0; ++ llc_sk_stop_all_timers(sk, false); + return 0; + } + +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 5e91b47f0d2a..9a42448eb182 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -951,6 +951,26 @@ struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct pr + return sk; + } + ++void llc_sk_stop_all_timers(struct sock *sk, bool sync) ++{ ++ struct llc_sock *llc = llc_sk(sk); ++ ++ if (sync) { ++ del_timer_sync(&llc->pf_cycle_timer.timer); ++ del_timer_sync(&llc->ack_timer.timer); ++ del_timer_sync(&llc->rej_sent_timer.timer); ++ del_timer_sync(&llc->busy_state_timer.timer); ++ } else { ++ del_timer(&llc->pf_cycle_timer.timer); ++ del_timer(&llc->ack_timer.timer); ++ del_timer(&llc->rej_sent_timer.timer); ++ del_timer(&llc->busy_state_timer.timer); ++ } ++ ++ llc->ack_must_be_send = 0; ++ llc->ack_pf = 0; ++} ++ + /** + * llc_sk_free - Frees a LLC socket + * @sk - socket to free +@@ -963,7 +983,7 @@ void llc_sk_free(struct sock *sk) + + llc->state = LLC_CONN_OUT_OF_SVC; + /* Stop all (possibly) running timers */ +- llc_conn_ac_stop_all_timers(sk, NULL); ++ llc_sk_stop_all_timers(sk, true); + #ifdef DEBUG_LLC_CONN_ALLOC + printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__, + skb_queue_len(&llc->pdu_unack_q), +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index f4a0587b7d5e..3994b71f8197 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -331,11 +331,11 @@ static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb) + skb_set_queue_mapping(skb, queue_index); + } + +-/* register_prot_hook must be invoked with the po->bind_lock held, ++/* __register_prot_hook must be invoked through register_prot_hook + * or from a context in which asynchronous accesses to the packet + * socket is not possible (packet_create()). + */ +-static void register_prot_hook(struct sock *sk) ++static void __register_prot_hook(struct sock *sk) + { + struct packet_sock *po = pkt_sk(sk); + +@@ -350,8 +350,13 @@ static void register_prot_hook(struct sock *sk) + } + } + +-/* {,__}unregister_prot_hook() must be invoked with the po->bind_lock +- * held. If the sync parameter is true, we will temporarily drop ++static void register_prot_hook(struct sock *sk) ++{ ++ lockdep_assert_held_once(&pkt_sk(sk)->bind_lock); ++ __register_prot_hook(sk); ++} ++ ++/* If the sync parameter is true, we will temporarily drop + * the po->bind_lock and do a synchronize_net to make sure no + * asynchronous packet processing paths still refer to the elements + * of po->prot_hook. If the sync parameter is false, it is the +@@ -361,6 +366,8 @@ static void __unregister_prot_hook(struct sock *sk, bool sync) + { + struct packet_sock *po = pkt_sk(sk); + ++ lockdep_assert_held_once(&po->bind_lock); ++ + po->running = 0; + + if (po->fanout) +@@ -3017,6 +3024,7 @@ static int packet_release(struct socket *sock) + + packet_flush_mclist(sk); + ++ lock_sock(sk); + if (po->rx_ring.pg_vec) { + memset(&req_u, 0, sizeof(req_u)); + packet_set_ring(sk, &req_u, 1, 0); +@@ -3026,6 +3034,7 @@ static int packet_release(struct socket *sock) + memset(&req_u, 0, sizeof(req_u)); + packet_set_ring(sk, &req_u, 1, 1); + } ++ release_sock(sk); + + f = fanout_release(sk); + +@@ -3259,7 +3268,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol, + + if (proto) { + po->prot_hook.type = proto; +- register_prot_hook(sk); ++ __register_prot_hook(sk); + } + + mutex_lock(&net->packet.sklist_lock); +@@ -3654,6 +3663,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + union tpacket_req_u req_u; + int len; + ++ lock_sock(sk); + switch (po->tp_version) { + case TPACKET_V1: + case TPACKET_V2: +@@ -3664,12 +3674,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + len = sizeof(req_u.req3); + break; + } +- if (optlen < len) +- return -EINVAL; +- if (copy_from_user(&req_u.req, optval, len)) +- return -EFAULT; +- return packet_set_ring(sk, &req_u, 0, +- optname == PACKET_TX_RING); ++ if (optlen < len) { ++ ret = -EINVAL; ++ } else { ++ if (copy_from_user(&req_u.req, optval, len)) ++ ret = -EFAULT; ++ else ++ ret = packet_set_ring(sk, &req_u, 0, ++ optname == PACKET_TX_RING); ++ } ++ release_sock(sk); ++ return ret; + } + case PACKET_COPY_THRESH: + { +@@ -3735,12 +3750,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + + if (optlen != sizeof(val)) + return -EINVAL; +- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) +- return -EBUSY; + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; +- po->tp_loss = !!val; +- return 0; ++ ++ lock_sock(sk); ++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { ++ ret = -EBUSY; ++ } else { ++ po->tp_loss = !!val; ++ ret = 0; ++ } ++ release_sock(sk); ++ return ret; + } + case PACKET_AUXDATA: + { +@@ -3751,7 +3772,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + ++ lock_sock(sk); + po->auxdata = !!val; ++ release_sock(sk); + return 0; + } + case PACKET_ORIGDEV: +@@ -3763,7 +3786,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + ++ lock_sock(sk); + po->origdev = !!val; ++ release_sock(sk); + return 0; + } + case PACKET_VNET_HDR: +@@ -3772,15 +3797,20 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + + if (sock->type != SOCK_RAW) + return -EINVAL; +- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) +- return -EBUSY; + if (optlen < sizeof(val)) + return -EINVAL; + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + +- po->has_vnet_hdr = !!val; +- return 0; ++ lock_sock(sk); ++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { ++ ret = -EBUSY; ++ } else { ++ po->has_vnet_hdr = !!val; ++ ret = 0; ++ } ++ release_sock(sk); ++ return ret; + } + case PACKET_TIMESTAMP: + { +@@ -3818,11 +3848,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv + + if (optlen != sizeof(val)) + return -EINVAL; +- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) +- return -EBUSY; + if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; +- po->tp_tx_has_off = !!val; ++ ++ lock_sock(sk); ++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { ++ ret = -EBUSY; ++ } else { ++ po->tp_tx_has_off = !!val; ++ ret = 0; ++ } ++ release_sock(sk); + return 0; + } + case PACKET_QDISC_BYPASS: +@@ -4219,8 +4255,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + /* Added to avoid minimal code churn */ + struct tpacket_req *req = &req_u->req; + +- lock_sock(sk); +- + rb = tx_ring ? &po->tx_ring : &po->rx_ring; + rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; + +@@ -4358,7 +4392,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + if (pg_vec) + free_pg_vec(pg_vec, order, req->tp_block_nr); + out: +- release_sock(sk); + return err; + } + +diff --git a/net/packet/internal.h b/net/packet/internal.h +index a1d2b2319ae9..3bb7c5fb3bff 100644 +--- a/net/packet/internal.h ++++ b/net/packet/internal.h +@@ -112,10 +112,12 @@ struct packet_sock { + int copy_thresh; + spinlock_t bind_lock; + struct mutex pg_vec_lock; +- unsigned int running:1, /* prot_hook is attached*/ +- auxdata:1, ++ unsigned int running; /* bind_lock must be held */ ++ unsigned int auxdata:1, /* writer must hold sock lock */ + origdev:1, +- has_vnet_hdr:1; ++ has_vnet_hdr:1, ++ tp_loss:1, ++ tp_tx_has_off:1; + int pressure; + int ifindex; /* bound device */ + __be16 num; +@@ -125,8 +127,6 @@ struct packet_sock { + enum tpacket_versions tp_version; + unsigned int tp_hdrlen; + unsigned int tp_reserve; +- unsigned int tp_loss:1; +- unsigned int tp_tx_has_off:1; + unsigned int tp_tstamp; + struct net_device __rcu *cached_dev; + int (*xmit)(struct sk_buff *skb); +diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c +index 8ccd35825b6b..85757af7f150 100644 +--- a/net/sched/act_ife.c ++++ b/net/sched/act_ife.c +@@ -605,7 +605,7 @@ static int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife, + } + } + +- return 0; ++ return -ENOENT; + } + + static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a, +@@ -639,7 +639,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a, + u16 mtype; + u16 dlen; + +- curr_data = ife_tlv_meta_decode(tlv_data, &mtype, &dlen, NULL); ++ curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype, ++ &dlen, NULL); ++ if (!curr_data) { ++ qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats)); ++ return TC_ACT_SHOT; ++ } + + if (find_decode_metaid(skb, ife, mtype, dlen, curr_data)) { + /* abuse overlimits to count when we receive metadata +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 08b5705e7381..7219a1c041f7 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -521,46 +521,49 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr, + addr->v6.sin6_scope_id = 0; + } + +-/* Compare addresses exactly. +- * v4-mapped-v6 is also in consideration. +- */ +-static int sctp_v6_cmp_addr(const union sctp_addr *addr1, +- const union sctp_addr *addr2) ++static int __sctp_v6_cmp_addr(const union sctp_addr *addr1, ++ const union sctp_addr *addr2) + { + if (addr1->sa.sa_family != addr2->sa.sa_family) { + if (addr1->sa.sa_family == AF_INET && + addr2->sa.sa_family == AF_INET6 && +- ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) { +- if (addr2->v6.sin6_port == addr1->v4.sin_port && +- addr2->v6.sin6_addr.s6_addr32[3] == +- addr1->v4.sin_addr.s_addr) +- return 1; +- } ++ ipv6_addr_v4mapped(&addr2->v6.sin6_addr) && ++ addr2->v6.sin6_addr.s6_addr32[3] == ++ addr1->v4.sin_addr.s_addr) ++ return 1; ++ + if (addr2->sa.sa_family == AF_INET && + addr1->sa.sa_family == AF_INET6 && +- ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) { +- if (addr1->v6.sin6_port == addr2->v4.sin_port && +- addr1->v6.sin6_addr.s6_addr32[3] == +- addr2->v4.sin_addr.s_addr) +- return 1; +- } ++ ipv6_addr_v4mapped(&addr1->v6.sin6_addr) && ++ addr1->v6.sin6_addr.s6_addr32[3] == ++ addr2->v4.sin_addr.s_addr) ++ return 1; ++ + return 0; + } +- if (addr1->v6.sin6_port != addr2->v6.sin6_port) +- return 0; ++ + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; ++ + /* If this is a linklocal address, compare the scope_id. */ +- if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) { +- if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id && +- (addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) { +- return 0; +- } +- } ++ if ((ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) && ++ addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id && ++ addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id) ++ return 0; + + return 1; + } + ++/* Compare addresses exactly. ++ * v4-mapped-v6 is also in consideration. ++ */ ++static int sctp_v6_cmp_addr(const union sctp_addr *addr1, ++ const union sctp_addr *addr2) ++{ ++ return __sctp_v6_cmp_addr(addr1, addr2) && ++ addr1->v6.sin6_port == addr2->v6.sin6_port; ++} ++ + /* Initialize addr struct to INADDR_ANY. */ + static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port) + { +@@ -845,8 +848,8 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1, + const union sctp_addr *addr2, + struct sctp_sock *opt) + { +- struct sctp_af *af1, *af2; + struct sock *sk = sctp_opt2sk(opt); ++ struct sctp_af *af1, *af2; + + af1 = sctp_get_af_specific(addr1->sa.sa_family); + af2 = sctp_get_af_specific(addr2->sa.sa_family); +@@ -862,10 +865,7 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1, + if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2)) + return 1; + +- if (addr1->sa.sa_family != addr2->sa.sa_family) +- return 0; +- +- return af1->cmp_addr(addr1, addr2); ++ return __sctp_v6_cmp_addr(addr1, addr2); + } + + /* Verify that the provided sockaddr looks bindable. Common verification, +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index a6d604fd9695..f9c289e05707 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1203,14 +1203,12 @@ static int smc_shutdown(struct socket *sock, int how) + rc = smc_close_shutdown_write(smc); + break; + case SHUT_RD: +- if (sk->sk_state == SMC_LISTEN) +- rc = smc_close_active(smc); +- else +- rc = 0; +- /* nothing more to do because peer is not involved */ ++ rc = 0; ++ /* nothing more to do because peer is not involved */ + break; + } +- rc1 = kernel_sock_shutdown(smc->clcsock, how); ++ if (smc->clcsock) ++ rc1 = kernel_sock_shutdown(smc->clcsock, how); + /* map sock_shutdown_cmd constants to sk_shutdown value range */ + sk->sk_shutdown |= how + 1; + +diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c +index 4a3a3f1331ee..c741365f77da 100644 +--- a/net/strparser/strparser.c ++++ b/net/strparser/strparser.c +@@ -67,7 +67,7 @@ static void strp_abort_strp(struct strparser *strp, int err) + + static void strp_start_timer(struct strparser *strp, long timeo) + { +- if (timeo) ++ if (timeo && timeo != LONG_MAX) + mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo); + } + +@@ -296,9 +296,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb, + strp_start_timer(strp, timeo); + } + ++ stm->accum_len += cand_len; + strp->need_bytes = stm->strp.full_len - + stm->accum_len; +- stm->accum_len += cand_len; + stm->early_eaten = cand_len; + STRP_STATS_ADD(strp->stats.bytes, cand_len); + desc->count = 0; /* Stop reading socket */ +@@ -321,6 +321,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb, + /* Hurray, we have a new message! */ + cancel_delayed_work(&strp->msg_timer_work); + strp->skb_head = NULL; ++ strp->need_bytes = 0; + STRP_STATS_INCR(strp->stats.msgs); + + /* Give skb to upper layer */ +@@ -410,9 +411,7 @@ void strp_data_ready(struct strparser *strp) + return; + + if (strp->need_bytes) { +- if (strp_peek_len(strp) >= strp->need_bytes) +- strp->need_bytes = 0; +- else ++ if (strp_peek_len(strp) < strp->need_bytes) + return; + } + +diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c +index b76f13f6fea1..d4e0bbeee727 100644 +--- a/net/tipc/netlink.c ++++ b/net/tipc/netlink.c +@@ -79,7 +79,8 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = { + + const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = { + [TIPC_NLA_NET_UNSPEC] = { .type = NLA_UNSPEC }, +- [TIPC_NLA_NET_ID] = { .type = NLA_U32 } ++ [TIPC_NLA_NET_ID] = { .type = NLA_U32 }, ++ [TIPC_NLA_NET_ADDR] = { .type = NLA_U32 }, + }; + + const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = { +diff --git a/security/commoncap.c b/security/commoncap.c +index 7b01431d1e19..1c1f64582bb5 100644 +--- a/security/commoncap.c ++++ b/security/commoncap.c +@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer, + magic |= VFS_CAP_FLAGS_EFFECTIVE; + memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32); + cap->magic_etc = cpu_to_le32(magic); ++ } else { ++ size = -ENOMEM; + } + } + kfree(tmpbuf); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.38-39.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.38-39.patch new file mode 100644 index 000000000000..f7760eb05d6f --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.38-39.patch @@ -0,0 +1,3551 @@ +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 0f9089416b4c..88ad78c6f605 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -1940,6 +1940,9 @@ ARM 32-bit VFP control registers have the following id bit patterns: + ARM 64-bit FP registers have the following id bit patterns: + 0x4030 0000 0012 0 + ++ARM firmware pseudo-registers have the following bit pattern: ++ 0x4030 0000 0014 ++ + + arm64 registers are mapped using the lower 32 bits. The upper 16 of + that is the register group type, or coprocessor number: +@@ -1956,6 +1959,9 @@ arm64 CCSIDR registers are demultiplexed by CSSELR value: + arm64 system registers have the following id bit patterns: + 0x6030 0000 0013 + ++arm64 firmware pseudo-registers have the following bit pattern: ++ 0x6030 0000 0014 ++ + + MIPS registers are mapped using the lower 32 bits. The upper 16 of that is + the register group type: +@@ -2490,7 +2496,8 @@ Possible features: + and execute guest code when KVM_RUN is called. + - KVM_ARM_VCPU_EL1_32BIT: Starts the CPU in a 32bit mode. + Depends on KVM_CAP_ARM_EL1_32BIT (arm64 only). +- - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 for the CPU. ++ - KVM_ARM_VCPU_PSCI_0_2: Emulate PSCI v0.2 (or a future revision ++ backward compatible with v0.2) for the CPU. + Depends on KVM_CAP_ARM_PSCI_0_2. + - KVM_ARM_VCPU_PMU_V3: Emulate PMUv3 for the CPU. + Depends on KVM_CAP_ARM_PMU_V3. +diff --git a/Documentation/virtual/kvm/arm/psci.txt b/Documentation/virtual/kvm/arm/psci.txt +new file mode 100644 +index 000000000000..aafdab887b04 +--- /dev/null ++++ b/Documentation/virtual/kvm/arm/psci.txt +@@ -0,0 +1,30 @@ ++KVM implements the PSCI (Power State Coordination Interface) ++specification in order to provide services such as CPU on/off, reset ++and power-off to the guest. ++ ++The PSCI specification is regularly updated to provide new features, ++and KVM implements these updates if they make sense from a virtualization ++point of view. ++ ++This means that a guest booted on two different versions of KVM can ++observe two different "firmware" revisions. This could cause issues if ++a given guest is tied to a particular PSCI revision (unlikely), or if ++a migration causes a different PSCI version to be exposed out of the ++blue to an unsuspecting guest. ++ ++In order to remedy this situation, KVM exposes a set of "firmware ++pseudo-registers" that can be manipulated using the GET/SET_ONE_REG ++interface. These registers can be saved/restored by userspace, and set ++to a convenient value if required. ++ ++The following register is defined: ++ ++* KVM_REG_ARM_PSCI_VERSION: ++ ++ - Only valid if the vcpu has the KVM_ARM_VCPU_PSCI_0_2 feature set ++ (and thus has already been initialized) ++ - Returns the current PSCI version on GET_ONE_REG (defaulting to the ++ highest PSCI version implemented by KVM and compatible with v0.2) ++ - Allows any PSCI version implemented by KVM and compatible with ++ v0.2 to be set with SET_ONE_REG ++ - Affects the whole VM (even if the register view is per-vcpu) +diff --git a/Makefile b/Makefile +index 27a8d5c37180..248b99283f71 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 38 ++SUBLEVEL = 39 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/configs/socfpga_defconfig b/arch/arm/configs/socfpga_defconfig +index 2620ce790db0..371fca4e1ab7 100644 +--- a/arch/arm/configs/socfpga_defconfig ++++ b/arch/arm/configs/socfpga_defconfig +@@ -57,6 +57,7 @@ CONFIG_MTD_M25P80=y + CONFIG_MTD_NAND=y + CONFIG_MTD_NAND_DENALI_DT=y + CONFIG_MTD_SPI_NOR=y ++# CONFIG_MTD_SPI_NOR_USE_4K_SECTORS is not set + CONFIG_SPI_CADENCE_QUADSPI=y + CONFIG_OF_OVERLAY=y + CONFIG_OF_CONFIGFS=y +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index 31fbb9285f62..8f973e3b7348 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -75,6 +75,9 @@ struct kvm_arch { + /* Interrupt controller */ + struct vgic_dist vgic; + int max_vcpus; ++ ++ /* Mandated version of PSCI */ ++ u32 psci_version; + }; + + #define KVM_NR_MEM_OBJS 40 +diff --git a/arch/arm/include/uapi/asm/kvm.h b/arch/arm/include/uapi/asm/kvm.h +index 1f57bbe82b6f..df24fc8da1bc 100644 +--- a/arch/arm/include/uapi/asm/kvm.h ++++ b/arch/arm/include/uapi/asm/kvm.h +@@ -180,6 +180,12 @@ struct kvm_arch_memory_slot { + #define KVM_REG_ARM_VFP_FPINST 0x1009 + #define KVM_REG_ARM_VFP_FPINST2 0x100A + ++/* KVM-as-firmware specific pseudo-registers */ ++#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) ++#define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM | KVM_REG_SIZE_U64 | \ ++ KVM_REG_ARM_FW | ((r) & 0xffff)) ++#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) ++ + /* Device Control API: ARM VGIC */ + #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 + #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 +diff --git a/arch/arm/kvm/guest.c b/arch/arm/kvm/guest.c +index 1e0784ebbfd6..a18f33edc471 100644 +--- a/arch/arm/kvm/guest.c ++++ b/arch/arm/kvm/guest.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -176,6 +177,7 @@ static unsigned long num_core_regs(void) + unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu) + { + return num_core_regs() + kvm_arm_num_coproc_regs(vcpu) ++ + kvm_arm_get_fw_num_regs(vcpu) + + NUM_TIMER_REGS; + } + +@@ -196,6 +198,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) + uindices++; + } + ++ ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices); ++ if (ret) ++ return ret; ++ uindices += kvm_arm_get_fw_num_regs(vcpu); ++ + ret = copy_timer_indices(vcpu, uindices); + if (ret) + return ret; +@@ -214,6 +221,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) + return get_core_reg(vcpu, reg); + ++ if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW) ++ return kvm_arm_get_fw_reg(vcpu, reg); ++ + if (is_timer_reg(reg->id)) + return get_timer_reg(vcpu, reg); + +@@ -230,6 +240,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) + return set_core_reg(vcpu, reg); + ++ if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW) ++ return kvm_arm_set_fw_reg(vcpu, reg); ++ + if (is_timer_reg(reg->id)) + return set_timer_reg(vcpu, reg); + +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 8ad208cb866c..8abec9f7f430 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -71,6 +71,9 @@ struct kvm_arch { + + /* Interrupt controller */ + struct vgic_dist vgic; ++ ++ /* Mandated version of PSCI */ ++ u32 psci_version; + }; + + #define KVM_NR_MEM_OBJS 40 +diff --git a/arch/arm64/include/uapi/asm/kvm.h b/arch/arm64/include/uapi/asm/kvm.h +index 51149ec75fe4..9f74ce5899f0 100644 +--- a/arch/arm64/include/uapi/asm/kvm.h ++++ b/arch/arm64/include/uapi/asm/kvm.h +@@ -200,6 +200,12 @@ struct kvm_arch_memory_slot { + #define KVM_REG_ARM_TIMER_CNT ARM64_SYS_REG(3, 3, 14, 3, 2) + #define KVM_REG_ARM_TIMER_CVAL ARM64_SYS_REG(3, 3, 14, 0, 2) + ++/* KVM-as-firmware specific pseudo-registers */ ++#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) ++#define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ ++ KVM_REG_ARM_FW | ((r) & 0xffff)) ++#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) ++ + /* Device Control API: ARM VGIC */ + #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 + #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 +diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c +index 5c7f657dd207..811f04c5760e 100644 +--- a/arch/arm64/kvm/guest.c ++++ b/arch/arm64/kvm/guest.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -205,7 +206,7 @@ static int get_timer_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + unsigned long kvm_arm_num_regs(struct kvm_vcpu *vcpu) + { + return num_core_regs() + kvm_arm_num_sys_reg_descs(vcpu) +- + NUM_TIMER_REGS; ++ + kvm_arm_get_fw_num_regs(vcpu) + NUM_TIMER_REGS; + } + + /** +@@ -225,6 +226,11 @@ int kvm_arm_copy_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) + uindices++; + } + ++ ret = kvm_arm_copy_fw_reg_indices(vcpu, uindices); ++ if (ret) ++ return ret; ++ uindices += kvm_arm_get_fw_num_regs(vcpu); ++ + ret = copy_timer_indices(vcpu, uindices); + if (ret) + return ret; +@@ -243,6 +249,9 @@ int kvm_arm_get_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) + return get_core_reg(vcpu, reg); + ++ if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW) ++ return kvm_arm_get_fw_reg(vcpu, reg); ++ + if (is_timer_reg(reg->id)) + return get_timer_reg(vcpu, reg); + +@@ -259,6 +268,9 @@ int kvm_arm_set_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) + if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_CORE) + return set_core_reg(vcpu, reg); + ++ if ((reg->id & KVM_REG_ARM_COPROC_MASK) == KVM_REG_ARM_FW) ++ return kvm_arm_set_fw_reg(vcpu, reg); ++ + if (is_timer_reg(reg->id)) + return set_timer_reg(vcpu, reg); + +diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c +index 8b840191df59..ca2243df9cb2 100644 +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -207,18 +207,18 @@ static void *eeh_report_error(void *data, void *userdata) + + if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) + return NULL; ++ ++ device_lock(&dev->dev); + dev->error_state = pci_channel_io_frozen; + + driver = eeh_pcid_get(dev); +- if (!driver) return NULL; ++ if (!driver) goto out_no_dev; + + eeh_disable_irq(dev); + + if (!driver->err_handler || +- !driver->err_handler->error_detected) { +- eeh_pcid_put(dev); +- return NULL; +- } ++ !driver->err_handler->error_detected) ++ goto out; + + rc = driver->err_handler->error_detected(dev, pci_channel_io_frozen); + +@@ -227,7 +227,10 @@ static void *eeh_report_error(void *data, void *userdata) + if (*res == PCI_ERS_RESULT_NONE) *res = rc; + + edev->in_error = true; ++out: + eeh_pcid_put(dev); ++out_no_dev: ++ device_unlock(&dev->dev); + return NULL; + } + +@@ -250,15 +253,14 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) + if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) + return NULL; + ++ device_lock(&dev->dev); + driver = eeh_pcid_get(dev); +- if (!driver) return NULL; ++ if (!driver) goto out_no_dev; + + if (!driver->err_handler || + !driver->err_handler->mmio_enabled || +- (edev->mode & EEH_DEV_NO_HANDLER)) { +- eeh_pcid_put(dev); +- return NULL; +- } ++ (edev->mode & EEH_DEV_NO_HANDLER)) ++ goto out; + + rc = driver->err_handler->mmio_enabled(dev); + +@@ -266,7 +268,10 @@ static void *eeh_report_mmio_enabled(void *data, void *userdata) + if (rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; + if (*res == PCI_ERS_RESULT_NONE) *res = rc; + ++out: + eeh_pcid_put(dev); ++out_no_dev: ++ device_unlock(&dev->dev); + return NULL; + } + +@@ -289,20 +294,20 @@ static void *eeh_report_reset(void *data, void *userdata) + + if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) + return NULL; ++ ++ device_lock(&dev->dev); + dev->error_state = pci_channel_io_normal; + + driver = eeh_pcid_get(dev); +- if (!driver) return NULL; ++ if (!driver) goto out_no_dev; + + eeh_enable_irq(dev); + + if (!driver->err_handler || + !driver->err_handler->slot_reset || + (edev->mode & EEH_DEV_NO_HANDLER) || +- (!edev->in_error)) { +- eeh_pcid_put(dev); +- return NULL; +- } ++ (!edev->in_error)) ++ goto out; + + rc = driver->err_handler->slot_reset(dev); + if ((*res == PCI_ERS_RESULT_NONE) || +@@ -310,7 +315,10 @@ static void *eeh_report_reset(void *data, void *userdata) + if (*res == PCI_ERS_RESULT_DISCONNECT && + rc == PCI_ERS_RESULT_NEED_RESET) *res = rc; + ++out: + eeh_pcid_put(dev); ++out_no_dev: ++ device_unlock(&dev->dev); + return NULL; + } + +@@ -361,10 +369,12 @@ static void *eeh_report_resume(void *data, void *userdata) + + if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) + return NULL; ++ ++ device_lock(&dev->dev); + dev->error_state = pci_channel_io_normal; + + driver = eeh_pcid_get(dev); +- if (!driver) return NULL; ++ if (!driver) goto out_no_dev; + + was_in_error = edev->in_error; + edev->in_error = false; +@@ -374,13 +384,15 @@ static void *eeh_report_resume(void *data, void *userdata) + !driver->err_handler->resume || + (edev->mode & EEH_DEV_NO_HANDLER) || !was_in_error) { + edev->mode &= ~EEH_DEV_NO_HANDLER; +- eeh_pcid_put(dev); +- return NULL; ++ goto out; + } + + driver->err_handler->resume(dev); + ++out: + eeh_pcid_put(dev); ++out_no_dev: ++ device_unlock(&dev->dev); + return NULL; + } + +@@ -400,22 +412,25 @@ static void *eeh_report_failure(void *data, void *userdata) + + if (!dev || eeh_dev_removed(edev) || eeh_pe_passed(edev->pe)) + return NULL; ++ ++ device_lock(&dev->dev); + dev->error_state = pci_channel_io_perm_failure; + + driver = eeh_pcid_get(dev); +- if (!driver) return NULL; ++ if (!driver) goto out_no_dev; + + eeh_disable_irq(dev); + + if (!driver->err_handler || +- !driver->err_handler->error_detected) { +- eeh_pcid_put(dev); +- return NULL; +- } ++ !driver->err_handler->error_detected) ++ goto out; + + driver->err_handler->error_detected(dev, pci_channel_io_perm_failure); + ++out: + eeh_pcid_put(dev); ++out_no_dev: ++ device_unlock(&dev->dev); + return NULL; + } + +diff --git a/arch/powerpc/mm/mem.c b/arch/powerpc/mm/mem.c +index 4362b86ef84c..9c2f83331e5b 100644 +--- a/arch/powerpc/mm/mem.c ++++ b/arch/powerpc/mm/mem.c +@@ -143,6 +143,7 @@ int arch_add_memory(int nid, u64 start, u64 size, bool want_memblock) + start, start + size, rc); + return -EFAULT; + } ++ flush_inval_dcache_range(start, start + size); + + return __add_pages(nid, start_pfn, nr_pages, want_memblock); + } +@@ -171,6 +172,7 @@ int arch_remove_memory(u64 start, u64 size) + + /* Remove htab bolted mappings for this section of memory */ + start = (unsigned long)__va(start); ++ flush_inval_dcache_range(start, start + size); + ret = remove_section_mapping(start, start + size); + + /* Ensure all vmalloc mappings are flushed in case they also +diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c +index 2cb6cbea4b3b..4043109f4051 100644 +--- a/arch/powerpc/platforms/powernv/npu-dma.c ++++ b/arch/powerpc/platforms/powernv/npu-dma.c +@@ -33,6 +33,13 @@ + + #define npu_to_phb(x) container_of(x, struct pnv_phb, npu) + ++/* ++ * When an address shootdown range exceeds this threshold we invalidate the ++ * entire TLB on the GPU for the given PID rather than each specific address in ++ * the range. ++ */ ++#define ATSD_THRESHOLD (2*1024*1024) ++ + /* + * Other types of TCE cache invalidation are not functional in the + * hardware. +@@ -621,11 +628,19 @@ static void pnv_npu2_mn_invalidate_range(struct mmu_notifier *mn, + struct npu_context *npu_context = mn_to_npu_context(mn); + unsigned long address; + +- for (address = start; address < end; address += PAGE_SIZE) +- mmio_invalidate(npu_context, 1, address, false); ++ if (end - start > ATSD_THRESHOLD) { ++ /* ++ * Just invalidate the entire PID if the address range is too ++ * large. ++ */ ++ mmio_invalidate(npu_context, 0, 0, true); ++ } else { ++ for (address = start; address < end; address += PAGE_SIZE) ++ mmio_invalidate(npu_context, 1, address, false); + +- /* Do the flush only on the final addess == end */ +- mmio_invalidate(npu_context, 1, address, true); ++ /* Do the flush only on the final addess == end */ ++ mmio_invalidate(npu_context, 1, address, true); ++ } + } + + static const struct mmu_notifier_ops nv_nmmu_notifier_ops = { +diff --git a/arch/powerpc/platforms/powernv/opal-rtc.c b/arch/powerpc/platforms/powernv/opal-rtc.c +index f8868864f373..aa2a5139462e 100644 +--- a/arch/powerpc/platforms/powernv/opal-rtc.c ++++ b/arch/powerpc/platforms/powernv/opal-rtc.c +@@ -48,10 +48,12 @@ unsigned long __init opal_get_boot_time(void) + + while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) { + rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms); +- if (rc == OPAL_BUSY_EVENT) ++ if (rc == OPAL_BUSY_EVENT) { ++ mdelay(OPAL_BUSY_DELAY_MS); + opal_poll_events(NULL); +- else if (rc == OPAL_BUSY) +- mdelay(10); ++ } else if (rc == OPAL_BUSY) { ++ mdelay(OPAL_BUSY_DELAY_MS); ++ } + } + if (rc != OPAL_SUCCESS) + return 0; +diff --git a/arch/x86/include/uapi/asm/msgbuf.h b/arch/x86/include/uapi/asm/msgbuf.h +index 809134c644a6..90ab9a795b49 100644 +--- a/arch/x86/include/uapi/asm/msgbuf.h ++++ b/arch/x86/include/uapi/asm/msgbuf.h +@@ -1 +1,32 @@ ++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++#ifndef __ASM_X64_MSGBUF_H ++#define __ASM_X64_MSGBUF_H ++ ++#if !defined(__x86_64__) || !defined(__ILP32__) + #include ++#else ++/* ++ * The msqid64_ds structure for x86 architecture with x32 ABI. ++ * ++ * On x86-32 and x86-64 we can just use the generic definition, but ++ * x32 uses the same binary layout as x86_64, which is differnet ++ * from other 32-bit architectures. ++ */ ++ ++struct msqid64_ds { ++ struct ipc64_perm msg_perm; ++ __kernel_time_t msg_stime; /* last msgsnd time */ ++ __kernel_time_t msg_rtime; /* last msgrcv time */ ++ __kernel_time_t msg_ctime; /* last change time */ ++ __kernel_ulong_t msg_cbytes; /* current number of bytes on queue */ ++ __kernel_ulong_t msg_qnum; /* number of messages in queue */ ++ __kernel_ulong_t msg_qbytes; /* max number of bytes on queue */ ++ __kernel_pid_t msg_lspid; /* pid of last msgsnd */ ++ __kernel_pid_t msg_lrpid; /* last receive pid */ ++ __kernel_ulong_t __unused4; ++ __kernel_ulong_t __unused5; ++}; ++ ++#endif ++ ++#endif /* __ASM_GENERIC_MSGBUF_H */ +diff --git a/arch/x86/include/uapi/asm/shmbuf.h b/arch/x86/include/uapi/asm/shmbuf.h +index 83c05fc2de38..644421f3823b 100644 +--- a/arch/x86/include/uapi/asm/shmbuf.h ++++ b/arch/x86/include/uapi/asm/shmbuf.h +@@ -1 +1,43 @@ ++/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */ ++#ifndef __ASM_X86_SHMBUF_H ++#define __ASM_X86_SHMBUF_H ++ ++#if !defined(__x86_64__) || !defined(__ILP32__) + #include ++#else ++/* ++ * The shmid64_ds structure for x86 architecture with x32 ABI. ++ * ++ * On x86-32 and x86-64 we can just use the generic definition, but ++ * x32 uses the same binary layout as x86_64, which is differnet ++ * from other 32-bit architectures. ++ */ ++ ++struct shmid64_ds { ++ struct ipc64_perm shm_perm; /* operation perms */ ++ size_t shm_segsz; /* size of segment (bytes) */ ++ __kernel_time_t shm_atime; /* last attach time */ ++ __kernel_time_t shm_dtime; /* last detach time */ ++ __kernel_time_t shm_ctime; /* last change time */ ++ __kernel_pid_t shm_cpid; /* pid of creator */ ++ __kernel_pid_t shm_lpid; /* pid of last operator */ ++ __kernel_ulong_t shm_nattch; /* no. of current attaches */ ++ __kernel_ulong_t __unused4; ++ __kernel_ulong_t __unused5; ++}; ++ ++struct shminfo64 { ++ __kernel_ulong_t shmmax; ++ __kernel_ulong_t shmmin; ++ __kernel_ulong_t shmmni; ++ __kernel_ulong_t shmseg; ++ __kernel_ulong_t shmall; ++ __kernel_ulong_t __unused1; ++ __kernel_ulong_t __unused2; ++ __kernel_ulong_t __unused3; ++ __kernel_ulong_t __unused4; ++}; ++ ++#endif ++ ++#endif /* __ASM_X86_SHMBUF_H */ +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 021c90464cc2..c8e0cda0f272 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -564,14 +564,12 @@ static int __reload_late(void *info) + apply_microcode_local(&err); + spin_unlock(&update_lock); + ++ /* siblings return UCODE_OK because their engine got updated already */ + if (err > UCODE_NFOUND) { + pr_warn("Error reloading microcode on CPU %d\n", cpu); +- return -1; +- /* siblings return UCODE_OK because their engine got updated already */ ++ ret = -1; + } else if (err == UCODE_UPDATED || err == UCODE_OK) { + ret = 1; +- } else { +- return ret; + } + + /* +diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c +index 32b8e5724f96..1c2cfa0644aa 100644 +--- a/arch/x86/kernel/cpu/microcode/intel.c ++++ b/arch/x86/kernel/cpu/microcode/intel.c +@@ -485,7 +485,6 @@ static void show_saved_mc(void) + */ + static void save_mc_for_early(u8 *mc, unsigned int size) + { +-#ifdef CONFIG_HOTPLUG_CPU + /* Synchronization during CPU hotplug. */ + static DEFINE_MUTEX(x86_cpu_microcode_mutex); + +@@ -495,7 +494,6 @@ static void save_mc_for_early(u8 *mc, unsigned int size) + show_saved_mc(); + + mutex_unlock(&x86_cpu_microcode_mutex); +-#endif + } + + static bool load_builtin_intel_microcode(struct cpio_data *cp) +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 2651ca2112c4..6b841262b790 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1613,6 +1613,8 @@ static inline void mwait_play_dead(void) + void *mwait_ptr; + int i; + ++ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) ++ return; + if (!this_cpu_has(X86_FEATURE_MWAIT)) + return; + if (!this_cpu_has(X86_FEATURE_CLFLUSH)) +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 0f860cf0d56d..56c9cd01fd1d 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -4447,8 +4447,16 @@ static void bfq_prepare_request(struct request *rq, struct bio *bio) + bool new_queue = false; + bool bfqq_already_existing = false, split = false; + +- if (!rq->elv.icq) ++ /* ++ * Even if we don't have an icq attached, we should still clear ++ * the scheduler pointers, as they might point to previously ++ * allocated bic/bfqq structs. ++ */ ++ if (!rq->elv.icq) { ++ rq->elv.priv[0] = rq->elv.priv[1] = NULL; + return; ++ } ++ + bic = icq_to_bic(rq->elv.icq); + + spin_lock_irq(&bfqd->lock); +diff --git a/crypto/drbg.c b/crypto/drbg.c +index 70018397e59a..6c3221313753 100644 +--- a/crypto/drbg.c ++++ b/crypto/drbg.c +@@ -1134,8 +1134,10 @@ static inline void drbg_dealloc_state(struct drbg_state *drbg) + if (!drbg) + return; + kzfree(drbg->Vbuf); ++ drbg->Vbuf = NULL; + drbg->V = NULL; + kzfree(drbg->Cbuf); ++ drbg->Cbuf = NULL; + drbg->C = NULL; + kzfree(drbg->scratchpadbuf); + drbg->scratchpadbuf = NULL; +diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c +index e0f74ddc22b7..8a99fbe5759f 100644 +--- a/drivers/amba/bus.c ++++ b/drivers/amba/bus.c +@@ -69,11 +69,12 @@ static ssize_t driver_override_show(struct device *_dev, + struct device_attribute *attr, char *buf) + { + struct amba_device *dev = to_amba_device(_dev); ++ ssize_t len; + +- if (!dev->driver_override) +- return 0; +- +- return sprintf(buf, "%s\n", dev->driver_override); ++ device_lock(_dev); ++ len = sprintf(buf, "%s\n", dev->driver_override); ++ device_unlock(_dev); ++ return len; + } + + static ssize_t driver_override_store(struct device *_dev, +@@ -81,9 +82,10 @@ static ssize_t driver_override_store(struct device *_dev, + const char *buf, size_t count) + { + struct amba_device *dev = to_amba_device(_dev); +- char *driver_override, *old = dev->driver_override, *cp; ++ char *driver_override, *old, *cp; + +- if (count > PATH_MAX) ++ /* We need to keep extra room for a newline */ ++ if (count >= (PAGE_SIZE - 1)) + return -EINVAL; + + driver_override = kstrndup(buf, count, GFP_KERNEL); +@@ -94,12 +96,15 @@ static ssize_t driver_override_store(struct device *_dev, + if (cp) + *cp = '\0'; + ++ device_lock(_dev); ++ old = dev->driver_override; + if (strlen(driver_override)) { + dev->driver_override = driver_override; + } else { + kfree(driver_override); + dev->driver_override = NULL; + } ++ device_unlock(_dev); + + kfree(old); + +diff --git a/drivers/android/binder.c b/drivers/android/binder.c +index b7efdc8badee..a86c27948fca 100644 +--- a/drivers/android/binder.c ++++ b/drivers/android/binder.c +@@ -2785,6 +2785,14 @@ static void binder_transaction(struct binder_proc *proc, + else + return_error = BR_DEAD_REPLY; + mutex_unlock(&context->context_mgr_node_lock); ++ if (target_node && target_proc == proc) { ++ binder_user_error("%d:%d got transaction to context manager from process owning it\n", ++ proc->pid, thread->pid); ++ return_error = BR_FAILED_REPLY; ++ return_error_param = -EINVAL; ++ return_error_line = __LINE__; ++ goto err_invalid_target_handle; ++ } + } + if (!target_node) { + /* +diff --git a/drivers/char/random.c b/drivers/char/random.c +index 58a2ff7df392..ddc493d976fd 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -261,6 +261,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -438,6 +439,16 @@ static void _crng_backtrack_protect(struct crng_state *crng, + static void process_random_ready_list(void); + static void _get_random_bytes(void *buf, int nbytes); + ++static struct ratelimit_state unseeded_warning = ++ RATELIMIT_STATE_INIT("warn_unseeded_randomness", HZ, 3); ++static struct ratelimit_state urandom_warning = ++ RATELIMIT_STATE_INIT("warn_urandom_randomness", HZ, 3); ++ ++static int ratelimit_disable __read_mostly; ++ ++module_param_named(ratelimit_disable, ratelimit_disable, int, 0644); ++MODULE_PARM_DESC(ratelimit_disable, "Disable random ratelimit suppression"); ++ + /********************************************************************** + * + * OS independent entropy store. Here are the functions which handle +@@ -787,6 +798,39 @@ static void crng_initialize(struct crng_state *crng) + crng->init_time = jiffies - CRNG_RESEED_INTERVAL - 1; + } + ++#ifdef CONFIG_NUMA ++static void do_numa_crng_init(struct work_struct *work) ++{ ++ int i; ++ struct crng_state *crng; ++ struct crng_state **pool; ++ ++ pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL); ++ for_each_online_node(i) { ++ crng = kmalloc_node(sizeof(struct crng_state), ++ GFP_KERNEL | __GFP_NOFAIL, i); ++ spin_lock_init(&crng->lock); ++ crng_initialize(crng); ++ pool[i] = crng; ++ } ++ mb(); ++ if (cmpxchg(&crng_node_pool, NULL, pool)) { ++ for_each_node(i) ++ kfree(pool[i]); ++ kfree(pool); ++ } ++} ++ ++static DECLARE_WORK(numa_crng_init_work, do_numa_crng_init); ++ ++static void numa_crng_init(void) ++{ ++ schedule_work(&numa_crng_init_work); ++} ++#else ++static void numa_crng_init(void) {} ++#endif ++ + /* + * crng_fast_load() can be called by code in the interrupt service + * path. So we can't afford to dilly-dally. +@@ -893,10 +937,23 @@ static void crng_reseed(struct crng_state *crng, struct entropy_store *r) + spin_unlock_irqrestore(&crng->lock, flags); + if (crng == &primary_crng && crng_init < 2) { + invalidate_batched_entropy(); ++ numa_crng_init(); + crng_init = 2; + process_random_ready_list(); + wake_up_interruptible(&crng_init_wait); + pr_notice("random: crng init done\n"); ++ if (unseeded_warning.missed) { ++ pr_notice("random: %d get_random_xx warning(s) missed " ++ "due to ratelimiting\n", ++ unseeded_warning.missed); ++ unseeded_warning.missed = 0; ++ } ++ if (urandom_warning.missed) { ++ pr_notice("random: %d urandom warning(s) missed " ++ "due to ratelimiting\n", ++ urandom_warning.missed); ++ urandom_warning.missed = 0; ++ } + } + } + +@@ -1540,8 +1597,9 @@ static void _warn_unseeded_randomness(const char *func_name, void *caller, + #ifndef CONFIG_WARN_ALL_UNSEEDED_RANDOM + print_once = true; + #endif +- pr_notice("random: %s called from %pS with crng_init=%d\n", +- func_name, caller, crng_init); ++ if (__ratelimit(&unseeded_warning)) ++ pr_notice("random: %s called from %pS with crng_init=%d\n", ++ func_name, caller, crng_init); + } + + /* +@@ -1731,29 +1789,14 @@ static void init_std_data(struct entropy_store *r) + */ + static int rand_initialize(void) + { +-#ifdef CONFIG_NUMA +- int i; +- struct crng_state *crng; +- struct crng_state **pool; +-#endif +- + init_std_data(&input_pool); + init_std_data(&blocking_pool); + crng_initialize(&primary_crng); + crng_global_init_time = jiffies; +- +-#ifdef CONFIG_NUMA +- pool = kcalloc(nr_node_ids, sizeof(*pool), GFP_KERNEL|__GFP_NOFAIL); +- for_each_online_node(i) { +- crng = kmalloc_node(sizeof(struct crng_state), +- GFP_KERNEL | __GFP_NOFAIL, i); +- spin_lock_init(&crng->lock); +- crng_initialize(crng); +- pool[i] = crng; ++ if (ratelimit_disable) { ++ urandom_warning.interval = 0; ++ unseeded_warning.interval = 0; + } +- mb(); +- crng_node_pool = pool; +-#endif + return 0; + } + early_initcall(rand_initialize); +@@ -1821,9 +1864,10 @@ urandom_read(struct file *file, char __user *buf, size_t nbytes, loff_t *ppos) + + if (!crng_ready() && maxwarn > 0) { + maxwarn--; +- printk(KERN_NOTICE "random: %s: uninitialized urandom read " +- "(%zd bytes read)\n", +- current->comm, nbytes); ++ if (__ratelimit(&urandom_warning)) ++ printk(KERN_NOTICE "random: %s: uninitialized " ++ "urandom read (%zd bytes read)\n", ++ current->comm, nbytes); + spin_lock_irqsave(&primary_crng.lock, flags); + crng_init_cnt = 0; + spin_unlock_irqrestore(&primary_crng.lock, flags); +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index d1aed2513bd9..a089474cb046 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -422,7 +422,7 @@ static void reclaim_dma_bufs(void) + } + } + +-static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size, ++static struct port_buffer *alloc_buf(struct virtio_device *vdev, size_t buf_size, + int pages) + { + struct port_buffer *buf; +@@ -445,16 +445,16 @@ static struct port_buffer *alloc_buf(struct virtqueue *vq, size_t buf_size, + return buf; + } + +- if (is_rproc_serial(vq->vdev)) { ++ if (is_rproc_serial(vdev)) { + /* + * Allocate DMA memory from ancestor. When a virtio + * device is created by remoteproc, the DMA memory is + * associated with the grandparent device: + * vdev => rproc => platform-dev. + */ +- if (!vq->vdev->dev.parent || !vq->vdev->dev.parent->parent) ++ if (!vdev->dev.parent || !vdev->dev.parent->parent) + goto free_buf; +- buf->dev = vq->vdev->dev.parent->parent; ++ buf->dev = vdev->dev.parent->parent; + + /* Increase device refcnt to avoid freeing it */ + get_device(buf->dev); +@@ -838,7 +838,7 @@ static ssize_t port_fops_write(struct file *filp, const char __user *ubuf, + + count = min((size_t)(32 * 1024), count); + +- buf = alloc_buf(port->out_vq, count, 0); ++ buf = alloc_buf(port->portdev->vdev, count, 0); + if (!buf) + return -ENOMEM; + +@@ -957,7 +957,7 @@ static ssize_t port_fops_splice_write(struct pipe_inode_info *pipe, + if (ret < 0) + goto error_out; + +- buf = alloc_buf(port->out_vq, 0, pipe->nrbufs); ++ buf = alloc_buf(port->portdev->vdev, 0, pipe->nrbufs); + if (!buf) { + ret = -ENOMEM; + goto error_out; +@@ -1374,7 +1374,7 @@ static unsigned int fill_queue(struct virtqueue *vq, spinlock_t *lock) + + nr_added_bufs = 0; + do { +- buf = alloc_buf(vq, PAGE_SIZE, 0); ++ buf = alloc_buf(vq->vdev, PAGE_SIZE, 0); + if (!buf) + break; + +@@ -1402,7 +1402,6 @@ static int add_port(struct ports_device *portdev, u32 id) + { + char debugfs_name[16]; + struct port *port; +- struct port_buffer *buf; + dev_t devt; + unsigned int nr_added_bufs; + int err; +@@ -1513,8 +1512,6 @@ static int add_port(struct ports_device *portdev, u32 id) + return 0; + + free_inbufs: +- while ((buf = virtqueue_detach_unused_buf(port->in_vq))) +- free_buf(buf, true); + free_device: + device_destroy(pdrvdata.class, port->dev->devt); + free_cdev: +@@ -1539,34 +1536,14 @@ static void remove_port(struct kref *kref) + + static void remove_port_data(struct port *port) + { +- struct port_buffer *buf; +- + spin_lock_irq(&port->inbuf_lock); + /* Remove unused data this port might have received. */ + discard_port_data(port); + spin_unlock_irq(&port->inbuf_lock); + +- /* Remove buffers we queued up for the Host to send us data in. */ +- do { +- spin_lock_irq(&port->inbuf_lock); +- buf = virtqueue_detach_unused_buf(port->in_vq); +- spin_unlock_irq(&port->inbuf_lock); +- if (buf) +- free_buf(buf, true); +- } while (buf); +- + spin_lock_irq(&port->outvq_lock); + reclaim_consumed_buffers(port); + spin_unlock_irq(&port->outvq_lock); +- +- /* Free pending buffers from the out-queue. */ +- do { +- spin_lock_irq(&port->outvq_lock); +- buf = virtqueue_detach_unused_buf(port->out_vq); +- spin_unlock_irq(&port->outvq_lock); +- if (buf) +- free_buf(buf, true); +- } while (buf); + } + + /* +@@ -1791,13 +1768,24 @@ static void control_work_handler(struct work_struct *work) + spin_unlock(&portdev->c_ivq_lock); + } + ++static void flush_bufs(struct virtqueue *vq, bool can_sleep) ++{ ++ struct port_buffer *buf; ++ unsigned int len; ++ ++ while ((buf = virtqueue_get_buf(vq, &len))) ++ free_buf(buf, can_sleep); ++} ++ + static void out_intr(struct virtqueue *vq) + { + struct port *port; + + port = find_port_by_vq(vq->vdev->priv, vq); +- if (!port) ++ if (!port) { ++ flush_bufs(vq, false); + return; ++ } + + wake_up_interruptible(&port->waitqueue); + } +@@ -1808,8 +1796,10 @@ static void in_intr(struct virtqueue *vq) + unsigned long flags; + + port = find_port_by_vq(vq->vdev->priv, vq); +- if (!port) ++ if (!port) { ++ flush_bufs(vq, false); + return; ++ } + + spin_lock_irqsave(&port->inbuf_lock, flags); + port->inbuf = get_inbuf(port); +@@ -1984,24 +1974,54 @@ static const struct file_operations portdev_fops = { + + static void remove_vqs(struct ports_device *portdev) + { ++ struct virtqueue *vq; ++ ++ virtio_device_for_each_vq(portdev->vdev, vq) { ++ struct port_buffer *buf; ++ ++ flush_bufs(vq, true); ++ while ((buf = virtqueue_detach_unused_buf(vq))) ++ free_buf(buf, true); ++ } + portdev->vdev->config->del_vqs(portdev->vdev); + kfree(portdev->in_vqs); + kfree(portdev->out_vqs); + } + +-static void remove_controlq_data(struct ports_device *portdev) ++static void virtcons_remove(struct virtio_device *vdev) + { +- struct port_buffer *buf; +- unsigned int len; ++ struct ports_device *portdev; ++ struct port *port, *port2; + +- if (!use_multiport(portdev)) +- return; ++ portdev = vdev->priv; + +- while ((buf = virtqueue_get_buf(portdev->c_ivq, &len))) +- free_buf(buf, true); ++ spin_lock_irq(&pdrvdata_lock); ++ list_del(&portdev->list); ++ spin_unlock_irq(&pdrvdata_lock); + +- while ((buf = virtqueue_detach_unused_buf(portdev->c_ivq))) +- free_buf(buf, true); ++ /* Disable interrupts for vqs */ ++ vdev->config->reset(vdev); ++ /* Finish up work that's lined up */ ++ if (use_multiport(portdev)) ++ cancel_work_sync(&portdev->control_work); ++ else ++ cancel_work_sync(&portdev->config_work); ++ ++ list_for_each_entry_safe(port, port2, &portdev->ports, list) ++ unplug_port(port); ++ ++ unregister_chrdev(portdev->chr_major, "virtio-portsdev"); ++ ++ /* ++ * When yanking out a device, we immediately lose the ++ * (device-side) queues. So there's no point in keeping the ++ * guest side around till we drop our final reference. This ++ * also means that any ports which are in an open state will ++ * have to just stop using the port, as the vqs are going ++ * away. ++ */ ++ remove_vqs(portdev); ++ kfree(portdev); + } + + /* +@@ -2070,6 +2090,7 @@ static int virtcons_probe(struct virtio_device *vdev) + + spin_lock_init(&portdev->ports_lock); + INIT_LIST_HEAD(&portdev->ports); ++ INIT_LIST_HEAD(&portdev->list); + + virtio_device_ready(portdev->vdev); + +@@ -2087,8 +2108,15 @@ static int virtcons_probe(struct virtio_device *vdev) + if (!nr_added_bufs) { + dev_err(&vdev->dev, + "Error allocating buffers for control queue\n"); +- err = -ENOMEM; +- goto free_vqs; ++ /* ++ * The host might want to notify mgmt sw about device ++ * add failure. ++ */ ++ __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID, ++ VIRTIO_CONSOLE_DEVICE_READY, 0); ++ /* Device was functional: we need full cleanup. */ ++ virtcons_remove(vdev); ++ return -ENOMEM; + } + } else { + /* +@@ -2119,11 +2147,6 @@ static int virtcons_probe(struct virtio_device *vdev) + + return 0; + +-free_vqs: +- /* The host might want to notify mgmt sw about device add failure */ +- __send_control_msg(portdev, VIRTIO_CONSOLE_BAD_ID, +- VIRTIO_CONSOLE_DEVICE_READY, 0); +- remove_vqs(portdev); + free_chrdev: + unregister_chrdev(portdev->chr_major, "virtio-portsdev"); + free: +@@ -2132,43 +2155,6 @@ static int virtcons_probe(struct virtio_device *vdev) + return err; + } + +-static void virtcons_remove(struct virtio_device *vdev) +-{ +- struct ports_device *portdev; +- struct port *port, *port2; +- +- portdev = vdev->priv; +- +- spin_lock_irq(&pdrvdata_lock); +- list_del(&portdev->list); +- spin_unlock_irq(&pdrvdata_lock); +- +- /* Disable interrupts for vqs */ +- vdev->config->reset(vdev); +- /* Finish up work that's lined up */ +- if (use_multiport(portdev)) +- cancel_work_sync(&portdev->control_work); +- else +- cancel_work_sync(&portdev->config_work); +- +- list_for_each_entry_safe(port, port2, &portdev->ports, list) +- unplug_port(port); +- +- unregister_chrdev(portdev->chr_major, "virtio-portsdev"); +- +- /* +- * When yanking out a device, we immediately lose the +- * (device-side) queues. So there's no point in keeping the +- * guest side around till we drop our final reference. This +- * also means that any ports which are in an open state will +- * have to just stop using the port, as the vqs are going +- * away. +- */ +- remove_controlq_data(portdev); +- remove_vqs(portdev); +- kfree(portdev); +-} +- + static struct virtio_device_id id_table[] = { + { VIRTIO_ID_CONSOLE, VIRTIO_DEV_ANY_ID }, + { 0 }, +@@ -2209,7 +2195,6 @@ static int virtcons_freeze(struct virtio_device *vdev) + */ + if (use_multiport(portdev)) + virtqueue_disable_cb(portdev->c_ivq); +- remove_controlq_data(portdev); + + list_for_each_entry(port, &portdev->ports, list) { + virtqueue_disable_cb(port->in_vq); +diff --git a/drivers/cpufreq/powernv-cpufreq.c b/drivers/cpufreq/powernv-cpufreq.c +index 6b3a63545619..a28bb8f3f395 100644 +--- a/drivers/cpufreq/powernv-cpufreq.c ++++ b/drivers/cpufreq/powernv-cpufreq.c +@@ -646,6 +646,16 @@ void gpstate_timer_handler(unsigned long data) + + if (!spin_trylock(&gpstates->gpstate_lock)) + return; ++ /* ++ * If the timer has migrated to the different cpu then bring ++ * it back to one of the policy->cpus ++ */ ++ if (!cpumask_test_cpu(raw_smp_processor_id(), policy->cpus)) { ++ gpstates->timer.expires = jiffies + msecs_to_jiffies(1); ++ add_timer_on(&gpstates->timer, cpumask_first(policy->cpus)); ++ spin_unlock(&gpstates->gpstate_lock); ++ return; ++ } + + /* + * If PMCR was last updated was using fast_swtich then +@@ -685,10 +695,8 @@ void gpstate_timer_handler(unsigned long data) + if (gpstate_idx != gpstates->last_lpstate_idx) + queue_gpstate_timer(gpstates); + ++ set_pstate(&freq_data); + spin_unlock(&gpstates->gpstate_lock); +- +- /* Timer may get migrated to a different cpu on cpu hot unplug */ +- smp_call_function_any(policy->cpus, set_pstate, &freq_data, 1); + } + + /* +diff --git a/drivers/fpga/altera-ps-spi.c b/drivers/fpga/altera-ps-spi.c +index 14f14efdf0d5..06d212a3d49d 100644 +--- a/drivers/fpga/altera-ps-spi.c ++++ b/drivers/fpga/altera-ps-spi.c +@@ -249,7 +249,7 @@ static int altera_ps_probe(struct spi_device *spi) + + conf->data = of_id->data; + conf->spi = spi; +- conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_HIGH); ++ conf->config = devm_gpiod_get(&spi->dev, "nconfig", GPIOD_OUT_LOW); + if (IS_ERR(conf->config)) { + dev_err(&spi->dev, "Failed to get config gpio: %ld\n", + PTR_ERR(conf->config)); +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +index fc260c13b1da..a7e54820a330 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v8_0.c +@@ -1398,10 +1398,11 @@ static const u32 sgpr_init_compute_shader[] = + static const u32 vgpr_init_regs[] = + { + mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0xffffffff, +- mmCOMPUTE_RESOURCE_LIMITS, 0, ++ mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */ + mmCOMPUTE_NUM_THREAD_X, 256*4, + mmCOMPUTE_NUM_THREAD_Y, 1, + mmCOMPUTE_NUM_THREAD_Z, 1, ++ mmCOMPUTE_PGM_RSRC1, 0x100004f, /* VGPRS=15 (64 logical VGPRs), SGPRS=1 (16 SGPRs), BULKY=1 */ + mmCOMPUTE_PGM_RSRC2, 20, + mmCOMPUTE_USER_DATA_0, 0xedcedc00, + mmCOMPUTE_USER_DATA_1, 0xedcedc01, +@@ -1418,10 +1419,11 @@ static const u32 vgpr_init_regs[] = + static const u32 sgpr1_init_regs[] = + { + mmCOMPUTE_STATIC_THREAD_MGMT_SE0, 0x0f, +- mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, ++ mmCOMPUTE_RESOURCE_LIMITS, 0x1000000, /* CU_GROUP_COUNT=1 */ + mmCOMPUTE_NUM_THREAD_X, 256*5, + mmCOMPUTE_NUM_THREAD_Y, 1, + mmCOMPUTE_NUM_THREAD_Z, 1, ++ mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */ + mmCOMPUTE_PGM_RSRC2, 20, + mmCOMPUTE_USER_DATA_0, 0xedcedc00, + mmCOMPUTE_USER_DATA_1, 0xedcedc01, +@@ -1442,6 +1444,7 @@ static const u32 sgpr2_init_regs[] = + mmCOMPUTE_NUM_THREAD_X, 256*5, + mmCOMPUTE_NUM_THREAD_Y, 1, + mmCOMPUTE_NUM_THREAD_Z, 1, ++ mmCOMPUTE_PGM_RSRC1, 0x240, /* SGPRS=9 (80 GPRS) */ + mmCOMPUTE_PGM_RSRC2, 20, + mmCOMPUTE_USER_DATA_0, 0xedcedc00, + mmCOMPUTE_USER_DATA_1, 0xedcedc01, +diff --git a/drivers/gpu/drm/i915/intel_runtime_pm.c b/drivers/gpu/drm/i915/intel_runtime_pm.c +index bcccacba1ec6..bcfc1c235966 100644 +--- a/drivers/gpu/drm/i915/intel_runtime_pm.c ++++ b/drivers/gpu/drm/i915/intel_runtime_pm.c +@@ -622,19 +622,18 @@ void skl_enable_dc6(struct drm_i915_private *dev_priv) + + DRM_DEBUG_KMS("Enabling DC6\n"); + +- gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6); ++ /* Wa Display #1183: skl,kbl,cfl */ ++ if (IS_GEN9_BC(dev_priv)) ++ I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) | ++ SKL_SELECT_ALTERNATE_DC_EXIT); + ++ gen9_set_dc_state(dev_priv, DC_STATE_EN_UPTO_DC6); + } + + void skl_disable_dc6(struct drm_i915_private *dev_priv) + { + DRM_DEBUG_KMS("Disabling DC6\n"); + +- /* Wa Display #1183: skl,kbl,cfl */ +- if (IS_GEN9_BC(dev_priv)) +- I915_WRITE(GEN8_CHICKEN_DCPR_1, I915_READ(GEN8_CHICKEN_DCPR_1) | +- SKL_SELECT_ALTERNATE_DC_EXIT); +- + gen9_set_dc_state(dev_priv, DC_STATE_DISABLE); + } + +diff --git a/drivers/gpu/drm/virtio/virtgpu_vq.c b/drivers/gpu/drm/virtio/virtgpu_vq.c +index 9eb96fb2c147..26a2da1f712d 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_vq.c ++++ b/drivers/gpu/drm/virtio/virtgpu_vq.c +@@ -291,7 +291,7 @@ static int virtio_gpu_queue_ctrl_buffer_locked(struct virtio_gpu_device *vgdev, + ret = virtqueue_add_sgs(vq, sgs, outcnt, incnt, vbuf, GFP_ATOMIC); + if (ret == -ENOSPC) { + spin_unlock(&vgdev->ctrlq.qlock); +- wait_event(vgdev->ctrlq.ack_queue, vq->num_free); ++ wait_event(vgdev->ctrlq.ack_queue, vq->num_free >= outcnt + incnt); + spin_lock(&vgdev->ctrlq.qlock); + goto retry; + } else { +@@ -366,7 +366,7 @@ static int virtio_gpu_queue_cursor(struct virtio_gpu_device *vgdev, + ret = virtqueue_add_sgs(vq, sgs, outcnt, 0, vbuf, GFP_ATOMIC); + if (ret == -ENOSPC) { + spin_unlock(&vgdev->cursorq.qlock); +- wait_event(vgdev->cursorq.ack_queue, vq->num_free); ++ wait_event(vgdev->cursorq.ack_queue, vq->num_free >= outcnt); + spin_lock(&vgdev->cursorq.qlock); + goto retry; + } else { +diff --git a/drivers/mtd/chips/cfi_cmdset_0001.c b/drivers/mtd/chips/cfi_cmdset_0001.c +index 5e1b68cbcd0a..e1b603ca0170 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0001.c ++++ b/drivers/mtd/chips/cfi_cmdset_0001.c +@@ -45,6 +45,7 @@ + #define I82802AB 0x00ad + #define I82802AC 0x00ac + #define PF38F4476 0x881c ++#define M28F00AP30 0x8963 + /* STMicroelectronics chips */ + #define M50LPW080 0x002F + #define M50FLW080A 0x0080 +@@ -375,6 +376,17 @@ static void cfi_fixup_major_minor(struct cfi_private *cfi, + extp->MinorVersion = '1'; + } + ++static int cfi_is_micron_28F00AP30(struct cfi_private *cfi, struct flchip *chip) ++{ ++ /* ++ * Micron(was Numonyx) 1Gbit bottom boot are buggy w.r.t ++ * Erase Supend for their small Erase Blocks(0x8000) ++ */ ++ if (cfi->mfr == CFI_MFR_INTEL && cfi->id == M28F00AP30) ++ return 1; ++ return 0; ++} ++ + static inline struct cfi_pri_intelext * + read_pri_intelext(struct map_info *map, __u16 adr) + { +@@ -831,21 +843,30 @@ static int chip_ready (struct map_info *map, struct flchip *chip, unsigned long + (mode == FL_WRITING && (cfip->SuspendCmdSupport & 1)))) + goto sleep; + ++ /* Do not allow suspend iff read/write to EB address */ ++ if ((adr & chip->in_progress_block_mask) == ++ chip->in_progress_block_addr) ++ goto sleep; ++ ++ /* do not suspend small EBs, buggy Micron Chips */ ++ if (cfi_is_micron_28F00AP30(cfi, chip) && ++ (chip->in_progress_block_mask == ~(0x8000-1))) ++ goto sleep; + + /* Erase suspend */ +- map_write(map, CMD(0xB0), adr); ++ map_write(map, CMD(0xB0), chip->in_progress_block_addr); + + /* If the flash has finished erasing, then 'erase suspend' + * appears to make some (28F320) flash devices switch to + * 'read' mode. Make sure that we switch to 'read status' + * mode so we get the right data. --rmk + */ +- map_write(map, CMD(0x70), adr); ++ map_write(map, CMD(0x70), chip->in_progress_block_addr); + chip->oldstate = FL_ERASING; + chip->state = FL_ERASE_SUSPENDING; + chip->erase_suspended = 1; + for (;;) { +- status = map_read(map, adr); ++ status = map_read(map, chip->in_progress_block_addr); + if (map_word_andequal(map, status, status_OK, status_OK)) + break; + +@@ -1041,8 +1062,8 @@ static void put_chip(struct map_info *map, struct flchip *chip, unsigned long ad + sending the 0x70 (Read Status) command to an erasing + chip and expecting it to be ignored, that's what we + do. */ +- map_write(map, CMD(0xd0), adr); +- map_write(map, CMD(0x70), adr); ++ map_write(map, CMD(0xd0), chip->in_progress_block_addr); ++ map_write(map, CMD(0x70), chip->in_progress_block_addr); + chip->oldstate = FL_READY; + chip->state = FL_ERASING; + break; +@@ -1933,6 +1954,8 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + map_write(map, CMD(0xD0), adr); + chip->state = FL_ERASING; + chip->erase_suspended = 0; ++ chip->in_progress_block_addr = adr; ++ chip->in_progress_block_mask = ~(len - 1); + + ret = INVAL_CACHE_AND_WAIT(map, chip, adr, + adr, len, +diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c +index 56aa6b75213d..d524a64ed754 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -816,9 +816,10 @@ static int get_chip(struct map_info *map, struct flchip *chip, unsigned long adr + (mode == FL_WRITING && (cfip->EraseSuspend & 0x2)))) + goto sleep; + +- /* We could check to see if we're trying to access the sector +- * that is currently being erased. However, no user will try +- * anything like that so we just wait for the timeout. */ ++ /* Do not allow suspend iff read/write to EB address */ ++ if ((adr & chip->in_progress_block_mask) == ++ chip->in_progress_block_addr) ++ goto sleep; + + /* Erase suspend */ + /* It's harmless to issue the Erase-Suspend and Erase-Resume +@@ -2267,6 +2268,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) + chip->state = FL_ERASING; + chip->erase_suspended = 0; + chip->in_progress_block_addr = adr; ++ chip->in_progress_block_mask = ~(map->size - 1); + + INVALIDATE_CACHE_UDELAY(map, chip, + adr, map->size, +@@ -2356,6 +2358,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + chip->state = FL_ERASING; + chip->erase_suspended = 0; + chip->in_progress_block_addr = adr; ++ chip->in_progress_block_mask = ~(len - 1); + + INVALIDATE_CACHE_UDELAY(map, chip, + adr, len, +diff --git a/drivers/mtd/nand/tango_nand.c b/drivers/mtd/nand/tango_nand.c +index 766906f03943..ce366816a7ef 100644 +--- a/drivers/mtd/nand/tango_nand.c ++++ b/drivers/mtd/nand/tango_nand.c +@@ -654,7 +654,7 @@ static int tango_nand_probe(struct platform_device *pdev) + + writel_relaxed(MODE_RAW, nfc->pbus_base + PBUS_PAD_MODE); + +- clk = clk_get(&pdev->dev, NULL); ++ clk = devm_clk_get(&pdev->dev, NULL); + if (IS_ERR(clk)) + return PTR_ERR(clk); + +diff --git a/drivers/mtd/spi-nor/cadence-quadspi.c b/drivers/mtd/spi-nor/cadence-quadspi.c +index 53c7d8e0327a..8d89204b90d2 100644 +--- a/drivers/mtd/spi-nor/cadence-quadspi.c ++++ b/drivers/mtd/spi-nor/cadence-quadspi.c +@@ -495,7 +495,9 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, + void __iomem *reg_base = cqspi->iobase; + void __iomem *ahb_base = cqspi->ahb_base; + unsigned int remaining = n_rx; ++ unsigned int mod_bytes = n_rx % 4; + unsigned int bytes_to_read = 0; ++ u8 *rxbuf_end = rxbuf + n_rx; + int ret = 0; + + writel(remaining, reg_base + CQSPI_REG_INDIRECTRDBYTES); +@@ -523,11 +525,24 @@ static int cqspi_indirect_read_execute(struct spi_nor *nor, + } + + while (bytes_to_read != 0) { ++ unsigned int word_remain = round_down(remaining, 4); ++ + bytes_to_read *= cqspi->fifo_width; + bytes_to_read = bytes_to_read > remaining ? + remaining : bytes_to_read; +- ioread32_rep(ahb_base, rxbuf, +- DIV_ROUND_UP(bytes_to_read, 4)); ++ bytes_to_read = round_down(bytes_to_read, 4); ++ /* Read 4 byte word chunks then single bytes */ ++ if (bytes_to_read) { ++ ioread32_rep(ahb_base, rxbuf, ++ (bytes_to_read / 4)); ++ } else if (!word_remain && mod_bytes) { ++ unsigned int temp = ioread32(ahb_base); ++ ++ bytes_to_read = mod_bytes; ++ memcpy(rxbuf, &temp, min((unsigned int) ++ (rxbuf_end - rxbuf), ++ bytes_to_read)); ++ } + rxbuf += bytes_to_read; + remaining -= bytes_to_read; + bytes_to_read = cqspi_get_rd_sram_level(cqspi); +diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c +index ce30c9a588a4..6337c394bfe3 100644 +--- a/drivers/of/fdt.c ++++ b/drivers/of/fdt.c +@@ -975,7 +975,7 @@ int __init early_init_dt_scan_chosen_stdout(void) + int offset; + const char *p, *q, *options = NULL; + int l; +- const struct earlycon_id *match; ++ const struct earlycon_id **p_match; + const void *fdt = initial_boot_params; + + offset = fdt_path_offset(fdt, "/chosen"); +@@ -1002,7 +1002,10 @@ int __init early_init_dt_scan_chosen_stdout(void) + return 0; + } + +- for (match = __earlycon_table; match < __earlycon_table_end; match++) { ++ for (p_match = __earlycon_table; p_match < __earlycon_table_end; ++ p_match++) { ++ const struct earlycon_id *match = *p_match; ++ + if (!match->compatible[0]) + continue; + +diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c +index 26ed0c08f209..9bfc22b5da4b 100644 +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -32,6 +32,7 @@ + #define PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT 5 + #define PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE (0 << 11) + #define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT 12 ++#define PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ 0x2 + #define PCIE_CORE_LINK_CTRL_STAT_REG 0xd0 + #define PCIE_CORE_LINK_L0S_ENTRY BIT(0) + #define PCIE_CORE_LINK_TRAINING BIT(5) +@@ -103,7 +104,8 @@ + #define PCIE_ISR1_MASK_REG (CONTROL_BASE_ADDR + 0x4C) + #define PCIE_ISR1_POWER_STATE_CHANGE BIT(4) + #define PCIE_ISR1_FLUSH BIT(5) +-#define PCIE_ISR1_ALL_MASK GENMASK(5, 4) ++#define PCIE_ISR1_INTX_ASSERT(val) BIT(8 + (val)) ++#define PCIE_ISR1_ALL_MASK GENMASK(11, 4) + #define PCIE_MSI_ADDR_LOW_REG (CONTROL_BASE_ADDR + 0x50) + #define PCIE_MSI_ADDR_HIGH_REG (CONTROL_BASE_ADDR + 0x54) + #define PCIE_MSI_STATUS_REG (CONTROL_BASE_ADDR + 0x58) +@@ -175,8 +177,6 @@ + #define PCIE_CONFIG_WR_TYPE0 0xa + #define PCIE_CONFIG_WR_TYPE1 0xb + +-/* PCI_BDF shifts 8bit, so we need extra 4bit shift */ +-#define PCIE_BDF(dev) (dev << 4) + #define PCIE_CONF_BUS(bus) (((bus) & 0xff) << 20) + #define PCIE_CONF_DEV(dev) (((dev) & 0x1f) << 15) + #define PCIE_CONF_FUNC(fun) (((fun) & 0x7) << 12) +@@ -299,7 +299,8 @@ static void advk_pcie_setup_hw(struct advk_pcie *pcie) + reg = PCIE_CORE_DEV_CTRL_STATS_RELAX_ORDER_DISABLE | + (7 << PCIE_CORE_DEV_CTRL_STATS_MAX_PAYLOAD_SZ_SHIFT) | + PCIE_CORE_DEV_CTRL_STATS_SNOOP_DISABLE | +- PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT; ++ (PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SZ << ++ PCIE_CORE_DEV_CTRL_STATS_MAX_RD_REQ_SIZE_SHIFT); + advk_writel(pcie, reg, PCIE_CORE_DEV_CTRL_STATS_REG); + + /* Program PCIe Control 2 to disable strict ordering */ +@@ -440,7 +441,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + u32 reg; + int ret; + +- if (PCI_SLOT(devfn) != 0) { ++ if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) { + *val = 0xffffffff; + return PCIBIOS_DEVICE_NOT_FOUND; + } +@@ -459,7 +460,7 @@ static int advk_pcie_rd_conf(struct pci_bus *bus, u32 devfn, + advk_writel(pcie, reg, PIO_CTRL); + + /* Program the address registers */ +- reg = PCIE_BDF(devfn) | PCIE_CONF_REG(where); ++ reg = PCIE_CONF_ADDR(bus->number, devfn, where); + advk_writel(pcie, reg, PIO_ADDR_LS); + advk_writel(pcie, 0, PIO_ADDR_MS); + +@@ -494,7 +495,7 @@ static int advk_pcie_wr_conf(struct pci_bus *bus, u32 devfn, + int offset; + int ret; + +- if (PCI_SLOT(devfn) != 0) ++ if ((bus->number == pcie->root_bus_nr) && PCI_SLOT(devfn) != 0) + return PCIBIOS_DEVICE_NOT_FOUND; + + if (where % size) +@@ -612,9 +613,9 @@ static void advk_pcie_irq_mask(struct irq_data *d) + irq_hw_number_t hwirq = irqd_to_hwirq(d); + u32 mask; + +- mask = advk_readl(pcie, PCIE_ISR0_MASK_REG); +- mask |= PCIE_ISR0_INTX_ASSERT(hwirq); +- advk_writel(pcie, mask, PCIE_ISR0_MASK_REG); ++ mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); ++ mask |= PCIE_ISR1_INTX_ASSERT(hwirq); ++ advk_writel(pcie, mask, PCIE_ISR1_MASK_REG); + } + + static void advk_pcie_irq_unmask(struct irq_data *d) +@@ -623,9 +624,9 @@ static void advk_pcie_irq_unmask(struct irq_data *d) + irq_hw_number_t hwirq = irqd_to_hwirq(d); + u32 mask; + +- mask = advk_readl(pcie, PCIE_ISR0_MASK_REG); +- mask &= ~PCIE_ISR0_INTX_ASSERT(hwirq); +- advk_writel(pcie, mask, PCIE_ISR0_MASK_REG); ++ mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); ++ mask &= ~PCIE_ISR1_INTX_ASSERT(hwirq); ++ advk_writel(pcie, mask, PCIE_ISR1_MASK_REG); + } + + static int advk_pcie_irq_map(struct irq_domain *h, +@@ -768,29 +769,35 @@ static void advk_pcie_handle_msi(struct advk_pcie *pcie) + + static void advk_pcie_handle_int(struct advk_pcie *pcie) + { +- u32 val, mask, status; ++ u32 isr0_val, isr0_mask, isr0_status; ++ u32 isr1_val, isr1_mask, isr1_status; + int i, virq; + +- val = advk_readl(pcie, PCIE_ISR0_REG); +- mask = advk_readl(pcie, PCIE_ISR0_MASK_REG); +- status = val & ((~mask) & PCIE_ISR0_ALL_MASK); ++ isr0_val = advk_readl(pcie, PCIE_ISR0_REG); ++ isr0_mask = advk_readl(pcie, PCIE_ISR0_MASK_REG); ++ isr0_status = isr0_val & ((~isr0_mask) & PCIE_ISR0_ALL_MASK); ++ ++ isr1_val = advk_readl(pcie, PCIE_ISR1_REG); ++ isr1_mask = advk_readl(pcie, PCIE_ISR1_MASK_REG); ++ isr1_status = isr1_val & ((~isr1_mask) & PCIE_ISR1_ALL_MASK); + +- if (!status) { +- advk_writel(pcie, val, PCIE_ISR0_REG); ++ if (!isr0_status && !isr1_status) { ++ advk_writel(pcie, isr0_val, PCIE_ISR0_REG); ++ advk_writel(pcie, isr1_val, PCIE_ISR1_REG); + return; + } + + /* Process MSI interrupts */ +- if (status & PCIE_ISR0_MSI_INT_PENDING) ++ if (isr0_status & PCIE_ISR0_MSI_INT_PENDING) + advk_pcie_handle_msi(pcie); + + /* Process legacy interrupts */ + for (i = 0; i < PCI_NUM_INTX; i++) { +- if (!(status & PCIE_ISR0_INTX_ASSERT(i))) ++ if (!(isr1_status & PCIE_ISR1_INTX_ASSERT(i))) + continue; + +- advk_writel(pcie, PCIE_ISR0_INTX_ASSERT(i), +- PCIE_ISR0_REG); ++ advk_writel(pcie, PCIE_ISR1_INTX_ASSERT(i), ++ PCIE_ISR1_REG); + + virq = irq_find_mapping(pcie->irq_domain, i); + generic_handle_irq(virq); +diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c +index 304e891e35fc..60f2250fd96b 100644 +--- a/drivers/rtc/rtc-opal.c ++++ b/drivers/rtc/rtc-opal.c +@@ -57,7 +57,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms) + + static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + { +- long rc = OPAL_BUSY; ++ s64 rc = OPAL_BUSY; + int retries = 10; + u32 y_m_d; + u64 h_m_s_ms; +@@ -66,13 +66,17 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + + while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) { + rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms); +- if (rc == OPAL_BUSY_EVENT) ++ if (rc == OPAL_BUSY_EVENT) { ++ msleep(OPAL_BUSY_DELAY_MS); + opal_poll_events(NULL); +- else if (retries-- && (rc == OPAL_HARDWARE +- || rc == OPAL_INTERNAL_ERROR)) +- msleep(10); +- else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) +- break; ++ } else if (rc == OPAL_BUSY) { ++ msleep(OPAL_BUSY_DELAY_MS); ++ } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) { ++ if (retries--) { ++ msleep(10); /* Wait 10ms before retry */ ++ rc = OPAL_BUSY; /* go around again */ ++ } ++ } + } + + if (rc != OPAL_SUCCESS) +@@ -87,21 +91,26 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) + + static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm) + { +- long rc = OPAL_BUSY; ++ s64 rc = OPAL_BUSY; + int retries = 10; + u32 y_m_d = 0; + u64 h_m_s_ms = 0; + + tm_to_opal(tm, &y_m_d, &h_m_s_ms); ++ + while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) { + rc = opal_rtc_write(y_m_d, h_m_s_ms); +- if (rc == OPAL_BUSY_EVENT) ++ if (rc == OPAL_BUSY_EVENT) { ++ msleep(OPAL_BUSY_DELAY_MS); + opal_poll_events(NULL); +- else if (retries-- && (rc == OPAL_HARDWARE +- || rc == OPAL_INTERNAL_ERROR)) +- msleep(10); +- else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) +- break; ++ } else if (rc == OPAL_BUSY) { ++ msleep(OPAL_BUSY_DELAY_MS); ++ } else if (rc == OPAL_HARDWARE || rc == OPAL_INTERNAL_ERROR) { ++ if (retries--) { ++ msleep(10); /* Wait 10ms before retry */ ++ rc = OPAL_BUSY; /* go around again */ ++ } ++ } + } + + return rc == OPAL_SUCCESS ? 0 : -EIO; +diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c +index c30420c517b1..e96b85579f21 100644 +--- a/drivers/s390/cio/vfio_ccw_fsm.c ++++ b/drivers/s390/cio/vfio_ccw_fsm.c +@@ -20,12 +20,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private) + int ccode; + __u8 lpm; + unsigned long flags; ++ int ret; + + sch = private->sch; + + spin_lock_irqsave(sch->lock, flags); + private->state = VFIO_CCW_STATE_BUSY; +- spin_unlock_irqrestore(sch->lock, flags); + + orb = cp_get_orb(&private->cp, (u32)(addr_t)sch, sch->lpm); + +@@ -38,10 +38,12 @@ static int fsm_io_helper(struct vfio_ccw_private *private) + * Initialize device status information + */ + sch->schib.scsw.cmd.actl |= SCSW_ACTL_START_PEND; +- return 0; ++ ret = 0; ++ break; + case 1: /* Status pending */ + case 2: /* Busy */ +- return -EBUSY; ++ ret = -EBUSY; ++ break; + case 3: /* Device/path not operational */ + { + lpm = orb->cmd.lpm; +@@ -51,13 +53,16 @@ static int fsm_io_helper(struct vfio_ccw_private *private) + sch->lpm = 0; + + if (cio_update_schib(sch)) +- return -ENODEV; +- +- return sch->lpm ? -EACCES : -ENODEV; ++ ret = -ENODEV; ++ else ++ ret = sch->lpm ? -EACCES : -ENODEV; ++ break; + } + default: +- return ccode; ++ ret = ccode; + } ++ spin_unlock_irqrestore(sch->lock, flags); ++ return ret; + } + + static void fsm_notoper(struct vfio_ccw_private *private, +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 72db0f7d221a..2f9912de2212 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2132,6 +2132,8 @@ sd_spinup_disk(struct scsi_disk *sdkp) + break; /* standby */ + if (sshdr.asc == 4 && sshdr.ascq == 0xc) + break; /* unavailable */ ++ if (sshdr.asc == 4 && sshdr.ascq == 0x1b) ++ break; /* sanitize in progress */ + /* + * Issue command to spin up drive when not ready + */ +diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c +index 7253e8d2c6d9..f46bd1af7a10 100644 +--- a/drivers/tty/n_gsm.c ++++ b/drivers/tty/n_gsm.c +@@ -133,6 +133,9 @@ struct gsm_dlci { + struct mutex mutex; + + /* Link layer */ ++ int mode; ++#define DLCI_MODE_ABM 0 /* Normal Asynchronous Balanced Mode */ ++#define DLCI_MODE_ADM 1 /* Asynchronous Disconnected Mode */ + spinlock_t lock; /* Protects the internal state */ + struct timer_list t1; /* Retransmit timer for SABM and UA */ + int retries; +@@ -1376,7 +1379,13 @@ static struct gsm_control *gsm_control_send(struct gsm_mux *gsm, + ctrl->data = data; + ctrl->len = clen; + gsm->pending_cmd = ctrl; +- gsm->cretries = gsm->n2; ++ ++ /* If DLCI0 is in ADM mode skip retries, it won't respond */ ++ if (gsm->dlci[0]->mode == DLCI_MODE_ADM) ++ gsm->cretries = 1; ++ else ++ gsm->cretries = gsm->n2; ++ + mod_timer(&gsm->t2_timer, jiffies + gsm->t2 * HZ / 100); + gsm_control_transmit(gsm, ctrl); + spin_unlock_irqrestore(&gsm->control_lock, flags); +@@ -1484,6 +1493,7 @@ static void gsm_dlci_t1(unsigned long data) + if (debug & 8) + pr_info("DLCI %d opening in ADM mode.\n", + dlci->addr); ++ dlci->mode = DLCI_MODE_ADM; + gsm_dlci_open(dlci); + } else { + gsm_dlci_close(dlci); +@@ -2875,11 +2885,22 @@ static int gsmtty_modem_update(struct gsm_dlci *dlci, u8 brk) + static int gsm_carrier_raised(struct tty_port *port) + { + struct gsm_dlci *dlci = container_of(port, struct gsm_dlci, port); ++ struct gsm_mux *gsm = dlci->gsm; ++ + /* Not yet open so no carrier info */ + if (dlci->state != DLCI_OPEN) + return 0; + if (debug & 2) + return 1; ++ ++ /* ++ * Basic mode with control channel in ADM mode may not respond ++ * to CMD_MSC at all and modem_rx is empty. ++ */ ++ if (gsm->encoding == 0 && gsm->dlci[0]->mode == DLCI_MODE_ADM && ++ !dlci->modem_rx) ++ return 1; ++ + return dlci->modem_rx & TIOCM_CD; + } + +diff --git a/drivers/tty/serial/earlycon.c b/drivers/tty/serial/earlycon.c +index 17dba0af5ee9..ac667b47f199 100644 +--- a/drivers/tty/serial/earlycon.c ++++ b/drivers/tty/serial/earlycon.c +@@ -172,7 +172,7 @@ static int __init register_earlycon(char *buf, const struct earlycon_id *match) + */ + int __init setup_earlycon(char *buf) + { +- const struct earlycon_id *match; ++ const struct earlycon_id **p_match; + + if (!buf || !buf[0]) + return -EINVAL; +@@ -180,7 +180,9 @@ int __init setup_earlycon(char *buf) + if (early_con.flags & CON_ENABLED) + return -EALREADY; + +- for (match = __earlycon_table; match < __earlycon_table_end; match++) { ++ for (p_match = __earlycon_table; p_match < __earlycon_table_end; ++ p_match++) { ++ const struct earlycon_id *match = *p_match; + size_t len = strlen(match->name); + + if (strncmp(buf, match->name, len)) +diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c +index 52627478ab61..562d31073f9a 100644 +--- a/drivers/tty/tty_io.c ++++ b/drivers/tty/tty_io.c +@@ -2815,7 +2815,10 @@ struct tty_struct *alloc_tty_struct(struct tty_driver *driver, int idx) + + kref_init(&tty->kref); + tty->magic = TTY_MAGIC; +- tty_ldisc_init(tty); ++ if (tty_ldisc_init(tty)) { ++ kfree(tty); ++ return NULL; ++ } + tty->session = NULL; + tty->pgrp = NULL; + mutex_init(&tty->legacy_mutex); +diff --git a/drivers/tty/tty_ldisc.c b/drivers/tty/tty_ldisc.c +index 7c895684c3ef..ca656ef8de64 100644 +--- a/drivers/tty/tty_ldisc.c ++++ b/drivers/tty/tty_ldisc.c +@@ -175,12 +175,11 @@ static struct tty_ldisc *tty_ldisc_get(struct tty_struct *tty, int disc) + return ERR_CAST(ldops); + } + +- ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL); +- if (ld == NULL) { +- put_ldops(ldops); +- return ERR_PTR(-ENOMEM); +- } +- ++ /* ++ * There is no way to handle allocation failure of only 16 bytes. ++ * Let's simplify error handling and save more memory. ++ */ ++ ld = kmalloc(sizeof(struct tty_ldisc), GFP_KERNEL | __GFP_NOFAIL); + ld->ops = ldops; + ld->tty = tty; + +@@ -526,19 +525,16 @@ static int tty_ldisc_failto(struct tty_struct *tty, int ld) + static void tty_ldisc_restore(struct tty_struct *tty, struct tty_ldisc *old) + { + /* There is an outstanding reference here so this is safe */ +- old = tty_ldisc_get(tty, old->ops->num); +- WARN_ON(IS_ERR(old)); +- tty->ldisc = old; +- tty_set_termios_ldisc(tty, old->ops->num); +- if (tty_ldisc_open(tty, old) < 0) { +- tty_ldisc_put(old); ++ if (tty_ldisc_failto(tty, old->ops->num) < 0) { ++ const char *name = tty_name(tty); ++ ++ pr_warn("Falling back ldisc for %s.\n", name); + /* The traditional behaviour is to fall back to N_TTY, we + want to avoid falling back to N_NULL unless we have no + choice to avoid the risk of breaking anything */ + if (tty_ldisc_failto(tty, N_TTY) < 0 && + tty_ldisc_failto(tty, N_NULL) < 0) +- panic("Couldn't open N_NULL ldisc for %s.", +- tty_name(tty)); ++ panic("Couldn't open N_NULL ldisc for %s.", name); + } + } + +@@ -823,12 +819,13 @@ EXPORT_SYMBOL_GPL(tty_ldisc_release); + * the tty structure is not completely set up when this call is made. + */ + +-void tty_ldisc_init(struct tty_struct *tty) ++int tty_ldisc_init(struct tty_struct *tty) + { + struct tty_ldisc *ld = tty_ldisc_get(tty, N_TTY); + if (IS_ERR(ld)) +- panic("n_tty: init_tty"); ++ return PTR_ERR(ld); + tty->ldisc = ld; ++ return 0; + } + + /** +diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c +index 75ad6718858c..d0b2e0ed9bab 100644 +--- a/drivers/usb/core/hcd.c ++++ b/drivers/usb/core/hcd.c +@@ -2376,6 +2376,7 @@ void usb_hcd_resume_root_hub (struct usb_hcd *hcd) + + spin_lock_irqsave (&hcd_root_hub_lock, flags); + if (hcd->rh_registered) { ++ pm_wakeup_event(&hcd->self.root_hub->dev, 0); + set_bit(HCD_FLAG_WAKEUP_PENDING, &hcd->flags); + queue_work(pm_wq, &hcd->wakeup_work); + } +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 8f7d94239ee3..442be7f312f6 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -650,12 +650,17 @@ void usb_wakeup_notification(struct usb_device *hdev, + unsigned int portnum) + { + struct usb_hub *hub; ++ struct usb_port *port_dev; + + if (!hdev) + return; + + hub = usb_hub_to_struct_hub(hdev); + if (hub) { ++ port_dev = hub->ports[portnum - 1]; ++ if (port_dev && port_dev->child) ++ pm_wakeup_event(&port_dev->child->dev, 0); ++ + set_bit(portnum, hub->wakeup_bits); + kick_hub_wq(hub); + } +@@ -3415,8 +3420,11 @@ int usb_port_resume(struct usb_device *udev, pm_message_t msg) + + /* Skip the initial Clear-Suspend step for a remote wakeup */ + status = hub_port_status(hub, port1, &portstatus, &portchange); +- if (status == 0 && !port_is_suspended(hub, portstatus)) ++ if (status == 0 && !port_is_suspended(hub, portstatus)) { ++ if (portchange & USB_PORT_STAT_C_SUSPEND) ++ pm_wakeup_event(&udev->dev, 0); + goto SuspendCleared; ++ } + + /* see 7.1.7.7; affects power usage, but not budgeting */ + if (hub_is_superspeed(hub->hdev)) +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 4f1c6f8d4352..40ce175655e6 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -45,6 +45,9 @@ static const struct usb_device_id usb_quirk_list[] = { + { USB_DEVICE(0x03f0, 0x0701), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, + ++ /* HP v222w 16GB Mini USB Drive */ ++ { USB_DEVICE(0x03f0, 0x3f40), .driver_info = USB_QUIRK_DELAY_INIT }, ++ + /* Creative SB Audigy 2 NX */ + { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index 3fb57cf8abb8..d79ab0d85924 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -134,7 +134,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_AMD && usb_amd_find_chipset_info()) + xhci->quirks |= XHCI_AMD_PLL_FIX; + +- if (pdev->vendor == PCI_VENDOR_ID_AMD && pdev->device == 0x43bb) ++ if (pdev->vendor == PCI_VENDOR_ID_AMD && ++ (pdev->device == 0x15e0 || ++ pdev->device == 0x15e1 || ++ pdev->device == 0x43bb)) + xhci->quirks |= XHCI_SUSPEND_DELAY; + + if (pdev->vendor == PCI_VENDOR_ID_AMD) +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 1cb6eaef4ae1..7d9e085f7b85 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -423,7 +423,6 @@ MODULE_DEVICE_TABLE(acpi, usb_xhci_acpi_match); + static struct platform_driver usb_xhci_driver = { + .probe = xhci_plat_probe, + .remove = xhci_plat_remove, +- .shutdown = usb_hcd_platform_shutdown, + .driver = { + .name = "xhci-hcd", + .pm = &xhci_plat_pm_ops, +diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig +index c66b93664d54..c508e2d7104b 100644 +--- a/drivers/usb/serial/Kconfig ++++ b/drivers/usb/serial/Kconfig +@@ -62,6 +62,7 @@ config USB_SERIAL_SIMPLE + - Fundamental Software dongle. + - Google USB serial devices + - HP4x calculators ++ - Libtransistor USB console + - a number of Motorola phones + - Motorola Tetra devices + - Novatel Wireless GPS receivers +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 2836acf73a07..d0f00274d16c 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -217,6 +217,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ + { USB_DEVICE(0x3195, 0xF281) }, /* Link Instruments MSO-28 */ ++ { USB_DEVICE(0x3923, 0x7A0B) }, /* National Instruments USB Serial Console */ + { USB_DEVICE(0x413C, 0x9500) }, /* DW700 GPS USB interface */ + { } /* Terminating Entry */ + }; +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index a2a5232751cb..385f2ae3be24 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1902,7 +1902,8 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial) + return ftdi_jtag_probe(serial); + + if (udev->product && +- (!strcmp(udev->product, "BeagleBone/XDS100V2") || ++ (!strcmp(udev->product, "Arrow USB Blaster") || ++ !strcmp(udev->product, "BeagleBone/XDS100V2") || + !strcmp(udev->product, "SNAP Connect E10"))) + return ftdi_jtag_probe(serial); + +diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c +index 6aa7ff2c1cf7..2674da40d9cd 100644 +--- a/drivers/usb/serial/usb-serial-simple.c ++++ b/drivers/usb/serial/usb-serial-simple.c +@@ -66,6 +66,11 @@ DEVICE(flashloader, FLASHLOADER_IDS); + 0x01) } + DEVICE(google, GOOGLE_IDS); + ++/* Libtransistor USB console */ ++#define LIBTRANSISTOR_IDS() \ ++ { USB_DEVICE(0x1209, 0x8b00) } ++DEVICE(libtransistor, LIBTRANSISTOR_IDS); ++ + /* ViVOpay USB Serial Driver */ + #define VIVOPAY_IDS() \ + { USB_DEVICE(0x1d5f, 0x1004) } /* ViVOpay 8800 */ +@@ -113,6 +118,7 @@ static struct usb_serial_driver * const serial_drivers[] = { + &funsoft_device, + &flashloader_device, + &google_device, ++ &libtransistor_device, + &vivopay_device, + &moto_modem_device, + &motorola_tetra_device, +@@ -129,6 +135,7 @@ static const struct usb_device_id id_table[] = { + FUNSOFT_IDS(), + FLASHLOADER_IDS(), + GOOGLE_IDS(), ++ LIBTRANSISTOR_IDS(), + VIVOPAY_IDS(), + MOTO_IDS(), + MOTOROLA_TETRA_IDS(), +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index 714c5bcedf2b..dd24c5c1534d 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -31,7 +31,7 @@ + * difficult to estimate the time it takes for the system to process the command + * before it is actually passed to the PPM. + */ +-#define UCSI_TIMEOUT_MS 1000 ++#define UCSI_TIMEOUT_MS 5000 + + /* + * UCSI_SWAP_TIMEOUT_MS - Timeout for role swap requests +diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c +index 6968c906fa29..b59a253a8479 100644 +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -200,7 +200,12 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf, + if (!bid) + return -ENODEV; + ++ /* device_attach() callers should hold parent lock for USB */ ++ if (bid->udev->dev.parent) ++ device_lock(bid->udev->dev.parent); + ret = device_attach(&bid->udev->dev); ++ if (bid->udev->dev.parent) ++ device_unlock(bid->udev->dev.parent); + if (ret < 0) { + dev_err(&bid->udev->dev, "rebind failed\n"); + return ret; +diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h +index 33737b612b1f..c81c44c13a56 100644 +--- a/drivers/usb/usbip/usbip_common.h ++++ b/drivers/usb/usbip/usbip_common.h +@@ -257,7 +257,7 @@ enum usbip_side { + #define VUDC_EVENT_ERROR_USB (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE) + #define VUDC_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE) + +-#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_BYE) ++#define VDEV_EVENT_REMOVED (USBIP_EH_SHUTDOWN | USBIP_EH_RESET | USBIP_EH_BYE) + #define VDEV_EVENT_DOWN (USBIP_EH_SHUTDOWN | USBIP_EH_RESET) + #define VDEV_EVENT_ERROR_TCP (USBIP_EH_SHUTDOWN | USBIP_EH_RESET) + #define VDEV_EVENT_ERROR_MALLOC (USBIP_EH_SHUTDOWN | USBIP_EH_UNUSABLE) +diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c +index f1635662c299..f8f7f3803a99 100644 +--- a/drivers/usb/usbip/usbip_event.c ++++ b/drivers/usb/usbip/usbip_event.c +@@ -105,10 +105,6 @@ static void event_handler(struct work_struct *work) + unset_event(ud, USBIP_EH_UNUSABLE); + } + +- /* Stop the error handler. */ +- if (ud->event & USBIP_EH_BYE) +- usbip_dbg_eh("removed %p\n", ud); +- + wake_up(&ud->eh_waitq); + } + } +diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c +index 89858aeed647..05aa1ba351b6 100644 +--- a/drivers/usb/usbip/vhci_hcd.c ++++ b/drivers/usb/usbip/vhci_hcd.c +@@ -368,6 +368,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + usbip_dbg_vhci_rh(" ClearHubFeature\n"); + break; + case ClearPortFeature: ++ if (rhport < 0) ++ goto error; + switch (wValue) { + case USB_PORT_FEAT_SUSPEND: + if (hcd->speed == HCD_USB3) { +@@ -525,11 +527,16 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + goto error; + } + ++ if (rhport < 0) ++ goto error; ++ + vhci_hcd->port_status[rhport] |= USB_PORT_STAT_SUSPEND; + break; + case USB_PORT_FEAT_POWER: + usbip_dbg_vhci_rh( + " SetPortFeature: USB_PORT_FEAT_POWER\n"); ++ if (rhport < 0) ++ goto error; + if (hcd->speed == HCD_USB3) + vhci_hcd->port_status[rhport] |= USB_SS_PORT_STAT_POWER; + else +@@ -538,6 +545,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + case USB_PORT_FEAT_BH_PORT_RESET: + usbip_dbg_vhci_rh( + " SetPortFeature: USB_PORT_FEAT_BH_PORT_RESET\n"); ++ if (rhport < 0) ++ goto error; + /* Applicable only for USB3.0 hub */ + if (hcd->speed != HCD_USB3) { + pr_err("USB_PORT_FEAT_BH_PORT_RESET req not " +@@ -548,6 +557,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + case USB_PORT_FEAT_RESET: + usbip_dbg_vhci_rh( + " SetPortFeature: USB_PORT_FEAT_RESET\n"); ++ if (rhport < 0) ++ goto error; + /* if it's already enabled, disable */ + if (hcd->speed == HCD_USB3) { + vhci_hcd->port_status[rhport] = 0; +@@ -568,6 +579,8 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, + default: + usbip_dbg_vhci_rh(" SetPortFeature: default %d\n", + wValue); ++ if (rhport < 0) ++ goto error; + if (hcd->speed == HCD_USB3) { + if ((vhci_hcd->port_status[rhport] & + USB_SS_PORT_STAT_POWER) != 0) { +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index db5be5e2e6f2..58db8109defa 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -321,6 +321,7 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb, + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_grpblk_t offset; + ext4_grpblk_t next_zero_bit; ++ ext4_grpblk_t max_bit = EXT4_CLUSTERS_PER_GROUP(sb); + ext4_fsblk_t blk; + ext4_fsblk_t group_first_block; + +@@ -338,20 +339,25 @@ static ext4_fsblk_t ext4_valid_block_bitmap(struct super_block *sb, + /* check whether block bitmap block number is set */ + blk = ext4_block_bitmap(sb, desc); + offset = blk - group_first_block; +- if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data)) ++ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit || ++ !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data)) + /* bad block bitmap */ + return blk; + + /* check whether the inode bitmap block number is set */ + blk = ext4_inode_bitmap(sb, desc); + offset = blk - group_first_block; +- if (!ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data)) ++ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit || ++ !ext4_test_bit(EXT4_B2C(sbi, offset), bh->b_data)) + /* bad block bitmap */ + return blk; + + /* check whether the inode table block number is set */ + blk = ext4_inode_table(sb, desc); + offset = blk - group_first_block; ++ if (offset < 0 || EXT4_B2C(sbi, offset) >= max_bit || ++ EXT4_B2C(sbi, offset + sbi->s_itb_per_group) >= max_bit) ++ return blk; + next_zero_bit = ext4_find_next_zero_bit(bh->b_data, + EXT4_B2C(sbi, offset + EXT4_SB(sb)->s_itb_per_group), + EXT4_B2C(sbi, offset)); +@@ -417,6 +423,7 @@ struct buffer_head * + ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) + { + struct ext4_group_desc *desc; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); + struct buffer_head *bh; + ext4_fsblk_t bitmap_blk; + int err; +@@ -425,6 +432,12 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) + if (!desc) + return ERR_PTR(-EFSCORRUPTED); + bitmap_blk = ext4_block_bitmap(sb, desc); ++ if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) || ++ (bitmap_blk >= ext4_blocks_count(sbi->s_es))) { ++ ext4_error(sb, "Invalid block bitmap block %llu in " ++ "block_group %u", bitmap_blk, block_group); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + bh = sb_getblk(sb, bitmap_blk); + if (unlikely(!bh)) { + ext4_error(sb, "Cannot get buffer for block bitmap - " +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index c941251ac0c0..883e89a903d1 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -5346,8 +5346,9 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + stop = le32_to_cpu(extent->ee_block); + + /* +- * In case of left shift, Don't start shifting extents until we make +- * sure the hole is big enough to accommodate the shift. ++ * For left shifts, make sure the hole on the left is big enough to ++ * accommodate the shift. For right shifts, make sure the last extent ++ * won't be shifted beyond EXT_MAX_BLOCKS. + */ + if (SHIFT == SHIFT_LEFT) { + path = ext4_find_extent(inode, start - 1, &path, +@@ -5367,9 +5368,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, + + if ((start == ex_start && shift > ex_start) || + (shift > start - ex_end)) { +- ext4_ext_drop_refs(path); +- kfree(path); +- return -EINVAL; ++ ret = -EINVAL; ++ goto out; ++ } ++ } else { ++ if (shift > EXT_MAX_BLOCKS - ++ (stop + ext4_ext_get_actual_len(extent))) { ++ ret = -EINVAL; ++ goto out; + } + } + +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 7ec55dd8db56..f420124ac035 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -122,6 +122,7 @@ static struct buffer_head * + ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) + { + struct ext4_group_desc *desc; ++ struct ext4_sb_info *sbi = EXT4_SB(sb); + struct buffer_head *bh = NULL; + ext4_fsblk_t bitmap_blk; + int err; +@@ -131,6 +132,12 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) + return ERR_PTR(-EFSCORRUPTED); + + bitmap_blk = ext4_inode_bitmap(sb, desc); ++ if ((bitmap_blk <= le32_to_cpu(sbi->s_es->s_first_data_block)) || ++ (bitmap_blk >= ext4_blocks_count(sbi->s_es))) { ++ ext4_error(sb, "Invalid inode bitmap blk %llu in " ++ "block_group %u", bitmap_blk, block_group); ++ return ERR_PTR(-EFSCORRUPTED); ++ } + bh = sb_getblk(sb, bitmap_blk); + if (unlikely(!bh)) { + ext4_error(sb, "Cannot read inode bitmap - " +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 3a605c672649..9102ae7709d3 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5865,5 +5865,6 @@ static void __exit ext4_exit_fs(void) + MODULE_AUTHOR("Remy Card, Stephen Tweedie, Andrew Morton, Andreas Dilger, Theodore Ts'o and others"); + MODULE_DESCRIPTION("Fourth Extended Filesystem"); + MODULE_LICENSE("GPL"); ++MODULE_SOFTDEP("pre: crc32c"); + module_init(ext4_init_fs) + module_exit(ext4_exit_fs) +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index c0681814c379..07793e25c976 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -535,6 +535,7 @@ int jbd2_journal_start_reserved(handle_t *handle, unsigned int type, + */ + ret = start_this_handle(journal, handle, GFP_NOFS); + if (ret < 0) { ++ handle->h_journal = journal; + jbd2_journal_free_reserved(handle); + return ret; + } +diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h +index 353f52fdc35e..fcec26d60d8c 100644 +--- a/include/asm-generic/vmlinux.lds.h ++++ b/include/asm-generic/vmlinux.lds.h +@@ -170,7 +170,7 @@ + #endif + + #ifdef CONFIG_SERIAL_EARLYCON +-#define EARLYCON_TABLE() STRUCT_ALIGN(); \ ++#define EARLYCON_TABLE() . = ALIGN(8); \ + VMLINUX_SYMBOL(__earlycon_table) = .; \ + KEEP(*(__earlycon_table)) \ + VMLINUX_SYMBOL(__earlycon_table_end) = .; +diff --git a/include/kvm/arm_psci.h b/include/kvm/arm_psci.h +index e518e4e3dfb5..4b1548129fa2 100644 +--- a/include/kvm/arm_psci.h ++++ b/include/kvm/arm_psci.h +@@ -37,10 +37,15 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm) + * Our PSCI implementation stays the same across versions from + * v0.2 onward, only adding the few mandatory functions (such + * as FEATURES with 1.0) that are required by newer +- * revisions. It is thus safe to return the latest. ++ * revisions. It is thus safe to return the latest, unless ++ * userspace has instructed us otherwise. + */ +- if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features)) ++ if (test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features)) { ++ if (vcpu->kvm->arch.psci_version) ++ return vcpu->kvm->arch.psci_version; ++ + return KVM_ARM_PSCI_LATEST; ++ } + + return KVM_ARM_PSCI_0_1; + } +@@ -48,4 +53,11 @@ static inline int kvm_psci_version(struct kvm_vcpu *vcpu, struct kvm *kvm) + + int kvm_hvc_call_handler(struct kvm_vcpu *vcpu); + ++struct kvm_one_reg; ++ ++int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu); ++int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices); ++int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg); ++int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg); ++ + #endif /* __KVM_ARM_PSCI_H__ */ +diff --git a/include/linux/mtd/flashchip.h b/include/linux/mtd/flashchip.h +index b63fa457febd..3529683f691e 100644 +--- a/include/linux/mtd/flashchip.h ++++ b/include/linux/mtd/flashchip.h +@@ -85,6 +85,7 @@ struct flchip { + unsigned int write_suspended:1; + unsigned int erase_suspended:1; + unsigned long in_progress_block_addr; ++ unsigned long in_progress_block_mask; + + struct mutex mutex; + wait_queue_head_t wq; /* Wait on here when we're waiting for the chip +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 5553e04e59c9..74fc82d22310 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -351,10 +351,10 @@ struct earlycon_id { + char name[16]; + char compatible[128]; + int (*setup)(struct earlycon_device *, const char *options); +-} __aligned(32); ++}; + +-extern const struct earlycon_id __earlycon_table[]; +-extern const struct earlycon_id __earlycon_table_end[]; ++extern const struct earlycon_id *__earlycon_table[]; ++extern const struct earlycon_id *__earlycon_table_end[]; + + #if defined(CONFIG_SERIAL_EARLYCON) && !defined(MODULE) + #define EARLYCON_USED_OR_UNUSED __used +@@ -362,12 +362,19 @@ extern const struct earlycon_id __earlycon_table_end[]; + #define EARLYCON_USED_OR_UNUSED __maybe_unused + #endif + +-#define OF_EARLYCON_DECLARE(_name, compat, fn) \ +- static const struct earlycon_id __UNIQUE_ID(__earlycon_##_name) \ +- EARLYCON_USED_OR_UNUSED __section(__earlycon_table) \ ++#define _OF_EARLYCON_DECLARE(_name, compat, fn, unique_id) \ ++ static const struct earlycon_id unique_id \ ++ EARLYCON_USED_OR_UNUSED __initconst \ + = { .name = __stringify(_name), \ + .compatible = compat, \ +- .setup = fn } ++ .setup = fn }; \ ++ static const struct earlycon_id EARLYCON_USED_OR_UNUSED \ ++ __section(__earlycon_table) \ ++ * const __PASTE(__p, unique_id) = &unique_id ++ ++#define OF_EARLYCON_DECLARE(_name, compat, fn) \ ++ _OF_EARLYCON_DECLARE(_name, compat, fn, \ ++ __UNIQUE_ID(__earlycon_##_name)) + + #define EARLYCON_DECLARE(_name, fn) OF_EARLYCON_DECLARE(_name, "", fn) + +diff --git a/include/linux/tty.h b/include/linux/tty.h +index 47f8af22f216..1dd587ba6d88 100644 +--- a/include/linux/tty.h ++++ b/include/linux/tty.h +@@ -701,7 +701,7 @@ extern int tty_unregister_ldisc(int disc); + extern int tty_set_ldisc(struct tty_struct *tty, int disc); + extern int tty_ldisc_setup(struct tty_struct *tty, struct tty_struct *o_tty); + extern void tty_ldisc_release(struct tty_struct *tty); +-extern void tty_ldisc_init(struct tty_struct *tty); ++extern int __must_check tty_ldisc_init(struct tty_struct *tty); + extern void tty_ldisc_deinit(struct tty_struct *tty); + extern int tty_ldisc_receive_buf(struct tty_ldisc *ld, const unsigned char *p, + char *f, int count); +diff --git a/include/linux/virtio.h b/include/linux/virtio.h +index 988c7355bc22..fa1b5da2804e 100644 +--- a/include/linux/virtio.h ++++ b/include/linux/virtio.h +@@ -157,6 +157,9 @@ int virtio_device_freeze(struct virtio_device *dev); + int virtio_device_restore(struct virtio_device *dev); + #endif + ++#define virtio_device_for_each_vq(vdev, vq) \ ++ list_for_each_entry(vq, &vdev->vqs, list) ++ + /** + * virtio_driver - operations for a virtio I/O driver + * @driver: underlying device driver (populate name and owner). +diff --git a/include/sound/control.h b/include/sound/control.h +index ca13a44ae9d4..6011a58d3e20 100644 +--- a/include/sound/control.h ++++ b/include/sound/control.h +@@ -23,6 +23,7 @@ + */ + + #include ++#include + #include + + #define snd_kcontrol_chip(kcontrol) ((kcontrol)->private_data) +@@ -148,12 +149,14 @@ int snd_ctl_get_preferred_subdevice(struct snd_card *card, int type); + + static inline unsigned int snd_ctl_get_ioffnum(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id) + { +- return id->numid - kctl->id.numid; ++ unsigned int ioff = id->numid - kctl->id.numid; ++ return array_index_nospec(ioff, kctl->count); + } + + static inline unsigned int snd_ctl_get_ioffidx(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id) + { +- return id->index - kctl->id.index; ++ unsigned int ioff = id->index - kctl->id.index; ++ return array_index_nospec(ioff, kctl->count); + } + + static inline unsigned int snd_ctl_get_ioff(struct snd_kcontrol *kctl, struct snd_ctl_elem_id *id) +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index dfa4a117fee3..bb2af74e6b62 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -820,12 +820,13 @@ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, + goto out; + } + +- hrtimer_set_expires(&ts->sched_timer, tick); +- +- if (ts->nohz_mode == NOHZ_MODE_HIGHRES) +- hrtimer_start_expires(&ts->sched_timer, HRTIMER_MODE_ABS_PINNED); +- else ++ if (ts->nohz_mode == NOHZ_MODE_HIGHRES) { ++ hrtimer_start(&ts->sched_timer, tick, HRTIMER_MODE_ABS_PINNED); ++ } else { ++ hrtimer_set_expires(&ts->sched_timer, tick); + tick_program_event(tick, 1); ++ } ++ + out: + /* + * Update the estimated sleep length until the next timer +diff --git a/lib/kobject.c b/lib/kobject.c +index 763d70a18941..34f847252c02 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -234,14 +234,12 @@ static int kobject_add_internal(struct kobject *kobj) + + /* be noisy on error issues */ + if (error == -EEXIST) +- WARN(1, "%s failed for %s with " +- "-EEXIST, don't try to register things with " +- "the same name in the same directory.\n", +- __func__, kobject_name(kobj)); ++ pr_err("%s failed for %s with -EEXIST, don't try to register things with the same name in the same directory.\n", ++ __func__, kobject_name(kobj)); + else +- WARN(1, "%s failed for %s (error: %d parent: %s)\n", +- __func__, kobject_name(kobj), error, +- parent ? kobject_name(parent) : "'none'"); ++ pr_err("%s failed for %s (error: %d parent: %s)\n", ++ __func__, kobject_name(kobj), error, ++ parent ? kobject_name(parent) : "'none'"); + } else + kobj->state_in_sysfs = 1; + +diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c +index ad93342c90d7..5c4e85296cf6 100644 +--- a/net/ceph/messenger.c ++++ b/net/ceph/messenger.c +@@ -2530,6 +2530,11 @@ static int try_write(struct ceph_connection *con) + int ret = 1; + + dout("try_write start %p state %lu\n", con, con->state); ++ if (con->state != CON_STATE_PREOPEN && ++ con->state != CON_STATE_CONNECTING && ++ con->state != CON_STATE_NEGOTIATING && ++ con->state != CON_STATE_OPEN) ++ return 0; + + more: + dout("try_write out_kvec_bytes %d\n", con->out_kvec_bytes); +@@ -2555,6 +2560,8 @@ static int try_write(struct ceph_connection *con) + } + + more_kvec: ++ BUG_ON(!con->sock); ++ + /* kvec data queued? */ + if (con->out_kvec_left) { + ret = write_partial_kvec(con); +diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c +index 9ae1bab8c05d..f14498a7eaec 100644 +--- a/net/ceph/mon_client.c ++++ b/net/ceph/mon_client.c +@@ -209,6 +209,14 @@ static void reopen_session(struct ceph_mon_client *monc) + __open_session(monc); + } + ++static void un_backoff(struct ceph_mon_client *monc) ++{ ++ monc->hunt_mult /= 2; /* reduce by 50% */ ++ if (monc->hunt_mult < 1) ++ monc->hunt_mult = 1; ++ dout("%s hunt_mult now %d\n", __func__, monc->hunt_mult); ++} ++ + /* + * Reschedule delayed work timer. + */ +@@ -963,6 +971,7 @@ static void delayed_work(struct work_struct *work) + if (!monc->hunting) { + ceph_con_keepalive(&monc->con); + __validate_auth(monc); ++ un_backoff(monc); + } + + if (is_auth && +@@ -1123,9 +1132,8 @@ static void finish_hunting(struct ceph_mon_client *monc) + dout("%s found mon%d\n", __func__, monc->cur_mon); + monc->hunting = false; + monc->had_a_connection = true; +- monc->hunt_mult /= 2; /* reduce by 50% */ +- if (monc->hunt_mult < 1) +- monc->hunt_mult = 1; ++ un_backoff(monc); ++ __schedule_delayed(monc); + } + } + +diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c +index b719d0bd833e..06d7c40af570 100644 +--- a/sound/core/pcm_compat.c ++++ b/sound/core/pcm_compat.c +@@ -27,10 +27,11 @@ static int snd_pcm_ioctl_delay_compat(struct snd_pcm_substream *substream, + s32 __user *src) + { + snd_pcm_sframes_t delay; ++ int err; + +- delay = snd_pcm_delay(substream); +- if (delay < 0) +- return delay; ++ err = snd_pcm_delay(substream, &delay); ++ if (err) ++ return err; + if (put_user(delay, src)) + return -EFAULT; + return 0; +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index eba2bedcbc81..ab3bf36786b6 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -2689,7 +2689,8 @@ static int snd_pcm_hwsync(struct snd_pcm_substream *substream) + return err; + } + +-static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream) ++static int snd_pcm_delay(struct snd_pcm_substream *substream, ++ snd_pcm_sframes_t *delay) + { + struct snd_pcm_runtime *runtime = substream->runtime; + int err; +@@ -2705,7 +2706,9 @@ static snd_pcm_sframes_t snd_pcm_delay(struct snd_pcm_substream *substream) + n += runtime->delay; + } + snd_pcm_stream_unlock_irq(substream); +- return err < 0 ? err : n; ++ if (!err) ++ *delay = n; ++ return err; + } + + static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream, +@@ -2748,6 +2751,7 @@ static int snd_pcm_sync_ptr(struct snd_pcm_substream *substream, + sync_ptr.s.status.hw_ptr = status->hw_ptr; + sync_ptr.s.status.tstamp = status->tstamp; + sync_ptr.s.status.suspended_state = status->suspended_state; ++ sync_ptr.s.status.audio_tstamp = status->audio_tstamp; + snd_pcm_stream_unlock_irq(substream); + if (copy_to_user(_sync_ptr, &sync_ptr, sizeof(sync_ptr))) + return -EFAULT; +@@ -2913,11 +2917,13 @@ static int snd_pcm_common_ioctl(struct file *file, + return snd_pcm_hwsync(substream); + case SNDRV_PCM_IOCTL_DELAY: + { +- snd_pcm_sframes_t delay = snd_pcm_delay(substream); ++ snd_pcm_sframes_t delay; + snd_pcm_sframes_t __user *res = arg; ++ int err; + +- if (delay < 0) +- return delay; ++ err = snd_pcm_delay(substream, &delay); ++ if (err) ++ return err; + if (put_user(delay, res)) + return -EFAULT; + return 0; +@@ -3005,13 +3011,7 @@ int snd_pcm_kernel_ioctl(struct snd_pcm_substream *substream, + case SNDRV_PCM_IOCTL_DROP: + return snd_pcm_drop(substream); + case SNDRV_PCM_IOCTL_DELAY: +- { +- result = snd_pcm_delay(substream); +- if (result < 0) +- return result; +- *frames = result; +- return 0; +- } ++ return snd_pcm_delay(substream, frames); + default: + return -EINVAL; + } +diff --git a/sound/core/seq/oss/seq_oss_event.c b/sound/core/seq/oss/seq_oss_event.c +index c3908862bc8b..86ca584c27b2 100644 +--- a/sound/core/seq/oss/seq_oss_event.c ++++ b/sound/core/seq/oss/seq_oss_event.c +@@ -26,6 +26,7 @@ + #include + #include "seq_oss_readq.h" + #include "seq_oss_writeq.h" ++#include + + + /* +@@ -287,10 +288,10 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st + { + struct seq_oss_synthinfo *info; + +- if (!snd_seq_oss_synth_is_valid(dp, dev)) ++ info = snd_seq_oss_synth_info(dp, dev); ++ if (!info) + return -ENXIO; + +- info = &dp->synths[dev]; + switch (info->arg.event_passing) { + case SNDRV_SEQ_OSS_PROCESS_EVENTS: + if (! info->ch || ch < 0 || ch >= info->nr_voices) { +@@ -298,6 +299,7 @@ note_on_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, st + return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev); + } + ++ ch = array_index_nospec(ch, info->nr_voices); + if (note == 255 && info->ch[ch].note >= 0) { + /* volume control */ + int type; +@@ -347,10 +349,10 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s + { + struct seq_oss_synthinfo *info; + +- if (!snd_seq_oss_synth_is_valid(dp, dev)) ++ info = snd_seq_oss_synth_info(dp, dev); ++ if (!info) + return -ENXIO; + +- info = &dp->synths[dev]; + switch (info->arg.event_passing) { + case SNDRV_SEQ_OSS_PROCESS_EVENTS: + if (! info->ch || ch < 0 || ch >= info->nr_voices) { +@@ -358,6 +360,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s + return set_note_event(dp, dev, SNDRV_SEQ_EVENT_NOTEON, ch, note, vel, ev); + } + ++ ch = array_index_nospec(ch, info->nr_voices); + if (info->ch[ch].note >= 0) { + note = info->ch[ch].note; + info->ch[ch].vel = 0; +@@ -381,7 +384,7 @@ note_off_event(struct seq_oss_devinfo *dp, int dev, int ch, int note, int vel, s + static int + set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note, int vel, struct snd_seq_event *ev) + { +- if (! snd_seq_oss_synth_is_valid(dp, dev)) ++ if (!snd_seq_oss_synth_info(dp, dev)) + return -ENXIO; + + ev->type = type; +@@ -399,7 +402,7 @@ set_note_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int note, + static int + set_control_event(struct seq_oss_devinfo *dp, int dev, int type, int ch, int param, int val, struct snd_seq_event *ev) + { +- if (! snd_seq_oss_synth_is_valid(dp, dev)) ++ if (!snd_seq_oss_synth_info(dp, dev)) + return -ENXIO; + + ev->type = type; +diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c +index b30b2139e3f0..9debd1b8fd28 100644 +--- a/sound/core/seq/oss/seq_oss_midi.c ++++ b/sound/core/seq/oss/seq_oss_midi.c +@@ -29,6 +29,7 @@ + #include "../seq_lock.h" + #include + #include ++#include + + + /* +@@ -315,6 +316,7 @@ get_mididev(struct seq_oss_devinfo *dp, int dev) + { + if (dev < 0 || dev >= dp->max_mididev) + return NULL; ++ dev = array_index_nospec(dev, dp->max_mididev); + return get_mdev(dev); + } + +diff --git a/sound/core/seq/oss/seq_oss_synth.c b/sound/core/seq/oss/seq_oss_synth.c +index cd0e0ebbfdb1..278ebb993122 100644 +--- a/sound/core/seq/oss/seq_oss_synth.c ++++ b/sound/core/seq/oss/seq_oss_synth.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + /* + * constants +@@ -339,17 +340,13 @@ snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp) + dp->max_synthdev = 0; + } + +-/* +- * check if the specified device is MIDI mapped device +- */ +-static int +-is_midi_dev(struct seq_oss_devinfo *dp, int dev) ++static struct seq_oss_synthinfo * ++get_synthinfo_nospec(struct seq_oss_devinfo *dp, int dev) + { + if (dev < 0 || dev >= dp->max_synthdev) +- return 0; +- if (dp->synths[dev].is_midi) +- return 1; +- return 0; ++ return NULL; ++ dev = array_index_nospec(dev, SNDRV_SEQ_OSS_MAX_SYNTH_DEVS); ++ return &dp->synths[dev]; + } + + /* +@@ -359,14 +356,20 @@ static struct seq_oss_synth * + get_synthdev(struct seq_oss_devinfo *dp, int dev) + { + struct seq_oss_synth *rec; +- if (dev < 0 || dev >= dp->max_synthdev) +- return NULL; +- if (! dp->synths[dev].opened) ++ struct seq_oss_synthinfo *info = get_synthinfo_nospec(dp, dev); ++ ++ if (!info) + return NULL; +- if (dp->synths[dev].is_midi) +- return &midi_synth_dev; +- if ((rec = get_sdev(dev)) == NULL) ++ if (!info->opened) + return NULL; ++ if (info->is_midi) { ++ rec = &midi_synth_dev; ++ snd_use_lock_use(&rec->use_lock); ++ } else { ++ rec = get_sdev(dev); ++ if (!rec) ++ return NULL; ++ } + if (! rec->opened) { + snd_use_lock_free(&rec->use_lock); + return NULL; +@@ -402,10 +405,8 @@ snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev) + struct seq_oss_synth *rec; + struct seq_oss_synthinfo *info; + +- if (snd_BUG_ON(dev < 0 || dev >= dp->max_synthdev)) +- return; +- info = &dp->synths[dev]; +- if (! info->opened) ++ info = get_synthinfo_nospec(dp, dev); ++ if (!info || !info->opened) + return; + if (info->sysex) + info->sysex->len = 0; /* reset sysex */ +@@ -454,12 +455,14 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt, + const char __user *buf, int p, int c) + { + struct seq_oss_synth *rec; ++ struct seq_oss_synthinfo *info; + int rc; + +- if (dev < 0 || dev >= dp->max_synthdev) ++ info = get_synthinfo_nospec(dp, dev); ++ if (!info) + return -ENXIO; + +- if (is_midi_dev(dp, dev)) ++ if (info->is_midi) + return 0; + if ((rec = get_synthdev(dp, dev)) == NULL) + return -ENXIO; +@@ -467,24 +470,25 @@ snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt, + if (rec->oper.load_patch == NULL) + rc = -ENXIO; + else +- rc = rec->oper.load_patch(&dp->synths[dev].arg, fmt, buf, p, c); ++ rc = rec->oper.load_patch(&info->arg, fmt, buf, p, c); + snd_use_lock_free(&rec->use_lock); + return rc; + } + + /* +- * check if the device is valid synth device ++ * check if the device is valid synth device and return the synth info + */ +-int +-snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev) ++struct seq_oss_synthinfo * ++snd_seq_oss_synth_info(struct seq_oss_devinfo *dp, int dev) + { + struct seq_oss_synth *rec; ++ + rec = get_synthdev(dp, dev); + if (rec) { + snd_use_lock_free(&rec->use_lock); +- return 1; ++ return get_synthinfo_nospec(dp, dev); + } +- return 0; ++ return NULL; + } + + +@@ -499,16 +503,18 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, + int i, send; + unsigned char *dest; + struct seq_oss_synth_sysex *sysex; ++ struct seq_oss_synthinfo *info; + +- if (! snd_seq_oss_synth_is_valid(dp, dev)) ++ info = snd_seq_oss_synth_info(dp, dev); ++ if (!info) + return -ENXIO; + +- sysex = dp->synths[dev].sysex; ++ sysex = info->sysex; + if (sysex == NULL) { + sysex = kzalloc(sizeof(*sysex), GFP_KERNEL); + if (sysex == NULL) + return -ENOMEM; +- dp->synths[dev].sysex = sysex; ++ info->sysex = sysex; + } + + send = 0; +@@ -553,10 +559,12 @@ snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, + int + snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev) + { +- if (! snd_seq_oss_synth_is_valid(dp, dev)) ++ struct seq_oss_synthinfo *info = snd_seq_oss_synth_info(dp, dev); ++ ++ if (!info) + return -EINVAL; +- snd_seq_oss_fill_addr(dp, ev, dp->synths[dev].arg.addr.client, +- dp->synths[dev].arg.addr.port); ++ snd_seq_oss_fill_addr(dp, ev, info->arg.addr.client, ++ info->arg.addr.port); + return 0; + } + +@@ -568,16 +576,18 @@ int + snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, unsigned long addr) + { + struct seq_oss_synth *rec; ++ struct seq_oss_synthinfo *info; + int rc; + +- if (is_midi_dev(dp, dev)) ++ info = get_synthinfo_nospec(dp, dev); ++ if (!info || info->is_midi) + return -ENXIO; + if ((rec = get_synthdev(dp, dev)) == NULL) + return -ENXIO; + if (rec->oper.ioctl == NULL) + rc = -ENXIO; + else +- rc = rec->oper.ioctl(&dp->synths[dev].arg, cmd, addr); ++ rc = rec->oper.ioctl(&info->arg, cmd, addr); + snd_use_lock_free(&rec->use_lock); + return rc; + } +@@ -589,7 +599,10 @@ snd_seq_oss_synth_ioctl(struct seq_oss_devinfo *dp, int dev, unsigned int cmd, u + int + snd_seq_oss_synth_raw_event(struct seq_oss_devinfo *dp, int dev, unsigned char *data, struct snd_seq_event *ev) + { +- if (! snd_seq_oss_synth_is_valid(dp, dev) || is_midi_dev(dp, dev)) ++ struct seq_oss_synthinfo *info; ++ ++ info = snd_seq_oss_synth_info(dp, dev); ++ if (!info || info->is_midi) + return -ENXIO; + ev->type = SNDRV_SEQ_EVENT_OSS; + memcpy(ev->data.raw8.d, data, 8); +diff --git a/sound/core/seq/oss/seq_oss_synth.h b/sound/core/seq/oss/seq_oss_synth.h +index 74ac55f166b6..a63f9e22974d 100644 +--- a/sound/core/seq/oss/seq_oss_synth.h ++++ b/sound/core/seq/oss/seq_oss_synth.h +@@ -37,7 +37,8 @@ void snd_seq_oss_synth_cleanup(struct seq_oss_devinfo *dp); + void snd_seq_oss_synth_reset(struct seq_oss_devinfo *dp, int dev); + int snd_seq_oss_synth_load_patch(struct seq_oss_devinfo *dp, int dev, int fmt, + const char __user *buf, int p, int c); +-int snd_seq_oss_synth_is_valid(struct seq_oss_devinfo *dp, int dev); ++struct seq_oss_synthinfo *snd_seq_oss_synth_info(struct seq_oss_devinfo *dp, ++ int dev); + int snd_seq_oss_synth_sysex(struct seq_oss_devinfo *dp, int dev, unsigned char *buf, + struct snd_seq_event *ev); + int snd_seq_oss_synth_addr(struct seq_oss_devinfo *dp, int dev, struct snd_seq_event *ev); +diff --git a/sound/drivers/opl3/opl3_synth.c b/sound/drivers/opl3/opl3_synth.c +index ddcc1a325a61..42920a243328 100644 +--- a/sound/drivers/opl3/opl3_synth.c ++++ b/sound/drivers/opl3/opl3_synth.c +@@ -21,6 +21,7 @@ + + #include + #include ++#include + #include + #include + +@@ -448,7 +449,7 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v + { + unsigned short reg_side; + unsigned char op_offset; +- unsigned char voice_offset; ++ unsigned char voice_offset, voice_op; + + unsigned short opl3_reg; + unsigned char reg_val; +@@ -473,7 +474,9 @@ static int snd_opl3_set_voice(struct snd_opl3 * opl3, struct snd_dm_fm_voice * v + voice_offset = voice->voice - MAX_OPL2_VOICES; + } + /* Get register offset of operator */ +- op_offset = snd_opl3_regmap[voice_offset][voice->op]; ++ voice_offset = array_index_nospec(voice_offset, MAX_OPL2_VOICES); ++ voice_op = array_index_nospec(voice->op, 4); ++ op_offset = snd_opl3_regmap[voice_offset][voice_op]; + + reg_val = 0x00; + /* Set amplitude modulation (tremolo) effect */ +diff --git a/sound/firewire/dice/dice-stream.c b/sound/firewire/dice/dice-stream.c +index 8573289c381e..928a255bfc35 100644 +--- a/sound/firewire/dice/dice-stream.c ++++ b/sound/firewire/dice/dice-stream.c +@@ -435,7 +435,7 @@ int snd_dice_stream_init_duplex(struct snd_dice *dice) + err = init_stream(dice, AMDTP_IN_STREAM, i); + if (err < 0) { + for (; i >= 0; i--) +- destroy_stream(dice, AMDTP_OUT_STREAM, i); ++ destroy_stream(dice, AMDTP_IN_STREAM, i); + goto end; + } + } +diff --git a/sound/firewire/dice/dice.c b/sound/firewire/dice/dice.c +index 4ddb4cdd054b..96bb01b6b751 100644 +--- a/sound/firewire/dice/dice.c ++++ b/sound/firewire/dice/dice.c +@@ -14,7 +14,7 @@ MODULE_LICENSE("GPL v2"); + #define OUI_WEISS 0x001c6a + #define OUI_LOUD 0x000ff2 + #define OUI_FOCUSRITE 0x00130e +-#define OUI_TCELECTRONIC 0x001486 ++#define OUI_TCELECTRONIC 0x000166 + + #define DICE_CATEGORY_ID 0x04 + #define WEISS_CATEGORY_ID 0x00 +diff --git a/sound/pci/asihpi/hpimsginit.c b/sound/pci/asihpi/hpimsginit.c +index 7eb617175fde..a31a70dccecf 100644 +--- a/sound/pci/asihpi/hpimsginit.c ++++ b/sound/pci/asihpi/hpimsginit.c +@@ -23,6 +23,7 @@ + + #include "hpi_internal.h" + #include "hpimsginit.h" ++#include + + /* The actual message size for each object type */ + static u16 msg_size[HPI_OBJ_MAXINDEX + 1] = HPI_MESSAGE_SIZE_BY_OBJECT; +@@ -39,10 +40,12 @@ static void hpi_init_message(struct hpi_message *phm, u16 object, + { + u16 size; + +- if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) ++ if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) { ++ object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1); + size = msg_size[object]; +- else ++ } else { + size = sizeof(*phm); ++ } + + memset(phm, 0, size); + phm->size = size; +@@ -66,10 +69,12 @@ void hpi_init_response(struct hpi_response *phr, u16 object, u16 function, + { + u16 size; + +- if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) ++ if ((object > 0) && (object <= HPI_OBJ_MAXINDEX)) { ++ object = array_index_nospec(object, HPI_OBJ_MAXINDEX + 1); + size = res_size[object]; +- else ++ } else { + size = sizeof(*phr); ++ } + + memset(phr, 0, sizeof(*phr)); + phr->size = size; +diff --git a/sound/pci/asihpi/hpioctl.c b/sound/pci/asihpi/hpioctl.c +index 5badd08e1d69..b1a2a7ea4172 100644 +--- a/sound/pci/asihpi/hpioctl.c ++++ b/sound/pci/asihpi/hpioctl.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + + #ifdef MODULE_FIRMWARE + MODULE_FIRMWARE("asihpi/dsp5000.bin"); +@@ -186,7 +187,8 @@ long asihpi_hpi_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + struct hpi_adapter *pa = NULL; + + if (hm->h.adapter_index < ARRAY_SIZE(adapters)) +- pa = &adapters[hm->h.adapter_index]; ++ pa = &adapters[array_index_nospec(hm->h.adapter_index, ++ ARRAY_SIZE(adapters))]; + + if (!pa || !pa->adapter || !pa->adapter->type) { + hpi_init_response(&hr->r0, hm->h.object, +diff --git a/sound/pci/hda/hda_hwdep.c b/sound/pci/hda/hda_hwdep.c +index 57df06e76968..cc009a4a3d1d 100644 +--- a/sound/pci/hda/hda_hwdep.c ++++ b/sound/pci/hda/hda_hwdep.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + #include "hda_codec.h" + #include "hda_local.h" +@@ -51,7 +52,16 @@ static int get_wcap_ioctl(struct hda_codec *codec, + + if (get_user(verb, &arg->verb)) + return -EFAULT; +- res = get_wcaps(codec, verb >> 24); ++ /* open-code get_wcaps(verb>>24) with nospec */ ++ verb >>= 24; ++ if (verb < codec->core.start_nid || ++ verb >= codec->core.start_nid + codec->core.num_nodes) { ++ res = 0; ++ } else { ++ verb -= codec->core.start_nid; ++ verb = array_index_nospec(verb, codec->core.num_nodes); ++ res = codec->wcaps[verb]; ++ } + if (put_user(res, &arg->res)) + return -EFAULT; + return 0; +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index b4f1b6e88305..7d7eb1354eee 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -1383,6 +1383,8 @@ static void hdmi_pcm_setup_pin(struct hdmi_spec *spec, + pcm = get_pcm_rec(spec, per_pin->pcm_idx); + else + return; ++ if (!pcm->pcm) ++ return; + if (!test_bit(per_pin->pcm_idx, &spec->pcm_in_use)) + return; + +@@ -2151,8 +2153,13 @@ static int generic_hdmi_build_controls(struct hda_codec *codec) + int dev, err; + int pin_idx, pcm_idx; + +- + for (pcm_idx = 0; pcm_idx < spec->pcm_used; pcm_idx++) { ++ if (!get_pcm_rec(spec, pcm_idx)->pcm) { ++ /* no PCM: mark this for skipping permanently */ ++ set_bit(pcm_idx, &spec->pcm_bitmap); ++ continue; ++ } ++ + err = generic_hdmi_build_jack(codec, pcm_idx); + if (err < 0) + return err; +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 590887d9b7a1..59daf9901466 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -331,6 +331,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) + /* fallthrough */ + case 0x10ec0215: + case 0x10ec0233: ++ case 0x10ec0235: + case 0x10ec0236: + case 0x10ec0255: + case 0x10ec0256: +@@ -6435,6 +6436,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), ++ SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), +@@ -7015,8 +7017,11 @@ static int patch_alc269(struct hda_codec *codec) + case 0x10ec0298: + spec->codec_variant = ALC269_TYPE_ALC298; + break; ++ case 0x10ec0235: + case 0x10ec0255: + spec->codec_variant = ALC269_TYPE_ALC255; ++ spec->shutup = alc256_shutup; ++ spec->init_hook = alc256_init; + break; + case 0x10ec0236: + case 0x10ec0256: +diff --git a/sound/pci/rme9652/hdspm.c b/sound/pci/rme9652/hdspm.c +index f20d42714e4d..343f533906ba 100644 +--- a/sound/pci/rme9652/hdspm.c ++++ b/sound/pci/rme9652/hdspm.c +@@ -137,6 +137,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -5698,40 +5699,43 @@ static int snd_hdspm_channel_info(struct snd_pcm_substream *substream, + struct snd_pcm_channel_info *info) + { + struct hdspm *hdspm = snd_pcm_substream_chip(substream); ++ unsigned int channel = info->channel; + + if (substream->stream == SNDRV_PCM_STREAM_PLAYBACK) { +- if (snd_BUG_ON(info->channel >= hdspm->max_channels_out)) { ++ if (snd_BUG_ON(channel >= hdspm->max_channels_out)) { + dev_info(hdspm->card->dev, + "snd_hdspm_channel_info: output channel out of range (%d)\n", +- info->channel); ++ channel); + return -EINVAL; + } + +- if (hdspm->channel_map_out[info->channel] < 0) { ++ channel = array_index_nospec(channel, hdspm->max_channels_out); ++ if (hdspm->channel_map_out[channel] < 0) { + dev_info(hdspm->card->dev, + "snd_hdspm_channel_info: output channel %d mapped out\n", +- info->channel); ++ channel); + return -EINVAL; + } + +- info->offset = hdspm->channel_map_out[info->channel] * ++ info->offset = hdspm->channel_map_out[channel] * + HDSPM_CHANNEL_BUFFER_BYTES; + } else { +- if (snd_BUG_ON(info->channel >= hdspm->max_channels_in)) { ++ if (snd_BUG_ON(channel >= hdspm->max_channels_in)) { + dev_info(hdspm->card->dev, + "snd_hdspm_channel_info: input channel out of range (%d)\n", +- info->channel); ++ channel); + return -EINVAL; + } + +- if (hdspm->channel_map_in[info->channel] < 0) { ++ channel = array_index_nospec(channel, hdspm->max_channels_in); ++ if (hdspm->channel_map_in[channel] < 0) { + dev_info(hdspm->card->dev, + "snd_hdspm_channel_info: input channel %d mapped out\n", +- info->channel); ++ channel); + return -EINVAL; + } + +- info->offset = hdspm->channel_map_in[info->channel] * ++ info->offset = hdspm->channel_map_in[channel] * + HDSPM_CHANNEL_BUFFER_BYTES; + } + +diff --git a/sound/pci/rme9652/rme9652.c b/sound/pci/rme9652/rme9652.c +index df648b1d9217..edd765e22377 100644 +--- a/sound/pci/rme9652/rme9652.c ++++ b/sound/pci/rme9652/rme9652.c +@@ -26,6 +26,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -2071,9 +2072,10 @@ static int snd_rme9652_channel_info(struct snd_pcm_substream *substream, + if (snd_BUG_ON(info->channel >= RME9652_NCHANNELS)) + return -EINVAL; + +- if ((chn = rme9652->channel_map[info->channel]) < 0) { ++ chn = rme9652->channel_map[array_index_nospec(info->channel, ++ RME9652_NCHANNELS)]; ++ if (chn < 0) + return -EINVAL; +- } + + info->offset = chn * RME9652_CHANNEL_BUFFER_BYTES; + info->first = 0; +diff --git a/sound/soc/fsl/fsl_esai.c b/sound/soc/fsl/fsl_esai.c +index cef79a1a620b..81268760b7a9 100644 +--- a/sound/soc/fsl/fsl_esai.c ++++ b/sound/soc/fsl/fsl_esai.c +@@ -144,6 +144,13 @@ static int fsl_esai_divisor_cal(struct snd_soc_dai *dai, bool tx, u32 ratio, + + psr = ratio <= 256 * maxfp ? ESAI_xCCR_xPSR_BYPASS : ESAI_xCCR_xPSR_DIV8; + ++ /* Do not loop-search if PM (1 ~ 256) alone can serve the ratio */ ++ if (ratio <= 256) { ++ pm = ratio; ++ fp = 1; ++ goto out; ++ } ++ + /* Set the max fluctuation -- 0.1% of the max devisor */ + savesub = (psr ? 1 : 8) * 256 * maxfp / 1000; + +diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c +index 9038b2e7df73..eaa03acd4686 100644 +--- a/sound/usb/mixer_maps.c ++++ b/sound/usb/mixer_maps.c +@@ -353,8 +353,11 @@ static struct usbmix_name_map bose_companion5_map[] = { + /* + * Dell usb dock with ALC4020 codec had a firmware problem where it got + * screwed up when zero volume is passed; just skip it as a workaround ++ * ++ * Also the extension unit gives an access error, so skip it as well. + */ + static const struct usbmix_name_map dell_alc4020_map[] = { ++ { 4, NULL }, /* extension unit */ + { 16, NULL }, + { 19, NULL }, + { 0 } +diff --git a/tools/lib/str_error_r.c b/tools/lib/str_error_r.c +index d6d65537b0d9..6aad8308a0ac 100644 +--- a/tools/lib/str_error_r.c ++++ b/tools/lib/str_error_r.c +@@ -22,6 +22,6 @@ char *str_error_r(int errnum, char *buf, size_t buflen) + { + int err = strerror_r(errnum, buf, buflen); + if (err) +- snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, %p, %zd)=%d", errnum, buf, buflen, err); ++ snprintf(buf, buflen, "INTERNAL ERROR: strerror_r(%d, [buf], %zd)=%d", errnum, buflen, err); + return buf; + } +diff --git a/tools/lib/subcmd/pager.c b/tools/lib/subcmd/pager.c +index 5ba754d17952..9997a8805a82 100644 +--- a/tools/lib/subcmd/pager.c ++++ b/tools/lib/subcmd/pager.c +@@ -30,10 +30,13 @@ static void pager_preexec(void) + * have real input + */ + fd_set in; ++ fd_set exception; + + FD_ZERO(&in); ++ FD_ZERO(&exception); + FD_SET(0, &in); +- select(1, &in, NULL, &in, NULL); ++ FD_SET(0, &exception); ++ select(1, &in, NULL, &exception, NULL); + + setenv("LESS", "FRSX", 0); + } +diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c +index 1366462a3ab2..9bee849db682 100644 +--- a/virt/kvm/arm/arm.c ++++ b/virt/kvm/arm/arm.c +@@ -61,7 +61,7 @@ static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu); + static atomic64_t kvm_vmid_gen = ATOMIC64_INIT(1); + static u32 kvm_next_vmid; + static unsigned int kvm_vmid_bits __read_mostly; +-static DEFINE_SPINLOCK(kvm_vmid_lock); ++static DEFINE_RWLOCK(kvm_vmid_lock); + + static bool vgic_present; + +@@ -462,11 +462,16 @@ static void update_vttbr(struct kvm *kvm) + { + phys_addr_t pgd_phys; + u64 vmid; ++ bool new_gen; + +- if (!need_new_vmid_gen(kvm)) ++ read_lock(&kvm_vmid_lock); ++ new_gen = need_new_vmid_gen(kvm); ++ read_unlock(&kvm_vmid_lock); ++ ++ if (!new_gen) + return; + +- spin_lock(&kvm_vmid_lock); ++ write_lock(&kvm_vmid_lock); + + /* + * We need to re-check the vmid_gen here to ensure that if another vcpu +@@ -474,7 +479,7 @@ static void update_vttbr(struct kvm *kvm) + * use the same vmid. + */ + if (!need_new_vmid_gen(kvm)) { +- spin_unlock(&kvm_vmid_lock); ++ write_unlock(&kvm_vmid_lock); + return; + } + +@@ -508,7 +513,7 @@ static void update_vttbr(struct kvm *kvm) + vmid = ((u64)(kvm->arch.vmid) << VTTBR_VMID_SHIFT) & VTTBR_VMID_MASK(kvm_vmid_bits); + kvm->arch.vttbr = pgd_phys | vmid; + +- spin_unlock(&kvm_vmid_lock); ++ write_unlock(&kvm_vmid_lock); + } + + static int kvm_vcpu_first_run_init(struct kvm_vcpu *vcpu) +diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c +index 6919352cbf15..c4762bef13c6 100644 +--- a/virt/kvm/arm/psci.c ++++ b/virt/kvm/arm/psci.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -427,3 +428,62 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) + smccc_set_retval(vcpu, val, 0, 0, 0); + return 1; + } ++ ++int kvm_arm_get_fw_num_regs(struct kvm_vcpu *vcpu) ++{ ++ return 1; /* PSCI version */ ++} ++ ++int kvm_arm_copy_fw_reg_indices(struct kvm_vcpu *vcpu, u64 __user *uindices) ++{ ++ if (put_user(KVM_REG_ARM_PSCI_VERSION, uindices)) ++ return -EFAULT; ++ ++ return 0; ++} ++ ++int kvm_arm_get_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) ++{ ++ if (reg->id == KVM_REG_ARM_PSCI_VERSION) { ++ void __user *uaddr = (void __user *)(long)reg->addr; ++ u64 val; ++ ++ val = kvm_psci_version(vcpu, vcpu->kvm); ++ if (copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id))) ++ return -EFAULT; ++ ++ return 0; ++ } ++ ++ return -EINVAL; ++} ++ ++int kvm_arm_set_fw_reg(struct kvm_vcpu *vcpu, const struct kvm_one_reg *reg) ++{ ++ if (reg->id == KVM_REG_ARM_PSCI_VERSION) { ++ void __user *uaddr = (void __user *)(long)reg->addr; ++ bool wants_02; ++ u64 val; ++ ++ if (copy_from_user(&val, uaddr, KVM_REG_SIZE(reg->id))) ++ return -EFAULT; ++ ++ wants_02 = test_bit(KVM_ARM_VCPU_PSCI_0_2, vcpu->arch.features); ++ ++ switch (val) { ++ case KVM_ARM_PSCI_0_1: ++ if (wants_02) ++ return -EINVAL; ++ vcpu->kvm->arch.psci_version = val; ++ return 0; ++ case KVM_ARM_PSCI_0_2: ++ case KVM_ARM_PSCI_1_0: ++ if (!wants_02) ++ return -EINVAL; ++ vcpu->kvm->arch.psci_version = val; ++ return 0; ++ } ++ } ++ ++ return -EINVAL; ++} diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.131-132.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.39-40.patch similarity index 52% rename from patch/kernel/mvebu64-default/04-patch-4.4.131-132.patch rename to patch/kernel/mvebu64-default/0004-patch-4.14.39-40.patch index c2f7c0270f03..f0610e0a5696 100644 --- a/patch/kernel/mvebu64-default/04-patch-4.4.131-132.patch +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.39-40.patch @@ -1,210 +1,156 @@ diff --git a/Makefile b/Makefile -index 6ec65396a56d..ace4a655548a 100644 +index 248b99283f71..6eede39f898a 100644 --- a/Makefile +++ b/Makefile -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 131 -+SUBLEVEL = 132 + PATCHLEVEL = 14 +-SUBLEVEL = 39 ++SUBLEVEL = 40 EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index b011140e6b06..5ddb1debba95 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -118,8 +118,8 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { - - /* upper facilities limit for kvm */ - unsigned long kvm_s390_fac_list_mask[] = { -- 0xffe6fffbfcfdfc40UL, -- 0x005e800000000000UL, -+ 0xffe6ffffffffffffUL, -+ 0x005effffffffffffUL, - }; - - unsigned long kvm_s390_fac_list_mask_size(void) -diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c -index b52a8d08ab36..fbf2edc3eb35 100644 ---- a/arch/x86/kernel/cpu/perf_event.c -+++ b/arch/x86/kernel/cpu/perf_event.c -@@ -25,6 +25,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -297,17 +298,20 @@ set_ext_hw_attr(struct hw_perf_event *hwc, struct perf_event *event) - - config = attr->config; - -- cache_type = (config >> 0) & 0xff; -+ cache_type = (config >> 0) & 0xff; - if (cache_type >= PERF_COUNT_HW_CACHE_MAX) - return -EINVAL; -+ cache_type = array_index_nospec(cache_type, PERF_COUNT_HW_CACHE_MAX); - - cache_op = (config >> 8) & 0xff; - if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX) - return -EINVAL; -+ cache_op = array_index_nospec(cache_op, PERF_COUNT_HW_CACHE_OP_MAX); + NAME = Petit Gorille + +diff --git a/drivers/acpi/button.c b/drivers/acpi/button.c +index ef1856b15488..9e80802e3603 100644 +--- a/drivers/acpi/button.c ++++ b/drivers/acpi/button.c +@@ -595,4 +595,26 @@ module_param_call(lid_init_state, + NULL, 0644); + MODULE_PARM_DESC(lid_init_state, "Behavior for reporting LID initial state"); + +-module_acpi_driver(acpi_button_driver); ++static int acpi_button_register_driver(struct acpi_driver *driver) ++{ ++ /* ++ * Modules such as nouveau.ko and i915.ko have a link time dependency ++ * on acpi_lid_open(), and would therefore not be loadable on ACPI ++ * capable kernels booted in non-ACPI mode if the return value of ++ * acpi_bus_register_driver() is returned from here with ACPI disabled ++ * when this driver is built as a module. ++ */ ++ if (acpi_disabled) ++ return 0; ++ ++ return acpi_bus_register_driver(driver); ++} ++ ++static void acpi_button_unregister_driver(struct acpi_driver *driver) ++{ ++ if (!acpi_disabled) ++ acpi_bus_unregister_driver(driver); ++} ++ ++module_driver(acpi_button_driver, acpi_button_register_driver, ++ acpi_button_unregister_driver); +diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c +index ceae25112acd..57e1b203cf36 100644 +--- a/drivers/crypto/talitos.c ++++ b/drivers/crypto/talitos.c +@@ -1116,10 +1116,10 @@ static int sg_to_link_tbl_offset(struct scatterlist *sg, int sg_count, + return count; + } - cache_result = (config >> 16) & 0xff; - if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX) - return -EINVAL; -+ cache_result = array_index_nospec(cache_result, PERF_COUNT_HW_CACHE_RESULT_MAX); +-int talitos_sg_map(struct device *dev, struct scatterlist *src, +- unsigned int len, struct talitos_edesc *edesc, +- struct talitos_ptr *ptr, +- int sg_count, unsigned int offset, int tbl_off) ++static int talitos_sg_map_ext(struct device *dev, struct scatterlist *src, ++ unsigned int len, struct talitos_edesc *edesc, ++ struct talitos_ptr *ptr, int sg_count, ++ unsigned int offset, int tbl_off, int elen) + { + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); +@@ -1130,7 +1130,7 @@ int talitos_sg_map(struct device *dev, struct scatterlist *src, + } - val = hw_cache_event_ids[cache_type][cache_op][cache_result]; + to_talitos_ptr_len(ptr, len, is_sec1); +- to_talitos_ptr_ext_set(ptr, 0, is_sec1); ++ to_talitos_ptr_ext_set(ptr, elen, is_sec1); -@@ -404,6 +408,8 @@ int x86_setup_perfctr(struct perf_event *event) - if (attr->config >= x86_pmu.max_events) - return -EINVAL; + if (sg_count == 1) { + to_talitos_ptr(ptr, sg_dma_address(src) + offset, is_sec1); +@@ -1140,7 +1140,7 @@ int talitos_sg_map(struct device *dev, struct scatterlist *src, + to_talitos_ptr(ptr, edesc->dma_link_tbl + offset, is_sec1); + return sg_count; + } +- sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len, ++ sg_count = sg_to_link_tbl_offset(src, sg_count, offset, len + elen, + &edesc->link_tbl[tbl_off]); + if (sg_count == 1) { + /* Only one segment now, so no link tbl needed*/ +@@ -1154,6 +1154,15 @@ int talitos_sg_map(struct device *dev, struct scatterlist *src, + return sg_count; + } -+ attr->config = array_index_nospec((unsigned long)attr->config, x86_pmu.max_events); ++static int talitos_sg_map(struct device *dev, struct scatterlist *src, ++ unsigned int len, struct talitos_edesc *edesc, ++ struct talitos_ptr *ptr, int sg_count, ++ unsigned int offset, int tbl_off) ++{ ++ return talitos_sg_map_ext(dev, src, len, edesc, ptr, sg_count, offset, ++ tbl_off, 0); ++} + - /* - * The generic map: + /* + * fill in and submit ipsec_esp descriptor + */ +@@ -1171,7 +1180,7 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + unsigned int ivsize = crypto_aead_ivsize(aead); + int tbl_off = 0; + int sg_count, ret; +- int sg_link_tbl_len; ++ int elen = 0; + bool sync_needed = false; + struct talitos_private *priv = dev_get_drvdata(dev); + bool is_sec1 = has_ftr_sec1(priv); +@@ -1225,20 +1234,12 @@ static int ipsec_esp(struct talitos_edesc *edesc, struct aead_request *areq, + * extent is bytes of HMAC postpended to ciphertext, + * typically 12 for ipsec */ -diff --git a/arch/x86/kernel/cpu/perf_event_intel_cstate.c b/arch/x86/kernel/cpu/perf_event_intel_cstate.c -index 75a38b5a2e26..5b8c90935270 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_cstate.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_cstate.c -@@ -88,6 +88,7 @@ - #include - #include - #include -+#include - #include - #include "perf_event.h" - -@@ -409,6 +410,7 @@ static int cstate_pmu_event_init(struct perf_event *event) - } else if (event->pmu == &cstate_pkg_pmu) { - if (cfg >= PERF_CSTATE_PKG_EVENT_MAX) - return -EINVAL; -+ cfg = array_index_nospec((unsigned long)cfg, PERF_CSTATE_PKG_EVENT_MAX); - if (!pkg_msr[cfg].attr) - return -EINVAL; - event->hw.event_base = pkg_msr[cfg].msr; -diff --git a/arch/x86/kernel/cpu/perf_event_msr.c b/arch/x86/kernel/cpu/perf_event_msr.c -index ec863b9a9f78..067427384a63 100644 ---- a/arch/x86/kernel/cpu/perf_event_msr.c -+++ b/arch/x86/kernel/cpu/perf_event_msr.c -@@ -1,4 +1,5 @@ - #include -+#include - - enum perf_msr_id { - PERF_MSR_TSC = 0, -@@ -115,9 +116,6 @@ static int msr_event_init(struct perf_event *event) - if (event->attr.type != event->pmu->type) - return -ENOENT; - -- if (cfg >= PERF_MSR_EVENT_MAX) -- return -EINVAL; +- to_talitos_ptr_len(&desc->ptr[4], cryptlen, is_sec1); +- to_talitos_ptr_ext_set(&desc->ptr[4], 0, is_sec1); - - /* unsupported modes and filters */ - if (event->attr.exclude_user || - event->attr.exclude_kernel || -@@ -128,6 +126,11 @@ static int msr_event_init(struct perf_event *event) - event->attr.sample_period) /* no sampling */ - return -EINVAL; - -+ if (cfg >= PERF_MSR_EVENT_MAX) -+ return -EINVAL; -+ -+ cfg = array_index_nospec((unsigned long)cfg, PERF_MSR_EVENT_MAX); -+ - if (!msr[cfg].attr) - return -EINVAL; - -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index ca50eeb13097..b5953f1d1a18 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -157,16 +157,16 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - void *private; - int err; - -- /* If caller uses non-allowed flag, return error. */ -- if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) -- return -EINVAL; +- sg_link_tbl_len = cryptlen; - - if (sock->state == SS_CONNECTED) - return -EINVAL; +- if (desc->hdr & DESC_HDR_TYPE_IPSEC_ESP) { +- to_talitos_ptr_ext_set(&desc->ptr[4], authsize, is_sec1); +- +- if (edesc->desc.hdr & DESC_HDR_MODE1_MDEU_CICV) +- sg_link_tbl_len += authsize; +- } ++ if ((desc->hdr & DESC_HDR_TYPE_IPSEC_ESP) && ++ (desc->hdr & DESC_HDR_MODE1_MDEU_CICV)) ++ elen = authsize; + +- ret = talitos_sg_map(dev, areq->src, sg_link_tbl_len, edesc, +- &desc->ptr[4], sg_count, areq->assoclen, tbl_off); ++ ret = talitos_sg_map_ext(dev, areq->src, cryptlen, edesc, &desc->ptr[4], ++ sg_count, areq->assoclen, tbl_off, elen); + + if (ret > 1) { + tbl_off += ret; +diff --git a/drivers/gpu/drm/bridge/dumb-vga-dac.c b/drivers/gpu/drm/bridge/dumb-vga-dac.c +index de5e7dee7ad6..2e6c61d9b8ea 100644 +--- a/drivers/gpu/drm/bridge/dumb-vga-dac.c ++++ b/drivers/gpu/drm/bridge/dumb-vga-dac.c +@@ -55,7 +55,9 @@ static int dumb_vga_get_modes(struct drm_connector *connector) + } - if (addr_len != sizeof(*sa)) - return -EINVAL; + drm_mode_connector_update_edid_property(connector, edid); +- return drm_add_edid_modes(connector, edid); ++ ret = drm_add_edid_modes(connector, edid); ++ kfree(edid); ++ return ret; -+ /* If caller uses non-allowed flag, return error. */ -+ if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) -+ return -EINVAL; -+ - sa->salg_type[sizeof(sa->salg_type) - 1] = 0; - sa->salg_name[sizeof(sa->salg_name) - 1] = 0; - -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index 2d677ba46d77..60d6db82ce5a 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4243,6 +4243,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - ATA_HORKAGE_ZERO_AFTER_TRIM | - ATA_HORKAGE_NOLPM, }, - -+ /* Sandisk devices which are known to not handle LPM well */ -+ { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, }, -+ - /* devices that don't properly handle queued TRIM commands */ - { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | - ATA_HORKAGE_ZERO_AFTER_TRIM, }, -diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c -index cecfb943762f..6eab52b92e01 100644 ---- a/drivers/atm/zatm.c -+++ b/drivers/atm/zatm.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -1456,6 +1457,8 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg) - return -EFAULT; - if (pool < 0 || pool > ZATM_LAST_POOL) - return -EINVAL; -+ pool = array_index_nospec(pool, -+ ZATM_LAST_POOL + 1); - spin_lock_irqsave(&zatm_dev->lock, flags); - info = zatm_dev->pool_info[pool]; - if (cmd == ZATM_GETPOOLZ) { -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 7fca7cfd5b09..54cef3dc0beb 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -216,6 +216,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, -@@ -246,7 +247,6 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, - - /* QCA ROME chipset */ -- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, - { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, - { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, - { USB_DEVICE(0x0cf3, 0xe360), .driver_info = BTUSB_QCA_ROME }, + fallback: + /* diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -index 098e562bd579..9b97f70fbb3d 100644 +index 9e010f8c36a1..11f1c30ead54 100644 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_kms.c -@@ -1991,6 +1991,7 @@ void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, +@@ -2612,6 +2612,7 @@ void vmw_kms_helper_resource_finish(struct vmw_validation_ctx *ctx, vmw_kms_helper_buffer_finish(res->dev_priv, NULL, ctx->buf, out_fence, NULL); @@ -213,10 +159,10 @@ index 098e562bd579..9b97f70fbb3d 100644 mutex_unlock(&res->dev_priv->cmdbuf_mutex); } diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c -index ea3bc9bb1b7a..2b9c00faca7d 100644 +index 0698d92e2656..c65f0e8ecbd6 100644 --- a/drivers/infiniband/core/ucma.c +++ b/drivers/infiniband/core/ucma.c -@@ -675,7 +675,7 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file, +@@ -678,7 +678,7 @@ static ssize_t ucma_resolve_ip(struct ucma_file *file, if (copy_from_user(&cmd, inbuf, sizeof(cmd))) return -EFAULT; @@ -225,11 +171,522 @@ index ea3bc9bb1b7a..2b9c00faca7d 100644 !rdma_addr_size_in6(&cmd.dst_addr)) return -EINVAL; +diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c +index 73feeeeb4283..6b15508ce17e 100644 +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -330,7 +330,7 @@ static void advance_oldest_read(struct t4_wq *wq) + * Deal with out-of-order and/or completions that complete + * prior unsignalled WRs. + */ +-void c4iw_flush_hw_cq(struct c4iw_cq *chp) ++void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp) + { + struct t4_cqe *hw_cqe, *swcqe, read_cqe; + struct c4iw_qp *qhp; +@@ -354,6 +354,13 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp) + if (qhp == NULL) + goto next_cqe; + ++ if (flush_qhp != qhp) { ++ spin_lock(&qhp->lock); ++ ++ if (qhp->wq.flushed == 1) ++ goto next_cqe; ++ } ++ + if (CQE_OPCODE(hw_cqe) == FW_RI_TERMINATE) + goto next_cqe; + +@@ -405,6 +412,8 @@ void c4iw_flush_hw_cq(struct c4iw_cq *chp) + next_cqe: + t4_hwcq_consume(&chp->cq); + ret = t4_next_hw_cqe(&chp->cq, &hw_cqe); ++ if (qhp && flush_qhp != qhp) ++ spin_unlock(&qhp->lock); + } + } + +diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c +index fc886f81b885..99f232e3ea93 100644 +--- a/drivers/infiniband/hw/cxgb4/device.c ++++ b/drivers/infiniband/hw/cxgb4/device.c +@@ -884,6 +884,11 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev) + + rdev->status_page->db_off = 0; + ++ init_completion(&rdev->rqt_compl); ++ init_completion(&rdev->pbl_compl); ++ kref_init(&rdev->rqt_kref); ++ kref_init(&rdev->pbl_kref); ++ + return 0; + err_free_status_page_and_wr_log: + if (c4iw_wr_log && rdev->wr_log) +@@ -902,13 +907,15 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev) + + static void c4iw_rdev_close(struct c4iw_rdev *rdev) + { +- destroy_workqueue(rdev->free_workq); + kfree(rdev->wr_log); + c4iw_release_dev_ucontext(rdev, &rdev->uctx); + free_page((unsigned long)rdev->status_page); + c4iw_pblpool_destroy(rdev); + c4iw_rqtpool_destroy(rdev); ++ wait_for_completion(&rdev->pbl_compl); ++ wait_for_completion(&rdev->rqt_compl); + c4iw_ocqp_pool_destroy(rdev); ++ destroy_workqueue(rdev->free_workq); + c4iw_destroy_resource(&rdev->resource); + } + +diff --git a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h +index 20c481115a99..f52779871d04 100644 +--- a/drivers/infiniband/hw/cxgb4/iw_cxgb4.h ++++ b/drivers/infiniband/hw/cxgb4/iw_cxgb4.h +@@ -185,6 +185,10 @@ struct c4iw_rdev { + struct wr_log_entry *wr_log; + int wr_log_size; + struct workqueue_struct *free_workq; ++ struct completion rqt_compl; ++ struct completion pbl_compl; ++ struct kref rqt_kref; ++ struct kref pbl_kref; + }; + + static inline int c4iw_fatal_error(struct c4iw_rdev *rdev) +@@ -989,7 +993,7 @@ void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size); + u32 c4iw_ocqp_pool_alloc(struct c4iw_rdev *rdev, int size); + void c4iw_ocqp_pool_free(struct c4iw_rdev *rdev, u32 addr, int size); + int c4iw_ofld_send(struct c4iw_rdev *rdev, struct sk_buff *skb); +-void c4iw_flush_hw_cq(struct c4iw_cq *chp); ++void c4iw_flush_hw_cq(struct c4iw_cq *chp, struct c4iw_qp *flush_qhp); + void c4iw_count_rcqes(struct t4_cq *cq, struct t4_wq *wq, int *count); + int c4iw_ep_disconnect(struct c4iw_ep *ep, int abrupt, gfp_t gfp); + int c4iw_flush_rq(struct t4_wq *wq, struct t4_cq *cq, int count); +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index f311ea73c806..a8a8f65a1e51 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -1349,12 +1349,12 @@ static void __flush_qp(struct c4iw_qp *qhp, struct c4iw_cq *rchp, + qhp->wq.flushed = 1; + t4_set_wq_in_error(&qhp->wq); + +- c4iw_flush_hw_cq(rchp); ++ c4iw_flush_hw_cq(rchp, qhp); + c4iw_count_rcqes(&rchp->cq, &qhp->wq, &count); + rq_flushed = c4iw_flush_rq(&qhp->wq, &rchp->cq, count); + + if (schp != rchp) +- c4iw_flush_hw_cq(schp); ++ c4iw_flush_hw_cq(schp, qhp); + sq_flushed = c4iw_flush_sq(qhp); + + spin_unlock(&qhp->lock); +diff --git a/drivers/infiniband/hw/cxgb4/resource.c b/drivers/infiniband/hw/cxgb4/resource.c +index 8ff0cbe5cb16..755a77a9178b 100644 +--- a/drivers/infiniband/hw/cxgb4/resource.c ++++ b/drivers/infiniband/hw/cxgb4/resource.c +@@ -260,12 +260,22 @@ u32 c4iw_pblpool_alloc(struct c4iw_rdev *rdev, int size) + rdev->stats.pbl.cur += roundup(size, 1 << MIN_PBL_SHIFT); + if (rdev->stats.pbl.cur > rdev->stats.pbl.max) + rdev->stats.pbl.max = rdev->stats.pbl.cur; ++ kref_get(&rdev->pbl_kref); + } else + rdev->stats.pbl.fail++; + mutex_unlock(&rdev->stats.lock); + return (u32)addr; + } + ++static void destroy_pblpool(struct kref *kref) ++{ ++ struct c4iw_rdev *rdev; ++ ++ rdev = container_of(kref, struct c4iw_rdev, pbl_kref); ++ gen_pool_destroy(rdev->pbl_pool); ++ complete(&rdev->pbl_compl); ++} ++ + void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size) + { + pr_debug("%s addr 0x%x size %d\n", __func__, addr, size); +@@ -273,6 +283,7 @@ void c4iw_pblpool_free(struct c4iw_rdev *rdev, u32 addr, int size) + rdev->stats.pbl.cur -= roundup(size, 1 << MIN_PBL_SHIFT); + mutex_unlock(&rdev->stats.lock); + gen_pool_free(rdev->pbl_pool, (unsigned long)addr, size); ++ kref_put(&rdev->pbl_kref, destroy_pblpool); + } + + int c4iw_pblpool_create(struct c4iw_rdev *rdev) +@@ -310,7 +321,7 @@ int c4iw_pblpool_create(struct c4iw_rdev *rdev) + + void c4iw_pblpool_destroy(struct c4iw_rdev *rdev) + { +- gen_pool_destroy(rdev->pbl_pool); ++ kref_put(&rdev->pbl_kref, destroy_pblpool); + } + + /* +@@ -331,12 +342,22 @@ u32 c4iw_rqtpool_alloc(struct c4iw_rdev *rdev, int size) + rdev->stats.rqt.cur += roundup(size << 6, 1 << MIN_RQT_SHIFT); + if (rdev->stats.rqt.cur > rdev->stats.rqt.max) + rdev->stats.rqt.max = rdev->stats.rqt.cur; ++ kref_get(&rdev->rqt_kref); + } else + rdev->stats.rqt.fail++; + mutex_unlock(&rdev->stats.lock); + return (u32)addr; + } + ++static void destroy_rqtpool(struct kref *kref) ++{ ++ struct c4iw_rdev *rdev; ++ ++ rdev = container_of(kref, struct c4iw_rdev, rqt_kref); ++ gen_pool_destroy(rdev->rqt_pool); ++ complete(&rdev->rqt_compl); ++} ++ + void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size) + { + pr_debug("%s addr 0x%x size %d\n", __func__, addr, size << 6); +@@ -344,6 +365,7 @@ void c4iw_rqtpool_free(struct c4iw_rdev *rdev, u32 addr, int size) + rdev->stats.rqt.cur -= roundup(size << 6, 1 << MIN_RQT_SHIFT); + mutex_unlock(&rdev->stats.lock); + gen_pool_free(rdev->rqt_pool, (unsigned long)addr, size << 6); ++ kref_put(&rdev->rqt_kref, destroy_rqtpool); + } + + int c4iw_rqtpool_create(struct c4iw_rdev *rdev) +@@ -380,7 +402,7 @@ int c4iw_rqtpool_create(struct c4iw_rdev *rdev) + + void c4iw_rqtpool_destroy(struct c4iw_rdev *rdev) + { +- gen_pool_destroy(rdev->rqt_pool); ++ kref_put(&rdev->rqt_kref, destroy_rqtpool); + } + + /* +diff --git a/drivers/infiniband/hw/hfi1/driver.c b/drivers/infiniband/hw/hfi1/driver.c +index 7372cc00cb2d..72c836b826ca 100644 +--- a/drivers/infiniband/hw/hfi1/driver.c ++++ b/drivers/infiniband/hw/hfi1/driver.c +@@ -437,31 +437,43 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt, + bool do_cnp) + { + struct hfi1_ibport *ibp = to_iport(qp->ibqp.device, qp->port_num); ++ struct hfi1_pportdata *ppd = ppd_from_ibp(ibp); + struct ib_other_headers *ohdr = pkt->ohdr; + struct ib_grh *grh = pkt->grh; + u32 rqpn = 0, bth1; +- u16 pkey, rlid, dlid = ib_get_dlid(pkt->hdr); ++ u16 pkey; ++ u32 rlid, slid, dlid = 0; + u8 hdr_type, sc, svc_type; + bool is_mcast = false; + ++ /* can be called from prescan */ + if (pkt->etype == RHF_RCV_TYPE_BYPASS) { + is_mcast = hfi1_is_16B_mcast(dlid); + pkey = hfi1_16B_get_pkey(pkt->hdr); + sc = hfi1_16B_get_sc(pkt->hdr); ++ dlid = hfi1_16B_get_dlid(pkt->hdr); ++ slid = hfi1_16B_get_slid(pkt->hdr); + hdr_type = HFI1_PKT_TYPE_16B; + } else { + is_mcast = (dlid > be16_to_cpu(IB_MULTICAST_LID_BASE)) && + (dlid != be16_to_cpu(IB_LID_PERMISSIVE)); + pkey = ib_bth_get_pkey(ohdr); + sc = hfi1_9B_get_sc5(pkt->hdr, pkt->rhf); ++ dlid = ib_get_dlid(pkt->hdr); ++ slid = ib_get_slid(pkt->hdr); + hdr_type = HFI1_PKT_TYPE_9B; + } + + switch (qp->ibqp.qp_type) { ++ case IB_QPT_UD: ++ dlid = ppd->lid; ++ rlid = slid; ++ rqpn = ib_get_sqpn(pkt->ohdr); ++ svc_type = IB_CC_SVCTYPE_UD; ++ break; + case IB_QPT_SMI: + case IB_QPT_GSI: +- case IB_QPT_UD: +- rlid = ib_get_slid(pkt->hdr); ++ rlid = slid; + rqpn = ib_get_sqpn(pkt->ohdr); + svc_type = IB_CC_SVCTYPE_UD; + break; +@@ -486,7 +498,6 @@ void hfi1_process_ecn_slowpath(struct rvt_qp *qp, struct hfi1_packet *pkt, + dlid, rlid, sc, grh); + + if (!is_mcast && (bth1 & IB_BECN_SMASK)) { +- struct hfi1_pportdata *ppd = ppd_from_ibp(ibp); + u32 lqpn = bth1 & RVT_QPN_MASK; + u8 sl = ibp->sc_to_sl[sc]; + +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index dc9c951ef946..ccc7b9b8637e 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1523,13 +1523,13 @@ void set_link_ipg(struct hfi1_pportdata *ppd); + void process_becn(struct hfi1_pportdata *ppd, u8 sl, u32 rlid, u32 lqpn, + u32 rqpn, u8 svc_type); + void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn, +- u32 pkey, u32 slid, u32 dlid, u8 sc5, ++ u16 pkey, u32 slid, u32 dlid, u8 sc5, + const struct ib_grh *old_grh); + void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp, +- u32 remote_qpn, u32 pkey, u32 slid, u32 dlid, ++ u32 remote_qpn, u16 pkey, u32 slid, u32 dlid, + u8 sc5, const struct ib_grh *old_grh); + typedef void (*hfi1_handle_cnp)(struct hfi1_ibport *ibp, struct rvt_qp *qp, +- u32 remote_qpn, u32 pkey, u32 slid, u32 dlid, ++ u32 remote_qpn, u16 pkey, u32 slid, u32 dlid, + u8 sc5, const struct ib_grh *old_grh); + + /* We support only two types - 9B and 16B for now */ +@@ -2431,7 +2431,7 @@ static inline void hfi1_make_16b_hdr(struct hfi1_16b_header *hdr, + ((slid >> OPA_16B_SLID_SHIFT) << OPA_16B_SLID_HIGH_SHIFT); + lrh2 = (lrh2 & ~OPA_16B_DLID_MASK) | + ((dlid >> OPA_16B_DLID_SHIFT) << OPA_16B_DLID_HIGH_SHIFT); +- lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | (pkey << OPA_16B_PKEY_SHIFT); ++ lrh2 = (lrh2 & ~OPA_16B_PKEY_MASK) | ((u32)pkey << OPA_16B_PKEY_SHIFT); + lrh2 = (lrh2 & ~OPA_16B_L4_MASK) | l4; + + hdr->lrh[0] = lrh0; +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index d4fc8795cdf6..d5c6ff843fc6 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -1234,6 +1234,8 @@ struct hfi1_devdata *hfi1_alloc_devdata(struct pci_dev *pdev, size_t extra) + return ERR_PTR(-ENOMEM); + dd->num_pports = nports; + dd->pport = (struct hfi1_pportdata *)(dd + 1); ++ dd->pcidev = pdev; ++ pci_set_drvdata(pdev, dd); + + INIT_LIST_HEAD(&dd->list); + idr_preload(GFP_KERNEL); +diff --git a/drivers/infiniband/hw/hfi1/pcie.c b/drivers/infiniband/hw/hfi1/pcie.c +index 8c7e7a60b715..51a5416b1da4 100644 +--- a/drivers/infiniband/hw/hfi1/pcie.c ++++ b/drivers/infiniband/hw/hfi1/pcie.c +@@ -163,9 +163,6 @@ int hfi1_pcie_ddinit(struct hfi1_devdata *dd, struct pci_dev *pdev) + resource_size_t addr; + int ret = 0; + +- dd->pcidev = pdev; +- pci_set_drvdata(pdev, dd); +- + addr = pci_resource_start(pdev, 0); + len = pci_resource_len(pdev, 0); + +diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c +index b3291f0fde9a..5866ccc0fc21 100644 +--- a/drivers/infiniband/hw/hfi1/ruc.c ++++ b/drivers/infiniband/hw/hfi1/ruc.c +@@ -745,6 +745,20 @@ static inline void hfi1_make_ruc_bth(struct rvt_qp *qp, + ohdr->bth[2] = cpu_to_be32(bth2); + } + ++/** ++ * hfi1_make_ruc_header_16B - build a 16B header ++ * @qp: the queue pair ++ * @ohdr: a pointer to the destination header memory ++ * @bth0: bth0 passed in from the RC/UC builder ++ * @bth2: bth2 passed in from the RC/UC builder ++ * @middle: non zero implies indicates ahg "could" be used ++ * @ps: the current packet state ++ * ++ * This routine may disarm ahg under these situations: ++ * - packet needs a GRH ++ * - BECN needed ++ * - migration state not IB_MIG_MIGRATED ++ */ + static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp, + struct ib_other_headers *ohdr, + u32 bth0, u32 bth2, int middle, +@@ -789,6 +803,12 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp, + else + middle = 0; + ++ if (qp->s_flags & RVT_S_ECN) { ++ qp->s_flags &= ~RVT_S_ECN; ++ /* we recently received a FECN, so return a BECN */ ++ becn = true; ++ middle = 0; ++ } + if (middle) + build_ahg(qp, bth2); + else +@@ -796,11 +816,6 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp, + + bth0 |= pkey; + bth0 |= extra_bytes << 20; +- if (qp->s_flags & RVT_S_ECN) { +- qp->s_flags &= ~RVT_S_ECN; +- /* we recently received a FECN, so return a BECN */ +- becn = 1; +- } + hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2); + + if (!ppd->lid) +@@ -818,6 +833,20 @@ static inline void hfi1_make_ruc_header_16B(struct rvt_qp *qp, + pkey, becn, 0, l4, priv->s_sc); + } + ++/** ++ * hfi1_make_ruc_header_9B - build a 9B header ++ * @qp: the queue pair ++ * @ohdr: a pointer to the destination header memory ++ * @bth0: bth0 passed in from the RC/UC builder ++ * @bth2: bth2 passed in from the RC/UC builder ++ * @middle: non zero implies indicates ahg "could" be used ++ * @ps: the current packet state ++ * ++ * This routine may disarm ahg under these situations: ++ * - packet needs a GRH ++ * - BECN needed ++ * - migration state not IB_MIG_MIGRATED ++ */ + static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp, + struct ib_other_headers *ohdr, + u32 bth0, u32 bth2, int middle, +@@ -853,6 +882,12 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp, + else + middle = 0; + ++ if (qp->s_flags & RVT_S_ECN) { ++ qp->s_flags &= ~RVT_S_ECN; ++ /* we recently received a FECN, so return a BECN */ ++ bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT); ++ middle = 0; ++ } + if (middle) + build_ahg(qp, bth2); + else +@@ -860,11 +895,6 @@ static inline void hfi1_make_ruc_header_9B(struct rvt_qp *qp, + + bth0 |= pkey; + bth0 |= extra_bytes << 20; +- if (qp->s_flags & RVT_S_ECN) { +- qp->s_flags &= ~RVT_S_ECN; +- /* we recently received a FECN, so return a BECN */ +- bth1 |= (IB_BECN_MASK << IB_BECN_SHIFT); +- } + hfi1_make_ruc_bth(qp, ohdr, bth0, bth1, bth2); + + if (!ppd->lid) +diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c +index 2ba74fdd6f15..38c7d9c456fe 100644 +--- a/drivers/infiniband/hw/hfi1/ud.c ++++ b/drivers/infiniband/hw/hfi1/ud.c +@@ -630,7 +630,7 @@ int hfi1_lookup_pkey_idx(struct hfi1_ibport *ibp, u16 pkey) + } + + void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp, +- u32 remote_qpn, u32 pkey, u32 slid, u32 dlid, ++ u32 remote_qpn, u16 pkey, u32 slid, u32 dlid, + u8 sc5, const struct ib_grh *old_grh) + { + u64 pbc, pbc_flags = 0; +@@ -688,7 +688,7 @@ void return_cnp_16B(struct hfi1_ibport *ibp, struct rvt_qp *qp, + } + + void return_cnp(struct hfi1_ibport *ibp, struct rvt_qp *qp, u32 remote_qpn, +- u32 pkey, u32 slid, u32 dlid, u8 sc5, ++ u16 pkey, u32 slid, u32 dlid, u8 sc5, + const struct ib_grh *old_grh) + { + u64 pbc, pbc_flags = 0; +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 538f1784863a..9866c5d1b99f 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -833,25 +833,28 @@ static int mr_umem_get(struct ib_pd *pd, u64 start, u64 length, + int *order) + { + struct mlx5_ib_dev *dev = to_mdev(pd->device); ++ struct ib_umem *u; + int err; + +- *umem = ib_umem_get(pd->uobject->context, start, length, +- access_flags, 0); +- err = PTR_ERR_OR_ZERO(*umem); ++ *umem = NULL; ++ ++ u = ib_umem_get(pd->uobject->context, start, length, access_flags, 0); ++ err = PTR_ERR_OR_ZERO(u); + if (err) { +- *umem = NULL; +- mlx5_ib_err(dev, "umem get failed (%d)\n", err); ++ mlx5_ib_dbg(dev, "umem get failed (%d)\n", err); + return err; + } + +- mlx5_ib_cont_pages(*umem, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages, ++ mlx5_ib_cont_pages(u, start, MLX5_MKEY_PAGE_SHIFT_MASK, npages, + page_shift, ncont, order); + if (!*npages) { + mlx5_ib_warn(dev, "avoid zero region\n"); +- ib_umem_release(*umem); ++ ib_umem_release(u); + return -EINVAL; + } + ++ *umem = u; ++ + mlx5_ib_dbg(dev, "npages %d, ncont %d, order %d, page_shift %d\n", + *npages, *ncont, *order, *page_shift); + +@@ -1340,13 +1343,12 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, + int access_flags = flags & IB_MR_REREG_ACCESS ? + new_access_flags : + mr->access_flags; +- u64 addr = (flags & IB_MR_REREG_TRANS) ? virt_addr : mr->umem->address; +- u64 len = (flags & IB_MR_REREG_TRANS) ? length : mr->umem->length; + int page_shift = 0; + int upd_flags = 0; + int npages = 0; + int ncont = 0; + int order = 0; ++ u64 addr, len; + int err; + + mlx5_ib_dbg(dev, "start 0x%llx, virt_addr 0x%llx, length 0x%llx, access_flags 0x%x\n", +@@ -1354,6 +1356,17 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, + + atomic_sub(mr->npages, &dev->mdev->priv.reg_pages); + ++ if (!mr->umem) ++ return -EINVAL; ++ ++ if (flags & IB_MR_REREG_TRANS) { ++ addr = virt_addr; ++ len = length; ++ } else { ++ addr = mr->umem->address; ++ len = mr->umem->length; ++ } ++ + if (flags != IB_MR_REREG_PD) { + /* + * Replace umem. This needs to be done whether or not UMR is +@@ -1361,6 +1374,7 @@ int mlx5_ib_rereg_user_mr(struct ib_mr *ib_mr, int flags, u64 start, + */ + flags |= IB_MR_REREG_TRANS; + ib_umem_release(mr->umem); ++ mr->umem = NULL; + err = mr_umem_get(pd, addr, len, access_flags, &mr->umem, + &npages, &page_shift, &ncont, &order); + if (err < 0) { diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c -index cfcfbb6b84d7..c5390f6f94c5 100644 +index 464c78f8cec9..749fe906a5b6 100644 --- a/drivers/infiniband/hw/mlx5/qp.c +++ b/drivers/infiniband/hw/mlx5/qp.c -@@ -231,7 +231,11 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap, +@@ -256,7 +256,11 @@ static int set_rq_size(struct mlx5_ib_dev *dev, struct ib_qp_cap *cap, } else { if (ucmd) { qp->rq.wqe_cnt = ucmd->rq_wqe_count; @@ -241,7 +698,7 @@ index cfcfbb6b84d7..c5390f6f94c5 100644 qp->rq.max_gs = (1 << qp->rq.wqe_shift) / sizeof(struct mlx5_wqe_data_seg) - qp->wq_sig; qp->rq.max_post = qp->rq.wqe_cnt; } else { -@@ -1348,18 +1352,18 @@ enum { +@@ -2195,18 +2199,18 @@ enum { static int ib_rate_to_mlx5(struct mlx5_ib_dev *dev, u8 rate) { @@ -268,7 +725,21 @@ index cfcfbb6b84d7..c5390f6f94c5 100644 + return rate ? rate + MLX5_STAT_RATE_OFFSET : rate; } - static int mlx5_set_path(struct mlx5_ib_dev *dev, const struct ib_ah_attr *ah, + static int modify_raw_packet_eth_prio(struct mlx5_core_dev *dev, +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +index 7774654c2ccb..7a5ed5a5391e 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c +@@ -1447,8 +1447,7 @@ void ipoib_cm_skb_too_long(struct net_device *dev, struct sk_buff *skb, + struct ipoib_dev_priv *priv = ipoib_priv(dev); + int e = skb_queue_empty(&priv->cm.skb_queue); + +- if (skb_dst(skb)) +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + + skb_queue_tail(&priv->cm.skb_queue, skb); + if (e) diff --git a/drivers/input/input-leds.c b/drivers/input/input-leds.c index 766bf2660116..5f04b2d94635 100644 --- a/drivers/input/input-leds.c @@ -300,10 +771,10 @@ index 766bf2660116..5f04b2d94635 100644 dev_name(&dev->dev), input_led_info[led_code].name); diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c -index 2d5794ec338b..88dfe3008cf4 100644 +index 7659bc48f1db..429b694405c7 100644 --- a/drivers/input/touchscreen/atmel_mxt_ts.c +++ b/drivers/input/touchscreen/atmel_mxt_ts.c -@@ -2522,6 +2522,15 @@ static const struct dmi_system_id mxt_dmi_table[] = { +@@ -3030,6 +3030,15 @@ static const struct dmi_system_id mxt_dmi_table[] = { }, .driver_data = samus_platform_data, }, @@ -319,494 +790,294 @@ index 2d5794ec338b..88dfe3008cf4 100644 { /* Other Google Chromebooks */ .ident = "Chromebook", -diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c -index e2a239c1f40b..40a335c6b792 100644 ---- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c -+++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c -@@ -1032,14 +1032,87 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, - /* Loop over status bytes, accumulating ECC status. */ - status = auxiliary_virt + nfc_geo->auxiliary_status_offset; - -+ read_page_swap_end(this, buf, nfc_geo->payload_size, -+ this->payload_virt, this->payload_phys, -+ nfc_geo->payload_size, -+ payload_virt, payload_phys); -+ - for (i = 0; i < nfc_geo->ecc_chunk_count; i++, status++) { - if ((*status == STATUS_GOOD) || (*status == STATUS_ERASED)) - continue; - - if (*status == STATUS_UNCORRECTABLE) { -+ int eccbits = nfc_geo->ecc_strength * nfc_geo->gf_len; -+ u8 *eccbuf = this->raw_buffer; -+ int offset, bitoffset; -+ int eccbytes; -+ int flips; -+ -+ /* Read ECC bytes into our internal raw_buffer */ -+ offset = nfc_geo->metadata_size * 8; -+ offset += ((8 * nfc_geo->ecc_chunk_size) + eccbits) * (i + 1); -+ offset -= eccbits; -+ bitoffset = offset % 8; -+ eccbytes = DIV_ROUND_UP(offset + eccbits, 8); -+ offset /= 8; -+ eccbytes -= offset; -+ chip->cmdfunc(mtd, NAND_CMD_RNDOUT, offset, -1); -+ chip->read_buf(mtd, eccbuf, eccbytes); -+ -+ /* -+ * ECC data are not byte aligned and we may have -+ * in-band data in the first and last byte of -+ * eccbuf. Set non-eccbits to one so that -+ * nand_check_erased_ecc_chunk() does not count them -+ * as bitflips. -+ */ -+ if (bitoffset) -+ eccbuf[0] |= GENMASK(bitoffset - 1, 0); +diff --git a/drivers/irqchip/qcom-irq-combiner.c b/drivers/irqchip/qcom-irq-combiner.c +index f31265937439..7f0c0be322e0 100644 +--- a/drivers/irqchip/qcom-irq-combiner.c ++++ b/drivers/irqchip/qcom-irq-combiner.c +@@ -1,4 +1,4 @@ +-/* Copyright (c) 2015-2016, The Linux Foundation. All rights reserved. ++/* Copyright (c) 2015-2018, The Linux Foundation. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 and +@@ -68,7 +68,7 @@ static void combiner_handle_irq(struct irq_desc *desc) + + bit = readl_relaxed(combiner->regs[reg].addr); + status = bit & combiner->regs[reg].enabled; +- if (!status) ++ if (bit && !status) + pr_warn_ratelimited("Unexpected IRQ on CPU%d: (%08x %08lx %p)\n", + smp_processor_id(), bit, + combiner->regs[reg].enabled, +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index b9d8d71a6ecc..fbc825ac97ab 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -825,6 +825,13 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(rt)) + return PTR_ERR(rt); + ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(&rt->dst) - sizeof(struct iphdr) - ++ GENEVE_BASE_HLEN - info->options_len - 14; + -+ bitoffset = (bitoffset + eccbits) % 8; -+ if (bitoffset) -+ eccbuf[eccbytes - 1] |= GENMASK(7, bitoffset); -+ -+ /* -+ * The ECC hardware has an uncorrectable ECC status -+ * code in case we have bitflips in an erased page. As -+ * nothing was written into this subpage the ECC is -+ * obviously wrong and we can not trust it. We assume -+ * at this point that we are reading an erased page and -+ * try to correct the bitflips in buffer up to -+ * ecc_strength bitflips. If this is a page with random -+ * data, we exceed this number of bitflips and have a -+ * ECC failure. Otherwise we use the corrected buffer. -+ */ -+ if (i == 0) { -+ /* The first block includes metadata */ -+ flips = nand_check_erased_ecc_chunk( -+ buf + i * nfc_geo->ecc_chunk_size, -+ nfc_geo->ecc_chunk_size, -+ eccbuf, eccbytes, -+ auxiliary_virt, -+ nfc_geo->metadata_size, -+ nfc_geo->ecc_strength); -+ } else { -+ flips = nand_check_erased_ecc_chunk( -+ buf + i * nfc_geo->ecc_chunk_size, -+ nfc_geo->ecc_chunk_size, -+ eccbuf, eccbytes, -+ NULL, 0, -+ nfc_geo->ecc_strength); -+ } ++ skb_dst_update_pmtu(skb, mtu); ++ } + -+ if (flips > 0) { -+ max_bitflips = max_t(unsigned int, max_bitflips, -+ flips); -+ mtd->ecc_stats.corrected += flips; -+ continue; -+ } + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + if (geneve->collect_md) { + tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); +@@ -864,6 +871,13 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, + if (IS_ERR(dst)) + return PTR_ERR(dst); + ++ if (skb_dst(skb)) { ++ int mtu = dst_mtu(dst) - sizeof(struct ipv6hdr) - ++ GENEVE_BASE_HLEN - info->options_len - 14; + - mtd->ecc_stats.failed++; - continue; - } ++ skb_dst_update_pmtu(skb, mtu); ++ } + - mtd->ecc_stats.corrected += *status; - max_bitflips = max_t(unsigned int, max_bitflips, *status); - } -@@ -1062,11 +1135,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, - chip->oob_poi[0] = ((uint8_t *) auxiliary_virt)[0]; - } - -- read_page_swap_end(this, buf, nfc_geo->payload_size, -- this->payload_virt, this->payload_phys, -- nfc_geo->payload_size, -- payload_virt, payload_phys); -- - return max_bitflips; - } - -diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index db1855b0e08f..59f891bebcc6 100644 ---- a/drivers/net/can/usb/kvaser_usb.c -+++ b/drivers/net/can/usb/kvaser_usb.c -@@ -1175,7 +1175,7 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev, - - skb = alloc_can_skb(priv->netdev, &cf); - if (!skb) { -- stats->tx_dropped++; -+ stats->rx_dropped++; - return; - } - + sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + if (geneve->collect_md) { + prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index b0ea8dee5f06..a6f0a8f516d6 100644 +index 5d3d31f5933b..1aad0568dcc6 100644 --- a/drivers/net/usb/qmi_wwan.c +++ b/drivers/net/usb/qmi_wwan.c -@@ -631,6 +631,7 @@ static const struct usb_device_id products[] = { +@@ -1098,6 +1098,7 @@ static const struct usb_device_id products[] = { {QMI_FIXED_INTF(0x05c6, 0x9080, 8)}, {QMI_FIXED_INTF(0x05c6, 0x9083, 3)}, {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x90b2, 3)}, /* ublox R410M */ {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, - {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, -diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c -index ee638cb8b48f..0c23768aa1ec 100644 ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -67,6 +67,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA988X_BOARD_DATA_SZ, - .board_ext_size = QCA988X_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA6174_HW_2_1_VERSION, -@@ -85,6 +86,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA6174_BOARD_DATA_SZ, - .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA6174_HW_2_1_VERSION, -@@ -103,6 +105,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA6174_BOARD_DATA_SZ, - .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA6174_HW_3_0_VERSION, -@@ -121,6 +124,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA6174_BOARD_DATA_SZ, - .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA6174_HW_3_2_VERSION, -@@ -140,6 +144,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA6174_BOARD_DATA_SZ, - .board_ext_size = QCA6174_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA99X0_HW_2_0_DEV_VERSION, -@@ -159,6 +164,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA99X0_BOARD_DATA_SZ, - .board_ext_size = QCA99X0_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 1, - }, - { - .id = QCA9377_HW_1_0_DEV_VERSION, -@@ -177,6 +183,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA9377_BOARD_DATA_SZ, - .board_ext_size = QCA9377_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - { - .id = QCA9377_HW_1_1_DEV_VERSION, -@@ -195,6 +202,7 @@ static const struct ath10k_hw_params ath10k_hw_params_list[] = { - .board_size = QCA9377_BOARD_DATA_SZ, - .board_ext_size = QCA9377_BOARD_EXT_DATA_SZ, - }, -+ .decap_align_bytes = 4, - }, - }; + {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index bb44f0c6891f..3d9c5b35a4a7 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2158,8 +2158,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + if (skb_dst(skb)) { + int mtu = dst_mtu(ndst) - VXLAN_HEADROOM; + +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, +- skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + } -diff --git a/drivers/net/wireless/ath/ath10k/core.h b/drivers/net/wireless/ath/ath10k/core.h -index 858d75f49a9f..257836a0cfbc 100644 ---- a/drivers/net/wireless/ath/ath10k/core.h -+++ b/drivers/net/wireless/ath/ath10k/core.h -@@ -670,6 +670,10 @@ struct ath10k { - size_t board_size; - size_t board_ext_size; - } fw; -+ -+ /* Number of bytes used for alignment in rx_hdr_status */ -+ int decap_align_bytes; -+ - } hw_params; - - const struct firmware *board; -diff --git a/drivers/net/wireless/ath/ath10k/htt_rx.c b/drivers/net/wireless/ath/ath10k/htt_rx.c -index 6060dda4e910..d26cb37b1fbd 100644 ---- a/drivers/net/wireless/ath/ath10k/htt_rx.c -+++ b/drivers/net/wireless/ath/ath10k/htt_rx.c -@@ -979,7 +979,7 @@ static void ath10k_process_rx(struct ath10k *ar, - *status = *rx_status; - - ath10k_dbg(ar, ATH10K_DBG_DATA, -- "rx skb %p len %u peer %pM %s %s sn %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%x fcs-err %i mic-err %i amsdu-more %i\n", -+ "rx skb %p len %u peer %pM %s %s sn %u %s%s%s%s%s %srate_idx %u vht_nss %u freq %u band %u flag 0x%llx fcs-err %i mic-err %i amsdu-more %i\n", - skb, - skb->len, - ieee80211_get_SA(hdr), -@@ -1076,7 +1076,21 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar, - hdr = (void *)msdu->data; - - /* Tail */ -- skb_trim(msdu, msdu->len - ath10k_htt_rx_crypto_tail_len(ar, enctype)); -+ if (status->flag & RX_FLAG_IV_STRIPPED) { -+ skb_trim(msdu, msdu->len - -+ ath10k_htt_rx_crypto_tail_len(ar, enctype)); -+ } else { -+ /* MIC */ -+ if ((status->flag & RX_FLAG_MIC_STRIPPED) && -+ enctype == HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2) -+ skb_trim(msdu, msdu->len - 8); -+ -+ /* ICV */ -+ if (status->flag & RX_FLAG_ICV_STRIPPED && -+ enctype != HTT_RX_MPDU_ENCRYPT_AES_CCM_WPA2) -+ skb_trim(msdu, msdu->len - -+ ath10k_htt_rx_crypto_tail_len(ar, enctype)); -+ } + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); +@@ -2200,8 +2199,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + if (skb_dst(skb)) { + int mtu = dst_mtu(ndst) - VXLAN6_HEADROOM; + +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, +- skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + } + + tos = ip_tunnel_ecn_encap(tos, old_iph, skb); +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +index b5e9877d935c..a9e1239ff21b 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.c +@@ -173,16 +173,6 @@ static u8 halbtc_get_wifi_central_chnl(struct btc_coexist *btcoexist) - /* MMIC */ - if (!ieee80211_has_morefrags(hdr->frame_control) && -@@ -1095,12 +1109,14 @@ static void ath10k_htt_rx_h_undecap_raw(struct ath10k *ar, - static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar, - struct sk_buff *msdu, - struct ieee80211_rx_status *status, -- const u8 first_hdr[64]) -+ const u8 first_hdr[64], -+ enum htt_rx_mpdu_encrypt_type enctype) + u8 rtl_get_hwpg_single_ant_path(struct rtl_priv *rtlpriv) { - struct ieee80211_hdr *hdr; - size_t hdr_len; - u8 da[ETH_ALEN]; - u8 sa[ETH_ALEN]; -+ int bytes_aligned = ar->hw_params.decap_align_bytes; - - /* Delivered decapped frame: - * [nwifi 802.11 header] <-- replaced with 802.11 hdr -@@ -1123,6 +1139,14 @@ static void ath10k_htt_rx_h_undecap_nwifi(struct ath10k *ar, - /* push original 802.11 header */ - hdr = (struct ieee80211_hdr *)first_hdr; - hdr_len = ieee80211_hdrlen(hdr->frame_control); -+ -+ if (!(status->flag & RX_FLAG_IV_STRIPPED)) { -+ memcpy(skb_push(msdu, -+ ath10k_htt_rx_crypto_param_len(ar, enctype)), -+ (void *)hdr + round_up(hdr_len, bytes_aligned), -+ ath10k_htt_rx_crypto_param_len(ar, enctype)); -+ } -+ - memcpy(skb_push(msdu, hdr_len), hdr, hdr_len); - - /* original 802.11 header has a different DA and in -@@ -1180,6 +1204,7 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar, - void *rfc1042; - u8 da[ETH_ALEN]; - u8 sa[ETH_ALEN]; -+ int bytes_aligned = ar->hw_params.decap_align_bytes; - - /* Delivered decapped frame: - * [eth header] <-- replaced with 802.11 hdr & rfc1042/llc -@@ -1203,6 +1228,14 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar, - /* push original 802.11 header */ - hdr = (struct ieee80211_hdr *)first_hdr; - hdr_len = ieee80211_hdrlen(hdr->frame_control); -+ -+ if (!(status->flag & RX_FLAG_IV_STRIPPED)) { -+ memcpy(skb_push(msdu, -+ ath10k_htt_rx_crypto_param_len(ar, enctype)), -+ (void *)hdr + round_up(hdr_len, bytes_aligned), -+ ath10k_htt_rx_crypto_param_len(ar, enctype)); -+ } -+ - memcpy(skb_push(msdu, hdr_len), hdr, hdr_len); - - /* original 802.11 header has a different DA and in -@@ -1216,10 +1249,12 @@ static void ath10k_htt_rx_h_undecap_eth(struct ath10k *ar, - static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar, - struct sk_buff *msdu, - struct ieee80211_rx_status *status, -- const u8 first_hdr[64]) -+ const u8 first_hdr[64], -+ enum htt_rx_mpdu_encrypt_type enctype) +- struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; +- +- /* override ant_num / ant_path */ +- if (mod_params->ant_sel) { +- rtlpriv->btcoexist.btc_info.ant_num = +- (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); +- +- rtlpriv->btcoexist.btc_info.single_ant_path = +- (mod_params->ant_sel == 1 ? 0 : 1); +- } + return rtlpriv->btcoexist.btc_info.single_ant_path; + } + +@@ -193,7 +183,6 @@ u8 rtl_get_hwpg_bt_type(struct rtl_priv *rtlpriv) + + u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv) { - struct ieee80211_hdr *hdr; - size_t hdr_len; -+ int bytes_aligned = ar->hw_params.decap_align_bytes; +- struct rtl_mod_params *mod_params = rtlpriv->cfg->mod_params; + u8 num; - /* Delivered decapped frame: - * [amsdu header] <-- replaced with 802.11 hdr -@@ -1231,6 +1266,14 @@ static void ath10k_htt_rx_h_undecap_snap(struct ath10k *ar, + if (rtlpriv->btcoexist.btc_info.ant_num == ANT_X2) +@@ -201,10 +190,6 @@ u8 rtl_get_hwpg_ant_num(struct rtl_priv *rtlpriv) + else + num = 1; - hdr = (struct ieee80211_hdr *)first_hdr; - hdr_len = ieee80211_hdrlen(hdr->frame_control); -+ -+ if (!(status->flag & RX_FLAG_IV_STRIPPED)) { -+ memcpy(skb_push(msdu, -+ ath10k_htt_rx_crypto_param_len(ar, enctype)), -+ (void *)hdr + round_up(hdr_len, bytes_aligned), -+ ath10k_htt_rx_crypto_param_len(ar, enctype)); -+ } -+ - memcpy(skb_push(msdu, hdr_len), hdr, hdr_len); +- /* override ant_num / ant_path */ +- if (mod_params->ant_sel) +- num = (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1) + 1; +- + return num; } -@@ -1265,13 +1308,15 @@ static void ath10k_htt_rx_h_undecap(struct ath10k *ar, - is_decrypted); - break; - case RX_MSDU_DECAP_NATIVE_WIFI: -- ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr); -+ ath10k_htt_rx_h_undecap_nwifi(ar, msdu, status, first_hdr, -+ enctype); - break; - case RX_MSDU_DECAP_ETHERNET2_DIX: - ath10k_htt_rx_h_undecap_eth(ar, msdu, status, first_hdr, enctype); - break; - case RX_MSDU_DECAP_8023_SNAP_LLC: -- ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr); -+ ath10k_htt_rx_h_undecap_snap(ar, msdu, status, first_hdr, -+ enctype); - break; - } +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +index f9b87c12db09..ed1725cf091c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/halbtcoutsrc.h +@@ -601,6 +601,7 @@ extern struct btc_coexist gl_bt_coexist; + + bool exhalbtc_initlize_variables(void); + bool exhalbtc_bind_bt_coex_withadapter(void *adapter); ++void exhalbtc_power_on_setting(struct btc_coexist *btcoexist); + void exhalbtc_init_hw_config(struct btc_coexist *btcoexist, bool wifi_only); + void exhalbtc_init_coex_dm(struct btc_coexist *btcoexist); + void exhalbtc_ips_notify(struct btc_coexist *btcoexist, u8 type); +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +index 7d296a401b6f..c394e0412982 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.c +@@ -32,6 +32,7 @@ + static struct rtl_btc_ops rtl_btc_operation = { + .btc_init_variables = rtl_btc_init_variables, + .btc_init_hal_vars = rtl_btc_init_hal_vars, ++ .btc_power_on_setting = rtl_btc_power_on_setting, + .btc_init_hw_config = rtl_btc_init_hw_config, + .btc_ips_notify = rtl_btc_ips_notify, + .btc_lps_notify = rtl_btc_lps_notify, +@@ -110,6 +111,11 @@ void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv) + */ } -@@ -1314,7 +1359,8 @@ static void ath10k_htt_rx_h_csum_offload(struct sk_buff *msdu) - static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, - struct sk_buff_head *amsdu, -- struct ieee80211_rx_status *status) -+ struct ieee80211_rx_status *status, -+ bool fill_crypt_header) ++void rtl_btc_power_on_setting(struct rtl_priv *rtlpriv) ++{ ++ exhalbtc_power_on_setting(&gl_bt_coexist); ++} ++ + void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv) { - struct sk_buff *first; - struct sk_buff *last; -@@ -1324,7 +1370,6 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, - enum htt_rx_mpdu_encrypt_type enctype; - u8 first_hdr[64]; - u8 *qos; -- size_t hdr_len; - bool has_fcs_err; - bool has_crypto_err; - bool has_tkip_err; -@@ -1345,15 +1390,17 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, - * decapped header. It'll be used for undecapping of each MSDU. - */ - hdr = (void *)rxd->rx_hdr_status; -- hdr_len = ieee80211_hdrlen(hdr->frame_control); -- memcpy(first_hdr, hdr, hdr_len); -+ memcpy(first_hdr, hdr, RX_HTT_HDR_STATUS_LEN); + u8 bt_exist; +diff --git a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h +index ac1253c46f44..c2735e4fa5d3 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h ++++ b/drivers/net/wireless/realtek/rtlwifi/btcoexist/rtl_btc.h +@@ -29,6 +29,7 @@ + + void rtl_btc_init_variables(struct rtl_priv *rtlpriv); + void rtl_btc_init_hal_vars(struct rtl_priv *rtlpriv); ++void rtl_btc_power_on_setting(struct rtl_priv *rtlpriv); + void rtl_btc_init_hw_config(struct rtl_priv *rtlpriv); + void rtl_btc_ips_notify(struct rtl_priv *rtlpriv, u8 type); + void rtl_btc_lps_notify(struct rtl_priv *rtlpriv, u8 type); +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +index 0034ebd3e5ba..f019eebe41d1 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723be/hw.c +@@ -846,6 +846,9 @@ static bool _rtl8723be_init_mac(struct ieee80211_hw *hw) + return false; + } - /* Each A-MSDU subframe will use the original header as the base and be - * reported as a separate MSDU so strip the A-MSDU bit from QoS Ctl. - */ - hdr = (void *)first_hdr; -- qos = ieee80211_get_qos_ctl(hdr); -- qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT; ++ if (rtlpriv->cfg->ops->get_btc_status()) ++ rtlpriv->btcoexist.btc_ops->btc_power_on_setting(rtlpriv); + -+ if (ieee80211_is_data_qos(hdr->frame_control)) { -+ qos = ieee80211_get_qos_ctl(hdr); -+ qos[0] &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT; -+ } + bytetmp = rtl_read_byte(rtlpriv, REG_MULTI_FUNC_CTRL); + rtl_write_byte(rtlpriv, REG_MULTI_FUNC_CTRL, bytetmp | BIT(3)); + +@@ -2696,21 +2699,21 @@ void rtl8723be_read_bt_coexist_info_from_hwpg(struct ieee80211_hw *hw, + rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B; + rtlpriv->btcoexist.btc_info.ant_num = (value & 0x1); + rtlpriv->btcoexist.btc_info.single_ant_path = +- (value & 0x40); /*0xc3[6]*/ ++ (value & 0x40 ? ANT_AUX : ANT_MAIN); /*0xc3[6]*/ + } else { + rtlpriv->btcoexist.btc_info.btcoexist = 0; + rtlpriv->btcoexist.btc_info.bt_type = BT_RTL8723B; + rtlpriv->btcoexist.btc_info.ant_num = ANT_X2; +- rtlpriv->btcoexist.btc_info.single_ant_path = 0; ++ rtlpriv->btcoexist.btc_info.single_ant_path = ANT_MAIN; + } - /* Some attention flags are valid only in the last MSDU. */ - last = skb_peek_tail(amsdu); -@@ -1387,11 +1434,17 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, - if (has_tkip_err) - status->flag |= RX_FLAG_MMIC_ERROR; - -- if (is_decrypted) -+ if (is_decrypted) { - status->flag |= RX_FLAG_DECRYPTED | -- RX_FLAG_IV_STRIPPED | - RX_FLAG_MMIC_STRIPPED; - -+ if (fill_crypt_header) -+ status->flag |= RX_FLAG_MIC_STRIPPED | -+ RX_FLAG_ICV_STRIPPED; -+ else -+ status->flag |= RX_FLAG_IV_STRIPPED; -+ } -+ - skb_queue_walk(amsdu, msdu) { - ath10k_htt_rx_h_csum_offload(msdu); - ath10k_htt_rx_h_undecap(ar, msdu, status, first_hdr, enctype, -@@ -1404,6 +1457,9 @@ static void ath10k_htt_rx_h_mpdu(struct ath10k *ar, - if (!is_decrypted) - continue; - -+ if (fill_crypt_header) -+ continue; -+ - hdr = (void *)msdu->data; - hdr->frame_control &= ~__cpu_to_le16(IEEE80211_FCTL_PROTECTED); + /* override ant_num / ant_path */ + if (mod_params->ant_sel) { + rtlpriv->btcoexist.btc_info.ant_num = +- (mod_params->ant_sel == 1 ? ANT_X2 : ANT_X1); ++ (mod_params->ant_sel == 1 ? ANT_X1 : ANT_X2); + + rtlpriv->btcoexist.btc_info.single_ant_path = +- (mod_params->ant_sel == 1 ? 0 : 1); ++ (mod_params->ant_sel == 1 ? ANT_AUX : ANT_MAIN); } -@@ -1414,6 +1470,9 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar, - struct ieee80211_rx_status *status) - { - struct sk_buff *msdu; -+ struct sk_buff *first_subframe; -+ -+ first_subframe = skb_peek(amsdu); - - while ((msdu = __skb_dequeue(amsdu))) { - /* Setup per-MSDU flags */ -@@ -1422,6 +1481,13 @@ static void ath10k_htt_rx_h_deliver(struct ath10k *ar, - else - status->flag |= RX_FLAG_AMSDU_MORE; - -+ if (msdu == first_subframe) { -+ first_subframe = NULL; -+ status->flag &= ~RX_FLAG_ALLOW_SAME_PN; -+ } else { -+ status->flag |= RX_FLAG_ALLOW_SAME_PN; -+ } + } + +diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h +index 25c4e3e55921..c73ce334ce6c 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/wifi.h ++++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h +@@ -2545,6 +2545,7 @@ struct bt_coexist_info { + struct rtl_btc_ops { + void (*btc_init_variables) (struct rtl_priv *rtlpriv); + void (*btc_init_hal_vars) (struct rtl_priv *rtlpriv); ++ void (*btc_power_on_setting)(struct rtl_priv *rtlpriv); + void (*btc_init_hw_config) (struct rtl_priv *rtlpriv); + void (*btc_ips_notify) (struct rtl_priv *rtlpriv, u8 type); + void (*btc_lps_notify)(struct rtl_priv *rtlpriv, u8 type); +@@ -2707,6 +2708,11 @@ enum bt_ant_num { + ANT_X1 = 1, + }; + ++enum bt_ant_path { ++ ANT_MAIN = 0, ++ ANT_AUX = 1, ++}; + - ath10k_process_rx(ar, status, msdu); - } + enum bt_co_type { + BT_2WIRE = 0, + BT_ISSC_3WIRE = 1, +diff --git a/drivers/platform/x86/asus-wireless.c b/drivers/platform/x86/asus-wireless.c +index d4aeac3477f5..f086469ea740 100644 +--- a/drivers/platform/x86/asus-wireless.c ++++ b/drivers/platform/x86/asus-wireless.c +@@ -178,8 +178,10 @@ static int asus_wireless_remove(struct acpi_device *adev) + { + struct asus_wireless_data *data = acpi_driver_data(adev); + +- if (data->wq) ++ if (data->wq) { ++ devm_led_classdev_unregister(&adev->dev, &data->led); + destroy_workqueue(data->wq); ++ } + return 0; } -@@ -1607,7 +1673,7 @@ static void ath10k_htt_rx_handler(struct ath10k_htt *htt, - ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff); - ath10k_htt_rx_h_unchain(ar, &amsdu, ret > 0); - ath10k_htt_rx_h_filter(ar, &amsdu, rx_status); -- ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status); -+ ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true); - ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status); - } -@@ -1653,7 +1719,7 @@ static void ath10k_htt_rx_frag_handler(struct ath10k_htt *htt, - - ath10k_htt_rx_h_ppdu(ar, &amsdu, rx_status, 0xffff); - ath10k_htt_rx_h_filter(ar, &amsdu, rx_status); -- ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status); -+ ath10k_htt_rx_h_mpdu(ar, &amsdu, rx_status, true); - ath10k_htt_rx_h_deliver(ar, &amsdu, rx_status); - - if (fw_desc_len > 0) { -@@ -1952,7 +2018,7 @@ static void ath10k_htt_rx_in_ord_ind(struct ath10k *ar, struct sk_buff *skb) - */ - ath10k_htt_rx_h_ppdu(ar, &amsdu, status, vdev_id); - ath10k_htt_rx_h_filter(ar, &amsdu, status); -- ath10k_htt_rx_h_mpdu(ar, &amsdu, status); -+ ath10k_htt_rx_h_mpdu(ar, &amsdu, status, false); - ath10k_htt_rx_h_deliver(ar, &amsdu, status); - break; - case -EAGAIN: -diff --git a/drivers/net/wireless/ath/wcn36xx/txrx.c b/drivers/net/wireless/ath/wcn36xx/txrx.c -index 9bec8237231d..99c21aac68bd 100644 ---- a/drivers/net/wireless/ath/wcn36xx/txrx.c -+++ b/drivers/net/wireless/ath/wcn36xx/txrx.c -@@ -57,7 +57,7 @@ int wcn36xx_rx_skb(struct wcn36xx *wcn, struct sk_buff *skb) - RX_FLAG_MMIC_STRIPPED | - RX_FLAG_DECRYPTED; - -- wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%x\n", status.flag); -+ wcn36xx_dbg(WCN36XX_DBG_RX, "status.flags=%llx\n", status.flag); - - memcpy(IEEE80211_SKB_RXCB(skb), &status, sizeof(status)); +diff --git a/drivers/target/target_core_iblock.c b/drivers/target/target_core_iblock.c +index 07c814c42648..60429011292a 100644 +--- a/drivers/target/target_core_iblock.c ++++ b/drivers/target/target_core_iblock.c +@@ -427,8 +427,8 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd) + { + struct se_device *dev = cmd->se_dev; + struct scatterlist *sg = &cmd->t_data_sg[0]; +- unsigned char *buf, zero = 0x00, *p = &zero; +- int rc, ret; ++ unsigned char *buf, *not_zero; ++ int ret; + + buf = kmap(sg_page(sg)) + sg->offset; + if (!buf) +@@ -437,10 +437,10 @@ iblock_execute_zero_out(struct block_device *bdev, struct se_cmd *cmd) + * Fall back to block_execute_write_same() slow-path if + * incoming WRITE_SAME payload does not contain zeros. + */ +- rc = memcmp(buf, p, cmd->data_length); ++ not_zero = memchr_inv(buf, 0x00, cmd->data_length); + kunmap(sg_page(sg)); + +- if (rc) ++ if (not_zero) + return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + ret = blkdev_issue_zeroout(bdev, diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 22dcccf2d286..6a287c81a7be 100644 +index 9e3355b97396..bd749e78df59 100644 --- a/drivers/usb/core/config.c +++ b/drivers/usb/core/config.c -@@ -157,7 +157,9 @@ static const unsigned short full_speed_maxpacket_maxes[4] = { +@@ -191,7 +191,9 @@ static const unsigned short full_speed_maxpacket_maxes[4] = { static const unsigned short high_speed_maxpacket_maxes[4] = { [USB_ENDPOINT_XFER_CONTROL] = 64, [USB_ENDPOINT_XFER_ISOC] = 1024, @@ -817,11 +1088,45 @@ index 22dcccf2d286..6a287c81a7be 100644 [USB_ENDPOINT_XFER_INT] = 1024, }; static const unsigned short super_speed_maxpacket_maxes[4] = { +diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c +index fe75e969f5ac..d7fae66a0681 100644 +--- a/drivers/usb/dwc3/gadget.c ++++ b/drivers/usb/dwc3/gadget.c +@@ -1444,7 +1444,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, + dwc->lock); + + if (!r->trb) +- goto out1; ++ goto out0; + + if (r->num_pending_sgs) { + struct dwc3_trb *trb; +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index bc6d1717c9ec..87f932d4b72c 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -442,7 +442,6 @@ void musb_g_tx(struct musb *musb, u8 epnum) + req = next_request(musb_ep); + request = &req->request; + +- trace_musb_req_tx(req); + csr = musb_readw(epio, MUSB_TXCSR); + musb_dbg(musb, "<== %s, txcsr %04x", musb_ep->end_point.name, csr); + +@@ -481,6 +480,8 @@ void musb_g_tx(struct musb *musb, u8 epnum) + u8 is_dma = 0; + bool short_packet = false; + ++ trace_musb_req_tx(req); ++ + if (dma && (csr & MUSB_TXCSR_DMAENAB)) { + is_dma = 1; + csr |= MUSB_TXCSR_P_WZC_BITS; diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c -index 0d843e0f8055..494823f21c28 100644 +index b5cc08d8aa22..5a6dca01a1d0 100644 --- a/drivers/usb/musb/musb_host.c +++ b/drivers/usb/musb/musb_host.c -@@ -1048,7 +1048,9 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep, +@@ -1023,7 +1023,9 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep, /* set tx_reinit and schedule the next qh */ ep->tx_reinit = 1; } @@ -833,7 +1138,7 @@ index 0d843e0f8055..494823f21c28 100644 } diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 1799aa058a5b..d982c455e18e 100644 +index dcf78a498927..d4124551fb56 100644 --- a/drivers/usb/serial/option.c +++ b/drivers/usb/serial/option.c @@ -236,6 +236,8 @@ static void option_instat_callback(struct urb *urb); @@ -1597,9 +1902,9 @@ index 1799aa058a5b..d982c455e18e 100644 - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + .driver_info = RSVD(4) }, { USB_DEVICE(CHANGHONG_VENDOR_ID, CHANGHONG_PRODUCT_CH690) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x02, 0x01) }, /* D-Link DWM-156 (variant) */ - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d01, 0xff, 0x00, 0x00) }, /* D-Link DWM-156 (variant) */ -@@ -2052,9 +1925,9 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d01, 0xff) }, /* D-Link DWM-156 (variant) */ + { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d02, 0xff) }, +@@ -2049,9 +1922,9 @@ static const struct usb_device_id option_ids[] = { { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ @@ -1611,7 +1916,7 @@ index 1799aa058a5b..d982c455e18e 100644 { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ -@@ -2114,7 +1987,7 @@ static int option_probe(struct usb_serial *serial, +@@ -2111,7 +1984,7 @@ static int option_probe(struct usb_serial *serial, struct usb_interface_descriptor *iface_desc = &serial->interface->cur_altsetting->desc; struct usb_device_descriptor *dev_desc = &serial->dev->descriptor; @@ -1620,7 +1925,7 @@ index 1799aa058a5b..d982c455e18e 100644 /* Never bind to the CD-Rom emulation interface */ if (iface_desc->bInterfaceClass == 0x08) -@@ -2125,9 +1998,7 @@ static int option_probe(struct usb_serial *serial, +@@ -2122,9 +1995,7 @@ static int option_probe(struct usb_serial *serial, * the same class/subclass/protocol as the serial interfaces. Look at * the Windows driver .INF files for reserved interface numbers. */ @@ -1631,7 +1936,7 @@ index 1799aa058a5b..d982c455e18e 100644 return -ENODEV; /* * Don't bind network interface on Samsung GT-B3730, it is handled by -@@ -2138,8 +2009,8 @@ static int option_probe(struct usb_serial *serial, +@@ -2135,8 +2006,8 @@ static int option_probe(struct usb_serial *serial, iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA) return -ENODEV; @@ -1642,7 +1947,7 @@ index 1799aa058a5b..d982c455e18e 100644 return 0; } -@@ -2147,22 +2018,21 @@ static int option_probe(struct usb_serial *serial, +@@ -2144,22 +2015,21 @@ static int option_probe(struct usb_serial *serial, static int option_attach(struct usb_serial *serial) { struct usb_interface_descriptor *iface_desc; @@ -1671,7 +1976,7 @@ index 1799aa058a5b..d982c455e18e 100644 usb_set_serial_data(serial, data); diff --git a/drivers/usb/serial/visor.c b/drivers/usb/serial/visor.c -index 337a0be89fcf..dbc3801b43eb 100644 +index 9f3317a940ef..879840ec0658 100644 --- a/drivers/usb/serial/visor.c +++ b/drivers/usb/serial/visor.c @@ -338,47 +338,48 @@ static int palm_os_3_probe(struct usb_serial *serial, @@ -1757,24 +2062,11 @@ index 337a0be89fcf..dbc3801b43eb 100644 dev_info(dev, "%s: Number of ports: %d\n", serial->type->description, num_ports); -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index 0fe667875852..cfb75dbb96f5 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -1906,7 +1906,7 @@ void wb_workfn(struct work_struct *work) - } - - if (!list_empty(&wb->work_list)) -- mod_delayed_work(bdi_wq, &wb->dwork, 0); -+ wb_wakeup(wb); - else if (wb_has_dirty_io(wb) && dirty_writeback_interval) - wb_wakeup_delayed(wb); - diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c -index 3dd47307363f..e917aec4babe 100644 +index 6526ef0e2a23..fa68e81e9671 100644 --- a/fs/xfs/xfs_file.c +++ b/fs/xfs/xfs_file.c -@@ -969,22 +969,26 @@ xfs_file_fallocate( +@@ -811,22 +811,26 @@ xfs_file_fallocate( if (error) goto out_unlock; } else if (mode & FALLOC_FL_INSERT_RANGE) { @@ -1806,252 +2098,125 @@ index 3dd47307363f..e917aec4babe 100644 error = -EINVAL; goto out_unlock; } -diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h -index c9b3eb70f340..567017b5fc9e 100644 ---- a/include/net/inet_timewait_sock.h -+++ b/include/net/inet_timewait_sock.h -@@ -55,6 +55,7 @@ struct inet_timewait_sock { - #define tw_family __tw_common.skc_family - #define tw_state __tw_common.skc_state - #define tw_reuse __tw_common.skc_reuse -+#define tw_reuseport __tw_common.skc_reuseport - #define tw_ipv6only __tw_common.skc_ipv6only - #define tw_bound_dev_if __tw_common.skc_bound_dev_if - #define tw_node __tw_common.skc_nulls_node -diff --git a/include/net/mac80211.h b/include/net/mac80211.h -index 4e51f9a5a177..7a49a31f6ddc 100644 ---- a/include/net/mac80211.h -+++ b/include/net/mac80211.h -@@ -975,7 +975,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) - * @RX_FLAG_DECRYPTED: This frame was decrypted in hardware. - * @RX_FLAG_MMIC_STRIPPED: the Michael MIC is stripped off this frame, - * verification has been done by the hardware. -- * @RX_FLAG_IV_STRIPPED: The IV/ICV are stripped from this frame. -+ * @RX_FLAG_IV_STRIPPED: The IV and ICV are stripped from this frame. - * If this flag is set, the stack cannot do any replay detection - * hence the driver or hardware will have to do that. - * @RX_FLAG_PN_VALIDATED: Currently only valid for CCMP/GCMP frames, this -@@ -1013,6 +1013,8 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) - * on this subframe - * @RX_FLAG_AMPDU_DELIM_CRC_KNOWN: The delimiter CRC field is known (the CRC - * is stored in the @ampdu_delimiter_crc field) -+ * @RX_FLAG_MIC_STRIPPED: The mic was stripped of this packet. Decryption was -+ * done by the hardware - * @RX_FLAG_LDPC: LDPC was used - * @RX_FLAG_STBC_MASK: STBC 2 bit bitmask. 1 - Nss=1, 2 - Nss=2, 3 - Nss=3 - * @RX_FLAG_10MHZ: 10 MHz (half channel) was used -@@ -1029,6 +1031,11 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) - * @RX_FLAG_RADIOTAP_VENDOR_DATA: This frame contains vendor-specific - * radiotap data in the skb->data (before the frame) as described by - * the &struct ieee80211_vendor_radiotap. -+ * @RX_FLAG_ALLOW_SAME_PN: Allow the same PN as same packet before. -+ * This is used for AMSDU subframes which can have the same PN as -+ * the first subframe. -+ * @RX_FLAG_ICV_STRIPPED: The ICV is stripped from this frame. CRC checking must -+ * be done in the hardware. - */ - enum mac80211_rx_flags { - RX_FLAG_MMIC_ERROR = BIT(0), -@@ -1059,6 +1066,9 @@ enum mac80211_rx_flags { - RX_FLAG_5MHZ = BIT(29), - RX_FLAG_AMSDU_MORE = BIT(30), - RX_FLAG_RADIOTAP_VENDOR_DATA = BIT(31), -+ RX_FLAG_MIC_STRIPPED = BIT_ULL(32), -+ RX_FLAG_ALLOW_SAME_PN = BIT_ULL(33), -+ RX_FLAG_ICV_STRIPPED = BIT_ULL(34), - }; - - #define RX_FLAG_STBC_SHIFT 26 -@@ -1113,7 +1123,7 @@ struct ieee80211_rx_status { - u64 mactime; - u32 device_timestamp; - u32 ampdu_reference; -- u32 flag; -+ u64 flag; - u16 freq; - u8 vht_flag; - u8 rate_idx; -diff --git a/include/net/nexthop.h b/include/net/nexthop.h -index 3334dbfa5aa4..7fc78663ec9d 100644 ---- a/include/net/nexthop.h -+++ b/include/net/nexthop.h -@@ -6,7 +6,7 @@ - - static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining) - { -- return remaining >= sizeof(*rtnh) && -+ return remaining >= (int)sizeof(*rtnh) && - rtnh->rtnh_len >= sizeof(*rtnh) && - rtnh->rtnh_len <= remaining; +diff --git a/include/net/dst.h b/include/net/dst.h +index 694c2e6ae618..ebfb4328fdb1 100644 +--- a/include/net/dst.h ++++ b/include/net/dst.h +@@ -520,4 +520,12 @@ static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst) } -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index 3608fa1aec8a..0eb11b4ac4c7 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -102,7 +102,7 @@ static void *array_map_lookup_elem(struct bpf_map *map, void *key) - static int array_map_get_next_key(struct bpf_map *map, void *key, void *next_key) - { - struct bpf_array *array = container_of(map, struct bpf_array, map); -- u32 index = *(u32 *)key; -+ u32 index = key ? *(u32 *)key : U32_MAX; - u32 *next = (u32 *)next_key; - - if (index >= array->map.max_entries) { -diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c -index 34777b3746fa..a35abe048239 100644 ---- a/kernel/bpf/hashtab.c -+++ b/kernel/bpf/hashtab.c -@@ -169,12 +169,15 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key) - struct hlist_head *head; - struct htab_elem *l, *next_l; - u32 hash, key_size; -- int i; -+ int i = 0; - - WARN_ON_ONCE(!rcu_read_lock_held()); - - key_size = map->key_size; - -+ if (!key) -+ goto find_first_elem; -+ - hash = htab_map_hash(key, key_size); - - head = select_bucket(htab, hash); -@@ -182,10 +185,8 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key) - /* lookup the key */ - l = lookup_elem_raw(head, hash, key, key_size); - -- if (!l) { -- i = 0; -+ if (!l) - goto find_first_elem; -- } + #endif - /* key was found, get next key in the same bucket */ - next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)), -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index dc19b6e210e6..4b9bbfe764e8 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -390,14 +390,18 @@ static int map_get_next_key(union bpf_attr *attr) - if (IS_ERR(map)) - return PTR_ERR(map); - -- err = -ENOMEM; -- key = kmalloc(map->key_size, GFP_USER); -- if (!key) -- goto err_put; -- -- err = -EFAULT; -- if (copy_from_user(key, ukey, map->key_size) != 0) -- goto free_key; -+ if (ukey) { -+ err = -ENOMEM; -+ key = kmalloc(map->key_size, GFP_USER); -+ if (!key) -+ goto err_put; ++static inline void skb_dst_update_pmtu(struct sk_buff *skb, u32 mtu) ++{ ++ struct dst_entry *dst = skb_dst(skb); + -+ err = -EFAULT; -+ if (copy_from_user(key, ukey, map->key_size) != 0) -+ goto free_key; -+ } else { -+ key = NULL; -+ } - - err = -ENOMEM; - next_key = kmalloc(map->key_size, GFP_USER); -diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c -index 9c418002b8c1..75f835d353db 100644 ---- a/kernel/events/callchain.c -+++ b/kernel/events/callchain.c -@@ -107,14 +107,8 @@ int get_callchain_buffers(void) - goto exit; ++ if (dst && dst->ops->update_pmtu) ++ dst->ops->update_pmtu(dst, NULL, skb, mtu); ++} ++ + #endif /* _NET_DST_H */ +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 4525e0271a53..14d3af6a2953 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -55,6 +55,7 @@ struct trace_uprobe { + struct list_head list; + struct trace_uprobe_filter filter; + struct uprobe_consumer consumer; ++ struct path path; + struct inode *inode; + char *filename; + unsigned long offset; +@@ -287,7 +288,7 @@ static void free_trace_uprobe(struct trace_uprobe *tu) + for (i = 0; i < tu->tp.nr_args; i++) + traceprobe_free_probe_arg(&tu->tp.args[i]); + +- iput(tu->inode); ++ path_put(&tu->path); + kfree(tu->tp.call.class->system); + kfree(tu->tp.call.name); + kfree(tu->filename); +@@ -361,7 +362,6 @@ static int register_trace_uprobe(struct trace_uprobe *tu) + static int create_trace_uprobe(int argc, char **argv) + { + struct trace_uprobe *tu; +- struct inode *inode; + char *arg, *event, *group, *filename; + char buf[MAX_EVENT_NAME_LEN]; + struct path path; +@@ -369,7 +369,6 @@ static int create_trace_uprobe(int argc, char **argv) + bool is_delete, is_return; + int i, ret; + +- inode = NULL; + ret = 0; + is_delete = false; + is_return = false; +@@ -435,21 +434,16 @@ static int create_trace_uprobe(int argc, char **argv) } - -- if (count > 1) { -- /* If the allocation failed, give up */ -- if (!callchain_cpus_entries) -- err = -ENOMEM; -- goto exit; + /* Find the last occurrence, in case the path contains ':' too. */ + arg = strrchr(argv[1], ':'); +- if (!arg) { +- ret = -EINVAL; +- goto fail_address_parse; - } ++ if (!arg) ++ return -EINVAL; + + *arg++ = '\0'; + filename = argv[1]; + ret = kern_path(filename, LOOKUP_FOLLOW, &path); + if (ret) +- goto fail_address_parse; - -- err = alloc_callchain_buffers(); -+ if (count == 1) -+ err = alloc_callchain_buffers(); - exit: - if (err) - atomic_dec(&nr_callchain_events); -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 6aeb0ef4fe70..92d1f12f4407 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -229,7 +229,7 @@ int perf_cpu_time_max_percent_handler(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, - loff_t *ppos) - { -- int ret = proc_dointvec(table, write, buffer, lenp, ppos); -+ int ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - - if (ret || !write) - return ret; -diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c -index 014b69528194..58013ef228a1 100644 ---- a/kernel/events/ring_buffer.c -+++ b/kernel/events/ring_buffer.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include - - #include "internal.h" - -@@ -779,8 +780,10 @@ perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff) - return NULL; - - /* AUX space */ -- if (pgoff >= rb->aux_pgoff) -- return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]); -+ if (pgoff >= rb->aux_pgoff) { -+ int aux_pgoff = array_index_nospec(pgoff - rb->aux_pgoff, rb->aux_nr_pages); -+ return virt_to_page(rb->aux_pages[aux_pgoff]); -+ } +- inode = igrab(d_inode(path.dentry)); +- path_put(&path); ++ return ret; + +- if (!inode || !S_ISREG(inode->i_mode)) { ++ if (!d_is_reg(path.dentry)) { + ret = -EINVAL; + goto fail_address_parse; } +@@ -488,7 +482,7 @@ static int create_trace_uprobe(int argc, char **argv) + goto fail_address_parse; + } + tu->offset = offset; +- tu->inode = inode; ++ tu->path = path; + tu->filename = kstrdup(filename, GFP_KERNEL); - return __perf_mmap_to_page(rb, pgoff); -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index f0e5408499b6..1ab2db6c127b 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -322,6 +322,9 @@ static int regex_match_full(char *str, struct regex *r, int len) + if (!tu->filename) { +@@ -556,7 +550,7 @@ static int create_trace_uprobe(int argc, char **argv) + return ret; - static int regex_match_front(char *str, struct regex *r, int len) - { -+ if (len < r->len) -+ return 0; -+ - if (strncmp(str, r->pattern, r->len) == 0) - return 1; - return 0; -diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c -index d2f6d0be3503..68bb89ad9d28 100644 ---- a/kernel/trace/trace_uprobe.c -+++ b/kernel/trace/trace_uprobe.c -@@ -149,6 +149,8 @@ static void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, - return; + fail_address_parse: +- iput(inode); ++ path_put(&path); - ret = strncpy_from_user(dst, src, maxlen); -+ if (ret == maxlen) -+ dst[--ret] = '\0'; + pr_info("Failed to parse address or file.\n"); - if (ret < 0) { /* Failed to fetch string */ - ((u8 *)get_rloc_data(dest))[0] = '\0'; +@@ -935,6 +929,7 @@ probe_event_enable(struct trace_uprobe *tu, struct trace_event_file *file, + goto err_flags; + + tu->consumer.filter = filter; ++ tu->inode = d_real_inode(tu->path.dentry); + ret = uprobe_register(tu->inode, tu->offset, &tu->consumer); + if (ret) + goto err_buffer; +@@ -980,6 +975,7 @@ probe_event_disable(struct trace_uprobe *tu, struct trace_event_file *file) + WARN_ON(!uprobe_filter_is_empty(&tu->filter)); + + uprobe_unregister(tu->inode, tu->offset, &tu->consumer); ++ tu->inode = NULL; + tu->tp.flags &= file ? ~TP_FLAG_TRACE : ~TP_FLAG_PROFILE; + + uprobe_buffer_disable(); diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c -index ecd536de603a..eda85bbf1c2e 100644 +index 685c50ae6300..a170d83043a5 100644 --- a/kernel/tracepoint.c +++ b/kernel/tracepoint.c -@@ -202,7 +202,7 @@ static int tracepoint_add_func(struct tracepoint *tp, +@@ -207,7 +207,7 @@ static int tracepoint_add_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_add(&tp_funcs, func, prio); if (IS_ERR(old)) { @@ -2060,7 +2225,7 @@ index ecd536de603a..eda85bbf1c2e 100644 return PTR_ERR(old); } -@@ -235,7 +235,7 @@ static int tracepoint_remove_func(struct tracepoint *tp, +@@ -240,7 +240,7 @@ static int tracepoint_remove_func(struct tracepoint *tp, lockdep_is_held(&tracepoints_mutex)); old = func_remove(&tp_funcs, func); if (IS_ERR(old)) { @@ -2069,11 +2234,52 @@ index ecd536de603a..eda85bbf1c2e 100644 return PTR_ERR(old); } +diff --git a/lib/errseq.c b/lib/errseq.c +index 79cc66897db4..b6ed81ec788d 100644 +--- a/lib/errseq.c ++++ b/lib/errseq.c +@@ -111,25 +111,22 @@ EXPORT_SYMBOL(errseq_set); + * errseq_sample - grab current errseq_t value + * @eseq: pointer to errseq_t to be sampled + * +- * This function allows callers to sample an errseq_t value, marking it as +- * "seen" if required. ++ * This function allows callers to initialise their errseq_t variable. ++ * If the error has been "seen", new callers will not see an old error. ++ * If there is an unseen error in @eseq, the caller of this function will ++ * see it the next time it checks for an error. ++ * ++ * Context: Any context. ++ * Return: The current errseq value. + */ + errseq_t errseq_sample(errseq_t *eseq) + { + errseq_t old = READ_ONCE(*eseq); +- errseq_t new = old; + +- /* +- * For the common case of no errors ever having been set, we can skip +- * marking the SEEN bit. Once an error has been set, the value will +- * never go back to zero. +- */ +- if (old != 0) { +- new |= ERRSEQ_SEEN; +- if (old != new) +- cmpxchg(eseq, old, new); +- } +- return new; ++ /* If nobody has seen this error yet, then we can be the first. */ ++ if (!(old & ERRSEQ_SEEN)) ++ old = 0; ++ return old; + } + EXPORT_SYMBOL(errseq_sample); + diff --git a/mm/percpu.c b/mm/percpu.c -index ef6353f0adbd..1c784df3bdfe 100644 +index c80e796bf35c..5fa5e79b69f0 100644 --- a/mm/percpu.c +++ b/mm/percpu.c -@@ -68,6 +68,7 @@ +@@ -80,6 +80,7 @@ #include #include #include @@ -2081,717 +2287,89 @@ index ef6353f0adbd..1c784df3bdfe 100644 #include #include -diff --git a/net/atm/lec.c b/net/atm/lec.c -index cd3b37989057..10e4066991b8 100644 ---- a/net/atm/lec.c -+++ b/net/atm/lec.c -@@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 }; - #include - #include - -+/* Hardening for Spectre-v1 */ -+#include -+ - #include "lec.h" - #include "lec_arpc.h" - #include "resources.h" -@@ -697,8 +700,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) - bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); - if (bytes_left != 0) - pr_info("copy from user failed for %d bytes\n", bytes_left); -- if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || -- !dev_lec[ioc_data.dev_num]) -+ if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF) -+ return -EINVAL; -+ ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF); -+ if (!dev_lec[ioc_data.dev_num]) - return -EINVAL; - vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL); - if (!vpriv) -diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c -index c0548d268e1a..e3e6a3e2ca22 100644 ---- a/net/core/dev_addr_lists.c -+++ b/net/core/dev_addr_lists.c -@@ -57,8 +57,8 @@ static int __hw_addr_add_ex(struct netdev_hw_addr_list *list, - return -EINVAL; - - list_for_each_entry(ha, &list->list, list) { -- if (!memcmp(ha->addr, addr, addr_len) && -- ha->type == addr_type) { -+ if (ha->type == addr_type && -+ !memcmp(ha->addr, addr, addr_len)) { - if (global) { - /* check if addr is already used as global */ - if (ha->global_use) -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 7d3442594e0d..5668dd3f9969 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -827,6 +827,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb) - n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len; - n->cloned = 1; - n->nohdr = 0; -+ n->peeked = 0; - n->destructor = NULL; - C(tail); - C(end); -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 6eb2bbf9873b..45fd82e61e79 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -618,6 +618,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) - ireq = inet_rsk(req); - sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr); - sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr); -+ ireq->ir_mark = inet_request_mark(sk, skb); - ireq->ireq_family = AF_INET; - ireq->ir_iif = sk->sk_bound_dev_if; - -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 09a9ab65f4e1..0bf41faeffc4 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -345,6 +345,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) - ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr; - ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr; - ireq->ireq_family = AF_INET6; -+ ireq->ir_mark = inet_request_mark(sk, skb); - - if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) || - np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo || -diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c -index c67f9bd7699c..d8316869947a 100644 ---- a/net/ipv4/inet_timewait_sock.c -+++ b/net/ipv4/inet_timewait_sock.c -@@ -182,6 +182,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, - tw->tw_dport = inet->inet_dport; - tw->tw_family = sk->sk_family; - tw->tw_reuse = sk->sk_reuse; -+ tw->tw_reuseport = sk->sk_reuseport; - tw->tw_hash = sk->sk_hash; - tw->tw_ipv6only = 0; - tw->tw_transparent = inet->transparent; -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 82d2b55c953a..b531a0997664 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2450,7 +2450,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, - case TCP_REPAIR_QUEUE: - if (!tp->repair) - err = -EPERM; -- else if (val < TCP_QUEUES_NR) -+ else if ((unsigned int)val < TCP_QUEUES_NR) - tp->repair_queue = val; - else - err = -EINVAL; -diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 33344f5a66a8..ec26a84b00e2 100644 ---- a/net/mac80211/util.c -+++ b/net/mac80211/util.c -@@ -2663,8 +2663,9 @@ u64 ieee80211_calculate_rx_timestamp(struct ieee80211_local *local, - - rate = cfg80211_calculate_bitrate(&ri); - if (WARN_ONCE(!rate, -- "Invalid bitrate: flags=0x%x, idx=%d, vht_nss=%d\n", -- status->flag, status->rate_idx, status->vht_nss)) -+ "Invalid bitrate: flags=0x%llx, idx=%d, vht_nss=%d\n", -+ (unsigned long long)status->flag, status->rate_idx, -+ status->vht_nss)) - return 0; - - /* rewind from end of MPDU */ -diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c -index efa3f48f1ec5..73e8f347802e 100644 ---- a/net/mac80211/wep.c -+++ b/net/mac80211/wep.c -@@ -293,7 +293,8 @@ ieee80211_crypto_wep_decrypt(struct ieee80211_rx_data *rx) - return RX_DROP_UNUSABLE; - ieee80211_wep_remove_iv(rx->local, rx->skb, rx->key); - /* remove ICV */ -- if (pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN)) -+ if (!(status->flag & RX_FLAG_ICV_STRIPPED) && -+ pskb_trim(rx->skb, rx->skb->len - IEEE80211_WEP_ICV_LEN)) - return RX_DROP_UNUSABLE; - } - -diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c -index e19ea1c53afa..cb439e06919f 100644 ---- a/net/mac80211/wpa.c -+++ b/net/mac80211/wpa.c -@@ -298,7 +298,8 @@ ieee80211_crypto_tkip_decrypt(struct ieee80211_rx_data *rx) - return RX_DROP_UNUSABLE; - - /* Trim ICV */ -- skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN); -+ if (!(status->flag & RX_FLAG_ICV_STRIPPED)) -+ skb_trim(skb, skb->len - IEEE80211_TKIP_ICV_LEN); - - /* Remove IV */ - memmove(skb->data + IEEE80211_TKIP_IV_LEN, skb->data, hdrlen); -@@ -508,25 +509,31 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, - !ieee80211_is_robust_mgmt_frame(skb)) - return RX_CONTINUE; - -- data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; -- if (!rx->sta || data_len < 0) -- return RX_DROP_UNUSABLE; -- - if (status->flag & RX_FLAG_DECRYPTED) { - if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_CCMP_HDR_LEN)) - return RX_DROP_UNUSABLE; -+ if (status->flag & RX_FLAG_MIC_STRIPPED) -+ mic_len = 0; - } else { - if (skb_linearize(rx->skb)) - return RX_DROP_UNUSABLE; - } - -+ data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; -+ if (!rx->sta || data_len < 0) -+ return RX_DROP_UNUSABLE; -+ - if (!(status->flag & RX_FLAG_PN_VALIDATED)) { -+ int res; -+ - ccmp_hdr2pn(pn, skb->data + hdrlen); - - queue = rx->security_idx; - -- if (memcmp(pn, key->u.ccmp.rx_pn[queue], -- IEEE80211_CCMP_PN_LEN) <= 0) { -+ res = memcmp(pn, key->u.ccmp.rx_pn[queue], -+ IEEE80211_CCMP_PN_LEN); -+ if (res < 0 || -+ (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) { - key->u.ccmp.replays++; - return RX_DROP_UNUSABLE; - } -@@ -724,8 +731,7 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) - struct sk_buff *skb = rx->skb; - struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); - u8 pn[IEEE80211_GCMP_PN_LEN]; -- int data_len; -- int queue; -+ int data_len, queue, mic_len = IEEE80211_GCMP_MIC_LEN; - - hdrlen = ieee80211_hdrlen(hdr->frame_control); - -@@ -733,26 +739,31 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) - !ieee80211_is_robust_mgmt_frame(skb)) - return RX_CONTINUE; - -- data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - -- IEEE80211_GCMP_MIC_LEN; -- if (!rx->sta || data_len < 0) -- return RX_DROP_UNUSABLE; -- - if (status->flag & RX_FLAG_DECRYPTED) { - if (!pskb_may_pull(rx->skb, hdrlen + IEEE80211_GCMP_HDR_LEN)) - return RX_DROP_UNUSABLE; -+ if (status->flag & RX_FLAG_MIC_STRIPPED) -+ mic_len = 0; - } else { - if (skb_linearize(rx->skb)) - return RX_DROP_UNUSABLE; - } - -+ data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len; -+ if (!rx->sta || data_len < 0) -+ return RX_DROP_UNUSABLE; -+ - if (!(status->flag & RX_FLAG_PN_VALIDATED)) { -+ int res; -+ - gcmp_hdr2pn(pn, skb->data + hdrlen); - - queue = rx->security_idx; - -- if (memcmp(pn, key->u.gcmp.rx_pn[queue], -- IEEE80211_GCMP_PN_LEN) <= 0) { -+ res = memcmp(pn, key->u.gcmp.rx_pn[queue], -+ IEEE80211_GCMP_PN_LEN); -+ if (res < 0 || -+ (!res && !(status->flag & RX_FLAG_ALLOW_SAME_PN))) { - key->u.gcmp.replays++; - return RX_DROP_UNUSABLE; - } -@@ -776,7 +787,7 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) - } - - /* Remove GCMP header and MIC */ -- if (pskb_trim(skb, skb->len - IEEE80211_GCMP_MIC_LEN)) -+ if (pskb_trim(skb, skb->len - mic_len)) - return RX_DROP_UNUSABLE; - memmove(skb->data + IEEE80211_GCMP_HDR_LEN, skb->data, hdrlen); - skb_pull(skb, IEEE80211_GCMP_HDR_LEN); -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index 2f0e4f61c40f..c0656510c4dc 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -2352,11 +2352,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) - strlcpy(cfg.mcast_ifn, dm->mcast_ifn, - sizeof(cfg.mcast_ifn)); - cfg.syncid = dm->syncid; -- rtnl_lock(); -- mutex_lock(&ipvs->sync_mutex); - ret = start_sync_thread(ipvs, &cfg, dm->state); -- mutex_unlock(&ipvs->sync_mutex); -- rtnl_unlock(); - } else { - mutex_lock(&ipvs->sync_mutex); - ret = stop_sync_thread(ipvs, dm->state); -@@ -3435,12 +3431,8 @@ static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs) - if (ipvs->mixed_address_family_dests > 0) - return -EINVAL; - -- rtnl_lock(); -- mutex_lock(&ipvs->sync_mutex); - ret = start_sync_thread(ipvs, &c, - nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE])); -- mutex_unlock(&ipvs->sync_mutex); -- rtnl_unlock(); - return ret; - } - -diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c -index 1b07578bedf3..cec7234b7a1d 100644 ---- a/net/netfilter/ipvs/ip_vs_sync.c -+++ b/net/netfilter/ipvs/ip_vs_sync.c -@@ -48,6 +48,7 @@ - #include - #include - #include -+#include - - #include /* Used for ntoh_seq and hton_seq */ - -@@ -1356,15 +1357,9 @@ static void set_mcast_pmtudisc(struct sock *sk, int val) - /* - * Specifiy default interface for outgoing multicasts - */ --static int set_mcast_if(struct sock *sk, char *ifname) -+static int set_mcast_if(struct sock *sk, struct net_device *dev) - { -- struct net_device *dev; - struct inet_sock *inet = inet_sk(sk); -- struct net *net = sock_net(sk); -- -- dev = __dev_get_by_name(net, ifname); -- if (!dev) -- return -ENODEV; - - if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) - return -EINVAL; -@@ -1392,19 +1387,14 @@ static int set_mcast_if(struct sock *sk, char *ifname) - * in the in_addr structure passed in as a parameter. - */ - static int --join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname) -+join_mcast_group(struct sock *sk, struct in_addr *addr, struct net_device *dev) - { -- struct net *net = sock_net(sk); - struct ip_mreqn mreq; -- struct net_device *dev; - int ret; - - memset(&mreq, 0, sizeof(mreq)); - memcpy(&mreq.imr_multiaddr, addr, sizeof(struct in_addr)); - -- dev = __dev_get_by_name(net, ifname); -- if (!dev) -- return -ENODEV; - if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) - return -EINVAL; - -@@ -1419,15 +1409,10 @@ join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname) - - #ifdef CONFIG_IP_VS_IPV6 - static int join_mcast_group6(struct sock *sk, struct in6_addr *addr, -- char *ifname) -+ struct net_device *dev) - { -- struct net *net = sock_net(sk); -- struct net_device *dev; - int ret; - -- dev = __dev_get_by_name(net, ifname); -- if (!dev) -- return -ENODEV; - if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) - return -EINVAL; - -@@ -1439,24 +1424,18 @@ static int join_mcast_group6(struct sock *sk, struct in6_addr *addr, - } - #endif - --static int bind_mcastif_addr(struct socket *sock, char *ifname) -+static int bind_mcastif_addr(struct socket *sock, struct net_device *dev) - { -- struct net *net = sock_net(sock->sk); -- struct net_device *dev; - __be32 addr; - struct sockaddr_in sin; - -- dev = __dev_get_by_name(net, ifname); -- if (!dev) -- return -ENODEV; -- - addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE); - if (!addr) - pr_err("You probably need to specify IP address on " - "multicast interface.\n"); - - IP_VS_DBG(7, "binding socket with (%s) %pI4\n", -- ifname, &addr); -+ dev->name, &addr); - - /* Now bind the socket with the address of multicast interface */ - sin.sin_family = AF_INET; -@@ -1489,7 +1468,8 @@ static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen, - /* - * Set up sending multicast socket over UDP - */ --static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) -+static int make_send_sock(struct netns_ipvs *ipvs, int id, -+ struct net_device *dev, struct socket **sock_ret) - { - /* multicast addr */ - union ipvs_sockaddr mcast_addr; -@@ -1501,9 +1481,10 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) - IPPROTO_UDP, &sock); - if (result < 0) { - pr_err("Error during creation of socket; terminating\n"); -- return ERR_PTR(result); -+ goto error; - } -- result = set_mcast_if(sock->sk, ipvs->mcfg.mcast_ifn); -+ *sock_ret = sock; -+ result = set_mcast_if(sock->sk, dev); - if (result < 0) { - pr_err("Error setting outbound mcast interface\n"); - goto error; -@@ -1518,7 +1499,7 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) - set_sock_size(sock->sk, 1, result); - - if (AF_INET == ipvs->mcfg.mcast_af) -- result = bind_mcastif_addr(sock, ipvs->mcfg.mcast_ifn); -+ result = bind_mcastif_addr(sock, dev); +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 13f7bbc0168d..a2fcc20774a6 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -521,8 +521,7 @@ static int tnl_update_pmtu(struct net_device *dev, struct sk_buff *skb, else - result = 0; - if (result < 0) { -@@ -1534,19 +1515,18 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) - goto error; - } - -- return sock; -+ return 0; - - error: -- sock_release(sock); -- return ERR_PTR(result); -+ return result; - } - - - /* - * Set up receiving multicast socket over UDP - */ --static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, -- int ifindex) -+static int make_receive_sock(struct netns_ipvs *ipvs, int id, -+ struct net_device *dev, struct socket **sock_ret) - { - /* multicast addr */ - union ipvs_sockaddr mcast_addr; -@@ -1558,8 +1538,9 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, - IPPROTO_UDP, &sock); - if (result < 0) { - pr_err("Error during creation of socket; terminating\n"); -- return ERR_PTR(result); -+ goto error; - } -+ *sock_ret = sock; - /* it is equivalent to the REUSEADDR option in user-space */ - sock->sk->sk_reuse = SK_CAN_REUSE; - result = sysctl_sync_sock_size(ipvs); -@@ -1567,7 +1548,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, - set_sock_size(sock->sk, 0, result); - - get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id); -- sock->sk->sk_bound_dev_if = ifindex; -+ sock->sk->sk_bound_dev_if = dev->ifindex; - result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen); - if (result < 0) { - pr_err("Error binding to the multicast addr\n"); -@@ -1578,21 +1559,20 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, - #ifdef CONFIG_IP_VS_IPV6 - if (ipvs->bcfg.mcast_af == AF_INET6) - result = join_mcast_group6(sock->sk, &mcast_addr.in6.sin6_addr, -- ipvs->bcfg.mcast_ifn); -+ dev); - else - #endif - result = join_mcast_group(sock->sk, &mcast_addr.in.sin_addr, -- ipvs->bcfg.mcast_ifn); -+ dev); - if (result < 0) { - pr_err("Error joining to the multicast group\n"); - goto error; - } - -- return sock; -+ return 0; - - error: -- sock_release(sock); -- return ERR_PTR(result); -+ return result; - } - - -@@ -1777,13 +1757,12 @@ static int sync_thread_backup(void *data) - int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - int state) - { -- struct ip_vs_sync_thread_data *tinfo; -+ struct ip_vs_sync_thread_data *tinfo = NULL; - struct task_struct **array = NULL, *task; -- struct socket *sock; - struct net_device *dev; - char *name; - int (*threadfn)(void *data); -- int id, count, hlen; -+ int id = 0, count, hlen; - int result = -ENOMEM; - u16 mtu, min_mtu; - -@@ -1791,6 +1770,18 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %Zd bytes\n", - sizeof(struct ip_vs_sync_conn_v0)); - -+ /* Do not hold one mutex and then to block on another */ -+ for (;;) { -+ rtnl_lock(); -+ if (mutex_trylock(&ipvs->sync_mutex)) -+ break; -+ rtnl_unlock(); -+ mutex_lock(&ipvs->sync_mutex); -+ if (rtnl_trylock()) -+ break; -+ mutex_unlock(&ipvs->sync_mutex); -+ } -+ - if (!ipvs->sync_state) { - count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX); - ipvs->threads_mask = count - 1; -@@ -1809,7 +1800,8 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - dev = __dev_get_by_name(ipvs->net, c->mcast_ifn); - if (!dev) { - pr_err("Unknown mcast interface: %s\n", c->mcast_ifn); -- return -ENODEV; -+ result = -ENODEV; -+ goto out_early; - } - hlen = (AF_INET6 == c->mcast_af) ? - sizeof(struct ipv6hdr) + sizeof(struct udphdr) : -@@ -1826,26 +1818,30 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - c->sync_maxlen = mtu - hlen; - - if (state == IP_VS_STATE_MASTER) { -+ result = -EEXIST; - if (ipvs->ms) -- return -EEXIST; -+ goto out_early; - - ipvs->mcfg = *c; - name = "ipvs-m:%d:%d"; - threadfn = sync_thread_master; - } else if (state == IP_VS_STATE_BACKUP) { -+ result = -EEXIST; - if (ipvs->backup_threads) -- return -EEXIST; -+ goto out_early; - - ipvs->bcfg = *c; - name = "ipvs-b:%d:%d"; - threadfn = sync_thread_backup; - } else { -- return -EINVAL; -+ result = -EINVAL; -+ goto out_early; - } - - if (state == IP_VS_STATE_MASTER) { - struct ipvs_master_sync_state *ms; - -+ result = -ENOMEM; - ipvs->ms = kzalloc(count * sizeof(ipvs->ms[0]), GFP_KERNEL); - if (!ipvs->ms) - goto out; -@@ -1861,39 +1857,38 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - } else { - array = kzalloc(count * sizeof(struct task_struct *), - GFP_KERNEL); -+ result = -ENOMEM; - if (!array) + mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu; + +- if (skb_dst(skb)) +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + + if (skb->protocol == htons(ETH_P_IP)) { + if (!skb_is_gso(skb) && +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index 89453cf62158..c9cd891f69c2 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -209,7 +209,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, + + mtu = dst_mtu(dst); + if (skb->len > mtu) { +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + if (skb->protocol == htons(ETH_P_IP)) { + icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, + htonl(mtu)); +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 7e11f6a811f5..d61a82fd4b60 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -652,7 +652,7 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, + if (rel_info > dst_mtu(skb_dst(skb2))) goto out; - } -- tinfo = NULL; - for (id = 0; id < count; id++) { -- if (state == IP_VS_STATE_MASTER) -- sock = make_send_sock(ipvs, id); -- else -- sock = make_receive_sock(ipvs, id, dev->ifindex); -- if (IS_ERR(sock)) { -- result = PTR_ERR(sock); -- goto outtinfo; -- } -+ result = -ENOMEM; - tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL); - if (!tinfo) -- goto outsocket; -+ goto out; - tinfo->ipvs = ipvs; -- tinfo->sock = sock; -+ tinfo->sock = NULL; - if (state == IP_VS_STATE_BACKUP) { - tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen, - GFP_KERNEL); - if (!tinfo->buf) -- goto outtinfo; -+ goto out; - } else { - tinfo->buf = NULL; - } - tinfo->id = id; -+ if (state == IP_VS_STATE_MASTER) -+ result = make_send_sock(ipvs, id, dev, &tinfo->sock); -+ else -+ result = make_receive_sock(ipvs, id, dev, &tinfo->sock); -+ if (result < 0) -+ goto out; - - task = kthread_run(threadfn, tinfo, name, ipvs->gen, id); - if (IS_ERR(task)) { - result = PTR_ERR(task); -- goto outtinfo; -+ goto out; - } - tinfo = NULL; - if (state == IP_VS_STATE_MASTER) -@@ -1910,20 +1905,20 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, - ipvs->sync_state |= state; - spin_unlock_bh(&ipvs->sync_buff_lock); - -+ mutex_unlock(&ipvs->sync_mutex); -+ rtnl_unlock(); -+ - /* increase the module use count */ - ip_vs_use_count_inc(); - - return 0; - --outsocket: -- sock_release(sock); -- --outtinfo: -- if (tinfo) { -- sock_release(tinfo->sock); -- kfree(tinfo->buf); -- kfree(tinfo); -- } -+out: -+ /* We do not need RTNL lock anymore, release it here so that -+ * sock_release below and in the kthreads can use rtnl_lock -+ * to leave the mcast group. -+ */ -+ rtnl_unlock(); - count = id; - while (count-- > 0) { - if (state == IP_VS_STATE_MASTER) -@@ -1931,13 +1926,23 @@ outtinfo: - else - kthread_stop(array[count]); +- skb_dst(skb2)->ops->update_pmtu(skb_dst(skb2), NULL, skb2, rel_info); ++ skb_dst_update_pmtu(skb2, rel_info); } -- kfree(array); -- --out: - if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) { - kfree(ipvs->ms); - ipvs->ms = NULL; + if (rel_type == ICMP_REDIRECT) + skb_dst(skb2)->ops->redirect(skb_dst(skb2), NULL, skb2); +@@ -1141,8 +1141,7 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + mtu = 576; } -+ mutex_unlock(&ipvs->sync_mutex); -+ if (tinfo) { -+ if (tinfo->sock) -+ sock_release(tinfo->sock); -+ kfree(tinfo->buf); -+ kfree(tinfo); -+ } -+ kfree(array); -+ return result; -+ -+out_early: -+ mutex_unlock(&ipvs->sync_mutex); -+ rtnl_unlock(); - return result; - } - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 98fe9691337c..818400fddc9b 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -1795,6 +1795,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - - if (msg->msg_namelen) { - err = -EINVAL; -+ if (msg->msg_namelen < sizeof(struct sockaddr_nl)) -+ goto out; - if (addr->nl_family != AF_NETLINK) - goto out; - dst_portid = addr->nl_pid; -diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c -index 93127220cb54..e6e249cc651c 100644 ---- a/net/rfkill/rfkill-gpio.c -+++ b/net/rfkill/rfkill-gpio.c -@@ -140,13 +140,18 @@ static int rfkill_gpio_probe(struct platform_device *pdev) - ret = rfkill_register(rfkill->rfkill_dev); - if (ret < 0) -- return ret; -+ goto err_destroy; - - platform_set_drvdata(pdev, rfkill); +- if (skb_dst(skb) && !t->parms.collect_md) +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { + *pmtu = mtu; + err = -EMSGSIZE; +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 7c0f647b5195..2493a40bc4b1 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -486,7 +486,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) + + mtu = dst_mtu(dst); + if (!skb->ignore_df && skb->len > mtu) { +- skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); ++ skb_dst_update_pmtu(skb, mtu); + + if (skb->protocol == htons(ETH_P_IPV6)) { + if (mtu < IPV6_MIN_MTU) +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index f03c1a562135..b35d8905794c 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -925,8 +925,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb, + df = 0; + } - dev_info(&pdev->dev, "%s device registered.\n", rfkill->name); +- if (tunnel->parms.iph.daddr && skb_dst(skb)) +- skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); ++ if (tunnel->parms.iph.daddr) ++ skb_dst_update_pmtu(skb, mtu); - return 0; -+ -+err_destroy: -+ rfkill_destroy(rfkill->rfkill_dev); -+ -+ return ret; - } - - static int rfkill_gpio_remove(struct platform_device *pdev) -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 5d9f25cb6426..90270d7110a3 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -2480,7 +2480,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - - #ifdef CONFIG_COMPAT - if (is_compat_task()) -- return -ENOTSUPP; -+ return -EOPNOTSUPP; - #endif - - type = nlh->nlmsg_type; + if (skb->len > mtu && !skb_is_gso(skb)) { + icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); diff --git a/sound/core/pcm_compat.c b/sound/core/pcm_compat.c -index 1f64ab0c2a95..7ae080bae15c 100644 +index 06d7c40af570..6491afbb5fd5 100644 --- a/sound/core/pcm_compat.c +++ b/sound/core/pcm_compat.c -@@ -426,6 +426,8 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream, +@@ -423,6 +423,8 @@ static int snd_pcm_ioctl_xfern_compat(struct snd_pcm_substream *substream, return -ENOTTY; if (substream->stream != dir) return -EINVAL; @@ -2801,7 +2379,7 @@ index 1f64ab0c2a95..7ae080bae15c 100644 if ((ch = substream->runtime->channels) > 128) return -EINVAL; diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c -index 3b126af4a026..ef494ffc1369 100644 +index f48a4cd24ffc..289ae6bb81d9 100644 --- a/sound/core/seq/seq_virmidi.c +++ b/sound/core/seq/seq_virmidi.c @@ -174,12 +174,12 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream, @@ -2820,7 +2398,7 @@ index 3b126af4a026..ef494ffc1369 100644 count = __snd_rawmidi_transmit_peek(substream, buf, sizeof(buf)); if (count <= 0) diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c -index dc91002d1e0d..847f70348d4d 100644 +index 829e2f6bfb73..dfd30a80ece8 100644 --- a/sound/drivers/aloop.c +++ b/sound/drivers/aloop.c @@ -296,6 +296,8 @@ static int loopback_trigger(struct snd_pcm_substream *substream, int cmd) @@ -2928,11 +2506,47 @@ index dc91002d1e0d..847f70348d4d 100644 return 0; } +diff --git a/sound/firewire/amdtp-stream.c b/sound/firewire/amdtp-stream.c +index 3fc581a5ad62..d7d47dc8b5f1 100644 +--- a/sound/firewire/amdtp-stream.c ++++ b/sound/firewire/amdtp-stream.c +@@ -773,8 +773,6 @@ static void amdtp_stream_first_callback(struct fw_iso_context *context, + u32 cycle; + unsigned int packets; + +- s->max_payload_length = amdtp_stream_get_max_payload(s); +- + /* + * For in-stream, first packet has come. + * For out-stream, prepared to transmit first packet +@@ -879,6 +877,9 @@ int amdtp_stream_start(struct amdtp_stream *s, int channel, int speed) + + amdtp_stream_update(s); + ++ if (s->direction == AMDTP_IN_STREAM) ++ s->max_payload_length = amdtp_stream_get_max_payload(s); ++ + if (s->flags & CIP_NO_HEADER) + s->tag = TAG_NO_CIP_HEADER; + else +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 59daf9901466..6ae061183eff 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3722,7 +3722,7 @@ static void alc280_fixup_hp_gpio4(struct hda_codec *codec, + } + } + +-#if IS_REACHABLE(INPUT) ++#if IS_REACHABLE(CONFIG_INPUT) + static void gpio2_mic_hotkey_event(struct hda_codec *codec, + struct hda_jack_callback *event) + { diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh -index 61f9b1dbbd9b..63c310cdac09 100755 +index 13ade39fe832..13ecf4b61b2b 100755 --- a/tools/testing/selftests/firmware/fw_filesystem.sh +++ b/tools/testing/selftests/firmware/fw_filesystem.sh -@@ -29,9 +29,11 @@ test_finish() +@@ -46,9 +46,11 @@ test_finish() echo "$OLD_TIMEOUT" >/sys/class/firmware/timeout fi if [ "$OLD_FWPATH" = "" ]; then diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.40-41.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.40-41.patch new file mode 100644 index 000000000000..dea50ad5d236 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.40-41.patch @@ -0,0 +1,2289 @@ +diff --git a/Documentation/arm64/silicon-errata.txt b/Documentation/arm64/silicon-errata.txt +index f3d0d316d5f1..e4fe6adc372b 100644 +--- a/Documentation/arm64/silicon-errata.txt ++++ b/Documentation/arm64/silicon-errata.txt +@@ -55,6 +55,7 @@ stable kernels. + | ARM | Cortex-A57 | #834220 | ARM64_ERRATUM_834220 | + | ARM | Cortex-A72 | #853709 | N/A | + | ARM | Cortex-A73 | #858921 | ARM64_ERRATUM_858921 | ++| ARM | Cortex-A55 | #1024718 | ARM64_ERRATUM_1024718 | + | ARM | MMU-500 | #841119,#826419 | N/A | + | | | | | + | Cavium | ThunderX ITS | #22375, #24313 | CAVIUM_ERRATUM_22375 | +diff --git a/Makefile b/Makefile +index 6eede39f898a..c23d0b0c6c45 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 40 ++SUBLEVEL = 41 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index c2abb4e88ff2..2d5f7aca156d 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -443,6 +443,20 @@ config ARM64_ERRATUM_843419 + + If unsure, say Y. + ++config ARM64_ERRATUM_1024718 ++ bool "Cortex-A55: 1024718: Update of DBM/AP bits without break before make might result in incorrect update" ++ default y ++ help ++ This option adds work around for Arm Cortex-A55 Erratum 1024718. ++ ++ Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect ++ update of the hardware dirty bit when the DBM/AP bits are updated ++ without a break-before-make. The work around is to disable the usage ++ of hardware DBM locally on the affected cores. CPUs not affected by ++ erratum will continue to use the feature. ++ ++ If unsure, say Y. ++ + config CAVIUM_ERRATUM_22375 + bool "Cavium erratum 22375, 24313" + default y +diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h +index 463619dcadd4..25b2a4161c7a 100644 +--- a/arch/arm64/include/asm/assembler.h ++++ b/arch/arm64/include/asm/assembler.h +@@ -25,6 +25,7 @@ + + #include + #include ++#include + #include + #include + #include +@@ -495,4 +496,43 @@ alternative_endif + and \phys, \pte, #(((1 << (48 - PAGE_SHIFT)) - 1) << PAGE_SHIFT) + .endm + ++/* ++ * Check the MIDR_EL1 of the current CPU for a given model and a range of ++ * variant/revision. See asm/cputype.h for the macros used below. ++ * ++ * model: MIDR_CPU_MODEL of CPU ++ * rv_min: Minimum of MIDR_CPU_VAR_REV() ++ * rv_max: Maximum of MIDR_CPU_VAR_REV() ++ * res: Result register. ++ * tmp1, tmp2, tmp3: Temporary registers ++ * ++ * Corrupts: res, tmp1, tmp2, tmp3 ++ * Returns: 0, if the CPU id doesn't match. Non-zero otherwise ++ */ ++ .macro cpu_midr_match model, rv_min, rv_max, res, tmp1, tmp2, tmp3 ++ mrs \res, midr_el1 ++ mov_q \tmp1, (MIDR_REVISION_MASK | MIDR_VARIANT_MASK) ++ mov_q \tmp2, MIDR_CPU_MODEL_MASK ++ and \tmp3, \res, \tmp2 // Extract model ++ and \tmp1, \res, \tmp1 // rev & variant ++ mov_q \tmp2, \model ++ cmp \tmp3, \tmp2 ++ cset \res, eq ++ cbz \res, .Ldone\@ // Model matches ? ++ ++ .if (\rv_min != 0) // Skip min check if rv_min == 0 ++ mov_q \tmp3, \rv_min ++ cmp \tmp1, \tmp3 ++ cset \res, ge ++ .endif // \rv_min != 0 ++ /* Skip rv_max check if rv_min == rv_max && rv_min != 0 */ ++ .if ((\rv_min != \rv_max) || \rv_min == 0) ++ mov_q \tmp2, \rv_max ++ cmp \tmp1, \tmp2 ++ cset \tmp2, le ++ and \res, \res, \tmp2 ++ .endif ++.Ldone\@: ++ .endm ++ + #endif /* __ASM_ASSEMBLER_H */ +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index be7bd19c87ec..30da0918d046 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -78,6 +78,7 @@ + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 ++#define ARM_CPU_PART_CORTEX_A55 0xD05 + #define ARM_CPU_PART_CORTEX_A57 0xD07 + #define ARM_CPU_PART_CORTEX_A72 0xD08 + #define ARM_CPU_PART_CORTEX_A53 0xD03 +@@ -98,6 +99,7 @@ + #define QCOM_CPU_PART_KRYO 0x200 + + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) ++#define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) + #define MIDR_CORTEX_A72 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A72) + #define MIDR_CORTEX_A73 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A73) +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index 139320a7f7a2..e338165000e6 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -438,6 +438,11 @@ ENTRY(__cpu_setup) + cbz x9, 2f + cmp x9, #2 + b.lt 1f ++#ifdef CONFIG_ARM64_ERRATUM_1024718 ++ /* Disable hardware DBM on Cortex-A55 r0p0, r0p1 & r1p0 */ ++ cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(1, 0), x1, x2, x3, x4 ++ cbnz x1, 1f ++#endif + orr x10, x10, #TCR_HD // hardware Dirty flag update + 1: orr x10, x10, #TCR_HA // hardware Access flag update + 2: +diff --git a/arch/powerpc/kvm/book3s_64_mmu_radix.c b/arch/powerpc/kvm/book3s_64_mmu_radix.c +index c5d7435455f1..27a41695fcfd 100644 +--- a/arch/powerpc/kvm/book3s_64_mmu_radix.c ++++ b/arch/powerpc/kvm/book3s_64_mmu_radix.c +@@ -19,6 +19,9 @@ + #include + #include + ++static void mark_pages_dirty(struct kvm *kvm, struct kvm_memory_slot *memslot, ++ unsigned long gfn, unsigned int order); ++ + /* + * Supported radix tree geometry. + * Like p9, we support either 5 or 9 bits at the first (lowest) level, +@@ -195,6 +198,12 @@ static void kvmppc_pte_free(pte_t *ptep) + kmem_cache_free(kvm_pte_cache, ptep); + } + ++/* Like pmd_huge() and pmd_large(), but works regardless of config options */ ++static inline int pmd_is_leaf(pmd_t pmd) ++{ ++ return !!(pmd_val(pmd) & _PAGE_PTE); ++} ++ + static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa, + unsigned int level, unsigned long mmu_seq) + { +@@ -219,7 +228,7 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa, + else + new_pmd = pmd_alloc_one(kvm->mm, gpa); + +- if (level == 0 && !(pmd && pmd_present(*pmd))) ++ if (level == 0 && !(pmd && pmd_present(*pmd) && !pmd_is_leaf(*pmd))) + new_ptep = kvmppc_pte_alloc(); + + /* Check if we might have been invalidated; let the guest retry if so */ +@@ -244,12 +253,30 @@ static int kvmppc_create_pte(struct kvm *kvm, pte_t pte, unsigned long gpa, + new_pmd = NULL; + } + pmd = pmd_offset(pud, gpa); +- if (pmd_large(*pmd)) { +- /* Someone else has instantiated a large page here; retry */ +- ret = -EAGAIN; +- goto out_unlock; +- } +- if (level == 1 && !pmd_none(*pmd)) { ++ if (pmd_is_leaf(*pmd)) { ++ unsigned long lgpa = gpa & PMD_MASK; ++ ++ /* ++ * If we raced with another CPU which has just put ++ * a 2MB pte in after we saw a pte page, try again. ++ */ ++ if (level == 0 && !new_ptep) { ++ ret = -EAGAIN; ++ goto out_unlock; ++ } ++ /* Valid 2MB page here already, remove it */ ++ old = kvmppc_radix_update_pte(kvm, pmdp_ptep(pmd), ++ ~0UL, 0, lgpa, PMD_SHIFT); ++ kvmppc_radix_tlbie_page(kvm, lgpa, PMD_SHIFT); ++ if (old & _PAGE_DIRTY) { ++ unsigned long gfn = lgpa >> PAGE_SHIFT; ++ struct kvm_memory_slot *memslot; ++ memslot = gfn_to_memslot(kvm, gfn); ++ if (memslot) ++ mark_pages_dirty(kvm, memslot, gfn, ++ PMD_SHIFT - PAGE_SHIFT); ++ } ++ } else if (level == 1 && !pmd_none(*pmd)) { + /* + * There's a page table page here, but we wanted + * to install a large page. Tell the caller and let +@@ -412,28 +439,24 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu, + } else { + page = pages[0]; + pfn = page_to_pfn(page); +- if (PageHuge(page)) { +- page = compound_head(page); +- pte_size <<= compound_order(page); ++ if (PageCompound(page)) { ++ pte_size <<= compound_order(compound_head(page)); + /* See if we can insert a 2MB large-page PTE here */ + if (pte_size >= PMD_SIZE && +- (gpa & PMD_MASK & PAGE_MASK) == +- (hva & PMD_MASK & PAGE_MASK)) { ++ (gpa & (PMD_SIZE - PAGE_SIZE)) == ++ (hva & (PMD_SIZE - PAGE_SIZE))) { + level = 1; + pfn &= ~((PMD_SIZE >> PAGE_SHIFT) - 1); + } + } + /* See if we can provide write access */ + if (writing) { +- /* +- * We assume gup_fast has set dirty on the host PTE. +- */ + pgflags |= _PAGE_WRITE; + } else { + local_irq_save(flags); + ptep = find_current_mm_pte(current->mm->pgd, + hva, NULL, NULL); +- if (ptep && pte_write(*ptep) && pte_dirty(*ptep)) ++ if (ptep && pte_write(*ptep)) + pgflags |= _PAGE_WRITE; + local_irq_restore(flags); + } +@@ -459,18 +482,15 @@ int kvmppc_book3s_radix_page_fault(struct kvm_run *run, struct kvm_vcpu *vcpu, + pte = pfn_pte(pfn, __pgprot(pgflags)); + ret = kvmppc_create_pte(kvm, pte, gpa, level, mmu_seq); + } +- if (ret == 0 || ret == -EAGAIN) +- ret = RESUME_GUEST; + + if (page) { +- /* +- * We drop pages[0] here, not page because page might +- * have been set to the head page of a compound, but +- * we have to drop the reference on the correct tail +- * page to match the get inside gup() +- */ +- put_page(pages[0]); ++ if (!ret && (pgflags & _PAGE_WRITE)) ++ set_page_dirty_lock(page); ++ put_page(page); + } ++ ++ if (ret == 0 || ret == -EAGAIN) ++ ret = RESUME_GUEST; + return ret; + } + +@@ -676,7 +696,7 @@ void kvmppc_free_radix(struct kvm *kvm) + continue; + pmd = pmd_offset(pud, 0); + for (im = 0; im < PTRS_PER_PMD; ++im, ++pmd) { +- if (pmd_huge(*pmd)) { ++ if (pmd_is_leaf(*pmd)) { + pmd_clear(pmd); + continue; + } +diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c +index e094dc90ff1b..377d1420bd02 100644 +--- a/arch/powerpc/kvm/book3s_hv.c ++++ b/arch/powerpc/kvm/book3s_hv.c +@@ -2847,7 +2847,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc) + */ + trace_hardirqs_on(); + +- guest_enter(); ++ guest_enter_irqoff(); + + srcu_idx = srcu_read_lock(&vc->kvm->srcu); + +@@ -2855,8 +2855,6 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc) + + srcu_read_unlock(&vc->kvm->srcu, srcu_idx); + +- guest_exit(); +- + trace_hardirqs_off(); + set_irq_happened(trap); + +@@ -2890,6 +2888,7 @@ static noinline void kvmppc_run_core(struct kvmppc_vcore *vc) + kvmppc_set_host_core(pcpu); + + local_irq_enable(); ++ guest_exit(); + + /* Let secondaries go back to the offline loop */ + for (i = 0; i < controlled_threads; ++i) { +@@ -3619,15 +3618,17 @@ static int kvmppc_hv_setup_htab_rma(struct kvm_vcpu *vcpu) + goto up_out; + + psize = vma_kernel_pagesize(vma); +- porder = __ilog2(psize); + + up_read(¤t->mm->mmap_sem); + + /* We can handle 4k, 64k or 16M pages in the VRMA */ +- err = -EINVAL; +- if (!(psize == 0x1000 || psize == 0x10000 || +- psize == 0x1000000)) +- goto out_srcu; ++ if (psize >= 0x1000000) ++ psize = 0x1000000; ++ else if (psize >= 0x10000) ++ psize = 0x10000; ++ else ++ psize = 0x1000; ++ porder = __ilog2(psize); + + senc = slb_pgsize_encoding(psize); + kvm->arch.vrma_slb_v = senc | SLB_VSID_B_1T | +diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +index 2b3194b9608f..663a398449b7 100644 +--- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S ++++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S +@@ -308,7 +308,6 @@ kvm_novcpu_exit: + stw r12, STACK_SLOT_TRAP(r1) + bl kvmhv_commence_exit + nop +- lwz r12, STACK_SLOT_TRAP(r1) + b kvmhv_switch_to_host + + /* +@@ -1136,6 +1135,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + + secondary_too_late: + li r12, 0 ++ stw r12, STACK_SLOT_TRAP(r1) + cmpdi r4, 0 + beq 11f + stw r12, VCPU_TRAP(r4) +@@ -1445,12 +1445,12 @@ mc_cont: + 1: + #endif /* CONFIG_KVM_XICS */ + ++ stw r12, STACK_SLOT_TRAP(r1) + mr r3, r12 + /* Increment exit count, poke other threads to exit */ + bl kvmhv_commence_exit + nop + ld r9, HSTATE_KVM_VCPU(r13) +- lwz r12, VCPU_TRAP(r9) + + /* Stop others sending VCPU interrupts to this physical CPU */ + li r0, -1 +@@ -1816,6 +1816,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_POWER9_DD1) + * POWER7/POWER8 guest -> host partition switch code. + * We don't have to lock against tlbies but we do + * have to coordinate the hardware threads. ++ * Here STACK_SLOT_TRAP(r1) contains the trap number. + */ + kvmhv_switch_to_host: + /* Secondary threads wait for primary to do partition switch */ +@@ -1868,11 +1869,11 @@ BEGIN_FTR_SECTION + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) + + /* If HMI, call kvmppc_realmode_hmi_handler() */ ++ lwz r12, STACK_SLOT_TRAP(r1) + cmpwi r12, BOOK3S_INTERRUPT_HMI + bne 27f + bl kvmppc_realmode_hmi_handler + nop +- li r12, BOOK3S_INTERRUPT_HMI + /* + * At this point kvmppc_realmode_hmi_handler would have resync-ed + * the TB. Hence it is not required to subtract guest timebase +@@ -1950,6 +1951,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_TYPE_RADIX) + li r0, KVM_GUEST_MODE_NONE + stb r0, HSTATE_IN_GUEST(r13) + ++ lwz r12, STACK_SLOT_TRAP(r1) /* return trap # in r12 */ + ld r0, SFS+PPC_LR_STKOFF(r1) + addi r1, r1, SFS + mtlr r0 +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 589af1eec7c1..011a47b4587c 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -304,17 +305,20 @@ set_ext_hw_attr(struct hw_perf_event *hwc, struct perf_event *event) + + config = attr->config; + +- cache_type = (config >> 0) & 0xff; ++ cache_type = (config >> 0) & 0xff; + if (cache_type >= PERF_COUNT_HW_CACHE_MAX) + return -EINVAL; ++ cache_type = array_index_nospec(cache_type, PERF_COUNT_HW_CACHE_MAX); + + cache_op = (config >> 8) & 0xff; + if (cache_op >= PERF_COUNT_HW_CACHE_OP_MAX) + return -EINVAL; ++ cache_op = array_index_nospec(cache_op, PERF_COUNT_HW_CACHE_OP_MAX); + + cache_result = (config >> 16) & 0xff; + if (cache_result >= PERF_COUNT_HW_CACHE_RESULT_MAX) + return -EINVAL; ++ cache_result = array_index_nospec(cache_result, PERF_COUNT_HW_CACHE_RESULT_MAX); + + val = hw_cache_event_ids[cache_type][cache_op][cache_result]; + +@@ -421,6 +425,8 @@ int x86_setup_perfctr(struct perf_event *event) + if (attr->config >= x86_pmu.max_events) + return -EINVAL; + ++ attr->config = array_index_nospec((unsigned long)attr->config, x86_pmu.max_events); ++ + /* + * The generic map: + */ +diff --git a/arch/x86/events/intel/cstate.c b/arch/x86/events/intel/cstate.c +index 72db0664a53d..357e82dc0e2a 100644 +--- a/arch/x86/events/intel/cstate.c ++++ b/arch/x86/events/intel/cstate.c +@@ -91,6 +91,7 @@ + #include + #include + #include ++#include + #include + #include + #include "../perf_event.h" +@@ -301,6 +302,7 @@ static int cstate_pmu_event_init(struct perf_event *event) + } else if (event->pmu == &cstate_pkg_pmu) { + if (cfg >= PERF_CSTATE_PKG_EVENT_MAX) + return -EINVAL; ++ cfg = array_index_nospec((unsigned long)cfg, PERF_CSTATE_PKG_EVENT_MAX); + if (!pkg_msr[cfg].attr) + return -EINVAL; + event->hw.event_base = pkg_msr[cfg].msr; +diff --git a/arch/x86/events/msr.c b/arch/x86/events/msr.c +index 14efaa0e8684..81dd57280441 100644 +--- a/arch/x86/events/msr.c ++++ b/arch/x86/events/msr.c +@@ -1,5 +1,6 @@ + // SPDX-License-Identifier: GPL-2.0 + #include ++#include + #include + + enum perf_msr_id { +@@ -145,9 +146,6 @@ static int msr_event_init(struct perf_event *event) + if (event->attr.type != event->pmu->type) + return -ENOENT; + +- if (cfg >= PERF_MSR_EVENT_MAX) +- return -EINVAL; +- + /* unsupported modes and filters */ + if (event->attr.exclude_user || + event->attr.exclude_kernel || +@@ -158,6 +156,11 @@ static int msr_event_init(struct perf_event *event) + event->attr.sample_period) /* no sampling */ + return -EINVAL; + ++ if (cfg >= PERF_MSR_EVENT_MAX) ++ return -EINVAL; ++ ++ cfg = array_index_nospec((unsigned long)cfg, PERF_MSR_EVENT_MAX); ++ + if (!msr[cfg].attr) + return -EINVAL; + +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 8cfdb6484fd0..ab8993fe58cc 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -1418,23 +1418,6 @@ static void start_sw_tscdeadline(struct kvm_lapic *apic) + local_irq_restore(flags); + } + +-static void start_sw_period(struct kvm_lapic *apic) +-{ +- if (!apic->lapic_timer.period) +- return; +- +- if (apic_lvtt_oneshot(apic) && +- ktime_after(ktime_get(), +- apic->lapic_timer.target_expiration)) { +- apic_timer_expired(apic); +- return; +- } +- +- hrtimer_start(&apic->lapic_timer.timer, +- apic->lapic_timer.target_expiration, +- HRTIMER_MODE_ABS_PINNED); +-} +- + static bool set_target_expiration(struct kvm_lapic *apic) + { + ktime_t now; +@@ -1491,6 +1474,26 @@ static void advance_periodic_target_expiration(struct kvm_lapic *apic) + apic->lapic_timer.period); + } + ++static void start_sw_period(struct kvm_lapic *apic) ++{ ++ if (!apic->lapic_timer.period) ++ return; ++ ++ if (ktime_after(ktime_get(), ++ apic->lapic_timer.target_expiration)) { ++ apic_timer_expired(apic); ++ ++ if (apic_lvtt_oneshot(apic)) ++ return; ++ ++ advance_periodic_target_expiration(apic); ++ } ++ ++ hrtimer_start(&apic->lapic_timer.timer, ++ apic->lapic_timer.target_expiration, ++ HRTIMER_MODE_ABS_PINNED); ++} ++ + bool kvm_lapic_hv_timer_in_use(struct kvm_vcpu *vcpu) + { + if (!lapic_in_kernel(vcpu)) +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 4e4640bb82b9..815ee1075574 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -158,16 +158,16 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + void *private; + int err; + +- /* If caller uses non-allowed flag, return error. */ +- if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) +- return -EINVAL; +- + if (sock->state == SS_CONNECTED) + return -EINVAL; + + if (addr_len < sizeof(*sa)) + return -EINVAL; + ++ /* If caller uses non-allowed flag, return error. */ ++ if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) ++ return -EINVAL; ++ + sa->salg_type[sizeof(sa->salg_type) - 1] = 0; + sa->salg_name[sizeof(sa->salg_name) + addr_len - sizeof(*sa) - 1] = 0; + +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index c6fe2974b336..473f150d6b22 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4539,6 +4539,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM | + ATA_HORKAGE_NOLPM, }, + ++ /* Sandisk devices which are known to not handle LPM well */ ++ { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, }, ++ + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c +index 1ef67db03c8e..9c9a22958717 100644 +--- a/drivers/atm/zatm.c ++++ b/drivers/atm/zatm.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + #include "uPD98401.h" + #include "uPD98402.h" +@@ -1458,6 +1459,8 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg) + return -EFAULT; + if (pool < 0 || pool > ZATM_LAST_POOL) + return -EINVAL; ++ pool = array_index_nospec(pool, ++ ZATM_LAST_POOL + 1); + spin_lock_irqsave(&zatm_dev->lock, flags); + info = zatm_dev->pool_info[pool]; + if (cmd == ZATM_GETPOOLZ) { +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index e9dff868c028..7fcc4d7f4909 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -235,6 +235,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0930, 0x0227), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0b05, 0x17d0), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x0036), .driver_info = BTUSB_ATH3012 }, ++ { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x3008), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311d), .driver_info = BTUSB_ATH3012 }, + { USB_DEVICE(0x0cf3, 0x311e), .driver_info = BTUSB_ATH3012 }, +@@ -267,7 +268,6 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x0489, 0xe03c), .driver_info = BTUSB_ATH3012 }, + + /* QCA ROME chipset */ +- { USB_DEVICE(0x0cf3, 0x3004), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe007), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe009), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x0cf3, 0xe300), .driver_info = BTUSB_QCA_ROME }, +@@ -395,6 +395,13 @@ static const struct dmi_system_id btusb_needs_reset_resume_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "OptiPlex 3060"), + }, + }, ++ { ++ /* Dell XPS 9360 (QCA ROME device 0cf3:e300) */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), ++ }, ++ }, + {} + }; + +@@ -2895,6 +2902,12 @@ static int btusb_config_oob_wake(struct hci_dev *hdev) + } + #endif + ++static void btusb_check_needs_reset_resume(struct usb_interface *intf) ++{ ++ if (dmi_check_system(btusb_needs_reset_resume_table)) ++ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; ++} ++ + static int btusb_probe(struct usb_interface *intf, + const struct usb_device_id *id) + { +@@ -3030,9 +3043,6 @@ static int btusb_probe(struct usb_interface *intf, + hdev->send = btusb_send_frame; + hdev->notify = btusb_notify; + +- if (dmi_check_system(btusb_needs_reset_resume_table)) +- interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; +- + #ifdef CONFIG_PM + err = btusb_config_oob_wake(hdev); + if (err) +@@ -3119,6 +3129,7 @@ static int btusb_probe(struct usb_interface *intf, + if (id->driver_info & BTUSB_QCA_ROME) { + data->setup_on_usb = btusb_setup_qca; + hdev->set_bdaddr = btusb_set_bdaddr_ath3012; ++ btusb_check_needs_reset_resume(intf); + } + + #ifdef CONFIG_BT_HCIBTUSB_RTL +diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c +index bfc53995064a..f03fe916eb9d 100644 +--- a/drivers/gpio/gpio-aspeed.c ++++ b/drivers/gpio/gpio-aspeed.c +@@ -375,7 +375,7 @@ static void aspeed_gpio_irq_set_mask(struct irq_data *d, bool set) + if (set) + reg |= bit; + else +- reg &= bit; ++ reg &= ~bit; + iowrite32(reg, addr); + + spin_unlock_irqrestore(&gpio->lock, flags); +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index b4c8b25453a6..68ea6e712bf9 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -443,7 +443,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) + struct gpiohandle_request handlereq; + struct linehandle_state *lh; + struct file *file; +- int fd, i, ret; ++ int fd, i, count = 0, ret; + + if (copy_from_user(&handlereq, ip, sizeof(handlereq))) + return -EFAULT; +@@ -489,6 +489,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) + if (ret) + goto out_free_descs; + lh->descs[i] = desc; ++ count = i; + + if (lflags & GPIOHANDLE_REQUEST_ACTIVE_LOW) + set_bit(FLAG_ACTIVE_LOW, &desc->flags); +@@ -555,7 +556,7 @@ static int linehandle_create(struct gpio_device *gdev, void __user *ip) + out_put_unused_fd: + put_unused_fd(fd); + out_free_descs: +- for (; i >= 0; i--) ++ for (i = 0; i < count; i++) + gpiod_free(lh->descs[i]); + kfree(lh->label); + out_free_lh: +@@ -812,7 +813,7 @@ static int lineevent_create(struct gpio_device *gdev, void __user *ip) + desc = &gdev->descs[offset]; + ret = gpiod_request(desc, le->label); + if (ret) +- goto out_free_desc; ++ goto out_free_label; + le->desc = desc; + le->eflags = eflags; + +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 2fd383d7253a..0d8a417e2cd6 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -151,6 +151,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) + state->connectors[i].state); + state->connectors[i].ptr = NULL; + state->connectors[i].state = NULL; ++ state->connectors[i].old_state = NULL; ++ state->connectors[i].new_state = NULL; + drm_connector_put(connector); + } + +@@ -172,6 +174,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) + state->crtcs[i].commit = NULL; + state->crtcs[i].ptr = NULL; + state->crtcs[i].state = NULL; ++ state->crtcs[i].old_state = NULL; ++ state->crtcs[i].new_state = NULL; + } + + for (i = 0; i < config->num_total_plane; i++) { +@@ -184,6 +188,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) + state->planes[i].state); + state->planes[i].ptr = NULL; + state->planes[i].state = NULL; ++ state->planes[i].old_state = NULL; ++ state->planes[i].new_state = NULL; + } + + for (i = 0; i < state->num_private_objs; i++) { +@@ -196,6 +202,8 @@ void drm_atomic_state_default_clear(struct drm_atomic_state *state) + state->private_objs[i].state); + state->private_objs[i].ptr = NULL; + state->private_objs[i].state = NULL; ++ state->private_objs[i].old_state = NULL; ++ state->private_objs[i].new_state = NULL; + } + state->num_private_objs = 0; + +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 8e215777c7f4..240308f1b6dd 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -317,7 +317,8 @@ static void intel_enable_lvds(struct intel_encoder *encoder, + + I915_WRITE(PP_CONTROL(0), I915_READ(PP_CONTROL(0)) | PANEL_POWER_ON); + POSTING_READ(lvds_encoder->reg); +- if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 1000)) ++ ++ if (intel_wait_for_register(dev_priv, PP_STATUS(0), PP_ON, PP_ON, 5000)) + DRM_ERROR("timed out waiting for panel to power on\n"); + + intel_panel_enable_backlight(pipe_config, conn_state); +diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c +index 6e196bc01118..a29474528e85 100644 +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -3216,10 +3216,11 @@ nv50_mstm_destroy_connector(struct drm_dp_mst_topology_mgr *mgr, + + drm_connector_unregister(&mstc->connector); + +- drm_modeset_lock_all(drm->dev); + drm_fb_helper_remove_one_connector(&drm->fbcon->helper, &mstc->connector); ++ ++ drm_modeset_lock(&drm->dev->mode_config.connection_mutex, NULL); + mstc->port = NULL; +- drm_modeset_unlock_all(drm->dev); ++ drm_modeset_unlock(&drm->dev->mode_config.connection_mutex); + + drm_connector_unreference(&mstc->connector); + } +@@ -3229,9 +3230,7 @@ nv50_mstm_register_connector(struct drm_connector *connector) + { + struct nouveau_drm *drm = nouveau_drm(connector->dev); + +- drm_modeset_lock_all(drm->dev); + drm_fb_helper_add_one_connector(&drm->fbcon->helper, connector); +- drm_modeset_unlock_all(drm->dev); + + drm_connector_register(connector); + } +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 2968b3ebb895..77c56264c05b 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -535,7 +535,7 @@ static int vc4_plane_mode_set(struct drm_plane *plane, + * the scl fields here. + */ + if (num_planes == 1) { +- scl0 = vc4_get_scl_field(state, 1); ++ scl0 = vc4_get_scl_field(state, 0); + scl1 = scl0; + } else { + scl0 = vc4_get_scl_field(state, 1); +diff --git a/drivers/md/dm-integrity.c b/drivers/md/dm-integrity.c +index 3cc2052f972c..cbc56372ff97 100644 +--- a/drivers/md/dm-integrity.c ++++ b/drivers/md/dm-integrity.c +@@ -2439,7 +2439,7 @@ static void dm_integrity_free_journal_scatterlist(struct dm_integrity_c *ic, str + unsigned i; + for (i = 0; i < ic->journal_sections; i++) + kvfree(sl[i]); +- kfree(sl); ++ kvfree(sl); + } + + static struct scatterlist **dm_integrity_alloc_journal_scatterlist(struct dm_integrity_c *ic, struct page_list *pl) +diff --git a/drivers/net/can/spi/hi311x.c b/drivers/net/can/spi/hi311x.c +index 5590c559a8ca..53e320c92a8b 100644 +--- a/drivers/net/can/spi/hi311x.c ++++ b/drivers/net/can/spi/hi311x.c +@@ -91,6 +91,7 @@ + #define HI3110_STAT_BUSOFF BIT(2) + #define HI3110_STAT_ERRP BIT(3) + #define HI3110_STAT_ERRW BIT(4) ++#define HI3110_STAT_TXMTY BIT(7) + + #define HI3110_BTR0_SJW_SHIFT 6 + #define HI3110_BTR0_BRP_SHIFT 0 +@@ -427,8 +428,10 @@ static int hi3110_get_berr_counter(const struct net_device *net, + struct hi3110_priv *priv = netdev_priv(net); + struct spi_device *spi = priv->spi; + ++ mutex_lock(&priv->hi3110_lock); + bec->txerr = hi3110_read(spi, HI3110_READ_TEC); + bec->rxerr = hi3110_read(spi, HI3110_READ_REC); ++ mutex_unlock(&priv->hi3110_lock); + + return 0; + } +@@ -735,10 +738,7 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + } + } + +- if (intf == 0) +- break; +- +- if (intf & HI3110_INT_TXCPLT) { ++ if (priv->tx_len && statf & HI3110_STAT_TXMTY) { + net->stats.tx_packets++; + net->stats.tx_bytes += priv->tx_len - 1; + can_led_event(net, CAN_LED_EVENT_TX); +@@ -748,6 +748,9 @@ static irqreturn_t hi3110_can_ist(int irq, void *dev_id) + } + netif_wake_queue(net); + } ++ ++ if (intf == 0) ++ break; + } + mutex_unlock(&priv->hi3110_lock); + return IRQ_HANDLED; +diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c +index 63587b8e6825..daed57d3d209 100644 +--- a/drivers/net/can/usb/kvaser_usb.c ++++ b/drivers/net/can/usb/kvaser_usb.c +@@ -1179,7 +1179,7 @@ static void kvaser_usb_rx_can_msg(const struct kvaser_usb *dev, + + skb = alloc_can_skb(priv->netdev, &cf); + if (!skb) { +- stats->tx_dropped++; ++ stats->rx_dropped++; + return; + } + +diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h +index 044af553204c..7ef0a8e1c3e8 100644 +--- a/drivers/nvme/host/nvme.h ++++ b/drivers/nvme/host/nvme.h +@@ -80,6 +80,11 @@ enum nvme_quirks { + * Supports the LighNVM command set if indicated in vs[1]. + */ + NVME_QUIRK_LIGHTNVM = (1 << 6), ++ ++ /* ++ * Set MEDIUM priority on SQ creation ++ */ ++ NVME_QUIRK_MEDIUM_PRIO_SQ = (1 << 7), + }; + + /* +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index cdd2fd509ddc..eab17405e815 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -947,9 +947,18 @@ static int adapter_alloc_cq(struct nvme_dev *dev, u16 qid, + static int adapter_alloc_sq(struct nvme_dev *dev, u16 qid, + struct nvme_queue *nvmeq) + { ++ struct nvme_ctrl *ctrl = &dev->ctrl; + struct nvme_command c; + int flags = NVME_QUEUE_PHYS_CONTIG; + ++ /* ++ * Some drives have a bug that auto-enables WRRU if MEDIUM isn't ++ * set. Since URGENT priority is zeroes, it makes all queues ++ * URGENT. ++ */ ++ if (ctrl->quirks & NVME_QUIRK_MEDIUM_PRIO_SQ) ++ flags |= NVME_SQ_PRIO_MEDIUM; ++ + /* + * Note: we (ab)use the fact the the prp fields survive if no data + * is attached to the request. +@@ -2523,7 +2532,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_STRIPE_SIZE | + NVME_QUIRK_DEALLOCATE_ZEROES, }, + { PCI_VDEVICE(INTEL, 0xf1a5), /* Intel 600P/P3100 */ +- .driver_data = NVME_QUIRK_NO_DEEPEST_PS }, ++ .driver_data = NVME_QUIRK_NO_DEEPEST_PS | ++ NVME_QUIRK_MEDIUM_PRIO_SQ }, + { PCI_VDEVICE(INTEL, 0x5845), /* Qemu emulated controller */ + .driver_data = NVME_QUIRK_IDENTIFY_CNS, }, + { PCI_DEVICE(0x1c58, 0x0003), /* HGST adapter */ +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index 74f1c57ab93b..62a0677b32f1 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -1892,7 +1892,7 @@ void pci_pme_active(struct pci_dev *dev, bool enable) + EXPORT_SYMBOL(pci_pme_active); + + /** +- * pci_enable_wake - enable PCI device as wakeup event source ++ * __pci_enable_wake - enable PCI device as wakeup event source + * @dev: PCI device affected + * @state: PCI state from which device will issue wakeup events + * @enable: True to enable event generation; false to disable +@@ -1910,7 +1910,7 @@ EXPORT_SYMBOL(pci_pme_active); + * Error code depending on the platform is returned if both the platform and + * the native mechanism fail to enable the generation of wake-up events + */ +-int pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable) ++static int __pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable) + { + int ret = 0; + +@@ -1951,6 +1951,23 @@ int pci_enable_wake(struct pci_dev *dev, pci_power_t state, bool enable) + + return ret; + } ++ ++/** ++ * pci_enable_wake - change wakeup settings for a PCI device ++ * @pci_dev: Target device ++ * @state: PCI state from which device will issue wakeup events ++ * @enable: Whether or not to enable event generation ++ * ++ * If @enable is set, check device_may_wakeup() for the device before calling ++ * __pci_enable_wake() for it. ++ */ ++int pci_enable_wake(struct pci_dev *pci_dev, pci_power_t state, bool enable) ++{ ++ if (enable && !device_may_wakeup(&pci_dev->dev)) ++ return -EINVAL; ++ ++ return __pci_enable_wake(pci_dev, state, enable); ++} + EXPORT_SYMBOL(pci_enable_wake); + + /** +@@ -1963,9 +1980,9 @@ EXPORT_SYMBOL(pci_enable_wake); + * should not be called twice in a row to enable wake-up due to PCI PM vs ACPI + * ordering constraints. + * +- * This function only returns error code if the device is not capable of +- * generating PME# from both D3_hot and D3_cold, and the platform is unable to +- * enable wake-up power for it. ++ * This function only returns error code if the device is not allowed to wake ++ * up the system from sleep or it is not capable of generating PME# from both ++ * D3_hot and D3_cold and the platform is unable to enable wake-up power for it. + */ + int pci_wake_from_d3(struct pci_dev *dev, bool enable) + { +@@ -2096,7 +2113,7 @@ int pci_finish_runtime_suspend(struct pci_dev *dev) + + dev->runtime_d3cold = target_state == PCI_D3cold; + +- pci_enable_wake(dev, target_state, pci_dev_run_wake(dev)); ++ __pci_enable_wake(dev, target_state, pci_dev_run_wake(dev)); + + error = pci_set_power_state(dev, target_state); + +@@ -2120,16 +2137,16 @@ bool pci_dev_run_wake(struct pci_dev *dev) + { + struct pci_bus *bus = dev->bus; + +- if (device_can_wakeup(&dev->dev)) +- return true; +- + if (!dev->pme_support) + return false; + + /* PME-capable in principle, but not from the target power state */ +- if (!pci_pme_capable(dev, pci_target_state(dev, false))) ++ if (!pci_pme_capable(dev, pci_target_state(dev, true))) + return false; + ++ if (device_can_wakeup(&dev->dev)) ++ return true; ++ + while (bus->parent) { + struct pci_dev *bridge = bus->self; + +diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c +index ed805c7c5ace..ac83f721db24 100644 +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -185,6 +185,7 @@ + * @regulator: pointer to the TMU regulator structure. + * @reg_conf: pointer to structure to register with core thermal. + * @ntrip: number of supported trip points. ++ * @enabled: current status of TMU device + * @tmu_initialize: SoC specific TMU initialization method + * @tmu_control: SoC specific TMU control method + * @tmu_read: SoC specific TMU temperature read method +@@ -205,6 +206,7 @@ struct exynos_tmu_data { + struct regulator *regulator; + struct thermal_zone_device *tzd; + unsigned int ntrip; ++ bool enabled; + + int (*tmu_initialize)(struct platform_device *pdev); + void (*tmu_control)(struct platform_device *pdev, bool on); +@@ -398,6 +400,7 @@ static void exynos_tmu_control(struct platform_device *pdev, bool on) + mutex_lock(&data->lock); + clk_enable(data->clk); + data->tmu_control(pdev, on); ++ data->enabled = on; + clk_disable(data->clk); + mutex_unlock(&data->lock); + } +@@ -889,19 +892,24 @@ static void exynos7_tmu_control(struct platform_device *pdev, bool on) + static int exynos_get_temp(void *p, int *temp) + { + struct exynos_tmu_data *data = p; ++ int value, ret = 0; + +- if (!data || !data->tmu_read) ++ if (!data || !data->tmu_read || !data->enabled) + return -EINVAL; + + mutex_lock(&data->lock); + clk_enable(data->clk); + +- *temp = code_to_temp(data, data->tmu_read(data)) * MCELSIUS; ++ value = data->tmu_read(data); ++ if (value < 0) ++ ret = value; ++ else ++ *temp = code_to_temp(data, value) * MCELSIUS; + + clk_disable(data->clk); + mutex_unlock(&data->lock); + +- return 0; ++ return ret; + } + + #ifdef CONFIG_THERMAL_EMULATION +diff --git a/fs/ceph/file.c b/fs/ceph/file.c +index 0024d3e61bcd..6d653235e323 100644 +--- a/fs/ceph/file.c ++++ b/fs/ceph/file.c +@@ -873,6 +873,11 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + size_t start = 0; + ssize_t len; + ++ if (write) ++ size = min_t(u64, size, fsc->mount_options->wsize); ++ else ++ size = min_t(u64, size, fsc->mount_options->rsize); ++ + vino = ceph_vino(inode); + req = ceph_osdc_new_request(&fsc->client->osdc, &ci->i_layout, + vino, pos, &size, 0, +@@ -888,11 +893,6 @@ ceph_direct_read_write(struct kiocb *iocb, struct iov_iter *iter, + break; + } + +- if (write) +- size = min_t(u64, size, fsc->mount_options->wsize); +- else +- size = min_t(u64, size, fsc->mount_options->rsize); +- + len = size; + pages = dio_get_pages_alloc(iter, len, &start, &num_pages); + if (IS_ERR(pages)) { +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index dbcd2e066066..490c5fc9e69c 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1045,6 +1045,18 @@ ssize_t cifs_file_copychunk_range(unsigned int xid, + return rc; + } + ++/* ++ * Directory operations under CIFS/SMB2/SMB3 are synchronous, so fsync() ++ * is a dummy operation. ++ */ ++static int cifs_dir_fsync(struct file *file, loff_t start, loff_t end, int datasync) ++{ ++ cifs_dbg(FYI, "Sync directory - name: %pD datasync: 0x%x\n", ++ file, datasync); ++ ++ return 0; ++} ++ + static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off, + struct file *dst_file, loff_t destoff, + size_t len, unsigned int flags) +@@ -1173,6 +1185,7 @@ const struct file_operations cifs_dir_ops = { + .copy_file_range = cifs_copy_file_range, + .clone_file_range = cifs_clone_file_range, + .llseek = generic_file_llseek, ++ .fsync = cifs_dir_fsync, + }; + + static void +diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c +index 8a7ef9378bf6..3244932f4d5c 100644 +--- a/fs/fs-writeback.c ++++ b/fs/fs-writeback.c +@@ -1940,7 +1940,7 @@ void wb_workfn(struct work_struct *work) + } + + if (!list_empty(&wb->work_list)) +- mod_delayed_work(bdi_wq, &wb->dwork, 0); ++ wb_wakeup(wb); + else if (wb_has_dirty_io(wb) && dirty_writeback_interval) + wb_wakeup_delayed(wb); + +diff --git a/include/linux/oom.h b/include/linux/oom.h +index 5bad038ac012..6adac113e96d 100644 +--- a/include/linux/oom.h ++++ b/include/linux/oom.h +@@ -95,6 +95,8 @@ static inline int check_stable_address_space(struct mm_struct *mm) + return 0; + } + ++void __oom_reap_task_mm(struct mm_struct *mm); ++ + extern unsigned long oom_badness(struct task_struct *p, + struct mem_cgroup *memcg, const nodemask_t *nodemask, + unsigned long totalpages); +diff --git a/include/linux/wait_bit.h b/include/linux/wait_bit.h +index af0d495430d7..bc96d90bcafd 100644 +--- a/include/linux/wait_bit.h ++++ b/include/linux/wait_bit.h +@@ -259,4 +259,21 @@ int wait_on_atomic_t(atomic_t *val, int (*action)(atomic_t *), unsigned mode) + return out_of_line_wait_on_atomic_t(val, action, mode); + } + ++/** ++ * clear_and_wake_up_bit - clear a bit and wake up anyone waiting on that bit ++ * ++ * @bit: the bit of the word being waited on ++ * @word: the word being waited on, a kernel virtual address ++ * ++ * You can use this helper if bitflags are manipulated atomically rather than ++ * non-atomically under a lock. ++ */ ++static inline void clear_and_wake_up_bit(int bit, void *word) ++{ ++ clear_bit_unlock(bit, word); ++ /* See wake_up_bit() for which memory barrier you need to use. */ ++ smp_mb__after_atomic(); ++ wake_up_bit(word, bit); ++} ++ + #endif /* _LINUX_WAIT_BIT_H */ +diff --git a/include/net/inet_timewait_sock.h b/include/net/inet_timewait_sock.h +index 1356fa6a7566..fb439db7fa45 100644 +--- a/include/net/inet_timewait_sock.h ++++ b/include/net/inet_timewait_sock.h +@@ -43,6 +43,7 @@ struct inet_timewait_sock { + #define tw_family __tw_common.skc_family + #define tw_state __tw_common.skc_state + #define tw_reuse __tw_common.skc_reuse ++#define tw_reuseport __tw_common.skc_reuseport + #define tw_ipv6only __tw_common.skc_ipv6only + #define tw_bound_dev_if __tw_common.skc_bound_dev_if + #define tw_node __tw_common.skc_nulls_node +diff --git a/include/net/nexthop.h b/include/net/nexthop.h +index 36bb794f5cd6..902ff382a6dc 100644 +--- a/include/net/nexthop.h ++++ b/include/net/nexthop.h +@@ -7,7 +7,7 @@ + + static inline int rtnh_ok(const struct rtnexthop *rtnh, int remaining) + { +- return remaining >= sizeof(*rtnh) && ++ return remaining >= (int)sizeof(*rtnh) && + rtnh->rtnh_len >= sizeof(*rtnh) && + rtnh->rtnh_len <= remaining; + } +diff --git a/kernel/compat.c b/kernel/compat.c +index 772e038d04d9..7e83733d4c95 100644 +--- a/kernel/compat.c ++++ b/kernel/compat.c +@@ -34,6 +34,7 @@ int compat_get_timex(struct timex *txc, const struct compat_timex __user *utp) + { + struct compat_timex tx32; + ++ memset(txc, 0, sizeof(struct timex)); + if (copy_from_user(&tx32, utp, sizeof(struct compat_timex))) + return -EFAULT; + +diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c +index fa4f47a0a631..b23294e21e76 100644 +--- a/kernel/events/callchain.c ++++ b/kernel/events/callchain.c +@@ -131,14 +131,8 @@ int get_callchain_buffers(int event_max_stack) + goto exit; + } + +- if (count > 1) { +- /* If the allocation failed, give up */ +- if (!callchain_cpus_entries) +- err = -ENOMEM; +- goto exit; +- } +- +- err = alloc_callchain_buffers(); ++ if (count == 1) ++ err = alloc_callchain_buffers(); + exit: + if (err) + atomic_dec(&nr_callchain_events); +diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c +index f684d8e5fa2b..c573c7339223 100644 +--- a/kernel/events/ring_buffer.c ++++ b/kernel/events/ring_buffer.c +@@ -14,6 +14,7 @@ + #include + #include + #include ++#include + + #include "internal.h" + +@@ -863,8 +864,10 @@ perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff) + return NULL; + + /* AUX space */ +- if (pgoff >= rb->aux_pgoff) +- return virt_to_page(rb->aux_pages[pgoff - rb->aux_pgoff]); ++ if (pgoff >= rb->aux_pgoff) { ++ int aux_pgoff = array_index_nospec(pgoff - rb->aux_pgoff, rb->aux_nr_pages); ++ return virt_to_page(rb->aux_pages[aux_pgoff]); ++ } + } + + return __perf_mmap_to_page(rb, pgoff); +diff --git a/kernel/sched/autogroup.c b/kernel/sched/autogroup.c +index a43df5193538..1d179ab9ef8d 100644 +--- a/kernel/sched/autogroup.c ++++ b/kernel/sched/autogroup.c +@@ -7,6 +7,7 @@ + #include + #include + #include ++#include + + unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1; + static struct autogroup autogroup_default; +@@ -213,7 +214,7 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice) + static unsigned long next = INITIAL_JIFFIES; + struct autogroup *ag; + unsigned long shares; +- int err; ++ int err, idx; + + if (nice < MIN_NICE || nice > MAX_NICE) + return -EINVAL; +@@ -231,7 +232,9 @@ int proc_sched_autogroup_set_nice(struct task_struct *p, int nice) + + next = HZ / 10 + jiffies; + ag = autogroup_task_get(p); +- shares = scale_load(sched_prio_to_weight[nice + 20]); ++ ++ idx = array_index_nospec(nice + 20, 40); ++ shares = scale_load(sched_prio_to_weight[idx]); + + down_write(&ag->lock); + err = sched_group_set_shares(ag->tg, shares); +diff --git a/kernel/sched/cpufreq_schedutil.c b/kernel/sched/cpufreq_schedutil.c +index d6717a3331a1..81eb7899c7c8 100644 +--- a/kernel/sched/cpufreq_schedutil.c ++++ b/kernel/sched/cpufreq_schedutil.c +@@ -282,7 +282,8 @@ static void sugov_update_single(struct update_util_data *hook, u64 time, + * Do not reduce the frequency if the CPU has not been idle + * recently, as the reduction is likely to be premature then. + */ +- if (busy && next_f < sg_policy->next_freq) { ++ if (busy && next_f < sg_policy->next_freq && ++ sg_policy->next_freq != UINT_MAX) { + next_f = sg_policy->next_freq; + + /* Reset cached freq as next_freq has changed */ +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index a764aec3c9a1..55008fa93097 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -338,6 +338,9 @@ static int regex_match_full(char *str, struct regex *r, int len) + + static int regex_match_front(char *str, struct regex *r, int len) + { ++ if (len < r->len) ++ return 0; ++ + if (strncmp(str, r->pattern, r->len) == 0) + return 1; + return 0; +diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c +index 14d3af6a2953..7197ff9f0bbd 100644 +--- a/kernel/trace/trace_uprobe.c ++++ b/kernel/trace/trace_uprobe.c +@@ -152,6 +152,8 @@ static void FETCH_FUNC_NAME(memory, string)(struct pt_regs *regs, + return; + + ret = strncpy_from_user(dst, src, maxlen); ++ if (ret == maxlen) ++ dst[--ret] = '\0'; + + if (ret < 0) { /* Failed to fetch string */ + ((u8 *)get_rloc_data(dest))[0] = '\0'; +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index e19606bb41a0..dee049a0ec5b 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -381,7 +381,7 @@ static void wb_shutdown(struct bdi_writeback *wb) + * the barrier provided by test_and_clear_bit() above. + */ + smp_wmb(); +- clear_bit(WB_shutting_down, &wb->state); ++ clear_and_wake_up_bit(WB_shutting_down, &wb->state); + } + + static void wb_exit(struct bdi_writeback *wb) +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 66e7efabf0a1..546cd481a2ca 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -4187,6 +4187,9 @@ static void free_mem_cgroup_per_node_info(struct mem_cgroup *memcg, int node) + { + struct mem_cgroup_per_node *pn = memcg->nodeinfo[node]; + ++ if (!pn) ++ return; ++ + free_percpu(pn->lruvec_stat); + kfree(pn); + } +diff --git a/mm/mmap.c b/mm/mmap.c +index 0de87a376aaa..11f96fad5271 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -2982,6 +2982,32 @@ void exit_mmap(struct mm_struct *mm) + /* mm's last user has gone, and its about to be pulled down */ + mmu_notifier_release(mm); + ++ if (unlikely(mm_is_oom_victim(mm))) { ++ /* ++ * Manually reap the mm to free as much memory as possible. ++ * Then, as the oom reaper does, set MMF_OOM_SKIP to disregard ++ * this mm from further consideration. Taking mm->mmap_sem for ++ * write after setting MMF_OOM_SKIP will guarantee that the oom ++ * reaper will not run on this mm again after mmap_sem is ++ * dropped. ++ * ++ * Nothing can be holding mm->mmap_sem here and the above call ++ * to mmu_notifier_release(mm) ensures mmu notifier callbacks in ++ * __oom_reap_task_mm() will not block. ++ * ++ * This needs to be done before calling munlock_vma_pages_all(), ++ * which clears VM_LOCKED, otherwise the oom reaper cannot ++ * reliably test it. ++ */ ++ mutex_lock(&oom_lock); ++ __oom_reap_task_mm(mm); ++ mutex_unlock(&oom_lock); ++ ++ set_bit(MMF_OOM_SKIP, &mm->flags); ++ down_write(&mm->mmap_sem); ++ up_write(&mm->mmap_sem); ++ } ++ + if (mm->locked_vm) { + vma = mm->mmap; + while (vma) { +@@ -3003,24 +3029,6 @@ void exit_mmap(struct mm_struct *mm) + /* update_hiwater_rss(mm) here? but nobody should be looking */ + /* Use -1 here to ensure all VMAs in the mm are unmapped */ + unmap_vmas(&tlb, vma, 0, -1); +- +- if (unlikely(mm_is_oom_victim(mm))) { +- /* +- * Wait for oom_reap_task() to stop working on this +- * mm. Because MMF_OOM_SKIP is already set before +- * calling down_read(), oom_reap_task() will not run +- * on this "mm" post up_write(). +- * +- * mm_is_oom_victim() cannot be set from under us +- * either because victim->mm is already set to NULL +- * under task_lock before calling mmput and oom_mm is +- * set not NULL by the OOM killer only if victim->mm +- * is found not NULL while holding the task_lock. +- */ +- set_bit(MMF_OOM_SKIP, &mm->flags); +- down_write(&mm->mmap_sem); +- up_write(&mm->mmap_sem); +- } + free_pgtables(&tlb, vma, FIRST_USER_ADDRESS, USER_PGTABLES_CEILING); + tlb_finish_mmu(&tlb, 0, -1); + +diff --git a/mm/oom_kill.c b/mm/oom_kill.c +index 10aed8d8c080..58977f634ced 100644 +--- a/mm/oom_kill.c ++++ b/mm/oom_kill.c +@@ -456,7 +456,6 @@ bool process_shares_mm(struct task_struct *p, struct mm_struct *mm) + return false; + } + +- + #ifdef CONFIG_MMU + /* + * OOM Reaper kernel thread which tries to reap the memory used by the OOM +@@ -467,16 +466,51 @@ static DECLARE_WAIT_QUEUE_HEAD(oom_reaper_wait); + static struct task_struct *oom_reaper_list; + static DEFINE_SPINLOCK(oom_reaper_lock); + +-static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) ++void __oom_reap_task_mm(struct mm_struct *mm) + { +- struct mmu_gather tlb; + struct vm_area_struct *vma; ++ ++ /* ++ * Tell all users of get_user/copy_from_user etc... that the content ++ * is no longer stable. No barriers really needed because unmapping ++ * should imply barriers already and the reader would hit a page fault ++ * if it stumbled over a reaped memory. ++ */ ++ set_bit(MMF_UNSTABLE, &mm->flags); ++ ++ for (vma = mm->mmap ; vma; vma = vma->vm_next) { ++ if (!can_madv_dontneed_vma(vma)) ++ continue; ++ ++ /* ++ * Only anonymous pages have a good chance to be dropped ++ * without additional steps which we cannot afford as we ++ * are OOM already. ++ * ++ * We do not even care about fs backed pages because all ++ * which are reclaimable have already been reclaimed and ++ * we do not want to block exit_mmap by keeping mm ref ++ * count elevated without a good reason. ++ */ ++ if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) { ++ struct mmu_gather tlb; ++ ++ tlb_gather_mmu(&tlb, mm, vma->vm_start, vma->vm_end); ++ unmap_page_range(&tlb, vma, vma->vm_start, vma->vm_end, ++ NULL); ++ tlb_finish_mmu(&tlb, vma->vm_start, vma->vm_end); ++ } ++ } ++} ++ ++static bool oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) ++{ + bool ret = true; + + /* + * We have to make sure to not race with the victim exit path + * and cause premature new oom victim selection: +- * __oom_reap_task_mm exit_mm ++ * oom_reap_task_mm exit_mm + * mmget_not_zero + * mmput + * atomic_dec_and_test +@@ -524,35 +558,8 @@ static bool __oom_reap_task_mm(struct task_struct *tsk, struct mm_struct *mm) + + trace_start_task_reaping(tsk->pid); + +- /* +- * Tell all users of get_user/copy_from_user etc... that the content +- * is no longer stable. No barriers really needed because unmapping +- * should imply barriers already and the reader would hit a page fault +- * if it stumbled over a reaped memory. +- */ +- set_bit(MMF_UNSTABLE, &mm->flags); +- +- for (vma = mm->mmap ; vma; vma = vma->vm_next) { +- if (!can_madv_dontneed_vma(vma)) +- continue; ++ __oom_reap_task_mm(mm); + +- /* +- * Only anonymous pages have a good chance to be dropped +- * without additional steps which we cannot afford as we +- * are OOM already. +- * +- * We do not even care about fs backed pages because all +- * which are reclaimable have already been reclaimed and +- * we do not want to block exit_mmap by keeping mm ref +- * count elevated without a good reason. +- */ +- if (vma_is_anonymous(vma) || !(vma->vm_flags & VM_SHARED)) { +- tlb_gather_mmu(&tlb, mm, vma->vm_start, vma->vm_end); +- unmap_page_range(&tlb, vma, vma->vm_start, vma->vm_end, +- NULL); +- tlb_finish_mmu(&tlb, vma->vm_start, vma->vm_end); +- } +- } + pr_info("oom_reaper: reaped process %d (%s), now anon-rss:%lukB, file-rss:%lukB, shmem-rss:%lukB\n", + task_pid_nr(tsk), tsk->comm, + K(get_mm_counter(mm, MM_ANONPAGES)), +@@ -573,13 +580,12 @@ static void oom_reap_task(struct task_struct *tsk) + struct mm_struct *mm = tsk->signal->oom_mm; + + /* Retry the down_read_trylock(mmap_sem) a few times */ +- while (attempts++ < MAX_OOM_REAP_RETRIES && !__oom_reap_task_mm(tsk, mm)) ++ while (attempts++ < MAX_OOM_REAP_RETRIES && !oom_reap_task_mm(tsk, mm)) + schedule_timeout_idle(HZ/10); + + if (attempts <= MAX_OOM_REAP_RETRIES) + goto done; + +- + pr_info("oom_reaper: unable to reap pid:%d (%s)\n", + task_pid_nr(tsk), tsk->comm); + debug_show_all_locks(); +diff --git a/mm/sparse.c b/mm/sparse.c +index 30e56a100ee8..76ed2f4a8a3e 100644 +--- a/mm/sparse.c ++++ b/mm/sparse.c +@@ -661,7 +661,7 @@ void offline_mem_sections(unsigned long start_pfn, unsigned long end_pfn) + unsigned long pfn; + + for (pfn = start_pfn; pfn < end_pfn; pfn += PAGES_PER_SECTION) { +- unsigned long section_nr = pfn_to_section_nr(start_pfn); ++ unsigned long section_nr = pfn_to_section_nr(pfn); + struct mem_section *ms; + + /* +diff --git a/mm/z3fold.c b/mm/z3fold.c +index 39e19125d6a0..ddfb20cfd9af 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -144,7 +144,8 @@ enum z3fold_page_flags { + PAGE_HEADLESS = 0, + MIDDLE_CHUNK_MAPPED, + NEEDS_COMPACTING, +- PAGE_STALE ++ PAGE_STALE, ++ UNDER_RECLAIM + }; + + /***************** +@@ -173,6 +174,7 @@ static struct z3fold_header *init_z3fold_page(struct page *page, + clear_bit(MIDDLE_CHUNK_MAPPED, &page->private); + clear_bit(NEEDS_COMPACTING, &page->private); + clear_bit(PAGE_STALE, &page->private); ++ clear_bit(UNDER_RECLAIM, &page->private); + + spin_lock_init(&zhdr->page_lock); + kref_init(&zhdr->refcount); +@@ -748,6 +750,10 @@ static void z3fold_free(struct z3fold_pool *pool, unsigned long handle) + atomic64_dec(&pool->pages_nr); + return; + } ++ if (test_bit(UNDER_RECLAIM, &page->private)) { ++ z3fold_page_unlock(zhdr); ++ return; ++ } + if (test_and_set_bit(NEEDS_COMPACTING, &page->private)) { + z3fold_page_unlock(zhdr); + return; +@@ -832,6 +838,8 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + kref_get(&zhdr->refcount); + list_del_init(&zhdr->buddy); + zhdr->cpu = -1; ++ set_bit(UNDER_RECLAIM, &page->private); ++ break; + } + + list_del_init(&page->lru); +@@ -879,25 +887,35 @@ static int z3fold_reclaim_page(struct z3fold_pool *pool, unsigned int retries) + goto next; + } + next: +- spin_lock(&pool->lock); + if (test_bit(PAGE_HEADLESS, &page->private)) { + if (ret == 0) { +- spin_unlock(&pool->lock); + free_z3fold_page(page); + return 0; + } +- } else if (kref_put(&zhdr->refcount, release_z3fold_page)) { +- atomic64_dec(&pool->pages_nr); ++ spin_lock(&pool->lock); ++ list_add(&page->lru, &pool->lru); ++ spin_unlock(&pool->lock); ++ } else { ++ z3fold_page_lock(zhdr); ++ clear_bit(UNDER_RECLAIM, &page->private); ++ if (kref_put(&zhdr->refcount, ++ release_z3fold_page_locked)) { ++ atomic64_dec(&pool->pages_nr); ++ return 0; ++ } ++ /* ++ * if we are here, the page is still not completely ++ * free. Take the global pool lock then to be able ++ * to add it back to the lru list ++ */ ++ spin_lock(&pool->lock); ++ list_add(&page->lru, &pool->lru); + spin_unlock(&pool->lock); +- return 0; ++ z3fold_page_unlock(zhdr); + } + +- /* +- * Add to the beginning of LRU. +- * Pool lock has to be kept here to ensure the page has +- * not already been released +- */ +- list_add(&page->lru, &pool->lru); ++ /* We started off locked to we need to lock the pool back */ ++ spin_lock(&pool->lock); + } + spin_unlock(&pool->lock); + return -EAGAIN; +diff --git a/net/atm/lec.c b/net/atm/lec.c +index a3d93a1bb133..5741b6474dd9 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -41,6 +41,9 @@ static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 }; + #include + #include + ++/* Hardening for Spectre-v1 */ ++#include ++ + #include "lec.h" + #include "lec_arpc.h" + #include "resources.h" +@@ -687,8 +690,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg) + bytes_left = copy_from_user(&ioc_data, arg, sizeof(struct atmlec_ioc)); + if (bytes_left != 0) + pr_info("copy from user failed for %d bytes\n", bytes_left); +- if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF || +- !dev_lec[ioc_data.dev_num]) ++ if (ioc_data.dev_num < 0 || ioc_data.dev_num >= MAX_LEC_ITF) ++ return -EINVAL; ++ ioc_data.dev_num = array_index_nospec(ioc_data.dev_num, MAX_LEC_ITF); ++ if (!dev_lec[ioc_data.dev_num]) + return -EINVAL; + vpriv = kmalloc(sizeof(struct lec_vcc_priv), GFP_KERNEL); + if (!vpriv) +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 014a73b46064..2800c4c4978c 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1819,13 +1819,14 @@ static int compat_table_info(const struct ebt_table_info *info, + { + unsigned int size = info->entries_size; + const void *entries = info->entries; +- int ret; + + newinfo->entries_size = size; +- +- ret = xt_compat_init_offsets(NFPROTO_BRIDGE, info->nentries); +- if (ret) +- return ret; ++ if (info->nentries) { ++ int ret = xt_compat_init_offsets(NFPROTO_BRIDGE, ++ info->nentries); ++ if (ret) ++ return ret; ++ } + + return EBT_ENTRY_ITERATE(entries, size, compat_calc_entry, info, + entries, newinfo); +diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c +index c0548d268e1a..e3e6a3e2ca22 100644 +--- a/net/core/dev_addr_lists.c ++++ b/net/core/dev_addr_lists.c +@@ -57,8 +57,8 @@ static int __hw_addr_add_ex(struct netdev_hw_addr_list *list, + return -EINVAL; + + list_for_each_entry(ha, &list->list, list) { +- if (!memcmp(ha->addr, addr, addr_len) && +- ha->type == addr_type) { ++ if (ha->type == addr_type && ++ !memcmp(ha->addr, addr, addr_len)) { + if (global) { + /* check if addr is already used as global */ + if (ha->global_use) +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 564beb7e6d1c..ef734ad1d852 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -857,6 +857,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb) + n->hdr_len = skb->nohdr ? skb_headroom(skb) : skb->hdr_len; + n->cloned = 1; + n->nohdr = 0; ++ n->peeked = 0; + n->destructor = NULL; + C(tail); + C(end); +diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c +index e65fcb45c3f6..b08feb219b44 100644 +--- a/net/dccp/ipv4.c ++++ b/net/dccp/ipv4.c +@@ -614,6 +614,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) + ireq = inet_rsk(req); + sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr); + sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr); ++ ireq->ir_mark = inet_request_mark(sk, skb); + ireq->ireq_family = AF_INET; + ireq->ir_iif = sk->sk_bound_dev_if; + +diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c +index 5df7857fc0f3..6344f1b18a6a 100644 +--- a/net/dccp/ipv6.c ++++ b/net/dccp/ipv6.c +@@ -351,6 +351,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) + ireq->ir_v6_rmt_addr = ipv6_hdr(skb)->saddr; + ireq->ir_v6_loc_addr = ipv6_hdr(skb)->daddr; + ireq->ireq_family = AF_INET6; ++ ireq->ir_mark = inet_request_mark(sk, skb); + + if (ipv6_opt_accepted(sk, skb, IP6CB(skb)) || + np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo || +diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c +index d451b9f19b59..2341c1401681 100644 +--- a/net/ipv4/inet_timewait_sock.c ++++ b/net/ipv4/inet_timewait_sock.c +@@ -179,6 +179,7 @@ struct inet_timewait_sock *inet_twsk_alloc(const struct sock *sk, + tw->tw_dport = inet->inet_dport; + tw->tw_family = sk->sk_family; + tw->tw_reuse = sk->sk_reuse; ++ tw->tw_reuseport = sk->sk_reuseport; + tw->tw_hash = sk->sk_hash; + tw->tw_ipv6only = 0; + tw->tw_transparent = inet->transparent; +diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c +index b20c8ac64081..64007ce87273 100644 +--- a/net/ipv4/inetpeer.c ++++ b/net/ipv4/inetpeer.c +@@ -210,6 +210,7 @@ struct inet_peer *inet_getpeer(struct inet_peer_base *base, + p = kmem_cache_alloc(peer_cachep, GFP_ATOMIC); + if (p) { + p->daddr = *daddr; ++ p->dtime = (__u32)jiffies; + refcount_set(&p->refcnt, 2); + atomic_set(&p->rid, 0); + p->metrics[RTAX_LOCK-1] = INETPEER_METRICS_NEW; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 9ff06c5051ae..5ea559f8c456 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2288,13 +2288,14 @@ struct rtable *ip_route_output_key_hash(struct net *net, struct flowi4 *fl4, + const struct sk_buff *skb) + { + __u8 tos = RT_FL_TOS(fl4); +- struct fib_result res; ++ struct fib_result res = { ++ .type = RTN_UNSPEC, ++ .fi = NULL, ++ .table = NULL, ++ .tclassid = 0, ++ }; + struct rtable *rth; + +- res.tclassid = 0; +- res.fi = NULL; +- res.table = NULL; +- + fl4->flowi4_iif = LOOPBACK_IFINDEX; + fl4->flowi4_tos = tos & IPTOS_RT_MASK; + fl4->flowi4_scope = ((tos & RTO_ONLINK) ? +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index d023f879e7bb..b694fbf44a35 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -2601,7 +2601,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level, + case TCP_REPAIR_QUEUE: + if (!tp->repair) + err = -EPERM; +- else if (val < TCP_QUEUES_NR) ++ else if ((unsigned int)val < TCP_QUEUES_NR) + tp->repair_queue = val; + else + err = -EINVAL; +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 9db49805b7be..01a4ff3df60b 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1425,6 +1425,7 @@ static int kcm_attach(struct socket *sock, struct socket *csock, + */ + if (csk->sk_user_data) { + write_unlock_bh(&csk->sk_callback_lock); ++ strp_stop(&psock->strp); + strp_done(&psock->strp); + kmem_cache_free(kcm_psockp, psock); + err = -EALREADY; +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index b3245f9a37d1..e8f1556fa446 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2387,11 +2387,7 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) + strlcpy(cfg.mcast_ifn, dm->mcast_ifn, + sizeof(cfg.mcast_ifn)); + cfg.syncid = dm->syncid; +- rtnl_lock(); +- mutex_lock(&ipvs->sync_mutex); + ret = start_sync_thread(ipvs, &cfg, dm->state); +- mutex_unlock(&ipvs->sync_mutex); +- rtnl_unlock(); + } else { + mutex_lock(&ipvs->sync_mutex); + ret = stop_sync_thread(ipvs, dm->state); +@@ -3484,12 +3480,8 @@ static int ip_vs_genl_new_daemon(struct netns_ipvs *ipvs, struct nlattr **attrs) + if (ipvs->mixed_address_family_dests > 0) + return -EINVAL; + +- rtnl_lock(); +- mutex_lock(&ipvs->sync_mutex); + ret = start_sync_thread(ipvs, &c, + nla_get_u32(attrs[IPVS_DAEMON_ATTR_STATE])); +- mutex_unlock(&ipvs->sync_mutex); +- rtnl_unlock(); + return ret; + } + +diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c +index 13f740875507..5e07f7a6794e 100644 +--- a/net/netfilter/ipvs/ip_vs_sync.c ++++ b/net/netfilter/ipvs/ip_vs_sync.c +@@ -49,6 +49,7 @@ + #include + #include + #include ++#include + + #include /* Used for ntoh_seq and hton_seq */ + +@@ -1360,15 +1361,9 @@ static void set_mcast_pmtudisc(struct sock *sk, int val) + /* + * Specifiy default interface for outgoing multicasts + */ +-static int set_mcast_if(struct sock *sk, char *ifname) ++static int set_mcast_if(struct sock *sk, struct net_device *dev) + { +- struct net_device *dev; + struct inet_sock *inet = inet_sk(sk); +- struct net *net = sock_net(sk); +- +- dev = __dev_get_by_name(net, ifname); +- if (!dev) +- return -ENODEV; + + if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) + return -EINVAL; +@@ -1396,19 +1391,14 @@ static int set_mcast_if(struct sock *sk, char *ifname) + * in the in_addr structure passed in as a parameter. + */ + static int +-join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname) ++join_mcast_group(struct sock *sk, struct in_addr *addr, struct net_device *dev) + { +- struct net *net = sock_net(sk); + struct ip_mreqn mreq; +- struct net_device *dev; + int ret; + + memset(&mreq, 0, sizeof(mreq)); + memcpy(&mreq.imr_multiaddr, addr, sizeof(struct in_addr)); + +- dev = __dev_get_by_name(net, ifname); +- if (!dev) +- return -ENODEV; + if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) + return -EINVAL; + +@@ -1423,15 +1413,10 @@ join_mcast_group(struct sock *sk, struct in_addr *addr, char *ifname) + + #ifdef CONFIG_IP_VS_IPV6 + static int join_mcast_group6(struct sock *sk, struct in6_addr *addr, +- char *ifname) ++ struct net_device *dev) + { +- struct net *net = sock_net(sk); +- struct net_device *dev; + int ret; + +- dev = __dev_get_by_name(net, ifname); +- if (!dev) +- return -ENODEV; + if (sk->sk_bound_dev_if && dev->ifindex != sk->sk_bound_dev_if) + return -EINVAL; + +@@ -1443,24 +1428,18 @@ static int join_mcast_group6(struct sock *sk, struct in6_addr *addr, + } + #endif + +-static int bind_mcastif_addr(struct socket *sock, char *ifname) ++static int bind_mcastif_addr(struct socket *sock, struct net_device *dev) + { +- struct net *net = sock_net(sock->sk); +- struct net_device *dev; + __be32 addr; + struct sockaddr_in sin; + +- dev = __dev_get_by_name(net, ifname); +- if (!dev) +- return -ENODEV; +- + addr = inet_select_addr(dev, 0, RT_SCOPE_UNIVERSE); + if (!addr) + pr_err("You probably need to specify IP address on " + "multicast interface.\n"); + + IP_VS_DBG(7, "binding socket with (%s) %pI4\n", +- ifname, &addr); ++ dev->name, &addr); + + /* Now bind the socket with the address of multicast interface */ + sin.sin_family = AF_INET; +@@ -1493,7 +1472,8 @@ static void get_mcast_sockaddr(union ipvs_sockaddr *sa, int *salen, + /* + * Set up sending multicast socket over UDP + */ +-static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) ++static int make_send_sock(struct netns_ipvs *ipvs, int id, ++ struct net_device *dev, struct socket **sock_ret) + { + /* multicast addr */ + union ipvs_sockaddr mcast_addr; +@@ -1505,9 +1485,10 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) + IPPROTO_UDP, &sock); + if (result < 0) { + pr_err("Error during creation of socket; terminating\n"); +- return ERR_PTR(result); ++ goto error; + } +- result = set_mcast_if(sock->sk, ipvs->mcfg.mcast_ifn); ++ *sock_ret = sock; ++ result = set_mcast_if(sock->sk, dev); + if (result < 0) { + pr_err("Error setting outbound mcast interface\n"); + goto error; +@@ -1522,7 +1503,7 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) + set_sock_size(sock->sk, 1, result); + + if (AF_INET == ipvs->mcfg.mcast_af) +- result = bind_mcastif_addr(sock, ipvs->mcfg.mcast_ifn); ++ result = bind_mcastif_addr(sock, dev); + else + result = 0; + if (result < 0) { +@@ -1538,19 +1519,18 @@ static struct socket *make_send_sock(struct netns_ipvs *ipvs, int id) + goto error; + } + +- return sock; ++ return 0; + + error: +- sock_release(sock); +- return ERR_PTR(result); ++ return result; + } + + + /* + * Set up receiving multicast socket over UDP + */ +-static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, +- int ifindex) ++static int make_receive_sock(struct netns_ipvs *ipvs, int id, ++ struct net_device *dev, struct socket **sock_ret) + { + /* multicast addr */ + union ipvs_sockaddr mcast_addr; +@@ -1562,8 +1542,9 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, + IPPROTO_UDP, &sock); + if (result < 0) { + pr_err("Error during creation of socket; terminating\n"); +- return ERR_PTR(result); ++ goto error; + } ++ *sock_ret = sock; + /* it is equivalent to the REUSEADDR option in user-space */ + sock->sk->sk_reuse = SK_CAN_REUSE; + result = sysctl_sync_sock_size(ipvs); +@@ -1571,7 +1552,7 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, + set_sock_size(sock->sk, 0, result); + + get_mcast_sockaddr(&mcast_addr, &salen, &ipvs->bcfg, id); +- sock->sk->sk_bound_dev_if = ifindex; ++ sock->sk->sk_bound_dev_if = dev->ifindex; + result = sock->ops->bind(sock, (struct sockaddr *)&mcast_addr, salen); + if (result < 0) { + pr_err("Error binding to the multicast addr\n"); +@@ -1582,21 +1563,20 @@ static struct socket *make_receive_sock(struct netns_ipvs *ipvs, int id, + #ifdef CONFIG_IP_VS_IPV6 + if (ipvs->bcfg.mcast_af == AF_INET6) + result = join_mcast_group6(sock->sk, &mcast_addr.in6.sin6_addr, +- ipvs->bcfg.mcast_ifn); ++ dev); + else + #endif + result = join_mcast_group(sock->sk, &mcast_addr.in.sin_addr, +- ipvs->bcfg.mcast_ifn); ++ dev); + if (result < 0) { + pr_err("Error joining to the multicast group\n"); + goto error; + } + +- return sock; ++ return 0; + + error: +- sock_release(sock); +- return ERR_PTR(result); ++ return result; + } + + +@@ -1781,13 +1761,12 @@ static int sync_thread_backup(void *data) + int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + int state) + { +- struct ip_vs_sync_thread_data *tinfo; ++ struct ip_vs_sync_thread_data *tinfo = NULL; + struct task_struct **array = NULL, *task; +- struct socket *sock; + struct net_device *dev; + char *name; + int (*threadfn)(void *data); +- int id, count, hlen; ++ int id = 0, count, hlen; + int result = -ENOMEM; + u16 mtu, min_mtu; + +@@ -1795,6 +1774,18 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + IP_VS_DBG(7, "Each ip_vs_sync_conn entry needs %zd bytes\n", + sizeof(struct ip_vs_sync_conn_v0)); + ++ /* Do not hold one mutex and then to block on another */ ++ for (;;) { ++ rtnl_lock(); ++ if (mutex_trylock(&ipvs->sync_mutex)) ++ break; ++ rtnl_unlock(); ++ mutex_lock(&ipvs->sync_mutex); ++ if (rtnl_trylock()) ++ break; ++ mutex_unlock(&ipvs->sync_mutex); ++ } ++ + if (!ipvs->sync_state) { + count = clamp(sysctl_sync_ports(ipvs), 1, IPVS_SYNC_PORTS_MAX); + ipvs->threads_mask = count - 1; +@@ -1813,7 +1804,8 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + dev = __dev_get_by_name(ipvs->net, c->mcast_ifn); + if (!dev) { + pr_err("Unknown mcast interface: %s\n", c->mcast_ifn); +- return -ENODEV; ++ result = -ENODEV; ++ goto out_early; + } + hlen = (AF_INET6 == c->mcast_af) ? + sizeof(struct ipv6hdr) + sizeof(struct udphdr) : +@@ -1830,26 +1822,30 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + c->sync_maxlen = mtu - hlen; + + if (state == IP_VS_STATE_MASTER) { ++ result = -EEXIST; + if (ipvs->ms) +- return -EEXIST; ++ goto out_early; + + ipvs->mcfg = *c; + name = "ipvs-m:%d:%d"; + threadfn = sync_thread_master; + } else if (state == IP_VS_STATE_BACKUP) { ++ result = -EEXIST; + if (ipvs->backup_threads) +- return -EEXIST; ++ goto out_early; + + ipvs->bcfg = *c; + name = "ipvs-b:%d:%d"; + threadfn = sync_thread_backup; + } else { +- return -EINVAL; ++ result = -EINVAL; ++ goto out_early; + } + + if (state == IP_VS_STATE_MASTER) { + struct ipvs_master_sync_state *ms; + ++ result = -ENOMEM; + ipvs->ms = kcalloc(count, sizeof(ipvs->ms[0]), GFP_KERNEL); + if (!ipvs->ms) + goto out; +@@ -1865,39 +1861,38 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + } else { + array = kcalloc(count, sizeof(struct task_struct *), + GFP_KERNEL); ++ result = -ENOMEM; + if (!array) + goto out; + } + +- tinfo = NULL; + for (id = 0; id < count; id++) { +- if (state == IP_VS_STATE_MASTER) +- sock = make_send_sock(ipvs, id); +- else +- sock = make_receive_sock(ipvs, id, dev->ifindex); +- if (IS_ERR(sock)) { +- result = PTR_ERR(sock); +- goto outtinfo; +- } ++ result = -ENOMEM; + tinfo = kmalloc(sizeof(*tinfo), GFP_KERNEL); + if (!tinfo) +- goto outsocket; ++ goto out; + tinfo->ipvs = ipvs; +- tinfo->sock = sock; ++ tinfo->sock = NULL; + if (state == IP_VS_STATE_BACKUP) { + tinfo->buf = kmalloc(ipvs->bcfg.sync_maxlen, + GFP_KERNEL); + if (!tinfo->buf) +- goto outtinfo; ++ goto out; + } else { + tinfo->buf = NULL; + } + tinfo->id = id; ++ if (state == IP_VS_STATE_MASTER) ++ result = make_send_sock(ipvs, id, dev, &tinfo->sock); ++ else ++ result = make_receive_sock(ipvs, id, dev, &tinfo->sock); ++ if (result < 0) ++ goto out; + + task = kthread_run(threadfn, tinfo, name, ipvs->gen, id); + if (IS_ERR(task)) { + result = PTR_ERR(task); +- goto outtinfo; ++ goto out; + } + tinfo = NULL; + if (state == IP_VS_STATE_MASTER) +@@ -1914,20 +1909,20 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + ipvs->sync_state |= state; + spin_unlock_bh(&ipvs->sync_buff_lock); + ++ mutex_unlock(&ipvs->sync_mutex); ++ rtnl_unlock(); ++ + /* increase the module use count */ + ip_vs_use_count_inc(); + + return 0; + +-outsocket: +- sock_release(sock); +- +-outtinfo: +- if (tinfo) { +- sock_release(tinfo->sock); +- kfree(tinfo->buf); +- kfree(tinfo); +- } ++out: ++ /* We do not need RTNL lock anymore, release it here so that ++ * sock_release below and in the kthreads can use rtnl_lock ++ * to leave the mcast group. ++ */ ++ rtnl_unlock(); + count = id; + while (count-- > 0) { + if (state == IP_VS_STATE_MASTER) +@@ -1935,13 +1930,23 @@ int start_sync_thread(struct netns_ipvs *ipvs, struct ipvs_sync_daemon_cfg *c, + else + kthread_stop(array[count]); + } +- kfree(array); +- +-out: + if (!(ipvs->sync_state & IP_VS_STATE_MASTER)) { + kfree(ipvs->ms); + ipvs->ms = NULL; + } ++ mutex_unlock(&ipvs->sync_mutex); ++ if (tinfo) { ++ if (tinfo->sock) ++ sock_release(tinfo->sock); ++ kfree(tinfo->buf); ++ kfree(tinfo); ++ } ++ kfree(array); ++ return result; ++ ++out_early: ++ mutex_unlock(&ipvs->sync_mutex); ++ rtnl_unlock(); + return result; + } + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 1b86eccf94b6..b3932846f6c4 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1813,6 +1813,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + + if (msg->msg_namelen) { + err = -EINVAL; ++ if (msg->msg_namelen < sizeof(struct sockaddr_nl)) ++ goto out; + if (addr->nl_family != AF_NETLINK) + goto out; + dst_portid = addr->nl_pid; +diff --git a/net/rfkill/rfkill-gpio.c b/net/rfkill/rfkill-gpio.c +index 41bd496531d4..00192a996be0 100644 +--- a/net/rfkill/rfkill-gpio.c ++++ b/net/rfkill/rfkill-gpio.c +@@ -137,13 +137,18 @@ static int rfkill_gpio_probe(struct platform_device *pdev) + + ret = rfkill_register(rfkill->rfkill_dev); + if (ret < 0) +- return ret; ++ goto err_destroy; + + platform_set_drvdata(pdev, rfkill); + + dev_info(&pdev->dev, "%s device registered.\n", rfkill->name); + + return 0; ++ ++err_destroy: ++ rfkill_destroy(rfkill->rfkill_dev); ++ ++ return ret; + } + + static int rfkill_gpio_remove(struct platform_device *pdev) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.41-42.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.41-42.patch new file mode 100644 index 000000000000..5d73cf3b6b3a --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.41-42.patch @@ -0,0 +1,1534 @@ +diff --git a/Makefile b/Makefile +index c23d0b0c6c45..777f5685a36b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 41 ++SUBLEVEL = 42 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c +index c02cc817a490..60666db31886 100644 +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -450,7 +450,7 @@ static void rlb_update_client(struct rlb_client_info *client_info) + { + int i; + +- if (!client_info->slave) ++ if (!client_info->slave || !is_valid_ether_addr(client_info->mac_dst)) + return; + + for (i = 0; i < RLB_ARP_BURST_SIZE; i++) { +@@ -943,6 +943,10 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[], + skb->priority = TC_PRIO_CONTROL; + skb->dev = slave->dev; + ++ netdev_dbg(slave->bond->dev, ++ "Send learning packet: dev %s mac %pM vlan %d\n", ++ slave->dev->name, mac_addr, vid); ++ + if (vid) + __vlan_hwaccel_put_tag(skb, vlan_proto, vid); + +@@ -965,14 +969,13 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data) + u8 *mac_addr = data->mac_addr; + struct bond_vlan_tag *tags; + +- if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) { +- if (strict_match && +- ether_addr_equal_64bits(mac_addr, +- upper->dev_addr)) { ++ if (is_vlan_dev(upper) && ++ bond->nest_level == vlan_get_encap_level(upper) - 1) { ++ if (upper->addr_assign_type == NET_ADDR_STOLEN) { + alb_send_lp_vid(slave, mac_addr, + vlan_dev_vlan_proto(upper), + vlan_dev_vlan_id(upper)); +- } else if (!strict_match) { ++ } else { + alb_send_lp_vid(slave, upper->dev_addr, + vlan_dev_vlan_proto(upper), + vlan_dev_vlan_id(upper)); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index bf3be2e6d4a8..f0aa57222f17 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1734,6 +1734,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + if (bond_mode_uses_xmit_hash(bond)) + bond_update_slave_arr(bond, NULL); + ++ bond->nest_level = dev_get_nest_level(bond_dev); ++ + netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", + slave_dev->name, + bond_is_active_slave(new_slave) ? "an active" : "a backup", +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 48738eb27806..9a8ef630466f 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -8723,14 +8723,15 @@ static void tg3_free_consistent(struct tg3 *tp) + tg3_mem_rx_release(tp); + tg3_mem_tx_release(tp); + +- /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ +- tg3_full_lock(tp, 0); ++ /* tp->hw_stats can be referenced safely: ++ * 1. under rtnl_lock ++ * 2. or under tp->lock if TG3_FLAG_INIT_COMPLETE is set. ++ */ + if (tp->hw_stats) { + dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), + tp->hw_stats, tp->stats_mapping); + tp->hw_stats = NULL; + } +- tg3_full_unlock(tp); + } + + /* +@@ -14167,7 +14168,7 @@ static void tg3_get_stats64(struct net_device *dev, + struct tg3 *tp = netdev_priv(dev); + + spin_lock_bh(&tp->lock); +- if (!tp->hw_stats) { ++ if (!tp->hw_stats || !tg3_flag(tp, INIT_COMPLETE)) { + *stats = tp->net_stats_prev; + spin_unlock_bh(&tp->lock); + return; +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index 67f74fcb265e..5fe56dc4cfae 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1013,6 +1013,22 @@ static int mlx4_en_set_coalesce(struct net_device *dev, + if (!coal->tx_max_coalesced_frames_irq) + return -EINVAL; + ++ if (coal->tx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs_low > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs_high > MLX4_EN_MAX_COAL_TIME) { ++ netdev_info(dev, "%s: maximum coalesce time supported is %d usecs\n", ++ __func__, MLX4_EN_MAX_COAL_TIME); ++ return -ERANGE; ++ } ++ ++ if (coal->tx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS || ++ coal->rx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS) { ++ netdev_info(dev, "%s: maximum coalesced frames supported is %d\n", ++ __func__, MLX4_EN_MAX_COAL_PKTS); ++ return -ERANGE; ++ } ++ + priv->rx_frames = (coal->rx_max_coalesced_frames == + MLX4_EN_AUTO_CONF) ? + MLX4_EN_RX_COAL_TARGET : +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index c097eef41a9c..faa4bd21f148 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -3318,12 +3318,11 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + MAX_TX_RINGS, GFP_KERNEL); + if (!priv->tx_ring[t]) { + err = -ENOMEM; +- goto err_free_tx; ++ goto out; + } + priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) * + MAX_TX_RINGS, GFP_KERNEL); + if (!priv->tx_cq[t]) { +- kfree(priv->tx_ring[t]); + err = -ENOMEM; + goto out; + } +@@ -3576,11 +3575,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + + return 0; + +-err_free_tx: +- while (t--) { +- kfree(priv->tx_ring[t]); +- kfree(priv->tx_cq[t]); +- } + out: + mlx4_en_destroy_netdev(dev); + return err; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index 2c1a5ff6acfa..09f4764a3f39 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -131,6 +131,9 @@ + #define MLX4_EN_TX_COAL_PKTS 16 + #define MLX4_EN_TX_COAL_TIME 0x10 + ++#define MLX4_EN_MAX_COAL_PKTS U16_MAX ++#define MLX4_EN_MAX_COAL_TIME U16_MAX ++ + #define MLX4_EN_RX_RATE_LOW 400000 + #define MLX4_EN_RX_COAL_TIME_LOW 0 + #define MLX4_EN_RX_RATE_HIGH 450000 +@@ -547,8 +550,8 @@ struct mlx4_en_priv { + u16 rx_usecs_low; + u32 pkt_rate_high; + u16 rx_usecs_high; +- u16 sample_interval; +- u16 adaptive_rx_coal; ++ u32 sample_interval; ++ u32 adaptive_rx_coal; + u32 msg_enable; + u32 loopback_ok; + u32 validate_loopback; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 42bab73a9f40..ede66e6af786 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -780,6 +780,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + f->mask); + addr_type = key->addr_type; + ++ /* the HW doesn't support frag first/later */ ++ if (mask->flags & FLOW_DIS_FIRST_FRAG) ++ return -EOPNOTSUPP; ++ + if (mask->flags & FLOW_DIS_IS_FRAGMENT) { + MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1); + MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, +@@ -1383,7 +1387,8 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec, + } + + ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol); +- if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { ++ if (modify_ip_header && ip_proto != IPPROTO_TCP && ++ ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) { + pr_info("can't offload re-write of ip proto %d\n", ip_proto); + return false; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index eea7f931cad3..d560047c0bf9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -234,7 +234,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + dma_addr = dma_map_single(sq->pdev, skb_data, headlen, + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(sq->pdev, dma_addr))) +- return -ENOMEM; ++ goto dma_unmap_wqe_err; + + dseg->addr = cpu_to_be64(dma_addr); + dseg->lkey = sq->mkey_be; +@@ -252,7 +252,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz, + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(sq->pdev, dma_addr))) +- return -ENOMEM; ++ goto dma_unmap_wqe_err; + + dseg->addr = cpu_to_be64(dma_addr); + dseg->lkey = sq->mkey_be; +@@ -264,6 +264,10 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + } + + return num_dma; ++ ++dma_unmap_wqe_err: ++ mlx5e_dma_unmap_wqe_err(sq, num_dma); ++ return -ENOMEM; + } + + static inline void +@@ -355,17 +359,15 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen, + (struct mlx5_wqe_data_seg *)cseg + ds_cnt); + if (unlikely(num_dma < 0)) +- goto dma_unmap_wqe_err; ++ goto err_drop; + + mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma, + num_bytes, num_dma, wi, cseg); + + return NETDEV_TX_OK; + +-dma_unmap_wqe_err: ++err_drop: + sq->stats.dropped++; +- mlx5e_dma_unmap_wqe_err(sq, wi->num_dma); +- + dev_kfree_skb_any(skb); + + return NETDEV_TX_OK; +@@ -594,17 +596,15 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen, + (struct mlx5_wqe_data_seg *)cseg + ds_cnt); + if (unlikely(num_dma < 0)) +- goto dma_unmap_wqe_err; ++ goto err_drop; + + mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma, + num_bytes, num_dma, wi, cseg); + + return NETDEV_TX_OK; + +-dma_unmap_wqe_err: ++err_drop: + sq->stats.dropped++; +- mlx5e_dma_unmap_wqe_err(sq, wi->num_dma); +- + dev_kfree_skb_any(skb); + + return NETDEV_TX_OK; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index c77f4c0c7769..82e37250ed01 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -2054,26 +2054,35 @@ int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw, + memset(vf_stats, 0, sizeof(*vf_stats)); + vf_stats->rx_packets = + MLX5_GET_CTR(out, received_eth_unicast.packets) + ++ MLX5_GET_CTR(out, received_ib_unicast.packets) + + MLX5_GET_CTR(out, received_eth_multicast.packets) + ++ MLX5_GET_CTR(out, received_ib_multicast.packets) + + MLX5_GET_CTR(out, received_eth_broadcast.packets); + + vf_stats->rx_bytes = + MLX5_GET_CTR(out, received_eth_unicast.octets) + ++ MLX5_GET_CTR(out, received_ib_unicast.octets) + + MLX5_GET_CTR(out, received_eth_multicast.octets) + ++ MLX5_GET_CTR(out, received_ib_multicast.octets) + + MLX5_GET_CTR(out, received_eth_broadcast.octets); + + vf_stats->tx_packets = + MLX5_GET_CTR(out, transmitted_eth_unicast.packets) + ++ MLX5_GET_CTR(out, transmitted_ib_unicast.packets) + + MLX5_GET_CTR(out, transmitted_eth_multicast.packets) + ++ MLX5_GET_CTR(out, transmitted_ib_multicast.packets) + + MLX5_GET_CTR(out, transmitted_eth_broadcast.packets); + + vf_stats->tx_bytes = + MLX5_GET_CTR(out, transmitted_eth_unicast.octets) + ++ MLX5_GET_CTR(out, transmitted_ib_unicast.octets) + + MLX5_GET_CTR(out, transmitted_eth_multicast.octets) + ++ MLX5_GET_CTR(out, transmitted_ib_multicast.octets) + + MLX5_GET_CTR(out, transmitted_eth_broadcast.octets); + + vf_stats->multicast = +- MLX5_GET_CTR(out, received_eth_multicast.packets); ++ MLX5_GET_CTR(out, received_eth_multicast.packets) + ++ MLX5_GET_CTR(out, received_ib_multicast.packets); + + vf_stats->broadcast = + MLX5_GET_CTR(out, received_eth_broadcast.packets); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 5a7bea688ec8..33e5ff081e36 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -174,6 +174,7 @@ static void del_flow_group(struct fs_node *node); + static void del_fte(struct fs_node *node); + static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1, + struct mlx5_flow_destination *d2); ++static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns); + static struct mlx5_flow_rule * + find_flow_rule(struct fs_fte *fte, + struct mlx5_flow_destination *dest); +@@ -2041,23 +2042,27 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering) + + static int init_root_ns(struct mlx5_flow_steering *steering) + { ++ int err; ++ + steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX); + if (!steering->root_ns) +- goto cleanup; ++ return -ENOMEM; + +- if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node)) +- goto cleanup; ++ err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node); ++ if (err) ++ goto out_err; + + set_prio_attrs(steering->root_ns); +- +- if (create_anchor_flow_table(steering)) +- goto cleanup; ++ err = create_anchor_flow_table(steering); ++ if (err) ++ goto out_err; + + return 0; + +-cleanup: +- mlx5_cleanup_fs(steering->dev); +- return -ENOMEM; ++out_err: ++ cleanup_root_ns(steering->root_ns); ++ steering->root_ns = NULL; ++ return err; + } + + static void clean_tree(struct fs_node *node) +diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c +index d24b47b8e0b2..d118da5a10a2 100644 +--- a/drivers/net/ethernet/realtek/8139too.c ++++ b/drivers/net/ethernet/realtek/8139too.c +@@ -2224,7 +2224,7 @@ static void rtl8139_poll_controller(struct net_device *dev) + struct rtl8139_private *tp = netdev_priv(dev); + const int irq = tp->pci_dev->irq; + +- disable_irq(irq); ++ disable_irq_nosync(irq); + rtl8139_interrupt(irq, dev); + enable_irq(irq); + } +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index db553d4e8d22..b98fcc9e93e5 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -4886,6 +4886,9 @@ static void rtl_pll_power_down(struct rtl8169_private *tp) + static void rtl_pll_power_up(struct rtl8169_private *tp) + { + rtl_generic_op(tp, tp->pll_power_ops.up); ++ ++ /* give MAC/PHY some time to resume */ ++ msleep(20); + } + + static void rtl_init_pll_power_ops(struct rtl8169_private *tp) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 6a4e8e1bbd90..e92f41d20a2c 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -3442,7 +3442,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + + len = (val & RCR_ENTRY_L2_LEN) >> + RCR_ENTRY_L2_LEN_SHIFT; +- len -= ETH_FCS_LEN; ++ append_size = len + ETH_HLEN + ETH_FCS_LEN; + + addr = (val & RCR_ENTRY_PKT_BUF_ADDR) << + RCR_ENTRY_PKT_BUF_ADDR_SHIFT; +@@ -3452,7 +3452,6 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + RCR_ENTRY_PKTBUFSZ_SHIFT]; + + off = addr & ~PAGE_MASK; +- append_size = rcr_size; + if (num_rcr == 1) { + int ptype; + +@@ -3465,7 +3464,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + else + skb_checksum_none_assert(skb); + } else if (!(val & RCR_ENTRY_MULTI)) +- append_size = len - skb->len; ++ append_size = append_size - skb->len; + + niu_rx_skb_append(skb, page, off, append_size, rcr_size); + if ((page->index + rp->rbr_block_size) - rcr_size == addr) { +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 992c43b1868f..8cb44eabc283 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1260,6 +1260,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries( + cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr, + HOST_PORT_NUM, ALE_VLAN | + ALE_SECURE, slave->port_vlan); ++ cpsw_ale_control_set(cpsw->ale, slave_port, ++ ALE_PORT_DROP_UNKNOWN_VLAN, 1); + } + + static void soft_reset_slave(struct cpsw_slave *slave) +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index c849de3cb046..444e560d928b 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1742,7 +1742,8 @@ static int netvsc_vf_join(struct net_device *vf_netdev, + goto rx_handler_failed; + } + +- ret = netdev_upper_dev_link(vf_netdev, ndev); ++ ret = netdev_master_upper_dev_link(vf_netdev, ndev, ++ NULL, NULL); + if (ret != 0) { + netdev_err(vf_netdev, + "can not set master device %s (err = %d)\n", +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 1aad0568dcc6..2f828eb9ace6 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1338,6 +1338,18 @@ static int qmi_wwan_probe(struct usb_interface *intf, + id->driver_info = (unsigned long)&qmi_wwan_info; + } + ++ /* There are devices where the same interface number can be ++ * configured as different functions. We should only bind to ++ * vendor specific functions when matching on interface number ++ */ ++ if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER && ++ desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) { ++ dev_dbg(&intf->dev, ++ "Rejecting interface number match for class %02x\n", ++ desc->bInterfaceClass); ++ return -ENODEV; ++ } ++ + /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */ + if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) { + dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n"); +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index c0a4fcb7fd0a..3696f9ded252 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -752,6 +752,8 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback, + int wait; + unsigned long flags = 0; + unsigned long mflags = 0; ++ struct aac_hba_cmd_req *hbacmd = (struct aac_hba_cmd_req *) ++ fibptr->hw_fib_va; + + fibptr->flags = (FIB_CONTEXT_FLAG | FIB_CONTEXT_FLAG_NATIVE_HBA); + if (callback) { +@@ -762,11 +764,9 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback, + wait = 1; + + +- if (command == HBA_IU_TYPE_SCSI_CMD_REQ) { +- struct aac_hba_cmd_req *hbacmd = +- (struct aac_hba_cmd_req *)fibptr->hw_fib_va; ++ hbacmd->iu_type = command; + +- hbacmd->iu_type = command; ++ if (command == HBA_IU_TYPE_SCSI_CMD_REQ) { + /* bit1 of request_id must be 0 */ + hbacmd->request_id = + cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index d227d8514b25..1bc62294fe6b 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3171,7 +3171,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + struct btrfs_transaction *cur_trans; + int ret = 0; + ++ spin_lock(&root->fs_info->trans_lock); + cur_trans = root->fs_info->running_transaction; ++ if (cur_trans) ++ refcount_inc(&cur_trans->use_count); ++ spin_unlock(&root->fs_info->trans_lock); + if (!cur_trans) + return 0; + +@@ -3180,6 +3184,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); + if (!head) { + spin_unlock(&delayed_refs->lock); ++ btrfs_put_transaction(cur_trans); + return 0; + } + +@@ -3196,6 +3201,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + mutex_lock(&head->mutex); + mutex_unlock(&head->mutex); + btrfs_put_delayed_ref(&head->node); ++ btrfs_put_transaction(cur_trans); + return -EAGAIN; + } + spin_unlock(&delayed_refs->lock); +@@ -3223,6 +3229,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + } + spin_unlock(&head->lock); + mutex_unlock(&head->mutex); ++ btrfs_put_transaction(cur_trans); + return ret; + } + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 2ff11a693360..dd9d4d3a2e39 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -263,7 +263,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + * Inherently racy -- command line shares address space + * with code and data. + */ +- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); ++ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); + if (rv <= 0) + goto out_free_page; + +@@ -281,7 +281,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + int nr_read; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -327,7 +327,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -946,7 +946,7 @@ static ssize_t environ_read(struct file *file, char __user *buf, + max_len = min_t(size_t, PAGE_SIZE, count); + this_len = min(max_len, this_len); + +- retval = access_remote_vm(mm, (env_start + src), page, this_len, 0); ++ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); + + if (retval <= 0) { + ret = retval; +diff --git a/include/linux/mm.h b/include/linux/mm.h +index f50deada0f5c..f23215854c80 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2383,6 +2383,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma, + #define FOLL_MLOCK 0x1000 /* lock present pages */ + #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */ + #define FOLL_COW 0x4000 /* internal GUP flag */ ++#define FOLL_ANON 0x8000 /* don't do file mappings */ + + static inline int vm_fault_to_errno(int vm_fault, int foll_flags) + { +diff --git a/include/net/bonding.h b/include/net/bonding.h +index b2e68657a216..73799da57400 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -198,6 +198,7 @@ struct bonding { + struct slave __rcu *primary_slave; + struct bond_up_slave __rcu *slave_arr; /* Array of usable slaves */ + bool force_primary; ++ u32 nest_level; + s32 slave_cnt; /* never change this value outside the attach/detach wrappers */ + int (*recv_probe)(const struct sk_buff *, struct bonding *, + struct slave *); +diff --git a/include/net/tls.h b/include/net/tls.h +index df950383b8c1..48940a883d9a 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -98,6 +98,7 @@ struct tls_context { + struct scatterlist *partially_sent_record; + u16 partially_sent_offset; + unsigned long flags; ++ bool in_tcp_sendpages; + + u16 pending_open_record_frags; + int (*push_pending_record)(struct sock *sk, int flags); +diff --git a/mm/gup.c b/mm/gup.c +index 8fc23a60487d..d2ba0be71441 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -544,6 +544,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) + if (vm_flags & (VM_IO | VM_PFNMAP)) + return -EFAULT; + ++ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) ++ return -EFAULT; ++ + if (write) { + if (!(vm_flags & VM_WRITE)) { + if (!(gup_flags & FOLL_FORCE)) +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index f3aef22931ab..55a73ef388bf 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -503,8 +503,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) + if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit) + return -ELOOP; + +- /* Device is already being bridged */ +- if (br_port_exists(dev)) ++ /* Device has master upper dev */ ++ if (netdev_master_upper_dev_get(dev)) + return -EBUSY; + + /* No bridging devices that dislike that (e.g. wireless) */ +diff --git a/net/compat.c b/net/compat.c +index 22381719718c..32ed993588d6 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -377,7 +377,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname, + optname == SO_ATTACH_REUSEPORT_CBPF) + return do_set_attach_filter(sock, level, optname, + optval, optlen); +- if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO) ++ if (!COMPAT_USE_64BIT_TIME && ++ (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)) + return do_set_sock_timeout(sock, level, optname, optval, optlen); + + return sock_setsockopt(sock, level, optname, optval, optlen); +@@ -442,7 +443,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname, + static int compat_sock_getsockopt(struct socket *sock, int level, int optname, + char __user *optval, int __user *optlen) + { +- if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO) ++ if (!COMPAT_USE_64BIT_TIME && ++ (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)) + return do_get_sock_timeout(sock, level, optname, optval, optlen); + return sock_getsockopt(sock, level, optname, optval, optlen); + } +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index 97791b0b1b51..3887bc115762 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val) + DCCPF_SEQ_WMAX)); + } + ++static void dccp_tasklet_schedule(struct sock *sk) ++{ ++ struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet; ++ ++ if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) { ++ sock_hold(sk); ++ __tasklet_schedule(t); ++ } ++} ++ + static void ccid2_hc_tx_rto_expire(unsigned long data) + { + struct sock *sk = (struct sock *)data; +@@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(unsigned long data) + + /* if we were blocked before, we may now send cwnd=1 packet */ + if (sender_was_blocked) +- tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet); ++ dccp_tasklet_schedule(sk); + /* restart backed-off timer */ + sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto); + out: +@@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + done: + /* check if incoming Acks allow pending packets to be sent */ + if (sender_was_blocked && !ccid2_cwnd_network_limited(hc)) +- tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet); ++ dccp_tasklet_schedule(sk); + dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks); + } + +diff --git a/net/dccp/timer.c b/net/dccp/timer.c +index 3a2c34027758..2a952cbd6efa 100644 +--- a/net/dccp/timer.c ++++ b/net/dccp/timer.c +@@ -230,12 +230,12 @@ static void dccp_write_xmitlet(unsigned long data) + else + dccp_write_xmit(sk); + bh_unlock_sock(sk); ++ sock_put(sk); + } + + static void dccp_write_xmit_timer(unsigned long data) + { + dccp_write_xmitlet(data); +- sock_put((struct sock *)data); + } + + void dccp_init_xmit_timers(struct sock *sk) +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index b8f0db54b197..16226d49263d 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -775,8 +775,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + ipc.addr = faddr = daddr; + + if (ipc.opt && ipc.opt->opt.srr) { +- if (!daddr) +- return -EINVAL; ++ if (!daddr) { ++ err = -EINVAL; ++ goto out_free; ++ } + faddr = ipc.opt->opt.faddr; + } + tos = get_rttos(&ipc, inet); +@@ -842,6 +844,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + out: + ip_rt_put(rt); ++out_free: + if (free) + kfree(ipc.opt); + if (!err) { +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 5ea559f8c456..28bc3a98adc7 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -711,7 +711,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; + fnhe->fnhe_pmtu = pmtu; +- fnhe->fnhe_expires = expires; ++ fnhe->fnhe_expires = max(1UL, expires); + + /* Exception created; mark the cached routes for the nexthop + * stale, so anyone caching it rechecks if this exception +@@ -1286,6 +1286,36 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + ++static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) ++{ ++ struct fnhe_hash_bucket *hash; ++ struct fib_nh_exception *fnhe, __rcu **fnhe_p; ++ u32 hval = fnhe_hashfun(daddr); ++ ++ spin_lock_bh(&fnhe_lock); ++ ++ hash = rcu_dereference_protected(nh->nh_exceptions, ++ lockdep_is_held(&fnhe_lock)); ++ hash += hval; ++ ++ fnhe_p = &hash->chain; ++ fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock)); ++ while (fnhe) { ++ if (fnhe->fnhe_daddr == daddr) { ++ rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( ++ fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); ++ fnhe_flush_routes(fnhe); ++ kfree_rcu(fnhe, rcu); ++ break; ++ } ++ fnhe_p = &fnhe->fnhe_next; ++ fnhe = rcu_dereference_protected(fnhe->fnhe_next, ++ lockdep_is_held(&fnhe_lock)); ++ } ++ ++ spin_unlock_bh(&fnhe_lock); ++} ++ + static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr) + { + struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions); +@@ -1299,8 +1329,14 @@ static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr) + + for (fnhe = rcu_dereference(hash[hval].chain); fnhe; + fnhe = rcu_dereference(fnhe->fnhe_next)) { +- if (fnhe->fnhe_daddr == daddr) ++ if (fnhe->fnhe_daddr == daddr) { ++ if (fnhe->fnhe_expires && ++ time_after(jiffies, fnhe->fnhe_expires)) { ++ ip_del_fnhe(nh, daddr); ++ break; ++ } + return fnhe; ++ } + } + return NULL; + } +@@ -1620,36 +1656,6 @@ static void ip_handle_martian_source(struct net_device *dev, + #endif + } + +-static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) +-{ +- struct fnhe_hash_bucket *hash; +- struct fib_nh_exception *fnhe, __rcu **fnhe_p; +- u32 hval = fnhe_hashfun(daddr); +- +- spin_lock_bh(&fnhe_lock); +- +- hash = rcu_dereference_protected(nh->nh_exceptions, +- lockdep_is_held(&fnhe_lock)); +- hash += hval; +- +- fnhe_p = &hash->chain; +- fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock)); +- while (fnhe) { +- if (fnhe->fnhe_daddr == daddr) { +- rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( +- fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); +- fnhe_flush_routes(fnhe); +- kfree_rcu(fnhe, rcu); +- break; +- } +- fnhe_p = &fnhe->fnhe_next; +- fnhe = rcu_dereference_protected(fnhe->fnhe_next, +- lockdep_is_held(&fnhe_lock)); +- } +- +- spin_unlock_bh(&fnhe_lock); +-} +- + static void set_lwt_redirect(struct rtable *rth) + { + if (lwtunnel_output_redirect(rth->dst.lwtstate)) { +@@ -1716,20 +1722,10 @@ static int __mkroute_input(struct sk_buff *skb, + + fnhe = find_exception(&FIB_RES_NH(*res), daddr); + if (do_cache) { +- if (fnhe) { ++ if (fnhe) + rth = rcu_dereference(fnhe->fnhe_rth_input); +- if (rth && rth->dst.expires && +- time_after(jiffies, rth->dst.expires)) { +- ip_del_fnhe(&FIB_RES_NH(*res), daddr); +- fnhe = NULL; +- } else { +- goto rt_cache; +- } +- } +- +- rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input); +- +-rt_cache: ++ else ++ rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input); + if (rt_cache_valid(rth)) { + skb_dst_set_noref(skb, &rth->dst); + goto out; +@@ -2206,39 +2202,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res, + * the loopback interface and the IP_PKTINFO ipi_ifindex will + * be set to the loopback interface as well. + */ +- fi = NULL; ++ do_cache = false; + } + + fnhe = NULL; + do_cache &= fi != NULL; +- if (do_cache) { ++ if (fi) { + struct rtable __rcu **prth; + struct fib_nh *nh = &FIB_RES_NH(*res); + + fnhe = find_exception(nh, fl4->daddr); ++ if (!do_cache) ++ goto add; + if (fnhe) { + prth = &fnhe->fnhe_rth_output; +- rth = rcu_dereference(*prth); +- if (rth && rth->dst.expires && +- time_after(jiffies, rth->dst.expires)) { +- ip_del_fnhe(nh, fl4->daddr); +- fnhe = NULL; +- } else { +- goto rt_cache; ++ } else { ++ if (unlikely(fl4->flowi4_flags & ++ FLOWI_FLAG_KNOWN_NH && ++ !(nh->nh_gw && ++ nh->nh_scope == RT_SCOPE_LINK))) { ++ do_cache = false; ++ goto add; + } ++ prth = raw_cpu_ptr(nh->nh_pcpu_rth_output); + } +- +- if (unlikely(fl4->flowi4_flags & +- FLOWI_FLAG_KNOWN_NH && +- !(nh->nh_gw && +- nh->nh_scope == RT_SCOPE_LINK))) { +- do_cache = false; +- goto add; +- } +- prth = raw_cpu_ptr(nh->nh_pcpu_rth_output); + rth = rcu_dereference(*prth); +- +-rt_cache: + if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst)) + return rth; + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index b694fbf44a35..e3ece12f0250 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1194,7 +1194,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) + uarg->zerocopy = 0; + } + +- if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) { ++ if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) && ++ !tp->repair) { + err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size); + if (err == -EINPROGRESS && copied_syn > 0) + goto out; +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index 25c5a0b60cfc..9a0b952dd09b 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -802,7 +802,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs) + } + } + } +- bbr->idle_restart = 0; ++ /* Restart after idle ends only once we process a new S/ACK for data */ ++ if (rs->delivered > 0) ++ bbr->idle_restart = 0; + } + + static void bbr_update_model(struct sock *sk, const struct rate_sample *rs) +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index c79fa6f6b758..b0ad62bd38f7 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -413,9 +413,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score += 4; + } + +@@ -978,8 +978,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags); + + if (ipc.opt && ipc.opt->opt.srr) { +- if (!daddr) +- return -EINVAL; ++ if (!daddr) { ++ err = -EINVAL; ++ goto out_free; ++ } + faddr = ipc.opt->opt.faddr; + connected = 0; + } +@@ -1087,6 +1089,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + out: + ip_rt_put(rt); ++out_free: + if (free) + kfree(ipc.opt); + if (!err) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index e04c534b573e..7d50d889ab6e 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1222,11 +1222,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, + const struct ipv6hdr *inner_iph; + const struct icmp6hdr *icmph; + struct ipv6hdr _inner_iph; ++ struct icmp6hdr _icmph; + + if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6)) + goto out; + +- icmph = icmp6_hdr(skb); ++ icmph = skb_header_pointer(skb, skb_transport_offset(skb), ++ sizeof(_icmph), &_icmph); ++ if (!icmph) ++ goto out; ++ + if (icmph->icmp6_type != ICMPV6_DEST_UNREACH && + icmph->icmp6_type != ICMPV6_PKT_TOOBIG && + icmph->icmp6_type != ICMPV6_TIME_EXCEED && +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 40d7234c27b9..0146dcdc5c40 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -164,9 +164,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score++; + } + +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index fca69c3771f5..c28223d8092b 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -765,8 +765,6 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || +- (session->offset && +- nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index cf41d9b4a0b8..b49f5afab405 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -930,6 +930,9 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + if (size > llc->dev->mtu) + size = llc->dev->mtu; + copied = size - hdrlen; ++ rc = -EINVAL; ++ if (copied < 0) ++ goto release; + release_sock(sk); + skb = sock_alloc_send_skb(sk, size, noblock, &rc); + lock_sock(sk); +diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c +index 58fb827439a8..6df6f58a8103 100644 +--- a/net/nsh/nsh.c ++++ b/net/nsh/nsh.c +@@ -30,6 +30,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, + if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN))) + goto out; + nsh_len = nsh_hdr_len(nsh_hdr(skb)); ++ if (nsh_len < NSH_BASE_HDR_LEN) ++ goto out; + if (unlikely(!pskb_may_pull(skb, nsh_len))) + goto out; + +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 0d9f6afa266c..4c9c9458374a 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -1404,13 +1404,10 @@ static void nlattr_set(struct nlattr *attr, u8 val, + + /* The nlattr stream should already have been validated */ + nla_for_each_nested(nla, attr, rem) { +- if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) { +- if (tbl[nla_type(nla)].next) +- tbl = tbl[nla_type(nla)].next; +- nlattr_set(nla, val, tbl); +- } else { ++ if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) ++ nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl); ++ else + memset(nla_data(nla), val, nla_len(nla)); +- } + + if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE) + *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK; +diff --git a/net/rds/recv.c b/net/rds/recv.c +index b25bcfe411ca..555f07ccf0dc 100644 +--- a/net/rds/recv.c ++++ b/net/rds/recv.c +@@ -558,6 +558,7 @@ static int rds_cmsg_recv(struct rds_incoming *inc, struct msghdr *msg, + struct rds_cmsg_rx_trace t; + int i, j; + ++ memset(&t, 0, sizeof(t)); + inc->i_rx_lat_trace[RDS_MSG_RX_CMSG] = local_clock(); + t.rx_traces = rs->rs_rx_traces; + for (i = 0; i < rs->rs_rx_traces; i++) { +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index 6d10b3af479b..821823b2518a 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -131,8 +131,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla, + if (exists && bind) + return 0; + +- if (!lflags) ++ if (!lflags) { ++ if (exists) ++ tcf_idr_release(*a, bind); + return -EINVAL; ++ } + + if (!exists) { + ret = tcf_idr_create(tn, parm->index, est, a, +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index c2fab4bcb8be..2f4e1483aced 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -151,8 +151,8 @@ static struct tcf_proto *tcf_proto_create(const char *kind, u32 protocol, + } else { + err = -ENOENT; + } +- goto errout; + #endif ++ goto errout; + } + tp->classify = tp->ops->classify; + tp->protocol = protocol; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 263d16e3219e..f50eb87cfe79 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f) + return f->next == &detached; + } + ++static bool fq_flow_is_throttled(const struct fq_flow *f) ++{ ++ return f->next == &throttled; ++} ++ ++static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow) ++{ ++ if (head->first) ++ head->last->next = flow; ++ else ++ head->first = flow; ++ head->last = flow; ++ flow->next = NULL; ++} ++ ++static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f) ++{ ++ rb_erase(&f->rate_node, &q->delayed); ++ q->throttled_flows--; ++ fq_flow_add_tail(&q->old_flows, f); ++} ++ + static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f) + { + struct rb_node **p = &q->delayed.rb_node, *parent = NULL; +@@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f) + + static struct kmem_cache *fq_flow_cachep __read_mostly; + +-static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow) +-{ +- if (head->first) +- head->last->next = flow; +- else +- head->first = flow; +- head->last = flow; +- flow->next = NULL; +-} + + /* limit number of collected flows per round */ + #define FQ_GC_MAX 8 +@@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + f->socket_hash != sk->sk_hash)) { + f->credit = q->initial_quantum; + f->socket_hash = sk->sk_hash; ++ if (fq_flow_is_throttled(f)) ++ fq_flow_unset_throttled(q, f); + f->time_next_packet = 0ULL; + } + return f; +@@ -438,9 +453,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now) + q->time_next_delayed_flow = f->time_next_packet; + break; + } +- rb_erase(p, &q->delayed); +- q->throttled_flows--; +- fq_flow_add_tail(&q->old_flows, f); ++ fq_flow_unset_throttled(q, f); + } + } + +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index dfb9651e818b..58f7d8cfd748 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1025,8 +1025,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + struct sctp_endpoint *ep; + struct sctp_chunk *chunk; + struct sctp_inq *inqueue; +- int state; ++ int first_time = 1; /* is this the first time through the loop */ + int error = 0; ++ int state; + + /* The association should be held so we should be safe. */ + ep = asoc->ep; +@@ -1037,6 +1038,30 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + state = asoc->state; + subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type); + ++ /* If the first chunk in the packet is AUTH, do special ++ * processing specified in Section 6.3 of SCTP-AUTH spec ++ */ ++ if (first_time && subtype.chunk == SCTP_CID_AUTH) { ++ struct sctp_chunkhdr *next_hdr; ++ ++ next_hdr = sctp_inq_peek(inqueue); ++ if (!next_hdr) ++ goto normal; ++ ++ /* If the next chunk is COOKIE-ECHO, skip the AUTH ++ * chunk while saving a pointer to it so we can do ++ * Authentication later (during cookie-echo ++ * processing). ++ */ ++ if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { ++ chunk->auth_chunk = skb_clone(chunk->skb, ++ GFP_ATOMIC); ++ chunk->auth = 1; ++ continue; ++ } ++ } ++ ++normal: + /* SCTP-AUTH, Section 6.3: + * The receiver has a list of chunk types which it expects + * to be received only after an AUTH-chunk. This list has +@@ -1075,6 +1100,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + /* If there is an error on chunk, discard this packet. */ + if (error && chunk) + chunk->pdiscard = 1; ++ ++ if (first_time) ++ first_time = 0; + } + sctp_association_put(asoc); + } +diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c +index 48392552ee7c..1aa89d4682f4 100644 +--- a/net/sctp/inqueue.c ++++ b/net/sctp/inqueue.c +@@ -217,7 +217,7 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) + skb_pull(chunk->skb, sizeof(*ch)); + chunk->subh.v = NULL; /* Subheader is no longer valid. */ + +- if (chunk->chunk_end + sizeof(*ch) < skb_tail_pointer(chunk->skb)) { ++ if (chunk->chunk_end + sizeof(*ch) <= skb_tail_pointer(chunk->skb)) { + /* This is not a singleton */ + chunk->singleton = 0; + } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) { +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 7219a1c041f7..853fecdf6374 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -865,6 +865,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1, + if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2)) + return 1; + ++ if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET) ++ return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr; ++ + return __sctp_v6_cmp_addr(addr1, addr2); + } + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 8f8ccded13e4..01b078172306 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -150,10 +150,7 @@ static enum sctp_disposition sctp_sf_violation_chunk( + struct sctp_cmd_seq *commands); + + static enum sctp_ierror sctp_sf_authenticate( +- struct net *net, +- const struct sctp_endpoint *ep, + const struct sctp_association *asoc, +- const union sctp_subtype type, + struct sctp_chunk *chunk); + + static enum sctp_disposition __sctp_sf_do_9_1_abort( +@@ -618,6 +615,38 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net, + return SCTP_DISPOSITION_CONSUME; + } + ++static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk, ++ const struct sctp_association *asoc) ++{ ++ struct sctp_chunk auth; ++ ++ if (!chunk->auth_chunk) ++ return true; ++ ++ /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo ++ * is supposed to be authenticated and we have to do delayed ++ * authentication. We've just recreated the association using ++ * the information in the cookie and now it's much easier to ++ * do the authentication. ++ */ ++ ++ /* Make sure that we and the peer are AUTH capable */ ++ if (!net->sctp.auth_enable || !asoc->peer.auth_capable) ++ return false; ++ ++ /* set-up our fake chunk so that we can process it */ ++ auth.skb = chunk->auth_chunk; ++ auth.asoc = chunk->asoc; ++ auth.sctp_hdr = chunk->sctp_hdr; ++ auth.chunk_hdr = (struct sctp_chunkhdr *) ++ skb_push(chunk->auth_chunk, ++ sizeof(struct sctp_chunkhdr)); ++ skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); ++ auth.transport = chunk->transport; ++ ++ return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR; ++} ++ + /* + * Respond to a normal COOKIE ECHO chunk. + * We are the side that is being asked for an association. +@@ -755,37 +784,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + if (error) + goto nomem_init; + +- /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo +- * is supposed to be authenticated and we have to do delayed +- * authentication. We've just recreated the association using +- * the information in the cookie and now it's much easier to +- * do the authentication. +- */ +- if (chunk->auth_chunk) { +- struct sctp_chunk auth; +- enum sctp_ierror ret; +- +- /* Make sure that we and the peer are AUTH capable */ +- if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) { +- sctp_association_free(new_asoc); +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- } +- +- /* set-up our fake chunk so that we can process it */ +- auth.skb = chunk->auth_chunk; +- auth.asoc = chunk->asoc; +- auth.sctp_hdr = chunk->sctp_hdr; +- auth.chunk_hdr = (struct sctp_chunkhdr *) +- skb_push(chunk->auth_chunk, +- sizeof(struct sctp_chunkhdr)); +- skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); +- auth.transport = chunk->transport; +- +- ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth); +- if (ret != SCTP_IERROR_NO_ERROR) { +- sctp_association_free(new_asoc); +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- } ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) { ++ sctp_association_free(new_asoc); ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + } + + repl = sctp_make_cookie_ack(new_asoc, chunk); +@@ -1755,13 +1756,15 @@ static enum sctp_disposition sctp_sf_do_dupcook_a( + GFP_ATOMIC)) + goto nomem; + ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Make sure no new addresses are being added during the + * restart. Though this is a pretty complicated attack + * since you'd have to get inside the cookie. + */ +- if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) { ++ if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) + return SCTP_DISPOSITION_CONSUME; +- } + + /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes + * the peer has restarted (Action A), it MUST NOT setup a new +@@ -1867,6 +1870,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b( + GFP_ATOMIC)) + goto nomem; + ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Update the content of current association. */ + sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc)); + sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, +@@ -1961,6 +1967,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_d( + * a COOKIE ACK. + */ + ++ if (!sctp_auth_chunk_verify(net, chunk, asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Don't accidentally move back into established state. */ + if (asoc->state < SCTP_STATE_ESTABLISHED) { + sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, +@@ -2000,7 +2009,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_d( + } + } + +- repl = sctp_make_cookie_ack(new_asoc, chunk); ++ repl = sctp_make_cookie_ack(asoc, chunk); + if (!repl) + goto nomem; + +@@ -4111,10 +4120,7 @@ enum sctp_disposition sctp_sf_eat_fwd_tsn_fast( + * The return value is the disposition of the chunk. + */ + static enum sctp_ierror sctp_sf_authenticate( +- struct net *net, +- const struct sctp_endpoint *ep, + const struct sctp_association *asoc, +- const union sctp_subtype type, + struct sctp_chunk *chunk) + { + struct sctp_authhdr *auth_hdr; +@@ -4212,7 +4218,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net, + commands); + + auth_hdr = (struct sctp_authhdr *)chunk->skb->data; +- error = sctp_sf_authenticate(net, ep, asoc, type, chunk); ++ error = sctp_sf_authenticate(asoc, chunk); + switch (error) { + case SCTP_IERROR_AUTH_BAD_HMAC: + /* Generate the ERROR chunk and discard the rest +diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c +index 5447228bf1a0..8538c96c96c1 100644 +--- a/net/sctp/ulpevent.c ++++ b/net/sctp/ulpevent.c +@@ -717,7 +717,6 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc, + return event; + + fail_mark: +- sctp_chunk_put(chunk); + kfree_skb(skb); + fail: + return NULL; +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 282361ac0263..dfef930d1e50 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -87,6 +87,7 @@ int tls_push_sg(struct sock *sk, + size = sg->length - offset; + offset += sg->offset; + ++ ctx->in_tcp_sendpages = true; + while (1) { + if (sg_is_last(sg)) + sendpage_flags = flags; +@@ -107,6 +108,7 @@ int tls_push_sg(struct sock *sk, + offset -= sg->offset; + ctx->partially_sent_offset = offset; + ctx->partially_sent_record = (void *)sg; ++ ctx->in_tcp_sendpages = false; + return ret; + } + +@@ -121,6 +123,8 @@ int tls_push_sg(struct sock *sk, + } + + clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags); ++ ctx->in_tcp_sendpages = false; ++ ctx->sk_write_space(sk); + + return 0; + } +@@ -190,6 +194,10 @@ static void tls_write_space(struct sock *sk) + { + struct tls_context *ctx = tls_get_ctx(sk); + ++ /* We are already sending pages, ignore notification */ ++ if (ctx->in_tcp_sendpages) ++ return; ++ + if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) { + gfp_t sk_allocation = sk->sk_allocation; + int rc; +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 3f6f6f8c9fa5..5b2409746ae0 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -518,7 +518,7 @@ int xfrm_trans_queue(struct sk_buff *skb, + return -ENOBUFS; + + XFRM_TRANS_SKB_CB(skb)->finish = finish; +- skb_queue_tail(&trans->queue, skb); ++ __skb_queue_tail(&trans->queue, skb); + tasklet_schedule(&trans->tasklet); + return 0; + } +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 8f13fb57eab5..6c4ec69e11a0 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1345,6 +1345,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + + if (orig->aead) { + x->aead = xfrm_algo_aead_clone(orig->aead); ++ x->geniv = orig->geniv; + if (!x->aead) + goto error; + } diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.42-43.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.42-43.patch new file mode 100644 index 000000000000..7abbee275d76 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.42-43.patch @@ -0,0 +1,3826 @@ +diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu +index 258902db14bf..8355e79350b7 100644 +--- a/Documentation/ABI/testing/sysfs-devices-system-cpu ++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu +@@ -378,6 +378,7 @@ What: /sys/devices/system/cpu/vulnerabilities + /sys/devices/system/cpu/vulnerabilities/meltdown + /sys/devices/system/cpu/vulnerabilities/spectre_v1 + /sys/devices/system/cpu/vulnerabilities/spectre_v2 ++ /sys/devices/system/cpu/vulnerabilities/spec_store_bypass + Date: January 2018 + Contact: Linux kernel mailing list + Description: Information about CPU vulnerabilities +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 8cfb44ffe853..0380a45ecf4b 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -2600,6 +2600,9 @@ + allow data leaks with this option, which is equivalent + to spectre_v2=off. + ++ nospec_store_bypass_disable ++ [HW] Disable all mitigations for the Speculative Store Bypass vulnerability ++ + noxsave [BUGS=X86] Disables x86 extended register state save + and restore using xsave. The kernel will fallback to + enabling legacy floating-point and sse state. +@@ -3930,6 +3933,48 @@ + Not specifying this option is equivalent to + spectre_v2=auto. + ++ spec_store_bypass_disable= ++ [HW] Control Speculative Store Bypass (SSB) Disable mitigation ++ (Speculative Store Bypass vulnerability) ++ ++ Certain CPUs are vulnerable to an exploit against a ++ a common industry wide performance optimization known ++ as "Speculative Store Bypass" in which recent stores ++ to the same memory location may not be observed by ++ later loads during speculative execution. The idea ++ is that such stores are unlikely and that they can ++ be detected prior to instruction retirement at the ++ end of a particular speculation execution window. ++ ++ In vulnerable processors, the speculatively forwarded ++ store can be used in a cache side channel attack, for ++ example to read memory to which the attacker does not ++ directly have access (e.g. inside sandboxed code). ++ ++ This parameter controls whether the Speculative Store ++ Bypass optimization is used. ++ ++ on - Unconditionally disable Speculative Store Bypass ++ off - Unconditionally enable Speculative Store Bypass ++ auto - Kernel detects whether the CPU model contains an ++ implementation of Speculative Store Bypass and ++ picks the most appropriate mitigation. If the ++ CPU is not vulnerable, "off" is selected. If the ++ CPU is vulnerable the default mitigation is ++ architecture and Kconfig dependent. See below. ++ prctl - Control Speculative Store Bypass per thread ++ via prctl. Speculative Store Bypass is enabled ++ for a process by default. The state of the control ++ is inherited on fork. ++ seccomp - Same as "prctl" above, but all seccomp threads ++ will disable SSB unless they explicitly opt out. ++ ++ Not specifying this option is equivalent to ++ spec_store_bypass_disable=auto. ++ ++ Default mitigations: ++ X86: If CONFIG_SECCOMP=y "seccomp", otherwise "prctl" ++ + spia_io_base= [HW,MTD] + spia_fio_base= + spia_pedr= +diff --git a/Documentation/userspace-api/index.rst b/Documentation/userspace-api/index.rst +index 7b2eb1b7d4ca..a3233da7fa88 100644 +--- a/Documentation/userspace-api/index.rst ++++ b/Documentation/userspace-api/index.rst +@@ -19,6 +19,7 @@ place where this information is gathered. + no_new_privs + seccomp_filter + unshare ++ spec_ctrl + + .. only:: subproject and html + +diff --git a/Documentation/userspace-api/spec_ctrl.rst b/Documentation/userspace-api/spec_ctrl.rst +new file mode 100644 +index 000000000000..32f3d55c54b7 +--- /dev/null ++++ b/Documentation/userspace-api/spec_ctrl.rst +@@ -0,0 +1,94 @@ ++=================== ++Speculation Control ++=================== ++ ++Quite some CPUs have speculation-related misfeatures which are in ++fact vulnerabilities causing data leaks in various forms even across ++privilege domains. ++ ++The kernel provides mitigation for such vulnerabilities in various ++forms. Some of these mitigations are compile-time configurable and some ++can be supplied on the kernel command line. ++ ++There is also a class of mitigations which are very expensive, but they can ++be restricted to a certain set of processes or tasks in controlled ++environments. The mechanism to control these mitigations is via ++:manpage:`prctl(2)`. ++ ++There are two prctl options which are related to this: ++ ++ * PR_GET_SPECULATION_CTRL ++ ++ * PR_SET_SPECULATION_CTRL ++ ++PR_GET_SPECULATION_CTRL ++----------------------- ++ ++PR_GET_SPECULATION_CTRL returns the state of the speculation misfeature ++which is selected with arg2 of prctl(2). The return value uses bits 0-3 with ++the following meaning: ++ ++==== ===================== =================================================== ++Bit Define Description ++==== ===================== =================================================== ++0 PR_SPEC_PRCTL Mitigation can be controlled per task by ++ PR_SET_SPECULATION_CTRL. ++1 PR_SPEC_ENABLE The speculation feature is enabled, mitigation is ++ disabled. ++2 PR_SPEC_DISABLE The speculation feature is disabled, mitigation is ++ enabled. ++3 PR_SPEC_FORCE_DISABLE Same as PR_SPEC_DISABLE, but cannot be undone. A ++ subsequent prctl(..., PR_SPEC_ENABLE) will fail. ++==== ===================== =================================================== ++ ++If all bits are 0 the CPU is not affected by the speculation misfeature. ++ ++If PR_SPEC_PRCTL is set, then the per-task control of the mitigation is ++available. If not set, prctl(PR_SET_SPECULATION_CTRL) for the speculation ++misfeature will fail. ++ ++PR_SET_SPECULATION_CTRL ++----------------------- ++ ++PR_SET_SPECULATION_CTRL allows to control the speculation misfeature, which ++is selected by arg2 of :manpage:`prctl(2)` per task. arg3 is used to hand ++in the control value, i.e. either PR_SPEC_ENABLE or PR_SPEC_DISABLE or ++PR_SPEC_FORCE_DISABLE. ++ ++Common error codes ++------------------ ++======= ================================================================= ++Value Meaning ++======= ================================================================= ++EINVAL The prctl is not implemented by the architecture or unused ++ prctl(2) arguments are not 0. ++ ++ENODEV arg2 is selecting a not supported speculation misfeature. ++======= ================================================================= ++ ++PR_SET_SPECULATION_CTRL error codes ++----------------------------------- ++======= ================================================================= ++Value Meaning ++======= ================================================================= ++0 Success ++ ++ERANGE arg3 is incorrect, i.e. it's neither PR_SPEC_ENABLE nor ++ PR_SPEC_DISABLE nor PR_SPEC_FORCE_DISABLE. ++ ++ENXIO Control of the selected speculation misfeature is not possible. ++ See PR_GET_SPECULATION_CTRL. ++ ++EPERM Speculation was disabled with PR_SPEC_FORCE_DISABLE and caller ++ tried to enable it again. ++======= ================================================================= ++ ++Speculation misfeature controls ++------------------------------- ++- PR_SPEC_STORE_BYPASS: Speculative Store Bypass ++ ++ Invocations: ++ * prctl(PR_GET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, 0, 0, 0); ++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_ENABLE, 0, 0); ++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_DISABLE, 0, 0); ++ * prctl(PR_SET_SPECULATION_CTRL, PR_SPEC_STORE_BYPASS, PR_SPEC_FORCE_DISABLE, 0, 0); +diff --git a/Makefile b/Makefile +index 777f5685a36b..9be88c9d9fc9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 42 ++SUBLEVEL = 43 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h +index bc8d4bbd82e2..9342904cccca 100644 +--- a/arch/arm/include/asm/assembler.h ++++ b/arch/arm/include/asm/assembler.h +@@ -536,4 +536,14 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) + #endif + .endm + ++#ifdef CONFIG_KPROBES ++#define _ASM_NOKPROBE(entry) \ ++ .pushsection "_kprobe_blacklist", "aw" ; \ ++ .balign 4 ; \ ++ .long entry; \ ++ .popsection ++#else ++#define _ASM_NOKPROBE(entry) ++#endif ++ + #endif /* __ASM_ASSEMBLER_H__ */ +diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h +index eb46fc81a440..08cd720eae01 100644 +--- a/arch/arm/include/asm/kvm_mmu.h ++++ b/arch/arm/include/asm/kvm_mmu.h +@@ -221,6 +221,22 @@ static inline unsigned int kvm_get_vmid_bits(void) + return 8; + } + ++/* ++ * We are not in the kvm->srcu critical section most of the time, so we take ++ * the SRCU read lock here. Since we copy the data from the user page, we ++ * can immediately drop the lock again. ++ */ ++static inline int kvm_read_guest_lock(struct kvm *kvm, ++ gpa_t gpa, void *data, unsigned long len) ++{ ++ int srcu_idx = srcu_read_lock(&kvm->srcu); ++ int ret = kvm_read_guest(kvm, gpa, data, len); ++ ++ srcu_read_unlock(&kvm->srcu, srcu_idx); ++ ++ return ret; ++} ++ + static inline void *kvm_get_hyp_vector(void) + { + return kvm_ksym_ref(__kvm_hyp_vector); +diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c +index b8dc3b516f93..f702f2b37052 100644 +--- a/arch/arm/kernel/traps.c ++++ b/arch/arm/kernel/traps.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -417,7 +418,8 @@ void unregister_undef_hook(struct undef_hook *hook) + raw_spin_unlock_irqrestore(&undef_lock, flags); + } + +-static int call_undef_hook(struct pt_regs *regs, unsigned int instr) ++static nokprobe_inline ++int call_undef_hook(struct pt_regs *regs, unsigned int instr) + { + struct undef_hook *hook; + unsigned long flags; +@@ -490,6 +492,7 @@ asmlinkage void __exception do_undefinstr(struct pt_regs *regs) + + arm_notify_die("Oops - undefined instruction", regs, &info, 0, 6); + } ++NOKPROBE_SYMBOL(do_undefinstr) + + /* + * Handle FIQ similarly to NMI on x86 systems. +diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S +index df73914e81c8..746e7801dcdf 100644 +--- a/arch/arm/lib/getuser.S ++++ b/arch/arm/lib/getuser.S +@@ -38,6 +38,7 @@ ENTRY(__get_user_1) + mov r0, #0 + ret lr + ENDPROC(__get_user_1) ++_ASM_NOKPROBE(__get_user_1) + + ENTRY(__get_user_2) + check_uaccess r0, 2, r1, r2, __get_user_bad +@@ -58,6 +59,7 @@ rb .req r0 + mov r0, #0 + ret lr + ENDPROC(__get_user_2) ++_ASM_NOKPROBE(__get_user_2) + + ENTRY(__get_user_4) + check_uaccess r0, 4, r1, r2, __get_user_bad +@@ -65,6 +67,7 @@ ENTRY(__get_user_4) + mov r0, #0 + ret lr + ENDPROC(__get_user_4) ++_ASM_NOKPROBE(__get_user_4) + + ENTRY(__get_user_8) + check_uaccess r0, 8, r1, r2, __get_user_bad8 +@@ -78,6 +81,7 @@ ENTRY(__get_user_8) + mov r0, #0 + ret lr + ENDPROC(__get_user_8) ++_ASM_NOKPROBE(__get_user_8) + + #ifdef __ARMEB__ + ENTRY(__get_user_32t_8) +@@ -91,6 +95,7 @@ ENTRY(__get_user_32t_8) + mov r0, #0 + ret lr + ENDPROC(__get_user_32t_8) ++_ASM_NOKPROBE(__get_user_32t_8) + + ENTRY(__get_user_64t_1) + check_uaccess r0, 1, r1, r2, __get_user_bad8 +@@ -98,6 +103,7 @@ ENTRY(__get_user_64t_1) + mov r0, #0 + ret lr + ENDPROC(__get_user_64t_1) ++_ASM_NOKPROBE(__get_user_64t_1) + + ENTRY(__get_user_64t_2) + check_uaccess r0, 2, r1, r2, __get_user_bad8 +@@ -114,6 +120,7 @@ rb .req r0 + mov r0, #0 + ret lr + ENDPROC(__get_user_64t_2) ++_ASM_NOKPROBE(__get_user_64t_2) + + ENTRY(__get_user_64t_4) + check_uaccess r0, 4, r1, r2, __get_user_bad8 +@@ -121,6 +128,7 @@ ENTRY(__get_user_64t_4) + mov r0, #0 + ret lr + ENDPROC(__get_user_64t_4) ++_ASM_NOKPROBE(__get_user_64t_4) + #endif + + __get_user_bad8: +@@ -131,6 +139,8 @@ __get_user_bad: + ret lr + ENDPROC(__get_user_bad) + ENDPROC(__get_user_bad8) ++_ASM_NOKPROBE(__get_user_bad) ++_ASM_NOKPROBE(__get_user_bad8) + + .pushsection __ex_table, "a" + .long 1b, __get_user_bad +diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c +index bcdecc25461b..b2aa9b32bff2 100644 +--- a/arch/arm/probes/kprobes/opt-arm.c ++++ b/arch/arm/probes/kprobes/opt-arm.c +@@ -165,13 +165,14 @@ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) + { + unsigned long flags; + struct kprobe *p = &op->kp; +- struct kprobe_ctlblk *kcb = get_kprobe_ctlblk(); ++ struct kprobe_ctlblk *kcb; + + /* Save skipped registers */ + regs->ARM_pc = (unsigned long)op->kp.addr; + regs->ARM_ORIG_r0 = ~0UL; + + local_irq_save(flags); ++ kcb = get_kprobe_ctlblk(); + + if (kprobe_running()) { + kprobes_inc_nmissed_count(&op->kp); +@@ -191,6 +192,7 @@ optimized_callback(struct optimized_kprobe *op, struct pt_regs *regs) + + local_irq_restore(flags); + } ++NOKPROBE_SYMBOL(optimized_callback) + + int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *orig) + { +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index 2d6d4bd9de52..fe55b516f018 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -309,6 +309,22 @@ static inline unsigned int kvm_get_vmid_bits(void) + return (cpuid_feature_extract_unsigned_field(reg, ID_AA64MMFR1_VMIDBITS_SHIFT) == 2) ? 16 : 8; + } + ++/* ++ * We are not in the kvm->srcu critical section most of the time, so we take ++ * the SRCU read lock here. Since we copy the data from the user page, we ++ * can immediately drop the lock again. ++ */ ++static inline int kvm_read_guest_lock(struct kvm *kvm, ++ gpa_t gpa, void *data, unsigned long len) ++{ ++ int srcu_idx = srcu_read_lock(&kvm->srcu); ++ int ret = kvm_read_guest(kvm, gpa, data, len); ++ ++ srcu_read_unlock(&kvm->srcu, srcu_idx); ++ ++ return ret; ++} ++ + #ifdef CONFIG_HARDEN_BRANCH_PREDICTOR + #include + +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index 90bc20efb4c7..b4fcb54b9686 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -242,14 +242,6 @@ static int show_cpuinfo(struct seq_file *m, void *v) + unsigned short maj; + unsigned short min; + +- /* We only show online cpus: disable preempt (overzealous, I +- * knew) to prevent cpu going down. */ +- preempt_disable(); +- if (!cpu_online(cpu_id)) { +- preempt_enable(); +- return 0; +- } +- + #ifdef CONFIG_SMP + pvr = per_cpu(cpu_pvr, cpu_id); + #else +@@ -358,9 +350,6 @@ static int show_cpuinfo(struct seq_file *m, void *v) + #ifdef CONFIG_SMP + seq_printf(m, "\n"); + #endif +- +- preempt_enable(); +- + /* If this is the last cpu, print the summary */ + if (cpumask_next(cpu_id, cpu_online_mask) >= nr_cpu_ids) + show_cpuinfo_summary(m); +diff --git a/arch/powerpc/platforms/powernv/opal-nvram.c b/arch/powerpc/platforms/powernv/opal-nvram.c +index 1bceb95f422d..5584247f5029 100644 +--- a/arch/powerpc/platforms/powernv/opal-nvram.c ++++ b/arch/powerpc/platforms/powernv/opal-nvram.c +@@ -44,6 +44,10 @@ static ssize_t opal_nvram_read(char *buf, size_t count, loff_t *index) + return count; + } + ++/* ++ * This can be called in the panic path with interrupts off, so use ++ * mdelay in that case. ++ */ + static ssize_t opal_nvram_write(char *buf, size_t count, loff_t *index) + { + s64 rc = OPAL_BUSY; +@@ -58,10 +62,16 @@ static ssize_t opal_nvram_write(char *buf, size_t count, loff_t *index) + while (rc == OPAL_BUSY || rc == OPAL_BUSY_EVENT) { + rc = opal_write_nvram(__pa(buf), count, off); + if (rc == OPAL_BUSY_EVENT) { +- msleep(OPAL_BUSY_DELAY_MS); ++ if (in_interrupt() || irqs_disabled()) ++ mdelay(OPAL_BUSY_DELAY_MS); ++ else ++ msleep(OPAL_BUSY_DELAY_MS); + opal_poll_events(NULL); + } else if (rc == OPAL_BUSY) { +- msleep(OPAL_BUSY_DELAY_MS); ++ if (in_interrupt() || irqs_disabled()) ++ mdelay(OPAL_BUSY_DELAY_MS); ++ else ++ msleep(OPAL_BUSY_DELAY_MS); + } + } + +diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c +index 94f2099bceb0..3d17c41074ca 100644 +--- a/arch/s390/kernel/irq.c ++++ b/arch/s390/kernel/irq.c +@@ -176,10 +176,9 @@ void do_softirq_own_stack(void) + new -= STACK_FRAME_OVERHEAD; + ((struct stack_frame *) new)->back_chain = old; + asm volatile(" la 15,0(%0)\n" +- " basr 14,%2\n" ++ " brasl 14,__do_softirq\n" + " la 15,0(%1)\n" +- : : "a" (new), "a" (old), +- "a" (__do_softirq) ++ : : "a" (new), "a" (old) + : "0", "1", "2", "3", "4", "5", "14", + "cc", "memory" ); + } else { +diff --git a/arch/s390/kernel/perf_cpum_sf.c b/arch/s390/kernel/perf_cpum_sf.c +index 7e1e40323b78..d99155793c26 100644 +--- a/arch/s390/kernel/perf_cpum_sf.c ++++ b/arch/s390/kernel/perf_cpum_sf.c +@@ -739,6 +739,10 @@ static int __hw_perf_event_init(struct perf_event *event) + */ + rate = 0; + if (attr->freq) { ++ if (!attr->sample_freq) { ++ err = -EINVAL; ++ goto out; ++ } + rate = freq_to_sample_rate(&si, attr->sample_freq); + rate = hw_limit_rate(&si, rate); + attr->freq = 0; +diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c +index e56dbc67e837..97c57b5f8d57 100644 +--- a/arch/x86/boot/compressed/eboot.c ++++ b/arch/x86/boot/compressed/eboot.c +@@ -163,7 +163,8 @@ __setup_efi_pci32(efi_pci_io_protocol_32 *pci, struct pci_setup_rom **__rom) + if (status != EFI_SUCCESS) + goto free_struct; + +- memcpy(rom->romdata, pci->romimage, pci->romsize); ++ memcpy(rom->romdata, (void *)(unsigned long)pci->romimage, ++ pci->romsize); + return status; + + free_struct: +@@ -269,7 +270,8 @@ __setup_efi_pci64(efi_pci_io_protocol_64 *pci, struct pci_setup_rom **__rom) + if (status != EFI_SUCCESS) + goto free_struct; + +- memcpy(rom->romdata, pci->romimage, pci->romsize); ++ memcpy(rom->romdata, (void *)(unsigned long)pci->romimage, ++ pci->romsize); + return status; + + free_struct: +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 23a65439c37c..403e97d5e243 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -198,7 +198,6 @@ + #define X86_FEATURE_CAT_L2 ( 7*32+ 5) /* Cache Allocation Technology L2 */ + #define X86_FEATURE_CDP_L3 ( 7*32+ 6) /* Code and Data Prioritization L3 */ + #define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 7) /* Effectively INVPCID && CR4.PCIDE=1 */ +- + #define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ + #define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ + #define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ +@@ -207,11 +206,19 @@ + #define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ + #define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ + ++#define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */ ++#define X86_FEATURE_SSBD ( 7*32+17) /* Speculative Store Bypass Disable */ + #define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ + #define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ + + #define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ + #define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ ++#define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23) /* "" Disable Speculative Store Bypass. */ ++#define X86_FEATURE_LS_CFG_SSBD ( 7*32+24) /* "" AMD SSBD implementation via LS_CFG MSR */ ++#define X86_FEATURE_IBRS ( 7*32+25) /* Indirect Branch Restricted Speculation */ ++#define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */ ++#define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ + + /* Virtualization flags: Linux defined, word 8 */ + #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ +@@ -272,9 +279,10 @@ + #define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */ + #define X86_FEATURE_IRPERF (13*32+ 1) /* Instructions Retired Count */ + #define X86_FEATURE_XSAVEERPTR (13*32+ 2) /* Always save/restore FP error pointers */ +-#define X86_FEATURE_IBPB (13*32+12) /* Indirect Branch Prediction Barrier */ +-#define X86_FEATURE_IBRS (13*32+14) /* Indirect Branch Restricted Speculation */ +-#define X86_FEATURE_STIBP (13*32+15) /* Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_AMD_IBPB (13*32+12) /* "" Indirect Branch Prediction Barrier */ ++#define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */ ++#define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */ + + /* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */ + #define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */ +@@ -331,6 +339,7 @@ + #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ + #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ + #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ ++#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ + + /* + * BUG word(s) +@@ -360,5 +369,6 @@ + #define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ + #define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ + #define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ ++#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ + + #endif /* _ASM_X86_CPUFEATURES_H */ +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 4f8b80199672..174b9c41efce 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -908,7 +908,7 @@ struct kvm_x86_ops { + int (*hardware_setup)(void); /* __init */ + void (*hardware_unsetup)(void); /* __exit */ + bool (*cpu_has_accelerated_tpr)(void); +- bool (*cpu_has_high_real_mode_segbase)(void); ++ bool (*has_emulated_msr)(int index); + void (*cpuid_update)(struct kvm_vcpu *vcpu); + + int (*vm_init)(struct kvm *kvm); +diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h +index 1de72ce514cd..ed97ef3b48a7 100644 +--- a/arch/x86/include/asm/mmu_context.h ++++ b/arch/x86/include/asm/mmu_context.h +@@ -192,7 +192,7 @@ static inline int init_new_context(struct task_struct *tsk, + + #ifdef CONFIG_X86_INTEL_MEMORY_PROTECTION_KEYS + if (cpu_feature_enabled(X86_FEATURE_OSPKE)) { +- /* pkey 0 is the default and always allocated */ ++ /* pkey 0 is the default and allocated implicitly */ + mm->context.pkey_allocation_map = 0x1; + /* -1 means unallocated or invalid */ + mm->context.execute_only_pkey = -1; +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index eb83ff1bae8f..504b21692d32 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -42,6 +42,8 @@ + #define MSR_IA32_SPEC_CTRL 0x00000048 /* Speculation Control */ + #define SPEC_CTRL_IBRS (1 << 0) /* Indirect Branch Restricted Speculation */ + #define SPEC_CTRL_STIBP (1 << 1) /* Single Thread Indirect Branch Predictors */ ++#define SPEC_CTRL_SSBD_SHIFT 2 /* Speculative Store Bypass Disable bit */ ++#define SPEC_CTRL_SSBD (1 << SPEC_CTRL_SSBD_SHIFT) /* Speculative Store Bypass Disable */ + + #define MSR_IA32_PRED_CMD 0x00000049 /* Prediction Command */ + #define PRED_CMD_IBPB (1 << 0) /* Indirect Branch Prediction Barrier */ +@@ -68,6 +70,11 @@ + #define MSR_IA32_ARCH_CAPABILITIES 0x0000010a + #define ARCH_CAP_RDCL_NO (1 << 0) /* Not susceptible to Meltdown */ + #define ARCH_CAP_IBRS_ALL (1 << 1) /* Enhanced IBRS support */ ++#define ARCH_CAP_SSB_NO (1 << 4) /* ++ * Not susceptible to Speculative Store Bypass ++ * attack, so no Speculative Store Bypass ++ * control required. ++ */ + + #define MSR_IA32_BBL_CR_CTL 0x00000119 + #define MSR_IA32_BBL_CR_CTL3 0x0000011e +@@ -337,6 +344,8 @@ + #define MSR_AMD64_IBSOPDATA4 0xc001103d + #define MSR_AMD64_IBS_REG_COUNT_MAX 8 /* includes MSR_AMD64_IBSBRTARGET */ + ++#define MSR_AMD64_VIRT_SPEC_CTRL 0xc001011f ++ + /* Fam 17h MSRs */ + #define MSR_F17H_IRPERF 0xc00000e9 + +diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h +index f928ad9b143f..8b38df98548e 100644 +--- a/arch/x86/include/asm/nospec-branch.h ++++ b/arch/x86/include/asm/nospec-branch.h +@@ -217,6 +217,14 @@ enum spectre_v2_mitigation { + SPECTRE_V2_IBRS, + }; + ++/* The Speculative Store Bypass disable variants */ ++enum ssb_mitigation { ++ SPEC_STORE_BYPASS_NONE, ++ SPEC_STORE_BYPASS_DISABLE, ++ SPEC_STORE_BYPASS_PRCTL, ++ SPEC_STORE_BYPASS_SECCOMP, ++}; ++ + extern char __indirect_thunk_start[]; + extern char __indirect_thunk_end[]; + +@@ -241,22 +249,27 @@ static inline void vmexit_fill_RSB(void) + #endif + } + +-#define alternative_msr_write(_msr, _val, _feature) \ +- asm volatile(ALTERNATIVE("", \ +- "movl %[msr], %%ecx\n\t" \ +- "movl %[val], %%eax\n\t" \ +- "movl $0, %%edx\n\t" \ +- "wrmsr", \ +- _feature) \ +- : : [msr] "i" (_msr), [val] "i" (_val) \ +- : "eax", "ecx", "edx", "memory") ++static __always_inline ++void alternative_msr_write(unsigned int msr, u64 val, unsigned int feature) ++{ ++ asm volatile(ALTERNATIVE("", "wrmsr", %c[feature]) ++ : : "c" (msr), ++ "a" ((u32)val), ++ "d" ((u32)(val >> 32)), ++ [feature] "i" (feature) ++ : "memory"); ++} + + static inline void indirect_branch_prediction_barrier(void) + { +- alternative_msr_write(MSR_IA32_PRED_CMD, PRED_CMD_IBPB, +- X86_FEATURE_USE_IBPB); ++ u64 val = PRED_CMD_IBPB; ++ ++ alternative_msr_write(MSR_IA32_PRED_CMD, val, X86_FEATURE_USE_IBPB); + } + ++/* The Intel SPEC CTRL MSR base value cache */ ++extern u64 x86_spec_ctrl_base; ++ + /* + * With retpoline, we must use IBRS to restrict branch prediction + * before calling into firmware. +@@ -265,14 +278,18 @@ static inline void indirect_branch_prediction_barrier(void) + */ + #define firmware_restrict_branch_speculation_start() \ + do { \ ++ u64 val = x86_spec_ctrl_base | SPEC_CTRL_IBRS; \ ++ \ + preempt_disable(); \ +- alternative_msr_write(MSR_IA32_SPEC_CTRL, SPEC_CTRL_IBRS, \ ++ alternative_msr_write(MSR_IA32_SPEC_CTRL, val, \ + X86_FEATURE_USE_IBRS_FW); \ + } while (0) + + #define firmware_restrict_branch_speculation_end() \ + do { \ +- alternative_msr_write(MSR_IA32_SPEC_CTRL, 0, \ ++ u64 val = x86_spec_ctrl_base; \ ++ \ ++ alternative_msr_write(MSR_IA32_SPEC_CTRL, val, \ + X86_FEATURE_USE_IBRS_FW); \ + preempt_enable(); \ + } while (0) +diff --git a/arch/x86/include/asm/pkeys.h b/arch/x86/include/asm/pkeys.h +index a0ba1ffda0df..851c04b7a092 100644 +--- a/arch/x86/include/asm/pkeys.h ++++ b/arch/x86/include/asm/pkeys.h +@@ -2,6 +2,8 @@ + #ifndef _ASM_X86_PKEYS_H + #define _ASM_X86_PKEYS_H + ++#define ARCH_DEFAULT_PKEY 0 ++ + #define arch_max_pkey() (boot_cpu_has(X86_FEATURE_OSPKE) ? 16 : 1) + + extern int arch_set_user_pkey_access(struct task_struct *tsk, int pkey, +@@ -15,7 +17,7 @@ extern int __execute_only_pkey(struct mm_struct *mm); + static inline int execute_only_pkey(struct mm_struct *mm) + { + if (!boot_cpu_has(X86_FEATURE_OSPKE)) +- return 0; ++ return ARCH_DEFAULT_PKEY; + + return __execute_only_pkey(mm); + } +@@ -49,13 +51,21 @@ bool mm_pkey_is_allocated(struct mm_struct *mm, int pkey) + { + /* + * "Allocated" pkeys are those that have been returned +- * from pkey_alloc(). pkey 0 is special, and never +- * returned from pkey_alloc(). ++ * from pkey_alloc() or pkey 0 which is allocated ++ * implicitly when the mm is created. + */ +- if (pkey <= 0) ++ if (pkey < 0) + return false; + if (pkey >= arch_max_pkey()) + return false; ++ /* ++ * The exec-only pkey is set in the allocation map, but ++ * is not available to any of the user interfaces like ++ * mprotect_pkey(). ++ */ ++ if (pkey == mm->context.execute_only_pkey) ++ return false; ++ + return mm_pkey_allocation_map(mm) & (1U << pkey); + } + +diff --git a/arch/x86/include/asm/spec-ctrl.h b/arch/x86/include/asm/spec-ctrl.h +new file mode 100644 +index 000000000000..ae7c2c5cd7f0 +--- /dev/null ++++ b/arch/x86/include/asm/spec-ctrl.h +@@ -0,0 +1,80 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_X86_SPECCTRL_H_ ++#define _ASM_X86_SPECCTRL_H_ ++ ++#include ++#include ++ ++/* ++ * On VMENTER we must preserve whatever view of the SPEC_CTRL MSR ++ * the guest has, while on VMEXIT we restore the host view. This ++ * would be easier if SPEC_CTRL were architecturally maskable or ++ * shadowable for guests but this is not (currently) the case. ++ * Takes the guest view of SPEC_CTRL MSR as a parameter and also ++ * the guest's version of VIRT_SPEC_CTRL, if emulated. ++ */ ++extern void x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool guest); ++ ++/** ++ * x86_spec_ctrl_set_guest - Set speculation control registers for the guest ++ * @guest_spec_ctrl: The guest content of MSR_SPEC_CTRL ++ * @guest_virt_spec_ctrl: The guest controlled bits of MSR_VIRT_SPEC_CTRL ++ * (may get translated to MSR_AMD64_LS_CFG bits) ++ * ++ * Avoids writing to the MSR if the content/bits are the same ++ */ ++static inline ++void x86_spec_ctrl_set_guest(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl) ++{ ++ x86_virt_spec_ctrl(guest_spec_ctrl, guest_virt_spec_ctrl, true); ++} ++ ++/** ++ * x86_spec_ctrl_restore_host - Restore host speculation control registers ++ * @guest_spec_ctrl: The guest content of MSR_SPEC_CTRL ++ * @guest_virt_spec_ctrl: The guest controlled bits of MSR_VIRT_SPEC_CTRL ++ * (may get translated to MSR_AMD64_LS_CFG bits) ++ * ++ * Avoids writing to the MSR if the content/bits are the same ++ */ ++static inline ++void x86_spec_ctrl_restore_host(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl) ++{ ++ x86_virt_spec_ctrl(guest_spec_ctrl, guest_virt_spec_ctrl, false); ++} ++ ++/* AMD specific Speculative Store Bypass MSR data */ ++extern u64 x86_amd_ls_cfg_base; ++extern u64 x86_amd_ls_cfg_ssbd_mask; ++ ++static inline u64 ssbd_tif_to_spec_ctrl(u64 tifn) ++{ ++ BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT); ++ return (tifn & _TIF_SSBD) >> (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT); ++} ++ ++static inline unsigned long ssbd_spec_ctrl_to_tif(u64 spec_ctrl) ++{ ++ BUILD_BUG_ON(TIF_SSBD < SPEC_CTRL_SSBD_SHIFT); ++ return (spec_ctrl & SPEC_CTRL_SSBD) << (TIF_SSBD - SPEC_CTRL_SSBD_SHIFT); ++} ++ ++static inline u64 ssbd_tif_to_amd_ls_cfg(u64 tifn) ++{ ++ return (tifn & _TIF_SSBD) ? x86_amd_ls_cfg_ssbd_mask : 0ULL; ++} ++ ++#ifdef CONFIG_SMP ++extern void speculative_store_bypass_ht_init(void); ++#else ++static inline void speculative_store_bypass_ht_init(void) { } ++#endif ++ ++extern void speculative_store_bypass_update(unsigned long tif); ++ ++static inline void speculative_store_bypass_update_current(void) ++{ ++ speculative_store_bypass_update(current_thread_info()->flags); ++} ++ ++#endif +diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h +index eda3b6823ca4..95ff2d7f553f 100644 +--- a/arch/x86/include/asm/thread_info.h ++++ b/arch/x86/include/asm/thread_info.h +@@ -81,6 +81,7 @@ struct thread_info { + #define TIF_SIGPENDING 2 /* signal pending */ + #define TIF_NEED_RESCHED 3 /* rescheduling necessary */ + #define TIF_SINGLESTEP 4 /* reenable singlestep on user return*/ ++#define TIF_SSBD 5 /* Reduced data speculation */ + #define TIF_SYSCALL_EMU 6 /* syscall emulation active */ + #define TIF_SYSCALL_AUDIT 7 /* syscall auditing active */ + #define TIF_SECCOMP 8 /* secure computing */ +@@ -107,6 +108,7 @@ struct thread_info { + #define _TIF_SIGPENDING (1 << TIF_SIGPENDING) + #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) + #define _TIF_SINGLESTEP (1 << TIF_SINGLESTEP) ++#define _TIF_SSBD (1 << TIF_SSBD) + #define _TIF_SYSCALL_EMU (1 << TIF_SYSCALL_EMU) + #define _TIF_SYSCALL_AUDIT (1 << TIF_SYSCALL_AUDIT) + #define _TIF_SECCOMP (1 << TIF_SECCOMP) +@@ -146,7 +148,7 @@ struct thread_info { + + /* flags to check in __switch_to() */ + #define _TIF_WORK_CTXSW \ +- (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP) ++ (_TIF_IO_BITMAP|_TIF_NOCPUID|_TIF_NOTSC|_TIF_BLOCKSTEP|_TIF_SSBD) + + #define _TIF_WORK_CTXSW_PREV (_TIF_WORK_CTXSW|_TIF_USER_RETURN_NOTIFY) + #define _TIF_WORK_CTXSW_NEXT (_TIF_WORK_CTXSW) +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index e7d5a7883632..90574f731c05 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -554,6 +555,26 @@ static void bsp_init_amd(struct cpuinfo_x86 *c) + rdmsrl(MSR_FAM10H_NODE_ID, value); + nodes_per_socket = ((value >> 3) & 7) + 1; + } ++ ++ if (c->x86 >= 0x15 && c->x86 <= 0x17) { ++ unsigned int bit; ++ ++ switch (c->x86) { ++ case 0x15: bit = 54; break; ++ case 0x16: bit = 33; break; ++ case 0x17: bit = 10; break; ++ default: return; ++ } ++ /* ++ * Try to cache the base value so further operations can ++ * avoid RMW. If that faults, do not enable SSBD. ++ */ ++ if (!rdmsrl_safe(MSR_AMD64_LS_CFG, &x86_amd_ls_cfg_base)) { ++ setup_force_cpu_cap(X86_FEATURE_LS_CFG_SSBD); ++ setup_force_cpu_cap(X86_FEATURE_SSBD); ++ x86_amd_ls_cfg_ssbd_mask = 1ULL << bit; ++ } ++ } + } + + static void early_init_amd(struct cpuinfo_x86 *c) +@@ -765,6 +786,7 @@ static void init_amd_bd(struct cpuinfo_x86 *c) + + static void init_amd_zn(struct cpuinfo_x86 *c) + { ++ set_cpu_cap(c, X86_FEATURE_ZEN); + /* + * Fix erratum 1076: CPB feature bit not being set in CPUID. It affects + * all up to and including B1. +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index bfca937bdcc3..7416fc206b4a 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -12,8 +12,10 @@ + #include + #include + #include ++#include ++#include + +-#include ++#include + #include + #include + #include +@@ -27,6 +29,27 @@ + #include + + static void __init spectre_v2_select_mitigation(void); ++static void __init ssb_select_mitigation(void); ++ ++/* ++ * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any ++ * writes to SPEC_CTRL contain whatever reserved bits have been set. ++ */ ++u64 __ro_after_init x86_spec_ctrl_base; ++EXPORT_SYMBOL_GPL(x86_spec_ctrl_base); ++ ++/* ++ * The vendor and possibly platform specific bits which can be modified in ++ * x86_spec_ctrl_base. ++ */ ++static u64 __ro_after_init x86_spec_ctrl_mask = SPEC_CTRL_IBRS; ++ ++/* ++ * AMD specific MSR info for Speculative Store Bypass control. ++ * x86_amd_ls_cfg_ssbd_mask is initialized in identify_boot_cpu(). ++ */ ++u64 __ro_after_init x86_amd_ls_cfg_base; ++u64 __ro_after_init x86_amd_ls_cfg_ssbd_mask; + + void __init check_bugs(void) + { +@@ -37,9 +60,27 @@ void __init check_bugs(void) + print_cpu_info(&boot_cpu_data); + } + ++ /* ++ * Read the SPEC_CTRL MSR to account for reserved bits which may ++ * have unknown values. AMD64_LS_CFG MSR is cached in the early AMD ++ * init code as it is not enumerated and depends on the family. ++ */ ++ if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) ++ rdmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); ++ ++ /* Allow STIBP in MSR_SPEC_CTRL if supported */ ++ if (boot_cpu_has(X86_FEATURE_STIBP)) ++ x86_spec_ctrl_mask |= SPEC_CTRL_STIBP; ++ + /* Select the proper spectre mitigation before patching alternatives */ + spectre_v2_select_mitigation(); + ++ /* ++ * Select proper mitigation for any exposure to the Speculative Store ++ * Bypass vulnerability. ++ */ ++ ssb_select_mitigation(); ++ + #ifdef CONFIG_X86_32 + /* + * Check whether we are able to run this kernel safely on SMP. +@@ -93,7 +134,76 @@ static const char *spectre_v2_strings[] = { + #undef pr_fmt + #define pr_fmt(fmt) "Spectre V2 : " fmt + +-static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; ++static enum spectre_v2_mitigation spectre_v2_enabled __ro_after_init = ++ SPECTRE_V2_NONE; ++ ++void ++x86_virt_spec_ctrl(u64 guest_spec_ctrl, u64 guest_virt_spec_ctrl, bool setguest) ++{ ++ u64 msrval, guestval, hostval = x86_spec_ctrl_base; ++ struct thread_info *ti = current_thread_info(); ++ ++ /* Is MSR_SPEC_CTRL implemented ? */ ++ if (static_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) { ++ /* ++ * Restrict guest_spec_ctrl to supported values. Clear the ++ * modifiable bits in the host base value and or the ++ * modifiable bits from the guest value. ++ */ ++ guestval = hostval & ~x86_spec_ctrl_mask; ++ guestval |= guest_spec_ctrl & x86_spec_ctrl_mask; ++ ++ /* SSBD controlled in MSR_SPEC_CTRL */ ++ if (static_cpu_has(X86_FEATURE_SPEC_CTRL_SSBD)) ++ hostval |= ssbd_tif_to_spec_ctrl(ti->flags); ++ ++ if (hostval != guestval) { ++ msrval = setguest ? guestval : hostval; ++ wrmsrl(MSR_IA32_SPEC_CTRL, msrval); ++ } ++ } ++ ++ /* ++ * If SSBD is not handled in MSR_SPEC_CTRL on AMD, update ++ * MSR_AMD64_L2_CFG or MSR_VIRT_SPEC_CTRL if supported. ++ */ ++ if (!static_cpu_has(X86_FEATURE_LS_CFG_SSBD) && ++ !static_cpu_has(X86_FEATURE_VIRT_SSBD)) ++ return; ++ ++ /* ++ * If the host has SSBD mitigation enabled, force it in the host's ++ * virtual MSR value. If its not permanently enabled, evaluate ++ * current's TIF_SSBD thread flag. ++ */ ++ if (static_cpu_has(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE)) ++ hostval = SPEC_CTRL_SSBD; ++ else ++ hostval = ssbd_tif_to_spec_ctrl(ti->flags); ++ ++ /* Sanitize the guest value */ ++ guestval = guest_virt_spec_ctrl & SPEC_CTRL_SSBD; ++ ++ if (hostval != guestval) { ++ unsigned long tif; ++ ++ tif = setguest ? ssbd_spec_ctrl_to_tif(guestval) : ++ ssbd_spec_ctrl_to_tif(hostval); ++ ++ speculative_store_bypass_update(tif); ++ } ++} ++EXPORT_SYMBOL_GPL(x86_virt_spec_ctrl); ++ ++static void x86_amd_ssb_disable(void) ++{ ++ u64 msrval = x86_amd_ls_cfg_base | x86_amd_ls_cfg_ssbd_mask; ++ ++ if (boot_cpu_has(X86_FEATURE_VIRT_SSBD)) ++ wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, SPEC_CTRL_SSBD); ++ else if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD)) ++ wrmsrl(MSR_AMD64_LS_CFG, msrval); ++} + + #ifdef RETPOLINE + static bool spectre_v2_bad_module; +@@ -312,32 +422,289 @@ static void __init spectre_v2_select_mitigation(void) + } + + #undef pr_fmt ++#define pr_fmt(fmt) "Speculative Store Bypass: " fmt ++ ++static enum ssb_mitigation ssb_mode __ro_after_init = SPEC_STORE_BYPASS_NONE; ++ ++/* The kernel command line selection */ ++enum ssb_mitigation_cmd { ++ SPEC_STORE_BYPASS_CMD_NONE, ++ SPEC_STORE_BYPASS_CMD_AUTO, ++ SPEC_STORE_BYPASS_CMD_ON, ++ SPEC_STORE_BYPASS_CMD_PRCTL, ++ SPEC_STORE_BYPASS_CMD_SECCOMP, ++}; ++ ++static const char *ssb_strings[] = { ++ [SPEC_STORE_BYPASS_NONE] = "Vulnerable", ++ [SPEC_STORE_BYPASS_DISABLE] = "Mitigation: Speculative Store Bypass disabled", ++ [SPEC_STORE_BYPASS_PRCTL] = "Mitigation: Speculative Store Bypass disabled via prctl", ++ [SPEC_STORE_BYPASS_SECCOMP] = "Mitigation: Speculative Store Bypass disabled via prctl and seccomp", ++}; ++ ++static const struct { ++ const char *option; ++ enum ssb_mitigation_cmd cmd; ++} ssb_mitigation_options[] = { ++ { "auto", SPEC_STORE_BYPASS_CMD_AUTO }, /* Platform decides */ ++ { "on", SPEC_STORE_BYPASS_CMD_ON }, /* Disable Speculative Store Bypass */ ++ { "off", SPEC_STORE_BYPASS_CMD_NONE }, /* Don't touch Speculative Store Bypass */ ++ { "prctl", SPEC_STORE_BYPASS_CMD_PRCTL }, /* Disable Speculative Store Bypass via prctl */ ++ { "seccomp", SPEC_STORE_BYPASS_CMD_SECCOMP }, /* Disable Speculative Store Bypass via prctl and seccomp */ ++}; ++ ++static enum ssb_mitigation_cmd __init ssb_parse_cmdline(void) ++{ ++ enum ssb_mitigation_cmd cmd = SPEC_STORE_BYPASS_CMD_AUTO; ++ char arg[20]; ++ int ret, i; ++ ++ if (cmdline_find_option_bool(boot_command_line, "nospec_store_bypass_disable")) { ++ return SPEC_STORE_BYPASS_CMD_NONE; ++ } else { ++ ret = cmdline_find_option(boot_command_line, "spec_store_bypass_disable", ++ arg, sizeof(arg)); ++ if (ret < 0) ++ return SPEC_STORE_BYPASS_CMD_AUTO; ++ ++ for (i = 0; i < ARRAY_SIZE(ssb_mitigation_options); i++) { ++ if (!match_option(arg, ret, ssb_mitigation_options[i].option)) ++ continue; ++ ++ cmd = ssb_mitigation_options[i].cmd; ++ break; ++ } ++ ++ if (i >= ARRAY_SIZE(ssb_mitigation_options)) { ++ pr_err("unknown option (%s). Switching to AUTO select\n", arg); ++ return SPEC_STORE_BYPASS_CMD_AUTO; ++ } ++ } ++ ++ return cmd; ++} ++ ++static enum ssb_mitigation __init __ssb_select_mitigation(void) ++{ ++ enum ssb_mitigation mode = SPEC_STORE_BYPASS_NONE; ++ enum ssb_mitigation_cmd cmd; ++ ++ if (!boot_cpu_has(X86_FEATURE_SSBD)) ++ return mode; ++ ++ cmd = ssb_parse_cmdline(); ++ if (!boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS) && ++ (cmd == SPEC_STORE_BYPASS_CMD_NONE || ++ cmd == SPEC_STORE_BYPASS_CMD_AUTO)) ++ return mode; ++ ++ switch (cmd) { ++ case SPEC_STORE_BYPASS_CMD_AUTO: ++ case SPEC_STORE_BYPASS_CMD_SECCOMP: ++ /* ++ * Choose prctl+seccomp as the default mode if seccomp is ++ * enabled. ++ */ ++ if (IS_ENABLED(CONFIG_SECCOMP)) ++ mode = SPEC_STORE_BYPASS_SECCOMP; ++ else ++ mode = SPEC_STORE_BYPASS_PRCTL; ++ break; ++ case SPEC_STORE_BYPASS_CMD_ON: ++ mode = SPEC_STORE_BYPASS_DISABLE; ++ break; ++ case SPEC_STORE_BYPASS_CMD_PRCTL: ++ mode = SPEC_STORE_BYPASS_PRCTL; ++ break; ++ case SPEC_STORE_BYPASS_CMD_NONE: ++ break; ++ } ++ ++ /* ++ * We have three CPU feature flags that are in play here: ++ * - X86_BUG_SPEC_STORE_BYPASS - CPU is susceptible. ++ * - X86_FEATURE_SSBD - CPU is able to turn off speculative store bypass ++ * - X86_FEATURE_SPEC_STORE_BYPASS_DISABLE - engage the mitigation ++ */ ++ if (mode == SPEC_STORE_BYPASS_DISABLE) { ++ setup_force_cpu_cap(X86_FEATURE_SPEC_STORE_BYPASS_DISABLE); ++ /* ++ * Intel uses the SPEC CTRL MSR Bit(2) for this, while AMD uses ++ * a completely different MSR and bit dependent on family. ++ */ ++ switch (boot_cpu_data.x86_vendor) { ++ case X86_VENDOR_INTEL: ++ x86_spec_ctrl_base |= SPEC_CTRL_SSBD; ++ x86_spec_ctrl_mask |= SPEC_CTRL_SSBD; ++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); ++ break; ++ case X86_VENDOR_AMD: ++ x86_amd_ssb_disable(); ++ break; ++ } ++ } ++ ++ return mode; ++} ++ ++static void ssb_select_mitigation(void) ++{ ++ ssb_mode = __ssb_select_mitigation(); ++ ++ if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS)) ++ pr_info("%s\n", ssb_strings[ssb_mode]); ++} ++ ++#undef pr_fmt ++#define pr_fmt(fmt) "Speculation prctl: " fmt ++ ++static int ssb_prctl_set(struct task_struct *task, unsigned long ctrl) ++{ ++ bool update; ++ ++ if (ssb_mode != SPEC_STORE_BYPASS_PRCTL && ++ ssb_mode != SPEC_STORE_BYPASS_SECCOMP) ++ return -ENXIO; ++ ++ switch (ctrl) { ++ case PR_SPEC_ENABLE: ++ /* If speculation is force disabled, enable is not allowed */ ++ if (task_spec_ssb_force_disable(task)) ++ return -EPERM; ++ task_clear_spec_ssb_disable(task); ++ update = test_and_clear_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ case PR_SPEC_DISABLE: ++ task_set_spec_ssb_disable(task); ++ update = !test_and_set_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ case PR_SPEC_FORCE_DISABLE: ++ task_set_spec_ssb_disable(task); ++ task_set_spec_ssb_force_disable(task); ++ update = !test_and_set_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ default: ++ return -ERANGE; ++ } ++ ++ /* ++ * If being set on non-current task, delay setting the CPU ++ * mitigation until it is next scheduled. ++ */ ++ if (task == current && update) ++ speculative_store_bypass_update_current(); ++ ++ return 0; ++} ++ ++int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, ++ unsigned long ctrl) ++{ ++ switch (which) { ++ case PR_SPEC_STORE_BYPASS: ++ return ssb_prctl_set(task, ctrl); ++ default: ++ return -ENODEV; ++ } ++} ++ ++#ifdef CONFIG_SECCOMP ++void arch_seccomp_spec_mitigate(struct task_struct *task) ++{ ++ if (ssb_mode == SPEC_STORE_BYPASS_SECCOMP) ++ ssb_prctl_set(task, PR_SPEC_FORCE_DISABLE); ++} ++#endif ++ ++static int ssb_prctl_get(struct task_struct *task) ++{ ++ switch (ssb_mode) { ++ case SPEC_STORE_BYPASS_DISABLE: ++ return PR_SPEC_DISABLE; ++ case SPEC_STORE_BYPASS_SECCOMP: ++ case SPEC_STORE_BYPASS_PRCTL: ++ if (task_spec_ssb_force_disable(task)) ++ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE; ++ if (task_spec_ssb_disable(task)) ++ return PR_SPEC_PRCTL | PR_SPEC_DISABLE; ++ return PR_SPEC_PRCTL | PR_SPEC_ENABLE; ++ default: ++ if (boot_cpu_has_bug(X86_BUG_SPEC_STORE_BYPASS)) ++ return PR_SPEC_ENABLE; ++ return PR_SPEC_NOT_AFFECTED; ++ } ++} ++ ++int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which) ++{ ++ switch (which) { ++ case PR_SPEC_STORE_BYPASS: ++ return ssb_prctl_get(task); ++ default: ++ return -ENODEV; ++ } ++} ++ ++void x86_spec_ctrl_setup_ap(void) ++{ ++ if (boot_cpu_has(X86_FEATURE_MSR_SPEC_CTRL)) ++ wrmsrl(MSR_IA32_SPEC_CTRL, x86_spec_ctrl_base); ++ ++ if (ssb_mode == SPEC_STORE_BYPASS_DISABLE) ++ x86_amd_ssb_disable(); ++} + + #ifdef CONFIG_SYSFS +-ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) ++ ++static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, ++ char *buf, unsigned int bug) + { +- if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN)) ++ if (!boot_cpu_has_bug(bug)) + return sprintf(buf, "Not affected\n"); +- if (boot_cpu_has(X86_FEATURE_PTI)) +- return sprintf(buf, "Mitigation: PTI\n"); ++ ++ switch (bug) { ++ case X86_BUG_CPU_MELTDOWN: ++ if (boot_cpu_has(X86_FEATURE_PTI)) ++ return sprintf(buf, "Mitigation: PTI\n"); ++ ++ break; ++ ++ case X86_BUG_SPECTRE_V1: ++ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); ++ ++ case X86_BUG_SPECTRE_V2: ++ return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], ++ boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "", ++ boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", ++ spectre_v2_module_string()); ++ ++ case X86_BUG_SPEC_STORE_BYPASS: ++ return sprintf(buf, "%s\n", ssb_strings[ssb_mode]); ++ ++ default: ++ break; ++ } ++ + return sprintf(buf, "Vulnerable\n"); + } + ++ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_common(dev, attr, buf, X86_BUG_CPU_MELTDOWN); ++} ++ + ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) + { +- if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1)) +- return sprintf(buf, "Not affected\n"); +- return sprintf(buf, "Mitigation: __user pointer sanitization\n"); ++ return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V1); + } + + ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf) + { +- if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) +- return sprintf(buf, "Not affected\n"); ++ return cpu_show_common(dev, attr, buf, X86_BUG_SPECTRE_V2); ++} + +- return sprintf(buf, "%s%s%s%s\n", spectre_v2_strings[spectre_v2_enabled], +- boot_cpu_has(X86_FEATURE_USE_IBPB) ? ", IBPB" : "", +- boot_cpu_has(X86_FEATURE_USE_IBRS_FW) ? ", IBRS_FW" : "", +- spectre_v2_module_string()); ++ssize_t cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS); + } + #endif +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index cf6380200dc2..48e98964ecad 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -733,17 +733,32 @@ static void init_speculation_control(struct cpuinfo_x86 *c) + * and they also have a different bit for STIBP support. Also, + * a hypervisor might have set the individual AMD bits even on + * Intel CPUs, for finer-grained selection of what's available. +- * +- * We use the AMD bits in 0x8000_0008 EBX as the generic hardware +- * features, which are visible in /proc/cpuinfo and used by the +- * kernel. So set those accordingly from the Intel bits. + */ + if (cpu_has(c, X86_FEATURE_SPEC_CTRL)) { + set_cpu_cap(c, X86_FEATURE_IBRS); + set_cpu_cap(c, X86_FEATURE_IBPB); ++ set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL); + } ++ + if (cpu_has(c, X86_FEATURE_INTEL_STIBP)) + set_cpu_cap(c, X86_FEATURE_STIBP); ++ ++ if (cpu_has(c, X86_FEATURE_SPEC_CTRL_SSBD) || ++ cpu_has(c, X86_FEATURE_VIRT_SSBD)) ++ set_cpu_cap(c, X86_FEATURE_SSBD); ++ ++ if (cpu_has(c, X86_FEATURE_AMD_IBRS)) { ++ set_cpu_cap(c, X86_FEATURE_IBRS); ++ set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL); ++ } ++ ++ if (cpu_has(c, X86_FEATURE_AMD_IBPB)) ++ set_cpu_cap(c, X86_FEATURE_IBPB); ++ ++ if (cpu_has(c, X86_FEATURE_AMD_STIBP)) { ++ set_cpu_cap(c, X86_FEATURE_STIBP); ++ set_cpu_cap(c, X86_FEATURE_MSR_SPEC_CTRL); ++ } + } + + void get_cpu_cap(struct cpuinfo_x86 *c) +@@ -894,21 +909,55 @@ static const __initconst struct x86_cpu_id cpu_no_meltdown[] = { + {} + }; + +-static bool __init cpu_vulnerable_to_meltdown(struct cpuinfo_x86 *c) ++static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = { ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PINEVIEW }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_LINCROFT }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_PENWELL }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CLOVERVIEW }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_CEDARVIEW }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_CORE_YONAH }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM }, ++ { X86_VENDOR_CENTAUR, 5, }, ++ { X86_VENDOR_INTEL, 5, }, ++ { X86_VENDOR_NSC, 5, }, ++ { X86_VENDOR_AMD, 0x12, }, ++ { X86_VENDOR_AMD, 0x11, }, ++ { X86_VENDOR_AMD, 0x10, }, ++ { X86_VENDOR_AMD, 0xf, }, ++ { X86_VENDOR_ANY, 4, }, ++ {} ++}; ++ ++static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) + { + u64 ia32_cap = 0; + +- if (x86_match_cpu(cpu_no_meltdown)) +- return false; +- + if (cpu_has(c, X86_FEATURE_ARCH_CAPABILITIES)) + rdmsrl(MSR_IA32_ARCH_CAPABILITIES, ia32_cap); + ++ if (!x86_match_cpu(cpu_no_spec_store_bypass) && ++ !(ia32_cap & ARCH_CAP_SSB_NO)) ++ setup_force_cpu_bug(X86_BUG_SPEC_STORE_BYPASS); ++ ++ if (x86_match_cpu(cpu_no_speculation)) ++ return; ++ ++ setup_force_cpu_bug(X86_BUG_SPECTRE_V1); ++ setup_force_cpu_bug(X86_BUG_SPECTRE_V2); ++ ++ if (x86_match_cpu(cpu_no_meltdown)) ++ return; ++ + /* Rogue Data Cache Load? No! */ + if (ia32_cap & ARCH_CAP_RDCL_NO) +- return false; ++ return; + +- return true; ++ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); + } + + /* +@@ -958,12 +1007,7 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) + + setup_force_cpu_cap(X86_FEATURE_ALWAYS); + +- if (!x86_match_cpu(cpu_no_speculation)) { +- if (cpu_vulnerable_to_meltdown(c)) +- setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); +- setup_force_cpu_bug(X86_BUG_SPECTRE_V1); +- setup_force_cpu_bug(X86_BUG_SPECTRE_V2); +- } ++ cpu_set_bug_bits(c); + + fpu__init_system(c); + +@@ -1322,6 +1366,7 @@ void identify_secondary_cpu(struct cpuinfo_x86 *c) + #endif + mtrr_ap_init(); + validate_apic_and_package_id(c); ++ x86_spec_ctrl_setup_ap(); + } + + static __init int setup_noclflush(char *arg) +diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h +index e806b11a99af..37672d299e35 100644 +--- a/arch/x86/kernel/cpu/cpu.h ++++ b/arch/x86/kernel/cpu/cpu.h +@@ -50,4 +50,6 @@ extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c); + + unsigned int aperfmperf_get_khz(int cpu); + ++extern void x86_spec_ctrl_setup_ap(void); ++ + #endif /* ARCH_X86_CPU_H */ +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index c3af167d0a70..c895f38a7a5e 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -188,7 +188,10 @@ static void early_init_intel(struct cpuinfo_x86 *c) + setup_clear_cpu_cap(X86_FEATURE_IBPB); + setup_clear_cpu_cap(X86_FEATURE_STIBP); + setup_clear_cpu_cap(X86_FEATURE_SPEC_CTRL); ++ setup_clear_cpu_cap(X86_FEATURE_MSR_SPEC_CTRL); + setup_clear_cpu_cap(X86_FEATURE_INTEL_STIBP); ++ setup_clear_cpu_cap(X86_FEATURE_SSBD); ++ setup_clear_cpu_cap(X86_FEATURE_SPEC_CTRL_SSBD); + } + + /* +diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c +index 8bd1d8292cf7..988a98f34c66 100644 +--- a/arch/x86/kernel/process.c ++++ b/arch/x86/kernel/process.c +@@ -39,6 +39,7 @@ + #include + #include + #include ++#include + + /* + * per-CPU TSS segments. Threads are completely 'soft' on Linux, +@@ -279,6 +280,148 @@ static inline void switch_to_bitmap(struct tss_struct *tss, + } + } + ++#ifdef CONFIG_SMP ++ ++struct ssb_state { ++ struct ssb_state *shared_state; ++ raw_spinlock_t lock; ++ unsigned int disable_state; ++ unsigned long local_state; ++}; ++ ++#define LSTATE_SSB 0 ++ ++static DEFINE_PER_CPU(struct ssb_state, ssb_state); ++ ++void speculative_store_bypass_ht_init(void) ++{ ++ struct ssb_state *st = this_cpu_ptr(&ssb_state); ++ unsigned int this_cpu = smp_processor_id(); ++ unsigned int cpu; ++ ++ st->local_state = 0; ++ ++ /* ++ * Shared state setup happens once on the first bringup ++ * of the CPU. It's not destroyed on CPU hotunplug. ++ */ ++ if (st->shared_state) ++ return; ++ ++ raw_spin_lock_init(&st->lock); ++ ++ /* ++ * Go over HT siblings and check whether one of them has set up the ++ * shared state pointer already. ++ */ ++ for_each_cpu(cpu, topology_sibling_cpumask(this_cpu)) { ++ if (cpu == this_cpu) ++ continue; ++ ++ if (!per_cpu(ssb_state, cpu).shared_state) ++ continue; ++ ++ /* Link it to the state of the sibling: */ ++ st->shared_state = per_cpu(ssb_state, cpu).shared_state; ++ return; ++ } ++ ++ /* ++ * First HT sibling to come up on the core. Link shared state of ++ * the first HT sibling to itself. The siblings on the same core ++ * which come up later will see the shared state pointer and link ++ * themself to the state of this CPU. ++ */ ++ st->shared_state = st; ++} ++ ++/* ++ * Logic is: First HT sibling enables SSBD for both siblings in the core ++ * and last sibling to disable it, disables it for the whole core. This how ++ * MSR_SPEC_CTRL works in "hardware": ++ * ++ * CORE_SPEC_CTRL = THREAD0_SPEC_CTRL | THREAD1_SPEC_CTRL ++ */ ++static __always_inline void amd_set_core_ssb_state(unsigned long tifn) ++{ ++ struct ssb_state *st = this_cpu_ptr(&ssb_state); ++ u64 msr = x86_amd_ls_cfg_base; ++ ++ if (!static_cpu_has(X86_FEATURE_ZEN)) { ++ msr |= ssbd_tif_to_amd_ls_cfg(tifn); ++ wrmsrl(MSR_AMD64_LS_CFG, msr); ++ return; ++ } ++ ++ if (tifn & _TIF_SSBD) { ++ /* ++ * Since this can race with prctl(), block reentry on the ++ * same CPU. ++ */ ++ if (__test_and_set_bit(LSTATE_SSB, &st->local_state)) ++ return; ++ ++ msr |= x86_amd_ls_cfg_ssbd_mask; ++ ++ raw_spin_lock(&st->shared_state->lock); ++ /* First sibling enables SSBD: */ ++ if (!st->shared_state->disable_state) ++ wrmsrl(MSR_AMD64_LS_CFG, msr); ++ st->shared_state->disable_state++; ++ raw_spin_unlock(&st->shared_state->lock); ++ } else { ++ if (!__test_and_clear_bit(LSTATE_SSB, &st->local_state)) ++ return; ++ ++ raw_spin_lock(&st->shared_state->lock); ++ st->shared_state->disable_state--; ++ if (!st->shared_state->disable_state) ++ wrmsrl(MSR_AMD64_LS_CFG, msr); ++ raw_spin_unlock(&st->shared_state->lock); ++ } ++} ++#else ++static __always_inline void amd_set_core_ssb_state(unsigned long tifn) ++{ ++ u64 msr = x86_amd_ls_cfg_base | ssbd_tif_to_amd_ls_cfg(tifn); ++ ++ wrmsrl(MSR_AMD64_LS_CFG, msr); ++} ++#endif ++ ++static __always_inline void amd_set_ssb_virt_state(unsigned long tifn) ++{ ++ /* ++ * SSBD has the same definition in SPEC_CTRL and VIRT_SPEC_CTRL, ++ * so ssbd_tif_to_spec_ctrl() just works. ++ */ ++ wrmsrl(MSR_AMD64_VIRT_SPEC_CTRL, ssbd_tif_to_spec_ctrl(tifn)); ++} ++ ++static __always_inline void intel_set_ssb_state(unsigned long tifn) ++{ ++ u64 msr = x86_spec_ctrl_base | ssbd_tif_to_spec_ctrl(tifn); ++ ++ wrmsrl(MSR_IA32_SPEC_CTRL, msr); ++} ++ ++static __always_inline void __speculative_store_bypass_update(unsigned long tifn) ++{ ++ if (static_cpu_has(X86_FEATURE_VIRT_SSBD)) ++ amd_set_ssb_virt_state(tifn); ++ else if (static_cpu_has(X86_FEATURE_LS_CFG_SSBD)) ++ amd_set_core_ssb_state(tifn); ++ else ++ intel_set_ssb_state(tifn); ++} ++ ++void speculative_store_bypass_update(unsigned long tif) ++{ ++ preempt_disable(); ++ __speculative_store_bypass_update(tif); ++ preempt_enable(); ++} ++ + void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p, + struct tss_struct *tss) + { +@@ -310,6 +453,9 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p, + + if ((tifp ^ tifn) & _TIF_NOCPUID) + set_cpuid_faulting(!!(tifn & _TIF_NOCPUID)); ++ ++ if ((tifp ^ tifn) & _TIF_SSBD) ++ __speculative_store_bypass_update(tifn); + } + + /* +diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c +index 9eb448c7859d..fa093b77689f 100644 +--- a/arch/x86/kernel/process_64.c ++++ b/arch/x86/kernel/process_64.c +@@ -528,6 +528,7 @@ void set_personality_64bit(void) + clear_thread_flag(TIF_X32); + /* Pretend that this comes from a 64bit execve */ + task_pt_regs(current)->orig_ax = __NR_execve; ++ current_thread_info()->status &= ~TS_COMPAT; + + /* Ensure the corresponding mm is not marked. */ + if (current->mm) +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 6b841262b790..4a96aa004390 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -77,6 +77,7 @@ + #include + #include + #include ++#include + + /* Number of siblings per CPU package */ + int smp_num_siblings = 1; +@@ -245,6 +246,8 @@ static void notrace start_secondary(void *unused) + */ + check_tsc_sync_target(); + ++ speculative_store_bypass_ht_init(); ++ + /* + * Lock vector_lock and initialize the vectors on this cpu + * before setting the cpu online. We must set it online with +@@ -1349,6 +1352,8 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus) + set_mtrr_aps_delayed_init(); + + smp_quirk_init_udelay(); ++ ++ speculative_store_bypass_ht_init(); + } + + void arch_enable_nonboot_cpus_begin(void) +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index 4f544f2a7b06..d67e3b31f3db 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -367,7 +367,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + + /* cpuid 0x80000008.ebx */ + const u32 kvm_cpuid_8000_0008_ebx_x86_features = +- F(IBPB) | F(IBRS); ++ F(AMD_IBPB) | F(AMD_IBRS) | F(VIRT_SSBD); + + /* cpuid 0xC0000001.edx */ + const u32 kvm_cpuid_C000_0001_edx_x86_features = +@@ -394,7 +394,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + + /* cpuid 7.0.edx*/ + const u32 kvm_cpuid_7_0_edx_x86_features = +- F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) | ++ F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) | F(SSBD) | + F(ARCH_CAPABILITIES); + + /* all calls to cpuid_count() should be made on the same cpu */ +@@ -632,13 +632,20 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + g_phys_as = phys_as; + entry->eax = g_phys_as | (virt_as << 8); + entry->edx = 0; +- /* IBRS and IBPB aren't necessarily present in hardware cpuid */ +- if (boot_cpu_has(X86_FEATURE_IBPB)) +- entry->ebx |= F(IBPB); +- if (boot_cpu_has(X86_FEATURE_IBRS)) +- entry->ebx |= F(IBRS); ++ /* ++ * IBRS, IBPB and VIRT_SSBD aren't necessarily present in ++ * hardware cpuid ++ */ ++ if (boot_cpu_has(X86_FEATURE_AMD_IBPB)) ++ entry->ebx |= F(AMD_IBPB); ++ if (boot_cpu_has(X86_FEATURE_AMD_IBRS)) ++ entry->ebx |= F(AMD_IBRS); ++ if (boot_cpu_has(X86_FEATURE_VIRT_SSBD)) ++ entry->ebx |= F(VIRT_SSBD); + entry->ebx &= kvm_cpuid_8000_0008_ebx_x86_features; + cpuid_mask(&entry->ebx, CPUID_8000_0008_EBX); ++ if (boot_cpu_has(X86_FEATURE_LS_CFG_SSBD)) ++ entry->ebx |= F(VIRT_SSBD); + break; + } + case 0x80000019: +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 9fb0daf628cb..029aa1318874 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -46,7 +46,7 @@ + #include + #include + #include +-#include ++#include + + #include + #include "trace.h" +@@ -186,6 +186,12 @@ struct vcpu_svm { + } host; + + u64 spec_ctrl; ++ /* ++ * Contains guest-controlled bits of VIRT_SPEC_CTRL, which will be ++ * translated into the appropriate L2_CFG bits on the host to ++ * perform speculative control. ++ */ ++ u64 virt_spec_ctrl; + + u32 *msrpm; + +@@ -1611,6 +1617,7 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + u32 eax = 1; + + svm->spec_ctrl = 0; ++ svm->virt_spec_ctrl = 0; + + if (!init_event) { + svm->vcpu.arch.apic_base = APIC_DEFAULT_PHYS_BASE | +@@ -3618,11 +3625,18 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBRS)) ++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS)) + return 1; + + msr_info->data = svm->spec_ctrl; + break; ++ case MSR_AMD64_VIRT_SPEC_CTRL: ++ if (!msr_info->host_initiated && ++ !guest_cpuid_has(vcpu, X86_FEATURE_VIRT_SSBD)) ++ return 1; ++ ++ msr_info->data = svm->virt_spec_ctrl; ++ break; + case MSR_IA32_UCODE_REV: + msr_info->data = 0x01000065; + break; +@@ -3716,7 +3730,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) + break; + case MSR_IA32_SPEC_CTRL: + if (!msr->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBRS)) ++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBRS)) + return 1; + + /* The STIBP bit doesn't fault even if it's not advertised */ +@@ -3743,7 +3757,7 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) + break; + case MSR_IA32_PRED_CMD: + if (!msr->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBPB)) ++ !guest_cpuid_has(vcpu, X86_FEATURE_AMD_IBPB)) + return 1; + + if (data & ~PRED_CMD_IBPB) +@@ -3757,6 +3771,16 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) + break; + set_msr_interception(svm->msrpm, MSR_IA32_PRED_CMD, 0, 1); + break; ++ case MSR_AMD64_VIRT_SPEC_CTRL: ++ if (!msr->host_initiated && ++ !guest_cpuid_has(vcpu, X86_FEATURE_VIRT_SSBD)) ++ return 1; ++ ++ if (data & ~SPEC_CTRL_SSBD) ++ return 1; ++ ++ svm->virt_spec_ctrl = data; ++ break; + case MSR_STAR: + svm->vmcb->save.star = data; + break; +@@ -5015,8 +5039,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) + * is no need to worry about the conditional branch over the wrmsr + * being speculatively taken. + */ +- if (svm->spec_ctrl) +- native_wrmsrl(MSR_IA32_SPEC_CTRL, svm->spec_ctrl); ++ x86_spec_ctrl_set_guest(svm->spec_ctrl, svm->virt_spec_ctrl); + + asm volatile ( + "push %%" _ASM_BP "; \n\t" +@@ -5110,6 +5133,18 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) + #endif + ); + ++ /* Eliminate branch target predictions from guest mode */ ++ vmexit_fill_RSB(); ++ ++#ifdef CONFIG_X86_64 ++ wrmsrl(MSR_GS_BASE, svm->host.gs_base); ++#else ++ loadsegment(fs, svm->host.fs); ++#ifndef CONFIG_X86_32_LAZY_GS ++ loadsegment(gs, svm->host.gs); ++#endif ++#endif ++ + /* + * We do not use IBRS in the kernel. If this vCPU has used the + * SPEC_CTRL MSR it may have left it on; save the value and +@@ -5128,20 +5163,7 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) + if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) + svm->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + +- if (svm->spec_ctrl) +- native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); +- +- /* Eliminate branch target predictions from guest mode */ +- vmexit_fill_RSB(); +- +-#ifdef CONFIG_X86_64 +- wrmsrl(MSR_GS_BASE, svm->host.gs_base); +-#else +- loadsegment(fs, svm->host.fs); +-#ifndef CONFIG_X86_32_LAZY_GS +- loadsegment(gs, svm->host.gs); +-#endif +-#endif ++ x86_spec_ctrl_restore_host(svm->spec_ctrl, svm->virt_spec_ctrl); + + reload_tss(vcpu); + +@@ -5244,7 +5266,7 @@ static bool svm_cpu_has_accelerated_tpr(void) + return false; + } + +-static bool svm_has_high_real_mode_segbase(void) ++static bool svm_has_emulated_msr(int index) + { + return true; + } +@@ -5551,7 +5573,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { + .hardware_enable = svm_hardware_enable, + .hardware_disable = svm_hardware_disable, + .cpu_has_accelerated_tpr = svm_cpu_has_accelerated_tpr, +- .cpu_has_high_real_mode_segbase = svm_has_high_real_mode_segbase, ++ .has_emulated_msr = svm_has_emulated_msr, + + .vcpu_create = svm_create_vcpu, + .vcpu_free = svm_free_vcpu, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index bdd84ce4491e..2e63edf8312c 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -52,7 +52,7 @@ + #include + #include + #include +-#include ++#include + + #include "trace.h" + #include "pmu.h" +@@ -3293,7 +3293,6 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBRS) && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + +@@ -3414,12 +3413,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + break; + case MSR_IA32_SPEC_CTRL: + if (!msr_info->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBRS) && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + + /* The STIBP bit doesn't fault even if it's not advertised */ +- if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP)) ++ if (data & ~(SPEC_CTRL_IBRS | SPEC_CTRL_STIBP | SPEC_CTRL_SSBD)) + return 1; + + vmx->spec_ctrl = data; +@@ -3445,7 +3443,6 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + break; + case MSR_IA32_PRED_CMD: + if (!msr_info->host_initiated && +- !guest_cpuid_has(vcpu, X86_FEATURE_IBPB) && + !guest_cpuid_has(vcpu, X86_FEATURE_SPEC_CTRL)) + return 1; + +@@ -9217,9 +9214,21 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) + } + STACK_FRAME_NON_STANDARD(vmx_handle_external_intr); + +-static bool vmx_has_high_real_mode_segbase(void) ++static bool vmx_has_emulated_msr(int index) + { +- return enable_unrestricted_guest || emulate_invalid_guest_state; ++ switch (index) { ++ case MSR_IA32_SMBASE: ++ /* ++ * We cannot do SMM unless we can run the guest in big ++ * real mode. ++ */ ++ return enable_unrestricted_guest || emulate_invalid_guest_state; ++ case MSR_AMD64_VIRT_SPEC_CTRL: ++ /* This is AMD only. */ ++ return false; ++ default: ++ return true; ++ } + } + + static bool vmx_mpx_supported(void) +@@ -9452,10 +9461,10 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + * is no need to worry about the conditional branch over the wrmsr + * being speculatively taken. + */ +- if (vmx->spec_ctrl) +- native_wrmsrl(MSR_IA32_SPEC_CTRL, vmx->spec_ctrl); ++ x86_spec_ctrl_set_guest(vmx->spec_ctrl, 0); + + vmx->__launched = vmx->loaded_vmcs->launched; ++ + asm( + /* Store host registers */ + "push %%" _ASM_DX "; push %%" _ASM_BP ";" +@@ -9591,8 +9600,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + if (unlikely(!msr_write_intercepted(vcpu, MSR_IA32_SPEC_CTRL))) + vmx->spec_ctrl = native_read_msr(MSR_IA32_SPEC_CTRL); + +- if (vmx->spec_ctrl) +- native_wrmsrl(MSR_IA32_SPEC_CTRL, 0); ++ x86_spec_ctrl_restore_host(vmx->spec_ctrl, 0); + + /* Eliminate branch target predictions from guest mode */ + vmexit_fill_RSB(); +@@ -12182,7 +12190,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { + .hardware_enable = hardware_enable, + .hardware_disable = hardware_disable, + .cpu_has_accelerated_tpr = report_flexpriority, +- .cpu_has_high_real_mode_segbase = vmx_has_high_real_mode_segbase, ++ .has_emulated_msr = vmx_has_emulated_msr, + + .vcpu_create = vmx_create_vcpu, + .vcpu_free = vmx_free_vcpu, +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 3b2c3aa2cd07..649f476039de 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -1036,6 +1036,7 @@ static u32 emulated_msrs[] = { + MSR_IA32_SMBASE, + MSR_PLATFORM_INFO, + MSR_MISC_FEATURES_ENABLES, ++ MSR_AMD64_VIRT_SPEC_CTRL, + }; + + static unsigned num_emulated_msrs; +@@ -2721,7 +2722,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) + * fringe case that is not enabled except via specific settings + * of the module parameters. + */ +- r = kvm_x86_ops->cpu_has_high_real_mode_segbase(); ++ r = kvm_x86_ops->has_emulated_msr(MSR_IA32_SMBASE); + break; + case KVM_CAP_VAPIC: + r = !kvm_x86_ops->cpu_has_accelerated_tpr(); +@@ -4324,14 +4325,8 @@ static void kvm_init_msr_list(void) + num_msrs_to_save = j; + + for (i = j = 0; i < ARRAY_SIZE(emulated_msrs); i++) { +- switch (emulated_msrs[i]) { +- case MSR_IA32_SMBASE: +- if (!kvm_x86_ops->cpu_has_high_real_mode_segbase()) +- continue; +- break; +- default: +- break; +- } ++ if (!kvm_x86_ops->has_emulated_msr(emulated_msrs[i])) ++ continue; + + if (j < i) + emulated_msrs[j] = emulated_msrs[i]; +diff --git a/arch/x86/mm/pkeys.c b/arch/x86/mm/pkeys.c +index d7bc0eea20a5..6e98e0a7c923 100644 +--- a/arch/x86/mm/pkeys.c ++++ b/arch/x86/mm/pkeys.c +@@ -94,26 +94,27 @@ int __arch_override_mprotect_pkey(struct vm_area_struct *vma, int prot, int pkey + */ + if (pkey != -1) + return pkey; +- /* +- * Look for a protection-key-drive execute-only mapping +- * which is now being given permissions that are not +- * execute-only. Move it back to the default pkey. +- */ +- if (vma_is_pkey_exec_only(vma) && +- (prot & (PROT_READ|PROT_WRITE))) { +- return 0; +- } ++ + /* + * The mapping is execute-only. Go try to get the + * execute-only protection key. If we fail to do that, + * fall through as if we do not have execute-only +- * support. ++ * support in this mm. + */ + if (prot == PROT_EXEC) { + pkey = execute_only_pkey(vma->vm_mm); + if (pkey > 0) + return pkey; ++ } else if (vma_is_pkey_exec_only(vma)) { ++ /* ++ * Protections are *not* PROT_EXEC, but the mapping ++ * is using the exec-only pkey. This mapping was ++ * PROT_EXEC and will no longer be. Move back to ++ * the default pkey. ++ */ ++ return ARCH_DEFAULT_PKEY; + } ++ + /* + * This is a vanilla, non-pkey mprotect (or we failed to + * setup execute-only), inherit the pkey from the VMA we +diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c +index 3e15345abfe7..de0263348f2d 100644 +--- a/arch/x86/xen/mmu.c ++++ b/arch/x86/xen/mmu.c +@@ -42,13 +42,11 @@ xmaddr_t arbitrary_virt_to_machine(void *vaddr) + } + EXPORT_SYMBOL_GPL(arbitrary_virt_to_machine); + +-static void xen_flush_tlb_all(void) ++static noinline void xen_flush_tlb_all(void) + { + struct mmuext_op *op; + struct multicall_space mcs; + +- trace_xen_mmu_flush_tlb_all(0); +- + preempt_disable(); + + mcs = xen_mc_entry(sizeof(*op)); +diff --git a/arch/x86/xen/mmu_pv.c b/arch/x86/xen/mmu_pv.c +index 042e9c422b21..b3526a98a5a5 100644 +--- a/arch/x86/xen/mmu_pv.c ++++ b/arch/x86/xen/mmu_pv.c +@@ -1280,13 +1280,11 @@ unsigned long xen_read_cr2_direct(void) + return this_cpu_read(xen_vcpu_info.arch.cr2); + } + +-static void xen_flush_tlb(void) ++static noinline void xen_flush_tlb(void) + { + struct mmuext_op *op; + struct multicall_space mcs; + +- trace_xen_mmu_flush_tlb(0); +- + preempt_disable(); + + mcs = xen_mc_entry(sizeof(*op)); +diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c +index 825964efda1d..433f14bcab15 100644 +--- a/drivers/base/cpu.c ++++ b/drivers/base/cpu.c +@@ -521,14 +521,22 @@ ssize_t __weak cpu_show_spectre_v2(struct device *dev, + return sprintf(buf, "Not affected\n"); + } + ++ssize_t __weak cpu_show_spec_store_bypass(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sprintf(buf, "Not affected\n"); ++} ++ + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); + static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); + static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); ++static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL); + + static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_meltdown.attr, + &dev_attr_spectre_v1.attr, + &dev_attr_spectre_v2.attr, ++ &dev_attr_spec_store_bypass.attr, + NULL + }; + +diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c +index be38ac7050d4..a7b6734bc3c3 100644 +--- a/drivers/gpu/drm/drm_drv.c ++++ b/drivers/gpu/drm/drm_drv.c +@@ -749,7 +749,7 @@ static void remove_compat_control_link(struct drm_device *dev) + if (!minor) + return; + +- name = kasprintf(GFP_KERNEL, "controlD%d", minor->index); ++ name = kasprintf(GFP_KERNEL, "controlD%d", minor->index + 64); + if (!name) + return; + +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index cc70e2470272..61a2203b75df 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -7044,6 +7044,9 @@ enum { + #define SLICE_ECO_CHICKEN0 _MMIO(0x7308) + #define PIXEL_MASK_CAMMING_DISABLE (1 << 14) + ++#define GEN9_WM_CHICKEN3 _MMIO(0x5588) ++#define GEN9_FACTOR_IN_CLR_VAL_HIZ (1 << 9) ++ + /* WaCatErrorRejectionIssue */ + #define GEN7_SQ_CHICKEN_MBCUNIT_CONFIG _MMIO(0x9030) + #define GEN7_SQ_CHICKEN_MBCUNIT_SQINTMOB (1<<11) +diff --git a/drivers/gpu/drm/i915/intel_engine_cs.c b/drivers/gpu/drm/i915/intel_engine_cs.c +index b6a7e492c1a3..c0e3e2ffb87d 100644 +--- a/drivers/gpu/drm/i915/intel_engine_cs.c ++++ b/drivers/gpu/drm/i915/intel_engine_cs.c +@@ -900,6 +900,10 @@ static int gen9_init_workarounds(struct intel_engine_cs *engine) + I915_WRITE(GEN8_L3SQCREG4, (I915_READ(GEN8_L3SQCREG4) | + GEN8_LQSC_FLUSH_COHERENT_LINES)); + ++ /* WaClearHIZ_WM_CHICKEN3:bxt,glk */ ++ if (IS_GEN9_LP(dev_priv)) ++ WA_SET_BIT_MASKED(GEN9_WM_CHICKEN3, GEN9_FACTOR_IN_CLR_VAL_HIZ); ++ + /* WaVFEStateAfterPipeControlwithMediaStateClear:skl,bxt,glk,cfl */ + ret = wa_ring_whitelist_reg(engine, GEN9_CTX_PREEMPT_REG); + if (ret) +diff --git a/drivers/i2c/busses/i2c-designware-master.c b/drivers/i2c/busses/i2c-designware-master.c +index 13e849bf9aa0..4915fa303a7e 100644 +--- a/drivers/i2c/busses/i2c-designware-master.c ++++ b/drivers/i2c/busses/i2c-designware-master.c +@@ -207,7 +207,10 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev) + i2c_dw_disable_int(dev); + + /* Enable the adapter */ +- __i2c_dw_enable_and_wait(dev, true); ++ __i2c_dw_enable(dev, true); ++ ++ /* Dummy read to avoid the register getting stuck on Bay Trail */ ++ dw_readl(dev, DW_IC_ENABLE_STATUS); + + /* Clear and enable interrupts */ + dw_readl(dev, DW_IC_CLR_INTR); +diff --git a/drivers/s390/cio/qdio_setup.c b/drivers/s390/cio/qdio_setup.c +index 48b3866a9ded..35286907c636 100644 +--- a/drivers/s390/cio/qdio_setup.c ++++ b/drivers/s390/cio/qdio_setup.c +@@ -140,7 +140,7 @@ static int __qdio_allocate_qs(struct qdio_q **irq_ptr_qs, int nr_queues) + int i; + + for (i = 0; i < nr_queues; i++) { +- q = kmem_cache_alloc(qdio_q_cache, GFP_KERNEL); ++ q = kmem_cache_zalloc(qdio_q_cache, GFP_KERNEL); + if (!q) + return -ENOMEM; + +@@ -456,7 +456,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data) + { + struct ciw *ciw; + struct qdio_irq *irq_ptr = init_data->cdev->private->qdio_data; +- int rc; + + memset(&irq_ptr->qib, 0, sizeof(irq_ptr->qib)); + memset(&irq_ptr->siga_flag, 0, sizeof(irq_ptr->siga_flag)); +@@ -493,16 +492,14 @@ int qdio_setup_irq(struct qdio_initialize *init_data) + ciw = ccw_device_get_ciw(init_data->cdev, CIW_TYPE_EQUEUE); + if (!ciw) { + DBF_ERROR("%4x NO EQ", irq_ptr->schid.sch_no); +- rc = -EINVAL; +- goto out_err; ++ return -EINVAL; + } + irq_ptr->equeue = *ciw; + + ciw = ccw_device_get_ciw(init_data->cdev, CIW_TYPE_AQUEUE); + if (!ciw) { + DBF_ERROR("%4x NO AQ", irq_ptr->schid.sch_no); +- rc = -EINVAL; +- goto out_err; ++ return -EINVAL; + } + irq_ptr->aqueue = *ciw; + +@@ -510,9 +507,6 @@ int qdio_setup_irq(struct qdio_initialize *init_data) + irq_ptr->orig_handler = init_data->cdev->handler; + init_data->cdev->handler = qdio_int_handler; + return 0; +-out_err: +- qdio_release_memory(irq_ptr); +- return rc; + } + + void qdio_print_subchannel_info(struct qdio_irq *irq_ptr, +diff --git a/drivers/s390/cio/vfio_ccw_cp.c b/drivers/s390/cio/vfio_ccw_cp.c +index 4a39b54732d0..72ce6ad95767 100644 +--- a/drivers/s390/cio/vfio_ccw_cp.c ++++ b/drivers/s390/cio/vfio_ccw_cp.c +@@ -703,6 +703,10 @@ void cp_free(struct channel_program *cp) + * and stores the result to ccwchain list. @cp must have been + * initialized by a previous call with cp_init(). Otherwise, undefined + * behavior occurs. ++ * For each chain composing the channel program: ++ * - On entry ch_len holds the count of CCWs to be translated. ++ * - On exit ch_len is adjusted to the count of successfully translated CCWs. ++ * This allows cp_free to find in ch_len the count of CCWs to free in a chain. + * + * The S/390 CCW Translation APIS (prefixed by 'cp_') are introduced + * as helpers to do ccw chain translation inside the kernel. Basically +@@ -737,11 +741,18 @@ int cp_prefetch(struct channel_program *cp) + for (idx = 0; idx < len; idx++) { + ret = ccwchain_fetch_one(chain, idx, cp); + if (ret) +- return ret; ++ goto out_err; + } + } + + return 0; ++out_err: ++ /* Only cleanup the chain elements that were actually translated. */ ++ chain->ch_len = idx; ++ list_for_each_entry_continue(chain, &cp->ccwchain_list, next) { ++ chain->ch_len = 0; ++ } ++ return ret; + } + + /** +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index a172ab299e80..ff01f865a173 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -490,7 +490,7 @@ static int bcm_qspi_bspi_set_mode(struct bcm_qspi *qspi, + + static void bcm_qspi_enable_bspi(struct bcm_qspi *qspi) + { +- if (!has_bspi(qspi) || (qspi->bspi_enabled)) ++ if (!has_bspi(qspi)) + return; + + qspi->bspi_enabled = 1; +@@ -505,7 +505,7 @@ static void bcm_qspi_enable_bspi(struct bcm_qspi *qspi) + + static void bcm_qspi_disable_bspi(struct bcm_qspi *qspi) + { +- if (!has_bspi(qspi) || (!qspi->bspi_enabled)) ++ if (!has_bspi(qspi)) + return; + + qspi->bspi_enabled = 0; +@@ -519,16 +519,19 @@ static void bcm_qspi_disable_bspi(struct bcm_qspi *qspi) + + static void bcm_qspi_chip_select(struct bcm_qspi *qspi, int cs) + { +- u32 data = 0; ++ u32 rd = 0; ++ u32 wr = 0; + +- if (qspi->curr_cs == cs) +- return; + if (qspi->base[CHIP_SELECT]) { +- data = bcm_qspi_read(qspi, CHIP_SELECT, 0); +- data = (data & ~0xff) | (1 << cs); +- bcm_qspi_write(qspi, CHIP_SELECT, 0, data); ++ rd = bcm_qspi_read(qspi, CHIP_SELECT, 0); ++ wr = (rd & ~0xff) | (1 << cs); ++ if (rd == wr) ++ return; ++ bcm_qspi_write(qspi, CHIP_SELECT, 0, wr); + usleep_range(10, 20); + } ++ ++ dev_dbg(&qspi->pdev->dev, "using cs:%d\n", cs); + qspi->curr_cs = cs; + } + +@@ -755,8 +758,13 @@ static int write_to_hw(struct bcm_qspi *qspi, struct spi_device *spi) + dev_dbg(&qspi->pdev->dev, "WR %04x\n", val); + } + mspi_cdram = MSPI_CDRAM_CONT_BIT; +- mspi_cdram |= (~(1 << spi->chip_select) & +- MSPI_CDRAM_PCS); ++ ++ if (has_bspi(qspi)) ++ mspi_cdram &= ~1; ++ else ++ mspi_cdram |= (~(1 << spi->chip_select) & ++ MSPI_CDRAM_PCS); ++ + mspi_cdram |= ((tp.trans->bits_per_word <= 8) ? 0 : + MSPI_CDRAM_BITSE_BIT); + +diff --git a/drivers/spi/spi-pxa2xx.h b/drivers/spi/spi-pxa2xx.h +index 94f7b0713281..02a8012a318a 100644 +--- a/drivers/spi/spi-pxa2xx.h ++++ b/drivers/spi/spi-pxa2xx.h +@@ -38,7 +38,7 @@ struct driver_data { + + /* SSP register addresses */ + void __iomem *ioaddr; +- u32 ssdr_physical; ++ phys_addr_t ssdr_physical; + + /* SSP masks*/ + u32 dma_cr1; +diff --git a/drivers/tee/tee_shm.c b/drivers/tee/tee_shm.c +index 4bc7956cefc4..ea3ce4e17b85 100644 +--- a/drivers/tee/tee_shm.c ++++ b/drivers/tee/tee_shm.c +@@ -203,9 +203,10 @@ int tee_shm_get_fd(struct tee_shm *shm) + if ((shm->flags & req_flags) != req_flags) + return -EINVAL; + ++ get_dma_buf(shm->dmabuf); + fd = dma_buf_fd(shm->dmabuf, O_CLOEXEC); +- if (fd >= 0) +- get_dma_buf(shm->dmabuf); ++ if (fd < 0) ++ dma_buf_put(shm->dmabuf); + return fd; + } + +diff --git a/drivers/usb/usbip/stub.h b/drivers/usb/usbip/stub.h +index 910f027773aa..84c0599b45b7 100644 +--- a/drivers/usb/usbip/stub.h ++++ b/drivers/usb/usbip/stub.h +@@ -87,6 +87,7 @@ struct bus_id_priv { + struct stub_device *sdev; + struct usb_device *udev; + char shutdown_busid; ++ spinlock_t busid_lock; + }; + + /* stub_priv is allocated from stub_priv_cache */ +@@ -97,6 +98,7 @@ extern struct usb_device_driver stub_driver; + + /* stub_main.c */ + struct bus_id_priv *get_busid_priv(const char *busid); ++void put_busid_priv(struct bus_id_priv *bid); + int del_match_busid(char *busid); + void stub_device_cleanup_urbs(struct stub_device *sdev); + +diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c +index b8915513fc84..cc847f2edf38 100644 +--- a/drivers/usb/usbip/stub_dev.c ++++ b/drivers/usb/usbip/stub_dev.c +@@ -314,9 +314,9 @@ static int stub_probe(struct usb_device *udev) + struct stub_device *sdev = NULL; + const char *udev_busid = dev_name(&udev->dev); + struct bus_id_priv *busid_priv; +- int rc; ++ int rc = 0; + +- dev_dbg(&udev->dev, "Enter\n"); ++ dev_dbg(&udev->dev, "Enter probe\n"); + + /* check we should claim or not by busid_table */ + busid_priv = get_busid_priv(udev_busid); +@@ -331,13 +331,15 @@ static int stub_probe(struct usb_device *udev) + * other matched drivers by the driver core. + * See driver_probe_device() in driver/base/dd.c + */ +- return -ENODEV; ++ rc = -ENODEV; ++ goto call_put_busid_priv; + } + + if (udev->descriptor.bDeviceClass == USB_CLASS_HUB) { + dev_dbg(&udev->dev, "%s is a usb hub device... skip!\n", + udev_busid); +- return -ENODEV; ++ rc = -ENODEV; ++ goto call_put_busid_priv; + } + + if (!strcmp(udev->bus->bus_name, "vhci_hcd")) { +@@ -345,13 +347,16 @@ static int stub_probe(struct usb_device *udev) + "%s is attached on vhci_hcd... skip!\n", + udev_busid); + +- return -ENODEV; ++ rc = -ENODEV; ++ goto call_put_busid_priv; + } + + /* ok, this is my device */ + sdev = stub_device_alloc(udev); +- if (!sdev) +- return -ENOMEM; ++ if (!sdev) { ++ rc = -ENOMEM; ++ goto call_put_busid_priv; ++ } + + dev_info(&udev->dev, + "usbip-host: register new device (bus %u dev %u)\n", +@@ -383,7 +388,9 @@ static int stub_probe(struct usb_device *udev) + } + busid_priv->status = STUB_BUSID_ALLOC; + +- return 0; ++ rc = 0; ++ goto call_put_busid_priv; ++ + err_files: + usb_hub_release_port(udev->parent, udev->portnum, + (struct usb_dev_state *) udev); +@@ -393,6 +400,9 @@ static int stub_probe(struct usb_device *udev) + + busid_priv->sdev = NULL; + stub_device_free(sdev); ++ ++call_put_busid_priv: ++ put_busid_priv(busid_priv); + return rc; + } + +@@ -418,7 +428,7 @@ static void stub_disconnect(struct usb_device *udev) + struct bus_id_priv *busid_priv; + int rc; + +- dev_dbg(&udev->dev, "Enter\n"); ++ dev_dbg(&udev->dev, "Enter disconnect\n"); + + busid_priv = get_busid_priv(udev_busid); + if (!busid_priv) { +@@ -431,7 +441,7 @@ static void stub_disconnect(struct usb_device *udev) + /* get stub_device */ + if (!sdev) { + dev_err(&udev->dev, "could not get device"); +- return; ++ goto call_put_busid_priv; + } + + dev_set_drvdata(&udev->dev, NULL); +@@ -446,12 +456,12 @@ static void stub_disconnect(struct usb_device *udev) + (struct usb_dev_state *) udev); + if (rc) { + dev_dbg(&udev->dev, "unable to release port\n"); +- return; ++ goto call_put_busid_priv; + } + + /* If usb reset is called from event handler */ + if (usbip_in_eh(current)) +- return; ++ goto call_put_busid_priv; + + /* shutdown the current connection */ + shutdown_busid(busid_priv); +@@ -462,12 +472,11 @@ static void stub_disconnect(struct usb_device *udev) + busid_priv->sdev = NULL; + stub_device_free(sdev); + +- if (busid_priv->status == STUB_BUSID_ALLOC) { ++ if (busid_priv->status == STUB_BUSID_ALLOC) + busid_priv->status = STUB_BUSID_ADDED; +- } else { +- busid_priv->status = STUB_BUSID_OTHER; +- del_match_busid((char *)udev_busid); +- } ++ ++call_put_busid_priv: ++ put_busid_priv(busid_priv); + } + + #ifdef CONFIG_PM +diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c +index b59a253a8479..108dd65fbfbc 100644 +--- a/drivers/usb/usbip/stub_main.c ++++ b/drivers/usb/usbip/stub_main.c +@@ -28,6 +28,7 @@ + #define DRIVER_DESC "USB/IP Host Driver" + + struct kmem_cache *stub_priv_cache; ++ + /* + * busid_tables defines matching busids that usbip can grab. A user can change + * dynamically what device is locally used and what device is exported to a +@@ -39,6 +40,8 @@ static spinlock_t busid_table_lock; + + static void init_busid_table(void) + { ++ int i; ++ + /* + * This also sets the bus_table[i].status to + * STUB_BUSID_OTHER, which is 0. +@@ -46,6 +49,9 @@ static void init_busid_table(void) + memset(busid_table, 0, sizeof(busid_table)); + + spin_lock_init(&busid_table_lock); ++ ++ for (i = 0; i < MAX_BUSID; i++) ++ spin_lock_init(&busid_table[i].busid_lock); + } + + /* +@@ -57,15 +63,20 @@ static int get_busid_idx(const char *busid) + int i; + int idx = -1; + +- for (i = 0; i < MAX_BUSID; i++) ++ for (i = 0; i < MAX_BUSID; i++) { ++ spin_lock(&busid_table[i].busid_lock); + if (busid_table[i].name[0]) + if (!strncmp(busid_table[i].name, busid, BUSID_SIZE)) { + idx = i; ++ spin_unlock(&busid_table[i].busid_lock); + break; + } ++ spin_unlock(&busid_table[i].busid_lock); ++ } + return idx; + } + ++/* Returns holding busid_lock. Should call put_busid_priv() to unlock */ + struct bus_id_priv *get_busid_priv(const char *busid) + { + int idx; +@@ -73,13 +84,22 @@ struct bus_id_priv *get_busid_priv(const char *busid) + + spin_lock(&busid_table_lock); + idx = get_busid_idx(busid); +- if (idx >= 0) ++ if (idx >= 0) { + bid = &(busid_table[idx]); ++ /* get busid_lock before returning */ ++ spin_lock(&bid->busid_lock); ++ } + spin_unlock(&busid_table_lock); + + return bid; + } + ++void put_busid_priv(struct bus_id_priv *bid) ++{ ++ if (bid) ++ spin_unlock(&bid->busid_lock); ++} ++ + static int add_match_busid(char *busid) + { + int i; +@@ -92,15 +112,19 @@ static int add_match_busid(char *busid) + goto out; + } + +- for (i = 0; i < MAX_BUSID; i++) ++ for (i = 0; i < MAX_BUSID; i++) { ++ spin_lock(&busid_table[i].busid_lock); + if (!busid_table[i].name[0]) { + strlcpy(busid_table[i].name, busid, BUSID_SIZE); + if ((busid_table[i].status != STUB_BUSID_ALLOC) && + (busid_table[i].status != STUB_BUSID_REMOV)) + busid_table[i].status = STUB_BUSID_ADDED; + ret = 0; ++ spin_unlock(&busid_table[i].busid_lock); + break; + } ++ spin_unlock(&busid_table[i].busid_lock); ++ } + + out: + spin_unlock(&busid_table_lock); +@@ -121,6 +145,8 @@ int del_match_busid(char *busid) + /* found */ + ret = 0; + ++ spin_lock(&busid_table[idx].busid_lock); ++ + if (busid_table[idx].status == STUB_BUSID_OTHER) + memset(busid_table[idx].name, 0, BUSID_SIZE); + +@@ -128,6 +154,7 @@ int del_match_busid(char *busid) + (busid_table[idx].status != STUB_BUSID_ADDED)) + busid_table[idx].status = STUB_BUSID_REMOV; + ++ spin_unlock(&busid_table[idx].busid_lock); + out: + spin_unlock(&busid_table_lock); + +@@ -140,9 +167,12 @@ static ssize_t match_busid_show(struct device_driver *drv, char *buf) + char *out = buf; + + spin_lock(&busid_table_lock); +- for (i = 0; i < MAX_BUSID; i++) ++ for (i = 0; i < MAX_BUSID; i++) { ++ spin_lock(&busid_table[i].busid_lock); + if (busid_table[i].name[0]) + out += sprintf(out, "%s ", busid_table[i].name); ++ spin_unlock(&busid_table[i].busid_lock); ++ } + spin_unlock(&busid_table_lock); + out += sprintf(out, "\n"); + +@@ -183,6 +213,51 @@ static ssize_t match_busid_store(struct device_driver *dev, const char *buf, + } + static DRIVER_ATTR_RW(match_busid); + ++static int do_rebind(char *busid, struct bus_id_priv *busid_priv) ++{ ++ int ret; ++ ++ /* device_attach() callers should hold parent lock for USB */ ++ if (busid_priv->udev->dev.parent) ++ device_lock(busid_priv->udev->dev.parent); ++ ret = device_attach(&busid_priv->udev->dev); ++ if (busid_priv->udev->dev.parent) ++ device_unlock(busid_priv->udev->dev.parent); ++ if (ret < 0) { ++ dev_err(&busid_priv->udev->dev, "rebind failed\n"); ++ return ret; ++ } ++ return 0; ++} ++ ++static void stub_device_rebind(void) ++{ ++#if IS_MODULE(CONFIG_USBIP_HOST) ++ struct bus_id_priv *busid_priv; ++ int i; ++ ++ /* update status to STUB_BUSID_OTHER so probe ignores the device */ ++ spin_lock(&busid_table_lock); ++ for (i = 0; i < MAX_BUSID; i++) { ++ if (busid_table[i].name[0] && ++ busid_table[i].shutdown_busid) { ++ busid_priv = &(busid_table[i]); ++ busid_priv->status = STUB_BUSID_OTHER; ++ } ++ } ++ spin_unlock(&busid_table_lock); ++ ++ /* now run rebind - no need to hold locks. driver files are removed */ ++ for (i = 0; i < MAX_BUSID; i++) { ++ if (busid_table[i].name[0] && ++ busid_table[i].shutdown_busid) { ++ busid_priv = &(busid_table[i]); ++ do_rebind(busid_table[i].name, busid_priv); ++ } ++ } ++#endif ++} ++ + static ssize_t rebind_store(struct device_driver *dev, const char *buf, + size_t count) + { +@@ -200,16 +275,17 @@ static ssize_t rebind_store(struct device_driver *dev, const char *buf, + if (!bid) + return -ENODEV; + +- /* device_attach() callers should hold parent lock for USB */ +- if (bid->udev->dev.parent) +- device_lock(bid->udev->dev.parent); +- ret = device_attach(&bid->udev->dev); +- if (bid->udev->dev.parent) +- device_unlock(bid->udev->dev.parent); +- if (ret < 0) { +- dev_err(&bid->udev->dev, "rebind failed\n"); ++ /* mark the device for deletion so probe ignores it during rescan */ ++ bid->status = STUB_BUSID_OTHER; ++ /* release the busid lock */ ++ put_busid_priv(bid); ++ ++ ret = do_rebind((char *) buf, bid); ++ if (ret < 0) + return ret; +- } ++ ++ /* delete device from busid_table */ ++ del_match_busid((char *) buf); + + return count; + } +@@ -331,6 +407,9 @@ static void __exit usbip_host_exit(void) + */ + usb_deregister_device_driver(&stub_driver); + ++ /* initiate scan to attach devices */ ++ stub_device_rebind(); ++ + kmem_cache_destroy(stub_priv_cache); + } + +diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c +index 21cc27509993..d1b9900ebc9b 100644 +--- a/fs/btrfs/ctree.c ++++ b/fs/btrfs/ctree.c +@@ -2497,10 +2497,8 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p, + if (p->reada != READA_NONE) + reada_for_search(fs_info, p, level, slot, key->objectid); + +- btrfs_release_path(p); +- + ret = -EAGAIN; +- tmp = read_tree_block(fs_info, blocknr, 0); ++ tmp = read_tree_block(fs_info, blocknr, gen); + if (!IS_ERR(tmp)) { + /* + * If the read above didn't mark this buffer up to date, +@@ -2514,6 +2512,8 @@ read_block_for_search(struct btrfs_root *root, struct btrfs_path *p, + } else { + ret = PTR_ERR(tmp); + } ++ ++ btrfs_release_path(p); + return ret; + } + +@@ -5454,12 +5454,24 @@ int btrfs_compare_trees(struct btrfs_root *left_root, + down_read(&fs_info->commit_root_sem); + left_level = btrfs_header_level(left_root->commit_root); + left_root_level = left_level; +- left_path->nodes[left_level] = left_root->commit_root; ++ left_path->nodes[left_level] = ++ btrfs_clone_extent_buffer(left_root->commit_root); ++ if (!left_path->nodes[left_level]) { ++ up_read(&fs_info->commit_root_sem); ++ ret = -ENOMEM; ++ goto out; ++ } + extent_buffer_get(left_path->nodes[left_level]); + + right_level = btrfs_header_level(right_root->commit_root); + right_root_level = right_level; +- right_path->nodes[right_level] = right_root->commit_root; ++ right_path->nodes[right_level] = ++ btrfs_clone_extent_buffer(right_root->commit_root); ++ if (!right_path->nodes[right_level]) { ++ up_read(&fs_info->commit_root_sem); ++ ret = -ENOMEM; ++ goto out; ++ } + extent_buffer_get(right_path->nodes[right_level]); + up_read(&fs_info->commit_root_sem); + +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index 8fc690384c58..c44703e21396 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -3150,6 +3150,8 @@ noinline int can_nocow_extent(struct inode *inode, u64 offset, u64 *len, + u64 *orig_start, u64 *orig_block_len, + u64 *ram_bytes); + ++void __btrfs_del_delalloc_inode(struct btrfs_root *root, ++ struct btrfs_inode *inode); + struct inode *btrfs_lookup_dentry(struct inode *dir, struct dentry *dentry); + int btrfs_set_inode_index(struct btrfs_inode *dir, u64 *index); + int btrfs_unlink_inode(struct btrfs_trans_handle *trans, +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 79f0f282a0ef..4a630aeabb10 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -3905,6 +3905,7 @@ void close_ctree(struct btrfs_fs_info *fs_info) + set_bit(BTRFS_FS_CLOSING_DONE, &fs_info->flags); + + btrfs_free_qgroup_config(fs_info); ++ ASSERT(list_empty(&fs_info->delalloc_roots)); + + if (percpu_counter_sum(&fs_info->delalloc_bytes)) { + btrfs_info(fs_info, "at unmount delalloc count %lld", +@@ -4203,15 +4204,15 @@ static int btrfs_check_super_valid(struct btrfs_fs_info *fs_info) + + static void btrfs_error_commit_super(struct btrfs_fs_info *fs_info) + { ++ /* cleanup FS via transaction */ ++ btrfs_cleanup_transaction(fs_info); ++ + mutex_lock(&fs_info->cleaner_mutex); + btrfs_run_delayed_iputs(fs_info); + mutex_unlock(&fs_info->cleaner_mutex); + + down_write(&fs_info->cleanup_work_sem); + up_write(&fs_info->cleanup_work_sem); +- +- /* cleanup FS via transaction */ +- btrfs_cleanup_transaction(fs_info); + } + + static void btrfs_destroy_ordered_extents(struct btrfs_root *root) +@@ -4334,19 +4335,23 @@ static void btrfs_destroy_delalloc_inodes(struct btrfs_root *root) + list_splice_init(&root->delalloc_inodes, &splice); + + while (!list_empty(&splice)) { ++ struct inode *inode = NULL; + btrfs_inode = list_first_entry(&splice, struct btrfs_inode, + delalloc_inodes); +- +- list_del_init(&btrfs_inode->delalloc_inodes); +- clear_bit(BTRFS_INODE_IN_DELALLOC_LIST, +- &btrfs_inode->runtime_flags); ++ __btrfs_del_delalloc_inode(root, btrfs_inode); + spin_unlock(&root->delalloc_lock); + +- btrfs_invalidate_inodes(btrfs_inode->root); +- ++ /* ++ * Make sure we get a live inode and that it'll not disappear ++ * meanwhile. ++ */ ++ inode = igrab(&btrfs_inode->vfs_inode); ++ if (inode) { ++ invalidate_inode_pages2(inode->i_mapping); ++ iput(inode); ++ } + spin_lock(&root->delalloc_lock); + } +- + spin_unlock(&root->delalloc_lock); + } + +@@ -4362,7 +4367,6 @@ static void btrfs_destroy_all_delalloc_inodes(struct btrfs_fs_info *fs_info) + while (!list_empty(&splice)) { + root = list_first_entry(&splice, struct btrfs_root, + delalloc_root); +- list_del_init(&root->delalloc_root); + root = btrfs_grab_fs_root(root); + BUG_ON(!root); + spin_unlock(&fs_info->delalloc_root_lock); +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 9f21c29d0259..b0fa3a032143 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1754,12 +1754,12 @@ static void btrfs_add_delalloc_inodes(struct btrfs_root *root, + spin_unlock(&root->delalloc_lock); + } + +-static void btrfs_del_delalloc_inode(struct btrfs_root *root, +- struct btrfs_inode *inode) ++ ++void __btrfs_del_delalloc_inode(struct btrfs_root *root, ++ struct btrfs_inode *inode) + { + struct btrfs_fs_info *fs_info = btrfs_sb(inode->vfs_inode.i_sb); + +- spin_lock(&root->delalloc_lock); + if (!list_empty(&inode->delalloc_inodes)) { + list_del_init(&inode->delalloc_inodes); + clear_bit(BTRFS_INODE_IN_DELALLOC_LIST, +@@ -1772,6 +1772,13 @@ static void btrfs_del_delalloc_inode(struct btrfs_root *root, + spin_unlock(&fs_info->delalloc_root_lock); + } + } ++} ++ ++static void btrfs_del_delalloc_inode(struct btrfs_root *root, ++ struct btrfs_inode *inode) ++{ ++ spin_lock(&root->delalloc_lock); ++ __btrfs_del_delalloc_inode(root, inode); + spin_unlock(&root->delalloc_lock); + } + +diff --git a/fs/btrfs/props.c b/fs/btrfs/props.c +index f6a05f836629..cbabc6f2b322 100644 +--- a/fs/btrfs/props.c ++++ b/fs/btrfs/props.c +@@ -400,6 +400,7 @@ static int prop_compression_apply(struct inode *inode, + const char *value, + size_t len) + { ++ struct btrfs_fs_info *fs_info = btrfs_sb(inode->i_sb); + int type; + + if (len == 0) { +@@ -410,14 +411,17 @@ static int prop_compression_apply(struct inode *inode, + return 0; + } + +- if (!strncmp("lzo", value, 3)) ++ if (!strncmp("lzo", value, 3)) { + type = BTRFS_COMPRESS_LZO; +- else if (!strncmp("zlib", value, 4)) ++ btrfs_set_fs_incompat(fs_info, COMPRESS_LZO); ++ } else if (!strncmp("zlib", value, 4)) { + type = BTRFS_COMPRESS_ZLIB; +- else if (!strncmp("zstd", value, len)) ++ } else if (!strncmp("zstd", value, len)) { + type = BTRFS_COMPRESS_ZSTD; +- else ++ btrfs_set_fs_incompat(fs_info, COMPRESS_ZSTD); ++ } else { + return -EINVAL; ++ } + + BTRFS_I(inode)->flags &= ~BTRFS_INODE_NOCOMPRESS; + BTRFS_I(inode)->flags |= BTRFS_INODE_COMPRESS; +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index b6dfe7af7a1f..2794f3550db6 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4669,6 +4669,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, + struct extent_map_tree *em_tree = &inode->extent_tree; + u64 logged_isize = 0; + bool need_log_inode_item = true; ++ bool xattrs_logged = false; + + path = btrfs_alloc_path(); + if (!path) +@@ -4971,6 +4972,7 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, + err = btrfs_log_all_xattrs(trans, root, inode, path, dst_path); + if (err) + goto out_unlock; ++ xattrs_logged = true; + if (max_key.type >= BTRFS_EXTENT_DATA_KEY && !fast_search) { + btrfs_release_path(path); + btrfs_release_path(dst_path); +@@ -4983,6 +4985,11 @@ static int btrfs_log_inode(struct btrfs_trans_handle *trans, + btrfs_release_path(dst_path); + if (need_log_inode_item) { + err = log_inode_item(trans, log, dst_path, inode); ++ if (!err && !xattrs_logged) { ++ err = btrfs_log_all_xattrs(trans, root, inode, path, ++ dst_path); ++ btrfs_release_path(path); ++ } + if (err) + goto out_unlock; + } +diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c +index b983e7fb200b..08afafb6ecf7 100644 +--- a/fs/btrfs/volumes.c ++++ b/fs/btrfs/volumes.c +@@ -3964,6 +3964,15 @@ int btrfs_resume_balance_async(struct btrfs_fs_info *fs_info) + return 0; + } + ++ /* ++ * A ro->rw remount sequence should continue with the paused balance ++ * regardless of who pauses it, system or the user as of now, so set ++ * the resume flag. ++ */ ++ spin_lock(&fs_info->balance_lock); ++ fs_info->balance_ctl->flags |= BTRFS_BALANCE_RESUME; ++ spin_unlock(&fs_info->balance_lock); ++ + tsk = kthread_run(balance_kthread, fs_info, "btrfs-balance"); + return PTR_ERR_OR_ZERO(tsk); + } +diff --git a/fs/proc/array.c b/fs/proc/array.c +index e6094a15ef30..4ac811e1a26c 100644 +--- a/fs/proc/array.c ++++ b/fs/proc/array.c +@@ -85,6 +85,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -347,6 +348,30 @@ static inline void task_seccomp(struct seq_file *m, struct task_struct *p) + #ifdef CONFIG_SECCOMP + seq_put_decimal_ull(m, "\nSeccomp:\t", p->seccomp.mode); + #endif ++ seq_printf(m, "\nSpeculation_Store_Bypass:\t"); ++ switch (arch_prctl_spec_ctrl_get(p, PR_SPEC_STORE_BYPASS)) { ++ case -EINVAL: ++ seq_printf(m, "unknown"); ++ break; ++ case PR_SPEC_NOT_AFFECTED: ++ seq_printf(m, "not vulnerable"); ++ break; ++ case PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE: ++ seq_printf(m, "thread force mitigated"); ++ break; ++ case PR_SPEC_PRCTL | PR_SPEC_DISABLE: ++ seq_printf(m, "thread mitigated"); ++ break; ++ case PR_SPEC_PRCTL | PR_SPEC_ENABLE: ++ seq_printf(m, "thread vulnerable"); ++ break; ++ case PR_SPEC_DISABLE: ++ seq_printf(m, "globally mitigated"); ++ break; ++ default: ++ seq_printf(m, "vulnerable"); ++ break; ++ } + seq_putc(m, '\n'); + } + +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index c816e6f2730c..9546bf2fe310 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -53,6 +53,8 @@ extern ssize_t cpu_show_spectre_v1(struct device *dev, + struct device_attribute *attr, char *buf); + extern ssize_t cpu_show_spectre_v2(struct device *dev, + struct device_attribute *attr, char *buf); ++extern ssize_t cpu_show_spec_store_bypass(struct device *dev, ++ struct device_attribute *attr, char *buf); + + extern __printf(4, 5) + struct device *cpu_device_create(struct device *parent, void *drvdata, +diff --git a/include/linux/efi.h b/include/linux/efi.h +index 29fdf8029cf6..b68b7d199fee 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -395,8 +395,8 @@ typedef struct { + u32 attributes; + u32 get_bar_attributes; + u32 set_bar_attributes; +- uint64_t romsize; +- void *romimage; ++ u64 romsize; ++ u32 romimage; + } efi_pci_io_protocol_32; + + typedef struct { +@@ -415,8 +415,8 @@ typedef struct { + u64 attributes; + u64 get_bar_attributes; + u64 set_bar_attributes; +- uint64_t romsize; +- void *romimage; ++ u64 romsize; ++ u64 romimage; + } efi_pci_io_protocol_64; + + typedef struct { +diff --git a/include/linux/nospec.h b/include/linux/nospec.h +index e791ebc65c9c..0c5ef54fd416 100644 +--- a/include/linux/nospec.h ++++ b/include/linux/nospec.h +@@ -7,6 +7,8 @@ + #define _LINUX_NOSPEC_H + #include + ++struct task_struct; ++ + /** + * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise + * @index: array element index +@@ -55,4 +57,12 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + \ + (typeof(_i)) (_i & _mask); \ + }) ++ ++/* Speculation control prctl */ ++int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which); ++int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, ++ unsigned long ctrl); ++/* Speculation control for seccomp enforced mitigation */ ++void arch_seccomp_spec_mitigate(struct task_struct *task); ++ + #endif /* _LINUX_NOSPEC_H */ +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 41354690e4e3..2c9790b43881 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1363,7 +1363,8 @@ static inline bool is_percpu_thread(void) + #define PFA_NO_NEW_PRIVS 0 /* May not gain new privileges. */ + #define PFA_SPREAD_PAGE 1 /* Spread page cache over cpuset */ + #define PFA_SPREAD_SLAB 2 /* Spread some slab caches over cpuset */ +- ++#define PFA_SPEC_SSB_DISABLE 3 /* Speculative Store Bypass disabled */ ++#define PFA_SPEC_SSB_FORCE_DISABLE 4 /* Speculative Store Bypass force disabled*/ + + #define TASK_PFA_TEST(name, func) \ + static inline bool task_##func(struct task_struct *p) \ +@@ -1388,6 +1389,13 @@ TASK_PFA_TEST(SPREAD_SLAB, spread_slab) + TASK_PFA_SET(SPREAD_SLAB, spread_slab) + TASK_PFA_CLEAR(SPREAD_SLAB, spread_slab) + ++TASK_PFA_TEST(SPEC_SSB_DISABLE, spec_ssb_disable) ++TASK_PFA_SET(SPEC_SSB_DISABLE, spec_ssb_disable) ++TASK_PFA_CLEAR(SPEC_SSB_DISABLE, spec_ssb_disable) ++ ++TASK_PFA_TEST(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) ++TASK_PFA_SET(SPEC_SSB_FORCE_DISABLE, spec_ssb_force_disable) ++ + static inline void + current_restore_flags(unsigned long orig_flags, unsigned long flags) + { +diff --git a/include/linux/seccomp.h b/include/linux/seccomp.h +index 10f25f7e4304..a9d5c52de4ea 100644 +--- a/include/linux/seccomp.h ++++ b/include/linux/seccomp.h +@@ -4,8 +4,9 @@ + + #include + +-#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \ +- SECCOMP_FILTER_FLAG_LOG) ++#define SECCOMP_FILTER_FLAG_MASK (SECCOMP_FILTER_FLAG_TSYNC | \ ++ SECCOMP_FILTER_FLAG_LOG | \ ++ SECCOMP_FILTER_FLAG_SPEC_ALLOW) + + #ifdef CONFIG_SECCOMP + +diff --git a/include/trace/events/xen.h b/include/trace/events/xen.h +index d791863b62fc..2ec9064a2bb7 100644 +--- a/include/trace/events/xen.h ++++ b/include/trace/events/xen.h +@@ -349,22 +349,6 @@ DECLARE_EVENT_CLASS(xen_mmu_pgd, + DEFINE_XEN_MMU_PGD_EVENT(xen_mmu_pgd_pin); + DEFINE_XEN_MMU_PGD_EVENT(xen_mmu_pgd_unpin); + +-TRACE_EVENT(xen_mmu_flush_tlb_all, +- TP_PROTO(int x), +- TP_ARGS(x), +- TP_STRUCT__entry(__array(char, x, 0)), +- TP_fast_assign((void)x), +- TP_printk("%s", "") +- ); +- +-TRACE_EVENT(xen_mmu_flush_tlb, +- TP_PROTO(int x), +- TP_ARGS(x), +- TP_STRUCT__entry(__array(char, x, 0)), +- TP_fast_assign((void)x), +- TP_printk("%s", "") +- ); +- + TRACE_EVENT(xen_mmu_flush_tlb_one_user, + TP_PROTO(unsigned long addr), + TP_ARGS(addr), +diff --git a/include/uapi/linux/prctl.h b/include/uapi/linux/prctl.h +index b640071421f7..3027f943f4b3 100644 +--- a/include/uapi/linux/prctl.h ++++ b/include/uapi/linux/prctl.h +@@ -198,4 +198,16 @@ struct prctl_mm_map { + # define PR_CAP_AMBIENT_LOWER 3 + # define PR_CAP_AMBIENT_CLEAR_ALL 4 + ++/* Per task speculation control */ ++#define PR_GET_SPECULATION_CTRL 52 ++#define PR_SET_SPECULATION_CTRL 53 ++/* Speculation control variants */ ++# define PR_SPEC_STORE_BYPASS 0 ++/* Return and control values for PR_SET/GET_SPECULATION_CTRL */ ++# define PR_SPEC_NOT_AFFECTED 0 ++# define PR_SPEC_PRCTL (1UL << 0) ++# define PR_SPEC_ENABLE (1UL << 1) ++# define PR_SPEC_DISABLE (1UL << 2) ++# define PR_SPEC_FORCE_DISABLE (1UL << 3) ++ + #endif /* _LINUX_PRCTL_H */ +diff --git a/include/uapi/linux/seccomp.h b/include/uapi/linux/seccomp.h +index 2a0bd9dd104d..9efc0e73d50b 100644 +--- a/include/uapi/linux/seccomp.h ++++ b/include/uapi/linux/seccomp.h +@@ -17,8 +17,9 @@ + #define SECCOMP_GET_ACTION_AVAIL 2 + + /* Valid flags for SECCOMP_SET_MODE_FILTER */ +-#define SECCOMP_FILTER_FLAG_TSYNC 1 +-#define SECCOMP_FILTER_FLAG_LOG 2 ++#define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0) ++#define SECCOMP_FILTER_FLAG_LOG (1UL << 1) ++#define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2) + + /* + * All BPF programs must return a 32-bit value. +diff --git a/kernel/seccomp.c b/kernel/seccomp.c +index 5f0dfb2abb8d..075e344a87c3 100644 +--- a/kernel/seccomp.c ++++ b/kernel/seccomp.c +@@ -19,6 +19,8 @@ + #include + #include + #include ++#include ++#include + #include + #include + #include +@@ -227,8 +229,11 @@ static inline bool seccomp_may_assign_mode(unsigned long seccomp_mode) + return true; + } + ++void __weak arch_seccomp_spec_mitigate(struct task_struct *task) { } ++ + static inline void seccomp_assign_mode(struct task_struct *task, +- unsigned long seccomp_mode) ++ unsigned long seccomp_mode, ++ unsigned long flags) + { + assert_spin_locked(&task->sighand->siglock); + +@@ -238,6 +243,9 @@ static inline void seccomp_assign_mode(struct task_struct *task, + * filter) is set. + */ + smp_mb__before_atomic(); ++ /* Assume default seccomp processes want spec flaw mitigation. */ ++ if ((flags & SECCOMP_FILTER_FLAG_SPEC_ALLOW) == 0) ++ arch_seccomp_spec_mitigate(task); + set_tsk_thread_flag(task, TIF_SECCOMP); + } + +@@ -305,7 +313,7 @@ static inline pid_t seccomp_can_sync_threads(void) + * without dropping the locks. + * + */ +-static inline void seccomp_sync_threads(void) ++static inline void seccomp_sync_threads(unsigned long flags) + { + struct task_struct *thread, *caller; + +@@ -346,7 +354,8 @@ static inline void seccomp_sync_threads(void) + * allow one thread to transition the other. + */ + if (thread->seccomp.mode == SECCOMP_MODE_DISABLED) +- seccomp_assign_mode(thread, SECCOMP_MODE_FILTER); ++ seccomp_assign_mode(thread, SECCOMP_MODE_FILTER, ++ flags); + } + } + +@@ -469,7 +478,7 @@ static long seccomp_attach_filter(unsigned int flags, + + /* Now that the new filter is in place, synchronize to all threads. */ + if (flags & SECCOMP_FILTER_FLAG_TSYNC) +- seccomp_sync_threads(); ++ seccomp_sync_threads(flags); + + return 0; + } +@@ -818,7 +827,7 @@ static long seccomp_set_mode_strict(void) + #ifdef TIF_NOTSC + disable_TSC(); + #endif +- seccomp_assign_mode(current, seccomp_mode); ++ seccomp_assign_mode(current, seccomp_mode, 0); + ret = 0; + + out: +@@ -876,7 +885,7 @@ static long seccomp_set_mode_filter(unsigned int flags, + /* Do not free the successfully attached filter. */ + prepared = NULL; + +- seccomp_assign_mode(current, seccomp_mode); ++ seccomp_assign_mode(current, seccomp_mode, flags); + out: + spin_unlock_irq(¤t->sighand->siglock); + if (flags & SECCOMP_FILTER_FLAG_TSYNC) +diff --git a/kernel/sys.c b/kernel/sys.c +index 524a4cb9bbe2..b5c1bc9e3769 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -61,6 +61,8 @@ + #include + #include + ++#include ++ + #include + /* Move somewhere else to avoid recompiling? */ + #include +@@ -2184,6 +2186,17 @@ static int propagate_has_child_subreaper(struct task_struct *p, void *data) + return 1; + } + ++int __weak arch_prctl_spec_ctrl_get(struct task_struct *t, unsigned long which) ++{ ++ return -EINVAL; ++} ++ ++int __weak arch_prctl_spec_ctrl_set(struct task_struct *t, unsigned long which, ++ unsigned long ctrl) ++{ ++ return -EINVAL; ++} ++ + SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, + unsigned long, arg4, unsigned long, arg5) + { +@@ -2386,6 +2399,16 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, + case PR_GET_FP_MODE: + error = GET_FP_MODE(me); + break; ++ case PR_GET_SPECULATION_CTRL: ++ if (arg3 || arg4 || arg5) ++ return -EINVAL; ++ error = arch_prctl_spec_ctrl_get(me, arg2); ++ break; ++ case PR_SET_SPECULATION_CTRL: ++ if (arg4 || arg5) ++ return -EINVAL; ++ error = arch_prctl_spec_ctrl_set(me, arg2, arg3); ++ break; + default: + error = -EINVAL; + break; +diff --git a/kernel/time/tick-broadcast.c b/kernel/time/tick-broadcast.c +index b398c2ea69b2..aa2094d5dd27 100644 +--- a/kernel/time/tick-broadcast.c ++++ b/kernel/time/tick-broadcast.c +@@ -612,6 +612,14 @@ static void tick_handle_oneshot_broadcast(struct clock_event_device *dev) + now = ktime_get(); + /* Find all expired events */ + for_each_cpu(cpu, tick_broadcast_oneshot_mask) { ++ /* ++ * Required for !SMP because for_each_cpu() reports ++ * unconditionally CPU0 as set on UP kernels. ++ */ ++ if (!IS_ENABLED(CONFIG_SMP) && ++ cpumask_empty(tick_broadcast_oneshot_mask)) ++ break; ++ + td = &per_cpu(tick_cpu_device, cpu); + if (td->evtdev->next_event <= now) { + cpumask_set_cpu(cpu, tmpmask); +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index 8b1feca1230a..70d677820740 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -1613,11 +1613,9 @@ static void set_iter_tags(struct radix_tree_iter *iter, + static void __rcu **skip_siblings(struct radix_tree_node **nodep, + void __rcu **slot, struct radix_tree_iter *iter) + { +- void *sib = node_to_entry(slot - 1); +- + while (iter->index < iter->next_index) { + *nodep = rcu_dereference_raw(*slot); +- if (*nodep && *nodep != sib) ++ if (*nodep && !is_sibling_entry(iter->node, *nodep)) + return slot; + slot++; + iter->index = __radix_tree_iter_add(iter, 1); +@@ -1632,7 +1630,7 @@ void __rcu **__radix_tree_next_slot(void __rcu **slot, + struct radix_tree_iter *iter, unsigned flags) + { + unsigned tag = flags & RADIX_TREE_ITER_TAG_MASK; +- struct radix_tree_node *node = rcu_dereference_raw(*slot); ++ struct radix_tree_node *node; + + slot = skip_siblings(&node, slot, iter); + +diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c +index 0ddf293cfac3..0a6f492fb9d9 100644 +--- a/lib/test_bitmap.c ++++ b/lib/test_bitmap.c +@@ -434,23 +434,32 @@ static void noinline __init test_mem_optimisations(void) + unsigned int start, nbits; + + for (start = 0; start < 1024; start += 8) { +- memset(bmap1, 0x5a, sizeof(bmap1)); +- memset(bmap2, 0x5a, sizeof(bmap2)); + for (nbits = 0; nbits < 1024 - start; nbits += 8) { ++ memset(bmap1, 0x5a, sizeof(bmap1)); ++ memset(bmap2, 0x5a, sizeof(bmap2)); ++ + bitmap_set(bmap1, start, nbits); + __bitmap_set(bmap2, start, nbits); +- if (!bitmap_equal(bmap1, bmap2, 1024)) ++ if (!bitmap_equal(bmap1, bmap2, 1024)) { + printk("set not equal %d %d\n", start, nbits); +- if (!__bitmap_equal(bmap1, bmap2, 1024)) ++ failed_tests++; ++ } ++ if (!__bitmap_equal(bmap1, bmap2, 1024)) { + printk("set not __equal %d %d\n", start, nbits); ++ failed_tests++; ++ } + + bitmap_clear(bmap1, start, nbits); + __bitmap_clear(bmap2, start, nbits); +- if (!bitmap_equal(bmap1, bmap2, 1024)) ++ if (!bitmap_equal(bmap1, bmap2, 1024)) { + printk("clear not equal %d %d\n", start, nbits); +- if (!__bitmap_equal(bmap1, bmap2, 1024)) ++ failed_tests++; ++ } ++ if (!__bitmap_equal(bmap1, bmap2, 1024)) { + printk("clear not __equal %d %d\n", start, + nbits); ++ failed_tests++; ++ } + } + } + } +diff --git a/mm/Kconfig b/mm/Kconfig +index 9c4bdddd80c2..59efbd3337e0 100644 +--- a/mm/Kconfig ++++ b/mm/Kconfig +@@ -649,6 +649,7 @@ config DEFERRED_STRUCT_PAGE_INIT + depends on ARCH_SUPPORTS_DEFERRED_STRUCT_PAGE_INIT + depends on NO_BOOTMEM && MEMORY_HOTPLUG + depends on !FLATMEM ++ depends on !NEED_PER_CPU_KM + help + Ordinarily all struct pages are initialised during early boot in a + single thread. On very large machines this can take a considerable +diff --git a/net/ipv4/netfilter/nf_socket_ipv4.c b/net/ipv4/netfilter/nf_socket_ipv4.c +index e9293bdebba0..4824b1e183a1 100644 +--- a/net/ipv4/netfilter/nf_socket_ipv4.c ++++ b/net/ipv4/netfilter/nf_socket_ipv4.c +@@ -108,10 +108,12 @@ struct sock *nf_sk_lookup_slow_v4(struct net *net, const struct sk_buff *skb, + int doff = 0; + + if (iph->protocol == IPPROTO_UDP || iph->protocol == IPPROTO_TCP) { +- struct udphdr _hdr, *hp; ++ struct tcphdr _hdr; ++ struct udphdr *hp; + + hp = skb_header_pointer(skb, ip_hdrlen(skb), +- sizeof(_hdr), &_hdr); ++ iph->protocol == IPPROTO_UDP ? ++ sizeof(*hp) : sizeof(_hdr), &_hdr); + if (hp == NULL) + return NULL; + +diff --git a/net/ipv6/netfilter/nf_socket_ipv6.c b/net/ipv6/netfilter/nf_socket_ipv6.c +index ebb2bf84232a..f14de4b6d639 100644 +--- a/net/ipv6/netfilter/nf_socket_ipv6.c ++++ b/net/ipv6/netfilter/nf_socket_ipv6.c +@@ -116,9 +116,11 @@ struct sock *nf_sk_lookup_slow_v6(struct net *net, const struct sk_buff *skb, + } + + if (tproto == IPPROTO_UDP || tproto == IPPROTO_TCP) { +- struct udphdr _hdr, *hp; ++ struct tcphdr _hdr; ++ struct udphdr *hp; + +- hp = skb_header_pointer(skb, thoff, sizeof(_hdr), &_hdr); ++ hp = skb_header_pointer(skb, thoff, tproto == IPPROTO_UDP ? ++ sizeof(*hp) : sizeof(_hdr), &_hdr); + if (hp == NULL) + return NULL; + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 5b504aa653f5..689e9c0570ba 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2344,41 +2344,46 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + } + + if (nlh->nlmsg_flags & NLM_F_REPLACE) { +- if (nft_is_active_next(net, old_rule)) { +- trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE, +- old_rule); +- if (trans == NULL) { +- err = -ENOMEM; +- goto err2; +- } +- nft_deactivate_next(net, old_rule); +- chain->use--; +- list_add_tail_rcu(&rule->list, &old_rule->list); +- } else { ++ if (!nft_is_active_next(net, old_rule)) { + err = -ENOENT; + goto err2; + } +- } else if (nlh->nlmsg_flags & NLM_F_APPEND) +- if (old_rule) +- list_add_rcu(&rule->list, &old_rule->list); +- else +- list_add_tail_rcu(&rule->list, &chain->rules); +- else { +- if (old_rule) +- list_add_tail_rcu(&rule->list, &old_rule->list); +- else +- list_add_rcu(&rule->list, &chain->rules); +- } ++ trans = nft_trans_rule_add(&ctx, NFT_MSG_DELRULE, ++ old_rule); ++ if (trans == NULL) { ++ err = -ENOMEM; ++ goto err2; ++ } ++ nft_deactivate_next(net, old_rule); ++ chain->use--; + +- if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { +- err = -ENOMEM; +- goto err3; ++ if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { ++ err = -ENOMEM; ++ goto err2; ++ } ++ ++ list_add_tail_rcu(&rule->list, &old_rule->list); ++ } else { ++ if (nft_trans_rule_add(&ctx, NFT_MSG_NEWRULE, rule) == NULL) { ++ err = -ENOMEM; ++ goto err2; ++ } ++ ++ if (nlh->nlmsg_flags & NLM_F_APPEND) { ++ if (old_rule) ++ list_add_rcu(&rule->list, &old_rule->list); ++ else ++ list_add_tail_rcu(&rule->list, &chain->rules); ++ } else { ++ if (old_rule) ++ list_add_tail_rcu(&rule->list, &old_rule->list); ++ else ++ list_add_rcu(&rule->list, &chain->rules); ++ } + } + chain->use++; + return 0; + +-err3: +- list_del_rcu(&rule->list); + err2: + nf_tables_rule_destroy(&ctx, rule); + err1: +@@ -3196,18 +3201,20 @@ static int nf_tables_newset(struct net *net, struct sock *nlsk, + + err = ops->init(set, &desc, nla); + if (err < 0) +- goto err2; ++ goto err3; + + err = nft_trans_set_add(&ctx, NFT_MSG_NEWSET, set); + if (err < 0) +- goto err3; ++ goto err4; + + list_add_tail_rcu(&set->list, &table->sets); + table->use++; + return 0; + +-err3: ++err4: + ops->destroy(set); ++err3: ++ kfree(set->name); + err2: + kvfree(set); + err1: +diff --git a/sound/core/control_compat.c b/sound/core/control_compat.c +index a848836a5de0..507fd5210c1c 100644 +--- a/sound/core/control_compat.c ++++ b/sound/core/control_compat.c +@@ -396,8 +396,7 @@ static int snd_ctl_elem_add_compat(struct snd_ctl_file *file, + if (copy_from_user(&data->id, &data32->id, sizeof(data->id)) || + copy_from_user(&data->type, &data32->type, 3 * sizeof(u32))) + goto error; +- if (get_user(data->owner, &data32->owner) || +- get_user(data->type, &data32->type)) ++ if (get_user(data->owner, &data32->owner)) + goto error; + switch (data->type) { + case SNDRV_CTL_ELEM_TYPE_BOOLEAN: +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 738e1fe90312..62fbdbe74b93 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2208,6 +2208,8 @@ static struct snd_pci_quirk power_save_blacklist[] = { + SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ + SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), ++ /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ ++ SND_PCI_QUIRK(0x17aa, 0x36a7, "Lenovo C50 All in one", 0), + /* https://bugzilla.kernel.org/show_bug.cgi?id=198611 */ + SND_PCI_QUIRK(0x17aa, 0x2227, "Lenovo X1 Carbon 3rd Gen", 0), + {} +diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c +index 89efec891e68..4d950b7c2f97 100644 +--- a/sound/usb/mixer.c ++++ b/sound/usb/mixer.c +@@ -911,6 +911,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval, + } + break; + ++ case USB_ID(0x0d8c, 0x0103): ++ if (!strcmp(kctl->id.name, "PCM Playback Volume")) { ++ usb_audio_info(chip, ++ "set volume quirk for CM102-A+/102S+\n"); ++ cval->min = -256; ++ } ++ break; ++ + case USB_ID(0x0471, 0x0101): + case USB_ID(0x0471, 0x0104): + case USB_ID(0x0471, 0x0105): +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 0b457e8e0f0c..194759ec9e70 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -134,11 +134,15 @@ struct seccomp_data { + #endif + + #ifndef SECCOMP_FILTER_FLAG_TSYNC +-#define SECCOMP_FILTER_FLAG_TSYNC 1 ++#define SECCOMP_FILTER_FLAG_TSYNC (1UL << 0) + #endif + + #ifndef SECCOMP_FILTER_FLAG_LOG +-#define SECCOMP_FILTER_FLAG_LOG 2 ++#define SECCOMP_FILTER_FLAG_LOG (1UL << 1) ++#endif ++ ++#ifndef SECCOMP_FILTER_FLAG_SPEC_ALLOW ++#define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2) + #endif + + #ifndef seccomp +@@ -2063,14 +2067,26 @@ TEST(seccomp_syscall_mode_lock) + TEST(detect_seccomp_filter_flags) + { + unsigned int flags[] = { SECCOMP_FILTER_FLAG_TSYNC, +- SECCOMP_FILTER_FLAG_LOG }; ++ SECCOMP_FILTER_FLAG_LOG, ++ SECCOMP_FILTER_FLAG_SPEC_ALLOW }; + unsigned int flag, all_flags; + int i; + long ret; + + /* Test detection of known-good filter flags */ + for (i = 0, all_flags = 0; i < ARRAY_SIZE(flags); i++) { ++ int bits = 0; ++ + flag = flags[i]; ++ /* Make sure the flag is a single bit! */ ++ while (flag) { ++ if (flag & 0x1) ++ bits ++; ++ flag >>= 1; ++ } ++ ASSERT_EQ(1, bits); ++ flag = flags[i]; ++ + ret = seccomp(SECCOMP_SET_MODE_FILTER, flag, NULL); + ASSERT_NE(ENOSYS, errno) { + TH_LOG("Kernel does not support seccomp syscall!"); +diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c +index 5a11f4d3972c..d72b8481f250 100644 +--- a/virt/kvm/arm/vgic/vgic-its.c ++++ b/virt/kvm/arm/vgic/vgic-its.c +@@ -279,8 +279,8 @@ static int update_lpi_config(struct kvm *kvm, struct vgic_irq *irq, + u8 prop; + int ret; + +- ret = kvm_read_guest(kvm, propbase + irq->intid - GIC_LPI_OFFSET, +- &prop, 1); ++ ret = kvm_read_guest_lock(kvm, propbase + irq->intid - GIC_LPI_OFFSET, ++ &prop, 1); + + if (ret) + return ret; +@@ -413,8 +413,9 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu) + * this very same byte in the last iteration. Reuse that. + */ + if (byte_offset != last_byte_offset) { +- ret = kvm_read_guest(vcpu->kvm, pendbase + byte_offset, +- &pendmask, 1); ++ ret = kvm_read_guest_lock(vcpu->kvm, ++ pendbase + byte_offset, ++ &pendmask, 1); + if (ret) { + kfree(intids); + return ret; +@@ -740,7 +741,7 @@ static bool vgic_its_check_id(struct vgic_its *its, u64 baser, u32 id, + return false; + + /* Each 1st level entry is represented by a 64-bit value. */ +- if (kvm_read_guest(its->dev->kvm, ++ if (kvm_read_guest_lock(its->dev->kvm, + BASER_ADDRESS(baser) + index * sizeof(indirect_ptr), + &indirect_ptr, sizeof(indirect_ptr))) + return false; +@@ -1297,8 +1298,8 @@ static void vgic_its_process_commands(struct kvm *kvm, struct vgic_its *its) + cbaser = CBASER_ADDRESS(its->cbaser); + + while (its->cwriter != its->creadr) { +- int ret = kvm_read_guest(kvm, cbaser + its->creadr, +- cmd_buf, ITS_CMD_SIZE); ++ int ret = kvm_read_guest_lock(kvm, cbaser + its->creadr, ++ cmd_buf, ITS_CMD_SIZE); + /* + * If kvm_read_guest() fails, this could be due to the guest + * programming a bogus value in CBASER or something else going +@@ -1830,7 +1831,7 @@ static int scan_its_table(struct vgic_its *its, gpa_t base, int size, int esz, + int next_offset; + size_t byte_offset; + +- ret = kvm_read_guest(kvm, gpa, entry, esz); ++ ret = kvm_read_guest_lock(kvm, gpa, entry, esz); + if (ret) + return ret; + +@@ -2191,7 +2192,7 @@ static int vgic_its_restore_cte(struct vgic_its *its, gpa_t gpa, int esz) + int ret; + + BUG_ON(esz > sizeof(val)); +- ret = kvm_read_guest(kvm, gpa, &val, esz); ++ ret = kvm_read_guest_lock(kvm, gpa, &val, esz); + if (ret) + return ret; + val = le64_to_cpu(val); +diff --git a/virt/kvm/arm/vgic/vgic-v3.c b/virt/kvm/arm/vgic/vgic-v3.c +index 9dcc31600a8b..6b4fcd52f14c 100644 +--- a/virt/kvm/arm/vgic/vgic-v3.c ++++ b/virt/kvm/arm/vgic/vgic-v3.c +@@ -297,7 +297,7 @@ int vgic_v3_lpi_sync_pending_status(struct kvm *kvm, struct vgic_irq *irq) + bit_nr = irq->intid % BITS_PER_BYTE; + ptr = pendbase + byte_offset; + +- ret = kvm_read_guest(kvm, ptr, &val, 1); ++ ret = kvm_read_guest_lock(kvm, ptr, &val, 1); + if (ret) + return ret; + +@@ -350,7 +350,7 @@ int vgic_v3_save_pending_tables(struct kvm *kvm) + ptr = pendbase + byte_offset; + + if (byte_offset != last_byte_offset) { +- ret = kvm_read_guest(kvm, ptr, &val, 1); ++ ret = kvm_read_guest_lock(kvm, ptr, &val, 1); + if (ret) + return ret; + last_byte_offset = byte_offset; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.43-44.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.43-44.patch new file mode 100644 index 000000000000..ba683aaa01e4 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.43-44.patch @@ -0,0 +1,6489 @@ +diff --git a/Makefile b/Makefile +index 9be88c9d9fc9..787cf6605209 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 43 ++SUBLEVEL = 44 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/imx7d-sdb.dts b/arch/arm/boot/dts/imx7d-sdb.dts +index 44637cabcc56..255e64ba32e2 100644 +--- a/arch/arm/boot/dts/imx7d-sdb.dts ++++ b/arch/arm/boot/dts/imx7d-sdb.dts +@@ -82,7 +82,7 @@ + enable-active-high; + }; + +- reg_usb_otg2_vbus: regulator-usb-otg1-vbus { ++ reg_usb_otg2_vbus: regulator-usb-otg2-vbus { + compatible = "regulator-fixed"; + regulator-name = "usb_otg2_vbus"; + regulator-min-microvolt = <5000000>; +diff --git a/arch/s390/crypto/crc32be-vx.S b/arch/s390/crypto/crc32be-vx.S +index e8077f0971f8..2bf01ba44107 100644 +--- a/arch/s390/crypto/crc32be-vx.S ++++ b/arch/s390/crypto/crc32be-vx.S +@@ -13,6 +13,7 @@ + */ + + #include ++#include + #include + + /* Vector register range containing CRC-32 constants */ +@@ -67,6 +68,8 @@ + + .previous + ++ GEN_BR_THUNK %r14 ++ + .text + /* + * The CRC-32 function(s) use these calling conventions: +@@ -203,6 +206,6 @@ ENTRY(crc32_be_vgfm_16) + + .Ldone: + VLGVF %r2,%v2,3 +- br %r14 ++ BR_EX %r14 + + .previous +diff --git a/arch/s390/crypto/crc32le-vx.S b/arch/s390/crypto/crc32le-vx.S +index d8c67a58c0c5..7d6f568bd3ad 100644 +--- a/arch/s390/crypto/crc32le-vx.S ++++ b/arch/s390/crypto/crc32le-vx.S +@@ -14,6 +14,7 @@ + */ + + #include ++#include + #include + + /* Vector register range containing CRC-32 constants */ +@@ -76,6 +77,7 @@ + + .previous + ++ GEN_BR_THUNK %r14 + + .text + +@@ -264,6 +266,6 @@ crc32_le_vgfm_generic: + + .Ldone: + VLGVF %r2,%v2,2 +- br %r14 ++ BR_EX %r14 + + .previous +diff --git a/arch/s390/include/asm/alternative-asm.h b/arch/s390/include/asm/alternative-asm.h +new file mode 100644 +index 000000000000..955d620db23e +--- /dev/null ++++ b/arch/s390/include/asm/alternative-asm.h +@@ -0,0 +1,108 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_S390_ALTERNATIVE_ASM_H ++#define _ASM_S390_ALTERNATIVE_ASM_H ++ ++#ifdef __ASSEMBLY__ ++ ++/* ++ * Check the length of an instruction sequence. The length may not be larger ++ * than 254 bytes and it has to be divisible by 2. ++ */ ++.macro alt_len_check start,end ++ .if ( \end - \start ) > 254 ++ .error "cpu alternatives does not support instructions blocks > 254 bytes\n" ++ .endif ++ .if ( \end - \start ) % 2 ++ .error "cpu alternatives instructions length is odd\n" ++ .endif ++.endm ++ ++/* ++ * Issue one struct alt_instr descriptor entry (need to put it into ++ * the section .altinstructions, see below). This entry contains ++ * enough information for the alternatives patching code to patch an ++ * instruction. See apply_alternatives(). ++ */ ++.macro alt_entry orig_start, orig_end, alt_start, alt_end, feature ++ .long \orig_start - . ++ .long \alt_start - . ++ .word \feature ++ .byte \orig_end - \orig_start ++ .byte \alt_end - \alt_start ++.endm ++ ++/* ++ * Fill up @bytes with nops. The macro emits 6-byte nop instructions ++ * for the bulk of the area, possibly followed by a 4-byte and/or ++ * a 2-byte nop if the size of the area is not divisible by 6. ++ */ ++.macro alt_pad_fill bytes ++ .fill ( \bytes ) / 6, 6, 0xc0040000 ++ .fill ( \bytes ) % 6 / 4, 4, 0x47000000 ++ .fill ( \bytes ) % 6 % 4 / 2, 2, 0x0700 ++.endm ++ ++/* ++ * Fill up @bytes with nops. If the number of bytes is larger ++ * than 6, emit a jg instruction to branch over all nops, then ++ * fill an area of size (@bytes - 6) with nop instructions. ++ */ ++.macro alt_pad bytes ++ .if ( \bytes > 0 ) ++ .if ( \bytes > 6 ) ++ jg . + \bytes ++ alt_pad_fill \bytes - 6 ++ .else ++ alt_pad_fill \bytes ++ .endif ++ .endif ++.endm ++ ++/* ++ * Define an alternative between two instructions. If @feature is ++ * present, early code in apply_alternatives() replaces @oldinstr with ++ * @newinstr. ".skip" directive takes care of proper instruction padding ++ * in case @newinstr is longer than @oldinstr. ++ */ ++.macro ALTERNATIVE oldinstr, newinstr, feature ++ .pushsection .altinstr_replacement,"ax" ++770: \newinstr ++771: .popsection ++772: \oldinstr ++773: alt_len_check 770b, 771b ++ alt_len_check 772b, 773b ++ alt_pad ( ( 771b - 770b ) - ( 773b - 772b ) ) ++774: .pushsection .altinstructions,"a" ++ alt_entry 772b, 774b, 770b, 771b, \feature ++ .popsection ++.endm ++ ++/* ++ * Define an alternative between two instructions. If @feature is ++ * present, early code in apply_alternatives() replaces @oldinstr with ++ * @newinstr. ".skip" directive takes care of proper instruction padding ++ * in case @newinstr is longer than @oldinstr. ++ */ ++.macro ALTERNATIVE_2 oldinstr, newinstr1, feature1, newinstr2, feature2 ++ .pushsection .altinstr_replacement,"ax" ++770: \newinstr1 ++771: \newinstr2 ++772: .popsection ++773: \oldinstr ++774: alt_len_check 770b, 771b ++ alt_len_check 771b, 772b ++ alt_len_check 773b, 774b ++ .if ( 771b - 770b > 772b - 771b ) ++ alt_pad ( ( 771b - 770b ) - ( 774b - 773b ) ) ++ .else ++ alt_pad ( ( 772b - 771b ) - ( 774b - 773b ) ) ++ .endif ++775: .pushsection .altinstructions,"a" ++ alt_entry 773b, 775b, 770b, 771b,\feature1 ++ alt_entry 773b, 775b, 771b, 772b,\feature2 ++ .popsection ++.endm ++ ++#endif /* __ASSEMBLY__ */ ++ ++#endif /* _ASM_S390_ALTERNATIVE_ASM_H */ +diff --git a/arch/s390/include/asm/nospec-insn.h b/arch/s390/include/asm/nospec-insn.h +new file mode 100644 +index 000000000000..9a56e738d645 +--- /dev/null ++++ b/arch/s390/include/asm/nospec-insn.h +@@ -0,0 +1,195 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_S390_NOSPEC_ASM_H ++#define _ASM_S390_NOSPEC_ASM_H ++ ++#include ++#include ++ ++#ifdef __ASSEMBLY__ ++ ++#ifdef CONFIG_EXPOLINE ++ ++_LC_BR_R1 = __LC_BR_R1 ++ ++/* ++ * The expoline macros are used to create thunks in the same format ++ * as gcc generates them. The 'comdat' section flag makes sure that ++ * the various thunks are merged into a single copy. ++ */ ++ .macro __THUNK_PROLOG_NAME name ++ .pushsection .text.\name,"axG",@progbits,\name,comdat ++ .globl \name ++ .hidden \name ++ .type \name,@function ++\name: ++ .cfi_startproc ++ .endm ++ ++ .macro __THUNK_EPILOG ++ .cfi_endproc ++ .popsection ++ .endm ++ ++ .macro __THUNK_PROLOG_BR r1,r2 ++ __THUNK_PROLOG_NAME __s390x_indirect_jump_r\r2\()use_r\r1 ++ .endm ++ ++ .macro __THUNK_PROLOG_BC d0,r1,r2 ++ __THUNK_PROLOG_NAME __s390x_indirect_branch_\d0\()_\r2\()use_\r1 ++ .endm ++ ++ .macro __THUNK_BR r1,r2 ++ jg __s390x_indirect_jump_r\r2\()use_r\r1 ++ .endm ++ ++ .macro __THUNK_BC d0,r1,r2 ++ jg __s390x_indirect_branch_\d0\()_\r2\()use_\r1 ++ .endm ++ ++ .macro __THUNK_BRASL r1,r2,r3 ++ brasl \r1,__s390x_indirect_jump_r\r3\()use_r\r2 ++ .endm ++ ++ .macro __DECODE_RR expand,reg,ruse ++ .set __decode_fail,1 ++ .irp r1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \reg,%r\r1 ++ .irp r2,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \ruse,%r\r2 ++ \expand \r1,\r2 ++ .set __decode_fail,0 ++ .endif ++ .endr ++ .endif ++ .endr ++ .if __decode_fail == 1 ++ .error "__DECODE_RR failed" ++ .endif ++ .endm ++ ++ .macro __DECODE_RRR expand,rsave,rtarget,ruse ++ .set __decode_fail,1 ++ .irp r1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \rsave,%r\r1 ++ .irp r2,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \rtarget,%r\r2 ++ .irp r3,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \ruse,%r\r3 ++ \expand \r1,\r2,\r3 ++ .set __decode_fail,0 ++ .endif ++ .endr ++ .endif ++ .endr ++ .endif ++ .endr ++ .if __decode_fail == 1 ++ .error "__DECODE_RRR failed" ++ .endif ++ .endm ++ ++ .macro __DECODE_DRR expand,disp,reg,ruse ++ .set __decode_fail,1 ++ .irp r1,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \reg,%r\r1 ++ .irp r2,0,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15 ++ .ifc \ruse,%r\r2 ++ \expand \disp,\r1,\r2 ++ .set __decode_fail,0 ++ .endif ++ .endr ++ .endif ++ .endr ++ .if __decode_fail == 1 ++ .error "__DECODE_DRR failed" ++ .endif ++ .endm ++ ++ .macro __THUNK_EX_BR reg,ruse ++ # Be very careful when adding instructions to this macro! ++ # The ALTERNATIVE replacement code has a .+10 which targets ++ # the "br \reg" after the code has been patched. ++#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES ++ exrl 0,555f ++ j . ++#else ++ .ifc \reg,%r1 ++ ALTERNATIVE "ex %r0,_LC_BR_R1", ".insn ril,0xc60000000000,0,.+10", 35 ++ j . ++ .else ++ larl \ruse,555f ++ ex 0,0(\ruse) ++ j . ++ .endif ++#endif ++555: br \reg ++ .endm ++ ++ .macro __THUNK_EX_BC disp,reg,ruse ++#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES ++ exrl 0,556f ++ j . ++#else ++ larl \ruse,556f ++ ex 0,0(\ruse) ++ j . ++#endif ++556: b \disp(\reg) ++ .endm ++ ++ .macro GEN_BR_THUNK reg,ruse=%r1 ++ __DECODE_RR __THUNK_PROLOG_BR,\reg,\ruse ++ __THUNK_EX_BR \reg,\ruse ++ __THUNK_EPILOG ++ .endm ++ ++ .macro GEN_B_THUNK disp,reg,ruse=%r1 ++ __DECODE_DRR __THUNK_PROLOG_BC,\disp,\reg,\ruse ++ __THUNK_EX_BC \disp,\reg,\ruse ++ __THUNK_EPILOG ++ .endm ++ ++ .macro BR_EX reg,ruse=%r1 ++557: __DECODE_RR __THUNK_BR,\reg,\ruse ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 557b-. ++ .popsection ++ .endm ++ ++ .macro B_EX disp,reg,ruse=%r1 ++558: __DECODE_DRR __THUNK_BC,\disp,\reg,\ruse ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 558b-. ++ .popsection ++ .endm ++ ++ .macro BASR_EX rsave,rtarget,ruse=%r1 ++559: __DECODE_RRR __THUNK_BRASL,\rsave,\rtarget,\ruse ++ .pushsection .s390_indirect_branches,"a",@progbits ++ .long 559b-. ++ .popsection ++ .endm ++ ++#else ++ .macro GEN_BR_THUNK reg,ruse=%r1 ++ .endm ++ ++ .macro GEN_B_THUNK disp,reg,ruse=%r1 ++ .endm ++ ++ .macro BR_EX reg,ruse=%r1 ++ br \reg ++ .endm ++ ++ .macro B_EX disp,reg,ruse=%r1 ++ b \disp(\reg) ++ .endm ++ ++ .macro BASR_EX rsave,rtarget,ruse=%r1 ++ basr \rsave,\rtarget ++ .endm ++#endif ++ ++#endif /* __ASSEMBLY__ */ ++ ++#endif /* _ASM_S390_NOSPEC_ASM_H */ +diff --git a/arch/s390/kernel/Makefile b/arch/s390/kernel/Makefile +index a3a4cafb6080..e0784fff07f5 100644 +--- a/arch/s390/kernel/Makefile ++++ b/arch/s390/kernel/Makefile +@@ -63,6 +63,7 @@ obj-y += nospec-branch.o + + extra-y += head.o head64.o vmlinux.lds + ++obj-$(CONFIG_SYSFS) += nospec-sysfs.o + CFLAGS_REMOVE_nospec-branch.o += $(CC_FLAGS_EXPOLINE) + + obj-$(CONFIG_MODULES) += module.o +diff --git a/arch/s390/kernel/asm-offsets.c b/arch/s390/kernel/asm-offsets.c +index 0e6d2b032484..4e69bf909e87 100644 +--- a/arch/s390/kernel/asm-offsets.c ++++ b/arch/s390/kernel/asm-offsets.c +@@ -177,6 +177,7 @@ int main(void) + OFFSET(__LC_PREEMPT_COUNT, lowcore, preempt_count); + OFFSET(__LC_GMAP, lowcore, gmap); + OFFSET(__LC_PASTE, lowcore, paste); ++ OFFSET(__LC_BR_R1, lowcore, br_r1_trampoline); + /* software defined ABI-relevant lowcore locations 0xe00 - 0xe20 */ + OFFSET(__LC_DUMP_REIPL, lowcore, ipib); + /* hardware defined lowcore locations 0x1000 - 0x18ff */ +diff --git a/arch/s390/kernel/base.S b/arch/s390/kernel/base.S +index f6c56009e822..b65874b0b412 100644 +--- a/arch/s390/kernel/base.S ++++ b/arch/s390/kernel/base.S +@@ -9,18 +9,22 @@ + + #include + #include ++#include + #include + #include + ++ GEN_BR_THUNK %r9 ++ GEN_BR_THUNK %r14 ++ + ENTRY(s390_base_mcck_handler) + basr %r13,0 + 0: lg %r15,__LC_PANIC_STACK # load panic stack + aghi %r15,-STACK_FRAME_OVERHEAD + larl %r1,s390_base_mcck_handler_fn +- lg %r1,0(%r1) +- ltgr %r1,%r1 ++ lg %r9,0(%r1) ++ ltgr %r9,%r9 + jz 1f +- basr %r14,%r1 ++ BASR_EX %r14,%r9 + 1: la %r1,4095 + lmg %r0,%r15,__LC_GPREGS_SAVE_AREA-4095(%r1) + lpswe __LC_MCK_OLD_PSW +@@ -37,10 +41,10 @@ ENTRY(s390_base_ext_handler) + basr %r13,0 + 0: aghi %r15,-STACK_FRAME_OVERHEAD + larl %r1,s390_base_ext_handler_fn +- lg %r1,0(%r1) +- ltgr %r1,%r1 ++ lg %r9,0(%r1) ++ ltgr %r9,%r9 + jz 1f +- basr %r14,%r1 ++ BASR_EX %r14,%r9 + 1: lmg %r0,%r15,__LC_SAVE_AREA_ASYNC + ni __LC_EXT_OLD_PSW+1,0xfd # clear wait state bit + lpswe __LC_EXT_OLD_PSW +@@ -57,10 +61,10 @@ ENTRY(s390_base_pgm_handler) + basr %r13,0 + 0: aghi %r15,-STACK_FRAME_OVERHEAD + larl %r1,s390_base_pgm_handler_fn +- lg %r1,0(%r1) +- ltgr %r1,%r1 ++ lg %r9,0(%r1) ++ ltgr %r9,%r9 + jz 1f +- basr %r14,%r1 ++ BASR_EX %r14,%r9 + lmg %r0,%r15,__LC_SAVE_AREA_SYNC + lpswe __LC_PGM_OLD_PSW + 1: lpswe disabled_wait_psw-0b(%r13) +@@ -117,7 +121,7 @@ ENTRY(diag308_reset) + larl %r4,.Lcontinue_psw # Restore PSW flags + lpswe 0(%r4) + .Lcontinue: +- br %r14 ++ BR_EX %r14 + .align 16 + .Lrestart_psw: + .long 0x00080000,0x80000000 + .Lrestart_part2 +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index ed9aaa212d4a..be20b1f73384 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + __PT_R0 = __PT_GPRS + __PT_R1 = __PT_GPRS + 8 +@@ -221,67 +222,9 @@ _PIF_WORK = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART) + .popsection + .endm + +-#ifdef CONFIG_EXPOLINE +- +- .macro GEN_BR_THUNK name,reg,tmp +- .section .text.\name,"axG",@progbits,\name,comdat +- .globl \name +- .hidden \name +- .type \name,@function +-\name: +- .cfi_startproc +-#ifdef CONFIG_HAVE_MARCH_Z10_FEATURES +- exrl 0,0f +-#else +- larl \tmp,0f +- ex 0,0(\tmp) +-#endif +- j . +-0: br \reg +- .cfi_endproc +- .endm +- +- GEN_BR_THUNK __s390x_indirect_jump_r1use_r9,%r9,%r1 +- GEN_BR_THUNK __s390x_indirect_jump_r1use_r14,%r14,%r1 +- GEN_BR_THUNK __s390x_indirect_jump_r11use_r14,%r14,%r11 +- +- .macro BASR_R14_R9 +-0: brasl %r14,__s390x_indirect_jump_r1use_r9 +- .pushsection .s390_indirect_branches,"a",@progbits +- .long 0b-. +- .popsection +- .endm +- +- .macro BR_R1USE_R14 +-0: jg __s390x_indirect_jump_r1use_r14 +- .pushsection .s390_indirect_branches,"a",@progbits +- .long 0b-. +- .popsection +- .endm +- +- .macro BR_R11USE_R14 +-0: jg __s390x_indirect_jump_r11use_r14 +- .pushsection .s390_indirect_branches,"a",@progbits +- .long 0b-. +- .popsection +- .endm +- +-#else /* CONFIG_EXPOLINE */ +- +- .macro BASR_R14_R9 +- basr %r14,%r9 +- .endm +- +- .macro BR_R1USE_R14 +- br %r14 +- .endm +- +- .macro BR_R11USE_R14 +- br %r14 +- .endm +- +-#endif /* CONFIG_EXPOLINE */ +- ++ GEN_BR_THUNK %r9 ++ GEN_BR_THUNK %r14 ++ GEN_BR_THUNK %r14,%r11 + + .section .kprobes.text, "ax" + .Ldummy: +@@ -298,7 +241,7 @@ _PIF_WORK = (_PIF_PER_TRAP | _PIF_SYSCALL_RESTART) + ENTRY(__bpon) + .globl __bpon + BPON +- BR_R1USE_R14 ++ BR_EX %r14 + + /* + * Scheduler resume function, called by switch_to +@@ -325,7 +268,7 @@ ENTRY(__switch_to) + TSTMSK __LC_MACHINE_FLAGS,MACHINE_FLAG_LPP + jz 0f + .insn s,0xb2800000,__LC_LPP # set program parameter +-0: BR_R1USE_R14 ++0: BR_EX %r14 + + .L__critical_start: + +@@ -392,7 +335,7 @@ sie_exit: + xgr %r5,%r5 + lmg %r6,%r14,__SF_GPRS(%r15) # restore kernel registers + lg %r2,__SF_EMPTY+16(%r15) # return exit reason code +- BR_R1USE_R14 ++ BR_EX %r14 + .Lsie_fault: + lghi %r14,-EFAULT + stg %r14,__SF_EMPTY+16(%r15) # set exit reason code +@@ -451,7 +394,7 @@ ENTRY(system_call) + lgf %r9,0(%r8,%r10) # get system call add. + TSTMSK __TI_flags(%r12),_TIF_TRACE + jnz .Lsysc_tracesys +- BASR_R14_R9 # call sys_xxxx ++ BASR_EX %r14,%r9 # call sys_xxxx + stg %r2,__PT_R2(%r11) # store return value + + .Lsysc_return: +@@ -628,7 +571,7 @@ ENTRY(system_call) + lmg %r3,%r7,__PT_R3(%r11) + stg %r7,STACK_FRAME_OVERHEAD(%r15) + lg %r2,__PT_ORIG_GPR2(%r11) +- BASR_R14_R9 # call sys_xxx ++ BASR_EX %r14,%r9 # call sys_xxx + stg %r2,__PT_R2(%r11) # store return value + .Lsysc_tracenogo: + TSTMSK __TI_flags(%r12),_TIF_TRACE +@@ -652,7 +595,7 @@ ENTRY(ret_from_fork) + lmg %r9,%r10,__PT_R9(%r11) # load gprs + ENTRY(kernel_thread_starter) + la %r2,0(%r10) +- BASR_R14_R9 ++ BASR_EX %r14,%r9 + j .Lsysc_tracenogo + + /* +@@ -731,7 +674,7 @@ ENTRY(pgm_check_handler) + je .Lpgm_return + lgf %r9,0(%r10,%r1) # load address of handler routine + lgr %r2,%r11 # pass pointer to pt_regs +- BASR_R14_R9 # branch to interrupt-handler ++ BASR_EX %r14,%r9 # branch to interrupt-handler + .Lpgm_return: + LOCKDEP_SYS_EXIT + tm __PT_PSW+1(%r11),0x01 # returning to user ? +@@ -1041,7 +984,7 @@ ENTRY(psw_idle) + stpt __TIMER_IDLE_ENTER(%r2) + .Lpsw_idle_lpsw: + lpswe __SF_EMPTY(%r15) +- BR_R1USE_R14 ++ BR_EX %r14 + .Lpsw_idle_end: + + /* +@@ -1083,7 +1026,7 @@ ENTRY(save_fpu_regs) + .Lsave_fpu_regs_done: + oi __LC_CPU_FLAGS+7,_CIF_FPU + .Lsave_fpu_regs_exit: +- BR_R1USE_R14 ++ BR_EX %r14 + .Lsave_fpu_regs_end: + EXPORT_SYMBOL(save_fpu_regs) + +@@ -1129,7 +1072,7 @@ load_fpu_regs: + .Lload_fpu_regs_done: + ni __LC_CPU_FLAGS+7,255-_CIF_FPU + .Lload_fpu_regs_exit: +- BR_R1USE_R14 ++ BR_EX %r14 + .Lload_fpu_regs_end: + + .L__critical_end: +@@ -1301,7 +1244,7 @@ cleanup_critical: + jl 0f + clg %r9,BASED(.Lcleanup_table+104) # .Lload_fpu_regs_end + jl .Lcleanup_load_fpu_regs +-0: BR_R11USE_R14 ++0: BR_EX %r14 + + .align 8 + .Lcleanup_table: +@@ -1337,7 +1280,7 @@ cleanup_critical: + ni __SIE_PROG0C+3(%r9),0xfe # no longer in SIE + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce + larl %r9,sie_exit # skip forward to sie_exit +- BR_R11USE_R14 ++ BR_EX %r14 + #endif + + .Lcleanup_system_call: +@@ -1391,7 +1334,7 @@ cleanup_critical: + stg %r15,56(%r11) # r15 stack pointer + # set new psw address and exit + larl %r9,.Lsysc_do_svc +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + .Lcleanup_system_call_insn: + .quad system_call + .quad .Lsysc_stmg +@@ -1403,7 +1346,7 @@ cleanup_critical: + + .Lcleanup_sysc_tif: + larl %r9,.Lsysc_tif +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + + .Lcleanup_sysc_restore: + # check if stpt has been executed +@@ -1420,14 +1363,14 @@ cleanup_critical: + mvc 0(64,%r11),__PT_R8(%r9) + lmg %r0,%r7,__PT_R0(%r9) + 1: lmg %r8,%r9,__LC_RETURN_PSW +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + .Lcleanup_sysc_restore_insn: + .quad .Lsysc_exit_timer + .quad .Lsysc_done - 4 + + .Lcleanup_io_tif: + larl %r9,.Lio_tif +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + + .Lcleanup_io_restore: + # check if stpt has been executed +@@ -1441,7 +1384,7 @@ cleanup_critical: + mvc 0(64,%r11),__PT_R8(%r9) + lmg %r0,%r7,__PT_R0(%r9) + 1: lmg %r8,%r9,__LC_RETURN_PSW +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + .Lcleanup_io_restore_insn: + .quad .Lio_exit_timer + .quad .Lio_done - 4 +@@ -1494,17 +1437,17 @@ cleanup_critical: + # prepare return psw + nihh %r8,0xfcfd # clear irq & wait state bits + lg %r9,48(%r11) # return from psw_idle +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + .Lcleanup_idle_insn: + .quad .Lpsw_idle_lpsw + + .Lcleanup_save_fpu_regs: + larl %r9,save_fpu_regs +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + + .Lcleanup_load_fpu_regs: + larl %r9,load_fpu_regs +- BR_R11USE_R14 ++ BR_EX %r14,%r11 + + /* + * Integer constants +diff --git a/arch/s390/kernel/mcount.S b/arch/s390/kernel/mcount.S +index 82df7d80fab2..27110f3294ed 100644 +--- a/arch/s390/kernel/mcount.S ++++ b/arch/s390/kernel/mcount.S +@@ -9,13 +9,17 @@ + #include + #include + #include ++#include + #include + #include + ++ GEN_BR_THUNK %r1 ++ GEN_BR_THUNK %r14 ++ + .section .kprobes.text, "ax" + + ENTRY(ftrace_stub) +- br %r14 ++ BR_EX %r14 + + #define STACK_FRAME_SIZE (STACK_FRAME_OVERHEAD + __PT_SIZE) + #define STACK_PTREGS (STACK_FRAME_OVERHEAD) +@@ -23,7 +27,7 @@ ENTRY(ftrace_stub) + #define STACK_PTREGS_PSW (STACK_PTREGS + __PT_PSW) + + ENTRY(_mcount) +- br %r14 ++ BR_EX %r14 + + EXPORT_SYMBOL(_mcount) + +@@ -53,7 +57,7 @@ ENTRY(ftrace_caller) + #endif + lgr %r3,%r14 + la %r5,STACK_PTREGS(%r15) +- basr %r14,%r1 ++ BASR_EX %r14,%r1 + #ifdef CONFIG_FUNCTION_GRAPH_TRACER + # The j instruction gets runtime patched to a nop instruction. + # See ftrace_enable_ftrace_graph_caller. +@@ -68,7 +72,7 @@ ftrace_graph_caller_end: + #endif + lg %r1,(STACK_PTREGS_PSW+8)(%r15) + lmg %r2,%r15,(STACK_PTREGS_GPRS+2*8)(%r15) +- br %r1 ++ BR_EX %r1 + + #ifdef CONFIG_FUNCTION_GRAPH_TRACER + +@@ -81,6 +85,6 @@ ENTRY(return_to_handler) + aghi %r15,STACK_FRAME_OVERHEAD + lgr %r14,%r2 + lmg %r2,%r5,32(%r15) +- br %r14 ++ BR_EX %r14 + + #endif +diff --git a/arch/s390/kernel/nospec-branch.c b/arch/s390/kernel/nospec-branch.c +index 9f3b5b382743..d5eed651b5ab 100644 +--- a/arch/s390/kernel/nospec-branch.c ++++ b/arch/s390/kernel/nospec-branch.c +@@ -44,24 +44,6 @@ static int __init nospec_report(void) + } + arch_initcall(nospec_report); + +-#ifdef CONFIG_SYSFS +-ssize_t cpu_show_spectre_v1(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- return sprintf(buf, "Mitigation: __user pointer sanitization\n"); +-} +- +-ssize_t cpu_show_spectre_v2(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) +- return sprintf(buf, "Mitigation: execute trampolines\n"); +- if (__test_facility(82, S390_lowcore.alt_stfle_fac_list)) +- return sprintf(buf, "Mitigation: limited branch prediction.\n"); +- return sprintf(buf, "Vulnerable\n"); +-} +-#endif +- + #ifdef CONFIG_EXPOLINE + + int nospec_disable = IS_ENABLED(CONFIG_EXPOLINE_OFF); +@@ -112,7 +94,6 @@ static void __init_or_module __nospec_revert(s32 *start, s32 *end) + s32 *epo; + + /* Second part of the instruction replace is always a nop */ +- memcpy(insnbuf + 2, (char[]) { 0x47, 0x00, 0x00, 0x00 }, 4); + for (epo = start; epo < end; epo++) { + instr = (u8 *) epo + *epo; + if (instr[0] == 0xc0 && (instr[1] & 0x0f) == 0x04) +@@ -133,18 +114,34 @@ static void __init_or_module __nospec_revert(s32 *start, s32 *end) + br = thunk + (*(int *)(thunk + 2)) * 2; + else + continue; +- if (br[0] != 0x07 || (br[1] & 0xf0) != 0xf0) ++ /* Check for unconditional branch 0x07f? or 0x47f???? */ ++ if ((br[0] & 0xbf) != 0x07 || (br[1] & 0xf0) != 0xf0) + continue; ++ ++ memcpy(insnbuf + 2, (char[]) { 0x47, 0x00, 0x07, 0x00 }, 4); + switch (type) { + case BRCL_EXPOLINE: +- /* brcl to thunk, replace with br + nop */ + insnbuf[0] = br[0]; + insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f); ++ if (br[0] == 0x47) { ++ /* brcl to b, replace with bc + nopr */ ++ insnbuf[2] = br[2]; ++ insnbuf[3] = br[3]; ++ } else { ++ /* brcl to br, replace with bcr + nop */ ++ } + break; + case BRASL_EXPOLINE: +- /* brasl to thunk, replace with basr + nop */ +- insnbuf[0] = 0x0d; + insnbuf[1] = (instr[1] & 0xf0) | (br[1] & 0x0f); ++ if (br[0] == 0x47) { ++ /* brasl to b, replace with bas + nopr */ ++ insnbuf[0] = 0x4d; ++ insnbuf[2] = br[2]; ++ insnbuf[3] = br[3]; ++ } else { ++ /* brasl to br, replace with basr + nop */ ++ insnbuf[0] = 0x0d; ++ } + break; + } + +diff --git a/arch/s390/kernel/nospec-sysfs.c b/arch/s390/kernel/nospec-sysfs.c +new file mode 100644 +index 000000000000..8affad5f18cb +--- /dev/null ++++ b/arch/s390/kernel/nospec-sysfs.c +@@ -0,0 +1,21 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include ++#include ++#include ++#include ++ ++ssize_t cpu_show_spectre_v1(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); ++} ++ ++ssize_t cpu_show_spectre_v2(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) ++ return sprintf(buf, "Mitigation: execute trampolines\n"); ++ if (__test_facility(82, S390_lowcore.alt_stfle_fac_list)) ++ return sprintf(buf, "Mitigation: limited branch prediction\n"); ++ return sprintf(buf, "Vulnerable\n"); ++} +diff --git a/arch/s390/kernel/reipl.S b/arch/s390/kernel/reipl.S +index a40ebd1d29d0..8e954c102639 100644 +--- a/arch/s390/kernel/reipl.S ++++ b/arch/s390/kernel/reipl.S +@@ -7,8 +7,11 @@ + + #include + #include ++#include + #include + ++ GEN_BR_THUNK %r9 ++ + # + # Issue "store status" for the current CPU to its prefix page + # and call passed function afterwards +@@ -67,9 +70,9 @@ ENTRY(store_status) + st %r4,0(%r1) + st %r5,4(%r1) + stg %r2,8(%r1) +- lgr %r1,%r2 ++ lgr %r9,%r2 + lgr %r2,%r3 +- br %r1 ++ BR_EX %r9 + + .section .bss + .align 8 +diff --git a/arch/s390/kernel/swsusp.S b/arch/s390/kernel/swsusp.S +index e99187149f17..a049a7b9d6e8 100644 +--- a/arch/s390/kernel/swsusp.S ++++ b/arch/s390/kernel/swsusp.S +@@ -13,6 +13,7 @@ + #include + #include + #include ++#include + #include + + /* +@@ -24,6 +25,8 @@ + * (see below) in the resume process. + * This function runs with disabled interrupts. + */ ++ GEN_BR_THUNK %r14 ++ + .section .text + ENTRY(swsusp_arch_suspend) + stmg %r6,%r15,__SF_GPRS(%r15) +@@ -103,7 +106,7 @@ ENTRY(swsusp_arch_suspend) + spx 0x318(%r1) + lmg %r6,%r15,STACK_FRAME_OVERHEAD + __SF_GPRS(%r15) + lghi %r2,0 +- br %r14 ++ BR_EX %r14 + + /* + * Restore saved memory image to correct place and restore register context. +@@ -197,11 +200,10 @@ pgm_check_entry: + larl %r15,init_thread_union + ahi %r15,1<<(PAGE_SHIFT+THREAD_SIZE_ORDER) + larl %r2,.Lpanic_string +- larl %r3,sclp_early_printk + lghi %r1,0 + sam31 + sigp %r1,%r0,SIGP_SET_ARCHITECTURE +- basr %r14,%r3 ++ brasl %r14,sclp_early_printk + larl %r3,.Ldisabled_wait_31 + lpsw 0(%r3) + 4: +@@ -267,7 +269,7 @@ restore_registers: + /* Return 0 */ + lmg %r6,%r15,STACK_FRAME_OVERHEAD + __SF_GPRS(%r15) + lghi %r2,0 +- br %r14 ++ BR_EX %r14 + + .section .data..nosave,"aw",@progbits + .align 8 +diff --git a/arch/s390/lib/mem.S b/arch/s390/lib/mem.S +index d66751397e72..e1fa974ac500 100644 +--- a/arch/s390/lib/mem.S ++++ b/arch/s390/lib/mem.S +@@ -7,6 +7,9 @@ + + #include + #include ++#include ++ ++ GEN_BR_THUNK %r14 + + /* + * void *memmove(void *dest, const void *src, size_t n) +@@ -33,14 +36,14 @@ ENTRY(memmove) + .Lmemmove_forward_remainder: + larl %r5,.Lmemmove_mvc + ex %r4,0(%r5) +- br %r14 ++ BR_EX %r14 + .Lmemmove_reverse: + ic %r0,0(%r4,%r3) + stc %r0,0(%r4,%r1) + brctg %r4,.Lmemmove_reverse + ic %r0,0(%r4,%r3) + stc %r0,0(%r4,%r1) +- br %r14 ++ BR_EX %r14 + .Lmemmove_mvc: + mvc 0(1,%r1),0(%r3) + EXPORT_SYMBOL(memmove) +@@ -77,7 +80,7 @@ ENTRY(memset) + .Lmemset_clear_remainder: + larl %r3,.Lmemset_xc + ex %r4,0(%r3) +- br %r14 ++ BR_EX %r14 + .Lmemset_fill: + stc %r3,0(%r2) + cghi %r4,1 +@@ -94,7 +97,7 @@ ENTRY(memset) + .Lmemset_fill_remainder: + larl %r3,.Lmemset_mvc + ex %r4,0(%r3) +- br %r14 ++ BR_EX %r14 + .Lmemset_xc: + xc 0(1,%r1),0(%r1) + .Lmemset_mvc: +@@ -117,7 +120,7 @@ ENTRY(memcpy) + .Lmemcpy_remainder: + larl %r5,.Lmemcpy_mvc + ex %r4,0(%r5) +- br %r14 ++ BR_EX %r14 + .Lmemcpy_loop: + mvc 0(256,%r1),0(%r3) + la %r1,256(%r1) +diff --git a/arch/s390/net/bpf_jit.S b/arch/s390/net/bpf_jit.S +index 25bb4643c4f4..9f794869c1b0 100644 +--- a/arch/s390/net/bpf_jit.S ++++ b/arch/s390/net/bpf_jit.S +@@ -9,6 +9,7 @@ + */ + + #include ++#include + #include "bpf_jit.h" + + /* +@@ -54,7 +55,7 @@ ENTRY(sk_load_##NAME##_pos); \ + clg %r3,STK_OFF_HLEN(%r15); /* Offset + SIZE > hlen? */ \ + jh sk_load_##NAME##_slow; \ + LOAD %r14,-SIZE(%r3,%r12); /* Get data from skb */ \ +- b OFF_OK(%r6); /* Return */ \ ++ B_EX OFF_OK,%r6; /* Return */ \ + \ + sk_load_##NAME##_slow:; \ + lgr %r2,%r7; /* Arg1 = skb pointer */ \ +@@ -64,11 +65,14 @@ sk_load_##NAME##_slow:; \ + brasl %r14,skb_copy_bits; /* Get data from skb */ \ + LOAD %r14,STK_OFF_TMP(%r15); /* Load from temp bufffer */ \ + ltgr %r2,%r2; /* Set cc to (%r2 != 0) */ \ +- br %r6; /* Return */ ++ BR_EX %r6; /* Return */ + + sk_load_common(word, 4, llgf) /* r14 = *(u32 *) (skb->data+offset) */ + sk_load_common(half, 2, llgh) /* r14 = *(u16 *) (skb->data+offset) */ + ++ GEN_BR_THUNK %r6 ++ GEN_B_THUNK OFF_OK,%r6 ++ + /* + * Load 1 byte from SKB (optimized version) + */ +@@ -80,7 +84,7 @@ ENTRY(sk_load_byte_pos) + clg %r3,STK_OFF_HLEN(%r15) # Offset >= hlen? + jnl sk_load_byte_slow + llgc %r14,0(%r3,%r12) # Get byte from skb +- b OFF_OK(%r6) # Return OK ++ B_EX OFF_OK,%r6 # Return OK + + sk_load_byte_slow: + lgr %r2,%r7 # Arg1 = skb pointer +@@ -90,7 +94,7 @@ sk_load_byte_slow: + brasl %r14,skb_copy_bits # Get data from skb + llgc %r14,STK_OFF_TMP(%r15) # Load result from temp buffer + ltgr %r2,%r2 # Set cc to (%r2 != 0) +- br %r6 # Return cc ++ BR_EX %r6 # Return cc + + #define sk_negative_common(NAME, SIZE, LOAD) \ + sk_load_##NAME##_slow_neg:; \ +@@ -104,7 +108,7 @@ sk_load_##NAME##_slow_neg:; \ + jz bpf_error; \ + LOAD %r14,0(%r2); /* Get data from pointer */ \ + xr %r3,%r3; /* Set cc to zero */ \ +- br %r6; /* Return cc */ ++ BR_EX %r6; /* Return cc */ + + sk_negative_common(word, 4, llgf) + sk_negative_common(half, 2, llgh) +@@ -113,4 +117,4 @@ sk_negative_common(byte, 1, llgc) + bpf_error: + # force a return 0 from jit handler + ltgr %r15,%r15 # Set condition code +- br %r6 ++ BR_EX %r6 +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 33e2785f6842..11cd151733d4 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -25,6 +25,8 @@ + #include + #include + #include ++#include ++#include + #include + #include "bpf_jit.h" + +@@ -43,6 +45,8 @@ struct bpf_jit { + int base_ip; /* Base address for literal pool */ + int ret0_ip; /* Address of return 0 */ + int exit_ip; /* Address of exit */ ++ int r1_thunk_ip; /* Address of expoline thunk for 'br %r1' */ ++ int r14_thunk_ip; /* Address of expoline thunk for 'br %r14' */ + int tail_call_start; /* Tail call start offset */ + int labels[1]; /* Labels for local jumps */ + }; +@@ -252,6 +256,19 @@ static inline void reg_set_seen(struct bpf_jit *jit, u32 b1) + REG_SET_SEEN(b2); \ + }) + ++#define EMIT6_PCREL_RILB(op, b, target) \ ++({ \ ++ int rel = (target - jit->prg) / 2; \ ++ _EMIT6(op | reg_high(b) << 16 | rel >> 16, rel & 0xffff); \ ++ REG_SET_SEEN(b); \ ++}) ++ ++#define EMIT6_PCREL_RIL(op, target) \ ++({ \ ++ int rel = (target - jit->prg) / 2; \ ++ _EMIT6(op | rel >> 16, rel & 0xffff); \ ++}) ++ + #define _EMIT6_IMM(op, imm) \ + ({ \ + unsigned int __imm = (imm); \ +@@ -471,8 +488,45 @@ static void bpf_jit_epilogue(struct bpf_jit *jit) + EMIT4(0xb9040000, REG_2, BPF_REG_0); + /* Restore registers */ + save_restore_regs(jit, REGS_RESTORE); ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) { ++ jit->r14_thunk_ip = jit->prg; ++ /* Generate __s390_indirect_jump_r14 thunk */ ++ if (test_facility(35)) { ++ /* exrl %r0,.+10 */ ++ EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10); ++ } else { ++ /* larl %r1,.+14 */ ++ EMIT6_PCREL_RILB(0xc0000000, REG_1, jit->prg + 14); ++ /* ex 0,0(%r1) */ ++ EMIT4_DISP(0x44000000, REG_0, REG_1, 0); ++ } ++ /* j . */ ++ EMIT4_PCREL(0xa7f40000, 0); ++ } + /* br %r14 */ + _EMIT2(0x07fe); ++ ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable && ++ (jit->seen & SEEN_FUNC)) { ++ jit->r1_thunk_ip = jit->prg; ++ /* Generate __s390_indirect_jump_r1 thunk */ ++ if (test_facility(35)) { ++ /* exrl %r0,.+10 */ ++ EMIT6_PCREL_RIL(0xc6000000, jit->prg + 10); ++ /* j . */ ++ EMIT4_PCREL(0xa7f40000, 0); ++ /* br %r1 */ ++ _EMIT2(0x07f1); ++ } else { ++ /* larl %r1,.+14 */ ++ EMIT6_PCREL_RILB(0xc0000000, REG_1, jit->prg + 14); ++ /* ex 0,S390_lowcore.br_r1_tampoline */ ++ EMIT4_DISP(0x44000000, REG_0, REG_0, ++ offsetof(struct lowcore, br_r1_trampoline)); ++ /* j . */ ++ EMIT4_PCREL(0xa7f40000, 0); ++ } ++ } + } + + /* +@@ -978,8 +1032,13 @@ static noinline int bpf_jit_insn(struct bpf_jit *jit, struct bpf_prog *fp, int i + /* lg %w1,(%l) */ + EMIT6_DISP_LH(0xe3000000, 0x0004, REG_W1, REG_0, REG_L, + EMIT_CONST_U64(func)); +- /* basr %r14,%w1 */ +- EMIT2(0x0d00, REG_14, REG_W1); ++ if (IS_ENABLED(CC_USING_EXPOLINE) && !nospec_disable) { ++ /* brasl %r14,__s390_indirect_jump_r1 */ ++ EMIT6_PCREL_RILB(0xc0050000, REG_14, jit->r1_thunk_ip); ++ } else { ++ /* basr %r14,%w1 */ ++ EMIT2(0x0d00, REG_14, REG_W1); ++ } + /* lgr %b0,%r2: load return value into %b0 */ + EMIT4(0xb9040000, BPF_REG_0, REG_2); + if ((jit->seen & SEEN_SKB) && +diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c +index 1a0fa10cb6b7..32bae68e34c1 100644 +--- a/arch/sparc/kernel/vio.c ++++ b/arch/sparc/kernel/vio.c +@@ -403,7 +403,7 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp, + if (err) { + printk(KERN_ERR "VIO: Could not register device %s, err=%d\n", + dev_name(&vdev->dev), err); +- kfree(vdev); ++ put_device(&vdev->dev); + return NULL; + } + if (vdev->dp) +diff --git a/arch/x86/kernel/machine_kexec_32.c b/arch/x86/kernel/machine_kexec_32.c +index edfede768688..5167f3f74136 100644 +--- a/arch/x86/kernel/machine_kexec_32.c ++++ b/arch/x86/kernel/machine_kexec_32.c +@@ -57,12 +57,17 @@ static void load_segments(void) + static void machine_kexec_free_page_tables(struct kimage *image) + { + free_page((unsigned long)image->arch.pgd); ++ image->arch.pgd = NULL; + #ifdef CONFIG_X86_PAE + free_page((unsigned long)image->arch.pmd0); ++ image->arch.pmd0 = NULL; + free_page((unsigned long)image->arch.pmd1); ++ image->arch.pmd1 = NULL; + #endif + free_page((unsigned long)image->arch.pte0); ++ image->arch.pte0 = NULL; + free_page((unsigned long)image->arch.pte1); ++ image->arch.pte1 = NULL; + } + + static int machine_kexec_alloc_page_tables(struct kimage *image) +@@ -79,7 +84,6 @@ static int machine_kexec_alloc_page_tables(struct kimage *image) + !image->arch.pmd0 || !image->arch.pmd1 || + #endif + !image->arch.pte0 || !image->arch.pte1) { +- machine_kexec_free_page_tables(image); + return -ENOMEM; + } + return 0; +diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c +index 3b7427aa7d85..5bce2a88e8a3 100644 +--- a/arch/x86/kernel/machine_kexec_64.c ++++ b/arch/x86/kernel/machine_kexec_64.c +@@ -38,9 +38,13 @@ static struct kexec_file_ops *kexec_file_loaders[] = { + static void free_transition_pgtable(struct kimage *image) + { + free_page((unsigned long)image->arch.p4d); ++ image->arch.p4d = NULL; + free_page((unsigned long)image->arch.pud); ++ image->arch.pud = NULL; + free_page((unsigned long)image->arch.pmd); ++ image->arch.pmd = NULL; + free_page((unsigned long)image->arch.pte); ++ image->arch.pte = NULL; + } + + static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) +@@ -90,7 +94,6 @@ static int init_transition_pgtable(struct kimage *image, pgd_t *pgd) + set_pte(pte, pfn_pte(paddr >> PAGE_SHIFT, PAGE_KERNEL_EXEC_NOENC)); + return 0; + err: +- free_transition_pgtable(image); + return result; + } + +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 754852156622..1a87f87c88d0 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -1166,21 +1166,17 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) + static int + loop_get_status(struct loop_device *lo, struct loop_info64 *info) + { +- struct file *file = lo->lo_backing_file; ++ struct file *file; + struct kstat stat; +- int error; ++ int ret; + +- if (lo->lo_state != Lo_bound) ++ if (lo->lo_state != Lo_bound) { ++ mutex_unlock(&lo->lo_ctl_mutex); + return -ENXIO; +- error = vfs_getattr(&file->f_path, &stat, +- STATX_INO, AT_STATX_SYNC_AS_STAT); +- if (error) +- return error; ++ } ++ + memset(info, 0, sizeof(*info)); + info->lo_number = lo->lo_number; +- info->lo_device = huge_encode_dev(stat.dev); +- info->lo_inode = stat.ino; +- info->lo_rdevice = huge_encode_dev(lo->lo_device ? stat.rdev : stat.dev); + info->lo_offset = lo->lo_offset; + info->lo_sizelimit = lo->lo_sizelimit; + info->lo_flags = lo->lo_flags; +@@ -1193,7 +1189,19 @@ loop_get_status(struct loop_device *lo, struct loop_info64 *info) + memcpy(info->lo_encrypt_key, lo->lo_encrypt_key, + lo->lo_encrypt_key_size); + } +- return 0; ++ ++ /* Drop lo_ctl_mutex while we call into the filesystem. */ ++ file = get_file(lo->lo_backing_file); ++ mutex_unlock(&lo->lo_ctl_mutex); ++ ret = vfs_getattr(&file->f_path, &stat, STATX_INO, ++ AT_STATX_SYNC_AS_STAT); ++ if (!ret) { ++ info->lo_device = huge_encode_dev(stat.dev); ++ info->lo_inode = stat.ino; ++ info->lo_rdevice = huge_encode_dev(stat.rdev); ++ } ++ fput(file); ++ return ret; + } + + static void +@@ -1274,12 +1282,13 @@ static int + loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { + struct loop_info info; + struct loop_info64 info64; +- int err = 0; ++ int err; + +- if (!arg) +- err = -EINVAL; +- if (!err) +- err = loop_get_status(lo, &info64); ++ if (!arg) { ++ mutex_unlock(&lo->lo_ctl_mutex); ++ return -EINVAL; ++ } ++ err = loop_get_status(lo, &info64); + if (!err) + err = loop_info64_to_old(&info64, &info); + if (!err && copy_to_user(arg, &info, sizeof(info))) +@@ -1291,12 +1300,13 @@ loop_get_status_old(struct loop_device *lo, struct loop_info __user *arg) { + static int + loop_get_status64(struct loop_device *lo, struct loop_info64 __user *arg) { + struct loop_info64 info64; +- int err = 0; ++ int err; + +- if (!arg) +- err = -EINVAL; +- if (!err) +- err = loop_get_status(lo, &info64); ++ if (!arg) { ++ mutex_unlock(&lo->lo_ctl_mutex); ++ return -EINVAL; ++ } ++ err = loop_get_status(lo, &info64); + if (!err && copy_to_user(arg, &info64, sizeof(info64))) + err = -EFAULT; + +@@ -1373,7 +1383,8 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, + break; + case LOOP_GET_STATUS: + err = loop_get_status_old(lo, (struct loop_info __user *) arg); +- break; ++ /* loop_get_status() unlocks lo_ctl_mutex */ ++ goto out_unlocked; + case LOOP_SET_STATUS64: + err = -EPERM; + if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) +@@ -1382,7 +1393,8 @@ static int lo_ioctl(struct block_device *bdev, fmode_t mode, + break; + case LOOP_GET_STATUS64: + err = loop_get_status64(lo, (struct loop_info64 __user *) arg); +- break; ++ /* loop_get_status() unlocks lo_ctl_mutex */ ++ goto out_unlocked; + case LOOP_SET_CAPACITY: + err = -EPERM; + if ((mode & FMODE_WRITE) || capable(CAP_SYS_ADMIN)) +@@ -1515,12 +1527,13 @@ loop_get_status_compat(struct loop_device *lo, + struct compat_loop_info __user *arg) + { + struct loop_info64 info64; +- int err = 0; ++ int err; + +- if (!arg) +- err = -EINVAL; +- if (!err) +- err = loop_get_status(lo, &info64); ++ if (!arg) { ++ mutex_unlock(&lo->lo_ctl_mutex); ++ return -EINVAL; ++ } ++ err = loop_get_status(lo, &info64); + if (!err) + err = loop_info64_to_compat(&info64, arg); + return err; +@@ -1543,7 +1556,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode, + mutex_lock(&lo->lo_ctl_mutex); + err = loop_get_status_compat( + lo, (struct compat_loop_info __user *) arg); +- mutex_unlock(&lo->lo_ctl_mutex); ++ /* loop_get_status() unlocks lo_ctl_mutex */ + break; + case LOOP_SET_CAPACITY: + case LOOP_CLR_FD: +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 7fcc4d7f4909..86d7975afaeb 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -370,6 +370,9 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK }, + ++ /* Additional Realtek 8723BU Bluetooth devices */ ++ { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, ++ + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, +@@ -377,6 +380,9 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x13d3, 0x3461), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3462), .driver_info = BTUSB_REALTEK }, + ++ /* Additional Realtek 8822BE Bluetooth devices */ ++ { USB_DEVICE(0x0b05, 0x185c), .driver_info = BTUSB_REALTEK }, ++ + /* Silicon Wave based devices */ + { USB_DEVICE(0x0c10, 0x0000), .driver_info = BTUSB_SWAVE }, + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 60c7fde37d23..4e21f5bcd954 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -1931,6 +1931,9 @@ static int clk_core_get_phase(struct clk_core *core) + int ret; + + clk_prepare_lock(); ++ /* Always try to update cached phase if possible */ ++ if (core->ops->get_phase) ++ core->phase = core->ops->get_phase(core->hw); + ret = core->phase; + clk_prepare_unlock(); + +diff --git a/drivers/clk/hisilicon/crg-hi3516cv300.c b/drivers/clk/hisilicon/crg-hi3516cv300.c +index 2007123832bb..53450b651e4c 100644 +--- a/drivers/clk/hisilicon/crg-hi3516cv300.c ++++ b/drivers/clk/hisilicon/crg-hi3516cv300.c +@@ -204,7 +204,7 @@ static const struct hisi_crg_funcs hi3516cv300_crg_funcs = { + /* hi3516CV300 sysctrl CRG */ + #define HI3516CV300_SYSCTRL_NR_CLKS 16 + +-static const char *wdt_mux_p[] __initconst = { "3m", "apb" }; ++static const char *const wdt_mux_p[] __initconst = { "3m", "apb" }; + static u32 wdt_mux_table[] = {0, 1}; + + static const struct hisi_mux_clock hi3516cv300_sysctrl_mux_clks[] = { +diff --git a/drivers/clk/rockchip/clk-mmc-phase.c b/drivers/clk/rockchip/clk-mmc-phase.c +index 077fcdc7908b..fe7d9ed1d436 100644 +--- a/drivers/clk/rockchip/clk-mmc-phase.c ++++ b/drivers/clk/rockchip/clk-mmc-phase.c +@@ -58,6 +58,12 @@ static int rockchip_mmc_get_phase(struct clk_hw *hw) + u16 degrees; + u32 delay_num = 0; + ++ /* See the comment for rockchip_mmc_set_phase below */ ++ if (!rate) { ++ pr_err("%s: invalid clk rate\n", __func__); ++ return -EINVAL; ++ } ++ + raw_value = readl(mmc_clock->reg) >> (mmc_clock->shift); + + degrees = (raw_value & ROCKCHIP_MMC_DEGREE_MASK) * 90; +@@ -84,6 +90,23 @@ static int rockchip_mmc_set_phase(struct clk_hw *hw, int degrees) + u32 raw_value; + u32 delay; + ++ /* ++ * The below calculation is based on the output clock from ++ * MMC host to the card, which expects the phase clock inherits ++ * the clock rate from its parent, namely the output clock ++ * provider of MMC host. However, things may go wrong if ++ * (1) It is orphan. ++ * (2) It is assigned to the wrong parent. ++ * ++ * This check help debug the case (1), which seems to be the ++ * most likely problem we often face and which makes it difficult ++ * for people to debug unstable mmc tuning results. ++ */ ++ if (!rate) { ++ pr_err("%s: invalid clk rate\n", __func__); ++ return -EINVAL; ++ } ++ + nineties = degrees / 90; + remainder = (degrees % 90); + +diff --git a/drivers/clk/rockchip/clk-rk3228.c b/drivers/clk/rockchip/clk-rk3228.c +index 11e7f2d1c054..7af48184b022 100644 +--- a/drivers/clk/rockchip/clk-rk3228.c ++++ b/drivers/clk/rockchip/clk-rk3228.c +@@ -387,7 +387,7 @@ static struct rockchip_clk_branch rk3228_clk_branches[] __initdata = { + RK2928_CLKSEL_CON(23), 5, 2, MFLAGS, 0, 6, DFLAGS, + RK2928_CLKGATE_CON(2), 15, GFLAGS), + +- COMPOSITE(SCLK_SDMMC, "sclk_sdmmc0", mux_mmc_src_p, 0, ++ COMPOSITE(SCLK_SDMMC, "sclk_sdmmc", mux_mmc_src_p, 0, + RK2928_CLKSEL_CON(11), 8, 2, MFLAGS, 0, 8, DFLAGS, + RK2928_CLKGATE_CON(2), 11, GFLAGS), + +diff --git a/drivers/clk/samsung/clk-exynos3250.c b/drivers/clk/samsung/clk-exynos3250.c +index 1b81e283f605..ed36728424a2 100644 +--- a/drivers/clk/samsung/clk-exynos3250.c ++++ b/drivers/clk/samsung/clk-exynos3250.c +@@ -698,7 +698,7 @@ static const struct samsung_pll_rate_table exynos3250_epll_rates[] __initconst = + PLL_36XX_RATE(144000000, 96, 2, 3, 0), + PLL_36XX_RATE( 96000000, 128, 2, 4, 0), + PLL_36XX_RATE( 84000000, 112, 2, 4, 0), +- PLL_36XX_RATE( 80000004, 106, 2, 4, 43691), ++ PLL_36XX_RATE( 80000003, 106, 2, 4, 43691), + PLL_36XX_RATE( 73728000, 98, 2, 4, 19923), + PLL_36XX_RATE( 67737598, 270, 3, 5, 62285), + PLL_36XX_RATE( 65535999, 174, 2, 5, 49982), +@@ -734,7 +734,7 @@ static const struct samsung_pll_rate_table exynos3250_vpll_rates[] __initconst = + PLL_36XX_RATE(148352005, 98, 2, 3, 59070), + PLL_36XX_RATE(108000000, 144, 2, 4, 0), + PLL_36XX_RATE( 74250000, 99, 2, 4, 0), +- PLL_36XX_RATE( 74176002, 98, 3, 4, 59070), ++ PLL_36XX_RATE( 74176002, 98, 2, 4, 59070), + PLL_36XX_RATE( 54054000, 216, 3, 5, 14156), + PLL_36XX_RATE( 54000000, 144, 2, 5, 0), + { /* sentinel */ } +diff --git a/drivers/clk/samsung/clk-exynos5250.c b/drivers/clk/samsung/clk-exynos5250.c +index 27a227d6620c..6a0cb8a515e8 100644 +--- a/drivers/clk/samsung/clk-exynos5250.c ++++ b/drivers/clk/samsung/clk-exynos5250.c +@@ -711,13 +711,13 @@ static const struct samsung_pll_rate_table epll_24mhz_tbl[] __initconst = { + /* sorted in descending order */ + /* PLL_36XX_RATE(rate, m, p, s, k) */ + PLL_36XX_RATE(192000000, 64, 2, 2, 0), +- PLL_36XX_RATE(180633600, 90, 3, 2, 20762), ++ PLL_36XX_RATE(180633605, 90, 3, 2, 20762), + PLL_36XX_RATE(180000000, 90, 3, 2, 0), + PLL_36XX_RATE(73728000, 98, 2, 4, 19923), +- PLL_36XX_RATE(67737600, 90, 2, 4, 20762), ++ PLL_36XX_RATE(67737602, 90, 2, 4, 20762), + PLL_36XX_RATE(49152000, 98, 3, 4, 19923), +- PLL_36XX_RATE(45158400, 90, 3, 4, 20762), +- PLL_36XX_RATE(32768000, 131, 3, 5, 4719), ++ PLL_36XX_RATE(45158401, 90, 3, 4, 20762), ++ PLL_36XX_RATE(32768001, 131, 3, 5, 4719), + { }, + }; + +diff --git a/drivers/clk/samsung/clk-exynos5260.c b/drivers/clk/samsung/clk-exynos5260.c +index fd1d9bfc151b..8eae1752d700 100644 +--- a/drivers/clk/samsung/clk-exynos5260.c ++++ b/drivers/clk/samsung/clk-exynos5260.c +@@ -65,7 +65,7 @@ static const struct samsung_pll_rate_table pll2650_24mhz_tbl[] __initconst = { + PLL_36XX_RATE(480000000, 160, 2, 2, 0), + PLL_36XX_RATE(432000000, 144, 2, 2, 0), + PLL_36XX_RATE(400000000, 200, 3, 2, 0), +- PLL_36XX_RATE(394073130, 459, 7, 2, 49282), ++ PLL_36XX_RATE(394073128, 459, 7, 2, 49282), + PLL_36XX_RATE(333000000, 111, 2, 2, 0), + PLL_36XX_RATE(300000000, 100, 2, 2, 0), + PLL_36XX_RATE(266000000, 266, 3, 3, 0), +diff --git a/drivers/clk/samsung/clk-exynos5433.c b/drivers/clk/samsung/clk-exynos5433.c +index 11343a597093..1d2265f9ee97 100644 +--- a/drivers/clk/samsung/clk-exynos5433.c ++++ b/drivers/clk/samsung/clk-exynos5433.c +@@ -725,7 +725,7 @@ static const struct samsung_pll_rate_table exynos5433_pll_rates[] __initconst = + PLL_35XX_RATE(800000000U, 400, 6, 1), + PLL_35XX_RATE(733000000U, 733, 12, 1), + PLL_35XX_RATE(700000000U, 175, 3, 1), +- PLL_35XX_RATE(667000000U, 222, 4, 1), ++ PLL_35XX_RATE(666000000U, 222, 4, 1), + PLL_35XX_RATE(633000000U, 211, 4, 1), + PLL_35XX_RATE(600000000U, 500, 5, 2), + PLL_35XX_RATE(552000000U, 460, 5, 2), +@@ -753,12 +753,12 @@ static const struct samsung_pll_rate_table exynos5433_pll_rates[] __initconst = + /* AUD_PLL */ + static const struct samsung_pll_rate_table exynos5433_aud_pll_rates[] __initconst = { + PLL_36XX_RATE(400000000U, 200, 3, 2, 0), +- PLL_36XX_RATE(393216000U, 197, 3, 2, -25690), ++ PLL_36XX_RATE(393216003U, 197, 3, 2, -25690), + PLL_36XX_RATE(384000000U, 128, 2, 2, 0), +- PLL_36XX_RATE(368640000U, 246, 4, 2, -15729), +- PLL_36XX_RATE(361507200U, 181, 3, 2, -16148), +- PLL_36XX_RATE(338688000U, 113, 2, 2, -6816), +- PLL_36XX_RATE(294912000U, 98, 1, 3, 19923), ++ PLL_36XX_RATE(368639991U, 246, 4, 2, -15729), ++ PLL_36XX_RATE(361507202U, 181, 3, 2, -16148), ++ PLL_36XX_RATE(338687988U, 113, 2, 2, -6816), ++ PLL_36XX_RATE(294912002U, 98, 1, 3, 19923), + PLL_36XX_RATE(288000000U, 96, 1, 3, 0), + PLL_36XX_RATE(252000000U, 84, 1, 3, 0), + { /* sentinel */ } +diff --git a/drivers/clk/samsung/clk-exynos7.c b/drivers/clk/samsung/clk-exynos7.c +index 5931a4140c3d..bbfa57b4e017 100644 +--- a/drivers/clk/samsung/clk-exynos7.c ++++ b/drivers/clk/samsung/clk-exynos7.c +@@ -140,7 +140,7 @@ static const struct samsung_div_clock topc_div_clks[] __initconst = { + }; + + static const struct samsung_pll_rate_table pll1460x_24mhz_tbl[] __initconst = { +- PLL_36XX_RATE(491520000, 20, 1, 0, 31457), ++ PLL_36XX_RATE(491519897, 20, 1, 0, 31457), + {}, + }; + +diff --git a/drivers/clk/samsung/clk-s3c2410.c b/drivers/clk/samsung/clk-s3c2410.c +index e0650c33863b..d8e58a659467 100644 +--- a/drivers/clk/samsung/clk-s3c2410.c ++++ b/drivers/clk/samsung/clk-s3c2410.c +@@ -168,7 +168,7 @@ static struct samsung_pll_rate_table pll_s3c2410_12mhz_tbl[] __initdata = { + PLL_35XX_RATE(226000000, 105, 1, 1), + PLL_35XX_RATE(210000000, 132, 2, 1), + /* 2410 common */ +- PLL_35XX_RATE(203000000, 161, 3, 1), ++ PLL_35XX_RATE(202800000, 161, 3, 1), + PLL_35XX_RATE(192000000, 88, 1, 1), + PLL_35XX_RATE(186000000, 85, 1, 1), + PLL_35XX_RATE(180000000, 82, 1, 1), +@@ -178,18 +178,18 @@ static struct samsung_pll_rate_table pll_s3c2410_12mhz_tbl[] __initdata = { + PLL_35XX_RATE(147000000, 90, 2, 1), + PLL_35XX_RATE(135000000, 82, 2, 1), + PLL_35XX_RATE(124000000, 116, 1, 2), +- PLL_35XX_RATE(118000000, 150, 2, 2), ++ PLL_35XX_RATE(118500000, 150, 2, 2), + PLL_35XX_RATE(113000000, 105, 1, 2), +- PLL_35XX_RATE(101000000, 127, 2, 2), ++ PLL_35XX_RATE(101250000, 127, 2, 2), + PLL_35XX_RATE(90000000, 112, 2, 2), +- PLL_35XX_RATE(85000000, 105, 2, 2), ++ PLL_35XX_RATE(84750000, 105, 2, 2), + PLL_35XX_RATE(79000000, 71, 1, 2), +- PLL_35XX_RATE(68000000, 82, 2, 2), +- PLL_35XX_RATE(56000000, 142, 2, 3), ++ PLL_35XX_RATE(67500000, 82, 2, 2), ++ PLL_35XX_RATE(56250000, 142, 2, 3), + PLL_35XX_RATE(48000000, 120, 2, 3), +- PLL_35XX_RATE(51000000, 161, 3, 3), ++ PLL_35XX_RATE(50700000, 161, 3, 3), + PLL_35XX_RATE(45000000, 82, 1, 3), +- PLL_35XX_RATE(34000000, 82, 2, 3), ++ PLL_35XX_RATE(33750000, 82, 2, 3), + { /* sentinel */ }, + }; + +diff --git a/drivers/clk/tegra/clk-pll.c b/drivers/clk/tegra/clk-pll.c +index 7c369e21c91c..830d1c87fa7c 100644 +--- a/drivers/clk/tegra/clk-pll.c ++++ b/drivers/clk/tegra/clk-pll.c +@@ -1151,6 +1151,8 @@ static const struct clk_ops tegra_clk_pllu_ops = { + .enable = clk_pllu_enable, + .disable = clk_pll_disable, + .recalc_rate = clk_pll_recalc_rate, ++ .round_rate = clk_pll_round_rate, ++ .set_rate = clk_pll_set_rate, + }; + + static int _pll_fixed_mdiv(struct tegra_clk_pll_params *pll_params, +diff --git a/drivers/crypto/atmel-aes.c b/drivers/crypto/atmel-aes.c +index 29e20c37f3a6..11129b796dda 100644 +--- a/drivers/crypto/atmel-aes.c ++++ b/drivers/crypto/atmel-aes.c +@@ -2145,7 +2145,7 @@ static int atmel_aes_authenc_setkey(struct crypto_aead *tfm, const u8 *key, + + badkey: + crypto_aead_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); +- memzero_explicit(&key, sizeof(keys)); ++ memzero_explicit(&keys, sizeof(keys)); + return -EINVAL; + } + +diff --git a/drivers/crypto/ccp/ccp-debugfs.c b/drivers/crypto/ccp/ccp-debugfs.c +index 59d4ca4e72d8..1a734bd2070a 100644 +--- a/drivers/crypto/ccp/ccp-debugfs.c ++++ b/drivers/crypto/ccp/ccp-debugfs.c +@@ -278,7 +278,7 @@ static const struct file_operations ccp_debugfs_stats_ops = { + }; + + static struct dentry *ccp_debugfs_dir; +-static DEFINE_RWLOCK(ccp_debugfs_lock); ++static DEFINE_MUTEX(ccp_debugfs_lock); + + #define MAX_NAME_LEN 20 + +@@ -290,16 +290,15 @@ void ccp5_debugfs_setup(struct ccp_device *ccp) + struct dentry *debugfs_stats; + struct dentry *debugfs_q_instance; + struct dentry *debugfs_q_stats; +- unsigned long flags; + int i; + + if (!debugfs_initialized()) + return; + +- write_lock_irqsave(&ccp_debugfs_lock, flags); ++ mutex_lock(&ccp_debugfs_lock); + if (!ccp_debugfs_dir) + ccp_debugfs_dir = debugfs_create_dir(KBUILD_MODNAME, NULL); +- write_unlock_irqrestore(&ccp_debugfs_lock, flags); ++ mutex_unlock(&ccp_debugfs_lock); + if (!ccp_debugfs_dir) + return; + +diff --git a/drivers/crypto/inside-secure/safexcel.c b/drivers/crypto/inside-secure/safexcel.c +index d4c81cb73bee..3ee68ecde9ec 100644 +--- a/drivers/crypto/inside-secure/safexcel.c ++++ b/drivers/crypto/inside-secure/safexcel.c +@@ -462,6 +462,15 @@ void safexcel_dequeue(struct safexcel_crypto_priv *priv, int ring) + if (backlog) + backlog->complete(backlog, -EINPROGRESS); + ++ /* In case the send() helper did not issue any command to push ++ * to the engine because the input data was cached, continue to ++ * dequeue other requests as this is valid and not an error. ++ */ ++ if (!commands && !results) { ++ kfree(request); ++ continue; ++ } ++ + spin_lock_bh(&priv->ring[ring].egress_lock); + list_add_tail(&request->list, &priv->ring[ring].list); + spin_unlock_bh(&priv->ring[ring].egress_lock); +diff --git a/drivers/crypto/inside-secure/safexcel_cipher.c b/drivers/crypto/inside-secure/safexcel_cipher.c +index fcc0a606d748..29cf7e00b574 100644 +--- a/drivers/crypto/inside-secure/safexcel_cipher.c ++++ b/drivers/crypto/inside-secure/safexcel_cipher.c +@@ -446,7 +446,7 @@ static int safexcel_cipher_exit_inv(struct crypto_tfm *tfm) + if (!priv->ring[ring].need_dequeue) + safexcel_dequeue(priv, ring); + +- wait_for_completion_interruptible(&result.completion); ++ wait_for_completion(&result.completion); + + if (result.error) { + dev_warn(priv->dev, +diff --git a/drivers/crypto/inside-secure/safexcel_hash.c b/drivers/crypto/inside-secure/safexcel_hash.c +index d626aa485a76..69f29776591a 100644 +--- a/drivers/crypto/inside-secure/safexcel_hash.c ++++ b/drivers/crypto/inside-secure/safexcel_hash.c +@@ -185,7 +185,7 @@ static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring, + int i, queued, len, cache_len, extra, n_cdesc = 0, ret = 0; + + queued = len = req->len - req->processed; +- if (queued < crypto_ahash_blocksize(ahash)) ++ if (queued <= crypto_ahash_blocksize(ahash)) + cache_len = queued; + else + cache_len = queued - areq->nbytes; +@@ -199,7 +199,7 @@ static int safexcel_ahash_send_req(struct crypto_async_request *async, int ring, + /* If this is not the last request and the queued data + * is a multiple of a block, cache the last one for now. + */ +- extra = queued - crypto_ahash_blocksize(ahash); ++ extra = crypto_ahash_blocksize(ahash); + + if (extra) { + sg_pcopy_to_buffer(areq->src, sg_nents(areq->src), +@@ -494,7 +494,7 @@ static int safexcel_ahash_exit_inv(struct crypto_tfm *tfm) + if (!priv->ring[ring].need_dequeue) + safexcel_dequeue(priv, ring); + +- wait_for_completion_interruptible(&result.completion); ++ wait_for_completion(&result.completion); + + if (result.error) { + dev_warn(priv->dev, "hash: completion error (%d)\n", +@@ -819,7 +819,7 @@ static int safexcel_hmac_init_pad(struct ahash_request *areq, + init_completion(&result.completion); + + ret = crypto_ahash_digest(areq); +- if (ret == -EINPROGRESS) { ++ if (ret == -EINPROGRESS || ret == -EBUSY) { + wait_for_completion_interruptible(&result.completion); + ret = result.error; + } +diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-core.c b/drivers/crypto/sunxi-ss/sun4i-ss-core.c +index 1547cbe13dc2..a81d89b3b7d8 100644 +--- a/drivers/crypto/sunxi-ss/sun4i-ss-core.c ++++ b/drivers/crypto/sunxi-ss/sun4i-ss-core.c +@@ -451,6 +451,7 @@ static struct platform_driver sun4i_ss_driver = { + + module_platform_driver(sun4i_ss_driver); + ++MODULE_ALIAS("platform:sun4i-ss"); + MODULE_DESCRIPTION("Allwinner Security System cryptographic accelerator"); + MODULE_LICENSE("GPL"); + MODULE_AUTHOR("Corentin LABBE "); +diff --git a/drivers/media/dvb-core/dmxdev.c b/drivers/media/dvb-core/dmxdev.c +index 18e4230865be..51009b2718a3 100644 +--- a/drivers/media/dvb-core/dmxdev.c ++++ b/drivers/media/dvb-core/dmxdev.c +@@ -1055,7 +1055,7 @@ static int dvb_demux_do_ioctl(struct file *file, + break; + + default: +- ret = -EINVAL; ++ ret = -ENOTTY; + break; + } + mutex_unlock(&dmxdev->mutex); +diff --git a/drivers/media/dvb-frontends/lgdt3306a.c b/drivers/media/dvb-frontends/lgdt3306a.c +index c9b1eb38444e..fbb3b2f49d2d 100644 +--- a/drivers/media/dvb-frontends/lgdt3306a.c ++++ b/drivers/media/dvb-frontends/lgdt3306a.c +@@ -1767,7 +1767,13 @@ static void lgdt3306a_release(struct dvb_frontend *fe) + struct lgdt3306a_state *state = fe->demodulator_priv; + + dbg_info("\n"); +- kfree(state); ++ ++ /* ++ * If state->muxc is not NULL, then we are an i2c device ++ * and lgdt3306a_remove will clean up state ++ */ ++ if (!state->muxc) ++ kfree(state); + } + + static const struct dvb_frontend_ops lgdt3306a_ops; +@@ -2168,7 +2174,7 @@ static int lgdt3306a_probe(struct i2c_client *client, + sizeof(struct lgdt3306a_config)); + + config->i2c_addr = client->addr; +- fe = lgdt3306a_attach(config, client->adapter); ++ fe = dvb_attach(lgdt3306a_attach, config, client->adapter); + if (fe == NULL) { + ret = -ENODEV; + goto err_fe; +diff --git a/drivers/media/i2c/adv748x/adv748x-hdmi.c b/drivers/media/i2c/adv748x/adv748x-hdmi.c +index 4da4253553fc..10d229a4f088 100644 +--- a/drivers/media/i2c/adv748x/adv748x-hdmi.c ++++ b/drivers/media/i2c/adv748x/adv748x-hdmi.c +@@ -105,6 +105,9 @@ static void adv748x_hdmi_fill_format(struct adv748x_hdmi *hdmi, + + fmt->width = hdmi->timings.bt.width; + fmt->height = hdmi->timings.bt.height; ++ ++ if (fmt->field == V4L2_FIELD_ALTERNATE) ++ fmt->height /= 2; + } + + static void adv748x_fill_optional_dv_timings(struct v4l2_dv_timings *timings) +diff --git a/drivers/media/i2c/ov5645.c b/drivers/media/i2c/ov5645.c +index d28845f7356f..a31fe18c71d6 100644 +--- a/drivers/media/i2c/ov5645.c ++++ b/drivers/media/i2c/ov5645.c +@@ -1131,13 +1131,14 @@ static int ov5645_probe(struct i2c_client *client, + + ret = v4l2_fwnode_endpoint_parse(of_fwnode_handle(endpoint), + &ov5645->ep); ++ ++ of_node_put(endpoint); ++ + if (ret < 0) { + dev_err(dev, "parsing endpoint node failed\n"); + return ret; + } + +- of_node_put(endpoint); +- + if (ov5645->ep.bus_type != V4L2_MBUS_CSI2) { + dev_err(dev, "invalid bus type, must be CSI2\n"); + return -EINVAL; +diff --git a/drivers/media/i2c/tvp5150.c b/drivers/media/i2c/tvp5150.c +index 7b79a7498751..698fa764999c 100644 +--- a/drivers/media/i2c/tvp5150.c ++++ b/drivers/media/i2c/tvp5150.c +@@ -506,80 +506,77 @@ static struct i2c_vbi_ram_value vbi_ram_default[] = + /* FIXME: Current api doesn't handle all VBI types, those not + yet supported are placed under #if 0 */ + #if 0 +- {0x010, /* Teletext, SECAM, WST System A */ ++ [0] = {0x010, /* Teletext, SECAM, WST System A */ + {V4L2_SLICED_TELETEXT_SECAM,6,23,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x26, + 0xe6, 0xb4, 0x0e, 0x00, 0x00, 0x00, 0x10, 0x00 } + }, + #endif +- {0x030, /* Teletext, PAL, WST System B */ ++ [1] = {0x030, /* Teletext, PAL, WST System B */ + {V4L2_SLICED_TELETEXT_B,6,22,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x2b, + 0xa6, 0x72, 0x10, 0x00, 0x00, 0x00, 0x10, 0x00 } + }, + #if 0 +- {0x050, /* Teletext, PAL, WST System C */ ++ [2] = {0x050, /* Teletext, PAL, WST System C */ + {V4L2_SLICED_TELETEXT_PAL_C,6,22,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22, + 0xa6, 0x98, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 } + }, +- {0x070, /* Teletext, NTSC, WST System B */ ++ [3] = {0x070, /* Teletext, NTSC, WST System B */ + {V4L2_SLICED_TELETEXT_NTSC_B,10,21,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0x27, 0x2e, 0x20, 0x23, + 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 } + }, +- {0x090, /* Tetetext, NTSC NABTS System C */ ++ [4] = {0x090, /* Tetetext, NTSC NABTS System C */ + {V4L2_SLICED_TELETEXT_NTSC_C,10,21,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0xe7, 0x2e, 0x20, 0x22, + 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x15, 0x00 } + }, +- {0x0b0, /* Teletext, NTSC-J, NABTS System D */ ++ [5] = {0x0b0, /* Teletext, NTSC-J, NABTS System D */ + {V4L2_SLICED_TELETEXT_NTSC_D,10,21,1}, + { 0xaa, 0xaa, 0xff, 0xff, 0xa7, 0x2e, 0x20, 0x23, + 0x69, 0x93, 0x0d, 0x00, 0x00, 0x00, 0x10, 0x00 } + }, +- {0x0d0, /* Closed Caption, PAL/SECAM */ ++ [6] = {0x0d0, /* Closed Caption, PAL/SECAM */ + {V4L2_SLICED_CAPTION_625,22,22,1}, + { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02, + 0xa6, 0x7b, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 } + }, + #endif +- {0x0f0, /* Closed Caption, NTSC */ ++ [7] = {0x0f0, /* Closed Caption, NTSC */ + {V4L2_SLICED_CAPTION_525,21,21,1}, + { 0xaa, 0x2a, 0xff, 0x3f, 0x04, 0x51, 0x6e, 0x02, + 0x69, 0x8c, 0x09, 0x00, 0x00, 0x00, 0x27, 0x00 } + }, +- {0x110, /* Wide Screen Signal, PAL/SECAM */ ++ [8] = {0x110, /* Wide Screen Signal, PAL/SECAM */ + {V4L2_SLICED_WSS_625,23,23,1}, + { 0x5b, 0x55, 0xc5, 0xff, 0x00, 0x71, 0x6e, 0x42, + 0xa6, 0xcd, 0x0f, 0x00, 0x00, 0x00, 0x3a, 0x00 } + }, + #if 0 +- {0x130, /* Wide Screen Signal, NTSC C */ ++ [9] = {0x130, /* Wide Screen Signal, NTSC C */ + {V4L2_SLICED_WSS_525,20,20,1}, + { 0x38, 0x00, 0x3f, 0x00, 0x00, 0x71, 0x6e, 0x43, + 0x69, 0x7c, 0x08, 0x00, 0x00, 0x00, 0x39, 0x00 } + }, +- {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */ ++ [10] = {0x150, /* Vertical Interval Timecode (VITC), PAL/SECAM */ + {V4l2_SLICED_VITC_625,6,22,0}, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49, + 0xa6, 0x85, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 } + }, +- {0x170, /* Vertical Interval Timecode (VITC), NTSC */ ++ [11] = {0x170, /* Vertical Interval Timecode (VITC), NTSC */ + {V4l2_SLICED_VITC_525,10,20,0}, + { 0x00, 0x00, 0x00, 0x00, 0x00, 0x8f, 0x6d, 0x49, + 0x69, 0x94, 0x08, 0x00, 0x00, 0x00, 0x4c, 0x00 } + }, + #endif +- {0x190, /* Video Program System (VPS), PAL */ ++ [12] = {0x190, /* Video Program System (VPS), PAL */ + {V4L2_SLICED_VPS,16,16,0}, + { 0xaa, 0xaa, 0xff, 0xff, 0xba, 0xce, 0x2b, 0x0d, + 0xa6, 0xda, 0x0b, 0x00, 0x00, 0x00, 0x60, 0x00 } + }, + /* 0x1d0 User programmable */ +- +- /* End of struct */ +- { (u16)-1 } + }; + + static int tvp5150_write_inittab(struct v4l2_subdev *sd, +@@ -592,10 +589,10 @@ static int tvp5150_write_inittab(struct v4l2_subdev *sd, + return 0; + } + +-static int tvp5150_vdp_init(struct v4l2_subdev *sd, +- const struct i2c_vbi_ram_value *regs) ++static int tvp5150_vdp_init(struct v4l2_subdev *sd) + { + unsigned int i; ++ int j; + + /* Disable Full Field */ + tvp5150_write(sd, TVP5150_FULL_FIELD_ENA, 0); +@@ -605,14 +602,17 @@ static int tvp5150_vdp_init(struct v4l2_subdev *sd, + tvp5150_write(sd, i, 0xff); + + /* Load Ram Table */ +- while (regs->reg != (u16)-1) { ++ for (j = 0; j < ARRAY_SIZE(vbi_ram_default); j++) { ++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[j]; ++ ++ if (!regs->type.vbi_type) ++ continue; ++ + tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_HIGH, regs->reg >> 8); + tvp5150_write(sd, TVP5150_CONF_RAM_ADDR_LOW, regs->reg); + + for (i = 0; i < 16; i++) + tvp5150_write(sd, TVP5150_VDP_CONF_RAM_DATA, regs->values[i]); +- +- regs++; + } + return 0; + } +@@ -621,19 +621,23 @@ static int tvp5150_vdp_init(struct v4l2_subdev *sd, + static int tvp5150_g_sliced_vbi_cap(struct v4l2_subdev *sd, + struct v4l2_sliced_vbi_cap *cap) + { +- const struct i2c_vbi_ram_value *regs = vbi_ram_default; +- int line; ++ int line, i; + + dev_dbg_lvl(sd->dev, 1, debug, "g_sliced_vbi_cap\n"); + memset(cap, 0, sizeof *cap); + +- while (regs->reg != (u16)-1 ) { +- for (line=regs->type.ini_line;line<=regs->type.end_line;line++) { ++ for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) { ++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[i]; ++ ++ if (!regs->type.vbi_type) ++ continue; ++ ++ for (line = regs->type.ini_line; ++ line <= regs->type.end_line; ++ line++) { + cap->service_lines[0][line] |= regs->type.vbi_type; + } + cap->service_set |= regs->type.vbi_type; +- +- regs++; + } + return 0; + } +@@ -652,14 +656,13 @@ static int tvp5150_g_sliced_vbi_cap(struct v4l2_subdev *sd, + * MSB = field2 + */ + static int tvp5150_set_vbi(struct v4l2_subdev *sd, +- const struct i2c_vbi_ram_value *regs, + unsigned int type,u8 flags, int line, + const int fields) + { + struct tvp5150 *decoder = to_tvp5150(sd); + v4l2_std_id std = decoder->norm; + u8 reg; +- int pos = 0; ++ int i, pos = 0; + + if (std == V4L2_STD_ALL) { + dev_err(sd->dev, "VBI can't be configured without knowing number of lines\n"); +@@ -672,19 +675,19 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd, + if (line < 6 || line > 27) + return 0; + +- while (regs->reg != (u16)-1) { ++ for (i = 0; i < ARRAY_SIZE(vbi_ram_default); i++) { ++ const struct i2c_vbi_ram_value *regs = &vbi_ram_default[i]; ++ ++ if (!regs->type.vbi_type) ++ continue; ++ + if ((type & regs->type.vbi_type) && + (line >= regs->type.ini_line) && + (line <= regs->type.end_line)) + break; +- +- regs++; + pos++; + } + +- if (regs->reg == (u16)-1) +- return 0; +- + type = pos | (flags & 0xf0); + reg = ((line - 6) << 1) + TVP5150_LINE_MODE_INI; + +@@ -697,8 +700,7 @@ static int tvp5150_set_vbi(struct v4l2_subdev *sd, + return type; + } + +-static int tvp5150_get_vbi(struct v4l2_subdev *sd, +- const struct i2c_vbi_ram_value *regs, int line) ++static int tvp5150_get_vbi(struct v4l2_subdev *sd, int line) + { + struct tvp5150 *decoder = to_tvp5150(sd); + v4l2_std_id std = decoder->norm; +@@ -727,8 +729,8 @@ static int tvp5150_get_vbi(struct v4l2_subdev *sd, + return 0; + } + pos = ret & 0x0f; +- if (pos < 0x0f) +- type |= regs[pos].type.vbi_type; ++ if (pos < ARRAY_SIZE(vbi_ram_default)) ++ type |= vbi_ram_default[pos].type.vbi_type; + } + + return type; +@@ -789,7 +791,7 @@ static int tvp5150_reset(struct v4l2_subdev *sd, u32 val) + tvp5150_write_inittab(sd, tvp5150_init_default); + + /* Initializes VDP registers */ +- tvp5150_vdp_init(sd, vbi_ram_default); ++ tvp5150_vdp_init(sd); + + /* Selects decoder input */ + tvp5150_selmux(sd); +@@ -1122,8 +1124,8 @@ static int tvp5150_s_sliced_fmt(struct v4l2_subdev *sd, struct v4l2_sliced_vbi_f + for (i = 0; i <= 23; i++) { + svbi->service_lines[1][i] = 0; + svbi->service_lines[0][i] = +- tvp5150_set_vbi(sd, vbi_ram_default, +- svbi->service_lines[0][i], 0xf0, i, 3); ++ tvp5150_set_vbi(sd, svbi->service_lines[0][i], ++ 0xf0, i, 3); + } + /* Enables FIFO */ + tvp5150_write(sd, TVP5150_FIFO_OUT_CTRL, 1); +@@ -1149,7 +1151,7 @@ static int tvp5150_g_sliced_fmt(struct v4l2_subdev *sd, struct v4l2_sliced_vbi_f + + for (i = 0; i <= 23; i++) { + svbi->service_lines[0][i] = +- tvp5150_get_vbi(sd, vbi_ram_default, i); ++ tvp5150_get_vbi(sd, i); + mask |= svbi->service_lines[0][i]; + } + svbi->service_set = mask; +diff --git a/drivers/media/pci/cx23885/cx23885-cards.c b/drivers/media/pci/cx23885/cx23885-cards.c +index 78a8836d03e4..6c0fd9438dd9 100644 +--- a/drivers/media/pci/cx23885/cx23885-cards.c ++++ b/drivers/media/pci/cx23885/cx23885-cards.c +@@ -2286,6 +2286,10 @@ void cx23885_card_setup(struct cx23885_dev *dev) + &dev->i2c_bus[2].i2c_adap, + "cx25840", 0x88 >> 1, NULL); + if (dev->sd_cx25840) { ++ /* set host data for clk_freq configuration */ ++ v4l2_set_subdev_hostdata(dev->sd_cx25840, ++ &dev->clk_freq); ++ + dev->sd_cx25840->grp_id = CX23885_HW_AV_CORE; + v4l2_subdev_call(dev->sd_cx25840, core, load_fw); + } +diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c +index 8f63df1cb418..4612f26fcd6d 100644 +--- a/drivers/media/pci/cx23885/cx23885-core.c ++++ b/drivers/media/pci/cx23885/cx23885-core.c +@@ -873,6 +873,16 @@ static int cx23885_dev_setup(struct cx23885_dev *dev) + if (cx23885_boards[dev->board].clk_freq > 0) + dev->clk_freq = cx23885_boards[dev->board].clk_freq; + ++ if (dev->board == CX23885_BOARD_HAUPPAUGE_IMPACTVCBE && ++ dev->pci->subsystem_device == 0x7137) { ++ /* Hauppauge ImpactVCBe device ID 0x7137 is populated ++ * with an 888, and a 25Mhz crystal, instead of the ++ * usual third overtone 50Mhz. The default clock rate must ++ * be overridden so the cx25840 is properly configured ++ */ ++ dev->clk_freq = 25000000; ++ } ++ + dev->pci_bus = dev->pci->bus->number; + dev->pci_slot = PCI_SLOT(dev->pci->devfn); + cx23885_irq_add(dev, 0x001f00); +diff --git a/drivers/media/pci/cx25821/cx25821-core.c b/drivers/media/pci/cx25821/cx25821-core.c +index 04aa4a68a0ae..040c6c251d3a 100644 +--- a/drivers/media/pci/cx25821/cx25821-core.c ++++ b/drivers/media/pci/cx25821/cx25821-core.c +@@ -867,6 +867,10 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + dev->nr = ++cx25821_devcount; + sprintf(dev->name, "cx25821[%d]", dev->nr); + ++ if (dev->nr >= ARRAY_SIZE(card)) { ++ CX25821_INFO("dev->nr >= %zd", ARRAY_SIZE(card)); ++ return -ENODEV; ++ } + if (dev->pci->device != 0x8210) { + pr_info("%s(): Exiting. Incorrect Hardware device = 0x%02x\n", + __func__, dev->pci->device); +@@ -882,9 +886,6 @@ static int cx25821_dev_setup(struct cx25821_dev *dev) + dev->channels[i].sram_channels = &cx25821_sram_channels[i]; + } + +- if (dev->nr > 1) +- CX25821_INFO("dev->nr > 1!"); +- + /* board config */ + dev->board = 1; /* card[dev->nr]; */ + dev->_max_num_decoders = MAX_DECODERS; +diff --git a/drivers/media/platform/s3c-camif/camif-capture.c b/drivers/media/platform/s3c-camif/camif-capture.c +index 25c7a7d42292..0f0324a14d51 100644 +--- a/drivers/media/platform/s3c-camif/camif-capture.c ++++ b/drivers/media/platform/s3c-camif/camif-capture.c +@@ -1256,16 +1256,17 @@ static void __camif_subdev_try_format(struct camif_dev *camif, + { + const struct s3c_camif_variant *variant = camif->variant; + const struct vp_pix_limits *pix_lim; +- int i = ARRAY_SIZE(camif_mbus_formats); ++ unsigned int i; + + /* FIXME: constraints against codec or preview path ? */ + pix_lim = &variant->vp_pix_limits[VP_CODEC]; + +- while (i-- >= 0) ++ for (i = 0; i < ARRAY_SIZE(camif_mbus_formats); i++) + if (camif_mbus_formats[i] == mf->code) + break; + +- mf->code = camif_mbus_formats[i]; ++ if (i == ARRAY_SIZE(camif_mbus_formats)) ++ mf->code = camif_mbus_formats[0]; + + if (pad == CAMIF_SD_PAD_SINK) { + v4l_bound_align_image(&mf->width, 8, CAMIF_MAX_PIX_WIDTH, +diff --git a/drivers/media/platform/vivid/vivid-ctrls.c b/drivers/media/platform/vivid/vivid-ctrls.c +index 34731f71cc00..8ca9343b6730 100644 +--- a/drivers/media/platform/vivid/vivid-ctrls.c ++++ b/drivers/media/platform/vivid/vivid-ctrls.c +@@ -1191,6 +1191,7 @@ static int vivid_radio_rx_s_ctrl(struct v4l2_ctrl *ctrl) + v4l2_ctrl_activate(dev->radio_rx_rds_ta, dev->radio_rx_rds_controls); + v4l2_ctrl_activate(dev->radio_rx_rds_tp, dev->radio_rx_rds_controls); + v4l2_ctrl_activate(dev->radio_rx_rds_ms, dev->radio_rx_rds_controls); ++ dev->radio_rx_dev.device_caps = dev->radio_rx_caps; + break; + case V4L2_CID_RDS_RECEPTION: + dev->radio_rx_rds_enabled = ctrl->val; +@@ -1265,6 +1266,7 @@ static int vivid_radio_tx_s_ctrl(struct v4l2_ctrl *ctrl) + dev->radio_tx_caps &= ~V4L2_CAP_READWRITE; + if (!dev->radio_tx_rds_controls) + dev->radio_tx_caps |= V4L2_CAP_READWRITE; ++ dev->radio_tx_dev.device_caps = dev->radio_tx_caps; + break; + case V4L2_CID_RDS_TX_PTY: + if (dev->radio_rx_rds_controls) +diff --git a/drivers/media/platform/vsp1/vsp1_drm.c b/drivers/media/platform/vsp1/vsp1_drm.c +index 4dfbeac8f42c..d3cd57f6ba52 100644 +--- a/drivers/media/platform/vsp1/vsp1_drm.c ++++ b/drivers/media/platform/vsp1/vsp1_drm.c +@@ -504,6 +504,15 @@ void vsp1_du_atomic_flush(struct device *dev, unsigned int pipe_index) + struct vsp1_rwpf *rpf = vsp1->rpf[i]; + unsigned int j; + ++ /* ++ * Make sure we don't accept more inputs than the hardware can ++ * handle. This is a temporary fix to avoid display stall, we ++ * need to instead allocate the BRU or BRS to display pipelines ++ * dynamically based on the number of planes they each use. ++ */ ++ if (pipe->num_inputs >= pipe->bru->source_pad) ++ pipe->inputs[i] = NULL; ++ + if (!pipe->inputs[i]) + continue; + +diff --git a/drivers/media/usb/em28xx/em28xx-cards.c b/drivers/media/usb/em28xx/em28xx-cards.c +index 4c57fd7929cb..11a59854a0a6 100644 +--- a/drivers/media/usb/em28xx/em28xx-cards.c ++++ b/drivers/media/usb/em28xx/em28xx-cards.c +@@ -508,8 +508,10 @@ static struct em28xx_reg_seq plex_px_bcud[] = { + }; + + /* +- * 2040:0265 Hauppauge WinTV-dualHD DVB +- * 2040:026d Hauppauge WinTV-dualHD ATSC/QAM ++ * 2040:0265 Hauppauge WinTV-dualHD DVB Isoc ++ * 2040:8265 Hauppauge WinTV-dualHD DVB Bulk ++ * 2040:026d Hauppauge WinTV-dualHD ATSC/QAM Isoc ++ * 2040:826d Hauppauge WinTV-dualHD ATSC/QAM Bulk + * reg 0x80/0x84: + * GPIO_0: Yellow LED tuner 1, 0=on, 1=off + * GPIO_1: Green LED tuner 1, 0=on, 1=off +@@ -2392,7 +2394,8 @@ struct em28xx_board em28xx_boards[] = { + .has_dvb = 1, + }, + /* +- * 2040:0265 Hauppauge WinTV-dualHD (DVB version). ++ * 2040:0265 Hauppauge WinTV-dualHD (DVB version) Isoc. ++ * 2040:8265 Hauppauge WinTV-dualHD (DVB version) Bulk. + * Empia EM28274, 2x Silicon Labs Si2168, 2x Silicon Labs Si2157 + */ + [EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB] = { +@@ -2407,7 +2410,8 @@ struct em28xx_board em28xx_boards[] = { + .leds = hauppauge_dualhd_leds, + }, + /* +- * 2040:026d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM). ++ * 2040:026d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM) Isoc. ++ * 2040:826d Hauppauge WinTV-dualHD (model 01595 - ATSC/QAM) Bulk. + * Empia EM28274, 2x LG LGDT3306A, 2x Silicon Labs Si2157 + */ + [EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595] = { +@@ -2548,8 +2552,12 @@ struct usb_device_id em28xx_id_table[] = { + .driver_info = EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850 }, + { USB_DEVICE(0x2040, 0x0265), + .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB }, ++ { USB_DEVICE(0x2040, 0x8265), ++ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_DVB }, + { USB_DEVICE(0x2040, 0x026d), + .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595 }, ++ { USB_DEVICE(0x2040, 0x826d), ++ .driver_info = EM28174_BOARD_HAUPPAUGE_WINTV_DUALHD_01595 }, + { USB_DEVICE(0x0438, 0xb002), + .driver_info = EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600 }, + { USB_DEVICE(0x2001, 0xf112), +@@ -2610,7 +2618,11 @@ struct usb_device_id em28xx_id_table[] = { + .driver_info = EM28178_BOARD_PCTV_461E }, + { USB_DEVICE(0x2013, 0x025f), + .driver_info = EM28178_BOARD_PCTV_292E }, +- { USB_DEVICE(0x2040, 0x0264), /* Hauppauge WinTV-soloHD */ ++ { USB_DEVICE(0x2040, 0x0264), /* Hauppauge WinTV-soloHD Isoc */ ++ .driver_info = EM28178_BOARD_PCTV_292E }, ++ { USB_DEVICE(0x2040, 0x8264), /* Hauppauge OEM Generic WinTV-soloHD Bulk */ ++ .driver_info = EM28178_BOARD_PCTV_292E }, ++ { USB_DEVICE(0x2040, 0x8268), /* Hauppauge Retail WinTV-soloHD Bulk */ + .driver_info = EM28178_BOARD_PCTV_292E }, + { USB_DEVICE(0x0413, 0x6f07), + .driver_info = EM2861_BOARD_LEADTEK_VC100 }, +diff --git a/drivers/media/usb/em28xx/em28xx.h b/drivers/media/usb/em28xx/em28xx.h +index 88084f24f033..094e83b6908d 100644 +--- a/drivers/media/usb/em28xx/em28xx.h ++++ b/drivers/media/usb/em28xx/em28xx.h +@@ -191,7 +191,7 @@ + USB 2.0 spec says bulk packet size is always 512 bytes + */ + #define EM28XX_BULK_PACKET_MULTIPLIER 384 +-#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 384 ++#define EM28XX_DVB_BULK_PACKET_MULTIPLIER 94 + + #define EM28XX_INTERLACED_DEFAULT 1 + +diff --git a/drivers/media/v4l2-core/videobuf2-vmalloc.c b/drivers/media/v4l2-core/videobuf2-vmalloc.c +index 3a7c80cd1a17..359fb9804d16 100644 +--- a/drivers/media/v4l2-core/videobuf2-vmalloc.c ++++ b/drivers/media/v4l2-core/videobuf2-vmalloc.c +@@ -106,7 +106,7 @@ static void *vb2_vmalloc_get_userptr(struct device *dev, unsigned long vaddr, + if (nums[i-1] + 1 != nums[i]) + goto fail_map; + buf->vaddr = (__force void *) +- ioremap_nocache(nums[0] << PAGE_SHIFT, size); ++ ioremap_nocache(__pfn_to_phys(nums[0]), size + offset); + } else { + buf->vaddr = vm_map_ram(frame_vector_pages(vec), n_pages, -1, + PAGE_KERNEL); +diff --git a/drivers/message/fusion/mptctl.c b/drivers/message/fusion/mptctl.c +index 7b3b41368931..cf6ce9f600ca 100644 +--- a/drivers/message/fusion/mptctl.c ++++ b/drivers/message/fusion/mptctl.c +@@ -2698,6 +2698,8 @@ mptctl_hp_targetinfo(unsigned long arg) + __FILE__, __LINE__, iocnum); + return -ENODEV; + } ++ if (karg.hdr.id >= MPT_MAX_FC_DEVICES) ++ return -EINVAL; + dctlprintk(ioc, printk(MYIOC_s_DEBUG_FMT "mptctl_hp_targetinfo called.\n", + ioc->name)); + +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index e61c99ef741d..c273a3ebb8e8 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -3007,6 +3007,7 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port) + mlx4_err(dev, "Failed to create file for port %d\n", port); + devlink_port_unregister(&info->devlink_port); + info->port = -1; ++ return err; + } + + sprintf(info->dev_mtu_name, "mlx4_port%d_mtu", port); +@@ -3028,9 +3029,10 @@ static int mlx4_init_port_info(struct mlx4_dev *dev, int port) + &info->port_attr); + devlink_port_unregister(&info->devlink_port); + info->port = -1; ++ return err; + } + +- return err; ++ return 0; + } + + static void mlx4_cleanup_port_info(struct mlx4_port_info *info) +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index 4f3afcf92a7c..01017dd88802 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -179,7 +179,7 @@ struct rndis_device { + + u8 hw_mac_adr[ETH_ALEN]; + u8 rss_key[NETVSC_HASH_KEYLEN]; +- u16 ind_table[ITAB_NUM]; ++ u16 rx_table[ITAB_NUM]; + }; + + +@@ -192,7 +192,7 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + const struct netvsc_device_info *info); + int netvsc_alloc_recv_comp_ring(struct netvsc_device *net_device, u32 q_idx); + void netvsc_device_remove(struct hv_device *device); +-int netvsc_send(struct net_device_context *ndc, ++int netvsc_send(struct net_device *net, + struct hv_netvsc_packet *packet, + struct rndis_message *rndis_msg, + struct hv_page_buffer *page_buffer, +@@ -208,7 +208,6 @@ void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + + void rndis_set_subchannel(struct work_struct *w); +-bool rndis_filter_opened(const struct netvsc_device *nvdev); + int rndis_filter_open(struct netvsc_device *nvdev); + int rndis_filter_close(struct netvsc_device *nvdev); + struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +@@ -659,6 +658,10 @@ struct nvsp_message { + #define NETVSC_RECEIVE_BUFFER_ID 0xcafe + #define NETVSC_SEND_BUFFER_ID 0 + ++#define NETVSC_SUPPORTED_HW_FEATURES (NETIF_F_RXCSUM | NETIF_F_IP_CSUM | \ ++ NETIF_F_TSO | NETIF_F_IPV6_CSUM | \ ++ NETIF_F_TSO6) ++ + #define VRSS_SEND_TAB_SIZE 16 /* must be power of 2 */ + #define VRSS_CHANNEL_MAX 64 + #define VRSS_CHANNEL_DEFAULT 8 +@@ -734,7 +737,7 @@ struct net_device_context { + + u32 tx_checksum_mask; + +- u32 tx_send_table[VRSS_SEND_TAB_SIZE]; ++ u32 tx_table[VRSS_SEND_TAB_SIZE]; + + /* Ethtool settings */ + bool udp4_l4_hash; +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index a6bafcf55776..99be63eacaeb 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -89,6 +89,11 @@ static void free_netvsc_device(struct rcu_head *head) + = container_of(head, struct netvsc_device, rcu); + int i; + ++ kfree(nvdev->extension); ++ vfree(nvdev->recv_buf); ++ vfree(nvdev->send_buf); ++ kfree(nvdev->send_section_map); ++ + for (i = 0; i < VRSS_CHANNEL_MAX; i++) + vfree(nvdev->chan_table[i].mrc.slots); + +@@ -100,12 +105,11 @@ static void free_netvsc_device_rcu(struct netvsc_device *nvdev) + call_rcu(&nvdev->rcu, free_netvsc_device); + } + +-static void netvsc_destroy_buf(struct hv_device *device) ++static void netvsc_revoke_recv_buf(struct hv_device *device, ++ struct netvsc_device *net_device) + { +- struct nvsp_message *revoke_packet; + struct net_device *ndev = hv_get_drvdata(device); +- struct net_device_context *ndc = netdev_priv(ndev); +- struct netvsc_device *net_device = rtnl_dereference(ndc->nvdev); ++ struct nvsp_message *revoke_packet; + int ret; + + /* +@@ -147,28 +151,14 @@ static void netvsc_destroy_buf(struct hv_device *device) + } + net_device->recv_section_cnt = 0; + } ++} + +- /* Teardown the gpadl on the vsp end */ +- if (net_device->recv_buf_gpadl_handle) { +- ret = vmbus_teardown_gpadl(device->channel, +- net_device->recv_buf_gpadl_handle); +- +- /* If we failed here, we might as well return and have a leak +- * rather than continue and a bugchk +- */ +- if (ret != 0) { +- netdev_err(ndev, +- "unable to teardown receive buffer's gpadl\n"); +- return; +- } +- net_device->recv_buf_gpadl_handle = 0; +- } +- +- if (net_device->recv_buf) { +- /* Free up the receive buffer */ +- vfree(net_device->recv_buf); +- net_device->recv_buf = NULL; +- } ++static void netvsc_revoke_send_buf(struct hv_device *device, ++ struct netvsc_device *net_device) ++{ ++ struct net_device *ndev = hv_get_drvdata(device); ++ struct nvsp_message *revoke_packet; ++ int ret; + + /* Deal with the send buffer we may have setup. + * If we got a send section size, it means we received a +@@ -210,7 +200,36 @@ static void netvsc_destroy_buf(struct hv_device *device) + } + net_device->send_section_cnt = 0; + } +- /* Teardown the gpadl on the vsp end */ ++} ++ ++static void netvsc_teardown_recv_gpadl(struct hv_device *device, ++ struct netvsc_device *net_device) ++{ ++ struct net_device *ndev = hv_get_drvdata(device); ++ int ret; ++ ++ if (net_device->recv_buf_gpadl_handle) { ++ ret = vmbus_teardown_gpadl(device->channel, ++ net_device->recv_buf_gpadl_handle); ++ ++ /* If we failed here, we might as well return and have a leak ++ * rather than continue and a bugchk ++ */ ++ if (ret != 0) { ++ netdev_err(ndev, ++ "unable to teardown receive buffer's gpadl\n"); ++ return; ++ } ++ net_device->recv_buf_gpadl_handle = 0; ++ } ++} ++ ++static void netvsc_teardown_send_gpadl(struct hv_device *device, ++ struct netvsc_device *net_device) ++{ ++ struct net_device *ndev = hv_get_drvdata(device); ++ int ret; ++ + if (net_device->send_buf_gpadl_handle) { + ret = vmbus_teardown_gpadl(device->channel, + net_device->send_buf_gpadl_handle); +@@ -225,12 +244,6 @@ static void netvsc_destroy_buf(struct hv_device *device) + } + net_device->send_buf_gpadl_handle = 0; + } +- if (net_device->send_buf) { +- /* Free up the send buffer */ +- vfree(net_device->send_buf); +- net_device->send_buf = NULL; +- } +- kfree(net_device->send_section_map); + } + + int netvsc_alloc_recv_comp_ring(struct netvsc_device *net_device, u32 q_idx) +@@ -425,7 +438,10 @@ static int netvsc_init_buf(struct hv_device *device, + goto exit; + + cleanup: +- netvsc_destroy_buf(device); ++ netvsc_revoke_recv_buf(device, net_device); ++ netvsc_revoke_send_buf(device, net_device); ++ netvsc_teardown_recv_gpadl(device, net_device); ++ netvsc_teardown_send_gpadl(device, net_device); + + exit: + return ret; +@@ -544,11 +560,6 @@ static int netvsc_connect_vsp(struct hv_device *device, + return ret; + } + +-static void netvsc_disconnect_vsp(struct hv_device *device) +-{ +- netvsc_destroy_buf(device); +-} +- + /* + * netvsc_device_remove - Callback when the root bus device is removed + */ +@@ -560,12 +571,24 @@ void netvsc_device_remove(struct hv_device *device) + = rtnl_dereference(net_device_ctx->nvdev); + int i; + +- cancel_work_sync(&net_device->subchan_work); ++ /* ++ * Revoke receive buffer. If host is pre-Win2016 then tear down ++ * receive buffer GPADL. Do the same for send buffer. ++ */ ++ netvsc_revoke_recv_buf(device, net_device); ++ if (vmbus_proto_version < VERSION_WIN10) ++ netvsc_teardown_recv_gpadl(device, net_device); + +- netvsc_disconnect_vsp(device); ++ netvsc_revoke_send_buf(device, net_device); ++ if (vmbus_proto_version < VERSION_WIN10) ++ netvsc_teardown_send_gpadl(device, net_device); + + RCU_INIT_POINTER(net_device_ctx->nvdev, NULL); + ++ /* And disassociate NAPI context from device */ ++ for (i = 0; i < net_device->num_chn; i++) ++ netif_napi_del(&net_device->chan_table[i].napi); ++ + /* + * At this point, no one should be accessing net_device + * except in here +@@ -575,9 +598,14 @@ void netvsc_device_remove(struct hv_device *device) + /* Now, we can close the channel safely */ + vmbus_close(device->channel); + +- /* And dissassociate NAPI context from device */ +- for (i = 0; i < net_device->num_chn; i++) +- netif_napi_del(&net_device->chan_table[i].napi); ++ /* ++ * If host is Win2016 or higher then we do the GPADL tear down ++ * here after VMBus is closed. ++ */ ++ if (vmbus_proto_version >= VERSION_WIN10) { ++ netvsc_teardown_recv_gpadl(device, net_device); ++ netvsc_teardown_send_gpadl(device, net_device); ++ } + + /* Release all resources */ + free_netvsc_device_rcu(net_device); +@@ -643,13 +671,18 @@ static void netvsc_send_tx_complete(struct netvsc_device *net_device, + queue_sends = + atomic_dec_return(&net_device->chan_table[q_idx].queue_sends); + +- if (net_device->destroy && queue_sends == 0) +- wake_up(&net_device->wait_drain); ++ if (unlikely(net_device->destroy)) { ++ if (queue_sends == 0) ++ wake_up(&net_device->wait_drain); ++ } else { ++ struct netdev_queue *txq = netdev_get_tx_queue(ndev, q_idx); + +- if (netif_tx_queue_stopped(netdev_get_tx_queue(ndev, q_idx)) && +- (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER || +- queue_sends < 1)) +- netif_tx_wake_queue(netdev_get_tx_queue(ndev, q_idx)); ++ if (netif_tx_queue_stopped(txq) && ++ (hv_ringbuf_avail_percent(&channel->outbound) > RING_AVAIL_PERCENT_HIWATER || ++ queue_sends < 1)) { ++ netif_tx_wake_queue(txq); ++ } ++ } + } + + static void netvsc_send_completion(struct netvsc_device *net_device, +@@ -697,13 +730,13 @@ static u32 netvsc_get_next_send_section(struct netvsc_device *net_device) + return NETVSC_INVALID_INDEX; + } + +-static u32 netvsc_copy_to_send_buf(struct netvsc_device *net_device, +- unsigned int section_index, +- u32 pend_size, +- struct hv_netvsc_packet *packet, +- struct rndis_message *rndis_msg, +- struct hv_page_buffer *pb, +- struct sk_buff *skb) ++static void netvsc_copy_to_send_buf(struct netvsc_device *net_device, ++ unsigned int section_index, ++ u32 pend_size, ++ struct hv_netvsc_packet *packet, ++ struct rndis_message *rndis_msg, ++ struct hv_page_buffer *pb, ++ bool xmit_more) + { + char *start = net_device->send_buf; + char *dest = start + (section_index * net_device->send_section_size) +@@ -716,7 +749,8 @@ static u32 netvsc_copy_to_send_buf(struct netvsc_device *net_device, + packet->page_buf_cnt; + + /* Add padding */ +- if (skb->xmit_more && remain && !packet->cp_partial) { ++ remain = packet->total_data_buflen & (net_device->pkt_align - 1); ++ if (xmit_more && remain) { + padding = net_device->pkt_align - remain; + rndis_msg->msg_len += padding; + packet->total_data_buflen += padding; +@@ -736,8 +770,6 @@ static u32 netvsc_copy_to_send_buf(struct netvsc_device *net_device, + memset(dest, 0, padding); + msg_size += padding; + } +- +- return msg_size; + } + + static inline int netvsc_send_pkt( +@@ -825,12 +857,13 @@ static inline void move_pkt_msd(struct hv_netvsc_packet **msd_send, + } + + /* RCU already held by caller */ +-int netvsc_send(struct net_device_context *ndev_ctx, ++int netvsc_send(struct net_device *ndev, + struct hv_netvsc_packet *packet, + struct rndis_message *rndis_msg, + struct hv_page_buffer *pb, + struct sk_buff *skb) + { ++ struct net_device_context *ndev_ctx = netdev_priv(ndev); + struct netvsc_device *net_device + = rcu_dereference_bh(ndev_ctx->nvdev); + struct hv_device *device = ndev_ctx->device_ctx; +@@ -841,20 +874,12 @@ int netvsc_send(struct net_device_context *ndev_ctx, + struct multi_send_data *msdp; + struct hv_netvsc_packet *msd_send = NULL, *cur_send = NULL; + struct sk_buff *msd_skb = NULL; +- bool try_batch; +- bool xmit_more = (skb != NULL) ? skb->xmit_more : false; ++ bool try_batch, xmit_more; + + /* If device is rescinded, return error and packet will get dropped. */ + if (unlikely(!net_device || net_device->destroy)) + return -ENODEV; + +- /* We may race with netvsc_connect_vsp()/netvsc_init_buf() and get +- * here before the negotiation with the host is finished and +- * send_section_map may not be allocated yet. +- */ +- if (unlikely(!net_device->send_section_map)) +- return -EAGAIN; +- + nvchan = &net_device->chan_table[packet->q_idx]; + packet->send_buf_index = NETVSC_INVALID_INDEX; + packet->cp_partial = false; +@@ -862,10 +887,8 @@ int netvsc_send(struct net_device_context *ndev_ctx, + /* Send control message directly without accessing msd (Multi-Send + * Data) field which may be changed during data packet processing. + */ +- if (!skb) { +- cur_send = packet; +- goto send_now; +- } ++ if (!skb) ++ return netvsc_send_pkt(device, packet, net_device, pb, skb); + + /* batch packets in send buffer if possible */ + msdp = &nvchan->msd; +@@ -893,10 +916,17 @@ int netvsc_send(struct net_device_context *ndev_ctx, + } + } + ++ /* Keep aggregating only if stack says more data is coming ++ * and not doing mixed modes send and not flow blocked ++ */ ++ xmit_more = skb->xmit_more && ++ !packet->cp_partial && ++ !netif_xmit_stopped(netdev_get_tx_queue(ndev, packet->q_idx)); ++ + if (section_index != NETVSC_INVALID_INDEX) { + netvsc_copy_to_send_buf(net_device, + section_index, msd_len, +- packet, rndis_msg, pb, skb); ++ packet, rndis_msg, pb, xmit_more); + + packet->send_buf_index = section_index; + +@@ -916,7 +946,7 @@ int netvsc_send(struct net_device_context *ndev_ctx, + if (msdp->skb) + dev_consume_skb_any(msdp->skb); + +- if (xmit_more && !packet->cp_partial) { ++ if (xmit_more) { + msdp->skb = skb; + msdp->pkt = packet; + msdp->count++; +@@ -942,7 +972,6 @@ int netvsc_send(struct net_device_context *ndev_ctx, + } + } + +-send_now: + if (cur_send) + ret = netvsc_send_pkt(device, cur_send, net_device, pb, skb); + +@@ -1107,7 +1136,7 @@ static void netvsc_send_table(struct hv_device *hdev, + nvmsg->msg.v5_msg.send_table.offset); + + for (i = 0; i < count; i++) +- net_device_ctx->tx_send_table[i] = tab[i]; ++ net_device_ctx->tx_table[i] = tab[i]; + } + + static void netvsc_send_vf(struct net_device_context *net_device_ctx, +@@ -1206,9 +1235,10 @@ int netvsc_poll(struct napi_struct *napi, int budget) + if (send_recv_completions(ndev, net_device, nvchan) == 0 && + work_done < budget && + napi_complete_done(napi, work_done) && +- hv_end_read(&channel->inbound)) { ++ hv_end_read(&channel->inbound) && ++ napi_schedule_prep(napi)) { + hv_begin_read(&channel->inbound); +- napi_reschedule(napi); ++ __napi_schedule(napi); + } + + /* Driver may overshoot since multiple packets per descriptor */ +@@ -1252,6 +1282,9 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + if (!net_device) + return ERR_PTR(-ENOMEM); + ++ for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) ++ net_device_ctx->tx_table[i] = 0; ++ + net_device->ring_size = ring_size; + + /* Because the device uses NAPI, all the interrupt batching and +@@ -1286,7 +1319,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + net_device->chan_table); + + if (ret != 0) { +- netif_napi_del(&net_device->chan_table[0].napi); + netdev_err(ndev, "unable to open channel: %d\n", ret); + goto cleanup; + } +@@ -1296,11 +1328,6 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + + napi_enable(&net_device->chan_table[0].napi); + +- /* Writing nvdev pointer unlocks netvsc_send(), make sure chn_table is +- * populated. +- */ +- rcu_assign_pointer(net_device_ctx->nvdev, net_device); +- + /* Connect with the NetVsp */ + ret = netvsc_connect_vsp(device, net_device, device_info); + if (ret != 0) { +@@ -1309,6 +1336,11 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + goto close; + } + ++ /* Writing nvdev pointer unlocks netvsc_send(), make sure chn_table is ++ * populated. ++ */ ++ rcu_assign_pointer(net_device_ctx->nvdev, net_device); ++ + return net_device; + + close: +@@ -1319,6 +1351,7 @@ struct netvsc_device *netvsc_device_add(struct hv_device *device, + vmbus_close(device->channel); + + cleanup: ++ netif_napi_del(&net_device->chan_table[0].napi); + free_netvsc_device(&net_device->rcu); + + return ERR_PTR(ret); +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 444e560d928b..11b46c8d2d67 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -45,7 +45,10 @@ + + #include "hyperv_net.h" + +-#define RING_SIZE_MIN 64 ++#define RING_SIZE_MIN 64 ++#define RETRY_US_LO 5000 ++#define RETRY_US_HI 10000 ++#define RETRY_MAX 2000 /* >10 sec */ + + #define LINKCHANGE_INT (2 * HZ) + #define VF_TAKEOVER_INT (HZ / 10) +@@ -88,10 +91,7 @@ static int netvsc_open(struct net_device *net) + return ret; + } + +- netif_tx_wake_all_queues(net); +- + rdev = nvdev->extension; +- + if (!rdev->link_state) + netif_carrier_on(net); + +@@ -109,36 +109,25 @@ static int netvsc_open(struct net_device *net) + return 0; + } + +-static int netvsc_close(struct net_device *net) ++static int netvsc_wait_until_empty(struct netvsc_device *nvdev) + { +- struct net_device_context *net_device_ctx = netdev_priv(net); +- struct net_device *vf_netdev +- = rtnl_dereference(net_device_ctx->vf_netdev); +- struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); +- int ret = 0; +- u32 aread, i, msec = 10, retry = 0, retry_max = 20; +- struct vmbus_channel *chn; +- +- netif_tx_disable(net); +- +- /* No need to close rndis filter if it is removed already */ +- if (!nvdev) +- goto out; +- +- ret = rndis_filter_close(nvdev); +- if (ret != 0) { +- netdev_err(net, "unable to close device (ret %d).\n", ret); +- return ret; +- } ++ unsigned int retry = 0; ++ int i; + + /* Ensure pending bytes in ring are read */ +- while (true) { +- aread = 0; ++ for (;;) { ++ u32 aread = 0; ++ + for (i = 0; i < nvdev->num_chn; i++) { +- chn = nvdev->chan_table[i].channel; ++ struct vmbus_channel *chn ++ = nvdev->chan_table[i].channel; ++ + if (!chn) + continue; + ++ /* make sure receive not running now */ ++ napi_synchronize(&nvdev->chan_table[i].napi); ++ + aread = hv_get_bytes_to_read(&chn->inbound); + if (aread) + break; +@@ -148,22 +137,40 @@ static int netvsc_close(struct net_device *net) + break; + } + +- retry++; +- if (retry > retry_max || aread == 0) +- break; ++ if (aread == 0) ++ return 0; + +- msleep(msec); ++ if (++retry > RETRY_MAX) ++ return -ETIMEDOUT; + +- if (msec < 1000) +- msec *= 2; ++ usleep_range(RETRY_US_LO, RETRY_US_HI); + } ++} + +- if (aread) { +- netdev_err(net, "Ring buffer not empty after closing rndis\n"); +- ret = -ETIMEDOUT; ++static int netvsc_close(struct net_device *net) ++{ ++ struct net_device_context *net_device_ctx = netdev_priv(net); ++ struct net_device *vf_netdev ++ = rtnl_dereference(net_device_ctx->vf_netdev); ++ struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); ++ int ret; ++ ++ netif_tx_disable(net); ++ ++ /* No need to close rndis filter if it is removed already */ ++ if (!nvdev) ++ return 0; ++ ++ ret = rndis_filter_close(nvdev); ++ if (ret != 0) { ++ netdev_err(net, "unable to close device (ret %d).\n", ret); ++ return ret; + } + +-out: ++ ret = netvsc_wait_until_empty(nvdev); ++ if (ret) ++ netdev_err(net, "Ring buffer not empty after closing rndis\n"); ++ + if (vf_netdev) + dev_close(vf_netdev); + +@@ -234,8 +241,8 @@ static inline int netvsc_get_tx_queue(struct net_device *ndev, + struct sock *sk = skb->sk; + int q_idx; + +- q_idx = ndc->tx_send_table[netvsc_get_hash(skb, ndc) & +- (VRSS_SEND_TAB_SIZE - 1)]; ++ q_idx = ndc->tx_table[netvsc_get_hash(skb, ndc) & ++ (VRSS_SEND_TAB_SIZE - 1)]; + + /* If queue index changed record the new value */ + if (q_idx != old_idx && +@@ -284,8 +291,19 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb, + rcu_read_lock(); + vf_netdev = rcu_dereference(ndc->vf_netdev); + if (vf_netdev) { +- txq = skb_rx_queue_recorded(skb) ? skb_get_rx_queue(skb) : 0; +- qdisc_skb_cb(skb)->slave_dev_queue_mapping = skb->queue_mapping; ++ const struct net_device_ops *vf_ops = vf_netdev->netdev_ops; ++ ++ if (vf_ops->ndo_select_queue) ++ txq = vf_ops->ndo_select_queue(vf_netdev, skb, ++ accel_priv, fallback); ++ else ++ txq = fallback(vf_netdev, skb); ++ ++ /* Record the queue selected by VF so that it can be ++ * used for common case where VF has more queues than ++ * the synthetic device. ++ */ ++ qdisc_skb_cb(skb)->slave_dev_queue_mapping = txq; + } else { + txq = netvsc_pick_tx(ndev, skb); + } +@@ -614,7 +632,7 @@ static int netvsc_start_xmit(struct sk_buff *skb, struct net_device *net) + /* timestamp packet in software */ + skb_tx_timestamp(skb); + +- ret = netvsc_send(net_device_ctx, packet, rndis_msg, pb, skb); ++ ret = netvsc_send(net, packet, rndis_msg, pb, skb); + if (likely(ret == 0)) + return NETDEV_TX_OK; + +@@ -810,16 +828,81 @@ static void netvsc_get_channels(struct net_device *net, + } + } + ++static int netvsc_detach(struct net_device *ndev, ++ struct netvsc_device *nvdev) ++{ ++ struct net_device_context *ndev_ctx = netdev_priv(ndev); ++ struct hv_device *hdev = ndev_ctx->device_ctx; ++ int ret; ++ ++ /* Don't try continuing to try and setup sub channels */ ++ if (cancel_work_sync(&nvdev->subchan_work)) ++ nvdev->num_chn = 1; ++ ++ /* If device was up (receiving) then shutdown */ ++ if (netif_running(ndev)) { ++ netif_tx_disable(ndev); ++ ++ ret = rndis_filter_close(nvdev); ++ if (ret) { ++ netdev_err(ndev, ++ "unable to close device (ret %d).\n", ret); ++ return ret; ++ } ++ ++ ret = netvsc_wait_until_empty(nvdev); ++ if (ret) { ++ netdev_err(ndev, ++ "Ring buffer not empty after closing rndis\n"); ++ return ret; ++ } ++ } ++ ++ netif_device_detach(ndev); ++ ++ rndis_filter_device_remove(hdev, nvdev); ++ ++ return 0; ++} ++ ++static int netvsc_attach(struct net_device *ndev, ++ struct netvsc_device_info *dev_info) ++{ ++ struct net_device_context *ndev_ctx = netdev_priv(ndev); ++ struct hv_device *hdev = ndev_ctx->device_ctx; ++ struct netvsc_device *nvdev; ++ struct rndis_device *rdev; ++ int ret; ++ ++ nvdev = rndis_filter_device_add(hdev, dev_info); ++ if (IS_ERR(nvdev)) ++ return PTR_ERR(nvdev); ++ ++ /* Note: enable and attach happen when sub-channels setup */ ++ ++ netif_carrier_off(ndev); ++ ++ if (netif_running(ndev)) { ++ ret = rndis_filter_open(nvdev); ++ if (ret) ++ return ret; ++ ++ rdev = nvdev->extension; ++ if (!rdev->link_state) ++ netif_carrier_on(ndev); ++ } ++ ++ return 0; ++} ++ + static int netvsc_set_channels(struct net_device *net, + struct ethtool_channels *channels) + { + struct net_device_context *net_device_ctx = netdev_priv(net); +- struct hv_device *dev = net_device_ctx->device_ctx; + struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); + unsigned int orig, count = channels->combined_count; + struct netvsc_device_info device_info; +- bool was_opened; +- int ret = 0; ++ int ret; + + /* We do not support separate count for rx, tx, or other */ + if (count == 0 || +@@ -836,9 +919,6 @@ static int netvsc_set_channels(struct net_device *net, + return -EINVAL; + + orig = nvdev->num_chn; +- was_opened = rndis_filter_opened(nvdev); +- if (was_opened) +- rndis_filter_close(nvdev); + + memset(&device_info, 0, sizeof(device_info)); + device_info.num_chn = count; +@@ -848,28 +928,17 @@ static int netvsc_set_channels(struct net_device *net, + device_info.recv_sections = nvdev->recv_section_cnt; + device_info.recv_section_size = nvdev->recv_section_size; + +- rndis_filter_device_remove(dev, nvdev); ++ ret = netvsc_detach(net, nvdev); ++ if (ret) ++ return ret; + +- nvdev = rndis_filter_device_add(dev, &device_info); +- if (IS_ERR(nvdev)) { +- ret = PTR_ERR(nvdev); ++ ret = netvsc_attach(net, &device_info); ++ if (ret) { + device_info.num_chn = orig; +- nvdev = rndis_filter_device_add(dev, &device_info); +- +- if (IS_ERR(nvdev)) { +- netdev_err(net, "restoring channel setting failed: %ld\n", +- PTR_ERR(nvdev)); +- return ret; +- } ++ if (netvsc_attach(net, &device_info)) ++ netdev_err(net, "restoring channel setting failed\n"); + } + +- if (was_opened) +- rndis_filter_open(nvdev); +- +- /* We may have missed link change notifications */ +- net_device_ctx->last_reconfig = 0; +- schedule_delayed_work(&net_device_ctx->dwork, 0); +- + return ret; + } + +@@ -936,10 +1005,8 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + struct net_device_context *ndevctx = netdev_priv(ndev); + struct net_device *vf_netdev = rtnl_dereference(ndevctx->vf_netdev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); +- struct hv_device *hdev = ndevctx->device_ctx; + int orig_mtu = ndev->mtu; + struct netvsc_device_info device_info; +- bool was_opened; + int ret = 0; + + if (!nvdev || nvdev->destroy) +@@ -952,11 +1019,6 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + return ret; + } + +- netif_device_detach(ndev); +- was_opened = rndis_filter_opened(nvdev); +- if (was_opened) +- rndis_filter_close(nvdev); +- + memset(&device_info, 0, sizeof(device_info)); + device_info.ring_size = ring_size; + device_info.num_chn = nvdev->num_chn; +@@ -965,35 +1027,27 @@ static int netvsc_change_mtu(struct net_device *ndev, int mtu) + device_info.recv_sections = nvdev->recv_section_cnt; + device_info.recv_section_size = nvdev->recv_section_size; + +- rndis_filter_device_remove(hdev, nvdev); ++ ret = netvsc_detach(ndev, nvdev); ++ if (ret) ++ goto rollback_vf; + + ndev->mtu = mtu; + +- nvdev = rndis_filter_device_add(hdev, &device_info); +- if (IS_ERR(nvdev)) { +- ret = PTR_ERR(nvdev); +- +- /* Attempt rollback to original MTU */ +- ndev->mtu = orig_mtu; +- nvdev = rndis_filter_device_add(hdev, &device_info); +- +- if (vf_netdev) +- dev_set_mtu(vf_netdev, orig_mtu); +- +- if (IS_ERR(nvdev)) { +- netdev_err(ndev, "restoring mtu failed: %ld\n", +- PTR_ERR(nvdev)); +- return ret; +- } +- } ++ ret = netvsc_attach(ndev, &device_info); ++ if (ret) ++ goto rollback; + +- if (was_opened) +- rndis_filter_open(nvdev); ++ return 0; + +- netif_device_attach(ndev); ++rollback: ++ /* Attempt rollback to original MTU */ ++ ndev->mtu = orig_mtu; + +- /* We may have missed link change notifications */ +- schedule_delayed_work(&ndevctx->dwork, 0); ++ if (netvsc_attach(ndev, &device_info)) ++ netdev_err(ndev, "restoring mtu failed\n"); ++rollback_vf: ++ if (vf_netdev) ++ dev_set_mtu(vf_netdev, orig_mtu); + + return ret; + } +@@ -1378,7 +1432,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key, + rndis_dev = ndev->extension; + if (indir) { + for (i = 0; i < ITAB_NUM; i++) +- indir[i] = rndis_dev->ind_table[i]; ++ indir[i] = rndis_dev->rx_table[i]; + } + + if (key) +@@ -1408,7 +1462,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, + return -EINVAL; + + for (i = 0; i < ITAB_NUM; i++) +- rndis_dev->ind_table[i] = indir[i]; ++ rndis_dev->rx_table[i] = indir[i]; + } + + if (!key) { +@@ -1459,11 +1513,9 @@ static int netvsc_set_ringparam(struct net_device *ndev, + { + struct net_device_context *ndevctx = netdev_priv(ndev); + struct netvsc_device *nvdev = rtnl_dereference(ndevctx->nvdev); +- struct hv_device *hdev = ndevctx->device_ctx; + struct netvsc_device_info device_info; + struct ethtool_ringparam orig; + u32 new_tx, new_rx; +- bool was_opened; + int ret = 0; + + if (!nvdev || nvdev->destroy) +@@ -1489,34 +1541,18 @@ static int netvsc_set_ringparam(struct net_device *ndev, + device_info.recv_sections = new_rx; + device_info.recv_section_size = nvdev->recv_section_size; + +- netif_device_detach(ndev); +- was_opened = rndis_filter_opened(nvdev); +- if (was_opened) +- rndis_filter_close(nvdev); +- +- rndis_filter_device_remove(hdev, nvdev); +- +- nvdev = rndis_filter_device_add(hdev, &device_info); +- if (IS_ERR(nvdev)) { +- ret = PTR_ERR(nvdev); ++ ret = netvsc_detach(ndev, nvdev); ++ if (ret) ++ return ret; + ++ ret = netvsc_attach(ndev, &device_info); ++ if (ret) { + device_info.send_sections = orig.tx_pending; + device_info.recv_sections = orig.rx_pending; +- nvdev = rndis_filter_device_add(hdev, &device_info); +- if (IS_ERR(nvdev)) { +- netdev_err(ndev, "restoring ringparam failed: %ld\n", +- PTR_ERR(nvdev)); +- return ret; +- } +- } +- +- if (was_opened) +- rndis_filter_open(nvdev); +- netif_device_attach(ndev); + +- /* We may have missed link change notifications */ +- ndevctx->last_reconfig = 0; +- schedule_delayed_work(&ndevctx->dwork, 0); ++ if (netvsc_attach(ndev, &device_info)) ++ netdev_err(ndev, "restoring ringparam failed"); ++ } + + return ret; + } +@@ -1932,6 +1968,12 @@ static int netvsc_probe(struct hv_device *dev, + /* We always need headroom for rndis header */ + net->needed_headroom = RNDIS_AND_PPI_SIZE; + ++ /* Initialize the number of queues to be 1, we may change it if more ++ * channels are offered later. ++ */ ++ netif_set_real_num_tx_queues(net, 1); ++ netif_set_real_num_rx_queues(net, 1); ++ + /* Notify the netvsc driver of the new device */ + memset(&device_info, 0, sizeof(device_info)); + device_info.ring_size = ring_size; +@@ -1950,7 +1992,7 @@ static int netvsc_probe(struct hv_device *dev, + + memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); + +- /* hw_features computed in rndis_filter_device_add */ ++ /* hw_features computed in rndis_netdev_set_hwcaps() */ + net->features = net->hw_features | + NETIF_F_HIGHDMA | NETIF_F_SG | + NETIF_F_HW_VLAN_CTAG_TX | NETIF_F_HW_VLAN_CTAG_RX; +@@ -1987,8 +2029,8 @@ static int netvsc_probe(struct hv_device *dev, + static int netvsc_remove(struct hv_device *dev) + { + struct net_device_context *ndev_ctx; +- struct net_device *vf_netdev; +- struct net_device *net; ++ struct net_device *vf_netdev, *net; ++ struct netvsc_device *nvdev; + + net = hv_get_drvdata(dev); + if (net == NULL) { +@@ -1998,10 +2040,14 @@ static int netvsc_remove(struct hv_device *dev) + + ndev_ctx = netdev_priv(net); + +- netif_device_detach(net); +- + cancel_delayed_work_sync(&ndev_ctx->dwork); + ++ rcu_read_lock(); ++ nvdev = rcu_dereference(ndev_ctx->nvdev); ++ ++ if (nvdev) ++ cancel_work_sync(&nvdev->subchan_work); ++ + /* + * Call to the vsc driver to let it know that the device is being + * removed. Also blocks mtu and channel changes. +@@ -2011,11 +2057,13 @@ static int netvsc_remove(struct hv_device *dev) + if (vf_netdev) + netvsc_unregister_vf(vf_netdev); + ++ if (nvdev) ++ rndis_filter_device_remove(dev, nvdev); ++ + unregister_netdevice(net); + +- rndis_filter_device_remove(dev, +- rtnl_dereference(ndev_ctx->nvdev)); + rtnl_unlock(); ++ rcu_read_unlock(); + + hv_set_drvdata(dev, NULL); + +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 065b204d8e17..6dde92c1c113 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -217,7 +217,6 @@ static int rndis_filter_send_request(struct rndis_device *dev, + struct hv_netvsc_packet *packet; + struct hv_page_buffer page_buf[2]; + struct hv_page_buffer *pb = page_buf; +- struct net_device_context *net_device_ctx = netdev_priv(dev->ndev); + int ret; + + /* Setup the packet to send it */ +@@ -245,7 +244,7 @@ static int rndis_filter_send_request(struct rndis_device *dev, + } + + rcu_read_lock_bh(); +- ret = netvsc_send(net_device_ctx, packet, NULL, pb, NULL); ++ ret = netvsc_send(dev->ndev, packet, NULL, pb, NULL); + rcu_read_unlock_bh(); + + return ret; +@@ -267,13 +266,23 @@ static void rndis_set_link_state(struct rndis_device *rdev, + } + } + +-static void rndis_filter_receive_response(struct rndis_device *dev, +- struct rndis_message *resp) ++static void rndis_filter_receive_response(struct net_device *ndev, ++ struct netvsc_device *nvdev, ++ const struct rndis_message *resp) + { ++ struct rndis_device *dev = nvdev->extension; + struct rndis_request *request = NULL; + bool found = false; + unsigned long flags; +- struct net_device *ndev = dev->ndev; ++ ++ /* This should never happen, it means control message ++ * response received after device removed. ++ */ ++ if (dev->state == RNDIS_DEV_UNINITIALIZED) { ++ netdev_err(ndev, ++ "got rndis message uninitialized\n"); ++ return; ++ } + + spin_lock_irqsave(&dev->request_lock, flags); + list_for_each_entry(request, &dev->req_list, list_ent) { +@@ -354,7 +363,7 @@ static inline void *rndis_get_ppi(struct rndis_packet *rpkt, u32 type) + } + + static int rndis_filter_receive_data(struct net_device *ndev, +- struct rndis_device *dev, ++ struct netvsc_device *nvdev, + struct rndis_message *msg, + struct vmbus_channel *channel, + void *data, u32 data_buflen) +@@ -374,7 +383,7 @@ static int rndis_filter_receive_data(struct net_device *ndev, + * should be the data packet size plus the trailer padding size + */ + if (unlikely(data_buflen < rndis_pkt->data_len)) { +- netdev_err(dev->ndev, "rndis message buffer " ++ netdev_err(ndev, "rndis message buffer " + "overflow detected (got %u, min %u)" + "...dropping this message!\n", + data_buflen, rndis_pkt->data_len); +@@ -402,34 +411,20 @@ int rndis_filter_receive(struct net_device *ndev, + void *data, u32 buflen) + { + struct net_device_context *net_device_ctx = netdev_priv(ndev); +- struct rndis_device *rndis_dev = net_dev->extension; + struct rndis_message *rndis_msg = data; + +- /* Make sure the rndis device state is initialized */ +- if (unlikely(!rndis_dev)) { +- netif_err(net_device_ctx, rx_err, ndev, +- "got rndis message but no rndis device!\n"); +- return NVSP_STAT_FAIL; +- } +- +- if (unlikely(rndis_dev->state == RNDIS_DEV_UNINITIALIZED)) { +- netif_err(net_device_ctx, rx_err, ndev, +- "got rndis message uninitialized\n"); +- return NVSP_STAT_FAIL; +- } +- + if (netif_msg_rx_status(net_device_ctx)) + dump_rndis_message(dev, rndis_msg); + + switch (rndis_msg->ndis_msg_type) { + case RNDIS_MSG_PACKET: +- return rndis_filter_receive_data(ndev, rndis_dev, rndis_msg, ++ return rndis_filter_receive_data(ndev, net_dev, rndis_msg, + channel, data, buflen); + case RNDIS_MSG_INIT_C: + case RNDIS_MSG_QUERY_C: + case RNDIS_MSG_SET_C: + /* completion msgs */ +- rndis_filter_receive_response(rndis_dev, rndis_msg); ++ rndis_filter_receive_response(ndev, net_dev, rndis_msg); + break; + + case RNDIS_MSG_INDICATE: +@@ -759,7 +754,7 @@ int rndis_filter_set_rss_param(struct rndis_device *rdev, + /* Set indirection table entries */ + itab = (u32 *)(rssp + 1); + for (i = 0; i < ITAB_NUM; i++) +- itab[i] = rdev->ind_table[i]; ++ itab[i] = rdev->rx_table[i]; + + /* Set hask key values */ + keyp = (u8 *)((unsigned long)rssp + rssp->kashkey_offset); +@@ -1114,6 +1109,10 @@ void rndis_set_subchannel(struct work_struct *w) + netif_set_real_num_tx_queues(ndev, nvdev->num_chn); + netif_set_real_num_rx_queues(ndev, nvdev->num_chn); + ++ for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) ++ ndev_ctx->tx_table[i] = i % nvdev->num_chn; ++ ++ netif_device_attach(ndev); + rtnl_unlock(); + return; + +@@ -1124,73 +1123,26 @@ void rndis_set_subchannel(struct work_struct *w) + + nvdev->max_chn = 1; + nvdev->num_chn = 1; ++ ++ netif_device_attach(ndev); + unlock: + rtnl_unlock(); + } + +-struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +- struct netvsc_device_info *device_info) ++static int rndis_netdev_set_hwcaps(struct rndis_device *rndis_device, ++ struct netvsc_device *nvdev) + { +- struct net_device *net = hv_get_drvdata(dev); ++ struct net_device *net = rndis_device->ndev; + struct net_device_context *net_device_ctx = netdev_priv(net); +- struct netvsc_device *net_device; +- struct rndis_device *rndis_device; + struct ndis_offload hwcaps; + struct ndis_offload_params offloads; +- struct ndis_recv_scale_cap rsscap; +- u32 rsscap_size = sizeof(struct ndis_recv_scale_cap); + unsigned int gso_max_size = GSO_MAX_SIZE; +- u32 mtu, size; +- const struct cpumask *node_cpu_mask; +- u32 num_possible_rss_qs; +- int i, ret; +- +- rndis_device = get_rndis_device(); +- if (!rndis_device) +- return ERR_PTR(-ENODEV); +- +- /* +- * Let the inner driver handle this first to create the netvsc channel +- * NOTE! Once the channel is created, we may get a receive callback +- * (RndisFilterOnReceive()) before this call is completed +- */ +- net_device = netvsc_device_add(dev, device_info); +- if (IS_ERR(net_device)) { +- kfree(rndis_device); +- return net_device; +- } +- +- /* Initialize the rndis device */ +- net_device->max_chn = 1; +- net_device->num_chn = 1; +- +- net_device->extension = rndis_device; +- rndis_device->ndev = net; +- +- /* Send the rndis initialization message */ +- ret = rndis_filter_init_device(rndis_device, net_device); +- if (ret != 0) +- goto err_dev_remv; +- +- /* Get the MTU from the host */ +- size = sizeof(u32); +- ret = rndis_filter_query_device(rndis_device, net_device, +- RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE, +- &mtu, &size); +- if (ret == 0 && size == sizeof(u32) && mtu < net->mtu) +- net->mtu = mtu; +- +- /* Get the mac address */ +- ret = rndis_filter_query_device_mac(rndis_device, net_device); +- if (ret != 0) +- goto err_dev_remv; +- +- memcpy(device_info->mac_adr, rndis_device->hw_mac_adr, ETH_ALEN); ++ int ret; + + /* Find HW offload capabilities */ +- ret = rndis_query_hwcaps(rndis_device, net_device, &hwcaps); ++ ret = rndis_query_hwcaps(rndis_device, nvdev, &hwcaps); + if (ret != 0) +- goto err_dev_remv; ++ return ret; + + /* A value of zero means "no change"; now turn on what we want. */ + memset(&offloads, 0, sizeof(struct ndis_offload_params)); +@@ -1198,8 +1150,12 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + /* Linux does not care about IP checksum, always does in kernel */ + offloads.ip_v4_csum = NDIS_OFFLOAD_PARAMETERS_TX_RX_DISABLED; + ++ /* Reset previously set hw_features flags */ ++ net->hw_features &= ~NETVSC_SUPPORTED_HW_FEATURES; ++ net_device_ctx->tx_checksum_mask = 0; ++ + /* Compute tx offload settings based on hw capabilities */ +- net->hw_features = NETIF_F_RXCSUM; ++ net->hw_features |= NETIF_F_RXCSUM; + + if ((hwcaps.csum.ip4_txcsum & NDIS_TXCSUM_ALL_TCP4) == NDIS_TXCSUM_ALL_TCP4) { + /* Can checksum TCP */ +@@ -1243,10 +1199,74 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + } + } + ++ /* In case some hw_features disappeared we need to remove them from ++ * net->features list as they're no longer supported. ++ */ ++ net->features &= ~NETVSC_SUPPORTED_HW_FEATURES | net->hw_features; ++ + netif_set_gso_max_size(net, gso_max_size); + +- ret = rndis_filter_set_offload_params(net, net_device, &offloads); +- if (ret) ++ ret = rndis_filter_set_offload_params(net, nvdev, &offloads); ++ ++ return ret; ++} ++ ++struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, ++ struct netvsc_device_info *device_info) ++{ ++ struct net_device *net = hv_get_drvdata(dev); ++ struct netvsc_device *net_device; ++ struct rndis_device *rndis_device; ++ struct ndis_recv_scale_cap rsscap; ++ u32 rsscap_size = sizeof(struct ndis_recv_scale_cap); ++ u32 mtu, size; ++ u32 num_possible_rss_qs; ++ int i, ret; ++ ++ rndis_device = get_rndis_device(); ++ if (!rndis_device) ++ return ERR_PTR(-ENODEV); ++ ++ /* Let the inner driver handle this first to create the netvsc channel ++ * NOTE! Once the channel is created, we may get a receive callback ++ * (RndisFilterOnReceive()) before this call is completed ++ */ ++ net_device = netvsc_device_add(dev, device_info); ++ if (IS_ERR(net_device)) { ++ kfree(rndis_device); ++ return net_device; ++ } ++ ++ /* Initialize the rndis device */ ++ net_device->max_chn = 1; ++ net_device->num_chn = 1; ++ ++ net_device->extension = rndis_device; ++ rndis_device->ndev = net; ++ ++ /* Send the rndis initialization message */ ++ ret = rndis_filter_init_device(rndis_device, net_device); ++ if (ret != 0) ++ goto err_dev_remv; ++ ++ /* Get the MTU from the host */ ++ size = sizeof(u32); ++ ret = rndis_filter_query_device(rndis_device, net_device, ++ RNDIS_OID_GEN_MAXIMUM_FRAME_SIZE, ++ &mtu, &size); ++ if (ret == 0 && size == sizeof(u32) && mtu < net->mtu) ++ net->mtu = mtu; ++ ++ /* Get the mac address */ ++ ret = rndis_filter_query_device_mac(rndis_device, net_device); ++ if (ret != 0) ++ goto err_dev_remv; ++ ++ memcpy(device_info->mac_adr, rndis_device->hw_mac_adr, ETH_ALEN); ++ ++ /* Query and set hardware capabilities */ ++ ret = rndis_netdev_set_hwcaps(rndis_device, net_device); ++ if (ret != 0) + goto err_dev_remv; + + rndis_filter_query_device_link_status(rndis_device, net_device); +@@ -1256,7 +1276,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + rndis_device->link_state ? "down" : "up"); + + if (net_device->nvsp_version < NVSP_PROTOCOL_VERSION_5) +- return net_device; ++ goto out; + + rndis_filter_query_link_speed(rndis_device, net_device); + +@@ -1268,14 +1288,8 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + if (ret || rsscap.num_recv_que < 2) + goto out; + +- /* +- * We will limit the VRSS channels to the number CPUs in the NUMA node +- * the primary channel is currently bound to. +- * +- * This also guarantees that num_possible_rss_qs <= num_online_cpus +- */ +- node_cpu_mask = cpumask_of_node(cpu_to_node(dev->channel->target_cpu)); +- num_possible_rss_qs = min_t(u32, cpumask_weight(node_cpu_mask), ++ /* This guarantees that num_possible_rss_qs <= num_online_cpus */ ++ num_possible_rss_qs = min_t(u32, num_online_cpus(), + rsscap.num_recv_que); + + net_device->max_chn = min_t(u32, VRSS_CHANNEL_MAX, num_possible_rss_qs); +@@ -1284,8 +1298,8 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + net_device->num_chn = min(net_device->max_chn, device_info->num_chn); + + for (i = 0; i < ITAB_NUM; i++) +- rndis_device->ind_table[i] = ethtool_rxfh_indir_default(i, +- net_device->num_chn); ++ rndis_device->rx_table[i] = ethtool_rxfh_indir_default( ++ i, net_device->num_chn); + + atomic_set(&net_device->open_chn, 1); + vmbus_set_sc_create_callback(dev->channel, netvsc_sc_open); +@@ -1313,6 +1327,10 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + net_device->num_chn = 1; + } + ++ /* No sub channels, device is ready */ ++ if (net_device->num_chn == 1) ++ netif_device_attach(net); ++ + return net_device; + + err_dev_remv: +@@ -1331,7 +1349,6 @@ void rndis_filter_device_remove(struct hv_device *dev, + net_dev->extension = NULL; + + netvsc_device_remove(dev); +- kfree(rndis_dev); + } + + int rndis_filter_open(struct netvsc_device *nvdev) +@@ -1355,8 +1372,3 @@ int rndis_filter_close(struct netvsc_device *nvdev) + + return rndis_filter_close_device(nvdev->extension); + } +- +-bool rndis_filter_opened(const struct netvsc_device *nvdev) +-{ +- return atomic_read(&nvdev->open_cnt) > 0; +-} +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 2f828eb9ace6..e522085ecbf7 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1105,6 +1105,9 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ ++ {QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */ ++ {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */ ++ {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */ + {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */ + {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */ + {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */ +@@ -1241,6 +1244,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */ + {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */ + {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ ++ {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ + {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ + {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 42baad125a7d..32fc69539126 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -315,6 +315,7 @@ static void __usbnet_status_stop_force(struct usbnet *dev) + void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb) + { + struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64); ++ unsigned long flags; + int status; + + if (test_bit(EVENT_RX_PAUSED, &dev->flags)) { +@@ -326,10 +327,10 @@ void usbnet_skb_return (struct usbnet *dev, struct sk_buff *skb) + if (skb->protocol == 0) + skb->protocol = eth_type_trans (skb, dev->net); + +- u64_stats_update_begin(&stats64->syncp); ++ flags = u64_stats_update_begin_irqsave(&stats64->syncp); + stats64->rx_packets++; + stats64->rx_bytes += skb->len; +- u64_stats_update_end(&stats64->syncp); ++ u64_stats_update_end_irqrestore(&stats64->syncp, flags); + + netif_dbg(dev, rx_status, dev->net, "< rx, len %zu, type 0x%x\n", + skb->len + sizeof (struct ethhdr), skb->protocol); +@@ -1250,11 +1251,12 @@ static void tx_complete (struct urb *urb) + + if (urb->status == 0) { + struct pcpu_sw_netstats *stats64 = this_cpu_ptr(dev->stats64); ++ unsigned long flags; + +- u64_stats_update_begin(&stats64->syncp); ++ flags = u64_stats_update_begin_irqsave(&stats64->syncp); + stats64->tx_packets += entry->packets; + stats64->tx_bytes += entry->length; +- u64_stats_update_end(&stats64->syncp); ++ u64_stats_update_end_irqrestore(&stats64->syncp, flags); + } else { + dev->net->stats.tx_errors++; + +diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c +index cf95290b160c..3628fd7e606f 100644 +--- a/drivers/net/vmxnet3/vmxnet3_drv.c ++++ b/drivers/net/vmxnet3/vmxnet3_drv.c +@@ -369,6 +369,11 @@ vmxnet3_tq_tx_complete(struct vmxnet3_tx_queue *tq, + + gdesc = tq->comp_ring.base + tq->comp_ring.next2proc; + while (VMXNET3_TCD_GET_GEN(&gdesc->tcd) == tq->comp_ring.gen) { ++ /* Prevent any &gdesc->tcd field from being (speculatively) ++ * read before (&gdesc->tcd)->gen is read. ++ */ ++ dma_rmb(); ++ + completed += vmxnet3_unmap_pkt(VMXNET3_TCD_GET_TXIDX( + &gdesc->tcd), tq, adapter->pdev, + adapter); +@@ -1099,6 +1104,11 @@ vmxnet3_tq_xmit(struct sk_buff *skb, struct vmxnet3_tx_queue *tq, + gdesc->txd.tci = skb_vlan_tag_get(skb); + } + ++ /* Ensure that the write to (&gdesc->txd)->gen will be observed after ++ * all other writes to &gdesc->txd. ++ */ ++ dma_wmb(); ++ + /* finally flips the GEN bit of the SOP desc. */ + gdesc->dword[2] = cpu_to_le32(le32_to_cpu(gdesc->dword[2]) ^ + VMXNET3_TXD_GEN); +@@ -1286,6 +1296,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, + */ + break; + } ++ ++ /* Prevent any rcd field from being (speculatively) read before ++ * rcd->gen is read. ++ */ ++ dma_rmb(); ++ + BUG_ON(rcd->rqID != rq->qid && rcd->rqID != rq->qid2 && + rcd->rqID != rq->dataRingQid); + idx = rcd->rxdIdx; +@@ -1515,6 +1531,12 @@ vmxnet3_rq_rx_complete(struct vmxnet3_rx_queue *rq, + ring->next2comp = idx; + num_to_alloc = vmxnet3_cmd_ring_desc_avail(ring); + ring = rq->rx_ring + ring_idx; ++ ++ /* Ensure that the writes to rxd->gen bits will be observed ++ * after all other writes to rxd objects. ++ */ ++ dma_wmb(); ++ + while (num_to_alloc) { + vmxnet3_getRxDesc(rxd, &ring->base[ring->next2fill].rxd, + &rxCmdDesc); +@@ -2675,7 +2697,7 @@ vmxnet3_set_mac_addr(struct net_device *netdev, void *p) + /* ==================== initialization and cleanup routines ============ */ + + static int +-vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64) ++vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter) + { + int err; + unsigned long mmio_start, mmio_len; +@@ -2687,30 +2709,12 @@ vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64) + return err; + } + +- if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) { +- if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) { +- dev_err(&pdev->dev, +- "pci_set_consistent_dma_mask failed\n"); +- err = -EIO; +- goto err_set_mask; +- } +- *dma64 = true; +- } else { +- if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) { +- dev_err(&pdev->dev, +- "pci_set_dma_mask failed\n"); +- err = -EIO; +- goto err_set_mask; +- } +- *dma64 = false; +- } +- + err = pci_request_selected_regions(pdev, (1 << 2) - 1, + vmxnet3_driver_name); + if (err) { + dev_err(&pdev->dev, + "Failed to request region for adapter: error %d\n", err); +- goto err_set_mask; ++ goto err_enable_device; + } + + pci_set_master(pdev); +@@ -2738,7 +2742,7 @@ vmxnet3_alloc_pci_resources(struct vmxnet3_adapter *adapter, bool *dma64) + iounmap(adapter->hw_addr0); + err_ioremap: + pci_release_selected_regions(pdev, (1 << 2) - 1); +-err_set_mask: ++err_enable_device: + pci_disable_device(pdev); + return err; + } +@@ -3243,7 +3247,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, + #endif + }; + int err; +- bool dma64 = false; /* stupid gcc */ ++ bool dma64; + u32 ver; + struct net_device *netdev; + struct vmxnet3_adapter *adapter; +@@ -3289,6 +3293,24 @@ vmxnet3_probe_device(struct pci_dev *pdev, + adapter->rx_ring_size = VMXNET3_DEF_RX_RING_SIZE; + adapter->rx_ring2_size = VMXNET3_DEF_RX_RING2_SIZE; + ++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(64)) == 0) { ++ if (pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)) != 0) { ++ dev_err(&pdev->dev, ++ "pci_set_consistent_dma_mask failed\n"); ++ err = -EIO; ++ goto err_set_mask; ++ } ++ dma64 = true; ++ } else { ++ if (pci_set_dma_mask(pdev, DMA_BIT_MASK(32)) != 0) { ++ dev_err(&pdev->dev, ++ "pci_set_dma_mask failed\n"); ++ err = -EIO; ++ goto err_set_mask; ++ } ++ dma64 = false; ++ } ++ + spin_lock_init(&adapter->cmd_lock); + adapter->adapter_pa = dma_map_single(&adapter->pdev->dev, adapter, + sizeof(struct vmxnet3_adapter), +@@ -3296,7 +3318,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, + if (dma_mapping_error(&adapter->pdev->dev, adapter->adapter_pa)) { + dev_err(&pdev->dev, "Failed to map dma\n"); + err = -EFAULT; +- goto err_dma_map; ++ goto err_set_mask; + } + adapter->shared = dma_alloc_coherent( + &adapter->pdev->dev, +@@ -3347,7 +3369,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, + } + #endif /* VMXNET3_RSS */ + +- err = vmxnet3_alloc_pci_resources(adapter, &dma64); ++ err = vmxnet3_alloc_pci_resources(adapter); + if (err < 0) + goto err_alloc_pci; + +@@ -3493,7 +3515,7 @@ vmxnet3_probe_device(struct pci_dev *pdev, + err_alloc_shared: + dma_unmap_single(&adapter->pdev->dev, adapter->adapter_pa, + sizeof(struct vmxnet3_adapter), PCI_DMA_TODEVICE); +-err_dma_map: ++err_set_mask: + free_netdev(netdev); + return err; + } +diff --git a/drivers/rtc/hctosys.c b/drivers/rtc/hctosys.c +index e1cfa06810ef..e79f2a181ad2 100644 +--- a/drivers/rtc/hctosys.c ++++ b/drivers/rtc/hctosys.c +@@ -49,6 +49,11 @@ static int __init rtc_hctosys(void) + + tv64.tv_sec = rtc_tm_to_time64(&tm); + ++#if BITS_PER_LONG == 32 ++ if (tv64.tv_sec > INT_MAX) ++ goto err_read; ++#endif ++ + err = do_settimeofday64(&tv64); + + dev_info(rtc->dev.parent, +diff --git a/drivers/rtc/rtc-goldfish.c b/drivers/rtc/rtc-goldfish.c +index d67769265185..a1c44d0c8557 100644 +--- a/drivers/rtc/rtc-goldfish.c ++++ b/drivers/rtc/rtc-goldfish.c +@@ -235,3 +235,5 @@ static struct platform_driver goldfish_rtc = { + }; + + module_platform_driver(goldfish_rtc); ++ ++MODULE_LICENSE("GPL v2"); +diff --git a/drivers/rtc/rtc-m41t80.c b/drivers/rtc/rtc-m41t80.c +index c90fba3ed861..6620016869cf 100644 +--- a/drivers/rtc/rtc-m41t80.c ++++ b/drivers/rtc/rtc-m41t80.c +@@ -885,7 +885,6 @@ static int m41t80_probe(struct i2c_client *client, + { + struct i2c_adapter *adapter = to_i2c_adapter(client->dev.parent); + int rc = 0; +- struct rtc_device *rtc = NULL; + struct rtc_time tm; + struct m41t80_data *m41t80_data = NULL; + bool wakeup_source = false; +@@ -909,6 +908,10 @@ static int m41t80_probe(struct i2c_client *client, + m41t80_data->features = id->driver_data; + i2c_set_clientdata(client, m41t80_data); + ++ m41t80_data->rtc = devm_rtc_allocate_device(&client->dev); ++ if (IS_ERR(m41t80_data->rtc)) ++ return PTR_ERR(m41t80_data->rtc); ++ + #ifdef CONFIG_OF + wakeup_source = of_property_read_bool(client->dev.of_node, + "wakeup-source"); +@@ -932,15 +935,11 @@ static int m41t80_probe(struct i2c_client *client, + device_init_wakeup(&client->dev, true); + } + +- rtc = devm_rtc_device_register(&client->dev, client->name, +- &m41t80_rtc_ops, THIS_MODULE); +- if (IS_ERR(rtc)) +- return PTR_ERR(rtc); ++ m41t80_data->rtc->ops = &m41t80_rtc_ops; + +- m41t80_data->rtc = rtc; + if (client->irq <= 0) { + /* We cannot support UIE mode if we do not have an IRQ line */ +- rtc->uie_unsupported = 1; ++ m41t80_data->rtc->uie_unsupported = 1; + } + + /* Make sure HT (Halt Update) bit is cleared */ +@@ -993,6 +992,11 @@ static int m41t80_probe(struct i2c_client *client, + if (m41t80_data->features & M41T80_FEATURE_SQ) + m41t80_sqw_register_clk(m41t80_data); + #endif ++ ++ rc = rtc_register_device(m41t80_data->rtc); ++ if (rc) ++ return rc; ++ + return 0; + } + +diff --git a/drivers/rtc/rtc-rk808.c b/drivers/rtc/rtc-rk808.c +index 35c9aada07c8..79c8da54e922 100644 +--- a/drivers/rtc/rtc-rk808.c ++++ b/drivers/rtc/rtc-rk808.c +@@ -416,12 +416,11 @@ static int rk808_rtc_probe(struct platform_device *pdev) + + device_init_wakeup(&pdev->dev, 1); + +- rk808_rtc->rtc = devm_rtc_device_register(&pdev->dev, "rk808-rtc", +- &rk808_rtc_ops, THIS_MODULE); +- if (IS_ERR(rk808_rtc->rtc)) { +- ret = PTR_ERR(rk808_rtc->rtc); +- return ret; +- } ++ rk808_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(rk808_rtc->rtc)) ++ return PTR_ERR(rk808_rtc->rtc); ++ ++ rk808_rtc->rtc->ops = &rk808_rtc_ops; + + rk808_rtc->irq = platform_get_irq(pdev, 0); + if (rk808_rtc->irq < 0) { +@@ -438,9 +437,10 @@ static int rk808_rtc_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, "Failed to request alarm IRQ %d: %d\n", + rk808_rtc->irq, ret); ++ return ret; + } + +- return ret; ++ return rtc_register_device(rk808_rtc->rtc); + } + + static struct platform_driver rk808_rtc_driver = { +diff --git a/drivers/rtc/rtc-rp5c01.c b/drivers/rtc/rtc-rp5c01.c +index 026035373ae6..38a12435b5a0 100644 +--- a/drivers/rtc/rtc-rp5c01.c ++++ b/drivers/rtc/rtc-rp5c01.c +@@ -249,16 +249,24 @@ static int __init rp5c01_rtc_probe(struct platform_device *dev) + + platform_set_drvdata(dev, priv); + +- rtc = devm_rtc_device_register(&dev->dev, "rtc-rp5c01", &rp5c01_rtc_ops, +- THIS_MODULE); ++ rtc = devm_rtc_allocate_device(&dev->dev); + if (IS_ERR(rtc)) + return PTR_ERR(rtc); ++ ++ rtc->ops = &rp5c01_rtc_ops; ++ + priv->rtc = rtc; + + error = sysfs_create_bin_file(&dev->dev.kobj, &priv->nvram_attr); + if (error) + return error; + ++ error = rtc_register_device(rtc); ++ if (error) { ++ sysfs_remove_bin_file(&dev->dev.kobj, &priv->nvram_attr); ++ return error; ++ } ++ + return 0; + } + +diff --git a/drivers/rtc/rtc-snvs.c b/drivers/rtc/rtc-snvs.c +index d8ef9e052c4f..9af591d5223c 100644 +--- a/drivers/rtc/rtc-snvs.c ++++ b/drivers/rtc/rtc-snvs.c +@@ -132,20 +132,23 @@ static int snvs_rtc_set_time(struct device *dev, struct rtc_time *tm) + { + struct snvs_rtc_data *data = dev_get_drvdata(dev); + unsigned long time; ++ int ret; + + rtc_tm_to_time(tm, &time); + + /* Disable RTC first */ +- snvs_rtc_enable(data, false); ++ ret = snvs_rtc_enable(data, false); ++ if (ret) ++ return ret; + + /* Write 32-bit time to 47-bit timer, leaving 15 LSBs blank */ + regmap_write(data->regmap, data->offset + SNVS_LPSRTCLR, time << CNTR_TO_SECS_SH); + regmap_write(data->regmap, data->offset + SNVS_LPSRTCMR, time >> (32 - CNTR_TO_SECS_SH)); + + /* Enable RTC again */ +- snvs_rtc_enable(data, true); ++ ret = snvs_rtc_enable(data, true); + +- return 0; ++ return ret; + } + + static int snvs_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) +@@ -288,7 +291,11 @@ static int snvs_rtc_probe(struct platform_device *pdev) + regmap_write(data->regmap, data->offset + SNVS_LPSR, 0xffffffff); + + /* Enable RTC */ +- snvs_rtc_enable(data, true); ++ ret = snvs_rtc_enable(data, true); ++ if (ret) { ++ dev_err(&pdev->dev, "failed to enable rtc %d\n", ret); ++ goto error_rtc_device_register; ++ } + + device_init_wakeup(&pdev->dev, true); + +diff --git a/drivers/rtc/rtc-tx4939.c b/drivers/rtc/rtc-tx4939.c +index 560d9a5e0225..a9528083061d 100644 +--- a/drivers/rtc/rtc-tx4939.c ++++ b/drivers/rtc/rtc-tx4939.c +@@ -86,7 +86,8 @@ static int tx4939_rtc_read_time(struct device *dev, struct rtc_time *tm) + for (i = 2; i < 6; i++) + buf[i] = __raw_readl(&rtcreg->dat); + spin_unlock_irq(&pdata->lock); +- sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2]; ++ sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) | ++ (buf[3] << 8) | buf[2]; + rtc_time_to_tm(sec, tm); + return rtc_valid_tm(tm); + } +@@ -147,7 +148,8 @@ static int tx4939_rtc_read_alarm(struct device *dev, struct rtc_wkalrm *alrm) + alrm->enabled = (ctl & TX4939_RTCCTL_ALME) ? 1 : 0; + alrm->pending = (ctl & TX4939_RTCCTL_ALMD) ? 1 : 0; + spin_unlock_irq(&pdata->lock); +- sec = (buf[5] << 24) | (buf[4] << 16) | (buf[3] << 8) | buf[2]; ++ sec = ((unsigned long)buf[5] << 24) | (buf[4] << 16) | ++ (buf[3] << 8) | buf[2]; + rtc_time_to_tm(sec, &alrm->time); + return rtc_valid_tm(&alrm->time); + } +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index a8b831000b2d..18c4f933e8b9 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -4,7 +4,7 @@ + * + * Debug traces for zfcp. + * +- * Copyright IBM Corp. 2002, 2017 ++ * Copyright IBM Corp. 2002, 2018 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -308,6 +308,27 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter, + spin_unlock_irqrestore(&dbf->rec_lock, flags); + } + ++/** ++ * zfcp_dbf_rec_trig_lock - trace event related to triggered recovery with lock ++ * @tag: identifier for event ++ * @adapter: adapter on which the erp_action should run ++ * @port: remote port involved in the erp_action ++ * @sdev: scsi device involved in the erp_action ++ * @want: wanted erp_action ++ * @need: required erp_action ++ * ++ * The adapter->erp_lock must not be held. ++ */ ++void zfcp_dbf_rec_trig_lock(char *tag, struct zfcp_adapter *adapter, ++ struct zfcp_port *port, struct scsi_device *sdev, ++ u8 want, u8 need) ++{ ++ unsigned long flags; ++ ++ read_lock_irqsave(&adapter->erp_lock, flags); ++ zfcp_dbf_rec_trig(tag, adapter, port, sdev, want, need); ++ read_unlock_irqrestore(&adapter->erp_lock, flags); ++} + + /** + * zfcp_dbf_rec_run_lvl - trace event related to running recovery +diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h +index 8ca2ab7deaa9..b1cbb14fb2ae 100644 +--- a/drivers/s390/scsi/zfcp_ext.h ++++ b/drivers/s390/scsi/zfcp_ext.h +@@ -4,7 +4,7 @@ + * + * External function declarations. + * +- * Copyright IBM Corp. 2002, 2016 ++ * Copyright IBM Corp. 2002, 2018 + */ + + #ifndef ZFCP_EXT_H +@@ -35,6 +35,9 @@ extern int zfcp_dbf_adapter_register(struct zfcp_adapter *); + extern void zfcp_dbf_adapter_unregister(struct zfcp_adapter *); + extern void zfcp_dbf_rec_trig(char *, struct zfcp_adapter *, + struct zfcp_port *, struct scsi_device *, u8, u8); ++extern void zfcp_dbf_rec_trig_lock(char *tag, struct zfcp_adapter *adapter, ++ struct zfcp_port *port, ++ struct scsi_device *sdev, u8 want, u8 need); + extern void zfcp_dbf_rec_run(char *, struct zfcp_erp_action *); + extern void zfcp_dbf_rec_run_lvl(int level, char *tag, + struct zfcp_erp_action *erp); +diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c +index 4d2ba5682493..22f9562f415c 100644 +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -4,7 +4,7 @@ + * + * Interface to Linux SCSI midlayer. + * +- * Copyright IBM Corp. 2002, 2017 ++ * Copyright IBM Corp. 2002, 2018 + */ + + #define KMSG_COMPONENT "zfcp" +@@ -618,9 +618,9 @@ static void zfcp_scsi_rport_register(struct zfcp_port *port) + ids.port_id = port->d_id; + ids.roles = FC_RPORT_ROLE_FCP_TARGET; + +- zfcp_dbf_rec_trig("scpaddy", port->adapter, port, NULL, +- ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD, +- ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD); ++ zfcp_dbf_rec_trig_lock("scpaddy", port->adapter, port, NULL, ++ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD, ++ ZFCP_PSEUDO_ERP_ACTION_RPORT_ADD); + rport = fc_remote_port_add(port->adapter->scsi_host, 0, &ids); + if (!rport) { + dev_err(&port->adapter->ccw_device->dev, +@@ -642,9 +642,9 @@ static void zfcp_scsi_rport_block(struct zfcp_port *port) + struct fc_rport *rport = port->rport; + + if (rport) { +- zfcp_dbf_rec_trig("scpdely", port->adapter, port, NULL, +- ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL, +- ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL); ++ zfcp_dbf_rec_trig_lock("scpdely", port->adapter, port, NULL, ++ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL, ++ ZFCP_PSEUDO_ERP_ACTION_RPORT_DEL); + fc_remote_port_delete(rport); + port->rport = NULL; + } +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 3696f9ded252..998788a967be 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -1530,9 +1530,10 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced, u8 reset_type) + host = aac->scsi_host_ptr; + scsi_block_requests(host); + aac_adapter_disable_int(aac); +- if (aac->thread->pid != current->pid) { ++ if (aac->thread && aac->thread->pid != current->pid) { + spin_unlock_irq(host->host_lock); + kthread_stop(aac->thread); ++ aac->thread = NULL; + jafo = 1; + } + +@@ -1619,6 +1620,7 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced, u8 reset_type) + aac->name); + if (IS_ERR(aac->thread)) { + retval = PTR_ERR(aac->thread); ++ aac->thread = NULL; + goto out; + } + } +diff --git a/drivers/scsi/aacraid/linit.c b/drivers/scsi/aacraid/linit.c +index 509fe23fafe1..4917649cacd5 100644 +--- a/drivers/scsi/aacraid/linit.c ++++ b/drivers/scsi/aacraid/linit.c +@@ -1565,6 +1565,7 @@ static void __aac_shutdown(struct aac_dev * aac) + up(&fib->event_wait); + } + kthread_stop(aac->thread); ++ aac->thread = NULL; + } + + aac_send_shutdown(aac); +@@ -1690,8 +1691,10 @@ static int aac_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + * Map in the registers from the adapter. + */ + aac->base_size = AAC_MIN_FOOTPRINT_SIZE; +- if ((*aac_drivers[index].init)(aac)) ++ if ((*aac_drivers[index].init)(aac)) { ++ error = -ENODEV; + goto out_unmap; ++ } + + if (aac->sync_mode) { + if (aac_sync_mode) +diff --git a/drivers/scsi/bnx2fc/bnx2fc_io.c b/drivers/scsi/bnx2fc/bnx2fc_io.c +index 5b6153f23f01..6626b28ba8fe 100644 +--- a/drivers/scsi/bnx2fc/bnx2fc_io.c ++++ b/drivers/scsi/bnx2fc/bnx2fc_io.c +@@ -1865,6 +1865,7 @@ void bnx2fc_process_scsi_cmd_compl(struct bnx2fc_cmd *io_req, + /* we will not receive ABTS response for this IO */ + BNX2FC_IO_DBG(io_req, "Timer context finished processing " + "this scsi cmd\n"); ++ return; + } + + /* Cancel the timeout_work, as we received IO completion */ +diff --git a/drivers/scsi/iscsi_tcp.c b/drivers/scsi/iscsi_tcp.c +index 4d934d6c3e13..e11eff6b0e97 100644 +--- a/drivers/scsi/iscsi_tcp.c ++++ b/drivers/scsi/iscsi_tcp.c +@@ -37,6 +37,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -952,6 +953,13 @@ static int iscsi_sw_tcp_slave_alloc(struct scsi_device *sdev) + + static int iscsi_sw_tcp_slave_configure(struct scsi_device *sdev) + { ++ struct iscsi_sw_tcp_host *tcp_sw_host = iscsi_host_priv(sdev->host); ++ struct iscsi_session *session = tcp_sw_host->session; ++ struct iscsi_conn *conn = session->leadconn; ++ ++ if (conn->datadgst_en) ++ sdev->request_queue->backing_dev_info->capabilities ++ |= BDI_CAP_STABLE_WRITES; + blk_queue_bounce_limit(sdev->request_queue, BLK_BOUNCE_ANY); + blk_queue_dma_alignment(sdev->request_queue, 0); + return 0; +diff --git a/drivers/scsi/libsas/sas_scsi_host.c b/drivers/scsi/libsas/sas_scsi_host.c +index 10b17da20176..0c4b186c852a 100644 +--- a/drivers/scsi/libsas/sas_scsi_host.c ++++ b/drivers/scsi/libsas/sas_scsi_host.c +@@ -222,6 +222,7 @@ int sas_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd) + static void sas_eh_finish_cmd(struct scsi_cmnd *cmd) + { + struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(cmd->device->host); ++ struct domain_device *dev = cmd_to_domain_dev(cmd); + struct sas_task *task = TO_SAS_TASK(cmd); + + /* At this point, we only get called following an actual abort +@@ -230,6 +231,14 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd) + */ + sas_end_task(cmd, task); + ++ if (dev_is_sata(dev)) { ++ /* defer commands to libata so that libata EH can ++ * handle ata qcs correctly ++ */ ++ list_move_tail(&cmd->eh_entry, &sas_ha->eh_ata_q); ++ return; ++ } ++ + /* now finish the command and move it on to the error + * handler done list, this also takes it off the + * error handler pending list. +@@ -237,22 +246,6 @@ static void sas_eh_finish_cmd(struct scsi_cmnd *cmd) + scsi_eh_finish_cmd(cmd, &sas_ha->eh_done_q); + } + +-static void sas_eh_defer_cmd(struct scsi_cmnd *cmd) +-{ +- struct domain_device *dev = cmd_to_domain_dev(cmd); +- struct sas_ha_struct *ha = dev->port->ha; +- struct sas_task *task = TO_SAS_TASK(cmd); +- +- if (!dev_is_sata(dev)) { +- sas_eh_finish_cmd(cmd); +- return; +- } +- +- /* report the timeout to libata */ +- sas_end_task(cmd, task); +- list_move_tail(&cmd->eh_entry, &ha->eh_ata_q); +-} +- + static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd *my_cmd) + { + struct scsi_cmnd *cmd, *n; +@@ -260,7 +253,7 @@ static void sas_scsi_clear_queue_lu(struct list_head *error_q, struct scsi_cmnd + list_for_each_entry_safe(cmd, n, error_q, eh_entry) { + if (cmd->device->sdev_target == my_cmd->device->sdev_target && + cmd->device->lun == my_cmd->device->lun) +- sas_eh_defer_cmd(cmd); ++ sas_eh_finish_cmd(cmd); + } + } + +@@ -630,12 +623,12 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head * + case TASK_IS_DONE: + SAS_DPRINTK("%s: task 0x%p is done\n", __func__, + task); +- sas_eh_defer_cmd(cmd); ++ sas_eh_finish_cmd(cmd); + continue; + case TASK_IS_ABORTED: + SAS_DPRINTK("%s: task 0x%p is aborted\n", + __func__, task); +- sas_eh_defer_cmd(cmd); ++ sas_eh_finish_cmd(cmd); + continue; + case TASK_IS_AT_LU: + SAS_DPRINTK("task 0x%p is at LU: lu recover\n", task); +@@ -646,7 +639,7 @@ static void sas_eh_handle_sas_errors(struct Scsi_Host *shost, struct list_head * + "recovered\n", + SAS_ADDR(task->dev), + cmd->device->lun); +- sas_eh_defer_cmd(cmd); ++ sas_eh_finish_cmd(cmd); + sas_scsi_clear_queue_lu(work_q, cmd); + goto Again; + } +diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c +index dc6519b2c53a..3da242201cb4 100644 +--- a/drivers/scsi/lpfc/lpfc_attr.c ++++ b/drivers/scsi/lpfc/lpfc_attr.c +@@ -871,7 +871,12 @@ lpfc_issue_lip(struct Scsi_Host *shost) + LPFC_MBOXQ_t *pmboxq; + int mbxstatus = MBXERR_ERROR; + ++ /* ++ * If the link is offline, disabled or BLOCK_MGMT_IO ++ * it doesn't make any sense to allow issue_lip ++ */ + if ((vport->fc_flag & FC_OFFLINE_MODE) || ++ (phba->hba_flag & LINK_DISABLED) || + (phba->sli.sli_flag & LPFC_BLOCK_MGMT_IO)) + return -EPERM; + +diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c +index d9a03beb76a4..4962d665b4d2 100644 +--- a/drivers/scsi/lpfc/lpfc_hbadisc.c ++++ b/drivers/scsi/lpfc/lpfc_hbadisc.c +@@ -698,8 +698,9 @@ lpfc_work_done(struct lpfc_hba *phba) + phba->hba_flag & HBA_SP_QUEUE_EVT)) { + if (pring->flag & LPFC_STOP_IOCB_EVENT) { + pring->flag |= LPFC_DEFERRED_RING_EVENT; +- /* Set the lpfc data pending flag */ +- set_bit(LPFC_DATA_READY, &phba->data_flags); ++ /* Preserve legacy behavior. */ ++ if (!(phba->hba_flag & HBA_SP_QUEUE_EVT)) ++ set_bit(LPFC_DATA_READY, &phba->data_flags); + } else { + if (phba->link_state >= LPFC_LINK_UP || + phba->link_flag & LS_MDS_LOOPBACK) { +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index 455f3ce9fda9..dc83498024dc 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -129,6 +129,8 @@ lpfc_sli4_wq_put(struct lpfc_queue *q, union lpfc_wqe *wqe) + /* set consumption flag every once in a while */ + if (!((q->host_index + 1) % q->entry_repost)) + bf_set(wqe_wqec, &wqe->generic.wqe_com, 1); ++ else ++ bf_set(wqe_wqec, &wqe->generic.wqe_com, 0); + if (q->phba->sli3_options & LPFC_SLI4_PHWQ_ENABLED) + bf_set(wqe_wqid, &wqe->generic.wqe_com, q->queue_id); + lpfc_sli_pcimem_bcopy(wqe, temp_wqe, q->entry_size); +diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c +index 6efa739a1912..9b716c8c558a 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_base.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_base.c +@@ -1921,8 +1921,11 @@ _base_assign_reply_queues(struct MPT3SAS_ADAPTER *ioc) + continue; + } + +- for_each_cpu(cpu, mask) ++ for_each_cpu_and(cpu, mask, cpu_online_mask) { ++ if (cpu >= ioc->cpu_msix_table_sz) ++ break; + ioc->cpu_msix_table[cpu] = reply_q->msix_index; ++ } + } + return; + } +diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +index 139219c994e9..ae5e579ac473 100644 +--- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c ++++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c +@@ -8941,7 +8941,7 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) + snprintf(ioc->firmware_event_name, sizeof(ioc->firmware_event_name), + "fw_event_%s%d", ioc->driver_name, ioc->id); + ioc->firmware_event_thread = alloc_ordered_workqueue( +- ioc->firmware_event_name, WQ_MEM_RECLAIM); ++ ioc->firmware_event_name, 0); + if (!ioc->firmware_event_thread) { + pr_err(MPT3SAS_FMT "failure at %s:%d/%s()!\n", + ioc->name, __FILE__, __LINE__, __func__); +diff --git a/drivers/scsi/mvsas/mv_94xx.c b/drivers/scsi/mvsas/mv_94xx.c +index 7de5d8d75480..eb5471bc7263 100644 +--- a/drivers/scsi/mvsas/mv_94xx.c ++++ b/drivers/scsi/mvsas/mv_94xx.c +@@ -1080,16 +1080,16 @@ static int mvs_94xx_gpio_write(struct mvs_prv_info *mvs_prv, + void __iomem *regs = mvi->regs_ex - 0x10200; + + int drive = (i/3) & (4-1); /* drive number on host */ +- u32 block = mr32(MVS_SGPIO_DCTRL + ++ int driveshift = drive * 8; /* bit offset of drive */ ++ u32 block = ioread32be(regs + MVS_SGPIO_DCTRL + + MVS_SGPIO_HOST_OFFSET * mvi->id); + +- + /* + * if bit is set then create a mask with the first + * bit of the drive set in the mask ... + */ +- u32 bit = (write_data[i/8] & (1 << (i&(8-1)))) ? +- 1<<(24-drive*8) : 0; ++ u32 bit = get_unaligned_be32(write_data) & (1 << i) ? ++ 1 << driveshift : 0; + + /* + * ... and then shift it to the right position based +@@ -1098,26 +1098,27 @@ static int mvs_94xx_gpio_write(struct mvs_prv_info *mvs_prv, + switch (i%3) { + case 0: /* activity */ + block &= ~((0x7 << MVS_SGPIO_DCTRL_ACT_SHIFT) +- << (24-drive*8)); ++ << driveshift); + /* hardwire activity bit to SOF */ + block |= LED_BLINKA_SOF << ( + MVS_SGPIO_DCTRL_ACT_SHIFT + +- (24-drive*8)); ++ driveshift); + break; + case 1: /* id */ + block &= ~((0x3 << MVS_SGPIO_DCTRL_LOC_SHIFT) +- << (24-drive*8)); ++ << driveshift); + block |= bit << MVS_SGPIO_DCTRL_LOC_SHIFT; + break; + case 2: /* fail */ + block &= ~((0x7 << MVS_SGPIO_DCTRL_ERR_SHIFT) +- << (24-drive*8)); ++ << driveshift); + block |= bit << MVS_SGPIO_DCTRL_ERR_SHIFT; + break; + } + +- mw32(MVS_SGPIO_DCTRL + MVS_SGPIO_HOST_OFFSET * mvi->id, +- block); ++ iowrite32be(block, ++ regs + MVS_SGPIO_DCTRL + ++ MVS_SGPIO_HOST_OFFSET * mvi->id); + + } + +@@ -1132,7 +1133,7 @@ static int mvs_94xx_gpio_write(struct mvs_prv_info *mvs_prv, + void __iomem *regs = mvi->regs_ex - 0x10200; + + mw32(MVS_SGPIO_DCTRL + MVS_SGPIO_HOST_OFFSET * mvi->id, +- be32_to_cpu(((u32 *) write_data)[i])); ++ ((u32 *) write_data)[i]); + } + return reg_count; + } +diff --git a/drivers/scsi/qedi/qedi_fw.c b/drivers/scsi/qedi/qedi_fw.c +index 93d54acd4a22..2e5e04a7623f 100644 +--- a/drivers/scsi/qedi/qedi_fw.c ++++ b/drivers/scsi/qedi/qedi_fw.c +@@ -769,6 +769,11 @@ static void qedi_process_cmd_cleanup_resp(struct qedi_ctx *qedi, + + iscsi_cid = cqe->conn_id; + qedi_conn = qedi->cid_que.conn_cid_tbl[iscsi_cid]; ++ if (!qedi_conn) { ++ QEDI_INFO(&qedi->dbg_ctx, QEDI_LOG_INFO, ++ "icid not found 0x%x\n", cqe->conn_id); ++ return; ++ } + + /* Based on this itt get the corresponding qedi_cmd */ + spin_lock_bh(&qedi_conn->tmf_work_lock); +diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c +index cccc34adc0e0..1573749fe615 100644 +--- a/drivers/scsi/qedi/qedi_main.c ++++ b/drivers/scsi/qedi/qedi_main.c +@@ -1840,8 +1840,8 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf) + + switch (type) { + case ISCSI_BOOT_INI_INITIATOR_NAME: +- rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n", +- initiator->initiator_name.byte); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, ++ initiator->initiator_name.byte); + break; + default: + rc = 0; +@@ -1908,8 +1908,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type, + + switch (type) { + case ISCSI_BOOT_TGT_NAME: +- rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n", +- block->target[idx].target_name.byte); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, ++ block->target[idx].target_name.byte); + break; + case ISCSI_BOOT_TGT_IP_ADDR: + if (ipv6_en) +@@ -1930,20 +1930,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type, + block->target[idx].lun.value[0]); + break; + case ISCSI_BOOT_TGT_CHAP_NAME: +- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n", +- chap_name); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, ++ chap_name); + break; + case ISCSI_BOOT_TGT_CHAP_SECRET: +- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n", +- chap_secret); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, ++ chap_secret); + break; + case ISCSI_BOOT_TGT_REV_CHAP_NAME: +- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n", +- mchap_name); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, ++ mchap_name); + break; + case ISCSI_BOOT_TGT_REV_CHAP_SECRET: +- rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n", +- mchap_secret); ++ rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, ++ mchap_secret); + break; + case ISCSI_BOOT_TGT_FLAGS: + rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT); +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index d95b879c2bca..13a00a42b3ca 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -272,7 +272,8 @@ qla2x00_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) + struct device_reg_2xxx __iomem *reg = &ha->iobase->isp; + + /* Read all mbox registers? */ +- mboxes = (1 << ha->mbx_count) - 1; ++ WARN_ON_ONCE(ha->mbx_count > 32); ++ mboxes = (1ULL << ha->mbx_count) - 1; + if (!ha->mcp) + ql_dbg(ql_dbg_async, vha, 0x5001, "MBX pointer ERROR.\n"); + else +@@ -2821,7 +2822,8 @@ qla24xx_mbx_completion(scsi_qla_host_t *vha, uint16_t mb0) + struct device_reg_24xx __iomem *reg = &ha->iobase->isp24; + + /* Read all mbox registers? */ +- mboxes = (1 << ha->mbx_count) - 1; ++ WARN_ON_ONCE(ha->mbx_count > 32); ++ mboxes = (1ULL << ha->mbx_count) - 1; + if (!ha->mcp) + ql_dbg(ql_dbg_async, vha, 0x504e, "MBX pointer ERROR.\n"); + else +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 8e7c0626f8b5..1be76695e692 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -3581,6 +3581,8 @@ qla2x00_remove_one(struct pci_dev *pdev) + } + qla2x00_wait_for_hba_ready(base_vha); + ++ qla2x00_wait_for_sess_deletion(base_vha); ++ + /* + * if UNLOAD flag is already set, then continue unload, + * where it was set first. +diff --git a/drivers/scsi/qla4xxx/ql4_def.h b/drivers/scsi/qla4xxx/ql4_def.h +index fc233717355f..817f312023a9 100644 +--- a/drivers/scsi/qla4xxx/ql4_def.h ++++ b/drivers/scsi/qla4xxx/ql4_def.h +@@ -168,6 +168,8 @@ + #define DEV_DB_NON_PERSISTENT 0 + #define DEV_DB_PERSISTENT 1 + ++#define QL4_ISP_REG_DISCONNECT 0xffffffffU ++ + #define COPY_ISID(dst_isid, src_isid) { \ + int i, j; \ + for (i = 0, j = ISID_SIZE - 1; i < ISID_SIZE;) \ +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index 64c6fa563fdb..a6aa08d9a171 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -262,6 +262,24 @@ static struct iscsi_transport qla4xxx_iscsi_transport = { + + static struct scsi_transport_template *qla4xxx_scsi_transport; + ++static int qla4xxx_isp_check_reg(struct scsi_qla_host *ha) ++{ ++ u32 reg_val = 0; ++ int rval = QLA_SUCCESS; ++ ++ if (is_qla8022(ha)) ++ reg_val = readl(&ha->qla4_82xx_reg->host_status); ++ else if (is_qla8032(ha) || is_qla8042(ha)) ++ reg_val = qla4_8xxx_rd_direct(ha, QLA8XXX_PEG_ALIVE_COUNTER); ++ else ++ reg_val = readw(&ha->reg->ctrl_status); ++ ++ if (reg_val == QL4_ISP_REG_DISCONNECT) ++ rval = QLA_ERROR; ++ ++ return rval; ++} ++ + static int qla4xxx_send_ping(struct Scsi_Host *shost, uint32_t iface_num, + uint32_t iface_type, uint32_t payload_size, + uint32_t pid, struct sockaddr *dst_addr) +@@ -9188,10 +9206,17 @@ static int qla4xxx_eh_abort(struct scsi_cmnd *cmd) + struct srb *srb = NULL; + int ret = SUCCESS; + int wait = 0; ++ int rval; + + ql4_printk(KERN_INFO, ha, "scsi%ld:%d:%llu: Abort command issued cmd=%p, cdb=0x%x\n", + ha->host_no, id, lun, cmd, cmd->cmnd[0]); + ++ rval = qla4xxx_isp_check_reg(ha); ++ if (rval != QLA_SUCCESS) { ++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n"); ++ return FAILED; ++ } ++ + spin_lock_irqsave(&ha->hardware_lock, flags); + srb = (struct srb *) CMD_SP(cmd); + if (!srb) { +@@ -9243,6 +9268,7 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd) + struct scsi_qla_host *ha = to_qla_host(cmd->device->host); + struct ddb_entry *ddb_entry = cmd->device->hostdata; + int ret = FAILED, stat; ++ int rval; + + if (!ddb_entry) + return ret; +@@ -9262,6 +9288,12 @@ static int qla4xxx_eh_device_reset(struct scsi_cmnd *cmd) + cmd, jiffies, cmd->request->timeout / HZ, + ha->dpc_flags, cmd->result, cmd->allowed)); + ++ rval = qla4xxx_isp_check_reg(ha); ++ if (rval != QLA_SUCCESS) { ++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n"); ++ return FAILED; ++ } ++ + /* FIXME: wait for hba to go online */ + stat = qla4xxx_reset_lun(ha, ddb_entry, cmd->device->lun); + if (stat != QLA_SUCCESS) { +@@ -9305,6 +9337,7 @@ static int qla4xxx_eh_target_reset(struct scsi_cmnd *cmd) + struct scsi_qla_host *ha = to_qla_host(cmd->device->host); + struct ddb_entry *ddb_entry = cmd->device->hostdata; + int stat, ret; ++ int rval; + + if (!ddb_entry) + return FAILED; +@@ -9322,6 +9355,12 @@ static int qla4xxx_eh_target_reset(struct scsi_cmnd *cmd) + ha->host_no, cmd, jiffies, cmd->request->timeout / HZ, + ha->dpc_flags, cmd->result, cmd->allowed)); + ++ rval = qla4xxx_isp_check_reg(ha); ++ if (rval != QLA_SUCCESS) { ++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n"); ++ return FAILED; ++ } ++ + stat = qla4xxx_reset_target(ha, ddb_entry); + if (stat != QLA_SUCCESS) { + starget_printk(KERN_INFO, scsi_target(cmd->device), +@@ -9376,9 +9415,16 @@ static int qla4xxx_eh_host_reset(struct scsi_cmnd *cmd) + { + int return_status = FAILED; + struct scsi_qla_host *ha; ++ int rval; + + ha = to_qla_host(cmd->device->host); + ++ rval = qla4xxx_isp_check_reg(ha); ++ if (rval != QLA_SUCCESS) { ++ ql4_printk(KERN_INFO, ha, "PCI/Register disconnect, exiting.\n"); ++ return FAILED; ++ } ++ + if ((is_qla8032(ha) || is_qla8042(ha)) && ql4xdontresethba) + qla4_83xx_set_idc_dontreset(ha); + +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index 359386730523..bfd8f12d4e9a 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -855,6 +855,17 @@ void scsi_io_completion(struct scsi_cmnd *cmd, unsigned int good_bytes) + /* for passthrough error may be set */ + error = BLK_STS_OK; + } ++ /* ++ * Another corner case: the SCSI status byte is non-zero but 'good'. ++ * Example: PRE-FETCH command returns SAM_STAT_CONDITION_MET when ++ * it is able to fit nominated LBs in its cache (and SAM_STAT_GOOD ++ * if it can't fit). Treat SAM_STAT_CONDITION_MET and the related ++ * intermediate statuses (both obsolete in SAM-4) as good. ++ */ ++ if (status_byte(result) && scsi_status_is_good(result)) { ++ result = 0; ++ error = BLK_STS_OK; ++ } + + /* + * special case: failed zero length commands always need to +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 2f9912de2212..4a532318b211 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2608,6 +2608,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer) + int res; + struct scsi_device *sdp = sdkp->device; + struct scsi_mode_data data; ++ int disk_ro = get_disk_ro(sdkp->disk); + int old_wp = sdkp->write_prot; + + set_disk_ro(sdkp->disk, 0); +@@ -2648,7 +2649,7 @@ sd_read_write_protect_flag(struct scsi_disk *sdkp, unsigned char *buffer) + "Test WP failed, assume Write Enabled\n"); + } else { + sdkp->write_prot = ((data.device_specific & 0x80) != 0); +- set_disk_ro(sdkp->disk, sdkp->write_prot); ++ set_disk_ro(sdkp->disk, sdkp->write_prot || disk_ro); + if (sdkp->first_scan || old_wp != sdkp->write_prot) { + sd_printk(KERN_NOTICE, sdkp, "Write Protect is %s\n", + sdkp->write_prot ? "on" : "off"); +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index aa28874e8fb9..17a4cc138b00 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -1894,7 +1894,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) + num = (rem_sz > scatter_elem_sz_prev) ? + scatter_elem_sz_prev : rem_sz; + +- schp->pages[k] = alloc_pages(gfp_mask, order); ++ schp->pages[k] = alloc_pages(gfp_mask | __GFP_ZERO, order); + if (!schp->pages[k]) + goto out; + +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index a3e480e7a257..c44de0b4a995 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1661,7 +1661,7 @@ static struct scsi_host_template scsi_driver = { + .eh_timed_out = storvsc_eh_timed_out, + .slave_alloc = storvsc_device_alloc, + .slave_configure = storvsc_device_configure, +- .cmd_per_lun = 255, ++ .cmd_per_lun = 2048, + .this_id = -1, + .use_clustering = ENABLE_CLUSTERING, + /* Make sure we dont get a sg segment crosses a page boundary */ +diff --git a/drivers/scsi/sym53c8xx_2/sym_hipd.c b/drivers/scsi/sym53c8xx_2/sym_hipd.c +index ca360daa6a25..378af306fda1 100644 +--- a/drivers/scsi/sym53c8xx_2/sym_hipd.c ++++ b/drivers/scsi/sym53c8xx_2/sym_hipd.c +@@ -536,7 +536,7 @@ sym_getsync(struct sym_hcb *np, u_char dt, u_char sfac, u_char *divp, u_char *fa + * Look for the greatest clock divisor that allows an + * input speed faster than the period. + */ +- while (div-- > 0) ++ while (--div > 0) + if (kpc >= (div_10M[div] << 2)) break; + + /* +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index d344fef01f1d..3bb1f6cc297a 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4347,6 +4347,8 @@ static int ufshcd_slave_alloc(struct scsi_device *sdev) + /* REPORT SUPPORTED OPERATION CODES is not supported */ + sdev->no_report_opcodes = 1; + ++ /* WRITE_SAME command is not supported */ ++ sdev->no_write_same = 1; + + ufshcd_set_queue_depth(sdev); + +diff --git a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +index 8e84b2e7f5bd..b83d17db06bd 100644 +--- a/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c ++++ b/drivers/staging/fsl-dpaa2/ethernet/dpaa2-eth.c +@@ -315,7 +315,7 @@ static int consume_frames(struct dpaa2_eth_channel *ch) + } + + fd = dpaa2_dq_fd(dq); +- fq = (struct dpaa2_eth_fq *)dpaa2_dq_fqd_ctx(dq); ++ fq = (struct dpaa2_eth_fq *)(uintptr_t)dpaa2_dq_fqd_ctx(dq); + fq->stats.frames++; + + fq->consume(priv, ch, fd, &ch->napi); +@@ -1888,7 +1888,7 @@ static int setup_rx_flow(struct dpaa2_eth_priv *priv, + queue.destination.id = fq->channel->dpcon_id; + queue.destination.type = DPNI_DEST_DPCON; + queue.destination.priority = 1; +- queue.user_context = (u64)fq; ++ queue.user_context = (u64)(uintptr_t)fq; + err = dpni_set_queue(priv->mc_io, 0, priv->mc_token, + DPNI_QUEUE_RX, 0, fq->flowid, + DPNI_QUEUE_OPT_USER_CTX | DPNI_QUEUE_OPT_DEST, +@@ -1940,7 +1940,7 @@ static int setup_tx_flow(struct dpaa2_eth_priv *priv, + queue.destination.id = fq->channel->dpcon_id; + queue.destination.type = DPNI_DEST_DPCON; + queue.destination.priority = 0; +- queue.user_context = (u64)fq; ++ queue.user_context = (u64)(uintptr_t)fq; + err = dpni_set_queue(priv->mc_io, 0, priv->mc_token, + DPNI_QUEUE_TX_CONFIRM, 0, fq->flowid, + DPNI_QUEUE_OPT_USER_CTX | DPNI_QUEUE_OPT_DEST, +diff --git a/drivers/staging/ks7010/ks_hostif.c b/drivers/staging/ks7010/ks_hostif.c +index 975dbbb3abd0..7da3eb4ca4be 100644 +--- a/drivers/staging/ks7010/ks_hostif.c ++++ b/drivers/staging/ks7010/ks_hostif.c +@@ -242,9 +242,8 @@ int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info, + offset = 0; + + while (bsize > offset) { +- /* DPRINTK(4, "Element ID=%d\n",*bp); */ +- switch (*bp) { +- case 0: /* ssid */ ++ switch (*bp) { /* Information Element ID */ ++ case WLAN_EID_SSID: + if (*(bp + 1) <= SSID_MAX_SIZE) { + ap->ssid.size = *(bp + 1); + } else { +@@ -254,8 +253,8 @@ int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info, + } + memcpy(ap->ssid.body, bp + 2, ap->ssid.size); + break; +- case 1: /* rate */ +- case 50: /* ext rate */ ++ case WLAN_EID_SUPP_RATES: ++ case WLAN_EID_EXT_SUPP_RATES: + if ((*(bp + 1) + ap->rate_set.size) <= + RATE_SET_MAX_SIZE) { + memcpy(&ap->rate_set.body[ap->rate_set.size], +@@ -271,9 +270,9 @@ int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info, + (RATE_SET_MAX_SIZE - ap->rate_set.size); + } + break; +- case 3: /* DS parameter */ ++ case WLAN_EID_DS_PARAMS: + break; +- case 48: /* RSN(WPA2) */ ++ case WLAN_EID_RSN: + ap->rsn_ie.id = *bp; + if (*(bp + 1) <= RSN_IE_BODY_MAX) { + ap->rsn_ie.size = *(bp + 1); +@@ -284,8 +283,8 @@ int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info, + } + memcpy(ap->rsn_ie.body, bp + 2, ap->rsn_ie.size); + break; +- case 221: /* WPA */ +- if (memcmp(bp + 2, "\x00\x50\xf2\x01", 4) == 0) { /* WPA OUI check */ ++ case WLAN_EID_VENDOR_SPECIFIC: /* WPA */ ++ if (memcmp(bp + 2, "\x00\x50\xf2\x01", 4) == 0) { /* WPA OUI check */ + ap->wpa_ie.id = *bp; + if (*(bp + 1) <= RSN_IE_BODY_MAX) { + ap->wpa_ie.size = *(bp + 1); +@@ -300,18 +299,18 @@ int get_ap_information(struct ks_wlan_private *priv, struct ap_info_t *ap_info, + } + break; + +- case 2: /* FH parameter */ +- case 4: /* CF parameter */ +- case 5: /* TIM */ +- case 6: /* IBSS parameter */ +- case 7: /* Country */ +- case 42: /* ERP information */ +- case 47: /* Reserve ID 47 Broadcom AP */ ++ case WLAN_EID_FH_PARAMS: ++ case WLAN_EID_CF_PARAMS: ++ case WLAN_EID_TIM: ++ case WLAN_EID_IBSS_PARAMS: ++ case WLAN_EID_COUNTRY: ++ case WLAN_EID_ERP_INFO: + break; + default: + DPRINTK(4, "unknown Element ID=%d\n", *bp); + break; + } ++ + offset += 2; /* id & size field */ + offset += *(bp + 1); /* +size offset */ + bp += (*(bp + 1) + 2); /* pointer update */ +diff --git a/drivers/staging/ks7010/ks_hostif.h b/drivers/staging/ks7010/ks_hostif.h +index 5bae8d468e23..9ac317e4b507 100644 +--- a/drivers/staging/ks7010/ks_hostif.h ++++ b/drivers/staging/ks7010/ks_hostif.h +@@ -13,6 +13,7 @@ + #define _KS_HOSTIF_H_ + + #include ++#include + + /* + * HOST-MAC I/F events +diff --git a/drivers/staging/lustre/lustre/include/obd.h b/drivers/staging/lustre/lustre/include/obd.h +index a986737ec010..82a499fb23bb 100644 +--- a/drivers/staging/lustre/lustre/include/obd.h ++++ b/drivers/staging/lustre/lustre/include/obd.h +@@ -190,7 +190,7 @@ struct client_obd { + struct sptlrpc_flavor cl_flvr_mgc; /* fixed flavor of mgc->mgs */ + + /* the grant values are protected by loi_list_lock below */ +- unsigned long cl_dirty_pages; /* all _dirty_ in pahges */ ++ unsigned long cl_dirty_pages; /* all _dirty_ in pages */ + unsigned long cl_dirty_max_pages; /* allowed w/o rpc */ + unsigned long cl_dirty_transit; /* dirty synchronous */ + unsigned long cl_avail_grant; /* bytes of credit for ost */ +diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c +index 6e16c930a021..c2aadb2d1fea 100644 +--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c ++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c +@@ -2694,7 +2694,7 @@ static int lmv_unpackmd(struct obd_export *exp, struct lmv_stripe_md **lsmp, + if (lsm && !lmm) { + int i; + +- for (i = 1; i < lsm->lsm_md_stripe_count; i++) { ++ for (i = 0; i < lsm->lsm_md_stripe_count; i++) { + /* + * For migrating inode, the master stripe and master + * object will be the same, so do not need iput, see +diff --git a/drivers/staging/lustre/lustre/osc/osc_cache.c b/drivers/staging/lustre/lustre/osc/osc_cache.c +index e1207c227b79..c356d00d87a5 100644 +--- a/drivers/staging/lustre/lustre/osc/osc_cache.c ++++ b/drivers/staging/lustre/lustre/osc/osc_cache.c +@@ -1528,7 +1528,7 @@ static int osc_enter_cache_try(struct client_obd *cli, + if (rc < 0) + return 0; + +- if (cli->cl_dirty_pages <= cli->cl_dirty_max_pages && ++ if (cli->cl_dirty_pages < cli->cl_dirty_max_pages && + atomic_long_read(&obd_dirty_pages) + 1 <= obd_max_dirty_pages) { + osc_consume_write_grant(cli, &oap->oap_brw_page); + if (transient) { +diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c +index 46b3f19e0878..db3eb7ec5809 100644 +--- a/drivers/staging/rtl8192u/r8192U_core.c ++++ b/drivers/staging/rtl8192u/r8192U_core.c +@@ -1702,6 +1702,8 @@ static short rtl8192_usb_initendpoints(struct net_device *dev) + + priv->rx_urb[16] = usb_alloc_urb(0, GFP_KERNEL); + priv->oldaddr = kmalloc(16, GFP_KERNEL); ++ if (!priv->oldaddr) ++ return -ENOMEM; + oldaddr = priv->oldaddr; + align = ((long)oldaddr) & 3; + if (align) { +diff --git a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +index 8f2d508183b2..9030d71a3d0b 100644 +--- a/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c ++++ b/drivers/staging/vc04_services/bcm2835-audio/bcm2835.c +@@ -36,6 +36,10 @@ MODULE_PARM_DESC(enable_compat_alsa, + static void snd_devm_unregister_child(struct device *dev, void *res) + { + struct device *childdev = *(struct device **)res; ++ struct bcm2835_chip *chip = dev_get_drvdata(childdev); ++ struct snd_card *card = chip->card; ++ ++ snd_card_free(card); + + device_unregister(childdev); + } +@@ -61,6 +65,13 @@ static int snd_devm_add_child(struct device *dev, struct device *child) + return 0; + } + ++static void snd_bcm2835_release(struct device *dev) ++{ ++ struct bcm2835_chip *chip = dev_get_drvdata(dev); ++ ++ kfree(chip); ++} ++ + static struct device * + snd_create_device(struct device *parent, + struct device_driver *driver, +@@ -76,6 +87,7 @@ snd_create_device(struct device *parent, + device_initialize(device); + device->parent = parent; + device->driver = driver; ++ device->release = snd_bcm2835_release; + + dev_set_name(device, "%s", name); + +@@ -86,18 +98,19 @@ snd_create_device(struct device *parent, + return device; + } + +-static int snd_bcm2835_free(struct bcm2835_chip *chip) +-{ +- kfree(chip); +- return 0; +-} +- + /* component-destructor + * (see "Management of Cards and Components") + */ + static int snd_bcm2835_dev_free(struct snd_device *device) + { +- return snd_bcm2835_free(device->device_data); ++ struct bcm2835_chip *chip = device->device_data; ++ struct snd_card *card = chip->card; ++ ++ /* TODO: free pcm, ctl */ ++ ++ snd_device_free(card, chip); ++ ++ return 0; + } + + /* chip-specific constructor +@@ -122,7 +135,7 @@ static int snd_bcm2835_create(struct snd_card *card, + + err = snd_device_new(card, SNDRV_DEV_LOWLEVEL, chip, &ops); + if (err) { +- snd_bcm2835_free(chip); ++ kfree(chip); + return err; + } + +@@ -130,31 +143,14 @@ static int snd_bcm2835_create(struct snd_card *card, + return 0; + } + +-static void snd_devm_card_free(struct device *dev, void *res) ++static struct snd_card *snd_bcm2835_card_new(struct device *dev) + { +- struct snd_card *snd_card = *(struct snd_card **)res; +- +- snd_card_free(snd_card); +-} +- +-static struct snd_card *snd_devm_card_new(struct device *dev) +-{ +- struct snd_card **dr; + struct snd_card *card; + int ret; + +- dr = devres_alloc(snd_devm_card_free, sizeof(*dr), GFP_KERNEL); +- if (!dr) +- return ERR_PTR(-ENOMEM); +- + ret = snd_card_new(dev, -1, NULL, THIS_MODULE, 0, &card); +- if (ret) { +- devres_free(dr); ++ if (ret) + return ERR_PTR(ret); +- } +- +- *dr = card; +- devres_add(dev, dr); + + return card; + } +@@ -271,7 +267,7 @@ static int snd_add_child_device(struct device *device, + return PTR_ERR(child); + } + +- card = snd_devm_card_new(child); ++ card = snd_bcm2835_card_new(child); + if (IS_ERR(card)) { + dev_err(child, "Failed to create card"); + return PTR_ERR(card); +@@ -313,7 +309,7 @@ static int snd_add_child_device(struct device *device, + return err; + } + +- dev_set_drvdata(child, card); ++ dev_set_drvdata(child, chip); + dev_info(child, "card created with %d channels\n", numchans); + + return 0; +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index e32c51d549c3..be456ea27ab2 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -1874,7 +1874,8 @@ int serial8250_handle_irq(struct uart_port *port, unsigned int iir) + + status = serial_port_in(port, UART_LSR); + +- if (status & (UART_LSR_DR | UART_LSR_BI)) { ++ if (status & (UART_LSR_DR | UART_LSR_BI) && ++ iir & UART_IIR_RDI) { + if (!up->dma || handle_rx_dma(up, iir)) + status = serial8250_rx_chars(up, status); + } +diff --git a/drivers/tty/serial/altera_uart.c b/drivers/tty/serial/altera_uart.c +index 3e4b717670d7..59cb62de236b 100644 +--- a/drivers/tty/serial/altera_uart.c ++++ b/drivers/tty/serial/altera_uart.c +@@ -331,7 +331,7 @@ static int altera_uart_startup(struct uart_port *port) + + /* Enable RX interrupts now */ + pp->imr = ALTERA_UART_CONTROL_RRDY_MSK; +- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG); ++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG); + + spin_unlock_irqrestore(&port->lock, flags); + +@@ -347,7 +347,7 @@ static void altera_uart_shutdown(struct uart_port *port) + + /* Disable all interrupts now */ + pp->imr = 0; +- writel(pp->imr, port->membase + ALTERA_UART_CONTROL_REG); ++ altera_uart_writel(port, pp->imr, ALTERA_UART_CONTROL_REG); + + spin_unlock_irqrestore(&port->lock, flags); + +@@ -436,7 +436,7 @@ static void altera_uart_console_putc(struct uart_port *port, int c) + ALTERA_UART_STATUS_TRDY_MSK)) + cpu_relax(); + +- writel(c, port->membase + ALTERA_UART_TXDATA_REG); ++ altera_uart_writel(port, c, ALTERA_UART_TXDATA_REG); + } + + static void altera_uart_console_write(struct console *co, const char *s, +@@ -506,13 +506,13 @@ static int __init altera_uart_earlycon_setup(struct earlycon_device *dev, + return -ENODEV; + + /* Enable RX interrupts now */ +- writel(ALTERA_UART_CONTROL_RRDY_MSK, +- port->membase + ALTERA_UART_CONTROL_REG); ++ altera_uart_writel(port, ALTERA_UART_CONTROL_RRDY_MSK, ++ ALTERA_UART_CONTROL_REG); + + if (dev->baud) { + unsigned int baudclk = port->uartclk / dev->baud; + +- writel(baudclk, port->membase + ALTERA_UART_DIVISOR_REG); ++ altera_uart_writel(port, baudclk, ALTERA_UART_DIVISOR_REG); + } + + dev->con->write = altera_uart_earlycon_write; +diff --git a/drivers/tty/serial/arc_uart.c b/drivers/tty/serial/arc_uart.c +index 77fe306690c4..71e37abb6bcb 100644 +--- a/drivers/tty/serial/arc_uart.c ++++ b/drivers/tty/serial/arc_uart.c +@@ -596,6 +596,11 @@ static int arc_serial_probe(struct platform_device *pdev) + if (dev_id < 0) + dev_id = 0; + ++ if (dev_id >= ARRAY_SIZE(arc_uart_ports)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", dev_id); ++ return -EINVAL; ++ } ++ + uart = &arc_uart_ports[dev_id]; + port = &uart->port; + +diff --git a/drivers/tty/serial/fsl_lpuart.c b/drivers/tty/serial/fsl_lpuart.c +index f0252184291e..7a3db9378fa3 100644 +--- a/drivers/tty/serial/fsl_lpuart.c ++++ b/drivers/tty/serial/fsl_lpuart.c +@@ -2151,6 +2151,10 @@ static int lpuart_probe(struct platform_device *pdev) + dev_err(&pdev->dev, "failed to get alias id, errno %d\n", ret); + return ret; + } ++ if (ret >= ARRAY_SIZE(lpuart_ports)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", ret); ++ return -EINVAL; ++ } + sport->port.line = ret; + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + sport->port.membase = devm_ioremap_resource(&pdev->dev, res); +diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c +index 521500c575c8..8deaf2ad8b34 100644 +--- a/drivers/tty/serial/imx.c ++++ b/drivers/tty/serial/imx.c +@@ -2096,6 +2096,12 @@ static int serial_imx_probe(struct platform_device *pdev) + else if (ret < 0) + return ret; + ++ if (sport->port.line >= ARRAY_SIZE(imx_ports)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", ++ sport->port.line); ++ return -EINVAL; ++ } ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + base = devm_ioremap_resource(&pdev->dev, res); + if (IS_ERR(base)) +diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c +index be94246b6fcc..673c8fd7e34f 100644 +--- a/drivers/tty/serial/mxs-auart.c ++++ b/drivers/tty/serial/mxs-auart.c +@@ -1667,6 +1667,10 @@ static int mxs_auart_probe(struct platform_device *pdev) + s->port.line = pdev->id < 0 ? 0 : pdev->id; + else if (ret < 0) + return ret; ++ if (s->port.line >= ARRAY_SIZE(auart_port)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", s->port.line); ++ return -EINVAL; ++ } + + if (of_id) { + pdev->id_entry = of_id->data; +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index 8aca18c4cdea..bedd4bdec4ab 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1821,6 +1821,10 @@ static int s3c24xx_serial_probe(struct platform_device *pdev) + + dbg("s3c24xx_serial_probe(%p) %d\n", pdev, index); + ++ if (index >= ARRAY_SIZE(s3c24xx_serial_ports)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", index); ++ return -EINVAL; ++ } + ourport = &s3c24xx_serial_ports[index]; + + ourport->drv_data = s3c24xx_get_driver_data(pdev); +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 22f60239026c..8a58ee32ff61 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -3076,6 +3076,10 @@ static struct plat_sci_port *sci_parse_dt(struct platform_device *pdev, + dev_err(&pdev->dev, "failed to get alias id (%d)\n", id); + return NULL; + } ++ if (id >= ARRAY_SIZE(sci_ports)) { ++ dev_err(&pdev->dev, "serial%d out of range\n", id); ++ return NULL; ++ } + + sp = &sci_ports[id]; + *dev_id = id; +diff --git a/drivers/tty/serial/xilinx_uartps.c b/drivers/tty/serial/xilinx_uartps.c +index 31a630ae0870..21c35ad72b99 100644 +--- a/drivers/tty/serial/xilinx_uartps.c ++++ b/drivers/tty/serial/xilinx_uartps.c +@@ -1115,7 +1115,7 @@ static struct uart_port *cdns_uart_get_port(int id) + struct uart_port *port; + + /* Try the given port id if failed use default method */ +- if (cdns_uart_port[id].mapbase != 0) { ++ if (id < CDNS_UART_NR_PORTS && cdns_uart_port[id].mapbase != 0) { + /* Find the next unused port */ + for (id = 0; id < CDNS_UART_NR_PORTS; id++) + if (cdns_uart_port[id].mapbase == 0) +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 4149a965516e..22952d70b981 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -187,6 +187,7 @@ static int acm_wb_alloc(struct acm *acm) + wb = &acm->wb[wbn]; + if (!wb->use) { + wb->use = 1; ++ wb->len = 0; + return wbn; + } + wbn = (wbn + 1) % ACM_NW; +@@ -818,16 +819,18 @@ static int acm_tty_write(struct tty_struct *tty, + static void acm_tty_flush_chars(struct tty_struct *tty) + { + struct acm *acm = tty->driver_data; +- struct acm_wb *cur = acm->putbuffer; ++ struct acm_wb *cur; + int err; + unsigned long flags; + ++ spin_lock_irqsave(&acm->write_lock, flags); ++ ++ cur = acm->putbuffer; + if (!cur) /* nothing to do */ +- return; ++ goto out; + + acm->putbuffer = NULL; + err = usb_autopm_get_interface_async(acm->control); +- spin_lock_irqsave(&acm->write_lock, flags); + if (err < 0) { + cur->use = 0; + acm->putbuffer = cur; +diff --git a/drivers/usb/dwc2/core.h b/drivers/usb/dwc2/core.h +index 8367d4f985c1..ec965ac5f1f5 100644 +--- a/drivers/usb/dwc2/core.h ++++ b/drivers/usb/dwc2/core.h +@@ -216,7 +216,7 @@ struct dwc2_hsotg_ep { + unsigned char dir_in; + unsigned char index; + unsigned char mc; +- unsigned char interval; ++ u16 interval; + + unsigned int halted:1; + unsigned int periodic:1; +diff --git a/drivers/usb/dwc2/gadget.c b/drivers/usb/dwc2/gadget.c +index 0d8e09ccb59c..6ef001a83fe2 100644 +--- a/drivers/usb/dwc2/gadget.c ++++ b/drivers/usb/dwc2/gadget.c +@@ -3414,12 +3414,6 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg, + dwc2_writel(dwc2_hsotg_ep0_mps(hsotg->eps_out[0]->ep.maxpacket) | + DXEPCTL_USBACTEP, hsotg->regs + DIEPCTL0); + +- dwc2_hsotg_enqueue_setup(hsotg); +- +- dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n", +- dwc2_readl(hsotg->regs + DIEPCTL0), +- dwc2_readl(hsotg->regs + DOEPCTL0)); +- + /* clear global NAKs */ + val = DCTL_CGOUTNAK | DCTL_CGNPINNAK; + if (!is_usb_reset) +@@ -3430,6 +3424,12 @@ void dwc2_hsotg_core_init_disconnected(struct dwc2_hsotg *hsotg, + mdelay(3); + + hsotg->lx_state = DWC2_L0; ++ ++ dwc2_hsotg_enqueue_setup(hsotg); ++ ++ dev_dbg(hsotg->dev, "EP0: DIEPCTL0=0x%08x, DOEPCTL0=0x%08x\n", ++ dwc2_readl(hsotg->regs + DIEPCTL0), ++ dwc2_readl(hsotg->regs + DOEPCTL0)); + } + + static void dwc2_hsotg_core_disconnect(struct dwc2_hsotg *hsotg) +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 9bd60ec83ac6..87484f71b2ab 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -979,6 +979,24 @@ void dwc2_hc_halt(struct dwc2_hsotg *hsotg, struct dwc2_host_chan *chan, + + if (dbg_hc(chan)) + dev_vdbg(hsotg->dev, "%s()\n", __func__); ++ ++ /* ++ * In buffer DMA or external DMA mode channel can't be halted ++ * for non-split periodic channels. At the end of the next ++ * uframe/frame (in the worst case), the core generates a channel ++ * halted and disables the channel automatically. ++ */ ++ if ((hsotg->params.g_dma && !hsotg->params.g_dma_desc) || ++ hsotg->hw_params.arch == GHWCFG2_EXT_DMA_ARCH) { ++ if (!chan->do_split && ++ (chan->ep_type == USB_ENDPOINT_XFER_ISOC || ++ chan->ep_type == USB_ENDPOINT_XFER_INT)) { ++ dev_err(hsotg->dev, "%s() Channel can't be halted\n", ++ __func__); ++ return; ++ } ++ } ++ + if (halt_status == DWC2_HC_XFER_NO_HALT_STATUS) + dev_err(hsotg->dev, "!!! halt_status = %d !!!\n", halt_status); + +@@ -2311,10 +2329,22 @@ static int dwc2_core_init(struct dwc2_hsotg *hsotg, bool initial_setup) + */ + static void dwc2_core_host_init(struct dwc2_hsotg *hsotg) + { +- u32 hcfg, hfir, otgctl; ++ u32 hcfg, hfir, otgctl, usbcfg; + + dev_dbg(hsotg->dev, "%s(%p)\n", __func__, hsotg); + ++ /* Set HS/FS Timeout Calibration to 7 (max available value). ++ * The number of PHY clocks that the application programs in ++ * this field is added to the high/full speed interpacket timeout ++ * duration in the core to account for any additional delays ++ * introduced by the PHY. This can be required, because the delay ++ * introduced by the PHY in generating the linestate condition ++ * can vary from one PHY to another. ++ */ ++ usbcfg = dwc2_readl(hsotg->regs + GUSBCFG); ++ usbcfg |= GUSBCFG_TOUTCAL(7); ++ dwc2_writel(usbcfg, hsotg->regs + GUSBCFG); ++ + /* Restart the Phy Clock */ + dwc2_writel(0, hsotg->regs + PCGCTL); + +diff --git a/drivers/usb/dwc3/Makefile b/drivers/usb/dwc3/Makefile +index 7ac725038f8d..025bc68094fc 100644 +--- a/drivers/usb/dwc3/Makefile ++++ b/drivers/usb/dwc3/Makefile +@@ -6,7 +6,7 @@ obj-$(CONFIG_USB_DWC3) += dwc3.o + + dwc3-y := core.o + +-ifneq ($(CONFIG_FTRACE),) ++ifneq ($(CONFIG_TRACING),) + dwc3-y += trace.o + endif + +diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c +index c3f3f1a89b0f..dca78bb20e5d 100644 +--- a/drivers/usb/dwc3/core.c ++++ b/drivers/usb/dwc3/core.c +@@ -243,12 +243,26 @@ static int dwc3_core_soft_reset(struct dwc3 *dwc) + do { + reg = dwc3_readl(dwc->regs, DWC3_DCTL); + if (!(reg & DWC3_DCTL_CSFTRST)) +- return 0; ++ goto done; + + udelay(1); + } while (--retries); + ++ phy_exit(dwc->usb3_generic_phy); ++ phy_exit(dwc->usb2_generic_phy); ++ + return -ETIMEDOUT; ++ ++done: ++ /* ++ * For DWC_usb31 controller, once DWC3_DCTL_CSFTRST bit is cleared, ++ * we must wait at least 50ms before accessing the PHY domain ++ * (synchronization delay). DWC_usb31 programming guide section 1.3.2. ++ */ ++ if (dwc3_is_usb31(dwc)) ++ msleep(50); ++ ++ return 0; + } + + /* +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index fc28819253f7..b782ba58a7fc 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -249,6 +249,8 @@ + #define DWC3_GUSB3PIPECTL_TX_DEEPH(n) ((n) << 1) + + /* Global TX Fifo Size Register */ ++#define DWC31_GTXFIFOSIZ_TXFRAMNUM BIT(15) /* DWC_usb31 only */ ++#define DWC31_GTXFIFOSIZ_TXFDEF(n) ((n) & 0x7fff) /* DWC_usb31 only */ + #define DWC3_GTXFIFOSIZ_TXFDEF(n) ((n) & 0xffff) + #define DWC3_GTXFIFOSIZ_TXFSTADDR(n) ((n) & 0xffff0000) + +diff --git a/drivers/usb/dwc3/dwc3-omap.c b/drivers/usb/dwc3/dwc3-omap.c +index 3530795bbb8f..fdd0d5aa1f5e 100644 +--- a/drivers/usb/dwc3/dwc3-omap.c ++++ b/drivers/usb/dwc3/dwc3-omap.c +@@ -590,9 +590,25 @@ static int dwc3_omap_resume(struct device *dev) + return 0; + } + ++static void dwc3_omap_complete(struct device *dev) ++{ ++ struct dwc3_omap *omap = dev_get_drvdata(dev); ++ ++ if (extcon_get_state(omap->edev, EXTCON_USB)) ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_VALID); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_VBUS_OFF); ++ ++ if (extcon_get_state(omap->edev, EXTCON_USB_HOST)) ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_GROUND); ++ else ++ dwc3_omap_set_mailbox(omap, OMAP_DWC3_ID_FLOAT); ++} ++ + static const struct dev_pm_ops dwc3_omap_dev_pm_ops = { + + SET_SYSTEM_SLEEP_PM_OPS(dwc3_omap_suspend, dwc3_omap_resume) ++ .complete = dwc3_omap_complete, + }; + + #define DEV_PM_OPS (&dwc3_omap_dev_pm_ops) +diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c +index ed9346f0b000..940de04ed72a 100644 +--- a/drivers/usb/gadget/composite.c ++++ b/drivers/usb/gadget/composite.c +@@ -1425,7 +1425,7 @@ static int count_ext_compat(struct usb_configuration *c) + return res; + } + +-static void fill_ext_compat(struct usb_configuration *c, u8 *buf) ++static int fill_ext_compat(struct usb_configuration *c, u8 *buf) + { + int i, count; + +@@ -1452,10 +1452,12 @@ static void fill_ext_compat(struct usb_configuration *c, u8 *buf) + buf += 23; + } + count += 24; +- if (count >= 4096) +- return; ++ if (count + 24 >= USB_COMP_EP0_OS_DESC_BUFSIZ) ++ return count; + } + } ++ ++ return count; + } + + static int count_ext_prop(struct usb_configuration *c, int interface) +@@ -1500,25 +1502,20 @@ static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf) + struct usb_os_desc *d; + struct usb_os_desc_ext_prop *ext_prop; + int j, count, n, ret; +- u8 *start = buf; + + f = c->interface[interface]; ++ count = 10; /* header length */ + for (j = 0; j < f->os_desc_n; ++j) { + if (interface != f->os_desc_table[j].if_id) + continue; + d = f->os_desc_table[j].os_desc; + if (d) + list_for_each_entry(ext_prop, &d->ext_prop, entry) { +- /* 4kB minus header length */ +- n = buf - start; +- if (n >= 4086) +- return 0; +- +- count = ext_prop->data_len + ++ n = ext_prop->data_len + + ext_prop->name_len + 14; +- if (count > 4086 - n) +- return -EINVAL; +- usb_ext_prop_put_size(buf, count); ++ if (count + n >= USB_COMP_EP0_OS_DESC_BUFSIZ) ++ return count; ++ usb_ext_prop_put_size(buf, n); + usb_ext_prop_put_type(buf, ext_prop->type); + ret = usb_ext_prop_put_name(buf, ext_prop->name, + ext_prop->name_len); +@@ -1544,11 +1541,12 @@ static int fill_ext_prop(struct usb_configuration *c, int interface, u8 *buf) + default: + return -EINVAL; + } +- buf += count; ++ buf += n; ++ count += n; + } + } + +- return 0; ++ return count; + } + + /* +@@ -1830,6 +1828,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + req->complete = composite_setup_complete; + buf = req->buf; + os_desc_cfg = cdev->os_desc_config; ++ w_length = min_t(u16, w_length, USB_COMP_EP0_OS_DESC_BUFSIZ); + memset(buf, 0, w_length); + buf[5] = 0x01; + switch (ctrl->bRequestType & USB_RECIP_MASK) { +@@ -1853,8 +1852,8 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + count += 16; /* header */ + put_unaligned_le32(count, buf); + buf += 16; +- fill_ext_compat(os_desc_cfg, buf); +- value = w_length; ++ value = fill_ext_compat(os_desc_cfg, buf); ++ value = min_t(u16, w_length, value); + } + break; + case USB_RECIP_INTERFACE: +@@ -1883,8 +1882,7 @@ composite_setup(struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl) + interface, buf); + if (value < 0) + return value; +- +- value = w_length; ++ value = min_t(u16, w_length, value); + } + break; + } +@@ -2159,8 +2157,8 @@ int composite_os_desc_req_prepare(struct usb_composite_dev *cdev, + goto end; + } + +- /* OS feature descriptor length <= 4kB */ +- cdev->os_desc_req->buf = kmalloc(4096, GFP_KERNEL); ++ cdev->os_desc_req->buf = kmalloc(USB_COMP_EP0_OS_DESC_BUFSIZ, ++ GFP_KERNEL); + if (!cdev->os_desc_req->buf) { + ret = -ENOMEM; + usb_ep_free_request(ep0, cdev->os_desc_req); +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 0904cb6ce4de..7b53ac548b1a 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -759,9 +759,13 @@ static void ffs_user_copy_worker(struct work_struct *work) + bool kiocb_has_eventfd = io_data->kiocb->ki_flags & IOCB_EVENTFD; + + if (io_data->read && ret > 0) { ++ mm_segment_t oldfs = get_fs(); ++ ++ set_fs(USER_DS); + use_mm(io_data->mm); + ret = ffs_copy_to_iter(io_data->buf, ret, &io_data->data); + unuse_mm(io_data->mm); ++ set_fs(oldfs); + } + + io_data->kiocb->ki_complete(io_data->kiocb, ret, ret); +@@ -3239,7 +3243,7 @@ static int ffs_func_setup(struct usb_function *f, + __ffs_event_add(ffs, FUNCTIONFS_SETUP); + spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); + +- return 0; ++ return USB_GADGET_DELAYED_STATUS; + } + + static bool ffs_func_req_match(struct usb_function *f, +diff --git a/drivers/usb/gadget/function/f_uac2.c b/drivers/usb/gadget/function/f_uac2.c +index f05c3f3e6103..97cb2dfd6369 100644 +--- a/drivers/usb/gadget/function/f_uac2.c ++++ b/drivers/usb/gadget/function/f_uac2.c +@@ -528,6 +528,8 @@ afunc_bind(struct usb_configuration *cfg, struct usb_function *fn) + dev_err(dev, "%s:%d Error!\n", __func__, __LINE__); + return ret; + } ++ iad_desc.bFirstInterface = ret; ++ + std_ac_if_desc.bInterfaceNumber = ret; + uac2->ac_intf = ret; + uac2->ac_alt = 0; +diff --git a/drivers/usb/gadget/udc/core.c b/drivers/usb/gadget/udc/core.c +index 5bab09294a8a..ad315c4c6f35 100644 +--- a/drivers/usb/gadget/udc/core.c ++++ b/drivers/usb/gadget/udc/core.c +@@ -191,8 +191,8 @@ EXPORT_SYMBOL_GPL(usb_ep_alloc_request); + void usb_ep_free_request(struct usb_ep *ep, + struct usb_request *req) + { +- ep->ops->free_request(ep, req); + trace_usb_ep_free_request(ep, req, 0); ++ ep->ops->free_request(ep, req); + } + EXPORT_SYMBOL_GPL(usb_ep_free_request); + +diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c +index 6f2f71c054be..7874c112f3fd 100644 +--- a/drivers/usb/gadget/udc/fsl_udc_core.c ++++ b/drivers/usb/gadget/udc/fsl_udc_core.c +@@ -1309,7 +1309,7 @@ static void udc_reset_ep_queue(struct fsl_udc *udc, u8 pipe) + { + struct fsl_ep *ep = get_ep_by_pipe(udc, pipe); + +- if (ep->name) ++ if (ep->ep.name) + nuke(ep, -ESHUTDOWN); + } + +@@ -1697,7 +1697,7 @@ static void dtd_complete_irq(struct fsl_udc *udc) + curr_ep = get_ep_by_pipe(udc, i); + + /* If the ep is configured */ +- if (curr_ep->name == NULL) { ++ if (!curr_ep->ep.name) { + WARNING("Invalid EP?"); + continue; + } +diff --git a/drivers/usb/gadget/udc/goku_udc.h b/drivers/usb/gadget/udc/goku_udc.h +index 86d2adafe149..64eb0f2b5ea0 100644 +--- a/drivers/usb/gadget/udc/goku_udc.h ++++ b/drivers/usb/gadget/udc/goku_udc.h +@@ -28,7 +28,7 @@ struct goku_udc_regs { + # define INT_EP1DATASET 0x00040 + # define INT_EP2DATASET 0x00080 + # define INT_EP3DATASET 0x00100 +-#define INT_EPnNAK(n) (0x00100 < (n)) /* 0 < n < 4 */ ++#define INT_EPnNAK(n) (0x00100 << (n)) /* 0 < n < 4 */ + # define INT_EP1NAK 0x00200 + # define INT_EP2NAK 0x00400 + # define INT_EP3NAK 0x00800 +diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c +index 1099465b27f0..b4599aa428f3 100644 +--- a/drivers/usb/host/ohci-hcd.c ++++ b/drivers/usb/host/ohci-hcd.c +@@ -446,7 +446,8 @@ static int ohci_init (struct ohci_hcd *ohci) + struct usb_hcd *hcd = ohci_to_hcd(ohci); + + /* Accept arbitrarily long scatter-gather lists */ +- hcd->self.sg_tablesize = ~0; ++ if (!(hcd->driver->flags & HCD_LOCAL_MEM)) ++ hcd->self.sg_tablesize = ~0; + + if (distrust_firmware) + ohci->flags |= OHCI_QUIRK_HUB_POWER; +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index ccdc971283d0..efd7e4882d66 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -926,6 +926,8 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) + if (dev->out_ctx) + xhci_free_container_ctx(xhci, dev->out_ctx); + ++ if (dev->udev && dev->udev->slot_id) ++ dev->udev->slot_id = 0; + kfree(xhci->devs[slot_id]); + xhci->devs[slot_id] = NULL; + } +diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c +index 7d9e085f7b85..830dd0dbbce0 100644 +--- a/drivers/usb/host/xhci-plat.c ++++ b/drivers/usb/host/xhci-plat.c +@@ -355,7 +355,6 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev) + { + struct usb_hcd *hcd = dev_get_drvdata(dev); + struct xhci_hcd *xhci = hcd_to_xhci(hcd); +- int ret; + + /* + * xhci_suspend() needs `do_wakeup` to know whether host is allowed +@@ -365,12 +364,7 @@ static int __maybe_unused xhci_plat_suspend(struct device *dev) + * reconsider this when xhci_plat_suspend enlarges its scope, e.g., + * also applies to runtime suspend. + */ +- ret = xhci_suspend(xhci, device_may_wakeup(dev)); +- +- if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk)) +- clk_disable_unprepare(xhci->clk); +- +- return ret; ++ return xhci_suspend(xhci, device_may_wakeup(dev)); + } + + static int __maybe_unused xhci_plat_resume(struct device *dev) +@@ -379,9 +373,6 @@ static int __maybe_unused xhci_plat_resume(struct device *dev) + struct xhci_hcd *xhci = hcd_to_xhci(hcd); + int ret; + +- if (!device_may_wakeup(dev) && !IS_ERR(xhci->clk)) +- clk_prepare_enable(xhci->clk); +- + ret = xhci_priv_resume_quirk(hcd); + if (ret) + return ret; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index bcf315b32bff..d8b185b0d0f9 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4764,6 +4764,7 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + * quirks + */ + struct device *dev = hcd->self.sysdev; ++ unsigned int minor_rev; + int retval; + + /* Accept arbitrarily long scatter-gather lists */ +@@ -4791,12 +4792,19 @@ int xhci_gen_setup(struct usb_hcd *hcd, xhci_get_quirks_t get_quirks) + */ + hcd->has_tt = 1; + } else { +- /* Some 3.1 hosts return sbrn 0x30, can't rely on sbrn alone */ +- if (xhci->sbrn == 0x31 || xhci->usb3_rhub.min_rev >= 1) { +- xhci_info(xhci, "Host supports USB 3.1 Enhanced SuperSpeed\n"); ++ /* ++ * Some 3.1 hosts return sbrn 0x30, use xhci supported protocol ++ * minor revision instead of sbrn ++ */ ++ minor_rev = xhci->usb3_rhub.min_rev; ++ if (minor_rev) { + hcd->speed = HCD_USB31; + hcd->self.root_hub->speed = USB_SPEED_SUPER_PLUS; + } ++ xhci_info(xhci, "Host supports USB 3.%x %s SuperSpeed\n", ++ minor_rev, ++ minor_rev ? "Enhanced" : ""); ++ + /* xHCI private pointer was set in xhci_pci_probe for the second + * registered roothub. + */ +diff --git a/drivers/usb/usbip/Kconfig b/drivers/usb/usbip/Kconfig +index eeefa29f8aa2..a20b65cb6678 100644 +--- a/drivers/usb/usbip/Kconfig ++++ b/drivers/usb/usbip/Kconfig +@@ -27,7 +27,7 @@ config USBIP_VHCI_HCD + + config USBIP_VHCI_HC_PORTS + int "Number of ports per USB/IP virtual host controller" +- range 1 31 ++ range 1 15 + default 8 + depends on USBIP_VHCI_HCD + ---help--- +diff --git a/fs/ext2/inode.c b/fs/ext2/inode.c +index 1442a4c734c8..a7c87d593083 100644 +--- a/fs/ext2/inode.c ++++ b/fs/ext2/inode.c +@@ -1261,21 +1261,11 @@ static void __ext2_truncate_blocks(struct inode *inode, loff_t offset) + + static void ext2_truncate_blocks(struct inode *inode, loff_t offset) + { +- /* +- * XXX: it seems like a bug here that we don't allow +- * IS_APPEND inode to have blocks-past-i_size trimmed off. +- * review and fix this. +- * +- * Also would be nice to be able to handle IO errors and such, +- * but that's probably too much to ask. +- */ + if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) || + S_ISLNK(inode->i_mode))) + return; + if (ext2_inode_is_fast_symlink(inode)) + return; +- if (IS_APPEND(inode) || IS_IMMUTABLE(inode)) +- return; + + dax_sem_down_write(EXT2_I(inode)); + __ext2_truncate_blocks(inode, offset); +diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c +index e5bb2de2262a..3cba08c931ee 100644 +--- a/fs/hfsplus/super.c ++++ b/fs/hfsplus/super.c +@@ -588,6 +588,7 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent) + return 0; + + out_put_hidden_dir: ++ cancel_delayed_work_sync(&sbi->sync_work); + iput(sbi->hidden_dir); + out_put_root: + dput(sb->s_root); +diff --git a/include/linux/u64_stats_sync.h b/include/linux/u64_stats_sync.h +index 5bdbd9f49395..07ee0f84a46c 100644 +--- a/include/linux/u64_stats_sync.h ++++ b/include/linux/u64_stats_sync.h +@@ -90,6 +90,28 @@ static inline void u64_stats_update_end(struct u64_stats_sync *syncp) + #endif + } + ++static inline unsigned long ++u64_stats_update_begin_irqsave(struct u64_stats_sync *syncp) ++{ ++ unsigned long flags = 0; ++ ++#if BITS_PER_LONG==32 && defined(CONFIG_SMP) ++ local_irq_save(flags); ++ write_seqcount_begin(&syncp->seq); ++#endif ++ return flags; ++} ++ ++static inline void ++u64_stats_update_end_irqrestore(struct u64_stats_sync *syncp, ++ unsigned long flags) ++{ ++#if BITS_PER_LONG==32 && defined(CONFIG_SMP) ++ write_seqcount_end(&syncp->seq); ++ local_irq_restore(flags); ++#endif ++} ++ + static inline void u64_stats_update_begin_raw(struct u64_stats_sync *syncp) + { + #if BITS_PER_LONG==32 && defined(CONFIG_SMP) +diff --git a/include/linux/usb/composite.h b/include/linux/usb/composite.h +index f665d2ceac20..590d313b5f39 100644 +--- a/include/linux/usb/composite.h ++++ b/include/linux/usb/composite.h +@@ -53,6 +53,9 @@ + /* big enough to hold our biggest descriptor */ + #define USB_COMP_EP0_BUFSIZ 1024 + ++/* OS feature descriptor length <= 4kB */ ++#define USB_COMP_EP0_OS_DESC_BUFSIZ 4096 ++ + #define USB_MS_TO_HS_INTERVAL(x) (ilog2((x * 1000 / 125)) + 1) + struct usb_configuration; + +diff --git a/include/scsi/scsi.h b/include/scsi/scsi.h +index cb85eddb47ea..eb7853c1a23b 100644 +--- a/include/scsi/scsi.h ++++ b/include/scsi/scsi.h +@@ -47,6 +47,8 @@ static inline int scsi_status_is_good(int status) + */ + status &= 0xfe; + return ((status == SAM_STAT_GOOD) || ++ (status == SAM_STAT_CONDITION_MET) || ++ /* Next two "intermediate" statuses are obsolete in SAM-4 */ + (status == SAM_STAT_INTERMEDIATE) || + (status == SAM_STAT_INTERMEDIATE_CONDITION_MET) || + /* FIXME: this is obsolete in SAM-3 */ +diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h +index 51626b4175c0..3fab6c81917f 100644 +--- a/include/uapi/linux/nl80211.h ++++ b/include/uapi/linux/nl80211.h +@@ -2604,6 +2604,8 @@ enum nl80211_attrs { + #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS + #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS + ++#define NL80211_WIPHY_NAME_MAXLEN 128 ++ + #define NL80211_MAX_SUPP_RATES 32 + #define NL80211_MAX_SUPP_HT_RATES 77 + #define NL80211_MAX_SUPP_REG_RULES 64 +diff --git a/net/core/dev.c b/net/core/dev.c +index e7d56c5adde6..6ca771f2f25b 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -2058,7 +2058,7 @@ static bool remove_xps_queue_cpu(struct net_device *dev, + int i, j; + + for (i = count, j = offset; i--; j++) { +- if (!remove_xps_queue(dev_maps, cpu, j)) ++ if (!remove_xps_queue(dev_maps, tci, j)) + break; + } + +diff --git a/net/core/sock.c b/net/core/sock.c +index ec6eb546b228..68d08ed5521e 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1595,7 +1595,7 @@ void sk_destruct(struct sock *sk) + + static void __sk_free(struct sock *sk) + { +- if (unlikely(sock_diag_has_destroy_listeners(sk) && sk->sk_net_refcnt)) ++ if (unlikely(sk->sk_net_refcnt && sock_diag_has_destroy_listeners(sk))) + sock_diag_broadcast_destroy(sk); + else + sk_destruct(sk); +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index e8e675be60ec..63d5d66e040a 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -1040,7 +1040,8 @@ static int __ip_append_data(struct sock *sk, + if (copy > length) + copy = length; + +- if (!(rt->dst.dev->features&NETIF_F_SG)) { ++ if (!(rt->dst.dev->features&NETIF_F_SG) && ++ skb_tailroom(skb) >= copy) { + unsigned int off; + + off = skb->len; +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 83d11cd2eb65..abae5196cd3a 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2814,8 +2814,10 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + return -EBUSY; + + if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) { +- if (before(TCP_SKB_CB(skb)->end_seq, tp->snd_una)) +- BUG(); ++ if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) { ++ WARN_ON_ONCE(1); ++ return -EINVAL; ++ } + if (tcp_trim_head(sk, skb, tp->snd_una - TCP_SKB_CB(skb)->seq)) + return -ENOMEM; + } +@@ -3312,6 +3314,7 @@ static void tcp_connect_init(struct sock *sk) + sock_reset_flag(sk, SOCK_DONE); + tp->snd_wnd = 0; + tcp_init_wl(tp, 0); ++ tcp_write_queue_purge(sk); + tp->snd_una = tp->write_seq; + tp->snd_sml = tp->write_seq; + tp->snd_up = tp->write_seq; +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index ffbb81609016..0f2d74885bcb 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1488,7 +1488,8 @@ static int __ip6_append_data(struct sock *sk, + if (copy > length) + copy = length; + +- if (!(rt->dst.dev->features&NETIF_F_SG)) { ++ if (!(rt->dst.dev->features&NETIF_F_SG) && ++ skb_tailroom(skb) >= copy) { + unsigned int off; + + off = skb->len; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 3994b71f8197..8351faabba62 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2912,13 +2912,15 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + if (skb == NULL) + goto out_unlock; + +- skb_set_network_header(skb, reserve); ++ skb_reset_network_header(skb); + + err = -EINVAL; + if (sock->type == SOCK_DGRAM) { + offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len); + if (unlikely(offset < 0)) + goto out_free; ++ } else if (reserve) { ++ skb_push(skb, reserve); + } + + /* Returns -EFAULT on error */ +diff --git a/net/sched/act_vlan.c b/net/sched/act_vlan.c +index 16eb067a8d8f..5c10a0fce35b 100644 +--- a/net/sched/act_vlan.c ++++ b/net/sched/act_vlan.c +@@ -154,6 +154,8 @@ static int tcf_vlan_init(struct net *net, struct nlattr *nla, + case htons(ETH_P_8021AD): + break; + default: ++ if (exists) ++ tcf_idr_release(*a, bind); + return -EPROTONOSUPPORT; + } + } else { +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index d87c41e82917..c453b8d81c9e 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -191,10 +191,11 @@ static int red_change(struct Qdisc *sch, struct nlattr *opt) + child = fifo_create_dflt(sch, &bfifo_qdisc_ops, ctl->limit); + if (IS_ERR(child)) + return PTR_ERR(child); +- } + +- if (child != &noop_qdisc) ++ /* child is fifo, no need to check for noop_qdisc */ + qdisc_hash_add(child, true); ++ } ++ + sch_tree_lock(sch); + q->flags = ctl->flags; + q->limit = ctl->limit; +diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c +index 120f4f365967..b36ecb58aa6e 100644 +--- a/net/sched/sch_tbf.c ++++ b/net/sched/sch_tbf.c +@@ -388,6 +388,9 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) + err = PTR_ERR(child); + goto done; + } ++ ++ /* child is fifo, no need to check for noop_qdisc */ ++ qdisc_hash_add(child, true); + } + + sch_tree_lock(sch); +@@ -396,8 +399,6 @@ static int tbf_change(struct Qdisc *sch, struct nlattr *opt) + q->qdisc->qstats.backlog); + qdisc_destroy(q->qdisc); + q->qdisc = child; +- if (child != &noop_qdisc) +- qdisc_hash_add(child, true); + } + q->limit = qopt->limit; + if (tb[TCA_TBF_PBURST]) +diff --git a/net/smc/smc_pnet.c b/net/smc/smc_pnet.c +index 74568cdbca70..d7b88b2d1b22 100644 +--- a/net/smc/smc_pnet.c ++++ b/net/smc/smc_pnet.c +@@ -245,40 +245,45 @@ static struct smc_ib_device *smc_pnet_find_ib(char *ib_name) + static int smc_pnet_fill_entry(struct net *net, struct smc_pnetentry *pnetelem, + struct nlattr *tb[]) + { +- char *string, *ibname = NULL; +- int rc = 0; ++ char *string, *ibname; ++ int rc; + + memset(pnetelem, 0, sizeof(*pnetelem)); + INIT_LIST_HEAD(&pnetelem->list); +- if (tb[SMC_PNETID_NAME]) { +- string = (char *)nla_data(tb[SMC_PNETID_NAME]); +- if (!smc_pnetid_valid(string, pnetelem->pnet_name)) { +- rc = -EINVAL; +- goto error; +- } +- } +- if (tb[SMC_PNETID_ETHNAME]) { +- string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]); +- pnetelem->ndev = dev_get_by_name(net, string); +- if (!pnetelem->ndev) +- return -ENOENT; +- } +- if (tb[SMC_PNETID_IBNAME]) { +- ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]); +- ibname = strim(ibname); +- pnetelem->smcibdev = smc_pnet_find_ib(ibname); +- if (!pnetelem->smcibdev) { +- rc = -ENOENT; +- goto error; +- } +- } +- if (tb[SMC_PNETID_IBPORT]) { +- pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]); +- if (pnetelem->ib_port > SMC_MAX_PORTS) { +- rc = -EINVAL; +- goto error; +- } +- } ++ ++ rc = -EINVAL; ++ if (!tb[SMC_PNETID_NAME]) ++ goto error; ++ string = (char *)nla_data(tb[SMC_PNETID_NAME]); ++ if (!smc_pnetid_valid(string, pnetelem->pnet_name)) ++ goto error; ++ ++ rc = -EINVAL; ++ if (!tb[SMC_PNETID_ETHNAME]) ++ goto error; ++ rc = -ENOENT; ++ string = (char *)nla_data(tb[SMC_PNETID_ETHNAME]); ++ pnetelem->ndev = dev_get_by_name(net, string); ++ if (!pnetelem->ndev) ++ goto error; ++ ++ rc = -EINVAL; ++ if (!tb[SMC_PNETID_IBNAME]) ++ goto error; ++ rc = -ENOENT; ++ ibname = (char *)nla_data(tb[SMC_PNETID_IBNAME]); ++ ibname = strim(ibname); ++ pnetelem->smcibdev = smc_pnet_find_ib(ibname); ++ if (!pnetelem->smcibdev) ++ goto error; ++ ++ rc = -EINVAL; ++ if (!tb[SMC_PNETID_IBPORT]) ++ goto error; ++ pnetelem->ib_port = nla_get_u8(tb[SMC_PNETID_IBPORT]); ++ if (pnetelem->ib_port < 1 || pnetelem->ib_port > SMC_MAX_PORTS) ++ goto error; ++ + return 0; + + error: +@@ -307,6 +312,8 @@ static int smc_pnet_get(struct sk_buff *skb, struct genl_info *info) + void *hdr; + int rc; + ++ if (!info->attrs[SMC_PNETID_NAME]) ++ return -EINVAL; + pnetelem = smc_pnet_find_pnetid( + (char *)nla_data(info->attrs[SMC_PNETID_NAME])); + if (!pnetelem) +@@ -359,6 +366,8 @@ static int smc_pnet_add(struct sk_buff *skb, struct genl_info *info) + + static int smc_pnet_del(struct sk_buff *skb, struct genl_info *info) + { ++ if (!info->attrs[SMC_PNETID_NAME]) ++ return -EINVAL; + return smc_pnet_remove_by_pnetid( + (char *)nla_data(info->attrs[SMC_PNETID_NAME])); + } +diff --git a/net/wireless/core.c b/net/wireless/core.c +index 33ce0484b2a0..45cbade9ad68 100644 +--- a/net/wireless/core.c ++++ b/net/wireless/core.c +@@ -95,6 +95,9 @@ static int cfg80211_dev_check_name(struct cfg80211_registered_device *rdev, + + ASSERT_RTNL(); + ++ if (strlen(newname) > NL80211_WIPHY_NAME_MAXLEN) ++ return -EINVAL; ++ + /* prohibit calling the thing phy%d when %d is not its number */ + sscanf(newname, PHY_NAME "%d%n", &wiphy_idx, &taken); + if (taken == strlen(newname) && wiphy_idx != rdev->wiphy_idx) { +diff --git a/sound/soc/codecs/hdmi-codec.c b/sound/soc/codecs/hdmi-codec.c +index 3abf82563408..cf3b905b4ead 100644 +--- a/sound/soc/codecs/hdmi-codec.c ++++ b/sound/soc/codecs/hdmi-codec.c +@@ -801,12 +801,7 @@ static int hdmi_codec_probe(struct platform_device *pdev) + + static int hdmi_codec_remove(struct platform_device *pdev) + { +- struct device *dev = &pdev->dev; +- struct hdmi_codec_priv *hcp; +- +- hcp = dev_get_drvdata(dev); +- kfree(hcp->chmap_info); +- snd_soc_unregister_codec(dev); ++ snd_soc_unregister_codec(&pdev->dev); + + return 0; + } +diff --git a/sound/soc/rockchip/Kconfig b/sound/soc/rockchip/Kconfig +index b0825370d262..957046ac6c8c 100644 +--- a/sound/soc/rockchip/Kconfig ++++ b/sound/soc/rockchip/Kconfig +@@ -56,6 +56,9 @@ config SND_SOC_RK3288_HDMI_ANALOG + depends on SND_SOC_ROCKCHIP && I2C && GPIOLIB && CLKDEV_LOOKUP + select SND_SOC_ROCKCHIP_I2S + select SND_SOC_HDMI_CODEC ++ select SND_SOC_ES8328_I2C ++ select SND_SOC_ES8328_SPI if SPI_MASTER ++ select DRM_DW_HDMI_I2S_AUDIO if DRM_DW_HDMI + help + Say Y or M here if you want to add support for SoC audio on Rockchip + RK3288 boards using an analog output and the built-in HDMI audio. +diff --git a/sound/soc/samsung/i2s.c b/sound/soc/samsung/i2s.c +index 10a4da06c0a1..f058f2bdd519 100644 +--- a/sound/soc/samsung/i2s.c ++++ b/sound/soc/samsung/i2s.c +@@ -653,8 +653,12 @@ static int i2s_set_fmt(struct snd_soc_dai *dai, + tmp |= mod_slave; + break; + case SND_SOC_DAIFMT_CBS_CFS: +- /* Set default source clock in Master mode */ +- if (i2s->rclk_srcrate == 0) ++ /* ++ * Set default source clock in Master mode, only when the ++ * CLK_I2S_RCLK_SRC clock is not exposed so we ensure any ++ * clock configuration assigned in DT is not overwritten. ++ */ ++ if (i2s->rclk_srcrate == 0 && i2s->clk_data.clks == NULL) + i2s_set_sysclk(dai, SAMSUNG_I2S_RCLKSRC_0, + 0, SND_SOC_CLOCK_IN); + break; +@@ -878,6 +882,11 @@ static int config_setup(struct i2s_dai *i2s) + return 0; + + if (!(i2s->quirks & QUIRK_NO_MUXPSR)) { ++ struct clk *rclksrc = i2s->clk_table[CLK_I2S_RCLK_SRC]; ++ ++ if (i2s->rclk_srcrate == 0 && rclksrc && !IS_ERR(rclksrc)) ++ i2s->rclk_srcrate = clk_get_rate(rclksrc); ++ + psr = i2s->rclk_srcrate / i2s->frmclk / rfs; + writel(((psr - 1) << 8) | PSR_PSREN, i2s->addr + I2SPSR); + dev_dbg(&i2s->pdev->dev, +diff --git a/sound/soc/samsung/odroid.c b/sound/soc/samsung/odroid.c +index 44b6de5a331a..06a31a9585a0 100644 +--- a/sound/soc/samsung/odroid.c ++++ b/sound/soc/samsung/odroid.c +@@ -36,23 +36,26 @@ static int odroid_card_hw_params(struct snd_pcm_substream *substream, + { + struct snd_soc_pcm_runtime *rtd = substream->private_data; + struct odroid_priv *priv = snd_soc_card_get_drvdata(rtd->card); +- unsigned int pll_freq, rclk_freq; ++ unsigned int pll_freq, rclk_freq, rfs; + int ret; + + switch (params_rate(params)) { +- case 32000: + case 64000: +- pll_freq = 131072006U; ++ pll_freq = 196608001U; ++ rfs = 384; + break; + case 44100: + case 88200: + case 176400: + pll_freq = 180633609U; ++ rfs = 512; + break; ++ case 32000: + case 48000: + case 96000: + case 192000: + pll_freq = 196608001U; ++ rfs = 512; + break; + default: + return -EINVAL; +@@ -67,7 +70,7 @@ static int odroid_card_hw_params(struct snd_pcm_substream *substream, + * frequency values due to the EPLL output frequency not being exact + * multiple of the audio sampling rate. + */ +- rclk_freq = params_rate(params) * 256 + 1; ++ rclk_freq = params_rate(params) * rfs + 1; + + ret = clk_set_rate(priv->sclk_i2s, rclk_freq); + if (ret < 0) +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 782c580b7aa3..e5049fbfc4f1 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1276,6 +1276,9 @@ static struct snd_kcontrol_new *soc_tplg_dapm_widget_dmixer_create( + kfree(sm); + continue; + } ++ ++ /* create any TLV data */ ++ soc_tplg_create_tlv(tplg, &kc[i], &mc->hdr); + } + return kc; + +diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c +index 58f94f399efb..ad14d6b78bdc 100644 +--- a/sound/usb/quirks.c ++++ b/sound/usb/quirks.c +@@ -1155,24 +1155,27 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) + return false; + } + +-/* Marantz/Denon USB DACs need a vendor cmd to switch ++/* ITF-USB DSD based DACs need a vendor cmd to switch + * between PCM and native DSD mode ++ * (2 altsets version) + */ +-static bool is_marantz_denon_dac(unsigned int id) ++static bool is_itf_usb_dsd_2alts_dac(unsigned int id) + { + switch (id) { + case USB_ID(0x154e, 0x1003): /* Denon DA-300USB */ + case USB_ID(0x154e, 0x3005): /* Marantz HD-DAC1 */ + case USB_ID(0x154e, 0x3006): /* Marantz SA-14S1 */ ++ case USB_ID(0x1852, 0x5065): /* Luxman DA-06 */ + return true; + } + return false; + } + +-/* TEAC UD-501/UD-503/NT-503 USB DACs need a vendor cmd to switch +- * between PCM/DOP and native DSD mode ++/* ITF-USB DSD based DACs need a vendor cmd to switch ++ * between PCM and native DSD mode ++ * (3 altsets version) + */ +-static bool is_teac_dsd_dac(unsigned int id) ++static bool is_itf_usb_dsd_3alts_dac(unsigned int id) + { + switch (id) { + case USB_ID(0x0644, 0x8043): /* TEAC UD-501/UD-503/NT-503 */ +@@ -1189,7 +1192,7 @@ int snd_usb_select_mode_quirk(struct snd_usb_substream *subs, + struct usb_device *dev = subs->dev; + int err; + +- if (is_marantz_denon_dac(subs->stream->chip->usb_id)) { ++ if (is_itf_usb_dsd_2alts_dac(subs->stream->chip->usb_id)) { + /* First switch to alt set 0, otherwise the mode switch cmd + * will not be accepted by the DAC + */ +@@ -1210,7 +1213,7 @@ int snd_usb_select_mode_quirk(struct snd_usb_substream *subs, + break; + } + mdelay(20); +- } else if (is_teac_dsd_dac(subs->stream->chip->usb_id)) { ++ } else if (is_itf_usb_dsd_3alts_dac(subs->stream->chip->usb_id)) { + /* Vendor mode switch cmd is required. */ + switch (fmt->altsetting) { + case 3: /* DSD mode (DSD_U32) requested */ +@@ -1306,10 +1309,10 @@ void snd_usb_ctl_msg_quirk(struct usb_device *dev, unsigned int pipe, + (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + mdelay(20); + +- /* Marantz/Denon devices with USB DAC functionality need a delay ++ /* ITF-USB DSD based DACs functionality need a delay + * after each class compliant request + */ +- if (is_marantz_denon_dac(chip->usb_id) ++ if (is_itf_usb_dsd_2alts_dac(chip->usb_id) + && (requesttype & USB_TYPE_MASK) == USB_TYPE_CLASS) + mdelay(20); + +@@ -1396,14 +1399,14 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, + break; + } + +- /* Denon/Marantz devices with USB DAC functionality */ +- if (is_marantz_denon_dac(chip->usb_id)) { ++ /* ITF-USB DSD based DACs (2 altsets version) */ ++ if (is_itf_usb_dsd_2alts_dac(chip->usb_id)) { + if (fp->altsetting == 2) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + } + +- /* TEAC devices with USB DAC functionality */ +- if (is_teac_dsd_dac(chip->usb_id)) { ++ /* ITF-USB DSD based DACs (3 altsets version) */ ++ if (is_itf_usb_dsd_3alts_dac(chip->usb_id)) { + if (fp->altsetting == 3) + return SNDRV_PCM_FMTBIT_DSD_U32_BE; + } diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.44-45.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.44-45.patch new file mode 100644 index 000000000000..b09109cd3e0c --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.44-45.patch @@ -0,0 +1,16561 @@ +diff --git a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt +index 7eda08eb8a1e..a2b6a8a565a7 100644 +--- a/Documentation/devicetree/bindings/clock/sunxi-ccu.txt ++++ b/Documentation/devicetree/bindings/clock/sunxi-ccu.txt +@@ -20,6 +20,7 @@ Required properties : + - "allwinner,sun50i-a64-ccu" + - "allwinner,sun50i-a64-r-ccu" + - "allwinner,sun50i-h5-ccu" ++ - "allwinner,sun50i-h6-ccu" + - "nextthing,gr8-ccu" + + - reg: Must contain the registers base address and length +@@ -31,6 +32,9 @@ Required properties : + - #clock-cells : must contain 1 + - #reset-cells : must contain 1 + ++For the main CCU on H6, one more clock is needed: ++- "iosc": the SoC's internal frequency oscillator ++ + For the PRCM CCUs on A83T/H3/A64, two more clocks are needed: + - "pll-periph": the SoC's peripheral PLL from the main CCU + - "iosc": the SoC's internal frequency oscillator +diff --git a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt +index 217a90eaabe7..9c38bbe7e6d7 100644 +--- a/Documentation/devicetree/bindings/dma/mv-xor-v2.txt ++++ b/Documentation/devicetree/bindings/dma/mv-xor-v2.txt +@@ -11,7 +11,11 @@ Required properties: + interrupts. + + Optional properties: +-- clocks: Optional reference to the clock used by the XOR engine. ++- clocks: Optional reference to the clocks used by the XOR engine. ++- clock-names: mandatory if there is a second clock, in this case the ++ name must be "core" for the first clock and "reg" for the second ++ one ++ + + Example: + +diff --git a/Documentation/devicetree/bindings/pinctrl/axis,artpec6-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/axis,artpec6-pinctrl.txt +index 47284f85ec80..c3f9826692bc 100644 +--- a/Documentation/devicetree/bindings/pinctrl/axis,artpec6-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/axis,artpec6-pinctrl.txt +@@ -20,7 +20,8 @@ Required subnode-properties: + gpio: cpuclkoutgrp0, udlclkoutgrp0, i2c1grp0, i2c2grp0, + i2c3grp0, i2s0grp0, i2s1grp0, i2srefclkgrp0, spi0grp0, + spi1grp0, pciedebuggrp0, uart0grp0, uart0grp1, uart1grp0, +- uart2grp0, uart2grp1, uart3grp0, uart4grp0, uart5grp0 ++ uart2grp0, uart2grp1, uart3grp0, uart4grp0, uart5grp0, ++ uart5nocts + cpuclkout: cpuclkoutgrp0 + udlclkout: udlclkoutgrp0 + i2c1: i2c1grp0 +@@ -37,7 +38,7 @@ Required subnode-properties: + uart2: uart2grp0, uart2grp1 + uart3: uart3grp0 + uart4: uart4grp0 +- uart5: uart5grp0 ++ uart5: uart5grp0, uart5nocts + nand: nandgrp0 + sdio0: sdio0grp0 + sdio1: sdio1grp0 +diff --git a/Makefile b/Makefile +index 787cf6605209..f3ea74e7a516 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 44 ++SUBLEVEL = 45 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/alpha/include/asm/xchg.h b/arch/alpha/include/asm/xchg.h +index 68dfb3cb7145..02a7c2fa6106 100644 +--- a/arch/alpha/include/asm/xchg.h ++++ b/arch/alpha/include/asm/xchg.h +@@ -12,6 +12,10 @@ + * Atomic exchange. + * Since it can be used to implement critical sections + * it must clobber "memory" (also for interrupts in UP). ++ * ++ * The leading and the trailing memory barriers guarantee that these ++ * operations are fully ordered. ++ * + */ + + static inline unsigned long +@@ -19,6 +23,7 @@ ____xchg(_u8, volatile char *m, unsigned long val) + { + unsigned long ret, tmp, addr64; + ++ smp_mb(); + __asm__ __volatile__( + " andnot %4,7,%3\n" + " insbl %1,%4,%1\n" +@@ -43,6 +48,7 @@ ____xchg(_u16, volatile short *m, unsigned long val) + { + unsigned long ret, tmp, addr64; + ++ smp_mb(); + __asm__ __volatile__( + " andnot %4,7,%3\n" + " inswl %1,%4,%1\n" +@@ -67,6 +73,7 @@ ____xchg(_u32, volatile int *m, unsigned long val) + { + unsigned long dummy; + ++ smp_mb(); + __asm__ __volatile__( + "1: ldl_l %0,%4\n" + " bis $31,%3,%1\n" +@@ -87,6 +94,7 @@ ____xchg(_u64, volatile long *m, unsigned long val) + { + unsigned long dummy; + ++ smp_mb(); + __asm__ __volatile__( + "1: ldq_l %0,%4\n" + " bis $31,%3,%1\n" +@@ -128,10 +136,12 @@ ____xchg(, volatile void *ptr, unsigned long x, int size) + * store NEW in MEM. Return the initial value in MEM. Success is + * indicated by comparing RETURN with OLD. + * +- * The memory barrier should be placed in SMP only when we actually +- * make the change. If we don't change anything (so if the returned +- * prev is equal to old) then we aren't acquiring anything new and +- * we don't need any memory barrier as far I can tell. ++ * The leading and the trailing memory barriers guarantee that these ++ * operations are fully ordered. ++ * ++ * The trailing memory barrier is placed in SMP unconditionally, in ++ * order to guarantee that dependency ordering is preserved when a ++ * dependency is headed by an unsuccessful operation. + */ + + static inline unsigned long +@@ -139,6 +149,7 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new) + { + unsigned long prev, tmp, cmp, addr64; + ++ smp_mb(); + __asm__ __volatile__( + " andnot %5,7,%4\n" + " insbl %1,%5,%1\n" +@@ -150,8 +161,8 @@ ____cmpxchg(_u8, volatile char *m, unsigned char old, unsigned char new) + " or %1,%2,%2\n" + " stq_c %2,0(%4)\n" + " beq %2,3f\n" +- __ASM__MB + "2:\n" ++ __ASM__MB + ".subsection 2\n" + "3: br 1b\n" + ".previous" +@@ -166,6 +177,7 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new) + { + unsigned long prev, tmp, cmp, addr64; + ++ smp_mb(); + __asm__ __volatile__( + " andnot %5,7,%4\n" + " inswl %1,%5,%1\n" +@@ -177,8 +189,8 @@ ____cmpxchg(_u16, volatile short *m, unsigned short old, unsigned short new) + " or %1,%2,%2\n" + " stq_c %2,0(%4)\n" + " beq %2,3f\n" +- __ASM__MB + "2:\n" ++ __ASM__MB + ".subsection 2\n" + "3: br 1b\n" + ".previous" +@@ -193,6 +205,7 @@ ____cmpxchg(_u32, volatile int *m, int old, int new) + { + unsigned long prev, cmp; + ++ smp_mb(); + __asm__ __volatile__( + "1: ldl_l %0,%5\n" + " cmpeq %0,%3,%1\n" +@@ -200,8 +213,8 @@ ____cmpxchg(_u32, volatile int *m, int old, int new) + " mov %4,%1\n" + " stl_c %1,%2\n" + " beq %1,3f\n" +- __ASM__MB + "2:\n" ++ __ASM__MB + ".subsection 2\n" + "3: br 1b\n" + ".previous" +@@ -216,6 +229,7 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new) + { + unsigned long prev, cmp; + ++ smp_mb(); + __asm__ __volatile__( + "1: ldq_l %0,%5\n" + " cmpeq %0,%3,%1\n" +@@ -223,8 +237,8 @@ ____cmpxchg(_u64, volatile long *m, unsigned long old, unsigned long new) + " mov %4,%1\n" + " stq_c %1,%2\n" + " beq %1,3f\n" +- __ASM__MB + "2:\n" ++ __ASM__MB + ".subsection 2\n" + "3: br 1b\n" + ".previous" +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig +index c84e67fdea09..4383313b064a 100644 +--- a/arch/arc/Kconfig ++++ b/arch/arc/Kconfig +@@ -487,7 +487,6 @@ config ARC_CURR_IN_REG + + config ARC_EMUL_UNALIGNED + bool "Emulate unaligned memory access (userspace only)" +- default N + select SYSCTL_ARCH_UNALIGN_NO_WARN + select SYSCTL_ARCH_UNALIGN_ALLOW + depends on ISA_ARCOMPACT +diff --git a/arch/arc/include/asm/bug.h b/arch/arc/include/asm/bug.h +index ea022d47896c..21ec82466d62 100644 +--- a/arch/arc/include/asm/bug.h ++++ b/arch/arc/include/asm/bug.h +@@ -23,7 +23,8 @@ void die(const char *str, struct pt_regs *regs, unsigned long address); + + #define BUG() do { \ + pr_warn("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ +- dump_stack(); \ ++ barrier_before_unreachable(); \ ++ __builtin_trap(); \ + } while (0) + + #define HAVE_ARCH_BUG +diff --git a/arch/arc/kernel/mcip.c b/arch/arc/kernel/mcip.c +index f61a52b01625..5fe84e481654 100644 +--- a/arch/arc/kernel/mcip.c ++++ b/arch/arc/kernel/mcip.c +@@ -22,10 +22,79 @@ static DEFINE_RAW_SPINLOCK(mcip_lock); + + static char smp_cpuinfo_buf[128]; + ++/* ++ * Set mask to halt GFRC if any online core in SMP cluster is halted. ++ * Only works for ARC HS v3.0+, on earlier versions has no effect. ++ */ ++static void mcip_update_gfrc_halt_mask(int cpu) ++{ ++ struct bcr_generic gfrc; ++ unsigned long flags; ++ u32 gfrc_halt_mask; ++ ++ READ_BCR(ARC_REG_GFRC_BUILD, gfrc); ++ ++ /* ++ * CMD_GFRC_SET_CORE and CMD_GFRC_READ_CORE commands were added in ++ * GFRC 0x3 version. ++ */ ++ if (gfrc.ver < 0x3) ++ return; ++ ++ raw_spin_lock_irqsave(&mcip_lock, flags); ++ ++ __mcip_cmd(CMD_GFRC_READ_CORE, 0); ++ gfrc_halt_mask = read_aux_reg(ARC_REG_MCIP_READBACK); ++ gfrc_halt_mask |= BIT(cpu); ++ __mcip_cmd_data(CMD_GFRC_SET_CORE, 0, gfrc_halt_mask); ++ ++ raw_spin_unlock_irqrestore(&mcip_lock, flags); ++} ++ ++static void mcip_update_debug_halt_mask(int cpu) ++{ ++ u32 mcip_mask = 0; ++ unsigned long flags; ++ ++ raw_spin_lock_irqsave(&mcip_lock, flags); ++ ++ /* ++ * mcip_mask is same for CMD_DEBUG_SET_SELECT and CMD_DEBUG_SET_MASK ++ * commands. So read it once instead of reading both CMD_DEBUG_READ_MASK ++ * and CMD_DEBUG_READ_SELECT. ++ */ ++ __mcip_cmd(CMD_DEBUG_READ_SELECT, 0); ++ mcip_mask = read_aux_reg(ARC_REG_MCIP_READBACK); ++ ++ mcip_mask |= BIT(cpu); ++ ++ __mcip_cmd_data(CMD_DEBUG_SET_SELECT, 0, mcip_mask); ++ /* ++ * Parameter specified halt cause: ++ * STATUS32[H]/actionpoint/breakpoint/self-halt ++ * We choose all of them (0xF). ++ */ ++ __mcip_cmd_data(CMD_DEBUG_SET_MASK, 0xF, mcip_mask); ++ ++ raw_spin_unlock_irqrestore(&mcip_lock, flags); ++} ++ + static void mcip_setup_per_cpu(int cpu) + { ++ struct mcip_bcr mp; ++ ++ READ_BCR(ARC_REG_MCIP_BCR, mp); ++ + smp_ipi_irq_setup(cpu, IPI_IRQ); + smp_ipi_irq_setup(cpu, SOFTIRQ_IRQ); ++ ++ /* Update GFRC halt mask as new CPU came online */ ++ if (mp.gfrc) ++ mcip_update_gfrc_halt_mask(cpu); ++ ++ /* Update MCIP debug mask as new CPU came online */ ++ if (mp.dbg) ++ mcip_update_debug_halt_mask(cpu); + } + + static void mcip_ipi_send(int cpu) +@@ -101,11 +170,6 @@ static void mcip_probe_n_setup(void) + IS_AVAIL1(mp.gfrc, "GFRC")); + + cpuinfo_arc700[0].extn.gfrc = mp.gfrc; +- +- if (mp.dbg) { +- __mcip_cmd_data(CMD_DEBUG_SET_SELECT, 0, 0xf); +- __mcip_cmd_data(CMD_DEBUG_SET_MASK, 0xf, 0xf); +- } + } + + struct plat_smp_ops plat_smp_ops = { +diff --git a/arch/arc/kernel/smp.c b/arch/arc/kernel/smp.c +index 6df9d94a9537..115eecc0d9a4 100644 +--- a/arch/arc/kernel/smp.c ++++ b/arch/arc/kernel/smp.c +@@ -24,6 +24,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -47,6 +48,42 @@ void __init smp_prepare_boot_cpu(void) + { + } + ++static int __init arc_get_cpu_map(const char *name, struct cpumask *cpumask) ++{ ++ unsigned long dt_root = of_get_flat_dt_root(); ++ const char *buf; ++ ++ buf = of_get_flat_dt_prop(dt_root, name, NULL); ++ if (!buf) ++ return -EINVAL; ++ ++ if (cpulist_parse(buf, cpumask)) ++ return -EINVAL; ++ ++ return 0; ++} ++ ++/* ++ * Read from DeviceTree and setup cpu possible mask. If there is no ++ * "possible-cpus" property in DeviceTree pretend all [0..NR_CPUS-1] exist. ++ */ ++static void __init arc_init_cpu_possible(void) ++{ ++ struct cpumask cpumask; ++ ++ if (arc_get_cpu_map("possible-cpus", &cpumask)) { ++ pr_warn("Failed to get possible-cpus from dtb, pretending all %u cpus exist\n", ++ NR_CPUS); ++ ++ cpumask_setall(&cpumask); ++ } ++ ++ if (!cpumask_test_cpu(0, &cpumask)) ++ panic("Master cpu (cpu[0]) is missed in cpu possible mask!"); ++ ++ init_cpu_possible(&cpumask); ++} ++ + /* + * Called from setup_arch() before calling setup_processor() + * +@@ -58,10 +95,7 @@ void __init smp_prepare_boot_cpu(void) + */ + void __init smp_init_cpus(void) + { +- unsigned int i; +- +- for (i = 0; i < NR_CPUS; i++) +- set_cpu_possible(i, true); ++ arc_init_cpu_possible(); + + if (plat_smp_ops.init_early_smp) + plat_smp_ops.init_early_smp(); +@@ -70,16 +104,12 @@ void __init smp_init_cpus(void) + /* called from init ( ) => process 1 */ + void __init smp_prepare_cpus(unsigned int max_cpus) + { +- int i; +- + /* + * if platform didn't set the present map already, do it now + * boot cpu is set to present already by init/main.c + */ +- if (num_present_cpus() <= 1) { +- for (i = 0; i < max_cpus; i++) +- set_cpu_present(i, true); +- } ++ if (num_present_cpus() <= 1) ++ init_cpu_present(cpu_possible_mask); + } + + void __init smp_cpus_done(unsigned int max_cpus) +diff --git a/arch/arm/boot/dts/at91-tse850-3.dts b/arch/arm/boot/dts/at91-tse850-3.dts +index 5f29010cdbd8..4ef80a703eda 100644 +--- a/arch/arm/boot/dts/at91-tse850-3.dts ++++ b/arch/arm/boot/dts/at91-tse850-3.dts +@@ -245,7 +245,7 @@ + }; + + eeprom@50 { +- compatible = "nxp,24c02", "atmel,24c02"; ++ compatible = "nxp,se97b", "atmel,24c02"; + reg = <0x50>; + pagesize = <16>; + }; +diff --git a/arch/arm/boot/dts/bcm2836.dtsi b/arch/arm/boot/dts/bcm2836.dtsi +index 61e158003509..168c002f0ca0 100644 +--- a/arch/arm/boot/dts/bcm2836.dtsi ++++ b/arch/arm/boot/dts/bcm2836.dtsi +@@ -9,7 +9,7 @@ + <0x40000000 0x40000000 0x00001000>; + dma-ranges = <0xc0000000 0x00000000 0x3f000000>; + +- local_intc: local_intc { ++ local_intc: local_intc@40000000 { + compatible = "brcm,bcm2836-l1-intc"; + reg = <0x40000000 0x100>; + interrupt-controller; +diff --git a/arch/arm/boot/dts/bcm2837.dtsi b/arch/arm/boot/dts/bcm2837.dtsi +index bc1cca5cf43c..d5d058a568c3 100644 +--- a/arch/arm/boot/dts/bcm2837.dtsi ++++ b/arch/arm/boot/dts/bcm2837.dtsi +@@ -8,7 +8,7 @@ + <0x40000000 0x40000000 0x00001000>; + dma-ranges = <0xc0000000 0x00000000 0x3f000000>; + +- local_intc: local_intc { ++ local_intc: local_intc@40000000 { + compatible = "brcm,bcm2836-l1-intc"; + reg = <0x40000000 0x100>; + interrupt-controller; +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index 013431e3d7c3..4745e3c7806b 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -251,7 +251,7 @@ + + jtag_gpio4: jtag_gpio4 { + brcm,pins = <4 5 6 12 13>; +- brcm,function = ; ++ brcm,function = ; + }; + jtag_gpio22: jtag_gpio22 { + brcm,pins = <22 23 24 25 26 27>; +@@ -396,8 +396,8 @@ + + i2s: i2s@7e203000 { + compatible = "brcm,bcm2835-i2s"; +- reg = <0x7e203000 0x20>, +- <0x7e101098 0x02>; ++ reg = <0x7e203000 0x24>; ++ clocks = <&clocks BCM2835_CLOCK_PCM>; + + dmas = <&dma 2>, + <&dma 3>; +diff --git a/arch/arm/boot/dts/bcm958625hr.dts b/arch/arm/boot/dts/bcm958625hr.dts +index 6a44b8021702..f0e2008f7490 100644 +--- a/arch/arm/boot/dts/bcm958625hr.dts ++++ b/arch/arm/boot/dts/bcm958625hr.dts +@@ -49,7 +49,7 @@ + + memory { + device_type = "memory"; +- reg = <0x60000000 0x80000000>; ++ reg = <0x60000000 0x20000000>; + }; + + gpio-restart { +diff --git a/arch/arm/boot/dts/dra71-evm.dts b/arch/arm/boot/dts/dra71-evm.dts +index 41c9132eb550..64363f75c01a 100644 +--- a/arch/arm/boot/dts/dra71-evm.dts ++++ b/arch/arm/boot/dts/dra71-evm.dts +@@ -24,13 +24,13 @@ + + regulator-name = "vddshv8"; + regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <3000000>; ++ regulator-max-microvolt = <3300000>; + regulator-boot-on; + vin-supply = <&evm_5v0>; + + gpios = <&gpio7 11 GPIO_ACTIVE_HIGH>; + states = <1800000 0x0 +- 3000000 0x1>; ++ 3300000 0x1>; + }; + + evm_1v8_sw: fixedregulator-evm_1v8 { +diff --git a/arch/arm/boot/dts/imx6dl-icore-rqs.dts b/arch/arm/boot/dts/imx6dl-icore-rqs.dts +index cf42c2f5cdc7..1281bc39b7ab 100644 +--- a/arch/arm/boot/dts/imx6dl-icore-rqs.dts ++++ b/arch/arm/boot/dts/imx6dl-icore-rqs.dts +@@ -42,7 +42,7 @@ + + /dts-v1/; + +-#include "imx6q.dtsi" ++#include "imx6dl.dtsi" + #include "imx6qdl-icore-rqs.dtsi" + + / { +diff --git a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +index ae45af1ad062..3cc1fb9ce441 100644 +--- a/arch/arm/boot/dts/imx7d-cl-som-imx7.dts ++++ b/arch/arm/boot/dts/imx7d-cl-som-imx7.dts +@@ -213,37 +213,37 @@ + &iomuxc { + pinctrl_enet1: enet1grp { + fsl,pins = < +- MX7D_PAD_SD2_CD_B__ENET1_MDIO 0x3 +- MX7D_PAD_SD2_WP__ENET1_MDC 0x3 +- MX7D_PAD_ENET1_RGMII_TXC__ENET1_RGMII_TXC 0x1 +- MX7D_PAD_ENET1_RGMII_TD0__ENET1_RGMII_TD0 0x1 +- MX7D_PAD_ENET1_RGMII_TD1__ENET1_RGMII_TD1 0x1 +- MX7D_PAD_ENET1_RGMII_TD2__ENET1_RGMII_TD2 0x1 +- MX7D_PAD_ENET1_RGMII_TD3__ENET1_RGMII_TD3 0x1 +- MX7D_PAD_ENET1_RGMII_TX_CTL__ENET1_RGMII_TX_CTL 0x1 +- MX7D_PAD_ENET1_RGMII_RXC__ENET1_RGMII_RXC 0x1 +- MX7D_PAD_ENET1_RGMII_RD0__ENET1_RGMII_RD0 0x1 +- MX7D_PAD_ENET1_RGMII_RD1__ENET1_RGMII_RD1 0x1 +- MX7D_PAD_ENET1_RGMII_RD2__ENET1_RGMII_RD2 0x1 +- MX7D_PAD_ENET1_RGMII_RD3__ENET1_RGMII_RD3 0x1 +- MX7D_PAD_ENET1_RGMII_RX_CTL__ENET1_RGMII_RX_CTL 0x1 ++ MX7D_PAD_SD2_CD_B__ENET1_MDIO 0x30 ++ MX7D_PAD_SD2_WP__ENET1_MDC 0x30 ++ MX7D_PAD_ENET1_RGMII_TXC__ENET1_RGMII_TXC 0x11 ++ MX7D_PAD_ENET1_RGMII_TD0__ENET1_RGMII_TD0 0x11 ++ MX7D_PAD_ENET1_RGMII_TD1__ENET1_RGMII_TD1 0x11 ++ MX7D_PAD_ENET1_RGMII_TD2__ENET1_RGMII_TD2 0x11 ++ MX7D_PAD_ENET1_RGMII_TD3__ENET1_RGMII_TD3 0x11 ++ MX7D_PAD_ENET1_RGMII_TX_CTL__ENET1_RGMII_TX_CTL 0x11 ++ MX7D_PAD_ENET1_RGMII_RXC__ENET1_RGMII_RXC 0x11 ++ MX7D_PAD_ENET1_RGMII_RD0__ENET1_RGMII_RD0 0x11 ++ MX7D_PAD_ENET1_RGMII_RD1__ENET1_RGMII_RD1 0x11 ++ MX7D_PAD_ENET1_RGMII_RD2__ENET1_RGMII_RD2 0x11 ++ MX7D_PAD_ENET1_RGMII_RD3__ENET1_RGMII_RD3 0x11 ++ MX7D_PAD_ENET1_RGMII_RX_CTL__ENET1_RGMII_RX_CTL 0x11 + >; + }; + + pinctrl_enet2: enet2grp { + fsl,pins = < +- MX7D_PAD_EPDC_GDSP__ENET2_RGMII_TXC 0x1 +- MX7D_PAD_EPDC_SDCE2__ENET2_RGMII_TD0 0x1 +- MX7D_PAD_EPDC_SDCE3__ENET2_RGMII_TD1 0x1 +- MX7D_PAD_EPDC_GDCLK__ENET2_RGMII_TD2 0x1 +- MX7D_PAD_EPDC_GDOE__ENET2_RGMII_TD3 0x1 +- MX7D_PAD_EPDC_GDRL__ENET2_RGMII_TX_CTL 0x1 +- MX7D_PAD_EPDC_SDCE1__ENET2_RGMII_RXC 0x1 +- MX7D_PAD_EPDC_SDCLK__ENET2_RGMII_RD0 0x1 +- MX7D_PAD_EPDC_SDLE__ENET2_RGMII_RD1 0x1 +- MX7D_PAD_EPDC_SDOE__ENET2_RGMII_RD2 0x1 +- MX7D_PAD_EPDC_SDSHR__ENET2_RGMII_RD3 0x1 +- MX7D_PAD_EPDC_SDCE0__ENET2_RGMII_RX_CTL 0x1 ++ MX7D_PAD_EPDC_GDSP__ENET2_RGMII_TXC 0x11 ++ MX7D_PAD_EPDC_SDCE2__ENET2_RGMII_TD0 0x11 ++ MX7D_PAD_EPDC_SDCE3__ENET2_RGMII_TD1 0x11 ++ MX7D_PAD_EPDC_GDCLK__ENET2_RGMII_TD2 0x11 ++ MX7D_PAD_EPDC_GDOE__ENET2_RGMII_TD3 0x11 ++ MX7D_PAD_EPDC_GDRL__ENET2_RGMII_TX_CTL 0x11 ++ MX7D_PAD_EPDC_SDCE1__ENET2_RGMII_RXC 0x11 ++ MX7D_PAD_EPDC_SDCLK__ENET2_RGMII_RD0 0x11 ++ MX7D_PAD_EPDC_SDLE__ENET2_RGMII_RD1 0x11 ++ MX7D_PAD_EPDC_SDOE__ENET2_RGMII_RD2 0x11 ++ MX7D_PAD_EPDC_SDSHR__ENET2_RGMII_RD3 0x11 ++ MX7D_PAD_EPDC_SDCE0__ENET2_RGMII_RX_CTL 0x11 + >; + }; + +diff --git a/arch/arm/boot/dts/r8a7791-porter.dts b/arch/arm/boot/dts/r8a7791-porter.dts +index 95da5cb9d37a..b6ebe79261c6 100644 +--- a/arch/arm/boot/dts/r8a7791-porter.dts ++++ b/arch/arm/boot/dts/r8a7791-porter.dts +@@ -427,7 +427,7 @@ + "dclkin.0", "dclkin.1"; + + ports { +- port@1 { ++ port@0 { + endpoint { + remote-endpoint = <&adv7511_in>; + }; +diff --git a/arch/arm/boot/dts/rk3036.dtsi b/arch/arm/boot/dts/rk3036.dtsi +index 4916c65e0ace..5c0a76493d22 100644 +--- a/arch/arm/boot/dts/rk3036.dtsi ++++ b/arch/arm/boot/dts/rk3036.dtsi +@@ -261,7 +261,7 @@ + max-frequency = <37500000>; + clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>, + <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + interrupts = ; + resets = <&cru SRST_SDIO>; +@@ -279,7 +279,7 @@ + max-frequency = <37500000>; + clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>, + <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + default-sample-phase = <158>; + disable-wp; + dmas = <&pdma 12>; +diff --git a/arch/arm/boot/dts/rk322x.dtsi b/arch/arm/boot/dts/rk322x.dtsi +index 06814421eed2..f59f7cc62be6 100644 +--- a/arch/arm/boot/dts/rk322x.dtsi ++++ b/arch/arm/boot/dts/rk322x.dtsi +@@ -600,7 +600,7 @@ + interrupts = ; + clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>, + <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + pinctrl-names = "default"; + pinctrl-0 = <&sdmmc_clk &sdmmc_cmd &sdmmc_bus4>; +@@ -613,7 +613,7 @@ + interrupts = ; + clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>, + <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + pinctrl-names = "default"; + pinctrl-0 = <&sdio_clk &sdio_cmd &sdio_bus4>; +@@ -628,7 +628,7 @@ + max-frequency = <37500000>; + clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>, + <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + bus-width = <8>; + default-sample-phase = <158>; + fifo-depth = <0x100>; +diff --git a/arch/arm/boot/dts/rk3288.dtsi b/arch/arm/boot/dts/rk3288.dtsi +index 356ed1e62452..f7a951afd281 100644 +--- a/arch/arm/boot/dts/rk3288.dtsi ++++ b/arch/arm/boot/dts/rk3288.dtsi +@@ -927,6 +927,7 @@ + i2s: i2s@ff890000 { + compatible = "rockchip,rk3288-i2s", "rockchip,rk3066-i2s"; + reg = <0x0 0xff890000 0x0 0x10000>; ++ #sound-dai-cells = <0>; + interrupts = ; + #address-cells = <1>; + #size-cells = <0>; +@@ -1122,6 +1123,7 @@ + compatible = "rockchip,rk3288-dw-hdmi"; + reg = <0x0 0xff980000 0x0 0x20000>; + reg-io-width = <4>; ++ #sound-dai-cells = <0>; + rockchip,grf = <&grf>; + interrupts = ; + clocks = <&cru PCLK_HDMI_CTRL>, <&cru SCLK_HDMI_HDCP>; +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 7e24dc8e82d4..8d9f42a422cb 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -827,7 +827,7 @@ + timer@fffec600 { + compatible = "arm,cortex-a9-twd-timer"; + reg = <0xfffec600 0x100>; +- interrupts = <1 13 0xf04>; ++ interrupts = <1 13 0xf01>; + clocks = <&mpu_periph_clk>; + }; + +diff --git a/arch/arm/include/asm/vdso.h b/arch/arm/include/asm/vdso.h +index 9c99e817535e..5b85889f82ee 100644 +--- a/arch/arm/include/asm/vdso.h ++++ b/arch/arm/include/asm/vdso.h +@@ -12,8 +12,6 @@ struct mm_struct; + + void arm_install_vdso(struct mm_struct *mm, unsigned long addr); + +-extern char vdso_start, vdso_end; +- + extern unsigned int vdso_total_pages; + + #else /* CONFIG_VDSO */ +diff --git a/arch/arm/kernel/vdso.c b/arch/arm/kernel/vdso.c +index a4d6dc0f2427..f4dd7f9663c1 100644 +--- a/arch/arm/kernel/vdso.c ++++ b/arch/arm/kernel/vdso.c +@@ -39,6 +39,8 @@ + + static struct page **vdso_text_pagelist; + ++extern char vdso_start[], vdso_end[]; ++ + /* Total number of pages needed for the data and text portions of the VDSO. */ + unsigned int vdso_total_pages __ro_after_init; + +@@ -197,13 +199,13 @@ static int __init vdso_init(void) + unsigned int text_pages; + int i; + +- if (memcmp(&vdso_start, "\177ELF", 4)) { ++ if (memcmp(vdso_start, "\177ELF", 4)) { + pr_err("VDSO is not a valid ELF object!\n"); + return -ENOEXEC; + } + +- text_pages = (&vdso_end - &vdso_start) >> PAGE_SHIFT; +- pr_debug("vdso: %i text pages at base %p\n", text_pages, &vdso_start); ++ text_pages = (vdso_end - vdso_start) >> PAGE_SHIFT; ++ pr_debug("vdso: %i text pages at base %p\n", text_pages, vdso_start); + + /* Allocate the VDSO text pagelist */ + vdso_text_pagelist = kcalloc(text_pages, sizeof(struct page *), +@@ -218,7 +220,7 @@ static int __init vdso_init(void) + for (i = 0; i < text_pages; i++) { + struct page *page; + +- page = virt_to_page(&vdso_start + i * PAGE_SIZE); ++ page = virt_to_page(vdso_start + i * PAGE_SIZE); + vdso_text_pagelist[i] = page; + } + +@@ -229,7 +231,7 @@ static int __init vdso_init(void) + + cntvct_ok = cntvct_functional(); + +- patch_vdso(&vdso_start); ++ patch_vdso(vdso_start); + + return 0; + } +diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c +index a3e78074be70..62eb7d668890 100644 +--- a/arch/arm/mach-davinci/board-omapl138-hawk.c ++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c +@@ -127,8 +127,8 @@ static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/ +- GPIO_LOOKUP("davinci_gpio.1", 28, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.1", 29, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-omap1/clock.c b/arch/arm/mach-omap1/clock.c +index 43e3e188f521..fa512413a471 100644 +--- a/arch/arm/mach-omap1/clock.c ++++ b/arch/arm/mach-omap1/clock.c +@@ -1011,17 +1011,17 @@ static int clk_debugfs_register_one(struct clk *c) + return -ENOMEM; + c->dent = d; + +- d = debugfs_create_u8("usecount", S_IRUGO, c->dent, (u8 *)&c->usecount); ++ d = debugfs_create_u8("usecount", S_IRUGO, c->dent, &c->usecount); + if (!d) { + err = -ENOMEM; + goto err_out; + } +- d = debugfs_create_u32("rate", S_IRUGO, c->dent, (u32 *)&c->rate); ++ d = debugfs_create_ulong("rate", S_IRUGO, c->dent, &c->rate); + if (!d) { + err = -ENOMEM; + goto err_out; + } +- d = debugfs_create_x32("flags", S_IRUGO, c->dent, (u32 *)&c->flags); ++ d = debugfs_create_x8("flags", S_IRUGO, c->dent, &c->flags); + if (!d) { + err = -ENOMEM; + goto err_out; +diff --git a/arch/arm/mach-omap2/omap-wakeupgen.c b/arch/arm/mach-omap2/omap-wakeupgen.c +index 4bb6751864a5..fc5fb776a710 100644 +--- a/arch/arm/mach-omap2/omap-wakeupgen.c ++++ b/arch/arm/mach-omap2/omap-wakeupgen.c +@@ -299,8 +299,6 @@ static void irq_save_context(void) + if (soc_is_dra7xx()) + return; + +- if (!sar_base) +- sar_base = omap4_get_sar_ram_base(); + if (wakeupgen_ops && wakeupgen_ops->save_context) + wakeupgen_ops->save_context(); + } +@@ -598,6 +596,8 @@ static int __init wakeupgen_init(struct device_node *node, + irq_hotplug_init(); + irq_pm_init(); + ++ sar_base = omap4_get_sar_ram_base(); ++ + return 0; + } + IRQCHIP_DECLARE(ti_wakeupgen, "ti,omap4-wugen-mpu", wakeupgen_init); +diff --git a/arch/arm/mach-omap2/pm.c b/arch/arm/mach-omap2/pm.c +index 366158a54fcd..6f68576e5695 100644 +--- a/arch/arm/mach-omap2/pm.c ++++ b/arch/arm/mach-omap2/pm.c +@@ -186,7 +186,7 @@ static void omap_pm_end(void) + cpu_idle_poll_ctrl(false); + } + +-static void omap_pm_finish(void) ++static void omap_pm_wake(void) + { + if (soc_is_omap34xx()) + omap_prcm_irq_complete(); +@@ -196,7 +196,7 @@ static const struct platform_suspend_ops omap_pm_ops = { + .begin = omap_pm_begin, + .end = omap_pm_end, + .enter = omap_pm_enter, +- .finish = omap_pm_finish, ++ .wake = omap_pm_wake, + .valid = suspend_valid_only_mem, + }; + +diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c +index ece09c9461f7..d61fbd7a2840 100644 +--- a/arch/arm/mach-omap2/timer.c ++++ b/arch/arm/mach-omap2/timer.c +@@ -156,12 +156,6 @@ static struct clock_event_device clockevent_gpt = { + .tick_resume = omap2_gp_timer_shutdown, + }; + +-static struct property device_disabled = { +- .name = "status", +- .length = sizeof("disabled"), +- .value = "disabled", +-}; +- + static const struct of_device_id omap_timer_match[] __initconst = { + { .compatible = "ti,omap2420-timer", }, + { .compatible = "ti,omap3430-timer", }, +@@ -203,8 +197,17 @@ static struct device_node * __init omap_get_timer_dt(const struct of_device_id * + of_get_property(np, "ti,timer-secure", NULL))) + continue; + +- if (!of_device_is_compatible(np, "ti,omap-counter32k")) +- of_add_property(np, &device_disabled); ++ if (!of_device_is_compatible(np, "ti,omap-counter32k")) { ++ struct property *prop; ++ ++ prop = kzalloc(sizeof(*prop), GFP_KERNEL); ++ if (!prop) ++ return NULL; ++ prop->name = "status"; ++ prop->value = "disabled"; ++ prop->length = strlen(prop->value); ++ of_add_property(np, prop); ++ } + return np; + } + +diff --git a/arch/arm/mach-orion5x/Kconfig b/arch/arm/mach-orion5x/Kconfig +index 2a7bb6ccdcb7..a810f4dd34b1 100644 +--- a/arch/arm/mach-orion5x/Kconfig ++++ b/arch/arm/mach-orion5x/Kconfig +@@ -58,7 +58,6 @@ config MACH_KUROBOX_PRO + + config MACH_DNS323 + bool "D-Link DNS-323" +- select GENERIC_NET_UTILS + select I2C_BOARDINFO if I2C + help + Say 'Y' here if you want your kernel to support the +@@ -66,7 +65,6 @@ config MACH_DNS323 + + config MACH_TS209 + bool "QNAP TS-109/TS-209" +- select GENERIC_NET_UTILS + help + Say 'Y' here if you want your kernel to support the + QNAP TS-109/TS-209 platform. +@@ -101,7 +99,6 @@ config MACH_LINKSTATION_LS_HGL + + config MACH_TS409 + bool "QNAP TS-409" +- select GENERIC_NET_UTILS + help + Say 'Y' here if you want your kernel to support the + QNAP TS-409 platform. +diff --git a/arch/arm/mach-orion5x/dns323-setup.c b/arch/arm/mach-orion5x/dns323-setup.c +index cd483bfb5ca8..d13344b2ddcd 100644 +--- a/arch/arm/mach-orion5x/dns323-setup.c ++++ b/arch/arm/mach-orion5x/dns323-setup.c +@@ -173,10 +173,42 @@ static struct mv643xx_eth_platform_data dns323_eth_data = { + .phy_addr = MV643XX_ETH_PHY_ADDR(8), + }; + ++/* dns323_parse_hex_*() taken from tsx09-common.c; should a common copy of these ++ * functions be kept somewhere? ++ */ ++static int __init dns323_parse_hex_nibble(char n) ++{ ++ if (n >= '0' && n <= '9') ++ return n - '0'; ++ ++ if (n >= 'A' && n <= 'F') ++ return n - 'A' + 10; ++ ++ if (n >= 'a' && n <= 'f') ++ return n - 'a' + 10; ++ ++ return -1; ++} ++ ++static int __init dns323_parse_hex_byte(const char *b) ++{ ++ int hi; ++ int lo; ++ ++ hi = dns323_parse_hex_nibble(b[0]); ++ lo = dns323_parse_hex_nibble(b[1]); ++ ++ if (hi < 0 || lo < 0) ++ return -1; ++ ++ return (hi << 4) | lo; ++} ++ + static int __init dns323_read_mac_addr(void) + { + u_int8_t addr[6]; +- void __iomem *mac_page; ++ int i; ++ char *mac_page; + + /* MAC address is stored as a regular ol' string in /dev/mtdblock4 + * (0x007d0000-0x00800000) starting at offset 196480 (0x2ff80). +@@ -185,8 +217,23 @@ static int __init dns323_read_mac_addr(void) + if (!mac_page) + return -ENOMEM; + +- if (!mac_pton((__force const char *) mac_page, addr)) +- goto error_fail; ++ /* Sanity check the string we're looking at */ ++ for (i = 0; i < 5; i++) { ++ if (*(mac_page + (i * 3) + 2) != ':') { ++ goto error_fail; ++ } ++ } ++ ++ for (i = 0; i < 6; i++) { ++ int byte; ++ ++ byte = dns323_parse_hex_byte(mac_page + (i * 3)); ++ if (byte < 0) { ++ goto error_fail; ++ } ++ ++ addr[i] = byte; ++ } + + iounmap(mac_page); + printk("DNS-323: Found ethernet MAC address: %pM\n", addr); +diff --git a/arch/arm/mach-orion5x/tsx09-common.c b/arch/arm/mach-orion5x/tsx09-common.c +index 89774985d380..905d4f2dd0b8 100644 +--- a/arch/arm/mach-orion5x/tsx09-common.c ++++ b/arch/arm/mach-orion5x/tsx09-common.c +@@ -53,12 +53,53 @@ struct mv643xx_eth_platform_data qnap_tsx09_eth_data = { + .phy_addr = MV643XX_ETH_PHY_ADDR(8), + }; + ++static int __init qnap_tsx09_parse_hex_nibble(char n) ++{ ++ if (n >= '0' && n <= '9') ++ return n - '0'; ++ ++ if (n >= 'A' && n <= 'F') ++ return n - 'A' + 10; ++ ++ if (n >= 'a' && n <= 'f') ++ return n - 'a' + 10; ++ ++ return -1; ++} ++ ++static int __init qnap_tsx09_parse_hex_byte(const char *b) ++{ ++ int hi; ++ int lo; ++ ++ hi = qnap_tsx09_parse_hex_nibble(b[0]); ++ lo = qnap_tsx09_parse_hex_nibble(b[1]); ++ ++ if (hi < 0 || lo < 0) ++ return -1; ++ ++ return (hi << 4) | lo; ++} ++ + static int __init qnap_tsx09_check_mac_addr(const char *addr_str) + { + u_int8_t addr[6]; ++ int i; + +- if (!mac_pton(addr_str, addr)) +- return -1; ++ for (i = 0; i < 6; i++) { ++ int byte; ++ ++ /* ++ * Enforce "xx:xx:xx:xx:xx:xx\n" format. ++ */ ++ if (addr_str[(i * 3) + 2] != ((i < 5) ? ':' : '\n')) ++ return -1; ++ ++ byte = qnap_tsx09_parse_hex_byte(addr_str + (i * 3)); ++ if (byte < 0) ++ return -1; ++ addr[i] = byte; ++ } + + printk(KERN_INFO "tsx09: found ethernet mac address %pM\n", addr); + +@@ -77,12 +118,12 @@ void __init qnap_tsx09_find_mac_addr(u32 mem_base, u32 size) + unsigned long addr; + + for (addr = mem_base; addr < (mem_base + size); addr += 1024) { +- void __iomem *nor_page; ++ char *nor_page; + int ret = 0; + + nor_page = ioremap(addr, 1024); + if (nor_page != NULL) { +- ret = qnap_tsx09_check_mac_addr((__force const char *)nor_page); ++ ret = qnap_tsx09_check_mac_addr(nor_page); + iounmap(nor_page); + } + +diff --git a/arch/arm/plat-omap/dmtimer.c b/arch/arm/plat-omap/dmtimer.c +index 7a327bd32521..ebef8aacea83 100644 +--- a/arch/arm/plat-omap/dmtimer.c ++++ b/arch/arm/plat-omap/dmtimer.c +@@ -890,11 +890,8 @@ static int omap_dm_timer_probe(struct platform_device *pdev) + timer->irq = irq->start; + timer->pdev = pdev; + +- /* Skip pm_runtime_enable for OMAP1 */ +- if (!(timer->capability & OMAP_TIMER_NEEDS_RESET)) { +- pm_runtime_enable(dev); +- pm_runtime_irq_safe(dev); +- } ++ pm_runtime_enable(dev); ++ pm_runtime_irq_safe(dev); + + if (!timer->reserved) { + ret = pm_runtime_get_sync(dev); +diff --git a/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi b/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi +index 4220fbdcb24a..ff5c4c47b22b 100644 +--- a/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi ++++ b/arch/arm64/boot/dts/cavium/thunder2-99xx.dtsi +@@ -98,7 +98,7 @@ + clock-output-names = "clk125mhz"; + }; + +- pci { ++ pcie@30000000 { + compatible = "pci-host-ecam-generic"; + device_type = "pci"; + #interrupt-cells = <1>; +@@ -118,6 +118,7 @@ + ranges = + <0x02000000 0 0x40000000 0 0x40000000 0 0x20000000 + 0x43000000 0x40 0x00000000 0x40 0x00000000 0x20 0x00000000>; ++ bus-range = <0 0xff>; + interrupt-map-mask = <0 0 0 7>; + interrupt-map = + /* addr pin ic icaddr icintr */ +diff --git a/arch/arm64/boot/dts/qcom/msm8996.dtsi b/arch/arm64/boot/dts/qcom/msm8996.dtsi +index 887b61c872dd..ab00be277c6f 100644 +--- a/arch/arm64/boot/dts/qcom/msm8996.dtsi ++++ b/arch/arm64/boot/dts/qcom/msm8996.dtsi +@@ -484,8 +484,8 @@ + blsp2_spi5: spi@075ba000{ + compatible = "qcom,spi-qup-v2.2.1"; + reg = <0x075ba000 0x600>; +- interrupts = ; +- clocks = <&gcc GCC_BLSP2_QUP5_SPI_APPS_CLK>, ++ interrupts = ; ++ clocks = <&gcc GCC_BLSP2_QUP6_SPI_APPS_CLK>, + <&gcc GCC_BLSP2_AHB_CLK>; + clock-names = "core", "iface"; + pinctrl-names = "default", "sleep"; +diff --git a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +index d4f80786e7c2..28257724a56e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3328-rock64.dts +@@ -136,11 +136,12 @@ + phy-mode = "rgmii"; + pinctrl-names = "default"; + pinctrl-0 = <&rgmiim1_pins>; ++ snps,force_thresh_dma_mode; + snps,reset-gpio = <&gpio1 RK_PC2 GPIO_ACTIVE_LOW>; + snps,reset-active-low; + snps,reset-delays-us = <0 10000 50000>; +- tx_delay = <0x26>; +- rx_delay = <0x11>; ++ tx_delay = <0x24>; ++ rx_delay = <0x18>; + status = "okay"; + }; + +diff --git a/arch/arm64/boot/dts/rockchip/rk3328.dtsi b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +index 41d61840fb99..d70e409e2b0c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3328.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3328.dtsi +@@ -683,7 +683,7 @@ + interrupts = ; + clocks = <&cru HCLK_SDMMC>, <&cru SCLK_SDMMC>, + <&cru SCLK_SDMMC_DRV>, <&cru SCLK_SDMMC_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + status = "disabled"; + }; +@@ -694,7 +694,7 @@ + interrupts = ; + clocks = <&cru HCLK_SDIO>, <&cru SCLK_SDIO>, + <&cru SCLK_SDIO_DRV>, <&cru SCLK_SDIO_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + status = "disabled"; + }; +@@ -705,7 +705,7 @@ + interrupts = ; + clocks = <&cru HCLK_EMMC>, <&cru SCLK_EMMC>, + <&cru SCLK_EMMC_DRV>, <&cru SCLK_EMMC_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + status = "disabled"; + }; +diff --git a/arch/arm64/boot/dts/rockchip/rk3368.dtsi b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +index 1070c8264c13..2313aea0e69e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3368.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3368.dtsi +@@ -257,7 +257,7 @@ + max-frequency = <150000000>; + clocks = <&cru HCLK_SDIO0>, <&cru SCLK_SDIO0>, + <&cru SCLK_SDIO0_DRV>, <&cru SCLK_SDIO0_SAMPLE>; +- clock-names = "biu", "ciu", "ciu_drv", "ciu_sample"; ++ clock-names = "biu", "ciu", "ciu-drive", "ciu-sample"; + fifo-depth = <0x100>; + interrupts = ; + resets = <&cru SRST_SDIO0>; +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +index 199a5118b20d..264a6bb60c53 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-gru.dtsi +@@ -406,8 +406,9 @@ + wlan_pd_n: wlan-pd-n { + compatible = "regulator-fixed"; + regulator-name = "wlan_pd_n"; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&wlan_module_reset_l>; + +- /* Note the wlan_module_reset_l pinctrl */ + enable-active-high; + gpio = <&gpio1 11 GPIO_ACTIVE_HIGH>; + +@@ -940,12 +941,6 @@ ap_i2c_audio: &i2c8 { + pinctrl-0 = < + &ap_pwroff /* AP will auto-assert this when in S3 */ + &clk_32k /* This pin is always 32k on gru boards */ +- +- /* +- * We want this driven low ASAP; firmware should help us, but +- * we can help ourselves too. +- */ +- &wlan_module_reset_l + >; + + pcfg_output_low: pcfg-output-low { +@@ -1125,12 +1120,7 @@ ap_i2c_audio: &i2c8 { + }; + + wlan_module_reset_l: wlan-module-reset-l { +- /* +- * We want this driven low ASAP (As {Soon,Strongly} As +- * Possible), to avoid leakage through the powered-down +- * WiFi. +- */ +- rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_output_low>; ++ rockchip,pins = <1 11 RK_FUNC_GPIO &pcfg_pull_none>; + }; + + bt_host_wake_l: bt-host-wake-l { +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi +index 0f873c897d0d..ce592a4c0c4c 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-sapphire.dtsi +@@ -457,7 +457,7 @@ + assigned-clocks = <&cru SCLK_PCIEPHY_REF>; + assigned-clock-parents = <&cru SCLK_PCIEPHY_REF100M>; + assigned-clock-rates = <100000000>; +- ep-gpios = <&gpio3 RK_PB5 GPIO_ACTIVE_HIGH>; ++ ep-gpios = <&gpio2 RK_PA4 GPIO_ACTIVE_HIGH>; + num-lanes = <4>; + pinctrl-names = "default"; + pinctrl-0 = <&pcie_clkreqn_cpm>; +diff --git a/arch/arm64/include/asm/atomic_lse.h b/arch/arm64/include/asm/atomic_lse.h +index 9ef0797380cb..f9b0b09153e0 100644 +--- a/arch/arm64/include/asm/atomic_lse.h ++++ b/arch/arm64/include/asm/atomic_lse.h +@@ -117,7 +117,7 @@ static inline void atomic_and(int i, atomic_t *v) + /* LSE atomics */ + " mvn %w[i], %w[i]\n" + " stclr %w[i], %[v]") +- : [i] "+r" (w0), [v] "+Q" (v->counter) ++ : [i] "+&r" (w0), [v] "+Q" (v->counter) + : "r" (x1) + : __LL_SC_CLOBBERS); + } +@@ -135,7 +135,7 @@ static inline int atomic_fetch_and##name(int i, atomic_t *v) \ + /* LSE atomics */ \ + " mvn %w[i], %w[i]\n" \ + " ldclr" #mb " %w[i], %w[i], %[v]") \ +- : [i] "+r" (w0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (w0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS, ##cl); \ + \ +@@ -161,7 +161,7 @@ static inline void atomic_sub(int i, atomic_t *v) + /* LSE atomics */ + " neg %w[i], %w[i]\n" + " stadd %w[i], %[v]") +- : [i] "+r" (w0), [v] "+Q" (v->counter) ++ : [i] "+&r" (w0), [v] "+Q" (v->counter) + : "r" (x1) + : __LL_SC_CLOBBERS); + } +@@ -180,7 +180,7 @@ static inline int atomic_sub_return##name(int i, atomic_t *v) \ + " neg %w[i], %w[i]\n" \ + " ldadd" #mb " %w[i], w30, %[v]\n" \ + " add %w[i], %w[i], w30") \ +- : [i] "+r" (w0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (w0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS , ##cl); \ + \ +@@ -207,7 +207,7 @@ static inline int atomic_fetch_sub##name(int i, atomic_t *v) \ + /* LSE atomics */ \ + " neg %w[i], %w[i]\n" \ + " ldadd" #mb " %w[i], %w[i], %[v]") \ +- : [i] "+r" (w0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (w0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS, ##cl); \ + \ +@@ -314,7 +314,7 @@ static inline void atomic64_and(long i, atomic64_t *v) + /* LSE atomics */ + " mvn %[i], %[i]\n" + " stclr %[i], %[v]") +- : [i] "+r" (x0), [v] "+Q" (v->counter) ++ : [i] "+&r" (x0), [v] "+Q" (v->counter) + : "r" (x1) + : __LL_SC_CLOBBERS); + } +@@ -332,7 +332,7 @@ static inline long atomic64_fetch_and##name(long i, atomic64_t *v) \ + /* LSE atomics */ \ + " mvn %[i], %[i]\n" \ + " ldclr" #mb " %[i], %[i], %[v]") \ +- : [i] "+r" (x0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (x0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS, ##cl); \ + \ +@@ -358,7 +358,7 @@ static inline void atomic64_sub(long i, atomic64_t *v) + /* LSE atomics */ + " neg %[i], %[i]\n" + " stadd %[i], %[v]") +- : [i] "+r" (x0), [v] "+Q" (v->counter) ++ : [i] "+&r" (x0), [v] "+Q" (v->counter) + : "r" (x1) + : __LL_SC_CLOBBERS); + } +@@ -377,7 +377,7 @@ static inline long atomic64_sub_return##name(long i, atomic64_t *v) \ + " neg %[i], %[i]\n" \ + " ldadd" #mb " %[i], x30, %[v]\n" \ + " add %[i], %[i], x30") \ +- : [i] "+r" (x0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (x0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS, ##cl); \ + \ +@@ -404,7 +404,7 @@ static inline long atomic64_fetch_sub##name(long i, atomic64_t *v) \ + /* LSE atomics */ \ + " neg %[i], %[i]\n" \ + " ldadd" #mb " %[i], %[i], %[v]") \ +- : [i] "+r" (x0), [v] "+Q" (v->counter) \ ++ : [i] "+&r" (x0), [v] "+Q" (v->counter) \ + : "r" (x1) \ + : __LL_SC_CLOBBERS, ##cl); \ + \ +@@ -435,7 +435,7 @@ static inline long atomic64_dec_if_positive(atomic64_t *v) + " sub x30, x30, %[ret]\n" + " cbnz x30, 1b\n" + "2:") +- : [ret] "+r" (x0), [v] "+Q" (v->counter) ++ : [ret] "+&r" (x0), [v] "+Q" (v->counter) + : + : __LL_SC_CLOBBERS, "cc", "memory"); + +@@ -516,7 +516,7 @@ static inline long __cmpxchg_double##name(unsigned long old1, \ + " eor %[old1], %[old1], %[oldval1]\n" \ + " eor %[old2], %[old2], %[oldval2]\n" \ + " orr %[old1], %[old1], %[old2]") \ +- : [old1] "+r" (x0), [old2] "+r" (x1), \ ++ : [old1] "+&r" (x0), [old2] "+&r" (x1), \ + [v] "+Q" (*(unsigned long *)ptr) \ + : [new1] "r" (x2), [new2] "r" (x3), [ptr] "r" (x4), \ + [oldval1] "r" (oldval1), [oldval2] "r" (oldval2) \ +diff --git a/arch/arm64/include/asm/stacktrace.h b/arch/arm64/include/asm/stacktrace.h +index 6ad30776e984..99390755c0c4 100644 +--- a/arch/arm64/include/asm/stacktrace.h ++++ b/arch/arm64/include/asm/stacktrace.h +@@ -27,7 +27,7 @@ struct stackframe { + unsigned long fp; + unsigned long pc; + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- unsigned int graph; ++ int graph; + #endif + }; + +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index 52f15cd896e1..b5a28336c077 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -178,7 +178,7 @@ static int enable_smccc_arch_workaround_1(void *data) + case PSCI_CONDUIT_HVC: + arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, + ARM_SMCCC_ARCH_WORKAROUND_1, &res); +- if (res.a0) ++ if ((int)res.a0 < 0) + return 0; + cb = call_hvc_arch_workaround_1; + smccc_start = __smccc_workaround_1_hvc_start; +@@ -188,7 +188,7 @@ static int enable_smccc_arch_workaround_1(void *data) + case PSCI_CONDUIT_SMC: + arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, + ARM_SMCCC_ARCH_WORKAROUND_1, &res); +- if (res.a0) ++ if ((int)res.a0 < 0) + return 0; + cb = call_smc_arch_workaround_1; + smccc_start = __smccc_workaround_1_smc_start; +diff --git a/arch/arm64/kernel/perf_event.c b/arch/arm64/kernel/perf_event.c +index 9eaef51f83ff..1984e739f155 100644 +--- a/arch/arm64/kernel/perf_event.c ++++ b/arch/arm64/kernel/perf_event.c +@@ -914,9 +914,9 @@ static void __armv8pmu_probe_pmu(void *info) + int pmuver; + + dfr0 = read_sysreg(id_aa64dfr0_el1); +- pmuver = cpuid_feature_extract_signed_field(dfr0, ++ pmuver = cpuid_feature_extract_unsigned_field(dfr0, + ID_AA64DFR0_PMUVER_SHIFT); +- if (pmuver < 1) ++ if (pmuver == 0xf || pmuver == 0) + return; + + probe->present = true; +diff --git a/arch/arm64/kernel/stacktrace.c b/arch/arm64/kernel/stacktrace.c +index 76809ccd309c..d5718a060672 100644 +--- a/arch/arm64/kernel/stacktrace.c ++++ b/arch/arm64/kernel/stacktrace.c +@@ -59,6 +59,11 @@ int notrace unwind_frame(struct task_struct *tsk, struct stackframe *frame) + #ifdef CONFIG_FUNCTION_GRAPH_TRACER + if (tsk->ret_stack && + (frame->pc == (unsigned long)return_to_handler)) { ++ if (WARN_ON_ONCE(frame->graph == -1)) ++ return -EINVAL; ++ if (frame->graph < -1) ++ frame->graph += FTRACE_NOTRACE_DEPTH; ++ + /* + * This is a case where function graph tracer has + * modified a return address (LR) in a stack frame +diff --git a/arch/arm64/kernel/time.c b/arch/arm64/kernel/time.c +index a4391280fba9..f258636273c9 100644 +--- a/arch/arm64/kernel/time.c ++++ b/arch/arm64/kernel/time.c +@@ -52,7 +52,7 @@ unsigned long profile_pc(struct pt_regs *regs) + frame.fp = regs->regs[29]; + frame.pc = regs->pc; + #ifdef CONFIG_FUNCTION_GRAPH_TRACER +- frame.graph = -1; /* no task info */ ++ frame.graph = current->curr_ret_stack; + #endif + do { + int ret = unwind_frame(NULL, &frame); +diff --git a/arch/cris/include/arch-v10/arch/bug.h b/arch/cris/include/arch-v10/arch/bug.h +index 905afeacfedf..06da9d49152a 100644 +--- a/arch/cris/include/arch-v10/arch/bug.h ++++ b/arch/cris/include/arch-v10/arch/bug.h +@@ -44,18 +44,25 @@ struct bug_frame { + * not be used like this with newer versions of gcc. + */ + #define BUG() \ ++do { \ + __asm__ __volatile__ ("clear.d [" __stringify(BUG_MAGIC) "]\n\t"\ + "movu.w " __stringify(__LINE__) ",$r0\n\t"\ + "jump 0f\n\t" \ + ".section .rodata\n" \ + "0:\t.string \"" __FILE__ "\"\n\t" \ +- ".previous") ++ ".previous"); \ ++ unreachable(); \ ++} while (0) + #endif + + #else + + /* This just causes an oops. */ +-#define BUG() (*(int *)0 = 0) ++#define BUG() \ ++do { \ ++ barrier_before_unreachable(); \ ++ __builtin_trap(); \ ++} while (0) + + #endif + +diff --git a/arch/ia64/include/asm/bug.h b/arch/ia64/include/asm/bug.h +index bd3eeb8d1cfa..66b37a532765 100644 +--- a/arch/ia64/include/asm/bug.h ++++ b/arch/ia64/include/asm/bug.h +@@ -4,7 +4,11 @@ + + #ifdef CONFIG_BUG + #define ia64_abort() __builtin_trap() +-#define BUG() do { printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); ia64_abort(); } while (0) ++#define BUG() do { \ ++ printk("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ ++ ia64_abort(); \ ++} while (0) + + /* should this BUG be made generic? */ + #define HAVE_ARCH_BUG +diff --git a/arch/ia64/kernel/err_inject.c b/arch/ia64/kernel/err_inject.c +index 85bba43e7d5d..658a8e06a69b 100644 +--- a/arch/ia64/kernel/err_inject.c ++++ b/arch/ia64/kernel/err_inject.c +@@ -142,7 +142,7 @@ store_virtual_to_phys(struct device *dev, struct device_attribute *attr, + u64 virt_addr=simple_strtoull(buf, NULL, 16); + int ret; + +- ret = get_user_pages(virt_addr, 1, FOLL_WRITE, NULL, NULL); ++ ret = get_user_pages_fast(virt_addr, 1, FOLL_WRITE, NULL); + if (ret<=0) { + #ifdef ERR_INJ_DEBUG + printk("Virtual address %lx is not existing.\n",virt_addr); +diff --git a/arch/m68k/coldfire/device.c b/arch/m68k/coldfire/device.c +index 84938fdbbada..908d58347790 100644 +--- a/arch/m68k/coldfire/device.c ++++ b/arch/m68k/coldfire/device.c +@@ -135,7 +135,11 @@ static struct platform_device mcf_fec0 = { + .id = 0, + .num_resources = ARRAY_SIZE(mcf_fec0_resources), + .resource = mcf_fec0_resources, +- .dev.platform_data = FEC_PDATA, ++ .dev = { ++ .dma_mask = &mcf_fec0.dev.coherent_dma_mask, ++ .coherent_dma_mask = DMA_BIT_MASK(32), ++ .platform_data = FEC_PDATA, ++ } + }; + + #ifdef MCFFEC_BASE1 +@@ -167,7 +171,11 @@ static struct platform_device mcf_fec1 = { + .id = 1, + .num_resources = ARRAY_SIZE(mcf_fec1_resources), + .resource = mcf_fec1_resources, +- .dev.platform_data = FEC_PDATA, ++ .dev = { ++ .dma_mask = &mcf_fec1.dev.coherent_dma_mask, ++ .coherent_dma_mask = DMA_BIT_MASK(32), ++ .platform_data = FEC_PDATA, ++ } + }; + #endif /* MCFFEC_BASE1 */ + #endif /* CONFIG_FEC */ +diff --git a/arch/m68k/include/asm/bug.h b/arch/m68k/include/asm/bug.h +index b7e2bf1ba4a6..275dca1435bf 100644 +--- a/arch/m68k/include/asm/bug.h ++++ b/arch/m68k/include/asm/bug.h +@@ -8,16 +8,19 @@ + #ifndef CONFIG_SUN3 + #define BUG() do { \ + pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #else + #define BUG() do { \ + pr_crit("kernel BUG at %s:%d!\n", __FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + panic("BUG!"); \ + } while (0) + #endif + #else + #define BUG() do { \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #endif +diff --git a/arch/mips/cavium-octeon/octeon-irq.c b/arch/mips/cavium-octeon/octeon-irq.c +index d99f5242169e..b3aec101a65d 100644 +--- a/arch/mips/cavium-octeon/octeon-irq.c ++++ b/arch/mips/cavium-octeon/octeon-irq.c +@@ -2271,7 +2271,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + + parent_irq = irq_of_parse_and_map(ciu_node, 0); + if (!parent_irq) { +- pr_err("ERROR: Couldn't acquire parent_irq for %s\n.", ++ pr_err("ERROR: Couldn't acquire parent_irq for %s\n", + ciu_node->name); + return -EINVAL; + } +@@ -2283,7 +2283,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + + addr = of_get_address(ciu_node, 0, NULL, NULL); + if (!addr) { +- pr_err("ERROR: Couldn't acquire reg(0) %s\n.", ciu_node->name); ++ pr_err("ERROR: Couldn't acquire reg(0) %s\n", ciu_node->name); + return -EINVAL; + } + host_data->raw_reg = (u64)phys_to_virt( +@@ -2291,7 +2291,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + + addr = of_get_address(ciu_node, 1, NULL, NULL); + if (!addr) { +- pr_err("ERROR: Couldn't acquire reg(1) %s\n.", ciu_node->name); ++ pr_err("ERROR: Couldn't acquire reg(1) %s\n", ciu_node->name); + return -EINVAL; + } + host_data->en_reg = (u64)phys_to_virt( +@@ -2299,7 +2299,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + + r = of_property_read_u32(ciu_node, "cavium,max-bits", &val); + if (r) { +- pr_err("ERROR: Couldn't read cavium,max-bits from %s\n.", ++ pr_err("ERROR: Couldn't read cavium,max-bits from %s\n", + ciu_node->name); + return r; + } +@@ -2309,7 +2309,7 @@ static int __init octeon_irq_init_cib(struct device_node *ciu_node, + &octeon_irq_domain_cib_ops, + host_data); + if (!cib_domain) { +- pr_err("ERROR: Couldn't irq_domain_add_linear()\n."); ++ pr_err("ERROR: Couldn't irq_domain_add_linear()\n"); + return -ENOMEM; + } + +diff --git a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h +index aa3800c82332..d99ca862dae3 100644 +--- a/arch/mips/include/asm/mach-ath79/ar71xx_regs.h ++++ b/arch/mips/include/asm/mach-ath79/ar71xx_regs.h +@@ -167,7 +167,7 @@ + #define AR71XX_AHB_DIV_MASK 0x7 + + #define AR724X_PLL_REG_CPU_CONFIG 0x00 +-#define AR724X_PLL_REG_PCIE_CONFIG 0x18 ++#define AR724X_PLL_REG_PCIE_CONFIG 0x10 + + #define AR724X_PLL_FB_SHIFT 0 + #define AR724X_PLL_FB_MASK 0x3ff +diff --git a/arch/mips/include/asm/machine.h b/arch/mips/include/asm/machine.h +index e0d9b373d415..f83879dadd1e 100644 +--- a/arch/mips/include/asm/machine.h ++++ b/arch/mips/include/asm/machine.h +@@ -52,7 +52,7 @@ mips_machine_is_compatible(const struct mips_machine *mach, const void *fdt) + if (!mach->matches) + return NULL; + +- for (match = mach->matches; match->compatible; match++) { ++ for (match = mach->matches; match->compatible[0]; match++) { + if (fdt_node_check_compatible(fdt, 0, match->compatible) == 0) + return match; + } +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index c552c20237d4..006105fb12fe 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -454,7 +454,7 @@ static int fpr_get_msa(struct task_struct *target, + /* + * Copy the floating-point context to the supplied NT_PRFPREG buffer. + * Choose the appropriate helper for general registers, and then copy +- * the FCSR register separately. ++ * the FCSR and FIR registers separately. + */ + static int fpr_get(struct task_struct *target, + const struct user_regset *regset, +@@ -462,6 +462,7 @@ static int fpr_get(struct task_struct *target, + void *kbuf, void __user *ubuf) + { + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t); ++ const int fir_pos = fcr31_pos + sizeof(u32); + int err; + + if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t)) +@@ -474,6 +475,12 @@ static int fpr_get(struct task_struct *target, + err = user_regset_copyout(&pos, &count, &kbuf, &ubuf, + &target->thread.fpu.fcr31, + fcr31_pos, fcr31_pos + sizeof(u32)); ++ if (err) ++ return err; ++ ++ err = user_regset_copyout(&pos, &count, &kbuf, &ubuf, ++ &boot_cpu_data.fpu_id, ++ fir_pos, fir_pos + sizeof(u32)); + + return err; + } +@@ -522,7 +529,8 @@ static int fpr_set_msa(struct task_struct *target, + /* + * Copy the supplied NT_PRFPREG buffer to the floating-point context. + * Choose the appropriate helper for general registers, and then copy +- * the FCSR register separately. ++ * the FCSR register separately. Ignore the incoming FIR register ++ * contents though, as the register is read-only. + * + * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0', + * which is supposed to have been guaranteed by the kernel before +@@ -536,6 +544,7 @@ static int fpr_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t); ++ const int fir_pos = fcr31_pos + sizeof(u32); + u32 fcr31; + int err; + +@@ -563,6 +572,11 @@ static int fpr_set(struct task_struct *target, + ptrace_setfcr31(target, fcr31); + } + ++ if (count > 0) ++ err = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, ++ fir_pos, ++ fir_pos + sizeof(u32)); ++ + return err; + } + +@@ -784,7 +798,7 @@ long arch_ptrace(struct task_struct *child, long request, + fregs = get_fpu_regs(child); + + #ifdef CONFIG_32BIT +- if (test_thread_flag(TIF_32BIT_FPREGS)) { ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) { + /* + * The odd registers are actually the high + * order bits of the values stored in the even +@@ -873,7 +887,7 @@ long arch_ptrace(struct task_struct *child, long request, + + init_fp_ctx(child); + #ifdef CONFIG_32BIT +- if (test_thread_flag(TIF_32BIT_FPREGS)) { ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) { + /* + * The odd registers are actually the high + * order bits of the values stored in the even +diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c +index 40e212d6b26b..4a157d3249ac 100644 +--- a/arch/mips/kernel/ptrace32.c ++++ b/arch/mips/kernel/ptrace32.c +@@ -98,7 +98,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + break; + } + fregs = get_fpu_regs(child); +- if (test_thread_flag(TIF_32BIT_FPREGS)) { ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) { + /* + * The odd registers are actually the high + * order bits of the values stored in the even +@@ -205,7 +205,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + sizeof(child->thread.fpu)); + child->thread.fpu.fcr31 = 0; + } +- if (test_thread_flag(TIF_32BIT_FPREGS)) { ++ if (test_tsk_thread_flag(child, TIF_32BIT_FPREGS)) { + /* + * The odd registers are actually the high + * order bits of the values stored in the even +diff --git a/arch/mips/kvm/mips.c b/arch/mips/kvm/mips.c +index 75fdeaa8c62f..9730ba734afe 100644 +--- a/arch/mips/kvm/mips.c ++++ b/arch/mips/kvm/mips.c +@@ -45,7 +45,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { + { "cache", VCPU_STAT(cache_exits), KVM_STAT_VCPU }, + { "signal", VCPU_STAT(signal_exits), KVM_STAT_VCPU }, + { "interrupt", VCPU_STAT(int_exits), KVM_STAT_VCPU }, +- { "cop_unsuable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU }, ++ { "cop_unusable", VCPU_STAT(cop_unusable_exits), KVM_STAT_VCPU }, + { "tlbmod", VCPU_STAT(tlbmod_exits), KVM_STAT_VCPU }, + { "tlbmiss_ld", VCPU_STAT(tlbmiss_ld_exits), KVM_STAT_VCPU }, + { "tlbmiss_st", VCPU_STAT(tlbmiss_st_exits), KVM_STAT_VCPU }, +diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c +index 6f534b209971..e12dfa48b478 100644 +--- a/arch/mips/mm/c-r4k.c ++++ b/arch/mips/mm/c-r4k.c +@@ -851,9 +851,12 @@ static void r4k_dma_cache_wback_inv(unsigned long addr, unsigned long size) + /* + * Either no secondary cache or the available caches don't have the + * subset property so we have to flush the primary caches +- * explicitly ++ * explicitly. ++ * If we would need IPI to perform an INDEX-type operation, then ++ * we have to use the HIT-type alternative as IPI cannot be used ++ * here due to interrupts possibly being disabled. + */ +- if (size >= dcache_size) { ++ if (!r4k_op_needs_ipi(R4K_INDEX) && size >= dcache_size) { + r4k_blast_dcache(); + } else { + R4600_HIT_CACHEOP_WAR_IMPL; +@@ -890,7 +893,7 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size) + return; + } + +- if (size >= dcache_size) { ++ if (!r4k_op_needs_ipi(R4K_INDEX) && size >= dcache_size) { + r4k_blast_dcache(); + } else { + R4600_HIT_CACHEOP_WAR_IMPL; +diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile +index 651974192c4d..b479926f0167 100644 +--- a/arch/powerpc/boot/Makefile ++++ b/arch/powerpc/boot/Makefile +@@ -101,7 +101,8 @@ $(addprefix $(obj)/,$(zlib-y)): \ + libfdt := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c + libfdtheader := fdt.h libfdt.h libfdt_internal.h + +-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o): \ ++$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o opal.o \ ++ treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \ + $(addprefix $(obj)/,$(libfdtheader)) + + src-wlib-y := string.S crt0.S stdio.c decompress.c main.c \ +diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h +index ccf10c2f8899..c3bdd2d8ec90 100644 +--- a/arch/powerpc/include/asm/exception-64s.h ++++ b/arch/powerpc/include/asm/exception-64s.h +@@ -69,6 +69,27 @@ + */ + #define EX_R3 EX_DAR + ++#define STF_ENTRY_BARRIER_SLOT \ ++ STF_ENTRY_BARRIER_FIXUP_SECTION; \ ++ nop; \ ++ nop; \ ++ nop ++ ++#define STF_EXIT_BARRIER_SLOT \ ++ STF_EXIT_BARRIER_FIXUP_SECTION; \ ++ nop; \ ++ nop; \ ++ nop; \ ++ nop; \ ++ nop; \ ++ nop ++ ++/* ++ * r10 must be free to use, r13 must be paca ++ */ ++#define INTERRUPT_TO_KERNEL \ ++ STF_ENTRY_BARRIER_SLOT ++ + /* + * Macros for annotating the expected destination of (h)rfid + * +@@ -85,16 +106,19 @@ + rfid + + #define RFI_TO_USER \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + rfid; \ + b rfi_flush_fallback + + #define RFI_TO_USER_OR_KERNEL \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + rfid; \ + b rfi_flush_fallback + + #define RFI_TO_GUEST \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + rfid; \ + b rfi_flush_fallback +@@ -103,21 +127,25 @@ + hrfid + + #define HRFI_TO_USER \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + hrfid; \ + b hrfi_flush_fallback + + #define HRFI_TO_USER_OR_KERNEL \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + hrfid; \ + b hrfi_flush_fallback + + #define HRFI_TO_GUEST \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + hrfid; \ + b hrfi_flush_fallback + + #define HRFI_TO_UNKNOWN \ ++ STF_EXIT_BARRIER_SLOT; \ + RFI_FLUSH_SLOT; \ + hrfid; \ + b hrfi_flush_fallback +@@ -249,6 +277,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943) + #define __EXCEPTION_PROLOG_1(area, extra, vec) \ + OPT_SAVE_REG_TO_PACA(area+EX_PPR, r9, CPU_FTR_HAS_PPR); \ + OPT_SAVE_REG_TO_PACA(area+EX_CFAR, r10, CPU_FTR_CFAR); \ ++ INTERRUPT_TO_KERNEL; \ + SAVE_CTR(r10, area); \ + mfcr r9; \ + extra(vec); \ +diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h +index 1e82eb3caabd..a9b64df34e2a 100644 +--- a/arch/powerpc/include/asm/feature-fixups.h ++++ b/arch/powerpc/include/asm/feature-fixups.h +@@ -187,6 +187,22 @@ label##3: \ + FTR_ENTRY_OFFSET label##1b-label##3b; \ + .popsection; + ++#define STF_ENTRY_BARRIER_FIXUP_SECTION \ ++953: \ ++ .pushsection __stf_entry_barrier_fixup,"a"; \ ++ .align 2; \ ++954: \ ++ FTR_ENTRY_OFFSET 953b-954b; \ ++ .popsection; ++ ++#define STF_EXIT_BARRIER_FIXUP_SECTION \ ++955: \ ++ .pushsection __stf_exit_barrier_fixup,"a"; \ ++ .align 2; \ ++956: \ ++ FTR_ENTRY_OFFSET 955b-956b; \ ++ .popsection; ++ + #define RFI_FLUSH_FIXUP_SECTION \ + 951: \ + .pushsection __rfi_flush_fixup,"a"; \ +@@ -199,6 +215,9 @@ label##3: \ + #ifndef __ASSEMBLY__ + #include + ++extern long stf_barrier_fallback; ++extern long __start___stf_entry_barrier_fixup, __stop___stf_entry_barrier_fixup; ++extern long __start___stf_exit_barrier_fixup, __stop___stf_exit_barrier_fixup; + extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; + + void apply_feature_fixups(void); +diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h +index eca3f9c68907..5a740feb7bd7 100644 +--- a/arch/powerpc/include/asm/hvcall.h ++++ b/arch/powerpc/include/asm/hvcall.h +@@ -337,6 +337,9 @@ + #define H_CPU_CHAR_L1D_FLUSH_ORI30 (1ull << 61) // IBM bit 2 + #define H_CPU_CHAR_L1D_FLUSH_TRIG2 (1ull << 60) // IBM bit 3 + #define H_CPU_CHAR_L1D_THREAD_PRIV (1ull << 59) // IBM bit 4 ++#define H_CPU_CHAR_BRANCH_HINTS_HONORED (1ull << 58) // IBM bit 5 ++#define H_CPU_CHAR_THREAD_RECONFIG_CTRL (1ull << 57) // IBM bit 6 ++#define H_CPU_CHAR_COUNT_CACHE_DISABLED (1ull << 56) // IBM bit 7 + + #define H_CPU_BEHAV_FAVOUR_SECURITY (1ull << 63) // IBM bit 0 + #define H_CPU_BEHAV_L1D_FLUSH_PR (1ull << 62) // IBM bit 1 +diff --git a/arch/powerpc/include/asm/irq_work.h b/arch/powerpc/include/asm/irq_work.h +index c6d3078bd8c3..b8b0be8f1a07 100644 +--- a/arch/powerpc/include/asm/irq_work.h ++++ b/arch/powerpc/include/asm/irq_work.h +@@ -6,5 +6,6 @@ static inline bool arch_irq_work_has_interrupt(void) + { + return true; + } ++extern void arch_irq_work_raise(void); + + #endif /* _ASM_POWERPC_IRQ_WORK_H */ +diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h +index b8366df50d19..e6bd59353e40 100644 +--- a/arch/powerpc/include/asm/paca.h ++++ b/arch/powerpc/include/asm/paca.h +@@ -238,8 +238,7 @@ struct paca_struct { + */ + u64 exrfi[EX_SIZE] __aligned(0x80); + void *rfi_flush_fallback_area; +- u64 l1d_flush_congruence; +- u64 l1d_flush_sets; ++ u64 l1d_flush_size; + #endif + }; + +diff --git a/arch/powerpc/include/asm/security_features.h b/arch/powerpc/include/asm/security_features.h +new file mode 100644 +index 000000000000..44989b22383c +--- /dev/null ++++ b/arch/powerpc/include/asm/security_features.h +@@ -0,0 +1,85 @@ ++/* SPDX-License-Identifier: GPL-2.0+ */ ++/* ++ * Security related feature bit definitions. ++ * ++ * Copyright 2018, Michael Ellerman, IBM Corporation. ++ */ ++ ++#ifndef _ASM_POWERPC_SECURITY_FEATURES_H ++#define _ASM_POWERPC_SECURITY_FEATURES_H ++ ++ ++extern unsigned long powerpc_security_features; ++extern bool rfi_flush; ++ ++/* These are bit flags */ ++enum stf_barrier_type { ++ STF_BARRIER_NONE = 0x1, ++ STF_BARRIER_FALLBACK = 0x2, ++ STF_BARRIER_EIEIO = 0x4, ++ STF_BARRIER_SYNC_ORI = 0x8, ++}; ++ ++void setup_stf_barrier(void); ++void do_stf_barrier_fixups(enum stf_barrier_type types); ++ ++static inline void security_ftr_set(unsigned long feature) ++{ ++ powerpc_security_features |= feature; ++} ++ ++static inline void security_ftr_clear(unsigned long feature) ++{ ++ powerpc_security_features &= ~feature; ++} ++ ++static inline bool security_ftr_enabled(unsigned long feature) ++{ ++ return !!(powerpc_security_features & feature); ++} ++ ++ ++// Features indicating support for Spectre/Meltdown mitigations ++ ++// The L1-D cache can be flushed with ori r30,r30,0 ++#define SEC_FTR_L1D_FLUSH_ORI30 0x0000000000000001ull ++ ++// The L1-D cache can be flushed with mtspr 882,r0 (aka SPRN_TRIG2) ++#define SEC_FTR_L1D_FLUSH_TRIG2 0x0000000000000002ull ++ ++// ori r31,r31,0 acts as a speculation barrier ++#define SEC_FTR_SPEC_BAR_ORI31 0x0000000000000004ull ++ ++// Speculation past bctr is disabled ++#define SEC_FTR_BCCTRL_SERIALISED 0x0000000000000008ull ++ ++// Entries in L1-D are private to a SMT thread ++#define SEC_FTR_L1D_THREAD_PRIV 0x0000000000000010ull ++ ++// Indirect branch prediction cache disabled ++#define SEC_FTR_COUNT_CACHE_DISABLED 0x0000000000000020ull ++ ++ ++// Features indicating need for Spectre/Meltdown mitigations ++ ++// The L1-D cache should be flushed on MSR[HV] 1->0 transition (hypervisor to guest) ++#define SEC_FTR_L1D_FLUSH_HV 0x0000000000000040ull ++ ++// The L1-D cache should be flushed on MSR[PR] 0->1 transition (kernel to userspace) ++#define SEC_FTR_L1D_FLUSH_PR 0x0000000000000080ull ++ ++// A speculation barrier should be used for bounds checks (Spectre variant 1) ++#define SEC_FTR_BNDS_CHK_SPEC_BAR 0x0000000000000100ull ++ ++// Firmware configuration indicates user favours security over performance ++#define SEC_FTR_FAVOUR_SECURITY 0x0000000000000200ull ++ ++ ++// Features enabled by default ++#define SEC_FTR_DEFAULT \ ++ (SEC_FTR_L1D_FLUSH_HV | \ ++ SEC_FTR_L1D_FLUSH_PR | \ ++ SEC_FTR_BNDS_CHK_SPEC_BAR | \ ++ SEC_FTR_FAVOUR_SECURITY) ++ ++#endif /* _ASM_POWERPC_SECURITY_FEATURES_H */ +diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h +index 469b7fdc9be4..bbcdf929be54 100644 +--- a/arch/powerpc/include/asm/setup.h ++++ b/arch/powerpc/include/asm/setup.h +@@ -49,7 +49,7 @@ enum l1d_flush_type { + L1D_FLUSH_MTTRIG = 0x8, + }; + +-void __init setup_rfi_flush(enum l1d_flush_type, bool enable); ++void setup_rfi_flush(enum l1d_flush_type, bool enable); + void do_rfi_flush_fixups(enum l1d_flush_type types); + + #endif /* !__ASSEMBLY__ */ +diff --git a/arch/powerpc/kernel/Makefile b/arch/powerpc/kernel/Makefile +index 6c6cce937dd8..1479c61e29c5 100644 +--- a/arch/powerpc/kernel/Makefile ++++ b/arch/powerpc/kernel/Makefile +@@ -42,7 +42,7 @@ obj-$(CONFIG_VDSO32) += vdso32/ + obj-$(CONFIG_PPC_WATCHDOG) += watchdog.o + obj-$(CONFIG_HAVE_HW_BREAKPOINT) += hw_breakpoint.o + obj-$(CONFIG_PPC_BOOK3S_64) += cpu_setup_ppc970.o cpu_setup_pa6t.o +-obj-$(CONFIG_PPC_BOOK3S_64) += cpu_setup_power.o ++obj-$(CONFIG_PPC_BOOK3S_64) += cpu_setup_power.o security.o + obj-$(CONFIG_PPC_BOOK3S_64) += mce.o mce_power.o + obj-$(CONFIG_PPC_BOOK3E_64) += exceptions-64e.o idle_book3e.o + obj-$(CONFIG_PPC64) += vdso64/ +diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c +index 748cdc4bb89a..2e5ea300258a 100644 +--- a/arch/powerpc/kernel/asm-offsets.c ++++ b/arch/powerpc/kernel/asm-offsets.c +@@ -239,8 +239,7 @@ int main(void) + OFFSET(PACA_IN_NMI, paca_struct, in_nmi); + OFFSET(PACA_RFI_FLUSH_FALLBACK_AREA, paca_struct, rfi_flush_fallback_area); + OFFSET(PACA_EXRFI, paca_struct, exrfi); +- OFFSET(PACA_L1D_FLUSH_CONGRUENCE, paca_struct, l1d_flush_congruence); +- OFFSET(PACA_L1D_FLUSH_SETS, paca_struct, l1d_flush_sets); ++ OFFSET(PACA_L1D_FLUSH_SIZE, paca_struct, l1d_flush_size); + + #endif + OFFSET(PACAHWCPUID, paca_struct, hw_cpu_id); +diff --git a/arch/powerpc/kernel/cpu_setup_power.S b/arch/powerpc/kernel/cpu_setup_power.S +index 679bbe714e85..9daede99c131 100644 +--- a/arch/powerpc/kernel/cpu_setup_power.S ++++ b/arch/powerpc/kernel/cpu_setup_power.S +@@ -28,6 +28,7 @@ _GLOBAL(__setup_cpu_power7) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + li r4,(LPCR_LPES1 >> LPCR_LPES_SH) + bl __init_LPCR_ISA206 +@@ -42,6 +43,7 @@ _GLOBAL(__restore_cpu_power7) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + li r4,(LPCR_LPES1 >> LPCR_LPES_SH) + bl __init_LPCR_ISA206 +@@ -59,6 +61,7 @@ _GLOBAL(__setup_cpu_power8) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + ori r3, r3, LPCR_PECEDH + li r4,0 /* LPES = 0 */ +@@ -81,6 +84,7 @@ _GLOBAL(__restore_cpu_power8) + beqlr + li r0,0 + mtspr SPRN_LPID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + ori r3, r3, LPCR_PECEDH + li r4,0 /* LPES = 0 */ +@@ -103,6 +107,7 @@ _GLOBAL(__setup_cpu_power9) + mtspr SPRN_PSSCR,r0 + mtspr SPRN_LPID,r0 + mtspr SPRN_PID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC) + or r3, r3, r4 +@@ -128,6 +133,7 @@ _GLOBAL(__restore_cpu_power9) + mtspr SPRN_PSSCR,r0 + mtspr SPRN_LPID,r0 + mtspr SPRN_PID,r0 ++ mtspr SPRN_PCR,r0 + mfspr r3,SPRN_LPCR + LOAD_REG_IMMEDIATE(r4, LPCR_PECEDH | LPCR_PECE_HVEE | LPCR_HVICE | LPCR_HEIC) + or r3, r3, r4 +diff --git a/arch/powerpc/kernel/dt_cpu_ftrs.c b/arch/powerpc/kernel/dt_cpu_ftrs.c +index f047ae1b6271..2dba206b065a 100644 +--- a/arch/powerpc/kernel/dt_cpu_ftrs.c ++++ b/arch/powerpc/kernel/dt_cpu_ftrs.c +@@ -137,6 +137,7 @@ static void __restore_cpu_cpufeatures(void) + if (hv_mode) { + mtspr(SPRN_LPID, 0); + mtspr(SPRN_HFSCR, system_registers.hfscr); ++ mtspr(SPRN_PCR, 0); + } + mtspr(SPRN_FSCR, system_registers.fscr); + +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index f9ca4bb3d48e..c09f0a6f8495 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -825,7 +825,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_TM) + #endif + + +-EXC_REAL_MASKABLE(decrementer, 0x900, 0x80) ++EXC_REAL_OOL_MASKABLE(decrementer, 0x900, 0x80) + EXC_VIRT_MASKABLE(decrementer, 0x4900, 0x80, 0x900) + TRAMP_KVM(PACA_EXGEN, 0x900) + EXC_COMMON_ASYNC(decrementer_common, 0x900, timer_interrupt) +@@ -901,6 +901,7 @@ EXC_COMMON(trap_0b_common, 0xb00, unknown_exception) + mtctr r13; \ + GET_PACA(r13); \ + std r10,PACA_EXGEN+EX_R10(r13); \ ++ INTERRUPT_TO_KERNEL; \ + KVMTEST_PR(0xc00); /* uses r10, branch to do_kvm_0xc00_system_call */ \ + HMT_MEDIUM; \ + mfctr r9; +@@ -909,7 +910,8 @@ EXC_COMMON(trap_0b_common, 0xb00, unknown_exception) + #define SYSCALL_KVMTEST \ + HMT_MEDIUM; \ + mr r9,r13; \ +- GET_PACA(r13); ++ GET_PACA(r13); \ ++ INTERRUPT_TO_KERNEL; + #endif + + #define LOAD_SYSCALL_HANDLER(reg) \ +@@ -1434,45 +1436,56 @@ masked_##_H##interrupt: \ + b .; \ + MASKED_DEC_HANDLER(_H) + ++TRAMP_REAL_BEGIN(stf_barrier_fallback) ++ std r9,PACA_EXRFI+EX_R9(r13) ++ std r10,PACA_EXRFI+EX_R10(r13) ++ sync ++ ld r9,PACA_EXRFI+EX_R9(r13) ++ ld r10,PACA_EXRFI+EX_R10(r13) ++ ori 31,31,0 ++ .rept 14 ++ b 1f ++1: ++ .endr ++ blr ++ + TRAMP_REAL_BEGIN(rfi_flush_fallback) + SET_SCRATCH0(r13); + GET_PACA(r13); + std r9,PACA_EXRFI+EX_R9(r13) + std r10,PACA_EXRFI+EX_R10(r13) + std r11,PACA_EXRFI+EX_R11(r13) +- std r12,PACA_EXRFI+EX_R12(r13) +- std r8,PACA_EXRFI+EX_R13(r13) + mfctr r9 + ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) +- ld r11,PACA_L1D_FLUSH_SETS(r13) +- ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) +- /* +- * The load adresses are at staggered offsets within cachelines, +- * which suits some pipelines better (on others it should not +- * hurt). +- */ +- addi r12,r12,8 ++ ld r11,PACA_L1D_FLUSH_SIZE(r13) ++ srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */ + mtctr r11 + DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ + + /* order ld/st prior to dcbt stop all streams with flushing */ + sync +-1: li r8,0 +- .rept 8 /* 8-way set associative */ +- ldx r11,r10,r8 +- add r8,r8,r12 +- xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not +- add r8,r8,r11 // Add 0, this creates a dependency on the ldx +- .endr +- addi r10,r10,128 /* 128 byte cache line */ ++ ++ /* ++ * The load adresses are at staggered offsets within cachelines, ++ * which suits some pipelines better (on others it should not ++ * hurt). ++ */ ++1: ++ ld r11,(0x80 + 8)*0(r10) ++ ld r11,(0x80 + 8)*1(r10) ++ ld r11,(0x80 + 8)*2(r10) ++ ld r11,(0x80 + 8)*3(r10) ++ ld r11,(0x80 + 8)*4(r10) ++ ld r11,(0x80 + 8)*5(r10) ++ ld r11,(0x80 + 8)*6(r10) ++ ld r11,(0x80 + 8)*7(r10) ++ addi r10,r10,0x80*8 + bdnz 1b + + mtctr r9 + ld r9,PACA_EXRFI+EX_R9(r13) + ld r10,PACA_EXRFI+EX_R10(r13) + ld r11,PACA_EXRFI+EX_R11(r13) +- ld r12,PACA_EXRFI+EX_R12(r13) +- ld r8,PACA_EXRFI+EX_R13(r13) + GET_SCRATCH0(r13); + rfid + +@@ -1482,39 +1495,37 @@ TRAMP_REAL_BEGIN(hrfi_flush_fallback) + std r9,PACA_EXRFI+EX_R9(r13) + std r10,PACA_EXRFI+EX_R10(r13) + std r11,PACA_EXRFI+EX_R11(r13) +- std r12,PACA_EXRFI+EX_R12(r13) +- std r8,PACA_EXRFI+EX_R13(r13) + mfctr r9 + ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) +- ld r11,PACA_L1D_FLUSH_SETS(r13) +- ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) +- /* +- * The load adresses are at staggered offsets within cachelines, +- * which suits some pipelines better (on others it should not +- * hurt). +- */ +- addi r12,r12,8 ++ ld r11,PACA_L1D_FLUSH_SIZE(r13) ++ srdi r11,r11,(7 + 3) /* 128 byte lines, unrolled 8x */ + mtctr r11 + DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ + + /* order ld/st prior to dcbt stop all streams with flushing */ + sync +-1: li r8,0 +- .rept 8 /* 8-way set associative */ +- ldx r11,r10,r8 +- add r8,r8,r12 +- xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not +- add r8,r8,r11 // Add 0, this creates a dependency on the ldx +- .endr +- addi r10,r10,128 /* 128 byte cache line */ ++ ++ /* ++ * The load adresses are at staggered offsets within cachelines, ++ * which suits some pipelines better (on others it should not ++ * hurt). ++ */ ++1: ++ ld r11,(0x80 + 8)*0(r10) ++ ld r11,(0x80 + 8)*1(r10) ++ ld r11,(0x80 + 8)*2(r10) ++ ld r11,(0x80 + 8)*3(r10) ++ ld r11,(0x80 + 8)*4(r10) ++ ld r11,(0x80 + 8)*5(r10) ++ ld r11,(0x80 + 8)*6(r10) ++ ld r11,(0x80 + 8)*7(r10) ++ addi r10,r10,0x80*8 + bdnz 1b + + mtctr r9 + ld r9,PACA_EXRFI+EX_R9(r13) + ld r10,PACA_EXRFI+EX_R10(r13) + ld r11,PACA_EXRFI+EX_R11(r13) +- ld r12,PACA_EXRFI+EX_R12(r13) +- ld r8,PACA_EXRFI+EX_R13(r13) + GET_SCRATCH0(r13); + hrfid + +diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S +index 1125c9be9e06..e35cebd45c35 100644 +--- a/arch/powerpc/kernel/idle_book3s.S ++++ b/arch/powerpc/kernel/idle_book3s.S +@@ -838,6 +838,8 @@ BEGIN_FTR_SECTION + mtspr SPRN_PTCR,r4 + ld r4,_RPR(r1) + mtspr SPRN_RPR,r4 ++ ld r4,_AMOR(r1) ++ mtspr SPRN_AMOR,r4 + END_FTR_SECTION_IFSET(CPU_FTR_ARCH_300) + + ld r4,_TSCR(r1) +diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c +new file mode 100644 +index 000000000000..b98a722da915 +--- /dev/null ++++ b/arch/powerpc/kernel/security.c +@@ -0,0 +1,237 @@ ++// SPDX-License-Identifier: GPL-2.0+ ++// ++// Security related flags and so on. ++// ++// Copyright 2018, Michael Ellerman, IBM Corporation. ++ ++#include ++#include ++#include ++ ++#include ++#include ++ ++ ++unsigned long powerpc_security_features __read_mostly = SEC_FTR_DEFAULT; ++ ++ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ bool thread_priv; ++ ++ thread_priv = security_ftr_enabled(SEC_FTR_L1D_THREAD_PRIV); ++ ++ if (rfi_flush || thread_priv) { ++ struct seq_buf s; ++ seq_buf_init(&s, buf, PAGE_SIZE - 1); ++ ++ seq_buf_printf(&s, "Mitigation: "); ++ ++ if (rfi_flush) ++ seq_buf_printf(&s, "RFI Flush"); ++ ++ if (rfi_flush && thread_priv) ++ seq_buf_printf(&s, ", "); ++ ++ if (thread_priv) ++ seq_buf_printf(&s, "L1D private per thread"); ++ ++ seq_buf_printf(&s, "\n"); ++ ++ return s.len; ++ } ++ ++ if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && ++ !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)) ++ return sprintf(buf, "Not affected\n"); ++ ++ return sprintf(buf, "Vulnerable\n"); ++} ++ ++ssize_t cpu_show_spectre_v1(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ if (!security_ftr_enabled(SEC_FTR_BNDS_CHK_SPEC_BAR)) ++ return sprintf(buf, "Not affected\n"); ++ ++ return sprintf(buf, "Vulnerable\n"); ++} ++ ++ssize_t cpu_show_spectre_v2(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ bool bcs, ccd, ori; ++ struct seq_buf s; ++ ++ seq_buf_init(&s, buf, PAGE_SIZE - 1); ++ ++ bcs = security_ftr_enabled(SEC_FTR_BCCTRL_SERIALISED); ++ ccd = security_ftr_enabled(SEC_FTR_COUNT_CACHE_DISABLED); ++ ori = security_ftr_enabled(SEC_FTR_SPEC_BAR_ORI31); ++ ++ if (bcs || ccd) { ++ seq_buf_printf(&s, "Mitigation: "); ++ ++ if (bcs) ++ seq_buf_printf(&s, "Indirect branch serialisation (kernel only)"); ++ ++ if (bcs && ccd) ++ seq_buf_printf(&s, ", "); ++ ++ if (ccd) ++ seq_buf_printf(&s, "Indirect branch cache disabled"); ++ } else ++ seq_buf_printf(&s, "Vulnerable"); ++ ++ if (ori) ++ seq_buf_printf(&s, ", ori31 speculation barrier enabled"); ++ ++ seq_buf_printf(&s, "\n"); ++ ++ return s.len; ++} ++ ++/* ++ * Store-forwarding barrier support. ++ */ ++ ++static enum stf_barrier_type stf_enabled_flush_types; ++static bool no_stf_barrier; ++bool stf_barrier; ++ ++static int __init handle_no_stf_barrier(char *p) ++{ ++ pr_info("stf-barrier: disabled on command line."); ++ no_stf_barrier = true; ++ return 0; ++} ++ ++early_param("no_stf_barrier", handle_no_stf_barrier); ++ ++/* This is the generic flag used by other architectures */ ++static int __init handle_ssbd(char *p) ++{ ++ if (!p || strncmp(p, "auto", 5) == 0 || strncmp(p, "on", 2) == 0 ) { ++ /* Until firmware tells us, we have the barrier with auto */ ++ return 0; ++ } else if (strncmp(p, "off", 3) == 0) { ++ handle_no_stf_barrier(NULL); ++ return 0; ++ } else ++ return 1; ++ ++ return 0; ++} ++early_param("spec_store_bypass_disable", handle_ssbd); ++ ++/* This is the generic flag used by other architectures */ ++static int __init handle_no_ssbd(char *p) ++{ ++ handle_no_stf_barrier(NULL); ++ return 0; ++} ++early_param("nospec_store_bypass_disable", handle_no_ssbd); ++ ++static void stf_barrier_enable(bool enable) ++{ ++ if (enable) ++ do_stf_barrier_fixups(stf_enabled_flush_types); ++ else ++ do_stf_barrier_fixups(STF_BARRIER_NONE); ++ ++ stf_barrier = enable; ++} ++ ++void setup_stf_barrier(void) ++{ ++ enum stf_barrier_type type; ++ bool enable, hv; ++ ++ hv = cpu_has_feature(CPU_FTR_HVMODE); ++ ++ /* Default to fallback in case fw-features are not available */ ++ if (cpu_has_feature(CPU_FTR_ARCH_300)) ++ type = STF_BARRIER_EIEIO; ++ else if (cpu_has_feature(CPU_FTR_ARCH_207S)) ++ type = STF_BARRIER_SYNC_ORI; ++ else if (cpu_has_feature(CPU_FTR_ARCH_206)) ++ type = STF_BARRIER_FALLBACK; ++ else ++ type = STF_BARRIER_NONE; ++ ++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && ++ (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) || ++ (security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && hv)); ++ ++ if (type == STF_BARRIER_FALLBACK) { ++ pr_info("stf-barrier: fallback barrier available\n"); ++ } else if (type == STF_BARRIER_SYNC_ORI) { ++ pr_info("stf-barrier: hwsync barrier available\n"); ++ } else if (type == STF_BARRIER_EIEIO) { ++ pr_info("stf-barrier: eieio barrier available\n"); ++ } ++ ++ stf_enabled_flush_types = type; ++ ++ if (!no_stf_barrier) ++ stf_barrier_enable(enable); ++} ++ ++ssize_t cpu_show_spec_store_bypass(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ if (stf_barrier && stf_enabled_flush_types != STF_BARRIER_NONE) { ++ const char *type; ++ switch (stf_enabled_flush_types) { ++ case STF_BARRIER_EIEIO: ++ type = "eieio"; ++ break; ++ case STF_BARRIER_SYNC_ORI: ++ type = "hwsync"; ++ break; ++ case STF_BARRIER_FALLBACK: ++ type = "fallback"; ++ break; ++ default: ++ type = "unknown"; ++ } ++ return sprintf(buf, "Mitigation: Kernel entry/exit barrier (%s)\n", type); ++ } ++ ++ if (!security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV) && ++ !security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR)) ++ return sprintf(buf, "Not affected\n"); ++ ++ return sprintf(buf, "Vulnerable\n"); ++} ++ ++#ifdef CONFIG_DEBUG_FS ++static int stf_barrier_set(void *data, u64 val) ++{ ++ bool enable; ++ ++ if (val == 1) ++ enable = true; ++ else if (val == 0) ++ enable = false; ++ else ++ return -EINVAL; ++ ++ /* Only do anything if we're changing state */ ++ if (enable != stf_barrier) ++ stf_barrier_enable(enable); ++ ++ return 0; ++} ++ ++static int stf_barrier_get(void *data, u64 *val) ++{ ++ *val = stf_barrier ? 1 : 0; ++ return 0; ++} ++ ++DEFINE_SIMPLE_ATTRIBUTE(fops_stf_barrier, stf_barrier_get, stf_barrier_set, "%llu\n"); ++ ++static __init int stf_barrier_debugfs_init(void) ++{ ++ debugfs_create_file("stf_barrier", 0600, powerpc_debugfs_root, NULL, &fops_stf_barrier); ++ return 0; ++} ++device_initcall(stf_barrier_debugfs_init); ++#endif /* CONFIG_DEBUG_FS */ +diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c +index 9527a4c6cbc2..0618aa61b26a 100644 +--- a/arch/powerpc/kernel/setup_64.c ++++ b/arch/powerpc/kernel/setup_64.c +@@ -822,9 +822,6 @@ static void do_nothing(void *unused) + + void rfi_flush_enable(bool enable) + { +- if (rfi_flush == enable) +- return; +- + if (enable) { + do_rfi_flush_fixups(enabled_flush_types); + on_each_cpu(do_nothing, NULL, 1); +@@ -834,11 +831,15 @@ void rfi_flush_enable(bool enable) + rfi_flush = enable; + } + +-static void init_fallback_flush(void) ++static void __ref init_fallback_flush(void) + { + u64 l1d_size, limit; + int cpu; + ++ /* Only allocate the fallback flush area once (at boot time). */ ++ if (l1d_flush_fallback_area) ++ return; ++ + l1d_size = ppc64_caches.l1d.size; + limit = min(safe_stack_limit(), ppc64_rma_size); + +@@ -851,34 +852,23 @@ static void init_fallback_flush(void) + memset(l1d_flush_fallback_area, 0, l1d_size * 2); + + for_each_possible_cpu(cpu) { +- /* +- * The fallback flush is currently coded for 8-way +- * associativity. Different associativity is possible, but it +- * will be treated as 8-way and may not evict the lines as +- * effectively. +- * +- * 128 byte lines are mandatory. +- */ +- u64 c = l1d_size / 8; +- + paca[cpu].rfi_flush_fallback_area = l1d_flush_fallback_area; +- paca[cpu].l1d_flush_congruence = c; +- paca[cpu].l1d_flush_sets = c / 128; ++ paca[cpu].l1d_flush_size = l1d_size; + } + } + +-void __init setup_rfi_flush(enum l1d_flush_type types, bool enable) ++void setup_rfi_flush(enum l1d_flush_type types, bool enable) + { + if (types & L1D_FLUSH_FALLBACK) { +- pr_info("rfi-flush: Using fallback displacement flush\n"); ++ pr_info("rfi-flush: fallback displacement flush available\n"); + init_fallback_flush(); + } + + if (types & L1D_FLUSH_ORI) +- pr_info("rfi-flush: Using ori type flush\n"); ++ pr_info("rfi-flush: ori type flush available\n"); + + if (types & L1D_FLUSH_MTTRIG) +- pr_info("rfi-flush: Using mttrig type flush\n"); ++ pr_info("rfi-flush: mttrig type flush available\n"); + + enabled_flush_types = types; + +@@ -889,13 +879,19 @@ void __init setup_rfi_flush(enum l1d_flush_type types, bool enable) + #ifdef CONFIG_DEBUG_FS + static int rfi_flush_set(void *data, u64 val) + { ++ bool enable; ++ + if (val == 1) +- rfi_flush_enable(true); ++ enable = true; + else if (val == 0) +- rfi_flush_enable(false); ++ enable = false; + else + return -EINVAL; + ++ /* Only do anything if we're changing state */ ++ if (enable != rfi_flush) ++ rfi_flush_enable(enable); ++ + return 0; + } + +@@ -914,12 +910,4 @@ static __init int rfi_flush_debugfs_init(void) + } + device_initcall(rfi_flush_debugfs_init); + #endif +- +-ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) +-{ +- if (rfi_flush) +- return sprintf(buf, "Mitigation: RFI Flush\n"); +- +- return sprintf(buf, "Vulnerable\n"); +-} + #endif /* CONFIG_PPC_BOOK3S_64 */ +diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c +index d17007451f62..ac2e5e56a9f0 100644 +--- a/arch/powerpc/kernel/traps.c ++++ b/arch/powerpc/kernel/traps.c +@@ -182,6 +182,12 @@ static void oops_end(unsigned long flags, struct pt_regs *regs, + } + raw_local_irq_restore(flags); + ++ /* ++ * system_reset_excption handles debugger, crash dump, panic, for 0x100 ++ */ ++ if (TRAP(regs) == 0x100) ++ return; ++ + crash_fadump(regs, "die oops"); + + if (kexec_should_crash(current)) +@@ -246,8 +252,13 @@ void die(const char *str, struct pt_regs *regs, long err) + { + unsigned long flags; + +- if (debugger(regs)) +- return; ++ /* ++ * system_reset_excption handles debugger, crash dump, panic, for 0x100 ++ */ ++ if (TRAP(regs) != 0x100) { ++ if (debugger(regs)) ++ return; ++ } + + flags = oops_begin(regs); + if (__die(str, regs, err)) +@@ -1379,6 +1390,22 @@ void facility_unavailable_exception(struct pt_regs *regs) + value = mfspr(SPRN_FSCR); + + status = value >> 56; ++ if ((hv || status >= 2) && ++ (status < ARRAY_SIZE(facility_strings)) && ++ facility_strings[status]) ++ facility = facility_strings[status]; ++ ++ /* We should not have taken this interrupt in kernel */ ++ if (!user_mode(regs)) { ++ pr_emerg("Facility '%s' unavailable (%d) exception in kernel mode at %lx\n", ++ facility, status, regs->nip); ++ die("Unexpected facility unavailable exception", regs, SIGABRT); ++ } ++ ++ /* We restore the interrupt state now */ ++ if (!arch_irq_disabled_regs(regs)) ++ local_irq_enable(); ++ + if (status == FSCR_DSCR_LG) { + /* + * User is accessing the DSCR register using the problem +@@ -1445,25 +1472,11 @@ void facility_unavailable_exception(struct pt_regs *regs) + return; + } + +- if ((hv || status >= 2) && +- (status < ARRAY_SIZE(facility_strings)) && +- facility_strings[status]) +- facility = facility_strings[status]; +- +- /* We restore the interrupt state now */ +- if (!arch_irq_disabled_regs(regs)) +- local_irq_enable(); +- + pr_err_ratelimited("%sFacility '%s' unavailable (%d), exception at 0x%lx, MSR=%lx\n", + hv ? "Hypervisor " : "", facility, status, regs->nip, regs->msr); + + out: +- if (user_mode(regs)) { +- _exception(SIGILL, regs, ILL_ILLOPC, regs->nip); +- return; +- } +- +- die("Unexpected facility unavailable exception", regs, SIGABRT); ++ _exception(SIGILL, regs, ILL_ILLOPC, regs->nip); + } + #endif + +diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S +index 307843d23682..c89ffb88fa3b 100644 +--- a/arch/powerpc/kernel/vmlinux.lds.S ++++ b/arch/powerpc/kernel/vmlinux.lds.S +@@ -133,6 +133,20 @@ SECTIONS + RO_DATA(PAGE_SIZE) + + #ifdef CONFIG_PPC64 ++ . = ALIGN(8); ++ __stf_entry_barrier_fixup : AT(ADDR(__stf_entry_barrier_fixup) - LOAD_OFFSET) { ++ __start___stf_entry_barrier_fixup = .; ++ *(__stf_entry_barrier_fixup) ++ __stop___stf_entry_barrier_fixup = .; ++ } ++ ++ . = ALIGN(8); ++ __stf_exit_barrier_fixup : AT(ADDR(__stf_exit_barrier_fixup) - LOAD_OFFSET) { ++ __start___stf_exit_barrier_fixup = .; ++ *(__stf_exit_barrier_fixup) ++ __stop___stf_exit_barrier_fixup = .; ++ } ++ + . = ALIGN(8); + __rfi_flush_fixup : AT(ADDR(__rfi_flush_fixup) - LOAD_OFFSET) { + __start___rfi_flush_fixup = .; +diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c +index d0c0b8443dcf..762a899e85a4 100644 +--- a/arch/powerpc/lib/feature-fixups.c ++++ b/arch/powerpc/lib/feature-fixups.c +@@ -23,6 +23,7 @@ + #include + #include + #include ++#include + #include + + struct fixup_entry { +@@ -117,6 +118,120 @@ void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end) + } + + #ifdef CONFIG_PPC_BOOK3S_64 ++void do_stf_entry_barrier_fixups(enum stf_barrier_type types) ++{ ++ unsigned int instrs[3], *dest; ++ long *start, *end; ++ int i; ++ ++ start = PTRRELOC(&__start___stf_entry_barrier_fixup), ++ end = PTRRELOC(&__stop___stf_entry_barrier_fixup); ++ ++ instrs[0] = 0x60000000; /* nop */ ++ instrs[1] = 0x60000000; /* nop */ ++ instrs[2] = 0x60000000; /* nop */ ++ ++ i = 0; ++ if (types & STF_BARRIER_FALLBACK) { ++ instrs[i++] = 0x7d4802a6; /* mflr r10 */ ++ instrs[i++] = 0x60000000; /* branch patched below */ ++ instrs[i++] = 0x7d4803a6; /* mtlr r10 */ ++ } else if (types & STF_BARRIER_EIEIO) { ++ instrs[i++] = 0x7e0006ac; /* eieio + bit 6 hint */ ++ } else if (types & STF_BARRIER_SYNC_ORI) { ++ instrs[i++] = 0x7c0004ac; /* hwsync */ ++ instrs[i++] = 0xe94d0000; /* ld r10,0(r13) */ ++ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ ++ } ++ ++ for (i = 0; start < end; start++, i++) { ++ dest = (void *)start + *start; ++ ++ pr_devel("patching dest %lx\n", (unsigned long)dest); ++ ++ patch_instruction(dest, instrs[0]); ++ ++ if (types & STF_BARRIER_FALLBACK) ++ patch_branch(dest + 1, (unsigned long)&stf_barrier_fallback, ++ BRANCH_SET_LINK); ++ else ++ patch_instruction(dest + 1, instrs[1]); ++ ++ patch_instruction(dest + 2, instrs[2]); ++ } ++ ++ printk(KERN_DEBUG "stf-barrier: patched %d entry locations (%s barrier)\n", i, ++ (types == STF_BARRIER_NONE) ? "no" : ++ (types == STF_BARRIER_FALLBACK) ? "fallback" : ++ (types == STF_BARRIER_EIEIO) ? "eieio" : ++ (types == (STF_BARRIER_SYNC_ORI)) ? "hwsync" ++ : "unknown"); ++} ++ ++void do_stf_exit_barrier_fixups(enum stf_barrier_type types) ++{ ++ unsigned int instrs[6], *dest; ++ long *start, *end; ++ int i; ++ ++ start = PTRRELOC(&__start___stf_exit_barrier_fixup), ++ end = PTRRELOC(&__stop___stf_exit_barrier_fixup); ++ ++ instrs[0] = 0x60000000; /* nop */ ++ instrs[1] = 0x60000000; /* nop */ ++ instrs[2] = 0x60000000; /* nop */ ++ instrs[3] = 0x60000000; /* nop */ ++ instrs[4] = 0x60000000; /* nop */ ++ instrs[5] = 0x60000000; /* nop */ ++ ++ i = 0; ++ if (types & STF_BARRIER_FALLBACK || types & STF_BARRIER_SYNC_ORI) { ++ if (cpu_has_feature(CPU_FTR_HVMODE)) { ++ instrs[i++] = 0x7db14ba6; /* mtspr 0x131, r13 (HSPRG1) */ ++ instrs[i++] = 0x7db04aa6; /* mfspr r13, 0x130 (HSPRG0) */ ++ } else { ++ instrs[i++] = 0x7db243a6; /* mtsprg 2,r13 */ ++ instrs[i++] = 0x7db142a6; /* mfsprg r13,1 */ ++ } ++ instrs[i++] = 0x7c0004ac; /* hwsync */ ++ instrs[i++] = 0xe9ad0000; /* ld r13,0(r13) */ ++ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ ++ if (cpu_has_feature(CPU_FTR_HVMODE)) { ++ instrs[i++] = 0x7db14aa6; /* mfspr r13, 0x131 (HSPRG1) */ ++ } else { ++ instrs[i++] = 0x7db242a6; /* mfsprg r13,2 */ ++ } ++ } else if (types & STF_BARRIER_EIEIO) { ++ instrs[i++] = 0x7e0006ac; /* eieio + bit 6 hint */ ++ } ++ ++ for (i = 0; start < end; start++, i++) { ++ dest = (void *)start + *start; ++ ++ pr_devel("patching dest %lx\n", (unsigned long)dest); ++ ++ patch_instruction(dest, instrs[0]); ++ patch_instruction(dest + 1, instrs[1]); ++ patch_instruction(dest + 2, instrs[2]); ++ patch_instruction(dest + 3, instrs[3]); ++ patch_instruction(dest + 4, instrs[4]); ++ patch_instruction(dest + 5, instrs[5]); ++ } ++ printk(KERN_DEBUG "stf-barrier: patched %d exit locations (%s barrier)\n", i, ++ (types == STF_BARRIER_NONE) ? "no" : ++ (types == STF_BARRIER_FALLBACK) ? "fallback" : ++ (types == STF_BARRIER_EIEIO) ? "eieio" : ++ (types == (STF_BARRIER_SYNC_ORI)) ? "hwsync" ++ : "unknown"); ++} ++ ++ ++void do_stf_barrier_fixups(enum stf_barrier_type types) ++{ ++ do_stf_entry_barrier_fixups(types); ++ do_stf_exit_barrier_fixups(types); ++} ++ + void do_rfi_flush_fixups(enum l1d_flush_type types) + { + unsigned int instrs[3], *dest; +@@ -153,7 +268,14 @@ void do_rfi_flush_fixups(enum l1d_flush_type types) + patch_instruction(dest + 2, instrs[2]); + } + +- printk(KERN_DEBUG "rfi-flush: patched %d locations\n", i); ++ printk(KERN_DEBUG "rfi-flush: patched %d locations (%s flush)\n", i, ++ (types == L1D_FLUSH_NONE) ? "no" : ++ (types == L1D_FLUSH_FALLBACK) ? "fallback displacement" : ++ (types & L1D_FLUSH_ORI) ? (types & L1D_FLUSH_MTTRIG) ++ ? "ori+mttrig type" ++ : "ori type" : ++ (types & L1D_FLUSH_MTTRIG) ? "mttrig type" ++ : "unknown"); + } + #endif /* CONFIG_PPC_BOOK3S_64 */ + +diff --git a/arch/powerpc/net/bpf_jit_comp.c b/arch/powerpc/net/bpf_jit_comp.c +index f9941b3b5770..f760494ecd66 100644 +--- a/arch/powerpc/net/bpf_jit_comp.c ++++ b/arch/powerpc/net/bpf_jit_comp.c +@@ -329,6 +329,9 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image, + BUILD_BUG_ON(FIELD_SIZEOF(struct sk_buff, len) != 4); + PPC_LWZ_OFFS(r_A, r_skb, offsetof(struct sk_buff, len)); + break; ++ case BPF_LDX | BPF_W | BPF_ABS: /* A = *((u32 *)(seccomp_data + K)); */ ++ PPC_LWZ_OFFS(r_A, r_skb, K); ++ break; + case BPF_LDX | BPF_W | BPF_LEN: /* X = skb->len; */ + PPC_LWZ_OFFS(r_X, r_skb, offsetof(struct sk_buff, len)); + break; +diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c +index fce545774d50..b7a6044161e8 100644 +--- a/arch/powerpc/perf/core-book3s.c ++++ b/arch/powerpc/perf/core-book3s.c +@@ -457,6 +457,16 @@ static void power_pmu_bhrb_read(struct cpu_hw_events *cpuhw) + /* invalid entry */ + continue; + ++ /* ++ * BHRB rolling buffer could very much contain the kernel ++ * addresses at this point. Check the privileges before ++ * exporting it to userspace (avoid exposure of regions ++ * where we could have speculative execution) ++ */ ++ if (perf_paranoid_kernel() && !capable(CAP_SYS_ADMIN) && ++ is_kernel_addr(addr)) ++ continue; ++ + /* Branches are read most recent first (ie. mfbhrb 0 is + * the most recent branch). + * There are two types of valid entries: +@@ -1226,6 +1236,7 @@ static void power_pmu_disable(struct pmu *pmu) + */ + write_mmcr0(cpuhw, val); + mb(); ++ isync(); + + /* + * Disable instruction sampling if it was enabled +@@ -1234,12 +1245,26 @@ static void power_pmu_disable(struct pmu *pmu) + mtspr(SPRN_MMCRA, + cpuhw->mmcr[2] & ~MMCRA_SAMPLE_ENABLE); + mb(); ++ isync(); + } + + cpuhw->disabled = 1; + cpuhw->n_added = 0; + + ebb_switch_out(mmcr0); ++ ++#ifdef CONFIG_PPC64 ++ /* ++ * These are readable by userspace, may contain kernel ++ * addresses and are not switched by context switch, so clear ++ * them now to avoid leaking anything to userspace in general ++ * including to another process. ++ */ ++ if (ppmu->flags & PPMU_ARCH_207S) { ++ mtspr(SPRN_SDAR, 0); ++ mtspr(SPRN_SIAR, 0); ++ } ++#endif + } + + local_irq_restore(flags); +diff --git a/arch/powerpc/platforms/powernv/npu-dma.c b/arch/powerpc/platforms/powernv/npu-dma.c +index 4043109f4051..63f007f2de7e 100644 +--- a/arch/powerpc/platforms/powernv/npu-dma.c ++++ b/arch/powerpc/platforms/powernv/npu-dma.c +@@ -413,6 +413,11 @@ struct npu_context { + void *priv; + }; + ++struct mmio_atsd_reg { ++ struct npu *npu; ++ int reg; ++}; ++ + /* + * Find a free MMIO ATSD register and mark it in use. Return -ENOSPC + * if none are available. +@@ -422,7 +427,7 @@ static int get_mmio_atsd_reg(struct npu *npu) + int i; + + for (i = 0; i < npu->mmio_atsd_count; i++) { +- if (!test_and_set_bit(i, &npu->mmio_atsd_usage)) ++ if (!test_and_set_bit_lock(i, &npu->mmio_atsd_usage)) + return i; + } + +@@ -431,86 +436,90 @@ static int get_mmio_atsd_reg(struct npu *npu) + + static void put_mmio_atsd_reg(struct npu *npu, int reg) + { +- clear_bit(reg, &npu->mmio_atsd_usage); ++ clear_bit_unlock(reg, &npu->mmio_atsd_usage); + } + + /* MMIO ATSD register offsets */ + #define XTS_ATSD_AVA 1 + #define XTS_ATSD_STAT 2 + +-static int mmio_launch_invalidate(struct npu *npu, unsigned long launch, +- unsigned long va) ++static void mmio_launch_invalidate(struct mmio_atsd_reg *mmio_atsd_reg, ++ unsigned long launch, unsigned long va) + { +- int mmio_atsd_reg; +- +- do { +- mmio_atsd_reg = get_mmio_atsd_reg(npu); +- cpu_relax(); +- } while (mmio_atsd_reg < 0); ++ struct npu *npu = mmio_atsd_reg->npu; ++ int reg = mmio_atsd_reg->reg; + + __raw_writeq(cpu_to_be64(va), +- npu->mmio_atsd_regs[mmio_atsd_reg] + XTS_ATSD_AVA); ++ npu->mmio_atsd_regs[reg] + XTS_ATSD_AVA); + eieio(); +- __raw_writeq(cpu_to_be64(launch), npu->mmio_atsd_regs[mmio_atsd_reg]); +- +- return mmio_atsd_reg; ++ __raw_writeq(cpu_to_be64(launch), npu->mmio_atsd_regs[reg]); + } + +-static int mmio_invalidate_pid(struct npu *npu, unsigned long pid, bool flush) ++static void mmio_invalidate_pid(struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS], ++ unsigned long pid, bool flush) + { ++ int i; + unsigned long launch; + +- /* IS set to invalidate matching PID */ +- launch = PPC_BIT(12); ++ for (i = 0; i <= max_npu2_index; i++) { ++ if (mmio_atsd_reg[i].reg < 0) ++ continue; ++ ++ /* IS set to invalidate matching PID */ ++ launch = PPC_BIT(12); + +- /* PRS set to process-scoped */ +- launch |= PPC_BIT(13); ++ /* PRS set to process-scoped */ ++ launch |= PPC_BIT(13); + +- /* AP */ +- launch |= (u64) mmu_get_ap(mmu_virtual_psize) << PPC_BITLSHIFT(17); ++ /* AP */ ++ launch |= (u64) ++ mmu_get_ap(mmu_virtual_psize) << PPC_BITLSHIFT(17); + +- /* PID */ +- launch |= pid << PPC_BITLSHIFT(38); ++ /* PID */ ++ launch |= pid << PPC_BITLSHIFT(38); + +- /* No flush */ +- launch |= !flush << PPC_BITLSHIFT(39); ++ /* No flush */ ++ launch |= !flush << PPC_BITLSHIFT(39); + +- /* Invalidating the entire process doesn't use a va */ +- return mmio_launch_invalidate(npu, launch, 0); ++ /* Invalidating the entire process doesn't use a va */ ++ mmio_launch_invalidate(&mmio_atsd_reg[i], launch, 0); ++ } + } + +-static int mmio_invalidate_va(struct npu *npu, unsigned long va, +- unsigned long pid, bool flush) ++static void mmio_invalidate_va(struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS], ++ unsigned long va, unsigned long pid, bool flush) + { ++ int i; + unsigned long launch; + +- /* IS set to invalidate target VA */ +- launch = 0; ++ for (i = 0; i <= max_npu2_index; i++) { ++ if (mmio_atsd_reg[i].reg < 0) ++ continue; ++ ++ /* IS set to invalidate target VA */ ++ launch = 0; + +- /* PRS set to process scoped */ +- launch |= PPC_BIT(13); ++ /* PRS set to process scoped */ ++ launch |= PPC_BIT(13); + +- /* AP */ +- launch |= (u64) mmu_get_ap(mmu_virtual_psize) << PPC_BITLSHIFT(17); ++ /* AP */ ++ launch |= (u64) ++ mmu_get_ap(mmu_virtual_psize) << PPC_BITLSHIFT(17); + +- /* PID */ +- launch |= pid << PPC_BITLSHIFT(38); ++ /* PID */ ++ launch |= pid << PPC_BITLSHIFT(38); + +- /* No flush */ +- launch |= !flush << PPC_BITLSHIFT(39); ++ /* No flush */ ++ launch |= !flush << PPC_BITLSHIFT(39); + +- return mmio_launch_invalidate(npu, launch, va); ++ mmio_launch_invalidate(&mmio_atsd_reg[i], launch, va); ++ } + } + + #define mn_to_npu_context(x) container_of(x, struct npu_context, mn) + +-struct mmio_atsd_reg { +- struct npu *npu; +- int reg; +-}; +- + static void mmio_invalidate_wait( +- struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS], bool flush) ++ struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS]) + { + struct npu *npu; + int i, reg; +@@ -525,16 +534,67 @@ static void mmio_invalidate_wait( + reg = mmio_atsd_reg[i].reg; + while (__raw_readq(npu->mmio_atsd_regs[reg] + XTS_ATSD_STAT)) + cpu_relax(); ++ } ++} ++ ++/* ++ * Acquires all the address translation shootdown (ATSD) registers required to ++ * launch an ATSD on all links this npu_context is active on. ++ */ ++static void acquire_atsd_reg(struct npu_context *npu_context, ++ struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS]) ++{ ++ int i, j; ++ struct npu *npu; ++ struct pci_dev *npdev; ++ struct pnv_phb *nphb; + +- put_mmio_atsd_reg(npu, reg); ++ for (i = 0; i <= max_npu2_index; i++) { ++ mmio_atsd_reg[i].reg = -1; ++ for (j = 0; j < NV_MAX_LINKS; j++) { ++ /* ++ * There are no ordering requirements with respect to ++ * the setup of struct npu_context, but to ensure ++ * consistent behaviour we need to ensure npdev[][] is ++ * only read once. ++ */ ++ npdev = READ_ONCE(npu_context->npdev[i][j]); ++ if (!npdev) ++ continue; + ++ nphb = pci_bus_to_host(npdev->bus)->private_data; ++ npu = &nphb->npu; ++ mmio_atsd_reg[i].npu = npu; ++ mmio_atsd_reg[i].reg = get_mmio_atsd_reg(npu); ++ while (mmio_atsd_reg[i].reg < 0) { ++ mmio_atsd_reg[i].reg = get_mmio_atsd_reg(npu); ++ cpu_relax(); ++ } ++ break; ++ } ++ } ++} ++ ++/* ++ * Release previously acquired ATSD registers. To avoid deadlocks the registers ++ * must be released in the same order they were acquired above in ++ * acquire_atsd_reg. ++ */ ++static void release_atsd_reg(struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS]) ++{ ++ int i; ++ ++ for (i = 0; i <= max_npu2_index; i++) { + /* +- * The GPU requires two flush ATSDs to ensure all entries have +- * been flushed. We use PID 0 as it will never be used for a +- * process on the GPU. ++ * We can't rely on npu_context->npdev[][] being the same here ++ * as when acquire_atsd_reg() was called, hence we use the ++ * values stored in mmio_atsd_reg during the acquire phase ++ * rather than re-reading npdev[][]. + */ +- if (flush) +- mmio_invalidate_pid(npu, 0, true); ++ if (mmio_atsd_reg[i].reg < 0) ++ continue; ++ ++ put_mmio_atsd_reg(mmio_atsd_reg[i].npu, mmio_atsd_reg[i].reg); + } + } + +@@ -545,10 +605,6 @@ static void mmio_invalidate_wait( + static void mmio_invalidate(struct npu_context *npu_context, int va, + unsigned long address, bool flush) + { +- int i, j; +- struct npu *npu; +- struct pnv_phb *nphb; +- struct pci_dev *npdev; + struct mmio_atsd_reg mmio_atsd_reg[NV_MAX_NPUS]; + unsigned long pid = npu_context->mm->context.id; + +@@ -562,37 +618,25 @@ static void mmio_invalidate(struct npu_context *npu_context, int va, + * Loop over all the NPUs this process is active on and launch + * an invalidate. + */ +- for (i = 0; i <= max_npu2_index; i++) { +- mmio_atsd_reg[i].reg = -1; +- for (j = 0; j < NV_MAX_LINKS; j++) { +- npdev = npu_context->npdev[i][j]; +- if (!npdev) +- continue; +- +- nphb = pci_bus_to_host(npdev->bus)->private_data; +- npu = &nphb->npu; +- mmio_atsd_reg[i].npu = npu; +- +- if (va) +- mmio_atsd_reg[i].reg = +- mmio_invalidate_va(npu, address, pid, +- flush); +- else +- mmio_atsd_reg[i].reg = +- mmio_invalidate_pid(npu, pid, flush); +- +- /* +- * The NPU hardware forwards the shootdown to all GPUs +- * so we only have to launch one shootdown per NPU. +- */ +- break; +- } ++ acquire_atsd_reg(npu_context, mmio_atsd_reg); ++ if (va) ++ mmio_invalidate_va(mmio_atsd_reg, address, pid, flush); ++ else ++ mmio_invalidate_pid(mmio_atsd_reg, pid, flush); ++ ++ mmio_invalidate_wait(mmio_atsd_reg); ++ if (flush) { ++ /* ++ * The GPU requires two flush ATSDs to ensure all entries have ++ * been flushed. We use PID 0 as it will never be used for a ++ * process on the GPU. ++ */ ++ mmio_invalidate_pid(mmio_atsd_reg, 0, true); ++ mmio_invalidate_wait(mmio_atsd_reg); ++ mmio_invalidate_pid(mmio_atsd_reg, 0, true); ++ mmio_invalidate_wait(mmio_atsd_reg); + } +- +- mmio_invalidate_wait(mmio_atsd_reg, flush); +- if (flush) +- /* Wait for the flush to complete */ +- mmio_invalidate_wait(mmio_atsd_reg, false); ++ release_atsd_reg(mmio_atsd_reg); + } + + static void pnv_npu2_mn_release(struct mmu_notifier *mn, +@@ -735,7 +779,16 @@ struct npu_context *pnv_npu2_init_context(struct pci_dev *gpdev, + if (WARN_ON(of_property_read_u32(nvlink_dn, "ibm,npu-link-index", + &nvlink_index))) + return ERR_PTR(-ENODEV); +- npu_context->npdev[npu->index][nvlink_index] = npdev; ++ ++ /* ++ * npdev is a pci_dev pointer setup by the PCI code. We assign it to ++ * npdev[][] to indicate to the mmu notifiers that an invalidation ++ * should also be sent over this nvlink. The notifiers don't use any ++ * other fields in npu_context, so we just need to ensure that when they ++ * deference npu_context->npdev[][] it is either a valid pointer or ++ * NULL. ++ */ ++ WRITE_ONCE(npu_context->npdev[npu->index][nvlink_index], npdev); + + return npu_context; + } +@@ -774,7 +827,7 @@ void pnv_npu2_destroy_context(struct npu_context *npu_context, + if (WARN_ON(of_property_read_u32(nvlink_dn, "ibm,npu-link-index", + &nvlink_index))) + return; +- npu_context->npdev[npu->index][nvlink_index] = NULL; ++ WRITE_ONCE(npu_context->npdev[npu->index][nvlink_index], NULL); + opal_npu_destroy_context(nphb->opal_id, npu_context->mm->context.id, + PCI_DEVID(gpdev->bus->number, gpdev->devfn)); + kref_put(&npu_context->kref, pnv_npu2_release_context); +diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c +index 7966a314d93a..fd143c934768 100644 +--- a/arch/powerpc/platforms/powernv/setup.c ++++ b/arch/powerpc/platforms/powernv/setup.c +@@ -37,53 +37,92 @@ + #include + #include + #include ++#include + + #include "powernv.h" + ++ ++static bool fw_feature_is(const char *state, const char *name, ++ struct device_node *fw_features) ++{ ++ struct device_node *np; ++ bool rc = false; ++ ++ np = of_get_child_by_name(fw_features, name); ++ if (np) { ++ rc = of_property_read_bool(np, state); ++ of_node_put(np); ++ } ++ ++ return rc; ++} ++ ++static void init_fw_feat_flags(struct device_node *np) ++{ ++ if (fw_feature_is("enabled", "inst-spec-barrier-ori31,31,0", np)) ++ security_ftr_set(SEC_FTR_SPEC_BAR_ORI31); ++ ++ if (fw_feature_is("enabled", "fw-bcctrl-serialized", np)) ++ security_ftr_set(SEC_FTR_BCCTRL_SERIALISED); ++ ++ if (fw_feature_is("enabled", "inst-l1d-flush-ori30,30,0", np)) ++ security_ftr_set(SEC_FTR_L1D_FLUSH_ORI30); ++ ++ if (fw_feature_is("enabled", "inst-l1d-flush-trig2", np)) ++ security_ftr_set(SEC_FTR_L1D_FLUSH_TRIG2); ++ ++ if (fw_feature_is("enabled", "fw-l1d-thread-split", np)) ++ security_ftr_set(SEC_FTR_L1D_THREAD_PRIV); ++ ++ if (fw_feature_is("enabled", "fw-count-cache-disabled", np)) ++ security_ftr_set(SEC_FTR_COUNT_CACHE_DISABLED); ++ ++ /* ++ * The features below are enabled by default, so we instead look to see ++ * if firmware has *disabled* them, and clear them if so. ++ */ ++ if (fw_feature_is("disabled", "speculation-policy-favor-security", np)) ++ security_ftr_clear(SEC_FTR_FAVOUR_SECURITY); ++ ++ if (fw_feature_is("disabled", "needs-l1d-flush-msr-pr-0-to-1", np)) ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_PR); ++ ++ if (fw_feature_is("disabled", "needs-l1d-flush-msr-hv-1-to-0", np)) ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_HV); ++ ++ if (fw_feature_is("disabled", "needs-spec-barrier-for-bound-checks", np)) ++ security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR); ++} ++ + static void pnv_setup_rfi_flush(void) + { + struct device_node *np, *fw_features; + enum l1d_flush_type type; +- int enable; ++ bool enable; + + /* Default to fallback in case fw-features are not available */ + type = L1D_FLUSH_FALLBACK; +- enable = 1; + + np = of_find_node_by_name(NULL, "ibm,opal"); + fw_features = of_get_child_by_name(np, "fw-features"); + of_node_put(np); + + if (fw_features) { +- np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2"); +- if (np && of_property_read_bool(np, "enabled")) +- type = L1D_FLUSH_MTTRIG; ++ init_fw_feat_flags(fw_features); ++ of_node_put(fw_features); + +- of_node_put(np); ++ if (security_ftr_enabled(SEC_FTR_L1D_FLUSH_TRIG2)) ++ type = L1D_FLUSH_MTTRIG; + +- np = of_get_child_by_name(fw_features, "inst-l1d-flush-ori30,30,0"); +- if (np && of_property_read_bool(np, "enabled")) ++ if (security_ftr_enabled(SEC_FTR_L1D_FLUSH_ORI30)) + type = L1D_FLUSH_ORI; +- +- of_node_put(np); +- +- /* Enable unless firmware says NOT to */ +- enable = 2; +- np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-hv-1-to-0"); +- if (np && of_property_read_bool(np, "disabled")) +- enable--; +- +- of_node_put(np); +- +- np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-pr-0-to-1"); +- if (np && of_property_read_bool(np, "disabled")) +- enable--; +- +- of_node_put(np); +- of_node_put(fw_features); + } + +- setup_rfi_flush(type, enable > 0); ++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \ ++ (security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR) || \ ++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_HV)); ++ ++ setup_rfi_flush(type, enable); + } + + static void __init pnv_setup_arch(void) +@@ -91,6 +130,7 @@ static void __init pnv_setup_arch(void) + set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT); + + pnv_setup_rfi_flush(); ++ setup_stf_barrier(); + + /* Initialize SMP */ + pnv_smp_init(); +diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c +index f7042ad492ba..fbea7db043fa 100644 +--- a/arch/powerpc/platforms/pseries/mobility.c ++++ b/arch/powerpc/platforms/pseries/mobility.c +@@ -348,6 +348,9 @@ void post_mobility_fixup(void) + printk(KERN_ERR "Post-mobility device tree update " + "failed: %d\n", rc); + ++ /* Possibly switch to a new RFI flush type */ ++ pseries_setup_rfi_flush(); ++ + return; + } + +diff --git a/arch/powerpc/platforms/pseries/pseries.h b/arch/powerpc/platforms/pseries/pseries.h +index 1ae1d9f4dbe9..27cdcb69fd18 100644 +--- a/arch/powerpc/platforms/pseries/pseries.h ++++ b/arch/powerpc/platforms/pseries/pseries.h +@@ -100,4 +100,6 @@ static inline unsigned long cmo_get_page_size(void) + + int dlpar_workqueue_init(void); + ++void pseries_setup_rfi_flush(void); ++ + #endif /* _PSERIES_PSERIES_H */ +diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c +index ae4f596273b5..45f814041448 100644 +--- a/arch/powerpc/platforms/pseries/setup.c ++++ b/arch/powerpc/platforms/pseries/setup.c +@@ -68,6 +68,7 @@ + #include + #include + #include ++#include + + #include "pseries.h" + +@@ -459,35 +460,78 @@ static void __init find_and_init_phbs(void) + of_pci_check_probe_only(); + } + +-static void pseries_setup_rfi_flush(void) ++static void init_cpu_char_feature_flags(struct h_cpu_char_result *result) ++{ ++ /* ++ * The features below are disabled by default, so we instead look to see ++ * if firmware has *enabled* them, and set them if so. ++ */ ++ if (result->character & H_CPU_CHAR_SPEC_BAR_ORI31) ++ security_ftr_set(SEC_FTR_SPEC_BAR_ORI31); ++ ++ if (result->character & H_CPU_CHAR_BCCTRL_SERIALISED) ++ security_ftr_set(SEC_FTR_BCCTRL_SERIALISED); ++ ++ if (result->character & H_CPU_CHAR_L1D_FLUSH_ORI30) ++ security_ftr_set(SEC_FTR_L1D_FLUSH_ORI30); ++ ++ if (result->character & H_CPU_CHAR_L1D_FLUSH_TRIG2) ++ security_ftr_set(SEC_FTR_L1D_FLUSH_TRIG2); ++ ++ if (result->character & H_CPU_CHAR_L1D_THREAD_PRIV) ++ security_ftr_set(SEC_FTR_L1D_THREAD_PRIV); ++ ++ if (result->character & H_CPU_CHAR_COUNT_CACHE_DISABLED) ++ security_ftr_set(SEC_FTR_COUNT_CACHE_DISABLED); ++ ++ /* ++ * The features below are enabled by default, so we instead look to see ++ * if firmware has *disabled* them, and clear them if so. ++ */ ++ if (!(result->behaviour & H_CPU_BEHAV_FAVOUR_SECURITY)) ++ security_ftr_clear(SEC_FTR_FAVOUR_SECURITY); ++ ++ if (!(result->behaviour & H_CPU_BEHAV_L1D_FLUSH_PR)) ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_PR); ++ ++ if (!(result->behaviour & H_CPU_BEHAV_BNDS_CHK_SPEC_BAR)) ++ security_ftr_clear(SEC_FTR_BNDS_CHK_SPEC_BAR); ++} ++ ++void pseries_setup_rfi_flush(void) + { + struct h_cpu_char_result result; + enum l1d_flush_type types; + bool enable; + long rc; + +- /* Enable by default */ +- enable = true; ++ /* ++ * Set features to the defaults assumed by init_cpu_char_feature_flags() ++ * so it can set/clear again any features that might have changed after ++ * migration, and in case the hypercall fails and it is not even called. ++ */ ++ powerpc_security_features = SEC_FTR_DEFAULT; + + rc = plpar_get_cpu_characteristics(&result); +- if (rc == H_SUCCESS) { +- types = L1D_FLUSH_NONE; ++ if (rc == H_SUCCESS) ++ init_cpu_char_feature_flags(&result); + +- if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2) +- types |= L1D_FLUSH_MTTRIG; +- if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30) +- types |= L1D_FLUSH_ORI; ++ /* ++ * We're the guest so this doesn't apply to us, clear it to simplify ++ * handling of it elsewhere. ++ */ ++ security_ftr_clear(SEC_FTR_L1D_FLUSH_HV); + +- /* Use fallback if nothing set in hcall */ +- if (types == L1D_FLUSH_NONE) +- types = L1D_FLUSH_FALLBACK; ++ types = L1D_FLUSH_FALLBACK; + +- if (!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR)) +- enable = false; +- } else { +- /* Default to fallback if case hcall is not available */ +- types = L1D_FLUSH_FALLBACK; +- } ++ if (security_ftr_enabled(SEC_FTR_L1D_FLUSH_TRIG2)) ++ types |= L1D_FLUSH_MTTRIG; ++ ++ if (security_ftr_enabled(SEC_FTR_L1D_FLUSH_ORI30)) ++ types |= L1D_FLUSH_ORI; ++ ++ enable = security_ftr_enabled(SEC_FTR_FAVOUR_SECURITY) && \ ++ security_ftr_enabled(SEC_FTR_L1D_FLUSH_PR); + + setup_rfi_flush(types, enable); + } +@@ -510,6 +554,7 @@ static void __init pSeries_setup_arch(void) + fwnmi_init(); + + pseries_setup_rfi_flush(); ++ setup_stf_barrier(); + + /* By default, only probe PCI (can be overridden by rtas_pci) */ + pci_add_flags(PCI_PROBE_ONLY); +diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c +index ead3e2549ebf..205dec18d6b5 100644 +--- a/arch/powerpc/sysdev/mpic.c ++++ b/arch/powerpc/sysdev/mpic.c +@@ -626,7 +626,7 @@ static inline u32 mpic_physmask(u32 cpumask) + int i; + u32 mask = 0; + +- for (i = 0; i < min(32, NR_CPUS); ++i, cpumask >>= 1) ++ for (i = 0; i < min(32, NR_CPUS) && cpu_possible(i); ++i, cpumask >>= 1) + mask |= (cpumask & 1) << get_hard_smp_processor_id(i); + return mask; + } +diff --git a/arch/powerpc/xmon/xmon.c b/arch/powerpc/xmon/xmon.c +index 2c8b325591cc..a5938fadd031 100644 +--- a/arch/powerpc/xmon/xmon.c ++++ b/arch/powerpc/xmon/xmon.c +@@ -2348,6 +2348,8 @@ static void dump_one_paca(int cpu) + DUMP(p, slb_cache_ptr, "x"); + for (i = 0; i < SLB_CACHE_ENTRIES; i++) + printf(" slb_cache[%d]: = 0x%016lx\n", i, p->slb_cache[i]); ++ ++ DUMP(p, rfi_flush_fallback_area, "px"); + #endif + DUMP(p, dscr_default, "llx"); + #ifdef CONFIG_PPC_BOOK3E +diff --git a/arch/s390/kvm/vsie.c b/arch/s390/kvm/vsie.c +index eb7b530d1783..4f1f5fc8139d 100644 +--- a/arch/s390/kvm/vsie.c ++++ b/arch/s390/kvm/vsie.c +@@ -590,7 +590,7 @@ static int pin_blocks(struct kvm_vcpu *vcpu, struct vsie_page *vsie_page) + + gpa = READ_ONCE(scb_o->itdba) & ~0xffUL; + if (gpa && (scb_s->ecb & ECB_TE)) { +- if (!(gpa & ~0x1fffU)) { ++ if (!(gpa & ~0x1fffUL)) { + rc = set_validity_icpt(scb_s, 0x0080U); + goto unpin; + } +diff --git a/arch/sh/kernel/entry-common.S b/arch/sh/kernel/entry-common.S +index c001f782c5f1..28cc61216b64 100644 +--- a/arch/sh/kernel/entry-common.S ++++ b/arch/sh/kernel/entry-common.S +@@ -255,7 +255,7 @@ debug_trap: + mov.l @r8, r8 + jsr @r8 + nop +- bra __restore_all ++ bra ret_from_exception + nop + CFI_ENDPROC + +diff --git a/arch/sparc/include/asm/atomic_64.h b/arch/sparc/include/asm/atomic_64.h +index abad97edf736..28db058d471b 100644 +--- a/arch/sparc/include/asm/atomic_64.h ++++ b/arch/sparc/include/asm/atomic_64.h +@@ -83,7 +83,11 @@ ATOMIC_OPS(xor) + #define atomic64_add_negative(i, v) (atomic64_add_return(i, v) < 0) + + #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n))) +-#define atomic_xchg(v, new) (xchg(&((v)->counter), new)) ++ ++static inline int atomic_xchg(atomic_t *v, int new) ++{ ++ return xchg(&v->counter, new); ++} + + static inline int __atomic_add_unless(atomic_t *v, int a, int u) + { +diff --git a/arch/sparc/include/asm/bug.h b/arch/sparc/include/asm/bug.h +index 6f17528356b2..ea53e418f6c0 100644 +--- a/arch/sparc/include/asm/bug.h ++++ b/arch/sparc/include/asm/bug.h +@@ -9,10 +9,14 @@ + void do_BUG(const char *file, int line); + #define BUG() do { \ + do_BUG(__FILE__, __LINE__); \ ++ barrier_before_unreachable(); \ + __builtin_trap(); \ + } while (0) + #else +-#define BUG() __builtin_trap() ++#define BUG() do { \ ++ barrier_before_unreachable(); \ ++ __builtin_trap(); \ ++} while (0) + #endif + + #define HAVE_ARCH_BUG +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 011a47b4587c..717c9219d00e 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -1162,16 +1162,13 @@ int x86_perf_event_set_period(struct perf_event *event) + + per_cpu(pmc_prev_left[idx], smp_processor_id()) = left; + +- if (!(hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) || +- local64_read(&hwc->prev_count) != (u64)-left) { +- /* +- * The hw event starts counting from this event offset, +- * mark it to be able to extra future deltas: +- */ +- local64_set(&hwc->prev_count, (u64)-left); ++ /* ++ * The hw event starts counting from this event offset, ++ * mark it to be able to extra future deltas: ++ */ ++ local64_set(&hwc->prev_count, (u64)-left); + +- wrmsrl(hwc->event_base, (u64)(-left) & x86_pmu.cntval_mask); +- } ++ wrmsrl(hwc->event_base, (u64)(-left) & x86_pmu.cntval_mask); + + /* + * Due to erratum on certan cpu we need +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 9b18a227fff7..6965ee8c4b8a 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -2201,9 +2201,15 @@ static int intel_pmu_handle_irq(struct pt_regs *regs) + int bit, loops; + u64 status; + int handled; ++ int pmu_enabled; + + cpuc = this_cpu_ptr(&cpu_hw_events); + ++ /* ++ * Save the PMU state. ++ * It needs to be restored when leaving the handler. ++ */ ++ pmu_enabled = cpuc->enabled; + /* + * No known reason to not always do late ACK, + * but just in case do it opt-in. +@@ -2211,6 +2217,7 @@ static int intel_pmu_handle_irq(struct pt_regs *regs) + if (!x86_pmu.late_ack) + apic_write(APIC_LVTPC, APIC_DM_NMI); + intel_bts_disable_local(); ++ cpuc->enabled = 0; + __intel_pmu_disable_all(); + handled = intel_pmu_drain_bts_buffer(); + handled += intel_bts_interrupt(); +@@ -2320,7 +2327,8 @@ static int intel_pmu_handle_irq(struct pt_regs *regs) + + done: + /* Only restore PMU state when it's active. See x86_pmu_disable(). */ +- if (cpuc->enabled) ++ cpuc->enabled = pmu_enabled; ++ if (pmu_enabled) + __intel_pmu_enable_all(0, true); + intel_bts_enable_local(); + +@@ -3188,7 +3196,7 @@ glp_get_event_constraints(struct cpu_hw_events *cpuc, int idx, + * Therefore the effective (average) period matches the requested period, + * despite coarser hardware granularity. + */ +-static unsigned bdw_limit_period(struct perf_event *event, unsigned left) ++static u64 bdw_limit_period(struct perf_event *event, u64 left) + { + if ((event->hw.config & INTEL_ARCH_EVENT_MASK) == + X86_CONFIG(.event=0xc0, .umask=0x01)) { +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 8156e47da7ba..10b39d44981c 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -1150,6 +1150,7 @@ static void setup_pebs_sample_data(struct perf_event *event, + if (pebs == NULL) + return; + ++ regs->flags &= ~PERF_EFLAGS_EXACT; + sample_type = event->attr.sample_type; + dsrc = sample_type & PERF_SAMPLE_DATA_SRC; + +@@ -1194,7 +1195,6 @@ static void setup_pebs_sample_data(struct perf_event *event, + */ + *regs = *iregs; + regs->flags = pebs->flags; +- set_linear_ip(regs, pebs->ip); + + if (sample_type & PERF_SAMPLE_REGS_INTR) { + regs->ax = pebs->ax; +@@ -1230,13 +1230,22 @@ static void setup_pebs_sample_data(struct perf_event *event, + #endif + } + +- if (event->attr.precise_ip > 1 && x86_pmu.intel_cap.pebs_format >= 2) { +- regs->ip = pebs->real_ip; +- regs->flags |= PERF_EFLAGS_EXACT; +- } else if (event->attr.precise_ip > 1 && intel_pmu_pebs_fixup_ip(regs)) +- regs->flags |= PERF_EFLAGS_EXACT; +- else +- regs->flags &= ~PERF_EFLAGS_EXACT; ++ if (event->attr.precise_ip > 1) { ++ /* Haswell and later have the eventing IP, so use it: */ ++ if (x86_pmu.intel_cap.pebs_format >= 2) { ++ set_linear_ip(regs, pebs->real_ip); ++ regs->flags |= PERF_EFLAGS_EXACT; ++ } else { ++ /* Otherwise use PEBS off-by-1 IP: */ ++ set_linear_ip(regs, pebs->ip); ++ ++ /* ... and try to fix it up using the LBR entries: */ ++ if (intel_pmu_pebs_fixup_ip(regs)) ++ regs->flags |= PERF_EFLAGS_EXACT; ++ } ++ } else ++ set_linear_ip(regs, pebs->ip); ++ + + if ((sample_type & (PERF_SAMPLE_ADDR | PERF_SAMPLE_PHYS_ADDR)) && + x86_pmu.intel_cap.pebs_format >= 1) +@@ -1303,17 +1312,84 @@ get_next_pebs_record_by_bit(void *base, void *top, int bit) + return NULL; + } + ++/* ++ * Special variant of intel_pmu_save_and_restart() for auto-reload. ++ */ ++static int ++intel_pmu_save_and_restart_reload(struct perf_event *event, int count) ++{ ++ struct hw_perf_event *hwc = &event->hw; ++ int shift = 64 - x86_pmu.cntval_bits; ++ u64 period = hwc->sample_period; ++ u64 prev_raw_count, new_raw_count; ++ s64 new, old; ++ ++ WARN_ON(!period); ++ ++ /* ++ * drain_pebs() only happens when the PMU is disabled. ++ */ ++ WARN_ON(this_cpu_read(cpu_hw_events.enabled)); ++ ++ prev_raw_count = local64_read(&hwc->prev_count); ++ rdpmcl(hwc->event_base_rdpmc, new_raw_count); ++ local64_set(&hwc->prev_count, new_raw_count); ++ ++ /* ++ * Since the counter increments a negative counter value and ++ * overflows on the sign switch, giving the interval: ++ * ++ * [-period, 0] ++ * ++ * the difference between two consequtive reads is: ++ * ++ * A) value2 - value1; ++ * when no overflows have happened in between, ++ * ++ * B) (0 - value1) + (value2 - (-period)); ++ * when one overflow happened in between, ++ * ++ * C) (0 - value1) + (n - 1) * (period) + (value2 - (-period)); ++ * when @n overflows happened in between. ++ * ++ * Here A) is the obvious difference, B) is the extension to the ++ * discrete interval, where the first term is to the top of the ++ * interval and the second term is from the bottom of the next ++ * interval and C) the extension to multiple intervals, where the ++ * middle term is the whole intervals covered. ++ * ++ * An equivalent of C, by reduction, is: ++ * ++ * value2 - value1 + n * period ++ */ ++ new = ((s64)(new_raw_count << shift) >> shift); ++ old = ((s64)(prev_raw_count << shift) >> shift); ++ local64_add(new - old + count * period, &event->count); ++ ++ perf_event_update_userpage(event); ++ ++ return 0; ++} ++ + static void __intel_pmu_pebs_event(struct perf_event *event, + struct pt_regs *iregs, + void *base, void *top, + int bit, int count) + { ++ struct hw_perf_event *hwc = &event->hw; + struct perf_sample_data data; + struct pt_regs regs; + void *at = get_next_pebs_record_by_bit(base, top, bit); + +- if (!intel_pmu_save_and_restart(event) && +- !(event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD)) ++ if (hwc->flags & PERF_X86_EVENT_AUTO_RELOAD) { ++ /* ++ * Now, auto-reload is only enabled in fixed period mode. ++ * The reload value is always hwc->sample_period. ++ * May need to change it, if auto-reload is enabled in ++ * freq mode later. ++ */ ++ intel_pmu_save_and_restart_reload(event, count); ++ } else if (!intel_pmu_save_and_restart(event)) + return; + + while (count > 1) { +@@ -1365,8 +1441,11 @@ static void intel_pmu_drain_pebs_core(struct pt_regs *iregs) + return; + + n = top - at; +- if (n <= 0) ++ if (n <= 0) { ++ if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD) ++ intel_pmu_save_and_restart_reload(event, 0); + return; ++ } + + __intel_pmu_pebs_event(event, iregs, at, top, 0, n); + } +@@ -1389,8 +1468,22 @@ static void intel_pmu_drain_pebs_nhm(struct pt_regs *iregs) + + ds->pebs_index = ds->pebs_buffer_base; + +- if (unlikely(base >= top)) ++ if (unlikely(base >= top)) { ++ /* ++ * The drain_pebs() could be called twice in a short period ++ * for auto-reload event in pmu::read(). There are no ++ * overflows have happened in between. ++ * It needs to call intel_pmu_save_and_restart_reload() to ++ * update the event->count for this case. ++ */ ++ for_each_set_bit(bit, (unsigned long *)&cpuc->pebs_enabled, ++ x86_pmu.max_pebs_events) { ++ event = cpuc->events[bit]; ++ if (event->hw.flags & PERF_X86_EVENT_AUTO_RELOAD) ++ intel_pmu_save_and_restart_reload(event, 0); ++ } + return; ++ } + + for (at = base; at < top; at += x86_pmu.pebs_record_size) { + struct pebs_record_nhm *p = at; +diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h +index 8e4ea143ed96..dc4728eccfd8 100644 +--- a/arch/x86/events/perf_event.h ++++ b/arch/x86/events/perf_event.h +@@ -556,7 +556,7 @@ struct x86_pmu { + struct x86_pmu_quirk *quirks; + int perfctr_second_write; + bool late_ack; +- unsigned (*limit_period)(struct perf_event *event, unsigned l); ++ u64 (*limit_period)(struct perf_event *event, u64 l); + + /* + * sysfs attrs +diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h +index cf5961ca8677..4cd6a3b71824 100644 +--- a/arch/x86/include/asm/alternative.h ++++ b/arch/x86/include/asm/alternative.h +@@ -218,13 +218,11 @@ static inline int alternatives_text_reserved(void *start, void *end) + */ + #define alternative_call_2(oldfunc, newfunc1, feature1, newfunc2, feature2, \ + output, input...) \ +-{ \ + asm volatile (ALTERNATIVE_2("call %P[old]", "call %P[new1]", feature1,\ + "call %P[new2]", feature2) \ + : output, ASM_CALL_CONSTRAINT \ + : [old] "i" (oldfunc), [new1] "i" (newfunc1), \ +- [new2] "i" (newfunc2), ## input); \ +-} ++ [new2] "i" (newfunc2), ## input) + + /* + * use this macro(s) if you need more than one output parameter +diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h +index 704f31315dde..875ca99b82ee 100644 +--- a/arch/x86/include/asm/tlbflush.h ++++ b/arch/x86/include/asm/tlbflush.h +@@ -131,7 +131,12 @@ static inline unsigned long build_cr3(pgd_t *pgd, u16 asid) + static inline unsigned long build_cr3_noflush(pgd_t *pgd, u16 asid) + { + VM_WARN_ON_ONCE(asid > MAX_ASID_AVAILABLE); +- VM_WARN_ON_ONCE(!this_cpu_has(X86_FEATURE_PCID)); ++ /* ++ * Use boot_cpu_has() instead of this_cpu_has() as this function ++ * might be called during early boot. This should work even after ++ * boot because all CPU's the have same capabilities: ++ */ ++ VM_WARN_ON_ONCE(!boot_cpu_has(X86_FEATURE_PCID)); + return __sme_pa(pgd) | kern_pcid(asid) | CR3_NOFLUSH; + } + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index 5942aa5f569b..ebdcc368a2d3 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -1481,7 +1481,7 @@ void setup_local_APIC(void) + * TODO: set up through-local-APIC from through-I/O-APIC? --macro + */ + value = apic_read(APIC_LVT0) & APIC_LVT_MASKED; +- if (!cpu && (pic_mode || !value)) { ++ if (!cpu && (pic_mode || !value || skip_ioapic_setup)) { + value = APIC_DM_EXTINT; + apic_printk(APIC_VERBOSE, "enabled ExtINT on CPU#%d\n", cpu); + } else { +diff --git a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +index 7be35b600299..2dae1b3c42fc 100644 +--- a/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c ++++ b/arch/x86/kernel/cpu/intel_rdt_rdtgroup.c +@@ -1657,6 +1657,7 @@ static int rdtgroup_mkdir_ctrl_mon(struct kernfs_node *parent_kn, + if (ret < 0) + goto out_common_fail; + closid = ret; ++ ret = 0; + + rdtgrp->closid = closid; + list_add(&rdtgrp->rdtgroup_list, &rdt_all_groups); +diff --git a/arch/x86/kernel/devicetree.c b/arch/x86/kernel/devicetree.c +index 76e07698e6d1..7fa0855e4b9a 100644 +--- a/arch/x86/kernel/devicetree.c ++++ b/arch/x86/kernel/devicetree.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -200,19 +201,22 @@ static struct of_ioapic_type of_ioapic_type[] = + static int dt_irqdomain_alloc(struct irq_domain *domain, unsigned int virq, + unsigned int nr_irqs, void *arg) + { +- struct of_phandle_args *irq_data = (void *)arg; ++ struct irq_fwspec *fwspec = (struct irq_fwspec *)arg; + struct of_ioapic_type *it; + struct irq_alloc_info tmp; ++ int type_index; + +- if (WARN_ON(irq_data->args_count < 2)) ++ if (WARN_ON(fwspec->param_count < 2)) + return -EINVAL; +- if (irq_data->args[1] >= ARRAY_SIZE(of_ioapic_type)) ++ ++ type_index = fwspec->param[1]; ++ if (type_index >= ARRAY_SIZE(of_ioapic_type)) + return -EINVAL; + +- it = &of_ioapic_type[irq_data->args[1]]; ++ it = &of_ioapic_type[type_index]; + ioapic_set_alloc_attr(&tmp, NUMA_NO_NODE, it->trigger, it->polarity); + tmp.ioapic_id = mpc_ioapic_id(mp_irqdomain_ioapic_idx(domain)); +- tmp.ioapic_pin = irq_data->args[0]; ++ tmp.ioapic_pin = fwspec->param[0]; + + return mp_irqdomain_alloc(domain, virq, nr_irqs, &tmp); + } +@@ -276,14 +280,15 @@ static void __init x86_flattree_get_config(void) + + map_len = max(PAGE_SIZE - (initial_dtb & ~PAGE_MASK), (u64)128); + +- initial_boot_params = dt = early_memremap(initial_dtb, map_len); +- size = of_get_flat_dt_size(); ++ dt = early_memremap(initial_dtb, map_len); ++ size = fdt_totalsize(dt); + if (map_len < size) { + early_memunmap(dt, map_len); +- initial_boot_params = dt = early_memremap(initial_dtb, size); ++ dt = early_memremap(initial_dtb, size); + map_len = size; + } + ++ early_init_dt_verify(dt); + unflatten_and_copy_device_tree(); + early_memunmap(dt, map_len); + } +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 4a96aa004390..344d3c160f8d 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -1521,6 +1521,7 @@ static void remove_siblinginfo(int cpu) + cpumask_clear(topology_core_cpumask(cpu)); + c->phys_proc_id = 0; + c->cpu_core_id = 0; ++ c->booted_cores = 0; + cpumask_clear_cpu(cpu, cpu_sibling_setup_mask); + recompute_smt_state(); + } +diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c +index d67e3b31f3db..d1f5c744142b 100644 +--- a/arch/x86/kvm/cpuid.c ++++ b/arch/x86/kvm/cpuid.c +@@ -394,8 +394,8 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + + /* cpuid 7.0.edx*/ + const u32 kvm_cpuid_7_0_edx_x86_features = +- F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) | F(SSBD) | +- F(ARCH_CAPABILITIES); ++ F(AVX512_4VNNIW) | F(AVX512_4FMAPS) | F(SPEC_CTRL) | ++ F(SPEC_CTRL_SSBD) | F(ARCH_CAPABILITIES); + + /* all calls to cpuid_count() should be made on the same cpu */ + get_cpu(); +@@ -481,6 +481,11 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, + entry->ecx &= ~F(PKU); + entry->edx &= kvm_cpuid_7_0_edx_x86_features; + cpuid_mask(&entry->edx, CPUID_7_EDX); ++ /* ++ * We emulate ARCH_CAPABILITIES in software even ++ * if the host doesn't support it. ++ */ ++ entry->edx |= F(ARCH_CAPABILITIES); + } else { + entry->ebx = 0; + entry->ecx = 0; +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index ab8993fe58cc..6d0fbff71d7a 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -321,8 +321,16 @@ void kvm_apic_set_version(struct kvm_vcpu *vcpu) + if (!lapic_in_kernel(vcpu)) + return; + ++ /* ++ * KVM emulates 82093AA datasheet (with in-kernel IOAPIC implementation) ++ * which doesn't have EOI register; Some buggy OSes (e.g. Windows with ++ * Hyper-V role) disable EOI broadcast in lapic not checking for IOAPIC ++ * version first and level-triggered interrupts never get EOIed in ++ * IOAPIC. ++ */ + feat = kvm_find_cpuid_entry(apic->vcpu, 0x1, 0); +- if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31)))) ++ if (feat && (feat->ecx & (1 << (X86_FEATURE_X2APIC & 31))) && ++ !ioapic_in_kernel(vcpu->kvm)) + v |= APIC_LVR_DIRECTED_EOI; + kvm_lapic_set_reg(apic, APIC_LVR, v); + } +@@ -1467,11 +1475,23 @@ static bool set_target_expiration(struct kvm_lapic *apic) + + static void advance_periodic_target_expiration(struct kvm_lapic *apic) + { +- apic->lapic_timer.tscdeadline += +- nsec_to_cycles(apic->vcpu, apic->lapic_timer.period); ++ ktime_t now = ktime_get(); ++ u64 tscl = rdtsc(); ++ ktime_t delta; ++ ++ /* ++ * Synchronize both deadlines to the same time source or ++ * differences in the periods (caused by differences in the ++ * underlying clocks or numerical approximation errors) will ++ * cause the two to drift apart over time as the errors ++ * accumulate. ++ */ + apic->lapic_timer.target_expiration = + ktime_add_ns(apic->lapic_timer.target_expiration, + apic->lapic_timer.period); ++ delta = ktime_sub(apic->lapic_timer.target_expiration, now); ++ apic->lapic_timer.tscdeadline = kvm_read_l1_tsc(apic->vcpu, tscl) + ++ nsec_to_cycles(apic->vcpu, delta); + } + + static void start_sw_period(struct kvm_lapic *apic) +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 2e63edf8312c..4c88572d2b81 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2583,6 +2583,8 @@ static void vmx_queue_exception(struct kvm_vcpu *vcpu) + return; + } + ++ WARN_ON_ONCE(vmx->emulation_required); ++ + if (kvm_exception_is_soft(nr)) { + vmcs_write32(VM_ENTRY_INSTRUCTION_LEN, + vmx->vcpu.arch.event_exit_inst_len); +@@ -6829,12 +6831,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu) + goto out; + } + +- if (err != EMULATE_DONE) { +- vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; +- vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; +- vcpu->run->internal.ndata = 0; +- return 0; +- } ++ if (err != EMULATE_DONE) ++ goto emulation_error; ++ ++ if (vmx->emulation_required && !vmx->rmode.vm86_active && ++ vcpu->arch.exception.pending) ++ goto emulation_error; + + if (vcpu->arch.halt_request) { + vcpu->arch.halt_request = 0; +@@ -6850,6 +6852,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu) + + out: + return ret; ++ ++emulation_error: ++ vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; ++ vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; ++ vcpu->run->internal.ndata = 0; ++ return 0; + } + + static int __grow_ple_window(int val) +@@ -11174,7 +11182,12 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch) + if (ret) + return ret; + +- if (vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) ++ /* ++ * If we're entering a halted L2 vcpu and the L2 vcpu won't be woken ++ * by event injection, halt vcpu. ++ */ ++ if ((vmcs12->guest_activity_state == GUEST_ACTIVITY_HLT) && ++ !(vmcs12->vm_entry_intr_info_field & INTR_INFO_VALID_MASK)) + return kvm_vcpu_halt(vcpu); + + vmx->nested.nested_run_pending = 1; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 649f476039de..adac01d0181a 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -7505,6 +7505,7 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, + { + struct msr_data apic_base_msr; + int mmu_reset_needed = 0; ++ int cpuid_update_needed = 0; + int pending_vec, max_bits, idx; + struct desc_ptr dt; + +@@ -7542,8 +7543,10 @@ int kvm_arch_vcpu_ioctl_set_sregs(struct kvm_vcpu *vcpu, + vcpu->arch.cr0 = sregs->cr0; + + mmu_reset_needed |= kvm_read_cr4(vcpu) != sregs->cr4; ++ cpuid_update_needed |= ((kvm_read_cr4(vcpu) ^ sregs->cr4) & ++ (X86_CR4_OSXSAVE | X86_CR4_PKE)); + kvm_x86_ops->set_cr4(vcpu, sregs->cr4); +- if (sregs->cr4 & (X86_CR4_OSXSAVE | X86_CR4_PKE)) ++ if (cpuid_update_needed) + kvm_update_cpuid(vcpu); + + idx = srcu_read_lock(&vcpu->kvm->srcu); +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c +index 3ed9a08885c5..4085897fef64 100644 +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -298,9 +298,11 @@ static inline pgprot_t static_protections(pgprot_t prot, unsigned long address, + + /* + * The .rodata section needs to be read-only. Using the pfn +- * catches all aliases. ++ * catches all aliases. This also includes __ro_after_init, ++ * so do not enforce until kernel_set_to_readonly is true. + */ +- if (within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT, ++ if (kernel_set_to_readonly && ++ within(pfn, __pa_symbol(__start_rodata) >> PAGE_SHIFT, + __pa_symbol(__end_rodata) >> PAGE_SHIFT)) + pgprot_val(forbidden) |= _PAGE_RW; + +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index 34cda7e0551b..c03c85e4fb6a 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -1,6 +1,7 @@ + // SPDX-License-Identifier: GPL-2.0 + #include + #include ++#include + #include + #include + #include +@@ -636,6 +637,10 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot) + (mtrr != MTRR_TYPE_WRBACK)) + return 0; + ++ /* Bail out if we are we on a populated non-leaf entry: */ ++ if (pud_present(*pud) && !pud_huge(*pud)) ++ return 0; ++ + prot = pgprot_4k_2_large(prot); + + set_pte((pte_t *)pud, pfn_pte( +@@ -664,6 +669,10 @@ int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot) + return 0; + } + ++ /* Bail out if we are we on a populated non-leaf entry: */ ++ if (pmd_present(*pmd) && !pmd_huge(*pmd)) ++ return 0; ++ + prot = pgprot_4k_2_large(prot); + + set_pte((pte_t *)pmd, pfn_pte( +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 91622db9aedf..08dabcd8b6ae 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -51,6 +51,12 @@ const char *bdevname(struct block_device *bdev, char *buf) + + EXPORT_SYMBOL(bdevname); + ++const char *bio_devname(struct bio *bio, char *buf) ++{ ++ return disk_name(bio->bi_disk, bio->bi_partno, buf); ++} ++EXPORT_SYMBOL(bio_devname); ++ + /* + * There's very little reason to use this, you should really + * have a struct block_device just about everywhere and use +diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c +index f6a009d88a33..52e5ea3b8e40 100644 +--- a/crypto/asymmetric_keys/pkcs7_trust.c ++++ b/crypto/asymmetric_keys/pkcs7_trust.c +@@ -106,6 +106,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7, + pr_devel("sinfo %u: Direct signer is key %x\n", + sinfo->index, key_serial(key)); + x509 = NULL; ++ sig = sinfo->sig; + goto matched; + } + if (PTR_ERR(key) != -ENOKEY) +diff --git a/drivers/acpi/acpi_pad.c b/drivers/acpi/acpi_pad.c +index 754431031282..552c1f725b6c 100644 +--- a/drivers/acpi/acpi_pad.c ++++ b/drivers/acpi/acpi_pad.c +@@ -110,6 +110,7 @@ static void round_robin_cpu(unsigned int tsk_index) + cpumask_andnot(tmp, cpu_online_mask, pad_busy_cpus); + if (cpumask_empty(tmp)) { + mutex_unlock(&round_robin_lock); ++ free_cpumask_var(tmp); + return; + } + for_each_cpu(cpu, tmp) { +@@ -127,6 +128,8 @@ static void round_robin_cpu(unsigned int tsk_index) + mutex_unlock(&round_robin_lock); + + set_cpus_allowed_ptr(current, cpumask_of(preferred_cpu)); ++ ++ free_cpumask_var(tmp); + } + + static void exit_round_robin(unsigned int tsk_index) +diff --git a/drivers/acpi/acpica/evevent.c b/drivers/acpi/acpica/evevent.c +index d3b6b314fa50..37b0b4c04220 100644 +--- a/drivers/acpi/acpica/evevent.c ++++ b/drivers/acpi/acpica/evevent.c +@@ -204,6 +204,7 @@ u32 acpi_ev_fixed_event_detect(void) + u32 fixed_status; + u32 fixed_enable; + u32 i; ++ acpi_status status; + + ACPI_FUNCTION_NAME(ev_fixed_event_detect); + +@@ -211,8 +212,12 @@ u32 acpi_ev_fixed_event_detect(void) + * Read the fixed feature status and enable registers, as all the cases + * depend on their values. Ignore errors here. + */ +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status); +- (void)acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable); ++ status = acpi_hw_register_read(ACPI_REGISTER_PM1_STATUS, &fixed_status); ++ status |= ++ acpi_hw_register_read(ACPI_REGISTER_PM1_ENABLE, &fixed_enable); ++ if (ACPI_FAILURE(status)) { ++ return (int_status); ++ } + + ACPI_DEBUG_PRINT((ACPI_DB_INTERRUPTS, + "Fixed Event Block: Enable %08X Status %08X\n", +diff --git a/drivers/acpi/acpica/nseval.c b/drivers/acpi/acpica/nseval.c +index d22167cbd0ca..f13d3cfa74e1 100644 +--- a/drivers/acpi/acpica/nseval.c ++++ b/drivers/acpi/acpica/nseval.c +@@ -308,6 +308,14 @@ acpi_status acpi_ns_evaluate(struct acpi_evaluate_info *info) + /* Map AE_CTRL_RETURN_VALUE to AE_OK, we are done with it */ + + status = AE_OK; ++ } else if (ACPI_FAILURE(status)) { ++ ++ /* If return_object exists, delete it */ ++ ++ if (info->return_object) { ++ acpi_ut_remove_reference(info->return_object); ++ info->return_object = NULL; ++ } + } + + ACPI_DEBUG_PRINT((ACPI_DB_NAMES, +diff --git a/drivers/acpi/acpica/psargs.c b/drivers/acpi/acpica/psargs.c +index eb9dfaca555f..11ce4e5d10e2 100644 +--- a/drivers/acpi/acpica/psargs.c ++++ b/drivers/acpi/acpica/psargs.c +@@ -890,6 +890,10 @@ acpi_ps_get_next_arg(struct acpi_walk_state *walk_state, + ACPI_POSSIBLE_METHOD_CALL); + + if (arg->common.aml_opcode == AML_INT_METHODCALL_OP) { ++ ++ /* Free method call op and corresponding namestring sub-ob */ ++ ++ acpi_ps_free_op(arg->common.value.arg); + acpi_ps_free_op(arg); + arg = NULL; + walk_state->arg_count = 1; +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 473f150d6b22..71008dbabe98 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4483,6 +4483,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + /* https://bugzilla.kernel.org/show_bug.cgi?id=15573 */ + { "C300-CTFDDAC128MAG", "0001", ATA_HORKAGE_NONCQ, }, + ++ /* Some Sandisk SSDs lock up hard with NCQ enabled. Reported on ++ SD7SN6S256G and SD8SN8U256G */ ++ { "SanDisk SD[78]SN*G", NULL, ATA_HORKAGE_NONCQ, }, ++ + /* devices which puke on READ_NATIVE_MAX */ + { "HDS724040KLSA80", "KFAOA20N", ATA_HORKAGE_BROKEN_HPA, }, + { "WDC WD3200JD-00KLB0", "WD-WCAMR1130137", ATA_HORKAGE_BROKEN_HPA }, +@@ -4543,6 +4547,8 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, }, + + /* devices that don't properly handle queued TRIM commands */ ++ { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | ++ ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Micron_M500_*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, + { "Crucial_CT*M500*", NULL, ATA_HORKAGE_NO_NCQ_TRIM | +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 4ff69f508e95..6b0440a12c51 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -4287,7 +4287,7 @@ static inline void ata_scsi_dump_cdb(struct ata_port *ap, + #ifdef ATA_DEBUG + struct scsi_device *scsidev = cmd->device; + +- DPRINTK("CDB (%u:%d,%d,%d) %9ph\n", ++ DPRINTK("CDB (%u:%d,%d,%lld) %9ph\n", + ap->print_id, + scsidev->channel, scsidev->id, scsidev->lun, + cmd->cmnd); +diff --git a/drivers/base/regmap/regmap.c b/drivers/base/regmap/regmap.c +index efdadd153abe..8fd08023c0f5 100644 +--- a/drivers/base/regmap/regmap.c ++++ b/drivers/base/regmap/regmap.c +@@ -98,7 +98,7 @@ bool regmap_cached(struct regmap *map, unsigned int reg) + int ret; + unsigned int val; + +- if (map->cache == REGCACHE_NONE) ++ if (map->cache_type == REGCACHE_NONE) + return false; + + if (!map->cache_ops) +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 5f2a4240a204..86258b00a1d4 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -1591,7 +1591,7 @@ static int nbd_genl_connect(struct sk_buff *skb, struct genl_info *info) + if (new_index < 0) { + mutex_unlock(&nbd_index_mutex); + printk(KERN_ERR "nbd: failed to add new device\n"); +- return ret; ++ return new_index; + } + nbd = idr_find(&nbd_index_idr, new_index); + } +diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c +index 69dfa1d3f453..f01d4a8a783a 100644 +--- a/drivers/block/null_blk.c ++++ b/drivers/block/null_blk.c +@@ -68,6 +68,7 @@ enum nullb_device_flags { + NULLB_DEV_FL_CACHE = 3, + }; + ++#define MAP_SZ ((PAGE_SIZE >> SECTOR_SHIFT) + 2) + /* + * nullb_page is a page in memory for nullb devices. + * +@@ -82,10 +83,10 @@ enum nullb_device_flags { + */ + struct nullb_page { + struct page *page; +- unsigned long bitmap; ++ DECLARE_BITMAP(bitmap, MAP_SZ); + }; +-#define NULLB_PAGE_LOCK (sizeof(unsigned long) * 8 - 1) +-#define NULLB_PAGE_FREE (sizeof(unsigned long) * 8 - 2) ++#define NULLB_PAGE_LOCK (MAP_SZ - 1) ++#define NULLB_PAGE_FREE (MAP_SZ - 2) + + struct nullb_device { + struct nullb *nullb; +@@ -725,7 +726,7 @@ static struct nullb_page *null_alloc_page(gfp_t gfp_flags) + if (!t_page->page) + goto out_freepage; + +- t_page->bitmap = 0; ++ memset(t_page->bitmap, 0, sizeof(t_page->bitmap)); + return t_page; + out_freepage: + kfree(t_page); +@@ -735,13 +736,20 @@ static struct nullb_page *null_alloc_page(gfp_t gfp_flags) + + static void null_free_page(struct nullb_page *t_page) + { +- __set_bit(NULLB_PAGE_FREE, &t_page->bitmap); +- if (test_bit(NULLB_PAGE_LOCK, &t_page->bitmap)) ++ __set_bit(NULLB_PAGE_FREE, t_page->bitmap); ++ if (test_bit(NULLB_PAGE_LOCK, t_page->bitmap)) + return; + __free_page(t_page->page); + kfree(t_page); + } + ++static bool null_page_empty(struct nullb_page *page) ++{ ++ int size = MAP_SZ - 2; ++ ++ return find_first_bit(page->bitmap, size) == size; ++} ++ + static void null_free_sector(struct nullb *nullb, sector_t sector, + bool is_cache) + { +@@ -756,9 +764,9 @@ static void null_free_sector(struct nullb *nullb, sector_t sector, + + t_page = radix_tree_lookup(root, idx); + if (t_page) { +- __clear_bit(sector_bit, &t_page->bitmap); ++ __clear_bit(sector_bit, t_page->bitmap); + +- if (!t_page->bitmap) { ++ if (null_page_empty(t_page)) { + ret = radix_tree_delete_item(root, idx, t_page); + WARN_ON(ret != t_page); + null_free_page(ret); +@@ -829,7 +837,7 @@ static struct nullb_page *__null_lookup_page(struct nullb *nullb, + t_page = radix_tree_lookup(root, idx); + WARN_ON(t_page && t_page->page->index != idx); + +- if (t_page && (for_write || test_bit(sector_bit, &t_page->bitmap))) ++ if (t_page && (for_write || test_bit(sector_bit, t_page->bitmap))) + return t_page; + + return NULL; +@@ -892,10 +900,10 @@ static int null_flush_cache_page(struct nullb *nullb, struct nullb_page *c_page) + + t_page = null_insert_page(nullb, idx << PAGE_SECTORS_SHIFT, true); + +- __clear_bit(NULLB_PAGE_LOCK, &c_page->bitmap); +- if (test_bit(NULLB_PAGE_FREE, &c_page->bitmap)) { ++ __clear_bit(NULLB_PAGE_LOCK, c_page->bitmap); ++ if (test_bit(NULLB_PAGE_FREE, c_page->bitmap)) { + null_free_page(c_page); +- if (t_page && t_page->bitmap == 0) { ++ if (t_page && null_page_empty(t_page)) { + ret = radix_tree_delete_item(&nullb->dev->data, + idx, t_page); + null_free_page(t_page); +@@ -911,11 +919,11 @@ static int null_flush_cache_page(struct nullb *nullb, struct nullb_page *c_page) + + for (i = 0; i < PAGE_SECTORS; + i += (nullb->dev->blocksize >> SECTOR_SHIFT)) { +- if (test_bit(i, &c_page->bitmap)) { ++ if (test_bit(i, c_page->bitmap)) { + offset = (i << SECTOR_SHIFT); + memcpy(dst + offset, src + offset, + nullb->dev->blocksize); +- __set_bit(i, &t_page->bitmap); ++ __set_bit(i, t_page->bitmap); + } + } + +@@ -952,10 +960,10 @@ static int null_make_cache_space(struct nullb *nullb, unsigned long n) + * We found the page which is being flushed to disk by other + * threads + */ +- if (test_bit(NULLB_PAGE_LOCK, &c_pages[i]->bitmap)) ++ if (test_bit(NULLB_PAGE_LOCK, c_pages[i]->bitmap)) + c_pages[i] = NULL; + else +- __set_bit(NULLB_PAGE_LOCK, &c_pages[i]->bitmap); ++ __set_bit(NULLB_PAGE_LOCK, c_pages[i]->bitmap); + } + + one_round = 0; +@@ -1008,7 +1016,7 @@ static int copy_to_nullb(struct nullb *nullb, struct page *source, + kunmap_atomic(dst); + kunmap_atomic(src); + +- __set_bit(sector & SECTOR_MASK, &t_page->bitmap); ++ __set_bit(sector & SECTOR_MASK, t_page->bitmap); + + if (is_fua) + null_free_sector(nullb, sector, true); +@@ -1922,10 +1930,6 @@ static int __init null_init(void) + struct nullb *nullb; + struct nullb_device *dev; + +- /* check for nullb_page.bitmap */ +- if (sizeof(unsigned long) * 8 - 2 < (PAGE_SIZE >> SECTOR_SHIFT)) +- return -EINVAL; +- + if (g_bs > PAGE_SIZE) { + pr_warn("null_blk: invalid block size\n"); + pr_warn("null_blk: defaults block size to %lu\n", PAGE_SIZE); +diff --git a/drivers/block/paride/pcd.c b/drivers/block/paride/pcd.c +index 7b8c6368beb7..a026211afb51 100644 +--- a/drivers/block/paride/pcd.c ++++ b/drivers/block/paride/pcd.c +@@ -230,6 +230,8 @@ static int pcd_block_open(struct block_device *bdev, fmode_t mode) + struct pcd_unit *cd = bdev->bd_disk->private_data; + int ret; + ++ check_disk_change(bdev); ++ + mutex_lock(&pcd_mutex); + ret = cdrom_open(&cd->info, bdev, mode); + mutex_unlock(&pcd_mutex); +diff --git a/drivers/block/xen-blkfront.c b/drivers/block/xen-blkfront.c +index 891265acb10e..7d23225f79ed 100644 +--- a/drivers/block/xen-blkfront.c ++++ b/drivers/block/xen-blkfront.c +@@ -262,6 +262,7 @@ static DEFINE_SPINLOCK(minor_lock); + + static int blkfront_setup_indirect(struct blkfront_ring_info *rinfo); + static void blkfront_gather_backend_features(struct blkfront_info *info); ++static int negotiate_mq(struct blkfront_info *info); + + static int get_id_from_freelist(struct blkfront_ring_info *rinfo) + { +@@ -1774,11 +1775,18 @@ static int talk_to_blkback(struct xenbus_device *dev, + unsigned int i, max_page_order; + unsigned int ring_page_order; + ++ if (!info) ++ return -ENODEV; ++ + max_page_order = xenbus_read_unsigned(info->xbdev->otherend, + "max-ring-page-order", 0); + ring_page_order = min(xen_blkif_max_ring_order, max_page_order); + info->nr_ring_pages = 1 << ring_page_order; + ++ err = negotiate_mq(info); ++ if (err) ++ goto destroy_blkring; ++ + for (i = 0; i < info->nr_rings; i++) { + struct blkfront_ring_info *rinfo = &info->rinfo[i]; + +@@ -1978,11 +1986,6 @@ static int blkfront_probe(struct xenbus_device *dev, + } + + info->xbdev = dev; +- err = negotiate_mq(info); +- if (err) { +- kfree(info); +- return err; +- } + + mutex_init(&info->mutex); + info->vdevice = vdevice; +@@ -2099,10 +2102,6 @@ static int blkfront_resume(struct xenbus_device *dev) + + blkif_free(info, info->connected == BLKIF_STATE_CONNECTED); + +- err = negotiate_mq(info); +- if (err) +- return err; +- + err = talk_to_blkback(dev, info); + if (!err) + blk_mq_update_nr_hw_queues(&info->tag_set, info->nr_rings); +diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c +index 5f7d86509f2f..bfc566d3f31a 100644 +--- a/drivers/cdrom/cdrom.c ++++ b/drivers/cdrom/cdrom.c +@@ -1152,9 +1152,6 @@ int cdrom_open(struct cdrom_device_info *cdi, struct block_device *bdev, + + cd_dbg(CD_OPEN, "entering cdrom_open\n"); + +- /* open is event synchronization point, check events first */ +- check_disk_change(bdev); +- + /* if this was a O_NONBLOCK open and we should honor the flags, + * do a quick open without drive/disc integrity checks. */ + cdi->use_count++; +diff --git a/drivers/cdrom/gdrom.c b/drivers/cdrom/gdrom.c +index 6495b03f576c..ae3a7537cf0f 100644 +--- a/drivers/cdrom/gdrom.c ++++ b/drivers/cdrom/gdrom.c +@@ -497,6 +497,9 @@ static const struct cdrom_device_ops gdrom_ops = { + static int gdrom_bdops_open(struct block_device *bdev, fmode_t mode) + { + int ret; ++ ++ check_disk_change(bdev); ++ + mutex_lock(&gdrom_mutex); + ret = cdrom_open(gd.cd_info, bdev, mode); + mutex_unlock(&gdrom_mutex); +diff --git a/drivers/char/hw_random/stm32-rng.c b/drivers/char/hw_random/stm32-rng.c +index 63d84e6f1891..83c695938a2d 100644 +--- a/drivers/char/hw_random/stm32-rng.c ++++ b/drivers/char/hw_random/stm32-rng.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + #include + + #define RNG_CR 0x00 +@@ -46,6 +47,7 @@ struct stm32_rng_private { + struct hwrng rng; + void __iomem *base; + struct clk *clk; ++ struct reset_control *rst; + }; + + static int stm32_rng_read(struct hwrng *rng, void *data, size_t max, bool wait) +@@ -140,6 +142,13 @@ static int stm32_rng_probe(struct platform_device *ofdev) + if (IS_ERR(priv->clk)) + return PTR_ERR(priv->clk); + ++ priv->rst = devm_reset_control_get(&ofdev->dev, NULL); ++ if (!IS_ERR(priv->rst)) { ++ reset_control_assert(priv->rst); ++ udelay(2); ++ reset_control_deassert(priv->rst); ++ } ++ + dev_set_drvdata(dev, priv); + + priv->rng.name = dev_driver_string(dev), +diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c +index 0aea3bcb6158..6f2eaba1cd6a 100644 +--- a/drivers/char/ipmi/ipmi_ssif.c ++++ b/drivers/char/ipmi/ipmi_ssif.c +@@ -763,7 +763,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + ssif_info->ssif_state = SSIF_NORMAL; + ipmi_ssif_unlock_cond(ssif_info, flags); + pr_warn(PFX "Error getting flags: %d %d, %x\n", +- result, len, data[2]); ++ result, len, (len >= 3) ? data[2] : 0); + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 + || data[1] != IPMI_GET_MSG_FLAGS_CMD) { + /* +@@ -785,7 +785,7 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, + if ((result < 0) || (len < 3) || (data[2] != 0)) { + /* Error clearing flags */ + pr_warn(PFX "Error clearing flags: %d %d, %x\n", +- result, len, data[2]); ++ result, len, (len >= 3) ? data[2] : 0); + } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 + || data[1] != IPMI_CLEAR_MSG_FLAGS_CMD) { + pr_warn(PFX "Invalid response clearing flags: %x %x\n", +diff --git a/drivers/clocksource/fsl_ftm_timer.c b/drivers/clocksource/fsl_ftm_timer.c +index 3ee7e6fea621..846d18daf893 100644 +--- a/drivers/clocksource/fsl_ftm_timer.c ++++ b/drivers/clocksource/fsl_ftm_timer.c +@@ -281,7 +281,7 @@ static int __init __ftm_clk_init(struct device_node *np, char *cnt_name, + + static unsigned long __init ftm_clk_init(struct device_node *np) + { +- unsigned long freq; ++ long freq; + + freq = __ftm_clk_init(np, "ftm-evt-counter-en", "ftm-evt"); + if (freq <= 0) +diff --git a/drivers/clocksource/mips-gic-timer.c b/drivers/clocksource/mips-gic-timer.c +index ae3167c28b12..a07f51231e33 100644 +--- a/drivers/clocksource/mips-gic-timer.c ++++ b/drivers/clocksource/mips-gic-timer.c +@@ -164,7 +164,7 @@ static int __init __gic_clocksource_init(void) + + /* Set clocksource mask. */ + count_width = read_gic_config() & GIC_CONFIG_COUNTBITS; +- count_width >>= __fls(GIC_CONFIG_COUNTBITS); ++ count_width >>= __ffs(GIC_CONFIG_COUNTBITS); + count_width *= 4; + count_width += 32; + gic_clocksource.mask = CLOCKSOURCE_MASK(count_width); +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index dcb1cb9a4572..8b432d6e846d 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -167,9 +167,19 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy) + NSEC_PER_USEC; + policy->shared_type = cpu->shared_type; + +- if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) ++ if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) { ++ int i; ++ + cpumask_copy(policy->cpus, cpu->shared_cpu_map); +- else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) { ++ ++ for_each_cpu(i, policy->cpus) { ++ if (unlikely(i == policy->cpu)) ++ continue; ++ ++ memcpy(&all_cpu_data[i]->perf_caps, &cpu->perf_caps, ++ sizeof(cpu->perf_caps)); ++ } ++ } else if (policy->shared_type == CPUFREQ_SHARED_TYPE_ALL) { + /* Support only SW_ANY for now. */ + pr_debug("Unsupported CPU co-ord type\n"); + return -EFAULT; +@@ -233,8 +243,13 @@ static int __init cppc_cpufreq_init(void) + return ret; + + out: +- for_each_possible_cpu(i) +- kfree(all_cpu_data[i]); ++ for_each_possible_cpu(i) { ++ cpu = all_cpu_data[i]; ++ if (!cpu) ++ break; ++ free_cpumask_var(cpu->shared_cpu_map); ++ kfree(cpu); ++ } + + kfree(all_cpu_data); + return -ENODEV; +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index ea43b147a7fe..789fc3a8289f 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -1315,14 +1315,14 @@ static int cpufreq_online(unsigned int cpu) + return 0; + + out_exit_policy: ++ for_each_cpu(j, policy->real_cpus) ++ remove_cpu_dev_symlink(policy, get_cpu_device(j)); ++ + up_write(&policy->rwsem); + + if (cpufreq_driver->exit) + cpufreq_driver->exit(policy); + +- for_each_cpu(j, policy->real_cpus) +- remove_cpu_dev_symlink(policy, get_cpu_device(j)); +- + out_free_policy: + cpufreq_policy_free(policy); + return ret; +diff --git a/drivers/dma/mv_xor_v2.c b/drivers/dma/mv_xor_v2.c +index f652a0e0f5a2..3548caa9e933 100644 +--- a/drivers/dma/mv_xor_v2.c ++++ b/drivers/dma/mv_xor_v2.c +@@ -163,6 +163,7 @@ struct mv_xor_v2_device { + void __iomem *dma_base; + void __iomem *glob_base; + struct clk *clk; ++ struct clk *reg_clk; + struct tasklet_struct irq_tasklet; + struct list_head free_sw_desc; + struct dma_device dmadev; +@@ -749,13 +750,26 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + if (ret) + return ret; + ++ xor_dev->reg_clk = devm_clk_get(&pdev->dev, "reg"); ++ if (PTR_ERR(xor_dev->reg_clk) != -ENOENT) { ++ if (!IS_ERR(xor_dev->reg_clk)) { ++ ret = clk_prepare_enable(xor_dev->reg_clk); ++ if (ret) ++ return ret; ++ } else { ++ return PTR_ERR(xor_dev->reg_clk); ++ } ++ } ++ + xor_dev->clk = devm_clk_get(&pdev->dev, NULL); +- if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (IS_ERR(xor_dev->clk) && PTR_ERR(xor_dev->clk) == -EPROBE_DEFER) { ++ ret = EPROBE_DEFER; ++ goto disable_reg_clk; ++ } + if (!IS_ERR(xor_dev->clk)) { + ret = clk_prepare_enable(xor_dev->clk); + if (ret) +- return ret; ++ goto disable_reg_clk; + } + + ret = platform_msi_domain_alloc_irqs(&pdev->dev, 1, +@@ -866,8 +880,9 @@ static int mv_xor_v2_probe(struct platform_device *pdev) + free_msi_irqs: + platform_msi_domain_free_irqs(&pdev->dev); + disable_clk: +- if (!IS_ERR(xor_dev->clk)) +- clk_disable_unprepare(xor_dev->clk); ++ clk_disable_unprepare(xor_dev->clk); ++disable_reg_clk: ++ clk_disable_unprepare(xor_dev->reg_clk); + return ret; + } + +diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c +index f122c2a7b9f0..7432c8894e32 100644 +--- a/drivers/dma/pl330.c ++++ b/drivers/dma/pl330.c +@@ -1510,7 +1510,7 @@ static void pl330_dotask(unsigned long data) + /* Returns 1 if state was updated, 0 otherwise */ + static int pl330_update(struct pl330_dmac *pl330) + { +- struct dma_pl330_desc *descdone, *tmp; ++ struct dma_pl330_desc *descdone; + unsigned long flags; + void __iomem *regs; + u32 val; +@@ -1588,7 +1588,9 @@ static int pl330_update(struct pl330_dmac *pl330) + } + + /* Now that we are in no hurry, do the callbacks */ +- list_for_each_entry_safe(descdone, tmp, &pl330->req_done, rqd) { ++ while (!list_empty(&pl330->req_done)) { ++ descdone = list_first_entry(&pl330->req_done, ++ struct dma_pl330_desc, rqd); + list_del(&descdone->rqd); + spin_unlock_irqrestore(&pl330->lock, flags); + dma_pl330_rqcb(descdone, PL330_ERR_NONE); +diff --git a/drivers/dma/qcom/bam_dma.c b/drivers/dma/qcom/bam_dma.c +index 6d89fb6a6a92..8fbf175fdcc7 100644 +--- a/drivers/dma/qcom/bam_dma.c ++++ b/drivers/dma/qcom/bam_dma.c +@@ -388,6 +388,7 @@ struct bam_device { + struct device_dma_parameters dma_parms; + struct bam_chan *channels; + u32 num_channels; ++ u32 num_ees; + + /* execution environment ID, from DT */ + u32 ee; +@@ -1080,15 +1081,19 @@ static int bam_init(struct bam_device *bdev) + u32 val; + + /* read revision and configuration information */ +- val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION)) >> NUM_EES_SHIFT; +- val &= NUM_EES_MASK; ++ if (!bdev->num_ees) { ++ val = readl_relaxed(bam_addr(bdev, 0, BAM_REVISION)); ++ bdev->num_ees = (val >> NUM_EES_SHIFT) & NUM_EES_MASK; ++ } + + /* check that configured EE is within range */ +- if (bdev->ee >= val) ++ if (bdev->ee >= bdev->num_ees) + return -EINVAL; + +- val = readl_relaxed(bam_addr(bdev, 0, BAM_NUM_PIPES)); +- bdev->num_channels = val & BAM_NUM_PIPES_MASK; ++ if (!bdev->num_channels) { ++ val = readl_relaxed(bam_addr(bdev, 0, BAM_NUM_PIPES)); ++ bdev->num_channels = val & BAM_NUM_PIPES_MASK; ++ } + + if (bdev->controlled_remotely) + return 0; +@@ -1183,6 +1188,18 @@ static int bam_dma_probe(struct platform_device *pdev) + bdev->controlled_remotely = of_property_read_bool(pdev->dev.of_node, + "qcom,controlled-remotely"); + ++ if (bdev->controlled_remotely) { ++ ret = of_property_read_u32(pdev->dev.of_node, "num-channels", ++ &bdev->num_channels); ++ if (ret) ++ dev_err(bdev->dev, "num-channels unspecified in dt\n"); ++ ++ ret = of_property_read_u32(pdev->dev.of_node, "qcom,num-ees", ++ &bdev->num_ees); ++ if (ret) ++ dev_err(bdev->dev, "num-ees unspecified in dt\n"); ++ } ++ + bdev->bamclk = devm_clk_get(bdev->dev, "bam_clk"); + if (IS_ERR(bdev->bamclk)) + return PTR_ERR(bdev->bamclk); +diff --git a/drivers/dma/sh/rcar-dmac.c b/drivers/dma/sh/rcar-dmac.c +index 2b2c7db3e480..9d6ce5051d8f 100644 +--- a/drivers/dma/sh/rcar-dmac.c ++++ b/drivers/dma/sh/rcar-dmac.c +@@ -880,7 +880,7 @@ rcar_dmac_chan_prep_sg(struct rcar_dmac_chan *chan, struct scatterlist *sgl, + + rcar_dmac_chan_configure_desc(chan, desc); + +- max_chunk_size = (RCAR_DMATCR_MASK + 1) << desc->xfer_shift; ++ max_chunk_size = RCAR_DMATCR_MASK << desc->xfer_shift; + + /* + * Allocate and fill the transfer chunk descriptors. We own the only +@@ -1264,8 +1264,17 @@ static unsigned int rcar_dmac_chan_get_residue(struct rcar_dmac_chan *chan, + * If the cookie doesn't correspond to the currently running transfer + * then the descriptor hasn't been processed yet, and the residue is + * equal to the full descriptor size. ++ * Also, a client driver is possible to call this function before ++ * rcar_dmac_isr_channel_thread() runs. In this case, the "desc.running" ++ * will be the next descriptor, and the done list will appear. So, if ++ * the argument cookie matches the done list's cookie, we can assume ++ * the residue is zero. + */ + if (cookie != desc->async_tx.cookie) { ++ list_for_each_entry(desc, &chan->desc.done, node) { ++ if (cookie == desc->async_tx.cookie) ++ return 0; ++ } + list_for_each_entry(desc, &chan->desc.pending, node) { + if (cookie == desc->async_tx.cookie) + return desc->size; +diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c +index e8db9659a36b..fe0d30340e96 100644 +--- a/drivers/firmware/dmi_scan.c ++++ b/drivers/firmware/dmi_scan.c +@@ -191,7 +191,7 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, + char *s; + int is_ff = 1, is_00 = 1, i; + +- if (dmi_ident[slot] || dm->length <= index + 16) ++ if (dmi_ident[slot] || dm->length < index + 16) + return; + + d = (u8 *) dm + index; +diff --git a/drivers/firmware/efi/arm-runtime.c b/drivers/firmware/efi/arm-runtime.c +index 1cc41c3d6315..86a1ad17a32e 100644 +--- a/drivers/firmware/efi/arm-runtime.c ++++ b/drivers/firmware/efi/arm-runtime.c +@@ -54,6 +54,9 @@ static struct ptdump_info efi_ptdump_info = { + + static int __init ptdump_init(void) + { ++ if (!efi_enabled(EFI_RUNTIME_SERVICES)) ++ return 0; ++ + return ptdump_debugfs_register(&efi_ptdump_info, "efi_page_tables"); + } + device_initcall(ptdump_init); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +index 8d689ab7e429..1ef486b5d54b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd.h +@@ -26,6 +26,7 @@ + #define AMDGPU_AMDKFD_H_INCLUDED + + #include ++#include + #include + #include + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +index 659997bfff30..cd84bd0b1eaf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ib.c +@@ -322,14 +322,45 @@ int amdgpu_ib_ring_tests(struct amdgpu_device *adev) + { + unsigned i; + int r, ret = 0; ++ long tmo_gfx, tmo_mm; ++ ++ tmo_mm = tmo_gfx = AMDGPU_IB_TEST_TIMEOUT; ++ if (amdgpu_sriov_vf(adev)) { ++ /* for MM engines in hypervisor side they are not scheduled together ++ * with CP and SDMA engines, so even in exclusive mode MM engine could ++ * still running on other VF thus the IB TEST TIMEOUT for MM engines ++ * under SR-IOV should be set to a long time. 8 sec should be enough ++ * for the MM comes back to this VF. ++ */ ++ tmo_mm = 8 * AMDGPU_IB_TEST_TIMEOUT; ++ } ++ ++ if (amdgpu_sriov_runtime(adev)) { ++ /* for CP & SDMA engines since they are scheduled together so ++ * need to make the timeout width enough to cover the time ++ * cost waiting for it coming back under RUNTIME only ++ */ ++ tmo_gfx = 8 * AMDGPU_IB_TEST_TIMEOUT; ++ } + + for (i = 0; i < AMDGPU_MAX_RINGS; ++i) { + struct amdgpu_ring *ring = adev->rings[i]; ++ long tmo; + + if (!ring || !ring->ready) + continue; + +- r = amdgpu_ring_test_ib(ring, AMDGPU_IB_TEST_TIMEOUT); ++ /* MM engine need more time */ ++ if (ring->funcs->type == AMDGPU_RING_TYPE_UVD || ++ ring->funcs->type == AMDGPU_RING_TYPE_VCE || ++ ring->funcs->type == AMDGPU_RING_TYPE_UVD_ENC || ++ ring->funcs->type == AMDGPU_RING_TYPE_VCN_DEC || ++ ring->funcs->type == AMDGPU_RING_TYPE_VCN_ENC) ++ tmo = tmo_mm; ++ else ++ tmo = tmo_gfx; ++ ++ r = amdgpu_ring_test_ib(ring, tmo); + if (r) { + ring->ready = false; + +diff --git a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +index 69182eeca264..1a30c54a0889 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gfx_v9_0.c +@@ -2889,7 +2889,13 @@ static int gfx_v9_0_hw_fini(void *handle) + amdgpu_irq_put(adev, &adev->gfx.priv_reg_irq, 0); + amdgpu_irq_put(adev, &adev->gfx.priv_inst_irq, 0); + if (amdgpu_sriov_vf(adev)) { +- pr_debug("For SRIOV client, shouldn't do anything.\n"); ++ gfx_v9_0_cp_gfx_enable(adev, false); ++ /* must disable polling for SRIOV when hw finished, otherwise ++ * CPC engine may still keep fetching WB address which is already ++ * invalid after sw finished and trigger DMAR reading error in ++ * hypervisor side. ++ */ ++ WREG32_FIELD15(GC, 0, CP_PQ_WPTR_POLL_CNTL, EN, 0); + return 0; + } + gfx_v9_0_cp_enable(adev, false); +diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +index 6dc0f6e346e7..a1d71429fb72 100644 +--- a/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v9_0.c +@@ -456,7 +456,10 @@ static int gmc_v9_0_mc_init(struct amdgpu_device *adev) + adev->mc.vram_width = amdgpu_atomfirmware_get_vram_width(adev); + if (!adev->mc.vram_width) { + /* hbm memory channel size */ +- chansize = 128; ++ if (adev->flags & AMD_IS_APU) ++ chansize = 64; ++ else ++ chansize = 128; + + tmp = RREG32_SOC15(DF, 0, mmDF_CS_AON0_DramBaseAddress0); + tmp &= DF_CS_AON0_DramBaseAddress0__IntLvNumChan_MASK; +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c +index 1d312603de9f..308571b09c6b 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_packet_manager.c +@@ -166,8 +166,7 @@ static int pm_create_map_process(struct packet_manager *pm, uint32_t *buffer, + packet->sh_mem_ape1_base = qpd->sh_mem_ape1_base; + packet->sh_mem_ape1_limit = qpd->sh_mem_ape1_limit; + +- /* TODO: scratch support */ +- packet->sh_hidden_private_base_vmid = 0; ++ packet->sh_hidden_private_base_vmid = qpd->sh_hidden_private_base; + + packet->gds_addr_lo = lower_32_bits(qpd->gds_context_area); + packet->gds_addr_hi = upper_32_bits(qpd->gds_context_area); +diff --git a/drivers/gpu/drm/ast/ast_tables.h b/drivers/gpu/drm/ast/ast_tables.h +index 5f4c2e833a65..d665dd5af5dd 100644 +--- a/drivers/gpu/drm/ast/ast_tables.h ++++ b/drivers/gpu/drm/ast/ast_tables.h +@@ -97,7 +97,7 @@ static const struct ast_vbios_dclk_info dclk_table[] = { + {0x67, 0x22, 0x00}, /* 0E: VCLK157_5 */ + {0x6A, 0x22, 0x00}, /* 0F: VCLK162 */ + {0x4d, 0x4c, 0x80}, /* 10: VCLK154 */ +- {0xa7, 0x78, 0x80}, /* 11: VCLK83.5 */ ++ {0x68, 0x6f, 0x80}, /* 11: VCLK83.5 */ + {0x28, 0x49, 0x80}, /* 12: VCLK106.5 */ + {0x37, 0x49, 0x80}, /* 13: VCLK146.25 */ + {0x1f, 0x45, 0x80}, /* 14: VCLK148.5 */ +@@ -127,7 +127,7 @@ static const struct ast_vbios_dclk_info dclk_table_ast2500[] = { + {0x67, 0x22, 0x00}, /* 0E: VCLK157_5 */ + {0x6A, 0x22, 0x00}, /* 0F: VCLK162 */ + {0x4d, 0x4c, 0x80}, /* 10: VCLK154 */ +- {0xa7, 0x78, 0x80}, /* 11: VCLK83.5 */ ++ {0x68, 0x6f, 0x80}, /* 11: VCLK83.5 */ + {0x28, 0x49, 0x80}, /* 12: VCLK106.5 */ + {0x37, 0x49, 0x80}, /* 13: VCLK146.25 */ + {0x1f, 0x45, 0x80}, /* 14: VCLK148.5 */ +diff --git a/drivers/gpu/drm/bridge/sii902x.c b/drivers/gpu/drm/bridge/sii902x.c +index b1ab4ab09532..60373d7eb220 100644 +--- a/drivers/gpu/drm/bridge/sii902x.c ++++ b/drivers/gpu/drm/bridge/sii902x.c +@@ -137,7 +137,9 @@ static int sii902x_get_modes(struct drm_connector *connector) + struct sii902x *sii902x = connector_to_sii902x(connector); + struct regmap *regmap = sii902x->regmap; + u32 bus_format = MEDIA_BUS_FMT_RGB888_1X24; ++ struct device *dev = &sii902x->i2c->dev; + unsigned long timeout; ++ unsigned int retries; + unsigned int status; + struct edid *edid; + int num = 0; +@@ -159,7 +161,7 @@ static int sii902x_get_modes(struct drm_connector *connector) + time_before(jiffies, timeout)); + + if (!(status & SII902X_SYS_CTRL_DDC_BUS_GRTD)) { +- dev_err(&sii902x->i2c->dev, "failed to acquire the i2c bus\n"); ++ dev_err(dev, "failed to acquire the i2c bus\n"); + return -ETIMEDOUT; + } + +@@ -179,9 +181,19 @@ static int sii902x_get_modes(struct drm_connector *connector) + if (ret) + return ret; + +- ret = regmap_read(regmap, SII902X_SYS_CTRL_DATA, &status); ++ /* ++ * Sometimes the I2C bus can stall after failure to use the ++ * EDID channel. Retry a few times to see if things clear ++ * up, else continue anyway. ++ */ ++ retries = 5; ++ do { ++ ret = regmap_read(regmap, SII902X_SYS_CTRL_DATA, ++ &status); ++ retries--; ++ } while (ret && retries); + if (ret) +- return ret; ++ dev_err(dev, "failed to read status (%d)\n", ret); + + ret = regmap_update_bits(regmap, SII902X_SYS_CTRL_DATA, + SII902X_SYS_CTRL_DDC_BUS_REQ | +@@ -201,7 +213,7 @@ static int sii902x_get_modes(struct drm_connector *connector) + + if (status & (SII902X_SYS_CTRL_DDC_BUS_REQ | + SII902X_SYS_CTRL_DDC_BUS_GRTD)) { +- dev_err(&sii902x->i2c->dev, "failed to release the i2c bus\n"); ++ dev_err(dev, "failed to release the i2c bus\n"); + return -ETIMEDOUT; + } + +diff --git a/drivers/gpu/drm/exynos/exynos_drm_g2d.c b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +index 2b8bf2dd6387..9effe40f5fa5 100644 +--- a/drivers/gpu/drm/exynos/exynos_drm_g2d.c ++++ b/drivers/gpu/drm/exynos/exynos_drm_g2d.c +@@ -926,7 +926,7 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no) + struct drm_device *drm_dev = g2d->subdrv.drm_dev; + struct g2d_runqueue_node *runqueue_node = g2d->runqueue_node; + struct drm_exynos_pending_g2d_event *e; +- struct timeval now; ++ struct timespec64 now; + + if (list_empty(&runqueue_node->event_list)) + return; +@@ -934,9 +934,9 @@ static void g2d_finish_event(struct g2d_data *g2d, u32 cmdlist_no) + e = list_first_entry(&runqueue_node->event_list, + struct drm_exynos_pending_g2d_event, base.link); + +- do_gettimeofday(&now); ++ ktime_get_ts64(&now); + e->event.tv_sec = now.tv_sec; +- e->event.tv_usec = now.tv_usec; ++ e->event.tv_usec = now.tv_nsec / NSEC_PER_USEC; + e->event.cmdlist_no = cmdlist_no; + + drm_send_event(drm_dev, &e->base); +diff --git a/drivers/gpu/drm/exynos/regs-fimc.h b/drivers/gpu/drm/exynos/regs-fimc.h +index 30496134a3d0..d7cbe53c4c01 100644 +--- a/drivers/gpu/drm/exynos/regs-fimc.h ++++ b/drivers/gpu/drm/exynos/regs-fimc.h +@@ -569,7 +569,7 @@ + #define EXYNOS_CIIMGEFF_FIN_EMBOSSING (4 << 26) + #define EXYNOS_CIIMGEFF_FIN_SILHOUETTE (5 << 26) + #define EXYNOS_CIIMGEFF_FIN_MASK (7 << 26) +-#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff < 13) | (0xff < 0)) ++#define EXYNOS_CIIMGEFF_PAT_CBCR_MASK ((0xff << 13) | (0xff << 0)) + + /* Real input DMA size register */ + #define EXYNOS_CIREAL_ISIZE_AUTOLOAD_ENABLE (1 << 31) +diff --git a/drivers/gpu/drm/imx/ipuv3-crtc.c b/drivers/gpu/drm/imx/ipuv3-crtc.c +index 53e0b24beda6..d976391dfa31 100644 +--- a/drivers/gpu/drm/imx/ipuv3-crtc.c ++++ b/drivers/gpu/drm/imx/ipuv3-crtc.c +@@ -225,7 +225,11 @@ static void ipu_crtc_atomic_begin(struct drm_crtc *crtc, + struct drm_crtc_state *old_crtc_state) + { + drm_crtc_vblank_on(crtc); ++} + ++static void ipu_crtc_atomic_flush(struct drm_crtc *crtc, ++ struct drm_crtc_state *old_crtc_state) ++{ + spin_lock_irq(&crtc->dev->event_lock); + if (crtc->state->event) { + WARN_ON(drm_crtc_vblank_get(crtc)); +@@ -293,6 +297,7 @@ static const struct drm_crtc_helper_funcs ipu_helper_funcs = { + .mode_set_nofb = ipu_crtc_mode_set_nofb, + .atomic_check = ipu_crtc_atomic_check, + .atomic_begin = ipu_crtc_atomic_begin, ++ .atomic_flush = ipu_crtc_atomic_flush, + .atomic_disable = ipu_crtc_atomic_disable, + .atomic_enable = ipu_crtc_atomic_enable, + }; +diff --git a/drivers/gpu/drm/meson/meson_crtc.c b/drivers/gpu/drm/meson/meson_crtc.c +index 5155f0179b61..05520202c967 100644 +--- a/drivers/gpu/drm/meson/meson_crtc.c ++++ b/drivers/gpu/drm/meson/meson_crtc.c +@@ -36,6 +36,7 @@ + #include "meson_venc.h" + #include "meson_vpp.h" + #include "meson_viu.h" ++#include "meson_canvas.h" + #include "meson_registers.h" + + /* CRTC definition */ +@@ -192,6 +193,11 @@ void meson_crtc_irq(struct meson_drm *priv) + } else + meson_vpp_disable_interlace_vscaler_osd1(priv); + ++ meson_canvas_setup(priv, MESON_CANVAS_ID_OSD1, ++ priv->viu.osd1_addr, priv->viu.osd1_stride, ++ priv->viu.osd1_height, MESON_CANVAS_WRAP_NONE, ++ MESON_CANVAS_BLKMODE_LINEAR); ++ + /* Enable OSD1 */ + writel_bits_relaxed(VPP_OSD1_POSTBLEND, VPP_OSD1_POSTBLEND, + priv->io_base + _REG(VPP_MISC)); +diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c +index 7742c7d81ed8..4ad8223c60ea 100644 +--- a/drivers/gpu/drm/meson/meson_drv.c ++++ b/drivers/gpu/drm/meson/meson_drv.c +@@ -180,40 +180,51 @@ static int meson_drv_bind_master(struct device *dev, bool has_components) + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "vpu"); + regs = devm_ioremap_resource(dev, res); +- if (IS_ERR(regs)) +- return PTR_ERR(regs); ++ if (IS_ERR(regs)) { ++ ret = PTR_ERR(regs); ++ goto free_drm; ++ } + + priv->io_base = regs; + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "hhi"); + /* Simply ioremap since it may be a shared register zone */ + regs = devm_ioremap(dev, res->start, resource_size(res)); +- if (!regs) +- return -EADDRNOTAVAIL; ++ if (!regs) { ++ ret = -EADDRNOTAVAIL; ++ goto free_drm; ++ } + + priv->hhi = devm_regmap_init_mmio(dev, regs, + &meson_regmap_config); + if (IS_ERR(priv->hhi)) { + dev_err(&pdev->dev, "Couldn't create the HHI regmap\n"); +- return PTR_ERR(priv->hhi); ++ ret = PTR_ERR(priv->hhi); ++ goto free_drm; + } + + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, "dmc"); + /* Simply ioremap since it may be a shared register zone */ + regs = devm_ioremap(dev, res->start, resource_size(res)); +- if (!regs) +- return -EADDRNOTAVAIL; ++ if (!regs) { ++ ret = -EADDRNOTAVAIL; ++ goto free_drm; ++ } + + priv->dmc = devm_regmap_init_mmio(dev, regs, + &meson_regmap_config); + if (IS_ERR(priv->dmc)) { + dev_err(&pdev->dev, "Couldn't create the DMC regmap\n"); +- return PTR_ERR(priv->dmc); ++ ret = PTR_ERR(priv->dmc); ++ goto free_drm; + } + + priv->vsync_irq = platform_get_irq(pdev, 0); + +- drm_vblank_init(drm, 1); ++ ret = drm_vblank_init(drm, 1); ++ if (ret) ++ goto free_drm; ++ + drm_mode_config_init(drm); + drm->mode_config.max_width = 3840; + drm->mode_config.max_height = 2160; +diff --git a/drivers/gpu/drm/meson/meson_drv.h b/drivers/gpu/drm/meson/meson_drv.h +index 5e8b392b9d1f..8450d6ac8c9b 100644 +--- a/drivers/gpu/drm/meson/meson_drv.h ++++ b/drivers/gpu/drm/meson/meson_drv.h +@@ -43,6 +43,9 @@ struct meson_drm { + bool osd1_commit; + uint32_t osd1_ctrl_stat; + uint32_t osd1_blk0_cfg[5]; ++ uint32_t osd1_addr; ++ uint32_t osd1_stride; ++ uint32_t osd1_height; + } viu; + + struct { +diff --git a/drivers/gpu/drm/meson/meson_plane.c b/drivers/gpu/drm/meson/meson_plane.c +index 17e96fa47868..0b6011b8d632 100644 +--- a/drivers/gpu/drm/meson/meson_plane.c ++++ b/drivers/gpu/drm/meson/meson_plane.c +@@ -164,10 +164,9 @@ static void meson_plane_atomic_update(struct drm_plane *plane, + /* Update Canvas with buffer address */ + gem = drm_fb_cma_get_gem_obj(fb, 0); + +- meson_canvas_setup(priv, MESON_CANVAS_ID_OSD1, +- gem->paddr, fb->pitches[0], +- fb->height, MESON_CANVAS_WRAP_NONE, +- MESON_CANVAS_BLKMODE_LINEAR); ++ priv->viu.osd1_addr = gem->paddr; ++ priv->viu.osd1_stride = fb->pitches[0]; ++ priv->viu.osd1_height = fb->height; + + spin_unlock_irqrestore(&priv->drm->event_lock, flags); + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index f56f60f695e1..debbbf0fd4bd 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -134,7 +134,7 @@ nv50_get_intensity(struct backlight_device *bd) + struct nouveau_encoder *nv_encoder = bl_get_data(bd); + struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); + struct nvif_object *device = &drm->client.device.object; +- int or = nv_encoder->or; ++ int or = ffs(nv_encoder->dcb->or) - 1; + u32 div = 1025; + u32 val; + +@@ -149,7 +149,7 @@ nv50_set_intensity(struct backlight_device *bd) + struct nouveau_encoder *nv_encoder = bl_get_data(bd); + struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); + struct nvif_object *device = &drm->client.device.object; +- int or = nv_encoder->or; ++ int or = ffs(nv_encoder->dcb->or) - 1; + u32 div = 1025; + u32 val = (bd->props.brightness * div) / 100; + +@@ -170,7 +170,7 @@ nva3_get_intensity(struct backlight_device *bd) + struct nouveau_encoder *nv_encoder = bl_get_data(bd); + struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); + struct nvif_object *device = &drm->client.device.object; +- int or = nv_encoder->or; ++ int or = ffs(nv_encoder->dcb->or) - 1; + u32 div, val; + + div = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or)); +@@ -188,7 +188,7 @@ nva3_set_intensity(struct backlight_device *bd) + struct nouveau_encoder *nv_encoder = bl_get_data(bd); + struct nouveau_drm *drm = nouveau_drm(nv_encoder->base.base.dev); + struct nvif_object *device = &drm->client.device.object; +- int or = nv_encoder->or; ++ int or = ffs(nv_encoder->dcb->or) - 1; + u32 div, val; + + div = nvif_rd32(device, NV50_PDISP_SOR_PWM_DIV(or)); +@@ -228,7 +228,7 @@ nv50_backlight_init(struct drm_connector *connector) + return -ENODEV; + } + +- if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(nv_encoder->or))) ++ if (!nvif_rd32(device, NV50_PDISP_SOR_PWM_CTL(ffs(nv_encoder->dcb->or) - 1))) + return 0; + + if (drm->client.device.info.chipset <= 0xa0 || +diff --git a/drivers/gpu/drm/omapdrm/dss/dss.c b/drivers/gpu/drm/omapdrm/dss/dss.c +index d1755f12236b..41ebb37aaa79 100644 +--- a/drivers/gpu/drm/omapdrm/dss/dss.c ++++ b/drivers/gpu/drm/omapdrm/dss/dss.c +@@ -1299,88 +1299,18 @@ static const struct soc_device_attribute dss_soc_devices[] = { + + static int dss_bind(struct device *dev) + { +- struct platform_device *pdev = to_platform_device(dev); +- struct resource *dss_mem; +- u32 rev; + int r; + +- dss_mem = platform_get_resource(dss.pdev, IORESOURCE_MEM, 0); +- dss.base = devm_ioremap_resource(&pdev->dev, dss_mem); +- if (IS_ERR(dss.base)) +- return PTR_ERR(dss.base); +- +- r = dss_get_clocks(); ++ r = component_bind_all(dev, NULL); + if (r) + return r; + +- r = dss_setup_default_clock(); +- if (r) +- goto err_setup_clocks; +- +- r = dss_video_pll_probe(pdev); +- if (r) +- goto err_pll_init; +- +- r = dss_init_ports(pdev); +- if (r) +- goto err_init_ports; +- +- pm_runtime_enable(&pdev->dev); +- +- r = dss_runtime_get(); +- if (r) +- goto err_runtime_get; +- +- dss.dss_clk_rate = clk_get_rate(dss.dss_clk); +- +- /* Select DPLL */ +- REG_FLD_MOD(DSS_CONTROL, 0, 0, 0); +- +- dss_select_dispc_clk_source(DSS_CLK_SRC_FCK); +- +-#ifdef CONFIG_OMAP2_DSS_VENC +- REG_FLD_MOD(DSS_CONTROL, 1, 4, 4); /* venc dac demen */ +- REG_FLD_MOD(DSS_CONTROL, 1, 3, 3); /* venc clock 4x enable */ +- REG_FLD_MOD(DSS_CONTROL, 0, 2, 2); /* venc clock mode = normal */ +-#endif +- dss.dsi_clk_source[0] = DSS_CLK_SRC_FCK; +- dss.dsi_clk_source[1] = DSS_CLK_SRC_FCK; +- dss.dispc_clk_source = DSS_CLK_SRC_FCK; +- dss.lcd_clk_source[0] = DSS_CLK_SRC_FCK; +- dss.lcd_clk_source[1] = DSS_CLK_SRC_FCK; +- +- rev = dss_read_reg(DSS_REVISION); +- pr_info("OMAP DSS rev %d.%d\n", FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0)); +- +- dss_runtime_put(); +- +- r = component_bind_all(&pdev->dev, NULL); +- if (r) +- goto err_component; +- +- dss_debugfs_create_file("dss", dss_dump_regs); +- + pm_set_vt_switch(0); + + omapdss_gather_components(dev); + omapdss_set_is_initialized(true); + + return 0; +- +-err_component: +-err_runtime_get: +- pm_runtime_disable(&pdev->dev); +- dss_uninit_ports(pdev); +-err_init_ports: +- if (dss.video1_pll) +- dss_video_pll_uninit(dss.video1_pll); +- +- if (dss.video2_pll) +- dss_video_pll_uninit(dss.video2_pll); +-err_pll_init: +-err_setup_clocks: +- dss_put_clocks(); +- return r; + } + + static void dss_unbind(struct device *dev) +@@ -1390,18 +1320,6 @@ static void dss_unbind(struct device *dev) + omapdss_set_is_initialized(false); + + component_unbind_all(&pdev->dev, NULL); +- +- if (dss.video1_pll) +- dss_video_pll_uninit(dss.video1_pll); +- +- if (dss.video2_pll) +- dss_video_pll_uninit(dss.video2_pll); +- +- dss_uninit_ports(pdev); +- +- pm_runtime_disable(&pdev->dev); +- +- dss_put_clocks(); + } + + static const struct component_master_ops dss_component_ops = { +@@ -1433,10 +1351,46 @@ static int dss_add_child_component(struct device *dev, void *data) + return 0; + } + ++static int dss_probe_hardware(void) ++{ ++ u32 rev; ++ int r; ++ ++ r = dss_runtime_get(); ++ if (r) ++ return r; ++ ++ dss.dss_clk_rate = clk_get_rate(dss.dss_clk); ++ ++ /* Select DPLL */ ++ REG_FLD_MOD(DSS_CONTROL, 0, 0, 0); ++ ++ dss_select_dispc_clk_source(DSS_CLK_SRC_FCK); ++ ++#ifdef CONFIG_OMAP2_DSS_VENC ++ REG_FLD_MOD(DSS_CONTROL, 1, 4, 4); /* venc dac demen */ ++ REG_FLD_MOD(DSS_CONTROL, 1, 3, 3); /* venc clock 4x enable */ ++ REG_FLD_MOD(DSS_CONTROL, 0, 2, 2); /* venc clock mode = normal */ ++#endif ++ dss.dsi_clk_source[0] = DSS_CLK_SRC_FCK; ++ dss.dsi_clk_source[1] = DSS_CLK_SRC_FCK; ++ dss.dispc_clk_source = DSS_CLK_SRC_FCK; ++ dss.lcd_clk_source[0] = DSS_CLK_SRC_FCK; ++ dss.lcd_clk_source[1] = DSS_CLK_SRC_FCK; ++ ++ rev = dss_read_reg(DSS_REVISION); ++ pr_info("OMAP DSS rev %d.%d\n", FLD_GET(rev, 7, 4), FLD_GET(rev, 3, 0)); ++ ++ dss_runtime_put(); ++ ++ return 0; ++} ++ + static int dss_probe(struct platform_device *pdev) + { + const struct soc_device_attribute *soc; + struct component_match *match = NULL; ++ struct resource *dss_mem; + int r; + + dss.pdev = pdev; +@@ -1451,20 +1405,69 @@ static int dss_probe(struct platform_device *pdev) + else + dss.feat = of_match_device(dss_of_match, &pdev->dev)->data; + +- r = dss_initialize_debugfs(); ++ /* Map I/O registers, get and setup clocks. */ ++ dss_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ dss.base = devm_ioremap_resource(&pdev->dev, dss_mem); ++ if (IS_ERR(dss.base)) ++ return PTR_ERR(dss.base); ++ ++ r = dss_get_clocks(); + if (r) + return r; + +- /* add all the child devices as components */ ++ r = dss_setup_default_clock(); ++ if (r) ++ goto err_put_clocks; ++ ++ /* Setup the video PLLs and the DPI and SDI ports. */ ++ r = dss_video_pll_probe(pdev); ++ if (r) ++ goto err_put_clocks; ++ ++ r = dss_init_ports(pdev); ++ if (r) ++ goto err_uninit_plls; ++ ++ /* Enable runtime PM and probe the hardware. */ ++ pm_runtime_enable(&pdev->dev); ++ ++ r = dss_probe_hardware(); ++ if (r) ++ goto err_pm_runtime_disable; ++ ++ /* Initialize debugfs. */ ++ r = dss_initialize_debugfs(); ++ if (r) ++ goto err_pm_runtime_disable; ++ ++ dss_debugfs_create_file("dss", dss_dump_regs); ++ ++ /* Add all the child devices as components. */ + device_for_each_child(&pdev->dev, &match, dss_add_child_component); + + r = component_master_add_with_match(&pdev->dev, &dss_component_ops, match); +- if (r) { +- dss_uninitialize_debugfs(); +- return r; +- } ++ if (r) ++ goto err_uninit_debugfs; + + return 0; ++ ++err_uninit_debugfs: ++ dss_uninitialize_debugfs(); ++ ++err_pm_runtime_disable: ++ pm_runtime_disable(&pdev->dev); ++ dss_uninit_ports(pdev); ++ ++err_uninit_plls: ++ if (dss.video1_pll) ++ dss_video_pll_uninit(dss.video1_pll); ++ if (dss.video2_pll) ++ dss_video_pll_uninit(dss.video2_pll); ++ ++err_put_clocks: ++ dss_put_clocks(); ++ ++ return r; + } + + static int dss_remove(struct platform_device *pdev) +@@ -1473,6 +1476,18 @@ static int dss_remove(struct platform_device *pdev) + + dss_uninitialize_debugfs(); + ++ pm_runtime_disable(&pdev->dev); ++ ++ dss_uninit_ports(pdev); ++ ++ if (dss.video1_pll) ++ dss_video_pll_uninit(dss.video1_pll); ++ ++ if (dss.video2_pll) ++ dss_video_pll_uninit(dss.video2_pll); ++ ++ dss_put_clocks(); ++ + return 0; + } + +diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c +index 234af81fb3d0..fc56d033febe 100644 +--- a/drivers/gpu/drm/panel/panel-simple.c ++++ b/drivers/gpu/drm/panel/panel-simple.c +@@ -1561,7 +1561,7 @@ static const struct panel_desc ontat_yx700wv03 = { + .width = 154, + .height = 83, + }, +- .bus_format = MEDIA_BUS_FMT_RGB888_1X24, ++ .bus_format = MEDIA_BUS_FMT_RGB666_1X18, + }; + + static const struct drm_display_mode ortustech_com43h4m85ulc_mode = { +diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c +index 12d22f3db1af..6a4b8c98a719 100644 +--- a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c ++++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c +@@ -59,11 +59,8 @@ static void rcar_du_lvdsenc_start_gen2(struct rcar_du_lvdsenc *lvds, + + rcar_lvds_write(lvds, LVDPLLCR, pllcr); + +- /* +- * Select the input, hardcode mode 0, enable LVDS operation and turn +- * bias circuitry on. +- */ +- lvdcr0 = (lvds->mode << LVDCR0_LVMD_SHIFT) | LVDCR0_BEN | LVDCR0_LVEN; ++ /* Select the input and set the LVDS mode. */ ++ lvdcr0 = lvds->mode << LVDCR0_LVMD_SHIFT; + if (rcrtc->index == 2) + lvdcr0 |= LVDCR0_DUSEL; + rcar_lvds_write(lvds, LVDCR0, lvdcr0); +@@ -74,6 +71,10 @@ static void rcar_du_lvdsenc_start_gen2(struct rcar_du_lvdsenc *lvds, + LVDCR1_CHSTBY_GEN2(1) | LVDCR1_CHSTBY_GEN2(0) | + LVDCR1_CLKSTBY_GEN2); + ++ /* Enable LVDS operation and turn bias circuitry on. */ ++ lvdcr0 |= LVDCR0_BEN | LVDCR0_LVEN; ++ rcar_lvds_write(lvds, LVDCR0, lvdcr0); ++ + /* + * Turn the PLL on, wait for the startup delay, and turn the output + * on. +@@ -95,7 +96,7 @@ static void rcar_du_lvdsenc_start_gen3(struct rcar_du_lvdsenc *lvds, + u32 lvdcr0; + u32 pllcr; + +- /* PLL clock configuration */ ++ /* Set the PLL clock configuration and LVDS mode. */ + if (freq < 42000) + pllcr = LVDPLLCR_PLLDIVCNT_42M; + else if (freq < 85000) +@@ -107,6 +108,9 @@ static void rcar_du_lvdsenc_start_gen3(struct rcar_du_lvdsenc *lvds, + + rcar_lvds_write(lvds, LVDPLLCR, pllcr); + ++ lvdcr0 = lvds->mode << LVDCR0_LVMD_SHIFT; ++ rcar_lvds_write(lvds, LVDCR0, lvdcr0); ++ + /* Turn all the channels on. */ + rcar_lvds_write(lvds, LVDCR1, + LVDCR1_CHSTBY_GEN3(3) | LVDCR1_CHSTBY_GEN3(2) | +@@ -117,7 +121,7 @@ static void rcar_du_lvdsenc_start_gen3(struct rcar_du_lvdsenc *lvds, + * Turn the PLL on, set it to LVDS normal mode, wait for the startup + * delay and turn the output on. + */ +- lvdcr0 = (lvds->mode << LVDCR0_LVMD_SHIFT) | LVDCR0_PLLON; ++ lvdcr0 |= LVDCR0_PLLON; + rcar_lvds_write(lvds, LVDCR0, lvdcr0); + + lvdcr0 |= LVDCR0_PWD; +diff --git a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +index 1869c8bb76c8..bde65186a3c3 100644 +--- a/drivers/gpu/drm/rockchip/rockchip_drm_gem.c ++++ b/drivers/gpu/drm/rockchip/rockchip_drm_gem.c +@@ -262,7 +262,6 @@ static int rockchip_drm_gem_object_mmap(struct drm_gem_object *obj, + * VM_PFNMAP flag that was set by drm_gem_mmap_obj()/drm_gem_mmap(). + */ + vma->vm_flags &= ~VM_PFNMAP; +- vma->vm_pgoff = 0; + + if (rk_obj->pages) + ret = rockchip_drm_gem_object_mmap_iommu(obj, vma); +@@ -297,6 +296,12 @@ int rockchip_gem_mmap(struct file *filp, struct vm_area_struct *vma) + if (ret) + return ret; + ++ /* ++ * Set vm_pgoff (used as a fake buffer offset by DRM) to 0 and map the ++ * whole buffer from the start. ++ */ ++ vma->vm_pgoff = 0; ++ + obj = vma->vm_private_data; + + return rockchip_drm_gem_object_mmap(obj, vma); +diff --git a/drivers/gpu/drm/sun4i/sun4i_dotclock.c b/drivers/gpu/drm/sun4i/sun4i_dotclock.c +index d401156490f3..4460ca46a350 100644 +--- a/drivers/gpu/drm/sun4i/sun4i_dotclock.c ++++ b/drivers/gpu/drm/sun4i/sun4i_dotclock.c +@@ -129,10 +129,13 @@ static int sun4i_dclk_get_phase(struct clk_hw *hw) + static int sun4i_dclk_set_phase(struct clk_hw *hw, int degrees) + { + struct sun4i_dclk *dclk = hw_to_dclk(hw); ++ u32 val = degrees / 120; ++ ++ val <<= 28; + + regmap_update_bits(dclk->regmap, SUN4I_TCON0_IO_POL_REG, + GENMASK(29, 28), +- degrees / 120); ++ val); + + return 0; + } +diff --git a/drivers/gpu/drm/tegra/drm.c b/drivers/gpu/drm/tegra/drm.c +index 597d563d636a..0598b4c18c25 100644 +--- a/drivers/gpu/drm/tegra/drm.c ++++ b/drivers/gpu/drm/tegra/drm.c +@@ -250,6 +250,7 @@ static void tegra_drm_unload(struct drm_device *drm) + + drm_kms_helper_poll_fini(drm); + tegra_drm_fb_exit(drm); ++ drm_atomic_helper_shutdown(drm); + drm_mode_config_cleanup(drm); + + err = host1x_device_exit(device); +diff --git a/drivers/gpu/drm/virtio/virtgpu_ioctl.c b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +index b94bd5440e57..ed9c443bb8a1 100644 +--- a/drivers/gpu/drm/virtio/virtgpu_ioctl.c ++++ b/drivers/gpu/drm/virtio/virtgpu_ioctl.c +@@ -196,6 +196,9 @@ static int virtio_gpu_getparam_ioctl(struct drm_device *dev, void *data, + case VIRTGPU_PARAM_3D_FEATURES: + value = vgdev->has_virgl_3d == true ? 1 : 0; + break; ++ case VIRTGPU_PARAM_CAPSET_QUERY_FIX: ++ value = 1; ++ break; + default: + return -EINVAL; + } +@@ -471,7 +474,7 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, + { + struct virtio_gpu_device *vgdev = dev->dev_private; + struct drm_virtgpu_get_caps *args = data; +- int size; ++ unsigned size, host_caps_size; + int i; + int found_valid = -1; + int ret; +@@ -480,6 +483,10 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, + if (vgdev->num_capsets == 0) + return -ENOSYS; + ++ /* don't allow userspace to pass 0 */ ++ if (args->size == 0) ++ return -EINVAL; ++ + spin_lock(&vgdev->display_info_lock); + for (i = 0; i < vgdev->num_capsets; i++) { + if (vgdev->capsets[i].id == args->cap_set_id) { +@@ -495,11 +502,9 @@ static int virtio_gpu_get_caps_ioctl(struct drm_device *dev, + return -EINVAL; + } + +- size = vgdev->capsets[found_valid].max_size; +- if (args->size > size) { +- spin_unlock(&vgdev->display_info_lock); +- return -EINVAL; +- } ++ host_caps_size = vgdev->capsets[found_valid].max_size; ++ /* only copy to user the minimum of the host caps size or the guest caps size */ ++ size = min(args->size, host_caps_size); + + list_for_each_entry(cache_ent, &vgdev->cap_cache, head) { + if (cache_ent->id == args->cap_set_id && +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h +index 557a033fb610..8545488aa0cf 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_msg.h +@@ -135,17 +135,24 @@ + + #else + +-/* In the 32-bit version of this macro, we use "m" because there is no +- * more register left for bp ++/* ++ * In the 32-bit version of this macro, we store bp in a memory location ++ * because we've ran out of registers. ++ * Now we can't reference that memory location while we've modified ++ * %esp or %ebp, so we first push it on the stack, just before we push ++ * %ebp, and then when we need it we read it from the stack where we ++ * just pushed it. + */ + #define VMW_PORT_HB_OUT(cmd, in_ecx, in_si, in_di, \ + port_num, magic, bp, \ + eax, ebx, ecx, edx, si, di) \ + ({ \ +- asm volatile ("push %%ebp;" \ +- "mov %12, %%ebp;" \ ++ asm volatile ("push %12;" \ ++ "push %%ebp;" \ ++ "mov 0x04(%%esp), %%ebp;" \ + "rep outsb;" \ +- "pop %%ebp;" : \ ++ "pop %%ebp;" \ ++ "add $0x04, %%esp;" : \ + "=a"(eax), \ + "=b"(ebx), \ + "=c"(ecx), \ +@@ -167,10 +174,12 @@ + port_num, magic, bp, \ + eax, ebx, ecx, edx, si, di) \ + ({ \ +- asm volatile ("push %%ebp;" \ +- "mov %12, %%ebp;" \ ++ asm volatile ("push %12;" \ ++ "push %%ebp;" \ ++ "mov 0x04(%%esp), %%ebp;" \ + "rep insb;" \ +- "pop %%ebp" : \ ++ "pop %%ebp;" \ ++ "add $0x04, %%esp;" : \ + "=a"(eax), \ + "=b"(ebx), \ + "=c"(ecx), \ +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +index aacce4753a62..205a5f4b58f3 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_scrn.c +@@ -453,7 +453,11 @@ vmw_sou_primary_plane_cleanup_fb(struct drm_plane *plane, + struct drm_plane_state *old_state) + { + struct vmw_plane_state *vps = vmw_plane_state_to_vps(old_state); ++ struct drm_crtc *crtc = plane->state->crtc ? ++ plane->state->crtc : old_state->crtc; + ++ if (vps->dmabuf) ++ vmw_dmabuf_unpin(vmw_priv(crtc->dev), vps->dmabuf, false); + vmw_dmabuf_unreference(&vps->dmabuf); + vps->dmabuf_size = 0; + +@@ -491,10 +495,17 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane, + } + + size = new_state->crtc_w * new_state->crtc_h * 4; ++ dev_priv = vmw_priv(crtc->dev); + + if (vps->dmabuf) { +- if (vps->dmabuf_size == size) +- return 0; ++ if (vps->dmabuf_size == size) { ++ /* ++ * Note that this might temporarily up the pin-count ++ * to 2, until cleanup_fb() is called. ++ */ ++ return vmw_dmabuf_pin_in_vram(dev_priv, vps->dmabuf, ++ true); ++ } + + vmw_dmabuf_unreference(&vps->dmabuf); + vps->dmabuf_size = 0; +@@ -504,7 +515,6 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane, + if (!vps->dmabuf) + return -ENOMEM; + +- dev_priv = vmw_priv(crtc->dev); + vmw_svga_enable(dev_priv); + + /* After we have alloced the backing store might not be able to +@@ -515,13 +525,18 @@ vmw_sou_primary_plane_prepare_fb(struct drm_plane *plane, + &vmw_vram_ne_placement, + false, &vmw_dmabuf_bo_free); + vmw_overlay_resume_all(dev_priv); +- +- if (ret != 0) ++ if (ret) { + vps->dmabuf = NULL; /* vmw_dmabuf_init frees on error */ +- else +- vps->dmabuf_size = size; ++ return ret; ++ } + +- return ret; ++ vps->dmabuf_size = size; ++ ++ /* ++ * TTM already thinks the buffer is pinned, but make sure the ++ * pin_count is upped. ++ */ ++ return vmw_dmabuf_pin_in_vram(dev_priv, vps->dmabuf, true); + } + + +diff --git a/drivers/gpu/ipu-v3/ipu-pre.c b/drivers/gpu/ipu-v3/ipu-pre.c +index c860a7997cb5..1d1612e28854 100644 +--- a/drivers/gpu/ipu-v3/ipu-pre.c ++++ b/drivers/gpu/ipu-v3/ipu-pre.c +@@ -125,11 +125,14 @@ ipu_pre_lookup_by_phandle(struct device *dev, const char *name, int index) + if (pre_node == pre->dev->of_node) { + mutex_unlock(&ipu_pre_list_mutex); + device_link_add(dev, pre->dev, DL_FLAG_AUTOREMOVE); ++ of_node_put(pre_node); + return pre; + } + } + mutex_unlock(&ipu_pre_list_mutex); + ++ of_node_put(pre_node); ++ + return NULL; + } + +diff --git a/drivers/gpu/ipu-v3/ipu-prg.c b/drivers/gpu/ipu-v3/ipu-prg.c +index 0013ca9f72c8..1c36fa3a90e2 100644 +--- a/drivers/gpu/ipu-v3/ipu-prg.c ++++ b/drivers/gpu/ipu-v3/ipu-prg.c +@@ -101,11 +101,14 @@ ipu_prg_lookup_by_phandle(struct device *dev, const char *name, int ipu_id) + mutex_unlock(&ipu_prg_list_mutex); + device_link_add(dev, prg->dev, DL_FLAG_AUTOREMOVE); + prg->id = ipu_id; ++ of_node_put(prg_node); + return prg; + } + } + mutex_unlock(&ipu_prg_list_mutex); + ++ of_node_put(prg_node); ++ + return NULL; + } + +@@ -249,10 +252,14 @@ void ipu_prg_channel_disable(struct ipuv3_channel *ipu_chan) + { + int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num); + struct ipu_prg *prg = ipu_chan->ipu->prg_priv; +- struct ipu_prg_channel *chan = &prg->chan[prg_chan]; ++ struct ipu_prg_channel *chan; + u32 val; + +- if (!chan->enabled || prg_chan < 0) ++ if (prg_chan < 0) ++ return; ++ ++ chan = &prg->chan[prg_chan]; ++ if (!chan->enabled) + return; + + clk_prepare_enable(prg->clk_ipg); +@@ -279,13 +286,15 @@ int ipu_prg_channel_configure(struct ipuv3_channel *ipu_chan, + { + int prg_chan = ipu_prg_ipu_to_prg_chan(ipu_chan->num); + struct ipu_prg *prg = ipu_chan->ipu->prg_priv; +- struct ipu_prg_channel *chan = &prg->chan[prg_chan]; ++ struct ipu_prg_channel *chan; + u32 val; + int ret; + + if (prg_chan < 0) + return prg_chan; + ++ chan = &prg->chan[prg_chan]; ++ + if (chan->enabled) { + ipu_pre_update(prg->pres[chan->used_pre], *eba); + return 0; +diff --git a/drivers/hwmon/nct6775.c b/drivers/hwmon/nct6775.c +index c219e43b8f02..f5f3f8cf57ea 100644 +--- a/drivers/hwmon/nct6775.c ++++ b/drivers/hwmon/nct6775.c +@@ -1469,7 +1469,7 @@ static void nct6775_update_pwm(struct device *dev) + duty_is_dc = data->REG_PWM_MODE[i] && + (nct6775_read_value(data, data->REG_PWM_MODE[i]) + & data->PWM_MODE_MASK[i]); +- data->pwm_mode[i] = duty_is_dc; ++ data->pwm_mode[i] = !duty_is_dc; + + fanmodecfg = nct6775_read_value(data, data->REG_FAN_MODE[i]); + for (j = 0; j < ARRAY_SIZE(data->REG_PWM); j++) { +@@ -2350,7 +2350,7 @@ show_pwm_mode(struct device *dev, struct device_attribute *attr, char *buf) + struct nct6775_data *data = nct6775_update_device(dev); + struct sensor_device_attribute *sattr = to_sensor_dev_attr(attr); + +- return sprintf(buf, "%d\n", !data->pwm_mode[sattr->index]); ++ return sprintf(buf, "%d\n", data->pwm_mode[sattr->index]); + } + + static ssize_t +@@ -2371,9 +2371,9 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr, + if (val > 1) + return -EINVAL; + +- /* Setting DC mode is not supported for all chips/channels */ ++ /* Setting DC mode (0) is not supported for all chips/channels */ + if (data->REG_PWM_MODE[nr] == 0) { +- if (val) ++ if (!val) + return -EINVAL; + return count; + } +@@ -2382,7 +2382,7 @@ store_pwm_mode(struct device *dev, struct device_attribute *attr, + data->pwm_mode[nr] = val; + reg = nct6775_read_value(data, data->REG_PWM_MODE[nr]); + reg &= ~data->PWM_MODE_MASK[nr]; +- if (val) ++ if (!val) + reg |= data->PWM_MODE_MASK[nr]; + nct6775_write_value(data, data->REG_PWM_MODE[nr], reg); + mutex_unlock(&data->update_lock); +diff --git a/drivers/hwmon/pmbus/adm1275.c b/drivers/hwmon/pmbus/adm1275.c +index 00d6995af4c2..8a44e94d5679 100644 +--- a/drivers/hwmon/pmbus/adm1275.c ++++ b/drivers/hwmon/pmbus/adm1275.c +@@ -154,7 +154,7 @@ static int adm1275_read_word_data(struct i2c_client *client, int page, int reg) + const struct adm1275_data *data = to_adm1275_data(info); + int ret = 0; + +- if (page) ++ if (page > 0) + return -ENXIO; + + switch (reg) { +@@ -240,7 +240,7 @@ static int adm1275_write_word_data(struct i2c_client *client, int page, int reg, + const struct adm1275_data *data = to_adm1275_data(info); + int ret; + +- if (page) ++ if (page > 0) + return -ENXIO; + + switch (reg) { +diff --git a/drivers/hwmon/pmbus/max8688.c b/drivers/hwmon/pmbus/max8688.c +index dd4883a19045..e951f9b87abb 100644 +--- a/drivers/hwmon/pmbus/max8688.c ++++ b/drivers/hwmon/pmbus/max8688.c +@@ -45,7 +45,7 @@ static int max8688_read_word_data(struct i2c_client *client, int page, int reg) + { + int ret; + +- if (page) ++ if (page > 0) + return -ENXIO; + + switch (reg) { +diff --git a/drivers/hwtracing/coresight/coresight-cpu-debug.c b/drivers/hwtracing/coresight/coresight-cpu-debug.c +index 6ea62c62ff27..9cdb3fbc8c1f 100644 +--- a/drivers/hwtracing/coresight/coresight-cpu-debug.c ++++ b/drivers/hwtracing/coresight/coresight-cpu-debug.c +@@ -315,7 +315,7 @@ static void debug_dump_regs(struct debug_drvdata *drvdata) + } + + pc = debug_adjust_pc(drvdata); +- dev_emerg(dev, " EDPCSR: [<%p>] %pS\n", (void *)pc, (void *)pc); ++ dev_emerg(dev, " EDPCSR: [<%px>] %pS\n", (void *)pc, (void *)pc); + + if (drvdata->edcidsr_present) + dev_emerg(dev, " EDCIDSR: %08x\n", drvdata->edcidsr); +diff --git a/drivers/hwtracing/intel_th/core.c b/drivers/hwtracing/intel_th/core.c +index 1a023e30488c..c1793313bb08 100644 +--- a/drivers/hwtracing/intel_th/core.c ++++ b/drivers/hwtracing/intel_th/core.c +@@ -935,7 +935,7 @@ EXPORT_SYMBOL_GPL(intel_th_trace_disable); + int intel_th_set_output(struct intel_th_device *thdev, + unsigned int master) + { +- struct intel_th_device *hub = to_intel_th_device(thdev->dev.parent); ++ struct intel_th_device *hub = to_intel_th_hub(thdev); + struct intel_th_driver *hubdrv = to_intel_th_driver(hub->dev.driver); + + if (!hubdrv->set_output) +diff --git a/drivers/i2c/busses/i2c-mv64xxx.c b/drivers/i2c/busses/i2c-mv64xxx.c +index a832c45276a4..b0fb97823d6a 100644 +--- a/drivers/i2c/busses/i2c-mv64xxx.c ++++ b/drivers/i2c/busses/i2c-mv64xxx.c +@@ -844,12 +844,16 @@ mv64xxx_of_config(struct mv64xxx_i2c_data *drv_data, + */ + if (of_device_is_compatible(np, "marvell,mv78230-i2c")) { + drv_data->offload_enabled = true; +- drv_data->errata_delay = true; ++ /* The delay is only needed in standard mode (100kHz) */ ++ if (bus_freq <= 100000) ++ drv_data->errata_delay = true; + } + + if (of_device_is_compatible(np, "marvell,mv78230-a0-i2c")) { + drv_data->offload_enabled = false; +- drv_data->errata_delay = true; ++ /* The delay is only needed in standard mode (100kHz) */ ++ if (bus_freq <= 100000) ++ drv_data->errata_delay = true; + } + + if (of_device_is_compatible(np, "allwinner,sun6i-a31-i2c")) +diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c +index 6ff0be8cbdc9..4de45db76756 100644 +--- a/drivers/ide/ide-cd.c ++++ b/drivers/ide/ide-cd.c +@@ -1614,6 +1614,8 @@ static int idecd_open(struct block_device *bdev, fmode_t mode) + struct cdrom_info *info; + int rc = -ENXIO; + ++ check_disk_change(bdev); ++ + mutex_lock(&ide_cd_mutex); + info = ide_cd_get(bdev->bd_disk); + if (!info) +diff --git a/drivers/infiniband/core/multicast.c b/drivers/infiniband/core/multicast.c +index 45f2f095f793..4eb72ff539fc 100644 +--- a/drivers/infiniband/core/multicast.c ++++ b/drivers/infiniband/core/multicast.c +@@ -724,21 +724,19 @@ int ib_init_ah_from_mcmember(struct ib_device *device, u8 port_num, + { + int ret; + u16 gid_index; +- u8 p; +- +- if (rdma_protocol_roce(device, port_num)) { +- ret = ib_find_cached_gid_by_port(device, &rec->port_gid, +- gid_type, port_num, +- ndev, +- &gid_index); +- } else if (rdma_protocol_ib(device, port_num)) { +- ret = ib_find_cached_gid(device, &rec->port_gid, +- IB_GID_TYPE_IB, NULL, &p, +- &gid_index); +- } else { +- ret = -EINVAL; +- } + ++ /* GID table is not based on the netdevice for IB link layer, ++ * so ignore ndev during search. ++ */ ++ if (rdma_protocol_ib(device, port_num)) ++ ndev = NULL; ++ else if (!rdma_protocol_roce(device, port_num)) ++ return -EINVAL; ++ ++ ret = ib_find_cached_gid_by_port(device, &rec->port_gid, ++ gid_type, port_num, ++ ndev, ++ &gid_index); + if (ret) + return ret; + +diff --git a/drivers/infiniband/core/rdma_core.c b/drivers/infiniband/core/rdma_core.c +index 9cb801d1fe54..1984d6cee3e0 100644 +--- a/drivers/infiniband/core/rdma_core.c ++++ b/drivers/infiniband/core/rdma_core.c +@@ -486,12 +486,13 @@ int rdma_explicit_destroy(struct ib_uobject *uobject) + ret = uobject->type->type_class->remove_commit(uobject, + RDMA_REMOVE_DESTROY); + if (ret) +- return ret; ++ goto out; + + uobject->type = &null_obj_type; + ++out: + up_read(&ucontext->cleanup_rwsem); +- return 0; ++ return ret; + } + + static void alloc_commit_idr_uobject(struct ib_uobject *uobj) +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c +index ab5e1024fea9..b81d2597f563 100644 +--- a/drivers/infiniband/core/sa_query.c ++++ b/drivers/infiniband/core/sa_query.c +@@ -1291,10 +1291,9 @@ int ib_init_ah_from_path(struct ib_device *device, u8 port_num, + + resolved_dev = dev_get_by_index(dev_addr.net, + dev_addr.bound_dev_if); +- if (resolved_dev->flags & IFF_LOOPBACK) { +- dev_put(resolved_dev); +- resolved_dev = idev; +- dev_hold(resolved_dev); ++ if (!resolved_dev) { ++ dev_put(idev); ++ return -ENODEV; + } + ndev = ib_get_ndev_from_path(rec); + rcu_read_lock(); +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index c65f0e8ecbd6..e47baf0950e3 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1315,7 +1315,7 @@ static ssize_t ucma_set_option(struct ucma_file *file, const char __user *inbuf, + if (IS_ERR(ctx)) + return PTR_ERR(ctx); + +- if (unlikely(cmd.optval > KMALLOC_MAX_SIZE)) ++ if (unlikely(cmd.optlen > KMALLOC_MAX_SIZE)) + return -EINVAL; + + optval = memdup_user((void __user *) (unsigned long) cmd.optval, +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 9a4e899d94b3..2b6c9b516070 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -119,7 +119,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + umem->length = size; + umem->address = addr; + umem->page_shift = PAGE_SHIFT; +- umem->pid = get_task_pid(current, PIDTYPE_PID); + /* + * We ask for writable memory if any of the following + * access flags are set. "Local write" and "remote write" +@@ -132,7 +131,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND)); + + if (access & IB_ACCESS_ON_DEMAND) { +- put_pid(umem->pid); + ret = ib_umem_odp_get(context, umem, access); + if (ret) { + kfree(umem); +@@ -148,7 +146,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + + page_list = (struct page **) __get_free_page(GFP_KERNEL); + if (!page_list) { +- put_pid(umem->pid); + kfree(umem); + return ERR_PTR(-ENOMEM); + } +@@ -231,7 +228,6 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + if (ret < 0) { + if (need_release) + __ib_umem_release(context->device, umem, 0); +- put_pid(umem->pid); + kfree(umem); + } else + current->mm->pinned_vm = locked; +@@ -274,8 +270,7 @@ void ib_umem_release(struct ib_umem *umem) + + __ib_umem_release(umem->context->device, umem, 1); + +- task = get_pid_task(umem->pid, PIDTYPE_PID); +- put_pid(umem->pid); ++ task = get_pid_task(umem->context->tgid, PIDTYPE_PID); + if (!task) + goto out; + mm = get_task_mm(task); +diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c +index 8f2dc79ad4ec..5e9f72ea4579 100644 +--- a/drivers/infiniband/core/uverbs_ioctl.c ++++ b/drivers/infiniband/core/uverbs_ioctl.c +@@ -59,6 +59,9 @@ static int uverbs_process_attr(struct ib_device *ibdev, + return 0; + } + ++ if (test_bit(attr_id, attr_bundle_h->valid_bitmap)) ++ return -EINVAL; ++ + spec = &attr_spec_bucket->attrs[attr_id]; + e = &elements[attr_id]; + e->uattr = uattr_ptr; +diff --git a/drivers/infiniband/core/uverbs_ioctl_merge.c b/drivers/infiniband/core/uverbs_ioctl_merge.c +index 76ddb6564578..48a99dce976c 100644 +--- a/drivers/infiniband/core/uverbs_ioctl_merge.c ++++ b/drivers/infiniband/core/uverbs_ioctl_merge.c +@@ -114,6 +114,7 @@ static size_t get_elements_above_id(const void **iters, + short min = SHRT_MAX; + const void *elem; + int i, j, last_stored = -1; ++ unsigned int equal_min = 0; + + for_each_element(elem, i, j, elements, num_elements, num_offset, + data_offset) { +@@ -136,6 +137,10 @@ static size_t get_elements_above_id(const void **iters, + */ + iters[last_stored == i ? num_iters - 1 : num_iters++] = elem; + last_stored = i; ++ if (min == GET_ID(id)) ++ equal_min++; ++ else ++ equal_min = 1; + min = GET_ID(id); + } + +@@ -146,15 +151,10 @@ static size_t get_elements_above_id(const void **iters, + * Therefore, we need to clean the beginning of the array to make sure + * all ids of final elements are equal to min. + */ +- for (i = num_iters - 1; i >= 0 && +- GET_ID(*(u16 *)(iters[i] + id_offset)) == min; i--) +- ; +- +- num_iters -= i + 1; +- memmove(iters, iters + i + 1, sizeof(*iters) * num_iters); ++ memmove(iters, iters + num_iters - equal_min, sizeof(*iters) * equal_min); + + *min_id = min; +- return num_iters; ++ return equal_min; + } + + #define find_max_element_entry_id(num_elements, elements, num_objects_fld, \ +@@ -322,7 +322,7 @@ static struct uverbs_method_spec *build_method_with_attrs(const struct uverbs_me + hash = kzalloc(sizeof(*hash) + + ALIGN(sizeof(*hash->attrs) * (attr_max_bucket + 1), + sizeof(long)) + +- BITS_TO_LONGS(attr_max_bucket) * sizeof(long), ++ BITS_TO_LONGS(attr_max_bucket + 1) * sizeof(long), + GFP_KERNEL); + if (!hash) { + res = -ENOMEM; +@@ -509,7 +509,7 @@ static struct uverbs_object_spec *build_object_with_methods(const struct uverbs_ + * first handler which != NULL. This also defines the + * set of flags used for this handler. + */ +- for (i = num_object_defs - 1; ++ for (i = num_method_defs - 1; + i >= 0 && !method_defs[i]->handler; i--) + ; + hash->methods[min_id++] = method; +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index b210495ff33c..ef9135aa392c 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1180,7 +1180,7 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd, + rc = bnxt_qplib_create_qp(&rdev->qplib_res, &qp->qplib_qp); + if (rc) { + dev_err(rdev_to_dev(rdev), "Failed to create HW QP"); +- goto fail; ++ goto free_umem; + } + } + +@@ -1208,6 +1208,13 @@ struct ib_qp *bnxt_re_create_qp(struct ib_pd *ib_pd, + return &qp->ib_qp; + qp_destroy: + bnxt_qplib_destroy_qp(&rdev->qplib_res, &qp->qplib_qp); ++free_umem: ++ if (udata) { ++ if (qp->rumem) ++ ib_umem_release(qp->rumem); ++ if (qp->sumem) ++ ib_umem_release(qp->sumem); ++ } + fail: + kfree(qp); + return ERR_PTR(rc); +@@ -1956,10 +1963,13 @@ static int bnxt_re_build_inv_wqe(struct ib_send_wr *wr, + wqe->type = BNXT_QPLIB_SWQE_TYPE_LOCAL_INV; + wqe->local_inv.inv_l_key = wr->ex.invalidate_rkey; + ++ /* Need unconditional fence for local invalidate ++ * opcode to work as expected. ++ */ ++ wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE; ++ + if (wr->send_flags & IB_SEND_SIGNALED) + wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP; +- if (wr->send_flags & IB_SEND_FENCE) +- wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE; + if (wr->send_flags & IB_SEND_SOLICITED) + wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SOLICIT_EVENT; + +@@ -1980,8 +1990,12 @@ static int bnxt_re_build_reg_wqe(struct ib_reg_wr *wr, + wqe->frmr.levels = qplib_frpl->hwq.level + 1; + wqe->type = BNXT_QPLIB_SWQE_TYPE_REG_MR; + +- if (wr->wr.send_flags & IB_SEND_FENCE) +- wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE; ++ /* Need unconditional fence for reg_mr ++ * opcode to function as expected. ++ */ ++ ++ wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_UC_FENCE; ++ + if (wr->wr.send_flags & IB_SEND_SIGNALED) + wqe->flags |= BNXT_QPLIB_SWQE_FLAGS_SIGNAL_COMP; + +diff --git a/drivers/infiniband/hw/bnxt_re/main.c b/drivers/infiniband/hw/bnxt_re/main.c +index e7450ea92aa9..bf811b23bc95 100644 +--- a/drivers/infiniband/hw/bnxt_re/main.c ++++ b/drivers/infiniband/hw/bnxt_re/main.c +@@ -1240,9 +1240,12 @@ static void bnxt_re_task(struct work_struct *work) + switch (re_work->event) { + case NETDEV_REGISTER: + rc = bnxt_re_ib_reg(rdev); +- if (rc) ++ if (rc) { + dev_err(rdev_to_dev(rdev), + "Failed to register with IB: %#x", rc); ++ bnxt_re_remove_one(rdev); ++ bnxt_re_dev_unreg(rdev); ++ } + break; + case NETDEV_UP: + bnxt_re_dispatch_event(&rdev->ibdev, NULL, 1, +@@ -1398,6 +1401,11 @@ static void __exit bnxt_re_mod_exit(void) + + list_for_each_entry(rdev, &to_be_deleted, list) { + dev_info(rdev_to_dev(rdev), "Unregistering Device"); ++ /* ++ * Flush out any scheduled tasks before destroying the ++ * resources ++ */ ++ flush_workqueue(bnxt_re_wq); + bnxt_re_dev_stop(rdev); + bnxt_re_ib_unreg(rdev, true); + bnxt_re_remove_one(rdev); +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +index 2bdb1562bd21..8d91733009a4 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.c +@@ -457,7 +457,11 @@ int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + int rc; + + RCFW_CMD_PREP(req, INITIALIZE_FW, cmd_flags); +- ++ /* Supply (log-base-2-of-host-page-size - base-page-shift) ++ * to bono to adjust the doorbell page sizes. ++ */ ++ req.log2_dbr_pg_size = cpu_to_le16(PAGE_SHIFT - ++ RCFW_DBR_BASE_PAGE_SHIFT); + /* + * VFs need not setup the HW context area, PF + * shall setup this area for VF. Skipping the +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 85b16da287f9..7c85e3c4445b 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -49,6 +49,7 @@ + #define RCFW_COMM_SIZE 0x104 + + #define RCFW_DBR_PCI_BAR_REGION 2 ++#define RCFW_DBR_BASE_PAGE_SHIFT 12 + + #define RCFW_CMD_PREP(req, CMD, cmd_flags) \ + do { \ +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_sp.c b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +index e277e54a05eb..9536de8c5fb8 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_sp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_sp.c +@@ -130,7 +130,8 @@ int bnxt_qplib_get_dev_attr(struct bnxt_qplib_rcfw *rcfw, + attr->max_pkey = le32_to_cpu(sb->max_pkeys); + + attr->max_inline_data = le32_to_cpu(sb->max_inline_data); +- attr->l2_db_size = (sb->l2_db_space_size + 1) * PAGE_SIZE; ++ attr->l2_db_size = (sb->l2_db_space_size + 1) * ++ (0x01 << RCFW_DBR_BASE_PAGE_SHIFT); + attr->max_sgid = le32_to_cpu(sb->max_gid); + + strlcpy(attr->fw_ver, "20.6.28.0", sizeof(attr->fw_ver)); +diff --git a/drivers/infiniband/hw/bnxt_re/roce_hsi.h b/drivers/infiniband/hw/bnxt_re/roce_hsi.h +index eeb55b2db57e..480f592e5b4b 100644 +--- a/drivers/infiniband/hw/bnxt_re/roce_hsi.h ++++ b/drivers/infiniband/hw/bnxt_re/roce_hsi.h +@@ -1734,7 +1734,30 @@ struct cmdq_initialize_fw { + #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_2M (0x3UL << 4) + #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_8M (0x4UL << 4) + #define CMDQ_INITIALIZE_FW_TIM_PG_SIZE_PG_1G (0x5UL << 4) +- __le16 reserved16; ++ /* This value is (log-base-2-of-DBR-page-size - 12). ++ * 0 for 4KB. HW supported values are enumerated below. ++ */ ++ __le16 log2_dbr_pg_size; ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_MASK 0xfUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_SFT 0 ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4K 0x0UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8K 0x1UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16K 0x2UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32K 0x3UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64K 0x4UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128K 0x5UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_256K 0x6UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_512K 0x7UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_1M 0x8UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_2M 0x9UL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_4M 0xaUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_8M 0xbUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_16M 0xcUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_32M 0xdUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_64M 0xeUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M 0xfUL ++ #define CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_LAST \ ++ CMDQ_INITIALIZE_FW_LOG2_DBR_PG_SIZE_PG_128M + __le64 qpc_page_dir; + __le64 mrw_page_dir; + __le64 srq_page_dir; +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 82114ba86041..259562282668 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -5945,6 +5945,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd, + u64 status; + u32 sw_index; + int i = 0; ++ unsigned long irq_flags; + + sw_index = dd->hw_to_sw[hw_context]; + if (sw_index >= dd->num_send_contexts) { +@@ -5954,10 +5955,12 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd, + return; + } + sci = &dd->send_contexts[sw_index]; ++ spin_lock_irqsave(&dd->sc_lock, irq_flags); + sc = sci->sc; + if (!sc) { + dd_dev_err(dd, "%s: context %u(%u): no sc?\n", __func__, + sw_index, hw_context); ++ spin_unlock_irqrestore(&dd->sc_lock, irq_flags); + return; + } + +@@ -5979,6 +5982,7 @@ static void is_sendctxt_err_int(struct hfi1_devdata *dd, + */ + if (sc->type != SC_USER) + queue_work(dd->pport->hfi1_wq, &sc->halt_work); ++ spin_unlock_irqrestore(&dd->sc_lock, irq_flags); + + /* + * Update the counters for the corresponding status bits. +diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c +index cab796341697..d92f639c287f 100644 +--- a/drivers/infiniband/hw/mlx4/cq.c ++++ b/drivers/infiniband/hw/mlx4/cq.c +@@ -597,6 +597,7 @@ static void use_tunnel_data(struct mlx4_ib_qp *qp, struct mlx4_ib_cq *cq, struct + wc->dlid_path_bits = 0; + + if (is_eth) { ++ wc->slid = 0; + wc->vlan_id = be16_to_cpu(hdr->tun.sl_vid); + memcpy(&(wc->smac[0]), (char *)&hdr->tun.mac_31_0, 4); + memcpy(&(wc->smac[4]), (char *)&hdr->tun.slid_mac_47_32, 2); +@@ -845,7 +846,6 @@ static int mlx4_ib_poll_one(struct mlx4_ib_cq *cq, + } + } + +- wc->slid = be16_to_cpu(cqe->rlid); + g_mlpath_rqpn = be32_to_cpu(cqe->g_mlpath_rqpn); + wc->src_qp = g_mlpath_rqpn & 0xffffff; + wc->dlid_path_bits = (g_mlpath_rqpn >> 24) & 0x7f; +@@ -854,6 +854,7 @@ static int mlx4_ib_poll_one(struct mlx4_ib_cq *cq, + wc->wc_flags |= mlx4_ib_ipoib_csum_ok(cqe->status, + cqe->checksum) ? IB_WC_IP_CSUM_OK : 0; + if (is_eth) { ++ wc->slid = 0; + wc->sl = be16_to_cpu(cqe->sl_vid) >> 13; + if (be32_to_cpu(cqe->vlan_my_qpn) & + MLX4_CQE_CVLAN_PRESENT_MASK) { +@@ -865,6 +866,7 @@ static int mlx4_ib_poll_one(struct mlx4_ib_cq *cq, + memcpy(wc->smac, cqe->smac, ETH_ALEN); + wc->wc_flags |= (IB_WC_WITH_VLAN | IB_WC_WITH_SMAC); + } else { ++ wc->slid = be16_to_cpu(cqe->rlid); + wc->sl = be16_to_cpu(cqe->sl_vid) >> 12; + wc->vlan_id = 0xffff; + } +diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c +index 8c681a36e6c7..e2beb182d54c 100644 +--- a/drivers/infiniband/hw/mlx4/main.c ++++ b/drivers/infiniband/hw/mlx4/main.c +@@ -219,8 +219,6 @@ static int mlx4_ib_update_gids_v1_v2(struct gid_entry *gids, + gid_tbl[i].version = 2; + if (!ipv6_addr_v4mapped((struct in6_addr *)&gids[i].gid)) + gid_tbl[i].type = 1; +- else +- memset(&gid_tbl[i].gid, 0, 12); + } + } + +@@ -366,8 +364,13 @@ static int mlx4_ib_del_gid(struct ib_device *device, + if (!gids) { + ret = -ENOMEM; + } else { +- for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) +- memcpy(&gids[i].gid, &port_gid_table->gids[i].gid, sizeof(union ib_gid)); ++ for (i = 0; i < MLX4_MAX_PORT_GIDS; i++) { ++ memcpy(&gids[i].gid, ++ &port_gid_table->gids[i].gid, ++ sizeof(union ib_gid)); ++ gids[i].gid_type = ++ port_gid_table->gids[i].gid_type; ++ } + } + } + spin_unlock_bh(&iboe->lock); +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index faedc080a5e6..d804880d637a 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -224,7 +224,6 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, + wc->ex.invalidate_rkey = be32_to_cpu(cqe->imm_inval_pkey); + break; + } +- wc->slid = be16_to_cpu(cqe->slid); + wc->src_qp = be32_to_cpu(cqe->flags_rqpn) & 0xffffff; + wc->dlid_path_bits = cqe->ml_path; + g = (be32_to_cpu(cqe->flags_rqpn) >> 28) & 3; +@@ -239,10 +238,12 @@ static void handle_responder(struct ib_wc *wc, struct mlx5_cqe64 *cqe, + } + + if (ll != IB_LINK_LAYER_ETHERNET) { ++ wc->slid = be16_to_cpu(cqe->slid); + wc->sl = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0xf; + return; + } + ++ wc->slid = 0; + vlan_present = cqe->l4_l3_hdr_type & 0x1; + roce_packet_type = (be32_to_cpu(cqe->flags_rqpn) >> 24) & 0x3; + if (vlan_present) { +diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c +index fb5302ee57c7..ab70194a73db 100644 +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -270,6 +270,9 @@ static int mlx5_query_port_roce(struct ib_device *device, u8 port_num, + if (err) + return err; + ++ props->active_width = IB_WIDTH_4X; ++ props->active_speed = IB_SPEED_QDR; ++ + translate_eth_proto_oper(eth_prot_oper, &props->active_speed, + &props->active_width); + +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c +index 749fe906a5b6..ef9ee6c328a1 100644 +--- a/drivers/infiniband/hw/mlx5/qp.c ++++ b/drivers/infiniband/hw/mlx5/qp.c +@@ -2881,8 +2881,10 @@ static int __mlx5_ib_modify_qp(struct ib_qp *ibqp, + goto out; + + if (mlx5_cur >= MLX5_QP_NUM_STATE || mlx5_new >= MLX5_QP_NUM_STATE || +- !optab[mlx5_cur][mlx5_new]) ++ !optab[mlx5_cur][mlx5_new]) { ++ err = -EINVAL; + goto out; ++ } + + op = optab[mlx5_cur][mlx5_new]; + optpar = ib_mask_to_mlx5_opt(attr_mask); +diff --git a/drivers/infiniband/hw/qedr/main.c b/drivers/infiniband/hw/qedr/main.c +index 97d033f51dc9..ddb05b42e5e6 100644 +--- a/drivers/infiniband/hw/qedr/main.c ++++ b/drivers/infiniband/hw/qedr/main.c +@@ -782,7 +782,8 @@ static struct qedr_dev *qedr_add(struct qed_dev *cdev, struct pci_dev *pdev, + + dev->num_cnq = dev->ops->rdma_get_min_cnq_msix(cdev); + if (!dev->num_cnq) { +- DP_ERR(dev, "not enough CNQ resources.\n"); ++ DP_ERR(dev, "Failed. At least one CNQ is required.\n"); ++ rc = -ENOMEM; + goto init_err; + } + +diff --git a/drivers/infiniband/hw/qedr/verbs.c b/drivers/infiniband/hw/qedr/verbs.c +index 769ac07c3c8e..7f4cc9336442 100644 +--- a/drivers/infiniband/hw/qedr/verbs.c ++++ b/drivers/infiniband/hw/qedr/verbs.c +@@ -1663,14 +1663,15 @@ static void qedr_reset_qp_hwq_info(struct qedr_qp_hwq_info *qph) + + static int qedr_update_qp_state(struct qedr_dev *dev, + struct qedr_qp *qp, ++ enum qed_roce_qp_state cur_state, + enum qed_roce_qp_state new_state) + { + int status = 0; + +- if (new_state == qp->state) ++ if (new_state == cur_state) + return 0; + +- switch (qp->state) { ++ switch (cur_state) { + case QED_ROCE_QP_STATE_RESET: + switch (new_state) { + case QED_ROCE_QP_STATE_INIT: +@@ -1774,6 +1775,7 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + struct qedr_dev *dev = get_qedr_dev(&qp->dev->ibdev); + const struct ib_global_route *grh = rdma_ah_read_grh(&attr->ah_attr); + enum ib_qp_state old_qp_state, new_qp_state; ++ enum qed_roce_qp_state cur_state; + int rc = 0; + + DP_DEBUG(dev, QEDR_MSG_QP, +@@ -1903,18 +1905,23 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + SET_FIELD(qp_params.modify_flags, + QED_ROCE_MODIFY_QP_VALID_ACK_TIMEOUT, 1); + +- qp_params.ack_timeout = attr->timeout; +- if (attr->timeout) { +- u32 temp; +- +- temp = 4096 * (1UL << attr->timeout) / 1000 / 1000; +- /* FW requires [msec] */ +- qp_params.ack_timeout = temp; +- } else { +- /* Infinite */ ++ /* The received timeout value is an exponent used like this: ++ * "12.7.34 LOCAL ACK TIMEOUT ++ * Value representing the transport (ACK) timeout for use by ++ * the remote, expressed as: 4.096 * 2^timeout [usec]" ++ * The FW expects timeout in msec so we need to divide the usec ++ * result by 1000. We'll approximate 1000~2^10, and 4.096 ~ 2^2, ++ * so we get: 2^2 * 2^timeout / 2^10 = 2^(timeout - 8). ++ * The value of zero means infinite so we use a 'max_t' to make ++ * sure that sub 1 msec values will be configured as 1 msec. ++ */ ++ if (attr->timeout) ++ qp_params.ack_timeout = ++ 1 << max_t(int, attr->timeout - 8, 0); ++ else + qp_params.ack_timeout = 0; +- } + } ++ + if (attr_mask & IB_QP_RETRY_CNT) { + SET_FIELD(qp_params.modify_flags, + QED_ROCE_MODIFY_QP_VALID_RETRY_CNT, 1); +@@ -1987,13 +1994,25 @@ int qedr_modify_qp(struct ib_qp *ibqp, struct ib_qp_attr *attr, + qp->dest_qp_num = attr->dest_qp_num; + } + ++ cur_state = qp->state; ++ ++ /* Update the QP state before the actual ramrod to prevent a race with ++ * fast path. Modifying the QP state to error will cause the device to ++ * flush the CQEs and while polling the flushed CQEs will considered as ++ * a potential issue if the QP isn't in error state. ++ */ ++ if ((attr_mask & IB_QP_STATE) && qp->qp_type != IB_QPT_GSI && ++ !udata && qp_params.new_state == QED_ROCE_QP_STATE_ERR) ++ qp->state = QED_ROCE_QP_STATE_ERR; ++ + if (qp->qp_type != IB_QPT_GSI) + rc = dev->ops->rdma_modify_qp(dev->rdma_ctx, + qp->qed_qp, &qp_params); + + if (attr_mask & IB_QP_STATE) { + if ((qp->qp_type != IB_QPT_GSI) && (!udata)) +- rc = qedr_update_qp_state(dev, qp, qp_params.new_state); ++ rc = qedr_update_qp_state(dev, qp, cur_state, ++ qp_params.new_state); + qp->state = qp_params.new_state; + } + +@@ -2832,6 +2851,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + + switch (wr->opcode) { + case IB_WR_SEND_WITH_IMM: ++ if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) { ++ rc = -EINVAL; ++ *bad_wr = wr; ++ break; ++ } + wqe->req_type = RDMA_SQ_REQ_TYPE_SEND_WITH_IMM; + swqe = (struct rdma_sq_send_wqe_1st *)wqe; + swqe->wqe_size = 2; +@@ -2873,6 +2897,11 @@ static int __qedr_post_send(struct ib_qp *ibqp, struct ib_send_wr *wr, + break; + + case IB_WR_RDMA_WRITE_WITH_IMM: ++ if (unlikely(rdma_protocol_iwarp(&dev->ibdev, 1))) { ++ rc = -EINVAL; ++ *bad_wr = wr; ++ break; ++ } + wqe->req_type = RDMA_SQ_REQ_TYPE_RDMA_WR_WITH_IMM; + rwqe = (struct rdma_sq_rdma_wqe_1st *)wqe; + +@@ -3518,7 +3547,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + { + struct qedr_dev *dev = get_qedr_dev(ibcq->device); + struct qedr_cq *cq = get_qedr_cq(ibcq); +- union rdma_cqe *cqe = cq->latest_cqe; ++ union rdma_cqe *cqe; + u32 old_cons, new_cons; + unsigned long flags; + int update = 0; +@@ -3535,6 +3564,7 @@ int qedr_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + return qedr_gsi_poll_cq(ibcq, num_entries, wc); + + spin_lock_irqsave(&cq->cq_lock, flags); ++ cqe = cq->latest_cqe; + old_cons = qed_chain_get_cons_idx_u32(&cq->pbl); + while (num_entries && is_valid_cqe(cq, cqe)) { + struct qedr_qp *qp; +diff --git a/drivers/infiniband/sw/rxe/rxe_verbs.c b/drivers/infiniband/sw/rxe/rxe_verbs.c +index 906bacf365d4..1cbf4e407afa 100644 +--- a/drivers/infiniband/sw/rxe/rxe_verbs.c ++++ b/drivers/infiniband/sw/rxe/rxe_verbs.c +@@ -1206,7 +1206,7 @@ int rxe_register_device(struct rxe_dev *rxe) + rxe->ndev->dev_addr); + dev->dev.dma_ops = &dma_virt_ops; + dma_coerce_mask_and_coherent(&dev->dev, +- dma_get_required_mask(dev->dev.parent)); ++ dma_get_required_mask(&dev->dev)); + + dev->uverbs_abi_ver = RXE_UVERBS_ABI_VERSION; + dev->uverbs_cmd_mask = BIT_ULL(IB_USER_VERBS_CMD_GET_CONTEXT) +diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c +index 99a2a57b6cfd..10190e361a13 100644 +--- a/drivers/iommu/amd_iommu.c ++++ b/drivers/iommu/amd_iommu.c +@@ -311,6 +311,8 @@ static struct iommu_dev_data *find_dev_data(u16 devid) + + if (dev_data == NULL) { + dev_data = alloc_dev_data(devid); ++ if (!dev_data) ++ return NULL; + + if (translation_pre_enabled(iommu)) + dev_data->defer_attach = true; +diff --git a/drivers/iommu/mtk_iommu.c b/drivers/iommu/mtk_iommu.c +index 16d33ac19db0..c30f62700431 100644 +--- a/drivers/iommu/mtk_iommu.c ++++ b/drivers/iommu/mtk_iommu.c +@@ -60,7 +60,7 @@ + (((prot) & 0x3) << F_MMU_TF_PROTECT_SEL_SHIFT(data)) + + #define REG_MMU_IVRP_PADDR 0x114 +-#define F_MMU_IVRP_PA_SET(pa, ext) (((pa) >> 1) | ((!!(ext)) << 31)) ++ + #define REG_MMU_VLD_PA_RNG 0x118 + #define F_MMU_VLD_PA_RNG(EA, SA) (((EA) << 8) | (SA)) + +@@ -532,8 +532,13 @@ static int mtk_iommu_hw_init(const struct mtk_iommu_data *data) + F_INT_PRETETCH_TRANSATION_FIFO_FAULT; + writel_relaxed(regval, data->base + REG_MMU_INT_MAIN_CONTROL); + +- writel_relaxed(F_MMU_IVRP_PA_SET(data->protect_base, data->enable_4GB), +- data->base + REG_MMU_IVRP_PADDR); ++ if (data->m4u_plat == M4U_MT8173) ++ regval = (data->protect_base >> 1) | (data->enable_4GB << 31); ++ else ++ regval = lower_32_bits(data->protect_base) | ++ upper_32_bits(data->protect_base); ++ writel_relaxed(regval, data->base + REG_MMU_IVRP_PADDR); ++ + if (data->enable_4GB && data->m4u_plat != M4U_MT8173) { + /* + * If 4GB mode is enabled, the validate PA range is from +@@ -688,6 +693,7 @@ static int __maybe_unused mtk_iommu_suspend(struct device *dev) + reg->ctrl_reg = readl_relaxed(base + REG_MMU_CTRL_REG); + reg->int_control0 = readl_relaxed(base + REG_MMU_INT_CONTROL0); + reg->int_main_control = readl_relaxed(base + REG_MMU_INT_MAIN_CONTROL); ++ reg->ivrp_paddr = readl_relaxed(base + REG_MMU_IVRP_PADDR); + clk_disable_unprepare(data->bclk); + return 0; + } +@@ -710,8 +716,7 @@ static int __maybe_unused mtk_iommu_resume(struct device *dev) + writel_relaxed(reg->ctrl_reg, base + REG_MMU_CTRL_REG); + writel_relaxed(reg->int_control0, base + REG_MMU_INT_CONTROL0); + writel_relaxed(reg->int_main_control, base + REG_MMU_INT_MAIN_CONTROL); +- writel_relaxed(F_MMU_IVRP_PA_SET(data->protect_base, data->enable_4GB), +- base + REG_MMU_IVRP_PADDR); ++ writel_relaxed(reg->ivrp_paddr, base + REG_MMU_IVRP_PADDR); + if (data->m4u_dom) + writel(data->m4u_dom->cfg.arm_v7s_cfg.ttbr[0], + base + REG_MMU_PT_BASE_ADDR); +diff --git a/drivers/iommu/mtk_iommu.h b/drivers/iommu/mtk_iommu.h +index b4451a1c7c2f..778498b8633f 100644 +--- a/drivers/iommu/mtk_iommu.h ++++ b/drivers/iommu/mtk_iommu.h +@@ -32,6 +32,7 @@ struct mtk_iommu_suspend_reg { + u32 ctrl_reg; + u32 int_control0; + u32 int_main_control; ++ u32 ivrp_paddr; + }; + + enum mtk_iommu_plat { +diff --git a/drivers/macintosh/rack-meter.c b/drivers/macintosh/rack-meter.c +index 910b5b6f96b1..eb65b6e78d57 100644 +--- a/drivers/macintosh/rack-meter.c ++++ b/drivers/macintosh/rack-meter.c +@@ -154,8 +154,8 @@ static void rackmeter_do_pause(struct rackmeter *rm, int pause) + DBDMA_DO_STOP(rm->dma_regs); + return; + } +- memset(rdma->buf1, 0, ARRAY_SIZE(rdma->buf1)); +- memset(rdma->buf2, 0, ARRAY_SIZE(rdma->buf2)); ++ memset(rdma->buf1, 0, sizeof(rdma->buf1)); ++ memset(rdma->buf2, 0, sizeof(rdma->buf2)); + + rm->dma_buf_v->mark = 0; + +diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c +index f34ad8720756..5b63afff46d5 100644 +--- a/drivers/md/bcache/request.c ++++ b/drivers/md/bcache/request.c +@@ -651,11 +651,11 @@ static void do_bio_hook(struct search *s, struct bio *orig_bio) + static void search_free(struct closure *cl) + { + struct search *s = container_of(cl, struct search, cl); +- bio_complete(s); + + if (s->iop.bio) + bio_put(s->iop.bio); + ++ bio_complete(s); + closure_debug_destroy(cl); + mempool_free(s, s->d->c->search); + } +diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c +index f046dedc59ab..930b00f6a3a2 100644 +--- a/drivers/md/bcache/writeback.c ++++ b/drivers/md/bcache/writeback.c +@@ -421,9 +421,15 @@ static int bch_writeback_thread(void *arg) + while (!kthread_should_stop()) { + down_write(&dc->writeback_lock); + set_current_state(TASK_INTERRUPTIBLE); +- if (!atomic_read(&dc->has_dirty) || +- (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) && +- !dc->writeback_running)) { ++ /* ++ * If the bache device is detaching, skip here and continue ++ * to perform writeback. Otherwise, if no dirty data on cache, ++ * or there is dirty data on cache but writeback is disabled, ++ * the writeback thread should sleep here and wait for others ++ * to wake up it. ++ */ ++ if (!test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags) && ++ (!atomic_read(&dc->has_dirty) || !dc->writeback_running)) { + up_write(&dc->writeback_lock); + + if (kthread_should_stop()) { +@@ -444,6 +450,14 @@ static int bch_writeback_thread(void *arg) + cached_dev_put(dc); + SET_BDEV_STATE(&dc->sb, BDEV_STATE_CLEAN); + bch_write_bdev_super(dc, NULL); ++ /* ++ * If bcache device is detaching via sysfs interface, ++ * writeback thread should stop after there is no dirty ++ * data on cache. BCACHE_DEV_DETACHING flag is set in ++ * bch_cached_dev_detach(). ++ */ ++ if (test_bit(BCACHE_DEV_DETACHING, &dc->disk.flags)) ++ break; + } + + up_write(&dc->writeback_lock); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index e058c209bbcf..24e64b04424a 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -779,6 +779,9 @@ void md_super_write(struct mddev *mddev, struct md_rdev *rdev, + struct bio *bio; + int ff = 0; + ++ if (!page) ++ return; ++ + if (test_bit(Faulty, &rdev->flags)) + return; + +@@ -5434,6 +5437,7 @@ int md_run(struct mddev *mddev) + * the only valid external interface is through the md + * device. + */ ++ mddev->has_superblocks = false; + rdev_for_each(rdev, mddev) { + if (test_bit(Faulty, &rdev->flags)) + continue; +@@ -5447,6 +5451,9 @@ int md_run(struct mddev *mddev) + set_disk_ro(mddev->gendisk, 1); + } + ++ if (rdev->sb_page) ++ mddev->has_superblocks = true; ++ + /* perform some consistency tests on the device. + * We don't want the data to overlap the metadata, + * Internal Bitmap issues have been handled elsewhere. +@@ -5479,8 +5486,10 @@ int md_run(struct mddev *mddev) + } + if (mddev->sync_set == NULL) { + mddev->sync_set = bioset_create(BIO_POOL_SIZE, 0, BIOSET_NEED_BVECS); +- if (!mddev->sync_set) +- return -ENOMEM; ++ if (!mddev->sync_set) { ++ err = -ENOMEM; ++ goto abort; ++ } + } + + spin_lock(&pers_lock); +@@ -5493,7 +5502,8 @@ int md_run(struct mddev *mddev) + else + pr_warn("md: personality for level %s is not loaded!\n", + mddev->clevel); +- return -EINVAL; ++ err = -EINVAL; ++ goto abort; + } + spin_unlock(&pers_lock); + if (mddev->level != pers->level) { +@@ -5506,7 +5516,8 @@ int md_run(struct mddev *mddev) + pers->start_reshape == NULL) { + /* This personality cannot handle reshaping... */ + module_put(pers->owner); +- return -EINVAL; ++ err = -EINVAL; ++ goto abort; + } + + if (pers->sync_request) { +@@ -5580,7 +5591,7 @@ int md_run(struct mddev *mddev) + mddev->private = NULL; + module_put(pers->owner); + bitmap_destroy(mddev); +- return err; ++ goto abort; + } + if (mddev->queue) { + bool nonrot = true; +@@ -5642,6 +5653,18 @@ int md_run(struct mddev *mddev) + sysfs_notify_dirent_safe(mddev->sysfs_action); + sysfs_notify(&mddev->kobj, NULL, "degraded"); + return 0; ++ ++abort: ++ if (mddev->bio_set) { ++ bioset_free(mddev->bio_set); ++ mddev->bio_set = NULL; ++ } ++ if (mddev->sync_set) { ++ bioset_free(mddev->sync_set); ++ mddev->sync_set = NULL; ++ } ++ ++ return err; + } + EXPORT_SYMBOL_GPL(md_run); + +@@ -8006,6 +8029,7 @@ EXPORT_SYMBOL(md_done_sync); + bool md_write_start(struct mddev *mddev, struct bio *bi) + { + int did_change = 0; ++ + if (bio_data_dir(bi) != WRITE) + return true; + +@@ -8038,6 +8062,8 @@ bool md_write_start(struct mddev *mddev, struct bio *bi) + rcu_read_unlock(); + if (did_change) + sysfs_notify_dirent_safe(mddev->sysfs_state); ++ if (!mddev->has_superblocks) ++ return true; + wait_event(mddev->sb_wait, + !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) || + mddev->suspended); +@@ -8496,6 +8522,19 @@ void md_do_sync(struct md_thread *thread) + set_mask_bits(&mddev->sb_flags, 0, + BIT(MD_SB_CHANGE_PENDING) | BIT(MD_SB_CHANGE_DEVS)); + ++ if (test_bit(MD_RECOVERY_RESHAPE, &mddev->recovery) && ++ !test_bit(MD_RECOVERY_INTR, &mddev->recovery) && ++ mddev->delta_disks > 0 && ++ mddev->pers->finish_reshape && ++ mddev->pers->size && ++ mddev->queue) { ++ mddev_lock_nointr(mddev); ++ md_set_array_sectors(mddev, mddev->pers->size(mddev, 0, 0)); ++ mddev_unlock(mddev); ++ set_capacity(mddev->gendisk, mddev->array_sectors); ++ revalidate_disk(mddev->gendisk); ++ } ++ + spin_lock(&mddev->lock); + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) { + /* We completed so min/max setting can be forgotten if used. */ +diff --git a/drivers/md/md.h b/drivers/md/md.h +index d8287d3cd1bf..9b0a896890ef 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -462,6 +462,8 @@ struct mddev { + void (*sync_super)(struct mddev *mddev, struct md_rdev *rdev); + struct md_cluster_info *cluster_info; + unsigned int good_device_nr; /* good device num within cluster raid */ ++ ++ bool has_superblocks:1; + }; + + enum recovery_flags { +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 788fc0800465..e4e01d3bab81 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1813,6 +1813,17 @@ static int raid1_remove_disk(struct mddev *mddev, struct md_rdev *rdev) + struct md_rdev *repl = + conf->mirrors[conf->raid_disks + number].rdev; + freeze_array(conf, 0); ++ if (atomic_read(&repl->nr_pending)) { ++ /* It means that some queued IO of retry_list ++ * hold repl. Thus, we cannot set replacement ++ * as NULL, avoiding rdev NULL pointer ++ * dereference in sync_request_write and ++ * handle_write_finished. ++ */ ++ err = -EBUSY; ++ unfreeze_array(conf); ++ goto abort; ++ } + clear_bit(Replacement, &repl->flags); + p->rdev = repl; + conf->mirrors[conf->raid_disks + number].rdev = NULL; +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 0d18d3b95201..5fb31ef52945 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2625,7 +2625,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) + for (m = 0; m < conf->copies; m++) { + int dev = r10_bio->devs[m].devnum; + rdev = conf->mirrors[dev].rdev; +- if (r10_bio->devs[m].bio == NULL) ++ if (r10_bio->devs[m].bio == NULL || ++ r10_bio->devs[m].bio->bi_end_io == NULL) + continue; + if (!r10_bio->devs[m].bio->bi_status) { + rdev_clear_badblocks( +@@ -2640,7 +2641,8 @@ static void handle_write_completed(struct r10conf *conf, struct r10bio *r10_bio) + md_error(conf->mddev, rdev); + } + rdev = conf->mirrors[dev].replacement; +- if (r10_bio->devs[m].repl_bio == NULL) ++ if (r10_bio->devs[m].repl_bio == NULL || ++ r10_bio->devs[m].repl_bio->bi_end_io == NULL) + continue; + + if (!r10_bio->devs[m].repl_bio->bi_status) { +@@ -4691,17 +4693,11 @@ static void raid10_finish_reshape(struct mddev *mddev) + return; + + if (mddev->delta_disks > 0) { +- sector_t size = raid10_size(mddev, 0, 0); +- md_set_array_sectors(mddev, size); + if (mddev->recovery_cp > mddev->resync_max_sectors) { + mddev->recovery_cp = mddev->resync_max_sectors; + set_bit(MD_RECOVERY_NEEDED, &mddev->recovery); + } +- mddev->resync_max_sectors = size; +- if (mddev->queue) { +- set_capacity(mddev->gendisk, mddev->array_sectors); +- revalidate_disk(mddev->gendisk); +- } ++ mddev->resync_max_sectors = mddev->array_sectors; + } else { + int d; + rcu_read_lock(); +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index 7ec822ced80b..de1ef6264ee7 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -2197,15 +2197,16 @@ static int grow_one_stripe(struct r5conf *conf, gfp_t gfp) + static int grow_stripes(struct r5conf *conf, int num) + { + struct kmem_cache *sc; ++ size_t namelen = sizeof(conf->cache_name[0]); + int devs = max(conf->raid_disks, conf->previous_raid_disks); + + if (conf->mddev->gendisk) +- sprintf(conf->cache_name[0], ++ snprintf(conf->cache_name[0], namelen, + "raid%d-%s", conf->level, mdname(conf->mddev)); + else +- sprintf(conf->cache_name[0], ++ snprintf(conf->cache_name[0], namelen, + "raid%d-%p", conf->level, conf->mddev); +- sprintf(conf->cache_name[1], "%s-alt", conf->cache_name[0]); ++ snprintf(conf->cache_name[1], namelen, "%.27s-alt", conf->cache_name[0]); + + conf->active_name = 0; + sc = kmem_cache_create(conf->cache_name[conf->active_name], +@@ -8000,13 +8001,7 @@ static void raid5_finish_reshape(struct mddev *mddev) + + if (!test_bit(MD_RECOVERY_INTR, &mddev->recovery)) { + +- if (mddev->delta_disks > 0) { +- md_set_array_sectors(mddev, raid5_size(mddev, 0, 0)); +- if (mddev->queue) { +- set_capacity(mddev->gendisk, mddev->array_sectors); +- revalidate_disk(mddev->gendisk); +- } +- } else { ++ if (mddev->delta_disks <= 0) { + int d; + spin_lock_irq(&conf->device_lock); + mddev->degraded = raid5_calc_degraded(conf); +diff --git a/drivers/misc/cxl/cxl.h b/drivers/misc/cxl/cxl.h +index b1afeccbb97f..c96dcda1111f 100644 +--- a/drivers/misc/cxl/cxl.h ++++ b/drivers/misc/cxl/cxl.h +@@ -365,6 +365,9 @@ static const cxl_p2n_reg_t CXL_PSL_WED_An = {0x0A0}; + #define CXL_PSL_TFC_An_AE (1ull << (63-30)) /* Restart PSL with address error */ + #define CXL_PSL_TFC_An_R (1ull << (63-31)) /* Restart PSL transaction */ + ++/****** CXL_PSL_DEBUG *****************************************************/ ++#define CXL_PSL_DEBUG_CDC (1ull << (63-27)) /* Coherent Data cache support */ ++ + /****** CXL_XSL9_IERAT_ERAT - CAIA 2 **********************************/ + #define CXL_XSL9_IERAT_MLPID (1ull << (63-0)) /* Match LPID */ + #define CXL_XSL9_IERAT_MPID (1ull << (63-1)) /* Match PID */ +@@ -659,6 +662,7 @@ struct cxl_native { + irq_hw_number_t err_hwirq; + unsigned int err_virq; + u64 ps_off; ++ bool no_data_cache; /* set if no data cache on the card */ + const struct cxl_service_layer_ops *sl_ops; + }; + +diff --git a/drivers/misc/cxl/native.c b/drivers/misc/cxl/native.c +index 4a82c313cf71..9c042b0b8c55 100644 +--- a/drivers/misc/cxl/native.c ++++ b/drivers/misc/cxl/native.c +@@ -352,8 +352,17 @@ int cxl_data_cache_flush(struct cxl *adapter) + u64 reg; + unsigned long timeout = jiffies + (HZ * CXL_TIMEOUT); + +- pr_devel("Flushing data cache\n"); ++ /* ++ * Do a datacache flush only if datacache is available. ++ * In case of PSL9D datacache absent hence flush operation. ++ * would timeout. ++ */ ++ if (adapter->native->no_data_cache) { ++ pr_devel("No PSL data cache. Ignoring cache flush req.\n"); ++ return 0; ++ } + ++ pr_devel("Flushing data cache\n"); + reg = cxl_p1_read(adapter, CXL_PSL_Control); + reg |= CXL_PSL_Control_Fr; + cxl_p1_write(adapter, CXL_PSL_Control, reg); +diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c +index 81093f8157a9..2b3fd0a51701 100644 +--- a/drivers/misc/cxl/pci.c ++++ b/drivers/misc/cxl/pci.c +@@ -457,6 +457,7 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, + u64 chipid; + u32 phb_index; + u64 capp_unit_id; ++ u64 psl_debug; + int rc; + + rc = cxl_calc_capp_routing(dev, &chipid, &phb_index, &capp_unit_id); +@@ -507,6 +508,16 @@ static int init_implementation_adapter_regs_psl9(struct cxl *adapter, + if (cxl_is_power9_dd1()) + cxl_p1_write(adapter, CXL_PSL9_GP_CT, 0x0400000000000001ULL); + ++ /* ++ * Check if PSL has data-cache. We need to flush adapter datacache ++ * when as its about to be removed. ++ */ ++ psl_debug = cxl_p1_read(adapter, CXL_PSL9_DEBUG); ++ if (psl_debug & CXL_PSL_DEBUG_CDC) { ++ dev_dbg(&dev->dev, "No data-cache present\n"); ++ adapter->native->no_data_cache = true; ++ } ++ + return 0; + } + +@@ -1450,10 +1461,8 @@ int cxl_pci_reset(struct cxl *adapter) + + /* + * The adapter is about to be reset, so ignore errors. +- * Not supported on P9 DD1 + */ +- if ((cxl_is_power8()) || (!(cxl_is_power9_dd1()))) +- cxl_data_cache_flush(adapter); ++ cxl_data_cache_flush(adapter); + + /* pcie_warm_reset requests a fundamental pci reset which includes a + * PERST assert/deassert. PERST triggers a loading of the image +@@ -1898,10 +1907,8 @@ static void cxl_pci_remove_adapter(struct cxl *adapter) + + /* + * Flush adapter datacache as its about to be removed. +- * Not supported on P9 DD1. + */ +- if ((cxl_is_power8()) || (!(cxl_is_power9_dd1()))) +- cxl_data_cache_flush(adapter); ++ cxl_data_cache_flush(adapter); + + cxl_deconfigure_adapter(adapter); + +diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c +index 61666d269771..0cfbdb3ab68a 100644 +--- a/drivers/mmc/host/sdhci-iproc.c ++++ b/drivers/mmc/host/sdhci-iproc.c +@@ -33,6 +33,8 @@ struct sdhci_iproc_host { + const struct sdhci_iproc_data *data; + u32 shadow_cmd; + u32 shadow_blk; ++ bool is_cmd_shadowed; ++ bool is_blk_shadowed; + }; + + #define REG_OFFSET_IN_BITS(reg) ((reg) << 3 & 0x18) +@@ -48,8 +50,22 @@ static inline u32 sdhci_iproc_readl(struct sdhci_host *host, int reg) + + static u16 sdhci_iproc_readw(struct sdhci_host *host, int reg) + { +- u32 val = sdhci_iproc_readl(host, (reg & ~3)); +- u16 word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff; ++ struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host); ++ struct sdhci_iproc_host *iproc_host = sdhci_pltfm_priv(pltfm_host); ++ u32 val; ++ u16 word; ++ ++ if ((reg == SDHCI_TRANSFER_MODE) && iproc_host->is_cmd_shadowed) { ++ /* Get the saved transfer mode */ ++ val = iproc_host->shadow_cmd; ++ } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) && ++ iproc_host->is_blk_shadowed) { ++ /* Get the saved block info */ ++ val = iproc_host->shadow_blk; ++ } else { ++ val = sdhci_iproc_readl(host, (reg & ~3)); ++ } ++ word = val >> REG_OFFSET_IN_BITS(reg) & 0xffff; + return word; + } + +@@ -105,13 +121,15 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg) + + if (reg == SDHCI_COMMAND) { + /* Write the block now as we are issuing a command */ +- if (iproc_host->shadow_blk != 0) { ++ if (iproc_host->is_blk_shadowed) { + sdhci_iproc_writel(host, iproc_host->shadow_blk, + SDHCI_BLOCK_SIZE); +- iproc_host->shadow_blk = 0; ++ iproc_host->is_blk_shadowed = false; + } + oldval = iproc_host->shadow_cmd; +- } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) { ++ iproc_host->is_cmd_shadowed = false; ++ } else if ((reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) && ++ iproc_host->is_blk_shadowed) { + /* Block size and count are stored in shadow reg */ + oldval = iproc_host->shadow_blk; + } else { +@@ -123,9 +141,11 @@ static void sdhci_iproc_writew(struct sdhci_host *host, u16 val, int reg) + if (reg == SDHCI_TRANSFER_MODE) { + /* Save the transfer mode until the command is issued */ + iproc_host->shadow_cmd = newval; ++ iproc_host->is_cmd_shadowed = true; + } else if (reg == SDHCI_BLOCK_SIZE || reg == SDHCI_BLOCK_COUNT) { + /* Save the block info until the command is issued */ + iproc_host->shadow_blk = newval; ++ iproc_host->is_blk_shadowed = true; + } else { + /* Command or other regular 32-bit write */ + sdhci_iproc_writel(host, newval, reg & ~3); +@@ -166,7 +186,7 @@ static const struct sdhci_ops sdhci_iproc_32only_ops = { + + static const struct sdhci_pltfm_data sdhci_iproc_cygnus_pltfm_data = { + .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK, +- .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN, ++ .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN | SDHCI_QUIRK2_HOST_OFF_CARD_ON, + .ops = &sdhci_iproc_32only_ops, + }; + +@@ -206,7 +226,6 @@ static const struct sdhci_iproc_data iproc_data = { + .caps1 = SDHCI_DRIVER_TYPE_C | + SDHCI_DRIVER_TYPE_D | + SDHCI_SUPPORT_DDR50, +- .mmc_caps = MMC_CAP_1_8V_DDR, + }; + + static const struct sdhci_pltfm_data sdhci_bcm2835_pltfm_data = { +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index f0aa57222f17..00245b73c224 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1528,7 +1528,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + if (res) { + netdev_err(bond_dev, "Couldn't add bond vlan ids to %s\n", + slave_dev->name); +- goto err_close; ++ goto err_hwaddr_unsync; + } + + prev_slave = bond_last_slave(bond); +@@ -1769,6 +1769,10 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + synchronize_rcu(); + slave_disable_netpoll(new_slave); + ++err_hwaddr_unsync: ++ if (!bond_uses_primary(bond)) ++ bond_hw_addr_flush(bond_dev, slave_dev); ++ + err_close: + slave_dev->priv_flags &= ~IFF_BONDING; + dev_close(slave_dev); +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index f4947a74b65f..5d4e61741476 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + + /* napi related */ + #define M_CAN_NAPI_WEIGHT 64 +@@ -246,7 +247,7 @@ enum m_can_mram_cfg { + + /* Rx FIFO 0/1 Configuration (RXF0C/RXF1C) */ + #define RXFC_FWM_SHIFT 24 +-#define RXFC_FWM_MASK (0x7f < RXFC_FWM_SHIFT) ++#define RXFC_FWM_MASK (0x7f << RXFC_FWM_SHIFT) + #define RXFC_FS_SHIFT 16 + #define RXFC_FS_MASK (0x7f << RXFC_FS_SHIFT) + +@@ -1682,6 +1683,8 @@ static __maybe_unused int m_can_suspend(struct device *dev) + m_can_clk_stop(priv); + } + ++ pinctrl_pm_select_sleep_state(dev); ++ + priv->can.state = CAN_STATE_SLEEPING; + + return 0; +@@ -1692,6 +1695,8 @@ static __maybe_unused int m_can_resume(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct m_can_priv *priv = netdev_priv(ndev); + ++ pinctrl_pm_select_default_state(dev); ++ + m_can_init_ram(priv); + + priv->can.state = CAN_STATE_ERROR_ACTIVE; +diff --git a/drivers/net/dsa/Makefile b/drivers/net/dsa/Makefile +index d040aeb45172..15c2a831edf1 100644 +--- a/drivers/net/dsa/Makefile ++++ b/drivers/net/dsa/Makefile +@@ -1,7 +1,10 @@ + # SPDX-License-Identifier: GPL-2.0 + obj-$(CONFIG_NET_DSA_BCM_SF2) += bcm-sf2.o + bcm-sf2-objs := bcm_sf2.o bcm_sf2_cfp.o +-obj-$(CONFIG_NET_DSA_LOOP) += dsa_loop.o dsa_loop_bdinfo.o ++obj-$(CONFIG_NET_DSA_LOOP) += dsa_loop.o ++ifdef CONFIG_NET_DSA_LOOP ++obj-$(CONFIG_FIXED_PHY) += dsa_loop_bdinfo.o ++endif + obj-$(CONFIG_NET_DSA_MT7530) += mt7530.o + obj-$(CONFIG_NET_DSA_MV88E6060) += mv88e6060.o + obj-$(CONFIG_NET_DSA_QCA8K) += qca8k.o +diff --git a/drivers/net/dsa/mt7530.c b/drivers/net/dsa/mt7530.c +index c142b97add2c..3b073e152237 100644 +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -1122,6 +1122,7 @@ static const struct of_device_id mt7530_of_match[] = { + { .compatible = "mediatek,mt7530" }, + { /* sentinel */ }, + }; ++MODULE_DEVICE_TABLE(of, mt7530_of_match); + + static struct mdio_driver mt7530_mdio_driver = { + .probe = mt7530_probe, +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c +index 48d672b204a4..a4080f18135c 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -532,7 +532,8 @@ static void bgmac_dma_tx_ring_free(struct bgmac *bgmac, + int i; + + for (i = 0; i < BGMAC_TX_RING_SLOTS; i++) { +- int len = dma_desc[i].ctl1 & BGMAC_DESC_CTL1_LEN; ++ u32 ctl1 = le32_to_cpu(dma_desc[i].ctl1); ++ unsigned int len = ctl1 & BGMAC_DESC_CTL1_LEN; + + slot = &ring->slots[i]; + dev_kfree_skb(slot->skb); +diff --git a/drivers/net/ethernet/broadcom/bgmac.h b/drivers/net/ethernet/broadcom/bgmac.h +index 4040d846da8e..40d02fec2747 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.h ++++ b/drivers/net/ethernet/broadcom/bgmac.h +@@ -479,9 +479,9 @@ struct bgmac_rx_header { + struct bgmac { + union { + struct { +- void *base; +- void *idm_base; +- void *nicpm_base; ++ void __iomem *base; ++ void __iomem *idm_base; ++ void __iomem *nicpm_base; + } plat; + struct { + struct bcma_device *core; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 807cf75f0a98..bfd2d0382f4c 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -3808,6 +3808,9 @@ static int bnxt_hwrm_vnic_set_tpa(struct bnxt *bp, u16 vnic_id, u32 tpa_flags) + struct bnxt_vnic_info *vnic = &bp->vnic_info[vnic_id]; + struct hwrm_vnic_tpa_cfg_input req = {0}; + ++ if (vnic->fw_vnic_id == INVALID_HW_RING_ID) ++ return 0; ++ + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_VNIC_TPA_CFG, -1, -1); + + if (tpa_flags) { +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +index 92d9d795d874..44a0d04dd8a0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c +@@ -815,8 +815,6 @@ static int setup_fw_sge_queues(struct adapter *adap) + + err = t4_sge_alloc_rxq(adap, &s->fw_evtq, true, adap->port[0], + adap->msi_idx, NULL, fwevtq_handler, NULL, -1); +- if (err) +- t4_free_sge_resources(adap); + return err; + } + +@@ -4679,7 +4677,6 @@ static void dummy_setup(struct net_device *dev) + /* Initialize the device structure. */ + dev->netdev_ops = &cxgb4_mgmt_netdev_ops; + dev->ethtool_ops = &cxgb4_mgmt_ethtool_ops; +- dev->needs_free_netdev = true; + } + + static int config_mgmt_dev(struct pci_dev *pdev) +@@ -5117,6 +5114,13 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + if (err) + goto out_free_dev; + ++ err = setup_fw_sge_queues(adapter); ++ if (err) { ++ dev_err(adapter->pdev_dev, ++ "FW sge queue allocation failed, err %d", err); ++ goto out_free_dev; ++ } ++ + /* + * The card is now ready to go. If any errors occur during device + * registration we do not fail the whole card but rather proceed only +@@ -5165,7 +5169,6 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + cxgb4_ptp_init(adapter); + + print_adapter_info(adapter); +- setup_fw_sge_queues(adapter); + return 0; + + sriov: +@@ -5221,6 +5224,7 @@ static int init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + #endif + + out_free_dev: ++ t4_free_sge_resources(adapter); + free_some_resources(adapter); + if (adapter->flags & USING_MSIX) + free_msix_info(adapter); +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c +index 71a315bc1409..99a9d5278369 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_uld.c +@@ -342,6 +342,7 @@ static void free_queues_uld(struct adapter *adap, unsigned int uld_type) + { + struct sge_uld_rxq_info *rxq_info = adap->sge.uld_rxq_info[uld_type]; + ++ adap->sge.uld_rxq_info[uld_type] = NULL; + kfree(rxq_info->rspq_id); + kfree(rxq_info->uldrxq); + kfree(rxq_info); +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index d24ee1ad3be1..aef40f02c77f 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -1897,6 +1897,8 @@ static int enic_open(struct net_device *netdev) + } + + for (i = 0; i < enic->rq_count; i++) { ++ /* enable rq before updating rq desc */ ++ vnic_rq_enable(&enic->rq[i]); + vnic_rq_fill(&enic->rq[i], enic_rq_alloc_buf); + /* Need at least one buffer on ring to get going */ + if (vnic_rq_desc_used(&enic->rq[i]) == 0) { +@@ -1908,8 +1910,6 @@ static int enic_open(struct net_device *netdev) + + for (i = 0; i < enic->wq_count; i++) + vnic_wq_enable(&enic->wq[i]); +- for (i = 0; i < enic->rq_count; i++) +- vnic_rq_enable(&enic->rq[i]); + + if (!enic_is_dynamic(enic) && !enic_is_sriov_vf(enic)) + enic_dev_add_station_addr(enic); +@@ -1935,8 +1935,12 @@ static int enic_open(struct net_device *netdev) + return 0; + + err_out_free_rq: +- for (i = 0; i < enic->rq_count; i++) ++ for (i = 0; i < enic->rq_count; i++) { ++ err = vnic_rq_disable(&enic->rq[i]); ++ if (err) ++ return err; + vnic_rq_clean(&enic->rq[i], enic_free_rq_buf); ++ } + enic_dev_notify_unset(enic); + err_out_free_intr: + enic_unset_affinity_hint(enic); +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 4f6e9d3470d5..5b4f05805006 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -1930,8 +1930,10 @@ static int skb_to_sg_fd(struct dpaa_priv *priv, + goto csum_failed; + } + ++ /* SGT[0] is used by the linear part */ + sgt = (struct qm_sg_entry *)(sgt_buf + priv->tx_headroom); +- qm_sg_entry_set_len(&sgt[0], skb_headlen(skb)); ++ frag_len = skb_headlen(skb); ++ qm_sg_entry_set_len(&sgt[0], frag_len); + sgt[0].bpid = FSL_DPAA_BPID_INV; + sgt[0].offset = 0; + addr = dma_map_single(dev, skb->data, +@@ -1944,9 +1946,9 @@ static int skb_to_sg_fd(struct dpaa_priv *priv, + qm_sg_entry_set64(&sgt[0], addr); + + /* populate the rest of SGT entries */ +- frag = &skb_shinfo(skb)->frags[0]; +- frag_len = frag->size; +- for (i = 1; i <= nr_frags; i++, frag++) { ++ for (i = 0; i < nr_frags; i++) { ++ frag = &skb_shinfo(skb)->frags[i]; ++ frag_len = frag->size; + WARN_ON(!skb_frag_page(frag)); + addr = skb_frag_dma_map(dev, frag, 0, + frag_len, dma_dir); +@@ -1956,15 +1958,16 @@ static int skb_to_sg_fd(struct dpaa_priv *priv, + goto sg_map_failed; + } + +- qm_sg_entry_set_len(&sgt[i], frag_len); +- sgt[i].bpid = FSL_DPAA_BPID_INV; +- sgt[i].offset = 0; ++ qm_sg_entry_set_len(&sgt[i + 1], frag_len); ++ sgt[i + 1].bpid = FSL_DPAA_BPID_INV; ++ sgt[i + 1].offset = 0; + + /* keep the offset in the address */ +- qm_sg_entry_set64(&sgt[i], addr); +- frag_len = frag->size; ++ qm_sg_entry_set64(&sgt[i + 1], addr); + } +- qm_sg_entry_set_f(&sgt[i - 1], frag_len); ++ ++ /* Set the final bit in the last used entry of the SGT */ ++ qm_sg_entry_set_f(&sgt[nr_frags], frag_len); + + qm_fd_set_sg(fd, priv->tx_headroom, skb->len); + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c +index faea674094b9..85306d1b2acf 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_ethtool.c +@@ -211,7 +211,7 @@ static int dpaa_set_pauseparam(struct net_device *net_dev, + if (epause->rx_pause) + newadv = ADVERTISED_Pause | ADVERTISED_Asym_Pause; + if (epause->tx_pause) +- newadv |= ADVERTISED_Asym_Pause; ++ newadv ^= ADVERTISED_Asym_Pause; + + oldadv = phydev->advertising & + (ADVERTISED_Pause | ADVERTISED_Asym_Pause); +diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +index ea43b4974149..7af31ddd093f 100644 +--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c ++++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c +@@ -1100,7 +1100,7 @@ int dtsec_add_hash_mac_address(struct fman_mac *dtsec, enet_addr_t *eth_addr) + set_bucket(dtsec->regs, bucket, true); + + /* Create element to be added to the driver hash table */ +- hash_entry = kmalloc(sizeof(*hash_entry), GFP_KERNEL); ++ hash_entry = kmalloc(sizeof(*hash_entry), GFP_ATOMIC); + if (!hash_entry) + return -ENOMEM; + hash_entry->addr = addr; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 3bdeb295514b..63daae120b2d 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -3072,9 +3072,6 @@ static void gfar_process_frame(struct net_device *ndev, struct sk_buff *skb) + if (ndev->features & NETIF_F_RXCSUM) + gfar_rx_checksum(skb, fcb); + +- /* Tell the skb what kind of packet this is */ +- skb->protocol = eth_type_trans(skb, ndev); +- + /* There's need to check for NETIF_F_HW_VLAN_CTAG_RX here. + * Even if vlan rx accel is disabled, on some chips + * RXFCB_VLN is pseudo randomly set. +@@ -3145,13 +3142,15 @@ int gfar_clean_rx_ring(struct gfar_priv_rx_q *rx_queue, int rx_work_limit) + continue; + } + ++ gfar_process_frame(ndev, skb); ++ + /* Increment the number of packets */ + total_pkts++; + total_bytes += skb->len; + + skb_record_rx_queue(skb, rx_queue->qindex); + +- gfar_process_frame(ndev, skb); ++ skb->protocol = eth_type_trans(skb, ndev); + + /* Send the packet up the stack */ + napi_gro_receive(&rx_queue->grp->napi_rx, skb); +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 3ae02b0620bc..98493be7b4af 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -933,6 +933,35 @@ static int ibmvnic_open(struct net_device *netdev) + return rc; + } + ++static void clean_rx_pools(struct ibmvnic_adapter *adapter) ++{ ++ struct ibmvnic_rx_pool *rx_pool; ++ u64 rx_entries; ++ int rx_scrqs; ++ int i, j; ++ ++ if (!adapter->rx_pool) ++ return; ++ ++ rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs); ++ rx_entries = adapter->req_rx_add_entries_per_subcrq; ++ ++ /* Free any remaining skbs in the rx buffer pools */ ++ for (i = 0; i < rx_scrqs; i++) { ++ rx_pool = &adapter->rx_pool[i]; ++ if (!rx_pool) ++ continue; ++ ++ netdev_dbg(adapter->netdev, "Cleaning rx_pool[%d]\n", i); ++ for (j = 0; j < rx_entries; j++) { ++ if (rx_pool->rx_buff[j].skb) { ++ dev_kfree_skb_any(rx_pool->rx_buff[j].skb); ++ rx_pool->rx_buff[j].skb = NULL; ++ } ++ } ++ } ++} ++ + static void clean_tx_pools(struct ibmvnic_adapter *adapter) + { + struct ibmvnic_tx_pool *tx_pool; +@@ -1010,7 +1039,7 @@ static int __ibmvnic_close(struct net_device *netdev) + } + } + } +- ++ clean_rx_pools(adapter); + clean_tx_pools(adapter); + adapter->state = VNIC_CLOSED; + return rc; +@@ -1460,8 +1489,6 @@ static int do_reset(struct ibmvnic_adapter *adapter, + return 0; + } + +- netif_carrier_on(netdev); +- + /* kick napi */ + for (i = 0; i < adapter->req_rx_queues; i++) + napi_schedule(&adapter->napi[i]); +@@ -1469,6 +1496,8 @@ static int do_reset(struct ibmvnic_adapter *adapter, + if (adapter->reset_reason != VNIC_RESET_FAILOVER) + netdev_notify_peers(netdev); + ++ netif_carrier_on(netdev); ++ + return 0; + } + +@@ -1636,6 +1665,12 @@ static int ibmvnic_poll(struct napi_struct *napi, int budget) + be16_to_cpu(next->rx_comp.rc)); + /* free the entry */ + next->rx_comp.first = 0; ++ dev_kfree_skb_any(rx_buff->skb); ++ remove_buff_from_pool(adapter, rx_buff); ++ continue; ++ } else if (!rx_buff->skb) { ++ /* free the entry */ ++ next->rx_comp.first = 0; + remove_buff_from_pool(adapter, rx_buff); + continue; + } +@@ -1927,6 +1962,7 @@ static int reset_one_sub_crq_queue(struct ibmvnic_adapter *adapter, + } + + memset(scrq->msgs, 0, 4 * PAGE_SIZE); ++ atomic_set(&scrq->used, 0); + scrq->cur = 0; + + rc = h_reg_sub_crq(adapter->vdev->unit_address, scrq->msg_token, +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 31277d3bb7dc..ff308b05d68c 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1602,7 +1602,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) + * we have already determined whether we have link or not. + */ + if (!mac->autoneg) +- return -E1000_ERR_CONFIG; ++ return 1; + + /* Auto-Neg is enabled. Auto Speed Detection takes care + * of MAC speed/duplex configuration. So we only need to +diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c +index f457c5703d0c..db735644b312 100644 +--- a/drivers/net/ethernet/intel/e1000e/mac.c ++++ b/drivers/net/ethernet/intel/e1000e/mac.c +@@ -450,7 +450,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) + * we have already determined whether we have link or not. + */ + if (!mac->autoneg) +- return -E1000_ERR_CONFIG; ++ return 1; + + /* Auto-Neg is enabled. Auto Speed Detection takes care + * of MAC speed/duplex configuration. So we only need to +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 991c2a0dd67e..7a226537877b 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -2329,8 +2329,8 @@ static int e1000_alloc_ring_dma(struct e1000_adapter *adapter, + { + struct pci_dev *pdev = adapter->pdev; + +- ring->desc = dma_alloc_coherent(&pdev->dev, ring->size, &ring->dma, +- GFP_KERNEL); ++ ring->desc = dma_zalloc_coherent(&pdev->dev, ring->size, &ring->dma, ++ GFP_KERNEL); + if (!ring->desc) + return -ENOMEM; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index d36b799116e4..04dbf64fb1cb 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -7196,6 +7196,17 @@ static void i40e_rebuild(struct i40e_pf *pf, bool reinit, bool lock_acquired) + } + i40e_get_oem_version(&pf->hw); + ++ if (test_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state) && ++ ((hw->aq.fw_maj_ver == 4 && hw->aq.fw_min_ver <= 33) || ++ hw->aq.fw_maj_ver < 4) && hw->mac.type == I40E_MAC_XL710) { ++ /* The following delay is necessary for 4.33 firmware and older ++ * to recover after EMP reset. 200 ms should suffice but we ++ * put here 300 ms to be sure that FW is ready to operate ++ * after reset. ++ */ ++ mdelay(300); ++ } ++ + /* re-verify the eeprom if we just had an EMP reset */ + if (test_and_clear_bit(__I40E_EMP_RESET_INTR_RECEIVED, pf->state)) + i40e_verify_eeprom(pf); +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 9e30cfeac04b..20a8018d41ef 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -7658,7 +7658,8 @@ static void ixgbe_service_task(struct work_struct *work) + + if (test_bit(__IXGBE_PTP_RUNNING, &adapter->state)) { + ixgbe_ptp_overflow_check(adapter); +- ixgbe_ptp_rx_hang(adapter); ++ if (adapter->flags & IXGBE_FLAG_RX_HWTSTAMP_IN_REGISTER) ++ ixgbe_ptp_rx_hang(adapter); + ixgbe_ptp_tx_hang(adapter); + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig +index fdaef00465d7..576b61c119bb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig ++++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig +@@ -46,7 +46,7 @@ config MLX5_MPFS + + config MLX5_ESWITCH + bool "Mellanox Technologies MLX5 SRIOV E-Switch support" +- depends on MLX5_CORE_EN ++ depends on MLX5_CORE_EN && NET_SWITCHDEV + default y + ---help--- + Mellanox Technologies Ethernet SRIOV E-Switch support in ConnectX NIC. +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index e9a1fbcc4adf..3efe45bc2471 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -1802,7 +1802,7 @@ int mlx5_cmd_init(struct mlx5_core_dev *dev) + + cmd->checksum_disabled = 1; + cmd->max_reg_cmds = (1 << cmd->log_sz) - 1; +- cmd->bitmask = (1 << cmd->max_reg_cmds) - 1; ++ cmd->bitmask = (1UL << cmd->max_reg_cmds) - 1; + + cmd->cmdif_rev = ioread32be(&dev->iseg->cmdif_rev_fw_sub) >> 16; + if (cmd->cmdif_rev > CMD_IF_REV) { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 225b2ad3e15f..337ce9423794 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -4022,7 +4022,7 @@ static void mlx5e_set_netdev_dev_addr(struct net_device *netdev) + } + } + +-#if IS_ENABLED(CONFIG_NET_SWITCHDEV) && IS_ENABLED(CONFIG_MLX5_ESWITCH) ++#if IS_ENABLED(CONFIG_MLX5_ESWITCH) + static const struct switchdev_ops mlx5e_switchdev_ops = { + .switchdev_port_attr_get = mlx5e_attr_get, + }; +@@ -4126,7 +4126,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + + mlx5e_set_netdev_dev_addr(netdev); + +-#if IS_ENABLED(CONFIG_NET_SWITCHDEV) && IS_ENABLED(CONFIG_MLX5_ESWITCH) ++#if IS_ENABLED(CONFIG_MLX5_ESWITCH) + if (MLX5_VPORT_MANAGER(mdev)) + netdev->switchdev_ops = &mlx5e_switchdev_ops; + #endif +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 5ffd1db4e797..4727e7390834 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -825,9 +825,7 @@ static void mlx5e_build_rep_netdev(struct net_device *netdev) + + netdev->ethtool_ops = &mlx5e_rep_ethtool_ops; + +-#ifdef CONFIG_NET_SWITCHDEV + netdev->switchdev_ops = &mlx5e_rep_switchdev_ops; +-#endif + + netdev->features |= NETIF_F_VLAN_CHALLENGED | NETIF_F_HW_TC | NETIF_F_NETNS_LOCAL; + netdev->hw_features |= NETIF_F_HW_TC; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index ede66e6af786..e28f9dab9ceb 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -2018,7 +2018,8 @@ static int parse_tc_fdb_actions(struct mlx5e_priv *priv, struct tcf_exts *exts, + if (tcf_vlan_action(a) == TCA_VLAN_ACT_POP) { + attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_POP; + } else if (tcf_vlan_action(a) == TCA_VLAN_ACT_PUSH) { +- if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q)) ++ if (tcf_vlan_push_proto(a) != htons(ETH_P_8021Q) || ++ tcf_vlan_push_prio(a)) + return -EOPNOTSUPP; + + attr->action |= MLX5_FLOW_CONTEXT_ACTION_VLAN_PUSH; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h +index f6963b0b4a55..122506daa586 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.h +@@ -107,20 +107,20 @@ static const struct mlxsw_afk_element_info mlxsw_afk_element_infos[] = { + MLXSW_AFK_ELEMENT_INFO_U32(VID, 0x10, 8, 12), + MLXSW_AFK_ELEMENT_INFO_U32(PCP, 0x10, 20, 3), + MLXSW_AFK_ELEMENT_INFO_U32(TCP_FLAGS, 0x10, 23, 9), +- MLXSW_AFK_ELEMENT_INFO_U32(IP_TTL_, 0x14, 0, 8), +- MLXSW_AFK_ELEMENT_INFO_U32(IP_ECN, 0x14, 9, 2), +- MLXSW_AFK_ELEMENT_INFO_U32(IP_DSCP, 0x14, 11, 6), +- MLXSW_AFK_ELEMENT_INFO_U32(SRC_IP4, 0x18, 0, 32), +- MLXSW_AFK_ELEMENT_INFO_U32(DST_IP4, 0x1C, 0, 32), +- MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_HI, 0x18, 8), +- MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_LO, 0x20, 8), +- MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_HI, 0x28, 8), +- MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_LO, 0x30, 8), + MLXSW_AFK_ELEMENT_INFO_U32(DST_L4_PORT, 0x14, 0, 16), + MLXSW_AFK_ELEMENT_INFO_U32(SRC_L4_PORT, 0x14, 16, 16), ++ MLXSW_AFK_ELEMENT_INFO_U32(IP_TTL_, 0x18, 0, 8), ++ MLXSW_AFK_ELEMENT_INFO_U32(IP_ECN, 0x18, 9, 2), ++ MLXSW_AFK_ELEMENT_INFO_U32(IP_DSCP, 0x18, 11, 6), ++ MLXSW_AFK_ELEMENT_INFO_U32(SRC_IP4, 0x20, 0, 32), ++ MLXSW_AFK_ELEMENT_INFO_U32(DST_IP4, 0x24, 0, 32), ++ MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_HI, 0x20, 8), ++ MLXSW_AFK_ELEMENT_INFO_BUF(SRC_IP6_LO, 0x28, 8), ++ MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_HI, 0x30, 8), ++ MLXSW_AFK_ELEMENT_INFO_BUF(DST_IP6_LO, 0x38, 8), + }; + +-#define MLXSW_AFK_ELEMENT_STORAGE_SIZE 0x38 ++#define MLXSW_AFK_ELEMENT_STORAGE_SIZE 0x40 + + struct mlxsw_afk_element_inst { /* element instance in actual block */ + const struct mlxsw_afk_element_info *info; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +index 99bd6e88ebc7..8b48338b4a70 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -1417,6 +1417,7 @@ mlxsw_sp_port_vlan_create(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid) + } + + mlxsw_sp_port_vlan->mlxsw_sp_port = mlxsw_sp_port; ++ mlxsw_sp_port_vlan->ref_count = 1; + mlxsw_sp_port_vlan->vid = vid; + list_add(&mlxsw_sp_port_vlan->list, &mlxsw_sp_port->vlans_list); + +@@ -1444,8 +1445,10 @@ mlxsw_sp_port_vlan_get(struct mlxsw_sp_port *mlxsw_sp_port, u16 vid) + struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan; + + mlxsw_sp_port_vlan = mlxsw_sp_port_vlan_find_by_vid(mlxsw_sp_port, vid); +- if (mlxsw_sp_port_vlan) ++ if (mlxsw_sp_port_vlan) { ++ mlxsw_sp_port_vlan->ref_count++; + return mlxsw_sp_port_vlan; ++ } + + return mlxsw_sp_port_vlan_create(mlxsw_sp_port, vid); + } +@@ -1454,6 +1457,9 @@ void mlxsw_sp_port_vlan_put(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan) + { + struct mlxsw_sp_fid *fid = mlxsw_sp_port_vlan->fid; + ++ if (--mlxsw_sp_port_vlan->ref_count != 0) ++ return; ++ + if (mlxsw_sp_port_vlan->bridge_port) + mlxsw_sp_port_vlan_bridge_leave(mlxsw_sp_port_vlan); + else if (fid) +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +index 88892d47acae..8c4ce0a0cc82 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h +@@ -194,6 +194,7 @@ struct mlxsw_sp_port_vlan { + struct list_head list; + struct mlxsw_sp_port *mlxsw_sp_port; + struct mlxsw_sp_fid *fid; ++ unsigned int ref_count; + u16 vid; + struct mlxsw_sp_bridge_port *bridge_port; + struct list_head bridge_vlan_node; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +index bbd238e50f05..54262af4e98f 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_fid.c +@@ -112,11 +112,11 @@ static const int mlxsw_sp_sfgc_bc_packet_types[MLXSW_REG_SFGC_TYPE_MAX] = { + [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_NON_IP] = 1, + [MLXSW_REG_SFGC_TYPE_IPV4_LINK_LOCAL] = 1, + [MLXSW_REG_SFGC_TYPE_IPV6_ALL_HOST] = 1, ++ [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV6] = 1, + }; + + static const int mlxsw_sp_sfgc_mc_packet_types[MLXSW_REG_SFGC_TYPE_MAX] = { + [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV4] = 1, +- [MLXSW_REG_SFGC_TYPE_UNREGISTERED_MULTICAST_IPV6] = 1, + }; + + static const int *mlxsw_sp_packet_type_sfgc_types[] = { +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index af106be8cc08..629bfa0cd3f0 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -2471,7 +2471,10 @@ int qed_cxt_free_proto_ilt(struct qed_hwfn *p_hwfn, enum protocol_type proto) + if (rc) + return rc; + +- /* Free Task CXT */ ++ /* Free Task CXT ( Intentionally RoCE as task-id is shared between ++ * RoCE and iWARP ) ++ */ ++ proto = PROTOCOLID_ROCE; + rc = qed_cxt_free_ilt_range(p_hwfn, QED_ELEM_TASK, 0, + qed_cxt_get_proto_tid_count(p_hwfn, proto)); + if (rc) +diff --git a/drivers/net/ethernet/qlogic/qed/qed_rdma.c b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +index 6fb99518a61f..1b6554866138 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_rdma.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_rdma.c +@@ -360,6 +360,7 @@ static void qed_rdma_free(struct qed_hwfn *p_hwfn) + DP_VERBOSE(p_hwfn, QED_MSG_RDMA, "Freeing RDMA\n"); + + qed_rdma_resc_free(p_hwfn); ++ qed_cxt_free_proto_ilt(p_hwfn, p_hwfn->p_rdma_info->proto); + } + + static void qed_rdma_get_guid(struct qed_hwfn *p_hwfn, u8 *guid) +diff --git a/drivers/net/ethernet/qlogic/qede/qede_fp.c b/drivers/net/ethernet/qlogic/qede/qede_fp.c +index 6fc854b120b0..d50cc2635477 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_fp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_fp.c +@@ -320,13 +320,11 @@ static inline void qede_update_tx_producer(struct qede_tx_queue *txq) + barrier(); + writel(txq->tx_db.raw, txq->doorbell_addr); + +- /* mmiowb is needed to synchronize doorbell writes from more than one +- * processor. It guarantees that the write arrives to the device before +- * the queue lock is released and another start_xmit is called (possibly +- * on another CPU). Without this barrier, the next doorbell can bypass +- * this doorbell. This is applicable to IA64/Altix systems. ++ /* Fence required to flush the write combined buffer, since another ++ * CPU may write to the same doorbell address and data may be lost ++ * due to relaxed order nature of write combined bar. + */ +- mmiowb(); ++ wmb(); + } + + static int qede_xdp_xmit(struct qede_dev *edev, struct qede_fastpath *fp, +@@ -1247,16 +1245,10 @@ static int qede_rx_process_cqe(struct qede_dev *edev, + + csum_flag = qede_check_csum(parse_flag); + if (unlikely(csum_flag == QEDE_CSUM_ERROR)) { +- if (qede_pkt_is_ip_fragmented(fp_cqe, parse_flag)) { ++ if (qede_pkt_is_ip_fragmented(fp_cqe, parse_flag)) + rxq->rx_ip_frags++; +- } else { +- DP_NOTICE(edev, +- "CQE has error, flags = %x, dropping incoming packet\n", +- parse_flag); ++ else + rxq->rx_hw_errors++; +- qede_recycle_rx_bd_ring(rxq, fp_cqe->bd_num); +- return 0; +- } + } + + /* Basic validation passed; Need to prepare an SKB. This would also +diff --git a/drivers/net/ethernet/qualcomm/emac/emac-mac.c b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +index 3ed9033e56db..44f797ab5d15 100644 +--- a/drivers/net/ethernet/qualcomm/emac/emac-mac.c ++++ b/drivers/net/ethernet/qualcomm/emac/emac-mac.c +@@ -1204,9 +1204,9 @@ void emac_mac_tx_process(struct emac_adapter *adpt, struct emac_tx_queue *tx_q) + while (tx_q->tpd.consume_idx != hw_consume_idx) { + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.consume_idx); + if (tpbuf->dma_addr) { +- dma_unmap_single(adpt->netdev->dev.parent, +- tpbuf->dma_addr, tpbuf->length, +- DMA_TO_DEVICE); ++ dma_unmap_page(adpt->netdev->dev.parent, ++ tpbuf->dma_addr, tpbuf->length, ++ DMA_TO_DEVICE); + tpbuf->dma_addr = 0; + } + +@@ -1363,9 +1363,11 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt, + + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx); + tpbuf->length = mapped_len; +- tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent, +- skb->data, tpbuf->length, +- DMA_TO_DEVICE); ++ tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent, ++ virt_to_page(skb->data), ++ offset_in_page(skb->data), ++ tpbuf->length, ++ DMA_TO_DEVICE); + ret = dma_mapping_error(adpt->netdev->dev.parent, + tpbuf->dma_addr); + if (ret) +@@ -1381,9 +1383,12 @@ static void emac_tx_fill_tpd(struct emac_adapter *adpt, + if (mapped_len < len) { + tpbuf = GET_TPD_BUFFER(tx_q, tx_q->tpd.produce_idx); + tpbuf->length = len - mapped_len; +- tpbuf->dma_addr = dma_map_single(adpt->netdev->dev.parent, +- skb->data + mapped_len, +- tpbuf->length, DMA_TO_DEVICE); ++ tpbuf->dma_addr = dma_map_page(adpt->netdev->dev.parent, ++ virt_to_page(skb->data + ++ mapped_len), ++ offset_in_page(skb->data + ++ mapped_len), ++ tpbuf->length, DMA_TO_DEVICE); + ret = dma_mapping_error(adpt->netdev->dev.parent, + tpbuf->dma_addr); + if (ret) +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index db31963c5d9d..38080e95a82d 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -753,6 +753,7 @@ static struct sh_eth_cpu_data sh7757_data = { + .rpadir = 1, + .rpadir_value = 2 << 16, + .rtrate = 1, ++ .dual_port = 1, + }; + + #define SH_GIGA_ETH_BASE 0xfee00000UL +@@ -831,6 +832,7 @@ static struct sh_eth_cpu_data sh7757_data_giga = { + .no_trimd = 1, + .no_ade = 1, + .tsu = 1, ++ .dual_port = 1, + }; + + /* SH7734 */ +@@ -901,6 +903,7 @@ static struct sh_eth_cpu_data sh7763_data = { + .tsu = 1, + .irq_flags = IRQF_SHARED, + .magic = 1, ++ .dual_port = 1, + }; + + static struct sh_eth_cpu_data sh7619_data = { +@@ -933,6 +936,7 @@ static struct sh_eth_cpu_data sh771x_data = { + EESIPR_RRFIP | EESIPR_RTLFIP | EESIPR_RTSFIP | + EESIPR_PREIP | EESIPR_CERFIP, + .tsu = 1, ++ .dual_port = 1, + }; + + static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd) +@@ -2911,7 +2915,7 @@ static int sh_eth_vlan_rx_kill_vid(struct net_device *ndev, + /* SuperH's TSU register init function */ + static void sh_eth_tsu_init(struct sh_eth_private *mdp) + { +- if (sh_eth_is_rz_fast_ether(mdp)) { ++ if (!mdp->cd->dual_port) { + sh_eth_tsu_write(mdp, 0, TSU_TEN); /* Disable all CAM entry */ + sh_eth_tsu_write(mdp, TSU_FWSLC_POSTENU | TSU_FWSLC_POSTENL, + TSU_FWSLC); /* Enable POST registers */ +diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h +index a6753ccba711..6ab3d46d4f28 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.h ++++ b/drivers/net/ethernet/renesas/sh_eth.h +@@ -509,6 +509,7 @@ struct sh_eth_cpu_data { + unsigned rmiimode:1; /* EtherC has RMIIMODE register */ + unsigned rtrate:1; /* EtherC has RTRATE register */ + unsigned magic:1; /* EtherC has ECMR.MPDE and ECSR.MPD */ ++ unsigned dual_port:1; /* Dual EtherC/E-DMAC */ + }; + + struct sh_eth_private { +diff --git a/drivers/net/ethernet/smsc/smsc911x.c b/drivers/net/ethernet/smsc/smsc911x.c +index 012fb66eed8d..f0afb88d7bc2 100644 +--- a/drivers/net/ethernet/smsc/smsc911x.c ++++ b/drivers/net/ethernet/smsc/smsc911x.c +@@ -2335,14 +2335,14 @@ static int smsc911x_drv_remove(struct platform_device *pdev) + pdata = netdev_priv(dev); + BUG_ON(!pdata); + BUG_ON(!pdata->ioaddr); +- WARN_ON(dev->phydev); + + SMSC_TRACE(pdata, ifdown, "Stopping driver"); + ++ unregister_netdev(dev); ++ + mdiobus_unregister(pdata->mii_bus); + mdiobus_free(pdata->mii_bus); + +- unregister_netdev(dev); + res = platform_get_resource_byname(pdev, IORESOURCE_MEM, + "smsc911x-memory"); + if (!res) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index d0cc73795056..9866d2e34cdd 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1829,6 +1829,11 @@ static void stmmac_tx_clean(struct stmmac_priv *priv, u32 queue) + if (unlikely(status & tx_dma_own)) + break; + ++ /* Make sure descriptor fields are read after reading ++ * the own bit. ++ */ ++ dma_rmb(); ++ + /* Just consider the last segment and ...*/ + if (likely(!(status & tx_not_ls))) { + /* ... verify the status error condition */ +@@ -2368,7 +2373,7 @@ static void stmmac_mac_config_rx_queues_routing(struct stmmac_priv *priv) + continue; + + packet = priv->plat->rx_queues_cfg[queue].pkt_route; +- priv->hw->mac->rx_queue_prio(priv->hw, packet, queue); ++ priv->hw->mac->rx_queue_routing(priv->hw, packet, queue); + } + } + +@@ -2918,8 +2923,15 @@ static netdev_tx_t stmmac_tso_xmit(struct sk_buff *skb, struct net_device *dev) + tcp_hdrlen(skb) / 4, (skb->len - proto_hdr_len)); + + /* If context desc is used to change MSS */ +- if (mss_desc) ++ if (mss_desc) { ++ /* Make sure that first descriptor has been completely ++ * written, including its own bit. This is because MSS is ++ * actually before first descriptor, so we need to make ++ * sure that MSS's own bit is the last thing written. ++ */ ++ dma_wmb(); + priv->hw->desc->set_tx_owner(mss_desc); ++ } + + /* The own bit must be the latest setting done when prepare the + * descriptor and then barrier is needed to make sure that +diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c +index 0b95105f7060..65347d2f139b 100644 +--- a/drivers/net/ethernet/sun/sunvnet.c ++++ b/drivers/net/ethernet/sun/sunvnet.c +@@ -311,7 +311,7 @@ static struct vnet *vnet_new(const u64 *local_mac, + dev->ethtool_ops = &vnet_ethtool_ops; + dev->watchdog_timeo = VNET_TX_TIMEOUT; + +- dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_GSO_SOFTWARE | ++ dev->hw_features = NETIF_F_TSO | NETIF_F_GSO | NETIF_F_ALL_TSO | + NETIF_F_HW_CSUM | NETIF_F_SG; + dev->features = dev->hw_features; + +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 99be63eacaeb..4647ecbe6f36 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1261,7 +1261,7 @@ void netvsc_channel_cb(void *context) + /* disable interupts from host */ + hv_begin_read(rbi); + +- __napi_schedule(&nvchan->napi); ++ __napi_schedule_irqoff(&nvchan->napi); + } + } + +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 11b46c8d2d67..3a7241c8713c 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -66,12 +66,43 @@ static int debug = -1; + module_param(debug, int, S_IRUGO); + MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)"); + +-static void netvsc_set_multicast_list(struct net_device *net) ++static void netvsc_change_rx_flags(struct net_device *net, int change) + { +- struct net_device_context *net_device_ctx = netdev_priv(net); +- struct netvsc_device *nvdev = rtnl_dereference(net_device_ctx->nvdev); ++ struct net_device_context *ndev_ctx = netdev_priv(net); ++ struct net_device *vf_netdev = rtnl_dereference(ndev_ctx->vf_netdev); ++ int inc; + +- rndis_filter_update(nvdev); ++ if (!vf_netdev) ++ return; ++ ++ if (change & IFF_PROMISC) { ++ inc = (net->flags & IFF_PROMISC) ? 1 : -1; ++ dev_set_promiscuity(vf_netdev, inc); ++ } ++ ++ if (change & IFF_ALLMULTI) { ++ inc = (net->flags & IFF_ALLMULTI) ? 1 : -1; ++ dev_set_allmulti(vf_netdev, inc); ++ } ++} ++ ++static void netvsc_set_rx_mode(struct net_device *net) ++{ ++ struct net_device_context *ndev_ctx = netdev_priv(net); ++ struct net_device *vf_netdev; ++ struct netvsc_device *nvdev; ++ ++ rcu_read_lock(); ++ vf_netdev = rcu_dereference(ndev_ctx->vf_netdev); ++ if (vf_netdev) { ++ dev_uc_sync(vf_netdev, net); ++ dev_mc_sync(vf_netdev, net); ++ } ++ ++ nvdev = rcu_dereference(ndev_ctx->nvdev); ++ if (nvdev) ++ rndis_filter_update(nvdev); ++ rcu_read_unlock(); + } + + static int netvsc_open(struct net_device *net) +@@ -1582,7 +1613,8 @@ static const struct net_device_ops device_ops = { + .ndo_open = netvsc_open, + .ndo_stop = netvsc_close, + .ndo_start_xmit = netvsc_start_xmit, +- .ndo_set_rx_mode = netvsc_set_multicast_list, ++ .ndo_change_rx_flags = netvsc_change_rx_flags, ++ .ndo_set_rx_mode = netvsc_set_rx_mode, + .ndo_change_mtu = netvsc_change_mtu, + .ndo_validate_addr = eth_validate_addr, + .ndo_set_mac_address = netvsc_set_mac_addr, +@@ -1814,6 +1846,15 @@ static void __netvsc_vf_setup(struct net_device *ndev, + netdev_warn(vf_netdev, + "unable to change mtu to %u\n", ndev->mtu); + ++ /* set multicast etc flags on VF */ ++ dev_change_flags(vf_netdev, ndev->flags | IFF_SLAVE); ++ ++ /* sync address list from ndev to VF */ ++ netif_addr_lock_bh(ndev); ++ dev_uc_sync(vf_netdev, ndev); ++ dev_mc_sync(vf_netdev, ndev); ++ netif_addr_unlock_bh(ndev); ++ + if (netif_running(ndev)) { + ret = dev_open(vf_netdev); + if (ret) +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index 6dde92c1c113..d1ae184008b4 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -850,15 +850,19 @@ static void rndis_set_multicast(struct work_struct *w) + { + struct rndis_device *rdev + = container_of(w, struct rndis_device, mcast_work); ++ u32 filter = NDIS_PACKET_TYPE_DIRECTED; ++ unsigned int flags = rdev->ndev->flags; + +- if (rdev->ndev->flags & IFF_PROMISC) +- rndis_filter_set_packet_filter(rdev, +- NDIS_PACKET_TYPE_PROMISCUOUS); +- else +- rndis_filter_set_packet_filter(rdev, +- NDIS_PACKET_TYPE_BROADCAST | +- NDIS_PACKET_TYPE_ALL_MULTICAST | +- NDIS_PACKET_TYPE_DIRECTED); ++ if (flags & IFF_PROMISC) { ++ filter = NDIS_PACKET_TYPE_PROMISCUOUS; ++ } else { ++ if (!netdev_mc_empty(rdev->ndev) || (flags & IFF_ALLMULTI)) ++ filter |= NDIS_PACKET_TYPE_ALL_MULTICAST; ++ if (flags & IFF_BROADCAST) ++ filter |= NDIS_PACKET_TYPE_BROADCAST; ++ } ++ ++ rndis_filter_set_packet_filter(rdev, filter); + } + + void rndis_filter_update(struct netvsc_device *nvdev) +diff --git a/drivers/net/ieee802154/ca8210.c b/drivers/net/ieee802154/ca8210.c +index 24a1eabbbc9d..22e466ea919a 100644 +--- a/drivers/net/ieee802154/ca8210.c ++++ b/drivers/net/ieee802154/ca8210.c +@@ -2493,13 +2493,14 @@ static ssize_t ca8210_test_int_user_write( + struct ca8210_priv *priv = filp->private_data; + u8 command[CA8210_SPI_BUF_SIZE]; + +- if (len > CA8210_SPI_BUF_SIZE) { ++ memset(command, SPI_IDLE, 6); ++ if (len > CA8210_SPI_BUF_SIZE || len < 2) { + dev_warn( + &priv->spi->dev, +- "userspace requested erroneously long write (%zu)\n", ++ "userspace requested erroneous write length (%zu)\n", + len + ); +- return -EMSGSIZE; ++ return -EBADE; + } + + ret = copy_from_user(command, in_buf, len); +@@ -2511,6 +2512,13 @@ static ssize_t ca8210_test_int_user_write( + ); + return -EIO; + } ++ if (len != command[1] + 2) { ++ dev_err( ++ &priv->spi->dev, ++ "write len does not match packet length field\n" ++ ); ++ return -EBADE; ++ } + + ret = ca8210_test_check_upstream(command, priv->spi); + if (ret == 0) { +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 0f35597553f4..963a02c988e9 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1448,7 +1448,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev, + /* the macvlan port may be freed by macvlan_uninit when fail to register. + * so we destroy the macvlan port only when it's valid. + */ +- if (create && macvlan_port_get_rtnl(dev)) ++ if (create && macvlan_port_get_rtnl(lowerdev)) + macvlan_port_destroy(port->dev); + return err; + } +diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c +index cbd629822f04..26fbbd3ffe33 100644 +--- a/drivers/net/phy/dp83640.c ++++ b/drivers/net/phy/dp83640.c +@@ -1207,6 +1207,23 @@ static void dp83640_remove(struct phy_device *phydev) + kfree(dp83640); + } + ++static int dp83640_soft_reset(struct phy_device *phydev) ++{ ++ int ret; ++ ++ ret = genphy_soft_reset(phydev); ++ if (ret < 0) ++ return ret; ++ ++ /* From DP83640 datasheet: "Software driver code must wait 3 us ++ * following a software reset before allowing further serial MII ++ * operations with the DP83640." ++ */ ++ udelay(10); /* Taking udelay inaccuracy into account */ ++ ++ return 0; ++} ++ + static int dp83640_config_init(struct phy_device *phydev) + { + struct dp83640_private *dp83640 = phydev->priv; +@@ -1501,6 +1518,7 @@ static struct phy_driver dp83640_driver = { + .flags = PHY_HAS_INTERRUPT, + .probe = dp83640_probe, + .remove = dp83640_remove, ++ .soft_reset = dp83640_soft_reset, + .config_init = dp83640_config_init, + .config_aneg = genphy_config_aneg, + .read_status = genphy_read_status, +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 1fb464837b3e..9881edc568ba 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -2083,10 +2083,6 @@ static int lan78xx_phy_init(struct lan78xx_net *dev) + + dev->fc_autoneg = phydev->autoneg; + +- phy_start(phydev); +- +- netif_dbg(dev, ifup, dev->net, "phy initialised successfully"); +- + return 0; + + error: +@@ -2352,6 +2348,7 @@ static int lan78xx_reset(struct lan78xx_net *dev) + u32 buf; + int ret = 0; + unsigned long timeout; ++ u8 sig; + + ret = lan78xx_read_reg(dev, HW_CFG, &buf); + buf |= HW_CFG_LRST_; +@@ -2451,6 +2448,15 @@ static int lan78xx_reset(struct lan78xx_net *dev) + /* LAN7801 only has RGMII mode */ + if (dev->chipid == ID_REV_CHIP_ID_7801_) + buf &= ~MAC_CR_GMII_EN_; ++ ++ if (dev->chipid == ID_REV_CHIP_ID_7800_) { ++ ret = lan78xx_read_raw_eeprom(dev, 0, 1, &sig); ++ if (!ret && sig != EEPROM_INDICATOR) { ++ /* Implies there is no external eeprom. Set mac speed */ ++ netdev_info(dev->net, "No External EEPROM. Setting MAC Speed\n"); ++ buf |= MAC_CR_AUTO_DUPLEX_ | MAC_CR_AUTO_SPEED_; ++ } ++ } + ret = lan78xx_write_reg(dev, MAC_CR, buf); + + ret = lan78xx_read_reg(dev, MAC_TX, &buf); +@@ -2513,9 +2519,9 @@ static int lan78xx_open(struct net_device *net) + if (ret < 0) + goto done; + +- ret = lan78xx_phy_init(dev); +- if (ret < 0) +- goto done; ++ phy_start(net->phydev); ++ ++ netif_dbg(dev, ifup, dev->net, "phy initialised successfully"); + + /* for Link Check */ + if (dev->urb_intr) { +@@ -2576,13 +2582,8 @@ static int lan78xx_stop(struct net_device *net) + if (timer_pending(&dev->stat_monitor)) + del_timer_sync(&dev->stat_monitor); + +- phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0); +- phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0); +- +- phy_stop(net->phydev); +- phy_disconnect(net->phydev); +- +- net->phydev = NULL; ++ if (net->phydev) ++ phy_stop(net->phydev); + + clear_bit(EVENT_DEV_OPEN, &dev->flags); + netif_stop_queue(net); +@@ -3497,8 +3498,13 @@ static void lan78xx_disconnect(struct usb_interface *intf) + return; + + udev = interface_to_usbdev(intf); +- + net = dev->net; ++ ++ phy_unregister_fixup_for_uid(PHY_KSZ9031RNX, 0xfffffff0); ++ phy_unregister_fixup_for_uid(PHY_LAN8835, 0xfffffff0); ++ ++ phy_disconnect(net->phydev); ++ + unregister_netdev(net); + + cancel_delayed_work_sync(&dev->wq); +@@ -3658,8 +3664,14 @@ static int lan78xx_probe(struct usb_interface *intf, + pm_runtime_set_autosuspend_delay(&udev->dev, + DEFAULT_AUTOSUSPEND_DELAY); + ++ ret = lan78xx_phy_init(dev); ++ if (ret < 0) ++ goto out4; ++ + return 0; + ++out4: ++ unregister_netdev(netdev); + out3: + lan78xx_unbind(dev, intf); + out2: +@@ -4007,7 +4019,7 @@ static int lan78xx_reset_resume(struct usb_interface *intf) + + lan78xx_reset(dev); + +- lan78xx_phy_init(dev); ++ phy_start(dev->net->phydev); + + return lan78xx_resume(intf); + } +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index e522085ecbf7..8e06f308ce44 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1184,6 +1184,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ + {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ ++ {QMI_FIXED_INTF(0x2020, 0x2033, 4)}, /* BroadMobi BM806U */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index d51d9abf7986..aa88b640cb6c 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -1793,7 +1793,7 @@ static int r8152_tx_agg_fill(struct r8152 *tp, struct tx_agg *agg) + + tx_data += len; + agg->skb_len += len; +- agg->skb_num++; ++ agg->skb_num += skb_shinfo(skb)->gso_segs ?: 1; + + dev_kfree_skb_any(skb); + +diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c +index d0a113743195..7a6a1fe79309 100644 +--- a/drivers/net/usb/smsc75xx.c ++++ b/drivers/net/usb/smsc75xx.c +@@ -954,10 +954,11 @@ static int smsc75xx_set_features(struct net_device *netdev, + /* it's racing here! */ + + ret = smsc75xx_write_reg(dev, RFE_CTL, pdata->rfe_ctl); +- if (ret < 0) ++ if (ret < 0) { + netdev_warn(dev->net, "Error writing RFE_CTL\n"); +- +- return ret; ++ return ret; ++ } ++ return 0; + } + + static int smsc75xx_wait_ready(struct usbnet *dev, int in_pm) +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index bb15b3012aa5..948611317c97 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -513,7 +513,7 @@ static struct sk_buff *receive_small(struct net_device *dev, + void *orig_data; + u32 act; + +- if (unlikely(hdr->hdr.gso_type || hdr->hdr.flags)) ++ if (unlikely(hdr->hdr.gso_type)) + goto err_xdp; + + if (unlikely(xdp_headroom < virtnet_get_headroom(vi))) { +@@ -2655,8 +2655,8 @@ static int virtnet_probe(struct virtio_device *vdev) + + /* Assume link up if device can't report link status, + otherwise get link status from config. */ ++ netif_carrier_off(dev); + if (virtio_has_feature(vi->vdev, VIRTIO_NET_F_STATUS)) { +- netif_carrier_off(dev); + schedule_work(&vi->config_work); + } else { + vi->status = VIRTIO_NET_S_LINK_UP; +diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c +index c1772215702a..df11bb449988 100644 +--- a/drivers/net/wireless/ath/ath10k/mac.c ++++ b/drivers/net/wireless/ath/ath10k/mac.c +@@ -7059,10 +7059,20 @@ static void ath10k_sta_rc_update(struct ieee80211_hw *hw, + { + struct ath10k *ar = hw->priv; + struct ath10k_sta *arsta = (struct ath10k_sta *)sta->drv_priv; ++ struct ath10k_vif *arvif = (void *)vif->drv_priv; ++ struct ath10k_peer *peer; + u32 bw, smps; + + spin_lock_bh(&ar->data_lock); + ++ peer = ath10k_peer_find(ar, arvif->vdev_id, sta->addr); ++ if (!peer) { ++ spin_unlock_bh(&ar->data_lock); ++ ath10k_warn(ar, "mac sta rc update failed to find peer %pM on vdev %i\n", ++ sta->addr, arvif->vdev_id); ++ return; ++ } ++ + ath10k_dbg(ar, ATH10K_DBG_MAC, + "mac sta rc update for %pM changed %08x bw %d nss %d smps %d\n", + sta->addr, changed, sta->bandwidth, sta->rx_nss, +@@ -7810,6 +7820,7 @@ static const struct ieee80211_iface_combination ath10k_10x_if_comb[] = { + .max_interfaces = 8, + .num_different_channels = 1, + .beacon_int_infra_match = true, ++ .beacon_int_min_gcd = 1, + #ifdef CONFIG_ATH10K_DFS_CERTIFIED + .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) | + BIT(NL80211_CHAN_WIDTH_20) | +@@ -7933,6 +7944,7 @@ static const struct ieee80211_iface_combination ath10k_10_4_if_comb[] = { + .max_interfaces = 16, + .num_different_channels = 1, + .beacon_int_infra_match = true, ++ .beacon_int_min_gcd = 1, + #ifdef CONFIG_ATH10K_DFS_CERTIFIED + .radar_detect_widths = BIT(NL80211_CHAN_WIDTH_20_NOHT) | + BIT(NL80211_CHAN_WIDTH_20) | +diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c +index 5e77fe1f5b0d..a41bcbda1d9e 100644 +--- a/drivers/net/wireless/ath/ath9k/common-spectral.c ++++ b/drivers/net/wireless/ath/ath9k/common-spectral.c +@@ -479,14 +479,16 @@ ath_cmn_is_fft_buf_full(struct ath_spec_scan_priv *spec_priv) + { + int i = 0; + int ret = 0; ++ struct rchan_buf *buf; + struct rchan *rc = spec_priv->rfs_chan_spec_scan; + +- for_each_online_cpu(i) +- ret += relay_buf_full(*per_cpu_ptr(rc->buf, i)); +- +- i = num_online_cpus(); ++ for_each_possible_cpu(i) { ++ if ((buf = *per_cpu_ptr(rc->buf, i))) { ++ ret += relay_buf_full(buf); ++ } ++ } + +- if (ret == i) ++ if (ret) + return 1; + else + return 0; +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +index 4157c90ad973..083e5ce7eac7 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c +@@ -6916,7 +6916,7 @@ static void brcmf_cfg80211_reg_notifier(struct wiphy *wiphy, + return; + + /* ignore non-ISO3166 country codes */ +- for (i = 0; i < sizeof(req->alpha2); i++) ++ for (i = 0; i < 2; i++) + if (req->alpha2[i] < 'A' || req->alpha2[i] > 'Z') { + brcmf_err("not an ISO3166 code (0x%02x 0x%02x)\n", + req->alpha2[0], req->alpha2[1]); +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h +index 3721a3ed358b..f824bebceb06 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/api/time-event.h +@@ -211,7 +211,7 @@ enum { + * @TE_V2_NOTIF_HOST_FRAG_END:request/receive notification on frag end + * @TE_V2_NOTIF_INTERNAL_FRAG_START: internal FW use. + * @TE_V2_NOTIF_INTERNAL_FRAG_END: internal FW use. +- * @T2_V2_START_IMMEDIATELY: start time event immediately ++ * @TE_V2_START_IMMEDIATELY: start time event immediately + * @TE_V2_DEP_OTHER: depends on another time event + * @TE_V2_DEP_TSF: depends on a specific time + * @TE_V2_EVENT_SOCIOPATHIC: can't co-exist with other events of tha same MAC +@@ -230,7 +230,7 @@ enum iwl_time_event_policy { + TE_V2_NOTIF_HOST_FRAG_END = BIT(5), + TE_V2_NOTIF_INTERNAL_FRAG_START = BIT(6), + TE_V2_NOTIF_INTERNAL_FRAG_END = BIT(7), +- T2_V2_START_IMMEDIATELY = BIT(11), ++ TE_V2_START_IMMEDIATELY = BIT(11), + + /* placement characteristics */ + TE_V2_DEP_OTHER = BIT(TE_V2_PLACEMENT_POS), +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +index f5dd7d83cd0a..2fa7ec466275 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -33,6 +34,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -928,7 +930,6 @@ void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt) + + out: + iwl_fw_free_dump_desc(fwrt); +- fwrt->dump.trig = NULL; + clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status); + } + IWL_EXPORT_SYMBOL(iwl_fw_error_dump); +@@ -1084,6 +1085,14 @@ void iwl_fw_error_dump_wk(struct work_struct *work) + fwrt->ops->dump_start(fwrt->ops_ctx)) + return; + ++ if (fwrt->ops && fwrt->ops->fw_running && ++ !fwrt->ops->fw_running(fwrt->ops_ctx)) { ++ IWL_ERR(fwrt, "Firmware not running - cannot dump error\n"); ++ iwl_fw_free_dump_desc(fwrt); ++ clear_bit(IWL_FWRT_STATUS_DUMPING, &fwrt->status); ++ goto out; ++ } ++ + if (fwrt->trans->cfg->device_family == IWL_DEVICE_FAMILY_7000) { + /* stop recording */ + iwl_fw_dbg_stop_recording(fwrt); +@@ -1117,7 +1126,7 @@ void iwl_fw_error_dump_wk(struct work_struct *work) + iwl_write_prph(fwrt->trans, DBGC_OUT_CTRL, out_ctrl); + } + } +- ++out: + if (fwrt->ops && fwrt->ops->dump_end) + fwrt->ops->dump_end(fwrt->ops_ctx); + } +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h +index 223fb77a3aa9..72259bff9922 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/dbg.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/dbg.h +@@ -8,6 +8,7 @@ + * Copyright(c) 2008 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -33,6 +34,7 @@ + * Copyright(c) 2005 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2015 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -91,6 +93,7 @@ static inline void iwl_fw_free_dump_desc(struct iwl_fw_runtime *fwrt) + if (fwrt->dump.desc != &iwl_dump_desc_assert) + kfree(fwrt->dump.desc); + fwrt->dump.desc = NULL; ++ fwrt->dump.trig = NULL; + } + + void iwl_fw_error_dump(struct iwl_fw_runtime *fwrt); +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h +index 50cfb6d795a5..fb1ad3c5c93c 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/runtime.h ++++ b/drivers/net/wireless/intel/iwlwifi/fw/runtime.h +@@ -6,6 +6,7 @@ + * GPL LICENSE SUMMARY + * + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -26,6 +27,7 @@ + * BSD LICENSE + * + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -68,6 +70,7 @@ + struct iwl_fw_runtime_ops { + int (*dump_start)(void *ctx); + void (*dump_end)(void *ctx); ++ bool (*fw_running)(void *ctx); + }; + + #define MAX_NUM_LMAC 2 +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +index e97904c2c4d4..714996187236 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/debugfs.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -35,6 +36,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -1209,9 +1211,6 @@ static ssize_t iwl_dbgfs_fw_dbg_collect_write(struct iwl_mvm *mvm, + { + int ret; + +- if (!iwl_mvm_firmware_running(mvm)) +- return -EIO; +- + ret = iwl_mvm_ref_sync(mvm, IWL_MVM_REF_PRPH_WRITE); + if (ret) + return ret; +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +index 2f22e14e00fe..8ba16fc24e3a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac-ctxt.c +@@ -438,7 +438,8 @@ int iwl_mvm_mac_ctxt_init(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + } + + /* Allocate the CAB queue for softAP and GO interfaces */ +- if (vif->type == NL80211_IFTYPE_AP) { ++ if (vif->type == NL80211_IFTYPE_AP || ++ vif->type == NL80211_IFTYPE_ADHOC) { + /* + * For TVQM this will be overwritten later with the FW assigned + * queue value (when queue is enabled). +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +index a9ac872226fd..db1fab9aa1c6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mac80211.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -2127,15 +2128,40 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw, + if (ret) + goto out_remove; + +- ret = iwl_mvm_add_mcast_sta(mvm, vif); +- if (ret) +- goto out_unbind; +- +- /* Send the bcast station. At this stage the TBTT and DTIM time events +- * are added and applied to the scheduler */ +- ret = iwl_mvm_send_add_bcast_sta(mvm, vif); +- if (ret) +- goto out_rm_mcast; ++ /* ++ * This is not very nice, but the simplest: ++ * For older FWs adding the mcast sta before the bcast station may ++ * cause assert 0x2b00. ++ * This is fixed in later FW so make the order of removal depend on ++ * the TLV ++ */ ++ if (fw_has_api(&mvm->fw->ucode_capa, IWL_UCODE_TLV_API_STA_TYPE)) { ++ ret = iwl_mvm_add_mcast_sta(mvm, vif); ++ if (ret) ++ goto out_unbind; ++ /* ++ * Send the bcast station. At this stage the TBTT and DTIM time ++ * events are added and applied to the scheduler ++ */ ++ ret = iwl_mvm_send_add_bcast_sta(mvm, vif); ++ if (ret) { ++ iwl_mvm_rm_mcast_sta(mvm, vif); ++ goto out_unbind; ++ } ++ } else { ++ /* ++ * Send the bcast station. At this stage the TBTT and DTIM time ++ * events are added and applied to the scheduler ++ */ ++ ret = iwl_mvm_send_add_bcast_sta(mvm, vif); ++ if (ret) ++ goto out_unbind; ++ ret = iwl_mvm_add_mcast_sta(mvm, vif); ++ if (ret) { ++ iwl_mvm_send_rm_bcast_sta(mvm, vif); ++ goto out_unbind; ++ } ++ } + + /* must be set before quota calculations */ + mvmvif->ap_ibss_active = true; +@@ -2165,7 +2191,6 @@ static int iwl_mvm_start_ap_ibss(struct ieee80211_hw *hw, + iwl_mvm_power_update_mac(mvm); + mvmvif->ap_ibss_active = false; + iwl_mvm_send_rm_bcast_sta(mvm, vif); +-out_rm_mcast: + iwl_mvm_rm_mcast_sta(mvm, vif); + out_unbind: + iwl_mvm_binding_remove_vif(mvm, vif); +@@ -2703,6 +2728,10 @@ static int iwl_mvm_mac_sta_state(struct ieee80211_hw *hw, + + /* enable beacon filtering */ + WARN_ON(iwl_mvm_enable_beacon_filter(mvm, vif, 0)); ++ ++ iwl_mvm_rs_rate_init(mvm, sta, mvmvif->phy_ctxt->channel->band, ++ false); ++ + ret = 0; + } else if (old_state == IEEE80211_STA_AUTHORIZED && + new_state == IEEE80211_STA_ASSOC) { +@@ -3468,6 +3497,7 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm, + ret = 0; + goto out; + case NL80211_IFTYPE_STATION: ++ mvmvif->csa_bcn_pending = false; + break; + case NL80211_IFTYPE_MONITOR: + /* always disable PS when a monitor interface is active */ +@@ -3511,7 +3541,7 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm, + } + + if (switching_chanctx && vif->type == NL80211_IFTYPE_STATION) { +- u32 duration = 2 * vif->bss_conf.beacon_int; ++ u32 duration = 3 * vif->bss_conf.beacon_int; + + /* iwl_mvm_protect_session() reads directly from the + * device (the system time), so make sure it is +@@ -3524,6 +3554,7 @@ static int __iwl_mvm_assign_vif_chanctx(struct iwl_mvm *mvm, + /* Protect the session to make sure we hear the first + * beacon on the new channel. + */ ++ mvmvif->csa_bcn_pending = true; + iwl_mvm_protect_session(mvm, vif, duration, duration, + vif->bss_conf.beacon_int / 2, + true); +@@ -3967,6 +3998,7 @@ static int iwl_mvm_post_channel_switch(struct ieee80211_hw *hw, + if (vif->type == NL80211_IFTYPE_STATION) { + struct iwl_mvm_sta *mvmsta; + ++ mvmvif->csa_bcn_pending = false; + mvmsta = iwl_mvm_sta_from_staid_protected(mvm, + mvmvif->ap_sta_id); + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +index 2ec27ceb8af9..736c176f1fd6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/mvm.h +@@ -434,6 +434,9 @@ struct iwl_mvm_vif { + bool csa_failed; + u16 csa_target_freq; + ++ /* Indicates that we are waiting for a beacon on a new channel */ ++ bool csa_bcn_pending; ++ + /* TCP Checksum Offload */ + netdev_features_t features; + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +index 9fb40955d5f4..54f411b83bea 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ops.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ops.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -35,6 +36,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -553,9 +555,15 @@ static void iwl_mvm_fwrt_dump_end(void *ctx) + iwl_mvm_unref(mvm, IWL_MVM_REF_FW_DBG_COLLECT); + } + ++static bool iwl_mvm_fwrt_fw_running(void *ctx) ++{ ++ return iwl_mvm_firmware_running(ctx); ++} ++ + static const struct iwl_fw_runtime_ops iwl_mvm_fwrt_ops = { + .dump_start = iwl_mvm_fwrt_dump_start, + .dump_end = iwl_mvm_fwrt_dump_end, ++ .fw_running = iwl_mvm_fwrt_fw_running, + }; + + static struct iwl_op_mode * +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +index d22cef7381ba..386fdee23eb0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rs.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rs.c +@@ -2690,7 +2690,8 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm, + struct ieee80211_sta *sta, + struct iwl_lq_sta *lq_sta, + enum nl80211_band band, +- struct rs_rate *rate) ++ struct rs_rate *rate, ++ bool init) + { + int i, nentries; + unsigned long active_rate; +@@ -2744,14 +2745,25 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm, + */ + if (sta->vht_cap.vht_supported && + best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) { +- switch (sta->bandwidth) { +- case IEEE80211_STA_RX_BW_160: +- case IEEE80211_STA_RX_BW_80: +- case IEEE80211_STA_RX_BW_40: ++ /* ++ * In AP mode, when a new station associates, rs is initialized ++ * immediately upon association completion, before the phy ++ * context is updated with the association parameters, so the ++ * sta bandwidth might be wider than the phy context allows. ++ * To avoid this issue, always initialize rs with 20mhz ++ * bandwidth rate, and after authorization, when the phy context ++ * is already up-to-date, re-init rs with the correct bw. ++ */ ++ u32 bw = init ? RATE_MCS_CHAN_WIDTH_20 : rs_bw_from_sta_bw(sta); ++ ++ switch (bw) { ++ case RATE_MCS_CHAN_WIDTH_40: ++ case RATE_MCS_CHAN_WIDTH_80: ++ case RATE_MCS_CHAN_WIDTH_160: + initial_rates = rs_optimal_rates_vht; + nentries = ARRAY_SIZE(rs_optimal_rates_vht); + break; +- case IEEE80211_STA_RX_BW_20: ++ case RATE_MCS_CHAN_WIDTH_20: + initial_rates = rs_optimal_rates_vht_20mhz; + nentries = ARRAY_SIZE(rs_optimal_rates_vht_20mhz); + break; +@@ -2762,7 +2774,7 @@ static void rs_get_initial_rate(struct iwl_mvm *mvm, + + active_rate = lq_sta->active_siso_rate; + rate->type = LQ_VHT_SISO; +- rate->bw = rs_bw_from_sta_bw(sta); ++ rate->bw = bw; + } else if (sta->ht_cap.ht_supported && + best_rssi > IWL_RS_LOW_RSSI_THRESHOLD) { + initial_rates = rs_optimal_rates_ht; +@@ -2844,7 +2856,7 @@ static void rs_initialize_lq(struct iwl_mvm *mvm, + tbl = &(lq_sta->lq_info[active_tbl]); + rate = &tbl->rate; + +- rs_get_initial_rate(mvm, sta, lq_sta, band, rate); ++ rs_get_initial_rate(mvm, sta, lq_sta, band, rate, init); + rs_init_optimal_rate(mvm, sta, lq_sta); + + WARN_ONCE(rate->ant != ANT_A && rate->ant != ANT_B, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +index 819e6f66a5b5..e2196dc35dc6 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c +@@ -71,6 +71,7 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb, + struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)skb->data; + struct ieee80211_rx_status *stats = IEEE80211_SKB_RXCB(skb); + struct iwl_mvm_key_pn *ptk_pn; ++ int res; + u8 tid, keyidx; + u8 pn[IEEE80211_CCMP_PN_LEN]; + u8 *extiv; +@@ -127,12 +128,13 @@ static inline int iwl_mvm_check_pn(struct iwl_mvm *mvm, struct sk_buff *skb, + pn[4] = extiv[1]; + pn[5] = extiv[0]; + +- if (memcmp(pn, ptk_pn->q[queue].pn[tid], +- IEEE80211_CCMP_PN_LEN) <= 0) ++ res = memcmp(pn, ptk_pn->q[queue].pn[tid], IEEE80211_CCMP_PN_LEN); ++ if (res < 0) ++ return -1; ++ if (!res && !(stats->flag & RX_FLAG_ALLOW_SAME_PN)) + return -1; + +- if (!(stats->flag & RX_FLAG_AMSDU_MORE)) +- memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN); ++ memcpy(ptk_pn->q[queue].pn[tid], pn, IEEE80211_CCMP_PN_LEN); + stats->flag |= RX_FLAG_PN_VALIDATED; + + return 0; +@@ -310,28 +312,21 @@ static void iwl_mvm_rx_csum(struct ieee80211_sta *sta, + } + + /* +- * returns true if a packet outside BA session is a duplicate and +- * should be dropped ++ * returns true if a packet is a duplicate and should be dropped. ++ * Updates AMSDU PN tracking info + */ +-static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue, +- struct ieee80211_rx_status *rx_status, +- struct ieee80211_hdr *hdr, +- struct iwl_rx_mpdu_desc *desc) ++static bool iwl_mvm_is_dup(struct ieee80211_sta *sta, int queue, ++ struct ieee80211_rx_status *rx_status, ++ struct ieee80211_hdr *hdr, ++ struct iwl_rx_mpdu_desc *desc) + { + struct iwl_mvm_sta *mvm_sta; + struct iwl_mvm_rxq_dup_data *dup_data; +- u8 baid, tid, sub_frame_idx; ++ u8 tid, sub_frame_idx; + + if (WARN_ON(IS_ERR_OR_NULL(sta))) + return false; + +- baid = (le32_to_cpu(desc->reorder_data) & +- IWL_RX_MPDU_REORDER_BAID_MASK) >> +- IWL_RX_MPDU_REORDER_BAID_SHIFT; +- +- if (baid != IWL_RX_REORDER_DATA_INVALID_BAID) +- return false; +- + mvm_sta = iwl_mvm_sta_from_mac80211(sta); + dup_data = &mvm_sta->dup_data[queue]; + +@@ -361,6 +356,12 @@ static bool iwl_mvm_is_nonagg_dup(struct ieee80211_sta *sta, int queue, + dup_data->last_sub_frame[tid] >= sub_frame_idx)) + return true; + ++ /* Allow same PN as the first subframe for following sub frames */ ++ if (dup_data->last_seq[tid] == hdr->seq_ctrl && ++ sub_frame_idx > dup_data->last_sub_frame[tid] && ++ desc->mac_flags2 & IWL_RX_MPDU_MFLG2_AMSDU) ++ rx_status->flag |= RX_FLAG_ALLOW_SAME_PN; ++ + dup_data->last_seq[tid] = hdr->seq_ctrl; + dup_data->last_sub_frame[tid] = sub_frame_idx; + +@@ -929,7 +930,7 @@ void iwl_mvm_rx_mpdu_mq(struct iwl_mvm *mvm, struct napi_struct *napi, + if (ieee80211_is_data(hdr->frame_control)) + iwl_mvm_rx_csum(sta, skb, desc); + +- if (iwl_mvm_is_nonagg_dup(sta, queue, rx_status, hdr, desc)) { ++ if (iwl_mvm_is_dup(sta, queue, rx_status, hdr, desc)) { + kfree_skb(skb); + goto out; + } +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +index 0d7929799942..d31d84eebc5d 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c +@@ -1679,7 +1679,8 @@ int iwl_mvm_allocate_int_sta(struct iwl_mvm *mvm, + u32 qmask, enum nl80211_iftype iftype, + enum iwl_sta_type type) + { +- if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status)) { ++ if (!test_bit(IWL_MVM_STATUS_IN_HW_RESTART, &mvm->status) || ++ sta->sta_id == IWL_MVM_INVALID_STA) { + sta->sta_id = iwl_mvm_find_free_sta_id(mvm, iftype); + if (WARN_ON_ONCE(sta->sta_id == IWL_MVM_INVALID_STA)) + return -ENOSPC; +@@ -2023,7 +2024,7 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + struct iwl_trans_txq_scd_cfg cfg = { + .fifo = IWL_MVM_TX_FIFO_MCAST, + .sta_id = msta->sta_id, +- .tid = IWL_MAX_TID_COUNT, ++ .tid = 0, + .aggregate = false, + .frame_limit = IWL_FRAME_LIMIT, + }; +@@ -2036,6 +2037,17 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + vif->type != NL80211_IFTYPE_ADHOC)) + return -ENOTSUPP; + ++ /* ++ * In IBSS, ieee80211_check_queues() sets the cab_queue to be ++ * invalid, so make sure we use the queue we want. ++ * Note that this is done here as we want to avoid making DQA ++ * changes in mac80211 layer. ++ */ ++ if (vif->type == NL80211_IFTYPE_ADHOC) { ++ vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE; ++ mvmvif->cab_queue = vif->cab_queue; ++ } ++ + /* + * While in previous FWs we had to exclude cab queue from TFD queue + * mask, now it is needed as any other queue. +@@ -2063,24 +2075,13 @@ int iwl_mvm_add_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + if (iwl_mvm_has_new_tx_api(mvm)) { + int queue = iwl_mvm_tvqm_enable_txq(mvm, vif->cab_queue, + msta->sta_id, +- IWL_MAX_TID_COUNT, ++ 0, + timeout); + mvmvif->cab_queue = queue; + } else if (!fw_has_api(&mvm->fw->ucode_capa, +- IWL_UCODE_TLV_API_STA_TYPE)) { +- /* +- * In IBSS, ieee80211_check_queues() sets the cab_queue to be +- * invalid, so make sure we use the queue we want. +- * Note that this is done here as we want to avoid making DQA +- * changes in mac80211 layer. +- */ +- if (vif->type == NL80211_IFTYPE_ADHOC) { +- vif->cab_queue = IWL_MVM_DQA_GCAST_QUEUE; +- mvmvif->cab_queue = vif->cab_queue; +- } ++ IWL_UCODE_TLV_API_STA_TYPE)) + iwl_mvm_enable_txq(mvm, vif->cab_queue, vif->cab_queue, 0, + &cfg, timeout); +- } + + return 0; + } +@@ -2099,7 +2100,7 @@ int iwl_mvm_rm_mcast_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif) + iwl_mvm_flush_sta(mvm, &mvmvif->mcast_sta, true, 0); + + iwl_mvm_disable_txq(mvm, mvmvif->cab_queue, vif->cab_queue, +- IWL_MAX_TID_COUNT, 0); ++ 0, 0); + + ret = iwl_mvm_rm_sta_common(mvm, mvmvif->mcast_sta.sta_id); + if (ret) +@@ -2435,28 +2436,12 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + + /* + * Note the possible cases: +- * 1. In DQA mode with an enabled TXQ - TXQ needs to become agg'ed +- * 2. Non-DQA mode: the TXQ hasn't yet been enabled, so find a free +- * one and mark it as reserved +- * 3. In DQA mode, but no traffic yet on this TID: same treatment as in +- * non-DQA mode, since the TXQ hasn't yet been allocated +- * Don't support case 3 for new TX path as it is not expected to happen +- * and aggregation will be offloaded soon anyway ++ * 1. An enabled TXQ - TXQ needs to become agg'ed ++ * 2. The TXQ hasn't yet been enabled, so find a free one and mark ++ * it as reserved + */ + txq_id = mvmsta->tid_data[tid].txq_id; +- if (iwl_mvm_has_new_tx_api(mvm)) { +- if (txq_id == IWL_MVM_INVALID_QUEUE) { +- ret = -ENXIO; +- goto release_locks; +- } +- } else if (unlikely(mvm->queue_info[txq_id].status == +- IWL_MVM_QUEUE_SHARED)) { +- ret = -ENXIO; +- IWL_DEBUG_TX_QUEUES(mvm, +- "Can't start tid %d agg on shared queue!\n", +- tid); +- goto release_locks; +- } else if (mvm->queue_info[txq_id].status != IWL_MVM_QUEUE_READY) { ++ if (txq_id == IWL_MVM_INVALID_QUEUE) { + txq_id = iwl_mvm_find_free_queue(mvm, mvmsta->sta_id, + IWL_MVM_DQA_MIN_DATA_QUEUE, + IWL_MVM_DQA_MAX_DATA_QUEUE); +@@ -2465,16 +2450,16 @@ int iwl_mvm_sta_tx_agg_start(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + IWL_ERR(mvm, "Failed to allocate agg queue\n"); + goto release_locks; + } +- /* +- * TXQ shouldn't be in inactive mode for non-DQA, so getting +- * an inactive queue from iwl_mvm_find_free_queue() is +- * certainly a bug +- */ +- WARN_ON(mvm->queue_info[txq_id].status == +- IWL_MVM_QUEUE_INACTIVE); + + /* TXQ hasn't yet been enabled, so mark it only as reserved */ + mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_RESERVED; ++ } else if (unlikely(mvm->queue_info[txq_id].status == ++ IWL_MVM_QUEUE_SHARED)) { ++ ret = -ENXIO; ++ IWL_DEBUG_TX_QUEUES(mvm, ++ "Can't start tid %d agg on shared queue!\n", ++ tid); ++ goto release_locks; + } + + spin_unlock(&mvm->queue_info_lock); +@@ -2645,8 +2630,10 @@ int iwl_mvm_sta_tx_agg_oper(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + + static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm, + struct iwl_mvm_sta *mvmsta, +- u16 txq_id) ++ struct iwl_mvm_tid_data *tid_data) + { ++ u16 txq_id = tid_data->txq_id; ++ + if (iwl_mvm_has_new_tx_api(mvm)) + return; + +@@ -2658,8 +2645,10 @@ static void iwl_mvm_unreserve_agg_queue(struct iwl_mvm *mvm, + * allocated through iwl_mvm_enable_txq, so we can just mark it back as + * free. + */ +- if (mvm->queue_info[txq_id].status == IWL_MVM_QUEUE_RESERVED) ++ if (mvm->queue_info[txq_id].status == IWL_MVM_QUEUE_RESERVED) { + mvm->queue_info[txq_id].status = IWL_MVM_QUEUE_FREE; ++ tid_data->txq_id = IWL_MVM_INVALID_QUEUE; ++ } + + spin_unlock_bh(&mvm->queue_info_lock); + } +@@ -2690,7 +2679,7 @@ int iwl_mvm_sta_tx_agg_stop(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + + mvmsta->agg_tids &= ~BIT(tid); + +- iwl_mvm_unreserve_agg_queue(mvm, mvmsta, txq_id); ++ iwl_mvm_unreserve_agg_queue(mvm, mvmsta, tid_data); + + switch (tid_data->state) { + case IWL_AGG_ON: +@@ -2757,7 +2746,7 @@ int iwl_mvm_sta_tx_agg_flush(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + mvmsta->agg_tids &= ~BIT(tid); + spin_unlock_bh(&mvmsta->lock); + +- iwl_mvm_unreserve_agg_queue(mvm, mvmsta, txq_id); ++ iwl_mvm_unreserve_agg_queue(mvm, mvmsta, tid_data); + + if (old_state >= IWL_AGG_ON) { + iwl_mvm_drain_sta(mvm, mvmsta, true); +@@ -3119,8 +3108,9 @@ static int __iwl_mvm_remove_sta_key(struct iwl_mvm *mvm, u8 sta_id, + int ret, size; + u32 status; + ++ /* This is a valid situation for GTK removal */ + if (sta_id == IWL_MVM_INVALID_STA) +- return -EINVAL; ++ return 0; + + key_flags = cpu_to_le16((keyconf->keyidx << STA_KEY_FLG_KEYID_POS) & + STA_KEY_FLG_KEYID_MSK); +@@ -3181,17 +3171,9 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm, + } + sta_id = mvm_sta->sta_id; + +- if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC || +- keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 || +- keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256) { +- ret = iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, +- false); +- goto end; +- } +- + /* + * It is possible that the 'sta' parameter is NULL, and thus +- * there is a need to retrieve the sta from the local station ++ * there is a need to retrieve the sta from the local station + * table. + */ + if (!sta) { +@@ -3206,6 +3188,17 @@ int iwl_mvm_set_sta_key(struct iwl_mvm *mvm, + + if (WARN_ON_ONCE(iwl_mvm_sta_from_mac80211(sta)->vif != vif)) + return -EINVAL; ++ } else { ++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); ++ ++ sta_id = mvmvif->mcast_sta.sta_id; ++ } ++ ++ if (keyconf->cipher == WLAN_CIPHER_SUITE_AES_CMAC || ++ keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_128 || ++ keyconf->cipher == WLAN_CIPHER_SUITE_BIP_GMAC_256) { ++ ret = iwl_mvm_send_sta_igtk(mvm, keyconf, sta_id, false); ++ goto end; + } + + /* If the key_offset is not pre-assigned, we need to find a +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +index e25cda9fbf6c..342ca1778efd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/time-event.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -18,11 +19,6 @@ + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * General Public License for more details. + * +- * You should have received a copy of the GNU General Public License +- * along with this program; if not, write to the Free Software +- * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110, +- * USA +- * + * The full GNU General Public License is included in this distribution + * in the file called COPYING. + * +@@ -35,6 +31,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -203,9 +200,13 @@ static bool iwl_mvm_te_check_disconnect(struct iwl_mvm *mvm, + struct ieee80211_vif *vif, + const char *errmsg) + { ++ struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif); ++ + if (vif->type != NL80211_IFTYPE_STATION) + return false; +- if (vif->bss_conf.assoc && vif->bss_conf.dtim_period) ++ ++ if (!mvmvif->csa_bcn_pending && vif->bss_conf.assoc && ++ vif->bss_conf.dtim_period) + return false; + if (errmsg) + IWL_ERR(mvm, "%s\n", errmsg); +@@ -349,7 +350,7 @@ static void iwl_mvm_te_handle_notif(struct iwl_mvm *mvm, + * and know the dtim period. + */ + iwl_mvm_te_check_disconnect(mvm, te_data->vif, +- "No association and the time event is over already..."); ++ "No beacon heard and the time event is over already..."); + break; + default: + break; +@@ -621,7 +622,7 @@ void iwl_mvm_protect_session(struct iwl_mvm *mvm, + time_cmd.repeat = 1; + time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START | + TE_V2_NOTIF_HOST_EVENT_END | +- T2_V2_START_IMMEDIATELY); ++ TE_V2_START_IMMEDIATELY); + + if (!wait_for_notif) { + iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd); +@@ -814,7 +815,7 @@ int iwl_mvm_start_p2p_roc(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + time_cmd.repeat = 1; + time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START | + TE_V2_NOTIF_HOST_EVENT_END | +- T2_V2_START_IMMEDIATELY); ++ TE_V2_START_IMMEDIATELY); + + return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd); + } +@@ -924,6 +925,8 @@ int iwl_mvm_schedule_csa_period(struct iwl_mvm *mvm, + time_cmd.interval = cpu_to_le32(1); + time_cmd.policy = cpu_to_le16(TE_V2_NOTIF_HOST_EVENT_START | + TE_V2_ABSENCE); ++ if (!apply_time) ++ time_cmd.policy |= cpu_to_le16(TE_V2_START_IMMEDIATELY); + + return iwl_mvm_time_event_send_add(mvm, vif, te_data, &time_cmd); + } +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +index 887a504ce64a..6c014c273922 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/tx.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/tx.c +@@ -419,11 +419,11 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm, + { + struct ieee80211_key_conf *keyconf = info->control.hw_key; + u8 *crypto_hdr = skb_frag->data + hdrlen; ++ enum iwl_tx_cmd_sec_ctrl type = TX_CMD_SEC_CCM; + u64 pn; + + switch (keyconf->cipher) { + case WLAN_CIPHER_SUITE_CCMP: +- case WLAN_CIPHER_SUITE_CCMP_256: + iwl_mvm_set_tx_cmd_ccmp(info, tx_cmd); + iwl_mvm_set_tx_cmd_pn(info, crypto_hdr); + break; +@@ -447,13 +447,16 @@ static void iwl_mvm_set_tx_cmd_crypto(struct iwl_mvm *mvm, + break; + case WLAN_CIPHER_SUITE_GCMP: + case WLAN_CIPHER_SUITE_GCMP_256: ++ type = TX_CMD_SEC_GCMP; ++ /* Fall through */ ++ case WLAN_CIPHER_SUITE_CCMP_256: + /* TODO: Taking the key from the table might introduce a race + * when PTK rekeying is done, having an old packets with a PN + * based on the old key but the message encrypted with a new + * one. + * Need to handle this. + */ +- tx_cmd->sec_ctl |= TX_CMD_SEC_GCMP | TX_CMD_SEC_KEY_FROM_TABLE; ++ tx_cmd->sec_ctl |= type | TX_CMD_SEC_KEY_FROM_TABLE; + tx_cmd->key[0] = keyconf->hw_key_idx; + iwl_mvm_set_tx_cmd_pn(info, crypto_hdr); + break; +@@ -645,7 +648,11 @@ int iwl_mvm_tx_skb_non_sta(struct iwl_mvm *mvm, struct sk_buff *skb) + if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE || + info.control.vif->type == NL80211_IFTYPE_AP || + info.control.vif->type == NL80211_IFTYPE_ADHOC) { +- sta_id = mvmvif->bcast_sta.sta_id; ++ if (info.control.vif->type == NL80211_IFTYPE_P2P_DEVICE) ++ sta_id = mvmvif->bcast_sta.sta_id; ++ else ++ sta_id = mvmvif->mcast_sta.sta_id; ++ + queue = iwl_mvm_get_ctrl_vif_queue(mvm, &info, + hdr->frame_control); + if (queue < 0) +@@ -1872,14 +1879,12 @@ int iwl_mvm_flush_sta(struct iwl_mvm *mvm, void *sta, bool internal, u32 flags) + struct iwl_mvm_int_sta *int_sta = sta; + struct iwl_mvm_sta *mvm_sta = sta; + +- if (iwl_mvm_has_new_tx_api(mvm)) { +- if (internal) +- return iwl_mvm_flush_sta_tids(mvm, int_sta->sta_id, +- BIT(IWL_MGMT_TID), flags); ++ BUILD_BUG_ON(offsetof(struct iwl_mvm_int_sta, sta_id) != ++ offsetof(struct iwl_mvm_sta, sta_id)); + ++ if (iwl_mvm_has_new_tx_api(mvm)) + return iwl_mvm_flush_sta_tids(mvm, mvm_sta->sta_id, +- 0xFF, flags); +- } ++ 0xff | BIT(IWL_MGMT_TID), flags); + + if (internal) + return iwl_mvm_flush_tx_path(mvm, int_sta->tfd_queue_msk, +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +index 43ab172d31cb..d2cada0ab426 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/utils.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/utils.c +@@ -810,12 +810,19 @@ int iwl_mvm_disable_txq(struct iwl_mvm *mvm, int queue, int mac80211_queue, + .scd_queue = queue, + .action = SCD_CFG_DISABLE_QUEUE, + }; +- bool remove_mac_queue = true; ++ bool remove_mac_queue = mac80211_queue != IEEE80211_INVAL_HW_QUEUE; + int ret; + ++ if (WARN_ON(remove_mac_queue && mac80211_queue >= IEEE80211_MAX_QUEUES)) ++ return -EINVAL; ++ + if (iwl_mvm_has_new_tx_api(mvm)) { + spin_lock_bh(&mvm->queue_info_lock); +- mvm->hw_queue_to_mac80211[queue] &= ~BIT(mac80211_queue); ++ ++ if (remove_mac_queue) ++ mvm->hw_queue_to_mac80211[queue] &= ++ ~BIT(mac80211_queue); ++ + spin_unlock_bh(&mvm->queue_info_lock); + + iwl_trans_txq_free(mvm->trans, queue); +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index 8d3a4839b6ef..370161ca2a1c 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -636,11 +636,14 @@ static int rsi_sdio_master_reg_read(struct rsi_hw *adapter, u32 addr, + u32 *read_buf, u16 size) + { + u32 addr_on_bus, *data; +- u32 align[2] = {}; + u16 ms_addr; + int status; + +- data = PTR_ALIGN(&align[0], 8); ++ data = kzalloc(RSI_MASTER_REG_BUF_SIZE, GFP_KERNEL); ++ if (!data) ++ return -ENOMEM; ++ ++ data = PTR_ALIGN(data, 8); + + ms_addr = (addr >> 16); + status = rsi_sdio_master_access_msword(adapter, ms_addr); +@@ -648,7 +651,7 @@ static int rsi_sdio_master_reg_read(struct rsi_hw *adapter, u32 addr, + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return status; ++ goto err; + } + addr &= 0xFFFF; + +@@ -666,7 +669,7 @@ static int rsi_sdio_master_reg_read(struct rsi_hw *adapter, u32 addr, + (u8 *)data, 4); + if (status < 0) { + rsi_dbg(ERR_ZONE, "%s: AHB register read failed\n", __func__); +- return status; ++ goto err; + } + if (size == 2) { + if ((addr & 0x3) == 0) +@@ -688,17 +691,23 @@ static int rsi_sdio_master_reg_read(struct rsi_hw *adapter, u32 addr, + *read_buf = *data; + } + +- return 0; ++err: ++ kfree(data); ++ return status; + } + + static int rsi_sdio_master_reg_write(struct rsi_hw *adapter, + unsigned long addr, + unsigned long data, u16 size) + { +- unsigned long data1[2], *data_aligned; ++ unsigned long *data_aligned; + int status; + +- data_aligned = PTR_ALIGN(&data1[0], 8); ++ data_aligned = kzalloc(RSI_MASTER_REG_BUF_SIZE, GFP_KERNEL); ++ if (!data_aligned) ++ return -ENOMEM; ++ ++ data_aligned = PTR_ALIGN(data_aligned, 8); + + if (size == 2) { + *data_aligned = ((data << 16) | (data & 0xFFFF)); +@@ -717,6 +726,7 @@ static int rsi_sdio_master_reg_write(struct rsi_hw *adapter, + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); ++ kfree(data_aligned); + return -EIO; + } + addr = addr & 0xFFFF; +@@ -726,12 +736,12 @@ static int rsi_sdio_master_reg_write(struct rsi_hw *adapter, + (adapter, + (addr | RSI_SD_REQUEST_MASTER), + (u8 *)data_aligned, size); +- if (status < 0) { ++ if (status < 0) + rsi_dbg(ERR_ZONE, + "%s: Unable to do AHB reg write\n", __func__); +- return status; +- } +- return 0; ++ ++ kfree(data_aligned); ++ return status; + } + + /** +diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h +index 95e4bed57baf..903392039200 100644 +--- a/drivers/net/wireless/rsi/rsi_sdio.h ++++ b/drivers/net/wireless/rsi/rsi_sdio.h +@@ -46,6 +46,8 @@ enum sdio_interrupt_type { + #define PKT_BUFF_AVAILABLE 1 + #define FW_ASSERT_IND 2 + ++#define RSI_MASTER_REG_BUF_SIZE 12 ++ + #define RSI_DEVICE_BUFFER_STATUS_REGISTER 0xf3 + #define RSI_FN1_INT_REGISTER 0xf9 + #define RSI_SD_REQUEST_MASTER 0x10000 +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 8cd42544c90e..740aae51e1c6 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -606,8 +606,10 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + opts->discovery_nqn = + !(strcmp(opts->subsysnqn, + NVME_DISC_SUBSYS_NAME)); +- if (opts->discovery_nqn) ++ if (opts->discovery_nqn) { ++ opts->kato = 0; + opts->nr_io_queues = 0; ++ } + break; + case NVMF_OPT_TRADDR: + p = match_strdup(args); +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index eab17405e815..3d4724e38aa9 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1013,12 +1013,6 @@ static bool nvme_should_reset(struct nvme_dev *dev, u32 csts) + if (!(csts & NVME_CSTS_CFS) && !nssro) + return false; + +- /* If PCI error recovery process is happening, we cannot reset or +- * the recovery mechanism will surely fail. +- */ +- if (pci_channel_offline(to_pci_dev(dev->dev))) +- return false; +- + return true; + } + +@@ -1049,6 +1043,13 @@ static enum blk_eh_timer_return nvme_timeout(struct request *req, bool reserved) + struct nvme_command cmd; + u32 csts = readl(dev->bar + NVME_REG_CSTS); + ++ /* If PCI error recovery process is happening, we cannot reset or ++ * the recovery mechanism will surely fail. ++ */ ++ mb(); ++ if (pci_channel_offline(to_pci_dev(dev->dev))) ++ return BLK_EH_RESET_TIMER; ++ + /* + * Reset immediately if the controller is failed + */ +@@ -1322,7 +1323,7 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid) + nvmeq->cq_vector = qid - 1; + result = adapter_alloc_cq(dev, qid, nvmeq); + if (result < 0) +- return result; ++ goto release_vector; + + result = adapter_alloc_sq(dev, qid, nvmeq); + if (result < 0) +@@ -1336,9 +1337,12 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid) + return result; + + release_sq: ++ dev->online_queues--; + adapter_delete_sq(dev, qid); + release_cq: + adapter_delete_cq(dev, qid); ++ release_vector: ++ nvmeq->cq_vector = -1; + return result; + } + +@@ -1766,7 +1770,7 @@ static int nvme_setup_io_queues(struct nvme_dev *dev) + int result, nr_io_queues; + unsigned long size; + +- nr_io_queues = num_present_cpus(); ++ nr_io_queues = num_possible_cpus(); + result = nvme_set_queue_count(&dev->ctrl, &nr_io_queues); + if (result < 0) + return result; +@@ -2310,10 +2314,13 @@ static unsigned long check_vendor_combination_bug(struct pci_dev *pdev) + } else if (pdev->vendor == 0x144d && pdev->device == 0xa804) { + /* + * Samsung SSD 960 EVO drops off the PCIe bus after system +- * suspend on a Ryzen board, ASUS PRIME B350M-A. ++ * suspend on a Ryzen board, ASUS PRIME B350M-A, as well as ++ * within few minutes after bootup on a Coffee Lake board - ++ * ASUS PRIME Z370-A + */ + if (dmi_match(DMI_BOARD_VENDOR, "ASUSTeK COMPUTER INC.") && +- dmi_match(DMI_BOARD_NAME, "PRIME B350M-A")) ++ (dmi_match(DMI_BOARD_NAME, "PRIME B350M-A") || ++ dmi_match(DMI_BOARD_NAME, "PRIME Z370-A"))) + return NVME_QUIRK_NO_APST; + } + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 645ba7eee35d..240b0d628222 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -505,9 +505,12 @@ bool nvmet_req_init(struct nvmet_req *req, struct nvmet_cq *cq, + goto fail; + } + +- /* either variant of SGLs is fine, as we don't support metadata */ +- if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF && +- (flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METASEG)) { ++ /* ++ * For fabrics, PSDT field shall describe metadata pointer (MPTR) that ++ * contains an address of a single contiguous physical buffer that is ++ * byte aligned. ++ */ ++ if (unlikely((flags & NVME_CMD_SGL_ALL) != NVME_CMD_SGL_METABUF)) { + status = NVME_SC_INVALID_FIELD | NVME_SC_DNR; + goto fail; + } +diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c +index 41b740aed3a3..69bd98421eb1 100644 +--- a/drivers/parisc/lba_pci.c ++++ b/drivers/parisc/lba_pci.c +@@ -1403,9 +1403,27 @@ lba_hw_init(struct lba_device *d) + WRITE_REG32(stat, d->hba.base_addr + LBA_ERROR_CONFIG); + } + +- /* Set HF mode as the default (vs. -1 mode). */ ++ ++ /* ++ * Hard Fail vs. Soft Fail on PCI "Master Abort". ++ * ++ * "Master Abort" means the MMIO transaction timed out - usually due to ++ * the device not responding to an MMIO read. We would like HF to be ++ * enabled to find driver problems, though it means the system will ++ * crash with a HPMC. ++ * ++ * In SoftFail mode "~0L" is returned as a result of a timeout on the ++ * pci bus. This is like how PCI busses on x86 and most other ++ * architectures behave. In order to increase compatibility with ++ * existing (x86) PCI hardware and existing Linux drivers we enable ++ * Soft Faul mode on PA-RISC now too. ++ */ + stat = READ_REG32(d->hba.base_addr + LBA_STAT_CTL); ++#if defined(ENABLE_HARDFAIL) + WRITE_REG32(stat | HF_ENABLE, d->hba.base_addr + LBA_STAT_CTL); ++#else ++ WRITE_REG32(stat & ~HF_ENABLE, d->hba.base_addr + LBA_STAT_CTL); ++#endif + + /* + ** Writing a zero to STAT_CTL.rf (bit 0) will clear reset signal +diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c +index bb0927de79dd..ea69b4dbab66 100644 +--- a/drivers/pci/pci-driver.c ++++ b/drivers/pci/pci-driver.c +@@ -1164,11 +1164,14 @@ static int pci_pm_runtime_suspend(struct device *dev) + int error; + + /* +- * If pci_dev->driver is not set (unbound), the device should +- * always remain in D0 regardless of the runtime PM status ++ * If pci_dev->driver is not set (unbound), we leave the device in D0, ++ * but it may go to D3cold when the bridge above it runtime suspends. ++ * Save its config space in case that happens. + */ +- if (!pci_dev->driver) ++ if (!pci_dev->driver) { ++ pci_save_state(pci_dev); + return 0; ++ } + + if (!pm || !pm->runtime_suspend) + return -ENOSYS; +@@ -1216,16 +1219,18 @@ static int pci_pm_runtime_resume(struct device *dev) + const struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL; + + /* +- * If pci_dev->driver is not set (unbound), the device should +- * always remain in D0 regardless of the runtime PM status ++ * Restoring config space is necessary even if the device is not bound ++ * to a driver because although we left it in D0, it may have gone to ++ * D3cold when the bridge above it runtime suspended. + */ ++ pci_restore_standard_config(pci_dev); ++ + if (!pci_dev->driver) + return 0; + + if (!pm || !pm->runtime_resume) + return -ENOSYS; + +- pci_restore_standard_config(pci_dev); + pci_fixup_device(pci_fixup_resume_early, pci_dev); + pci_enable_wake(pci_dev, PCI_D0, false); + pci_fixup_device(pci_fixup_resume, pci_dev); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 116127a0accb..929d68f744af 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -3896,6 +3896,9 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9182, + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c46 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x91a0, + quirk_dma_func1_alias); ++/* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c127 */ ++DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9220, ++ quirk_dma_func1_alias); + /* https://bugzilla.kernel.org/show_bug.cgi?id=42679#c49 */ + DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_MARVELL_EXT, 0x9230, + quirk_dma_func1_alias); +diff --git a/drivers/pcmcia/cs.c b/drivers/pcmcia/cs.c +index c3b615c94b4b..8c8caec3a72c 100644 +--- a/drivers/pcmcia/cs.c ++++ b/drivers/pcmcia/cs.c +@@ -452,17 +452,20 @@ static int socket_insert(struct pcmcia_socket *skt) + + static int socket_suspend(struct pcmcia_socket *skt) + { +- if (skt->state & SOCKET_SUSPEND) ++ if ((skt->state & SOCKET_SUSPEND) && !(skt->state & SOCKET_IN_RESUME)) + return -EBUSY; + + mutex_lock(&skt->ops_mutex); +- skt->suspended_state = skt->state; ++ /* store state on first suspend, but not after spurious wakeups */ ++ if (!(skt->state & SOCKET_IN_RESUME)) ++ skt->suspended_state = skt->state; + + skt->socket = dead_socket; + skt->ops->set_socket(skt, &skt->socket); + if (skt->ops->suspend) + skt->ops->suspend(skt); + skt->state |= SOCKET_SUSPEND; ++ skt->state &= ~SOCKET_IN_RESUME; + mutex_unlock(&skt->ops_mutex); + return 0; + } +@@ -475,6 +478,7 @@ static int socket_early_resume(struct pcmcia_socket *skt) + skt->ops->set_socket(skt, &skt->socket); + if (skt->state & SOCKET_PRESENT) + skt->resume_status = socket_setup(skt, resume_delay); ++ skt->state |= SOCKET_IN_RESUME; + mutex_unlock(&skt->ops_mutex); + return 0; + } +@@ -484,7 +488,7 @@ static int socket_late_resume(struct pcmcia_socket *skt) + int ret = 0; + + mutex_lock(&skt->ops_mutex); +- skt->state &= ~SOCKET_SUSPEND; ++ skt->state &= ~(SOCKET_SUSPEND | SOCKET_IN_RESUME); + mutex_unlock(&skt->ops_mutex); + + if (!(skt->state & SOCKET_PRESENT)) { +diff --git a/drivers/pcmcia/cs_internal.h b/drivers/pcmcia/cs_internal.h +index e86cd6b31773..384629ce48f5 100644 +--- a/drivers/pcmcia/cs_internal.h ++++ b/drivers/pcmcia/cs_internal.h +@@ -70,6 +70,7 @@ struct pccard_resource_ops { + /* Flags in socket state */ + #define SOCKET_PRESENT 0x0008 + #define SOCKET_INUSE 0x0010 ++#define SOCKET_IN_RESUME 0x0040 + #define SOCKET_SUSPEND 0x0080 + #define SOCKET_WIN_REQ(i) (0x0100<<(i)) + #define SOCKET_CARDBUS 0x8000 +diff --git a/drivers/phy/qualcomm/phy-qcom-qmp.c b/drivers/phy/qualcomm/phy-qcom-qmp.c +index e17f0351ccc2..2526971f9929 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qmp.c ++++ b/drivers/phy/qualcomm/phy-qcom-qmp.c +@@ -751,8 +751,6 @@ static int qcom_qmp_phy_poweroff(struct phy *phy) + struct qmp_phy *qphy = phy_get_drvdata(phy); + struct qcom_qmp *qmp = qphy->qmp; + +- clk_disable_unprepare(qphy->pipe_clk); +- + regulator_bulk_disable(qmp->cfg->num_vregs, qmp->vregs); + + return 0; +@@ -936,6 +934,8 @@ static int qcom_qmp_phy_exit(struct phy *phy) + const struct qmp_phy_cfg *cfg = qmp->cfg; + int i = cfg->num_clks; + ++ clk_disable_unprepare(qphy->pipe_clk); ++ + /* PHY reset */ + qphy_setbits(qphy->pcs, cfg->regs[QPHY_SW_RESET], SW_RESET); + +diff --git a/drivers/phy/rockchip/phy-rockchip-emmc.c b/drivers/phy/rockchip/phy-rockchip-emmc.c +index f1b24f18e9b2..b0d10934413f 100644 +--- a/drivers/phy/rockchip/phy-rockchip-emmc.c ++++ b/drivers/phy/rockchip/phy-rockchip-emmc.c +@@ -76,6 +76,10 @@ + #define PHYCTRL_OTAPDLYSEL_MASK 0xf + #define PHYCTRL_OTAPDLYSEL_SHIFT 0x7 + ++#define PHYCTRL_IS_CALDONE(x) \ ++ ((((x) >> PHYCTRL_CALDONE_SHIFT) & \ ++ PHYCTRL_CALDONE_MASK) == PHYCTRL_CALDONE_DONE) ++ + struct rockchip_emmc_phy { + unsigned int reg_offset; + struct regmap *reg_base; +@@ -90,6 +94,7 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off) + unsigned int freqsel = PHYCTRL_FREQSEL_200M; + unsigned long rate; + unsigned long timeout; ++ int ret; + + /* + * Keep phyctrl_pdb and phyctrl_endll low to allow +@@ -160,17 +165,19 @@ static int rockchip_emmc_phy_power(struct phy *phy, bool on_off) + PHYCTRL_PDB_SHIFT)); + + /* +- * According to the user manual, it asks driver to +- * wait 5us for calpad busy trimming ++ * According to the user manual, it asks driver to wait 5us for ++ * calpad busy trimming. However it is documented that this value is ++ * PVT(A.K.A process,voltage and temperature) relevant, so some ++ * failure cases are found which indicates we should be more tolerant ++ * to calpad busy trimming. + */ +- udelay(5); +- regmap_read(rk_phy->reg_base, +- rk_phy->reg_offset + GRF_EMMCPHY_STATUS, +- &caldone); +- caldone = (caldone >> PHYCTRL_CALDONE_SHIFT) & PHYCTRL_CALDONE_MASK; +- if (caldone != PHYCTRL_CALDONE_DONE) { +- pr_err("rockchip_emmc_phy_power: caldone timeout.\n"); +- return -ETIMEDOUT; ++ ret = regmap_read_poll_timeout(rk_phy->reg_base, ++ rk_phy->reg_offset + GRF_EMMCPHY_STATUS, ++ caldone, PHYCTRL_IS_CALDONE(caldone), ++ 0, 50); ++ if (ret) { ++ pr_err("%s: caldone failed, ret=%d\n", __func__, ret); ++ return ret; + } + + /* Set the frequency of the DLL operation */ +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index 1ff6c3573493..b601039d6c69 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -122,8 +122,10 @@ static int dt_to_map_one_config(struct pinctrl *p, + /* OK let's just assume this will appear later then */ + return -EPROBE_DEFER; + } +- if (!pctldev) +- pctldev = get_pinctrl_dev_from_of_node(np_pctldev); ++ /* If we're creating a hog we can use the passed pctldev */ ++ if (pctldev && (np_pctldev == p->dev->of_node)) ++ break; ++ pctldev = get_pinctrl_dev_from_of_node(np_pctldev); + if (pctldev) + break; + /* Do not defer probing of hogs (circular loop) */ +diff --git a/drivers/pinctrl/pinctrl-mcp23s08.c b/drivers/pinctrl/pinctrl-mcp23s08.c +index 447763aad815..db9cca4a83ff 100644 +--- a/drivers/pinctrl/pinctrl-mcp23s08.c ++++ b/drivers/pinctrl/pinctrl-mcp23s08.c +@@ -779,6 +779,7 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, + { + int status, ret; + bool mirror = false; ++ struct regmap_config *one_regmap_config = NULL; + + mutex_init(&mcp->lock); + +@@ -799,22 +800,36 @@ static int mcp23s08_probe_one(struct mcp23s08 *mcp, struct device *dev, + switch (type) { + #ifdef CONFIG_SPI_MASTER + case MCP_TYPE_S08: +- mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp, +- &mcp23x08_regmap); +- mcp->reg_shift = 0; +- mcp->chip.ngpio = 8; +- mcp->chip.label = "mcp23s08"; +- break; +- + case MCP_TYPE_S17: ++ switch (type) { ++ case MCP_TYPE_S08: ++ one_regmap_config = ++ devm_kmemdup(dev, &mcp23x08_regmap, ++ sizeof(struct regmap_config), GFP_KERNEL); ++ mcp->reg_shift = 0; ++ mcp->chip.ngpio = 8; ++ mcp->chip.label = "mcp23s08"; ++ break; ++ case MCP_TYPE_S17: ++ one_regmap_config = ++ devm_kmemdup(dev, &mcp23x17_regmap, ++ sizeof(struct regmap_config), GFP_KERNEL); ++ mcp->reg_shift = 1; ++ mcp->chip.ngpio = 16; ++ mcp->chip.label = "mcp23s17"; ++ break; ++ } ++ if (!one_regmap_config) ++ return -ENOMEM; ++ ++ one_regmap_config->name = devm_kasprintf(dev, GFP_KERNEL, "%d", (addr & ~0x40) >> 1); + mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp, +- &mcp23x17_regmap); +- mcp->reg_shift = 1; +- mcp->chip.ngpio = 16; +- mcp->chip.label = "mcp23s17"; ++ one_regmap_config); + break; + + case MCP_TYPE_S18: ++ if (!one_regmap_config) ++ return -ENOMEM; + mcp->regmap = devm_regmap_init(dev, &mcp23sxx_spi_regmap, mcp, + &mcp23x17_regmap); + mcp->reg_shift = 1; +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index ff491da64dab..19cd357bb464 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -818,7 +818,7 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) + return -EINVAL; + + chip = &pctrl->chip; +- chip->base = 0; ++ chip->base = -1; + chip->ngpio = ngpio; + chip->label = dev_name(pctrl->dev); + chip->parent = pctrl->dev; +diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7796.c b/drivers/pinctrl/sh-pfc/pfc-r8a7796.c +index 200e1f4f6db9..711333fb2c6e 100644 +--- a/drivers/pinctrl/sh-pfc/pfc-r8a7796.c ++++ b/drivers/pinctrl/sh-pfc/pfc-r8a7796.c +@@ -1,7 +1,7 @@ + /* + * R8A7796 processor support - PFC hardware block. + * +- * Copyright (C) 2016 Renesas Electronics Corp. ++ * Copyright (C) 2016-2017 Renesas Electronics Corp. + * + * This file is based on the drivers/pinctrl/sh-pfc/pfc-r8a7795.c + * +@@ -477,7 +477,7 @@ FM(IP16_31_28) IP16_31_28 FM(IP17_31_28) IP17_31_28 + #define MOD_SEL1_26 FM(SEL_TIMER_TMU_0) FM(SEL_TIMER_TMU_1) + #define MOD_SEL1_25_24 FM(SEL_SSP1_1_0) FM(SEL_SSP1_1_1) FM(SEL_SSP1_1_2) FM(SEL_SSP1_1_3) + #define MOD_SEL1_23_22_21 FM(SEL_SSP1_0_0) FM(SEL_SSP1_0_1) FM(SEL_SSP1_0_2) FM(SEL_SSP1_0_3) FM(SEL_SSP1_0_4) F_(0, 0) F_(0, 0) F_(0, 0) +-#define MOD_SEL1_20 FM(SEL_SSI_0) FM(SEL_SSI_1) ++#define MOD_SEL1_20 FM(SEL_SSI1_0) FM(SEL_SSI1_1) + #define MOD_SEL1_19 FM(SEL_SPEED_PULSE_0) FM(SEL_SPEED_PULSE_1) + #define MOD_SEL1_18_17 FM(SEL_SIMCARD_0) FM(SEL_SIMCARD_1) FM(SEL_SIMCARD_2) FM(SEL_SIMCARD_3) + #define MOD_SEL1_16 FM(SEL_SDHI2_0) FM(SEL_SDHI2_1) +@@ -1224,7 +1224,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP13_11_8, HSCK0), + PINMUX_IPSR_MSEL(IP13_11_8, MSIOF1_SCK_D, SEL_MSIOF1_3), + PINMUX_IPSR_MSEL(IP13_11_8, AUDIO_CLKB_A, SEL_ADG_B_0), +- PINMUX_IPSR_MSEL(IP13_11_8, SSI_SDATA1_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP13_11_8, SSI_SDATA1_B, SEL_SSI1_1), + PINMUX_IPSR_MSEL(IP13_11_8, TS_SCK0_D, SEL_TSIF0_3), + PINMUX_IPSR_MSEL(IP13_11_8, STP_ISCLK_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_MSEL(IP13_11_8, RIF0_CLK_C, SEL_DRIF0_2), +@@ -1232,14 +1232,14 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP13_15_12, HRX0), + PINMUX_IPSR_MSEL(IP13_15_12, MSIOF1_RXD_D, SEL_MSIOF1_3), +- PINMUX_IPSR_MSEL(IP13_15_12, SSI_SDATA2_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP13_15_12, SSI_SDATA2_B, SEL_SSI2_1), + PINMUX_IPSR_MSEL(IP13_15_12, TS_SDEN0_D, SEL_TSIF0_3), + PINMUX_IPSR_MSEL(IP13_15_12, STP_ISEN_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_MSEL(IP13_15_12, RIF0_D0_C, SEL_DRIF0_2), + + PINMUX_IPSR_GPSR(IP13_19_16, HTX0), + PINMUX_IPSR_MSEL(IP13_19_16, MSIOF1_TXD_D, SEL_MSIOF1_3), +- PINMUX_IPSR_MSEL(IP13_19_16, SSI_SDATA9_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP13_19_16, SSI_SDATA9_B, SEL_SSI9_1), + PINMUX_IPSR_MSEL(IP13_19_16, TS_SDAT0_D, SEL_TSIF0_3), + PINMUX_IPSR_MSEL(IP13_19_16, STP_ISD_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_MSEL(IP13_19_16, RIF0_D1_C, SEL_DRIF0_2), +@@ -1247,7 +1247,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP13_23_20, HCTS0_N), + PINMUX_IPSR_MSEL(IP13_23_20, RX2_B, SEL_SCIF2_1), + PINMUX_IPSR_MSEL(IP13_23_20, MSIOF1_SYNC_D, SEL_MSIOF1_3), +- PINMUX_IPSR_MSEL(IP13_23_20, SSI_SCK9_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP13_23_20, SSI_SCK9_A, SEL_SSI9_0), + PINMUX_IPSR_MSEL(IP13_23_20, TS_SPSYNC0_D, SEL_TSIF0_3), + PINMUX_IPSR_MSEL(IP13_23_20, STP_ISSYNC_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_MSEL(IP13_23_20, RIF0_SYNC_C, SEL_DRIF0_2), +@@ -1256,7 +1256,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_GPSR(IP13_27_24, HRTS0_N), + PINMUX_IPSR_MSEL(IP13_27_24, TX2_B, SEL_SCIF2_1), + PINMUX_IPSR_MSEL(IP13_27_24, MSIOF1_SS1_D, SEL_MSIOF1_3), +- PINMUX_IPSR_MSEL(IP13_27_24, SSI_WS9_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP13_27_24, SSI_WS9_A, SEL_SSI9_0), + PINMUX_IPSR_MSEL(IP13_27_24, STP_IVCXO27_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_MSEL(IP13_27_24, BPFCLK_A, SEL_FM_0), + PINMUX_IPSR_GPSR(IP13_27_24, AUDIO_CLKOUT2_A), +@@ -1271,7 +1271,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP14_3_0, RX5_A, SEL_SCIF5_0), + PINMUX_IPSR_MSEL(IP14_3_0, NFWP_N_A, SEL_NDF_0), + PINMUX_IPSR_MSEL(IP14_3_0, AUDIO_CLKA_C, SEL_ADG_A_2), +- PINMUX_IPSR_MSEL(IP14_3_0, SSI_SCK2_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP14_3_0, SSI_SCK2_A, SEL_SSI2_0), + PINMUX_IPSR_MSEL(IP14_3_0, STP_IVCXO27_0_C, SEL_SSP1_0_2), + PINMUX_IPSR_GPSR(IP14_3_0, AUDIO_CLKOUT3_A), + PINMUX_IPSR_MSEL(IP14_3_0, TCLK1_B, SEL_TIMER_TMU_1), +@@ -1280,7 +1280,7 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP14_7_4, TX5_A, SEL_SCIF5_0), + PINMUX_IPSR_MSEL(IP14_7_4, MSIOF1_SS2_D, SEL_MSIOF1_3), + PINMUX_IPSR_MSEL(IP14_7_4, AUDIO_CLKC_A, SEL_ADG_C_0), +- PINMUX_IPSR_MSEL(IP14_7_4, SSI_WS2_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP14_7_4, SSI_WS2_A, SEL_SSI2_0), + PINMUX_IPSR_MSEL(IP14_7_4, STP_OPWM_0_D, SEL_SSP1_0_3), + PINMUX_IPSR_GPSR(IP14_7_4, AUDIO_CLKOUT_D), + PINMUX_IPSR_MSEL(IP14_7_4, SPEEDIN_B, SEL_SPEED_PULSE_1), +@@ -1308,10 +1308,10 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP14_31_28, MSIOF1_SS2_F, SEL_MSIOF1_5), + + /* IPSR15 */ +- PINMUX_IPSR_MSEL(IP15_3_0, SSI_SDATA1_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP15_3_0, SSI_SDATA1_A, SEL_SSI1_0), + +- PINMUX_IPSR_MSEL(IP15_7_4, SSI_SDATA2_A, SEL_SSI_0), +- PINMUX_IPSR_MSEL(IP15_7_4, SSI_SCK1_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP15_7_4, SSI_SDATA2_A, SEL_SSI2_0), ++ PINMUX_IPSR_MSEL(IP15_7_4, SSI_SCK1_B, SEL_SSI1_1), + + PINMUX_IPSR_GPSR(IP15_11_8, SSI_SCK349), + PINMUX_IPSR_MSEL(IP15_11_8, MSIOF1_SS1_A, SEL_MSIOF1_0), +@@ -1397,11 +1397,11 @@ static const u16 pinmux_data[] = { + PINMUX_IPSR_MSEL(IP16_27_24, RIF1_D1_A, SEL_DRIF1_0), + PINMUX_IPSR_MSEL(IP16_27_24, RIF3_D1_A, SEL_DRIF3_0), + +- PINMUX_IPSR_MSEL(IP16_31_28, SSI_SDATA9_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP16_31_28, SSI_SDATA9_A, SEL_SSI9_0), + PINMUX_IPSR_MSEL(IP16_31_28, HSCK2_B, SEL_HSCIF2_1), + PINMUX_IPSR_MSEL(IP16_31_28, MSIOF1_SS1_C, SEL_MSIOF1_2), + PINMUX_IPSR_MSEL(IP16_31_28, HSCK1_A, SEL_HSCIF1_0), +- PINMUX_IPSR_MSEL(IP16_31_28, SSI_WS1_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP16_31_28, SSI_WS1_B, SEL_SSI1_1), + PINMUX_IPSR_GPSR(IP16_31_28, SCK1), + PINMUX_IPSR_MSEL(IP16_31_28, STP_IVCXO27_1_A, SEL_SSP1_1_0), + PINMUX_IPSR_MSEL(IP16_31_28, SCK5_A, SEL_SCIF5_0), +@@ -1433,7 +1433,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP17_19_16, USB1_PWEN), + PINMUX_IPSR_MSEL(IP17_19_16, SIM0_CLK_C, SEL_SIMCARD_2), +- PINMUX_IPSR_MSEL(IP17_19_16, SSI_SCK1_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP17_19_16, SSI_SCK1_A, SEL_SSI1_0), + PINMUX_IPSR_MSEL(IP17_19_16, TS_SCK0_E, SEL_TSIF0_4), + PINMUX_IPSR_MSEL(IP17_19_16, STP_ISCLK_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP17_19_16, FMCLK_B, SEL_FM_1), +@@ -1443,7 +1443,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP17_23_20, USB1_OVC), + PINMUX_IPSR_MSEL(IP17_23_20, MSIOF1_SS2_C, SEL_MSIOF1_2), +- PINMUX_IPSR_MSEL(IP17_23_20, SSI_WS1_A, SEL_SSI_0), ++ PINMUX_IPSR_MSEL(IP17_23_20, SSI_WS1_A, SEL_SSI1_0), + PINMUX_IPSR_MSEL(IP17_23_20, TS_SDAT0_E, SEL_TSIF0_4), + PINMUX_IPSR_MSEL(IP17_23_20, STP_ISD_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP17_23_20, FMIN_B, SEL_FM_1), +@@ -1453,7 +1453,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP17_27_24, USB30_PWEN), + PINMUX_IPSR_GPSR(IP17_27_24, AUDIO_CLKOUT_B), +- PINMUX_IPSR_MSEL(IP17_27_24, SSI_SCK2_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP17_27_24, SSI_SCK2_B, SEL_SSI2_1), + PINMUX_IPSR_MSEL(IP17_27_24, TS_SDEN1_D, SEL_TSIF1_3), + PINMUX_IPSR_MSEL(IP17_27_24, STP_ISEN_1_D, SEL_SSP1_1_3), + PINMUX_IPSR_MSEL(IP17_27_24, STP_OPWM_0_E, SEL_SSP1_0_4), +@@ -1465,7 +1465,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP17_31_28, USB30_OVC), + PINMUX_IPSR_GPSR(IP17_31_28, AUDIO_CLKOUT1_B), +- PINMUX_IPSR_MSEL(IP17_31_28, SSI_WS2_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP17_31_28, SSI_WS2_B, SEL_SSI2_1), + PINMUX_IPSR_MSEL(IP17_31_28, TS_SPSYNC1_D, SEL_TSIF1_3), + PINMUX_IPSR_MSEL(IP17_31_28, STP_ISSYNC_1_D, SEL_SSP1_1_3), + PINMUX_IPSR_MSEL(IP17_31_28, STP_IVCXO27_0_E, SEL_SSP1_0_4), +@@ -1476,7 +1476,7 @@ static const u16 pinmux_data[] = { + /* IPSR18 */ + PINMUX_IPSR_GPSR(IP18_3_0, GP6_30), + PINMUX_IPSR_GPSR(IP18_3_0, AUDIO_CLKOUT2_B), +- PINMUX_IPSR_MSEL(IP18_3_0, SSI_SCK9_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP18_3_0, SSI_SCK9_B, SEL_SSI9_1), + PINMUX_IPSR_MSEL(IP18_3_0, TS_SDEN0_E, SEL_TSIF0_4), + PINMUX_IPSR_MSEL(IP18_3_0, STP_ISEN_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP18_3_0, RIF2_D0_B, SEL_DRIF2_1), +@@ -1486,7 +1486,7 @@ static const u16 pinmux_data[] = { + + PINMUX_IPSR_GPSR(IP18_7_4, GP6_31), + PINMUX_IPSR_GPSR(IP18_7_4, AUDIO_CLKOUT3_B), +- PINMUX_IPSR_MSEL(IP18_7_4, SSI_WS9_B, SEL_SSI_1), ++ PINMUX_IPSR_MSEL(IP18_7_4, SSI_WS9_B, SEL_SSI9_1), + PINMUX_IPSR_MSEL(IP18_7_4, TS_SPSYNC0_E, SEL_TSIF0_4), + PINMUX_IPSR_MSEL(IP18_7_4, STP_ISSYNC_0_E, SEL_SSP1_0_4), + PINMUX_IPSR_MSEL(IP18_7_4, RIF2_D1_B, SEL_DRIF2_1), +diff --git a/drivers/power/supply/ltc2941-battery-gauge.c b/drivers/power/supply/ltc2941-battery-gauge.c +index 08e4fd9ee607..9621d6dd88c6 100644 +--- a/drivers/power/supply/ltc2941-battery-gauge.c ++++ b/drivers/power/supply/ltc2941-battery-gauge.c +@@ -316,15 +316,15 @@ static int ltc294x_get_temperature(const struct ltc294x_info *info, int *val) + + if (info->id == LTC2942_ID) { + reg = LTC2942_REG_TEMPERATURE_MSB; +- value = 60000; /* Full-scale is 600 Kelvin */ ++ value = 6000; /* Full-scale is 600 Kelvin */ + } else { + reg = LTC2943_REG_TEMPERATURE_MSB; +- value = 51000; /* Full-scale is 510 Kelvin */ ++ value = 5100; /* Full-scale is 510 Kelvin */ + } + ret = ltc294x_read_regs(info->client, reg, &datar[0], 2); + value *= (datar[0] << 8) | datar[1]; +- /* Convert to centidegrees */ +- *val = value / 0xFFFF - 27215; ++ /* Convert to tenths of degree Celsius */ ++ *val = value / 0xFFFF - 2722; + return ret; + } + +diff --git a/drivers/power/supply/max17042_battery.c b/drivers/power/supply/max17042_battery.c +index 5b556a13f517..9c7eaaeda343 100644 +--- a/drivers/power/supply/max17042_battery.c ++++ b/drivers/power/supply/max17042_battery.c +@@ -1021,6 +1021,7 @@ static int max17042_probe(struct i2c_client *client, + + i2c_set_clientdata(client, chip); + psy_cfg.drv_data = chip; ++ psy_cfg.of_node = dev->of_node; + + /* When current is not measured, + * CURRENT_NOW and CURRENT_AVG properties should be invisible. */ +diff --git a/drivers/regulator/gpio-regulator.c b/drivers/regulator/gpio-regulator.c +index 0fce06acfaec..a2eb50719c7b 100644 +--- a/drivers/regulator/gpio-regulator.c ++++ b/drivers/regulator/gpio-regulator.c +@@ -271,8 +271,7 @@ static int gpio_regulator_probe(struct platform_device *pdev) + drvdata->desc.name = kstrdup(config->supply_name, GFP_KERNEL); + if (drvdata->desc.name == NULL) { + dev_err(&pdev->dev, "Failed to allocate supply name\n"); +- ret = -ENOMEM; +- goto err; ++ return -ENOMEM; + } + + if (config->nr_gpios != 0) { +@@ -292,7 +291,7 @@ static int gpio_regulator_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "Could not obtain regulator setting GPIOs: %d\n", + ret); +- goto err_memstate; ++ goto err_memgpio; + } + } + +@@ -303,7 +302,7 @@ static int gpio_regulator_probe(struct platform_device *pdev) + if (drvdata->states == NULL) { + dev_err(&pdev->dev, "Failed to allocate state data\n"); + ret = -ENOMEM; +- goto err_memgpio; ++ goto err_stategpio; + } + drvdata->nr_states = config->nr_states; + +@@ -324,7 +323,7 @@ static int gpio_regulator_probe(struct platform_device *pdev) + default: + dev_err(&pdev->dev, "No regulator type set\n"); + ret = -EINVAL; +- goto err_memgpio; ++ goto err_memstate; + } + + /* build initial state from gpio init data. */ +@@ -361,22 +360,21 @@ static int gpio_regulator_probe(struct platform_device *pdev) + if (IS_ERR(drvdata->dev)) { + ret = PTR_ERR(drvdata->dev); + dev_err(&pdev->dev, "Failed to register regulator: %d\n", ret); +- goto err_stategpio; ++ goto err_memstate; + } + + platform_set_drvdata(pdev, drvdata); + + return 0; + +-err_stategpio: +- gpio_free_array(drvdata->gpios, drvdata->nr_gpios); + err_memstate: + kfree(drvdata->states); ++err_stategpio: ++ gpio_free_array(drvdata->gpios, drvdata->nr_gpios); + err_memgpio: + kfree(drvdata->gpios); + err_name: + kfree(drvdata->desc.name); +-err: + return ret; + } + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index 14637a01ba2d..c9875355905d 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -305,6 +305,7 @@ int of_regulator_match(struct device *dev, struct device_node *node, + dev_err(dev, + "failed to parse DT for regulator %s\n", + child->name); ++ of_node_put(child); + return -EINVAL; + } + match->of_node = of_node_get(child); +diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c +index 633268e9d550..05bcbce2013a 100644 +--- a/drivers/remoteproc/imx_rproc.c ++++ b/drivers/remoteproc/imx_rproc.c +@@ -339,8 +339,10 @@ static int imx_rproc_probe(struct platform_device *pdev) + } + + dcfg = of_device_get_match_data(dev); +- if (!dcfg) +- return -EINVAL; ++ if (!dcfg) { ++ ret = -EINVAL; ++ goto err_put_rproc; ++ } + + priv = rproc->priv; + priv->rproc = rproc; +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index 29f35e29d480..e67c1d8a193d 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -2596,8 +2596,6 @@ int dasd_cancel_req(struct dasd_ccw_req *cqr) + case DASD_CQR_QUEUED: + /* request was not started - just set to cleared */ + cqr->status = DASD_CQR_CLEARED; +- if (cqr->callback_data == DASD_SLEEPON_START_TAG) +- cqr->callback_data = DASD_SLEEPON_END_TAG; + break; + case DASD_CQR_IN_IO: + /* request in IO - terminate IO and release again */ +@@ -3917,9 +3915,12 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device) + wait_event(dasd_flush_wq, + (cqr->status != DASD_CQR_CLEAR_PENDING)); + +- /* mark sleepon requests as ended */ +- if (cqr->callback_data == DASD_SLEEPON_START_TAG) +- cqr->callback_data = DASD_SLEEPON_END_TAG; ++ /* ++ * requeue requests to blocklayer will only work ++ * for block device requests ++ */ ++ if (_dasd_requeue_request(cqr)) ++ continue; + + /* remove requests from device and block queue */ + list_del_init(&cqr->devlist); +@@ -3932,13 +3933,6 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device) + cqr = refers; + } + +- /* +- * requeue requests to blocklayer will only work +- * for block device requests +- */ +- if (_dasd_requeue_request(cqr)) +- continue; +- + if (cqr->block) + list_del_init(&cqr->blocklist); + cqr->block->base->discipline->free_cp( +@@ -3955,8 +3949,7 @@ static int dasd_generic_requeue_all_requests(struct dasd_device *device) + list_splice_tail(&requeue_queue, &device->ccw_queue); + spin_unlock_irq(get_ccwdev_lock(device->cdev)); + } +- /* wake up generic waitqueue for eventually ended sleepon requests */ +- wake_up(&generic_waitq); ++ dasd_schedule_device_bh(device); + return rc; + } + +diff --git a/drivers/s390/cio/device_fsm.c b/drivers/s390/cio/device_fsm.c +index f98ea674c3d8..28837ad75712 100644 +--- a/drivers/s390/cio/device_fsm.c ++++ b/drivers/s390/cio/device_fsm.c +@@ -796,6 +796,7 @@ ccw_device_online_timeout(struct ccw_device *cdev, enum dev_event dev_event) + + ccw_device_set_timeout(cdev, 0); + cdev->private->iretry = 255; ++ cdev->private->async_kill_io_rc = -ETIMEDOUT; + ret = ccw_device_cancel_halt_clear(cdev); + if (ret == -EBUSY) { + ccw_device_set_timeout(cdev, 3*HZ); +@@ -872,7 +873,7 @@ ccw_device_killing_irq(struct ccw_device *cdev, enum dev_event dev_event) + /* OK, i/o is dead now. Call interrupt handler. */ + if (cdev->handler) + cdev->handler(cdev, cdev->private->intparm, +- ERR_PTR(-EIO)); ++ ERR_PTR(cdev->private->async_kill_io_rc)); + } + + static void +@@ -889,14 +890,16 @@ ccw_device_killing_timeout(struct ccw_device *cdev, enum dev_event dev_event) + ccw_device_online_verify(cdev, 0); + if (cdev->handler) + cdev->handler(cdev, cdev->private->intparm, +- ERR_PTR(-EIO)); ++ ERR_PTR(cdev->private->async_kill_io_rc)); + } + + void ccw_device_kill_io(struct ccw_device *cdev) + { + int ret; + ++ ccw_device_set_timeout(cdev, 0); + cdev->private->iretry = 255; ++ cdev->private->async_kill_io_rc = -EIO; + ret = ccw_device_cancel_halt_clear(cdev); + if (ret == -EBUSY) { + ccw_device_set_timeout(cdev, 3*HZ); +diff --git a/drivers/s390/cio/device_ops.c b/drivers/s390/cio/device_ops.c +index cf8c4ac6323a..b22922ec32d1 100644 +--- a/drivers/s390/cio/device_ops.c ++++ b/drivers/s390/cio/device_ops.c +@@ -160,7 +160,7 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm) + } + + /** +- * ccw_device_start_key() - start a s390 channel program with key ++ * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key + * @cdev: target ccw device + * @cpa: logical start address of channel program + * @intparm: user specific interruption parameter; will be presented back to +@@ -171,10 +171,15 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm) + * @key: storage key to be used for the I/O + * @flags: additional flags; defines the action to be performed for I/O + * processing. ++ * @expires: timeout value in jiffies + * + * Start a S/390 channel program. When the interrupt arrives, the + * IRQ handler is called, either immediately, delayed (dev-end missing, + * or sense required) or never (no IRQ handler registered). ++ * This function notifies the device driver if the channel program has not ++ * completed during the time specified by @expires. If a timeout occurs, the ++ * channel program is terminated via xsch, hsch or csch, and the device's ++ * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT). + * Returns: + * %0, if the operation was successful; + * -%EBUSY, if the device is busy, or status pending; +@@ -183,9 +188,9 @@ int ccw_device_clear(struct ccw_device *cdev, unsigned long intparm) + * Context: + * Interrupts disabled, ccw device lock held + */ +-int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, +- unsigned long intparm, __u8 lpm, __u8 key, +- unsigned long flags) ++int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa, ++ unsigned long intparm, __u8 lpm, __u8 key, ++ unsigned long flags, int expires) + { + struct subchannel *sch; + int ret; +@@ -225,6 +230,8 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, + switch (ret) { + case 0: + cdev->private->intparm = intparm; ++ if (expires) ++ ccw_device_set_timeout(cdev, expires); + break; + case -EACCES: + case -ENODEV: +@@ -235,7 +242,7 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, + } + + /** +- * ccw_device_start_timeout_key() - start a s390 channel program with timeout and key ++ * ccw_device_start_key() - start a s390 channel program with key + * @cdev: target ccw device + * @cpa: logical start address of channel program + * @intparm: user specific interruption parameter; will be presented back to +@@ -246,15 +253,10 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, + * @key: storage key to be used for the I/O + * @flags: additional flags; defines the action to be performed for I/O + * processing. +- * @expires: timeout value in jiffies + * + * Start a S/390 channel program. When the interrupt arrives, the + * IRQ handler is called, either immediately, delayed (dev-end missing, + * or sense required) or never (no IRQ handler registered). +- * This function notifies the device driver if the channel program has not +- * completed during the time specified by @expires. If a timeout occurs, the +- * channel program is terminated via xsch, hsch or csch, and the device's +- * interrupt handler will be called with an irb containing ERR_PTR(-%ETIMEDOUT). + * Returns: + * %0, if the operation was successful; + * -%EBUSY, if the device is busy, or status pending; +@@ -263,19 +265,12 @@ int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, + * Context: + * Interrupts disabled, ccw device lock held + */ +-int ccw_device_start_timeout_key(struct ccw_device *cdev, struct ccw1 *cpa, +- unsigned long intparm, __u8 lpm, __u8 key, +- unsigned long flags, int expires) ++int ccw_device_start_key(struct ccw_device *cdev, struct ccw1 *cpa, ++ unsigned long intparm, __u8 lpm, __u8 key, ++ unsigned long flags) + { +- int ret; +- +- if (!cdev) +- return -ENODEV; +- ccw_device_set_timeout(cdev, expires); +- ret = ccw_device_start_key(cdev, cpa, intparm, lpm, key, flags); +- if (ret != 0) +- ccw_device_set_timeout(cdev, 0); +- return ret; ++ return ccw_device_start_timeout_key(cdev, cpa, intparm, lpm, key, ++ flags, 0); + } + + /** +@@ -490,18 +485,20 @@ void ccw_device_get_id(struct ccw_device *cdev, struct ccw_dev_id *dev_id) + EXPORT_SYMBOL(ccw_device_get_id); + + /** +- * ccw_device_tm_start_key() - perform start function ++ * ccw_device_tm_start_timeout_key() - perform start function + * @cdev: ccw device on which to perform the start function + * @tcw: transport-command word to be started + * @intparm: user defined parameter to be passed to the interrupt handler + * @lpm: mask of paths to use + * @key: storage key to use for storage access ++ * @expires: time span in jiffies after which to abort request + * + * Start the tcw on the given ccw device. Return zero on success, non-zero + * otherwise. + */ +-int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw, +- unsigned long intparm, u8 lpm, u8 key) ++int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw, ++ unsigned long intparm, u8 lpm, u8 key, ++ int expires) + { + struct subchannel *sch; + int rc; +@@ -528,37 +525,32 @@ int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw, + return -EACCES; + } + rc = cio_tm_start_key(sch, tcw, lpm, key); +- if (rc == 0) ++ if (rc == 0) { + cdev->private->intparm = intparm; ++ if (expires) ++ ccw_device_set_timeout(cdev, expires); ++ } + return rc; + } +-EXPORT_SYMBOL(ccw_device_tm_start_key); ++EXPORT_SYMBOL(ccw_device_tm_start_timeout_key); + + /** +- * ccw_device_tm_start_timeout_key() - perform start function ++ * ccw_device_tm_start_key() - perform start function + * @cdev: ccw device on which to perform the start function + * @tcw: transport-command word to be started + * @intparm: user defined parameter to be passed to the interrupt handler + * @lpm: mask of paths to use + * @key: storage key to use for storage access +- * @expires: time span in jiffies after which to abort request + * + * Start the tcw on the given ccw device. Return zero on success, non-zero + * otherwise. + */ +-int ccw_device_tm_start_timeout_key(struct ccw_device *cdev, struct tcw *tcw, +- unsigned long intparm, u8 lpm, u8 key, +- int expires) ++int ccw_device_tm_start_key(struct ccw_device *cdev, struct tcw *tcw, ++ unsigned long intparm, u8 lpm, u8 key) + { +- int ret; +- +- ccw_device_set_timeout(cdev, expires); +- ret = ccw_device_tm_start_key(cdev, tcw, intparm, lpm, key); +- if (ret != 0) +- ccw_device_set_timeout(cdev, 0); +- return ret; ++ return ccw_device_tm_start_timeout_key(cdev, tcw, intparm, lpm, key, 0); + } +-EXPORT_SYMBOL(ccw_device_tm_start_timeout_key); ++EXPORT_SYMBOL(ccw_device_tm_start_key); + + /** + * ccw_device_tm_start() - perform start function +diff --git a/drivers/s390/cio/io_sch.h b/drivers/s390/cio/io_sch.h +index af571d8d6925..90e4e3a7841b 100644 +--- a/drivers/s390/cio/io_sch.h ++++ b/drivers/s390/cio/io_sch.h +@@ -157,6 +157,7 @@ struct ccw_device_private { + unsigned long intparm; /* user interruption parameter */ + struct qdio_irq *qdio_data; + struct irb irb; /* device status */ ++ int async_kill_io_rc; + struct senseid senseid; /* SenseID info */ + struct pgid pgid[8]; /* path group IDs per chpid*/ + struct ccw1 iccws[2]; /* ccws for SNID/SID/SPGID commands */ +diff --git a/drivers/s390/cio/vfio_ccw_fsm.c b/drivers/s390/cio/vfio_ccw_fsm.c +index e96b85579f21..3c800642134e 100644 +--- a/drivers/s390/cio/vfio_ccw_fsm.c ++++ b/drivers/s390/cio/vfio_ccw_fsm.c +@@ -129,6 +129,11 @@ static void fsm_io_request(struct vfio_ccw_private *private, + if (scsw->cmd.fctl & SCSW_FCTL_START_FUNC) { + orb = (union orb *)io_region->orb_area; + ++ /* Don't try to build a cp if transport mode is specified. */ ++ if (orb->tm.b) { ++ io_region->ret_code = -EOPNOTSUPP; ++ goto err_out; ++ } + io_region->ret_code = cp_init(&private->cp, mdev_dev(mdev), + orb); + if (io_region->ret_code) +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 9be34d37c356..3f3cb72e0c0c 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -525,6 +525,8 @@ static int sr_block_open(struct block_device *bdev, fmode_t mode) + struct scsi_cd *cd; + int ret = -ENXIO; + ++ check_disk_change(bdev); ++ + mutex_lock(&sr_mutex); + cd = scsi_cd_get(bdev->bd_disk); + if (cd) { +@@ -585,18 +587,28 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd, + static unsigned int sr_block_check_events(struct gendisk *disk, + unsigned int clearing) + { +- struct scsi_cd *cd = scsi_cd(disk); ++ unsigned int ret = 0; ++ struct scsi_cd *cd; + +- if (atomic_read(&cd->device->disk_events_disable_depth)) ++ cd = scsi_cd_get(disk); ++ if (!cd) + return 0; + +- return cdrom_check_events(&cd->cdi, clearing); ++ if (!atomic_read(&cd->device->disk_events_disable_depth)) ++ ret = cdrom_check_events(&cd->cdi, clearing); ++ ++ scsi_cd_put(cd); ++ return ret; + } + + static int sr_block_revalidate_disk(struct gendisk *disk) + { +- struct scsi_cd *cd = scsi_cd(disk); + struct scsi_sense_hdr sshdr; ++ struct scsi_cd *cd; ++ ++ cd = scsi_cd_get(disk); ++ if (!cd) ++ return -ENXIO; + + /* if the unit is not ready, nothing more to do */ + if (scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr)) +@@ -605,6 +617,7 @@ static int sr_block_revalidate_disk(struct gendisk *disk) + sr_cd_check(&cd->cdi); + get_sectorsize(cd); + out: ++ scsi_cd_put(cd); + return 0; + } + +diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c +index 2a21f2d48592..35fab1e18adc 100644 +--- a/drivers/scsi/sr_ioctl.c ++++ b/drivers/scsi/sr_ioctl.c +@@ -188,9 +188,13 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc) + struct scsi_device *SDev; + struct scsi_sense_hdr sshdr; + int result, err = 0, retries = 0; ++ unsigned char sense_buffer[SCSI_SENSE_BUFFERSIZE], *senseptr = NULL; + + SDev = cd->device; + ++ if (cgc->sense) ++ senseptr = sense_buffer; ++ + retry: + if (!scsi_block_when_processing_errors(SDev)) { + err = -ENODEV; +@@ -198,10 +202,12 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc) + } + + result = scsi_execute(SDev, cgc->cmd, cgc->data_direction, +- cgc->buffer, cgc->buflen, +- (unsigned char *)cgc->sense, &sshdr, ++ cgc->buffer, cgc->buflen, senseptr, &sshdr, + cgc->timeout, IOCTL_RETRIES, 0, 0, NULL); + ++ if (cgc->sense) ++ memcpy(cgc->sense, sense_buffer, sizeof(*cgc->sense)); ++ + /* Minimal error checking. Ignore cases we know about, and report the rest. */ + if (driver_byte(result) != 0) { + switch (sshdr.sense_key) { +diff --git a/drivers/soc/imx/gpc.c b/drivers/soc/imx/gpc.c +index 47e7aa963dbb..1613ccf0c059 100644 +--- a/drivers/soc/imx/gpc.c ++++ b/drivers/soc/imx/gpc.c +@@ -456,13 +456,21 @@ static int imx_gpc_probe(struct platform_device *pdev) + + static int imx_gpc_remove(struct platform_device *pdev) + { ++ struct device_node *pgc_node; + int ret; + ++ pgc_node = of_get_child_by_name(pdev->dev.of_node, "pgc"); ++ ++ /* bail out if DT too old and doesn't provide the necessary info */ ++ if (!of_property_read_bool(pdev->dev.of_node, "#power-domain-cells") && ++ !pgc_node) ++ return 0; ++ + /* + * If the old DT binding is used the toplevel driver needs to + * de-register the power domains + */ +- if (!of_get_child_by_name(pdev->dev.of_node, "pgc")) { ++ if (!pgc_node) { + of_genpd_del_provider(pdev->dev.of_node); + + ret = pm_genpd_remove(&imx_gpc_domains[GPC_PGC_DOMAIN_PU].base); +diff --git a/drivers/soc/qcom/wcnss_ctrl.c b/drivers/soc/qcom/wcnss_ctrl.c +index d008e5b82db4..df3ccb30bc2d 100644 +--- a/drivers/soc/qcom/wcnss_ctrl.c ++++ b/drivers/soc/qcom/wcnss_ctrl.c +@@ -249,7 +249,7 @@ static int wcnss_download_nv(struct wcnss_ctrl *wcnss, bool *expect_cbc) + /* Increment for next fragment */ + req->seq++; + +- data += req->hdr.len; ++ data += NV_FRAGMENT_SIZE; + left -= NV_FRAGMENT_SIZE; + } while (left > 0); + +diff --git a/drivers/spi/spi-bcm-qspi.c b/drivers/spi/spi-bcm-qspi.c +index ff01f865a173..6573152ce893 100644 +--- a/drivers/spi/spi-bcm-qspi.c ++++ b/drivers/spi/spi-bcm-qspi.c +@@ -1255,7 +1255,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + qspi->base[MSPI] = devm_ioremap_resource(dev, res); + if (IS_ERR(qspi->base[MSPI])) { + ret = PTR_ERR(qspi->base[MSPI]); +- goto qspi_probe_err; ++ goto qspi_resource_err; + } + } else { + goto qspi_resource_err; +@@ -1266,7 +1266,7 @@ int bcm_qspi_probe(struct platform_device *pdev, + qspi->base[BSPI] = devm_ioremap_resource(dev, res); + if (IS_ERR(qspi->base[BSPI])) { + ret = PTR_ERR(qspi->base[BSPI]); +- goto qspi_probe_err; ++ goto qspi_resource_err; + } + qspi->bspi_mode = true; + } else { +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 6dda3623a276..e1faee1f8602 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -65,6 +65,23 @@ + #define AX_INDXC 0x30 + #define AX_DATAC 0x34 + ++#define PT_ADDR_INDX 0xE8 ++#define PT_READ_INDX 0xE4 ++#define PT_SIG_1_ADDR 0xA520 ++#define PT_SIG_2_ADDR 0xA521 ++#define PT_SIG_3_ADDR 0xA522 ++#define PT_SIG_4_ADDR 0xA523 ++#define PT_SIG_1_DATA 0x78 ++#define PT_SIG_2_DATA 0x56 ++#define PT_SIG_3_DATA 0x34 ++#define PT_SIG_4_DATA 0x12 ++#define PT4_P1_REG 0xB521 ++#define PT4_P2_REG 0xB522 ++#define PT2_P1_REG 0xD520 ++#define PT2_P2_REG 0xD521 ++#define PT1_P1_REG 0xD522 ++#define PT1_P2_REG 0xD523 ++ + #define NB_PCIE_INDX_ADDR 0xe0 + #define NB_PCIE_INDX_DATA 0xe4 + #define PCIE_P_CNTL 0x10040 +@@ -511,6 +528,98 @@ void usb_amd_dev_put(void) + } + EXPORT_SYMBOL_GPL(usb_amd_dev_put); + ++/* ++ * Check if port is disabled in BIOS on AMD Promontory host. ++ * BIOS Disabled ports may wake on connect/disconnect and need ++ * driver workaround to keep them disabled. ++ * Returns true if port is marked disabled. ++ */ ++bool usb_amd_pt_check_port(struct device *device, int port) ++{ ++ unsigned char value, port_shift; ++ struct pci_dev *pdev; ++ u16 reg; ++ ++ pdev = to_pci_dev(device); ++ pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_1_ADDR); ++ ++ pci_read_config_byte(pdev, PT_READ_INDX, &value); ++ if (value != PT_SIG_1_DATA) ++ return false; ++ ++ pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_2_ADDR); ++ ++ pci_read_config_byte(pdev, PT_READ_INDX, &value); ++ if (value != PT_SIG_2_DATA) ++ return false; ++ ++ pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_3_ADDR); ++ ++ pci_read_config_byte(pdev, PT_READ_INDX, &value); ++ if (value != PT_SIG_3_DATA) ++ return false; ++ ++ pci_write_config_word(pdev, PT_ADDR_INDX, PT_SIG_4_ADDR); ++ ++ pci_read_config_byte(pdev, PT_READ_INDX, &value); ++ if (value != PT_SIG_4_DATA) ++ return false; ++ ++ /* Check disabled port setting, if bit is set port is enabled */ ++ switch (pdev->device) { ++ case 0x43b9: ++ case 0x43ba: ++ /* ++ * device is AMD_PROMONTORYA_4(0x43b9) or PROMONTORYA_3(0x43ba) ++ * PT4_P1_REG bits[7..1] represents USB2.0 ports 6 to 0 ++ * PT4_P2_REG bits[6..0] represents ports 13 to 7 ++ */ ++ if (port > 6) { ++ reg = PT4_P2_REG; ++ port_shift = port - 7; ++ } else { ++ reg = PT4_P1_REG; ++ port_shift = port + 1; ++ } ++ break; ++ case 0x43bb: ++ /* ++ * device is AMD_PROMONTORYA_2(0x43bb) ++ * PT2_P1_REG bits[7..5] represents USB2.0 ports 2 to 0 ++ * PT2_P2_REG bits[5..0] represents ports 9 to 3 ++ */ ++ if (port > 2) { ++ reg = PT2_P2_REG; ++ port_shift = port - 3; ++ } else { ++ reg = PT2_P1_REG; ++ port_shift = port + 5; ++ } ++ break; ++ case 0x43bc: ++ /* ++ * device is AMD_PROMONTORYA_1(0x43bc) ++ * PT1_P1_REG[7..4] represents USB2.0 ports 3 to 0 ++ * PT1_P2_REG[5..0] represents ports 9 to 4 ++ */ ++ if (port > 3) { ++ reg = PT1_P2_REG; ++ port_shift = port - 4; ++ } else { ++ reg = PT1_P1_REG; ++ port_shift = port + 4; ++ } ++ break; ++ default: ++ return false; ++ } ++ pci_write_config_word(pdev, PT_ADDR_INDX, reg); ++ pci_read_config_byte(pdev, PT_READ_INDX, &value); ++ ++ return !(value & BIT(port_shift)); ++} ++EXPORT_SYMBOL_GPL(usb_amd_pt_check_port); ++ + /* + * Make sure the controller is completely inactive, unable to + * generate interrupts or do DMA. +diff --git a/drivers/usb/host/pci-quirks.h b/drivers/usb/host/pci-quirks.h +index b68dcb5dd0fd..4ca0d9b7e463 100644 +--- a/drivers/usb/host/pci-quirks.h ++++ b/drivers/usb/host/pci-quirks.h +@@ -17,6 +17,7 @@ void usb_enable_intel_xhci_ports(struct pci_dev *xhci_pdev); + void usb_disable_xhci_ports(struct pci_dev *xhci_pdev); + void sb800_prefetch(struct device *dev, int on); + bool usb_xhci_needs_pci_reset(struct pci_dev *pdev); ++bool usb_amd_pt_check_port(struct device *device, int port); + #else + struct pci_dev; + static inline void usb_amd_quirk_pll_disable(void) {} +@@ -25,6 +26,10 @@ static inline void usb_asmedia_modifyflowcontrol(struct pci_dev *pdev) {} + static inline void usb_amd_dev_put(void) {} + static inline void usb_disable_xhci_ports(struct pci_dev *xhci_pdev) {} + static inline void sb800_prefetch(struct device *dev, int on) {} ++static inline bool usb_amd_pt_check_port(struct device *device, int port) ++{ ++ return false; ++} + #endif /* CONFIG_USB_PCI */ + + #endif /* __LINUX_USB_PCI_QUIRKS_H */ +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 9762333d8d7f..00b8d4cdcac3 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -1531,6 +1531,13 @@ int xhci_bus_suspend(struct usb_hcd *hcd) + t2 |= PORT_WKOC_E | PORT_WKCONN_E; + t2 &= ~PORT_WKDISC_E; + } ++ ++ if ((xhci->quirks & XHCI_U2_DISABLE_WAKE) && ++ (hcd->speed < HCD_USB3)) { ++ if (usb_amd_pt_check_port(hcd->self.controller, ++ port_index)) ++ t2 &= ~PORT_WAKE_BITS; ++ } + } else + t2 &= ~PORT_WAKE_BITS; + +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index d79ab0d85924..838d37e79fa2 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -54,6 +54,10 @@ + #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 + #define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 + ++#define PCI_DEVICE_ID_AMD_PROMONTORYA_4 0x43b9 ++#define PCI_DEVICE_ID_AMD_PROMONTORYA_3 0x43ba ++#define PCI_DEVICE_ID_AMD_PROMONTORYA_2 0x43bb ++#define PCI_DEVICE_ID_AMD_PROMONTORYA_1 0x43bc + #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI 0x1142 + + static const char hcd_name[] = "xhci_hcd"; +@@ -143,6 +147,13 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + if (pdev->vendor == PCI_VENDOR_ID_AMD) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + ++ if ((pdev->vendor == PCI_VENDOR_ID_AMD) && ++ ((pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_4) || ++ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_3) || ++ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_2) || ++ (pdev->device == PCI_DEVICE_ID_AMD_PROMONTORYA_1))) ++ xhci->quirks |= XHCI_U2_DISABLE_WAKE; ++ + if (pdev->vendor == PCI_VENDOR_ID_INTEL) { + xhci->quirks |= XHCI_LPM_SUPPORT; + xhci->quirks |= XHCI_INTEL_HOST; +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index f5fb1f4a092c..2a72060dda1b 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -1829,7 +1829,7 @@ struct xhci_hcd { + /* For controller with a broken Port Disable implementation */ + #define XHCI_BROKEN_PORT_PED (1 << 25) + #define XHCI_LIMIT_ENDPOINT_INTERVAL_7 (1 << 26) +-/* Reserved. It was XHCI_U2_DISABLE_WAKE */ ++#define XHCI_U2_DISABLE_WAKE (1 << 27) + #define XHCI_ASMEDIA_MODIFY_FLOWCONTROL (1 << 28) + #define XHCI_SUSPEND_DELAY (1 << 30) + +diff --git a/drivers/video/fbdev/sbuslib.c b/drivers/video/fbdev/sbuslib.c +index af6fc97f4ba4..a436d44f1b7f 100644 +--- a/drivers/video/fbdev/sbuslib.c ++++ b/drivers/video/fbdev/sbuslib.c +@@ -122,7 +122,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + unsigned char __user *ured; + unsigned char __user *ugreen; + unsigned char __user *ublue; +- int index, count, i; ++ unsigned int index, count, i; + + if (get_user(index, &c->index) || + __get_user(count, &c->count) || +@@ -161,7 +161,7 @@ int sbusfb_ioctl_helper(unsigned long cmd, unsigned long arg, + unsigned char __user *ugreen; + unsigned char __user *ublue; + struct fb_cmap *cmap = &info->cmap; +- int index, count, i; ++ unsigned int index, count, i; + u8 red, green, blue; + + if (get_user(index, &c->index) || +diff --git a/drivers/watchdog/asm9260_wdt.c b/drivers/watchdog/asm9260_wdt.c +index 7dd0da644a7f..2cf56b459d84 100644 +--- a/drivers/watchdog/asm9260_wdt.c ++++ b/drivers/watchdog/asm9260_wdt.c +@@ -292,14 +292,14 @@ static int asm9260_wdt_probe(struct platform_device *pdev) + if (IS_ERR(priv->iobase)) + return PTR_ERR(priv->iobase); + +- ret = asm9260_wdt_get_dt_clks(priv); +- if (ret) +- return ret; +- + priv->rst = devm_reset_control_get_exclusive(&pdev->dev, "wdt_rst"); + if (IS_ERR(priv->rst)) + return PTR_ERR(priv->rst); + ++ ret = asm9260_wdt_get_dt_clks(priv); ++ if (ret) ++ return ret; ++ + wdd = &priv->wdd; + wdd->info = &asm9260_wdt_ident; + wdd->ops = &asm9260_wdt_ops; +diff --git a/drivers/watchdog/aspeed_wdt.c b/drivers/watchdog/aspeed_wdt.c +index 79cc766cd30f..fd91007b4e41 100644 +--- a/drivers/watchdog/aspeed_wdt.c ++++ b/drivers/watchdog/aspeed_wdt.c +@@ -46,6 +46,7 @@ MODULE_DEVICE_TABLE(of, aspeed_wdt_of_table); + #define WDT_RELOAD_VALUE 0x04 + #define WDT_RESTART 0x08 + #define WDT_CTRL 0x0C ++#define WDT_CTRL_BOOT_SECONDARY BIT(7) + #define WDT_CTRL_RESET_MODE_SOC (0x00 << 5) + #define WDT_CTRL_RESET_MODE_FULL_CHIP (0x01 << 5) + #define WDT_CTRL_RESET_MODE_ARM_CPU (0x10 << 5) +@@ -158,6 +159,7 @@ static int aspeed_wdt_restart(struct watchdog_device *wdd, + { + struct aspeed_wdt *wdt = to_aspeed_wdt(wdd); + ++ wdt->ctrl &= ~WDT_CTRL_BOOT_SECONDARY; + aspeed_wdt_enable(wdt, 128 * WDT_RATE_1MHZ / 1000); + + mdelay(1000); +@@ -232,16 +234,21 @@ static int aspeed_wdt_probe(struct platform_device *pdev) + wdt->ctrl |= WDT_CTRL_RESET_MODE_SOC | WDT_CTRL_RESET_SYSTEM; + } else { + if (!strcmp(reset_type, "cpu")) +- wdt->ctrl |= WDT_CTRL_RESET_MODE_ARM_CPU; ++ wdt->ctrl |= WDT_CTRL_RESET_MODE_ARM_CPU | ++ WDT_CTRL_RESET_SYSTEM; + else if (!strcmp(reset_type, "soc")) +- wdt->ctrl |= WDT_CTRL_RESET_MODE_SOC; ++ wdt->ctrl |= WDT_CTRL_RESET_MODE_SOC | ++ WDT_CTRL_RESET_SYSTEM; + else if (!strcmp(reset_type, "system")) +- wdt->ctrl |= WDT_CTRL_RESET_SYSTEM; ++ wdt->ctrl |= WDT_CTRL_RESET_MODE_FULL_CHIP | ++ WDT_CTRL_RESET_SYSTEM; + else if (strcmp(reset_type, "none")) + return -EINVAL; + } + if (of_property_read_bool(np, "aspeed,external-signal")) + wdt->ctrl |= WDT_CTRL_WDT_EXT; ++ if (of_property_read_bool(np, "aspeed,alt-boot")) ++ wdt->ctrl |= WDT_CTRL_BOOT_SECONDARY; + + writel(wdt->ctrl, wdt->base + WDT_CTRL); + +diff --git a/drivers/watchdog/davinci_wdt.c b/drivers/watchdog/davinci_wdt.c +index 2f46487af86d..6d9a5d8c3c8d 100644 +--- a/drivers/watchdog/davinci_wdt.c ++++ b/drivers/watchdog/davinci_wdt.c +@@ -198,15 +198,22 @@ static int davinci_wdt_probe(struct platform_device *pdev) + + wdt_mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); + davinci_wdt->base = devm_ioremap_resource(dev, wdt_mem); +- if (IS_ERR(davinci_wdt->base)) +- return PTR_ERR(davinci_wdt->base); ++ if (IS_ERR(davinci_wdt->base)) { ++ ret = PTR_ERR(davinci_wdt->base); ++ goto err_clk_disable; ++ } + + ret = watchdog_register_device(wdd); +- if (ret < 0) { +- clk_disable_unprepare(davinci_wdt->clk); ++ if (ret) { + dev_err(dev, "cannot register watchdog device\n"); ++ goto err_clk_disable; + } + ++ return 0; ++ ++err_clk_disable: ++ clk_disable_unprepare(davinci_wdt->clk); ++ + return ret; + } + +diff --git a/drivers/watchdog/dw_wdt.c b/drivers/watchdog/dw_wdt.c +index c2f4ff516230..918357bccf5e 100644 +--- a/drivers/watchdog/dw_wdt.c ++++ b/drivers/watchdog/dw_wdt.c +@@ -34,6 +34,7 @@ + + #define WDOG_CONTROL_REG_OFFSET 0x00 + #define WDOG_CONTROL_REG_WDT_EN_MASK 0x01 ++#define WDOG_CONTROL_REG_RESP_MODE_MASK 0x02 + #define WDOG_TIMEOUT_RANGE_REG_OFFSET 0x04 + #define WDOG_TIMEOUT_RANGE_TOPINIT_SHIFT 4 + #define WDOG_CURRENT_COUNT_REG_OFFSET 0x08 +@@ -121,14 +122,23 @@ static int dw_wdt_set_timeout(struct watchdog_device *wdd, unsigned int top_s) + return 0; + } + ++static void dw_wdt_arm_system_reset(struct dw_wdt *dw_wdt) ++{ ++ u32 val = readl(dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); ++ ++ /* Disable interrupt mode; always perform system reset. */ ++ val &= ~WDOG_CONTROL_REG_RESP_MODE_MASK; ++ /* Enable watchdog. */ ++ val |= WDOG_CONTROL_REG_WDT_EN_MASK; ++ writel(val, dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); ++} ++ + static int dw_wdt_start(struct watchdog_device *wdd) + { + struct dw_wdt *dw_wdt = to_dw_wdt(wdd); + + dw_wdt_set_timeout(wdd, wdd->timeout); +- +- writel(WDOG_CONTROL_REG_WDT_EN_MASK, +- dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); ++ dw_wdt_arm_system_reset(dw_wdt); + + return 0; + } +@@ -152,16 +162,13 @@ static int dw_wdt_restart(struct watchdog_device *wdd, + unsigned long action, void *data) + { + struct dw_wdt *dw_wdt = to_dw_wdt(wdd); +- u32 val; + + writel(0, dw_wdt->regs + WDOG_TIMEOUT_RANGE_REG_OFFSET); +- val = readl(dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); +- if (val & WDOG_CONTROL_REG_WDT_EN_MASK) ++ if (dw_wdt_is_enabled(dw_wdt)) + writel(WDOG_COUNTER_RESTART_KICK_VALUE, + dw_wdt->regs + WDOG_COUNTER_RESTART_REG_OFFSET); + else +- writel(WDOG_CONTROL_REG_WDT_EN_MASK, +- dw_wdt->regs + WDOG_CONTROL_REG_OFFSET); ++ dw_wdt_arm_system_reset(dw_wdt); + + /* wait for reset to assert... */ + mdelay(500); +diff --git a/drivers/watchdog/f71808e_wdt.c b/drivers/watchdog/f71808e_wdt.c +index e682bf046e50..88cd2a52d8d3 100644 +--- a/drivers/watchdog/f71808e_wdt.c ++++ b/drivers/watchdog/f71808e_wdt.c +@@ -566,7 +566,8 @@ static ssize_t watchdog_write(struct file *file, const char __user *buf, + char c; + if (get_user(c, buf + i)) + return -EFAULT; +- expect_close = (c == 'V'); ++ if (c == 'V') ++ expect_close = true; + } + + /* Properly order writes across fork()ed processes */ +diff --git a/drivers/watchdog/sbsa_gwdt.c b/drivers/watchdog/sbsa_gwdt.c +index 316c2eb122d2..e8bd9887c566 100644 +--- a/drivers/watchdog/sbsa_gwdt.c ++++ b/drivers/watchdog/sbsa_gwdt.c +@@ -50,6 +50,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -159,7 +160,7 @@ static unsigned int sbsa_gwdt_get_timeleft(struct watchdog_device *wdd) + !(readl(gwdt->control_base + SBSA_GWDT_WCS) & SBSA_GWDT_WCS_WS0)) + timeleft += readl(gwdt->control_base + SBSA_GWDT_WOR); + +- timeleft += readq(gwdt->control_base + SBSA_GWDT_WCV) - ++ timeleft += lo_hi_readq(gwdt->control_base + SBSA_GWDT_WCV) - + arch_counter_get_cntvct(); + + do_div(timeleft, gwdt->clk); +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 1ab4bd11f5f3..762378f1811c 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -755,8 +755,8 @@ int xen_bind_pirq_msi_to_irq(struct pci_dev *dev, struct msi_desc *msidesc, + mutex_unlock(&irq_mapping_update_lock); + return irq; + error_irq: +- for (; i >= 0; i--) +- __unbind_from_irq(irq + i); ++ while (nvec--) ++ __unbind_from_irq(irq + nvec); + mutex_unlock(&irq_mapping_update_lock); + return ret; + } +diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c +index b209cd44bb8d..169293c25a91 100644 +--- a/drivers/xen/pvcalls-back.c ++++ b/drivers/xen/pvcalls-back.c +@@ -424,7 +424,7 @@ static int pvcalls_back_connect(struct xenbus_device *dev, + sock); + if (!map) { + ret = -EFAULT; +- sock_release(map->sock); ++ sock_release(sock); + } + + out: +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index 82fc54f8eb77..f98b8c135db9 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -365,7 +365,7 @@ xen_swiotlb_free_coherent(struct device *hwdev, size_t size, void *vaddr, + * physical address */ + phys = xen_bus_to_phys(dev_addr); + +- if (((dev_addr + size - 1 > dma_mask)) || ++ if (((dev_addr + size - 1 <= dma_mask)) || + range_straddles_page_boundary(phys, size)) + xen_destroy_contiguous_region(phys, order); + +diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c +index 23e391d3ec01..22863f5f2474 100644 +--- a/drivers/xen/xen-acpi-processor.c ++++ b/drivers/xen/xen-acpi-processor.c +@@ -362,9 +362,9 @@ read_acpi_id(acpi_handle handle, u32 lvl, void *context, void **rv) + } + /* There are more ACPI Processor objects than in x2APIC or MADT. + * This can happen with incorrect ACPI SSDT declerations. */ +- if (acpi_id > nr_acpi_bits) { +- pr_debug("We only have %u, trying to set %u\n", +- nr_acpi_bits, acpi_id); ++ if (acpi_id >= nr_acpi_bits) { ++ pr_debug("max acpi id %u, trying to set %u\n", ++ nr_acpi_bits - 1, acpi_id); + return AE_OK; + } + /* OK, There is a ACPI Processor object */ +diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c +index 74888cacd0b0..ec9eb4fba59c 100644 +--- a/drivers/xen/xenbus/xenbus_probe.c ++++ b/drivers/xen/xenbus/xenbus_probe.c +@@ -466,8 +466,11 @@ int xenbus_probe_node(struct xen_bus_type *bus, + + /* Register with generic device framework. */ + err = device_register(&xendev->dev); +- if (err) ++ if (err) { ++ put_device(&xendev->dev); ++ xendev = NULL; + goto fail; ++ } + + return 0; + fail: +diff --git a/drivers/zorro/zorro.c b/drivers/zorro/zorro.c +index cc1b1ac57d61..47728477297e 100644 +--- a/drivers/zorro/zorro.c ++++ b/drivers/zorro/zorro.c +@@ -16,6 +16,7 @@ + #include + #include + #include ++#include + #include + + #include +@@ -185,6 +186,17 @@ static int __init amiga_zorro_probe(struct platform_device *pdev) + z->dev.parent = &bus->dev; + z->dev.bus = &zorro_bus_type; + z->dev.id = i; ++ switch (z->rom.er_Type & ERT_TYPEMASK) { ++ case ERT_ZORROIII: ++ z->dev.coherent_dma_mask = DMA_BIT_MASK(32); ++ break; ++ ++ case ERT_ZORROII: ++ default: ++ z->dev.coherent_dma_mask = DMA_BIT_MASK(24); ++ break; ++ } ++ z->dev.dma_mask = &z->dev.coherent_dma_mask; + } + + /* ... then register them */ +diff --git a/fs/affs/namei.c b/fs/affs/namei.c +index d8aa0ae3d037..1ed0fa4c4d48 100644 +--- a/fs/affs/namei.c ++++ b/fs/affs/namei.c +@@ -206,9 +206,10 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) + + affs_lock_dir(dir); + bh = affs_find_entry(dir, dentry); +- affs_unlock_dir(dir); +- if (IS_ERR(bh)) ++ if (IS_ERR(bh)) { ++ affs_unlock_dir(dir); + return ERR_CAST(bh); ++ } + if (bh) { + u32 ino = bh->b_blocknr; + +@@ -222,10 +223,13 @@ affs_lookup(struct inode *dir, struct dentry *dentry, unsigned int flags) + } + affs_brelse(bh); + inode = affs_iget(sb, ino); +- if (IS_ERR(inode)) ++ if (IS_ERR(inode)) { ++ affs_unlock_dir(dir); + return ERR_CAST(inode); ++ } + } + d_add(dentry, inode); ++ affs_unlock_dir(dir); + return NULL; + } + +diff --git a/fs/aio.c b/fs/aio.c +index c3ace7833a03..4e23958c2509 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -1087,8 +1087,8 @@ static struct kioctx *lookup_ioctx(unsigned long ctx_id) + + ctx = rcu_dereference(table->table[id]); + if (ctx && ctx->user_id == ctx_id) { +- percpu_ref_get(&ctx->users); +- ret = ctx; ++ if (percpu_ref_tryget_live(&ctx->users)) ++ ret = ctx; + } + out: + rcu_read_unlock(); +diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h +index c44703e21396..588760c49fe2 100644 +--- a/fs/btrfs/ctree.h ++++ b/fs/btrfs/ctree.h +@@ -2969,7 +2969,7 @@ static inline void free_fs_info(struct btrfs_fs_info *fs_info) + kfree(fs_info->super_copy); + kfree(fs_info->super_for_commit); + security_free_mnt_opts(&fs_info->security_opts); +- kfree(fs_info); ++ kvfree(fs_info); + } + + /* tree mod log functions from ctree.c */ +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 4a630aeabb10..27d59cf36341 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -1276,7 +1276,7 @@ static struct btrfs_subvolume_writers *btrfs_alloc_subvolume_writers(void) + if (!writers) + return ERR_PTR(-ENOMEM); + +- ret = percpu_counter_init(&writers->counter, 0, GFP_KERNEL); ++ ret = percpu_counter_init(&writers->counter, 0, GFP_NOFS); + if (ret < 0) { + kfree(writers); + return ERR_PTR(ret); +@@ -3896,7 +3896,8 @@ void close_ctree(struct btrfs_fs_info *fs_info) + btrfs_err(fs_info, "commit super ret %d", ret); + } + +- if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state)) ++ if (test_bit(BTRFS_FS_STATE_ERROR, &fs_info->fs_state) || ++ test_bit(BTRFS_FS_STATE_TRANS_ABORTED, &fs_info->fs_state)) + btrfs_error_commit_super(fs_info); + + kthread_stop(fs_info->transaction_kthread); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index 1bc62294fe6b..53487102081d 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -4675,6 +4675,7 @@ static int do_chunk_alloc(struct btrfs_trans_handle *trans, + if (wait_for_alloc) { + mutex_unlock(&fs_info->chunk_mutex); + wait_for_alloc = 0; ++ cond_resched(); + goto again; + } + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index b0fa3a032143..8ecbac3b862e 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -6664,8 +6664,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry, + goto out_unlock_inode; + } else { + btrfs_update_inode(trans, root, inode); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + } + + out_unlock: +@@ -6742,8 +6741,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry, + goto out_unlock_inode; + + BTRFS_I(inode)->io_tree.ops = &btrfs_extent_io_ops; +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + out_unlock: + btrfs_end_transaction(trans); +@@ -6890,12 +6888,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + if (err) + goto out_fail_inode; + +- d_instantiate(dentry, inode); +- /* +- * mkdir is special. We're unlocking after we call d_instantiate +- * to avoid a race with nfsd calling d_instantiate. +- */ +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + drop_on_err = 0; + + out_fail: +@@ -10573,8 +10566,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry, + goto out_unlock_inode; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + out_unlock: + btrfs_end_transaction(trans); +diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c +index 2c35717a3470..baf5a4cd7ffc 100644 +--- a/fs/btrfs/send.c ++++ b/fs/btrfs/send.c +@@ -5008,6 +5008,9 @@ static int send_hole(struct send_ctx *sctx, u64 end) + u64 len; + int ret = 0; + ++ if (sctx->flags & BTRFS_SEND_FLAG_NO_FILE_DATA) ++ return send_update_extent(sctx, offset, end - offset); ++ + p = fs_path_alloc(); + if (!p) + return -ENOMEM; +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index e8f5e24325f3..8e3ce81d3f44 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -1581,7 +1581,7 @@ static struct dentry *btrfs_mount(struct file_system_type *fs_type, int flags, + * it for searching for existing supers, so this lets us do that and + * then open_ctree will properly initialize everything later. + */ +- fs_info = kzalloc(sizeof(struct btrfs_fs_info), GFP_KERNEL); ++ fs_info = kvzalloc(sizeof(struct btrfs_fs_info), GFP_KERNEL); + if (!fs_info) { + error = -ENOMEM; + goto error_sec_opts; +diff --git a/fs/btrfs/tests/qgroup-tests.c b/fs/btrfs/tests/qgroup-tests.c +index 0f4ce970d195..578fd045e859 100644 +--- a/fs/btrfs/tests/qgroup-tests.c ++++ b/fs/btrfs/tests/qgroup-tests.c +@@ -63,7 +63,7 @@ static int insert_normal_tree_ref(struct btrfs_root *root, u64 bytenr, + btrfs_set_extent_generation(leaf, item, 1); + btrfs_set_extent_flags(leaf, item, BTRFS_EXTENT_FLAG_TREE_BLOCK); + block_info = (struct btrfs_tree_block_info *)(item + 1); +- btrfs_set_tree_block_level(leaf, block_info, 1); ++ btrfs_set_tree_block_level(leaf, block_info, 0); + iref = (struct btrfs_extent_inline_ref *)(block_info + 1); + if (parent > 0) { + btrfs_set_extent_inline_ref_type(leaf, iref, +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index f615d59b0489..27638b96079d 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -319,7 +319,7 @@ static int record_root_in_trans(struct btrfs_trans_handle *trans, + if ((test_bit(BTRFS_ROOT_REF_COWS, &root->state) && + root->last_trans < trans->transid) || force) { + WARN_ON(root == fs_info->extent_root); +- WARN_ON(root->commit_root != root->node); ++ WARN_ON(!force && root->commit_root != root->node); + + /* + * see below for IN_TRANS_SETUP usage rules +@@ -1365,6 +1365,14 @@ static int qgroup_account_snapshot(struct btrfs_trans_handle *trans, + if (!test_bit(BTRFS_FS_QUOTA_ENABLED, &fs_info->flags)) + return 0; + ++ /* ++ * Ensure dirty @src will be commited. Or, after comming ++ * commit_fs_roots() and switch_commit_roots(), any dirty but not ++ * recorded root will never be updated again, causing an outdated root ++ * item. ++ */ ++ record_root_in_trans(trans, src, 1); ++ + /* + * We are going to commit transaction, see btrfs_commit_transaction() + * comment for reason locking tree_log_mutex +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index 2794f3550db6..fc4c14a72366 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -2272,8 +2272,10 @@ static noinline int replay_dir_deletes(struct btrfs_trans_handle *trans, + nritems = btrfs_header_nritems(path->nodes[0]); + if (path->slots[0] >= nritems) { + ret = btrfs_next_leaf(root, path); +- if (ret) ++ if (ret == 1) + break; ++ else if (ret < 0) ++ goto out; + } + btrfs_item_key_to_cpu(path->nodes[0], &found_key, + path->slots[0]); +@@ -2377,13 +2379,41 @@ static int replay_one_buffer(struct btrfs_root *log, struct extent_buffer *eb, + if (ret) + break; + +- /* for regular files, make sure corresponding +- * orphan item exist. extents past the new EOF +- * will be truncated later by orphan cleanup. ++ /* ++ * Before replaying extents, truncate the inode to its ++ * size. We need to do it now and not after log replay ++ * because before an fsync we can have prealloc extents ++ * added beyond the inode's i_size. If we did it after, ++ * through orphan cleanup for example, we would drop ++ * those prealloc extents just after replaying them. + */ + if (S_ISREG(mode)) { +- ret = insert_orphan_item(wc->trans, root, +- key.objectid); ++ struct inode *inode; ++ u64 from; ++ ++ inode = read_one_inode(root, key.objectid); ++ if (!inode) { ++ ret = -EIO; ++ break; ++ } ++ from = ALIGN(i_size_read(inode), ++ root->fs_info->sectorsize); ++ ret = btrfs_drop_extents(wc->trans, root, inode, ++ from, (u64)-1, 1); ++ /* ++ * If the nlink count is zero here, the iput ++ * will free the inode. We bump it to make ++ * sure it doesn't get freed until the link ++ * count fixup is done. ++ */ ++ if (!ret) { ++ if (inode->i_nlink == 0) ++ inc_nlink(inode); ++ /* Update link count and nbytes. */ ++ ret = btrfs_update_inode(wc->trans, ++ root, inode); ++ } ++ iput(inode); + if (ret) + break; + } +@@ -3432,8 +3462,11 @@ static noinline int log_dir_items(struct btrfs_trans_handle *trans, + * from this directory and from this transaction + */ + ret = btrfs_next_leaf(root, path); +- if (ret == 1) { +- last_offset = (u64)-1; ++ if (ret) { ++ if (ret == 1) ++ last_offset = (u64)-1; ++ else ++ err = ret; + goto done; + } + btrfs_item_key_to_cpu(path->nodes[0], &tmp, path->slots[0]); +@@ -3885,6 +3918,7 @@ static noinline int copy_items(struct btrfs_trans_handle *trans, + ASSERT(ret == 0); + src = src_path->nodes[0]; + i = 0; ++ need_find_last_extent = true; + } + + btrfs_item_key_to_cpu(src, &key, i); +@@ -4234,6 +4268,31 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + num++; + } + ++ /* ++ * Add all prealloc extents beyond the inode's i_size to make sure we ++ * don't lose them after doing a fast fsync and replaying the log. ++ */ ++ if (inode->flags & BTRFS_INODE_PREALLOC) { ++ struct rb_node *node; ++ ++ for (node = rb_last(&tree->map); node; node = rb_prev(node)) { ++ em = rb_entry(node, struct extent_map, rb_node); ++ if (em->start < i_size_read(&inode->vfs_inode)) ++ break; ++ if (!list_empty(&em->list)) ++ continue; ++ /* Same as above loop. */ ++ if (++num > 32768) { ++ list_del_init(&tree->modified_extents); ++ ret = -EFBIG; ++ goto process; ++ } ++ refcount_inc(&em->refs); ++ set_bit(EXTENT_FLAG_LOGGING, &em->flags); ++ list_add_tail(&em->list, &extents); ++ } ++ } ++ + list_sort(NULL, &extents, extent_cmp); + btrfs_get_logged_extents(inode, logged_list, logged_start, logged_end); + /* +@@ -5888,7 +5947,7 @@ int btrfs_log_new_name(struct btrfs_trans_handle *trans, + * this will force the logging code to walk the dentry chain + * up for the file + */ +- if (S_ISREG(inode->vfs_inode.i_mode)) ++ if (!S_ISDIR(inode->vfs_inode.i_mode)) + inode->last_unlink_trans = trans->transid; + + /* +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index e4082afedcb1..48ffe720bf09 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -224,6 +224,7 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + break; + case Opt_mds_namespace: ++ kfree(fsopt->mds_namespace); + fsopt->mds_namespace = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, + GFP_KERNEL); +@@ -231,6 +232,7 @@ static int parse_fsopt_token(char *c, void *private) + return -ENOMEM; + break; + case Opt_fscache_uniq: ++ kfree(fsopt->fscache_uniq); + fsopt->fscache_uniq = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, + GFP_KERNEL); +@@ -710,14 +712,17 @@ static int __init init_caches(void) + goto bad_dentry; + + ceph_file_cachep = KMEM_CACHE(ceph_file_info, SLAB_MEM_SPREAD); +- + if (!ceph_file_cachep) + goto bad_file; + +- if ((error = ceph_fscache_register())) +- goto bad_file; ++ error = ceph_fscache_register(); ++ if (error) ++ goto bad_fscache; + + return 0; ++ ++bad_fscache: ++ kmem_cache_destroy(ceph_file_cachep); + bad_file: + kmem_cache_destroy(ceph_dentry_cachep); + bad_dentry: +@@ -835,7 +840,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc) + int err; + unsigned long started = jiffies; /* note the start time */ + struct dentry *root; +- int first = 0; /* first vfsmount for this super_block */ + + dout("mount start %p\n", fsc); + mutex_lock(&fsc->client->mount_mutex); +@@ -860,17 +864,17 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc) + path = fsc->mount_options->server_path + 1; + dout("mount opening path %s\n", path); + } ++ ++ err = ceph_fs_debugfs_init(fsc); ++ if (err < 0) ++ goto out; ++ + root = open_root_dentry(fsc, path, started); + if (IS_ERR(root)) { + err = PTR_ERR(root); + goto out; + } + fsc->sb->s_root = dget(root); +- first = 1; +- +- err = ceph_fs_debugfs_init(fsc); +- if (err < 0) +- goto fail; + } else { + root = dget(fsc->sb->s_root); + } +@@ -880,11 +884,6 @@ static struct dentry *ceph_real_mount(struct ceph_fs_client *fsc) + mutex_unlock(&fsc->client->mount_mutex); + return root; + +-fail: +- if (first) { +- dput(fsc->sb->s_root); +- fsc->sb->s_root = NULL; +- } + out: + mutex_unlock(&fsc->client->mount_mutex); + return ERR_PTR(err); +diff --git a/fs/dcache.c b/fs/dcache.c +index c28b9c91b5cb..5f31a93150d1 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -1867,6 +1867,28 @@ void d_instantiate(struct dentry *entry, struct inode * inode) + } + EXPORT_SYMBOL(d_instantiate); + ++/* ++ * This should be equivalent to d_instantiate() + unlock_new_inode(), ++ * with lockdep-related part of unlock_new_inode() done before ++ * anything else. Use that instead of open-coding d_instantiate()/ ++ * unlock_new_inode() combinations. ++ */ ++void d_instantiate_new(struct dentry *entry, struct inode *inode) ++{ ++ BUG_ON(!hlist_unhashed(&entry->d_u.d_alias)); ++ BUG_ON(!inode); ++ lockdep_annotate_inode_mutex_key(inode); ++ security_d_instantiate(entry, inode); ++ spin_lock(&inode->i_lock); ++ __d_instantiate(entry, inode); ++ WARN_ON(!(inode->i_state & I_NEW)); ++ inode->i_state &= ~I_NEW; ++ smp_mb(); ++ wake_up_bit(&inode->i_state, __I_NEW); ++ spin_unlock(&inode->i_lock); ++} ++EXPORT_SYMBOL(d_instantiate_new); ++ + /** + * d_instantiate_no_diralias - instantiate a non-aliased dentry + * @entry: dentry to complete +@@ -2460,7 +2482,7 @@ struct dentry *d_alloc_parallel(struct dentry *parent, + + retry: + rcu_read_lock(); +- seq = smp_load_acquire(&parent->d_inode->i_dir_seq) & ~1; ++ seq = smp_load_acquire(&parent->d_inode->i_dir_seq); + r_seq = read_seqbegin(&rename_lock); + dentry = __d_lookup_rcu(parent, name, &d_seq); + if (unlikely(dentry)) { +@@ -2481,8 +2503,14 @@ struct dentry *d_alloc_parallel(struct dentry *parent, + rcu_read_unlock(); + goto retry; + } ++ ++ if (unlikely(seq & 1)) { ++ rcu_read_unlock(); ++ goto retry; ++ } ++ + hlist_bl_lock(b); +- if (unlikely(parent->d_inode->i_dir_seq != seq)) { ++ if (unlikely(READ_ONCE(parent->d_inode->i_dir_seq) != seq)) { + hlist_bl_unlock(b); + rcu_read_unlock(); + goto retry; +diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c +index efc2db42d175..bda65a730790 100644 +--- a/fs/ecryptfs/inode.c ++++ b/fs/ecryptfs/inode.c +@@ -284,8 +284,7 @@ ecryptfs_create(struct inode *directory_inode, struct dentry *ecryptfs_dentry, + iget_failed(ecryptfs_inode); + goto out; + } +- unlock_new_inode(ecryptfs_inode); +- d_instantiate(ecryptfs_dentry, ecryptfs_inode); ++ d_instantiate_new(ecryptfs_dentry, ecryptfs_inode); + out: + return rc; + } +diff --git a/fs/ext2/namei.c b/fs/ext2/namei.c +index e078075dc66f..aa6ec191cac0 100644 +--- a/fs/ext2/namei.c ++++ b/fs/ext2/namei.c +@@ -41,8 +41,7 @@ static inline int ext2_add_nondir(struct dentry *dentry, struct inode *inode) + { + int err = ext2_add_link(dentry, inode); + if (!err) { +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -269,8 +268,7 @@ static int ext2_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) + if (err) + goto out_fail; + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + out: + return err; + +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index fccf295fcb03..6747861f9b70 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -2420,8 +2420,7 @@ static int ext4_add_nondir(handle_t *handle, + int err = ext4_add_entry(handle, dentry, inode); + if (!err) { + ext4_mark_inode_dirty(handle, inode); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + drop_nlink(inode); +@@ -2660,8 +2659,7 @@ static int ext4_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + err = ext4_mark_inode_dirty(handle, dir); + if (err) + goto out_clear_inode; +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + if (IS_DIRSYNC(dir)) + ext4_handle_sync(handle); + +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 9102ae7709d3..ec74d06fa24a 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3663,6 +3663,12 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ext4_msg(sb, KERN_INFO, "mounting ext2 file system " + "using the ext4 subsystem"); + else { ++ /* ++ * If we're probing be silent, if this looks like ++ * it's actually an ext[34] filesystem. ++ */ ++ if (silent && ext4_feature_set_ok(sb, sb_rdonly(sb))) ++ goto failed_mount; + ext4_msg(sb, KERN_ERR, "couldn't mount as ext2 due " + "to feature incompatibilities"); + goto failed_mount; +@@ -3674,6 +3680,12 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ext4_msg(sb, KERN_INFO, "mounting ext3 file system " + "using the ext4 subsystem"); + else { ++ /* ++ * If we're probing be silent, if this looks like ++ * it's actually an ext4 filesystem. ++ */ ++ if (silent && ext4_feature_set_ok(sb, sb_rdonly(sb))) ++ goto failed_mount; + ext4_msg(sb, KERN_ERR, "couldn't mount as ext3 due " + "to feature incompatibilities"); + goto failed_mount; +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index 04fe1df052b2..c282e21f5b5e 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1108,6 +1108,8 @@ static void update_ckpt_flags(struct f2fs_sb_info *sbi, struct cp_control *cpc) + + if (cpc->reason & CP_TRIMMED) + __set_ckpt_flags(ckpt, CP_TRIMMED_FLAG); ++ else ++ __clear_ckpt_flags(ckpt, CP_TRIMMED_FLAG); + + if (cpc->reason & CP_UMOUNT) + __set_ckpt_flags(ckpt, CP_UMOUNT_FLAG); +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index ff2352a0ed15..aff6c2ed1c02 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -706,6 +706,9 @@ void f2fs_drop_extent_tree(struct inode *inode) + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et = F2FS_I(inode)->extent_tree; + ++ if (!f2fs_may_extent_tree(inode)) ++ return; ++ + set_inode_flag(inode, FI_NO_EXTENT); + + write_lock(&et->lock); +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index b8372095ba0a..29c5f799890c 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1321,8 +1321,12 @@ static int f2fs_zero_range(struct inode *inode, loff_t offset, loff_t len, + } + + out: +- if (!(mode & FALLOC_FL_KEEP_SIZE) && i_size_read(inode) < new_size) +- f2fs_i_size_write(inode, new_size); ++ if (new_size > i_size_read(inode)) { ++ if (mode & FALLOC_FL_KEEP_SIZE) ++ file_set_keep_isize(inode); ++ else ++ f2fs_i_size_write(inode, new_size); ++ } + out_sem: + up_write(&F2FS_I(inode)->i_mmap_sem); + +diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c +index a4dab98c4b7b..b80e7db3b55b 100644 +--- a/fs/f2fs/namei.c ++++ b/fs/f2fs/namei.c +@@ -201,8 +201,7 @@ static int f2fs_create(struct inode *dir, struct dentry *dentry, umode_t mode, + + alloc_nid_done(sbi, ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); +@@ -529,8 +528,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry, + err = page_symlink(inode, disk_link.name, disk_link.len); + + err_out: +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + + /* + * Let's flush symlink data in order to avoid broken symlink as much as +@@ -588,8 +586,7 @@ static int f2fs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + + alloc_nid_done(sbi, inode->i_ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); +@@ -637,8 +634,7 @@ static int f2fs_mknod(struct inode *dir, struct dentry *dentry, + + alloc_nid_done(sbi, inode->i_ino); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + + if (IS_DIRSYNC(dir)) + f2fs_sync_fs(sbi->sb, 1); +diff --git a/fs/fscache/page.c b/fs/fscache/page.c +index 0ad3fd3ad0b4..ae9470f3643c 100644 +--- a/fs/fscache/page.c ++++ b/fs/fscache/page.c +@@ -776,6 +776,7 @@ static void fscache_write_op(struct fscache_operation *_op) + + _enter("{OP%x,%d}", op->op.debug_id, atomic_read(&op->op.usage)); + ++again: + spin_lock(&object->lock); + cookie = object->cookie; + +@@ -816,10 +817,6 @@ static void fscache_write_op(struct fscache_operation *_op) + goto superseded; + page = results[0]; + _debug("gang %d [%lx]", n, page->index); +- if (page->index >= op->store_limit) { +- fscache_stat(&fscache_n_store_pages_over_limit); +- goto superseded; +- } + + radix_tree_tag_set(&cookie->stores, page->index, + FSCACHE_COOKIE_STORING_TAG); +@@ -829,6 +826,9 @@ static void fscache_write_op(struct fscache_operation *_op) + spin_unlock(&cookie->stores_lock); + spin_unlock(&object->lock); + ++ if (page->index >= op->store_limit) ++ goto discard_page; ++ + fscache_stat(&fscache_n_store_pages); + fscache_stat(&fscache_n_cop_write_page); + ret = object->cache->ops->write_page(op, page); +@@ -844,6 +844,11 @@ static void fscache_write_op(struct fscache_operation *_op) + _leave(""); + return; + ++discard_page: ++ fscache_stat(&fscache_n_store_pages_over_limit); ++ fscache_end_page_write(object, page); ++ goto again; ++ + superseded: + /* this writer is going away and there aren't any more things to + * write */ +diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c +index 2a29cf3371f6..10f0fac031f4 100644 +--- a/fs/gfs2/file.c ++++ b/fs/gfs2/file.c +@@ -803,7 +803,7 @@ static long __gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t + struct gfs2_inode *ip = GFS2_I(inode); + struct gfs2_alloc_parms ap = { .aflags = 0, }; + unsigned int data_blocks = 0, ind_blocks = 0, rblocks; +- loff_t bytes, max_bytes, max_blks = UINT_MAX; ++ loff_t bytes, max_bytes, max_blks; + int error; + const loff_t pos = offset; + const loff_t count = len; +@@ -855,7 +855,8 @@ static long __gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t + return error; + /* ap.allowed tells us how many blocks quota will allow + * us to write. Check if this reduces max_blks */ +- if (ap.allowed && ap.allowed < max_blks) ++ max_blks = UINT_MAX; ++ if (ap.allowed) + max_blks = ap.allowed; + + error = gfs2_inplace_reserve(ip, &ap); +diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h +index 5e47c935a515..836f29480be6 100644 +--- a/fs/gfs2/quota.h ++++ b/fs/gfs2/quota.h +@@ -45,6 +45,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip, + { + struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); + int ret; ++ ++ ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */ + if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF) + return 0; + ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE); +diff --git a/fs/jffs2/dir.c b/fs/jffs2/dir.c +index 0a754f38462e..e5a6deb38e1e 100644 +--- a/fs/jffs2/dir.c ++++ b/fs/jffs2/dir.c +@@ -209,8 +209,7 @@ static int jffs2_create(struct inode *dir_i, struct dentry *dentry, + __func__, inode->i_ino, inode->i_mode, inode->i_nlink, + f->inocache->pino_nlink, inode->i_mapping->nrpages); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -430,8 +429,7 @@ static int jffs2_symlink (struct inode *dir_i, struct dentry *dentry, const char + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -575,8 +573,7 @@ static int jffs2_mkdir (struct inode *dir_i, struct dentry *dentry, umode_t mode + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +@@ -747,8 +744,7 @@ static int jffs2_mknod (struct inode *dir_i, struct dentry *dentry, umode_t mode + mutex_unlock(&dir_f->sem); + jffs2_complete_reservation(c); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + fail: +diff --git a/fs/jfs/namei.c b/fs/jfs/namei.c +index b41596d71858..56c3fcbfe80e 100644 +--- a/fs/jfs/namei.c ++++ b/fs/jfs/namei.c +@@ -178,8 +178,7 @@ static int jfs_create(struct inode *dip, struct dentry *dentry, umode_t mode, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -313,8 +312,7 @@ static int jfs_mkdir(struct inode *dip, struct dentry *dentry, umode_t mode) + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -1059,8 +1057,7 @@ static int jfs_symlink(struct inode *dip, struct dentry *dentry, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out2: +@@ -1447,8 +1444,7 @@ static int jfs_mknod(struct inode *dir, struct dentry *dentry, + unlock_new_inode(ip); + iput(ip); + } else { +- unlock_new_inode(ip); +- d_instantiate(dentry, ip); ++ d_instantiate_new(dentry, ip); + } + + out1: +diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c +index e9bea90dc017..fb85d04fdc4c 100644 +--- a/fs/nfs/nfs4client.c ++++ b/fs/nfs/nfs4client.c +@@ -858,8 +858,10 @@ static int nfs4_set_client(struct nfs_server *server, + if (IS_ERR(clp)) + return PTR_ERR(clp); + +- if (server->nfs_client == clp) ++ if (server->nfs_client == clp) { ++ nfs_put_client(clp); + return -ELOOP; ++ } + + /* + * Query for the lease time on clientid setup or renewal +@@ -1217,11 +1219,11 @@ int nfs4_update_server(struct nfs_server *server, const char *hostname, + clp->cl_proto, clnt->cl_timeout, + clp->cl_minorversion, net); + clear_bit(NFS_MIG_TSM_POSSIBLE, &server->mig_status); +- nfs_put_client(clp); + if (error != 0) { + nfs_server_insert_lists(server); + return error; + } ++ nfs_put_client(clp); + + if (server->nfs_client->cl_hostname == NULL) + server->nfs_client->cl_hostname = kstrdup(hostname, GFP_KERNEL); +diff --git a/fs/nilfs2/namei.c b/fs/nilfs2/namei.c +index 515d13c196da..1ba4719de70d 100644 +--- a/fs/nilfs2/namei.c ++++ b/fs/nilfs2/namei.c +@@ -46,8 +46,7 @@ static inline int nilfs_add_nondir(struct dentry *dentry, struct inode *inode) + int err = nilfs_add_link(dentry, inode); + + if (!err) { +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -243,8 +242,7 @@ static int nilfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + goto out_fail; + + nilfs_mark_inode_dirty(inode); +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + out: + if (!err) + err = nilfs_transaction_commit(dir->i_sb); +diff --git a/fs/ocfs2/dlm/dlmdomain.c b/fs/ocfs2/dlm/dlmdomain.c +index a2b19fbdcf46..6099a8034b17 100644 +--- a/fs/ocfs2/dlm/dlmdomain.c ++++ b/fs/ocfs2/dlm/dlmdomain.c +@@ -676,20 +676,6 @@ static void dlm_leave_domain(struct dlm_ctxt *dlm) + spin_unlock(&dlm->spinlock); + } + +-int dlm_shutting_down(struct dlm_ctxt *dlm) +-{ +- int ret = 0; +- +- spin_lock(&dlm_domain_lock); +- +- if (dlm->dlm_state == DLM_CTXT_IN_SHUTDOWN) +- ret = 1; +- +- spin_unlock(&dlm_domain_lock); +- +- return ret; +-} +- + void dlm_unregister_domain(struct dlm_ctxt *dlm) + { + int leave = 0; +diff --git a/fs/ocfs2/dlm/dlmdomain.h b/fs/ocfs2/dlm/dlmdomain.h +index fd6122a38dbd..8a9281411c18 100644 +--- a/fs/ocfs2/dlm/dlmdomain.h ++++ b/fs/ocfs2/dlm/dlmdomain.h +@@ -28,7 +28,30 @@ + extern spinlock_t dlm_domain_lock; + extern struct list_head dlm_domains; + +-int dlm_shutting_down(struct dlm_ctxt *dlm); ++static inline int dlm_joined(struct dlm_ctxt *dlm) ++{ ++ int ret = 0; ++ ++ spin_lock(&dlm_domain_lock); ++ if (dlm->dlm_state == DLM_CTXT_JOINED) ++ ret = 1; ++ spin_unlock(&dlm_domain_lock); ++ ++ return ret; ++} ++ ++static inline int dlm_shutting_down(struct dlm_ctxt *dlm) ++{ ++ int ret = 0; ++ ++ spin_lock(&dlm_domain_lock); ++ if (dlm->dlm_state == DLM_CTXT_IN_SHUTDOWN) ++ ret = 1; ++ spin_unlock(&dlm_domain_lock); ++ ++ return ret; ++} ++ + void dlm_fire_domain_eviction_callbacks(struct dlm_ctxt *dlm, + int node_num); + +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index ec8f75813beb..505ab4281f36 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -1378,6 +1378,15 @@ int dlm_mig_lockres_handler(struct o2net_msg *msg, u32 len, void *data, + if (!dlm_grab(dlm)) + return -EINVAL; + ++ if (!dlm_joined(dlm)) { ++ mlog(ML_ERROR, "Domain %s not joined! " ++ "lockres %.*s, master %u\n", ++ dlm->name, mres->lockname_len, ++ mres->lockname, mres->master); ++ dlm_put(dlm); ++ return -EINVAL; ++ } ++ + BUG_ON(!(mres->flags & (DLM_MRES_RECOVERY|DLM_MRES_MIGRATION))); + + real_master = mres->master; +diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c +index 7e9e5d0ea3bc..f8f3c73d2664 100644 +--- a/fs/orangefs/namei.c ++++ b/fs/orangefs/namei.c +@@ -71,8 +71,7 @@ static int orangefs_create(struct inode *dir, + get_khandle_from_ino(inode), + dentry); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + orangefs_set_timeout(dentry); + ORANGEFS_I(inode)->getattr_time = jiffies - 1; + ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS; +@@ -320,8 +319,7 @@ static int orangefs_symlink(struct inode *dir, + "Assigned symlink inode new number of %pU\n", + get_khandle_from_ino(inode)); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + orangefs_set_timeout(dentry); + ORANGEFS_I(inode)->getattr_time = jiffies - 1; + ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS; +@@ -385,8 +383,7 @@ static int orangefs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode + "Assigned dir inode new number of %pU\n", + get_khandle_from_ino(inode)); + +- d_instantiate(dentry, inode); +- unlock_new_inode(inode); ++ d_instantiate_new(dentry, inode); + orangefs_set_timeout(dentry); + ORANGEFS_I(inode)->getattr_time = jiffies - 1; + ORANGEFS_I(inode)->getattr_mask = STATX_BASIC_STATS; +diff --git a/fs/proc/proc_sysctl.c b/fs/proc/proc_sysctl.c +index c5cbbdff3c3d..82ac5f682b73 100644 +--- a/fs/proc/proc_sysctl.c ++++ b/fs/proc/proc_sysctl.c +@@ -707,7 +707,10 @@ static bool proc_sys_link_fill_cache(struct file *file, + struct ctl_table *table) + { + bool ret = true; ++ + head = sysctl_head_grab(head); ++ if (IS_ERR(head)) ++ return false; + + if (S_ISLNK(table->mode)) { + /* It is not an error if we can not follow the link ignore it */ +diff --git a/fs/reiserfs/namei.c b/fs/reiserfs/namei.c +index bd39a998843d..5089dac02660 100644 +--- a/fs/reiserfs/namei.c ++++ b/fs/reiserfs/namei.c +@@ -687,8 +687,7 @@ static int reiserfs_create(struct inode *dir, struct dentry *dentry, umode_t mod + reiserfs_update_inode_transaction(inode); + reiserfs_update_inode_transaction(dir); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + + out_failed: +@@ -771,8 +770,7 @@ static int reiserfs_mknod(struct inode *dir, struct dentry *dentry, umode_t mode + goto out_failed; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + + out_failed: +@@ -871,8 +869,7 @@ static int reiserfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode + /* the above add_entry did not update dir's stat data */ + reiserfs_update_sd(&th, dir); + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + out_failed: + reiserfs_write_unlock(dir->i_sb); +@@ -1187,8 +1184,7 @@ static int reiserfs_symlink(struct inode *parent_dir, + goto out_failed; + } + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + retval = journal_end(&th); + out_failed: + reiserfs_write_unlock(parent_dir->i_sb); +diff --git a/fs/super.c b/fs/super.c +index 79d7fc5e0ddd..219f7ca7c5d2 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -120,13 +120,23 @@ static unsigned long super_cache_count(struct shrinker *shrink, + sb = container_of(shrink, struct super_block, s_shrink); + + /* +- * Don't call trylock_super as it is a potential +- * scalability bottleneck. The counts could get updated +- * between super_cache_count and super_cache_scan anyway. +- * Call to super_cache_count with shrinker_rwsem held +- * ensures the safety of call to list_lru_shrink_count() and +- * s_op->nr_cached_objects(). ++ * We don't call trylock_super() here as it is a scalability bottleneck, ++ * so we're exposed to partial setup state. The shrinker rwsem does not ++ * protect filesystem operations backing list_lru_shrink_count() or ++ * s_op->nr_cached_objects(). Counts can change between ++ * super_cache_count and super_cache_scan, so we really don't need locks ++ * here. ++ * ++ * However, if we are currently mounting the superblock, the underlying ++ * filesystem might be in a state of partial construction and hence it ++ * is dangerous to access it. trylock_super() uses a SB_BORN check to ++ * avoid this situation, so do the same here. The memory barrier is ++ * matched with the one in mount_fs() as we don't hold locks here. + */ ++ if (!(sb->s_flags & SB_BORN)) ++ return 0; ++ smp_rmb(); ++ + if (sb->s_op && sb->s_op->nr_cached_objects) + total_objects = sb->s_op->nr_cached_objects(sb, sc); + +@@ -1232,6 +1242,14 @@ mount_fs(struct file_system_type *type, int flags, const char *name, void *data) + sb = root->d_sb; + BUG_ON(!sb); + WARN_ON(!sb->s_bdi); ++ ++ /* ++ * Write barrier is for super_cache_count(). We place it before setting ++ * SB_BORN as the data dependency between the two functions is the ++ * superblock structure contents that we just set up, not the SB_BORN ++ * flag. ++ */ ++ smp_wmb(); + sb->s_flags |= SB_BORN; + + error = security_sb_kern_mount(sb, flags, secdata); +diff --git a/fs/udf/namei.c b/fs/udf/namei.c +index 885198dfd9f8..041bf34f781f 100644 +--- a/fs/udf/namei.c ++++ b/fs/udf/namei.c +@@ -621,8 +621,7 @@ static int udf_add_nondir(struct dentry *dentry, struct inode *inode) + if (fibh.sbh != fibh.ebh) + brelse(fibh.ebh); + brelse(fibh.sbh); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + + return 0; + } +@@ -732,8 +731,7 @@ static int udf_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode) + inc_nlink(dir); + dir->i_ctime = dir->i_mtime = current_time(dir); + mark_inode_dirty(dir); +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + if (fibh.sbh != fibh.ebh) + brelse(fibh.ebh); + brelse(fibh.sbh); +diff --git a/fs/udf/super.c b/fs/udf/super.c +index 08bf097507f6..9b0d6562d0a1 100644 +--- a/fs/udf/super.c ++++ b/fs/udf/super.c +@@ -2091,8 +2091,9 @@ static int udf_fill_super(struct super_block *sb, void *options, int silent) + bool lvid_open = false; + + uopt.flags = (1 << UDF_FLAG_USE_AD_IN_ICB) | (1 << UDF_FLAG_STRICT); +- uopt.uid = INVALID_UID; +- uopt.gid = INVALID_GID; ++ /* By default we'll use overflow[ug]id when UDF inode [ug]id == -1 */ ++ uopt.uid = make_kuid(current_user_ns(), overflowuid); ++ uopt.gid = make_kgid(current_user_ns(), overflowgid); + uopt.umask = 0; + uopt.fmode = UDF_INVALID_MODE; + uopt.dmode = UDF_INVALID_MODE; +diff --git a/fs/ufs/namei.c b/fs/ufs/namei.c +index 32545cd00ceb..d5f43ba76c59 100644 +--- a/fs/ufs/namei.c ++++ b/fs/ufs/namei.c +@@ -39,8 +39,7 @@ static inline int ufs_add_nondir(struct dentry *dentry, struct inode *inode) + { + int err = ufs_add_link(dentry, inode); + if (!err) { +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + } + inode_dec_link_count(inode); +@@ -193,8 +192,7 @@ static int ufs_mkdir(struct inode * dir, struct dentry * dentry, umode_t mode) + if (err) + goto out_fail; + +- unlock_new_inode(inode); +- d_instantiate(dentry, inode); ++ d_instantiate_new(dentry, inode); + return 0; + + out_fail: +diff --git a/fs/xfs/xfs_discard.c b/fs/xfs/xfs_discard.c +index b2cde5426182..7b68e6c9a474 100644 +--- a/fs/xfs/xfs_discard.c ++++ b/fs/xfs/xfs_discard.c +@@ -50,19 +50,19 @@ xfs_trim_extents( + + pag = xfs_perag_get(mp, agno); + +- error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp); +- if (error || !agbp) +- goto out_put_perag; +- +- cur = xfs_allocbt_init_cursor(mp, NULL, agbp, agno, XFS_BTNUM_CNT); +- + /* + * Force out the log. This means any transactions that might have freed +- * space before we took the AGF buffer lock are now on disk, and the ++ * space before we take the AGF buffer lock are now on disk, and the + * volatile disk cache is flushed. + */ + xfs_log_force(mp, XFS_LOG_SYNC); + ++ error = xfs_alloc_read_agf(mp, NULL, agno, 0, &agbp); ++ if (error || !agbp) ++ goto out_put_perag; ++ ++ cur = xfs_allocbt_init_cursor(mp, NULL, agbp, agno, XFS_BTNUM_CNT); ++ + /* + * Look up the longest btree in the AGF and start with it. + */ +diff --git a/include/asm-generic/bug.h b/include/asm-generic/bug.h +index af2cc94a61bf..ae1a33aa8955 100644 +--- a/include/asm-generic/bug.h ++++ b/include/asm-generic/bug.h +@@ -50,6 +50,7 @@ struct bug_entry { + #ifndef HAVE_ARCH_BUG + #define BUG() do { \ + printk("BUG: failure at %s:%d/%s()!\n", __FILE__, __LINE__, __func__); \ ++ barrier_before_unreachable(); \ + panic("BUG!"); \ + } while (0) + #endif +diff --git a/include/linux/bio.h b/include/linux/bio.h +index 45f00dd6323c..5aa40f4712ff 100644 +--- a/include/linux/bio.h ++++ b/include/linux/bio.h +@@ -501,6 +501,7 @@ void zero_fill_bio(struct bio *bio); + extern struct bio_vec *bvec_alloc(gfp_t, int, unsigned long *, mempool_t *); + extern void bvec_free(mempool_t *, struct bio_vec *, unsigned int); + extern unsigned int bvec_nr_vecs(unsigned short idx); ++extern const char *bio_devname(struct bio *bio, char *buffer); + + #define bio_set_dev(bio, bdev) \ + do { \ +@@ -519,9 +520,6 @@ do { \ + #define bio_dev(bio) \ + disk_devt((bio)->bi_disk) + +-#define bio_devname(bio, buf) \ +- __bdevname(bio_dev(bio), (buf)) +- + #ifdef CONFIG_BLK_CGROUP + int bio_associate_blkcg(struct bio *bio, struct cgroup_subsys_state *blkcg_css); + int bio_associate_current(struct bio *bio); +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index b78b31af36f8..f43113b8890b 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -211,6 +211,15 @@ + #endif + #endif + ++/* ++ * calling noreturn functions, __builtin_unreachable() and __builtin_trap() ++ * confuse the stack allocation in gcc, leading to overly large stack ++ * frames, see https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82365 ++ * ++ * Adding an empty inline assembly before it works around the problem ++ */ ++#define barrier_before_unreachable() asm volatile("") ++ + /* + * Mark a position in code as unreachable. This can be used to + * suppress control flow warnings after asm blocks that transfer +@@ -221,7 +230,11 @@ + * unreleased. Really, we need to have autoconf for the kernel. + */ + #define unreachable() \ +- do { annotate_unreachable(); __builtin_unreachable(); } while (0) ++ do { \ ++ annotate_unreachable(); \ ++ barrier_before_unreachable(); \ ++ __builtin_unreachable(); \ ++ } while (0) + + /* Mark a function definition as prohibited from being cloned. */ + #define __noclone __attribute__((__noclone__, __optimize__("no-tracer"))) +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index e8c9cd18bb05..853929f98962 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -86,6 +86,11 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, + # define barrier_data(ptr) barrier() + #endif + ++/* workaround for GCC PR82365 if needed */ ++#ifndef barrier_before_unreachable ++# define barrier_before_unreachable() do { } while (0) ++#endif ++ + /* Unreachable code */ + #ifdef CONFIG_STACK_VALIDATION + #define annotate_reachable() ({ \ +diff --git a/include/linux/dcache.h b/include/linux/dcache.h +index f05a659cdf34..006f4ccda5f5 100644 +--- a/include/linux/dcache.h ++++ b/include/linux/dcache.h +@@ -226,6 +226,7 @@ extern seqlock_t rename_lock; + * These are the low-level FS interfaces to the dcache.. + */ + extern void d_instantiate(struct dentry *, struct inode *); ++extern void d_instantiate_new(struct dentry *, struct inode *); + extern struct dentry * d_instantiate_unique(struct dentry *, struct inode *); + extern int d_instantiate_no_diralias(struct dentry *, struct inode *); + extern void __d_drop(struct dentry *dentry); +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index ab927383c99d..87b8c20d5b27 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -300,32 +300,47 @@ static inline bool vlan_hw_offload_capable(netdev_features_t features, + } + + /** +- * __vlan_insert_tag - regular VLAN tag inserting ++ * __vlan_insert_inner_tag - inner VLAN tag inserting + * @skb: skbuff to tag + * @vlan_proto: VLAN encapsulation protocol + * @vlan_tci: VLAN TCI to insert ++ * @mac_len: MAC header length including outer vlan headers + * +- * Inserts the VLAN tag into @skb as part of the payload ++ * Inserts the VLAN tag into @skb as part of the payload at offset mac_len + * Returns error if skb_cow_head failes. + * + * Does not change skb->protocol so this function can be used during receive. + */ +-static inline int __vlan_insert_tag(struct sk_buff *skb, +- __be16 vlan_proto, u16 vlan_tci) ++static inline int __vlan_insert_inner_tag(struct sk_buff *skb, ++ __be16 vlan_proto, u16 vlan_tci, ++ unsigned int mac_len) + { + struct vlan_ethhdr *veth; + + if (skb_cow_head(skb, VLAN_HLEN) < 0) + return -ENOMEM; + +- veth = skb_push(skb, VLAN_HLEN); ++ skb_push(skb, VLAN_HLEN); + +- /* Move the mac addresses to the beginning of the new header. */ +- memmove(skb->data, skb->data + VLAN_HLEN, 2 * ETH_ALEN); ++ /* Move the mac header sans proto to the beginning of the new header. */ ++ if (likely(mac_len > ETH_TLEN)) ++ memmove(skb->data, skb->data + VLAN_HLEN, mac_len - ETH_TLEN); + skb->mac_header -= VLAN_HLEN; + ++ veth = (struct vlan_ethhdr *)(skb->data + mac_len - ETH_HLEN); ++ + /* first, the ethernet type */ +- veth->h_vlan_proto = vlan_proto; ++ if (likely(mac_len >= ETH_TLEN)) { ++ /* h_vlan_encapsulated_proto should already be populated, and ++ * skb->data has space for h_vlan_proto ++ */ ++ veth->h_vlan_proto = vlan_proto; ++ } else { ++ /* h_vlan_encapsulated_proto should not be populated, and ++ * skb->data has no space for h_vlan_proto ++ */ ++ veth->h_vlan_encapsulated_proto = skb->protocol; ++ } + + /* now, the TCI */ + veth->h_vlan_TCI = htons(vlan_tci); +@@ -334,12 +349,30 @@ static inline int __vlan_insert_tag(struct sk_buff *skb, + } + + /** +- * vlan_insert_tag - regular VLAN tag inserting ++ * __vlan_insert_tag - regular VLAN tag inserting + * @skb: skbuff to tag + * @vlan_proto: VLAN encapsulation protocol + * @vlan_tci: VLAN TCI to insert + * + * Inserts the VLAN tag into @skb as part of the payload ++ * Returns error if skb_cow_head failes. ++ * ++ * Does not change skb->protocol so this function can be used during receive. ++ */ ++static inline int __vlan_insert_tag(struct sk_buff *skb, ++ __be16 vlan_proto, u16 vlan_tci) ++{ ++ return __vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, ETH_HLEN); ++} ++ ++/** ++ * vlan_insert_inner_tag - inner VLAN tag inserting ++ * @skb: skbuff to tag ++ * @vlan_proto: VLAN encapsulation protocol ++ * @vlan_tci: VLAN TCI to insert ++ * @mac_len: MAC header length including outer vlan headers ++ * ++ * Inserts the VLAN tag into @skb as part of the payload at offset mac_len + * Returns a VLAN tagged skb. If a new skb is created, @skb is freed. + * + * Following the skb_unshare() example, in case of error, the calling function +@@ -347,12 +380,14 @@ static inline int __vlan_insert_tag(struct sk_buff *skb, + * + * Does not change skb->protocol so this function can be used during receive. + */ +-static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, +- __be16 vlan_proto, u16 vlan_tci) ++static inline struct sk_buff *vlan_insert_inner_tag(struct sk_buff *skb, ++ __be16 vlan_proto, ++ u16 vlan_tci, ++ unsigned int mac_len) + { + int err; + +- err = __vlan_insert_tag(skb, vlan_proto, vlan_tci); ++ err = __vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, mac_len); + if (err) { + dev_kfree_skb_any(skb); + return NULL; +@@ -360,6 +395,26 @@ static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, + return skb; + } + ++/** ++ * vlan_insert_tag - regular VLAN tag inserting ++ * @skb: skbuff to tag ++ * @vlan_proto: VLAN encapsulation protocol ++ * @vlan_tci: VLAN TCI to insert ++ * ++ * Inserts the VLAN tag into @skb as part of the payload ++ * Returns a VLAN tagged skb. If a new skb is created, @skb is freed. ++ * ++ * Following the skb_unshare() example, in case of error, the calling function ++ * doesn't have to worry about freeing the original skb. ++ * ++ * Does not change skb->protocol so this function can be used during receive. ++ */ ++static inline struct sk_buff *vlan_insert_tag(struct sk_buff *skb, ++ __be16 vlan_proto, u16 vlan_tci) ++{ ++ return vlan_insert_inner_tag(skb, vlan_proto, vlan_tci, ETH_HLEN); ++} ++ + /** + * vlan_insert_tag_set_proto - regular VLAN tag inserting + * @skb: skbuff to tag +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 5a8019befafd..39f0489eb137 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -1104,7 +1104,6 @@ static inline void kvm_irq_routing_update(struct kvm *kvm) + { + } + #endif +-void kvm_arch_irq_routing_update(struct kvm *kvm); + + static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args) + { +@@ -1113,6 +1112,8 @@ static inline int kvm_ioeventfd(struct kvm *kvm, struct kvm_ioeventfd *args) + + #endif /* CONFIG_HAVE_KVM_EVENTFD */ + ++void kvm_arch_irq_routing_update(struct kvm *kvm); ++ + static inline void kvm_make_request(int req, struct kvm_vcpu *vcpu) + { + /* +diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h +index 35d125569e68..e8b12b79a0de 100644 +--- a/include/linux/ptr_ring.h ++++ b/include/linux/ptr_ring.h +@@ -450,7 +450,7 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r, + */ + static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp) + { +- if (size * sizeof(void *) > KMALLOC_MAX_SIZE) ++ if (size > KMALLOC_MAX_SIZE / sizeof(void *)) + return NULL; + return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO); + } +diff --git a/include/net/ip.h b/include/net/ip.h +index af8addbaa3c1..81da1123fc8e 100644 +--- a/include/net/ip.h ++++ b/include/net/ip.h +@@ -326,6 +326,13 @@ int ip_decrease_ttl(struct iphdr *iph) + return --iph->ttl; + } + ++static inline int ip_mtu_locked(const struct dst_entry *dst) ++{ ++ const struct rtable *rt = (const struct rtable *)dst; ++ ++ return rt->rt_mtu_locked || dst_metric_locked(dst, RTAX_MTU); ++} ++ + static inline + int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst) + { +@@ -333,7 +340,7 @@ int ip_dont_fragment(const struct sock *sk, const struct dst_entry *dst) + + return pmtudisc == IP_PMTUDISC_DO || + (pmtudisc == IP_PMTUDISC_WANT && +- !(dst_metric_locked(dst, RTAX_MTU))); ++ !ip_mtu_locked(dst)); + } + + static inline bool ip_sk_accept_pmtu(const struct sock *sk) +@@ -359,7 +366,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, + struct net *net = dev_net(dst->dev); + + if (net->ipv4.sysctl_ip_fwd_use_pmtu || +- dst_metric_locked(dst, RTAX_MTU) || ++ ip_mtu_locked(dst) || + !forwarding) + return dst_mtu(dst); + +diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h +index 1a7f7e424320..5c5d344c0629 100644 +--- a/include/net/ip_fib.h ++++ b/include/net/ip_fib.h +@@ -59,6 +59,7 @@ struct fib_nh_exception { + int fnhe_genid; + __be32 fnhe_daddr; + u32 fnhe_pmtu; ++ bool fnhe_mtu_locked; + __be32 fnhe_gw; + unsigned long fnhe_expires; + struct rtable __rcu *fnhe_rth_input; +diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h +index ea985aa7a6c5..df528a623548 100644 +--- a/include/net/llc_conn.h ++++ b/include/net/llc_conn.h +@@ -104,7 +104,7 @@ void llc_sk_reset(struct sock *sk); + + /* Access to a connection */ + int llc_conn_state_process(struct sock *sk, struct sk_buff *skb); +-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); ++int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb); + void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb); + void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit); + void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit); +diff --git a/include/net/mac80211.h b/include/net/mac80211.h +index 4f1d2dec43ce..87b62bae20af 100644 +--- a/include/net/mac80211.h ++++ b/include/net/mac80211.h +@@ -4141,7 +4141,7 @@ void ieee80211_sta_uapsd_trigger(struct ieee80211_sta *sta, u8 tid); + * The TX headroom reserved by mac80211 for its own tx_status functions. + * This is enough for the radiotap header. + */ +-#define IEEE80211_TX_STATUS_HEADROOM 14 ++#define IEEE80211_TX_STATUS_HEADROOM ALIGN(14, 4) + + /** + * ieee80211_sta_set_buffered - inform mac80211 about driver-buffered frames +diff --git a/include/net/regulatory.h b/include/net/regulatory.h +index ebc5a2ed8631..f83cacce3308 100644 +--- a/include/net/regulatory.h ++++ b/include/net/regulatory.h +@@ -78,7 +78,7 @@ struct regulatory_request { + int wiphy_idx; + enum nl80211_reg_initiator initiator; + enum nl80211_user_reg_hint_type user_reg_hint_type; +- char alpha2[2]; ++ char alpha2[3]; + enum nl80211_dfs_regions dfs_region; + bool intersect; + bool processed; +diff --git a/include/net/route.h b/include/net/route.h +index d538e6db1afe..6077a0fb3044 100644 +--- a/include/net/route.h ++++ b/include/net/route.h +@@ -63,7 +63,8 @@ struct rtable { + __be32 rt_gateway; + + /* Miscellaneous cached information */ +- u32 rt_pmtu; ++ u32 rt_mtu_locked:1, ++ rt_pmtu:31; + + u32 rt_table_id; + +diff --git a/include/rdma/ib_umem.h b/include/rdma/ib_umem.h +index 23159dd5be18..a1fd63871d17 100644 +--- a/include/rdma/ib_umem.h ++++ b/include/rdma/ib_umem.h +@@ -48,7 +48,6 @@ struct ib_umem { + int writable; + int hugetlb; + struct work_struct work; +- struct pid *pid; + struct mm_struct *mm; + unsigned long diff; + struct ib_umem_odp *odp_data; +diff --git a/include/soc/arc/mcip.h b/include/soc/arc/mcip.h +index c2d1b15da136..a91f25151a5b 100644 +--- a/include/soc/arc/mcip.h ++++ b/include/soc/arc/mcip.h +@@ -15,6 +15,7 @@ + + #define ARC_REG_MCIP_BCR 0x0d0 + #define ARC_REG_MCIP_IDU_BCR 0x0D5 ++#define ARC_REG_GFRC_BUILD 0x0D6 + #define ARC_REG_MCIP_CMD 0x600 + #define ARC_REG_MCIP_WDATA 0x601 + #define ARC_REG_MCIP_READBACK 0x602 +@@ -36,10 +37,14 @@ struct mcip_cmd { + #define CMD_SEMA_RELEASE 0x12 + + #define CMD_DEBUG_SET_MASK 0x34 ++#define CMD_DEBUG_READ_MASK 0x35 + #define CMD_DEBUG_SET_SELECT 0x36 ++#define CMD_DEBUG_READ_SELECT 0x37 + + #define CMD_GFRC_READ_LO 0x42 + #define CMD_GFRC_READ_HI 0x43 ++#define CMD_GFRC_SET_CORE 0x47 ++#define CMD_GFRC_READ_CORE 0x48 + + #define CMD_IDU_ENABLE 0x71 + #define CMD_IDU_DISABLE 0x72 +diff --git a/include/uapi/drm/virtgpu_drm.h b/include/uapi/drm/virtgpu_drm.h +index 91a31ffed828..9a781f0611df 100644 +--- a/include/uapi/drm/virtgpu_drm.h ++++ b/include/uapi/drm/virtgpu_drm.h +@@ -63,6 +63,7 @@ struct drm_virtgpu_execbuffer { + }; + + #define VIRTGPU_PARAM_3D_FEATURES 1 /* do we have 3D features in the hw */ ++#define VIRTGPU_PARAM_CAPSET_QUERY_FIX 2 /* do we have the capset fix */ + + struct drm_virtgpu_getparam { + __u64 param; +diff --git a/include/uapi/linux/if_ether.h b/include/uapi/linux/if_ether.h +index 3ee3bf7c8526..244e3213ecb0 100644 +--- a/include/uapi/linux/if_ether.h ++++ b/include/uapi/linux/if_ether.h +@@ -30,6 +30,7 @@ + */ + + #define ETH_ALEN 6 /* Octets in one ethernet addr */ ++#define ETH_TLEN 2 /* Octets in ethernet type field */ + #define ETH_HLEN 14 /* Total octets in header. */ + #define ETH_ZLEN 60 /* Min. octets in frame sans FCS */ + #define ETH_DATA_LEN 1500 /* Max. octets in payload */ +diff --git a/ipc/shm.c b/ipc/shm.c +index a9cce632ed48..44cca2529a95 100644 +--- a/ipc/shm.c ++++ b/ipc/shm.c +@@ -1309,14 +1309,17 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, + + if (addr) { + if (addr & (shmlba - 1)) { +- /* +- * Round down to the nearest multiple of shmlba. +- * For sane do_mmap_pgoff() parameters, avoid +- * round downs that trigger nil-page and MAP_FIXED. +- */ +- if ((shmflg & SHM_RND) && addr >= shmlba) +- addr &= ~(shmlba - 1); +- else ++ if (shmflg & SHM_RND) { ++ addr &= ~(shmlba - 1); /* round down */ ++ ++ /* ++ * Ensure that the round-down is non-nil ++ * when remapping. This can happen for ++ * cases when addr < shmlba. ++ */ ++ if (!addr && (shmflg & SHM_REMAP)) ++ goto out; ++ } else + #ifndef __ARCH_FORCE_SHMLBA + if (addr & ~PAGE_MASK) + #endif +diff --git a/kernel/audit.c b/kernel/audit.c +index 5b34d3114af4..d301276bca58 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -1058,6 +1058,8 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature + return; + + ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE); ++ if (!ab) ++ return; + audit_log_task_info(ab, current); + audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d", + audit_feature_names[which], !!old_feature, !!new_feature, +diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c +index c8146d53ca67..07aefa8dbee8 100644 +--- a/kernel/debug/kdb/kdb_main.c ++++ b/kernel/debug/kdb/kdb_main.c +@@ -1566,6 +1566,7 @@ static int kdb_md(int argc, const char **argv) + int symbolic = 0; + int valid = 0; + int phys = 0; ++ int raw = 0; + + kdbgetintenv("MDCOUNT", &mdcount); + kdbgetintenv("RADIX", &radix); +@@ -1575,9 +1576,10 @@ static int kdb_md(int argc, const char **argv) + repeat = mdcount * 16 / bytesperword; + + if (strcmp(argv[0], "mdr") == 0) { +- if (argc != 2) ++ if (argc == 2 || (argc == 0 && last_addr != 0)) ++ valid = raw = 1; ++ else + return KDB_ARGCOUNT; +- valid = 1; + } else if (isdigit(argv[0][2])) { + bytesperword = (int)(argv[0][2] - '0'); + if (bytesperword == 0) { +@@ -1613,7 +1615,10 @@ static int kdb_md(int argc, const char **argv) + radix = last_radix; + bytesperword = last_bytesperword; + repeat = last_repeat; +- mdcount = ((repeat * bytesperword) + 15) / 16; ++ if (raw) ++ mdcount = repeat; ++ else ++ mdcount = ((repeat * bytesperword) + 15) / 16; + } + + if (argc) { +@@ -1630,7 +1635,10 @@ static int kdb_md(int argc, const char **argv) + diag = kdbgetularg(argv[nextarg], &val); + if (!diag) { + mdcount = (int) val; +- repeat = mdcount * 16 / bytesperword; ++ if (raw) ++ repeat = mdcount; ++ else ++ repeat = mdcount * 16 / bytesperword; + } + } + if (argc >= nextarg+1) { +@@ -1640,8 +1648,15 @@ static int kdb_md(int argc, const char **argv) + } + } + +- if (strcmp(argv[0], "mdr") == 0) +- return kdb_mdr(addr, mdcount); ++ if (strcmp(argv[0], "mdr") == 0) { ++ int ret; ++ last_addr = addr; ++ ret = kdb_mdr(addr, mdcount); ++ last_addr += mdcount; ++ last_repeat = mdcount; ++ last_bytesperword = bytesperword; // to make REPEAT happy ++ return ret; ++ } + + switch (radix) { + case 10: +diff --git a/kernel/events/core.c b/kernel/events/core.c +index cb8274d7824f..7c394ddf1ce6 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -642,9 +642,15 @@ static inline void __update_cgrp_time(struct perf_cgroup *cgrp) + + static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx) + { +- struct perf_cgroup *cgrp_out = cpuctx->cgrp; +- if (cgrp_out) +- __update_cgrp_time(cgrp_out); ++ struct perf_cgroup *cgrp = cpuctx->cgrp; ++ struct cgroup_subsys_state *css; ++ ++ if (cgrp) { ++ for (css = &cgrp->css; css; css = css->parent) { ++ cgrp = container_of(css, struct perf_cgroup, css); ++ __update_cgrp_time(cgrp); ++ } ++ } + } + + static inline void update_cgrp_time_from_event(struct perf_event *event) +@@ -672,6 +678,7 @@ perf_cgroup_set_timestamp(struct task_struct *task, + { + struct perf_cgroup *cgrp; + struct perf_cgroup_info *info; ++ struct cgroup_subsys_state *css; + + /* + * ctx->lock held by caller +@@ -682,8 +689,12 @@ perf_cgroup_set_timestamp(struct task_struct *task, + return; + + cgrp = perf_cgroup_from_task(task, ctx); +- info = this_cpu_ptr(cgrp->info); +- info->timestamp = ctx->timestamp; ++ ++ for (css = &cgrp->css; css; css = css->parent) { ++ cgrp = container_of(css, struct perf_cgroup, css); ++ info = this_cpu_ptr(cgrp->info); ++ info->timestamp = ctx->timestamp; ++ } + } + + static DEFINE_PER_CPU(struct list_head, cgrp_cpuctx_list); +@@ -889,27 +900,39 @@ list_update_cgroup_event(struct perf_event *event, + if (!is_cgroup_event(event)) + return; + +- if (add && ctx->nr_cgroups++) +- return; +- else if (!add && --ctx->nr_cgroups) +- return; + /* + * Because cgroup events are always per-cpu events, + * this will always be called from the right CPU. + */ + cpuctx = __get_cpu_context(ctx); +- cpuctx_entry = &cpuctx->cgrp_cpuctx_entry; +- /* cpuctx->cgrp is NULL unless a cgroup event is active in this CPU .*/ +- if (add) { ++ ++ /* ++ * Since setting cpuctx->cgrp is conditional on the current @cgrp ++ * matching the event's cgroup, we must do this for every new event, ++ * because if the first would mismatch, the second would not try again ++ * and we would leave cpuctx->cgrp unset. ++ */ ++ if (add && !cpuctx->cgrp) { + struct perf_cgroup *cgrp = perf_cgroup_from_task(current, ctx); + +- list_add(cpuctx_entry, this_cpu_ptr(&cgrp_cpuctx_list)); + if (cgroup_is_descendant(cgrp->css.cgroup, event->cgrp->css.cgroup)) + cpuctx->cgrp = cgrp; +- } else { +- list_del(cpuctx_entry); +- cpuctx->cgrp = NULL; + } ++ ++ if (add && ctx->nr_cgroups++) ++ return; ++ else if (!add && --ctx->nr_cgroups) ++ return; ++ ++ /* no cgroup running */ ++ if (!add) ++ cpuctx->cgrp = NULL; ++ ++ cpuctx_entry = &cpuctx->cgrp_cpuctx_entry; ++ if (add) ++ list_add(cpuctx_entry, this_cpu_ptr(&cgrp_cpuctx_list)); ++ else ++ list_del(cpuctx_entry); + } + + #else /* !CONFIG_CGROUP_PERF */ +@@ -2393,6 +2416,18 @@ static int __perf_install_in_context(void *info) + raw_spin_lock(&task_ctx->lock); + } + ++#ifdef CONFIG_CGROUP_PERF ++ if (is_cgroup_event(event)) { ++ /* ++ * If the current cgroup doesn't match the event's ++ * cgroup, we should not try to schedule it. ++ */ ++ struct perf_cgroup *cgrp = perf_cgroup_from_task(current, ctx); ++ reprogram = cgroup_is_descendant(cgrp->css.cgroup, ++ event->cgrp->css.cgroup); ++ } ++#endif ++ + if (reprogram) { + ctx_sched_out(ctx, cpuctx, EVENT_TIME); + add_event_to_ctx(event, ctx); +@@ -5802,7 +5837,8 @@ static void perf_output_read_group(struct perf_output_handle *handle, + if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) + values[n++] = running; + +- if (leader != event) ++ if ((leader != event) && ++ (leader->state == PERF_EVENT_STATE_ACTIVE)) + leader->pmu->read(leader); + + values[n++] = perf_event_count(leader); +diff --git a/kernel/rcu/tree_plugin.h b/kernel/rcu/tree_plugin.h +index fed95fa941e6..8b3102d22823 100644 +--- a/kernel/rcu/tree_plugin.h ++++ b/kernel/rcu/tree_plugin.h +@@ -559,8 +559,14 @@ static void rcu_print_detail_task_stall_rnp(struct rcu_node *rnp) + } + t = list_entry(rnp->gp_tasks->prev, + struct task_struct, rcu_node_entry); +- list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry) ++ list_for_each_entry_continue(t, &rnp->blkd_tasks, rcu_node_entry) { ++ /* ++ * We could be printing a lot while holding a spinlock. ++ * Avoid triggering hard lockup. ++ */ ++ touch_nmi_watchdog(); + sched_show_task(t); ++ } + raw_spin_unlock_irqrestore_rcu_node(rnp, flags); + } + +@@ -1677,6 +1683,12 @@ static void print_cpu_stall_info(struct rcu_state *rsp, int cpu) + char *ticks_title; + unsigned long ticks_value; + ++ /* ++ * We could be printing a lot while holding a spinlock. Avoid ++ * triggering hard lockup. ++ */ ++ touch_nmi_watchdog(); ++ + if (rsp->gpnum == rdp->gpnum) { + ticks_title = "ticks this GP"; + ticks_value = rdp->ticks_this_gp; +diff --git a/kernel/relay.c b/kernel/relay.c +index 55da824f4adc..1537158c67b3 100644 +--- a/kernel/relay.c ++++ b/kernel/relay.c +@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan) + { + struct rchan_buf *buf; + +- if (chan->n_subbufs > UINT_MAX / sizeof(size_t *)) ++ if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *)) + return NULL; + + buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL); +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 470a0c9e93de..113eaeb6c0f8 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -843,6 +843,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun) + continue; + + raw_spin_lock(&rq->lock); ++ update_rq_clock(rq); ++ + if (rt_rq->rt_time) { + u64 runtime; + +diff --git a/kernel/sys.c b/kernel/sys.c +index b5c1bc9e3769..de4ed027dfd7 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1395,6 +1395,7 @@ SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource, + if (resource >= RLIM_NLIMITS) + return -EINVAL; + ++ resource = array_index_nospec(resource, RLIM_NLIMITS); + task_lock(current->group_leader); + x = current->signal->rlim[resource]; + task_unlock(current->group_leader); +@@ -1414,6 +1415,7 @@ COMPAT_SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource, + if (resource >= RLIM_NLIMITS) + return -EINVAL; + ++ resource = array_index_nospec(resource, RLIM_NLIMITS); + task_lock(current->group_leader); + r = current->signal->rlim[resource]; + task_unlock(current->group_leader); +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index d0c6b50792c8..d8a7f8939c81 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -5350,7 +5350,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq) + + ret = device_register(&wq_dev->dev); + if (ret) { +- kfree(wq_dev); ++ put_device(&wq_dev->dev); + wq->wq_dev = NULL; + return ret; + } +diff --git a/lib/radix-tree.c b/lib/radix-tree.c +index 70d677820740..d172f0341b80 100644 +--- a/lib/radix-tree.c ++++ b/lib/radix-tree.c +@@ -2037,10 +2037,12 @@ void *radix_tree_delete_item(struct radix_tree_root *root, + unsigned long index, void *item) + { + struct radix_tree_node *node = NULL; +- void __rcu **slot; ++ void __rcu **slot = NULL; + void *entry; + + entry = __radix_tree_lookup(root, index, &node, &slot); ++ if (!slot) ++ return NULL; + if (!entry && (!is_idr(root) || node_tag_get(root, node, IDR_FREE, + get_slot_offset(node, slot)))) + return NULL; +diff --git a/lib/test_kmod.c b/lib/test_kmod.c +index fba78d25e825..96c304fd656a 100644 +--- a/lib/test_kmod.c ++++ b/lib/test_kmod.c +@@ -1149,7 +1149,7 @@ static struct kmod_test_device *register_test_dev_kmod(void) + mutex_lock(®_dev_mutex); + + /* int should suffice for number of devices, test for wrap */ +- if (unlikely(num_test_devs + 1) < 0) { ++ if (num_test_devs + 1 == INT_MAX) { + pr_err("reached limit of number of test devices\n"); + goto out; + } +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index a403d29da6fd..e774898c91d5 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -555,7 +555,8 @@ static int __do_huge_pmd_anonymous_page(struct vm_fault *vmf, struct page *page, + + VM_BUG_ON_PAGE(!PageCompound(page), page); + +- if (mem_cgroup_try_charge(page, vma->vm_mm, gfp, &memcg, true)) { ++ if (mem_cgroup_try_charge(page, vma->vm_mm, gfp | __GFP_NORETRY, &memcg, ++ true)) { + put_page(page); + count_vm_event(THP_FAULT_FALLBACK); + return VM_FAULT_FALLBACK; +@@ -1304,7 +1305,7 @@ int do_huge_pmd_wp_page(struct vm_fault *vmf, pmd_t orig_pmd) + } + + if (unlikely(mem_cgroup_try_charge(new_page, vma->vm_mm, +- huge_gfp, &memcg, true))) { ++ huge_gfp | __GFP_NORETRY, &memcg, true))) { + put_page(new_page); + split_huge_pmd(vma, vmf->pmd, vmf->address); + if (page) +diff --git a/mm/kasan/kasan.c b/mm/kasan/kasan.c +index 6f319fb81718..d90f29a166d8 100644 +--- a/mm/kasan/kasan.c ++++ b/mm/kasan/kasan.c +@@ -737,6 +737,40 @@ void __asan_unpoison_stack_memory(const void *addr, size_t size) + EXPORT_SYMBOL(__asan_unpoison_stack_memory); + + #ifdef CONFIG_MEMORY_HOTPLUG ++static bool shadow_mapped(unsigned long addr) ++{ ++ pgd_t *pgd = pgd_offset_k(addr); ++ p4d_t *p4d; ++ pud_t *pud; ++ pmd_t *pmd; ++ pte_t *pte; ++ ++ if (pgd_none(*pgd)) ++ return false; ++ p4d = p4d_offset(pgd, addr); ++ if (p4d_none(*p4d)) ++ return false; ++ pud = pud_offset(p4d, addr); ++ if (pud_none(*pud)) ++ return false; ++ ++ /* ++ * We can't use pud_large() or pud_huge(), the first one is ++ * arch-specific, the last one depends on HUGETLB_PAGE. So let's abuse ++ * pud_bad(), if pud is bad then it's bad because it's huge. ++ */ ++ if (pud_bad(*pud)) ++ return true; ++ pmd = pmd_offset(pud, addr); ++ if (pmd_none(*pmd)) ++ return false; ++ ++ if (pmd_bad(*pmd)) ++ return true; ++ pte = pte_offset_kernel(pmd, addr); ++ return !pte_none(*pte); ++} ++ + static int __meminit kasan_mem_notifier(struct notifier_block *nb, + unsigned long action, void *data) + { +@@ -758,6 +792,14 @@ static int __meminit kasan_mem_notifier(struct notifier_block *nb, + case MEM_GOING_ONLINE: { + void *ret; + ++ /* ++ * If shadow is mapped already than it must have been mapped ++ * during the boot. This could happen if we onlining previously ++ * offlined memory. ++ */ ++ if (shadow_mapped(shadow_start)) ++ return NOTIFY_OK; ++ + ret = __vmalloc_node_range(shadow_size, PAGE_SIZE, shadow_start, + shadow_end, GFP_KERNEL, + PAGE_KERNEL, VM_NO_GUARD, +@@ -769,8 +811,26 @@ static int __meminit kasan_mem_notifier(struct notifier_block *nb, + kmemleak_ignore(ret); + return NOTIFY_OK; + } +- case MEM_OFFLINE: +- vfree((void *)shadow_start); ++ case MEM_CANCEL_ONLINE: ++ case MEM_OFFLINE: { ++ struct vm_struct *vm; ++ ++ /* ++ * shadow_start was either mapped during boot by kasan_init() ++ * or during memory online by __vmalloc_node_range(). ++ * In the latter case we can use vfree() to free shadow. ++ * Non-NULL result of the find_vm_area() will tell us if ++ * that was the second case. ++ * ++ * Currently it's not possible to free shadow mapped ++ * during boot by kasan_init(). It's because the code ++ * to do that hasn't been written yet. So we'll just ++ * leak the memory. ++ */ ++ vm = find_vm_area((void *)shadow_start); ++ if (vm) ++ vfree((void *)shadow_start); ++ } + } + + return NOTIFY_OK; +@@ -783,5 +843,5 @@ static int __init kasan_memhotplug_init(void) + return 0; + } + +-module_init(kasan_memhotplug_init); ++core_initcall(kasan_memhotplug_init); + #endif +diff --git a/mm/khugepaged.c b/mm/khugepaged.c +index 29221602d802..0a5bb3e8a8a3 100644 +--- a/mm/khugepaged.c ++++ b/mm/khugepaged.c +@@ -965,7 +965,9 @@ static void collapse_huge_page(struct mm_struct *mm, + goto out_nolock; + } + +- if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) { ++ /* Do not oom kill for khugepaged charges */ ++ if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY, ++ &memcg, true))) { + result = SCAN_CGROUP_CHARGE_FAIL; + goto out_nolock; + } +@@ -1324,7 +1326,9 @@ static void collapse_shmem(struct mm_struct *mm, + goto out; + } + +- if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp, &memcg, true))) { ++ /* Do not oom kill for khugepaged charges */ ++ if (unlikely(mem_cgroup_try_charge(new_page, mm, gfp | __GFP_NORETRY, ++ &memcg, true))) { + result = SCAN_CGROUP_CHARGE_FAIL; + goto out; + } +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index bd1374f402cd..d9e0be2a8189 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -1658,8 +1658,7 @@ static void start_scan_thread(void) + } + + /* +- * Stop the automatic memory scanning thread. This function must be called +- * with the scan_mutex held. ++ * Stop the automatic memory scanning thread. + */ + static void stop_scan_thread(void) + { +@@ -1922,12 +1921,15 @@ static void kmemleak_do_cleanup(struct work_struct *work) + { + stop_scan_thread(); + ++ mutex_lock(&scan_mutex); + /* +- * Once the scan thread has stopped, it is safe to no longer track +- * object freeing. Ordering of the scan thread stopping and the memory +- * accesses below is guaranteed by the kthread_stop() function. ++ * Once it is made sure that kmemleak_scan has stopped, it is safe to no ++ * longer track object freeing. Ordering of the scan thread stopping and ++ * the memory accesses below is guaranteed by the kthread_stop() ++ * function. + */ + kmemleak_free_enabled = 0; ++ mutex_unlock(&scan_mutex); + + if (!kmemleak_found_leaks) + __kmemleak_do_cleanup(); +diff --git a/mm/ksm.c b/mm/ksm.c +index 5b6be9eeb095..fdc8746ebcb4 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -2085,8 +2085,22 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item) + tree_rmap_item = + unstable_tree_search_insert(rmap_item, page, &tree_page); + if (tree_rmap_item) { ++ bool split; ++ + kpage = try_to_merge_two_pages(rmap_item, page, + tree_rmap_item, tree_page); ++ /* ++ * If both pages we tried to merge belong to the same compound ++ * page, then we actually ended up increasing the reference ++ * count of the same compound page twice, and split_huge_page ++ * failed. ++ * Here we set a flag if that happened, and we use it later to ++ * try split_huge_page again. Since we call put_page right ++ * afterwards, the reference count will be correct and ++ * split_huge_page should succeed. ++ */ ++ split = PageTransCompound(page) ++ && compound_head(page) == compound_head(tree_page); + put_page(tree_page); + if (kpage) { + /* +@@ -2113,6 +2127,20 @@ static void cmp_and_merge_page(struct page *page, struct rmap_item *rmap_item) + break_cow(tree_rmap_item); + break_cow(rmap_item); + } ++ } else if (split) { ++ /* ++ * We are here if we tried to merge two pages and ++ * failed because they both belonged to the same ++ * compound page. We will split the page now, but no ++ * merging will take place. ++ * We do not want to add the cost of a full lock; if ++ * the page is locked, it is better to skip it and ++ * perhaps try again later. ++ */ ++ if (!trylock_page(page)) ++ return; ++ split_huge_page(page); ++ unlock_page(page); + } + } + } +diff --git a/mm/mempolicy.c b/mm/mempolicy.c +index 2d3077ce50cd..ecbda7f5d494 100644 +--- a/mm/mempolicy.c ++++ b/mm/mempolicy.c +@@ -2128,6 +2128,9 @@ bool __mpol_equal(struct mempolicy *a, struct mempolicy *b) + case MPOL_INTERLEAVE: + return !!nodes_equal(a->v.nodes, b->v.nodes); + case MPOL_PREFERRED: ++ /* a's ->flags is the same as b's */ ++ if (a->flags & MPOL_F_LOCAL) ++ return true; + return a->v.preferred_node == b->v.preferred_node; + default: + BUG(); +diff --git a/mm/page_idle.c b/mm/page_idle.c +index 0a49374e6931..e412a63b2b74 100644 +--- a/mm/page_idle.c ++++ b/mm/page_idle.c +@@ -65,11 +65,15 @@ static bool page_idle_clear_pte_refs_one(struct page *page, + while (page_vma_mapped_walk(&pvmw)) { + addr = pvmw.address; + if (pvmw.pte) { +- referenced = ptep_clear_young_notify(vma, addr, +- pvmw.pte); ++ /* ++ * For PTE-mapped THP, one sub page is referenced, ++ * the whole THP is referenced. ++ */ ++ if (ptep_clear_young_notify(vma, addr, pvmw.pte)) ++ referenced = true; + } else if (IS_ENABLED(CONFIG_TRANSPARENT_HUGEPAGE)) { +- referenced = pmdp_clear_young_notify(vma, addr, +- pvmw.pmd); ++ if (pmdp_clear_young_notify(vma, addr, pvmw.pmd)) ++ referenced = true; + } else { + /* unexpected pmd-mapped page? */ + WARN_ON_ONCE(1); +diff --git a/mm/page_owner.c b/mm/page_owner.c +index 4f44b95b9d1e..a71fe4c623ef 100644 +--- a/mm/page_owner.c ++++ b/mm/page_owner.c +@@ -123,13 +123,13 @@ void __reset_page_owner(struct page *page, unsigned int order) + static inline bool check_recursive_alloc(struct stack_trace *trace, + unsigned long ip) + { +- int i, count; ++ int i; + + if (!trace->nr_entries) + return false; + +- for (i = 0, count = 0; i < trace->nr_entries; i++) { +- if (trace->entries[i] == ip && ++count == 2) ++ for (i = 0; i < trace->nr_entries; i++) { ++ if (trace->entries[i] == ip) + return true; + } + +diff --git a/mm/slab.c b/mm/slab.c +index 1bfc3d847a0a..198c1e2c5358 100644 +--- a/mm/slab.c ++++ b/mm/slab.c +@@ -1283,6 +1283,7 @@ void __init kmem_cache_init(void) + nr_node_ids * sizeof(struct kmem_cache_node *), + SLAB_HWCACHE_ALIGN); + list_add(&kmem_cache->list, &slab_caches); ++ memcg_link_cache(kmem_cache); + slab_state = PARTIAL; + + /* +diff --git a/mm/swapfile.c b/mm/swapfile.c +index e47a21e64764..03d2ce288d83 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2954,6 +2954,10 @@ static unsigned long read_swap_header(struct swap_info_struct *p, + maxpages = swp_offset(pte_to_swp_entry( + swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1; + last_page = swap_header->info.last_page; ++ if (!last_page) { ++ pr_warn("Empty swap-file\n"); ++ return 0; ++ } + if (last_page > maxpages) { + pr_warn("Truncating oversized swap area, only using %luk out of %luk\n", + maxpages << (PAGE_SHIFT - 10), +diff --git a/mm/vmscan.c b/mm/vmscan.c +index b3f5e337b64a..1a581468a9cf 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -3961,7 +3961,13 @@ int node_reclaim(struct pglist_data *pgdat, gfp_t gfp_mask, unsigned int order) + */ + int page_evictable(struct page *page) + { +- return !mapping_unevictable(page_mapping(page)) && !PageMlocked(page); ++ int ret; ++ ++ /* Prevent address_space of inode and swap cache from being freed */ ++ rcu_read_lock(); ++ ret = !mapping_unevictable(page_mapping(page)) && !PageMlocked(page); ++ rcu_read_unlock(); ++ return ret; + } + + #ifdef CONFIG_SHMEM +diff --git a/mm/vmstat.c b/mm/vmstat.c +index 4bb13e72ac97..e085b13c572e 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1770,9 +1770,11 @@ static void vmstat_update(struct work_struct *w) + * to occur in the future. Keep on running the + * update worker thread. + */ ++ preempt_disable(); + queue_delayed_work_on(smp_processor_id(), mm_percpu_wq, + this_cpu_ptr(&vmstat_work), + round_jiffies_relative(sysctl_stat_interval)); ++ preempt_enable(); + } + } + +diff --git a/mm/z3fold.c b/mm/z3fold.c +index ddfb20cfd9af..f33403d718ac 100644 +--- a/mm/z3fold.c ++++ b/mm/z3fold.c +@@ -469,6 +469,8 @@ static struct z3fold_pool *z3fold_create_pool(const char *name, gfp_t gfp, + spin_lock_init(&pool->lock); + spin_lock_init(&pool->stale_lock); + pool->unbuddied = __alloc_percpu(sizeof(struct list_head)*NCHUNKS, 2); ++ if (!pool->unbuddied) ++ goto out_pool; + for_each_possible_cpu(cpu) { + struct list_head *unbuddied = + per_cpu_ptr(pool->unbuddied, cpu); +@@ -481,7 +483,7 @@ static struct z3fold_pool *z3fold_create_pool(const char *name, gfp_t gfp, + pool->name = name; + pool->compact_wq = create_singlethread_workqueue(pool->name); + if (!pool->compact_wq) +- goto out; ++ goto out_unbuddied; + pool->release_wq = create_singlethread_workqueue(pool->name); + if (!pool->release_wq) + goto out_wq; +@@ -491,8 +493,11 @@ static struct z3fold_pool *z3fold_create_pool(const char *name, gfp_t gfp, + + out_wq: + destroy_workqueue(pool->compact_wq); +-out: ++out_unbuddied: ++ free_percpu(pool->unbuddied); ++out_pool: + kfree(pool); ++out: + return NULL; + } + +diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c +index 64aa9f755e1d..45c9bf5ff3a0 100644 +--- a/net/8021q/vlan_core.c ++++ b/net/8021q/vlan_core.c +@@ -48,8 +48,8 @@ bool vlan_do_receive(struct sk_buff **skbp) + * original position later + */ + skb_push(skb, offset); +- skb = *skbp = vlan_insert_tag(skb, skb->vlan_proto, +- skb->vlan_tci); ++ skb = *skbp = vlan_insert_inner_tag(skb, skb->vlan_proto, ++ skb->vlan_tci, skb->mac_len); + if (!skb) + return false; + skb_pull(skb, offset + VLAN_HLEN); +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index 83ba5483455a..71d8809fbe94 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -2719,7 +2719,7 @@ static int batadv_iv_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; + struct batadv_gw_node *curr_gw; +- int ret = -EINVAL; ++ int ret = 0; + void *hdr; + + router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT); +diff --git a/net/batman-adv/bat_v.c b/net/batman-adv/bat_v.c +index 4e2724c5b33d..a8f4c3902cf5 100644 +--- a/net/batman-adv/bat_v.c ++++ b/net/batman-adv/bat_v.c +@@ -930,7 +930,7 @@ static int batadv_v_gw_dump_entry(struct sk_buff *msg, u32 portid, u32 seq, + struct batadv_neigh_ifinfo *router_ifinfo = NULL; + struct batadv_neigh_node *router; + struct batadv_gw_node *curr_gw; +- int ret = -EINVAL; ++ int ret = 0; + void *hdr; + + router = batadv_orig_router_get(gw_node->orig_node, BATADV_IF_DEFAULT); +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c +index cdd8e8e4df0b..422ee16b7854 100644 +--- a/net/batman-adv/bridge_loop_avoidance.c ++++ b/net/batman-adv/bridge_loop_avoidance.c +@@ -2161,22 +2161,25 @@ batadv_bla_claim_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_bla_claim *claim; + int idx = 0; ++ int ret = 0; + + rcu_read_lock(); + hlist_for_each_entry_rcu(claim, head, hash_entry) { + if (idx++ < *idx_skip) + continue; +- if (batadv_bla_claim_dump_entry(msg, portid, seq, +- primary_if, claim)) { ++ ++ ret = batadv_bla_claim_dump_entry(msg, portid, seq, ++ primary_if, claim); ++ if (ret) { + *idx_skip = idx - 1; + goto unlock; + } + } + +- *idx_skip = idx; ++ *idx_skip = 0; + unlock: + rcu_read_unlock(); +- return 0; ++ return ret; + } + + /** +@@ -2391,22 +2394,25 @@ batadv_bla_backbone_dump_bucket(struct sk_buff *msg, u32 portid, u32 seq, + { + struct batadv_bla_backbone_gw *backbone_gw; + int idx = 0; ++ int ret = 0; + + rcu_read_lock(); + hlist_for_each_entry_rcu(backbone_gw, head, hash_entry) { + if (idx++ < *idx_skip) + continue; +- if (batadv_bla_backbone_dump_entry(msg, portid, seq, +- primary_if, backbone_gw)) { ++ ++ ret = batadv_bla_backbone_dump_entry(msg, portid, seq, ++ primary_if, backbone_gw); ++ if (ret) { + *idx_skip = idx - 1; + goto unlock; + } + } + +- *idx_skip = idx; ++ *idx_skip = 0; + unlock: + rcu_read_unlock(); +- return 0; ++ return ret; + } + + /** +diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c +index b6cfa78e9381..4f0111bc6621 100644 +--- a/net/batman-adv/distributed-arp-table.c ++++ b/net/batman-adv/distributed-arp-table.c +@@ -391,7 +391,7 @@ static void batadv_dbg_arp(struct batadv_priv *bat_priv, struct sk_buff *skb, + batadv_arp_hw_src(skb, hdr_size), &ip_src, + batadv_arp_hw_dst(skb, hdr_size), &ip_dst); + +- if (hdr_size == 0) ++ if (hdr_size < sizeof(struct batadv_unicast_packet)) + return; + + unicast_4addr_packet = (struct batadv_unicast_4addr_packet *)skb->data; +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index a98cf1104a30..b6abd19ab23e 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -287,7 +287,8 @@ batadv_frag_merge_packets(struct hlist_head *chain) + /* Move the existing MAC header to just before the payload. (Override + * the fragment header.) + */ +- skb_pull_rcsum(skb_out, hdr_size); ++ skb_pull(skb_out, hdr_size); ++ skb_out->ip_summed = CHECKSUM_NONE; + memmove(skb_out->data - ETH_HLEN, skb_mac_header(skb_out), ETH_HLEN); + skb_set_mac_header(skb_out, -ETH_HLEN); + skb_reset_network_header(skb_out); +diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c +index de9955d5224d..06276ae9f752 100644 +--- a/net/batman-adv/gateway_client.c ++++ b/net/batman-adv/gateway_client.c +@@ -705,7 +705,7 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, + { + struct batadv_neigh_node *neigh_curr = NULL; + struct batadv_neigh_node *neigh_old = NULL; +- struct batadv_orig_node *orig_dst_node; ++ struct batadv_orig_node *orig_dst_node = NULL; + struct batadv_gw_node *gw_node = NULL; + struct batadv_gw_node *curr_gw = NULL; + struct batadv_neigh_ifinfo *curr_ifinfo, *old_ifinfo; +@@ -716,6 +716,9 @@ bool batadv_gw_out_of_range(struct batadv_priv *bat_priv, + + vid = batadv_get_vid(skb, 0); + ++ if (is_multicast_ether_addr(ethhdr->h_dest)) ++ goto out; ++ + orig_dst_node = batadv_transtable_search(bat_priv, ethhdr->h_source, + ethhdr->h_dest, vid); + if (!orig_dst_node) +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index d327670641ac..fa02fb73367c 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -540,8 +540,8 @@ static bool batadv_mcast_mla_tvlv_update(struct batadv_priv *bat_priv) + bat_priv->mcast.enabled = true; + } + +- return !(mcast_data.flags & +- (BATADV_MCAST_WANT_ALL_IPV4 | BATADV_MCAST_WANT_ALL_IPV6)); ++ return !(mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV4 && ++ mcast_data.flags & BATADV_MCAST_WANT_ALL_IPV6); + } + + /** +@@ -809,8 +809,8 @@ static struct batadv_orig_node * + batadv_mcast_forw_tt_node_get(struct batadv_priv *bat_priv, + struct ethhdr *ethhdr) + { +- return batadv_transtable_search(bat_priv, ethhdr->h_source, +- ethhdr->h_dest, BATADV_NO_FLAGS); ++ return batadv_transtable_search(bat_priv, NULL, ethhdr->h_dest, ++ BATADV_NO_FLAGS); + } + + /** +diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c +index f10e3ff26f9d..cd82cff716c7 100644 +--- a/net/batman-adv/routing.c ++++ b/net/batman-adv/routing.c +@@ -743,6 +743,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb, + /** + * batadv_reroute_unicast_packet - update the unicast header for re-routing + * @bat_priv: the bat priv with all the soft interface information ++ * @skb: unicast packet to process + * @unicast_packet: the unicast header to be updated + * @dst_addr: the payload destination + * @vid: VLAN identifier +@@ -754,7 +755,7 @@ static int batadv_route_unicast_packet(struct sk_buff *skb, + * Return: true if the packet header has been updated, false otherwise + */ + static bool +-batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, ++batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, struct sk_buff *skb, + struct batadv_unicast_packet *unicast_packet, + u8 *dst_addr, unsigned short vid) + { +@@ -783,8 +784,10 @@ batadv_reroute_unicast_packet(struct batadv_priv *bat_priv, + } + + /* update the packet header */ ++ skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet)); + ether_addr_copy(unicast_packet->dest, orig_addr); + unicast_packet->ttvn = orig_ttvn; ++ skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet)); + + ret = true; + out: +@@ -825,7 +828,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, + * the packet to + */ + if (batadv_tt_local_client_is_roaming(bat_priv, ethhdr->h_dest, vid)) { +- if (batadv_reroute_unicast_packet(bat_priv, unicast_packet, ++ if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet, + ethhdr->h_dest, vid)) + batadv_dbg_ratelimited(BATADV_DBG_TT, + bat_priv, +@@ -871,7 +874,7 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, + * destination can possibly be updated and forwarded towards the new + * target host + */ +- if (batadv_reroute_unicast_packet(bat_priv, unicast_packet, ++ if (batadv_reroute_unicast_packet(bat_priv, skb, unicast_packet, + ethhdr->h_dest, vid)) { + batadv_dbg_ratelimited(BATADV_DBG_TT, bat_priv, + "Rerouting unicast packet to %pM (dst=%pM): TTVN mismatch old_ttvn=%u new_ttvn=%u\n", +@@ -894,12 +897,14 @@ static bool batadv_check_unicast_ttvn(struct batadv_priv *bat_priv, + if (!primary_if) + return false; + ++ /* update the packet header */ ++ skb_postpull_rcsum(skb, unicast_packet, sizeof(*unicast_packet)); + ether_addr_copy(unicast_packet->dest, primary_if->net_dev->dev_addr); ++ unicast_packet->ttvn = curr_ttvn; ++ skb_postpush_rcsum(skb, unicast_packet, sizeof(*unicast_packet)); + + batadv_hardif_put(primary_if); + +- unicast_packet->ttvn = curr_ttvn; +- + return true; + } + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 10f7edfb176e..aa2c49fa31ce 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -451,13 +451,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + + /* skb->dev & skb->pkt_type are set here */ + skb->protocol = eth_type_trans(skb, soft_iface); +- +- /* should not be necessary anymore as we use skb_pull_rcsum() +- * TODO: please verify this and remove this TODO +- * -- Dec 21st 2009, Simon Wunderlich +- */ +- +- /* skb->ip_summed = CHECKSUM_UNNECESSARY; */ ++ skb_postpull_rcsum(skb, eth_hdr(skb), ETH_HLEN); + + batadv_inc_counter(bat_priv, BATADV_CNT_RX); + batadv_add_counter(bat_priv, BATADV_CNT_RX_BYTES, +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 2800c4c4978c..5b8cd359c4c0 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1641,7 +1641,8 @@ static int compat_match_to_user(struct ebt_entry_match *m, void __user **dstptr, + int off = ebt_compat_match_offset(match, m->match_size); + compat_uint_t msize = m->match_size - off; + +- BUG_ON(off >= m->match_size); ++ if (WARN_ON(off >= m->match_size)) ++ return -EINVAL; + + if (copy_to_user(cm->u.name, match->name, + strlen(match->name) + 1) || put_user(msize, &cm->match_size)) +@@ -1671,7 +1672,8 @@ static int compat_target_to_user(struct ebt_entry_target *t, + int off = xt_compat_target_offset(target); + compat_uint_t tsize = t->target_size - off; + +- BUG_ON(off >= t->target_size); ++ if (WARN_ON(off >= t->target_size)) ++ return -EINVAL; + + if (copy_to_user(cm->u.name, target->name, + strlen(target->name) + 1) || put_user(tsize, &cm->match_size)) +@@ -1907,7 +1909,8 @@ static int ebt_buf_add(struct ebt_entries_buf_state *state, + if (state->buf_kern_start == NULL) + goto count_only; + +- BUG_ON(state->buf_kern_offset + sz > state->buf_kern_len); ++ if (WARN_ON(state->buf_kern_offset + sz > state->buf_kern_len)) ++ return -EINVAL; + + memcpy(state->buf_kern_start + state->buf_kern_offset, data, sz); + +@@ -1920,7 +1923,8 @@ static int ebt_buf_add_pad(struct ebt_entries_buf_state *state, unsigned int sz) + { + char *b = state->buf_kern_start; + +- BUG_ON(b && state->buf_kern_offset > state->buf_kern_len); ++ if (WARN_ON(b && state->buf_kern_offset > state->buf_kern_len)) ++ return -EINVAL; + + if (b != NULL && sz > 0) + memset(b + state->buf_kern_offset, 0, sz); +@@ -1997,8 +2001,10 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, + pad = XT_ALIGN(size_kern) - size_kern; + + if (pad > 0 && dst) { +- BUG_ON(state->buf_kern_len <= pad); +- BUG_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad); ++ if (WARN_ON(state->buf_kern_len <= pad)) ++ return -EINVAL; ++ if (WARN_ON(state->buf_kern_offset - (match_size + off) + size_kern > state->buf_kern_len - pad)) ++ return -EINVAL; + memset(dst + size_kern, 0, pad); + } + return off + match_size; +@@ -2048,7 +2054,8 @@ static int ebt_size_mwt(struct compat_ebt_entry_mwt *match32, + if (ret < 0) + return ret; + +- BUG_ON(ret < match32->match_size); ++ if (WARN_ON(ret < match32->match_size)) ++ return -EINVAL; + growth += ret - match32->match_size; + growth += ebt_compat_entry_padsize(); + +@@ -2117,8 +2124,12 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + * offsets are relative to beginning of struct ebt_entry (i.e., 0). + */ + for (i = 0; i < 4 ; ++i) { +- if (offsets[i] >= *total) ++ if (offsets[i] > *total) ++ return -EINVAL; ++ ++ if (i < 3 && offsets[i] == *total) + return -EINVAL; ++ + if (i == 0) + continue; + if (offsets[i-1] > offsets[i]) +@@ -2157,7 +2168,8 @@ static int size_entry_mwt(struct ebt_entry *entry, const unsigned char *base, + + startoff = state->buf_user_offset - startoff; + +- BUG_ON(*total < startoff); ++ if (WARN_ON(*total < startoff)) ++ return -EINVAL; + *total -= startoff; + return 0; + } +@@ -2286,7 +2298,8 @@ static int compat_do_replace(struct net *net, void __user *user, + state.buf_kern_len = size64; + + ret = compat_copy_entries(entries_tmp, tmp.entries_size, &state); +- BUG_ON(ret < 0); /* parses same data again */ ++ if (WARN_ON(ret < 0)) ++ goto out_unlock; + + vfree(entries_tmp); + tmp.entries_size = size64; +diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c +index 5c036d2f401e..cdb5b693a135 100644 +--- a/net/ceph/ceph_common.c ++++ b/net/ceph/ceph_common.c +@@ -418,11 +418,15 @@ ceph_parse_options(char *options, const char *dev_name, + opt->flags |= CEPH_OPT_FSID; + break; + case Opt_name: ++ kfree(opt->name); + opt->name = kstrndup(argstr[0].from, + argstr[0].to-argstr[0].from, + GFP_KERNEL); + break; + case Opt_secret: ++ ceph_crypto_key_destroy(opt->key); ++ kfree(opt->key); ++ + opt->key = kzalloc(sizeof(*opt->key), GFP_KERNEL); + if (!opt->key) { + err = -ENOMEM; +@@ -433,6 +437,9 @@ ceph_parse_options(char *options, const char *dev_name, + goto out; + break; + case Opt_key: ++ ceph_crypto_key_destroy(opt->key); ++ kfree(opt->key); ++ + opt->key = kzalloc(sizeof(*opt->key), GFP_KERNEL); + if (!opt->key) { + err = -ENOMEM; +diff --git a/net/core/ethtool.c b/net/core/ethtool.c +index d374a904f1b1..490eab16b04b 100644 +--- a/net/core/ethtool.c ++++ b/net/core/ethtool.c +@@ -2505,11 +2505,14 @@ static int set_phy_tunable(struct net_device *dev, void __user *useraddr) + static int ethtool_get_fecparam(struct net_device *dev, void __user *useraddr) + { + struct ethtool_fecparam fecparam = { ETHTOOL_GFECPARAM }; ++ int rc; + + if (!dev->ethtool_ops->get_fecparam) + return -EOPNOTSUPP; + +- dev->ethtool_ops->get_fecparam(dev, &fecparam); ++ rc = dev->ethtool_ops->get_fecparam(dev, &fecparam); ++ if (rc) ++ return rc; + + if (copy_to_user(useraddr, &fecparam, sizeof(fecparam))) + return -EFAULT; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index ef734ad1d852..c132eca9e383 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4939,13 +4939,18 @@ EXPORT_SYMBOL_GPL(skb_gso_validate_mtu); + + static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb) + { ++ int mac_len; ++ + if (skb_cow(skb, skb_headroom(skb)) < 0) { + kfree_skb(skb); + return NULL; + } + +- memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN, +- 2 * ETH_ALEN); ++ mac_len = skb->data - skb_mac_header(skb); ++ if (likely(mac_len > VLAN_HLEN + ETH_TLEN)) { ++ memmove(skb_mac_header(skb) + VLAN_HLEN, skb_mac_header(skb), ++ mac_len - VLAN_HLEN - ETH_TLEN); ++ } + skb->mac_header += VLAN_HLEN; + return skb; + } +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index 23e6d5532b5c..2459e9cc22a6 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -951,9 +951,6 @@ static void __gre_tunnel_init(struct net_device *dev) + + t_hlen = tunnel->hlen + sizeof(struct iphdr); + +- dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4; +- dev->mtu = ETH_DATA_LEN - t_hlen - 4; +- + dev->features |= GRE_FEATURES; + dev->hw_features |= GRE_FEATURES; + +@@ -1253,8 +1250,6 @@ static int erspan_tunnel_init(struct net_device *dev) + sizeof(struct erspanhdr); + t_hlen = tunnel->hlen + sizeof(struct iphdr); + +- dev->needed_headroom = LL_MAX_HEADER + t_hlen + 4; +- dev->mtu = ETH_DATA_LEN - t_hlen - 4; + dev->features |= GRE_FEATURES; + dev->hw_features |= GRE_FEATURES; + dev->priv_flags |= IFF_LIVE_ADDR_CHANGE; +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index a2fcc20774a6..4784f3f36b7e 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -1103,8 +1103,14 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[], + eth_hw_addr_random(dev); + + mtu = ip_tunnel_bind_dev(dev); +- if (!tb[IFLA_MTU]) ++ if (tb[IFLA_MTU]) { ++ unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen; ++ ++ dev->mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU, ++ (unsigned int)(max - sizeof(struct iphdr))); ++ } else { + dev->mtu = mtu; ++ } + + ip_tunnel_add(itn, nt); + out: +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index c9cd891f69c2..5c5699c08575 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -396,8 +396,6 @@ static int vti_tunnel_init(struct net_device *dev) + memcpy(dev->dev_addr, &iph->saddr, 4); + memcpy(dev->broadcast, &iph->daddr, 4); + +- dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr); +- dev->mtu = ETH_DATA_LEN; + dev->flags = IFF_NOARP; + dev->addr_len = 4; + dev->features |= NETIF_F_LLTX; +diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c +index c07e9db95ccc..cc7c9d67ac19 100644 +--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c ++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c +@@ -228,7 +228,6 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, + c->hash_mode = i->hash_mode; + c->hash_initval = i->hash_initval; + refcount_set(&c->refcount, 1); +- refcount_set(&c->entries, 1); + + spin_lock_bh(&cn->lock); + if (__clusterip_config_find(net, ip)) { +@@ -259,8 +258,10 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, + + c->notifier.notifier_call = clusterip_netdev_event; + err = register_netdevice_notifier(&c->notifier); +- if (!err) ++ if (!err) { ++ refcount_set(&c->entries, 1); + return c; ++ } + + #ifdef CONFIG_PROC_FS + proc_remove(c->pde); +@@ -269,7 +270,7 @@ clusterip_config_init(struct net *net, const struct ipt_clusterip_tgt_info *i, + spin_lock_bh(&cn->lock); + list_del_rcu(&c->list); + spin_unlock_bh(&cn->lock); +- kfree(c); ++ clusterip_config_put(c); + + return ERR_PTR(err); + } +@@ -492,12 +493,15 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) + return PTR_ERR(config); + } + } +- cipinfo->config = config; + + ret = nf_ct_netns_get(par->net, par->family); +- if (ret < 0) ++ if (ret < 0) { + pr_info("cannot load conntrack support for proto=%u\n", + par->family); ++ clusterip_config_entry_put(par->net, config); ++ clusterip_config_put(config); ++ return ret; ++ } + + if (!par->net->xt.clusterip_deprecated_warning) { + pr_info("ipt_CLUSTERIP is deprecated and it will removed soon, " +@@ -505,6 +509,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par) + par->net->xt.clusterip_deprecated_warning = true; + } + ++ cipinfo->config = config; + return ret; + } + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 28bc3a98adc7..7afa8d2463d8 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -639,6 +639,7 @@ static inline u32 fnhe_hashfun(__be32 daddr) + static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe) + { + rt->rt_pmtu = fnhe->fnhe_pmtu; ++ rt->rt_mtu_locked = fnhe->fnhe_mtu_locked; + rt->dst.expires = fnhe->fnhe_expires; + + if (fnhe->fnhe_gw) { +@@ -649,7 +650,7 @@ static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnh + } + + static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, +- u32 pmtu, unsigned long expires) ++ u32 pmtu, bool lock, unsigned long expires) + { + struct fnhe_hash_bucket *hash; + struct fib_nh_exception *fnhe; +@@ -686,8 +687,10 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_genid = genid; + if (gw) + fnhe->fnhe_gw = gw; +- if (pmtu) ++ if (pmtu) { + fnhe->fnhe_pmtu = pmtu; ++ fnhe->fnhe_mtu_locked = lock; ++ } + fnhe->fnhe_expires = max(1UL, expires); + /* Update all cached dsts too */ + rt = rcu_dereference(fnhe->fnhe_rth_input); +@@ -711,6 +714,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; + fnhe->fnhe_pmtu = pmtu; ++ fnhe->fnhe_mtu_locked = lock; + fnhe->fnhe_expires = max(1UL, expires); + + /* Exception created; mark the cached routes for the nexthop +@@ -792,7 +796,8 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow + struct fib_nh *nh = &FIB_RES_NH(res); + + update_or_create_fnhe(nh, fl4->daddr, new_gw, +- 0, jiffies + ip_rt_gc_timeout); ++ 0, false, ++ jiffies + ip_rt_gc_timeout); + } + if (kill_route) + rt->dst.obsolete = DST_OBSOLETE_KILL; +@@ -1005,15 +1010,18 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + { + struct dst_entry *dst = &rt->dst; + struct fib_result res; ++ bool lock = false; + +- if (dst_metric_locked(dst, RTAX_MTU)) ++ if (ip_mtu_locked(dst)) + return; + + if (ipv4_mtu(dst) < mtu) + return; + +- if (mtu < ip_rt_min_pmtu) ++ if (mtu < ip_rt_min_pmtu) { ++ lock = true; + mtu = ip_rt_min_pmtu; ++ } + + if (rt->rt_pmtu == mtu && + time_before(jiffies, dst->expires - ip_rt_mtu_expires / 2)) +@@ -1023,7 +1031,7 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) { + struct fib_nh *nh = &FIB_RES_NH(res); + +- update_or_create_fnhe(nh, fl4->daddr, 0, mtu, ++ update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock, + jiffies + ip_rt_mtu_expires); + } + rcu_read_unlock(); +@@ -1276,7 +1284,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + + mtu = READ_ONCE(dst->dev->mtu); + +- if (unlikely(dst_metric_locked(dst, RTAX_MTU))) { ++ if (unlikely(ip_mtu_locked(dst))) { + if (rt->rt_uses_gateway && mtu > 576) + mtu = 576; + } +@@ -1548,6 +1556,7 @@ struct rtable *rt_dst_alloc(struct net_device *dev, + rt->rt_is_input = 0; + rt->rt_iif = 0; + rt->rt_pmtu = 0; ++ rt->rt_mtu_locked = 0; + rt->rt_gateway = 0; + rt->rt_uses_gateway = 0; + rt->rt_table_id = 0; +@@ -2526,6 +2535,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or + rt->rt_is_input = ort->rt_is_input; + rt->rt_iif = ort->rt_iif; + rt->rt_pmtu = ort->rt_pmtu; ++ rt->rt_mtu_locked = ort->rt_mtu_locked; + + rt->rt_genid = rt_genid_ipv4(net); + rt->rt_flags = ort->rt_flags; +@@ -2628,6 +2638,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src, u32 table_id, + memcpy(metrics, dst_metrics_ptr(&rt->dst), sizeof(metrics)); + if (rt->rt_pmtu && expires) + metrics[RTAX_MTU - 1] = rt->rt_pmtu; ++ if (rt->rt_mtu_locked && expires) ++ metrics[RTAX_LOCK - 1] |= BIT(RTAX_MTU); + if (rtnetlink_put_metrics(skb, metrics) < 0) + goto nla_put_failure; + +diff --git a/net/ipv4/tcp_illinois.c b/net/ipv4/tcp_illinois.c +index 7c843578f233..faddf4f9a707 100644 +--- a/net/ipv4/tcp_illinois.c ++++ b/net/ipv4/tcp_illinois.c +@@ -6,7 +6,7 @@ + * The algorithm is described in: + * "TCP-Illinois: A Loss and Delay-Based Congestion Control Algorithm + * for High-Speed Networks" +- * http://www.ifp.illinois.edu/~srikant/Papers/liubassri06perf.pdf ++ * http://tamerbasar.csl.illinois.edu/LiuBasarSrikantPerfEvalArtJun2008.pdf + * + * Implemented from description in paper and ns-2 simulation. + * Copyright (C) 2007 Stephen Hemminger +diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c +index 05017e2c849c..4b586e7d5637 100644 +--- a/net/ipv4/xfrm4_policy.c ++++ b/net/ipv4/xfrm4_policy.c +@@ -100,6 +100,7 @@ static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev, + xdst->u.rt.rt_gateway = rt->rt_gateway; + xdst->u.rt.rt_uses_gateway = rt->rt_uses_gateway; + xdst->u.rt.rt_pmtu = rt->rt_pmtu; ++ xdst->u.rt.rt_mtu_locked = rt->rt_mtu_locked; + xdst->u.rt.rt_table_id = rt->rt_table_id; + INIT_LIST_HEAD(&xdst->u.rt.rt_uncached); + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index d61a82fd4b60..565a0388587a 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1990,14 +1990,14 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev, + { + struct net *net = dev_net(dev); + struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id); +- struct ip6_tnl *nt, *t; + struct ip_tunnel_encap ipencap; ++ struct ip6_tnl *nt, *t; ++ int err; + + nt = netdev_priv(dev); + + if (ip6_tnl_netlink_encap_parms(data, &ipencap)) { +- int err = ip6_tnl_encap_setup(nt, &ipencap); +- ++ err = ip6_tnl_encap_setup(nt, &ipencap); + if (err < 0) + return err; + } +@@ -2013,7 +2013,11 @@ static int ip6_tnl_newlink(struct net *src_net, struct net_device *dev, + return -EEXIST; + } + +- return ip6_tnl_create2(dev); ++ err = ip6_tnl_create2(dev); ++ if (!err && tb[IFLA_MTU]) ++ ip6_tnl_change_mtu(dev, nla_get_u32(tb[IFLA_MTU])); ++ ++ return err; + } + + static int ip6_tnl_changelink(struct net_device *dev, struct nlattr *tb[], +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 2493a40bc4b1..0e0ab90a4334 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -852,7 +852,7 @@ static void vti6_dev_setup(struct net_device *dev) + dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr); + dev->mtu = ETH_DATA_LEN; + dev->min_mtu = IPV6_MIN_MTU; +- dev->max_mtu = IP_MAX_MTU; ++ dev->max_mtu = IP_MAX_MTU - sizeof(struct ipv6hdr); + dev->flags |= IFF_NOARP; + dev->addr_len = sizeof(struct in6_addr); + netif_keep_dst(dev); +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index b35d8905794c..ad1e7e6ce009 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1569,6 +1569,13 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev, + if (err < 0) + return err; + ++ if (tb[IFLA_MTU]) { ++ u32 mtu = nla_get_u32(tb[IFLA_MTU]); ++ ++ if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len) ++ dev->mtu = mtu; ++ } ++ + #ifdef CONFIG_IPV6_SIT_6RD + if (ipip6_netlink_6rd_parms(data, &ip6rd)) + err = ipip6_tunnel_update_6rd(nt, &ip6rd); +diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c +index f8d4ab8ca1a5..4b60f68cb492 100644 +--- a/net/llc/llc_c_ac.c ++++ b/net/llc/llc_c_ac.c +@@ -389,7 +389,7 @@ static int llc_conn_ac_send_i_cmd_p_set_0(struct sock *sk, struct sk_buff *skb) + llc_pdu_init_as_i_cmd(skb, 0, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { +- llc_conn_send_pdu(sk, skb); ++ rc = llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } + return rc; +@@ -916,7 +916,7 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk, + llc_pdu_init_as_i_cmd(skb, llc->ack_pf, llc->vS, llc->vR); + rc = llc_mac_hdr_init(skb, llc->dev->dev_addr, llc->daddr.mac); + if (likely(!rc)) { +- llc_conn_send_pdu(sk, skb); ++ rc = llc_conn_send_pdu(sk, skb); + llc_conn_ac_inc_vs_by_1(sk, skb); + } + return rc; +@@ -935,14 +935,17 @@ static int llc_conn_ac_send_i_rsp_f_set_ackpf(struct sock *sk, + int llc_conn_ac_send_i_as_ack(struct sock *sk, struct sk_buff *skb) + { + struct llc_sock *llc = llc_sk(sk); ++ int ret; + + if (llc->ack_must_be_send) { +- llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb); ++ ret = llc_conn_ac_send_i_rsp_f_set_ackpf(sk, skb); + llc->ack_must_be_send = 0 ; + llc->ack_pf = 0; +- } else +- llc_conn_ac_send_i_cmd_p_set_0(sk, skb); +- return 0; ++ } else { ++ ret = llc_conn_ac_send_i_cmd_p_set_0(sk, skb); ++ } ++ ++ return ret; + } + + /** +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index 9a42448eb182..b084fd19ad32 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -30,7 +30,7 @@ + #endif + + static int llc_find_offset(int state, int ev_type); +-static void llc_conn_send_pdus(struct sock *sk); ++static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *skb); + static int llc_conn_service(struct sock *sk, struct sk_buff *skb); + static int llc_exec_conn_trans_actions(struct sock *sk, + struct llc_conn_state_trans *trans, +@@ -193,11 +193,11 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb) + return rc; + } + +-void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) ++int llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb) + { + /* queue PDU to send to MAC layer */ + skb_queue_tail(&sk->sk_write_queue, skb); +- llc_conn_send_pdus(sk); ++ return llc_conn_send_pdus(sk, skb); + } + + /** +@@ -255,7 +255,7 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit) + if (howmany_resend > 0) + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; + /* any PDUs to re-send are queued up; start sending to MAC */ +- llc_conn_send_pdus(sk); ++ llc_conn_send_pdus(sk, NULL); + out:; + } + +@@ -296,7 +296,7 @@ void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit) + if (howmany_resend > 0) + llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO; + /* any PDUs to re-send are queued up; start sending to MAC */ +- llc_conn_send_pdus(sk); ++ llc_conn_send_pdus(sk, NULL); + out:; + } + +@@ -340,12 +340,16 @@ int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked) + /** + * llc_conn_send_pdus - Sends queued PDUs + * @sk: active connection ++ * @hold_skb: the skb held by caller, or NULL if does not care + * +- * Sends queued pdus to MAC layer for transmission. ++ * Sends queued pdus to MAC layer for transmission. When @hold_skb is ++ * NULL, always return 0. Otherwise, return 0 if @hold_skb is sent ++ * successfully, or 1 for failure. + */ +-static void llc_conn_send_pdus(struct sock *sk) ++static int llc_conn_send_pdus(struct sock *sk, struct sk_buff *hold_skb) + { + struct sk_buff *skb; ++ int ret = 0; + + while ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL) { + struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb); +@@ -357,10 +361,20 @@ static void llc_conn_send_pdus(struct sock *sk) + skb_queue_tail(&llc_sk(sk)->pdu_unack_q, skb); + if (!skb2) + break; +- skb = skb2; ++ dev_queue_xmit(skb2); ++ } else { ++ bool is_target = skb == hold_skb; ++ int rc; ++ ++ if (is_target) ++ skb_get(skb); ++ rc = dev_queue_xmit(skb); ++ if (is_target) ++ ret = rc; + } +- dev_queue_xmit(skb); + } ++ ++ return ret; + } + + /** +diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c +index 2849a1fc41c5..3a7cfe01ee6d 100644 +--- a/net/mac80211/agg-rx.c ++++ b/net/mac80211/agg-rx.c +@@ -8,6 +8,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -322,9 +323,6 @@ void ___ieee80211_start_rx_ba_session(struct sta_info *sta, + * driver so reject the timeout update. + */ + status = WLAN_STATUS_REQUEST_DECLINED; +- ieee80211_send_addba_resp(sta->sdata, sta->sta.addr, +- tid, dialog_token, status, +- 1, buf_size, timeout); + goto end; + } + +diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h +index 9675814f64db..894937bcd479 100644 +--- a/net/mac80211/ieee80211_i.h ++++ b/net/mac80211/ieee80211_i.h +@@ -1466,7 +1466,7 @@ struct ieee802_11_elems { + const struct ieee80211_timeout_interval_ie *timeout_int; + const u8 *opmode_notif; + const struct ieee80211_sec_chan_offs_ie *sec_chan_offs; +- const struct ieee80211_mesh_chansw_params_ie *mesh_chansw_params_ie; ++ struct ieee80211_mesh_chansw_params_ie *mesh_chansw_params_ie; + const struct ieee80211_bss_max_idle_period_ie *max_idle_period_ie; + + /* length of them, respectively */ +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index a550c707cd8a..96e57d7c2872 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -1253,13 +1253,12 @@ int ieee80211_mesh_csa_beacon(struct ieee80211_sub_if_data *sdata, + } + + static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata, +- struct ieee80211_mgmt *mgmt, size_t len) ++ struct ieee80211_mgmt *mgmt, size_t len, ++ struct ieee802_11_elems *elems) + { + struct ieee80211_mgmt *mgmt_fwd; + struct sk_buff *skb; + struct ieee80211_local *local = sdata->local; +- u8 *pos = mgmt->u.action.u.chan_switch.variable; +- size_t offset_ttl; + + skb = dev_alloc_skb(local->tx_headroom + len); + if (!skb) +@@ -1267,13 +1266,9 @@ static int mesh_fwd_csa_frame(struct ieee80211_sub_if_data *sdata, + skb_reserve(skb, local->tx_headroom); + mgmt_fwd = skb_put(skb, len); + +- /* offset_ttl is based on whether the secondary channel +- * offset is available or not. Subtract 1 from the mesh TTL +- * and disable the initiator flag before forwarding. +- */ +- offset_ttl = (len < 42) ? 7 : 10; +- *(pos + offset_ttl) -= 1; +- *(pos + offset_ttl + 1) &= ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR; ++ elems->mesh_chansw_params_ie->mesh_ttl--; ++ elems->mesh_chansw_params_ie->mesh_flags &= ++ ~WLAN_EID_CHAN_SWITCH_PARAM_INITIATOR; + + memcpy(mgmt_fwd, mgmt, len); + eth_broadcast_addr(mgmt_fwd->da); +@@ -1321,7 +1316,7 @@ static void mesh_rx_csa_frame(struct ieee80211_sub_if_data *sdata, + + /* forward or re-broadcast the CSA frame */ + if (fwd_csa) { +- if (mesh_fwd_csa_frame(sdata, mgmt, len) < 0) ++ if (mesh_fwd_csa_frame(sdata, mgmt, len, &elems) < 0) + mcsa_dbg(sdata, "Failed to forward the CSA frame"); + } + } +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 4daafb07602f..dddd498e1338 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3928,7 +3928,7 @@ static bool ieee80211_invoke_fast_rx(struct ieee80211_rx_data *rx, + if ((hdr->frame_control & cpu_to_le16(IEEE80211_FCTL_FROMDS | + IEEE80211_FCTL_TODS)) != + fast_rx->expected_ds_bits) +- goto drop; ++ return false; + + /* assign the key to drop unencrypted frames (later) + * and strip the IV/MIC if necessary +diff --git a/net/mac80211/spectmgmt.c b/net/mac80211/spectmgmt.c +index ee0181778a42..029334835747 100644 +--- a/net/mac80211/spectmgmt.c ++++ b/net/mac80211/spectmgmt.c +@@ -8,6 +8,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2008, Intel Corporation + * Copyright 2008, Johannes Berg ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -27,7 +28,7 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata, + u32 sta_flags, u8 *bssid, + struct ieee80211_csa_ie *csa_ie) + { +- enum nl80211_band new_band; ++ enum nl80211_band new_band = current_band; + int new_freq; + u8 new_chan_no; + struct ieee80211_channel *new_chan; +@@ -55,15 +56,13 @@ int ieee80211_parse_ch_switch_ie(struct ieee80211_sub_if_data *sdata, + elems->ext_chansw_ie->new_operating_class, + &new_band)) { + sdata_info(sdata, +- "cannot understand ECSA IE operating class %d, disconnecting\n", ++ "cannot understand ECSA IE operating class, %d, ignoring\n", + elems->ext_chansw_ie->new_operating_class); +- return -EINVAL; + } + new_chan_no = elems->ext_chansw_ie->new_ch_num; + csa_ie->count = elems->ext_chansw_ie->count; + csa_ie->mode = elems->ext_chansw_ie->mode; + } else if (elems->ch_switch_ie) { +- new_band = current_band; + new_chan_no = elems->ch_switch_ie->new_ch_num; + csa_ie->count = elems->ch_switch_ie->count; + csa_ie->mode = elems->ch_switch_ie->mode; +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 69615016d5bf..f1b496222bda 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -314,7 +314,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, + + if (ieee80211_hw_check(hw, USES_RSS)) { + sta->pcpu_rx_stats = +- alloc_percpu(struct ieee80211_sta_rx_stats); ++ alloc_percpu_gfp(struct ieee80211_sta_rx_stats, gfp); + if (!sta->pcpu_rx_stats) + goto free; + } +@@ -439,6 +439,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, + if (sta->sta.txq[0]) + kfree(to_txq_info(sta->sta.txq[0])); + free: ++ free_percpu(sta->pcpu_rx_stats); + #ifdef CONFIG_MAC80211_MESH + kfree(sta->mesh); + #endif +diff --git a/net/netfilter/ipvs/ip_vs_ftp.c b/net/netfilter/ipvs/ip_vs_ftp.c +index 3e17d32b629d..58d5d05aec24 100644 +--- a/net/netfilter/ipvs/ip_vs_ftp.c ++++ b/net/netfilter/ipvs/ip_vs_ftp.c +@@ -260,7 +260,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp, + buf_len = strlen(buf); + + ct = nf_ct_get(skb, &ctinfo); +- if (ct && (ct->status & IPS_NAT_MASK)) { ++ if (ct) { + bool mangled; + + /* If mangling fails this function will return 0 +diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c +index 22dc1b9d6362..c070dfc0190a 100644 +--- a/net/netlabel/netlabel_unlabeled.c ++++ b/net/netlabel/netlabel_unlabeled.c +@@ -1472,6 +1472,16 @@ int netlbl_unlabel_getattr(const struct sk_buff *skb, + iface = rcu_dereference(netlbl_unlhsh_def); + if (iface == NULL || !iface->valid) + goto unlabel_getattr_nolabel; ++ ++#if IS_ENABLED(CONFIG_IPV6) ++ /* When resolving a fallback label, check the sk_buff version as ++ * it is possible (e.g. SCTP) to have family = PF_INET6 while ++ * receiving ip_hdr(skb)->version = 4. ++ */ ++ if (family == PF_INET6 && ip_hdr(skb)->version == 4) ++ family = PF_INET; ++#endif /* IPv6 */ ++ + switch (family) { + case PF_INET: { + struct iphdr *hdr4; +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index 367d8c027101..2ceefa183cee 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -149,6 +149,10 @@ struct nfc_llcp_sdp_tlv *nfc_llcp_build_sdreq_tlv(u8 tid, char *uri, + + pr_debug("uri: %s, len: %zu\n", uri, uri_len); + ++ /* sdreq->tlv_len is u8, takes uri_len, + 3 for header, + 1 for NULL */ ++ if (WARN_ON_ONCE(uri_len > U8_MAX - 4)) ++ return NULL; ++ + sdreq = kzalloc(sizeof(struct nfc_llcp_sdp_tlv), GFP_KERNEL); + if (sdreq == NULL) + return NULL; +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index b251fb936a27..08ed6abe4aae 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -61,7 +61,8 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { + }; + + static const struct nla_policy nfc_sdp_genl_policy[NFC_SDP_ATTR_MAX + 1] = { +- [NFC_SDP_ATTR_URI] = { .type = NLA_STRING }, ++ [NFC_SDP_ATTR_URI] = { .type = NLA_STRING, ++ .len = U8_MAX - 4 }, + [NFC_SDP_ATTR_SAP] = { .type = NLA_U8 }, + }; + +diff --git a/net/qrtr/smd.c b/net/qrtr/smd.c +index 50615d5efac1..9cf089b9754e 100644 +--- a/net/qrtr/smd.c ++++ b/net/qrtr/smd.c +@@ -114,5 +114,6 @@ static struct rpmsg_driver qcom_smd_qrtr_driver = { + + module_rpmsg_driver(qcom_smd_qrtr_driver); + ++MODULE_ALIAS("rpmsg:IPCRTR"); + MODULE_DESCRIPTION("Qualcomm IPC-Router SMD interface driver"); + MODULE_LICENSE("GPL v2"); +diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c +index c061d6eb465d..22571189f21e 100644 +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -1,5 +1,5 @@ + /* +- * Copyright (c) 2006 Oracle. All rights reserved. ++ * Copyright (c) 2006, 2018 Oracle. All rights reserved. + * + * This software is available to you under a choice of one of two + * licenses. You may choose to be licensed under the terms of the GNU +@@ -142,12 +142,20 @@ int rds_tcp_accept_one(struct socket *sock) + if (ret) + goto out; + +- new_sock->type = sock->type; +- new_sock->ops = sock->ops; + ret = sock->ops->accept(sock, new_sock, O_NONBLOCK, true); + if (ret < 0) + goto out; + ++ /* sock_create_lite() does not get a hold on the owner module so we ++ * need to do it here. Note that sock_release() uses sock->ops to ++ * determine if it needs to decrement the reference count. So set ++ * sock->ops after calling accept() in case that fails. And there's ++ * no need to do try_module_get() as the listener should have a hold ++ * already. ++ */ ++ new_sock->ops = sock->ops; ++ __module_get(new_sock->ops->owner); ++ + ret = rds_tcp_keepalive(new_sock); + if (ret < 0) + goto out; +diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c +index e56e23ed2229..5edb636dbc4d 100644 +--- a/net/rxrpc/input.c ++++ b/net/rxrpc/input.c +@@ -1175,16 +1175,19 @@ void rxrpc_data_ready(struct sock *udp_sk) + goto discard_unlock; + + if (sp->hdr.callNumber == chan->last_call) { +- /* For the previous service call, if completed successfully, we +- * discard all further packets. ++ if (chan->call || ++ sp->hdr.type == RXRPC_PACKET_TYPE_ABORT) ++ goto discard_unlock; ++ ++ /* For the previous service call, if completed ++ * successfully, we discard all further packets. + */ + if (rxrpc_conn_is_service(conn) && +- (chan->last_type == RXRPC_PACKET_TYPE_ACK || +- sp->hdr.type == RXRPC_PACKET_TYPE_ABORT)) ++ chan->last_type == RXRPC_PACKET_TYPE_ACK) + goto discard_unlock; + +- /* But otherwise we need to retransmit the final packet from +- * data cached in the connection record. ++ /* But otherwise we need to retransmit the final packet ++ * from data cached in the connection record. + */ + rxrpc_post_packet_to_conn(conn, skb); + goto out_unlock; +diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c +index bdece21f313d..abcf48026d99 100644 +--- a/net/rxrpc/recvmsg.c ++++ b/net/rxrpc/recvmsg.c +@@ -513,9 +513,10 @@ int rxrpc_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, + ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID, + sizeof(unsigned int), &id32); + } else { ++ unsigned long idl = call->user_call_ID; ++ + ret = put_cmsg(msg, SOL_RXRPC, RXRPC_USER_CALL_ID, +- sizeof(unsigned long), +- &call->user_call_ID); ++ sizeof(unsigned long), &idl); + } + if (ret < 0) + goto error_unlock_call; +diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c +index d2f51d6a253c..016e293681b8 100644 +--- a/net/rxrpc/sendmsg.c ++++ b/net/rxrpc/sendmsg.c +@@ -92,7 +92,9 @@ static inline void rxrpc_instant_resend(struct rxrpc_call *call, int ix) + spin_lock_bh(&call->lock); + + if (call->state < RXRPC_CALL_COMPLETE) { +- call->rxtx_annotations[ix] = RXRPC_TX_ANNO_RETRANS; ++ call->rxtx_annotations[ix] = ++ (call->rxtx_annotations[ix] & RXRPC_TX_ANNO_LAST) | ++ RXRPC_TX_ANNO_RETRANS; + if (!test_and_set_bit(RXRPC_CALL_EV_RESEND, &call->events)) + rxrpc_queue_call(call); + } +diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c +index 2b087623fb1d..364a878e51cb 100644 +--- a/net/sched/act_bpf.c ++++ b/net/sched/act_bpf.c +@@ -356,7 +356,7 @@ static int tcf_bpf_init(struct net *net, struct nlattr *nla, + return res; + out: + if (res == ACT_P_CREATED) +- tcf_idr_cleanup(*act, est); ++ tcf_idr_release(*act, bind); + + return ret; + } +diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c +index d9e399a7e3d5..18b2fd2ba7d7 100644 +--- a/net/sched/act_ipt.c ++++ b/net/sched/act_ipt.c +@@ -80,9 +80,12 @@ static void ipt_destroy_target(struct xt_entry_target *t) + static void tcf_ipt_release(struct tc_action *a, int bind) + { + struct tcf_ipt *ipt = to_ipt(a); +- ipt_destroy_target(ipt->tcfi_t); ++ ++ if (ipt->tcfi_t) { ++ ipt_destroy_target(ipt->tcfi_t); ++ kfree(ipt->tcfi_t); ++ } + kfree(ipt->tcfi_tname); +- kfree(ipt->tcfi_t); + } + + static const struct nla_policy ipt_policy[TCA_IPT_MAX + 1] = { +@@ -187,7 +190,7 @@ static int __tcf_ipt_init(struct net *net, unsigned int id, struct nlattr *nla, + kfree(tname); + err1: + if (ret == ACT_P_CREATED) +- tcf_idr_cleanup(*a, est); ++ tcf_idr_release(*a, bind); + return err; + } + +diff --git a/net/sched/act_pedit.c b/net/sched/act_pedit.c +index 491fe5deb09e..51ab463d9e16 100644 +--- a/net/sched/act_pedit.c ++++ b/net/sched/act_pedit.c +@@ -176,7 +176,7 @@ static int tcf_pedit_init(struct net *net, struct nlattr *nla, + p = to_pedit(*a); + keys = kmalloc(ksize, GFP_KERNEL); + if (keys == NULL) { +- tcf_idr_cleanup(*a, est); ++ tcf_idr_release(*a, bind); + kfree(keys_ex); + return -ENOMEM; + } +diff --git a/net/sched/act_police.c b/net/sched/act_police.c +index 3bb2ebf9e9ae..c16127109f21 100644 +--- a/net/sched/act_police.c ++++ b/net/sched/act_police.c +@@ -194,7 +194,7 @@ static int tcf_act_police_init(struct net *net, struct nlattr *nla, + qdisc_put_rtab(P_tab); + qdisc_put_rtab(R_tab); + if (ret == ACT_P_CREATED) +- tcf_idr_cleanup(*a, est); ++ tcf_idr_release(*a, bind); + return err; + } + +diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c +index 8b5abcd2f32f..53752b9327d0 100644 +--- a/net/sched/act_sample.c ++++ b/net/sched/act_sample.c +@@ -103,7 +103,8 @@ static void tcf_sample_cleanup_rcu(struct rcu_head *rcu) + + psample_group = rcu_dereference_protected(s->psample_group, 1); + RCU_INIT_POINTER(s->psample_group, NULL); +- psample_group_put(psample_group); ++ if (psample_group) ++ psample_group_put(psample_group); + } + + static void tcf_sample_cleanup(struct tc_action *a, int bind) +diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c +index e7b57e5071a3..b5f80e675783 100644 +--- a/net/sched/act_simple.c ++++ b/net/sched/act_simple.c +@@ -121,7 +121,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla, + d = to_defact(*a); + ret = alloc_defdata(d, defdata); + if (ret < 0) { +- tcf_idr_cleanup(*a, est); ++ tcf_idr_release(*a, bind); + return ret; + } + d->tcf_action = parm->action; +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index 821823b2518a..d227599f7e73 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -155,7 +155,7 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla, + ASSERT_RTNL(); + p = kzalloc(sizeof(struct tcf_skbmod_params), GFP_KERNEL); + if (unlikely(!p)) { +- if (ovr) ++ if (ret == ACT_P_CREATED) + tcf_idr_release(*a, bind); + return -ENOMEM; + } +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index 7166e7ecbe86..f04a037dc967 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -174,6 +174,7 @@ static int smc_lgr_create(struct smc_sock *smc, __be32 peer_in_addr, + + lnk = &lgr->lnk[SMC_SINGLE_LINK]; + /* initialize link */ ++ lnk->link_id = SMC_SINGLE_LINK; + lnk->smcibdev = smcibdev; + lnk->ibport = ibport; + lnk->path_mtu = smcibdev->pattr[ibport - 1].active_mtu; +diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c +index 9033b8a36fe1..4410d0071515 100644 +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -23,6 +23,8 @@ + #include "smc_wr.h" + #include "smc.h" + ++#define SMC_MAX_CQE 32766 /* max. # of completion queue elements */ ++ + #define SMC_QP_MIN_RNR_TIMER 5 + #define SMC_QP_TIMEOUT 15 /* 4096 * 2 ** timeout usec */ + #define SMC_QP_RETRY_CNT 7 /* 7: infinite */ +@@ -435,9 +437,15 @@ int smc_ib_remember_port_attr(struct smc_ib_device *smcibdev, u8 ibport) + long smc_ib_setup_per_ibdev(struct smc_ib_device *smcibdev) + { + struct ib_cq_init_attr cqattr = { +- .cqe = SMC_WR_MAX_CQE, .comp_vector = 0 }; ++ .cqe = SMC_MAX_CQE, .comp_vector = 0 }; ++ int cqe_size_order, smc_order; + long rc; + ++ /* the calculated number of cq entries fits to mlx5 cq allocation */ ++ cqe_size_order = cache_line_size() == 128 ? 7 : 6; ++ smc_order = MAX_ORDER - cqe_size_order - 1; ++ if (SMC_MAX_CQE + 2 > (0x00000001 << smc_order) * PAGE_SIZE) ++ cqattr.cqe = (0x00000001 << smc_order) * PAGE_SIZE - 2; + smcibdev->roce_cq_send = ib_create_cq(smcibdev->ibdev, + smc_wr_tx_cq_handler, NULL, + smcibdev, &cqattr); +diff --git a/net/smc/smc_llc.c b/net/smc/smc_llc.c +index 92fe4cc8c82c..b4aa4fcedb96 100644 +--- a/net/smc/smc_llc.c ++++ b/net/smc/smc_llc.c +@@ -92,7 +92,7 @@ int smc_llc_send_confirm_link(struct smc_link *link, u8 mac[], + memcpy(confllc->sender_mac, mac, ETH_ALEN); + memcpy(confllc->sender_gid, gid, SMC_GID_SIZE); + hton24(confllc->sender_qp_num, link->roce_qp->qp_num); +- /* confllc->link_num = SMC_SINGLE_LINK; already done by memset above */ ++ confllc->link_num = link->link_id; + memcpy(confllc->link_uid, lgr->id, SMC_LGR_ID_SIZE); + confllc->max_links = SMC_LINKS_PER_LGR_MAX; + /* send llc message */ +diff --git a/net/smc/smc_wr.h b/net/smc/smc_wr.h +index 2acf12b06063..c307402e67d6 100644 +--- a/net/smc/smc_wr.h ++++ b/net/smc/smc_wr.h +@@ -19,7 +19,6 @@ + #include "smc.h" + #include "smc_core.h" + +-#define SMC_WR_MAX_CQE 32768 /* max. # of completion queue elements */ + #define SMC_WR_BUF_CNT 16 /* # of ctrl buffers per link */ + + #define SMC_WR_TX_WAIT_FREE_SLOT_TIME (10 * HZ) +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index dfef930d1e50..ffb1a3a69bdd 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -299,7 +299,8 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval, + goto out; + } + lock_sock(sk); +- memcpy(crypto_info_aes_gcm_128->iv, ctx->iv, ++ memcpy(crypto_info_aes_gcm_128->iv, ++ ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE, + TLS_CIPHER_AES_GCM_128_IV_SIZE); + release_sock(sk); + if (copy_to_user(optval, +diff --git a/net/wireless/sme.c b/net/wireless/sme.c +index 3dd05a08c60a..d014aea07160 100644 +--- a/net/wireless/sme.c ++++ b/net/wireless/sme.c +@@ -989,6 +989,8 @@ void __cfg80211_disconnected(struct net_device *dev, const u8 *ie, + wdev->current_bss = NULL; + wdev->ssid_len = 0; + wdev->conn_owner_nlportid = 0; ++ kzfree(wdev->connect_keys); ++ wdev->connect_keys = NULL; + + nl80211_send_disconnected(rdev, dev, reason, ie, ie_len, from_ap); + +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 5b2409746ae0..9f492dc417d5 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -26,6 +26,12 @@ struct xfrm_trans_tasklet { + }; + + struct xfrm_trans_cb { ++ union { ++ struct inet_skb_parm h4; ++#if IS_ENABLED(CONFIG_IPV6) ++ struct inet6_skb_parm h6; ++#endif ++ } header; + int (*finish)(struct net *net, struct sock *sk, struct sk_buff *skb); + }; + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 73ad8c8ef344..35610cc881a9 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -285,8 +285,9 @@ void xfrm_local_error(struct sk_buff *skb, int mtu) + return; + + afinfo = xfrm_state_get_afinfo(proto); +- if (afinfo) ++ if (afinfo) { + afinfo->local_error(skb, mtu); +- rcu_read_unlock(); ++ rcu_read_unlock(); ++ } + } + EXPORT_SYMBOL_GPL(xfrm_local_error); +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 7d17c207fc8a..9c57d6a5816c 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1459,10 +1459,13 @@ xfrm_tmpl_resolve(struct xfrm_policy **pols, int npols, const struct flowi *fl, + static int xfrm_get_tos(const struct flowi *fl, int family) + { + const struct xfrm_policy_afinfo *afinfo; +- int tos = 0; ++ int tos; + + afinfo = xfrm_policy_get_afinfo(family); +- tos = afinfo ? afinfo->get_tos(fl) : 0; ++ if (!afinfo) ++ return 0; ++ ++ tos = afinfo->get_tos(fl); + + rcu_read_unlock(); + +diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c +index 02501817227b..bdb9b5121ba8 100644 +--- a/net/xfrm/xfrm_replay.c ++++ b/net/xfrm/xfrm_replay.c +@@ -658,7 +658,7 @@ static int xfrm_replay_overflow_offload_esn(struct xfrm_state *x, struct sk_buff + } else { + XFRM_SKB_CB(skb)->seq.output.low = oseq + 1; + XFRM_SKB_CB(skb)->seq.output.hi = oseq_hi; +- xo->seq.low = oseq = oseq + 1; ++ xo->seq.low = oseq + 1; + xo->seq.hi = oseq_hi; + oseq += skb_shinfo(skb)->gso_segs; + } +diff --git a/scripts/adjust_autoksyms.sh b/scripts/adjust_autoksyms.sh +index 513da1a4a2da..d67830e6e360 100755 +--- a/scripts/adjust_autoksyms.sh ++++ b/scripts/adjust_autoksyms.sh +@@ -84,6 +84,13 @@ while read sympath; do + depfile="include/config/ksym/${sympath}.h" + mkdir -p "$(dirname "$depfile")" + touch "$depfile" ++ # Filesystems with coarse time precision may create timestamps ++ # equal to the one from a file that was very recently built and that ++ # needs to be rebuild. Let's guard against that by making sure our ++ # dep files are always newer than the first file we created here. ++ while [ ! "$depfile" -nt "$new_ksyms_file" ]; do ++ touch "$depfile" ++ done + echo $((count += 1)) + done | tail -1 ) + changed=${changed:-0} +diff --git a/scripts/package/builddeb b/scripts/package/builddeb +index 0bc87473f68f..e15159d0a884 100755 +--- a/scripts/package/builddeb ++++ b/scripts/package/builddeb +@@ -313,7 +313,7 @@ fi + + # Build kernel header package + (cd $srctree; find . -name Makefile\* -o -name Kconfig\* -o -name \*.pl) > "$objtree/debian/hdrsrcfiles" +-(cd $srctree; find arch/*/include include scripts -type f) >> "$objtree/debian/hdrsrcfiles" ++(cd $srctree; find arch/*/include include scripts -type f -o -type l) >> "$objtree/debian/hdrsrcfiles" + (cd $srctree; find arch/$SRCARCH -name module.lds -o -name Kbuild.platforms -o -name Platform) >> "$objtree/debian/hdrsrcfiles" + (cd $srctree; find $(find arch/$SRCARCH -name include -o -name scripts -type d) -type f) >> "$objtree/debian/hdrsrcfiles" + if grep -q '^CONFIG_STACK_VALIDATION=y' $KCONFIG_CONFIG ; then +diff --git a/security/integrity/digsig.c b/security/integrity/digsig.c +index 06554c448dce..9676c8887da9 100644 +--- a/security/integrity/digsig.c ++++ b/security/integrity/digsig.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + +diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig +index 35ef69312811..6a8f67714c83 100644 +--- a/security/integrity/ima/Kconfig ++++ b/security/integrity/ima/Kconfig +@@ -10,6 +10,7 @@ config IMA + select CRYPTO_HASH_INFO + select TCG_TPM if HAS_IOMEM && !UML + select TCG_TIS if TCG_TPM && X86 ++ select TCG_CRB if TCG_TPM && ACPI + select TCG_IBMVTPM if TCG_TPM && PPC_PSERIES + help + The Trusted Computing Group(TCG) runtime Integrity +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index 802d5d20f36f..90453aa1c813 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -78,6 +78,8 @@ int __init ima_init_crypto(void) + hash_algo_name[ima_hash_algo], rc); + return rc; + } ++ pr_info("Allocated hash algorithm: %s\n", ++ hash_algo_name[ima_hash_algo]); + return 0; + } + +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index ab70a395f490..7e334fd31c15 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -16,6 +16,9 @@ + * implements the IMA hooks: ima_bprm_check, ima_file_mmap, + * and ima_file_check. + */ ++ ++#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt ++ + #include + #include + #include +@@ -427,6 +430,16 @@ static int __init init_ima(void) + ima_init_template_list(); + hash_setup(CONFIG_IMA_DEFAULT_HASH); + error = ima_init(); ++ ++ if (error && strcmp(hash_algo_name[ima_hash_algo], ++ CONFIG_IMA_DEFAULT_HASH) != 0) { ++ pr_info("Allocating %s failed, going to use default hash algorithm %s\n", ++ hash_algo_name[ima_hash_algo], CONFIG_IMA_DEFAULT_HASH); ++ hash_setup_done = 0; ++ hash_setup(CONFIG_IMA_DEFAULT_HASH); ++ error = ima_init(); ++ } ++ + if (!error) { + ima_initialized = 1; + ima_update_policy_flag(); +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 15e82a656d96..4fdc9e11e832 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -592,7 +592,7 @@ static int snd_timer_stop1(struct snd_timer_instance *timeri, bool stop) + else + timeri->flags |= SNDRV_TIMER_IFLG_PAUSED; + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : +- SNDRV_TIMER_EVENT_CONTINUE); ++ SNDRV_TIMER_EVENT_PAUSE); + unlock: + spin_unlock_irqrestore(&timer->lock, flags); + return result; +@@ -614,7 +614,7 @@ static int snd_timer_stop_slave(struct snd_timer_instance *timeri, bool stop) + list_del_init(&timeri->ack_list); + list_del_init(&timeri->active_list); + snd_timer_notify1(timeri, stop ? SNDRV_TIMER_EVENT_STOP : +- SNDRV_TIMER_EVENT_CONTINUE); ++ SNDRV_TIMER_EVENT_PAUSE); + spin_unlock(&timeri->timer->lock); + } + spin_unlock_irqrestore(&slave_active_lock, flags); +diff --git a/sound/core/vmaster.c b/sound/core/vmaster.c +index 8632301489fa..b67de2bb06a2 100644 +--- a/sound/core/vmaster.c ++++ b/sound/core/vmaster.c +@@ -68,10 +68,13 @@ static int slave_update(struct link_slave *slave) + return -ENOMEM; + uctl->id = slave->slave.id; + err = slave->slave.get(&slave->slave, uctl); ++ if (err < 0) ++ goto error; + for (ch = 0; ch < slave->info.count; ch++) + slave->vals[ch] = uctl->value.integer.value[ch]; ++ error: + kfree(uctl); +- return 0; ++ return err < 0 ? err : 0; + } + + /* get the slave ctl info and save the initial values */ +diff --git a/tools/hv/hv_fcopy_daemon.c b/tools/hv/hv_fcopy_daemon.c +index 457a1521f32f..785f4e95148c 100644 +--- a/tools/hv/hv_fcopy_daemon.c ++++ b/tools/hv/hv_fcopy_daemon.c +@@ -23,13 +23,14 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + + static int target_fd; +-static char target_fname[W_MAX_PATH]; ++static char target_fname[PATH_MAX]; + static unsigned long long filesize; + + static int hv_start_fcopy(struct hv_start_fcopy *smsg) +diff --git a/tools/hv/hv_vss_daemon.c b/tools/hv/hv_vss_daemon.c +index b2b4ebffab8c..34031a297f02 100644 +--- a/tools/hv/hv_vss_daemon.c ++++ b/tools/hv/hv_vss_daemon.c +@@ -22,6 +22,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf +index 91ef44bfaf3e..2a858ea56a81 100644 +--- a/tools/perf/Makefile.perf ++++ b/tools/perf/Makefile.perf +@@ -368,7 +368,8 @@ LIBS = -Wl,--whole-archive $(PERFLIBS) $(EXTRA_PERFLIBS) -Wl,--no-whole-archive + + ifeq ($(USE_CLANG), 1) + CLANGLIBS_LIST = AST Basic CodeGen Driver Frontend Lex Tooling Edit Sema Analysis Parse Serialization +- LIBCLANG = $(foreach l,$(CLANGLIBS_LIST),$(wildcard $(shell $(LLVM_CONFIG) --libdir)/libclang$(l).a)) ++ CLANGLIBS_NOEXT_LIST = $(foreach l,$(CLANGLIBS_LIST),$(shell $(LLVM_CONFIG) --libdir)/libclang$(l)) ++ LIBCLANG = $(foreach l,$(CLANGLIBS_NOEXT_LIST),$(wildcard $(l).a $(l).so)) + LIBS += -Wl,--start-group $(LIBCLANG) -Wl,--end-group + endif + +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index b205c1340456..3b570e808b31 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -926,6 +926,15 @@ static int __cmd_record(struct record *rec, int argc, const char **argv) + } + } + ++ /* ++ * If we have just single event and are sending data ++ * through pipe, we need to force the ids allocation, ++ * because we synthesize event name through the pipe ++ * and need the id for that. ++ */ ++ if (data->is_pipe && rec->evlist->nr_entries == 1) ++ rec->opts.sample_id = true; ++ + if (record__open(rec) != 0) { + err = -1; + goto out_child; +diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c +index 9df0af17e9c2..52486c90ab93 100644 +--- a/tools/perf/builtin-stat.c ++++ b/tools/perf/builtin-stat.c +@@ -2185,11 +2185,16 @@ static int add_default_attributes(void) + return 0; + + if (transaction_run) { ++ struct parse_events_error errinfo; ++ + if (pmu_have_event("cpu", "cycles-ct") && + pmu_have_event("cpu", "el-start")) +- err = parse_events(evsel_list, transaction_attrs, NULL); ++ err = parse_events(evsel_list, transaction_attrs, ++ &errinfo); + else +- err = parse_events(evsel_list, transaction_limited_attrs, NULL); ++ err = parse_events(evsel_list, ++ transaction_limited_attrs, ++ &errinfo); + if (err) { + fprintf(stderr, "Cannot set up transaction events\n"); + return -1; +diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c +index dd57978b2096..3103a33c13a8 100644 +--- a/tools/perf/builtin-top.c ++++ b/tools/perf/builtin-top.c +@@ -1080,8 +1080,10 @@ parse_callchain_opt(const struct option *opt, const char *arg, int unset) + + static int perf_top_config(const char *var, const char *value, void *cb __maybe_unused) + { +- if (!strcmp(var, "top.call-graph")) +- var = "call-graph.record-mode"; /* fall-through */ ++ if (!strcmp(var, "top.call-graph")) { ++ var = "call-graph.record-mode"; ++ return perf_default_config(var, value, cb); ++ } + if (!strcmp(var, "top.children")) { + symbol_conf.cumulate_callchain = perf_config_bool(var, value); + return 0; +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index 55086389fc06..de1debcd3ee7 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -61,6 +61,7 @@ struct record_opts { + bool tail_synthesize; + bool overwrite; + bool ignore_missing_thread; ++ bool sample_id; + unsigned int freq; + unsigned int mmap_pages; + unsigned int auxtrace_mmap_pages; +diff --git a/tools/perf/tests/dwarf-unwind.c b/tools/perf/tests/dwarf-unwind.c +index 260418969120..2f008067d989 100644 +--- a/tools/perf/tests/dwarf-unwind.c ++++ b/tools/perf/tests/dwarf-unwind.c +@@ -37,6 +37,19 @@ static int init_live_machine(struct machine *machine) + mmap_handler, machine, true, 500); + } + ++/* ++ * We need to keep these functions global, despite the ++ * fact that they are used only locally in this object, ++ * in order to keep them around even if the binary is ++ * stripped. If they are gone, the unwind check for ++ * symbol fails. ++ */ ++int test_dwarf_unwind__thread(struct thread *thread); ++int test_dwarf_unwind__compare(void *p1, void *p2); ++int test_dwarf_unwind__krava_3(struct thread *thread); ++int test_dwarf_unwind__krava_2(struct thread *thread); ++int test_dwarf_unwind__krava_1(struct thread *thread); ++ + #define MAX_STACK 8 + + static int unwind_entry(struct unwind_entry *entry, void *arg) +@@ -45,12 +58,12 @@ static int unwind_entry(struct unwind_entry *entry, void *arg) + char *symbol = entry->sym ? entry->sym->name : NULL; + static const char *funcs[MAX_STACK] = { + "test__arch_unwind_sample", +- "unwind_thread", +- "compare", ++ "test_dwarf_unwind__thread", ++ "test_dwarf_unwind__compare", + "bsearch", +- "krava_3", +- "krava_2", +- "krava_1", ++ "test_dwarf_unwind__krava_3", ++ "test_dwarf_unwind__krava_2", ++ "test_dwarf_unwind__krava_1", + "test__dwarf_unwind" + }; + /* +@@ -77,7 +90,7 @@ static int unwind_entry(struct unwind_entry *entry, void *arg) + return strcmp((const char *) symbol, funcs[idx]); + } + +-static noinline int unwind_thread(struct thread *thread) ++noinline int test_dwarf_unwind__thread(struct thread *thread) + { + struct perf_sample sample; + unsigned long cnt = 0; +@@ -108,7 +121,7 @@ static noinline int unwind_thread(struct thread *thread) + + static int global_unwind_retval = -INT_MAX; + +-static noinline int compare(void *p1, void *p2) ++noinline int test_dwarf_unwind__compare(void *p1, void *p2) + { + /* Any possible value should be 'thread' */ + struct thread *thread = *(struct thread **)p1; +@@ -117,17 +130,17 @@ static noinline int compare(void *p1, void *p2) + /* Call unwinder twice for both callchain orders. */ + callchain_param.order = ORDER_CALLER; + +- global_unwind_retval = unwind_thread(thread); ++ global_unwind_retval = test_dwarf_unwind__thread(thread); + if (!global_unwind_retval) { + callchain_param.order = ORDER_CALLEE; +- global_unwind_retval = unwind_thread(thread); ++ global_unwind_retval = test_dwarf_unwind__thread(thread); + } + } + + return p1 - p2; + } + +-static noinline int krava_3(struct thread *thread) ++noinline int test_dwarf_unwind__krava_3(struct thread *thread) + { + struct thread *array[2] = {thread, thread}; + void *fp = &bsearch; +@@ -141,18 +154,19 @@ static noinline int krava_3(struct thread *thread) + size_t, int (*)(void *, void *)); + + _bsearch = fp; +- _bsearch(array, &thread, 2, sizeof(struct thread **), compare); ++ _bsearch(array, &thread, 2, sizeof(struct thread **), ++ test_dwarf_unwind__compare); + return global_unwind_retval; + } + +-static noinline int krava_2(struct thread *thread) ++noinline int test_dwarf_unwind__krava_2(struct thread *thread) + { +- return krava_3(thread); ++ return test_dwarf_unwind__krava_3(thread); + } + +-static noinline int krava_1(struct thread *thread) ++noinline int test_dwarf_unwind__krava_1(struct thread *thread) + { +- return krava_2(thread); ++ return test_dwarf_unwind__krava_2(thread); + } + + int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unused) +@@ -189,7 +203,7 @@ int test__dwarf_unwind(struct test *test __maybe_unused, int subtest __maybe_unu + goto out; + } + +- err = krava_1(thread); ++ err = test_dwarf_unwind__krava_1(thread); + thread__put(thread); + + out: +diff --git a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +index a2f757da49d9..73bea00f590f 100755 +--- a/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh ++++ b/tools/perf/tests/shell/trace+probe_libc_inet_pton.sh +@@ -21,12 +21,12 @@ trace_libc_inet_pton_backtrace() { + expected[3]=".*packets transmitted.*" + expected[4]="rtt min.*" + expected[5]="[0-9]+\.[0-9]+[[:space:]]+probe_libc:inet_pton:\([[:xdigit:]]+\)" +- expected[6]=".*inet_pton[[:space:]]\($libc\)$" ++ expected[6]=".*inet_pton[[:space:]]\($libc|inlined\)$" + case "$(uname -m)" in + s390x) + eventattr='call-graph=dwarf' +- expected[7]="gaih_inet[[:space:]]\(inlined\)$" +- expected[8]="__GI_getaddrinfo[[:space:]]\(inlined\)$" ++ expected[7]="gaih_inet.*[[:space:]]\($libc|inlined\)$" ++ expected[8]="__GI_getaddrinfo[[:space:]]\($libc|inlined\)$" + expected[9]="main[[:space:]]\(.*/bin/ping.*\)$" + expected[10]="__libc_start_main[[:space:]]\($libc\)$" + expected[11]="_start[[:space:]]\(.*/bin/ping.*\)$" +diff --git a/tools/perf/tests/vmlinux-kallsyms.c b/tools/perf/tests/vmlinux-kallsyms.c +index f6789fb029d6..884cad122acf 100644 +--- a/tools/perf/tests/vmlinux-kallsyms.c ++++ b/tools/perf/tests/vmlinux-kallsyms.c +@@ -125,7 +125,7 @@ int test__vmlinux_matches_kallsyms(struct test *test __maybe_unused, int subtest + + if (pair && UM(pair->start) == mem_start) { + next_pair: +- if (strcmp(sym->name, pair->name) == 0) { ++ if (arch__compare_symbol_names(sym->name, pair->name) == 0) { + /* + * kallsyms don't have the symbol end, so we + * set that by using the next symbol start - 1, +diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c +index 8f7f59d1a2b5..0c486d2683c4 100644 +--- a/tools/perf/ui/browsers/annotate.c ++++ b/tools/perf/ui/browsers/annotate.c +@@ -312,6 +312,7 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser) + struct map_symbol *ms = ab->b.priv; + struct symbol *sym = ms->sym; + u8 pcnt_width = annotate_browser__pcnt_width(ab); ++ int width = 0; + + /* PLT symbols contain external offsets */ + if (strstr(sym->name, "@plt")) +@@ -335,13 +336,17 @@ static void annotate_browser__draw_current_jump(struct ui_browser *browser) + to = (u64)btarget->idx; + } + ++ if (ab->have_cycles) ++ width = IPC_WIDTH + CYCLES_WIDTH; ++ + ui_browser__set_color(browser, HE_COLORSET_JUMP_ARROWS); +- __ui_browser__line_arrow(browser, pcnt_width + 2 + ab->addr_width, ++ __ui_browser__line_arrow(browser, ++ pcnt_width + 2 + ab->addr_width + width, + from, to); + + if (is_fused(ab, cursor)) { + ui_browser__mark_fused(browser, +- pcnt_width + 3 + ab->addr_width, ++ pcnt_width + 3 + ab->addr_width + width, + from - 1, + to > from ? true : false); + } +diff --git a/tools/perf/util/c++/clang.cpp b/tools/perf/util/c++/clang.cpp +index 1bfc946e37dc..bf31ceab33bd 100644 +--- a/tools/perf/util/c++/clang.cpp ++++ b/tools/perf/util/c++/clang.cpp +@@ -9,6 +9,7 @@ + * Copyright (C) 2016 Huawei Inc. + */ + ++#include "clang/Basic/Version.h" + #include "clang/CodeGen/CodeGenAction.h" + #include "clang/Frontend/CompilerInvocation.h" + #include "clang/Frontend/CompilerInstance.h" +@@ -58,7 +59,8 @@ createCompilerInvocation(llvm::opt::ArgStringList CFlags, StringRef& Path, + + FrontendOptions& Opts = CI->getFrontendOpts(); + Opts.Inputs.clear(); +- Opts.Inputs.emplace_back(Path, IK_C); ++ Opts.Inputs.emplace_back(Path, ++ FrontendOptions::getInputKindForExtension("c")); + return CI; + } + +@@ -71,10 +73,17 @@ getModuleFromSource(llvm::opt::ArgStringList CFlags, + + Clang.setVirtualFileSystem(&*VFS); + ++#if CLANG_VERSION_MAJOR < 4 + IntrusiveRefCntPtr CI = + createCompilerInvocation(std::move(CFlags), Path, + Clang.getDiagnostics()); + Clang.setInvocation(&*CI); ++#else ++ std::shared_ptr CI( ++ createCompilerInvocation(std::move(CFlags), Path, ++ Clang.getDiagnostics())); ++ Clang.setInvocation(CI); ++#endif + + std::unique_ptr Act(new EmitLLVMOnlyAction(&*LLVMCtx)); + if (!Clang.ExecuteAction(*Act)) +diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c +index 097473600d94..5d420209505e 100644 +--- a/tools/perf/util/hist.c ++++ b/tools/perf/util/hist.c +@@ -878,7 +878,7 @@ iter_prepare_cumulative_entry(struct hist_entry_iter *iter, + * cumulated only one time to prevent entries more than 100% + * overhead. + */ +- he_cache = malloc(sizeof(*he_cache) * (iter->max_stack + 1)); ++ he_cache = malloc(sizeof(*he_cache) * (callchain_cursor.nr + 1)); + if (he_cache == NULL) + return -ENOMEM; + +@@ -1043,8 +1043,6 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, + if (err) + return err; + +- iter->max_stack = max_stack_depth; +- + err = iter->ops->prepare_entry(iter, al); + if (err) + goto out; +diff --git a/tools/perf/util/hist.h b/tools/perf/util/hist.h +index f6630cb95eff..b99d68943f25 100644 +--- a/tools/perf/util/hist.h ++++ b/tools/perf/util/hist.h +@@ -107,7 +107,6 @@ struct hist_entry_iter { + int curr; + + bool hide_unresolved; +- int max_stack; + + struct perf_evsel *evsel; + struct perf_sample *sample; +diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c +index 1e97937b03a9..6f09e4962dad 100644 +--- a/tools/perf/util/record.c ++++ b/tools/perf/util/record.c +@@ -137,6 +137,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + struct perf_evsel *evsel; + bool use_sample_identifier = false; + bool use_comm_exec; ++ bool sample_id = opts->sample_id; + + /* + * Set the evsel leader links before we configure attributes, +@@ -163,8 +164,7 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + * match the id. + */ + use_sample_identifier = perf_can_sample_identifier(); +- evlist__for_each_entry(evlist, evsel) +- perf_evsel__set_sample_id(evsel, use_sample_identifier); ++ sample_id = true; + } else if (evlist->nr_entries > 1) { + struct perf_evsel *first = perf_evlist__first(evlist); + +@@ -174,6 +174,10 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + use_sample_identifier = perf_can_sample_identifier(); + break; + } ++ sample_id = true; ++ } ++ ++ if (sample_id) { + evlist__for_each_entry(evlist, evsel) + perf_evsel__set_sample_id(evsel, use_sample_identifier); + } +diff --git a/tools/testing/radix-tree/idr-test.c b/tools/testing/radix-tree/idr-test.c +index 30cd0b296f1a..8e61aad0ca3f 100644 +--- a/tools/testing/radix-tree/idr-test.c ++++ b/tools/testing/radix-tree/idr-test.c +@@ -202,6 +202,13 @@ void idr_checks(void) + idr_remove(&idr, 3); + idr_remove(&idr, 0); + ++ assert(idr_alloc(&idr, DUMMY_PTR, 0, 0, GFP_KERNEL) == 0); ++ idr_remove(&idr, 1); ++ for (i = 1; i < RADIX_TREE_MAP_SIZE; i++) ++ assert(idr_alloc(&idr, DUMMY_PTR, 0, 0, GFP_KERNEL) == i); ++ idr_remove(&idr, 1 << 30); ++ idr_destroy(&idr); ++ + for (i = INT_MAX - 3UL; i < INT_MAX + 1UL; i++) { + struct item *item = item_create(i, 0); + assert(idr_alloc(&idr, item, i, i + 10, GFP_KERNEL) == i); +diff --git a/tools/testing/selftests/Makefile b/tools/testing/selftests/Makefile +index 3c9c0bbe7dbb..ea300e7818a7 100644 +--- a/tools/testing/selftests/Makefile ++++ b/tools/testing/selftests/Makefile +@@ -122,6 +122,7 @@ ifdef INSTALL_PATH + BUILD_TARGET=$$BUILD/$$TARGET; \ + echo "echo ; echo Running tests in $$TARGET" >> $(ALL_SCRIPT); \ + echo "echo ========================================" >> $(ALL_SCRIPT); \ ++ echo "[ -w /dev/kmsg ] && echo \"kselftest: Running tests in $$TARGET\" >> /dev/kmsg" >> $(ALL_SCRIPT); \ + echo "cd $$TARGET" >> $(ALL_SCRIPT); \ + make -s --no-print-directory OUTPUT=$$BUILD_TARGET -C $$TARGET emit_tests >> $(ALL_SCRIPT); \ + echo "cd \$$ROOT" >> $(ALL_SCRIPT); \ +diff --git a/tools/testing/selftests/bpf/test_maps.c b/tools/testing/selftests/bpf/test_maps.c +index 8b9470b5af6d..96c6238a4a1f 100644 +--- a/tools/testing/selftests/bpf/test_maps.c ++++ b/tools/testing/selftests/bpf/test_maps.c +@@ -126,6 +126,8 @@ static void test_hashmap_sizes(int task, void *data) + fd = bpf_create_map(BPF_MAP_TYPE_HASH, i, j, + 2, map_flags); + if (fd < 0) { ++ if (errno == ENOMEM) ++ return; + printf("Failed to create hashmap key=%d value=%d '%s'\n", + i, j, strerror(errno)); + exit(1); +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc +new file mode 100644 +index 000000000000..5ba73035e1d9 +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_string.tc +@@ -0,0 +1,46 @@ ++#!/bin/sh ++# SPDX-License-Identifier: GPL-2.0 ++# description: Kprobe event string type argument ++ ++[ -f kprobe_events ] || exit_unsupported # this is configurable ++ ++echo 0 > events/enable ++echo > kprobe_events ++ ++case `uname -m` in ++x86_64) ++ ARG2=%si ++ OFFS=8 ++;; ++i[3456]86) ++ ARG2=%cx ++ OFFS=4 ++;; ++aarch64) ++ ARG2=%x1 ++ OFFS=8 ++;; ++arm*) ++ ARG2=%r1 ++ OFFS=4 ++;; ++*) ++ echo "Please implement other architecture here" ++ exit_untested ++esac ++ ++: "Test get argument (1)" ++echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string" > kprobe_events ++echo 1 > events/kprobes/testprobe/enable ++! echo test >> kprobe_events ++tail -n 1 trace | grep -qe "testprobe.* arg1=\"test\"" ++ ++echo 0 > events/kprobes/testprobe/enable ++: "Test get argument (2)" ++echo "p:testprobe create_trace_kprobe arg1=+0(+0(${ARG2})):string arg2=+0(+${OFFS}(${ARG2})):string" > kprobe_events ++echo 1 > events/kprobes/testprobe/enable ++! echo test1 test2 >> kprobe_events ++tail -n 1 trace | grep -qe "testprobe.* arg1=\"test1\" arg2=\"test2\"" ++ ++echo 0 > events/enable ++echo > kprobe_events +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc +new file mode 100644 +index 000000000000..231bcd2c4eb5 +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_args_syntax.tc +@@ -0,0 +1,97 @@ ++#!/bin/sh ++# SPDX-License-Identifier: GPL-2.0 ++# description: Kprobe event argument syntax ++ ++[ -f kprobe_events ] || exit_unsupported # this is configurable ++ ++grep "x8/16/32/64" README > /dev/null || exit_unsupported # version issue ++ ++echo 0 > events/enable ++echo > kprobe_events ++ ++PROBEFUNC="vfs_read" ++GOODREG= ++BADREG= ++GOODSYM="_sdata" ++if ! grep -qw ${GOODSYM} /proc/kallsyms ; then ++ GOODSYM=$PROBEFUNC ++fi ++BADSYM="deaqswdefr" ++SYMADDR=0x`grep -w ${GOODSYM} /proc/kallsyms | cut -f 1 -d " "` ++GOODTYPE="x16" ++BADTYPE="y16" ++ ++case `uname -m` in ++x86_64|i[3456]86) ++ GOODREG=%ax ++ BADREG=%ex ++;; ++aarch64) ++ GOODREG=%x0 ++ BADREG=%ax ++;; ++arm*) ++ GOODREG=%r0 ++ BADREG=%ax ++;; ++esac ++ ++test_goodarg() # Good-args ++{ ++ while [ "$1" ]; do ++ echo "p ${PROBEFUNC} $1" > kprobe_events ++ shift 1 ++ done; ++} ++ ++test_badarg() # Bad-args ++{ ++ while [ "$1" ]; do ++ ! echo "p ${PROBEFUNC} $1" > kprobe_events ++ shift 1 ++ done; ++} ++ ++echo > kprobe_events ++ ++: "Register access" ++test_goodarg ${GOODREG} ++test_badarg ${BADREG} ++ ++: "Symbol access" ++test_goodarg "@${GOODSYM}" "@${SYMADDR}" "@${GOODSYM}+10" "@${GOODSYM}-10" ++test_badarg "@" "@${BADSYM}" "@${GOODSYM}*10" "@${GOODSYM}/10" \ ++ "@${GOODSYM}%10" "@${GOODSYM}&10" "@${GOODSYM}|10" ++ ++: "Stack access" ++test_goodarg "\$stack" "\$stack0" "\$stack1" ++test_badarg "\$stackp" "\$stack0+10" "\$stack1-10" ++ ++: "Retval access" ++echo "r ${PROBEFUNC} \$retval" > kprobe_events ++! echo "p ${PROBEFUNC} \$retval" > kprobe_events ++ ++: "Comm access" ++test_goodarg "\$comm" ++ ++: "Indirect memory access" ++test_goodarg "+0(${GOODREG})" "-0(${GOODREG})" "+10(\$stack)" \ ++ "+0(\$stack1)" "+10(@${GOODSYM}-10)" "+0(+10(+20(\$stack)))" ++test_badarg "+(${GOODREG})" "(${GOODREG}+10)" "-(${GOODREG})" "(${GOODREG})" \ ++ "+10(\$comm)" "+0(${GOODREG})+10" ++ ++: "Name assignment" ++test_goodarg "varname=${GOODREG}" ++test_badarg "varname=varname2=${GOODREG}" ++ ++: "Type syntax" ++test_goodarg "${GOODREG}:${GOODTYPE}" ++test_badarg "${GOODREG}::${GOODTYPE}" "${GOODREG}:${BADTYPE}" \ ++ "${GOODTYPE}:${GOODREG}" ++ ++: "Combination check" ++ ++test_goodarg "\$comm:string" "+0(\$stack):string" ++test_badarg "\$comm:x64" "\$stack:string" "${GOODREG}:string" ++ ++echo > kprobe_events +diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc +new file mode 100644 +index 000000000000..4fda01a08da4 +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/kprobe/probepoint.tc +@@ -0,0 +1,43 @@ ++#!/bin/sh ++# SPDX-License-Identifier: GPL-2.0 ++# description: Kprobe events - probe points ++ ++[ -f kprobe_events ] || exit_unsupported # this is configurable ++ ++TARGET_FUNC=create_trace_kprobe ++ ++dec_addr() { # hexaddr ++ printf "%d" "0x"`echo $1 | tail -c 8` ++} ++ ++set_offs() { # prev target next ++ A1=`dec_addr $1` ++ A2=`dec_addr $2` ++ A3=`dec_addr $3` ++ TARGET="0x$2" # an address ++ PREV=`expr $A1 - $A2` # offset to previous symbol ++ NEXT=+`expr $A3 - $A2` # offset to next symbol ++ OVERFLOW=+`printf "0x%x" ${PREV}` # overflow offset to previous symbol ++} ++ ++# We have to decode symbol addresses to get correct offsets. ++# If the offset is not an instruction boundary, it cause -EILSEQ. ++set_offs `grep -A1 -B1 ${TARGET_FUNC} /proc/kallsyms | cut -f 1 -d " " | xargs` ++ ++UINT_TEST=no ++# printf "%x" -1 returns (unsigned long)-1. ++if [ `printf "%x" -1 | wc -c` != 9 ]; then ++ UINT_TEST=yes ++fi ++ ++echo 0 > events/enable ++echo > kprobe_events ++echo "p:testprobe ${TARGET_FUNC}" > kprobe_events ++echo "p:testprobe ${TARGET}" > kprobe_events ++echo "p:testprobe ${TARGET_FUNC}${NEXT}" > kprobe_events ++! echo "p:testprobe ${TARGET_FUNC}${PREV}" > kprobe_events ++if [ "${UINT_TEST}" = yes ]; then ++! echo "p:testprobe ${TARGET_FUNC}${OVERFLOW}" > kprobe_events ++fi ++echo > kprobe_events ++clear_trace +diff --git a/tools/testing/selftests/futex/Makefile b/tools/testing/selftests/futex/Makefile +index cea4adcd42b8..a63e8453984d 100644 +--- a/tools/testing/selftests/futex/Makefile ++++ b/tools/testing/selftests/futex/Makefile +@@ -12,9 +12,9 @@ all: + BUILD_TARGET=$(OUTPUT)/$$DIR; \ + mkdir $$BUILD_TARGET -p; \ + make OUTPUT=$$BUILD_TARGET -C $$DIR $@;\ +- if [ -e $$DIR/$(TEST_PROGS) ]; then +- rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; +- fi ++ if [ -e $$DIR/$(TEST_PROGS) ]; then \ ++ rsync -a $$DIR/$(TEST_PROGS) $$BUILD_TARGET/; \ ++ fi \ + done + + override define RUN_TESTS +diff --git a/tools/testing/selftests/memfd/Makefile b/tools/testing/selftests/memfd/Makefile +index 3926a0409dda..36409cb7288c 100644 +--- a/tools/testing/selftests/memfd/Makefile ++++ b/tools/testing/selftests/memfd/Makefile +@@ -5,6 +5,7 @@ CFLAGS += -I../../../../include/ + CFLAGS += -I../../../../usr/include/ + + TEST_PROGS := run_tests.sh ++TEST_FILES := run_fuse_test.sh + TEST_GEN_FILES := memfd_test fuse_mnt fuse_test + + fuse_mnt.o: CFLAGS += $(shell pkg-config fuse --cflags) +diff --git a/tools/testing/selftests/memfd/config b/tools/testing/selftests/memfd/config +new file mode 100644 +index 000000000000..835c7f4dadcd +--- /dev/null ++++ b/tools/testing/selftests/memfd/config +@@ -0,0 +1 @@ ++CONFIG_FUSE_FS=m +diff --git a/tools/testing/selftests/net/psock_fanout.c b/tools/testing/selftests/net/psock_fanout.c +index 989f917068d1..d4346b16b2c1 100644 +--- a/tools/testing/selftests/net/psock_fanout.c ++++ b/tools/testing/selftests/net/psock_fanout.c +@@ -128,6 +128,8 @@ static void sock_fanout_getopts(int fd, uint16_t *typeflags, uint16_t *group_id) + + static void sock_fanout_set_ebpf(int fd) + { ++ static char log_buf[65536]; ++ + const int len_off = __builtin_offsetof(struct __sk_buff, len); + struct bpf_insn prog[] = { + { BPF_ALU64 | BPF_MOV | BPF_X, 6, 1, 0, 0 }, +@@ -140,7 +142,6 @@ static void sock_fanout_set_ebpf(int fd) + { BPF_ALU | BPF_MOV | BPF_K, 0, 0, 0, 0 }, + { BPF_JMP | BPF_EXIT, 0, 0, 0, 0 } + }; +- char log_buf[512]; + union bpf_attr attr; + int pfd; + +diff --git a/tools/testing/selftests/powerpc/mm/subpage_prot.c b/tools/testing/selftests/powerpc/mm/subpage_prot.c +index 35ade7406dcd..3ae77ba93208 100644 +--- a/tools/testing/selftests/powerpc/mm/subpage_prot.c ++++ b/tools/testing/selftests/powerpc/mm/subpage_prot.c +@@ -135,6 +135,16 @@ static int run_test(void *addr, unsigned long size) + return 0; + } + ++static int syscall_available(void) ++{ ++ int rc; ++ ++ errno = 0; ++ rc = syscall(__NR_subpage_prot, 0, 0, 0); ++ ++ return rc == 0 || (errno != ENOENT && errno != ENOSYS); ++} ++ + int test_anon(void) + { + unsigned long align; +@@ -145,6 +155,8 @@ int test_anon(void) + void *mallocblock; + unsigned long mallocsize; + ++ SKIP_IF(!syscall_available()); ++ + if (getpagesize() != 0x10000) { + fprintf(stderr, "Kernel page size must be 64K!\n"); + return 1; +@@ -180,6 +192,8 @@ int test_file(void) + off_t filesize; + int fd; + ++ SKIP_IF(!syscall_available()); ++ + fd = open(file_name, O_RDWR); + if (fd == -1) { + perror("failed to open file"); +diff --git a/tools/testing/selftests/pstore/config b/tools/testing/selftests/pstore/config +index 6a8e5a9bfc10..d148f9f89fb6 100644 +--- a/tools/testing/selftests/pstore/config ++++ b/tools/testing/selftests/pstore/config +@@ -2,3 +2,4 @@ CONFIG_MISC_FILESYSTEMS=y + CONFIG_PSTORE=y + CONFIG_PSTORE_PMSG=y + CONFIG_PSTORE_CONSOLE=y ++CONFIG_PSTORE_RAM=m +diff --git a/tools/testing/selftests/seccomp/seccomp_bpf.c b/tools/testing/selftests/seccomp/seccomp_bpf.c +index 194759ec9e70..e350cf3d4f90 100644 +--- a/tools/testing/selftests/seccomp/seccomp_bpf.c ++++ b/tools/testing/selftests/seccomp/seccomp_bpf.c +@@ -145,6 +145,15 @@ struct seccomp_data { + #define SECCOMP_FILTER_FLAG_SPEC_ALLOW (1UL << 2) + #endif + ++#ifndef PTRACE_SECCOMP_GET_METADATA ++#define PTRACE_SECCOMP_GET_METADATA 0x420d ++ ++struct seccomp_metadata { ++ __u64 filter_off; /* Input: which filter */ ++ __u64 flags; /* Output: filter's flags */ ++}; ++#endif ++ + #ifndef seccomp + int seccomp(unsigned int op, unsigned int flags, void *args) + { +@@ -2861,6 +2870,58 @@ TEST(get_action_avail) + EXPECT_EQ(errno, EOPNOTSUPP); + } + ++TEST(get_metadata) ++{ ++ pid_t pid; ++ int pipefd[2]; ++ char buf; ++ struct seccomp_metadata md; ++ ++ ASSERT_EQ(0, pipe(pipefd)); ++ ++ pid = fork(); ++ ASSERT_GE(pid, 0); ++ if (pid == 0) { ++ struct sock_filter filter[] = { ++ BPF_STMT(BPF_RET|BPF_K, SECCOMP_RET_ALLOW), ++ }; ++ struct sock_fprog prog = { ++ .len = (unsigned short)ARRAY_SIZE(filter), ++ .filter = filter, ++ }; ++ ++ /* one with log, one without */ ++ ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, ++ SECCOMP_FILTER_FLAG_LOG, &prog)); ++ ASSERT_EQ(0, seccomp(SECCOMP_SET_MODE_FILTER, 0, &prog)); ++ ++ ASSERT_EQ(0, close(pipefd[0])); ++ ASSERT_EQ(1, write(pipefd[1], "1", 1)); ++ ASSERT_EQ(0, close(pipefd[1])); ++ ++ while (1) ++ sleep(100); ++ } ++ ++ ASSERT_EQ(0, close(pipefd[1])); ++ ASSERT_EQ(1, read(pipefd[0], &buf, 1)); ++ ++ ASSERT_EQ(0, ptrace(PTRACE_ATTACH, pid)); ++ ASSERT_EQ(pid, waitpid(pid, NULL, 0)); ++ ++ md.filter_off = 0; ++ ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md)); ++ EXPECT_EQ(md.flags, SECCOMP_FILTER_FLAG_LOG); ++ EXPECT_EQ(md.filter_off, 0); ++ ++ md.filter_off = 1; ++ ASSERT_EQ(sizeof(md), ptrace(PTRACE_SECCOMP_GET_METADATA, pid, sizeof(md), &md)); ++ EXPECT_EQ(md.flags, 0); ++ EXPECT_EQ(md.filter_off, 1); ++ ++ ASSERT_EQ(0, kill(pid, SIGKILL)); ++} ++ + /* + * TODO: + * - add microbenchmarks +diff --git a/tools/testing/selftests/sync/Makefile b/tools/testing/selftests/sync/Makefile +index b3c8ba3cb668..d0121a8a3523 100644 +--- a/tools/testing/selftests/sync/Makefile ++++ b/tools/testing/selftests/sync/Makefile +@@ -30,7 +30,7 @@ $(TEST_CUSTOM_PROGS): $(TESTS) $(OBJS) + $(CC) -o $(TEST_CUSTOM_PROGS) $(OBJS) $(TESTS) $(CFLAGS) $(LDFLAGS) + + $(OBJS): $(OUTPUT)/%.o: %.c +- $(CC) -c $^ -o $@ ++ $(CC) -c $^ -o $@ $(CFLAGS) + + $(TESTS): $(OUTPUT)/%.o: %.c + $(CC) -c $^ -o $@ +diff --git a/tools/testing/selftests/vDSO/Makefile b/tools/testing/selftests/vDSO/Makefile +index 3d5a62ff7d31..f5d7a7851e21 100644 +--- a/tools/testing/selftests/vDSO/Makefile ++++ b/tools/testing/selftests/vDSO/Makefile +@@ -1,4 +1,6 @@ + # SPDX-License-Identifier: GPL-2.0 ++include ../lib.mk ++ + ifndef CROSS_COMPILE + CFLAGS := -std=gnu99 + CFLAGS_vdso_standalone_test_x86 := -nostdlib -fno-asynchronous-unwind-tables -fno-stack-protector +@@ -6,16 +8,14 @@ ifeq ($(CONFIG_X86_32),y) + LDLIBS += -lgcc_s + endif + +-TEST_PROGS := vdso_test vdso_standalone_test_x86 ++TEST_PROGS := $(OUTPUT)/vdso_test $(OUTPUT)/vdso_standalone_test_x86 + + all: $(TEST_PROGS) +-vdso_test: parse_vdso.c vdso_test.c +-vdso_standalone_test_x86: vdso_standalone_test_x86.c parse_vdso.c ++$(OUTPUT)/vdso_test: parse_vdso.c vdso_test.c ++$(OUTPUT)/vdso_standalone_test_x86: vdso_standalone_test_x86.c parse_vdso.c + $(CC) $(CFLAGS) $(CFLAGS_vdso_standalone_test_x86) \ + vdso_standalone_test_x86.c parse_vdso.c \ +- -o vdso_standalone_test_x86 ++ -o $@ + +-include ../lib.mk +-clean: +- rm -fr $(TEST_PROGS) ++EXTRA_CLEAN := $(TEST_PROGS) + endif +diff --git a/tools/testing/selftests/vm/run_vmtests b/tools/testing/selftests/vm/run_vmtests +index cc826326de87..45708aa3ce47 100755 +--- a/tools/testing/selftests/vm/run_vmtests ++++ b/tools/testing/selftests/vm/run_vmtests +@@ -2,25 +2,33 @@ + # SPDX-License-Identifier: GPL-2.0 + #please run as root + +-#we need 256M, below is the size in kB +-needmem=262144 + mnt=./huge + exitcode=0 + +-#get pagesize and freepages from /proc/meminfo ++#get huge pagesize and freepages from /proc/meminfo + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then + freepgs=$size + fi + if [ "$name" = "Hugepagesize:" ]; then +- pgsize=$size ++ hpgsize_KB=$size + fi + done < /proc/meminfo + ++# Simple hugetlbfs tests have a hardcoded minimum requirement of ++# huge pages totaling 256MB (262144KB) in size. The userfaultfd ++# hugetlb test requires a minimum of 2 * nr_cpus huge pages. Take ++# both of these requirements into account and attempt to increase ++# number of huge pages available. ++nr_cpus=$(nproc) ++hpgsize_MB=$((hpgsize_KB / 1024)) ++half_ufd_size_MB=$((((nr_cpus * hpgsize_MB + 127) / 128) * 128)) ++needmem_KB=$((half_ufd_size_MB * 2 * 1024)) ++ + #set proper nr_hugepages +-if [ -n "$freepgs" ] && [ -n "$pgsize" ]; then ++if [ -n "$freepgs" ] && [ -n "$hpgsize_KB" ]; then + nr_hugepgs=`cat /proc/sys/vm/nr_hugepages` +- needpgs=`expr $needmem / $pgsize` ++ needpgs=$((needmem_KB / hpgsize_KB)) + tries=2 + while [ $tries -gt 0 ] && [ $freepgs -lt $needpgs ]; do + lackpgs=$(( $needpgs - $freepgs )) +@@ -107,8 +115,9 @@ fi + echo "---------------------------" + echo "running userfaultfd_hugetlb" + echo "---------------------------" +-# 256MB total huge pages == 128MB src and 128MB dst +-./userfaultfd hugetlb 128 32 $mnt/ufd_test_file ++# Test requires source and destination huge pages. Size of source ++# (half_ufd_size_MB) is passed as argument to test. ++./userfaultfd hugetlb $half_ufd_size_MB 32 $mnt/ufd_test_file + if [ $? -ne 0 ]; then + echo "[FAIL]" + exitcode=1 +diff --git a/tools/thermal/tmon/sysfs.c b/tools/thermal/tmon/sysfs.c +index 1c12536f2081..18f523557983 100644 +--- a/tools/thermal/tmon/sysfs.c ++++ b/tools/thermal/tmon/sysfs.c +@@ -486,6 +486,7 @@ int zone_instance_to_index(int zone_inst) + int update_thermal_data() + { + int i; ++ int next_thermal_record = cur_thermal_record + 1; + char tz_name[256]; + static unsigned long samples; + +@@ -495,9 +496,9 @@ int update_thermal_data() + } + + /* circular buffer for keeping historic data */ +- if (cur_thermal_record >= NR_THERMAL_RECORDS) +- cur_thermal_record = 0; +- gettimeofday(&trec[cur_thermal_record].tv, NULL); ++ if (next_thermal_record >= NR_THERMAL_RECORDS) ++ next_thermal_record = 0; ++ gettimeofday(&trec[next_thermal_record].tv, NULL); + if (tmon_log) { + fprintf(tmon_log, "%lu ", ++samples); + fprintf(tmon_log, "%3.1f ", p_param.t_target); +@@ -507,11 +508,12 @@ int update_thermal_data() + snprintf(tz_name, 256, "%s/%s%d", THERMAL_SYSFS, TZONE, + ptdata.tzi[i].instance); + sysfs_get_ulong(tz_name, "temp", +- &trec[cur_thermal_record].temp[i]); ++ &trec[next_thermal_record].temp[i]); + if (tmon_log) + fprintf(tmon_log, "%lu ", +- trec[cur_thermal_record].temp[i]/1000); ++ trec[next_thermal_record].temp[i] / 1000); + } ++ cur_thermal_record = next_thermal_record; + for (i = 0; i < ptdata.nr_cooling_dev; i++) { + char cdev_name[256]; + unsigned long val; +diff --git a/tools/thermal/tmon/tmon.c b/tools/thermal/tmon/tmon.c +index 9aa19652e8e8..b43138f8b862 100644 +--- a/tools/thermal/tmon/tmon.c ++++ b/tools/thermal/tmon/tmon.c +@@ -336,7 +336,6 @@ int main(int argc, char **argv) + show_data_w(); + show_cooling_device(); + } +- cur_thermal_record++; + time_elapsed += ticktime; + controller_handler(trec[0].temp[target_tz_index] / 1000, + &yk); +diff --git a/virt/kvm/arm/vgic/vgic-mmio.c b/virt/kvm/arm/vgic/vgic-mmio.c +index c1e4bdd66131..b4c5baf4af45 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio.c ++++ b/virt/kvm/arm/vgic/vgic-mmio.c +@@ -110,9 +110,12 @@ unsigned long vgic_mmio_read_pending(struct kvm_vcpu *vcpu, + /* Loop over all IRQs affected by this read */ + for (i = 0; i < len * 8; i++) { + struct vgic_irq *irq = vgic_get_irq(vcpu->kvm, vcpu, intid + i); ++ unsigned long flags; + ++ spin_lock_irqsave(&irq->irq_lock, flags); + if (irq_is_pending(irq)) + value |= (1U << i); ++ spin_unlock_irqrestore(&irq->irq_lock, flags); + + vgic_put_irq(vcpu->kvm, irq); + } +diff --git a/virt/kvm/arm/vgic/vgic.h b/virt/kvm/arm/vgic/vgic.h +index f7450dc41ab3..21a2240164f3 100644 +--- a/virt/kvm/arm/vgic/vgic.h ++++ b/virt/kvm/arm/vgic/vgic.h +@@ -96,6 +96,7 @@ + /* we only support 64 kB translation table page size */ + #define KVM_ITS_L1E_ADDR_MASK GENMASK_ULL(51, 16) + ++/* Requires the irq_lock to be held by the caller. */ + static inline bool irq_is_pending(struct vgic_irq *irq) + { + if (irq->config == VGIC_CONFIG_EDGE) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.45-46.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.45-46.patch new file mode 100644 index 000000000000..1414cad3acfb --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.45-46.patch @@ -0,0 +1,850 @@ +diff --git a/Makefile b/Makefile +index f3ea74e7a516..3b1845f2b8f8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 45 ++SUBLEVEL = 46 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/tools/arch/arm/include/uapi/asm/kvm.h b/tools/arch/arm/include/uapi/asm/kvm.h +index 1f57bbe82b6f..df24fc8da1bc 100644 +--- a/tools/arch/arm/include/uapi/asm/kvm.h ++++ b/tools/arch/arm/include/uapi/asm/kvm.h +@@ -180,6 +180,12 @@ struct kvm_arch_memory_slot { + #define KVM_REG_ARM_VFP_FPINST 0x1009 + #define KVM_REG_ARM_VFP_FPINST2 0x100A + ++/* KVM-as-firmware specific pseudo-registers */ ++#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) ++#define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM | KVM_REG_SIZE_U64 | \ ++ KVM_REG_ARM_FW | ((r) & 0xffff)) ++#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) ++ + /* Device Control API: ARM VGIC */ + #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 + #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 +diff --git a/tools/arch/arm64/include/uapi/asm/kvm.h b/tools/arch/arm64/include/uapi/asm/kvm.h +index 51149ec75fe4..9f74ce5899f0 100644 +--- a/tools/arch/arm64/include/uapi/asm/kvm.h ++++ b/tools/arch/arm64/include/uapi/asm/kvm.h +@@ -200,6 +200,12 @@ struct kvm_arch_memory_slot { + #define KVM_REG_ARM_TIMER_CNT ARM64_SYS_REG(3, 3, 14, 3, 2) + #define KVM_REG_ARM_TIMER_CVAL ARM64_SYS_REG(3, 3, 14, 0, 2) + ++/* KVM-as-firmware specific pseudo-registers */ ++#define KVM_REG_ARM_FW (0x0014 << KVM_REG_ARM_COPROC_SHIFT) ++#define KVM_REG_ARM_FW_REG(r) (KVM_REG_ARM64 | KVM_REG_SIZE_U64 | \ ++ KVM_REG_ARM_FW | ((r) & 0xffff)) ++#define KVM_REG_ARM_PSCI_VERSION KVM_REG_ARM_FW_REG(0) ++ + /* Device Control API: ARM VGIC */ + #define KVM_DEV_ARM_VGIC_GRP_ADDR 0 + #define KVM_DEV_ARM_VGIC_GRP_DIST_REGS 1 +diff --git a/tools/arch/powerpc/include/uapi/asm/kvm.h b/tools/arch/powerpc/include/uapi/asm/kvm.h +index 61d6049f4c1e..8aaec831053a 100644 +--- a/tools/arch/powerpc/include/uapi/asm/kvm.h ++++ b/tools/arch/powerpc/include/uapi/asm/kvm.h +@@ -607,6 +607,8 @@ struct kvm_ppc_rmmu_info { + #define KVM_REG_PPC_TIDR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbc) + #define KVM_REG_PPC_PSSCR (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbd) + ++#define KVM_REG_PPC_DEC_EXPIRY (KVM_REG_PPC | KVM_REG_SIZE_U64 | 0xbe) ++ + /* Transactional Memory checkpointed state: + * This is all GPRs, all VSX regs and a subset of SPRs + */ +diff --git a/tools/arch/s390/include/uapi/asm/kvm.h b/tools/arch/s390/include/uapi/asm/kvm.h +index 9ad172dcd912..a3938db010f7 100644 +--- a/tools/arch/s390/include/uapi/asm/kvm.h ++++ b/tools/arch/s390/include/uapi/asm/kvm.h +@@ -228,6 +228,7 @@ struct kvm_guest_debug_arch { + #define KVM_SYNC_RICCB (1UL << 7) + #define KVM_SYNC_FPRS (1UL << 8) + #define KVM_SYNC_GSCB (1UL << 9) ++#define KVM_SYNC_BPBC (1UL << 10) + /* length and alignment of the sdnx as a power of two */ + #define SDNXC 8 + #define SDNXL (1UL << SDNXC) +@@ -251,7 +252,9 @@ struct kvm_sync_regs { + }; + __u8 reserved[512]; /* for future vector expansion */ + __u32 fpc; /* valid on KVM_SYNC_VRS or KVM_SYNC_FPRS */ +- __u8 padding1[52]; /* riccb needs to be 64byte aligned */ ++ __u8 bpbc : 1; /* bp mode */ ++ __u8 reserved2 : 7; ++ __u8 padding1[51]; /* riccb needs to be 64byte aligned */ + __u8 riccb[64]; /* runtime instrumentation controls block */ + __u8 padding2[192]; /* sdnx needs to be 256byte aligned */ + union { +diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h +index 793690fbda36..403e97d5e243 100644 +--- a/tools/arch/x86/include/asm/cpufeatures.h ++++ b/tools/arch/x86/include/asm/cpufeatures.h +@@ -13,173 +13,176 @@ + /* + * Defines x86 CPU feature bits + */ +-#define NCAPINTS 18 /* N 32-bit words worth of info */ +-#define NBUGINTS 1 /* N 32-bit bug flags */ ++#define NCAPINTS 19 /* N 32-bit words worth of info */ ++#define NBUGINTS 1 /* N 32-bit bug flags */ + + /* + * Note: If the comment begins with a quoted string, that string is used + * in /proc/cpuinfo instead of the macro name. If the string is "", + * this feature bit is not displayed in /proc/cpuinfo at all. ++ * ++ * When adding new features here that depend on other features, ++ * please update the table in kernel/cpu/cpuid-deps.c as well. + */ + +-/* Intel-defined CPU features, CPUID level 0x00000001 (edx), word 0 */ +-#define X86_FEATURE_FPU ( 0*32+ 0) /* Onboard FPU */ +-#define X86_FEATURE_VME ( 0*32+ 1) /* Virtual Mode Extensions */ +-#define X86_FEATURE_DE ( 0*32+ 2) /* Debugging Extensions */ +-#define X86_FEATURE_PSE ( 0*32+ 3) /* Page Size Extensions */ +-#define X86_FEATURE_TSC ( 0*32+ 4) /* Time Stamp Counter */ +-#define X86_FEATURE_MSR ( 0*32+ 5) /* Model-Specific Registers */ +-#define X86_FEATURE_PAE ( 0*32+ 6) /* Physical Address Extensions */ +-#define X86_FEATURE_MCE ( 0*32+ 7) /* Machine Check Exception */ +-#define X86_FEATURE_CX8 ( 0*32+ 8) /* CMPXCHG8 instruction */ +-#define X86_FEATURE_APIC ( 0*32+ 9) /* Onboard APIC */ +-#define X86_FEATURE_SEP ( 0*32+11) /* SYSENTER/SYSEXIT */ +-#define X86_FEATURE_MTRR ( 0*32+12) /* Memory Type Range Registers */ +-#define X86_FEATURE_PGE ( 0*32+13) /* Page Global Enable */ +-#define X86_FEATURE_MCA ( 0*32+14) /* Machine Check Architecture */ +-#define X86_FEATURE_CMOV ( 0*32+15) /* CMOV instructions */ +- /* (plus FCMOVcc, FCOMI with FPU) */ +-#define X86_FEATURE_PAT ( 0*32+16) /* Page Attribute Table */ +-#define X86_FEATURE_PSE36 ( 0*32+17) /* 36-bit PSEs */ +-#define X86_FEATURE_PN ( 0*32+18) /* Processor serial number */ +-#define X86_FEATURE_CLFLUSH ( 0*32+19) /* CLFLUSH instruction */ +-#define X86_FEATURE_DS ( 0*32+21) /* "dts" Debug Store */ +-#define X86_FEATURE_ACPI ( 0*32+22) /* ACPI via MSR */ +-#define X86_FEATURE_MMX ( 0*32+23) /* Multimedia Extensions */ +-#define X86_FEATURE_FXSR ( 0*32+24) /* FXSAVE/FXRSTOR, CR4.OSFXSR */ +-#define X86_FEATURE_XMM ( 0*32+25) /* "sse" */ +-#define X86_FEATURE_XMM2 ( 0*32+26) /* "sse2" */ +-#define X86_FEATURE_SELFSNOOP ( 0*32+27) /* "ss" CPU self snoop */ +-#define X86_FEATURE_HT ( 0*32+28) /* Hyper-Threading */ +-#define X86_FEATURE_ACC ( 0*32+29) /* "tm" Automatic clock control */ +-#define X86_FEATURE_IA64 ( 0*32+30) /* IA-64 processor */ +-#define X86_FEATURE_PBE ( 0*32+31) /* Pending Break Enable */ ++/* Intel-defined CPU features, CPUID level 0x00000001 (EDX), word 0 */ ++#define X86_FEATURE_FPU ( 0*32+ 0) /* Onboard FPU */ ++#define X86_FEATURE_VME ( 0*32+ 1) /* Virtual Mode Extensions */ ++#define X86_FEATURE_DE ( 0*32+ 2) /* Debugging Extensions */ ++#define X86_FEATURE_PSE ( 0*32+ 3) /* Page Size Extensions */ ++#define X86_FEATURE_TSC ( 0*32+ 4) /* Time Stamp Counter */ ++#define X86_FEATURE_MSR ( 0*32+ 5) /* Model-Specific Registers */ ++#define X86_FEATURE_PAE ( 0*32+ 6) /* Physical Address Extensions */ ++#define X86_FEATURE_MCE ( 0*32+ 7) /* Machine Check Exception */ ++#define X86_FEATURE_CX8 ( 0*32+ 8) /* CMPXCHG8 instruction */ ++#define X86_FEATURE_APIC ( 0*32+ 9) /* Onboard APIC */ ++#define X86_FEATURE_SEP ( 0*32+11) /* SYSENTER/SYSEXIT */ ++#define X86_FEATURE_MTRR ( 0*32+12) /* Memory Type Range Registers */ ++#define X86_FEATURE_PGE ( 0*32+13) /* Page Global Enable */ ++#define X86_FEATURE_MCA ( 0*32+14) /* Machine Check Architecture */ ++#define X86_FEATURE_CMOV ( 0*32+15) /* CMOV instructions (plus FCMOVcc, FCOMI with FPU) */ ++#define X86_FEATURE_PAT ( 0*32+16) /* Page Attribute Table */ ++#define X86_FEATURE_PSE36 ( 0*32+17) /* 36-bit PSEs */ ++#define X86_FEATURE_PN ( 0*32+18) /* Processor serial number */ ++#define X86_FEATURE_CLFLUSH ( 0*32+19) /* CLFLUSH instruction */ ++#define X86_FEATURE_DS ( 0*32+21) /* "dts" Debug Store */ ++#define X86_FEATURE_ACPI ( 0*32+22) /* ACPI via MSR */ ++#define X86_FEATURE_MMX ( 0*32+23) /* Multimedia Extensions */ ++#define X86_FEATURE_FXSR ( 0*32+24) /* FXSAVE/FXRSTOR, CR4.OSFXSR */ ++#define X86_FEATURE_XMM ( 0*32+25) /* "sse" */ ++#define X86_FEATURE_XMM2 ( 0*32+26) /* "sse2" */ ++#define X86_FEATURE_SELFSNOOP ( 0*32+27) /* "ss" CPU self snoop */ ++#define X86_FEATURE_HT ( 0*32+28) /* Hyper-Threading */ ++#define X86_FEATURE_ACC ( 0*32+29) /* "tm" Automatic clock control */ ++#define X86_FEATURE_IA64 ( 0*32+30) /* IA-64 processor */ ++#define X86_FEATURE_PBE ( 0*32+31) /* Pending Break Enable */ + + /* AMD-defined CPU features, CPUID level 0x80000001, word 1 */ + /* Don't duplicate feature flags which are redundant with Intel! */ +-#define X86_FEATURE_SYSCALL ( 1*32+11) /* SYSCALL/SYSRET */ +-#define X86_FEATURE_MP ( 1*32+19) /* MP Capable. */ +-#define X86_FEATURE_NX ( 1*32+20) /* Execute Disable */ +-#define X86_FEATURE_MMXEXT ( 1*32+22) /* AMD MMX extensions */ +-#define X86_FEATURE_FXSR_OPT ( 1*32+25) /* FXSAVE/FXRSTOR optimizations */ +-#define X86_FEATURE_GBPAGES ( 1*32+26) /* "pdpe1gb" GB pages */ +-#define X86_FEATURE_RDTSCP ( 1*32+27) /* RDTSCP */ +-#define X86_FEATURE_LM ( 1*32+29) /* Long Mode (x86-64) */ +-#define X86_FEATURE_3DNOWEXT ( 1*32+30) /* AMD 3DNow! extensions */ +-#define X86_FEATURE_3DNOW ( 1*32+31) /* 3DNow! */ ++#define X86_FEATURE_SYSCALL ( 1*32+11) /* SYSCALL/SYSRET */ ++#define X86_FEATURE_MP ( 1*32+19) /* MP Capable */ ++#define X86_FEATURE_NX ( 1*32+20) /* Execute Disable */ ++#define X86_FEATURE_MMXEXT ( 1*32+22) /* AMD MMX extensions */ ++#define X86_FEATURE_FXSR_OPT ( 1*32+25) /* FXSAVE/FXRSTOR optimizations */ ++#define X86_FEATURE_GBPAGES ( 1*32+26) /* "pdpe1gb" GB pages */ ++#define X86_FEATURE_RDTSCP ( 1*32+27) /* RDTSCP */ ++#define X86_FEATURE_LM ( 1*32+29) /* Long Mode (x86-64, 64-bit support) */ ++#define X86_FEATURE_3DNOWEXT ( 1*32+30) /* AMD 3DNow extensions */ ++#define X86_FEATURE_3DNOW ( 1*32+31) /* 3DNow */ + + /* Transmeta-defined CPU features, CPUID level 0x80860001, word 2 */ +-#define X86_FEATURE_RECOVERY ( 2*32+ 0) /* CPU in recovery mode */ +-#define X86_FEATURE_LONGRUN ( 2*32+ 1) /* Longrun power control */ +-#define X86_FEATURE_LRTI ( 2*32+ 3) /* LongRun table interface */ ++#define X86_FEATURE_RECOVERY ( 2*32+ 0) /* CPU in recovery mode */ ++#define X86_FEATURE_LONGRUN ( 2*32+ 1) /* Longrun power control */ ++#define X86_FEATURE_LRTI ( 2*32+ 3) /* LongRun table interface */ + + /* Other features, Linux-defined mapping, word 3 */ + /* This range is used for feature bits which conflict or are synthesized */ +-#define X86_FEATURE_CXMMX ( 3*32+ 0) /* Cyrix MMX extensions */ +-#define X86_FEATURE_K6_MTRR ( 3*32+ 1) /* AMD K6 nonstandard MTRRs */ +-#define X86_FEATURE_CYRIX_ARR ( 3*32+ 2) /* Cyrix ARRs (= MTRRs) */ +-#define X86_FEATURE_CENTAUR_MCR ( 3*32+ 3) /* Centaur MCRs (= MTRRs) */ +-/* cpu types for specific tunings: */ +-#define X86_FEATURE_K8 ( 3*32+ 4) /* "" Opteron, Athlon64 */ +-#define X86_FEATURE_K7 ( 3*32+ 5) /* "" Athlon */ +-#define X86_FEATURE_P3 ( 3*32+ 6) /* "" P3 */ +-#define X86_FEATURE_P4 ( 3*32+ 7) /* "" P4 */ +-#define X86_FEATURE_CONSTANT_TSC ( 3*32+ 8) /* TSC ticks at a constant rate */ +-#define X86_FEATURE_UP ( 3*32+ 9) /* smp kernel running on up */ +-#define X86_FEATURE_ART ( 3*32+10) /* Platform has always running timer (ART) */ +-#define X86_FEATURE_ARCH_PERFMON ( 3*32+11) /* Intel Architectural PerfMon */ +-#define X86_FEATURE_PEBS ( 3*32+12) /* Precise-Event Based Sampling */ +-#define X86_FEATURE_BTS ( 3*32+13) /* Branch Trace Store */ +-#define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in ia32 userspace */ +-#define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in ia32 userspace */ +-#define X86_FEATURE_REP_GOOD ( 3*32+16) /* rep microcode works well */ +-#define X86_FEATURE_MFENCE_RDTSC ( 3*32+17) /* "" Mfence synchronizes RDTSC */ +-#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" Lfence synchronizes RDTSC */ +-#define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */ +-#define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ +-#define X86_FEATURE_ALWAYS ( 3*32+21) /* "" Always-present feature */ +-#define X86_FEATURE_XTOPOLOGY ( 3*32+22) /* cpu topology enum extensions */ +-#define X86_FEATURE_TSC_RELIABLE ( 3*32+23) /* TSC is known to be reliable */ +-#define X86_FEATURE_NONSTOP_TSC ( 3*32+24) /* TSC does not stop in C states */ +-#define X86_FEATURE_CPUID ( 3*32+25) /* CPU has CPUID instruction itself */ +-#define X86_FEATURE_EXTD_APICID ( 3*32+26) /* has extended APICID (8 bits) */ +-#define X86_FEATURE_AMD_DCM ( 3*32+27) /* multi-node processor */ +-#define X86_FEATURE_APERFMPERF ( 3*32+28) /* APERFMPERF */ +-#define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ +-#define X86_FEATURE_TSC_KNOWN_FREQ ( 3*32+31) /* TSC has known frequency */ ++#define X86_FEATURE_CXMMX ( 3*32+ 0) /* Cyrix MMX extensions */ ++#define X86_FEATURE_K6_MTRR ( 3*32+ 1) /* AMD K6 nonstandard MTRRs */ ++#define X86_FEATURE_CYRIX_ARR ( 3*32+ 2) /* Cyrix ARRs (= MTRRs) */ ++#define X86_FEATURE_CENTAUR_MCR ( 3*32+ 3) /* Centaur MCRs (= MTRRs) */ ++ ++/* CPU types for specific tunings: */ ++#define X86_FEATURE_K8 ( 3*32+ 4) /* "" Opteron, Athlon64 */ ++#define X86_FEATURE_K7 ( 3*32+ 5) /* "" Athlon */ ++#define X86_FEATURE_P3 ( 3*32+ 6) /* "" P3 */ ++#define X86_FEATURE_P4 ( 3*32+ 7) /* "" P4 */ ++#define X86_FEATURE_CONSTANT_TSC ( 3*32+ 8) /* TSC ticks at a constant rate */ ++#define X86_FEATURE_UP ( 3*32+ 9) /* SMP kernel running on UP */ ++#define X86_FEATURE_ART ( 3*32+10) /* Always running timer (ART) */ ++#define X86_FEATURE_ARCH_PERFMON ( 3*32+11) /* Intel Architectural PerfMon */ ++#define X86_FEATURE_PEBS ( 3*32+12) /* Precise-Event Based Sampling */ ++#define X86_FEATURE_BTS ( 3*32+13) /* Branch Trace Store */ ++#define X86_FEATURE_SYSCALL32 ( 3*32+14) /* "" syscall in IA32 userspace */ ++#define X86_FEATURE_SYSENTER32 ( 3*32+15) /* "" sysenter in IA32 userspace */ ++#define X86_FEATURE_REP_GOOD ( 3*32+16) /* REP microcode works well */ ++#define X86_FEATURE_MFENCE_RDTSC ( 3*32+17) /* "" MFENCE synchronizes RDTSC */ ++#define X86_FEATURE_LFENCE_RDTSC ( 3*32+18) /* "" LFENCE synchronizes RDTSC */ ++#define X86_FEATURE_ACC_POWER ( 3*32+19) /* AMD Accumulated Power Mechanism */ ++#define X86_FEATURE_NOPL ( 3*32+20) /* The NOPL (0F 1F) instructions */ ++#define X86_FEATURE_ALWAYS ( 3*32+21) /* "" Always-present feature */ ++#define X86_FEATURE_XTOPOLOGY ( 3*32+22) /* CPU topology enum extensions */ ++#define X86_FEATURE_TSC_RELIABLE ( 3*32+23) /* TSC is known to be reliable */ ++#define X86_FEATURE_NONSTOP_TSC ( 3*32+24) /* TSC does not stop in C states */ ++#define X86_FEATURE_CPUID ( 3*32+25) /* CPU has CPUID instruction itself */ ++#define X86_FEATURE_EXTD_APICID ( 3*32+26) /* Extended APICID (8 bits) */ ++#define X86_FEATURE_AMD_DCM ( 3*32+27) /* AMD multi-node processor */ ++#define X86_FEATURE_APERFMPERF ( 3*32+28) /* P-State hardware coordination feedback capability (APERF/MPERF MSRs) */ ++#define X86_FEATURE_NONSTOP_TSC_S3 ( 3*32+30) /* TSC doesn't stop in S3 state */ ++#define X86_FEATURE_TSC_KNOWN_FREQ ( 3*32+31) /* TSC has known frequency */ + +-/* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */ +-#define X86_FEATURE_XMM3 ( 4*32+ 0) /* "pni" SSE-3 */ +-#define X86_FEATURE_PCLMULQDQ ( 4*32+ 1) /* PCLMULQDQ instruction */ +-#define X86_FEATURE_DTES64 ( 4*32+ 2) /* 64-bit Debug Store */ +-#define X86_FEATURE_MWAIT ( 4*32+ 3) /* "monitor" Monitor/Mwait support */ +-#define X86_FEATURE_DSCPL ( 4*32+ 4) /* "ds_cpl" CPL Qual. Debug Store */ +-#define X86_FEATURE_VMX ( 4*32+ 5) /* Hardware virtualization */ +-#define X86_FEATURE_SMX ( 4*32+ 6) /* Safer mode */ +-#define X86_FEATURE_EST ( 4*32+ 7) /* Enhanced SpeedStep */ +-#define X86_FEATURE_TM2 ( 4*32+ 8) /* Thermal Monitor 2 */ +-#define X86_FEATURE_SSSE3 ( 4*32+ 9) /* Supplemental SSE-3 */ +-#define X86_FEATURE_CID ( 4*32+10) /* Context ID */ +-#define X86_FEATURE_SDBG ( 4*32+11) /* Silicon Debug */ +-#define X86_FEATURE_FMA ( 4*32+12) /* Fused multiply-add */ +-#define X86_FEATURE_CX16 ( 4*32+13) /* CMPXCHG16B */ +-#define X86_FEATURE_XTPR ( 4*32+14) /* Send Task Priority Messages */ +-#define X86_FEATURE_PDCM ( 4*32+15) /* Performance Capabilities */ +-#define X86_FEATURE_PCID ( 4*32+17) /* Process Context Identifiers */ +-#define X86_FEATURE_DCA ( 4*32+18) /* Direct Cache Access */ +-#define X86_FEATURE_XMM4_1 ( 4*32+19) /* "sse4_1" SSE-4.1 */ +-#define X86_FEATURE_XMM4_2 ( 4*32+20) /* "sse4_2" SSE-4.2 */ +-#define X86_FEATURE_X2APIC ( 4*32+21) /* x2APIC */ +-#define X86_FEATURE_MOVBE ( 4*32+22) /* MOVBE instruction */ +-#define X86_FEATURE_POPCNT ( 4*32+23) /* POPCNT instruction */ +-#define X86_FEATURE_TSC_DEADLINE_TIMER ( 4*32+24) /* Tsc deadline timer */ +-#define X86_FEATURE_AES ( 4*32+25) /* AES instructions */ +-#define X86_FEATURE_XSAVE ( 4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV */ +-#define X86_FEATURE_OSXSAVE ( 4*32+27) /* "" XSAVE enabled in the OS */ +-#define X86_FEATURE_AVX ( 4*32+28) /* Advanced Vector Extensions */ +-#define X86_FEATURE_F16C ( 4*32+29) /* 16-bit fp conversions */ +-#define X86_FEATURE_RDRAND ( 4*32+30) /* The RDRAND instruction */ +-#define X86_FEATURE_HYPERVISOR ( 4*32+31) /* Running on a hypervisor */ ++/* Intel-defined CPU features, CPUID level 0x00000001 (ECX), word 4 */ ++#define X86_FEATURE_XMM3 ( 4*32+ 0) /* "pni" SSE-3 */ ++#define X86_FEATURE_PCLMULQDQ ( 4*32+ 1) /* PCLMULQDQ instruction */ ++#define X86_FEATURE_DTES64 ( 4*32+ 2) /* 64-bit Debug Store */ ++#define X86_FEATURE_MWAIT ( 4*32+ 3) /* "monitor" MONITOR/MWAIT support */ ++#define X86_FEATURE_DSCPL ( 4*32+ 4) /* "ds_cpl" CPL-qualified (filtered) Debug Store */ ++#define X86_FEATURE_VMX ( 4*32+ 5) /* Hardware virtualization */ ++#define X86_FEATURE_SMX ( 4*32+ 6) /* Safer Mode eXtensions */ ++#define X86_FEATURE_EST ( 4*32+ 7) /* Enhanced SpeedStep */ ++#define X86_FEATURE_TM2 ( 4*32+ 8) /* Thermal Monitor 2 */ ++#define X86_FEATURE_SSSE3 ( 4*32+ 9) /* Supplemental SSE-3 */ ++#define X86_FEATURE_CID ( 4*32+10) /* Context ID */ ++#define X86_FEATURE_SDBG ( 4*32+11) /* Silicon Debug */ ++#define X86_FEATURE_FMA ( 4*32+12) /* Fused multiply-add */ ++#define X86_FEATURE_CX16 ( 4*32+13) /* CMPXCHG16B instruction */ ++#define X86_FEATURE_XTPR ( 4*32+14) /* Send Task Priority Messages */ ++#define X86_FEATURE_PDCM ( 4*32+15) /* Perf/Debug Capabilities MSR */ ++#define X86_FEATURE_PCID ( 4*32+17) /* Process Context Identifiers */ ++#define X86_FEATURE_DCA ( 4*32+18) /* Direct Cache Access */ ++#define X86_FEATURE_XMM4_1 ( 4*32+19) /* "sse4_1" SSE-4.1 */ ++#define X86_FEATURE_XMM4_2 ( 4*32+20) /* "sse4_2" SSE-4.2 */ ++#define X86_FEATURE_X2APIC ( 4*32+21) /* X2APIC */ ++#define X86_FEATURE_MOVBE ( 4*32+22) /* MOVBE instruction */ ++#define X86_FEATURE_POPCNT ( 4*32+23) /* POPCNT instruction */ ++#define X86_FEATURE_TSC_DEADLINE_TIMER ( 4*32+24) /* TSC deadline timer */ ++#define X86_FEATURE_AES ( 4*32+25) /* AES instructions */ ++#define X86_FEATURE_XSAVE ( 4*32+26) /* XSAVE/XRSTOR/XSETBV/XGETBV instructions */ ++#define X86_FEATURE_OSXSAVE ( 4*32+27) /* "" XSAVE instruction enabled in the OS */ ++#define X86_FEATURE_AVX ( 4*32+28) /* Advanced Vector Extensions */ ++#define X86_FEATURE_F16C ( 4*32+29) /* 16-bit FP conversions */ ++#define X86_FEATURE_RDRAND ( 4*32+30) /* RDRAND instruction */ ++#define X86_FEATURE_HYPERVISOR ( 4*32+31) /* Running on a hypervisor */ + + /* VIA/Cyrix/Centaur-defined CPU features, CPUID level 0xC0000001, word 5 */ +-#define X86_FEATURE_XSTORE ( 5*32+ 2) /* "rng" RNG present (xstore) */ +-#define X86_FEATURE_XSTORE_EN ( 5*32+ 3) /* "rng_en" RNG enabled */ +-#define X86_FEATURE_XCRYPT ( 5*32+ 6) /* "ace" on-CPU crypto (xcrypt) */ +-#define X86_FEATURE_XCRYPT_EN ( 5*32+ 7) /* "ace_en" on-CPU crypto enabled */ +-#define X86_FEATURE_ACE2 ( 5*32+ 8) /* Advanced Cryptography Engine v2 */ +-#define X86_FEATURE_ACE2_EN ( 5*32+ 9) /* ACE v2 enabled */ +-#define X86_FEATURE_PHE ( 5*32+10) /* PadLock Hash Engine */ +-#define X86_FEATURE_PHE_EN ( 5*32+11) /* PHE enabled */ +-#define X86_FEATURE_PMM ( 5*32+12) /* PadLock Montgomery Multiplier */ +-#define X86_FEATURE_PMM_EN ( 5*32+13) /* PMM enabled */ ++#define X86_FEATURE_XSTORE ( 5*32+ 2) /* "rng" RNG present (xstore) */ ++#define X86_FEATURE_XSTORE_EN ( 5*32+ 3) /* "rng_en" RNG enabled */ ++#define X86_FEATURE_XCRYPT ( 5*32+ 6) /* "ace" on-CPU crypto (xcrypt) */ ++#define X86_FEATURE_XCRYPT_EN ( 5*32+ 7) /* "ace_en" on-CPU crypto enabled */ ++#define X86_FEATURE_ACE2 ( 5*32+ 8) /* Advanced Cryptography Engine v2 */ ++#define X86_FEATURE_ACE2_EN ( 5*32+ 9) /* ACE v2 enabled */ ++#define X86_FEATURE_PHE ( 5*32+10) /* PadLock Hash Engine */ ++#define X86_FEATURE_PHE_EN ( 5*32+11) /* PHE enabled */ ++#define X86_FEATURE_PMM ( 5*32+12) /* PadLock Montgomery Multiplier */ ++#define X86_FEATURE_PMM_EN ( 5*32+13) /* PMM enabled */ + +-/* More extended AMD flags: CPUID level 0x80000001, ecx, word 6 */ +-#define X86_FEATURE_LAHF_LM ( 6*32+ 0) /* LAHF/SAHF in long mode */ +-#define X86_FEATURE_CMP_LEGACY ( 6*32+ 1) /* If yes HyperThreading not valid */ +-#define X86_FEATURE_SVM ( 6*32+ 2) /* Secure virtual machine */ +-#define X86_FEATURE_EXTAPIC ( 6*32+ 3) /* Extended APIC space */ +-#define X86_FEATURE_CR8_LEGACY ( 6*32+ 4) /* CR8 in 32-bit mode */ +-#define X86_FEATURE_ABM ( 6*32+ 5) /* Advanced bit manipulation */ +-#define X86_FEATURE_SSE4A ( 6*32+ 6) /* SSE-4A */ +-#define X86_FEATURE_MISALIGNSSE ( 6*32+ 7) /* Misaligned SSE mode */ +-#define X86_FEATURE_3DNOWPREFETCH ( 6*32+ 8) /* 3DNow prefetch instructions */ +-#define X86_FEATURE_OSVW ( 6*32+ 9) /* OS Visible Workaround */ +-#define X86_FEATURE_IBS ( 6*32+10) /* Instruction Based Sampling */ +-#define X86_FEATURE_XOP ( 6*32+11) /* extended AVX instructions */ +-#define X86_FEATURE_SKINIT ( 6*32+12) /* SKINIT/STGI instructions */ +-#define X86_FEATURE_WDT ( 6*32+13) /* Watchdog timer */ +-#define X86_FEATURE_LWP ( 6*32+15) /* Light Weight Profiling */ +-#define X86_FEATURE_FMA4 ( 6*32+16) /* 4 operands MAC instructions */ +-#define X86_FEATURE_TCE ( 6*32+17) /* translation cache extension */ +-#define X86_FEATURE_NODEID_MSR ( 6*32+19) /* NodeId MSR */ +-#define X86_FEATURE_TBM ( 6*32+21) /* trailing bit manipulations */ +-#define X86_FEATURE_TOPOEXT ( 6*32+22) /* topology extensions CPUID leafs */ +-#define X86_FEATURE_PERFCTR_CORE ( 6*32+23) /* core performance counter extensions */ +-#define X86_FEATURE_PERFCTR_NB ( 6*32+24) /* NB performance counter extensions */ +-#define X86_FEATURE_BPEXT (6*32+26) /* data breakpoint extension */ +-#define X86_FEATURE_PTSC ( 6*32+27) /* performance time-stamp counter */ +-#define X86_FEATURE_PERFCTR_LLC ( 6*32+28) /* Last Level Cache performance counter extensions */ +-#define X86_FEATURE_MWAITX ( 6*32+29) /* MWAIT extension (MONITORX/MWAITX) */ ++/* More extended AMD flags: CPUID level 0x80000001, ECX, word 6 */ ++#define X86_FEATURE_LAHF_LM ( 6*32+ 0) /* LAHF/SAHF in long mode */ ++#define X86_FEATURE_CMP_LEGACY ( 6*32+ 1) /* If yes HyperThreading not valid */ ++#define X86_FEATURE_SVM ( 6*32+ 2) /* Secure Virtual Machine */ ++#define X86_FEATURE_EXTAPIC ( 6*32+ 3) /* Extended APIC space */ ++#define X86_FEATURE_CR8_LEGACY ( 6*32+ 4) /* CR8 in 32-bit mode */ ++#define X86_FEATURE_ABM ( 6*32+ 5) /* Advanced bit manipulation */ ++#define X86_FEATURE_SSE4A ( 6*32+ 6) /* SSE-4A */ ++#define X86_FEATURE_MISALIGNSSE ( 6*32+ 7) /* Misaligned SSE mode */ ++#define X86_FEATURE_3DNOWPREFETCH ( 6*32+ 8) /* 3DNow prefetch instructions */ ++#define X86_FEATURE_OSVW ( 6*32+ 9) /* OS Visible Workaround */ ++#define X86_FEATURE_IBS ( 6*32+10) /* Instruction Based Sampling */ ++#define X86_FEATURE_XOP ( 6*32+11) /* extended AVX instructions */ ++#define X86_FEATURE_SKINIT ( 6*32+12) /* SKINIT/STGI instructions */ ++#define X86_FEATURE_WDT ( 6*32+13) /* Watchdog timer */ ++#define X86_FEATURE_LWP ( 6*32+15) /* Light Weight Profiling */ ++#define X86_FEATURE_FMA4 ( 6*32+16) /* 4 operands MAC instructions */ ++#define X86_FEATURE_TCE ( 6*32+17) /* Translation Cache Extension */ ++#define X86_FEATURE_NODEID_MSR ( 6*32+19) /* NodeId MSR */ ++#define X86_FEATURE_TBM ( 6*32+21) /* Trailing Bit Manipulations */ ++#define X86_FEATURE_TOPOEXT ( 6*32+22) /* Topology extensions CPUID leafs */ ++#define X86_FEATURE_PERFCTR_CORE ( 6*32+23) /* Core performance counter extensions */ ++#define X86_FEATURE_PERFCTR_NB ( 6*32+24) /* NB performance counter extensions */ ++#define X86_FEATURE_BPEXT ( 6*32+26) /* Data breakpoint extension */ ++#define X86_FEATURE_PTSC ( 6*32+27) /* Performance time-stamp counter */ ++#define X86_FEATURE_PERFCTR_LLC ( 6*32+28) /* Last Level Cache performance counter extensions */ ++#define X86_FEATURE_MWAITX ( 6*32+29) /* MWAIT extension (MONITORX/MWAITX instructions) */ + + /* + * Auxiliary flags: Linux defined - For features scattered in various +@@ -187,146 +190,185 @@ + * + * Reuse free bits when adding new feature flags! + */ +-#define X86_FEATURE_RING3MWAIT ( 7*32+ 0) /* Ring 3 MONITOR/MWAIT */ +-#define X86_FEATURE_CPUID_FAULT ( 7*32+ 1) /* Intel CPUID faulting */ +-#define X86_FEATURE_CPB ( 7*32+ 2) /* AMD Core Performance Boost */ +-#define X86_FEATURE_EPB ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */ +-#define X86_FEATURE_CAT_L3 ( 7*32+ 4) /* Cache Allocation Technology L3 */ +-#define X86_FEATURE_CAT_L2 ( 7*32+ 5) /* Cache Allocation Technology L2 */ +-#define X86_FEATURE_CDP_L3 ( 7*32+ 6) /* Code and Data Prioritization L3 */ +- +-#define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ +-#define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ +-#define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ ++#define X86_FEATURE_RING3MWAIT ( 7*32+ 0) /* Ring 3 MONITOR/MWAIT instructions */ ++#define X86_FEATURE_CPUID_FAULT ( 7*32+ 1) /* Intel CPUID faulting */ ++#define X86_FEATURE_CPB ( 7*32+ 2) /* AMD Core Performance Boost */ ++#define X86_FEATURE_EPB ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */ ++#define X86_FEATURE_CAT_L3 ( 7*32+ 4) /* Cache Allocation Technology L3 */ ++#define X86_FEATURE_CAT_L2 ( 7*32+ 5) /* Cache Allocation Technology L2 */ ++#define X86_FEATURE_CDP_L3 ( 7*32+ 6) /* Code and Data Prioritization L3 */ ++#define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 7) /* Effectively INVPCID && CR4.PCIDE=1 */ ++#define X86_FEATURE_HW_PSTATE ( 7*32+ 8) /* AMD HW-PState */ ++#define X86_FEATURE_PROC_FEEDBACK ( 7*32+ 9) /* AMD ProcFeedbackInterface */ ++#define X86_FEATURE_SME ( 7*32+10) /* AMD Secure Memory Encryption */ ++#define X86_FEATURE_PTI ( 7*32+11) /* Kernel Page Table Isolation enabled */ ++#define X86_FEATURE_RETPOLINE ( 7*32+12) /* "" Generic Retpoline mitigation for Spectre variant 2 */ ++#define X86_FEATURE_RETPOLINE_AMD ( 7*32+13) /* "" AMD Retpoline mitigation for Spectre variant 2 */ ++#define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ + +-#define X86_FEATURE_INTEL_PPIN ( 7*32+14) /* Intel Processor Inventory Number */ +-#define X86_FEATURE_INTEL_PT ( 7*32+15) /* Intel Processor Trace */ +-#define X86_FEATURE_AVX512_4VNNIW (7*32+16) /* AVX-512 Neural Network Instructions */ +-#define X86_FEATURE_AVX512_4FMAPS (7*32+17) /* AVX-512 Multiply Accumulation Single precision */ ++#define X86_FEATURE_MSR_SPEC_CTRL ( 7*32+16) /* "" MSR SPEC_CTRL is implemented */ ++#define X86_FEATURE_SSBD ( 7*32+17) /* Speculative Store Bypass Disable */ ++#define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ ++#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* "" Fill RSB on context switches */ + +-#define X86_FEATURE_MBA ( 7*32+18) /* Memory Bandwidth Allocation */ ++#define X86_FEATURE_USE_IBPB ( 7*32+21) /* "" Indirect Branch Prediction Barrier enabled */ ++#define X86_FEATURE_USE_IBRS_FW ( 7*32+22) /* "" Use IBRS during runtime firmware calls */ ++#define X86_FEATURE_SPEC_STORE_BYPASS_DISABLE ( 7*32+23) /* "" Disable Speculative Store Bypass. */ ++#define X86_FEATURE_LS_CFG_SSBD ( 7*32+24) /* "" AMD SSBD implementation via LS_CFG MSR */ ++#define X86_FEATURE_IBRS ( 7*32+25) /* Indirect Branch Restricted Speculation */ ++#define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */ ++#define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ + + /* Virtualization flags: Linux defined, word 8 */ +-#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ +-#define X86_FEATURE_VNMI ( 8*32+ 1) /* Intel Virtual NMI */ +-#define X86_FEATURE_FLEXPRIORITY ( 8*32+ 2) /* Intel FlexPriority */ +-#define X86_FEATURE_EPT ( 8*32+ 3) /* Intel Extended Page Table */ +-#define X86_FEATURE_VPID ( 8*32+ 4) /* Intel Virtual Processor ID */ ++#define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ ++#define X86_FEATURE_VNMI ( 8*32+ 1) /* Intel Virtual NMI */ ++#define X86_FEATURE_FLEXPRIORITY ( 8*32+ 2) /* Intel FlexPriority */ ++#define X86_FEATURE_EPT ( 8*32+ 3) /* Intel Extended Page Table */ ++#define X86_FEATURE_VPID ( 8*32+ 4) /* Intel Virtual Processor ID */ + +-#define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer vmmcall to vmcall */ +-#define X86_FEATURE_XENPV ( 8*32+16) /* "" Xen paravirtual guest */ ++#define X86_FEATURE_VMMCALL ( 8*32+15) /* Prefer VMMCALL to VMCALL */ ++#define X86_FEATURE_XENPV ( 8*32+16) /* "" Xen paravirtual guest */ + + +-/* Intel-defined CPU features, CPUID level 0x00000007:0 (ebx), word 9 */ +-#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* {RD/WR}{FS/GS}BASE instructions*/ +-#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3b */ +-#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */ +-#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */ +-#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */ +-#define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Protection */ +-#define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */ +-#define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB */ +-#define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */ +-#define X86_FEATURE_RTM ( 9*32+11) /* Restricted Transactional Memory */ +-#define X86_FEATURE_CQM ( 9*32+12) /* Cache QoS Monitoring */ +-#define X86_FEATURE_MPX ( 9*32+14) /* Memory Protection Extension */ +-#define X86_FEATURE_RDT_A ( 9*32+15) /* Resource Director Technology Allocation */ +-#define X86_FEATURE_AVX512F ( 9*32+16) /* AVX-512 Foundation */ +-#define X86_FEATURE_AVX512DQ ( 9*32+17) /* AVX-512 DQ (Double/Quad granular) Instructions */ +-#define X86_FEATURE_RDSEED ( 9*32+18) /* The RDSEED instruction */ +-#define X86_FEATURE_ADX ( 9*32+19) /* The ADCX and ADOX instructions */ +-#define X86_FEATURE_SMAP ( 9*32+20) /* Supervisor Mode Access Prevention */ +-#define X86_FEATURE_AVX512IFMA ( 9*32+21) /* AVX-512 Integer Fused Multiply-Add instructions */ +-#define X86_FEATURE_CLFLUSHOPT ( 9*32+23) /* CLFLUSHOPT instruction */ +-#define X86_FEATURE_CLWB ( 9*32+24) /* CLWB instruction */ +-#define X86_FEATURE_AVX512PF ( 9*32+26) /* AVX-512 Prefetch */ +-#define X86_FEATURE_AVX512ER ( 9*32+27) /* AVX-512 Exponential and Reciprocal */ +-#define X86_FEATURE_AVX512CD ( 9*32+28) /* AVX-512 Conflict Detection */ +-#define X86_FEATURE_SHA_NI ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */ +-#define X86_FEATURE_AVX512BW ( 9*32+30) /* AVX-512 BW (Byte/Word granular) Instructions */ +-#define X86_FEATURE_AVX512VL ( 9*32+31) /* AVX-512 VL (128/256 Vector Length) Extensions */ ++/* Intel-defined CPU features, CPUID level 0x00000007:0 (EBX), word 9 */ ++#define X86_FEATURE_FSGSBASE ( 9*32+ 0) /* RDFSBASE, WRFSBASE, RDGSBASE, WRGSBASE instructions*/ ++#define X86_FEATURE_TSC_ADJUST ( 9*32+ 1) /* TSC adjustment MSR 0x3B */ ++#define X86_FEATURE_BMI1 ( 9*32+ 3) /* 1st group bit manipulation extensions */ ++#define X86_FEATURE_HLE ( 9*32+ 4) /* Hardware Lock Elision */ ++#define X86_FEATURE_AVX2 ( 9*32+ 5) /* AVX2 instructions */ ++#define X86_FEATURE_SMEP ( 9*32+ 7) /* Supervisor Mode Execution Protection */ ++#define X86_FEATURE_BMI2 ( 9*32+ 8) /* 2nd group bit manipulation extensions */ ++#define X86_FEATURE_ERMS ( 9*32+ 9) /* Enhanced REP MOVSB/STOSB instructions */ ++#define X86_FEATURE_INVPCID ( 9*32+10) /* Invalidate Processor Context ID */ ++#define X86_FEATURE_RTM ( 9*32+11) /* Restricted Transactional Memory */ ++#define X86_FEATURE_CQM ( 9*32+12) /* Cache QoS Monitoring */ ++#define X86_FEATURE_MPX ( 9*32+14) /* Memory Protection Extension */ ++#define X86_FEATURE_RDT_A ( 9*32+15) /* Resource Director Technology Allocation */ ++#define X86_FEATURE_AVX512F ( 9*32+16) /* AVX-512 Foundation */ ++#define X86_FEATURE_AVX512DQ ( 9*32+17) /* AVX-512 DQ (Double/Quad granular) Instructions */ ++#define X86_FEATURE_RDSEED ( 9*32+18) /* RDSEED instruction */ ++#define X86_FEATURE_ADX ( 9*32+19) /* ADCX and ADOX instructions */ ++#define X86_FEATURE_SMAP ( 9*32+20) /* Supervisor Mode Access Prevention */ ++#define X86_FEATURE_AVX512IFMA ( 9*32+21) /* AVX-512 Integer Fused Multiply-Add instructions */ ++#define X86_FEATURE_CLFLUSHOPT ( 9*32+23) /* CLFLUSHOPT instruction */ ++#define X86_FEATURE_CLWB ( 9*32+24) /* CLWB instruction */ ++#define X86_FEATURE_INTEL_PT ( 9*32+25) /* Intel Processor Trace */ ++#define X86_FEATURE_AVX512PF ( 9*32+26) /* AVX-512 Prefetch */ ++#define X86_FEATURE_AVX512ER ( 9*32+27) /* AVX-512 Exponential and Reciprocal */ ++#define X86_FEATURE_AVX512CD ( 9*32+28) /* AVX-512 Conflict Detection */ ++#define X86_FEATURE_SHA_NI ( 9*32+29) /* SHA1/SHA256 Instruction Extensions */ ++#define X86_FEATURE_AVX512BW ( 9*32+30) /* AVX-512 BW (Byte/Word granular) Instructions */ ++#define X86_FEATURE_AVX512VL ( 9*32+31) /* AVX-512 VL (128/256 Vector Length) Extensions */ + +-/* Extended state features, CPUID level 0x0000000d:1 (eax), word 10 */ +-#define X86_FEATURE_XSAVEOPT (10*32+ 0) /* XSAVEOPT */ +-#define X86_FEATURE_XSAVEC (10*32+ 1) /* XSAVEC */ +-#define X86_FEATURE_XGETBV1 (10*32+ 2) /* XGETBV with ECX = 1 */ +-#define X86_FEATURE_XSAVES (10*32+ 3) /* XSAVES/XRSTORS */ ++/* Extended state features, CPUID level 0x0000000d:1 (EAX), word 10 */ ++#define X86_FEATURE_XSAVEOPT (10*32+ 0) /* XSAVEOPT instruction */ ++#define X86_FEATURE_XSAVEC (10*32+ 1) /* XSAVEC instruction */ ++#define X86_FEATURE_XGETBV1 (10*32+ 2) /* XGETBV with ECX = 1 instruction */ ++#define X86_FEATURE_XSAVES (10*32+ 3) /* XSAVES/XRSTORS instructions */ + +-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (edx), word 11 */ +-#define X86_FEATURE_CQM_LLC (11*32+ 1) /* LLC QoS if 1 */ ++/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:0 (EDX), word 11 */ ++#define X86_FEATURE_CQM_LLC (11*32+ 1) /* LLC QoS if 1 */ + +-/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (edx), word 12 */ +-#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring if 1 */ +-#define X86_FEATURE_CQM_MBM_TOTAL (12*32+ 1) /* LLC Total MBM monitoring */ +-#define X86_FEATURE_CQM_MBM_LOCAL (12*32+ 2) /* LLC Local MBM monitoring */ ++/* Intel-defined CPU QoS Sub-leaf, CPUID level 0x0000000F:1 (EDX), word 12 */ ++#define X86_FEATURE_CQM_OCCUP_LLC (12*32+ 0) /* LLC occupancy monitoring */ ++#define X86_FEATURE_CQM_MBM_TOTAL (12*32+ 1) /* LLC Total MBM monitoring */ ++#define X86_FEATURE_CQM_MBM_LOCAL (12*32+ 2) /* LLC Local MBM monitoring */ + +-/* AMD-defined CPU features, CPUID level 0x80000008 (ebx), word 13 */ +-#define X86_FEATURE_CLZERO (13*32+0) /* CLZERO instruction */ +-#define X86_FEATURE_IRPERF (13*32+1) /* Instructions Retired Count */ ++/* AMD-defined CPU features, CPUID level 0x80000008 (EBX), word 13 */ ++#define X86_FEATURE_CLZERO (13*32+ 0) /* CLZERO instruction */ ++#define X86_FEATURE_IRPERF (13*32+ 1) /* Instructions Retired Count */ ++#define X86_FEATURE_XSAVEERPTR (13*32+ 2) /* Always save/restore FP error pointers */ ++#define X86_FEATURE_AMD_IBPB (13*32+12) /* "" Indirect Branch Prediction Barrier */ ++#define X86_FEATURE_AMD_IBRS (13*32+14) /* "" Indirect Branch Restricted Speculation */ ++#define X86_FEATURE_AMD_STIBP (13*32+15) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_VIRT_SSBD (13*32+25) /* Virtualized Speculative Store Bypass Disable */ + +-/* Thermal and Power Management Leaf, CPUID level 0x00000006 (eax), word 14 */ +-#define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */ +-#define X86_FEATURE_IDA (14*32+ 1) /* Intel Dynamic Acceleration */ +-#define X86_FEATURE_ARAT (14*32+ 2) /* Always Running APIC Timer */ +-#define X86_FEATURE_PLN (14*32+ 4) /* Intel Power Limit Notification */ +-#define X86_FEATURE_PTS (14*32+ 6) /* Intel Package Thermal Status */ +-#define X86_FEATURE_HWP (14*32+ 7) /* Intel Hardware P-states */ +-#define X86_FEATURE_HWP_NOTIFY (14*32+ 8) /* HWP Notification */ +-#define X86_FEATURE_HWP_ACT_WINDOW (14*32+ 9) /* HWP Activity Window */ +-#define X86_FEATURE_HWP_EPP (14*32+10) /* HWP Energy Perf. Preference */ +-#define X86_FEATURE_HWP_PKG_REQ (14*32+11) /* HWP Package Level Request */ ++/* Thermal and Power Management Leaf, CPUID level 0x00000006 (EAX), word 14 */ ++#define X86_FEATURE_DTHERM (14*32+ 0) /* Digital Thermal Sensor */ ++#define X86_FEATURE_IDA (14*32+ 1) /* Intel Dynamic Acceleration */ ++#define X86_FEATURE_ARAT (14*32+ 2) /* Always Running APIC Timer */ ++#define X86_FEATURE_PLN (14*32+ 4) /* Intel Power Limit Notification */ ++#define X86_FEATURE_PTS (14*32+ 6) /* Intel Package Thermal Status */ ++#define X86_FEATURE_HWP (14*32+ 7) /* Intel Hardware P-states */ ++#define X86_FEATURE_HWP_NOTIFY (14*32+ 8) /* HWP Notification */ ++#define X86_FEATURE_HWP_ACT_WINDOW (14*32+ 9) /* HWP Activity Window */ ++#define X86_FEATURE_HWP_EPP (14*32+10) /* HWP Energy Perf. Preference */ ++#define X86_FEATURE_HWP_PKG_REQ (14*32+11) /* HWP Package Level Request */ + +-/* AMD SVM Feature Identification, CPUID level 0x8000000a (edx), word 15 */ +-#define X86_FEATURE_NPT (15*32+ 0) /* Nested Page Table support */ +-#define X86_FEATURE_LBRV (15*32+ 1) /* LBR Virtualization support */ +-#define X86_FEATURE_SVML (15*32+ 2) /* "svm_lock" SVM locking MSR */ +-#define X86_FEATURE_NRIPS (15*32+ 3) /* "nrip_save" SVM next_rip save */ +-#define X86_FEATURE_TSCRATEMSR (15*32+ 4) /* "tsc_scale" TSC scaling support */ +-#define X86_FEATURE_VMCBCLEAN (15*32+ 5) /* "vmcb_clean" VMCB clean bits support */ +-#define X86_FEATURE_FLUSHBYASID (15*32+ 6) /* flush-by-ASID support */ +-#define X86_FEATURE_DECODEASSISTS (15*32+ 7) /* Decode Assists support */ +-#define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */ +-#define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */ +-#define X86_FEATURE_AVIC (15*32+13) /* Virtual Interrupt Controller */ +-#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */ +-#define X86_FEATURE_VGIF (15*32+16) /* Virtual GIF */ ++/* AMD SVM Feature Identification, CPUID level 0x8000000a (EDX), word 15 */ ++#define X86_FEATURE_NPT (15*32+ 0) /* Nested Page Table support */ ++#define X86_FEATURE_LBRV (15*32+ 1) /* LBR Virtualization support */ ++#define X86_FEATURE_SVML (15*32+ 2) /* "svm_lock" SVM locking MSR */ ++#define X86_FEATURE_NRIPS (15*32+ 3) /* "nrip_save" SVM next_rip save */ ++#define X86_FEATURE_TSCRATEMSR (15*32+ 4) /* "tsc_scale" TSC scaling support */ ++#define X86_FEATURE_VMCBCLEAN (15*32+ 5) /* "vmcb_clean" VMCB clean bits support */ ++#define X86_FEATURE_FLUSHBYASID (15*32+ 6) /* flush-by-ASID support */ ++#define X86_FEATURE_DECODEASSISTS (15*32+ 7) /* Decode Assists support */ ++#define X86_FEATURE_PAUSEFILTER (15*32+10) /* filtered pause intercept */ ++#define X86_FEATURE_PFTHRESHOLD (15*32+12) /* pause filter threshold */ ++#define X86_FEATURE_AVIC (15*32+13) /* Virtual Interrupt Controller */ ++#define X86_FEATURE_V_VMSAVE_VMLOAD (15*32+15) /* Virtual VMSAVE VMLOAD */ ++#define X86_FEATURE_VGIF (15*32+16) /* Virtual GIF */ + +-/* Intel-defined CPU features, CPUID level 0x00000007:0 (ecx), word 16 */ +-#define X86_FEATURE_AVX512VBMI (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/ +-#define X86_FEATURE_PKU (16*32+ 3) /* Protection Keys for Userspace */ +-#define X86_FEATURE_OSPKE (16*32+ 4) /* OS Protection Keys Enable */ +-#define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */ +-#define X86_FEATURE_LA57 (16*32+16) /* 5-level page tables */ +-#define X86_FEATURE_RDPID (16*32+22) /* RDPID instruction */ ++/* Intel-defined CPU features, CPUID level 0x00000007:0 (ECX), word 16 */ ++#define X86_FEATURE_AVX512VBMI (16*32+ 1) /* AVX512 Vector Bit Manipulation instructions*/ ++#define X86_FEATURE_UMIP (16*32+ 2) /* User Mode Instruction Protection */ ++#define X86_FEATURE_PKU (16*32+ 3) /* Protection Keys for Userspace */ ++#define X86_FEATURE_OSPKE (16*32+ 4) /* OS Protection Keys Enable */ ++#define X86_FEATURE_AVX512_VBMI2 (16*32+ 6) /* Additional AVX512 Vector Bit Manipulation Instructions */ ++#define X86_FEATURE_GFNI (16*32+ 8) /* Galois Field New Instructions */ ++#define X86_FEATURE_VAES (16*32+ 9) /* Vector AES */ ++#define X86_FEATURE_VPCLMULQDQ (16*32+10) /* Carry-Less Multiplication Double Quadword */ ++#define X86_FEATURE_AVX512_VNNI (16*32+11) /* Vector Neural Network Instructions */ ++#define X86_FEATURE_AVX512_BITALG (16*32+12) /* Support for VPOPCNT[B,W] and VPSHUF-BITQMB instructions */ ++#define X86_FEATURE_TME (16*32+13) /* Intel Total Memory Encryption */ ++#define X86_FEATURE_AVX512_VPOPCNTDQ (16*32+14) /* POPCNT for vectors of DW/QW */ ++#define X86_FEATURE_LA57 (16*32+16) /* 5-level page tables */ ++#define X86_FEATURE_RDPID (16*32+22) /* RDPID instruction */ + +-/* AMD-defined CPU features, CPUID level 0x80000007 (ebx), word 17 */ +-#define X86_FEATURE_OVERFLOW_RECOV (17*32+0) /* MCA overflow recovery support */ +-#define X86_FEATURE_SUCCOR (17*32+1) /* Uncorrectable error containment and recovery */ +-#define X86_FEATURE_SMCA (17*32+3) /* Scalable MCA */ ++/* AMD-defined CPU features, CPUID level 0x80000007 (EBX), word 17 */ ++#define X86_FEATURE_OVERFLOW_RECOV (17*32+ 0) /* MCA overflow recovery support */ ++#define X86_FEATURE_SUCCOR (17*32+ 1) /* Uncorrectable error containment and recovery */ ++#define X86_FEATURE_SMCA (17*32+ 3) /* Scalable MCA */ ++ ++/* Intel-defined CPU features, CPUID level 0x00000007:0 (EDX), word 18 */ ++#define X86_FEATURE_AVX512_4VNNIW (18*32+ 2) /* AVX-512 Neural Network Instructions */ ++#define X86_FEATURE_AVX512_4FMAPS (18*32+ 3) /* AVX-512 Multiply Accumulation Single precision */ ++#define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ ++#define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ ++#define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ ++#define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ + + /* + * BUG word(s) + */ +-#define X86_BUG(x) (NCAPINTS*32 + (x)) ++#define X86_BUG(x) (NCAPINTS*32 + (x)) + +-#define X86_BUG_F00F X86_BUG(0) /* Intel F00F */ +-#define X86_BUG_FDIV X86_BUG(1) /* FPU FDIV */ +-#define X86_BUG_COMA X86_BUG(2) /* Cyrix 6x86 coma */ +-#define X86_BUG_AMD_TLB_MMATCH X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */ +-#define X86_BUG_AMD_APIC_C1E X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */ +-#define X86_BUG_11AP X86_BUG(5) /* Bad local APIC aka 11AP */ +-#define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ +-#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ +-#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ ++#define X86_BUG_F00F X86_BUG(0) /* Intel F00F */ ++#define X86_BUG_FDIV X86_BUG(1) /* FPU FDIV */ ++#define X86_BUG_COMA X86_BUG(2) /* Cyrix 6x86 coma */ ++#define X86_BUG_AMD_TLB_MMATCH X86_BUG(3) /* "tlb_mmatch" AMD Erratum 383 */ ++#define X86_BUG_AMD_APIC_C1E X86_BUG(4) /* "apic_c1e" AMD Erratum 400 */ ++#define X86_BUG_11AP X86_BUG(5) /* Bad local APIC aka 11AP */ ++#define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ ++#define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ ++#define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ + #ifdef CONFIG_X86_32 + /* + * 64-bit kernels don't use X86_BUG_ESPFIX. Make the define conditional + * to avoid confusion. + */ +-#define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ ++#define X86_BUG_ESPFIX X86_BUG(9) /* "" IRET to 16-bit SS corrupts ESP/RSP high bits */ + #endif +-#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */ +-#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */ +-#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */ +-#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */ ++#define X86_BUG_NULL_SEG X86_BUG(10) /* Nulling a selector preserves the base */ ++#define X86_BUG_SWAPGS_FENCE X86_BUG(11) /* SWAPGS without input dep on GS */ ++#define X86_BUG_MONITOR X86_BUG(12) /* IPI required to wake up remote CPU */ ++#define X86_BUG_AMD_E400 X86_BUG(13) /* CPU is among the affected by Erratum 400 */ ++#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ ++#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ ++#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ ++#define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ ++ + #endif /* _ASM_X86_CPUFEATURES_H */ +diff --git a/tools/arch/x86/include/asm/disabled-features.h b/tools/arch/x86/include/asm/disabled-features.h +index c10c9128f54e..c6a3af198294 100644 +--- a/tools/arch/x86/include/asm/disabled-features.h ++++ b/tools/arch/x86/include/asm/disabled-features.h +@@ -44,6 +44,12 @@ + # define DISABLE_LA57 (1<<(X86_FEATURE_LA57 & 31)) + #endif + ++#ifdef CONFIG_PAGE_TABLE_ISOLATION ++# define DISABLE_PTI 0 ++#else ++# define DISABLE_PTI (1 << (X86_FEATURE_PTI & 31)) ++#endif ++ + /* + * Make sure to add features to the correct mask + */ +@@ -54,7 +60,7 @@ + #define DISABLED_MASK4 (DISABLE_PCID) + #define DISABLED_MASK5 0 + #define DISABLED_MASK6 0 +-#define DISABLED_MASK7 0 ++#define DISABLED_MASK7 (DISABLE_PTI) + #define DISABLED_MASK8 0 + #define DISABLED_MASK9 (DISABLE_MPX) + #define DISABLED_MASK10 0 +@@ -65,6 +71,7 @@ + #define DISABLED_MASK15 0 + #define DISABLED_MASK16 (DISABLE_PKU|DISABLE_OSPKE|DISABLE_LA57) + #define DISABLED_MASK17 0 +-#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18) ++#define DISABLED_MASK18 0 ++#define DISABLED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) + + #endif /* _ASM_X86_DISABLED_FEATURES_H */ +diff --git a/tools/arch/x86/include/asm/required-features.h b/tools/arch/x86/include/asm/required-features.h +index d91ba04dd007..fb3a6de7440b 100644 +--- a/tools/arch/x86/include/asm/required-features.h ++++ b/tools/arch/x86/include/asm/required-features.h +@@ -106,6 +106,7 @@ + #define REQUIRED_MASK15 0 + #define REQUIRED_MASK16 (NEED_LA57) + #define REQUIRED_MASK17 0 +-#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 18) ++#define REQUIRED_MASK18 0 ++#define REQUIRED_MASK_CHECK BUILD_BUG_ON_ZERO(NCAPINTS != 19) + + #endif /* _ASM_X86_REQUIRED_FEATURES_H */ +diff --git a/tools/include/uapi/linux/kvm.h b/tools/include/uapi/linux/kvm.h +index 7e99999d6236..857bad91c454 100644 +--- a/tools/include/uapi/linux/kvm.h ++++ b/tools/include/uapi/linux/kvm.h +@@ -931,6 +931,7 @@ struct kvm_ppc_resize_hpt { + #define KVM_CAP_PPC_SMT_POSSIBLE 147 + #define KVM_CAP_HYPERV_SYNIC2 148 + #define KVM_CAP_HYPERV_VP_INDEX 149 ++#define KVM_CAP_S390_BPB 152 + + #ifdef KVM_CAP_IRQ_ROUTING + +diff --git a/tools/perf/.gitignore b/tools/perf/.gitignore +index 643cc4ba6872..3e5135dded16 100644 +--- a/tools/perf/.gitignore ++++ b/tools/perf/.gitignore +@@ -31,5 +31,6 @@ config.mak.autogen + .config-detected + util/intel-pt-decoder/inat-tables.c + arch/*/include/generated/ ++trace/beauty/generated/ + pmu-events/pmu-events.c + pmu-events/jevents +diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c +index 3b570e808b31..b205c1340456 100644 +--- a/tools/perf/builtin-record.c ++++ b/tools/perf/builtin-record.c +@@ -926,15 +926,6 @@ static int __cmd_record(struct record *rec, int argc, const char **argv) + } + } + +- /* +- * If we have just single event and are sending data +- * through pipe, we need to force the ids allocation, +- * because we synthesize event name through the pipe +- * and need the id for that. +- */ +- if (data->is_pipe && rec->evlist->nr_entries == 1) +- rec->opts.sample_id = true; +- + if (record__open(rec) != 0) { + err = -1; + goto out_child; +diff --git a/tools/perf/perf.h b/tools/perf/perf.h +index de1debcd3ee7..55086389fc06 100644 +--- a/tools/perf/perf.h ++++ b/tools/perf/perf.h +@@ -61,7 +61,6 @@ struct record_opts { + bool tail_synthesize; + bool overwrite; + bool ignore_missing_thread; +- bool sample_id; + unsigned int freq; + unsigned int mmap_pages; + unsigned int auxtrace_mmap_pages; +diff --git a/tools/perf/util/record.c b/tools/perf/util/record.c +index 6f09e4962dad..1e97937b03a9 100644 +--- a/tools/perf/util/record.c ++++ b/tools/perf/util/record.c +@@ -137,7 +137,6 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + struct perf_evsel *evsel; + bool use_sample_identifier = false; + bool use_comm_exec; +- bool sample_id = opts->sample_id; + + /* + * Set the evsel leader links before we configure attributes, +@@ -164,7 +163,8 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + * match the id. + */ + use_sample_identifier = perf_can_sample_identifier(); +- sample_id = true; ++ evlist__for_each_entry(evlist, evsel) ++ perf_evsel__set_sample_id(evsel, use_sample_identifier); + } else if (evlist->nr_entries > 1) { + struct perf_evsel *first = perf_evlist__first(evlist); + +@@ -174,10 +174,6 @@ void perf_evlist__config(struct perf_evlist *evlist, struct record_opts *opts, + use_sample_identifier = perf_can_sample_identifier(); + break; + } +- sample_id = true; +- } +- +- if (sample_id) { + evlist__for_each_entry(evlist, evsel) + perf_evsel__set_sample_id(evsel, use_sample_identifier); + } diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.134-135.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.46-47.patch similarity index 59% rename from patch/kernel/mvebu64-default/04-patch-4.4.134-135.patch rename to patch/kernel/mvebu64-default/0004-patch-4.14.46-47.patch index d31ea123737d..ded7b4e1e0d1 100644 --- a/patch/kernel/mvebu64-default/04-patch-4.4.134-135.patch +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.46-47.patch @@ -1,20 +1,21 @@ diff --git a/Makefile b/Makefile -index 119dbcb4f311..9b14a5a224c5 100644 +index 3b1845f2b8f8..d6db01a02252 100644 --- a/Makefile +++ b/Makefile -@@ -1,6 +1,6 @@ +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 134 -+SUBLEVEL = 135 + PATCHLEVEL = 14 +-SUBLEVEL = 46 ++SUBLEVEL = 47 EXTRAVERSION = - NAME = Blurry Fish Butt + NAME = Petit Gorille diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index fa79e8118b9b..4b7c81f88abf 100644 +index 5c5699c08575..00d4371d4573 100644 --- a/net/ipv4/ip_vti.c +++ b/net/ipv4/ip_vti.c -@@ -366,6 +366,7 @@ static int vti_tunnel_init(struct net_device *dev) +@@ -396,6 +396,7 @@ static int vti_tunnel_init(struct net_device *dev) memcpy(dev->dev_addr, &iph->saddr, 4); memcpy(dev->broadcast, &iph->daddr, 4); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.47-48.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.47-48.patch new file mode 100644 index 000000000000..891c066d181d --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.47-48.patch @@ -0,0 +1,2503 @@ +diff --git a/Makefile b/Makefile +index d6db01a02252..7a246f1ce44e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 47 ++SUBLEVEL = 48 + EXTRAVERSION = + NAME = Petit Gorille + +@@ -369,11 +369,6 @@ HOSTCXXFLAGS := -O2 $(HOST_LFS_CFLAGS) + HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) + HOST_LOADLIBES := $(HOST_LFS_LIBS) + +-ifeq ($(shell $(HOSTCC) -v 2>&1 | grep -c "clang version"), 1) +-HOSTCFLAGS += -Wno-unused-value -Wno-unused-parameter \ +- -Wno-missing-field-initializers -fno-delete-null-pointer-checks +-endif +- + # Make variables (CC, etc...) + AS = $(CROSS_COMPILE)as + LD = $(CROSS_COMPILE)ld +@@ -711,7 +706,6 @@ KBUILD_CFLAGS += $(stackp-flag) + + ifeq ($(cc-name),clang) + KBUILD_CPPFLAGS += $(call cc-option,-Qunused-arguments,) +-KBUILD_CFLAGS += $(call cc-disable-warning, unused-variable) + KBUILD_CFLAGS += $(call cc-disable-warning, format-invalid-specifier) + KBUILD_CFLAGS += $(call cc-disable-warning, gnu) + KBUILD_CFLAGS += $(call cc-disable-warning, address-of-packed-member) +@@ -729,9 +723,9 @@ else + # These warnings generated too much noise in a regular build. + # Use make W=1 to enable them (see scripts/Makefile.extrawarn) + KBUILD_CFLAGS += $(call cc-disable-warning, unused-but-set-variable) +-KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + endif + ++KBUILD_CFLAGS += $(call cc-disable-warning, unused-const-variable) + ifdef CONFIG_FRAME_POINTER + KBUILD_CFLAGS += -fno-omit-frame-pointer -fno-optimize-sibling-calls + else +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index 2f2d176396aa..e1ddb94a6522 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -721,6 +721,10 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value) + if (value & ~known_bits) + return -EOPNOTSUPP; + ++ /* Setting FRE without FR is not supported. */ ++ if ((value & (PR_FP_MODE_FR | PR_FP_MODE_FRE)) == PR_FP_MODE_FRE) ++ return -EOPNOTSUPP; ++ + /* Avoid inadvertently triggering emulation */ + if ((value & PR_FP_MODE_FR) && raw_cpu_has_fpu && + !(raw_current_cpu_data.fpu_id & MIPS_FPIR_F64)) +diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c +index 006105fb12fe..e058cd300713 100644 +--- a/arch/mips/kernel/ptrace.c ++++ b/arch/mips/kernel/ptrace.c +@@ -809,7 +809,7 @@ long arch_ptrace(struct task_struct *child, long request, + break; + } + #endif +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; +diff --git a/arch/mips/kernel/ptrace32.c b/arch/mips/kernel/ptrace32.c +index 4a157d3249ac..89026d33a07b 100644 +--- a/arch/mips/kernel/ptrace32.c ++++ b/arch/mips/kernel/ptrace32.c +@@ -108,7 +108,7 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request, + addr & 1); + break; + } +- tmp = get_fpr32(&fregs[addr - FPR_BASE], 0); ++ tmp = get_fpr64(&fregs[addr - FPR_BASE], 0); + break; + case PC: + tmp = regs->cp0_epc; +diff --git a/arch/powerpc/include/asm/book3s/64/slice.h b/arch/powerpc/include/asm/book3s/64/slice.h +new file mode 100644 +index 000000000000..db0dedab65ee +--- /dev/null ++++ b/arch/powerpc/include/asm/book3s/64/slice.h +@@ -0,0 +1,27 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_POWERPC_BOOK3S_64_SLICE_H ++#define _ASM_POWERPC_BOOK3S_64_SLICE_H ++ ++#ifdef CONFIG_PPC_MM_SLICES ++ ++#define SLICE_LOW_SHIFT 28 ++#define SLICE_LOW_TOP (0x100000000ul) ++#define SLICE_NUM_LOW (SLICE_LOW_TOP >> SLICE_LOW_SHIFT) ++#define GET_LOW_SLICE_INDEX(addr) ((addr) >> SLICE_LOW_SHIFT) ++ ++#define SLICE_HIGH_SHIFT 40 ++#define SLICE_NUM_HIGH (H_PGTABLE_RANGE >> SLICE_HIGH_SHIFT) ++#define GET_HIGH_SLICE_INDEX(addr) ((addr) >> SLICE_HIGH_SHIFT) ++ ++#else /* CONFIG_PPC_MM_SLICES */ ++ ++#define get_slice_psize(mm, addr) ((mm)->context.user_psize) ++#define slice_set_user_psize(mm, psize) \ ++do { \ ++ (mm)->context.user_psize = (psize); \ ++ (mm)->context.sllp = SLB_VSID_USER | mmu_psize_defs[(psize)].sllp; \ ++} while (0) ++ ++#endif /* CONFIG_PPC_MM_SLICES */ ++ ++#endif /* _ASM_POWERPC_BOOK3S_64_SLICE_H */ +diff --git a/arch/powerpc/include/asm/mmu-8xx.h b/arch/powerpc/include/asm/mmu-8xx.h +index 5bb3dbede41a..1325e5b5f680 100644 +--- a/arch/powerpc/include/asm/mmu-8xx.h ++++ b/arch/powerpc/include/asm/mmu-8xx.h +@@ -169,6 +169,12 @@ typedef struct { + unsigned int id; + unsigned int active; + unsigned long vdso_base; ++#ifdef CONFIG_PPC_MM_SLICES ++ u16 user_psize; /* page size index */ ++ u64 low_slices_psize; /* page size encodings */ ++ unsigned char high_slices_psize[0]; ++ unsigned long addr_limit; ++#endif + } mm_context_t; + + #define PHYS_IMMR_BASE (mfspr(SPRN_IMMR) & 0xfff80000) +diff --git a/arch/powerpc/include/asm/nohash/32/slice.h b/arch/powerpc/include/asm/nohash/32/slice.h +new file mode 100644 +index 000000000000..95d532e18092 +--- /dev/null ++++ b/arch/powerpc/include/asm/nohash/32/slice.h +@@ -0,0 +1,18 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_POWERPC_NOHASH_32_SLICE_H ++#define _ASM_POWERPC_NOHASH_32_SLICE_H ++ ++#ifdef CONFIG_PPC_MM_SLICES ++ ++#define SLICE_LOW_SHIFT 28 ++#define SLICE_LOW_TOP (0x100000000ull) ++#define SLICE_NUM_LOW (SLICE_LOW_TOP >> SLICE_LOW_SHIFT) ++#define GET_LOW_SLICE_INDEX(addr) ((addr) >> SLICE_LOW_SHIFT) ++ ++#define SLICE_HIGH_SHIFT 0 ++#define SLICE_NUM_HIGH 0ul ++#define GET_HIGH_SLICE_INDEX(addr) (addr & 0) ++ ++#endif /* CONFIG_PPC_MM_SLICES */ ++ ++#endif /* _ASM_POWERPC_NOHASH_32_SLICE_H */ +diff --git a/arch/powerpc/include/asm/nohash/64/slice.h b/arch/powerpc/include/asm/nohash/64/slice.h +new file mode 100644 +index 000000000000..ad0d6e3cc1c5 +--- /dev/null ++++ b/arch/powerpc/include/asm/nohash/64/slice.h +@@ -0,0 +1,12 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_POWERPC_NOHASH_64_SLICE_H ++#define _ASM_POWERPC_NOHASH_64_SLICE_H ++ ++#ifdef CONFIG_PPC_64K_PAGES ++#define get_slice_psize(mm, addr) MMU_PAGE_64K ++#else /* CONFIG_PPC_64K_PAGES */ ++#define get_slice_psize(mm, addr) MMU_PAGE_4K ++#endif /* !CONFIG_PPC_64K_PAGES */ ++#define slice_set_user_psize(mm, psize) do { BUG(); } while (0) ++ ++#endif /* _ASM_POWERPC_NOHASH_64_SLICE_H */ +diff --git a/arch/powerpc/include/asm/page.h b/arch/powerpc/include/asm/page.h +index 8da5d4c1cab2..d5f1c41b7dba 100644 +--- a/arch/powerpc/include/asm/page.h ++++ b/arch/powerpc/include/asm/page.h +@@ -344,5 +344,6 @@ typedef struct page *pgtable_t; + + #include + #endif /* __ASSEMBLY__ */ ++#include + + #endif /* _ASM_POWERPC_PAGE_H */ +diff --git a/arch/powerpc/include/asm/page_64.h b/arch/powerpc/include/asm/page_64.h +index c4d9654bd637..af04acdb873f 100644 +--- a/arch/powerpc/include/asm/page_64.h ++++ b/arch/powerpc/include/asm/page_64.h +@@ -86,65 +86,6 @@ extern u64 ppc64_pft_size; + + #endif /* __ASSEMBLY__ */ + +-#ifdef CONFIG_PPC_MM_SLICES +- +-#define SLICE_LOW_SHIFT 28 +-#define SLICE_HIGH_SHIFT 40 +- +-#define SLICE_LOW_TOP (0x100000000ul) +-#define SLICE_NUM_LOW (SLICE_LOW_TOP >> SLICE_LOW_SHIFT) +-#define SLICE_NUM_HIGH (H_PGTABLE_RANGE >> SLICE_HIGH_SHIFT) +- +-#define GET_LOW_SLICE_INDEX(addr) ((addr) >> SLICE_LOW_SHIFT) +-#define GET_HIGH_SLICE_INDEX(addr) ((addr) >> SLICE_HIGH_SHIFT) +- +-#ifndef __ASSEMBLY__ +-struct mm_struct; +- +-extern unsigned long slice_get_unmapped_area(unsigned long addr, +- unsigned long len, +- unsigned long flags, +- unsigned int psize, +- int topdown); +- +-extern unsigned int get_slice_psize(struct mm_struct *mm, +- unsigned long addr); +- +-extern void slice_set_user_psize(struct mm_struct *mm, unsigned int psize); +-extern void slice_set_range_psize(struct mm_struct *mm, unsigned long start, +- unsigned long len, unsigned int psize); +- +-#endif /* __ASSEMBLY__ */ +-#else +-#define slice_init() +-#ifdef CONFIG_PPC_STD_MMU_64 +-#define get_slice_psize(mm, addr) ((mm)->context.user_psize) +-#define slice_set_user_psize(mm, psize) \ +-do { \ +- (mm)->context.user_psize = (psize); \ +- (mm)->context.sllp = SLB_VSID_USER | mmu_psize_defs[(psize)].sllp; \ +-} while (0) +-#else /* CONFIG_PPC_STD_MMU_64 */ +-#ifdef CONFIG_PPC_64K_PAGES +-#define get_slice_psize(mm, addr) MMU_PAGE_64K +-#else /* CONFIG_PPC_64K_PAGES */ +-#define get_slice_psize(mm, addr) MMU_PAGE_4K +-#endif /* !CONFIG_PPC_64K_PAGES */ +-#define slice_set_user_psize(mm, psize) do { BUG(); } while(0) +-#endif /* !CONFIG_PPC_STD_MMU_64 */ +- +-#define slice_set_range_psize(mm, start, len, psize) \ +- slice_set_user_psize((mm), (psize)) +-#endif /* CONFIG_PPC_MM_SLICES */ +- +-#ifdef CONFIG_HUGETLB_PAGE +- +-#ifdef CONFIG_PPC_MM_SLICES +-#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA +-#endif +- +-#endif /* !CONFIG_HUGETLB_PAGE */ +- + #define VM_DATA_DEFAULT_FLAGS \ + (is_32bit_task() ? \ + VM_DATA_DEFAULT_FLAGS32 : VM_DATA_DEFAULT_FLAGS64) +diff --git a/arch/powerpc/include/asm/slice.h b/arch/powerpc/include/asm/slice.h +new file mode 100644 +index 000000000000..172711fadb1c +--- /dev/null ++++ b/arch/powerpc/include/asm/slice.h +@@ -0,0 +1,42 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_POWERPC_SLICE_H ++#define _ASM_POWERPC_SLICE_H ++ ++#ifdef CONFIG_PPC_BOOK3S_64 ++#include ++#elif defined(CONFIG_PPC64) ++#include ++#elif defined(CONFIG_PPC_MMU_NOHASH) ++#include ++#endif ++ ++#ifdef CONFIG_PPC_MM_SLICES ++ ++#ifdef CONFIG_HUGETLB_PAGE ++#define HAVE_ARCH_HUGETLB_UNMAPPED_AREA ++#endif ++#define HAVE_ARCH_UNMAPPED_AREA ++#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN ++ ++#ifndef __ASSEMBLY__ ++ ++struct mm_struct; ++ ++unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len, ++ unsigned long flags, unsigned int psize, ++ int topdown); ++ ++unsigned int get_slice_psize(struct mm_struct *mm, unsigned long addr); ++ ++void slice_set_user_psize(struct mm_struct *mm, unsigned int psize); ++void slice_set_range_psize(struct mm_struct *mm, unsigned long start, ++ unsigned long len, unsigned int psize); ++#endif /* __ASSEMBLY__ */ ++ ++#else /* CONFIG_PPC_MM_SLICES */ ++ ++#define slice_set_range_psize(mm, start, len, psize) \ ++ slice_set_user_psize((mm), (psize)) ++#endif /* CONFIG_PPC_MM_SLICES */ ++ ++#endif /* _ASM_POWERPC_SLICE_H */ +diff --git a/arch/powerpc/kernel/setup-common.c b/arch/powerpc/kernel/setup-common.c +index b4fcb54b9686..008447664643 100644 +--- a/arch/powerpc/kernel/setup-common.c ++++ b/arch/powerpc/kernel/setup-common.c +@@ -915,6 +915,8 @@ void __init setup_arch(char **cmdline_p) + #ifdef CONFIG_PPC_MM_SLICES + #ifdef CONFIG_PPC64 + init_mm.context.addr_limit = DEFAULT_MAP_WINDOW_USER64; ++#elif defined(CONFIG_PPC_8xx) ++ init_mm.context.addr_limit = DEFAULT_MAP_WINDOW; + #else + #error "context.addr_limit not initialized." + #endif +diff --git a/arch/powerpc/mm/8xx_mmu.c b/arch/powerpc/mm/8xx_mmu.c +index f29212e40f40..0be77709446c 100644 +--- a/arch/powerpc/mm/8xx_mmu.c ++++ b/arch/powerpc/mm/8xx_mmu.c +@@ -192,7 +192,7 @@ void set_context(unsigned long id, pgd_t *pgd) + mtspr(SPRN_M_TW, __pa(pgd) - offset); + + /* Update context */ +- mtspr(SPRN_M_CASID, id); ++ mtspr(SPRN_M_CASID, id - 1); + /* sync */ + mb(); + } +diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c +index 1571a498a33f..4c9e5f9c7a44 100644 +--- a/arch/powerpc/mm/hugetlbpage.c ++++ b/arch/powerpc/mm/hugetlbpage.c +@@ -552,9 +552,11 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, + struct hstate *hstate = hstate_file(file); + int mmu_psize = shift_to_mmu_psize(huge_page_shift(hstate)); + ++#ifdef CONFIG_PPC_RADIX_MMU + if (radix_enabled()) + return radix__hugetlb_get_unmapped_area(file, addr, len, + pgoff, flags); ++#endif + return slice_get_unmapped_area(addr, len, flags, mmu_psize, 1); + } + #endif +diff --git a/arch/powerpc/mm/mmu_context_nohash.c b/arch/powerpc/mm/mmu_context_nohash.c +index 4554d6527682..e2b28b3a512e 100644 +--- a/arch/powerpc/mm/mmu_context_nohash.c ++++ b/arch/powerpc/mm/mmu_context_nohash.c +@@ -331,6 +331,20 @@ int init_new_context(struct task_struct *t, struct mm_struct *mm) + { + pr_hard("initing context for mm @%p\n", mm); + ++#ifdef CONFIG_PPC_MM_SLICES ++ if (!mm->context.addr_limit) ++ mm->context.addr_limit = DEFAULT_MAP_WINDOW; ++ ++ /* ++ * We have MMU_NO_CONTEXT set to be ~0. Hence check ++ * explicitly against context.id == 0. This ensures that we properly ++ * initialize context slice details for newly allocated mm's (which will ++ * have id == 0) and don't alter context slice inherited via fork (which ++ * will have id != 0). ++ */ ++ if (mm->context.id == 0) ++ slice_set_user_psize(mm, mmu_virtual_psize); ++#endif + mm->context.id = MMU_NO_CONTEXT; + mm->context.active = 0; + return 0; +@@ -428,8 +442,8 @@ void __init mmu_context_init(void) + * -- BenH + */ + if (mmu_has_feature(MMU_FTR_TYPE_8xx)) { +- first_context = 0; +- last_context = 15; ++ first_context = 1; ++ last_context = 16; + no_selective_tlbil = true; + } else if (mmu_has_feature(MMU_FTR_TYPE_47x)) { + first_context = 1; +diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c +index a4f93699194b..8baaa6c6f21c 100644 +--- a/arch/powerpc/mm/slice.c ++++ b/arch/powerpc/mm/slice.c +@@ -73,10 +73,12 @@ static void slice_range_to_mask(unsigned long start, unsigned long len, + unsigned long end = start + len - 1; + + ret->low_slices = 0; +- bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); ++ if (SLICE_NUM_HIGH) ++ bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); + + if (start < SLICE_LOW_TOP) { +- unsigned long mend = min(end, (SLICE_LOW_TOP - 1)); ++ unsigned long mend = min(end, ++ (unsigned long)(SLICE_LOW_TOP - 1)); + + ret->low_slices = (1u << (GET_LOW_SLICE_INDEX(mend) + 1)) + - (1u << GET_LOW_SLICE_INDEX(start)); +@@ -113,11 +115,13 @@ static int slice_high_has_vma(struct mm_struct *mm, unsigned long slice) + unsigned long start = slice << SLICE_HIGH_SHIFT; + unsigned long end = start + (1ul << SLICE_HIGH_SHIFT); + ++#ifdef CONFIG_PPC64 + /* Hack, so that each addresses is controlled by exactly one + * of the high or low area bitmaps, the first high area starts + * at 4GB, not 0 */ + if (start == 0) + start = SLICE_LOW_TOP; ++#endif + + return !slice_area_is_free(mm, start, end - start); + } +@@ -127,7 +131,8 @@ static void slice_mask_for_free(struct mm_struct *mm, struct slice_mask *ret) + unsigned long i; + + ret->low_slices = 0; +- bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); ++ if (SLICE_NUM_HIGH) ++ bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); + + for (i = 0; i < SLICE_NUM_LOW; i++) + if (!slice_low_has_vma(mm, i)) +@@ -149,7 +154,8 @@ static void slice_mask_for_size(struct mm_struct *mm, int psize, struct slice_ma + u64 lpsizes; + + ret->low_slices = 0; +- bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); ++ if (SLICE_NUM_HIGH) ++ bitmap_zero(ret->high_slices, SLICE_NUM_HIGH); + + lpsizes = mm->context.low_slices_psize; + for (i = 0; i < SLICE_NUM_LOW; i++) +@@ -171,6 +177,10 @@ static int slice_check_fit(struct mm_struct *mm, + DECLARE_BITMAP(result, SLICE_NUM_HIGH); + unsigned long slice_count = GET_HIGH_SLICE_INDEX(mm->context.addr_limit); + ++ if (!SLICE_NUM_HIGH) ++ return (mask.low_slices & available.low_slices) == ++ mask.low_slices; ++ + bitmap_and(result, mask.high_slices, + available.high_slices, slice_count); + +@@ -180,6 +190,7 @@ static int slice_check_fit(struct mm_struct *mm, + + static void slice_flush_segments(void *parm) + { ++#ifdef CONFIG_PPC64 + struct mm_struct *mm = parm; + unsigned long flags; + +@@ -191,6 +202,7 @@ static void slice_flush_segments(void *parm) + local_irq_save(flags); + slb_flush_and_rebolt(); + local_irq_restore(flags); ++#endif + } + + static void slice_convert(struct mm_struct *mm, struct slice_mask mask, int psize) +@@ -379,21 +391,21 @@ static unsigned long slice_find_area(struct mm_struct *mm, unsigned long len, + + static inline void slice_or_mask(struct slice_mask *dst, struct slice_mask *src) + { +- DECLARE_BITMAP(result, SLICE_NUM_HIGH); +- + dst->low_slices |= src->low_slices; +- bitmap_or(result, dst->high_slices, src->high_slices, SLICE_NUM_HIGH); +- bitmap_copy(dst->high_slices, result, SLICE_NUM_HIGH); ++ if (!SLICE_NUM_HIGH) ++ return; ++ bitmap_or(dst->high_slices, dst->high_slices, src->high_slices, ++ SLICE_NUM_HIGH); + } + + static inline void slice_andnot_mask(struct slice_mask *dst, struct slice_mask *src) + { +- DECLARE_BITMAP(result, SLICE_NUM_HIGH); +- + dst->low_slices &= ~src->low_slices; + +- bitmap_andnot(result, dst->high_slices, src->high_slices, SLICE_NUM_HIGH); +- bitmap_copy(dst->high_slices, result, SLICE_NUM_HIGH); ++ if (!SLICE_NUM_HIGH) ++ return; ++ bitmap_andnot(dst->high_slices, dst->high_slices, src->high_slices, ++ SLICE_NUM_HIGH); + } + + #ifdef CONFIG_PPC_64K_PAGES +@@ -441,14 +453,17 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len, + * init different masks + */ + mask.low_slices = 0; +- bitmap_zero(mask.high_slices, SLICE_NUM_HIGH); + + /* silence stupid warning */; + potential_mask.low_slices = 0; +- bitmap_zero(potential_mask.high_slices, SLICE_NUM_HIGH); + + compat_mask.low_slices = 0; +- bitmap_zero(compat_mask.high_slices, SLICE_NUM_HIGH); ++ ++ if (SLICE_NUM_HIGH) { ++ bitmap_zero(mask.high_slices, SLICE_NUM_HIGH); ++ bitmap_zero(potential_mask.high_slices, SLICE_NUM_HIGH); ++ bitmap_zero(compat_mask.high_slices, SLICE_NUM_HIGH); ++ } + + /* Sanity checks */ + BUG_ON(mm->task_size == 0); +@@ -586,7 +601,9 @@ unsigned long slice_get_unmapped_area(unsigned long addr, unsigned long len, + convert: + slice_andnot_mask(&mask, &good_mask); + slice_andnot_mask(&mask, &compat_mask); +- if (mask.low_slices || !bitmap_empty(mask.high_slices, SLICE_NUM_HIGH)) { ++ if (mask.low_slices || ++ (SLICE_NUM_HIGH && ++ !bitmap_empty(mask.high_slices, SLICE_NUM_HIGH))) { + slice_convert(mm, mask, psize); + if (psize > MMU_PAGE_BASE) + on_each_cpu(slice_flush_segments, mm, 1); +diff --git a/arch/powerpc/platforms/Kconfig.cputype b/arch/powerpc/platforms/Kconfig.cputype +index a78f255111f2..3ce376b42330 100644 +--- a/arch/powerpc/platforms/Kconfig.cputype ++++ b/arch/powerpc/platforms/Kconfig.cputype +@@ -325,6 +325,7 @@ config PPC_BOOK3E_MMU + config PPC_MM_SLICES + bool + default y if PPC_STD_MMU_64 ++ default y if PPC_8xx && HUGETLB_PAGE + default n + + config PPC_HAVE_PMU_SUPPORT +diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c +index 259c75d7a2a0..dbcb01006749 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_amd.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c +@@ -94,6 +94,11 @@ static struct smca_bank_name smca_names[] = { + [SMCA_SMU] = { "smu", "System Management Unit" }, + }; + ++static u32 smca_bank_addrs[MAX_NR_BANKS][NR_BLOCKS] __ro_after_init = ++{ ++ [0 ... MAX_NR_BANKS - 1] = { [0 ... NR_BLOCKS - 1] = -1 } ++}; ++ + const char *smca_get_name(enum smca_bank_types t) + { + if (t >= N_SMCA_BANK_TYPES) +@@ -429,52 +434,51 @@ static void deferred_error_interrupt_enable(struct cpuinfo_x86 *c) + wrmsr(MSR_CU_DEF_ERR, low, high); + } + +-static u32 get_block_address(unsigned int cpu, u32 current_addr, u32 low, u32 high, +- unsigned int bank, unsigned int block) ++static u32 smca_get_block_address(unsigned int cpu, unsigned int bank, ++ unsigned int block) + { +- u32 addr = 0, offset = 0; ++ u32 low, high; ++ u32 addr = 0; + +- if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS)) ++ if (smca_get_bank_type(bank) == SMCA_RESERVED) + return addr; + +- /* Get address from already initialized block. */ +- if (per_cpu(threshold_banks, cpu)) { +- struct threshold_bank *bankp = per_cpu(threshold_banks, cpu)[bank]; ++ if (!block) ++ return MSR_AMD64_SMCA_MCx_MISC(bank); + +- if (bankp && bankp->blocks) { +- struct threshold_block *blockp = &bankp->blocks[block]; ++ /* Check our cache first: */ ++ if (smca_bank_addrs[bank][block] != -1) ++ return smca_bank_addrs[bank][block]; + +- if (blockp) +- return blockp->address; +- } +- } ++ /* ++ * For SMCA enabled processors, BLKPTR field of the first MISC register ++ * (MCx_MISC0) indicates presence of additional MISC regs set (MISC1-4). ++ */ ++ if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_CONFIG(bank), &low, &high)) ++ goto out; + +- if (mce_flags.smca) { +- if (smca_get_bank_type(bank) == SMCA_RESERVED) +- return addr; ++ if (!(low & MCI_CONFIG_MCAX)) ++ goto out; + +- if (!block) { +- addr = MSR_AMD64_SMCA_MCx_MISC(bank); +- } else { +- /* +- * For SMCA enabled processors, BLKPTR field of the +- * first MISC register (MCx_MISC0) indicates presence of +- * additional MISC register set (MISC1-4). +- */ +- u32 low, high; ++ if (!rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_MISC(bank), &low, &high) && ++ (low & MASK_BLKPTR_LO)) ++ addr = MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1); + +- if (rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_CONFIG(bank), &low, &high)) +- return addr; ++out: ++ smca_bank_addrs[bank][block] = addr; ++ return addr; ++} + +- if (!(low & MCI_CONFIG_MCAX)) +- return addr; ++static u32 get_block_address(unsigned int cpu, u32 current_addr, u32 low, u32 high, ++ unsigned int bank, unsigned int block) ++{ ++ u32 addr = 0, offset = 0; + +- if (!rdmsr_safe_on_cpu(cpu, MSR_AMD64_SMCA_MCx_MISC(bank), &low, &high) && +- (low & MASK_BLKPTR_LO)) +- addr = MSR_AMD64_SMCA_MCx_MISCy(bank, block - 1); +- } ++ if ((bank >= mca_cfg.banks) || (block >= NR_BLOCKS)) + return addr; +- } ++ ++ if (mce_flags.smca) ++ return smca_get_block_address(cpu, bank, block); + + /* Fall back to method we used for older processors: */ + switch (block) { +diff --git a/drivers/dma-buf/dma-buf.c b/drivers/dma-buf/dma-buf.c +index 4a038dcf5361..bc1cb284111c 100644 +--- a/drivers/dma-buf/dma-buf.c ++++ b/drivers/dma-buf/dma-buf.c +@@ -625,7 +625,7 @@ EXPORT_SYMBOL_GPL(dma_buf_detach); + struct sg_table *dma_buf_map_attachment(struct dma_buf_attachment *attach, + enum dma_data_direction direction) + { +- struct sg_table *sg_table = ERR_PTR(-EINVAL); ++ struct sg_table *sg_table; + + might_sleep(); + +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c +index b33935fcf428..e6c6994e74ba 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/cz_clockpowergating.c +@@ -176,10 +176,10 @@ int cz_dpm_powergate_uvd(struct pp_hwmgr *hwmgr, bool bgate) + cz_dpm_powerup_uvd(hwmgr); + cgs_set_clockgating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_PG_STATE_UNGATE); ++ AMD_CG_STATE_UNGATE); + cgs_set_powergating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + cz_dpm_update_uvd_dpm(hwmgr, false); + } + +@@ -208,11 +208,11 @@ int cz_dpm_powergate_vce(struct pp_hwmgr *hwmgr, bool bgate) + cgs_set_clockgating_state( + hwmgr->device, + AMD_IP_BLOCK_TYPE_VCE, +- AMD_PG_STATE_UNGATE); ++ AMD_CG_STATE_UNGATE); + cgs_set_powergating_state( + hwmgr->device, + AMD_IP_BLOCK_TYPE_VCE, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + cz_dpm_update_vce_dpm(hwmgr); + cz_enable_disable_vce_dpm(hwmgr, true); + return 0; +diff --git a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c +index 261b828ad590..2f3509be226f 100644 +--- a/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c ++++ b/drivers/gpu/drm/amd/powerplay/hwmgr/smu7_clockpowergating.c +@@ -162,7 +162,7 @@ int smu7_powergate_uvd(struct pp_hwmgr *hwmgr, bool bgate) + AMD_CG_STATE_UNGATE); + cgs_set_powergating_state(hwmgr->device, + AMD_IP_BLOCK_TYPE_UVD, +- AMD_CG_STATE_UNGATE); ++ AMD_PG_STATE_UNGATE); + smu7_update_uvd_dpm(hwmgr, false); + } + +diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c +index 08af8d6b844b..493d8f56d14e 100644 +--- a/drivers/gpu/drm/drm_dp_helper.c ++++ b/drivers/gpu/drm/drm_dp_helper.c +@@ -1139,6 +1139,7 @@ int drm_dp_psr_setup_time(const u8 psr_cap[EDP_PSR_RECEIVER_CAP_SIZE]) + static const u16 psr_setup_time_us[] = { + PSR_SETUP_TIME(330), + PSR_SETUP_TIME(275), ++ PSR_SETUP_TIME(220), + PSR_SETUP_TIME(165), + PSR_SETUP_TIME(110), + PSR_SETUP_TIME(55), +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 3b2c0538e48d..90359c7954c8 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -3378,24 +3378,12 @@ static int wait_for_timeline(struct i915_gem_timeline *tl, unsigned int flags) + return 0; + } + +-static int wait_for_engine(struct intel_engine_cs *engine, int timeout_ms) +-{ +- return wait_for(intel_engine_is_idle(engine), timeout_ms); +-} +- + static int wait_for_engines(struct drm_i915_private *i915) + { +- struct intel_engine_cs *engine; +- enum intel_engine_id id; +- +- for_each_engine(engine, i915, id) { +- if (GEM_WARN_ON(wait_for_engine(engine, 50))) { +- i915_gem_set_wedged(i915); +- return -EIO; +- } +- +- GEM_BUG_ON(intel_engine_get_seqno(engine) != +- intel_engine_last_submit(engine)); ++ if (wait_for(intel_engines_are_idle(i915), 50)) { ++ DRM_ERROR("Failed to idle engines, declaring wedged!\n"); ++ i915_gem_set_wedged(i915); ++ return -EIO; + } + + return 0; +@@ -4575,7 +4563,7 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv) + ret = i915_gem_wait_for_idle(dev_priv, + I915_WAIT_INTERRUPTIBLE | + I915_WAIT_LOCKED); +- if (ret) ++ if (ret && ret != -EIO) + goto err_unlock; + + assert_kernel_context_is_current(dev_priv); +@@ -4619,11 +4607,12 @@ int i915_gem_suspend(struct drm_i915_private *dev_priv) + * machine in an unusable condition. + */ + i915_gem_sanitize(dev_priv); +- goto out_rpm_put; ++ ++ intel_runtime_pm_put(dev_priv); ++ return 0; + + err_unlock: + mutex_unlock(&dev->struct_mutex); +-out_rpm_put: + intel_runtime_pm_put(dev_priv); + return ret; + } +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index 240308f1b6dd..dae4e22a2c3f 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -565,6 +565,36 @@ static int intel_lid_notify(struct notifier_block *nb, unsigned long val, + return NOTIFY_OK; + } + ++static int ++intel_lvds_connector_register(struct drm_connector *connector) ++{ ++ struct intel_lvds_connector *lvds = to_lvds_connector(connector); ++ int ret; ++ ++ ret = intel_connector_register(connector); ++ if (ret) ++ return ret; ++ ++ lvds->lid_notifier.notifier_call = intel_lid_notify; ++ if (acpi_lid_notifier_register(&lvds->lid_notifier)) { ++ DRM_DEBUG_KMS("lid notifier registration failed\n"); ++ lvds->lid_notifier.notifier_call = NULL; ++ } ++ ++ return 0; ++} ++ ++static void ++intel_lvds_connector_unregister(struct drm_connector *connector) ++{ ++ struct intel_lvds_connector *lvds = to_lvds_connector(connector); ++ ++ if (lvds->lid_notifier.notifier_call) ++ acpi_lid_notifier_unregister(&lvds->lid_notifier); ++ ++ intel_connector_unregister(connector); ++} ++ + /** + * intel_lvds_destroy - unregister and free LVDS structures + * @connector: connector to free +@@ -577,9 +607,6 @@ static void intel_lvds_destroy(struct drm_connector *connector) + struct intel_lvds_connector *lvds_connector = + to_lvds_connector(connector); + +- if (lvds_connector->lid_notifier.notifier_call) +- acpi_lid_notifier_unregister(&lvds_connector->lid_notifier); +- + if (!IS_ERR_OR_NULL(lvds_connector->base.edid)) + kfree(lvds_connector->base.edid); + +@@ -600,8 +627,8 @@ static const struct drm_connector_funcs intel_lvds_connector_funcs = { + .fill_modes = drm_helper_probe_single_connector_modes, + .atomic_get_property = intel_digital_connector_atomic_get_property, + .atomic_set_property = intel_digital_connector_atomic_set_property, +- .late_register = intel_connector_register, +- .early_unregister = intel_connector_unregister, ++ .late_register = intel_lvds_connector_register, ++ .early_unregister = intel_lvds_connector_unregister, + .destroy = intel_lvds_destroy, + .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, + .atomic_duplicate_state = intel_digital_connector_duplicate_state, +@@ -818,6 +845,14 @@ static const struct dmi_system_id intel_no_lvds[] = { + DMI_EXACT_MATCH(DMI_BOARD_NAME, "D525MW"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "Radiant P845", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "Radiant Systems Inc"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "P845"), ++ }, ++ }, + + { } /* terminating entry */ + }; +@@ -1149,12 +1184,6 @@ void intel_lvds_init(struct drm_i915_private *dev_priv) + + lvds_encoder->a3_power = lvds & LVDS_A3_POWER_MASK; + +- lvds_connector->lid_notifier.notifier_call = intel_lid_notify; +- if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) { +- DRM_DEBUG_KMS("lid notifier registration failed\n"); +- lvds_connector->lid_notifier.notifier_call = NULL; +- } +- + return; + + failed: +diff --git a/drivers/hwtracing/intel_th/msu.c b/drivers/hwtracing/intel_th/msu.c +index dfb57eaa9f22..58ac786634dc 100644 +--- a/drivers/hwtracing/intel_th/msu.c ++++ b/drivers/hwtracing/intel_th/msu.c +@@ -741,8 +741,8 @@ static int msc_buffer_win_alloc(struct msc *msc, unsigned int nr_blocks) + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(msc), size, win->block[i].bdesc, +- win->block[i].addr); ++ dma_free_coherent(msc_dev(msc)->parent->parent, size, ++ win->block[i].bdesc, win->block[i].addr); + } + kfree(win); + +@@ -777,7 +777,7 @@ static void msc_buffer_win_free(struct msc *msc, struct msc_window *win) + /* Reset the page to write-back before releasing */ + set_memory_wb((unsigned long)win->block[i].bdesc, 1); + #endif +- dma_free_coherent(msc_dev(win->msc), PAGE_SIZE, ++ dma_free_coherent(msc_dev(win->msc)->parent->parent, PAGE_SIZE, + win->block[i].bdesc, win->block[i].addr); + } + +diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c +index f129869e05a9..736862967e32 100644 +--- a/drivers/hwtracing/stm/core.c ++++ b/drivers/hwtracing/stm/core.c +@@ -27,6 +27,7 @@ + #include + #include + #include ++#include + #include "stm.h" + + #include +@@ -682,7 +683,7 @@ static void stm_device_release(struct device *dev) + { + struct stm_device *stm = to_stm_device(dev); + +- kfree(stm); ++ vfree(stm); + } + + int stm_register_device(struct device *parent, struct stm_data *stm_data, +@@ -699,7 +700,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, + return -EINVAL; + + nmasters = stm_data->sw_end - stm_data->sw_start + 1; +- stm = kzalloc(sizeof(*stm) + nmasters * sizeof(void *), GFP_KERNEL); ++ stm = vzalloc(sizeof(*stm) + nmasters * sizeof(void *)); + if (!stm) + return -ENOMEM; + +@@ -752,7 +753,7 @@ int stm_register_device(struct device *parent, struct stm_data *stm_data, + /* matches device_initialize() above */ + put_device(&stm->dev); + err_free: +- kfree(stm); ++ vfree(stm); + + return err; + } +diff --git a/drivers/iio/adc/Kconfig b/drivers/iio/adc/Kconfig +index 1d13bf03c758..369a2c632e46 100644 +--- a/drivers/iio/adc/Kconfig ++++ b/drivers/iio/adc/Kconfig +@@ -158,6 +158,7 @@ config AT91_SAMA5D2_ADC + tristate "Atmel AT91 SAMA5D2 ADC" + depends on ARCH_AT91 || COMPILE_TEST + depends on HAS_IOMEM ++ select IIO_BUFFER + select IIO_TRIGGERED_BUFFER + help + Say yes here to build support for Atmel SAMA5D2 ADC which is +diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c +index 47c3d7f32900..07246a6037e3 100644 +--- a/drivers/iio/adc/ad7793.c ++++ b/drivers/iio/adc/ad7793.c +@@ -348,55 +348,6 @@ static const u16 ad7793_sample_freq_avail[16] = {0, 470, 242, 123, 62, 50, 39, + static const u16 ad7797_sample_freq_avail[16] = {0, 0, 0, 123, 62, 50, 0, + 33, 0, 17, 16, 12, 10, 8, 6, 4}; + +-static ssize_t ad7793_read_frequency(struct device *dev, +- struct device_attribute *attr, +- char *buf) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- +- return sprintf(buf, "%d\n", +- st->chip_info->sample_freq_avail[AD7793_MODE_RATE(st->mode)]); +-} +- +-static ssize_t ad7793_write_frequency(struct device *dev, +- struct device_attribute *attr, +- const char *buf, +- size_t len) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7793_state *st = iio_priv(indio_dev); +- long lval; +- int i, ret; +- +- ret = kstrtol(buf, 10, &lval); +- if (ret) +- return ret; +- +- if (lval == 0) +- return -EINVAL; +- +- for (i = 0; i < 16; i++) +- if (lval == st->chip_info->sample_freq_avail[i]) +- break; +- if (i == 16) +- return -EINVAL; +- +- ret = iio_device_claim_direct_mode(indio_dev); +- if (ret) +- return ret; +- st->mode &= ~AD7793_MODE_RATE(-1); +- st->mode |= AD7793_MODE_RATE(i); +- ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), st->mode); +- iio_device_release_direct_mode(indio_dev); +- +- return len; +-} +- +-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, +- ad7793_read_frequency, +- ad7793_write_frequency); +- + static IIO_CONST_ATTR_SAMP_FREQ_AVAIL( + "470 242 123 62 50 39 33 19 17 16 12 10 8 6 4"); + +@@ -424,7 +375,6 @@ static IIO_DEVICE_ATTR_NAMED(in_m_in_scale_available, + ad7793_show_scale_available, NULL, 0); + + static struct attribute *ad7793_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available.dev_attr.attr, + &iio_dev_attr_in_m_in_scale_available.dev_attr.attr, + NULL +@@ -435,7 +385,6 @@ static const struct attribute_group ad7793_attribute_group = { + }; + + static struct attribute *ad7797_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available_ad7797.dev_attr.attr, + NULL + }; +@@ -505,6 +454,10 @@ static int ad7793_read_raw(struct iio_dev *indio_dev, + *val -= offset; + } + return IIO_VAL_INT; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ *val = st->chip_info ++ ->sample_freq_avail[AD7793_MODE_RATE(st->mode)]; ++ return IIO_VAL_INT; + } + return -EINVAL; + } +@@ -542,6 +495,26 @@ static int ad7793_write_raw(struct iio_dev *indio_dev, + break; + } + break; ++ case IIO_CHAN_INFO_SAMP_FREQ: ++ if (!val) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ for (i = 0; i < 16; i++) ++ if (val == st->chip_info->sample_freq_avail[i]) ++ break; ++ ++ if (i == 16) { ++ ret = -EINVAL; ++ break; ++ } ++ ++ st->mode &= ~AD7793_MODE_RATE(-1); ++ st->mode |= AD7793_MODE_RATE(i); ++ ad_sd_write_reg(&st->sd, AD7793_REG_MODE, sizeof(st->mode), ++ st->mode); ++ break; + default: + ret = -EINVAL; + } +diff --git a/drivers/iio/buffer/industrialio-buffer-dma.c b/drivers/iio/buffer/industrialio-buffer-dma.c +index ff03324dee13..0a7289571b68 100644 +--- a/drivers/iio/buffer/industrialio-buffer-dma.c ++++ b/drivers/iio/buffer/industrialio-buffer-dma.c +@@ -587,7 +587,7 @@ EXPORT_SYMBOL_GPL(iio_dma_buffer_set_bytes_per_datum); + * Should be used as the set_length callback for iio_buffer_access_ops + * struct for DMA buffers. + */ +-int iio_dma_buffer_set_length(struct iio_buffer *buffer, int length) ++int iio_dma_buffer_set_length(struct iio_buffer *buffer, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +diff --git a/drivers/iio/buffer/kfifo_buf.c b/drivers/iio/buffer/kfifo_buf.c +index 047fe757ab97..70c302a93d7f 100644 +--- a/drivers/iio/buffer/kfifo_buf.c ++++ b/drivers/iio/buffer/kfifo_buf.c +@@ -22,11 +22,18 @@ struct iio_kfifo { + #define iio_to_kfifo(r) container_of(r, struct iio_kfifo, buffer) + + static inline int __iio_allocate_kfifo(struct iio_kfifo *buf, +- int bytes_per_datum, int length) ++ size_t bytes_per_datum, unsigned int length) + { + if ((length == 0) || (bytes_per_datum == 0)) + return -EINVAL; + ++ /* ++ * Make sure we don't overflow an unsigned int after kfifo rounds up to ++ * the next power of 2. ++ */ ++ if (roundup_pow_of_two(length) > UINT_MAX / bytes_per_datum) ++ return -EINVAL; ++ + return __kfifo_alloc((struct __kfifo *)&buf->kf, length, + bytes_per_datum, GFP_KERNEL); + } +@@ -67,7 +74,7 @@ static int iio_set_bytes_per_datum_kfifo(struct iio_buffer *r, size_t bpd) + return 0; + } + +-static int iio_set_length_kfifo(struct iio_buffer *r, int length) ++static int iio_set_length_kfifo(struct iio_buffer *r, unsigned int length) + { + /* Avoid an invalid state */ + if (length < 2) +diff --git a/drivers/infiniband/core/cache.c b/drivers/infiniband/core/cache.c +index 77515638c55c..896cfd9303b0 100644 +--- a/drivers/infiniband/core/cache.c ++++ b/drivers/infiniband/core/cache.c +@@ -434,7 +434,7 @@ static int __ib_cache_gid_get(struct ib_device *ib_dev, u8 port, int index, + return -EINVAL; + + if (table->data_vec[index].props & GID_TABLE_ENTRY_INVALID) +- return -EAGAIN; ++ return -EINVAL; + + memcpy(gid, &table->data_vec[index].gid, sizeof(*gid)); + if (attr) { +diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c +index 29f99529b187..cfcb32559925 100644 +--- a/drivers/input/mouse/elan_i2c_smbus.c ++++ b/drivers/input/mouse/elan_i2c_smbus.c +@@ -130,7 +130,7 @@ static int elan_smbus_get_baseline_data(struct i2c_client *client, + bool max_baseline, u8 *value) + { + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, + max_baseline ? +@@ -149,7 +149,7 @@ static int elan_smbus_get_version(struct i2c_client *client, + bool iap, u8 *version) + { + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, + iap ? ETP_SMBUS_IAP_VERSION_CMD : +@@ -170,7 +170,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client, + u8 *clickpad) + { + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, + ETP_SMBUS_SM_VERSION_CMD, val); +@@ -188,7 +188,7 @@ static int elan_smbus_get_sm_version(struct i2c_client *client, + static int elan_smbus_get_product_id(struct i2c_client *client, u16 *id) + { + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, + ETP_SMBUS_UNIQUEID_CMD, val); +@@ -205,7 +205,7 @@ static int elan_smbus_get_checksum(struct i2c_client *client, + bool iap, u16 *csum) + { + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, + iap ? ETP_SMBUS_FW_CHECKSUM_CMD : +@@ -226,7 +226,7 @@ static int elan_smbus_get_max(struct i2c_client *client, + { + int ret; + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RANGE_CMD, val); + if (ret != 3) { +@@ -246,7 +246,7 @@ static int elan_smbus_get_resolution(struct i2c_client *client, + { + int ret; + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + ret = i2c_smbus_read_block_data(client, ETP_SMBUS_RESOLUTION_CMD, val); + if (ret != 3) { +@@ -267,7 +267,7 @@ static int elan_smbus_get_num_traces(struct i2c_client *client, + { + int ret; + int error; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + ret = i2c_smbus_read_block_data(client, ETP_SMBUS_XY_TRACENUM_CMD, val); + if (ret != 3) { +@@ -294,7 +294,7 @@ static int elan_smbus_iap_get_mode(struct i2c_client *client, + { + int error; + u16 constant; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + error = i2c_smbus_read_block_data(client, ETP_SMBUS_IAP_CTRL_CMD, val); + if (error < 0) { +@@ -345,7 +345,7 @@ static int elan_smbus_prepare_fw_update(struct i2c_client *client) + int len; + int error; + enum tp_mode mode; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + u8 cmd[4] = {0x0F, 0x78, 0x00, 0x06}; + u16 password; + +@@ -419,7 +419,7 @@ static int elan_smbus_write_fw_block(struct i2c_client *client, + struct device *dev = &client->dev; + int error; + u16 result; +- u8 val[3]; ++ u8 val[I2C_SMBUS_BLOCK_MAX] = {0}; + + /* + * Due to the limitation of smbus protocol limiting +diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c +index a246fc686bb7..6c4bbd38700e 100644 +--- a/drivers/input/mouse/synaptics.c ++++ b/drivers/input/mouse/synaptics.c +@@ -172,6 +172,12 @@ static const char * const smbus_pnp_ids[] = { + "LEN0048", /* X1 Carbon 3 */ + "LEN0046", /* X250 */ + "LEN004a", /* W541 */ ++ "LEN0071", /* T480 */ ++ "LEN0072", /* X1 Carbon Gen 5 (2017) - Elan/ALPS trackpoint */ ++ "LEN0073", /* X1 Carbon G5 (Elantech) */ ++ "LEN0092", /* X1 Carbon 6 */ ++ "LEN0096", /* X280 */ ++ "LEN0097", /* X280 -> ALPS trackpoint */ + "LEN200f", /* T450s */ + NULL + }; +diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +index a2c1ca5c76d1..e1660b92b20c 100644 +--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c ++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c +@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev, + + /* + * Determine IFS values +- * - Use TXOP_BACKOFF for probe and management frames except beacons ++ * - Use TXOP_BACKOFF for management frames except beacons + * - Use TXOP_SIFS for fragment bursts + * - Use TXOP_HTTXOP for everything else + * + * Note: rt2800 devices won't use CTS protection (if used) + * for frames not transmitted with TXOP_HTTXOP + */ +- if ((ieee80211_is_mgmt(hdr->frame_control) && +- !ieee80211_is_beacon(hdr->frame_control)) || +- (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE)) ++ if (ieee80211_is_mgmt(hdr->frame_control) && ++ !ieee80211_is_beacon(hdr->frame_control)) + txdesc->u.ht.txop = TXOP_BACKOFF; + else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT)) + txdesc->u.ht.txop = TXOP_SIFS; +diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c +index 9cff6bc4049c..cf551785eb08 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c ++++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192cu/rf.c +@@ -299,9 +299,6 @@ static void _rtl92c_get_txpower_writeval_by_regulatory(struct ieee80211_hw *hw, + writeVal = 0x00000000; + if (rtlpriv->dm.dynamic_txhighpower_lvl == TXHIGHPWRLEVEL_BT1) + writeVal = writeVal - 0x06060606; +- else if (rtlpriv->dm.dynamic_txhighpower_lvl == +- TXHIGHPWRLEVEL_BT2) +- writeVal = writeVal; + *(p_outwriteval + rf) = writeVal; + } + } +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 73b724143be0..c91662927de0 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -531,6 +531,8 @@ struct hv_pci_compl { + s32 completion_status; + }; + ++static void hv_pci_onchannelcallback(void *context); ++ + /** + * hv_pci_generic_compl() - Invoked for a completion packet + * @context: Set up by the sender of the packet. +@@ -675,6 +677,31 @@ static void _hv_pcifront_read_config(struct hv_pci_dev *hpdev, int where, + } + } + ++static u16 hv_pcifront_get_vendor_id(struct hv_pci_dev *hpdev) ++{ ++ u16 ret; ++ unsigned long flags; ++ void __iomem *addr = hpdev->hbus->cfg_addr + CFG_PAGE_OFFSET + ++ PCI_VENDOR_ID; ++ ++ spin_lock_irqsave(&hpdev->hbus->config_lock, flags); ++ ++ /* Choose the function to be read. (See comment above) */ ++ writel(hpdev->desc.win_slot.slot, hpdev->hbus->cfg_addr); ++ /* Make sure the function was chosen before we start reading. */ ++ mb(); ++ /* Read from that function's config space. */ ++ ret = readw(addr); ++ /* ++ * mb() is not required here, because the spin_unlock_irqrestore() ++ * is a barrier. ++ */ ++ ++ spin_unlock_irqrestore(&hpdev->hbus->config_lock, flags); ++ ++ return ret; ++} ++ + /** + * _hv_pcifront_write_config() - Internal PCI config write + * @hpdev: The PCI driver's representation of the device +@@ -1121,8 +1148,37 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + * Since this function is called with IRQ locks held, can't + * do normal wait for completion; instead poll. + */ +- while (!try_wait_for_completion(&comp.comp_pkt.host_event)) ++ while (!try_wait_for_completion(&comp.comp_pkt.host_event)) { ++ /* 0xFFFF means an invalid PCI VENDOR ID. */ ++ if (hv_pcifront_get_vendor_id(hpdev) == 0xFFFF) { ++ dev_err_once(&hbus->hdev->device, ++ "the device has gone\n"); ++ goto free_int_desc; ++ } ++ ++ /* ++ * When the higher level interrupt code calls us with ++ * interrupt disabled, we must poll the channel by calling ++ * the channel callback directly when channel->target_cpu is ++ * the current CPU. When the higher level interrupt code ++ * calls us with interrupt enabled, let's add the ++ * local_bh_disable()/enable() to avoid race. ++ */ ++ local_bh_disable(); ++ ++ if (hbus->hdev->channel->target_cpu == smp_processor_id()) ++ hv_pci_onchannelcallback(hbus); ++ ++ local_bh_enable(); ++ ++ if (hpdev->state == hv_pcichild_ejecting) { ++ dev_err_once(&hbus->hdev->device, ++ "the device is being ejected\n"); ++ goto free_int_desc; ++ } ++ + udelay(100); ++ } + + if (comp.comp_pkt.completion_status < 0) { + dev_err(&hbus->hdev->device, +diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c +index 19cd357bb464..ff491da64dab 100644 +--- a/drivers/pinctrl/qcom/pinctrl-msm.c ++++ b/drivers/pinctrl/qcom/pinctrl-msm.c +@@ -818,7 +818,7 @@ static int msm_gpio_init(struct msm_pinctrl *pctrl) + return -EINVAL; + + chip = &pctrl->chip; +- chip->base = -1; ++ chip->base = 0; + chip->ngpio = ngpio; + chip->label = dev_name(pctrl->dev); + chip->parent = pctrl->dev; +diff --git a/drivers/platform/chrome/cros_ec_lpc.c b/drivers/platform/chrome/cros_ec_lpc.c +index 1baf720faf69..87e9747d229a 100644 +--- a/drivers/platform/chrome/cros_ec_lpc.c ++++ b/drivers/platform/chrome/cros_ec_lpc.c +@@ -54,7 +54,6 @@ static int ec_response_timed_out(void) + static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec, + struct cros_ec_command *msg) + { +- struct ec_host_request *request; + struct ec_host_response response; + u8 sum; + int ret = 0; +@@ -65,8 +64,6 @@ static int cros_ec_pkt_xfer_lpc(struct cros_ec_device *ec, + /* Write buffer */ + cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_PACKET, ret, ec->dout); + +- request = (struct ec_host_request *)ec->dout; +- + /* Here we go */ + sum = EC_COMMAND_PROTOCOL_3; + cros_ec_lpc_write_bytes(EC_LPC_ADDR_HOST_CMD, 1, &sum); +diff --git a/drivers/scsi/scsi_transport_srp.c b/drivers/scsi/scsi_transport_srp.c +index 36f6190931bc..456ce9f19569 100644 +--- a/drivers/scsi/scsi_transport_srp.c ++++ b/drivers/scsi/scsi_transport_srp.c +@@ -51,6 +51,8 @@ struct srp_internal { + struct transport_container rport_attr_cont; + }; + ++static int scsi_is_srp_rport(const struct device *dev); ++ + #define to_srp_internal(tmpl) container_of(tmpl, struct srp_internal, t) + + #define dev_to_rport(d) container_of(d, struct srp_rport, dev) +@@ -60,9 +62,24 @@ static inline struct Scsi_Host *rport_to_shost(struct srp_rport *r) + return dev_to_shost(r->dev.parent); + } + ++static int find_child_rport(struct device *dev, void *data) ++{ ++ struct device **child = data; ++ ++ if (scsi_is_srp_rport(dev)) { ++ WARN_ON_ONCE(*child); ++ *child = dev; ++ } ++ return 0; ++} ++ + static inline struct srp_rport *shost_to_rport(struct Scsi_Host *shost) + { +- return transport_class_to_srp_rport(&shost->shost_gendev); ++ struct device *child = NULL; ++ ++ WARN_ON_ONCE(device_for_each_child(&shost->shost_gendev, &child, ++ find_child_rport) < 0); ++ return child ? dev_to_rport(child) : NULL; + } + + /** +@@ -600,7 +617,8 @@ enum blk_eh_timer_return srp_timed_out(struct scsi_cmnd *scmd) + struct srp_rport *rport = shost_to_rport(shost); + + pr_debug("timeout for sdev %s\n", dev_name(&sdev->sdev_gendev)); +- return rport->fast_io_fail_tmo < 0 && rport->dev_loss_tmo < 0 && ++ return rport && rport->fast_io_fail_tmo < 0 && ++ rport->dev_loss_tmo < 0 && + i->f->reset_timer_if_blocked && scsi_device_blocked(sdev) ? + BLK_EH_RESET_TIMER : BLK_EH_NOT_HANDLED; + } +diff --git a/drivers/soc/lantiq/gphy.c b/drivers/soc/lantiq/gphy.c +index 8d8659463b3e..feeb17cebc25 100644 +--- a/drivers/soc/lantiq/gphy.c ++++ b/drivers/soc/lantiq/gphy.c +@@ -30,7 +30,6 @@ struct xway_gphy_priv { + struct clk *gphy_clk_gate; + struct reset_control *gphy_reset; + struct reset_control *gphy_reset2; +- struct notifier_block gphy_reboot_nb; + void __iomem *membase; + char *fw_name; + }; +@@ -64,24 +63,6 @@ static const struct of_device_id xway_gphy_match[] = { + }; + MODULE_DEVICE_TABLE(of, xway_gphy_match); + +-static struct xway_gphy_priv *to_xway_gphy_priv(struct notifier_block *nb) +-{ +- return container_of(nb, struct xway_gphy_priv, gphy_reboot_nb); +-} +- +-static int xway_gphy_reboot_notify(struct notifier_block *reboot_nb, +- unsigned long code, void *unused) +-{ +- struct xway_gphy_priv *priv = to_xway_gphy_priv(reboot_nb); +- +- if (priv) { +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); +- } +- +- return NOTIFY_DONE; +-} +- + static int xway_gphy_load(struct device *dev, struct xway_gphy_priv *priv, + dma_addr_t *dev_addr) + { +@@ -205,14 +186,6 @@ static int xway_gphy_probe(struct platform_device *pdev) + reset_control_deassert(priv->gphy_reset); + reset_control_deassert(priv->gphy_reset2); + +- /* assert the gphy reset because it can hang after a reboot: */ +- priv->gphy_reboot_nb.notifier_call = xway_gphy_reboot_notify; +- priv->gphy_reboot_nb.priority = -1; +- +- ret = register_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to register reboot notifier\n"); +- + platform_set_drvdata(pdev, priv); + + return ret; +@@ -220,21 +193,12 @@ static int xway_gphy_probe(struct platform_device *pdev) + + static int xway_gphy_remove(struct platform_device *pdev) + { +- struct device *dev = &pdev->dev; + struct xway_gphy_priv *priv = platform_get_drvdata(pdev); +- int ret; +- +- reset_control_assert(priv->gphy_reset); +- reset_control_assert(priv->gphy_reset2); + + iowrite32be(0, priv->membase); + + clk_disable_unprepare(priv->gphy_clk_gate); + +- ret = unregister_reboot_notifier(&priv->gphy_reboot_nb); +- if (ret) +- dev_warn(dev, "Failed to unregister reboot notifier\n"); +- + return 0; + } + +diff --git a/fs/aio.c b/fs/aio.c +index 4e23958c2509..3a749c3a92e3 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -643,9 +643,8 @@ static void free_ioctx_users(struct percpu_ref *ref) + while (!list_empty(&ctx->active_reqs)) { + req = list_first_entry(&ctx->active_reqs, + struct aio_kiocb, ki_list); +- +- list_del_init(&req->ki_list); + kiocb_cancel(req); ++ list_del_init(&req->ki_list); + } + + spin_unlock_irq(&ctx->ctx_lock); +diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c +index f965ce832bc0..516e0c57cf9c 100644 +--- a/fs/xfs/libxfs/xfs_alloc.c ++++ b/fs/xfs/libxfs/xfs_alloc.c +@@ -52,6 +52,23 @@ STATIC int xfs_alloc_ag_vextent_size(xfs_alloc_arg_t *); + STATIC int xfs_alloc_ag_vextent_small(xfs_alloc_arg_t *, + xfs_btree_cur_t *, xfs_agblock_t *, xfs_extlen_t *, int *); + ++/* ++ * Size of the AGFL. For CRC-enabled filesystes we steal a couple of slots in ++ * the beginning of the block for a proper header with the location information ++ * and CRC. ++ */ ++unsigned int ++xfs_agfl_size( ++ struct xfs_mount *mp) ++{ ++ unsigned int size = mp->m_sb.sb_sectsize; ++ ++ if (xfs_sb_version_hascrc(&mp->m_sb)) ++ size -= sizeof(struct xfs_agfl); ++ ++ return size / sizeof(xfs_agblock_t); ++} ++ + unsigned int + xfs_refc_block( + struct xfs_mount *mp) +@@ -540,7 +557,7 @@ xfs_agfl_verify( + if (bp->b_pag && be32_to_cpu(agfl->agfl_seqno) != bp->b_pag->pag_agno) + return false; + +- for (i = 0; i < XFS_AGFL_SIZE(mp); i++) { ++ for (i = 0; i < xfs_agfl_size(mp); i++) { + if (be32_to_cpu(agfl->agfl_bno[i]) != NULLAGBLOCK && + be32_to_cpu(agfl->agfl_bno[i]) >= mp->m_sb.sb_agblocks) + return false; +@@ -2039,6 +2056,93 @@ xfs_alloc_space_available( + return true; + } + ++/* ++ * Check the agfl fields of the agf for inconsistency or corruption. The purpose ++ * is to detect an agfl header padding mismatch between current and early v5 ++ * kernels. This problem manifests as a 1-slot size difference between the ++ * on-disk flcount and the active [first, last] range of a wrapped agfl. This ++ * may also catch variants of agfl count corruption unrelated to padding. Either ++ * way, we'll reset the agfl and warn the user. ++ * ++ * Return true if a reset is required before the agfl can be used, false ++ * otherwise. ++ */ ++static bool ++xfs_agfl_needs_reset( ++ struct xfs_mount *mp, ++ struct xfs_agf *agf) ++{ ++ uint32_t f = be32_to_cpu(agf->agf_flfirst); ++ uint32_t l = be32_to_cpu(agf->agf_fllast); ++ uint32_t c = be32_to_cpu(agf->agf_flcount); ++ int agfl_size = xfs_agfl_size(mp); ++ int active; ++ ++ /* no agfl header on v4 supers */ ++ if (!xfs_sb_version_hascrc(&mp->m_sb)) ++ return false; ++ ++ /* ++ * The agf read verifier catches severe corruption of these fields. ++ * Repeat some sanity checks to cover a packed -> unpacked mismatch if ++ * the verifier allows it. ++ */ ++ if (f >= agfl_size || l >= agfl_size) ++ return true; ++ if (c > agfl_size) ++ return true; ++ ++ /* ++ * Check consistency between the on-disk count and the active range. An ++ * agfl padding mismatch manifests as an inconsistent flcount. ++ */ ++ if (c && l >= f) ++ active = l - f + 1; ++ else if (c) ++ active = agfl_size - f + l + 1; ++ else ++ active = 0; ++ ++ return active != c; ++} ++ ++/* ++ * Reset the agfl to an empty state. Ignore/drop any existing blocks since the ++ * agfl content cannot be trusted. Warn the user that a repair is required to ++ * recover leaked blocks. ++ * ++ * The purpose of this mechanism is to handle filesystems affected by the agfl ++ * header padding mismatch problem. A reset keeps the filesystem online with a ++ * relatively minor free space accounting inconsistency rather than suffer the ++ * inevitable crash from use of an invalid agfl block. ++ */ ++static void ++xfs_agfl_reset( ++ struct xfs_trans *tp, ++ struct xfs_buf *agbp, ++ struct xfs_perag *pag) ++{ ++ struct xfs_mount *mp = tp->t_mountp; ++ struct xfs_agf *agf = XFS_BUF_TO_AGF(agbp); ++ ++ ASSERT(pag->pagf_agflreset); ++ trace_xfs_agfl_reset(mp, agf, 0, _RET_IP_); ++ ++ xfs_warn(mp, ++ "WARNING: Reset corrupted AGFL on AG %u. %d blocks leaked. " ++ "Please unmount and run xfs_repair.", ++ pag->pag_agno, pag->pagf_flcount); ++ ++ agf->agf_flfirst = 0; ++ agf->agf_fllast = cpu_to_be32(xfs_agfl_size(mp) - 1); ++ agf->agf_flcount = 0; ++ xfs_alloc_log_agf(tp, agbp, XFS_AGF_FLFIRST | XFS_AGF_FLLAST | ++ XFS_AGF_FLCOUNT); ++ ++ pag->pagf_flcount = 0; ++ pag->pagf_agflreset = false; ++} ++ + /* + * Decide whether to use this allocation group for this allocation. + * If so, fix up the btree freelist's size. +@@ -2100,6 +2204,10 @@ xfs_alloc_fix_freelist( + } + } + ++ /* reset a padding mismatched agfl before final free space check */ ++ if (pag->pagf_agflreset) ++ xfs_agfl_reset(tp, agbp, pag); ++ + /* If there isn't enough total space or single-extent, reject it. */ + need = xfs_alloc_min_freelist(mp, pag); + if (!xfs_alloc_space_available(args, need, flags)) +@@ -2252,10 +2360,11 @@ xfs_alloc_get_freelist( + bno = be32_to_cpu(agfl_bno[be32_to_cpu(agf->agf_flfirst)]); + be32_add_cpu(&agf->agf_flfirst, 1); + xfs_trans_brelse(tp, agflbp); +- if (be32_to_cpu(agf->agf_flfirst) == XFS_AGFL_SIZE(mp)) ++ if (be32_to_cpu(agf->agf_flfirst) == xfs_agfl_size(mp)) + agf->agf_flfirst = 0; + + pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno)); ++ ASSERT(!pag->pagf_agflreset); + be32_add_cpu(&agf->agf_flcount, -1); + xfs_trans_agflist_delta(tp, -1); + pag->pagf_flcount--; +@@ -2363,10 +2472,11 @@ xfs_alloc_put_freelist( + be32_to_cpu(agf->agf_seqno), &agflbp))) + return error; + be32_add_cpu(&agf->agf_fllast, 1); +- if (be32_to_cpu(agf->agf_fllast) == XFS_AGFL_SIZE(mp)) ++ if (be32_to_cpu(agf->agf_fllast) == xfs_agfl_size(mp)) + agf->agf_fllast = 0; + + pag = xfs_perag_get(mp, be32_to_cpu(agf->agf_seqno)); ++ ASSERT(!pag->pagf_agflreset); + be32_add_cpu(&agf->agf_flcount, 1); + xfs_trans_agflist_delta(tp, 1); + pag->pagf_flcount++; +@@ -2381,7 +2491,7 @@ xfs_alloc_put_freelist( + + xfs_alloc_log_agf(tp, agbp, logflags); + +- ASSERT(be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp)); ++ ASSERT(be32_to_cpu(agf->agf_flcount) <= xfs_agfl_size(mp)); + + agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, agflbp); + blockp = &agfl_bno[be32_to_cpu(agf->agf_fllast)]; +@@ -2414,9 +2524,9 @@ xfs_agf_verify( + if (!(agf->agf_magicnum == cpu_to_be32(XFS_AGF_MAGIC) && + XFS_AGF_GOOD_VERSION(be32_to_cpu(agf->agf_versionnum)) && + be32_to_cpu(agf->agf_freeblks) <= be32_to_cpu(agf->agf_length) && +- be32_to_cpu(agf->agf_flfirst) < XFS_AGFL_SIZE(mp) && +- be32_to_cpu(agf->agf_fllast) < XFS_AGFL_SIZE(mp) && +- be32_to_cpu(agf->agf_flcount) <= XFS_AGFL_SIZE(mp))) ++ be32_to_cpu(agf->agf_flfirst) < xfs_agfl_size(mp) && ++ be32_to_cpu(agf->agf_fllast) < xfs_agfl_size(mp) && ++ be32_to_cpu(agf->agf_flcount) <= xfs_agfl_size(mp))) + return false; + + if (be32_to_cpu(agf->agf_levels[XFS_BTNUM_BNO]) < 1 || +@@ -2572,6 +2682,7 @@ xfs_alloc_read_agf( + pag->pagb_count = 0; + pag->pagb_tree = RB_ROOT; + pag->pagf_init = 1; ++ pag->pagf_agflreset = xfs_agfl_needs_reset(mp, agf); + } + #ifdef DEBUG + else if (!XFS_FORCED_SHUTDOWN(mp)) { +diff --git a/fs/xfs/libxfs/xfs_alloc.h b/fs/xfs/libxfs/xfs_alloc.h +index ef26edc2e938..346ba8ab68b5 100644 +--- a/fs/xfs/libxfs/xfs_alloc.h ++++ b/fs/xfs/libxfs/xfs_alloc.h +@@ -26,6 +26,8 @@ struct xfs_trans; + + extern struct workqueue_struct *xfs_alloc_wq; + ++unsigned int xfs_agfl_size(struct xfs_mount *mp); ++ + /* + * Freespace allocation types. Argument to xfs_alloc_[v]extent. + */ +diff --git a/fs/xfs/libxfs/xfs_format.h b/fs/xfs/libxfs/xfs_format.h +index 23229f0c5b15..ed4481b2f113 100644 +--- a/fs/xfs/libxfs/xfs_format.h ++++ b/fs/xfs/libxfs/xfs_format.h +@@ -798,24 +798,13 @@ typedef struct xfs_agi { + &(XFS_BUF_TO_AGFL(bp)->agfl_bno[0]) : \ + (__be32 *)(bp)->b_addr) + +-/* +- * Size of the AGFL. For CRC-enabled filesystes we steal a couple of +- * slots in the beginning of the block for a proper header with the +- * location information and CRC. +- */ +-#define XFS_AGFL_SIZE(mp) \ +- (((mp)->m_sb.sb_sectsize - \ +- (xfs_sb_version_hascrc(&((mp)->m_sb)) ? \ +- sizeof(struct xfs_agfl) : 0)) / \ +- sizeof(xfs_agblock_t)) +- + typedef struct xfs_agfl { + __be32 agfl_magicnum; + __be32 agfl_seqno; + uuid_t agfl_uuid; + __be64 agfl_lsn; + __be32 agfl_crc; +- __be32 agfl_bno[]; /* actually XFS_AGFL_SIZE(mp) */ ++ __be32 agfl_bno[]; /* actually xfs_agfl_size(mp) */ + } __attribute__((packed)) xfs_agfl_t; + + #define XFS_AGFL_CRC_OFF offsetof(struct xfs_agfl, agfl_crc) +diff --git a/fs/xfs/xfs_fsops.c b/fs/xfs/xfs_fsops.c +index 8f22fc579dbb..40783a313df9 100644 +--- a/fs/xfs/xfs_fsops.c ++++ b/fs/xfs/xfs_fsops.c +@@ -294,7 +294,7 @@ xfs_growfs_data_private( + } + + agfl_bno = XFS_BUF_TO_AGFL_BNO(mp, bp); +- for (bucket = 0; bucket < XFS_AGFL_SIZE(mp); bucket++) ++ for (bucket = 0; bucket < xfs_agfl_size(mp); bucket++) + agfl_bno[bucket] = cpu_to_be32(NULLAGBLOCK); + + error = xfs_bwrite(bp); +diff --git a/fs/xfs/xfs_mount.h b/fs/xfs/xfs_mount.h +index e0792d036be2..d359a88ea249 100644 +--- a/fs/xfs/xfs_mount.h ++++ b/fs/xfs/xfs_mount.h +@@ -353,6 +353,7 @@ typedef struct xfs_perag { + char pagi_inodeok; /* The agi is ok for inodes */ + uint8_t pagf_levels[XFS_BTNUM_AGF]; + /* # of levels in bno & cnt btree */ ++ bool pagf_agflreset; /* agfl requires reset before use */ + uint32_t pagf_flcount; /* count of blocks in freelist */ + xfs_extlen_t pagf_freeblks; /* total free blocks */ + xfs_extlen_t pagf_longest; /* longest free space */ +diff --git a/fs/xfs/xfs_trace.h b/fs/xfs/xfs_trace.h +index bb5514688d47..06bc87369632 100644 +--- a/fs/xfs/xfs_trace.h ++++ b/fs/xfs/xfs_trace.h +@@ -1513,7 +1513,7 @@ TRACE_EVENT(xfs_extent_busy_trim, + __entry->tlen) + ); + +-TRACE_EVENT(xfs_agf, ++DECLARE_EVENT_CLASS(xfs_agf_class, + TP_PROTO(struct xfs_mount *mp, struct xfs_agf *agf, int flags, + unsigned long caller_ip), + TP_ARGS(mp, agf, flags, caller_ip), +@@ -1569,6 +1569,13 @@ TRACE_EVENT(xfs_agf, + __entry->longest, + (void *)__entry->caller_ip) + ); ++#define DEFINE_AGF_EVENT(name) \ ++DEFINE_EVENT(xfs_agf_class, name, \ ++ TP_PROTO(struct xfs_mount *mp, struct xfs_agf *agf, int flags, \ ++ unsigned long caller_ip), \ ++ TP_ARGS(mp, agf, flags, caller_ip)) ++DEFINE_AGF_EVENT(xfs_agf); ++DEFINE_AGF_EVENT(xfs_agfl_reset); + + TRACE_EVENT(xfs_free_extent, + TP_PROTO(struct xfs_mount *mp, xfs_agnumber_t agno, xfs_agblock_t agbno, +diff --git a/include/linux/iio/buffer_impl.h b/include/linux/iio/buffer_impl.h +index b9e22b7e2f28..d1171db23742 100644 +--- a/include/linux/iio/buffer_impl.h ++++ b/include/linux/iio/buffer_impl.h +@@ -53,7 +53,7 @@ struct iio_buffer_access_funcs { + int (*request_update)(struct iio_buffer *buffer); + + int (*set_bytes_per_datum)(struct iio_buffer *buffer, size_t bpd); +- int (*set_length)(struct iio_buffer *buffer, int length); ++ int (*set_length)(struct iio_buffer *buffer, unsigned int length); + + int (*enable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); + int (*disable)(struct iio_buffer *buffer, struct iio_dev *indio_dev); +@@ -72,10 +72,10 @@ struct iio_buffer_access_funcs { + */ + struct iio_buffer { + /** @length: Number of datums in buffer. */ +- int length; ++ unsigned int length; + + /** @bytes_per_datum: Size of individual datum including timestamp. */ +- int bytes_per_datum; ++ size_t bytes_per_datum; + + /** + * @access: Buffer access functions associated with the +diff --git a/include/linux/tcp.h b/include/linux/tcp.h +index e8418fc77a43..fe322fa611e6 100644 +--- a/include/linux/tcp.h ++++ b/include/linux/tcp.h +@@ -334,7 +334,7 @@ struct tcp_sock { + + /* Receiver queue space */ + struct { +- int space; ++ u32 space; + u32 seq; + u64 time; + } rcvq_space; +diff --git a/include/uapi/linux/nl80211.h b/include/uapi/linux/nl80211.h +index 3fab6c81917f..f41ea5af22ee 100644 +--- a/include/uapi/linux/nl80211.h ++++ b/include/uapi/linux/nl80211.h +@@ -2604,7 +2604,7 @@ enum nl80211_attrs { + #define NL80211_ATTR_KEYS NL80211_ATTR_KEYS + #define NL80211_ATTR_FEATURE_FLAGS NL80211_ATTR_FEATURE_FLAGS + +-#define NL80211_WIPHY_NAME_MAXLEN 128 ++#define NL80211_WIPHY_NAME_MAXLEN 64 + + #define NL80211_MAX_SUPP_RATES 32 + #define NL80211_MAX_SUPP_HT_RATES 77 +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 76bcc80b893e..520ecaf61dc4 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -894,7 +894,7 @@ int __trace_bputs(unsigned long ip, const char *str) + EXPORT_SYMBOL_GPL(__trace_bputs); + + #ifdef CONFIG_TRACER_SNAPSHOT +-static void tracing_snapshot_instance(struct trace_array *tr) ++void tracing_snapshot_instance(struct trace_array *tr) + { + struct tracer *tracer = tr->current_trace; + unsigned long flags; +@@ -950,7 +950,7 @@ static int resize_buffer_duplicate_size(struct trace_buffer *trace_buf, + struct trace_buffer *size_buf, int cpu_id); + static void set_buffer_entries(struct trace_buffer *buf, unsigned long val); + +-static int alloc_snapshot(struct trace_array *tr) ++int tracing_alloc_snapshot_instance(struct trace_array *tr) + { + int ret; + +@@ -996,7 +996,7 @@ int tracing_alloc_snapshot(void) + struct trace_array *tr = &global_trace; + int ret; + +- ret = alloc_snapshot(tr); ++ ret = tracing_alloc_snapshot_instance(tr); + WARN_ON(ret < 0); + + return ret; +@@ -5400,7 +5400,7 @@ static int tracing_set_tracer(struct trace_array *tr, const char *buf) + + #ifdef CONFIG_TRACER_MAX_TRACE + if (t->use_max_tr && !had_max_tr) { +- ret = alloc_snapshot(tr); ++ ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + goto out; + } +@@ -6378,7 +6378,7 @@ tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt, + } + #endif + if (!tr->allocated_snapshot) { +- ret = alloc_snapshot(tr); ++ ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + break; + } +@@ -7099,7 +7099,7 @@ ftrace_trace_snapshot_callback(struct trace_array *tr, struct ftrace_hash *hash, + return ret; + + out_reg: +- ret = alloc_snapshot(tr); ++ ret = tracing_alloc_snapshot_instance(tr); + if (ret < 0) + goto out; + +diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h +index 401b0639116f..851cd1605085 100644 +--- a/kernel/trace/trace.h ++++ b/kernel/trace/trace.h +@@ -1807,6 +1807,17 @@ static inline void __init trace_event_init(void) { } + static inline void trace_event_eval_update(struct trace_eval_map **map, int len) { } + #endif + ++#ifdef CONFIG_TRACER_SNAPSHOT ++void tracing_snapshot_instance(struct trace_array *tr); ++int tracing_alloc_snapshot_instance(struct trace_array *tr); ++#else ++static inline void tracing_snapshot_instance(struct trace_array *tr) { } ++static inline int tracing_alloc_snapshot_instance(struct trace_array *tr) ++{ ++ return 0; ++} ++#endif ++ + extern struct trace_iterator *tracepoint_print_iter; + + #endif /* _LINUX_KERNEL_TRACE_H */ +diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c +index f2ac9d44f6c4..b413fab7d75b 100644 +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -482,9 +482,10 @@ clear_event_triggers(struct trace_array *tr) + struct trace_event_file *file; + + list_for_each_entry(file, &tr->events, list) { +- struct event_trigger_data *data; +- list_for_each_entry_rcu(data, &file->triggers, list) { ++ struct event_trigger_data *data, *n; ++ list_for_each_entry_safe(data, n, &file->triggers, list) { + trace_event_trigger_enable_disable(file, 0); ++ list_del_rcu(&data->list); + if (data->ops->free) + data->ops->free(data->ops, data); + } +@@ -641,6 +642,7 @@ event_trigger_callback(struct event_command *cmd_ops, + trigger_data->count = -1; + trigger_data->ops = trigger_ops; + trigger_data->cmd_ops = cmd_ops; ++ trigger_data->private_data = file; + INIT_LIST_HEAD(&trigger_data->list); + INIT_LIST_HEAD(&trigger_data->named_list); + +@@ -1041,7 +1043,12 @@ static struct event_command trigger_traceoff_cmd = { + static void + snapshot_trigger(struct event_trigger_data *data, void *rec) + { +- tracing_snapshot(); ++ struct trace_event_file *file = data->private_data; ++ ++ if (file) ++ tracing_snapshot_instance(file->tr); ++ else ++ tracing_snapshot(); + } + + static void +@@ -1063,7 +1070,7 @@ register_snapshot_trigger(char *glob, struct event_trigger_ops *ops, + { + int ret = register_trigger(glob, ops, data, file); + +- if (ret > 0 && tracing_alloc_snapshot() != 0) { ++ if (ret > 0 && tracing_alloc_snapshot_instance(file->tr) != 0) { + unregister_trigger(glob, ops, data, file); + ret = 0; + } +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index e774898c91d5..8af604f3b370 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2388,7 +2388,7 @@ static void __split_huge_page(struct page *page, struct list_head *list, + __split_huge_page_tail(head, i, lruvec, list); + /* Some pages can be beyond i_size: drop them from page cache */ + if (head[i].index >= end) { +- __ClearPageDirty(head + i); ++ ClearPageDirty(head + i); + __delete_from_page_cache(head + i, NULL); + if (IS_ENABLED(CONFIG_SHMEM) && PageSwapBacked(head)) + shmem_uncharge(head->mapping->host, 1); +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 1a581468a9cf..be56e2e1931e 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1451,7 +1451,7 @@ int __isolate_lru_page(struct page *page, isolate_mode_t mode) + return ret; + + mapping = page_mapping(page); +- migrate_dirty = mapping && mapping->a_ops->migratepage; ++ migrate_dirty = !mapping || mapping->a_ops->migratepage; + unlock_page(page); + if (!migrate_dirty) + return ret; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index ebbb54bcbcac..125b49c166a4 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -591,8 +591,8 @@ static inline void tcp_rcv_rtt_measure_ts(struct sock *sk, + void tcp_rcv_space_adjust(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); ++ u32 copied; + int time; +- int copied; + + tcp_mstamp_refresh(tp); + time = tcp_stamp_us_delta(tp->tcp_mstamp, tp->rcvq_space.time); +@@ -615,12 +615,13 @@ void tcp_rcv_space_adjust(struct sock *sk) + + if (sysctl_tcp_moderate_rcvbuf && + !(sk->sk_userlocks & SOCK_RCVBUF_LOCK)) { +- int rcvwin, rcvmem, rcvbuf; ++ int rcvmem, rcvbuf; ++ u64 rcvwin; + + /* minimal window to cope with packet losses, assuming + * steady state. Add some cushion because of small variations. + */ +- rcvwin = (copied << 1) + 16 * tp->advmss; ++ rcvwin = ((u64)copied << 1) + 16 * tp->advmss; + + /* If rate increased by 25%, + * assume slow start, rcvwin = 3 * copied +@@ -640,7 +641,8 @@ void tcp_rcv_space_adjust(struct sock *sk) + while (tcp_win_from_space(rcvmem) < tp->advmss) + rcvmem += 128; + +- rcvbuf = min(rcvwin / tp->advmss * rcvmem, sysctl_tcp_rmem[2]); ++ do_div(rcvwin, tp->advmss); ++ rcvbuf = min_t(u64, rcvwin * rcvmem, sysctl_tcp_rmem[2]); + if (rcvbuf > sk->sk_rcvbuf) { + sk->sk_rcvbuf = rcvbuf; + +diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c +index c9c031e3d1ae..b275743e23cc 100644 +--- a/security/selinux/ss/services.c ++++ b/security/selinux/ss/services.c +@@ -1448,7 +1448,7 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len, + scontext_len, &context, def_sid); + if (rc == -EINVAL && force) { + context.str = str; +- context.len = scontext_len; ++ context.len = strlen(str) + 1; + str = NULL; + } else if (rc) + goto out_unlock; +diff --git a/sound/soc/intel/common/sst-firmware.c b/sound/soc/intel/common/sst-firmware.c +index a086c35f91bb..79a9fdf94d38 100644 +--- a/sound/soc/intel/common/sst-firmware.c ++++ b/sound/soc/intel/common/sst-firmware.c +@@ -274,7 +274,6 @@ int sst_dma_new(struct sst_dsp *sst) + struct sst_pdata *sst_pdata = sst->pdata; + struct sst_dma *dma; + struct resource mem; +- const char *dma_dev_name; + int ret = 0; + + if (sst->pdata->resindex_dma_base == -1) +@@ -285,7 +284,6 @@ int sst_dma_new(struct sst_dsp *sst) + * is attached to the ADSP IP. */ + switch (sst->pdata->dma_engine) { + case SST_DMA_TYPE_DW: +- dma_dev_name = "dw_dmac"; + break; + default: + dev_err(sst->dev, "error: invalid DMA engine %d\n", +diff --git a/tools/objtool/check.c b/tools/objtool/check.c +index c8b8b7101c6f..e128d1c71c30 100644 +--- a/tools/objtool/check.c ++++ b/tools/objtool/check.c +@@ -59,6 +59,31 @@ static struct instruction *next_insn_same_sec(struct objtool_file *file, + return next; + } + ++static struct instruction *next_insn_same_func(struct objtool_file *file, ++ struct instruction *insn) ++{ ++ struct instruction *next = list_next_entry(insn, list); ++ struct symbol *func = insn->func; ++ ++ if (!func) ++ return NULL; ++ ++ if (&next->list != &file->insn_list && next->func == func) ++ return next; ++ ++ /* Check if we're already in the subfunction: */ ++ if (func == func->cfunc) ++ return NULL; ++ ++ /* Move to the subfunction: */ ++ return find_insn(file, func->cfunc->sec, func->cfunc->offset); ++} ++ ++#define func_for_each_insn_all(file, func, insn) \ ++ for (insn = find_insn(file, func->sec, func->offset); \ ++ insn; \ ++ insn = next_insn_same_func(file, insn)) ++ + #define func_for_each_insn(file, func, insn) \ + for (insn = find_insn(file, func->sec, func->offset); \ + insn && &insn->list != &file->insn_list && \ +@@ -148,10 +173,14 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func, + if (!strcmp(func->name, global_noreturns[i])) + return 1; + +- if (!func->sec) ++ if (!func->len) + return 0; + +- func_for_each_insn(file, func, insn) { ++ insn = find_insn(file, func->sec, func->offset); ++ if (!insn->func) ++ return 0; ++ ++ func_for_each_insn_all(file, func, insn) { + empty = false; + + if (insn->type == INSN_RETURN) +@@ -166,35 +195,28 @@ static int __dead_end_function(struct objtool_file *file, struct symbol *func, + * case, the function's dead-end status depends on whether the target + * of the sibling call returns. + */ +- func_for_each_insn(file, func, insn) { +- if (insn->sec != func->sec || +- insn->offset >= func->offset + func->len) +- break; +- ++ func_for_each_insn_all(file, func, insn) { + if (insn->type == INSN_JUMP_UNCONDITIONAL) { + struct instruction *dest = insn->jump_dest; +- struct symbol *dest_func; + + if (!dest) + /* sibling call to another file */ + return 0; + +- if (dest->sec != func->sec || +- dest->offset < func->offset || +- dest->offset >= func->offset + func->len) { +- /* local sibling call */ +- dest_func = find_symbol_by_offset(dest->sec, +- dest->offset); +- if (!dest_func) +- continue; ++ if (dest->func && dest->func->pfunc != insn->func->pfunc) { + ++ /* local sibling call */ + if (recursion == 5) { +- WARN_FUNC("infinite recursion (objtool bug!)", +- dest->sec, dest->offset); +- return -1; ++ /* ++ * Infinite recursion: two functions ++ * have sibling calls to each other. ++ * This is a very rare case. It means ++ * they aren't dead ends. ++ */ ++ return 0; + } + +- return __dead_end_function(file, dest_func, ++ return __dead_end_function(file, dest->func, + recursion + 1); + } + } +@@ -421,7 +443,7 @@ static void add_ignores(struct objtool_file *file) + if (!ignore_func(file, func)) + continue; + +- func_for_each_insn(file, func, insn) ++ func_for_each_insn_all(file, func, insn) + insn->ignore = true; + } + } +@@ -781,30 +803,35 @@ static int add_special_section_alts(struct objtool_file *file) + return ret; + } + +-static int add_switch_table(struct objtool_file *file, struct symbol *func, +- struct instruction *insn, struct rela *table, +- struct rela *next_table) ++static int add_switch_table(struct objtool_file *file, struct instruction *insn, ++ struct rela *table, struct rela *next_table) + { + struct rela *rela = table; + struct instruction *alt_insn; + struct alternative *alt; ++ struct symbol *pfunc = insn->func->pfunc; ++ unsigned int prev_offset = 0; + + list_for_each_entry_from(rela, &file->rodata->rela->rela_list, list) { + if (rela == next_table) + break; + +- if (rela->sym->sec != insn->sec || +- rela->addend <= func->offset || +- rela->addend >= func->offset + func->len) ++ /* Make sure the switch table entries are consecutive: */ ++ if (prev_offset && rela->offset != prev_offset + 8) + break; + +- alt_insn = find_insn(file, insn->sec, rela->addend); +- if (!alt_insn) { +- WARN("%s: can't find instruction at %s+0x%x", +- file->rodata->rela->name, insn->sec->name, +- rela->addend); +- return -1; +- } ++ /* Detect function pointers from contiguous objects: */ ++ if (rela->sym->sec == pfunc->sec && ++ rela->addend == pfunc->offset) ++ break; ++ ++ alt_insn = find_insn(file, rela->sym->sec, rela->addend); ++ if (!alt_insn) ++ break; ++ ++ /* Make sure the jmp dest is in the function or subfunction: */ ++ if (alt_insn->func->pfunc != pfunc) ++ break; + + alt = malloc(sizeof(*alt)); + if (!alt) { +@@ -814,6 +841,13 @@ static int add_switch_table(struct objtool_file *file, struct symbol *func, + + alt->insn = alt_insn; + list_add_tail(&alt->list, &insn->alts); ++ prev_offset = rela->offset; ++ } ++ ++ if (!prev_offset) { ++ WARN_FUNC("can't find switch jump table", ++ insn->sec, insn->offset); ++ return -1; + } + + return 0; +@@ -868,40 +902,21 @@ static struct rela *find_switch_table(struct objtool_file *file, + { + struct rela *text_rela, *rodata_rela; + struct instruction *orig_insn = insn; ++ unsigned long table_offset; + +- text_rela = find_rela_by_dest_range(insn->sec, insn->offset, insn->len); +- if (text_rela && text_rela->sym == file->rodata->sym) { +- /* case 1 */ +- rodata_rela = find_rela_by_dest(file->rodata, +- text_rela->addend); +- if (rodata_rela) +- return rodata_rela; +- +- /* case 2 */ +- rodata_rela = find_rela_by_dest(file->rodata, +- text_rela->addend + 4); +- if (!rodata_rela) +- return NULL; +- +- file->ignore_unreachables = true; +- return rodata_rela; +- } +- +- /* case 3 */ + /* + * Backward search using the @first_jump_src links, these help avoid + * much of the 'in between' code. Which avoids us getting confused by + * it. + */ +- for (insn = list_prev_entry(insn, list); +- ++ for (; + &insn->list != &file->insn_list && + insn->sec == func->sec && + insn->offset >= func->offset; + + insn = insn->first_jump_src ?: list_prev_entry(insn, list)) { + +- if (insn->type == INSN_JUMP_DYNAMIC) ++ if (insn != orig_insn && insn->type == INSN_JUMP_DYNAMIC) + break; + + /* allow small jumps within the range */ +@@ -917,18 +932,29 @@ static struct rela *find_switch_table(struct objtool_file *file, + if (!text_rela || text_rela->sym != file->rodata->sym) + continue; + ++ table_offset = text_rela->addend; ++ if (text_rela->type == R_X86_64_PC32) ++ table_offset += 4; ++ + /* + * Make sure the .rodata address isn't associated with a + * symbol. gcc jump tables are anonymous data. + */ +- if (find_symbol_containing(file->rodata, text_rela->addend)) ++ if (find_symbol_containing(file->rodata, table_offset)) + continue; + +- rodata_rela = find_rela_by_dest(file->rodata, text_rela->addend); +- if (!rodata_rela) +- continue; ++ rodata_rela = find_rela_by_dest(file->rodata, table_offset); ++ if (rodata_rela) { ++ /* ++ * Use of RIP-relative switch jumps is quite rare, and ++ * indicates a rare GCC quirk/bug which can leave dead ++ * code behind. ++ */ ++ if (text_rela->type == R_X86_64_PC32) ++ file->ignore_unreachables = true; + +- return rodata_rela; ++ return rodata_rela; ++ } + } + + return NULL; +@@ -942,7 +968,7 @@ static int add_func_switch_tables(struct objtool_file *file, + struct rela *rela, *prev_rela = NULL; + int ret; + +- func_for_each_insn(file, func, insn) { ++ func_for_each_insn_all(file, func, insn) { + if (!last) + last = insn; + +@@ -973,8 +999,7 @@ static int add_func_switch_tables(struct objtool_file *file, + * the beginning of another switch table in the same function. + */ + if (prev_jump) { +- ret = add_switch_table(file, func, prev_jump, prev_rela, +- rela); ++ ret = add_switch_table(file, prev_jump, prev_rela, rela); + if (ret) + return ret; + } +@@ -984,7 +1009,7 @@ static int add_func_switch_tables(struct objtool_file *file, + } + + if (prev_jump) { +- ret = add_switch_table(file, func, prev_jump, prev_rela, NULL); ++ ret = add_switch_table(file, prev_jump, prev_rela, NULL); + if (ret) + return ret; + } +@@ -1748,15 +1773,13 @@ static int validate_branch(struct objtool_file *file, struct instruction *first, + while (1) { + next_insn = next_insn_same_sec(file, insn); + +- +- if (file->c_file && func && insn->func && func != insn->func) { ++ if (file->c_file && func && insn->func && func != insn->func->pfunc) { + WARN("%s() falls through to next function %s()", + func->name, insn->func->name); + return 1; + } + +- if (insn->func) +- func = insn->func; ++ func = insn->func ? insn->func->pfunc : NULL; + + if (func && insn->ignore) { + WARN_FUNC("BUG: why am I validating an ignored function?", +@@ -1777,7 +1800,7 @@ static int validate_branch(struct objtool_file *file, struct instruction *first, + + i = insn; + save_insn = NULL; +- func_for_each_insn_continue_reverse(file, func, i) { ++ func_for_each_insn_continue_reverse(file, insn->func, i) { + if (i->save) { + save_insn = i; + break; +@@ -1864,7 +1887,7 @@ static int validate_branch(struct objtool_file *file, struct instruction *first, + case INSN_JUMP_UNCONDITIONAL: + if (insn->jump_dest && + (!func || !insn->jump_dest->func || +- func == insn->jump_dest->func)) { ++ insn->jump_dest->func->pfunc == func)) { + ret = validate_branch(file, insn->jump_dest, + state); + if (ret) +@@ -2059,7 +2082,7 @@ static int validate_functions(struct objtool_file *file) + + for_each_sec(file, sec) { + list_for_each_entry(func, &sec->symbol_list, list) { +- if (func->type != STT_FUNC) ++ if (func->type != STT_FUNC || func->pfunc != func) + continue; + + insn = find_insn(file, sec, func->offset); +diff --git a/tools/objtool/elf.c b/tools/objtool/elf.c +index c1c338661699..4e60e105583e 100644 +--- a/tools/objtool/elf.c ++++ b/tools/objtool/elf.c +@@ -79,6 +79,19 @@ struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset) + return NULL; + } + ++struct symbol *find_symbol_by_name(struct elf *elf, const char *name) ++{ ++ struct section *sec; ++ struct symbol *sym; ++ ++ list_for_each_entry(sec, &elf->sections, list) ++ list_for_each_entry(sym, &sec->symbol_list, list) ++ if (!strcmp(sym->name, name)) ++ return sym; ++ ++ return NULL; ++} ++ + struct symbol *find_symbol_containing(struct section *sec, unsigned long offset) + { + struct symbol *sym; +@@ -203,10 +216,11 @@ static int read_sections(struct elf *elf) + + static int read_symbols(struct elf *elf) + { +- struct section *symtab; +- struct symbol *sym; ++ struct section *symtab, *sec; ++ struct symbol *sym, *pfunc; + struct list_head *entry, *tmp; + int symbols_nr, i; ++ char *coldstr; + + symtab = find_section_by_name(elf, ".symtab"); + if (!symtab) { +@@ -281,6 +295,30 @@ static int read_symbols(struct elf *elf) + hash_add(sym->sec->symbol_hash, &sym->hash, sym->idx); + } + ++ /* Create parent/child links for any cold subfunctions */ ++ list_for_each_entry(sec, &elf->sections, list) { ++ list_for_each_entry(sym, &sec->symbol_list, list) { ++ if (sym->type != STT_FUNC) ++ continue; ++ sym->pfunc = sym->cfunc = sym; ++ coldstr = strstr(sym->name, ".cold."); ++ if (coldstr) { ++ coldstr[0] = '\0'; ++ pfunc = find_symbol_by_name(elf, sym->name); ++ coldstr[0] = '.'; ++ ++ if (!pfunc) { ++ WARN("%s(): can't find parent function", ++ sym->name); ++ goto err; ++ } ++ ++ sym->pfunc = pfunc; ++ pfunc->cfunc = sym; ++ } ++ } ++ } ++ + return 0; + + err: +diff --git a/tools/objtool/elf.h b/tools/objtool/elf.h +index d86e2ff14466..de5cd2ddded9 100644 +--- a/tools/objtool/elf.h ++++ b/tools/objtool/elf.h +@@ -61,6 +61,7 @@ struct symbol { + unsigned char bind, type; + unsigned long offset; + unsigned int len; ++ struct symbol *pfunc, *cfunc; + }; + + struct rela { +@@ -86,6 +87,7 @@ struct elf { + struct elf *elf_open(const char *name, int flags); + struct section *find_section_by_name(struct elf *elf, const char *name); + struct symbol *find_symbol_by_offset(struct section *sec, unsigned long offset); ++struct symbol *find_symbol_by_name(struct elf *elf, const char *name); + struct symbol *find_symbol_containing(struct section *sec, unsigned long offset); + struct rela *find_rela_by_dest(struct section *sec, unsigned long offset); + struct rela *find_rela_by_dest_range(struct section *sec, unsigned long offset, diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.48-49.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.48-49.patch new file mode 100644 index 000000000000..4f8e7ec07b59 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.48-49.patch @@ -0,0 +1,1356 @@ +diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt +index cfc66ea72329..a365656e4873 100644 +--- a/Documentation/networking/netdev-FAQ.txt ++++ b/Documentation/networking/netdev-FAQ.txt +@@ -176,6 +176,15 @@ A: No. See above answer. In short, if you think it really belongs in + dash marker line as described in Documentation/process/submitting-patches.rst to + temporarily embed that information into the patch that you send. + ++Q: Are all networking bug fixes backported to all stable releases? ++ ++A: Due to capacity, Dave could only take care of the backports for the last ++ 2 stable releases. For earlier stable releases, each stable branch maintainer ++ is supposed to take care of them. If you find any patch is missing from an ++ earlier stable branch, please notify stable@vger.kernel.org with either a ++ commit ID or a formal patch backported, and CC Dave and other relevant ++ networking developers. ++ + Q: Someone said that the comment style and coding convention is different + for the networking content. Is this true? + +diff --git a/Makefile b/Makefile +index 7a246f1ce44e..480ae7ef755c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 48 ++SUBLEVEL = 49 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/gpu/drm/drm_file.c b/drivers/gpu/drm/drm_file.c +index b3c6e997ccdb..03244b3c985d 100644 +--- a/drivers/gpu/drm/drm_file.c ++++ b/drivers/gpu/drm/drm_file.c +@@ -212,6 +212,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor) + return -ENOMEM; + + filp->private_data = priv; ++ filp->f_mode |= FMODE_UNSIGNED_OFFSET; + priv->filp = filp; + priv->pid = get_pid(task_pid(current)); + priv->minor = minor; +diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c +index 944a7f338099..1b25d8bc153a 100644 +--- a/drivers/isdn/hardware/eicon/diva.c ++++ b/drivers/isdn/hardware/eicon/diva.c +@@ -388,10 +388,10 @@ void divasa_xdi_driver_unload(void) + ** Receive and process command from user mode utility + */ + void *diva_xdi_open_adapter(void *os_handle, const void __user *src, +- int length, ++ int length, void *mptr, + divas_xdi_copy_from_user_fn_t cp_fn) + { +- diva_xdi_um_cfg_cmd_t msg; ++ diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; + diva_os_xdi_adapter_t *a = NULL; + diva_os_spin_lock_magic_t old_irql; + struct list_head *tmp; +@@ -401,21 +401,21 @@ void *diva_xdi_open_adapter(void *os_handle, const void __user *src, + length, sizeof(diva_xdi_um_cfg_cmd_t))) + return NULL; + } +- if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) { ++ if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) { + DBG_ERR(("A: A(?) open, write error")) + return NULL; + } + diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter"); + list_for_each(tmp, &adapter_queue) { + a = list_entry(tmp, diva_os_xdi_adapter_t, link); +- if (a->controller == (int)msg.adapter) ++ if (a->controller == (int)msg->adapter) + break; + a = NULL; + } + diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter"); + + if (!a) { +- DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter)) ++ DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter)) + } + + return (a); +@@ -437,8 +437,10 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle) + + int + diva_xdi_write(void *adapter, void *os_handle, const void __user *src, +- int length, divas_xdi_copy_from_user_fn_t cp_fn) ++ int length, void *mptr, ++ divas_xdi_copy_from_user_fn_t cp_fn) + { ++ diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr; + diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter; + void *data; + +@@ -459,7 +461,13 @@ diva_xdi_write(void *adapter, void *os_handle, const void __user *src, + return (-2); + } + +- length = (*cp_fn) (os_handle, data, src, length); ++ if (msg) { ++ *(diva_xdi_um_cfg_cmd_t *)data = *msg; ++ length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg), ++ src + sizeof(*msg), length - sizeof(*msg)); ++ } else { ++ length = (*cp_fn) (os_handle, data, src, length); ++ } + if (length > 0) { + if ((*(a->interface.cmd_proc)) + (a, (diva_xdi_um_cfg_cmd_t *) data, length)) { +diff --git a/drivers/isdn/hardware/eicon/diva.h b/drivers/isdn/hardware/eicon/diva.h +index b067032093a8..1ad76650fbf9 100644 +--- a/drivers/isdn/hardware/eicon/diva.h ++++ b/drivers/isdn/hardware/eicon/diva.h +@@ -20,10 +20,11 @@ int diva_xdi_read(void *adapter, void *os_handle, void __user *dst, + int max_length, divas_xdi_copy_to_user_fn_t cp_fn); + + int diva_xdi_write(void *adapter, void *os_handle, const void __user *src, +- int length, divas_xdi_copy_from_user_fn_t cp_fn); ++ int length, void *msg, ++ divas_xdi_copy_from_user_fn_t cp_fn); + + void *diva_xdi_open_adapter(void *os_handle, const void __user *src, +- int length, ++ int length, void *msg, + divas_xdi_copy_from_user_fn_t cp_fn); + + void diva_xdi_close_adapter(void *adapter, void *os_handle); +diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c +index b2023e08dcd2..932e98d0d901 100644 +--- a/drivers/isdn/hardware/eicon/divasmain.c ++++ b/drivers/isdn/hardware/eicon/divasmain.c +@@ -591,19 +591,22 @@ static int divas_release(struct inode *inode, struct file *file) + static ssize_t divas_write(struct file *file, const char __user *buf, + size_t count, loff_t *ppos) + { ++ diva_xdi_um_cfg_cmd_t msg; + int ret = -EINVAL; + + if (!file->private_data) { + file->private_data = diva_xdi_open_adapter(file, buf, +- count, ++ count, &msg, + xdi_copy_from_user); +- } +- if (!file->private_data) { +- return (-ENODEV); ++ if (!file->private_data) ++ return (-ENODEV); ++ ret = diva_xdi_write(file->private_data, file, ++ buf, count, &msg, xdi_copy_from_user); ++ } else { ++ ret = diva_xdi_write(file->private_data, file, ++ buf, count, NULL, xdi_copy_from_user); + } + +- ret = diva_xdi_write(file->private_data, file, +- buf, count, xdi_copy_from_user); + switch (ret) { + case -1: /* Message should be removed from rx mailbox first */ + ret = -EBUSY; +@@ -622,11 +625,12 @@ static ssize_t divas_write(struct file *file, const char __user *buf, + static ssize_t divas_read(struct file *file, char __user *buf, + size_t count, loff_t *ppos) + { ++ diva_xdi_um_cfg_cmd_t msg; + int ret = -EINVAL; + + if (!file->private_data) { + file->private_data = diva_xdi_open_adapter(file, buf, +- count, ++ count, &msg, + xdi_copy_from_user); + } + if (!file->private_data) { +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +index 7dd83d0ef0a0..22243c480a05 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c +@@ -588,7 +588,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params, + * slots for the highest priority. + */ + REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS : +- NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); ++ NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); + /* Mapping between the CREDIT_WEIGHT registers and actual client + * numbers + */ +diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c +index aef40f02c77f..a03a32a4ffca 100644 +--- a/drivers/net/ethernet/cisco/enic/enic_main.c ++++ b/drivers/net/ethernet/cisco/enic/enic_main.c +@@ -2703,11 +2703,11 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + pci_set_master(pdev); + + /* Query PCI controller on system for DMA addressing +- * limitation for the device. Try 64-bit first, and ++ * limitation for the device. Try 47-bit first, and + * fail to 32-bit. + */ + +- err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64)); ++ err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47)); + if (err) { + err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32)); + if (err) { +@@ -2721,10 +2721,10 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + goto err_out_release_regions; + } + } else { +- err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64)); ++ err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47)); + if (err) { + dev_err(dev, "Unable to obtain %u-bit DMA " +- "for consistent allocations, aborting\n", 64); ++ "for consistent allocations, aborting\n", 47); + goto err_out_release_regions; + } + using_dac = 1; +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 1b03c32afc1f..7e2b70c2bba3 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -3294,7 +3294,9 @@ void be_detect_error(struct be_adapter *adapter) + if ((val & POST_STAGE_FAT_LOG_START) + != POST_STAGE_FAT_LOG_START && + (val & POST_STAGE_ARMFW_UE) +- != POST_STAGE_ARMFW_UE) ++ != POST_STAGE_ARMFW_UE && ++ (val & POST_STAGE_RECOVERABLE_ERR) ++ != POST_STAGE_RECOVERABLE_ERR) + return; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c +index 22a3bfe1ed8f..73419224367a 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/qp.c ++++ b/drivers/net/ethernet/mellanox/mlx4/qp.c +@@ -393,11 +393,11 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn) + struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table; + struct mlx4_qp *qp; + +- spin_lock(&qp_table->lock); ++ spin_lock_irq(&qp_table->lock); + + qp = __mlx4_qp_lookup(dev, qpn); + +- spin_unlock(&qp_table->lock); ++ spin_unlock_irq(&qp_table->lock); + return qp; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +index 3476f594c195..8285e6d24f30 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c +@@ -635,6 +635,45 @@ static inline bool is_first_ethertype_ip(struct sk_buff *skb) + return (ethertype == htons(ETH_P_IP) || ethertype == htons(ETH_P_IPV6)); + } + ++static __be32 mlx5e_get_fcs(struct sk_buff *skb) ++{ ++ int last_frag_sz, bytes_in_prev, nr_frags; ++ u8 *fcs_p1, *fcs_p2; ++ skb_frag_t *last_frag; ++ __be32 fcs_bytes; ++ ++ if (!skb_is_nonlinear(skb)) ++ return *(__be32 *)(skb->data + skb->len - ETH_FCS_LEN); ++ ++ nr_frags = skb_shinfo(skb)->nr_frags; ++ last_frag = &skb_shinfo(skb)->frags[nr_frags - 1]; ++ last_frag_sz = skb_frag_size(last_frag); ++ ++ /* If all FCS data is in last frag */ ++ if (last_frag_sz >= ETH_FCS_LEN) ++ return *(__be32 *)(skb_frag_address(last_frag) + ++ last_frag_sz - ETH_FCS_LEN); ++ ++ fcs_p2 = (u8 *)skb_frag_address(last_frag); ++ bytes_in_prev = ETH_FCS_LEN - last_frag_sz; ++ ++ /* Find where the other part of the FCS is - Linear or another frag */ ++ if (nr_frags == 1) { ++ fcs_p1 = skb_tail_pointer(skb); ++ } else { ++ skb_frag_t *prev_frag = &skb_shinfo(skb)->frags[nr_frags - 2]; ++ ++ fcs_p1 = skb_frag_address(prev_frag) + ++ skb_frag_size(prev_frag); ++ } ++ fcs_p1 -= bytes_in_prev; ++ ++ memcpy(&fcs_bytes, fcs_p1, bytes_in_prev); ++ memcpy(((u8 *)&fcs_bytes) + bytes_in_prev, fcs_p2, last_frag_sz); ++ ++ return fcs_bytes; ++} ++ + static inline void mlx5e_handle_csum(struct net_device *netdev, + struct mlx5_cqe64 *cqe, + struct mlx5e_rq *rq, +@@ -653,6 +692,9 @@ static inline void mlx5e_handle_csum(struct net_device *netdev, + if (is_first_ethertype_ip(skb)) { + skb->ip_summed = CHECKSUM_COMPLETE; + skb->csum = csum_unfold((__force __sum16)cqe->check_sum); ++ if (unlikely(netdev->features & NETIF_F_RXFCS)) ++ skb->csum = csum_add(skb->csum, ++ (__force __wsum)mlx5e_get_fcs(skb)); + rq->stats.csum_complete++; + return; + } +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index 629bfa0cd3f0..27ba476f761d 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -77,7 +77,7 @@ + #define ILT_CFG_REG(cli, reg) PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET + + /* ILT entry structure */ +-#define ILT_ENTRY_PHY_ADDR_MASK 0x000FFFFFFFFFFFULL ++#define ILT_ENTRY_PHY_ADDR_MASK (~0ULL >> 12) + #define ILT_ENTRY_PHY_ADDR_SHIFT 0 + #define ILT_ENTRY_VALID_MASK 0x1ULL + #define ILT_ENTRY_VALID_SHIFT 52 +diff --git a/drivers/net/phy/bcm-cygnus.c b/drivers/net/phy/bcm-cygnus.c +index 3fe8cc5c177e..9b27ca264c66 100644 +--- a/drivers/net/phy/bcm-cygnus.c ++++ b/drivers/net/phy/bcm-cygnus.c +@@ -61,17 +61,17 @@ static int bcm_cygnus_afe_config(struct phy_device *phydev) + return rc; + + /* make rcal=100, since rdb default is 000 */ +- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10); ++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10); + if (rc < 0) + return rc; + + /* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */ +- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10); ++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10); + if (rc < 0) + return rc; + + /* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */ +- rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00); ++ rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00); + + return 0; + } +diff --git a/drivers/net/phy/bcm-phy-lib.c b/drivers/net/phy/bcm-phy-lib.c +index 171010eb4d9c..8d96c6f048d0 100644 +--- a/drivers/net/phy/bcm-phy-lib.c ++++ b/drivers/net/phy/bcm-phy-lib.c +@@ -56,7 +56,7 @@ int bcm54xx_auxctl_read(struct phy_device *phydev, u16 regnum) + /* The register must be written to both the Shadow Register Select and + * the Shadow Read Register Selector + */ +- phy_write(phydev, MII_BCM54XX_AUX_CTL, regnum | ++ phy_write(phydev, MII_BCM54XX_AUX_CTL, MII_BCM54XX_AUXCTL_SHDWSEL_MASK | + regnum << MII_BCM54XX_AUXCTL_SHDWSEL_READ_SHIFT); + return phy_read(phydev, MII_BCM54XX_AUX_CTL); + } +diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h +index 7c73808cbbde..81cceaa412fe 100644 +--- a/drivers/net/phy/bcm-phy-lib.h ++++ b/drivers/net/phy/bcm-phy-lib.h +@@ -14,11 +14,18 @@ + #ifndef _LINUX_BCM_PHY_LIB_H + #define _LINUX_BCM_PHY_LIB_H + ++#include + #include + + int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val); + int bcm_phy_read_exp(struct phy_device *phydev, u16 reg); + ++static inline int bcm_phy_write_exp_sel(struct phy_device *phydev, ++ u16 reg, u16 val) ++{ ++ return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val); ++} ++ + int bcm54xx_auxctl_write(struct phy_device *phydev, u16 regnum, u16 val); + int bcm54xx_auxctl_read(struct phy_device *phydev, u16 regnum); + +diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c +index 8b33f688ac8a..3c5b2a2e2fcc 100644 +--- a/drivers/net/phy/bcm7xxx.c ++++ b/drivers/net/phy/bcm7xxx.c +@@ -65,10 +65,10 @@ struct bcm7xxx_phy_priv { + static void r_rc_cal_reset(struct phy_device *phydev) + { + /* Reset R_CAL/RC_CAL Engine */ +- bcm_phy_write_exp(phydev, 0x00b0, 0x0010); ++ bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010); + + /* Disable Reset R_AL/RC_CAL Engine */ +- bcm_phy_write_exp(phydev, 0x00b0, 0x0000); ++ bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000); + } + + static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev) +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 8a222ae5950e..83c591713837 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1004,7 +1004,8 @@ static void team_port_disable(struct team *team, + static void __team_compute_features(struct team *team) + { + struct team_port *port; +- u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL; ++ netdev_features_t vlan_features = TEAM_VLAN_FEATURES & ++ NETIF_F_ALL_FOR_ALL; + netdev_features_t enc_features = TEAM_ENC_FEATURES; + unsigned short max_hard_header_len = ETH_HLEN; + unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE | +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index bc38d54e37b9..3d9ad11e4f28 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1315,7 +1315,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + else + *skb_xdp = 0; + +- preempt_disable(); ++ local_bh_disable(); + rcu_read_lock(); + xdp_prog = rcu_dereference(tun->xdp_prog); + if (xdp_prog && !*skb_xdp) { +@@ -1338,7 +1338,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + if (err) + goto err_redirect; + rcu_read_unlock(); +- preempt_enable(); ++ local_bh_enable(); + return NULL; + case XDP_TX: + xdp_xmit = true; +@@ -1360,7 +1360,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + skb = build_skb(buf, buflen); + if (!skb) { + rcu_read_unlock(); +- preempt_enable(); ++ local_bh_enable(); + return ERR_PTR(-ENOMEM); + } + +@@ -1373,12 +1373,12 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + skb->dev = tun->dev; + generic_xdp_tx(skb, xdp_prog); + rcu_read_unlock(); +- preempt_enable(); ++ local_bh_enable(); + return NULL; + } + + rcu_read_unlock(); +- preempt_enable(); ++ local_bh_enable(); + + return skb; + +@@ -1386,7 +1386,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun, + put_page(alloc_frag->page); + err_xdp: + rcu_read_unlock(); +- preempt_enable(); ++ local_bh_enable(); + this_cpu_inc(tun->pcpu_stats->rx_dropped); + return NULL; + } +@@ -1556,16 +1556,19 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + struct bpf_prog *xdp_prog; + int ret; + ++ local_bh_disable(); + rcu_read_lock(); + xdp_prog = rcu_dereference(tun->xdp_prog); + if (xdp_prog) { + ret = do_xdp_generic(xdp_prog, skb); + if (ret != XDP_PASS) { + rcu_read_unlock(); ++ local_bh_enable(); + return total_len; + } + } + rcu_read_unlock(); ++ local_bh_enable(); + } + + rxhash = __skb_get_hash_symmetric(skb); +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c +index 7220cd620717..0362acd5cdca 100644 +--- a/drivers/net/usb/cdc_mbim.c ++++ b/drivers/net/usb/cdc_mbim.c +@@ -609,7 +609,7 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = { + */ + static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = { + .description = "CDC MBIM", +- .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN, ++ .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP, + .bind = cdc_mbim_bind, + .unbind = cdc_mbim_unbind, + .manage_power = cdc_mbim_manage_power, +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 948611317c97..9e93e7a5df7e 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -632,6 +632,13 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, + void *data; + u32 act; + ++ /* Transient failure which in theory could occur if ++ * in-flight packets from before XDP was enabled reach ++ * the receive path after XDP is loaded. ++ */ ++ if (unlikely(hdr->hdr.gso_type)) ++ goto err_xdp; ++ + /* This happens when rx buffer size is underestimated */ + if (unlikely(num_buf > 1 || + headroom < virtnet_get_headroom(vi))) { +@@ -647,14 +654,6 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, + xdp_page = page; + } + +- /* Transient failure which in theory could occur if +- * in-flight packets from before XDP was enabled reach +- * the receive path after XDP is loaded. In practice I +- * was not able to create this condition. +- */ +- if (unlikely(hdr->hdr.gso_type)) +- goto err_xdp; +- + /* Allow consuming headroom but reserve enough space to push + * the descriptor on if we get an XDP_TX return code. + */ +@@ -688,7 +687,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, + trace_xdp_exception(vi->dev, xdp_prog, act); + ewma_pkt_len_add(&rq->mrg_avg_pkt_len, len); + if (unlikely(xdp_page != page)) +- goto err_xdp; ++ put_page(page); + rcu_read_unlock(); + goto xdp_xmit; + default: +@@ -777,7 +776,7 @@ static struct sk_buff *receive_mergeable(struct net_device *dev, + rcu_read_unlock(); + err_skb: + put_page(page); +- while (--num_buf) { ++ while (num_buf-- > 1) { + buf = virtqueue_get_buf(rq->vq, &len); + if (unlikely(!buf)) { + pr_debug("%s: rx error: %d buffers missing\n", +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index c91662927de0..0b750228ad70 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -566,6 +566,26 @@ static void put_pcichild(struct hv_pci_dev *hv_pcidev, + static void get_hvpcibus(struct hv_pcibus_device *hv_pcibus); + static void put_hvpcibus(struct hv_pcibus_device *hv_pcibus); + ++/* ++ * There is no good way to get notified from vmbus_onoffer_rescind(), ++ * so let's use polling here, since this is not a hot path. ++ */ ++static int wait_for_response(struct hv_device *hdev, ++ struct completion *comp) ++{ ++ while (true) { ++ if (hdev->channel->rescind) { ++ dev_warn_once(&hdev->device, "The device is gone.\n"); ++ return -ENODEV; ++ } ++ ++ if (wait_for_completion_timeout(comp, HZ / 10)) ++ break; ++ } ++ ++ return 0; ++} ++ + /** + * devfn_to_wslot() - Convert from Linux PCI slot to Windows + * @devfn: The Linux representation of PCI slot +@@ -1582,7 +1602,8 @@ static struct hv_pci_dev *new_pcichild_device(struct hv_pcibus_device *hbus, + if (ret) + goto error; + +- wait_for_completion(&comp_pkt.host_event); ++ if (wait_for_response(hbus->hdev, &comp_pkt.host_event)) ++ goto error; + + hpdev->desc = *desc; + refcount_set(&hpdev->refs, 1); +@@ -2075,15 +2096,16 @@ static int hv_pci_protocol_negotiation(struct hv_device *hdev) + sizeof(struct pci_version_request), + (unsigned long)pkt, VM_PKT_DATA_INBAND, + VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); ++ if (!ret) ++ ret = wait_for_response(hdev, &comp_pkt.host_event); ++ + if (ret) { + dev_err(&hdev->device, +- "PCI Pass-through VSP failed sending version reqquest: %#x", ++ "PCI Pass-through VSP failed to request version: %d", + ret); + goto exit; + } + +- wait_for_completion(&comp_pkt.host_event); +- + if (comp_pkt.completion_status >= 0) { + pci_protocol_version = pci_protocol_versions[i]; + dev_info(&hdev->device, +@@ -2292,11 +2314,12 @@ static int hv_pci_enter_d0(struct hv_device *hdev) + ret = vmbus_sendpacket(hdev->channel, d0_entry, sizeof(*d0_entry), + (unsigned long)pkt, VM_PKT_DATA_INBAND, + VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); ++ if (!ret) ++ ret = wait_for_response(hdev, &comp_pkt.host_event); ++ + if (ret) + goto exit; + +- wait_for_completion(&comp_pkt.host_event); +- + if (comp_pkt.completion_status < 0) { + dev_err(&hdev->device, + "PCI Pass-through VSP failed D0 Entry with status %x\n", +@@ -2336,11 +2359,10 @@ static int hv_pci_query_relations(struct hv_device *hdev) + + ret = vmbus_sendpacket(hdev->channel, &message, sizeof(message), + 0, VM_PKT_DATA_INBAND, 0); +- if (ret) +- return ret; ++ if (!ret) ++ ret = wait_for_response(hdev, &comp); + +- wait_for_completion(&comp); +- return 0; ++ return ret; + } + + /** +@@ -2410,11 +2432,11 @@ static int hv_send_resources_allocated(struct hv_device *hdev) + size_res, (unsigned long)pkt, + VM_PKT_DATA_INBAND, + VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); ++ if (!ret) ++ ret = wait_for_response(hdev, &comp_pkt.host_event); + if (ret) + break; + +- wait_for_completion(&comp_pkt.host_event); +- + if (comp_pkt.completion_status < 0) { + ret = -EPROTO; + dev_err(&hdev->device, +diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c +index 2eb61d54bbb4..ea9e1e0ed5b8 100644 +--- a/drivers/scsi/sd_zbc.c ++++ b/drivers/scsi/sd_zbc.c +@@ -423,9 +423,18 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, + + #define SD_ZBC_BUF_SIZE 131072 + +-static int sd_zbc_check_zone_size(struct scsi_disk *sdkp) ++/** ++ * sd_zbc_check_zone_size - Check the device zone sizes ++ * @sdkp: Target disk ++ * ++ * Check that all zones of the device are equal. The last zone can however ++ * be smaller. The zone size must also be a power of two number of LBAs. ++ * ++ * Returns the zone size in bytes upon success or an error code upon failure. ++ */ ++static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp) + { +- u64 zone_blocks; ++ u64 zone_blocks = 0; + sector_t block = 0; + unsigned char *buf; + unsigned char *rec; +@@ -434,8 +443,6 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp) + int ret; + u8 same; + +- sdkp->zone_blocks = 0; +- + /* Get a buffer */ + buf = kmalloc(SD_ZBC_BUF_SIZE, GFP_KERNEL); + if (!buf) +@@ -443,10 +450,8 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp) + + /* Do a report zone to get the same field */ + ret = sd_zbc_report_zones(sdkp, buf, SD_ZBC_BUF_SIZE, 0); +- if (ret) { +- zone_blocks = 0; +- goto out; +- } ++ if (ret) ++ goto out_free; + + same = buf[4] & 0x0f; + if (same > 0) { +@@ -472,16 +477,17 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp) + + /* Parse zone descriptors */ + while (rec < buf + buf_len) { +- zone_blocks = get_unaligned_be64(&rec[8]); +- if (sdkp->zone_blocks == 0) { +- sdkp->zone_blocks = zone_blocks; +- } else if (zone_blocks != sdkp->zone_blocks && +- (block + zone_blocks < sdkp->capacity +- || zone_blocks > sdkp->zone_blocks)) { ++ u64 this_zone_blocks = get_unaligned_be64(&rec[8]); ++ ++ if (zone_blocks == 0) { ++ zone_blocks = this_zone_blocks; ++ } else if (this_zone_blocks != zone_blocks && ++ (block + this_zone_blocks < sdkp->capacity ++ || this_zone_blocks > zone_blocks)) { + zone_blocks = 0; + goto out; + } +- block += zone_blocks; ++ block += this_zone_blocks; + rec += 64; + } + +@@ -489,61 +495,77 @@ static int sd_zbc_check_zone_size(struct scsi_disk *sdkp) + ret = sd_zbc_report_zones(sdkp, buf, + SD_ZBC_BUF_SIZE, block); + if (ret) +- return ret; ++ goto out_free; + } + + } while (block < sdkp->capacity); + +- zone_blocks = sdkp->zone_blocks; +- + out: +- kfree(buf); +- + if (!zone_blocks) { + if (sdkp->first_scan) + sd_printk(KERN_NOTICE, sdkp, + "Devices with non constant zone " + "size are not supported\n"); +- return -ENODEV; +- } +- +- if (!is_power_of_2(zone_blocks)) { ++ ret = -ENODEV; ++ } else if (!is_power_of_2(zone_blocks)) { + if (sdkp->first_scan) + sd_printk(KERN_NOTICE, sdkp, + "Devices with non power of 2 zone " + "size are not supported\n"); +- return -ENODEV; +- } +- +- if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) { ++ ret = -ENODEV; ++ } else if (logical_to_sectors(sdkp->device, zone_blocks) > UINT_MAX) { + if (sdkp->first_scan) + sd_printk(KERN_NOTICE, sdkp, + "Zone size too large\n"); +- return -ENODEV; ++ ret = -ENODEV; ++ } else { ++ ret = zone_blocks; + } + +- sdkp->zone_blocks = zone_blocks; ++out_free: ++ kfree(buf); + +- return 0; ++ return ret; + } + +-static int sd_zbc_setup(struct scsi_disk *sdkp) ++static int sd_zbc_setup(struct scsi_disk *sdkp, u32 zone_blocks) + { ++ struct request_queue *q = sdkp->disk->queue; ++ u32 zone_shift = ilog2(zone_blocks); ++ u32 nr_zones; + + /* chunk_sectors indicates the zone size */ +- blk_queue_chunk_sectors(sdkp->disk->queue, +- logical_to_sectors(sdkp->device, sdkp->zone_blocks)); +- sdkp->zone_shift = ilog2(sdkp->zone_blocks); +- sdkp->nr_zones = sdkp->capacity >> sdkp->zone_shift; +- if (sdkp->capacity & (sdkp->zone_blocks - 1)) +- sdkp->nr_zones++; +- +- if (!sdkp->zones_wlock) { +- sdkp->zones_wlock = kcalloc(BITS_TO_LONGS(sdkp->nr_zones), +- sizeof(unsigned long), +- GFP_KERNEL); +- if (!sdkp->zones_wlock) +- return -ENOMEM; ++ blk_queue_chunk_sectors(q, ++ logical_to_sectors(sdkp->device, zone_blocks)); ++ nr_zones = round_up(sdkp->capacity, zone_blocks) >> zone_shift; ++ ++ /* ++ * Initialize the disk zone write lock bitmap if the number ++ * of zones changed. ++ */ ++ if (nr_zones != sdkp->nr_zones) { ++ unsigned long *zones_wlock = NULL; ++ ++ if (nr_zones) { ++ zones_wlock = kcalloc(BITS_TO_LONGS(nr_zones), ++ sizeof(unsigned long), ++ GFP_KERNEL); ++ if (!zones_wlock) ++ return -ENOMEM; ++ } ++ ++ blk_mq_freeze_queue(q); ++ sdkp->zone_blocks = zone_blocks; ++ sdkp->zone_shift = zone_shift; ++ sdkp->nr_zones = nr_zones; ++ swap(sdkp->zones_wlock, zones_wlock); ++ blk_mq_unfreeze_queue(q); ++ ++ kfree(zones_wlock); ++ ++ /* READ16/WRITE16 is mandatory for ZBC disks */ ++ sdkp->device->use_16_for_rw = 1; ++ sdkp->device->use_10_for_rw = 0; + } + + return 0; +@@ -552,6 +574,7 @@ static int sd_zbc_setup(struct scsi_disk *sdkp) + int sd_zbc_read_zones(struct scsi_disk *sdkp, + unsigned char *buf) + { ++ int64_t zone_blocks; + int ret; + + if (!sd_is_zoned(sdkp)) +@@ -589,19 +612,19 @@ int sd_zbc_read_zones(struct scsi_disk *sdkp, + * Check zone size: only devices with a constant zone size (except + * an eventual last runt zone) that is a power of 2 are supported. + */ +- ret = sd_zbc_check_zone_size(sdkp); +- if (ret) ++ zone_blocks = sd_zbc_check_zone_size(sdkp); ++ ret = -EFBIG; ++ if (zone_blocks != (u32)zone_blocks) ++ goto err; ++ ret = zone_blocks; ++ if (ret < 0) + goto err; + + /* The drive satisfies the kernel restrictions: set it up */ +- ret = sd_zbc_setup(sdkp); ++ ret = sd_zbc_setup(sdkp, zone_blocks); + if (ret) + goto err; + +- /* READ16/WRITE16 is mandatory for ZBC disks */ +- sdkp->device->use_16_for_rw = 1; +- sdkp->device->use_10_for_rw = 0; +- + return 0; + + err: +@@ -614,6 +637,7 @@ void sd_zbc_remove(struct scsi_disk *sdkp) + { + kfree(sdkp->zones_wlock); + sdkp->zones_wlock = NULL; ++ sdkp->nr_zones = 0; + } + + void sd_zbc_print_zones(struct scsi_disk *sdkp) +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 8e3ca4400766..50e48afd88ff 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -993,6 +993,7 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev, + { + int ret = 0; + ++ mutex_lock(&dev->mutex); + vhost_dev_lock_vqs(dev); + switch (msg->type) { + case VHOST_IOTLB_UPDATE: +@@ -1024,6 +1025,8 @@ static int vhost_process_iotlb_msg(struct vhost_dev *dev, + } + + vhost_dev_unlock_vqs(dev); ++ mutex_unlock(&dev->mutex); ++ + return ret; + } + ssize_t vhost_chr_write_iter(struct vhost_dev *dev, +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index 27d59cf36341..b475d1ebbbbf 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -59,7 +59,8 @@ + BTRFS_HEADER_FLAG_RELOC |\ + BTRFS_SUPER_FLAG_ERROR |\ + BTRFS_SUPER_FLAG_SEEDING |\ +- BTRFS_SUPER_FLAG_METADUMP) ++ BTRFS_SUPER_FLAG_METADUMP |\ ++ BTRFS_SUPER_FLAG_METADUMP_V2) + + static const struct extent_io_ops btree_extent_io_ops; + static void end_workqueue_fn(struct btrfs_work *work); +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 9596aa93d6ef..a54b8c58ccb7 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -861,6 +861,11 @@ static inline __be32 ip6_make_flowinfo(unsigned int tclass, __be32 flowlabel) + return htonl(tclass << IPV6_TCLASS_SHIFT) | flowlabel; + } + ++static inline __be32 flowi6_get_flowlabel(const struct flowi6 *fl6) ++{ ++ return fl6->flowlabel & IPV6_FLOWLABEL_MASK; ++} ++ + /* + * Prototypes exported by ipv6 + */ +diff --git a/include/uapi/linux/btrfs_tree.h b/include/uapi/linux/btrfs_tree.h +index 8f659bb7badc..7115838fbf2a 100644 +--- a/include/uapi/linux/btrfs_tree.h ++++ b/include/uapi/linux/btrfs_tree.h +@@ -456,6 +456,7 @@ struct btrfs_free_space_header { + + #define BTRFS_SUPER_FLAG_SEEDING (1ULL << 32) + #define BTRFS_SUPER_FLAG_METADUMP (1ULL << 33) ++#define BTRFS_SUPER_FLAG_METADUMP_V2 (1ULL << 34) + + + /* +diff --git a/mm/mmap.c b/mm/mmap.c +index 11f96fad5271..f858b1f336af 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -1315,6 +1315,35 @@ static inline int mlock_future_check(struct mm_struct *mm, + return 0; + } + ++static inline u64 file_mmap_size_max(struct file *file, struct inode *inode) ++{ ++ if (S_ISREG(inode->i_mode)) ++ return MAX_LFS_FILESIZE; ++ ++ if (S_ISBLK(inode->i_mode)) ++ return MAX_LFS_FILESIZE; ++ ++ /* Special "we do even unsigned file positions" case */ ++ if (file->f_mode & FMODE_UNSIGNED_OFFSET) ++ return 0; ++ ++ /* Yes, random drivers might want more. But I'm tired of buggy drivers */ ++ return ULONG_MAX; ++} ++ ++static inline bool file_mmap_ok(struct file *file, struct inode *inode, ++ unsigned long pgoff, unsigned long len) ++{ ++ u64 maxsize = file_mmap_size_max(file, inode); ++ ++ if (maxsize && len > maxsize) ++ return false; ++ maxsize -= len; ++ if (pgoff > maxsize >> PAGE_SHIFT) ++ return false; ++ return true; ++} ++ + /* + * The caller must hold down_write(¤t->mm->mmap_sem). + */ +@@ -1388,6 +1417,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr, + if (file) { + struct inode *inode = file_inode(file); + ++ if (!file_mmap_ok(file, inode, pgoff, len)) ++ return -EOVERFLOW; ++ + switch (flags & MAP_TYPE) { + case MAP_SHARED: + if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE)) +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index f950b80c0dd1..d8796a7874b6 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -1179,7 +1179,7 @@ __u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys) + keys->ports.src = fl6->fl6_sport; + keys->ports.dst = fl6->fl6_dport; + keys->keyid.keyid = fl6->fl6_gre_key; +- keys->tags.flow_label = (__force u32)fl6->flowlabel; ++ keys->tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6); + keys->basic.ip_proto = fl6->flowi6_proto; + + return flow_hash_from_keys(keys); +diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c +index 927a6dcbad96..8f17724a173c 100644 +--- a/net/core/net-sysfs.c ++++ b/net/core/net-sysfs.c +@@ -1207,9 +1207,6 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, + cpumask_var_t mask; + unsigned long index; + +- if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) +- return -ENOMEM; +- + index = get_netdev_queue_index(queue); + + if (dev->num_tc) { +@@ -1219,6 +1216,9 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue, + return -EINVAL; + } + ++ if (!zalloc_cpumask_var(&mask, GFP_KERNEL)) ++ return -ENOMEM; ++ + rcu_read_lock(); + dev_maps = rcu_dereference(dev->xps_maps); + if (dev_maps) { +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 5ace48926b19..4cfdad08aca0 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1958,6 +1958,10 @@ static int do_setlink(const struct sk_buff *skb, + const struct net_device_ops *ops = dev->netdev_ops; + int err; + ++ err = validate_linkmsg(dev, tb); ++ if (err < 0) ++ return err; ++ + if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]) { + struct net *net = rtnl_link_get_net(dev_net(dev), tb); + if (IS_ERR(net)) { +@@ -2296,10 +2300,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, + goto errout; + } + +- err = validate_linkmsg(dev, tb); +- if (err < 0) +- goto errout; +- + err = do_setlink(skb, dev, ifm, extack, tb, ifname, 0); + errout: + return err; +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index ff3b058cf58c..936dab12f99f 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -280,9 +280,7 @@ int dccp_disconnect(struct sock *sk, int flags) + + dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); +- ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; +- dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index d72874150905..df8fd3ce713d 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -625,6 +625,7 @@ const struct nla_policy rtm_ipv4_policy[RTA_MAX + 1] = { + [RTA_ENCAP] = { .type = NLA_NESTED }, + [RTA_UID] = { .type = NLA_U32 }, + [RTA_MARK] = { .type = NLA_U32 }, ++ [RTA_TABLE] = { .type = NLA_U32 }, + }; + + static int rtm_to_fib_config(struct net *net, struct sk_buff *skb, +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index f39955913d3f..b557af72cde9 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -725,6 +725,8 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi) + nla_strlcpy(tmp, nla, sizeof(tmp)); + val = tcp_ca_get_key_by_name(tmp, &ecn_ca); + } else { ++ if (nla_len(nla) != sizeof(u32)) ++ return false; + val = nla_get_u32(nla); + } + +@@ -1051,6 +1053,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) + if (val == TCP_CA_UNSPEC) + return -EINVAL; + } else { ++ if (nla_len(nla) != sizeof(u32)) ++ return -EINVAL; + val = nla_get_u32(nla); + } + if (type == RTAX_ADVMSS && val > 65535 - 40) +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 1e70ed5244ea..d07ba4d5917b 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -511,8 +511,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len) + int err; + int copied; + +- WARN_ON_ONCE(sk->sk_family == AF_INET6); +- + err = -EAGAIN; + skb = sock_dequeue_err_skb(sk); + if (!skb) +diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c +index c9b3e6e069ae..cbd9c0d8a788 100644 +--- a/net/ipv4/ipmr.c ++++ b/net/ipv4/ipmr.c +@@ -323,6 +323,7 @@ static const struct rhashtable_params ipmr_rht_params = { + static struct mr_table *ipmr_new_table(struct net *net, u32 id) + { + struct mr_table *mrt; ++ int err; + + /* "pimreg%u" should not exceed 16 bytes (IFNAMSIZ) */ + if (id != RT_TABLE_DEFAULT && id >= 1000000000) +@@ -338,7 +339,11 @@ static struct mr_table *ipmr_new_table(struct net *net, u32 id) + write_pnet(&mrt->net, net); + mrt->id = id; + +- rhltable_init(&mrt->mfc_hash, &ipmr_rht_params); ++ err = rhltable_init(&mrt->mfc_hash, &ipmr_rht_params); ++ if (err) { ++ kfree(mrt); ++ return ERR_PTR(err); ++ } + INIT_LIST_HEAD(&mrt->mfc_cache_list); + INIT_LIST_HEAD(&mrt->mfc_unres_queue); + +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 0f2d74885bcb..32fcce711855 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -506,7 +506,8 @@ int ip6_forward(struct sk_buff *skb) + send redirects to source routed frames. + We don't send redirects to frames decapsulated from IPsec. + */ +- if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) { ++ if (IP6CB(skb)->iif == dst->dev->ifindex && ++ opt->srcrt == 0 && !skb_sec_path(skb)) { + struct in6_addr *target = NULL; + struct inet_peer *peer; + struct rt6_info *rt; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 565a0388587a..84ee2eb88121 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1693,8 +1693,13 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu) + if (new_mtu < ETH_MIN_MTU) + return -EINVAL; + } +- if (new_mtu > 0xFFF8 - dev->hard_header_len) +- return -EINVAL; ++ if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) { ++ if (new_mtu > IP6_MAX_MTU - dev->hard_header_len) ++ return -EINVAL; ++ } else { ++ if (new_mtu > IP_MAX_MTU - dev->hard_header_len) ++ return -EINVAL; ++ } + dev->mtu = new_mtu; + return 0; + } +@@ -1842,7 +1847,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev) + if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT)) + dev->mtu -= 8; + dev->min_mtu = ETH_MIN_MTU; +- dev->max_mtu = 0xFFF8 - dev->hard_header_len; ++ dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len; + + return 0; + +diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c +index e1060f28410d..8015e74fd7d9 100644 +--- a/net/ipv6/ip6mr.c ++++ b/net/ipv6/ip6mr.c +@@ -1795,7 +1795,8 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns + ret = 0; + if (!ip6mr_new_table(net, v)) + ret = -ENOMEM; +- raw6_sk(sk)->ip6mr_table = v; ++ else ++ raw6_sk(sk)->ip6mr_table = v; + rtnl_unlock(); + return ret; + } +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index dd28005efb97..d081db125905 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -1568,6 +1568,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) + ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL; + bool ret; + ++ if (netif_is_l3_master(skb->dev)) { ++ dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif); ++ if (!dev) ++ return; ++ } ++ + if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) { + ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n", + dev->name); +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 7d50d889ab6e..375b20d5bbd7 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1250,7 +1250,7 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, + keys->control.addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS; + keys->addrs.v6addrs.src = key_iph->saddr; + keys->addrs.v6addrs.dst = key_iph->daddr; +- keys->tags.flow_label = ip6_flowinfo(key_iph); ++ keys->tags.flow_label = ip6_flowlabel(key_iph); + keys->basic.ip_proto = key_iph->nexthdr; + } + +diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c +index 5fe139484919..bf4763fd68c2 100644 +--- a/net/ipv6/seg6_iptunnel.c ++++ b/net/ipv6/seg6_iptunnel.c +@@ -103,7 +103,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto) + hdrlen = (osrh->hdrlen + 1) << 3; + tot_len = hdrlen + sizeof(*hdr); + +- err = skb_cow_head(skb, tot_len); ++ err = skb_cow_head(skb, tot_len + skb->mac_len); + if (unlikely(err)) + return err; + +@@ -161,7 +161,7 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh) + + hdrlen = (osrh->hdrlen + 1) << 3; + +- err = skb_cow_head(skb, hdrlen); ++ err = skb_cow_head(skb, hdrlen + skb->mac_len); + if (unlikely(err)) + return err; + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index ad1e7e6ce009..5d00a38cd1cb 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -1360,7 +1360,7 @@ static void ipip6_tunnel_setup(struct net_device *dev) + dev->hard_header_len = LL_MAX_HEADER + t_hlen; + dev->mtu = ETH_DATA_LEN - t_hlen; + dev->min_mtu = IPV6_MIN_MTU; +- dev->max_mtu = 0xFFF8 - t_hlen; ++ dev->max_mtu = IP6_MAX_MTU - t_hlen; + dev->flags = IFF_NOARP; + netif_keep_dst(dev); + dev->addr_len = 4; +@@ -1572,7 +1572,8 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev, + if (tb[IFLA_MTU]) { + u32 mtu = nla_get_u32(tb[IFLA_MTU]); + +- if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len) ++ if (mtu >= IPV6_MIN_MTU && ++ mtu <= IP6_MAX_MTU - dev->hard_header_len) + dev->mtu = mtu; + } + +diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c +index 01a4ff3df60b..9bf997404918 100644 +--- a/net/kcm/kcmsock.c ++++ b/net/kcm/kcmsock.c +@@ -1672,7 +1672,7 @@ static struct file *kcm_clone(struct socket *osock) + __module_get(newsock->ops->owner); + + newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL, +- &kcm_proto, true); ++ &kcm_proto, false); + if (!newsk) { + sock_release(newsock); + return ERR_PTR(-ENOMEM); +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 8351faabba62..7806e166669a 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2920,7 +2920,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) + if (unlikely(offset < 0)) + goto out_free; + } else if (reserve) { +- skb_push(skb, reserve); ++ skb_reserve(skb, -reserve); + } + + /* Returns -EFAULT on error */ +@@ -4293,7 +4293,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + goto out; + if (po->tp_version >= TPACKET_V3 && + req->tp_block_size <= +- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) + goto out; + if (unlikely(req->tp_frame_size < po->tp_hdrlen + + po->tp_reserve)) +diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c +index 7a838d1c1c00..1879665e5a2b 100644 +--- a/net/sched/cls_flower.c ++++ b/net/sched/cls_flower.c +@@ -1007,7 +1007,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb, + return 0; + + errout_idr: +- if (fnew->handle) ++ if (!fold) + idr_remove_ext(&head->handle_idr, fnew->handle); + errout: + tcf_exts_destroy(&fnew->exts); +diff --git a/net/sctp/transport.c b/net/sctp/transport.c +index 7ef77fd7b52a..e0c2a4e23039 100644 +--- a/net/sctp/transport.c ++++ b/net/sctp/transport.c +@@ -637,7 +637,7 @@ unsigned long sctp_transport_timeout(struct sctp_transport *trans) + trans->state != SCTP_PF) + timeout += trans->hbinterval; + +- return timeout; ++ return max_t(unsigned long, timeout, HZ / 5); + } + + /* Reset transport variables to their initial values */ +diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c +index 297b079ae4d9..27aac273205b 100644 +--- a/scripts/kconfig/confdata.c ++++ b/scripts/kconfig/confdata.c +@@ -745,7 +745,7 @@ int conf_write(const char *name) + struct menu *menu; + const char *basename; + const char *str; +- char dirname[PATH_MAX+1], tmpname[PATH_MAX+1], newname[PATH_MAX+1]; ++ char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8]; + char *env; + + dirname[0] = 0; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.49-50.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.49-50.patch new file mode 100644 index 000000000000..e5b653e36501 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.49-50.patch @@ -0,0 +1,2447 @@ +diff --git a/Makefile b/Makefile +index 480ae7ef755c..84374c5ba60e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 49 ++SUBLEVEL = 50 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h +index ee23a43386a2..8493303d8b2e 100644 +--- a/arch/x86/include/asm/kvm_emulate.h ++++ b/arch/x86/include/asm/kvm_emulate.h +@@ -107,11 +107,12 @@ struct x86_emulate_ops { + * @addr: [IN ] Linear address from which to read. + * @val: [OUT] Value read from memory, zero-extended to 'u_long'. + * @bytes: [IN ] Number of bytes to read from memory. ++ * @system:[IN ] Whether the access is forced to be at CPL0. + */ + int (*read_std)(struct x86_emulate_ctxt *ctxt, + unsigned long addr, void *val, + unsigned int bytes, +- struct x86_exception *fault); ++ struct x86_exception *fault, bool system); + + /* + * read_phys: Read bytes of standard (non-emulated/special) memory. +@@ -129,10 +130,11 @@ struct x86_emulate_ops { + * @addr: [IN ] Linear address to which to write. + * @val: [OUT] Value write to memory, zero-extended to 'u_long'. + * @bytes: [IN ] Number of bytes to write to memory. ++ * @system:[IN ] Whether the access is forced to be at CPL0. + */ + int (*write_std)(struct x86_emulate_ctxt *ctxt, + unsigned long addr, void *val, unsigned int bytes, +- struct x86_exception *fault); ++ struct x86_exception *fault, bool system); + /* + * fetch: Read bytes of standard (non-emulated/special) memory. + * Used for instruction fetch. +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index fab073b19528..5f758568fc44 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -811,6 +811,19 @@ static inline int jmp_rel(struct x86_emulate_ctxt *ctxt, int rel) + return assign_eip_near(ctxt, ctxt->_eip + rel); + } + ++static int linear_read_system(struct x86_emulate_ctxt *ctxt, ulong linear, ++ void *data, unsigned size) ++{ ++ return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception, true); ++} ++ ++static int linear_write_system(struct x86_emulate_ctxt *ctxt, ++ ulong linear, void *data, ++ unsigned int size) ++{ ++ return ctxt->ops->write_std(ctxt, linear, data, size, &ctxt->exception, true); ++} ++ + static int segmented_read_std(struct x86_emulate_ctxt *ctxt, + struct segmented_address addr, + void *data, +@@ -822,7 +835,7 @@ static int segmented_read_std(struct x86_emulate_ctxt *ctxt, + rc = linearize(ctxt, addr, size, false, &linear); + if (rc != X86EMUL_CONTINUE) + return rc; +- return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception); ++ return ctxt->ops->read_std(ctxt, linear, data, size, &ctxt->exception, false); + } + + static int segmented_write_std(struct x86_emulate_ctxt *ctxt, +@@ -836,7 +849,7 @@ static int segmented_write_std(struct x86_emulate_ctxt *ctxt, + rc = linearize(ctxt, addr, size, true, &linear); + if (rc != X86EMUL_CONTINUE) + return rc; +- return ctxt->ops->write_std(ctxt, linear, data, size, &ctxt->exception); ++ return ctxt->ops->write_std(ctxt, linear, data, size, &ctxt->exception, false); + } + + /* +@@ -1509,8 +1522,7 @@ static int read_interrupt_descriptor(struct x86_emulate_ctxt *ctxt, + return emulate_gp(ctxt, index << 3 | 0x2); + + addr = dt.address + index * 8; +- return ctxt->ops->read_std(ctxt, addr, desc, sizeof *desc, +- &ctxt->exception); ++ return linear_read_system(ctxt, addr, desc, sizeof *desc); + } + + static void get_descriptor_table_ptr(struct x86_emulate_ctxt *ctxt, +@@ -1573,8 +1585,7 @@ static int read_segment_descriptor(struct x86_emulate_ctxt *ctxt, + if (rc != X86EMUL_CONTINUE) + return rc; + +- return ctxt->ops->read_std(ctxt, *desc_addr_p, desc, sizeof(*desc), +- &ctxt->exception); ++ return linear_read_system(ctxt, *desc_addr_p, desc, sizeof(*desc)); + } + + /* allowed just for 8 bytes segments */ +@@ -1588,8 +1599,7 @@ static int write_segment_descriptor(struct x86_emulate_ctxt *ctxt, + if (rc != X86EMUL_CONTINUE) + return rc; + +- return ctxt->ops->write_std(ctxt, addr, desc, sizeof *desc, +- &ctxt->exception); ++ return linear_write_system(ctxt, addr, desc, sizeof *desc); + } + + static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, +@@ -1750,8 +1760,7 @@ static int __load_segment_descriptor(struct x86_emulate_ctxt *ctxt, + return ret; + } + } else if (ctxt->mode == X86EMUL_MODE_PROT64) { +- ret = ctxt->ops->read_std(ctxt, desc_addr+8, &base3, +- sizeof(base3), &ctxt->exception); ++ ret = linear_read_system(ctxt, desc_addr+8, &base3, sizeof(base3)); + if (ret != X86EMUL_CONTINUE) + return ret; + if (emul_is_noncanonical_address(get_desc_base(&seg_desc) | +@@ -2064,11 +2073,11 @@ static int __emulate_int_real(struct x86_emulate_ctxt *ctxt, int irq) + eip_addr = dt.address + (irq << 2); + cs_addr = dt.address + (irq << 2) + 2; + +- rc = ops->read_std(ctxt, cs_addr, &cs, 2, &ctxt->exception); ++ rc = linear_read_system(ctxt, cs_addr, &cs, 2); + if (rc != X86EMUL_CONTINUE) + return rc; + +- rc = ops->read_std(ctxt, eip_addr, &eip, 2, &ctxt->exception); ++ rc = linear_read_system(ctxt, eip_addr, &eip, 2); + if (rc != X86EMUL_CONTINUE) + return rc; + +@@ -2912,12 +2921,12 @@ static bool emulator_io_port_access_allowed(struct x86_emulate_ctxt *ctxt, + #ifdef CONFIG_X86_64 + base |= ((u64)base3) << 32; + #endif +- r = ops->read_std(ctxt, base + 102, &io_bitmap_ptr, 2, NULL); ++ r = ops->read_std(ctxt, base + 102, &io_bitmap_ptr, 2, NULL, true); + if (r != X86EMUL_CONTINUE) + return false; + if (io_bitmap_ptr + port/8 > desc_limit_scaled(&tr_seg)) + return false; +- r = ops->read_std(ctxt, base + io_bitmap_ptr + port/8, &perm, 2, NULL); ++ r = ops->read_std(ctxt, base + io_bitmap_ptr + port/8, &perm, 2, NULL, true); + if (r != X86EMUL_CONTINUE) + return false; + if ((perm >> bit_idx) & mask) +@@ -3046,35 +3055,30 @@ static int task_switch_16(struct x86_emulate_ctxt *ctxt, + u16 tss_selector, u16 old_tss_sel, + ulong old_tss_base, struct desc_struct *new_desc) + { +- const struct x86_emulate_ops *ops = ctxt->ops; + struct tss_segment_16 tss_seg; + int ret; + u32 new_tss_base = get_desc_base(new_desc); + +- ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg, +- &ctxt->exception); ++ ret = linear_read_system(ctxt, old_tss_base, &tss_seg, sizeof tss_seg); + if (ret != X86EMUL_CONTINUE) + return ret; + + save_state_to_tss16(ctxt, &tss_seg); + +- ret = ops->write_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg, +- &ctxt->exception); ++ ret = linear_write_system(ctxt, old_tss_base, &tss_seg, sizeof tss_seg); + if (ret != X86EMUL_CONTINUE) + return ret; + +- ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg, +- &ctxt->exception); ++ ret = linear_read_system(ctxt, new_tss_base, &tss_seg, sizeof tss_seg); + if (ret != X86EMUL_CONTINUE) + return ret; + + if (old_tss_sel != 0xffff) { + tss_seg.prev_task_link = old_tss_sel; + +- ret = ops->write_std(ctxt, new_tss_base, +- &tss_seg.prev_task_link, +- sizeof tss_seg.prev_task_link, +- &ctxt->exception); ++ ret = linear_write_system(ctxt, new_tss_base, ++ &tss_seg.prev_task_link, ++ sizeof tss_seg.prev_task_link); + if (ret != X86EMUL_CONTINUE) + return ret; + } +@@ -3190,38 +3194,34 @@ static int task_switch_32(struct x86_emulate_ctxt *ctxt, + u16 tss_selector, u16 old_tss_sel, + ulong old_tss_base, struct desc_struct *new_desc) + { +- const struct x86_emulate_ops *ops = ctxt->ops; + struct tss_segment_32 tss_seg; + int ret; + u32 new_tss_base = get_desc_base(new_desc); + u32 eip_offset = offsetof(struct tss_segment_32, eip); + u32 ldt_sel_offset = offsetof(struct tss_segment_32, ldt_selector); + +- ret = ops->read_std(ctxt, old_tss_base, &tss_seg, sizeof tss_seg, +- &ctxt->exception); ++ ret = linear_read_system(ctxt, old_tss_base, &tss_seg, sizeof tss_seg); + if (ret != X86EMUL_CONTINUE) + return ret; + + save_state_to_tss32(ctxt, &tss_seg); + + /* Only GP registers and segment selectors are saved */ +- ret = ops->write_std(ctxt, old_tss_base + eip_offset, &tss_seg.eip, +- ldt_sel_offset - eip_offset, &ctxt->exception); ++ ret = linear_write_system(ctxt, old_tss_base + eip_offset, &tss_seg.eip, ++ ldt_sel_offset - eip_offset); + if (ret != X86EMUL_CONTINUE) + return ret; + +- ret = ops->read_std(ctxt, new_tss_base, &tss_seg, sizeof tss_seg, +- &ctxt->exception); ++ ret = linear_read_system(ctxt, new_tss_base, &tss_seg, sizeof tss_seg); + if (ret != X86EMUL_CONTINUE) + return ret; + + if (old_tss_sel != 0xffff) { + tss_seg.prev_task_link = old_tss_sel; + +- ret = ops->write_std(ctxt, new_tss_base, +- &tss_seg.prev_task_link, +- sizeof tss_seg.prev_task_link, +- &ctxt->exception); ++ ret = linear_write_system(ctxt, new_tss_base, ++ &tss_seg.prev_task_link, ++ sizeof tss_seg.prev_task_link); + if (ret != X86EMUL_CONTINUE) + return ret; + } +@@ -4152,7 +4152,9 @@ static int check_cr_write(struct x86_emulate_ctxt *ctxt) + maxphyaddr = eax & 0xff; + else + maxphyaddr = 36; +- rsvd = rsvd_bits(maxphyaddr, 62); ++ rsvd = rsvd_bits(maxphyaddr, 63); ++ if (ctxt->ops->get_cr(ctxt, 4) & X86_CR4_PCIDE) ++ rsvd &= ~CR3_PCID_INVD; + } + + if (new_val & rsvd) +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 4c88572d2b81..b1556166a06d 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7317,8 +7317,7 @@ static int nested_vmx_get_vmptr(struct kvm_vcpu *vcpu, gpa_t *vmpointer) + vmcs_read32(VMX_INSTRUCTION_INFO), false, &gva)) + return 1; + +- if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, vmpointer, +- sizeof(*vmpointer), &e)) { ++ if (kvm_read_guest_virt(vcpu, gva, vmpointer, sizeof(*vmpointer), &e)) { + kvm_inject_page_fault(vcpu, &e); + return 1; + } +@@ -7399,6 +7398,12 @@ static int handle_vmon(struct kvm_vcpu *vcpu) + return 1; + } + ++ /* CPL=0 must be checked manually. */ ++ if (vmx_get_cpl(vcpu)) { ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 1; ++ } ++ + if (vmx->nested.vmxon) { + nested_vmx_failValid(vcpu, VMXERR_VMXON_IN_VMX_ROOT_OPERATION); + return kvm_skip_emulated_instruction(vcpu); +@@ -7458,6 +7463,11 @@ static int handle_vmon(struct kvm_vcpu *vcpu) + */ + static int nested_vmx_check_permission(struct kvm_vcpu *vcpu) + { ++ if (vmx_get_cpl(vcpu)) { ++ kvm_queue_exception(vcpu, UD_VECTOR); ++ return 0; ++ } ++ + if (!to_vmx(vcpu)->nested.vmxon) { + kvm_queue_exception(vcpu, UD_VECTOR); + return 0; +@@ -7790,9 +7800,9 @@ static int handle_vmread(struct kvm_vcpu *vcpu) + if (get_vmx_mem_address(vcpu, exit_qualification, + vmx_instruction_info, true, &gva)) + return 1; +- /* _system ok, as hardware has verified cpl=0 */ +- kvm_write_guest_virt_system(&vcpu->arch.emulate_ctxt, gva, +- &field_value, (is_long_mode(vcpu) ? 8 : 4), NULL); ++ /* _system ok, nested_vmx_check_permission has verified cpl=0 */ ++ kvm_write_guest_virt_system(vcpu, gva, &field_value, ++ (is_long_mode(vcpu) ? 8 : 4), NULL); + } + + nested_vmx_succeed(vcpu); +@@ -7828,8 +7838,8 @@ static int handle_vmwrite(struct kvm_vcpu *vcpu) + if (get_vmx_mem_address(vcpu, exit_qualification, + vmx_instruction_info, false, &gva)) + return 1; +- if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, +- &field_value, (is_64_bit_mode(vcpu) ? 8 : 4), &e)) { ++ if (kvm_read_guest_virt(vcpu, gva, &field_value, ++ (is_64_bit_mode(vcpu) ? 8 : 4), &e)) { + kvm_inject_page_fault(vcpu, &e); + return 1; + } +@@ -7933,10 +7943,10 @@ static int handle_vmptrst(struct kvm_vcpu *vcpu) + if (get_vmx_mem_address(vcpu, exit_qualification, + vmx_instruction_info, true, &vmcs_gva)) + return 1; +- /* ok to use *_system, as hardware has verified cpl=0 */ +- if (kvm_write_guest_virt_system(&vcpu->arch.emulate_ctxt, vmcs_gva, +- (void *)&to_vmx(vcpu)->nested.current_vmptr, +- sizeof(u64), &e)) { ++ /* *_system ok, nested_vmx_check_permission has verified cpl=0 */ ++ if (kvm_write_guest_virt_system(vcpu, vmcs_gva, ++ (void *)&to_vmx(vcpu)->nested.current_vmptr, ++ sizeof(u64), &e)) { + kvm_inject_page_fault(vcpu, &e); + return 1; + } +@@ -7983,8 +7993,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) + if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION), + vmx_instruction_info, false, &gva)) + return 1; +- if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, &operand, +- sizeof(operand), &e)) { ++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) { + kvm_inject_page_fault(vcpu, &e); + return 1; + } +@@ -8048,8 +8057,7 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) + if (get_vmx_mem_address(vcpu, vmcs_readl(EXIT_QUALIFICATION), + vmx_instruction_info, false, &gva)) + return 1; +- if (kvm_read_guest_virt(&vcpu->arch.emulate_ctxt, gva, &operand, +- sizeof(operand), &e)) { ++ if (kvm_read_guest_virt(vcpu, gva, &operand, sizeof(operand), &e)) { + kvm_inject_page_fault(vcpu, &e); + return 1; + } +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index adac01d0181a..b62328cd4cb0 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -836,7 +836,7 @@ int kvm_set_cr3(struct kvm_vcpu *vcpu, unsigned long cr3) + } + + if (is_long_mode(vcpu) && +- (cr3 & rsvd_bits(cpuid_maxphyaddr(vcpu), 62))) ++ (cr3 & rsvd_bits(cpuid_maxphyaddr(vcpu), 63))) + return 1; + else if (is_pae(vcpu) && is_paging(vcpu) && + !load_pdptrs(vcpu, vcpu->arch.walk_mmu, cr3)) +@@ -4492,11 +4492,10 @@ static int kvm_fetch_guest_virt(struct x86_emulate_ctxt *ctxt, + return X86EMUL_CONTINUE; + } + +-int kvm_read_guest_virt(struct x86_emulate_ctxt *ctxt, ++int kvm_read_guest_virt(struct kvm_vcpu *vcpu, + gva_t addr, void *val, unsigned int bytes, + struct x86_exception *exception) + { +- struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt); + u32 access = (kvm_x86_ops->get_cpl(vcpu) == 3) ? PFERR_USER_MASK : 0; + + return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, +@@ -4504,12 +4503,17 @@ int kvm_read_guest_virt(struct x86_emulate_ctxt *ctxt, + } + EXPORT_SYMBOL_GPL(kvm_read_guest_virt); + +-static int kvm_read_guest_virt_system(struct x86_emulate_ctxt *ctxt, +- gva_t addr, void *val, unsigned int bytes, +- struct x86_exception *exception) ++static int emulator_read_std(struct x86_emulate_ctxt *ctxt, ++ gva_t addr, void *val, unsigned int bytes, ++ struct x86_exception *exception, bool system) + { + struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt); +- return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, 0, exception); ++ u32 access = 0; ++ ++ if (!system && kvm_x86_ops->get_cpl(vcpu) == 3) ++ access |= PFERR_USER_MASK; ++ ++ return kvm_read_guest_virt_helper(addr, val, bytes, vcpu, access, exception); + } + + static int kvm_read_guest_phys_system(struct x86_emulate_ctxt *ctxt, +@@ -4521,18 +4525,16 @@ static int kvm_read_guest_phys_system(struct x86_emulate_ctxt *ctxt, + return r < 0 ? X86EMUL_IO_NEEDED : X86EMUL_CONTINUE; + } + +-int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, +- gva_t addr, void *val, +- unsigned int bytes, +- struct x86_exception *exception) ++static int kvm_write_guest_virt_helper(gva_t addr, void *val, unsigned int bytes, ++ struct kvm_vcpu *vcpu, u32 access, ++ struct x86_exception *exception) + { +- struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt); + void *data = val; + int r = X86EMUL_CONTINUE; + + while (bytes) { + gpa_t gpa = vcpu->arch.walk_mmu->gva_to_gpa(vcpu, addr, +- PFERR_WRITE_MASK, ++ access, + exception); + unsigned offset = addr & (PAGE_SIZE-1); + unsigned towrite = min(bytes, (unsigned)PAGE_SIZE - offset); +@@ -4553,6 +4555,27 @@ int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, + out: + return r; + } ++ ++static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *val, ++ unsigned int bytes, struct x86_exception *exception, ++ bool system) ++{ ++ struct kvm_vcpu *vcpu = emul_to_vcpu(ctxt); ++ u32 access = PFERR_WRITE_MASK; ++ ++ if (!system && kvm_x86_ops->get_cpl(vcpu) == 3) ++ access |= PFERR_USER_MASK; ++ ++ return kvm_write_guest_virt_helper(addr, val, bytes, vcpu, ++ access, exception); ++} ++ ++int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val, ++ unsigned int bytes, struct x86_exception *exception) ++{ ++ return kvm_write_guest_virt_helper(addr, val, bytes, vcpu, ++ PFERR_WRITE_MASK, exception); ++} + EXPORT_SYMBOL_GPL(kvm_write_guest_virt_system); + + static int vcpu_is_mmio_gpa(struct kvm_vcpu *vcpu, unsigned long gva, +@@ -5287,8 +5310,8 @@ static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_fla + static const struct x86_emulate_ops emulate_ops = { + .read_gpr = emulator_read_gpr, + .write_gpr = emulator_write_gpr, +- .read_std = kvm_read_guest_virt_system, +- .write_std = kvm_write_guest_virt_system, ++ .read_std = emulator_read_std, ++ .write_std = emulator_write_std, + .read_phys = kvm_read_guest_phys_system, + .fetch = kvm_fetch_guest_virt, + .read_emulated = emulator_read_emulated, +diff --git a/arch/x86/kvm/x86.h b/arch/x86/kvm/x86.h +index 6d112d8f799c..d4b59cf0dc51 100644 +--- a/arch/x86/kvm/x86.h ++++ b/arch/x86/kvm/x86.h +@@ -213,11 +213,11 @@ int kvm_inject_realmode_interrupt(struct kvm_vcpu *vcpu, int irq, int inc_eip); + void kvm_write_tsc(struct kvm_vcpu *vcpu, struct msr_data *msr); + u64 get_kvmclock_ns(struct kvm *kvm); + +-int kvm_read_guest_virt(struct x86_emulate_ctxt *ctxt, ++int kvm_read_guest_virt(struct kvm_vcpu *vcpu, + gva_t addr, void *val, unsigned int bytes, + struct x86_exception *exception); + +-int kvm_write_guest_virt_system(struct x86_emulate_ctxt *ctxt, ++int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, + gva_t addr, void *val, unsigned int bytes, + struct x86_exception *exception); + +diff --git a/block/blk-zoned.c b/block/blk-zoned.c +index ff57fb51b338..77fce6f09f78 100644 +--- a/block/blk-zoned.c ++++ b/block/blk-zoned.c +@@ -286,7 +286,11 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode, + if (!rep.nr_zones) + return -EINVAL; + +- zones = kcalloc(rep.nr_zones, sizeof(struct blk_zone), GFP_KERNEL); ++ if (rep.nr_zones > INT_MAX / sizeof(struct blk_zone)) ++ return -ERANGE; ++ ++ zones = kvmalloc(rep.nr_zones * sizeof(struct blk_zone), ++ GFP_KERNEL | __GFP_ZERO); + if (!zones) + return -ENOMEM; + +@@ -308,7 +312,7 @@ int blkdev_report_zones_ioctl(struct block_device *bdev, fmode_t mode, + } + + out: +- kfree(zones); ++ kvfree(zones); + + return ret; + } +diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c +index 54f3b375a453..a8a2a271b63d 100644 +--- a/drivers/crypto/caam/caamalg.c ++++ b/drivers/crypto/caam/caamalg.c +@@ -735,15 +735,18 @@ struct aead_edesc { + * @src_nents: number of segments in input s/w scatterlist + * @dst_nents: number of segments in output s/w scatterlist + * @iv_dma: dma address of iv for checking continuity and link table ++ * @iv_dir: DMA mapping direction for IV + * @sec4_sg_bytes: length of dma mapped sec4_sg space + * @sec4_sg_dma: bus physical mapped address of h/w link table + * @sec4_sg: pointer to h/w link table + * @hw_desc: the h/w job descriptor followed by any referenced link tables ++ * and IV + */ + struct ablkcipher_edesc { + int src_nents; + int dst_nents; + dma_addr_t iv_dma; ++ enum dma_data_direction iv_dir; + int sec4_sg_bytes; + dma_addr_t sec4_sg_dma; + struct sec4_sg_entry *sec4_sg; +@@ -753,7 +756,8 @@ struct ablkcipher_edesc { + static void caam_unmap(struct device *dev, struct scatterlist *src, + struct scatterlist *dst, int src_nents, + int dst_nents, +- dma_addr_t iv_dma, int ivsize, dma_addr_t sec4_sg_dma, ++ dma_addr_t iv_dma, int ivsize, ++ enum dma_data_direction iv_dir, dma_addr_t sec4_sg_dma, + int sec4_sg_bytes) + { + if (dst != src) { +@@ -765,7 +769,7 @@ static void caam_unmap(struct device *dev, struct scatterlist *src, + } + + if (iv_dma) +- dma_unmap_single(dev, iv_dma, ivsize, DMA_TO_DEVICE); ++ dma_unmap_single(dev, iv_dma, ivsize, iv_dir); + if (sec4_sg_bytes) + dma_unmap_single(dev, sec4_sg_dma, sec4_sg_bytes, + DMA_TO_DEVICE); +@@ -776,7 +780,7 @@ static void aead_unmap(struct device *dev, + struct aead_request *req) + { + caam_unmap(dev, req->src, req->dst, +- edesc->src_nents, edesc->dst_nents, 0, 0, ++ edesc->src_nents, edesc->dst_nents, 0, 0, DMA_NONE, + edesc->sec4_sg_dma, edesc->sec4_sg_bytes); + } + +@@ -789,7 +793,7 @@ static void ablkcipher_unmap(struct device *dev, + + caam_unmap(dev, req->src, req->dst, + edesc->src_nents, edesc->dst_nents, +- edesc->iv_dma, ivsize, ++ edesc->iv_dma, ivsize, edesc->iv_dir, + edesc->sec4_sg_dma, edesc->sec4_sg_bytes); + } + +@@ -878,6 +882,18 @@ static void ablkcipher_encrypt_done(struct device *jrdev, u32 *desc, u32 err, + scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize, + ivsize, 0); + ++ /* In case initial IV was generated, copy it in GIVCIPHER request */ ++ if (edesc->iv_dir == DMA_FROM_DEVICE) { ++ u8 *iv; ++ struct skcipher_givcrypt_request *greq; ++ ++ greq = container_of(req, struct skcipher_givcrypt_request, ++ creq); ++ iv = (u8 *)edesc->hw_desc + desc_bytes(edesc->hw_desc) + ++ edesc->sec4_sg_bytes; ++ memcpy(greq->giv, iv, ivsize); ++ } ++ + kfree(edesc); + + ablkcipher_request_complete(req, err); +@@ -888,10 +904,10 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err, + { + struct ablkcipher_request *req = context; + struct ablkcipher_edesc *edesc; ++#ifdef DEBUG + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + +-#ifdef DEBUG + dev_err(jrdev, "%s %d: err 0x%x\n", __func__, __LINE__, err); + #endif + +@@ -909,14 +925,6 @@ static void ablkcipher_decrypt_done(struct device *jrdev, u32 *desc, u32 err, + edesc->dst_nents > 1 ? 100 : req->nbytes, 1); + + ablkcipher_unmap(jrdev, edesc, req); +- +- /* +- * The crypto API expects us to set the IV (req->info) to the last +- * ciphertext block. +- */ +- scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize, +- ivsize, 0); +- + kfree(edesc); + + ablkcipher_request_complete(req, err); +@@ -1057,15 +1065,14 @@ static void init_authenc_job(struct aead_request *req, + */ + static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr, + struct ablkcipher_edesc *edesc, +- struct ablkcipher_request *req, +- bool iv_contig) ++ struct ablkcipher_request *req) + { + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + u32 *desc = edesc->hw_desc; +- u32 out_options = 0, in_options; +- dma_addr_t dst_dma, src_dma; +- int len, sec4_sg_index = 0; ++ u32 out_options = 0; ++ dma_addr_t dst_dma; ++ int len; + + #ifdef DEBUG + print_hex_dump(KERN_ERR, "presciv@"__stringify(__LINE__)": ", +@@ -1081,30 +1088,18 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr, + len = desc_len(sh_desc); + init_job_desc_shared(desc, ptr, len, HDR_SHARE_DEFER | HDR_REVERSE); + +- if (iv_contig) { +- src_dma = edesc->iv_dma; +- in_options = 0; +- } else { +- src_dma = edesc->sec4_sg_dma; +- sec4_sg_index += edesc->src_nents + 1; +- in_options = LDST_SGF; +- } +- append_seq_in_ptr(desc, src_dma, req->nbytes + ivsize, in_options); ++ append_seq_in_ptr(desc, edesc->sec4_sg_dma, req->nbytes + ivsize, ++ LDST_SGF); + + if (likely(req->src == req->dst)) { +- if (edesc->src_nents == 1 && iv_contig) { +- dst_dma = sg_dma_address(req->src); +- } else { +- dst_dma = edesc->sec4_sg_dma + +- sizeof(struct sec4_sg_entry); +- out_options = LDST_SGF; +- } ++ dst_dma = edesc->sec4_sg_dma + sizeof(struct sec4_sg_entry); ++ out_options = LDST_SGF; + } else { + if (edesc->dst_nents == 1) { + dst_dma = sg_dma_address(req->dst); + } else { +- dst_dma = edesc->sec4_sg_dma + +- sec4_sg_index * sizeof(struct sec4_sg_entry); ++ dst_dma = edesc->sec4_sg_dma + (edesc->src_nents + 1) * ++ sizeof(struct sec4_sg_entry); + out_options = LDST_SGF; + } + } +@@ -1116,13 +1111,12 @@ static void init_ablkcipher_job(u32 *sh_desc, dma_addr_t ptr, + */ + static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr, + struct ablkcipher_edesc *edesc, +- struct ablkcipher_request *req, +- bool iv_contig) ++ struct ablkcipher_request *req) + { + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + u32 *desc = edesc->hw_desc; +- u32 out_options, in_options; ++ u32 in_options; + dma_addr_t dst_dma, src_dma; + int len, sec4_sg_index = 0; + +@@ -1148,15 +1142,9 @@ static void init_ablkcipher_giv_job(u32 *sh_desc, dma_addr_t ptr, + } + append_seq_in_ptr(desc, src_dma, req->nbytes, in_options); + +- if (iv_contig) { +- dst_dma = edesc->iv_dma; +- out_options = 0; +- } else { +- dst_dma = edesc->sec4_sg_dma + +- sec4_sg_index * sizeof(struct sec4_sg_entry); +- out_options = LDST_SGF; +- } +- append_seq_out_ptr(desc, dst_dma, req->nbytes + ivsize, out_options); ++ dst_dma = edesc->sec4_sg_dma + sec4_sg_index * ++ sizeof(struct sec4_sg_entry); ++ append_seq_out_ptr(desc, dst_dma, req->nbytes + ivsize, LDST_SGF); + } + + /* +@@ -1245,7 +1233,7 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req, + GFP_DMA | flags); + if (!edesc) { + caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, +- 0, 0, 0); ++ 0, DMA_NONE, 0, 0); + return ERR_PTR(-ENOMEM); + } + +@@ -1449,8 +1437,7 @@ static int aead_decrypt(struct aead_request *req) + * allocate and map the ablkcipher extended descriptor for ablkcipher + */ + static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request +- *req, int desc_bytes, +- bool *iv_contig_out) ++ *req, int desc_bytes) + { + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); +@@ -1459,8 +1446,8 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + GFP_KERNEL : GFP_ATOMIC; + int src_nents, mapped_src_nents, dst_nents = 0, mapped_dst_nents = 0; + struct ablkcipher_edesc *edesc; +- dma_addr_t iv_dma = 0; +- bool in_contig; ++ dma_addr_t iv_dma; ++ u8 *iv; + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + int dst_sg_idx, sec4_sg_ents, sec4_sg_bytes; + +@@ -1504,33 +1491,20 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + } + } + +- iv_dma = dma_map_single(jrdev, req->info, ivsize, DMA_TO_DEVICE); +- if (dma_mapping_error(jrdev, iv_dma)) { +- dev_err(jrdev, "unable to map IV\n"); +- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, +- 0, 0, 0); +- return ERR_PTR(-ENOMEM); +- } +- +- if (mapped_src_nents == 1 && +- iv_dma + ivsize == sg_dma_address(req->src)) { +- in_contig = true; +- sec4_sg_ents = 0; +- } else { +- in_contig = false; +- sec4_sg_ents = 1 + mapped_src_nents; +- } ++ sec4_sg_ents = 1 + mapped_src_nents; + dst_sg_idx = sec4_sg_ents; + sec4_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0; + sec4_sg_bytes = sec4_sg_ents * sizeof(struct sec4_sg_entry); + +- /* allocate space for base edesc and hw desc commands, link tables */ +- edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes, ++ /* ++ * allocate space for base edesc and hw desc commands, link tables, IV ++ */ ++ edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes + ivsize, + GFP_DMA | flags); + if (!edesc) { + dev_err(jrdev, "could not allocate extended descriptor\n"); +- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, 0, 0); ++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, DMA_NONE, 0, 0); + return ERR_PTR(-ENOMEM); + } + +@@ -1539,13 +1513,24 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + edesc->sec4_sg_bytes = sec4_sg_bytes; + edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) + + desc_bytes; ++ edesc->iv_dir = DMA_TO_DEVICE; + +- if (!in_contig) { +- dma_to_sec4_sg_one(edesc->sec4_sg, iv_dma, ivsize, 0); +- sg_to_sec4_sg_last(req->src, mapped_src_nents, +- edesc->sec4_sg + 1, 0); ++ /* Make sure IV is located in a DMAable area */ ++ iv = (u8 *)edesc->hw_desc + desc_bytes + sec4_sg_bytes; ++ memcpy(iv, req->info, ivsize); ++ ++ iv_dma = dma_map_single(jrdev, iv, ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(jrdev, iv_dma)) { ++ dev_err(jrdev, "unable to map IV\n"); ++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, DMA_NONE, 0, 0); ++ kfree(edesc); ++ return ERR_PTR(-ENOMEM); + } + ++ dma_to_sec4_sg_one(edesc->sec4_sg, iv_dma, ivsize, 0); ++ sg_to_sec4_sg_last(req->src, mapped_src_nents, edesc->sec4_sg + 1, 0); ++ + if (mapped_dst_nents > 1) { + sg_to_sec4_sg_last(req->dst, mapped_dst_nents, + edesc->sec4_sg + dst_sg_idx, 0); +@@ -1556,7 +1541,7 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + if (dma_mapping_error(jrdev, edesc->sec4_sg_dma)) { + dev_err(jrdev, "unable to map S/G table\n"); + caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, 0, 0); ++ iv_dma, ivsize, DMA_TO_DEVICE, 0, 0); + kfree(edesc); + return ERR_PTR(-ENOMEM); + } +@@ -1569,7 +1554,6 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + sec4_sg_bytes, 1); + #endif + +- *iv_contig_out = in_contig; + return edesc; + } + +@@ -1579,19 +1563,16 @@ static int ablkcipher_encrypt(struct ablkcipher_request *req) + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); + struct device *jrdev = ctx->jrdev; +- bool iv_contig; + u32 *desc; + int ret = 0; + + /* allocate extended descriptor */ +- edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * +- CAAM_CMD_SZ, &iv_contig); ++ edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * CAAM_CMD_SZ); + if (IS_ERR(edesc)) + return PTR_ERR(edesc); + + /* Create and submit job descriptor*/ +- init_ablkcipher_job(ctx->sh_desc_enc, +- ctx->sh_desc_enc_dma, edesc, req, iv_contig); ++ init_ablkcipher_job(ctx->sh_desc_enc, ctx->sh_desc_enc_dma, edesc, req); + #ifdef DEBUG + print_hex_dump(KERN_ERR, "ablkcipher jobdesc@"__stringify(__LINE__)": ", + DUMP_PREFIX_ADDRESS, 16, 4, edesc->hw_desc, +@@ -1615,20 +1596,25 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req) + struct ablkcipher_edesc *edesc; + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); ++ int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + struct device *jrdev = ctx->jrdev; +- bool iv_contig; + u32 *desc; + int ret = 0; + + /* allocate extended descriptor */ +- edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * +- CAAM_CMD_SZ, &iv_contig); ++ edesc = ablkcipher_edesc_alloc(req, DESC_JOB_IO_LEN * CAAM_CMD_SZ); + if (IS_ERR(edesc)) + return PTR_ERR(edesc); + ++ /* ++ * The crypto API expects us to set the IV (req->info) to the last ++ * ciphertext block. ++ */ ++ scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ivsize, ++ ivsize, 0); ++ + /* Create and submit job descriptor*/ +- init_ablkcipher_job(ctx->sh_desc_dec, +- ctx->sh_desc_dec_dma, edesc, req, iv_contig); ++ init_ablkcipher_job(ctx->sh_desc_dec, ctx->sh_desc_dec_dma, edesc, req); + desc = edesc->hw_desc; + #ifdef DEBUG + print_hex_dump(KERN_ERR, "ablkcipher jobdesc@"__stringify(__LINE__)": ", +@@ -1653,8 +1639,7 @@ static int ablkcipher_decrypt(struct ablkcipher_request *req) + */ + static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + struct skcipher_givcrypt_request *greq, +- int desc_bytes, +- bool *iv_contig_out) ++ int desc_bytes) + { + struct ablkcipher_request *req = &greq->creq; + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); +@@ -1664,8 +1649,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + GFP_KERNEL : GFP_ATOMIC; + int src_nents, mapped_src_nents, dst_nents, mapped_dst_nents; + struct ablkcipher_edesc *edesc; +- dma_addr_t iv_dma = 0; +- bool out_contig; ++ dma_addr_t iv_dma; ++ u8 *iv; + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + int dst_sg_idx, sec4_sg_ents, sec4_sg_bytes; + +@@ -1710,36 +1695,20 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + } + } + +- /* +- * Check if iv can be contiguous with source and destination. +- * If so, include it. If not, create scatterlist. +- */ +- iv_dma = dma_map_single(jrdev, greq->giv, ivsize, DMA_TO_DEVICE); +- if (dma_mapping_error(jrdev, iv_dma)) { +- dev_err(jrdev, "unable to map IV\n"); +- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, +- 0, 0, 0); +- return ERR_PTR(-ENOMEM); +- } +- + sec4_sg_ents = mapped_src_nents > 1 ? mapped_src_nents : 0; + dst_sg_idx = sec4_sg_ents; +- if (mapped_dst_nents == 1 && +- iv_dma + ivsize == sg_dma_address(req->dst)) { +- out_contig = true; +- } else { +- out_contig = false; +- sec4_sg_ents += 1 + mapped_dst_nents; +- } ++ sec4_sg_ents += 1 + mapped_dst_nents; + +- /* allocate space for base edesc and hw desc commands, link tables */ ++ /* ++ * allocate space for base edesc and hw desc commands, link tables, IV ++ */ + sec4_sg_bytes = sec4_sg_ents * sizeof(struct sec4_sg_entry); +- edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes, ++ edesc = kzalloc(sizeof(*edesc) + desc_bytes + sec4_sg_bytes + ivsize, + GFP_DMA | flags); + if (!edesc) { + dev_err(jrdev, "could not allocate extended descriptor\n"); +- caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, 0, 0); ++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, DMA_NONE, 0, 0); + return ERR_PTR(-ENOMEM); + } + +@@ -1748,24 +1717,33 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + edesc->sec4_sg_bytes = sec4_sg_bytes; + edesc->sec4_sg = (void *)edesc + sizeof(struct ablkcipher_edesc) + + desc_bytes; ++ edesc->iv_dir = DMA_FROM_DEVICE; ++ ++ /* Make sure IV is located in a DMAable area */ ++ iv = (u8 *)edesc->hw_desc + desc_bytes + sec4_sg_bytes; ++ iv_dma = dma_map_single(jrdev, iv, ivsize, DMA_FROM_DEVICE); ++ if (dma_mapping_error(jrdev, iv_dma)) { ++ dev_err(jrdev, "unable to map IV\n"); ++ caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, DMA_NONE, 0, 0); ++ kfree(edesc); ++ return ERR_PTR(-ENOMEM); ++ } + + if (mapped_src_nents > 1) + sg_to_sec4_sg_last(req->src, mapped_src_nents, edesc->sec4_sg, + 0); + +- if (!out_contig) { +- dma_to_sec4_sg_one(edesc->sec4_sg + dst_sg_idx, +- iv_dma, ivsize, 0); +- sg_to_sec4_sg_last(req->dst, mapped_dst_nents, +- edesc->sec4_sg + dst_sg_idx + 1, 0); +- } ++ dma_to_sec4_sg_one(edesc->sec4_sg + dst_sg_idx, iv_dma, ivsize, 0); ++ sg_to_sec4_sg_last(req->dst, mapped_dst_nents, edesc->sec4_sg + ++ dst_sg_idx + 1, 0); + + edesc->sec4_sg_dma = dma_map_single(jrdev, edesc->sec4_sg, + sec4_sg_bytes, DMA_TO_DEVICE); + if (dma_mapping_error(jrdev, edesc->sec4_sg_dma)) { + dev_err(jrdev, "unable to map S/G table\n"); + caam_unmap(jrdev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, 0, 0); ++ iv_dma, ivsize, DMA_FROM_DEVICE, 0, 0); + kfree(edesc); + return ERR_PTR(-ENOMEM); + } +@@ -1778,7 +1756,6 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + sec4_sg_bytes, 1); + #endif + +- *iv_contig_out = out_contig; + return edesc; + } + +@@ -1789,19 +1766,17 @@ static int ablkcipher_givencrypt(struct skcipher_givcrypt_request *creq) + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); + struct device *jrdev = ctx->jrdev; +- bool iv_contig = false; + u32 *desc; + int ret = 0; + + /* allocate extended descriptor */ +- edesc = ablkcipher_giv_edesc_alloc(creq, DESC_JOB_IO_LEN * +- CAAM_CMD_SZ, &iv_contig); ++ edesc = ablkcipher_giv_edesc_alloc(creq, DESC_JOB_IO_LEN * CAAM_CMD_SZ); + if (IS_ERR(edesc)) + return PTR_ERR(edesc); + + /* Create and submit job descriptor*/ + init_ablkcipher_giv_job(ctx->sh_desc_givenc, ctx->sh_desc_givenc_dma, +- edesc, req, iv_contig); ++ edesc, req); + #ifdef DEBUG + print_hex_dump(KERN_ERR, + "ablkcipher jobdesc@" __stringify(__LINE__) ": ", +diff --git a/drivers/crypto/caam/caamalg_qi.c b/drivers/crypto/caam/caamalg_qi.c +index b648e31673f9..e7966e37a5aa 100644 +--- a/drivers/crypto/caam/caamalg_qi.c ++++ b/drivers/crypto/caam/caamalg_qi.c +@@ -401,7 +401,7 @@ static int xts_ablkcipher_setkey(struct crypto_ablkcipher *ablkcipher, + * @assoclen: associated data length, in CAAM endianness + * @assoclen_dma: bus physical mapped address of req->assoclen + * @drv_req: driver-specific request structure +- * @sgt: the h/w link table ++ * @sgt: the h/w link table, followed by IV + */ + struct aead_edesc { + int src_nents; +@@ -412,9 +412,6 @@ struct aead_edesc { + unsigned int assoclen; + dma_addr_t assoclen_dma; + struct caam_drv_req drv_req; +-#define CAAM_QI_MAX_AEAD_SG \ +- ((CAAM_QI_MEMCACHE_SIZE - offsetof(struct aead_edesc, sgt)) / \ +- sizeof(struct qm_sg_entry)) + struct qm_sg_entry sgt[0]; + }; + +@@ -426,7 +423,7 @@ struct aead_edesc { + * @qm_sg_bytes: length of dma mapped h/w link table + * @qm_sg_dma: bus physical mapped address of h/w link table + * @drv_req: driver-specific request structure +- * @sgt: the h/w link table ++ * @sgt: the h/w link table, followed by IV + */ + struct ablkcipher_edesc { + int src_nents; +@@ -435,9 +432,6 @@ struct ablkcipher_edesc { + int qm_sg_bytes; + dma_addr_t qm_sg_dma; + struct caam_drv_req drv_req; +-#define CAAM_QI_MAX_ABLKCIPHER_SG \ +- ((CAAM_QI_MEMCACHE_SIZE - offsetof(struct ablkcipher_edesc, sgt)) / \ +- sizeof(struct qm_sg_entry)) + struct qm_sg_entry sgt[0]; + }; + +@@ -649,17 +643,8 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req, + } + } + +- if ((alg->caam.rfc3686 && encrypt) || !alg->caam.geniv) { ++ if ((alg->caam.rfc3686 && encrypt) || !alg->caam.geniv) + ivsize = crypto_aead_ivsize(aead); +- iv_dma = dma_map_single(qidev, req->iv, ivsize, DMA_TO_DEVICE); +- if (dma_mapping_error(qidev, iv_dma)) { +- dev_err(qidev, "unable to map IV\n"); +- caam_unmap(qidev, req->src, req->dst, src_nents, +- dst_nents, 0, 0, op_type, 0, 0); +- qi_cache_free(edesc); +- return ERR_PTR(-ENOMEM); +- } +- } + + /* + * Create S/G table: req->assoclen, [IV,] req->src [, req->dst]. +@@ -667,16 +652,33 @@ static struct aead_edesc *aead_edesc_alloc(struct aead_request *req, + */ + qm_sg_ents = 1 + !!ivsize + mapped_src_nents + + (mapped_dst_nents > 1 ? mapped_dst_nents : 0); +- if (unlikely(qm_sg_ents > CAAM_QI_MAX_AEAD_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", +- qm_sg_ents, CAAM_QI_MAX_AEAD_SG); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, op_type, 0, 0); ++ sg_table = &edesc->sgt[0]; ++ qm_sg_bytes = qm_sg_ents * sizeof(*sg_table); ++ if (unlikely(offsetof(struct aead_edesc, sgt) + qm_sg_bytes + ivsize > ++ CAAM_QI_MEMCACHE_SIZE)) { ++ dev_err(qidev, "No space for %d S/G entries and/or %dB IV\n", ++ qm_sg_ents, ivsize); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); + qi_cache_free(edesc); + return ERR_PTR(-ENOMEM); + } +- sg_table = &edesc->sgt[0]; +- qm_sg_bytes = qm_sg_ents * sizeof(*sg_table); ++ ++ if (ivsize) { ++ u8 *iv = (u8 *)(sg_table + qm_sg_ents); ++ ++ /* Make sure IV is located in a DMAable area */ ++ memcpy(iv, req->iv, ivsize); ++ ++ iv_dma = dma_map_single(qidev, iv, ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(qidev, iv_dma)) { ++ dev_err(qidev, "unable to map IV\n"); ++ caam_unmap(qidev, req->src, req->dst, src_nents, ++ dst_nents, 0, 0, 0, 0, 0); ++ qi_cache_free(edesc); ++ return ERR_PTR(-ENOMEM); ++ } ++ } + + edesc->src_nents = src_nents; + edesc->dst_nents = dst_nents; +@@ -813,15 +815,27 @@ static void ablkcipher_done(struct caam_drv_req *drv_req, u32 status) + #endif + + ablkcipher_unmap(qidev, edesc, req); +- qi_cache_free(edesc); ++ ++ /* In case initial IV was generated, copy it in GIVCIPHER request */ ++ if (edesc->drv_req.drv_ctx->op_type == GIVENCRYPT) { ++ u8 *iv; ++ struct skcipher_givcrypt_request *greq; ++ ++ greq = container_of(req, struct skcipher_givcrypt_request, ++ creq); ++ iv = (u8 *)edesc->sgt + edesc->qm_sg_bytes; ++ memcpy(greq->giv, iv, ivsize); ++ } + + /* + * The crypto API expects us to set the IV (req->info) to the last + * ciphertext block. This is used e.g. by the CTS mode. + */ +- scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ivsize, +- ivsize, 0); ++ if (edesc->drv_req.drv_ctx->op_type != DECRYPT) ++ scatterwalk_map_and_copy(req->info, req->dst, req->nbytes - ++ ivsize, ivsize, 0); + ++ qi_cache_free(edesc); + ablkcipher_request_complete(req, status); + } + +@@ -836,9 +850,9 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + int src_nents, mapped_src_nents, dst_nents = 0, mapped_dst_nents = 0; + struct ablkcipher_edesc *edesc; + dma_addr_t iv_dma; +- bool in_contig; ++ u8 *iv; + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); +- int dst_sg_idx, qm_sg_ents; ++ int dst_sg_idx, qm_sg_ents, qm_sg_bytes; + struct qm_sg_entry *sg_table, *fd_sgt; + struct caam_drv_ctx *drv_ctx; + enum optype op_type = encrypt ? ENCRYPT : DECRYPT; +@@ -885,55 +899,53 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + } + } + +- iv_dma = dma_map_single(qidev, req->info, ivsize, DMA_TO_DEVICE); +- if (dma_mapping_error(qidev, iv_dma)) { +- dev_err(qidev, "unable to map IV\n"); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, +- 0, 0, 0, 0); +- return ERR_PTR(-ENOMEM); +- } +- +- if (mapped_src_nents == 1 && +- iv_dma + ivsize == sg_dma_address(req->src)) { +- in_contig = true; +- qm_sg_ents = 0; +- } else { +- in_contig = false; +- qm_sg_ents = 1 + mapped_src_nents; +- } ++ qm_sg_ents = 1 + mapped_src_nents; + dst_sg_idx = qm_sg_ents; + + qm_sg_ents += mapped_dst_nents > 1 ? mapped_dst_nents : 0; +- if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", +- qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, op_type, 0, 0); ++ qm_sg_bytes = qm_sg_ents * sizeof(struct qm_sg_entry); ++ if (unlikely(offsetof(struct ablkcipher_edesc, sgt) + qm_sg_bytes + ++ ivsize > CAAM_QI_MEMCACHE_SIZE)) { ++ dev_err(qidev, "No space for %d S/G entries and/or %dB IV\n", ++ qm_sg_ents, ivsize); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); + return ERR_PTR(-ENOMEM); + } + +- /* allocate space for base edesc and link tables */ ++ /* allocate space for base edesc, link tables and IV */ + edesc = qi_cache_alloc(GFP_DMA | flags); + if (unlikely(!edesc)) { + dev_err(qidev, "could not allocate extended descriptor\n"); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, op_type, 0, 0); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ /* Make sure IV is located in a DMAable area */ ++ sg_table = &edesc->sgt[0]; ++ iv = (u8 *)(sg_table + qm_sg_ents); ++ memcpy(iv, req->info, ivsize); ++ ++ iv_dma = dma_map_single(qidev, iv, ivsize, DMA_TO_DEVICE); ++ if (dma_mapping_error(qidev, iv_dma)) { ++ dev_err(qidev, "unable to map IV\n"); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); ++ qi_cache_free(edesc); + return ERR_PTR(-ENOMEM); + } + + edesc->src_nents = src_nents; + edesc->dst_nents = dst_nents; + edesc->iv_dma = iv_dma; +- sg_table = &edesc->sgt[0]; +- edesc->qm_sg_bytes = qm_sg_ents * sizeof(*sg_table); ++ edesc->qm_sg_bytes = qm_sg_bytes; + edesc->drv_req.app_ctx = req; + edesc->drv_req.cbk = ablkcipher_done; + edesc->drv_req.drv_ctx = drv_ctx; + +- if (!in_contig) { +- dma_to_qm_sg_one(sg_table, iv_dma, ivsize, 0); +- sg_to_qm_sg_last(req->src, mapped_src_nents, sg_table + 1, 0); +- } ++ dma_to_qm_sg_one(sg_table, iv_dma, ivsize, 0); ++ sg_to_qm_sg_last(req->src, mapped_src_nents, sg_table + 1, 0); + + if (mapped_dst_nents > 1) + sg_to_qm_sg_last(req->dst, mapped_dst_nents, sg_table + +@@ -951,20 +963,12 @@ static struct ablkcipher_edesc *ablkcipher_edesc_alloc(struct ablkcipher_request + + fd_sgt = &edesc->drv_req.fd_sgt[0]; + +- if (!in_contig) +- dma_to_qm_sg_one_last_ext(&fd_sgt[1], edesc->qm_sg_dma, +- ivsize + req->nbytes, 0); +- else +- dma_to_qm_sg_one_last(&fd_sgt[1], iv_dma, ivsize + req->nbytes, +- 0); ++ dma_to_qm_sg_one_last_ext(&fd_sgt[1], edesc->qm_sg_dma, ++ ivsize + req->nbytes, 0); + + if (req->src == req->dst) { +- if (!in_contig) +- dma_to_qm_sg_one_ext(&fd_sgt[0], edesc->qm_sg_dma + +- sizeof(*sg_table), req->nbytes, 0); +- else +- dma_to_qm_sg_one(&fd_sgt[0], sg_dma_address(req->src), +- req->nbytes, 0); ++ dma_to_qm_sg_one_ext(&fd_sgt[0], edesc->qm_sg_dma + ++ sizeof(*sg_table), req->nbytes, 0); + } else if (mapped_dst_nents > 1) { + dma_to_qm_sg_one_ext(&fd_sgt[0], edesc->qm_sg_dma + dst_sg_idx * + sizeof(*sg_table), req->nbytes, 0); +@@ -988,10 +992,10 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + int src_nents, mapped_src_nents, dst_nents, mapped_dst_nents; + struct ablkcipher_edesc *edesc; + dma_addr_t iv_dma; +- bool out_contig; ++ u8 *iv; + int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + struct qm_sg_entry *sg_table, *fd_sgt; +- int dst_sg_idx, qm_sg_ents; ++ int dst_sg_idx, qm_sg_ents, qm_sg_bytes; + struct caam_drv_ctx *drv_ctx; + + drv_ctx = get_drv_ctx(ctx, GIVENCRYPT); +@@ -1039,46 +1043,45 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + mapped_dst_nents = src_nents; + } + +- iv_dma = dma_map_single(qidev, creq->giv, ivsize, DMA_FROM_DEVICE); +- if (dma_mapping_error(qidev, iv_dma)) { +- dev_err(qidev, "unable to map IV\n"); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, +- 0, 0, 0, 0); +- return ERR_PTR(-ENOMEM); +- } +- + qm_sg_ents = mapped_src_nents > 1 ? mapped_src_nents : 0; + dst_sg_idx = qm_sg_ents; +- if (mapped_dst_nents == 1 && +- iv_dma + ivsize == sg_dma_address(req->dst)) { +- out_contig = true; +- } else { +- out_contig = false; +- qm_sg_ents += 1 + mapped_dst_nents; +- } + +- if (unlikely(qm_sg_ents > CAAM_QI_MAX_ABLKCIPHER_SG)) { +- dev_err(qidev, "Insufficient S/G entries: %d > %zu\n", +- qm_sg_ents, CAAM_QI_MAX_ABLKCIPHER_SG); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, GIVENCRYPT, 0, 0); ++ qm_sg_ents += 1 + mapped_dst_nents; ++ qm_sg_bytes = qm_sg_ents * sizeof(struct qm_sg_entry); ++ if (unlikely(offsetof(struct ablkcipher_edesc, sgt) + qm_sg_bytes + ++ ivsize > CAAM_QI_MEMCACHE_SIZE)) { ++ dev_err(qidev, "No space for %d S/G entries and/or %dB IV\n", ++ qm_sg_ents, ivsize); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); + return ERR_PTR(-ENOMEM); + } + +- /* allocate space for base edesc and link tables */ ++ /* allocate space for base edesc, link tables and IV */ + edesc = qi_cache_alloc(GFP_DMA | flags); + if (!edesc) { + dev_err(qidev, "could not allocate extended descriptor\n"); +- caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, +- iv_dma, ivsize, GIVENCRYPT, 0, 0); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); ++ return ERR_PTR(-ENOMEM); ++ } ++ ++ /* Make sure IV is located in a DMAable area */ ++ sg_table = &edesc->sgt[0]; ++ iv = (u8 *)(sg_table + qm_sg_ents); ++ iv_dma = dma_map_single(qidev, iv, ivsize, DMA_FROM_DEVICE); ++ if (dma_mapping_error(qidev, iv_dma)) { ++ dev_err(qidev, "unable to map IV\n"); ++ caam_unmap(qidev, req->src, req->dst, src_nents, dst_nents, 0, ++ 0, 0, 0, 0); ++ qi_cache_free(edesc); + return ERR_PTR(-ENOMEM); + } + + edesc->src_nents = src_nents; + edesc->dst_nents = dst_nents; + edesc->iv_dma = iv_dma; +- sg_table = &edesc->sgt[0]; +- edesc->qm_sg_bytes = qm_sg_ents * sizeof(*sg_table); ++ edesc->qm_sg_bytes = qm_sg_bytes; + edesc->drv_req.app_ctx = req; + edesc->drv_req.cbk = ablkcipher_done; + edesc->drv_req.drv_ctx = drv_ctx; +@@ -1086,11 +1089,9 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + if (mapped_src_nents > 1) + sg_to_qm_sg_last(req->src, mapped_src_nents, sg_table, 0); + +- if (!out_contig) { +- dma_to_qm_sg_one(sg_table + dst_sg_idx, iv_dma, ivsize, 0); +- sg_to_qm_sg_last(req->dst, mapped_dst_nents, sg_table + +- dst_sg_idx + 1, 0); +- } ++ dma_to_qm_sg_one(sg_table + dst_sg_idx, iv_dma, ivsize, 0); ++ sg_to_qm_sg_last(req->dst, mapped_dst_nents, sg_table + dst_sg_idx + 1, ++ 0); + + edesc->qm_sg_dma = dma_map_single(qidev, sg_table, edesc->qm_sg_bytes, + DMA_TO_DEVICE); +@@ -1111,13 +1112,8 @@ static struct ablkcipher_edesc *ablkcipher_giv_edesc_alloc( + dma_to_qm_sg_one(&fd_sgt[1], sg_dma_address(req->src), + req->nbytes, 0); + +- if (!out_contig) +- dma_to_qm_sg_one_ext(&fd_sgt[0], edesc->qm_sg_dma + dst_sg_idx * +- sizeof(*sg_table), ivsize + req->nbytes, +- 0); +- else +- dma_to_qm_sg_one(&fd_sgt[0], sg_dma_address(req->dst), +- ivsize + req->nbytes, 0); ++ dma_to_qm_sg_one_ext(&fd_sgt[0], edesc->qm_sg_dma + dst_sg_idx * ++ sizeof(*sg_table), ivsize + req->nbytes, 0); + + return edesc; + } +@@ -1127,6 +1123,7 @@ static inline int ablkcipher_crypt(struct ablkcipher_request *req, bool encrypt) + struct ablkcipher_edesc *edesc; + struct crypto_ablkcipher *ablkcipher = crypto_ablkcipher_reqtfm(req); + struct caam_ctx *ctx = crypto_ablkcipher_ctx(ablkcipher); ++ int ivsize = crypto_ablkcipher_ivsize(ablkcipher); + int ret; + + if (unlikely(caam_congested)) +@@ -1137,6 +1134,14 @@ static inline int ablkcipher_crypt(struct ablkcipher_request *req, bool encrypt) + if (IS_ERR(edesc)) + return PTR_ERR(edesc); + ++ /* ++ * The crypto API expects us to set the IV (req->info) to the last ++ * ciphertext block. ++ */ ++ if (!encrypt) ++ scatterwalk_map_and_copy(req->info, req->src, req->nbytes - ++ ivsize, ivsize, 0); ++ + ret = caam_qi_enqueue(ctx->qidev, &edesc->drv_req); + if (!ret) { + ret = -EINPROGRESS; +diff --git a/drivers/crypto/caam/caampkc.c b/drivers/crypto/caam/caampkc.c +index 7a897209f181..7ff4a25440ac 100644 +--- a/drivers/crypto/caam/caampkc.c ++++ b/drivers/crypto/caam/caampkc.c +@@ -66,7 +66,7 @@ static void rsa_priv_f2_unmap(struct device *dev, struct rsa_edesc *edesc, + struct caam_rsa_key *key = &ctx->key; + struct rsa_priv_f2_pdb *pdb = &edesc->pdb.priv_f2; + size_t p_sz = key->p_sz; +- size_t q_sz = key->p_sz; ++ size_t q_sz = key->q_sz; + + dma_unmap_single(dev, pdb->d_dma, key->d_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE); +@@ -83,7 +83,7 @@ static void rsa_priv_f3_unmap(struct device *dev, struct rsa_edesc *edesc, + struct caam_rsa_key *key = &ctx->key; + struct rsa_priv_f3_pdb *pdb = &edesc->pdb.priv_f3; + size_t p_sz = key->p_sz; +- size_t q_sz = key->p_sz; ++ size_t q_sz = key->q_sz; + + dma_unmap_single(dev, pdb->p_dma, p_sz, DMA_TO_DEVICE); + dma_unmap_single(dev, pdb->q_dma, q_sz, DMA_TO_DEVICE); +@@ -166,18 +166,71 @@ static void rsa_priv_f3_done(struct device *dev, u32 *desc, u32 err, + akcipher_request_complete(req, err); + } + ++static int caam_rsa_count_leading_zeros(struct scatterlist *sgl, ++ unsigned int nbytes, ++ unsigned int flags) ++{ ++ struct sg_mapping_iter miter; ++ int lzeros, ents; ++ unsigned int len; ++ unsigned int tbytes = nbytes; ++ const u8 *buff; ++ ++ ents = sg_nents_for_len(sgl, nbytes); ++ if (ents < 0) ++ return ents; ++ ++ sg_miter_start(&miter, sgl, ents, SG_MITER_FROM_SG | flags); ++ ++ lzeros = 0; ++ len = 0; ++ while (nbytes > 0) { ++ while (len && !*buff) { ++ lzeros++; ++ len--; ++ buff++; ++ } ++ ++ if (len && *buff) ++ break; ++ ++ sg_miter_next(&miter); ++ buff = miter.addr; ++ len = miter.length; ++ ++ nbytes -= lzeros; ++ lzeros = 0; ++ } ++ ++ miter.consumed = lzeros; ++ sg_miter_stop(&miter); ++ nbytes -= lzeros; ++ ++ return tbytes - nbytes; ++} ++ + static struct rsa_edesc *rsa_edesc_alloc(struct akcipher_request *req, + size_t desclen) + { + struct crypto_akcipher *tfm = crypto_akcipher_reqtfm(req); + struct caam_rsa_ctx *ctx = akcipher_tfm_ctx(tfm); + struct device *dev = ctx->dev; ++ struct caam_rsa_req_ctx *req_ctx = akcipher_request_ctx(req); + struct rsa_edesc *edesc; + gfp_t flags = (req->base.flags & CRYPTO_TFM_REQ_MAY_SLEEP) ? + GFP_KERNEL : GFP_ATOMIC; ++ int sg_flags = (flags == GFP_ATOMIC) ? SG_MITER_ATOMIC : 0; + int sgc; + int sec4_sg_index, sec4_sg_len = 0, sec4_sg_bytes; + int src_nents, dst_nents; ++ int lzeros; ++ ++ lzeros = caam_rsa_count_leading_zeros(req->src, req->src_len, sg_flags); ++ if (lzeros < 0) ++ return ERR_PTR(lzeros); ++ ++ req->src_len -= lzeros; ++ req->src = scatterwalk_ffwd(req_ctx->src, req->src, lzeros); + + src_nents = sg_nents_for_len(req->src, req->src_len); + dst_nents = sg_nents_for_len(req->dst, req->dst_len); +@@ -344,7 +397,7 @@ static int set_rsa_priv_f2_pdb(struct akcipher_request *req, + struct rsa_priv_f2_pdb *pdb = &edesc->pdb.priv_f2; + int sec4_sg_index = 0; + size_t p_sz = key->p_sz; +- size_t q_sz = key->p_sz; ++ size_t q_sz = key->q_sz; + + pdb->d_dma = dma_map_single(dev, key->d, key->d_sz, DMA_TO_DEVICE); + if (dma_mapping_error(dev, pdb->d_dma)) { +@@ -419,7 +472,7 @@ static int set_rsa_priv_f3_pdb(struct akcipher_request *req, + struct rsa_priv_f3_pdb *pdb = &edesc->pdb.priv_f3; + int sec4_sg_index = 0; + size_t p_sz = key->p_sz; +- size_t q_sz = key->p_sz; ++ size_t q_sz = key->q_sz; + + pdb->p_dma = dma_map_single(dev, key->p, p_sz, DMA_TO_DEVICE); + if (dma_mapping_error(dev, pdb->p_dma)) { +@@ -953,6 +1006,7 @@ static struct akcipher_alg caam_rsa = { + .max_size = caam_rsa_max_size, + .init = caam_rsa_init_tfm, + .exit = caam_rsa_exit_tfm, ++ .reqsize = sizeof(struct caam_rsa_req_ctx), + .base = { + .cra_name = "rsa", + .cra_driver_name = "rsa-caam", +diff --git a/drivers/crypto/caam/caampkc.h b/drivers/crypto/caam/caampkc.h +index fd145c46eae1..82645bcf8b27 100644 +--- a/drivers/crypto/caam/caampkc.h ++++ b/drivers/crypto/caam/caampkc.h +@@ -95,6 +95,14 @@ struct caam_rsa_ctx { + struct device *dev; + }; + ++/** ++ * caam_rsa_req_ctx - per request context. ++ * @src: input scatterlist (stripped of leading zeros) ++ */ ++struct caam_rsa_req_ctx { ++ struct scatterlist src[2]; ++}; ++ + /** + * rsa_edesc - s/w-extended rsa descriptor + * @src_nents : number of segments in input scatterlist +diff --git a/drivers/crypto/cavium/zip/common.h b/drivers/crypto/cavium/zip/common.h +index dc451e0a43c5..58fb3ed6e644 100644 +--- a/drivers/crypto/cavium/zip/common.h ++++ b/drivers/crypto/cavium/zip/common.h +@@ -46,8 +46,10 @@ + #ifndef __COMMON_H__ + #define __COMMON_H__ + ++#include + #include + #include ++#include + #include + #include + #include +@@ -149,6 +151,25 @@ struct zip_operation { + u32 sizeofzops; + }; + ++static inline int zip_poll_result(union zip_zres_s *result) ++{ ++ int retries = 1000; ++ ++ while (!result->s.compcode) { ++ if (!--retries) { ++ pr_err("ZIP ERR: request timed out"); ++ return -ETIMEDOUT; ++ } ++ udelay(10); ++ /* ++ * Force re-reading of compcode which is updated ++ * by the ZIP coprocessor. ++ */ ++ rmb(); ++ } ++ return 0; ++} ++ + /* error messages */ + #define zip_err(fmt, args...) pr_err("ZIP ERR:%s():%d: " \ + fmt "\n", __func__, __LINE__, ## args) +diff --git a/drivers/crypto/cavium/zip/zip_crypto.c b/drivers/crypto/cavium/zip/zip_crypto.c +index 8df4d26cf9d4..b92b6e7e100f 100644 +--- a/drivers/crypto/cavium/zip/zip_crypto.c ++++ b/drivers/crypto/cavium/zip/zip_crypto.c +@@ -124,7 +124,7 @@ int zip_compress(const u8 *src, unsigned int slen, + struct zip_kernel_ctx *zip_ctx) + { + struct zip_operation *zip_ops = NULL; +- struct zip_state zip_state; ++ struct zip_state *zip_state; + struct zip_device *zip = NULL; + int ret; + +@@ -135,20 +135,23 @@ int zip_compress(const u8 *src, unsigned int slen, + if (!zip) + return -ENODEV; + +- memset(&zip_state, 0, sizeof(struct zip_state)); ++ zip_state = kzalloc(sizeof(*zip_state), GFP_ATOMIC); ++ if (!zip_state) ++ return -ENOMEM; ++ + zip_ops = &zip_ctx->zip_comp; + + zip_ops->input_len = slen; + zip_ops->output_len = *dlen; + memcpy(zip_ops->input, src, slen); + +- ret = zip_deflate(zip_ops, &zip_state, zip); ++ ret = zip_deflate(zip_ops, zip_state, zip); + + if (!ret) { + *dlen = zip_ops->output_len; + memcpy(dst, zip_ops->output, *dlen); + } +- ++ kfree(zip_state); + return ret; + } + +@@ -157,7 +160,7 @@ int zip_decompress(const u8 *src, unsigned int slen, + struct zip_kernel_ctx *zip_ctx) + { + struct zip_operation *zip_ops = NULL; +- struct zip_state zip_state; ++ struct zip_state *zip_state; + struct zip_device *zip = NULL; + int ret; + +@@ -168,7 +171,10 @@ int zip_decompress(const u8 *src, unsigned int slen, + if (!zip) + return -ENODEV; + +- memset(&zip_state, 0, sizeof(struct zip_state)); ++ zip_state = kzalloc(sizeof(*zip_state), GFP_ATOMIC); ++ if (!zip_state) ++ return -ENOMEM; ++ + zip_ops = &zip_ctx->zip_decomp; + memcpy(zip_ops->input, src, slen); + +@@ -179,13 +185,13 @@ int zip_decompress(const u8 *src, unsigned int slen, + zip_ops->input_len = slen; + zip_ops->output_len = *dlen; + +- ret = zip_inflate(zip_ops, &zip_state, zip); ++ ret = zip_inflate(zip_ops, zip_state, zip); + + if (!ret) { + *dlen = zip_ops->output_len; + memcpy(dst, zip_ops->output, *dlen); + } +- ++ kfree(zip_state); + return ret; + } + +diff --git a/drivers/crypto/cavium/zip/zip_deflate.c b/drivers/crypto/cavium/zip/zip_deflate.c +index 9a944b8c1e29..d7133f857d67 100644 +--- a/drivers/crypto/cavium/zip/zip_deflate.c ++++ b/drivers/crypto/cavium/zip/zip_deflate.c +@@ -129,8 +129,8 @@ int zip_deflate(struct zip_operation *zip_ops, struct zip_state *s, + /* Stats update for compression requests submitted */ + atomic64_inc(&zip_dev->stats.comp_req_submit); + +- while (!result_ptr->s.compcode) +- continue; ++ /* Wait for completion or error */ ++ zip_poll_result(result_ptr); + + /* Stats update for compression requests completed */ + atomic64_inc(&zip_dev->stats.comp_req_complete); +diff --git a/drivers/crypto/cavium/zip/zip_inflate.c b/drivers/crypto/cavium/zip/zip_inflate.c +index 50cbdd83dbf2..7e0d73e2f89e 100644 +--- a/drivers/crypto/cavium/zip/zip_inflate.c ++++ b/drivers/crypto/cavium/zip/zip_inflate.c +@@ -143,8 +143,8 @@ int zip_inflate(struct zip_operation *zip_ops, struct zip_state *s, + /* Decompression requests submitted stats update */ + atomic64_inc(&zip_dev->stats.decomp_req_submit); + +- while (!result_ptr->s.compcode) +- continue; ++ /* Wait for completion or error */ ++ zip_poll_result(result_ptr); + + /* Decompression requests completed stats update */ + atomic64_inc(&zip_dev->stats.decomp_req_complete); +diff --git a/drivers/crypto/omap-sham.c b/drivers/crypto/omap-sham.c +index c40ac30ec002..c1f8da958c78 100644 +--- a/drivers/crypto/omap-sham.c ++++ b/drivers/crypto/omap-sham.c +@@ -1082,7 +1082,7 @@ static void omap_sham_finish_req(struct ahash_request *req, int err) + + if (test_bit(FLAGS_SGS_COPIED, &dd->flags)) + free_pages((unsigned long)sg_virt(ctx->sg), +- get_order(ctx->sg->length)); ++ get_order(ctx->sg->length + ctx->bufcnt)); + + if (test_bit(FLAGS_SGS_ALLOCED, &dd->flags)) + kfree(ctx->sg); +diff --git a/drivers/crypto/vmx/aes.c b/drivers/crypto/vmx/aes.c +index 96072b9b55c4..d7316f7a3a69 100644 +--- a/drivers/crypto/vmx/aes.c ++++ b/drivers/crypto/vmx/aes.c +@@ -48,8 +48,6 @@ static int p8_aes_init(struct crypto_tfm *tfm) + alg, PTR_ERR(fallback)); + return PTR_ERR(fallback); + } +- printk(KERN_INFO "Using '%s' as fallback implementation.\n", +- crypto_tfm_alg_driver_name((struct crypto_tfm *) fallback)); + + crypto_cipher_set_flags(fallback, + crypto_cipher_get_flags((struct +diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c +index 7394d35d5936..5285ece4f33a 100644 +--- a/drivers/crypto/vmx/aes_cbc.c ++++ b/drivers/crypto/vmx/aes_cbc.c +@@ -52,9 +52,6 @@ static int p8_aes_cbc_init(struct crypto_tfm *tfm) + alg, PTR_ERR(fallback)); + return PTR_ERR(fallback); + } +- printk(KERN_INFO "Using '%s' as fallback implementation.\n", +- crypto_skcipher_driver_name(fallback)); +- + + crypto_skcipher_set_flags( + fallback, +diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c +index 17d84217dd76..02ba5f2aa0e6 100644 +--- a/drivers/crypto/vmx/aes_ctr.c ++++ b/drivers/crypto/vmx/aes_ctr.c +@@ -48,8 +48,6 @@ static int p8_aes_ctr_init(struct crypto_tfm *tfm) + alg, PTR_ERR(fallback)); + return PTR_ERR(fallback); + } +- printk(KERN_INFO "Using '%s' as fallback implementation.\n", +- crypto_tfm_alg_driver_name((struct crypto_tfm *) fallback)); + + crypto_blkcipher_set_flags( + fallback, +diff --git a/drivers/crypto/vmx/aes_xts.c b/drivers/crypto/vmx/aes_xts.c +index 8cd6e62e4c90..8bd9aff0f55f 100644 +--- a/drivers/crypto/vmx/aes_xts.c ++++ b/drivers/crypto/vmx/aes_xts.c +@@ -53,8 +53,6 @@ static int p8_aes_xts_init(struct crypto_tfm *tfm) + alg, PTR_ERR(fallback)); + return PTR_ERR(fallback); + } +- printk(KERN_INFO "Using '%s' as fallback implementation.\n", +- crypto_skcipher_driver_name(fallback)); + + crypto_skcipher_set_flags( + fallback, +diff --git a/drivers/crypto/vmx/ghash.c b/drivers/crypto/vmx/ghash.c +index 27a94a119009..1c4b5b889fba 100644 +--- a/drivers/crypto/vmx/ghash.c ++++ b/drivers/crypto/vmx/ghash.c +@@ -64,8 +64,6 @@ static int p8_ghash_init_tfm(struct crypto_tfm *tfm) + alg, PTR_ERR(fallback)); + return PTR_ERR(fallback); + } +- printk(KERN_INFO "Using '%s' as fallback implementation.\n", +- crypto_tfm_alg_driver_name(crypto_shash_tfm(fallback))); + + crypto_shash_set_flags(fallback, + crypto_shash_get_flags((struct crypto_shash +diff --git a/drivers/gpio/gpiolib.c b/drivers/gpio/gpiolib.c +index 68ea6e712bf9..7e0bfd7347f6 100644 +--- a/drivers/gpio/gpiolib.c ++++ b/drivers/gpio/gpiolib.c +@@ -3313,6 +3313,8 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + struct gpio_desc *desc = NULL; + int status; + enum gpio_lookup_flags lookupflags = 0; ++ /* Maybe we have a device name, maybe not */ ++ const char *devname = dev ? dev_name(dev) : "?"; + + dev_dbg(dev, "GPIO lookup for consumer %s\n", con_id); + +@@ -3341,8 +3343,11 @@ struct gpio_desc *__must_check gpiod_get_index(struct device *dev, + return desc; + } + +- /* If a connection label was passed use that, else use the device name as label */ +- status = gpiod_request(desc, con_id ? con_id : dev_name(dev)); ++ /* ++ * If a connection label was passed use that, else attempt to use ++ * the device name as label ++ */ ++ status = gpiod_request(desc, con_id ? con_id : devname); + if (status < 0) + return ERR_PTR(status); + +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index d88d3e0f59fb..466cef930bf1 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -126,6 +126,7 @@ static const struct xpad_device { + u8 mapping; + u8 xtype; + } xpad_device[] = { ++ { 0x0079, 0x18d4, "GPD Win 2 Controller", 0, XTYPE_XBOX360 }, + { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, +@@ -411,6 +412,7 @@ static const signed short xpad_abs_triggers[] = { + + static const struct usb_device_id xpad_table[] = { + { USB_INTERFACE_INFO('X', 'B', 0) }, /* X-Box USB-IF not approved class */ ++ XPAD_XBOX360_VENDOR(0x0079), /* GPD Win 2 Controller */ + XPAD_XBOX360_VENDOR(0x044f), /* Thrustmaster X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x045e), /* Microsoft X-Box 360 controllers */ + XPAD_XBOXONE_VENDOR(0x045e), /* Microsoft X-Box One controllers */ +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index d6135900da64..c4926645c779 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1260,6 +1260,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN060B", 0 }, + { "ELAN060C", 0 }, + { "ELAN0611", 0 }, ++ { "ELAN0612", 0 }, + { "ELAN1000", 0 }, + { } + }; +diff --git a/drivers/input/touchscreen/goodix.c b/drivers/input/touchscreen/goodix.c +index 5dafafad6351..2bfa89ec552c 100644 +--- a/drivers/input/touchscreen/goodix.c ++++ b/drivers/input/touchscreen/goodix.c +@@ -888,6 +888,7 @@ MODULE_DEVICE_TABLE(i2c, goodix_ts_id); + #ifdef CONFIG_ACPI + static const struct acpi_device_id goodix_acpi_match[] = { + { "GDIX1001", 0 }, ++ { "GDIX1002", 0 }, + { } + }; + MODULE_DEVICE_TABLE(acpi, goodix_acpi_match); +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 9047c0a529b2..efd733472a35 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -576,15 +576,9 @@ static void vmballoon_pop(struct vmballoon *b) + } + } + +- if (b->batch_page) { +- vunmap(b->batch_page); +- b->batch_page = NULL; +- } +- +- if (b->page) { +- __free_page(b->page); +- b->page = NULL; +- } ++ /* Clearing the batch_page unconditionally has no adverse effect */ ++ free_page((unsigned long)b->batch_page); ++ b->batch_page = NULL; + } + + /* +@@ -991,16 +985,13 @@ static const struct vmballoon_ops vmballoon_batched_ops = { + + static bool vmballoon_init_batching(struct vmballoon *b) + { +- b->page = alloc_page(VMW_PAGE_ALLOC_NOSLEEP); +- if (!b->page) +- return false; ++ struct page *page; + +- b->batch_page = vmap(&b->page, 1, VM_MAP, PAGE_KERNEL); +- if (!b->batch_page) { +- __free_page(b->page); ++ page = alloc_page(GFP_KERNEL | __GFP_ZERO); ++ if (!page) + return false; +- } + ++ b->batch_page = page_address(page); + return true; + } + +diff --git a/drivers/nfc/pn533/usb.c b/drivers/nfc/pn533/usb.c +index e153e8b64bb8..d5553c47014f 100644 +--- a/drivers/nfc/pn533/usb.c ++++ b/drivers/nfc/pn533/usb.c +@@ -62,6 +62,9 @@ struct pn533_usb_phy { + struct urb *out_urb; + struct urb *in_urb; + ++ struct urb *ack_urb; ++ u8 *ack_buffer; ++ + struct pn533 *priv; + }; + +@@ -150,13 +153,16 @@ static int pn533_usb_send_ack(struct pn533 *dev, gfp_t flags) + struct pn533_usb_phy *phy = dev->phy; + static const u8 ack[6] = {0x00, 0x00, 0xff, 0x00, 0xff, 0x00}; + /* spec 7.1.1.3: Preamble, SoPC (2), ACK Code (2), Postamble */ +- int rc; + +- phy->out_urb->transfer_buffer = (u8 *)ack; +- phy->out_urb->transfer_buffer_length = sizeof(ack); +- rc = usb_submit_urb(phy->out_urb, flags); ++ if (!phy->ack_buffer) { ++ phy->ack_buffer = kmemdup(ack, sizeof(ack), flags); ++ if (!phy->ack_buffer) ++ return -ENOMEM; ++ } + +- return rc; ++ phy->ack_urb->transfer_buffer = phy->ack_buffer; ++ phy->ack_urb->transfer_buffer_length = sizeof(ack); ++ return usb_submit_urb(phy->ack_urb, flags); + } + + static int pn533_usb_send_frame(struct pn533 *dev, +@@ -375,26 +381,31 @@ static int pn533_acr122_poweron_rdr(struct pn533_usb_phy *phy) + /* Power on th reader (CCID cmd) */ + u8 cmd[10] = {PN533_ACR122_PC_TO_RDR_ICCPOWERON, + 0, 0, 0, 0, 0, 0, 3, 0, 0}; ++ char *buffer; ++ int transferred; + int rc; + void *cntx; + struct pn533_acr122_poweron_rdr_arg arg; + + dev_dbg(&phy->udev->dev, "%s\n", __func__); + ++ buffer = kmemdup(cmd, sizeof(cmd), GFP_KERNEL); ++ if (!buffer) ++ return -ENOMEM; ++ + init_completion(&arg.done); + cntx = phy->in_urb->context; /* backup context */ + + phy->in_urb->complete = pn533_acr122_poweron_rdr_resp; + phy->in_urb->context = &arg; + +- phy->out_urb->transfer_buffer = cmd; +- phy->out_urb->transfer_buffer_length = sizeof(cmd); +- + print_hex_dump_debug("ACR122 TX: ", DUMP_PREFIX_NONE, 16, 1, + cmd, sizeof(cmd), false); + +- rc = usb_submit_urb(phy->out_urb, GFP_KERNEL); +- if (rc) { ++ rc = usb_bulk_msg(phy->udev, phy->out_urb->pipe, buffer, sizeof(cmd), ++ &transferred, 0); ++ kfree(buffer); ++ if (rc || (transferred != sizeof(cmd))) { + nfc_err(&phy->udev->dev, + "Reader power on cmd error %d\n", rc); + return rc; +@@ -490,8 +501,9 @@ static int pn533_usb_probe(struct usb_interface *interface, + + phy->in_urb = usb_alloc_urb(0, GFP_KERNEL); + phy->out_urb = usb_alloc_urb(0, GFP_KERNEL); ++ phy->ack_urb = usb_alloc_urb(0, GFP_KERNEL); + +- if (!phy->in_urb || !phy->out_urb) ++ if (!phy->in_urb || !phy->out_urb || !phy->ack_urb) + goto error; + + usb_fill_bulk_urb(phy->in_urb, phy->udev, +@@ -501,7 +513,9 @@ static int pn533_usb_probe(struct usb_interface *interface, + usb_fill_bulk_urb(phy->out_urb, phy->udev, + usb_sndbulkpipe(phy->udev, out_endpoint), + NULL, 0, pn533_send_complete, phy); +- ++ usb_fill_bulk_urb(phy->ack_urb, phy->udev, ++ usb_sndbulkpipe(phy->udev, out_endpoint), ++ NULL, 0, pn533_send_complete, phy); + + switch (id->driver_info) { + case PN533_DEVICE_STD: +@@ -554,6 +568,7 @@ static int pn533_usb_probe(struct usb_interface *interface, + error: + usb_free_urb(phy->in_urb); + usb_free_urb(phy->out_urb); ++ usb_free_urb(phy->ack_urb); + usb_put_dev(phy->udev); + kfree(in_buf); + +@@ -573,10 +588,13 @@ static void pn533_usb_disconnect(struct usb_interface *interface) + + usb_kill_urb(phy->in_urb); + usb_kill_urb(phy->out_urb); ++ usb_kill_urb(phy->ack_urb); + + kfree(phy->in_urb->transfer_buffer); + usb_free_urb(phy->in_urb); + usb_free_urb(phy->out_urb); ++ usb_free_urb(phy->ack_urb); ++ kfree(phy->ack_buffer); + + nfc_info(&interface->dev, "NXP PN533 NFC device disconnected\n"); + } +diff --git a/drivers/phy/qualcomm/phy-qcom-qusb2.c b/drivers/phy/qualcomm/phy-qcom-qusb2.c +index 6c575244c0fb..af9b7005a2ba 100644 +--- a/drivers/phy/qualcomm/phy-qcom-qusb2.c ++++ b/drivers/phy/qualcomm/phy-qcom-qusb2.c +@@ -178,6 +178,10 @@ static void qusb2_phy_set_tune2_param(struct qusb2_phy *qphy) + struct device *dev = &qphy->phy->dev; + u8 *val; + ++ /* efuse register is optional */ ++ if (!qphy->cell) ++ return; ++ + /* + * Read efuse register having TUNE2 parameter's high nibble. + * If efuse register shows value as 0x0, or if we fail to find +diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c +index 83dc3292e9ab..24cb666c9224 100644 +--- a/drivers/staging/android/ion/ion.c ++++ b/drivers/staging/android/ion/ion.c +@@ -131,8 +131,11 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap, + + void ion_buffer_destroy(struct ion_buffer *buffer) + { +- if (WARN_ON(buffer->kmap_cnt > 0)) ++ if (buffer->kmap_cnt > 0) { ++ pr_warn_once("%s: buffer still mapped in the kernel\n", ++ __func__); + buffer->heap->ops->unmap_kernel(buffer->heap, buffer); ++ } + buffer->heap->ops->free(buffer); + kfree(buffer); + } +diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c +index 833771bca0a5..da04ba1ecf68 100644 +--- a/drivers/tty/serial/8250/8250_omap.c ++++ b/drivers/tty/serial/8250/8250_omap.c +@@ -1100,13 +1100,14 @@ static int omap8250_no_handle_irq(struct uart_port *port) + return 0; + } + ++static const u8 omap4_habit = UART_ERRATA_CLOCK_DISABLE; + static const u8 am3352_habit = OMAP_DMA_TX_KICK | UART_ERRATA_CLOCK_DISABLE; + static const u8 dra742_habit = UART_ERRATA_CLOCK_DISABLE; + + static const struct of_device_id omap8250_dt_ids[] = { + { .compatible = "ti,omap2-uart" }, + { .compatible = "ti,omap3-uart" }, +- { .compatible = "ti,omap4-uart" }, ++ { .compatible = "ti,omap4-uart", .data = &omap4_habit, }, + { .compatible = "ti,am3352-uart", .data = &am3352_habit, }, + { .compatible = "ti,am4372-uart", .data = &am3352_habit, }, + { .compatible = "ti,dra742-uart", .data = &dra742_habit, }, +@@ -1343,6 +1344,19 @@ static int omap8250_soft_reset(struct device *dev) + int sysc; + int syss; + ++ /* ++ * At least on omap4, unused uarts may not idle after reset without ++ * a basic scr dma configuration even with no dma in use. The ++ * module clkctrl status bits will be 1 instead of 3 blocking idle ++ * for the whole clockdomain. The softreset below will clear scr, ++ * and we restore it on resume so this is safe to do on all SoCs ++ * needing omap8250_soft_reset() quirk. Do it in two writes as ++ * recommended in the comment for omap8250_update_scr(). ++ */ ++ serial_out(up, UART_OMAP_SCR, OMAP_UART_SCR_DMAMODE_1); ++ serial_out(up, UART_OMAP_SCR, ++ OMAP_UART_SCR_DMAMODE_1 | OMAP_UART_SCR_DMAMODE_CTL); ++ + sysc = serial_in(up, UART_OMAP_SYSC); + + /* softreset the UART */ +diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c +index 111e6a950779..c9f701aca677 100644 +--- a/drivers/tty/serial/amba-pl011.c ++++ b/drivers/tty/serial/amba-pl011.c +@@ -1747,10 +1747,26 @@ static int pl011_allocate_irq(struct uart_amba_port *uap) + */ + static void pl011_enable_interrupts(struct uart_amba_port *uap) + { ++ unsigned int i; ++ + spin_lock_irq(&uap->port.lock); + + /* Clear out any spuriously appearing RX interrupts */ + pl011_write(UART011_RTIS | UART011_RXIS, uap, REG_ICR); ++ ++ /* ++ * RXIS is asserted only when the RX FIFO transitions from below ++ * to above the trigger threshold. If the RX FIFO is already ++ * full to the threshold this can't happen and RXIS will now be ++ * stuck off. Drain the RX FIFO explicitly to fix this: ++ */ ++ for (i = 0; i < uap->fifosize * 2; ++i) { ++ if (pl011_read(uap, REG_FR) & UART01x_FR_RXFE) ++ break; ++ ++ pl011_read(uap, REG_DR); ++ } ++ + uap->im = UART011_RTIM; + if (!pl011_dma_rx_running(uap)) + uap->im |= UART011_RXIM; +diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c +index a0b24bc09783..2286e9d73115 100644 +--- a/drivers/tty/serial/atmel_serial.c ++++ b/drivers/tty/serial/atmel_serial.c +@@ -1786,7 +1786,6 @@ static int atmel_startup(struct uart_port *port) + { + struct platform_device *pdev = to_platform_device(port->dev); + struct atmel_uart_port *atmel_port = to_atmel_uart_port(port); +- struct tty_struct *tty = port->state->port.tty; + int retval; + + /* +@@ -1801,8 +1800,8 @@ static int atmel_startup(struct uart_port *port) + * Allocate the IRQ + */ + retval = request_irq(port->irq, atmel_interrupt, +- IRQF_SHARED | IRQF_COND_SUSPEND, +- tty ? tty->name : "atmel_serial", port); ++ IRQF_SHARED | IRQF_COND_SUSPEND, ++ dev_name(&pdev->dev), port); + if (retval) { + dev_err(port->dev, "atmel_startup - Can't get irq\n"); + return retval; +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index bedd4bdec4ab..57baa84ccf86 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -865,15 +865,12 @@ static int s3c24xx_serial_request_dma(struct s3c24xx_uart_port *p) + dma->rx_conf.direction = DMA_DEV_TO_MEM; + dma->rx_conf.src_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; + dma->rx_conf.src_addr = p->port.mapbase + S3C2410_URXH; +- dma->rx_conf.src_maxburst = 16; ++ dma->rx_conf.src_maxburst = 1; + + dma->tx_conf.direction = DMA_MEM_TO_DEV; + dma->tx_conf.dst_addr_width = DMA_SLAVE_BUSWIDTH_1_BYTE; + dma->tx_conf.dst_addr = p->port.mapbase + S3C2410_UTXH; +- if (dma_get_cache_alignment() >= 16) +- dma->tx_conf.dst_maxburst = 16; +- else +- dma->tx_conf.dst_maxburst = 1; ++ dma->tx_conf.dst_maxburst = 1; + + dma->rx_chan = dma_request_chan(p->port.dev, "rx"); + +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index 8a58ee32ff61..c6daa315ee4e 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -2669,8 +2669,8 @@ static int sci_init_clocks(struct sci_port *sci_port, struct device *dev) + dev_dbg(dev, "failed to get %s (%ld)\n", clk_names[i], + PTR_ERR(clk)); + else +- dev_dbg(dev, "clk %s is %pC rate %pCr\n", clk_names[i], +- clk, clk); ++ dev_dbg(dev, "clk %s is %pC rate %lu\n", clk_names[i], ++ clk, clk_get_rate(clk)); + sci_port->clks[i] = IS_ERR(clk) ? NULL : clk; + } + return 0; +diff --git a/drivers/usb/gadget/function/f_printer.c b/drivers/usb/gadget/function/f_printer.c +index ea0da35a44e2..e6d4fa5eeff1 100644 +--- a/drivers/usb/gadget/function/f_printer.c ++++ b/drivers/usb/gadget/function/f_printer.c +@@ -635,19 +635,19 @@ printer_write(struct file *fd, const char __user *buf, size_t len, loff_t *ptr) + return -EAGAIN; + } + ++ list_add(&req->list, &dev->tx_reqs_active); ++ + /* here, we unlock, and only unlock, to avoid deadlock. */ + spin_unlock(&dev->lock); + value = usb_ep_queue(dev->in_ep, req, GFP_ATOMIC); + spin_lock(&dev->lock); + if (value) { ++ list_del(&req->list); + list_add(&req->list, &dev->tx_reqs); + spin_unlock_irqrestore(&dev->lock, flags); + mutex_unlock(&dev->lock_printer_io); + return -EAGAIN; + } +- +- list_add(&req->list, &dev->tx_reqs_active); +- + } + + spin_unlock_irqrestore(&dev->lock, flags); +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 6b3e8adb64e6..4cfa72cb0a91 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -623,6 +623,13 @@ static void usb3_disconnect(struct renesas_usb3 *usb3) + usb3_usb2_pullup(usb3, 0); + usb3_clear_bit(usb3, USB30_CON_B3_CONNECT, USB3_USB30_CON); + usb3_reset_epc(usb3); ++ usb3_disable_irq_1(usb3, USB_INT_1_B2_RSUM | USB_INT_1_B3_PLLWKUP | ++ USB_INT_1_B3_LUPSUCS | USB_INT_1_B3_DISABLE | ++ USB_INT_1_SPEED | USB_INT_1_B3_WRMRST | ++ USB_INT_1_B3_HOTRST | USB_INT_1_B2_SPND | ++ USB_INT_1_B2_L1SPND | USB_INT_1_B2_USBRST); ++ usb3_clear_bit(usb3, USB_COM_CON_SPD_MODE, USB3_USB_COM_CON); ++ usb3_init_epc_registers(usb3); + + if (usb3->driver) + usb3->driver->disconnect(&usb3->gadget); +diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c +index 25a281f876b5..33a6d624c843 100644 +--- a/drivers/usb/storage/uas.c ++++ b/drivers/usb/storage/uas.c +@@ -836,6 +836,12 @@ static int uas_slave_configure(struct scsi_device *sdev) + if (devinfo->flags & US_FL_BROKEN_FUA) + sdev->broken_fua = 1; + ++ /* UAS also needs to support FL_ALWAYS_SYNC */ ++ if (devinfo->flags & US_FL_ALWAYS_SYNC) { ++ sdev->skip_ms_page_3f = 1; ++ sdev->skip_ms_page_8 = 1; ++ sdev->wce_default_on = 1; ++ } + scsi_change_queue_depth(sdev, devinfo->qdepth - 2); + return 0; + } +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 52b3e6da0745..d100290628bd 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -2340,6 +2340,15 @@ UNUSUAL_DEV( 0x4146, 0xba01, 0x0100, 0x0100, + "Micro Mini 1GB", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE ), + ++/* "G-DRIVE" external HDD hangs on write without these. ++ * Patch submitted by Alexander Kappner ++ */ ++UNUSUAL_DEV(0x4971, 0x8024, 0x0000, 0x9999, ++ "SimpleTech", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_ALWAYS_SYNC), ++ + /* + * Nick Bowler + * SCSI stack spams (otherwise harmless) error messages. +diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h +index 719ec68ae309..f15aa47c54a9 100644 +--- a/drivers/usb/storage/unusual_uas.h ++++ b/drivers/usb/storage/unusual_uas.h +@@ -183,3 +183,12 @@ UNUSUAL_DEV(0x4971, 0x8017, 0x0000, 0x9999, + "External HDD", + USB_SC_DEVICE, USB_PR_DEVICE, NULL, + US_FL_NO_REPORT_OPCODES), ++ ++/* "G-DRIVE" external HDD hangs on write without these. ++ * Patch submitted by Alexander Kappner ++ */ ++UNUSUAL_DEV(0x4971, 0x8024, 0x0000, 0x9999, ++ "SimpleTech", ++ "External HDD", ++ USB_SC_DEVICE, USB_PR_DEVICE, NULL, ++ US_FL_ALWAYS_SYNC), +diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c +index 84df63e3130d..4a22a9f06d96 100644 +--- a/drivers/usb/usbip/vhci_sysfs.c ++++ b/drivers/usb/usbip/vhci_sysfs.c +@@ -24,6 +24,9 @@ + #include + #include + ++/* Hardening for Spectre-v1 */ ++#include ++ + #include "usbip_common.h" + #include "vhci.h" + +@@ -219,16 +222,20 @@ static int vhci_port_disconnect(struct vhci_hcd *vhci_hcd, __u32 rhport) + return 0; + } + +-static int valid_port(__u32 pdev_nr, __u32 rhport) ++static int valid_port(__u32 *pdev_nr, __u32 *rhport) + { +- if (pdev_nr >= vhci_num_controllers) { +- pr_err("pdev %u\n", pdev_nr); ++ if (*pdev_nr >= vhci_num_controllers) { ++ pr_err("pdev %u\n", *pdev_nr); + return 0; + } +- if (rhport >= VHCI_HC_PORTS) { +- pr_err("rhport %u\n", rhport); ++ *pdev_nr = array_index_nospec(*pdev_nr, vhci_num_controllers); ++ ++ if (*rhport >= VHCI_HC_PORTS) { ++ pr_err("rhport %u\n", *rhport); + return 0; + } ++ *rhport = array_index_nospec(*rhport, VHCI_HC_PORTS); ++ + return 1; + } + +@@ -246,7 +253,7 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr, + pdev_nr = port_to_pdev_nr(port); + rhport = port_to_rhport(port); + +- if (!valid_port(pdev_nr, rhport)) ++ if (!valid_port(&pdev_nr, &rhport)) + return -EINVAL; + + hcd = platform_get_drvdata(vhcis[pdev_nr].pdev); +@@ -272,7 +279,8 @@ static ssize_t store_detach(struct device *dev, struct device_attribute *attr, + } + static DEVICE_ATTR(detach, S_IWUSR, NULL, store_detach); + +-static int valid_args(__u32 pdev_nr, __u32 rhport, enum usb_device_speed speed) ++static int valid_args(__u32 *pdev_nr, __u32 *rhport, ++ enum usb_device_speed speed) + { + if (!valid_port(pdev_nr, rhport)) { + return 0; +@@ -336,7 +344,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr, + sockfd, devid, speed); + + /* check received parameters */ +- if (!valid_args(pdev_nr, rhport, speed)) ++ if (!valid_args(&pdev_nr, &rhport, speed)) + return -EINVAL; + + hcd = platform_get_drvdata(vhcis[pdev_nr].pdev); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 2ad693232f74..3b209cbfe1df 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -437,6 +437,24 @@ static int verify_address_len(const void *p) + return 0; + } + ++static inline int sadb_key_len(const struct sadb_key *key) ++{ ++ int key_bytes = DIV_ROUND_UP(key->sadb_key_bits, 8); ++ ++ return DIV_ROUND_UP(sizeof(struct sadb_key) + key_bytes, ++ sizeof(uint64_t)); ++} ++ ++static int verify_key_len(const void *p) ++{ ++ const struct sadb_key *key = p; ++ ++ if (sadb_key_len(key) > key->sadb_key_len) ++ return -EINVAL; ++ ++ return 0; ++} ++ + static inline int pfkey_sec_ctx_len(const struct sadb_x_sec_ctx *sec_ctx) + { + return DIV_ROUND_UP(sizeof(struct sadb_x_sec_ctx) + +@@ -533,16 +551,25 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void * + return -EINVAL; + if (ext_hdrs[ext_type-1] != NULL) + return -EINVAL; +- if (ext_type == SADB_EXT_ADDRESS_SRC || +- ext_type == SADB_EXT_ADDRESS_DST || +- ext_type == SADB_EXT_ADDRESS_PROXY || +- ext_type == SADB_X_EXT_NAT_T_OA) { ++ switch (ext_type) { ++ case SADB_EXT_ADDRESS_SRC: ++ case SADB_EXT_ADDRESS_DST: ++ case SADB_EXT_ADDRESS_PROXY: ++ case SADB_X_EXT_NAT_T_OA: + if (verify_address_len(p)) + return -EINVAL; +- } +- if (ext_type == SADB_X_EXT_SEC_CTX) { ++ break; ++ case SADB_X_EXT_SEC_CTX: + if (verify_sec_ctx_len(p)) + return -EINVAL; ++ break; ++ case SADB_EXT_KEY_AUTH: ++ case SADB_EXT_KEY_ENCRYPT: ++ if (verify_key_len(p)) ++ return -EINVAL; ++ break; ++ default: ++ break; + } + ext_hdrs[ext_type-1] = (void *) p; + } +@@ -1104,14 +1131,12 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + key = ext_hdrs[SADB_EXT_KEY_AUTH - 1]; + if (key != NULL && + sa->sadb_sa_auth != SADB_X_AALG_NULL && +- ((key->sadb_key_bits+7) / 8 == 0 || +- (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) ++ key->sadb_key_bits == 0) + return ERR_PTR(-EINVAL); + key = ext_hdrs[SADB_EXT_KEY_ENCRYPT-1]; + if (key != NULL && + sa->sadb_sa_encrypt != SADB_EALG_NULL && +- ((key->sadb_key_bits+7) / 8 == 0 || +- (key->sadb_key_bits+7) / 8 > key->sadb_key_len * sizeof(uint64_t))) ++ key->sadb_key_bits == 0) + return ERR_PTR(-EINVAL); + + x = xfrm_state_alloc(net); +diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c +index bd0975d7dd6f..5e0d367a0988 100644 +--- a/net/netfilter/nft_ct.c ++++ b/net/netfilter/nft_ct.c +@@ -875,22 +875,26 @@ static int nft_ct_helper_obj_dump(struct sk_buff *skb, + struct nft_object *obj, bool reset) + { + const struct nft_ct_helper_obj *priv = nft_obj_data(obj); +- const struct nf_conntrack_helper *helper = priv->helper4; ++ const struct nf_conntrack_helper *helper; + u16 family; + ++ if (priv->helper4 && priv->helper6) { ++ family = NFPROTO_INET; ++ helper = priv->helper4; ++ } else if (priv->helper6) { ++ family = NFPROTO_IPV6; ++ helper = priv->helper6; ++ } else { ++ family = NFPROTO_IPV4; ++ helper = priv->helper4; ++ } ++ + if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name)) + return -1; + + if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto)) + return -1; + +- if (priv->helper4 && priv->helper6) +- family = NFPROTO_INET; +- else if (priv->helper6) +- family = NFPROTO_IPV6; +- else +- family = NFPROTO_IPV4; +- + if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family))) + return -1; + diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.50-51.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.50-51.patch new file mode 100644 index 000000000000..30c0ca20df87 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.50-51.patch @@ -0,0 +1,6337 @@ +diff --git a/Documentation/devicetree/bindings/display/panel/panel-common.txt b/Documentation/devicetree/bindings/display/panel/panel-common.txt +index ec52c472c845..0603af877155 100644 +--- a/Documentation/devicetree/bindings/display/panel/panel-common.txt ++++ b/Documentation/devicetree/bindings/display/panel/panel-common.txt +@@ -38,7 +38,7 @@ Display Timings + require specific display timings. The panel-timing subnode expresses those + timings as specified in the timing subnode section of the display timing + bindings defined in +- Documentation/devicetree/bindings/display/display-timing.txt. ++ Documentation/devicetree/bindings/display/panel/display-timing.txt. + + + Connectivity +diff --git a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt +index 891db41e9420..98d7898fcd78 100644 +--- a/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt ++++ b/Documentation/devicetree/bindings/dma/renesas,rcar-dmac.txt +@@ -25,6 +25,7 @@ Required Properties: + - "renesas,dmac-r8a7794" (R-Car E2) + - "renesas,dmac-r8a7795" (R-Car H3) + - "renesas,dmac-r8a7796" (R-Car M3-W) ++ - "renesas,dmac-r8a77965" (R-Car M3-N) + - "renesas,dmac-r8a77970" (R-Car V3M) + + - reg: base address and length of the registers block for the DMAC +diff --git a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt +index 6f2ec9af0de2..dee9520224a9 100644 +--- a/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/allwinner,sunxi-pinctrl.txt +@@ -55,9 +55,9 @@ pins it needs, and how they should be configured, with regard to muxer + configuration, drive strength and pullups. If one of these options is + not set, its actual value will be unspecified. + +-This driver supports the generic pin multiplexing and configuration +-bindings. For details on each properties, you can refer to +-./pinctrl-bindings.txt. ++Allwinner A1X Pin Controller supports the generic pin multiplexing and ++configuration bindings. For details on each properties, you can refer to ++ ./pinctrl-bindings.txt. + + Required sub-node properties: + - pins +diff --git a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt +index 8ff65fa632fd..c06c045126fc 100644 +--- a/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt ++++ b/Documentation/devicetree/bindings/serial/amlogic,meson-uart.txt +@@ -21,7 +21,7 @@ Required properties: + - interrupts : identifier to the device interrupt + - clocks : a list of phandle + clock-specifier pairs, one for each + entry in clock names. +-- clocks-names : ++- clock-names : + * "xtal" for external xtal clock identifier + * "pclk" for the bus core clock, either the clk81 clock or the gate clock + * "baud" for the source of the baudrate generator, can be either the xtal +diff --git a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt +index cf504d0380ae..88f947c47adc 100644 +--- a/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt ++++ b/Documentation/devicetree/bindings/serial/renesas,sci-serial.txt +@@ -41,6 +41,8 @@ Required properties: + - "renesas,hscif-r8a7795" for R8A7795 (R-Car H3) HSCIF compatible UART. + - "renesas,scif-r8a7796" for R8A7796 (R-Car M3-W) SCIF compatible UART. + - "renesas,hscif-r8a7796" for R8A7796 (R-Car M3-W) HSCIF compatible UART. ++ - "renesas,scif-r8a77965" for R8A77965 (R-Car M3-N) SCIF compatible UART. ++ - "renesas,hscif-r8a77965" for R8A77965 (R-Car M3-N) HSCIF compatible UART. + - "renesas,scif-r8a77970" for R8A77970 (R-Car V3M) SCIF compatible UART. + - "renesas,hscif-r8a77970" for R8A77970 (R-Car V3M) HSCIF compatible UART. + - "renesas,scif-r8a77995" for R8A77995 (R-Car D3) SCIF compatible UART. +diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt +index 1afd298eddd7..f4a98c85340a 100644 +--- a/Documentation/devicetree/bindings/vendor-prefixes.txt ++++ b/Documentation/devicetree/bindings/vendor-prefixes.txt +@@ -172,6 +172,7 @@ karo Ka-Ro electronics GmbH + keithkoep Keith & Koep GmbH + keymile Keymile GmbH + khadas Khadas ++kiebackpeter Kieback & Peter GmbH + kinetic Kinetic Technologies + kingnovel Kingnovel Technology Co., Ltd. + kosagi Sutajio Ko-Usagi PTE Ltd. +diff --git a/Makefile b/Makefile +index 84374c5ba60e..a33376204c17 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 50 ++SUBLEVEL = 51 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/compressed/head.S b/arch/arm/boot/compressed/head.S +index 8a756870c238..5f687ba1eaa7 100644 +--- a/arch/arm/boot/compressed/head.S ++++ b/arch/arm/boot/compressed/head.S +@@ -29,19 +29,19 @@ + #if defined(CONFIG_DEBUG_ICEDCC) + + #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_V6K) || defined(CONFIG_CPU_V7) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c0, c5, 0 + .endm + #elif defined(CONFIG_CPU_XSCALE) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c8, c0, 0 + .endm + #else +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + .endm + .macro writeb, ch, rb + mcr p14, 0, \ch, c1, c0, 0 +@@ -57,7 +57,7 @@ + .endm + + #if defined(CONFIG_ARCH_SA1100) +- .macro loadsp, rb, tmp ++ .macro loadsp, rb, tmp1, tmp2 + mov \rb, #0x80000000 @ physical base address + #ifdef CONFIG_DEBUG_LL_SER3 + add \rb, \rb, #0x00050000 @ Ser3 +@@ -66,8 +66,8 @@ + #endif + .endm + #else +- .macro loadsp, rb, tmp +- addruart \rb, \tmp ++ .macro loadsp, rb, tmp1, tmp2 ++ addruart \rb, \tmp1, \tmp2 + .endm + #endif + #endif +@@ -559,8 +559,6 @@ not_relocated: mov r0, #0 + bl decompress_kernel + bl cache_clean_flush + bl cache_off +- mov r1, r7 @ restore architecture number +- mov r2, r8 @ restore atags pointer + + #ifdef CONFIG_ARM_VIRT_EXT + mrs r0, spsr @ Get saved CPU boot mode +@@ -1295,7 +1293,7 @@ phex: adr r3, phexbuf + b 1b + + @ puts corrupts {r0, r1, r2, r3} +-puts: loadsp r3, r1 ++puts: loadsp r3, r2, r1 + 1: ldrb r2, [r0], #1 + teq r2, #0 + moveq pc, lr +@@ -1312,8 +1310,8 @@ puts: loadsp r3, r1 + @ putc corrupts {r0, r1, r2, r3} + putc: + mov r2, r0 ++ loadsp r3, r1, r0 + mov r0, #0 +- loadsp r3, r1 + b 2b + + @ memdump corrupts {r0, r1, r2, r3, r10, r11, r12, lr} +@@ -1363,6 +1361,8 @@ __hyp_reentry_vectors: + + __enter_kernel: + mov r0, #0 @ must be 0 ++ mov r1, r7 @ restore architecture number ++ mov r2, r8 @ restore atags pointer + ARM( mov pc, r4 ) @ call kernel + M_CLASS( add r4, r4, #1 ) @ enter in Thumb mode for M class + THUMB( bx r4 ) @ entry point is always ARM for A/R classes +diff --git a/arch/arm/boot/dts/bcm-cygnus.dtsi b/arch/arm/boot/dts/bcm-cygnus.dtsi +index 7c957ea06c66..9a9902974b1b 100644 +--- a/arch/arm/boot/dts/bcm-cygnus.dtsi ++++ b/arch/arm/boot/dts/bcm-cygnus.dtsi +@@ -69,7 +69,7 @@ + timer@20200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0x20200 0x100>; +- interrupts = ; ++ interrupts = ; + clocks = <&periph_clk>; + }; + +diff --git a/arch/arm/boot/dts/da850.dtsi b/arch/arm/boot/dts/da850.dtsi +index af68ef7b0caa..8a15f7193c82 100644 +--- a/arch/arm/boot/dts/da850.dtsi ++++ b/arch/arm/boot/dts/da850.dtsi +@@ -34,8 +34,6 @@ + pmx_core: pinmux@14120 { + compatible = "pinctrl-single"; + reg = <0x14120 0x50>; +- #address-cells = <1>; +- #size-cells = <0>; + #pinctrl-cells = <2>; + pinctrl-single,bit-per-mux; + pinctrl-single,register-width = <32>; +diff --git a/arch/arm/boot/dts/logicpd-som-lv.dtsi b/arch/arm/boot/dts/logicpd-som-lv.dtsi +index e262fa9ef334..c335b923753a 100644 +--- a/arch/arm/boot/dts/logicpd-som-lv.dtsi ++++ b/arch/arm/boot/dts/logicpd-som-lv.dtsi +@@ -26,7 +26,7 @@ + gpio = <&gpio1 3 0>; /* gpio_3 */ + startup-delay-us = <70000>; + enable-active-high; +- vin-supply = <&vmmc2>; ++ vin-supply = <&vaux3>; + }; + + /* HS USB Host PHY on PORT 1 */ +@@ -108,6 +108,7 @@ + twl_audio: audio { + compatible = "ti,twl4030-audio"; + codec { ++ ti,hs_extmute_gpio = <&gpio2 25 GPIO_ACTIVE_HIGH>; + }; + }; + }; +@@ -221,6 +222,7 @@ + pinctrl-single,pins = < + OMAP3_CORE1_IOPAD(0x21ba, PIN_INPUT | MUX_MODE0) /* i2c1_scl.i2c1_scl */ + OMAP3_CORE1_IOPAD(0x21bc, PIN_INPUT | MUX_MODE0) /* i2c1_sda.i2c1_sda */ ++ OMAP3_CORE1_IOPAD(0x20ba, PIN_OUTPUT | MUX_MODE4) /* gpmc_ncs6.gpio_57 */ + >; + }; + }; +@@ -235,7 +237,7 @@ + }; + wl127x_gpio: pinmux_wl127x_gpio_pin { + pinctrl-single,pins = < +- OMAP3_WKUP_IOPAD(0x2a0c, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ ++ OMAP3_WKUP_IOPAD(0x2a0a, PIN_INPUT | MUX_MODE4) /* sys_boot0.gpio_2 */ + OMAP3_WKUP_IOPAD(0x2a0c, PIN_OUTPUT | MUX_MODE4) /* sys_boot1.gpio_3 */ + >; + }; +@@ -270,6 +272,11 @@ + #include "twl4030.dtsi" + #include "twl4030_omap3.dtsi" + ++&vaux3 { ++ regulator-min-microvolt = <2800000>; ++ regulator-max-microvolt = <2800000>; ++}; ++ + &twl { + twl_power: power { + compatible = "ti,twl4030-power-idle-osc-off", "ti,twl4030-power-idle"; +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index 6b38d7a634c1..c15318431986 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -95,6 +95,27 @@ void machine_crash_nonpanic_core(void *unused) + cpu_relax(); + } + ++void crash_smp_send_stop(void) ++{ ++ static int cpus_stopped; ++ unsigned long msecs; ++ ++ if (cpus_stopped) ++ return; ++ ++ atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); ++ smp_call_function(machine_crash_nonpanic_core, NULL, false); ++ msecs = 1000; /* Wait at most a second for the other cpus to stop */ ++ while ((atomic_read(&waiting_for_crash_ipi) > 0) && msecs) { ++ mdelay(1); ++ msecs--; ++ } ++ if (atomic_read(&waiting_for_crash_ipi) > 0) ++ pr_warn("Non-crashing CPUs did not react to IPI\n"); ++ ++ cpus_stopped = 1; ++} ++ + static void machine_kexec_mask_interrupts(void) + { + unsigned int i; +@@ -120,19 +141,8 @@ static void machine_kexec_mask_interrupts(void) + + void machine_crash_shutdown(struct pt_regs *regs) + { +- unsigned long msecs; +- + local_irq_disable(); +- +- atomic_set(&waiting_for_crash_ipi, num_online_cpus() - 1); +- smp_call_function(machine_crash_nonpanic_core, NULL, false); +- msecs = 1000; /* Wait at most a second for the other cpus to stop */ +- while ((atomic_read(&waiting_for_crash_ipi) > 0) && msecs) { +- mdelay(1); +- msecs--; +- } +- if (atomic_read(&waiting_for_crash_ipi) > 0) +- pr_warn("Non-crashing CPUs did not react to IPI\n"); ++ crash_smp_send_stop(); + + crash_save_cpu(regs, smp_processor_id()); + machine_kexec_mask_interrupts(); +diff --git a/arch/arm/mach-davinci/board-da830-evm.c b/arch/arm/mach-davinci/board-da830-evm.c +index f673cd7a6766..fb7c44cdadcb 100644 +--- a/arch/arm/mach-davinci/board-da830-evm.c ++++ b/arch/arm/mach-davinci/board-da830-evm.c +@@ -205,12 +205,17 @@ static const short da830_evm_mmc_sd_pins[] = { + -1 + }; + ++#define DA830_MMCSD_WP_PIN GPIO_TO_PIN(2, 1) ++#define DA830_MMCSD_CD_PIN GPIO_TO_PIN(2, 2) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 1 contains gpio range 32-63 */ +- GPIO_LOOKUP("davinci_gpio.1", 2, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.1", 1, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA830_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/board-da850-evm.c b/arch/arm/mach-davinci/board-da850-evm.c +index cbde0030c092..25f12118c364 100644 +--- a/arch/arm/mach-davinci/board-da850-evm.c ++++ b/arch/arm/mach-davinci/board-da850-evm.c +@@ -763,12 +763,17 @@ static const short da850_evm_mcasp_pins[] __initconst = { + -1 + }; + ++#define DA850_MMCSD_CD_PIN GPIO_TO_PIN(4, 0) ++#define DA850_MMCSD_WP_PIN GPIO_TO_PIN(4, 1) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { + /* gpio chip 2 contains gpio range 64-95 */ +- GPIO_LOOKUP("davinci_gpio.2", 0, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.2", 1, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/board-dm355-evm.c b/arch/arm/mach-davinci/board-dm355-evm.c +index 62e7bc3018f0..8e64685b1941 100644 +--- a/arch/arm/mach-davinci/board-dm355-evm.c ++++ b/arch/arm/mach-davinci/board-dm355-evm.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -168,11 +169,16 @@ static struct resource dm355evm_dm9000_rsrc[] = { + }, + }; + ++static struct dm9000_plat_data dm335evm_dm9000_platdata; ++ + static struct platform_device dm355evm_dm9000 = { + .name = "dm9000", + .id = -1, + .resource = dm355evm_dm9000_rsrc, + .num_resources = ARRAY_SIZE(dm355evm_dm9000_rsrc), ++ .dev = { ++ .platform_data = &dm335evm_dm9000_platdata, ++ }, + }; + + static struct tvp514x_platform_data tvp5146_pdata = { +diff --git a/arch/arm/mach-davinci/board-dm646x-evm.c b/arch/arm/mach-davinci/board-dm646x-evm.c +index cb0a41e83582..4c458f714101 100644 +--- a/arch/arm/mach-davinci/board-dm646x-evm.c ++++ b/arch/arm/mach-davinci/board-dm646x-evm.c +@@ -534,11 +534,12 @@ static struct vpif_display_config dm646x_vpif_display_config = { + .set_clock = set_vpif_clock, + .subdevinfo = dm646x_vpif_subdev, + .subdev_count = ARRAY_SIZE(dm646x_vpif_subdev), ++ .i2c_adapter_id = 1, + .chan_config[0] = { + .outputs = dm6467_ch0_outputs, + .output_count = ARRAY_SIZE(dm6467_ch0_outputs), + }, +- .card_name = "DM646x EVM", ++ .card_name = "DM646x EVM Video Display", + }; + + /** +@@ -676,6 +677,7 @@ static struct vpif_capture_config dm646x_vpif_capture_cfg = { + .setup_input_channel_mode = setup_vpif_input_channel_mode, + .subdev_info = vpif_capture_sdev_info, + .subdev_count = ARRAY_SIZE(vpif_capture_sdev_info), ++ .i2c_adapter_id = 1, + .chan_config[0] = { + .inputs = dm6467_ch0_inputs, + .input_count = ARRAY_SIZE(dm6467_ch0_inputs), +@@ -696,6 +698,7 @@ static struct vpif_capture_config dm646x_vpif_capture_cfg = { + .fid_pol = 0, + }, + }, ++ .card_name = "DM646x EVM Video Capture", + }; + + static void __init evm_init_video(void) +diff --git a/arch/arm/mach-davinci/board-omapl138-hawk.c b/arch/arm/mach-davinci/board-omapl138-hawk.c +index 62eb7d668890..10a027253250 100644 +--- a/arch/arm/mach-davinci/board-omapl138-hawk.c ++++ b/arch/arm/mach-davinci/board-omapl138-hawk.c +@@ -123,12 +123,16 @@ static const short hawk_mmcsd0_pins[] = { + -1 + }; + ++#define DA850_HAWK_MMCSD_CD_PIN GPIO_TO_PIN(3, 12) ++#define DA850_HAWK_MMCSD_WP_PIN GPIO_TO_PIN(3, 13) ++ + static struct gpiod_lookup_table mmc_gpios_table = { + .dev_id = "da830-mmc.0", + .table = { +- /* CD: gpio3_12: gpio60: chip 1 contains gpio range 32-63*/ +- GPIO_LOOKUP("davinci_gpio.0", 28, "cd", GPIO_ACTIVE_LOW), +- GPIO_LOOKUP("davinci_gpio.0", 29, "wp", GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_CD_PIN, "cd", ++ GPIO_ACTIVE_LOW), ++ GPIO_LOOKUP("davinci_gpio.0", DA850_HAWK_MMCSD_WP_PIN, "wp", ++ GPIO_ACTIVE_LOW), + }, + }; + +diff --git a/arch/arm/mach-davinci/dm646x.c b/arch/arm/mach-davinci/dm646x.c +index da21353cac45..d869369ca2bc 100644 +--- a/arch/arm/mach-davinci/dm646x.c ++++ b/arch/arm/mach-davinci/dm646x.c +@@ -495,7 +495,8 @@ static u8 dm646x_default_priorities[DAVINCI_N_AINTC_IRQ] = { + [IRQ_DM646X_MCASP0TXINT] = 7, + [IRQ_DM646X_MCASP0RXINT] = 7, + [IRQ_DM646X_RESERVED_3] = 7, +- [IRQ_DM646X_MCASP1TXINT] = 7, /* clockevent */ ++ [IRQ_DM646X_MCASP1TXINT] = 7, ++ [IRQ_TINT0_TINT12] = 7, /* clockevent */ + [IRQ_TINT0_TINT34] = 7, /* clocksource */ + [IRQ_TINT1_TINT12] = 7, /* DSP timer */ + [IRQ_TINT1_TINT34] = 7, /* system tick */ +diff --git a/arch/arm/mach-keystone/pm_domain.c b/arch/arm/mach-keystone/pm_domain.c +index fe57e2692629..abca83d22ff3 100644 +--- a/arch/arm/mach-keystone/pm_domain.c ++++ b/arch/arm/mach-keystone/pm_domain.c +@@ -29,6 +29,7 @@ static struct dev_pm_domain keystone_pm_domain = { + + static struct pm_clk_notifier_block platform_domain_notifier = { + .pm_domain = &keystone_pm_domain, ++ .con_ids = { NULL }, + }; + + static const struct of_device_id of_keystone_table[] = { +diff --git a/arch/arm/mach-omap1/ams-delta-fiq.c b/arch/arm/mach-omap1/ams-delta-fiq.c +index 793a24a53c52..d7ca9e2b40d2 100644 +--- a/arch/arm/mach-omap1/ams-delta-fiq.c ++++ b/arch/arm/mach-omap1/ams-delta-fiq.c +@@ -58,22 +58,24 @@ static irqreturn_t deferred_fiq(int irq, void *dev_id) + irq_num = gpio_to_irq(gpio); + fiq_count = fiq_buffer[FIQ_CNT_INT_00 + gpio]; + +- while (irq_counter[gpio] < fiq_count) { +- if (gpio != AMS_DELTA_GPIO_PIN_KEYBRD_CLK) { +- struct irq_data *d = irq_get_irq_data(irq_num); +- +- /* +- * It looks like handle_edge_irq() that +- * OMAP GPIO edge interrupts default to, +- * expects interrupt already unmasked. +- */ +- if (irq_chip && irq_chip->irq_unmask) ++ if (irq_counter[gpio] < fiq_count && ++ gpio != AMS_DELTA_GPIO_PIN_KEYBRD_CLK) { ++ struct irq_data *d = irq_get_irq_data(irq_num); ++ ++ /* ++ * handle_simple_irq() that OMAP GPIO edge ++ * interrupts default to since commit 80ac93c27441 ++ * requires interrupt already acked and unmasked. ++ */ ++ if (irq_chip) { ++ if (irq_chip->irq_ack) ++ irq_chip->irq_ack(d); ++ if (irq_chip->irq_unmask) + irq_chip->irq_unmask(d); + } +- generic_handle_irq(irq_num); +- +- irq_counter[gpio]++; + } ++ for (; irq_counter[gpio] < fiq_count; irq_counter[gpio]++) ++ generic_handle_irq(irq_num); + } + return IRQ_HANDLED; + } +diff --git a/arch/arm/mach-omap2/powerdomain.c b/arch/arm/mach-omap2/powerdomain.c +index 76eb6ec5f157..1e6a967cd2d5 100644 +--- a/arch/arm/mach-omap2/powerdomain.c ++++ b/arch/arm/mach-omap2/powerdomain.c +@@ -188,7 +188,7 @@ static int _pwrdm_state_switch(struct powerdomain *pwrdm, int flag) + ((prev & OMAP_POWERSTATE_MASK) << 0)); + trace_power_domain_target_rcuidle(pwrdm->name, + trace_state, +- smp_processor_id()); ++ raw_smp_processor_id()); + } + break; + default: +@@ -518,7 +518,7 @@ int pwrdm_set_next_pwrst(struct powerdomain *pwrdm, u8 pwrst) + if (arch_pwrdm && arch_pwrdm->pwrdm_set_next_pwrst) { + /* Trace the pwrdm desired target state */ + trace_power_domain_target_rcuidle(pwrdm->name, pwrst, +- smp_processor_id()); ++ raw_smp_processor_id()); + /* Program the pwrdm desired target state */ + ret = arch_pwrdm->pwrdm_set_next_pwrst(pwrdm, pwrst); + } +diff --git a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi +index 54f418d05e15..2306b1a0c09a 100644 +--- a/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi ++++ b/arch/arm64/boot/dts/nvidia/tegra186-p3310.dtsi +@@ -46,7 +46,7 @@ + compatible = "ethernet-phy-ieee802.3-c22"; + reg = <0x0>; + interrupt-parent = <&gpio>; +- interrupts = ; ++ interrupts = ; + }; + }; + }; +diff --git a/arch/arm64/include/asm/cputype.h b/arch/arm64/include/asm/cputype.h +index 30da0918d046..04569aa267fd 100644 +--- a/arch/arm64/include/asm/cputype.h ++++ b/arch/arm64/include/asm/cputype.h +@@ -75,6 +75,7 @@ + #define ARM_CPU_IMP_CAVIUM 0x43 + #define ARM_CPU_IMP_BRCM 0x42 + #define ARM_CPU_IMP_QCOM 0x51 ++#define ARM_CPU_IMP_NVIDIA 0x4E + + #define ARM_CPU_PART_AEM_V8 0xD0F + #define ARM_CPU_PART_FOUNDATION 0xD00 +@@ -98,6 +99,9 @@ + #define QCOM_CPU_PART_FALKOR 0xC00 + #define QCOM_CPU_PART_KRYO 0x200 + ++#define NVIDIA_CPU_PART_DENVER 0x003 ++#define NVIDIA_CPU_PART_CARMEL 0x004 ++ + #define MIDR_CORTEX_A53 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A53) + #define MIDR_CORTEX_A55 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A55) + #define MIDR_CORTEX_A57 MIDR_CPU_MODEL(ARM_CPU_IMP_ARM, ARM_CPU_PART_CORTEX_A57) +@@ -112,6 +116,8 @@ + #define MIDR_QCOM_FALKOR_V1 MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR_V1) + #define MIDR_QCOM_FALKOR MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_FALKOR) + #define MIDR_QCOM_KRYO MIDR_CPU_MODEL(ARM_CPU_IMP_QCOM, QCOM_CPU_PART_KRYO) ++#define MIDR_NVIDIA_DENVER MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_DENVER) ++#define MIDR_NVIDIA_CARMEL MIDR_CPU_MODEL(ARM_CPU_IMP_NVIDIA, NVIDIA_CPU_PART_CARMEL) + + #ifndef __ASSEMBLY__ + +diff --git a/arch/arm64/kernel/ptrace.c b/arch/arm64/kernel/ptrace.c +index 9cbb6123208f..edaf346d13d5 100644 +--- a/arch/arm64/kernel/ptrace.c ++++ b/arch/arm64/kernel/ptrace.c +@@ -25,6 +25,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -247,15 +248,20 @@ static struct perf_event *ptrace_hbp_get_event(unsigned int note_type, + + switch (note_type) { + case NT_ARM_HW_BREAK: +- if (idx < ARM_MAX_BRP) +- bp = tsk->thread.debug.hbp_break[idx]; ++ if (idx >= ARM_MAX_BRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_BRP); ++ bp = tsk->thread.debug.hbp_break[idx]; + break; + case NT_ARM_HW_WATCH: +- if (idx < ARM_MAX_WRP) +- bp = tsk->thread.debug.hbp_watch[idx]; ++ if (idx >= ARM_MAX_WRP) ++ goto out; ++ idx = array_index_nospec(idx, ARM_MAX_WRP); ++ bp = tsk->thread.debug.hbp_watch[idx]; + break; + } + ++out: + return bp; + } + +@@ -1194,9 +1200,7 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, + { + int ret; + u32 kdata; +- mm_segment_t old_fs = get_fs(); + +- set_fs(KERNEL_DS); + /* Watchpoint */ + if (num < 0) { + ret = compat_ptrace_hbp_get(NT_ARM_HW_WATCH, tsk, num, &kdata); +@@ -1207,7 +1211,6 @@ static int compat_ptrace_gethbpregs(struct task_struct *tsk, compat_long_t num, + } else { + ret = compat_ptrace_hbp_get(NT_ARM_HW_BREAK, tsk, num, &kdata); + } +- set_fs(old_fs); + + if (!ret) + ret = put_user(kdata, data); +@@ -1220,7 +1223,6 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, + { + int ret; + u32 kdata = 0; +- mm_segment_t old_fs = get_fs(); + + if (num == 0) + return 0; +@@ -1229,12 +1231,10 @@ static int compat_ptrace_sethbpregs(struct task_struct *tsk, compat_long_t num, + if (ret) + return ret; + +- set_fs(KERNEL_DS); + if (num < 0) + ret = compat_ptrace_hbp_set(NT_ARM_HW_WATCH, tsk, num, &kdata); + else + ret = compat_ptrace_hbp_set(NT_ARM_HW_BREAK, tsk, num, &kdata); +- set_fs(old_fs); + + return ret; + } +diff --git a/arch/hexagon/include/asm/io.h b/arch/hexagon/include/asm/io.h +index 66f5e9a61efc..7288e31d3713 100644 +--- a/arch/hexagon/include/asm/io.h ++++ b/arch/hexagon/include/asm/io.h +@@ -216,6 +216,12 @@ static inline void memcpy_toio(volatile void __iomem *dst, const void *src, + memcpy((void *) dst, src, count); + } + ++static inline void memset_io(volatile void __iomem *addr, int value, ++ size_t size) ++{ ++ memset((void __force *)addr, value, size); ++} ++ + #define PCI_IO_ADDR (volatile void __iomem *) + + /* +diff --git a/arch/hexagon/lib/checksum.c b/arch/hexagon/lib/checksum.c +index 617506d1a559..7cd0a2259269 100644 +--- a/arch/hexagon/lib/checksum.c ++++ b/arch/hexagon/lib/checksum.c +@@ -199,3 +199,4 @@ csum_partial_copy_nocheck(const void *src, void *dst, int len, __wsum sum) + memcpy(dst, src, len); + return csum_partial(dst, len, sum); + } ++EXPORT_SYMBOL(csum_partial_copy_nocheck); +diff --git a/arch/mips/boot/dts/img/boston.dts b/arch/mips/boot/dts/img/boston.dts +index 2cd49b60e030..f7aad80c69ab 100644 +--- a/arch/mips/boot/dts/img/boston.dts ++++ b/arch/mips/boot/dts/img/boston.dts +@@ -51,6 +51,8 @@ + ranges = <0x02000000 0 0x40000000 + 0x40000000 0 0x40000000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci0_intc 1>, + <0 0 0 2 &pci0_intc 2>, +@@ -79,6 +81,8 @@ + ranges = <0x02000000 0 0x20000000 + 0x20000000 0 0x20000000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci1_intc 1>, + <0 0 0 2 &pci1_intc 2>, +@@ -107,6 +111,8 @@ + ranges = <0x02000000 0 0x16000000 + 0x16000000 0 0x100000>; + ++ bus-range = <0x00 0xff>; ++ + interrupt-map-mask = <0 0 0 7>; + interrupt-map = <0 0 0 1 &pci2_intc 1>, + <0 0 0 2 &pci2_intc 2>, +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index 0cbf3af37eca..a7d0b836f2f7 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -307,7 +307,7 @@ static inline void iounmap(const volatile void __iomem *addr) + #if defined(CONFIG_CPU_CAVIUM_OCTEON) || defined(CONFIG_LOONGSON3_ENHANCEMENT) + #define war_io_reorder_wmb() wmb() + #else +-#define war_io_reorder_wmb() do { } while (0) ++#define war_io_reorder_wmb() barrier() + #endif + + #define __BUILD_MEMORY_SINGLE(pfx, bwlq, type, irq) \ +@@ -377,6 +377,8 @@ static inline type pfx##read##bwlq(const volatile void __iomem *mem) \ + BUG(); \ + } \ + \ ++ /* prevent prefetching of coherent DMA data prematurely */ \ ++ rmb(); \ + return pfx##ioswab##bwlq(__mem, __val); \ + } + +diff --git a/arch/parisc/kernel/drivers.c b/arch/parisc/kernel/drivers.c +index 513826a43efd..6a71d3151a23 100644 +--- a/arch/parisc/kernel/drivers.c ++++ b/arch/parisc/kernel/drivers.c +@@ -448,7 +448,8 @@ static int match_by_id(struct device * dev, void * data) + * Checks all the children of @parent for a matching @id. If none + * found, it allocates a new device and returns it. + */ +-static struct parisc_device * alloc_tree_node(struct device *parent, char id) ++static struct parisc_device * __init alloc_tree_node( ++ struct device *parent, char id) + { + struct match_id_data d = { + .id = id, +@@ -825,8 +826,8 @@ void walk_lower_bus(struct parisc_device *dev) + * devices which are not physically connected (such as extra serial & + * keyboard ports). This problem is not yet solved. + */ +-static void walk_native_bus(unsigned long io_io_low, unsigned long io_io_high, +- struct device *parent) ++static void __init walk_native_bus(unsigned long io_io_low, ++ unsigned long io_io_high, struct device *parent) + { + int i, devices_found = 0; + unsigned long hpa = io_io_low; +diff --git a/arch/parisc/kernel/smp.c b/arch/parisc/kernel/smp.c +index 30c28ab14540..ab4d5580bb02 100644 +--- a/arch/parisc/kernel/smp.c ++++ b/arch/parisc/kernel/smp.c +@@ -418,8 +418,7 @@ int __cpu_up(unsigned int cpu, struct task_struct *tidle) + } + + #ifdef CONFIG_PROC_FS +-int __init +-setup_profiling_timer(unsigned int multiplier) ++int setup_profiling_timer(unsigned int multiplier) + { + return -EINVAL; + } +diff --git a/arch/parisc/kernel/time.c b/arch/parisc/kernel/time.c +index f7e684560186..42a873226a04 100644 +--- a/arch/parisc/kernel/time.c ++++ b/arch/parisc/kernel/time.c +@@ -205,7 +205,7 @@ static int __init rtc_init(void) + device_initcall(rtc_init); + #endif + +-void read_persistent_clock(struct timespec *ts) ++void read_persistent_clock64(struct timespec64 *ts) + { + static struct pdc_tod tod_data; + if (pdc_tod_read(&tod_data) == 0) { +diff --git a/arch/powerpc/platforms/powernv/memtrace.c b/arch/powerpc/platforms/powernv/memtrace.c +index de470caf0784..fc222a0c2ac4 100644 +--- a/arch/powerpc/platforms/powernv/memtrace.c ++++ b/arch/powerpc/platforms/powernv/memtrace.c +@@ -82,19 +82,6 @@ static const struct file_operations memtrace_fops = { + .open = simple_open, + }; + +-static void flush_memory_region(u64 base, u64 size) +-{ +- unsigned long line_size = ppc64_caches.l1d.size; +- u64 end = base + size; +- u64 addr; +- +- base = round_down(base, line_size); +- end = round_up(end, line_size); +- +- for (addr = base; addr < end; addr += line_size) +- asm volatile("dcbf 0,%0" : "=r" (addr) :: "memory"); +-} +- + static int check_memblock_online(struct memory_block *mem, void *arg) + { + if (mem->state != MEM_ONLINE) +@@ -132,10 +119,6 @@ static bool memtrace_offline_pages(u32 nid, u64 start_pfn, u64 nr_pages) + walk_memory_range(start_pfn, end_pfn, (void *)MEM_OFFLINE, + change_memblock_state); + +- /* RCU grace period? */ +- flush_memory_region((u64)__va(start_pfn << PAGE_SHIFT), +- nr_pages << PAGE_SHIFT); +- + lock_device_hotplug(); + remove_memory(nid, start_pfn << PAGE_SHIFT, nr_pages << PAGE_SHIFT); + unlock_device_hotplug(); +diff --git a/arch/sh/kernel/cpu/sh2/probe.c b/arch/sh/kernel/cpu/sh2/probe.c +index 4205f6d42b69..a5bd03642678 100644 +--- a/arch/sh/kernel/cpu/sh2/probe.c ++++ b/arch/sh/kernel/cpu/sh2/probe.c +@@ -43,7 +43,11 @@ void __ref cpu_probe(void) + #endif + + #if defined(CONFIG_CPU_J2) ++#if defined(CONFIG_SMP) + unsigned cpu = hard_smp_processor_id(); ++#else ++ unsigned cpu = 0; ++#endif + if (cpu == 0) of_scan_flat_dt(scan_cache, NULL); + if (j2_ccr_base) __raw_writel(0x80000303, j2_ccr_base + 4*cpu); + if (cpu != 0) return; +diff --git a/arch/x86/events/intel/core.c b/arch/x86/events/intel/core.c +index 6965ee8c4b8a..228732654cfe 100644 +--- a/arch/x86/events/intel/core.c ++++ b/arch/x86/events/intel/core.c +@@ -3331,7 +3331,8 @@ static void intel_pmu_cpu_starting(int cpu) + + cpuc->lbr_sel = NULL; + +- flip_smm_bit(&x86_pmu.attr_freeze_on_smi); ++ if (x86_pmu.version > 1) ++ flip_smm_bit(&x86_pmu.attr_freeze_on_smi); + + if (!cpuc->shared_regs) + return; +@@ -3494,6 +3495,8 @@ static __initconst const struct x86_pmu core_pmu = { + .cpu_dying = intel_pmu_cpu_dying, + }; + ++static struct attribute *intel_pmu_attrs[]; ++ + static __initconst const struct x86_pmu intel_pmu = { + .name = "Intel", + .handle_irq = intel_pmu_handle_irq, +@@ -3524,6 +3527,8 @@ static __initconst const struct x86_pmu intel_pmu = { + .format_attrs = intel_arch3_formats_attr, + .events_sysfs_show = intel_event_sysfs_show, + ++ .attrs = intel_pmu_attrs, ++ + .cpu_prepare = intel_pmu_cpu_prepare, + .cpu_starting = intel_pmu_cpu_starting, + .cpu_dying = intel_pmu_cpu_dying, +@@ -3902,8 +3907,6 @@ __init int intel_pmu_init(void) + + x86_pmu.max_pebs_events = min_t(unsigned, MAX_PEBS_EVENTS, x86_pmu.num_counters); + +- +- x86_pmu.attrs = intel_pmu_attrs; + /* + * Quirk: v2 perfmon does not report fixed-purpose events, so + * assume at least 3 events, when not running in a hypervisor: +diff --git a/arch/x86/include/asm/insn.h b/arch/x86/include/asm/insn.h +index b3e32b010ab1..c2c01f84df75 100644 +--- a/arch/x86/include/asm/insn.h ++++ b/arch/x86/include/asm/insn.h +@@ -208,4 +208,22 @@ static inline int insn_offset_immediate(struct insn *insn) + return insn_offset_displacement(insn) + insn->displacement.nbytes; + } + ++#define POP_SS_OPCODE 0x1f ++#define MOV_SREG_OPCODE 0x8e ++ ++/* ++ * Intel SDM Vol.3A 6.8.3 states; ++ * "Any single-step trap that would be delivered following the MOV to SS ++ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is ++ * suppressed." ++ * This function returns true if @insn is MOV SS or POP SS. On these ++ * instructions, single stepping is suppressed. ++ */ ++static inline int insn_masking_exception(struct insn *insn) ++{ ++ return insn->opcode.bytes[0] == POP_SS_OPCODE || ++ (insn->opcode.bytes[0] == MOV_SREG_OPCODE && ++ X86_MODRM_REG(insn->modrm.bytes[0]) == 2); ++} ++ + #endif /* _ASM_X86_INSN_H */ +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index c895f38a7a5e..0b2330e19169 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -751,6 +751,9 @@ static const struct _tlb_table intel_tlb_table[] = { + { 0x5d, TLB_DATA_4K_4M, 256, " TLB_DATA 4 KByte and 4 MByte pages" }, + { 0x61, TLB_INST_4K, 48, " TLB_INST 4 KByte pages, full associative" }, + { 0x63, TLB_DATA_1G, 4, " TLB_DATA 1 GByte pages, 4-way set associative" }, ++ { 0x6b, TLB_DATA_4K, 256, " TLB_DATA 4 KByte pages, 8-way associative" }, ++ { 0x6c, TLB_DATA_2M_4M, 128, " TLB_DATA 2 MByte or 4 MByte pages, 8-way associative" }, ++ { 0x6d, TLB_DATA_1G, 16, " TLB_DATA 1 GByte pages, fully associative" }, + { 0x76, TLB_INST_2M_4M, 8, " TLB_INST 2-MByte or 4-MByte pages, fully associative" }, + { 0xb0, TLB_INST_4K, 128, " TLB_INST 4 KByte pages, 4-way set associative" }, + { 0xb1, TLB_INST_2M_4M, 4, " TLB_INST 2M pages, 4-way, 8 entries or 4M pages, 4-way entries" }, +diff --git a/arch/x86/kernel/kexec-bzimage64.c b/arch/x86/kernel/kexec-bzimage64.c +index fb095ba0c02f..f24cd9f1799a 100644 +--- a/arch/x86/kernel/kexec-bzimage64.c ++++ b/arch/x86/kernel/kexec-bzimage64.c +@@ -398,11 +398,10 @@ static void *bzImage64_load(struct kimage *image, char *kernel, + * little bit simple + */ + efi_map_sz = efi_get_runtime_map_size(); +- efi_map_sz = ALIGN(efi_map_sz, 16); + params_cmdline_sz = sizeof(struct boot_params) + cmdline_len + + MAX_ELFCOREHDR_STR_LEN; + params_cmdline_sz = ALIGN(params_cmdline_sz, 16); +- kbuf.bufsz = params_cmdline_sz + efi_map_sz + ++ kbuf.bufsz = params_cmdline_sz + ALIGN(efi_map_sz, 16) + + sizeof(struct setup_data) + + sizeof(struct efi_setup_data); + +@@ -410,7 +409,7 @@ static void *bzImage64_load(struct kimage *image, char *kernel, + if (!params) + return ERR_PTR(-ENOMEM); + efi_map_offset = params_cmdline_sz; +- efi_setup_data_offset = efi_map_offset + efi_map_sz; ++ efi_setup_data_offset = efi_map_offset + ALIGN(efi_map_sz, 16); + + /* Copy setup header onto bootparams. Documentation/x86/boot.txt */ + setup_header_size = 0x0202 + kernel[0x0201] - setup_hdr_offset; +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index ce06ec9c2323..f1030c522e06 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -369,6 +369,10 @@ int __copy_instruction(u8 *dest, u8 *src, struct insn *insn) + if (insn->opcode.bytes[0] == BREAKPOINT_INSTRUCTION) + return 0; + ++ /* We should not singlestep on the exception masking instructions */ ++ if (insn_masking_exception(insn)) ++ return 0; ++ + #ifdef CONFIG_X86_64 + /* Only x86_64 has RIP relative instructions */ + if (insn_rip_relative(insn)) { +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index 495c776de4b4..e1ea13ae53b9 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -296,6 +296,10 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool + if (is_prefix_bad(insn)) + return -ENOTSUPP; + ++ /* We should not singlestep on the exception masking instructions */ ++ if (insn_masking_exception(insn)) ++ return -ENOTSUPP; ++ + if (x86_64) + good_insns = good_insns_64; + else +diff --git a/arch/x86/kvm/hyperv.c b/arch/x86/kvm/hyperv.c +index dc97f2544b6f..5d13abecb384 100644 +--- a/arch/x86/kvm/hyperv.c ++++ b/arch/x86/kvm/hyperv.c +@@ -1223,7 +1223,7 @@ static int kvm_hv_hypercall_complete_userspace(struct kvm_vcpu *vcpu) + struct kvm_run *run = vcpu->run; + + kvm_hv_hypercall_set_result(vcpu, run->hyperv.u.hcall.result); +- return 1; ++ return kvm_skip_emulated_instruction(vcpu); + } + + int kvm_hv_hypercall(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index 029aa1318874..cfa155078ebb 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -4756,9 +4756,8 @@ static int svm_update_pi_irte(struct kvm *kvm, unsigned int host_irq, + } + + if (!ret && svm) { +- trace_kvm_pi_irte_update(svm->vcpu.vcpu_id, +- host_irq, e->gsi, +- vcpu_info.vector, ++ trace_kvm_pi_irte_update(host_irq, svm->vcpu.vcpu_id, ++ e->gsi, vcpu_info.vector, + vcpu_info.pi_desc_addr, set); + } + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index b1556166a06d..90747865205d 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -10318,6 +10318,16 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, + return true; + } + ++static int nested_vmx_check_apic_access_controls(struct kvm_vcpu *vcpu, ++ struct vmcs12 *vmcs12) ++{ ++ if (nested_cpu_has2(vmcs12, SECONDARY_EXEC_VIRTUALIZE_APIC_ACCESSES) && ++ !page_address_valid(vcpu, vmcs12->apic_access_addr)) ++ return -EINVAL; ++ else ++ return 0; ++} ++ + static int nested_vmx_check_apicv_controls(struct kvm_vcpu *vcpu, + struct vmcs12 *vmcs12) + { +@@ -10961,6 +10971,9 @@ static int check_vmentry_prereqs(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) + if (nested_vmx_check_msr_bitmap_controls(vcpu, vmcs12)) + return VMXERR_ENTRY_INVALID_CONTROL_FIELD; + ++ if (nested_vmx_check_apic_access_controls(vcpu, vmcs12)) ++ return VMXERR_ENTRY_INVALID_CONTROL_FIELD; ++ + if (nested_vmx_check_tpr_shadow_controls(vcpu, vmcs12)) + return VMXERR_ENTRY_INVALID_CONTROL_FIELD; + +@@ -12171,7 +12184,7 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, + vcpu_info.pi_desc_addr = __pa(vcpu_to_pi_desc(vcpu)); + vcpu_info.vector = irq.vector; + +- trace_kvm_pi_irte_update(vcpu->vcpu_id, host_irq, e->gsi, ++ trace_kvm_pi_irte_update(host_irq, vcpu->vcpu_id, e->gsi, + vcpu_info.vector, vcpu_info.pi_desc_addr, set); + + if (set) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index b62328cd4cb0..2f3fe25639b3 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -6297,12 +6297,13 @@ void kvm_vcpu_deactivate_apicv(struct kvm_vcpu *vcpu) + int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + { + unsigned long nr, a0, a1, a2, a3, ret; +- int op_64_bit, r; ++ int op_64_bit; + +- r = kvm_skip_emulated_instruction(vcpu); +- +- if (kvm_hv_hypercall_enabled(vcpu->kvm)) +- return kvm_hv_hypercall(vcpu); ++ if (kvm_hv_hypercall_enabled(vcpu->kvm)) { ++ if (!kvm_hv_hypercall(vcpu)) ++ return 0; ++ goto out; ++ } + + nr = kvm_register_read(vcpu, VCPU_REGS_RAX); + a0 = kvm_register_read(vcpu, VCPU_REGS_RBX); +@@ -6323,7 +6324,7 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + + if (kvm_x86_ops->get_cpl(vcpu) != 0) { + ret = -KVM_EPERM; +- goto out; ++ goto out_error; + } + + switch (nr) { +@@ -6343,12 +6344,14 @@ int kvm_emulate_hypercall(struct kvm_vcpu *vcpu) + ret = -KVM_ENOSYS; + break; + } +-out: ++out_error: + if (!op_64_bit) + ret = (u32)ret; + kvm_register_write(vcpu, VCPU_REGS_RAX, ret); ++ ++out: + ++vcpu->stat.hypercalls; +- return r; ++ return kvm_skip_emulated_instruction(vcpu); + } + EXPORT_SYMBOL_GPL(kvm_emulate_hypercall); + +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index bb77606d04e0..a9deb2b0397d 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -1159,6 +1159,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + for (pass = 0; pass < 20 || image; pass++) { + proglen = do_jit(prog, addrs, image, oldproglen, &ctx); + if (proglen <= 0) { ++out_image: + image = NULL; + if (header) + bpf_jit_binary_free(header); +@@ -1169,8 +1170,7 @@ struct bpf_prog *bpf_int_jit_compile(struct bpf_prog *prog) + if (proglen != oldproglen) { + pr_err("bpf_jit: proglen=%d != oldproglen=%d\n", + proglen, oldproglen); +- prog = orig_prog; +- goto out_addrs; ++ goto out_image; + } + break; + } +diff --git a/arch/x86/xen/enlighten_hvm.c b/arch/x86/xen/enlighten_hvm.c +index 754d5391d9fa..854508b00bbb 100644 +--- a/arch/x86/xen/enlighten_hvm.c ++++ b/arch/x86/xen/enlighten_hvm.c +@@ -64,6 +64,19 @@ static void __init xen_hvm_init_mem_mapping(void) + { + early_memunmap(HYPERVISOR_shared_info, PAGE_SIZE); + HYPERVISOR_shared_info = __va(PFN_PHYS(shared_info_pfn)); ++ ++ /* ++ * The virtual address of the shared_info page has changed, so ++ * the vcpu_info pointer for VCPU 0 is now stale. ++ * ++ * The prepare_boot_cpu callback will re-initialize it via ++ * xen_vcpu_setup, but we can't rely on that to be called for ++ * old Xen versions (xen_have_vector_callback == 0). ++ * ++ * It is, in any case, bad to have a stale vcpu_info pointer ++ * so reset it now. ++ */ ++ xen_vcpu_info_reset(0); + } + + static void __init init_hvm_pv_info(void) +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index d3f56baee936..3dc7c0b4adcb 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -1149,18 +1149,16 @@ int blkcg_init_queue(struct request_queue *q) + rcu_read_lock(); + spin_lock_irq(q->queue_lock); + blkg = blkg_create(&blkcg_root, q, new_blkg); ++ if (IS_ERR(blkg)) ++ goto err_unlock; ++ q->root_blkg = blkg; ++ q->root_rl.blkg = blkg; + spin_unlock_irq(q->queue_lock); + rcu_read_unlock(); + + if (preloaded) + radix_tree_preload_end(); + +- if (IS_ERR(blkg)) +- return PTR_ERR(blkg); +- +- q->root_blkg = blkg; +- q->root_rl.blkg = blkg; +- + ret = blk_throtl_init(q); + if (ret) { + spin_lock_irq(q->queue_lock); +@@ -1168,6 +1166,13 @@ int blkcg_init_queue(struct request_queue *q) + spin_unlock_irq(q->queue_lock); + } + return ret; ++ ++err_unlock: ++ spin_unlock_irq(q->queue_lock); ++ rcu_read_unlock(); ++ if (preloaded) ++ radix_tree_preload_end(); ++ return PTR_ERR(blkg); + } + + /** +@@ -1374,17 +1379,12 @@ void blkcg_deactivate_policy(struct request_queue *q, + __clear_bit(pol->plid, q->blkcg_pols); + + list_for_each_entry(blkg, &q->blkg_list, q_node) { +- /* grab blkcg lock too while removing @pd from @blkg */ +- spin_lock(&blkg->blkcg->lock); +- + if (blkg->pd[pol->plid]) { + if (pol->pd_offline_fn) + pol->pd_offline_fn(blkg->pd[pol->plid]); + pol->pd_free_fn(blkg->pd[pol->plid]); + blkg->pd[pol->plid] = NULL; + } +- +- spin_unlock(&blkg->blkcg->lock); + } + + spin_unlock_irq(q->queue_lock); +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 007f96611364..74c35513ada5 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -118,6 +118,25 @@ void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part, + blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight, &mi); + } + ++static void blk_mq_check_inflight_rw(struct blk_mq_hw_ctx *hctx, ++ struct request *rq, void *priv, ++ bool reserved) ++{ ++ struct mq_inflight *mi = priv; ++ ++ if (rq->part == mi->part) ++ mi->inflight[rq_data_dir(rq)]++; ++} ++ ++void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]) ++{ ++ struct mq_inflight mi = { .part = part, .inflight = inflight, }; ++ ++ inflight[0] = inflight[1] = 0; ++ blk_mq_queue_tag_busy_iter(q, blk_mq_check_inflight_rw, &mi); ++} ++ + void blk_freeze_queue_start(struct request_queue *q) + { + int freeze_depth; +diff --git a/block/blk-mq.h b/block/blk-mq.h +index 4933af9d61f7..877237e09083 100644 +--- a/block/blk-mq.h ++++ b/block/blk-mq.h +@@ -136,6 +136,8 @@ static inline bool blk_mq_hw_queue_mapped(struct blk_mq_hw_ctx *hctx) + } + + void blk_mq_in_flight(struct request_queue *q, struct hd_struct *part, +- unsigned int inflight[2]); ++ unsigned int inflight[2]); ++void blk_mq_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]); + + #endif +diff --git a/block/genhd.c b/block/genhd.c +index dd305c65ffb0..449ef56bba70 100644 +--- a/block/genhd.c ++++ b/block/genhd.c +@@ -82,6 +82,18 @@ void part_in_flight(struct request_queue *q, struct hd_struct *part, + } + } + ++void part_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]) ++{ ++ if (q->mq_ops) { ++ blk_mq_in_flight_rw(q, part, inflight); ++ return; ++ } ++ ++ inflight[0] = atomic_read(&part->in_flight[0]); ++ inflight[1] = atomic_read(&part->in_flight[1]); ++} ++ + struct hd_struct *__disk_get_part(struct gendisk *disk, int partno) + { + struct disk_part_tbl *ptbl = rcu_dereference(disk->part_tbl); +diff --git a/block/partition-generic.c b/block/partition-generic.c +index 08dabcd8b6ae..db57cced9b98 100644 +--- a/block/partition-generic.c ++++ b/block/partition-generic.c +@@ -145,13 +145,15 @@ ssize_t part_stat_show(struct device *dev, + jiffies_to_msecs(part_stat_read(p, time_in_queue))); + } + +-ssize_t part_inflight_show(struct device *dev, +- struct device_attribute *attr, char *buf) ++ssize_t part_inflight_show(struct device *dev, struct device_attribute *attr, ++ char *buf) + { + struct hd_struct *p = dev_to_part(dev); ++ struct request_queue *q = part_to_disk(p)->queue; ++ unsigned int inflight[2]; + +- return sprintf(buf, "%8u %8u\n", atomic_read(&p->in_flight[0]), +- atomic_read(&p->in_flight[1])); ++ part_in_flight_rw(q, p, inflight); ++ return sprintf(buf, "%8u %8u\n", inflight[0], inflight[1]); + } + + #ifdef CONFIG_FAIL_MAKE_REQUEST +diff --git a/drivers/acpi/acpi_watchdog.c b/drivers/acpi/acpi_watchdog.c +index ebb626ffb5fa..4bde16fb97d8 100644 +--- a/drivers/acpi/acpi_watchdog.c ++++ b/drivers/acpi/acpi_watchdog.c +@@ -12,23 +12,64 @@ + #define pr_fmt(fmt) "ACPI: watchdog: " fmt + + #include ++#include + #include + #include + + #include "internal.h" + ++static const struct dmi_system_id acpi_watchdog_skip[] = { ++ { ++ /* ++ * On Lenovo Z50-70 there are two issues with the WDAT ++ * table. First some of the instructions use RTC SRAM ++ * to store persistent information. This does not work well ++ * with Linux RTC driver. Second, more important thing is ++ * that the instructions do not actually reset the system. ++ * ++ * On this particular system iTCO_wdt seems to work just ++ * fine so we prefer that over WDAT for now. ++ * ++ * See also https://bugzilla.kernel.org/show_bug.cgi?id=199033. ++ */ ++ .ident = "Lenovo Z50-70", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "20354"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo Z50-70"), ++ }, ++ }, ++ {} ++}; ++ ++static const struct acpi_table_wdat *acpi_watchdog_get_wdat(void) ++{ ++ const struct acpi_table_wdat *wdat = NULL; ++ acpi_status status; ++ ++ if (acpi_disabled) ++ return NULL; ++ ++ if (dmi_check_system(acpi_watchdog_skip)) ++ return NULL; ++ ++ status = acpi_get_table(ACPI_SIG_WDAT, 0, ++ (struct acpi_table_header **)&wdat); ++ if (ACPI_FAILURE(status)) { ++ /* It is fine if there is no WDAT */ ++ return NULL; ++ } ++ ++ return wdat; ++} ++ + /** + * Returns true if this system should prefer ACPI based watchdog instead of + * the native one (which are typically the same hardware). + */ + bool acpi_has_watchdog(void) + { +- struct acpi_table_header hdr; +- +- if (acpi_disabled) +- return false; +- +- return ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_WDAT, 0, &hdr)); ++ return !!acpi_watchdog_get_wdat(); + } + EXPORT_SYMBOL_GPL(acpi_has_watchdog); + +@@ -41,12 +82,10 @@ void __init acpi_watchdog_init(void) + struct platform_device *pdev; + struct resource *resources; + size_t nresources = 0; +- acpi_status status; + int i; + +- status = acpi_get_table(ACPI_SIG_WDAT, 0, +- (struct acpi_table_header **)&wdat); +- if (ACPI_FAILURE(status)) { ++ wdat = acpi_watchdog_get_wdat(); ++ if (!wdat) { + /* It is fine if there is no WDAT */ + return; + } +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 8082871b409a..2ef0ad6a33d6 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -364,6 +364,19 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9360"), + }, + }, ++ /* ++ * ThinkPad X1 Tablet(2016) cannot do suspend-to-idle using ++ * the Low Power S0 Idle firmware interface (see ++ * https://bugzilla.kernel.org/show_bug.cgi?id=199057). ++ */ ++ { ++ .callback = init_no_lps0, ++ .ident = "ThinkPad X1 Tablet(2016)", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "20GGA00L00"), ++ }, ++ }, + {}, + }; + +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 18391d0c0cd7..75eb50041c99 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -686,7 +686,7 @@ static int ahci_vt8251_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + rc = sata_link_hardreset(link, sata_ehc_deb_timing(&link->eh_context), + deadline, &online, NULL); +@@ -712,7 +712,7 @@ static int ahci_p5wdh_hardreset(struct ata_link *link, unsigned int *class, + bool online; + int rc; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +@@ -776,7 +776,7 @@ static int ahci_avn_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + for (i = 0; i < 2; i++) { + u16 val; +diff --git a/drivers/ata/ahci.h b/drivers/ata/ahci.h +index 8b61123d2c3c..781b898e5785 100644 +--- a/drivers/ata/ahci.h ++++ b/drivers/ata/ahci.h +@@ -361,6 +361,13 @@ struct ahci_host_priv { + * be overridden anytime before the host is activated. + */ + void (*start_engine)(struct ata_port *ap); ++ /* ++ * Optional ahci_stop_engine override, if not set this gets set to the ++ * default ahci_stop_engine during ahci_save_initial_config, this can ++ * be overridden anytime before the host is activated. ++ */ ++ int (*stop_engine)(struct ata_port *ap); ++ + irqreturn_t (*irq_handler)(int irq, void *dev_instance); + + /* only required for per-port MSI(-X) support */ +diff --git a/drivers/ata/ahci_mvebu.c b/drivers/ata/ahci_mvebu.c +index de7128d81e9c..0045dacd814b 100644 +--- a/drivers/ata/ahci_mvebu.c ++++ b/drivers/ata/ahci_mvebu.c +@@ -62,6 +62,60 @@ static void ahci_mvebu_regret_option(struct ahci_host_priv *hpriv) + writel(0x80, hpriv->mmio + AHCI_VENDOR_SPECIFIC_0_DATA); + } + ++/** ++ * ahci_mvebu_stop_engine ++ * ++ * @ap: Target ata port ++ * ++ * Errata Ref#226 - SATA Disk HOT swap issue when connected through ++ * Port Multiplier in FIS-based Switching mode. ++ * ++ * To avoid the issue, according to design, the bits[11:8, 0] of ++ * register PxFBS are cleared when Port Command and Status (0x18) bit[0] ++ * changes its value from 1 to 0, i.e. falling edge of Port ++ * Command and Status bit[0] sends PULSE that resets PxFBS ++ * bits[11:8; 0]. ++ * ++ * This function is used to override function of "ahci_stop_engine" ++ * from libahci.c by adding the mvebu work around(WA) to save PxFBS ++ * value before the PxCMD ST write of 0, then restore PxFBS value. ++ * ++ * Return: 0 on success; Error code otherwise. ++ */ ++int ahci_mvebu_stop_engine(struct ata_port *ap) ++{ ++ void __iomem *port_mmio = ahci_port_base(ap); ++ u32 tmp, port_fbs; ++ ++ tmp = readl(port_mmio + PORT_CMD); ++ ++ /* check if the HBA is idle */ ++ if ((tmp & (PORT_CMD_START | PORT_CMD_LIST_ON)) == 0) ++ return 0; ++ ++ /* save the port PxFBS register for later restore */ ++ port_fbs = readl(port_mmio + PORT_FBS); ++ ++ /* setting HBA to idle */ ++ tmp &= ~PORT_CMD_START; ++ writel(tmp, port_mmio + PORT_CMD); ++ ++ /* ++ * bit #15 PxCMD signal doesn't clear PxFBS, ++ * restore the PxFBS register right after clearing the PxCMD ST, ++ * no need to wait for the PxCMD bit #15. ++ */ ++ writel(port_fbs, port_mmio + PORT_FBS); ++ ++ /* wait for engine to stop. This could be as long as 500 msec */ ++ tmp = ata_wait_register(ap, port_mmio + PORT_CMD, ++ PORT_CMD_LIST_ON, PORT_CMD_LIST_ON, 1, 500); ++ if (tmp & PORT_CMD_LIST_ON) ++ return -EIO; ++ ++ return 0; ++} ++ + #ifdef CONFIG_PM_SLEEP + static int ahci_mvebu_suspend(struct platform_device *pdev, pm_message_t state) + { +@@ -112,6 +166,8 @@ static int ahci_mvebu_probe(struct platform_device *pdev) + if (rc) + return rc; + ++ hpriv->stop_engine = ahci_mvebu_stop_engine; ++ + if (of_device_is_compatible(pdev->dev.of_node, + "marvell,armada-380-ahci")) { + dram = mv_mbus_dram_info(); +diff --git a/drivers/ata/ahci_qoriq.c b/drivers/ata/ahci_qoriq.c +index b6b0bf76dfc7..ab5ac103bfb8 100644 +--- a/drivers/ata/ahci_qoriq.c ++++ b/drivers/ata/ahci_qoriq.c +@@ -94,7 +94,7 @@ static int ahci_qoriq_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* + * There is a errata on ls1021a Rev1.0 and Rev2.0 which is: +diff --git a/drivers/ata/ahci_xgene.c b/drivers/ata/ahci_xgene.c +index c2b5941d9184..ad58da7c9aff 100644 +--- a/drivers/ata/ahci_xgene.c ++++ b/drivers/ata/ahci_xgene.c +@@ -165,7 +165,7 @@ static int xgene_ahci_restart_engine(struct ata_port *ap) + PORT_CMD_ISSUE, 0x0, 1, 100)) + return -EBUSY; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + ahci_start_fis_rx(ap); + + /* +@@ -421,7 +421,7 @@ static int xgene_ahci_hardreset(struct ata_link *link, unsigned int *class, + portrxfis_saved = readl(port_mmio + PORT_FIS_ADDR); + portrxfishi_saved = readl(port_mmio + PORT_FIS_ADDR_HI); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + rc = xgene_ahci_do_hardreset(link, deadline, &online); + +diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c +index 3e286d86ab42..5ae268b8514e 100644 +--- a/drivers/ata/libahci.c ++++ b/drivers/ata/libahci.c +@@ -560,6 +560,9 @@ void ahci_save_initial_config(struct device *dev, struct ahci_host_priv *hpriv) + if (!hpriv->start_engine) + hpriv->start_engine = ahci_start_engine; + ++ if (!hpriv->stop_engine) ++ hpriv->stop_engine = ahci_stop_engine; ++ + if (!hpriv->irq_handler) + hpriv->irq_handler = ahci_single_level_irq_intr; + } +@@ -887,9 +890,10 @@ static void ahci_start_port(struct ata_port *ap) + static int ahci_deinit_port(struct ata_port *ap, const char **emsg) + { + int rc; ++ struct ahci_host_priv *hpriv = ap->host->private_data; + + /* disable DMA */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) { + *emsg = "failed to stop engine"; + return rc; +@@ -1299,7 +1303,7 @@ int ahci_kick_engine(struct ata_port *ap) + int busy, rc; + + /* stop engine */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + goto out_restart; + +@@ -1538,7 +1542,7 @@ int ahci_do_hardreset(struct ata_link *link, unsigned int *class, + + DPRINTK("ENTER\n"); + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +@@ -2064,14 +2068,14 @@ void ahci_error_handler(struct ata_port *ap) + + if (!(ap->pflags & ATA_PFLAG_FROZEN)) { + /* restart engine */ +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + hpriv->start_engine(ap); + } + + sata_pmp_error_handler(ap); + + if (!ata_dev_enabled(ap->link.device)) +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + } + EXPORT_SYMBOL_GPL(ahci_error_handler); + +@@ -2118,7 +2122,7 @@ static void ahci_set_aggressive_devslp(struct ata_port *ap, bool sleep) + return; + + /* set DITO, MDAT, DETO and enable DevSlp, need to stop engine first */ +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +@@ -2178,7 +2182,7 @@ static void ahci_enable_fbs(struct ata_port *ap) + return; + } + +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +@@ -2211,7 +2215,7 @@ static void ahci_disable_fbs(struct ata_port *ap) + return; + } + +- rc = ahci_stop_engine(ap); ++ rc = hpriv->stop_engine(ap); + if (rc) + return; + +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index ea20e0eb4d5a..711dd91b5e2c 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -175,8 +175,8 @@ static void ata_eh_handle_port_resume(struct ata_port *ap) + { } + #endif /* CONFIG_PM */ + +-static void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, const char *fmt, +- va_list args) ++static __printf(2, 0) void __ata_ehi_pushv_desc(struct ata_eh_info *ehi, ++ const char *fmt, va_list args) + { + ehi->desc_len += vscnprintf(ehi->desc + ehi->desc_len, + ATA_EH_DESC_LEN - ehi->desc_len, +diff --git a/drivers/ata/sata_highbank.c b/drivers/ata/sata_highbank.c +index aafb8cc03523..e67815b896fc 100644 +--- a/drivers/ata/sata_highbank.c ++++ b/drivers/ata/sata_highbank.c +@@ -410,7 +410,7 @@ static int ahci_highbank_hardreset(struct ata_link *link, unsigned int *class, + int rc; + int retry = 100; + +- ahci_stop_engine(ap); ++ hpriv->stop_engine(ap); + + /* clear D2H reception area to properly wait for D2H FIS */ + ata_tf_init(link->device, &tf); +diff --git a/drivers/char/agp/uninorth-agp.c b/drivers/char/agp/uninorth-agp.c +index c381c8e396fc..79d8c84693a1 100644 +--- a/drivers/char/agp/uninorth-agp.c ++++ b/drivers/char/agp/uninorth-agp.c +@@ -195,7 +195,7 @@ static int uninorth_insert_memory(struct agp_memory *mem, off_t pg_start, int ty + return 0; + } + +-int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type) ++static int uninorth_remove_memory(struct agp_memory *mem, off_t pg_start, int type) + { + size_t i; + u32 *gp; +@@ -470,7 +470,7 @@ static int uninorth_free_gatt_table(struct agp_bridge_data *bridge) + return 0; + } + +-void null_cache_flush(void) ++static void null_cache_flush(void) + { + mb(); + } +diff --git a/drivers/clk/clk-mux.c b/drivers/clk/clk-mux.c +index 16a3d5717f4e..a062f79bc509 100644 +--- a/drivers/clk/clk-mux.c ++++ b/drivers/clk/clk-mux.c +@@ -101,10 +101,18 @@ static int clk_mux_set_parent(struct clk_hw *hw, u8 index) + return 0; + } + ++static int clk_mux_determine_rate(struct clk_hw *hw, ++ struct clk_rate_request *req) ++{ ++ struct clk_mux *mux = to_clk_mux(hw); ++ ++ return clk_mux_determine_rate_flags(hw, req, mux->flags); ++} ++ + const struct clk_ops clk_mux_ops = { + .get_parent = clk_mux_get_parent, + .set_parent = clk_mux_set_parent, +- .determine_rate = __clk_mux_determine_rate, ++ .determine_rate = clk_mux_determine_rate, + }; + EXPORT_SYMBOL_GPL(clk_mux_ops); + +diff --git a/drivers/clk/clk.c b/drivers/clk/clk.c +index 4e21f5bcd954..6f4c98ca6e50 100644 +--- a/drivers/clk/clk.c ++++ b/drivers/clk/clk.c +@@ -351,9 +351,9 @@ static bool mux_is_better_rate(unsigned long rate, unsigned long now, + return now <= rate && now > best; + } + +-static int +-clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req, +- unsigned long flags) ++int clk_mux_determine_rate_flags(struct clk_hw *hw, ++ struct clk_rate_request *req, ++ unsigned long flags) + { + struct clk_core *core = hw->core, *parent, *best_parent = NULL; + int i, num_parents, ret; +@@ -413,6 +413,7 @@ clk_mux_determine_rate_flags(struct clk_hw *hw, struct clk_rate_request *req, + + return 0; + } ++EXPORT_SYMBOL_GPL(clk_mux_determine_rate_flags); + + struct clk *__clk_lookup(const char *name) + { +diff --git a/drivers/clk/imx/clk-imx6ul.c b/drivers/clk/imx/clk-imx6ul.c +index 5e8c18afce9a..41c08fc892b9 100644 +--- a/drivers/clk/imx/clk-imx6ul.c ++++ b/drivers/clk/imx/clk-imx6ul.c +@@ -461,7 +461,7 @@ static void __init imx6ul_clocks_init(struct device_node *ccm_node) + clk_set_rate(clks[IMX6UL_CLK_AHB], 99000000); + + /* Change periph_pre clock to pll2_bus to adjust AXI rate to 264MHz */ +- clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_PLL3_USB_OTG]); ++ clk_set_parent(clks[IMX6UL_CLK_PERIPH_CLK2_SEL], clks[IMX6UL_CLK_OSC]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_CLK2]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH_PRE], clks[IMX6UL_CLK_PLL2_BUS]); + clk_set_parent(clks[IMX6UL_CLK_PERIPH], clks[IMX6UL_CLK_PERIPH_PRE]); +diff --git a/drivers/clocksource/timer-imx-tpm.c b/drivers/clocksource/timer-imx-tpm.c +index 557ed25b42e3..d175b9545581 100644 +--- a/drivers/clocksource/timer-imx-tpm.c ++++ b/drivers/clocksource/timer-imx-tpm.c +@@ -20,6 +20,7 @@ + #define TPM_SC 0x10 + #define TPM_SC_CMOD_INC_PER_CNT (0x1 << 3) + #define TPM_SC_CMOD_DIV_DEFAULT 0x3 ++#define TPM_SC_TOF_MASK (0x1 << 7) + #define TPM_CNT 0x14 + #define TPM_MOD 0x18 + #define TPM_STATUS 0x1c +@@ -29,6 +30,7 @@ + #define TPM_C0SC_MODE_SHIFT 2 + #define TPM_C0SC_MODE_MASK 0x3c + #define TPM_C0SC_MODE_SW_COMPARE 0x4 ++#define TPM_C0SC_CHF_MASK (0x1 << 7) + #define TPM_C0V 0x24 + + static void __iomem *timer_base; +@@ -205,9 +207,13 @@ static int __init tpm_timer_init(struct device_node *np) + * 4) Channel0 disabled + * 5) DMA transfers disabled + */ ++ /* make sure counter is disabled */ + writel(0, timer_base + TPM_SC); ++ /* TOF is W1C */ ++ writel(TPM_SC_TOF_MASK, timer_base + TPM_SC); + writel(0, timer_base + TPM_CNT); +- writel(0, timer_base + TPM_C0SC); ++ /* CHF is W1C */ ++ writel(TPM_C0SC_CHF_MASK, timer_base + TPM_C0SC); + + /* increase per cnt, div 8 by default */ + writel(TPM_SC_CMOD_INC_PER_CNT | TPM_SC_CMOD_DIV_DEFAULT, +diff --git a/drivers/firmware/efi/libstub/arm64-stub.c b/drivers/firmware/efi/libstub/arm64-stub.c +index b9bd827caa22..1b4d465cc5d9 100644 +--- a/drivers/firmware/efi/libstub/arm64-stub.c ++++ b/drivers/firmware/efi/libstub/arm64-stub.c +@@ -97,6 +97,16 @@ efi_status_t handle_kernel_image(efi_system_table_t *sys_table_arg, + u32 offset = !IS_ENABLED(CONFIG_DEBUG_ALIGN_RODATA) ? + (phys_seed >> 32) & mask : TEXT_OFFSET; + ++ /* ++ * With CONFIG_RANDOMIZE_TEXT_OFFSET=y, TEXT_OFFSET may not ++ * be a multiple of EFI_KIMG_ALIGN, and we must ensure that ++ * we preserve the misalignment of 'offset' relative to ++ * EFI_KIMG_ALIGN so that statically allocated objects whose ++ * alignment exceeds PAGE_SIZE appear correctly aligned in ++ * memory. ++ */ ++ offset |= TEXT_OFFSET % EFI_KIMG_ALIGN; ++ + /* + * If KASLR is enabled, and we have some randomness available, + * locate the kernel at a randomized offset in physical memory. +diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +index 660b3fbade41..8a05efa7edf0 100644 +--- a/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c ++++ b/drivers/gpu/drm/amd/amdkfd/kfd_chardev.c +@@ -716,12 +716,13 @@ static int kfd_ioctl_get_clock_counters(struct file *filep, + struct timespec64 time; + + dev = kfd_device_by_id(args->gpu_id); +- if (dev == NULL) +- return -EINVAL; +- +- /* Reading GPU clock counter from KGD */ +- args->gpu_clock_counter = +- dev->kfd2kgd->get_gpu_clock_counter(dev->kgd); ++ if (dev) ++ /* Reading GPU clock counter from KGD */ ++ args->gpu_clock_counter = ++ dev->kfd2kgd->get_gpu_clock_counter(dev->kgd); ++ else ++ /* Node without GPU resource */ ++ args->gpu_clock_counter = 0; + + /* No access to rdtsc. Using raw monotonic time */ + getrawmonotonic64(&time); +diff --git a/drivers/gpu/drm/drm_dumb_buffers.c b/drivers/gpu/drm/drm_dumb_buffers.c +index 39ac15ce4702..9e2ae02f31e0 100644 +--- a/drivers/gpu/drm/drm_dumb_buffers.c ++++ b/drivers/gpu/drm/drm_dumb_buffers.c +@@ -65,12 +65,13 @@ int drm_mode_create_dumb_ioctl(struct drm_device *dev, + return -EINVAL; + + /* overflow checks for 32bit size calculations */ +- /* NOTE: DIV_ROUND_UP() can overflow */ ++ if (args->bpp > U32_MAX - 8) ++ return -EINVAL; + cpp = DIV_ROUND_UP(args->bpp, 8); +- if (!cpp || cpp > 0xffffffffU / args->width) ++ if (cpp > U32_MAX / args->width) + return -EINVAL; + stride = cpp * args->width; +- if (args->height > 0xffffffffU / stride) ++ if (args->height > U32_MAX / stride) + return -EINVAL; + + /* test for wrap-around */ +diff --git a/drivers/gpu/drm/msm/dsi/dsi_host.c b/drivers/gpu/drm/msm/dsi/dsi_host.c +index deaf869374ea..a9a0b56f1fbc 100644 +--- a/drivers/gpu/drm/msm/dsi/dsi_host.c ++++ b/drivers/gpu/drm/msm/dsi/dsi_host.c +@@ -740,7 +740,7 @@ static inline enum dsi_cmd_dst_format dsi_get_cmd_fmt( + switch (mipi_fmt) { + case MIPI_DSI_FMT_RGB888: return CMD_DST_FORMAT_RGB888; + case MIPI_DSI_FMT_RGB666_PACKED: +- case MIPI_DSI_FMT_RGB666: return VID_DST_FORMAT_RGB666; ++ case MIPI_DSI_FMT_RGB666: return CMD_DST_FORMAT_RGB666; + case MIPI_DSI_FMT_RGB565: return CMD_DST_FORMAT_RGB565; + default: return CMD_DST_FORMAT_RGB888; + } +diff --git a/drivers/gpu/drm/msm/msm_fbdev.c b/drivers/gpu/drm/msm/msm_fbdev.c +index c178563fcd4d..456622b46335 100644 +--- a/drivers/gpu/drm/msm/msm_fbdev.c ++++ b/drivers/gpu/drm/msm/msm_fbdev.c +@@ -92,8 +92,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, + + if (IS_ERR(fb)) { + dev_err(dev->dev, "failed to allocate fb\n"); +- ret = PTR_ERR(fb); +- goto fail; ++ return PTR_ERR(fb); + } + + bo = msm_framebuffer_bo(fb, 0); +@@ -151,13 +150,7 @@ static int msm_fbdev_create(struct drm_fb_helper *helper, + + fail_unlock: + mutex_unlock(&dev->struct_mutex); +-fail: +- +- if (ret) { +- if (fb) +- drm_framebuffer_remove(fb); +- } +- ++ drm_framebuffer_remove(fb); + return ret; + } + +diff --git a/drivers/gpu/drm/msm/msm_gem.c b/drivers/gpu/drm/msm/msm_gem.c +index 6e0fb50d0de4..f2df718af370 100644 +--- a/drivers/gpu/drm/msm/msm_gem.c ++++ b/drivers/gpu/drm/msm/msm_gem.c +@@ -132,17 +132,19 @@ static void put_pages(struct drm_gem_object *obj) + struct msm_gem_object *msm_obj = to_msm_bo(obj); + + if (msm_obj->pages) { +- /* For non-cached buffers, ensure the new pages are clean +- * because display controller, GPU, etc. are not coherent: +- */ +- if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) +- dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, +- msm_obj->sgt->nents, DMA_BIDIRECTIONAL); ++ if (msm_obj->sgt) { ++ /* For non-cached buffers, ensure the new ++ * pages are clean because display controller, ++ * GPU, etc. are not coherent: ++ */ ++ if (msm_obj->flags & (MSM_BO_WC|MSM_BO_UNCACHED)) ++ dma_unmap_sg(obj->dev->dev, msm_obj->sgt->sgl, ++ msm_obj->sgt->nents, ++ DMA_BIDIRECTIONAL); + +- if (msm_obj->sgt) + sg_free_table(msm_obj->sgt); +- +- kfree(msm_obj->sgt); ++ kfree(msm_obj->sgt); ++ } + + if (use_pages(obj)) + drm_gem_put_pages(obj, msm_obj->pages, true, false); +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4.c b/drivers/gpu/drm/omapdrm/dss/hdmi4.c +index f169348da377..ef3731d2f2e7 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi4.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4.c +@@ -634,7 +634,7 @@ static int hdmi_audio_config(struct device *dev, + struct omap_dss_audio *dss_audio) + { + struct omap_hdmi *hd = dev_get_drvdata(dev); +- int ret; ++ int ret = 0; + + mutex_lock(&hd->lock); + +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c +index c3453f3bd603..1359bf50598f 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi4_core.c +@@ -926,8 +926,13 @@ int hdmi4_core_init(struct platform_device *pdev, struct hdmi_core_data *core) + { + const struct hdmi4_features *features; + struct resource *res; ++ const struct soc_device_attribute *soc; + +- features = soc_device_match(hdmi4_soc_devices)->data; ++ soc = soc_device_match(hdmi4_soc_devices); ++ if (!soc) ++ return -ENODEV; ++ ++ features = soc->data; + core->cts_swmode = features->cts_swmode; + core->audio_use_mclk = features->audio_use_mclk; + +diff --git a/drivers/gpu/drm/omapdrm/dss/hdmi5.c b/drivers/gpu/drm/omapdrm/dss/hdmi5.c +index b3221ca5bcd8..26db0ce7a085 100644 +--- a/drivers/gpu/drm/omapdrm/dss/hdmi5.c ++++ b/drivers/gpu/drm/omapdrm/dss/hdmi5.c +@@ -660,7 +660,7 @@ static int hdmi_audio_config(struct device *dev, + struct omap_dss_audio *dss_audio) + { + struct omap_hdmi *hd = dev_get_drvdata(dev); +- int ret; ++ int ret = 0; + + mutex_lock(&hd->lock); + +diff --git a/drivers/gpu/drm/omapdrm/omap_connector.c b/drivers/gpu/drm/omapdrm/omap_connector.c +index aa5ba9ae2191..556335ecb2b7 100644 +--- a/drivers/gpu/drm/omapdrm/omap_connector.c ++++ b/drivers/gpu/drm/omapdrm/omap_connector.c +@@ -123,6 +123,9 @@ static int omap_connector_get_modes(struct drm_connector *connector) + if (dssdrv->read_edid) { + void *edid = kzalloc(MAX_EDID, GFP_KERNEL); + ++ if (!edid) ++ return 0; ++ + if ((dssdrv->read_edid(dssdev, edid, MAX_EDID) > 0) && + drm_edid_is_valid(edid)) { + drm_mode_connector_update_edid_property( +@@ -141,6 +144,9 @@ static int omap_connector_get_modes(struct drm_connector *connector) + struct drm_display_mode *mode = drm_mode_create(dev); + struct videomode vm = {0}; + ++ if (!mode) ++ return 0; ++ + dssdrv->get_timings(dssdev, &vm); + + drm_display_mode_from_videomode(&vm, mode); +@@ -196,6 +202,10 @@ static int omap_connector_mode_valid(struct drm_connector *connector, + if (!r) { + /* check if vrefresh is still valid */ + new_mode = drm_mode_duplicate(dev, mode); ++ ++ if (!new_mode) ++ return MODE_BAD; ++ + new_mode->clock = vm.pixelclock / 1000; + new_mode->vrefresh = 0; + if (mode->vrefresh == drm_mode_vrefresh(new_mode)) +diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +index fd05f7e9f43f..df05fe53c399 100644 +--- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c ++++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c +@@ -389,12 +389,16 @@ int tiler_unpin(struct tiler_block *block) + struct tiler_block *tiler_reserve_2d(enum tiler_fmt fmt, uint16_t w, + uint16_t h, uint16_t align) + { +- struct tiler_block *block = kzalloc(sizeof(*block), GFP_KERNEL); ++ struct tiler_block *block; + u32 min_align = 128; + int ret; + unsigned long flags; + u32 slot_bytes; + ++ block = kzalloc(sizeof(*block), GFP_KERNEL); ++ if (!block) ++ return ERR_PTR(-ENOMEM); ++ + BUG_ON(!validfmt(fmt)); + + /* convert width/height to slots */ +diff --git a/drivers/gpu/drm/omapdrm/tcm-sita.c b/drivers/gpu/drm/omapdrm/tcm-sita.c +index c10fdfc0930f..1cd39507b634 100644 +--- a/drivers/gpu/drm/omapdrm/tcm-sita.c ++++ b/drivers/gpu/drm/omapdrm/tcm-sita.c +@@ -92,7 +92,7 @@ static int l2r_t2b(uint16_t w, uint16_t h, uint16_t a, int16_t offset, + { + int i; + unsigned long index; +- bool area_free; ++ bool area_free = false; + unsigned long slots_per_band = PAGE_SIZE / slot_bytes; + unsigned long bit_offset = (offset > 0) ? offset / slot_bytes : 0; + unsigned long curr_bit = bit_offset; +diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig +index 8c7a0ce147a1..eca4c9d97110 100644 +--- a/drivers/hid/Kconfig ++++ b/drivers/hid/Kconfig +@@ -436,10 +436,11 @@ config HID_LENOVO + select NEW_LEDS + select LEDS_CLASS + ---help--- +- Support for Lenovo devices that are not fully compliant with HID standard. ++ Support for IBM/Lenovo devices that are not fully compliant with HID standard. + +- Say Y if you want support for the non-compliant features of the Lenovo +- Thinkpad standalone keyboards, e.g: ++ Say Y if you want support for horizontal scrolling of the IBM/Lenovo ++ Scrollpoint mice or the non-compliant features of the Lenovo Thinkpad ++ standalone keyboards, e.g: + - ThinkPad USB Keyboard with TrackPoint (supports extra LEDs and trackpoint + configuration) + - ThinkPad Compact Bluetooth Keyboard with TrackPoint (supports Fn keys) +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index ff539c0b4637..9e478f03e845 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -532,6 +532,13 @@ + #define USB_VENDOR_ID_HUION 0x256c + #define USB_DEVICE_ID_HUION_TABLET 0x006e + ++#define USB_VENDOR_ID_IBM 0x04b3 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_III 0x3100 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_PRO 0x3103 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL 0x3105 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL 0x3108 ++#define USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO 0x3109 ++ + #define USB_VENDOR_ID_IDEACOM 0x1cb6 + #define USB_DEVICE_ID_IDEACOM_IDC6650 0x6650 + #define USB_DEVICE_ID_IDEACOM_IDC6651 0x6651 +@@ -664,6 +671,7 @@ + #define USB_DEVICE_ID_LENOVO_TPKBD 0x6009 + #define USB_DEVICE_ID_LENOVO_CUSBKBD 0x6047 + #define USB_DEVICE_ID_LENOVO_CBTKBD 0x6048 ++#define USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL 0x6049 + #define USB_DEVICE_ID_LENOVO_TPPRODOCK 0x6067 + #define USB_DEVICE_ID_LENOVO_X1_COVER 0x6085 + #define USB_DEVICE_ID_LENOVO_X1_TAB 0x60a3 +diff --git a/drivers/hid/hid-lenovo.c b/drivers/hid/hid-lenovo.c +index 1ac4ff4d57a6..643b6eb54442 100644 +--- a/drivers/hid/hid-lenovo.c ++++ b/drivers/hid/hid-lenovo.c +@@ -6,6 +6,17 @@ + * + * Copyright (c) 2012 Bernhard Seibold + * Copyright (c) 2014 Jamie Lentin ++ * ++ * Linux IBM/Lenovo Scrollpoint mouse driver: ++ * - IBM Scrollpoint III ++ * - IBM Scrollpoint Pro ++ * - IBM Scrollpoint Optical ++ * - IBM Scrollpoint Optical 800dpi ++ * - IBM Scrollpoint Optical 800dpi Pro ++ * - Lenovo Scrollpoint Optical ++ * ++ * Copyright (c) 2012 Peter De Wachter ++ * Copyright (c) 2018 Peter Ganzhorn + */ + + /* +@@ -160,6 +171,17 @@ static int lenovo_input_mapping_cptkbd(struct hid_device *hdev, + return 0; + } + ++static int lenovo_input_mapping_scrollpoint(struct hid_device *hdev, ++ struct hid_input *hi, struct hid_field *field, ++ struct hid_usage *usage, unsigned long **bit, int *max) ++{ ++ if (usage->hid == HID_GD_Z) { ++ hid_map_usage(hi, usage, bit, max, EV_REL, REL_HWHEEL); ++ return 1; ++ } ++ return 0; ++} ++ + static int lenovo_input_mapping(struct hid_device *hdev, + struct hid_input *hi, struct hid_field *field, + struct hid_usage *usage, unsigned long **bit, int *max) +@@ -172,6 +194,14 @@ static int lenovo_input_mapping(struct hid_device *hdev, + case USB_DEVICE_ID_LENOVO_CBTKBD: + return lenovo_input_mapping_cptkbd(hdev, hi, field, + usage, bit, max); ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_III: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_PRO: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL: ++ case USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO: ++ case USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL: ++ return lenovo_input_mapping_scrollpoint(hdev, hi, field, ++ usage, bit, max); + default: + return 0; + } +@@ -883,6 +913,12 @@ static const struct hid_device_id lenovo_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CUSBKBD) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_CBTKBD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_TPPRODOCK) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_III) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_PRO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_OPTICAL) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_IBM, USB_DEVICE_ID_IBM_SCROLLPOINT_800DPI_OPTICAL_PRO) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_LENOVO, USB_DEVICE_ID_LENOVO_SCROLLPOINT_OPTICAL) }, + { } + }; + +diff --git a/drivers/hid/intel-ish-hid/ishtp/bus.c b/drivers/hid/intel-ish-hid/ishtp/bus.c +index f272cdd9bd55..2623a567ffba 100644 +--- a/drivers/hid/intel-ish-hid/ishtp/bus.c ++++ b/drivers/hid/intel-ish-hid/ishtp/bus.c +@@ -418,7 +418,7 @@ static struct ishtp_cl_device *ishtp_bus_add_device(struct ishtp_device *dev, + list_del(&device->device_link); + spin_unlock_irqrestore(&dev->device_list_lock, flags); + dev_err(dev->devc, "Failed to register ISHTP client device\n"); +- kfree(device); ++ put_device(&device->dev); + return NULL; + } + +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 4c337585479e..69afd7968d9c 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -1102,8 +1102,10 @@ static int __wacom_devm_sysfs_create_group(struct wacom *wacom, + devres->root = root; + + error = sysfs_create_group(devres->root, group); +- if (error) ++ if (error) { ++ devres_free(devres); + return error; ++ } + + devres_add(&wacom->hdev->dev, devres); + +diff --git a/drivers/i2c/busses/i2c-pmcmsp.c b/drivers/i2c/busses/i2c-pmcmsp.c +index 2aa0e83174c5..dae8ac618a52 100644 +--- a/drivers/i2c/busses/i2c-pmcmsp.c ++++ b/drivers/i2c/busses/i2c-pmcmsp.c +@@ -564,10 +564,10 @@ static int pmcmsptwi_master_xfer(struct i2c_adapter *adap, + * TODO: We could potentially loop and retry in the case + * of MSP_TWI_XFER_TIMEOUT. + */ +- return -1; ++ return -EIO; + } + +- return 0; ++ return num; + } + + static u32 pmcmsptwi_i2c_func(struct i2c_adapter *adapter) +diff --git a/drivers/i2c/busses/i2c-sprd.c b/drivers/i2c/busses/i2c-sprd.c +index 25fcc3c1e32b..4053259bccb8 100644 +--- a/drivers/i2c/busses/i2c-sprd.c ++++ b/drivers/i2c/busses/i2c-sprd.c +@@ -86,6 +86,7 @@ struct sprd_i2c { + u32 count; + int irq; + int err; ++ bool is_suspended; + }; + + static void sprd_i2c_set_count(struct sprd_i2c *i2c_dev, u32 count) +@@ -283,6 +284,9 @@ static int sprd_i2c_master_xfer(struct i2c_adapter *i2c_adap, + struct sprd_i2c *i2c_dev = i2c_adap->algo_data; + int im, ret; + ++ if (i2c_dev->is_suspended) ++ return -EBUSY; ++ + ret = pm_runtime_get_sync(i2c_dev->dev); + if (ret < 0) + return ret; +@@ -364,13 +368,12 @@ static irqreturn_t sprd_i2c_isr_thread(int irq, void *dev_id) + struct sprd_i2c *i2c_dev = dev_id; + struct i2c_msg *msg = i2c_dev->msg; + bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK); +- u32 i2c_count = readl(i2c_dev->base + I2C_COUNT); + u32 i2c_tran; + + if (msg->flags & I2C_M_RD) + i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD; + else +- i2c_tran = i2c_count; ++ i2c_tran = i2c_dev->count; + + /* + * If we got one ACK from slave when writing data, and we did not +@@ -408,14 +411,13 @@ static irqreturn_t sprd_i2c_isr(int irq, void *dev_id) + { + struct sprd_i2c *i2c_dev = dev_id; + struct i2c_msg *msg = i2c_dev->msg; +- u32 i2c_count = readl(i2c_dev->base + I2C_COUNT); + bool ack = !(readl(i2c_dev->base + I2C_STATUS) & I2C_RX_ACK); + u32 i2c_tran; + + if (msg->flags & I2C_M_RD) + i2c_tran = i2c_dev->count >= I2C_FIFO_FULL_THLD; + else +- i2c_tran = i2c_count; ++ i2c_tran = i2c_dev->count; + + /* + * If we did not get one ACK from slave when writing data, then we +@@ -586,11 +588,23 @@ static int sprd_i2c_remove(struct platform_device *pdev) + + static int __maybe_unused sprd_i2c_suspend_noirq(struct device *pdev) + { ++ struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev); ++ ++ i2c_lock_adapter(&i2c_dev->adap); ++ i2c_dev->is_suspended = true; ++ i2c_unlock_adapter(&i2c_dev->adap); ++ + return pm_runtime_force_suspend(pdev); + } + + static int __maybe_unused sprd_i2c_resume_noirq(struct device *pdev) + { ++ struct sprd_i2c *i2c_dev = dev_get_drvdata(pdev); ++ ++ i2c_lock_adapter(&i2c_dev->adap); ++ i2c_dev->is_suspended = false; ++ i2c_unlock_adapter(&i2c_dev->adap); ++ + return pm_runtime_force_resume(pdev); + } + +diff --git a/drivers/i2c/busses/i2c-viperboard.c b/drivers/i2c/busses/i2c-viperboard.c +index e4be86b3de9a..7235c7302bb7 100644 +--- a/drivers/i2c/busses/i2c-viperboard.c ++++ b/drivers/i2c/busses/i2c-viperboard.c +@@ -337,7 +337,7 @@ static int vprbrd_i2c_xfer(struct i2c_adapter *i2c, struct i2c_msg *msgs, + } + mutex_unlock(&vb->lock); + } +- return 0; ++ return num; + error: + mutex_unlock(&vb->lock); + return error; +diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig +index 3726205c8704..7507cc641de3 100644 +--- a/drivers/infiniband/Kconfig ++++ b/drivers/infiniband/Kconfig +@@ -60,9 +60,12 @@ config INFINIBAND_ON_DEMAND_PAGING + pages on demand instead. + + config INFINIBAND_ADDR_TRANS +- bool ++ bool "RDMA/CM" + depends on INFINIBAND + default y ++ ---help--- ++ Support for RDMA communication manager (CM). ++ This allows for a generic connection abstraction over RDMA. + + config INFINIBAND_ADDR_TRANS_CONFIGFS + bool +diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c +index 6c725c435f5d..79843a3ca9dc 100644 +--- a/drivers/infiniband/core/cma.c ++++ b/drivers/infiniband/core/cma.c +@@ -420,6 +420,8 @@ struct cma_hdr { + #define CMA_VERSION 0x00 + + struct cma_req_info { ++ struct sockaddr_storage listen_addr_storage; ++ struct sockaddr_storage src_addr_storage; + struct ib_device *device; + int port; + union ib_gid local_gid; +@@ -898,7 +900,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv, + { + struct ib_qp_attr qp_attr; + int qp_attr_mask, ret; +- union ib_gid sgid; + + mutex_lock(&id_priv->qp_mutex); + if (!id_priv->id.qp) { +@@ -921,12 +922,6 @@ static int cma_modify_qp_rtr(struct rdma_id_private *id_priv, + if (ret) + goto out; + +- ret = ib_query_gid(id_priv->id.device, id_priv->id.port_num, +- rdma_ah_read_grh(&qp_attr.ah_attr)->sgid_index, +- &sgid, NULL); +- if (ret) +- goto out; +- + BUG_ON(id_priv->cma_dev->device != id_priv->id.device); + + if (conn_param) +@@ -1372,11 +1367,11 @@ static bool validate_net_dev(struct net_device *net_dev, + } + + static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event, +- const struct cma_req_info *req) ++ struct cma_req_info *req) + { +- struct sockaddr_storage listen_addr_storage, src_addr_storage; +- struct sockaddr *listen_addr = (struct sockaddr *)&listen_addr_storage, +- *src_addr = (struct sockaddr *)&src_addr_storage; ++ struct sockaddr *listen_addr = ++ (struct sockaddr *)&req->listen_addr_storage; ++ struct sockaddr *src_addr = (struct sockaddr *)&req->src_addr_storage; + struct net_device *net_dev; + const union ib_gid *gid = req->has_gid ? &req->local_gid : NULL; + int err; +@@ -1391,11 +1386,6 @@ static struct net_device *cma_get_net_dev(struct ib_cm_event *ib_event, + if (!net_dev) + return ERR_PTR(-ENODEV); + +- if (!validate_net_dev(net_dev, listen_addr, src_addr)) { +- dev_put(net_dev); +- return ERR_PTR(-EHOSTUNREACH); +- } +- + return net_dev; + } + +@@ -1531,15 +1521,51 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, + } + } + ++ /* ++ * Net namespace might be getting deleted while route lookup, ++ * cm_id lookup is in progress. Therefore, perform netdevice ++ * validation, cm_id lookup under rcu lock. ++ * RCU lock along with netdevice state check, synchronizes with ++ * netdevice migrating to different net namespace and also avoids ++ * case where net namespace doesn't get deleted while lookup is in ++ * progress. ++ * If the device state is not IFF_UP, its properties such as ifindex ++ * and nd_net cannot be trusted to remain valid without rcu lock. ++ * net/core/dev.c change_net_namespace() ensures to synchronize with ++ * ongoing operations on net device after device is closed using ++ * synchronize_net(). ++ */ ++ rcu_read_lock(); ++ if (*net_dev) { ++ /* ++ * If netdevice is down, it is likely that it is administratively ++ * down or it might be migrating to different namespace. ++ * In that case avoid further processing, as the net namespace ++ * or ifindex may change. ++ */ ++ if (((*net_dev)->flags & IFF_UP) == 0) { ++ id_priv = ERR_PTR(-EHOSTUNREACH); ++ goto err; ++ } ++ ++ if (!validate_net_dev(*net_dev, ++ (struct sockaddr *)&req.listen_addr_storage, ++ (struct sockaddr *)&req.src_addr_storage)) { ++ id_priv = ERR_PTR(-EHOSTUNREACH); ++ goto err; ++ } ++ } ++ + bind_list = cma_ps_find(*net_dev ? dev_net(*net_dev) : &init_net, + rdma_ps_from_service_id(req.service_id), + cma_port_from_service_id(req.service_id)); + id_priv = cma_find_listener(bind_list, cm_id, ib_event, &req, *net_dev); ++err: ++ rcu_read_unlock(); + if (IS_ERR(id_priv) && *net_dev) { + dev_put(*net_dev); + *net_dev = NULL; + } +- + return id_priv; + } + +diff --git a/drivers/infiniband/core/iwpm_util.c b/drivers/infiniband/core/iwpm_util.c +index 81528f64061a..cb0fecc958b5 100644 +--- a/drivers/infiniband/core/iwpm_util.c ++++ b/drivers/infiniband/core/iwpm_util.c +@@ -114,7 +114,7 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr, + struct sockaddr_storage *mapped_sockaddr, + u8 nl_client) + { +- struct hlist_head *hash_bucket_head; ++ struct hlist_head *hash_bucket_head = NULL; + struct iwpm_mapping_info *map_info; + unsigned long flags; + int ret = -EINVAL; +@@ -142,6 +142,9 @@ int iwpm_create_mapinfo(struct sockaddr_storage *local_sockaddr, + } + } + spin_unlock_irqrestore(&iwpm_mapinfo_lock, flags); ++ ++ if (!hash_bucket_head) ++ kfree(map_info); + return ret; + } + +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index cb91245e9163..d8efdc191c27 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -60,7 +60,7 @@ module_param_named(recv_queue_size, mad_recvq_size, int, 0444); + MODULE_PARM_DESC(recv_queue_size, "Size of receive queue in number of work requests"); + + static struct list_head ib_mad_port_list; +-static u32 ib_mad_client_id = 0; ++static atomic_t ib_mad_client_id = ATOMIC_INIT(0); + + /* Port list lock */ + static DEFINE_SPINLOCK(ib_mad_port_list_lock); +@@ -378,7 +378,7 @@ struct ib_mad_agent *ib_register_mad_agent(struct ib_device *device, + } + + spin_lock_irqsave(&port_priv->reg_lock, flags); +- mad_agent_priv->agent.hi_tid = ++ib_mad_client_id; ++ mad_agent_priv->agent.hi_tid = atomic_inc_return(&ib_mad_client_id); + + /* + * Make sure MAD registration (if supplied) +diff --git a/drivers/infiniband/core/uverbs_ioctl.c b/drivers/infiniband/core/uverbs_ioctl.c +index 5e9f72ea4579..5feb8bbeff18 100644 +--- a/drivers/infiniband/core/uverbs_ioctl.c ++++ b/drivers/infiniband/core/uverbs_ioctl.c +@@ -191,6 +191,15 @@ static int uverbs_validate_kernel_mandatory(const struct uverbs_method_spec *met + return -EINVAL; + } + ++ for (; i < method_spec->num_buckets; i++) { ++ struct uverbs_attr_spec_hash *attr_spec_bucket = ++ method_spec->attr_buckets[i]; ++ ++ if (!bitmap_empty(attr_spec_bucket->mandatory_attrs_bitmask, ++ attr_spec_bucket->num_attrs)) ++ return -EINVAL; ++ } ++ + return 0; + } + +diff --git a/drivers/infiniband/hw/hfi1/affinity.c b/drivers/infiniband/hw/hfi1/affinity.c +index a97055dd4fbd..b5fab55cc275 100644 +--- a/drivers/infiniband/hw/hfi1/affinity.c ++++ b/drivers/infiniband/hw/hfi1/affinity.c +@@ -412,7 +412,6 @@ static void hfi1_cleanup_sdma_notifier(struct hfi1_msix_entry *msix) + static int get_irq_affinity(struct hfi1_devdata *dd, + struct hfi1_msix_entry *msix) + { +- int ret; + cpumask_var_t diff; + struct hfi1_affinity_node *entry; + struct cpu_mask_set *set = NULL; +@@ -424,10 +423,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + extra[0] = '\0'; + cpumask_clear(&msix->mask); + +- ret = zalloc_cpumask_var(&diff, GFP_KERNEL); +- if (!ret) +- return -ENOMEM; +- + entry = node_affinity_lookup(dd->node); + + switch (msix->type) { +@@ -458,6 +453,9 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + * finds its CPU here. + */ + if (cpu == -1 && set) { ++ if (!zalloc_cpumask_var(&diff, GFP_KERNEL)) ++ return -ENOMEM; ++ + if (cpumask_equal(&set->mask, &set->used)) { + /* + * We've used up all the CPUs, bump up the generation +@@ -469,6 +467,8 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + cpumask_andnot(diff, &set->mask, &set->used); + cpu = cpumask_first(diff); + cpumask_set_cpu(cpu, &set->used); ++ ++ free_cpumask_var(diff); + } + + cpumask_set_cpu(cpu, &msix->mask); +@@ -482,7 +482,6 @@ static int get_irq_affinity(struct hfi1_devdata *dd, + hfi1_setup_sdma_notifier(msix); + } + +- free_cpumask_var(diff); + return 0; + } + +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index d5c6ff843fc6..918dbd350c71 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -88,9 +88,9 @@ + * pio buffers per ctxt, etc.) Zero means use one user context per CPU. + */ + int num_user_contexts = -1; +-module_param_named(num_user_contexts, num_user_contexts, uint, S_IRUGO); ++module_param_named(num_user_contexts, num_user_contexts, int, 0444); + MODULE_PARM_DESC( +- num_user_contexts, "Set max number of user contexts to use"); ++ num_user_contexts, "Set max number of user contexts to use (default: -1 will use the real (non-HT) CPU count)"); + + uint krcvqs[RXE_NUM_DATA_VL]; + int krcvqsset; +diff --git a/drivers/infiniband/sw/rxe/rxe_opcode.c b/drivers/infiniband/sw/rxe/rxe_opcode.c +index 61927c165b59..4cf11063e0b5 100644 +--- a/drivers/infiniband/sw/rxe/rxe_opcode.c ++++ b/drivers/infiniband/sw/rxe/rxe_opcode.c +@@ -390,7 +390,7 @@ struct rxe_opcode_info rxe_opcode[RXE_NUM_OPCODE] = { + .name = "IB_OPCODE_RC_SEND_ONLY_INV", + .mask = RXE_IETH_MASK | RXE_PAYLOAD_MASK | RXE_REQ_MASK + | RXE_COMP_MASK | RXE_RWR_MASK | RXE_SEND_MASK +- | RXE_END_MASK, ++ | RXE_END_MASK | RXE_START_MASK, + .length = RXE_BTH_BYTES + RXE_IETH_BYTES, + .offset = { + [RXE_BTH] = 0, +diff --git a/drivers/infiniband/sw/rxe/rxe_req.c b/drivers/infiniband/sw/rxe/rxe_req.c +index 44b838ec9420..54cc9cb1e3b7 100644 +--- a/drivers/infiniband/sw/rxe/rxe_req.c ++++ b/drivers/infiniband/sw/rxe/rxe_req.c +@@ -728,7 +728,6 @@ int rxe_requester(void *arg) + rollback_state(wqe, qp, &rollback_wqe, rollback_psn); + + if (ret == -EAGAIN) { +- kfree_skb(skb); + rxe_run_task(&qp->req.task, 1); + goto exit; + } +diff --git a/drivers/infiniband/sw/rxe/rxe_resp.c b/drivers/infiniband/sw/rxe/rxe_resp.c +index 01f926fd9029..bd43c1c7a42f 100644 +--- a/drivers/infiniband/sw/rxe/rxe_resp.c ++++ b/drivers/infiniband/sw/rxe/rxe_resp.c +@@ -742,7 +742,6 @@ static enum resp_states read_reply(struct rxe_qp *qp, + err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); + if (err) { + pr_err("Failed sending RDMA reply.\n"); +- kfree_skb(skb); + return RESPST_ERR_RNR; + } + +@@ -955,10 +954,8 @@ static int send_ack(struct rxe_qp *qp, struct rxe_pkt_info *pkt, + } + + err = rxe_xmit_packet(rxe, qp, &ack_pkt, skb); +- if (err) { ++ if (err) + pr_err_ratelimited("Failed sending ack\n"); +- kfree_skb(skb); +- } + + err1: + return err; +@@ -1151,7 +1148,6 @@ static enum resp_states duplicate_request(struct rxe_qp *qp, + if (rc) { + pr_err("Failed resending result. This flow is not handled - skb ignored\n"); + rxe_drop_ref(qp); +- kfree_skb(skb_copy); + rc = RESPST_CLEANUP; + goto out; + } +diff --git a/drivers/infiniband/ulp/srp/Kconfig b/drivers/infiniband/ulp/srp/Kconfig +index c74ee9633041..99db8fe5173a 100644 +--- a/drivers/infiniband/ulp/srp/Kconfig ++++ b/drivers/infiniband/ulp/srp/Kconfig +@@ -1,6 +1,6 @@ + config INFINIBAND_SRP + tristate "InfiniBand SCSI RDMA Protocol" +- depends on SCSI ++ depends on SCSI && INFINIBAND_ADDR_TRANS + select SCSI_SRP_ATTRS + ---help--- + Support for the SCSI RDMA Protocol over InfiniBand. This +diff --git a/drivers/infiniband/ulp/srpt/Kconfig b/drivers/infiniband/ulp/srpt/Kconfig +index 31ee83d528d9..fb8b7182f05e 100644 +--- a/drivers/infiniband/ulp/srpt/Kconfig ++++ b/drivers/infiniband/ulp/srpt/Kconfig +@@ -1,6 +1,6 @@ + config INFINIBAND_SRPT + tristate "InfiniBand SCSI RDMA Protocol target support" +- depends on INFINIBAND && TARGET_CORE ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS && TARGET_CORE + ---help--- + + Support for the SCSI RDMA Protocol (SRP) Target driver. The +diff --git a/drivers/input/rmi4/rmi_spi.c b/drivers/input/rmi4/rmi_spi.c +index d97a85907ed6..d0c3d275bf9f 100644 +--- a/drivers/input/rmi4/rmi_spi.c ++++ b/drivers/input/rmi4/rmi_spi.c +@@ -147,8 +147,11 @@ static int rmi_spi_xfer(struct rmi_spi_xport *rmi_spi, + if (len > RMI_SPI_XFER_SIZE_LIMIT) + return -EINVAL; + +- if (rmi_spi->xfer_buf_size < len) +- rmi_spi_manage_pools(rmi_spi, len); ++ if (rmi_spi->xfer_buf_size < len) { ++ ret = rmi_spi_manage_pools(rmi_spi, len); ++ if (ret < 0) ++ return ret; ++ } + + if (addr == 0) + /* +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 429b694405c7..fc149ea64be7 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -275,7 +275,8 @@ struct mxt_data { + char phys[64]; /* device physical location */ + const struct mxt_platform_data *pdata; + struct mxt_object *object_table; +- struct mxt_info info; ++ struct mxt_info *info; ++ void *raw_info_block; + unsigned int irq; + unsigned int max_x; + unsigned int max_y; +@@ -450,12 +451,13 @@ static int mxt_lookup_bootloader_address(struct mxt_data *data, bool retry) + { + u8 appmode = data->client->addr; + u8 bootloader; ++ u8 family_id = data->info ? data->info->family_id : 0; + + switch (appmode) { + case 0x4a: + case 0x4b: + /* Chips after 1664S use different scheme */ +- if (retry || data->info.family_id >= 0xa2) { ++ if (retry || family_id >= 0xa2) { + bootloader = appmode - 0x24; + break; + } +@@ -682,7 +684,7 @@ mxt_get_object(struct mxt_data *data, u8 type) + struct mxt_object *object; + int i; + +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + object = data->object_table + i; + if (object->type == type) + return object; +@@ -1453,12 +1455,12 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + data_pos += offset; + } + +- if (cfg_info.family_id != data->info.family_id) { ++ if (cfg_info.family_id != data->info->family_id) { + dev_err(dev, "Family ID mismatch!\n"); + return -EINVAL; + } + +- if (cfg_info.variant_id != data->info.variant_id) { ++ if (cfg_info.variant_id != data->info->variant_id) { + dev_err(dev, "Variant ID mismatch!\n"); + return -EINVAL; + } +@@ -1503,7 +1505,7 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + + /* Malloc memory to store configuration */ + cfg_start_ofs = MXT_OBJECT_START + +- data->info.object_num * sizeof(struct mxt_object) + ++ data->info->object_num * sizeof(struct mxt_object) + + MXT_INFO_CHECKSUM_SIZE; + config_mem_size = data->mem_size - cfg_start_ofs; + config_mem = kzalloc(config_mem_size, GFP_KERNEL); +@@ -1554,20 +1556,6 @@ static int mxt_update_cfg(struct mxt_data *data, const struct firmware *cfg) + return ret; + } + +-static int mxt_get_info(struct mxt_data *data) +-{ +- struct i2c_client *client = data->client; +- struct mxt_info *info = &data->info; +- int error; +- +- /* Read 7-byte info block starting at address 0 */ +- error = __mxt_read_reg(client, 0, sizeof(*info), info); +- if (error) +- return error; +- +- return 0; +-} +- + static void mxt_free_input_device(struct mxt_data *data) + { + if (data->input_dev) { +@@ -1582,9 +1570,10 @@ static void mxt_free_object_table(struct mxt_data *data) + video_unregister_device(&data->dbg.vdev); + v4l2_device_unregister(&data->dbg.v4l2); + #endif +- +- kfree(data->object_table); + data->object_table = NULL; ++ data->info = NULL; ++ kfree(data->raw_info_block); ++ data->raw_info_block = NULL; + kfree(data->msg_buf); + data->msg_buf = NULL; + data->T5_address = 0; +@@ -1600,34 +1589,18 @@ static void mxt_free_object_table(struct mxt_data *data) + data->max_reportid = 0; + } + +-static int mxt_get_object_table(struct mxt_data *data) ++static int mxt_parse_object_table(struct mxt_data *data, ++ struct mxt_object *object_table) + { + struct i2c_client *client = data->client; +- size_t table_size; +- struct mxt_object *object_table; +- int error; + int i; + u8 reportid; + u16 end_address; + +- table_size = data->info.object_num * sizeof(struct mxt_object); +- object_table = kzalloc(table_size, GFP_KERNEL); +- if (!object_table) { +- dev_err(&data->client->dev, "Failed to allocate memory\n"); +- return -ENOMEM; +- } +- +- error = __mxt_read_reg(client, MXT_OBJECT_START, table_size, +- object_table); +- if (error) { +- kfree(object_table); +- return error; +- } +- + /* Valid Report IDs start counting from 1 */ + reportid = 1; + data->mem_size = 0; +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + struct mxt_object *object = object_table + i; + u8 min_id, max_id; + +@@ -1651,8 +1624,8 @@ static int mxt_get_object_table(struct mxt_data *data) + + switch (object->type) { + case MXT_GEN_MESSAGE_T5: +- if (data->info.family_id == 0x80 && +- data->info.version < 0x20) { ++ if (data->info->family_id == 0x80 && ++ data->info->version < 0x20) { + /* + * On mXT224 firmware versions prior to V2.0 + * read and discard unused CRC byte otherwise +@@ -1707,24 +1680,102 @@ static int mxt_get_object_table(struct mxt_data *data) + /* If T44 exists, T5 position has to be directly after */ + if (data->T44_address && (data->T5_address != data->T44_address + 1)) { + dev_err(&client->dev, "Invalid T44 position\n"); +- error = -EINVAL; +- goto free_object_table; ++ return -EINVAL; + } + + data->msg_buf = kcalloc(data->max_reportid, + data->T5_msg_size, GFP_KERNEL); +- if (!data->msg_buf) { +- dev_err(&client->dev, "Failed to allocate message buffer\n"); ++ if (!data->msg_buf) ++ return -ENOMEM; ++ ++ return 0; ++} ++ ++static int mxt_read_info_block(struct mxt_data *data) ++{ ++ struct i2c_client *client = data->client; ++ int error; ++ size_t size; ++ void *id_buf, *buf; ++ uint8_t num_objects; ++ u32 calculated_crc; ++ u8 *crc_ptr; ++ ++ /* If info block already allocated, free it */ ++ if (data->raw_info_block) ++ mxt_free_object_table(data); ++ ++ /* Read 7-byte ID information block starting at address 0 */ ++ size = sizeof(struct mxt_info); ++ id_buf = kzalloc(size, GFP_KERNEL); ++ if (!id_buf) ++ return -ENOMEM; ++ ++ error = __mxt_read_reg(client, 0, size, id_buf); ++ if (error) ++ goto err_free_mem; ++ ++ /* Resize buffer to give space for rest of info block */ ++ num_objects = ((struct mxt_info *)id_buf)->object_num; ++ size += (num_objects * sizeof(struct mxt_object)) ++ + MXT_INFO_CHECKSUM_SIZE; ++ ++ buf = krealloc(id_buf, size, GFP_KERNEL); ++ if (!buf) { + error = -ENOMEM; +- goto free_object_table; ++ goto err_free_mem; ++ } ++ id_buf = buf; ++ ++ /* Read rest of info block */ ++ error = __mxt_read_reg(client, MXT_OBJECT_START, ++ size - MXT_OBJECT_START, ++ id_buf + MXT_OBJECT_START); ++ if (error) ++ goto err_free_mem; ++ ++ /* Extract & calculate checksum */ ++ crc_ptr = id_buf + size - MXT_INFO_CHECKSUM_SIZE; ++ data->info_crc = crc_ptr[0] | (crc_ptr[1] << 8) | (crc_ptr[2] << 16); ++ ++ calculated_crc = mxt_calculate_crc(id_buf, 0, ++ size - MXT_INFO_CHECKSUM_SIZE); ++ ++ /* ++ * CRC mismatch can be caused by data corruption due to I2C comms ++ * issue or else device is not using Object Based Protocol (eg i2c-hid) ++ */ ++ if ((data->info_crc == 0) || (data->info_crc != calculated_crc)) { ++ dev_err(&client->dev, ++ "Info Block CRC error calculated=0x%06X read=0x%06X\n", ++ calculated_crc, data->info_crc); ++ error = -EIO; ++ goto err_free_mem; ++ } ++ ++ data->raw_info_block = id_buf; ++ data->info = (struct mxt_info *)id_buf; ++ ++ dev_info(&client->dev, ++ "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n", ++ data->info->family_id, data->info->variant_id, ++ data->info->version >> 4, data->info->version & 0xf, ++ data->info->build, data->info->object_num); ++ ++ /* Parse object table information */ ++ error = mxt_parse_object_table(data, id_buf + MXT_OBJECT_START); ++ if (error) { ++ dev_err(&client->dev, "Error %d parsing object table\n", error); ++ mxt_free_object_table(data); ++ goto err_free_mem; + } + +- data->object_table = object_table; ++ data->object_table = (struct mxt_object *)(id_buf + MXT_OBJECT_START); + + return 0; + +-free_object_table: +- mxt_free_object_table(data); ++err_free_mem: ++ kfree(id_buf); + return error; + } + +@@ -2039,7 +2090,7 @@ static int mxt_initialize(struct mxt_data *data) + int error; + + while (1) { +- error = mxt_get_info(data); ++ error = mxt_read_info_block(data); + if (!error) + break; + +@@ -2070,16 +2121,9 @@ static int mxt_initialize(struct mxt_data *data) + msleep(MXT_FW_RESET_TIME); + } + +- /* Get object table information */ +- error = mxt_get_object_table(data); +- if (error) { +- dev_err(&client->dev, "Error %d reading object table\n", error); +- return error; +- } +- + error = mxt_acquire_irq(data); + if (error) +- goto err_free_object_table; ++ return error; + + error = request_firmware_nowait(THIS_MODULE, true, MXT_CFG_NAME, + &client->dev, GFP_KERNEL, data, +@@ -2087,14 +2131,10 @@ static int mxt_initialize(struct mxt_data *data) + if (error) { + dev_err(&client->dev, "Failed to invoke firmware loader: %d\n", + error); +- goto err_free_object_table; ++ return error; + } + + return 0; +- +-err_free_object_table: +- mxt_free_object_table(data); +- return error; + } + + static int mxt_set_t7_power_cfg(struct mxt_data *data, u8 sleep) +@@ -2155,7 +2195,7 @@ static int mxt_init_t7_power_cfg(struct mxt_data *data) + static u16 mxt_get_debug_value(struct mxt_data *data, unsigned int x, + unsigned int y) + { +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + struct mxt_dbg *dbg = &data->dbg; + unsigned int ofs, page; + unsigned int col = 0; +@@ -2483,7 +2523,7 @@ static const struct video_device mxt_video_device = { + + static void mxt_debug_init(struct mxt_data *data) + { +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + struct mxt_dbg *dbg = &data->dbg; + struct mxt_object *object; + int error; +@@ -2569,7 +2609,6 @@ static int mxt_configure_objects(struct mxt_data *data, + const struct firmware *cfg) + { + struct device *dev = &data->client->dev; +- struct mxt_info *info = &data->info; + int error; + + error = mxt_init_t7_power_cfg(data); +@@ -2594,11 +2633,6 @@ static int mxt_configure_objects(struct mxt_data *data, + + mxt_debug_init(data); + +- dev_info(dev, +- "Family: %u Variant: %u Firmware V%u.%u.%02X Objects: %u\n", +- info->family_id, info->variant_id, info->version >> 4, +- info->version & 0xf, info->build, info->object_num); +- + return 0; + } + +@@ -2607,7 +2641,7 @@ static ssize_t mxt_fw_version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct mxt_data *data = dev_get_drvdata(dev); +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + return scnprintf(buf, PAGE_SIZE, "%u.%u.%02X\n", + info->version >> 4, info->version & 0xf, info->build); + } +@@ -2617,7 +2651,7 @@ static ssize_t mxt_hw_version_show(struct device *dev, + struct device_attribute *attr, char *buf) + { + struct mxt_data *data = dev_get_drvdata(dev); +- struct mxt_info *info = &data->info; ++ struct mxt_info *info = data->info; + return scnprintf(buf, PAGE_SIZE, "%u.%u\n", + info->family_id, info->variant_id); + } +@@ -2656,7 +2690,7 @@ static ssize_t mxt_object_show(struct device *dev, + return -ENOMEM; + + error = 0; +- for (i = 0; i < data->info.object_num; i++) { ++ for (i = 0; i < data->info->object_num; i++) { + object = data->object_table + i; + + if (!mxt_object_readable(object->type)) +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 57c920c1372d..e3dbb6101b4a 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -1342,7 +1342,7 @@ void qi_flush_dev_iotlb(struct intel_iommu *iommu, u16 sid, u16 qdep, + struct qi_desc desc; + + if (mask) { +- BUG_ON(addr & ((1 << (VTD_PAGE_SHIFT + mask)) - 1)); ++ BUG_ON(addr & ((1ULL << (VTD_PAGE_SHIFT + mask)) - 1)); + addr |= (1ULL << (VTD_PAGE_SHIFT + mask - 1)) - 1; + desc.high = QI_DEV_IOTLB_ADDR(addr) | QI_DEV_IOTLB_SIZE; + } else +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 365a8cc62405..b6a681bce400 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -604,7 +604,7 @@ void can_bus_off(struct net_device *dev) + { + struct can_priv *priv = netdev_priv(dev); + +- netdev_dbg(dev, "bus-off\n"); ++ netdev_info(dev, "bus-off\n"); + + netif_carrier_off(dev); + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +index c93e5613d4cc..cc658a29cc33 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c +@@ -310,6 +310,8 @@ int aq_nic_ndev_init(struct aq_nic_s *self) + + self->ndev->hw_features |= aq_hw_caps->hw_features; + self->ndev->features = aq_hw_caps->hw_features; ++ self->ndev->vlan_features |= NETIF_F_HW_CSUM | NETIF_F_RXCSUM | ++ NETIF_F_RXHASH | NETIF_F_SG | NETIF_F_LRO; + self->ndev->priv_flags = aq_hw_caps->hw_priv_flags; + self->ndev->mtu = aq_nic_cfg->mtu - ETH_HLEN; + self->ndev->max_mtu = self->aq_hw_caps.mtu - ETH_FCS_LEN - ETH_HLEN; +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.h b/drivers/net/ethernet/hisilicon/hns/hnae.h +index 3e62692af011..fa5b30f547f6 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.h ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.h +@@ -87,7 +87,7 @@ do { \ + + #define HNAE_AE_REGISTER 0x1 + +-#define RCB_RING_NAME_LEN 16 ++#define RCB_RING_NAME_LEN (IFNAMSIZ + 4) + + #define HNAE_LOWEST_LATENCY_COAL_PARAM 30 + #define HNAE_LOW_LATENCY_COAL_PARAM 80 +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +index 8a85217845ae..cf6a245db6d5 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c +@@ -3413,6 +3413,9 @@ static s32 ixgbe_reset_hw_X550em(struct ixgbe_hw *hw) + hw->phy.sfp_setup_needed = false; + } + ++ if (status == IXGBE_ERR_SFP_NOT_SUPPORTED) ++ return status; ++ + /* Reset PHY */ + if (!hw->phy.reset_disable && hw->phy.ops.reset) + hw->phy.ops.reset(hw); +diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +index f88ff3f4b661..35d14af235f7 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c ++++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c +@@ -277,8 +277,7 @@ nfp_nsp_wait_reg(struct nfp_cpp *cpp, u64 *reg, + if ((*reg & mask) == val) + return 0; + +- if (msleep_interruptible(25)) +- return -ERESTARTSYS; ++ msleep(25); + + if (time_after(start_time, wait_until)) + return -ETIMEDOUT; +diff --git a/drivers/net/ethernet/qlogic/qed/qed_l2.c b/drivers/net/ethernet/qlogic/qed/qed_l2.c +index 085338990f49..c5452b445c37 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_l2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_l2.c +@@ -115,8 +115,7 @@ int qed_l2_alloc(struct qed_hwfn *p_hwfn) + + void qed_l2_setup(struct qed_hwfn *p_hwfn) + { +- if (p_hwfn->hw_info.personality != QED_PCI_ETH && +- p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) ++ if (!QED_IS_L2_PERSONALITY(p_hwfn)) + return; + + mutex_init(&p_hwfn->p_l2_info->lock); +@@ -126,8 +125,7 @@ void qed_l2_free(struct qed_hwfn *p_hwfn) + { + u32 i; + +- if (p_hwfn->hw_info.personality != QED_PCI_ETH && +- p_hwfn->hw_info.personality != QED_PCI_ETH_ROCE) ++ if (!QED_IS_L2_PERSONALITY(p_hwfn)) + return; + + if (!p_hwfn->p_l2_info) +diff --git a/drivers/net/ethernet/qlogic/qede/qede_rdma.c b/drivers/net/ethernet/qlogic/qede/qede_rdma.c +index 50b142fad6b8..1900bf7e67d1 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_rdma.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_rdma.c +@@ -238,7 +238,7 @@ qede_rdma_get_free_event_node(struct qede_dev *edev) + } + + if (!found) { +- event_node = kzalloc(sizeof(*event_node), GFP_KERNEL); ++ event_node = kzalloc(sizeof(*event_node), GFP_ATOMIC); + if (!event_node) { + DP_NOTICE(edev, + "qedr: Could not allocate memory for rdma work\n"); +diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c +index a3f456b91c99..e9e67c22c8bb 100644 +--- a/drivers/net/phy/marvell.c ++++ b/drivers/net/phy/marvell.c +@@ -1409,6 +1409,15 @@ static int m88e1318_set_wol(struct phy_device *phydev, + if (err < 0) + return err; + ++ /* If WOL event happened once, the LED[2] interrupt pin ++ * will not be cleared unless we reading the interrupt status ++ * register. If interrupts are in use, the normal interrupt ++ * handling will clear the WOL event. Clear the WOL event ++ * before enabling it if !phy_interrupt_is_valid() ++ */ ++ if (!phy_interrupt_is_valid(phydev)) ++ phy_read(phydev, MII_M1011_IEVENT); ++ + /* Enable the WOL interrupt */ + temp = phy_read(phydev, MII_88E1318S_PHY_CSIER); + temp |= MII_88E1318S_PHY_CSIER_WOL_EIE; +diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig +index 46d6cb1e03bd..8f845de8a8a2 100644 +--- a/drivers/nvme/host/Kconfig ++++ b/drivers/nvme/host/Kconfig +@@ -18,7 +18,7 @@ config NVME_FABRICS + + config NVME_RDMA + tristate "NVM Express over Fabrics RDMA host driver" +- depends on INFINIBAND && BLOCK ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS && BLOCK + select NVME_CORE + select NVME_FABRICS + select SG_POOL +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index dd956311a85a..38c128f230e7 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -665,6 +665,7 @@ static int nvme_submit_user_cmd(struct request_queue *q, + ret = PTR_ERR(meta); + goto out_unmap; + } ++ req->cmd_flags |= REQ_INTEGRITY; + } + } + +diff --git a/drivers/nvme/host/fabrics.c b/drivers/nvme/host/fabrics.c +index 740aae51e1c6..33d060c524e6 100644 +--- a/drivers/nvme/host/fabrics.c ++++ b/drivers/nvme/host/fabrics.c +@@ -587,6 +587,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->transport); + opts->transport = p; + break; + case NVMF_OPT_NQN: +@@ -595,6 +596,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->subsysnqn); + opts->subsysnqn = p; + nqnlen = strlen(opts->subsysnqn); + if (nqnlen >= NVMF_NQN_SIZE) { +@@ -617,6 +619,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->traddr); + opts->traddr = p; + break; + case NVMF_OPT_TRSVCID: +@@ -625,6 +628,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->trsvcid); + opts->trsvcid = p; + break; + case NVMF_OPT_QUEUE_SIZE: +@@ -706,6 +710,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -EINVAL; + goto out; + } ++ nvmf_host_put(opts->host); + opts->host = nvmf_host_add(p); + kfree(p); + if (!opts->host) { +@@ -731,6 +736,7 @@ static int nvmf_parse_options(struct nvmf_ctrl_options *opts, + ret = -ENOMEM; + goto out; + } ++ kfree(opts->host_traddr); + opts->host_traddr = p; + break; + case NVMF_OPT_HOST_ID: +diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig +index 03e4ab65fe77..48d20c2c1256 100644 +--- a/drivers/nvme/target/Kconfig ++++ b/drivers/nvme/target/Kconfig +@@ -27,7 +27,7 @@ config NVME_TARGET_LOOP + + config NVME_TARGET_RDMA + tristate "NVMe over Fabrics RDMA target support" +- depends on INFINIBAND ++ depends on INFINIBAND && INFINIBAND_ADDR_TRANS + depends on NVME_TARGET + help + This enables the NVMe RDMA target support, which allows exporting NVMe +diff --git a/drivers/pci/dwc/pcie-kirin.c b/drivers/pci/dwc/pcie-kirin.c +index dc3033cf3c19..efc317e7669d 100644 +--- a/drivers/pci/dwc/pcie-kirin.c ++++ b/drivers/pci/dwc/pcie-kirin.c +@@ -490,7 +490,7 @@ static int kirin_pcie_probe(struct platform_device *pdev) + return ret; + + kirin_pcie->gpio_id_reset = of_get_named_gpio(dev->of_node, +- "reset-gpio", 0); ++ "reset-gpios", 0); + if (kirin_pcie->gpio_id_reset < 0) + return -ENODEV; + +diff --git a/drivers/remoteproc/qcom_q6v5_pil.c b/drivers/remoteproc/qcom_q6v5_pil.c +index 2d3d5ac92c06..81ec9b6805fc 100644 +--- a/drivers/remoteproc/qcom_q6v5_pil.c ++++ b/drivers/remoteproc/qcom_q6v5_pil.c +@@ -915,6 +915,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + dev_err(qproc->dev, "unable to resolve mba region\n"); + return ret; + } ++ of_node_put(node); + + qproc->mba_phys = r.start; + qproc->mba_size = resource_size(&r); +@@ -932,6 +933,7 @@ static int q6v5_alloc_memory_region(struct q6v5 *qproc) + dev_err(qproc->dev, "unable to resolve mpss region\n"); + return ret; + } ++ of_node_put(node); + + qproc->mpss_phys = qproc->mpss_reloc = r.start; + qproc->mpss_size = resource_size(&r); +diff --git a/drivers/rpmsg/rpmsg_char.c b/drivers/rpmsg/rpmsg_char.c +index e0996fce3963..6a5b5b16145e 100644 +--- a/drivers/rpmsg/rpmsg_char.c ++++ b/drivers/rpmsg/rpmsg_char.c +@@ -581,4 +581,6 @@ static void rpmsg_chrdev_exit(void) + unregister_chrdev_region(rpmsg_major, RPMSG_DEV_MAX); + } + module_exit(rpmsg_chrdev_exit); ++ ++MODULE_ALIAS("rpmsg:rpmsg_chrdev"); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/s390/net/smsgiucv.c b/drivers/s390/net/smsgiucv.c +index a851d34c642b..04674ce961f1 100644 +--- a/drivers/s390/net/smsgiucv.c ++++ b/drivers/s390/net/smsgiucv.c +@@ -189,7 +189,7 @@ static struct device_driver smsg_driver = { + + static void __exit smsg_exit(void) + { +- cpcmd("SET SMSG IUCV", NULL, 0, NULL); ++ cpcmd("SET SMSG OFF", NULL, 0, NULL); + device_unregister(smsg_dev); + iucv_unregister(&smsg_handler, 1); + driver_unregister(&smsg_driver); +diff --git a/drivers/scsi/isci/port_config.c b/drivers/scsi/isci/port_config.c +index ac879745ef80..18a409bb9e0c 100644 +--- a/drivers/scsi/isci/port_config.c ++++ b/drivers/scsi/isci/port_config.c +@@ -291,7 +291,7 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost, + * Note: We have not moved the current phy_index so we will actually + * compare the startting phy with itself. + * This is expected and required to add the phy to the port. */ +- while (phy_index < SCI_MAX_PHYS) { ++ for (; phy_index < SCI_MAX_PHYS; phy_index++) { + if ((phy_mask & (1 << phy_index)) == 0) + continue; + sci_phy_get_sas_address(&ihost->phys[phy_index], +@@ -311,7 +311,6 @@ sci_mpc_agent_validate_phy_configuration(struct isci_host *ihost, + &ihost->phys[phy_index]); + + assigned_phy_mask |= (1 << phy_index); +- phy_index++; + } + + } +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 4bf406df051b..72a919179d06 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -903,7 +903,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + goto fail_fw_init; + } + +- ret = 0; ++ return 0; + + fail_fw_init: + megasas_return_cmd(instance, cmd); +@@ -913,8 +913,8 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + IOCInitMessage, ioc_init_handle); + fail_get_cmd: + dev_err(&instance->pdev->dev, +- "Init cmd return status %s for SCSI host %d\n", +- ret ? "FAILED" : "SUCCESS", instance->host->host_no); ++ "Init cmd return status FAILED for SCSI host %d\n", ++ instance->host->host_no); + + return ret; + } +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 7404d26895f5..f6542c159ed6 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -2322,6 +2322,12 @@ iscsi_multicast_skb(struct sk_buff *skb, uint32_t group, gfp_t gfp) + return nlmsg_multicast(nls, skb, 0, group, gfp); + } + ++static int ++iscsi_unicast_skb(struct sk_buff *skb, u32 portid) ++{ ++ return nlmsg_unicast(nls, skb, portid); ++} ++ + int iscsi_recv_pdu(struct iscsi_cls_conn *conn, struct iscsi_hdr *hdr, + char *data, uint32_t data_size) + { +@@ -2524,14 +2530,11 @@ void iscsi_ping_comp_event(uint32_t host_no, struct iscsi_transport *transport, + EXPORT_SYMBOL_GPL(iscsi_ping_comp_event); + + static int +-iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi, +- void *payload, int size) ++iscsi_if_send_reply(u32 portid, int type, void *payload, int size) + { + struct sk_buff *skb; + struct nlmsghdr *nlh; + int len = nlmsg_total_size(size); +- int flags = multi ? NLM_F_MULTI : 0; +- int t = done ? NLMSG_DONE : type; + + skb = alloc_skb(len, GFP_ATOMIC); + if (!skb) { +@@ -2539,10 +2542,9 @@ iscsi_if_send_reply(uint32_t group, int seq, int type, int done, int multi, + return -ENOMEM; + } + +- nlh = __nlmsg_put(skb, 0, 0, t, (len - sizeof(*nlh)), 0); +- nlh->nlmsg_flags = flags; ++ nlh = __nlmsg_put(skb, 0, 0, type, (len - sizeof(*nlh)), 0); + memcpy(nlmsg_data(nlh), payload, size); +- return iscsi_multicast_skb(skb, group, GFP_ATOMIC); ++ return iscsi_unicast_skb(skb, portid); + } + + static int +@@ -3470,6 +3472,7 @@ static int + iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + { + int err = 0; ++ u32 portid; + struct iscsi_uevent *ev = nlmsg_data(nlh); + struct iscsi_transport *transport = NULL; + struct iscsi_internal *priv; +@@ -3490,10 +3493,12 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + if (!try_module_get(transport->owner)) + return -EINVAL; + ++ portid = NETLINK_CB(skb).portid; ++ + switch (nlh->nlmsg_type) { + case ISCSI_UEVENT_CREATE_SESSION: + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CB(skb).portid, ++ portid, + ev->u.c_session.initial_cmdsn, + ev->u.c_session.cmds_max, + ev->u.c_session.queue_depth); +@@ -3506,7 +3511,7 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + } + + err = iscsi_if_create_session(priv, ep, ev, +- NETLINK_CB(skb).portid, ++ portid, + ev->u.c_bound_session.initial_cmdsn, + ev->u.c_bound_session.cmds_max, + ev->u.c_bound_session.queue_depth); +@@ -3664,6 +3669,8 @@ iscsi_if_recv_msg(struct sk_buff *skb, struct nlmsghdr *nlh, uint32_t *group) + static void + iscsi_if_rx(struct sk_buff *skb) + { ++ u32 portid = NETLINK_CB(skb).portid; ++ + mutex_lock(&rx_queue_mutex); + while (skb->len >= NLMSG_HDRLEN) { + int err; +@@ -3699,8 +3706,8 @@ iscsi_if_rx(struct sk_buff *skb) + break; + if (ev->type == ISCSI_UEVENT_GET_CHAP && !err) + break; +- err = iscsi_if_send_reply(group, nlh->nlmsg_seq, +- nlh->nlmsg_type, 0, 0, ev, sizeof(*ev)); ++ err = iscsi_if_send_reply(portid, nlh->nlmsg_type, ++ ev, sizeof(*ev)); + } while (err < 0 && err != -ECONNREFUSED && err != -ESRCH); + skb_pull(skb, rlen); + } +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index c44de0b4a995..beb585ddc07d 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -1725,11 +1725,14 @@ static int storvsc_probe(struct hv_device *device, + max_targets = STORVSC_MAX_TARGETS; + max_channels = STORVSC_MAX_CHANNELS; + /* +- * On Windows8 and above, we support sub-channels for storage. ++ * On Windows8 and above, we support sub-channels for storage ++ * on SCSI and FC controllers. + * The number of sub-channels offerred is based on the number of + * VCPUs in the guest. + */ +- max_sub_channels = (num_cpus / storvsc_vcpus_per_sub_channel); ++ if (!dev_is_ide) ++ max_sub_channels = ++ (num_cpus - 1) / storvsc_vcpus_per_sub_channel; + } + + scsi_driver.can_queue = (max_outstanding_req_per_channel * +diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c +index c374e3b5c678..777e5f1e52d1 100644 +--- a/drivers/scsi/vmw_pvscsi.c ++++ b/drivers/scsi/vmw_pvscsi.c +@@ -609,7 +609,7 @@ static void pvscsi_complete_request(struct pvscsi_adapter *adapter, + break; + + case BTSTAT_ABORTQUEUE: +- cmd->result = (DID_ABORT << 16); ++ cmd->result = (DID_BUS_BUSY << 16); + break; + + case BTSTAT_SCSIPARITY: +diff --git a/drivers/soc/bcm/raspberrypi-power.c b/drivers/soc/bcm/raspberrypi-power.c +index fe96a8b956fb..f7ed1187518b 100644 +--- a/drivers/soc/bcm/raspberrypi-power.c ++++ b/drivers/soc/bcm/raspberrypi-power.c +@@ -45,7 +45,7 @@ struct rpi_power_domains { + struct rpi_power_domain_packet { + u32 domain; + u32 on; +-} __packet; ++}; + + /* + * Asks the firmware to enable or disable power on a specific power +diff --git a/drivers/spi/spi-bcm2835aux.c b/drivers/spi/spi-bcm2835aux.c +index 7428091d3f5b..bd00b7cc8b78 100644 +--- a/drivers/spi/spi-bcm2835aux.c ++++ b/drivers/spi/spi-bcm2835aux.c +@@ -184,6 +184,11 @@ static irqreturn_t bcm2835aux_spi_interrupt(int irq, void *dev_id) + struct bcm2835aux_spi *bs = spi_master_get_devdata(master); + irqreturn_t ret = IRQ_NONE; + ++ /* IRQ may be shared, so return if our interrupts are disabled */ ++ if (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_CNTL1) & ++ (BCM2835_AUX_SPI_CNTL1_TXEMPTY | BCM2835_AUX_SPI_CNTL1_IDLE))) ++ return ret; ++ + /* check if we have data to read */ + while (bs->rx_len && + (!(bcm2835aux_rd(bs, BCM2835_AUX_SPI_STAT) & +diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c +index 5c9516ae4942..4a001634023e 100644 +--- a/drivers/spi/spi-cadence.c ++++ b/drivers/spi/spi-cadence.c +@@ -313,6 +313,14 @@ static void cdns_spi_fill_tx_fifo(struct cdns_spi *xspi) + + while ((trans_cnt < CDNS_SPI_FIFO_DEPTH) && + (xspi->tx_bytes > 0)) { ++ ++ /* When xspi in busy condition, bytes may send failed, ++ * then spi control did't work thoroughly, add one byte delay ++ */ ++ if (cdns_spi_read(xspi, CDNS_SPI_ISR) & ++ CDNS_SPI_IXR_TXFULL) ++ usleep_range(10, 20); ++ + if (xspi->txbuf) + cdns_spi_write(xspi, CDNS_SPI_TXD, *xspi->txbuf++); + else +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 2770fbd4ce49..52056535f54e 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -277,6 +277,7 @@ static void sh_msiof_spi_set_clk_regs(struct sh_msiof_spi_priv *p, + } + + k = min_t(int, k, ARRAY_SIZE(sh_msiof_spi_div_table) - 1); ++ brps = min_t(int, brps, 32); + + scr = sh_msiof_spi_div_table[k].brdv | SCR_BRPS(brps); + sh_msiof_write(p, TSCR, scr); +diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c +index 0d99b242e82e..6cb933ecc084 100644 +--- a/drivers/target/target_core_pscsi.c ++++ b/drivers/target/target_core_pscsi.c +@@ -890,6 +890,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + bytes = min(bytes, data_len); + + if (!bio) { ++new_bio: + nr_vecs = min_t(int, BIO_MAX_PAGES, nr_pages); + nr_pages -= nr_vecs; + /* +@@ -931,6 +932,7 @@ pscsi_map_sg(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, + * be allocated with pscsi_get_bio() above. + */ + bio = NULL; ++ goto new_bio; + } + + data_len -= bytes; +diff --git a/drivers/tee/tee_core.c b/drivers/tee/tee_core.c +index 58a5009eacc3..a548c3695797 100644 +--- a/drivers/tee/tee_core.c ++++ b/drivers/tee/tee_core.c +@@ -181,6 +181,17 @@ static int params_from_user(struct tee_context *ctx, struct tee_param *params, + if (IS_ERR(shm)) + return PTR_ERR(shm); + ++ /* ++ * Ensure offset + size does not overflow offset ++ * and does not overflow the size of the referred ++ * shared memory object. ++ */ ++ if ((ip.a + ip.b) < ip.a || ++ (ip.a + ip.b) > shm->size) { ++ tee_shm_put(shm); ++ return -EINVAL; ++ } ++ + params[n].u.memref.shm_offs = ip.a; + params[n].u.memref.size = ip.b; + params[n].u.memref.shm = shm; +diff --git a/drivers/thermal/int340x_thermal/int3403_thermal.c b/drivers/thermal/int340x_thermal/int3403_thermal.c +index 8a7f24dd9315..0c19fcd56a0d 100644 +--- a/drivers/thermal/int340x_thermal/int3403_thermal.c ++++ b/drivers/thermal/int340x_thermal/int3403_thermal.c +@@ -194,6 +194,7 @@ static int int3403_cdev_add(struct int3403_priv *priv) + return -EFAULT; + } + ++ priv->priv = obj; + obj->max_state = p->package.count - 1; + obj->cdev = + thermal_cooling_device_register(acpi_device_bid(priv->adev), +@@ -201,8 +202,6 @@ static int int3403_cdev_add(struct int3403_priv *priv) + if (IS_ERR(obj->cdev)) + result = PTR_ERR(obj->cdev); + +- priv->priv = obj; +- + kfree(buf.pointer); + /* TODO: add ACPI notification support */ + +diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c +index 5a6dca01a1d0..802388bb42ba 100644 +--- a/drivers/usb/musb/musb_host.c ++++ b/drivers/usb/musb/musb_host.c +@@ -2560,8 +2560,11 @@ static int musb_bus_suspend(struct usb_hcd *hcd) + { + struct musb *musb = hcd_to_musb(hcd); + u8 devctl; ++ int ret; + +- musb_port_suspend(musb, true); ++ ret = musb_port_suspend(musb, true); ++ if (ret) ++ return ret; + + if (!is_host_active(musb)) + return 0; +diff --git a/drivers/usb/musb/musb_host.h b/drivers/usb/musb/musb_host.h +index 7bbf01bf4bb0..54d02ed032df 100644 +--- a/drivers/usb/musb/musb_host.h ++++ b/drivers/usb/musb/musb_host.h +@@ -92,7 +92,7 @@ extern void musb_host_rx(struct musb *, u8); + extern void musb_root_disconnect(struct musb *musb); + extern void musb_host_resume_root_hub(struct musb *musb); + extern void musb_host_poke_root_hub(struct musb *musb); +-extern void musb_port_suspend(struct musb *musb, bool do_suspend); ++extern int musb_port_suspend(struct musb *musb, bool do_suspend); + extern void musb_port_reset(struct musb *musb, bool do_reset); + extern void musb_host_finish_resume(struct work_struct *work); + #else +@@ -124,7 +124,10 @@ static inline void musb_root_disconnect(struct musb *musb) {} + static inline void musb_host_resume_root_hub(struct musb *musb) {} + static inline void musb_host_poll_rh_status(struct musb *musb) {} + static inline void musb_host_poke_root_hub(struct musb *musb) {} +-static inline void musb_port_suspend(struct musb *musb, bool do_suspend) {} ++static inline int musb_port_suspend(struct musb *musb, bool do_suspend) ++{ ++ return 0; ++} + static inline void musb_port_reset(struct musb *musb, bool do_reset) {} + static inline void musb_host_finish_resume(struct work_struct *work) {} + #endif +diff --git a/drivers/usb/musb/musb_virthub.c b/drivers/usb/musb/musb_virthub.c +index 0b4595439d51..5eca5d2d5e00 100644 +--- a/drivers/usb/musb/musb_virthub.c ++++ b/drivers/usb/musb/musb_virthub.c +@@ -73,14 +73,14 @@ void musb_host_finish_resume(struct work_struct *work) + spin_unlock_irqrestore(&musb->lock, flags); + } + +-void musb_port_suspend(struct musb *musb, bool do_suspend) ++int musb_port_suspend(struct musb *musb, bool do_suspend) + { + struct usb_otg *otg = musb->xceiv->otg; + u8 power; + void __iomem *mbase = musb->mregs; + + if (!is_host_active(musb)) +- return; ++ return 0; + + /* NOTE: this doesn't necessarily put PHY into low power mode, + * turning off its clock; that's a function of PHY integration and +@@ -91,16 +91,20 @@ void musb_port_suspend(struct musb *musb, bool do_suspend) + if (do_suspend) { + int retries = 10000; + +- power &= ~MUSB_POWER_RESUME; +- power |= MUSB_POWER_SUSPENDM; +- musb_writeb(mbase, MUSB_POWER, power); ++ if (power & MUSB_POWER_RESUME) ++ return -EBUSY; + +- /* Needed for OPT A tests */ +- power = musb_readb(mbase, MUSB_POWER); +- while (power & MUSB_POWER_SUSPENDM) { ++ if (!(power & MUSB_POWER_SUSPENDM)) { ++ power |= MUSB_POWER_SUSPENDM; ++ musb_writeb(mbase, MUSB_POWER, power); ++ ++ /* Needed for OPT A tests */ + power = musb_readb(mbase, MUSB_POWER); +- if (retries-- < 1) +- break; ++ while (power & MUSB_POWER_SUSPENDM) { ++ power = musb_readb(mbase, MUSB_POWER); ++ if (retries-- < 1) ++ break; ++ } + } + + musb_dbg(musb, "Root port suspended, power %02x", power); +@@ -136,6 +140,7 @@ void musb_port_suspend(struct musb *musb, bool do_suspend) + schedule_delayed_work(&musb->finish_resume_work, + msecs_to_jiffies(USB_RESUME_TIMEOUT)); + } ++ return 0; + } + + void musb_port_reset(struct musb *musb, bool do_reset) +diff --git a/drivers/usb/typec/ucsi/Makefile b/drivers/usb/typec/ucsi/Makefile +index b57891c1fd31..7afbea512207 100644 +--- a/drivers/usb/typec/ucsi/Makefile ++++ b/drivers/usb/typec/ucsi/Makefile +@@ -5,6 +5,6 @@ obj-$(CONFIG_TYPEC_UCSI) += typec_ucsi.o + + typec_ucsi-y := ucsi.o + +-typec_ucsi-$(CONFIG_FTRACE) += trace.o ++typec_ucsi-$(CONFIG_TRACING) += trace.o + + obj-$(CONFIG_UCSI_ACPI) += ucsi_acpi.o +diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c +index d2edbc79384a..83243af22d51 100644 +--- a/drivers/xen/xenbus/xenbus_dev_frontend.c ++++ b/drivers/xen/xenbus/xenbus_dev_frontend.c +@@ -403,7 +403,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u, + { + struct { + struct xsd_sockmsg hdr; +- const char body[16]; ++ char body[16]; + } msg; + int rc; + +@@ -412,6 +412,7 @@ static int xenbus_command_reply(struct xenbus_file_priv *u, + msg.hdr.len = strlen(reply) + 1; + if (msg.hdr.len > sizeof(msg.body)) + return -E2BIG; ++ memcpy(&msg.body, reply, msg.hdr.len); + + mutex_lock(&u->reply_mutex); + rc = queue_reply(&u->read_buffers, &msg, sizeof(msg.hdr) + msg.hdr.len); +diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c +index 9f715c3edcf9..ccc9c708a860 100644 +--- a/fs/afs/rxrpc.c ++++ b/fs/afs/rxrpc.c +@@ -55,6 +55,7 @@ int afs_open_socket(void) + { + struct sockaddr_rxrpc srx; + struct socket *socket; ++ unsigned int min_level; + int ret; + + _enter(""); +@@ -80,6 +81,12 @@ int afs_open_socket(void) + memset(&srx.transport.sin.sin_addr, 0, + sizeof(srx.transport.sin.sin_addr)); + ++ min_level = RXRPC_SECURITY_ENCRYPT; ++ ret = kernel_setsockopt(socket, SOL_RXRPC, RXRPC_MIN_SECURITY_LEVEL, ++ (void *)&min_level, sizeof(min_level)); ++ if (ret < 0) ++ goto error_2; ++ + ret = kernel_bind(socket, (struct sockaddr *) &srx, sizeof(srx)); + if (ret < 0) + goto error_2; +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index e3f6c49e5c4d..24613b4e224c 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -301,6 +301,11 @@ static void __scrub_blocked_if_needed(struct btrfs_fs_info *fs_info); + static void scrub_blocked_if_needed(struct btrfs_fs_info *fs_info); + static void scrub_put_ctx(struct scrub_ctx *sctx); + ++static inline int scrub_is_page_on_raid56(struct scrub_page *page) ++{ ++ return page->recover && ++ (page->recover->bbio->map_type & BTRFS_BLOCK_GROUP_RAID56_MASK); ++} + + static void scrub_pending_bio_inc(struct scrub_ctx *sctx) + { +@@ -1323,15 +1328,34 @@ static int scrub_handle_errored_block(struct scrub_block *sblock_to_check) + * could happen otherwise that a correct page would be + * overwritten by a bad one). + */ +- for (mirror_index = 0; +- mirror_index < BTRFS_MAX_MIRRORS && +- sblocks_for_recheck[mirror_index].page_count > 0; +- mirror_index++) { ++ for (mirror_index = 0; ;mirror_index++) { + struct scrub_block *sblock_other; + + if (mirror_index == failed_mirror_index) + continue; +- sblock_other = sblocks_for_recheck + mirror_index; ++ ++ /* raid56's mirror can be more than BTRFS_MAX_MIRRORS */ ++ if (!scrub_is_page_on_raid56(sblock_bad->pagev[0])) { ++ if (mirror_index >= BTRFS_MAX_MIRRORS) ++ break; ++ if (!sblocks_for_recheck[mirror_index].page_count) ++ break; ++ ++ sblock_other = sblocks_for_recheck + mirror_index; ++ } else { ++ struct scrub_recover *r = sblock_bad->pagev[0]->recover; ++ int max_allowed = r->bbio->num_stripes - ++ r->bbio->num_tgtdevs; ++ ++ if (mirror_index >= max_allowed) ++ break; ++ if (!sblocks_for_recheck[1].page_count) ++ break; ++ ++ ASSERT(failed_mirror_index == 0); ++ sblock_other = sblocks_for_recheck + 1; ++ sblock_other->pagev[0]->mirror_num = 1 + mirror_index; ++ } + + /* build and submit the bios, check checksums */ + scrub_recheck_block(fs_info, sblock_other, 0); +@@ -1679,18 +1703,13 @@ static void scrub_bio_wait_endio(struct bio *bio) + complete(&ret->event); + } + +-static inline int scrub_is_page_on_raid56(struct scrub_page *page) +-{ +- return page->recover && +- (page->recover->bbio->map_type & BTRFS_BLOCK_GROUP_RAID56_MASK); +-} +- + static int scrub_submit_raid56_bio_wait(struct btrfs_fs_info *fs_info, + struct bio *bio, + struct scrub_page *page) + { + struct scrub_bio_ret done; + int ret; ++ int mirror_num; + + init_completion(&done.event); + done.status = 0; +@@ -1698,9 +1717,10 @@ static int scrub_submit_raid56_bio_wait(struct btrfs_fs_info *fs_info, + bio->bi_private = &done; + bio->bi_end_io = scrub_bio_wait_endio; + ++ mirror_num = page->sblock->pagev[0]->mirror_num; + ret = raid56_parity_recover(fs_info, bio, page->recover->bbio, + page->recover->map_length, +- page->mirror_num, 0); ++ mirror_num, 0); + if (ret) + return ret; + +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index eef875da7c0b..839327f75e3d 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -570,9 +570,15 @@ smb2_query_eas(const unsigned int xid, struct cifs_tcon *tcon, + + SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); + ++ /* ++ * If ea_name is NULL (listxattr) and there are no EAs, return 0 as it's ++ * not an error. Otherwise, the specified ea_name was not found. ++ */ + if (!rc) + rc = move_smb2_ea_to_cifs(ea_data, buf_size, smb2_data, + SMB2_MAX_EA_BUF, ea_name); ++ else if (!ea_name && rc == -ENODATA) ++ rc = 0; + + kfree(smb2_data); + return rc; +diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c +index e5e29f8c920b..9d1823efff34 100644 +--- a/fs/ecryptfs/crypto.c ++++ b/fs/ecryptfs/crypto.c +@@ -2026,6 +2026,16 @@ int ecryptfs_encrypt_and_encode_filename( + return rc; + } + ++static bool is_dot_dotdot(const char *name, size_t name_size) ++{ ++ if (name_size == 1 && name[0] == '.') ++ return true; ++ else if (name_size == 2 && name[0] == '.' && name[1] == '.') ++ return true; ++ ++ return false; ++} ++ + /** + * ecryptfs_decode_and_decrypt_filename - converts the encoded cipher text name to decoded plaintext + * @plaintext_name: The plaintext name +@@ -2050,13 +2060,21 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, + size_t packet_size; + int rc = 0; + +- if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) +- && !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED) +- && (name_size > ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) +- && (strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX, +- ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE) == 0)) { +- const char *orig_name = name; +- size_t orig_name_size = name_size; ++ if ((mount_crypt_stat->flags & ECRYPTFS_GLOBAL_ENCRYPT_FILENAMES) && ++ !(mount_crypt_stat->flags & ECRYPTFS_ENCRYPTED_VIEW_ENABLED)) { ++ if (is_dot_dotdot(name, name_size)) { ++ rc = ecryptfs_copy_filename(plaintext_name, ++ plaintext_name_size, ++ name, name_size); ++ goto out; ++ } ++ ++ if (name_size <= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE || ++ strncmp(name, ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX, ++ ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE)) { ++ rc = -EINVAL; ++ goto out; ++ } + + name += ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE; + name_size -= ECRYPTFS_FNEK_ENCRYPTED_FILENAME_PREFIX_SIZE; +@@ -2079,12 +2097,9 @@ int ecryptfs_decode_and_decrypt_filename(char **plaintext_name, + decoded_name, + decoded_name_size); + if (rc) { +- printk(KERN_INFO "%s: Could not parse tag 70 packet " +- "from filename; copying through filename " +- "as-is\n", __func__); +- rc = ecryptfs_copy_filename(plaintext_name, +- plaintext_name_size, +- orig_name, orig_name_size); ++ ecryptfs_printk(KERN_DEBUG, ++ "%s: Could not parse tag 70 packet from filename\n", ++ __func__); + goto out_free; + } + } else { +diff --git a/fs/ecryptfs/file.c b/fs/ecryptfs/file.c +index c74ed3ca3372..b76a9853325e 100644 +--- a/fs/ecryptfs/file.c ++++ b/fs/ecryptfs/file.c +@@ -82,17 +82,28 @@ ecryptfs_filldir(struct dir_context *ctx, const char *lower_name, + buf->sb, lower_name, + lower_namelen); + if (rc) { +- printk(KERN_ERR "%s: Error attempting to decode and decrypt " +- "filename [%s]; rc = [%d]\n", __func__, lower_name, +- rc); +- goto out; ++ if (rc != -EINVAL) { ++ ecryptfs_printk(KERN_DEBUG, ++ "%s: Error attempting to decode and decrypt filename [%s]; rc = [%d]\n", ++ __func__, lower_name, rc); ++ return rc; ++ } ++ ++ /* Mask -EINVAL errors as these are most likely due a plaintext ++ * filename present in the lower filesystem despite filename ++ * encryption being enabled. One unavoidable example would be ++ * the "lost+found" dentry in the root directory of an Ext4 ++ * filesystem. ++ */ ++ return 0; + } ++ + buf->caller->pos = buf->ctx.pos; + rc = !dir_emit(buf->caller, name, name_size, ino, d_type); + kfree(name); + if (!rc) + buf->entries_written++; +-out: ++ + return rc; + } + +diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c +index 447a24d77b89..ed4edcd2bc56 100644 +--- a/fs/isofs/inode.c ++++ b/fs/isofs/inode.c +@@ -394,7 +394,10 @@ static int parse_options(char *options, struct iso9660_options *popt) + break; + #ifdef CONFIG_JOLIET + case Opt_iocharset: ++ kfree(popt->iocharset); + popt->iocharset = match_strdup(&args[0]); ++ if (!popt->iocharset) ++ return 0; + break; + #endif + case Opt_map_a: +diff --git a/fs/namespace.c b/fs/namespace.c +index 62b17aff1908..1eb3bfd8be5a 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -2810,7 +2810,7 @@ long do_mount(const char *dev_name, const char __user *dir_name, + mnt_flags |= MNT_NODIRATIME; + if (flags & MS_STRICTATIME) + mnt_flags &= ~(MNT_RELATIME | MNT_NOATIME); +- if (flags & SB_RDONLY) ++ if (flags & MS_RDONLY) + mnt_flags |= MNT_READONLY; + + /* The default atime for remount is preservation */ +diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c +index 074716293829..d76c81323dc1 100644 +--- a/fs/notify/fsnotify.c ++++ b/fs/notify/fsnotify.c +@@ -192,8 +192,9 @@ static int send_to_group(struct inode *to_tell, + struct fsnotify_iter_info *iter_info) + { + struct fsnotify_group *group = NULL; +- __u32 inode_test_mask = 0; +- __u32 vfsmount_test_mask = 0; ++ __u32 test_mask = (mask & ~FS_EVENT_ON_CHILD); ++ __u32 marks_mask = 0; ++ __u32 marks_ignored_mask = 0; + + if (unlikely(!inode_mark && !vfsmount_mark)) { + BUG(); +@@ -213,29 +214,25 @@ static int send_to_group(struct inode *to_tell, + /* does the inode mark tell us to do something? */ + if (inode_mark) { + group = inode_mark->group; +- inode_test_mask = (mask & ~FS_EVENT_ON_CHILD); +- inode_test_mask &= inode_mark->mask; +- inode_test_mask &= ~inode_mark->ignored_mask; ++ marks_mask |= inode_mark->mask; ++ marks_ignored_mask |= inode_mark->ignored_mask; + } + + /* does the vfsmount_mark tell us to do something? */ + if (vfsmount_mark) { +- vfsmount_test_mask = (mask & ~FS_EVENT_ON_CHILD); + group = vfsmount_mark->group; +- vfsmount_test_mask &= vfsmount_mark->mask; +- vfsmount_test_mask &= ~vfsmount_mark->ignored_mask; +- if (inode_mark) +- vfsmount_test_mask &= ~inode_mark->ignored_mask; ++ marks_mask |= vfsmount_mark->mask; ++ marks_ignored_mask |= vfsmount_mark->ignored_mask; + } + + pr_debug("%s: group=%p to_tell=%p mask=%x inode_mark=%p" +- " inode_test_mask=%x vfsmount_mark=%p vfsmount_test_mask=%x" ++ " vfsmount_mark=%p marks_mask=%x marks_ignored_mask=%x" + " data=%p data_is=%d cookie=%d\n", +- __func__, group, to_tell, mask, inode_mark, +- inode_test_mask, vfsmount_mark, vfsmount_test_mask, data, ++ __func__, group, to_tell, mask, inode_mark, vfsmount_mark, ++ marks_mask, marks_ignored_mask, data, + data_is, cookie); + +- if (!inode_test_mask && !vfsmount_test_mask) ++ if (!(test_mask & marks_mask & ~marks_ignored_mask)) + return 0; + + return group->ops->handle_event(group, to_tell, inode_mark, +diff --git a/fs/ocfs2/refcounttree.c b/fs/ocfs2/refcounttree.c +index ab156e35ec00..1b1283f07941 100644 +--- a/fs/ocfs2/refcounttree.c ++++ b/fs/ocfs2/refcounttree.c +@@ -4250,10 +4250,11 @@ static int __ocfs2_reflink(struct dentry *old_dentry, + static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + struct dentry *new_dentry, bool preserve) + { +- int error; ++ int error, had_lock; + struct inode *inode = d_inode(old_dentry); + struct buffer_head *old_bh = NULL; + struct inode *new_orphan_inode = NULL; ++ struct ocfs2_lock_holder oh; + + if (!ocfs2_refcount_tree(OCFS2_SB(inode->i_sb))) + return -EOPNOTSUPP; +@@ -4295,6 +4296,14 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + goto out; + } + ++ had_lock = ocfs2_inode_lock_tracker(new_orphan_inode, NULL, 1, ++ &oh); ++ if (had_lock < 0) { ++ error = had_lock; ++ mlog_errno(error); ++ goto out; ++ } ++ + /* If the security isn't preserved, we need to re-initialize them. */ + if (!preserve) { + error = ocfs2_init_security_and_acl(dir, new_orphan_inode, +@@ -4302,14 +4311,15 @@ static int ocfs2_reflink(struct dentry *old_dentry, struct inode *dir, + if (error) + mlog_errno(error); + } +-out: + if (!error) { + error = ocfs2_mv_orphaned_inode_to_new(dir, new_orphan_inode, + new_dentry); + if (error) + mlog_errno(error); + } ++ ocfs2_inode_unlock_tracker(new_orphan_inode, 1, &oh, had_lock); + ++out: + if (new_orphan_inode) { + /* + * We need to open_unlock the inode no matter whether we +diff --git a/fs/proc/base.c b/fs/proc/base.c +index dd9d4d3a2e39..c5c42f3e33d1 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -1694,6 +1694,12 @@ void task_dump_owner(struct task_struct *task, mode_t mode, + kuid_t uid; + kgid_t gid; + ++ if (unlikely(task->flags & PF_KTHREAD)) { ++ *ruid = GLOBAL_ROOT_UID; ++ *rgid = GLOBAL_ROOT_GID; ++ return; ++ } ++ + /* Default to the tasks effective ownership */ + rcu_read_lock(); + cred = __task_cred(task); +diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c +index d1e82761de81..e64ecb9f2720 100644 +--- a/fs/proc/kcore.c ++++ b/fs/proc/kcore.c +@@ -209,25 +209,34 @@ kclist_add_private(unsigned long pfn, unsigned long nr_pages, void *arg) + { + struct list_head *head = (struct list_head *)arg; + struct kcore_list *ent; ++ struct page *p; ++ ++ if (!pfn_valid(pfn)) ++ return 1; ++ ++ p = pfn_to_page(pfn); ++ if (!memmap_valid_within(pfn, p, page_zone(p))) ++ return 1; + + ent = kmalloc(sizeof(*ent), GFP_KERNEL); + if (!ent) + return -ENOMEM; +- ent->addr = (unsigned long)__va((pfn << PAGE_SHIFT)); ++ ent->addr = (unsigned long)page_to_virt(p); + ent->size = nr_pages << PAGE_SHIFT; + +- /* Sanity check: Can happen in 32bit arch...maybe */ +- if (ent->addr < (unsigned long) __va(0)) ++ if (!virt_addr_valid(ent->addr)) + goto free_out; + + /* cut not-mapped area. ....from ppc-32 code. */ + if (ULONG_MAX - ent->addr < ent->size) + ent->size = ULONG_MAX - ent->addr; + +- /* cut when vmalloc() area is higher than direct-map area */ +- if (VMALLOC_START > (unsigned long)__va(0)) { +- if (ent->addr > VMALLOC_START) +- goto free_out; ++ /* ++ * We've already checked virt_addr_valid so we know this address ++ * is a valid pointer, therefore we can check against it to determine ++ * if we need to trim ++ */ ++ if (VMALLOC_START > ent->addr) { + if (VMALLOC_START - ent->addr < ent->size) + ent->size = VMALLOC_START - ent->addr; + } +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 6744bd706ecf..4cd8328e4039 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1327,9 +1327,11 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { + swp_entry_t entry = pmd_to_swp_entry(pmd); ++ unsigned long offset = swp_offset(entry); + ++ offset += (addr & ~PMD_MASK) >> PAGE_SHIFT; + frame = swp_type(entry) | +- (swp_offset(entry) << MAX_SWAPFILES_SHIFT); ++ (offset << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; + if (pmd_swp_soft_dirty(pmd)) + flags |= PM_SOFT_DIRTY; +@@ -1349,6 +1351,8 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + break; + if (pm->show_pfn && (flags & PM_PRESENT)) + frame++; ++ else if (flags & PM_SWAP) ++ frame += (1 << MAX_SWAPFILES_SHIFT); + } + spin_unlock(ptl); + return err; +diff --git a/include/linux/clk-provider.h b/include/linux/clk-provider.h +index 86eb33f67618..2f4e79fe7b86 100644 +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -752,6 +752,9 @@ int __clk_mux_determine_rate(struct clk_hw *hw, + int __clk_determine_rate(struct clk_hw *core, struct clk_rate_request *req); + int __clk_mux_determine_rate_closest(struct clk_hw *hw, + struct clk_rate_request *req); ++int clk_mux_determine_rate_flags(struct clk_hw *hw, ++ struct clk_rate_request *req, ++ unsigned long flags); + void clk_hw_reparent(struct clk_hw *hw, struct clk_hw *new_parent); + void clk_hw_set_rate_range(struct clk_hw *hw, unsigned long min_rate, + unsigned long max_rate); +diff --git a/include/linux/ethtool.h b/include/linux/ethtool.h +index 0c0146e7e274..59fbe005f204 100644 +--- a/include/linux/ethtool.h ++++ b/include/linux/ethtool.h +@@ -300,6 +300,8 @@ bool ethtool_convert_link_mode_to_legacy_u32(u32 *legacy_u32, + * fields should be ignored (use %__ETHTOOL_LINK_MODE_MASK_NBITS + * instead of the latter), any change to them will be overwritten + * by kernel. Returns a negative error code or zero. ++ * @get_fecparam: Get the network device Forward Error Correction parameters. ++ * @set_fecparam: Set the network device Forward Error Correction parameters. + * + * All operations are optional (i.e. the function pointer may be set + * to %NULL) and callers must take this into account. Callers must +diff --git a/include/linux/genhd.h b/include/linux/genhd.h +index 5ade8f2a6987..550fa358893a 100644 +--- a/include/linux/genhd.h ++++ b/include/linux/genhd.h +@@ -365,7 +365,9 @@ static inline void free_part_stats(struct hd_struct *part) + part_stat_add(cpu, gendiskp, field, -subnd) + + void part_in_flight(struct request_queue *q, struct hd_struct *part, +- unsigned int inflight[2]); ++ unsigned int inflight[2]); ++void part_in_flight_rw(struct request_queue *q, struct hd_struct *part, ++ unsigned int inflight[2]); + void part_dec_in_flight(struct request_queue *q, struct hd_struct *part, + int rw); + void part_inc_in_flight(struct request_queue *q, struct hd_struct *part, +diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h +index 39f0489eb137..b81d458ad4fb 100644 +--- a/include/linux/kvm_host.h ++++ b/include/linux/kvm_host.h +@@ -1044,13 +1044,7 @@ static inline int mmu_notifier_retry(struct kvm *kvm, unsigned long mmu_seq) + + #ifdef CONFIG_HAVE_KVM_IRQ_ROUTING + +-#ifdef CONFIG_S390 +-#define KVM_MAX_IRQ_ROUTES 4096 //FIXME: we can have more than that... +-#elif defined(CONFIG_ARM64) +-#define KVM_MAX_IRQ_ROUTES 4096 +-#else +-#define KVM_MAX_IRQ_ROUTES 1024 +-#endif ++#define KVM_MAX_IRQ_ROUTES 4096 /* might need extension/rework in the future */ + + bool kvm_arch_can_set_irq_routing(struct kvm *kvm); + int kvm_set_irq_routing(struct kvm *kvm, +diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h +index b5b43f94f311..01b990e4b228 100644 +--- a/include/linux/mtd/map.h ++++ b/include/linux/mtd/map.h +@@ -312,7 +312,7 @@ void map_destroy(struct mtd_info *mtd); + ({ \ + int i, ret = 1; \ + for (i = 0; i < map_words(map); i++) { \ +- if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) { \ ++ if (((val1).x[i] & (val2).x[i]) != (val3).x[i]) { \ + ret = 0; \ + break; \ + } \ +diff --git a/include/linux/percpu-rwsem.h b/include/linux/percpu-rwsem.h +index b1f37a89e368..79b99d653e03 100644 +--- a/include/linux/percpu-rwsem.h ++++ b/include/linux/percpu-rwsem.h +@@ -133,7 +133,7 @@ static inline void percpu_rwsem_release(struct percpu_rw_semaphore *sem, + lock_release(&sem->rw_sem.dep_map, 1, ip); + #ifdef CONFIG_RWSEM_SPIN_ON_OWNER + if (!read) +- sem->rw_sem.owner = NULL; ++ sem->rw_sem.owner = RWSEM_OWNER_UNKNOWN; + #endif + } + +@@ -141,6 +141,10 @@ static inline void percpu_rwsem_acquire(struct percpu_rw_semaphore *sem, + bool read, unsigned long ip) + { + lock_acquire(&sem->rw_sem.dep_map, 0, 1, read, 1, NULL, ip); ++#ifdef CONFIG_RWSEM_SPIN_ON_OWNER ++ if (!read) ++ sem->rw_sem.owner = current; ++#endif + } + + #endif +diff --git a/include/linux/rwsem.h b/include/linux/rwsem.h +index dfa34d803439..c427ffaa4904 100644 +--- a/include/linux/rwsem.h ++++ b/include/linux/rwsem.h +@@ -44,6 +44,12 @@ struct rw_semaphore { + #endif + }; + ++/* ++ * Setting bit 0 of the owner field with other non-zero bits will indicate ++ * that the rwsem is writer-owned with an unknown owner. ++ */ ++#define RWSEM_OWNER_UNKNOWN ((struct task_struct *)-1L) ++ + extern struct rw_semaphore *rwsem_down_read_failed(struct rw_semaphore *sem); + extern struct rw_semaphore *rwsem_down_read_failed_killable(struct rw_semaphore *sem); + extern struct rw_semaphore *rwsem_down_write_failed(struct rw_semaphore *sem); +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 2c9790b43881..e04919aa8201 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -113,17 +113,36 @@ struct task_group; + + #ifdef CONFIG_DEBUG_ATOMIC_SLEEP + ++/* ++ * Special states are those that do not use the normal wait-loop pattern. See ++ * the comment with set_special_state(). ++ */ ++#define is_special_task_state(state) \ ++ ((state) & (__TASK_STOPPED | __TASK_TRACED | TASK_DEAD)) ++ + #define __set_current_state(state_value) \ + do { \ ++ WARN_ON_ONCE(is_special_task_state(state_value));\ + current->task_state_change = _THIS_IP_; \ + current->state = (state_value); \ + } while (0) ++ + #define set_current_state(state_value) \ + do { \ ++ WARN_ON_ONCE(is_special_task_state(state_value));\ + current->task_state_change = _THIS_IP_; \ + smp_store_mb(current->state, (state_value)); \ + } while (0) + ++#define set_special_state(state_value) \ ++ do { \ ++ unsigned long flags; /* may shadow */ \ ++ WARN_ON_ONCE(!is_special_task_state(state_value)); \ ++ raw_spin_lock_irqsave(¤t->pi_lock, flags); \ ++ current->task_state_change = _THIS_IP_; \ ++ current->state = (state_value); \ ++ raw_spin_unlock_irqrestore(¤t->pi_lock, flags); \ ++ } while (0) + #else + /* + * set_current_state() includes a barrier so that the write of current->state +@@ -145,8 +164,8 @@ struct task_group; + * + * The above is typically ordered against the wakeup, which does: + * +- * need_sleep = false; +- * wake_up_state(p, TASK_UNINTERRUPTIBLE); ++ * need_sleep = false; ++ * wake_up_state(p, TASK_UNINTERRUPTIBLE); + * + * Where wake_up_state() (and all other wakeup primitives) imply enough + * barriers to order the store of the variable against wakeup. +@@ -155,12 +174,33 @@ struct task_group; + * once it observes the TASK_UNINTERRUPTIBLE store the waking CPU can issue a + * TASK_RUNNING store which can collide with __set_current_state(TASK_RUNNING). + * +- * This is obviously fine, since they both store the exact same value. ++ * However, with slightly different timing the wakeup TASK_RUNNING store can ++ * also collide with the TASK_UNINTERRUPTIBLE store. Loosing that store is not ++ * a problem either because that will result in one extra go around the loop ++ * and our @cond test will save the day. + * + * Also see the comments of try_to_wake_up(). + */ +-#define __set_current_state(state_value) do { current->state = (state_value); } while (0) +-#define set_current_state(state_value) smp_store_mb(current->state, (state_value)) ++#define __set_current_state(state_value) \ ++ current->state = (state_value) ++ ++#define set_current_state(state_value) \ ++ smp_store_mb(current->state, (state_value)) ++ ++/* ++ * set_special_state() should be used for those states when the blocking task ++ * can not use the regular condition based wait-loop. In that case we must ++ * serialize against wakeups such that any possible in-flight TASK_RUNNING stores ++ * will not collide with our state change. ++ */ ++#define set_special_state(state_value) \ ++ do { \ ++ unsigned long flags; /* may shadow */ \ ++ raw_spin_lock_irqsave(¤t->pi_lock, flags); \ ++ current->state = (state_value); \ ++ raw_spin_unlock_irqrestore(¤t->pi_lock, flags); \ ++ } while (0) ++ + #endif + + /* Task command name length: */ +diff --git a/include/linux/sched/signal.h b/include/linux/sched/signal.h +index 0aa4548fb492..fbf86ecd149d 100644 +--- a/include/linux/sched/signal.h ++++ b/include/linux/sched/signal.h +@@ -280,7 +280,7 @@ static inline void kernel_signal_stop(void) + { + spin_lock_irq(¤t->sighand->siglock); + if (current->jobctl & JOBCTL_STOP_DEQUEUED) +- __set_current_state(TASK_STOPPED); ++ set_special_state(TASK_STOPPED); + spin_unlock_irq(¤t->sighand->siglock); + + schedule(); +diff --git a/include/linux/stringhash.h b/include/linux/stringhash.h +index e8f0f852968f..c0c5c5b73dc0 100644 +--- a/include/linux/stringhash.h ++++ b/include/linux/stringhash.h +@@ -50,9 +50,9 @@ partial_name_hash(unsigned long c, unsigned long prevhash) + * losing bits). This also has the property (wanted by the dcache) + * that the msbits make a good hash table index. + */ +-static inline unsigned long end_name_hash(unsigned long hash) ++static inline unsigned int end_name_hash(unsigned long hash) + { +- return __hash_32((unsigned int)hash); ++ return hash_long(hash, 32); + } + + /* +diff --git a/include/soc/bcm2835/raspberrypi-firmware.h b/include/soc/bcm2835/raspberrypi-firmware.h +index cb979ad90401..b86c4c367004 100644 +--- a/include/soc/bcm2835/raspberrypi-firmware.h ++++ b/include/soc/bcm2835/raspberrypi-firmware.h +@@ -125,13 +125,13 @@ struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node); + static inline int rpi_firmware_property(struct rpi_firmware *fw, u32 tag, + void *data, size_t len) + { +- return 0; ++ return -ENOSYS; + } + + static inline int rpi_firmware_property_list(struct rpi_firmware *fw, + void *data, size_t tag_size) + { +- return 0; ++ return -ENOSYS; + } + + static inline struct rpi_firmware *rpi_firmware_get(struct device_node *firmware_node) +diff --git a/init/main.c b/init/main.c +index 2d355a61dfc5..0d88f37febcb 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -974,6 +974,13 @@ __setup("rodata=", set_debug_rodata); + static void mark_readonly(void) + { + if (rodata_enabled) { ++ /* ++ * load_module() results in W+X mappings, which are cleaned up ++ * with call_rcu_sched(). Let's make sure that queued work is ++ * flushed so that we don't hit false positives looking for ++ * insecure pages which are W+X. ++ */ ++ rcu_barrier_sched(); + mark_rodata_ro(); + rodata_test(); + } else +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 1c19edf82427..1ef8f3a5b072 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -169,12 +169,13 @@ void *kthread_probe_data(struct task_struct *task) + + static void __kthread_parkme(struct kthread *self) + { +- __set_current_state(TASK_PARKED); +- while (test_bit(KTHREAD_SHOULD_PARK, &self->flags)) { ++ for (;;) { ++ set_current_state(TASK_PARKED); ++ if (!test_bit(KTHREAD_SHOULD_PARK, &self->flags)) ++ break; + if (!test_and_set_bit(KTHREAD_IS_PARKED, &self->flags)) + complete(&self->parked); + schedule(); +- __set_current_state(TASK_PARKED); + } + clear_bit(KTHREAD_IS_PARKED, &self->flags); + __set_current_state(TASK_RUNNING); +diff --git a/kernel/locking/rwsem-xadd.c b/kernel/locking/rwsem-xadd.c +index e795908f3607..a90336779375 100644 +--- a/kernel/locking/rwsem-xadd.c ++++ b/kernel/locking/rwsem-xadd.c +@@ -352,16 +352,15 @@ static inline bool rwsem_can_spin_on_owner(struct rw_semaphore *sem) + struct task_struct *owner; + bool ret = true; + ++ BUILD_BUG_ON(!rwsem_has_anonymous_owner(RWSEM_OWNER_UNKNOWN)); ++ + if (need_resched()) + return false; + + rcu_read_lock(); + owner = READ_ONCE(sem->owner); +- if (!rwsem_owner_is_writer(owner)) { +- /* +- * Don't spin if the rwsem is readers owned. +- */ +- ret = !rwsem_owner_is_reader(owner); ++ if (!owner || !is_rwsem_owner_spinnable(owner)) { ++ ret = !owner; /* !owner is spinnable */ + goto done; + } + +@@ -382,11 +381,11 @@ static noinline bool rwsem_spin_on_owner(struct rw_semaphore *sem) + { + struct task_struct *owner = READ_ONCE(sem->owner); + +- if (!rwsem_owner_is_writer(owner)) +- goto out; ++ if (!is_rwsem_owner_spinnable(owner)) ++ return false; + + rcu_read_lock(); +- while (sem->owner == owner) { ++ while (owner && (READ_ONCE(sem->owner) == owner)) { + /* + * Ensure we emit the owner->on_cpu, dereference _after_ + * checking sem->owner still matches owner, if that fails, +@@ -408,12 +407,12 @@ static noinline bool rwsem_spin_on_owner(struct rw_semaphore *sem) + cpu_relax(); + } + rcu_read_unlock(); +-out: ++ + /* + * If there is a new owner or the owner is not set, we continue + * spinning. + */ +- return !rwsem_owner_is_reader(READ_ONCE(sem->owner)); ++ return is_rwsem_owner_spinnable(READ_ONCE(sem->owner)); + } + + static bool rwsem_optimistic_spin(struct rw_semaphore *sem) +diff --git a/kernel/locking/rwsem.c b/kernel/locking/rwsem.c +index a6c76a4832b4..22bd01a7dcaa 100644 +--- a/kernel/locking/rwsem.c ++++ b/kernel/locking/rwsem.c +@@ -201,5 +201,3 @@ void up_read_non_owner(struct rw_semaphore *sem) + EXPORT_SYMBOL(up_read_non_owner); + + #endif +- +- +diff --git a/kernel/locking/rwsem.h b/kernel/locking/rwsem.h +index a883b8f1fdc6..410ee7b9ac2c 100644 +--- a/kernel/locking/rwsem.h ++++ b/kernel/locking/rwsem.h +@@ -1,20 +1,24 @@ + /* SPDX-License-Identifier: GPL-2.0 */ + /* + * The owner field of the rw_semaphore structure will be set to +- * RWSEM_READ_OWNED when a reader grabs the lock. A writer will clear ++ * RWSEM_READER_OWNED when a reader grabs the lock. A writer will clear + * the owner field when it unlocks. A reader, on the other hand, will + * not touch the owner field when it unlocks. + * +- * In essence, the owner field now has the following 3 states: ++ * In essence, the owner field now has the following 4 states: + * 1) 0 + * - lock is free or the owner hasn't set the field yet + * 2) RWSEM_READER_OWNED + * - lock is currently or previously owned by readers (lock is free + * or not set by owner yet) +- * 3) Other non-zero value +- * - a writer owns the lock ++ * 3) RWSEM_ANONYMOUSLY_OWNED bit set with some other bits set as well ++ * - lock is owned by an anonymous writer, so spinning on the lock ++ * owner should be disabled. ++ * 4) Other non-zero value ++ * - a writer owns the lock and other writers can spin on the lock owner. + */ +-#define RWSEM_READER_OWNED ((struct task_struct *)1UL) ++#define RWSEM_ANONYMOUSLY_OWNED (1UL << 0) ++#define RWSEM_READER_OWNED ((struct task_struct *)RWSEM_ANONYMOUSLY_OWNED) + + #ifdef CONFIG_RWSEM_SPIN_ON_OWNER + /* +@@ -45,14 +49,22 @@ static inline void rwsem_set_reader_owned(struct rw_semaphore *sem) + WRITE_ONCE(sem->owner, RWSEM_READER_OWNED); + } + +-static inline bool rwsem_owner_is_writer(struct task_struct *owner) ++/* ++ * Return true if the a rwsem waiter can spin on the rwsem's owner ++ * and steal the lock, i.e. the lock is not anonymously owned. ++ * N.B. !owner is considered spinnable. ++ */ ++static inline bool is_rwsem_owner_spinnable(struct task_struct *owner) + { +- return owner && owner != RWSEM_READER_OWNED; ++ return !((unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED); + } + +-static inline bool rwsem_owner_is_reader(struct task_struct *owner) ++/* ++ * Return true if rwsem is owned by an anonymous writer or readers. ++ */ ++static inline bool rwsem_has_anonymous_owner(struct task_struct *owner) + { +- return owner == RWSEM_READER_OWNED; ++ return (unsigned long)owner & RWSEM_ANONYMOUSLY_OWNED; + } + #else + static inline void rwsem_set_owner(struct rw_semaphore *sem) +diff --git a/kernel/module.c b/kernel/module.c +index 690c0651c40f..321b0b1f87e7 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -3506,6 +3506,11 @@ static noinline int do_init_module(struct module *mod) + * walking this with preempt disabled. In all the failure paths, we + * call synchronize_sched(), but we don't want to slow down the success + * path, so use actual RCU here. ++ * Note that module_alloc() on most architectures creates W+X page ++ * mappings which won't be cleaned up until do_free_init() runs. Any ++ * code such as mark_rodata_ro() which depends on those mappings to ++ * be cleaned up needs to sync with the queued work - ie ++ * rcu_barrier_sched() + */ + call_rcu_sched(&freeinit->rcu, do_free_init); + mutex_unlock(&module_mutex); +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 8cf36b30a006..f287dcbe8cb2 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -3374,23 +3374,8 @@ static void __sched notrace __schedule(bool preempt) + + void __noreturn do_task_dead(void) + { +- /* +- * The setting of TASK_RUNNING by try_to_wake_up() may be delayed +- * when the following two conditions become true. +- * - There is race condition of mmap_sem (It is acquired by +- * exit_mm()), and +- * - SMI occurs before setting TASK_RUNINNG. +- * (or hypervisor of virtual machine switches to other guest) +- * As a result, we may become TASK_RUNNING after becoming TASK_DEAD +- * +- * To avoid it, we have to wait for releasing tsk->pi_lock which +- * is held by try_to_wake_up() +- */ +- raw_spin_lock_irq(¤t->pi_lock); +- raw_spin_unlock_irq(¤t->pi_lock); +- + /* Causes final put_task_struct in finish_task_switch(): */ +- __set_current_state(TASK_DEAD); ++ set_special_state(TASK_DEAD); + + /* Tell freezer to ignore us: */ + current->flags |= PF_NOFREEZE; +diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c +index 4ae5c1ea90e2..501f17c642ab 100644 +--- a/kernel/sched/deadline.c ++++ b/kernel/sched/deadline.c +@@ -1084,7 +1084,7 @@ extern bool sched_rt_bandwidth_account(struct rt_rq *rt_rq); + * should be larger than 2^(64 - 20 - 8), which is more than 64 seconds. + * So, overflow is not an issue here. + */ +-u64 grub_reclaim(u64 delta, struct rq *rq, struct sched_dl_entity *dl_se) ++static u64 grub_reclaim(u64 delta, struct rq *rq, struct sched_dl_entity *dl_se) + { + u64 u_inact = rq->dl.this_bw - rq->dl.running_bw; /* Utot - Uact */ + u64 u_act; +@@ -2655,8 +2655,6 @@ bool dl_cpu_busy(unsigned int cpu) + #endif + + #ifdef CONFIG_SCHED_DEBUG +-extern void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq); +- + void print_dl_stats(struct seq_file *m, int cpu) + { + print_dl_rq(m, cpu, &cpu_rq(cpu)->dl); +diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c +index 113eaeb6c0f8..bba2217652ff 100644 +--- a/kernel/sched/rt.c ++++ b/kernel/sched/rt.c +@@ -2689,8 +2689,6 @@ int sched_rr_handler(struct ctl_table *table, int write, + } + + #ifdef CONFIG_SCHED_DEBUG +-extern void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq); +- + void print_rt_stats(struct seq_file *m, int cpu) + { + rt_rq_iter_t iter; +diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h +index 307c35d33660..b29376169f3f 100644 +--- a/kernel/sched/sched.h ++++ b/kernel/sched/sched.h +@@ -1969,8 +1969,9 @@ extern bool sched_debug_enabled; + extern void print_cfs_stats(struct seq_file *m, int cpu); + extern void print_rt_stats(struct seq_file *m, int cpu); + extern void print_dl_stats(struct seq_file *m, int cpu); +-extern void +-print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq); ++extern void print_cfs_rq(struct seq_file *m, int cpu, struct cfs_rq *cfs_rq); ++extern void print_rt_rq(struct seq_file *m, int cpu, struct rt_rq *rt_rq); ++extern void print_dl_rq(struct seq_file *m, int cpu, struct dl_rq *dl_rq); + #ifdef CONFIG_NUMA_BALANCING + extern void + show_numa_stats(struct task_struct *p, struct seq_file *m); +diff --git a/kernel/signal.c b/kernel/signal.c +index 6895f6bb98a7..4439ba9dc5d9 100644 +--- a/kernel/signal.c ++++ b/kernel/signal.c +@@ -1828,14 +1828,27 @@ static void ptrace_stop(int exit_code, int why, int clear_code, siginfo_t *info) + return; + } + ++ set_special_state(TASK_TRACED); ++ + /* + * We're committing to trapping. TRACED should be visible before + * TRAPPING is cleared; otherwise, the tracer might fail do_wait(). + * Also, transition to TRACED and updates to ->jobctl should be + * atomic with respect to siglock and should be done after the arch + * hook as siglock is released and regrabbed across it. ++ * ++ * TRACER TRACEE ++ * ++ * ptrace_attach() ++ * [L] wait_on_bit(JOBCTL_TRAPPING) [S] set_special_state(TRACED) ++ * do_wait() ++ * set_current_state() smp_wmb(); ++ * ptrace_do_wait() ++ * wait_task_stopped() ++ * task_stopped_code() ++ * [L] task_is_traced() [S] task_clear_jobctl_trapping(); + */ +- set_current_state(TASK_TRACED); ++ smp_wmb(); + + current->last_siginfo = info; + current->exit_code = exit_code; +@@ -2043,7 +2056,7 @@ static bool do_signal_stop(int signr) + if (task_participate_group_stop(current)) + notify = CLD_STOPPED; + +- __set_current_state(TASK_STOPPED); ++ set_special_state(TASK_STOPPED); + spin_unlock_irq(¤t->sighand->siglock); + + /* +diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c +index b7591261652d..64c0291b579c 100644 +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + /* + * Structure to determine completion condition and record errors. May +@@ -65,27 +66,31 @@ static void cpu_stop_signal_done(struct cpu_stop_done *done) + } + + static void __cpu_stop_queue_work(struct cpu_stopper *stopper, +- struct cpu_stop_work *work) ++ struct cpu_stop_work *work, ++ struct wake_q_head *wakeq) + { + list_add_tail(&work->list, &stopper->works); +- wake_up_process(stopper->thread); ++ wake_q_add(wakeq, stopper->thread); + } + + /* queue @work to @stopper. if offline, @work is completed immediately */ + static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work) + { + struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu); ++ DEFINE_WAKE_Q(wakeq); + unsigned long flags; + bool enabled; + + spin_lock_irqsave(&stopper->lock, flags); + enabled = stopper->enabled; + if (enabled) +- __cpu_stop_queue_work(stopper, work); ++ __cpu_stop_queue_work(stopper, work, &wakeq); + else if (work->done) + cpu_stop_signal_done(work->done); + spin_unlock_irqrestore(&stopper->lock, flags); + ++ wake_up_q(&wakeq); ++ + return enabled; + } + +@@ -229,6 +234,7 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + { + struct cpu_stopper *stopper1 = per_cpu_ptr(&cpu_stopper, cpu1); + struct cpu_stopper *stopper2 = per_cpu_ptr(&cpu_stopper, cpu2); ++ DEFINE_WAKE_Q(wakeq); + int err; + retry: + spin_lock_irq(&stopper1->lock); +@@ -252,8 +258,8 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + goto unlock; + + err = 0; +- __cpu_stop_queue_work(stopper1, work1); +- __cpu_stop_queue_work(stopper2, work2); ++ __cpu_stop_queue_work(stopper1, work1, &wakeq); ++ __cpu_stop_queue_work(stopper2, work2, &wakeq); + unlock: + spin_unlock(&stopper2->lock); + spin_unlock_irq(&stopper1->lock); +@@ -263,6 +269,9 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + cpu_relax(); + goto retry; + } ++ ++ wake_up_q(&wakeq); ++ + return err; + } + /** +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 546cd481a2ca..942d9342b63b 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -2205,7 +2205,7 @@ static void __memcg_schedule_kmem_cache_create(struct mem_cgroup *memcg, + { + struct memcg_kmem_cache_create_work *cw; + +- cw = kmalloc(sizeof(*cw), GFP_NOWAIT); ++ cw = kmalloc(sizeof(*cw), GFP_NOWAIT | __GFP_NOWARN); + if (!cw) + return; + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 125b49c166a4..f0caff3139ed 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -647,7 +647,7 @@ void tcp_rcv_space_adjust(struct sock *sk) + sk->sk_rcvbuf = rcvbuf; + + /* Make the window clamp follow along. */ +- tp->window_clamp = rcvwin; ++ tp->window_clamp = tcp_win_from_space(rcvbuf); + } + } + tp->rcvq_space.space = copied; +diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig +index 6acb2eecd986..c764c2a77d94 100644 +--- a/net/ipv6/netfilter/Kconfig ++++ b/net/ipv6/netfilter/Kconfig +@@ -48,6 +48,34 @@ config NFT_CHAIN_ROUTE_IPV6 + fields such as the source, destination, flowlabel, hop-limit and + the packet mark. + ++if NF_NAT_IPV6 ++ ++config NFT_CHAIN_NAT_IPV6 ++ tristate "IPv6 nf_tables nat chain support" ++ help ++ This option enables the "nat" chain for IPv6 in nf_tables. This ++ chain type is used to perform Network Address Translation (NAT) ++ packet transformations such as the source, destination address and ++ source and destination ports. ++ ++config NFT_MASQ_IPV6 ++ tristate "IPv6 masquerade support for nf_tables" ++ depends on NFT_MASQ ++ select NF_NAT_MASQUERADE_IPV6 ++ help ++ This is the expression that provides IPv4 masquerading support for ++ nf_tables. ++ ++config NFT_REDIR_IPV6 ++ tristate "IPv6 redirect support for nf_tables" ++ depends on NFT_REDIR ++ select NF_NAT_REDIRECT ++ help ++ This is the expression that provides IPv4 redirect support for ++ nf_tables. ++ ++endif # NF_NAT_IPV6 ++ + config NFT_REJECT_IPV6 + select NF_REJECT_IPV6 + default NFT_REJECT +@@ -99,39 +127,12 @@ config NF_NAT_IPV6 + + if NF_NAT_IPV6 + +-config NFT_CHAIN_NAT_IPV6 +- depends on NF_TABLES_IPV6 +- tristate "IPv6 nf_tables nat chain support" +- help +- This option enables the "nat" chain for IPv6 in nf_tables. This +- chain type is used to perform Network Address Translation (NAT) +- packet transformations such as the source, destination address and +- source and destination ports. +- + config NF_NAT_MASQUERADE_IPV6 + tristate "IPv6 masquerade support" + help + This is the kernel functionality to provide NAT in the masquerade + flavour (automatic source address selection) for IPv6. + +-config NFT_MASQ_IPV6 +- tristate "IPv6 masquerade support for nf_tables" +- depends on NF_TABLES_IPV6 +- depends on NFT_MASQ +- select NF_NAT_MASQUERADE_IPV6 +- help +- This is the expression that provides IPv4 masquerading support for +- nf_tables. +- +-config NFT_REDIR_IPV6 +- tristate "IPv6 redirect support for nf_tables" +- depends on NF_TABLES_IPV6 +- depends on NFT_REDIR +- select NF_NAT_REDIRECT +- help +- This is the expression that provides IPv4 redirect support for +- nf_tables. +- + endif # NF_NAT_IPV6 + + config IP6_NF_IPTABLES +diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c +index bef516ec47f9..197947a07f83 100644 +--- a/net/mac80211/agg-tx.c ++++ b/net/mac80211/agg-tx.c +@@ -8,6 +8,7 @@ + * Copyright 2007, Michael Wu + * Copyright 2007-2010, Intel Corporation + * Copyright(c) 2015-2017 Intel Deutschland GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -987,6 +988,9 @@ void ieee80211_process_addba_resp(struct ieee80211_local *local, + + sta->ampdu_mlme.addba_req_num[tid] = 0; + ++ tid_tx->timeout = ++ le16_to_cpu(mgmt->u.action.u.addba_resp.timeout); ++ + if (tid_tx->timeout) { + mod_timer(&tid_tx->session_timer, + TU_TO_EXP_TIME(tid_tx->timeout)); +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 9115cc52ce83..052dbd4fa366 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -35,6 +35,7 @@ + #define IEEE80211_AUTH_TIMEOUT (HZ / 5) + #define IEEE80211_AUTH_TIMEOUT_LONG (HZ / 2) + #define IEEE80211_AUTH_TIMEOUT_SHORT (HZ / 10) ++#define IEEE80211_AUTH_TIMEOUT_SAE (HZ * 2) + #define IEEE80211_AUTH_MAX_TRIES 3 + #define IEEE80211_AUTH_WAIT_ASSOC (HZ * 5) + #define IEEE80211_ASSOC_TIMEOUT (HZ / 5) +@@ -3798,16 +3799,19 @@ static int ieee80211_auth(struct ieee80211_sub_if_data *sdata) + tx_flags); + + if (tx_flags == 0) { +- auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; +- auth_data->timeout_started = true; +- run_again(sdata, auth_data->timeout); ++ if (auth_data->algorithm == WLAN_AUTH_SAE) ++ auth_data->timeout = jiffies + ++ IEEE80211_AUTH_TIMEOUT_SAE; ++ else ++ auth_data->timeout = jiffies + IEEE80211_AUTH_TIMEOUT; + } else { + auth_data->timeout = + round_jiffies_up(jiffies + IEEE80211_AUTH_TIMEOUT_LONG); +- auth_data->timeout_started = true; +- run_again(sdata, auth_data->timeout); + } + ++ auth_data->timeout_started = true; ++ run_again(sdata, auth_data->timeout); ++ + return 0; + } + +@@ -3878,8 +3882,15 @@ void ieee80211_sta_work(struct ieee80211_sub_if_data *sdata) + ifmgd->status_received = false; + if (ifmgd->auth_data && ieee80211_is_auth(fc)) { + if (status_acked) { +- ifmgd->auth_data->timeout = +- jiffies + IEEE80211_AUTH_TIMEOUT_SHORT; ++ if (ifmgd->auth_data->algorithm == ++ WLAN_AUTH_SAE) ++ ifmgd->auth_data->timeout = ++ jiffies + ++ IEEE80211_AUTH_TIMEOUT_SAE; ++ else ++ ifmgd->auth_data->timeout = ++ jiffies + ++ IEEE80211_AUTH_TIMEOUT_SHORT; + run_again(sdata, ifmgd->auth_data->timeout); + } else { + ifmgd->auth_data->timeout = jiffies - 1; +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index 73429841f115..ccb65f18df5d 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -4,6 +4,7 @@ + * Copyright 2006-2007 Jiri Benc + * Copyright 2007 Johannes Berg + * Copyright 2013-2014 Intel Mobile Communications GmbH ++ * Copyright (C) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License version 2 as +@@ -1138,7 +1139,7 @@ static bool ieee80211_tx_prep_agg(struct ieee80211_tx_data *tx, + } + + /* reset session timer */ +- if (reset_agg_timer && tid_tx->timeout) ++ if (reset_agg_timer) + tid_tx->last_tx = jiffies; + + return queued; +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 689e9c0570ba..cf30c440f7a7 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4977,7 +4977,7 @@ static void nft_chain_commit_update(struct nft_trans *trans) + struct nft_base_chain *basechain; + + if (nft_trans_chain_name(trans)) +- strcpy(trans->ctx.chain->name, nft_trans_chain_name(trans)); ++ swap(trans->ctx.chain->name, nft_trans_chain_name(trans)); + + if (!nft_is_base_chain(trans->ctx.chain)) + return; +diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c +index 80fb6f63e768..6e721c449c4b 100644 +--- a/net/rds/ib_cm.c ++++ b/net/rds/ib_cm.c +@@ -546,7 +546,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd, + ic->i_send_cq, ic->i_recv_cq); + +- return ret; ++ goto out; + + sends_out: + vfree(ic->i_sends); +@@ -571,6 +571,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) + ic->i_send_cq = NULL; + rds_ibdev_out: + rds_ib_remove_conn(rds_ibdev, conn); ++out: + rds_ib_dev_put(rds_ibdev); + + return ret; +diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c +index 7c1cb08874d5..2a32f60652d8 100644 +--- a/net/rxrpc/af_rxrpc.c ++++ b/net/rxrpc/af_rxrpc.c +@@ -302,7 +302,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock, + memset(&cp, 0, sizeof(cp)); + cp.local = rx->local; + cp.key = key; +- cp.security_level = 0; ++ cp.security_level = rx->min_sec_level; + cp.exclusive = false; + cp.service_id = srx->srx_service; + call = rxrpc_new_client_call(rx, &cp, srx, user_call_ID, tx_total_len, +diff --git a/net/rxrpc/local_object.c b/net/rxrpc/local_object.c +index 38b99db30e54..2af42c7d5b82 100644 +--- a/net/rxrpc/local_object.c ++++ b/net/rxrpc/local_object.c +@@ -133,22 +133,49 @@ static int rxrpc_open_socket(struct rxrpc_local *local, struct net *net) + } + } + +- /* we want to receive ICMP errors */ +- opt = 1; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, +- (char *) &opt, sizeof(opt)); +- if (ret < 0) { +- _debug("setsockopt failed"); +- goto error; +- } ++ switch (local->srx.transport.family) { ++ case AF_INET: ++ /* we want to receive ICMP errors */ ++ opt = 1; ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_RECVERR, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } + +- /* we want to set the don't fragment bit */ +- opt = IP_PMTUDISC_DO; +- ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, +- (char *) &opt, sizeof(opt)); +- if (ret < 0) { +- _debug("setsockopt failed"); +- goto error; ++ /* we want to set the don't fragment bit */ ++ opt = IP_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IP, IP_MTU_DISCOVER, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ break; ++ ++ case AF_INET6: ++ /* we want to receive ICMP errors */ ++ opt = 1; ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_RECVERR, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ ++ /* we want to set the don't fragment bit */ ++ opt = IPV6_PMTUDISC_DO; ++ ret = kernel_setsockopt(local->socket, SOL_IPV6, IPV6_MTU_DISCOVER, ++ (char *) &opt, sizeof(opt)); ++ if (ret < 0) { ++ _debug("setsockopt failed"); ++ goto error; ++ } ++ break; ++ ++ default: ++ BUG(); + } + + /* set the socket up */ +diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c +index 59949d61f20d..6e749497009e 100644 +--- a/net/sched/act_skbedit.c ++++ b/net/sched/act_skbedit.c +@@ -121,7 +121,8 @@ static int tcf_skbedit_init(struct net *net, struct nlattr *nla, + return 0; + + if (!flags) { +- tcf_idr_release(*a, bind); ++ if (exists) ++ tcf_idr_release(*a, bind); + return -EINVAL; + } + +diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c +index f9c289e05707..654a81238406 100644 +--- a/net/smc/af_smc.c ++++ b/net/smc/af_smc.c +@@ -1264,8 +1264,11 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page, + + smc = smc_sk(sk); + lock_sock(sk); +- if (sk->sk_state != SMC_ACTIVE) ++ if (sk->sk_state != SMC_ACTIVE) { ++ release_sock(sk); + goto out; ++ } ++ release_sock(sk); + if (smc->use_fallback) + rc = kernel_sendpage(smc->clcsock, page, offset, + size, flags); +@@ -1273,7 +1276,6 @@ static ssize_t smc_sendpage(struct socket *sock, struct page *page, + rc = sock_no_sendpage(sock, page, offset, size, flags); + + out: +- release_sock(sk); + return rc; + } + +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index 0fcfb3916dcf..254ddc2c3914 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -768,7 +768,7 @@ int __tipc_nl_add_monitor(struct net *net, struct tipc_nl_msg *msg, + + ret = tipc_bearer_get_name(net, bearer_name, bearer_id); + if (ret || !mon) +- return -EINVAL; ++ return 0; + + hdr = genlmsg_put(msg->skb, msg->portid, msg->seq, &tipc_genl_family, + NLM_F_MULTI, TIPC_NL_MON_GET); +diff --git a/net/tipc/node.c b/net/tipc/node.c +index f6c5743c170e..42e9bdcc4bb6 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -1831,6 +1831,7 @@ int tipc_nl_node_set_link(struct sk_buff *skb, struct genl_info *info) + int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) + { + struct net *net = genl_info_net(info); ++ struct nlattr *attrs[TIPC_NLA_LINK_MAX + 1]; + struct tipc_nl_msg msg; + char *name; + int err; +@@ -1838,9 +1839,19 @@ int tipc_nl_node_get_link(struct sk_buff *skb, struct genl_info *info) + msg.portid = info->snd_portid; + msg.seq = info->snd_seq; + +- if (!info->attrs[TIPC_NLA_LINK_NAME]) ++ if (!info->attrs[TIPC_NLA_LINK]) + return -EINVAL; +- name = nla_data(info->attrs[TIPC_NLA_LINK_NAME]); ++ ++ err = nla_parse_nested(attrs, TIPC_NLA_LINK_MAX, ++ info->attrs[TIPC_NLA_LINK], ++ tipc_nl_link_policy, info->extack); ++ if (err) ++ return err; ++ ++ if (!attrs[TIPC_NLA_LINK_NAME]) ++ return -EINVAL; ++ ++ name = nla_data(attrs[TIPC_NLA_LINK_NAME]); + + msg.skb = nlmsg_new(NLMSG_GOODSIZE, GFP_KERNEL); + if (!msg.skb) +@@ -2113,8 +2124,8 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb) + struct net *net = sock_net(skb->sk); + u32 prev_bearer = cb->args[0]; + struct tipc_nl_msg msg; ++ int bearer_id; + int err; +- int i; + + if (prev_bearer == MAX_BEARERS) + return 0; +@@ -2124,16 +2135,13 @@ int tipc_nl_node_dump_monitor(struct sk_buff *skb, struct netlink_callback *cb) + msg.seq = cb->nlh->nlmsg_seq; + + rtnl_lock(); +- for (i = prev_bearer; i < MAX_BEARERS; i++) { +- prev_bearer = i; +- err = __tipc_nl_add_monitor(net, &msg, prev_bearer); ++ for (bearer_id = prev_bearer; bearer_id < MAX_BEARERS; bearer_id++) { ++ err = __tipc_nl_add_monitor(net, &msg, bearer_id); + if (err) +- goto out; ++ break; + } +- +-out: + rtnl_unlock(); +- cb->args[0] = prev_bearer; ++ cb->args[0] = bearer_id; + + return skb->len; + } +diff --git a/sound/soc/codecs/msm8916-wcd-analog.c b/sound/soc/codecs/msm8916-wcd-analog.c +index 8c7063e1aa46..0b9b014b4bb6 100644 +--- a/sound/soc/codecs/msm8916-wcd-analog.c ++++ b/sound/soc/codecs/msm8916-wcd-analog.c +@@ -1184,7 +1184,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, pm8916_mbhc_switch_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ pm8916_mbhc_switch_irq_handler, + IRQF_TRIGGER_RISING | IRQF_TRIGGER_FALLING | + IRQF_ONESHOT, + "mbhc switch irq", priv); +@@ -1198,7 +1199,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, mbhc_btn_press_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ mbhc_btn_press_irq_handler, + IRQF_TRIGGER_RISING | + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "mbhc btn press irq", priv); +@@ -1211,7 +1213,8 @@ static int pm8916_wcd_analog_spmi_probe(struct platform_device *pdev) + return irq; + } + +- ret = devm_request_irq(dev, irq, mbhc_btn_release_irq_handler, ++ ret = devm_request_threaded_irq(dev, irq, NULL, ++ mbhc_btn_release_irq_handler, + IRQF_TRIGGER_RISING | + IRQF_TRIGGER_FALLING | IRQF_ONESHOT, + "mbhc btn release irq", priv); +diff --git a/sound/soc/codecs/rt5514.c b/sound/soc/codecs/rt5514.c +index d7956ababd11..e52e68b56238 100644 +--- a/sound/soc/codecs/rt5514.c ++++ b/sound/soc/codecs/rt5514.c +@@ -89,6 +89,7 @@ static const struct reg_default rt5514_reg[] = { + {RT5514_PLL3_CALIB_CTRL5, 0x40220012}, + {RT5514_DELAY_BUF_CTRL1, 0x7fff006a}, + {RT5514_DELAY_BUF_CTRL3, 0x00000000}, ++ {RT5514_ASRC_IN_CTRL1, 0x00000003}, + {RT5514_DOWNFILTER0_CTRL1, 0x00020c2f}, + {RT5514_DOWNFILTER0_CTRL2, 0x00020c2f}, + {RT5514_DOWNFILTER0_CTRL3, 0x10000362}, +@@ -181,6 +182,7 @@ static bool rt5514_readable_register(struct device *dev, unsigned int reg) + case RT5514_PLL3_CALIB_CTRL5: + case RT5514_DELAY_BUF_CTRL1: + case RT5514_DELAY_BUF_CTRL3: ++ case RT5514_ASRC_IN_CTRL1: + case RT5514_DOWNFILTER0_CTRL1: + case RT5514_DOWNFILTER0_CTRL2: + case RT5514_DOWNFILTER0_CTRL3: +@@ -238,6 +240,7 @@ static bool rt5514_i2c_readable_register(struct device *dev, + case RT5514_DSP_MAPPING | RT5514_PLL3_CALIB_CTRL5: + case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DELAY_BUF_CTRL3: ++ case RT5514_DSP_MAPPING | RT5514_ASRC_IN_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL1: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL2: + case RT5514_DSP_MAPPING | RT5514_DOWNFILTER0_CTRL3: +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index e5049fbfc4f1..30cdad2eab7f 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -510,7 +510,7 @@ static void remove_widget(struct snd_soc_component *comp, + */ + if (dobj->widget.kcontrol_type == SND_SOC_TPLG_TYPE_ENUM) { + /* enumerated widget mixer */ +- for (i = 0; i < w->num_kcontrols; i++) { ++ for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) { + struct snd_kcontrol *kcontrol = w->kcontrols[i]; + struct soc_enum *se = + (struct soc_enum *)kcontrol->private_value; +@@ -528,7 +528,7 @@ static void remove_widget(struct snd_soc_component *comp, + kfree(w->kcontrol_news); + } else { + /* volume mixer or bytes controls */ +- for (i = 0; i < w->num_kcontrols; i++) { ++ for (i = 0; w->kcontrols != NULL && i < w->num_kcontrols; i++) { + struct snd_kcontrol *kcontrol = w->kcontrols[i]; + + if (dobj->widget.kcontrol_type +@@ -2571,7 +2571,7 @@ int snd_soc_tplg_component_remove(struct snd_soc_component *comp, u32 index) + + /* match index */ + if (dobj->index != index && +- dobj->index != SND_SOC_TPLG_INDEX_ALL) ++ index != SND_SOC_TPLG_INDEX_ALL) + continue; + + switch (dobj->type) { +diff --git a/tools/net/bpf_dbg.c b/tools/net/bpf_dbg.c +index 4f254bcc4423..61b9aa5d6415 100644 +--- a/tools/net/bpf_dbg.c ++++ b/tools/net/bpf_dbg.c +@@ -1063,7 +1063,7 @@ static int cmd_load_pcap(char *file) + + static int cmd_load(char *arg) + { +- char *subcmd, *cont, *tmp = strdup(arg); ++ char *subcmd, *cont = NULL, *tmp = strdup(arg); + int ret = CMD_OK; + + subcmd = strtok_r(tmp, " ", &cont); +@@ -1073,7 +1073,10 @@ static int cmd_load(char *arg) + bpf_reset(); + bpf_reset_breakpoints(); + +- ret = cmd_load_bpf(cont); ++ if (!cont) ++ ret = CMD_ERR; ++ else ++ ret = cmd_load_bpf(cont); + } else if (matches(subcmd, "pcap") == 0) { + ret = cmd_load_pcap(cont); + } else { +diff --git a/tools/objtool/arch/x86/include/asm/insn.h b/tools/objtool/arch/x86/include/asm/insn.h +index b3e32b010ab1..c2c01f84df75 100644 +--- a/tools/objtool/arch/x86/include/asm/insn.h ++++ b/tools/objtool/arch/x86/include/asm/insn.h +@@ -208,4 +208,22 @@ static inline int insn_offset_immediate(struct insn *insn) + return insn_offset_displacement(insn) + insn->displacement.nbytes; + } + ++#define POP_SS_OPCODE 0x1f ++#define MOV_SREG_OPCODE 0x8e ++ ++/* ++ * Intel SDM Vol.3A 6.8.3 states; ++ * "Any single-step trap that would be delivered following the MOV to SS ++ * instruction or POP to SS instruction (because EFLAGS.TF is 1) is ++ * suppressed." ++ * This function returns true if @insn is MOV SS or POP SS. On these ++ * instructions, single stepping is suppressed. ++ */ ++static inline int insn_masking_exception(struct insn *insn) ++{ ++ return insn->opcode.bytes[0] == POP_SS_OPCODE || ++ (insn->opcode.bytes[0] == MOV_SREG_OPCODE && ++ X86_MODRM_REG(insn->modrm.bytes[0]) == 2); ++} ++ + #endif /* _ASM_X86_INSN_H */ +diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c +index 4e8dd5fd45fd..ec40e47aa198 100644 +--- a/tools/perf/util/symbol.c ++++ b/tools/perf/util/symbol.c +@@ -2093,16 +2093,14 @@ static bool symbol__read_kptr_restrict(void) + + int symbol__annotation_init(void) + { ++ if (symbol_conf.init_annotation) ++ return 0; ++ + if (symbol_conf.initialized) { + pr_err("Annotation needs to be init before symbol__init()\n"); + return -1; + } + +- if (symbol_conf.init_annotation) { +- pr_warning("Annotation being initialized multiple times\n"); +- return 0; +- } +- + symbol_conf.priv_size += sizeof(struct annotation); + symbol_conf.init_annotation = true; + return 0; +diff --git a/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc +new file mode 100644 +index 000000000000..c193dce611a2 +--- /dev/null ++++ b/tools/testing/selftests/ftrace/test.d/trigger/inter-event/trigger-multi-actions-accept.tc +@@ -0,0 +1,44 @@ ++#!/bin/sh ++# description: event trigger - test multiple actions on hist trigger ++ ++ ++do_reset() { ++ reset_trigger ++ echo > set_event ++ clear_trace ++} ++ ++fail() { #msg ++ do_reset ++ echo $1 ++ exit_fail ++} ++ ++if [ ! -f set_event ]; then ++ echo "event tracing is not supported" ++ exit_unsupported ++fi ++ ++if [ ! -f synthetic_events ]; then ++ echo "synthetic event is not supported" ++ exit_unsupported ++fi ++ ++clear_synthetic_events ++reset_tracer ++do_reset ++ ++echo "Test multiple actions on hist trigger" ++echo 'wakeup_latency u64 lat; pid_t pid' >> synthetic_events ++TRIGGER1=events/sched/sched_wakeup/trigger ++TRIGGER2=events/sched/sched_switch/trigger ++ ++echo 'hist:keys=pid:ts0=common_timestamp.usecs if comm=="cyclictest"' > $TRIGGER1 ++echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0 if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,next_pid) if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid:onmatch(sched.sched_wakeup).wakeup_latency(sched.sched_switch.$wakeup_lat,prev_pid) if next_comm=="cyclictest"' >> $TRIGGER2 ++echo 'hist:keys=next_pid if next_comm=="cyclictest"' >> $TRIGGER2 ++ ++do_reset ++ ++exit 0 +diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile +index aa6e2d7f6a1f..903980921d9e 100644 +--- a/tools/testing/selftests/x86/Makefile ++++ b/tools/testing/selftests/x86/Makefile +@@ -11,7 +11,7 @@ CAN_BUILD_X86_64 := $(shell ./check_cc.sh $(CC) trivial_64bit_program.c) + + TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs syscall_nt test_mremap_vdso \ + check_initial_reg_state sigreturn iopl mpx-mini-test ioperm \ +- protection_keys test_vdso test_vsyscall ++ protection_keys test_vdso test_vsyscall mov_ss_trap + TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault test_syscall_vdso unwind_vdso \ + test_FCMOV test_FCOMI test_FISTTP \ + vdso_restorer +diff --git a/tools/testing/selftests/x86/mov_ss_trap.c b/tools/testing/selftests/x86/mov_ss_trap.c +new file mode 100644 +index 000000000000..3c3a022654f3 +--- /dev/null ++++ b/tools/testing/selftests/x86/mov_ss_trap.c +@@ -0,0 +1,285 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++/* ++ * mov_ss_trap.c: Exercise the bizarre side effects of a watchpoint on MOV SS ++ * ++ * This does MOV SS from a watchpointed address followed by various ++ * types of kernel entries. A MOV SS that hits a watchpoint will queue ++ * up a #DB trap but will not actually deliver that trap. The trap ++ * will be delivered after the next instruction instead. The CPU's logic ++ * seems to be: ++ * ++ * - Any fault: drop the pending #DB trap. ++ * - INT $N, INT3, INTO, SYSCALL, SYSENTER: enter the kernel and then ++ * deliver #DB. ++ * - ICEBP: enter the kernel but do not deliver the watchpoint trap ++ * - breakpoint: only one #DB is delivered (phew!) ++ * ++ * There are plenty of ways for a kernel to handle this incorrectly. This ++ * test tries to exercise all the cases. ++ * ++ * This should mostly cover CVE-2018-1087 and CVE-2018-8897. ++ */ ++#define _GNU_SOURCE ++ ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++#include ++ ++#define X86_EFLAGS_RF (1UL << 16) ++ ++#if __x86_64__ ++# define REG_IP REG_RIP ++#else ++# define REG_IP REG_EIP ++#endif ++ ++unsigned short ss; ++extern unsigned char breakpoint_insn[]; ++sigjmp_buf jmpbuf; ++static unsigned char altstack_data[SIGSTKSZ]; ++ ++static void enable_watchpoint(void) ++{ ++ pid_t parent = getpid(); ++ int status; ++ ++ pid_t child = fork(); ++ if (child < 0) ++ err(1, "fork"); ++ ++ if (child) { ++ if (waitpid(child, &status, 0) != child) ++ err(1, "waitpid for child"); ++ } else { ++ unsigned long dr0, dr1, dr7; ++ ++ dr0 = (unsigned long)&ss; ++ dr1 = (unsigned long)breakpoint_insn; ++ dr7 = ((1UL << 1) | /* G0 */ ++ (3UL << 16) | /* RW0 = read or write */ ++ (1UL << 18) | /* LEN0 = 2 bytes */ ++ (1UL << 3)); /* G1, RW1 = insn */ ++ ++ if (ptrace(PTRACE_ATTACH, parent, NULL, NULL) != 0) ++ err(1, "PTRACE_ATTACH"); ++ ++ if (waitpid(parent, &status, 0) != parent) ++ err(1, "waitpid for child"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[0]), dr0) != 0) ++ err(1, "PTRACE_POKEUSER DR0"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[1]), dr1) != 0) ++ err(1, "PTRACE_POKEUSER DR1"); ++ ++ if (ptrace(PTRACE_POKEUSER, parent, (void *)offsetof(struct user, u_debugreg[7]), dr7) != 0) ++ err(1, "PTRACE_POKEUSER DR7"); ++ ++ printf("\tDR0 = %lx, DR1 = %lx, DR7 = %lx\n", dr0, dr1, dr7); ++ ++ if (ptrace(PTRACE_DETACH, parent, NULL, NULL) != 0) ++ err(1, "PTRACE_DETACH"); ++ ++ exit(0); ++ } ++} ++ ++static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), ++ int flags) ++{ ++ struct sigaction sa; ++ memset(&sa, 0, sizeof(sa)); ++ sa.sa_sigaction = handler; ++ sa.sa_flags = SA_SIGINFO | flags; ++ sigemptyset(&sa.sa_mask); ++ if (sigaction(sig, &sa, 0)) ++ err(1, "sigaction"); ++} ++ ++static char const * const signames[] = { ++ [SIGSEGV] = "SIGSEGV", ++ [SIGBUS] = "SIBGUS", ++ [SIGTRAP] = "SIGTRAP", ++ [SIGILL] = "SIGILL", ++}; ++ ++static void sigtrap(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot SIGTRAP with RIP=%lx, EFLAGS.RF=%d\n", ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP], ++ !!(ctx->uc_mcontext.gregs[REG_EFL] & X86_EFLAGS_RF)); ++} ++ ++static void handle_and_return(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot %s with RIP=%lx\n", signames[sig], ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); ++} ++ ++static void handle_and_longjmp(int sig, siginfo_t *si, void *ctx_void) ++{ ++ ucontext_t *ctx = ctx_void; ++ ++ printf("\tGot %s with RIP=%lx\n", signames[sig], ++ (unsigned long)ctx->uc_mcontext.gregs[REG_IP]); ++ ++ siglongjmp(jmpbuf, 1); ++} ++ ++int main() ++{ ++ unsigned long nr; ++ ++ asm volatile ("mov %%ss, %[ss]" : [ss] "=m" (ss)); ++ printf("\tSS = 0x%hx, &SS = 0x%p\n", ss, &ss); ++ ++ if (prctl(PR_SET_PTRACER, PR_SET_PTRACER_ANY, 0, 0, 0) == 0) ++ printf("\tPR_SET_PTRACER_ANY succeeded\n"); ++ ++ printf("\tSet up a watchpoint\n"); ++ sethandler(SIGTRAP, sigtrap, 0); ++ enable_watchpoint(); ++ ++ printf("[RUN]\tRead from watched memory (should get SIGTRAP)\n"); ++ asm volatile ("mov %[ss], %[tmp]" : [tmp] "=r" (nr) : [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT3\n"); ++ asm volatile ("mov %[ss], %%ss; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT 3\n"); ++ asm volatile ("mov %[ss], %%ss; .byte 0xcd, 0x3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; CS CS INT3\n"); ++ asm volatile ("mov %[ss], %%ss; .byte 0x2e, 0x2e; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; CSx14 INT3\n"); ++ asm volatile ("mov %[ss], %%ss; .fill 14,1,0x2e; int3" :: [ss] "m" (ss)); ++ ++ printf("[RUN]\tMOV SS; INT 4\n"); ++ sethandler(SIGSEGV, handle_and_return, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; int $4" :: [ss] "m" (ss)); ++ ++#ifdef __i386__ ++ printf("[RUN]\tMOV SS; INTO\n"); ++ sethandler(SIGSEGV, handle_and_return, SA_RESETHAND); ++ nr = -1; ++ asm volatile ("add $1, %[tmp]; mov %[ss], %%ss; into" ++ : [tmp] "+r" (nr) : [ss] "m" (ss)); ++#endif ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; ICEBP\n"); ++ ++ /* Some emulators (e.g. QEMU TCG) don't emulate ICEBP. */ ++ sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND); ++ ++ asm volatile ("mov %[ss], %%ss; .byte 0xf1" :: [ss] "m" (ss)); ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; CLI\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; cli" :: [ss] "m" (ss)); ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; #PF\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; mov (-1), %[tmp]" ++ : [tmp] "=r" (nr) : [ss] "m" (ss)); ++ } ++ ++ /* ++ * INT $1: if #DB has DPL=3 and there isn't special handling, ++ * then the kernel will die. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; INT 1\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ asm volatile ("mov %[ss], %%ss; int $1" :: [ss] "m" (ss)); ++ } ++ ++#ifdef __x86_64__ ++ /* ++ * In principle, we should test 32-bit SYSCALL as well, but ++ * the calling convention is so unpredictable that it's ++ * not obviously worth the effort. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; SYSCALL\n"); ++ sethandler(SIGILL, handle_and_longjmp, SA_RESETHAND); ++ nr = SYS_getpid; ++ /* ++ * Toggle the high bit of RSP to make it noncanonical to ++ * strengthen this test on non-SMAP systems. ++ */ ++ asm volatile ("btc $63, %%rsp\n\t" ++ "mov %[ss], %%ss; syscall\n\t" ++ "btc $63, %%rsp" ++ : "+a" (nr) : [ss] "m" (ss) ++ : "rcx" ++#ifdef __x86_64__ ++ , "r11" ++#endif ++ ); ++ } ++#endif ++ ++ printf("[RUN]\tMOV SS; breakpointed NOP\n"); ++ asm volatile ("mov %[ss], %%ss; breakpoint_insn: nop" :: [ss] "m" (ss)); ++ ++ /* ++ * Invoking SYSENTER directly breaks all the rules. Just handle ++ * the SIGSEGV. ++ */ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; SYSENTER\n"); ++ stack_t stack = { ++ .ss_sp = altstack_data, ++ .ss_size = SIGSTKSZ, ++ }; ++ if (sigaltstack(&stack, NULL) != 0) ++ err(1, "sigaltstack"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND | SA_ONSTACK); ++ nr = SYS_getpid; ++ asm volatile ("mov %[ss], %%ss; SYSENTER" : "+a" (nr) ++ : [ss] "m" (ss) : "flags", "rcx" ++#ifdef __x86_64__ ++ , "r11" ++#endif ++ ); ++ ++ /* We're unreachable here. SYSENTER forgets RIP. */ ++ } ++ ++ if (sigsetjmp(jmpbuf, 1) == 0) { ++ printf("[RUN]\tMOV SS; INT $0x80\n"); ++ sethandler(SIGSEGV, handle_and_longjmp, SA_RESETHAND); ++ nr = 20; /* compat getpid */ ++ asm volatile ("mov %[ss], %%ss; int $0x80" ++ : "+a" (nr) : [ss] "m" (ss) ++ : "flags" ++#ifdef __x86_64__ ++ , "r8", "r9", "r10", "r11" ++#endif ++ ); ++ } ++ ++ printf("[OK]\tI aten't dead\n"); ++ return 0; ++} +diff --git a/tools/testing/selftests/x86/mpx-mini-test.c b/tools/testing/selftests/x86/mpx-mini-test.c +index 9c0325e1ea68..50f7e9272481 100644 +--- a/tools/testing/selftests/x86/mpx-mini-test.c ++++ b/tools/testing/selftests/x86/mpx-mini-test.c +@@ -368,6 +368,11 @@ static int expected_bnd_index = -1; + uint64_t shadow_plb[NR_MPX_BOUNDS_REGISTERS][2]; /* shadow MPX bound registers */ + unsigned long shadow_map[NR_MPX_BOUNDS_REGISTERS]; + ++/* Failed address bound checks: */ ++#ifndef SEGV_BNDERR ++# define SEGV_BNDERR 3 ++#endif ++ + /* + * The kernel is supposed to provide some information about the bounds + * exception in the siginfo. It should match what we have in the bounds +@@ -419,8 +424,6 @@ void handler(int signum, siginfo_t *si, void *vucontext) + br_count++; + dprintf1("#BR 0x%jx (total seen: %d)\n", status, br_count); + +-#define SEGV_BNDERR 3 /* failed address bound checks */ +- + dprintf2("Saw a #BR! status 0x%jx at %016lx br_reason: %jx\n", + status, ip, br_reason); + dprintf2("si_signo: %d\n", si->si_signo); +diff --git a/tools/testing/selftests/x86/protection_keys.c b/tools/testing/selftests/x86/protection_keys.c +index f15aa5a76fe3..460b4bdf4c1e 100644 +--- a/tools/testing/selftests/x86/protection_keys.c ++++ b/tools/testing/selftests/x86/protection_keys.c +@@ -72,10 +72,9 @@ extern void abort_hooks(void); + test_nr, iteration_nr); \ + dprintf0("errno at assert: %d", errno); \ + abort_hooks(); \ +- assert(condition); \ ++ exit(__LINE__); \ + } \ + } while (0) +-#define raw_assert(cond) assert(cond) + + void cat_into_file(char *str, char *file) + { +@@ -87,12 +86,17 @@ void cat_into_file(char *str, char *file) + * these need to be raw because they are called under + * pkey_assert() + */ +- raw_assert(fd >= 0); ++ if (fd < 0) { ++ fprintf(stderr, "error opening '%s'\n", str); ++ perror("error: "); ++ exit(__LINE__); ++ } ++ + ret = write(fd, str, strlen(str)); + if (ret != strlen(str)) { + perror("write to file failed"); + fprintf(stderr, "filename: '%s' str: '%s'\n", file, str); +- raw_assert(0); ++ exit(__LINE__); + } + close(fd); + } +@@ -191,26 +195,30 @@ void lots_o_noops_around_write(int *write_to_me) + #ifdef __i386__ + + #ifndef SYS_mprotect_key +-# define SYS_mprotect_key 380 ++# define SYS_mprotect_key 380 + #endif ++ + #ifndef SYS_pkey_alloc +-# define SYS_pkey_alloc 381 +-# define SYS_pkey_free 382 ++# define SYS_pkey_alloc 381 ++# define SYS_pkey_free 382 + #endif +-#define REG_IP_IDX REG_EIP +-#define si_pkey_offset 0x14 ++ ++#define REG_IP_IDX REG_EIP ++#define si_pkey_offset 0x14 + + #else + + #ifndef SYS_mprotect_key +-# define SYS_mprotect_key 329 ++# define SYS_mprotect_key 329 + #endif ++ + #ifndef SYS_pkey_alloc +-# define SYS_pkey_alloc 330 +-# define SYS_pkey_free 331 ++# define SYS_pkey_alloc 330 ++# define SYS_pkey_free 331 + #endif +-#define REG_IP_IDX REG_RIP +-#define si_pkey_offset 0x20 ++ ++#define REG_IP_IDX REG_RIP ++#define si_pkey_offset 0x20 + + #endif + +@@ -225,8 +233,14 @@ void dump_mem(void *dumpme, int len_bytes) + } + } + +-#define SEGV_BNDERR 3 /* failed address bound checks */ +-#define SEGV_PKUERR 4 ++/* Failed address bound checks: */ ++#ifndef SEGV_BNDERR ++# define SEGV_BNDERR 3 ++#endif ++ ++#ifndef SEGV_PKUERR ++# define SEGV_PKUERR 4 ++#endif + + static char *si_code_str(int si_code) + { +@@ -289,13 +303,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + dump_mem(pkru_ptr - 128, 256); + pkey_assert(*pkru_ptr); + +- si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset); +- dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr); +- dump_mem(si_pkey_ptr - 8, 24); +- siginfo_pkey = *si_pkey_ptr; +- pkey_assert(siginfo_pkey < NR_PKEYS); +- last_si_pkey = siginfo_pkey; +- + if ((si->si_code == SEGV_MAPERR) || + (si->si_code == SEGV_ACCERR) || + (si->si_code == SEGV_BNDERR)) { +@@ -303,6 +310,13 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + exit(4); + } + ++ si_pkey_ptr = (u32 *)(((u8 *)si) + si_pkey_offset); ++ dprintf1("si_pkey_ptr: %p\n", si_pkey_ptr); ++ dump_mem((u8 *)si_pkey_ptr - 8, 24); ++ siginfo_pkey = *si_pkey_ptr; ++ pkey_assert(siginfo_pkey < NR_PKEYS); ++ last_si_pkey = siginfo_pkey; ++ + dprintf1("signal pkru from xsave: %08x\n", *pkru_ptr); + /* need __rdpkru() version so we do not do shadow_pkru checking */ + dprintf1("signal pkru from pkru: %08x\n", __rdpkru()); +@@ -311,22 +325,6 @@ void signal_handler(int signum, siginfo_t *si, void *vucontext) + dprintf1("WARNING: set PRKU=0 to allow faulting instruction to continue\n"); + pkru_faults++; + dprintf1("<<<<==================================================\n"); +- return; +- if (trapno == 14) { +- fprintf(stderr, +- "ERROR: In signal handler, page fault, trapno = %d, ip = %016lx\n", +- trapno, ip); +- fprintf(stderr, "si_addr %p\n", si->si_addr); +- fprintf(stderr, "REG_ERR: %lx\n", +- (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]); +- exit(1); +- } else { +- fprintf(stderr, "unexpected trap %d! at 0x%lx\n", trapno, ip); +- fprintf(stderr, "si_addr %p\n", si->si_addr); +- fprintf(stderr, "REG_ERR: %lx\n", +- (unsigned long)uctxt->uc_mcontext.gregs[REG_ERR]); +- exit(2); +- } + dprint_in_signal = 0; + } + +@@ -393,10 +391,15 @@ pid_t fork_lazy_child(void) + return forkret; + } + +-#define PKEY_DISABLE_ACCESS 0x1 +-#define PKEY_DISABLE_WRITE 0x2 ++#ifndef PKEY_DISABLE_ACCESS ++# define PKEY_DISABLE_ACCESS 0x1 ++#endif ++ ++#ifndef PKEY_DISABLE_WRITE ++# define PKEY_DISABLE_WRITE 0x2 ++#endif + +-u32 pkey_get(int pkey, unsigned long flags) ++static u32 hw_pkey_get(int pkey, unsigned long flags) + { + u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE); + u32 pkru = __rdpkru(); +@@ -418,7 +421,7 @@ u32 pkey_get(int pkey, unsigned long flags) + return masked_pkru; + } + +-int pkey_set(int pkey, unsigned long rights, unsigned long flags) ++static int hw_pkey_set(int pkey, unsigned long rights, unsigned long flags) + { + u32 mask = (PKEY_DISABLE_ACCESS|PKEY_DISABLE_WRITE); + u32 old_pkru = __rdpkru(); +@@ -452,15 +455,15 @@ void pkey_disable_set(int pkey, int flags) + pkey, flags); + pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + +- pkey_rights = pkey_get(pkey, syscall_flags); ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); + +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + pkey_assert(pkey_rights >= 0); + + pkey_rights |= flags; + +- ret = pkey_set(pkey, pkey_rights, syscall_flags); ++ ret = hw_pkey_set(pkey, pkey_rights, syscall_flags); + assert(!ret); + /*pkru and flags have the same format */ + shadow_pkru |= flags << (pkey * 2); +@@ -468,8 +471,8 @@ void pkey_disable_set(int pkey, int flags) + + pkey_assert(ret >= 0); + +- pkey_rights = pkey_get(pkey, syscall_flags); +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + + dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru()); +@@ -483,24 +486,24 @@ void pkey_disable_clear(int pkey, int flags) + { + unsigned long syscall_flags = 0; + int ret; +- int pkey_rights = pkey_get(pkey, syscall_flags); ++ int pkey_rights = hw_pkey_get(pkey, syscall_flags); + u32 orig_pkru = rdpkru(); + + pkey_assert(flags & (PKEY_DISABLE_ACCESS | PKEY_DISABLE_WRITE)); + +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + pkey_assert(pkey_rights >= 0); + + pkey_rights |= flags; + +- ret = pkey_set(pkey, pkey_rights, 0); ++ ret = hw_pkey_set(pkey, pkey_rights, 0); + /* pkru and flags have the same format */ + shadow_pkru &= ~(flags << (pkey * 2)); + pkey_assert(ret >= 0); + +- pkey_rights = pkey_get(pkey, syscall_flags); +- dprintf1("%s(%d) pkey_get(%d): %x\n", __func__, ++ pkey_rights = hw_pkey_get(pkey, syscall_flags); ++ dprintf1("%s(%d) hw_pkey_get(%d): %x\n", __func__, + pkey, pkey, pkey_rights); + + dprintf1("%s(%d) pkru: 0x%x\n", __func__, pkey, rdpkru()); +@@ -674,10 +677,12 @@ int mprotect_pkey(void *ptr, size_t size, unsigned long orig_prot, + struct pkey_malloc_record { + void *ptr; + long size; ++ int prot; + }; + struct pkey_malloc_record *pkey_malloc_records; ++struct pkey_malloc_record *pkey_last_malloc_record; + long nr_pkey_malloc_records; +-void record_pkey_malloc(void *ptr, long size) ++void record_pkey_malloc(void *ptr, long size, int prot) + { + long i; + struct pkey_malloc_record *rec = NULL; +@@ -709,6 +714,8 @@ void record_pkey_malloc(void *ptr, long size) + (int)(rec - pkey_malloc_records), rec, ptr, size); + rec->ptr = ptr; + rec->size = size; ++ rec->prot = prot; ++ pkey_last_malloc_record = rec; + nr_pkey_malloc_records++; + } + +@@ -753,7 +760,7 @@ void *malloc_pkey_with_mprotect(long size, int prot, u16 pkey) + pkey_assert(ptr != (void *)-1); + ret = mprotect_pkey((void *)ptr, PAGE_SIZE, prot, pkey); + pkey_assert(!ret); +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + rdpkru(); + + dprintf1("%s() for pkey %d @ %p\n", __func__, pkey, ptr); +@@ -774,7 +781,7 @@ void *malloc_pkey_anon_huge(long size, int prot, u16 pkey) + size = ALIGN_UP(size, HPAGE_SIZE * 2); + ptr = mmap(NULL, size, PROT_NONE, MAP_ANONYMOUS|MAP_PRIVATE, -1, 0); + pkey_assert(ptr != (void *)-1); +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + mprotect_pkey(ptr, size, prot, pkey); + + dprintf1("unaligned ptr: %p\n", ptr); +@@ -847,7 +854,7 @@ void *malloc_pkey_hugetlb(long size, int prot, u16 pkey) + pkey_assert(ptr != (void *)-1); + mprotect_pkey(ptr, size, prot, pkey); + +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + + dprintf1("mmap()'d hugetlbfs for pkey %d @ %p\n", pkey, ptr); + return ptr; +@@ -869,7 +876,7 @@ void *malloc_pkey_mmap_dax(long size, int prot, u16 pkey) + + mprotect_pkey(ptr, size, prot, pkey); + +- record_pkey_malloc(ptr, size); ++ record_pkey_malloc(ptr, size, prot); + + dprintf1("mmap()'d for pkey %d @ %p\n", pkey, ptr); + close(fd); +@@ -918,13 +925,21 @@ void *malloc_pkey(long size, int prot, u16 pkey) + } + + int last_pkru_faults; ++#define UNKNOWN_PKEY -2 + void expected_pk_fault(int pkey) + { + dprintf2("%s(): last_pkru_faults: %d pkru_faults: %d\n", + __func__, last_pkru_faults, pkru_faults); + dprintf2("%s(%d): last_si_pkey: %d\n", __func__, pkey, last_si_pkey); + pkey_assert(last_pkru_faults + 1 == pkru_faults); +- pkey_assert(last_si_pkey == pkey); ++ ++ /* ++ * For exec-only memory, we do not know the pkey in ++ * advance, so skip this check. ++ */ ++ if (pkey != UNKNOWN_PKEY) ++ pkey_assert(last_si_pkey == pkey); ++ + /* + * The signal handler shold have cleared out PKRU to let the + * test program continue. We now have to restore it. +@@ -939,10 +954,11 @@ void expected_pk_fault(int pkey) + last_si_pkey = -1; + } + +-void do_not_expect_pk_fault(void) +-{ +- pkey_assert(last_pkru_faults == pkru_faults); +-} ++#define do_not_expect_pk_fault(msg) do { \ ++ if (last_pkru_faults != pkru_faults) \ ++ dprintf0("unexpected PK fault: %s\n", msg); \ ++ pkey_assert(last_pkru_faults == pkru_faults); \ ++} while (0) + + int test_fds[10] = { -1 }; + int nr_test_fds; +@@ -1151,12 +1167,15 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey) + pkey_assert(i < NR_PKEYS*2); + + /* +- * There are 16 pkeys supported in hardware. One is taken +- * up for the default (0) and another can be taken up by +- * an execute-only mapping. Ensure that we can allocate +- * at least 14 (16-2). ++ * There are 16 pkeys supported in hardware. Three are ++ * allocated by the time we get here: ++ * 1. The default key (0) ++ * 2. One possibly consumed by an execute-only mapping. ++ * 3. One allocated by the test code and passed in via ++ * 'pkey' to this function. ++ * Ensure that we can allocate at least another 13 (16-3). + */ +- pkey_assert(i >= NR_PKEYS-2); ++ pkey_assert(i >= NR_PKEYS-3); + + for (i = 0; i < nr_allocated_pkeys; i++) { + err = sys_pkey_free(allocated_pkeys[i]); +@@ -1165,6 +1184,35 @@ void test_pkey_alloc_exhaust(int *ptr, u16 pkey) + } + } + ++/* ++ * pkey 0 is special. It is allocated by default, so you do not ++ * have to call pkey_alloc() to use it first. Make sure that it ++ * is usable. ++ */ ++void test_mprotect_with_pkey_0(int *ptr, u16 pkey) ++{ ++ long size; ++ int prot; ++ ++ assert(pkey_last_malloc_record); ++ size = pkey_last_malloc_record->size; ++ /* ++ * This is a bit of a hack. But mprotect() requires ++ * huge-page-aligned sizes when operating on hugetlbfs. ++ * So, make sure that we use something that's a multiple ++ * of a huge page when we can. ++ */ ++ if (size >= HPAGE_SIZE) ++ size = HPAGE_SIZE; ++ prot = pkey_last_malloc_record->prot; ++ ++ /* Use pkey 0 */ ++ mprotect_pkey(ptr, size, prot, 0); ++ ++ /* Make sure that we can set it back to the original pkey. */ ++ mprotect_pkey(ptr, size, prot, pkey); ++} ++ + void test_ptrace_of_child(int *ptr, u16 pkey) + { + __attribute__((__unused__)) int peek_result; +@@ -1228,7 +1276,7 @@ void test_ptrace_of_child(int *ptr, u16 pkey) + pkey_assert(ret != -1); + /* Now access from the current task, and expect NO exception: */ + peek_result = read_ptr(plain_ptr); +- do_not_expect_pk_fault(); ++ do_not_expect_pk_fault("read plain pointer after ptrace"); + + ret = ptrace(PTRACE_DETACH, child_pid, ignored, 0); + pkey_assert(ret != -1); +@@ -1241,12 +1289,9 @@ void test_ptrace_of_child(int *ptr, u16 pkey) + free(plain_ptr_unaligned); + } + +-void test_executing_on_unreadable_memory(int *ptr, u16 pkey) ++void *get_pointer_to_instructions(void) + { + void *p1; +- int scratch; +- int ptr_contents; +- int ret; + + p1 = ALIGN_PTR_UP(&lots_o_noops_around_write, PAGE_SIZE); + dprintf3("&lots_o_noops: %p\n", &lots_o_noops_around_write); +@@ -1256,7 +1301,23 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey) + /* Point 'p1' at the *second* page of the function: */ + p1 += PAGE_SIZE; + ++ /* ++ * Try to ensure we fault this in on next touch to ensure ++ * we get an instruction fault as opposed to a data one ++ */ + madvise(p1, PAGE_SIZE, MADV_DONTNEED); ++ ++ return p1; ++} ++ ++void test_executing_on_unreadable_memory(int *ptr, u16 pkey) ++{ ++ void *p1; ++ int scratch; ++ int ptr_contents; ++ int ret; ++ ++ p1 = get_pointer_to_instructions(); + lots_o_noops_around_write(&scratch); + ptr_contents = read_ptr(p1); + dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); +@@ -1272,12 +1333,55 @@ void test_executing_on_unreadable_memory(int *ptr, u16 pkey) + */ + madvise(p1, PAGE_SIZE, MADV_DONTNEED); + lots_o_noops_around_write(&scratch); +- do_not_expect_pk_fault(); ++ do_not_expect_pk_fault("executing on PROT_EXEC memory"); + ptr_contents = read_ptr(p1); + dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); + expected_pk_fault(pkey); + } + ++void test_implicit_mprotect_exec_only_memory(int *ptr, u16 pkey) ++{ ++ void *p1; ++ int scratch; ++ int ptr_contents; ++ int ret; ++ ++ dprintf1("%s() start\n", __func__); ++ ++ p1 = get_pointer_to_instructions(); ++ lots_o_noops_around_write(&scratch); ++ ptr_contents = read_ptr(p1); ++ dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); ++ ++ /* Use a *normal* mprotect(), not mprotect_pkey(): */ ++ ret = mprotect(p1, PAGE_SIZE, PROT_EXEC); ++ pkey_assert(!ret); ++ ++ dprintf2("pkru: %x\n", rdpkru()); ++ ++ /* Make sure this is an *instruction* fault */ ++ madvise(p1, PAGE_SIZE, MADV_DONTNEED); ++ lots_o_noops_around_write(&scratch); ++ do_not_expect_pk_fault("executing on PROT_EXEC memory"); ++ ptr_contents = read_ptr(p1); ++ dprintf2("ptr (%p) contents@%d: %x\n", p1, __LINE__, ptr_contents); ++ expected_pk_fault(UNKNOWN_PKEY); ++ ++ /* ++ * Put the memory back to non-PROT_EXEC. Should clear the ++ * exec-only pkey off the VMA and allow it to be readable ++ * again. Go to PROT_NONE first to check for a kernel bug ++ * that did not clear the pkey when doing PROT_NONE. ++ */ ++ ret = mprotect(p1, PAGE_SIZE, PROT_NONE); ++ pkey_assert(!ret); ++ ++ ret = mprotect(p1, PAGE_SIZE, PROT_READ|PROT_EXEC); ++ pkey_assert(!ret); ++ ptr_contents = read_ptr(p1); ++ do_not_expect_pk_fault("plain read on recently PROT_EXEC area"); ++} ++ + void test_mprotect_pkey_on_unsupported_cpu(int *ptr, u16 pkey) + { + int size = PAGE_SIZE; +@@ -1302,6 +1406,8 @@ void (*pkey_tests[])(int *ptr, u16 pkey) = { + test_kernel_gup_of_access_disabled_region, + test_kernel_gup_write_to_write_disabled_region, + test_executing_on_unreadable_memory, ++ test_implicit_mprotect_exec_only_memory, ++ test_mprotect_with_pkey_0, + test_ptrace_of_child, + test_pkey_syscalls_on_non_allocated_pkey, + test_pkey_syscalls_bad_args, +diff --git a/virt/kvm/arm/vgic/vgic-mmio-v2.c b/virt/kvm/arm/vgic/vgic-mmio-v2.c +index b3d4a10f09a1..af003268bf3e 100644 +--- a/virt/kvm/arm/vgic/vgic-mmio-v2.c ++++ b/virt/kvm/arm/vgic/vgic-mmio-v2.c +@@ -14,6 +14,8 @@ + #include + #include + #include ++#include ++ + #include + #include + +@@ -320,6 +322,9 @@ static unsigned long vgic_mmio_read_apr(struct kvm_vcpu *vcpu, + + if (n > vgic_v3_max_apr_idx(vcpu)) + return 0; ++ ++ n = array_index_nospec(n, 4); ++ + /* GICv3 only uses ICH_AP1Rn for memory mapped (GICv2) guests */ + return vgicv3->vgic_ap1r[n]; + } diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.51-52.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.51-52.patch new file mode 100644 index 000000000000..a5b3f530b0c6 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.51-52.patch @@ -0,0 +1,1921 @@ +diff --git a/Makefile b/Makefile +index a33376204c17..e2e4009bbfed 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 51 ++SUBLEVEL = 52 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/x86/kernel/cpu/intel_rdt.c b/arch/x86/kernel/cpu/intel_rdt.c +index 18dd8f22e353..665d0f6cd62f 100644 +--- a/arch/x86/kernel/cpu/intel_rdt.c ++++ b/arch/x86/kernel/cpu/intel_rdt.c +@@ -773,6 +773,8 @@ static __init void rdt_quirks(void) + case INTEL_FAM6_SKYLAKE_X: + if (boot_cpu_data.x86_stepping <= 4) + set_rdt_options("!cmt,!mbmtotal,!mbmlocal,!l3cat"); ++ else ++ set_rdt_options("!l3cat"); + } + } + +diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c +index 231ad23b24a9..8fec687b3e44 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce-inject.c ++++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c +@@ -48,7 +48,7 @@ static struct dentry *dfs_inj; + + static u8 n_banks; + +-#define MAX_FLAG_OPT_SIZE 3 ++#define MAX_FLAG_OPT_SIZE 4 + #define NBCFG 0x44 + + enum injection_type { +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 74c35513ada5..49979c095f31 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -2252,7 +2252,6 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q) + + mutex_lock(&set->tag_list_lock); + list_del_rcu(&q->tag_set_list); +- INIT_LIST_HEAD(&q->tag_set_list); + if (list_is_singular(&set->tag_list)) { + /* just transitioned to unshared */ + set->flags &= ~BLK_MQ_F_TAG_SHARED; +@@ -2260,8 +2259,8 @@ static void blk_mq_del_queue_tag_set(struct request_queue *q) + blk_mq_update_tag_set_depth(set, false); + } + mutex_unlock(&set->tag_list_lock); +- + synchronize_rcu(); ++ INIT_LIST_HEAD(&q->tag_set_list); + } + + static void blk_mq_add_queue_tag_set(struct blk_mq_tag_set *set, +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index 71008dbabe98..cad2530a5b52 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4543,9 +4543,6 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { + ATA_HORKAGE_ZERO_AFTER_TRIM | + ATA_HORKAGE_NOLPM, }, + +- /* Sandisk devices which are known to not handle LPM well */ +- { "SanDisk SD7UB3Q*G1001", NULL, ATA_HORKAGE_NOLPM, }, +- + /* devices that don't properly handle queued TRIM commands */ + { "Micron_M500IT_*", "MU01", ATA_HORKAGE_NO_NCQ_TRIM | + ATA_HORKAGE_ZERO_AFTER_TRIM, }, +diff --git a/drivers/ata/libata-zpodd.c b/drivers/ata/libata-zpodd.c +index de4ddd0e8550..b3ed8f9953a8 100644 +--- a/drivers/ata/libata-zpodd.c ++++ b/drivers/ata/libata-zpodd.c +@@ -35,7 +35,7 @@ struct zpodd { + static int eject_tray(struct ata_device *dev) + { + struct ata_taskfile tf; +- static const char cdb[] = { GPCMD_START_STOP_UNIT, ++ static const char cdb[ATAPI_CDB_LEN] = { GPCMD_START_STOP_UNIT, + 0, 0, 0, + 0x02, /* LoEj */ + 0, 0, 0, 0, 0, 0, 0, +diff --git a/drivers/base/core.c b/drivers/base/core.c +index c8501cdb95f4..a359934ffd85 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -1461,7 +1461,7 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) + + dir = kzalloc(sizeof(*dir), GFP_KERNEL); + if (!dir) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + dir->class = class; + kobject_init(&dir->kobj, &class_dir_ktype); +@@ -1471,7 +1471,7 @@ class_dir_create_and_add(struct class *class, struct kobject *parent_kobj) + retval = kobject_add(&dir->kobj, parent_kobj, "%s", class->name); + if (retval < 0) { + kobject_put(&dir->kobj); +- return NULL; ++ return ERR_PTR(retval); + } + return &dir->kobj; + } +@@ -1778,6 +1778,10 @@ int device_add(struct device *dev) + + parent = get_device(dev->parent); + kobj = get_device_parent(dev, parent); ++ if (IS_ERR(kobj)) { ++ error = PTR_ERR(kobj); ++ goto parent_error; ++ } + if (kobj) + dev->kobj.parent = kobj; + +@@ -1876,6 +1880,7 @@ int device_add(struct device *dev) + kobject_del(&dev->kobj); + Error: + cleanup_glue_dir(dev, glue_dir); ++parent_error: + put_device(parent); + name_error: + kfree(dev->p); +@@ -2695,6 +2700,11 @@ int device_move(struct device *dev, struct device *new_parent, + device_pm_lock(); + new_parent = get_device(new_parent); + new_parent_kobj = get_device_parent(dev, new_parent); ++ if (IS_ERR(new_parent_kobj)) { ++ error = PTR_ERR(new_parent_kobj); ++ put_device(new_parent); ++ goto out; ++ } + + pr_debug("device: '%s': %s: moving to '%s'\n", dev_name(dev), + __func__, new_parent ? dev_name(new_parent) : ""); +diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c +index 86258b00a1d4..6fb64e73bc96 100644 +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -173,9 +173,12 @@ static const struct device_attribute pid_attr = { + static void nbd_dev_remove(struct nbd_device *nbd) + { + struct gendisk *disk = nbd->disk; ++ struct request_queue *q; ++ + if (disk) { ++ q = disk->queue; + del_gendisk(disk); +- blk_cleanup_queue(disk->queue); ++ blk_cleanup_queue(q); + blk_mq_free_tag_set(&nbd->tag_set); + disk->private_data = NULL; + put_disk(disk); +@@ -231,9 +234,18 @@ static void nbd_size_clear(struct nbd_device *nbd) + static void nbd_size_update(struct nbd_device *nbd) + { + struct nbd_config *config = nbd->config; ++ struct block_device *bdev = bdget_disk(nbd->disk, 0); ++ + blk_queue_logical_block_size(nbd->disk->queue, config->blksize); + blk_queue_physical_block_size(nbd->disk->queue, config->blksize); + set_capacity(nbd->disk, config->bytesize >> 9); ++ if (bdev) { ++ if (bdev->bd_disk) ++ bd_set_size(bdev, config->bytesize); ++ else ++ bdev->bd_invalidated = 1; ++ bdput(bdev); ++ } + kobject_uevent(&nbd_to_dev(nbd)->kobj, KOBJ_CHANGE); + } + +@@ -243,6 +255,8 @@ static void nbd_size_set(struct nbd_device *nbd, loff_t blocksize, + struct nbd_config *config = nbd->config; + config->blksize = blocksize; + config->bytesize = blocksize * nr_blocks; ++ if (nbd->task_recv != NULL) ++ nbd_size_update(nbd); + } + + static void nbd_complete_rq(struct request *req) +@@ -1109,7 +1123,6 @@ static int nbd_start_device_ioctl(struct nbd_device *nbd, struct block_device *b + if (ret) + return ret; + +- bd_set_size(bdev, config->bytesize); + if (max_part) + bdev->bd_invalidated = 1; + mutex_unlock(&nbd->config_lock); +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 789fc3a8289f..93754300cb57 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -693,6 +693,8 @@ static ssize_t store_##file_name \ + struct cpufreq_policy new_policy; \ + \ + memcpy(&new_policy, policy, sizeof(*policy)); \ ++ new_policy.min = policy->user_policy.min; \ ++ new_policy.max = policy->user_policy.max; \ + \ + ret = sscanf(buf, "%u", &new_policy.object); \ + if (ret != 1) \ +diff --git a/drivers/cpufreq/cpufreq_governor.c b/drivers/cpufreq/cpufreq_governor.c +index ca38229b045a..43e14bb512c8 100644 +--- a/drivers/cpufreq/cpufreq_governor.c ++++ b/drivers/cpufreq/cpufreq_governor.c +@@ -165,7 +165,7 @@ unsigned int dbs_update(struct cpufreq_policy *policy) + * calls, so the previous load value can be used then. + */ + load = j_cdbs->prev_load; +- } else if (unlikely(time_elapsed > 2 * sampling_rate && ++ } else if (unlikely((int)idle_time > 2 * sampling_rate && + j_cdbs->prev_load)) { + /* + * If the CPU had gone completely idle and a task has +@@ -185,10 +185,8 @@ unsigned int dbs_update(struct cpufreq_policy *policy) + * clear prev_load to guarantee that the load will be + * computed again next time. + * +- * Detecting this situation is easy: the governor's +- * utilization update handler would not have run during +- * CPU-idle periods. Hence, an unusually large +- * 'time_elapsed' (as compared to the sampling rate) ++ * Detecting this situation is easy: an unusually large ++ * 'idle_time' (as compared to the sampling rate) + * indicates this scenario. + */ + load = j_cdbs->prev_load; +@@ -217,8 +215,8 @@ unsigned int dbs_update(struct cpufreq_policy *policy) + j_cdbs->prev_load = load; + } + +- if (time_elapsed > 2 * sampling_rate) { +- unsigned int periods = time_elapsed / sampling_rate; ++ if (unlikely((int)idle_time > 2 * sampling_rate)) { ++ unsigned int periods = idle_time / sampling_rate; + + if (periods < idle_periods) + idle_periods = periods; +diff --git a/drivers/hid/intel-ish-hid/ipc/pci-ish.c b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +index 20d824f74f99..90d7be08fea0 100644 +--- a/drivers/hid/intel-ish-hid/ipc/pci-ish.c ++++ b/drivers/hid/intel-ish-hid/ipc/pci-ish.c +@@ -204,8 +204,7 @@ static void ish_remove(struct pci_dev *pdev) + kfree(ishtp_dev); + } + +-#ifdef CONFIG_PM +-static struct device *ish_resume_device; ++static struct device __maybe_unused *ish_resume_device; + + /* 50ms to get resume response */ + #define WAIT_FOR_RESUME_ACK_MS 50 +@@ -219,7 +218,7 @@ static struct device *ish_resume_device; + * in that case a simple resume message is enough, others we need + * a reset sequence. + */ +-static void ish_resume_handler(struct work_struct *work) ++static void __maybe_unused ish_resume_handler(struct work_struct *work) + { + struct pci_dev *pdev = to_pci_dev(ish_resume_device); + struct ishtp_device *dev = pci_get_drvdata(pdev); +@@ -261,7 +260,7 @@ static void ish_resume_handler(struct work_struct *work) + * + * Return: 0 to the pm core + */ +-static int ish_suspend(struct device *device) ++static int __maybe_unused ish_suspend(struct device *device) + { + struct pci_dev *pdev = to_pci_dev(device); + struct ishtp_device *dev = pci_get_drvdata(pdev); +@@ -287,7 +286,7 @@ static int ish_suspend(struct device *device) + return 0; + } + +-static DECLARE_WORK(resume_work, ish_resume_handler); ++static __maybe_unused DECLARE_WORK(resume_work, ish_resume_handler); + /** + * ish_resume() - ISH resume callback + * @device: device pointer +@@ -296,7 +295,7 @@ static DECLARE_WORK(resume_work, ish_resume_handler); + * + * Return: 0 to the pm core + */ +-static int ish_resume(struct device *device) ++static int __maybe_unused ish_resume(struct device *device) + { + struct pci_dev *pdev = to_pci_dev(device); + struct ishtp_device *dev = pci_get_drvdata(pdev); +@@ -310,21 +309,14 @@ static int ish_resume(struct device *device) + return 0; + } + +-static const struct dev_pm_ops ish_pm_ops = { +- .suspend = ish_suspend, +- .resume = ish_resume, +-}; +-#define ISHTP_ISH_PM_OPS (&ish_pm_ops) +-#else +-#define ISHTP_ISH_PM_OPS NULL +-#endif /* CONFIG_PM */ ++static SIMPLE_DEV_PM_OPS(ish_pm_ops, ish_suspend, ish_resume); + + static struct pci_driver ish_driver = { + .name = KBUILD_MODNAME, + .id_table = ish_pci_tbl, + .probe = ish_probe, + .remove = ish_remove, +- .driver.pm = ISHTP_ISH_PM_OPS, ++ .driver.pm = &ish_pm_ops, + }; + + module_pci_driver(ish_driver); +diff --git a/drivers/hid/wacom_sys.c b/drivers/hid/wacom_sys.c +index 69afd7968d9c..18d5b99d13f1 100644 +--- a/drivers/hid/wacom_sys.c ++++ b/drivers/hid/wacom_sys.c +@@ -284,6 +284,14 @@ static void wacom_usage_mapping(struct hid_device *hdev, + } + } + ++ /* 2nd-generation Intuos Pro Large has incorrect Y maximum */ ++ if (hdev->vendor == USB_VENDOR_ID_WACOM && ++ hdev->product == 0x0358 && ++ WACOM_PEN_FIELD(field) && ++ wacom_equivalent_usage(usage->hid) == HID_GD_Y) { ++ field->logical_maximum = 43200; ++ } ++ + switch (usage->hid) { + case HID_GD_X: + features->x_max = field->logical_maximum; +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 5931aa2fe997..61084ba69a99 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -1142,6 +1142,7 @@ static int bond_option_primary_set(struct bonding *bond, + slave->dev->name); + rcu_assign_pointer(bond->primary_slave, slave); + strcpy(bond->params.primary, slave->dev->name); ++ bond->force_primary = true; + bond_select_active_slave(bond); + goto out; + } +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 3a7241c8713c..6890478a0851 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -123,8 +123,10 @@ static int netvsc_open(struct net_device *net) + } + + rdev = nvdev->extension; +- if (!rdev->link_state) ++ if (!rdev->link_state) { + netif_carrier_on(net); ++ netif_tx_wake_all_queues(net); ++ } + + if (vf_netdev) { + /* Setting synthetic device up transparently sets +diff --git a/drivers/net/tap.c b/drivers/net/tap.c +index bfd4ded0a53f..773a3fea8f0e 100644 +--- a/drivers/net/tap.c ++++ b/drivers/net/tap.c +@@ -777,13 +777,16 @@ static ssize_t tap_put_user(struct tap_queue *q, + int total; + + if (q->flags & IFF_VNET_HDR) { ++ int vlan_hlen = skb_vlan_tag_present(skb) ? VLAN_HLEN : 0; + struct virtio_net_hdr vnet_hdr; ++ + vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); + if (iov_iter_count(iter) < vnet_hdr_len) + return -EINVAL; + + if (virtio_net_hdr_from_skb(skb, &vnet_hdr, +- tap_is_little_endian(q), true)) ++ tap_is_little_endian(q), true, ++ vlan_hlen)) + BUG(); + + if (copy_to_iter(&vnet_hdr, sizeof(vnet_hdr), iter) != +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 3d9ad11e4f28..cb17ffadfc30 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1648,7 +1648,8 @@ static ssize_t tun_put_user(struct tun_struct *tun, + return -EINVAL; + + if (virtio_net_hdr_from_skb(skb, &gso, +- tun_is_little_endian(tun), true)) { ++ tun_is_little_endian(tun), true, ++ vlan_hlen)) { + struct skb_shared_info *sinfo = skb_shinfo(skb); + pr_err("unexpected GSO type: " + "0x%x, gso_size %d, hdr_len %d\n", +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 9e1b74590682..f5316ab68a0a 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -1124,7 +1124,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + * accordingly. Otherwise, we should check here. + */ + if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) +- delayed_ndp_size = ctx->max_ndp_size; ++ delayed_ndp_size = ALIGN(ctx->max_ndp_size, ctx->tx_ndp_modulus); + else + delayed_ndp_size = 0; + +@@ -1285,7 +1285,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign) + /* If requested, put NDP at end of frame. */ + if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) { + nth16 = (struct usb_cdc_ncm_nth16 *)skb_out->data; +- cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size); ++ cdc_ncm_align_tail(skb_out, ctx->tx_ndp_modulus, 0, ctx->tx_curr_size - ctx->max_ndp_size); + nth16->wNdpIndex = cpu_to_le16(skb_out->len); + skb_put_data(skb_out, ctx->delayed_ndp16, ctx->max_ndp_size); + +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 9e93e7a5df7e..910c46b47769 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -1237,7 +1237,8 @@ static int xmit_skb(struct send_queue *sq, struct sk_buff *skb) + hdr = skb_vnet_hdr(skb); + + if (virtio_net_hdr_from_skb(skb, &hdr->hdr, +- virtio_is_little_endian(vi->vdev), false)) ++ virtio_is_little_endian(vi->vdev), false, ++ 0)) + BUG(); + + if (vi->mergeable_rx_bufs) +diff --git a/drivers/net/wireless/intel/iwlwifi/fw/paging.c b/drivers/net/wireless/intel/iwlwifi/fw/paging.c +index 1610722b8099..747eef82cefd 100644 +--- a/drivers/net/wireless/intel/iwlwifi/fw/paging.c ++++ b/drivers/net/wireless/intel/iwlwifi/fw/paging.c +@@ -8,6 +8,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of version 2 of the GNU General Public License as +@@ -30,6 +31,7 @@ + * Copyright(c) 2012 - 2014 Intel Corporation. All rights reserved. + * Copyright(c) 2013 - 2015 Intel Mobile Communications GmbH + * Copyright(c) 2016 - 2017 Intel Deutschland GmbH ++ * Copyright(c) 2018 Intel Corporation + * All rights reserved. + * + * Redistribution and use in source and binary forms, with or without +@@ -174,7 +176,7 @@ static int iwl_alloc_fw_paging_mem(struct iwl_fw_runtime *fwrt, + static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt, + const struct fw_img *image) + { +- int sec_idx, idx; ++ int sec_idx, idx, ret; + u32 offset = 0; + + /* +@@ -201,17 +203,23 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt, + */ + if (sec_idx >= image->num_sec - 1) { + IWL_ERR(fwrt, "Paging: Missing CSS and/or paging sections\n"); +- iwl_free_fw_paging(fwrt); +- return -EINVAL; ++ ret = -EINVAL; ++ goto err; + } + + /* copy the CSS block to the dram */ + IWL_DEBUG_FW(fwrt, "Paging: load paging CSS to FW, sec = %d\n", + sec_idx); + ++ if (image->sec[sec_idx].len > fwrt->fw_paging_db[0].fw_paging_size) { ++ IWL_ERR(fwrt, "CSS block is larger than paging size\n"); ++ ret = -EINVAL; ++ goto err; ++ } ++ + memcpy(page_address(fwrt->fw_paging_db[0].fw_paging_block), + image->sec[sec_idx].data, +- fwrt->fw_paging_db[0].fw_paging_size); ++ image->sec[sec_idx].len); + dma_sync_single_for_device(fwrt->trans->dev, + fwrt->fw_paging_db[0].fw_paging_phys, + fwrt->fw_paging_db[0].fw_paging_size, +@@ -232,6 +240,14 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt, + for (idx = 1; idx < fwrt->num_of_paging_blk; idx++) { + struct iwl_fw_paging *block = &fwrt->fw_paging_db[idx]; + ++ if (block->fw_paging_size > image->sec[sec_idx].len - offset) { ++ IWL_ERR(fwrt, ++ "Paging: paging size is larger than remaining data in block %d\n", ++ idx); ++ ret = -EINVAL; ++ goto err; ++ } ++ + memcpy(page_address(block->fw_paging_block), + image->sec[sec_idx].data + offset, + block->fw_paging_size); +@@ -242,19 +258,32 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt, + + IWL_DEBUG_FW(fwrt, + "Paging: copied %d paging bytes to block %d\n", +- fwrt->fw_paging_db[idx].fw_paging_size, +- idx); ++ block->fw_paging_size, idx); ++ ++ offset += block->fw_paging_size; + +- offset += fwrt->fw_paging_db[idx].fw_paging_size; ++ if (offset > image->sec[sec_idx].len) { ++ IWL_ERR(fwrt, ++ "Paging: offset goes over section size\n"); ++ ret = -EINVAL; ++ goto err; ++ } + } + + /* copy the last paging block */ + if (fwrt->num_of_pages_in_last_blk > 0) { + struct iwl_fw_paging *block = &fwrt->fw_paging_db[idx]; + ++ if (image->sec[sec_idx].len - offset > block->fw_paging_size) { ++ IWL_ERR(fwrt, ++ "Paging: last block is larger than paging size\n"); ++ ret = -EINVAL; ++ goto err; ++ } ++ + memcpy(page_address(block->fw_paging_block), + image->sec[sec_idx].data + offset, +- FW_PAGING_SIZE * fwrt->num_of_pages_in_last_blk); ++ image->sec[sec_idx].len - offset); + dma_sync_single_for_device(fwrt->trans->dev, + block->fw_paging_phys, + block->fw_paging_size, +@@ -266,6 +295,10 @@ static int iwl_fill_paging_mem(struct iwl_fw_runtime *fwrt, + } + + return 0; ++ ++err: ++ iwl_free_fw_paging(fwrt); ++ return ret; + } + + static int iwl_save_fw_paging(struct iwl_fw_runtime *fwrt, +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 50e48afd88ff..244e5256c526 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -2382,6 +2382,9 @@ struct vhost_msg_node *vhost_new_msg(struct vhost_virtqueue *vq, int type) + struct vhost_msg_node *node = kmalloc(sizeof *node, GFP_KERNEL); + if (!node) + return NULL; ++ ++ /* Make sure all padding within the structure is initialized. */ ++ memset(&node->msg, 0, sizeof node->msg); + node->vq = vq; + node->msg.type = type; + return node; +diff --git a/drivers/w1/masters/mxc_w1.c b/drivers/w1/masters/mxc_w1.c +index 74f2e6e6202a..8851d441e5fd 100644 +--- a/drivers/w1/masters/mxc_w1.c ++++ b/drivers/w1/masters/mxc_w1.c +@@ -112,6 +112,10 @@ static int mxc_w1_probe(struct platform_device *pdev) + if (IS_ERR(mdev->clk)) + return PTR_ERR(mdev->clk); + ++ err = clk_prepare_enable(mdev->clk); ++ if (err) ++ return err; ++ + clkrate = clk_get_rate(mdev->clk); + if (clkrate < 10000000) + dev_warn(&pdev->dev, +@@ -125,12 +129,10 @@ static int mxc_w1_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + mdev->regs = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(mdev->regs)) +- return PTR_ERR(mdev->regs); +- +- err = clk_prepare_enable(mdev->clk); +- if (err) +- return err; ++ if (IS_ERR(mdev->regs)) { ++ err = PTR_ERR(mdev->regs); ++ goto out_disable_clk; ++ } + + /* Software reset 1-Wire module */ + writeb(MXC_W1_RESET_RST, mdev->regs + MXC_W1_RESET); +@@ -146,8 +148,12 @@ static int mxc_w1_probe(struct platform_device *pdev) + + err = w1_add_master_device(&mdev->bus_master); + if (err) +- clk_disable_unprepare(mdev->clk); ++ goto out_disable_clk; + ++ return 0; ++ ++out_disable_clk: ++ clk_disable_unprepare(mdev->clk); + return err; + } + +diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c +index a7c5a9861bef..8311e8ed76de 100644 +--- a/fs/binfmt_misc.c ++++ b/fs/binfmt_misc.c +@@ -387,8 +387,13 @@ static Node *create_entry(const char __user *buffer, size_t count) + s = strchr(p, del); + if (!s) + goto einval; +- *s++ = '\0'; +- e->offset = simple_strtoul(p, &p, 10); ++ *s = '\0'; ++ if (p != s) { ++ int r = kstrtoint(p, 10, &e->offset); ++ if (r != 0 || e->offset < 0) ++ goto einval; ++ } ++ p = s; + if (*p++) + goto einval; + pr_debug("register: offset: %#x\n", e->offset); +@@ -428,7 +433,8 @@ static Node *create_entry(const char __user *buffer, size_t count) + if (e->mask && + string_unescape_inplace(e->mask, UNESCAPE_HEX) != e->size) + goto einval; +- if (e->size + e->offset > BINPRM_BUF_SIZE) ++ if (e->size > BINPRM_BUF_SIZE || ++ BINPRM_BUF_SIZE - e->size < e->offset) + goto einval; + pr_debug("register: magic/mask length: %i\n", e->size); + if (USE_DEBUG) { +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 8ecbac3b862e..3a07900971c3 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -1027,8 +1027,10 @@ static noinline int cow_file_range(struct inode *inode, + ram_size, /* ram_bytes */ + BTRFS_COMPRESS_NONE, /* compress_type */ + BTRFS_ORDERED_REGULAR /* type */); +- if (IS_ERR(em)) ++ if (IS_ERR(em)) { ++ ret = PTR_ERR(em); + goto out_reserve; ++ } + free_extent_map(em); + + ret = btrfs_add_ordered_extent(inode, start, ins.objectid, +diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c +index 2763f3184ac5..7303ba108112 100644 +--- a/fs/btrfs/ioctl.c ++++ b/fs/btrfs/ioctl.c +@@ -2682,8 +2682,10 @@ static long btrfs_ioctl_rm_dev_v2(struct file *file, void __user *arg) + } + + /* Check for compatibility reject unknown flags */ +- if (vol_args->flags & ~BTRFS_VOL_ARG_V2_FLAGS_SUPPORTED) +- return -EOPNOTSUPP; ++ if (vol_args->flags & ~BTRFS_VOL_ARG_V2_FLAGS_SUPPORTED) { ++ ret = -EOPNOTSUPP; ++ goto out; ++ } + + if (test_and_set_bit(BTRFS_FS_EXCL_OP, &fs_info->flags)) { + ret = BTRFS_ERROR_DEV_EXCL_RUN_IN_PROGRESS; +@@ -3861,11 +3863,6 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src, + src->i_sb != inode->i_sb) + return -EXDEV; + +- /* don't make the dst file partly checksummed */ +- if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) != +- (BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)) +- return -EINVAL; +- + if (S_ISDIR(src->i_mode) || S_ISDIR(inode->i_mode)) + return -EISDIR; + +@@ -3875,6 +3872,13 @@ static noinline int btrfs_clone_files(struct file *file, struct file *file_src, + inode_lock(src); + } + ++ /* don't make the dst file partly checksummed */ ++ if ((BTRFS_I(src)->flags & BTRFS_INODE_NODATASUM) != ++ (BTRFS_I(inode)->flags & BTRFS_INODE_NODATASUM)) { ++ ret = -EINVAL; ++ goto out_unlock; ++ } ++ + /* determine range to clone */ + ret = -EINVAL; + if (off + len > src->i_size || off + len < off) +diff --git a/fs/btrfs/scrub.c b/fs/btrfs/scrub.c +index 24613b4e224c..936d58ca2b49 100644 +--- a/fs/btrfs/scrub.c ++++ b/fs/btrfs/scrub.c +@@ -2775,7 +2775,7 @@ static int scrub_extent(struct scrub_ctx *sctx, u64 logical, u64 len, + have_csum = scrub_find_csum(sctx, logical, csum); + if (have_csum == 0) + ++sctx->stat.no_csum; +- if (sctx->is_dev_replace && !have_csum) { ++ if (0 && sctx->is_dev_replace && !have_csum) { + ret = copy_nocow_pages(sctx, logical, l, + mirror_num, + physical_for_dev_replace); +diff --git a/fs/cifs/cifsacl.h b/fs/cifs/cifsacl.h +index 4f3884835267..dd95a6fa24bf 100644 +--- a/fs/cifs/cifsacl.h ++++ b/fs/cifs/cifsacl.h +@@ -98,4 +98,18 @@ struct cifs_ace { + struct cifs_sid sid; /* ie UUID of user or group who gets these perms */ + } __attribute__((packed)); + ++/* ++ * Minimum security identifier can be one for system defined Users ++ * and Groups such as NULL SID and World or Built-in accounts such ++ * as Administrator and Guest and consists of ++ * Revision + Num (Sub)Auths + Authority + Domain (one Subauthority) ++ */ ++#define MIN_SID_LEN (1 + 1 + 6 + 4) /* in bytes */ ++ ++/* ++ * Minimum security descriptor can be one without any SACL and DACL and can ++ * consist of revision, type, and two sids of minimum size for owner and group ++ */ ++#define MIN_SEC_DESC_LEN (sizeof(struct cifs_ntsd) + (2 * MIN_SID_LEN)) ++ + #endif /* _CIFSACL_H */ +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 839327f75e3d..36bc9a7eb8ea 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -1256,10 +1256,11 @@ smb2_is_session_expired(char *buf) + { + struct smb2_sync_hdr *shdr = get_sync_hdr(buf); + +- if (shdr->Status != STATUS_NETWORK_SESSION_EXPIRED) ++ if (shdr->Status != STATUS_NETWORK_SESSION_EXPIRED && ++ shdr->Status != STATUS_USER_SESSION_DELETED) + return false; + +- cifs_dbg(FYI, "Session expired\n"); ++ cifs_dbg(FYI, "Session expired or deleted\n"); + return true; + } + +@@ -1571,8 +1572,11 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, + oparms.create_options = 0; + + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); +- if (!utf16_path) +- return ERR_PTR(-ENOMEM); ++ if (!utf16_path) { ++ rc = -ENOMEM; ++ free_xid(xid); ++ return ERR_PTR(rc); ++ } + + oparms.tcon = tcon; + oparms.desired_access = READ_CONTROL; +@@ -1630,8 +1634,11 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, + access_flags = WRITE_DAC; + + utf16_path = cifs_convert_path_to_utf16(path, cifs_sb); +- if (!utf16_path) +- return -ENOMEM; ++ if (!utf16_path) { ++ rc = -ENOMEM; ++ free_xid(xid); ++ return rc; ++ } + + oparms.tcon = tcon; + oparms.desired_access = access_flags; +@@ -1691,15 +1698,21 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, + + /* if file not oplocked can't be sure whether asking to extend size */ + if (!CIFS_CACHE_READ(cifsi)) +- if (keep_size == false) +- return -EOPNOTSUPP; ++ if (keep_size == false) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + /* + * Must check if file sparse since fallocate -z (zero range) assumes + * non-sparse allocation + */ +- if (!(cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE)) +- return -EOPNOTSUPP; ++ if (!(cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE)) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + /* + * need to make sure we are not asked to extend the file since the SMB3 +@@ -1708,8 +1721,11 @@ static long smb3_zero_range(struct file *file, struct cifs_tcon *tcon, + * which for a non sparse file would zero the newly extended range + */ + if (keep_size == false) +- if (i_size_read(inode) < offset + len) +- return -EOPNOTSUPP; ++ if (i_size_read(inode) < offset + len) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + cifs_dbg(FYI, "offset %lld len %lld", offset, len); + +@@ -1743,8 +1759,11 @@ static long smb3_punch_hole(struct file *file, struct cifs_tcon *tcon, + + /* Need to make file sparse, if not already, before freeing range. */ + /* Consider adding equivalent for compressed since it could also work */ +- if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) +- return -EOPNOTSUPP; ++ if (!smb2_set_sparse(xid, tcon, cfile, inode, set_sparse)) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + cifs_dbg(FYI, "offset %lld len %lld", offset, len); + +@@ -1776,8 +1795,10 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, + + /* if file not oplocked can't be sure whether asking to extend size */ + if (!CIFS_CACHE_READ(cifsi)) +- if (keep_size == false) +- return -EOPNOTSUPP; ++ if (keep_size == false) { ++ free_xid(xid); ++ return rc; ++ } + + /* + * Files are non-sparse by default so falloc may be a no-op +@@ -1786,14 +1807,16 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, + */ + if ((cifsi->cifsAttrs & FILE_ATTRIBUTE_SPARSE_FILE) == 0) { + if (keep_size == true) +- return 0; ++ rc = 0; + /* check if extending file */ + else if (i_size_read(inode) >= off + len) + /* not extending file and already not sparse */ +- return 0; ++ rc = 0; + /* BB: in future add else clause to extend file */ + else +- return -EOPNOTSUPP; ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; + } + + if ((keep_size == true) || (i_size_read(inode) >= off + len)) { +@@ -1805,8 +1828,11 @@ static long smb3_simple_falloc(struct file *file, struct cifs_tcon *tcon, + * ie potentially making a few extra pages at the beginning + * or end of the file non-sparse via set_sparse is harmless. + */ +- if ((off > 8192) || (off + len + 8192 < i_size_read(inode))) +- return -EOPNOTSUPP; ++ if ((off > 8192) || (off + len + 8192 < i_size_read(inode))) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + rc = smb2_set_sparse(xid, tcon, cfile, inode, false); + } +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 49779d952cd5..5247b40e57f6 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1182,6 +1182,7 @@ SMB2_sess_setup(const unsigned int xid, struct cifs_ses *ses, + sess_data->ses = ses; + sess_data->buf0_type = CIFS_NO_BUFFER; + sess_data->nls_cp = (struct nls_table *) nls_cp; ++ sess_data->previous_session = ses->Suid; + + while (sess_data->func) + sess_data->func(sess_data); +@@ -2278,8 +2279,7 @@ SMB2_query_acl(const unsigned int xid, struct cifs_tcon *tcon, + + return query_info(xid, tcon, persistent_fid, volatile_fid, + 0, SMB2_O_INFO_SECURITY, additional_info, +- SMB2_MAX_BUFFER_SIZE, +- sizeof(struct smb2_file_all_info), data, plen); ++ SMB2_MAX_BUFFER_SIZE, MIN_SEC_DESC_LEN, data, plen); + } + + int +diff --git a/fs/ext4/indirect.c b/fs/ext4/indirect.c +index c32802c956d5..bf7fa1507e81 100644 +--- a/fs/ext4/indirect.c ++++ b/fs/ext4/indirect.c +@@ -561,10 +561,16 @@ int ext4_ind_map_blocks(handle_t *handle, struct inode *inode, + unsigned epb = inode->i_sb->s_blocksize / sizeof(u32); + int i; + +- /* Count number blocks in a subtree under 'partial' */ +- count = 1; +- for (i = 0; partial + i != chain + depth - 1; i++) +- count *= epb; ++ /* ++ * Count number blocks in a subtree under 'partial'. At each ++ * level we count number of complete empty subtrees beyond ++ * current offset and then descend into the subtree only ++ * partially beyond current offset. ++ */ ++ count = 0; ++ for (i = partial - chain + 1; i < depth; i++) ++ count = count * epb + (epb - offsets[i] - 1); ++ count++; + /* Fill in size of a hole we found */ + map->m_pblk = 0; + map->m_len = min_t(unsigned int, map->m_len, count); +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index fd9501977f1c..8f5dc243effd 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -150,6 +150,12 @@ int ext4_find_inline_data_nolock(struct inode *inode) + goto out; + + if (!is.s.not_found) { ++ if (is.s.here->e_value_inum) { ++ EXT4_ERROR_INODE(inode, "inline data xattr refers " ++ "to an external xattr inode"); ++ error = -EFSCORRUPTED; ++ goto out; ++ } + EXT4_I(inode)->i_inline_off = (u16)((void *)is.s.here - + (void *)ext4_raw_inode(&is.iloc)); + EXT4_I(inode)->i_inline_size = EXT4_MIN_INLINE_DATA_SIZE + +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index 09014c3c4207..bd6453e78992 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -4246,28 +4246,28 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) + EXT4_BLOCK_SIZE_BITS(sb); + stop_block = (offset + length) >> EXT4_BLOCK_SIZE_BITS(sb); + +- /* If there are no blocks to remove, return now */ +- if (first_block >= stop_block) +- goto out_stop; ++ /* If there are blocks to remove, do it */ ++ if (stop_block > first_block) { + +- down_write(&EXT4_I(inode)->i_data_sem); +- ext4_discard_preallocations(inode); ++ down_write(&EXT4_I(inode)->i_data_sem); ++ ext4_discard_preallocations(inode); + +- ret = ext4_es_remove_extent(inode, first_block, +- stop_block - first_block); +- if (ret) { +- up_write(&EXT4_I(inode)->i_data_sem); +- goto out_stop; +- } ++ ret = ext4_es_remove_extent(inode, first_block, ++ stop_block - first_block); ++ if (ret) { ++ up_write(&EXT4_I(inode)->i_data_sem); ++ goto out_stop; ++ } + +- if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) +- ret = ext4_ext_remove_space(inode, first_block, +- stop_block - 1); +- else +- ret = ext4_ind_remove_space(handle, inode, first_block, +- stop_block); ++ if (ext4_test_inode_flag(inode, EXT4_INODE_EXTENTS)) ++ ret = ext4_ext_remove_space(inode, first_block, ++ stop_block - 1); ++ else ++ ret = ext4_ind_remove_space(handle, inode, first_block, ++ stop_block); + +- up_write(&EXT4_I(inode)->i_data_sem); ++ up_write(&EXT4_I(inode)->i_data_sem); ++ } + if (IS_SYNC(inode)) + ext4_handle_sync(handle); + +@@ -4634,19 +4634,21 @@ static blkcnt_t ext4_inode_blocks(struct ext4_inode *raw_inode, + } + } + +-static inline void ext4_iget_extra_inode(struct inode *inode, ++static inline int ext4_iget_extra_inode(struct inode *inode, + struct ext4_inode *raw_inode, + struct ext4_inode_info *ei) + { + __le32 *magic = (void *)raw_inode + + EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize; ++ + if (EXT4_GOOD_OLD_INODE_SIZE + ei->i_extra_isize + sizeof(__le32) <= + EXT4_INODE_SIZE(inode->i_sb) && + *magic == cpu_to_le32(EXT4_XATTR_MAGIC)) { + ext4_set_inode_state(inode, EXT4_STATE_XATTR); +- ext4_find_inline_data_nolock(inode); ++ return ext4_find_inline_data_nolock(inode); + } else + EXT4_I(inode)->i_inline_off = 0; ++ return 0; + } + + int ext4_get_projid(struct inode *inode, kprojid_t *projid) +@@ -4826,7 +4828,9 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) + ei->i_extra_isize = sizeof(struct ext4_inode) - + EXT4_GOOD_OLD_INODE_SIZE; + } else { +- ext4_iget_extra_inode(inode, raw_inode, ei); ++ ret = ext4_iget_extra_inode(inode, raw_inode, ei); ++ if (ret) ++ goto bad_inode; + } + } + +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 1dac59c24792..823c0b82dfeb 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -1905,7 +1905,7 @@ int ext4_resize_fs(struct super_block *sb, ext4_fsblk_t n_blocks_count) + return 0; + + n_group = ext4_get_group_number(sb, n_blocks_count - 1); +- if (n_group > (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) { ++ if (n_group >= (0xFFFFFFFFUL / EXT4_INODES_PER_GROUP(sb))) { + ext4_warning(sb, "resize would cause inodes_count overflow"); + return -EINVAL; + } +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index 1718354e6322..ed1cf24a7831 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -1687,7 +1687,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, + + /* No failures allowed past this point. */ + +- if (!s->not_found && here->e_value_offs) { ++ if (!s->not_found && here->e_value_size && here->e_value_offs) { + /* Remove the old value. */ + void *first_val = s->base + min_offs; + size_t offs = le16_to_cpu(here->e_value_offs); +diff --git a/fs/nfs/nfs4_fs.h b/fs/nfs/nfs4_fs.h +index dcfcf7fd7438..a73144b3cb8c 100644 +--- a/fs/nfs/nfs4_fs.h ++++ b/fs/nfs/nfs4_fs.h +@@ -465,7 +465,7 @@ extern void nfs_increment_open_seqid(int status, struct nfs_seqid *seqid); + extern void nfs_increment_lock_seqid(int status, struct nfs_seqid *seqid); + extern void nfs_release_seqid(struct nfs_seqid *seqid); + extern void nfs_free_seqid(struct nfs_seqid *seqid); +-extern int nfs4_setup_sequence(const struct nfs_client *client, ++extern int nfs4_setup_sequence(struct nfs_client *client, + struct nfs4_sequence_args *args, + struct nfs4_sequence_res *res, + struct rpc_task *task); +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index ae8f43d270d6..8ff98bbe479b 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -96,6 +96,10 @@ static int nfs4_do_setattr(struct inode *inode, struct rpc_cred *cred, + struct nfs_open_context *ctx, struct nfs4_label *ilabel, + struct nfs4_label *olabel); + #ifdef CONFIG_NFS_V4_1 ++static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, ++ struct rpc_cred *cred, ++ struct nfs4_slot *slot, ++ bool is_privileged); + static int nfs41_test_stateid(struct nfs_server *, nfs4_stateid *, + struct rpc_cred *); + static int nfs41_free_stateid(struct nfs_server *, const nfs4_stateid *, +@@ -641,13 +645,14 @@ static int nfs40_sequence_done(struct rpc_task *task, + + #if defined(CONFIG_NFS_V4_1) + +-static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res) ++static void nfs41_release_slot(struct nfs4_slot *slot) + { + struct nfs4_session *session; + struct nfs4_slot_table *tbl; +- struct nfs4_slot *slot = res->sr_slot; + bool send_new_highest_used_slotid = false; + ++ if (!slot) ++ return; + tbl = slot->table; + session = tbl->session; + +@@ -673,13 +678,18 @@ static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res) + send_new_highest_used_slotid = false; + out_unlock: + spin_unlock(&tbl->slot_tbl_lock); +- res->sr_slot = NULL; + if (send_new_highest_used_slotid) + nfs41_notify_server(session->clp); + if (waitqueue_active(&tbl->slot_waitq)) + wake_up_all(&tbl->slot_waitq); + } + ++static void nfs41_sequence_free_slot(struct nfs4_sequence_res *res) ++{ ++ nfs41_release_slot(res->sr_slot); ++ res->sr_slot = NULL; ++} ++ + static int nfs41_sequence_process(struct rpc_task *task, + struct nfs4_sequence_res *res) + { +@@ -707,13 +717,6 @@ static int nfs41_sequence_process(struct rpc_task *task, + /* Check the SEQUENCE operation status */ + switch (res->sr_status) { + case 0: +- /* If previous op on slot was interrupted and we reused +- * the seq# and got a reply from the cache, then retry +- */ +- if (task->tk_status == -EREMOTEIO && interrupted) { +- ++slot->seq_nr; +- goto retry_nowait; +- } + /* Update the slot's sequence and clientid lease timer */ + slot->seq_done = 1; + clp = session->clp; +@@ -747,16 +750,16 @@ static int nfs41_sequence_process(struct rpc_task *task, + * The slot id we used was probably retired. Try again + * using a different slot id. + */ ++ if (slot->seq_nr < slot->table->target_highest_slotid) ++ goto session_recover; + goto retry_nowait; + case -NFS4ERR_SEQ_MISORDERED: + /* + * Was the last operation on this sequence interrupted? + * If so, retry after bumping the sequence number. + */ +- if (interrupted) { +- ++slot->seq_nr; +- goto retry_nowait; +- } ++ if (interrupted) ++ goto retry_new_seq; + /* + * Could this slot have been previously retired? + * If so, then the server may be expecting seq_nr = 1! +@@ -765,10 +768,11 @@ static int nfs41_sequence_process(struct rpc_task *task, + slot->seq_nr = 1; + goto retry_nowait; + } +- break; ++ goto session_recover; + case -NFS4ERR_SEQ_FALSE_RETRY: +- ++slot->seq_nr; +- goto retry_nowait; ++ if (interrupted) ++ goto retry_new_seq; ++ goto session_recover; + default: + /* Just update the slot sequence no. */ + slot->seq_done = 1; +@@ -778,6 +782,11 @@ static int nfs41_sequence_process(struct rpc_task *task, + dprintk("%s: Error %d free the slot \n", __func__, res->sr_status); + out_noaction: + return ret; ++session_recover: ++ nfs4_schedule_session_recovery(session, res->sr_status); ++ goto retry_nowait; ++retry_new_seq: ++ ++slot->seq_nr; + retry_nowait: + if (rpc_restart_call_prepare(task)) { + nfs41_sequence_free_slot(res); +@@ -854,6 +863,17 @@ static const struct rpc_call_ops nfs41_call_sync_ops = { + .rpc_call_done = nfs41_call_sync_done, + }; + ++static void ++nfs4_sequence_process_interrupted(struct nfs_client *client, ++ struct nfs4_slot *slot, struct rpc_cred *cred) ++{ ++ struct rpc_task *task; ++ ++ task = _nfs41_proc_sequence(client, cred, slot, true); ++ if (!IS_ERR(task)) ++ rpc_put_task_async(task); ++} ++ + #else /* !CONFIG_NFS_V4_1 */ + + static int nfs4_sequence_process(struct rpc_task *task, struct nfs4_sequence_res *res) +@@ -874,9 +894,34 @@ int nfs4_sequence_done(struct rpc_task *task, + } + EXPORT_SYMBOL_GPL(nfs4_sequence_done); + ++static void ++nfs4_sequence_process_interrupted(struct nfs_client *client, ++ struct nfs4_slot *slot, struct rpc_cred *cred) ++{ ++ WARN_ON_ONCE(1); ++ slot->interrupted = 0; ++} ++ + #endif /* !CONFIG_NFS_V4_1 */ + +-int nfs4_setup_sequence(const struct nfs_client *client, ++static ++void nfs4_sequence_attach_slot(struct nfs4_sequence_args *args, ++ struct nfs4_sequence_res *res, ++ struct nfs4_slot *slot) ++{ ++ if (!slot) ++ return; ++ slot->privileged = args->sa_privileged ? 1 : 0; ++ args->sa_slot = slot; ++ ++ res->sr_slot = slot; ++ res->sr_timestamp = jiffies; ++ res->sr_status_flags = 0; ++ res->sr_status = 1; ++ ++} ++ ++int nfs4_setup_sequence(struct nfs_client *client, + struct nfs4_sequence_args *args, + struct nfs4_sequence_res *res, + struct rpc_task *task) +@@ -894,29 +939,28 @@ int nfs4_setup_sequence(const struct nfs_client *client, + task->tk_timeout = 0; + } + +- spin_lock(&tbl->slot_tbl_lock); +- /* The state manager will wait until the slot table is empty */ +- if (nfs4_slot_tbl_draining(tbl) && !args->sa_privileged) +- goto out_sleep; ++ for (;;) { ++ spin_lock(&tbl->slot_tbl_lock); ++ /* The state manager will wait until the slot table is empty */ ++ if (nfs4_slot_tbl_draining(tbl) && !args->sa_privileged) ++ goto out_sleep; ++ ++ slot = nfs4_alloc_slot(tbl); ++ if (IS_ERR(slot)) { ++ /* Try again in 1/4 second */ ++ if (slot == ERR_PTR(-ENOMEM)) ++ task->tk_timeout = HZ >> 2; ++ goto out_sleep; ++ } ++ spin_unlock(&tbl->slot_tbl_lock); + +- slot = nfs4_alloc_slot(tbl); +- if (IS_ERR(slot)) { +- /* Try again in 1/4 second */ +- if (slot == ERR_PTR(-ENOMEM)) +- task->tk_timeout = HZ >> 2; +- goto out_sleep; ++ if (likely(!slot->interrupted)) ++ break; ++ nfs4_sequence_process_interrupted(client, ++ slot, task->tk_msg.rpc_cred); + } +- spin_unlock(&tbl->slot_tbl_lock); +- +- slot->privileged = args->sa_privileged ? 1 : 0; +- args->sa_slot = slot; + +- res->sr_slot = slot; +- if (session) { +- res->sr_timestamp = jiffies; +- res->sr_status_flags = 0; +- res->sr_status = 1; +- } ++ nfs4_sequence_attach_slot(args, res, slot); + + trace_nfs4_setup_sequence(session, args); + out_start: +@@ -8151,6 +8195,7 @@ static const struct rpc_call_ops nfs41_sequence_ops = { + + static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, + struct rpc_cred *cred, ++ struct nfs4_slot *slot, + bool is_privileged) + { + struct nfs4_sequence_data *calldata; +@@ -8164,15 +8209,18 @@ static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, + .callback_ops = &nfs41_sequence_ops, + .flags = RPC_TASK_ASYNC | RPC_TASK_TIMEOUT, + }; ++ struct rpc_task *ret; + ++ ret = ERR_PTR(-EIO); + if (!atomic_inc_not_zero(&clp->cl_count)) +- return ERR_PTR(-EIO); ++ goto out_err; ++ ++ ret = ERR_PTR(-ENOMEM); + calldata = kzalloc(sizeof(*calldata), GFP_NOFS); +- if (calldata == NULL) { +- nfs_put_client(clp); +- return ERR_PTR(-ENOMEM); +- } ++ if (calldata == NULL) ++ goto out_put_clp; + nfs4_init_sequence(&calldata->args, &calldata->res, 0); ++ nfs4_sequence_attach_slot(&calldata->args, &calldata->res, slot); + if (is_privileged) + nfs4_set_sequence_privileged(&calldata->args); + msg.rpc_argp = &calldata->args; +@@ -8180,7 +8228,15 @@ static struct rpc_task *_nfs41_proc_sequence(struct nfs_client *clp, + calldata->clp = clp; + task_setup_data.callback_data = calldata; + +- return rpc_run_task(&task_setup_data); ++ ret = rpc_run_task(&task_setup_data); ++ if (IS_ERR(ret)) ++ goto out_err; ++ return ret; ++out_put_clp: ++ nfs_put_client(clp); ++out_err: ++ nfs41_release_slot(slot); ++ return ret; + } + + static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cred, unsigned renew_flags) +@@ -8190,7 +8246,7 @@ static int nfs41_proc_async_sequence(struct nfs_client *clp, struct rpc_cred *cr + + if ((renew_flags & NFS4_RENEW_TIMEOUT) == 0) + return -EAGAIN; +- task = _nfs41_proc_sequence(clp, cred, false); ++ task = _nfs41_proc_sequence(clp, cred, NULL, false); + if (IS_ERR(task)) + ret = PTR_ERR(task); + else +@@ -8204,7 +8260,7 @@ static int nfs4_proc_sequence(struct nfs_client *clp, struct rpc_cred *cred) + struct rpc_task *task; + int ret; + +- task = _nfs41_proc_sequence(clp, cred, true); ++ task = _nfs41_proc_sequence(clp, cred, NULL, true); + if (IS_ERR(task)) { + ret = PTR_ERR(task); + goto out; +diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c +index 28825a5b6d09..902b72dac41a 100644 +--- a/fs/orangefs/inode.c ++++ b/fs/orangefs/inode.c +@@ -269,6 +269,13 @@ int orangefs_getattr(const struct path *path, struct kstat *stat, + else + stat->result_mask = STATX_BASIC_STATS & + ~STATX_SIZE; ++ ++ stat->attributes_mask = STATX_ATTR_IMMUTABLE | ++ STATX_ATTR_APPEND; ++ if (inode->i_flags & S_IMMUTABLE) ++ stat->attributes |= STATX_ATTR_IMMUTABLE; ++ if (inode->i_flags & S_APPEND) ++ stat->attributes |= STATX_ATTR_APPEND; + } + return ret; + } +diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c +index f8f3c73d2664..05b3abbdbc4b 100644 +--- a/fs/orangefs/namei.c ++++ b/fs/orangefs/namei.c +@@ -314,6 +314,13 @@ static int orangefs_symlink(struct inode *dir, + ret = PTR_ERR(inode); + goto out; + } ++ /* ++ * This is necessary because orangefs_inode_getattr will not ++ * re-read symlink size as it is impossible for it to change. ++ * Invalidating the cache does not help. orangefs_new_inode ++ * does not set the correct size (it does not know symname). ++ */ ++ inode->i_size = strlen(symname); + + gossip_debug(GOSSIP_NAME_DEBUG, + "Assigned symlink inode new number of %pU\n", +diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h +index f144216febc6..9397628a1967 100644 +--- a/include/linux/virtio_net.h ++++ b/include/linux/virtio_net.h +@@ -58,7 +58,8 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb, + static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, + struct virtio_net_hdr *hdr, + bool little_endian, +- bool has_data_valid) ++ bool has_data_valid, ++ int vlan_hlen) + { + memset(hdr, 0, sizeof(*hdr)); /* no info leak */ + +@@ -83,12 +84,8 @@ static inline int virtio_net_hdr_from_skb(const struct sk_buff *skb, + + if (skb->ip_summed == CHECKSUM_PARTIAL) { + hdr->flags = VIRTIO_NET_HDR_F_NEEDS_CSUM; +- if (skb_vlan_tag_present(skb)) +- hdr->csum_start = __cpu_to_virtio16(little_endian, +- skb_checksum_start_offset(skb) + VLAN_HLEN); +- else +- hdr->csum_start = __cpu_to_virtio16(little_endian, +- skb_checksum_start_offset(skb)); ++ hdr->csum_start = __cpu_to_virtio16(little_endian, ++ skb_checksum_start_offset(skb) + vlan_hlen); + hdr->csum_offset = __cpu_to_virtio16(little_endian, + skb->csum_offset); + } else if (has_data_valid && +diff --git a/include/net/transp_v6.h b/include/net/transp_v6.h +index c4f5caaf3778..f6a3543e5247 100644 +--- a/include/net/transp_v6.h ++++ b/include/net/transp_v6.h +@@ -45,8 +45,15 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, struct msghdr *msg, + struct flowi6 *fl6, struct ipcm6_cookie *ipc6, + struct sockcm_cookie *sockc); + +-void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, +- __u16 srcp, __u16 destp, int bucket); ++void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, ++ __u16 srcp, __u16 destp, int rqueue, int bucket); ++static inline void ++ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, __u16 srcp, ++ __u16 destp, int bucket) ++{ ++ __ip6_dgram_sock_seq_show(seq, sp, srcp, destp, sk_rmem_alloc_get(sp), ++ bucket); ++} + + #define LOOPBACK4_IPV6 cpu_to_be32(0x7f000006) + +diff --git a/include/net/udp.h b/include/net/udp.h +index 6c759c8594e2..18391015233e 100644 +--- a/include/net/udp.h ++++ b/include/net/udp.h +@@ -244,6 +244,11 @@ static inline __be16 udp_flow_src_port(struct net *net, struct sk_buff *skb, + return htons((((u64) hash * (max - min)) >> 32) + min); + } + ++static inline int udp_rqueue_get(struct sock *sk) ++{ ++ return sk_rmem_alloc_get(sk) - READ_ONCE(udp_sk(sk)->forward_deficit); ++} ++ + /* net/ipv4/udp.c */ + void udp_destruct_sock(struct sock *sk); + void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len); +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index dee049a0ec5b..6774e0369ebe 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -409,6 +409,7 @@ static void wb_exit(struct bdi_writeback *wb) + * protected. + */ + static DEFINE_SPINLOCK(cgwb_lock); ++static struct workqueue_struct *cgwb_release_wq; + + /** + * wb_congested_get_create - get or create a wb_congested +@@ -519,7 +520,7 @@ static void cgwb_release(struct percpu_ref *refcnt) + { + struct bdi_writeback *wb = container_of(refcnt, struct bdi_writeback, + refcnt); +- schedule_work(&wb->release_work); ++ queue_work(cgwb_release_wq, &wb->release_work); + } + + static void cgwb_kill(struct bdi_writeback *wb) +@@ -783,6 +784,21 @@ static void cgwb_bdi_register(struct backing_dev_info *bdi) + spin_unlock_irq(&cgwb_lock); + } + ++static int __init cgwb_init(void) ++{ ++ /* ++ * There can be many concurrent release work items overwhelming ++ * system_wq. Put them in a separate wq and limit concurrency. ++ * There's no point in executing many of these in parallel. ++ */ ++ cgwb_release_wq = alloc_workqueue("cgwb_release", 0, 1); ++ if (!cgwb_release_wq) ++ return -ENOMEM; ++ ++ return 0; ++} ++subsys_initcall(cgwb_init); ++ + #else /* CONFIG_CGROUP_WRITEBACK */ + + static int cgwb_bdi_init(struct backing_dev_info *bdi) +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 1d7693c35424..59ccf455fcbd 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3981,7 +3981,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, + * orientated. + */ + if (!(alloc_flags & ALLOC_CPUSET) || reserve_flags) { +- ac->zonelist = node_zonelist(numa_node_id(), gfp_mask); + ac->preferred_zoneref = first_zones_zonelist(ac->zonelist, + ac->high_zoneidx, ac->nodemask); + } +diff --git a/net/dsa/tag_trailer.c b/net/dsa/tag_trailer.c +index fcc9aa72877d..374d586b4a2c 100644 +--- a/net/dsa/tag_trailer.c ++++ b/net/dsa/tag_trailer.c +@@ -79,7 +79,8 @@ static struct sk_buff *trailer_rcv(struct sk_buff *skb, struct net_device *dev, + if (unlikely(ds->cpu_port_mask & BIT(source_port))) + return NULL; + +- pskb_trim_rcsum(skb, skb->len - 4); ++ if (pskb_trim_rcsum(skb, skb->len - 4)) ++ return NULL; + + skb->dev = ds->ports[source_port].netdev; + +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index cab4b935e474..a95ccdceb797 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1675,6 +1675,10 @@ int tcp_v4_rcv(struct sk_buff *skb) + reqsk_put(req); + goto discard_it; + } ++ if (tcp_checksum_complete(skb)) { ++ reqsk_put(req); ++ goto csum_error; ++ } + if (unlikely(sk->sk_state != TCP_LISTEN)) { + inet_csk_reqsk_queue_drop_and_put(sk, req); + goto lookup; +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index b0ad62bd38f7..5752bf7593dc 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2720,7 +2720,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f, + " %02X %08X:%08X %02X:%08lX %08X %5u %8d %lu %d %pK %d", + bucket, src, srcp, dest, destp, sp->sk_state, + sk_wmem_alloc_get(sp), +- sk_rmem_alloc_get(sp), ++ udp_rqueue_get(sp), + 0, 0L, 0, + from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)), + 0, sock_i_ino(sp), +diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c +index d0390d844ac8..d9ad986c7b2c 100644 +--- a/net/ipv4/udp_diag.c ++++ b/net/ipv4/udp_diag.c +@@ -163,7 +163,7 @@ static int udp_diag_dump_one(struct sk_buff *in_skb, const struct nlmsghdr *nlh, + static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r, + void *info) + { +- r->idiag_rqueue = sk_rmem_alloc_get(sk); ++ r->idiag_rqueue = udp_rqueue_get(sk); + r->idiag_wqueue = sk_wmem_alloc_get(sk); + } + +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 287112da3c06..453dc3726199 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -1026,8 +1026,8 @@ int ip6_datagram_send_ctl(struct net *net, struct sock *sk, + } + EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl); + +-void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, +- __u16 srcp, __u16 destp, int bucket) ++void __ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, ++ __u16 srcp, __u16 destp, int rqueue, int bucket) + { + const struct in6_addr *dest, *src; + +@@ -1043,7 +1043,7 @@ void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp, + dest->s6_addr32[2], dest->s6_addr32[3], destp, + sp->sk_state, + sk_wmem_alloc_get(sp), +- sk_rmem_alloc_get(sp), ++ rqueue, + 0, 0L, 0, + from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)), + 0, +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 375b20d5bbd7..60efd326014b 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1476,9 +1476,6 @@ static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, + const struct in6_addr *daddr, *saddr; + struct rt6_info *rt6 = (struct rt6_info *)dst; + +- if (rt6->rt6i_flags & RTF_LOCAL) +- return; +- + if (dst_metric_locked(dst, RTAX_MTU)) + return; + +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 237cc6187c5a..35e8aef9ceed 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1453,6 +1453,10 @@ static int tcp_v6_rcv(struct sk_buff *skb) + reqsk_put(req); + goto discard_it; + } ++ if (tcp_checksum_complete(skb)) { ++ reqsk_put(req); ++ goto csum_error; ++ } + if (unlikely(sk->sk_state != TCP_LISTEN)) { + inet_csk_reqsk_queue_drop_and_put(sk, req); + goto lookup; +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 0146dcdc5c40..330d5ea8451b 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -1503,7 +1503,8 @@ int udp6_seq_show(struct seq_file *seq, void *v) + struct inet_sock *inet = inet_sk(v); + __u16 srcp = ntohs(inet->inet_sport); + __u16 destp = ntohs(inet->inet_dport); +- ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket); ++ __ip6_dgram_sock_seq_show(seq, v, srcp, destp, ++ udp_rqueue_get(v), bucket); + } + return 0; + } +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 7806e166669a..4fe2e34522d6 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2046,7 +2046,7 @@ static int packet_rcv_vnet(struct msghdr *msg, const struct sk_buff *skb, + return -EINVAL; + *len -= sizeof(vnet_hdr); + +- if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le(), true)) ++ if (virtio_net_hdr_from_skb(skb, &vnet_hdr, vio_le(), true, 0)) + return -EINVAL; + + return memcpy_to_msg(msg, (void *)&vnet_hdr, sizeof(vnet_hdr)); +@@ -2313,7 +2313,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + if (do_vnet) { + if (virtio_net_hdr_from_skb(skb, h.raw + macoff - + sizeof(struct virtio_net_hdr), +- vio_le(), true)) { ++ vio_le(), true, 0)) { + spin_lock(&sk->sk_receive_queue.lock); + goto drop_n_account; + } +diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c +index b5f80e675783..f3ed63aa4111 100644 +--- a/net/sched/act_simple.c ++++ b/net/sched/act_simple.c +@@ -53,22 +53,22 @@ static void tcf_simp_release(struct tc_action *a, int bind) + kfree(d->tcfd_defdata); + } + +-static int alloc_defdata(struct tcf_defact *d, char *defdata) ++static int alloc_defdata(struct tcf_defact *d, const struct nlattr *defdata) + { + d->tcfd_defdata = kzalloc(SIMP_MAX_DATA, GFP_KERNEL); + if (unlikely(!d->tcfd_defdata)) + return -ENOMEM; +- strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); ++ nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); + return 0; + } + +-static void reset_policy(struct tcf_defact *d, char *defdata, ++static void reset_policy(struct tcf_defact *d, const struct nlattr *defdata, + struct tc_defact *p) + { + spin_lock_bh(&d->tcf_lock); + d->tcf_action = p->action; + memset(d->tcfd_defdata, 0, SIMP_MAX_DATA); +- strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); ++ nla_strlcpy(d->tcfd_defdata, defdata, SIMP_MAX_DATA); + spin_unlock_bh(&d->tcf_lock); + } + +@@ -87,7 +87,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla, + struct tcf_defact *d; + bool exists = false; + int ret = 0, err; +- char *defdata; + + if (nla == NULL) + return -EINVAL; +@@ -110,8 +109,6 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla, + return -EINVAL; + } + +- defdata = nla_data(tb[TCA_DEF_DATA]); +- + if (!exists) { + ret = tcf_idr_create(tn, parm->index, est, a, + &act_simp_ops, bind, false); +@@ -119,7 +116,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla, + return ret; + + d = to_defact(*a); +- ret = alloc_defdata(d, defdata); ++ ret = alloc_defdata(d, tb[TCA_DEF_DATA]); + if (ret < 0) { + tcf_idr_release(*a, bind); + return ret; +@@ -133,7 +130,7 @@ static int tcf_simp_init(struct net *net, struct nlattr *nla, + if (!ovr) + return -EEXIST; + +- reset_policy(d, defdata, parm); ++ reset_policy(d, tb[TCA_DEF_DATA], parm); + } + + if (ret == ACT_P_CREATED) +diff --git a/net/socket.c b/net/socket.c +index 43d2f17f5eea..8b2bef6cfe42 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -538,7 +538,10 @@ static int sockfs_setattr(struct dentry *dentry, struct iattr *iattr) + if (!err && (iattr->ia_valid & ATTR_UID)) { + struct socket *sock = SOCKET_I(d_inode(dentry)); + +- sock->sk->sk_uid = iattr->ia_uid; ++ if (sock->sk) ++ sock->sk->sk_uid = iattr->ia_uid; ++ else ++ err = -ENOENT; + } + + return err; +@@ -588,12 +591,16 @@ EXPORT_SYMBOL(sock_alloc); + * an inode not a file. + */ + +-void sock_release(struct socket *sock) ++static void __sock_release(struct socket *sock, struct inode *inode) + { + if (sock->ops) { + struct module *owner = sock->ops->owner; + ++ if (inode) ++ inode_lock(inode); + sock->ops->release(sock); ++ if (inode) ++ inode_unlock(inode); + sock->ops = NULL; + module_put(owner); + } +@@ -608,6 +615,11 @@ void sock_release(struct socket *sock) + } + sock->file = NULL; + } ++ ++void sock_release(struct socket *sock) ++{ ++ __sock_release(sock, NULL); ++} + EXPORT_SYMBOL(sock_release); + + void __sock_tx_timestamp(__u16 tsflags, __u8 *tx_flags) +@@ -1122,7 +1134,7 @@ static int sock_mmap(struct file *file, struct vm_area_struct *vma) + + static int sock_close(struct inode *inode, struct file *filp) + { +- sock_release(SOCKET_I(inode)); ++ __sock_release(SOCKET_I(inode), inode); + return 0; + } + +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 83f886d7c1f8..3c86614462f6 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -211,18 +211,12 @@ static void tls_free_both_sg(struct sock *sk) + } + + static int tls_do_encryption(struct tls_context *tls_ctx, +- struct tls_sw_context *ctx, size_t data_len, +- gfp_t flags) ++ struct tls_sw_context *ctx, ++ struct aead_request *aead_req, ++ size_t data_len) + { +- unsigned int req_size = sizeof(struct aead_request) + +- crypto_aead_reqsize(ctx->aead_send); +- struct aead_request *aead_req; + int rc; + +- aead_req = kzalloc(req_size, flags); +- if (!aead_req) +- return -ENOMEM; +- + ctx->sg_encrypted_data[0].offset += tls_ctx->prepend_size; + ctx->sg_encrypted_data[0].length -= tls_ctx->prepend_size; + +@@ -235,7 +229,6 @@ static int tls_do_encryption(struct tls_context *tls_ctx, + ctx->sg_encrypted_data[0].offset -= tls_ctx->prepend_size; + ctx->sg_encrypted_data[0].length += tls_ctx->prepend_size; + +- kfree(aead_req); + return rc; + } + +@@ -244,8 +237,14 @@ static int tls_push_record(struct sock *sk, int flags, + { + struct tls_context *tls_ctx = tls_get_ctx(sk); + struct tls_sw_context *ctx = tls_sw_ctx(tls_ctx); ++ struct aead_request *req; + int rc; + ++ req = kzalloc(sizeof(struct aead_request) + ++ crypto_aead_reqsize(ctx->aead_send), sk->sk_allocation); ++ if (!req) ++ return -ENOMEM; ++ + sg_mark_end(ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem - 1); + sg_mark_end(ctx->sg_encrypted_data + ctx->sg_encrypted_num_elem - 1); + +@@ -261,15 +260,14 @@ static int tls_push_record(struct sock *sk, int flags, + tls_ctx->pending_open_record_frags = 0; + set_bit(TLS_PENDING_CLOSED_RECORD, &tls_ctx->flags); + +- rc = tls_do_encryption(tls_ctx, ctx, ctx->sg_plaintext_size, +- sk->sk_allocation); ++ rc = tls_do_encryption(tls_ctx, ctx, req, ctx->sg_plaintext_size); + if (rc < 0) { + /* If we are called from write_space and + * we fail, we need to set this SOCK_NOSPACE + * to trigger another write_space in the future. + */ + set_bit(SOCK_NOSPACE, &sk->sk_socket->flags); +- return rc; ++ goto out_req; + } + + free_sg(sk, ctx->sg_plaintext_data, &ctx->sg_plaintext_num_elem, +@@ -284,6 +282,8 @@ static int tls_push_record(struct sock *sk, int flags, + tls_err_abort(sk); + + tls_advance_record_sn(sk, tls_ctx); ++out_req: ++ kfree(req); + return rc; + } + +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index d1eb14842340..a12e594d4e3b 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -748,8 +748,10 @@ int snd_hda_attach_pcm_stream(struct hda_bus *_bus, struct hda_codec *codec, + return err; + strlcpy(pcm->name, cpcm->name, sizeof(pcm->name)); + apcm = kzalloc(sizeof(*apcm), GFP_KERNEL); +- if (apcm == NULL) ++ if (apcm == NULL) { ++ snd_device_free(chip->card, pcm); + return -ENOMEM; ++ } + apcm->chip = chip; + apcm->pcm = pcm; + apcm->codec = codec; +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 5b4dbcec6de8..ba9a7e552183 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -959,12 +959,15 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x807C, "HP EliteBook 820 G3", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x80FD, "HP ProBook 640 G2", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83b3, "HP EliteBook 830 G5", CXT_FIXUP_HP_DOCK), ++ SND_PCI_QUIRK(0x103c, 0x83d3, "HP ProBook 640 G4", CXT_FIXUP_HP_DOCK), + SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), ++ SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), + SND_PCI_QUIRK(0x152d, 0x0833, "OLPC XO-1.5", CXT_FIXUP_OLPC_XO), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Lenovo T400", CXT_PINCFG_LENOVO_TP410), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 6ae061183eff..2a8aa2bc5c30 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6439,7 +6439,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +- SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), + SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), +@@ -6610,6 +6609,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x12, 0x90a60140}, + {0x14, 0x90170110}, + {0x21, 0x02211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY, ++ {0x12, 0x90a60140}, ++ {0x14, 0x90170110}, ++ {0x19, 0x02a11030}, ++ {0x21, 0x02211020}), + SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60140}, + {0x14, 0x90170150}, diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.52-53.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.52-53.patch new file mode 100644 index 000000000000..7067fd2d777a --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.52-53.patch @@ -0,0 +1,7251 @@ +diff --git a/Documentation/ABI/testing/sysfs-class-cxl b/Documentation/ABI/testing/sysfs-class-cxl +index 640f65e79ef1..267920a1874b 100644 +--- a/Documentation/ABI/testing/sysfs-class-cxl ++++ b/Documentation/ABI/testing/sysfs-class-cxl +@@ -69,7 +69,9 @@ Date: September 2014 + Contact: linuxppc-dev@lists.ozlabs.org + Description: read/write + Set the mode for prefaulting in segments into the segment table +- when performing the START_WORK ioctl. Possible values: ++ when performing the START_WORK ioctl. Only applicable when ++ running under hashed page table mmu. ++ Possible values: + none: No prefaulting (default) + work_element_descriptor: Treat the work element + descriptor as an effective address and +diff --git a/Documentation/printk-formats.txt b/Documentation/printk-formats.txt +index 361789df51ec..d1aecf53badb 100644 +--- a/Documentation/printk-formats.txt ++++ b/Documentation/printk-formats.txt +@@ -397,11 +397,10 @@ struct clk + + %pC pll1 + %pCn pll1 +- %pCr 1560000000 + + For printing struct clk structures. ``%pC`` and ``%pCn`` print the name + (Common Clock Framework) or address (legacy clock framework) of the +-structure; ``%pCr`` prints the current clock rate. ++structure. + + Passed by reference. + +diff --git a/Makefile b/Makefile +index e2e4009bbfed..fb66998408f4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 52 ++SUBLEVEL = 53 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/mt7623.dtsi b/arch/arm/boot/dts/mt7623.dtsi +index 36983a7d7cfd..185357323572 100644 +--- a/arch/arm/boot/dts/mt7623.dtsi ++++ b/arch/arm/boot/dts/mt7623.dtsi +@@ -22,11 +22,12 @@ + #include + #include + #include +-#include "skeleton64.dtsi" + + / { + compatible = "mediatek,mt7623"; + interrupt-parent = <&sysirq>; ++ #address-cells = <2>; ++ #size-cells = <2>; + + cpu_opp_table: opp_table { + compatible = "operating-points-v2"; +diff --git a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts +index 7de704575aee..e96c0ca97972 100644 +--- a/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts ++++ b/arch/arm/boot/dts/mt7623n-bananapi-bpi-r2.dts +@@ -100,6 +100,7 @@ + }; + + memory@80000000 { ++ device_type = "memory"; + reg = <0 0x80000000 0 0x40000000>; + }; + }; +diff --git a/arch/arm/boot/dts/mt7623n-rfb.dtsi b/arch/arm/boot/dts/mt7623n-rfb.dtsi +index 256c5fd947bf..43c9d7ca23a0 100644 +--- a/arch/arm/boot/dts/mt7623n-rfb.dtsi ++++ b/arch/arm/boot/dts/mt7623n-rfb.dtsi +@@ -47,6 +47,7 @@ + }; + + memory@80000000 { ++ device_type = "memory"; + reg = <0 0x80000000 0 0x40000000>; + }; + +diff --git a/arch/arm/boot/dts/socfpga.dtsi b/arch/arm/boot/dts/socfpga.dtsi +index 8d9f42a422cb..10d2fa183a9f 100644 +--- a/arch/arm/boot/dts/socfpga.dtsi ++++ b/arch/arm/boot/dts/socfpga.dtsi +@@ -744,13 +744,13 @@ + nand0: nand@ff900000 { + #address-cells = <0x1>; + #size-cells = <0x1>; +- compatible = "denali,denali-nand-dt"; ++ compatible = "altr,socfpga-denali-nand"; + reg = <0xff900000 0x100000>, + <0xffb80000 0x10000>; + reg-names = "nand_data", "denali_reg"; + interrupts = <0x0 0x90 0x4>; + dma-mask = <0xffffffff>; +- clocks = <&nand_clk>; ++ clocks = <&nand_x_clk>; + status = "disabled"; + }; + +diff --git a/arch/arm/boot/dts/socfpga_arria10.dtsi b/arch/arm/boot/dts/socfpga_arria10.dtsi +index bead79e4b2aa..791ca15c799e 100644 +--- a/arch/arm/boot/dts/socfpga_arria10.dtsi ++++ b/arch/arm/boot/dts/socfpga_arria10.dtsi +@@ -593,8 +593,7 @@ + #size-cells = <0>; + reg = <0xffda5000 0x100>; + interrupts = <0 102 4>; +- num-chipselect = <4>; +- bus-num = <0>; ++ num-cs = <4>; + /*32bit_access;*/ + tx-dma-channel = <&pdma 16>; + rx-dma-channel = <&pdma 17>; +@@ -633,7 +632,7 @@ + nand: nand@ffb90000 { + #address-cells = <1>; + #size-cells = <1>; +- compatible = "denali,denali-nand-dt", "altr,socfpga-denali-nand"; ++ compatible = "altr,socfpga-denali-nand"; + reg = <0xffb90000 0x72000>, + <0xffb80000 0x10000>; + reg-names = "nand_data", "denali_reg"; +diff --git a/arch/arm/include/asm/kgdb.h b/arch/arm/include/asm/kgdb.h +index 3b73fdcf3627..8de1100d1067 100644 +--- a/arch/arm/include/asm/kgdb.h ++++ b/arch/arm/include/asm/kgdb.h +@@ -77,7 +77,7 @@ extern int kgdb_fault_expected; + + #define KGDB_MAX_NO_CPUS 1 + #define BUFMAX 400 +-#define NUMREGBYTES (DBG_MAX_REG_NUM << 2) ++#define NUMREGBYTES (GDB_MAX_REGS << 2) + #define NUMCRITREGBYTES (32 << 2) + + #define _R0 0 +diff --git a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +index 64c54c92e214..d71cbf596d1f 100644 +--- a/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts ++++ b/arch/arm64/boot/dts/amlogic/meson-gxl-s905x-libretech-cc.dts +@@ -205,9 +205,6 @@ + + bus-width = <4>; + cap-sd-highspeed; +- sd-uhs-sdr12; +- sd-uhs-sdr25; +- sd-uhs-sdr50; + max-frequency = <100000000>; + disable-wp; + +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 345d4e521191..718822ab6e4b 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -877,7 +877,7 @@ static int __init parse_kpti(char *str) + __kpti_forced = enabled ? 1 : -1; + return 0; + } +-__setup("kpti=", parse_kpti); ++early_param("kpti", parse_kpti); + #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ + + static const struct arm64_cpu_capabilities arm64_features[] = { +diff --git a/arch/arm64/kernel/signal.c b/arch/arm64/kernel/signal.c +index 0bdc96c61bc0..43442b3a463f 100644 +--- a/arch/arm64/kernel/signal.c ++++ b/arch/arm64/kernel/signal.c +@@ -676,11 +676,12 @@ static void do_signal(struct pt_regs *regs) + unsigned long continue_addr = 0, restart_addr = 0; + int retval = 0; + struct ksignal ksig; ++ bool syscall = in_syscall(regs); + + /* + * If we were from a system call, check for system call restarting... + */ +- if (in_syscall(regs)) { ++ if (syscall) { + continue_addr = regs->pc; + restart_addr = continue_addr - (compat_thumb_mode(regs) ? 2 : 4); + retval = regs->regs[0]; +@@ -732,7 +733,7 @@ static void do_signal(struct pt_regs *regs) + * Handle restarting a different system call. As above, if a debugger + * has chosen to restart at a different PC, ignore the restart. + */ +- if (in_syscall(regs) && regs->pc == restart_addr) { ++ if (syscall && regs->pc == restart_addr) { + if (retval == -ERESTART_RESTARTBLOCK) + setup_restart_syscall(regs); + user_rewind_single_step(current); +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index e338165000e6..bf0821b7b1ab 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -196,8 +196,9 @@ ENDPROC(idmap_cpu_replace_ttbr1) + + .macro __idmap_kpti_put_pgtable_ent_ng, type + orr \type, \type, #PTE_NG // Same bit for blocks and pages +- str \type, [cur_\()\type\()p] // Update the entry and ensure it +- dc civac, cur_\()\type\()p // is visible to all CPUs. ++ str \type, [cur_\()\type\()p] // Update the entry and ensure ++ dmb sy // that it is visible to all ++ dc civac, cur_\()\type\()p // CPUs. + .endm + + /* +diff --git a/arch/m68k/mac/config.c b/arch/m68k/mac/config.c +index 22123f7e8f75..2004b3f72d80 100644 +--- a/arch/m68k/mac/config.c ++++ b/arch/m68k/mac/config.c +@@ -1017,7 +1017,7 @@ int __init mac_platform_init(void) + struct resource swim_rsrc = { + .flags = IORESOURCE_MEM, + .start = (resource_size_t)swim_base, +- .end = (resource_size_t)swim_base + 0x2000, ++ .end = (resource_size_t)swim_base + 0x1FFF, + }; + + platform_device_register_simple("swim", -1, &swim_rsrc, 1); +diff --git a/arch/m68k/mm/kmap.c b/arch/m68k/mm/kmap.c +index c2a38321c96d..3b420f6d8822 100644 +--- a/arch/m68k/mm/kmap.c ++++ b/arch/m68k/mm/kmap.c +@@ -89,7 +89,8 @@ static inline void free_io_area(void *addr) + for (p = &iolist ; (tmp = *p) ; p = &tmp->next) { + if (tmp->addr == addr) { + *p = tmp->next; +- __iounmap(tmp->addr, tmp->size); ++ /* remove gap added in get_io_area() */ ++ __iounmap(tmp->addr, tmp->size - IO_SIZE); + kfree(tmp); + return; + } +diff --git a/arch/mips/bcm47xx/setup.c b/arch/mips/bcm47xx/setup.c +index 6054d49e608e..8c9cbf13d32a 100644 +--- a/arch/mips/bcm47xx/setup.c ++++ b/arch/mips/bcm47xx/setup.c +@@ -212,6 +212,12 @@ static int __init bcm47xx_cpu_fixes(void) + */ + if (bcm47xx_bus.bcma.bus.chipinfo.id == BCMA_CHIP_ID_BCM4706) + cpu_wait = NULL; ++ ++ /* ++ * BCM47XX Erratum "R10: PCIe Transactions Periodically Fail" ++ * Enable ExternalSync for sync instruction to take effect ++ */ ++ set_c0_config7(MIPS_CONF7_ES); + break; + #endif + } +diff --git a/arch/mips/include/asm/io.h b/arch/mips/include/asm/io.h +index a7d0b836f2f7..cea8ad864b3f 100644 +--- a/arch/mips/include/asm/io.h ++++ b/arch/mips/include/asm/io.h +@@ -414,6 +414,8 @@ static inline type pfx##in##bwlq##p(unsigned long port) \ + __val = *__addr; \ + slow; \ + \ ++ /* prevent prefetching of coherent DMA data prematurely */ \ ++ rmb(); \ + return pfx##ioswab##bwlq(__addr, __val); \ + } + +diff --git a/arch/mips/include/asm/mipsregs.h b/arch/mips/include/asm/mipsregs.h +index a6810923b3f0..60c787d943b0 100644 +--- a/arch/mips/include/asm/mipsregs.h ++++ b/arch/mips/include/asm/mipsregs.h +@@ -680,6 +680,8 @@ + #define MIPS_CONF7_WII (_ULCAST_(1) << 31) + + #define MIPS_CONF7_RPS (_ULCAST_(1) << 2) ++/* ExternalSync */ ++#define MIPS_CONF7_ES (_ULCAST_(1) << 8) + + #define MIPS_CONF7_IAR (_ULCAST_(1) << 10) + #define MIPS_CONF7_AR (_ULCAST_(1) << 16) +@@ -2745,6 +2747,7 @@ __BUILD_SET_C0(status) + __BUILD_SET_C0(cause) + __BUILD_SET_C0(config) + __BUILD_SET_C0(config5) ++__BUILD_SET_C0(config7) + __BUILD_SET_C0(intcontrol) + __BUILD_SET_C0(intctl) + __BUILD_SET_C0(srsmap) +diff --git a/arch/mips/kernel/mcount.S b/arch/mips/kernel/mcount.S +index f2ee7e1e3342..cff52b283e03 100644 +--- a/arch/mips/kernel/mcount.S ++++ b/arch/mips/kernel/mcount.S +@@ -119,10 +119,20 @@ NESTED(_mcount, PT_SIZE, ra) + EXPORT_SYMBOL(_mcount) + PTR_LA t1, ftrace_stub + PTR_L t2, ftrace_trace_function /* Prepare t2 for (1) */ +- bne t1, t2, static_trace ++ beq t1, t2, fgraph_trace + nop + ++ MCOUNT_SAVE_REGS ++ ++ move a0, ra /* arg1: self return address */ ++ jalr t2 /* (1) call *ftrace_trace_function */ ++ move a1, AT /* arg2: parent's return address */ ++ ++ MCOUNT_RESTORE_REGS ++ ++fgraph_trace: + #ifdef CONFIG_FUNCTION_GRAPH_TRACER ++ PTR_LA t1, ftrace_stub + PTR_L t3, ftrace_graph_return + bne t1, t3, ftrace_graph_caller + nop +@@ -131,24 +141,11 @@ EXPORT_SYMBOL(_mcount) + bne t1, t3, ftrace_graph_caller + nop + #endif +- b ftrace_stub +-#ifdef CONFIG_32BIT +- addiu sp, sp, 8 +-#else +- nop +-#endif + +-static_trace: +- MCOUNT_SAVE_REGS +- +- move a0, ra /* arg1: self return address */ +- jalr t2 /* (1) call *ftrace_trace_function */ +- move a1, AT /* arg2: parent's return address */ +- +- MCOUNT_RESTORE_REGS + #ifdef CONFIG_32BIT + addiu sp, sp, 8 + #endif ++ + .globl ftrace_stub + ftrace_stub: + RETURN_BACK +diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S +index 6f07c687fc05..c194f4c8e66b 100644 +--- a/arch/powerpc/kernel/entry_64.S ++++ b/arch/powerpc/kernel/entry_64.S +@@ -597,6 +597,7 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT) + * actually hit this code path. + */ + ++ isync + slbie r6 + slbie r6 /* Workaround POWER5 < DD2.1 issue */ + slbmte r7,r0 +diff --git a/arch/powerpc/kernel/fadump.c b/arch/powerpc/kernel/fadump.c +index 29d2b6050140..d0020bc1f209 100644 +--- a/arch/powerpc/kernel/fadump.c ++++ b/arch/powerpc/kernel/fadump.c +@@ -1155,6 +1155,9 @@ void fadump_cleanup(void) + init_fadump_mem_struct(&fdm, + be64_to_cpu(fdm_active->cpu_state_data.destination_address)); + fadump_invalidate_dump(&fdm); ++ } else if (fw_dump.dump_registered) { ++ /* Un-register Firmware-assisted dump if it was registered. */ ++ fadump_unregister_dump(&fdm); + } + } + +diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c +index 53b9c1dfd7d9..ceafad83ef50 100644 +--- a/arch/powerpc/kernel/hw_breakpoint.c ++++ b/arch/powerpc/kernel/hw_breakpoint.c +@@ -175,8 +175,8 @@ int arch_validate_hwbkpt_settings(struct perf_event *bp) + if (cpu_has_feature(CPU_FTR_DAWR)) { + length_max = 512 ; /* 64 doublewords */ + /* DAWR region can't cross 512 boundary */ +- if ((bp->attr.bp_addr >> 10) != +- ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 10)) ++ if ((bp->attr.bp_addr >> 9) != ++ ((bp->attr.bp_addr + bp->attr.bp_len - 1) >> 9)) + return -EINVAL; + } + if (info->len > +diff --git a/arch/powerpc/kernel/ptrace.c b/arch/powerpc/kernel/ptrace.c +index f52ad5bb7109..81750d9624ab 100644 +--- a/arch/powerpc/kernel/ptrace.c ++++ b/arch/powerpc/kernel/ptrace.c +@@ -2362,6 +2362,7 @@ static int ptrace_set_debugreg(struct task_struct *task, unsigned long addr, + /* Create a new breakpoint request if one doesn't exist already */ + hw_breakpoint_init(&attr); + attr.bp_addr = hw_brk.address; ++ attr.bp_len = 8; + arch_bp_generic_fields(hw_brk.type, + &attr.bp_type); + +diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c +index da6ba9ba73ed..b73961b95c34 100644 +--- a/arch/powerpc/perf/imc-pmu.c ++++ b/arch/powerpc/perf/imc-pmu.c +@@ -1131,7 +1131,7 @@ static int init_nest_pmu_ref(void) + + static void cleanup_all_core_imc_memory(void) + { +- int i, nr_cores = DIV_ROUND_UP(num_present_cpus(), threads_per_core); ++ int i, nr_cores = DIV_ROUND_UP(num_possible_cpus(), threads_per_core); + struct imc_mem_info *ptr = core_imc_pmu->mem_info; + int size = core_imc_pmu->counter_mem_size; + +@@ -1239,7 +1239,7 @@ static int imc_mem_init(struct imc_pmu *pmu_ptr, struct device_node *parent, + if (!pmu_ptr->pmu.name) + return -ENOMEM; + +- nr_cores = DIV_ROUND_UP(num_present_cpus(), threads_per_core); ++ nr_cores = DIV_ROUND_UP(num_possible_cpus(), threads_per_core); + pmu_ptr->mem_info = kcalloc(nr_cores, sizeof(struct imc_mem_info), + GFP_KERNEL); + +diff --git a/arch/powerpc/platforms/powernv/copy-paste.h b/arch/powerpc/platforms/powernv/copy-paste.h +index c9a503623431..e9a6c35f8a29 100644 +--- a/arch/powerpc/platforms/powernv/copy-paste.h ++++ b/arch/powerpc/platforms/powernv/copy-paste.h +@@ -42,5 +42,6 @@ static inline int vas_paste(void *paste_address, int offset) + : "b" (offset), "b" (paste_address) + : "memory", "cr0"); + +- return (cr >> CR0_SHIFT) & CR0_MASK; ++ /* We mask with 0xE to ignore SO */ ++ return (cr >> CR0_SHIFT) & 0xE; + } +diff --git a/arch/powerpc/platforms/powernv/idle.c b/arch/powerpc/platforms/powernv/idle.c +index 443d5ca71995..028d6d12ba32 100644 +--- a/arch/powerpc/platforms/powernv/idle.c ++++ b/arch/powerpc/platforms/powernv/idle.c +@@ -78,7 +78,7 @@ static int pnv_save_sprs_for_deep_states(void) + uint64_t msr_val = MSR_IDLE; + uint64_t psscr_val = pnv_deepest_stop_psscr_val; + +- for_each_possible_cpu(cpu) { ++ for_each_present_cpu(cpu) { + uint64_t pir = get_hard_smp_processor_id(cpu); + uint64_t hsprg0_val = (uint64_t)&paca[cpu]; + +@@ -741,7 +741,7 @@ static int __init pnv_init_idle_states(void) + int cpu; + + pr_info("powernv: idle: Saving PACA pointers of all CPUs in their thread sibling PACA\n"); +- for_each_possible_cpu(cpu) { ++ for_each_present_cpu(cpu) { + int base_cpu = cpu_first_thread_sibling(cpu); + int idx = cpu_thread_in_core(cpu); + int i; +diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c +index 57f9e55f4352..677b29ef4532 100644 +--- a/arch/powerpc/platforms/powernv/pci-ioda.c ++++ b/arch/powerpc/platforms/powernv/pci-ioda.c +@@ -3591,7 +3591,6 @@ static void pnv_pci_ioda2_release_pe_dma(struct pnv_ioda_pe *pe) + WARN_ON(pe->table_group.group); + } + +- pnv_pci_ioda2_table_free_pages(tbl); + iommu_tce_table_put(tbl); + } + +diff --git a/arch/x86/events/intel/uncore_snbep.c b/arch/x86/events/intel/uncore_snbep.c +index 8243fdbb9b9c..2dae3f585c01 100644 +--- a/arch/x86/events/intel/uncore_snbep.c ++++ b/arch/x86/events/intel/uncore_snbep.c +@@ -3035,11 +3035,19 @@ static struct intel_uncore_type *bdx_msr_uncores[] = { + NULL, + }; + ++/* Bit 7 'Use Occupancy' is not available for counter 0 on BDX */ ++static struct event_constraint bdx_uncore_pcu_constraints[] = { ++ EVENT_CONSTRAINT(0x80, 0xe, 0x80), ++ EVENT_CONSTRAINT_END ++}; ++ + void bdx_uncore_cpu_init(void) + { + if (bdx_uncore_cbox.num_boxes > boot_cpu_data.x86_max_cores) + bdx_uncore_cbox.num_boxes = boot_cpu_data.x86_max_cores; + uncore_msr_uncores = bdx_msr_uncores; ++ ++ hswep_uncore_pcu.constraints = bdx_uncore_pcu_constraints; + } + + static struct intel_uncore_type bdx_uncore_ha = { +diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h +index 4db77731e130..a04f0c242a28 100644 +--- a/arch/x86/include/asm/barrier.h ++++ b/arch/x86/include/asm/barrier.h +@@ -38,7 +38,7 @@ static inline unsigned long array_index_mask_nospec(unsigned long index, + { + unsigned long mask; + +- asm ("cmp %1,%2; sbb %0,%0;" ++ asm volatile ("cmp %1,%2; sbb %0,%0;" + :"=r" (mask) + :"g"(size),"r" (index) + :"cc"); +diff --git a/arch/x86/kernel/cpu/mcheck/mce-severity.c b/arch/x86/kernel/cpu/mcheck/mce-severity.c +index 4b8187639c2d..c51353569492 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce-severity.c ++++ b/arch/x86/kernel/cpu/mcheck/mce-severity.c +@@ -143,6 +143,11 @@ static struct severity { + SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_INSTR), + USER + ), ++ MCESEV( ++ PANIC, "Data load in unrecoverable area of kernel", ++ SER, MASK(MCI_STATUS_OVER|MCI_UC_SAR|MCI_ADDR|MCACOD, MCI_UC_SAR|MCI_ADDR|MCACOD_DATA), ++ KERNEL ++ ), + #endif + MCESEV( + PANIC, "Action required: unknown MCACOD", +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 28d27de08545..58f887f5e036 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -760,23 +760,25 @@ EXPORT_SYMBOL_GPL(machine_check_poll); + static int mce_no_way_out(struct mce *m, char **msg, unsigned long *validp, + struct pt_regs *regs) + { +- int i, ret = 0; + char *tmp; ++ int i; + + for (i = 0; i < mca_cfg.banks; i++) { + m->status = mce_rdmsrl(msr_ops.status(i)); +- if (m->status & MCI_STATUS_VAL) { +- __set_bit(i, validp); +- if (quirk_no_way_out) +- quirk_no_way_out(i, m, regs); +- } ++ if (!(m->status & MCI_STATUS_VAL)) ++ continue; ++ ++ __set_bit(i, validp); ++ if (quirk_no_way_out) ++ quirk_no_way_out(i, m, regs); + + if (mce_severity(m, mca_cfg.tolerant, &tmp, true) >= MCE_PANIC_SEVERITY) { ++ mce_read_aux(m, i); + *msg = tmp; +- ret = 1; ++ return 1; + } + } +- return ret; ++ return 0; + } + + /* +@@ -1205,13 +1207,18 @@ void do_machine_check(struct pt_regs *regs, long error_code) + lmce = m.mcgstatus & MCG_STATUS_LMCES; + + /* ++ * Local machine check may already know that we have to panic. ++ * Broadcast machine check begins rendezvous in mce_start() + * Go through all banks in exclusion of the other CPUs. This way we + * don't report duplicated events on shared banks because the first one +- * to see it will clear it. If this is a Local MCE, then no need to +- * perform rendezvous. ++ * to see it will clear it. + */ +- if (!lmce) ++ if (lmce) { ++ if (no_way_out) ++ mce_panic("Fatal local machine check", &m, msg); ++ } else { + order = mce_start(&no_way_out); ++ } + + for (i = 0; i < cfg->banks; i++) { + __clear_bit(i, toclear); +@@ -1287,12 +1294,17 @@ void do_machine_check(struct pt_regs *regs, long error_code) + no_way_out = worst >= MCE_PANIC_SEVERITY; + } else { + /* +- * Local MCE skipped calling mce_reign() +- * If we found a fatal error, we need to panic here. ++ * If there was a fatal machine check we should have ++ * already called mce_panic earlier in this function. ++ * Since we re-read the banks, we might have found ++ * something new. Check again to see if we found a ++ * fatal error. We call "mce_severity()" again to ++ * make sure we have the right "msg". + */ +- if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3) +- mce_panic("Machine check from unknown source", +- NULL, NULL); ++ if (worst >= MCE_PANIC_SEVERITY && mca_cfg.tolerant < 3) { ++ mce_severity(&m, cfg->tolerant, &msg, true); ++ mce_panic("Local fatal machine check!", &m, msg); ++ } + } + + /* +diff --git a/arch/x86/kernel/quirks.c b/arch/x86/kernel/quirks.c +index 697a4ce04308..736348ead421 100644 +--- a/arch/x86/kernel/quirks.c ++++ b/arch/x86/kernel/quirks.c +@@ -645,12 +645,19 @@ static void quirk_intel_brickland_xeon_ras_cap(struct pci_dev *pdev) + /* Skylake */ + static void quirk_intel_purley_xeon_ras_cap(struct pci_dev *pdev) + { +- u32 capid0; ++ u32 capid0, capid5; + + pci_read_config_dword(pdev, 0x84, &capid0); ++ pci_read_config_dword(pdev, 0x98, &capid5); + +- if ((capid0 & 0xc0) == 0xc0) ++ /* ++ * CAPID0{7:6} indicate whether this is an advanced RAS SKU ++ * CAPID5{8:5} indicate that various NVDIMM usage modes are ++ * enabled, so memory machine check recovery is also enabled. ++ */ ++ if ((capid0 & 0xc0) == 0xc0 || (capid5 & 0x1e0)) + static_branch_inc(&mcsafe_key); ++ + } + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x0ec3, quirk_intel_brickland_xeon_ras_cap); + DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_INTEL, 0x2fc0, quirk_intel_brickland_xeon_ras_cap); +diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c +index ef4efb931efa..ed8d78fd4f8c 100644 +--- a/arch/x86/kernel/traps.c ++++ b/arch/x86/kernel/traps.c +@@ -828,16 +828,18 @@ static void math_error(struct pt_regs *regs, int error_code, int trapnr) + char *str = (trapnr == X86_TRAP_MF) ? "fpu exception" : + "simd exception"; + +- if (notify_die(DIE_TRAP, str, regs, error_code, trapnr, SIGFPE) == NOTIFY_STOP) +- return; + cond_local_irq_enable(regs); + + if (!user_mode(regs)) { +- if (!fixup_exception(regs, trapnr)) { +- task->thread.error_code = error_code; +- task->thread.trap_nr = trapnr; ++ if (fixup_exception(regs, trapnr)) ++ return; ++ ++ task->thread.error_code = error_code; ++ task->thread.trap_nr = trapnr; ++ ++ if (notify_die(DIE_TRAP, str, regs, error_code, ++ trapnr, SIGFPE) != NOTIFY_STOP) + die(str, regs, error_code); +- } + return; + } + +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 82f5252c723a..071cbbbb60d9 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -706,7 +706,9 @@ void __init init_mem_mapping(void) + */ + int devmem_is_allowed(unsigned long pagenr) + { +- if (page_is_ram(pagenr)) { ++ if (region_intersects(PFN_PHYS(pagenr), PAGE_SIZE, ++ IORESOURCE_SYSTEM_RAM, IORES_DESC_NONE) ++ != REGION_DISJOINT) { + /* + * For disallowed memory regions in the low 1MB range, + * request that the page be shown as all zeros. +diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c +index f7af598c4f55..ae369c2bbc3e 100644 +--- a/arch/x86/platform/efi/efi_64.c ++++ b/arch/x86/platform/efi/efi_64.c +@@ -166,14 +166,14 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd) + pgd = pgd_offset_k(pgd_idx * PGDIR_SIZE); + set_pgd(pgd_offset_k(pgd_idx * PGDIR_SIZE), save_pgd[pgd_idx]); + +- if (!(pgd_val(*pgd) & _PAGE_PRESENT)) ++ if (!pgd_present(*pgd)) + continue; + + for (i = 0; i < PTRS_PER_P4D; i++) { + p4d = p4d_offset(pgd, + pgd_idx * PGDIR_SIZE + i * P4D_SIZE); + +- if (!(p4d_val(*p4d) & _PAGE_PRESENT)) ++ if (!p4d_present(*p4d)) + continue; + + pud = (pud_t *)p4d_page_vaddr(*p4d); +diff --git a/arch/x86/xen/smp_pv.c b/arch/x86/xen/smp_pv.c +index c0c756c76afe..db6d90e451de 100644 +--- a/arch/x86/xen/smp_pv.c ++++ b/arch/x86/xen/smp_pv.c +@@ -32,6 +32,7 @@ + #include + #include + ++#include + #include + #include + +@@ -70,6 +71,8 @@ static void cpu_bringup(void) + cpu_data(cpu).x86_max_cores = 1; + set_cpu_sibling_map(cpu); + ++ speculative_store_bypass_ht_init(); ++ + xen_setup_cpu_clockevents(); + + notify_cpu_starting(cpu); +@@ -250,6 +253,8 @@ static void __init xen_pv_smp_prepare_cpus(unsigned int max_cpus) + } + set_cpu_sibling_map(0); + ++ speculative_store_bypass_ht_init(); ++ + xen_pmu_init(0); + + if (xen_smp_intr_init(0) || xen_smp_intr_init_pv(0)) +diff --git a/arch/xtensa/kernel/traps.c b/arch/xtensa/kernel/traps.c +index bae697a06a98..2986bc88a18e 100644 +--- a/arch/xtensa/kernel/traps.c ++++ b/arch/xtensa/kernel/traps.c +@@ -336,7 +336,7 @@ do_unaligned_user (struct pt_regs *regs) + info.si_errno = 0; + info.si_code = BUS_ADRALN; + info.si_addr = (void *) regs->excvaddr; +- force_sig_info(SIGSEGV, &info, current); ++ force_sig_info(SIGBUS, &info, current); + + } + #endif +diff --git a/block/blk-core.c b/block/blk-core.c +index 1feeb1a8aad9..6f6e21821d2d 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -3150,6 +3150,10 @@ static void __blk_rq_prep_clone(struct request *dst, struct request *src) + dst->cpu = src->cpu; + dst->__sector = blk_rq_pos(src); + dst->__data_len = blk_rq_bytes(src); ++ if (src->rq_flags & RQF_SPECIAL_PAYLOAD) { ++ dst->rq_flags |= RQF_SPECIAL_PAYLOAD; ++ dst->special_vec = src->special_vec; ++ } + dst->nr_phys_segments = src->nr_phys_segments; + dst->ioprio = src->ioprio; + dst->extra_len = src->extra_len; +diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c +index ce2df8c9c583..7e6a43ffdcbe 100644 +--- a/crypto/asymmetric_keys/x509_cert_parser.c ++++ b/crypto/asymmetric_keys/x509_cert_parser.c +@@ -249,6 +249,15 @@ int x509_note_signature(void *context, size_t hdrlen, + return -EINVAL; + } + ++ if (strcmp(ctx->cert->sig->pkey_algo, "rsa") == 0) { ++ /* Discard the BIT STRING metadata */ ++ if (vlen < 1 || *(const u8 *)value != 0) ++ return -EBADMSG; ++ ++ value++; ++ vlen--; ++ } ++ + ctx->cert->raw_sig = value; + ctx->cert->raw_sig_size = vlen; + return 0; +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index a2be3fd2c72b..602ae58ee2d8 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -229,11 +229,13 @@ static const struct lpss_device_desc lpt_sdio_dev_desc = { + + static const struct lpss_device_desc byt_pwm_dev_desc = { + .flags = LPSS_SAVE_CTX, ++ .prv_offset = 0x800, + .setup = byt_pwm_setup, + }; + + static const struct lpss_device_desc bsw_pwm_dev_desc = { + .flags = LPSS_SAVE_CTX | LPSS_NO_D3_DELAY, ++ .prv_offset = 0x800, + .setup = bsw_pwm_setup, + }; + +diff --git a/drivers/auxdisplay/Kconfig b/drivers/auxdisplay/Kconfig +index 2c2ed9cf8796..f9413755177b 100644 +--- a/drivers/auxdisplay/Kconfig ++++ b/drivers/auxdisplay/Kconfig +@@ -14,9 +14,6 @@ menuconfig AUXDISPLAY + + If you say N, all options in this submenu will be skipped and disabled. + +-config CHARLCD +- tristate "Character LCD core support" if COMPILE_TEST +- + if AUXDISPLAY + + config HD44780 +@@ -157,8 +154,6 @@ config HT16K33 + Say yes here to add support for Holtek HT16K33, RAM mapping 16*8 + LED controller driver with keyscan. + +-endif # AUXDISPLAY +- + config ARM_CHARLCD + bool "ARM Ltd. Character LCD Driver" + depends on PLAT_VERSATILE +@@ -169,6 +164,8 @@ config ARM_CHARLCD + line and the Linux version on the second line, but that's + still useful. + ++endif # AUXDISPLAY ++ + config PANEL + tristate "Parallel port LCD/Keypad Panel support" + depends on PARPORT +@@ -448,3 +445,6 @@ config PANEL_BOOT_MESSAGE + printf()-formatted message is valid with newline and escape codes. + + endif # PANEL ++ ++config CHARLCD ++ tristate "Character LCD core support" if COMPILE_TEST +diff --git a/drivers/base/core.c b/drivers/base/core.c +index a359934ffd85..b054cb2fd2b9 100644 +--- a/drivers/base/core.c ++++ b/drivers/base/core.c +@@ -217,6 +217,13 @@ struct device_link *device_link_add(struct device *consumer, + link->rpm_active = true; + } + pm_runtime_new_link(consumer); ++ /* ++ * If the link is being added by the consumer driver at probe ++ * time, balance the decrementation of the supplier's runtime PM ++ * usage counter after consumer probe in driver_probe_device(). ++ */ ++ if (consumer->links.status == DL_DEV_PROBING) ++ pm_runtime_get_noresume(supplier); + } + get_device(supplier); + link->supplier = supplier; +@@ -235,12 +242,12 @@ struct device_link *device_link_add(struct device *consumer, + switch (consumer->links.status) { + case DL_DEV_PROBING: + /* +- * Balance the decrementation of the supplier's +- * runtime PM usage counter after consumer probe +- * in driver_probe_device(). ++ * Some callers expect the link creation during ++ * consumer driver probe to resume the supplier ++ * even without DL_FLAG_RPM_ACTIVE. + */ + if (flags & DL_FLAG_PM_RUNTIME) +- pm_runtime_get_sync(supplier); ++ pm_runtime_resume(supplier); + + link->status = DL_STATE_CONSUMER_PROBE; + break; +diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c +index b3b78079aa9f..c276ba1c0a19 100644 +--- a/drivers/base/power/domain.c ++++ b/drivers/base/power/domain.c +@@ -2162,6 +2162,9 @@ int genpd_dev_pm_attach(struct device *dev) + genpd_lock(pd); + ret = genpd_power_on(pd, 0); + genpd_unlock(pd); ++ ++ if (ret) ++ genpd_remove_device(pd, dev); + out: + return ret ? -EPROBE_DEFER : 0; + } +diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c +index 0459b1204694..d4862775b9f6 100644 +--- a/drivers/base/power/opp/core.c ++++ b/drivers/base/power/opp/core.c +@@ -552,7 +552,7 @@ static int _generic_set_opp_regulator(const struct opp_table *opp_table, + } + + /* Scaling up? Scale voltage before frequency */ +- if (freq > old_freq) { ++ if (freq >= old_freq) { + ret = _set_opp_voltage(dev, reg, new_supply); + if (ret) + goto restore_voltage; +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c +index fe4fd8aee19f..9057dad2a64c 100644 +--- a/drivers/block/rbd.c ++++ b/drivers/block/rbd.c +@@ -3841,7 +3841,6 @@ static void cancel_tasks_sync(struct rbd_device *rbd_dev) + { + dout("%s rbd_dev %p\n", __func__, rbd_dev); + +- cancel_delayed_work_sync(&rbd_dev->watch_dwork); + cancel_work_sync(&rbd_dev->acquired_lock_work); + cancel_work_sync(&rbd_dev->released_lock_work); + cancel_delayed_work_sync(&rbd_dev->lock_dwork); +@@ -3859,6 +3858,7 @@ static void rbd_unregister_watch(struct rbd_device *rbd_dev) + rbd_dev->watch_state = RBD_WATCH_STATE_UNREGISTERED; + mutex_unlock(&rbd_dev->watch_mutex); + ++ cancel_delayed_work_sync(&rbd_dev->watch_dwork); + ceph_osdc_flush_notifies(&rbd_dev->rbd_client->client->osdc); + } + +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index c9f0ac083a3e..6f4ebd5e54c8 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -936,6 +936,12 @@ static int qca_setup(struct hci_uart *hu) + } else if (ret == -ENOENT) { + /* No patch/nvm-config found, run with original fw/config */ + ret = 0; ++ } else if (ret == -EAGAIN) { ++ /* ++ * Userspace firmware loader will return -EAGAIN in case no ++ * patch/nvm-config is found, so run with original fw/config. ++ */ ++ ret = 0; + } + + /* Setup bdaddr */ +diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c +index feafdab734ae..4835b588b783 100644 +--- a/drivers/char/ipmi/ipmi_bt_sm.c ++++ b/drivers/char/ipmi/ipmi_bt_sm.c +@@ -522,11 +522,12 @@ static enum si_sm_result bt_event(struct si_sm_data *bt, long time) + if (status & BT_H_BUSY) /* clear a leftover H_BUSY */ + BT_CONTROL(BT_H_BUSY); + ++ bt->timeout = bt->BT_CAP_req2rsp; ++ + /* Read BT capabilities if it hasn't been done yet */ + if (!bt->BT_CAP_outreqs) + BT_STATE_CHANGE(BT_STATE_CAPABILITIES_BEGIN, + SI_SM_CALL_WITHOUT_DELAY); +- bt->timeout = bt->BT_CAP_req2rsp; + BT_SI_SM_RETURN(SI_SM_IDLE); + + case BT_STATE_XACTION_START: +diff --git a/drivers/char/tpm/tpm-dev-common.c b/drivers/char/tpm/tpm-dev-common.c +index 461bf0b8a094..98cf36fb068d 100644 +--- a/drivers/char/tpm/tpm-dev-common.c ++++ b/drivers/char/tpm/tpm-dev-common.c +@@ -37,7 +37,7 @@ static void timeout_work(struct work_struct *work) + struct file_priv *priv = container_of(work, struct file_priv, work); + + mutex_lock(&priv->buffer_mutex); +- atomic_set(&priv->data_pending, 0); ++ priv->data_pending = 0; + memset(priv->data_buffer, 0, sizeof(priv->data_buffer)); + mutex_unlock(&priv->buffer_mutex); + } +@@ -46,7 +46,6 @@ void tpm_common_open(struct file *file, struct tpm_chip *chip, + struct file_priv *priv) + { + priv->chip = chip; +- atomic_set(&priv->data_pending, 0); + mutex_init(&priv->buffer_mutex); + setup_timer(&priv->user_read_timer, user_reader_timeout, + (unsigned long)priv); +@@ -59,29 +58,24 @@ ssize_t tpm_common_read(struct file *file, char __user *buf, + size_t size, loff_t *off) + { + struct file_priv *priv = file->private_data; +- ssize_t ret_size; +- ssize_t orig_ret_size; ++ ssize_t ret_size = 0; + int rc; + + del_singleshot_timer_sync(&priv->user_read_timer); + flush_work(&priv->work); +- ret_size = atomic_read(&priv->data_pending); +- if (ret_size > 0) { /* relay data */ +- orig_ret_size = ret_size; +- if (size < ret_size) +- ret_size = size; ++ mutex_lock(&priv->buffer_mutex); + +- mutex_lock(&priv->buffer_mutex); ++ if (priv->data_pending) { ++ ret_size = min_t(ssize_t, size, priv->data_pending); + rc = copy_to_user(buf, priv->data_buffer, ret_size); +- memset(priv->data_buffer, 0, orig_ret_size); ++ memset(priv->data_buffer, 0, priv->data_pending); + if (rc) + ret_size = -EFAULT; + +- mutex_unlock(&priv->buffer_mutex); ++ priv->data_pending = 0; + } + +- atomic_set(&priv->data_pending, 0); +- ++ mutex_unlock(&priv->buffer_mutex); + return ret_size; + } + +@@ -92,17 +86,19 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf, + size_t in_size = size; + ssize_t out_size; + ++ if (in_size > TPM_BUFSIZE) ++ return -E2BIG; ++ ++ mutex_lock(&priv->buffer_mutex); ++ + /* Cannot perform a write until the read has cleared either via + * tpm_read or a user_read_timer timeout. This also prevents split + * buffered writes from blocking here. + */ +- if (atomic_read(&priv->data_pending) != 0) ++ if (priv->data_pending != 0) { ++ mutex_unlock(&priv->buffer_mutex); + return -EBUSY; +- +- if (in_size > TPM_BUFSIZE) +- return -E2BIG; +- +- mutex_lock(&priv->buffer_mutex); ++ } + + if (copy_from_user + (priv->data_buffer, (void __user *) buf, in_size)) { +@@ -133,7 +129,7 @@ ssize_t tpm_common_write(struct file *file, const char __user *buf, + return out_size; + } + +- atomic_set(&priv->data_pending, out_size); ++ priv->data_pending = out_size; + mutex_unlock(&priv->buffer_mutex); + + /* Set a timeout by which the reader must come claim the result */ +@@ -150,5 +146,5 @@ void tpm_common_release(struct file *file, struct file_priv *priv) + del_singleshot_timer_sync(&priv->user_read_timer); + flush_work(&priv->work); + file->private_data = NULL; +- atomic_set(&priv->data_pending, 0); ++ priv->data_pending = 0; + } +diff --git a/drivers/char/tpm/tpm-dev.h b/drivers/char/tpm/tpm-dev.h +index ba3b6f9dacf7..b24cfb4d3ee1 100644 +--- a/drivers/char/tpm/tpm-dev.h ++++ b/drivers/char/tpm/tpm-dev.h +@@ -8,7 +8,7 @@ struct file_priv { + struct tpm_chip *chip; + + /* Data passed to and from the tpm via the read/write calls */ +- atomic_t data_pending; ++ size_t data_pending; + struct mutex buffer_mutex; + + struct timer_list user_read_timer; /* user needs to claim result */ +diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c +index e2e059d8ffec..d26ea7513226 100644 +--- a/drivers/char/tpm/tpm2-space.c ++++ b/drivers/char/tpm/tpm2-space.c +@@ -102,8 +102,9 @@ static int tpm2_load_context(struct tpm_chip *chip, u8 *buf, + * TPM_RC_REFERENCE_H0 means the session has been + * flushed outside the space + */ +- rc = -ENOENT; ++ *handle = 0; + tpm_buf_destroy(&tbuf); ++ return -ENOENT; + } else if (rc > 0) { + dev_warn(&chip->dev, "%s: failed with a TPM error 0x%04X\n", + __func__, rc); +diff --git a/drivers/clk/at91/clk-pll.c b/drivers/clk/at91/clk-pll.c +index 7d3223fc7161..72b6091eb7b9 100644 +--- a/drivers/clk/at91/clk-pll.c ++++ b/drivers/clk/at91/clk-pll.c +@@ -132,19 +132,8 @@ static unsigned long clk_pll_recalc_rate(struct clk_hw *hw, + unsigned long parent_rate) + { + struct clk_pll *pll = to_clk_pll(hw); +- unsigned int pllr; +- u16 mul; +- u8 div; +- +- regmap_read(pll->regmap, PLL_REG(pll->id), &pllr); +- +- div = PLL_DIV(pllr); +- mul = PLL_MUL(pllr, pll->layout); +- +- if (!div || !mul) +- return 0; + +- return (parent_rate / div) * (mul + 1); ++ return (parent_rate / pll->div) * (pll->mul + 1); + } + + static long clk_pll_get_best_div_mul(struct clk_pll *pll, unsigned long rate, +diff --git a/drivers/clk/renesas/renesas-cpg-mssr.c b/drivers/clk/renesas/renesas-cpg-mssr.c +index e580a5e6346c..30c23b882675 100644 +--- a/drivers/clk/renesas/renesas-cpg-mssr.c ++++ b/drivers/clk/renesas/renesas-cpg-mssr.c +@@ -248,8 +248,9 @@ struct clk *cpg_mssr_clk_src_twocell_get(struct of_phandle_args *clkspec, + dev_err(dev, "Cannot get %s clock %u: %ld", type, clkidx, + PTR_ERR(clk)); + else +- dev_dbg(dev, "clock (%u, %u) is %pC at %pCr Hz\n", +- clkspec->args[0], clkspec->args[1], clk, clk); ++ dev_dbg(dev, "clock (%u, %u) is %pC at %lu Hz\n", ++ clkspec->args[0], clkspec->args[1], clk, ++ clk_get_rate(clk)); + return clk; + } + +@@ -314,7 +315,7 @@ static void __init cpg_mssr_register_core_clk(const struct cpg_core_clk *core, + if (IS_ERR_OR_NULL(clk)) + goto fail; + +- dev_dbg(dev, "Core clock %pC at %pCr Hz\n", clk, clk); ++ dev_dbg(dev, "Core clock %pC at %lu Hz\n", clk, clk_get_rate(clk)); + priv->clks[id] = clk; + return; + +@@ -380,7 +381,7 @@ static void __init cpg_mssr_register_mod_clk(const struct mssr_mod_clk *mod, + if (IS_ERR(clk)) + goto fail; + +- dev_dbg(dev, "Module clock %pC at %pCr Hz\n", clk, clk); ++ dev_dbg(dev, "Module clock %pC at %lu Hz\n", clk, clk_get_rate(clk)); + priv->clks[id] = clk; + return; + +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index 20226d4243f2..a905bbb45667 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -285,6 +285,7 @@ struct pstate_funcs { + static struct pstate_funcs pstate_funcs __read_mostly; + + static int hwp_active __read_mostly; ++static int hwp_mode_bdw __read_mostly; + static bool per_cpu_limits __read_mostly; + + static struct cpufreq_driver *intel_pstate_driver __read_mostly; +@@ -1371,7 +1372,15 @@ static void intel_pstate_get_cpu_pstates(struct cpudata *cpu) + cpu->pstate.turbo_pstate = pstate_funcs.get_turbo(); + cpu->pstate.scaling = pstate_funcs.get_scaling(); + cpu->pstate.max_freq = cpu->pstate.max_pstate * cpu->pstate.scaling; +- cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling; ++ ++ if (hwp_active && !hwp_mode_bdw) { ++ unsigned int phy_max, current_max; ++ ++ intel_pstate_get_hwp_max(cpu->cpu, &phy_max, ¤t_max); ++ cpu->pstate.turbo_freq = phy_max * cpu->pstate.scaling; ++ } else { ++ cpu->pstate.turbo_freq = cpu->pstate.turbo_pstate * cpu->pstate.scaling; ++ } + + if (pstate_funcs.get_aperf_mperf_shift) + cpu->aperf_mperf_shift = pstate_funcs.get_aperf_mperf_shift(); +@@ -2261,28 +2270,36 @@ static inline bool intel_pstate_has_acpi_ppc(void) { return false; } + static inline void intel_pstate_request_control_from_smm(void) {} + #endif /* CONFIG_ACPI */ + ++#define INTEL_PSTATE_HWP_BROADWELL 0x01 ++ ++#define ICPU_HWP(model, hwp_mode) \ ++ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_HWP, hwp_mode } ++ + static const struct x86_cpu_id hwp_support_ids[] __initconst = { +- { X86_VENDOR_INTEL, 6, X86_MODEL_ANY, X86_FEATURE_HWP }, ++ ICPU_HWP(INTEL_FAM6_BROADWELL_X, INTEL_PSTATE_HWP_BROADWELL), ++ ICPU_HWP(INTEL_FAM6_BROADWELL_XEON_D, INTEL_PSTATE_HWP_BROADWELL), ++ ICPU_HWP(X86_MODEL_ANY, 0), + {} + }; + + static int __init intel_pstate_init(void) + { ++ const struct x86_cpu_id *id; + int rc; + + if (no_load) + return -ENODEV; + +- if (x86_match_cpu(hwp_support_ids)) { ++ id = x86_match_cpu(hwp_support_ids); ++ if (id) { + copy_cpu_funcs(&core_funcs); + if (!no_hwp) { + hwp_active++; ++ hwp_mode_bdw = id->driver_data; + intel_pstate.attr = hwp_cpufreq_attrs; + goto hwp_cpu_matched; + } + } else { +- const struct x86_cpu_id *id; +- + id = x86_match_cpu(intel_pstate_cpu_ids); + if (!id) + return -ENODEV; +diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c +index e06605b21841..1d7d5d121d55 100644 +--- a/drivers/cpuidle/cpuidle-powernv.c ++++ b/drivers/cpuidle/cpuidle-powernv.c +@@ -43,9 +43,31 @@ struct stop_psscr_table { + + static struct stop_psscr_table stop_psscr_table[CPUIDLE_STATE_MAX] __read_mostly; + +-static u64 snooze_timeout __read_mostly; ++static u64 default_snooze_timeout __read_mostly; + static bool snooze_timeout_en __read_mostly; + ++static u64 get_snooze_timeout(struct cpuidle_device *dev, ++ struct cpuidle_driver *drv, ++ int index) ++{ ++ int i; ++ ++ if (unlikely(!snooze_timeout_en)) ++ return default_snooze_timeout; ++ ++ for (i = index + 1; i < drv->state_count; i++) { ++ struct cpuidle_state *s = &drv->states[i]; ++ struct cpuidle_state_usage *su = &dev->states_usage[i]; ++ ++ if (s->disabled || su->disable) ++ continue; ++ ++ return s->target_residency * tb_ticks_per_usec; ++ } ++ ++ return default_snooze_timeout; ++} ++ + static int snooze_loop(struct cpuidle_device *dev, + struct cpuidle_driver *drv, + int index) +@@ -56,7 +78,7 @@ static int snooze_loop(struct cpuidle_device *dev, + + local_irq_enable(); + +- snooze_exit_time = get_tb() + snooze_timeout; ++ snooze_exit_time = get_tb() + get_snooze_timeout(dev, drv, index); + ppc64_runlatch_off(); + HMT_very_low(); + while (!need_resched()) { +@@ -463,11 +485,9 @@ static int powernv_idle_probe(void) + cpuidle_state_table = powernv_states; + /* Device tree can indicate more idle states */ + max_idle_state = powernv_add_idle_states(); +- if (max_idle_state > 1) { ++ default_snooze_timeout = TICK_USEC * tb_ticks_per_usec; ++ if (max_idle_state > 1) + snooze_timeout_en = true; +- snooze_timeout = powernv_states[1].target_residency * +- tb_ticks_per_usec; +- } + } else + return -ENODEV; + +diff --git a/drivers/iio/accel/sca3000.c b/drivers/iio/accel/sca3000.c +index 39ab210c44f6..565f7d8d3304 100644 +--- a/drivers/iio/accel/sca3000.c ++++ b/drivers/iio/accel/sca3000.c +@@ -1277,7 +1277,7 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) + { + struct iio_buffer *buffer; + +- buffer = iio_kfifo_allocate(); ++ buffer = devm_iio_kfifo_allocate(&indio_dev->dev); + if (!buffer) + return -ENOMEM; + +@@ -1287,11 +1287,6 @@ static int sca3000_configure_ring(struct iio_dev *indio_dev) + return 0; + } + +-static void sca3000_unconfigure_ring(struct iio_dev *indio_dev) +-{ +- iio_kfifo_free(indio_dev->buffer); +-} +- + static inline + int __sca3000_hw_ring_state_set(struct iio_dev *indio_dev, bool state) + { +@@ -1547,8 +1542,6 @@ static int sca3000_remove(struct spi_device *spi) + if (spi->irq) + free_irq(spi->irq, indio_dev); + +- sca3000_unconfigure_ring(indio_dev); +- + return 0; + } + +diff --git a/drivers/iio/adc/ad7791.c b/drivers/iio/adc/ad7791.c +index 34e353c43ac8..677f812f372a 100644 +--- a/drivers/iio/adc/ad7791.c ++++ b/drivers/iio/adc/ad7791.c +@@ -244,58 +244,9 @@ static int ad7791_read_raw(struct iio_dev *indio_dev, + return -EINVAL; + } + +-static const char * const ad7791_sample_freq_avail[] = { +- [AD7791_FILTER_RATE_120] = "120", +- [AD7791_FILTER_RATE_100] = "100", +- [AD7791_FILTER_RATE_33_3] = "33.3", +- [AD7791_FILTER_RATE_20] = "20", +- [AD7791_FILTER_RATE_16_6] = "16.6", +- [AD7791_FILTER_RATE_16_7] = "16.7", +- [AD7791_FILTER_RATE_13_3] = "13.3", +- [AD7791_FILTER_RATE_9_5] = "9.5", +-}; +- +-static ssize_t ad7791_read_frequency(struct device *dev, +- struct device_attribute *attr, char *buf) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7791_state *st = iio_priv(indio_dev); +- unsigned int rate = st->filter & AD7791_FILTER_RATE_MASK; +- +- return sprintf(buf, "%s\n", ad7791_sample_freq_avail[rate]); +-} +- +-static ssize_t ad7791_write_frequency(struct device *dev, +- struct device_attribute *attr, const char *buf, size_t len) +-{ +- struct iio_dev *indio_dev = dev_to_iio_dev(dev); +- struct ad7791_state *st = iio_priv(indio_dev); +- int i, ret; +- +- i = sysfs_match_string(ad7791_sample_freq_avail, buf); +- if (i < 0) +- return i; +- +- ret = iio_device_claim_direct_mode(indio_dev); +- if (ret) +- return ret; +- st->filter &= ~AD7791_FILTER_RATE_MASK; +- st->filter |= i; +- ad_sd_write_reg(&st->sd, AD7791_REG_FILTER, sizeof(st->filter), +- st->filter); +- iio_device_release_direct_mode(indio_dev); +- +- return len; +-} +- +-static IIO_DEV_ATTR_SAMP_FREQ(S_IWUSR | S_IRUGO, +- ad7791_read_frequency, +- ad7791_write_frequency); +- + static IIO_CONST_ATTR_SAMP_FREQ_AVAIL("120 100 33.3 20 16.7 16.6 13.3 9.5"); + + static struct attribute *ad7791_attributes[] = { +- &iio_dev_attr_sampling_frequency.dev_attr.attr, + &iio_const_attr_sampling_frequency_available.dev_attr.attr, + NULL + }; +diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c +index 2b6c9b516070..d76455edd292 100644 +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -119,16 +119,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr, + umem->length = size; + umem->address = addr; + umem->page_shift = PAGE_SHIFT; +- /* +- * We ask for writable memory if any of the following +- * access flags are set. "Local write" and "remote write" +- * obviously require write access. "Remote atomic" can do +- * things like fetch and add, which will modify memory, and +- * "MW bind" can change permissions by binding a window. +- */ +- umem->writable = !!(access & +- (IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE | +- IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND)); ++ umem->writable = ib_access_writable(access); + + if (access & IB_ACCESS_ON_DEMAND) { + ret = ib_umem_odp_get(context, umem, access); +diff --git a/drivers/infiniband/hw/hfi1/chip.c b/drivers/infiniband/hw/hfi1/chip.c +index 259562282668..33cf1734c4e5 100644 +--- a/drivers/infiniband/hw/hfi1/chip.c ++++ b/drivers/infiniband/hw/hfi1/chip.c +@@ -6829,7 +6829,7 @@ static void rxe_kernel_unfreeze(struct hfi1_devdata *dd) + } + rcvmask = HFI1_RCVCTRL_CTXT_ENB; + /* HFI1_RCVCTRL_TAILUPD_[ENB|DIS] needs to be set explicitly */ +- rcvmask |= HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) ? ++ rcvmask |= rcd->rcvhdrtail_kvaddr ? + HFI1_RCVCTRL_TAILUPD_ENB : HFI1_RCVCTRL_TAILUPD_DIS; + hfi1_rcvctrl(dd, rcvmask, rcd); + hfi1_rcd_put(rcd); +@@ -8341,7 +8341,7 @@ static inline int check_packet_present(struct hfi1_ctxtdata *rcd) + u32 tail; + int present; + +- if (!HFI1_CAP_IS_KSET(DMA_RTAIL)) ++ if (!rcd->rcvhdrtail_kvaddr) + present = (rcd->seq_cnt == + rhf_rcv_seq(rhf_to_cpu(get_rhf_addr(rcd)))); + else /* is RDMA rtail */ +@@ -11813,7 +11813,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *dd, unsigned int op, + /* reset the tail and hdr addresses, and sequence count */ + write_kctxt_csr(dd, ctxt, RCV_HDR_ADDR, + rcd->rcvhdrq_dma); +- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) ++ if (rcd->rcvhdrtail_kvaddr) + write_kctxt_csr(dd, ctxt, RCV_HDR_TAIL_ADDR, + rcd->rcvhdrqtailaddr_dma); + rcd->seq_cnt = 1; +@@ -11893,7 +11893,7 @@ void hfi1_rcvctrl(struct hfi1_devdata *dd, unsigned int op, + rcvctrl |= RCV_CTXT_CTRL_INTR_AVAIL_SMASK; + if (op & HFI1_RCVCTRL_INTRAVAIL_DIS) + rcvctrl &= ~RCV_CTXT_CTRL_INTR_AVAIL_SMASK; +- if (op & HFI1_RCVCTRL_TAILUPD_ENB && rcd->rcvhdrqtailaddr_dma) ++ if ((op & HFI1_RCVCTRL_TAILUPD_ENB) && rcd->rcvhdrtail_kvaddr) + rcvctrl |= RCV_CTXT_CTRL_TAIL_UPD_SMASK; + if (op & HFI1_RCVCTRL_TAILUPD_DIS) { + /* See comment on RcvCtxtCtrl.TailUpd above */ +diff --git a/drivers/infiniband/hw/hfi1/debugfs.c b/drivers/infiniband/hw/hfi1/debugfs.c +index 36ae1fd86502..f661b387e916 100644 +--- a/drivers/infiniband/hw/hfi1/debugfs.c ++++ b/drivers/infiniband/hw/hfi1/debugfs.c +@@ -1179,7 +1179,8 @@ DEBUGFS_FILE_OPS(fault_stats); + + static void fault_exit_opcode_debugfs(struct hfi1_ibdev *ibd) + { +- debugfs_remove_recursive(ibd->fault_opcode->dir); ++ if (ibd->fault_opcode) ++ debugfs_remove_recursive(ibd->fault_opcode->dir); + kfree(ibd->fault_opcode); + ibd->fault_opcode = NULL; + } +@@ -1207,6 +1208,7 @@ static int fault_init_opcode_debugfs(struct hfi1_ibdev *ibd) + &ibd->fault_opcode->attr); + if (IS_ERR(ibd->fault_opcode->dir)) { + kfree(ibd->fault_opcode); ++ ibd->fault_opcode = NULL; + return -ENOENT; + } + +@@ -1230,7 +1232,8 @@ static int fault_init_opcode_debugfs(struct hfi1_ibdev *ibd) + + static void fault_exit_packet_debugfs(struct hfi1_ibdev *ibd) + { +- debugfs_remove_recursive(ibd->fault_packet->dir); ++ if (ibd->fault_packet) ++ debugfs_remove_recursive(ibd->fault_packet->dir); + kfree(ibd->fault_packet); + ibd->fault_packet = NULL; + } +@@ -1256,6 +1259,7 @@ static int fault_init_packet_debugfs(struct hfi1_ibdev *ibd) + &ibd->fault_opcode->attr); + if (IS_ERR(ibd->fault_packet->dir)) { + kfree(ibd->fault_packet); ++ ibd->fault_packet = NULL; + return -ENOENT; + } + +diff --git a/drivers/infiniband/hw/hfi1/file_ops.c b/drivers/infiniband/hw/hfi1/file_ops.c +index ee2253d06984..9abc5a9c47a0 100644 +--- a/drivers/infiniband/hw/hfi1/file_ops.c ++++ b/drivers/infiniband/hw/hfi1/file_ops.c +@@ -622,7 +622,7 @@ static int hfi1_file_mmap(struct file *fp, struct vm_area_struct *vma) + ret = -EINVAL; + goto done; + } +- if (flags & VM_WRITE) { ++ if ((flags & VM_WRITE) || !uctxt->rcvhdrtail_kvaddr) { + ret = -EPERM; + goto done; + } +@@ -807,8 +807,8 @@ static int hfi1_file_close(struct inode *inode, struct file *fp) + * checks to default and disable the send context. + */ + if (uctxt->sc) { +- set_pio_integrity(uctxt->sc); + sc_disable(uctxt->sc); ++ set_pio_integrity(uctxt->sc); + } + + hfi1_free_ctxt_rcv_groups(uctxt); +diff --git a/drivers/infiniband/hw/hfi1/hfi.h b/drivers/infiniband/hw/hfi1/hfi.h +index ccc7b9b8637e..13a7bcaa58e6 100644 +--- a/drivers/infiniband/hw/hfi1/hfi.h ++++ b/drivers/infiniband/hw/hfi1/hfi.h +@@ -1851,6 +1851,7 @@ struct cc_state *get_cc_state_protected(struct hfi1_pportdata *ppd) + #define HFI1_HAS_SDMA_TIMEOUT 0x8 + #define HFI1_HAS_SEND_DMA 0x10 /* Supports Send DMA */ + #define HFI1_FORCED_FREEZE 0x80 /* driver forced freeze mode */ ++#define HFI1_SHUTDOWN 0x100 /* device is shutting down */ + + /* IB dword length mask in PBC (lower 11 bits); same for all chips */ + #define HFI1_PBC_LENGTH_MASK ((1 << 11) - 1) +diff --git a/drivers/infiniband/hw/hfi1/init.c b/drivers/infiniband/hw/hfi1/init.c +index 918dbd350c71..ee5cbdfeb3ab 100644 +--- a/drivers/infiniband/hw/hfi1/init.c ++++ b/drivers/infiniband/hw/hfi1/init.c +@@ -1029,6 +1029,10 @@ static void shutdown_device(struct hfi1_devdata *dd) + unsigned pidx; + int i; + ++ if (dd->flags & HFI1_SHUTDOWN) ++ return; ++ dd->flags |= HFI1_SHUTDOWN; ++ + for (pidx = 0; pidx < dd->num_pports; ++pidx) { + ppd = dd->pport + pidx; + +@@ -1353,6 +1357,7 @@ void hfi1_disable_after_error(struct hfi1_devdata *dd) + + static void remove_one(struct pci_dev *); + static int init_one(struct pci_dev *, const struct pci_device_id *); ++static void shutdown_one(struct pci_dev *); + + #define DRIVER_LOAD_MSG "Intel " DRIVER_NAME " loaded: " + #define PFX DRIVER_NAME ": " +@@ -1369,6 +1374,7 @@ static struct pci_driver hfi1_pci_driver = { + .name = DRIVER_NAME, + .probe = init_one, + .remove = remove_one, ++ .shutdown = shutdown_one, + .id_table = hfi1_pci_tbl, + .err_handler = &hfi1_pci_err_handler, + }; +@@ -1780,6 +1786,13 @@ static void remove_one(struct pci_dev *pdev) + postinit_cleanup(dd); + } + ++static void shutdown_one(struct pci_dev *pdev) ++{ ++ struct hfi1_devdata *dd = pci_get_drvdata(pdev); ++ ++ shutdown_device(dd); ++} ++ + /** + * hfi1_create_rcvhdrq - create a receive header queue + * @dd: the hfi1_ib device +@@ -1795,7 +1808,6 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd) + u64 reg; + + if (!rcd->rcvhdrq) { +- dma_addr_t dma_hdrqtail; + gfp_t gfp_flags; + + /* +@@ -1821,13 +1833,13 @@ int hfi1_create_rcvhdrq(struct hfi1_devdata *dd, struct hfi1_ctxtdata *rcd) + goto bail; + } + +- if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL)) { ++ if (HFI1_CAP_KGET_MASK(rcd->flags, DMA_RTAIL) || ++ HFI1_CAP_UGET_MASK(rcd->flags, DMA_RTAIL)) { + rcd->rcvhdrtail_kvaddr = dma_zalloc_coherent( +- &dd->pcidev->dev, PAGE_SIZE, &dma_hdrqtail, +- gfp_flags); ++ &dd->pcidev->dev, PAGE_SIZE, ++ &rcd->rcvhdrqtailaddr_dma, gfp_flags); + if (!rcd->rcvhdrtail_kvaddr) + goto bail_free; +- rcd->rcvhdrqtailaddr_dma = dma_hdrqtail; + } + + rcd->rcvhdrq_size = amt; +diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c +index 7108a4b5e94c..a95ac6246559 100644 +--- a/drivers/infiniband/hw/hfi1/pio.c ++++ b/drivers/infiniband/hw/hfi1/pio.c +@@ -50,8 +50,6 @@ + #include "qp.h" + #include "trace.h" + +-#define SC_CTXT_PACKET_EGRESS_TIMEOUT 350 /* in chip cycles */ +- + #define SC(name) SEND_CTXT_##name + /* + * Send Context functions +@@ -977,15 +975,40 @@ void sc_disable(struct send_context *sc) + } + + /* return SendEgressCtxtStatus.PacketOccupancy */ +-#define packet_occupancy(r) \ +- (((r) & SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_PACKET_OCCUPANCY_SMASK)\ +- >> SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_PACKET_OCCUPANCY_SHIFT) ++static u64 packet_occupancy(u64 reg) ++{ ++ return (reg & ++ SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_PACKET_OCCUPANCY_SMASK) ++ >> SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_PACKET_OCCUPANCY_SHIFT; ++} + + /* is egress halted on the context? */ +-#define egress_halted(r) \ +- ((r) & SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_HALT_STATUS_SMASK) ++static bool egress_halted(u64 reg) ++{ ++ return !!(reg & SEND_EGRESS_CTXT_STATUS_CTXT_EGRESS_HALT_STATUS_SMASK); ++} + +-/* wait for packet egress, optionally pause for credit return */ ++/* is the send context halted? */ ++static bool is_sc_halted(struct hfi1_devdata *dd, u32 hw_context) ++{ ++ return !!(read_kctxt_csr(dd, hw_context, SC(STATUS)) & ++ SC(STATUS_CTXT_HALTED_SMASK)); ++} ++ ++/** ++ * sc_wait_for_packet_egress ++ * @sc: valid send context ++ * @pause: wait for credit return ++ * ++ * Wait for packet egress, optionally pause for credit return ++ * ++ * Egress halt and Context halt are not necessarily the same thing, so ++ * check for both. ++ * ++ * NOTE: The context halt bit may not be set immediately. Because of this, ++ * it is necessary to check the SW SFC_HALTED bit (set in the IRQ) and the HW ++ * context bit to determine if the context is halted. ++ */ + static void sc_wait_for_packet_egress(struct send_context *sc, int pause) + { + struct hfi1_devdata *dd = sc->dd; +@@ -997,8 +1020,9 @@ static void sc_wait_for_packet_egress(struct send_context *sc, int pause) + reg_prev = reg; + reg = read_csr(dd, sc->hw_context * 8 + + SEND_EGRESS_CTXT_STATUS); +- /* done if egress is stopped */ +- if (egress_halted(reg)) ++ /* done if any halt bits, SW or HW are set */ ++ if (sc->flags & SCF_HALTED || ++ is_sc_halted(dd, sc->hw_context) || egress_halted(reg)) + break; + reg = packet_occupancy(reg); + if (reg == 0) +diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c +index 0793a21d76f4..d604b3d5aa3e 100644 +--- a/drivers/infiniband/hw/mlx4/mad.c ++++ b/drivers/infiniband/hw/mlx4/mad.c +@@ -1934,7 +1934,6 @@ static void mlx4_ib_sqp_comp_worker(struct work_struct *work) + "buf:%lld\n", wc.wr_id); + break; + default: +- BUG_ON(1); + break; + } + } else { +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index e80a7f764a74..1587cedee13e 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -131,6 +131,40 @@ int mlx4_ib_umem_write_mtt(struct mlx4_ib_dev *dev, struct mlx4_mtt *mtt, + return err; + } + ++static struct ib_umem *mlx4_get_umem_mr(struct ib_ucontext *context, u64 start, ++ u64 length, u64 virt_addr, ++ int access_flags) ++{ ++ /* ++ * Force registering the memory as writable if the underlying pages ++ * are writable. This is so rereg can change the access permissions ++ * from readable to writable without having to run through ib_umem_get ++ * again ++ */ ++ if (!ib_access_writable(access_flags)) { ++ struct vm_area_struct *vma; ++ ++ down_read(¤t->mm->mmap_sem); ++ /* ++ * FIXME: Ideally this would iterate over all the vmas that ++ * cover the memory, but for now it requires a single vma to ++ * entirely cover the MR to support RO mappings. ++ */ ++ vma = find_vma(current->mm, start); ++ if (vma && vma->vm_end >= start + length && ++ vma->vm_start <= start) { ++ if (vma->vm_flags & VM_WRITE) ++ access_flags |= IB_ACCESS_LOCAL_WRITE; ++ } else { ++ access_flags |= IB_ACCESS_LOCAL_WRITE; ++ } ++ ++ up_read(¤t->mm->mmap_sem); ++ } ++ ++ return ib_umem_get(context, start, length, access_flags, 0); ++} ++ + struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + u64 virt_addr, int access_flags, + struct ib_udata *udata) +@@ -145,10 +179,8 @@ struct ib_mr *mlx4_ib_reg_user_mr(struct ib_pd *pd, u64 start, u64 length, + if (!mr) + return ERR_PTR(-ENOMEM); + +- /* Force registering the memory as writable. */ +- /* Used for memory re-registeration. HCA protects the access */ +- mr->umem = ib_umem_get(pd->uobject->context, start, length, +- access_flags | IB_ACCESS_LOCAL_WRITE, 0); ++ mr->umem = mlx4_get_umem_mr(pd->uobject->context, start, length, ++ virt_addr, access_flags); + if (IS_ERR(mr->umem)) { + err = PTR_ERR(mr->umem); + goto err_free; +@@ -215,6 +247,9 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, + } + + if (flags & IB_MR_REREG_ACCESS) { ++ if (ib_access_writable(mr_access_flags) && !mmr->umem->writable) ++ return -EPERM; ++ + err = mlx4_mr_hw_change_access(dev->dev, *pmpt_entry, + convert_access(mr_access_flags)); + +@@ -228,10 +263,9 @@ int mlx4_ib_rereg_user_mr(struct ib_mr *mr, int flags, + + mlx4_mr_rereg_mem_cleanup(dev->dev, &mmr->mmr); + ib_umem_release(mmr->umem); +- mmr->umem = ib_umem_get(mr->uobject->context, start, length, +- mr_access_flags | +- IB_ACCESS_LOCAL_WRITE, +- 0); ++ mmr->umem = ++ mlx4_get_umem_mr(mr->uobject->context, start, length, ++ virt_addr, mr_access_flags); + if (IS_ERR(mmr->umem)) { + err = PTR_ERR(mmr->umem); + /* Prevent mlx4_ib_dereg_mr from free'ing invalid pointer */ +diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c +index d804880d637a..be6612fc33ac 100644 +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -646,7 +646,7 @@ static int mlx5_poll_one(struct mlx5_ib_cq *cq, + } + + static int poll_soft_wc(struct mlx5_ib_cq *cq, int num_entries, +- struct ib_wc *wc) ++ struct ib_wc *wc, bool is_fatal_err) + { + struct mlx5_ib_dev *dev = to_mdev(cq->ibcq.device); + struct mlx5_ib_wc *soft_wc, *next; +@@ -659,6 +659,10 @@ static int poll_soft_wc(struct mlx5_ib_cq *cq, int num_entries, + mlx5_ib_dbg(dev, "polled software generated completion on CQ 0x%x\n", + cq->mcq.cqn); + ++ if (unlikely(is_fatal_err)) { ++ soft_wc->wc.status = IB_WC_WR_FLUSH_ERR; ++ soft_wc->wc.vendor_err = MLX5_CQE_SYNDROME_WR_FLUSH_ERR; ++ } + wc[npolled++] = soft_wc->wc; + list_del(&soft_wc->list); + kfree(soft_wc); +@@ -679,12 +683,17 @@ int mlx5_ib_poll_cq(struct ib_cq *ibcq, int num_entries, struct ib_wc *wc) + + spin_lock_irqsave(&cq->lock, flags); + if (mdev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) { +- mlx5_ib_poll_sw_comp(cq, num_entries, wc, &npolled); ++ /* make sure no soft wqe's are waiting */ ++ if (unlikely(!list_empty(&cq->wc_list))) ++ soft_polled = poll_soft_wc(cq, num_entries, wc, true); ++ ++ mlx5_ib_poll_sw_comp(cq, num_entries - soft_polled, ++ wc + soft_polled, &npolled); + goto out; + } + + if (unlikely(!list_empty(&cq->wc_list))) +- soft_polled = poll_soft_wc(cq, num_entries, wc); ++ soft_polled = poll_soft_wc(cq, num_entries, wc, false); + + for (npolled = 0; npolled < num_entries - soft_polled; npolled++) { + if (mlx5_poll_one(cq, &cur_qp, wc + soft_polled + npolled)) +diff --git a/drivers/infiniband/hw/qib/qib.h b/drivers/infiniband/hw/qib/qib.h +index f9e1c69603a5..1dda4a2623c9 100644 +--- a/drivers/infiniband/hw/qib/qib.h ++++ b/drivers/infiniband/hw/qib/qib.h +@@ -1250,6 +1250,7 @@ static inline struct qib_ibport *to_iport(struct ib_device *ibdev, u8 port) + #define QIB_BADINTR 0x8000 /* severe interrupt problems */ + #define QIB_DCA_ENABLED 0x10000 /* Direct Cache Access enabled */ + #define QIB_HAS_QSFP 0x20000 /* device (card instance) has QSFP */ ++#define QIB_SHUTDOWN 0x40000 /* device is shutting down */ + + /* + * values for ppd->lflags (_ib_port_ related flags) +@@ -1448,8 +1449,7 @@ u64 qib_sps_ints(void); + /* + * dma_addr wrappers - all 0's invalid for hw + */ +-dma_addr_t qib_map_page(struct pci_dev *, struct page *, unsigned long, +- size_t, int); ++int qib_map_page(struct pci_dev *d, struct page *p, dma_addr_t *daddr); + const char *qib_get_unit_name(int unit); + const char *qib_get_card_name(struct rvt_dev_info *rdi); + struct pci_dev *qib_get_pci_dev(struct rvt_dev_info *rdi); +diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c +index 9396c1807cc3..40efc9151ec4 100644 +--- a/drivers/infiniband/hw/qib/qib_file_ops.c ++++ b/drivers/infiniband/hw/qib/qib_file_ops.c +@@ -364,6 +364,8 @@ static int qib_tid_update(struct qib_ctxtdata *rcd, struct file *fp, + goto done; + } + for (i = 0; i < cnt; i++, vaddr += PAGE_SIZE) { ++ dma_addr_t daddr; ++ + for (; ntids--; tid++) { + if (tid == tidcnt) + tid = 0; +@@ -380,12 +382,14 @@ static int qib_tid_update(struct qib_ctxtdata *rcd, struct file *fp, + ret = -ENOMEM; + break; + } ++ ret = qib_map_page(dd->pcidev, pagep[i], &daddr); ++ if (ret) ++ break; ++ + tidlist[i] = tid + tidoff; + /* we "know" system pages and TID pages are same size */ + dd->pageshadow[ctxttid + tid] = pagep[i]; +- dd->physshadow[ctxttid + tid] = +- qib_map_page(dd->pcidev, pagep[i], 0, PAGE_SIZE, +- PCI_DMA_FROMDEVICE); ++ dd->physshadow[ctxttid + tid] = daddr; + /* + * don't need atomic or it's overhead + */ +diff --git a/drivers/infiniband/hw/qib/qib_init.c b/drivers/infiniband/hw/qib/qib_init.c +index c5a4c65636d6..7ba7d2122f3b 100644 +--- a/drivers/infiniband/hw/qib/qib_init.c ++++ b/drivers/infiniband/hw/qib/qib_init.c +@@ -850,6 +850,10 @@ static void qib_shutdown_device(struct qib_devdata *dd) + struct qib_pportdata *ppd; + unsigned pidx; + ++ if (dd->flags & QIB_SHUTDOWN) ++ return; ++ dd->flags |= QIB_SHUTDOWN; ++ + for (pidx = 0; pidx < dd->num_pports; ++pidx) { + ppd = dd->pport + pidx; + +@@ -1189,6 +1193,7 @@ void qib_disable_after_error(struct qib_devdata *dd) + + static void qib_remove_one(struct pci_dev *); + static int qib_init_one(struct pci_dev *, const struct pci_device_id *); ++static void qib_shutdown_one(struct pci_dev *); + + #define DRIVER_LOAD_MSG "Intel " QIB_DRV_NAME " loaded: " + #define PFX QIB_DRV_NAME ": " +@@ -1206,6 +1211,7 @@ static struct pci_driver qib_driver = { + .name = QIB_DRV_NAME, + .probe = qib_init_one, + .remove = qib_remove_one, ++ .shutdown = qib_shutdown_one, + .id_table = qib_pci_tbl, + .err_handler = &qib_pci_err_handler, + }; +@@ -1556,6 +1562,13 @@ static void qib_remove_one(struct pci_dev *pdev) + qib_postinit_cleanup(dd); + } + ++static void qib_shutdown_one(struct pci_dev *pdev) ++{ ++ struct qib_devdata *dd = pci_get_drvdata(pdev); ++ ++ qib_shutdown_device(dd); ++} ++ + /** + * qib_create_rcvhdrq - create a receive header queue + * @dd: the qlogic_ib device +diff --git a/drivers/infiniband/hw/qib/qib_user_pages.c b/drivers/infiniband/hw/qib/qib_user_pages.c +index ce83ba9a12ef..16543d5e80c3 100644 +--- a/drivers/infiniband/hw/qib/qib_user_pages.c ++++ b/drivers/infiniband/hw/qib/qib_user_pages.c +@@ -99,23 +99,27 @@ static int __qib_get_user_pages(unsigned long start_page, size_t num_pages, + * + * I'm sure we won't be so lucky with other iommu's, so FIXME. + */ +-dma_addr_t qib_map_page(struct pci_dev *hwdev, struct page *page, +- unsigned long offset, size_t size, int direction) ++int qib_map_page(struct pci_dev *hwdev, struct page *page, dma_addr_t *daddr) + { + dma_addr_t phys; + +- phys = pci_map_page(hwdev, page, offset, size, direction); ++ phys = pci_map_page(hwdev, page, 0, PAGE_SIZE, PCI_DMA_FROMDEVICE); ++ if (pci_dma_mapping_error(hwdev, phys)) ++ return -ENOMEM; + +- if (phys == 0) { +- pci_unmap_page(hwdev, phys, size, direction); +- phys = pci_map_page(hwdev, page, offset, size, direction); ++ if (!phys) { ++ pci_unmap_page(hwdev, phys, PAGE_SIZE, PCI_DMA_FROMDEVICE); ++ phys = pci_map_page(hwdev, page, 0, PAGE_SIZE, ++ PCI_DMA_FROMDEVICE); ++ if (pci_dma_mapping_error(hwdev, phys)) ++ return -ENOMEM; + /* + * FIXME: If we get 0 again, we should keep this page, + * map another, then free the 0 page. + */ + } +- +- return phys; ++ *daddr = phys; ++ return 0; + } + + /** +diff --git a/drivers/infiniband/sw/rdmavt/cq.c b/drivers/infiniband/sw/rdmavt/cq.c +index 88fa4d44ab5f..76a86f805233 100644 +--- a/drivers/infiniband/sw/rdmavt/cq.c ++++ b/drivers/infiniband/sw/rdmavt/cq.c +@@ -121,17 +121,20 @@ void rvt_cq_enter(struct rvt_cq *cq, struct ib_wc *entry, bool solicited) + if (cq->notify == IB_CQ_NEXT_COMP || + (cq->notify == IB_CQ_SOLICITED && + (solicited || entry->status != IB_WC_SUCCESS))) { ++ struct kthread_worker *worker; ++ + /* + * This will cause send_complete() to be called in + * another thread. + */ +- spin_lock(&cq->rdi->n_cqs_lock); +- if (likely(cq->rdi->worker)) { ++ rcu_read_lock(); ++ worker = rcu_dereference(cq->rdi->worker); ++ if (likely(worker)) { + cq->notify = RVT_CQ_NONE; + cq->triggered++; +- kthread_queue_work(cq->rdi->worker, &cq->comptask); ++ kthread_queue_work(worker, &cq->comptask); + } +- spin_unlock(&cq->rdi->n_cqs_lock); ++ rcu_read_unlock(); + } + + spin_unlock_irqrestore(&cq->lock, flags); +@@ -513,7 +516,7 @@ int rvt_driver_cq_init(struct rvt_dev_info *rdi) + int cpu; + struct kthread_worker *worker; + +- if (rdi->worker) ++ if (rcu_access_pointer(rdi->worker)) + return 0; + + spin_lock_init(&rdi->n_cqs_lock); +@@ -525,7 +528,7 @@ int rvt_driver_cq_init(struct rvt_dev_info *rdi) + return PTR_ERR(worker); + + set_user_nice(worker->task, MIN_NICE); +- rdi->worker = worker; ++ RCU_INIT_POINTER(rdi->worker, worker); + return 0; + } + +@@ -537,15 +540,19 @@ void rvt_cq_exit(struct rvt_dev_info *rdi) + { + struct kthread_worker *worker; + +- /* block future queuing from send_complete() */ +- spin_lock_irq(&rdi->n_cqs_lock); +- worker = rdi->worker; ++ if (!rcu_access_pointer(rdi->worker)) ++ return; ++ ++ spin_lock(&rdi->n_cqs_lock); ++ worker = rcu_dereference_protected(rdi->worker, ++ lockdep_is_held(&rdi->n_cqs_lock)); + if (!worker) { +- spin_unlock_irq(&rdi->n_cqs_lock); ++ spin_unlock(&rdi->n_cqs_lock); + return; + } +- rdi->worker = NULL; +- spin_unlock_irq(&rdi->n_cqs_lock); ++ RCU_INIT_POINTER(rdi->worker, NULL); ++ spin_unlock(&rdi->n_cqs_lock); ++ synchronize_rcu(); + + kthread_destroy_worker(worker); + } +diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c +index e770c17cbca9..ee3f630c9217 100644 +--- a/drivers/infiniband/ulp/isert/ib_isert.c ++++ b/drivers/infiniband/ulp/isert/ib_isert.c +@@ -885,15 +885,9 @@ isert_login_post_send(struct isert_conn *isert_conn, struct iser_tx_desc *tx_des + } + + static void +-isert_create_send_desc(struct isert_conn *isert_conn, +- struct isert_cmd *isert_cmd, +- struct iser_tx_desc *tx_desc) ++__isert_create_send_desc(struct isert_device *device, ++ struct iser_tx_desc *tx_desc) + { +- struct isert_device *device = isert_conn->device; +- struct ib_device *ib_dev = device->ib_device; +- +- ib_dma_sync_single_for_cpu(ib_dev, tx_desc->dma_addr, +- ISER_HEADERS_LEN, DMA_TO_DEVICE); + + memset(&tx_desc->iser_header, 0, sizeof(struct iser_ctrl)); + tx_desc->iser_header.flags = ISCSI_CTRL; +@@ -906,6 +900,20 @@ isert_create_send_desc(struct isert_conn *isert_conn, + } + } + ++static void ++isert_create_send_desc(struct isert_conn *isert_conn, ++ struct isert_cmd *isert_cmd, ++ struct iser_tx_desc *tx_desc) ++{ ++ struct isert_device *device = isert_conn->device; ++ struct ib_device *ib_dev = device->ib_device; ++ ++ ib_dma_sync_single_for_cpu(ib_dev, tx_desc->dma_addr, ++ ISER_HEADERS_LEN, DMA_TO_DEVICE); ++ ++ __isert_create_send_desc(device, tx_desc); ++} ++ + static int + isert_init_tx_hdrs(struct isert_conn *isert_conn, + struct iser_tx_desc *tx_desc) +@@ -993,7 +1001,7 @@ isert_put_login_tx(struct iscsi_conn *conn, struct iscsi_login *login, + struct iser_tx_desc *tx_desc = &isert_conn->login_tx_desc; + int ret; + +- isert_create_send_desc(isert_conn, NULL, tx_desc); ++ __isert_create_send_desc(device, tx_desc); + + memcpy(&tx_desc->iscsi_header, &login->rsp[0], + sizeof(struct iscsi_hdr)); +@@ -2108,7 +2116,7 @@ isert_set_sig_attrs(struct se_cmd *se_cmd, struct ib_sig_attrs *sig_attrs) + + sig_attrs->check_mask = + (se_cmd->prot_checks & TARGET_DIF_CHECK_GUARD ? 0xc0 : 0) | +- (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x30 : 0) | ++ (se_cmd->prot_checks & TARGET_DIF_CHECK_APPTAG ? 0x30 : 0) | + (se_cmd->prot_checks & TARGET_DIF_CHECK_REFTAG ? 0x0f : 0); + return 0; + } +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 466cef930bf1..53f775c41cd1 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -126,7 +126,7 @@ static const struct xpad_device { + u8 mapping; + u8 xtype; + } xpad_device[] = { +- { 0x0079, 0x18d4, "GPD Win 2 Controller", 0, XTYPE_XBOX360 }, ++ { 0x0079, 0x18d4, "GPD Win 2 X-Box Controller", 0, XTYPE_XBOX360 }, + { 0x044f, 0x0f00, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f03, "Thrustmaster Wheel", 0, XTYPE_XBOX }, + { 0x044f, 0x0f07, "Thrustmaster, Inc. Controller", 0, XTYPE_XBOX }, +diff --git a/drivers/input/mouse/elan_i2c.h b/drivers/input/mouse/elan_i2c.h +index 599544c1a91c..243e0fa6e3e3 100644 +--- a/drivers/input/mouse/elan_i2c.h ++++ b/drivers/input/mouse/elan_i2c.h +@@ -27,6 +27,8 @@ + #define ETP_DISABLE_POWER 0x0001 + #define ETP_PRESSURE_OFFSET 25 + ++#define ETP_CALIBRATE_MAX_LEN 3 ++ + /* IAP Firmware handling */ + #define ETP_PRODUCT_ID_FORMAT_STRING "%d.0" + #define ETP_FW_NAME "elan_i2c_" ETP_PRODUCT_ID_FORMAT_STRING ".bin" +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index c4926645c779..7b5fa501bbcf 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -610,7 +610,7 @@ static ssize_t calibrate_store(struct device *dev, + int tries = 20; + int retval; + int error; +- u8 val[3]; ++ u8 val[ETP_CALIBRATE_MAX_LEN]; + + retval = mutex_lock_interruptible(&data->sysfs_mutex); + if (retval) +@@ -1261,6 +1261,7 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN060C", 0 }, + { "ELAN0611", 0 }, + { "ELAN0612", 0 }, ++ { "ELAN0618", 0 }, + { "ELAN1000", 0 }, + { } + }; +diff --git a/drivers/input/mouse/elan_i2c_smbus.c b/drivers/input/mouse/elan_i2c_smbus.c +index cfcb32559925..c060d270bc4d 100644 +--- a/drivers/input/mouse/elan_i2c_smbus.c ++++ b/drivers/input/mouse/elan_i2c_smbus.c +@@ -56,7 +56,7 @@ + static int elan_smbus_initialize(struct i2c_client *client) + { + u8 check[ETP_SMBUS_HELLOPACKET_LEN] = { 0x55, 0x55, 0x55, 0x55, 0x55 }; +- u8 values[ETP_SMBUS_HELLOPACKET_LEN] = { 0, 0, 0, 0, 0 }; ++ u8 values[I2C_SMBUS_BLOCK_MAX] = {0}; + int len, error; + + /* Get hello packet */ +@@ -117,12 +117,16 @@ static int elan_smbus_calibrate(struct i2c_client *client) + static int elan_smbus_calibrate_result(struct i2c_client *client, u8 *val) + { + int error; ++ u8 buf[I2C_SMBUS_BLOCK_MAX] = {0}; ++ ++ BUILD_BUG_ON(ETP_CALIBRATE_MAX_LEN > sizeof(buf)); + + error = i2c_smbus_read_block_data(client, +- ETP_SMBUS_CALIBRATE_QUERY, val); ++ ETP_SMBUS_CALIBRATE_QUERY, buf); + if (error < 0) + return error; + ++ memcpy(val, buf, ETP_CALIBRATE_MAX_LEN); + return 0; + } + +@@ -472,6 +476,8 @@ static int elan_smbus_get_report(struct i2c_client *client, u8 *report) + { + int len; + ++ BUILD_BUG_ON(I2C_SMBUS_BLOCK_MAX > ETP_SMBUS_REPORT_LEN); ++ + len = i2c_smbus_read_block_data(client, + ETP_SMBUS_PACKET_QUERY, + &report[ETP_SMBUS_REPORT_OFFSET]); +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index a4aaa748e987..a250f433eb96 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -804,7 +804,7 @@ static int elantech_packet_check_v4(struct psmouse *psmouse) + else if (ic_version == 7 && etd->samples[1] == 0x2A) + sanity_check = ((packet[3] & 0x1c) == 0x10); + else +- sanity_check = ((packet[0] & 0x0c) == 0x04 && ++ sanity_check = ((packet[0] & 0x08) == 0x00 && + (packet[3] & 0x1c) == 0x10); + + if (!sanity_check) +@@ -1177,6 +1177,12 @@ static const struct dmi_system_id elantech_dmi_has_middle_button[] = { + { } + }; + ++static const char * const middle_button_pnp_ids[] = { ++ "LEN2131", /* ThinkPad P52 w/ NFC */ ++ "LEN2132", /* ThinkPad P52 */ ++ NULL ++}; ++ + /* + * Set the appropriate event bits for the input subsystem + */ +@@ -1196,7 +1202,8 @@ static int elantech_set_input_params(struct psmouse *psmouse) + __clear_bit(EV_REL, dev->evbit); + + __set_bit(BTN_LEFT, dev->keybit); +- if (dmi_check_system(elantech_dmi_has_middle_button)) ++ if (dmi_check_system(elantech_dmi_has_middle_button) || ++ psmouse_matches_pnp_id(psmouse, middle_button_pnp_ids)) + __set_bit(BTN_MIDDLE, dev->keybit); + __set_bit(BTN_RIGHT, dev->keybit); + +diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c +index 13f195c9743e..2ea39a83737f 100644 +--- a/drivers/irqchip/irq-gic-v3-its.c ++++ b/drivers/irqchip/irq-gic-v3-its.c +@@ -2221,7 +2221,14 @@ static void its_irq_domain_activate(struct irq_domain *domain, + cpu_mask = cpumask_of_node(its_dev->its->numa_node); + + /* Bind the LPI to the first possible CPU */ +- cpu = cpumask_first(cpu_mask); ++ cpu = cpumask_first_and(cpu_mask, cpu_online_mask); ++ if (cpu >= nr_cpu_ids) { ++ if (its_dev->its->flags & ITS_FLAGS_WORKAROUND_CAVIUM_23144) ++ return; ++ ++ cpu = cpumask_first(cpu_online_mask); ++ } ++ + its_dev->event_map.col_map[event] = cpu; + irq_data_update_effective_affinity(d, cpumask_of(cpu)); + +diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c +index 02e42ba2ecbc..72ae5dc50532 100644 +--- a/drivers/md/dm-thin.c ++++ b/drivers/md/dm-thin.c +@@ -1380,6 +1380,8 @@ static void schedule_external_copy(struct thin_c *tc, dm_block_t virt_block, + + static void set_pool_mode(struct pool *pool, enum pool_mode new_mode); + ++static void requeue_bios(struct pool *pool); ++ + static void check_for_space(struct pool *pool) + { + int r; +@@ -1392,8 +1394,10 @@ static void check_for_space(struct pool *pool) + if (r) + return; + +- if (nr_free) ++ if (nr_free) { + set_pool_mode(pool, PM_WRITE); ++ requeue_bios(pool); ++ } + } + + /* +@@ -1470,7 +1474,10 @@ static int alloc_data_block(struct thin_c *tc, dm_block_t *result) + + r = dm_pool_alloc_data_block(pool->pmd, result); + if (r) { +- metadata_operation_failed(pool, "dm_pool_alloc_data_block", r); ++ if (r == -ENOSPC) ++ set_pool_mode(pool, PM_OUT_OF_DATA_SPACE); ++ else ++ metadata_operation_failed(pool, "dm_pool_alloc_data_block", r); + return r; + } + +diff --git a/drivers/md/dm-zoned-target.c b/drivers/md/dm-zoned-target.c +index 6d7bda6f8190..ba6b0a90ecfb 100644 +--- a/drivers/md/dm-zoned-target.c ++++ b/drivers/md/dm-zoned-target.c +@@ -788,7 +788,7 @@ static int dmz_ctr(struct dm_target *ti, unsigned int argc, char **argv) + + /* Chunk BIO work */ + mutex_init(&dmz->chunk_lock); +- INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_KERNEL); ++ INIT_RADIX_TREE(&dmz->chunk_rxtree, GFP_NOIO); + dmz->chunk_wq = alloc_workqueue("dmz_cwq_%s", WQ_MEM_RECLAIM | WQ_UNBOUND, + 0, dev->name); + if (!dmz->chunk_wq) { +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 24e64b04424a..7143c8b9284b 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -2823,7 +2823,8 @@ state_store(struct md_rdev *rdev, const char *buf, size_t len) + err = 0; + } + } else if (cmd_match(buf, "re-add")) { +- if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1)) { ++ if (test_bit(Faulty, &rdev->flags) && (rdev->raid_disk == -1) && ++ rdev->saved_raid_disk >= 0) { + /* clear_bit is performed _after_ all the devices + * have their local Faulty bit cleared. If any writes + * happen in the meantime in the local node, they +@@ -8594,6 +8595,7 @@ static int remove_and_add_spares(struct mddev *mddev, + if (mddev->pers->hot_remove_disk( + mddev, rdev) == 0) { + sysfs_unlink_rdev(mddev, rdev); ++ rdev->saved_raid_disk = rdev->raid_disk; + rdev->raid_disk = -1; + removed++; + } +diff --git a/drivers/media/dvb-core/dvb_frontend.c b/drivers/media/dvb-core/dvb_frontend.c +index 33d844fe2e70..f7d4ec37fdbc 100644 +--- a/drivers/media/dvb-core/dvb_frontend.c ++++ b/drivers/media/dvb-core/dvb_frontend.c +@@ -275,8 +275,20 @@ static void dvb_frontend_add_event(struct dvb_frontend *fe, + wake_up_interruptible (&events->wait_queue); + } + ++static int dvb_frontend_test_event(struct dvb_frontend_private *fepriv, ++ struct dvb_fe_events *events) ++{ ++ int ret; ++ ++ up(&fepriv->sem); ++ ret = events->eventw != events->eventr; ++ down(&fepriv->sem); ++ ++ return ret; ++} ++ + static int dvb_frontend_get_event(struct dvb_frontend *fe, +- struct dvb_frontend_event *event, int flags) ++ struct dvb_frontend_event *event, int flags) + { + struct dvb_frontend_private *fepriv = fe->frontend_priv; + struct dvb_fe_events *events = &fepriv->events; +@@ -294,13 +306,8 @@ static int dvb_frontend_get_event(struct dvb_frontend *fe, + if (flags & O_NONBLOCK) + return -EWOULDBLOCK; + +- up(&fepriv->sem); +- +- ret = wait_event_interruptible (events->wait_queue, +- events->eventw != events->eventr); +- +- if (down_interruptible (&fepriv->sem)) +- return -ERESTARTSYS; ++ ret = wait_event_interruptible(events->wait_queue, ++ dvb_frontend_test_event(fepriv, events)); + + if (ret < 0) + return ret; +diff --git a/drivers/media/platform/vsp1/vsp1_video.c b/drivers/media/platform/vsp1/vsp1_video.c +index c2d3b8f0f487..93f69b3ac911 100644 +--- a/drivers/media/platform/vsp1/vsp1_video.c ++++ b/drivers/media/platform/vsp1/vsp1_video.c +@@ -849,9 +849,8 @@ static int vsp1_video_setup_pipeline(struct vsp1_pipeline *pipe) + return 0; + } + +-static void vsp1_video_cleanup_pipeline(struct vsp1_pipeline *pipe) ++static void vsp1_video_release_buffers(struct vsp1_video *video) + { +- struct vsp1_video *video = pipe->output->video; + struct vsp1_vb2_buffer *buffer; + unsigned long flags; + +@@ -861,12 +860,18 @@ static void vsp1_video_cleanup_pipeline(struct vsp1_pipeline *pipe) + vb2_buffer_done(&buffer->buf.vb2_buf, VB2_BUF_STATE_ERROR); + INIT_LIST_HEAD(&video->irqqueue); + spin_unlock_irqrestore(&video->irqlock, flags); ++} ++ ++static void vsp1_video_cleanup_pipeline(struct vsp1_pipeline *pipe) ++{ ++ lockdep_assert_held(&pipe->lock); + + /* Release our partition table allocation */ +- mutex_lock(&pipe->lock); + kfree(pipe->part_table); + pipe->part_table = NULL; +- mutex_unlock(&pipe->lock); ++ ++ vsp1_dl_list_put(pipe->dl); ++ pipe->dl = NULL; + } + + static int vsp1_video_start_streaming(struct vb2_queue *vq, unsigned int count) +@@ -881,8 +886,9 @@ static int vsp1_video_start_streaming(struct vb2_queue *vq, unsigned int count) + if (pipe->stream_count == pipe->num_inputs) { + ret = vsp1_video_setup_pipeline(pipe); + if (ret < 0) { +- mutex_unlock(&pipe->lock); ++ vsp1_video_release_buffers(video); + vsp1_video_cleanup_pipeline(pipe); ++ mutex_unlock(&pipe->lock); + return ret; + } + +@@ -932,13 +938,12 @@ static void vsp1_video_stop_streaming(struct vb2_queue *vq) + if (ret == -ETIMEDOUT) + dev_err(video->vsp1->dev, "pipeline stop timeout\n"); + +- vsp1_dl_list_put(pipe->dl); +- pipe->dl = NULL; ++ vsp1_video_cleanup_pipeline(pipe); + } + mutex_unlock(&pipe->lock); + + media_pipeline_stop(&video->video.entity); +- vsp1_video_cleanup_pipeline(pipe); ++ vsp1_video_release_buffers(video); + vsp1_video_pipeline_put(pipe); + } + +diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c +index 9b742d569fb5..c30cb0fb165d 100644 +--- a/drivers/media/usb/cx231xx/cx231xx-cards.c ++++ b/drivers/media/usb/cx231xx/cx231xx-cards.c +@@ -918,6 +918,9 @@ struct usb_device_id cx231xx_id_table[] = { + .driver_info = CX231XX_BOARD_CNXT_RDE_250}, + {USB_DEVICE(0x0572, 0x58A0), + .driver_info = CX231XX_BOARD_CNXT_RDU_250}, ++ /* AverMedia DVD EZMaker 7 */ ++ {USB_DEVICE(0x07ca, 0xc039), ++ .driver_info = CX231XX_BOARD_CNXT_VIDEO_GRABBER}, + {USB_DEVICE(0x2040, 0xb110), + .driver_info = CX231XX_BOARD_HAUPPAUGE_USB2_FM_PAL}, + {USB_DEVICE(0x2040, 0xb111), +diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +index 6730fd08ef03..e159dfc21279 100644 +--- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c ++++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c +@@ -871,7 +871,7 @@ static int put_v4l2_ext_controls32(struct file *file, + get_user(kcontrols, &kp->controls)) + return -EFAULT; + +- if (!count) ++ if (!count || count > (U32_MAX/sizeof(*ucontrols))) + return 0; + if (get_user(p, &up->controls)) + return -EFAULT; +diff --git a/drivers/mfd/intel-lpss-pci.c b/drivers/mfd/intel-lpss-pci.c +index d1c46de89eb4..d9ae983095c5 100644 +--- a/drivers/mfd/intel-lpss-pci.c ++++ b/drivers/mfd/intel-lpss-pci.c +@@ -124,6 +124,11 @@ static const struct intel_lpss_platform_info apl_i2c_info = { + .properties = apl_i2c_properties, + }; + ++static const struct intel_lpss_platform_info cnl_i2c_info = { ++ .clk_rate = 216000000, ++ .properties = spt_i2c_properties, ++}; ++ + static const struct pci_device_id intel_lpss_pci_ids[] = { + /* BXT A-Step */ + { PCI_VDEVICE(INTEL, 0x0aac), (kernel_ulong_t)&bxt_i2c_info }, +@@ -207,13 +212,13 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0x9daa), (kernel_ulong_t)&spt_info }, + { PCI_VDEVICE(INTEL, 0x9dab), (kernel_ulong_t)&spt_info }, + { PCI_VDEVICE(INTEL, 0x9dfb), (kernel_ulong_t)&spt_info }, +- { PCI_VDEVICE(INTEL, 0x9dc5), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x9dc6), (kernel_ulong_t)&spt_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9dc5), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9dc6), (kernel_ulong_t)&cnl_i2c_info }, + { PCI_VDEVICE(INTEL, 0x9dc7), (kernel_ulong_t)&spt_uart_info }, +- { PCI_VDEVICE(INTEL, 0x9de8), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x9de9), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x9dea), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0x9deb), (kernel_ulong_t)&spt_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9de8), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9de9), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9dea), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0x9deb), (kernel_ulong_t)&cnl_i2c_info }, + /* SPT-H */ + { PCI_VDEVICE(INTEL, 0xa127), (kernel_ulong_t)&spt_uart_info }, + { PCI_VDEVICE(INTEL, 0xa128), (kernel_ulong_t)&spt_uart_info }, +@@ -240,10 +245,10 @@ static const struct pci_device_id intel_lpss_pci_ids[] = { + { PCI_VDEVICE(INTEL, 0xa32b), (kernel_ulong_t)&spt_info }, + { PCI_VDEVICE(INTEL, 0xa37b), (kernel_ulong_t)&spt_info }, + { PCI_VDEVICE(INTEL, 0xa347), (kernel_ulong_t)&spt_uart_info }, +- { PCI_VDEVICE(INTEL, 0xa368), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0xa369), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0xa36a), (kernel_ulong_t)&spt_i2c_info }, +- { PCI_VDEVICE(INTEL, 0xa36b), (kernel_ulong_t)&spt_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0xa368), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0xa369), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0xa36a), (kernel_ulong_t)&cnl_i2c_info }, ++ { PCI_VDEVICE(INTEL, 0xa36b), (kernel_ulong_t)&cnl_i2c_info }, + { } + }; + MODULE_DEVICE_TABLE(pci, intel_lpss_pci_ids); +diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c +index 0e0ab9bb1530..40e8d9b59d07 100644 +--- a/drivers/mfd/intel-lpss.c ++++ b/drivers/mfd/intel-lpss.c +@@ -275,11 +275,11 @@ static void intel_lpss_init_dev(const struct intel_lpss *lpss) + + intel_lpss_deassert_reset(lpss); + ++ intel_lpss_set_remap_addr(lpss); ++ + if (!intel_lpss_has_idma(lpss)) + return; + +- intel_lpss_set_remap_addr(lpss); +- + /* Make sure that SPI multiblock DMA transfers are re-enabled */ + if (lpss->type == LPSS_DEV_SPI) + writel(value, lpss->priv + LPSS_PRIV_SSP_REG); +diff --git a/drivers/misc/cxl/sysfs.c b/drivers/misc/cxl/sysfs.c +index a8b6d6a635e9..393a80bdb846 100644 +--- a/drivers/misc/cxl/sysfs.c ++++ b/drivers/misc/cxl/sysfs.c +@@ -331,12 +331,20 @@ static ssize_t prefault_mode_store(struct device *device, + struct cxl_afu *afu = to_cxl_afu(device); + enum prefault_modes mode = -1; + +- if (!strncmp(buf, "work_element_descriptor", 23)) +- mode = CXL_PREFAULT_WED; +- if (!strncmp(buf, "all", 3)) +- mode = CXL_PREFAULT_ALL; + if (!strncmp(buf, "none", 4)) + mode = CXL_PREFAULT_NONE; ++ else { ++ if (!radix_enabled()) { ++ ++ /* only allowed when not in radix mode */ ++ if (!strncmp(buf, "work_element_descriptor", 23)) ++ mode = CXL_PREFAULT_WED; ++ if (!strncmp(buf, "all", 3)) ++ mode = CXL_PREFAULT_ALL; ++ } else { ++ dev_err(device, "Cannot prefault with radix enabled\n"); ++ } ++ } + + if (mode == -1) + return -EINVAL; +diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c +index d524a64ed754..ac76c10c042f 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -1880,7 +1880,7 @@ static int __xipram do_write_buffer(struct map_info *map, struct flchip *chip, + if (time_after(jiffies, timeo) && !chip_ready(map, adr)) + break; + +- if (chip_ready(map, adr)) { ++ if (chip_good(map, adr, datum)) { + xip_enable(map, chip, adr); + goto op_done; + } +@@ -2535,7 +2535,7 @@ static int cfi_atmel_unlock(struct mtd_info *mtd, loff_t ofs, uint64_t len) + + struct ppb_lock { + struct flchip *chip; +- loff_t offset; ++ unsigned long adr; + int locked; + }; + +@@ -2553,8 +2553,9 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map, + unsigned long timeo; + int ret; + ++ adr += chip->start; + mutex_lock(&chip->mutex); +- ret = get_chip(map, chip, adr + chip->start, FL_LOCKING); ++ ret = get_chip(map, chip, adr, FL_LOCKING); + if (ret) { + mutex_unlock(&chip->mutex); + return ret; +@@ -2572,8 +2573,8 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map, + + if (thunk == DO_XXLOCK_ONEBLOCK_LOCK) { + chip->state = FL_LOCKING; +- map_write(map, CMD(0xA0), chip->start + adr); +- map_write(map, CMD(0x00), chip->start + adr); ++ map_write(map, CMD(0xA0), adr); ++ map_write(map, CMD(0x00), adr); + } else if (thunk == DO_XXLOCK_ONEBLOCK_UNLOCK) { + /* + * Unlocking of one specific sector is not supported, so we +@@ -2611,7 +2612,7 @@ static int __maybe_unused do_ppb_xxlock(struct map_info *map, + map_write(map, CMD(0x00), chip->start); + + chip->state = FL_READY; +- put_chip(map, chip, adr + chip->start); ++ put_chip(map, chip, adr); + mutex_unlock(&chip->mutex); + + return ret; +@@ -2668,9 +2669,9 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs, + * sectors shall be unlocked, so lets keep their locking + * status at "unlocked" (locked=0) for the final re-locking. + */ +- if ((adr < ofs) || (adr >= (ofs + len))) { ++ if ((offset < ofs) || (offset >= (ofs + len))) { + sect[sectors].chip = &cfi->chips[chipnum]; +- sect[sectors].offset = offset; ++ sect[sectors].adr = adr; + sect[sectors].locked = do_ppb_xxlock( + map, &cfi->chips[chipnum], adr, 0, + DO_XXLOCK_ONEBLOCK_GETLOCK); +@@ -2684,6 +2685,8 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs, + i++; + + if (adr >> cfi->chipshift) { ++ if (offset >= (ofs + len)) ++ break; + adr = 0; + chipnum++; + +@@ -2714,7 +2717,7 @@ static int __maybe_unused cfi_ppb_unlock(struct mtd_info *mtd, loff_t ofs, + */ + for (i = 0; i < sectors; i++) { + if (sect[i].locked) +- do_ppb_xxlock(map, sect[i].chip, sect[i].offset, 0, ++ do_ppb_xxlock(map, sect[i].chip, sect[i].adr, 0, + DO_XXLOCK_ONEBLOCK_LOCK); + } + +diff --git a/drivers/mtd/ubi/build.c b/drivers/mtd/ubi/build.c +index defb1cd8d2e1..18a72da759a0 100644 +--- a/drivers/mtd/ubi/build.c ++++ b/drivers/mtd/ubi/build.c +@@ -1082,6 +1082,9 @@ int ubi_detach_mtd_dev(int ubi_num, int anyway) + if (ubi->bgt_thread) + kthread_stop(ubi->bgt_thread); + ++#ifdef CONFIG_MTD_UBI_FASTMAP ++ cancel_work_sync(&ubi->fm_work); ++#endif + ubi_debugfs_exit_dev(ubi); + uif_close(ubi); + +diff --git a/drivers/mtd/ubi/eba.c b/drivers/mtd/ubi/eba.c +index 388e46be6ad9..d0884bd9d955 100644 +--- a/drivers/mtd/ubi/eba.c ++++ b/drivers/mtd/ubi/eba.c +@@ -490,6 +490,82 @@ int ubi_eba_unmap_leb(struct ubi_device *ubi, struct ubi_volume *vol, + return err; + } + ++#ifdef CONFIG_MTD_UBI_FASTMAP ++/** ++ * check_mapping - check and fixup a mapping ++ * @ubi: UBI device description object ++ * @vol: volume description object ++ * @lnum: logical eraseblock number ++ * @pnum: physical eraseblock number ++ * ++ * Checks whether a given mapping is valid. Fastmap cannot track LEB unmap ++ * operations, if such an operation is interrupted the mapping still looks ++ * good, but upon first read an ECC is reported to the upper layer. ++ * Normaly during the full-scan at attach time this is fixed, for Fastmap ++ * we have to deal with it while reading. ++ * If the PEB behind a LEB shows this symthom we change the mapping to ++ * %UBI_LEB_UNMAPPED and schedule the PEB for erasure. ++ * ++ * Returns 0 on success, negative error code in case of failure. ++ */ ++static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int lnum, ++ int *pnum) ++{ ++ int err; ++ struct ubi_vid_io_buf *vidb; ++ ++ if (!ubi->fast_attach) ++ return 0; ++ ++ vidb = ubi_alloc_vid_buf(ubi, GFP_NOFS); ++ if (!vidb) ++ return -ENOMEM; ++ ++ err = ubi_io_read_vid_hdr(ubi, *pnum, vidb, 0); ++ if (err > 0 && err != UBI_IO_BITFLIPS) { ++ int torture = 0; ++ ++ switch (err) { ++ case UBI_IO_FF: ++ case UBI_IO_FF_BITFLIPS: ++ case UBI_IO_BAD_HDR: ++ case UBI_IO_BAD_HDR_EBADMSG: ++ break; ++ default: ++ ubi_assert(0); ++ } ++ ++ if (err == UBI_IO_BAD_HDR_EBADMSG || err == UBI_IO_FF_BITFLIPS) ++ torture = 1; ++ ++ down_read(&ubi->fm_eba_sem); ++ vol->eba_tbl->entries[lnum].pnum = UBI_LEB_UNMAPPED; ++ up_read(&ubi->fm_eba_sem); ++ ubi_wl_put_peb(ubi, vol->vol_id, lnum, *pnum, torture); ++ ++ *pnum = UBI_LEB_UNMAPPED; ++ } else if (err < 0) { ++ ubi_err(ubi, "unable to read VID header back from PEB %i: %i", ++ *pnum, err); ++ ++ goto out_free; ++ } ++ ++ err = 0; ++ ++out_free: ++ ubi_free_vid_buf(vidb); ++ ++ return err; ++} ++#else ++static int check_mapping(struct ubi_device *ubi, struct ubi_volume *vol, int lnum, ++ int *pnum) ++{ ++ return 0; ++} ++#endif ++ + /** + * ubi_eba_read_leb - read data. + * @ubi: UBI device description object +@@ -522,7 +598,13 @@ int ubi_eba_read_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum, + return err; + + pnum = vol->eba_tbl->entries[lnum].pnum; +- if (pnum < 0) { ++ if (pnum >= 0) { ++ err = check_mapping(ubi, vol, lnum, &pnum); ++ if (err < 0) ++ goto out_unlock; ++ } ++ ++ if (pnum == UBI_LEB_UNMAPPED) { + /* + * The logical eraseblock is not mapped, fill the whole buffer + * with 0xFF bytes. The exception is static volumes for which +@@ -930,6 +1012,12 @@ int ubi_eba_write_leb(struct ubi_device *ubi, struct ubi_volume *vol, int lnum, + return err; + + pnum = vol->eba_tbl->entries[lnum].pnum; ++ if (pnum >= 0) { ++ err = check_mapping(ubi, vol, lnum, &pnum); ++ if (err < 0) ++ goto out; ++ } ++ + if (pnum >= 0) { + dbg_eba("write %d bytes at offset %d of LEB %d:%d, PEB %d", + len, offset, vol_id, lnum, pnum); +diff --git a/drivers/mtd/ubi/wl.c b/drivers/mtd/ubi/wl.c +index 668b46202507..23a6986d512b 100644 +--- a/drivers/mtd/ubi/wl.c ++++ b/drivers/mtd/ubi/wl.c +@@ -1505,6 +1505,7 @@ int ubi_thread(void *u) + } + + dbg_wl("background thread \"%s\" is killed", ubi->bgt_name); ++ ubi->thread_enabled = 0; + return 0; + } + +@@ -1514,9 +1515,6 @@ int ubi_thread(void *u) + */ + static void shutdown_work(struct ubi_device *ubi) + { +-#ifdef CONFIG_MTD_UBI_FASTMAP +- flush_work(&ubi->fm_work); +-#endif + while (!list_empty(&ubi->works)) { + struct ubi_work *wrk; + +diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c +index baf283986a7e..2fffd42767c7 100644 +--- a/drivers/nvdimm/bus.c ++++ b/drivers/nvdimm/bus.c +@@ -565,14 +565,18 @@ int nvdimm_revalidate_disk(struct gendisk *disk) + { + struct device *dev = disk_to_dev(disk)->parent; + struct nd_region *nd_region = to_nd_region(dev->parent); +- const char *pol = nd_region->ro ? "only" : "write"; ++ int disk_ro = get_disk_ro(disk); + +- if (nd_region->ro == get_disk_ro(disk)) ++ /* ++ * Upgrade to read-only if the region is read-only preserve as ++ * read-only if the disk is already read-only. ++ */ ++ if (disk_ro || nd_region->ro == disk_ro) + return 0; + +- dev_info(dev, "%s read-%s, marking %s read-%s\n", +- dev_name(&nd_region->dev), pol, disk->disk_name, pol); +- set_disk_ro(disk, nd_region->ro); ++ dev_info(dev, "%s read-only, marking %s read-only\n", ++ dev_name(&nd_region->dev), disk->disk_name); ++ set_disk_ro(disk, 1); + + return 0; + +diff --git a/drivers/of/platform.c b/drivers/of/platform.c +index ac15d0e3d27d..0f49718c6012 100644 +--- a/drivers/of/platform.c ++++ b/drivers/of/platform.c +@@ -533,6 +533,9 @@ int of_platform_device_destroy(struct device *dev, void *data) + if (of_node_check_flag(dev->of_node, OF_POPULATED_BUS)) + device_for_each_child(dev, NULL, of_platform_device_destroy); + ++ of_node_clear_flag(dev->of_node, OF_POPULATED); ++ of_node_clear_flag(dev->of_node, OF_POPULATED_BUS); ++ + if (dev->bus == &platform_bus_type) + platform_device_unregister(to_platform_device(dev)); + #ifdef CONFIG_ARM_AMBA +@@ -540,8 +543,6 @@ int of_platform_device_destroy(struct device *dev, void *data) + amba_device_unregister(to_amba_device(dev)); + #endif + +- of_node_clear_flag(dev->of_node, OF_POPULATED); +- of_node_clear_flag(dev->of_node, OF_POPULATED_BUS); + return 0; + } + EXPORT_SYMBOL_GPL(of_platform_device_destroy); +diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c +index 99309cb7d372..3bf4b6489fd0 100644 +--- a/drivers/of/resolver.c ++++ b/drivers/of/resolver.c +@@ -129,6 +129,11 @@ static int update_usages_of_a_phandle_reference(struct device_node *overlay, + goto err_fail; + } + ++ if (offset < 0 || offset + sizeof(__be32) > prop->length) { ++ err = -EINVAL; ++ goto err_fail; ++ } ++ + *(__be32 *)(prop->value + offset) = cpu_to_be32(phandle); + } + +diff --git a/drivers/of/unittest.c b/drivers/of/unittest.c +index 168ef0bbabde..985a85f281a8 100644 +--- a/drivers/of/unittest.c ++++ b/drivers/of/unittest.c +@@ -164,20 +164,20 @@ static void __init of_unittest_dynamic(void) + /* Add a new property - should pass*/ + prop->name = "new-property"; + prop->value = "new-property-data"; +- prop->length = strlen(prop->value); ++ prop->length = strlen(prop->value) + 1; + unittest(of_add_property(np, prop) == 0, "Adding a new property failed\n"); + + /* Try to add an existing property - should fail */ + prop++; + prop->name = "new-property"; + prop->value = "new-property-data-should-fail"; +- prop->length = strlen(prop->value); ++ prop->length = strlen(prop->value) + 1; + unittest(of_add_property(np, prop) != 0, + "Adding an existing property should have failed\n"); + + /* Try to modify an existing property - should pass */ + prop->value = "modify-property-data-should-pass"; +- prop->length = strlen(prop->value); ++ prop->length = strlen(prop->value) + 1; + unittest(of_update_property(np, prop) == 0, + "Updating an existing property should have passed\n"); + +@@ -185,7 +185,7 @@ static void __init of_unittest_dynamic(void) + prop++; + prop->name = "modify-property"; + prop->value = "modify-missing-property-data-should-pass"; +- prop->length = strlen(prop->value); ++ prop->length = strlen(prop->value) + 1; + unittest(of_update_property(np, prop) == 0, + "Updating a missing property should have passed\n"); + +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 0b750228ad70..caea7c618207 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -1610,17 +1610,6 @@ static struct hv_pci_dev *new_pcichild_device(struct hv_pcibus_device *hbus, + get_pcichild(hpdev, hv_pcidev_ref_childlist); + spin_lock_irqsave(&hbus->device_list_lock, flags); + +- /* +- * When a device is being added to the bus, we set the PCI domain +- * number to be the device serial number, which is non-zero and +- * unique on the same VM. The serial numbers start with 1, and +- * increase by 1 for each device. So device names including this +- * can have shorter names than based on the bus instance UUID. +- * Only the first device serial number is used for domain, so the +- * domain number will not change after the first device is added. +- */ +- if (list_empty(&hbus->children)) +- hbus->sysdata.domain = desc->ser; + list_add_tail(&hpdev->list_entry, &hbus->children); + spin_unlock_irqrestore(&hbus->device_list_lock, flags); + return hpdev; +diff --git a/drivers/pci/hotplug/pciehp.h b/drivers/pci/hotplug/pciehp.h +index 06109d40c4ac..e7d6cfaf3865 100644 +--- a/drivers/pci/hotplug/pciehp.h ++++ b/drivers/pci/hotplug/pciehp.h +@@ -134,7 +134,7 @@ struct controller *pcie_init(struct pcie_device *dev); + int pcie_init_notification(struct controller *ctrl); + int pciehp_enable_slot(struct slot *p_slot); + int pciehp_disable_slot(struct slot *p_slot); +-void pcie_enable_notification(struct controller *ctrl); ++void pcie_reenable_notification(struct controller *ctrl); + int pciehp_power_on_slot(struct slot *slot); + void pciehp_power_off_slot(struct slot *slot); + void pciehp_get_power_status(struct slot *slot, u8 *status); +diff --git a/drivers/pci/hotplug/pciehp_core.c b/drivers/pci/hotplug/pciehp_core.c +index 35d84845d5af..1288289cc85d 100644 +--- a/drivers/pci/hotplug/pciehp_core.c ++++ b/drivers/pci/hotplug/pciehp_core.c +@@ -297,7 +297,7 @@ static int pciehp_resume(struct pcie_device *dev) + ctrl = get_service_data(dev); + + /* reinitialize the chipset's event detection logic */ +- pcie_enable_notification(ctrl); ++ pcie_reenable_notification(ctrl); + + slot = ctrl->slot; + +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index e5d5ce9e3010..05832b597e53 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -676,7 +676,7 @@ static irqreturn_t pcie_isr(int irq, void *dev_id) + return handled; + } + +-void pcie_enable_notification(struct controller *ctrl) ++static void pcie_enable_notification(struct controller *ctrl) + { + u16 cmd, mask; + +@@ -714,6 +714,17 @@ void pcie_enable_notification(struct controller *ctrl) + pci_pcie_cap(ctrl->pcie->port) + PCI_EXP_SLTCTL, cmd); + } + ++void pcie_reenable_notification(struct controller *ctrl) ++{ ++ /* ++ * Clear both Presence and Data Link Layer Changed to make sure ++ * those events still fire after we have re-enabled them. ++ */ ++ pcie_capability_write_word(ctrl->pcie->port, PCI_EXP_SLTSTA, ++ PCI_EXP_SLTSTA_PDC | PCI_EXP_SLTSTA_DLLSC); ++ pcie_enable_notification(ctrl); ++} ++ + static void pcie_disable_notification(struct controller *ctrl) + { + u16 mask; +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index 929d68f744af..ec2911c4ee42 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4377,11 +4377,29 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) + * 0xa290-0xa29f PCI Express Root port #{0-16} + * 0xa2e7-0xa2ee PCI Express Root port #{17-24} + * ++ * Mobile chipsets are also affected, 7th & 8th Generation ++ * Specification update confirms ACS errata 22, status no fix: (7th Generation ++ * Intel Processor Family I/O for U/Y Platforms and 8th Generation Intel ++ * Processor Family I/O for U Quad Core Platforms Specification Update, ++ * August 2017, Revision 002, Document#: 334660-002)[6] ++ * Device IDs from I/O datasheet: (7th Generation Intel Processor Family I/O ++ * for U/Y Platforms and 8th Generation Intel ® Processor Family I/O for U ++ * Quad Core Platforms, Vol 1 of 2, August 2017, Document#: 334658-003)[7] ++ * ++ * 0x9d10-0x9d1b PCI Express Root port #{1-12} ++ * ++ * The 300 series chipset suffers from the same bug so include those root ++ * ports here as well. ++ * ++ * 0xa32c-0xa343 PCI Express Root port #{0-24} ++ * + * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html + * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html + * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html + * [4] http://www.intel.com/content/www/us/en/chipsets/200-series-chipset-pch-spec-update.html + * [5] http://www.intel.com/content/www/us/en/chipsets/200-series-chipset-pch-datasheet-vol-1.html ++ * [6] https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-mobile-u-y-processor-lines-i-o-spec-update.html ++ * [7] https://www.intel.com/content/www/us/en/processors/core/7th-gen-core-family-mobile-u-y-processor-lines-i-o-datasheet-vol-1.html + */ + static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) + { +@@ -4391,6 +4409,8 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) + switch (dev->device) { + case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */ + case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */ ++ case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */ ++ case 0xa32c ... 0xa343: /* 300 series */ + return true; + } + +diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c +index b601039d6c69..c4aa411f5935 100644 +--- a/drivers/pinctrl/devicetree.c ++++ b/drivers/pinctrl/devicetree.c +@@ -101,10 +101,11 @@ struct pinctrl_dev *of_pinctrl_get(struct device_node *np) + } + + static int dt_to_map_one_config(struct pinctrl *p, +- struct pinctrl_dev *pctldev, ++ struct pinctrl_dev *hog_pctldev, + const char *statename, + struct device_node *np_config) + { ++ struct pinctrl_dev *pctldev = NULL; + struct device_node *np_pctldev; + const struct pinctrl_ops *ops; + int ret; +@@ -123,8 +124,10 @@ static int dt_to_map_one_config(struct pinctrl *p, + return -EPROBE_DEFER; + } + /* If we're creating a hog we can use the passed pctldev */ +- if (pctldev && (np_pctldev == p->dev->of_node)) ++ if (hog_pctldev && (np_pctldev == p->dev->of_node)) { ++ pctldev = hog_pctldev; + break; ++ } + pctldev = get_pinctrl_dev_from_of_node(np_pctldev); + if (pctldev) + break; +diff --git a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c +index 92aeea174a56..afeb4876ffb2 100644 +--- a/drivers/pinctrl/samsung/pinctrl-exynos-arm.c ++++ b/drivers/pinctrl/samsung/pinctrl-exynos-arm.c +@@ -110,12 +110,12 @@ static const struct samsung_pin_bank_data s5pv210_pin_bank[] __initconst = { + EXYNOS_PIN_BANK_EINTG(7, 0x1c0, "gpg1", 0x38), + EXYNOS_PIN_BANK_EINTG(7, 0x1e0, "gpg2", 0x3c), + EXYNOS_PIN_BANK_EINTG(7, 0x200, "gpg3", 0x40), +- EXYNOS_PIN_BANK_EINTN(7, 0x220, "gpi"), + EXYNOS_PIN_BANK_EINTG(8, 0x240, "gpj0", 0x44), + EXYNOS_PIN_BANK_EINTG(6, 0x260, "gpj1", 0x48), + EXYNOS_PIN_BANK_EINTG(8, 0x280, "gpj2", 0x4c), + EXYNOS_PIN_BANK_EINTG(8, 0x2a0, "gpj3", 0x50), + EXYNOS_PIN_BANK_EINTG(5, 0x2c0, "gpj4", 0x54), ++ EXYNOS_PIN_BANK_EINTN(7, 0x220, "gpi"), + EXYNOS_PIN_BANK_EINTN(8, 0x2e0, "mp01"), + EXYNOS_PIN_BANK_EINTN(4, 0x300, "mp02"), + EXYNOS_PIN_BANK_EINTN(8, 0x320, "mp03"), +@@ -635,7 +635,6 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = + EXYNOS_PIN_BANK_EINTG(4, 0x100, "gpc3", 0x20), + EXYNOS_PIN_BANK_EINTG(7, 0x120, "gpc1", 0x24), + EXYNOS_PIN_BANK_EINTG(7, 0x140, "gpc2", 0x28), +- EXYNOS_PIN_BANK_EINTN(2, 0x160, "gpm5"), + EXYNOS_PIN_BANK_EINTG(8, 0x180, "gpd1", 0x2c), + EXYNOS_PIN_BANK_EINTG(8, 0x1A0, "gpe0", 0x30), + EXYNOS_PIN_BANK_EINTG(2, 0x1C0, "gpe1", 0x34), +@@ -646,6 +645,7 @@ static const struct samsung_pin_bank_data exynos5410_pin_banks0[] __initconst = + EXYNOS_PIN_BANK_EINTG(2, 0x260, "gpg2", 0x48), + EXYNOS_PIN_BANK_EINTG(4, 0x280, "gph0", 0x4c), + EXYNOS_PIN_BANK_EINTG(8, 0x2A0, "gph1", 0x50), ++ EXYNOS_PIN_BANK_EINTN(2, 0x160, "gpm5"), + EXYNOS_PIN_BANK_EINTN(8, 0x2C0, "gpm7"), + EXYNOS_PIN_BANK_EINTN(6, 0x2E0, "gpy0"), + EXYNOS_PIN_BANK_EINTN(4, 0x300, "gpy1"), +diff --git a/drivers/pwm/pwm-lpss-platform.c b/drivers/pwm/pwm-lpss-platform.c +index 5d6ed1507d29..5561b9e190f8 100644 +--- a/drivers/pwm/pwm-lpss-platform.c ++++ b/drivers/pwm/pwm-lpss-platform.c +@@ -74,6 +74,10 @@ static int pwm_lpss_remove_platform(struct platform_device *pdev) + return pwm_lpss_remove(lpwm); + } + ++static SIMPLE_DEV_PM_OPS(pwm_lpss_platform_pm_ops, ++ pwm_lpss_suspend, ++ pwm_lpss_resume); ++ + static const struct acpi_device_id pwm_lpss_acpi_match[] = { + { "80860F09", (unsigned long)&pwm_lpss_byt_info }, + { "80862288", (unsigned long)&pwm_lpss_bsw_info }, +@@ -86,6 +90,7 @@ static struct platform_driver pwm_lpss_driver_platform = { + .driver = { + .name = "pwm-lpss", + .acpi_match_table = pwm_lpss_acpi_match, ++ .pm = &pwm_lpss_platform_pm_ops, + }, + .probe = pwm_lpss_probe_platform, + .remove = pwm_lpss_remove_platform, +diff --git a/drivers/pwm/pwm-lpss.c b/drivers/pwm/pwm-lpss.c +index 8db0d40ccacd..4721a264bac2 100644 +--- a/drivers/pwm/pwm-lpss.c ++++ b/drivers/pwm/pwm-lpss.c +@@ -32,10 +32,13 @@ + /* Size of each PWM register space if multiple */ + #define PWM_SIZE 0x400 + ++#define MAX_PWMS 4 ++ + struct pwm_lpss_chip { + struct pwm_chip chip; + void __iomem *regs; + const struct pwm_lpss_boardinfo *info; ++ u32 saved_ctrl[MAX_PWMS]; + }; + + static inline struct pwm_lpss_chip *to_lpwm(struct pwm_chip *chip) +@@ -177,6 +180,9 @@ struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r, + unsigned long c; + int ret; + ++ if (WARN_ON(info->npwm > MAX_PWMS)) ++ return ERR_PTR(-ENODEV); ++ + lpwm = devm_kzalloc(dev, sizeof(*lpwm), GFP_KERNEL); + if (!lpwm) + return ERR_PTR(-ENOMEM); +@@ -212,6 +218,30 @@ int pwm_lpss_remove(struct pwm_lpss_chip *lpwm) + } + EXPORT_SYMBOL_GPL(pwm_lpss_remove); + ++int pwm_lpss_suspend(struct device *dev) ++{ ++ struct pwm_lpss_chip *lpwm = dev_get_drvdata(dev); ++ int i; ++ ++ for (i = 0; i < lpwm->info->npwm; i++) ++ lpwm->saved_ctrl[i] = readl(lpwm->regs + i * PWM_SIZE + PWM); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(pwm_lpss_suspend); ++ ++int pwm_lpss_resume(struct device *dev) ++{ ++ struct pwm_lpss_chip *lpwm = dev_get_drvdata(dev); ++ int i; ++ ++ for (i = 0; i < lpwm->info->npwm; i++) ++ writel(lpwm->saved_ctrl[i], lpwm->regs + i * PWM_SIZE + PWM); ++ ++ return 0; ++} ++EXPORT_SYMBOL_GPL(pwm_lpss_resume); ++ + MODULE_DESCRIPTION("PWM driver for Intel LPSS"); + MODULE_AUTHOR("Mika Westerberg "); + MODULE_LICENSE("GPL v2"); +diff --git a/drivers/pwm/pwm-lpss.h b/drivers/pwm/pwm-lpss.h +index 98306bb02cfe..7a4238ad1fcb 100644 +--- a/drivers/pwm/pwm-lpss.h ++++ b/drivers/pwm/pwm-lpss.h +@@ -28,5 +28,7 @@ struct pwm_lpss_boardinfo { + struct pwm_lpss_chip *pwm_lpss_probe(struct device *dev, struct resource *r, + const struct pwm_lpss_boardinfo *info); + int pwm_lpss_remove(struct pwm_lpss_chip *lpwm); ++int pwm_lpss_suspend(struct device *dev); ++int pwm_lpss_resume(struct device *dev); + + #endif /* __PWM_LPSS_H */ +diff --git a/drivers/rpmsg/qcom_smd.c b/drivers/rpmsg/qcom_smd.c +index b01774e9fac0..f1a2147a6d84 100644 +--- a/drivers/rpmsg/qcom_smd.c ++++ b/drivers/rpmsg/qcom_smd.c +@@ -1043,12 +1043,12 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed + void *info; + int ret; + +- channel = devm_kzalloc(&edge->dev, sizeof(*channel), GFP_KERNEL); ++ channel = kzalloc(sizeof(*channel), GFP_KERNEL); + if (!channel) + return ERR_PTR(-ENOMEM); + + channel->edge = edge; +- channel->name = devm_kstrdup(&edge->dev, name, GFP_KERNEL); ++ channel->name = kstrdup(name, GFP_KERNEL); + if (!channel->name) + return ERR_PTR(-ENOMEM); + +@@ -1098,8 +1098,8 @@ static struct qcom_smd_channel *qcom_smd_create_channel(struct qcom_smd_edge *ed + return channel; + + free_name_and_channel: +- devm_kfree(&edge->dev, channel->name); +- devm_kfree(&edge->dev, channel); ++ kfree(channel->name); ++ kfree(channel); + + return ERR_PTR(ret); + } +@@ -1320,13 +1320,13 @@ static int qcom_smd_parse_edge(struct device *dev, + */ + static void qcom_smd_edge_release(struct device *dev) + { +- struct qcom_smd_channel *channel; ++ struct qcom_smd_channel *channel, *tmp; + struct qcom_smd_edge *edge = to_smd_edge(dev); + +- list_for_each_entry(channel, &edge->channels, list) { +- SET_RX_CHANNEL_INFO(channel, state, SMD_CHANNEL_CLOSED); +- SET_RX_CHANNEL_INFO(channel, head, 0); +- SET_RX_CHANNEL_INFO(channel, tail, 0); ++ list_for_each_entry_safe(channel, tmp, &edge->channels, list) { ++ list_del(&channel->list); ++ kfree(channel->name); ++ kfree(channel); + } + + kfree(edge); +diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c +index 3d2216ccd860..8eb2b6dd36fe 100644 +--- a/drivers/rtc/rtc-sun6i.c ++++ b/drivers/rtc/rtc-sun6i.c +@@ -74,7 +74,7 @@ + #define SUN6I_ALARM_CONFIG_WAKEUP BIT(0) + + #define SUN6I_LOSC_OUT_GATING 0x0060 +-#define SUN6I_LOSC_OUT_GATING_EN BIT(0) ++#define SUN6I_LOSC_OUT_GATING_EN_OFFSET 0 + + /* + * Get date values +@@ -253,7 +253,7 @@ static void __init sun6i_rtc_clk_init(struct device_node *node) + &clkout_name); + rtc->ext_losc = clk_register_gate(NULL, clkout_name, rtc->hw.init->name, + 0, rtc->base + SUN6I_LOSC_OUT_GATING, +- SUN6I_LOSC_OUT_GATING_EN, 0, ++ SUN6I_LOSC_OUT_GATING_EN_OFFSET, 0, + &rtc->lock); + if (IS_ERR(rtc->ext_losc)) { + pr_crit("Couldn't register the LOSC external gate\n"); +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index 18c4f933e8b9..b415ba42ca73 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -664,6 +664,46 @@ void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc, + spin_unlock_irqrestore(&dbf->scsi_lock, flags); + } + ++/** ++ * zfcp_dbf_scsi_eh() - Trace event for special cases of scsi_eh callbacks. ++ * @tag: Identifier for event. ++ * @adapter: Pointer to zfcp adapter as context for this event. ++ * @scsi_id: SCSI ID/target to indicate scope of task management function (TMF). ++ * @ret: Return value of calling function. ++ * ++ * This SCSI trace variant does not depend on any of: ++ * scsi_cmnd, zfcp_fsf_req, scsi_device. ++ */ ++void zfcp_dbf_scsi_eh(char *tag, struct zfcp_adapter *adapter, ++ unsigned int scsi_id, int ret) ++{ ++ struct zfcp_dbf *dbf = adapter->dbf; ++ struct zfcp_dbf_scsi *rec = &dbf->scsi_buf; ++ unsigned long flags; ++ static int const level = 1; ++ ++ if (unlikely(!debug_level_enabled(adapter->dbf->scsi, level))) ++ return; ++ ++ spin_lock_irqsave(&dbf->scsi_lock, flags); ++ memset(rec, 0, sizeof(*rec)); ++ ++ memcpy(rec->tag, tag, ZFCP_DBF_TAG_LEN); ++ rec->id = ZFCP_DBF_SCSI_CMND; ++ rec->scsi_result = ret; /* re-use field, int is 4 bytes and fits */ ++ rec->scsi_retries = ~0; ++ rec->scsi_allowed = ~0; ++ rec->fcp_rsp_info = ~0; ++ rec->scsi_id = scsi_id; ++ rec->scsi_lun = (u32)ZFCP_DBF_INVALID_LUN; ++ rec->scsi_lun_64_hi = (u32)(ZFCP_DBF_INVALID_LUN >> 32); ++ rec->host_scribble = ~0; ++ memset(rec->scsi_opcode, 0xff, ZFCP_DBF_SCSI_OPCODE); ++ ++ debug_event(dbf->scsi, level, rec, sizeof(*rec)); ++ spin_unlock_irqrestore(&dbf->scsi_lock, flags); ++} ++ + static debug_info_t *zfcp_dbf_reg(const char *name, int size, int rec_size) + { + struct debug_info *d; +diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c +index cbb8156bf5e0..7aa243a6cdbf 100644 +--- a/drivers/s390/scsi/zfcp_erp.c ++++ b/drivers/s390/scsi/zfcp_erp.c +@@ -35,11 +35,28 @@ enum zfcp_erp_steps { + ZFCP_ERP_STEP_LUN_OPENING = 0x2000, + }; + ++/** ++ * enum zfcp_erp_act_type - Type of ERP action object. ++ * @ZFCP_ERP_ACTION_REOPEN_LUN: LUN recovery. ++ * @ZFCP_ERP_ACTION_REOPEN_PORT: Port recovery. ++ * @ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: Forced port recovery. ++ * @ZFCP_ERP_ACTION_REOPEN_ADAPTER: Adapter recovery. ++ * @ZFCP_ERP_ACTION_NONE: Eyecatcher pseudo flag to bitwise or-combine with ++ * either of the first four enum values. ++ * Used to indicate that an ERP action could not be ++ * set up despite a detected need for some recovery. ++ * @ZFCP_ERP_ACTION_FAILED: Eyecatcher pseudo flag to bitwise or-combine with ++ * either of the first four enum values. ++ * Used to indicate that ERP not needed because ++ * the object has ZFCP_STATUS_COMMON_ERP_FAILED. ++ */ + enum zfcp_erp_act_type { + ZFCP_ERP_ACTION_REOPEN_LUN = 1, + ZFCP_ERP_ACTION_REOPEN_PORT = 2, + ZFCP_ERP_ACTION_REOPEN_PORT_FORCED = 3, + ZFCP_ERP_ACTION_REOPEN_ADAPTER = 4, ++ ZFCP_ERP_ACTION_NONE = 0xc0, ++ ZFCP_ERP_ACTION_FAILED = 0xe0, + }; + + enum zfcp_erp_act_state { +@@ -126,6 +143,49 @@ static void zfcp_erp_action_dismiss_adapter(struct zfcp_adapter *adapter) + } + } + ++static int zfcp_erp_handle_failed(int want, struct zfcp_adapter *adapter, ++ struct zfcp_port *port, ++ struct scsi_device *sdev) ++{ ++ int need = want; ++ struct zfcp_scsi_dev *zsdev; ++ ++ switch (want) { ++ case ZFCP_ERP_ACTION_REOPEN_LUN: ++ zsdev = sdev_to_zfcp(sdev); ++ if (atomic_read(&zsdev->status) & ZFCP_STATUS_COMMON_ERP_FAILED) ++ need = 0; ++ break; ++ case ZFCP_ERP_ACTION_REOPEN_PORT_FORCED: ++ if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED) ++ need = 0; ++ break; ++ case ZFCP_ERP_ACTION_REOPEN_PORT: ++ if (atomic_read(&port->status) & ++ ZFCP_STATUS_COMMON_ERP_FAILED) { ++ need = 0; ++ /* ensure propagation of failed status to new devices */ ++ zfcp_erp_set_port_status( ++ port, ZFCP_STATUS_COMMON_ERP_FAILED); ++ } ++ break; ++ case ZFCP_ERP_ACTION_REOPEN_ADAPTER: ++ if (atomic_read(&adapter->status) & ++ ZFCP_STATUS_COMMON_ERP_FAILED) { ++ need = 0; ++ /* ensure propagation of failed status to new devices */ ++ zfcp_erp_set_adapter_status( ++ adapter, ZFCP_STATUS_COMMON_ERP_FAILED); ++ } ++ break; ++ default: ++ need = 0; ++ break; ++ } ++ ++ return need; ++} ++ + static int zfcp_erp_required_act(int want, struct zfcp_adapter *adapter, + struct zfcp_port *port, + struct scsi_device *sdev) +@@ -249,16 +309,27 @@ static int zfcp_erp_action_enqueue(int want, struct zfcp_adapter *adapter, + int retval = 1, need; + struct zfcp_erp_action *act; + +- if (!adapter->erp_thread) +- return -EIO; ++ need = zfcp_erp_handle_failed(want, adapter, port, sdev); ++ if (!need) { ++ need = ZFCP_ERP_ACTION_FAILED; /* marker for trace */ ++ goto out; ++ } ++ ++ if (!adapter->erp_thread) { ++ need = ZFCP_ERP_ACTION_NONE; /* marker for trace */ ++ retval = -EIO; ++ goto out; ++ } + + need = zfcp_erp_required_act(want, adapter, port, sdev); + if (!need) + goto out; + + act = zfcp_erp_setup_act(need, act_status, adapter, port, sdev); +- if (!act) ++ if (!act) { ++ need |= ZFCP_ERP_ACTION_NONE; /* marker for trace */ + goto out; ++ } + atomic_or(ZFCP_STATUS_ADAPTER_ERP_PENDING, &adapter->status); + ++adapter->erp_total_count; + list_add_tail(&act->list, &adapter->erp_ready_head); +@@ -269,18 +340,32 @@ static int zfcp_erp_action_enqueue(int want, struct zfcp_adapter *adapter, + return retval; + } + ++void zfcp_erp_port_forced_no_port_dbf(char *id, struct zfcp_adapter *adapter, ++ u64 port_name, u32 port_id) ++{ ++ unsigned long flags; ++ static /* don't waste stack */ struct zfcp_port tmpport; ++ ++ write_lock_irqsave(&adapter->erp_lock, flags); ++ /* Stand-in zfcp port with fields just good enough for ++ * zfcp_dbf_rec_trig() and zfcp_dbf_set_common(). ++ * Under lock because tmpport is static. ++ */ ++ atomic_set(&tmpport.status, -1); /* unknown */ ++ tmpport.wwpn = port_name; ++ tmpport.d_id = port_id; ++ zfcp_dbf_rec_trig(id, adapter, &tmpport, NULL, ++ ZFCP_ERP_ACTION_REOPEN_PORT_FORCED, ++ ZFCP_ERP_ACTION_NONE); ++ write_unlock_irqrestore(&adapter->erp_lock, flags); ++} ++ + static int _zfcp_erp_adapter_reopen(struct zfcp_adapter *adapter, + int clear_mask, char *id) + { + zfcp_erp_adapter_block(adapter, clear_mask); + zfcp_scsi_schedule_rports_block(adapter); + +- /* ensure propagation of failed status to new devices */ +- if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED) { +- zfcp_erp_set_adapter_status(adapter, +- ZFCP_STATUS_COMMON_ERP_FAILED); +- return -EIO; +- } + return zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, + adapter, NULL, NULL, id, 0); + } +@@ -299,12 +384,8 @@ void zfcp_erp_adapter_reopen(struct zfcp_adapter *adapter, int clear, char *id) + zfcp_scsi_schedule_rports_block(adapter); + + write_lock_irqsave(&adapter->erp_lock, flags); +- if (atomic_read(&adapter->status) & ZFCP_STATUS_COMMON_ERP_FAILED) +- zfcp_erp_set_adapter_status(adapter, +- ZFCP_STATUS_COMMON_ERP_FAILED); +- else +- zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, adapter, +- NULL, NULL, id, 0); ++ zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_ADAPTER, adapter, ++ NULL, NULL, id, 0); + write_unlock_irqrestore(&adapter->erp_lock, flags); + } + +@@ -345,9 +426,6 @@ static void _zfcp_erp_port_forced_reopen(struct zfcp_port *port, int clear, + zfcp_erp_port_block(port, clear); + zfcp_scsi_schedule_rport_block(port); + +- if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED) +- return; +- + zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_PORT_FORCED, + port->adapter, port, NULL, id, 0); + } +@@ -373,12 +451,6 @@ static int _zfcp_erp_port_reopen(struct zfcp_port *port, int clear, char *id) + zfcp_erp_port_block(port, clear); + zfcp_scsi_schedule_rport_block(port); + +- if (atomic_read(&port->status) & ZFCP_STATUS_COMMON_ERP_FAILED) { +- /* ensure propagation of failed status to new devices */ +- zfcp_erp_set_port_status(port, ZFCP_STATUS_COMMON_ERP_FAILED); +- return -EIO; +- } +- + return zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_PORT, + port->adapter, port, NULL, id, 0); + } +@@ -418,9 +490,6 @@ static void _zfcp_erp_lun_reopen(struct scsi_device *sdev, int clear, char *id, + + zfcp_erp_lun_block(sdev, clear); + +- if (atomic_read(&zfcp_sdev->status) & ZFCP_STATUS_COMMON_ERP_FAILED) +- return; +- + zfcp_erp_action_enqueue(ZFCP_ERP_ACTION_REOPEN_LUN, adapter, + zfcp_sdev->port, sdev, id, act_status); + } +diff --git a/drivers/s390/scsi/zfcp_ext.h b/drivers/s390/scsi/zfcp_ext.h +index b1cbb14fb2ae..c1092a11e728 100644 +--- a/drivers/s390/scsi/zfcp_ext.h ++++ b/drivers/s390/scsi/zfcp_ext.h +@@ -52,10 +52,15 @@ extern void zfcp_dbf_san_res(char *, struct zfcp_fsf_req *); + extern void zfcp_dbf_san_in_els(char *, struct zfcp_fsf_req *); + extern void zfcp_dbf_scsi(char *, int, struct scsi_cmnd *, + struct zfcp_fsf_req *); ++extern void zfcp_dbf_scsi_eh(char *tag, struct zfcp_adapter *adapter, ++ unsigned int scsi_id, int ret); + + /* zfcp_erp.c */ + extern void zfcp_erp_set_adapter_status(struct zfcp_adapter *, u32); + extern void zfcp_erp_clear_adapter_status(struct zfcp_adapter *, u32); ++extern void zfcp_erp_port_forced_no_port_dbf(char *id, ++ struct zfcp_adapter *adapter, ++ u64 port_name, u32 port_id); + extern void zfcp_erp_adapter_reopen(struct zfcp_adapter *, int, char *); + extern void zfcp_erp_adapter_shutdown(struct zfcp_adapter *, int, char *); + extern void zfcp_erp_set_port_status(struct zfcp_port *, u32); +diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c +index 22f9562f415c..0b6f51424745 100644 +--- a/drivers/s390/scsi/zfcp_scsi.c ++++ b/drivers/s390/scsi/zfcp_scsi.c +@@ -181,6 +181,7 @@ static int zfcp_scsi_eh_abort_handler(struct scsi_cmnd *scpnt) + if (abrt_req) + break; + ++ zfcp_dbf_scsi_abort("abrt_wt", scpnt, NULL); + zfcp_erp_wait(adapter); + ret = fc_block_scsi_eh(scpnt); + if (ret) { +@@ -277,6 +278,7 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) + if (fsf_req) + break; + ++ zfcp_dbf_scsi_devreset("wait", scpnt, tm_flags, NULL); + zfcp_erp_wait(adapter); + ret = fc_block_scsi_eh(scpnt); + if (ret) { +@@ -323,15 +325,16 @@ static int zfcp_scsi_eh_host_reset_handler(struct scsi_cmnd *scpnt) + { + struct zfcp_scsi_dev *zfcp_sdev = sdev_to_zfcp(scpnt->device); + struct zfcp_adapter *adapter = zfcp_sdev->port->adapter; +- int ret; ++ int ret = SUCCESS, fc_ret; + + zfcp_erp_adapter_reopen(adapter, 0, "schrh_1"); + zfcp_erp_wait(adapter); +- ret = fc_block_scsi_eh(scpnt); +- if (ret) +- return ret; ++ fc_ret = fc_block_scsi_eh(scpnt); ++ if (fc_ret) ++ ret = fc_ret; + +- return SUCCESS; ++ zfcp_dbf_scsi_eh("schrh_r", adapter, ~0, ret); ++ return ret; + } + + struct scsi_transport_template *zfcp_scsi_transport_template; +@@ -602,6 +605,11 @@ static void zfcp_scsi_terminate_rport_io(struct fc_rport *rport) + if (port) { + zfcp_erp_port_forced_reopen(port, 0, "sctrpi1"); + put_device(&port->dev); ++ } else { ++ zfcp_erp_port_forced_no_port_dbf( ++ "sctrpin", adapter, ++ rport->port_name /* zfcp_scsi_rport_register */, ++ rport->port_id /* zfcp_scsi_rport_register */); + } + } + +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 5fbaf13781b6..604a39dba5d0 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -8638,7 +8638,7 @@ static void hpsa_disable_rld_caching(struct ctlr_info *h) + kfree(options); + } + +-static void hpsa_shutdown(struct pci_dev *pdev) ++static void __hpsa_shutdown(struct pci_dev *pdev) + { + struct ctlr_info *h; + +@@ -8653,6 +8653,12 @@ static void hpsa_shutdown(struct pci_dev *pdev) + hpsa_disable_interrupt_mode(h); /* pci_init 2 */ + } + ++static void hpsa_shutdown(struct pci_dev *pdev) ++{ ++ __hpsa_shutdown(pdev); ++ pci_disable_device(pdev); ++} ++ + static void hpsa_free_device_info(struct ctlr_info *h) + { + int i; +@@ -8696,7 +8702,7 @@ static void hpsa_remove_one(struct pci_dev *pdev) + scsi_remove_host(h->scsi_host); /* init_one 8 */ + /* includes hpsa_free_irqs - init_one 4 */ + /* includes hpsa_disable_interrupt_mode - pci_init 2 */ +- hpsa_shutdown(pdev); ++ __hpsa_shutdown(pdev); + + hpsa_free_device_info(h); /* scan */ + +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index e24f57946a17..bcde6130f121 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -4627,7 +4627,8 @@ qla2x00_iidma_fcport(scsi_qla_host_t *vha, fc_port_t *fcport) + return; + + if (fcport->fp_speed == PORT_SPEED_UNKNOWN || +- fcport->fp_speed > ha->link_data_rate) ++ fcport->fp_speed > ha->link_data_rate || ++ !ha->flags.gpsc_supported) + return; + + rval = qla2x00_set_idma_speed(vha, fcport->loop_id, fcport->fp_speed, +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 13a00a42b3ca..e073eb16f8a4 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -2454,8 +2454,12 @@ qla2x00_status_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, void *pkt) + ox_id = le16_to_cpu(sts24->ox_id); + par_sense_len = sizeof(sts24->data); + /* Valid values of the retry delay timer are 0x1-0xffef */ +- if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) +- retry_delay = sts24->retry_delay; ++ if (sts24->retry_delay > 0 && sts24->retry_delay < 0xfff1) { ++ retry_delay = sts24->retry_delay & 0x3fff; ++ ql_dbg(ql_dbg_io, sp->vha, 0x3033, ++ "%s: scope=%#x retry_delay=%#x\n", __func__, ++ sts24->retry_delay >> 14, retry_delay); ++ } + } else { + if (scsi_status & SS_SENSE_LEN_VALID) + sense_len = le16_to_cpu(sts->req_sense_length); +diff --git a/drivers/soc/rockchip/pm_domains.c b/drivers/soc/rockchip/pm_domains.c +index 40b75748835f..ba009bb9d82b 100644 +--- a/drivers/soc/rockchip/pm_domains.c ++++ b/drivers/soc/rockchip/pm_domains.c +@@ -255,7 +255,7 @@ static void rockchip_do_pmu_set_power_domain(struct rockchip_pm_domain *pd, + return; + else if (pd->info->pwr_w_mask) + regmap_write(pmu->regmap, pmu->info->pwr_offset, +- on ? pd->info->pwr_mask : ++ on ? pd->info->pwr_w_mask : + (pd->info->pwr_mask | pd->info->pwr_w_mask)); + else + regmap_update_bits(pmu->regmap, pmu->info->pwr_offset, +diff --git a/drivers/thermal/broadcom/bcm2835_thermal.c b/drivers/thermal/broadcom/bcm2835_thermal.c +index a4d6a0e2e993..23ad4f9f2143 100644 +--- a/drivers/thermal/broadcom/bcm2835_thermal.c ++++ b/drivers/thermal/broadcom/bcm2835_thermal.c +@@ -213,8 +213,8 @@ static int bcm2835_thermal_probe(struct platform_device *pdev) + rate = clk_get_rate(data->clk); + if ((rate < 1920000) || (rate > 5000000)) + dev_warn(&pdev->dev, +- "Clock %pCn running at %pCr Hz is outside of the recommended range: 1.92 to 5MHz\n", +- data->clk, data->clk); ++ "Clock %pCn running at %lu Hz is outside of the recommended range: 1.92 to 5MHz\n", ++ data->clk, rate); + + /* register of thermal sensor and get info from DT */ + tz = thermal_zone_of_sensor_register(&pdev->dev, 0, data, +diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c +index c6daa315ee4e..8bc8fe2b75f7 100644 +--- a/drivers/tty/serial/sh-sci.c ++++ b/drivers/tty/serial/sh-sci.c +@@ -2854,16 +2854,15 @@ static void serial_console_write(struct console *co, const char *s, + unsigned long flags; + int locked = 1; + +- local_irq_save(flags); + #if defined(SUPPORT_SYSRQ) + if (port->sysrq) + locked = 0; + else + #endif + if (oops_in_progress) +- locked = spin_trylock(&port->lock); ++ locked = spin_trylock_irqsave(&port->lock, flags); + else +- spin_lock(&port->lock); ++ spin_lock_irqsave(&port->lock, flags); + + /* first save SCSCR then disable interrupts, keep clock source */ + ctrl = serial_port_in(port, SCSCR); +@@ -2883,8 +2882,7 @@ static void serial_console_write(struct console *co, const char *s, + serial_port_out(port, SCSCR, ctrl); + + if (locked) +- spin_unlock(&port->lock); +- local_irq_restore(flags); ++ spin_unlock_irqrestore(&port->lock, flags); + } + + static int serial_console_setup(struct console *co, char *options) +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 442be7f312f6..e5f77e611451 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4519,7 +4519,9 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, + * reset. But only on the first attempt, + * lest we get into a time out/reset loop + */ +- if (r == 0 || (r == -ETIMEDOUT && retries == 0)) ++ if (r == 0 || (r == -ETIMEDOUT && ++ retries == 0 && ++ udev->speed > USB_SPEED_FULL)) + break; + } + udev->descriptor.bMaxPacketSize0 = +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index d8b185b0d0f9..e5bccc6d49cf 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -3551,6 +3551,7 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) + del_timer_sync(&virt_dev->eps[i].stop_cmd_timer); + } + ++ virt_dev->udev = NULL; + xhci_disable_slot(xhci, udev->slot_id); + /* + * Event command completion handler will free any data structures +diff --git a/drivers/video/backlight/as3711_bl.c b/drivers/video/backlight/as3711_bl.c +index 734a9158946b..e55304d5cf07 100644 +--- a/drivers/video/backlight/as3711_bl.c ++++ b/drivers/video/backlight/as3711_bl.c +@@ -262,10 +262,10 @@ static int as3711_bl_register(struct platform_device *pdev, + static int as3711_backlight_parse_dt(struct device *dev) + { + struct as3711_bl_pdata *pdata = dev_get_platdata(dev); +- struct device_node *bl = +- of_find_node_by_name(dev->parent->of_node, "backlight"), *fb; ++ struct device_node *bl, *fb; + int ret; + ++ bl = of_get_child_by_name(dev->parent->of_node, "backlight"); + if (!bl) { + dev_dbg(dev, "backlight node not found\n"); + return -ENODEV; +@@ -279,7 +279,7 @@ static int as3711_backlight_parse_dt(struct device *dev) + if (pdata->su1_max_uA <= 0) + ret = -EINVAL; + if (ret < 0) +- return ret; ++ goto err_put_bl; + } + + fb = of_parse_phandle(bl, "su2-dev", 0); +@@ -292,7 +292,7 @@ static int as3711_backlight_parse_dt(struct device *dev) + if (pdata->su2_max_uA <= 0) + ret = -EINVAL; + if (ret < 0) +- return ret; ++ goto err_put_bl; + + if (of_find_property(bl, "su2-feedback-voltage", NULL)) { + pdata->su2_feedback = AS3711_SU2_VOLTAGE; +@@ -314,8 +314,10 @@ static int as3711_backlight_parse_dt(struct device *dev) + pdata->su2_feedback = AS3711_SU2_CURR_AUTO; + count++; + } +- if (count != 1) +- return -EINVAL; ++ if (count != 1) { ++ ret = -EINVAL; ++ goto err_put_bl; ++ } + + count = 0; + if (of_find_property(bl, "su2-fbprot-lx-sd4", NULL)) { +@@ -334,8 +336,10 @@ static int as3711_backlight_parse_dt(struct device *dev) + pdata->su2_fbprot = AS3711_SU2_GPIO4; + count++; + } +- if (count != 1) +- return -EINVAL; ++ if (count != 1) { ++ ret = -EINVAL; ++ goto err_put_bl; ++ } + + count = 0; + if (of_find_property(bl, "su2-auto-curr1", NULL)) { +@@ -355,11 +359,20 @@ static int as3711_backlight_parse_dt(struct device *dev) + * At least one su2-auto-curr* must be specified iff + * AS3711_SU2_CURR_AUTO is used + */ +- if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO)) +- return -EINVAL; ++ if (!count ^ (pdata->su2_feedback != AS3711_SU2_CURR_AUTO)) { ++ ret = -EINVAL; ++ goto err_put_bl; ++ } + } + ++ of_node_put(bl); ++ + return 0; ++ ++err_put_bl: ++ of_node_put(bl); ++ ++ return ret; + } + + static int as3711_backlight_probe(struct platform_device *pdev) +diff --git a/drivers/video/backlight/max8925_bl.c b/drivers/video/backlight/max8925_bl.c +index 7b738d60ecc2..f3aa6088f1d9 100644 +--- a/drivers/video/backlight/max8925_bl.c ++++ b/drivers/video/backlight/max8925_bl.c +@@ -116,7 +116,7 @@ static void max8925_backlight_dt_init(struct platform_device *pdev) + if (!pdata) + return; + +- np = of_find_node_by_name(nproot, "backlight"); ++ np = of_get_child_by_name(nproot, "backlight"); + if (!np) { + dev_err(&pdev->dev, "failed to find backlight node\n"); + return; +@@ -125,6 +125,8 @@ static void max8925_backlight_dt_init(struct platform_device *pdev) + if (!of_property_read_u32(np, "maxim,max8925-dual-string", &val)) + pdata->dual_string = val; + ++ of_node_put(np); ++ + pdev->dev.platform_data = pdata; + } + +diff --git a/drivers/video/backlight/tps65217_bl.c b/drivers/video/backlight/tps65217_bl.c +index fd524ad860a5..f45d0c9467db 100644 +--- a/drivers/video/backlight/tps65217_bl.c ++++ b/drivers/video/backlight/tps65217_bl.c +@@ -184,11 +184,11 @@ static struct tps65217_bl_pdata * + tps65217_bl_parse_dt(struct platform_device *pdev) + { + struct tps65217 *tps = dev_get_drvdata(pdev->dev.parent); +- struct device_node *node = of_node_get(tps->dev->of_node); ++ struct device_node *node; + struct tps65217_bl_pdata *pdata, *err; + u32 val; + +- node = of_find_node_by_name(node, "backlight"); ++ node = of_get_child_by_name(tps->dev->of_node, "backlight"); + if (!node) + return ERR_PTR(-ENODEV); + +diff --git a/drivers/video/fbdev/uvesafb.c b/drivers/video/fbdev/uvesafb.c +index 73676eb0244a..c592ca513115 100644 +--- a/drivers/video/fbdev/uvesafb.c ++++ b/drivers/video/fbdev/uvesafb.c +@@ -1044,7 +1044,8 @@ static int uvesafb_setcmap(struct fb_cmap *cmap, struct fb_info *info) + info->cmap.len || cmap->start < info->cmap.start) + return -EINVAL; + +- entries = kmalloc(sizeof(*entries) * cmap->len, GFP_KERNEL); ++ entries = kmalloc_array(cmap->len, sizeof(*entries), ++ GFP_KERNEL); + if (!entries) + return -ENOMEM; + +diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c +index 0c2a5a8327bd..6f9e9505b34c 100644 +--- a/drivers/w1/w1.c ++++ b/drivers/w1/w1.c +@@ -750,7 +750,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn) + + /* slave modules need to be loaded in a context with unlocked mutex */ + mutex_unlock(&dev->mutex); +- request_module("w1-family-0x%02x", rn->family); ++ request_module("w1-family-0x%02X", rn->family); + mutex_lock(&dev->mutex); + + spin_lock(&w1_flock); +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 762378f1811c..08e4af04d6f2 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -628,8 +628,6 @@ static void __unbind_from_irq(unsigned int irq) + xen_irq_info_cleanup(info); + } + +- BUG_ON(info_for_irq(irq)->type == IRQT_UNBOUND); +- + xen_free_irq(irq); + } + +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 3a07900971c3..f5b90dc137ec 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -9769,6 +9769,7 @@ static int btrfs_rename_exchange(struct inode *old_dir, + u64 new_idx = 0; + u64 root_objectid; + int ret; ++ int ret2; + bool root_log_pinned = false; + bool dest_log_pinned = false; + +@@ -9965,7 +9966,8 @@ static int btrfs_rename_exchange(struct inode *old_dir, + dest_log_pinned = false; + } + } +- ret = btrfs_end_transaction(trans); ++ ret2 = btrfs_end_transaction(trans); ++ ret = ret ? ret : ret2; + out_notrans: + if (new_ino == BTRFS_FIRST_FREE_OBJECTID) + up_read(&fs_info->subvol_sem); +diff --git a/fs/fuse/control.c b/fs/fuse/control.c +index b9ea99c5b5b3..5be0339dcceb 100644 +--- a/fs/fuse/control.c ++++ b/fs/fuse/control.c +@@ -211,10 +211,11 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent, + if (!dentry) + return NULL; + +- fc->ctl_dentry[fc->ctl_ndents++] = dentry; + inode = new_inode(fuse_control_sb); +- if (!inode) ++ if (!inode) { ++ dput(dentry); + return NULL; ++ } + + inode->i_ino = get_next_ino(); + inode->i_mode = mode; +@@ -228,6 +229,9 @@ static struct dentry *fuse_ctl_add_dentry(struct dentry *parent, + set_nlink(inode, nlink); + inode->i_private = fc; + d_add(dentry, inode); ++ ++ fc->ctl_dentry[fc->ctl_ndents++] = dentry; ++ + return dentry; + } + +@@ -284,7 +288,10 @@ void fuse_ctl_remove_conn(struct fuse_conn *fc) + for (i = fc->ctl_ndents - 1; i >= 0; i--) { + struct dentry *dentry = fc->ctl_dentry[i]; + d_inode(dentry)->i_private = NULL; +- d_drop(dentry); ++ if (!i) { ++ /* Get rid of submounts: */ ++ d_invalidate(dentry); ++ } + dput(dentry); + } + drop_nlink(d_inode(fuse_control_sb->s_root)); +diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c +index 13c65dd2d37d..261fd13a75c6 100644 +--- a/fs/fuse/dev.c ++++ b/fs/fuse/dev.c +@@ -381,8 +381,7 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) + if (!fc->blocked && waitqueue_active(&fc->blocked_waitq)) + wake_up(&fc->blocked_waitq); + +- if (fc->num_background == fc->congestion_threshold && +- fc->connected && fc->sb) { ++ if (fc->num_background == fc->congestion_threshold && fc->sb) { + clear_bdi_congested(fc->sb->s_bdi, BLK_RW_SYNC); + clear_bdi_congested(fc->sb->s_bdi, BLK_RW_ASYNC); + } +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index 24967382a7b1..7a980b4462d9 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -1629,8 +1629,19 @@ int fuse_do_setattr(struct dentry *dentry, struct iattr *attr, + return err; + + if (attr->ia_valid & ATTR_OPEN) { +- if (fc->atomic_o_trunc) ++ /* This is coming from open(..., ... | O_TRUNC); */ ++ WARN_ON(!(attr->ia_valid & ATTR_SIZE)); ++ WARN_ON(attr->ia_size != 0); ++ if (fc->atomic_o_trunc) { ++ /* ++ * No need to send request to userspace, since actual ++ * truncation has already been done by OPEN. But still ++ * need to truncate page cache. ++ */ ++ i_size_write(inode, 0); ++ truncate_pagecache(inode, 0); + return 0; ++ } + file = NULL; + } + +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index 94a745acaef8..a13ecefa9cd1 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -1176,6 +1176,7 @@ static int fuse_fill_super(struct super_block *sb, void *data, int silent) + fuse_dev_free(fud); + err_put_conn: + fuse_conn_put(fc); ++ sb->s_fs_info = NULL; + err_fput: + fput(file); + err: +diff --git a/fs/nfs/callback_proc.c b/fs/nfs/callback_proc.c +index 19151f6c0e97..516b2248cafe 100644 +--- a/fs/nfs/callback_proc.c ++++ b/fs/nfs/callback_proc.c +@@ -420,11 +420,8 @@ validate_seqid(const struct nfs4_slot_table *tbl, const struct nfs4_slot *slot, + return htonl(NFS4ERR_SEQ_FALSE_RETRY); + } + +- /* Wraparound */ +- if (unlikely(slot->seq_nr == 0xFFFFFFFFU)) { +- if (args->csa_sequenceid == 1) +- return htonl(NFS4_OK); +- } else if (likely(args->csa_sequenceid == slot->seq_nr + 1)) ++ /* Note: wraparound relies on seq_nr being of type u32 */ ++ if (likely(args->csa_sequenceid == slot->seq_nr + 1)) + return htonl(NFS4_OK); + + /* Misordered request */ +diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c +index 22dc30a679a0..b6f9d84ba19b 100644 +--- a/fs/nfs/nfs4idmap.c ++++ b/fs/nfs/nfs4idmap.c +@@ -343,7 +343,7 @@ static ssize_t nfs_idmap_lookup_name(__u32 id, const char *type, char *buf, + int id_len; + ssize_t ret; + +- id_len = snprintf(id_str, sizeof(id_str), "%u", id); ++ id_len = nfs_map_numeric_to_string(id, id_str, sizeof(id_str)); + ret = nfs_idmap_get_key(id_str, id_len, type, buf, buflen, idmap); + if (ret < 0) + return -EINVAL; +@@ -627,7 +627,8 @@ static int nfs_idmap_read_and_verify_message(struct idmap_msg *im, + if (strcmp(upcall->im_name, im->im_name) != 0) + break; + /* Note: here we store the NUL terminator too */ +- len = sprintf(id_str, "%d", im->im_id) + 1; ++ len = 1 + nfs_map_numeric_to_string(im->im_id, id_str, ++ sizeof(id_str)); + ret = nfs_idmap_instantiate(key, authkey, id_str, len); + break; + case IDMAP_CONV_IDTONAME: +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 8ff98bbe479b..928bbc397818 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -750,7 +750,7 @@ static int nfs41_sequence_process(struct rpc_task *task, + * The slot id we used was probably retired. Try again + * using a different slot id. + */ +- if (slot->seq_nr < slot->table->target_highest_slotid) ++ if (slot->slot_nr < slot->table->target_highest_slotid) + goto session_recover; + goto retry_nowait; + case -NFS4ERR_SEQ_MISORDERED: +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index df2b8849a63b..f6588cc6816c 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -3645,7 +3645,8 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 + nfserr = nfserr_resource; + goto err_no_verf; + } +- maxcount = min_t(u32, readdir->rd_maxcount, INT_MAX); ++ maxcount = svc_max_payload(resp->rqstp); ++ maxcount = min_t(u32, readdir->rd_maxcount, maxcount); + /* + * Note the rfc defines rd_maxcount as the size of the + * READDIR4resok structure, which includes the verifier above +@@ -3659,7 +3660,7 @@ nfsd4_encode_readdir(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4 + + /* RFC 3530 14.2.24 allows us to ignore dircount when it's 0: */ + if (!readdir->rd_dircount) +- readdir->rd_dircount = INT_MAX; ++ readdir->rd_dircount = svc_max_payload(resp->rqstp); + + readdir->xdr = xdr; + readdir->rd_maxcount = maxcount; +diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c +index 04c4ec6483e5..8ae1cd8611cc 100644 +--- a/fs/ubifs/journal.c ++++ b/fs/ubifs/journal.c +@@ -1283,10 +1283,11 @@ static int truncate_data_node(const struct ubifs_info *c, const struct inode *in + int *new_len) + { + void *buf; +- int err, dlen, compr_type, out_len, old_dlen; ++ int err, compr_type; ++ u32 dlen, out_len, old_dlen; + + out_len = le32_to_cpu(dn->size); +- buf = kmalloc(out_len * WORST_COMPR_FACTOR, GFP_NOFS); ++ buf = kmalloc_array(out_len, WORST_COMPR_FACTOR, GFP_NOFS); + if (!buf) + return -ENOMEM; + +diff --git a/fs/udf/directory.c b/fs/udf/directory.c +index 7aa48bd7cbaf..a636b3b17219 100644 +--- a/fs/udf/directory.c ++++ b/fs/udf/directory.c +@@ -151,6 +151,9 @@ struct fileIdentDesc *udf_fileident_read(struct inode *dir, loff_t *nf_pos, + sizeof(struct fileIdentDesc)); + } + } ++ /* Got last entry outside of dir size - fs is corrupted! */ ++ if (*nf_pos > dir->i_size) ++ return NULL; + return fi; + } + +diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h +index 6362e3606aa5..4d4af0e94059 100644 +--- a/include/linux/blkdev.h ++++ b/include/linux/blkdev.h +@@ -1088,8 +1088,8 @@ static inline unsigned int blk_max_size_offset(struct request_queue *q, + if (!q->limits.chunk_sectors) + return q->limits.max_sectors; + +- return q->limits.chunk_sectors - +- (offset & (q->limits.chunk_sectors - 1)); ++ return min(q->limits.max_sectors, (unsigned int)(q->limits.chunk_sectors - ++ (offset & (q->limits.chunk_sectors - 1)))); + } + + static inline unsigned int blk_rq_get_max_sectors(struct request *rq, +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 853929f98962..a704d032713b 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -21,7 +21,7 @@ void ftrace_likely_update(struct ftrace_likely_data *f, int val, + #define unlikely_notrace(x) __builtin_expect(!!(x), 0) + + #define __branch_check__(x, expect, is_constant) ({ \ +- int ______r; \ ++ long ______r; \ + static struct ftrace_likely_data \ + __attribute__((__aligned__(4))) \ + __attribute__((section("_ftrace_annotated_branch"))) \ +diff --git a/include/linux/slub_def.h b/include/linux/slub_def.h +index 39fa09bcde23..2038ab531616 100644 +--- a/include/linux/slub_def.h ++++ b/include/linux/slub_def.h +@@ -151,8 +151,12 @@ struct kmem_cache { + + #ifdef CONFIG_SYSFS + #define SLAB_SUPPORTS_SYSFS ++void sysfs_slab_unlink(struct kmem_cache *); + void sysfs_slab_release(struct kmem_cache *); + #else ++static inline void sysfs_slab_unlink(struct kmem_cache *s) ++{ ++} + static inline void sysfs_slab_release(struct kmem_cache *s) + { + } +diff --git a/include/rdma/ib_verbs.h b/include/rdma/ib_verbs.h +index 08f3d8699a27..5a24b4c700e5 100644 +--- a/include/rdma/ib_verbs.h ++++ b/include/rdma/ib_verbs.h +@@ -3558,6 +3558,20 @@ static inline int ib_check_mr_access(int flags) + return 0; + } + ++static inline bool ib_access_writable(int access_flags) ++{ ++ /* ++ * We have writable memory backing the MR if any of the following ++ * access flags are set. "Local write" and "remote write" obviously ++ * require write access. "Remote atomic" can do things like fetch and ++ * add, which will modify memory, and "MW bind" can change permissions ++ * by binding a window. ++ */ ++ return access_flags & ++ (IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_WRITE | ++ IB_ACCESS_REMOTE_ATOMIC | IB_ACCESS_MW_BIND); ++} ++ + /** + * ib_check_mr_status: lightweight check of MR status. + * This routine may provide status checks on a selected +diff --git a/include/rdma/rdma_vt.h b/include/rdma/rdma_vt.h +index 1ba84a78f1c5..c653af91da16 100644 +--- a/include/rdma/rdma_vt.h ++++ b/include/rdma/rdma_vt.h +@@ -409,7 +409,7 @@ struct rvt_dev_info { + spinlock_t pending_lock; /* protect pending mmap list */ + + /* CQ */ +- struct kthread_worker *worker; /* per device cq worker */ ++ struct kthread_worker __rcu *worker; /* per device cq worker */ + u32 n_cqs_allocated; /* number of CQs allocated for device */ + spinlock_t n_cqs_lock; /* protect count of in use cqs */ + +diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c +index 3cdaeaef9ce1..d989cc238198 100644 +--- a/kernel/printk/printk_safe.c ++++ b/kernel/printk/printk_safe.c +@@ -85,6 +85,7 @@ static __printf(2, 0) int printk_safe_log_store(struct printk_safe_seq_buf *s, + { + int add; + size_t len; ++ va_list ap; + + again: + len = atomic_read(&s->len); +@@ -103,7 +104,9 @@ static __printf(2, 0) int printk_safe_log_store(struct printk_safe_seq_buf *s, + if (!len) + smp_rmb(); + +- add = vscnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, args); ++ va_copy(ap, args); ++ add = vscnprintf(s->buffer + len, sizeof(s->buffer) - len, fmt, ap); ++ va_end(ap); + if (!add) + return 0; + +diff --git a/kernel/time/time.c b/kernel/time/time.c +index 44a8c1402133..319935af02fb 100644 +--- a/kernel/time/time.c ++++ b/kernel/time/time.c +@@ -28,6 +28,7 @@ + */ + + #include ++#include + #include + #include + #include +@@ -348,9 +349,10 @@ unsigned int jiffies_to_msecs(const unsigned long j) + return (j + (HZ / MSEC_PER_SEC) - 1)/(HZ / MSEC_PER_SEC); + #else + # if BITS_PER_LONG == 32 +- return (HZ_TO_MSEC_MUL32 * j) >> HZ_TO_MSEC_SHR32; ++ return (HZ_TO_MSEC_MUL32 * j + (1ULL << HZ_TO_MSEC_SHR32) - 1) >> ++ HZ_TO_MSEC_SHR32; + # else +- return (j * HZ_TO_MSEC_NUM) / HZ_TO_MSEC_DEN; ++ return DIV_ROUND_UP(j * HZ_TO_MSEC_NUM, HZ_TO_MSEC_DEN); + # endif + #endif + } +diff --git a/lib/vsprintf.c b/lib/vsprintf.c +index 86c3385b9eb3..4a990f3fd345 100644 +--- a/lib/vsprintf.c ++++ b/lib/vsprintf.c +@@ -1392,9 +1392,6 @@ char *clock(char *buf, char *end, struct clk *clk, struct printf_spec spec, + return string(buf, end, NULL, spec); + + switch (fmt[1]) { +- case 'r': +- return number(buf, end, clk_get_rate(clk), spec); +- + case 'n': + default: + #ifdef CONFIG_COMMON_CLK +diff --git a/mm/gup.c b/mm/gup.c +index d2ba0be71441..72c921da0f3b 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1469,32 +1469,48 @@ static int __gup_device_huge(unsigned long pfn, unsigned long addr, + return 1; + } + +-static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, ++static int __gup_device_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, + unsigned long end, struct page **pages, int *nr) + { + unsigned long fault_pfn; ++ int nr_start = *nr; ++ ++ fault_pfn = pmd_pfn(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ if (!__gup_device_huge(fault_pfn, addr, end, pages, nr)) ++ return 0; + +- fault_pfn = pmd_pfn(pmd) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); +- return __gup_device_huge(fault_pfn, addr, end, pages, nr); ++ if (unlikely(pmd_val(orig) != pmd_val(*pmdp))) { ++ undo_dev_pagemap(nr, nr_start, pages); ++ return 0; ++ } ++ return 1; + } + +-static int __gup_device_huge_pud(pud_t pud, unsigned long addr, ++static int __gup_device_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, + unsigned long end, struct page **pages, int *nr) + { + unsigned long fault_pfn; ++ int nr_start = *nr; ++ ++ fault_pfn = pud_pfn(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); ++ if (!__gup_device_huge(fault_pfn, addr, end, pages, nr)) ++ return 0; + +- fault_pfn = pud_pfn(pud) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); +- return __gup_device_huge(fault_pfn, addr, end, pages, nr); ++ if (unlikely(pud_val(orig) != pud_val(*pudp))) { ++ undo_dev_pagemap(nr, nr_start, pages); ++ return 0; ++ } ++ return 1; + } + #else +-static int __gup_device_huge_pmd(pmd_t pmd, unsigned long addr, ++static int __gup_device_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, + unsigned long end, struct page **pages, int *nr) + { + BUILD_BUG(); + return 0; + } + +-static int __gup_device_huge_pud(pud_t pud, unsigned long addr, ++static int __gup_device_huge_pud(pud_t pud, pud_t *pudp, unsigned long addr, + unsigned long end, struct page **pages, int *nr) + { + BUILD_BUG(); +@@ -1512,7 +1528,7 @@ static int gup_huge_pmd(pmd_t orig, pmd_t *pmdp, unsigned long addr, + return 0; + + if (pmd_devmap(orig)) +- return __gup_device_huge_pmd(orig, addr, end, pages, nr); ++ return __gup_device_huge_pmd(orig, pmdp, addr, end, pages, nr); + + refs = 0; + page = pmd_page(orig) + ((addr & ~PMD_MASK) >> PAGE_SHIFT); +@@ -1550,7 +1566,7 @@ static int gup_huge_pud(pud_t orig, pud_t *pudp, unsigned long addr, + return 0; + + if (pud_devmap(orig)) +- return __gup_device_huge_pud(orig, addr, end, pages, nr); ++ return __gup_device_huge_pud(orig, pudp, addr, end, pages, nr); + + refs = 0; + page = pud_page(orig) + ((addr & ~PUD_MASK) >> PAGE_SHIFT); +diff --git a/mm/ksm.c b/mm/ksm.c +index fdc8746ebcb4..f50cc573815f 100644 +--- a/mm/ksm.c ++++ b/mm/ksm.c +@@ -199,6 +199,8 @@ struct rmap_item { + #define SEQNR_MASK 0x0ff /* low bits of unstable tree seqnr */ + #define UNSTABLE_FLAG 0x100 /* is a node of the unstable tree */ + #define STABLE_FLAG 0x200 /* is listed from the stable tree */ ++#define KSM_FLAG_MASK (SEQNR_MASK|UNSTABLE_FLAG|STABLE_FLAG) ++ /* to mask all the flags */ + + /* The stable and unstable tree heads */ + static struct rb_root one_stable_tree[1] = { RB_ROOT }; +@@ -2562,10 +2564,15 @@ void rmap_walk_ksm(struct page *page, struct rmap_walk_control *rwc) + anon_vma_lock_read(anon_vma); + anon_vma_interval_tree_foreach(vmac, &anon_vma->rb_root, + 0, ULONG_MAX) { ++ unsigned long addr; ++ + cond_resched(); + vma = vmac->vma; +- if (rmap_item->address < vma->vm_start || +- rmap_item->address >= vma->vm_end) ++ ++ /* Ignore the stable/unstable/sqnr flags */ ++ addr = rmap_item->address & ~KSM_FLAG_MASK; ++ ++ if (addr < vma->vm_start || addr >= vma->vm_end) + continue; + /* + * Initially we examine only the vma which covers this +@@ -2579,8 +2586,7 @@ void rmap_walk_ksm(struct page *page, struct rmap_walk_control *rwc) + if (rwc->invalid_vma && rwc->invalid_vma(vma, rwc->arg)) + continue; + +- if (!rwc->rmap_one(page, vma, +- rmap_item->address, rwc->arg)) { ++ if (!rwc->rmap_one(page, vma, addr, rwc->arg)) { + anon_vma_unlock_read(anon_vma); + return; + } +diff --git a/mm/slab_common.c b/mm/slab_common.c +index 65212caa1f2a..91d271b90600 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -546,10 +546,14 @@ static int shutdown_cache(struct kmem_cache *s) + list_del(&s->list); + + if (s->flags & SLAB_TYPESAFE_BY_RCU) { ++#ifdef SLAB_SUPPORTS_SYSFS ++ sysfs_slab_unlink(s); ++#endif + list_add_tail(&s->list, &slab_caches_to_rcu_destroy); + schedule_work(&slab_caches_to_rcu_destroy_work); + } else { + #ifdef SLAB_SUPPORTS_SYSFS ++ sysfs_slab_unlink(s); + sysfs_slab_release(s); + #else + slab_kmem_cache_release(s); +diff --git a/mm/slub.c b/mm/slub.c +index 41c01690d116..c38e71cea6d3 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -5660,7 +5660,6 @@ static void sysfs_slab_remove_workfn(struct work_struct *work) + kset_unregister(s->memcg_kset); + #endif + kobject_uevent(&s->kobj, KOBJ_REMOVE); +- kobject_del(&s->kobj); + out: + kobject_put(&s->kobj); + } +@@ -5745,6 +5744,12 @@ static void sysfs_slab_remove(struct kmem_cache *s) + schedule_work(&s->kobj_remove_work); + } + ++void sysfs_slab_unlink(struct kmem_cache *s) ++{ ++ if (slab_state >= FULL) ++ kobject_del(&s->kobj); ++} ++ + void sysfs_slab_release(struct kmem_cache *s) + { + if (slab_state >= FULL) +diff --git a/net/sunrpc/xprtrdma/rpc_rdma.c b/net/sunrpc/xprtrdma/rpc_rdma.c +index 491ae9fc561f..991d5a96f35b 100644 +--- a/net/sunrpc/xprtrdma/rpc_rdma.c ++++ b/net/sunrpc/xprtrdma/rpc_rdma.c +@@ -229,7 +229,7 @@ rpcrdma_convert_iovs(struct rpcrdma_xprt *r_xprt, struct xdr_buf *xdrbuf, + */ + *ppages = alloc_page(GFP_ATOMIC); + if (!*ppages) +- return -EAGAIN; ++ return -ENOBUFS; + } + seg->mr_page = *ppages; + seg->mr_offset = (char *)page_base; +diff --git a/sound/core/timer.c b/sound/core/timer.c +index 4fdc9e11e832..2c0f292226d7 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1514,7 +1514,7 @@ static int snd_timer_user_next_device(struct snd_timer_id __user *_tid) + } else { + if (id.subdevice < 0) + id.subdevice = 0; +- else ++ else if (id.subdevice < INT_MAX) + id.subdevice++; + } + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 2a8aa2bc5c30..02157e3d82bb 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -2518,6 +2518,7 @@ static const struct snd_pci_quirk alc262_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x1397, "Fujitsu Lifebook S7110", ALC262_FIXUP_FSC_S7110), + SND_PCI_QUIRK(0x10cf, 0x142d, "Fujitsu Lifebook E8410", ALC262_FIXUP_BENQ), + SND_PCI_QUIRK(0x10f1, 0x2915, "Tyan Thunder n6650W", ALC262_FIXUP_TYAN), ++ SND_PCI_QUIRK(0x1734, 0x1141, "FSC ESPRIMO U9210", ALC262_FIXUP_FSC_H270), + SND_PCI_QUIRK(0x1734, 0x1147, "FSC Celsius H270", ALC262_FIXUP_FSC_H270), + SND_PCI_QUIRK(0x17aa, 0x384e, "Lenovo 3000", ALC262_FIXUP_LENOVO_3000), + SND_PCI_QUIRK(0x17ff, 0x0560, "Benq ED8", ALC262_FIXUP_BENQ), +@@ -4844,7 +4845,6 @@ static void alc_fixup_tpt440_dock(struct hda_codec *codec, + struct alc_spec *spec = codec->spec; + + if (action == HDA_FIXUP_ACT_PRE_PROBE) { +- spec->shutup = alc_no_shutup; /* reduce click noise */ + spec->reboot_notify = alc_d3_at_reboot; /* reduce noise */ + spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; + codec->power_save_node = 0; /* avoid click noises */ +@@ -5243,6 +5243,13 @@ static void alc274_fixup_bind_dacs(struct hda_codec *codec, + /* for hda_fixup_thinkpad_acpi() */ + #include "thinkpad_helper.c" + ++static void alc_fixup_thinkpad_acpi(struct hda_codec *codec, ++ const struct hda_fixup *fix, int action) ++{ ++ alc_fixup_no_shutup(codec, fix, action); /* reduce click noise */ ++ hda_fixup_thinkpad_acpi(codec, fix, action); ++} ++ + /* for dell wmi mic mute led */ + #include "dell_wmi_helper.c" + +@@ -5786,7 +5793,7 @@ static const struct hda_fixup alc269_fixups[] = { + }, + [ALC269_FIXUP_THINKPAD_ACPI] = { + .type = HDA_FIXUP_FUNC, +- .v.func = hda_fixup_thinkpad_acpi, ++ .v.func = alc_fixup_thinkpad_acpi, + .chained = true, + .chain_id = ALC269_FIXUP_SKU_IGNORE, + }, +@@ -6436,8 +6443,9 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), ++ SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +- SND_PCI_QUIRK(0x17aa, 0x3138, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), ++ SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), +@@ -6614,6 +6622,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x14, 0x90170110}, + {0x19, 0x02a11030}, + {0x21, 0x02211020}), ++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION, ++ {0x14, 0x90170110}, ++ {0x19, 0x02a11030}, ++ {0x1a, 0x02a11040}, ++ {0x1b, 0x01014020}, ++ {0x21, 0x0221101f}), + SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60140}, + {0x14, 0x90170150}, +diff --git a/sound/soc/cirrus/edb93xx.c b/sound/soc/cirrus/edb93xx.c +index c53bd6f2c2d7..3d011abaa266 100644 +--- a/sound/soc/cirrus/edb93xx.c ++++ b/sound/soc/cirrus/edb93xx.c +@@ -67,7 +67,7 @@ static struct snd_soc_dai_link edb93xx_dai = { + .cpu_dai_name = "ep93xx-i2s", + .codec_name = "spi0.0", + .codec_dai_name = "cs4271-hifi", +- .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF | ++ .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | + SND_SOC_DAIFMT_CBS_CFS, + .ops = &edb93xx_ops, + }; +diff --git a/sound/soc/cirrus/ep93xx-i2s.c b/sound/soc/cirrus/ep93xx-i2s.c +index 934f8aefdd90..0dc3852c4621 100644 +--- a/sound/soc/cirrus/ep93xx-i2s.c ++++ b/sound/soc/cirrus/ep93xx-i2s.c +@@ -51,7 +51,9 @@ + #define EP93XX_I2S_WRDLEN_24 (1 << 0) + #define EP93XX_I2S_WRDLEN_32 (2 << 0) + +-#define EP93XX_I2S_LINCTRLDATA_R_JUST (1 << 2) /* Right justify */ ++#define EP93XX_I2S_RXLINCTRLDATA_R_JUST BIT(1) /* Right justify */ ++ ++#define EP93XX_I2S_TXLINCTRLDATA_R_JUST BIT(2) /* Right justify */ + + #define EP93XX_I2S_CLKCFG_LRS (1 << 0) /* lrclk polarity */ + #define EP93XX_I2S_CLKCFG_CKP (1 << 1) /* Bit clock polarity */ +@@ -170,25 +172,25 @@ static int ep93xx_i2s_set_dai_fmt(struct snd_soc_dai *cpu_dai, + unsigned int fmt) + { + struct ep93xx_i2s_info *info = snd_soc_dai_get_drvdata(cpu_dai); +- unsigned int clk_cfg, lin_ctrl; ++ unsigned int clk_cfg; ++ unsigned int txlin_ctrl = 0; ++ unsigned int rxlin_ctrl = 0; + + clk_cfg = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXCLKCFG); +- lin_ctrl = ep93xx_i2s_read_reg(info, EP93XX_I2S_RXLINCTRLDATA); + + switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) { + case SND_SOC_DAIFMT_I2S: + clk_cfg |= EP93XX_I2S_CLKCFG_REL; +- lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST; + break; + + case SND_SOC_DAIFMT_LEFT_J: + clk_cfg &= ~EP93XX_I2S_CLKCFG_REL; +- lin_ctrl &= ~EP93XX_I2S_LINCTRLDATA_R_JUST; + break; + + case SND_SOC_DAIFMT_RIGHT_J: + clk_cfg &= ~EP93XX_I2S_CLKCFG_REL; +- lin_ctrl |= EP93XX_I2S_LINCTRLDATA_R_JUST; ++ rxlin_ctrl |= EP93XX_I2S_RXLINCTRLDATA_R_JUST; ++ txlin_ctrl |= EP93XX_I2S_TXLINCTRLDATA_R_JUST; + break; + + default: +@@ -213,32 +215,32 @@ static int ep93xx_i2s_set_dai_fmt(struct snd_soc_dai *cpu_dai, + switch (fmt & SND_SOC_DAIFMT_INV_MASK) { + case SND_SOC_DAIFMT_NB_NF: + /* Negative bit clock, lrclk low on left word */ +- clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL); ++ clk_cfg &= ~(EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS); + break; + + case SND_SOC_DAIFMT_NB_IF: + /* Negative bit clock, lrclk low on right word */ + clk_cfg &= ~EP93XX_I2S_CLKCFG_CKP; +- clk_cfg |= EP93XX_I2S_CLKCFG_REL; ++ clk_cfg |= EP93XX_I2S_CLKCFG_LRS; + break; + + case SND_SOC_DAIFMT_IB_NF: + /* Positive bit clock, lrclk low on left word */ + clk_cfg |= EP93XX_I2S_CLKCFG_CKP; +- clk_cfg &= ~EP93XX_I2S_CLKCFG_REL; ++ clk_cfg &= ~EP93XX_I2S_CLKCFG_LRS; + break; + + case SND_SOC_DAIFMT_IB_IF: + /* Positive bit clock, lrclk low on right word */ +- clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_REL; ++ clk_cfg |= EP93XX_I2S_CLKCFG_CKP | EP93XX_I2S_CLKCFG_LRS; + break; + } + + /* Write new register values */ + ep93xx_i2s_write_reg(info, EP93XX_I2S_RXCLKCFG, clk_cfg); + ep93xx_i2s_write_reg(info, EP93XX_I2S_TXCLKCFG, clk_cfg); +- ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, lin_ctrl); +- ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, lin_ctrl); ++ ep93xx_i2s_write_reg(info, EP93XX_I2S_RXLINCTRLDATA, rxlin_ctrl); ++ ep93xx_i2s_write_reg(info, EP93XX_I2S_TXLINCTRLDATA, txlin_ctrl); + return 0; + } + +diff --git a/sound/soc/cirrus/snappercl15.c b/sound/soc/cirrus/snappercl15.c +index 2334ec19e7eb..11ff7b2672b2 100644 +--- a/sound/soc/cirrus/snappercl15.c ++++ b/sound/soc/cirrus/snappercl15.c +@@ -72,7 +72,7 @@ static struct snd_soc_dai_link snappercl15_dai = { + .codec_dai_name = "tlv320aic23-hifi", + .codec_name = "tlv320aic23-codec.0-001a", + .platform_name = "ep93xx-i2s", +- .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_IF | ++ .dai_fmt = SND_SOC_DAIFMT_I2S | SND_SOC_DAIFMT_NB_NF | + SND_SOC_DAIFMT_CBS_CFS, + .ops = &snappercl15_ops, + }; +diff --git a/sound/soc/codecs/cs35l35.c b/sound/soc/codecs/cs35l35.c +index 129978d1243e..51ce53e23599 100644 +--- a/sound/soc/codecs/cs35l35.c ++++ b/sound/soc/codecs/cs35l35.c +@@ -1106,6 +1106,7 @@ static struct regmap_config cs35l35_regmap = { + .readable_reg = cs35l35_readable_register, + .precious_reg = cs35l35_precious_register, + .cache_type = REGCACHE_RBTREE, ++ .use_single_rw = true, + }; + + static irqreturn_t cs35l35_irq(int irq, void *data) +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index dcef67a9bd48..1c9f6a0d234f 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -430,6 +430,8 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget, + static void dapm_kcontrol_free(struct snd_kcontrol *kctl) + { + struct dapm_kcontrol_data *data = snd_kcontrol_chip(kctl); ++ ++ list_del(&data->paths); + kfree(data->wlist); + kfree(data); + } +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/cache.json b/tools/perf/pmu-events/arch/x86/goldmontplus/cache.json +new file mode 100644 +index 000000000000..b4791b443a66 +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/cache.json +@@ -0,0 +1,1453 @@ ++[ ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts memory requests originating from the core that miss in the L2 cache.", ++ "EventCode": "0x2E", ++ "Counter": "0,1,2,3", ++ "UMask": "0x41", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LONGEST_LAT_CACHE.MISS", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "L2 cache request misses" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts memory requests originating from the core that reference a cache line in the L2 cache.", ++ "EventCode": "0x2E", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4f", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LONGEST_LAT_CACHE.REFERENCE", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "L2 cache requests" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of demand and prefetch transactions that the L2 XQ rejects due to a full or near full condition which likely indicates back pressure from the intra-die interconnect (IDI) fabric. The XQ may reject transactions from the L2Q (non-cacheable requests), L2 misses and L2 write-back victims.", ++ "EventCode": "0x30", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "L2_REJECT_XQ.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Requests rejected by the XQ" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of demand and L1 prefetcher requests rejected by the L2Q due to a full or nearly full condition which likely indicates back pressure from L2Q. It also counts requests that would have gone directly to the XQ, but are rejected due to a full or nearly full condition, indicating back pressure from the IDI link. The L2Q may also reject transactions from a core to insure fairness between cores, or to delay a core's dirty eviction when the address conflicts with incoming external snoops.", ++ "EventCode": "0x31", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CORE_REJECT_L2Q.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Requests rejected by the L2Q" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts when a modified (dirty) cache line is evicted from the data L1 cache and needs to be written back to memory. No count will occur if the evicted line is clean, and hence does not require a writeback.", ++ "EventCode": "0x51", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DL1.REPLACEMENT", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "L1 Cache evictions for dirty data" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts cycles that fetch is stalled due to an outstanding ICache miss. That is, the decoder queue is able to accept bytes, but the fetch unit is unable to provide bytes due to an ICache miss. Note: this event is not the same as the total number of cycles spent retrieving instruction cache lines from the memory hierarchy.", ++ "EventCode": "0x86", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "FETCH_STALL.ICACHE_FILL_PENDING_CYCLES", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles code-fetch stalled due to an outstanding ICache miss." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "EventCode": "0xB7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts locked memory uops retired. This includes regular locks and bus locks. (To specifically count bus locks only, see the Offcore response event.) A locked access is one with a lock prefix, or an exchange to memory. See the SDM for a complete description of which memory load accesses are locks.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x21", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.LOCK_LOADS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Locked load uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired where the data requested spans a 64 byte cache line boundary.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x41", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.SPLIT_LOADS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that split a cache-line (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts store uops retired where the data requested spans a 64 byte cache line boundary.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x42", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.SPLIT_STORES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Stores uops retired that split a cache-line (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts memory uops retired where the data requested spans a 64 byte cache line boundary.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x43", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.SPLIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Memory uops retired that split a cache-line (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts the number of load uops retired.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x81", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.ALL_LOADS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts the number of store uops retired.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x82", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.ALL_STORES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Store uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts the number of memory uops retired that is either a loads or a store or both.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x83", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.ALL", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Memory uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired that hit the L1 data cache.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.L1_HIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that hit L1 data cache (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired that hit in the L2 cache.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.L2_HIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that hit L2 (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired that miss the L1 data cache.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.L1_MISS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that missed L1 data cache (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired that miss in the L2 cache.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.L2_MISS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that missed L2 (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired where the cache line containing the data was in the modified state of another core or modules cache (HITM). More specifically, this means that when the load address was checked by other caching agents (typically another processor) in the system, one of those caching agents indicated that they had a dirty copy of the data. Loads that obtain a HITM response incur greater latency than most is typical for a load. In addition, since HITM indicates that some other processor had this data in its cache, it implies that the data was shared between processors, or potentially was a lock or semaphore value. This event is useful for locating sharing, false sharing, and contended locks.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x20", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.HITM", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Memory uop retired where cross core or cross module HITM occurred (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts memory load uops retired where the data is retrieved from the WCB (or fill buffer), indicating that the load found its data while that data was in the process of being brought into the L1 cache. Typically a load will receive this indication when some other load or prefetch missed the L1 cache and was in the process of retrieving the cache line containing the data, but that process had not yet finished (and written the data back to the cache). For example, consider load X and Y, both referencing the same cache line that is not in the L1 cache. If load X misses cache first, it obtains and WCB (or fill buffer) and begins the process of requesting the data. When load Y requests the data, it will either hit the WCB, or the L1 cache, depending on exactly what time the request to Y occurs.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x40", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.WCB_HIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads retired that hit WCB (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts memory load uops retired where the data is retrieved from DRAM. Event is counted at retirement, so the speculative loads are ignored. A memory load can hit (or miss) the L1 cache, hit (or miss) the L2 cache, hit DRAM, hit in the WCB or receive a HITM response.", ++ "EventCode": "0xD1", ++ "Counter": "0,1,2,3", ++ "UMask": "0x80", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_LOAD_UOPS_RETIRED.DRAM_HIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads retired that came from DRAM (Precise event capable)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand cacheable data reads of full cache lines have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010001", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_DATA_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand cacheable data reads of full cache lines have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand cacheable data reads of full cache lines hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040001", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_DATA_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand cacheable data reads of full cache lines hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand cacheable data reads of full cache lines true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000001", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_DATA_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand cacheable data reads of full cache lines true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand cacheable data reads of full cache lines miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000001", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_DATA_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand cacheable data reads of full cache lines miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand cacheable data reads of full cache lines outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000001", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_DATA_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand cacheable data reads of full cache lines outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010002", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_RFO.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040002", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_RFO.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000002", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_RFO.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000002", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_RFO.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000002", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_RFO.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand reads for ownership (RFO) requests generated by a write to full data cache line outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010004", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_CODE_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040004", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_CODE_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000004", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_CODE_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000004", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_CODE_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000004", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.DEMAND_CODE_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts demand instruction cacheline and I-side prefetch requests that miss the instruction cache outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010008", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.COREWB.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040008", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.COREWB.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000008", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.COREWB.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000008", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.COREWB.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000008", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.COREWB.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts the number of writeback transactions caused by L1 or L2 cache evictions outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_DATA_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_DATA_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_DATA_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_DATA_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_DATA_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cacheline reads generated by hardware L2 cache prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010020", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_RFO.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040020", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_RFO.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000020", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_RFO.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000020", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_RFO.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000020", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L2_RFO.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests generated by L2 prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts bus lock and split lock requests have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010400", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.BUS_LOCKS.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts bus lock and split lock requests have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts bus lock and split lock requests hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040400", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.BUS_LOCKS.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts bus lock and split lock requests hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts bus lock and split lock requests true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000400", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.BUS_LOCKS.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts bus lock and split lock requests true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts bus lock and split lock requests miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000400", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.BUS_LOCKS.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts bus lock and split lock requests miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts bus lock and split lock requests outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000400", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.BUS_LOCKS.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts bus lock and split lock requests outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.FULL_STREAMING_STORES.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.FULL_STREAMING_STORES.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.FULL_STREAMING_STORES.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.FULL_STREAMING_STORES.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.FULL_STREAMING_STORES.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts full cache line data writes to uncacheable write combining (USWC) memory region and full cache-line non-temporal writes outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache lines requests by software prefetch instructions have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000011000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.SW_PREFETCH.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache lines requests by software prefetch instructions have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache lines requests by software prefetch instructions hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000041000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.SW_PREFETCH.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache lines requests by software prefetch instructions hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache lines requests by software prefetch instructions true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200001000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.SW_PREFETCH.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache lines requests by software prefetch instructions true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache lines requests by software prefetch instructions miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000001000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.SW_PREFETCH.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache lines requests by software prefetch instructions miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache lines requests by software prefetch instructions outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000001000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.SW_PREFETCH.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache lines requests by software prefetch instructions outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000012000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L1_DATA_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000042000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L1_DATA_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200002000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L1_DATA_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000002000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L1_DATA_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000002000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.PF_L1_DATA_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data cache line reads generated by hardware L1 data cache prefetcher outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts any data writes to uncacheable write combining (USWC) memory region have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000014800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.STREAMING_STORES.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts any data writes to uncacheable write combining (USWC) memory region have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts any data writes to uncacheable write combining (USWC) memory region hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000044800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.STREAMING_STORES.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts any data writes to uncacheable write combining (USWC) memory region hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts any data writes to uncacheable write combining (USWC) memory region true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200004800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.STREAMING_STORES.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts any data writes to uncacheable write combining (USWC) memory region true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts any data writes to uncacheable write combining (USWC) memory region miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000004800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.STREAMING_STORES.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts any data writes to uncacheable write combining (USWC) memory region miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts any data writes to uncacheable write combining (USWC) memory region outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000004800", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.STREAMING_STORES.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts any data writes to uncacheable write combining (USWC) memory region outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the uncore subsystem have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000018000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_REQUEST.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts requests to the uncore subsystem have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the uncore subsystem hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000048000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_REQUEST.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts requests to the uncore subsystem hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the uncore subsystem true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200008000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_REQUEST.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts requests to the uncore subsystem true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the uncore subsystem miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000008000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_REQUEST.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts requests to the uncore subsystem miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the uncore subsystem outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000008000", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_REQUEST.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts requests to the uncore subsystem outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads generated by L1 or L2 prefetchers have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000013010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_PF_DATA_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads generated by L1 or L2 prefetchers have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads generated by L1 or L2 prefetchers hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000043010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_PF_DATA_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads generated by L1 or L2 prefetchers hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads generated by L1 or L2 prefetchers true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200003010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_PF_DATA_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads generated by L1 or L2 prefetchers true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads generated by L1 or L2 prefetchers miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000003010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_PF_DATA_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads generated by L1 or L2 prefetchers miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads generated by L1 or L2 prefetchers outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000003010", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_PF_DATA_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads generated by L1 or L2 prefetchers outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads (demand & prefetch) have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000013091", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_DATA_RD.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads (demand & prefetch) have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads (demand & prefetch) hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000043091", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_DATA_RD.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads (demand & prefetch) hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200003091", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_DATA_RD.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000003091", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_DATA_RD.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data reads (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000003091", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_DATA_RD.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data reads (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000010022", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_RFO.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0000040022", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_RFO.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x0200000022", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_RFO.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x1000000022", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_RFO.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x4000000022", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_RFO.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts reads for ownership (RFO) requests (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) have any transaction responses from the uncore subsystem. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x00000132b7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_READ.ANY_RESPONSE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) have any transaction responses from the uncore subsystem.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) hit the L2 cache. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x00000432b7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_READ.L2_HIT", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) hit the L2 cache.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x02000032b7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_READ.L2_MISS.SNOOP_MISS_OR_NO_SNOOP_NEEDED", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) true miss for the L2 cache with a snoop miss in the other processor module. ", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x10000032b7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_READ.L2_MISS.HITM_OTHER_CORE", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6, 0x1a7", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) miss the L2 cache with a snoop hit in the other processor module, data forwarding is required.", ++ "Offcore": "1" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received. Requires MSR_OFFCORE_RESP[0,1] to specify request type and response. (duplicated for both MSRs)", ++ "EventCode": "0xB7", ++ "MSRValue": "0x40000032b7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "OFFCORE_RESPONSE.ANY_READ.OUTSTANDING", ++ "PDIR_COUNTER": "na", ++ "MSRIndex": "0x1a6", ++ "SampleAfterValue": "100007", ++ "BriefDescription": "Counts data read, code read, and read for ownership (RFO) requests (demand & prefetch) outstanding, per cycle, from the time of the L2 miss to when any response is received.", ++ "Offcore": "1" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/frontend.json b/tools/perf/pmu-events/arch/x86/goldmontplus/frontend.json +new file mode 100644 +index 000000000000..a7878965ceab +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/frontend.json +@@ -0,0 +1,62 @@ ++[ ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the Instruction Cache (ICache) for one or more bytes in an ICache Line and that cache line is in the ICache (hit). The event strives to count on a cache line basis, so that multiple accesses which hit in a single cache line count as one ICACHE.HIT. Specifically, the event counts when straight line code crosses the cache line boundary, or when a branch target is to a new line, and that cache line is in the ICache. This event counts differently than Intel processors based on Silvermont microarchitecture.", ++ "EventCode": "0x80", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ICACHE.HIT", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "References per ICache line that are available in the ICache (hit). This event counts differently than Intel processors based on Silvermont microarchitecture" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the Instruction Cache (ICache) for one or more bytes in an ICache Line and that cache line is not in the ICache (miss). The event strives to count on a cache line basis, so that multiple accesses which miss in a single cache line count as one ICACHE.MISS. Specifically, the event counts when straight line code crosses the cache line boundary, or when a branch target is to a new line, and that cache line is not in the ICache. This event counts differently than Intel processors based on Silvermont microarchitecture.", ++ "EventCode": "0x80", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ICACHE.MISSES", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "References per ICache line that are not available in the ICache (miss). This event counts differently than Intel processors based on Silvermont microarchitecture" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts requests to the Instruction Cache (ICache) for one or more bytes in an ICache Line. The event strives to count on a cache line basis, so that multiple fetches to a single cache line count as one ICACHE.ACCESS. Specifically, the event counts when accesses from straight line code crosses the cache line boundary, or when a branch target is to a new line.\r\nThis event counts differently than Intel processors based on Silvermont microarchitecture.", ++ "EventCode": "0x80", ++ "Counter": "0,1,2,3", ++ "UMask": "0x3", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ICACHE.ACCESSES", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "References per ICache line. This event counts differently than Intel processors based on Silvermont microarchitecture" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times the Microcode Sequencer (MS) starts a flow of uops from the MSROM. It does not count every time a uop is read from the MSROM. The most common case that this counts is when a micro-coded instruction is encountered by the front end of the machine. Other cases include when an instruction encounters a fault, trap, or microcode assist of any sort that initiates a flow of uops. The event will count MS startups for uops that are speculative, and subsequently cleared by branch mispredict or a machine clear.", ++ "EventCode": "0xE7", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MS_DECODED.MS_ENTRY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "MS decode starts" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times the prediction (from the predecode cache) for instruction length is incorrect.", ++ "EventCode": "0xE9", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DECODE_RESTRICTION.PREDECODE_WRONG", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Decode restrictions due to predicting wrong instruction length" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/memory.json b/tools/perf/pmu-events/arch/x86/goldmontplus/memory.json +new file mode 100644 +index 000000000000..91e0815f3ffb +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/memory.json +@@ -0,0 +1,38 @@ ++[ ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts when a memory load of a uop spans a page boundary (a split) is retired.", ++ "EventCode": "0x13", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MISALIGN_MEM_REF.LOAD_PAGE_SPLIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops that split a page (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts when a memory store of a uop spans a page boundary (a split) is retired.", ++ "EventCode": "0x13", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MISALIGN_MEM_REF.STORE_PAGE_SPLIT", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Store uops that split a page (Precise event capable)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts machine clears due to memory ordering issues. This occurs when a snoop request happens and the machine is uncertain if memory ordering will be preserved - as another core is in the process of modifying the data.", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.MEMORY_ORDERING", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "Machine clears due to memory ordering issue" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/other.json b/tools/perf/pmu-events/arch/x86/goldmontplus/other.json +new file mode 100644 +index 000000000000..b860374418ab +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/other.json +@@ -0,0 +1,98 @@ ++[ ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts cycles that fetch is stalled due to any reason. That is, the decoder queue is able to accept bytes, but the fetch unit is unable to provide bytes. This will include cycles due to an ITLB miss, ICache miss and other events.", ++ "EventCode": "0x86", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "FETCH_STALL.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles code-fetch stalled due to any reason." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts cycles that fetch is stalled due to an outstanding ITLB miss. That is, the decoder queue is able to accept bytes, but the fetch unit is unable to provide bytes due to an ITLB miss. Note: this event is not the same as page walk cycles to retrieve an instruction translation.", ++ "EventCode": "0x86", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "FETCH_STALL.ITLB_FILL_PENDING_CYCLES", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles the code-fetch stalls and an ITLB miss is outstanding." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of issue slots per core cycle that were not consumed by the backend due to either a full resource in the backend (RESOURCE_FULL) or due to the processor recovering from some event (RECOVERY).", ++ "EventCode": "0xCA", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ISSUE_SLOTS_NOT_CONSUMED.ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Unfilled issue slots per cycle" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of issue slots per core cycle that were not consumed because of a full resource in the backend. Including but not limited to resources such as the Re-order Buffer (ROB), reservation stations (RS), load/store buffers, physical registers, or any other needed machine resource that is currently unavailable. Note that uops must be available for consumption in order for this event to fire. If a uop is not available (Instruction Queue is empty), this event will not count.", ++ "EventCode": "0xCA", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ISSUE_SLOTS_NOT_CONSUMED.RESOURCE_FULL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Unfilled issue slots per cycle because of a full resource in the backend" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of issue slots per core cycle that were not consumed by the backend because allocation is stalled waiting for a mispredicted jump to retire or other branch-like conditions (e.g. the event is relevant during certain microcode flows). Counts all issue slots blocked while within this window including slots where uops were not available in the Instruction Queue.", ++ "EventCode": "0xCA", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ISSUE_SLOTS_NOT_CONSUMED.RECOVERY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Unfilled issue slots per cycle to recover" ++ }, ++ { ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts hardware interrupts received by the processor.", ++ "EventCode": "0xCB", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "HW_INTERRUPTS.RECEIVED", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "203", ++ "BriefDescription": "Hardware interrupts received" ++ }, ++ { ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts the number of core cycles during which interrupts are masked (disabled). Increments by 1 each core cycle that EFLAGS.IF is 0, regardless of whether interrupts are pending or not.", ++ "EventCode": "0xCB", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "HW_INTERRUPTS.MASKED", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles hardware interrupts are masked" ++ }, ++ { ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts core cycles during which there are pending interrupts, but interrupts are masked (EFLAGS.IF = 0).", ++ "EventCode": "0xCB", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "HW_INTERRUPTS.PENDING_AND_MASKED", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles pending interrupts are masked" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/pipeline.json b/tools/perf/pmu-events/arch/x86/goldmontplus/pipeline.json +new file mode 100644 +index 000000000000..ccf1aed69197 +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/pipeline.json +@@ -0,0 +1,544 @@ ++[ ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of instructions that retire execution. For instructions that consist of multiple uops, this event counts the retirement of the last uop of the instruction. The counter continues counting during hardware interrupts, traps, and inside interrupt handlers. This event uses fixed counter 0. You cannot collect a PEBs record for this event.", ++ "EventCode": "0x00", ++ "Counter": "Fixed counter 0", ++ "UMask": "0x1", ++ "PEBScounters": "32", ++ "EventName": "INST_RETIRED.ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Instructions retired (Fixed event)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of core cycles while the core is not in a halt state. The core enters the halt state when it is running the HLT instruction. In mobile systems the core frequency may change from time to time. For this reason this event may have a changing ratio with regards to time. This event uses fixed counter 1. You cannot collect a PEBs record for this event.", ++ "EventCode": "0x00", ++ "Counter": "Fixed counter 1", ++ "UMask": "0x2", ++ "PEBScounters": "33", ++ "EventName": "CPU_CLK_UNHALTED.CORE", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Core cycles when core is not halted (Fixed event)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of reference cycles that the core is not in a halt state. The core enters the halt state when it is running the HLT instruction. In mobile systems the core frequency may change from time. This event is not affected by core frequency changes but counts as if the core is running at the maximum frequency all the time. This event uses fixed counter 2. You cannot collect a PEBs record for this event.", ++ "EventCode": "0x00", ++ "Counter": "Fixed counter 2", ++ "UMask": "0x3", ++ "PEBScounters": "34", ++ "EventName": "CPU_CLK_UNHALTED.REF_TSC", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Reference cycles when core is not halted (Fixed event)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts a load blocked from using a store forward, but did not occur because the store data was not available at the right time. The forward might occur subsequently when the data is available.", ++ "EventCode": "0x03", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LD_BLOCKS.DATA_UNKNOWN", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads blocked due to store data not ready (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts a load blocked from using a store forward because of an address/size mismatch, only one of the loads blocked from each store will be counted.", ++ "EventCode": "0x03", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LD_BLOCKS.STORE_FORWARD", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads blocked due to store forward restriction (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts loads that block because their address modulo 4K matches a pending store.", ++ "EventCode": "0x03", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LD_BLOCKS.4K_ALIAS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads blocked because address has 4k partial address false dependence (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts loads blocked because they are unable to find their physical address in the micro TLB (UTLB).", ++ "EventCode": "0x03", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LD_BLOCKS.UTLB_MISS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads blocked because address in not in the UTLB (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts anytime a load that retires is blocked for any reason.", ++ "EventCode": "0x03", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "LD_BLOCKS.ALL_BLOCK", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Loads blocked (Precise event capable)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts uops issued by the front end and allocated into the back end of the machine. This event counts uops that retire as well as uops that were speculatively executed but didn't retire. The sort of speculative uops that might be counted includes, but is not limited to those uops issued in the shadow of a miss-predicted branch, those uops that are inserted during an assist (such as for a denormal floating point result), and (previously allocated) uops that might be canceled during a machine clear.", ++ "EventCode": "0x0E", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_ISSUED.ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Uops issued to the back end per cycle" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Core cycles when core is not halted. This event uses a (_P)rogrammable general purpose performance counter.", ++ "EventCode": "0x3C", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CPU_CLK_UNHALTED.CORE_P", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Core cycles when core is not halted" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Reference cycles when core is not halted. This event uses a (_P)rogrammable general purpose performance counter.", ++ "EventCode": "0x3C", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CPU_CLK_UNHALTED.REF", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Reference cycles when core is not halted" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "This event used to measure front-end inefficiencies. I.e. when front-end of the machine is not delivering uops to the back-end and the back-end has is not stalled. This event can be used to identify if the machine is truly front-end bound. When this event occurs, it is an indication that the front-end of the machine is operating at less than its theoretical peak performance. Background: We can think of the processor pipeline as being divided into 2 broader parts: Front-end and Back-end. Front-end is responsible for fetching the instruction, decoding into uops in machine understandable format and putting them into a uop queue to be consumed by back end. The back-end then takes these uops, allocates the required resources. When all resources are ready, uops are executed. If the back-end is not ready to accept uops from the front-end, then we do not want to count these as front-end bottlenecks. However, whenever we have bottlenecks in the back-end, we will have allocation unit stalls and eventually forcing the front-end to wait until the back-end is ready to receive more uops. This event counts only when back-end is requesting more uops and front-end is not able to provide them. When 3 uops are requested and no uops are delivered, the event counts 3. When 3 are requested, and only 1 is delivered, the event counts 2. When only 2 are delivered, the event counts 1. Alternatively stated, the event will not count if 3 uops are delivered, or if the back end is stalled and not requesting any uops at all. Counts indicate missed opportunities for the front-end to deliver a uop to the back end. Some examples of conditions that cause front-end efficiencies are: ICache misses, ITLB misses, and decoder restrictions that limit the front-end bandwidth. Known Issues: Some uops require multiple allocation slots. These uops will not be charged as a front end 'not delivered' opportunity, and will be regarded as a back end problem. For example, the INC instruction has one uop that requires 2 issue slots. A stream of INC instructions will not count as UOPS_NOT_DELIVERED, even though only one instruction can be issued per clock. The low uop issue rate for a stream of INC instructions is considered to be a back end issue.", ++ "EventCode": "0x9C", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_NOT_DELIVERED.ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Uops requested but not-delivered to the back-end per cycle" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of instructions that retire execution. For instructions that consist of multiple uops, this event counts the retirement of the last uop of the instruction. The event continues counting during hardware interrupts, traps, and inside interrupt handlers. This is an architectural performance event. This event uses a (_P)rogrammable general purpose performance counter. *This event is Precise Event capable: The EventingRIP field in the PEBS record is precise to the address of the instruction which caused the event. Note: Because PEBS records can be collected only on IA32_PMC0, only one event can use the PEBS facility at a time.", ++ "EventCode": "0xC0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "INST_RETIRED.ANY_P", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Instructions retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts INST_RETIRED.ANY using the Reduced Skid PEBS feature that reduces the shadow in which events aren't counted allowing for a more unbiased distribution of samples across instructions retired.", ++ "EventCode": "0xC0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "EventName": "INST_RETIRED.PREC_DIST", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Instructions retired - using Reduced Skid PEBS feature" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts uops which retired.", ++ "EventCode": "0xC2", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_RETIRED.ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts uops retired that are from the complex flows issued by the micro-sequencer (MS). Counts both the uops from a micro-coded instruction, and the uops that might be generated from a micro-coded assist.", ++ "EventCode": "0xC2", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_RETIRED.MS", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "MS uops retired (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of floating point divide uops retired.", ++ "EventCode": "0xC2", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_RETIRED.FPDIV", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Floating point divide uops retired (Precise Event Capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of integer divide uops retired.", ++ "EventCode": "0xC2", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "UOPS_RETIRED.IDIV", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Integer divide uops retired (Precise Event Capable)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts machine clears for any reason.", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "All machine clears" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times that the processor detects that a program is writing to a code section and has to perform a machine clear because of that modification. Self-modifying code (SMC) causes a severe penalty in all Intel architecture processors.", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.SMC", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "Self-Modifying Code detected" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts machine clears due to floating point (FP) operations needing assists. For instance, if the result was a floating point denormal, the hardware clears the pipeline and reissues uops to produce the correct IEEE compliant denormal result.", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.FP_ASSIST", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "Machine clears due to FP assists" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts machine clears due to memory disambiguation. Memory disambiguation happens when a load which has been issued conflicts with a previous unretired store in the pipeline whose address was not known at issue time, but is later resolved to be the same as the load address.", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.DISAMBIGUATION", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "Machine clears due to memory disambiguation" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times that the machines clears due to a page fault. Covers both I-side and D-side(Loads/Stores) page faults. A page fault occurs when either page is not present, or an access violation", ++ "EventCode": "0xC3", ++ "Counter": "0,1,2,3", ++ "UMask": "0x20", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MACHINE_CLEARS.PAGE_FAULT", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "Machines clear due to a page fault" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts branch instructions retired for all branch types. This is an architectural performance event.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.ALL_BRANCHES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts retired Jcc (Jump on Conditional Code/Jump if Condition is Met) branch instructions retired, including both when the branch was taken and when it was not taken.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0x7e", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.JCC", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired conditional branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts the number of taken branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0x80", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.ALL_TAKEN_BRANCHES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired taken branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts far branch instructions retired. This includes far jump, far call and return, and Interrupt call and return.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xbf", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.FAR_BRANCH", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired far branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts near indirect call or near indirect jmp branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xeb", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.NON_RETURN_IND", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired instructions of near indirect Jmp or call (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts near return branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xf7", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.RETURN", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired near return instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts near CALL branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xf9", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.CALL", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired near call instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts near indirect CALL branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xfb", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.IND_CALL", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired near indirect call instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts near relative CALL branch instructions retired.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xfd", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.REL_CALL", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired near relative call instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts Jcc (Jump on Conditional Code/Jump if Condition is Met) branch instructions retired that were taken and does not count when the Jcc branch instruction were not taken.", ++ "EventCode": "0xC4", ++ "Counter": "0,1,2,3", ++ "UMask": "0xfe", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_INST_RETIRED.TAKEN_JCC", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired conditional branch instructions that were taken (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted branch instructions retired including all branch types.", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.ALL_BRANCHES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted retired Jcc (Jump on Conditional Code/Jump if Condition is Met) branch instructions retired, including both when the branch was supposed to be taken and when it was not supposed to be taken (but the processor predicted the opposite condition).", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0x7e", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.JCC", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted conditional branch instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted branch instructions retired that were near indirect call or near indirect jmp, where the target address taken was not what the processor predicted.", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0xeb", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.NON_RETURN_IND", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted instructions of near indirect Jmp or near indirect call (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted near RET branch instructions retired, where the return address taken was not what the processor predicted.", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0xf7", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.RETURN", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted near return instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted near indirect CALL branch instructions retired, where the target address taken was not what the processor predicted.", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0xfb", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.IND_CALL", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted near indirect call instructions (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts mispredicted retired Jcc (Jump on Conditional Code/Jump if Condition is Met) branch instructions retired that were supposed to be taken but the processor predicted that it would not be taken.", ++ "EventCode": "0xC5", ++ "Counter": "0,1,2,3", ++ "UMask": "0xfe", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BR_MISP_RETIRED.TAKEN_JCC", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Retired mispredicted conditional branch instructions that were taken (Precise event capable)" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts core cycles if either divide unit is busy.", ++ "EventCode": "0xCD", ++ "Counter": "0,1,2,3", ++ "UMask": "0x0", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CYCLES_DIV_BUSY.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Cycles a divider is busy" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts core cycles the integer divide unit is busy.", ++ "EventCode": "0xCD", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CYCLES_DIV_BUSY.IDIV", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles the integer divide unit is busy" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts core cycles the floating point divide unit is busy.", ++ "EventCode": "0xCD", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "CYCLES_DIV_BUSY.FPDIV", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Cycles the FP divide unit is busy" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times a BACLEAR is signaled for any reason, including, but not limited to indirect branch/call, Jcc (Jump on Conditional Code/Jump if Condition is Met) branch, unconditional branch/call, and returns.", ++ "EventCode": "0xE6", ++ "Counter": "0,1,2,3", ++ "UMask": "0x1", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BACLEARS.ALL", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "BACLEARs asserted for any branch type" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts BACLEARS on return instructions.", ++ "EventCode": "0xE6", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BACLEARS.RETURN", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "BACLEARs asserted for return branch" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts BACLEARS on Jcc (Jump on Conditional Code/Jump if Condition is Met) branches.", ++ "EventCode": "0xE6", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "BACLEARS.COND", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "BACLEARs asserted for conditional branch" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/goldmontplus/virtual-memory.json b/tools/perf/pmu-events/arch/x86/goldmontplus/virtual-memory.json +new file mode 100644 +index 000000000000..0b53a3b0dfb8 +--- /dev/null ++++ b/tools/perf/pmu-events/arch/x86/goldmontplus/virtual-memory.json +@@ -0,0 +1,218 @@ ++[ ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data loads (including SW prefetches) whose address translations missed in all TLB levels and were mapped to 4K pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x08", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_LOAD_MISSES.WALK_COMPLETED_4K", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walk completed due to a demand load to a 4K page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data loads (including SW prefetches) whose address translations missed in all TLB levels and were mapped to 2M or 4M pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x08", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_LOAD_MISSES.WALK_COMPLETED_2M_4M", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walk completed due to a demand load to a 2M or 4M page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data loads (including SW prefetches) whose address translations missed in all TLB levels and were mapped to 1GB pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x08", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_LOAD_MISSES.WALK_COMPLETED_1GB", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walk completed due to a demand load to a 1GB page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts once per cycle for each page walk occurring due to a load (demand data loads or SW prefetches). Includes cycles spent traversing the Extended Page Table (EPT). Average cycles per walk can be calculated by dividing by the number of walks.", ++ "EventCode": "0x08", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_LOAD_MISSES.WALK_PENDING", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walks outstanding due to a demand load every cycle." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data stores whose address translations missed in the TLB and were mapped to 4K pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x49", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_STORE_MISSES.WALK_COMPLETED_4K", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to a demand data store to a 4K page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data stores whose address translations missed in the TLB and were mapped to 2M or 4M pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x49", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_STORE_MISSES.WALK_COMPLETED_2M_4M", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to a demand data store to a 2M or 4M page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to demand data stores whose address translations missed in the TLB and were mapped to 1GB pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x49", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_STORE_MISSES.WALK_COMPLETED_1GB", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to a demand data store to a 1GB page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts once per cycle for each page walk occurring due to a demand data store. Includes cycles spent traversing the Extended Page Table (EPT). Average cycles per walk can be calculated by dividing by the number of walks.", ++ "EventCode": "0x49", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "DTLB_STORE_MISSES.WALK_PENDING", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walks outstanding due to a demand data store every cycle." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts once per cycle for each page walk only while traversing the Extended Page Table (EPT), and does not count during the rest of the translation. The EPT is used for translating Guest-Physical Addresses to Physical Addresses for Virtual Machine Monitors (VMMs). Average cycles per walk can be calculated by dividing the count by number of walks.", ++ "EventCode": "0x4F", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "EPT.WALK_PENDING", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walks outstanding due to walking the EPT every cycle" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts the number of times the machine was unable to find a translation in the Instruction Translation Lookaside Buffer (ITLB) for a linear address of an instruction fetch. It counts when new translation are filled into the ITLB. The event is speculative in nature, but will not count translations (page walks) that are begun and not finished, or translations that are finished but not filled into the ITLB.", ++ "EventCode": "0x81", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ITLB.MISS", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "ITLB misses" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to instruction fetches whose address translations missed in the TLB and were mapped to 4K pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x85", ++ "Counter": "0,1,2,3", ++ "UMask": "0x2", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ITLB_MISSES.WALK_COMPLETED_4K", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to an instruction fetch in a 4K page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to instruction fetches whose address translations missed in the TLB and were mapped to 2M or 4M pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x85", ++ "Counter": "0,1,2,3", ++ "UMask": "0x4", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ITLB_MISSES.WALK_COMPLETED_2M_4M", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to an instruction fetch in a 2M or 4M page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts page walks completed due to instruction fetches whose address translations missed in the TLB and were mapped to 1GB pages. The page walks can end with or without a page fault.", ++ "EventCode": "0x85", ++ "Counter": "0,1,2,3", ++ "UMask": "0x8", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ITLB_MISSES.WALK_COMPLETED_1GB", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "2000003", ++ "BriefDescription": "Page walk completed due to an instruction fetch in a 1GB page" ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts once per cycle for each page walk occurring due to an instruction fetch. Includes cycles spent traversing the Extended Page Table (EPT). Average cycles per walk can be calculated by dividing by the number of walks.", ++ "EventCode": "0x85", ++ "Counter": "0,1,2,3", ++ "UMask": "0x10", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "ITLB_MISSES.WALK_PENDING", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Page walks outstanding due to an instruction fetch every cycle." ++ }, ++ { ++ "CollectPEBSRecord": "1", ++ "PublicDescription": "Counts STLB flushes. The TLBs are flushed on instructions like INVLPG and MOV to CR3.", ++ "EventCode": "0xBD", ++ "Counter": "0,1,2,3", ++ "UMask": "0x20", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "TLB_FLUSHES.STLB_ANY", ++ "PDIR_COUNTER": "na", ++ "SampleAfterValue": "20003", ++ "BriefDescription": "STLB flushes" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts load uops retired that caused a DTLB miss.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x11", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.DTLB_MISS_LOADS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Load uops retired that missed the DTLB (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts store uops retired that caused a DTLB miss.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x12", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.DTLB_MISS_STORES", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Store uops retired that missed the DTLB (Precise event capable)" ++ }, ++ { ++ "PEBS": "2", ++ "CollectPEBSRecord": "2", ++ "PublicDescription": "Counts uops retired that had a DTLB miss on load, store or either. Note that when two distinct memory operations to the same page miss the DTLB, only one of them will be recorded as a DTLB miss.", ++ "EventCode": "0xD0", ++ "Counter": "0,1,2,3", ++ "UMask": "0x13", ++ "PEBScounters": "0,1,2,3", ++ "EventName": "MEM_UOPS_RETIRED.DTLB_MISS", ++ "SampleAfterValue": "200003", ++ "BriefDescription": "Memory uops retired that missed the DTLB (Precise event capable)" ++ } ++] +\ No newline at end of file +diff --git a/tools/perf/pmu-events/arch/x86/mapfile.csv b/tools/perf/pmu-events/arch/x86/mapfile.csv +index 4ea068366c3e..fe1a2c47cabf 100644 +--- a/tools/perf/pmu-events/arch/x86/mapfile.csv ++++ b/tools/perf/pmu-events/arch/x86/mapfile.csv +@@ -9,6 +9,7 @@ GenuineIntel-6-27,v4,bonnell,core + GenuineIntel-6-36,v4,bonnell,core + GenuineIntel-6-35,v4,bonnell,core + GenuineIntel-6-5C,v8,goldmont,core ++GenuineIntel-6-7A,v1,goldmontplus,core + GenuineIntel-6-3C,v24,haswell,core + GenuineIntel-6-45,v24,haswell,core + GenuineIntel-6-46,v24,haswell,core +diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c +index 00c98c968cb1..505c13bf7e30 100644 +--- a/tools/perf/util/dso.c ++++ b/tools/perf/util/dso.c +@@ -352,6 +352,8 @@ int __kmod_path__parse(struct kmod_path *m, const char *path, + if ((strncmp(name, "[kernel.kallsyms]", 17) == 0) || + (strncmp(name, "[guest.kernel.kallsyms", 22) == 0) || + (strncmp(name, "[vdso]", 6) == 0) || ++ (strncmp(name, "[vdso32]", 8) == 0) || ++ (strncmp(name, "[vdsox32]", 9) == 0) || + (strncmp(name, "[vsyscall]", 10) == 0)) { + m->kmod = false; + +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +index f9157aed1289..d404bed7003a 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c +@@ -113,6 +113,7 @@ struct intel_pt_decoder { + bool have_cyc; + bool fixup_last_mtc; + bool have_last_ip; ++ enum intel_pt_param_flags flags; + uint64_t pos; + uint64_t last_ip; + uint64_t ip; +@@ -226,6 +227,8 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) + decoder->return_compression = params->return_compression; + decoder->branch_enable = params->branch_enable; + ++ decoder->flags = params->flags; ++ + decoder->period = params->period; + decoder->period_type = params->period_type; + +@@ -1097,6 +1100,15 @@ static bool intel_pt_fup_event(struct intel_pt_decoder *decoder) + return ret; + } + ++static inline bool intel_pt_fup_with_nlip(struct intel_pt_decoder *decoder, ++ struct intel_pt_insn *intel_pt_insn, ++ uint64_t ip, int err) ++{ ++ return decoder->flags & INTEL_PT_FUP_WITH_NLIP && !err && ++ intel_pt_insn->branch == INTEL_PT_BR_INDIRECT && ++ ip == decoder->ip + intel_pt_insn->length; ++} ++ + static int intel_pt_walk_fup(struct intel_pt_decoder *decoder) + { + struct intel_pt_insn intel_pt_insn; +@@ -1109,10 +1121,11 @@ static int intel_pt_walk_fup(struct intel_pt_decoder *decoder) + err = intel_pt_walk_insn(decoder, &intel_pt_insn, ip); + if (err == INTEL_PT_RETURN) + return 0; +- if (err == -EAGAIN) { ++ if (err == -EAGAIN || ++ intel_pt_fup_with_nlip(decoder, &intel_pt_insn, ip, err)) { + if (intel_pt_fup_event(decoder)) + return 0; +- return err; ++ return -EAGAIN; + } + decoder->set_fup_tx_flags = false; + if (err) +@@ -1376,7 +1389,6 @@ static int intel_pt_overflow(struct intel_pt_decoder *decoder) + { + intel_pt_log("ERROR: Buffer overflow\n"); + intel_pt_clear_tx_flags(decoder); +- decoder->have_tma = false; + decoder->cbr = 0; + decoder->timestamp_insn_cnt = 0; + decoder->pkt_state = INTEL_PT_STATE_ERR_RESYNC; +@@ -1604,7 +1616,6 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder *decoder) + case INTEL_PT_PSB: + case INTEL_PT_TSC: + case INTEL_PT_TMA: +- case INTEL_PT_CBR: + case INTEL_PT_MODE_TSX: + case INTEL_PT_BAD: + case INTEL_PT_PSBEND: +@@ -1620,6 +1631,10 @@ static int intel_pt_walk_fup_tip(struct intel_pt_decoder *decoder) + decoder->pkt_step = 0; + return -ENOENT; + ++ case INTEL_PT_CBR: ++ intel_pt_calc_cbr(decoder); ++ break; ++ + case INTEL_PT_OVF: + return intel_pt_overflow(decoder); + +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +index fc1752d50019..51c18d67f4ca 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.h +@@ -60,6 +60,14 @@ enum { + INTEL_PT_ERR_MAX, + }; + ++enum intel_pt_param_flags { ++ /* ++ * FUP packet can contain next linear instruction pointer instead of ++ * current linear instruction pointer. ++ */ ++ INTEL_PT_FUP_WITH_NLIP = 1 << 0, ++}; ++ + struct intel_pt_state { + enum intel_pt_sample_type type; + int err; +@@ -106,6 +114,7 @@ struct intel_pt_params { + unsigned int mtc_period; + uint32_t tsc_ctc_ratio_n; + uint32_t tsc_ctc_ratio_d; ++ enum intel_pt_param_flags flags; + }; + + struct intel_pt_decoder; +diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c +index ba4c9dd18643..d426761a549d 100644 +--- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c ++++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c +@@ -366,7 +366,7 @@ static int intel_pt_get_cyc(unsigned int byte, const unsigned char *buf, + if (len < offs) + return INTEL_PT_NEED_MORE_BYTES; + byte = buf[offs++]; +- payload |= (byte >> 1) << shift; ++ payload |= ((uint64_t)byte >> 1) << shift; + } + + packet->type = INTEL_PT_CYC; +diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c +index d9573c1fa555..3b118fa9da89 100644 +--- a/tools/perf/util/intel-pt.c ++++ b/tools/perf/util/intel-pt.c +@@ -784,6 +784,7 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct intel_pt *pt, + unsigned int queue_nr) + { + struct intel_pt_params params = { .get_trace = 0, }; ++ struct perf_env *env = pt->machine->env; + struct intel_pt_queue *ptq; + + ptq = zalloc(sizeof(struct intel_pt_queue)); +@@ -865,6 +866,9 @@ static struct intel_pt_queue *intel_pt_alloc_queue(struct intel_pt *pt, + } + } + ++ if (env->cpuid && !strncmp(env->cpuid, "GenuineIntel,6,92,", 18)) ++ params.flags |= INTEL_PT_FUP_WITH_NLIP; ++ + ptq->decoder = intel_pt_decoder_new(¶ms); + if (!ptq->decoder) + goto out_free; +@@ -1560,6 +1564,7 @@ static int intel_pt_sample(struct intel_pt_queue *ptq) + + if (intel_pt_is_switch_ip(ptq, state->to_ip)) { + switch (ptq->switch_state) { ++ case INTEL_PT_SS_NOT_TRACING: + case INTEL_PT_SS_UNKNOWN: + case INTEL_PT_SS_EXPECTING_SWITCH_IP: + err = intel_pt_next_tid(pt, ptq); +diff --git a/tools/testing/selftests/ftrace/test.d/functions b/tools/testing/selftests/ftrace/test.d/functions +index f2019b37370d..6a4982d029bf 100644 +--- a/tools/testing/selftests/ftrace/test.d/functions ++++ b/tools/testing/selftests/ftrace/test.d/functions +@@ -15,14 +15,29 @@ reset_tracer() { # reset the current tracer + echo nop > current_tracer + } + +-reset_trigger() { # reset all current setting triggers +- grep -v ^# events/*/*/trigger | ++reset_trigger_file() { ++ # remove action triggers first ++ grep -H ':on[^:]*(' $@ | ++ while read line; do ++ cmd=`echo $line | cut -f2- -d: | cut -f1 -d" "` ++ file=`echo $line | cut -f1 -d:` ++ echo "!$cmd" >> $file ++ done ++ grep -Hv ^# $@ | + while read line; do + cmd=`echo $line | cut -f2- -d: | cut -f1 -d" "` +- echo "!$cmd" > `echo $line | cut -f1 -d:` ++ file=`echo $line | cut -f1 -d:` ++ echo "!$cmd" > $file + done + } + ++reset_trigger() { # reset all current setting triggers ++ if [ -d events/synthetic ]; then ++ reset_trigger_file events/synthetic/*/trigger ++ fi ++ reset_trigger_file events/*/*/trigger ++} ++ + reset_events_filter() { # reset all current setting filters + grep -v ^none events/*/*/filter | + while read line; do diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.53-54.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.53-54.patch new file mode 100644 index 000000000000..ee2b8c4e4b85 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.53-54.patch @@ -0,0 +1,2835 @@ +diff --git a/Documentation/devicetree/bindings/net/dsa/b53.txt b/Documentation/devicetree/bindings/net/dsa/b53.txt +index 8acf51a4dfa8..47a6a7fe0b86 100644 +--- a/Documentation/devicetree/bindings/net/dsa/b53.txt ++++ b/Documentation/devicetree/bindings/net/dsa/b53.txt +@@ -10,6 +10,7 @@ Required properties: + "brcm,bcm53128" + "brcm,bcm5365" + "brcm,bcm5395" ++ "brcm,bcm5389" + "brcm,bcm5397" + "brcm,bcm5398" + +diff --git a/Makefile b/Makefile +index fb66998408f4..de0955d8dfa3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 53 ++SUBLEVEL = 54 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/imx6q.dtsi b/arch/arm/boot/dts/imx6q.dtsi +index 90a741732f60..4747ede61acd 100644 +--- a/arch/arm/boot/dts/imx6q.dtsi ++++ b/arch/arm/boot/dts/imx6q.dtsi +@@ -96,7 +96,7 @@ + clocks = <&clks IMX6Q_CLK_ECSPI5>, + <&clks IMX6Q_CLK_ECSPI5>; + clock-names = "ipg", "per"; +- dmas = <&sdma 11 7 1>, <&sdma 12 7 2>; ++ dmas = <&sdma 11 8 1>, <&sdma 12 8 2>; + dma-names = "rx", "tx"; + status = "disabled"; + }; +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index db78d353bab1..191e86c62037 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -45,6 +45,8 @@ + #include + #include + ++#include "acpica/accommon.h" ++#include "acpica/acnamesp.h" + #include "internal.h" + + #define _COMPONENT ACPI_OS_SERVICES +@@ -1477,6 +1479,76 @@ int acpi_check_region(resource_size_t start, resource_size_t n, + } + EXPORT_SYMBOL(acpi_check_region); + ++static acpi_status acpi_deactivate_mem_region(acpi_handle handle, u32 level, ++ void *_res, void **return_value) ++{ ++ struct acpi_mem_space_context **mem_ctx; ++ union acpi_operand_object *handler_obj; ++ union acpi_operand_object *region_obj2; ++ union acpi_operand_object *region_obj; ++ struct resource *res = _res; ++ acpi_status status; ++ ++ region_obj = acpi_ns_get_attached_object(handle); ++ if (!region_obj) ++ return AE_OK; ++ ++ handler_obj = region_obj->region.handler; ++ if (!handler_obj) ++ return AE_OK; ++ ++ if (region_obj->region.space_id != ACPI_ADR_SPACE_SYSTEM_MEMORY) ++ return AE_OK; ++ ++ if (!(region_obj->region.flags & AOPOBJ_SETUP_COMPLETE)) ++ return AE_OK; ++ ++ region_obj2 = acpi_ns_get_secondary_object(region_obj); ++ if (!region_obj2) ++ return AE_OK; ++ ++ mem_ctx = (void *)®ion_obj2->extra.region_context; ++ ++ if (!(mem_ctx[0]->address >= res->start && ++ mem_ctx[0]->address < res->end)) ++ return AE_OK; ++ ++ status = handler_obj->address_space.setup(region_obj, ++ ACPI_REGION_DEACTIVATE, ++ NULL, (void **)mem_ctx); ++ if (ACPI_SUCCESS(status)) ++ region_obj->region.flags &= ~(AOPOBJ_SETUP_COMPLETE); ++ ++ return status; ++} ++ ++/** ++ * acpi_release_memory - Release any mappings done to a memory region ++ * @handle: Handle to namespace node ++ * @res: Memory resource ++ * @level: A level that terminates the search ++ * ++ * Walks through @handle and unmaps all SystemMemory Operation Regions that ++ * overlap with @res and that have already been activated (mapped). ++ * ++ * This is a helper that allows drivers to place special requirements on memory ++ * region that may overlap with operation regions, primarily allowing them to ++ * safely map the region as non-cached memory. ++ * ++ * The unmapped Operation Regions will be automatically remapped next time they ++ * are called, so the drivers do not need to do anything else. ++ */ ++acpi_status acpi_release_memory(acpi_handle handle, struct resource *res, ++ u32 level) ++{ ++ if (!(res->flags & IORESOURCE_MEM)) ++ return AE_TYPE; ++ ++ return acpi_walk_namespace(ACPI_TYPE_REGION, handle, level, ++ acpi_deactivate_mem_region, NULL, res, NULL); ++} ++EXPORT_SYMBOL_GPL(acpi_release_memory); ++ + /* + * Let drivers know whether the resource checks are effective + */ +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c +index 9c9a22958717..a8d2eb0ceb8d 100644 +--- a/drivers/atm/zatm.c ++++ b/drivers/atm/zatm.c +@@ -1151,8 +1151,8 @@ static void eprom_get_byte(struct zatm_dev *zatm_dev, unsigned char *byte, + } + + +-static unsigned char eprom_try_esi(struct atm_dev *dev, unsigned short cmd, +- int offset, int swap) ++static int eprom_try_esi(struct atm_dev *dev, unsigned short cmd, int offset, ++ int swap) + { + unsigned char buf[ZEPROM_SIZE]; + struct zatm_dev *zatm_dev; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 4d08957d2108..1360a24d2ede 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -747,8 +747,7 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain, + } + if (domain == AMDGPU_GEM_DOMAIN_VRAM) { + adev->vram_pin_size += amdgpu_bo_size(bo); +- if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS) +- adev->invisible_pin_size += amdgpu_bo_size(bo); ++ adev->invisible_pin_size += amdgpu_vram_mgr_bo_invisible_size(bo); + } else if (domain == AMDGPU_GEM_DOMAIN_GTT) { + adev->gart_pin_size += amdgpu_bo_size(bo); + } +@@ -786,8 +785,7 @@ int amdgpu_bo_unpin(struct amdgpu_bo *bo) + + if (bo->tbo.mem.mem_type == TTM_PL_VRAM) { + adev->vram_pin_size -= amdgpu_bo_size(bo); +- if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS) +- adev->invisible_pin_size -= amdgpu_bo_size(bo); ++ adev->invisible_pin_size -= amdgpu_vram_mgr_bo_invisible_size(bo); + } else if (bo->tbo.mem.mem_type == TTM_PL_TT) { + adev->gart_pin_size -= amdgpu_bo_size(bo); + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h +index 43093bffa2cf..557829a84778 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.h +@@ -64,6 +64,7 @@ extern const struct ttm_mem_type_manager_func amdgpu_vram_mgr_func; + bool amdgpu_gtt_mgr_is_allocated(struct ttm_mem_reg *mem); + uint64_t amdgpu_gtt_mgr_usage(struct ttm_mem_type_manager *man); + ++u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo); + uint64_t amdgpu_vram_mgr_usage(struct ttm_mem_type_manager *man); + uint64_t amdgpu_vram_mgr_vis_usage(struct ttm_mem_type_manager *man); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +index 041e0121590c..308a9755eae3 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vcn.c +@@ -85,6 +85,7 @@ int amdgpu_vcn_sw_init(struct amdgpu_device *adev) + } + + hdr = (const struct common_firmware_header *)adev->vcn.fw->data; ++ adev->vcn.fw_version = le32_to_cpu(hdr->ucode_version); + family_id = le32_to_cpu(hdr->ucode_version) & 0xff; + version_major = (le32_to_cpu(hdr->ucode_version) >> 24) & 0xff; + version_minor = (le32_to_cpu(hdr->ucode_version) >> 8) & 0xff; +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +index 26e900627971..86d8a961518e 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vram_mgr.c +@@ -101,6 +101,22 @@ static u64 amdgpu_vram_mgr_vis_size(struct amdgpu_device *adev, + adev->mc.visible_vram_size : end) - start; + } + ++/** ++ * amdgpu_vram_mgr_bo_invisible_size - CPU invisible BO size ++ * ++ * @bo: &amdgpu_bo buffer object (must be in VRAM) ++ * ++ * Returns: ++ * How much of the given &amdgpu_bo buffer object lies in CPU invisible VRAM. ++ */ ++u64 amdgpu_vram_mgr_bo_invisible_size(struct amdgpu_bo *bo) ++{ ++ if (bo->flags & AMDGPU_GEM_CREATE_NO_CPU_ACCESS) ++ return amdgpu_bo_size(bo); ++ ++ return 0; ++} ++ + /** + * amdgpu_vram_mgr_new - allocate new ranges + * +@@ -140,7 +156,8 @@ static int amdgpu_vram_mgr_new(struct ttm_mem_type_manager *man, + num_nodes = DIV_ROUND_UP(mem->num_pages, pages_per_node); + } + +- nodes = kcalloc(num_nodes, sizeof(*nodes), GFP_KERNEL); ++ nodes = kvmalloc_array(num_nodes, sizeof(*nodes), ++ GFP_KERNEL | __GFP_ZERO); + if (!nodes) + return -ENOMEM; + +@@ -195,7 +212,7 @@ static int amdgpu_vram_mgr_new(struct ttm_mem_type_manager *man, + drm_mm_remove_node(&nodes[i]); + spin_unlock(&mgr->lock); + +- kfree(nodes); ++ kvfree(nodes); + return r == -ENOSPC ? 0 : r; + } + +@@ -234,7 +251,7 @@ static void amdgpu_vram_mgr_del(struct ttm_mem_type_manager *man, + atomic64_sub(usage, &mgr->usage); + atomic64_sub(vis_usage, &mgr->vis_usage); + +- kfree(mem->mm_node); ++ kvfree(mem->mm_node); + mem->mm_node = NULL; + } + +diff --git a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +index cf81065e3c5a..5183b46563f6 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vce_v3_0.c +@@ -467,8 +467,8 @@ static int vce_v3_0_hw_init(void *handle) + struct amdgpu_device *adev = (struct amdgpu_device *)handle; + + vce_v3_0_override_vce_clock_gating(adev, true); +- if (!(adev->flags & AMD_IS_APU)) +- amdgpu_asic_set_vce_clocks(adev, 10000, 10000); ++ ++ amdgpu_asic_set_vce_clocks(adev, 10000, 10000); + + for (i = 0; i < adev->vce.num_rings; i++) + adev->vce.ring[i].ready = false; +diff --git a/drivers/gpu/drm/amd/amdgpu/vi.c b/drivers/gpu/drm/amd/amdgpu/vi.c +index 4968b6bb9466..0327e0a6802b 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vi.c ++++ b/drivers/gpu/drm/amd/amdgpu/vi.c +@@ -729,33 +729,59 @@ static int vi_set_uvd_clock(struct amdgpu_device *adev, u32 clock, + return r; + + tmp = RREG32_SMC(cntl_reg); +- tmp &= ~(CG_DCLK_CNTL__DCLK_DIR_CNTL_EN_MASK | +- CG_DCLK_CNTL__DCLK_DIVIDER_MASK); ++ ++ if (adev->flags & AMD_IS_APU) ++ tmp &= ~CG_DCLK_CNTL__DCLK_DIVIDER_MASK; ++ else ++ tmp &= ~(CG_DCLK_CNTL__DCLK_DIR_CNTL_EN_MASK | ++ CG_DCLK_CNTL__DCLK_DIVIDER_MASK); + tmp |= dividers.post_divider; + WREG32_SMC(cntl_reg, tmp); + + for (i = 0; i < 100; i++) { +- if (RREG32_SMC(status_reg) & CG_DCLK_STATUS__DCLK_STATUS_MASK) +- break; ++ tmp = RREG32_SMC(status_reg); ++ if (adev->flags & AMD_IS_APU) { ++ if (tmp & 0x10000) ++ break; ++ } else { ++ if (tmp & CG_DCLK_STATUS__DCLK_STATUS_MASK) ++ break; ++ } + mdelay(10); + } + if (i == 100) + return -ETIMEDOUT; +- + return 0; + } + ++#define ixGNB_CLK1_DFS_CNTL 0xD82200F0 ++#define ixGNB_CLK1_STATUS 0xD822010C ++#define ixGNB_CLK2_DFS_CNTL 0xD8220110 ++#define ixGNB_CLK2_STATUS 0xD822012C ++#define ixGNB_CLK3_DFS_CNTL 0xD8220130 ++#define ixGNB_CLK3_STATUS 0xD822014C ++ + static int vi_set_uvd_clocks(struct amdgpu_device *adev, u32 vclk, u32 dclk) + { + int r; + +- r = vi_set_uvd_clock(adev, vclk, ixCG_VCLK_CNTL, ixCG_VCLK_STATUS); +- if (r) +- return r; ++ if (adev->flags & AMD_IS_APU) { ++ r = vi_set_uvd_clock(adev, vclk, ixGNB_CLK2_DFS_CNTL, ixGNB_CLK2_STATUS); ++ if (r) ++ return r; + +- r = vi_set_uvd_clock(adev, dclk, ixCG_DCLK_CNTL, ixCG_DCLK_STATUS); +- if (r) +- return r; ++ r = vi_set_uvd_clock(adev, dclk, ixGNB_CLK1_DFS_CNTL, ixGNB_CLK1_STATUS); ++ if (r) ++ return r; ++ } else { ++ r = vi_set_uvd_clock(adev, vclk, ixCG_VCLK_CNTL, ixCG_VCLK_STATUS); ++ if (r) ++ return r; ++ ++ r = vi_set_uvd_clock(adev, dclk, ixCG_DCLK_CNTL, ixCG_DCLK_STATUS); ++ if (r) ++ return r; ++ } + + return 0; + } +@@ -765,6 +791,22 @@ static int vi_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk) + int r, i; + struct atom_clock_dividers dividers; + u32 tmp; ++ u32 reg_ctrl; ++ u32 reg_status; ++ u32 status_mask; ++ u32 reg_mask; ++ ++ if (adev->flags & AMD_IS_APU) { ++ reg_ctrl = ixGNB_CLK3_DFS_CNTL; ++ reg_status = ixGNB_CLK3_STATUS; ++ status_mask = 0x00010000; ++ reg_mask = CG_ECLK_CNTL__ECLK_DIVIDER_MASK; ++ } else { ++ reg_ctrl = ixCG_ECLK_CNTL; ++ reg_status = ixCG_ECLK_STATUS; ++ status_mask = CG_ECLK_STATUS__ECLK_STATUS_MASK; ++ reg_mask = CG_ECLK_CNTL__ECLK_DIR_CNTL_EN_MASK | CG_ECLK_CNTL__ECLK_DIVIDER_MASK; ++ } + + r = amdgpu_atombios_get_clock_dividers(adev, + COMPUTE_GPUCLK_INPUT_FLAG_DEFAULT_GPUCLK, +@@ -773,24 +815,25 @@ static int vi_set_vce_clocks(struct amdgpu_device *adev, u32 evclk, u32 ecclk) + return r; + + for (i = 0; i < 100; i++) { +- if (RREG32_SMC(ixCG_ECLK_STATUS) & CG_ECLK_STATUS__ECLK_STATUS_MASK) ++ if (RREG32_SMC(reg_status) & status_mask) + break; + mdelay(10); + } ++ + if (i == 100) + return -ETIMEDOUT; + +- tmp = RREG32_SMC(ixCG_ECLK_CNTL); +- tmp &= ~(CG_ECLK_CNTL__ECLK_DIR_CNTL_EN_MASK | +- CG_ECLK_CNTL__ECLK_DIVIDER_MASK); ++ tmp = RREG32_SMC(reg_ctrl); ++ tmp &= ~reg_mask; + tmp |= dividers.post_divider; +- WREG32_SMC(ixCG_ECLK_CNTL, tmp); ++ WREG32_SMC(reg_ctrl, tmp); + + for (i = 0; i < 100; i++) { +- if (RREG32_SMC(ixCG_ECLK_STATUS) & CG_ECLK_STATUS__ECLK_STATUS_MASK) ++ if (RREG32_SMC(reg_status) & status_mask) + break; + mdelay(10); + } ++ + if (i == 100) + return -ETIMEDOUT; + +diff --git a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +index 703c2d13603f..eb7c4cf19bf6 100644 +--- a/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c ++++ b/drivers/gpu/drm/atmel-hlcdc/atmel_hlcdc_plane.c +@@ -889,7 +889,7 @@ static int atmel_hlcdc_plane_init_properties(struct atmel_hlcdc_plane *plane, + drm_object_attach_property(&plane->base.base, + props->alpha, 255); + +- if (desc->layout.xstride && desc->layout.pstride) { ++ if (desc->layout.xstride[0] && desc->layout.pstride[0]) { + int ret; + + ret = drm_plane_create_rotation_property(&plane->base, +diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h +index 61a2203b75df..be813b2738c1 100644 +--- a/drivers/gpu/drm/i915/i915_reg.h ++++ b/drivers/gpu/drm/i915/i915_reg.h +@@ -2484,12 +2484,17 @@ enum i915_power_well_id { + #define _3D_CHICKEN _MMIO(0x2084) + #define _3D_CHICKEN_HIZ_PLANE_DISABLE_MSAA_4X_SNB (1 << 10) + #define _3D_CHICKEN2 _MMIO(0x208c) ++ ++#define FF_SLICE_CHICKEN _MMIO(0x2088) ++#define FF_SLICE_CHICKEN_CL_PROVOKING_VERTEX_FIX (1 << 1) ++ + /* Disables pipelining of read flushes past the SF-WIZ interface. + * Required on all Ironlake steppings according to the B-Spec, but the + * particular danger of not doing so is not specified. + */ + # define _3D_CHICKEN2_WM_READ_PIPELINED (1 << 14) + #define _3D_CHICKEN3 _MMIO(0x2090) ++#define _3D_CHICKEN_SF_PROVOKING_VERTEX_FIX (1 << 12) + #define _3D_CHICKEN_SF_DISABLE_OBJEND_CULL (1 << 10) + #define _3D_CHICKEN3_SF_DISABLE_FASTCLIP_CULL (1 << 5) + #define _3D_CHICKEN_SDE_LIMIT_FIFO_POLY_DEPTH(x) ((x)<<1) /* gen8+ */ +diff --git a/drivers/gpu/drm/i915/intel_lrc.c b/drivers/gpu/drm/i915/intel_lrc.c +index 6f972e6ec663..d638b641b760 100644 +--- a/drivers/gpu/drm/i915/intel_lrc.c ++++ b/drivers/gpu/drm/i915/intel_lrc.c +@@ -1067,11 +1067,21 @@ static u32 *gen9_init_indirectctx_bb(struct intel_engine_cs *engine, u32 *batch) + /* WaFlushCoherentL3CacheLinesAtContextSwitch:skl,bxt,glk */ + batch = gen8_emit_flush_coherentl3_wa(engine, batch); + ++ *batch++ = MI_LOAD_REGISTER_IMM(3); ++ + /* WaDisableGatherAtSetShaderCommonSlice:skl,bxt,kbl,glk */ +- *batch++ = MI_LOAD_REGISTER_IMM(1); + *batch++ = i915_mmio_reg_offset(COMMON_SLICE_CHICKEN2); + *batch++ = _MASKED_BIT_DISABLE( + GEN9_DISABLE_GATHER_AT_SET_SHADER_COMMON_SLICE); ++ ++ /* BSpec: 11391 */ ++ *batch++ = i915_mmio_reg_offset(FF_SLICE_CHICKEN); ++ *batch++ = _MASKED_BIT_ENABLE(FF_SLICE_CHICKEN_CL_PROVOKING_VERTEX_FIX); ++ ++ /* BSpec: 11299 */ ++ *batch++ = i915_mmio_reg_offset(_3D_CHICKEN3); ++ *batch++ = _MASKED_BIT_ENABLE(_3D_CHICKEN_SF_PROVOKING_VERTEX_FIX); ++ + *batch++ = MI_NOOP; + + /* WaClearSlmSpaceAtContextSwitch:kbl */ +diff --git a/drivers/gpu/drm/qxl/qxl_display.c b/drivers/gpu/drm/qxl/qxl_display.c +index 9a9214ae0fb5..573bab222123 100644 +--- a/drivers/gpu/drm/qxl/qxl_display.c ++++ b/drivers/gpu/drm/qxl/qxl_display.c +@@ -630,7 +630,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, + struct qxl_cursor_cmd *cmd; + struct qxl_cursor *cursor; + struct drm_gem_object *obj; +- struct qxl_bo *cursor_bo = NULL, *user_bo = NULL; ++ struct qxl_bo *cursor_bo = NULL, *user_bo = NULL, *old_cursor_bo = NULL; + int ret; + void *user_ptr; + int size = 64*64*4; +@@ -684,7 +684,7 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, + cursor_bo, 0); + cmd->type = QXL_CURSOR_SET; + +- qxl_bo_unref(&qcrtc->cursor_bo); ++ old_cursor_bo = qcrtc->cursor_bo; + qcrtc->cursor_bo = cursor_bo; + cursor_bo = NULL; + } else { +@@ -704,6 +704,9 @@ static void qxl_cursor_atomic_update(struct drm_plane *plane, + qxl_push_cursor_ring_release(qdev, release, QXL_CMD_CURSOR, false); + qxl_release_fence_buffer_objects(release); + ++ if (old_cursor_bo) ++ qxl_bo_unref(&old_cursor_bo); ++ + qxl_bo_unref(&cursor_bo); + + return; +diff --git a/drivers/md/dm-raid.c b/drivers/md/dm-raid.c +index 33834db7c0a0..38a2ac24428e 100644 +--- a/drivers/md/dm-raid.c ++++ b/drivers/md/dm-raid.c +@@ -3637,8 +3637,11 @@ static void raid_postsuspend(struct dm_target *ti) + { + struct raid_set *rs = ti->private; + +- if (!test_and_set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) ++ if (!test_and_set_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) { ++ mddev_lock_nointr(&rs->md); + mddev_suspend(&rs->md); ++ mddev_unlock(&rs->md); ++ } + + rs->md.ro = 1; + } +@@ -3898,8 +3901,11 @@ static void raid_resume(struct dm_target *ti) + if (!(rs->ctr_flags & RESUME_STAY_FROZEN_FLAGS)) + clear_bit(MD_RECOVERY_FROZEN, &mddev->recovery); + +- if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) ++ if (test_and_clear_bit(RT_FLAG_RS_SUSPENDED, &rs->runtime_flags)) { ++ mddev_lock_nointr(mddev); + mddev_resume(mddev); ++ mddev_unlock(mddev); ++ } + } + + static struct target_type raid_target = { +diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c +index 03082e17c65c..72ce0bccc865 100644 +--- a/drivers/md/md-cluster.c ++++ b/drivers/md/md-cluster.c +@@ -442,10 +442,11 @@ static void __remove_suspend_info(struct md_cluster_info *cinfo, int slot) + static void remove_suspend_info(struct mddev *mddev, int slot) + { + struct md_cluster_info *cinfo = mddev->cluster_info; ++ mddev->pers->quiesce(mddev, 1); + spin_lock_irq(&cinfo->suspend_lock); + __remove_suspend_info(cinfo, slot); + spin_unlock_irq(&cinfo->suspend_lock); +- mddev->pers->quiesce(mddev, 2); ++ mddev->pers->quiesce(mddev, 0); + } + + +@@ -492,13 +493,12 @@ static void process_suspend_info(struct mddev *mddev, + s->lo = lo; + s->hi = hi; + mddev->pers->quiesce(mddev, 1); +- mddev->pers->quiesce(mddev, 0); + spin_lock_irq(&cinfo->suspend_lock); + /* Remove existing entry (if exists) before adding */ + __remove_suspend_info(cinfo, slot); + list_add(&s->list, &cinfo->suspend_list); + spin_unlock_irq(&cinfo->suspend_lock); +- mddev->pers->quiesce(mddev, 2); ++ mddev->pers->quiesce(mddev, 0); + } + + static void process_add_new_disk(struct mddev *mddev, struct cluster_msg *cmsg) +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 7143c8b9284b..11a67eac55b1 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -266,16 +266,31 @@ static DEFINE_SPINLOCK(all_mddevs_lock); + * call has finished, the bio has been linked into some internal structure + * and so is visible to ->quiesce(), so we don't need the refcount any more. + */ ++static bool is_suspended(struct mddev *mddev, struct bio *bio) ++{ ++ if (mddev->suspended) ++ return true; ++ if (bio_data_dir(bio) != WRITE) ++ return false; ++ if (mddev->suspend_lo >= mddev->suspend_hi) ++ return false; ++ if (bio->bi_iter.bi_sector >= mddev->suspend_hi) ++ return false; ++ if (bio_end_sector(bio) < mddev->suspend_lo) ++ return false; ++ return true; ++} ++ + void md_handle_request(struct mddev *mddev, struct bio *bio) + { + check_suspended: + rcu_read_lock(); +- if (mddev->suspended) { ++ if (is_suspended(mddev, bio)) { + DEFINE_WAIT(__wait); + for (;;) { + prepare_to_wait(&mddev->sb_wait, &__wait, + TASK_UNINTERRUPTIBLE); +- if (!mddev->suspended) ++ if (!is_suspended(mddev, bio)) + break; + rcu_read_unlock(); + schedule(); +@@ -344,12 +359,17 @@ static blk_qc_t md_make_request(struct request_queue *q, struct bio *bio) + void mddev_suspend(struct mddev *mddev) + { + WARN_ON_ONCE(mddev->thread && current == mddev->thread->tsk); ++ lockdep_assert_held(&mddev->reconfig_mutex); + if (mddev->suspended++) + return; + synchronize_rcu(); + wake_up(&mddev->sb_wait); ++ set_bit(MD_ALLOW_SB_UPDATE, &mddev->flags); ++ smp_mb__after_atomic(); + wait_event(mddev->sb_wait, atomic_read(&mddev->active_io) == 0); + mddev->pers->quiesce(mddev, 1); ++ clear_bit_unlock(MD_ALLOW_SB_UPDATE, &mddev->flags); ++ wait_event(mddev->sb_wait, !test_bit(MD_UPDATING_SB, &mddev->flags)); + + del_timer_sync(&mddev->safemode_timer); + } +@@ -357,6 +377,7 @@ EXPORT_SYMBOL_GPL(mddev_suspend); + + void mddev_resume(struct mddev *mddev) + { ++ lockdep_assert_held(&mddev->reconfig_mutex); + if (--mddev->suspended) + return; + wake_up(&mddev->sb_wait); +@@ -663,6 +684,7 @@ void mddev_unlock(struct mddev *mddev) + */ + spin_lock(&pers_lock); + md_wakeup_thread(mddev->thread); ++ wake_up(&mddev->sb_wait); + spin_unlock(&pers_lock); + } + EXPORT_SYMBOL_GPL(mddev_unlock); +@@ -4828,7 +4850,7 @@ suspend_lo_show(struct mddev *mddev, char *page) + static ssize_t + suspend_lo_store(struct mddev *mddev, const char *buf, size_t len) + { +- unsigned long long old, new; ++ unsigned long long new; + int err; + + err = kstrtoull(buf, 10, &new); +@@ -4844,16 +4866,10 @@ suspend_lo_store(struct mddev *mddev, const char *buf, size_t len) + if (mddev->pers == NULL || + mddev->pers->quiesce == NULL) + goto unlock; +- old = mddev->suspend_lo; ++ mddev_suspend(mddev); + mddev->suspend_lo = new; +- if (new >= old) +- /* Shrinking suspended region */ +- mddev->pers->quiesce(mddev, 2); +- else { +- /* Expanding suspended region - need to wait */ +- mddev->pers->quiesce(mddev, 1); +- mddev->pers->quiesce(mddev, 0); +- } ++ mddev_resume(mddev); ++ + err = 0; + unlock: + mddev_unlock(mddev); +@@ -4871,7 +4887,7 @@ suspend_hi_show(struct mddev *mddev, char *page) + static ssize_t + suspend_hi_store(struct mddev *mddev, const char *buf, size_t len) + { +- unsigned long long old, new; ++ unsigned long long new; + int err; + + err = kstrtoull(buf, 10, &new); +@@ -4884,19 +4900,13 @@ suspend_hi_store(struct mddev *mddev, const char *buf, size_t len) + if (err) + return err; + err = -EINVAL; +- if (mddev->pers == NULL || +- mddev->pers->quiesce == NULL) ++ if (mddev->pers == NULL) + goto unlock; +- old = mddev->suspend_hi; ++ ++ mddev_suspend(mddev); + mddev->suspend_hi = new; +- if (new <= old) +- /* Shrinking suspended region */ +- mddev->pers->quiesce(mddev, 2); +- else { +- /* Expanding suspended region - need to wait */ +- mddev->pers->quiesce(mddev, 1); +- mddev->pers->quiesce(mddev, 0); +- } ++ mddev_resume(mddev); ++ + err = 0; + unlock: + mddev_unlock(mddev); +@@ -6642,22 +6652,26 @@ static int set_bitmap_file(struct mddev *mddev, int fd) + return -ENOENT; /* cannot remove what isn't there */ + err = 0; + if (mddev->pers) { +- mddev->pers->quiesce(mddev, 1); + if (fd >= 0) { + struct bitmap *bitmap; + + bitmap = bitmap_create(mddev, -1); ++ mddev_suspend(mddev); + if (!IS_ERR(bitmap)) { + mddev->bitmap = bitmap; + err = bitmap_load(mddev); + } else + err = PTR_ERR(bitmap); +- } +- if (fd < 0 || err) { ++ if (err) { ++ bitmap_destroy(mddev); ++ fd = -1; ++ } ++ mddev_resume(mddev); ++ } else if (fd < 0) { ++ mddev_suspend(mddev); + bitmap_destroy(mddev); +- fd = -1; /* make sure to put the file */ ++ mddev_resume(mddev); + } +- mddev->pers->quiesce(mddev, 0); + } + if (fd < 0) { + struct file *f = mddev->bitmap_info.file; +@@ -6941,8 +6955,8 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) + mddev->bitmap_info.default_offset; + mddev->bitmap_info.space = + mddev->bitmap_info.default_space; +- mddev->pers->quiesce(mddev, 1); + bitmap = bitmap_create(mddev, -1); ++ mddev_suspend(mddev); + if (!IS_ERR(bitmap)) { + mddev->bitmap = bitmap; + rv = bitmap_load(mddev); +@@ -6950,7 +6964,7 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) + rv = PTR_ERR(bitmap); + if (rv) + bitmap_destroy(mddev); +- mddev->pers->quiesce(mddev, 0); ++ mddev_resume(mddev); + } else { + /* remove the bitmap */ + if (!mddev->bitmap) { +@@ -6973,9 +6987,9 @@ static int update_array_info(struct mddev *mddev, mdu_array_info_t *info) + mddev->bitmap_info.nodes = 0; + md_cluster_ops->leave(mddev); + } +- mddev->pers->quiesce(mddev, 1); ++ mddev_suspend(mddev); + bitmap_destroy(mddev); +- mddev->pers->quiesce(mddev, 0); ++ mddev_resume(mddev); + mddev->bitmap_info.offset = 0; + } + } +@@ -8858,6 +8872,16 @@ void md_check_recovery(struct mddev *mddev) + unlock: + wake_up(&mddev->sb_wait); + mddev_unlock(mddev); ++ } else if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags) && mddev->sb_flags) { ++ /* Write superblock - thread that called mddev_suspend() ++ * holds reconfig_mutex for us. ++ */ ++ set_bit(MD_UPDATING_SB, &mddev->flags); ++ smp_mb__after_atomic(); ++ if (test_bit(MD_ALLOW_SB_UPDATE, &mddev->flags)) ++ md_update_sb(mddev, 0); ++ clear_bit_unlock(MD_UPDATING_SB, &mddev->flags); ++ wake_up(&mddev->sb_wait); + } + } + EXPORT_SYMBOL(md_check_recovery); +diff --git a/drivers/md/md.h b/drivers/md/md.h +index 9b0a896890ef..11696aba94e3 100644 +--- a/drivers/md/md.h ++++ b/drivers/md/md.h +@@ -237,6 +237,12 @@ enum mddev_flags { + */ + MD_HAS_PPL, /* The raid array has PPL feature set */ + MD_HAS_MULTIPLE_PPLS, /* The raid array has multiple PPLs feature set */ ++ MD_ALLOW_SB_UPDATE, /* md_check_recovery is allowed to update ++ * the metadata without taking reconfig_mutex. ++ */ ++ MD_UPDATING_SB, /* md_check_recovery is updating the metadata ++ * without explicitly holding reconfig_mutex. ++ */ + }; + + enum mddev_sb_flags { +@@ -540,12 +546,11 @@ struct md_personality + int (*check_reshape) (struct mddev *mddev); + int (*start_reshape) (struct mddev *mddev); + void (*finish_reshape) (struct mddev *mddev); +- /* quiesce moves between quiescence states +- * 0 - fully active +- * 1 - no new requests allowed +- * others - reserved ++ /* quiesce suspends or resumes internal processing. ++ * 1 - stop new actions and wait for action io to complete ++ * 0 - return to normal behaviour + */ +- void (*quiesce) (struct mddev *mddev, int state); ++ void (*quiesce) (struct mddev *mddev, int quiesce); + /* takeover is used to transition an array from one + * personality to another. The new personality must be able + * to handle the data in the current layout. +diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c +index 5a00fc118470..5ecba9eef441 100644 +--- a/drivers/md/raid0.c ++++ b/drivers/md/raid0.c +@@ -768,7 +768,7 @@ static void *raid0_takeover(struct mddev *mddev) + return ERR_PTR(-EINVAL); + } + +-static void raid0_quiesce(struct mddev *mddev, int state) ++static void raid0_quiesce(struct mddev *mddev, int quiesce) + { + } + +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index e4e01d3bab81..029ecba60727 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -1298,11 +1298,9 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + */ + + +- if ((bio_end_sector(bio) > mddev->suspend_lo && +- bio->bi_iter.bi_sector < mddev->suspend_hi) || +- (mddev_is_clustered(mddev) && ++ if (mddev_is_clustered(mddev) && + md_cluster_ops->area_resyncing(mddev, WRITE, +- bio->bi_iter.bi_sector, bio_end_sector(bio)))) { ++ bio->bi_iter.bi_sector, bio_end_sector(bio))) { + + /* + * As the suspend_* range is controlled by userspace, we want +@@ -1313,12 +1311,10 @@ static void raid1_write_request(struct mddev *mddev, struct bio *bio, + sigset_t full, old; + prepare_to_wait(&conf->wait_barrier, + &w, TASK_INTERRUPTIBLE); +- if ((bio_end_sector(bio) <= mddev->suspend_lo || +- bio->bi_iter.bi_sector >= mddev->suspend_hi) && +- (!mddev_is_clustered(mddev) || +- !md_cluster_ops->area_resyncing(mddev, WRITE, ++ if (!mddev_is_clustered(mddev) || ++ !md_cluster_ops->area_resyncing(mddev, WRITE, + bio->bi_iter.bi_sector, +- bio_end_sector(bio)))) ++ bio_end_sector(bio))) + break; + sigfillset(&full); + sigprocmask(SIG_BLOCK, &full, &old); +@@ -3280,21 +3276,14 @@ static int raid1_reshape(struct mddev *mddev) + return 0; + } + +-static void raid1_quiesce(struct mddev *mddev, int state) ++static void raid1_quiesce(struct mddev *mddev, int quiesce) + { + struct r1conf *conf = mddev->private; + +- switch(state) { +- case 2: /* wake for suspend */ +- wake_up(&conf->wait_barrier); +- break; +- case 1: ++ if (quiesce) + freeze_array(conf, 0); +- break; +- case 0: ++ else + unfreeze_array(conf); +- break; +- } + } + + static void *raid1_takeover(struct mddev *mddev) +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 5fb31ef52945..b20c23f970f4 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -3838,18 +3838,14 @@ static void raid10_free(struct mddev *mddev, void *priv) + kfree(conf); + } + +-static void raid10_quiesce(struct mddev *mddev, int state) ++static void raid10_quiesce(struct mddev *mddev, int quiesce) + { + struct r10conf *conf = mddev->private; + +- switch(state) { +- case 1: ++ if (quiesce) + raise_barrier(conf, 0); +- break; +- case 0: ++ else + lower_barrier(conf); +- break; +- } + } + + static int raid10_resize(struct mddev *mddev, sector_t sectors) +diff --git a/drivers/md/raid5-cache.c b/drivers/md/raid5-cache.c +index 9a340728b846..0d535b40cb3b 100644 +--- a/drivers/md/raid5-cache.c ++++ b/drivers/md/raid5-cache.c +@@ -693,6 +693,8 @@ static void r5c_disable_writeback_async(struct work_struct *work) + struct r5l_log *log = container_of(work, struct r5l_log, + disable_writeback_work); + struct mddev *mddev = log->rdev->mddev; ++ struct r5conf *conf = mddev->private; ++ int locked = 0; + + if (log->r5c_journal_mode == R5C_JOURNAL_MODE_WRITE_THROUGH) + return; +@@ -701,11 +703,15 @@ static void r5c_disable_writeback_async(struct work_struct *work) + + /* wait superblock change before suspend */ + wait_event(mddev->sb_wait, +- !test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags)); +- +- mddev_suspend(mddev); +- log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH; +- mddev_resume(mddev); ++ conf->log == NULL || ++ (!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags) && ++ (locked = mddev_trylock(mddev)))); ++ if (locked) { ++ mddev_suspend(mddev); ++ log->r5c_journal_mode = R5C_JOURNAL_MODE_WRITE_THROUGH; ++ mddev_resume(mddev); ++ mddev_unlock(mddev); ++ } + } + + static void r5l_submit_current_io(struct r5l_log *log) +@@ -1583,21 +1589,21 @@ void r5l_wake_reclaim(struct r5l_log *log, sector_t space) + md_wakeup_thread(log->reclaim_thread); + } + +-void r5l_quiesce(struct r5l_log *log, int state) ++void r5l_quiesce(struct r5l_log *log, int quiesce) + { + struct mddev *mddev; +- if (!log || state == 2) ++ if (!log) + return; +- if (state == 0) +- kthread_unpark(log->reclaim_thread->tsk); +- else if (state == 1) { ++ ++ if (quiesce) { + /* make sure r5l_write_super_and_discard_space exits */ + mddev = log->rdev->mddev; + wake_up(&mddev->sb_wait); + kthread_park(log->reclaim_thread->tsk); + r5l_wake_reclaim(log, MaxSector); + r5l_do_reclaim(log); +- } ++ } else ++ kthread_unpark(log->reclaim_thread->tsk); + } + + bool r5l_log_disk_error(struct r5conf *conf) +@@ -3161,6 +3167,8 @@ void r5l_exit_log(struct r5conf *conf) + conf->log = NULL; + synchronize_rcu(); + ++ /* Ensure disable_writeback_work wakes up and exits */ ++ wake_up(&conf->mddev->sb_wait); + flush_work(&log->disable_writeback_work); + md_unregister_thread(&log->reclaim_thread); + mempool_destroy(log->meta_pool); +diff --git a/drivers/md/raid5-log.h b/drivers/md/raid5-log.h +index 7f9ad5f7cda0..284578b0a349 100644 +--- a/drivers/md/raid5-log.h ++++ b/drivers/md/raid5-log.h +@@ -9,7 +9,7 @@ extern void r5l_write_stripe_run(struct r5l_log *log); + extern void r5l_flush_stripe_to_raid(struct r5l_log *log); + extern void r5l_stripe_write_finished(struct stripe_head *sh); + extern int r5l_handle_flush_request(struct r5l_log *log, struct bio *bio); +-extern void r5l_quiesce(struct r5l_log *log, int state); ++extern void r5l_quiesce(struct r5l_log *log, int quiesce); + extern bool r5l_log_disk_error(struct r5conf *conf); + extern bool r5c_is_writeback(struct r5l_log *log); + extern int +diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c +index de1ef6264ee7..07ca2fd10189 100644 +--- a/drivers/md/raid5.c ++++ b/drivers/md/raid5.c +@@ -5686,28 +5686,6 @@ static bool raid5_make_request(struct mddev *mddev, struct bio * bi) + goto retry; + } + +- if (rw == WRITE && +- logical_sector >= mddev->suspend_lo && +- logical_sector < mddev->suspend_hi) { +- raid5_release_stripe(sh); +- /* As the suspend_* range is controlled by +- * userspace, we want an interruptible +- * wait. +- */ +- prepare_to_wait(&conf->wait_for_overlap, +- &w, TASK_INTERRUPTIBLE); +- if (logical_sector >= mddev->suspend_lo && +- logical_sector < mddev->suspend_hi) { +- sigset_t full, old; +- sigfillset(&full); +- sigprocmask(SIG_BLOCK, &full, &old); +- schedule(); +- sigprocmask(SIG_SETMASK, &old, NULL); +- do_prepare = true; +- } +- goto retry; +- } +- + if (test_bit(STRIPE_EXPANDING, &sh->state) || + !add_stripe_bio(sh, bi, dd_idx, rw, previous)) { + /* Stripe is busy expanding or +@@ -8025,16 +8003,12 @@ static void raid5_finish_reshape(struct mddev *mddev) + } + } + +-static void raid5_quiesce(struct mddev *mddev, int state) ++static void raid5_quiesce(struct mddev *mddev, int quiesce) + { + struct r5conf *conf = mddev->private; + +- switch(state) { +- case 2: /* resume for a suspend */ +- wake_up(&conf->wait_for_overlap); +- break; +- +- case 1: /* stop all writes */ ++ if (quiesce) { ++ /* stop all writes */ + lock_all_device_hash_locks_irq(conf); + /* '2' tells resync/reshape to pause so that all + * active stripes can drain +@@ -8050,17 +8024,15 @@ static void raid5_quiesce(struct mddev *mddev, int state) + unlock_all_device_hash_locks_irq(conf); + /* allow reshape to continue */ + wake_up(&conf->wait_for_overlap); +- break; +- +- case 0: /* re-enable writes */ ++ } else { ++ /* re-enable writes */ + lock_all_device_hash_locks_irq(conf); + conf->quiesce = 0; + wake_up(&conf->wait_for_quiescent); + wake_up(&conf->wait_for_overlap); + unlock_all_device_hash_locks_irq(conf); +- break; + } +- r5l_quiesce(conf->log, state); ++ r5l_quiesce(conf->log, quiesce); + } + + static void *raid45_takeover_raid0(struct mddev *mddev, int level) +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 528e04f96c13..d410de331854 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -440,7 +440,7 @@ static int nand_block_bad(struct mtd_info *mtd, loff_t ofs) + + for (; page < page_end; page++) { + res = chip->ecc.read_oob(mtd, chip, page); +- if (res) ++ if (res < 0) + return res; + + bad = chip->oob_poi[chip->badblockpos]; +diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c +index 274f3679f33d..acf64d4cd94c 100644 +--- a/drivers/net/dsa/b53/b53_common.c ++++ b/drivers/net/dsa/b53/b53_common.c +@@ -1549,6 +1549,18 @@ static const struct b53_chip_data b53_switch_chips[] = { + .cpu_port = B53_CPU_PORT_25, + .duplex_reg = B53_DUPLEX_STAT_FE, + }, ++ { ++ .chip_id = BCM5389_DEVICE_ID, ++ .dev_name = "BCM5389", ++ .vlans = 4096, ++ .enabled_ports = 0x1f, ++ .arl_entries = 4, ++ .cpu_port = B53_CPU_PORT, ++ .vta_regs = B53_VTA_REGS, ++ .duplex_reg = B53_DUPLEX_STAT_GE, ++ .jumbo_pm_reg = B53_JUMBO_PORT_MASK, ++ .jumbo_size_reg = B53_JUMBO_MAX_SIZE, ++ }, + { + .chip_id = BCM5395_DEVICE_ID, + .dev_name = "BCM5395", +@@ -1872,6 +1884,7 @@ int b53_switch_detect(struct b53_device *dev) + else + dev->chip_id = BCM5365_DEVICE_ID; + break; ++ case BCM5389_DEVICE_ID: + case BCM5395_DEVICE_ID: + case BCM5397_DEVICE_ID: + case BCM5398_DEVICE_ID: +diff --git a/drivers/net/dsa/b53/b53_mdio.c b/drivers/net/dsa/b53/b53_mdio.c +index fa7556f5d4fb..a533a90e3904 100644 +--- a/drivers/net/dsa/b53/b53_mdio.c ++++ b/drivers/net/dsa/b53/b53_mdio.c +@@ -285,6 +285,7 @@ static const struct b53_io_ops b53_mdio_ops = { + #define B53_BRCM_OUI_1 0x0143bc00 + #define B53_BRCM_OUI_2 0x03625c00 + #define B53_BRCM_OUI_3 0x00406000 ++#define B53_BRCM_OUI_4 0x01410c00 + + static int b53_mdio_probe(struct mdio_device *mdiodev) + { +@@ -311,7 +312,8 @@ static int b53_mdio_probe(struct mdio_device *mdiodev) + */ + if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 && + (phy_id & 0xfffffc00) != B53_BRCM_OUI_2 && +- (phy_id & 0xfffffc00) != B53_BRCM_OUI_3) { ++ (phy_id & 0xfffffc00) != B53_BRCM_OUI_3 && ++ (phy_id & 0xfffffc00) != B53_BRCM_OUI_4) { + dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id); + return -ENODEV; + } +@@ -360,6 +362,7 @@ static const struct of_device_id b53_of_match[] = { + { .compatible = "brcm,bcm53125" }, + { .compatible = "brcm,bcm53128" }, + { .compatible = "brcm,bcm5365" }, ++ { .compatible = "brcm,bcm5389" }, + { .compatible = "brcm,bcm5395" }, + { .compatible = "brcm,bcm5397" }, + { .compatible = "brcm,bcm5398" }, +diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h +index 01bd8cbe9a3f..6b9e39ddaec1 100644 +--- a/drivers/net/dsa/b53/b53_priv.h ++++ b/drivers/net/dsa/b53/b53_priv.h +@@ -48,6 +48,7 @@ struct b53_io_ops { + enum { + BCM5325_DEVICE_ID = 0x25, + BCM5365_DEVICE_ID = 0x65, ++ BCM5389_DEVICE_ID = 0x89, + BCM5395_DEVICE_ID = 0x95, + BCM5397_DEVICE_ID = 0x97, + BCM5398_DEVICE_ID = 0x98, +diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c +index 612c7a44b26c..23821540ab07 100644 +--- a/drivers/net/ethernet/natsemi/sonic.c ++++ b/drivers/net/ethernet/natsemi/sonic.c +@@ -71,7 +71,7 @@ static int sonic_open(struct net_device *dev) + for (i = 0; i < SONIC_NUM_RRS; i++) { + dma_addr_t laddr = dma_map_single(lp->device, skb_put(lp->rx_skb[i], SONIC_RBSIZE), + SONIC_RBSIZE, DMA_FROM_DEVICE); +- if (!laddr) { ++ if (dma_mapping_error(lp->device, laddr)) { + while(i > 0) { /* free any that were mapped successfully */ + i--; + dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 8e06f308ce44..b23ee948e7c9 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1103,6 +1103,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, + {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ + {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, ++ {QMI_FIXED_INTF(0x0846, 0x68d3, 8)}, /* Netgear Aircard 779S */ + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ + {QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */ +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +index 12a9b86d71ea..dffa697d71e0 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c +@@ -1499,14 +1499,13 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev, + struct iwl_trans *trans) + { + struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans); +- int max_irqs, num_irqs, i, ret, nr_online_cpus; ++ int max_irqs, num_irqs, i, ret; + u16 pci_cmd; + + if (!trans->cfg->mq_rx_supported) + goto enable_msi; + +- nr_online_cpus = num_online_cpus(); +- max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES); ++ max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES); + for (i = 0; i < max_irqs; i++) + trans_pcie->msix_entries[i].entry = i; + +@@ -1532,16 +1531,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev, + * Two interrupts less: non rx causes shared with FBQ and RSS. + * More than two interrupts: we will use fewer RSS queues. + */ +- if (num_irqs <= nr_online_cpus) { ++ if (num_irqs <= max_irqs - 2) { + trans_pcie->trans->num_rx_queues = num_irqs + 1; + trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX | + IWL_SHARED_IRQ_FIRST_RSS; +- } else if (num_irqs == nr_online_cpus + 1) { ++ } else if (num_irqs == max_irqs - 1) { + trans_pcie->trans->num_rx_queues = num_irqs; + trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX; + } else { + trans_pcie->trans->num_rx_queues = num_irqs - 1; + } ++ WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES); + + trans_pcie->alloc_vecs = num_irqs; + trans_pcie->msix_enabled = true; +diff --git a/drivers/platform/x86/asus-wmi.c b/drivers/platform/x86/asus-wmi.c +index 48e1541dc8d4..7440f650e81a 100644 +--- a/drivers/platform/x86/asus-wmi.c ++++ b/drivers/platform/x86/asus-wmi.c +@@ -161,6 +161,16 @@ MODULE_LICENSE("GPL"); + + static const char * const ashs_ids[] = { "ATK4001", "ATK4002", NULL }; + ++static bool ashs_present(void) ++{ ++ int i = 0; ++ while (ashs_ids[i]) { ++ if (acpi_dev_found(ashs_ids[i++])) ++ return true; ++ } ++ return false; ++} ++ + struct bios_args { + u32 arg0; + u32 arg1; +@@ -962,6 +972,9 @@ static int asus_new_rfkill(struct asus_wmi *asus, + + static void asus_wmi_rfkill_exit(struct asus_wmi *asus) + { ++ if (asus->driver->wlan_ctrl_by_user && ashs_present()) ++ return; ++ + asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P5"); + asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P6"); + asus_unregister_rfkill_notifier(asus, "\\_SB.PCI0.P0P7"); +@@ -2058,16 +2071,6 @@ static int asus_wmi_fan_init(struct asus_wmi *asus) + return 0; + } + +-static bool ashs_present(void) +-{ +- int i = 0; +- while (ashs_ids[i]) { +- if (acpi_dev_found(ashs_ids[i++])) +- return true; +- } +- return false; +-} +- + /* + * WMI Driver + */ +diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c +index e67c1d8a193d..d072f84a8535 100644 +--- a/drivers/s390/block/dasd.c ++++ b/drivers/s390/block/dasd.c +@@ -3049,7 +3049,8 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx, + cqr->callback_data = req; + cqr->status = DASD_CQR_FILLED; + cqr->dq = dq; +- req->completion_data = cqr; ++ *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req)) = cqr; ++ + blk_mq_start_request(req); + spin_lock(&block->queue_lock); + list_add_tail(&cqr->blocklist, &block->ccw_queue); +@@ -3073,12 +3074,13 @@ static blk_status_t do_dasd_request(struct blk_mq_hw_ctx *hctx, + */ + enum blk_eh_timer_return dasd_times_out(struct request *req, bool reserved) + { +- struct dasd_ccw_req *cqr = req->completion_data; + struct dasd_block *block = req->q->queuedata; + struct dasd_device *device; ++ struct dasd_ccw_req *cqr; + unsigned long flags; + int rc = 0; + ++ cqr = *((struct dasd_ccw_req **) blk_mq_rq_to_pdu(req)); + if (!cqr) + return BLK_EH_NOT_HANDLED; + +@@ -3184,6 +3186,7 @@ static int dasd_alloc_queue(struct dasd_block *block) + int rc; + + block->tag_set.ops = &dasd_mq_ops; ++ block->tag_set.cmd_size = sizeof(struct dasd_ccw_req *); + block->tag_set.nr_hw_queues = DASD_NR_HW_QUEUES; + block->tag_set.queue_depth = DASD_MAX_LCU_DEV * DASD_REQ_PER_DEV; + block->tag_set.flags = BLK_MQ_F_SHOULD_MERGE; +diff --git a/drivers/staging/android/ion/ion_heap.c b/drivers/staging/android/ion/ion_heap.c +index 91faa7f035b9..babbd94c32d9 100644 +--- a/drivers/staging/android/ion/ion_heap.c ++++ b/drivers/staging/android/ion/ion_heap.c +@@ -38,7 +38,7 @@ void *ion_heap_map_kernel(struct ion_heap *heap, + struct page **tmp = pages; + + if (!pages) +- return NULL; ++ return ERR_PTR(-ENOMEM); + + if (buffer->flags & ION_FLAG_CACHED) + pgprot = PAGE_KERNEL; +diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c +index 1c70541a1467..0475f9685a41 100644 +--- a/drivers/tty/n_tty.c ++++ b/drivers/tty/n_tty.c +@@ -126,6 +126,8 @@ struct n_tty_data { + struct mutex output_lock; + }; + ++#define MASK(x) ((x) & (N_TTY_BUF_SIZE - 1)) ++ + static inline size_t read_cnt(struct n_tty_data *ldata) + { + return ldata->read_head - ldata->read_tail; +@@ -143,6 +145,7 @@ static inline unsigned char *read_buf_addr(struct n_tty_data *ldata, size_t i) + + static inline unsigned char echo_buf(struct n_tty_data *ldata, size_t i) + { ++ smp_rmb(); /* Matches smp_wmb() in add_echo_byte(). */ + return ldata->echo_buf[i & (N_TTY_BUF_SIZE - 1)]; + } + +@@ -318,9 +321,7 @@ static inline void put_tty_queue(unsigned char c, struct n_tty_data *ldata) + static void reset_buffer_flags(struct n_tty_data *ldata) + { + ldata->read_head = ldata->canon_head = ldata->read_tail = 0; +- ldata->echo_head = ldata->echo_tail = ldata->echo_commit = 0; + ldata->commit_head = 0; +- ldata->echo_mark = 0; + ldata->line_start = 0; + + ldata->erasing = 0; +@@ -619,12 +620,19 @@ static size_t __process_echoes(struct tty_struct *tty) + old_space = space = tty_write_room(tty); + + tail = ldata->echo_tail; +- while (ldata->echo_commit != tail) { ++ while (MASK(ldata->echo_commit) != MASK(tail)) { + c = echo_buf(ldata, tail); + if (c == ECHO_OP_START) { + unsigned char op; + int no_space_left = 0; + ++ /* ++ * Since add_echo_byte() is called without holding ++ * output_lock, we might see only portion of multi-byte ++ * operation. ++ */ ++ if (MASK(ldata->echo_commit) == MASK(tail + 1)) ++ goto not_yet_stored; + /* + * If the buffer byte is the start of a multi-byte + * operation, get the next byte, which is either the +@@ -636,6 +644,8 @@ static size_t __process_echoes(struct tty_struct *tty) + unsigned int num_chars, num_bs; + + case ECHO_OP_ERASE_TAB: ++ if (MASK(ldata->echo_commit) == MASK(tail + 2)) ++ goto not_yet_stored; + num_chars = echo_buf(ldata, tail + 2); + + /* +@@ -730,7 +740,8 @@ static size_t __process_echoes(struct tty_struct *tty) + /* If the echo buffer is nearly full (so that the possibility exists + * of echo overrun before the next commit), then discard enough + * data at the tail to prevent a subsequent overrun */ +- while (ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) { ++ while (ldata->echo_commit > tail && ++ ldata->echo_commit - tail >= ECHO_DISCARD_WATERMARK) { + if (echo_buf(ldata, tail) == ECHO_OP_START) { + if (echo_buf(ldata, tail + 1) == ECHO_OP_ERASE_TAB) + tail += 3; +@@ -740,6 +751,7 @@ static size_t __process_echoes(struct tty_struct *tty) + tail++; + } + ++ not_yet_stored: + ldata->echo_tail = tail; + return old_space - space; + } +@@ -750,6 +762,7 @@ static void commit_echoes(struct tty_struct *tty) + size_t nr, old, echoed; + size_t head; + ++ mutex_lock(&ldata->output_lock); + head = ldata->echo_head; + ldata->echo_mark = head; + old = ldata->echo_commit - ldata->echo_tail; +@@ -758,10 +771,12 @@ static void commit_echoes(struct tty_struct *tty) + * is over the threshold (and try again each time another + * block is accumulated) */ + nr = head - ldata->echo_tail; +- if (nr < ECHO_COMMIT_WATERMARK || (nr % ECHO_BLOCK > old % ECHO_BLOCK)) ++ if (nr < ECHO_COMMIT_WATERMARK || ++ (nr % ECHO_BLOCK > old % ECHO_BLOCK)) { ++ mutex_unlock(&ldata->output_lock); + return; ++ } + +- mutex_lock(&ldata->output_lock); + ldata->echo_commit = head; + echoed = __process_echoes(tty); + mutex_unlock(&ldata->output_lock); +@@ -812,7 +827,9 @@ static void flush_echoes(struct tty_struct *tty) + + static inline void add_echo_byte(unsigned char c, struct n_tty_data *ldata) + { +- *echo_buf_addr(ldata, ldata->echo_head++) = c; ++ *echo_buf_addr(ldata, ldata->echo_head) = c; ++ smp_wmb(); /* Matches smp_rmb() in echo_buf(). */ ++ ldata->echo_head++; + } + + /** +@@ -980,14 +997,15 @@ static void eraser(unsigned char c, struct tty_struct *tty) + } + + seen_alnums = 0; +- while (ldata->read_head != ldata->canon_head) { ++ while (MASK(ldata->read_head) != MASK(ldata->canon_head)) { + head = ldata->read_head; + + /* erase a single possibly multibyte character */ + do { + head--; + c = read_buf(ldata, head); +- } while (is_continuation(c, tty) && head != ldata->canon_head); ++ } while (is_continuation(c, tty) && ++ MASK(head) != MASK(ldata->canon_head)); + + /* do not partially erase */ + if (is_continuation(c, tty)) +@@ -1029,7 +1047,7 @@ static void eraser(unsigned char c, struct tty_struct *tty) + * This info is used to go back the correct + * number of columns. + */ +- while (tail != ldata->canon_head) { ++ while (MASK(tail) != MASK(ldata->canon_head)) { + tail--; + c = read_buf(ldata, tail); + if (c == '\t') { +@@ -1304,7 +1322,7 @@ n_tty_receive_char_special(struct tty_struct *tty, unsigned char c) + finish_erasing(ldata); + echo_char(c, tty); + echo_char_raw('\n', ldata); +- while (tail != ldata->read_head) { ++ while (MASK(tail) != MASK(ldata->read_head)) { + echo_char(read_buf(ldata, tail), tty); + tail++; + } +@@ -1880,30 +1898,21 @@ static int n_tty_open(struct tty_struct *tty) + struct n_tty_data *ldata; + + /* Currently a malloc failure here can panic */ +- ldata = vmalloc(sizeof(*ldata)); ++ ldata = vzalloc(sizeof(*ldata)); + if (!ldata) +- goto err; ++ return -ENOMEM; + + ldata->overrun_time = jiffies; + mutex_init(&ldata->atomic_read_lock); + mutex_init(&ldata->output_lock); + + tty->disc_data = ldata; +- reset_buffer_flags(tty->disc_data); +- ldata->column = 0; +- ldata->canon_column = 0; +- ldata->num_overrun = 0; +- ldata->no_room = 0; +- ldata->lnext = 0; + tty->closing = 0; + /* indicate buffer work may resume */ + clear_bit(TTY_LDISC_HALTED, &tty->flags); + n_tty_set_termios(tty, NULL); + tty_unthrottle(tty); +- + return 0; +-err: +- return -ENOMEM; + } + + static inline int input_available_p(struct tty_struct *tty, int poll) +@@ -2413,7 +2422,7 @@ static unsigned long inq_canon(struct n_tty_data *ldata) + tail = ldata->read_tail; + nr = head - tail; + /* Skip EOF-chars.. */ +- while (head != tail) { ++ while (MASK(head) != MASK(tail)) { + if (test_bit(tail & (N_TTY_BUF_SIZE - 1), ldata->read_flags) && + read_buf(ldata, tail) == __DISABLED_CHAR) + nr--; +diff --git a/drivers/tty/serdev/core.c b/drivers/tty/serdev/core.c +index 97db76afced2..ae2564ecddcd 100644 +--- a/drivers/tty/serdev/core.c ++++ b/drivers/tty/serdev/core.c +@@ -482,6 +482,7 @@ EXPORT_SYMBOL_GPL(__serdev_device_driver_register); + static void __exit serdev_exit(void) + { + bus_unregister(&serdev_bus_type); ++ ida_destroy(&ctrl_ida); + } + module_exit(serdev_exit); + +diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c +index 0d814a87acb2..4986b4aebe80 100644 +--- a/drivers/tty/serial/8250/8250_pci.c ++++ b/drivers/tty/serial/8250/8250_pci.c +@@ -3345,9 +3345,7 @@ static const struct pci_device_id blacklist[] = { + /* multi-io cards handled by parport_serial */ + { PCI_DEVICE(0x4348, 0x7053), }, /* WCH CH353 2S1P */ + { PCI_DEVICE(0x4348, 0x5053), }, /* WCH CH353 1S1P */ +- { PCI_DEVICE(0x4348, 0x7173), }, /* WCH CH355 4S */ + { PCI_DEVICE(0x1c00, 0x3250), }, /* WCH CH382 2S1P */ +- { PCI_DEVICE(0x1c00, 0x3470), }, /* WCH CH384 4S */ + + /* Moxa Smartio MUE boards handled by 8250_moxa */ + { PCI_VDEVICE(MOXA, 0x1024), }, +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index de67abbda921..e77421e7bf46 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -782,7 +782,7 @@ int vc_allocate(unsigned int currcons) /* return 0 on success */ + if (!*vc->vc_uni_pagedir_loc) + con_set_default_unimap(vc); + +- vc->vc_screenbuf = kmalloc(vc->vc_screenbuf_size, GFP_KERNEL); ++ vc->vc_screenbuf = kzalloc(vc->vc_screenbuf_size, GFP_KERNEL); + if (!vc->vc_screenbuf) + goto err_free; + +@@ -869,7 +869,7 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + + if (new_screen_size > (4 << 20)) + return -EINVAL; +- newscreen = kmalloc(new_screen_size, GFP_USER); ++ newscreen = kzalloc(new_screen_size, GFP_USER); + if (!newscreen) + return -ENOMEM; + +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 22952d70b981..3b9aadd007f5 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1771,6 +1771,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ + .driver_info = SINGLE_RX_URB, + }, ++ { USB_DEVICE(0x1965, 0x0018), /* Uniden UBC125XLT */ ++ .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ ++ }, + { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */ + .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ + }, +diff --git a/drivers/usb/dwc2/hcd_queue.c b/drivers/usb/dwc2/hcd_queue.c +index 3ae8b1bbaa55..7f51a77bc5cc 100644 +--- a/drivers/usb/dwc2/hcd_queue.c ++++ b/drivers/usb/dwc2/hcd_queue.c +@@ -379,7 +379,7 @@ static unsigned long *dwc2_get_ls_map(struct dwc2_hsotg *hsotg, + /* Get the map and adjust if this is a multi_tt hub */ + map = qh->dwc_tt->periodic_bitmaps; + if (qh->dwc_tt->usb_tt->multi) +- map += DWC2_ELEMENTS_PER_LS_BITMAP * qh->ttport; ++ map += DWC2_ELEMENTS_PER_LS_BITMAP * (qh->ttport - 1); + + return map; + } +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index efd7e4882d66..00b710016d21 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -891,12 +891,12 @@ void xhci_free_virt_device(struct xhci_hcd *xhci, int slot_id) + + dev = xhci->devs[slot_id]; + +- trace_xhci_free_virt_device(dev); +- + xhci->dcbaa->dev_context_ptrs[slot_id] = 0; + if (!dev) + return; + ++ trace_xhci_free_virt_device(dev); ++ + if (dev->tt_info) + old_active_eps = dev->tt_info->active_eps; + +diff --git a/drivers/usb/host/xhci-trace.h b/drivers/usb/host/xhci-trace.h +index f20753b99624..02a1164ca599 100644 +--- a/drivers/usb/host/xhci-trace.h ++++ b/drivers/usb/host/xhci-trace.h +@@ -158,6 +158,37 @@ DEFINE_EVENT(xhci_log_trb, xhci_queue_trb, + TP_ARGS(ring, trb) + ); + ++DECLARE_EVENT_CLASS(xhci_log_free_virt_dev, ++ TP_PROTO(struct xhci_virt_device *vdev), ++ TP_ARGS(vdev), ++ TP_STRUCT__entry( ++ __field(void *, vdev) ++ __field(unsigned long long, out_ctx) ++ __field(unsigned long long, in_ctx) ++ __field(u8, fake_port) ++ __field(u8, real_port) ++ __field(u16, current_mel) ++ ++ ), ++ TP_fast_assign( ++ __entry->vdev = vdev; ++ __entry->in_ctx = (unsigned long long) vdev->in_ctx->dma; ++ __entry->out_ctx = (unsigned long long) vdev->out_ctx->dma; ++ __entry->fake_port = (u8) vdev->fake_port; ++ __entry->real_port = (u8) vdev->real_port; ++ __entry->current_mel = (u16) vdev->current_mel; ++ ), ++ TP_printk("vdev %p ctx %llx | %llx fake_port %d real_port %d current_mel %d", ++ __entry->vdev, __entry->in_ctx, __entry->out_ctx, ++ __entry->fake_port, __entry->real_port, __entry->current_mel ++ ) ++); ++ ++DEFINE_EVENT(xhci_log_free_virt_dev, xhci_free_virt_device, ++ TP_PROTO(struct xhci_virt_device *vdev), ++ TP_ARGS(vdev) ++); ++ + DECLARE_EVENT_CLASS(xhci_log_virt_dev, + TP_PROTO(struct xhci_virt_device *vdev), + TP_ARGS(vdev), +@@ -195,11 +226,6 @@ DEFINE_EVENT(xhci_log_virt_dev, xhci_alloc_virt_device, + TP_ARGS(vdev) + ); + +-DEFINE_EVENT(xhci_log_virt_dev, xhci_free_virt_device, +- TP_PROTO(struct xhci_virt_device *vdev), +- TP_ARGS(vdev) +-); +- + DEFINE_EVENT(xhci_log_virt_dev, xhci_setup_device, + TP_PROTO(struct xhci_virt_device *vdev), + TP_ARGS(vdev) +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index d0f00274d16c..142a83e5974c 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -98,6 +98,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8156) }, /* B&G H3000 link cable */ + { USB_DEVICE(0x10C4, 0x815E) }, /* Helicomm IP-Link 1220-DVM */ + { USB_DEVICE(0x10C4, 0x815F) }, /* Timewave HamLinkUSB */ ++ { USB_DEVICE(0x10C4, 0x817C) }, /* CESINEL MEDCAL N Power Quality Monitor */ ++ { USB_DEVICE(0x10C4, 0x817D) }, /* CESINEL MEDCAL NT Power Quality Monitor */ ++ { USB_DEVICE(0x10C4, 0x817E) }, /* CESINEL MEDCAL S Power Quality Monitor */ + { USB_DEVICE(0x10C4, 0x818B) }, /* AVIT Research USB to TTL */ + { USB_DEVICE(0x10C4, 0x819F) }, /* MJS USB Toslink Switcher */ + { USB_DEVICE(0x10C4, 0x81A6) }, /* ThinkOptics WavIt */ +@@ -115,6 +118,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */ + { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */ + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */ ++ { USB_DEVICE(0x10C4, 0x82EF) }, /* CESINEL FALCO 6105 AC Power Supply */ ++ { USB_DEVICE(0x10C4, 0x82F1) }, /* CESINEL MEDCAL EFD Earth Fault Detector */ ++ { USB_DEVICE(0x10C4, 0x82F2) }, /* CESINEL MEDCAL ST Network Analyzer */ + { USB_DEVICE(0x10C4, 0x82F4) }, /* Starizona MicroTouch */ + { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */ + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */ +@@ -127,7 +133,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ + { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ + { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ ++ { USB_DEVICE(0x10C4, 0x851E) }, /* CESINEL MEDCAL PT Network Analyzer */ + { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */ ++ { USB_DEVICE(0x10C4, 0x85B8) }, /* CESINEL ReCon T Energy Logger */ + { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ + { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ + { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ +@@ -137,17 +145,23 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */ + { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */ + { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */ ++ { USB_DEVICE(0x10C4, 0x88FB) }, /* CESINEL MEDCAL STII Network Analyzer */ ++ { USB_DEVICE(0x10C4, 0x8938) }, /* CESINEL MEDCAL S II Network Analyzer */ + { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */ + { USB_DEVICE(0x10C4, 0x8962) }, /* Brim Brothers charging dock */ + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ ++ { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ + { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ ++ { USB_DEVICE(0x10C4, 0xEA63) }, /* Silicon Labs Windows Update (CP2101-4/CP2102N) */ + { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ + { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */ ++ { USB_DEVICE(0x10C4, 0xEA7A) }, /* Silicon Labs Windows Update (CP2105) */ ++ { USB_DEVICE(0x10C4, 0xEA7B) }, /* Silicon Labs Windows Update (CP2108) */ + { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */ + { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */ + { USB_DEVICE(0x10C4, 0xF003) }, /* Elan Digital Systems USBpulse100 */ +diff --git a/drivers/usb/typec/ucsi/ucsi.c b/drivers/usb/typec/ucsi/ucsi.c +index dd24c5c1534d..251f5d66651e 100644 +--- a/drivers/usb/typec/ucsi/ucsi.c ++++ b/drivers/usb/typec/ucsi/ucsi.c +@@ -346,6 +346,19 @@ static void ucsi_connector_change(struct work_struct *work) + } + + if (con->status.change & UCSI_CONSTAT_CONNECT_CHANGE) { ++ typec_set_pwr_role(con->port, con->status.pwr_dir); ++ ++ switch (con->status.partner_type) { ++ case UCSI_CONSTAT_PARTNER_TYPE_UFP: ++ typec_set_data_role(con->port, TYPEC_HOST); ++ break; ++ case UCSI_CONSTAT_PARTNER_TYPE_DFP: ++ typec_set_data_role(con->port, TYPEC_DEVICE); ++ break; ++ default: ++ break; ++ } ++ + if (con->status.connected) + ucsi_register_partner(con); + else +diff --git a/drivers/usb/typec/ucsi/ucsi_acpi.c b/drivers/usb/typec/ucsi/ucsi_acpi.c +index cabd47612b0a..494d2a49203a 100644 +--- a/drivers/usb/typec/ucsi/ucsi_acpi.c ++++ b/drivers/usb/typec/ucsi/ucsi_acpi.c +@@ -82,6 +82,11 @@ static int ucsi_acpi_probe(struct platform_device *pdev) + return -ENODEV; + } + ++ /* This will make sure we can use ioremap_nocache() */ ++ status = acpi_release_memory(ACPI_HANDLE(&pdev->dev), res, 1); ++ if (ACPI_FAILURE(status)) ++ return -ENOMEM; ++ + /* + * NOTE: The memory region for the data structures is used also in an + * operation region, which means ACPI has already reserved it. Therefore +diff --git a/fs/afs/security.c b/fs/afs/security.c +index faca66227ecf..859096e25f2c 100644 +--- a/fs/afs/security.c ++++ b/fs/afs/security.c +@@ -323,18 +323,14 @@ int afs_permission(struct inode *inode, int mask) + mask, access, S_ISDIR(inode->i_mode) ? "dir" : "file"); + + if (S_ISDIR(inode->i_mode)) { +- if (mask & MAY_EXEC) { ++ if (mask & (MAY_EXEC | MAY_READ | MAY_CHDIR)) { + if (!(access & AFS_ACE_LOOKUP)) + goto permission_denied; +- } else if (mask & MAY_READ) { +- if (!(access & AFS_ACE_LOOKUP)) +- goto permission_denied; +- } else if (mask & MAY_WRITE) { ++ } ++ if (mask & MAY_WRITE) { + if (!(access & (AFS_ACE_DELETE | /* rmdir, unlink, rename from */ + AFS_ACE_INSERT))) /* create, mkdir, symlink, rename to */ + goto permission_denied; +- } else { +- BUG(); + } + } else { + if (!(access & AFS_ACE_LOOKUP)) +diff --git a/fs/inode.c b/fs/inode.c +index d1e35b53bb23..e07b3e1f5970 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -177,6 +177,7 @@ int inode_init_always(struct super_block *sb, struct inode *inode) + mapping->a_ops = &empty_aops; + mapping->host = inode; + mapping->flags = 0; ++ mapping->wb_err = 0; + atomic_set(&mapping->i_mmap_writable, 0); + mapping_set_gfp_mask(mapping, GFP_HIGHUSER_MOVABLE); + mapping->private_data = NULL; +diff --git a/include/linux/acpi.h b/include/linux/acpi.h +index 502af53ec012..13c105121a18 100644 +--- a/include/linux/acpi.h ++++ b/include/linux/acpi.h +@@ -441,6 +441,9 @@ int acpi_check_resource_conflict(const struct resource *res); + int acpi_check_region(resource_size_t start, resource_size_t n, + const char *name); + ++acpi_status acpi_release_memory(acpi_handle handle, struct resource *res, ++ u32 level); ++ + int acpi_resources_are_enforced(void); + + #ifdef CONFIG_HIBERNATION +diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h +index 079c69cae2f6..59a4f50ffe8d 100644 +--- a/include/net/netfilter/nf_tables.h ++++ b/include/net/netfilter/nf_tables.h +@@ -177,6 +177,7 @@ struct nft_data_desc { + int nft_data_init(const struct nft_ctx *ctx, + struct nft_data *data, unsigned int size, + struct nft_data_desc *desc, const struct nlattr *nla); ++void nft_data_hold(const struct nft_data *data, enum nft_data_types type); + void nft_data_release(const struct nft_data *data, enum nft_data_types type); + int nft_data_dump(struct sk_buff *skb, int attr, const struct nft_data *data, + enum nft_data_types type, unsigned int len); +@@ -731,6 +732,10 @@ struct nft_expr_ops { + int (*init)(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nlattr * const tb[]); ++ void (*activate)(const struct nft_ctx *ctx, ++ const struct nft_expr *expr); ++ void (*deactivate)(const struct nft_ctx *ctx, ++ const struct nft_expr *expr); + void (*destroy)(const struct nft_ctx *ctx, + const struct nft_expr *expr); + int (*dump)(struct sk_buff *skb, +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index f287dcbe8cb2..31615d1ae44c 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -894,6 +894,33 @@ void check_preempt_curr(struct rq *rq, struct task_struct *p, int flags) + } + + #ifdef CONFIG_SMP ++ ++static inline bool is_per_cpu_kthread(struct task_struct *p) ++{ ++ if (!(p->flags & PF_KTHREAD)) ++ return false; ++ ++ if (p->nr_cpus_allowed != 1) ++ return false; ++ ++ return true; ++} ++ ++/* ++ * Per-CPU kthreads are allowed to run on !actie && online CPUs, see ++ * __set_cpus_allowed_ptr() and select_fallback_rq(). ++ */ ++static inline bool is_cpu_allowed(struct task_struct *p, int cpu) ++{ ++ if (!cpumask_test_cpu(cpu, &p->cpus_allowed)) ++ return false; ++ ++ if (is_per_cpu_kthread(p)) ++ return cpu_online(cpu); ++ ++ return cpu_active(cpu); ++} ++ + /* + * This is how migration works: + * +@@ -951,16 +978,8 @@ struct migration_arg { + static struct rq *__migrate_task(struct rq *rq, struct rq_flags *rf, + struct task_struct *p, int dest_cpu) + { +- if (p->flags & PF_KTHREAD) { +- if (unlikely(!cpu_online(dest_cpu))) +- return rq; +- } else { +- if (unlikely(!cpu_active(dest_cpu))) +- return rq; +- } +- + /* Affinity changed (again). */ +- if (!cpumask_test_cpu(dest_cpu, &p->cpus_allowed)) ++ if (!is_cpu_allowed(p, dest_cpu)) + return rq; + + update_rq_clock(rq); +@@ -1489,10 +1508,9 @@ static int select_fallback_rq(int cpu, struct task_struct *p) + for (;;) { + /* Any allowed, online CPU? */ + for_each_cpu(dest_cpu, &p->cpus_allowed) { +- if (!(p->flags & PF_KTHREAD) && !cpu_active(dest_cpu)) +- continue; +- if (!cpu_online(dest_cpu)) ++ if (!is_cpu_allowed(p, dest_cpu)) + continue; ++ + goto out; + } + +@@ -1555,8 +1573,7 @@ int select_task_rq(struct task_struct *p, int cpu, int sd_flags, int wake_flags) + * [ this allows ->select_task() to simply return task_cpu(p) and + * not worry about this generic constraint ] + */ +- if (unlikely(!cpumask_test_cpu(cpu, &p->cpus_allowed) || +- !cpu_online(cpu))) ++ if (unlikely(!is_cpu_allowed(p, cpu))) + cpu = select_fallback_rq(task_cpu(p), p); + + return cpu; +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 5b8cd359c4c0..e27fb6e97d18 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -1950,7 +1950,8 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt, + int off, pad = 0; + unsigned int size_kern, match_size = mwt->match_size; + +- strlcpy(name, mwt->u.name, sizeof(name)); ++ if (strscpy(name, mwt->u.name, sizeof(name)) < 0) ++ return -EINVAL; + + if (state->buf_kern_start) + dst = state->buf_kern_start + state->buf_kern_offset; +diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c +index b12e61b7b16c..1c4a5de3f301 100644 +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -48,10 +48,8 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + } + + fl6.flowi6_mark = flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; +- if ((flags & XT_RPFILTER_LOOSE) == 0) { ++ if ((flags & XT_RPFILTER_LOOSE) == 0) + fl6.flowi6_oif = dev->ifindex; +- lookup_flags |= RT6_LOOKUP_F_IFACE; +- } + + rt = (void *) ip6_route_lookup(net, &fl6, lookup_flags); + if (rt->dst.error) +diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c +index 54b5899543ef..fd9a45cbd709 100644 +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -182,7 +182,6 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, + } + + *dest = 0; +- again: + rt = (void *)ip6_route_lookup(nft_net(pkt), &fl6, lookup_flags); + if (rt->dst.error) + goto put_rt_err; +@@ -191,15 +190,8 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, + if (rt->rt6i_flags & (RTF_REJECT | RTF_ANYCAST | RTF_LOCAL)) + goto put_rt_err; + +- if (oif && oif != rt->rt6i_idev->dev) { +- /* multipath route? Try again with F_IFACE */ +- if ((lookup_flags & RT6_LOOKUP_F_IFACE) == 0) { +- lookup_flags |= RT6_LOOKUP_F_IFACE; +- fl6.flowi6_oif = oif->ifindex; +- ip6_rt_put(rt); +- goto again; +- } +- } ++ if (oif && oif != rt->rt6i_idev->dev) ++ goto put_rt_err; + + switch (priv->result) { + case NFT_FIB_RESULT_OIF: +diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c +index 17e95a0386b3..d6b012295b45 100644 +--- a/net/ipv6/xfrm6_policy.c ++++ b/net/ipv6/xfrm6_policy.c +@@ -123,7 +123,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse) + struct flowi6 *fl6 = &fl->u.ip6; + int onlyproto = 0; + const struct ipv6hdr *hdr = ipv6_hdr(skb); +- u16 offset = sizeof(*hdr); ++ u32 offset = sizeof(*hdr); + struct ipv6_opt_hdr *exthdr; + const unsigned char *nh = skb_network_header(skb); + u16 nhoff = IP6CB(skb)->nhoff; +diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c +index e8f1556fa446..327ebe786eeb 100644 +--- a/net/netfilter/ipvs/ip_vs_ctl.c ++++ b/net/netfilter/ipvs/ip_vs_ctl.c +@@ -2384,8 +2384,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) + struct ipvs_sync_daemon_cfg cfg; + + memset(&cfg, 0, sizeof(cfg)); +- strlcpy(cfg.mcast_ifn, dm->mcast_ifn, +- sizeof(cfg.mcast_ifn)); ++ ret = -EINVAL; ++ if (strscpy(cfg.mcast_ifn, dm->mcast_ifn, ++ sizeof(cfg.mcast_ifn)) <= 0) ++ goto out_dec; + cfg.syncid = dm->syncid; + ret = start_sync_thread(ipvs, &cfg, dm->state); + } else { +@@ -2423,12 +2425,19 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len) + } + } + ++ if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) && ++ strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) == ++ IP_VS_SCHEDNAME_MAXLEN) { ++ ret = -EINVAL; ++ goto out_unlock; ++ } ++ + /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */ + if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP && + usvc.protocol != IPPROTO_SCTP) { +- pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n", ++ pr_err("set_ctl: invalid protocol: %d %pI4:%d\n", + usvc.protocol, &usvc.addr.ip, +- ntohs(usvc.port), usvc.sched_name); ++ ntohs(usvc.port)); + ret = -EFAULT; + goto out_unlock; + } +@@ -2850,7 +2859,7 @@ static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = { + static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = { + [IPVS_DAEMON_ATTR_STATE] = { .type = NLA_U32 }, + [IPVS_DAEMON_ATTR_MCAST_IFN] = { .type = NLA_NUL_STRING, +- .len = IP_VS_IFNAME_MAXLEN }, ++ .len = IP_VS_IFNAME_MAXLEN - 1 }, + [IPVS_DAEMON_ATTR_SYNC_ID] = { .type = NLA_U32 }, + [IPVS_DAEMON_ATTR_SYNC_MAXLEN] = { .type = NLA_U16 }, + [IPVS_DAEMON_ATTR_MCAST_GROUP] = { .type = NLA_U32 }, +@@ -2868,7 +2877,7 @@ static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = { + [IPVS_SVC_ATTR_PORT] = { .type = NLA_U16 }, + [IPVS_SVC_ATTR_FWMARK] = { .type = NLA_U32 }, + [IPVS_SVC_ATTR_SCHED_NAME] = { .type = NLA_NUL_STRING, +- .len = IP_VS_SCHEDNAME_MAXLEN }, ++ .len = IP_VS_SCHEDNAME_MAXLEN - 1 }, + [IPVS_SVC_ATTR_PE_NAME] = { .type = NLA_NUL_STRING, + .len = IP_VS_PENAME_MAXLEN }, + [IPVS_SVC_ATTR_FLAGS] = { .type = NLA_BINARY, +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index cf30c440f7a7..85b549e84104 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -220,6 +220,34 @@ static int nft_delchain(struct nft_ctx *ctx) + return err; + } + ++static void nft_rule_expr_activate(const struct nft_ctx *ctx, ++ struct nft_rule *rule) ++{ ++ struct nft_expr *expr; ++ ++ expr = nft_expr_first(rule); ++ while (expr != nft_expr_last(rule) && expr->ops) { ++ if (expr->ops->activate) ++ expr->ops->activate(ctx, expr); ++ ++ expr = nft_expr_next(expr); ++ } ++} ++ ++static void nft_rule_expr_deactivate(const struct nft_ctx *ctx, ++ struct nft_rule *rule) ++{ ++ struct nft_expr *expr; ++ ++ expr = nft_expr_first(rule); ++ while (expr != nft_expr_last(rule) && expr->ops) { ++ if (expr->ops->deactivate) ++ expr->ops->deactivate(ctx, expr); ++ ++ expr = nft_expr_next(expr); ++ } ++} ++ + static int + nf_tables_delrule_deactivate(struct nft_ctx *ctx, struct nft_rule *rule) + { +@@ -265,6 +293,7 @@ static int nft_delrule(struct nft_ctx *ctx, struct nft_rule *rule) + nft_trans_destroy(trans); + return err; + } ++ nft_rule_expr_deactivate(ctx, rule); + + return 0; + } +@@ -1237,8 +1266,10 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain, + rcu_assign_pointer(chain->stats, newstats); + synchronize_rcu(); + free_percpu(oldstats); +- } else ++ } else { + rcu_assign_pointer(chain->stats, newstats); ++ static_branch_inc(&nft_counters_enabled); ++ } + } + + static void nf_tables_chain_destroy(struct nft_chain *chain) +@@ -1947,6 +1978,7 @@ static const struct nla_policy nft_rule_policy[NFTA_RULE_MAX + 1] = { + [NFTA_RULE_POSITION] = { .type = NLA_U64 }, + [NFTA_RULE_USERDATA] = { .type = NLA_BINARY, + .len = NFT_USERDATA_MAXLEN }, ++ [NFTA_RULE_ID] = { .type = NLA_U32 }, + }; + + static int nf_tables_fill_rule_info(struct sk_buff *skb, struct net *net, +@@ -2218,6 +2250,13 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, + kfree(rule); + } + ++static void nf_tables_rule_release(const struct nft_ctx *ctx, ++ struct nft_rule *rule) ++{ ++ nft_rule_expr_deactivate(ctx, rule); ++ nf_tables_rule_destroy(ctx, rule); ++} ++ + #define NFT_RULE_MAXEXPRS 128 + + static struct nft_expr_info *info; +@@ -2385,7 +2424,7 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + return 0; + + err2: +- nf_tables_rule_destroy(&ctx, rule); ++ nf_tables_rule_release(&ctx, rule); + err1: + for (i = 0; i < n; i++) { + if (info[i].ops != NULL) +@@ -3374,6 +3413,8 @@ static const struct nla_policy nft_set_elem_policy[NFTA_SET_ELEM_MAX + 1] = { + [NFTA_SET_ELEM_TIMEOUT] = { .type = NLA_U64 }, + [NFTA_SET_ELEM_USERDATA] = { .type = NLA_BINARY, + .len = NFT_USERDATA_MAXLEN }, ++ [NFTA_SET_ELEM_EXPR] = { .type = NLA_NESTED }, ++ [NFTA_SET_ELEM_OBJREF] = { .type = NLA_STRING }, + }; + + static const struct nla_policy nft_set_elem_list_policy[NFTA_SET_ELEM_LIST_MAX + 1] = { +@@ -3961,8 +4002,10 @@ static int nft_add_set_elem(struct nft_ctx *ctx, struct nft_set *set, + if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA) ^ + nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) || + nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF) ^ +- nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) +- return -EBUSY; ++ nft_set_ext_exists(ext2, NFT_SET_EXT_OBJREF)) { ++ err = -EBUSY; ++ goto err5; ++ } + if ((nft_set_ext_exists(ext, NFT_SET_EXT_DATA) && + nft_set_ext_exists(ext2, NFT_SET_EXT_DATA) && + memcmp(nft_set_ext_data(ext), +@@ -4054,7 +4097,7 @@ static int nf_tables_newsetelem(struct net *net, struct sock *nlsk, + * NFT_GOTO verdicts. This function must be called on active data objects + * from the second phase of the commit protocol. + */ +-static void nft_data_hold(const struct nft_data *data, enum nft_data_types type) ++void nft_data_hold(const struct nft_data *data, enum nft_data_types type) + { + if (type == NFT_DATA_VERDICT) { + switch (data->verdict.code) { +@@ -4571,7 +4614,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb) + if (idx > s_idx) + memset(&cb->args[1], 0, + sizeof(cb->args) - sizeof(cb->args[0])); +- if (filter && filter->table[0] && ++ if (filter && filter->table && + strcmp(filter->table, table->name)) + goto cont; + if (filter && +@@ -5221,10 +5264,12 @@ static int nf_tables_abort(struct net *net, struct sk_buff *skb) + case NFT_MSG_NEWRULE: + trans->ctx.chain->use--; + list_del_rcu(&nft_trans_rule(trans)->list); ++ nft_rule_expr_deactivate(&trans->ctx, nft_trans_rule(trans)); + break; + case NFT_MSG_DELRULE: + trans->ctx.chain->use++; + nft_clear(trans->ctx.net, nft_trans_rule(trans)); ++ nft_rule_expr_activate(&trans->ctx, nft_trans_rule(trans)); + nft_trans_destroy(trans); + break; + case NFT_MSG_NEWSET: +@@ -5798,7 +5843,7 @@ int __nft_release_basechain(struct nft_ctx *ctx) + list_for_each_entry_safe(rule, nr, &ctx->chain->rules, list) { + list_del(&rule->list); + ctx->chain->use--; +- nf_tables_rule_destroy(ctx, rule); ++ nf_tables_rule_release(ctx, rule); + } + list_del(&ctx->chain->list); + ctx->table->use--; +@@ -5832,7 +5877,7 @@ static void __nft_release_afinfo(struct net *net, struct nft_af_info *afi) + list_for_each_entry_safe(rule, nr, &chain->rules, list) { + list_del(&rule->list); + chain->use--; +- nf_tables_rule_destroy(&ctx, rule); ++ nf_tables_rule_release(&ctx, rule); + } + } + list_for_each_entry_safe(set, ns, &table->sets, list) { +diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c +index dfd0bf3810d2..32b7896929f3 100644 +--- a/net/netfilter/nf_tables_core.c ++++ b/net/netfilter/nf_tables_core.c +@@ -119,14 +119,21 @@ DEFINE_STATIC_KEY_FALSE(nft_counters_enabled); + static noinline void nft_update_chain_stats(const struct nft_chain *chain, + const struct nft_pktinfo *pkt) + { ++ struct nft_base_chain *base_chain; + struct nft_stats *stats; + ++ base_chain = nft_base_chain(chain); ++ if (!base_chain->stats) ++ return; ++ + local_bh_disable(); +- stats = this_cpu_ptr(rcu_dereference(nft_base_chain(chain)->stats)); +- u64_stats_update_begin(&stats->syncp); +- stats->pkts++; +- stats->bytes += pkt->skb->len; +- u64_stats_update_end(&stats->syncp); ++ stats = this_cpu_ptr(rcu_dereference(base_chain->stats)); ++ if (stats) { ++ u64_stats_update_begin(&stats->syncp); ++ stats->pkts++; ++ stats->bytes += pkt->skb->len; ++ u64_stats_update_end(&stats->syncp); ++ } + local_bh_enable(); + } + +@@ -201,7 +208,8 @@ nft_do_chain(struct nft_pktinfo *pkt, void *priv) + + switch (regs.verdict.code) { + case NFT_JUMP: +- BUG_ON(stackptr >= NFT_JUMP_STACK_SIZE); ++ if (WARN_ON_ONCE(stackptr >= NFT_JUMP_STACK_SIZE)) ++ return NF_DROP; + jumpstack[stackptr].chain = chain; + jumpstack[stackptr].rule = rule; + jumpstack[stackptr].rulenum = rulenum; +diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c +index b89f4f65b2a0..3bd637eadc42 100644 +--- a/net/netfilter/nft_compat.c ++++ b/net/netfilter/nft_compat.c +@@ -27,14 +27,31 @@ struct nft_xt { + struct list_head head; + struct nft_expr_ops ops; + unsigned int refcnt; ++ ++ /* Unlike other expressions, ops doesn't have static storage duration. ++ * nft core assumes they do. We use kfree_rcu so that nft core can ++ * can check expr->ops->size even after nft_compat->destroy() frees ++ * the nft_xt struct that holds the ops structure. ++ */ ++ struct rcu_head rcu_head; ++}; ++ ++/* Used for matches where *info is larger than X byte */ ++#define NFT_MATCH_LARGE_THRESH 192 ++ ++struct nft_xt_match_priv { ++ void *info; + }; + +-static void nft_xt_put(struct nft_xt *xt) ++static bool nft_xt_put(struct nft_xt *xt) + { + if (--xt->refcnt == 0) { + list_del(&xt->head); +- kfree(xt); ++ kfree_rcu(xt, rcu_head); ++ return true; + } ++ ++ return false; + } + + static int nft_compat_chain_validate_dependency(const char *tablename, +@@ -226,6 +243,7 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + struct xt_target *target = expr->ops->data; + struct xt_tgchk_param par; + size_t size = XT_ALIGN(nla_len(tb[NFTA_TARGET_INFO])); ++ struct nft_xt *nft_xt; + u16 proto = 0; + bool inv = false; + union nft_entry e = {}; +@@ -236,25 +254,22 @@ nft_target_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (ctx->nla[NFTA_RULE_COMPAT]) { + ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); + if (ret < 0) +- goto err; ++ return ret; + } + + nft_target_set_tgchk_param(&par, ctx, target, info, &e, proto, inv); + + ret = xt_check_target(&par, size, proto, inv); + if (ret < 0) +- goto err; ++ return ret; + + /* The standard target cannot be used */ +- if (target->target == NULL) { +- ret = -EINVAL; +- goto err; +- } ++ if (!target->target) ++ return -EINVAL; + ++ nft_xt = container_of(expr->ops, struct nft_xt, ops); ++ nft_xt->refcnt++; + return 0; +-err: +- module_put(target->me); +- return ret; + } + + static void +@@ -271,8 +286,8 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + if (par.target->destroy != NULL) + par.target->destroy(&par); + +- nft_xt_put(container_of(expr->ops, struct nft_xt, ops)); +- module_put(target->me); ++ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) ++ module_put(target->me); + } + + static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr) +@@ -316,11 +331,11 @@ static int nft_target_validate(const struct nft_ctx *ctx, + return 0; + } + +-static void nft_match_eval(const struct nft_expr *expr, +- struct nft_regs *regs, +- const struct nft_pktinfo *pkt) ++static void __nft_match_eval(const struct nft_expr *expr, ++ struct nft_regs *regs, ++ const struct nft_pktinfo *pkt, ++ void *info) + { +- void *info = nft_expr_priv(expr); + struct xt_match *match = expr->ops->data; + struct sk_buff *skb = pkt->skb; + bool ret; +@@ -344,6 +359,22 @@ static void nft_match_eval(const struct nft_expr *expr, + } + } + ++static void nft_match_large_eval(const struct nft_expr *expr, ++ struct nft_regs *regs, ++ const struct nft_pktinfo *pkt) ++{ ++ struct nft_xt_match_priv *priv = nft_expr_priv(expr); ++ ++ __nft_match_eval(expr, regs, pkt, priv->info); ++} ++ ++static void nft_match_eval(const struct nft_expr *expr, ++ struct nft_regs *regs, ++ const struct nft_pktinfo *pkt) ++{ ++ __nft_match_eval(expr, regs, pkt, nft_expr_priv(expr)); ++} ++ + static const struct nla_policy nft_match_policy[NFTA_MATCH_MAX + 1] = { + [NFTA_MATCH_NAME] = { .type = NLA_NUL_STRING }, + [NFTA_MATCH_REV] = { .type = NLA_U32 }, +@@ -404,13 +435,14 @@ static void match_compat_from_user(struct xt_match *m, void *in, void *out) + } + + static int +-nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, +- const struct nlattr * const tb[]) ++__nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ++ const struct nlattr * const tb[], ++ void *info) + { +- void *info = nft_expr_priv(expr); + struct xt_match *match = expr->ops->data; + struct xt_mtchk_param par; + size_t size = XT_ALIGN(nla_len(tb[NFTA_MATCH_INFO])); ++ struct nft_xt *nft_xt; + u16 proto = 0; + bool inv = false; + union nft_entry e = {}; +@@ -421,26 +453,50 @@ nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, + if (ctx->nla[NFTA_RULE_COMPAT]) { + ret = nft_parse_compat(ctx->nla[NFTA_RULE_COMPAT], &proto, &inv); + if (ret < 0) +- goto err; ++ return ret; + } + + nft_match_set_mtchk_param(&par, ctx, match, info, &e, proto, inv); + + ret = xt_check_match(&par, size, proto, inv); + if (ret < 0) +- goto err; ++ return ret; + ++ nft_xt = container_of(expr->ops, struct nft_xt, ops); ++ nft_xt->refcnt++; + return 0; +-err: +- module_put(match->me); ++} ++ ++static int ++nft_match_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ++ const struct nlattr * const tb[]) ++{ ++ return __nft_match_init(ctx, expr, tb, nft_expr_priv(expr)); ++} ++ ++static int ++nft_match_large_init(const struct nft_ctx *ctx, const struct nft_expr *expr, ++ const struct nlattr * const tb[]) ++{ ++ struct nft_xt_match_priv *priv = nft_expr_priv(expr); ++ struct xt_match *m = expr->ops->data; ++ int ret; ++ ++ priv->info = kmalloc(XT_ALIGN(m->matchsize), GFP_KERNEL); ++ if (!priv->info) ++ return -ENOMEM; ++ ++ ret = __nft_match_init(ctx, expr, tb, priv->info); ++ if (ret) ++ kfree(priv->info); + return ret; + } + + static void +-nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) ++__nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr, ++ void *info) + { + struct xt_match *match = expr->ops->data; +- void *info = nft_expr_priv(expr); + struct xt_mtdtor_param par; + + par.net = ctx->net; +@@ -450,13 +506,28 @@ nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) + if (par.match->destroy != NULL) + par.match->destroy(&par); + +- nft_xt_put(container_of(expr->ops, struct nft_xt, ops)); +- module_put(match->me); ++ if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops))) ++ module_put(match->me); + } + +-static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) ++static void ++nft_match_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) ++{ ++ __nft_match_destroy(ctx, expr, nft_expr_priv(expr)); ++} ++ ++static void ++nft_match_large_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr) ++{ ++ struct nft_xt_match_priv *priv = nft_expr_priv(expr); ++ ++ __nft_match_destroy(ctx, expr, priv->info); ++ kfree(priv->info); ++} ++ ++static int __nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr, ++ void *info) + { +- void *info = nft_expr_priv(expr); + struct xt_match *match = expr->ops->data; + + if (nla_put_string(skb, NFTA_MATCH_NAME, match->name) || +@@ -470,6 +541,18 @@ static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) + return -1; + } + ++static int nft_match_dump(struct sk_buff *skb, const struct nft_expr *expr) ++{ ++ return __nft_match_dump(skb, expr, nft_expr_priv(expr)); ++} ++ ++static int nft_match_large_dump(struct sk_buff *skb, const struct nft_expr *e) ++{ ++ struct nft_xt_match_priv *priv = nft_expr_priv(e); ++ ++ return __nft_match_dump(skb, e, priv->info); ++} ++ + static int nft_match_validate(const struct nft_ctx *ctx, + const struct nft_expr *expr, + const struct nft_data **data) +@@ -637,6 +720,7 @@ nft_match_select_ops(const struct nft_ctx *ctx, + { + struct nft_xt *nft_match; + struct xt_match *match; ++ unsigned int matchsize; + char *mt_name; + u32 rev, family; + int err; +@@ -654,13 +738,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, + list_for_each_entry(nft_match, &nft_match_list, head) { + struct xt_match *match = nft_match->ops.data; + +- if (nft_match_cmp(match, mt_name, rev, family)) { +- if (!try_module_get(match->me)) +- return ERR_PTR(-ENOENT); +- +- nft_match->refcnt++; ++ if (nft_match_cmp(match, mt_name, rev, family)) + return &nft_match->ops; +- } + } + + match = xt_request_find_match(family, mt_name, rev); +@@ -679,9 +758,8 @@ nft_match_select_ops(const struct nft_ctx *ctx, + goto err; + } + +- nft_match->refcnt = 1; ++ nft_match->refcnt = 0; + nft_match->ops.type = &nft_match_type; +- nft_match->ops.size = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); + nft_match->ops.eval = nft_match_eval; + nft_match->ops.init = nft_match_init; + nft_match->ops.destroy = nft_match_destroy; +@@ -689,6 +767,18 @@ nft_match_select_ops(const struct nft_ctx *ctx, + nft_match->ops.validate = nft_match_validate; + nft_match->ops.data = match; + ++ matchsize = NFT_EXPR_SIZE(XT_ALIGN(match->matchsize)); ++ if (matchsize > NFT_MATCH_LARGE_THRESH) { ++ matchsize = NFT_EXPR_SIZE(sizeof(struct nft_xt_match_priv)); ++ ++ nft_match->ops.eval = nft_match_large_eval; ++ nft_match->ops.init = nft_match_large_init; ++ nft_match->ops.destroy = nft_match_large_destroy; ++ nft_match->ops.dump = nft_match_large_dump; ++ } ++ ++ nft_match->ops.size = matchsize; ++ + list_add(&nft_match->head, &nft_match_list); + + return &nft_match->ops; +@@ -739,13 +829,8 @@ nft_target_select_ops(const struct nft_ctx *ctx, + list_for_each_entry(nft_target, &nft_target_list, head) { + struct xt_target *target = nft_target->ops.data; + +- if (nft_target_cmp(target, tg_name, rev, family)) { +- if (!try_module_get(target->me)) +- return ERR_PTR(-ENOENT); +- +- nft_target->refcnt++; ++ if (nft_target_cmp(target, tg_name, rev, family)) + return &nft_target->ops; +- } + } + + target = xt_request_find_target(family, tg_name, rev); +@@ -764,7 +849,7 @@ nft_target_select_ops(const struct nft_ctx *ctx, + goto err; + } + +- nft_target->refcnt = 1; ++ nft_target->refcnt = 0; + nft_target->ops.type = &nft_target_type; + nft_target->ops.size = NFT_EXPR_SIZE(XT_ALIGN(target->targetsize)); + nft_target->ops.init = nft_target_init; +@@ -825,6 +910,32 @@ static int __init nft_compat_module_init(void) + + static void __exit nft_compat_module_exit(void) + { ++ struct nft_xt *xt, *next; ++ ++ /* list should be empty here, it can be non-empty only in case there ++ * was an error that caused nft_xt expr to not be initialized fully ++ * and noone else requested the same expression later. ++ * ++ * In this case, the lists contain 0-refcount entries that still ++ * hold module reference. ++ */ ++ list_for_each_entry_safe(xt, next, &nft_target_list, head) { ++ struct xt_target *target = xt->ops.data; ++ ++ if (WARN_ON_ONCE(xt->refcnt)) ++ continue; ++ module_put(target->me); ++ kfree(xt); ++ } ++ ++ list_for_each_entry_safe(xt, next, &nft_match_list, head) { ++ struct xt_match *match = xt->ops.data; ++ ++ if (WARN_ON_ONCE(xt->refcnt)) ++ continue; ++ module_put(match->me); ++ kfree(xt); ++ } + nfnetlink_subsys_unregister(&nfnl_compat_subsys); + nft_unregister_expr(&nft_target_type); + nft_unregister_expr(&nft_match_type); +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index 4717d7796927..aa87ff8beae8 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -69,8 +69,16 @@ static int nft_immediate_init(const struct nft_ctx *ctx, + return err; + } + +-static void nft_immediate_destroy(const struct nft_ctx *ctx, +- const struct nft_expr *expr) ++static void nft_immediate_activate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) ++{ ++ const struct nft_immediate_expr *priv = nft_expr_priv(expr); ++ ++ return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg)); ++} ++ ++static void nft_immediate_deactivate(const struct nft_ctx *ctx, ++ const struct nft_expr *expr) + { + const struct nft_immediate_expr *priv = nft_expr_priv(expr); + +@@ -108,7 +116,8 @@ static const struct nft_expr_ops nft_imm_ops = { + .size = NFT_EXPR_SIZE(sizeof(struct nft_immediate_expr)), + .eval = nft_immediate_eval, + .init = nft_immediate_init, +- .destroy = nft_immediate_destroy, ++ .activate = nft_immediate_activate, ++ .deactivate = nft_immediate_deactivate, + .dump = nft_immediate_dump, + .validate = nft_immediate_validate, + }; +diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c +index a9fc298ef4c3..72f13a1144dd 100644 +--- a/net/netfilter/nft_limit.c ++++ b/net/netfilter/nft_limit.c +@@ -51,10 +51,13 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost) + return !limit->invert; + } + ++/* Use same default as in iptables. */ ++#define NFT_LIMIT_PKT_BURST_DEFAULT 5 ++ + static int nft_limit_init(struct nft_limit *limit, +- const struct nlattr * const tb[]) ++ const struct nlattr * const tb[], bool pkts) + { +- u64 unit; ++ u64 unit, tokens; + + if (tb[NFTA_LIMIT_RATE] == NULL || + tb[NFTA_LIMIT_UNIT] == NULL) +@@ -68,18 +71,25 @@ static int nft_limit_init(struct nft_limit *limit, + + if (tb[NFTA_LIMIT_BURST]) + limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST])); +- else +- limit->burst = 0; ++ ++ if (pkts && limit->burst == 0) ++ limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT; + + if (limit->rate + limit->burst < limit->rate) + return -EOVERFLOW; + +- /* The token bucket size limits the number of tokens can be +- * accumulated. tokens_max specifies the bucket size. +- * tokens_max = unit * (rate + burst) / rate. +- */ +- limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst), +- limit->rate); ++ if (pkts) { ++ tokens = div_u64(limit->nsecs, limit->rate) * limit->burst; ++ } else { ++ /* The token bucket size limits the number of tokens can be ++ * accumulated. tokens_max specifies the bucket size. ++ * tokens_max = unit * (rate + burst) / rate. ++ */ ++ tokens = div_u64(limit->nsecs * (limit->rate + limit->burst), ++ limit->rate); ++ } ++ ++ limit->tokens = tokens; + limit->tokens_max = limit->tokens; + + if (tb[NFTA_LIMIT_FLAGS]) { +@@ -144,7 +154,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx, + struct nft_limit_pkts *priv = nft_expr_priv(expr); + int err; + +- err = nft_limit_init(&priv->limit, tb); ++ err = nft_limit_init(&priv->limit, tb, true); + if (err < 0) + return err; + +@@ -185,7 +195,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx, + { + struct nft_limit *priv = nft_expr_priv(expr); + +- return nft_limit_init(priv, tb); ++ return nft_limit_init(priv, tb, false); + } + + static int nft_limit_bytes_dump(struct sk_buff *skb, +@@ -246,7 +256,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx, + struct nft_limit_pkts *priv = nft_obj_data(obj); + int err; + +- err = nft_limit_init(&priv->limit, tb); ++ err = nft_limit_init(&priv->limit, tb, true); + if (err < 0) + return err; + +@@ -289,7 +299,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx, + { + struct nft_limit *priv = nft_obj_data(obj); + +- return nft_limit_init(priv, tb); ++ return nft_limit_init(priv, tb, false); + } + + static int nft_limit_obj_bytes_dump(struct sk_buff *skb, +diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c +index 5a60eb23a7ed..c71184d4eac1 100644 +--- a/net/netfilter/nft_meta.c ++++ b/net/netfilter/nft_meta.c +@@ -229,7 +229,7 @@ void nft_meta_set_eval(const struct nft_expr *expr, + struct sk_buff *skb = pkt->skb; + u32 *sreg = ®s->data[meta->sreg]; + u32 value = *sreg; +- u8 pkt_type; ++ u8 value8; + + switch (meta->key) { + case NFT_META_MARK: +@@ -239,15 +239,17 @@ void nft_meta_set_eval(const struct nft_expr *expr, + skb->priority = value; + break; + case NFT_META_PKTTYPE: +- pkt_type = nft_reg_load8(sreg); ++ value8 = nft_reg_load8(sreg); + +- if (skb->pkt_type != pkt_type && +- skb_pkt_type_ok(pkt_type) && ++ if (skb->pkt_type != value8 && ++ skb_pkt_type_ok(value8) && + skb_pkt_type_ok(skb->pkt_type)) +- skb->pkt_type = pkt_type; ++ skb->pkt_type = value8; + break; + case NFT_META_NFTRACE: +- skb->nf_trace = !!value; ++ value8 = nft_reg_load8(sreg); ++ ++ skb->nf_trace = !!value8; + break; + default: + WARN_ON(1); +diff --git a/tools/perf/tests/topology.c b/tools/perf/tests/topology.c +index a59db7c45a65..81ede20f49d7 100644 +--- a/tools/perf/tests/topology.c ++++ b/tools/perf/tests/topology.c +@@ -66,6 +66,27 @@ static int check_cpu_topology(char *path, struct cpu_map *map) + session = perf_session__new(&file, false, NULL); + TEST_ASSERT_VAL("can't get session", session); + ++ /* On platforms with large numbers of CPUs process_cpu_topology() ++ * might issue an error while reading the perf.data file section ++ * HEADER_CPU_TOPOLOGY and the cpu_topology_map pointed to by member ++ * cpu is a NULL pointer. ++ * Example: On s390 ++ * CPU 0 is on core_id 0 and physical_package_id 6 ++ * CPU 1 is on core_id 1 and physical_package_id 3 ++ * ++ * Core_id and physical_package_id are platform and architecture ++ * dependend and might have higher numbers than the CPU id. ++ * This actually depends on the configuration. ++ * ++ * In this case process_cpu_topology() prints error message: ++ * "socket_id number is too big. You may need to upgrade the ++ * perf tool." ++ * ++ * This is the reason why this test might be skipped. ++ */ ++ if (!session->header.env.cpu) ++ return TEST_SKIP; ++ + for (i = 0; i < session->header.env.nr_cpus_avail; i++) { + if (!cpu_map__has(map, i)) + continue; +@@ -91,7 +112,7 @@ int test__session_topology(struct test *test __maybe_unused, int subtest __maybe + { + char path[PATH_MAX]; + struct cpu_map *map; +- int ret = -1; ++ int ret = TEST_FAIL; + + TEST_ASSERT_VAL("can't get templ file", !get_temp(path)); + +@@ -106,12 +127,9 @@ int test__session_topology(struct test *test __maybe_unused, int subtest __maybe + goto free_path; + } + +- if (check_cpu_topology(path, map)) +- goto free_map; +- ret = 0; +- +-free_map: ++ ret = check_cpu_topology(path, map); + cpu_map__put(map); ++ + free_path: + unlink(path); + return ret; +diff --git a/tools/perf/util/bpf-loader.c b/tools/perf/util/bpf-loader.c +index 72c107fcbc5a..c02d2cfd3aea 100644 +--- a/tools/perf/util/bpf-loader.c ++++ b/tools/perf/util/bpf-loader.c +@@ -66,7 +66,7 @@ bpf__prepare_load_buffer(void *obj_buf, size_t obj_buf_sz, const char *name) + } + + obj = bpf_object__open_buffer(obj_buf, obj_buf_sz, name); +- if (IS_ERR(obj)) { ++ if (IS_ERR_OR_NULL(obj)) { + pr_debug("bpf: failed to load buffer\n"); + return ERR_PTR(-EINVAL); + } +@@ -102,14 +102,14 @@ struct bpf_object *bpf__prepare_load(const char *filename, bool source) + pr_debug("bpf: successfull builtin compilation\n"); + obj = bpf_object__open_buffer(obj_buf, obj_buf_sz, filename); + +- if (!IS_ERR(obj) && llvm_param.dump_obj) ++ if (!IS_ERR_OR_NULL(obj) && llvm_param.dump_obj) + llvm__dump_obj(filename, obj_buf, obj_buf_sz); + + free(obj_buf); + } else + obj = bpf_object__open(filename); + +- if (IS_ERR(obj)) { ++ if (IS_ERR_OR_NULL(obj)) { + pr_debug("bpf: failed to load %s\n", filename); + return obj; + } diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.54-55.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.54-55.patch new file mode 100644 index 000000000000..360661a992b6 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.54-55.patch @@ -0,0 +1,2167 @@ +diff --git a/Makefile b/Makefile +index de0955d8dfa3..0700feaaa6cf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 54 ++SUBLEVEL = 55 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S +index be20b1f73384..e928c2af6a10 100644 +--- a/arch/s390/kernel/entry.S ++++ b/arch/s390/kernel/entry.S +@@ -1244,7 +1244,7 @@ cleanup_critical: + jl 0f + clg %r9,BASED(.Lcleanup_table+104) # .Lload_fpu_regs_end + jl .Lcleanup_load_fpu_regs +-0: BR_EX %r14 ++0: BR_EX %r14,%r11 + + .align 8 + .Lcleanup_table: +@@ -1280,7 +1280,7 @@ cleanup_critical: + ni __SIE_PROG0C+3(%r9),0xfe # no longer in SIE + lctlg %c1,%c1,__LC_USER_ASCE # load primary asce + larl %r9,sie_exit # skip forward to sie_exit +- BR_EX %r14 ++ BR_EX %r14,%r11 + #endif + + .Lcleanup_system_call: +diff --git a/block/blk-lib.c b/block/blk-lib.c +index 63fb971d6574..2bc544ce3d2e 100644 +--- a/block/blk-lib.c ++++ b/block/blk-lib.c +@@ -275,6 +275,40 @@ static unsigned int __blkdev_sectors_to_bio_pages(sector_t nr_sects) + return min(pages, (sector_t)BIO_MAX_PAGES); + } + ++static int __blkdev_issue_zero_pages(struct block_device *bdev, ++ sector_t sector, sector_t nr_sects, gfp_t gfp_mask, ++ struct bio **biop) ++{ ++ struct request_queue *q = bdev_get_queue(bdev); ++ struct bio *bio = *biop; ++ int bi_size = 0; ++ unsigned int sz; ++ ++ if (!q) ++ return -ENXIO; ++ ++ while (nr_sects != 0) { ++ bio = next_bio(bio, __blkdev_sectors_to_bio_pages(nr_sects), ++ gfp_mask); ++ bio->bi_iter.bi_sector = sector; ++ bio_set_dev(bio, bdev); ++ bio_set_op_attrs(bio, REQ_OP_WRITE, 0); ++ ++ while (nr_sects != 0) { ++ sz = min((sector_t) PAGE_SIZE, nr_sects << 9); ++ bi_size = bio_add_page(bio, ZERO_PAGE(0), sz, 0); ++ nr_sects -= bi_size >> 9; ++ sector += bi_size >> 9; ++ if (bi_size < sz) ++ break; ++ } ++ cond_resched(); ++ } ++ ++ *biop = bio; ++ return 0; ++} ++ + /** + * __blkdev_issue_zeroout - generate number of zero filed write bios + * @bdev: blockdev to issue +@@ -288,12 +322,6 @@ static unsigned int __blkdev_sectors_to_bio_pages(sector_t nr_sects) + * Zero-fill a block range, either using hardware offload or by explicitly + * writing zeroes to the device. + * +- * Note that this function may fail with -EOPNOTSUPP if the driver signals +- * zeroing offload support, but the device fails to process the command (for +- * some devices there is no non-destructive way to verify whether this +- * operation is actually supported). In this case the caller should call +- * retry the call to blkdev_issue_zeroout() and the fallback path will be used. +- * + * If a device is using logical block provisioning, the underlying space will + * not be released if %flags contains BLKDEV_ZERO_NOUNMAP. + * +@@ -305,9 +333,6 @@ int __blkdev_issue_zeroout(struct block_device *bdev, sector_t sector, + unsigned flags) + { + int ret; +- int bi_size = 0; +- struct bio *bio = *biop; +- unsigned int sz; + sector_t bs_mask; + + bs_mask = (bdev_logical_block_size(bdev) >> 9) - 1; +@@ -317,30 +342,10 @@ int __blkdev_issue_zeroout(struct block_device *bdev, sector_t sector, + ret = __blkdev_issue_write_zeroes(bdev, sector, nr_sects, gfp_mask, + biop, flags); + if (ret != -EOPNOTSUPP || (flags & BLKDEV_ZERO_NOFALLBACK)) +- goto out; +- +- ret = 0; +- while (nr_sects != 0) { +- bio = next_bio(bio, __blkdev_sectors_to_bio_pages(nr_sects), +- gfp_mask); +- bio->bi_iter.bi_sector = sector; +- bio_set_dev(bio, bdev); +- bio_set_op_attrs(bio, REQ_OP_WRITE, 0); +- +- while (nr_sects != 0) { +- sz = min((sector_t) PAGE_SIZE, nr_sects << 9); +- bi_size = bio_add_page(bio, ZERO_PAGE(0), sz, 0); +- nr_sects -= bi_size >> 9; +- sector += bi_size >> 9; +- if (bi_size < sz) +- break; +- } +- cond_resched(); +- } ++ return ret; + +- *biop = bio; +-out: +- return ret; ++ return __blkdev_issue_zero_pages(bdev, sector, nr_sects, gfp_mask, ++ biop); + } + EXPORT_SYMBOL(__blkdev_issue_zeroout); + +@@ -360,18 +365,49 @@ EXPORT_SYMBOL(__blkdev_issue_zeroout); + int blkdev_issue_zeroout(struct block_device *bdev, sector_t sector, + sector_t nr_sects, gfp_t gfp_mask, unsigned flags) + { +- int ret; +- struct bio *bio = NULL; ++ int ret = 0; ++ sector_t bs_mask; ++ struct bio *bio; + struct blk_plug plug; ++ bool try_write_zeroes = !!bdev_write_zeroes_sectors(bdev); + ++ bs_mask = (bdev_logical_block_size(bdev) >> 9) - 1; ++ if ((sector | nr_sects) & bs_mask) ++ return -EINVAL; ++ ++retry: ++ bio = NULL; + blk_start_plug(&plug); +- ret = __blkdev_issue_zeroout(bdev, sector, nr_sects, gfp_mask, +- &bio, flags); ++ if (try_write_zeroes) { ++ ret = __blkdev_issue_write_zeroes(bdev, sector, nr_sects, ++ gfp_mask, &bio, flags); ++ } else if (!(flags & BLKDEV_ZERO_NOFALLBACK)) { ++ ret = __blkdev_issue_zero_pages(bdev, sector, nr_sects, ++ gfp_mask, &bio); ++ } else { ++ /* No zeroing offload support */ ++ ret = -EOPNOTSUPP; ++ } + if (ret == 0 && bio) { + ret = submit_bio_wait(bio); + bio_put(bio); + } + blk_finish_plug(&plug); ++ if (ret && try_write_zeroes) { ++ if (!(flags & BLKDEV_ZERO_NOFALLBACK)) { ++ try_write_zeroes = false; ++ goto retry; ++ } ++ if (!bdev_write_zeroes_sectors(bdev)) { ++ /* ++ * Zeroing offload support was indicated, but the ++ * device reported ILLEGAL REQUEST (for some devices ++ * there is no non-destructive way to verify whether ++ * WRITE ZEROES is actually supported). ++ */ ++ ret = -EOPNOTSUPP; ++ } ++ } + + return ret; + } +diff --git a/drivers/block/drbd/drbd_worker.c b/drivers/block/drbd/drbd_worker.c +index 03471b3fce86..c2042f822b03 100644 +--- a/drivers/block/drbd/drbd_worker.c ++++ b/drivers/block/drbd/drbd_worker.c +@@ -282,8 +282,8 @@ void drbd_request_endio(struct bio *bio) + what = COMPLETED_OK; + } + +- bio_put(req->private_bio); + req->private_bio = ERR_PTR(blk_status_to_errno(bio->bi_status)); ++ bio_put(bio); + + /* not req_mod(), we need irqsave here! */ + spin_lock_irqsave(&device->resource->req_lock, flags); +diff --git a/drivers/dax/super.c b/drivers/dax/super.c +index c4cd034a3820..6c179c2a9ff9 100644 +--- a/drivers/dax/super.c ++++ b/drivers/dax/super.c +@@ -73,42 +73,50 @@ EXPORT_SYMBOL_GPL(fs_dax_get_by_bdev); + + /** + * __bdev_dax_supported() - Check if the device supports dax for filesystem +- * @sb: The superblock of the device ++ * @bdev: block device to check + * @blocksize: The block size of the device + * + * This is a library function for filesystems to check if the block device + * can be mounted with dax option. + * +- * Return: negative errno if unsupported, 0 if supported. ++ * Return: true if supported, false if unsupported + */ +-int __bdev_dax_supported(struct super_block *sb, int blocksize) ++bool __bdev_dax_supported(struct block_device *bdev, int blocksize) + { +- struct block_device *bdev = sb->s_bdev; + struct dax_device *dax_dev; ++ struct request_queue *q; + pgoff_t pgoff; + int err, id; + void *kaddr; + pfn_t pfn; + long len; ++ char buf[BDEVNAME_SIZE]; + + if (blocksize != PAGE_SIZE) { +- pr_err("VFS (%s): error: unsupported blocksize for dax\n", +- sb->s_id); +- return -EINVAL; ++ pr_debug("%s: error: unsupported blocksize for dax\n", ++ bdevname(bdev, buf)); ++ return false; ++ } ++ ++ q = bdev_get_queue(bdev); ++ if (!q || !blk_queue_dax(q)) { ++ pr_debug("%s: error: request queue doesn't support dax\n", ++ bdevname(bdev, buf)); ++ return false; + } + + err = bdev_dax_pgoff(bdev, 0, PAGE_SIZE, &pgoff); + if (err) { +- pr_err("VFS (%s): error: unaligned partition for dax\n", +- sb->s_id); +- return err; ++ pr_debug("%s: error: unaligned partition for dax\n", ++ bdevname(bdev, buf)); ++ return false; + } + + dax_dev = dax_get_by_host(bdev->bd_disk->disk_name); + if (!dax_dev) { +- pr_err("VFS (%s): error: device does not support dax\n", +- sb->s_id); +- return -EOPNOTSUPP; ++ pr_debug("%s: error: device does not support dax\n", ++ bdevname(bdev, buf)); ++ return false; + } + + id = dax_read_lock(); +@@ -118,12 +126,12 @@ int __bdev_dax_supported(struct super_block *sb, int blocksize) + put_dax(dax_dev); + + if (len < 1) { +- pr_err("VFS (%s): error: dax access failed (%ld)", +- sb->s_id, len); +- return len < 0 ? len : -EIO; ++ pr_debug("%s: error: dax access failed (%ld)\n", ++ bdevname(bdev, buf), len); ++ return false; + } + +- return 0; ++ return true; + } + EXPORT_SYMBOL_GPL(__bdev_dax_supported); + #endif +diff --git a/drivers/gpu/drm/drm_property.c b/drivers/gpu/drm/drm_property.c +index bc5128203056..78e630771214 100644 +--- a/drivers/gpu/drm/drm_property.c ++++ b/drivers/gpu/drm/drm_property.c +@@ -516,7 +516,7 @@ static void drm_property_free_blob(struct kref *kref) + + drm_mode_object_unregister(blob->dev, &blob->base); + +- kfree(blob); ++ kvfree(blob); + } + + /** +@@ -543,7 +543,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + if (!length || length > ULONG_MAX - sizeof(struct drm_property_blob)) + return ERR_PTR(-EINVAL); + +- blob = kzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); ++ blob = kvzalloc(sizeof(struct drm_property_blob)+length, GFP_KERNEL); + if (!blob) + return ERR_PTR(-ENOMEM); + +@@ -559,7 +559,7 @@ drm_property_create_blob(struct drm_device *dev, size_t length, + ret = __drm_mode_object_add(dev, &blob->base, DRM_MODE_OBJECT_BLOB, + true, drm_property_free_blob); + if (ret) { +- kfree(blob); ++ kvfree(blob); + return ERR_PTR(-EINVAL); + } + +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index 2ebdc6d5a76e..d5583190f3e4 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -137,7 +137,10 @@ int udl_handle_damage(struct udl_framebuffer *fb, int x, int y, + + if (cmd > (char *) urb->transfer_buffer) { + /* Send partial buffer remaining before exiting */ +- int len = cmd - (char *) urb->transfer_buffer; ++ int len; ++ if (cmd < (char *) urb->transfer_buffer + urb->transfer_buffer_length) ++ *cmd++ = 0xAF; ++ len = cmd - (char *) urb->transfer_buffer; + ret = udl_submit_urb(dev, urb, len); + bytes_sent += len; + } else +diff --git a/drivers/gpu/drm/udl/udl_transfer.c b/drivers/gpu/drm/udl/udl_transfer.c +index 0c87b1ac6b68..b992644c17e6 100644 +--- a/drivers/gpu/drm/udl/udl_transfer.c ++++ b/drivers/gpu/drm/udl/udl_transfer.c +@@ -153,11 +153,11 @@ static void udl_compress_hline16( + raw_pixels_count_byte = cmd++; /* we'll know this later */ + raw_pixel_start = pixel; + +- cmd_pixel_end = pixel + (min(MAX_CMD_PIXELS + 1, +- min((int)(pixel_end - pixel) / bpp, +- (int)(cmd_buffer_end - cmd) / 2))) * bpp; ++ cmd_pixel_end = pixel + min3(MAX_CMD_PIXELS + 1UL, ++ (unsigned long)(pixel_end - pixel) / bpp, ++ (unsigned long)(cmd_buffer_end - 1 - cmd) / 2) * bpp; + +- prefetch_range((void *) pixel, (cmd_pixel_end - pixel) * bpp); ++ prefetch_range((void *) pixel, cmd_pixel_end - pixel); + pixel_val16 = get_pixel_val16(pixel, bpp); + + while (pixel < cmd_pixel_end) { +@@ -193,6 +193,9 @@ static void udl_compress_hline16( + if (pixel > raw_pixel_start) { + /* finalize last RAW span */ + *raw_pixels_count_byte = ((pixel-raw_pixel_start) / bpp) & 0xFF; ++ } else { ++ /* undo unused byte */ ++ cmd--; + } + + *cmd_pixels_count_byte = ((pixel - cmd_pixel_start) / bpp) & 0xFF; +diff --git a/drivers/hid/hid-debug.c b/drivers/hid/hid-debug.c +index 5271db593478..ae8c8e66a6c4 100644 +--- a/drivers/hid/hid-debug.c ++++ b/drivers/hid/hid-debug.c +@@ -1154,6 +1154,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, + goto out; + if (list->tail > list->head) { + len = list->tail - list->head; ++ if (len > count) ++ len = count; + + if (copy_to_user(buffer + ret, &list->hid_debug_buf[list->head], len)) { + ret = -EFAULT; +@@ -1163,6 +1165,8 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, + list->head += len; + } else { + len = HID_DEBUG_BUFSIZE - list->head; ++ if (len > count) ++ len = count; + + if (copy_to_user(buffer, &list->hid_debug_buf[list->head], len)) { + ret = -EFAULT; +@@ -1170,7 +1174,9 @@ static ssize_t hid_debug_events_read(struct file *file, char __user *buffer, + } + list->head = 0; + ret += len; +- goto copy_rest; ++ count -= len; ++ if (count > 0) ++ goto copy_rest; + } + + } +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 3535073a9a7d..d92827556389 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -476,7 +476,7 @@ static void i2c_hid_get_input(struct i2c_hid *ihid) + return; + } + +- if ((ret_size > size) || (ret_size <= 2)) { ++ if ((ret_size > size) || (ret_size < 2)) { + dev_err(&ihid->client->dev, "%s: incomplete report (%d/%d)\n", + __func__, size, ret_size); + return; +diff --git a/drivers/hid/usbhid/hiddev.c b/drivers/hid/usbhid/hiddev.c +index 7d749b19c27c..cf307bdc3d53 100644 +--- a/drivers/hid/usbhid/hiddev.c ++++ b/drivers/hid/usbhid/hiddev.c +@@ -36,6 +36,7 @@ + #include + #include + #include ++#include + #include "usbhid.h" + + #ifdef CONFIG_USB_DYNAMIC_MINORS +@@ -469,10 +470,14 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, + + if (uref->field_index >= report->maxfield) + goto inval; ++ uref->field_index = array_index_nospec(uref->field_index, ++ report->maxfield); + + field = report->field[uref->field_index]; + if (uref->usage_index >= field->maxusage) + goto inval; ++ uref->usage_index = array_index_nospec(uref->usage_index, ++ field->maxusage); + + uref->usage_code = field->usage[uref->usage_index].hid; + +@@ -499,6 +504,8 @@ static noinline int hiddev_ioctl_usage(struct hiddev *hiddev, unsigned int cmd, + + if (uref->field_index >= report->maxfield) + goto inval; ++ uref->field_index = array_index_nospec(uref->field_index, ++ report->maxfield); + + field = report->field[uref->field_index]; + +@@ -753,6 +760,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + if (finfo.field_index >= report->maxfield) + break; ++ finfo.field_index = array_index_nospec(finfo.field_index, ++ report->maxfield); + + field = report->field[finfo.field_index]; + memset(&finfo, 0, sizeof(finfo)); +@@ -797,6 +806,8 @@ static long hiddev_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + + if (cinfo.index >= hid->maxcollection) + break; ++ cinfo.index = array_index_nospec(cinfo.index, ++ hid->maxcollection); + + cinfo.type = hid->collection[cinfo.index].type; + cinfo.usage = hid->collection[cinfo.index].usage; +diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c +index 4287fc9f3527..f9cd81375f28 100644 +--- a/drivers/md/dm-table.c ++++ b/drivers/md/dm-table.c +@@ -883,9 +883,7 @@ EXPORT_SYMBOL_GPL(dm_table_set_type); + static int device_supports_dax(struct dm_target *ti, struct dm_dev *dev, + sector_t start, sector_t len, void *data) + { +- struct request_queue *q = bdev_get_queue(dev->bdev); +- +- return q && blk_queue_dax(q); ++ return bdev_dax_supported(dev->bdev, PAGE_SIZE); + } + + static bool dm_table_supports_dax(struct dm_table *t) +@@ -1813,6 +1811,11 @@ void dm_table_set_restrictions(struct dm_table *t, struct request_queue *q, + } + blk_queue_write_cache(q, wc, fua); + ++ if (dm_table_supports_dax(t)) ++ queue_flag_set_unlocked(QUEUE_FLAG_DAX, q); ++ else ++ queue_flag_clear_unlocked(QUEUE_FLAG_DAX, q); ++ + if (dm_table_supports_dax_write_cache(t)) + dax_write_cache(t->md->dax_dev, true); + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 1dfc855ac708..24ec6e039448 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -961,8 +961,7 @@ static long dm_dax_direct_access(struct dax_device *dax_dev, pgoff_t pgoff, + if (len < 1) + goto out; + nr_pages = min(len, nr_pages); +- if (ti->type->direct_access) +- ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn); ++ ret = ti->type->direct_access(ti, pgoff, nr_pages, kaddr, pfn); + + out: + dm_put_live_table(md, srcu_idx); +@@ -2050,9 +2049,6 @@ int dm_setup_md_queue(struct mapped_device *md, struct dm_table *t) + */ + bioset_free(md->queue->bio_split); + md->queue->bio_split = NULL; +- +- if (type == DM_TYPE_DAX_BIO_BASED) +- queue_flag_set_unlocked(QUEUE_FLAG_DAX, md->queue); + break; + case DM_TYPE_NONE: + WARN_ON_ONCE(true); +diff --git a/drivers/media/i2c/cx25840/cx25840-core.c b/drivers/media/i2c/cx25840/cx25840-core.c +index 39f51daa7558..c5642813eff1 100644 +--- a/drivers/media/i2c/cx25840/cx25840-core.c ++++ b/drivers/media/i2c/cx25840/cx25840-core.c +@@ -463,8 +463,13 @@ static void cx23885_initialize(struct i2c_client *client) + { + DEFINE_WAIT(wait); + struct cx25840_state *state = to_state(i2c_get_clientdata(client)); ++ u32 clk_freq = 0; + struct workqueue_struct *q; + ++ /* cx23885 sets hostdata to clk_freq pointer */ ++ if (v4l2_get_subdev_hostdata(&state->sd)) ++ clk_freq = *((u32 *)v4l2_get_subdev_hostdata(&state->sd)); ++ + /* + * Come out of digital power down + * The CX23888, at least, needs this, otherwise registers aside from +@@ -500,8 +505,13 @@ static void cx23885_initialize(struct i2c_client *client) + * 50.0 MHz * (0xb + 0xe8ba26/0x2000000)/4 = 5 * 28.636363 MHz + * 572.73 MHz before post divide + */ +- /* HVR1850 or 50MHz xtal */ +- cx25840_write(client, 0x2, 0x71); ++ if (clk_freq == 25000000) { ++ /* 888/ImpactVCBe or 25Mhz xtal */ ++ ; /* nothing to do */ ++ } else { ++ /* HVR1850 or 50MHz xtal */ ++ cx25840_write(client, 0x2, 0x71); ++ } + cx25840_write4(client, 0x11c, 0x01d1744c); + cx25840_write4(client, 0x118, 0x00000416); + cx25840_write4(client, 0x404, 0x0010253e); +@@ -544,9 +554,15 @@ static void cx23885_initialize(struct i2c_client *client) + /* HVR1850 */ + switch (state->id) { + case CX23888_AV: +- /* 888/HVR1250 specific */ +- cx25840_write4(client, 0x10c, 0x13333333); +- cx25840_write4(client, 0x108, 0x00000515); ++ if (clk_freq == 25000000) { ++ /* 888/ImpactVCBe or 25MHz xtal */ ++ cx25840_write4(client, 0x10c, 0x01b6db7b); ++ cx25840_write4(client, 0x108, 0x00000512); ++ } else { ++ /* 888/HVR1250 or 50MHz xtal */ ++ cx25840_write4(client, 0x10c, 0x13333333); ++ cx25840_write4(client, 0x108, 0x00000515); ++ } + break; + default: + cx25840_write4(client, 0x10c, 0x002be2c9); +@@ -576,7 +592,7 @@ static void cx23885_initialize(struct i2c_client *client) + * 368.64 MHz before post divide + * 122.88 MHz / 0xa = 12.288 MHz + */ +- /* HVR1850 or 50MHz xtal */ ++ /* HVR1850 or 50MHz xtal or 25MHz xtal */ + cx25840_write4(client, 0x114, 0x017dbf48); + cx25840_write4(client, 0x110, 0x000a030e); + break; +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index 6d9adcaa26ba..ffbb178c6918 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -1689,6 +1689,15 @@ static void __vb2_queue_cancel(struct vb2_queue *q) + for (i = 0; i < q->num_buffers; ++i) { + struct vb2_buffer *vb = q->bufs[i]; + ++ if (vb->state == VB2_BUF_STATE_PREPARED || ++ vb->state == VB2_BUF_STATE_QUEUED) { ++ unsigned int plane; ++ ++ for (plane = 0; plane < vb->num_planes; ++plane) ++ call_void_memop(vb, finish, ++ vb->planes[plane].mem_priv); ++ } ++ + if (vb->state != VB2_BUF_STATE_DEQUEUED) { + vb->state = VB2_BUF_STATE_PREPARED; + call_void_vb_qop(vb, buf_finish, vb); +diff --git a/drivers/mtd/chips/cfi_cmdset_0002.c b/drivers/mtd/chips/cfi_cmdset_0002.c +index ac76c10c042f..af3d207c9cc4 100644 +--- a/drivers/mtd/chips/cfi_cmdset_0002.c ++++ b/drivers/mtd/chips/cfi_cmdset_0002.c +@@ -42,7 +42,7 @@ + #define AMD_BOOTLOC_BUG + #define FORCE_WORD_WRITE 0 + +-#define MAX_WORD_RETRIES 3 ++#define MAX_RETRIES 3 + + #define SST49LF004B 0x0060 + #define SST49LF040B 0x0050 +@@ -1647,7 +1647,7 @@ static int __xipram do_write_oneword(struct map_info *map, struct flchip *chip, + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_WORD_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) + goto retry; + + ret = -EIO; +@@ -2106,7 +2106,7 @@ static int do_panic_write_oneword(struct map_info *map, struct flchip *chip, + map_write(map, CMD(0xF0), chip->start); + /* FIXME - should have reset delay before continuing */ + +- if (++retry_cnt <= MAX_WORD_RETRIES) ++ if (++retry_cnt <= MAX_RETRIES) + goto retry; + + ret = -EIO; +@@ -2241,6 +2241,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) + unsigned long int adr; + DECLARE_WAITQUEUE(wait, current); + int ret = 0; ++ int retry_cnt = 0; + + adr = cfi->addr_unlock1; + +@@ -2258,6 +2259,7 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) + ENABLE_VPP(map); + xip_disable(map, chip, adr); + ++ retry: + cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); +@@ -2294,12 +2296,13 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) + chip->erase_suspended = 0; + } + +- if (chip_ready(map, adr)) ++ if (chip_good(map, adr, map_word_ff(map))) + break; + + if (time_after(jiffies, timeo)) { + printk(KERN_WARNING "MTD %s(): software timeout\n", + __func__ ); ++ ret = -EIO; + break; + } + +@@ -2307,12 +2310,15 @@ static int __xipram do_erase_chip(struct map_info *map, struct flchip *chip) + UDELAY(map, chip, adr, 1000000/HZ); + } + /* Did we succeed? */ +- if (!chip_good(map, adr, map_word_ff(map))) { ++ if (ret) { + /* reset on all failures. */ + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- ret = -EIO; ++ if (++retry_cnt <= MAX_RETRIES) { ++ ret = 0; ++ goto retry; ++ } + } + + chip->state = FL_READY; +@@ -2331,6 +2337,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + unsigned long timeo = jiffies + HZ; + DECLARE_WAITQUEUE(wait, current); + int ret = 0; ++ int retry_cnt = 0; + + adr += chip->start; + +@@ -2348,6 +2355,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + ENABLE_VPP(map); + xip_disable(map, chip, adr); + ++ retry: + cfi_send_gen_cmd(0xAA, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x55, cfi->addr_unlock2, chip->start, map, cfi, cfi->device_type, NULL); + cfi_send_gen_cmd(0x80, cfi->addr_unlock1, chip->start, map, cfi, cfi->device_type, NULL); +@@ -2384,7 +2392,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + chip->erase_suspended = 0; + } + +- if (chip_ready(map, adr)) { ++ if (chip_good(map, adr, map_word_ff(map))) { + xip_enable(map, chip, adr); + break; + } +@@ -2393,6 +2401,7 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + xip_enable(map, chip, adr); + printk(KERN_WARNING "MTD %s(): software timeout\n", + __func__ ); ++ ret = -EIO; + break; + } + +@@ -2400,12 +2409,15 @@ static int __xipram do_erase_oneblock(struct map_info *map, struct flchip *chip, + UDELAY(map, chip, adr, 1000000/HZ); + } + /* Did we succeed? */ +- if (!chip_good(map, adr, map_word_ff(map))) { ++ if (ret) { + /* reset on all failures. */ + map_write( map, CMD(0xF0), chip->start ); + /* FIXME - should have reset delay before continuing */ + +- ret = -EIO; ++ if (++retry_cnt <= MAX_RETRIES) { ++ ret = 0; ++ goto retry; ++ } + } + + chip->state = FL_READY; +diff --git a/drivers/mtd/nand/mxc_nand.c b/drivers/mtd/nand/mxc_nand.c +index 53e5e0337c3e..fcb575d55b89 100644 +--- a/drivers/mtd/nand/mxc_nand.c ++++ b/drivers/mtd/nand/mxc_nand.c +@@ -48,7 +48,7 @@ + #define NFC_V1_V2_CONFIG (host->regs + 0x0a) + #define NFC_V1_V2_ECC_STATUS_RESULT (host->regs + 0x0c) + #define NFC_V1_V2_RSLTMAIN_AREA (host->regs + 0x0e) +-#define NFC_V1_V2_RSLTSPARE_AREA (host->regs + 0x10) ++#define NFC_V21_RSLTSPARE_AREA (host->regs + 0x10) + #define NFC_V1_V2_WRPROT (host->regs + 0x12) + #define NFC_V1_UNLOCKSTART_BLKADDR (host->regs + 0x14) + #define NFC_V1_UNLOCKEND_BLKADDR (host->regs + 0x16) +@@ -1119,6 +1119,9 @@ static void preset_v2(struct mtd_info *mtd) + writew(config1, NFC_V1_V2_CONFIG1); + /* preset operation */ + ++ /* spare area size in 16-bit half-words */ ++ writew(mtd->oobsize / 2, NFC_V21_RSLTSPARE_AREA); ++ + /* Unlock the internal RAM Buffer */ + writew(0x2, NFC_V1_V2_CONFIG); + +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 5b4f05805006..519a021c0a25 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2863,7 +2863,7 @@ static int dpaa_remove(struct platform_device *pdev) + struct device *dev; + int err; + +- dev = pdev->dev.parent; ++ dev = &pdev->dev; + net_dev = dev_get_drvdata(dev); + + priv = netdev_priv(net_dev); +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 17a4cc138b00..4d49fb8f2bbc 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -51,6 +51,7 @@ static int sg_version_num = 30536; /* 2 digits for each component */ + #include + #include + #include ++#include /* for sg_check_file_access() */ + + #include "scsi.h" + #include +@@ -210,6 +211,33 @@ static void sg_device_destroy(struct kref *kref); + sdev_prefix_printk(prefix, (sdp)->device, \ + (sdp)->disk->disk_name, fmt, ##a) + ++/* ++ * The SCSI interfaces that use read() and write() as an asynchronous variant of ++ * ioctl(..., SG_IO, ...) are fundamentally unsafe, since there are lots of ways ++ * to trigger read() and write() calls from various contexts with elevated ++ * privileges. This can lead to kernel memory corruption (e.g. if these ++ * interfaces are called through splice()) and privilege escalation inside ++ * userspace (e.g. if a process with access to such a device passes a file ++ * descriptor to a SUID binary as stdin/stdout/stderr). ++ * ++ * This function provides protection for the legacy API by restricting the ++ * calling context. ++ */ ++static int sg_check_file_access(struct file *filp, const char *caller) ++{ ++ if (filp->f_cred != current_real_cred()) { ++ pr_err_once("%s: process %d (%s) changed security contexts after opening file descriptor, this is not allowed.\n", ++ caller, task_tgid_vnr(current), current->comm); ++ return -EPERM; ++ } ++ if (uaccess_kernel()) { ++ pr_err_once("%s: process %d (%s) called from kernel context, this is not allowed.\n", ++ caller, task_tgid_vnr(current), current->comm); ++ return -EACCES; ++ } ++ return 0; ++} ++ + static int sg_allow_access(struct file *filp, unsigned char *cmd) + { + struct sg_fd *sfp = filp->private_data; +@@ -394,6 +422,14 @@ sg_read(struct file *filp, char __user *buf, size_t count, loff_t * ppos) + struct sg_header *old_hdr = NULL; + int retval = 0; + ++ /* ++ * This could cause a response to be stranded. Close the associated ++ * file descriptor to free up any resources being held. ++ */ ++ retval = sg_check_file_access(filp, __func__); ++ if (retval) ++ return retval; ++ + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) + return -ENXIO; + SCSI_LOG_TIMEOUT(3, sg_printk(KERN_INFO, sdp, +@@ -581,9 +617,11 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) + struct sg_header old_hdr; + sg_io_hdr_t *hp; + unsigned char cmnd[SG_MAX_CDB_SIZE]; ++ int retval; + +- if (unlikely(uaccess_kernel())) +- return -EINVAL; ++ retval = sg_check_file_access(filp, __func__); ++ if (retval) ++ return retval; + + if ((!(sfp = (Sg_fd *) filp->private_data)) || (!(sdp = sfp->parentdp))) + return -ENXIO; +diff --git a/drivers/staging/comedi/drivers/quatech_daqp_cs.c b/drivers/staging/comedi/drivers/quatech_daqp_cs.c +index 802f51e46405..171960568356 100644 +--- a/drivers/staging/comedi/drivers/quatech_daqp_cs.c ++++ b/drivers/staging/comedi/drivers/quatech_daqp_cs.c +@@ -642,7 +642,7 @@ static int daqp_ao_insn_write(struct comedi_device *dev, + /* Make sure D/A update mode is direct update */ + outb(0, dev->iobase + DAQP_AUX_REG); + +- for (i = 0; i > insn->n; i++) { ++ for (i = 0; i < insn->n; i++) { + unsigned int val = data[i]; + int ret; + +diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c +index 4ba5004a069e..fd6ce9996488 100644 +--- a/drivers/target/target_core_pr.c ++++ b/drivers/target/target_core_pr.c +@@ -3729,11 +3729,16 @@ core_scsi3_pri_read_keys(struct se_cmd *cmd) + * Check for overflow of 8byte PRI READ_KEYS payload and + * next reservation key list descriptor. + */ +- if ((add_len + 8) > (cmd->data_length - 8)) +- break; +- +- put_unaligned_be64(pr_reg->pr_res_key, &buf[off]); +- off += 8; ++ if (off + 8 <= cmd->data_length) { ++ put_unaligned_be64(pr_reg->pr_res_key, &buf[off]); ++ off += 8; ++ } ++ /* ++ * SPC5r17: 6.16.2 READ KEYS service action ++ * The ADDITIONAL LENGTH field indicates the number of bytes in ++ * the Reservation key list. The contents of the ADDITIONAL ++ * LENGTH field are not altered based on the allocation length ++ */ + add_len += 8; + } + spin_unlock(&dev->t10_pr.registration_lock); +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index fb4e6a7ee521..d639378e36ac 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -339,18 +339,16 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + struct page *page[1]; + struct vm_area_struct *vma; + struct vm_area_struct *vmas[1]; ++ unsigned int flags = 0; + int ret; + ++ if (prot & IOMMU_WRITE) ++ flags |= FOLL_WRITE; ++ ++ down_read(&mm->mmap_sem); + if (mm == current->mm) { +- ret = get_user_pages_longterm(vaddr, 1, !!(prot & IOMMU_WRITE), +- page, vmas); ++ ret = get_user_pages_longterm(vaddr, 1, flags, page, vmas); + } else { +- unsigned int flags = 0; +- +- if (prot & IOMMU_WRITE) +- flags |= FOLL_WRITE; +- +- down_read(&mm->mmap_sem); + ret = get_user_pages_remote(NULL, mm, vaddr, 1, flags, page, + vmas, NULL); + /* +@@ -364,8 +362,8 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + ret = -EOPNOTSUPP; + put_page(page[0]); + } +- up_read(&mm->mmap_sem); + } ++ up_read(&mm->mmap_sem); + + if (ret == 1) { + *pfn = page_to_pfn(page[0]); +diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h +index 33d6eb58ce34..f29cdb1cdeb7 100644 +--- a/fs/cifs/cifsglob.h ++++ b/fs/cifs/cifsglob.h +@@ -1340,6 +1340,7 @@ typedef int (mid_handle_t)(struct TCP_Server_Info *server, + /* one of these for every pending CIFS request to the server */ + struct mid_q_entry { + struct list_head qhead; /* mids waiting on reply from this server */ ++ struct kref refcount; + struct TCP_Server_Info *server; /* server corresponding to this mid */ + __u64 mid; /* multiplex id */ + __u32 pid; /* process id */ +diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h +index 762d513a5087..ccdb42f71b2e 100644 +--- a/fs/cifs/cifsproto.h ++++ b/fs/cifs/cifsproto.h +@@ -76,6 +76,7 @@ extern struct mid_q_entry *AllocMidQEntry(const struct smb_hdr *smb_buffer, + struct TCP_Server_Info *server); + extern void DeleteMidQEntry(struct mid_q_entry *midEntry); + extern void cifs_delete_mid(struct mid_q_entry *mid); ++extern void cifs_mid_q_entry_release(struct mid_q_entry *midEntry); + extern void cifs_wake_up_task(struct mid_q_entry *mid); + extern int cifs_handle_standard(struct TCP_Server_Info *server, + struct mid_q_entry *mid); +diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c +index 7fd39ea6e22e..b5a436583469 100644 +--- a/fs/cifs/cifssmb.c ++++ b/fs/cifs/cifssmb.c +@@ -150,8 +150,14 @@ cifs_reconnect_tcon(struct cifs_tcon *tcon, int smb_command) + * greater than cifs socket timeout which is 7 seconds + */ + while (server->tcpStatus == CifsNeedReconnect) { +- wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), 10 * HZ); ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ 10 * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to a received" ++ " signal by the process\n", __func__); ++ return -ERESTARTSYS; ++ } + + /* are we still trying to reconnect? */ + if (server->tcpStatus != CifsNeedReconnect) +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index f7db2fedfa8c..fd24c72bd2cd 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -889,6 +889,7 @@ cifs_demultiplex_thread(void *p) + continue; + server->total_read += length; + ++ mid_entry = NULL; + if (server->ops->is_transform_hdr && + server->ops->receive_transform && + server->ops->is_transform_hdr(buf)) { +@@ -903,8 +904,11 @@ cifs_demultiplex_thread(void *p) + length = mid_entry->receive(server, mid_entry); + } + +- if (length < 0) ++ if (length < 0) { ++ if (mid_entry) ++ cifs_mid_q_entry_release(mid_entry); + continue; ++ } + + if (server->large_buf) + buf = server->bigbuf; +@@ -920,6 +924,8 @@ cifs_demultiplex_thread(void *p) + + if (!mid_entry->multiRsp || mid_entry->multiEnd) + mid_entry->callback(mid_entry); ++ ++ cifs_mid_q_entry_release(mid_entry); + } else if (server->ops->is_oplock_break && + server->ops->is_oplock_break(buf, server)) { + cifs_dbg(FYI, "Received oplock break\n"); +diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c +index a723df3e0197..d8cd82001c1c 100644 +--- a/fs/cifs/smb1ops.c ++++ b/fs/cifs/smb1ops.c +@@ -105,6 +105,7 @@ cifs_find_mid(struct TCP_Server_Info *server, char *buffer) + if (compare_mid(mid->mid, buf) && + mid->mid_state == MID_REQUEST_SUBMITTED && + le16_to_cpu(mid->command) == buf->Command) { ++ kref_get(&mid->refcount); + spin_unlock(&GlobalMid_Lock); + return mid; + } +diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c +index 36bc9a7eb8ea..83267ac3a3f0 100644 +--- a/fs/cifs/smb2ops.c ++++ b/fs/cifs/smb2ops.c +@@ -202,6 +202,7 @@ smb2_find_mid(struct TCP_Server_Info *server, char *buf) + if ((mid->mid == wire_mid) && + (mid->mid_state == MID_REQUEST_SUBMITTED) && + (mid->command == shdr->Command)) { ++ kref_get(&mid->refcount); + spin_unlock(&GlobalMid_Lock); + return mid; + } +@@ -635,6 +636,8 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon, + + rc = SMB2_set_ea(xid, tcon, fid.persistent_fid, fid.volatile_fid, ea, + len); ++ kfree(ea); ++ + SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid); + + return rc; +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 5247b40e57f6..0480cd9a9e81 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -153,7 +153,7 @@ smb2_hdr_assemble(struct smb2_sync_hdr *shdr, __le16 smb2_cmd, + static int + smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + { +- int rc = 0; ++ int rc; + struct nls_table *nls_codepage; + struct cifs_ses *ses; + struct TCP_Server_Info *server; +@@ -164,10 +164,10 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + * for those three - in the calling routine. + */ + if (tcon == NULL) +- return rc; ++ return 0; + + if (smb2_command == SMB2_TREE_CONNECT) +- return rc; ++ return 0; + + if (tcon->tidStatus == CifsExiting) { + /* +@@ -210,8 +210,14 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + return -EAGAIN; + } + +- wait_event_interruptible_timeout(server->response_q, +- (server->tcpStatus != CifsNeedReconnect), 10 * HZ); ++ rc = wait_event_interruptible_timeout(server->response_q, ++ (server->tcpStatus != CifsNeedReconnect), ++ 10 * HZ); ++ if (rc < 0) { ++ cifs_dbg(FYI, "%s: aborting reconnect due to a received" ++ " signal by the process\n", __func__); ++ return -ERESTARTSYS; ++ } + + /* are we still trying to reconnect? */ + if (server->tcpStatus != CifsNeedReconnect) +@@ -229,7 +235,7 @@ smb2_reconnect(__le16 smb2_command, struct cifs_tcon *tcon) + } + + if (!tcon->ses->need_reconnect && !tcon->need_reconnect) +- return rc; ++ return 0; + + nls_codepage = load_nls_default(); + +@@ -332,7 +338,10 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + return rc; + + /* BB eventually switch this to SMB2 specific small buf size */ +- *request_buf = cifs_small_buf_get(); ++ if (smb2_command == SMB2_SET_INFO) ++ *request_buf = cifs_buf_get(); ++ else ++ *request_buf = cifs_small_buf_get(); + if (*request_buf == NULL) { + /* BB should we add a retry in here if not a writepage? */ + return -ENOMEM; +@@ -3162,7 +3171,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon, + } + + rc = SendReceive2(xid, ses, iov, num, &resp_buftype, flags, &rsp_iov); +- cifs_small_buf_release(req); ++ cifs_buf_release(req); + rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; + + if (rc != 0) +diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c +index bf49cb73b9e6..a41fc4a63a59 100644 +--- a/fs/cifs/smb2transport.c ++++ b/fs/cifs/smb2transport.c +@@ -548,6 +548,7 @@ smb2_mid_entry_alloc(const struct smb2_sync_hdr *shdr, + + temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); + memset(temp, 0, sizeof(struct mid_q_entry)); ++ kref_init(&temp->refcount); + temp->mid = le64_to_cpu(shdr->MessageId); + temp->pid = current->pid; + temp->command = shdr->Command; /* Always LE */ +diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c +index 7efbab013957..a10f51dfa7f5 100644 +--- a/fs/cifs/transport.c ++++ b/fs/cifs/transport.c +@@ -56,6 +56,7 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) + + temp = mempool_alloc(cifs_mid_poolp, GFP_NOFS); + memset(temp, 0, sizeof(struct mid_q_entry)); ++ kref_init(&temp->refcount); + temp->mid = get_mid(smb_buffer); + temp->pid = current->pid; + temp->command = cpu_to_le16(smb_buffer->Command); +@@ -77,6 +78,21 @@ AllocMidQEntry(const struct smb_hdr *smb_buffer, struct TCP_Server_Info *server) + return temp; + } + ++static void _cifs_mid_q_entry_release(struct kref *refcount) ++{ ++ struct mid_q_entry *mid = container_of(refcount, struct mid_q_entry, ++ refcount); ++ ++ mempool_free(mid, cifs_mid_poolp); ++} ++ ++void cifs_mid_q_entry_release(struct mid_q_entry *midEntry) ++{ ++ spin_lock(&GlobalMid_Lock); ++ kref_put(&midEntry->refcount, _cifs_mid_q_entry_release); ++ spin_unlock(&GlobalMid_Lock); ++} ++ + void + DeleteMidQEntry(struct mid_q_entry *midEntry) + { +@@ -105,7 +121,7 @@ DeleteMidQEntry(struct mid_q_entry *midEntry) + } + } + #endif +- mempool_free(midEntry, cifs_mid_poolp); ++ cifs_mid_q_entry_release(midEntry); + } + + void +diff --git a/fs/ext2/super.c b/fs/ext2/super.c +index 1458706bd2ec..726e680a3368 100644 +--- a/fs/ext2/super.c ++++ b/fs/ext2/super.c +@@ -953,8 +953,7 @@ static int ext2_fill_super(struct super_block *sb, void *data, int silent) + blocksize = BLOCK_SIZE << le32_to_cpu(sbi->s_es->s_log_block_size); + + if (sbi->s_mount_opt & EXT2_MOUNT_DAX) { +- err = bdev_dax_supported(sb, blocksize); +- if (err) ++ if (!bdev_dax_supported(sb->s_bdev, blocksize)) + goto failed_mount; + } + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index 58db8109defa..9c9eafd6bd76 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -184,7 +184,6 @@ static int ext4_init_block_bitmap(struct super_block *sb, + unsigned int bit, bit_max; + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_fsblk_t start, tmp; +- int flex_bg = 0; + struct ext4_group_info *grp; + + J_ASSERT_BH(bh, buffer_locked(bh)); +@@ -217,22 +216,19 @@ static int ext4_init_block_bitmap(struct super_block *sb, + + start = ext4_group_first_block_no(sb, block_group); + +- if (ext4_has_feature_flex_bg(sb)) +- flex_bg = 1; +- + /* Set bits for block and inode bitmaps, and inode table */ + tmp = ext4_block_bitmap(sb, gdp); +- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) ++ if (ext4_block_in_group(sb, tmp, block_group)) + ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); + + tmp = ext4_inode_bitmap(sb, gdp); +- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) ++ if (ext4_block_in_group(sb, tmp, block_group)) + ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); + + tmp = ext4_inode_table(sb, gdp); + for (; tmp < ext4_inode_table(sb, gdp) + + sbi->s_itb_per_group; tmp++) { +- if (!flex_bg || ext4_block_in_group(sb, tmp, block_group)) ++ if (ext4_block_in_group(sb, tmp, block_group)) + ext4_set_bit(EXT4_B2C(sbi, tmp - start), bh->b_data); + } + +@@ -455,7 +451,16 @@ ext4_read_block_bitmap_nowait(struct super_block *sb, ext4_group_t block_group) + goto verify; + } + ext4_lock_group(sb, block_group); +- if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { ++ if (ext4_has_group_desc_csum(sb) && ++ (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { ++ if (block_group == 0) { ++ ext4_unlock_group(sb, block_group); ++ unlock_buffer(bh); ++ ext4_error(sb, "Block bitmap for bg 0 marked " ++ "uninitialized"); ++ err = -EFSCORRUPTED; ++ goto out; ++ } + err = ext4_init_block_bitmap(sb, bh, block_group, desc); + set_bitmap_uptodate(bh); + set_buffer_uptodate(bh); +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 58a0304566db..0abb30d19fa1 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -1542,11 +1542,6 @@ static inline struct ext4_inode_info *EXT4_I(struct inode *inode) + static inline int ext4_valid_inum(struct super_block *sb, unsigned long ino) + { + return ino == EXT4_ROOT_INO || +- ino == EXT4_USR_QUOTA_INO || +- ino == EXT4_GRP_QUOTA_INO || +- ino == EXT4_BOOT_LOADER_INO || +- ino == EXT4_JOURNAL_INO || +- ino == EXT4_RESIZE_INO || + (ino >= EXT4_FIRST_INO(sb) && + ino <= le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)); + } +@@ -3049,9 +3044,6 @@ extern struct buffer_head *ext4_get_first_inline_block(struct inode *inode, + extern int ext4_inline_data_fiemap(struct inode *inode, + struct fiemap_extent_info *fieinfo, + int *has_inline, __u64 start, __u64 len); +-extern int ext4_try_to_evict_inline_data(handle_t *handle, +- struct inode *inode, +- int needed); + extern int ext4_inline_data_truncate(struct inode *inode, int *has_inline); + + extern int ext4_convert_inline_data(struct inode *inode); +diff --git a/fs/ext4/ext4_extents.h b/fs/ext4/ext4_extents.h +index 8ecf84b8f5a1..a284fb28944b 100644 +--- a/fs/ext4/ext4_extents.h ++++ b/fs/ext4/ext4_extents.h +@@ -103,6 +103,7 @@ struct ext4_extent_header { + }; + + #define EXT4_EXT_MAGIC cpu_to_le16(0xf30a) ++#define EXT4_MAX_EXTENT_DEPTH 5 + + #define EXT4_EXTENT_TAIL_OFFSET(hdr) \ + (sizeof(struct ext4_extent_header) + \ +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 883e89a903d1..5592b7726241 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -881,6 +881,12 @@ ext4_find_extent(struct inode *inode, ext4_lblk_t block, + + eh = ext_inode_hdr(inode); + depth = ext_depth(inode); ++ if (depth < 0 || depth > EXT4_MAX_EXTENT_DEPTH) { ++ EXT4_ERROR_INODE(inode, "inode has invalid extent depth: %d", ++ depth); ++ ret = -EFSCORRUPTED; ++ goto err; ++ } + + if (path) { + ext4_ext_drop_refs(path); +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index f420124ac035..95341bc2b3b7 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -155,7 +155,16 @@ ext4_read_inode_bitmap(struct super_block *sb, ext4_group_t block_group) + } + + ext4_lock_group(sb, block_group); +- if (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT)) { ++ if (ext4_has_group_desc_csum(sb) && ++ (desc->bg_flags & cpu_to_le16(EXT4_BG_INODE_UNINIT))) { ++ if (block_group == 0) { ++ ext4_unlock_group(sb, block_group); ++ unlock_buffer(bh); ++ ext4_error(sb, "Inode bitmap for bg 0 marked " ++ "uninitialized"); ++ err = -EFSCORRUPTED; ++ goto out; ++ } + memset(bh->b_data, 0, (EXT4_INODES_PER_GROUP(sb) + 7) / 8); + ext4_mark_bitmap_end(EXT4_INODES_PER_GROUP(sb), + sb->s_blocksize * 8, bh->b_data); +@@ -1000,7 +1009,8 @@ struct inode *__ext4_new_inode(handle_t *handle, struct inode *dir, + + /* recheck and clear flag under lock if we still need to */ + ext4_lock_group(sb, group); +- if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { ++ if (ext4_has_group_desc_csum(sb) && ++ (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { + gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); + ext4_free_group_clusters_set(sb, gdp, + ext4_free_clusters_after_init(sb, group, gdp)); +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 8f5dc243effd..7d498f4a3f90 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -443,6 +443,7 @@ static int ext4_destroy_inline_data_nolock(handle_t *handle, + + memset((void *)ext4_raw_inode(&is.iloc)->i_block, + 0, EXT4_MIN_INLINE_DATA_SIZE); ++ memset(ei->i_data, 0, EXT4_MIN_INLINE_DATA_SIZE); + + if (ext4_has_feature_extents(inode->i_sb)) { + if (S_ISDIR(inode->i_mode) || +@@ -892,11 +893,11 @@ int ext4_da_write_inline_data_begin(struct address_space *mapping, + flags |= AOP_FLAG_NOFS; + + if (ret == -ENOSPC) { ++ ext4_journal_stop(handle); + ret = ext4_da_convert_inline_data_to_extent(mapping, + inode, + flags, + fsdata); +- ext4_journal_stop(handle); + if (ret == -ENOSPC && + ext4_should_retry_alloc(inode->i_sb, &retries)) + goto retry_journal; +@@ -1864,42 +1865,6 @@ int ext4_inline_data_fiemap(struct inode *inode, + return (error < 0 ? error : 0); + } + +-/* +- * Called during xattr set, and if we can sparse space 'needed', +- * just create the extent tree evict the data to the outer block. +- * +- * We use jbd2 instead of page cache to move data to the 1st block +- * so that the whole transaction can be committed as a whole and +- * the data isn't lost because of the delayed page cache write. +- */ +-int ext4_try_to_evict_inline_data(handle_t *handle, +- struct inode *inode, +- int needed) +-{ +- int error; +- struct ext4_xattr_entry *entry; +- struct ext4_inode *raw_inode; +- struct ext4_iloc iloc; +- +- error = ext4_get_inode_loc(inode, &iloc); +- if (error) +- return error; +- +- raw_inode = ext4_raw_inode(&iloc); +- entry = (struct ext4_xattr_entry *)((void *)raw_inode + +- EXT4_I(inode)->i_inline_off); +- if (EXT4_XATTR_LEN(entry->e_name_len) + +- EXT4_XATTR_SIZE(le32_to_cpu(entry->e_value_size)) < needed) { +- error = -ENOSPC; +- goto out; +- } +- +- error = ext4_convert_inline_data_nolock(handle, inode, &iloc); +-out: +- brelse(iloc.bh); +- return error; +-} +- + int ext4_inline_data_truncate(struct inode *inode, int *has_inline) + { + handle_t *handle; +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index bd6453e78992..c2efe4d2ad87 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -401,9 +401,9 @@ static int __check_block_validity(struct inode *inode, const char *func, + if (!ext4_data_block_valid(EXT4_SB(inode->i_sb), map->m_pblk, + map->m_len)) { + ext4_error_inode(inode, func, line, map->m_pblk, +- "lblock %lu mapped to illegal pblock " ++ "lblock %lu mapped to illegal pblock %llu " + "(length %d)", (unsigned long) map->m_lblk, +- map->m_len); ++ map->m_pblk, map->m_len); + return -EFSCORRUPTED; + } + return 0; +@@ -4455,7 +4455,8 @@ static int __ext4_get_inode_loc(struct inode *inode, + int inodes_per_block, inode_offset; + + iloc->bh = NULL; +- if (!ext4_valid_inum(sb, inode->i_ino)) ++ if (inode->i_ino < EXT4_ROOT_INO || ++ inode->i_ino > le32_to_cpu(EXT4_SB(sb)->s_es->s_inodes_count)) + return -EFSCORRUPTED; + + iloc->block_group = (inode->i_ino - 1) / EXT4_INODES_PER_GROUP(sb); +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index 701085620cd8..048c586d9a8b 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -2456,7 +2456,8 @@ int ext4_mb_add_groupinfo(struct super_block *sb, ext4_group_t group, + * initialize bb_free to be able to skip + * empty groups without initialization + */ +- if (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { ++ if (ext4_has_group_desc_csum(sb) && ++ (desc->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { + meta_group_info[i]->bb_free = + ext4_free_clusters_after_init(sb, group, desc); + } else { +@@ -3023,7 +3024,8 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac, + #endif + ext4_set_bits(bitmap_bh->b_data, ac->ac_b_ex.fe_start, + ac->ac_b_ex.fe_len); +- if (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT)) { ++ if (ext4_has_group_desc_csum(sb) && ++ (gdp->bg_flags & cpu_to_le16(EXT4_BG_BLOCK_UNINIT))) { + gdp->bg_flags &= cpu_to_le16(~EXT4_BG_BLOCK_UNINIT); + ext4_free_group_clusters_set(sb, gdp, + ext4_free_clusters_after_init(sb, +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index ec74d06fa24a..fc32a67a7a19 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2301,6 +2301,7 @@ static int ext4_check_descriptors(struct super_block *sb, + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block); + ext4_fsblk_t last_block; ++ ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1; + ext4_fsblk_t block_bitmap; + ext4_fsblk_t inode_bitmap; + ext4_fsblk_t inode_table; +@@ -2333,6 +2334,14 @@ static int ext4_check_descriptors(struct super_block *sb, + if (!sb_rdonly(sb)) + return 0; + } ++ if (block_bitmap >= sb_block + 1 && ++ block_bitmap <= last_bg_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Block bitmap for group %u overlaps " ++ "block group descriptors", i); ++ if (!sb_rdonly(sb)) ++ return 0; ++ } + if (block_bitmap < first_block || block_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Block bitmap for group %u not in group " +@@ -2347,6 +2356,14 @@ static int ext4_check_descriptors(struct super_block *sb, + if (!sb_rdonly(sb)) + return 0; + } ++ if (inode_bitmap >= sb_block + 1 && ++ inode_bitmap <= last_bg_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode bitmap for group %u overlaps " ++ "block group descriptors", i); ++ if (!sb_rdonly(sb)) ++ return 0; ++ } + if (inode_bitmap < first_block || inode_bitmap > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " + "Inode bitmap for group %u not in group " +@@ -2361,6 +2378,14 @@ static int ext4_check_descriptors(struct super_block *sb, + if (!sb_rdonly(sb)) + return 0; + } ++ if (inode_table >= sb_block + 1 && ++ inode_table <= last_bg_block) { ++ ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " ++ "Inode table for group %u overlaps " ++ "block group descriptors", i); ++ if (!sb_rdonly(sb)) ++ return 0; ++ } + if (inode_table < first_block || + inode_table + sbi->s_itb_per_group - 1 > last_block) { + ext4_msg(sb, KERN_ERR, "ext4_check_descriptors: " +@@ -3070,13 +3095,22 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb) + ext4_group_t group, ngroups = EXT4_SB(sb)->s_groups_count; + struct ext4_group_desc *gdp = NULL; + ++ if (!ext4_has_group_desc_csum(sb)) ++ return ngroups; ++ + for (group = 0; group < ngroups; group++) { + gdp = ext4_get_group_desc(sb, group, NULL); + if (!gdp) + continue; + +- if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))) ++ if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)) ++ continue; ++ if (group != 0) + break; ++ ext4_error(sb, "Inode table for bg 0 marked as " ++ "needing zeroing"); ++ if (sb_rdonly(sb)) ++ return ngroups; + } + + return group; +@@ -3715,6 +3749,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + le32_to_cpu(es->s_log_block_size)); + goto failed_mount; + } ++ if (le32_to_cpu(es->s_log_cluster_size) > ++ (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { ++ ext4_msg(sb, KERN_ERR, ++ "Invalid log cluster size: %u", ++ le32_to_cpu(es->s_log_cluster_size)); ++ goto failed_mount; ++ } + + if (le16_to_cpu(sbi->s_es->s_reserved_gdt_blocks) > (blocksize / 4)) { + ext4_msg(sb, KERN_ERR, +@@ -3729,8 +3770,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + " that may contain inline data"); + goto failed_mount; + } +- err = bdev_dax_supported(sb, blocksize); +- if (err) ++ if (!bdev_dax_supported(sb->s_bdev, blocksize)) + goto failed_mount; + } + +@@ -3777,6 +3817,11 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } else { + sbi->s_inode_size = le16_to_cpu(es->s_inode_size); + sbi->s_first_ino = le32_to_cpu(es->s_first_ino); ++ if (sbi->s_first_ino < EXT4_GOOD_OLD_FIRST_INO) { ++ ext4_msg(sb, KERN_ERR, "invalid first ino: %u", ++ sbi->s_first_ino); ++ goto failed_mount; ++ } + if ((sbi->s_inode_size < EXT4_GOOD_OLD_INODE_SIZE) || + (!is_power_of_2(sbi->s_inode_size)) || + (sbi->s_inode_size > blocksize)) { +@@ -3853,13 +3898,6 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + "block size (%d)", clustersize, blocksize); + goto failed_mount; + } +- if (le32_to_cpu(es->s_log_cluster_size) > +- (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) { +- ext4_msg(sb, KERN_ERR, +- "Invalid log cluster size: %u", +- le32_to_cpu(es->s_log_cluster_size)); +- goto failed_mount; +- } + sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) - + le32_to_cpu(es->s_log_block_size); + sbi->s_clusters_per_group = +@@ -3880,10 +3918,10 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + } + } else { + if (clustersize != blocksize) { +- ext4_warning(sb, "fragment/cluster size (%d) != " +- "block size (%d)", clustersize, +- blocksize); +- clustersize = blocksize; ++ ext4_msg(sb, KERN_ERR, ++ "fragment/cluster size (%d) != " ++ "block size (%d)", clustersize, blocksize); ++ goto failed_mount; + } + if (sbi->s_blocks_per_group > blocksize * 8) { + ext4_msg(sb, KERN_ERR, +@@ -3937,6 +3975,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ext4_blocks_count(es)); + goto failed_mount; + } ++ if ((es->s_first_data_block == 0) && (es->s_log_block_size == 0) && ++ (sbi->s_cluster_ratio == 1)) { ++ ext4_msg(sb, KERN_WARNING, "bad geometry: first data " ++ "block is 0 with a 1k block and cluster size"); ++ goto failed_mount; ++ } ++ + blocks_count = (ext4_blocks_count(es) - + le32_to_cpu(es->s_first_data_block) + + EXT4_BLOCKS_PER_GROUP(sb) - 1); +@@ -3972,6 +4017,14 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + ret = -ENOMEM; + goto failed_mount; + } ++ if (((u64)sbi->s_groups_count * sbi->s_inodes_per_group) != ++ le32_to_cpu(es->s_inodes_count)) { ++ ext4_msg(sb, KERN_ERR, "inodes count not valid: %u vs %llu", ++ le32_to_cpu(es->s_inodes_count), ++ ((u64)sbi->s_groups_count * sbi->s_inodes_per_group)); ++ ret = -EINVAL; ++ goto failed_mount; ++ } + + bgl_lock_init(sbi->s_blockgroup_lock); + +@@ -4700,6 +4753,14 @@ static int ext4_commit_super(struct super_block *sb, int sync) + + if (!sbh || block_device_ejected(sb)) + return error; ++ ++ /* ++ * The superblock bh should be mapped, but it might not be if the ++ * device was hot-removed. Not much we can do but fail the I/O. ++ */ ++ if (!buffer_mapped(sbh)) ++ return error; ++ + /* + * If the file system is mounted read-only, don't update the + * superblock write time. This avoids updating the superblock +diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c +index ed1cf24a7831..c7c8c16ccd93 100644 +--- a/fs/ext4/xattr.c ++++ b/fs/ext4/xattr.c +@@ -229,12 +229,12 @@ __ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh, + { + int error = -EFSCORRUPTED; + +- if (buffer_verified(bh)) +- return 0; +- + if (BHDR(bh)->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC) || + BHDR(bh)->h_blocks != cpu_to_le32(1)) + goto errout; ++ if (buffer_verified(bh)) ++ return 0; ++ + error = -EFSBADCRC; + if (!ext4_xattr_block_csum_verify(inode, bh)) + goto errout; +@@ -1559,7 +1559,7 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, + handle_t *handle, struct inode *inode, + bool is_block) + { +- struct ext4_xattr_entry *last; ++ struct ext4_xattr_entry *last, *next; + struct ext4_xattr_entry *here = s->here; + size_t min_offs = s->end - s->base, name_len = strlen(i->name); + int in_inode = i->in_inode; +@@ -1594,7 +1594,13 @@ static int ext4_xattr_set_entry(struct ext4_xattr_info *i, + + /* Compute min_offs and last. */ + last = s->first; +- for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { ++ for (; !IS_LAST_ENTRY(last); last = next) { ++ next = EXT4_XATTR_NEXT(last); ++ if ((void *)next >= s->end) { ++ EXT4_ERROR_INODE(inode, "corrupted xattr entries"); ++ ret = -EFSCORRUPTED; ++ goto out; ++ } + if (!last->e_value_inum && last->e_value_size) { + size_t offs = le16_to_cpu(last->e_value_offs); + if (offs < min_offs) +@@ -2205,23 +2211,8 @@ int ext4_xattr_ibody_inline_set(handle_t *handle, struct inode *inode, + if (EXT4_I(inode)->i_extra_isize == 0) + return -ENOSPC; + error = ext4_xattr_set_entry(i, s, handle, inode, false /* is_block */); +- if (error) { +- if (error == -ENOSPC && +- ext4_has_inline_data(inode)) { +- error = ext4_try_to_evict_inline_data(handle, inode, +- EXT4_XATTR_LEN(strlen(i->name) + +- EXT4_XATTR_SIZE(i->value_len))); +- if (error) +- return error; +- error = ext4_xattr_ibody_find(inode, i, is); +- if (error) +- return error; +- error = ext4_xattr_set_entry(i, s, handle, inode, +- false /* is_block */); +- } +- if (error) +- return error; +- } ++ if (error) ++ return error; + header = IHDR(inode, ext4_raw_inode(&is->iloc)); + if (!IS_LAST_ENTRY(s->first)) { + header->h_magic = cpu_to_le32(EXT4_XATTR_MAGIC); +@@ -2650,6 +2641,11 @@ static int ext4_xattr_make_inode_space(handle_t *handle, struct inode *inode, + last = IFIRST(header); + /* Find the entry best suited to be pushed into EA block */ + for (; !IS_LAST_ENTRY(last); last = EXT4_XATTR_NEXT(last)) { ++ /* never move system.data out of the inode */ ++ if ((last->e_name_len == 4) && ++ (last->e_name_index == EXT4_XATTR_INDEX_SYSTEM) && ++ !memcmp(last->e_name, "data", 4)) ++ continue; + total_size = EXT4_XATTR_LEN(last->e_name_len); + if (!last->e_value_inum) + total_size += EXT4_XATTR_SIZE( +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 29c5f799890c..72c6a9e9a9b4 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -2694,11 +2694,16 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + inode_lock(inode); + ret = generic_write_checks(iocb, from); + if (ret > 0) { ++ bool preallocated = false; ++ size_t target_size = 0; + int err; + + if (iov_iter_fault_in_readable(from, iov_iter_count(from))) + set_inode_flag(inode, FI_NO_PREALLOC); + ++ preallocated = true; ++ target_size = iocb->ki_pos + iov_iter_count(from); ++ + err = f2fs_preallocate_blocks(iocb, from); + if (err) { + clear_inode_flag(inode, FI_NO_PREALLOC); +@@ -2710,6 +2715,10 @@ static ssize_t f2fs_file_write_iter(struct kiocb *iocb, struct iov_iter *from) + blk_finish_plug(&plug); + clear_inode_flag(inode, FI_NO_PREALLOC); + ++ /* if we couldn't write data, we should deallocate blocks. */ ++ if (preallocated && i_size_read(inode) < target_size) ++ f2fs_truncate(inode); ++ + if (ret > 0) + f2fs_update_iostat(F2FS_I_SB(inode), APP_WRITE_IO, ret); + } +diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c +index 07793e25c976..e42736c1fdc8 100644 +--- a/fs/jbd2/transaction.c ++++ b/fs/jbd2/transaction.c +@@ -1366,6 +1366,13 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + if (jh->b_transaction == transaction && + jh->b_jlist != BJ_Metadata) { + jbd_lock_bh_state(bh); ++ if (jh->b_transaction == transaction && ++ jh->b_jlist != BJ_Metadata) ++ pr_err("JBD2: assertion failure: h_type=%u " ++ "h_line_no=%u block_no=%llu jlist=%u\n", ++ handle->h_type, handle->h_line_no, ++ (unsigned long long) bh->b_blocknr, ++ jh->b_jlist); + J_ASSERT_JH(jh, jh->b_transaction != transaction || + jh->b_jlist == BJ_Metadata); + jbd_unlock_bh_state(bh); +@@ -1385,11 +1392,11 @@ int jbd2_journal_dirty_metadata(handle_t *handle, struct buffer_head *bh) + * of the transaction. This needs to be done + * once a transaction -bzzz + */ +- jh->b_modified = 1; + if (handle->h_buffer_credits <= 0) { + ret = -ENOSPC; + goto out_unlock_bh; + } ++ jh->b_modified = 1; + handle->h_buffer_credits--; + } + +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index 5aa392eae1c3..f6ed92524a03 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -220,24 +220,26 @@ static inline bool userfaultfd_huge_must_wait(struct userfaultfd_ctx *ctx, + unsigned long reason) + { + struct mm_struct *mm = ctx->mm; +- pte_t *pte; ++ pte_t *ptep, pte; + bool ret = true; + + VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem)); + +- pte = huge_pte_offset(mm, address, vma_mmu_pagesize(vma)); +- if (!pte) ++ ptep = huge_pte_offset(mm, address, vma_mmu_pagesize(vma)); ++ ++ if (!ptep) + goto out; + + ret = false; ++ pte = huge_ptep_get(ptep); + + /* + * Lockless access: we're in a wait_event so it's ok if it + * changes under us. + */ +- if (huge_pte_none(*pte)) ++ if (huge_pte_none(pte)) + ret = true; +- if (!huge_pte_write(*pte) && (reason & VM_UFFD_WP)) ++ if (!huge_pte_write(pte) && (reason & VM_UFFD_WP)) + ret = true; + out: + return ret; +diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c +index aa75389be8cf..79a9a0def7db 100644 +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -1101,7 +1101,8 @@ xfs_ioctl_setattr_dax_invalidate( + if (fa->fsx_xflags & FS_XFLAG_DAX) { + if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))) + return -EINVAL; +- if (bdev_dax_supported(sb, sb->s_blocksize) < 0) ++ if (!bdev_dax_supported(xfs_find_bdev_for_inode(VFS_I(ip)), ++ sb->s_blocksize)) + return -EINVAL; + } + +diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c +index f24e5b6cfc86..1daa965f1e08 100644 +--- a/fs/xfs/xfs_iops.c ++++ b/fs/xfs/xfs_iops.c +@@ -1184,6 +1184,30 @@ static const struct inode_operations xfs_inline_symlink_inode_operations = { + .update_time = xfs_vn_update_time, + }; + ++/* Figure out if this file actually supports DAX. */ ++static bool ++xfs_inode_supports_dax( ++ struct xfs_inode *ip) ++{ ++ struct xfs_mount *mp = ip->i_mount; ++ ++ /* Only supported on non-reflinked files. */ ++ if (!S_ISREG(VFS_I(ip)->i_mode) || xfs_is_reflink_inode(ip)) ++ return false; ++ ++ /* DAX mount option or DAX iflag must be set. */ ++ if (!(mp->m_flags & XFS_MOUNT_DAX) && ++ !(ip->i_d.di_flags2 & XFS_DIFLAG2_DAX)) ++ return false; ++ ++ /* Block size must match page size */ ++ if (mp->m_sb.sb_blocksize != PAGE_SIZE) ++ return false; ++ ++ /* Device has to support DAX too. */ ++ return xfs_find_daxdev_for_inode(VFS_I(ip)) != NULL; ++} ++ + STATIC void + xfs_diflags_to_iflags( + struct inode *inode, +@@ -1202,11 +1226,7 @@ xfs_diflags_to_iflags( + inode->i_flags |= S_SYNC; + if (flags & XFS_DIFLAG_NOATIME) + inode->i_flags |= S_NOATIME; +- if (S_ISREG(inode->i_mode) && +- ip->i_mount->m_sb.sb_blocksize == PAGE_SIZE && +- !xfs_is_reflink_inode(ip) && +- (ip->i_mount->m_flags & XFS_MOUNT_DAX || +- ip->i_d.di_flags2 & XFS_DIFLAG2_DAX)) ++ if (xfs_inode_supports_dax(ip)) + inode->i_flags |= S_DAX; + } + +diff --git a/fs/xfs/xfs_super.c b/fs/xfs/xfs_super.c +index f663022353c0..0b0282d2f011 100644 +--- a/fs/xfs/xfs_super.c ++++ b/fs/xfs/xfs_super.c +@@ -1640,11 +1640,17 @@ xfs_fs_fill_super( + sb->s_flags |= SB_I_VERSION; + + if (mp->m_flags & XFS_MOUNT_DAX) { ++ bool rtdev_is_dax = false, datadev_is_dax; ++ + xfs_warn(mp, + "DAX enabled. Warning: EXPERIMENTAL, use at your own risk"); + +- error = bdev_dax_supported(sb, sb->s_blocksize); +- if (error) { ++ datadev_is_dax = bdev_dax_supported(mp->m_ddev_targp->bt_bdev, ++ sb->s_blocksize); ++ if (mp->m_rtdev_targp) ++ rtdev_is_dax = bdev_dax_supported( ++ mp->m_rtdev_targp->bt_bdev, sb->s_blocksize); ++ if (!rtdev_is_dax && !datadev_is_dax) { + xfs_alert(mp, + "DAX unsupported by block device. Turning off DAX."); + mp->m_flags &= ~XFS_MOUNT_DAX; +diff --git a/include/linux/dax.h b/include/linux/dax.h +index 895e16fcc62d..07d6bc1f90a3 100644 +--- a/include/linux/dax.h ++++ b/include/linux/dax.h +@@ -40,10 +40,10 @@ static inline void put_dax(struct dax_device *dax_dev) + + int bdev_dax_pgoff(struct block_device *, sector_t, size_t, pgoff_t *pgoff); + #if IS_ENABLED(CONFIG_FS_DAX) +-int __bdev_dax_supported(struct super_block *sb, int blocksize); +-static inline int bdev_dax_supported(struct super_block *sb, int blocksize) ++bool __bdev_dax_supported(struct block_device *bdev, int blocksize); ++static inline bool bdev_dax_supported(struct block_device *bdev, int blocksize) + { +- return __bdev_dax_supported(sb, blocksize); ++ return __bdev_dax_supported(bdev, blocksize); + } + + static inline struct dax_device *fs_dax_get_by_host(const char *host) +@@ -58,9 +58,10 @@ static inline void fs_put_dax(struct dax_device *dax_dev) + + struct dax_device *fs_dax_get_by_bdev(struct block_device *bdev); + #else +-static inline int bdev_dax_supported(struct super_block *sb, int blocksize) ++static inline bool bdev_dax_supported(struct block_device *bdev, ++ int blocksize) + { +- return -EOPNOTSUPP; ++ return false; + } + + static inline struct dax_device *fs_dax_get_by_host(const char *host) +diff --git a/include/linux/mm.h b/include/linux/mm.h +index f23215854c80..a26cf767407e 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2549,6 +2549,7 @@ enum mf_action_page_type { + MF_MSG_POISONED_HUGE, + MF_MSG_HUGE, + MF_MSG_FREE_HUGE, ++ MF_MSG_NON_PMD_HUGE, + MF_MSG_UNMAP_FAILED, + MF_MSG_DIRTY_SWAPCACHE, + MF_MSG_CLEAN_SWAPCACHE, +diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h +index da10aa21bebc..d447f24df970 100644 +--- a/include/trace/events/sched.h ++++ b/include/trace/events/sched.h +@@ -435,7 +435,9 @@ TRACE_EVENT(sched_pi_setprio, + memcpy(__entry->comm, tsk->comm, TASK_COMM_LEN); + __entry->pid = tsk->pid; + __entry->oldprio = tsk->prio; +- __entry->newprio = pi_task ? pi_task->prio : tsk->prio; ++ __entry->newprio = pi_task ? ++ min(tsk->normal_prio, pi_task->prio) : ++ tsk->normal_prio; + /* XXX SCHED_DEADLINE bits missing */ + ), + +diff --git a/kernel/irq/irqdesc.c b/kernel/irq/irqdesc.c +index 82afb7ed369f..e97bbae947f0 100644 +--- a/kernel/irq/irqdesc.c ++++ b/kernel/irq/irqdesc.c +@@ -27,7 +27,7 @@ static struct lock_class_key irq_desc_lock_class; + #if defined(CONFIG_SMP) + static int __init irq_affinity_setup(char *str) + { +- zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT); ++ alloc_bootmem_cpumask_var(&irq_default_affinity); + cpulist_parse(str, irq_default_affinity); + /* + * Set at least the boot cpu. We don't want to end up with +@@ -40,10 +40,8 @@ __setup("irqaffinity=", irq_affinity_setup); + + static void __init init_irq_default_affinity(void) + { +-#ifdef CONFIG_CPUMASK_OFFSTACK +- if (!irq_default_affinity) ++ if (!cpumask_available(irq_default_affinity)) + zalloc_cpumask_var(&irq_default_affinity, GFP_NOWAIT); +-#endif + if (cpumask_empty(irq_default_affinity)) + cpumask_setall(irq_default_affinity); + } +diff --git a/kernel/trace/trace_functions_graph.c b/kernel/trace/trace_functions_graph.c +index 23c0b0cb5fb9..169b3c44ee97 100644 +--- a/kernel/trace/trace_functions_graph.c ++++ b/kernel/trace/trace_functions_graph.c +@@ -831,6 +831,7 @@ print_graph_entry_leaf(struct trace_iterator *iter, + struct ftrace_graph_ret *graph_ret; + struct ftrace_graph_ent *call; + unsigned long long duration; ++ int cpu = iter->cpu; + int i; + + graph_ret = &ret_entry->ret; +@@ -839,7 +840,6 @@ print_graph_entry_leaf(struct trace_iterator *iter, + + if (data) { + struct fgraph_cpu_data *cpu_data; +- int cpu = iter->cpu; + + cpu_data = per_cpu_ptr(data->cpu_data, cpu); + +@@ -869,6 +869,9 @@ print_graph_entry_leaf(struct trace_iterator *iter, + + trace_seq_printf(s, "%ps();\n", (void *)call->func); + ++ print_graph_irq(iter, graph_ret->func, TRACE_GRAPH_RET, ++ cpu, iter->ent->pid, flags); ++ + return trace_handle_return(s); + } + +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index b1f841a9edd4..dfd2947e046e 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -2159,6 +2159,7 @@ static void __init gather_bootmem_prealloc(void) + */ + if (hstate_is_gigantic(h)) + adjust_managed_page_count(page, 1 << h->order); ++ cond_resched(); + } + } + +diff --git a/mm/memory-failure.c b/mm/memory-failure.c +index 1cd3b3569af8..345e69d88b37 100644 +--- a/mm/memory-failure.c ++++ b/mm/memory-failure.c +@@ -508,6 +508,7 @@ static const char * const action_page_types[] = { + [MF_MSG_POISONED_HUGE] = "huge page already hardware poisoned", + [MF_MSG_HUGE] = "huge page", + [MF_MSG_FREE_HUGE] = "free huge page", ++ [MF_MSG_NON_PMD_HUGE] = "non-pmd-sized huge page", + [MF_MSG_UNMAP_FAILED] = "unmapping failed page", + [MF_MSG_DIRTY_SWAPCACHE] = "dirty swapcache page", + [MF_MSG_CLEAN_SWAPCACHE] = "clean swapcache page", +@@ -1090,6 +1091,21 @@ static int memory_failure_hugetlb(unsigned long pfn, int trapno, int flags) + return 0; + } + ++ /* ++ * TODO: hwpoison for pud-sized hugetlb doesn't work right now, so ++ * simply disable it. In order to make it work properly, we need ++ * make sure that: ++ * - conversion of a pud that maps an error hugetlb into hwpoison ++ * entry properly works, and ++ * - other mm code walking over page table is aware of pud-aligned ++ * hwpoison entries. ++ */ ++ if (huge_page_size(page_hstate(head)) > PMD_SIZE) { ++ action_result(pfn, MF_MSG_NON_PMD_HUGE, MF_IGNORED); ++ res = -EBUSY; ++ goto out; ++ } ++ + if (!hwpoison_user_mappings(p, pfn, trapno, flags, &head)) { + action_result(pfn, MF_MSG_UNMAP_FAILED, MF_IGNORED); + res = -EBUSY; +diff --git a/mm/vmstat.c b/mm/vmstat.c +index e085b13c572e..4bb13e72ac97 100644 +--- a/mm/vmstat.c ++++ b/mm/vmstat.c +@@ -1770,11 +1770,9 @@ static void vmstat_update(struct work_struct *w) + * to occur in the future. Keep on running the + * update worker thread. + */ +- preempt_disable(); + queue_delayed_work_on(smp_processor_id(), mm_percpu_wq, + this_cpu_ptr(&vmstat_work), + round_jiffies_relative(sysctl_stat_interval)); +- preempt_enable(); + } + } + +diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c +index 8bb152a7cca4..276324abfa60 100644 +--- a/net/netfilter/nf_log.c ++++ b/net/netfilter/nf_log.c +@@ -458,14 +458,17 @@ static int nf_log_proc_dostring(struct ctl_table *table, int write, + rcu_assign_pointer(net->nf.nf_loggers[tindex], logger); + mutex_unlock(&nf_log_mutex); + } else { ++ struct ctl_table tmp = *table; ++ ++ tmp.data = buf; + mutex_lock(&nf_log_mutex); + logger = nft_log_dereference(net->nf.nf_loggers[tindex]); + if (!logger) +- table->data = "NONE"; ++ strlcpy(buf, "NONE", sizeof(buf)); + else +- table->data = logger->name; +- r = proc_dostring(table, write, buffer, lenp, ppos); ++ strlcpy(buf, logger->name, sizeof(buf)); + mutex_unlock(&nf_log_mutex); ++ r = proc_dostring(&tmp, write, buffer, lenp, ppos); + } + + return r; +diff --git a/scripts/Kbuild.include b/scripts/Kbuild.include +index 97769465de13..fcbbecf92395 100644 +--- a/scripts/Kbuild.include ++++ b/scripts/Kbuild.include +@@ -8,6 +8,7 @@ squote := ' + empty := + space := $(empty) $(empty) + space_escape := _-_SPACE_-_ ++pound := \# + + ### + # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o +@@ -251,11 +252,11 @@ endif + + # Replace >$< with >$$< to preserve $ when reloading the .cmd file + # (needed for make) +-# Replace >#< with >\#< to avoid starting a comment in the .cmd file ++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file + # (needed for make) + # Replace >'< with >'\''< to be able to enclose the whole string in '...' + # (needed for the shell) +-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1))))) ++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1))))) + + # Find any prerequisites that is newer than target or that does not exist. + # PHONY targets skipped in both cases. +diff --git a/tools/build/Build.include b/tools/build/Build.include +index 418871d02ebf..a4bbb984941d 100644 +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -12,6 +12,7 @@ + # Convenient variables + comma := , + squote := ' ++pound := \# + + ### + # Name of target with a '.' as filename prefix. foo/bar.o => foo/.bar.o +@@ -43,11 +44,11 @@ echo-cmd = $(if $($(quiet)cmd_$(1)),\ + ### + # Replace >$< with >$$< to preserve $ when reloading the .cmd file + # (needed for make) +-# Replace >#< with >\#< to avoid starting a comment in the .cmd file ++# Replace >#< with >$(pound)< to avoid starting a comment in the .cmd file + # (needed for make) + # Replace >'< with >'\''< to be able to enclose the whole string in '...' + # (needed for the shell) +-make-cmd = $(call escsq,$(subst \#,\\\#,$(subst $$,$$$$,$(cmd_$(1))))) ++make-cmd = $(call escsq,$(subst $(pound),$$(pound),$(subst $$,$$$$,$(cmd_$(1))))) + + ### + # Find any prerequisites that is newer than target or that does not exist. +diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile +index e6acc281dd37..8ae824dbfca3 100644 +--- a/tools/objtool/Makefile ++++ b/tools/objtool/Makefile +@@ -35,7 +35,7 @@ CFLAGS += -Wall -Werror $(WARNINGS) -fomit-frame-pointer -O2 -g $(INCLUDES) + LDFLAGS += -lelf $(LIBSUBCMD) + + # Allow old libelf to be used: +-elfshdr := $(shell echo '\#include ' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr) ++elfshdr := $(shell echo '$(pound)include ' | $(CC) $(CFLAGS) -x c -E - | grep elf_getshdr) + CFLAGS += $(if $(elfshdr),,-DLIBELF_USE_DEPRECATED) + + AWK = awk +diff --git a/tools/scripts/Makefile.include b/tools/scripts/Makefile.include +index 654efd9768fd..5f3f1f44ed0a 100644 +--- a/tools/scripts/Makefile.include ++++ b/tools/scripts/Makefile.include +@@ -101,3 +101,5 @@ ifneq ($(silent),1) + QUIET_INSTALL = @printf ' INSTALL %s\n' $1; + endif + endif ++ ++pound := \# diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.55-56.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.55-56.patch new file mode 100644 index 000000000000..a53e5fb95acc --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.55-56.patch @@ -0,0 +1,5019 @@ +diff --git a/Documentation/kbuild/kbuild.txt b/Documentation/kbuild/kbuild.txt +index ac2363ea05c5..82afdb7f0816 100644 +--- a/Documentation/kbuild/kbuild.txt ++++ b/Documentation/kbuild/kbuild.txt +@@ -152,15 +152,6 @@ stripped after they are installed. If INSTALL_MOD_STRIP is '1', then + the default option --strip-debug will be used. Otherwise, + INSTALL_MOD_STRIP value will be used as the options to the strip command. + +-INSTALL_FW_PATH +--------------------------------------------------- +-INSTALL_FW_PATH specifies where to install the firmware blobs. +-The default value is: +- +- $(INSTALL_MOD_PATH)/lib/firmware +- +-The value can be overridden in which case the default value is ignored. +- + INSTALL_HDR_PATH + -------------------------------------------------- + INSTALL_HDR_PATH specifies where to install user space headers when +diff --git a/Makefile b/Makefile +index 0700feaaa6cf..acbb0e3d29c9 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 55 ++SUBLEVEL = 56 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/include/asm/simd.h b/arch/arm64/include/asm/simd.h +index fa8b3fe932e6..6495cc51246f 100644 +--- a/arch/arm64/include/asm/simd.h ++++ b/arch/arm64/include/asm/simd.h +@@ -29,20 +29,15 @@ DECLARE_PER_CPU(bool, kernel_neon_busy); + static __must_check inline bool may_use_simd(void) + { + /* +- * The raw_cpu_read() is racy if called with preemption enabled. +- * This is not a bug: kernel_neon_busy is only set when +- * preemption is disabled, so we cannot migrate to another CPU +- * while it is set, nor can we migrate to a CPU where it is set. +- * So, if we find it clear on some CPU then we're guaranteed to +- * find it clear on any CPU we could migrate to. +- * +- * If we are in between kernel_neon_begin()...kernel_neon_end(), +- * the flag will be set, but preemption is also disabled, so we +- * can't migrate to another CPU and spuriously see it become +- * false. ++ * kernel_neon_busy is only set while preemption is disabled, ++ * and is clear whenever preemption is enabled. Since ++ * this_cpu_read() is atomic w.r.t. preemption, kernel_neon_busy ++ * cannot change under our feet -- if it's set we cannot be ++ * migrated, and if it's clear we cannot be migrated to a CPU ++ * where it is set. + */ + return !in_irq() && !irqs_disabled() && !in_nmi() && +- !raw_cpu_read(kernel_neon_busy); ++ !this_cpu_read(kernel_neon_busy); + } + + #else /* ! CONFIG_KERNEL_MODE_NEON */ +diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c +index e1ddb94a6522..e8d772a2597d 100644 +--- a/arch/mips/kernel/process.c ++++ b/arch/mips/kernel/process.c +@@ -29,6 +29,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -655,28 +656,42 @@ unsigned long arch_align_stack(unsigned long sp) + return sp & ALMASK; + } + +-static void arch_dump_stack(void *info) ++static DEFINE_PER_CPU(call_single_data_t, backtrace_csd); ++static struct cpumask backtrace_csd_busy; ++ ++static void handle_backtrace(void *info) + { +- struct pt_regs *regs; ++ nmi_cpu_backtrace(get_irq_regs()); ++ cpumask_clear_cpu(smp_processor_id(), &backtrace_csd_busy); ++} + +- regs = get_irq_regs(); ++static void raise_backtrace(cpumask_t *mask) ++{ ++ call_single_data_t *csd; ++ int cpu; + +- if (regs) +- show_regs(regs); ++ for_each_cpu(cpu, mask) { ++ /* ++ * If we previously sent an IPI to the target CPU & it hasn't ++ * cleared its bit in the busy cpumask then it didn't handle ++ * our previous IPI & it's not safe for us to reuse the ++ * call_single_data_t. ++ */ ++ if (cpumask_test_and_set_cpu(cpu, &backtrace_csd_busy)) { ++ pr_warn("Unable to send backtrace IPI to CPU%u - perhaps it hung?\n", ++ cpu); ++ continue; ++ } + +- dump_stack(); ++ csd = &per_cpu(backtrace_csd, cpu); ++ csd->func = handle_backtrace; ++ smp_call_function_single_async(cpu, csd); ++ } + } + + void arch_trigger_cpumask_backtrace(const cpumask_t *mask, bool exclude_self) + { +- long this_cpu = get_cpu(); +- +- if (cpumask_test_cpu(this_cpu, mask) && !exclude_self) +- dump_stack(); +- +- smp_call_function_many(mask, arch_dump_stack, NULL, 1); +- +- put_cpu(); ++ nmi_trigger_cpumask_backtrace(mask, exclude_self, raise_backtrace); + } + + int mips_get_process_fp_mode(struct task_struct *task) +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 5669d3b8bd38..583aed906933 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -351,6 +351,7 @@ static void __show_regs(const struct pt_regs *regs) + void show_regs(struct pt_regs *regs) + { + __show_regs((struct pt_regs *)regs); ++ dump_stack(); + } + + void show_registers(struct pt_regs *regs) +diff --git a/arch/mips/mm/ioremap.c b/arch/mips/mm/ioremap.c +index 1986e09fb457..1601d90b087b 100644 +--- a/arch/mips/mm/ioremap.c ++++ b/arch/mips/mm/ioremap.c +@@ -9,6 +9,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -98,6 +99,20 @@ static int remap_area_pages(unsigned long address, phys_addr_t phys_addr, + return error; + } + ++static int __ioremap_check_ram(unsigned long start_pfn, unsigned long nr_pages, ++ void *arg) ++{ ++ unsigned long i; ++ ++ for (i = 0; i < nr_pages; i++) { ++ if (pfn_valid(start_pfn + i) && ++ !PageReserved(pfn_to_page(start_pfn + i))) ++ return 1; ++ } ++ ++ return 0; ++} ++ + /* + * Generic mapping function (not visible outside): + */ +@@ -116,8 +131,8 @@ static int remap_area_pages(unsigned long address, phys_addr_t phys_addr, + + void __iomem * __ioremap(phys_addr_t phys_addr, phys_addr_t size, unsigned long flags) + { ++ unsigned long offset, pfn, last_pfn; + struct vm_struct * area; +- unsigned long offset; + phys_addr_t last_addr; + void * addr; + +@@ -137,18 +152,16 @@ void __iomem * __ioremap(phys_addr_t phys_addr, phys_addr_t size, unsigned long + return (void __iomem *) CKSEG1ADDR(phys_addr); + + /* +- * Don't allow anybody to remap normal RAM that we're using.. ++ * Don't allow anybody to remap RAM that may be allocated by the page ++ * allocator, since that could lead to races & data clobbering. + */ +- if (phys_addr < virt_to_phys(high_memory)) { +- char *t_addr, *t_end; +- struct page *page; +- +- t_addr = __va(phys_addr); +- t_end = t_addr + (size - 1); +- +- for(page = virt_to_page(t_addr); page <= virt_to_page(t_end); page++) +- if(!PageReserved(page)) +- return NULL; ++ pfn = PFN_DOWN(phys_addr); ++ last_pfn = PFN_DOWN(last_addr); ++ if (walk_system_ram_range(pfn, last_pfn - pfn + 1, NULL, ++ __ioremap_check_ram) == 1) { ++ WARN_ONCE(1, "ioremap on RAM at %pa - %pa\n", ++ &phys_addr, &last_addr); ++ return NULL; + } + + /* +diff --git a/arch/x86/crypto/Makefile b/arch/x86/crypto/Makefile +index 5f07333bb224..9c903a420cda 100644 +--- a/arch/x86/crypto/Makefile ++++ b/arch/x86/crypto/Makefile +@@ -15,7 +15,6 @@ obj-$(CONFIG_CRYPTO_GLUE_HELPER_X86) += glue_helper.o + + obj-$(CONFIG_CRYPTO_AES_586) += aes-i586.o + obj-$(CONFIG_CRYPTO_TWOFISH_586) += twofish-i586.o +-obj-$(CONFIG_CRYPTO_SALSA20_586) += salsa20-i586.o + obj-$(CONFIG_CRYPTO_SERPENT_SSE2_586) += serpent-sse2-i586.o + + obj-$(CONFIG_CRYPTO_AES_X86_64) += aes-x86_64.o +@@ -24,7 +23,6 @@ obj-$(CONFIG_CRYPTO_CAMELLIA_X86_64) += camellia-x86_64.o + obj-$(CONFIG_CRYPTO_BLOWFISH_X86_64) += blowfish-x86_64.o + obj-$(CONFIG_CRYPTO_TWOFISH_X86_64) += twofish-x86_64.o + obj-$(CONFIG_CRYPTO_TWOFISH_X86_64_3WAY) += twofish-x86_64-3way.o +-obj-$(CONFIG_CRYPTO_SALSA20_X86_64) += salsa20-x86_64.o + obj-$(CONFIG_CRYPTO_CHACHA20_X86_64) += chacha20-x86_64.o + obj-$(CONFIG_CRYPTO_SERPENT_SSE2_X86_64) += serpent-sse2-x86_64.o + obj-$(CONFIG_CRYPTO_AES_NI_INTEL) += aesni-intel.o +@@ -59,7 +57,6 @@ endif + + aes-i586-y := aes-i586-asm_32.o aes_glue.o + twofish-i586-y := twofish-i586-asm_32.o twofish_glue.o +-salsa20-i586-y := salsa20-i586-asm_32.o salsa20_glue.o + serpent-sse2-i586-y := serpent-sse2-i586-asm_32.o serpent_sse2_glue.o + + aes-x86_64-y := aes-x86_64-asm_64.o aes_glue.o +@@ -68,7 +65,6 @@ camellia-x86_64-y := camellia-x86_64-asm_64.o camellia_glue.o + blowfish-x86_64-y := blowfish-x86_64-asm_64.o blowfish_glue.o + twofish-x86_64-y := twofish-x86_64-asm_64.o twofish_glue.o + twofish-x86_64-3way-y := twofish-x86_64-asm_64-3way.o twofish_glue_3way.o +-salsa20-x86_64-y := salsa20-x86_64-asm_64.o salsa20_glue.o + chacha20-x86_64-y := chacha20-ssse3-x86_64.o chacha20_glue.o + serpent-sse2-x86_64-y := serpent-sse2-x86_64-asm_64.o serpent_sse2_glue.o + +diff --git a/arch/x86/crypto/salsa20-i586-asm_32.S b/arch/x86/crypto/salsa20-i586-asm_32.S +deleted file mode 100644 +index 329452b8f794..000000000000 +--- a/arch/x86/crypto/salsa20-i586-asm_32.S ++++ /dev/null +@@ -1,1114 +0,0 @@ +-# salsa20_pm.s version 20051229 +-# D. J. Bernstein +-# Public domain. +- +-#include +- +-.text +- +-# enter salsa20_encrypt_bytes +-ENTRY(salsa20_encrypt_bytes) +- mov %esp,%eax +- and $31,%eax +- add $256,%eax +- sub %eax,%esp +- # eax_stack = eax +- movl %eax,80(%esp) +- # ebx_stack = ebx +- movl %ebx,84(%esp) +- # esi_stack = esi +- movl %esi,88(%esp) +- # edi_stack = edi +- movl %edi,92(%esp) +- # ebp_stack = ebp +- movl %ebp,96(%esp) +- # x = arg1 +- movl 4(%esp,%eax),%edx +- # m = arg2 +- movl 8(%esp,%eax),%esi +- # out = arg3 +- movl 12(%esp,%eax),%edi +- # bytes = arg4 +- movl 16(%esp,%eax),%ebx +- # bytes -= 0 +- sub $0,%ebx +- # goto done if unsigned<= +- jbe ._done +-._start: +- # in0 = *(uint32 *) (x + 0) +- movl 0(%edx),%eax +- # in1 = *(uint32 *) (x + 4) +- movl 4(%edx),%ecx +- # in2 = *(uint32 *) (x + 8) +- movl 8(%edx),%ebp +- # j0 = in0 +- movl %eax,164(%esp) +- # in3 = *(uint32 *) (x + 12) +- movl 12(%edx),%eax +- # j1 = in1 +- movl %ecx,168(%esp) +- # in4 = *(uint32 *) (x + 16) +- movl 16(%edx),%ecx +- # j2 = in2 +- movl %ebp,172(%esp) +- # in5 = *(uint32 *) (x + 20) +- movl 20(%edx),%ebp +- # j3 = in3 +- movl %eax,176(%esp) +- # in6 = *(uint32 *) (x + 24) +- movl 24(%edx),%eax +- # j4 = in4 +- movl %ecx,180(%esp) +- # in7 = *(uint32 *) (x + 28) +- movl 28(%edx),%ecx +- # j5 = in5 +- movl %ebp,184(%esp) +- # in8 = *(uint32 *) (x + 32) +- movl 32(%edx),%ebp +- # j6 = in6 +- movl %eax,188(%esp) +- # in9 = *(uint32 *) (x + 36) +- movl 36(%edx),%eax +- # j7 = in7 +- movl %ecx,192(%esp) +- # in10 = *(uint32 *) (x + 40) +- movl 40(%edx),%ecx +- # j8 = in8 +- movl %ebp,196(%esp) +- # in11 = *(uint32 *) (x + 44) +- movl 44(%edx),%ebp +- # j9 = in9 +- movl %eax,200(%esp) +- # in12 = *(uint32 *) (x + 48) +- movl 48(%edx),%eax +- # j10 = in10 +- movl %ecx,204(%esp) +- # in13 = *(uint32 *) (x + 52) +- movl 52(%edx),%ecx +- # j11 = in11 +- movl %ebp,208(%esp) +- # in14 = *(uint32 *) (x + 56) +- movl 56(%edx),%ebp +- # j12 = in12 +- movl %eax,212(%esp) +- # in15 = *(uint32 *) (x + 60) +- movl 60(%edx),%eax +- # j13 = in13 +- movl %ecx,216(%esp) +- # j14 = in14 +- movl %ebp,220(%esp) +- # j15 = in15 +- movl %eax,224(%esp) +- # x_backup = x +- movl %edx,64(%esp) +-._bytesatleast1: +- # bytes - 64 +- cmp $64,%ebx +- # goto nocopy if unsigned>= +- jae ._nocopy +- # ctarget = out +- movl %edi,228(%esp) +- # out = &tmp +- leal 0(%esp),%edi +- # i = bytes +- mov %ebx,%ecx +- # while (i) { *out++ = *m++; --i } +- rep movsb +- # out = &tmp +- leal 0(%esp),%edi +- # m = &tmp +- leal 0(%esp),%esi +-._nocopy: +- # out_backup = out +- movl %edi,72(%esp) +- # m_backup = m +- movl %esi,68(%esp) +- # bytes_backup = bytes +- movl %ebx,76(%esp) +- # in0 = j0 +- movl 164(%esp),%eax +- # in1 = j1 +- movl 168(%esp),%ecx +- # in2 = j2 +- movl 172(%esp),%edx +- # in3 = j3 +- movl 176(%esp),%ebx +- # x0 = in0 +- movl %eax,100(%esp) +- # x1 = in1 +- movl %ecx,104(%esp) +- # x2 = in2 +- movl %edx,108(%esp) +- # x3 = in3 +- movl %ebx,112(%esp) +- # in4 = j4 +- movl 180(%esp),%eax +- # in5 = j5 +- movl 184(%esp),%ecx +- # in6 = j6 +- movl 188(%esp),%edx +- # in7 = j7 +- movl 192(%esp),%ebx +- # x4 = in4 +- movl %eax,116(%esp) +- # x5 = in5 +- movl %ecx,120(%esp) +- # x6 = in6 +- movl %edx,124(%esp) +- # x7 = in7 +- movl %ebx,128(%esp) +- # in8 = j8 +- movl 196(%esp),%eax +- # in9 = j9 +- movl 200(%esp),%ecx +- # in10 = j10 +- movl 204(%esp),%edx +- # in11 = j11 +- movl 208(%esp),%ebx +- # x8 = in8 +- movl %eax,132(%esp) +- # x9 = in9 +- movl %ecx,136(%esp) +- # x10 = in10 +- movl %edx,140(%esp) +- # x11 = in11 +- movl %ebx,144(%esp) +- # in12 = j12 +- movl 212(%esp),%eax +- # in13 = j13 +- movl 216(%esp),%ecx +- # in14 = j14 +- movl 220(%esp),%edx +- # in15 = j15 +- movl 224(%esp),%ebx +- # x12 = in12 +- movl %eax,148(%esp) +- # x13 = in13 +- movl %ecx,152(%esp) +- # x14 = in14 +- movl %edx,156(%esp) +- # x15 = in15 +- movl %ebx,160(%esp) +- # i = 20 +- mov $20,%ebp +- # p = x0 +- movl 100(%esp),%eax +- # s = x5 +- movl 120(%esp),%ecx +- # t = x10 +- movl 140(%esp),%edx +- # w = x15 +- movl 160(%esp),%ebx +-._mainloop: +- # x0 = p +- movl %eax,100(%esp) +- # x10 = t +- movl %edx,140(%esp) +- # p += x12 +- addl 148(%esp),%eax +- # x5 = s +- movl %ecx,120(%esp) +- # t += x6 +- addl 124(%esp),%edx +- # x15 = w +- movl %ebx,160(%esp) +- # r = x1 +- movl 104(%esp),%esi +- # r += s +- add %ecx,%esi +- # v = x11 +- movl 144(%esp),%edi +- # v += w +- add %ebx,%edi +- # p <<<= 7 +- rol $7,%eax +- # p ^= x4 +- xorl 116(%esp),%eax +- # t <<<= 7 +- rol $7,%edx +- # t ^= x14 +- xorl 156(%esp),%edx +- # r <<<= 7 +- rol $7,%esi +- # r ^= x9 +- xorl 136(%esp),%esi +- # v <<<= 7 +- rol $7,%edi +- # v ^= x3 +- xorl 112(%esp),%edi +- # x4 = p +- movl %eax,116(%esp) +- # x14 = t +- movl %edx,156(%esp) +- # p += x0 +- addl 100(%esp),%eax +- # x9 = r +- movl %esi,136(%esp) +- # t += x10 +- addl 140(%esp),%edx +- # x3 = v +- movl %edi,112(%esp) +- # p <<<= 9 +- rol $9,%eax +- # p ^= x8 +- xorl 132(%esp),%eax +- # t <<<= 9 +- rol $9,%edx +- # t ^= x2 +- xorl 108(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 9 +- rol $9,%ecx +- # s ^= x13 +- xorl 152(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 9 +- rol $9,%ebx +- # w ^= x7 +- xorl 128(%esp),%ebx +- # x8 = p +- movl %eax,132(%esp) +- # x2 = t +- movl %edx,108(%esp) +- # p += x4 +- addl 116(%esp),%eax +- # x13 = s +- movl %ecx,152(%esp) +- # t += x14 +- addl 156(%esp),%edx +- # x7 = w +- movl %ebx,128(%esp) +- # p <<<= 13 +- rol $13,%eax +- # p ^= x12 +- xorl 148(%esp),%eax +- # t <<<= 13 +- rol $13,%edx +- # t ^= x6 +- xorl 124(%esp),%edx +- # r += s +- add %ecx,%esi +- # r <<<= 13 +- rol $13,%esi +- # r ^= x1 +- xorl 104(%esp),%esi +- # v += w +- add %ebx,%edi +- # v <<<= 13 +- rol $13,%edi +- # v ^= x11 +- xorl 144(%esp),%edi +- # x12 = p +- movl %eax,148(%esp) +- # x6 = t +- movl %edx,124(%esp) +- # p += x8 +- addl 132(%esp),%eax +- # x1 = r +- movl %esi,104(%esp) +- # t += x2 +- addl 108(%esp),%edx +- # x11 = v +- movl %edi,144(%esp) +- # p <<<= 18 +- rol $18,%eax +- # p ^= x0 +- xorl 100(%esp),%eax +- # t <<<= 18 +- rol $18,%edx +- # t ^= x10 +- xorl 140(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 18 +- rol $18,%ecx +- # s ^= x5 +- xorl 120(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 18 +- rol $18,%ebx +- # w ^= x15 +- xorl 160(%esp),%ebx +- # x0 = p +- movl %eax,100(%esp) +- # x10 = t +- movl %edx,140(%esp) +- # p += x3 +- addl 112(%esp),%eax +- # p <<<= 7 +- rol $7,%eax +- # x5 = s +- movl %ecx,120(%esp) +- # t += x9 +- addl 136(%esp),%edx +- # x15 = w +- movl %ebx,160(%esp) +- # r = x4 +- movl 116(%esp),%esi +- # r += s +- add %ecx,%esi +- # v = x14 +- movl 156(%esp),%edi +- # v += w +- add %ebx,%edi +- # p ^= x1 +- xorl 104(%esp),%eax +- # t <<<= 7 +- rol $7,%edx +- # t ^= x11 +- xorl 144(%esp),%edx +- # r <<<= 7 +- rol $7,%esi +- # r ^= x6 +- xorl 124(%esp),%esi +- # v <<<= 7 +- rol $7,%edi +- # v ^= x12 +- xorl 148(%esp),%edi +- # x1 = p +- movl %eax,104(%esp) +- # x11 = t +- movl %edx,144(%esp) +- # p += x0 +- addl 100(%esp),%eax +- # x6 = r +- movl %esi,124(%esp) +- # t += x10 +- addl 140(%esp),%edx +- # x12 = v +- movl %edi,148(%esp) +- # p <<<= 9 +- rol $9,%eax +- # p ^= x2 +- xorl 108(%esp),%eax +- # t <<<= 9 +- rol $9,%edx +- # t ^= x8 +- xorl 132(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 9 +- rol $9,%ecx +- # s ^= x7 +- xorl 128(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 9 +- rol $9,%ebx +- # w ^= x13 +- xorl 152(%esp),%ebx +- # x2 = p +- movl %eax,108(%esp) +- # x8 = t +- movl %edx,132(%esp) +- # p += x1 +- addl 104(%esp),%eax +- # x7 = s +- movl %ecx,128(%esp) +- # t += x11 +- addl 144(%esp),%edx +- # x13 = w +- movl %ebx,152(%esp) +- # p <<<= 13 +- rol $13,%eax +- # p ^= x3 +- xorl 112(%esp),%eax +- # t <<<= 13 +- rol $13,%edx +- # t ^= x9 +- xorl 136(%esp),%edx +- # r += s +- add %ecx,%esi +- # r <<<= 13 +- rol $13,%esi +- # r ^= x4 +- xorl 116(%esp),%esi +- # v += w +- add %ebx,%edi +- # v <<<= 13 +- rol $13,%edi +- # v ^= x14 +- xorl 156(%esp),%edi +- # x3 = p +- movl %eax,112(%esp) +- # x9 = t +- movl %edx,136(%esp) +- # p += x2 +- addl 108(%esp),%eax +- # x4 = r +- movl %esi,116(%esp) +- # t += x8 +- addl 132(%esp),%edx +- # x14 = v +- movl %edi,156(%esp) +- # p <<<= 18 +- rol $18,%eax +- # p ^= x0 +- xorl 100(%esp),%eax +- # t <<<= 18 +- rol $18,%edx +- # t ^= x10 +- xorl 140(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 18 +- rol $18,%ecx +- # s ^= x5 +- xorl 120(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 18 +- rol $18,%ebx +- # w ^= x15 +- xorl 160(%esp),%ebx +- # x0 = p +- movl %eax,100(%esp) +- # x10 = t +- movl %edx,140(%esp) +- # p += x12 +- addl 148(%esp),%eax +- # x5 = s +- movl %ecx,120(%esp) +- # t += x6 +- addl 124(%esp),%edx +- # x15 = w +- movl %ebx,160(%esp) +- # r = x1 +- movl 104(%esp),%esi +- # r += s +- add %ecx,%esi +- # v = x11 +- movl 144(%esp),%edi +- # v += w +- add %ebx,%edi +- # p <<<= 7 +- rol $7,%eax +- # p ^= x4 +- xorl 116(%esp),%eax +- # t <<<= 7 +- rol $7,%edx +- # t ^= x14 +- xorl 156(%esp),%edx +- # r <<<= 7 +- rol $7,%esi +- # r ^= x9 +- xorl 136(%esp),%esi +- # v <<<= 7 +- rol $7,%edi +- # v ^= x3 +- xorl 112(%esp),%edi +- # x4 = p +- movl %eax,116(%esp) +- # x14 = t +- movl %edx,156(%esp) +- # p += x0 +- addl 100(%esp),%eax +- # x9 = r +- movl %esi,136(%esp) +- # t += x10 +- addl 140(%esp),%edx +- # x3 = v +- movl %edi,112(%esp) +- # p <<<= 9 +- rol $9,%eax +- # p ^= x8 +- xorl 132(%esp),%eax +- # t <<<= 9 +- rol $9,%edx +- # t ^= x2 +- xorl 108(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 9 +- rol $9,%ecx +- # s ^= x13 +- xorl 152(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 9 +- rol $9,%ebx +- # w ^= x7 +- xorl 128(%esp),%ebx +- # x8 = p +- movl %eax,132(%esp) +- # x2 = t +- movl %edx,108(%esp) +- # p += x4 +- addl 116(%esp),%eax +- # x13 = s +- movl %ecx,152(%esp) +- # t += x14 +- addl 156(%esp),%edx +- # x7 = w +- movl %ebx,128(%esp) +- # p <<<= 13 +- rol $13,%eax +- # p ^= x12 +- xorl 148(%esp),%eax +- # t <<<= 13 +- rol $13,%edx +- # t ^= x6 +- xorl 124(%esp),%edx +- # r += s +- add %ecx,%esi +- # r <<<= 13 +- rol $13,%esi +- # r ^= x1 +- xorl 104(%esp),%esi +- # v += w +- add %ebx,%edi +- # v <<<= 13 +- rol $13,%edi +- # v ^= x11 +- xorl 144(%esp),%edi +- # x12 = p +- movl %eax,148(%esp) +- # x6 = t +- movl %edx,124(%esp) +- # p += x8 +- addl 132(%esp),%eax +- # x1 = r +- movl %esi,104(%esp) +- # t += x2 +- addl 108(%esp),%edx +- # x11 = v +- movl %edi,144(%esp) +- # p <<<= 18 +- rol $18,%eax +- # p ^= x0 +- xorl 100(%esp),%eax +- # t <<<= 18 +- rol $18,%edx +- # t ^= x10 +- xorl 140(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 18 +- rol $18,%ecx +- # s ^= x5 +- xorl 120(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 18 +- rol $18,%ebx +- # w ^= x15 +- xorl 160(%esp),%ebx +- # x0 = p +- movl %eax,100(%esp) +- # x10 = t +- movl %edx,140(%esp) +- # p += x3 +- addl 112(%esp),%eax +- # p <<<= 7 +- rol $7,%eax +- # x5 = s +- movl %ecx,120(%esp) +- # t += x9 +- addl 136(%esp),%edx +- # x15 = w +- movl %ebx,160(%esp) +- # r = x4 +- movl 116(%esp),%esi +- # r += s +- add %ecx,%esi +- # v = x14 +- movl 156(%esp),%edi +- # v += w +- add %ebx,%edi +- # p ^= x1 +- xorl 104(%esp),%eax +- # t <<<= 7 +- rol $7,%edx +- # t ^= x11 +- xorl 144(%esp),%edx +- # r <<<= 7 +- rol $7,%esi +- # r ^= x6 +- xorl 124(%esp),%esi +- # v <<<= 7 +- rol $7,%edi +- # v ^= x12 +- xorl 148(%esp),%edi +- # x1 = p +- movl %eax,104(%esp) +- # x11 = t +- movl %edx,144(%esp) +- # p += x0 +- addl 100(%esp),%eax +- # x6 = r +- movl %esi,124(%esp) +- # t += x10 +- addl 140(%esp),%edx +- # x12 = v +- movl %edi,148(%esp) +- # p <<<= 9 +- rol $9,%eax +- # p ^= x2 +- xorl 108(%esp),%eax +- # t <<<= 9 +- rol $9,%edx +- # t ^= x8 +- xorl 132(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 9 +- rol $9,%ecx +- # s ^= x7 +- xorl 128(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 9 +- rol $9,%ebx +- # w ^= x13 +- xorl 152(%esp),%ebx +- # x2 = p +- movl %eax,108(%esp) +- # x8 = t +- movl %edx,132(%esp) +- # p += x1 +- addl 104(%esp),%eax +- # x7 = s +- movl %ecx,128(%esp) +- # t += x11 +- addl 144(%esp),%edx +- # x13 = w +- movl %ebx,152(%esp) +- # p <<<= 13 +- rol $13,%eax +- # p ^= x3 +- xorl 112(%esp),%eax +- # t <<<= 13 +- rol $13,%edx +- # t ^= x9 +- xorl 136(%esp),%edx +- # r += s +- add %ecx,%esi +- # r <<<= 13 +- rol $13,%esi +- # r ^= x4 +- xorl 116(%esp),%esi +- # v += w +- add %ebx,%edi +- # v <<<= 13 +- rol $13,%edi +- # v ^= x14 +- xorl 156(%esp),%edi +- # x3 = p +- movl %eax,112(%esp) +- # x9 = t +- movl %edx,136(%esp) +- # p += x2 +- addl 108(%esp),%eax +- # x4 = r +- movl %esi,116(%esp) +- # t += x8 +- addl 132(%esp),%edx +- # x14 = v +- movl %edi,156(%esp) +- # p <<<= 18 +- rol $18,%eax +- # p ^= x0 +- xorl 100(%esp),%eax +- # t <<<= 18 +- rol $18,%edx +- # t ^= x10 +- xorl 140(%esp),%edx +- # s += r +- add %esi,%ecx +- # s <<<= 18 +- rol $18,%ecx +- # s ^= x5 +- xorl 120(%esp),%ecx +- # w += v +- add %edi,%ebx +- # w <<<= 18 +- rol $18,%ebx +- # w ^= x15 +- xorl 160(%esp),%ebx +- # i -= 4 +- sub $4,%ebp +- # goto mainloop if unsigned > +- ja ._mainloop +- # x0 = p +- movl %eax,100(%esp) +- # x5 = s +- movl %ecx,120(%esp) +- # x10 = t +- movl %edx,140(%esp) +- # x15 = w +- movl %ebx,160(%esp) +- # out = out_backup +- movl 72(%esp),%edi +- # m = m_backup +- movl 68(%esp),%esi +- # in0 = x0 +- movl 100(%esp),%eax +- # in1 = x1 +- movl 104(%esp),%ecx +- # in0 += j0 +- addl 164(%esp),%eax +- # in1 += j1 +- addl 168(%esp),%ecx +- # in0 ^= *(uint32 *) (m + 0) +- xorl 0(%esi),%eax +- # in1 ^= *(uint32 *) (m + 4) +- xorl 4(%esi),%ecx +- # *(uint32 *) (out + 0) = in0 +- movl %eax,0(%edi) +- # *(uint32 *) (out + 4) = in1 +- movl %ecx,4(%edi) +- # in2 = x2 +- movl 108(%esp),%eax +- # in3 = x3 +- movl 112(%esp),%ecx +- # in2 += j2 +- addl 172(%esp),%eax +- # in3 += j3 +- addl 176(%esp),%ecx +- # in2 ^= *(uint32 *) (m + 8) +- xorl 8(%esi),%eax +- # in3 ^= *(uint32 *) (m + 12) +- xorl 12(%esi),%ecx +- # *(uint32 *) (out + 8) = in2 +- movl %eax,8(%edi) +- # *(uint32 *) (out + 12) = in3 +- movl %ecx,12(%edi) +- # in4 = x4 +- movl 116(%esp),%eax +- # in5 = x5 +- movl 120(%esp),%ecx +- # in4 += j4 +- addl 180(%esp),%eax +- # in5 += j5 +- addl 184(%esp),%ecx +- # in4 ^= *(uint32 *) (m + 16) +- xorl 16(%esi),%eax +- # in5 ^= *(uint32 *) (m + 20) +- xorl 20(%esi),%ecx +- # *(uint32 *) (out + 16) = in4 +- movl %eax,16(%edi) +- # *(uint32 *) (out + 20) = in5 +- movl %ecx,20(%edi) +- # in6 = x6 +- movl 124(%esp),%eax +- # in7 = x7 +- movl 128(%esp),%ecx +- # in6 += j6 +- addl 188(%esp),%eax +- # in7 += j7 +- addl 192(%esp),%ecx +- # in6 ^= *(uint32 *) (m + 24) +- xorl 24(%esi),%eax +- # in7 ^= *(uint32 *) (m + 28) +- xorl 28(%esi),%ecx +- # *(uint32 *) (out + 24) = in6 +- movl %eax,24(%edi) +- # *(uint32 *) (out + 28) = in7 +- movl %ecx,28(%edi) +- # in8 = x8 +- movl 132(%esp),%eax +- # in9 = x9 +- movl 136(%esp),%ecx +- # in8 += j8 +- addl 196(%esp),%eax +- # in9 += j9 +- addl 200(%esp),%ecx +- # in8 ^= *(uint32 *) (m + 32) +- xorl 32(%esi),%eax +- # in9 ^= *(uint32 *) (m + 36) +- xorl 36(%esi),%ecx +- # *(uint32 *) (out + 32) = in8 +- movl %eax,32(%edi) +- # *(uint32 *) (out + 36) = in9 +- movl %ecx,36(%edi) +- # in10 = x10 +- movl 140(%esp),%eax +- # in11 = x11 +- movl 144(%esp),%ecx +- # in10 += j10 +- addl 204(%esp),%eax +- # in11 += j11 +- addl 208(%esp),%ecx +- # in10 ^= *(uint32 *) (m + 40) +- xorl 40(%esi),%eax +- # in11 ^= *(uint32 *) (m + 44) +- xorl 44(%esi),%ecx +- # *(uint32 *) (out + 40) = in10 +- movl %eax,40(%edi) +- # *(uint32 *) (out + 44) = in11 +- movl %ecx,44(%edi) +- # in12 = x12 +- movl 148(%esp),%eax +- # in13 = x13 +- movl 152(%esp),%ecx +- # in12 += j12 +- addl 212(%esp),%eax +- # in13 += j13 +- addl 216(%esp),%ecx +- # in12 ^= *(uint32 *) (m + 48) +- xorl 48(%esi),%eax +- # in13 ^= *(uint32 *) (m + 52) +- xorl 52(%esi),%ecx +- # *(uint32 *) (out + 48) = in12 +- movl %eax,48(%edi) +- # *(uint32 *) (out + 52) = in13 +- movl %ecx,52(%edi) +- # in14 = x14 +- movl 156(%esp),%eax +- # in15 = x15 +- movl 160(%esp),%ecx +- # in14 += j14 +- addl 220(%esp),%eax +- # in15 += j15 +- addl 224(%esp),%ecx +- # in14 ^= *(uint32 *) (m + 56) +- xorl 56(%esi),%eax +- # in15 ^= *(uint32 *) (m + 60) +- xorl 60(%esi),%ecx +- # *(uint32 *) (out + 56) = in14 +- movl %eax,56(%edi) +- # *(uint32 *) (out + 60) = in15 +- movl %ecx,60(%edi) +- # bytes = bytes_backup +- movl 76(%esp),%ebx +- # in8 = j8 +- movl 196(%esp),%eax +- # in9 = j9 +- movl 200(%esp),%ecx +- # in8 += 1 +- add $1,%eax +- # in9 += 0 + carry +- adc $0,%ecx +- # j8 = in8 +- movl %eax,196(%esp) +- # j9 = in9 +- movl %ecx,200(%esp) +- # bytes - 64 +- cmp $64,%ebx +- # goto bytesatleast65 if unsigned> +- ja ._bytesatleast65 +- # goto bytesatleast64 if unsigned>= +- jae ._bytesatleast64 +- # m = out +- mov %edi,%esi +- # out = ctarget +- movl 228(%esp),%edi +- # i = bytes +- mov %ebx,%ecx +- # while (i) { *out++ = *m++; --i } +- rep movsb +-._bytesatleast64: +- # x = x_backup +- movl 64(%esp),%eax +- # in8 = j8 +- movl 196(%esp),%ecx +- # in9 = j9 +- movl 200(%esp),%edx +- # *(uint32 *) (x + 32) = in8 +- movl %ecx,32(%eax) +- # *(uint32 *) (x + 36) = in9 +- movl %edx,36(%eax) +-._done: +- # eax = eax_stack +- movl 80(%esp),%eax +- # ebx = ebx_stack +- movl 84(%esp),%ebx +- # esi = esi_stack +- movl 88(%esp),%esi +- # edi = edi_stack +- movl 92(%esp),%edi +- # ebp = ebp_stack +- movl 96(%esp),%ebp +- # leave +- add %eax,%esp +- ret +-._bytesatleast65: +- # bytes -= 64 +- sub $64,%ebx +- # out += 64 +- add $64,%edi +- # m += 64 +- add $64,%esi +- # goto bytesatleast1 +- jmp ._bytesatleast1 +-ENDPROC(salsa20_encrypt_bytes) +- +-# enter salsa20_keysetup +-ENTRY(salsa20_keysetup) +- mov %esp,%eax +- and $31,%eax +- add $256,%eax +- sub %eax,%esp +- # eax_stack = eax +- movl %eax,64(%esp) +- # ebx_stack = ebx +- movl %ebx,68(%esp) +- # esi_stack = esi +- movl %esi,72(%esp) +- # edi_stack = edi +- movl %edi,76(%esp) +- # ebp_stack = ebp +- movl %ebp,80(%esp) +- # k = arg2 +- movl 8(%esp,%eax),%ecx +- # kbits = arg3 +- movl 12(%esp,%eax),%edx +- # x = arg1 +- movl 4(%esp,%eax),%eax +- # in1 = *(uint32 *) (k + 0) +- movl 0(%ecx),%ebx +- # in2 = *(uint32 *) (k + 4) +- movl 4(%ecx),%esi +- # in3 = *(uint32 *) (k + 8) +- movl 8(%ecx),%edi +- # in4 = *(uint32 *) (k + 12) +- movl 12(%ecx),%ebp +- # *(uint32 *) (x + 4) = in1 +- movl %ebx,4(%eax) +- # *(uint32 *) (x + 8) = in2 +- movl %esi,8(%eax) +- # *(uint32 *) (x + 12) = in3 +- movl %edi,12(%eax) +- # *(uint32 *) (x + 16) = in4 +- movl %ebp,16(%eax) +- # kbits - 256 +- cmp $256,%edx +- # goto kbits128 if unsigned< +- jb ._kbits128 +-._kbits256: +- # in11 = *(uint32 *) (k + 16) +- movl 16(%ecx),%edx +- # in12 = *(uint32 *) (k + 20) +- movl 20(%ecx),%ebx +- # in13 = *(uint32 *) (k + 24) +- movl 24(%ecx),%esi +- # in14 = *(uint32 *) (k + 28) +- movl 28(%ecx),%ecx +- # *(uint32 *) (x + 44) = in11 +- movl %edx,44(%eax) +- # *(uint32 *) (x + 48) = in12 +- movl %ebx,48(%eax) +- # *(uint32 *) (x + 52) = in13 +- movl %esi,52(%eax) +- # *(uint32 *) (x + 56) = in14 +- movl %ecx,56(%eax) +- # in0 = 1634760805 +- mov $1634760805,%ecx +- # in5 = 857760878 +- mov $857760878,%edx +- # in10 = 2036477234 +- mov $2036477234,%ebx +- # in15 = 1797285236 +- mov $1797285236,%esi +- # *(uint32 *) (x + 0) = in0 +- movl %ecx,0(%eax) +- # *(uint32 *) (x + 20) = in5 +- movl %edx,20(%eax) +- # *(uint32 *) (x + 40) = in10 +- movl %ebx,40(%eax) +- # *(uint32 *) (x + 60) = in15 +- movl %esi,60(%eax) +- # goto keysetupdone +- jmp ._keysetupdone +-._kbits128: +- # in11 = *(uint32 *) (k + 0) +- movl 0(%ecx),%edx +- # in12 = *(uint32 *) (k + 4) +- movl 4(%ecx),%ebx +- # in13 = *(uint32 *) (k + 8) +- movl 8(%ecx),%esi +- # in14 = *(uint32 *) (k + 12) +- movl 12(%ecx),%ecx +- # *(uint32 *) (x + 44) = in11 +- movl %edx,44(%eax) +- # *(uint32 *) (x + 48) = in12 +- movl %ebx,48(%eax) +- # *(uint32 *) (x + 52) = in13 +- movl %esi,52(%eax) +- # *(uint32 *) (x + 56) = in14 +- movl %ecx,56(%eax) +- # in0 = 1634760805 +- mov $1634760805,%ecx +- # in5 = 824206446 +- mov $824206446,%edx +- # in10 = 2036477238 +- mov $2036477238,%ebx +- # in15 = 1797285236 +- mov $1797285236,%esi +- # *(uint32 *) (x + 0) = in0 +- movl %ecx,0(%eax) +- # *(uint32 *) (x + 20) = in5 +- movl %edx,20(%eax) +- # *(uint32 *) (x + 40) = in10 +- movl %ebx,40(%eax) +- # *(uint32 *) (x + 60) = in15 +- movl %esi,60(%eax) +-._keysetupdone: +- # eax = eax_stack +- movl 64(%esp),%eax +- # ebx = ebx_stack +- movl 68(%esp),%ebx +- # esi = esi_stack +- movl 72(%esp),%esi +- # edi = edi_stack +- movl 76(%esp),%edi +- # ebp = ebp_stack +- movl 80(%esp),%ebp +- # leave +- add %eax,%esp +- ret +-ENDPROC(salsa20_keysetup) +- +-# enter salsa20_ivsetup +-ENTRY(salsa20_ivsetup) +- mov %esp,%eax +- and $31,%eax +- add $256,%eax +- sub %eax,%esp +- # eax_stack = eax +- movl %eax,64(%esp) +- # ebx_stack = ebx +- movl %ebx,68(%esp) +- # esi_stack = esi +- movl %esi,72(%esp) +- # edi_stack = edi +- movl %edi,76(%esp) +- # ebp_stack = ebp +- movl %ebp,80(%esp) +- # iv = arg2 +- movl 8(%esp,%eax),%ecx +- # x = arg1 +- movl 4(%esp,%eax),%eax +- # in6 = *(uint32 *) (iv + 0) +- movl 0(%ecx),%edx +- # in7 = *(uint32 *) (iv + 4) +- movl 4(%ecx),%ecx +- # in8 = 0 +- mov $0,%ebx +- # in9 = 0 +- mov $0,%esi +- # *(uint32 *) (x + 24) = in6 +- movl %edx,24(%eax) +- # *(uint32 *) (x + 28) = in7 +- movl %ecx,28(%eax) +- # *(uint32 *) (x + 32) = in8 +- movl %ebx,32(%eax) +- # *(uint32 *) (x + 36) = in9 +- movl %esi,36(%eax) +- # eax = eax_stack +- movl 64(%esp),%eax +- # ebx = ebx_stack +- movl 68(%esp),%ebx +- # esi = esi_stack +- movl 72(%esp),%esi +- # edi = edi_stack +- movl 76(%esp),%edi +- # ebp = ebp_stack +- movl 80(%esp),%ebp +- # leave +- add %eax,%esp +- ret +-ENDPROC(salsa20_ivsetup) +diff --git a/arch/x86/crypto/salsa20-x86_64-asm_64.S b/arch/x86/crypto/salsa20-x86_64-asm_64.S +deleted file mode 100644 +index 10db30d58006..000000000000 +--- a/arch/x86/crypto/salsa20-x86_64-asm_64.S ++++ /dev/null +@@ -1,919 +0,0 @@ +-/* SPDX-License-Identifier: GPL-2.0 */ +-#include +- +-# enter salsa20_encrypt_bytes +-ENTRY(salsa20_encrypt_bytes) +- mov %rsp,%r11 +- and $31,%r11 +- add $256,%r11 +- sub %r11,%rsp +- # x = arg1 +- mov %rdi,%r8 +- # m = arg2 +- mov %rsi,%rsi +- # out = arg3 +- mov %rdx,%rdi +- # bytes = arg4 +- mov %rcx,%rdx +- # unsigned>? bytes - 0 +- cmp $0,%rdx +- # comment:fp stack unchanged by jump +- # goto done if !unsigned> +- jbe ._done +- # comment:fp stack unchanged by fallthrough +-# start: +-._start: +- # r11_stack = r11 +- movq %r11,0(%rsp) +- # r12_stack = r12 +- movq %r12,8(%rsp) +- # r13_stack = r13 +- movq %r13,16(%rsp) +- # r14_stack = r14 +- movq %r14,24(%rsp) +- # r15_stack = r15 +- movq %r15,32(%rsp) +- # rbx_stack = rbx +- movq %rbx,40(%rsp) +- # rbp_stack = rbp +- movq %rbp,48(%rsp) +- # in0 = *(uint64 *) (x + 0) +- movq 0(%r8),%rcx +- # in2 = *(uint64 *) (x + 8) +- movq 8(%r8),%r9 +- # in4 = *(uint64 *) (x + 16) +- movq 16(%r8),%rax +- # in6 = *(uint64 *) (x + 24) +- movq 24(%r8),%r10 +- # in8 = *(uint64 *) (x + 32) +- movq 32(%r8),%r11 +- # in10 = *(uint64 *) (x + 40) +- movq 40(%r8),%r12 +- # in12 = *(uint64 *) (x + 48) +- movq 48(%r8),%r13 +- # in14 = *(uint64 *) (x + 56) +- movq 56(%r8),%r14 +- # j0 = in0 +- movq %rcx,56(%rsp) +- # j2 = in2 +- movq %r9,64(%rsp) +- # j4 = in4 +- movq %rax,72(%rsp) +- # j6 = in6 +- movq %r10,80(%rsp) +- # j8 = in8 +- movq %r11,88(%rsp) +- # j10 = in10 +- movq %r12,96(%rsp) +- # j12 = in12 +- movq %r13,104(%rsp) +- # j14 = in14 +- movq %r14,112(%rsp) +- # x_backup = x +- movq %r8,120(%rsp) +-# bytesatleast1: +-._bytesatleast1: +- # unsigned>= 32 +- shr $32,%rdi +- # x3 = j2 +- movq 64(%rsp),%rsi +- # x2 = x3 +- mov %rsi,%rcx +- # (uint64) x3 >>= 32 +- shr $32,%rsi +- # x5 = j4 +- movq 72(%rsp),%r8 +- # x4 = x5 +- mov %r8,%r9 +- # (uint64) x5 >>= 32 +- shr $32,%r8 +- # x5_stack = x5 +- movq %r8,160(%rsp) +- # x7 = j6 +- movq 80(%rsp),%r8 +- # x6 = x7 +- mov %r8,%rax +- # (uint64) x7 >>= 32 +- shr $32,%r8 +- # x9 = j8 +- movq 88(%rsp),%r10 +- # x8 = x9 +- mov %r10,%r11 +- # (uint64) x9 >>= 32 +- shr $32,%r10 +- # x11 = j10 +- movq 96(%rsp),%r12 +- # x10 = x11 +- mov %r12,%r13 +- # x10_stack = x10 +- movq %r13,168(%rsp) +- # (uint64) x11 >>= 32 +- shr $32,%r12 +- # x13 = j12 +- movq 104(%rsp),%r13 +- # x12 = x13 +- mov %r13,%r14 +- # (uint64) x13 >>= 32 +- shr $32,%r13 +- # x15 = j14 +- movq 112(%rsp),%r15 +- # x14 = x15 +- mov %r15,%rbx +- # (uint64) x15 >>= 32 +- shr $32,%r15 +- # x15_stack = x15 +- movq %r15,176(%rsp) +- # i = 20 +- mov $20,%r15 +-# mainloop: +-._mainloop: +- # i_backup = i +- movq %r15,184(%rsp) +- # x5 = x5_stack +- movq 160(%rsp),%r15 +- # a = x12 + x0 +- lea (%r14,%rdx),%rbp +- # (uint32) a <<<= 7 +- rol $7,%ebp +- # x4 ^= a +- xor %rbp,%r9 +- # b = x1 + x5 +- lea (%rdi,%r15),%rbp +- # (uint32) b <<<= 7 +- rol $7,%ebp +- # x9 ^= b +- xor %rbp,%r10 +- # a = x0 + x4 +- lea (%rdx,%r9),%rbp +- # (uint32) a <<<= 9 +- rol $9,%ebp +- # x8 ^= a +- xor %rbp,%r11 +- # b = x5 + x9 +- lea (%r15,%r10),%rbp +- # (uint32) b <<<= 9 +- rol $9,%ebp +- # x13 ^= b +- xor %rbp,%r13 +- # a = x4 + x8 +- lea (%r9,%r11),%rbp +- # (uint32) a <<<= 13 +- rol $13,%ebp +- # x12 ^= a +- xor %rbp,%r14 +- # b = x9 + x13 +- lea (%r10,%r13),%rbp +- # (uint32) b <<<= 13 +- rol $13,%ebp +- # x1 ^= b +- xor %rbp,%rdi +- # a = x8 + x12 +- lea (%r11,%r14),%rbp +- # (uint32) a <<<= 18 +- rol $18,%ebp +- # x0 ^= a +- xor %rbp,%rdx +- # b = x13 + x1 +- lea (%r13,%rdi),%rbp +- # (uint32) b <<<= 18 +- rol $18,%ebp +- # x5 ^= b +- xor %rbp,%r15 +- # x10 = x10_stack +- movq 168(%rsp),%rbp +- # x5_stack = x5 +- movq %r15,160(%rsp) +- # c = x6 + x10 +- lea (%rax,%rbp),%r15 +- # (uint32) c <<<= 7 +- rol $7,%r15d +- # x14 ^= c +- xor %r15,%rbx +- # c = x10 + x14 +- lea (%rbp,%rbx),%r15 +- # (uint32) c <<<= 9 +- rol $9,%r15d +- # x2 ^= c +- xor %r15,%rcx +- # c = x14 + x2 +- lea (%rbx,%rcx),%r15 +- # (uint32) c <<<= 13 +- rol $13,%r15d +- # x6 ^= c +- xor %r15,%rax +- # c = x2 + x6 +- lea (%rcx,%rax),%r15 +- # (uint32) c <<<= 18 +- rol $18,%r15d +- # x10 ^= c +- xor %r15,%rbp +- # x15 = x15_stack +- movq 176(%rsp),%r15 +- # x10_stack = x10 +- movq %rbp,168(%rsp) +- # d = x11 + x15 +- lea (%r12,%r15),%rbp +- # (uint32) d <<<= 7 +- rol $7,%ebp +- # x3 ^= d +- xor %rbp,%rsi +- # d = x15 + x3 +- lea (%r15,%rsi),%rbp +- # (uint32) d <<<= 9 +- rol $9,%ebp +- # x7 ^= d +- xor %rbp,%r8 +- # d = x3 + x7 +- lea (%rsi,%r8),%rbp +- # (uint32) d <<<= 13 +- rol $13,%ebp +- # x11 ^= d +- xor %rbp,%r12 +- # d = x7 + x11 +- lea (%r8,%r12),%rbp +- # (uint32) d <<<= 18 +- rol $18,%ebp +- # x15 ^= d +- xor %rbp,%r15 +- # x15_stack = x15 +- movq %r15,176(%rsp) +- # x5 = x5_stack +- movq 160(%rsp),%r15 +- # a = x3 + x0 +- lea (%rsi,%rdx),%rbp +- # (uint32) a <<<= 7 +- rol $7,%ebp +- # x1 ^= a +- xor %rbp,%rdi +- # b = x4 + x5 +- lea (%r9,%r15),%rbp +- # (uint32) b <<<= 7 +- rol $7,%ebp +- # x6 ^= b +- xor %rbp,%rax +- # a = x0 + x1 +- lea (%rdx,%rdi),%rbp +- # (uint32) a <<<= 9 +- rol $9,%ebp +- # x2 ^= a +- xor %rbp,%rcx +- # b = x5 + x6 +- lea (%r15,%rax),%rbp +- # (uint32) b <<<= 9 +- rol $9,%ebp +- # x7 ^= b +- xor %rbp,%r8 +- # a = x1 + x2 +- lea (%rdi,%rcx),%rbp +- # (uint32) a <<<= 13 +- rol $13,%ebp +- # x3 ^= a +- xor %rbp,%rsi +- # b = x6 + x7 +- lea (%rax,%r8),%rbp +- # (uint32) b <<<= 13 +- rol $13,%ebp +- # x4 ^= b +- xor %rbp,%r9 +- # a = x2 + x3 +- lea (%rcx,%rsi),%rbp +- # (uint32) a <<<= 18 +- rol $18,%ebp +- # x0 ^= a +- xor %rbp,%rdx +- # b = x7 + x4 +- lea (%r8,%r9),%rbp +- # (uint32) b <<<= 18 +- rol $18,%ebp +- # x5 ^= b +- xor %rbp,%r15 +- # x10 = x10_stack +- movq 168(%rsp),%rbp +- # x5_stack = x5 +- movq %r15,160(%rsp) +- # c = x9 + x10 +- lea (%r10,%rbp),%r15 +- # (uint32) c <<<= 7 +- rol $7,%r15d +- # x11 ^= c +- xor %r15,%r12 +- # c = x10 + x11 +- lea (%rbp,%r12),%r15 +- # (uint32) c <<<= 9 +- rol $9,%r15d +- # x8 ^= c +- xor %r15,%r11 +- # c = x11 + x8 +- lea (%r12,%r11),%r15 +- # (uint32) c <<<= 13 +- rol $13,%r15d +- # x9 ^= c +- xor %r15,%r10 +- # c = x8 + x9 +- lea (%r11,%r10),%r15 +- # (uint32) c <<<= 18 +- rol $18,%r15d +- # x10 ^= c +- xor %r15,%rbp +- # x15 = x15_stack +- movq 176(%rsp),%r15 +- # x10_stack = x10 +- movq %rbp,168(%rsp) +- # d = x14 + x15 +- lea (%rbx,%r15),%rbp +- # (uint32) d <<<= 7 +- rol $7,%ebp +- # x12 ^= d +- xor %rbp,%r14 +- # d = x15 + x12 +- lea (%r15,%r14),%rbp +- # (uint32) d <<<= 9 +- rol $9,%ebp +- # x13 ^= d +- xor %rbp,%r13 +- # d = x12 + x13 +- lea (%r14,%r13),%rbp +- # (uint32) d <<<= 13 +- rol $13,%ebp +- # x14 ^= d +- xor %rbp,%rbx +- # d = x13 + x14 +- lea (%r13,%rbx),%rbp +- # (uint32) d <<<= 18 +- rol $18,%ebp +- # x15 ^= d +- xor %rbp,%r15 +- # x15_stack = x15 +- movq %r15,176(%rsp) +- # x5 = x5_stack +- movq 160(%rsp),%r15 +- # a = x12 + x0 +- lea (%r14,%rdx),%rbp +- # (uint32) a <<<= 7 +- rol $7,%ebp +- # x4 ^= a +- xor %rbp,%r9 +- # b = x1 + x5 +- lea (%rdi,%r15),%rbp +- # (uint32) b <<<= 7 +- rol $7,%ebp +- # x9 ^= b +- xor %rbp,%r10 +- # a = x0 + x4 +- lea (%rdx,%r9),%rbp +- # (uint32) a <<<= 9 +- rol $9,%ebp +- # x8 ^= a +- xor %rbp,%r11 +- # b = x5 + x9 +- lea (%r15,%r10),%rbp +- # (uint32) b <<<= 9 +- rol $9,%ebp +- # x13 ^= b +- xor %rbp,%r13 +- # a = x4 + x8 +- lea (%r9,%r11),%rbp +- # (uint32) a <<<= 13 +- rol $13,%ebp +- # x12 ^= a +- xor %rbp,%r14 +- # b = x9 + x13 +- lea (%r10,%r13),%rbp +- # (uint32) b <<<= 13 +- rol $13,%ebp +- # x1 ^= b +- xor %rbp,%rdi +- # a = x8 + x12 +- lea (%r11,%r14),%rbp +- # (uint32) a <<<= 18 +- rol $18,%ebp +- # x0 ^= a +- xor %rbp,%rdx +- # b = x13 + x1 +- lea (%r13,%rdi),%rbp +- # (uint32) b <<<= 18 +- rol $18,%ebp +- # x5 ^= b +- xor %rbp,%r15 +- # x10 = x10_stack +- movq 168(%rsp),%rbp +- # x5_stack = x5 +- movq %r15,160(%rsp) +- # c = x6 + x10 +- lea (%rax,%rbp),%r15 +- # (uint32) c <<<= 7 +- rol $7,%r15d +- # x14 ^= c +- xor %r15,%rbx +- # c = x10 + x14 +- lea (%rbp,%rbx),%r15 +- # (uint32) c <<<= 9 +- rol $9,%r15d +- # x2 ^= c +- xor %r15,%rcx +- # c = x14 + x2 +- lea (%rbx,%rcx),%r15 +- # (uint32) c <<<= 13 +- rol $13,%r15d +- # x6 ^= c +- xor %r15,%rax +- # c = x2 + x6 +- lea (%rcx,%rax),%r15 +- # (uint32) c <<<= 18 +- rol $18,%r15d +- # x10 ^= c +- xor %r15,%rbp +- # x15 = x15_stack +- movq 176(%rsp),%r15 +- # x10_stack = x10 +- movq %rbp,168(%rsp) +- # d = x11 + x15 +- lea (%r12,%r15),%rbp +- # (uint32) d <<<= 7 +- rol $7,%ebp +- # x3 ^= d +- xor %rbp,%rsi +- # d = x15 + x3 +- lea (%r15,%rsi),%rbp +- # (uint32) d <<<= 9 +- rol $9,%ebp +- # x7 ^= d +- xor %rbp,%r8 +- # d = x3 + x7 +- lea (%rsi,%r8),%rbp +- # (uint32) d <<<= 13 +- rol $13,%ebp +- # x11 ^= d +- xor %rbp,%r12 +- # d = x7 + x11 +- lea (%r8,%r12),%rbp +- # (uint32) d <<<= 18 +- rol $18,%ebp +- # x15 ^= d +- xor %rbp,%r15 +- # x15_stack = x15 +- movq %r15,176(%rsp) +- # x5 = x5_stack +- movq 160(%rsp),%r15 +- # a = x3 + x0 +- lea (%rsi,%rdx),%rbp +- # (uint32) a <<<= 7 +- rol $7,%ebp +- # x1 ^= a +- xor %rbp,%rdi +- # b = x4 + x5 +- lea (%r9,%r15),%rbp +- # (uint32) b <<<= 7 +- rol $7,%ebp +- # x6 ^= b +- xor %rbp,%rax +- # a = x0 + x1 +- lea (%rdx,%rdi),%rbp +- # (uint32) a <<<= 9 +- rol $9,%ebp +- # x2 ^= a +- xor %rbp,%rcx +- # b = x5 + x6 +- lea (%r15,%rax),%rbp +- # (uint32) b <<<= 9 +- rol $9,%ebp +- # x7 ^= b +- xor %rbp,%r8 +- # a = x1 + x2 +- lea (%rdi,%rcx),%rbp +- # (uint32) a <<<= 13 +- rol $13,%ebp +- # x3 ^= a +- xor %rbp,%rsi +- # b = x6 + x7 +- lea (%rax,%r8),%rbp +- # (uint32) b <<<= 13 +- rol $13,%ebp +- # x4 ^= b +- xor %rbp,%r9 +- # a = x2 + x3 +- lea (%rcx,%rsi),%rbp +- # (uint32) a <<<= 18 +- rol $18,%ebp +- # x0 ^= a +- xor %rbp,%rdx +- # b = x7 + x4 +- lea (%r8,%r9),%rbp +- # (uint32) b <<<= 18 +- rol $18,%ebp +- # x5 ^= b +- xor %rbp,%r15 +- # x10 = x10_stack +- movq 168(%rsp),%rbp +- # x5_stack = x5 +- movq %r15,160(%rsp) +- # c = x9 + x10 +- lea (%r10,%rbp),%r15 +- # (uint32) c <<<= 7 +- rol $7,%r15d +- # x11 ^= c +- xor %r15,%r12 +- # c = x10 + x11 +- lea (%rbp,%r12),%r15 +- # (uint32) c <<<= 9 +- rol $9,%r15d +- # x8 ^= c +- xor %r15,%r11 +- # c = x11 + x8 +- lea (%r12,%r11),%r15 +- # (uint32) c <<<= 13 +- rol $13,%r15d +- # x9 ^= c +- xor %r15,%r10 +- # c = x8 + x9 +- lea (%r11,%r10),%r15 +- # (uint32) c <<<= 18 +- rol $18,%r15d +- # x10 ^= c +- xor %r15,%rbp +- # x15 = x15_stack +- movq 176(%rsp),%r15 +- # x10_stack = x10 +- movq %rbp,168(%rsp) +- # d = x14 + x15 +- lea (%rbx,%r15),%rbp +- # (uint32) d <<<= 7 +- rol $7,%ebp +- # x12 ^= d +- xor %rbp,%r14 +- # d = x15 + x12 +- lea (%r15,%r14),%rbp +- # (uint32) d <<<= 9 +- rol $9,%ebp +- # x13 ^= d +- xor %rbp,%r13 +- # d = x12 + x13 +- lea (%r14,%r13),%rbp +- # (uint32) d <<<= 13 +- rol $13,%ebp +- # x14 ^= d +- xor %rbp,%rbx +- # d = x13 + x14 +- lea (%r13,%rbx),%rbp +- # (uint32) d <<<= 18 +- rol $18,%ebp +- # x15 ^= d +- xor %rbp,%r15 +- # x15_stack = x15 +- movq %r15,176(%rsp) +- # i = i_backup +- movq 184(%rsp),%r15 +- # unsigned>? i -= 4 +- sub $4,%r15 +- # comment:fp stack unchanged by jump +- # goto mainloop if unsigned> +- ja ._mainloop +- # (uint32) x2 += j2 +- addl 64(%rsp),%ecx +- # x3 <<= 32 +- shl $32,%rsi +- # x3 += j2 +- addq 64(%rsp),%rsi +- # (uint64) x3 >>= 32 +- shr $32,%rsi +- # x3 <<= 32 +- shl $32,%rsi +- # x2 += x3 +- add %rsi,%rcx +- # (uint32) x6 += j6 +- addl 80(%rsp),%eax +- # x7 <<= 32 +- shl $32,%r8 +- # x7 += j6 +- addq 80(%rsp),%r8 +- # (uint64) x7 >>= 32 +- shr $32,%r8 +- # x7 <<= 32 +- shl $32,%r8 +- # x6 += x7 +- add %r8,%rax +- # (uint32) x8 += j8 +- addl 88(%rsp),%r11d +- # x9 <<= 32 +- shl $32,%r10 +- # x9 += j8 +- addq 88(%rsp),%r10 +- # (uint64) x9 >>= 32 +- shr $32,%r10 +- # x9 <<= 32 +- shl $32,%r10 +- # x8 += x9 +- add %r10,%r11 +- # (uint32) x12 += j12 +- addl 104(%rsp),%r14d +- # x13 <<= 32 +- shl $32,%r13 +- # x13 += j12 +- addq 104(%rsp),%r13 +- # (uint64) x13 >>= 32 +- shr $32,%r13 +- # x13 <<= 32 +- shl $32,%r13 +- # x12 += x13 +- add %r13,%r14 +- # (uint32) x0 += j0 +- addl 56(%rsp),%edx +- # x1 <<= 32 +- shl $32,%rdi +- # x1 += j0 +- addq 56(%rsp),%rdi +- # (uint64) x1 >>= 32 +- shr $32,%rdi +- # x1 <<= 32 +- shl $32,%rdi +- # x0 += x1 +- add %rdi,%rdx +- # x5 = x5_stack +- movq 160(%rsp),%rdi +- # (uint32) x4 += j4 +- addl 72(%rsp),%r9d +- # x5 <<= 32 +- shl $32,%rdi +- # x5 += j4 +- addq 72(%rsp),%rdi +- # (uint64) x5 >>= 32 +- shr $32,%rdi +- # x5 <<= 32 +- shl $32,%rdi +- # x4 += x5 +- add %rdi,%r9 +- # x10 = x10_stack +- movq 168(%rsp),%r8 +- # (uint32) x10 += j10 +- addl 96(%rsp),%r8d +- # x11 <<= 32 +- shl $32,%r12 +- # x11 += j10 +- addq 96(%rsp),%r12 +- # (uint64) x11 >>= 32 +- shr $32,%r12 +- # x11 <<= 32 +- shl $32,%r12 +- # x10 += x11 +- add %r12,%r8 +- # x15 = x15_stack +- movq 176(%rsp),%rdi +- # (uint32) x14 += j14 +- addl 112(%rsp),%ebx +- # x15 <<= 32 +- shl $32,%rdi +- # x15 += j14 +- addq 112(%rsp),%rdi +- # (uint64) x15 >>= 32 +- shr $32,%rdi +- # x15 <<= 32 +- shl $32,%rdi +- # x14 += x15 +- add %rdi,%rbx +- # out = out_backup +- movq 136(%rsp),%rdi +- # m = m_backup +- movq 144(%rsp),%rsi +- # x0 ^= *(uint64 *) (m + 0) +- xorq 0(%rsi),%rdx +- # *(uint64 *) (out + 0) = x0 +- movq %rdx,0(%rdi) +- # x2 ^= *(uint64 *) (m + 8) +- xorq 8(%rsi),%rcx +- # *(uint64 *) (out + 8) = x2 +- movq %rcx,8(%rdi) +- # x4 ^= *(uint64 *) (m + 16) +- xorq 16(%rsi),%r9 +- # *(uint64 *) (out + 16) = x4 +- movq %r9,16(%rdi) +- # x6 ^= *(uint64 *) (m + 24) +- xorq 24(%rsi),%rax +- # *(uint64 *) (out + 24) = x6 +- movq %rax,24(%rdi) +- # x8 ^= *(uint64 *) (m + 32) +- xorq 32(%rsi),%r11 +- # *(uint64 *) (out + 32) = x8 +- movq %r11,32(%rdi) +- # x10 ^= *(uint64 *) (m + 40) +- xorq 40(%rsi),%r8 +- # *(uint64 *) (out + 40) = x10 +- movq %r8,40(%rdi) +- # x12 ^= *(uint64 *) (m + 48) +- xorq 48(%rsi),%r14 +- # *(uint64 *) (out + 48) = x12 +- movq %r14,48(%rdi) +- # x14 ^= *(uint64 *) (m + 56) +- xorq 56(%rsi),%rbx +- # *(uint64 *) (out + 56) = x14 +- movq %rbx,56(%rdi) +- # bytes = bytes_backup +- movq 152(%rsp),%rdx +- # in8 = j8 +- movq 88(%rsp),%rcx +- # in8 += 1 +- add $1,%rcx +- # j8 = in8 +- movq %rcx,88(%rsp) +- # unsigned>? unsigned +- ja ._bytesatleast65 +- # comment:fp stack unchanged by jump +- # goto bytesatleast64 if !unsigned< +- jae ._bytesatleast64 +- # m = out +- mov %rdi,%rsi +- # out = ctarget +- movq 128(%rsp),%rdi +- # i = bytes +- mov %rdx,%rcx +- # while (i) { *out++ = *m++; --i } +- rep movsb +- # comment:fp stack unchanged by fallthrough +-# bytesatleast64: +-._bytesatleast64: +- # x = x_backup +- movq 120(%rsp),%rdi +- # in8 = j8 +- movq 88(%rsp),%rsi +- # *(uint64 *) (x + 32) = in8 +- movq %rsi,32(%rdi) +- # r11 = r11_stack +- movq 0(%rsp),%r11 +- # r12 = r12_stack +- movq 8(%rsp),%r12 +- # r13 = r13_stack +- movq 16(%rsp),%r13 +- # r14 = r14_stack +- movq 24(%rsp),%r14 +- # r15 = r15_stack +- movq 32(%rsp),%r15 +- # rbx = rbx_stack +- movq 40(%rsp),%rbx +- # rbp = rbp_stack +- movq 48(%rsp),%rbp +- # comment:fp stack unchanged by fallthrough +-# done: +-._done: +- # leave +- add %r11,%rsp +- mov %rdi,%rax +- mov %rsi,%rdx +- ret +-# bytesatleast65: +-._bytesatleast65: +- # bytes -= 64 +- sub $64,%rdx +- # out += 64 +- add $64,%rdi +- # m += 64 +- add $64,%rsi +- # comment:fp stack unchanged by jump +- # goto bytesatleast1 +- jmp ._bytesatleast1 +-ENDPROC(salsa20_encrypt_bytes) +- +-# enter salsa20_keysetup +-ENTRY(salsa20_keysetup) +- mov %rsp,%r11 +- and $31,%r11 +- add $256,%r11 +- sub %r11,%rsp +- # k = arg2 +- mov %rsi,%rsi +- # kbits = arg3 +- mov %rdx,%rdx +- # x = arg1 +- mov %rdi,%rdi +- # in0 = *(uint64 *) (k + 0) +- movq 0(%rsi),%r8 +- # in2 = *(uint64 *) (k + 8) +- movq 8(%rsi),%r9 +- # *(uint64 *) (x + 4) = in0 +- movq %r8,4(%rdi) +- # *(uint64 *) (x + 12) = in2 +- movq %r9,12(%rdi) +- # unsigned +- * +- * The assembly codes are public domain assembly codes written by Daniel. J. +- * Bernstein . The codes are modified to include indentation +- * and to remove extraneous comments and functions that are not needed. +- * - i586 version, renamed as salsa20-i586-asm_32.S +- * available from +- * - x86-64 version, renamed as salsa20-x86_64-asm_64.S +- * available from +- * +- * This program is free software; you can redistribute it and/or modify it +- * under the terms of the GNU General Public License as published by the Free +- * Software Foundation; either version 2 of the License, or (at your option) +- * any later version. +- * +- */ +- +-#include +-#include +-#include +- +-#define SALSA20_IV_SIZE 8U +-#define SALSA20_MIN_KEY_SIZE 16U +-#define SALSA20_MAX_KEY_SIZE 32U +- +-struct salsa20_ctx +-{ +- u32 input[16]; +-}; +- +-asmlinkage void salsa20_keysetup(struct salsa20_ctx *ctx, const u8 *k, +- u32 keysize, u32 ivsize); +-asmlinkage void salsa20_ivsetup(struct salsa20_ctx *ctx, const u8 *iv); +-asmlinkage void salsa20_encrypt_bytes(struct salsa20_ctx *ctx, +- const u8 *src, u8 *dst, u32 bytes); +- +-static int setkey(struct crypto_tfm *tfm, const u8 *key, +- unsigned int keysize) +-{ +- struct salsa20_ctx *ctx = crypto_tfm_ctx(tfm); +- salsa20_keysetup(ctx, key, keysize*8, SALSA20_IV_SIZE*8); +- return 0; +-} +- +-static int encrypt(struct blkcipher_desc *desc, +- struct scatterlist *dst, struct scatterlist *src, +- unsigned int nbytes) +-{ +- struct blkcipher_walk walk; +- struct crypto_blkcipher *tfm = desc->tfm; +- struct salsa20_ctx *ctx = crypto_blkcipher_ctx(tfm); +- int err; +- +- blkcipher_walk_init(&walk, dst, src, nbytes); +- err = blkcipher_walk_virt_block(desc, &walk, 64); +- +- salsa20_ivsetup(ctx, walk.iv); +- +- while (walk.nbytes >= 64) { +- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, +- walk.dst.virt.addr, +- walk.nbytes - (walk.nbytes % 64)); +- err = blkcipher_walk_done(desc, &walk, walk.nbytes % 64); +- } +- +- if (walk.nbytes) { +- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, +- walk.dst.virt.addr, walk.nbytes); +- err = blkcipher_walk_done(desc, &walk, 0); +- } +- +- return err; +-} +- +-static struct crypto_alg alg = { +- .cra_name = "salsa20", +- .cra_driver_name = "salsa20-asm", +- .cra_priority = 200, +- .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER, +- .cra_type = &crypto_blkcipher_type, +- .cra_blocksize = 1, +- .cra_ctxsize = sizeof(struct salsa20_ctx), +- .cra_alignmask = 3, +- .cra_module = THIS_MODULE, +- .cra_u = { +- .blkcipher = { +- .setkey = setkey, +- .encrypt = encrypt, +- .decrypt = encrypt, +- .min_keysize = SALSA20_MIN_KEY_SIZE, +- .max_keysize = SALSA20_MAX_KEY_SIZE, +- .ivsize = SALSA20_IV_SIZE, +- } +- } +-}; +- +-static int __init init(void) +-{ +- return crypto_register_alg(&alg); +-} +- +-static void __exit fini(void) +-{ +- crypto_unregister_alg(&alg); +-} +- +-module_init(init); +-module_exit(fini); +- +-MODULE_LICENSE("GPL"); +-MODULE_DESCRIPTION ("Salsa20 stream cipher algorithm (optimized assembly version)"); +-MODULE_ALIAS_CRYPTO("salsa20"); +-MODULE_ALIAS_CRYPTO("salsa20-asm"); +diff --git a/arch/x86/kernel/uprobes.c b/arch/x86/kernel/uprobes.c +index e1ea13ae53b9..b9a8f34b5e5a 100644 +--- a/arch/x86/kernel/uprobes.c ++++ b/arch/x86/kernel/uprobes.c +@@ -290,7 +290,7 @@ static int uprobe_init_insn(struct arch_uprobe *auprobe, struct insn *insn, bool + insn_init(insn, auprobe->insn, sizeof(auprobe->insn), x86_64); + /* has the side-effect of processing the entire instruction */ + insn_get_length(insn); +- if (WARN_ON_ONCE(!insn_complete(insn))) ++ if (!insn_complete(insn)) + return -ENOEXEC; + + if (is_prefix_bad(insn)) +diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c +index fcd8789470d1..fd173e6425cc 100644 +--- a/arch/x86/xen/enlighten_pv.c ++++ b/arch/x86/xen/enlighten_pv.c +@@ -1230,12 +1230,20 @@ asmlinkage __visible void __init xen_start_kernel(void) + + xen_setup_features(); + +- xen_setup_machphys_mapping(); +- + /* Install Xen paravirt ops */ + pv_info = xen_info; + pv_init_ops.patch = paravirt_patch_default; + pv_cpu_ops = xen_cpu_ops; ++ xen_init_irq_ops(); ++ ++ /* ++ * Setup xen_vcpu early because it is needed for ++ * local_irq_disable(), irqs_disabled(), e.g. in printk(). ++ * ++ * Don't do the full vcpu_info placement stuff until we have ++ * the cpu_possible_mask and a non-dummy shared_info. ++ */ ++ xen_vcpu_info_reset(0); + + x86_platform.get_nmi_reason = xen_get_nmi_reason; + +@@ -1247,6 +1255,7 @@ asmlinkage __visible void __init xen_start_kernel(void) + * Set up some pagetable state before starting to set any ptes. + */ + ++ xen_setup_machphys_mapping(); + xen_init_mmu_ops(); + + /* Prevent unwanted bits from being set in PTEs. */ +@@ -1271,20 +1280,9 @@ asmlinkage __visible void __init xen_start_kernel(void) + get_cpu_cap(&boot_cpu_data); + x86_configure_nx(); + +- xen_init_irq_ops(); +- + /* Let's presume PV guests always boot on vCPU with id 0. */ + per_cpu(xen_vcpu_id, 0) = 0; + +- /* +- * Setup xen_vcpu early because idt_setup_early_handler needs it for +- * local_irq_disable(), irqs_disabled(). +- * +- * Don't do the full vcpu_info placement stuff until we have +- * the cpu_possible_mask and a non-dummy shared_info. +- */ +- xen_vcpu_info_reset(0); +- + idt_setup_early_handler(); + + xen_init_capabilities(); +diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c +index 74179852e46c..7515a19fd324 100644 +--- a/arch/x86/xen/irq.c ++++ b/arch/x86/xen/irq.c +@@ -128,8 +128,6 @@ static const struct pv_irq_ops xen_irq_ops __initconst = { + + void __init xen_init_irq_ops(void) + { +- /* For PVH we use default pv_irq_ops settings. */ +- if (!xen_feature(XENFEAT_hvm_callback_vector)) +- pv_irq_ops = xen_irq_ops; ++ pv_irq_ops = xen_irq_ops; + x86_init.irqs.intr_init = xen_init_IRQ; + } +diff --git a/crypto/Kconfig b/crypto/Kconfig +index 42212b60a0ee..5579eb88d460 100644 +--- a/crypto/Kconfig ++++ b/crypto/Kconfig +@@ -1324,32 +1324,6 @@ config CRYPTO_SALSA20 + The Salsa20 stream cipher algorithm is designed by Daniel J. + Bernstein . See + +-config CRYPTO_SALSA20_586 +- tristate "Salsa20 stream cipher algorithm (i586)" +- depends on (X86 || UML_X86) && !64BIT +- select CRYPTO_BLKCIPHER +- help +- Salsa20 stream cipher algorithm. +- +- Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT +- Stream Cipher Project. See +- +- The Salsa20 stream cipher algorithm is designed by Daniel J. +- Bernstein . See +- +-config CRYPTO_SALSA20_X86_64 +- tristate "Salsa20 stream cipher algorithm (x86_64)" +- depends on (X86 || UML_X86) && 64BIT +- select CRYPTO_BLKCIPHER +- help +- Salsa20 stream cipher algorithm. +- +- Salsa20 is a stream cipher submitted to eSTREAM, the ECRYPT +- Stream Cipher Project. See +- +- The Salsa20 stream cipher algorithm is designed by Daniel J. +- Bernstein . See +- + config CRYPTO_CHACHA20 + tristate "ChaCha20 cipher algorithm" + select CRYPTO_BLKCIPHER +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 75eb50041c99..f003e301723a 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -1267,6 +1267,59 @@ static bool ahci_broken_suspend(struct pci_dev *pdev) + return strcmp(buf, dmi->driver_data) < 0; + } + ++static bool ahci_broken_lpm(struct pci_dev *pdev) ++{ ++ static const struct dmi_system_id sysids[] = { ++ /* Various Lenovo 50 series have LPM issues with older BIOSen */ ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad X250"), ++ }, ++ .driver_data = "20180406", /* 1.31 */ ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L450"), ++ }, ++ .driver_data = "20180420", /* 1.28 */ ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T450s"), ++ }, ++ .driver_data = "20180315", /* 1.33 */ ++ }, ++ { ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad W541"), ++ }, ++ /* ++ * Note date based on release notes, 2.35 has been ++ * reported to be good, but I've been unable to get ++ * a hold of the reporter to get the DMI BIOS date. ++ * TODO: fix this. ++ */ ++ .driver_data = "20180310", /* 2.35 */ ++ }, ++ { } /* terminate list */ ++ }; ++ const struct dmi_system_id *dmi = dmi_first_match(sysids); ++ int year, month, date; ++ char buf[9]; ++ ++ if (!dmi) ++ return false; ++ ++ dmi_get_date(DMI_BIOS_DATE, &year, &month, &date); ++ snprintf(buf, sizeof(buf), "%04d%02d%02d", year, month, date); ++ ++ return strcmp(buf, dmi->driver_data) < 0; ++} ++ + static bool ahci_broken_online(struct pci_dev *pdev) + { + #define ENCODE_BUSDEVFN(bus, slot, func) \ +@@ -1677,6 +1730,12 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + "quirky BIOS, skipping spindown on poweroff\n"); + } + ++ if (ahci_broken_lpm(pdev)) { ++ pi.flags |= ATA_FLAG_NO_LPM; ++ dev_warn(&pdev->dev, ++ "BIOS update required for Link Power Management support\n"); ++ } ++ + if (ahci_broken_suspend(pdev)) { + hpriv->flags |= AHCI_HFLAG_NO_SUSPEND; + dev_warn(&pdev->dev, +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index cad2530a5b52..6938bd86ff1c 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -2501,6 +2501,9 @@ int ata_dev_configure(struct ata_device *dev) + (id[ATA_ID_SATA_CAPABILITY] & 0xe) == 0x2) + dev->horkage |= ATA_HORKAGE_NOLPM; + ++ if (ap->flags & ATA_FLAG_NO_LPM) ++ dev->horkage |= ATA_HORKAGE_NOLPM; ++ + if (dev->horkage & ATA_HORKAGE_NOLPM) { + ata_dev_warn(dev, "LPM support broken, forcing max_power\n"); + dev->link->ap->target_lpm_policy = ATA_LPM_MAX_POWER; +diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c +index 6b0440a12c51..bf5777bc04d3 100644 +--- a/drivers/ata/libata-scsi.c ++++ b/drivers/ata/libata-scsi.c +@@ -3801,10 +3801,20 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) + */ + goto invalid_param_len; + } +- if (block > dev->n_sectors) +- goto out_of_range; + + all = cdb[14] & 0x1; ++ if (all) { ++ /* ++ * Ignore the block address (zone ID) as defined by ZBC. ++ */ ++ block = 0; ++ } else if (block >= dev->n_sectors) { ++ /* ++ * Block must be a valid zone ID (a zone start LBA). ++ */ ++ fp = 2; ++ goto invalid_fld; ++ } + + if (ata_ncq_enabled(qc->dev) && + ata_fpdma_zac_mgmt_out_supported(qc->dev)) { +@@ -3833,10 +3843,6 @@ static unsigned int ata_scsi_zbc_out_xlat(struct ata_queued_cmd *qc) + invalid_fld: + ata_scsi_set_invalid_field(qc->dev, scmd, fp, 0xff); + return 1; +- out_of_range: +- /* "Logical Block Address out of range" */ +- ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x21, 0x00); +- return 1; + invalid_param_len: + /* "Parameter list length error" */ + ata_scsi_set_sense(qc->dev, scmd, ILLEGAL_REQUEST, 0x1a, 0x0); +diff --git a/drivers/block/loop.c b/drivers/block/loop.c +index 1a87f87c88d0..6d61633a7f89 100644 +--- a/drivers/block/loop.c ++++ b/drivers/block/loop.c +@@ -617,6 +617,36 @@ static void loop_reread_partitions(struct loop_device *lo, + __func__, lo->lo_number, lo->lo_file_name, rc); + } + ++static inline int is_loop_device(struct file *file) ++{ ++ struct inode *i = file->f_mapping->host; ++ ++ return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR; ++} ++ ++static int loop_validate_file(struct file *file, struct block_device *bdev) ++{ ++ struct inode *inode = file->f_mapping->host; ++ struct file *f = file; ++ ++ /* Avoid recursion */ ++ while (is_loop_device(f)) { ++ struct loop_device *l; ++ ++ if (f->f_mapping->host->i_bdev == bdev) ++ return -EBADF; ++ ++ l = f->f_mapping->host->i_bdev->bd_disk->private_data; ++ if (l->lo_state == Lo_unbound) { ++ return -EINVAL; ++ } ++ f = l->lo_backing_file; ++ } ++ if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) ++ return -EINVAL; ++ return 0; ++} ++ + /* + * loop_change_fd switched the backing store of a loopback device to + * a new file. This is useful for operating system installers to free up +@@ -646,14 +676,15 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + if (!file) + goto out; + ++ error = loop_validate_file(file, bdev); ++ if (error) ++ goto out_putf; ++ + inode = file->f_mapping->host; + old_file = lo->lo_backing_file; + + error = -EINVAL; + +- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) +- goto out_putf; +- + /* size of the new backing store needs to be the same */ + if (get_loop_size(lo, file) != get_loop_size(lo, old_file)) + goto out_putf; +@@ -679,13 +710,6 @@ static int loop_change_fd(struct loop_device *lo, struct block_device *bdev, + return error; + } + +-static inline int is_loop_device(struct file *file) +-{ +- struct inode *i = file->f_mapping->host; +- +- return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR; +-} +- + /* loop sysfs attributes */ + + static ssize_t loop_attr_show(struct device *dev, char *page, +@@ -782,16 +806,17 @@ static struct attribute_group loop_attribute_group = { + .attrs= loop_attrs, + }; + +-static int loop_sysfs_init(struct loop_device *lo) ++static void loop_sysfs_init(struct loop_device *lo) + { +- return sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj, +- &loop_attribute_group); ++ lo->sysfs_inited = !sysfs_create_group(&disk_to_dev(lo->lo_disk)->kobj, ++ &loop_attribute_group); + } + + static void loop_sysfs_exit(struct loop_device *lo) + { +- sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj, +- &loop_attribute_group); ++ if (lo->sysfs_inited) ++ sysfs_remove_group(&disk_to_dev(lo->lo_disk)->kobj, ++ &loop_attribute_group); + } + + static void loop_config_discard(struct loop_device *lo) +@@ -850,7 +875,7 @@ static int loop_prepare_queue(struct loop_device *lo) + static int loop_set_fd(struct loop_device *lo, fmode_t mode, + struct block_device *bdev, unsigned int arg) + { +- struct file *file, *f; ++ struct file *file; + struct inode *inode; + struct address_space *mapping; + int lo_flags = 0; +@@ -869,29 +894,13 @@ static int loop_set_fd(struct loop_device *lo, fmode_t mode, + if (lo->lo_state != Lo_unbound) + goto out_putf; + +- /* Avoid recursion */ +- f = file; +- while (is_loop_device(f)) { +- struct loop_device *l; +- +- if (f->f_mapping->host->i_bdev == bdev) +- goto out_putf; +- +- l = f->f_mapping->host->i_bdev->bd_disk->private_data; +- if (l->lo_state == Lo_unbound) { +- error = -EINVAL; +- goto out_putf; +- } +- f = l->lo_backing_file; +- } ++ error = loop_validate_file(file, bdev); ++ if (error) ++ goto out_putf; + + mapping = file->f_mapping; + inode = mapping->host; + +- error = -EINVAL; +- if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) +- goto out_putf; +- + if (!(file->f_mode & FMODE_WRITE) || !(mode & FMODE_WRITE) || + !file->f_op->write_iter) + lo_flags |= LO_FLAGS_READ_ONLY; +diff --git a/drivers/block/loop.h b/drivers/block/loop.h +index 1f3956702993..dfc54ceba410 100644 +--- a/drivers/block/loop.h ++++ b/drivers/block/loop.h +@@ -58,6 +58,7 @@ struct loop_device { + struct kthread_worker worker; + struct task_struct *worker_task; + bool use_dio; ++ bool sysfs_inited; + + struct request_queue *lo_queue; + struct blk_mq_tag_set tag_set; +diff --git a/drivers/i2c/busses/i2c-tegra.c b/drivers/i2c/busses/i2c-tegra.c +index 60292d243e24..ec2d11af6c78 100644 +--- a/drivers/i2c/busses/i2c-tegra.c ++++ b/drivers/i2c/busses/i2c-tegra.c +@@ -547,6 +547,14 @@ static int tegra_i2c_disable_packet_mode(struct tegra_i2c_dev *i2c_dev) + { + u32 cnfg; + ++ /* ++ * NACK interrupt is generated before the I2C controller generates ++ * the STOP condition on the bus. So wait for 2 clock periods ++ * before disabling the controller so that the STOP condition has ++ * been delivered properly. ++ */ ++ udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate)); ++ + cnfg = i2c_readl(i2c_dev, I2C_CNFG); + if (cnfg & I2C_CNFG_PACKET_MODE_EN) + i2c_writel(i2c_dev, cnfg & ~I2C_CNFG_PACKET_MODE_EN, I2C_CNFG); +@@ -708,15 +716,6 @@ static int tegra_i2c_xfer_msg(struct tegra_i2c_dev *i2c_dev, + if (likely(i2c_dev->msg_err == I2C_ERR_NONE)) + return 0; + +- /* +- * NACK interrupt is generated before the I2C controller generates +- * the STOP condition on the bus. So wait for 2 clock periods +- * before resetting the controller so that the STOP condition has +- * been delivered properly. +- */ +- if (i2c_dev->msg_err == I2C_ERR_NO_ACK) +- udelay(DIV_ROUND_UP(2 * 1000000, i2c_dev->bus_clk_rate)); +- + tegra_i2c_init(i2c_dev); + if (i2c_dev->msg_err == I2C_ERR_NO_ACK) { + if (msg->flags & I2C_M_IGNORE_NAK) +diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig +index 7507cc641de3..27b3c39e586a 100644 +--- a/drivers/infiniband/Kconfig ++++ b/drivers/infiniband/Kconfig +@@ -34,6 +34,18 @@ config INFINIBAND_USER_ACCESS + libibverbs, libibcm and a hardware driver library from + . + ++config INFINIBAND_USER_ACCESS_UCM ++ bool "Userspace CM (UCM, DEPRECATED)" ++ depends on BROKEN ++ depends on INFINIBAND_USER_ACCESS ++ help ++ The UCM module has known security flaws, which no one is ++ interested to fix. The user-space part of this code was ++ dropped from the upstream a long time ago. ++ ++ This option is DEPRECATED and planned to be removed. ++ ++ + config INFINIBAND_EXP_USER_ACCESS + bool "Allow experimental support for Infiniband ABI" + depends on INFINIBAND_USER_ACCESS +diff --git a/drivers/infiniband/core/Makefile b/drivers/infiniband/core/Makefile +index 9c0a2b5c834e..991c2522fb41 100644 +--- a/drivers/infiniband/core/Makefile ++++ b/drivers/infiniband/core/Makefile +@@ -5,8 +5,8 @@ user_access-$(CONFIG_INFINIBAND_ADDR_TRANS) := rdma_ucm.o + obj-$(CONFIG_INFINIBAND) += ib_core.o ib_cm.o iw_cm.o \ + $(infiniband-y) + obj-$(CONFIG_INFINIBAND_USER_MAD) += ib_umad.o +-obj-$(CONFIG_INFINIBAND_USER_ACCESS) += ib_uverbs.o ib_ucm.o \ +- $(user_access-y) ++obj-$(CONFIG_INFINIBAND_USER_ACCESS) += ib_uverbs.o $(user_access-y) ++obj-$(CONFIG_INFINIBAND_USER_ACCESS_UCM) += ib_ucm.o $(user_access-y) + + ib_core-y := packer.o ud_header.o verbs.o cq.o rw.o sysfs.o \ + device.o fmr_pool.o cache.o netlink.o \ +diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c +index c2fba76becd4..b5784cb145f5 100644 +--- a/drivers/infiniband/hw/cxgb4/mem.c ++++ b/drivers/infiniband/hw/cxgb4/mem.c +@@ -720,7 +720,7 @@ static int c4iw_set_page(struct ib_mr *ibmr, u64 addr) + { + struct c4iw_mr *mhp = to_c4iw_mr(ibmr); + +- if (unlikely(mhp->mpl_len == mhp->max_mpl_len)) ++ if (unlikely(mhp->mpl_len == mhp->attr.pbl_size)) + return -ENOMEM; + + mhp->mpl[mhp->mpl_len++] = addr; +diff --git a/drivers/infiniband/hw/hfi1/rc.c b/drivers/infiniband/hw/hfi1/rc.c +index 84c6a6ff4a67..818bac1a4056 100644 +--- a/drivers/infiniband/hw/hfi1/rc.c ++++ b/drivers/infiniband/hw/hfi1/rc.c +@@ -273,7 +273,7 @@ int hfi1_make_rc_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps) + + lockdep_assert_held(&qp->s_lock); + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + ps->s_txreq->phdr.hdr.hdr_type = priv->hdr_type; +diff --git a/drivers/infiniband/hw/hfi1/uc.c b/drivers/infiniband/hw/hfi1/uc.c +index 0b646173ca22..92e033fbb048 100644 +--- a/drivers/infiniband/hw/hfi1/uc.c ++++ b/drivers/infiniband/hw/hfi1/uc.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -72,7 +72,7 @@ int hfi1_make_uc_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps) + int middle = 0; + + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_SEND_OK)) { +diff --git a/drivers/infiniband/hw/hfi1/ud.c b/drivers/infiniband/hw/hfi1/ud.c +index 38c7d9c456fe..37abd150fad3 100644 +--- a/drivers/infiniband/hw/hfi1/ud.c ++++ b/drivers/infiniband/hw/hfi1/ud.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2015, 2016 Intel Corporation. ++ * Copyright(c) 2015 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -479,7 +479,7 @@ int hfi1_make_ud_req(struct rvt_qp *qp, struct hfi1_pkt_state *ps) + u32 lid; + + ps->s_txreq = get_txreq(ps->dev, qp); +- if (IS_ERR(ps->s_txreq)) ++ if (!ps->s_txreq) + goto bail_no_tx; + + if (!(ib_rvt_state_ops[qp->state] & RVT_PROCESS_NEXT_SEND_OK)) { +diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.c b/drivers/infiniband/hw/hfi1/verbs_txreq.c +index 873e48ea923f..c4ab2d5b4502 100644 +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.c ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.c +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2016 - 2017 Intel Corporation. ++ * Copyright(c) 2016 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -94,7 +94,7 @@ struct verbs_txreq *__get_txreq(struct hfi1_ibdev *dev, + struct rvt_qp *qp) + __must_hold(&qp->s_lock) + { +- struct verbs_txreq *tx = ERR_PTR(-EBUSY); ++ struct verbs_txreq *tx = NULL; + + write_seqlock(&dev->txwait_lock); + if (ib_rvt_state_ops[qp->state] & RVT_PROCESS_RECV_OK) { +diff --git a/drivers/infiniband/hw/hfi1/verbs_txreq.h b/drivers/infiniband/hw/hfi1/verbs_txreq.h +index 76216f2ef35a..22fc5ddf01ca 100644 +--- a/drivers/infiniband/hw/hfi1/verbs_txreq.h ++++ b/drivers/infiniband/hw/hfi1/verbs_txreq.h +@@ -1,5 +1,5 @@ + /* +- * Copyright(c) 2016 Intel Corporation. ++ * Copyright(c) 2016 - 2018 Intel Corporation. + * + * This file is provided under a dual BSD/GPLv2 license. When using or + * redistributing this file, you may do so under either license. +@@ -83,7 +83,7 @@ static inline struct verbs_txreq *get_txreq(struct hfi1_ibdev *dev, + if (unlikely(!tx)) { + /* call slow path to get the lock */ + tx = __get_txreq(dev, qp); +- if (IS_ERR(tx)) ++ if (!tx) + return tx; + } + tx->qp = qp; +diff --git a/drivers/media/rc/ir-mce_kbd-decoder.c b/drivers/media/rc/ir-mce_kbd-decoder.c +index 7c572a643656..2a1728edb3c6 100644 +--- a/drivers/media/rc/ir-mce_kbd-decoder.c ++++ b/drivers/media/rc/ir-mce_kbd-decoder.c +@@ -130,6 +130,8 @@ static void mce_kbd_rx_timeout(unsigned long data) + + for (i = 0; i < MCIR2_MASK_KEYS_START; i++) + input_report_key(mce_kbd->idev, kbd_keycodes[i], 0); ++ ++ input_sync(mce_kbd->idev); + } + + static enum mce_kbd_mode mce_kbd_mode(struct mce_kbd_dec *data) +diff --git a/drivers/misc/ibmasm/ibmasmfs.c b/drivers/misc/ibmasm/ibmasmfs.c +index e05c3245930a..fa840666bdd1 100644 +--- a/drivers/misc/ibmasm/ibmasmfs.c ++++ b/drivers/misc/ibmasm/ibmasmfs.c +@@ -507,35 +507,14 @@ static int remote_settings_file_close(struct inode *inode, struct file *file) + static ssize_t remote_settings_file_read(struct file *file, char __user *buf, size_t count, loff_t *offset) + { + void __iomem *address = (void __iomem *)file->private_data; +- unsigned char *page; +- int retval; + int len = 0; + unsigned int value; +- +- if (*offset < 0) +- return -EINVAL; +- if (count == 0 || count > 1024) +- return 0; +- if (*offset != 0) +- return 0; +- +- page = (unsigned char *)__get_free_page(GFP_KERNEL); +- if (!page) +- return -ENOMEM; ++ char lbuf[20]; + + value = readl(address); +- len = sprintf(page, "%d\n", value); +- +- if (copy_to_user(buf, page, len)) { +- retval = -EFAULT; +- goto exit; +- } +- *offset += len; +- retval = len; ++ len = snprintf(lbuf, sizeof(lbuf), "%d\n", value); + +-exit: +- free_page((unsigned long)page); +- return retval; ++ return simple_read_from_buffer(buf, count, offset, lbuf, len); + } + + static ssize_t remote_settings_file_write(struct file *file, const char __user *ubuff, size_t count, loff_t *offset) +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index efd733472a35..56c6f79a5c5a 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -467,7 +467,7 @@ static int vmballoon_send_batched_lock(struct vmballoon *b, + unsigned int num_pages, bool is_2m_pages, unsigned int *target) + { + unsigned long status; +- unsigned long pfn = page_to_pfn(b->page); ++ unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page)); + + STATS_INC(b->stats.lock[is_2m_pages]); + +@@ -515,7 +515,7 @@ static bool vmballoon_send_batched_unlock(struct vmballoon *b, + unsigned int num_pages, bool is_2m_pages, unsigned int *target) + { + unsigned long status; +- unsigned long pfn = page_to_pfn(b->page); ++ unsigned long pfn = PHYS_PFN(virt_to_phys(b->batch_page)); + + STATS_INC(b->stats.unlock[is_2m_pages]); + +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index de31e20dc56c..6a2cbbba29aa 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -1089,8 +1089,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct mmc_data *data) + * It's used when HS400 mode is enabled. + */ + if (data->flags & MMC_DATA_WRITE && +- !(host->timing != MMC_TIMING_MMC_HS400)) +- return; ++ host->timing != MMC_TIMING_MMC_HS400) ++ goto disable; + + if (data->flags & MMC_DATA_WRITE) + enable = SDMMC_CARD_WR_THR_EN; +@@ -1098,7 +1098,8 @@ static void dw_mci_ctrl_thld(struct dw_mci *host, struct mmc_data *data) + enable = SDMMC_CARD_RD_THR_EN; + + if (host->timing != MMC_TIMING_MMC_HS200 && +- host->timing != MMC_TIMING_UHS_SDR104) ++ host->timing != MMC_TIMING_UHS_SDR104 && ++ host->timing != MMC_TIMING_MMC_HS400) + goto disable; + + blksz_depth = blksz / (1 << host->data_shift); +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c +index 8b941f814472..c81de2f25281 100644 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c +@@ -305,6 +305,15 @@ static u32 esdhc_readl_le(struct sdhci_host *host, int reg) + + if (imx_data->socdata->flags & ESDHC_FLAG_HS400) + val |= SDHCI_SUPPORT_HS400; ++ ++ /* ++ * Do not advertise faster UHS modes if there are no ++ * pinctrl states for 100MHz/200MHz. ++ */ ++ if (IS_ERR_OR_NULL(imx_data->pins_100mhz) || ++ IS_ERR_OR_NULL(imx_data->pins_200mhz)) ++ val &= ~(SDHCI_SUPPORT_SDR50 | SDHCI_SUPPORT_DDR50 ++ | SDHCI_SUPPORT_SDR104 | SDHCI_SUPPORT_HS400); + } + } + +@@ -1135,18 +1144,6 @@ sdhci_esdhc_imx_probe_dt(struct platform_device *pdev, + ESDHC_PINCTRL_STATE_100MHZ); + imx_data->pins_200mhz = pinctrl_lookup_state(imx_data->pinctrl, + ESDHC_PINCTRL_STATE_200MHZ); +- if (IS_ERR(imx_data->pins_100mhz) || +- IS_ERR(imx_data->pins_200mhz)) { +- dev_warn(mmc_dev(host->mmc), +- "could not get ultra high speed state, work on normal mode\n"); +- /* +- * fall back to not supporting uhs by specifying no +- * 1.8v quirk +- */ +- host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V; +- } +- } else { +- host->quirks2 |= SDHCI_QUIRK2_NO_1_8_V; + } + + /* call to generic mmc_of_parse to support additional capabilities */ +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 3d4724e38aa9..4cac4755abef 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -1233,17 +1233,15 @@ static int nvme_cmb_qdepth(struct nvme_dev *dev, int nr_io_queues, + static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, + int qid, int depth) + { +- if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) { +- unsigned offset = (qid - 1) * roundup(SQ_SIZE(depth), +- dev->ctrl.page_size); +- nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; +- nvmeq->sq_cmds_io = dev->cmb + offset; +- } else { +- nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), +- &nvmeq->sq_dma_addr, GFP_KERNEL); +- if (!nvmeq->sq_cmds) +- return -ENOMEM; +- } ++ ++ /* CMB SQEs will be mapped before creation */ ++ if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) ++ return 0; ++ ++ nvmeq->sq_cmds = dma_alloc_coherent(dev->dev, SQ_SIZE(depth), ++ &nvmeq->sq_dma_addr, GFP_KERNEL); ++ if (!nvmeq->sq_cmds) ++ return -ENOMEM; + + return 0; + } +@@ -1320,6 +1318,13 @@ static int nvme_create_queue(struct nvme_queue *nvmeq, int qid) + struct nvme_dev *dev = nvmeq->dev; + int result; + ++ if (qid && dev->cmb && use_cmb_sqes && NVME_CMB_SQS(dev->cmbsz)) { ++ unsigned offset = (qid - 1) * roundup(SQ_SIZE(nvmeq->q_depth), ++ dev->ctrl.page_size); ++ nvmeq->sq_dma_addr = dev->cmb_bus_addr + offset; ++ nvmeq->sq_cmds_io = dev->cmb + offset; ++ } ++ + nvmeq->cq_vector = qid - 1; + result = adapter_alloc_cq(dev, qid, nvmeq); + if (result < 0) +diff --git a/drivers/scsi/megaraid/megaraid_sas.h b/drivers/scsi/megaraid/megaraid_sas.h +index a6722c93a295..81de4a1fbb9b 100644 +--- a/drivers/scsi/megaraid/megaraid_sas.h ++++ b/drivers/scsi/megaraid/megaraid_sas.h +@@ -1504,6 +1504,13 @@ enum FW_BOOT_CONTEXT { + + #define MR_CAN_HANDLE_SYNC_CACHE_OFFSET 0X01000000 + ++enum MR_ADAPTER_TYPE { ++ MFI_SERIES = 1, ++ THUNDERBOLT_SERIES = 2, ++ INVADER_SERIES = 3, ++ VENTURA_SERIES = 4, ++}; ++ + /* + * register set for both 1068 and 1078 controllers + * structure extended for 1078 registers +@@ -2092,6 +2099,7 @@ enum MR_PD_TYPE { + + struct megasas_instance { + ++ unsigned int *reply_map; + __le32 *producer; + dma_addr_t producer_h; + __le32 *consumer; +@@ -2236,12 +2244,12 @@ struct megasas_instance { + bool dev_handle; + bool fw_sync_cache_support; + u32 mfi_frame_size; +- bool is_ventura; + bool msix_combined; + u16 max_raid_mapsize; + /* preffered count to send as LDIO irrspective of FP capable.*/ + u8 r1_ldio_hint_default; + u32 nvme_page_size; ++ u8 adapter_type; + }; + struct MR_LD_VF_MAP { + u32 size; +diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c +index 4beb4dd2bee8..985378e4bb6f 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_base.c ++++ b/drivers/scsi/megaraid/megaraid_sas_base.c +@@ -2023,7 +2023,7 @@ void megaraid_sas_kill_hba(struct megasas_instance *instance) + msleep(1000); + if ((instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0073SKINNY) || + (instance->pdev->device == PCI_DEVICE_ID_LSI_SAS0071SKINNY) || +- (instance->ctrl_context)) { ++ (instance->adapter_type != MFI_SERIES)) { + writel(MFI_STOP_ADP, &instance->reg_set->doorbell); + /* Flush */ + readl(&instance->reg_set->doorbell); +@@ -2494,7 +2494,8 @@ int megasas_sriov_start_heartbeat(struct megasas_instance *instance, + dev_warn(&instance->pdev->dev, "SR-IOV: Starting heartbeat for scsi%d\n", + instance->host->host_no); + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + retval = megasas_issue_blocked_cmd(instance, cmd, + MEGASAS_ROUTINE_WAIT_TIME_VF); + else +@@ -2790,7 +2791,9 @@ static int megasas_reset_bus_host(struct scsi_cmnd *scmd) + /* + * First wait for all commands to complete + */ +- if (instance->ctrl_context) { ++ if (instance->adapter_type == MFI_SERIES) { ++ ret = megasas_generic_reset(scmd); ++ } else { + struct megasas_cmd_fusion *cmd; + cmd = (struct megasas_cmd_fusion *)scmd->SCp.ptr; + if (cmd) +@@ -2798,8 +2801,7 @@ static int megasas_reset_bus_host(struct scsi_cmnd *scmd) + MEGA_MPI2_RAID_DEFAULT_IO_FRAME_SIZE); + ret = megasas_reset_fusion(scmd->device->host, + SCSIIO_TIMEOUT_OCR); +- } else +- ret = megasas_generic_reset(scmd); ++ } + + return ret; + } +@@ -2816,7 +2818,7 @@ static int megasas_task_abort(struct scsi_cmnd *scmd) + + instance = (struct megasas_instance *)scmd->device->host->hostdata; + +- if (instance->ctrl_context) ++ if (instance->adapter_type != MFI_SERIES) + ret = megasas_task_abort_fusion(scmd); + else { + sdev_printk(KERN_NOTICE, scmd->device, "TASK ABORT not supported\n"); +@@ -2838,7 +2840,7 @@ static int megasas_reset_target(struct scsi_cmnd *scmd) + + instance = (struct megasas_instance *)scmd->device->host->hostdata; + +- if (instance->ctrl_context) ++ if (instance->adapter_type != MFI_SERIES) + ret = megasas_reset_target_fusion(scmd); + else { + sdev_printk(KERN_NOTICE, scmd->device, "TARGET RESET not supported\n"); +@@ -3715,7 +3717,7 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr) + PCI_DEVICE_ID_LSI_SAS0073SKINNY) || + (instance->pdev->device == + PCI_DEVICE_ID_LSI_SAS0071SKINNY) || +- (instance->ctrl_context)) ++ (instance->adapter_type != MFI_SERIES)) + writel( + MFI_INIT_CLEAR_HANDSHAKE|MFI_INIT_HOTPLUG, + &instance->reg_set->doorbell); +@@ -3733,7 +3735,7 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr) + PCI_DEVICE_ID_LSI_SAS0073SKINNY) || + (instance->pdev->device == + PCI_DEVICE_ID_LSI_SAS0071SKINNY) || +- (instance->ctrl_context)) ++ (instance->adapter_type != MFI_SERIES)) + writel(MFI_INIT_HOTPLUG, + &instance->reg_set->doorbell); + else +@@ -3753,11 +3755,11 @@ megasas_transition_to_ready(struct megasas_instance *instance, int ocr) + PCI_DEVICE_ID_LSI_SAS0073SKINNY) || + (instance->pdev->device == + PCI_DEVICE_ID_LSI_SAS0071SKINNY) || +- (instance->ctrl_context)) { ++ (instance->adapter_type != MFI_SERIES)) { + writel(MFI_RESET_FLAGS, + &instance->reg_set->doorbell); + +- if (instance->ctrl_context) { ++ if (instance->adapter_type != MFI_SERIES) { + for (i = 0; i < (10 * 1000); i += 20) { + if (readl( + &instance-> +@@ -3924,7 +3926,8 @@ static int megasas_create_frame_pool(struct megasas_instance *instance) + * max_sge_sz = 12 byte (sizeof megasas_sge64) + * Total 192 byte (3 MFI frame of 64 byte) + */ +- frame_count = instance->ctrl_context ? (3 + 1) : (15 + 1); ++ frame_count = (instance->adapter_type == MFI_SERIES) ? ++ (15 + 1) : (3 + 1); + instance->mfi_frame_size = MEGAMFI_FRAME_SIZE * frame_count; + /* + * Use DMA pool facility provided by PCI layer +@@ -3979,7 +3982,7 @@ static int megasas_create_frame_pool(struct megasas_instance *instance) + memset(cmd->frame, 0, instance->mfi_frame_size); + cmd->frame->io.context = cpu_to_le32(cmd->index); + cmd->frame->io.pad_0 = 0; +- if (!instance->ctrl_context && reset_devices) ++ if ((instance->adapter_type == MFI_SERIES) && reset_devices) + cmd->frame->hdr.cmd = MFI_CMD_INVALID; + } + +@@ -4099,7 +4102,7 @@ int megasas_alloc_cmds(struct megasas_instance *instance) + inline int + dcmd_timeout_ocr_possible(struct megasas_instance *instance) { + +- if (!instance->ctrl_context) ++ if (instance->adapter_type == MFI_SERIES) + return KILL_ADAPTER; + else if (instance->unload || + test_bit(MEGASAS_FUSION_IN_RESET, &instance->reset_flags)) +@@ -4143,7 +4146,8 @@ megasas_get_pd_info(struct megasas_instance *instance, struct scsi_device *sdev) + dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(instance->pd_info_h); + dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct MR_PD_INFO)); + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, MFI_IO_TIMEOUT_SECS); + else + ret = megasas_issue_polled(instance, cmd); +@@ -4240,7 +4244,8 @@ megasas_get_pd_list(struct megasas_instance *instance) + dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(ci_h); + dcmd->sgl.sge32[0].length = cpu_to_le32(MEGASAS_MAX_PD * sizeof(struct MR_PD_LIST)); + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, + MFI_IO_TIMEOUT_SECS); + else +@@ -4251,7 +4256,7 @@ megasas_get_pd_list(struct megasas_instance *instance) + dev_info(&instance->pdev->dev, "MR_DCMD_PD_LIST_QUERY " + "failed/not supported by firmware\n"); + +- if (instance->ctrl_context) ++ if (instance->adapter_type != MFI_SERIES) + megaraid_sas_kill_hba(instance); + else + instance->pd_list_not_supported = 1; +@@ -4372,7 +4377,8 @@ megasas_get_ld_list(struct megasas_instance *instance) + dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct MR_LD_LIST)); + dcmd->pad_0 = 0; + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, + MFI_IO_TIMEOUT_SECS); + else +@@ -4491,7 +4497,8 @@ megasas_ld_list_query(struct megasas_instance *instance, u8 query_type) + dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct MR_LD_TARGETID_LIST)); + dcmd->pad_0 = 0; + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, MFI_IO_TIMEOUT_SECS); + else + ret = megasas_issue_polled(instance, cmd); +@@ -4664,7 +4671,8 @@ megasas_get_ctrl_info(struct megasas_instance *instance) + dcmd->sgl.sge32[0].length = cpu_to_le32(sizeof(struct megasas_ctrl_info)); + dcmd->mbox.b[0] = 1; + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, MFI_IO_TIMEOUT_SECS); + else + ret = megasas_issue_polled(instance, cmd); +@@ -4783,7 +4791,8 @@ int megasas_set_crash_dump_params(struct megasas_instance *instance, + dcmd->sgl.sge32[0].phys_addr = cpu_to_le32(instance->crash_dump_h); + dcmd->sgl.sge32[0].length = cpu_to_le32(CRASH_DMA_BUF_SIZE); + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, cmd, MFI_IO_TIMEOUT_SECS); + else + ret = megasas_issue_polled(instance, cmd); +@@ -5129,6 +5138,26 @@ megasas_setup_jbod_map(struct megasas_instance *instance) + instance->use_seqnum_jbod_fp = false; + } + ++static void megasas_setup_reply_map(struct megasas_instance *instance) ++{ ++ const struct cpumask *mask; ++ unsigned int queue, cpu; ++ ++ for (queue = 0; queue < instance->msix_vectors; queue++) { ++ mask = pci_irq_get_affinity(instance->pdev, queue); ++ if (!mask) ++ goto fallback; ++ ++ for_each_cpu(cpu, mask) ++ instance->reply_map[cpu] = queue; ++ } ++ return; ++ ++fallback: ++ for_each_possible_cpu(cpu) ++ instance->reply_map[cpu] = cpu % instance->msix_vectors; ++} ++ + /** + * megasas_init_fw - Initializes the FW + * @instance: Adapter soft state +@@ -5170,7 +5199,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + + reg_set = instance->reg_set; + +- if (fusion) ++ if (instance->adapter_type != MFI_SERIES) + instance->instancet = &megasas_instance_template_fusion; + else { + switch (instance->pdev->device) { +@@ -5211,7 +5240,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + goto fail_ready_state; + } + +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + scratch_pad_3 = + readl(&instance->reg_set->outbound_scratch_pad_3); + instance->max_raid_mapsize = ((scratch_pad_3 >> +@@ -5229,7 +5258,8 @@ static int megasas_init_fw(struct megasas_instance *instance) + (&instance->reg_set->outbound_scratch_pad_2); + /* Check max MSI-X vectors */ + if (fusion) { +- if (fusion->adapter_type == THUNDERBOLT_SERIES) { /* Thunderbolt Series*/ ++ if (instance->adapter_type == THUNDERBOLT_SERIES) { ++ /* Thunderbolt Series*/ + instance->msix_vectors = (scratch_pad_2 + & MR_MAX_REPLY_QUEUES_OFFSET) + 1; + fw_msix_count = instance->msix_vectors; +@@ -5293,6 +5323,8 @@ static int megasas_init_fw(struct megasas_instance *instance) + goto fail_setup_irqs; + } + ++ megasas_setup_reply_map(instance); ++ + dev_info(&instance->pdev->dev, + "firmware supports msix\t: (%d)", fw_msix_count); + dev_info(&instance->pdev->dev, +@@ -5319,7 +5351,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + if (instance->instancet->init_adapter(instance)) + goto fail_init_adapter; + +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + scratch_pad_4 = + readl(&instance->reg_set->outbound_scratch_pad_4); + if ((scratch_pad_4 & MR_NVME_PAGE_SIZE_MASK) >= +@@ -5355,7 +5387,7 @@ static int megasas_init_fw(struct megasas_instance *instance) + memset(instance->ld_ids, 0xff, MEGASAS_MAX_LD_IDS); + + /* stream detection initialization */ +- if (instance->is_ventura && fusion) { ++ if (instance->adapter_type == VENTURA_SERIES) { + fusion->stream_detect_by_ld = + kzalloc(sizeof(struct LD_STREAM_DETECT *) + * MAX_LOGICAL_DRIVES_EXT, +@@ -5804,7 +5836,8 @@ megasas_get_target_prop(struct megasas_instance *instance, + dcmd->sgl.sge32[0].length = + cpu_to_le32(sizeof(struct MR_TARGET_PROPERTIES)); + +- if (instance->ctrl_context && !instance->mask_interrupts) ++ if ((instance->adapter_type != MFI_SERIES) && ++ !instance->mask_interrupts) + ret = megasas_issue_blocked_cmd(instance, + cmd, MFI_IO_TIMEOUT_SECS); + else +@@ -5965,6 +5998,125 @@ megasas_set_dma_mask(struct pci_dev *pdev) + return 1; + } + ++/* ++ * megasas_set_adapter_type - Set adapter type. ++ * Supported controllers can be divided in ++ * 4 categories- enum MR_ADAPTER_TYPE { ++ * MFI_SERIES = 1, ++ * THUNDERBOLT_SERIES = 2, ++ * INVADER_SERIES = 3, ++ * VENTURA_SERIES = 4, ++ * }; ++ * @instance: Adapter soft state ++ * return: void ++ */ ++static inline void megasas_set_adapter_type(struct megasas_instance *instance) ++{ ++ switch (instance->pdev->device) { ++ case PCI_DEVICE_ID_LSI_VENTURA: ++ case PCI_DEVICE_ID_LSI_HARPOON: ++ case PCI_DEVICE_ID_LSI_TOMCAT: ++ case PCI_DEVICE_ID_LSI_VENTURA_4PORT: ++ case PCI_DEVICE_ID_LSI_CRUSADER_4PORT: ++ instance->adapter_type = VENTURA_SERIES; ++ break; ++ case PCI_DEVICE_ID_LSI_FUSION: ++ case PCI_DEVICE_ID_LSI_PLASMA: ++ instance->adapter_type = THUNDERBOLT_SERIES; ++ break; ++ case PCI_DEVICE_ID_LSI_INVADER: ++ case PCI_DEVICE_ID_LSI_INTRUDER: ++ case PCI_DEVICE_ID_LSI_INTRUDER_24: ++ case PCI_DEVICE_ID_LSI_CUTLASS_52: ++ case PCI_DEVICE_ID_LSI_CUTLASS_53: ++ case PCI_DEVICE_ID_LSI_FURY: ++ instance->adapter_type = INVADER_SERIES; ++ break; ++ default: /* For all other supported controllers */ ++ instance->adapter_type = MFI_SERIES; ++ break; ++ } ++} ++ ++static inline int megasas_alloc_mfi_ctrl_mem(struct megasas_instance *instance) ++{ ++ instance->producer = pci_alloc_consistent(instance->pdev, sizeof(u32), ++ &instance->producer_h); ++ instance->consumer = pci_alloc_consistent(instance->pdev, sizeof(u32), ++ &instance->consumer_h); ++ ++ if (!instance->producer || !instance->consumer) { ++ dev_err(&instance->pdev->dev, ++ "Failed to allocate memory for producer, consumer\n"); ++ return -1; ++ } ++ ++ *instance->producer = 0; ++ *instance->consumer = 0; ++ return 0; ++} ++ ++/** ++ * megasas_alloc_ctrl_mem - Allocate per controller memory for core data ++ * structures which are not common across MFI ++ * adapters and fusion adapters. ++ * For MFI based adapters, allocate producer and ++ * consumer buffers. For fusion adapters, allocate ++ * memory for fusion context. ++ * @instance: Adapter soft state ++ * return: 0 for SUCCESS ++ */ ++static int megasas_alloc_ctrl_mem(struct megasas_instance *instance) ++{ ++ instance->reply_map = kzalloc(sizeof(unsigned int) * nr_cpu_ids, ++ GFP_KERNEL); ++ if (!instance->reply_map) ++ return -ENOMEM; ++ ++ switch (instance->adapter_type) { ++ case MFI_SERIES: ++ if (megasas_alloc_mfi_ctrl_mem(instance)) ++ goto fail; ++ break; ++ case VENTURA_SERIES: ++ case THUNDERBOLT_SERIES: ++ case INVADER_SERIES: ++ if (megasas_alloc_fusion_context(instance)) ++ goto fail; ++ break; ++ } ++ ++ return 0; ++ fail: ++ kfree(instance->reply_map); ++ instance->reply_map = NULL; ++ return -ENOMEM; ++} ++ ++/* ++ * megasas_free_ctrl_mem - Free fusion context for fusion adapters and ++ * producer, consumer buffers for MFI adapters ++ * ++ * @instance - Adapter soft instance ++ * ++ */ ++static inline void megasas_free_ctrl_mem(struct megasas_instance *instance) ++{ ++ kfree(instance->reply_map); ++ if (instance->adapter_type == MFI_SERIES) { ++ if (instance->producer) ++ pci_free_consistent(instance->pdev, sizeof(u32), ++ instance->producer, ++ instance->producer_h); ++ if (instance->consumer) ++ pci_free_consistent(instance->pdev, sizeof(u32), ++ instance->consumer, ++ instance->consumer_h); ++ } else { ++ megasas_free_fusion_context(instance); ++ } ++} ++ + /** + * megasas_probe_one - PCI hotplug entry point + * @pdev: PCI device structure +@@ -5977,7 +6129,6 @@ static int megasas_probe_one(struct pci_dev *pdev, + struct Scsi_Host *host; + struct megasas_instance *instance; + u16 control = 0; +- struct fusion_context *fusion = NULL; + + /* Reset MSI-X in the kdump kernel */ + if (reset_devices) { +@@ -6022,56 +6173,10 @@ static int megasas_probe_one(struct pci_dev *pdev, + atomic_set(&instance->fw_reset_no_pci_access, 0); + instance->pdev = pdev; + +- switch (instance->pdev->device) { +- case PCI_DEVICE_ID_LSI_VENTURA: +- case PCI_DEVICE_ID_LSI_HARPOON: +- case PCI_DEVICE_ID_LSI_TOMCAT: +- case PCI_DEVICE_ID_LSI_VENTURA_4PORT: +- case PCI_DEVICE_ID_LSI_CRUSADER_4PORT: +- instance->is_ventura = true; +- case PCI_DEVICE_ID_LSI_FUSION: +- case PCI_DEVICE_ID_LSI_PLASMA: +- case PCI_DEVICE_ID_LSI_INVADER: +- case PCI_DEVICE_ID_LSI_FURY: +- case PCI_DEVICE_ID_LSI_INTRUDER: +- case PCI_DEVICE_ID_LSI_INTRUDER_24: +- case PCI_DEVICE_ID_LSI_CUTLASS_52: +- case PCI_DEVICE_ID_LSI_CUTLASS_53: +- { +- if (megasas_alloc_fusion_context(instance)) { +- megasas_free_fusion_context(instance); +- goto fail_alloc_dma_buf; +- } +- fusion = instance->ctrl_context; +- +- if ((instance->pdev->device == PCI_DEVICE_ID_LSI_FUSION) || +- (instance->pdev->device == PCI_DEVICE_ID_LSI_PLASMA)) +- fusion->adapter_type = THUNDERBOLT_SERIES; +- else if (instance->is_ventura) +- fusion->adapter_type = VENTURA_SERIES; +- else +- fusion->adapter_type = INVADER_SERIES; +- } +- break; +- default: /* For all other supported controllers */ ++ megasas_set_adapter_type(instance); + +- instance->producer = +- pci_alloc_consistent(pdev, sizeof(u32), +- &instance->producer_h); +- instance->consumer = +- pci_alloc_consistent(pdev, sizeof(u32), +- &instance->consumer_h); +- +- if (!instance->producer || !instance->consumer) { +- dev_printk(KERN_DEBUG, &pdev->dev, "Failed to allocate " +- "memory for producer, consumer\n"); +- goto fail_alloc_dma_buf; +- } +- +- *instance->producer = 0; +- *instance->consumer = 0; +- break; +- } ++ if (megasas_alloc_ctrl_mem(instance)) ++ goto fail_alloc_dma_buf; + + /* Crash dump feature related initialisation*/ + instance->drv_buf_index = 0; +@@ -6166,7 +6271,7 @@ static int megasas_probe_one(struct pci_dev *pdev, + instance->disableOnlineCtrlReset = 1; + instance->UnevenSpanSupport = 0; + +- if (instance->ctrl_context) { ++ if (instance->adapter_type != MFI_SERIES) { + INIT_WORK(&instance->work_init, megasas_fusion_ocr_wq); + INIT_WORK(&instance->crash_init, megasas_fusion_crash_dump_wq); + } else +@@ -6246,7 +6351,7 @@ static int megasas_probe_one(struct pci_dev *pdev, + instance->instancet->disable_intr(instance); + megasas_destroy_irqs(instance); + +- if (instance->ctrl_context) ++ if (instance->adapter_type != MFI_SERIES) + megasas_release_fusion(instance); + else + megasas_release_mfi(instance); +@@ -6267,14 +6372,8 @@ static int megasas_probe_one(struct pci_dev *pdev, + pci_free_consistent(pdev, sizeof(struct MR_TARGET_PROPERTIES), + instance->tgt_prop, + instance->tgt_prop_h); +- if (instance->producer) +- pci_free_consistent(pdev, sizeof(u32), instance->producer, +- instance->producer_h); +- if (instance->consumer) +- pci_free_consistent(pdev, sizeof(u32), instance->consumer, +- instance->consumer_h); ++ megasas_free_ctrl_mem(instance); + scsi_host_put(host); +- + fail_alloc_instance: + fail_set_dma_mask: + pci_disable_device(pdev); +@@ -6480,7 +6579,9 @@ megasas_resume(struct pci_dev *pdev) + if (rval < 0) + goto fail_reenable_msix; + +- if (instance->ctrl_context) { ++ megasas_setup_reply_map(instance); ++ ++ if (instance->adapter_type != MFI_SERIES) { + megasas_reset_reply_desc(instance); + if (megasas_ioc_init_fusion(instance)) { + megasas_free_cmds(instance); +@@ -6543,12 +6644,8 @@ megasas_resume(struct pci_dev *pdev) + pci_free_consistent(pdev, sizeof(struct MR_TARGET_PROPERTIES), + instance->tgt_prop, + instance->tgt_prop_h); +- if (instance->producer) +- pci_free_consistent(pdev, sizeof(u32), instance->producer, +- instance->producer_h); +- if (instance->consumer) +- pci_free_consistent(pdev, sizeof(u32), instance->consumer, +- instance->consumer_h); ++ ++ megasas_free_ctrl_mem(instance); + scsi_host_put(host); + + fail_set_dma_mask: +@@ -6656,7 +6753,7 @@ static void megasas_detach_one(struct pci_dev *pdev) + if (instance->msix_vectors) + pci_free_irq_vectors(instance->pdev); + +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + for (i = 0; i < MAX_LOGICAL_DRIVES_EXT; ++i) + kfree(fusion->stream_detect_by_ld[i]); + kfree(fusion->stream_detect_by_ld); +@@ -6664,7 +6761,7 @@ static void megasas_detach_one(struct pci_dev *pdev) + } + + +- if (instance->ctrl_context) { ++ if (instance->adapter_type != MFI_SERIES) { + megasas_release_fusion(instance); + pd_seq_map_sz = sizeof(struct MR_PD_CFG_SEQ_NUM_SYNC) + + (sizeof(struct MR_PD_CFG_SEQ) * +@@ -6689,15 +6786,8 @@ static void megasas_detach_one(struct pci_dev *pdev) + fusion->pd_seq_sync[i], + fusion->pd_seq_phys[i]); + } +- megasas_free_fusion_context(instance); + } else { + megasas_release_mfi(instance); +- pci_free_consistent(pdev, sizeof(u32), +- instance->producer, +- instance->producer_h); +- pci_free_consistent(pdev, sizeof(u32), +- instance->consumer, +- instance->consumer_h); + } + + kfree(instance->ctrl_info); +@@ -6738,6 +6828,8 @@ static void megasas_detach_one(struct pci_dev *pdev) + pci_free_consistent(pdev, sizeof(struct MR_DRV_SYSTEM_INFO), + instance->system_info_buf, instance->system_info_h); + ++ megasas_free_ctrl_mem(instance); ++ + scsi_host_put(host); + + pci_disable_device(pdev); +diff --git a/drivers/scsi/megaraid/megaraid_sas_fp.c b/drivers/scsi/megaraid/megaraid_sas_fp.c +index 08945142b9f8..f2ffde430ec1 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fp.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fp.c +@@ -745,7 +745,7 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance *instance, u32 ld, + *pDevHandle = MR_PdDevHandleGet(pd, map); + *pPdInterface = MR_PdInterfaceTypeGet(pd, map); + /* get second pd also for raid 1/10 fast path writes*/ +- if (instance->is_ventura && ++ if ((instance->adapter_type == VENTURA_SERIES) && + (raid->level == 1) && + !io_info->isRead) { + r1_alt_pd = MR_ArPdGet(arRef, physArm + 1, map); +@@ -755,8 +755,8 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance *instance, u32 ld, + } + } else { + if ((raid->level >= 5) && +- ((fusion->adapter_type == THUNDERBOLT_SERIES) || +- ((fusion->adapter_type == INVADER_SERIES) && ++ ((instance->adapter_type == THUNDERBOLT_SERIES) || ++ ((instance->adapter_type == INVADER_SERIES) && + (raid->regTypeReqOnRead != REGION_TYPE_UNUSED)))) + pRAID_Context->reg_lock_flags = REGION_TYPE_EXCLUSIVE; + else if (raid->level == 1) { +@@ -770,7 +770,7 @@ static u8 mr_spanset_get_phy_params(struct megasas_instance *instance, u32 ld, + } + + *pdBlock += stripRef + le64_to_cpu(MR_LdSpanPtrGet(ld, span, map)->startBlk); +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + ((struct RAID_CONTEXT_G35 *)pRAID_Context)->span_arm = + (span << RAID_CTX_SPANARM_SPAN_SHIFT) | physArm; + io_info->span_arm = +@@ -861,7 +861,7 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 ld, u64 stripRow, + *pDevHandle = MR_PdDevHandleGet(pd, map); + *pPdInterface = MR_PdInterfaceTypeGet(pd, map); + /* get second pd also for raid 1/10 fast path writes*/ +- if (instance->is_ventura && ++ if ((instance->adapter_type == VENTURA_SERIES) && + (raid->level == 1) && + !io_info->isRead) { + r1_alt_pd = MR_ArPdGet(arRef, physArm + 1, map); +@@ -871,8 +871,8 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 ld, u64 stripRow, + } + } else { + if ((raid->level >= 5) && +- ((fusion->adapter_type == THUNDERBOLT_SERIES) || +- ((fusion->adapter_type == INVADER_SERIES) && ++ ((instance->adapter_type == THUNDERBOLT_SERIES) || ++ ((instance->adapter_type == INVADER_SERIES) && + (raid->regTypeReqOnRead != REGION_TYPE_UNUSED)))) + pRAID_Context->reg_lock_flags = REGION_TYPE_EXCLUSIVE; + else if (raid->level == 1) { +@@ -888,7 +888,7 @@ u8 MR_GetPhyParams(struct megasas_instance *instance, u32 ld, u64 stripRow, + } + + *pdBlock += stripRef + le64_to_cpu(MR_LdSpanPtrGet(ld, span, map)->startBlk); +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + ((struct RAID_CONTEXT_G35 *)pRAID_Context)->span_arm = + (span << RAID_CTX_SPANARM_SPAN_SHIFT) | physArm; + io_info->span_arm = +@@ -1096,10 +1096,10 @@ MR_BuildRaidContext(struct megasas_instance *instance, + cpu_to_le16(raid->fpIoTimeoutForLd ? + raid->fpIoTimeoutForLd : + map->raidMap.fpPdIoTimeoutSec); +- if (fusion->adapter_type == INVADER_SERIES) ++ if (instance->adapter_type == INVADER_SERIES) + pRAID_Context->reg_lock_flags = (isRead) ? + raid->regTypeReqOnRead : raid->regTypeReqOnWrite; +- else if (!instance->is_ventura) ++ else if (instance->adapter_type == THUNDERBOLT_SERIES) + pRAID_Context->reg_lock_flags = (isRead) ? + REGION_TYPE_SHARED_READ : raid->regTypeReqOnWrite; + pRAID_Context->virtual_disk_tgt_id = raid->targetId; +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index 72a919179d06..d8f626567f59 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -237,7 +237,7 @@ megasas_fusion_update_can_queue(struct megasas_instance *instance, int fw_boot_c + reg_set = instance->reg_set; + + /* ventura FW does not fill outbound_scratch_pad_3 with queue depth */ +- if (!instance->is_ventura) ++ if (instance->adapter_type < VENTURA_SERIES) + cur_max_fw_cmds = + readl(&instance->reg_set->outbound_scratch_pad_3) & 0x00FFFF; + +@@ -285,7 +285,7 @@ megasas_fusion_update_can_queue(struct megasas_instance *instance, int fw_boot_c + instance->host->can_queue = instance->cur_can_queue; + } + +- if (instance->is_ventura) ++ if (instance->adapter_type == VENTURA_SERIES) + instance->max_mpt_cmds = + instance->max_fw_cmds * RAID_1_PEER_CMDS; + else +@@ -838,7 +838,7 @@ megasas_ioc_init_fusion(struct megasas_instance *instance) + drv_ops = (MFI_CAPABILITIES *) &(init_frame->driver_operations); + + /* driver support Extended MSIX */ +- if (fusion->adapter_type >= INVADER_SERIES) ++ if (instance->adapter_type >= INVADER_SERIES) + drv_ops->mfi_capabilities.support_additional_msix = 1; + /* driver supports HA / Remote LUN over Fast Path interface */ + drv_ops->mfi_capabilities.support_fp_remote_lun = 1; +@@ -1789,7 +1789,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance, + + fusion = instance->ctrl_context; + +- if (fusion->adapter_type >= INVADER_SERIES) { ++ if (instance->adapter_type >= INVADER_SERIES) { + struct MPI25_IEEE_SGE_CHAIN64 *sgl_ptr_end = sgl_ptr; + sgl_ptr_end += fusion->max_sge_in_main_msg - 1; + sgl_ptr_end->Flags = 0; +@@ -1799,7 +1799,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance, + sgl_ptr->Length = cpu_to_le32(sg_dma_len(os_sgl)); + sgl_ptr->Address = cpu_to_le64(sg_dma_address(os_sgl)); + sgl_ptr->Flags = 0; +- if (fusion->adapter_type >= INVADER_SERIES) ++ if (instance->adapter_type >= INVADER_SERIES) + if (i == sge_count - 1) + sgl_ptr->Flags = IEEE_SGE_FLAGS_END_OF_LIST; + sgl_ptr++; +@@ -1809,7 +1809,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance, + (sge_count > fusion->max_sge_in_main_msg)) { + + struct MPI25_IEEE_SGE_CHAIN64 *sg_chain; +- if (fusion->adapter_type >= INVADER_SERIES) { ++ if (instance->adapter_type >= INVADER_SERIES) { + if ((le16_to_cpu(cmd->io_request->IoFlags) & + MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH) != + MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH) +@@ -1825,7 +1825,7 @@ megasas_make_sgl_fusion(struct megasas_instance *instance, + sg_chain = sgl_ptr; + /* Prepare chain element */ + sg_chain->NextChainOffset = 0; +- if (fusion->adapter_type >= INVADER_SERIES) ++ if (instance->adapter_type >= INVADER_SERIES) + sg_chain->Flags = IEEE_SGE_FLAGS_CHAIN_ELEMENT; + else + sg_chain->Flags = +@@ -2341,15 +2341,12 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + fp_possible = (io_info.fpOkForIo > 0) ? true : false; + } + +- /* Use raw_smp_processor_id() for now until cmd->request->cpu is CPU +- id by default, not CPU group id, otherwise all MSI-X queues won't +- be utilized */ +- cmd->request_desc->SCSIIO.MSIxIndex = instance->msix_vectors ? +- raw_smp_processor_id() % instance->msix_vectors : 0; ++ cmd->request_desc->SCSIIO.MSIxIndex = ++ instance->reply_map[raw_smp_processor_id()]; + + praid_context = &io_request->RaidContext; + +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + spin_lock_irqsave(&instance->stream_lock, spinlock_flags); + megasas_stream_detect(instance, cmd, &io_info); + spin_unlock_irqrestore(&instance->stream_lock, spinlock_flags); +@@ -2402,7 +2399,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + cmd->request_desc->SCSIIO.RequestFlags = + (MPI2_REQ_DESCRIPT_FLAGS_FP_IO + << MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); +- if (fusion->adapter_type == INVADER_SERIES) { ++ if (instance->adapter_type == INVADER_SERIES) { + if (io_request->RaidContext.raid_context.reg_lock_flags == + REGION_TYPE_UNUSED) + cmd->request_desc->SCSIIO.RequestFlags = +@@ -2415,7 +2412,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + io_request->RaidContext.raid_context.reg_lock_flags |= + (MR_RL_FLAGS_GRANT_DESTINATION_CUDA | + MR_RL_FLAGS_SEQ_NUM_ENABLE); +- } else if (instance->is_ventura) { ++ } else if (instance->adapter_type == VENTURA_SERIES) { + io_request->RaidContext.raid_context_g35.nseg_type |= + (1 << RAID_CONTEXT_NSEG_SHIFT); + io_request->RaidContext.raid_context_g35.nseg_type |= +@@ -2434,7 +2431,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + &io_info, local_map_ptr); + scp->SCp.Status |= MEGASAS_LOAD_BALANCE_FLAG; + cmd->pd_r1_lb = io_info.pd_after_lb; +- if (instance->is_ventura) ++ if (instance->adapter_type == VENTURA_SERIES) + io_request->RaidContext.raid_context_g35.span_arm + = io_info.span_arm; + else +@@ -2444,7 +2441,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + } else + scp->SCp.Status &= ~MEGASAS_LOAD_BALANCE_FLAG; + +- if (instance->is_ventura) ++ if (instance->adapter_type == VENTURA_SERIES) + cmd->r1_alt_dev_handle = io_info.r1_alt_dev_handle; + else + cmd->r1_alt_dev_handle = MR_DEVHANDLE_INVALID; +@@ -2467,7 +2464,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + cmd->request_desc->SCSIIO.RequestFlags = + (MEGASAS_REQ_DESCRIPT_FLAGS_LD_IO + << MEGASAS_REQ_DESCRIPT_FLAGS_TYPE_SHIFT); +- if (fusion->adapter_type == INVADER_SERIES) { ++ if (instance->adapter_type == INVADER_SERIES) { + if (io_info.do_fp_rlbypass || + (io_request->RaidContext.raid_context.reg_lock_flags + == REGION_TYPE_UNUSED)) +@@ -2480,7 +2477,7 @@ megasas_build_ldio_fusion(struct megasas_instance *instance, + (MR_RL_FLAGS_GRANT_DESTINATION_CPU0 | + MR_RL_FLAGS_SEQ_NUM_ENABLE); + io_request->RaidContext.raid_context.nseg = 0x1; +- } else if (instance->is_ventura) { ++ } else if (instance->adapter_type == VENTURA_SERIES) { + io_request->RaidContext.raid_context_g35.routing_flags |= + (1 << MR_RAID_CTX_ROUTINGFLAGS_SQN_SHIFT); + io_request->RaidContext.raid_context_g35.nseg_type |= +@@ -2555,7 +2552,7 @@ static void megasas_build_ld_nonrw_fusion(struct megasas_instance *instance, + + /* set RAID context values */ + pRAID_Context->config_seq_num = raid->seqNum; +- if (!instance->is_ventura) ++ if (instance->adapter_type != VENTURA_SERIES) + pRAID_Context->reg_lock_flags = REGION_TYPE_SHARED_READ; + pRAID_Context->timeout_value = + cpu_to_le16(raid->fpIoTimeoutForLd); +@@ -2640,7 +2637,7 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + cpu_to_le16(device_id + (MAX_PHYSICAL_DEVICES - 1)); + pRAID_Context->config_seq_num = pd_sync->seq[pd_index].seqNum; + io_request->DevHandle = pd_sync->seq[pd_index].devHandle; +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + io_request->RaidContext.raid_context_g35.routing_flags |= + (1 << MR_RAID_CTX_ROUTINGFLAGS_SQN_SHIFT); + io_request->RaidContext.raid_context_g35.nseg_type |= +@@ -2667,10 +2664,9 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + } + + cmd->request_desc->SCSIIO.DevHandle = io_request->DevHandle; +- cmd->request_desc->SCSIIO.MSIxIndex = +- instance->msix_vectors ? +- (raw_smp_processor_id() % instance->msix_vectors) : 0; + ++ cmd->request_desc->SCSIIO.MSIxIndex = ++ instance->reply_map[raw_smp_processor_id()]; + + if (!fp_possible) { + /* system pd firmware path */ +@@ -2688,7 +2684,7 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + pRAID_Context->timeout_value = + cpu_to_le16((os_timeout_value > timeout_limit) ? + timeout_limit : os_timeout_value); +- if (fusion->adapter_type >= INVADER_SERIES) ++ if (instance->adapter_type >= INVADER_SERIES) + io_request->IoFlags |= + cpu_to_le16(MPI25_SAS_DEVICE0_FLAGS_ENABLED_FAST_PATH); + +@@ -2771,7 +2767,7 @@ megasas_build_io_fusion(struct megasas_instance *instance, + return 1; + } + +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + set_num_sge(&io_request->RaidContext.raid_context_g35, sge_count); + cpu_to_le16s(&io_request->RaidContext.raid_context_g35.routing_flags); + cpu_to_le16s(&io_request->RaidContext.raid_context_g35.nseg_type); +@@ -3301,7 +3297,7 @@ build_mpt_mfi_pass_thru(struct megasas_instance *instance, + + io_req = cmd->io_request; + +- if (fusion->adapter_type >= INVADER_SERIES) { ++ if (instance->adapter_type >= INVADER_SERIES) { + struct MPI25_IEEE_SGE_CHAIN64 *sgl_ptr_end = + (struct MPI25_IEEE_SGE_CHAIN64 *)&io_req->SGL; + sgl_ptr_end += fusion->max_sge_in_main_msg - 1; +@@ -4233,7 +4229,7 @@ int megasas_reset_fusion(struct Scsi_Host *shost, int reason) + for (i = 0 ; i < instance->max_scsi_cmds; i++) { + cmd_fusion = fusion->cmd_list[i]; + /*check for extra commands issued by driver*/ +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + r1_cmd = fusion->cmd_list[i + instance->max_fw_cmds]; + megasas_return_cmd_fusion(instance, r1_cmd); + } +@@ -4334,7 +4330,7 @@ int megasas_reset_fusion(struct Scsi_Host *shost, int reason) + megasas_set_dynamic_target_properties(sdev); + + /* reset stream detection array */ +- if (instance->is_ventura) { ++ if (instance->adapter_type == VENTURA_SERIES) { + for (j = 0; j < MAX_LOGICAL_DRIVES_EXT; ++j) { + memset(fusion->stream_detect_by_ld[j], + 0, sizeof(struct LD_STREAM_DETECT)); +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.h b/drivers/scsi/megaraid/megaraid_sas_fusion.h +index d78d76112501..7c1f7ccf031d 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.h ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.h +@@ -104,12 +104,6 @@ enum MR_RAID_FLAGS_IO_SUB_TYPE { + #define RAID_1_PEER_CMDS 2 + #define JBOD_MAPS_COUNT 2 + +-enum MR_FUSION_ADAPTER_TYPE { +- THUNDERBOLT_SERIES = 0, +- INVADER_SERIES = 1, +- VENTURA_SERIES = 2, +-}; +- + /* + * Raid Context structure which describes MegaRAID specific IO Parameters + * This resides at offset 0x60 where the SGL normally starts in MPT IO Frames +@@ -1319,7 +1313,6 @@ struct fusion_context { + struct LD_LOAD_BALANCE_INFO *load_balance_info; + u32 load_balance_info_pages; + LD_SPAN_INFO log_to_span[MAX_LOGICAL_DRIVES_EXT]; +- u8 adapter_type; + struct LD_STREAM_DETECT **stream_detect_by_ld; + }; + +diff --git a/drivers/staging/rtl8723bs/core/rtw_ap.c b/drivers/staging/rtl8723bs/core/rtw_ap.c +index d3007c1c45e3..a84400f07a38 100644 +--- a/drivers/staging/rtl8723bs/core/rtw_ap.c ++++ b/drivers/staging/rtl8723bs/core/rtw_ap.c +@@ -1059,7 +1059,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) + return _FAIL; + + +- if (len > MAX_IE_SZ) ++ if (len < 0 || len > MAX_IE_SZ) + return _FAIL; + + pbss_network->IELength = len; +diff --git a/drivers/staging/rtlwifi/rtl8822be/hw.c b/drivers/staging/rtlwifi/rtl8822be/hw.c +index 74386003044f..c6db2bd20594 100644 +--- a/drivers/staging/rtlwifi/rtl8822be/hw.c ++++ b/drivers/staging/rtlwifi/rtl8822be/hw.c +@@ -814,7 +814,7 @@ static void _rtl8822be_enable_aspm_back_door(struct ieee80211_hw *hw) + return; + + pci_read_config_byte(rtlpci->pdev, 0x70f, &tmp); +- pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | BIT(7)); ++ pci_write_config_byte(rtlpci->pdev, 0x70f, tmp | ASPM_L1_LATENCY << 3); + + pci_read_config_byte(rtlpci->pdev, 0x719, &tmp); + pci_write_config_byte(rtlpci->pdev, 0x719, tmp | BIT(3) | BIT(4)); +diff --git a/drivers/staging/rtlwifi/wifi.h b/drivers/staging/rtlwifi/wifi.h +index eb91c130b245..5f0bc363ad41 100644 +--- a/drivers/staging/rtlwifi/wifi.h ++++ b/drivers/staging/rtlwifi/wifi.h +@@ -99,6 +99,7 @@ + #define RTL_USB_MAX_RX_COUNT 100 + #define QBSS_LOAD_SIZE 5 + #define MAX_WMMELE_LENGTH 64 ++#define ASPM_L1_LATENCY 7 + + #define TOTAL_CAM_ENTRY 32 + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 40ce175655e6..99f67764765f 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -231,6 +231,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Corsair K70 RGB */ + { USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT }, + ++ /* Corsair Strafe */ ++ { USB_DEVICE(0x1b1c, 0x1b15), .driver_info = USB_QUIRK_DELAY_INIT | ++ USB_QUIRK_DELAY_CTRL_MSG }, ++ + /* Corsair Strafe RGB */ + { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT | + USB_QUIRK_DELAY_CTRL_MSG }, +diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c +index 00b710016d21..b7b55eb82714 100644 +--- a/drivers/usb/host/xhci-mem.c ++++ b/drivers/usb/host/xhci-mem.c +@@ -604,7 +604,7 @@ struct xhci_ring *xhci_stream_id_to_ring( + if (!ep->stream_info) + return NULL; + +- if (stream_id > ep->stream_info->num_streams) ++ if (stream_id >= ep->stream_info->num_streams) + return NULL; + return ep->stream_info->stream_rings[stream_id]; + } +diff --git a/drivers/usb/misc/yurex.c b/drivers/usb/misc/yurex.c +index 58abdf28620a..47763311a42e 100644 +--- a/drivers/usb/misc/yurex.c ++++ b/drivers/usb/misc/yurex.c +@@ -400,8 +400,7 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, + loff_t *ppos) + { + struct usb_yurex *dev; +- int retval = 0; +- int bytes_read = 0; ++ int len = 0; + char in_buffer[20]; + unsigned long flags; + +@@ -409,26 +408,16 @@ static ssize_t yurex_read(struct file *file, char __user *buffer, size_t count, + + mutex_lock(&dev->io_mutex); + if (!dev->interface) { /* already disconnected */ +- retval = -ENODEV; +- goto exit; ++ mutex_unlock(&dev->io_mutex); ++ return -ENODEV; + } + + spin_lock_irqsave(&dev->lock, flags); +- bytes_read = snprintf(in_buffer, 20, "%lld\n", dev->bbu); ++ len = snprintf(in_buffer, 20, "%lld\n", dev->bbu); + spin_unlock_irqrestore(&dev->lock, flags); +- +- if (*ppos < bytes_read) { +- if (copy_to_user(buffer, in_buffer + *ppos, bytes_read - *ppos)) +- retval = -EFAULT; +- else { +- retval = bytes_read - *ppos; +- *ppos += bytes_read; +- } +- } +- +-exit: + mutex_unlock(&dev->io_mutex); +- return retval; ++ ++ return simple_read_from_buffer(buffer, count, ppos, in_buffer, len); + } + + static ssize_t yurex_write(struct file *file, const char __user *user_buffer, +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index 351745aec0e1..578596d301b8 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -131,7 +131,7 @@ static int ch341_control_in(struct usb_device *dev, + r = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), request, + USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_IN, + value, index, buf, bufsize, DEFAULT_TIMEOUT); +- if (r < bufsize) { ++ if (r < (int)bufsize) { + if (r >= 0) { + dev_err(&dev->dev, + "short control message received (%d < %u)\n", +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 142a83e5974c..c931ae689a91 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -152,6 +152,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ + { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ + { USB_DEVICE(0x10C4, 0x89A4) }, /* CESINEL FTBC Flexible Thyristor Bridge Controller */ ++ { USB_DEVICE(0x10C4, 0x89FB) }, /* Qivicon ZigBee USB Radio Stick */ + { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ + { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ + { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ +diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c +index 196908dd25a1..f8e8285663a6 100644 +--- a/drivers/usb/serial/keyspan_pda.c ++++ b/drivers/usb/serial/keyspan_pda.c +@@ -373,8 +373,10 @@ static int keyspan_pda_get_modem_info(struct usb_serial *serial, + 3, /* get pins */ + USB_TYPE_VENDOR|USB_RECIP_INTERFACE|USB_DIR_IN, + 0, 0, data, 1, 2000); +- if (rc >= 0) ++ if (rc == 1) + *value = *data; ++ else if (rc >= 0) ++ rc = -EIO; + + kfree(data); + return rc; +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index e8669aae14b3..5e490177cf75 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -481,6 +481,9 @@ static void mos7840_control_callback(struct urb *urb) + } + + dev_dbg(dev, "%s urb buffer size is %d\n", __func__, urb->actual_length); ++ if (urb->actual_length < 1) ++ goto out; ++ + dev_dbg(dev, "%s mos7840_port->MsrLsr is %d port %d\n", __func__, + mos7840_port->MsrLsr, mos7840_port->port_num); + data = urb->transfer_buffer; +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 73b01e474fdc..c0e3f91e28e9 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1235,9 +1235,8 @@ static int load_elf_library(struct file *file) + goto out_free_ph; + } + +- len = ELF_PAGESTART(eppnt->p_filesz + eppnt->p_vaddr + +- ELF_MIN_ALIGN - 1); +- bss = eppnt->p_memsz + eppnt->p_vaddr; ++ len = ELF_PAGEALIGN(eppnt->p_filesz + eppnt->p_vaddr); ++ bss = ELF_PAGEALIGN(eppnt->p_memsz + eppnt->p_vaddr); + if (bss > len) { + error = vm_brk(len, bss - len); + if (error) +diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c +index e31d6ed3ec32..542364bf923e 100644 +--- a/fs/devpts/inode.c ++++ b/fs/devpts/inode.c +@@ -138,10 +138,6 @@ static int devpts_ptmx_path(struct path *path) + struct super_block *sb; + int err; + +- /* Has the devpts filesystem already been found? */ +- if (path->mnt->mnt_sb->s_magic == DEVPTS_SUPER_MAGIC) +- return 0; +- + /* Is a devpts filesystem at "pts" in the same directory? */ + err = path_pts(path); + if (err) +@@ -159,22 +155,32 @@ static int devpts_ptmx_path(struct path *path) + struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi) + { + struct path path; +- int err; ++ int err = 0; + + path = filp->f_path; + path_get(&path); + +- err = devpts_ptmx_path(&path); ++ /* Walk upward while the start point is a bind mount of ++ * a single file. ++ */ ++ while (path.mnt->mnt_root == path.dentry) ++ if (follow_up(&path) == 0) ++ break; ++ ++ /* devpts_ptmx_path() finds a devpts fs or returns an error. */ ++ if ((path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) || ++ (DEVPTS_SB(path.mnt->mnt_sb) != fsi)) ++ err = devpts_ptmx_path(&path); + dput(path.dentry); +- if (err) { +- mntput(path.mnt); +- return ERR_PTR(err); +- } +- if (DEVPTS_SB(path.mnt->mnt_sb) != fsi) { +- mntput(path.mnt); +- return ERR_PTR(-ENODEV); ++ if (!err) { ++ if (DEVPTS_SB(path.mnt->mnt_sb) == fsi) ++ return path.mnt; ++ ++ err = -ENODEV; + } +- return path.mnt; ++ ++ mntput(path.mnt); ++ return ERR_PTR(err); + } + + struct pts_fs_info *devpts_acquire(struct file *filp) +@@ -182,15 +188,19 @@ struct pts_fs_info *devpts_acquire(struct file *filp) + struct pts_fs_info *result; + struct path path; + struct super_block *sb; +- int err; + + path = filp->f_path; + path_get(&path); + +- err = devpts_ptmx_path(&path); +- if (err) { +- result = ERR_PTR(err); +- goto out; ++ /* Has the devpts filesystem already been found? */ ++ if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) { ++ int err; ++ ++ err = devpts_ptmx_path(&path); ++ if (err) { ++ result = ERR_PTR(err); ++ goto out; ++ } + } + + /* +diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h +index 4b4a72f392be..3b34004a71c1 100644 +--- a/fs/f2fs/f2fs.h ++++ b/fs/f2fs/f2fs.h +@@ -1470,18 +1470,6 @@ static inline bool __exist_node_summaries(struct f2fs_sb_info *sbi) + is_set_ckpt_flags(sbi, CP_FASTBOOT_FLAG)); + } + +-/* +- * Check whether the given nid is within node id range. +- */ +-static inline int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid) +-{ +- if (unlikely(nid < F2FS_ROOT_INO(sbi))) +- return -EINVAL; +- if (unlikely(nid >= NM_I(sbi)->max_nid)) +- return -EINVAL; +- return 0; +-} +- + /* + * Check whether the inode has blocks or not + */ +@@ -2470,6 +2458,7 @@ f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info, + struct dnode_of_data; + struct node_info; + ++int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid); + bool available_free_memory(struct f2fs_sb_info *sbi, int type); + int need_dentry_mark(struct f2fs_sb_info *sbi, nid_t nid); + bool is_checkpointed_node(struct f2fs_sb_info *sbi, nid_t nid); +diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c +index 50c88e37ed66..259b0aa283f0 100644 +--- a/fs/f2fs/inode.c ++++ b/fs/f2fs/inode.c +@@ -188,12 +188,8 @@ static int do_read_inode(struct inode *inode) + projid_t i_projid; + + /* Check if ino is within scope */ +- if (check_nid_range(sbi, inode->i_ino)) { +- f2fs_msg(inode->i_sb, KERN_ERR, "bad inode number: %lu", +- (unsigned long) inode->i_ino); +- WARN_ON(1); ++ if (check_nid_range(sbi, inode->i_ino)) + return -EINVAL; +- } + + node_page = get_node_page(sbi, inode->i_ino); + if (IS_ERR(node_page)) +@@ -538,8 +534,11 @@ void f2fs_evict_inode(struct inode *inode) + alloc_nid_failed(sbi, inode->i_ino); + clear_inode_flag(inode, FI_FREE_NID); + } else { +- f2fs_bug_on(sbi, err && +- !exist_written_data(sbi, inode->i_ino, ORPHAN_INO)); ++ /* ++ * If xattr nid is corrupted, we can reach out error condition, ++ * err & !exist_written_data(sbi, inode->i_ino, ORPHAN_INO)). ++ * In that case, check_nid_range() is enough to give a clue. ++ */ + } + out_clear: + fscrypt_put_encryption_info(inode, NULL); +diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c +index fca87835a1da..f623da26159f 100644 +--- a/fs/f2fs/node.c ++++ b/fs/f2fs/node.c +@@ -29,6 +29,21 @@ static struct kmem_cache *nat_entry_slab; + static struct kmem_cache *free_nid_slab; + static struct kmem_cache *nat_entry_set_slab; + ++/* ++ * Check whether the given nid is within node id range. ++ */ ++int check_nid_range(struct f2fs_sb_info *sbi, nid_t nid) ++{ ++ if (unlikely(nid < F2FS_ROOT_INO(sbi) || nid >= NM_I(sbi)->max_nid)) { ++ set_sbi_flag(sbi, SBI_NEED_FSCK); ++ f2fs_msg(sbi->sb, KERN_WARNING, ++ "%s: out-of-range nid=%x, run fsck to fix.", ++ __func__, nid); ++ return -EINVAL; ++ } ++ return 0; ++} ++ + bool available_free_memory(struct f2fs_sb_info *sbi, int type) + { + struct f2fs_nm_info *nm_i = NM_I(sbi); +@@ -1122,7 +1137,8 @@ void ra_node_page(struct f2fs_sb_info *sbi, nid_t nid) + + if (!nid) + return; +- f2fs_bug_on(sbi, check_nid_range(sbi, nid)); ++ if (check_nid_range(sbi, nid)) ++ return; + + rcu_read_lock(); + apage = radix_tree_lookup(&NODE_MAPPING(sbi)->page_tree, nid); +@@ -1146,7 +1162,8 @@ static struct page *__get_node_page(struct f2fs_sb_info *sbi, pgoff_t nid, + + if (!nid) + return ERR_PTR(-ENOENT); +- f2fs_bug_on(sbi, check_nid_range(sbi, nid)); ++ if (check_nid_range(sbi, nid)) ++ return ERR_PTR(-EINVAL); + repeat: + page = f2fs_grab_cache_page(NODE_MAPPING(sbi), nid, false); + if (!page) +diff --git a/fs/inode.c b/fs/inode.c +index e07b3e1f5970..cfc36d11bcb3 100644 +--- a/fs/inode.c ++++ b/fs/inode.c +@@ -2006,8 +2006,14 @@ void inode_init_owner(struct inode *inode, const struct inode *dir, + inode->i_uid = current_fsuid(); + if (dir && dir->i_mode & S_ISGID) { + inode->i_gid = dir->i_gid; ++ ++ /* Directories are special, and always inherit S_ISGID */ + if (S_ISDIR(mode)) + mode |= S_ISGID; ++ else if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP) && ++ !in_group_p(inode->i_gid) && ++ !capable_wrt_inode_uidgid(dir, CAP_FSETID)) ++ mode &= ~S_ISGID; + } else + inode->i_gid = current_fsgid(); + inode->i_mode = mode; +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 4cd8328e4039..6f337fff38c4 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -850,7 +850,7 @@ static int show_smap(struct seq_file *m, void *v, int is_pid) + mss->private_hugetlb >> 10, + mss->swap >> 10, + (unsigned long)(mss->swap_pss >> (10 + PSS_SHIFT)), +- (unsigned long)(mss->pss >> (10 + PSS_SHIFT))); ++ (unsigned long)(mss->pss_locked >> (10 + PSS_SHIFT))); + + if (!rollup_mode) { + arch_show_smap(m, vma); +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 931c32f1f18d..c5188dc389c8 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -211,6 +211,7 @@ enum { + ATA_FLAG_SLAVE_POSS = (1 << 0), /* host supports slave dev */ + /* (doesn't imply presence) */ + ATA_FLAG_SATA = (1 << 1), ++ ATA_FLAG_NO_LPM = (1 << 2), /* host not happy with LPM */ + ATA_FLAG_NO_LOG_PAGE = (1 << 5), /* do not issue log page read */ + ATA_FLAG_NO_ATAPI = (1 << 6), /* No ATAPI support */ + ATA_FLAG_PIO_DMA = (1 << 7), /* PIO cmds via DMA */ +diff --git a/kernel/irq/affinity.c b/kernel/irq/affinity.c +index e12d35108225..a37a3b4b6342 100644 +--- a/kernel/irq/affinity.c ++++ b/kernel/irq/affinity.c +@@ -39,7 +39,7 @@ static void irq_spread_init_one(struct cpumask *irqmsk, struct cpumask *nmsk, + } + } + +-static cpumask_var_t *alloc_node_to_present_cpumask(void) ++static cpumask_var_t *alloc_node_to_possible_cpumask(void) + { + cpumask_var_t *masks; + int node; +@@ -62,7 +62,7 @@ static cpumask_var_t *alloc_node_to_present_cpumask(void) + return NULL; + } + +-static void free_node_to_present_cpumask(cpumask_var_t *masks) ++static void free_node_to_possible_cpumask(cpumask_var_t *masks) + { + int node; + +@@ -71,22 +71,22 @@ static void free_node_to_present_cpumask(cpumask_var_t *masks) + kfree(masks); + } + +-static void build_node_to_present_cpumask(cpumask_var_t *masks) ++static void build_node_to_possible_cpumask(cpumask_var_t *masks) + { + int cpu; + +- for_each_present_cpu(cpu) ++ for_each_possible_cpu(cpu) + cpumask_set_cpu(cpu, masks[cpu_to_node(cpu)]); + } + +-static int get_nodes_in_cpumask(cpumask_var_t *node_to_present_cpumask, ++static int get_nodes_in_cpumask(cpumask_var_t *node_to_possible_cpumask, + const struct cpumask *mask, nodemask_t *nodemsk) + { + int n, nodes = 0; + + /* Calculate the number of nodes in the supplied affinity mask */ + for_each_node(n) { +- if (cpumask_intersects(mask, node_to_present_cpumask[n])) { ++ if (cpumask_intersects(mask, node_to_possible_cpumask[n])) { + node_set(n, *nodemsk); + nodes++; + } +@@ -109,7 +109,7 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + int last_affv = affv + affd->pre_vectors; + nodemask_t nodemsk = NODE_MASK_NONE; + struct cpumask *masks; +- cpumask_var_t nmsk, *node_to_present_cpumask; ++ cpumask_var_t nmsk, *node_to_possible_cpumask; + + /* + * If there aren't any vectors left after applying the pre/post +@@ -125,8 +125,8 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + if (!masks) + goto out; + +- node_to_present_cpumask = alloc_node_to_present_cpumask(); +- if (!node_to_present_cpumask) ++ node_to_possible_cpumask = alloc_node_to_possible_cpumask(); ++ if (!node_to_possible_cpumask) + goto out; + + /* Fill out vectors at the beginning that don't need affinity */ +@@ -135,8 +135,8 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + + /* Stabilize the cpumasks */ + get_online_cpus(); +- build_node_to_present_cpumask(node_to_present_cpumask); +- nodes = get_nodes_in_cpumask(node_to_present_cpumask, cpu_present_mask, ++ build_node_to_possible_cpumask(node_to_possible_cpumask); ++ nodes = get_nodes_in_cpumask(node_to_possible_cpumask, cpu_possible_mask, + &nodemsk); + + /* +@@ -146,7 +146,7 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + if (affv <= nodes) { + for_each_node_mask(n, nodemsk) { + cpumask_copy(masks + curvec, +- node_to_present_cpumask[n]); ++ node_to_possible_cpumask[n]); + if (++curvec == last_affv) + break; + } +@@ -160,7 +160,7 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + vecs_per_node = (affv - (curvec - affd->pre_vectors)) / nodes; + + /* Get the cpus on this node which are in the mask */ +- cpumask_and(nmsk, cpu_present_mask, node_to_present_cpumask[n]); ++ cpumask_and(nmsk, cpu_possible_mask, node_to_possible_cpumask[n]); + + /* Calculate the number of cpus per vector */ + ncpus = cpumask_weight(nmsk); +@@ -192,7 +192,7 @@ irq_create_affinity_masks(int nvecs, const struct irq_affinity *affd) + /* Fill out vectors at the end that don't need affinity */ + for (; curvec < nvecs; curvec++) + cpumask_copy(masks + curvec, irq_default_affinity); +- free_node_to_present_cpumask(node_to_present_cpumask); ++ free_node_to_possible_cpumask(node_to_possible_cpumask); + out: + free_cpumask_var(nmsk); + return masks; +@@ -214,7 +214,7 @@ int irq_calc_affinity_vectors(int minvec, int maxvec, const struct irq_affinity + return 0; + + get_online_cpus(); +- ret = min_t(int, cpumask_weight(cpu_present_mask), vecs) + resv; ++ ret = min_t(int, cpumask_weight(cpu_possible_mask), vecs) + resv; + put_online_cpus(); + return ret; + } +diff --git a/kernel/power/user.c b/kernel/power/user.c +index 22df9f7ff672..69017a569f30 100644 +--- a/kernel/power/user.c ++++ b/kernel/power/user.c +@@ -186,6 +186,11 @@ static ssize_t snapshot_write(struct file *filp, const char __user *buf, + res = PAGE_SIZE - pg_offp; + } + ++ if (!data_of(data->handle)) { ++ res = -EINVAL; ++ goto unlock; ++ } ++ + res = simple_write_to_buffer(data_of(data->handle), res, &pg_offp, + buf, count); + if (res > 0) +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 520ecaf61dc4..e268750bd4ad 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3359,8 +3359,8 @@ static void print_func_help_header(struct trace_buffer *buf, struct seq_file *m, + + print_event_info(buf, m); + +- seq_printf(m, "# TASK-PID CPU# %s TIMESTAMP FUNCTION\n", tgid ? "TGID " : ""); +- seq_printf(m, "# | | | %s | |\n", tgid ? " | " : ""); ++ seq_printf(m, "# TASK-PID %s CPU# TIMESTAMP FUNCTION\n", tgid ? "TGID " : ""); ++ seq_printf(m, "# | | %s | | |\n", tgid ? " | " : ""); + } + + static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file *m, +@@ -3380,9 +3380,9 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file + tgid ? tgid_space : space); + seq_printf(m, "# %s||| / delay\n", + tgid ? tgid_space : space); +- seq_printf(m, "# TASK-PID CPU#%s|||| TIMESTAMP FUNCTION\n", ++ seq_printf(m, "# TASK-PID %sCPU# |||| TIMESTAMP FUNCTION\n", + tgid ? " TGID " : space); +- seq_printf(m, "# | | | %s|||| | |\n", ++ seq_printf(m, "# | | %s | |||| | |\n", + tgid ? " | " : space); + } + +diff --git a/kernel/trace/trace_output.c b/kernel/trace/trace_output.c +index c738e764e2a5..4500b00e4e36 100644 +--- a/kernel/trace/trace_output.c ++++ b/kernel/trace/trace_output.c +@@ -594,8 +594,7 @@ int trace_print_context(struct trace_iterator *iter) + + trace_find_cmdline(entry->pid, comm); + +- trace_seq_printf(s, "%16s-%-5d [%03d] ", +- comm, entry->pid, iter->cpu); ++ trace_seq_printf(s, "%16s-%-5d ", comm, entry->pid); + + if (tr->trace_flags & TRACE_ITER_RECORD_TGID) { + unsigned int tgid = trace_find_tgid(entry->pid); +@@ -606,6 +605,8 @@ int trace_print_context(struct trace_iterator *iter) + trace_seq_printf(s, "(%5d) ", tgid); + } + ++ trace_seq_printf(s, "[%03d] ", iter->cpu); ++ + if (tr->trace_flags & TRACE_ITER_IRQ_INFO) + trace_print_lat_fmt(s, entry); + +diff --git a/mm/gup.c b/mm/gup.c +index 72c921da0f3b..4cc8a6ff0f56 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -1235,8 +1235,6 @@ int __mm_populate(unsigned long start, unsigned long len, int ignore_errors) + int locked = 0; + long ret = 0; + +- VM_BUG_ON(start & ~PAGE_MASK); +- VM_BUG_ON(len != PAGE_ALIGN(len)); + end = start + len; + + for (nstart = start; nstart < end; nstart = nend) { +diff --git a/mm/mmap.c b/mm/mmap.c +index f858b1f336af..2398776195d2 100644 +--- a/mm/mmap.c ++++ b/mm/mmap.c +@@ -177,8 +177,8 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) + return next; + } + +-static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf); +- ++static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags, ++ struct list_head *uf); + SYSCALL_DEFINE1(brk, unsigned long, brk) + { + unsigned long retval; +@@ -236,7 +236,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) + goto out; + + /* Ok, looks good - let it rip. */ +- if (do_brk(oldbrk, newbrk-oldbrk, &uf) < 0) ++ if (do_brk_flags(oldbrk, newbrk-oldbrk, 0, &uf) < 0) + goto out; + + set_brk: +@@ -2887,21 +2887,14 @@ static inline void verify_mm_writelocked(struct mm_struct *mm) + * anonymous maps. eventually we may be able to do some + * brk-specific accounting here. + */ +-static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long flags, struct list_head *uf) ++static int do_brk_flags(unsigned long addr, unsigned long len, unsigned long flags, struct list_head *uf) + { + struct mm_struct *mm = current->mm; + struct vm_area_struct *vma, *prev; +- unsigned long len; + struct rb_node **rb_link, *rb_parent; + pgoff_t pgoff = addr >> PAGE_SHIFT; + int error; + +- len = PAGE_ALIGN(request); +- if (len < request) +- return -ENOMEM; +- if (!len) +- return 0; +- + /* Until we need other flags, refuse anything except VM_EXEC. */ + if ((flags & (~VM_EXEC)) != 0) + return -EINVAL; +@@ -2973,18 +2966,20 @@ static int do_brk_flags(unsigned long addr, unsigned long request, unsigned long + return 0; + } + +-static int do_brk(unsigned long addr, unsigned long len, struct list_head *uf) +-{ +- return do_brk_flags(addr, len, 0, uf); +-} +- +-int vm_brk_flags(unsigned long addr, unsigned long len, unsigned long flags) ++int vm_brk_flags(unsigned long addr, unsigned long request, unsigned long flags) + { + struct mm_struct *mm = current->mm; ++ unsigned long len; + int ret; + bool populate; + LIST_HEAD(uf); + ++ len = PAGE_ALIGN(request); ++ if (len < request) ++ return -ENOMEM; ++ if (!len) ++ return 0; ++ + if (down_write_killable(&mm->mmap_sem)) + return -EINTR; + +diff --git a/mm/rmap.c b/mm/rmap.c +index b874c4761e84..97edcf44d88c 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -64,6 +64,7 @@ + #include + #include + #include ++#include + + #include + +@@ -1476,11 +1477,16 @@ static bool try_to_unmap_one(struct page *page, struct vm_area_struct *vma, + set_pte_at(mm, address, pvmw.pte, pteval); + } + +- } else if (pte_unused(pteval)) { ++ } else if (pte_unused(pteval) && !userfaultfd_armed(vma)) { + /* + * The guest indicated that the page content is of no + * interest anymore. Simply discard the pte, vmscan + * will take care of the rest. ++ * A future reference will then fault in a new zero ++ * page. When userfaultfd is active, we must not drop ++ * this page though, as its main user (postcopy ++ * migration) will not expect userfaults on already ++ * copied pages. + */ + dec_mm_counter(mm, mm_counter(page)); + } else if (IS_ENABLED(CONFIG_MIGRATION) && +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index e27fb6e97d18..25738b20676d 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -696,6 +696,8 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + } + i = 0; + ++ memset(&mtpar, 0, sizeof(mtpar)); ++ memset(&tgpar, 0, sizeof(tgpar)); + mtpar.net = tgpar.net = net; + mtpar.table = tgpar.table = name; + mtpar.entryinfo = tgpar.entryinfo = e; +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c +index 1a925f2394ad..114d4bef1bec 100644 +--- a/net/ipv4/netfilter/ip_tables.c ++++ b/net/ipv4/netfilter/ip_tables.c +@@ -541,6 +541,7 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, + return -ENOMEM; + + j = 0; ++ memset(&mtpar, 0, sizeof(mtpar)); + mtpar.net = net; + mtpar.table = name; + mtpar.entryinfo = &e->ip; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index c5fe42e6b7f7..2e51e0156903 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -561,6 +561,7 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, + return -ENOMEM; + + j = 0; ++ memset(&mtpar, 0, sizeof(mtpar)); + mtpar.net = net; + mtpar.table = name; + mtpar.entryinfo = &e->ipv6; +diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c +index c9796629858f..02bbc2f9f1f1 100644 +--- a/net/netfilter/nfnetlink_queue.c ++++ b/net/netfilter/nfnetlink_queue.c +@@ -1228,6 +1228,9 @@ static int nfqnl_recv_unsupp(struct net *net, struct sock *ctnl, + static const struct nla_policy nfqa_cfg_policy[NFQA_CFG_MAX+1] = { + [NFQA_CFG_CMD] = { .len = sizeof(struct nfqnl_msg_config_cmd) }, + [NFQA_CFG_PARAMS] = { .len = sizeof(struct nfqnl_msg_config_params) }, ++ [NFQA_CFG_QUEUE_MAXLEN] = { .type = NLA_U32 }, ++ [NFQA_CFG_MASK] = { .type = NLA_U32 }, ++ [NFQA_CFG_FLAGS] = { .type = NLA_U32 }, + }; + + static const struct nf_queue_handler nfqh = { +diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c +index 7d7eb1354eee..ffb6aba71998 100644 +--- a/sound/pci/hda/patch_hdmi.c ++++ b/sound/pci/hda/patch_hdmi.c +@@ -33,6 +33,7 @@ + #include + #include + #include ++#include + #include + #include + #include +@@ -764,8 +765,10 @@ static void check_presence_and_report(struct hda_codec *codec, hda_nid_t nid, + + if (pin_idx < 0) + return; ++ mutex_lock(&spec->pcm_lock); + if (hdmi_present_sense(get_pin(spec, pin_idx), 1)) + snd_hda_jack_report_sync(codec); ++ mutex_unlock(&spec->pcm_lock); + } + + static void jack_callback(struct hda_codec *codec, +@@ -1628,21 +1631,23 @@ static void sync_eld_via_acomp(struct hda_codec *codec, + static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll) + { + struct hda_codec *codec = per_pin->codec; +- struct hdmi_spec *spec = codec->spec; + int ret; + + /* no temporary power up/down needed for component notifier */ +- if (!codec_has_acomp(codec)) +- snd_hda_power_up_pm(codec); ++ if (!codec_has_acomp(codec)) { ++ ret = snd_hda_power_up_pm(codec); ++ if (ret < 0 && pm_runtime_suspended(hda_codec_dev(codec))) { ++ snd_hda_power_down_pm(codec); ++ return false; ++ } ++ } + +- mutex_lock(&spec->pcm_lock); + if (codec_has_acomp(codec)) { + sync_eld_via_acomp(codec, per_pin); + ret = false; /* don't call snd_hda_jack_report_sync() */ + } else { + ret = hdmi_present_sense_via_verbs(per_pin, repoll); + } +- mutex_unlock(&spec->pcm_lock); + + if (!codec_has_acomp(codec)) + snd_hda_power_down_pm(codec); +@@ -1654,12 +1659,16 @@ static void hdmi_repoll_eld(struct work_struct *work) + { + struct hdmi_spec_per_pin *per_pin = + container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work); ++ struct hda_codec *codec = per_pin->codec; ++ struct hdmi_spec *spec = codec->spec; + + if (per_pin->repoll_count++ > 6) + per_pin->repoll_count = 0; + ++ mutex_lock(&spec->pcm_lock); + if (hdmi_present_sense(per_pin, per_pin->repoll_count)) + snd_hda_jack_report_sync(per_pin->codec); ++ mutex_unlock(&spec->pcm_lock); + } + + static void intel_haswell_fixup_connect_list(struct hda_codec *codec, +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 02157e3d82bb..bf7737fc3b28 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6445,7 +6445,6 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x310c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x312a, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x312f, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), +- SND_PCI_QUIRK(0x17aa, 0x3136, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x313c, "ThinkCentre Station", ALC294_FIXUP_LENOVO_MIC_LOCATION), + SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), +@@ -6628,6 +6627,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { + {0x1a, 0x02a11040}, + {0x1b, 0x01014020}, + {0x21, 0x0221101f}), ++ SND_HDA_PIN_QUIRK(0x10ec0235, 0x17aa, "Lenovo", ALC294_FIXUP_LENOVO_MIC_LOCATION, ++ {0x14, 0x90170110}, ++ {0x19, 0x02a11020}, ++ {0x1a, 0x02a11030}, ++ {0x21, 0x0221101f}), + SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, + {0x12, 0x90a60140}, + {0x14, 0x90170150}, +diff --git a/sound/soc/mediatek/common/mtk-afe-platform-driver.c b/sound/soc/mediatek/common/mtk-afe-platform-driver.c +index 82d439c15f4e..e58fbefa5e6b 100644 +--- a/sound/soc/mediatek/common/mtk-afe-platform-driver.c ++++ b/sound/soc/mediatek/common/mtk-afe-platform-driver.c +@@ -63,13 +63,13 @@ static const struct snd_pcm_ops mtk_afe_pcm_ops = { + static int mtk_afe_pcm_new(struct snd_soc_pcm_runtime *rtd) + { + size_t size; +- struct snd_card *card = rtd->card->snd_card; + struct snd_pcm *pcm = rtd->pcm; + struct mtk_base_afe *afe = snd_soc_platform_get_drvdata(rtd->platform); + + size = afe->mtk_afe_hardware->buffer_bytes_max; + return snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, +- card->dev, size, size); ++ rtd->platform->dev, ++ size, size); + } + + static void mtk_afe_pcm_free(struct snd_pcm *pcm) +diff --git a/tools/build/Build.include b/tools/build/Build.include +index a4bbb984941d..d9048f145f97 100644 +--- a/tools/build/Build.include ++++ b/tools/build/Build.include +@@ -63,8 +63,8 @@ dep-cmd = $(if $(wildcard $(fixdep)), + $(fixdep) $(depfile) $@ '$(make-cmd)' > $(dot-target).tmp; \ + rm -f $(depfile); \ + mv -f $(dot-target).tmp $(dot-target).cmd, \ +- printf '\# cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \ +- printf '\# using basic dep data\n\n' >> $(dot-target).cmd; \ ++ printf '$(pound) cannot find fixdep (%s)\n' $(fixdep) > $(dot-target).cmd; \ ++ printf '$(pound) using basic dep data\n\n' >> $(dot-target).cmd; \ + cat $(depfile) >> $(dot-target).cmd; \ + printf '\n%s\n' 'cmd_$@ := $(make-cmd)' >> $(dot-target).cmd) + diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.56-57.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.56-57.patch new file mode 100644 index 000000000000..eb55ba8be7c4 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.56-57.patch @@ -0,0 +1,4939 @@ +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index 0380a45ecf4b..d6d7669e667f 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -3997,6 +3997,23 @@ + expediting. Set to zero to disable automatic + expediting. + ++ ssbd= [ARM64,HW] ++ Speculative Store Bypass Disable control ++ ++ On CPUs that are vulnerable to the Speculative ++ Store Bypass vulnerability and offer a ++ firmware based mitigation, this parameter ++ indicates how the mitigation should be used: ++ ++ force-on: Unconditionally enable mitigation for ++ for both kernel and userspace ++ force-off: Unconditionally disable mitigation for ++ for both kernel and userspace ++ kernel: Always enable mitigation in the ++ kernel, and offer a prctl interface ++ to allow userspace to register its ++ interest in being mitigated too. ++ + stack_guard_gap= [MM] + override the default stack gap protection. The value + is in page units and it defines how many pages prior +diff --git a/Makefile b/Makefile +index acbb0e3d29c9..a44d6b2adb76 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 56 ++SUBLEVEL = 57 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/include/asm/kvm_host.h b/arch/arm/include/asm/kvm_host.h +index 8f973e3b7348..65572e14306c 100644 +--- a/arch/arm/include/asm/kvm_host.h ++++ b/arch/arm/include/asm/kvm_host.h +@@ -302,4 +302,16 @@ static inline bool kvm_arm_harden_branch_predictor(void) + return false; + } + ++#define KVM_SSBD_UNKNOWN -1 ++#define KVM_SSBD_FORCE_DISABLE 0 ++#define KVM_SSBD_KERNEL 1 ++#define KVM_SSBD_FORCE_ENABLE 2 ++#define KVM_SSBD_MITIGATED 3 ++ ++static inline int kvm_arm_have_ssbd(void) ++{ ++ /* No way to detect it yet, pretend it is not there. */ ++ return KVM_SSBD_UNKNOWN; ++} ++ + #endif /* __ARM_KVM_HOST_H__ */ +diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h +index 08cd720eae01..8a098e65f5f8 100644 +--- a/arch/arm/include/asm/kvm_mmu.h ++++ b/arch/arm/include/asm/kvm_mmu.h +@@ -28,6 +28,13 @@ + */ + #define kern_hyp_va(kva) (kva) + ++/* Contrary to arm64, there is no need to generate a PC-relative address */ ++#define hyp_symbol_addr(s) \ ++ ({ \ ++ typeof(s) *addr = &(s); \ ++ addr; \ ++ }) ++ + /* + * KVM_MMU_CACHE_MIN_PAGES is the number of stage2 page table translation levels. + */ +@@ -247,6 +254,11 @@ static inline int kvm_map_vectors(void) + return 0; + } + ++static inline int hyp_map_aux_data(void) ++{ ++ return 0; ++} ++ + #endif /* !__ASSEMBLY__ */ + + #endif /* __ARM_KVM_MMU_H__ */ +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 2d5f7aca156d..1bbb89d37f57 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -849,6 +849,15 @@ config HARDEN_BRANCH_PREDICTOR + + If unsure, say Y. + ++config ARM64_SSBD ++ bool "Speculative Store Bypass Disable" if EXPERT ++ default y ++ help ++ This enables mitigation of the bypassing of previous stores ++ by speculative loads. ++ ++ If unsure, say Y. ++ + menuconfig ARMV8_DEPRECATED + bool "Emulate deprecated/obsolete ARMv8 instructions" + depends on COMPAT +diff --git a/arch/arm64/include/asm/alternative.h b/arch/arm64/include/asm/alternative.h +index 4a85c6952a22..a91933b1e2e6 100644 +--- a/arch/arm64/include/asm/alternative.h ++++ b/arch/arm64/include/asm/alternative.h +@@ -5,6 +5,8 @@ + #include + #include + ++#define ARM64_CB_PATCH ARM64_NCAPS ++ + #ifndef __ASSEMBLY__ + + #include +@@ -12,6 +14,8 @@ + #include + #include + ++extern int alternatives_applied; ++ + struct alt_instr { + s32 orig_offset; /* offset to original instruction */ + s32 alt_offset; /* offset to replacement instruction */ +@@ -20,12 +24,19 @@ struct alt_instr { + u8 alt_len; /* size of new instruction(s), <= orig_len */ + }; + ++typedef void (*alternative_cb_t)(struct alt_instr *alt, ++ __le32 *origptr, __le32 *updptr, int nr_inst); ++ + void __init apply_alternatives_all(void); + void apply_alternatives(void *start, size_t length); + +-#define ALTINSTR_ENTRY(feature) \ ++#define ALTINSTR_ENTRY(feature,cb) \ + " .word 661b - .\n" /* label */ \ ++ " .if " __stringify(cb) " == 0\n" \ + " .word 663f - .\n" /* new instruction */ \ ++ " .else\n" \ ++ " .word " __stringify(cb) "- .\n" /* callback */ \ ++ " .endif\n" \ + " .hword " __stringify(feature) "\n" /* feature bit */ \ + " .byte 662b-661b\n" /* source len */ \ + " .byte 664f-663f\n" /* replacement len */ +@@ -43,15 +54,18 @@ void apply_alternatives(void *start, size_t length); + * but most assemblers die if insn1 or insn2 have a .inst. This should + * be fixed in a binutils release posterior to 2.25.51.0.2 (anything + * containing commit 4e4d08cf7399b606 or c1baaddf8861). ++ * ++ * Alternatives with callbacks do not generate replacement instructions. + */ +-#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled) \ ++#define __ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg_enabled, cb) \ + ".if "__stringify(cfg_enabled)" == 1\n" \ + "661:\n\t" \ + oldinstr "\n" \ + "662:\n" \ + ".pushsection .altinstructions,\"a\"\n" \ +- ALTINSTR_ENTRY(feature) \ ++ ALTINSTR_ENTRY(feature,cb) \ + ".popsection\n" \ ++ " .if " __stringify(cb) " == 0\n" \ + ".pushsection .altinstr_replacement, \"a\"\n" \ + "663:\n\t" \ + newinstr "\n" \ +@@ -59,11 +73,17 @@ void apply_alternatives(void *start, size_t length); + ".popsection\n\t" \ + ".org . - (664b-663b) + (662b-661b)\n\t" \ + ".org . - (662b-661b) + (664b-663b)\n" \ ++ ".else\n\t" \ ++ "663:\n\t" \ ++ "664:\n\t" \ ++ ".endif\n" \ + ".endif\n" + + #define _ALTERNATIVE_CFG(oldinstr, newinstr, feature, cfg, ...) \ +- __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg)) ++ __ALTERNATIVE_CFG(oldinstr, newinstr, feature, IS_ENABLED(cfg), 0) + ++#define ALTERNATIVE_CB(oldinstr, cb) \ ++ __ALTERNATIVE_CFG(oldinstr, "NOT_AN_INSTRUCTION", ARM64_CB_PATCH, 1, cb) + #else + + #include +@@ -130,6 +150,14 @@ void apply_alternatives(void *start, size_t length); + 661: + .endm + ++.macro alternative_cb cb ++ .set .Lasm_alt_mode, 0 ++ .pushsection .altinstructions, "a" ++ altinstruction_entry 661f, \cb, ARM64_CB_PATCH, 662f-661f, 0 ++ .popsection ++661: ++.endm ++ + /* + * Provide the other half of the alternative code sequence. + */ +@@ -155,6 +183,13 @@ void apply_alternatives(void *start, size_t length); + .org . - (662b-661b) + (664b-663b) + .endm + ++/* ++ * Callback-based alternative epilogue ++ */ ++.macro alternative_cb_end ++662: ++.endm ++ + /* + * Provides a trivial alternative or default sequence consisting solely + * of NOPs. The number of NOPs is chosen automatically to match the +diff --git a/arch/arm64/include/asm/assembler.h b/arch/arm64/include/asm/assembler.h +index 25b2a4161c7a..66aea4aa455d 100644 +--- a/arch/arm64/include/asm/assembler.h ++++ b/arch/arm64/include/asm/assembler.h +@@ -260,7 +260,11 @@ lr .req x30 // link register + #else + adr_l \dst, \sym + #endif ++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN + mrs \tmp, tpidr_el1 ++alternative_else ++ mrs \tmp, tpidr_el2 ++alternative_endif + add \dst, \dst, \tmp + .endm + +@@ -271,7 +275,11 @@ lr .req x30 // link register + */ + .macro ldr_this_cpu dst, sym, tmp + adr_l \dst, \sym ++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN + mrs \tmp, tpidr_el1 ++alternative_else ++ mrs \tmp, tpidr_el2 ++alternative_endif + ldr \dst, [\dst, \tmp] + .endm + +diff --git a/arch/arm64/include/asm/cpucaps.h b/arch/arm64/include/asm/cpucaps.h +index 2e7b236bc596..76c0d23ca161 100644 +--- a/arch/arm64/include/asm/cpucaps.h ++++ b/arch/arm64/include/asm/cpucaps.h +@@ -43,7 +43,8 @@ + #define ARM64_UNMAP_KERNEL_AT_EL0 23 + #define ARM64_HARDEN_BRANCH_PREDICTOR 24 + #define ARM64_HARDEN_BP_POST_GUEST_EXIT 25 ++#define ARM64_SSBD 26 + +-#define ARM64_NCAPS 26 ++#define ARM64_NCAPS 27 + + #endif /* __ASM_CPUCAPS_H */ +diff --git a/arch/arm64/include/asm/cpufeature.h b/arch/arm64/include/asm/cpufeature.h +index 428ee1f2468c..c5bc80a03515 100644 +--- a/arch/arm64/include/asm/cpufeature.h ++++ b/arch/arm64/include/asm/cpufeature.h +@@ -262,6 +262,28 @@ static inline bool system_uses_ttbr0_pan(void) + !cpus_have_const_cap(ARM64_HAS_PAN); + } + ++#define ARM64_SSBD_UNKNOWN -1 ++#define ARM64_SSBD_FORCE_DISABLE 0 ++#define ARM64_SSBD_KERNEL 1 ++#define ARM64_SSBD_FORCE_ENABLE 2 ++#define ARM64_SSBD_MITIGATED 3 ++ ++static inline int arm64_get_ssbd_state(void) ++{ ++#ifdef CONFIG_ARM64_SSBD ++ extern int ssbd_state; ++ return ssbd_state; ++#else ++ return ARM64_SSBD_UNKNOWN; ++#endif ++} ++ ++#ifdef CONFIG_ARM64_SSBD ++void arm64_set_ssbd_mitigation(bool state); ++#else ++static inline void arm64_set_ssbd_mitigation(bool state) {} ++#endif ++ + #endif /* __ASSEMBLY__ */ + + #endif +diff --git a/arch/arm64/include/asm/kvm_asm.h b/arch/arm64/include/asm/kvm_asm.h +index a7ef5a051911..1a6d02350fc6 100644 +--- a/arch/arm64/include/asm/kvm_asm.h ++++ b/arch/arm64/include/asm/kvm_asm.h +@@ -33,6 +33,10 @@ + #define KVM_ARM64_DEBUG_DIRTY_SHIFT 0 + #define KVM_ARM64_DEBUG_DIRTY (1 << KVM_ARM64_DEBUG_DIRTY_SHIFT) + ++#define VCPU_WORKAROUND_2_FLAG_SHIFT 0 ++#define VCPU_WORKAROUND_2_FLAG (_AC(1, UL) << VCPU_WORKAROUND_2_FLAG_SHIFT) ++ ++/* Translate a kernel address of @sym into its equivalent linear mapping */ + #define kvm_ksym_ref(sym) \ + ({ \ + void *val = &sym; \ +@@ -68,6 +72,43 @@ extern u32 __init_stage2_translation(void); + + extern void __qcom_hyp_sanitize_btac_predictors(void); + ++/* Home-grown __this_cpu_{ptr,read} variants that always work at HYP */ ++#define __hyp_this_cpu_ptr(sym) \ ++ ({ \ ++ void *__ptr = hyp_symbol_addr(sym); \ ++ __ptr += read_sysreg(tpidr_el2); \ ++ (typeof(&sym))__ptr; \ ++ }) ++ ++#define __hyp_this_cpu_read(sym) \ ++ ({ \ ++ *__hyp_this_cpu_ptr(sym); \ ++ }) ++ ++#else /* __ASSEMBLY__ */ ++ ++.macro hyp_adr_this_cpu reg, sym, tmp ++ adr_l \reg, \sym ++ mrs \tmp, tpidr_el2 ++ add \reg, \reg, \tmp ++.endm ++ ++.macro hyp_ldr_this_cpu reg, sym, tmp ++ adr_l \reg, \sym ++ mrs \tmp, tpidr_el2 ++ ldr \reg, [\reg, \tmp] ++.endm ++ ++.macro get_host_ctxt reg, tmp ++ hyp_adr_this_cpu \reg, kvm_host_cpu_state, \tmp ++.endm ++ ++.macro get_vcpu_ptr vcpu, ctxt ++ get_host_ctxt \ctxt, \vcpu ++ ldr \vcpu, [\ctxt, #HOST_CONTEXT_VCPU] ++ kern_hyp_va \vcpu ++.endm ++ + #endif + + #endif /* __ARM_KVM_ASM_H__ */ +diff --git a/arch/arm64/include/asm/kvm_host.h b/arch/arm64/include/asm/kvm_host.h +index 8abec9f7f430..b01ad3489bd8 100644 +--- a/arch/arm64/include/asm/kvm_host.h ++++ b/arch/arm64/include/asm/kvm_host.h +@@ -194,6 +194,8 @@ struct kvm_cpu_context { + u64 sys_regs[NR_SYS_REGS]; + u32 copro[NR_COPRO_REGS]; + }; ++ ++ struct kvm_vcpu *__hyp_running_vcpu; + }; + + typedef struct kvm_cpu_context kvm_cpu_context_t; +@@ -208,6 +210,9 @@ struct kvm_vcpu_arch { + /* Exception Information */ + struct kvm_vcpu_fault_info fault; + ++ /* State of various workarounds, see kvm_asm.h for bit assignment */ ++ u64 workaround_flags; ++ + /* Guest debug state */ + u64 debug_flags; + +@@ -348,10 +353,15 @@ int kvm_perf_teardown(void); + + struct kvm_vcpu *kvm_mpidr_to_vcpu(struct kvm *kvm, unsigned long mpidr); + ++void __kvm_set_tpidr_el2(u64 tpidr_el2); ++DECLARE_PER_CPU(kvm_cpu_context_t, kvm_host_cpu_state); ++ + static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr, + unsigned long hyp_stack_ptr, + unsigned long vector_ptr) + { ++ u64 tpidr_el2; ++ + /* + * Call initialization code, and switch to the full blown HYP code. + * If the cpucaps haven't been finalized yet, something has gone very +@@ -360,6 +370,16 @@ static inline void __cpu_init_hyp_mode(phys_addr_t pgd_ptr, + */ + BUG_ON(!static_branch_likely(&arm64_const_caps_ready)); + __kvm_call_hyp((void *)pgd_ptr, hyp_stack_ptr, vector_ptr); ++ ++ /* ++ * Calculate the raw per-cpu offset without a translation from the ++ * kernel's mapping to the linear mapping, and store it in tpidr_el2 ++ * so that we can use adr_l to access per-cpu variables in EL2. ++ */ ++ tpidr_el2 = (u64)this_cpu_ptr(&kvm_host_cpu_state) ++ - (u64)kvm_ksym_ref(kvm_host_cpu_state); ++ ++ kvm_call_hyp(__kvm_set_tpidr_el2, tpidr_el2); + } + + static inline void kvm_arch_hardware_unsetup(void) {} +@@ -392,4 +412,27 @@ static inline bool kvm_arm_harden_branch_predictor(void) + return cpus_have_const_cap(ARM64_HARDEN_BRANCH_PREDICTOR); + } + ++#define KVM_SSBD_UNKNOWN -1 ++#define KVM_SSBD_FORCE_DISABLE 0 ++#define KVM_SSBD_KERNEL 1 ++#define KVM_SSBD_FORCE_ENABLE 2 ++#define KVM_SSBD_MITIGATED 3 ++ ++static inline int kvm_arm_have_ssbd(void) ++{ ++ switch (arm64_get_ssbd_state()) { ++ case ARM64_SSBD_FORCE_DISABLE: ++ return KVM_SSBD_FORCE_DISABLE; ++ case ARM64_SSBD_KERNEL: ++ return KVM_SSBD_KERNEL; ++ case ARM64_SSBD_FORCE_ENABLE: ++ return KVM_SSBD_FORCE_ENABLE; ++ case ARM64_SSBD_MITIGATED: ++ return KVM_SSBD_MITIGATED; ++ case ARM64_SSBD_UNKNOWN: ++ default: ++ return KVM_SSBD_UNKNOWN; ++ } ++} ++ + #endif /* __ARM64_KVM_HOST_H__ */ +diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h +index fe55b516f018..e42c1f0ae6cf 100644 +--- a/arch/arm64/include/asm/kvm_mmu.h ++++ b/arch/arm64/include/asm/kvm_mmu.h +@@ -130,6 +130,26 @@ static inline unsigned long __kern_hyp_va(unsigned long v) + + #define kern_hyp_va(v) ((typeof(v))(__kern_hyp_va((unsigned long)(v)))) + ++/* ++ * Obtain the PC-relative address of a kernel symbol ++ * s: symbol ++ * ++ * The goal of this macro is to return a symbol's address based on a ++ * PC-relative computation, as opposed to a loading the VA from a ++ * constant pool or something similar. This works well for HYP, as an ++ * absolute VA is guaranteed to be wrong. Only use this if trying to ++ * obtain the address of a symbol (i.e. not something you obtained by ++ * following a pointer). ++ */ ++#define hyp_symbol_addr(s) \ ++ ({ \ ++ typeof(s) *addr; \ ++ asm("adrp %0, %1\n" \ ++ "add %0, %0, :lo12:%1\n" \ ++ : "=r" (addr) : "S" (&s)); \ ++ addr; \ ++ }) ++ + /* + * We currently only support a 40bit IPA. + */ +@@ -363,5 +383,29 @@ static inline int kvm_map_vectors(void) + } + #endif + ++#ifdef CONFIG_ARM64_SSBD ++DECLARE_PER_CPU_READ_MOSTLY(u64, arm64_ssbd_callback_required); ++ ++static inline int hyp_map_aux_data(void) ++{ ++ int cpu, err; ++ ++ for_each_possible_cpu(cpu) { ++ u64 *ptr; ++ ++ ptr = per_cpu_ptr(&arm64_ssbd_callback_required, cpu); ++ err = create_hyp_mappings(ptr, ptr + 1, PAGE_HYP); ++ if (err) ++ return err; ++ } ++ return 0; ++} ++#else ++static inline int hyp_map_aux_data(void) ++{ ++ return 0; ++} ++#endif ++ + #endif /* __ASSEMBLY__ */ + #endif /* __ARM64_KVM_MMU_H__ */ +diff --git a/arch/arm64/include/asm/percpu.h b/arch/arm64/include/asm/percpu.h +index 3bd498e4de4c..43393208229e 100644 +--- a/arch/arm64/include/asm/percpu.h ++++ b/arch/arm64/include/asm/percpu.h +@@ -16,11 +16,15 @@ + #ifndef __ASM_PERCPU_H + #define __ASM_PERCPU_H + ++#include + #include + + static inline void set_my_cpu_offset(unsigned long off) + { +- asm volatile("msr tpidr_el1, %0" :: "r" (off) : "memory"); ++ asm volatile(ALTERNATIVE("msr tpidr_el1, %0", ++ "msr tpidr_el2, %0", ++ ARM64_HAS_VIRT_HOST_EXTN) ++ :: "r" (off) : "memory"); + } + + static inline unsigned long __my_cpu_offset(void) +@@ -31,7 +35,10 @@ static inline unsigned long __my_cpu_offset(void) + * We want to allow caching the value, so avoid using volatile and + * instead use a fake stack read to hazard against barrier(). + */ +- asm("mrs %0, tpidr_el1" : "=r" (off) : ++ asm(ALTERNATIVE("mrs %0, tpidr_el1", ++ "mrs %0, tpidr_el2", ++ ARM64_HAS_VIRT_HOST_EXTN) ++ : "=r" (off) : + "Q" (*(const unsigned long *)current_stack_pointer)); + + return off; +diff --git a/arch/arm64/include/asm/thread_info.h b/arch/arm64/include/asm/thread_info.h +index ddded6497a8a..fc786d344e46 100644 +--- a/arch/arm64/include/asm/thread_info.h ++++ b/arch/arm64/include/asm/thread_info.h +@@ -92,6 +92,7 @@ void arch_setup_new_exec(void); + #define TIF_RESTORE_SIGMASK 20 + #define TIF_SINGLESTEP 21 + #define TIF_32BIT 22 /* 32bit process */ ++#define TIF_SSBD 23 /* Wants SSB mitigation */ + + #define _TIF_SIGPENDING (1 << TIF_SIGPENDING) + #define _TIF_NEED_RESCHED (1 << TIF_NEED_RESCHED) +diff --git a/arch/arm64/kernel/Makefile b/arch/arm64/kernel/Makefile +index def8d5623fd1..714fe90dbf66 100644 +--- a/arch/arm64/kernel/Makefile ++++ b/arch/arm64/kernel/Makefile +@@ -54,6 +54,7 @@ arm64-obj-$(CONFIG_KEXEC) += machine_kexec.o relocate_kernel.o \ + arm64-obj-$(CONFIG_ARM64_RELOC_TEST) += arm64-reloc-test.o + arm64-reloc-test-y := reloc_test_core.o reloc_test_syms.o + arm64-obj-$(CONFIG_CRASH_DUMP) += crash_dump.o ++arm64-obj-$(CONFIG_ARM64_SSBD) += ssbd.o + + ifeq ($(CONFIG_KVM),y) + arm64-obj-$(CONFIG_HARDEN_BRANCH_PREDICTOR) += bpi.o +diff --git a/arch/arm64/kernel/alternative.c b/arch/arm64/kernel/alternative.c +index 6dd0a3a3e5c9..5c4bce4ac381 100644 +--- a/arch/arm64/kernel/alternative.c ++++ b/arch/arm64/kernel/alternative.c +@@ -32,6 +32,8 @@ + #define ALT_ORIG_PTR(a) __ALT_PTR(a, orig_offset) + #define ALT_REPL_PTR(a) __ALT_PTR(a, alt_offset) + ++int alternatives_applied; ++ + struct alt_region { + struct alt_instr *begin; + struct alt_instr *end; +@@ -105,32 +107,53 @@ static u32 get_alt_insn(struct alt_instr *alt, __le32 *insnptr, __le32 *altinsnp + return insn; + } + ++static void patch_alternative(struct alt_instr *alt, ++ __le32 *origptr, __le32 *updptr, int nr_inst) ++{ ++ __le32 *replptr; ++ int i; ++ ++ replptr = ALT_REPL_PTR(alt); ++ for (i = 0; i < nr_inst; i++) { ++ u32 insn; ++ ++ insn = get_alt_insn(alt, origptr + i, replptr + i); ++ updptr[i] = cpu_to_le32(insn); ++ } ++} ++ + static void __apply_alternatives(void *alt_region, bool use_linear_alias) + { + struct alt_instr *alt; + struct alt_region *region = alt_region; +- __le32 *origptr, *replptr, *updptr; ++ __le32 *origptr, *updptr; ++ alternative_cb_t alt_cb; + + for (alt = region->begin; alt < region->end; alt++) { +- u32 insn; +- int i, nr_inst; ++ int nr_inst; + +- if (!cpus_have_cap(alt->cpufeature)) ++ /* Use ARM64_CB_PATCH as an unconditional patch */ ++ if (alt->cpufeature < ARM64_CB_PATCH && ++ !cpus_have_cap(alt->cpufeature)) + continue; + +- BUG_ON(alt->alt_len != alt->orig_len); ++ if (alt->cpufeature == ARM64_CB_PATCH) ++ BUG_ON(alt->alt_len != 0); ++ else ++ BUG_ON(alt->alt_len != alt->orig_len); + + pr_info_once("patching kernel code\n"); + + origptr = ALT_ORIG_PTR(alt); +- replptr = ALT_REPL_PTR(alt); + updptr = use_linear_alias ? lm_alias(origptr) : origptr; +- nr_inst = alt->alt_len / sizeof(insn); ++ nr_inst = alt->orig_len / AARCH64_INSN_SIZE; + +- for (i = 0; i < nr_inst; i++) { +- insn = get_alt_insn(alt, origptr + i, replptr + i); +- updptr[i] = cpu_to_le32(insn); +- } ++ if (alt->cpufeature < ARM64_CB_PATCH) ++ alt_cb = patch_alternative; ++ else ++ alt_cb = ALT_REPL_PTR(alt); ++ ++ alt_cb(alt, origptr, updptr, nr_inst); + + flush_icache_range((uintptr_t)origptr, + (uintptr_t)(origptr + nr_inst)); +@@ -143,7 +166,6 @@ static void __apply_alternatives(void *alt_region, bool use_linear_alias) + */ + static int __apply_alternatives_multi_stop(void *unused) + { +- static int patched = 0; + struct alt_region region = { + .begin = (struct alt_instr *)__alt_instructions, + .end = (struct alt_instr *)__alt_instructions_end, +@@ -151,14 +173,14 @@ static int __apply_alternatives_multi_stop(void *unused) + + /* We always have a CPU 0 at this point (__init) */ + if (smp_processor_id()) { +- while (!READ_ONCE(patched)) ++ while (!READ_ONCE(alternatives_applied)) + cpu_relax(); + isb(); + } else { +- BUG_ON(patched); ++ BUG_ON(alternatives_applied); + __apply_alternatives(®ion, true); + /* Barriers provided by the cache flushing */ +- WRITE_ONCE(patched, 1); ++ WRITE_ONCE(alternatives_applied, 1); + } + + return 0; +diff --git a/arch/arm64/kernel/asm-offsets.c b/arch/arm64/kernel/asm-offsets.c +index af247d10252f..b5e43b01b396 100644 +--- a/arch/arm64/kernel/asm-offsets.c ++++ b/arch/arm64/kernel/asm-offsets.c +@@ -131,11 +131,13 @@ int main(void) + BLANK(); + #ifdef CONFIG_KVM_ARM_HOST + DEFINE(VCPU_CONTEXT, offsetof(struct kvm_vcpu, arch.ctxt)); ++ DEFINE(VCPU_WORKAROUND_FLAGS, offsetof(struct kvm_vcpu, arch.workaround_flags)); + DEFINE(CPU_GP_REGS, offsetof(struct kvm_cpu_context, gp_regs)); + DEFINE(CPU_USER_PT_REGS, offsetof(struct kvm_regs, regs)); + DEFINE(CPU_FP_REGS, offsetof(struct kvm_regs, fp_regs)); + DEFINE(VCPU_FPEXC32_EL2, offsetof(struct kvm_vcpu, arch.ctxt.sys_regs[FPEXC32_EL2])); + DEFINE(VCPU_HOST_CONTEXT, offsetof(struct kvm_vcpu, arch.host_cpu_context)); ++ DEFINE(HOST_CONTEXT_VCPU, offsetof(struct kvm_cpu_context, __hyp_running_vcpu)); + #endif + #ifdef CONFIG_CPU_PM + DEFINE(CPU_SUSPEND_SZ, sizeof(struct cpu_suspend_ctx)); +diff --git a/arch/arm64/kernel/cpu_errata.c b/arch/arm64/kernel/cpu_errata.c +index b5a28336c077..eccdb28b4a39 100644 +--- a/arch/arm64/kernel/cpu_errata.c ++++ b/arch/arm64/kernel/cpu_errata.c +@@ -228,6 +228,178 @@ static int qcom_enable_link_stack_sanitization(void *data) + } + #endif /* CONFIG_HARDEN_BRANCH_PREDICTOR */ + ++#ifdef CONFIG_ARM64_SSBD ++DEFINE_PER_CPU_READ_MOSTLY(u64, arm64_ssbd_callback_required); ++ ++int ssbd_state __read_mostly = ARM64_SSBD_KERNEL; ++ ++static const struct ssbd_options { ++ const char *str; ++ int state; ++} ssbd_options[] = { ++ { "force-on", ARM64_SSBD_FORCE_ENABLE, }, ++ { "force-off", ARM64_SSBD_FORCE_DISABLE, }, ++ { "kernel", ARM64_SSBD_KERNEL, }, ++}; ++ ++static int __init ssbd_cfg(char *buf) ++{ ++ int i; ++ ++ if (!buf || !buf[0]) ++ return -EINVAL; ++ ++ for (i = 0; i < ARRAY_SIZE(ssbd_options); i++) { ++ int len = strlen(ssbd_options[i].str); ++ ++ if (strncmp(buf, ssbd_options[i].str, len)) ++ continue; ++ ++ ssbd_state = ssbd_options[i].state; ++ return 0; ++ } ++ ++ return -EINVAL; ++} ++early_param("ssbd", ssbd_cfg); ++ ++void __init arm64_update_smccc_conduit(struct alt_instr *alt, ++ __le32 *origptr, __le32 *updptr, ++ int nr_inst) ++{ ++ u32 insn; ++ ++ BUG_ON(nr_inst != 1); ++ ++ switch (psci_ops.conduit) { ++ case PSCI_CONDUIT_HVC: ++ insn = aarch64_insn_get_hvc_value(); ++ break; ++ case PSCI_CONDUIT_SMC: ++ insn = aarch64_insn_get_smc_value(); ++ break; ++ default: ++ return; ++ } ++ ++ *updptr = cpu_to_le32(insn); ++} ++ ++void __init arm64_enable_wa2_handling(struct alt_instr *alt, ++ __le32 *origptr, __le32 *updptr, ++ int nr_inst) ++{ ++ BUG_ON(nr_inst != 1); ++ /* ++ * Only allow mitigation on EL1 entry/exit and guest ++ * ARCH_WORKAROUND_2 handling if the SSBD state allows it to ++ * be flipped. ++ */ ++ if (arm64_get_ssbd_state() == ARM64_SSBD_KERNEL) ++ *updptr = cpu_to_le32(aarch64_insn_gen_nop()); ++} ++ ++void arm64_set_ssbd_mitigation(bool state) ++{ ++ switch (psci_ops.conduit) { ++ case PSCI_CONDUIT_HVC: ++ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_WORKAROUND_2, state, NULL); ++ break; ++ ++ case PSCI_CONDUIT_SMC: ++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_2, state, NULL); ++ break; ++ ++ default: ++ WARN_ON_ONCE(1); ++ break; ++ } ++} ++ ++static bool has_ssbd_mitigation(const struct arm64_cpu_capabilities *entry, ++ int scope) ++{ ++ struct arm_smccc_res res; ++ bool required = true; ++ s32 val; ++ ++ WARN_ON(scope != SCOPE_LOCAL_CPU || preemptible()); ++ ++ if (psci_ops.smccc_version == SMCCC_VERSION_1_0) { ++ ssbd_state = ARM64_SSBD_UNKNOWN; ++ return false; ++ } ++ ++ switch (psci_ops.conduit) { ++ case PSCI_CONDUIT_HVC: ++ arm_smccc_1_1_hvc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, ++ ARM_SMCCC_ARCH_WORKAROUND_2, &res); ++ break; ++ ++ case PSCI_CONDUIT_SMC: ++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_FEATURES_FUNC_ID, ++ ARM_SMCCC_ARCH_WORKAROUND_2, &res); ++ break; ++ ++ default: ++ ssbd_state = ARM64_SSBD_UNKNOWN; ++ return false; ++ } ++ ++ val = (s32)res.a0; ++ ++ switch (val) { ++ case SMCCC_RET_NOT_SUPPORTED: ++ ssbd_state = ARM64_SSBD_UNKNOWN; ++ return false; ++ ++ case SMCCC_RET_NOT_REQUIRED: ++ pr_info_once("%s mitigation not required\n", entry->desc); ++ ssbd_state = ARM64_SSBD_MITIGATED; ++ return false; ++ ++ case SMCCC_RET_SUCCESS: ++ required = true; ++ break; ++ ++ case 1: /* Mitigation not required on this CPU */ ++ required = false; ++ break; ++ ++ default: ++ WARN_ON(1); ++ return false; ++ } ++ ++ switch (ssbd_state) { ++ case ARM64_SSBD_FORCE_DISABLE: ++ pr_info_once("%s disabled from command-line\n", entry->desc); ++ arm64_set_ssbd_mitigation(false); ++ required = false; ++ break; ++ ++ case ARM64_SSBD_KERNEL: ++ if (required) { ++ __this_cpu_write(arm64_ssbd_callback_required, 1); ++ arm64_set_ssbd_mitigation(true); ++ } ++ break; ++ ++ case ARM64_SSBD_FORCE_ENABLE: ++ pr_info_once("%s forced from command-line\n", entry->desc); ++ arm64_set_ssbd_mitigation(true); ++ required = true; ++ break; ++ ++ default: ++ WARN_ON(1); ++ break; ++ } ++ ++ return required; ++} ++#endif /* CONFIG_ARM64_SSBD */ ++ + #define MIDR_RANGE(model, min, max) \ + .def_scope = SCOPE_LOCAL_CPU, \ + .matches = is_affected_midr_range, \ +@@ -425,6 +597,14 @@ const struct arm64_cpu_capabilities arm64_errata[] = { + MIDR_ALL_VERSIONS(MIDR_CAVIUM_THUNDERX2), + .enable = enable_smccc_arch_workaround_1, + }, ++#endif ++#ifdef CONFIG_ARM64_SSBD ++ { ++ .desc = "Speculative Store Bypass Disable", ++ .def_scope = SCOPE_LOCAL_CPU, ++ .capability = ARM64_SSBD, ++ .matches = has_ssbd_mitigation, ++ }, + #endif + { + } +diff --git a/arch/arm64/kernel/cpufeature.c b/arch/arm64/kernel/cpufeature.c +index 718822ab6e4b..376cf12edf0c 100644 +--- a/arch/arm64/kernel/cpufeature.c ++++ b/arch/arm64/kernel/cpufeature.c +@@ -880,6 +880,22 @@ static int __init parse_kpti(char *str) + early_param("kpti", parse_kpti); + #endif /* CONFIG_UNMAP_KERNEL_AT_EL0 */ + ++static int cpu_copy_el2regs(void *__unused) ++{ ++ /* ++ * Copy register values that aren't redirected by hardware. ++ * ++ * Before code patching, we only set tpidr_el1, all CPUs need to copy ++ * this value to tpidr_el2 before we patch the code. Once we've done ++ * that, freshly-onlined CPUs will set tpidr_el2, so we don't need to ++ * do anything here. ++ */ ++ if (!alternatives_applied) ++ write_sysreg(read_sysreg(tpidr_el1), tpidr_el2); ++ ++ return 0; ++} ++ + static const struct arm64_cpu_capabilities arm64_features[] = { + { + .desc = "GIC system register CPU interface", +@@ -949,6 +965,7 @@ static const struct arm64_cpu_capabilities arm64_features[] = { + .capability = ARM64_HAS_VIRT_HOST_EXTN, + .def_scope = SCOPE_SYSTEM, + .matches = runs_at_el2, ++ .enable = cpu_copy_el2regs, + }, + { + .desc = "32-bit EL0 Support", +diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S +index 93958d1341bb..c1ffa95c0ad2 100644 +--- a/arch/arm64/kernel/entry.S ++++ b/arch/arm64/kernel/entry.S +@@ -18,6 +18,7 @@ + * along with this program. If not, see . + */ + ++#include + #include + #include + +@@ -137,6 +138,25 @@ alternative_else_nop_endif + add \dst, \dst, #(\sym - .entry.tramp.text) + .endm + ++ // This macro corrupts x0-x3. It is the caller's duty ++ // to save/restore them if required. ++ .macro apply_ssbd, state, targ, tmp1, tmp2 ++#ifdef CONFIG_ARM64_SSBD ++alternative_cb arm64_enable_wa2_handling ++ b \targ ++alternative_cb_end ++ ldr_this_cpu \tmp2, arm64_ssbd_callback_required, \tmp1 ++ cbz \tmp2, \targ ++ ldr \tmp2, [tsk, #TSK_TI_FLAGS] ++ tbnz \tmp2, #TIF_SSBD, \targ ++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_2 ++ mov w1, #\state ++alternative_cb arm64_update_smccc_conduit ++ nop // Patched to SMC/HVC #0 ++alternative_cb_end ++#endif ++ .endm ++ + .macro kernel_entry, el, regsize = 64 + .if \regsize == 32 + mov w0, w0 // zero upper 32 bits of x0 +@@ -163,6 +183,14 @@ alternative_else_nop_endif + ldr x19, [tsk, #TSK_TI_FLAGS] // since we can unmask debug + disable_step_tsk x19, x20 // exceptions when scheduling. + ++ apply_ssbd 1, 1f, x22, x23 ++ ++#ifdef CONFIG_ARM64_SSBD ++ ldp x0, x1, [sp, #16 * 0] ++ ldp x2, x3, [sp, #16 * 1] ++#endif ++1: ++ + mov x29, xzr // fp pointed to user-space + .else + add x21, sp, #S_FRAME_SIZE +@@ -301,6 +329,8 @@ alternative_if ARM64_WORKAROUND_845719 + alternative_else_nop_endif + #endif + 3: ++ apply_ssbd 0, 5f, x0, x1 ++5: + .endif + + msr elr_el1, x21 // set up the return data +diff --git a/arch/arm64/kernel/hibernate.c b/arch/arm64/kernel/hibernate.c +index 095d3c170f5d..a028cc95afe1 100644 +--- a/arch/arm64/kernel/hibernate.c ++++ b/arch/arm64/kernel/hibernate.c +@@ -313,6 +313,17 @@ int swsusp_arch_suspend(void) + + sleep_cpu = -EINVAL; + __cpu_suspend_exit(); ++ ++ /* ++ * Just in case the boot kernel did turn the SSBD ++ * mitigation off behind our back, let's set the state ++ * to what we expect it to be. ++ */ ++ switch (arm64_get_ssbd_state()) { ++ case ARM64_SSBD_FORCE_ENABLE: ++ case ARM64_SSBD_KERNEL: ++ arm64_set_ssbd_mitigation(true); ++ } + } + + local_dbg_restore(flags); +diff --git a/arch/arm64/kernel/ssbd.c b/arch/arm64/kernel/ssbd.c +new file mode 100644 +index 000000000000..0560738c1d5c +--- /dev/null ++++ b/arch/arm64/kernel/ssbd.c +@@ -0,0 +1,108 @@ ++// SPDX-License-Identifier: GPL-2.0 ++/* ++ * Copyright (C) 2018 ARM Ltd, All Rights Reserved. ++ */ ++ ++#include ++#include ++#include ++#include ++ ++#include ++ ++/* ++ * prctl interface for SSBD ++ */ ++static int ssbd_prctl_set(struct task_struct *task, unsigned long ctrl) ++{ ++ int state = arm64_get_ssbd_state(); ++ ++ /* Unsupported */ ++ if (state == ARM64_SSBD_UNKNOWN) ++ return -EINVAL; ++ ++ /* Treat the unaffected/mitigated state separately */ ++ if (state == ARM64_SSBD_MITIGATED) { ++ switch (ctrl) { ++ case PR_SPEC_ENABLE: ++ return -EPERM; ++ case PR_SPEC_DISABLE: ++ case PR_SPEC_FORCE_DISABLE: ++ return 0; ++ } ++ } ++ ++ /* ++ * Things are a bit backward here: the arm64 internal API ++ * *enables the mitigation* when the userspace API *disables ++ * speculation*. So much fun. ++ */ ++ switch (ctrl) { ++ case PR_SPEC_ENABLE: ++ /* If speculation is force disabled, enable is not allowed */ ++ if (state == ARM64_SSBD_FORCE_ENABLE || ++ task_spec_ssb_force_disable(task)) ++ return -EPERM; ++ task_clear_spec_ssb_disable(task); ++ clear_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ case PR_SPEC_DISABLE: ++ if (state == ARM64_SSBD_FORCE_DISABLE) ++ return -EPERM; ++ task_set_spec_ssb_disable(task); ++ set_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ case PR_SPEC_FORCE_DISABLE: ++ if (state == ARM64_SSBD_FORCE_DISABLE) ++ return -EPERM; ++ task_set_spec_ssb_disable(task); ++ task_set_spec_ssb_force_disable(task); ++ set_tsk_thread_flag(task, TIF_SSBD); ++ break; ++ default: ++ return -ERANGE; ++ } ++ ++ return 0; ++} ++ ++int arch_prctl_spec_ctrl_set(struct task_struct *task, unsigned long which, ++ unsigned long ctrl) ++{ ++ switch (which) { ++ case PR_SPEC_STORE_BYPASS: ++ return ssbd_prctl_set(task, ctrl); ++ default: ++ return -ENODEV; ++ } ++} ++ ++static int ssbd_prctl_get(struct task_struct *task) ++{ ++ switch (arm64_get_ssbd_state()) { ++ case ARM64_SSBD_UNKNOWN: ++ return -EINVAL; ++ case ARM64_SSBD_FORCE_ENABLE: ++ return PR_SPEC_DISABLE; ++ case ARM64_SSBD_KERNEL: ++ if (task_spec_ssb_force_disable(task)) ++ return PR_SPEC_PRCTL | PR_SPEC_FORCE_DISABLE; ++ if (task_spec_ssb_disable(task)) ++ return PR_SPEC_PRCTL | PR_SPEC_DISABLE; ++ return PR_SPEC_PRCTL | PR_SPEC_ENABLE; ++ case ARM64_SSBD_FORCE_DISABLE: ++ return PR_SPEC_ENABLE; ++ default: ++ return PR_SPEC_NOT_AFFECTED; ++ } ++} ++ ++int arch_prctl_spec_ctrl_get(struct task_struct *task, unsigned long which) ++{ ++ switch (which) { ++ case PR_SPEC_STORE_BYPASS: ++ return ssbd_prctl_get(task); ++ default: ++ return -ENODEV; ++ } ++} +diff --git a/arch/arm64/kernel/suspend.c b/arch/arm64/kernel/suspend.c +index 77cd655e6eb7..7a655e60cf4b 100644 +--- a/arch/arm64/kernel/suspend.c ++++ b/arch/arm64/kernel/suspend.c +@@ -62,6 +62,14 @@ void notrace __cpu_suspend_exit(void) + */ + if (hw_breakpoint_restore) + hw_breakpoint_restore(cpu); ++ ++ /* ++ * On resume, firmware implementing dynamic mitigation will ++ * have turned the mitigation on. If the user has forcefully ++ * disabled it, make sure their wishes are obeyed. ++ */ ++ if (arm64_get_ssbd_state() == ARM64_SSBD_FORCE_DISABLE) ++ arm64_set_ssbd_mitigation(false); + } + + /* +diff --git a/arch/arm64/kvm/hyp-init.S b/arch/arm64/kvm/hyp-init.S +index 870828c364c5..dea20651a5f1 100644 +--- a/arch/arm64/kvm/hyp-init.S ++++ b/arch/arm64/kvm/hyp-init.S +@@ -122,6 +122,10 @@ CPU_BE( orr x4, x4, #SCTLR_ELx_EE) + kern_hyp_va x2 + msr vbar_el2, x2 + ++ /* copy tpidr_el1 into tpidr_el2 for use by HYP */ ++ mrs x1, tpidr_el1 ++ msr tpidr_el2, x1 ++ + /* Hello, World! */ + eret + ENDPROC(__kvm_hyp_init) +diff --git a/arch/arm64/kvm/hyp/entry.S b/arch/arm64/kvm/hyp/entry.S +index 9c45c6af1f58..a7b3c198d4de 100644 +--- a/arch/arm64/kvm/hyp/entry.S ++++ b/arch/arm64/kvm/hyp/entry.S +@@ -62,9 +62,6 @@ ENTRY(__guest_enter) + // Store the host regs + save_callee_saved_regs x1 + +- // Store the host_ctxt for use at exit time +- str x1, [sp, #-16]! +- + add x18, x0, #VCPU_CONTEXT + + // Restore guest regs x0-x17 +@@ -118,8 +115,7 @@ ENTRY(__guest_exit) + // Store the guest regs x19-x29, lr + save_callee_saved_regs x1 + +- // Restore the host_ctxt from the stack +- ldr x2, [sp], #16 ++ get_host_ctxt x2, x3 + + // Now restore the host regs + restore_callee_saved_regs x2 +@@ -159,6 +155,10 @@ abort_guest_exit_end: + ENDPROC(__guest_exit) + + ENTRY(__fpsimd_guest_restore) ++ // x0: esr ++ // x1: vcpu ++ // x2-x29,lr: vcpu regs ++ // vcpu x0-x1 on the stack + stp x2, x3, [sp, #-16]! + stp x4, lr, [sp, #-16]! + +@@ -173,7 +173,7 @@ alternative_else + alternative_endif + isb + +- mrs x3, tpidr_el2 ++ mov x3, x1 + + ldr x0, [x3, #VCPU_HOST_CONTEXT] + kern_hyp_va x0 +diff --git a/arch/arm64/kvm/hyp/hyp-entry.S b/arch/arm64/kvm/hyp/hyp-entry.S +index f49b53331d28..3c283fd8c8f5 100644 +--- a/arch/arm64/kvm/hyp/hyp-entry.S ++++ b/arch/arm64/kvm/hyp/hyp-entry.S +@@ -57,13 +57,8 @@ ENDPROC(__vhe_hyp_call) + el1_sync: // Guest trapped into EL2 + stp x0, x1, [sp, #-16]! + +-alternative_if_not ARM64_HAS_VIRT_HOST_EXTN +- mrs x1, esr_el2 +-alternative_else +- mrs x1, esr_el1 +-alternative_endif +- lsr x0, x1, #ESR_ELx_EC_SHIFT +- ++ mrs x0, esr_el2 ++ lsr x0, x0, #ESR_ELx_EC_SHIFT + cmp x0, #ESR_ELx_EC_HVC64 + ccmp x0, #ESR_ELx_EC_HVC32, #4, ne + b.ne el1_trap +@@ -111,14 +106,55 @@ el1_hvc_guest: + */ + ldr x1, [sp] // Guest's x0 + eor w1, w1, #ARM_SMCCC_ARCH_WORKAROUND_1 ++ cbz w1, wa_epilogue ++ ++ /* ARM_SMCCC_ARCH_WORKAROUND_2 handling */ ++ eor w1, w1, #(ARM_SMCCC_ARCH_WORKAROUND_1 ^ \ ++ ARM_SMCCC_ARCH_WORKAROUND_2) + cbnz w1, el1_trap +- mov x0, x1 ++ ++#ifdef CONFIG_ARM64_SSBD ++alternative_cb arm64_enable_wa2_handling ++ b wa2_end ++alternative_cb_end ++ get_vcpu_ptr x2, x0 ++ ldr x0, [x2, #VCPU_WORKAROUND_FLAGS] ++ ++ // Sanitize the argument and update the guest flags ++ ldr x1, [sp, #8] // Guest's x1 ++ clz w1, w1 // Murphy's device: ++ lsr w1, w1, #5 // w1 = !!w1 without using ++ eor w1, w1, #1 // the flags... ++ bfi x0, x1, #VCPU_WORKAROUND_2_FLAG_SHIFT, #1 ++ str x0, [x2, #VCPU_WORKAROUND_FLAGS] ++ ++ /* Check that we actually need to perform the call */ ++ hyp_ldr_this_cpu x0, arm64_ssbd_callback_required, x2 ++ cbz x0, wa2_end ++ ++ mov w0, #ARM_SMCCC_ARCH_WORKAROUND_2 ++ smc #0 ++ ++ /* Don't leak data from the SMC call */ ++ mov x3, xzr ++wa2_end: ++ mov x2, xzr ++ mov x1, xzr ++#endif ++ ++wa_epilogue: ++ mov x0, xzr + add sp, sp, #16 + eret + + el1_trap: ++ get_vcpu_ptr x1, x0 ++ ++ mrs x0, esr_el2 ++ lsr x0, x0, #ESR_ELx_EC_SHIFT + /* + * x0: ESR_EC ++ * x1: vcpu pointer + */ + + /* +@@ -132,19 +168,18 @@ alternative_if_not ARM64_HAS_NO_FPSIMD + b.eq __fpsimd_guest_restore + alternative_else_nop_endif + +- mrs x1, tpidr_el2 + mov x0, #ARM_EXCEPTION_TRAP + b __guest_exit + + el1_irq: + stp x0, x1, [sp, #-16]! +- mrs x1, tpidr_el2 ++ get_vcpu_ptr x1, x0 + mov x0, #ARM_EXCEPTION_IRQ + b __guest_exit + + el1_error: + stp x0, x1, [sp, #-16]! +- mrs x1, tpidr_el2 ++ get_vcpu_ptr x1, x0 + mov x0, #ARM_EXCEPTION_EL1_SERROR + b __guest_exit + +@@ -179,6 +214,11 @@ ENTRY(__hyp_do_panic) + eret + ENDPROC(__hyp_do_panic) + ++ENTRY(__hyp_panic) ++ get_host_ctxt x0, x1 ++ b hyp_panic ++ENDPROC(__hyp_panic) ++ + .macro invalid_vector label, target = __hyp_panic + .align 2 + \label: +diff --git a/arch/arm64/kvm/hyp/switch.c b/arch/arm64/kvm/hyp/switch.c +index e08ae6b6b63e..b2f1992c6234 100644 +--- a/arch/arm64/kvm/hyp/switch.c ++++ b/arch/arm64/kvm/hyp/switch.c +@@ -15,6 +15,7 @@ + * along with this program. If not, see . + */ + ++#include + #include + #include + #include +@@ -281,6 +282,39 @@ static void __hyp_text __skip_instr(struct kvm_vcpu *vcpu) + write_sysreg_el2(*vcpu_pc(vcpu), elr); + } + ++static inline bool __hyp_text __needs_ssbd_off(struct kvm_vcpu *vcpu) ++{ ++ if (!cpus_have_const_cap(ARM64_SSBD)) ++ return false; ++ ++ return !(vcpu->arch.workaround_flags & VCPU_WORKAROUND_2_FLAG); ++} ++ ++static void __hyp_text __set_guest_arch_workaround_state(struct kvm_vcpu *vcpu) ++{ ++#ifdef CONFIG_ARM64_SSBD ++ /* ++ * The host runs with the workaround always present. If the ++ * guest wants it disabled, so be it... ++ */ ++ if (__needs_ssbd_off(vcpu) && ++ __hyp_this_cpu_read(arm64_ssbd_callback_required)) ++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_2, 0, NULL); ++#endif ++} ++ ++static void __hyp_text __set_host_arch_workaround_state(struct kvm_vcpu *vcpu) ++{ ++#ifdef CONFIG_ARM64_SSBD ++ /* ++ * If the guest has disabled the workaround, bring it back on. ++ */ ++ if (__needs_ssbd_off(vcpu) && ++ __hyp_this_cpu_read(arm64_ssbd_callback_required)) ++ arm_smccc_1_1_smc(ARM_SMCCC_ARCH_WORKAROUND_2, 1, NULL); ++#endif ++} ++ + int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu) + { + struct kvm_cpu_context *host_ctxt; +@@ -289,9 +323,9 @@ int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu) + u64 exit_code; + + vcpu = kern_hyp_va(vcpu); +- write_sysreg(vcpu, tpidr_el2); + + host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context); ++ host_ctxt->__hyp_running_vcpu = vcpu; + guest_ctxt = &vcpu->arch.ctxt; + + __sysreg_save_host_state(host_ctxt); +@@ -311,6 +345,8 @@ int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu) + __sysreg_restore_guest_state(guest_ctxt); + __debug_restore_state(vcpu, kern_hyp_va(vcpu->arch.debug_ptr), guest_ctxt); + ++ __set_guest_arch_workaround_state(vcpu); ++ + /* Jump in the fire! */ + again: + exit_code = __guest_enter(vcpu, host_ctxt); +@@ -367,6 +403,8 @@ int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu) + /* 0 falls through to be handled out of EL2 */ + } + ++ __set_host_arch_workaround_state(vcpu); ++ + if (cpus_have_const_cap(ARM64_HARDEN_BP_POST_GUEST_EXIT)) { + u32 midr = read_cpuid_id(); + +@@ -406,7 +444,8 @@ int __hyp_text __kvm_vcpu_run(struct kvm_vcpu *vcpu) + + static const char __hyp_panic_string[] = "HYP panic:\nPS:%08llx PC:%016llx ESR:%08llx\nFAR:%016llx HPFAR:%016llx PAR:%016llx\nVCPU:%p\n"; + +-static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par) ++static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par, ++ struct kvm_vcpu *vcpu) + { + unsigned long str_va; + +@@ -420,35 +459,32 @@ static void __hyp_text __hyp_call_panic_nvhe(u64 spsr, u64 elr, u64 par) + __hyp_do_panic(str_va, + spsr, elr, + read_sysreg(esr_el2), read_sysreg_el2(far), +- read_sysreg(hpfar_el2), par, +- (void *)read_sysreg(tpidr_el2)); ++ read_sysreg(hpfar_el2), par, vcpu); + } + +-static void __hyp_text __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par) ++static void __hyp_text __hyp_call_panic_vhe(u64 spsr, u64 elr, u64 par, ++ struct kvm_vcpu *vcpu) + { + panic(__hyp_panic_string, + spsr, elr, + read_sysreg_el2(esr), read_sysreg_el2(far), +- read_sysreg(hpfar_el2), par, +- (void *)read_sysreg(tpidr_el2)); ++ read_sysreg(hpfar_el2), par, vcpu); + } + + static hyp_alternate_select(__hyp_call_panic, + __hyp_call_panic_nvhe, __hyp_call_panic_vhe, + ARM64_HAS_VIRT_HOST_EXTN); + +-void __hyp_text __noreturn __hyp_panic(void) ++void __hyp_text __noreturn hyp_panic(struct kvm_cpu_context *host_ctxt) + { ++ struct kvm_vcpu *vcpu = NULL; ++ + u64 spsr = read_sysreg_el2(spsr); + u64 elr = read_sysreg_el2(elr); + u64 par = read_sysreg(par_el1); + + if (read_sysreg(vttbr_el2)) { +- struct kvm_vcpu *vcpu; +- struct kvm_cpu_context *host_ctxt; +- +- vcpu = (struct kvm_vcpu *)read_sysreg(tpidr_el2); +- host_ctxt = kern_hyp_va(vcpu->arch.host_cpu_context); ++ vcpu = host_ctxt->__hyp_running_vcpu; + __timer_save_state(vcpu); + __deactivate_traps(vcpu); + __deactivate_vm(vcpu); +@@ -456,7 +492,7 @@ void __hyp_text __noreturn __hyp_panic(void) + } + + /* Call panic for real */ +- __hyp_call_panic()(spsr, elr, par); ++ __hyp_call_panic()(spsr, elr, par, vcpu); + + unreachable(); + } +diff --git a/arch/arm64/kvm/hyp/sysreg-sr.c b/arch/arm64/kvm/hyp/sysreg-sr.c +index 934137647837..e19d89cabf2a 100644 +--- a/arch/arm64/kvm/hyp/sysreg-sr.c ++++ b/arch/arm64/kvm/hyp/sysreg-sr.c +@@ -27,8 +27,8 @@ static void __hyp_text __sysreg_do_nothing(struct kvm_cpu_context *ctxt) { } + /* + * Non-VHE: Both host and guest must save everything. + * +- * VHE: Host must save tpidr*_el[01], actlr_el1, mdscr_el1, sp0, pc, +- * pstate, and guest must save everything. ++ * VHE: Host must save tpidr*_el0, actlr_el1, mdscr_el1, sp_el0, ++ * and guest must save everything. + */ + + static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt) +@@ -36,11 +36,8 @@ static void __hyp_text __sysreg_save_common_state(struct kvm_cpu_context *ctxt) + ctxt->sys_regs[ACTLR_EL1] = read_sysreg(actlr_el1); + ctxt->sys_regs[TPIDR_EL0] = read_sysreg(tpidr_el0); + ctxt->sys_regs[TPIDRRO_EL0] = read_sysreg(tpidrro_el0); +- ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1); + ctxt->sys_regs[MDSCR_EL1] = read_sysreg(mdscr_el1); + ctxt->gp_regs.regs.sp = read_sysreg(sp_el0); +- ctxt->gp_regs.regs.pc = read_sysreg_el2(elr); +- ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr); + } + + static void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt) +@@ -62,10 +59,13 @@ static void __hyp_text __sysreg_save_state(struct kvm_cpu_context *ctxt) + ctxt->sys_regs[AMAIR_EL1] = read_sysreg_el1(amair); + ctxt->sys_regs[CNTKCTL_EL1] = read_sysreg_el1(cntkctl); + ctxt->sys_regs[PAR_EL1] = read_sysreg(par_el1); ++ ctxt->sys_regs[TPIDR_EL1] = read_sysreg(tpidr_el1); + + ctxt->gp_regs.sp_el1 = read_sysreg(sp_el1); + ctxt->gp_regs.elr_el1 = read_sysreg_el1(elr); + ctxt->gp_regs.spsr[KVM_SPSR_EL1]= read_sysreg_el1(spsr); ++ ctxt->gp_regs.regs.pc = read_sysreg_el2(elr); ++ ctxt->gp_regs.regs.pstate = read_sysreg_el2(spsr); + } + + static hyp_alternate_select(__sysreg_call_save_host_state, +@@ -89,11 +89,8 @@ static void __hyp_text __sysreg_restore_common_state(struct kvm_cpu_context *ctx + write_sysreg(ctxt->sys_regs[ACTLR_EL1], actlr_el1); + write_sysreg(ctxt->sys_regs[TPIDR_EL0], tpidr_el0); + write_sysreg(ctxt->sys_regs[TPIDRRO_EL0], tpidrro_el0); +- write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1); + write_sysreg(ctxt->sys_regs[MDSCR_EL1], mdscr_el1); + write_sysreg(ctxt->gp_regs.regs.sp, sp_el0); +- write_sysreg_el2(ctxt->gp_regs.regs.pc, elr); +- write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr); + } + + static void __hyp_text __sysreg_restore_state(struct kvm_cpu_context *ctxt) +@@ -115,10 +112,13 @@ static void __hyp_text __sysreg_restore_state(struct kvm_cpu_context *ctxt) + write_sysreg_el1(ctxt->sys_regs[AMAIR_EL1], amair); + write_sysreg_el1(ctxt->sys_regs[CNTKCTL_EL1], cntkctl); + write_sysreg(ctxt->sys_regs[PAR_EL1], par_el1); ++ write_sysreg(ctxt->sys_regs[TPIDR_EL1], tpidr_el1); + + write_sysreg(ctxt->gp_regs.sp_el1, sp_el1); + write_sysreg_el1(ctxt->gp_regs.elr_el1, elr); + write_sysreg_el1(ctxt->gp_regs.spsr[KVM_SPSR_EL1],spsr); ++ write_sysreg_el2(ctxt->gp_regs.regs.pc, elr); ++ write_sysreg_el2(ctxt->gp_regs.regs.pstate, spsr); + } + + static hyp_alternate_select(__sysreg_call_restore_host_state, +@@ -183,3 +183,8 @@ void __hyp_text __sysreg32_restore_state(struct kvm_vcpu *vcpu) + if (vcpu->arch.debug_flags & KVM_ARM64_DEBUG_DIRTY) + write_sysreg(sysreg[DBGVCR32_EL2], dbgvcr32_el2); + } ++ ++void __hyp_text __kvm_set_tpidr_el2(u64 tpidr_el2) ++{ ++ asm("msr tpidr_el2, %0": : "r" (tpidr_el2)); ++} +diff --git a/arch/arm64/kvm/reset.c b/arch/arm64/kvm/reset.c +index 3256b9228e75..a74311beda35 100644 +--- a/arch/arm64/kvm/reset.c ++++ b/arch/arm64/kvm/reset.c +@@ -122,6 +122,10 @@ int kvm_reset_vcpu(struct kvm_vcpu *vcpu) + /* Reset PMU */ + kvm_pmu_vcpu_reset(vcpu); + ++ /* Default workaround setup is enabled (if supported) */ ++ if (kvm_arm_have_ssbd() == KVM_SSBD_KERNEL) ++ vcpu->arch.workaround_flags |= VCPU_WORKAROUND_2_FLAG; ++ + /* Reset timer */ + return kvm_timer_vcpu_reset(vcpu); + } +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index bf0821b7b1ab..10c835f13f62 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -70,7 +70,11 @@ ENTRY(cpu_do_suspend) + mrs x8, mdscr_el1 + mrs x9, oslsr_el1 + mrs x10, sctlr_el1 ++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN + mrs x11, tpidr_el1 ++alternative_else ++ mrs x11, tpidr_el2 ++alternative_endif + mrs x12, sp_el0 + stp x2, x3, [x0] + stp x4, xzr, [x0, #16] +@@ -116,7 +120,11 @@ ENTRY(cpu_do_resume) + msr mdscr_el1, x10 + + msr sctlr_el1, x12 ++alternative_if_not ARM64_HAS_VIRT_HOST_EXTN + msr tpidr_el1, x13 ++alternative_else ++ msr tpidr_el2, x13 ++alternative_endif + msr sp_el0, x14 + /* + * Restore oslsr_el1 by writing oslar_el1 +diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h +index 386a6900e206..3bf87f92b932 100644 +--- a/arch/x86/include/asm/asm.h ++++ b/arch/x86/include/asm/asm.h +@@ -46,6 +46,65 @@ + #define _ASM_SI __ASM_REG(si) + #define _ASM_DI __ASM_REG(di) + ++#ifndef __x86_64__ ++/* 32 bit */ ++ ++#define _ASM_ARG1 _ASM_AX ++#define _ASM_ARG2 _ASM_DX ++#define _ASM_ARG3 _ASM_CX ++ ++#define _ASM_ARG1L eax ++#define _ASM_ARG2L edx ++#define _ASM_ARG3L ecx ++ ++#define _ASM_ARG1W ax ++#define _ASM_ARG2W dx ++#define _ASM_ARG3W cx ++ ++#define _ASM_ARG1B al ++#define _ASM_ARG2B dl ++#define _ASM_ARG3B cl ++ ++#else ++/* 64 bit */ ++ ++#define _ASM_ARG1 _ASM_DI ++#define _ASM_ARG2 _ASM_SI ++#define _ASM_ARG3 _ASM_DX ++#define _ASM_ARG4 _ASM_CX ++#define _ASM_ARG5 r8 ++#define _ASM_ARG6 r9 ++ ++#define _ASM_ARG1Q rdi ++#define _ASM_ARG2Q rsi ++#define _ASM_ARG3Q rdx ++#define _ASM_ARG4Q rcx ++#define _ASM_ARG5Q r8 ++#define _ASM_ARG6Q r9 ++ ++#define _ASM_ARG1L edi ++#define _ASM_ARG2L esi ++#define _ASM_ARG3L edx ++#define _ASM_ARG4L ecx ++#define _ASM_ARG5L r8d ++#define _ASM_ARG6L r9d ++ ++#define _ASM_ARG1W di ++#define _ASM_ARG2W si ++#define _ASM_ARG3W dx ++#define _ASM_ARG4W cx ++#define _ASM_ARG5W r8w ++#define _ASM_ARG6W r9w ++ ++#define _ASM_ARG1B dil ++#define _ASM_ARG2B sil ++#define _ASM_ARG3B dl ++#define _ASM_ARG4B cl ++#define _ASM_ARG5B r8b ++#define _ASM_ARG6B r9b ++ ++#endif ++ + /* + * Macros to generate condition code outputs from inline assembly, + * The output operand must be type "bool". +diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h +index 89f08955fff7..c4fc17220df9 100644 +--- a/arch/x86/include/asm/irqflags.h ++++ b/arch/x86/include/asm/irqflags.h +@@ -13,7 +13,7 @@ + * Interrupt control: + */ + +-static inline unsigned long native_save_fl(void) ++extern inline unsigned long native_save_fl(void) + { + unsigned long flags; + +diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile +index 295abaa58add..4137f7ba0f88 100644 +--- a/arch/x86/kernel/Makefile ++++ b/arch/x86/kernel/Makefile +@@ -58,6 +58,7 @@ obj-y += alternative.o i8253.o pci-nommu.o hw_breakpoint.o + obj-y += tsc.o tsc_msr.o io_delay.o rtc.o + obj-y += pci-iommu_table.o + obj-y += resource.o ++obj-y += irqflags.o + + obj-y += process.o + obj-y += fpu/ +diff --git a/arch/x86/kernel/irqflags.S b/arch/x86/kernel/irqflags.S +new file mode 100644 +index 000000000000..ddeeaac8adda +--- /dev/null ++++ b/arch/x86/kernel/irqflags.S +@@ -0,0 +1,26 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++ ++#include ++#include ++#include ++ ++/* ++ * unsigned long native_save_fl(void) ++ */ ++ENTRY(native_save_fl) ++ pushf ++ pop %_ASM_AX ++ ret ++ENDPROC(native_save_fl) ++EXPORT_SYMBOL(native_save_fl) ++ ++/* ++ * void native_restore_fl(unsigned long flags) ++ * %eax/%rdi: flags ++ */ ++ENTRY(native_restore_fl) ++ push %_ASM_ARG1 ++ popf ++ ret ++ENDPROC(native_restore_fl) ++EXPORT_SYMBOL(native_restore_fl) +diff --git a/block/blk-core.c b/block/blk-core.c +index 6f6e21821d2d..68bae6338ad4 100644 +--- a/block/blk-core.c ++++ b/block/blk-core.c +@@ -779,7 +779,6 @@ EXPORT_SYMBOL(blk_alloc_queue); + int blk_queue_enter(struct request_queue *q, bool nowait) + { + while (true) { +- int ret; + + if (percpu_ref_tryget_live(&q->q_usage_counter)) + return 0; +@@ -796,13 +795,11 @@ int blk_queue_enter(struct request_queue *q, bool nowait) + */ + smp_rmb(); + +- ret = wait_event_interruptible(q->mq_freeze_wq, +- !atomic_read(&q->mq_freeze_depth) || +- blk_queue_dying(q)); ++ wait_event(q->mq_freeze_wq, ++ !atomic_read(&q->mq_freeze_depth) || ++ blk_queue_dying(q)); + if (blk_queue_dying(q)) + return -ENODEV; +- if (ret) +- return ret; + } + } + +diff --git a/crypto/af_alg.c b/crypto/af_alg.c +index 815ee1075574..42dfdd1fd6d8 100644 +--- a/crypto/af_alg.c ++++ b/crypto/af_alg.c +@@ -1183,8 +1183,10 @@ int af_alg_get_rsgl(struct sock *sk, struct msghdr *msg, int flags, + + /* make one iovec available as scatterlist */ + err = af_alg_make_sg(&rsgl->sgl, &msg->msg_iter, seglen); +- if (err < 0) ++ if (err < 0) { ++ rsgl->sg_num_bytes = 0; + return err; ++ } + + /* chain the new scatterlist with previous one */ + if (areq->last_rsgl) +diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c +index a8d2eb0ceb8d..2c288d1f42bb 100644 +--- a/drivers/atm/zatm.c ++++ b/drivers/atm/zatm.c +@@ -1483,6 +1483,8 @@ static int zatm_ioctl(struct atm_dev *dev,unsigned int cmd,void __user *arg) + return -EFAULT; + if (pool < 0 || pool > ZATM_LAST_POOL) + return -EINVAL; ++ pool = array_index_nospec(pool, ++ ZATM_LAST_POOL + 1); + if (copy_from_user(&info, + &((struct zatm_pool_req __user *) arg)->info, + sizeof(info))) return -EFAULT; +diff --git a/drivers/cpufreq/cppc_cpufreq.c b/drivers/cpufreq/cppc_cpufreq.c +index 8b432d6e846d..c9ce716247c1 100644 +--- a/drivers/cpufreq/cppc_cpufreq.c ++++ b/drivers/cpufreq/cppc_cpufreq.c +@@ -126,6 +126,49 @@ static void cppc_cpufreq_stop_cpu(struct cpufreq_policy *policy) + cpu->perf_caps.lowest_perf, cpu_num, ret); + } + ++/* ++ * The PCC subspace describes the rate at which platform can accept commands ++ * on the shared PCC channel (including READs which do not count towards freq ++ * trasition requests), so ideally we need to use the PCC values as a fallback ++ * if we don't have a platform specific transition_delay_us ++ */ ++#ifdef CONFIG_ARM64 ++#include ++ ++static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu) ++{ ++ unsigned long implementor = read_cpuid_implementor(); ++ unsigned long part_num = read_cpuid_part_number(); ++ unsigned int delay_us = 0; ++ ++ switch (implementor) { ++ case ARM_CPU_IMP_QCOM: ++ switch (part_num) { ++ case QCOM_CPU_PART_FALKOR_V1: ++ case QCOM_CPU_PART_FALKOR: ++ delay_us = 10000; ++ break; ++ default: ++ delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC; ++ break; ++ } ++ break; ++ default: ++ delay_us = cppc_get_transition_latency(cpu) / NSEC_PER_USEC; ++ break; ++ } ++ ++ return delay_us; ++} ++ ++#else ++ ++static unsigned int cppc_cpufreq_get_transition_delay_us(int cpu) ++{ ++ return cppc_get_transition_latency(cpu) / NSEC_PER_USEC; ++} ++#endif ++ + static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy) + { + struct cppc_cpudata *cpu; +@@ -163,8 +206,7 @@ static int cppc_cpufreq_cpu_init(struct cpufreq_policy *policy) + policy->cpuinfo.max_freq = cppc_dmi_max_khz; + + policy->cpuinfo.transition_latency = cppc_get_transition_latency(cpu_num); +- policy->transition_delay_us = cppc_get_transition_latency(cpu_num) / +- NSEC_PER_USEC; ++ policy->transition_delay_us = cppc_cpufreq_get_transition_delay_us(cpu_num); + policy->shared_type = cpu->shared_type; + + if (policy->shared_type == CPUFREQ_SHARED_TYPE_ANY) { +diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c +index 65dc78b91dea..3f9eee7e555f 100644 +--- a/drivers/crypto/amcc/crypto4xx_core.c ++++ b/drivers/crypto/amcc/crypto4xx_core.c +@@ -207,7 +207,7 @@ static u32 crypto4xx_build_pdr(struct crypto4xx_device *dev) + dev->pdr_pa); + return -ENOMEM; + } +- memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD); ++ memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD); + dev->shadow_sa_pool = dma_alloc_coherent(dev->core_dev->device, + 256 * PPC4XX_NUM_PD, + &dev->shadow_sa_pool_pa, +@@ -240,13 +240,15 @@ static u32 crypto4xx_build_pdr(struct crypto4xx_device *dev) + + static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev) + { +- if (dev->pdr != NULL) ++ if (dev->pdr) + dma_free_coherent(dev->core_dev->device, + sizeof(struct ce_pd) * PPC4XX_NUM_PD, + dev->pdr, dev->pdr_pa); ++ + if (dev->shadow_sa_pool) + dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD, + dev->shadow_sa_pool, dev->shadow_sa_pool_pa); ++ + if (dev->shadow_sr_pool) + dma_free_coherent(dev->core_dev->device, + sizeof(struct sa_state_record) * PPC4XX_NUM_PD, +@@ -416,12 +418,12 @@ static u32 crypto4xx_build_sdr(struct crypto4xx_device *dev) + + static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev) + { +- if (dev->sdr != NULL) ++ if (dev->sdr) + dma_free_coherent(dev->core_dev->device, + sizeof(struct ce_sd) * PPC4XX_NUM_SD, + dev->sdr, dev->sdr_pa); + +- if (dev->scatter_buffer_va != NULL) ++ if (dev->scatter_buffer_va) + dma_free_coherent(dev->core_dev->device, + dev->scatter_buffer_size * PPC4XX_NUM_SD, + dev->scatter_buffer_va, +@@ -1033,12 +1035,10 @@ int crypto4xx_register_alg(struct crypto4xx_device *sec_dev, + break; + } + +- if (rc) { +- list_del(&alg->entry); ++ if (rc) + kfree(alg); +- } else { ++ else + list_add_tail(&alg->entry, &sec_dev->alg_list); +- } + } + + return 0; +@@ -1193,7 +1193,7 @@ static int crypto4xx_probe(struct platform_device *ofdev) + + rc = crypto4xx_build_gdr(core_dev->dev); + if (rc) +- goto err_build_gdr; ++ goto err_build_pdr; + + rc = crypto4xx_build_sdr(core_dev->dev); + if (rc) +@@ -1236,12 +1236,11 @@ static int crypto4xx_probe(struct platform_device *ofdev) + err_request_irq: + irq_dispose_mapping(core_dev->irq); + tasklet_kill(&core_dev->tasklet); +- crypto4xx_destroy_sdr(core_dev->dev); + err_build_sdr: ++ crypto4xx_destroy_sdr(core_dev->dev); + crypto4xx_destroy_gdr(core_dev->dev); +-err_build_gdr: +- crypto4xx_destroy_pdr(core_dev->dev); + err_build_pdr: ++ crypto4xx_destroy_pdr(core_dev->dev); + kfree(core_dev->dev); + err_alloc_dev: + kfree(core_dev); +diff --git a/drivers/media/rc/rc-main.c b/drivers/media/rc/rc-main.c +index 72f381522cb2..a22828713c1c 100644 +--- a/drivers/media/rc/rc-main.c ++++ b/drivers/media/rc/rc-main.c +@@ -1824,11 +1824,11 @@ void rc_unregister_device(struct rc_dev *dev) + if (!dev) + return; + +- del_timer_sync(&dev->timer_keyup); +- + if (dev->driver_type == RC_DRIVER_IR_RAW) + ir_raw_event_unregister(dev); + ++ del_timer_sync(&dev->timer_keyup); ++ + rc_free_rx_device(dev); + + device_del(&dev->dev); +diff --git a/drivers/mtd/nand/denali_dt.c b/drivers/mtd/nand/denali_dt.c +index 56e2e177644d..3f4f4aea0e8b 100644 +--- a/drivers/mtd/nand/denali_dt.c ++++ b/drivers/mtd/nand/denali_dt.c +@@ -122,7 +122,11 @@ static int denali_dt_probe(struct platform_device *pdev) + if (ret) + return ret; + +- denali->clk_x_rate = clk_get_rate(dt->clk); ++ /* ++ * Hardcode the clock rate for the backward compatibility. ++ * This works for both SOCFPGA and UniPhier. ++ */ ++ denali->clk_x_rate = 200000000; + + ret = denali_init(denali); + if (ret) +diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c +index 567ee54504bc..5e5022fa1d04 100644 +--- a/drivers/net/ethernet/atheros/alx/main.c ++++ b/drivers/net/ethernet/atheros/alx/main.c +@@ -1897,13 +1897,19 @@ static int alx_resume(struct device *dev) + struct pci_dev *pdev = to_pci_dev(dev); + struct alx_priv *alx = pci_get_drvdata(pdev); + struct alx_hw *hw = &alx->hw; ++ int err; + + alx_reset_phy(hw); + + if (!netif_running(alx->dev)) + return 0; + netif_device_attach(alx->dev); +- return __alx_open(alx, true); ++ ++ rtnl_lock(); ++ err = __alx_open(alx, true); ++ rtnl_unlock(); ++ ++ return err; + } + + static SIMPLE_DEV_PM_OPS(alx_pm_ops, alx_suspend, alx_resume); +diff --git a/drivers/net/ethernet/broadcom/bcm63xx_enet.c b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +index 4f3845a58126..68470c7c630a 100644 +--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c ++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c +@@ -1062,7 +1062,8 @@ static int bcm_enet_open(struct net_device *dev) + val = enet_readl(priv, ENET_CTL_REG); + val |= ENET_CTL_ENABLE_MASK; + enet_writel(priv, val, ENET_CTL_REG); +- enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG); ++ if (priv->dma_has_sram) ++ enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG); + enet_dmac_writel(priv, priv->dma_chan_en_mask, + ENETDMAC_CHANCFG, priv->rx_chan); + +@@ -1773,7 +1774,9 @@ static int bcm_enet_probe(struct platform_device *pdev) + ret = PTR_ERR(priv->mac_clk); + goto out; + } +- clk_prepare_enable(priv->mac_clk); ++ ret = clk_prepare_enable(priv->mac_clk); ++ if (ret) ++ goto out_put_clk_mac; + + /* initialize default and fetch platform data */ + priv->rx_ring_size = BCMENET_DEF_RX_DESC; +@@ -1805,9 +1808,11 @@ static int bcm_enet_probe(struct platform_device *pdev) + if (IS_ERR(priv->phy_clk)) { + ret = PTR_ERR(priv->phy_clk); + priv->phy_clk = NULL; +- goto out_put_clk_mac; ++ goto out_disable_clk_mac; + } +- clk_prepare_enable(priv->phy_clk); ++ ret = clk_prepare_enable(priv->phy_clk); ++ if (ret) ++ goto out_put_clk_phy; + } + + /* do minimal hardware init to be able to probe mii bus */ +@@ -1901,13 +1906,16 @@ static int bcm_enet_probe(struct platform_device *pdev) + out_uninit_hw: + /* turn off mdc clock */ + enet_writel(priv, 0, ENET_MIISC_REG); +- if (priv->phy_clk) { ++ if (priv->phy_clk) + clk_disable_unprepare(priv->phy_clk); ++ ++out_put_clk_phy: ++ if (priv->phy_clk) + clk_put(priv->phy_clk); +- } + +-out_put_clk_mac: ++out_disable_clk_mac: + clk_disable_unprepare(priv->mac_clk); ++out_put_clk_mac: + clk_put(priv->mac_clk); + out: + free_netdev(dev); +@@ -2752,7 +2760,9 @@ static int bcm_enetsw_probe(struct platform_device *pdev) + ret = PTR_ERR(priv->mac_clk); + goto out_unmap; + } +- clk_enable(priv->mac_clk); ++ ret = clk_prepare_enable(priv->mac_clk); ++ if (ret) ++ goto out_put_clk; + + priv->rx_chan = 0; + priv->tx_chan = 1; +@@ -2773,7 +2783,7 @@ static int bcm_enetsw_probe(struct platform_device *pdev) + + ret = register_netdev(dev); + if (ret) +- goto out_put_clk; ++ goto out_disable_clk; + + netif_carrier_off(dev); + platform_set_drvdata(pdev, dev); +@@ -2782,6 +2792,9 @@ static int bcm_enetsw_probe(struct platform_device *pdev) + + return 0; + ++out_disable_clk: ++ clk_disable_unprepare(priv->mac_clk); ++ + out_put_clk: + clk_put(priv->mac_clk); + +@@ -2813,6 +2826,9 @@ static int bcm_enetsw_remove(struct platform_device *pdev) + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + release_mem_region(res->start, resource_size(res)); + ++ clk_disable_unprepare(priv->mac_clk); ++ clk_put(priv->mac_clk); ++ + free_netdev(dev); + return 0; + } +diff --git a/drivers/net/ethernet/cadence/macb_ptp.c b/drivers/net/ethernet/cadence/macb_ptp.c +index 2220c771092b..678835136bf8 100755 +--- a/drivers/net/ethernet/cadence/macb_ptp.c ++++ b/drivers/net/ethernet/cadence/macb_ptp.c +@@ -170,10 +170,7 @@ static int gem_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) + + if (delta > TSU_NSEC_MAX_VAL) { + gem_tsu_get_time(&bp->ptp_clock_info, &now); +- if (sign) +- now = timespec64_sub(now, then); +- else +- now = timespec64_add(now, then); ++ now = timespec64_add(now, then); + + gem_tsu_set_time(&bp->ptp_clock_info, + (const struct timespec64 *)&now); +diff --git a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +index 6a015362c340..bf291e90cdb0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/cxgb3_main.c +@@ -51,6 +51,7 @@ + #include + #include + #include ++#include + + #include "common.h" + #include "cxgb3_ioctl.h" +@@ -2268,6 +2269,7 @@ static int cxgb_extension_ioctl(struct net_device *dev, void __user *useraddr) + + if (t.qset_idx >= nqsets) + return -EINVAL; ++ t.qset_idx = array_index_nospec(t.qset_idx, nqsets); + + q = &adapter->params.sge.qset[q1 + t.qset_idx]; + t.rspq_size = q->rspq_size; +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 20a8018d41ef..b68d94b49a8a 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -2211,9 +2211,10 @@ static struct sk_buff *ixgbe_build_skb(struct ixgbe_ring *rx_ring, + return skb; + } + +-#define IXGBE_XDP_PASS 0 +-#define IXGBE_XDP_CONSUMED 1 +-#define IXGBE_XDP_TX 2 ++#define IXGBE_XDP_PASS 0 ++#define IXGBE_XDP_CONSUMED BIT(0) ++#define IXGBE_XDP_TX BIT(1) ++#define IXGBE_XDP_REDIR BIT(2) + + static int ixgbe_xmit_xdp_ring(struct ixgbe_adapter *adapter, + struct xdp_buff *xdp); +@@ -2242,7 +2243,7 @@ static struct sk_buff *ixgbe_run_xdp(struct ixgbe_adapter *adapter, + case XDP_REDIRECT: + err = xdp_do_redirect(adapter->netdev, xdp, xdp_prog); + if (!err) +- result = IXGBE_XDP_TX; ++ result = IXGBE_XDP_REDIR; + else + result = IXGBE_XDP_CONSUMED; + break; +@@ -2302,7 +2303,7 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + unsigned int mss = 0; + #endif /* IXGBE_FCOE */ + u16 cleaned_count = ixgbe_desc_unused(rx_ring); +- bool xdp_xmit = false; ++ unsigned int xdp_xmit = 0; + + while (likely(total_rx_packets < budget)) { + union ixgbe_adv_rx_desc *rx_desc; +@@ -2342,8 +2343,10 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + } + + if (IS_ERR(skb)) { +- if (PTR_ERR(skb) == -IXGBE_XDP_TX) { +- xdp_xmit = true; ++ unsigned int xdp_res = -PTR_ERR(skb); ++ ++ if (xdp_res & (IXGBE_XDP_TX | IXGBE_XDP_REDIR)) { ++ xdp_xmit |= xdp_res; + ixgbe_rx_buffer_flip(rx_ring, rx_buffer, size); + } else { + rx_buffer->pagecnt_bias++; +@@ -2415,7 +2418,10 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + total_rx_packets++; + } + +- if (xdp_xmit) { ++ if (xdp_xmit & IXGBE_XDP_REDIR) ++ xdp_do_flush_map(); ++ ++ if (xdp_xmit & IXGBE_XDP_TX) { + struct ixgbe_ring *ring = adapter->xdp_ring[smp_processor_id()]; + + /* Force memory writes to complete before letting h/w +@@ -2423,8 +2429,6 @@ static int ixgbe_clean_rx_irq(struct ixgbe_q_vector *q_vector, + */ + wmb(); + writel(ring->next_to_use, ring->tail); +- +- xdp_do_flush_map(); + } + + u64_stats_update_begin(&rx_ring->syncp); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +index 3efe45bc2471..cf94fdf25155 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c +@@ -801,6 +801,7 @@ static void cmd_work_handler(struct work_struct *work) + unsigned long flags; + bool poll_cmd = ent->polling; + int alloc_ret; ++ int cmd_mode; + + sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem; + down(sem); +@@ -847,6 +848,7 @@ static void cmd_work_handler(struct work_struct *work) + set_signature(ent, !cmd->checksum_disabled); + dump_command(dev, ent, 1); + ent->ts1 = ktime_get_ns(); ++ cmd_mode = cmd->mode; + + if (ent->callback) + schedule_delayed_work(&ent->cb_timeout_work, cb_timeout); +@@ -871,7 +873,7 @@ static void cmd_work_handler(struct work_struct *work) + iowrite32be(1 << ent->idx, &dev->iseg->cmd_dbell); + mmiowb(); + /* if not in polling don't use ent after this point */ +- if (cmd->mode == CMD_MODE_POLLING || poll_cmd) { ++ if (cmd_mode == CMD_MODE_POLLING || poll_cmd) { + poll_timeout(ent); + /* make sure we read the descriptor after ownership is SW */ + rmb(); +@@ -1272,7 +1274,7 @@ static ssize_t outlen_write(struct file *filp, const char __user *buf, + { + struct mlx5_core_dev *dev = filp->private_data; + struct mlx5_cmd_debug *dbg = &dev->cmd.dbg; +- char outlen_str[8]; ++ char outlen_str[8] = {0}; + int outlen; + void *ptr; + int err; +@@ -1287,8 +1289,6 @@ static ssize_t outlen_write(struct file *filp, const char __user *buf, + if (copy_from_user(outlen_str, buf, count)) + return -EFAULT; + +- outlen_str[7] = 0; +- + err = sscanf(outlen_str, "%d", &outlen); + if (err < 0) + return err; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 337ce9423794..bf34264c734b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2626,7 +2626,7 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv) + mlx5e_activate_channels(&priv->channels); + netif_tx_start_all_queues(priv->netdev); + +- if (MLX5_VPORT_MANAGER(priv->mdev)) ++ if (MLX5_ESWITCH_MANAGER(priv->mdev)) + mlx5e_add_sqs_fwd_rules(priv); + + mlx5e_wait_channels_min_rx_wqes(&priv->channels); +@@ -2637,7 +2637,7 @@ void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv) + { + mlx5e_redirect_rqts_to_drop(priv); + +- if (MLX5_VPORT_MANAGER(priv->mdev)) ++ if (MLX5_ESWITCH_MANAGER(priv->mdev)) + mlx5e_remove_sqs_fwd_rules(priv); + + /* FIXME: This is a W/A only for tx timeout watch dog false alarm when +@@ -4127,7 +4127,7 @@ static void mlx5e_build_nic_netdev(struct net_device *netdev) + mlx5e_set_netdev_dev_addr(netdev); + + #if IS_ENABLED(CONFIG_MLX5_ESWITCH) +- if (MLX5_VPORT_MANAGER(mdev)) ++ if (MLX5_ESWITCH_MANAGER(mdev)) + netdev->switchdev_ops = &mlx5e_switchdev_ops; + #endif + +@@ -4273,7 +4273,7 @@ static void mlx5e_nic_enable(struct mlx5e_priv *priv) + + mlx5e_enable_async_events(priv); + +- if (MLX5_VPORT_MANAGER(priv->mdev)) ++ if (MLX5_ESWITCH_MANAGER(priv->mdev)) + mlx5e_register_vport_reps(priv); + + if (netdev->reg_state != NETREG_REGISTERED) +@@ -4300,7 +4300,7 @@ static void mlx5e_nic_disable(struct mlx5e_priv *priv) + + queue_work(priv->wq, &priv->set_rx_mode_work); + +- if (MLX5_VPORT_MANAGER(priv->mdev)) ++ if (MLX5_ESWITCH_MANAGER(priv->mdev)) + mlx5e_unregister_vport_reps(priv); + + mlx5e_disable_async_events(priv); +@@ -4483,7 +4483,7 @@ static void *mlx5e_add(struct mlx5_core_dev *mdev) + return NULL; + + #ifdef CONFIG_MLX5_ESWITCH +- if (MLX5_VPORT_MANAGER(mdev)) { ++ if (MLX5_ESWITCH_MANAGER(mdev)) { + rpriv = mlx5e_alloc_nic_rep_priv(mdev); + if (!rpriv) { + mlx5_core_warn(mdev, "Failed to alloc NIC rep priv data\n"); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index 4727e7390834..281911698f72 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -710,7 +710,7 @@ bool mlx5e_is_uplink_rep(struct mlx5e_priv *priv) + struct mlx5e_rep_priv *rpriv = priv->ppriv; + struct mlx5_eswitch_rep *rep; + +- if (!MLX5_CAP_GEN(priv->mdev, vport_group_manager)) ++ if (!MLX5_ESWITCH_MANAGER(priv->mdev)) + return false; + + rep = rpriv->rep; +@@ -724,8 +724,12 @@ bool mlx5e_is_uplink_rep(struct mlx5e_priv *priv) + static bool mlx5e_is_vf_vport_rep(struct mlx5e_priv *priv) + { + struct mlx5e_rep_priv *rpriv = priv->ppriv; +- struct mlx5_eswitch_rep *rep = rpriv->rep; ++ struct mlx5_eswitch_rep *rep; + ++ if (!MLX5_ESWITCH_MANAGER(priv->mdev)) ++ return false; ++ ++ rep = rpriv->rep; + if (rep && rep->vport != FDB_UPLINK_VPORT) + return true; + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 82e37250ed01..667415301066 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1535,7 +1535,7 @@ int mlx5_eswitch_enable_sriov(struct mlx5_eswitch *esw, int nvfs, int mode) + if (!ESW_ALLOWED(esw)) + return 0; + +- if (!MLX5_CAP_GEN(esw->dev, eswitch_flow_table) || ++ if (!MLX5_ESWITCH_MANAGER(esw->dev) || + !MLX5_CAP_ESW_FLOWTABLE_FDB(esw->dev, ft_support)) { + esw_warn(esw->dev, "E-Switch FDB is not supported, aborting ...\n"); + return -EOPNOTSUPP; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +index 565c8b7a399a..10bf770675f3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.h +@@ -39,6 +39,8 @@ + #include + #include "lib/mpfs.h" + ++#define MLX5_ESWITCH_MANAGER(mdev) MLX5_CAP_GEN(mdev, eswitch_manager) ++ + enum { + SRIOV_NONE, + SRIOV_LEGACY, +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +index d9fd8570b07c..c699055c0ffd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch_offloads.c +@@ -912,8 +912,8 @@ static int mlx5_devlink_eswitch_check(struct devlink *devlink) + if (MLX5_CAP_GEN(dev, port_type) != MLX5_CAP_PORT_TYPE_ETH) + return -EOPNOTSUPP; + +- if (!MLX5_CAP_GEN(dev, vport_group_manager)) +- return -EOPNOTSUPP; ++ if(!MLX5_ESWITCH_MANAGER(dev)) ++ return -EPERM; + + if (dev->priv.eswitch->mode == SRIOV_NONE) + return -EOPNOTSUPP; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 33e5ff081e36..dd05cf148845 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -36,6 +36,7 @@ + #include "mlx5_core.h" + #include "fs_core.h" + #include "fs_cmd.h" ++#include "eswitch.h" + #include "diag/fs_tracepoint.h" + + #define INIT_TREE_NODE_ARRAY_SIZE(...) (sizeof((struct init_tree_node[]){__VA_ARGS__}) /\ +@@ -2211,7 +2212,7 @@ int mlx5_init_fs(struct mlx5_core_dev *dev) + goto err; + } + +- if (MLX5_CAP_GEN(dev, eswitch_flow_table)) { ++ if (MLX5_ESWITCH_MANAGER(dev)) { + if (MLX5_CAP_ESW_FLOWTABLE_FDB(dev, ft_support)) { + err = init_fdb_root_ns(steering); + if (err) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fw.c b/drivers/net/ethernet/mellanox/mlx5/core/fw.c +index 2c71557d1cee..d69897a1e2ce 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fw.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fw.c +@@ -34,6 +34,7 @@ + #include + #include + #include "mlx5_core.h" ++#include "eswitch.h" + #include "../../mlxfw/mlxfw.h" + + static int mlx5_cmd_query_adapter(struct mlx5_core_dev *dev, u32 *out, +@@ -152,13 +153,13 @@ int mlx5_query_hca_caps(struct mlx5_core_dev *dev) + } + + if (MLX5_CAP_GEN(dev, vport_group_manager) && +- MLX5_CAP_GEN(dev, eswitch_flow_table)) { ++ MLX5_ESWITCH_MANAGER(dev)) { + err = mlx5_core_get_caps(dev, MLX5_CAP_ESWITCH_FLOW_TABLE); + if (err) + return err; + } + +- if (MLX5_CAP_GEN(dev, eswitch_flow_table)) { ++ if (MLX5_ESWITCH_MANAGER(dev)) { + err = mlx5_core_get_caps(dev, MLX5_CAP_ESWITCH); + if (err) + return err; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c +index 7cb67122e8b5..22811ecd8fcd 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/mpfs.c +@@ -34,6 +34,7 @@ + #include + #include + #include "mlx5_core.h" ++#include "eswitch.h" + #include "lib/mpfs.h" + + /* HW L2 Table (MPFS) management */ +@@ -98,7 +99,7 @@ int mlx5_mpfs_init(struct mlx5_core_dev *dev) + int l2table_size = 1 << MLX5_CAP_GEN(dev, log_max_l2_table); + struct mlx5_mpfs *mpfs; + +- if (!MLX5_VPORT_MANAGER(dev)) ++ if (!MLX5_ESWITCH_MANAGER(dev)) + return 0; + + mpfs = kzalloc(sizeof(*mpfs), GFP_KERNEL); +@@ -122,7 +123,7 @@ void mlx5_mpfs_cleanup(struct mlx5_core_dev *dev) + { + struct mlx5_mpfs *mpfs = dev->priv.mpfs; + +- if (!MLX5_VPORT_MANAGER(dev)) ++ if (!MLX5_ESWITCH_MANAGER(dev)) + return; + + WARN_ON(!hlist_empty(mpfs->hash)); +@@ -137,7 +138,7 @@ int mlx5_mpfs_add_mac(struct mlx5_core_dev *dev, u8 *mac) + u32 index; + int err; + +- if (!MLX5_VPORT_MANAGER(dev)) ++ if (!MLX5_ESWITCH_MANAGER(dev)) + return 0; + + mutex_lock(&mpfs->lock); +@@ -179,7 +180,7 @@ int mlx5_mpfs_del_mac(struct mlx5_core_dev *dev, u8 *mac) + int err = 0; + u32 index; + +- if (!MLX5_VPORT_MANAGER(dev)) ++ if (!MLX5_ESWITCH_MANAGER(dev)) + return 0; + + mutex_lock(&mpfs->lock); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/port.c b/drivers/net/ethernet/mellanox/mlx5/core/port.c +index e07061f565d6..ccb6287aeeb7 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/port.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/port.c +@@ -641,7 +641,7 @@ EXPORT_SYMBOL_GPL(mlx5_query_port_prio_tc); + static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in, + int inlen) + { +- u32 out[MLX5_ST_SZ_DW(qtct_reg)]; ++ u32 out[MLX5_ST_SZ_DW(qetc_reg)]; + + if (!MLX5_CAP_GEN(mdev, ets)) + return -EOPNOTSUPP; +@@ -653,7 +653,7 @@ static int mlx5_set_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *in, + static int mlx5_query_port_qetcr_reg(struct mlx5_core_dev *mdev, u32 *out, + int outlen) + { +- u32 in[MLX5_ST_SZ_DW(qtct_reg)]; ++ u32 in[MLX5_ST_SZ_DW(qetc_reg)]; + + if (!MLX5_CAP_GEN(mdev, ets)) + return -EOPNOTSUPP; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c +index 2a8b529ce6dd..a0674962f02c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/sriov.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/sriov.c +@@ -88,6 +88,9 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs) + return -EBUSY; + } + ++ if (!MLX5_ESWITCH_MANAGER(dev)) ++ goto enable_vfs_hca; ++ + err = mlx5_eswitch_enable_sriov(dev->priv.eswitch, num_vfs, SRIOV_LEGACY); + if (err) { + mlx5_core_warn(dev, +@@ -95,6 +98,7 @@ static int mlx5_device_enable_sriov(struct mlx5_core_dev *dev, int num_vfs) + return err; + } + ++enable_vfs_hca: + for (vf = 0; vf < num_vfs; vf++) { + err = mlx5_core_enable_hca(dev, vf + 1); + if (err) { +@@ -140,7 +144,8 @@ static void mlx5_device_disable_sriov(struct mlx5_core_dev *dev) + } + + out: +- mlx5_eswitch_disable_sriov(dev->priv.eswitch); ++ if (MLX5_ESWITCH_MANAGER(dev)) ++ mlx5_eswitch_disable_sriov(dev->priv.eswitch); + + if (mlx5_wait_for_vf_pages(dev)) + mlx5_core_warn(dev, "timeout reclaiming VFs pages\n"); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +index 8f6ccc0c39e5..b306961b02fd 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c +@@ -700,9 +700,9 @@ qed_dcbx_get_local_lldp_params(struct qed_hwfn *p_hwfn, + p_local = &p_hwfn->p_dcbx_info->lldp_local[LLDP_NEAREST_BRIDGE]; + + memcpy(params->lldp_local.local_chassis_id, p_local->local_chassis_id, +- ARRAY_SIZE(p_local->local_chassis_id)); ++ sizeof(p_local->local_chassis_id)); + memcpy(params->lldp_local.local_port_id, p_local->local_port_id, +- ARRAY_SIZE(p_local->local_port_id)); ++ sizeof(p_local->local_port_id)); + } + + static void +@@ -714,9 +714,9 @@ qed_dcbx_get_remote_lldp_params(struct qed_hwfn *p_hwfn, + p_remote = &p_hwfn->p_dcbx_info->lldp_remote[LLDP_NEAREST_BRIDGE]; + + memcpy(params->lldp_remote.peer_chassis_id, p_remote->peer_chassis_id, +- ARRAY_SIZE(p_remote->peer_chassis_id)); ++ sizeof(p_remote->peer_chassis_id)); + memcpy(params->lldp_remote.peer_port_id, p_remote->peer_port_id, +- ARRAY_SIZE(p_remote->peer_port_id)); ++ sizeof(p_remote->peer_port_id)); + } + + static int +diff --git a/drivers/net/ethernet/qlogic/qed/qed_dev.c b/drivers/net/ethernet/qlogic/qed/qed_dev.c +index 58a689fb04db..ef2374699726 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_dev.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_dev.c +@@ -1782,7 +1782,7 @@ int qed_hw_init(struct qed_dev *cdev, struct qed_hw_init_params *p_params) + DP_INFO(p_hwfn, "Failed to update driver state\n"); + + rc = qed_mcp_ov_update_eswitch(p_hwfn, p_hwfn->p_main_ptt, +- QED_OV_ESWITCH_VEB); ++ QED_OV_ESWITCH_NONE); + if (rc) + DP_INFO(p_hwfn, "Failed to update eswitch mode\n"); + } +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 27832885a87f..2c958921dfb3 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -779,6 +779,14 @@ static int qed_slowpath_setup_int(struct qed_dev *cdev, + /* We want a minimum of one slowpath and one fastpath vector per hwfn */ + cdev->int_params.in.min_msix_cnt = cdev->num_hwfns * 2; + ++ if (is_kdump_kernel()) { ++ DP_INFO(cdev, ++ "Kdump kernel: Limit the max number of requested MSI-X vectors to %hd\n", ++ cdev->int_params.in.min_msix_cnt); ++ cdev->int_params.in.num_vectors = ++ cdev->int_params.in.min_msix_cnt; ++ } ++ + rc = qed_set_int_mode(cdev, false); + if (rc) { + DP_ERR(cdev, "qed_slowpath_setup_int ERR\n"); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_sriov.c b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +index 3f40b1de7957..d08fe350ab6c 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_sriov.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_sriov.c +@@ -4396,6 +4396,8 @@ static void qed_sriov_enable_qid_config(struct qed_hwfn *hwfn, + static int qed_sriov_enable(struct qed_dev *cdev, int num) + { + struct qed_iov_vf_init_params params; ++ struct qed_hwfn *hwfn; ++ struct qed_ptt *ptt; + int i, j, rc; + + if (num >= RESC_NUM(&cdev->hwfns[0], QED_VPORT)) { +@@ -4408,8 +4410,8 @@ static int qed_sriov_enable(struct qed_dev *cdev, int num) + + /* Initialize HW for VF access */ + for_each_hwfn(cdev, j) { +- struct qed_hwfn *hwfn = &cdev->hwfns[j]; +- struct qed_ptt *ptt = qed_ptt_acquire(hwfn); ++ hwfn = &cdev->hwfns[j]; ++ ptt = qed_ptt_acquire(hwfn); + + /* Make sure not to use more than 16 queues per VF */ + params.num_queues = min_t(int, +@@ -4445,6 +4447,19 @@ static int qed_sriov_enable(struct qed_dev *cdev, int num) + goto err; + } + ++ hwfn = QED_LEADING_HWFN(cdev); ++ ptt = qed_ptt_acquire(hwfn); ++ if (!ptt) { ++ DP_ERR(hwfn, "Failed to acquire ptt\n"); ++ rc = -EBUSY; ++ goto err; ++ } ++ ++ rc = qed_mcp_ov_update_eswitch(hwfn, ptt, QED_OV_ESWITCH_VEB); ++ if (rc) ++ DP_INFO(cdev, "Failed to update eswitch mode\n"); ++ qed_ptt_release(hwfn, ptt); ++ + return num; + + err: +diff --git a/drivers/net/ethernet/qlogic/qede/qede_ptp.c b/drivers/net/ethernet/qlogic/qede/qede_ptp.c +index 9b2280badaf7..475f6ae5d4b3 100644 +--- a/drivers/net/ethernet/qlogic/qede/qede_ptp.c ++++ b/drivers/net/ethernet/qlogic/qede/qede_ptp.c +@@ -337,8 +337,14 @@ int qede_ptp_get_ts_info(struct qede_dev *edev, struct ethtool_ts_info *info) + { + struct qede_ptp *ptp = edev->ptp; + +- if (!ptp) +- return -EIO; ++ if (!ptp) { ++ info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | ++ SOF_TIMESTAMPING_RX_SOFTWARE | ++ SOF_TIMESTAMPING_SOFTWARE; ++ info->phc_index = -1; ++ ++ return 0; ++ } + + info->so_timestamping = SOF_TIMESTAMPING_TX_SOFTWARE | + SOF_TIMESTAMPING_RX_SOFTWARE | +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 9866d2e34cdd..27f2e650e27b 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -914,6 +914,7 @@ static void stmmac_check_pcs_mode(struct stmmac_priv *priv) + static int stmmac_init_phy(struct net_device *dev) + { + struct stmmac_priv *priv = netdev_priv(dev); ++ u32 tx_cnt = priv->plat->tx_queues_to_use; + struct phy_device *phydev; + char phy_id_fmt[MII_BUS_ID_SIZE + 3]; + char bus_id[MII_BUS_ID_SIZE]; +@@ -954,6 +955,15 @@ static int stmmac_init_phy(struct net_device *dev) + phydev->advertising &= ~(SUPPORTED_1000baseT_Half | + SUPPORTED_1000baseT_Full); + ++ /* ++ * Half-duplex mode not supported with multiqueue ++ * half-duplex can only works with single queue ++ */ ++ if (tx_cnt > 1) ++ phydev->supported &= ~(SUPPORTED_1000baseT_Half | ++ SUPPORTED_100baseT_Half | ++ SUPPORTED_10baseT_Half); ++ + /* + * Broken HW is sometimes missing the pull-up resistor on the + * MDIO line, which results in reads to non-existent devices returning +diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c +index fa607d062cb3..15cd086e3f47 100644 +--- a/drivers/net/ethernet/sun/sungem.c ++++ b/drivers/net/ethernet/sun/sungem.c +@@ -59,8 +59,7 @@ + #include + #include "sungem.h" + +-/* Stripping FCS is causing problems, disabled for now */ +-#undef STRIP_FCS ++#define STRIP_FCS + + #define DEFAULT_MSG (NETIF_MSG_DRV | \ + NETIF_MSG_PROBE | \ +@@ -434,7 +433,7 @@ static int gem_rxmac_reset(struct gem *gp) + writel(desc_dma & 0xffffffff, gp->regs + RXDMA_DBLOW); + writel(RX_RING_SIZE - 4, gp->regs + RXDMA_KICK); + val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) | +- ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128); ++ (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128); + writel(val, gp->regs + RXDMA_CFG); + if (readl(gp->regs + GREG_BIFCFG) & GREG_BIFCFG_M66EN) + writel(((5 & RXDMA_BLANK_IPKTS) | +@@ -759,7 +758,6 @@ static int gem_rx(struct gem *gp, int work_to_do) + struct net_device *dev = gp->dev; + int entry, drops, work_done = 0; + u32 done; +- __sum16 csum; + + if (netif_msg_rx_status(gp)) + printk(KERN_DEBUG "%s: rx interrupt, done: %d, rx_new: %d\n", +@@ -854,9 +852,13 @@ static int gem_rx(struct gem *gp, int work_to_do) + skb = copy_skb; + } + +- csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff); +- skb->csum = csum_unfold(csum); +- skb->ip_summed = CHECKSUM_COMPLETE; ++ if (likely(dev->features & NETIF_F_RXCSUM)) { ++ __sum16 csum; ++ ++ csum = (__force __sum16)htons((status & RXDCTRL_TCPCSUM) ^ 0xffff); ++ skb->csum = csum_unfold(csum); ++ skb->ip_summed = CHECKSUM_COMPLETE; ++ } + skb->protocol = eth_type_trans(skb, gp->dev); + + napi_gro_receive(&gp->napi, skb); +@@ -1760,7 +1762,7 @@ static void gem_init_dma(struct gem *gp) + writel(0, gp->regs + TXDMA_KICK); + + val = (RXDMA_CFG_BASE | (RX_OFFSET << 10) | +- ((14 / 2) << 13) | RXDMA_CFG_FTHRESH_128); ++ (ETH_HLEN << 13) | RXDMA_CFG_FTHRESH_128); + writel(val, gp->regs + RXDMA_CFG); + + writel(desc_dma >> 32, gp->regs + RXDMA_DBHI); +@@ -2986,8 +2988,8 @@ static int gem_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + pci_set_drvdata(pdev, dev); + + /* We can do scatter/gather and HW checksum */ +- dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM; +- dev->features |= dev->hw_features | NETIF_F_RXCSUM; ++ dev->hw_features = NETIF_F_SG | NETIF_F_HW_CSUM | NETIF_F_RXCSUM; ++ dev->features = dev->hw_features; + if (pci_using_dac) + dev->features |= NETIF_F_HIGHDMA; + +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index fbc825ac97ab..cb51448389a1 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -474,7 +474,7 @@ static struct sk_buff **geneve_gro_receive(struct sock *sk, + out_unlock: + rcu_read_unlock(); + out: +- NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_flush_final(skb, pp, flush); + + return pp; + } +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index 01017dd88802..cb250cacf721 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -207,7 +207,7 @@ int netvsc_recv_callback(struct net_device *net, + void netvsc_channel_cb(void *context); + int netvsc_poll(struct napi_struct *napi, int budget); + +-void rndis_set_subchannel(struct work_struct *w); ++int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev); + int rndis_filter_open(struct netvsc_device *nvdev); + int rndis_filter_close(struct netvsc_device *nvdev); + struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 4647ecbe6f36..701be5d81062 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -62,6 +62,41 @@ void netvsc_switch_datapath(struct net_device *ndev, bool vf) + VM_PKT_DATA_INBAND, 0); + } + ++/* Worker to setup sub channels on initial setup ++ * Initial hotplug event occurs in softirq context ++ * and can't wait for channels. ++ */ ++static void netvsc_subchan_work(struct work_struct *w) ++{ ++ struct netvsc_device *nvdev = ++ container_of(w, struct netvsc_device, subchan_work); ++ struct rndis_device *rdev; ++ int i, ret; ++ ++ /* Avoid deadlock with device removal already under RTNL */ ++ if (!rtnl_trylock()) { ++ schedule_work(w); ++ return; ++ } ++ ++ rdev = nvdev->extension; ++ if (rdev) { ++ ret = rndis_set_subchannel(rdev->ndev, nvdev); ++ if (ret == 0) { ++ netif_device_attach(rdev->ndev); ++ } else { ++ /* fallback to only primary channel */ ++ for (i = 1; i < nvdev->num_chn; i++) ++ netif_napi_del(&nvdev->chan_table[i].napi); ++ ++ nvdev->max_chn = 1; ++ nvdev->num_chn = 1; ++ } ++ } ++ ++ rtnl_unlock(); ++} ++ + static struct netvsc_device *alloc_net_device(void) + { + struct netvsc_device *net_device; +@@ -78,7 +113,7 @@ static struct netvsc_device *alloc_net_device(void) + + init_completion(&net_device->channel_init_wait); + init_waitqueue_head(&net_device->subchan_open); +- INIT_WORK(&net_device->subchan_work, rndis_set_subchannel); ++ INIT_WORK(&net_device->subchan_work, netvsc_subchan_work); + + return net_device; + } +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index 6890478a0851..aeabeb107fed 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -911,8 +911,20 @@ static int netvsc_attach(struct net_device *ndev, + if (IS_ERR(nvdev)) + return PTR_ERR(nvdev); + +- /* Note: enable and attach happen when sub-channels setup */ ++ if (nvdev->num_chn > 1) { ++ ret = rndis_set_subchannel(ndev, nvdev); ++ ++ /* if unavailable, just proceed with one queue */ ++ if (ret) { ++ nvdev->max_chn = 1; ++ nvdev->num_chn = 1; ++ } ++ } ++ ++ /* In any case device is now ready */ ++ netif_device_attach(ndev); + ++ /* Note: enable and attach happen when sub-channels setup */ + netif_carrier_off(ndev); + + if (netif_running(ndev)) { +@@ -2035,6 +2047,9 @@ static int netvsc_probe(struct hv_device *dev, + + memcpy(net->dev_addr, device_info.mac_adr, ETH_ALEN); + ++ if (nvdev->num_chn > 1) ++ schedule_work(&nvdev->subchan_work); ++ + /* hw_features computed in rndis_netdev_set_hwcaps() */ + net->features = net->hw_features | + NETIF_F_HIGHDMA | NETIF_F_SG | +diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c +index d1ae184008b4..cb03a6ea076a 100644 +--- a/drivers/net/hyperv/rndis_filter.c ++++ b/drivers/net/hyperv/rndis_filter.c +@@ -1055,29 +1055,15 @@ static void netvsc_sc_open(struct vmbus_channel *new_sc) + * This breaks overlap of processing the host message for the + * new primary channel with the initialization of sub-channels. + */ +-void rndis_set_subchannel(struct work_struct *w) ++int rndis_set_subchannel(struct net_device *ndev, struct netvsc_device *nvdev) + { +- struct netvsc_device *nvdev +- = container_of(w, struct netvsc_device, subchan_work); + struct nvsp_message *init_packet = &nvdev->channel_init_pkt; +- struct net_device_context *ndev_ctx; +- struct rndis_device *rdev; +- struct net_device *ndev; +- struct hv_device *hv_dev; ++ struct net_device_context *ndev_ctx = netdev_priv(ndev); ++ struct hv_device *hv_dev = ndev_ctx->device_ctx; ++ struct rndis_device *rdev = nvdev->extension; + int i, ret; + +- if (!rtnl_trylock()) { +- schedule_work(w); +- return; +- } +- +- rdev = nvdev->extension; +- if (!rdev) +- goto unlock; /* device was removed */ +- +- ndev = rdev->ndev; +- ndev_ctx = netdev_priv(ndev); +- hv_dev = ndev_ctx->device_ctx; ++ ASSERT_RTNL(); + + memset(init_packet, 0, sizeof(struct nvsp_message)); + init_packet->hdr.msg_type = NVSP_MSG5_TYPE_SUBCHANNEL; +@@ -1091,13 +1077,13 @@ void rndis_set_subchannel(struct work_struct *w) + VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); + if (ret) { + netdev_err(ndev, "sub channel allocate send failed: %d\n", ret); +- goto failed; ++ return ret; + } + + wait_for_completion(&nvdev->channel_init_wait); + if (init_packet->msg.v5_msg.subchn_comp.status != NVSP_STAT_SUCCESS) { + netdev_err(ndev, "sub channel request failed\n"); +- goto failed; ++ return -EIO; + } + + nvdev->num_chn = 1 + +@@ -1116,21 +1102,7 @@ void rndis_set_subchannel(struct work_struct *w) + for (i = 0; i < VRSS_SEND_TAB_SIZE; i++) + ndev_ctx->tx_table[i] = i % nvdev->num_chn; + +- netif_device_attach(ndev); +- rtnl_unlock(); +- return; +- +-failed: +- /* fallback to only primary channel */ +- for (i = 1; i < nvdev->num_chn; i++) +- netif_napi_del(&nvdev->chan_table[i].napi); +- +- nvdev->max_chn = 1; +- nvdev->num_chn = 1; +- +- netif_device_attach(ndev); +-unlock: +- rtnl_unlock(); ++ return 0; + } + + static int rndis_netdev_set_hwcaps(struct rndis_device *rndis_device, +@@ -1321,21 +1293,12 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, + netif_napi_add(net, &net_device->chan_table[i].napi, + netvsc_poll, NAPI_POLL_WEIGHT); + +- if (net_device->num_chn > 1) +- schedule_work(&net_device->subchan_work); ++ return net_device; + + out: +- /* if unavailable, just proceed with one queue */ +- if (ret) { +- net_device->max_chn = 1; +- net_device->num_chn = 1; +- } +- +- /* No sub channels, device is ready */ +- if (net_device->num_chn == 1) +- netif_device_attach(net); +- +- return net_device; ++ /* setting up multiple channels failed */ ++ net_device->max_chn = 1; ++ net_device->num_chn = 1; + + err_dev_remv: + rndis_filter_device_remove(dev, net_device); +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index c74893c1e620..e7f7a1a002ee 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -546,7 +546,8 @@ int ipvlan_link_new(struct net *src_net, struct net_device *dev, + ipvlan->dev = dev; + ipvlan->port = port; + ipvlan->sfeatures = IPVLAN_FEATURES; +- ipvlan_adjust_mtu(ipvlan, phy_dev); ++ if (!tb[IFLA_MTU]) ++ ipvlan_adjust_mtu(ipvlan, phy_dev); + INIT_LIST_HEAD(&ipvlan->addrs); + + /* If the port-id base is at the MAX value, then wrap it around and +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 9881edc568ba..0aa91ab9a0fb 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -3197,6 +3197,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) + pkt_cnt = 0; + count = 0; + length = 0; ++ spin_lock_irqsave(&tqp->lock, flags); + for (skb = tqp->next; pkt_cnt < tqp->qlen; skb = skb->next) { + if (skb_is_gso(skb)) { + if (pkt_cnt) { +@@ -3205,7 +3206,8 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) + } + count = 1; + length = skb->len - TX_OVERHEAD; +- skb2 = skb_dequeue(tqp); ++ __skb_unlink(skb, tqp); ++ spin_unlock_irqrestore(&tqp->lock, flags); + goto gso_skb; + } + +@@ -3214,6 +3216,7 @@ static void lan78xx_tx_bh(struct lan78xx_net *dev) + skb_totallen = skb->len + roundup(skb_totallen, sizeof(u32)); + pkt_cnt++; + } ++ spin_unlock_irqrestore(&tqp->lock, flags); + + /* copy to a single skb */ + skb = alloc_skb(skb_totallen, GFP_ATOMIC); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index b23ee948e7c9..0db500bf86d9 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1245,6 +1245,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x413c, 0x81b3, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ + {QMI_FIXED_INTF(0x413c, 0x81b6, 8)}, /* Dell Wireless 5811e */ + {QMI_FIXED_INTF(0x413c, 0x81b6, 10)}, /* Dell Wireless 5811e */ ++ {QMI_FIXED_INTF(0x413c, 0x81d7, 1)}, /* Dell Wireless 5821e */ + {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ + {QMI_FIXED_INTF(0x03f0, 0x9d1d, 1)}, /* HP lt4120 Snapdragon X5 LTE */ + {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index aa88b640cb6c..0fa64cc1a011 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -3959,7 +3959,8 @@ static int rtl8152_close(struct net_device *netdev) + #ifdef CONFIG_PM_SLEEP + unregister_pm_notifier(&tp->pm_notifier); + #endif +- napi_disable(&tp->napi); ++ if (!test_bit(RTL8152_UNPLUG, &tp->flags)) ++ napi_disable(&tp->napi); + clear_bit(WORK_ENABLE, &tp->flags); + usb_kill_urb(tp->intr_urb); + cancel_delayed_work_sync(&tp->schedule); +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 3d9c5b35a4a7..bbdb46916dc3 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -623,9 +623,7 @@ static struct sk_buff **vxlan_gro_receive(struct sock *sk, + flush = 0; + + out: +- skb_gro_remcsum_cleanup(skb, &grc); +- skb->remcsum_offload = 0; +- NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_flush_final_remcsum(skb, pp, flush, &grc); + + return pp; + } +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.c b/drivers/net/wireless/realtek/rtlwifi/base.c +index 93256f8bc0b5..ec82c1c3f12e 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.c ++++ b/drivers/net/wireless/realtek/rtlwifi/base.c +@@ -483,18 +483,21 @@ static void _rtl_init_deferred_work(struct ieee80211_hw *hw) + + } + +-void rtl_deinit_deferred_work(struct ieee80211_hw *hw) ++void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq) + { + struct rtl_priv *rtlpriv = rtl_priv(hw); + + del_timer_sync(&rtlpriv->works.watchdog_timer); + +- cancel_delayed_work(&rtlpriv->works.watchdog_wq); +- cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq); +- cancel_delayed_work(&rtlpriv->works.ps_work); +- cancel_delayed_work(&rtlpriv->works.ps_rfon_wq); +- cancel_delayed_work(&rtlpriv->works.fwevt_wq); +- cancel_delayed_work(&rtlpriv->works.c2hcmd_wq); ++ cancel_delayed_work_sync(&rtlpriv->works.watchdog_wq); ++ if (ips_wq) ++ cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq); ++ else ++ cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq); ++ cancel_delayed_work_sync(&rtlpriv->works.ps_work); ++ cancel_delayed_work_sync(&rtlpriv->works.ps_rfon_wq); ++ cancel_delayed_work_sync(&rtlpriv->works.fwevt_wq); ++ cancel_delayed_work_sync(&rtlpriv->works.c2hcmd_wq); + } + EXPORT_SYMBOL_GPL(rtl_deinit_deferred_work); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/base.h b/drivers/net/wireless/realtek/rtlwifi/base.h +index b56d1b7f5567..cbbb5be36a09 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/base.h ++++ b/drivers/net/wireless/realtek/rtlwifi/base.h +@@ -121,7 +121,7 @@ void rtl_init_rfkill(struct ieee80211_hw *hw); + void rtl_deinit_rfkill(struct ieee80211_hw *hw); + + void rtl_watch_dog_timer_callback(unsigned long data); +-void rtl_deinit_deferred_work(struct ieee80211_hw *hw); ++void rtl_deinit_deferred_work(struct ieee80211_hw *hw, bool ips_wq); + + bool rtl_action_proc(struct ieee80211_hw *hw, struct sk_buff *skb, u8 is_tx); + int rtlwifi_rate_mapping(struct ieee80211_hw *hw, bool isht, +diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c +index c53cbf3d52bd..b01123138797 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/core.c ++++ b/drivers/net/wireless/realtek/rtlwifi/core.c +@@ -130,7 +130,6 @@ static void rtl_fw_do_work(const struct firmware *firmware, void *context, + firmware->size); + rtlpriv->rtlhal.wowlan_fwsize = firmware->size; + } +- rtlpriv->rtlhal.fwsize = firmware->size; + release_firmware(firmware); + } + +@@ -196,7 +195,7 @@ static void rtl_op_stop(struct ieee80211_hw *hw) + /* reset sec info */ + rtl_cam_reset_sec_info(hw); + +- rtl_deinit_deferred_work(hw); ++ rtl_deinit_deferred_work(hw, false); + } + rtlpriv->intf_ops->adapter_stop(hw); + +diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c +index d7331225c5f3..457a0f725c8a 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/pci.c ++++ b/drivers/net/wireless/realtek/rtlwifi/pci.c +@@ -2359,7 +2359,7 @@ void rtl_pci_disconnect(struct pci_dev *pdev) + ieee80211_unregister_hw(hw); + rtlmac->mac80211_registered = 0; + } else { +- rtl_deinit_deferred_work(hw); ++ rtl_deinit_deferred_work(hw, false); + rtlpriv->intf_ops->adapter_stop(hw); + } + rtlpriv->cfg->ops->disable_interrupt(hw); +diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c +index 07ee3096f50e..f6d00613c53d 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/ps.c ++++ b/drivers/net/wireless/realtek/rtlwifi/ps.c +@@ -66,7 +66,7 @@ bool rtl_ps_disable_nic(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + + /*<1> Stop all timer */ +- rtl_deinit_deferred_work(hw); ++ rtl_deinit_deferred_work(hw, true); + + /*<2> Disable Interrupt */ + rtlpriv->cfg->ops->disable_interrupt(hw); +@@ -287,7 +287,7 @@ void rtl_ips_nic_on(struct ieee80211_hw *hw) + struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw)); + enum rf_pwrstate rtstate; + +- cancel_delayed_work(&rtlpriv->works.ips_nic_off_wq); ++ cancel_delayed_work_sync(&rtlpriv->works.ips_nic_off_wq); + + spin_lock(&rtlpriv->locks.ips_lock); + if (ppsc->inactiveps) { +diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.c b/drivers/net/wireless/realtek/rtlwifi/usb.c +index 5590d07d0918..820c42ff5384 100644 +--- a/drivers/net/wireless/realtek/rtlwifi/usb.c ++++ b/drivers/net/wireless/realtek/rtlwifi/usb.c +@@ -1150,7 +1150,7 @@ void rtl_usb_disconnect(struct usb_interface *intf) + ieee80211_unregister_hw(hw); + rtlmac->mac80211_registered = 0; + } else { +- rtl_deinit_deferred_work(hw); ++ rtl_deinit_deferred_work(hw, false); + rtlpriv->intf_ops->adapter_stop(hw); + } + /*deinit rfkill */ +diff --git a/drivers/pci/dwc/pci-exynos.c b/drivers/pci/dwc/pci-exynos.c +index 5596fdedbb94..ea03f1ec12a4 100644 +--- a/drivers/pci/dwc/pci-exynos.c ++++ b/drivers/pci/dwc/pci-exynos.c +@@ -695,7 +695,8 @@ static int __init exynos_pcie_probe(struct platform_device *pdev) + return ret; + } + +- if (ep->ops && ep->ops->get_clk_resources) { ++ if (ep->ops && ep->ops->get_clk_resources && ++ ep->ops->init_clk_resources) { + ret = ep->ops->get_clk_resources(ep); + if (ret) + return ret; +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index caea7c618207..4523d7e1bcb9 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -1091,6 +1091,7 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + struct pci_bus *pbus; + struct pci_dev *pdev; + struct cpumask *dest; ++ unsigned long flags; + struct compose_comp_ctxt comp; + struct tran_int_desc *int_desc; + struct { +@@ -1182,14 +1183,15 @@ static void hv_compose_msi_msg(struct irq_data *data, struct msi_msg *msg) + * the channel callback directly when channel->target_cpu is + * the current CPU. When the higher level interrupt code + * calls us with interrupt enabled, let's add the +- * local_bh_disable()/enable() to avoid race. ++ * local_irq_save()/restore() to avoid race: ++ * hv_pci_onchannelcallback() can also run in tasklet. + */ +- local_bh_disable(); ++ local_irq_save(flags); + + if (hbus->hdev->channel->target_cpu == smp_processor_id()) + hv_pci_onchannelcallback(hbus); + +- local_bh_enable(); ++ local_irq_restore(flags); + + if (hpdev->state == hv_pcichild_ejecting) { + dev_err_once(&hbus->hdev->device, +diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c +index 00b8d4cdcac3..c01d1f3a1c7d 100644 +--- a/drivers/usb/host/xhci-hub.c ++++ b/drivers/usb/host/xhci-hub.c +@@ -366,7 +366,7 @@ int xhci_find_slot_id_by_port(struct usb_hcd *hcd, struct xhci_hcd *xhci, + + slot_id = 0; + for (i = 0; i < MAX_HC_SLOTS; i++) { +- if (!xhci->devs[i]) ++ if (!xhci->devs[i] || !xhci->devs[i]->udev) + continue; + speed = xhci->devs[i]->udev->speed; + if (((speed >= USB_SPEED_SUPER) == (hcd->speed >= HCD_USB3)) +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index b0d606b2d06c..6123b4dd8638 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -1186,7 +1186,8 @@ static long vhost_net_set_backend(struct vhost_net *n, unsigned index, int fd) + if (ubufs) + vhost_net_ubuf_put_wait_and_free(ubufs); + err_ubufs: +- sockfd_put(sock); ++ if (sock) ++ sockfd_put(sock); + err_vq: + mutex_unlock(&vq->mutex); + err: +diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c +index b7c816f39404..6dd63981787a 100644 +--- a/fs/autofs4/dev-ioctl.c ++++ b/fs/autofs4/dev-ioctl.c +@@ -148,6 +148,15 @@ static int validate_dev_ioctl(int cmd, struct autofs_dev_ioctl *param) + cmd); + goto out; + } ++ } else { ++ unsigned int inr = _IOC_NR(cmd); ++ ++ if (inr == AUTOFS_DEV_IOCTL_OPENMOUNT_CMD || ++ inr == AUTOFS_DEV_IOCTL_REQUESTER_CMD || ++ inr == AUTOFS_DEV_IOCTL_ISMOUNTPOINT_CMD) { ++ err = -EINVAL; ++ goto out; ++ } + } + + err = 0; +@@ -284,7 +293,8 @@ static int autofs_dev_ioctl_openmount(struct file *fp, + dev_t devid; + int err, fd; + +- /* param->path has already been checked */ ++ /* param->path has been checked in validate_dev_ioctl() */ ++ + if (!param->openmount.devid) + return -EINVAL; + +@@ -446,10 +456,7 @@ static int autofs_dev_ioctl_requester(struct file *fp, + dev_t devid; + int err = -ENOENT; + +- if (param->size <= AUTOFS_DEV_IOCTL_SIZE) { +- err = -EINVAL; +- goto out; +- } ++ /* param->path has been checked in validate_dev_ioctl() */ + + devid = sbi->sb->s_dev; + +@@ -534,10 +541,7 @@ static int autofs_dev_ioctl_ismountpoint(struct file *fp, + unsigned int devid, magic; + int err = -ENOENT; + +- if (param->size <= AUTOFS_DEV_IOCTL_SIZE) { +- err = -EINVAL; +- goto out; +- } ++ /* param->path has been checked in validate_dev_ioctl() */ + + name = param->path; + type = param->ismountpoint.in.type; +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index fc4c14a72366..bf4e22df7c97 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -4214,6 +4214,110 @@ static int log_one_extent(struct btrfs_trans_handle *trans, + return ret; + } + ++/* ++ * Log all prealloc extents beyond the inode's i_size to make sure we do not ++ * lose them after doing a fast fsync and replaying the log. We scan the ++ * subvolume's root instead of iterating the inode's extent map tree because ++ * otherwise we can log incorrect extent items based on extent map conversion. ++ * That can happen due to the fact that extent maps are merged when they ++ * are not in the extent map tree's list of modified extents. ++ */ ++static int btrfs_log_prealloc_extents(struct btrfs_trans_handle *trans, ++ struct btrfs_inode *inode, ++ struct btrfs_path *path) ++{ ++ struct btrfs_root *root = inode->root; ++ struct btrfs_key key; ++ const u64 i_size = i_size_read(&inode->vfs_inode); ++ const u64 ino = btrfs_ino(inode); ++ struct btrfs_path *dst_path = NULL; ++ u64 last_extent = (u64)-1; ++ int ins_nr = 0; ++ int start_slot; ++ int ret; ++ ++ if (!(inode->flags & BTRFS_INODE_PREALLOC)) ++ return 0; ++ ++ key.objectid = ino; ++ key.type = BTRFS_EXTENT_DATA_KEY; ++ key.offset = i_size; ++ ret = btrfs_search_slot(NULL, root, &key, path, 0, 0); ++ if (ret < 0) ++ goto out; ++ ++ while (true) { ++ struct extent_buffer *leaf = path->nodes[0]; ++ int slot = path->slots[0]; ++ ++ if (slot >= btrfs_header_nritems(leaf)) { ++ if (ins_nr > 0) { ++ ret = copy_items(trans, inode, dst_path, path, ++ &last_extent, start_slot, ++ ins_nr, 1, 0); ++ if (ret < 0) ++ goto out; ++ ins_nr = 0; ++ } ++ ret = btrfs_next_leaf(root, path); ++ if (ret < 0) ++ goto out; ++ if (ret > 0) { ++ ret = 0; ++ break; ++ } ++ continue; ++ } ++ ++ btrfs_item_key_to_cpu(leaf, &key, slot); ++ if (key.objectid > ino) ++ break; ++ if (WARN_ON_ONCE(key.objectid < ino) || ++ key.type < BTRFS_EXTENT_DATA_KEY || ++ key.offset < i_size) { ++ path->slots[0]++; ++ continue; ++ } ++ if (last_extent == (u64)-1) { ++ last_extent = key.offset; ++ /* ++ * Avoid logging extent items logged in past fsync calls ++ * and leading to duplicate keys in the log tree. ++ */ ++ do { ++ ret = btrfs_truncate_inode_items(trans, ++ root->log_root, ++ &inode->vfs_inode, ++ i_size, ++ BTRFS_EXTENT_DATA_KEY); ++ } while (ret == -EAGAIN); ++ if (ret) ++ goto out; ++ } ++ if (ins_nr == 0) ++ start_slot = slot; ++ ins_nr++; ++ path->slots[0]++; ++ if (!dst_path) { ++ dst_path = btrfs_alloc_path(); ++ if (!dst_path) { ++ ret = -ENOMEM; ++ goto out; ++ } ++ } ++ } ++ if (ins_nr > 0) { ++ ret = copy_items(trans, inode, dst_path, path, &last_extent, ++ start_slot, ins_nr, 1, 0); ++ if (ret > 0) ++ ret = 0; ++ } ++out: ++ btrfs_release_path(path); ++ btrfs_free_path(dst_path); ++ return ret; ++} ++ + static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + struct btrfs_root *root, + struct btrfs_inode *inode, +@@ -4256,6 +4360,11 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + if (em->generation <= test_gen) + continue; + ++ /* We log prealloc extents beyond eof later. */ ++ if (test_bit(EXTENT_FLAG_PREALLOC, &em->flags) && ++ em->start >= i_size_read(&inode->vfs_inode)) ++ continue; ++ + if (em->start < logged_start) + logged_start = em->start; + if ((em->start + em->len - 1) > logged_end) +@@ -4268,31 +4377,6 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + num++; + } + +- /* +- * Add all prealloc extents beyond the inode's i_size to make sure we +- * don't lose them after doing a fast fsync and replaying the log. +- */ +- if (inode->flags & BTRFS_INODE_PREALLOC) { +- struct rb_node *node; +- +- for (node = rb_last(&tree->map); node; node = rb_prev(node)) { +- em = rb_entry(node, struct extent_map, rb_node); +- if (em->start < i_size_read(&inode->vfs_inode)) +- break; +- if (!list_empty(&em->list)) +- continue; +- /* Same as above loop. */ +- if (++num > 32768) { +- list_del_init(&tree->modified_extents); +- ret = -EFBIG; +- goto process; +- } +- refcount_inc(&em->refs); +- set_bit(EXTENT_FLAG_LOGGING, &em->flags); +- list_add_tail(&em->list, &extents); +- } +- } +- + list_sort(NULL, &extents, extent_cmp); + btrfs_get_logged_extents(inode, logged_list, logged_start, logged_end); + /* +@@ -4337,6 +4421,9 @@ static int btrfs_log_changed_extents(struct btrfs_trans_handle *trans, + up_write(&inode->dio_sem); + + btrfs_release_path(path); ++ if (!ret) ++ ret = btrfs_log_prealloc_extents(trans, inode, path); ++ + return ret; + } + +diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c +index 88a31e9340a0..d1516327b787 100644 +--- a/fs/ocfs2/aops.c ++++ b/fs/ocfs2/aops.c +@@ -134,6 +134,19 @@ static int ocfs2_symlink_get_block(struct inode *inode, sector_t iblock, + return err; + } + ++static int ocfs2_lock_get_block(struct inode *inode, sector_t iblock, ++ struct buffer_head *bh_result, int create) ++{ ++ int ret = 0; ++ struct ocfs2_inode_info *oi = OCFS2_I(inode); ++ ++ down_read(&oi->ip_alloc_sem); ++ ret = ocfs2_get_block(inode, iblock, bh_result, create); ++ up_read(&oi->ip_alloc_sem); ++ ++ return ret; ++} ++ + int ocfs2_get_block(struct inode *inode, sector_t iblock, + struct buffer_head *bh_result, int create) + { +@@ -2128,7 +2141,7 @@ static void ocfs2_dio_free_write_ctx(struct inode *inode, + * called like this: dio->get_blocks(dio->inode, fs_startblk, + * fs_count, map_bh, dio->rw == WRITE); + */ +-static int ocfs2_dio_get_block(struct inode *inode, sector_t iblock, ++static int ocfs2_dio_wr_get_block(struct inode *inode, sector_t iblock, + struct buffer_head *bh_result, int create) + { + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); +@@ -2154,12 +2167,9 @@ static int ocfs2_dio_get_block(struct inode *inode, sector_t iblock, + * while file size will be changed. + */ + if (pos + total_len <= i_size_read(inode)) { +- down_read(&oi->ip_alloc_sem); +- /* This is the fast path for re-write. */ +- ret = ocfs2_get_block(inode, iblock, bh_result, create); +- +- up_read(&oi->ip_alloc_sem); + ++ /* This is the fast path for re-write. */ ++ ret = ocfs2_lock_get_block(inode, iblock, bh_result, create); + if (buffer_mapped(bh_result) && + !buffer_new(bh_result) && + ret == 0) +@@ -2424,9 +2434,9 @@ static ssize_t ocfs2_direct_IO(struct kiocb *iocb, struct iov_iter *iter) + return 0; + + if (iov_iter_rw(iter) == READ) +- get_block = ocfs2_get_block; ++ get_block = ocfs2_lock_get_block; + else +- get_block = ocfs2_dio_get_block; ++ get_block = ocfs2_dio_wr_get_block; + + return __blockdev_direct_IO(iocb, inode, inode->i_sb->s_bdev, + iter, get_block, +diff --git a/fs/ocfs2/cluster/nodemanager.c b/fs/ocfs2/cluster/nodemanager.c +index b17d180bdc16..c204ac9b49e5 100644 +--- a/fs/ocfs2/cluster/nodemanager.c ++++ b/fs/ocfs2/cluster/nodemanager.c +@@ -40,6 +40,9 @@ char *o2nm_fence_method_desc[O2NM_FENCE_METHODS] = { + "panic", /* O2NM_FENCE_PANIC */ + }; + ++static inline void o2nm_lock_subsystem(void); ++static inline void o2nm_unlock_subsystem(void); ++ + struct o2nm_node *o2nm_get_node_by_num(u8 node_num) + { + struct o2nm_node *node = NULL; +@@ -181,7 +184,10 @@ static struct o2nm_cluster *to_o2nm_cluster_from_node(struct o2nm_node *node) + { + /* through the first node_set .parent + * mycluster/nodes/mynode == o2nm_cluster->o2nm_node_group->o2nm_node */ +- return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent); ++ if (node->nd_item.ci_parent) ++ return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent); ++ else ++ return NULL; + } + + enum { +@@ -194,7 +200,7 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page, + size_t count) + { + struct o2nm_node *node = to_o2nm_node(item); +- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node); ++ struct o2nm_cluster *cluster; + unsigned long tmp; + char *p = (char *)page; + int ret = 0; +@@ -214,6 +220,13 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page, + !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes)) + return -EINVAL; /* XXX */ + ++ o2nm_lock_subsystem(); ++ cluster = to_o2nm_cluster_from_node(node); ++ if (!cluster) { ++ o2nm_unlock_subsystem(); ++ return -EINVAL; ++ } ++ + write_lock(&cluster->cl_nodes_lock); + if (cluster->cl_nodes[tmp]) + ret = -EEXIST; +@@ -226,6 +239,8 @@ static ssize_t o2nm_node_num_store(struct config_item *item, const char *page, + set_bit(tmp, cluster->cl_nodes_bitmap); + } + write_unlock(&cluster->cl_nodes_lock); ++ o2nm_unlock_subsystem(); ++ + if (ret) + return ret; + +@@ -269,7 +284,7 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item, + size_t count) + { + struct o2nm_node *node = to_o2nm_node(item); +- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node); ++ struct o2nm_cluster *cluster; + int ret, i; + struct rb_node **p, *parent; + unsigned int octets[4]; +@@ -286,6 +301,13 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item, + be32_add_cpu(&ipv4_addr, octets[i] << (i * 8)); + } + ++ o2nm_lock_subsystem(); ++ cluster = to_o2nm_cluster_from_node(node); ++ if (!cluster) { ++ o2nm_unlock_subsystem(); ++ return -EINVAL; ++ } ++ + ret = 0; + write_lock(&cluster->cl_nodes_lock); + if (o2nm_node_ip_tree_lookup(cluster, ipv4_addr, &p, &parent)) +@@ -298,6 +320,8 @@ static ssize_t o2nm_node_ipv4_address_store(struct config_item *item, + rb_insert_color(&node->nd_ip_node, &cluster->cl_node_ip_tree); + } + write_unlock(&cluster->cl_nodes_lock); ++ o2nm_unlock_subsystem(); ++ + if (ret) + return ret; + +@@ -315,7 +339,7 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page, + size_t count) + { + struct o2nm_node *node = to_o2nm_node(item); +- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node); ++ struct o2nm_cluster *cluster; + unsigned long tmp; + char *p = (char *)page; + ssize_t ret; +@@ -333,17 +357,26 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page, + !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes)) + return -EINVAL; /* XXX */ + ++ o2nm_lock_subsystem(); ++ cluster = to_o2nm_cluster_from_node(node); ++ if (!cluster) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + /* the only failure case is trying to set a new local node + * when a different one is already set */ + if (tmp && tmp == cluster->cl_has_local && +- cluster->cl_local_node != node->nd_num) +- return -EBUSY; ++ cluster->cl_local_node != node->nd_num) { ++ ret = -EBUSY; ++ goto out; ++ } + + /* bring up the rx thread if we're setting the new local node. */ + if (tmp && !cluster->cl_has_local) { + ret = o2net_start_listening(node); + if (ret) +- return ret; ++ goto out; + } + + if (!tmp && cluster->cl_has_local && +@@ -358,7 +391,11 @@ static ssize_t o2nm_node_local_store(struct config_item *item, const char *page, + cluster->cl_local_node = node->nd_num; + } + +- return count; ++ ret = count; ++ ++out: ++ o2nm_unlock_subsystem(); ++ return ret; + } + + CONFIGFS_ATTR(o2nm_node_, num); +@@ -738,6 +775,16 @@ static struct o2nm_cluster_group o2nm_cluster_group = { + }, + }; + ++static inline void o2nm_lock_subsystem(void) ++{ ++ mutex_lock(&o2nm_cluster_group.cs_subsys.su_mutex); ++} ++ ++static inline void o2nm_unlock_subsystem(void) ++{ ++ mutex_unlock(&o2nm_cluster_group.cs_subsys.su_mutex); ++} ++ + int o2nm_depend_item(struct config_item *item) + { + return configfs_depend_item(&o2nm_cluster_group.cs_subsys, item); +diff --git a/fs/reiserfs/prints.c b/fs/reiserfs/prints.c +index 64f49cafbc5b..cfb0c9ac2de4 100644 +--- a/fs/reiserfs/prints.c ++++ b/fs/reiserfs/prints.c +@@ -76,83 +76,99 @@ static char *le_type(struct reiserfs_key *key) + } + + /* %k */ +-static void sprintf_le_key(char *buf, struct reiserfs_key *key) ++static int scnprintf_le_key(char *buf, size_t size, struct reiserfs_key *key) + { + if (key) +- sprintf(buf, "[%d %d %s %s]", le32_to_cpu(key->k_dir_id), +- le32_to_cpu(key->k_objectid), le_offset(key), +- le_type(key)); ++ return scnprintf(buf, size, "[%d %d %s %s]", ++ le32_to_cpu(key->k_dir_id), ++ le32_to_cpu(key->k_objectid), le_offset(key), ++ le_type(key)); + else +- sprintf(buf, "[NULL]"); ++ return scnprintf(buf, size, "[NULL]"); + } + + /* %K */ +-static void sprintf_cpu_key(char *buf, struct cpu_key *key) ++static int scnprintf_cpu_key(char *buf, size_t size, struct cpu_key *key) + { + if (key) +- sprintf(buf, "[%d %d %s %s]", key->on_disk_key.k_dir_id, +- key->on_disk_key.k_objectid, reiserfs_cpu_offset(key), +- cpu_type(key)); ++ return scnprintf(buf, size, "[%d %d %s %s]", ++ key->on_disk_key.k_dir_id, ++ key->on_disk_key.k_objectid, ++ reiserfs_cpu_offset(key), cpu_type(key)); + else +- sprintf(buf, "[NULL]"); ++ return scnprintf(buf, size, "[NULL]"); + } + +-static void sprintf_de_head(char *buf, struct reiserfs_de_head *deh) ++static int scnprintf_de_head(char *buf, size_t size, ++ struct reiserfs_de_head *deh) + { + if (deh) +- sprintf(buf, +- "[offset=%d dir_id=%d objectid=%d location=%d state=%04x]", +- deh_offset(deh), deh_dir_id(deh), deh_objectid(deh), +- deh_location(deh), deh_state(deh)); ++ return scnprintf(buf, size, ++ "[offset=%d dir_id=%d objectid=%d location=%d state=%04x]", ++ deh_offset(deh), deh_dir_id(deh), ++ deh_objectid(deh), deh_location(deh), ++ deh_state(deh)); + else +- sprintf(buf, "[NULL]"); ++ return scnprintf(buf, size, "[NULL]"); + + } + +-static void sprintf_item_head(char *buf, struct item_head *ih) ++static int scnprintf_item_head(char *buf, size_t size, struct item_head *ih) + { + if (ih) { +- strcpy(buf, +- (ih_version(ih) == KEY_FORMAT_3_6) ? "*3.6* " : "*3.5*"); +- sprintf_le_key(buf + strlen(buf), &(ih->ih_key)); +- sprintf(buf + strlen(buf), ", item_len %d, item_location %d, " +- "free_space(entry_count) %d", +- ih_item_len(ih), ih_location(ih), ih_free_space(ih)); ++ char *p = buf; ++ char * const end = buf + size; ++ ++ p += scnprintf(p, end - p, "%s", ++ (ih_version(ih) == KEY_FORMAT_3_6) ? ++ "*3.6* " : "*3.5*"); ++ ++ p += scnprintf_le_key(p, end - p, &ih->ih_key); ++ ++ p += scnprintf(p, end - p, ++ ", item_len %d, item_location %d, free_space(entry_count) %d", ++ ih_item_len(ih), ih_location(ih), ++ ih_free_space(ih)); ++ return p - buf; + } else +- sprintf(buf, "[NULL]"); ++ return scnprintf(buf, size, "[NULL]"); + } + +-static void sprintf_direntry(char *buf, struct reiserfs_dir_entry *de) ++static int scnprintf_direntry(char *buf, size_t size, ++ struct reiserfs_dir_entry *de) + { + char name[20]; + + memcpy(name, de->de_name, de->de_namelen > 19 ? 19 : de->de_namelen); + name[de->de_namelen > 19 ? 19 : de->de_namelen] = 0; +- sprintf(buf, "\"%s\"==>[%d %d]", name, de->de_dir_id, de->de_objectid); ++ return scnprintf(buf, size, "\"%s\"==>[%d %d]", ++ name, de->de_dir_id, de->de_objectid); + } + +-static void sprintf_block_head(char *buf, struct buffer_head *bh) ++static int scnprintf_block_head(char *buf, size_t size, struct buffer_head *bh) + { +- sprintf(buf, "level=%d, nr_items=%d, free_space=%d rdkey ", +- B_LEVEL(bh), B_NR_ITEMS(bh), B_FREE_SPACE(bh)); ++ return scnprintf(buf, size, ++ "level=%d, nr_items=%d, free_space=%d rdkey ", ++ B_LEVEL(bh), B_NR_ITEMS(bh), B_FREE_SPACE(bh)); + } + +-static void sprintf_buffer_head(char *buf, struct buffer_head *bh) ++static int scnprintf_buffer_head(char *buf, size_t size, struct buffer_head *bh) + { +- sprintf(buf, +- "dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)", +- bh->b_bdev, bh->b_size, +- (unsigned long long)bh->b_blocknr, atomic_read(&(bh->b_count)), +- bh->b_state, bh->b_page, +- buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE", +- buffer_dirty(bh) ? "DIRTY" : "CLEAN", +- buffer_locked(bh) ? "LOCKED" : "UNLOCKED"); ++ return scnprintf(buf, size, ++ "dev %pg, size %zd, blocknr %llu, count %d, state 0x%lx, page %p, (%s, %s, %s)", ++ bh->b_bdev, bh->b_size, ++ (unsigned long long)bh->b_blocknr, ++ atomic_read(&(bh->b_count)), ++ bh->b_state, bh->b_page, ++ buffer_uptodate(bh) ? "UPTODATE" : "!UPTODATE", ++ buffer_dirty(bh) ? "DIRTY" : "CLEAN", ++ buffer_locked(bh) ? "LOCKED" : "UNLOCKED"); + } + +-static void sprintf_disk_child(char *buf, struct disk_child *dc) ++static int scnprintf_disk_child(char *buf, size_t size, struct disk_child *dc) + { +- sprintf(buf, "[dc_number=%d, dc_size=%u]", dc_block_number(dc), +- dc_size(dc)); ++ return scnprintf(buf, size, "[dc_number=%d, dc_size=%u]", ++ dc_block_number(dc), dc_size(dc)); + } + + static char *is_there_reiserfs_struct(char *fmt, int *what) +@@ -189,55 +205,60 @@ static void prepare_error_buf(const char *fmt, va_list args) + char *fmt1 = fmt_buf; + char *k; + char *p = error_buf; ++ char * const end = &error_buf[sizeof(error_buf)]; + int what; + + spin_lock(&error_lock); + +- strcpy(fmt1, fmt); ++ if (WARN_ON(strscpy(fmt_buf, fmt, sizeof(fmt_buf)) < 0)) { ++ strscpy(error_buf, "format string too long", end - error_buf); ++ goto out_unlock; ++ } + + while ((k = is_there_reiserfs_struct(fmt1, &what)) != NULL) { + *k = 0; + +- p += vsprintf(p, fmt1, args); ++ p += vscnprintf(p, end - p, fmt1, args); + + switch (what) { + case 'k': +- sprintf_le_key(p, va_arg(args, struct reiserfs_key *)); ++ p += scnprintf_le_key(p, end - p, ++ va_arg(args, struct reiserfs_key *)); + break; + case 'K': +- sprintf_cpu_key(p, va_arg(args, struct cpu_key *)); ++ p += scnprintf_cpu_key(p, end - p, ++ va_arg(args, struct cpu_key *)); + break; + case 'h': +- sprintf_item_head(p, va_arg(args, struct item_head *)); ++ p += scnprintf_item_head(p, end - p, ++ va_arg(args, struct item_head *)); + break; + case 't': +- sprintf_direntry(p, +- va_arg(args, +- struct reiserfs_dir_entry *)); ++ p += scnprintf_direntry(p, end - p, ++ va_arg(args, struct reiserfs_dir_entry *)); + break; + case 'y': +- sprintf_disk_child(p, +- va_arg(args, struct disk_child *)); ++ p += scnprintf_disk_child(p, end - p, ++ va_arg(args, struct disk_child *)); + break; + case 'z': +- sprintf_block_head(p, +- va_arg(args, struct buffer_head *)); ++ p += scnprintf_block_head(p, end - p, ++ va_arg(args, struct buffer_head *)); + break; + case 'b': +- sprintf_buffer_head(p, +- va_arg(args, struct buffer_head *)); ++ p += scnprintf_buffer_head(p, end - p, ++ va_arg(args, struct buffer_head *)); + break; + case 'a': +- sprintf_de_head(p, +- va_arg(args, +- struct reiserfs_de_head *)); ++ p += scnprintf_de_head(p, end - p, ++ va_arg(args, struct reiserfs_de_head *)); + break; + } + +- p += strlen(p); + fmt1 = k + 2; + } +- vsprintf(p, fmt1, args); ++ p += vscnprintf(p, end - p, fmt1, args); ++out_unlock: + spin_unlock(&error_lock); + + } +diff --git a/include/linux/arm-smccc.h b/include/linux/arm-smccc.h +index a031897fca76..ca1d2cc2cdfa 100644 +--- a/include/linux/arm-smccc.h ++++ b/include/linux/arm-smccc.h +@@ -80,6 +80,11 @@ + ARM_SMCCC_SMC_32, \ + 0, 0x8000) + ++#define ARM_SMCCC_ARCH_WORKAROUND_2 \ ++ ARM_SMCCC_CALL_VAL(ARM_SMCCC_FAST_CALL, \ ++ ARM_SMCCC_SMC_32, \ ++ 0, 0x7fff) ++ + #ifndef __ASSEMBLY__ + + #include +@@ -291,5 +296,10 @@ asmlinkage void __arm_smccc_hvc(unsigned long a0, unsigned long a1, + */ + #define arm_smccc_1_1_hvc(...) __arm_smccc_1_1(SMCCC_HVC_INST, __VA_ARGS__) + ++/* Return codes defined in ARM DEN 0070A */ ++#define SMCCC_RET_SUCCESS 0 ++#define SMCCC_RET_NOT_SUPPORTED -1 ++#define SMCCC_RET_NOT_REQUIRED -2 ++ + #endif /*__ASSEMBLY__*/ + #endif /*__LINUX_ARM_SMCCC_H*/ +diff --git a/include/linux/atmdev.h b/include/linux/atmdev.h +index 0c27515d2cf6..8124815eb121 100644 +--- a/include/linux/atmdev.h ++++ b/include/linux/atmdev.h +@@ -214,6 +214,7 @@ struct atmphy_ops { + struct atm_skb_data { + struct atm_vcc *vcc; /* ATM VCC */ + unsigned long atm_options; /* ATM layer options */ ++ unsigned int acct_truesize; /* truesize accounted to vcc */ + }; + + #define VCC_HTABLE_SIZE 32 +@@ -241,6 +242,20 @@ void vcc_insert_socket(struct sock *sk); + + void atm_dev_release_vccs(struct atm_dev *dev); + ++static inline void atm_account_tx(struct atm_vcc *vcc, struct sk_buff *skb) ++{ ++ /* ++ * Because ATM skbs may not belong to a sock (and we don't ++ * necessarily want to), skb->truesize may be adjusted, ++ * escaping the hack in pskb_expand_head() which avoids ++ * doing so for some cases. So stash the value of truesize ++ * at the time we accounted it, and atm_pop_raw() can use ++ * that value later, in case it changes. ++ */ ++ refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc); ++ ATM_SKB(skb)->acct_truesize = skb->truesize; ++ ATM_SKB(skb)->atm_options = vcc->atm_options; ++} + + static inline void atm_force_charge(struct atm_vcc *vcc,int truesize) + { +diff --git a/include/linux/backing-dev-defs.h b/include/linux/backing-dev-defs.h +index eac387a3bfef..3c1beffc861a 100644 +--- a/include/linux/backing-dev-defs.h ++++ b/include/linux/backing-dev-defs.h +@@ -22,7 +22,6 @@ struct dentry; + */ + enum wb_state { + WB_registered, /* bdi_register() was done */ +- WB_shutting_down, /* wb_shutdown() in progress */ + WB_writeback_running, /* Writeback is in progress */ + WB_has_dirty_io, /* Dirty inodes on ->b_{dirty|io|more_io} */ + }; +@@ -165,6 +164,7 @@ struct backing_dev_info { + #ifdef CONFIG_CGROUP_WRITEBACK + struct radix_tree_root cgwb_tree; /* radix tree of active cgroup wbs */ + struct rb_root cgwb_congested_tree; /* their congested states */ ++ struct mutex cgwb_release_mutex; /* protect shutdown of wb structs */ + #else + struct bdi_writeback_congested *wb_congested; + #endif +diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h +index f43113b8890b..c11032b06d68 100644 +--- a/include/linux/compiler-gcc.h ++++ b/include/linux/compiler-gcc.h +@@ -65,6 +65,18 @@ + #define __must_be_array(a) BUILD_BUG_ON_ZERO(__same_type((a), &(a)[0])) + #endif + ++/* ++ * Feature detection for gnu_inline (gnu89 extern inline semantics). Either ++ * __GNUC_STDC_INLINE__ is defined (not using gnu89 extern inline semantics, ++ * and we opt in to the gnu89 semantics), or __GNUC_STDC_INLINE__ is not ++ * defined so the gnu89 semantics are the default. ++ */ ++#ifdef __GNUC_STDC_INLINE__ ++# define __gnu_inline __attribute__((gnu_inline)) ++#else ++# define __gnu_inline ++#endif ++ + /* + * Force always-inline if the user requests it so via the .config, + * or if gcc is too old. +@@ -72,19 +84,22 @@ + * -Wunused-function. This turns out to avoid the need for complex #ifdef + * directives. Suppress the warning in clang as well by using "unused" + * function attribute, which is redundant but not harmful for gcc. ++ * Prefer gnu_inline, so that extern inline functions do not emit an ++ * externally visible function. This makes extern inline behave as per gnu89 ++ * semantics rather than c99. This prevents multiple symbol definition errors ++ * of extern inline functions at link time. ++ * A lot of inline functions can cause havoc with function tracing. + */ + #if !defined(CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING) || \ + !defined(CONFIG_OPTIMIZE_INLINING) || (__GNUC__ < 4) +-#define inline inline __attribute__((always_inline,unused)) notrace +-#define __inline__ __inline__ __attribute__((always_inline,unused)) notrace +-#define __inline __inline __attribute__((always_inline,unused)) notrace ++#define inline \ ++ inline __attribute__((always_inline, unused)) notrace __gnu_inline + #else +-/* A lot of inline functions can cause havoc with function tracing */ +-#define inline inline __attribute__((unused)) notrace +-#define __inline__ __inline__ __attribute__((unused)) notrace +-#define __inline __inline __attribute__((unused)) notrace ++#define inline inline __attribute__((unused)) notrace __gnu_inline + #endif + ++#define __inline__ inline ++#define __inline inline + #define __always_inline inline __attribute__((always_inline)) + #define noinline __attribute__((noinline)) + +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index f3765155fa4d..1d793d86d55f 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -857,7 +857,7 @@ struct mlx5_ifc_cmd_hca_cap_bits { + u8 reserved_at_1a4[0x1]; + u8 ets[0x1]; + u8 nic_flow_table[0x1]; +- u8 eswitch_flow_table[0x1]; ++ u8 eswitch_manager[0x1]; + u8 early_vf_enable[0x1]; + u8 mcam_reg[0x1]; + u8 pcam_reg[0x1]; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 46bf7cc7d5d5..2ea7ee1fb495 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -2668,11 +2668,31 @@ static inline void skb_gro_flush_final(struct sk_buff *skb, struct sk_buff **pp, + if (PTR_ERR(pp) != -EINPROGRESS) + NAPI_GRO_CB(skb)->flush |= flush; + } ++static inline void skb_gro_flush_final_remcsum(struct sk_buff *skb, ++ struct sk_buff **pp, ++ int flush, ++ struct gro_remcsum *grc) ++{ ++ if (PTR_ERR(pp) != -EINPROGRESS) { ++ NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_remcsum_cleanup(skb, grc); ++ skb->remcsum_offload = 0; ++ } ++} + #else + static inline void skb_gro_flush_final(struct sk_buff *skb, struct sk_buff **pp, int flush) + { + NAPI_GRO_CB(skb)->flush |= flush; + } ++static inline void skb_gro_flush_final_remcsum(struct sk_buff *skb, ++ struct sk_buff **pp, ++ int flush, ++ struct gro_remcsum *grc) ++{ ++ NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_remcsum_cleanup(skb, grc); ++ skb->remcsum_offload = 0; ++} + #endif + + static inline int dev_hard_header(struct sk_buff *skb, struct net_device *dev, +diff --git a/include/linux/string.h b/include/linux/string.h +index cfd83eb2f926..96115bf561b4 100644 +--- a/include/linux/string.h ++++ b/include/linux/string.h +@@ -28,7 +28,7 @@ extern char * strncpy(char *,const char *, __kernel_size_t); + size_t strlcpy(char *, const char *, size_t); + #endif + #ifndef __HAVE_ARCH_STRSCPY +-ssize_t __must_check strscpy(char *, const char *, size_t); ++ssize_t strscpy(char *, const char *, size_t); + #endif + #ifndef __HAVE_ARCH_STRCAT + extern char * strcat(char *, const char *); +diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c +index 03918a19cf2d..3b71d859ee38 100644 +--- a/kernel/time/clocksource.c ++++ b/kernel/time/clocksource.c +@@ -322,6 +322,8 @@ static void clocksource_enqueue_watchdog(struct clocksource *cs) + { + unsigned long flags; + ++ INIT_LIST_HEAD(&cs->wd_list); ++ + spin_lock_irqsave(&watchdog_lock, flags); + if (cs->flags & CLOCK_SOURCE_MUST_VERIFY) { + /* cs is a clocksource to be watched. */ +diff --git a/mm/backing-dev.c b/mm/backing-dev.c +index 6774e0369ebe..9386c98dac12 100644 +--- a/mm/backing-dev.c ++++ b/mm/backing-dev.c +@@ -356,15 +356,8 @@ static void wb_shutdown(struct bdi_writeback *wb) + spin_lock_bh(&wb->work_lock); + if (!test_and_clear_bit(WB_registered, &wb->state)) { + spin_unlock_bh(&wb->work_lock); +- /* +- * Wait for wb shutdown to finish if someone else is just +- * running wb_shutdown(). Otherwise we could proceed to wb / +- * bdi destruction before wb_shutdown() is finished. +- */ +- wait_on_bit(&wb->state, WB_shutting_down, TASK_UNINTERRUPTIBLE); + return; + } +- set_bit(WB_shutting_down, &wb->state); + spin_unlock_bh(&wb->work_lock); + + cgwb_remove_from_bdi_list(wb); +@@ -376,12 +369,6 @@ static void wb_shutdown(struct bdi_writeback *wb) + mod_delayed_work(bdi_wq, &wb->dwork, 0); + flush_delayed_work(&wb->dwork); + WARN_ON(!list_empty(&wb->work_list)); +- /* +- * Make sure bit gets cleared after shutdown is finished. Matches with +- * the barrier provided by test_and_clear_bit() above. +- */ +- smp_wmb(); +- clear_and_wake_up_bit(WB_shutting_down, &wb->state); + } + + static void wb_exit(struct bdi_writeback *wb) +@@ -505,10 +492,12 @@ static void cgwb_release_workfn(struct work_struct *work) + struct bdi_writeback *wb = container_of(work, struct bdi_writeback, + release_work); + ++ mutex_lock(&wb->bdi->cgwb_release_mutex); + wb_shutdown(wb); + + css_put(wb->memcg_css); + css_put(wb->blkcg_css); ++ mutex_unlock(&wb->bdi->cgwb_release_mutex); + + fprop_local_destroy_percpu(&wb->memcg_completions); + percpu_ref_exit(&wb->refcnt); +@@ -694,6 +683,7 @@ static int cgwb_bdi_init(struct backing_dev_info *bdi) + + INIT_RADIX_TREE(&bdi->cgwb_tree, GFP_ATOMIC); + bdi->cgwb_congested_tree = RB_ROOT; ++ mutex_init(&bdi->cgwb_release_mutex); + + ret = wb_init(&bdi->wb, bdi, 1, GFP_KERNEL); + if (!ret) { +@@ -714,7 +704,10 @@ static void cgwb_bdi_unregister(struct backing_dev_info *bdi) + spin_lock_irq(&cgwb_lock); + radix_tree_for_each_slot(slot, &bdi->cgwb_tree, &iter, 0) + cgwb_kill(*slot); ++ spin_unlock_irq(&cgwb_lock); + ++ mutex_lock(&bdi->cgwb_release_mutex); ++ spin_lock_irq(&cgwb_lock); + while (!list_empty(&bdi->wb_list)) { + wb = list_first_entry(&bdi->wb_list, struct bdi_writeback, + bdi_node); +@@ -723,6 +716,7 @@ static void cgwb_bdi_unregister(struct backing_dev_info *bdi) + spin_lock_irq(&cgwb_lock); + } + spin_unlock_irq(&cgwb_lock); ++ mutex_unlock(&bdi->cgwb_release_mutex); + } + + /** +diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c +index cf2e70003a53..cf82d970b0e4 100644 +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -664,7 +664,7 @@ static struct sk_buff **vlan_gro_receive(struct sk_buff **head, + out_unlock: + rcu_read_unlock(); + out: +- NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_flush_final(skb, pp, flush); + + return pp; + } +diff --git a/net/atm/br2684.c b/net/atm/br2684.c +index 4e111196f902..bc21f8e8daf2 100644 +--- a/net/atm/br2684.c ++++ b/net/atm/br2684.c +@@ -252,8 +252,7 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct net_device *dev, + + ATM_SKB(skb)->vcc = atmvcc = brvcc->atmvcc; + pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, atmvcc, atmvcc->dev); +- refcount_add(skb->truesize, &sk_atm(atmvcc)->sk_wmem_alloc); +- ATM_SKB(skb)->atm_options = atmvcc->atm_options; ++ atm_account_tx(atmvcc, skb); + dev->stats.tx_packets++; + dev->stats.tx_bytes += skb->len; + +diff --git a/net/atm/clip.c b/net/atm/clip.c +index 65f706e4344c..60920a42f640 100644 +--- a/net/atm/clip.c ++++ b/net/atm/clip.c +@@ -381,8 +381,7 @@ static netdev_tx_t clip_start_xmit(struct sk_buff *skb, + memcpy(here, llc_oui, sizeof(llc_oui)); + ((__be16 *) here)[3] = skb->protocol; + } +- refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc); +- ATM_SKB(skb)->atm_options = vcc->atm_options; ++ atm_account_tx(vcc, skb); + entry->vccs->last_use = jiffies; + pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", skb, vcc, vcc->dev); + old = xchg(&entry->vccs->xoff, 1); /* assume XOFF ... */ +diff --git a/net/atm/common.c b/net/atm/common.c +index 8a4f99114cd2..9e812c782a37 100644 +--- a/net/atm/common.c ++++ b/net/atm/common.c +@@ -630,10 +630,9 @@ int vcc_sendmsg(struct socket *sock, struct msghdr *m, size_t size) + goto out; + } + pr_debug("%d += %d\n", sk_wmem_alloc_get(sk), skb->truesize); +- refcount_add(skb->truesize, &sk->sk_wmem_alloc); ++ atm_account_tx(vcc, skb); + + skb->dev = NULL; /* for paths shared with net_device interfaces */ +- ATM_SKB(skb)->atm_options = vcc->atm_options; + if (!copy_from_iter_full(skb_put(skb, size), size, &m->msg_iter)) { + kfree_skb(skb); + error = -EFAULT; +diff --git a/net/atm/lec.c b/net/atm/lec.c +index 5741b6474dd9..9f2365694ad4 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -182,9 +182,8 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + struct net_device *dev = skb->dev; + + ATM_SKB(skb)->vcc = vcc; +- ATM_SKB(skb)->atm_options = vcc->atm_options; ++ atm_account_tx(vcc, skb); + +- refcount_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc); + if (vcc->send(vcc, skb) < 0) { + dev->stats.tx_dropped++; + return; +diff --git a/net/atm/mpc.c b/net/atm/mpc.c +index 5677147209e8..db9a1838687c 100644 +--- a/net/atm/mpc.c ++++ b/net/atm/mpc.c +@@ -555,8 +555,7 @@ static int send_via_shortcut(struct sk_buff *skb, struct mpoa_client *mpc) + sizeof(struct llc_snap_hdr)); + } + +- refcount_add(skb->truesize, &sk_atm(entry->shortcut)->sk_wmem_alloc); +- ATM_SKB(skb)->atm_options = entry->shortcut->atm_options; ++ atm_account_tx(entry->shortcut, skb); + entry->shortcut->send(entry->shortcut, skb); + entry->packets_fwded++; + mpc->in_ops->put(entry); +diff --git a/net/atm/pppoatm.c b/net/atm/pppoatm.c +index 21d9d341a619..af8c4b38b746 100644 +--- a/net/atm/pppoatm.c ++++ b/net/atm/pppoatm.c +@@ -350,8 +350,7 @@ static int pppoatm_send(struct ppp_channel *chan, struct sk_buff *skb) + return 1; + } + +- refcount_add(skb->truesize, &sk_atm(ATM_SKB(skb)->vcc)->sk_wmem_alloc); +- ATM_SKB(skb)->atm_options = ATM_SKB(skb)->vcc->atm_options; ++ atm_account_tx(vcc, skb); + pr_debug("atm_skb(%p)->vcc(%p)->dev(%p)\n", + skb, ATM_SKB(skb)->vcc, ATM_SKB(skb)->vcc->dev); + ret = ATM_SKB(skb)->vcc->send(ATM_SKB(skb)->vcc, skb) +diff --git a/net/atm/raw.c b/net/atm/raw.c +index ee10e8d46185..b3ba44aab0ee 100644 +--- a/net/atm/raw.c ++++ b/net/atm/raw.c +@@ -35,8 +35,8 @@ static void atm_pop_raw(struct atm_vcc *vcc, struct sk_buff *skb) + struct sock *sk = sk_atm(vcc); + + pr_debug("(%d) %d -= %d\n", +- vcc->vci, sk_wmem_alloc_get(sk), skb->truesize); +- WARN_ON(refcount_sub_and_test(skb->truesize, &sk->sk_wmem_alloc)); ++ vcc->vci, sk_wmem_alloc_get(sk), ATM_SKB(skb)->acct_truesize); ++ WARN_ON(refcount_sub_and_test(ATM_SKB(skb)->acct_truesize, &sk->sk_wmem_alloc)); + dev_kfree_skb_any(skb); + sk->sk_write_space(sk); + } +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c +index 25738b20676d..54c7fe68040f 100644 +--- a/net/bridge/netfilter/ebtables.c ++++ b/net/bridge/netfilter/ebtables.c +@@ -398,6 +398,12 @@ ebt_check_watcher(struct ebt_entry_watcher *w, struct xt_tgchk_param *par, + watcher = xt_request_find_target(NFPROTO_BRIDGE, w->u.name, 0); + if (IS_ERR(watcher)) + return PTR_ERR(watcher); ++ ++ if (watcher->family != NFPROTO_BRIDGE) { ++ module_put(watcher->me); ++ return -ENOENT; ++ } ++ + w->u.watcher = watcher; + + par->target = watcher; +@@ -719,6 +725,13 @@ ebt_check_entry(struct ebt_entry *e, struct net *net, + goto cleanup_watchers; + } + ++ /* Reject UNSPEC, xtables verdicts/return values are incompatible */ ++ if (target->family != NFPROTO_BRIDGE) { ++ module_put(target->me); ++ ret = -ENOENT; ++ goto cleanup_watchers; ++ } ++ + t->u.target = target; + if (t->u.target == &ebt_standard_target) { + if (gap < sizeof(struct ebt_standard_target)) { +diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c +index 119c04317d48..03fcf3ee1534 100644 +--- a/net/dccp/ccids/ccid3.c ++++ b/net/dccp/ccids/ccid3.c +@@ -599,7 +599,7 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk, + { + struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk); + struct dccp_sock *dp = dccp_sk(sk); +- ktime_t now = ktime_get_real(); ++ ktime_t now = ktime_get(); + s64 delta = 0; + + switch (fbtype) { +@@ -624,15 +624,14 @@ static void ccid3_hc_rx_send_feedback(struct sock *sk, + case CCID3_FBACK_PERIODIC: + delta = ktime_us_delta(now, hc->rx_tstamp_last_feedback); + if (delta <= 0) +- DCCP_BUG("delta (%ld) <= 0", (long)delta); +- else +- hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta); ++ delta = 1; ++ hc->rx_x_recv = scaled_div32(hc->rx_bytes_recv, delta); + break; + default: + return; + } + +- ccid3_pr_debug("Interval %ldusec, X_recv=%u, 1/p=%u\n", (long)delta, ++ ccid3_pr_debug("Interval %lldusec, X_recv=%u, 1/p=%u\n", delta, + hc->rx_x_recv, hc->rx_pinv); + + hc->rx_tstamp_last_feedback = now; +@@ -679,7 +678,8 @@ static int ccid3_hc_rx_insert_options(struct sock *sk, struct sk_buff *skb) + static u32 ccid3_first_li(struct sock *sk) + { + struct ccid3_hc_rx_sock *hc = ccid3_hc_rx_sk(sk); +- u32 x_recv, p, delta; ++ u32 x_recv, p; ++ s64 delta; + u64 fval; + + if (hc->rx_rtt == 0) { +@@ -687,7 +687,9 @@ static u32 ccid3_first_li(struct sock *sk) + hc->rx_rtt = DCCP_FALLBACK_RTT; + } + +- delta = ktime_to_us(net_timedelta(hc->rx_tstamp_last_feedback)); ++ delta = ktime_us_delta(ktime_get(), hc->rx_tstamp_last_feedback); ++ if (delta <= 0) ++ delta = 1; + x_recv = scaled_div32(hc->rx_bytes_recv, delta); + if (x_recv == 0) { /* would also trigger divide-by-zero */ + DCCP_WARN("X_recv==0\n"); +diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c +index f0252768ecf4..5f5d9eafccf5 100644 +--- a/net/dns_resolver/dns_key.c ++++ b/net/dns_resolver/dns_key.c +@@ -87,35 +87,39 @@ dns_resolver_preparse(struct key_preparsed_payload *prep) + opt++; + kdebug("options: '%s'", opt); + do { ++ int opt_len, opt_nlen; + const char *eq; +- int opt_len, opt_nlen, opt_vlen, tmp; ++ char optval[128]; + + next_opt = memchr(opt, '#', end - opt) ?: end; + opt_len = next_opt - opt; +- if (opt_len <= 0 || opt_len > 128) { ++ if (opt_len <= 0 || opt_len > sizeof(optval)) { + pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n", + opt_len); + return -EINVAL; + } + +- eq = memchr(opt, '=', opt_len) ?: end; +- opt_nlen = eq - opt; +- eq++; +- opt_vlen = next_opt - eq; /* will be -1 if no value */ ++ eq = memchr(opt, '=', opt_len); ++ if (eq) { ++ opt_nlen = eq - opt; ++ eq++; ++ memcpy(optval, eq, next_opt - eq); ++ optval[next_opt - eq] = '\0'; ++ } else { ++ opt_nlen = opt_len; ++ optval[0] = '\0'; ++ } + +- tmp = opt_vlen >= 0 ? opt_vlen : 0; +- kdebug("option '%*.*s' val '%*.*s'", +- opt_nlen, opt_nlen, opt, tmp, tmp, eq); ++ kdebug("option '%*.*s' val '%s'", ++ opt_nlen, opt_nlen, opt, optval); + + /* see if it's an error number representing a DNS error + * that's to be recorded as the result in this key */ + if (opt_nlen == sizeof(DNS_ERRORNO_OPTION) - 1 && + memcmp(opt, DNS_ERRORNO_OPTION, opt_nlen) == 0) { + kdebug("dns error number option"); +- if (opt_vlen <= 0) +- goto bad_option_value; + +- ret = kstrtoul(eq, 10, &derrno); ++ ret = kstrtoul(optval, 10, &derrno); + if (ret < 0) + goto bad_option_value; + +diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c +index 1540db65241a..c9ec1603666b 100644 +--- a/net/ipv4/fou.c ++++ b/net/ipv4/fou.c +@@ -448,9 +448,7 @@ static struct sk_buff **gue_gro_receive(struct sock *sk, + out_unlock: + rcu_read_unlock(); + out: +- NAPI_GRO_CB(skb)->flush |= flush; +- skb_gro_remcsum_cleanup(skb, &grc); +- skb->remcsum_offload = 0; ++ skb_gro_flush_final_remcsum(skb, pp, flush, &grc); + + return pp; + } +diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c +index 1859c473b21a..6a7d980105f6 100644 +--- a/net/ipv4/gre_offload.c ++++ b/net/ipv4/gre_offload.c +@@ -223,7 +223,7 @@ static struct sk_buff **gre_gro_receive(struct sk_buff **head, + out_unlock: + rcu_read_unlock(); + out: +- NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_flush_final(skb, pp, flush); + + return pp; + } +diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c +index e7d15fb0d94d..24b066c32e06 100644 +--- a/net/ipv4/inet_hashtables.c ++++ b/net/ipv4/inet_hashtables.c +@@ -188,9 +188,9 @@ static inline int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score += 4; + } + if (sk->sk_incoming_cpu == raw_smp_processor_id()) +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 0989e739d098..5a29dc5083a3 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -258,8 +258,9 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, + { + struct ctl_table tbl = { .maxlen = (TCP_FASTOPEN_KEY_LENGTH * 2 + 10) }; + struct tcp_fastopen_context *ctxt; +- int ret; + u32 user_key[4]; /* 16 bytes, matching TCP_FASTOPEN_KEY_LENGTH */ ++ __le32 key[4]; ++ int ret, i; + + tbl.data = kmalloc(tbl.maxlen, GFP_KERNEL); + if (!tbl.data) +@@ -268,11 +269,14 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, + rcu_read_lock(); + ctxt = rcu_dereference(tcp_fastopen_ctx); + if (ctxt) +- memcpy(user_key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); ++ memcpy(key, ctxt->key, TCP_FASTOPEN_KEY_LENGTH); + else +- memset(user_key, 0, sizeof(user_key)); ++ memset(key, 0, sizeof(key)); + rcu_read_unlock(); + ++ for (i = 0; i < ARRAY_SIZE(key); i++) ++ user_key[i] = le32_to_cpu(key[i]); ++ + snprintf(tbl.data, tbl.maxlen, "%08x-%08x-%08x-%08x", + user_key[0], user_key[1], user_key[2], user_key[3]); + ret = proc_dostring(&tbl, write, buffer, lenp, ppos); +@@ -288,12 +292,16 @@ static int proc_tcp_fastopen_key(struct ctl_table *ctl, int write, + * first invocation of tcp_fastopen_cookie_gen + */ + tcp_fastopen_init_key_once(false); +- tcp_fastopen_reset_cipher(user_key, TCP_FASTOPEN_KEY_LENGTH); ++ ++ for (i = 0; i < ARRAY_SIZE(user_key); i++) ++ key[i] = cpu_to_le32(user_key[i]); ++ ++ tcp_fastopen_reset_cipher(key, TCP_FASTOPEN_KEY_LENGTH); + } + + bad_key: + pr_debug("proc FO key set 0x%x-%x-%x-%x <- 0x%s: %u\n", +- user_key[0], user_key[1], user_key[2], user_key[3], ++ user_key[0], user_key[1], user_key[2], user_key[3], + (char *)tbl.data, ret); + kfree(tbl.data); + return ret; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index f0caff3139ed..5711b1b12d28 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -3194,6 +3194,15 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets, + + if (tcp_is_reno(tp)) { + tcp_remove_reno_sacks(sk, pkts_acked); ++ ++ /* If any of the cumulatively ACKed segments was ++ * retransmitted, non-SACK case cannot confirm that ++ * progress was due to original transmission due to ++ * lack of TCPCB_SACKED_ACKED bits even if some of ++ * the packets may have been never retransmitted. ++ */ ++ if (flag & FLAG_RETRANS_DATA_ACKED) ++ flag &= ~FLAG_ORIG_SACK_ACKED; + } else { + int delta; + +diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c +index ea6e6e7df0ee..cde2719fcb89 100644 +--- a/net/ipv4/udp_offload.c ++++ b/net/ipv4/udp_offload.c +@@ -295,7 +295,7 @@ struct sk_buff **udp_gro_receive(struct sk_buff **head, struct sk_buff *skb, + out_unlock: + rcu_read_unlock(); + out: +- NAPI_GRO_CB(skb)->flush |= flush; ++ skb_gro_flush_final(skb, pp, flush); + return pp; + } + EXPORT_SYMBOL(udp_gro_receive); +diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c +index b01858f5deb1..6dc93ac28261 100644 +--- a/net/ipv6/inet6_hashtables.c ++++ b/net/ipv6/inet6_hashtables.c +@@ -113,9 +113,9 @@ static inline int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score++; + } + if (sk->sk_incoming_cpu == raw_smp_processor_id()) +diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c +index 64ec23388450..722a9db8c6a7 100644 +--- a/net/ipv6/netfilter/nf_conntrack_reasm.c ++++ b/net/ipv6/netfilter/nf_conntrack_reasm.c +@@ -618,6 +618,8 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) + fq->q.meat == fq->q.len && + nf_ct_frag6_reasm(fq, skb, dev)) + ret = 0; ++ else ++ skb_dst_drop(skb); + + out_unlock: + spin_unlock_bh(&fq->q.lock); +diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c +index 33fb35cbfac1..558fe8cc6d43 100644 +--- a/net/ipv6/seg6_hmac.c ++++ b/net/ipv6/seg6_hmac.c +@@ -373,7 +373,7 @@ static int seg6_hmac_init_algo(void) + return -ENOMEM; + + for_each_possible_cpu(cpu) { +- tfm = crypto_alloc_shash(algo->name, 0, GFP_KERNEL); ++ tfm = crypto_alloc_shash(algo->name, 0, 0); + if (IS_ERR(tfm)) + return PTR_ERR(tfm); + p_tfm = per_cpu_ptr(algo->tfms, cpu); +diff --git a/net/nfc/llcp_commands.c b/net/nfc/llcp_commands.c +index 2ceefa183cee..6a196e438b6c 100644 +--- a/net/nfc/llcp_commands.c ++++ b/net/nfc/llcp_commands.c +@@ -752,11 +752,14 @@ int nfc_llcp_send_ui_frame(struct nfc_llcp_sock *sock, u8 ssap, u8 dsap, + pr_debug("Fragment %zd bytes remaining %zd", + frag_len, remaining_len); + +- pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, MSG_DONTWAIT, ++ pdu = nfc_alloc_send_skb(sock->dev, &sock->sk, 0, + frag_len + LLCP_HEADER_SIZE, &err); + if (pdu == NULL) { +- pr_err("Could not allocate PDU\n"); +- continue; ++ pr_err("Could not allocate PDU (error=%d)\n", err); ++ len -= remaining_len; ++ if (len == 0) ++ len = err; ++ break; + } + + pdu = llcp_add_header(pdu, dsap, ssap, LLCP_PDU_UI); +diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c +index 6df6f58a8103..5647905c88d6 100644 +--- a/net/nsh/nsh.c ++++ b/net/nsh/nsh.c +@@ -42,7 +42,7 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, + __skb_pull(skb, nsh_len); + + skb_reset_mac_header(skb); +- skb_reset_mac_len(skb); ++ skb->mac_len = proto == htons(ETH_P_TEB) ? ETH_HLEN : 0; + skb->protocol = proto; + + features &= NETIF_F_SG; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 4fe2e34522d6..27dafe36f29c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2303,6 +2303,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + if (po->stats.stats1.tp_drops) + status |= TP_STATUS_LOSING; + } ++ ++ if (do_vnet && ++ virtio_net_hdr_from_skb(skb, h.raw + macoff - ++ sizeof(struct virtio_net_hdr), ++ vio_le(), true, 0)) ++ goto drop_n_account; ++ + po->stats.stats1.tp_packets++; + if (copy_skb) { + status |= TP_STATUS_COPY; +@@ -2310,15 +2317,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + } + spin_unlock(&sk->sk_receive_queue.lock); + +- if (do_vnet) { +- if (virtio_net_hdr_from_skb(skb, h.raw + macoff - +- sizeof(struct virtio_net_hdr), +- vio_le(), true, 0)) { +- spin_lock(&sk->sk_receive_queue.lock); +- goto drop_n_account; +- } +- } +- + skb_copy_bits(skb, 0, h.raw + macoff, snaplen); + + if (!(ts_status = tpacket_get_timestamp(skb, &ts, po->tp_tstamp))) +diff --git a/net/rds/loop.c b/net/rds/loop.c +index f2bf78de5688..dac6218a460e 100644 +--- a/net/rds/loop.c ++++ b/net/rds/loop.c +@@ -193,4 +193,5 @@ struct rds_transport rds_loop_transport = { + .inc_copy_to_user = rds_message_inc_copy_to_user, + .inc_free = rds_loop_inc_free, + .t_name = "loopback", ++ .t_type = RDS_TRANS_LOOP, + }; +diff --git a/net/rds/rds.h b/net/rds/rds.h +index d09f6c1facb4..f685d8b514e5 100644 +--- a/net/rds/rds.h ++++ b/net/rds/rds.h +@@ -454,6 +454,11 @@ struct rds_notifier { + int n_status; + }; + ++/* Available as part of RDS core, so doesn't need to participate ++ * in get_preferred transport etc ++ */ ++#define RDS_TRANS_LOOP 3 ++ + /** + * struct rds_transport - transport specific behavioural hooks + * +diff --git a/net/rds/recv.c b/net/rds/recv.c +index 555f07ccf0dc..c27cceae52e1 100644 +--- a/net/rds/recv.c ++++ b/net/rds/recv.c +@@ -103,6 +103,11 @@ static void rds_recv_rcvbuf_delta(struct rds_sock *rs, struct sock *sk, + rds_stats_add(s_recv_bytes_added_to_socket, delta); + else + rds_stats_add(s_recv_bytes_removed_from_socket, -delta); ++ ++ /* loop transport doesn't send/recv congestion updates */ ++ if (rs->rs_transport->t_type == RDS_TRANS_LOOP) ++ return; ++ + now_congested = rs->rs_rcv_bytes > rds_sk_rcvbuf(rs); + + rdsdebug("rs %p (%pI4:%u) recv bytes %d buf %d " +diff --git a/net/sched/sch_blackhole.c b/net/sched/sch_blackhole.c +index c98a61e980ba..9c4c2bb547d7 100644 +--- a/net/sched/sch_blackhole.c ++++ b/net/sched/sch_blackhole.c +@@ -21,7 +21,7 @@ static int blackhole_enqueue(struct sk_buff *skb, struct Qdisc *sch, + struct sk_buff **to_free) + { + qdisc_drop(skb, sch, to_free); +- return NET_XMIT_SUCCESS; ++ return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS; + } + + static struct sk_buff *blackhole_dequeue(struct Qdisc *sch) +diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c +index c741365f77da..a68c754e84ea 100644 +--- a/net/strparser/strparser.c ++++ b/net/strparser/strparser.c +@@ -35,7 +35,6 @@ struct _strp_msg { + */ + struct strp_msg strp; + int accum_len; +- int early_eaten; + }; + + static inline struct _strp_msg *_strp_msg(struct sk_buff *skb) +@@ -115,20 +114,6 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb, + head = strp->skb_head; + if (head) { + /* Message already in progress */ +- +- stm = _strp_msg(head); +- if (unlikely(stm->early_eaten)) { +- /* Already some number of bytes on the receive sock +- * data saved in skb_head, just indicate they +- * are consumed. +- */ +- eaten = orig_len <= stm->early_eaten ? +- orig_len : stm->early_eaten; +- stm->early_eaten -= eaten; +- +- return eaten; +- } +- + if (unlikely(orig_offset)) { + /* Getting data with a non-zero offset when a message is + * in progress is not expected. If it does happen, we +@@ -297,9 +282,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb, + } + + stm->accum_len += cand_len; ++ eaten += cand_len; + strp->need_bytes = stm->strp.full_len - + stm->accum_len; +- stm->early_eaten = cand_len; + STRP_STATS_ADD(strp->stats.bytes, cand_len); + desc->count = 0; /* Stop reading socket */ + break; +diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c +index 97b9d4f671ac..2aaf46599126 100644 +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -270,7 +270,6 @@ rpcrdma_conn_upcall(struct rdma_cm_id *id, struct rdma_cm_event *event) + wait_for_completion(&ia->ri_remove_done); + + ia->ri_id = NULL; +- ia->ri_pd = NULL; + ia->ri_device = NULL; + /* Return 1 to ensure the core destroys the id. */ + return 1; +@@ -464,7 +463,9 @@ rpcrdma_ia_remove(struct rpcrdma_ia *ia) + ia->ri_id->qp = NULL; + } + ib_free_cq(ep->rep_attr.recv_cq); ++ ep->rep_attr.recv_cq = NULL; + ib_free_cq(ep->rep_attr.send_cq); ++ ep->rep_attr.send_cq = NULL; + + /* The ULP is responsible for ensuring all DMA + * mappings and MRs are gone. +@@ -477,6 +478,8 @@ rpcrdma_ia_remove(struct rpcrdma_ia *ia) + rpcrdma_dma_unmap_regbuf(req->rl_recvbuf); + } + rpcrdma_destroy_mrs(buf); ++ ib_dealloc_pd(ia->ri_pd); ++ ia->ri_pd = NULL; + + /* Allow waiters to continue */ + complete(&ia->ri_remove_done); +@@ -650,14 +653,16 @@ rpcrdma_ep_destroy(struct rpcrdma_ep *ep, struct rpcrdma_ia *ia) + + cancel_delayed_work_sync(&ep->rep_connect_worker); + +- if (ia->ri_id->qp) { ++ if (ia->ri_id && ia->ri_id->qp) { + rpcrdma_ep_disconnect(ep, ia); + rdma_destroy_qp(ia->ri_id); + ia->ri_id->qp = NULL; + } + +- ib_free_cq(ep->rep_attr.recv_cq); +- ib_free_cq(ep->rep_attr.send_cq); ++ if (ep->rep_attr.recv_cq) ++ ib_free_cq(ep->rep_attr.recv_cq); ++ if (ep->rep_attr.send_cq) ++ ib_free_cq(ep->rep_attr.send_cq); + } + + /* Re-establish a connection after a device removal event. +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 3c86614462f6..8ee4e667a414 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -449,7 +449,7 @@ int tls_sw_sendmsg(struct sock *sk, struct msghdr *msg, size_t size) + ret = tls_push_record(sk, msg->msg_flags, record_type); + if (!ret) + continue; +- if (ret == -EAGAIN) ++ if (ret < 0) + goto send_end; + + copied -= try_to_copy; +diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c +index 403d86e80162..fdb294441682 100644 +--- a/net/vmw_vsock/virtio_transport.c ++++ b/net/vmw_vsock/virtio_transport.c +@@ -201,7 +201,7 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt) + return -ENODEV; + } + +- if (le32_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid) ++ if (le64_to_cpu(pkt->hdr.dst_cid) == vsock->guest_cid) + return virtio_transport_send_pkt_loopback(vsock, pkt); + + if (pkt->reply) +diff --git a/virt/kvm/arm/arm.c b/virt/kvm/arm/arm.c +index 9bee849db682..d5f1d8364571 100644 +--- a/virt/kvm/arm/arm.c ++++ b/virt/kvm/arm/arm.c +@@ -51,8 +51,8 @@ + __asm__(".arch_extension virt"); + #endif + ++DEFINE_PER_CPU(kvm_cpu_context_t, kvm_host_cpu_state); + static DEFINE_PER_CPU(unsigned long, kvm_arm_hyp_stack_page); +-static kvm_cpu_context_t __percpu *kvm_host_cpu_state; + + /* Per-CPU variable containing the currently running vcpu. */ + static DEFINE_PER_CPU(struct kvm_vcpu *, kvm_arm_running_vcpu); +@@ -351,7 +351,7 @@ void kvm_arch_vcpu_load(struct kvm_vcpu *vcpu, int cpu) + } + + vcpu->cpu = cpu; +- vcpu->arch.host_cpu_context = this_cpu_ptr(kvm_host_cpu_state); ++ vcpu->arch.host_cpu_context = this_cpu_ptr(&kvm_host_cpu_state); + + kvm_arm_set_running_vcpu(vcpu); + +@@ -1259,19 +1259,8 @@ static inline void hyp_cpu_pm_exit(void) + } + #endif + +-static void teardown_common_resources(void) +-{ +- free_percpu(kvm_host_cpu_state); +-} +- + static int init_common_resources(void) + { +- kvm_host_cpu_state = alloc_percpu(kvm_cpu_context_t); +- if (!kvm_host_cpu_state) { +- kvm_err("Cannot allocate host CPU state\n"); +- return -ENOMEM; +- } +- + /* set size of VMID supported by CPU */ + kvm_vmid_bits = kvm_get_vmid_bits(); + kvm_info("%d-bit VMID\n", kvm_vmid_bits); +@@ -1413,7 +1402,7 @@ static int init_hyp_mode(void) + for_each_possible_cpu(cpu) { + kvm_cpu_context_t *cpu_ctxt; + +- cpu_ctxt = per_cpu_ptr(kvm_host_cpu_state, cpu); ++ cpu_ctxt = per_cpu_ptr(&kvm_host_cpu_state, cpu); + err = create_hyp_mappings(cpu_ctxt, cpu_ctxt + 1, PAGE_HYP); + + if (err) { +@@ -1422,6 +1411,10 @@ static int init_hyp_mode(void) + } + } + ++ err = hyp_map_aux_data(); ++ if (err) ++ kvm_err("Cannot map host auxilary data: %d\n", err); ++ + return 0; + + out_err: +@@ -1497,7 +1490,6 @@ int kvm_arch_init(void *opaque) + if (!in_hyp_mode) + teardown_hyp_mode(); + out_err: +- teardown_common_resources(); + return err; + } + +diff --git a/virt/kvm/arm/hyp/vgic-v2-sr.c b/virt/kvm/arm/hyp/vgic-v2-sr.c +index d7fd46fe9efb..4b4221b0d4ba 100644 +--- a/virt/kvm/arm/hyp/vgic-v2-sr.c ++++ b/virt/kvm/arm/hyp/vgic-v2-sr.c +@@ -139,7 +139,7 @@ int __hyp_text __vgic_v2_perform_cpuif_access(struct kvm_vcpu *vcpu) + return -1; + + rd = kvm_vcpu_dabt_get_rd(vcpu); +- addr = kern_hyp_va((kern_hyp_va(&kvm_vgic_global_state))->vcpu_base_va); ++ addr = kern_hyp_va(hyp_symbol_addr(kvm_vgic_global_state)->vcpu_base_va); + addr += fault_ipa - vgic->vgic_cpu_base; + + if (kvm_vcpu_dabt_iswrite(vcpu)) { +diff --git a/virt/kvm/arm/psci.c b/virt/kvm/arm/psci.c +index c4762bef13c6..c95ab4c5a475 100644 +--- a/virt/kvm/arm/psci.c ++++ b/virt/kvm/arm/psci.c +@@ -405,7 +405,7 @@ static int kvm_psci_call(struct kvm_vcpu *vcpu) + int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) + { + u32 func_id = smccc_get_function(vcpu); +- u32 val = PSCI_RET_NOT_SUPPORTED; ++ u32 val = SMCCC_RET_NOT_SUPPORTED; + u32 feature; + + switch (func_id) { +@@ -417,7 +417,21 @@ int kvm_hvc_call_handler(struct kvm_vcpu *vcpu) + switch(feature) { + case ARM_SMCCC_ARCH_WORKAROUND_1: + if (kvm_arm_harden_branch_predictor()) +- val = 0; ++ val = SMCCC_RET_SUCCESS; ++ break; ++ case ARM_SMCCC_ARCH_WORKAROUND_2: ++ switch (kvm_arm_have_ssbd()) { ++ case KVM_SSBD_FORCE_DISABLE: ++ case KVM_SSBD_UNKNOWN: ++ break; ++ case KVM_SSBD_KERNEL: ++ val = SMCCC_RET_SUCCESS; ++ break; ++ case KVM_SSBD_FORCE_ENABLE: ++ case KVM_SSBD_MITIGATED: ++ val = SMCCC_RET_NOT_REQUIRED; ++ break; ++ } + break; + } + break; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.57-58.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.57-58.patch new file mode 100644 index 000000000000..ba096a0dde60 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.57-58.patch @@ -0,0 +1,1431 @@ +diff --git a/Makefile b/Makefile +index a44d6b2adb76..ffc9b4e3867e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 57 ++SUBLEVEL = 58 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c +index 75a5c35a2067..a48976dc9bcd 100644 +--- a/arch/alpha/kernel/osf_sys.c ++++ b/arch/alpha/kernel/osf_sys.c +@@ -1183,13 +1183,10 @@ SYSCALL_DEFINE2(osf_getrusage, int, who, struct rusage32 __user *, ru) + SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options, + struct rusage32 __user *, ur) + { +- unsigned int status = 0; + struct rusage r; +- long err = kernel_wait4(pid, &status, options, &r); ++ long err = kernel_wait4(pid, ustatus, options, &r); + if (err <= 0) + return err; +- if (put_user(status, ustatus)) +- return -EFAULT; + if (!ur) + return err; + if (put_tv32(&ur->ru_utime, &r.ru_utime)) +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig +index 4383313b064a..5c8caf85c350 100644 +--- a/arch/arc/Kconfig ++++ b/arch/arc/Kconfig +@@ -408,7 +408,7 @@ config ARC_HAS_DIV_REM + + config ARC_HAS_ACCL_REGS + bool "Reg Pair ACCL:ACCH (FPU and/or MPY > 6)" +- default n ++ default y + help + Depending on the configuration, CPU can contain accumulator reg-pair + (also referred to as r58:r59). These can also be used by gcc as GPR so +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index ec7c849a5c8e..a8242362e551 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 63d3cf69e0b0..ef3c31cd7737 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index f613ecac14a7..1757ac9cecbc 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/configs/haps_hs_defconfig b/arch/arc/configs/haps_hs_defconfig +index db04ea4dd2d9..aa8240a92b60 100644 +--- a/arch/arc/configs/haps_hs_defconfig ++++ b/arch/arc/configs/haps_hs_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EXPERT=y + CONFIG_PERF_EVENTS=y + # CONFIG_COMPAT_BRK is not set +diff --git a/arch/arc/configs/haps_hs_smp_defconfig b/arch/arc/configs/haps_hs_smp_defconfig +index 3507be2af6fe..bc5a24ea6cf7 100644 +--- a/arch/arc/configs/haps_hs_smp_defconfig ++++ b/arch/arc/configs/haps_hs_smp_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/configs/hsdk_defconfig b/arch/arc/configs/hsdk_defconfig +index 7b8f8faf8a24..762b1fcd93dc 100644 +--- a/arch/arc/configs/hsdk_defconfig ++++ b/arch/arc/configs/hsdk_defconfig +@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set +diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig +index 6dff83a238b8..b1a78222699c 100644 +--- a/arch/arc/configs/nsim_700_defconfig ++++ b/arch/arc/configs/nsim_700_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" + CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y +diff --git a/arch/arc/configs/nsim_hs_defconfig b/arch/arc/configs/nsim_hs_defconfig +index 31ee51b987e7..217d7ea3c956 100644 +--- a/arch/arc/configs/nsim_hs_defconfig ++++ b/arch/arc/configs/nsim_hs_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../../arc_initramfs_hs/" + CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y +diff --git a/arch/arc/configs/nsim_hs_smp_defconfig b/arch/arc/configs/nsim_hs_smp_defconfig +index 8d3b1f67cae4..e733e4f1a320 100644 +--- a/arch/arc/configs/nsim_hs_smp_defconfig ++++ b/arch/arc/configs/nsim_hs_smp_defconfig +@@ -9,7 +9,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" + CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y +diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig +index 6168ce2ac2ef..14377b8234f7 100644 +--- a/arch/arc/configs/nsimosci_defconfig ++++ b/arch/arc/configs/nsimosci_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs/" + CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y +diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig +index a70bdeb2b3fd..7e61c923a3cd 100644 +--- a/arch/arc/configs/nsimosci_hs_defconfig ++++ b/arch/arc/configs/nsimosci_hs_defconfig +@@ -11,7 +11,6 @@ CONFIG_NAMESPACES=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" + CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + CONFIG_PERF_EVENTS=y +diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig +index ef96406c446e..299fbe8003b2 100644 +--- a/arch/arc/configs/nsimosci_hs_smp_defconfig ++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig +@@ -9,7 +9,6 @@ CONFIG_IKCONFIG_PROC=y + # CONFIG_UTS_NS is not set + # CONFIG_PID_NS is not set + CONFIG_BLK_DEV_INITRD=y +-CONFIG_INITRAMFS_SOURCE="../arc_initramfs_hs/" + CONFIG_PERF_EVENTS=y + # CONFIG_COMPAT_BRK is not set + CONFIG_KPROBES=y +diff --git a/arch/arc/include/asm/page.h b/arch/arc/include/asm/page.h +index 109baa06831c..09ddddf71cc5 100644 +--- a/arch/arc/include/asm/page.h ++++ b/arch/arc/include/asm/page.h +@@ -105,7 +105,7 @@ typedef pte_t * pgtable_t; + #define virt_addr_valid(kaddr) pfn_valid(virt_to_pfn(kaddr)) + + /* Default Permissions for stack/heaps pages (Non Executable) */ +-#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE) ++#define VM_DATA_DEFAULT_FLAGS (VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC) + + #define WANT_PAGE_VIRTUAL 1 + +diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h +index 08fe33830d4b..77676e18da69 100644 +--- a/arch/arc/include/asm/pgtable.h ++++ b/arch/arc/include/asm/pgtable.h +@@ -379,7 +379,7 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, + + /* Decode a PTE containing swap "identifier "into constituents */ + #define __swp_type(pte_lookalike) (((pte_lookalike).val) & 0x1f) +-#define __swp_offset(pte_lookalike) ((pte_lookalike).val << 13) ++#define __swp_offset(pte_lookalike) ((pte_lookalike).val >> 13) + + /* NOPs, to keep generic kernel happy */ + #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val(pte) }) +diff --git a/arch/arc/plat-hsdk/Kconfig b/arch/arc/plat-hsdk/Kconfig +index 19ab3cf98f0f..fcc9a9e27e9c 100644 +--- a/arch/arc/plat-hsdk/Kconfig ++++ b/arch/arc/plat-hsdk/Kconfig +@@ -7,5 +7,7 @@ + + menuconfig ARC_SOC_HSDK + bool "ARC HS Development Kit SOC" ++ depends on ISA_ARCV2 ++ select ARC_HAS_ACCL_REGS + select CLK_HSDK + select RESET_HSDK +diff --git a/arch/powerpc/kernel/idle_book3s.S b/arch/powerpc/kernel/idle_book3s.S +index e35cebd45c35..4efbde0984b2 100644 +--- a/arch/powerpc/kernel/idle_book3s.S ++++ b/arch/powerpc/kernel/idle_book3s.S +@@ -140,6 +140,8 @@ power9_restore_additional_sprs: + ld r4, STOP_MMCR2(r13) + mtspr SPRN_MMCR1, r3 + mtspr SPRN_MMCR2, r4 ++ ld r4, PACA_SPRG_VDSO(r13) ++ mtspr SPRN_SPRG3, r4 + blr + + /* +diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c +index 10b39d44981c..25386be0d757 100644 +--- a/arch/x86/events/intel/ds.c ++++ b/arch/x86/events/intel/ds.c +@@ -410,9 +410,11 @@ static int alloc_bts_buffer(int cpu) + ds->bts_buffer_base = (unsigned long) cea; + ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL); + ds->bts_index = ds->bts_buffer_base; +- max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE); +- ds->bts_absolute_maximum = ds->bts_buffer_base + max; +- ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16); ++ max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE; ++ ds->bts_absolute_maximum = ds->bts_buffer_base + ++ max * BTS_RECORD_SIZE; ++ ds->bts_interrupt_threshold = ds->bts_absolute_maximum - ++ (max / 16) * BTS_RECORD_SIZE; + return 0; + } + +diff --git a/arch/x86/include/asm/apm.h b/arch/x86/include/asm/apm.h +index c356098b6fb9..4d4015ddcf26 100644 +--- a/arch/x86/include/asm/apm.h ++++ b/arch/x86/include/asm/apm.h +@@ -7,8 +7,6 @@ + #ifndef _ASM_X86_MACH_DEFAULT_APM_H + #define _ASM_X86_MACH_DEFAULT_APM_H + +-#include +- + #ifdef APM_ZERO_SEGS + # define APM_DO_ZERO_SEGS \ + "pushl %%ds\n\t" \ +@@ -34,7 +32,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, + * N.B. We do NOT need a cld after the BIOS call + * because we always save and restore the flags. + */ +- firmware_restrict_branch_speculation_start(); + __asm__ __volatile__(APM_DO_ZERO_SEGS + "pushl %%edi\n\t" + "pushl %%ebp\n\t" +@@ -47,7 +44,6 @@ static inline void apm_bios_call_asm(u32 func, u32 ebx_in, u32 ecx_in, + "=S" (*esi) + : "a" (func), "b" (ebx_in), "c" (ecx_in) + : "memory", "cc"); +- firmware_restrict_branch_speculation_end(); + } + + static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, +@@ -60,7 +56,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, + * N.B. We do NOT need a cld after the BIOS call + * because we always save and restore the flags. + */ +- firmware_restrict_branch_speculation_start(); + __asm__ __volatile__(APM_DO_ZERO_SEGS + "pushl %%edi\n\t" + "pushl %%ebp\n\t" +@@ -73,7 +68,6 @@ static inline bool apm_bios_call_simple_asm(u32 func, u32 ebx_in, + "=S" (si) + : "a" (func), "b" (ebx_in), "c" (ecx_in) + : "memory", "cc"); +- firmware_restrict_branch_speculation_end(); + return error; + } + +diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c +index 2a7fd56e67b3..63d3e6a6b5ef 100644 +--- a/arch/x86/kernel/apm_32.c ++++ b/arch/x86/kernel/apm_32.c +@@ -240,6 +240,7 @@ + #include + #include + #include ++#include + + #if defined(CONFIG_APM_DISPLAY_BLANK) && defined(CONFIG_VT) + extern int (*console_blank_hook)(int); +@@ -614,11 +615,13 @@ static long __apm_bios_call(void *_call) + gdt[0x40 / 8] = bad_bios_desc; + + apm_irq_save(flags); ++ firmware_restrict_branch_speculation_start(); + APM_DO_SAVE_SEGS; + apm_bios_call_asm(call->func, call->ebx, call->ecx, + &call->eax, &call->ebx, &call->ecx, &call->edx, + &call->esi); + APM_DO_RESTORE_SEGS; ++ firmware_restrict_branch_speculation_end(); + apm_irq_restore(flags); + gdt[0x40 / 8] = save_desc_40; + put_cpu(); +@@ -690,10 +693,12 @@ static long __apm_bios_call_simple(void *_call) + gdt[0x40 / 8] = bad_bios_desc; + + apm_irq_save(flags); ++ firmware_restrict_branch_speculation_start(); + APM_DO_SAVE_SEGS; + error = apm_bios_call_simple_asm(call->func, call->ebx, call->ecx, + &call->eax); + APM_DO_RESTORE_SEGS; ++ firmware_restrict_branch_speculation_end(); + apm_irq_restore(flags); + gdt[0x40 / 8] = save_desc_40; + put_cpu(); +diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c +index 58f887f5e036..98e4e4dc4a3b 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce.c ++++ b/arch/x86/kernel/cpu/mcheck/mce.c +@@ -2150,9 +2150,6 @@ static ssize_t store_int_with_restart(struct device *s, + if (check_interval == old_check_interval) + return ret; + +- if (check_interval < 1) +- check_interval = 1; +- + mutex_lock(&mce_sysfs_mutex); + mce_restart(); + mutex_unlock(&mce_sysfs_mutex); +diff --git a/drivers/cpufreq/intel_pstate.c b/drivers/cpufreq/intel_pstate.c +index a905bbb45667..114dfe67015b 100644 +--- a/drivers/cpufreq/intel_pstate.c ++++ b/drivers/cpufreq/intel_pstate.c +@@ -2188,6 +2188,18 @@ static bool __init intel_pstate_no_acpi_pss(void) + return true; + } + ++static bool __init intel_pstate_no_acpi_pcch(void) ++{ ++ acpi_status status; ++ acpi_handle handle; ++ ++ status = acpi_get_handle(NULL, "\\_SB", &handle); ++ if (ACPI_FAILURE(status)) ++ return true; ++ ++ return !acpi_has_method(handle, "PCCH"); ++} ++ + static bool __init intel_pstate_has_acpi_ppc(void) + { + int i; +@@ -2247,7 +2259,10 @@ static bool __init intel_pstate_platform_pwr_mgmt_exists(void) + + switch (plat_info[idx].data) { + case PSS: +- return intel_pstate_no_acpi_pss(); ++ if (!intel_pstate_no_acpi_pss()) ++ return false; ++ ++ return intel_pstate_no_acpi_pcch(); + case PPC: + return intel_pstate_has_acpi_ppc() && !force_load; + } +diff --git a/drivers/cpufreq/pcc-cpufreq.c b/drivers/cpufreq/pcc-cpufreq.c +index 3f0ce2ae35ee..0c56c9759672 100644 +--- a/drivers/cpufreq/pcc-cpufreq.c ++++ b/drivers/cpufreq/pcc-cpufreq.c +@@ -580,6 +580,10 @@ static int __init pcc_cpufreq_init(void) + { + int ret; + ++ /* Skip initialization if another cpufreq driver is there. */ ++ if (cpufreq_get_current_driver()) ++ return 0; ++ + if (acpi_disabled) + return 0; + +diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c +index b63893eeca73..20a471ad0ad2 100644 +--- a/drivers/gpu/drm/i915/i915_irq.c ++++ b/drivers/gpu/drm/i915/i915_irq.c +@@ -1786,10 +1786,38 @@ static void valleyview_pipestat_irq_handler(struct drm_i915_private *dev_priv, + + static u32 i9xx_hpd_irq_ack(struct drm_i915_private *dev_priv) + { +- u32 hotplug_status = I915_READ(PORT_HOTPLUG_STAT); ++ u32 hotplug_status = 0, hotplug_status_mask; ++ int i; ++ ++ if (IS_G4X(dev_priv) || ++ IS_VALLEYVIEW(dev_priv) || IS_CHERRYVIEW(dev_priv)) ++ hotplug_status_mask = HOTPLUG_INT_STATUS_G4X | ++ DP_AUX_CHANNEL_MASK_INT_STATUS_G4X; ++ else ++ hotplug_status_mask = HOTPLUG_INT_STATUS_I915; + +- if (hotplug_status) ++ /* ++ * We absolutely have to clear all the pending interrupt ++ * bits in PORT_HOTPLUG_STAT. Otherwise the ISR port ++ * interrupt bit won't have an edge, and the i965/g4x ++ * edge triggered IIR will not notice that an interrupt ++ * is still pending. We can't use PORT_HOTPLUG_EN to ++ * guarantee the edge as the act of toggling the enable ++ * bits can itself generate a new hotplug interrupt :( ++ */ ++ for (i = 0; i < 10; i++) { ++ u32 tmp = I915_READ(PORT_HOTPLUG_STAT) & hotplug_status_mask; ++ ++ if (tmp == 0) ++ return hotplug_status; ++ ++ hotplug_status |= tmp; + I915_WRITE(PORT_HOTPLUG_STAT, hotplug_status); ++ } ++ ++ WARN_ONCE(1, ++ "PORT_HOTPLUG_STAT did not clear (0x%08x)\n", ++ I915_READ(PORT_HOTPLUG_STAT)); + + return hotplug_status; + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_backlight.c b/drivers/gpu/drm/nouveau/nouveau_backlight.c +index debbbf0fd4bd..408b955e5c39 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_backlight.c ++++ b/drivers/gpu/drm/nouveau/nouveau_backlight.c +@@ -267,6 +267,7 @@ nouveau_backlight_init(struct drm_device *dev) + struct nouveau_drm *drm = nouveau_drm(dev); + struct nvif_device *device = &drm->client.device; + struct drm_connector *connector; ++ struct drm_connector_list_iter conn_iter; + + INIT_LIST_HEAD(&drm->bl_connectors); + +@@ -275,7 +276,8 @@ nouveau_backlight_init(struct drm_device *dev) + return 0; + } + +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ drm_for_each_connector_iter(connector, &conn_iter) { + if (connector->connector_type != DRM_MODE_CONNECTOR_LVDS && + connector->connector_type != DRM_MODE_CONNECTOR_eDP) + continue; +@@ -292,7 +294,7 @@ nouveau_backlight_init(struct drm_device *dev) + break; + } + } +- ++ drm_connector_list_iter_end(&conn_iter); + + return 0; + } +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index c902a851eb51..430830d63a33 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -1208,14 +1208,19 @@ nouveau_connector_create(struct drm_device *dev, int index) + struct nouveau_display *disp = nouveau_display(dev); + struct nouveau_connector *nv_connector = NULL; + struct drm_connector *connector; ++ struct drm_connector_list_iter conn_iter; + int type, ret = 0; + bool dummy; + +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { + nv_connector = nouveau_connector(connector); +- if (nv_connector->index == index) ++ if (nv_connector->index == index) { ++ drm_connector_list_iter_end(&conn_iter); + return connector; ++ } + } ++ drm_connector_list_iter_end(&conn_iter); + + nv_connector = kzalloc(sizeof(*nv_connector), GFP_KERNEL); + if (!nv_connector) +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.h b/drivers/gpu/drm/nouveau/nouveau_connector.h +index a4d1a059bd3d..dc7454e7f19a 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.h ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.h +@@ -33,6 +33,7 @@ + #include + #include + #include "nouveau_crtc.h" ++#include "nouveau_encoder.h" + + struct nvkm_i2c_port; + +@@ -60,19 +61,46 @@ static inline struct nouveau_connector *nouveau_connector( + return container_of(con, struct nouveau_connector, base); + } + ++static inline bool ++nouveau_connector_is_mst(struct drm_connector *connector) ++{ ++ const struct nouveau_encoder *nv_encoder; ++ const struct drm_encoder *encoder; ++ ++ if (connector->connector_type != DRM_MODE_CONNECTOR_DisplayPort) ++ return false; ++ ++ nv_encoder = find_encoder(connector, DCB_OUTPUT_ANY); ++ if (!nv_encoder) ++ return false; ++ ++ encoder = &nv_encoder->base.base; ++ return encoder->encoder_type == DRM_MODE_ENCODER_DPMST; ++} ++ ++#define nouveau_for_each_non_mst_connector_iter(connector, iter) \ ++ drm_for_each_connector_iter(connector, iter) \ ++ for_each_if(!nouveau_connector_is_mst(connector)) ++ + static inline struct nouveau_connector * + nouveau_crtc_connector_get(struct nouveau_crtc *nv_crtc) + { + struct drm_device *dev = nv_crtc->base.dev; + struct drm_connector *connector; ++ struct drm_connector_list_iter conn_iter; ++ struct nouveau_connector *nv_connector = NULL; + struct drm_crtc *crtc = to_drm_crtc(nv_crtc); + +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { +- if (connector->encoder && connector->encoder->crtc == crtc) +- return nouveau_connector(connector); ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { ++ if (connector->encoder && connector->encoder->crtc == crtc) { ++ nv_connector = nouveau_connector(connector); ++ break; ++ } + } ++ drm_connector_list_iter_end(&conn_iter); + +- return NULL; ++ return nv_connector; + } + + struct drm_connector * +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c +index 2e7785f49e6d..caf53503c0f7 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -405,6 +405,7 @@ nouveau_display_init(struct drm_device *dev) + struct nouveau_display *disp = nouveau_display(dev); + struct nouveau_drm *drm = nouveau_drm(dev); + struct drm_connector *connector; ++ struct drm_connector_list_iter conn_iter; + int ret; + + ret = disp->init(dev); +@@ -412,10 +413,12 @@ nouveau_display_init(struct drm_device *dev) + return ret; + + /* enable hotplug interrupts */ +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { + struct nouveau_connector *conn = nouveau_connector(connector); + nvif_notify_get(&conn->hpd); + } ++ drm_connector_list_iter_end(&conn_iter); + + /* enable flip completion events */ + nvif_notify_get(&drm->flip); +@@ -428,6 +431,7 @@ nouveau_display_fini(struct drm_device *dev, bool suspend) + struct nouveau_display *disp = nouveau_display(dev); + struct nouveau_drm *drm = nouveau_drm(dev); + struct drm_connector *connector; ++ struct drm_connector_list_iter conn_iter; + + if (!suspend) { + if (drm_drv_uses_atomic_modeset(dev)) +@@ -440,10 +444,12 @@ nouveau_display_fini(struct drm_device *dev, bool suspend) + nvif_notify_put(&drm->flip); + + /* disable hotplug interrupts */ +- list_for_each_entry(connector, &dev->mode_config.connector_list, head) { ++ drm_connector_list_iter_begin(dev, &conn_iter); ++ nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { + struct nouveau_connector *conn = nouveau_connector(connector); + nvif_notify_put(&conn->hpd); + } ++ drm_connector_list_iter_end(&conn_iter); + + drm_kms_helper_poll_disable(dev); + disp->fini(dev); +diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c +index a0c44d16bf30..c75daba57fd7 100644 +--- a/drivers/misc/cxl/api.c ++++ b/drivers/misc/cxl/api.c +@@ -102,15 +102,15 @@ static struct file *cxl_getfile(const char *name, + d_instantiate(path.dentry, inode); + + file = alloc_file(&path, OPEN_FMODE(flags), fops); +- if (IS_ERR(file)) +- goto err_dput; ++ if (IS_ERR(file)) { ++ path_put(&path); ++ goto err_fs; ++ } + file->f_flags = flags & (O_ACCMODE | O_NONBLOCK); + file->private_data = priv; + + return file; + +-err_dput: +- path_put(&path); + err_inode: + iput(inode); + err_fs: +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 1e856e8b9a92..0fff2432ab4c 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -1851,8 +1851,8 @@ static int bcm_sysport_open(struct net_device *dev) + if (!priv->is_lite) + priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD); + else +- priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) & +- GIB_FCS_STRIP); ++ priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) & ++ GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT); + + phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link, + 0, priv->phy_interface); +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.h b/drivers/net/ethernet/broadcom/bcmsysport.h +index a2006f5fc26f..86ae751ccb5c 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.h ++++ b/drivers/net/ethernet/broadcom/bcmsysport.h +@@ -277,7 +277,8 @@ struct bcm_rsb { + #define GIB_GTX_CLK_EXT_CLK (0 << GIB_GTX_CLK_SEL_SHIFT) + #define GIB_GTX_CLK_125MHZ (1 << GIB_GTX_CLK_SEL_SHIFT) + #define GIB_GTX_CLK_250MHZ (2 << GIB_GTX_CLK_SEL_SHIFT) +-#define GIB_FCS_STRIP (1 << 6) ++#define GIB_FCS_STRIP_SHIFT 6 ++#define GIB_FCS_STRIP (1 << GIB_FCS_STRIP_SHIFT) + #define GIB_LCL_LOOP_EN (1 << 7) + #define GIB_LCL_LOOP_TXEN (1 << 8) + #define GIB_RMT_LOOP_EN (1 << 9) +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 9a8ef630466f..1b1d2a67f412 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -9279,6 +9279,15 @@ static int tg3_chip_reset(struct tg3 *tp) + + tg3_restore_clk(tp); + ++ /* Increase the core clock speed to fix tx timeout issue for 5762 ++ * with 100Mbps link speed. ++ */ ++ if (tg3_asic_rev(tp) == ASIC_REV_5762) { ++ val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE); ++ tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val | ++ TG3_CPMU_MAC_ORIDE_ENABLE); ++ } ++ + /* Reprobe ASF enable state. */ + tg3_flag_clear(tp, ENABLE_ASF); + tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK | +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +index b97a55c827eb..ab2a9dbb46c7 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c +@@ -472,10 +472,10 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv, + { + const struct mlx4_en_frag_info *frag_info = priv->frag_info; + unsigned int truesize = 0; ++ bool release = true; + int nr, frag_size; + struct page *page; + dma_addr_t dma; +- bool release; + + /* Collect used fragments while replacing them in the HW descriptors */ + for (nr = 0;; frags++) { +@@ -498,7 +498,11 @@ static int mlx4_en_complete_rx_desc(struct mlx4_en_priv *priv, + release = page_count(page) != 1 || + page_is_pfmemalloc(page) || + page_to_nid(page) != numa_mem_id(); +- } else { ++ } else if (!priv->rx_headroom) { ++ /* rx_headroom for non XDP setup is always 0. ++ * When XDP is set, the above condition will ++ * guarantee page is always released. ++ */ + u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES); + + frags->page_offset += sz_align; +diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c +index 701be5d81062..806239b89990 100644 +--- a/drivers/net/hyperv/netvsc.c ++++ b/drivers/net/hyperv/netvsc.c +@@ -1250,6 +1250,7 @@ int netvsc_poll(struct napi_struct *napi, int budget) + struct hv_device *device = netvsc_channel_to_device(channel); + struct net_device *ndev = hv_get_drvdata(device); + int work_done = 0; ++ int ret; + + /* If starting a new interval */ + if (!nvchan->desc) +@@ -1261,16 +1262,18 @@ int netvsc_poll(struct napi_struct *napi, int budget) + nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc); + } + +- /* If send of pending receive completions suceeded +- * and did not exhaust NAPI budget this time +- * and not doing busy poll ++ /* Send any pending receive completions */ ++ ret = send_recv_completions(ndev, net_device, nvchan); ++ ++ /* If it did not exhaust NAPI budget this time ++ * and not doing busy poll + * then re-enable host interrupts +- * and reschedule if ring is not empty. ++ * and reschedule if ring is not empty ++ * or sending receive completion failed. + */ +- if (send_recv_completions(ndev, net_device, nvchan) == 0 && +- work_done < budget && ++ if (work_done < budget && + napi_complete_done(napi, work_done) && +- hv_end_read(&channel->inbound) && ++ (ret || hv_end_read(&channel->inbound)) && + napi_schedule_prep(napi)) { + hv_begin_read(&channel->inbound); + __napi_schedule(napi); +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index a1e7ea4d4b16..a174d05a9752 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1686,11 +1686,8 @@ EXPORT_SYMBOL(genphy_loopback); + + static int __set_phy_supported(struct phy_device *phydev, u32 max_speed) + { +- /* The default values for phydev->supported are provided by the PHY +- * driver "features" member, we want to reset to sane defaults first +- * before supporting higher speeds. +- */ +- phydev->supported &= PHY_DEFAULT_FEATURES; ++ phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES | ++ PHY_10BT_FEATURES); + + switch (max_speed) { + default: +diff --git a/drivers/net/usb/asix_devices.c b/drivers/net/usb/asix_devices.c +index 3d4f7959dabb..b1b3d8f7e67d 100644 +--- a/drivers/net/usb/asix_devices.c ++++ b/drivers/net/usb/asix_devices.c +@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct usbnet *dev) + priv->presvd_phy_advertise); + + /* Restore BMCR */ ++ if (priv->presvd_phy_bmcr & BMCR_ANENABLE) ++ priv->presvd_phy_bmcr |= BMCR_ANRESTART; ++ + asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR, + priv->presvd_phy_bmcr); + +- mii_nway_restart(&dev->mii); + priv->presvd_phy_advertise = 0; + priv->presvd_phy_bmcr = 0; + } +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 0db500bf86d9..6d3811c869fd 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1252,6 +1252,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ ++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */ + {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */ + +diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c +index 58a97d420572..51364621f77c 100644 +--- a/drivers/ptp/ptp_chardev.c ++++ b/drivers/ptp/ptp_chardev.c +@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *ptp, unsigned int pin, + case PTP_PF_PHYSYNC: + if (chan != 0) + return -EINVAL; ++ break; + default: + return -EINVAL; + } +diff --git a/drivers/scsi/sd_zbc.c b/drivers/scsi/sd_zbc.c +index ea9e1e0ed5b8..f4944dde6c8e 100644 +--- a/drivers/scsi/sd_zbc.c ++++ b/drivers/scsi/sd_zbc.c +@@ -430,7 +430,8 @@ static int sd_zbc_check_capacity(struct scsi_disk *sdkp, + * Check that all zones of the device are equal. The last zone can however + * be smaller. The zone size must also be a power of two number of LBAs. + * +- * Returns the zone size in bytes upon success or an error code upon failure. ++ * Returns the zone size in number of blocks upon success or an error code ++ * upon failure. + */ + static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp) + { +@@ -440,7 +441,7 @@ static s64 sd_zbc_check_zone_size(struct scsi_disk *sdkp) + unsigned char *rec; + unsigned int buf_len; + unsigned int list_length; +- int ret; ++ s64 ret; + u8 same; + + /* Get a buffer */ +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index e5bccc6d49cf..fe84b36627ec 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -856,6 +856,41 @@ static void xhci_disable_port_wake_on_bits(struct xhci_hcd *xhci) + spin_unlock_irqrestore(&xhci->lock, flags); + } + ++static bool xhci_pending_portevent(struct xhci_hcd *xhci) ++{ ++ __le32 __iomem **port_array; ++ int port_index; ++ u32 status; ++ u32 portsc; ++ ++ status = readl(&xhci->op_regs->status); ++ if (status & STS_EINT) ++ return true; ++ /* ++ * Checking STS_EINT is not enough as there is a lag between a change ++ * bit being set and the Port Status Change Event that it generated ++ * being written to the Event Ring. See note in xhci 1.1 section 4.19.2. ++ */ ++ ++ port_index = xhci->num_usb2_ports; ++ port_array = xhci->usb2_ports; ++ while (port_index--) { ++ portsc = readl(port_array[port_index]); ++ if (portsc & PORT_CHANGE_MASK || ++ (portsc & PORT_PLS_MASK) == XDEV_RESUME) ++ return true; ++ } ++ port_index = xhci->num_usb3_ports; ++ port_array = xhci->usb3_ports; ++ while (port_index--) { ++ portsc = readl(port_array[port_index]); ++ if (portsc & PORT_CHANGE_MASK || ++ (portsc & PORT_PLS_MASK) == XDEV_RESUME) ++ return true; ++ } ++ return false; ++} ++ + /* + * Stop HC (not bus-specific) + * +@@ -955,7 +990,7 @@ EXPORT_SYMBOL_GPL(xhci_suspend); + */ + int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + { +- u32 command, temp = 0, status; ++ u32 command, temp = 0; + struct usb_hcd *hcd = xhci_to_hcd(xhci); + struct usb_hcd *secondary_hcd; + int retval = 0; +@@ -1077,8 +1112,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated) + done: + if (retval == 0) { + /* Resume root hubs only when have pending events. */ +- status = readl(&xhci->op_regs->status); +- if (status & STS_EINT) { ++ if (xhci_pending_portevent(xhci)) { + usb_hcd_resume_root_hub(xhci->shared_hcd); + usb_hcd_resume_root_hub(hcd); + } +diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h +index 2a72060dda1b..11232e62b898 100644 +--- a/drivers/usb/host/xhci.h ++++ b/drivers/usb/host/xhci.h +@@ -392,6 +392,10 @@ struct xhci_op_regs { + #define PORT_PLC (1 << 22) + /* port configure error change - port failed to configure its link partner */ + #define PORT_CEC (1 << 23) ++#define PORT_CHANGE_MASK (PORT_CSC | PORT_PEC | PORT_WRC | PORT_OCC | \ ++ PORT_RC | PORT_PLC | PORT_CEC) ++ ++ + /* Cold Attach Status - xHC can set this bit to report device attached during + * Sx state. Warm port reset should be perfomed to clear this bit and move port + * to connected state. +diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c +index f041b1a6cf66..695b9d1a1aae 100644 +--- a/drivers/vfio/pci/vfio_pci.c ++++ b/drivers/vfio/pci/vfio_pci.c +@@ -28,6 +28,7 @@ + #include + #include + #include ++#include + + #include "vfio_pci_private.h" + +@@ -746,6 +747,9 @@ static long vfio_pci_ioctl(void *device_data, + if (info.index >= + VFIO_PCI_NUM_REGIONS + vdev->num_regions) + return -EINVAL; ++ info.index = array_index_nospec(info.index, ++ VFIO_PCI_NUM_REGIONS + ++ vdev->num_regions); + + i = info.index - VFIO_PCI_NUM_REGIONS; + +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index 63112c36ab2d..b751dd60e41a 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -457,13 +457,13 @@ static void tce_iommu_unuse_page(struct tce_container *container, + } + + static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container, +- unsigned long tce, unsigned long size, ++ unsigned long tce, unsigned long shift, + unsigned long *phpa, struct mm_iommu_table_group_mem_t **pmem) + { + long ret = 0; + struct mm_iommu_table_group_mem_t *mem; + +- mem = mm_iommu_lookup(container->mm, tce, size); ++ mem = mm_iommu_lookup(container->mm, tce, 1ULL << shift); + if (!mem) + return -EINVAL; + +@@ -487,7 +487,7 @@ static void tce_iommu_unuse_page_v2(struct tce_container *container, + if (!pua) + return; + +- ret = tce_iommu_prereg_ua_to_hpa(container, *pua, IOMMU_PAGE_SIZE(tbl), ++ ret = tce_iommu_prereg_ua_to_hpa(container, *pua, tbl->it_page_shift, + &hpa, &mem); + if (ret) + pr_debug("%s: tce %lx at #%lx was not cached, ret=%d\n", +@@ -609,7 +609,7 @@ static long tce_iommu_build_v2(struct tce_container *container, + entry + i); + + ret = tce_iommu_prereg_ua_to_hpa(container, +- tce, IOMMU_PAGE_SIZE(tbl), &hpa, &mem); ++ tce, tbl->it_page_shift, &hpa, &mem); + if (ret) + break; + +diff --git a/fs/fat/inode.c b/fs/fat/inode.c +index c7a4dee206b9..3b40937b942a 100644 +--- a/fs/fat/inode.c ++++ b/fs/fat/inode.c +@@ -696,13 +696,21 @@ static void fat_set_state(struct super_block *sb, + brelse(bh); + } + ++static void fat_reset_iocharset(struct fat_mount_options *opts) ++{ ++ if (opts->iocharset != fat_default_iocharset) { ++ /* Note: opts->iocharset can be NULL here */ ++ kfree(opts->iocharset); ++ opts->iocharset = fat_default_iocharset; ++ } ++} ++ + static void delayed_free(struct rcu_head *p) + { + struct msdos_sb_info *sbi = container_of(p, struct msdos_sb_info, rcu); + unload_nls(sbi->nls_disk); + unload_nls(sbi->nls_io); +- if (sbi->options.iocharset != fat_default_iocharset) +- kfree(sbi->options.iocharset); ++ fat_reset_iocharset(&sbi->options); + kfree(sbi); + } + +@@ -1117,7 +1125,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat, + opts->fs_fmask = opts->fs_dmask = current_umask(); + opts->allow_utime = -1; + opts->codepage = fat_default_codepage; +- opts->iocharset = fat_default_iocharset; ++ fat_reset_iocharset(opts); + if (is_vfat) { + opts->shortname = VFAT_SFN_DISPLAY_WINNT|VFAT_SFN_CREATE_WIN95; + opts->rodir = 0; +@@ -1274,8 +1282,7 @@ static int parse_options(struct super_block *sb, char *options, int is_vfat, + + /* vfat specific */ + case Opt_charset: +- if (opts->iocharset != fat_default_iocharset) +- kfree(opts->iocharset); ++ fat_reset_iocharset(opts); + iocharset = match_strdup(&args[0]); + if (!iocharset) + return -ENOMEM; +@@ -1866,8 +1873,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat, + iput(fat_inode); + unload_nls(sbi->nls_io); + unload_nls(sbi->nls_disk); +- if (sbi->options.iocharset != fat_default_iocharset) +- kfree(sbi->options.iocharset); ++ fat_reset_iocharset(&sbi->options); + sb->s_fs_info = NULL; + kfree(sbi); + return error; +diff --git a/include/linux/sched/task.h b/include/linux/sched/task.h +index 05b8650f06f5..a74ec619ac51 100644 +--- a/include/linux/sched/task.h ++++ b/include/linux/sched/task.h +@@ -75,7 +75,7 @@ extern long _do_fork(unsigned long, unsigned long, unsigned long, int __user *, + extern long do_fork(unsigned long, unsigned long, unsigned long, int __user *, int __user *); + struct task_struct *fork_idle(int); + extern pid_t kernel_thread(int (*fn)(void *), void *arg, unsigned long flags); +-extern long kernel_wait4(pid_t, int *, int, struct rusage *); ++extern long kernel_wait4(pid_t, int __user *, int, struct rusage *); + + extern void free_task(struct task_struct *tsk); + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index be45224b01d7..9cf971c68401 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -624,6 +624,7 @@ typedef unsigned char *sk_buff_data_t; + * @hash: the packet hash + * @queue_mapping: Queue mapping for multiqueue devices + * @xmit_more: More SKBs are pending for this queue ++ * @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves + * @ndisc_nodetype: router type (from link layer) + * @ooo_okay: allow the mapping of a socket to a queue to be changed + * @l4_hash: indicate hash is a canonical 4-tuple hash over transport +@@ -722,7 +723,7 @@ struct sk_buff { + peeked:1, + head_frag:1, + xmit_more:1, +- __unused:1; /* one bit hole */ ++ pfmemalloc:1; + + /* fields enclosed in headers_start/headers_end are copied + * using a single memcpy() in __copy_skb_header() +@@ -741,31 +742,30 @@ struct sk_buff { + + __u8 __pkt_type_offset[0]; + __u8 pkt_type:3; +- __u8 pfmemalloc:1; + __u8 ignore_df:1; +- + __u8 nf_trace:1; + __u8 ip_summed:2; + __u8 ooo_okay:1; ++ + __u8 l4_hash:1; + __u8 sw_hash:1; + __u8 wifi_acked_valid:1; + __u8 wifi_acked:1; +- + __u8 no_fcs:1; + /* Indicates the inner headers are valid in the skbuff. */ + __u8 encapsulation:1; + __u8 encap_hdr_csum:1; + __u8 csum_valid:1; ++ + __u8 csum_complete_sw:1; + __u8 csum_level:2; + __u8 csum_not_inet:1; +- + __u8 dst_pending_confirm:1; + #ifdef CONFIG_IPV6_NDISC_NODETYPE + __u8 ndisc_nodetype:2; + #endif + __u8 ipvs_property:1; ++ + __u8 inner_protocol_type:1; + __u8 remcsum_offload:1; + #ifdef CONFIG_NET_SWITCHDEV +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index a54b8c58ccb7..e59f385da38e 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -795,7 +795,7 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb, + * to minimize possbility that any useful information to an + * attacker is leaked. Only lower 20 bits are relevant. + */ +- rol32(hash, 16); ++ hash = rol32(hash, 16); + + flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK; + +diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c +index 64c0291b579c..2f6fa95de2d8 100644 +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -270,7 +270,11 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + goto retry; + } + +- wake_up_q(&wakeq); ++ if (!err) { ++ preempt_disable(); ++ wake_up_q(&wakeq); ++ preempt_enable(); ++ } + + return err; + } +diff --git a/lib/rhashtable.c b/lib/rhashtable.c +index b734ce731a7a..39215c724fc7 100644 +--- a/lib/rhashtable.c ++++ b/lib/rhashtable.c +@@ -878,8 +878,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop); + + static size_t rounded_hashtable_size(const struct rhashtable_params *params) + { +- return max(roundup_pow_of_two(params->nelem_hint * 4 / 3), +- (unsigned long)params->min_size); ++ size_t retsize; ++ ++ if (params->nelem_hint) ++ retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3), ++ (unsigned long)params->min_size); ++ else ++ retsize = max(HASH_DEFAULT_SIZE, ++ (unsigned long)params->min_size); ++ ++ return retsize; + } + + static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed) +@@ -936,8 +944,6 @@ int rhashtable_init(struct rhashtable *ht, + struct bucket_table *tbl; + size_t size; + +- size = HASH_DEFAULT_SIZE; +- + if ((!params->key_len && !params->obj_hashfn) || + (params->obj_hashfn && !params->obj_cmpfn)) + return -EINVAL; +@@ -964,8 +970,7 @@ int rhashtable_init(struct rhashtable *ht, + + ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE); + +- if (params->nelem_hint) +- size = rounded_hashtable_size(&ht->p); ++ size = rounded_hashtable_size(&ht->p); + + if (params->locks_mul) + ht->p.locks_mul = roundup_pow_of_two(params->locks_mul); +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 8af604f3b370..255469f78217 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2069,6 +2069,8 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, + if (vma_is_dax(vma)) + return; + page = pmd_page(_pmd); ++ if (!PageDirty(page) && pmd_dirty(_pmd)) ++ set_page_dirty(page); + if (!PageReferenced(page) && pmd_young(_pmd)) + SetPageReferenced(page); + page_remove_rmap(page, true); +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 942d9342b63b..db69d938e9ed 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -879,7 +879,7 @@ static void invalidate_reclaim_iterators(struct mem_cgroup *dead_memcg) + int nid; + int i; + +- while ((memcg = parent_mem_cgroup(memcg))) { ++ for (; memcg; memcg = parent_mem_cgroup(memcg)) { + for_each_node(nid) { + mz = mem_cgroup_nodeinfo(memcg, nid); + for (i = 0; i <= DEF_PRIORITY; i++) { +diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c +index 87f28557b329..441c04adedba 100644 +--- a/net/core/gen_stats.c ++++ b/net/core/gen_stats.c +@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_buff *skb, int type, int tc_stats_type, + d->lock = lock; + spin_lock_bh(lock); + } +- if (d->tail) +- return gnet_stats_copy(d, type, NULL, 0, padattr); ++ if (d->tail) { ++ int ret = gnet_stats_copy(d, type, NULL, 0, padattr); ++ ++ /* The initial attribute added in gnet_stats_copy() may be ++ * preceded by a padding attribute, in which case d->tail will ++ * end up pointing at the padding instead of the real attribute. ++ * Fix this so gnet_stats_finish_copy() adjusts the length of ++ * the right attribute. ++ */ ++ if (ret == 0 && d->tail->nla_type == padattr) ++ d->tail = (struct nlattr *)((char *)d->tail + ++ NLA_ALIGN(d->tail->nla_len)); ++ return ret; ++ } + + return 0; + } +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index c132eca9e383..23041b5c0b27 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -858,6 +858,7 @@ static struct sk_buff *__skb_clone(struct sk_buff *n, struct sk_buff *skb) + n->cloned = 1; + n->nohdr = 0; + n->peeked = 0; ++ C(pfmemalloc); + n->destructor = NULL; + C(tail); + C(end); +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index df8fd3ce713d..67eebcb113f3 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -290,6 +290,7 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) + if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { + struct flowi4 fl4 = { + .flowi4_iif = LOOPBACK_IFINDEX, ++ .flowi4_oif = l3mdev_master_ifindex_rcu(dev), + .daddr = ip_hdr(skb)->saddr, + .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), + .flowi4_scope = scope, +diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c +index 5a29dc5083a3..d82e8344fc54 100644 +--- a/net/ipv4/sysctl_net_ipv4.c ++++ b/net/ipv4/sysctl_net_ipv4.c +@@ -186,8 +186,9 @@ static int ipv4_ping_group_range(struct ctl_table *table, int write, + if (write && ret == 0) { + low = make_kgid(user_ns, urange[0]); + high = make_kgid(user_ns, urange[1]); +- if (!gid_valid(low) || !gid_valid(high) || +- (urange[1] < urange[0]) || gid_lt(high, low)) { ++ if (!gid_valid(low) || !gid_valid(high)) ++ return -EINVAL; ++ if (urange[1] < urange[0] || gid_lt(high, low)) { + low = make_kgid(&init_user_ns, 1); + high = make_kgid(&init_user_ns, 0); + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index e3ece12f0250..e81ff9d545a4 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -3415,8 +3415,7 @@ int tcp_abort(struct sock *sk, int err) + struct request_sock *req = inet_reqsk(sk); + + local_bh_disable(); +- inet_csk_reqsk_queue_drop_and_put(req->rsk_listener, +- req); ++ inet_csk_reqsk_queue_drop(req->rsk_listener, req); + local_bh_enable(); + return 0; + } +diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig +index ea71e4b0ab7a..2d36fd097299 100644 +--- a/net/ipv6/Kconfig ++++ b/net/ipv6/Kconfig +@@ -109,6 +109,7 @@ config IPV6_MIP6 + config IPV6_ILA + tristate "IPv6: Identifier Locator Addressing (ILA)" + depends on NETFILTER ++ select DST_CACHE + select LWTUNNEL + ---help--- + Support for IPv6 Identifier Locator Addressing (ILA). +diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c +index d081db125905..528218460bc5 100644 +--- a/net/ipv6/ndisc.c ++++ b/net/ipv6/ndisc.c +@@ -803,7 +803,7 @@ static void ndisc_recv_ns(struct sk_buff *skb) + return; + } + } +- if (ndopts.nd_opts_nonce) ++ if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1) + memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6); + + inc = ipv6_addr_is_multicast(daddr); +diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c +index f055ca10bbc1..abacbbc0b0e8 100644 +--- a/sound/core/rawmidi.c ++++ b/sound/core/rawmidi.c +@@ -635,7 +635,7 @@ static int snd_rawmidi_info_select_user(struct snd_card *card, + int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream, + struct snd_rawmidi_params * params) + { +- char *newbuf; ++ char *newbuf, *oldbuf; + struct snd_rawmidi_runtime *runtime = substream->runtime; + + if (substream->append && substream->use_count > 1) +@@ -648,13 +648,17 @@ int snd_rawmidi_output_params(struct snd_rawmidi_substream *substream, + return -EINVAL; + } + if (params->buffer_size != runtime->buffer_size) { +- newbuf = krealloc(runtime->buffer, params->buffer_size, +- GFP_KERNEL); ++ newbuf = kmalloc(params->buffer_size, GFP_KERNEL); + if (!newbuf) + return -ENOMEM; ++ spin_lock_irq(&runtime->lock); ++ oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; + runtime->avail = runtime->buffer_size; ++ runtime->appl_ptr = runtime->hw_ptr = 0; ++ spin_unlock_irq(&runtime->lock); ++ kfree(oldbuf); + } + runtime->avail_min = params->avail_min; + substream->active_sensing = !params->no_active_sensing; +@@ -665,7 +669,7 @@ EXPORT_SYMBOL(snd_rawmidi_output_params); + int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream, + struct snd_rawmidi_params * params) + { +- char *newbuf; ++ char *newbuf, *oldbuf; + struct snd_rawmidi_runtime *runtime = substream->runtime; + + snd_rawmidi_drain_input(substream); +@@ -676,12 +680,16 @@ int snd_rawmidi_input_params(struct snd_rawmidi_substream *substream, + return -EINVAL; + } + if (params->buffer_size != runtime->buffer_size) { +- newbuf = krealloc(runtime->buffer, params->buffer_size, +- GFP_KERNEL); ++ newbuf = kmalloc(params->buffer_size, GFP_KERNEL); + if (!newbuf) + return -ENOMEM; ++ spin_lock_irq(&runtime->lock); ++ oldbuf = runtime->buffer; + runtime->buffer = newbuf; + runtime->buffer_size = params->buffer_size; ++ runtime->appl_ptr = runtime->hw_ptr = 0; ++ spin_unlock_irq(&runtime->lock); ++ kfree(oldbuf); + } + runtime->avail_min = params->avail_min; + return 0; +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index ba9a7e552183..88ce2f1022e1 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -965,6 +965,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { + SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), + SND_PCI_QUIRK(0x103c, 0x814f, "HP ZBook 15u G3", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x822e, "HP ProBook 440 G4", CXT_FIXUP_MUTE_LED_GPIO), ++ SND_PCI_QUIRK(0x103c, 0x836e, "HP ProBook 455 G5", CXT_FIXUP_MUTE_LED_GPIO), + SND_PCI_QUIRK(0x103c, 0x8299, "HP 800 G3 SFF", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x829a, "HP 800 G3 DM", CXT_FIXUP_HP_MIC_NO_PRESENCE), + SND_PCI_QUIRK(0x103c, 0x8455, "HP Z2 G4", CXT_FIXUP_HP_MIC_NO_PRESENCE), +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index bf7737fc3b28..dcc9e6551b51 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -6402,6 +6402,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC), + SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x10ec, 0x10f2, "Intel Reference board", ALC700_FIXUP_INTEL_REFERENCE), ++ SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-SZ6", ALC269_FIXUP_HEADSET_MODE), + SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), + SND_PCI_QUIRK(0x144d, 0xc740, "Samsung Ativ book 8 (NP870Z5G)", ALC269_FIXUP_ATIV_BOOK_8), + SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_HEADSET_MIC), +diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c +index f2ac53ab8243..58a9b31b0dd5 100644 +--- a/virt/kvm/eventfd.c ++++ b/virt/kvm/eventfd.c +@@ -119,8 +119,12 @@ irqfd_shutdown(struct work_struct *work) + { + struct kvm_kernel_irqfd *irqfd = + container_of(work, struct kvm_kernel_irqfd, shutdown); ++ struct kvm *kvm = irqfd->kvm; + u64 cnt; + ++ /* Make sure irqfd has been initalized in assign path. */ ++ synchronize_srcu(&kvm->irq_srcu); ++ + /* + * Synchronize with the wait-queue and unhook ourselves to prevent + * further events. +@@ -387,7 +391,6 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) + + idx = srcu_read_lock(&kvm->irq_srcu); + irqfd_update(kvm, irqfd); +- srcu_read_unlock(&kvm->irq_srcu, idx); + + list_add_tail(&irqfd->list, &kvm->irqfds.items); + +@@ -421,6 +424,7 @@ kvm_irqfd_assign(struct kvm *kvm, struct kvm_irqfd *args) + } + #endif + ++ srcu_read_unlock(&kvm->irq_srcu, idx); + return 0; + + fail: diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.58-59.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.58-59.patch new file mode 100644 index 000000000000..d6b26001b134 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.58-59.patch @@ -0,0 +1,2213 @@ +diff --git a/Makefile b/Makefile +index ffc9b4e3867e..81b0e99dce80 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 58 ++SUBLEVEL = 59 + EXTRAVERSION = + NAME = Petit Gorille + +@@ -642,6 +642,7 @@ KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) + KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) + KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) + KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) ++KBUILD_CFLAGS += $(call cc-disable-warning, attribute-alias) + + ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE + KBUILD_CFLAGS += $(call cc-option,-Oz,-Os) +diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c +index 10a405d593df..c782b10ddf50 100644 +--- a/arch/mips/ath79/common.c ++++ b/arch/mips/ath79/common.c +@@ -58,7 +58,7 @@ EXPORT_SYMBOL_GPL(ath79_ddr_ctrl_init); + + void ath79_ddr_wb_flush(u32 reg) + { +- void __iomem *flush_reg = ath79_ddr_wb_flush_base + reg; ++ void __iomem *flush_reg = ath79_ddr_wb_flush_base + (reg * 4); + + /* Flush the DDR write buffer. */ + __raw_writel(0x1, flush_reg); +diff --git a/arch/mips/pci/pci.c b/arch/mips/pci/pci.c +index 9632436d74d7..c2e94cf5ecda 100644 +--- a/arch/mips/pci/pci.c ++++ b/arch/mips/pci/pci.c +@@ -54,5 +54,5 @@ void pci_resource_to_user(const struct pci_dev *dev, int bar, + phys_addr_t size = resource_size(rsrc); + + *start = fixup_bigphys_addr(rsrc->start, size); +- *end = rsrc->start + size; ++ *end = rsrc->start + size - 1; + } +diff --git a/arch/powerpc/include/asm/mmu_context.h b/arch/powerpc/include/asm/mmu_context.h +index 44fdf4786638..6f67ff5a5267 100644 +--- a/arch/powerpc/include/asm/mmu_context.h ++++ b/arch/powerpc/include/asm/mmu_context.h +@@ -35,9 +35,9 @@ extern struct mm_iommu_table_group_mem_t *mm_iommu_lookup_rm( + extern struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm, + unsigned long ua, unsigned long entries); + extern long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa); ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa); + extern long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa); ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa); + extern long mm_iommu_mapped_inc(struct mm_iommu_table_group_mem_t *mem); + extern void mm_iommu_mapped_dec(struct mm_iommu_table_group_mem_t *mem); + #endif +diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c +index 4dffa611376d..e14cec6bc339 100644 +--- a/arch/powerpc/kvm/book3s_64_vio.c ++++ b/arch/powerpc/kvm/book3s_64_vio.c +@@ -433,7 +433,7 @@ long kvmppc_tce_iommu_map(struct kvm *kvm, struct iommu_table *tbl, + /* This only handles v2 IOMMU type, v1 is handled via ioctl() */ + return H_TOO_HARD; + +- if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, &hpa))) ++ if (WARN_ON_ONCE(mm_iommu_ua_to_hpa(mem, ua, tbl->it_page_shift, &hpa))) + return H_HARDWARE; + + if (mm_iommu_mapped_inc(mem)) +diff --git a/arch/powerpc/kvm/book3s_64_vio_hv.c b/arch/powerpc/kvm/book3s_64_vio_hv.c +index c32e9bfe75b1..648cf6c01348 100644 +--- a/arch/powerpc/kvm/book3s_64_vio_hv.c ++++ b/arch/powerpc/kvm/book3s_64_vio_hv.c +@@ -262,7 +262,8 @@ static long kvmppc_rm_tce_iommu_map(struct kvm *kvm, struct iommu_table *tbl, + if (!mem) + return H_TOO_HARD; + +- if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, &hpa))) ++ if (WARN_ON_ONCE_RM(mm_iommu_ua_to_hpa_rm(mem, ua, tbl->it_page_shift, ++ &hpa))) + return H_HARDWARE; + + pua = (void *) vmalloc_to_phys(pua); +@@ -431,7 +432,8 @@ long kvmppc_rm_h_put_tce_indirect(struct kvm_vcpu *vcpu, + + mem = mm_iommu_lookup_rm(vcpu->kvm->mm, ua, IOMMU_PAGE_SIZE_4K); + if (mem) +- prereg = mm_iommu_ua_to_hpa_rm(mem, ua, &tces) == 0; ++ prereg = mm_iommu_ua_to_hpa_rm(mem, ua, ++ IOMMU_PAGE_SHIFT_4K, &tces) == 0; + } + + if (!prereg) { +diff --git a/arch/powerpc/mm/mmu_context_iommu.c b/arch/powerpc/mm/mmu_context_iommu.c +index e0a2d8e806ed..816055927ee4 100644 +--- a/arch/powerpc/mm/mmu_context_iommu.c ++++ b/arch/powerpc/mm/mmu_context_iommu.c +@@ -19,6 +19,7 @@ + #include + #include + #include ++#include + + static DEFINE_MUTEX(mem_list_mutex); + +@@ -27,6 +28,7 @@ struct mm_iommu_table_group_mem_t { + struct rcu_head rcu; + unsigned long used; + atomic64_t mapped; ++ unsigned int pageshift; + u64 ua; /* userspace address */ + u64 entries; /* number of entries in hpas[] */ + u64 *hpas; /* vmalloc'ed */ +@@ -126,6 +128,8 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + { + struct mm_iommu_table_group_mem_t *mem; + long i, j, ret = 0, locked_entries = 0; ++ unsigned int pageshift; ++ unsigned long flags; + struct page *page = NULL; + + mutex_lock(&mem_list_mutex); +@@ -160,6 +164,12 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + goto unlock_exit; + } + ++ /* ++ * For a starting point for a maximum page size calculation ++ * we use @ua and @entries natural alignment to allow IOMMU pages ++ * smaller than huge pages but still bigger than PAGE_SIZE. ++ */ ++ mem->pageshift = __ffs(ua | (entries << PAGE_SHIFT)); + mem->hpas = vzalloc(entries * sizeof(mem->hpas[0])); + if (!mem->hpas) { + kfree(mem); +@@ -200,6 +210,23 @@ long mm_iommu_get(struct mm_struct *mm, unsigned long ua, unsigned long entries, + } + } + populate: ++ pageshift = PAGE_SHIFT; ++ if (PageCompound(page)) { ++ pte_t *pte; ++ struct page *head = compound_head(page); ++ unsigned int compshift = compound_order(head); ++ ++ local_irq_save(flags); /* disables as well */ ++ pte = find_linux_pte(mm->pgd, ua, NULL, &pageshift); ++ local_irq_restore(flags); ++ ++ /* Double check it is still the same pinned page */ ++ if (pte && pte_page(*pte) == head && ++ pageshift == compshift) ++ pageshift = max_t(unsigned int, pageshift, ++ PAGE_SHIFT); ++ } ++ mem->pageshift = min(mem->pageshift, pageshift); + mem->hpas[i] = page_to_pfn(page) << PAGE_SHIFT; + } + +@@ -350,7 +377,7 @@ struct mm_iommu_table_group_mem_t *mm_iommu_find(struct mm_struct *mm, + EXPORT_SYMBOL_GPL(mm_iommu_find); + + long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa) ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa) + { + const long entry = (ua - mem->ua) >> PAGE_SHIFT; + u64 *va = &mem->hpas[entry]; +@@ -358,6 +385,9 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, + if (entry >= mem->entries) + return -EFAULT; + ++ if (pageshift > mem->pageshift) ++ return -EFAULT; ++ + *hpa = *va | (ua & ~PAGE_MASK); + + return 0; +@@ -365,7 +395,7 @@ long mm_iommu_ua_to_hpa(struct mm_iommu_table_group_mem_t *mem, + EXPORT_SYMBOL_GPL(mm_iommu_ua_to_hpa); + + long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, +- unsigned long ua, unsigned long *hpa) ++ unsigned long ua, unsigned int pageshift, unsigned long *hpa) + { + const long entry = (ua - mem->ua) >> PAGE_SHIFT; + void *va = &mem->hpas[entry]; +@@ -374,6 +404,9 @@ long mm_iommu_ua_to_hpa_rm(struct mm_iommu_table_group_mem_t *mem, + if (entry >= mem->entries) + return -EFAULT; + ++ if (pageshift > mem->pageshift) ++ return -EFAULT; ++ + pa = (void *) vmalloc_to_phys(va); + if (!pa) + return -EFAULT; +diff --git a/arch/x86/xen/xen-pvh.S b/arch/x86/xen/xen-pvh.S +index e1a5fbeae08d..5d7554c025fd 100644 +--- a/arch/x86/xen/xen-pvh.S ++++ b/arch/x86/xen/xen-pvh.S +@@ -54,6 +54,9 @@ + * charge of setting up it's own stack, GDT and IDT. + */ + ++#define PVH_GDT_ENTRY_CANARY 4 ++#define PVH_CANARY_SEL (PVH_GDT_ENTRY_CANARY * 8) ++ + ENTRY(pvh_start_xen) + cld + +@@ -98,6 +101,12 @@ ENTRY(pvh_start_xen) + /* 64-bit entry point. */ + .code64 + 1: ++ /* Set base address in stack canary descriptor. */ ++ mov $MSR_GS_BASE,%ecx ++ mov $_pa(canary), %eax ++ xor %edx, %edx ++ wrmsr ++ + call xen_prepare_pvh + + /* startup_64 expects boot_params in %rsi. */ +@@ -107,6 +116,17 @@ ENTRY(pvh_start_xen) + + #else /* CONFIG_X86_64 */ + ++ /* Set base address in stack canary descriptor. */ ++ movl $_pa(gdt_start),%eax ++ movl $_pa(canary),%ecx ++ movw %cx, (PVH_GDT_ENTRY_CANARY * 8) + 2(%eax) ++ shrl $16, %ecx ++ movb %cl, (PVH_GDT_ENTRY_CANARY * 8) + 4(%eax) ++ movb %ch, (PVH_GDT_ENTRY_CANARY * 8) + 7(%eax) ++ ++ mov $PVH_CANARY_SEL,%eax ++ mov %eax,%gs ++ + call mk_early_pgtbl_32 + + mov $_pa(initial_page_table), %eax +@@ -150,9 +170,13 @@ gdt_start: + .quad GDT_ENTRY(0xc09a, 0, 0xfffff) /* __KERNEL_CS */ + #endif + .quad GDT_ENTRY(0xc092, 0, 0xfffff) /* __KERNEL_DS */ ++ .quad GDT_ENTRY(0x4090, 0, 0x18) /* PVH_CANARY_SEL */ + gdt_end: + +- .balign 4 ++ .balign 16 ++canary: ++ .fill 48, 1, 0 ++ + early_stack: + .fill 256, 1, 0 + early_stack_end: +diff --git a/drivers/base/dd.c b/drivers/base/dd.c +index ad44b40fe284..55fc31f6fe7f 100644 +--- a/drivers/base/dd.c ++++ b/drivers/base/dd.c +@@ -401,14 +401,6 @@ re_probe: + goto probe_failed; + } + +- /* +- * Ensure devices are listed in devices_kset in correct order +- * It's important to move Dev to the end of devices_kset before +- * calling .probe, because it could be recursive and parent Dev +- * should always go first +- */ +- devices_kset_move_last(dev); +- + if (dev->bus->probe) { + ret = dev->bus->probe(dev); + if (ret) +diff --git a/drivers/gpu/drm/nouveau/dispnv04/disp.c b/drivers/gpu/drm/nouveau/dispnv04/disp.c +index 5b9d549aa791..e7926da59214 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/disp.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/disp.c +@@ -55,6 +55,9 @@ nv04_display_create(struct drm_device *dev) + nouveau_display(dev)->init = nv04_display_init; + nouveau_display(dev)->fini = nv04_display_fini; + ++ /* Pre-nv50 doesn't support atomic, so don't expose the ioctls */ ++ dev->driver->driver_features &= ~DRIVER_ATOMIC; ++ + nouveau_hw_save_vga_fonts(dev, 1); + + nv04_crtc_create(dev, 0); +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index 595630d1fb9e..362a34cb435d 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -79,6 +79,10 @@ MODULE_PARM_DESC(modeset, "enable driver (default: auto, " + int nouveau_modeset = -1; + module_param_named(modeset, nouveau_modeset, int, 0400); + ++MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)"); ++static int nouveau_atomic = 0; ++module_param_named(atomic, nouveau_atomic, int, 0400); ++ + MODULE_PARM_DESC(runpm, "disable (0), force enable (1), optimus only default (-1)"); + static int nouveau_runtime_pm = -1; + module_param_named(runpm, nouveau_runtime_pm, int, 0400); +@@ -383,6 +387,9 @@ static int nouveau_drm_probe(struct pci_dev *pdev, + + pci_set_master(pdev); + ++ if (nouveau_atomic) ++ driver_pci.driver_features |= DRIVER_ATOMIC; ++ + ret = drm_get_pci_dev(pdev, pent, &driver_pci); + if (ret) { + nvkm_device_del(&device); +diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c +index a29474528e85..926ec51ba5be 100644 +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -4150,7 +4150,7 @@ nv50_disp_atomic_commit(struct drm_device *dev, + nv50_disp_atomic_commit_tail(state); + + drm_for_each_crtc(crtc, dev) { +- if (crtc->state->enable) { ++ if (crtc->state->active) { + if (!drm->have_disp_power_ref) { + drm->have_disp_power_ref = true; + return 0; +@@ -4398,10 +4398,6 @@ nv50_display_destroy(struct drm_device *dev) + kfree(disp); + } + +-MODULE_PARM_DESC(atomic, "Expose atomic ioctl (default: disabled)"); +-static int nouveau_atomic = 0; +-module_param_named(atomic, nouveau_atomic, int, 0400); +- + int + nv50_display_create(struct drm_device *dev) + { +@@ -4426,8 +4422,6 @@ nv50_display_create(struct drm_device *dev) + disp->disp = &nouveau_display(dev)->disp; + dev->mode_config.funcs = &nv50_disp_func; + dev->driver->driver_features |= DRIVER_PREFER_XBGR_30BPP; +- if (nouveau_atomic) +- dev->driver->driver_features |= DRIVER_ATOMIC; + + /* small shared memory area we use for notifiers and semaphores */ + ret = nouveau_bo_new(&drm->client, 4096, 0x1000, TTM_PL_FLAG_VRAM, +diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c +index 61084ba69a99..3d154eb63dcf 100644 +--- a/drivers/net/bonding/bond_options.c ++++ b/drivers/net/bonding/bond_options.c +@@ -743,15 +743,20 @@ const struct bond_option *bond_opt_get(unsigned int option) + static int bond_option_mode_set(struct bonding *bond, + const struct bond_opt_value *newval) + { +- if (!bond_mode_uses_arp(newval->value) && bond->params.arp_interval) { +- netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", +- newval->string); +- /* disable arp monitoring */ +- bond->params.arp_interval = 0; +- /* set miimon to default value */ +- bond->params.miimon = BOND_DEFAULT_MIIMON; +- netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n", +- bond->params.miimon); ++ if (!bond_mode_uses_arp(newval->value)) { ++ if (bond->params.arp_interval) { ++ netdev_dbg(bond->dev, "%s mode is incompatible with arp monitoring, start mii monitoring\n", ++ newval->string); ++ /* disable arp monitoring */ ++ bond->params.arp_interval = 0; ++ } ++ ++ if (!bond->params.miimon) { ++ /* set miimon to default value */ ++ bond->params.miimon = BOND_DEFAULT_MIIMON; ++ netdev_dbg(bond->dev, "Setting MII monitoring interval to %d\n", ++ bond->params.miimon); ++ } + } + + if (newval->value == BOND_MODE_ALB) +diff --git a/drivers/net/can/m_can/m_can.c b/drivers/net/can/m_can/m_can.c +index 5d4e61741476..ca3fa82316c2 100644 +--- a/drivers/net/can/m_can/m_can.c ++++ b/drivers/net/can/m_can/m_can.c +@@ -1073,7 +1073,8 @@ static void m_can_chip_config(struct net_device *dev) + + } else { + /* Version 3.1.x or 3.2.x */ +- cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE); ++ cccr &= ~(CCCR_TEST | CCCR_MON | CCCR_BRSE | CCCR_FDOE | ++ CCCR_NISO); + + /* Only 3.2.x has NISO Bit implemented */ + if (priv->can.ctrlmode & CAN_CTRLMODE_FD_NON_ISO) +diff --git a/drivers/net/can/peak_canfd/peak_pciefd_main.c b/drivers/net/can/peak_canfd/peak_pciefd_main.c +index 3c51a884db87..fa689854f16b 100644 +--- a/drivers/net/can/peak_canfd/peak_pciefd_main.c ++++ b/drivers/net/can/peak_canfd/peak_pciefd_main.c +@@ -58,6 +58,10 @@ MODULE_LICENSE("GPL v2"); + #define PCIEFD_REG_SYS_VER1 0x0040 /* version reg #1 */ + #define PCIEFD_REG_SYS_VER2 0x0044 /* version reg #2 */ + ++#define PCIEFD_FW_VERSION(x, y, z) (((u32)(x) << 24) | \ ++ ((u32)(y) << 16) | \ ++ ((u32)(z) << 8)) ++ + /* System Control Registers Bits */ + #define PCIEFD_SYS_CTL_TS_RST 0x00000001 /* timestamp clock */ + #define PCIEFD_SYS_CTL_CLK_EN 0x00000002 /* system clock */ +@@ -783,6 +787,21 @@ static int peak_pciefd_probe(struct pci_dev *pdev, + "%ux CAN-FD PCAN-PCIe FPGA v%u.%u.%u:\n", can_count, + hw_ver_major, hw_ver_minor, hw_ver_sub); + ++#ifdef CONFIG_ARCH_DMA_ADDR_T_64BIT ++ /* FW < v3.3.0 DMA logic doesn't handle correctly the mix of 32-bit and ++ * 64-bit logical addresses: this workaround forces usage of 32-bit ++ * DMA addresses only when such a fw is detected. ++ */ ++ if (PCIEFD_FW_VERSION(hw_ver_major, hw_ver_minor, hw_ver_sub) < ++ PCIEFD_FW_VERSION(3, 3, 0)) { ++ err = dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(32)); ++ if (err) ++ dev_warn(&pdev->dev, ++ "warning: can't set DMA mask %llxh (err %d)\n", ++ DMA_BIT_MASK(32), err); ++ } ++#endif ++ + /* stop system clock */ + pciefd_sys_writereg(pciefd, PCIEFD_SYS_CTL_CLK_EN, + PCIEFD_REG_SYS_CTL_CLR); +diff --git a/drivers/net/can/xilinx_can.c b/drivers/net/can/xilinx_can.c +index 89aec07c225f..5a24039733ef 100644 +--- a/drivers/net/can/xilinx_can.c ++++ b/drivers/net/can/xilinx_can.c +@@ -2,6 +2,7 @@ + * + * Copyright (C) 2012 - 2014 Xilinx, Inc. + * Copyright (C) 2009 PetaLogix. All rights reserved. ++ * Copyright (C) 2017 Sandvik Mining and Construction Oy + * + * Description: + * This driver is developed for Axi CAN IP and for Zynq CANPS Controller. +@@ -25,8 +26,10 @@ + #include + #include + #include ++#include + #include + #include ++#include + #include + #include + #include +@@ -101,7 +104,7 @@ enum xcan_reg { + #define XCAN_INTR_ALL (XCAN_IXR_TXOK_MASK | XCAN_IXR_BSOFF_MASK |\ + XCAN_IXR_WKUP_MASK | XCAN_IXR_SLP_MASK | \ + XCAN_IXR_RXNEMP_MASK | XCAN_IXR_ERROR_MASK | \ +- XCAN_IXR_ARBLST_MASK | XCAN_IXR_RXOK_MASK) ++ XCAN_IXR_RXOFLW_MASK | XCAN_IXR_ARBLST_MASK) + + /* CAN register bit shift - XCAN___SHIFT */ + #define XCAN_BTR_SJW_SHIFT 7 /* Synchronous jump width */ +@@ -118,6 +121,7 @@ enum xcan_reg { + /** + * struct xcan_priv - This definition define CAN driver instance + * @can: CAN private data structure. ++ * @tx_lock: Lock for synchronizing TX interrupt handling + * @tx_head: Tx CAN packets ready to send on the queue + * @tx_tail: Tx CAN packets successfully sended on the queue + * @tx_max: Maximum number packets the driver can send +@@ -132,6 +136,7 @@ enum xcan_reg { + */ + struct xcan_priv { + struct can_priv can; ++ spinlock_t tx_lock; + unsigned int tx_head; + unsigned int tx_tail; + unsigned int tx_max; +@@ -159,6 +164,11 @@ static const struct can_bittiming_const xcan_bittiming_const = { + .brp_inc = 1, + }; + ++#define XCAN_CAP_WATERMARK 0x0001 ++struct xcan_devtype_data { ++ unsigned int caps; ++}; ++ + /** + * xcan_write_reg_le - Write a value to the device register little endian + * @priv: Driver private data structure +@@ -238,6 +248,10 @@ static int set_reset_mode(struct net_device *ndev) + usleep_range(500, 10000); + } + ++ /* reset clears FIFOs */ ++ priv->tx_head = 0; ++ priv->tx_tail = 0; ++ + return 0; + } + +@@ -392,6 +406,7 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + struct net_device_stats *stats = &ndev->stats; + struct can_frame *cf = (struct can_frame *)skb->data; + u32 id, dlc, data[2] = {0, 0}; ++ unsigned long flags; + + if (can_dropped_invalid_skb(ndev, skb)) + return NETDEV_TX_OK; +@@ -439,6 +454,9 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + data[1] = be32_to_cpup((__be32 *)(cf->data + 4)); + + can_put_echo_skb(skb, ndev, priv->tx_head % priv->tx_max); ++ ++ spin_lock_irqsave(&priv->tx_lock, flags); ++ + priv->tx_head++; + + /* Write the Frame to Xilinx CAN TX FIFO */ +@@ -454,10 +472,16 @@ static int xcan_start_xmit(struct sk_buff *skb, struct net_device *ndev) + stats->tx_bytes += cf->can_dlc; + } + ++ /* Clear TX-FIFO-empty interrupt for xcan_tx_interrupt() */ ++ if (priv->tx_max > 1) ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXFEMP_MASK); ++ + /* Check if the TX buffer is full */ + if ((priv->tx_head - priv->tx_tail) == priv->tx_max) + netif_stop_queue(ndev); + ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ + return NETDEV_TX_OK; + } + +@@ -529,6 +553,123 @@ static int xcan_rx(struct net_device *ndev) + return 1; + } + ++/** ++ * xcan_current_error_state - Get current error state from HW ++ * @ndev: Pointer to net_device structure ++ * ++ * Checks the current CAN error state from the HW. Note that this ++ * only checks for ERROR_PASSIVE and ERROR_WARNING. ++ * ++ * Return: ++ * ERROR_PASSIVE or ERROR_WARNING if either is active, ERROR_ACTIVE ++ * otherwise. ++ */ ++static enum can_state xcan_current_error_state(struct net_device *ndev) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ u32 status = priv->read_reg(priv, XCAN_SR_OFFSET); ++ ++ if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) ++ return CAN_STATE_ERROR_PASSIVE; ++ else if (status & XCAN_SR_ERRWRN_MASK) ++ return CAN_STATE_ERROR_WARNING; ++ else ++ return CAN_STATE_ERROR_ACTIVE; ++} ++ ++/** ++ * xcan_set_error_state - Set new CAN error state ++ * @ndev: Pointer to net_device structure ++ * @new_state: The new CAN state to be set ++ * @cf: Error frame to be populated or NULL ++ * ++ * Set new CAN error state for the device, updating statistics and ++ * populating the error frame if given. ++ */ ++static void xcan_set_error_state(struct net_device *ndev, ++ enum can_state new_state, ++ struct can_frame *cf) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ u32 ecr = priv->read_reg(priv, XCAN_ECR_OFFSET); ++ u32 txerr = ecr & XCAN_ECR_TEC_MASK; ++ u32 rxerr = (ecr & XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT; ++ ++ priv->can.state = new_state; ++ ++ if (cf) { ++ cf->can_id |= CAN_ERR_CRTL; ++ cf->data[6] = txerr; ++ cf->data[7] = rxerr; ++ } ++ ++ switch (new_state) { ++ case CAN_STATE_ERROR_PASSIVE: ++ priv->can.can_stats.error_passive++; ++ if (cf) ++ cf->data[1] = (rxerr > 127) ? ++ CAN_ERR_CRTL_RX_PASSIVE : ++ CAN_ERR_CRTL_TX_PASSIVE; ++ break; ++ case CAN_STATE_ERROR_WARNING: ++ priv->can.can_stats.error_warning++; ++ if (cf) ++ cf->data[1] |= (txerr > rxerr) ? ++ CAN_ERR_CRTL_TX_WARNING : ++ CAN_ERR_CRTL_RX_WARNING; ++ break; ++ case CAN_STATE_ERROR_ACTIVE: ++ if (cf) ++ cf->data[1] |= CAN_ERR_CRTL_ACTIVE; ++ break; ++ default: ++ /* non-ERROR states are handled elsewhere */ ++ WARN_ON(1); ++ break; ++ } ++} ++ ++/** ++ * xcan_update_error_state_after_rxtx - Update CAN error state after RX/TX ++ * @ndev: Pointer to net_device structure ++ * ++ * If the device is in a ERROR-WARNING or ERROR-PASSIVE state, check if ++ * the performed RX/TX has caused it to drop to a lesser state and set ++ * the interface state accordingly. ++ */ ++static void xcan_update_error_state_after_rxtx(struct net_device *ndev) ++{ ++ struct xcan_priv *priv = netdev_priv(ndev); ++ enum can_state old_state = priv->can.state; ++ enum can_state new_state; ++ ++ /* changing error state due to successful frame RX/TX can only ++ * occur from these states ++ */ ++ if (old_state != CAN_STATE_ERROR_WARNING && ++ old_state != CAN_STATE_ERROR_PASSIVE) ++ return; ++ ++ new_state = xcan_current_error_state(ndev); ++ ++ if (new_state != old_state) { ++ struct sk_buff *skb; ++ struct can_frame *cf; ++ ++ skb = alloc_can_err_skb(ndev, &cf); ++ ++ xcan_set_error_state(ndev, new_state, skb ? cf : NULL); ++ ++ if (skb) { ++ struct net_device_stats *stats = &ndev->stats; ++ ++ stats->rx_packets++; ++ stats->rx_bytes += cf->can_dlc; ++ netif_rx(skb); ++ } ++ } ++} ++ + /** + * xcan_err_interrupt - error frame Isr + * @ndev: net_device pointer +@@ -544,16 +685,12 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + struct net_device_stats *stats = &ndev->stats; + struct can_frame *cf; + struct sk_buff *skb; +- u32 err_status, status, txerr = 0, rxerr = 0; ++ u32 err_status; + + skb = alloc_can_err_skb(ndev, &cf); + + err_status = priv->read_reg(priv, XCAN_ESR_OFFSET); + priv->write_reg(priv, XCAN_ESR_OFFSET, err_status); +- txerr = priv->read_reg(priv, XCAN_ECR_OFFSET) & XCAN_ECR_TEC_MASK; +- rxerr = ((priv->read_reg(priv, XCAN_ECR_OFFSET) & +- XCAN_ECR_REC_MASK) >> XCAN_ESR_REC_SHIFT); +- status = priv->read_reg(priv, XCAN_SR_OFFSET); + + if (isr & XCAN_IXR_BSOFF_MASK) { + priv->can.state = CAN_STATE_BUS_OFF; +@@ -563,28 +700,10 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + can_bus_off(ndev); + if (skb) + cf->can_id |= CAN_ERR_BUSOFF; +- } else if ((status & XCAN_SR_ESTAT_MASK) == XCAN_SR_ESTAT_MASK) { +- priv->can.state = CAN_STATE_ERROR_PASSIVE; +- priv->can.can_stats.error_passive++; +- if (skb) { +- cf->can_id |= CAN_ERR_CRTL; +- cf->data[1] = (rxerr > 127) ? +- CAN_ERR_CRTL_RX_PASSIVE : +- CAN_ERR_CRTL_TX_PASSIVE; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } +- } else if (status & XCAN_SR_ERRWRN_MASK) { +- priv->can.state = CAN_STATE_ERROR_WARNING; +- priv->can.can_stats.error_warning++; +- if (skb) { +- cf->can_id |= CAN_ERR_CRTL; +- cf->data[1] |= (txerr > rxerr) ? +- CAN_ERR_CRTL_TX_WARNING : +- CAN_ERR_CRTL_RX_WARNING; +- cf->data[6] = txerr; +- cf->data[7] = rxerr; +- } ++ } else { ++ enum can_state new_state = xcan_current_error_state(ndev); ++ ++ xcan_set_error_state(ndev, new_state, skb ? cf : NULL); + } + + /* Check for Arbitration lost interrupt */ +@@ -600,7 +719,6 @@ static void xcan_err_interrupt(struct net_device *ndev, u32 isr) + if (isr & XCAN_IXR_RXOFLW_MASK) { + stats->rx_over_errors++; + stats->rx_errors++; +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); + if (skb) { + cf->can_id |= CAN_ERR_CRTL; + cf->data[1] |= CAN_ERR_CRTL_RX_OVERFLOW; +@@ -709,26 +827,20 @@ static int xcan_rx_poll(struct napi_struct *napi, int quota) + + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + while ((isr & XCAN_IXR_RXNEMP_MASK) && (work_done < quota)) { +- if (isr & XCAN_IXR_RXOK_MASK) { +- priv->write_reg(priv, XCAN_ICR_OFFSET, +- XCAN_IXR_RXOK_MASK); +- work_done += xcan_rx(ndev); +- } else { +- priv->write_reg(priv, XCAN_ICR_OFFSET, +- XCAN_IXR_RXNEMP_MASK); +- break; +- } ++ work_done += xcan_rx(ndev); + priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_RXNEMP_MASK); + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + } + +- if (work_done) ++ if (work_done) { + can_led_event(ndev, CAN_LED_EVENT_RX); ++ xcan_update_error_state_after_rxtx(ndev); ++ } + + if (work_done < quota) { + napi_complete_done(napi, work_done); + ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier |= (XCAN_IXR_RXOK_MASK | XCAN_IXR_RXNEMP_MASK); ++ ier |= XCAN_IXR_RXNEMP_MASK; + priv->write_reg(priv, XCAN_IER_OFFSET, ier); + } + return work_done; +@@ -743,18 +855,71 @@ static void xcan_tx_interrupt(struct net_device *ndev, u32 isr) + { + struct xcan_priv *priv = netdev_priv(ndev); + struct net_device_stats *stats = &ndev->stats; ++ unsigned int frames_in_fifo; ++ int frames_sent = 1; /* TXOK => at least 1 frame was sent */ ++ unsigned long flags; ++ int retries = 0; ++ ++ /* Synchronize with xmit as we need to know the exact number ++ * of frames in the FIFO to stay in sync due to the TXFEMP ++ * handling. ++ * This also prevents a race between netif_wake_queue() and ++ * netif_stop_queue(). ++ */ ++ spin_lock_irqsave(&priv->tx_lock, flags); ++ ++ frames_in_fifo = priv->tx_head - priv->tx_tail; ++ ++ if (WARN_ON_ONCE(frames_in_fifo == 0)) { ++ /* clear TXOK anyway to avoid getting back here */ ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ return; ++ } ++ ++ /* Check if 2 frames were sent (TXOK only means that at least 1 ++ * frame was sent). ++ */ ++ if (frames_in_fifo > 1) { ++ WARN_ON(frames_in_fifo > priv->tx_max); ++ ++ /* Synchronize TXOK and isr so that after the loop: ++ * (1) isr variable is up-to-date at least up to TXOK clear ++ * time. This avoids us clearing a TXOK of a second frame ++ * but not noticing that the FIFO is now empty and thus ++ * marking only a single frame as sent. ++ * (2) No TXOK is left. Having one could mean leaving a ++ * stray TXOK as we might process the associated frame ++ * via TXFEMP handling as we read TXFEMP *after* TXOK ++ * clear to satisfy (1). ++ */ ++ while ((isr & XCAN_IXR_TXOK_MASK) && !WARN_ON(++retries == 100)) { ++ priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ isr = priv->read_reg(priv, XCAN_ISR_OFFSET); ++ } + +- while ((priv->tx_head - priv->tx_tail > 0) && +- (isr & XCAN_IXR_TXOK_MASK)) { ++ if (isr & XCAN_IXR_TXFEMP_MASK) { ++ /* nothing in FIFO anymore */ ++ frames_sent = frames_in_fifo; ++ } ++ } else { ++ /* single frame in fifo, just clear TXOK */ + priv->write_reg(priv, XCAN_ICR_OFFSET, XCAN_IXR_TXOK_MASK); ++ } ++ ++ while (frames_sent--) { + can_get_echo_skb(ndev, priv->tx_tail % + priv->tx_max); + priv->tx_tail++; + stats->tx_packets++; +- isr = priv->read_reg(priv, XCAN_ISR_OFFSET); + } +- can_led_event(ndev, CAN_LED_EVENT_TX); ++ + netif_wake_queue(ndev); ++ ++ spin_unlock_irqrestore(&priv->tx_lock, flags); ++ ++ can_led_event(ndev, CAN_LED_EVENT_TX); ++ xcan_update_error_state_after_rxtx(ndev); + } + + /** +@@ -773,6 +938,7 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + struct net_device *ndev = (struct net_device *)dev_id; + struct xcan_priv *priv = netdev_priv(ndev); + u32 isr, ier; ++ u32 isr_errors; + + /* Get the interrupt status from Xilinx CAN */ + isr = priv->read_reg(priv, XCAN_ISR_OFFSET); +@@ -791,18 +957,17 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + xcan_tx_interrupt(ndev, isr); + + /* Check for the type of error interrupt and Processing it */ +- if (isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK | +- XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK)) { +- priv->write_reg(priv, XCAN_ICR_OFFSET, (XCAN_IXR_ERROR_MASK | +- XCAN_IXR_RXOFLW_MASK | XCAN_IXR_BSOFF_MASK | +- XCAN_IXR_ARBLST_MASK)); ++ isr_errors = isr & (XCAN_IXR_ERROR_MASK | XCAN_IXR_RXOFLW_MASK | ++ XCAN_IXR_BSOFF_MASK | XCAN_IXR_ARBLST_MASK); ++ if (isr_errors) { ++ priv->write_reg(priv, XCAN_ICR_OFFSET, isr_errors); + xcan_err_interrupt(ndev, isr); + } + + /* Check for the type of receive interrupt and Processing it */ +- if (isr & (XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK)) { ++ if (isr & XCAN_IXR_RXNEMP_MASK) { + ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier &= ~(XCAN_IXR_RXNEMP_MASK | XCAN_IXR_RXOK_MASK); ++ ier &= ~XCAN_IXR_RXNEMP_MASK; + priv->write_reg(priv, XCAN_IER_OFFSET, ier); + napi_schedule(&priv->napi); + } +@@ -819,13 +984,9 @@ static irqreturn_t xcan_interrupt(int irq, void *dev_id) + static void xcan_chip_stop(struct net_device *ndev) + { + struct xcan_priv *priv = netdev_priv(ndev); +- u32 ier; + + /* Disable interrupts and leave the can in configuration mode */ +- ier = priv->read_reg(priv, XCAN_IER_OFFSET); +- ier &= ~XCAN_INTR_ALL; +- priv->write_reg(priv, XCAN_IER_OFFSET, ier); +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); ++ set_reset_mode(ndev); + priv->can.state = CAN_STATE_STOPPED; + } + +@@ -958,10 +1119,15 @@ static const struct net_device_ops xcan_netdev_ops = { + */ + static int __maybe_unused xcan_suspend(struct device *dev) + { +- if (!device_may_wakeup(dev)) +- return pm_runtime_force_suspend(dev); ++ struct net_device *ndev = dev_get_drvdata(dev); + +- return 0; ++ if (netif_running(ndev)) { ++ netif_stop_queue(ndev); ++ netif_device_detach(ndev); ++ xcan_chip_stop(ndev); ++ } ++ ++ return pm_runtime_force_suspend(dev); + } + + /** +@@ -973,11 +1139,27 @@ static int __maybe_unused xcan_suspend(struct device *dev) + */ + static int __maybe_unused xcan_resume(struct device *dev) + { +- if (!device_may_wakeup(dev)) +- return pm_runtime_force_resume(dev); ++ struct net_device *ndev = dev_get_drvdata(dev); ++ int ret; + +- return 0; ++ ret = pm_runtime_force_resume(dev); ++ if (ret) { ++ dev_err(dev, "pm_runtime_force_resume failed on resume\n"); ++ return ret; ++ } ++ ++ if (netif_running(ndev)) { ++ ret = xcan_chip_start(ndev); ++ if (ret) { ++ dev_err(dev, "xcan_chip_start failed on resume\n"); ++ return ret; ++ } ++ ++ netif_device_attach(ndev); ++ netif_start_queue(ndev); ++ } + ++ return 0; + } + + /** +@@ -992,14 +1174,6 @@ static int __maybe_unused xcan_runtime_suspend(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct xcan_priv *priv = netdev_priv(ndev); + +- if (netif_running(ndev)) { +- netif_stop_queue(ndev); +- netif_device_detach(ndev); +- } +- +- priv->write_reg(priv, XCAN_MSR_OFFSET, XCAN_MSR_SLEEP_MASK); +- priv->can.state = CAN_STATE_SLEEPING; +- + clk_disable_unprepare(priv->bus_clk); + clk_disable_unprepare(priv->can_clk); + +@@ -1018,7 +1192,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev) + struct net_device *ndev = dev_get_drvdata(dev); + struct xcan_priv *priv = netdev_priv(ndev); + int ret; +- u32 isr, status; + + ret = clk_prepare_enable(priv->bus_clk); + if (ret) { +@@ -1032,27 +1205,6 @@ static int __maybe_unused xcan_runtime_resume(struct device *dev) + return ret; + } + +- priv->write_reg(priv, XCAN_SRR_OFFSET, XCAN_SRR_RESET_MASK); +- isr = priv->read_reg(priv, XCAN_ISR_OFFSET); +- status = priv->read_reg(priv, XCAN_SR_OFFSET); +- +- if (netif_running(ndev)) { +- if (isr & XCAN_IXR_BSOFF_MASK) { +- priv->can.state = CAN_STATE_BUS_OFF; +- priv->write_reg(priv, XCAN_SRR_OFFSET, +- XCAN_SRR_RESET_MASK); +- } else if ((status & XCAN_SR_ESTAT_MASK) == +- XCAN_SR_ESTAT_MASK) { +- priv->can.state = CAN_STATE_ERROR_PASSIVE; +- } else if (status & XCAN_SR_ERRWRN_MASK) { +- priv->can.state = CAN_STATE_ERROR_WARNING; +- } else { +- priv->can.state = CAN_STATE_ERROR_ACTIVE; +- } +- netif_device_attach(ndev); +- netif_start_queue(ndev); +- } +- + return 0; + } + +@@ -1061,6 +1213,18 @@ static const struct dev_pm_ops xcan_dev_pm_ops = { + SET_RUNTIME_PM_OPS(xcan_runtime_suspend, xcan_runtime_resume, NULL) + }; + ++static const struct xcan_devtype_data xcan_zynq_data = { ++ .caps = XCAN_CAP_WATERMARK, ++}; ++ ++/* Match table for OF platform binding */ ++static const struct of_device_id xcan_of_match[] = { ++ { .compatible = "xlnx,zynq-can-1.0", .data = &xcan_zynq_data }, ++ { .compatible = "xlnx,axi-can-1.00.a", }, ++ { /* end of list */ }, ++}; ++MODULE_DEVICE_TABLE(of, xcan_of_match); ++ + /** + * xcan_probe - Platform registration call + * @pdev: Handle to the platform device structure +@@ -1075,8 +1239,10 @@ static int xcan_probe(struct platform_device *pdev) + struct resource *res; /* IO mem resources */ + struct net_device *ndev; + struct xcan_priv *priv; ++ const struct of_device_id *of_id; ++ int caps = 0; + void __iomem *addr; +- int ret, rx_max, tx_max; ++ int ret, rx_max, tx_max, tx_fifo_depth; + + /* Get the virtual base address for the device */ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); +@@ -1086,7 +1252,8 @@ static int xcan_probe(struct platform_device *pdev) + goto err; + } + +- ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", &tx_max); ++ ret = of_property_read_u32(pdev->dev.of_node, "tx-fifo-depth", ++ &tx_fifo_depth); + if (ret < 0) + goto err; + +@@ -1094,6 +1261,30 @@ static int xcan_probe(struct platform_device *pdev) + if (ret < 0) + goto err; + ++ of_id = of_match_device(xcan_of_match, &pdev->dev); ++ if (of_id) { ++ const struct xcan_devtype_data *devtype_data = of_id->data; ++ ++ if (devtype_data) ++ caps = devtype_data->caps; ++ } ++ ++ /* There is no way to directly figure out how many frames have been ++ * sent when the TXOK interrupt is processed. If watermark programming ++ * is supported, we can have 2 frames in the FIFO and use TXFEMP ++ * to determine if 1 or 2 frames have been sent. ++ * Theoretically we should be able to use TXFWMEMP to determine up ++ * to 3 frames, but it seems that after putting a second frame in the ++ * FIFO, with watermark at 2 frames, it can happen that TXFWMEMP (less ++ * than 2 frames in FIFO) is set anyway with no TXOK (a frame was ++ * sent), which is not a sensible state - possibly TXFWMEMP is not ++ * completely synchronized with the rest of the bits? ++ */ ++ if (caps & XCAN_CAP_WATERMARK) ++ tx_max = min(tx_fifo_depth, 2); ++ else ++ tx_max = 1; ++ + /* Create a CAN device instance */ + ndev = alloc_candev(sizeof(struct xcan_priv), tx_max); + if (!ndev) +@@ -1108,6 +1299,7 @@ static int xcan_probe(struct platform_device *pdev) + CAN_CTRLMODE_BERR_REPORTING; + priv->reg_base = addr; + priv->tx_max = tx_max; ++ spin_lock_init(&priv->tx_lock); + + /* Get IRQ for the device */ + ndev->irq = platform_get_irq(pdev, 0); +@@ -1172,9 +1364,9 @@ static int xcan_probe(struct platform_device *pdev) + + pm_runtime_put(&pdev->dev); + +- netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth:%d\n", ++ netdev_dbg(ndev, "reg_base=0x%p irq=%d clock=%d, tx fifo depth: actual %d, using %d\n", + priv->reg_base, ndev->irq, priv->can.clock.freq, +- priv->tx_max); ++ tx_fifo_depth, priv->tx_max); + + return 0; + +@@ -1208,14 +1400,6 @@ static int xcan_remove(struct platform_device *pdev) + return 0; + } + +-/* Match table for OF platform binding */ +-static const struct of_device_id xcan_of_match[] = { +- { .compatible = "xlnx,zynq-can-1.0", }, +- { .compatible = "xlnx,axi-can-1.00.a", }, +- { /* end of list */ }, +-}; +-MODULE_DEVICE_TABLE(of, xcan_of_match); +- + static struct platform_driver xcan_driver = { + .probe = xcan_probe, + .remove = xcan_remove, +diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +index a069fcc823c3..b26da0952a4d 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c ++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c +@@ -2957,7 +2957,7 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave, + u32 srqn = qp_get_srqn(qpc) & 0xffffff; + int use_srq = (qp_get_srqn(qpc) >> 24) & 1; + struct res_srq *srq; +- int local_qpn = be32_to_cpu(qpc->local_qpn) & 0xffffff; ++ int local_qpn = vhcr->in_modifier & 0xffffff; + + err = adjust_qp_sched_queue(dev, slave, qpc, inbox); + if (err) +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +index 12d3ced61114..e87923e046c9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_arfs.c +@@ -381,14 +381,14 @@ static void arfs_may_expire_flow(struct mlx5e_priv *priv) + HLIST_HEAD(del_list); + spin_lock_bh(&priv->fs.arfs.arfs_lock); + mlx5e_for_each_arfs_rule(arfs_rule, htmp, priv->fs.arfs.arfs_tables, i, j) { +- if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA) +- break; + if (!work_pending(&arfs_rule->arfs_work) && + rps_may_expire_flow(priv->netdev, + arfs_rule->rxq, arfs_rule->flow_id, + arfs_rule->filter_id)) { + hlist_del_init(&arfs_rule->hlist); + hlist_add_head(&arfs_rule->hlist, &del_list); ++ if (quota++ > MLX5E_ARFS_EXPIRY_QUOTA) ++ break; + } + } + spin_unlock_bh(&priv->fs.arfs.arfs_lock); +@@ -711,6 +711,9 @@ int mlx5e_rx_flow_steer(struct net_device *dev, const struct sk_buff *skb, + skb->protocol != htons(ETH_P_IPV6)) + return -EPROTONOSUPPORT; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + arfs_t = arfs_get_table(arfs, arfs_get_ip_proto(skb), skb->protocol); + if (!arfs_t) + return -EPROTONOSUPPORT; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c +index 84dd63e74041..27040009d87a 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_clock.c +@@ -545,6 +545,7 @@ void mlx5e_pps_event_handler(struct mlx5e_priv *priv, + void mlx5e_timestamp_init(struct mlx5e_priv *priv) + { + struct mlx5e_tstamp *tstamp = &priv->tstamp; ++ u64 overflow_cycles; + u64 ns; + u64 frac = 0; + u32 dev_freq; +@@ -569,10 +570,17 @@ void mlx5e_timestamp_init(struct mlx5e_priv *priv) + + /* Calculate period in seconds to call the overflow watchdog - to make + * sure counter is checked at least once every wrap around. ++ * The period is calculated as the minimum between max HW cycles count ++ * (The clock source mask) and max amount of cycles that can be ++ * multiplied by clock multiplier where the result doesn't exceed ++ * 64bits. + */ +- ns = cyclecounter_cyc2ns(&tstamp->cycles, tstamp->cycles.mask, ++ overflow_cycles = div64_u64(~0ULL >> 1, tstamp->cycles.mult); ++ overflow_cycles = min(overflow_cycles, tstamp->cycles.mask >> 1); ++ ++ ns = cyclecounter_cyc2ns(&tstamp->cycles, overflow_cycles, + frac, &frac); +- do_div(ns, NSEC_PER_SEC / 2 / HZ); ++ do_div(ns, NSEC_PER_SEC / HZ); + tstamp->overflow_period = ns; + + INIT_WORK(&tstamp->pps_info.out_work, mlx5e_pps_out); +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c +index dba6d17ad885..47d2ef2fb9b3 100644 +--- a/drivers/net/phy/phy.c ++++ b/drivers/net/phy/phy.c +@@ -511,7 +511,7 @@ static int phy_start_aneg_priv(struct phy_device *phydev, bool sync) + * negotiation may already be done and aneg interrupt may not be + * generated. + */ +- if (phy_interrupt_is_valid(phydev) && (phydev->state == PHY_AN)) { ++ if (phydev->irq != PHY_POLL && phydev->state == PHY_AN) { + err = phy_aneg_done(phydev); + if (err > 0) { + trigger = true; +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index bbdb46916dc3..13d39a72fe0d 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -636,8 +636,61 @@ static int vxlan_gro_complete(struct sock *sk, struct sk_buff *skb, int nhoff) + return eth_gro_complete(skb, nhoff + sizeof(struct vxlanhdr)); + } + +-/* Add new entry to forwarding table -- assumes lock held */ ++static struct vxlan_fdb *vxlan_fdb_alloc(struct vxlan_dev *vxlan, ++ const u8 *mac, __u16 state, ++ __be32 src_vni, __u8 ndm_flags) ++{ ++ struct vxlan_fdb *f; ++ ++ f = kmalloc(sizeof(*f), GFP_ATOMIC); ++ if (!f) ++ return NULL; ++ f->state = state; ++ f->flags = ndm_flags; ++ f->updated = f->used = jiffies; ++ f->vni = src_vni; ++ INIT_LIST_HEAD(&f->remotes); ++ memcpy(f->eth_addr, mac, ETH_ALEN); ++ ++ return f; ++} ++ + static int vxlan_fdb_create(struct vxlan_dev *vxlan, ++ const u8 *mac, union vxlan_addr *ip, ++ __u16 state, __be16 port, __be32 src_vni, ++ __be32 vni, __u32 ifindex, __u8 ndm_flags, ++ struct vxlan_fdb **fdb) ++{ ++ struct vxlan_rdst *rd = NULL; ++ struct vxlan_fdb *f; ++ int rc; ++ ++ if (vxlan->cfg.addrmax && ++ vxlan->addrcnt >= vxlan->cfg.addrmax) ++ return -ENOSPC; ++ ++ netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); ++ f = vxlan_fdb_alloc(vxlan, mac, state, src_vni, ndm_flags); ++ if (!f) ++ return -ENOMEM; ++ ++ rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); ++ if (rc < 0) { ++ kfree(f); ++ return rc; ++ } ++ ++ ++vxlan->addrcnt; ++ hlist_add_head_rcu(&f->hlist, ++ vxlan_fdb_head(vxlan, mac, src_vni)); ++ ++ *fdb = f; ++ ++ return 0; ++} ++ ++/* Add new entry to forwarding table -- assumes lock held */ ++static int vxlan_fdb_update(struct vxlan_dev *vxlan, + const u8 *mac, union vxlan_addr *ip, + __u16 state, __u16 flags, + __be16 port, __be32 src_vni, __be32 vni, +@@ -687,37 +740,17 @@ static int vxlan_fdb_create(struct vxlan_dev *vxlan, + if (!(flags & NLM_F_CREATE)) + return -ENOENT; + +- if (vxlan->cfg.addrmax && +- vxlan->addrcnt >= vxlan->cfg.addrmax) +- return -ENOSPC; +- + /* Disallow replace to add a multicast entry */ + if ((flags & NLM_F_REPLACE) && + (is_multicast_ether_addr(mac) || is_zero_ether_addr(mac))) + return -EOPNOTSUPP; + + netdev_dbg(vxlan->dev, "add %pM -> %pIS\n", mac, ip); +- f = kmalloc(sizeof(*f), GFP_ATOMIC); +- if (!f) +- return -ENOMEM; +- +- notify = 1; +- f->state = state; +- f->flags = ndm_flags; +- f->updated = f->used = jiffies; +- f->vni = src_vni; +- INIT_LIST_HEAD(&f->remotes); +- memcpy(f->eth_addr, mac, ETH_ALEN); +- +- rc = vxlan_fdb_append(f, ip, port, vni, ifindex, &rd); +- if (rc < 0) { +- kfree(f); ++ rc = vxlan_fdb_create(vxlan, mac, ip, state, port, src_vni, ++ vni, ifindex, ndm_flags, &f); ++ if (rc < 0) + return rc; +- } +- +- ++vxlan->addrcnt; +- hlist_add_head_rcu(&f->hlist, +- vxlan_fdb_head(vxlan, mac, src_vni)); ++ notify = 1; + } + + if (notify) { +@@ -741,13 +774,15 @@ static void vxlan_fdb_free(struct rcu_head *head) + kfree(f); + } + +-static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f) ++static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f, ++ bool do_notify) + { + netdev_dbg(vxlan->dev, + "delete %pM\n", f->eth_addr); + + --vxlan->addrcnt; +- vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH); ++ if (do_notify) ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_DELNEIGH); + + hlist_del_rcu(&f->hlist); + call_rcu(&f->rcu, vxlan_fdb_free); +@@ -863,7 +898,7 @@ static int vxlan_fdb_add(struct ndmsg *ndm, struct nlattr *tb[], + return -EAFNOSUPPORT; + + spin_lock_bh(&vxlan->hash_lock); +- err = vxlan_fdb_create(vxlan, addr, &ip, ndm->ndm_state, flags, ++ err = vxlan_fdb_update(vxlan, addr, &ip, ndm->ndm_state, flags, + port, src_vni, vni, ifindex, ndm->ndm_flags); + spin_unlock_bh(&vxlan->hash_lock); + +@@ -897,7 +932,7 @@ static int __vxlan_fdb_delete(struct vxlan_dev *vxlan, + goto out; + } + +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + + out: + return 0; +@@ -1006,7 +1041,7 @@ static bool vxlan_snoop(struct net_device *dev, + + /* close off race between vxlan_flush and incoming packets */ + if (netif_running(dev)) +- vxlan_fdb_create(vxlan, src_mac, src_ip, ++ vxlan_fdb_update(vxlan, src_mac, src_ip, + NUD_REACHABLE, + NLM_F_EXCL|NLM_F_CREATE, + vxlan->cfg.dst_port, +@@ -2360,7 +2395,7 @@ static void vxlan_cleanup(unsigned long arg) + "garbage collect %pM\n", + f->eth_addr); + f->state = NUD_STALE; +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + } else if (time_before(timeout, next_timer)) + next_timer = timeout; + } +@@ -2411,7 +2446,7 @@ static void vxlan_fdb_delete_default(struct vxlan_dev *vxlan, __be32 vni) + spin_lock_bh(&vxlan->hash_lock); + f = __vxlan_find_mac(vxlan, all_zeros_mac, vni); + if (f) +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + spin_unlock_bh(&vxlan->hash_lock); + } + +@@ -2465,7 +2500,7 @@ static void vxlan_flush(struct vxlan_dev *vxlan, bool do_all) + continue; + /* the all_zeros_mac entry is deleted at vxlan_uninit */ + if (!is_zero_ether_addr(f->eth_addr)) +- vxlan_fdb_destroy(vxlan, f); ++ vxlan_fdb_destroy(vxlan, f, true); + } + } + spin_unlock_bh(&vxlan->hash_lock); +@@ -3157,6 +3192,7 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + { + struct vxlan_net *vn = net_generic(net, vxlan_net_id); + struct vxlan_dev *vxlan = netdev_priv(dev); ++ struct vxlan_fdb *f = NULL; + int err; + + err = vxlan_dev_configure(net, dev, conf, false, extack); +@@ -3170,24 +3206,35 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + err = vxlan_fdb_create(vxlan, all_zeros_mac, + &vxlan->default_dst.remote_ip, + NUD_REACHABLE | NUD_PERMANENT, +- NLM_F_EXCL | NLM_F_CREATE, + vxlan->cfg.dst_port, + vxlan->default_dst.remote_vni, + vxlan->default_dst.remote_vni, + vxlan->default_dst.remote_ifindex, +- NTF_SELF); ++ NTF_SELF, &f); + if (err) + return err; + } + + err = register_netdevice(dev); ++ if (err) ++ goto errout; ++ ++ err = rtnl_configure_link(dev, NULL); + if (err) { +- vxlan_fdb_delete_default(vxlan, vxlan->default_dst.remote_vni); +- return err; ++ unregister_netdevice(dev); ++ goto errout; + } + ++ /* notify default fdb entry */ ++ if (f) ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH); ++ + list_add(&vxlan->next, &vn->vxlan_list); + return 0; ++errout: ++ if (f) ++ vxlan_fdb_destroy(vxlan, f, false); ++ return err; + } + + static int vxlan_nl2conf(struct nlattr *tb[], struct nlattr *data[], +@@ -3416,6 +3463,7 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + struct vxlan_rdst *dst = &vxlan->default_dst; + struct vxlan_rdst old_dst; + struct vxlan_config conf; ++ struct vxlan_fdb *f = NULL; + int err; + + err = vxlan_nl2conf(tb, data, +@@ -3444,16 +3492,16 @@ static int vxlan_changelink(struct net_device *dev, struct nlattr *tb[], + err = vxlan_fdb_create(vxlan, all_zeros_mac, + &dst->remote_ip, + NUD_REACHABLE | NUD_PERMANENT, +- NLM_F_CREATE | NLM_F_APPEND, + vxlan->cfg.dst_port, + dst->remote_vni, + dst->remote_vni, + dst->remote_ifindex, +- NTF_SELF); ++ NTF_SELF, &f); + if (err) { + spin_unlock_bh(&vxlan->hash_lock); + return err; + } ++ vxlan_fdb_notify(vxlan, f, first_remote_rtnl(f), RTM_NEWNEIGH); + } + spin_unlock_bh(&vxlan->hash_lock); + } +diff --git a/drivers/staging/speakup/speakup_soft.c b/drivers/staging/speakup/speakup_soft.c +index d99daf69e501..fe229d63deec 100644 +--- a/drivers/staging/speakup/speakup_soft.c ++++ b/drivers/staging/speakup/speakup_soft.c +@@ -207,11 +207,15 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + int chars_sent = 0; + char __user *cp; + char *init; ++ size_t bytes_per_ch = unicode ? 3 : 1; + u16 ch; + int empty; + unsigned long flags; + DEFINE_WAIT(wait); + ++ if (count < bytes_per_ch) ++ return -EINVAL; ++ + spin_lock_irqsave(&speakup_info.spinlock, flags); + while (1) { + prepare_to_wait(&speakup_event, &wait, TASK_INTERRUPTIBLE); +@@ -237,7 +241,7 @@ static ssize_t softsynthx_read(struct file *fp, char __user *buf, size_t count, + init = get_initstring(); + + /* Keep 3 bytes available for a 16bit UTF-8-encoded character */ +- while (chars_sent <= count - 3) { ++ while (chars_sent <= count - bytes_per_ch) { + if (speakup_info.flushing) { + speakup_info.flushing = 0; + ch = '\x18'; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 3b9aadd007f5..f2f31fc16f29 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -1844,6 +1844,9 @@ static const struct usb_device_id acm_ids[] = { + { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ + .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ + }, ++ { USB_DEVICE(0x0ca6, 0xa050), /* Castles VEGA3000 */ ++ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ ++ }, + + { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ + .driver_info = CLEAR_HALT_CONDITIONS, +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index e5f77e611451..a8bc48b26c23 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -1141,10 +1141,14 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) + + if (!udev || udev->state == USB_STATE_NOTATTACHED) { + /* Tell hub_wq to disconnect the device or +- * check for a new connection ++ * check for a new connection or over current condition. ++ * Based on USB2.0 Spec Section 11.12.5, ++ * C_PORT_OVER_CURRENT could be set while ++ * PORT_OVER_CURRENT is not. So check for any of them. + */ + if (udev || (portstatus & USB_PORT_STAT_CONNECTION) || +- (portstatus & USB_PORT_STAT_OVERCURRENT)) ++ (portstatus & USB_PORT_STAT_OVERCURRENT) || ++ (portchange & USB_PORT_STAT_C_OVERCURRENT)) + set_bit(port1, hub->change_bits); + + } else if (portstatus & USB_PORT_STAT_ENABLE) { +diff --git a/drivers/usb/dwc2/hcd.c b/drivers/usb/dwc2/hcd.c +index 87484f71b2ab..46d3b0fc00c5 100644 +--- a/drivers/usb/dwc2/hcd.c ++++ b/drivers/usb/dwc2/hcd.c +@@ -2606,34 +2606,29 @@ static void dwc2_hc_init_xfer(struct dwc2_hsotg *hsotg, + + #define DWC2_USB_DMA_ALIGN 4 + +-struct dma_aligned_buffer { +- void *kmalloc_ptr; +- void *old_xfer_buffer; +- u8 data[0]; +-}; +- + static void dwc2_free_dma_aligned_buffer(struct urb *urb) + { +- struct dma_aligned_buffer *temp; ++ void *stored_xfer_buffer; + + if (!(urb->transfer_flags & URB_ALIGNED_TEMP_BUFFER)) + return; + +- temp = container_of(urb->transfer_buffer, +- struct dma_aligned_buffer, data); ++ /* Restore urb->transfer_buffer from the end of the allocated area */ ++ memcpy(&stored_xfer_buffer, urb->transfer_buffer + ++ urb->transfer_buffer_length, sizeof(urb->transfer_buffer)); + + if (usb_urb_dir_in(urb)) +- memcpy(temp->old_xfer_buffer, temp->data, ++ memcpy(stored_xfer_buffer, urb->transfer_buffer, + urb->transfer_buffer_length); +- urb->transfer_buffer = temp->old_xfer_buffer; +- kfree(temp->kmalloc_ptr); ++ kfree(urb->transfer_buffer); ++ urb->transfer_buffer = stored_xfer_buffer; + + urb->transfer_flags &= ~URB_ALIGNED_TEMP_BUFFER; + } + + static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) + { +- struct dma_aligned_buffer *temp, *kmalloc_ptr; ++ void *kmalloc_ptr; + size_t kmalloc_size; + + if (urb->num_sgs || urb->sg || +@@ -2641,22 +2636,29 @@ static int dwc2_alloc_dma_aligned_buffer(struct urb *urb, gfp_t mem_flags) + !((uintptr_t)urb->transfer_buffer & (DWC2_USB_DMA_ALIGN - 1))) + return 0; + +- /* Allocate a buffer with enough padding for alignment */ ++ /* ++ * Allocate a buffer with enough padding for original transfer_buffer ++ * pointer. This allocation is guaranteed to be aligned properly for ++ * DMA ++ */ + kmalloc_size = urb->transfer_buffer_length + +- sizeof(struct dma_aligned_buffer) + DWC2_USB_DMA_ALIGN - 1; ++ sizeof(urb->transfer_buffer); + + kmalloc_ptr = kmalloc(kmalloc_size, mem_flags); + if (!kmalloc_ptr) + return -ENOMEM; + +- /* Position our struct dma_aligned_buffer such that data is aligned */ +- temp = PTR_ALIGN(kmalloc_ptr + 1, DWC2_USB_DMA_ALIGN) - 1; +- temp->kmalloc_ptr = kmalloc_ptr; +- temp->old_xfer_buffer = urb->transfer_buffer; ++ /* ++ * Position value of original urb->transfer_buffer pointer to the end ++ * of allocation for later referencing ++ */ ++ memcpy(kmalloc_ptr + urb->transfer_buffer_length, ++ &urb->transfer_buffer, sizeof(urb->transfer_buffer)); ++ + if (usb_urb_dir_out(urb)) +- memcpy(temp->data, urb->transfer_buffer, ++ memcpy(kmalloc_ptr, urb->transfer_buffer, + urb->transfer_buffer_length); +- urb->transfer_buffer = temp->data; ++ urb->transfer_buffer = kmalloc_ptr; + + urb->transfer_flags |= URB_ALIGNED_TEMP_BUFFER; + +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 7b53ac548b1a..52e6897fa35a 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3243,7 +3243,7 @@ static int ffs_func_setup(struct usb_function *f, + __ffs_event_add(ffs, FUNCTIONFS_SETUP); + spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags); + +- return USB_GADGET_DELAYED_STATUS; ++ return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0; + } + + static bool ffs_func_req_match(struct usb_function *f, +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index b751dd60e41a..b4c68f3b82be 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -467,7 +467,7 @@ static int tce_iommu_prereg_ua_to_hpa(struct tce_container *container, + if (!mem) + return -EINVAL; + +- ret = mm_iommu_ua_to_hpa(mem, tce, phpa); ++ ret = mm_iommu_ua_to_hpa(mem, tce, shift, phpa); + if (ret) + return -EINVAL; + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 0480cd9a9e81..71b81980787f 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -338,10 +338,7 @@ smb2_plain_req_init(__le16 smb2_command, struct cifs_tcon *tcon, + return rc; + + /* BB eventually switch this to SMB2 specific small buf size */ +- if (smb2_command == SMB2_SET_INFO) +- *request_buf = cifs_buf_get(); +- else +- *request_buf = cifs_small_buf_get(); ++ *request_buf = cifs_small_buf_get(); + if (*request_buf == NULL) { + /* BB should we add a retry in here if not a writepage? */ + return -ENOMEM; +@@ -3171,7 +3168,7 @@ send_set_info(const unsigned int xid, struct cifs_tcon *tcon, + } + + rc = SendReceive2(xid, ses, iov, num, &resp_buftype, flags, &rsp_iov); +- cifs_buf_release(req); ++ cifs_small_buf_release(req); + rsp = (struct smb2_set_info_rsp *)rsp_iov.iov_base; + + if (rc != 0) +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 9cf971c68401..6dd77767fd5b 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -3167,6 +3167,8 @@ static inline int __skb_grow_rcsum(struct sk_buff *skb, unsigned int len) + return __skb_grow(skb, len); + } + ++#define rb_to_skb(rb) rb_entry_safe(rb, struct sk_buff, rbnode) ++ + #define skb_queue_walk(queue, skb) \ + for (skb = (queue)->next; \ + skb != (struct sk_buff *)(queue); \ +diff --git a/include/net/tcp.h b/include/net/tcp.h +index fb653736f335..3173dd12b8cc 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -372,6 +372,7 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); + ++void tcp_enter_quickack_mode(struct sock *sk); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +@@ -560,6 +561,7 @@ void tcp_send_fin(struct sock *sk); + void tcp_send_active_reset(struct sock *sk, gfp_t priority); + int tcp_send_synack(struct sock *); + void tcp_push_one(struct sock *, unsigned int mss_now); ++void __tcp_send_ack(struct sock *sk, u32 rcv_nxt); + void tcp_send_ack(struct sock *sk); + void tcp_send_delayed_ack(struct sock *sk); + void tcp_send_loss_probe(struct sock *sk); +@@ -857,6 +859,11 @@ struct tcp_skb_cb { + * as TCP moves IP6CB into a different location in skb->cb[] + */ + static inline int tcp_v6_iif(const struct sk_buff *skb) ++{ ++ return TCP_SKB_CB(skb)->header.h6.iif; ++} ++ ++static inline int tcp_v6_iif_l3_slave(const struct sk_buff *skb) + { + bool l3_slave = ipv6_l3mdev_skb(TCP_SKB_CB(skb)->header.h6.flags); + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 4cfdad08aca0..efe396cc77b5 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2402,9 +2402,12 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm) + return err; + } + +- dev->rtnl_link_state = RTNL_LINK_INITIALIZED; +- +- __dev_notify_flags(dev, old_flags, ~0U); ++ if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) { ++ __dev_notify_flags(dev, old_flags, 0U); ++ } else { ++ dev->rtnl_link_state = RTNL_LINK_INITIALIZED; ++ __dev_notify_flags(dev, old_flags, ~0U); ++ } + return 0; + } + EXPORT_SYMBOL(rtnl_configure_link); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 23041b5c0b27..2e5eeba97de9 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -3675,6 +3675,7 @@ normal: + net_warn_ratelimited( + "skb_segment: too many frags: %u %u\n", + pos, mss); ++ err = -EINVAL; + goto err; + } + +@@ -3713,11 +3714,10 @@ skip_fraglist: + + perform_csum_check: + if (!csum) { +- if (skb_has_shared_frag(nskb)) { +- err = __skb_linearize(nskb); +- if (err) +- goto err; +- } ++ if (skb_has_shared_frag(nskb) && ++ __skb_linearize(nskb)) ++ goto err; ++ + if (!nskb->remcsum_offload) + nskb->ip_summed = CHECKSUM_NONE; + SKB_GSO_CB(nskb)->csum = +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index fbeb35ad804b..502aae3e3ab8 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -1201,8 +1201,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im) + if (pmc) { + im->interface = pmc->interface; + im->crcount = in_dev->mr_qrv ?: net->ipv4.sysctl_igmp_qrv; +- im->sfmode = pmc->sfmode; +- if (pmc->sfmode == MCAST_INCLUDE) { ++ if (im->sfmode == MCAST_INCLUDE) { + im->tomb = pmc->tomb; + im->sources = pmc->sources; + for (psf = im->sources; psf; psf = psf->sf_next) +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index 63d5d66e040a..e2dd325bed9b 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -523,6 +523,8 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from) + to->dev = from->dev; + to->mark = from->mark; + ++ skb_copy_hash(to, from); ++ + /* Copy the flags to each fragment. */ + IPCB(to)->flags = IPCB(from)->flags; + +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index d07ba4d5917b..048d5f6dd320 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -148,15 +148,18 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) + { + struct sockaddr_in sin; + const struct iphdr *iph = ip_hdr(skb); +- __be16 *ports = (__be16 *)skb_transport_header(skb); ++ __be16 *ports; ++ int end; + +- if (skb_transport_offset(skb) + 4 > (int)skb->len) ++ end = skb_transport_offset(skb) + 4; ++ if (end > 0 && !pskb_may_pull(skb, end)) + return; + + /* All current transport protocols have the port numbers in the + * first four bytes of the transport header and this function is + * written with this assumption in mind. + */ ++ ports = (__be16 *)skb_transport_header(skb); + + sin.sin_family = AF_INET; + sin.sin_addr.s_addr = iph->daddr; +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index 5f5e5936760e..c78fb53988a1 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -131,23 +131,14 @@ static void dctcp_ce_state_0_to_1(struct sock *sk) + struct dctcp *ca = inet_csk_ca(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- /* State has changed from CE=0 to CE=1 and delayed +- * ACK has not sent yet. +- */ +- if (!ca->ce_state && ca->delayed_ack_reserved) { +- u32 tmp_rcv_nxt; +- +- /* Save current rcv_nxt. */ +- tmp_rcv_nxt = tp->rcv_nxt; +- +- /* Generate previous ack with CE=0. */ +- tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR; +- tp->rcv_nxt = ca->prior_rcv_nxt; +- +- tcp_send_ack(sk); +- +- /* Recover current rcv_nxt. */ +- tp->rcv_nxt = tmp_rcv_nxt; ++ if (!ca->ce_state) { ++ /* State has changed from CE=0 to CE=1, force an immediate ++ * ACK to reflect the new CE state. If an ACK was delayed, ++ * send that first to reflect the prior CE state. ++ */ ++ if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) ++ __tcp_send_ack(sk, ca->prior_rcv_nxt); ++ tcp_enter_quickack_mode(sk); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +@@ -161,23 +152,14 @@ static void dctcp_ce_state_1_to_0(struct sock *sk) + struct dctcp *ca = inet_csk_ca(sk); + struct tcp_sock *tp = tcp_sk(sk); + +- /* State has changed from CE=1 to CE=0 and delayed +- * ACK has not sent yet. +- */ +- if (ca->ce_state && ca->delayed_ack_reserved) { +- u32 tmp_rcv_nxt; +- +- /* Save current rcv_nxt. */ +- tmp_rcv_nxt = tp->rcv_nxt; +- +- /* Generate previous ack with CE=1. */ +- tp->ecn_flags |= TCP_ECN_DEMAND_CWR; +- tp->rcv_nxt = ca->prior_rcv_nxt; +- +- tcp_send_ack(sk); +- +- /* Recover current rcv_nxt. */ +- tp->rcv_nxt = tmp_rcv_nxt; ++ if (ca->ce_state) { ++ /* State has changed from CE=1 to CE=0, force an immediate ++ * ACK to reflect the new CE state. If an ACK was delayed, ++ * send that first to reflect the prior CE state. ++ */ ++ if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) ++ __tcp_send_ack(sk, ca->prior_rcv_nxt); ++ tcp_enter_quickack_mode(sk); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 5711b1b12d28..b86e7b8beb1d 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -209,13 +209,14 @@ static void tcp_incr_quickack(struct sock *sk) + icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS); + } + +-static void tcp_enter_quickack_mode(struct sock *sk) ++void tcp_enter_quickack_mode(struct sock *sk) + { + struct inet_connection_sock *icsk = inet_csk(sk); + tcp_incr_quickack(sk); + icsk->icsk_ack.pingpong = 0; + icsk->icsk_ack.ato = TCP_ATO_MIN; + } ++EXPORT_SYMBOL(tcp_enter_quickack_mode); + + /* Send ACKs quickly, if "quick" count is not exhausted + * and the session is not interactive. +@@ -4331,6 +4332,23 @@ static bool tcp_try_coalesce(struct sock *sk, + return true; + } + ++static bool tcp_ooo_try_coalesce(struct sock *sk, ++ struct sk_buff *to, ++ struct sk_buff *from, ++ bool *fragstolen) ++{ ++ bool res = tcp_try_coalesce(sk, OOO_QUEUE, to, from, fragstolen); ++ ++ /* In case tcp_drop() is called later, update to->gso_segs */ ++ if (res) { ++ u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) + ++ max_t(u16, 1, skb_shinfo(from)->gso_segs); ++ ++ skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF); ++ } ++ return res; ++} ++ + static void tcp_drop(struct sock *sk, struct sk_buff *skb) + { + sk_drops_add(sk, skb); +@@ -4462,8 +4480,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + /* In the typical case, we are adding an skb to the end of the list. + * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup. + */ +- if (tcp_try_coalesce(sk, OOO_QUEUE, tp->ooo_last_skb, +- skb, &fragstolen)) { ++ if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb, ++ skb, &fragstolen)) { + coalesce_done: + tcp_grow_window(sk, skb); + kfree_skb_partial(skb, fragstolen); +@@ -4491,7 +4509,7 @@ coalesce_done: + /* All the bits are present. Drop. */ + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb); ++ tcp_drop(sk, skb); + skb = NULL; + tcp_dsack_set(sk, seq, end_seq); + goto add_sack; +@@ -4510,11 +4528,11 @@ coalesce_done: + TCP_SKB_CB(skb1)->end_seq); + NET_INC_STATS(sock_net(sk), + LINUX_MIB_TCPOFOMERGE); +- __kfree_skb(skb1); ++ tcp_drop(sk, skb1); + goto merge_right; + } +- } else if (tcp_try_coalesce(sk, OOO_QUEUE, skb1, +- skb, &fragstolen)) { ++ } else if (tcp_ooo_try_coalesce(sk, skb1, ++ skb, &fragstolen)) { + goto coalesce_done; + } + p = &parent->rb_right; +@@ -4876,6 +4894,7 @@ end: + static void tcp_collapse_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); ++ u32 range_truesize, sum_tiny = 0; + struct sk_buff *skb, *head; + struct rb_node *p; + u32 start, end; +@@ -4894,6 +4913,7 @@ new_range: + } + start = TCP_SKB_CB(skb)->seq; + end = TCP_SKB_CB(skb)->end_seq; ++ range_truesize = skb->truesize; + + for (head = skb;;) { + skb = tcp_skb_next(skb, NULL); +@@ -4904,11 +4924,20 @@ new_range: + if (!skb || + after(TCP_SKB_CB(skb)->seq, end) || + before(TCP_SKB_CB(skb)->end_seq, start)) { +- tcp_collapse(sk, NULL, &tp->out_of_order_queue, +- head, skb, start, end); ++ /* Do not attempt collapsing tiny skbs */ ++ if (range_truesize != head->truesize || ++ end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) { ++ tcp_collapse(sk, NULL, &tp->out_of_order_queue, ++ head, skb, start, end); ++ } else { ++ sum_tiny += range_truesize; ++ if (sum_tiny > sk->sk_rcvbuf >> 3) ++ return; ++ } + goto new_range; + } + ++ range_truesize += skb->truesize; + if (unlikely(before(TCP_SKB_CB(skb)->seq, start))) + start = TCP_SKB_CB(skb)->seq; + if (after(TCP_SKB_CB(skb)->end_seq, end)) +@@ -4923,6 +4952,7 @@ new_range: + * 2) not add too big latencies if thousands of packets sit there. + * (But if application shrinks SO_RCVBUF, we could still end up + * freeing whole queue here) ++ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks. + * + * Return true if queue has shrunk. + */ +@@ -4930,20 +4960,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk) + { + struct tcp_sock *tp = tcp_sk(sk); + struct rb_node *node, *prev; ++ int goal; + + if (RB_EMPTY_ROOT(&tp->out_of_order_queue)) + return false; + + NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED); ++ goal = sk->sk_rcvbuf >> 3; + node = &tp->ooo_last_skb->rbnode; + do { + prev = rb_prev(node); + rb_erase(node, &tp->out_of_order_queue); ++ goal -= rb_to_skb(node)->truesize; + tcp_drop(sk, rb_entry(node, struct sk_buff, rbnode)); +- sk_mem_reclaim(sk); +- if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && +- !tcp_under_memory_pressure(sk)) +- break; ++ if (!prev || goal <= 0) { ++ sk_mem_reclaim(sk); ++ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf && ++ !tcp_under_memory_pressure(sk)) ++ break; ++ goal = sk->sk_rcvbuf >> 3; ++ } + node = prev; + } while (node); + tp->ooo_last_skb = rb_entry(prev, struct sk_buff, rbnode); +@@ -4978,6 +5014,9 @@ static int tcp_prune_queue(struct sock *sk) + else if (tcp_under_memory_pressure(sk)) + tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss); + ++ if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf) ++ return 0; ++ + tcp_collapse_ofo_queue(sk); + if (!skb_queue_empty(&sk->sk_receive_queue)) + tcp_collapse(sk, &sk->sk_receive_queue, NULL, +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index abae5196cd3a..3d8f6f342cb1 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -175,8 +175,13 @@ static void tcp_event_data_sent(struct tcp_sock *tp, + } + + /* Account for an ACK we sent. */ +-static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts) ++static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts, ++ u32 rcv_nxt) + { ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (unlikely(rcv_nxt != tp->rcv_nxt)) ++ return; /* Special ACK sent by DCTCP to reflect ECN */ + tcp_dec_quickack_mode(sk, pkts); + inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK); + } +@@ -984,8 +989,8 @@ static void tcp_internal_pacing(struct sock *sk, const struct sk_buff *skb) + * We are working here with either a clone of the original + * SKB, or a fresh unique copy made by the retransmit engine. + */ +-static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, +- gfp_t gfp_mask) ++static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, ++ int clone_it, gfp_t gfp_mask, u32 rcv_nxt) + { + const struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet; +@@ -1057,7 +1062,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + th->source = inet->inet_sport; + th->dest = inet->inet_dport; + th->seq = htonl(tcb->seq); +- th->ack_seq = htonl(tp->rcv_nxt); ++ th->ack_seq = htonl(rcv_nxt); + *(((__be16 *)th) + 6) = htons(((tcp_header_size >> 2) << 12) | + tcb->tcp_flags); + +@@ -1098,7 +1103,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + icsk->icsk_af_ops->send_check(sk, skb); + + if (likely(tcb->tcp_flags & TCPHDR_ACK)) +- tcp_event_ack_sent(sk, tcp_skb_pcount(skb)); ++ tcp_event_ack_sent(sk, tcp_skb_pcount(skb), rcv_nxt); + + if (skb->len != tcp_header_size) { + tcp_event_data_sent(tp, sk); +@@ -1135,6 +1140,13 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, + return err; + } + ++static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, ++ gfp_t gfp_mask) ++{ ++ return __tcp_transmit_skb(sk, skb, clone_it, gfp_mask, ++ tcp_sk(sk)->rcv_nxt); ++} ++ + /* This routine just queues the buffer for sending. + * + * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames, +@@ -3551,7 +3563,7 @@ void tcp_send_delayed_ack(struct sock *sk) + } + + /* This routine sends an ack and also updates the window. */ +-void tcp_send_ack(struct sock *sk) ++void __tcp_send_ack(struct sock *sk, u32 rcv_nxt) + { + struct sk_buff *buff; + +@@ -3586,9 +3598,14 @@ void tcp_send_ack(struct sock *sk) + skb_set_tcp_pure_ack(buff); + + /* Send it off, this clears delayed acks for us. */ +- tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0); ++ __tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0, rcv_nxt); ++} ++EXPORT_SYMBOL_GPL(__tcp_send_ack); ++ ++void tcp_send_ack(struct sock *sk) ++{ ++ __tcp_send_ack(sk, tcp_sk(sk)->rcv_nxt); + } +-EXPORT_SYMBOL_GPL(tcp_send_ack); + + /* This routine sends a packet with an out of date sequence + * number. It assumes the other end will try to ack it. +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index 453dc3726199..461825e0680f 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -708,13 +708,16 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg, + } + if (np->rxopt.bits.rxorigdstaddr) { + struct sockaddr_in6 sin6; +- __be16 *ports = (__be16 *) skb_transport_header(skb); ++ __be16 *ports; ++ int end; + +- if (skb_transport_offset(skb) + 4 <= (int)skb->len) { ++ end = skb_transport_offset(skb) + 4; ++ if (end <= 0 || pskb_may_pull(skb, end)) { + /* All current transport protocols have the port numbers in the + * first four bytes of the transport header and this function is + * written with this assumption in mind. + */ ++ ports = (__be16 *)skb_transport_header(skb); + + sin6.sin6_family = AF_INET6; + sin6.sin6_addr = ipv6_hdr(skb)->daddr; +diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c +index 5acb54405b10..c5f2b17b7ee1 100644 +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -405,9 +405,10 @@ static int icmp6_iif(const struct sk_buff *skb) + + /* for local traffic to local address, skb dev is the loopback + * device. Check if there is a dst attached to the skb and if so +- * get the real device index. ++ * get the real device index. Same is needed for replies to a link ++ * local address on a device enslaved to an L3 master device + */ +- if (unlikely(iif == LOOPBACK_IFINDEX)) { ++ if (unlikely(iif == LOOPBACK_IFINDEX || netif_is_l3_master(skb->dev))) { + const struct rt6_info *rt6 = skb_rt6_info(skb); + + if (rt6) +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 32fcce711855..1da021527fcd 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -595,6 +595,8 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from) + to->dev = from->dev; + to->mark = from->mark; + ++ skb_copy_hash(to, from); ++ + #ifdef CONFIG_NET_SCHED + to->tc_index = from->tc_index; + #endif +diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c +index 9a38a2c641fa..6fd913d63835 100644 +--- a/net/ipv6/mcast.c ++++ b/net/ipv6/mcast.c +@@ -771,8 +771,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im) + if (pmc) { + im->idev = pmc->idev; + im->mca_crcount = idev->mc_qrv; +- im->mca_sfmode = pmc->mca_sfmode; +- if (pmc->mca_sfmode == MCAST_INCLUDE) { ++ if (im->mca_sfmode == MCAST_INCLUDE) { + im->mca_tomb = pmc->mca_tomb; + im->mca_sources = pmc->mca_sources; + for (psf = im->mca_sources; psf; psf = psf->sf_next) +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 35e8aef9ceed..ba8586aadffa 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -918,7 +918,8 @@ static void tcp_v6_send_reset(const struct sock *sk, struct sk_buff *skb) + &tcp_hashinfo, NULL, 0, + &ipv6h->saddr, + th->source, &ipv6h->daddr, +- ntohs(th->source), tcp_v6_iif(skb), ++ ntohs(th->source), ++ tcp_v6_iif_l3_slave(skb), + tcp_v6_sdif(skb)); + if (!sk1) + goto out; +@@ -1573,7 +1574,8 @@ do_time_wait: + skb, __tcp_hdrlen(th), + &ipv6_hdr(skb)->saddr, th->source, + &ipv6_hdr(skb)->daddr, +- ntohs(th->dest), tcp_v6_iif(skb), ++ ntohs(th->dest), ++ tcp_v6_iif_l3_slave(skb), + sdif); + if (sk2) { + struct inet_timewait_sock *tw = inet_twsk(sk); +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 8ee4e667a414..fb79caf56d0e 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -135,9 +135,10 @@ static int alloc_sg(struct sock *sk, int len, struct scatterlist *sg, + pfrag->offset += use; + + sge = sg + num_elem - 1; +- if (num_elem > first_coalesce && sg_page(sg) == pfrag->page && +- sg->offset + sg->length == orig_offset) { +- sg->length += use; ++ ++ if (num_elem > first_coalesce && sg_page(sge) == pfrag->page && ++ sge->offset + sge->length == orig_offset) { ++ sge->length += use; + } else { + sge++; + sg_unmark_end(sge); diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.59-60.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.59-60.patch new file mode 100644 index 000000000000..03968ccd5504 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.59-60.patch @@ -0,0 +1,7461 @@ +diff --git a/Documentation/devicetree/bindings/net/dsa/qca8k.txt b/Documentation/devicetree/bindings/net/dsa/qca8k.txt +index 9c67ee4890d7..bbcb255c3150 100644 +--- a/Documentation/devicetree/bindings/net/dsa/qca8k.txt ++++ b/Documentation/devicetree/bindings/net/dsa/qca8k.txt +@@ -2,7 +2,10 @@ + + Required properties: + +-- compatible: should be "qca,qca8337" ++- compatible: should be one of: ++ "qca,qca8334" ++ "qca,qca8337" ++ + - #size-cells: must be 0 + - #address-cells: must be 1 + +@@ -14,6 +17,20 @@ port and PHY id, each subnode describing a port needs to have a valid phandle + referencing the internal PHY connected to it. The CPU port of this switch is + always port 0. + ++A CPU port node has the following optional node: ++ ++- fixed-link : Fixed-link subnode describing a link to a non-MDIO ++ managed entity. See ++ Documentation/devicetree/bindings/net/fixed-link.txt ++ for details. ++ ++For QCA8K the 'fixed-link' sub-node supports only the following properties: ++ ++- 'speed' (integer, mandatory), to indicate the link speed. Accepted ++ values are 10, 100 and 1000 ++- 'full-duplex' (boolean, optional), to indicate that full duplex is ++ used. When absent, half duplex is assumed. ++ + Example: + + +@@ -53,6 +70,10 @@ Example: + label = "cpu"; + ethernet = <&gmac1>; + phy-mode = "rgmii"; ++ fixed-link { ++ speed = 1000; ++ full-duplex; ++ }; + }; + + port@1 { +diff --git a/Documentation/devicetree/bindings/net/meson-dwmac.txt b/Documentation/devicetree/bindings/net/meson-dwmac.txt +index 354dd9896bb5..910187ebf1ce 100644 +--- a/Documentation/devicetree/bindings/net/meson-dwmac.txt ++++ b/Documentation/devicetree/bindings/net/meson-dwmac.txt +@@ -10,6 +10,7 @@ Required properties on all platforms: + - "amlogic,meson6-dwmac" + - "amlogic,meson8b-dwmac" + - "amlogic,meson-gxbb-dwmac" ++ - "amlogic,meson-axg-dwmac" + Additionally "snps,dwmac" and any applicable more + detailed version number described in net/stmmac.txt + should be used. +diff --git a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt +index 2392557ede27..df77d394edc0 100644 +--- a/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt ++++ b/Documentation/devicetree/bindings/pinctrl/meson,pinctrl.txt +@@ -3,8 +3,10 @@ + Required properties for the root node: + - compatible: one of "amlogic,meson8-cbus-pinctrl" + "amlogic,meson8b-cbus-pinctrl" ++ "amlogic,meson8m2-cbus-pinctrl" + "amlogic,meson8-aobus-pinctrl" + "amlogic,meson8b-aobus-pinctrl" ++ "amlogic,meson8m2-aobus-pinctrl" + "amlogic,meson-gxbb-periphs-pinctrl" + "amlogic,meson-gxbb-aobus-pinctrl" + "amlogic,meson-gxl-periphs-pinctrl" +diff --git a/Documentation/vfio-mediated-device.txt b/Documentation/vfio-mediated-device.txt +index 1b3950346532..c3f69bcaf96e 100644 +--- a/Documentation/vfio-mediated-device.txt ++++ b/Documentation/vfio-mediated-device.txt +@@ -145,6 +145,11 @@ The functions in the mdev_parent_ops structure are as follows: + * create: allocate basic resources in a driver for a mediated device + * remove: free resources in a driver when a mediated device is destroyed + ++(Note that mdev-core provides no implicit serialization of create/remove ++callbacks per mdev parent device, per mdev type, or any other categorization. ++Vendor drivers are expected to be fully asynchronous in this respect or ++provide their own internal resource protection.) ++ + The callbacks in the mdev_parent_ops structure are as follows: + + * open: open callback of mediated device +diff --git a/Makefile b/Makefile +index 81b0e99dce80..5b48ec630990 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 59 ++SUBLEVEL = 60 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm/boot/dts/emev2.dtsi b/arch/arm/boot/dts/emev2.dtsi +index 42ea246e71cb..fec1241b858f 100644 +--- a/arch/arm/boot/dts/emev2.dtsi ++++ b/arch/arm/boot/dts/emev2.dtsi +@@ -31,13 +31,13 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; + clock-frequency = <533000000>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -57,6 +57,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + clocks@e0110000 { +diff --git a/arch/arm/boot/dts/sh73a0.dtsi b/arch/arm/boot/dts/sh73a0.dtsi +index 4ea5c5a16c57..5fc24d4c2d5d 100644 +--- a/arch/arm/boot/dts/sh73a0.dtsi ++++ b/arch/arm/boot/dts/sh73a0.dtsi +@@ -22,7 +22,7 @@ + #address-cells = <1>; + #size-cells = <0>; + +- cpu@0 { ++ cpu0: cpu@0 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <0>; +@@ -30,7 +30,7 @@ + power-domains = <&pd_a2sl>; + next-level-cache = <&L2>; + }; +- cpu@1 { ++ cpu1: cpu@1 { + device_type = "cpu"; + compatible = "arm,cortex-a9"; + reg = <1>; +@@ -89,6 +89,7 @@ + compatible = "arm,cortex-a9-pmu"; + interrupts = , + ; ++ interrupt-affinity = <&cpu0>, <&cpu1>; + }; + + cmt1: timer@e6138000 { +diff --git a/arch/arm/boot/dts/stih407-pinctrl.dtsi b/arch/arm/boot/dts/stih407-pinctrl.dtsi +index bd1a82e8fffe..fe501d32d059 100644 +--- a/arch/arm/boot/dts/stih407-pinctrl.dtsi ++++ b/arch/arm/boot/dts/stih407-pinctrl.dtsi +@@ -52,7 +52,7 @@ + st,syscfg = <&syscfg_sbc>; + reg = <0x0961f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09610000 0x6000>; + +@@ -376,7 +376,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0920f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09200000 0x10000>; + +@@ -936,7 +936,7 @@ + st,syscfg = <&syscfg_front>; + reg = <0x0921f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09210000 0x10000>; + +@@ -969,7 +969,7 @@ + st,syscfg = <&syscfg_rear>; + reg = <0x0922f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09220000 0x6000>; + +@@ -1164,7 +1164,7 @@ + st,syscfg = <&syscfg_flash>; + reg = <0x0923f080 0x4>; + reg-names = "irqmux"; +- interrupts = ; ++ interrupts = ; + interrupt-names = "irqmux"; + ranges = <0 0x09230000 0x3000>; + +diff --git a/arch/arm/net/bpf_jit_32.c b/arch/arm/net/bpf_jit_32.c +index 323a4df59a6c..ece2d1d43724 100644 +--- a/arch/arm/net/bpf_jit_32.c ++++ b/arch/arm/net/bpf_jit_32.c +@@ -718,7 +718,7 @@ static inline void emit_a32_arsh_r64(const u8 dst[], const u8 src[], bool dstk, + } + + /* dst = dst >> src */ +-static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk, ++static inline void emit_a32_rsh_r64(const u8 dst[], const u8 src[], bool dstk, + bool sstk, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -734,7 +734,7 @@ static inline void emit_a32_lsr_r64(const u8 dst[], const u8 src[], bool dstk, + emit(ARM_LDR_I(rm, ARM_SP, STACK_VAR(dst_hi)), ctx); + } + +- /* Do LSH operation */ ++ /* Do RSH operation */ + emit(ARM_RSB_I(ARM_IP, rt, 32), ctx); + emit(ARM_SUBS_I(tmp2[0], rt, 32), ctx); + emit(ARM_MOV_SR(ARM_LR, rd, SRTYPE_LSR, rt), ctx); +@@ -784,7 +784,7 @@ static inline void emit_a32_lsh_i64(const u8 dst[], bool dstk, + } + + /* dst = dst >> val */ +-static inline void emit_a32_lsr_i64(const u8 dst[], bool dstk, ++static inline void emit_a32_rsh_i64(const u8 dst[], bool dstk, + const u32 val, struct jit_ctx *ctx) { + const u8 *tmp = bpf2a32[TMP_REG_1]; + const u8 *tmp2 = bpf2a32[TMP_REG_2]; +@@ -1340,7 +1340,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + case BPF_ALU64 | BPF_RSH | BPF_K: + if (unlikely(imm > 63)) + return -EINVAL; +- emit_a32_lsr_i64(dst, dstk, imm, ctx); ++ emit_a32_rsh_i64(dst, dstk, imm, ctx); + break; + /* dst = dst << src */ + case BPF_ALU64 | BPF_LSH | BPF_X: +@@ -1348,7 +1348,7 @@ static int build_insn(const struct bpf_insn *insn, struct jit_ctx *ctx) + break; + /* dst = dst >> src */ + case BPF_ALU64 | BPF_RSH | BPF_X: +- emit_a32_lsr_r64(dst, src, dstk, sstk, ctx); ++ emit_a32_rsh_r64(dst, src, dstk, sstk, ctx); + break; + /* dst = dst >> src (signed) */ + case BPF_ALU64 | BPF_ARSH | BPF_X: +diff --git a/arch/arm64/boot/dts/renesas/salvator-common.dtsi b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +index 9eb11a8d9eda..26a978616071 100644 +--- a/arch/arm64/boot/dts/renesas/salvator-common.dtsi ++++ b/arch/arm64/boot/dts/renesas/salvator-common.dtsi +@@ -93,20 +93,12 @@ + regulator-always-on; + }; + +- rsnd_ak4613: sound { +- compatible = "simple-audio-card"; ++ sound_card: sound { ++ compatible = "audio-graph-card"; + +- simple-audio-card,format = "left_j"; +- simple-audio-card,bitclock-master = <&sndcpu>; +- simple-audio-card,frame-master = <&sndcpu>; ++ label = "rcar-sound"; + +- sndcpu: simple-audio-card,cpu { +- sound-dai = <&rcar_sound>; +- }; +- +- sndcodec: simple-audio-card,codec { +- sound-dai = <&ak4613>; +- }; ++ dais = <&rsnd_port0>; + }; + + vbus0_usb2: regulator-vbus0-usb2 { +@@ -320,6 +312,12 @@ + asahi-kasei,out4-single-end; + asahi-kasei,out5-single-end; + asahi-kasei,out6-single-end; ++ ++ port { ++ ak4613_endpoint: endpoint { ++ remote-endpoint = <&rsnd_endpoint0>; ++ }; ++ }; + }; + + cs2000: clk_multiplier@4f { +@@ -538,10 +536,18 @@ + <&audio_clk_c>, + <&cpg CPG_CORE CPG_AUDIO_CLK_I>; + +- rcar_sound,dai { +- dai0 { +- playback = <&ssi0 &src0 &dvc0>; +- capture = <&ssi1 &src1 &dvc1>; ++ ports { ++ rsnd_port0: port@0 { ++ rsnd_endpoint0: endpoint { ++ remote-endpoint = <&ak4613_endpoint>; ++ ++ dai-format = "left_j"; ++ bitclock-master = <&rsnd_endpoint0>; ++ frame-master = <&rsnd_endpoint0>; ++ ++ playback = <&ssi0 &src0 &dvc0>; ++ capture = <&ssi1 &src1 &dvc1>; ++ }; + }; + }; + }; +diff --git a/arch/arm64/configs/defconfig b/arch/arm64/configs/defconfig +index 34480e9af2e7..b05796578e7a 100644 +--- a/arch/arm64/configs/defconfig ++++ b/arch/arm64/configs/defconfig +@@ -302,6 +302,8 @@ CONFIG_GPIO_XGENE_SB=y + CONFIG_GPIO_PCA953X=y + CONFIG_GPIO_PCA953X_IRQ=y + CONFIG_GPIO_MAX77620=y ++CONFIG_POWER_AVS=y ++CONFIG_ROCKCHIP_IODOMAIN=y + CONFIG_POWER_RESET_MSM=y + CONFIG_POWER_RESET_XGENE=y + CONFIG_POWER_RESET_SYSCON=y +diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h +index ae852add053d..0f2e1ab5e166 100644 +--- a/arch/arm64/include/asm/cmpxchg.h ++++ b/arch/arm64/include/asm/cmpxchg.h +@@ -229,7 +229,9 @@ static inline void __cmpwait_case_##name(volatile void *ptr, \ + unsigned long tmp; \ + \ + asm volatile( \ +- " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ ++ " sevl\n" \ ++ " wfe\n" \ ++ " ldxr" #sz "\t%" #w "[tmp], %[v]\n" \ + " eor %" #w "[tmp], %" #w "[tmp], %" #w "[val]\n" \ + " cbnz %" #w "[tmp], 1f\n" \ + " wfe\n" \ +diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c +index 00e7b900ca41..1190d90e01e6 100644 +--- a/arch/arm64/mm/init.c ++++ b/arch/arm64/mm/init.c +@@ -651,11 +651,13 @@ void __init mem_init(void) + BUILD_BUG_ON(TASK_SIZE_32 > TASK_SIZE_64); + #endif + ++#ifdef CONFIG_SPARSEMEM_VMEMMAP + /* + * Make sure we chose the upper bound of sizeof(struct page) +- * correctly. ++ * correctly when sizing the VMEMMAP array. + */ + BUILD_BUG_ON(sizeof(struct page) > (1 << STRUCT_PAGE_MAX_SHIFT)); ++#endif + + if (PAGE_SIZE >= 16384 && get_num_physpages() <= 128) { + extern int sysctl_overcommit_memory; +diff --git a/arch/microblaze/boot/Makefile b/arch/microblaze/boot/Makefile +index 47f94cc383b6..7c2f52d4a0e4 100644 +--- a/arch/microblaze/boot/Makefile ++++ b/arch/microblaze/boot/Makefile +@@ -22,17 +22,19 @@ $(obj)/linux.bin.gz: $(obj)/linux.bin FORCE + quiet_cmd_cp = CP $< $@$2 + cmd_cp = cat $< >$@$2 || (rm -f $@ && echo false) + +-quiet_cmd_strip = STRIP $@ ++quiet_cmd_strip = STRIP $< $@$2 + cmd_strip = $(STRIP) -K microblaze_start -K _end -K __log_buf \ +- -K _fdt_start vmlinux -o $@ ++ -K _fdt_start $< -o $@$2 + + UIMAGE_LOADADDR = $(CONFIG_KERNEL_BASE_ADDR) ++UIMAGE_IN = $@ ++UIMAGE_OUT = $@.ub + + $(obj)/simpleImage.%: vmlinux FORCE + $(call if_changed,cp,.unstrip) + $(call if_changed,objcopy) + $(call if_changed,uimage) +- $(call if_changed,strip) +- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' ++ $(call if_changed,strip,.strip) ++ @echo 'Kernel: $(UIMAGE_OUT) is ready' ' (#'`cat .version`')' + + clean-files += simpleImage.*.unstrip linux.bin.ub dts/*.dtb +diff --git a/arch/powerpc/include/asm/barrier.h b/arch/powerpc/include/asm/barrier.h +index c7c63959ba91..e582d2c88092 100644 +--- a/arch/powerpc/include/asm/barrier.h ++++ b/arch/powerpc/include/asm/barrier.h +@@ -76,6 +76,21 @@ do { \ + ___p1; \ + }) + ++#ifdef CONFIG_PPC_BOOK3S_64 ++/* ++ * Prevent execution of subsequent instructions until preceding branches have ++ * been fully resolved and are no longer executing speculatively. ++ */ ++#define barrier_nospec_asm ori 31,31,0 ++ ++// This also acts as a compiler barrier due to the memory clobber. ++#define barrier_nospec() asm (stringify_in_c(barrier_nospec_asm) ::: "memory") ++ ++#else /* !CONFIG_PPC_BOOK3S_64 */ ++#define barrier_nospec_asm ++#define barrier_nospec() ++#endif ++ + #include + + #endif /* _ASM_POWERPC_BARRIER_H */ +diff --git a/arch/powerpc/include/asm/cache.h b/arch/powerpc/include/asm/cache.h +index c1d257aa4c2d..66298461b640 100644 +--- a/arch/powerpc/include/asm/cache.h ++++ b/arch/powerpc/include/asm/cache.h +@@ -9,11 +9,14 @@ + #if defined(CONFIG_PPC_8xx) || defined(CONFIG_403GCX) + #define L1_CACHE_SHIFT 4 + #define MAX_COPY_PREFETCH 1 ++#define IFETCH_ALIGN_SHIFT 2 + #elif defined(CONFIG_PPC_E500MC) + #define L1_CACHE_SHIFT 6 + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 + #elif defined(CONFIG_PPC32) + #define MAX_COPY_PREFETCH 4 ++#define IFETCH_ALIGN_SHIFT 3 /* 603 fetches 2 insn at a time */ + #if defined(CONFIG_PPC_47x) + #define L1_CACHE_SHIFT 7 + #else +diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c +index ca2243df9cb2..470284f9e4f6 100644 +--- a/arch/powerpc/kernel/eeh_driver.c ++++ b/arch/powerpc/kernel/eeh_driver.c +@@ -450,9 +450,11 @@ static void *eeh_add_virt_device(void *data, void *userdata) + + driver = eeh_pcid_get(dev); + if (driver) { +- eeh_pcid_put(dev); +- if (driver->err_handler) ++ if (driver->err_handler) { ++ eeh_pcid_put(dev); + return NULL; ++ } ++ eeh_pcid_put(dev); + } + + #ifdef CONFIG_PPC_POWERNV +@@ -489,17 +491,19 @@ static void *eeh_rmv_device(void *data, void *userdata) + if (eeh_dev_removed(edev)) + return NULL; + +- driver = eeh_pcid_get(dev); +- if (driver) { +- eeh_pcid_put(dev); +- if (removed && +- eeh_pe_passed(edev->pe)) +- return NULL; +- if (removed && +- driver->err_handler && +- driver->err_handler->error_detected && +- driver->err_handler->slot_reset) ++ if (removed) { ++ if (eeh_pe_passed(edev->pe)) + return NULL; ++ driver = eeh_pcid_get(dev); ++ if (driver) { ++ if (driver->err_handler && ++ driver->err_handler->error_detected && ++ driver->err_handler->slot_reset) { ++ eeh_pcid_put(dev); ++ return NULL; ++ } ++ eeh_pcid_put(dev); ++ } + } + + /* Remove it from PCI subsystem */ +diff --git a/arch/powerpc/kernel/head_8xx.S b/arch/powerpc/kernel/head_8xx.S +index 4fee00d414e8..2d0d89e2cb9a 100644 +--- a/arch/powerpc/kernel/head_8xx.S ++++ b/arch/powerpc/kernel/head_8xx.S +@@ -958,7 +958,7 @@ start_here: + tovirt(r6,r6) + lis r5, abatron_pteptrs@h + ori r5, r5, abatron_pteptrs@l +- stw r5, 0xf0(r0) /* Must match your Abatron config file */ ++ stw r5, 0xf0(0) /* Must match your Abatron config file */ + tophys(r5,r5) + stw r6, 0(r5) + +diff --git a/arch/powerpc/kernel/pci_32.c b/arch/powerpc/kernel/pci_32.c +index 1d817f4d97d9..2094f2b249fd 100644 +--- a/arch/powerpc/kernel/pci_32.c ++++ b/arch/powerpc/kernel/pci_32.c +@@ -11,6 +11,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c +index 02190e90c7ae..f8782c7ef50f 100644 +--- a/arch/powerpc/kernel/prom_init.c ++++ b/arch/powerpc/kernel/prom_init.c +@@ -334,6 +334,7 @@ static void __init prom_print_dec(unsigned long val) + call_prom("write", 3, 1, prom.stdout, buf+i, size); + } + ++__printf(1, 2) + static void __init prom_printf(const char *format, ...) + { + const char *p, *q, *s; +@@ -1148,7 +1149,7 @@ static void __init prom_send_capabilities(void) + */ + + cores = DIV_ROUND_UP(NR_CPUS, prom_count_smt_threads()); +- prom_printf("Max number of cores passed to firmware: %lu (NR_CPUS = %lu)\n", ++ prom_printf("Max number of cores passed to firmware: %u (NR_CPUS = %d)\n", + cores, NR_CPUS); + + ibm_architecture_vec.vec5.max_cpus = cpu_to_be32(cores); +@@ -1230,7 +1231,7 @@ static unsigned long __init alloc_up(unsigned long size, unsigned long align) + + if (align) + base = _ALIGN_UP(base, align); +- prom_debug("alloc_up(%x, %x)\n", size, align); ++ prom_debug("%s(%lx, %lx)\n", __func__, size, align); + if (ram_top == 0) + prom_panic("alloc_up() called with mem not initialized\n"); + +@@ -1241,7 +1242,7 @@ static unsigned long __init alloc_up(unsigned long size, unsigned long align) + + for(; (base + size) <= alloc_top; + base = _ALIGN_UP(base + 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1253,12 +1254,12 @@ static unsigned long __init alloc_up(unsigned long size, unsigned long align) + return 0; + alloc_bottom = addr + size; + +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1273,7 +1274,7 @@ static unsigned long __init alloc_down(unsigned long size, unsigned long align, + { + unsigned long base, addr = 0; + +- prom_debug("alloc_down(%x, %x, %s)\n", size, align, ++ prom_debug("%s(%lx, %lx, %s)\n", __func__, size, align, + highmem ? "(high)" : "(low)"); + if (ram_top == 0) + prom_panic("alloc_down() called with mem not initialized\n"); +@@ -1301,7 +1302,7 @@ static unsigned long __init alloc_down(unsigned long size, unsigned long align, + base = _ALIGN_DOWN(alloc_top - size, align); + for (; base > alloc_bottom; + base = _ALIGN_DOWN(base - 0x100000, align)) { +- prom_debug(" trying: 0x%x\n\r", base); ++ prom_debug(" trying: 0x%lx\n\r", base); + addr = (unsigned long)prom_claim(base, size, 0); + if (addr != PROM_ERROR && addr != 0) + break; +@@ -1312,12 +1313,12 @@ static unsigned long __init alloc_down(unsigned long size, unsigned long align, + alloc_top = addr; + + bail: +- prom_debug(" -> %x\n", addr); +- prom_debug(" alloc_bottom : %x\n", alloc_bottom); +- prom_debug(" alloc_top : %x\n", alloc_top); +- prom_debug(" alloc_top_hi : %x\n", alloc_top_high); +- prom_debug(" rmo_top : %x\n", rmo_top); +- prom_debug(" ram_top : %x\n", ram_top); ++ prom_debug(" -> %lx\n", addr); ++ prom_debug(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_debug(" alloc_top : %lx\n", alloc_top); ++ prom_debug(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_debug(" rmo_top : %lx\n", rmo_top); ++ prom_debug(" ram_top : %lx\n", ram_top); + + return addr; + } +@@ -1443,7 +1444,7 @@ static void __init prom_init_mem(void) + + if (size == 0) + continue; +- prom_debug(" %x %x\n", base, size); ++ prom_debug(" %lx %lx\n", base, size); + if (base == 0 && (of_platform & PLATFORM_LPAR)) + rmo_top = size; + if ((base + size) > ram_top) +@@ -1463,12 +1464,12 @@ static void __init prom_init_mem(void) + + if (prom_memory_limit) { + if (prom_memory_limit <= alloc_bottom) { +- prom_printf("Ignoring mem=%x <= alloc_bottom.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx <= alloc_bottom.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else if (prom_memory_limit >= ram_top) { +- prom_printf("Ignoring mem=%x >= ram_top.\n", +- prom_memory_limit); ++ prom_printf("Ignoring mem=%lx >= ram_top.\n", ++ prom_memory_limit); + prom_memory_limit = 0; + } else { + ram_top = prom_memory_limit; +@@ -1500,12 +1501,13 @@ static void __init prom_init_mem(void) + alloc_bottom = PAGE_ALIGN(prom_initrd_end); + + prom_printf("memory layout at init:\n"); +- prom_printf(" memory_limit : %x (16 MB aligned)\n", prom_memory_limit); +- prom_printf(" alloc_bottom : %x\n", alloc_bottom); +- prom_printf(" alloc_top : %x\n", alloc_top); +- prom_printf(" alloc_top_hi : %x\n", alloc_top_high); +- prom_printf(" rmo_top : %x\n", rmo_top); +- prom_printf(" ram_top : %x\n", ram_top); ++ prom_printf(" memory_limit : %lx (16 MB aligned)\n", ++ prom_memory_limit); ++ prom_printf(" alloc_bottom : %lx\n", alloc_bottom); ++ prom_printf(" alloc_top : %lx\n", alloc_top); ++ prom_printf(" alloc_top_hi : %lx\n", alloc_top_high); ++ prom_printf(" rmo_top : %lx\n", rmo_top); ++ prom_printf(" ram_top : %lx\n", ram_top); + } + + static void __init prom_close_stdin(void) +@@ -1566,7 +1568,7 @@ static void __init prom_instantiate_opal(void) + return; + } + +- prom_printf("instantiating opal at 0x%x...", base); ++ prom_printf("instantiating opal at 0x%llx...", base); + + if (call_prom_ret("call-method", 4, 3, rets, + ADDR("load-opal-runtime"), +@@ -1582,10 +1584,10 @@ static void __init prom_instantiate_opal(void) + + reserve_mem(base, size); + +- prom_debug("opal base = 0x%x\n", base); +- prom_debug("opal align = 0x%x\n", align); +- prom_debug("opal entry = 0x%x\n", entry); +- prom_debug("opal size = 0x%x\n", (long)size); ++ prom_debug("opal base = 0x%llx\n", base); ++ prom_debug("opal align = 0x%llx\n", align); ++ prom_debug("opal entry = 0x%llx\n", entry); ++ prom_debug("opal size = 0x%llx\n", size); + + prom_setprop(opal_node, "/ibm,opal", "opal-base-address", + &base, sizeof(base)); +@@ -1662,7 +1664,7 @@ static void __init prom_instantiate_rtas(void) + + prom_debug("rtas base = 0x%x\n", base); + prom_debug("rtas entry = 0x%x\n", entry); +- prom_debug("rtas size = 0x%x\n", (long)size); ++ prom_debug("rtas size = 0x%x\n", size); + + prom_debug("prom_instantiate_rtas: end...\n"); + } +@@ -1720,7 +1722,7 @@ static void __init prom_instantiate_sml(void) + if (base == 0) + prom_panic("Could not allocate memory for sml\n"); + +- prom_printf("instantiating sml at 0x%x...", base); ++ prom_printf("instantiating sml at 0x%llx...", base); + + memset((void *)base, 0, size); + +@@ -1739,8 +1741,8 @@ static void __init prom_instantiate_sml(void) + prom_setprop(ibmvtpm_node, "/vdevice/vtpm", "linux,sml-size", + &size, sizeof(size)); + +- prom_debug("sml base = 0x%x\n", base); +- prom_debug("sml size = 0x%x\n", (long)size); ++ prom_debug("sml base = 0x%llx\n", base); ++ prom_debug("sml size = 0x%x\n", size); + + prom_debug("prom_instantiate_sml: end...\n"); + } +@@ -1841,7 +1843,7 @@ static void __init prom_initialize_tce_table(void) + + prom_debug("TCE table: %s\n", path); + prom_debug("\tnode = 0x%x\n", node); +- prom_debug("\tbase = 0x%x\n", base); ++ prom_debug("\tbase = 0x%llx\n", base); + prom_debug("\tsize = 0x%x\n", minsize); + + /* Initialize the table to have a one-to-one mapping +@@ -1928,12 +1930,12 @@ static void __init prom_hold_cpus(void) + } + + prom_debug("prom_hold_cpus: start...\n"); +- prom_debug(" 1) spinloop = 0x%x\n", (unsigned long)spinloop); +- prom_debug(" 1) *spinloop = 0x%x\n", *spinloop); +- prom_debug(" 1) acknowledge = 0x%x\n", ++ prom_debug(" 1) spinloop = 0x%lx\n", (unsigned long)spinloop); ++ prom_debug(" 1) *spinloop = 0x%lx\n", *spinloop); ++ prom_debug(" 1) acknowledge = 0x%lx\n", + (unsigned long)acknowledge); +- prom_debug(" 1) *acknowledge = 0x%x\n", *acknowledge); +- prom_debug(" 1) secondary_hold = 0x%x\n", secondary_hold); ++ prom_debug(" 1) *acknowledge = 0x%lx\n", *acknowledge); ++ prom_debug(" 1) secondary_hold = 0x%lx\n", secondary_hold); + + /* Set the common spinloop variable, so all of the secondary cpus + * will block when they are awakened from their OF spinloop. +@@ -1961,7 +1963,7 @@ static void __init prom_hold_cpus(void) + prom_getprop(node, "reg", ®, sizeof(reg)); + cpu_no = be32_to_cpu(reg); + +- prom_debug("cpu hw idx = %lu\n", cpu_no); ++ prom_debug("cpu hw idx = %u\n", cpu_no); + + /* Init the acknowledge var which will be reset by + * the secondary cpu when it awakens from its OF +@@ -1971,7 +1973,7 @@ static void __init prom_hold_cpus(void) + + if (cpu_no != prom.cpu) { + /* Primary Thread of non-boot cpu or any thread */ +- prom_printf("starting cpu hw idx %lu... ", cpu_no); ++ prom_printf("starting cpu hw idx %u... ", cpu_no); + call_prom("start-cpu", 3, 0, node, + secondary_hold, cpu_no); + +@@ -1982,11 +1984,11 @@ static void __init prom_hold_cpus(void) + if (*acknowledge == cpu_no) + prom_printf("done\n"); + else +- prom_printf("failed: %x\n", *acknowledge); ++ prom_printf("failed: %lx\n", *acknowledge); + } + #ifdef CONFIG_SMP + else +- prom_printf("boot cpu hw idx %lu\n", cpu_no); ++ prom_printf("boot cpu hw idx %u\n", cpu_no); + #endif /* CONFIG_SMP */ + } + +@@ -2264,7 +2266,7 @@ static void __init *make_room(unsigned long *mem_start, unsigned long *mem_end, + while ((*mem_start + needed) > *mem_end) { + unsigned long room, chunk; + +- prom_debug("Chunk exhausted, claiming more at %x...\n", ++ prom_debug("Chunk exhausted, claiming more at %lx...\n", + alloc_bottom); + room = alloc_top - alloc_bottom; + if (room > DEVTREE_CHUNK_SIZE) +@@ -2490,7 +2492,7 @@ static void __init flatten_device_tree(void) + room = alloc_top - alloc_bottom - 0x4000; + if (room > DEVTREE_CHUNK_SIZE) + room = DEVTREE_CHUNK_SIZE; +- prom_debug("starting device tree allocs at %x\n", alloc_bottom); ++ prom_debug("starting device tree allocs at %lx\n", alloc_bottom); + + /* Now try to claim that */ + mem_start = (unsigned long)alloc_up(room, PAGE_SIZE); +@@ -2553,7 +2555,7 @@ static void __init flatten_device_tree(void) + int i; + prom_printf("reserved memory map:\n"); + for (i = 0; i < mem_reserve_cnt; i++) +- prom_printf(" %x - %x\n", ++ prom_printf(" %llx - %llx\n", + be64_to_cpu(mem_reserve_map[i].base), + be64_to_cpu(mem_reserve_map[i].size)); + } +@@ -2563,9 +2565,9 @@ static void __init flatten_device_tree(void) + */ + mem_reserve_cnt = MEM_RESERVE_MAP_SIZE; + +- prom_printf("Device tree strings 0x%x -> 0x%x\n", ++ prom_printf("Device tree strings 0x%lx -> 0x%lx\n", + dt_string_start, dt_string_end); +- prom_printf("Device tree struct 0x%x -> 0x%x\n", ++ prom_printf("Device tree struct 0x%lx -> 0x%lx\n", + dt_struct_start, dt_struct_end); + } + +@@ -2997,7 +2999,7 @@ static void __init prom_find_boot_cpu(void) + prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval)); + prom.cpu = be32_to_cpu(rval); + +- prom_debug("Booting CPU hw index = %lu\n", prom.cpu); ++ prom_debug("Booting CPU hw index = %d\n", prom.cpu); + } + + static void __init prom_check_initrd(unsigned long r3, unsigned long r4) +@@ -3019,8 +3021,8 @@ static void __init prom_check_initrd(unsigned long r3, unsigned long r4) + reserve_mem(prom_initrd_start, + prom_initrd_end - prom_initrd_start); + +- prom_debug("initrd_start=0x%x\n", prom_initrd_start); +- prom_debug("initrd_end=0x%x\n", prom_initrd_end); ++ prom_debug("initrd_start=0x%lx\n", prom_initrd_start); ++ prom_debug("initrd_end=0x%lx\n", prom_initrd_end); + } + #endif /* CONFIG_BLK_DEV_INITRD */ + } +@@ -3273,7 +3275,7 @@ unsigned long __init prom_init(unsigned long r3, unsigned long r4, + /* Don't print anything after quiesce under OPAL, it crashes OFW */ + if (of_platform != PLATFORM_OPAL) { + prom_printf("Booting Linux via __start() @ 0x%lx ...\n", kbase); +- prom_debug("->dt_header_start=0x%x\n", hdr); ++ prom_debug("->dt_header_start=0x%lx\n", hdr); + } + + #ifdef CONFIG_PPC32 +diff --git a/arch/powerpc/lib/string.S b/arch/powerpc/lib/string.S +index a787776822d8..0378def28d41 100644 +--- a/arch/powerpc/lib/string.S ++++ b/arch/powerpc/lib/string.S +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + + .text + +@@ -23,7 +24,7 @@ _GLOBAL(strncpy) + mtctr r5 + addi r6,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r4) + cmpwi 0,r0,0 + stbu r0,1(r6) +@@ -43,7 +44,7 @@ _GLOBAL(strncmp) + mtctr r5 + addi r5,r3,-1 + addi r4,r4,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r3,1(r5) + cmpwi 1,r3,0 + lbzu r0,1(r4) +@@ -77,7 +78,7 @@ _GLOBAL(memchr) + beq- 2f + mtctr r5 + addi r3,r3,-1 +- .balign 16 ++ .balign IFETCH_ALIGN_BYTES + 1: lbzu r0,1(r3) + cmpw 0,r0,r4 + bdnzf 2,1b +diff --git a/arch/powerpc/mm/slb.c b/arch/powerpc/mm/slb.c +index 13cfe413b40d..6d9bf014b3e7 100644 +--- a/arch/powerpc/mm/slb.c ++++ b/arch/powerpc/mm/slb.c +@@ -62,14 +62,14 @@ static inline void slb_shadow_update(unsigned long ea, int ssize, + * updating it. No write barriers are needed here, provided + * we only update the current CPU's SLB shadow buffer. + */ +- p->save_area[index].esid = 0; +- p->save_area[index].vsid = cpu_to_be64(mk_vsid_data(ea, ssize, flags)); +- p->save_area[index].esid = cpu_to_be64(mk_esid_data(ea, ssize, index)); ++ WRITE_ONCE(p->save_area[index].esid, 0); ++ WRITE_ONCE(p->save_area[index].vsid, cpu_to_be64(mk_vsid_data(ea, ssize, flags))); ++ WRITE_ONCE(p->save_area[index].esid, cpu_to_be64(mk_esid_data(ea, ssize, index))); + } + + static inline void slb_shadow_clear(enum slb_index index) + { +- get_slb_shadow()->save_area[index].esid = 0; ++ WRITE_ONCE(get_slb_shadow()->save_area[index].esid, 0); + } + + static inline void create_shadowed_slbe(unsigned long ea, int ssize, +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c +index bd0786c23109..254634fb3fc7 100644 +--- a/arch/powerpc/net/bpf_jit_comp64.c ++++ b/arch/powerpc/net/bpf_jit_comp64.c +@@ -203,25 +203,37 @@ static void bpf_jit_build_epilogue(u32 *image, struct codegen_context *ctx) + + static void bpf_jit_emit_func_call(u32 *image, struct codegen_context *ctx, u64 func) + { ++ unsigned int i, ctx_idx = ctx->idx; ++ ++ /* Load function address into r12 */ ++ PPC_LI64(12, func); ++ ++ /* For bpf-to-bpf function calls, the callee's address is unknown ++ * until the last extra pass. As seen above, we use PPC_LI64() to ++ * load the callee's address, but this may optimize the number of ++ * instructions required based on the nature of the address. ++ * ++ * Since we don't want the number of instructions emitted to change, ++ * we pad the optimized PPC_LI64() call with NOPs to guarantee that ++ * we always have a five-instruction sequence, which is the maximum ++ * that PPC_LI64() can emit. ++ */ ++ for (i = ctx->idx - ctx_idx; i < 5; i++) ++ PPC_NOP(); ++ + #ifdef PPC64_ELF_ABI_v1 +- /* func points to the function descriptor */ +- PPC_LI64(b2p[TMP_REG_2], func); +- /* Load actual entry point from function descriptor */ +- PPC_BPF_LL(b2p[TMP_REG_1], b2p[TMP_REG_2], 0); +- /* ... and move it to LR */ +- PPC_MTLR(b2p[TMP_REG_1]); + /* + * Load TOC from function descriptor at offset 8. + * We can clobber r2 since we get called through a + * function pointer (so caller will save/restore r2) + * and since we don't use a TOC ourself. + */ +- PPC_BPF_LL(2, b2p[TMP_REG_2], 8); +-#else +- /* We can clobber r12 */ +- PPC_FUNC_ADDR(12, func); +- PPC_MTLR(12); ++ PPC_BPF_LL(2, 12, 8); ++ /* Load actual entry point from function descriptor */ ++ PPC_BPF_LL(12, 12, 0); + #endif ++ ++ PPC_MTLR(12); + PPC_BLRL(); + } + +diff --git a/arch/powerpc/platforms/chrp/time.c b/arch/powerpc/platforms/chrp/time.c +index 03d115aaa191..acde7bbe0716 100644 +--- a/arch/powerpc/platforms/chrp/time.c ++++ b/arch/powerpc/platforms/chrp/time.c +@@ -28,6 +28,8 @@ + #include + #include + ++#include ++ + extern spinlock_t rtc_lock; + + #define NVRAM_AS0 0x74 +@@ -63,7 +65,7 @@ long __init chrp_time_init(void) + return 0; + } + +-int chrp_cmos_clock_read(int addr) ++static int chrp_cmos_clock_read(int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); +@@ -71,7 +73,7 @@ int chrp_cmos_clock_read(int addr) + return (inb(nvram_data)); + } + +-void chrp_cmos_clock_write(unsigned long val, int addr) ++static void chrp_cmos_clock_write(unsigned long val, int addr) + { + if (nvram_as1 != 0) + outb(addr>>8, nvram_as1); +diff --git a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +index 89c54de88b7a..bf4a125faec6 100644 +--- a/arch/powerpc/platforms/embedded6xx/hlwd-pic.c ++++ b/arch/powerpc/platforms/embedded6xx/hlwd-pic.c +@@ -35,6 +35,8 @@ + */ + #define HW_BROADWAY_ICR 0x00 + #define HW_BROADWAY_IMR 0x04 ++#define HW_STARLET_ICR 0x08 ++#define HW_STARLET_IMR 0x0c + + + /* +@@ -74,6 +76,9 @@ static void hlwd_pic_unmask(struct irq_data *d) + void __iomem *io_base = irq_data_get_irq_chip_data(d); + + setbits32(io_base + HW_BROADWAY_IMR, 1 << irq); ++ ++ /* Make sure the ARM (aka. Starlet) doesn't handle this interrupt. */ ++ clrbits32(io_base + HW_STARLET_IMR, 1 << irq); + } + + +diff --git a/arch/powerpc/platforms/powermac/bootx_init.c b/arch/powerpc/platforms/powermac/bootx_init.c +index c3c9bbb3573a..ba0964c17620 100644 +--- a/arch/powerpc/platforms/powermac/bootx_init.c ++++ b/arch/powerpc/platforms/powermac/bootx_init.c +@@ -468,7 +468,7 @@ void __init bootx_init(unsigned long r3, unsigned long r4) + boot_infos_t *bi = (boot_infos_t *) r4; + unsigned long hdr; + unsigned long space; +- unsigned long ptr, x; ++ unsigned long ptr; + char *model; + unsigned long offset = reloc_offset(); + +@@ -562,6 +562,8 @@ void __init bootx_init(unsigned long r3, unsigned long r4) + * MMU switched OFF, so this should not be useful anymore. + */ + if (bi->version < 4) { ++ unsigned long x __maybe_unused; ++ + bootx_printf("Touching pages...\n"); + + /* +diff --git a/arch/powerpc/platforms/powermac/setup.c b/arch/powerpc/platforms/powermac/setup.c +index ab668cb72263..8b2eab1340f4 100644 +--- a/arch/powerpc/platforms/powermac/setup.c ++++ b/arch/powerpc/platforms/powermac/setup.c +@@ -352,6 +352,7 @@ static int pmac_late_init(void) + } + machine_late_initcall(powermac, pmac_late_init); + ++void note_bootable_part(dev_t dev, int part, int goodness); + /* + * This is __ref because we check for "initializing" before + * touching any of the __init sensitive things and "initializing" +diff --git a/arch/s390/include/asm/cpu_mf.h b/arch/s390/include/asm/cpu_mf.h +index 05480e4cc5ca..bc764a674594 100644 +--- a/arch/s390/include/asm/cpu_mf.h ++++ b/arch/s390/include/asm/cpu_mf.h +@@ -116,7 +116,7 @@ struct hws_basic_entry { + + struct hws_diag_entry { + unsigned int def:16; /* 0-15 Data Entry Format */ +- unsigned int R:14; /* 16-19 and 20-30 reserved */ ++ unsigned int R:15; /* 16-19 and 20-30 reserved */ + unsigned int I:1; /* 31 entry valid or invalid */ + u8 data[]; /* Machine-dependent sample data */ + } __packed; +@@ -132,7 +132,9 @@ struct hws_trailer_entry { + unsigned int f:1; /* 0 - Block Full Indicator */ + unsigned int a:1; /* 1 - Alert request control */ + unsigned int t:1; /* 2 - Timestamp format */ +- unsigned long long:61; /* 3 - 63: Reserved */ ++ unsigned int :29; /* 3 - 31: Reserved */ ++ unsigned int bsdes:16; /* 32-47: size of basic SDE */ ++ unsigned int dsdes:16; /* 48-63: size of diagnostic SDE */ + }; + unsigned long long flags; /* 0 - 63: All indicators */ + }; +diff --git a/arch/x86/events/intel/uncore.c b/arch/x86/events/intel/uncore.c +index d45e06346f14..c56cb37b88e3 100644 +--- a/arch/x86/events/intel/uncore.c ++++ b/arch/x86/events/intel/uncore.c +@@ -218,7 +218,7 @@ void uncore_perf_event_update(struct intel_uncore_box *box, struct perf_event *e + u64 prev_count, new_count, delta; + int shift; + +- if (event->hw.idx >= UNCORE_PMC_IDX_FIXED) ++ if (event->hw.idx == UNCORE_PMC_IDX_FIXED) + shift = 64 - uncore_fixed_ctr_bits(box); + else + shift = 64 - uncore_perf_ctr_bits(box); +diff --git a/arch/x86/events/intel/uncore_nhmex.c b/arch/x86/events/intel/uncore_nhmex.c +index 93e7a8397cde..173e2674be6e 100644 +--- a/arch/x86/events/intel/uncore_nhmex.c ++++ b/arch/x86/events/intel/uncore_nhmex.c +@@ -246,7 +246,7 @@ static void nhmex_uncore_msr_enable_event(struct intel_uncore_box *box, struct p + { + struct hw_perf_event *hwc = &event->hw; + +- if (hwc->idx >= UNCORE_PMC_IDX_FIXED) ++ if (hwc->idx == UNCORE_PMC_IDX_FIXED) + wrmsrl(hwc->config_base, NHMEX_PMON_CTL_EN_BIT0); + else if (box->pmu->type->event_mask & NHMEX_PMON_CTL_EN_BIT0) + wrmsrl(hwc->config_base, hwc->config | NHMEX_PMON_CTL_EN_BIT22); +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index c8e0cda0f272..4fc0e08a30b9 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -70,7 +70,7 @@ static DEFINE_MUTEX(microcode_mutex); + /* + * Serialize late loading so that CPUs get updated one-by-one. + */ +-static DEFINE_SPINLOCK(update_lock); ++static DEFINE_RAW_SPINLOCK(update_lock); + + struct ucode_cpu_info ucode_cpu_info[NR_CPUS]; + +@@ -560,9 +560,9 @@ static int __reload_late(void *info) + if (__wait_for_cpus(&late_cpus_in, NSEC_PER_SEC)) + return -1; + +- spin_lock(&update_lock); ++ raw_spin_lock(&update_lock); + apply_microcode_local(&err); +- spin_unlock(&update_lock); ++ raw_spin_unlock(&update_lock); + + /* siblings return UCODE_OK because their engine got updated already */ + if (err > UCODE_NFOUND) { +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 43bbece92632..2ef2f1fe875b 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -890,7 +890,7 @@ static int mmu_topup_memory_cache_page(struct kvm_mmu_memory_cache *cache, + if (cache->nobjs >= min) + return 0; + while (cache->nobjs < ARRAY_SIZE(cache->objects)) { +- page = (void *)__get_free_page(GFP_KERNEL); ++ page = (void *)__get_free_page(GFP_KERNEL_ACCOUNT); + if (!page) + return -ENOMEM; + cache->objects[cache->nobjs++] = page; +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 56c9cd01fd1d..4a4b7d3c909a 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -1678,7 +1678,6 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, + + if (!RB_EMPTY_NODE(&rq->rb_node)) + goto end; +- spin_lock_irq(&bfqq->bfqd->lock); + + /* + * If next and rq belong to the same bfq_queue and next is older +@@ -1702,7 +1701,6 @@ static void bfq_requests_merged(struct request_queue *q, struct request *rq, + + bfq_remove_request(q, next); + +- spin_unlock_irq(&bfqq->bfqd->lock); + end: + bfqg_stats_update_io_merged(bfqq_group(bfqq), next->cmd_flags); + } +diff --git a/block/bio.c b/block/bio.c +index 90f19d7df66c..194d28cdc642 100644 +--- a/block/bio.c ++++ b/block/bio.c +@@ -881,16 +881,16 @@ EXPORT_SYMBOL(bio_add_page); + */ + int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) + { +- unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt; ++ unsigned short nr_pages = bio->bi_max_vecs - bio->bi_vcnt, idx; + struct bio_vec *bv = bio->bi_io_vec + bio->bi_vcnt; + struct page **pages = (struct page **)bv; +- size_t offset, diff; ++ size_t offset; + ssize_t size; + + size = iov_iter_get_pages(iter, pages, LONG_MAX, nr_pages, &offset); + if (unlikely(size <= 0)) + return size ? size : -EFAULT; +- nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE; ++ idx = nr_pages = (size + offset + PAGE_SIZE - 1) / PAGE_SIZE; + + /* + * Deep magic below: We need to walk the pinned pages backwards +@@ -903,17 +903,15 @@ int bio_iov_iter_get_pages(struct bio *bio, struct iov_iter *iter) + bio->bi_iter.bi_size += size; + bio->bi_vcnt += nr_pages; + +- diff = (nr_pages * PAGE_SIZE - offset) - size; +- while (nr_pages--) { +- bv[nr_pages].bv_page = pages[nr_pages]; +- bv[nr_pages].bv_len = PAGE_SIZE; +- bv[nr_pages].bv_offset = 0; ++ while (idx--) { ++ bv[idx].bv_page = pages[idx]; ++ bv[idx].bv_len = PAGE_SIZE; ++ bv[idx].bv_offset = 0; + } + + bv[0].bv_offset += offset; + bv[0].bv_len -= offset; +- if (diff) +- bv[bio->bi_vcnt - 1].bv_len -= diff; ++ bv[nr_pages - 1].bv_len -= nr_pages * PAGE_SIZE - offset - size; + + iov_iter_advance(iter, size); + return 0; +@@ -1891,6 +1889,7 @@ struct bio *bio_split(struct bio *bio, int sectors, + bio_integrity_trim(split); + + bio_advance(bio, split->bi_iter.bi_size); ++ bio->bi_iter.bi_done = 0; + + if (bio_flagged(bio, BIO_TRACE_COMPLETION)) + bio_set_flag(split, BIO_TRACE_COMPLETION); +diff --git a/crypto/authenc.c b/crypto/authenc.c +index 875470b0e026..0db344d5a01a 100644 +--- a/crypto/authenc.c ++++ b/crypto/authenc.c +@@ -108,6 +108,7 @@ static int crypto_authenc_setkey(struct crypto_aead *authenc, const u8 *key, + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: +diff --git a/crypto/authencesn.c b/crypto/authencesn.c +index 0cf5fefdb859..6de852ce4cf8 100644 +--- a/crypto/authencesn.c ++++ b/crypto/authencesn.c +@@ -90,6 +90,7 @@ static int crypto_authenc_esn_setkey(struct crypto_aead *authenc_esn, const u8 * + CRYPTO_TFM_RES_MASK); + + out: ++ memzero_explicit(&keys, sizeof(keys)); + return err; + + badkey: +diff --git a/drivers/acpi/acpi_lpss.c b/drivers/acpi/acpi_lpss.c +index 602ae58ee2d8..75c3cb377b98 100644 +--- a/drivers/acpi/acpi_lpss.c ++++ b/drivers/acpi/acpi_lpss.c +@@ -69,6 +69,10 @@ ACPI_MODULE_NAME("acpi_lpss"); + #define LPSS_SAVE_CTX BIT(4) + #define LPSS_NO_D3_DELAY BIT(5) + ++/* Crystal Cove PMIC shares same ACPI ID between different platforms */ ++#define BYT_CRC_HRV 2 ++#define CHT_CRC_HRV 3 ++ + struct lpss_private_data; + + struct lpss_device_desc { +@@ -162,7 +166,7 @@ static void byt_pwm_setup(struct lpss_private_data *pdata) + if (!adev->pnp.unique_id || strcmp(adev->pnp.unique_id, "1")) + return; + +- if (!acpi_dev_present("INT33FD", NULL, -1)) ++ if (!acpi_dev_present("INT33FD", NULL, BYT_CRC_HRV)) + pwm_add_table(byt_pwm_lookup, ARRAY_SIZE(byt_pwm_lookup)); + } + +diff --git a/drivers/acpi/pci_root.c b/drivers/acpi/pci_root.c +index 6fc204a52493..eb857d6ea1fe 100644 +--- a/drivers/acpi/pci_root.c ++++ b/drivers/acpi/pci_root.c +@@ -472,9 +472,11 @@ static void negotiate_os_control(struct acpi_pci_root *root, int *no_aspm) + } + + control = OSC_PCI_EXPRESS_CAPABILITY_CONTROL +- | OSC_PCI_EXPRESS_NATIVE_HP_CONTROL + | OSC_PCI_EXPRESS_PME_CONTROL; + ++ if (IS_ENABLED(CONFIG_HOTPLUG_PCI_PCIE)) ++ control |= OSC_PCI_EXPRESS_NATIVE_HP_CONTROL; ++ + if (pci_aer_available()) { + if (aer_acpi_firmware_first()) + dev_info(&device->dev, +diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c +index 711dd91b5e2c..2651c81d1edf 100644 +--- a/drivers/ata/libata-eh.c ++++ b/drivers/ata/libata-eh.c +@@ -2217,12 +2217,16 @@ static void ata_eh_link_autopsy(struct ata_link *link) + if (qc->err_mask & ~AC_ERR_OTHER) + qc->err_mask &= ~AC_ERR_OTHER; + +- /* SENSE_VALID trumps dev/unknown error and revalidation */ ++ /* ++ * SENSE_VALID trumps dev/unknown error and revalidation. Upper ++ * layers will determine whether the command is worth retrying ++ * based on the sense data and device class/type. Otherwise, ++ * determine directly if the command is worth retrying using its ++ * error mask and flags. ++ */ + if (qc->flags & ATA_QCFLAG_SENSE_VALID) + qc->err_mask &= ~(AC_ERR_DEV | AC_ERR_OTHER); +- +- /* determine whether the command is worth retrying */ +- if (ata_eh_worth_retry(qc)) ++ else if (ata_eh_worth_retry(qc)) + qc->flags |= ATA_QCFLAG_RETRY; + + /* accumulate error info */ +diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c +index 86d7975afaeb..819521d5895e 100644 +--- a/drivers/bluetooth/btusb.c ++++ b/drivers/bluetooth/btusb.c +@@ -279,6 +279,7 @@ static const struct usb_device_id blacklist_table[] = { + { USB_DEVICE(0x04ca, 0x3011), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3015), .driver_info = BTUSB_QCA_ROME }, + { USB_DEVICE(0x04ca, 0x3016), .driver_info = BTUSB_QCA_ROME }, ++ { USB_DEVICE(0x04ca, 0x301a), .driver_info = BTUSB_QCA_ROME }, + + /* Broadcom BCM2035 */ + { USB_DEVICE(0x0a5c, 0x2009), .driver_info = BTUSB_BCM92035 }, +@@ -373,6 +374,9 @@ static const struct usb_device_id blacklist_table[] = { + /* Additional Realtek 8723BU Bluetooth devices */ + { USB_DEVICE(0x7392, 0xa611), .driver_info = BTUSB_REALTEK }, + ++ /* Additional Realtek 8723DE Bluetooth devices */ ++ { USB_DEVICE(0x2ff8, 0xb011), .driver_info = BTUSB_REALTEK }, ++ + /* Additional Realtek 8821AE Bluetooth devices */ + { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, + { USB_DEVICE(0x13d3, 0x3414), .driver_info = BTUSB_REALTEK }, +diff --git a/drivers/bluetooth/hci_qca.c b/drivers/bluetooth/hci_qca.c +index 6f4ebd5e54c8..a6173ddfb5a7 100644 +--- a/drivers/bluetooth/hci_qca.c ++++ b/drivers/bluetooth/hci_qca.c +@@ -881,7 +881,7 @@ static int qca_set_baudrate(struct hci_dev *hdev, uint8_t baudrate) + */ + set_current_state(TASK_UNINTERRUPTIBLE); + schedule_timeout(msecs_to_jiffies(BAUDRATE_SETTLE_TIMEOUT_MS)); +- set_current_state(TASK_INTERRUPTIBLE); ++ set_current_state(TASK_RUNNING); + + return 0; + } +diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c +index 72fd1750134d..942d076cbb0a 100644 +--- a/drivers/bus/arm-ccn.c ++++ b/drivers/bus/arm-ccn.c +@@ -736,7 +736,7 @@ static int arm_ccn_pmu_event_init(struct perf_event *event) + ccn = pmu_to_arm_ccn(event->pmu); + + if (hw->sample_period) { +- dev_warn(ccn->dev, "Sampling not supported!\n"); ++ dev_dbg(ccn->dev, "Sampling not supported!\n"); + return -EOPNOTSUPP; + } + +@@ -744,12 +744,12 @@ static int arm_ccn_pmu_event_init(struct perf_event *event) + event->attr.exclude_kernel || event->attr.exclude_hv || + event->attr.exclude_idle || event->attr.exclude_host || + event->attr.exclude_guest) { +- dev_warn(ccn->dev, "Can't exclude execution levels!\n"); ++ dev_dbg(ccn->dev, "Can't exclude execution levels!\n"); + return -EINVAL; + } + + if (event->cpu < 0) { +- dev_warn(ccn->dev, "Can't provide per-task data!\n"); ++ dev_dbg(ccn->dev, "Can't provide per-task data!\n"); + return -EOPNOTSUPP; + } + /* +@@ -771,13 +771,13 @@ static int arm_ccn_pmu_event_init(struct perf_event *event) + switch (type) { + case CCN_TYPE_MN: + if (node_xp != ccn->mn_id) { +- dev_warn(ccn->dev, "Invalid MN ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid MN ID %d!\n", node_xp); + return -EINVAL; + } + break; + case CCN_TYPE_XP: + if (node_xp >= ccn->num_xps) { +- dev_warn(ccn->dev, "Invalid XP ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid XP ID %d!\n", node_xp); + return -EINVAL; + } + break; +@@ -785,11 +785,11 @@ static int arm_ccn_pmu_event_init(struct perf_event *event) + break; + default: + if (node_xp >= ccn->num_nodes) { +- dev_warn(ccn->dev, "Invalid node ID %d!\n", node_xp); ++ dev_dbg(ccn->dev, "Invalid node ID %d!\n", node_xp); + return -EINVAL; + } + if (!arm_ccn_pmu_type_eq(type, ccn->node[node_xp].type)) { +- dev_warn(ccn->dev, "Invalid type 0x%x for node %d!\n", ++ dev_dbg(ccn->dev, "Invalid type 0x%x for node %d!\n", + type, node_xp); + return -EINVAL; + } +@@ -808,19 +808,19 @@ static int arm_ccn_pmu_event_init(struct perf_event *event) + if (event_id != e->event) + continue; + if (e->num_ports && port >= e->num_ports) { +- dev_warn(ccn->dev, "Invalid port %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid port %d for node/XP %d!\n", + port, node_xp); + return -EINVAL; + } + if (e->num_vcs && vc >= e->num_vcs) { +- dev_warn(ccn->dev, "Invalid vc %d for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid vc %d for node/XP %d!\n", + vc, node_xp); + return -EINVAL; + } + valid = 1; + } + if (!valid) { +- dev_warn(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", ++ dev_dbg(ccn->dev, "Invalid event 0x%x for node/XP %d!\n", + event_id, node_xp); + return -EINVAL; + } +diff --git a/drivers/char/random.c b/drivers/char/random.c +index ddc493d976fd..ea4dbfa30657 100644 +--- a/drivers/char/random.c ++++ b/drivers/char/random.c +@@ -1897,14 +1897,22 @@ static int + write_pool(struct entropy_store *r, const char __user *buffer, size_t count) + { + size_t bytes; +- __u32 buf[16]; ++ __u32 t, buf[16]; + const char __user *p = buffer; + + while (count > 0) { ++ int b, i = 0; ++ + bytes = min(count, sizeof(buf)); + if (copy_from_user(&buf, p, bytes)) + return -EFAULT; + ++ for (b = bytes ; b > 0 ; b -= sizeof(__u32), i++) { ++ if (!arch_get_random_int(&t)) ++ break; ++ buf[i] ^= t; ++ } ++ + count -= bytes; + p += bytes; + +diff --git a/drivers/edac/altera_edac.c b/drivers/edac/altera_edac.c +index 346c4987b284..38983f56ad0d 100644 +--- a/drivers/edac/altera_edac.c ++++ b/drivers/edac/altera_edac.c +@@ -1106,7 +1106,7 @@ static void *ocram_alloc_mem(size_t size, void **other) + + static void ocram_free_mem(void *p, size_t size, void *other) + { +- gen_pool_free((struct gen_pool *)other, (u32)p, size); ++ gen_pool_free((struct gen_pool *)other, (unsigned long)p, size); + } + + static const struct edac_device_prv_data ocramecc_data = { +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +index 1360a24d2ede..f08624f2f209 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c +@@ -683,8 +683,12 @@ int amdgpu_bo_pin_restricted(struct amdgpu_bo *bo, u32 domain, + return -EINVAL; + + /* A shared bo cannot be migrated to VRAM */ +- if (bo->prime_shared_count && (domain == AMDGPU_GEM_DOMAIN_VRAM)) +- return -EINVAL; ++ if (bo->prime_shared_count) { ++ if (domain & AMDGPU_GEM_DOMAIN_GTT) ++ domain = AMDGPU_GEM_DOMAIN_GTT; ++ else ++ return -EINVAL; ++ } + + if (bo->pin_count) { + uint32_t mem_type = bo->tbo.mem.mem_type; +diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c +index 0d8a417e2cd6..bb5cc15fa0b9 100644 +--- a/drivers/gpu/drm/drm_atomic.c ++++ b/drivers/gpu/drm/drm_atomic.c +@@ -1355,7 +1355,9 @@ drm_atomic_set_crtc_for_plane(struct drm_plane_state *plane_state, + { + struct drm_plane *plane = plane_state->plane; + struct drm_crtc_state *crtc_state; +- ++ /* Nothing to do for same crtc*/ ++ if (plane_state->crtc == crtc) ++ return 0; + if (plane_state->crtc) { + crtc_state = drm_atomic_get_crtc_state(plane_state->state, + plane_state->crtc); +diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c +index 0028591f3f95..1f08d597b87a 100644 +--- a/drivers/gpu/drm/drm_atomic_helper.c ++++ b/drivers/gpu/drm/drm_atomic_helper.c +@@ -2683,31 +2683,9 @@ commit: + return 0; + } + +-/** +- * drm_atomic_helper_disable_all - disable all currently active outputs +- * @dev: DRM device +- * @ctx: lock acquisition context +- * +- * Loops through all connectors, finding those that aren't turned off and then +- * turns them off by setting their DPMS mode to OFF and deactivating the CRTC +- * that they are connected to. +- * +- * This is used for example in suspend/resume to disable all currently active +- * functions when suspending. If you just want to shut down everything at e.g. +- * driver unload, look at drm_atomic_helper_shutdown(). +- * +- * Note that if callers haven't already acquired all modeset locks this might +- * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). +- * +- * Returns: +- * 0 on success or a negative error code on failure. +- * +- * See also: +- * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and +- * drm_atomic_helper_shutdown(). +- */ +-int drm_atomic_helper_disable_all(struct drm_device *dev, +- struct drm_modeset_acquire_ctx *ctx) ++static int __drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx, ++ bool clean_old_fbs) + { + struct drm_atomic_state *state; + struct drm_connector_state *conn_state; +@@ -2759,8 +2737,11 @@ int drm_atomic_helper_disable_all(struct drm_device *dev, + goto free; + + drm_atomic_set_fb_for_plane(plane_state, NULL); +- plane_mask |= BIT(drm_plane_index(plane)); +- plane->old_fb = plane->fb; ++ ++ if (clean_old_fbs) { ++ plane->old_fb = plane->fb; ++ plane_mask |= BIT(drm_plane_index(plane)); ++ } + } + + ret = drm_atomic_commit(state); +@@ -2771,6 +2752,34 @@ free: + return ret; + } + ++/** ++ * drm_atomic_helper_disable_all - disable all currently active outputs ++ * @dev: DRM device ++ * @ctx: lock acquisition context ++ * ++ * Loops through all connectors, finding those that aren't turned off and then ++ * turns them off by setting their DPMS mode to OFF and deactivating the CRTC ++ * that they are connected to. ++ * ++ * This is used for example in suspend/resume to disable all currently active ++ * functions when suspending. If you just want to shut down everything at e.g. ++ * driver unload, look at drm_atomic_helper_shutdown(). ++ * ++ * Note that if callers haven't already acquired all modeset locks this might ++ * return -EDEADLK, which must be handled by calling drm_modeset_backoff(). ++ * ++ * Returns: ++ * 0 on success or a negative error code on failure. ++ * ++ * See also: ++ * drm_atomic_helper_suspend(), drm_atomic_helper_resume() and ++ * drm_atomic_helper_shutdown(). ++ */ ++int drm_atomic_helper_disable_all(struct drm_device *dev, ++ struct drm_modeset_acquire_ctx *ctx) ++{ ++ return __drm_atomic_helper_disable_all(dev, ctx, false); ++} + EXPORT_SYMBOL(drm_atomic_helper_disable_all); + + /** +@@ -2793,7 +2802,7 @@ void drm_atomic_helper_shutdown(struct drm_device *dev) + while (1) { + ret = drm_modeset_lock_all_ctx(dev, &ctx); + if (!ret) +- ret = drm_atomic_helper_disable_all(dev, &ctx); ++ ret = __drm_atomic_helper_disable_all(dev, &ctx, true); + + if (ret != -EDEADLK) + break; +@@ -2897,16 +2906,11 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state, + struct drm_connector_state *new_conn_state; + struct drm_crtc *crtc; + struct drm_crtc_state *new_crtc_state; +- unsigned plane_mask = 0; +- struct drm_device *dev = state->dev; +- int ret; + + state->acquire_ctx = ctx; + +- for_each_new_plane_in_state(state, plane, new_plane_state, i) { +- plane_mask |= BIT(drm_plane_index(plane)); ++ for_each_new_plane_in_state(state, plane, new_plane_state, i) + state->planes[i].old_state = plane->state; +- } + + for_each_new_crtc_in_state(state, crtc, new_crtc_state, i) + state->crtcs[i].old_state = crtc->state; +@@ -2914,11 +2918,7 @@ int drm_atomic_helper_commit_duplicated_state(struct drm_atomic_state *state, + for_each_new_connector_in_state(state, connector, new_conn_state, i) + state->connectors[i].old_state = connector->state; + +- ret = drm_atomic_commit(state); +- if (plane_mask) +- drm_atomic_clean_old_fb(dev, plane_mask, ret); +- +- return ret; ++ return drm_atomic_commit(state); + } + EXPORT_SYMBOL(drm_atomic_helper_commit_duplicated_state); + +diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c +index 41b492f99955..c022ab6e84bd 100644 +--- a/drivers/gpu/drm/drm_dp_mst_topology.c ++++ b/drivers/gpu/drm/drm_dp_mst_topology.c +@@ -2862,12 +2862,14 @@ static void drm_dp_mst_dump_mstb(struct seq_file *m, + } + } + ++#define DP_PAYLOAD_TABLE_SIZE 64 ++ + static bool dump_dp_payload_table(struct drm_dp_mst_topology_mgr *mgr, + char *buf) + { + int i; + +- for (i = 0; i < 64; i += 16) { ++ for (i = 0; i < DP_PAYLOAD_TABLE_SIZE; i += 16) { + if (drm_dp_dpcd_read(mgr->aux, + DP_PAYLOAD_TABLE_UPDATE_STATUS + i, + &buf[i], 16) != 16) +@@ -2936,7 +2938,7 @@ void drm_dp_mst_dump_topology(struct seq_file *m, + + mutex_lock(&mgr->lock); + if (mgr->mst_primary) { +- u8 buf[64]; ++ u8 buf[DP_PAYLOAD_TABLE_SIZE]; + int ret; + + ret = drm_dp_dpcd_read(mgr->aux, DP_DPCD_REV, buf, DP_RECEIVER_CAP_SIZE); +@@ -2954,8 +2956,7 @@ void drm_dp_mst_dump_topology(struct seq_file *m, + seq_printf(m, " revision: hw: %x.%x sw: %x.%x\n", + buf[0x9] >> 4, buf[0x9] & 0xf, buf[0xa], buf[0xb]); + if (dump_dp_payload_table(mgr, buf)) +- seq_printf(m, "payload table: %*ph\n", 63, buf); +- ++ seq_printf(m, "payload table: %*ph\n", DP_PAYLOAD_TABLE_SIZE, buf); + } + + mutex_unlock(&mgr->lock); +diff --git a/drivers/gpu/drm/gma500/psb_intel_drv.h b/drivers/gpu/drm/gma500/psb_intel_drv.h +index e8e4ea14b12b..e05e5399af2d 100644 +--- a/drivers/gpu/drm/gma500/psb_intel_drv.h ++++ b/drivers/gpu/drm/gma500/psb_intel_drv.h +@@ -255,7 +255,7 @@ extern int intelfb_remove(struct drm_device *dev, + extern bool psb_intel_lvds_mode_fixup(struct drm_encoder *encoder, + const struct drm_display_mode *mode, + struct drm_display_mode *adjusted_mode); +-extern int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++extern enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode); + extern int psb_intel_lvds_set_property(struct drm_connector *connector, + struct drm_property *property, +diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c +index be3eefec5152..8baf6325c6e4 100644 +--- a/drivers/gpu/drm/gma500/psb_intel_lvds.c ++++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c +@@ -343,7 +343,7 @@ static void psb_intel_lvds_restore(struct drm_connector *connector) + } + } + +-int psb_intel_lvds_mode_valid(struct drm_connector *connector, ++enum drm_mode_status psb_intel_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_psb_private *dev_priv = connector->dev->dev_private; +diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c +index a7e55c422501..0b632dc0cf7d 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c ++++ b/drivers/gpu/drm/nouveau/nvkm/engine/fifo/gk104.c +@@ -155,10 +155,10 @@ gk104_fifo_runlist_commit(struct gk104_fifo *fifo, int runl) + (target << 28)); + nvkm_wr32(device, 0x002274, (runl << 20) | nr); + +- if (wait_event_timeout(fifo->runlist[runl].wait, +- !(nvkm_rd32(device, 0x002284 + (runl * 0x08)) +- & 0x00100000), +- msecs_to_jiffies(2000)) == 0) ++ if (nvkm_msec(device, 2000, ++ if (!(nvkm_rd32(device, 0x002284 + (runl * 0x08)) & 0x00100000)) ++ break; ++ ) < 0) + nvkm_error(subdev, "runlist %d update timeout\n", runl); + unlock: + mutex_unlock(&subdev->mutex); +diff --git a/drivers/gpu/drm/radeon/radeon_connectors.c b/drivers/gpu/drm/radeon/radeon_connectors.c +index 424cd1b66575..337d3a1c2a40 100644 +--- a/drivers/gpu/drm/radeon/radeon_connectors.c ++++ b/drivers/gpu/drm/radeon/radeon_connectors.c +@@ -853,7 +853,7 @@ static int radeon_lvds_get_modes(struct drm_connector *connector) + return ret; + } + +-static int radeon_lvds_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_lvds_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_encoder *encoder = radeon_best_single_encoder(connector); +@@ -1013,7 +1013,7 @@ static int radeon_vga_get_modes(struct drm_connector *connector) + return ret; + } + +-static int radeon_vga_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_vga_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1157,7 +1157,7 @@ static int radeon_tv_get_modes(struct drm_connector *connector) + return 1; + } + +-static int radeon_tv_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_tv_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + if ((mode->hdisplay > 1024) || (mode->vdisplay > 768)) +@@ -1499,7 +1499,7 @@ static void radeon_dvi_force(struct drm_connector *connector) + radeon_connector->use_digital = true; + } + +-static int radeon_dvi_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dvi_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +@@ -1801,7 +1801,7 @@ out: + return ret; + } + +-static int radeon_dp_mode_valid(struct drm_connector *connector, ++static enum drm_mode_status radeon_dp_mode_valid(struct drm_connector *connector, + struct drm_display_mode *mode) + { + struct drm_device *dev = connector->dev; +diff --git a/drivers/hid/hid-plantronics.c b/drivers/hid/hid-plantronics.c +index febb21ee190e..584b10d3fc3d 100644 +--- a/drivers/hid/hid-plantronics.c ++++ b/drivers/hid/hid-plantronics.c +@@ -2,7 +2,7 @@ + * Plantronics USB HID Driver + * + * Copyright (c) 2014 JD Cole +- * Copyright (c) 2015 Terry Junge ++ * Copyright (c) 2015-2018 Terry Junge + */ + + /* +@@ -48,6 +48,10 @@ static int plantronics_input_mapping(struct hid_device *hdev, + unsigned short mapped_key; + unsigned long plt_type = (unsigned long)hid_get_drvdata(hdev); + ++ /* special case for PTT products */ ++ if (field->application == HID_GD_JOYSTICK) ++ goto defaulted; ++ + /* handle volume up/down mapping */ + /* non-standard types or multi-HID interfaces - plt_type is PID */ + if (!(plt_type & HID_USAGE_PAGE)) { +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index d92827556389..136a34dc31b8 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -1036,6 +1036,14 @@ static int i2c_hid_probe(struct i2c_client *client, + pm_runtime_enable(&client->dev); + device_enable_async_suspend(&client->dev); + ++ /* Make sure there is something at this address */ ++ ret = i2c_smbus_read_byte(client); ++ if (ret < 0) { ++ dev_dbg(&client->dev, "nothing at this address: %d\n", ret); ++ ret = -ENXIO; ++ goto err_pm; ++ } ++ + ret = i2c_hid_fetch_hid_descriptor(ihid); + if (ret < 0) + goto err_pm; +diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c +index 56e46581b84b..6f2fe63e8f5a 100644 +--- a/drivers/i2c/i2c-core-base.c ++++ b/drivers/i2c/i2c-core-base.c +@@ -808,8 +808,11 @@ EXPORT_SYMBOL_GPL(i2c_new_device); + */ + void i2c_unregister_device(struct i2c_client *client) + { +- if (client->dev.of_node) ++ if (client->dev.of_node) { + of_node_clear_flag(client->dev.of_node, OF_POPULATED); ++ of_node_put(client->dev.of_node); ++ } ++ + if (ACPI_COMPANION(&client->dev)) + acpi_device_clear_enumerated(ACPI_COMPANION(&client->dev)); + device_unregister(&client->dev); +diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c +index d8efdc191c27..55252079faf6 100644 +--- a/drivers/infiniband/core/mad.c ++++ b/drivers/infiniband/core/mad.c +@@ -1558,7 +1558,8 @@ static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req, + mad_reg_req->oui, 3)) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(!*method); ++ if (!*method) ++ goto error3; + goto check_in_use; + } + } +@@ -1568,10 +1569,12 @@ static int add_oui_reg_req(struct ib_mad_reg_req *mad_reg_req, + vclass]->oui[i])) { + method = &(*vendor_table)->vendor_class[ + vclass]->method_table[i]; +- BUG_ON(*method); + /* Allocate method table for this OUI */ +- if ((ret = allocate_method_table(method))) +- goto error3; ++ if (!*method) { ++ ret = allocate_method_table(method); ++ if (ret) ++ goto error3; ++ } + memcpy((*vendor_table)->vendor_class[vclass]->oui[i], + mad_reg_req->oui, 3); + goto check_in_use; +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index e47baf0950e3..a22b992cde38 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -218,7 +218,7 @@ static struct ucma_multicast* ucma_alloc_multicast(struct ucma_context *ctx) + return NULL; + + mutex_lock(&mut); +- mc->id = idr_alloc(&multicast_idr, mc, 0, 0, GFP_KERNEL); ++ mc->id = idr_alloc(&multicast_idr, NULL, 0, 0, GFP_KERNEL); + mutex_unlock(&mut); + if (mc->id < 0) + goto error; +@@ -1404,6 +1404,10 @@ static ssize_t ucma_process_join(struct ucma_file *file, + goto err3; + } + ++ mutex_lock(&mut); ++ idr_replace(&multicast_idr, mc, mc->id); ++ mutex_unlock(&mut); ++ + mutex_unlock(&file->mut); + ucma_put_ctx(ctx); + return 0; +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index 186dce6bba8f..b8229d7b0ff5 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -3376,6 +3376,11 @@ int ib_uverbs_ex_create_flow(struct ib_uverbs_file *file, + goto err_uobj; + } + ++ if (qp->qp_type != IB_QPT_UD && qp->qp_type != IB_QPT_RAW_PACKET) { ++ err = -EINVAL; ++ goto err_put; ++ } ++ + flow_attr = kzalloc(sizeof(*flow_attr) + cmd.flow_attr.num_of_specs * + sizeof(union ib_flow_spec), GFP_KERNEL); + if (!flow_attr) { +diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c +index 9032f77cc38d..feb80dbb5948 100644 +--- a/drivers/infiniband/core/verbs.c ++++ b/drivers/infiniband/core/verbs.c +@@ -2115,10 +2115,16 @@ static void __ib_drain_sq(struct ib_qp *qp) + struct ib_cq *cq = qp->send_cq; + struct ib_qp_attr attr = { .qp_state = IB_QPS_ERR }; + struct ib_drain_cqe sdrain; +- struct ib_send_wr swr = {}, *bad_swr; ++ struct ib_send_wr *bad_swr; ++ struct ib_rdma_wr swr = { ++ .wr = { ++ .next = NULL, ++ { .wr_cqe = &sdrain.cqe, }, ++ .opcode = IB_WR_RDMA_WRITE, ++ }, ++ }; + int ret; + +- swr.wr_cqe = &sdrain.cqe; + sdrain.cqe.done = ib_drain_qp_done; + init_completion(&sdrain.done); + +@@ -2128,7 +2134,7 @@ static void __ib_drain_sq(struct ib_qp *qp) + return; + } + +- ret = ib_post_send(qp, &swr, &bad_swr); ++ ret = ib_post_send(qp, &swr.wr, &bad_swr); + if (ret) { + WARN_ONCE(ret, "failed to drain send queue: %d\n", ret); + return; +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index ee578fa713c2..97c2225829ea 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -787,13 +787,17 @@ static int srpt_post_recv(struct srpt_device *sdev, + */ + static int srpt_zerolength_write(struct srpt_rdma_ch *ch) + { +- struct ib_send_wr wr, *bad_wr; ++ struct ib_send_wr *bad_wr; ++ struct ib_rdma_wr wr = { ++ .wr = { ++ .next = NULL, ++ { .wr_cqe = &ch->zw_cqe, }, ++ .opcode = IB_WR_RDMA_WRITE, ++ .send_flags = IB_SEND_SIGNALED, ++ } ++ }; + +- memset(&wr, 0, sizeof(wr)); +- wr.opcode = IB_WR_RDMA_WRITE; +- wr.wr_cqe = &ch->zw_cqe; +- wr.send_flags = IB_SEND_SIGNALED; +- return ib_post_send(ch->qp, &wr, &bad_wr); ++ return ib_post_send(ch->qp, &wr.wr, &bad_wr); + } + + static void srpt_zerolength_write_done(struct ib_cq *cq, struct ib_wc *wc) +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index 7b5fa501bbcf..696e540304fd 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1262,6 +1262,8 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0611", 0 }, + { "ELAN0612", 0 }, + { "ELAN0618", 0 }, ++ { "ELAN061D", 0 }, ++ { "ELAN0622", 0 }, + { "ELAN1000", 0 }, + { } + }; +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index b353d494ad40..136f6e7bf797 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -527,6 +527,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { + DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"), + }, + }, ++ { ++ /* Lenovo LaVie Z */ ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"), ++ DMI_MATCH(DMI_PRODUCT_VERSION, "Lenovo LaVie Z"), ++ }, ++ }, + { } + }; + +diff --git a/drivers/irqchip/irq-ls-scfg-msi.c b/drivers/irqchip/irq-ls-scfg-msi.c +index 119f4ef0d421..b7f943f96068 100644 +--- a/drivers/irqchip/irq-ls-scfg-msi.c ++++ b/drivers/irqchip/irq-ls-scfg-msi.c +@@ -21,6 +21,7 @@ + #include + #include + #include ++#include + + #define MSI_IRQS_PER_MSIR 32 + #define MSI_MSIR_OFFSET 4 +@@ -94,6 +95,8 @@ static void ls_scfg_msi_compose_msg(struct irq_data *data, struct msi_msg *msg) + + if (msi_affinity_flag) + msg->data |= cpumask_first(data->common->affinity); ++ ++ iommu_dma_map_msi_msg(data->irq, msg); + } + + static int ls_scfg_msi_set_affinity(struct irq_data *irq_data, +diff --git a/drivers/lightnvm/pblk-rb.c b/drivers/lightnvm/pblk-rb.c +index 9bc32578a766..c0dd17a82170 100644 +--- a/drivers/lightnvm/pblk-rb.c ++++ b/drivers/lightnvm/pblk-rb.c +@@ -142,10 +142,9 @@ static void clean_wctx(struct pblk_w_ctx *w_ctx) + { + int flags; + +-try: + flags = READ_ONCE(w_ctx->flags); +- if (!(flags & PBLK_SUBMITTED_ENTRY)) +- goto try; ++ WARN_ONCE(!(flags & PBLK_SUBMITTED_ENTRY), ++ "pblk: overwriting unsubmitted data\n"); + + /* Release flags on context. Protect from writes and reads */ + smp_store_release(&w_ctx->flags, PBLK_WRITABLE_ENTRY); +diff --git a/drivers/md/md.c b/drivers/md/md.c +index 11a67eac55b1..5599712d478e 100644 +--- a/drivers/md/md.c ++++ b/drivers/md/md.c +@@ -6498,6 +6498,9 @@ static int hot_remove_disk(struct mddev *mddev, dev_t dev) + char b[BDEVNAME_SIZE]; + struct md_rdev *rdev; + ++ if (!mddev->pers) ++ return -ENODEV; ++ + rdev = find_rdev(mddev, dev); + if (!rdev) + return -ENXIO; +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c +index 029ecba60727..78d830763704 100644 +--- a/drivers/md/raid1.c ++++ b/drivers/md/raid1.c +@@ -2462,6 +2462,8 @@ static void handle_read_error(struct r1conf *conf, struct r1bio *r1_bio) + fix_read_error(conf, r1_bio->read_disk, + r1_bio->sector, r1_bio->sectors); + unfreeze_array(conf); ++ } else if (mddev->ro == 0 && test_bit(FailFast, &rdev->flags)) { ++ md_error(mddev, rdev); + } else { + r1_bio->bios[r1_bio->read_disk] = IO_BLOCKED; + } +diff --git a/drivers/media/common/siano/smsendian.c b/drivers/media/common/siano/smsendian.c +index bfe831c10b1c..b95a631f23f9 100644 +--- a/drivers/media/common/siano/smsendian.c ++++ b/drivers/media/common/siano/smsendian.c +@@ -35,7 +35,7 @@ void smsendian_handle_tx_message(void *buffer) + switch (msg->x_msg_header.msg_type) { + case MSG_SMS_DATA_DOWNLOAD_REQ: + { +- msg->msg_data[0] = le32_to_cpu(msg->msg_data[0]); ++ msg->msg_data[0] = le32_to_cpu((__force __le32)(msg->msg_data[0])); + break; + } + +@@ -44,7 +44,7 @@ void smsendian_handle_tx_message(void *buffer) + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -64,7 +64,7 @@ void smsendian_handle_rx_message(void *buffer) + { + struct sms_version_res *ver = + (struct sms_version_res *) msg; +- ver->chip_model = le16_to_cpu(ver->chip_model); ++ ver->chip_model = le16_to_cpu((__force __le16)ver->chip_model); + break; + } + +@@ -81,7 +81,7 @@ void smsendian_handle_rx_message(void *buffer) + sizeof(struct sms_msg_hdr))/4; + + for (i = 0; i < msg_words; i++) +- msg->msg_data[i] = le32_to_cpu(msg->msg_data[i]); ++ msg->msg_data[i] = le32_to_cpu((__force __le32)msg->msg_data[i]); + + break; + } +@@ -95,9 +95,9 @@ void smsendian_handle_message_header(void *msg) + #ifdef __BIG_ENDIAN + struct sms_msg_hdr *phdr = (struct sms_msg_hdr *)msg; + +- phdr->msg_type = le16_to_cpu(phdr->msg_type); +- phdr->msg_length = le16_to_cpu(phdr->msg_length); +- phdr->msg_flags = le16_to_cpu(phdr->msg_flags); ++ phdr->msg_type = le16_to_cpu((__force __le16)phdr->msg_type); ++ phdr->msg_length = le16_to_cpu((__force __le16)phdr->msg_length); ++ phdr->msg_flags = le16_to_cpu((__force __le16)phdr->msg_flags); + #endif /* __BIG_ENDIAN */ + } + EXPORT_SYMBOL_GPL(smsendian_handle_message_header); +diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c +index 700f433261d0..e4d7f2febf00 100644 +--- a/drivers/media/i2c/smiapp/smiapp-core.c ++++ b/drivers/media/i2c/smiapp/smiapp-core.c +@@ -1001,7 +1001,7 @@ static int smiapp_read_nvm(struct smiapp_sensor *sensor, + if (rval) + goto out; + +- for (i = 0; i < 1000; i++) { ++ for (i = 1000; i > 0; i--) { + rval = smiapp_read( + sensor, + SMIAPP_REG_U8_DATA_TRANSFER_IF_1_STATUS, &s); +@@ -1012,11 +1012,10 @@ static int smiapp_read_nvm(struct smiapp_sensor *sensor, + if (s & SMIAPP_DATA_TRANSFER_IF_1_STATUS_RD_READY) + break; + +- if (--i == 0) { +- rval = -ETIMEDOUT; +- goto out; +- } +- ++ } ++ if (!i) { ++ rval = -ETIMEDOUT; ++ goto out; + } + + for (i = 0; i < SMIAPP_NVM_PAGE_SIZE; i++) { +diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c +index e79f72b8b858..62b2c5d9bdfb 100644 +--- a/drivers/media/media-device.c ++++ b/drivers/media/media-device.c +@@ -54,9 +54,10 @@ static int media_device_close(struct file *filp) + return 0; + } + +-static int media_device_get_info(struct media_device *dev, +- struct media_device_info *info) ++static long media_device_get_info(struct media_device *dev, void *arg) + { ++ struct media_device_info *info = arg; ++ + memset(info, 0, sizeof(*info)); + + if (dev->driver_name[0]) +@@ -93,9 +94,9 @@ static struct media_entity *find_entity(struct media_device *mdev, u32 id) + return NULL; + } + +-static long media_device_enum_entities(struct media_device *mdev, +- struct media_entity_desc *entd) ++static long media_device_enum_entities(struct media_device *mdev, void *arg) + { ++ struct media_entity_desc *entd = arg; + struct media_entity *ent; + + ent = find_entity(mdev, entd->id); +@@ -146,9 +147,9 @@ static void media_device_kpad_to_upad(const struct media_pad *kpad, + upad->flags = kpad->flags; + } + +-static long media_device_enum_links(struct media_device *mdev, +- struct media_links_enum *links) ++static long media_device_enum_links(struct media_device *mdev, void *arg) + { ++ struct media_links_enum *links = arg; + struct media_entity *entity; + + entity = find_entity(mdev, links->entity); +@@ -194,9 +195,9 @@ static long media_device_enum_links(struct media_device *mdev, + return 0; + } + +-static long media_device_setup_link(struct media_device *mdev, +- struct media_link_desc *linkd) ++static long media_device_setup_link(struct media_device *mdev, void *arg) + { ++ struct media_link_desc *linkd = arg; + struct media_link *link = NULL; + struct media_entity *source; + struct media_entity *sink; +@@ -222,9 +223,9 @@ static long media_device_setup_link(struct media_device *mdev, + return __media_entity_setup_link(link, linkd->flags); + } + +-static long media_device_get_topology(struct media_device *mdev, +- struct media_v2_topology *topo) ++static long media_device_get_topology(struct media_device *mdev, void *arg) + { ++ struct media_v2_topology *topo = arg; + struct media_entity *entity; + struct media_interface *intf; + struct media_pad *pad; +diff --git a/drivers/media/pci/saa7164/saa7164-fw.c b/drivers/media/pci/saa7164/saa7164-fw.c +index ef4906406ebf..a50461861133 100644 +--- a/drivers/media/pci/saa7164/saa7164-fw.c ++++ b/drivers/media/pci/saa7164/saa7164-fw.c +@@ -426,7 +426,8 @@ int saa7164_downloadfirmware(struct saa7164_dev *dev) + __func__, fw->size); + + if (fw->size != fwlength) { +- printk(KERN_ERR "xc5000: firmware incorrect size\n"); ++ printk(KERN_ERR "saa7164: firmware incorrect size %zu != %u\n", ++ fw->size, fwlength); + ret = -ENOMEM; + goto out; + } +diff --git a/drivers/media/pci/tw686x/tw686x-video.c b/drivers/media/pci/tw686x/tw686x-video.c +index c3fafa97b2d0..0ea8dd44026c 100644 +--- a/drivers/media/pci/tw686x/tw686x-video.c ++++ b/drivers/media/pci/tw686x/tw686x-video.c +@@ -1228,7 +1228,8 @@ int tw686x_video_init(struct tw686x_dev *dev) + vc->vidq.timestamp_flags = V4L2_BUF_FLAG_TIMESTAMP_MONOTONIC; + vc->vidq.min_buffers_needed = 2; + vc->vidq.lock = &vc->vb_mutex; +- vc->vidq.gfp_flags = GFP_DMA32; ++ vc->vidq.gfp_flags = dev->dma_mode != TW686X_DMA_MODE_MEMCPY ? ++ GFP_DMA32 : 0; + vc->vidq.dev = &dev->pci_dev->dev; + + err = vb2_queue_init(&vc->vidq); +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 1a428fe9f070..9f023bc6e1b7 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -1945,6 +1945,7 @@ error_csi2: + + static void isp_detach_iommu(struct isp_device *isp) + { ++ arm_iommu_detach_device(isp->dev); + arm_iommu_release_mapping(isp->mapping); + isp->mapping = NULL; + } +@@ -1961,8 +1962,7 @@ static int isp_attach_iommu(struct isp_device *isp) + mapping = arm_iommu_create_mapping(&platform_bus_type, SZ_1G, SZ_2G); + if (IS_ERR(mapping)) { + dev_err(isp->dev, "failed to create ARM IOMMU mapping\n"); +- ret = PTR_ERR(mapping); +- goto error; ++ return PTR_ERR(mapping); + } + + isp->mapping = mapping; +@@ -1977,7 +1977,8 @@ static int isp_attach_iommu(struct isp_device *isp) + return 0; + + error: +- isp_detach_iommu(isp); ++ arm_iommu_release_mapping(isp->mapping); ++ isp->mapping = NULL; + return ret; + } + +diff --git a/drivers/media/platform/rcar_jpu.c b/drivers/media/platform/rcar_jpu.c +index 070bac36d766..2e2b8c409150 100644 +--- a/drivers/media/platform/rcar_jpu.c ++++ b/drivers/media/platform/rcar_jpu.c +@@ -1280,7 +1280,7 @@ static int jpu_open(struct file *file) + /* ...issue software reset */ + ret = jpu_reset(jpu); + if (ret) +- goto device_prepare_rollback; ++ goto jpu_reset_rollback; + } + + jpu->ref_count++; +@@ -1288,6 +1288,8 @@ static int jpu_open(struct file *file) + mutex_unlock(&jpu->mutex); + return 0; + ++jpu_reset_rollback: ++ clk_disable_unprepare(jpu->clk); + device_prepare_rollback: + mutex_unlock(&jpu->mutex); + v4l_prepare_rollback: +diff --git a/drivers/media/radio/si470x/radio-si470x-i2c.c b/drivers/media/radio/si470x/radio-si470x-i2c.c +index b3034f80163f..8ce6f9cff746 100644 +--- a/drivers/media/radio/si470x/radio-si470x-i2c.c ++++ b/drivers/media/radio/si470x/radio-si470x-i2c.c +@@ -92,7 +92,7 @@ MODULE_PARM_DESC(max_rds_errors, "RDS maximum block errors: *1*"); + */ + int si470x_get_register(struct si470x_device *radio, int regnr) + { +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -117,7 +117,7 @@ int si470x_get_register(struct si470x_device *radio, int regnr) + int si470x_set_register(struct si470x_device *radio, int regnr) + { + int i; +- u16 buf[WRITE_REG_NUM]; ++ __be16 buf[WRITE_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +@@ -147,7 +147,7 @@ int si470x_set_register(struct si470x_device *radio, int regnr) + static int si470x_get_all_registers(struct si470x_device *radio) + { + int i; +- u16 buf[READ_REG_NUM]; ++ __be16 buf[READ_REG_NUM]; + struct i2c_msg msgs[1] = { + { + .addr = radio->client->addr, +diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c +index ffbb178c6918..2dbf632c10de 100644 +--- a/drivers/media/v4l2-core/videobuf2-core.c ++++ b/drivers/media/v4l2-core/videobuf2-core.c +@@ -912,9 +912,12 @@ void vb2_buffer_done(struct vb2_buffer *vb, enum vb2_buffer_state state) + dprintk(4, "done processing on buffer %d, state: %d\n", + vb->index, state); + +- /* sync buffers */ +- for (plane = 0; plane < vb->num_planes; ++plane) +- call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ if (state != VB2_BUF_STATE_QUEUED && ++ state != VB2_BUF_STATE_REQUEUEING) { ++ /* sync buffers */ ++ for (plane = 0; plane < vb->num_planes; ++plane) ++ call_void_memop(vb, finish, vb->planes[plane].mem_priv); ++ } + + spin_lock_irqsave(&q->done_lock, flags); + if (state == VB2_BUF_STATE_QUEUED || +diff --git a/drivers/memory/tegra/mc.c b/drivers/memory/tegra/mc.c +index a4803ac192bb..1d49a8dd4a37 100644 +--- a/drivers/memory/tegra/mc.c ++++ b/drivers/memory/tegra/mc.c +@@ -20,14 +20,6 @@ + #include "mc.h" + + #define MC_INTSTATUS 0x000 +-#define MC_INT_DECERR_MTS (1 << 16) +-#define MC_INT_SECERR_SEC (1 << 13) +-#define MC_INT_DECERR_VPR (1 << 12) +-#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) +-#define MC_INT_INVALID_SMMU_PAGE (1 << 10) +-#define MC_INT_ARBITRATION_EMEM (1 << 9) +-#define MC_INT_SECURITY_VIOLATION (1 << 8) +-#define MC_INT_DECERR_EMEM (1 << 6) + + #define MC_INTMASK 0x004 + +@@ -248,12 +240,13 @@ static const char *const error_names[8] = { + static irqreturn_t tegra_mc_irq(int irq, void *data) + { + struct tegra_mc *mc = data; +- unsigned long status, mask; ++ unsigned long status; + unsigned int bit; + + /* mask all interrupts to avoid flooding */ +- status = mc_readl(mc, MC_INTSTATUS); +- mask = mc_readl(mc, MC_INTMASK); ++ status = mc_readl(mc, MC_INTSTATUS) & mc->soc->intmask; ++ if (!status) ++ return IRQ_NONE; + + for_each_set_bit(bit, &status, 32) { + const char *error = status_names[bit] ?: "unknown"; +@@ -346,7 +339,6 @@ static int tegra_mc_probe(struct platform_device *pdev) + const struct of_device_id *match; + struct resource *res; + struct tegra_mc *mc; +- u32 value; + int err; + + match = of_match_node(tegra_mc_of_match, pdev->dev.of_node); +@@ -414,11 +406,7 @@ static int tegra_mc_probe(struct platform_device *pdev) + + WARN(!mc->soc->client_id_mask, "Missing client ID mask for this SoC\n"); + +- value = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | +- MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | +- MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM; +- +- mc_writel(mc, value, MC_INTMASK); ++ mc_writel(mc, mc->soc->intmask, MC_INTMASK); + + return 0; + } +diff --git a/drivers/memory/tegra/mc.h b/drivers/memory/tegra/mc.h +index ddb16676c3af..24e020b4609b 100644 +--- a/drivers/memory/tegra/mc.h ++++ b/drivers/memory/tegra/mc.h +@@ -14,6 +14,15 @@ + + #include + ++#define MC_INT_DECERR_MTS (1 << 16) ++#define MC_INT_SECERR_SEC (1 << 13) ++#define MC_INT_DECERR_VPR (1 << 12) ++#define MC_INT_INVALID_APB_ASID_UPDATE (1 << 11) ++#define MC_INT_INVALID_SMMU_PAGE (1 << 10) ++#define MC_INT_ARBITRATION_EMEM (1 << 9) ++#define MC_INT_SECURITY_VIOLATION (1 << 8) ++#define MC_INT_DECERR_EMEM (1 << 6) ++ + static inline u32 mc_readl(struct tegra_mc *mc, unsigned long offset) + { + return readl(mc->regs + offset); +diff --git a/drivers/memory/tegra/tegra114.c b/drivers/memory/tegra/tegra114.c +index ba8fff3d66a6..6d2a5a849d92 100644 +--- a/drivers/memory/tegra/tegra114.c ++++ b/drivers/memory/tegra/tegra114.c +@@ -930,4 +930,6 @@ const struct tegra_mc_soc tegra114_mc_soc = { + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra114_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +diff --git a/drivers/memory/tegra/tegra124.c b/drivers/memory/tegra/tegra124.c +index 5a58e440f4a7..9f68a56f2727 100644 +--- a/drivers/memory/tegra/tegra124.c ++++ b/drivers/memory/tegra/tegra124.c +@@ -1020,6 +1020,9 @@ const struct tegra_mc_soc tegra124_mc_soc = { + .smmu = &tegra124_smmu_soc, + .emem_regs = tegra124_mc_emem_regs, + .num_emem_regs = ARRAY_SIZE(tegra124_mc_emem_regs), ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_124_SOC */ + +@@ -1042,5 +1045,8 @@ const struct tegra_mc_soc tegra132_mc_soc = { + .atom_size = 32, + .client_id_mask = 0x7f, + .smmu = &tegra132_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; + #endif /* CONFIG_ARCH_TEGRA_132_SOC */ +diff --git a/drivers/memory/tegra/tegra210.c b/drivers/memory/tegra/tegra210.c +index 5e144abe4c18..47c78a6d8f00 100644 +--- a/drivers/memory/tegra/tegra210.c ++++ b/drivers/memory/tegra/tegra210.c +@@ -1077,4 +1077,7 @@ const struct tegra_mc_soc tegra210_mc_soc = { + .atom_size = 64, + .client_id_mask = 0xff, + .smmu = &tegra210_smmu_soc, ++ .intmask = MC_INT_DECERR_MTS | MC_INT_SECERR_SEC | MC_INT_DECERR_VPR | ++ MC_INT_INVALID_APB_ASID_UPDATE | MC_INT_INVALID_SMMU_PAGE | ++ MC_INT_SECURITY_VIOLATION | MC_INT_DECERR_EMEM, + }; +diff --git a/drivers/memory/tegra/tegra30.c b/drivers/memory/tegra/tegra30.c +index b44737840e70..d0689428ea1a 100644 +--- a/drivers/memory/tegra/tegra30.c ++++ b/drivers/memory/tegra/tegra30.c +@@ -952,4 +952,6 @@ const struct tegra_mc_soc tegra30_mc_soc = { + .atom_size = 16, + .client_id_mask = 0x7f, + .smmu = &tegra30_smmu_soc, ++ .intmask = MC_INT_INVALID_SMMU_PAGE | MC_INT_SECURITY_VIOLATION | ++ MC_INT_DECERR_EMEM, + }; +diff --git a/drivers/mfd/cros_ec.c b/drivers/mfd/cros_ec.c +index b0ca5a4c841e..c5528ae982f2 100644 +--- a/drivers/mfd/cros_ec.c ++++ b/drivers/mfd/cros_ec.c +@@ -112,7 +112,11 @@ int cros_ec_register(struct cros_ec_device *ec_dev) + + mutex_init(&ec_dev->lock); + +- cros_ec_query_all(ec_dev); ++ err = cros_ec_query_all(ec_dev); ++ if (err) { ++ dev_err(dev, "Cannot identify the EC: error %d\n", err); ++ return err; ++ } + + if (ec_dev->irq) { + err = request_threaded_irq(ec_dev->irq, NULL, ec_irq_thread, +diff --git a/drivers/mmc/core/pwrseq_simple.c b/drivers/mmc/core/pwrseq_simple.c +index 13ef162cf066..a8b9fee4d62a 100644 +--- a/drivers/mmc/core/pwrseq_simple.c ++++ b/drivers/mmc/core/pwrseq_simple.c +@@ -40,14 +40,18 @@ static void mmc_pwrseq_simple_set_gpios_value(struct mmc_pwrseq_simple *pwrseq, + struct gpio_descs *reset_gpios = pwrseq->reset_gpios; + + if (!IS_ERR(reset_gpios)) { +- int i; +- int values[reset_gpios->ndescs]; ++ int i, *values; ++ int nvalues = reset_gpios->ndescs; + +- for (i = 0; i < reset_gpios->ndescs; i++) ++ values = kmalloc_array(nvalues, sizeof(int), GFP_KERNEL); ++ if (!values) ++ return; ++ ++ for (i = 0; i < nvalues; i++) + values[i] = value; + +- gpiod_set_array_value_cansleep( +- reset_gpios->ndescs, reset_gpios->desc, values); ++ gpiod_set_array_value_cansleep(nvalues, reset_gpios->desc, values); ++ kfree(values); + } + } + +diff --git a/drivers/mmc/host/dw_mmc.c b/drivers/mmc/host/dw_mmc.c +index 6a2cbbba29aa..5252885e5cda 100644 +--- a/drivers/mmc/host/dw_mmc.c ++++ b/drivers/mmc/host/dw_mmc.c +@@ -1255,6 +1255,8 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit) + if (host->state == STATE_WAITING_CMD11_DONE) + sdmmc_cmd_bits |= SDMMC_CMD_VOLT_SWITCH; + ++ slot->mmc->actual_clock = 0; ++ + if (!clock) { + mci_writel(host, CLKENA, 0); + mci_send_cmd(slot, sdmmc_cmd_bits, 0); +@@ -1313,6 +1315,8 @@ static void dw_mci_setup_bus(struct dw_mci_slot *slot, bool force_clkinit) + + /* keep the last clock value that was requested from core */ + slot->__clk_old = clock; ++ slot->mmc->actual_clock = div ? ((host->bus_hz / div) >> 1) : ++ host->bus_hz; + } + + host->current_speed = clock; +diff --git a/drivers/mtd/nand/fsl_ifc_nand.c b/drivers/mtd/nand/fsl_ifc_nand.c +index 4005b427023c..16deba1a2385 100644 +--- a/drivers/mtd/nand/fsl_ifc_nand.c ++++ b/drivers/mtd/nand/fsl_ifc_nand.c +@@ -342,9 +342,16 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command, + + case NAND_CMD_READID: + case NAND_CMD_PARAM: { ++ /* ++ * For READID, read 8 bytes that are currently used. ++ * For PARAM, read all 3 copies of 256-bytes pages. ++ */ ++ int len = 8; + int timing = IFC_FIR_OP_RB; +- if (command == NAND_CMD_PARAM) ++ if (command == NAND_CMD_PARAM) { + timing = IFC_FIR_OP_RBCD; ++ len = 256 * 3; ++ } + + ifc_out32((IFC_FIR_OP_CW0 << IFC_NAND_FIR0_OP0_SHIFT) | + (IFC_FIR_OP_UA << IFC_NAND_FIR0_OP1_SHIFT) | +@@ -354,12 +361,8 @@ static void fsl_ifc_cmdfunc(struct mtd_info *mtd, unsigned int command, + &ifc->ifc_nand.nand_fcr0); + ifc_out32(column, &ifc->ifc_nand.row3); + +- /* +- * although currently it's 8 bytes for READID, we always read +- * the maximum 256 bytes(for PARAM) +- */ +- ifc_out32(256, &ifc->ifc_nand.nand_fbcr); +- ifc_nand_ctrl->read_bytes = 256; ++ ifc_out32(len, &ifc->ifc_nand.nand_fbcr); ++ ifc_nand_ctrl->read_bytes = len; + + set_addr(mtd, 0, 0, 0); + fsl_ifc_run_command(mtd); +diff --git a/drivers/net/dsa/qca8k.c b/drivers/net/dsa/qca8k.c +index 5ada7a41449c..9645c8f05c7f 100644 +--- a/drivers/net/dsa/qca8k.c ++++ b/drivers/net/dsa/qca8k.c +@@ -473,7 +473,7 @@ qca8k_set_pad_ctrl(struct qca8k_priv *priv, int port, int mode) + static void + qca8k_port_set_status(struct qca8k_priv *priv, int port, int enable) + { +- u32 mask = QCA8K_PORT_STATUS_TXMAC; ++ u32 mask = QCA8K_PORT_STATUS_TXMAC | QCA8K_PORT_STATUS_RXMAC; + + /* Port 0 and 6 have no internal PHY */ + if ((port > 0) && (port < 6)) +@@ -490,6 +490,7 @@ qca8k_setup(struct dsa_switch *ds) + { + struct qca8k_priv *priv = (struct qca8k_priv *)ds->priv; + int ret, i, phy_mode = -1; ++ u32 mask; + + /* Make sure that port 0 is the cpu port */ + if (!dsa_is_cpu_port(ds, 0)) { +@@ -515,7 +516,10 @@ qca8k_setup(struct dsa_switch *ds) + if (ret < 0) + return ret; + +- /* Enable CPU Port */ ++ /* Enable CPU Port, force it to maximum bandwidth and full-duplex */ ++ mask = QCA8K_PORT_STATUS_SPEED_1000 | QCA8K_PORT_STATUS_TXFLOW | ++ QCA8K_PORT_STATUS_RXFLOW | QCA8K_PORT_STATUS_DUPLEX; ++ qca8k_write(priv, QCA8K_REG_PORT_STATUS(QCA8K_CPU_PORT), mask); + qca8k_reg_set(priv, QCA8K_REG_GLOBAL_FW_CTRL0, + QCA8K_GLOBAL_FW_CTRL0_CPU_PORT_EN); + qca8k_port_set_status(priv, QCA8K_CPU_PORT, 1); +@@ -584,6 +588,47 @@ qca8k_setup(struct dsa_switch *ds) + return 0; + } + ++static void ++qca8k_adjust_link(struct dsa_switch *ds, int port, struct phy_device *phy) ++{ ++ struct qca8k_priv *priv = ds->priv; ++ u32 reg; ++ ++ /* Force fixed-link setting for CPU port, skip others. */ ++ if (!phy_is_pseudo_fixed_link(phy)) ++ return; ++ ++ /* Set port speed */ ++ switch (phy->speed) { ++ case 10: ++ reg = QCA8K_PORT_STATUS_SPEED_10; ++ break; ++ case 100: ++ reg = QCA8K_PORT_STATUS_SPEED_100; ++ break; ++ case 1000: ++ reg = QCA8K_PORT_STATUS_SPEED_1000; ++ break; ++ default: ++ dev_dbg(priv->dev, "port%d link speed %dMbps not supported.\n", ++ port, phy->speed); ++ return; ++ } ++ ++ /* Set duplex mode */ ++ if (phy->duplex == DUPLEX_FULL) ++ reg |= QCA8K_PORT_STATUS_DUPLEX; ++ ++ /* Force flow control */ ++ if (dsa_is_cpu_port(ds, port)) ++ reg |= QCA8K_PORT_STATUS_RXFLOW | QCA8K_PORT_STATUS_TXFLOW; ++ ++ /* Force link down before changing MAC options */ ++ qca8k_port_set_status(priv, port, 0); ++ qca8k_write(priv, QCA8K_REG_PORT_STATUS(port), reg); ++ qca8k_port_set_status(priv, port, 1); ++} ++ + static int + qca8k_phy_read(struct dsa_switch *ds, int phy, int regnum) + { +@@ -832,6 +877,7 @@ qca8k_get_tag_protocol(struct dsa_switch *ds) + static const struct dsa_switch_ops qca8k_switch_ops = { + .get_tag_protocol = qca8k_get_tag_protocol, + .setup = qca8k_setup, ++ .adjust_link = qca8k_adjust_link, + .get_strings = qca8k_get_strings, + .phy_read = qca8k_phy_read, + .phy_write = qca8k_phy_write, +@@ -863,6 +909,7 @@ qca8k_sw_probe(struct mdio_device *mdiodev) + return -ENOMEM; + + priv->bus = mdiodev->bus; ++ priv->dev = &mdiodev->dev; + + /* read the switches ID register */ + id = qca8k_read(priv, QCA8K_REG_MASK_CTRL); +@@ -934,6 +981,7 @@ static SIMPLE_DEV_PM_OPS(qca8k_pm_ops, + qca8k_suspend, qca8k_resume); + + static const struct of_device_id qca8k_of_match[] = { ++ { .compatible = "qca,qca8334" }, + { .compatible = "qca,qca8337" }, + { /* sentinel */ }, + }; +diff --git a/drivers/net/dsa/qca8k.h b/drivers/net/dsa/qca8k.h +index 1cf8a920d4ff..613fe5c50236 100644 +--- a/drivers/net/dsa/qca8k.h ++++ b/drivers/net/dsa/qca8k.h +@@ -51,8 +51,10 @@ + #define QCA8K_GOL_MAC_ADDR0 0x60 + #define QCA8K_GOL_MAC_ADDR1 0x64 + #define QCA8K_REG_PORT_STATUS(_i) (0x07c + (_i) * 4) +-#define QCA8K_PORT_STATUS_SPEED GENMASK(2, 0) +-#define QCA8K_PORT_STATUS_SPEED_S 0 ++#define QCA8K_PORT_STATUS_SPEED GENMASK(1, 0) ++#define QCA8K_PORT_STATUS_SPEED_10 0 ++#define QCA8K_PORT_STATUS_SPEED_100 0x1 ++#define QCA8K_PORT_STATUS_SPEED_1000 0x2 + #define QCA8K_PORT_STATUS_TXMAC BIT(2) + #define QCA8K_PORT_STATUS_RXMAC BIT(3) + #define QCA8K_PORT_STATUS_TXFLOW BIT(4) +@@ -165,6 +167,7 @@ struct qca8k_priv { + struct ar8xxx_port_status port_sts[QCA8K_NUM_PORTS]; + struct dsa_switch *ds; + struct mutex reg_mutex; ++ struct device *dev; + }; + + struct qca8k_mib_desc { +diff --git a/drivers/net/ethernet/amazon/ena/ena_com.c b/drivers/net/ethernet/amazon/ena/ena_com.c +index 52beba8c7a39..e3b7a71fcad9 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_com.c +@@ -331,6 +331,7 @@ static int ena_com_init_io_sq(struct ena_com_dev *ena_dev, + + memset(&io_sq->desc_addr, 0x0, sizeof(io_sq->desc_addr)); + ++ io_sq->dma_addr_bits = ena_dev->dma_addr_bits; + io_sq->desc_entry_size = + (io_sq->direction == ENA_COM_IO_QUEUE_DIRECTION_TX) ? + sizeof(struct ena_eth_io_tx_desc) : +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +index 1b45cd73a258..119777986ea4 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c +@@ -1128,14 +1128,14 @@ static void xgbe_phy_adjust_link(struct xgbe_prv_data *pdata) + + if (pdata->tx_pause != pdata->phy.tx_pause) { + new_state = 1; +- pdata->hw_if.config_tx_flow_control(pdata); + pdata->tx_pause = pdata->phy.tx_pause; ++ pdata->hw_if.config_tx_flow_control(pdata); + } + + if (pdata->rx_pause != pdata->phy.rx_pause) { + new_state = 1; +- pdata->hw_if.config_rx_flow_control(pdata); + pdata->rx_pause = pdata->phy.rx_pause; ++ pdata->hw_if.config_rx_flow_control(pdata); + } + + /* Speed support */ +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index bfd2d0382f4c..94931318587c 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -5927,6 +5927,9 @@ static int bnxt_update_link(struct bnxt *bp, bool chng_link_state) + } + mutex_unlock(&bp->hwrm_cmd_lock); + ++ if (!BNXT_SINGLE_PF(bp)) ++ return 0; ++ + diff = link_info->support_auto_speeds ^ link_info->advertising; + if ((link_info->support_auto_speeds | diff) != + link_info->support_auto_speeds) { +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index ff7a70ffafc6..c133491ad9fa 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -1272,8 +1272,11 @@ static int hclge_alloc_vport(struct hclge_dev *hdev) + /* We need to alloc a vport for main NIC of PF */ + num_vport = hdev->num_vmdq_vport + hdev->num_req_vfs + 1; + +- if (hdev->num_tqps < num_vport) +- num_vport = hdev->num_tqps; ++ if (hdev->num_tqps < num_vport) { ++ dev_err(&hdev->pdev->dev, "tqps(%d) is less than vports(%d)", ++ hdev->num_tqps, num_vport); ++ return -EINVAL; ++ } + + /* Alloc the same number of TQPs for every vport */ + tqp_per_vport = hdev->num_tqps / num_vport; +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +index d1e4dcec5db2..69726908e72c 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hns3_enet.c +@@ -1598,6 +1598,7 @@ static void hns3_replace_buffer(struct hns3_enet_ring *ring, int i, + hns3_unmap_buffer(ring, &ring->desc_cb[i]); + ring->desc_cb[i] = *res_cb; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) +@@ -1605,6 +1606,7 @@ static void hns3_reuse_buffer(struct hns3_enet_ring *ring, int i) + ring->desc_cb[i].reuse_flag = 0; + ring->desc[i].addr = cpu_to_le64(ring->desc_cb[i].dma + + ring->desc_cb[i].page_offset); ++ ring->desc[i].rx.bd_base_info = 0; + } + + static void hns3_nic_reclaim_one_desc(struct hns3_enet_ring *ring, int *bytes, +@@ -2881,6 +2883,8 @@ static int __init hns3_init_module(void) + + client.ops = &client_ops; + ++ INIT_LIST_HEAD(&client.node); ++ + ret = hnae3_register_client(&client); + if (ret) + return ret; +diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c +index 7a226537877b..6265ce8915b6 100644 +--- a/drivers/net/ethernet/intel/e1000e/netdev.c ++++ b/drivers/net/ethernet/intel/e1000e/netdev.c +@@ -3558,15 +3558,12 @@ s32 e1000e_get_base_timinca(struct e1000_adapter *adapter, u32 *timinca) + } + break; + case e1000_pch_spt: +- if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { +- /* Stable 24MHz frequency */ +- incperiod = INCPERIOD_24MHZ; +- incvalue = INCVALUE_24MHZ; +- shift = INCVALUE_SHIFT_24MHZ; +- adapter->cc.shift = shift; +- break; +- } +- return -EINVAL; ++ /* Stable 24MHz frequency */ ++ incperiod = INCPERIOD_24MHZ; ++ incvalue = INCVALUE_24MHZ; ++ shift = INCVALUE_SHIFT_24MHZ; ++ adapter->cc.shift = shift; ++ break; + case e1000_pch_cnp: + if (er32(TSYNCRXCTL) & E1000_TSYNCRXCTL_SYSCFI) { + /* Stable 24MHz frequency */ +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ptp.c b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +index d8456c381c99..ef242dbae116 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ptp.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ptp.c +@@ -337,6 +337,8 @@ void i40e_ptp_rx_hang(struct i40e_pf *pf) + **/ + void i40e_ptp_tx_hang(struct i40e_pf *pf) + { ++ struct sk_buff *skb; ++ + if (!(pf->flags & I40E_FLAG_PTP) || !pf->ptp_tx) + return; + +@@ -349,9 +351,12 @@ void i40e_ptp_tx_hang(struct i40e_pf *pf) + * within a second it is reasonable to assume that we never will. + */ + if (time_is_before_jiffies(pf->ptp_tx_start + HZ)) { +- dev_kfree_skb_any(pf->ptp_tx_skb); ++ skb = pf->ptp_tx_skb; + pf->ptp_tx_skb = NULL; + clear_bit_unlock(__I40E_PTP_TX_IN_PROGRESS, pf->state); ++ ++ /* Free the skb after we clear the bitlock */ ++ dev_kfree_skb_any(skb); + pf->tx_hwtstamp_timeouts++; + } + } +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 6ca580cdfd84..1c027f9d9af5 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -8376,12 +8376,17 @@ static void igb_rar_set_index(struct igb_adapter *adapter, u32 index) + if (is_valid_ether_addr(addr)) + rar_high |= E1000_RAH_AV; + +- if (hw->mac.type == e1000_82575) ++ switch (hw->mac.type) { ++ case e1000_82575: ++ case e1000_i210: + rar_high |= E1000_RAH_POOL_1 * + adapter->mac_table[index].queue; +- else ++ break; ++ default: + rar_high |= E1000_RAH_POOL_1 << + adapter->mac_table[index].queue; ++ break; ++ } + } + + wr32(E1000_RAL(index), rar_low); +diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +index 90ecc4b06462..90be4385bf36 100644 +--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c ++++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c +@@ -3737,6 +3737,7 @@ static int ixgbevf_set_mac(struct net_device *netdev, void *p) + return -EPERM; + + ether_addr_copy(hw->mac.addr, addr->sa_data); ++ ether_addr_copy(hw->mac.perm_addr, addr->sa_data); + ether_addr_copy(netdev->dev_addr, addr->sa_data); + + return 0; +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 42a6afcaae03..7924f241e3ad 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -912,8 +912,10 @@ mlxsw_sp_port_vlan_bridge_join(struct mlxsw_sp_port_vlan *mlxsw_sp_port_vlan, + int err; + + /* No need to continue if only VLAN flags were changed */ +- if (mlxsw_sp_port_vlan->bridge_port) ++ if (mlxsw_sp_port_vlan->bridge_port) { ++ mlxsw_sp_port_vlan_put(mlxsw_sp_port_vlan); + return 0; ++ } + + err = mlxsw_sp_port_vlan_fid_join(mlxsw_sp_port_vlan, bridge_port); + if (err) +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 27f2e650e27b..1a9a382bf1c4 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -51,7 +51,7 @@ + #include + #include "dwmac1000.h" + +-#define STMMAC_ALIGN(x) L1_CACHE_ALIGN(x) ++#define STMMAC_ALIGN(x) __ALIGN_KERNEL(x, SMP_CACHE_BYTES) + #define TSO_MAX_BUFF_SIZE (SZ_16K - 1) + + /* Module parameters */ +diff --git a/drivers/net/ethernet/ti/cpsw-phy-sel.c b/drivers/net/ethernet/ti/cpsw-phy-sel.c +index 18013645e76c..0c1adad7415d 100644 +--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c ++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c +@@ -177,12 +177,18 @@ void cpsw_phy_sel(struct device *dev, phy_interface_t phy_mode, int slave) + } + + dev = bus_find_device(&platform_bus_type, NULL, node, match); +- of_node_put(node); ++ if (!dev) { ++ dev_err(dev, "unable to find platform device for %pOF\n", node); ++ goto out; ++ } ++ + priv = dev_get_drvdata(dev); + + priv->cpsw_phy_sel(priv, phy_mode, slave); + + put_device(dev); ++out: ++ of_node_put(node); + } + EXPORT_SYMBOL_GPL(cpsw_phy_sel); + +diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h +index cb250cacf721..e33a6c672a0a 100644 +--- a/drivers/net/hyperv/hyperv_net.h ++++ b/drivers/net/hyperv/hyperv_net.h +@@ -724,6 +724,8 @@ struct net_device_context { + struct hv_device *device_ctx; + /* netvsc_device */ + struct netvsc_device __rcu *nvdev; ++ /* list of netvsc net_devices */ ++ struct list_head list; + /* reconfigure work */ + struct delayed_work dwork; + /* last reconfig time */ +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index aeabeb107fed..6a77ef38c549 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -66,6 +66,8 @@ static int debug = -1; + module_param(debug, int, S_IRUGO); + MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)"); + ++static LIST_HEAD(netvsc_dev_list); ++ + static void netvsc_change_rx_flags(struct net_device *net, int change) + { + struct net_device_context *ndev_ctx = netdev_priv(net); +@@ -1749,13 +1751,10 @@ out_unlock: + + static struct net_device *get_netvsc_bymac(const u8 *mac) + { +- struct net_device *dev; +- +- ASSERT_RTNL(); ++ struct net_device_context *ndev_ctx; + +- for_each_netdev(&init_net, dev) { +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ ++ list_for_each_entry(ndev_ctx, &netvsc_dev_list, list) { ++ struct net_device *dev = hv_get_drvdata(ndev_ctx->device_ctx); + + if (ether_addr_equal(mac, dev->perm_addr)) + return dev; +@@ -1766,25 +1765,18 @@ static struct net_device *get_netvsc_bymac(const u8 *mac) + + static struct net_device *get_netvsc_byref(struct net_device *vf_netdev) + { ++ struct net_device_context *net_device_ctx; + struct net_device *dev; + +- ASSERT_RTNL(); +- +- for_each_netdev(&init_net, dev) { +- struct net_device_context *net_device_ctx; ++ dev = netdev_master_upper_dev_get(vf_netdev); ++ if (!dev || dev->netdev_ops != &device_ops) ++ return NULL; /* not a netvsc device */ + +- if (dev->netdev_ops != &device_ops) +- continue; /* not a netvsc device */ ++ net_device_ctx = netdev_priv(dev); ++ if (!rtnl_dereference(net_device_ctx->nvdev)) ++ return NULL; /* device is removed */ + +- net_device_ctx = netdev_priv(dev); +- if (!rtnl_dereference(net_device_ctx->nvdev)) +- continue; /* device is removed */ +- +- if (rtnl_dereference(net_device_ctx->vf_netdev) == vf_netdev) +- return dev; /* a match */ +- } +- +- return NULL; ++ return dev; + } + + /* Called when VF is injecting data into network stack. +@@ -2065,15 +2057,19 @@ static int netvsc_probe(struct hv_device *dev, + else + net->max_mtu = ETH_DATA_LEN; + +- ret = register_netdev(net); ++ rtnl_lock(); ++ ret = register_netdevice(net); + if (ret != 0) { + pr_err("Unable to register netdev.\n"); + goto register_failed; + } + +- return ret; ++ list_add(&net_device_ctx->list, &netvsc_dev_list); ++ rtnl_unlock(); ++ return 0; + + register_failed: ++ rtnl_unlock(); + rndis_filter_device_remove(dev, nvdev); + rndis_failed: + free_percpu(net_device_ctx->vf_stats); +@@ -2119,6 +2115,7 @@ static int netvsc_remove(struct hv_device *dev) + rndis_filter_device_remove(dev, nvdev); + + unregister_netdevice(net); ++ list_del(&ndev_ctx->list); + + rtnl_unlock(); + rcu_read_unlock(); +diff --git a/drivers/net/phy/mdio-mux-bcm-iproc.c b/drivers/net/phy/mdio-mux-bcm-iproc.c +index 0831b7142df7..0c5b68e7da51 100644 +--- a/drivers/net/phy/mdio-mux-bcm-iproc.c ++++ b/drivers/net/phy/mdio-mux-bcm-iproc.c +@@ -218,7 +218,7 @@ out: + + static int mdio_mux_iproc_remove(struct platform_device *pdev) + { +- struct iproc_mdiomux_desc *md = dev_get_platdata(&pdev->dev); ++ struct iproc_mdiomux_desc *md = platform_get_drvdata(pdev); + + mdio_mux_uninit(md->mux_handle); + mdiobus_unregister(md->mii_bus); +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 1b2fe74a44ea..e4a6ed88b9cf 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -561,6 +561,8 @@ void phylink_destroy(struct phylink *pl) + { + if (pl->sfp_bus) + sfp_unregister_upstream(pl->sfp_bus); ++ if (!IS_ERR(pl->link_gpio)) ++ gpiod_put(pl->link_gpio); + + cancel_work_sync(&pl->resolve); + kfree(pl); +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c +index 0aa91ab9a0fb..9e3f632e22f1 100644 +--- a/drivers/net/usb/lan78xx.c ++++ b/drivers/net/usb/lan78xx.c +@@ -1216,6 +1216,8 @@ static int lan78xx_link_reset(struct lan78xx_net *dev) + mod_timer(&dev->stat_monitor, + jiffies + STAT_UPDATE_TIMER); + } ++ ++ tasklet_schedule(&dev->bh); + } + + return ret; +diff --git a/drivers/net/wireless/ath/regd.h b/drivers/net/wireless/ath/regd.h +index 5d80be213fac..869f276cc1d8 100644 +--- a/drivers/net/wireless/ath/regd.h ++++ b/drivers/net/wireless/ath/regd.h +@@ -68,12 +68,14 @@ enum CountryCode { + CTRY_AUSTRALIA = 36, + CTRY_AUSTRIA = 40, + CTRY_AZERBAIJAN = 31, ++ CTRY_BAHAMAS = 44, + CTRY_BAHRAIN = 48, + CTRY_BANGLADESH = 50, + CTRY_BARBADOS = 52, + CTRY_BELARUS = 112, + CTRY_BELGIUM = 56, + CTRY_BELIZE = 84, ++ CTRY_BERMUDA = 60, + CTRY_BOLIVIA = 68, + CTRY_BOSNIA_HERZ = 70, + CTRY_BRAZIL = 76, +@@ -159,6 +161,7 @@ enum CountryCode { + CTRY_ROMANIA = 642, + CTRY_RUSSIA = 643, + CTRY_SAUDI_ARABIA = 682, ++ CTRY_SERBIA = 688, + CTRY_SERBIA_MONTENEGRO = 891, + CTRY_SINGAPORE = 702, + CTRY_SLOVAKIA = 703, +@@ -170,11 +173,13 @@ enum CountryCode { + CTRY_SWITZERLAND = 756, + CTRY_SYRIA = 760, + CTRY_TAIWAN = 158, ++ CTRY_TANZANIA = 834, + CTRY_THAILAND = 764, + CTRY_TRINIDAD_Y_TOBAGO = 780, + CTRY_TUNISIA = 788, + CTRY_TURKEY = 792, + CTRY_UAE = 784, ++ CTRY_UGANDA = 800, + CTRY_UKRAINE = 804, + CTRY_UNITED_KINGDOM = 826, + CTRY_UNITED_STATES = 840, +diff --git a/drivers/net/wireless/ath/regd_common.h b/drivers/net/wireless/ath/regd_common.h +index bdd2b4d61f2f..15bbd1e0d912 100644 +--- a/drivers/net/wireless/ath/regd_common.h ++++ b/drivers/net/wireless/ath/regd_common.h +@@ -35,6 +35,7 @@ enum EnumRd { + FRANCE_RES = 0x31, + FCC3_FCCA = 0x3A, + FCC3_WORLD = 0x3B, ++ FCC3_ETSIC = 0x3F, + + ETSI1_WORLD = 0x37, + ETSI3_ETSIA = 0x32, +@@ -44,6 +45,7 @@ enum EnumRd { + ETSI4_ETSIC = 0x38, + ETSI5_WORLD = 0x39, + ETSI6_WORLD = 0x34, ++ ETSI8_WORLD = 0x3D, + ETSI_RESERVED = 0x33, + + MKK1_MKKA = 0x40, +@@ -59,6 +61,7 @@ enum EnumRd { + MKK1_MKKA1 = 0x4A, + MKK1_MKKA2 = 0x4B, + MKK1_MKKC = 0x4C, ++ APL2_FCCA = 0x4D, + + APL3_FCCA = 0x50, + APL1_WORLD = 0x52, +@@ -67,6 +70,7 @@ enum EnumRd { + APL1_ETSIC = 0x55, + APL2_ETSIC = 0x56, + APL5_WORLD = 0x58, ++ APL13_WORLD = 0x5A, + APL6_WORLD = 0x5B, + APL7_FCCA = 0x5C, + APL8_WORLD = 0x5D, +@@ -168,6 +172,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = { + {FCC2_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC3_FCCA, CTL_FCC, CTL_FCC}, + {FCC3_WORLD, CTL_FCC, CTL_ETSI}, ++ {FCC3_ETSIC, CTL_FCC, CTL_ETSI}, + {FCC4_FCCA, CTL_FCC, CTL_FCC}, + {FCC5_FCCA, CTL_FCC, CTL_FCC}, + {FCC6_FCCA, CTL_FCC, CTL_FCC}, +@@ -179,6 +184,7 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = { + {ETSI4_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI5_WORLD, CTL_ETSI, CTL_ETSI}, + {ETSI6_WORLD, CTL_ETSI, CTL_ETSI}, ++ {ETSI8_WORLD, CTL_ETSI, CTL_ETSI}, + + /* XXX: For ETSI3_ETSIA, Was NO_CTL meant for the 2 GHz band ? */ + {ETSI3_ETSIA, CTL_ETSI, CTL_ETSI}, +@@ -188,9 +194,11 @@ static struct reg_dmn_pair_mapping regDomainPairs[] = { + {FCC1_FCCA, CTL_FCC, CTL_FCC}, + {APL1_WORLD, CTL_FCC, CTL_ETSI}, + {APL2_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL2_FCCA, CTL_FCC, CTL_FCC}, + {APL3_WORLD, CTL_FCC, CTL_ETSI}, + {APL4_WORLD, CTL_FCC, CTL_ETSI}, + {APL5_WORLD, CTL_FCC, CTL_ETSI}, ++ {APL13_WORLD, CTL_ETSI, CTL_ETSI}, + {APL6_WORLD, CTL_ETSI, CTL_ETSI}, + {APL8_WORLD, CTL_ETSI, CTL_ETSI}, + {APL9_WORLD, CTL_ETSI, CTL_ETSI}, +@@ -298,6 +306,7 @@ static struct country_code_to_enum_rd allCountries[] = { + {CTRY_AUSTRALIA2, FCC6_WORLD, "AU"}, + {CTRY_AUSTRIA, ETSI1_WORLD, "AT"}, + {CTRY_AZERBAIJAN, ETSI4_WORLD, "AZ"}, ++ {CTRY_BAHAMAS, FCC3_WORLD, "BS"}, + {CTRY_BAHRAIN, APL6_WORLD, "BH"}, + {CTRY_BANGLADESH, NULL1_WORLD, "BD"}, + {CTRY_BARBADOS, FCC2_WORLD, "BB"}, +@@ -305,6 +314,7 @@ static struct country_code_to_enum_rd allCountries[] = { + {CTRY_BELGIUM, ETSI1_WORLD, "BE"}, + {CTRY_BELGIUM2, ETSI4_WORLD, "BL"}, + {CTRY_BELIZE, APL1_ETSIC, "BZ"}, ++ {CTRY_BERMUDA, FCC3_FCCA, "BM"}, + {CTRY_BOLIVIA, APL1_ETSIC, "BO"}, + {CTRY_BOSNIA_HERZ, ETSI1_WORLD, "BA"}, + {CTRY_BRAZIL, FCC3_WORLD, "BR"}, +@@ -444,6 +454,7 @@ static struct country_code_to_enum_rd allCountries[] = { + {CTRY_ROMANIA, NULL1_WORLD, "RO"}, + {CTRY_RUSSIA, NULL1_WORLD, "RU"}, + {CTRY_SAUDI_ARABIA, NULL1_WORLD, "SA"}, ++ {CTRY_SERBIA, ETSI1_WORLD, "RS"}, + {CTRY_SERBIA_MONTENEGRO, ETSI1_WORLD, "CS"}, + {CTRY_SINGAPORE, APL6_WORLD, "SG"}, + {CTRY_SLOVAKIA, ETSI1_WORLD, "SK"}, +@@ -455,10 +466,12 @@ static struct country_code_to_enum_rd allCountries[] = { + {CTRY_SWITZERLAND, ETSI1_WORLD, "CH"}, + {CTRY_SYRIA, NULL1_WORLD, "SY"}, + {CTRY_TAIWAN, APL3_FCCA, "TW"}, ++ {CTRY_TANZANIA, APL1_WORLD, "TZ"}, + {CTRY_THAILAND, FCC3_WORLD, "TH"}, + {CTRY_TRINIDAD_Y_TOBAGO, FCC3_WORLD, "TT"}, + {CTRY_TUNISIA, ETSI3_WORLD, "TN"}, + {CTRY_TURKEY, ETSI3_WORLD, "TR"}, ++ {CTRY_UGANDA, FCC3_WORLD, "UG"}, + {CTRY_UKRAINE, NULL1_WORLD, "UA"}, + {CTRY_UAE, NULL1_WORLD, "AE"}, + {CTRY_UNITED_KINGDOM, ETSI1_WORLD, "GB"}, +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +index cd587325e286..dd6e27513cc1 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/bcmsdh.c +@@ -1098,6 +1098,7 @@ static const struct sdio_device_id brcmf_sdmmc_ids[] = { + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43340), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43341), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43362), ++ BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43364), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4335_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_4339), + BRCMF_SDIO_DEVICE(SDIO_DEVICE_ID_BROADCOM_43430), +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +index a06b6612b658..ca99c3cf41c2 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/rx.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/rx.c +@@ -901,6 +901,8 @@ static int _iwl_pcie_rx_init(struct iwl_trans *trans) + } + def_rxq = trans_pcie->rxq; + ++ cancel_work_sync(&rba->rx_alloc); ++ + spin_lock(&rba->lock); + atomic_set(&rba->req_pending, 0); + atomic_set(&rba->req_ready, 0); +diff --git a/drivers/net/wireless/marvell/mwifiex/usb.c b/drivers/net/wireless/marvell/mwifiex/usb.c +index f4f2b9b27e32..50890cab8807 100644 +--- a/drivers/net/wireless/marvell/mwifiex/usb.c ++++ b/drivers/net/wireless/marvell/mwifiex/usb.c +@@ -644,6 +644,9 @@ static void mwifiex_usb_disconnect(struct usb_interface *intf) + MWIFIEX_FUNC_SHUTDOWN); + } + ++ if (adapter->workqueue) ++ flush_workqueue(adapter->workqueue); ++ + mwifiex_usb_free(card); + + mwifiex_dbg(adapter, FATAL, +diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c +index 0cd68ffc2c74..51ccf10f4413 100644 +--- a/drivers/net/wireless/marvell/mwifiex/util.c ++++ b/drivers/net/wireless/marvell/mwifiex/util.c +@@ -708,12 +708,14 @@ void mwifiex_hist_data_set(struct mwifiex_private *priv, u8 rx_rate, s8 snr, + s8 nflr) + { + struct mwifiex_histogram_data *phist_data = priv->hist_data; ++ s8 nf = -nflr; ++ s8 rssi = snr - nflr; + + atomic_inc(&phist_data->num_samples); + atomic_inc(&phist_data->rx_rate[rx_rate]); +- atomic_inc(&phist_data->snr[snr]); +- atomic_inc(&phist_data->noise_flr[128 + nflr]); +- atomic_inc(&phist_data->sig_str[nflr - snr]); ++ atomic_inc(&phist_data->snr[snr + 128]); ++ atomic_inc(&phist_data->noise_flr[nf + 128]); ++ atomic_inc(&phist_data->sig_str[rssi + 128]); + } + + /* function to reset histogram data during init/reset */ +diff --git a/drivers/net/wireless/rsi/rsi_91x_hal.c b/drivers/net/wireless/rsi/rsi_91x_hal.c +index 070dfd68bb83..120b0ff545c1 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_hal.c ++++ b/drivers/net/wireless/rsi/rsi_91x_hal.c +@@ -557,28 +557,32 @@ static int bl_write_header(struct rsi_hw *adapter, u8 *flash_content, + u32 content_size) + { + struct rsi_host_intf_ops *hif_ops = adapter->host_intf_ops; +- struct bl_header bl_hdr; ++ struct bl_header *bl_hdr; + u32 write_addr, write_len; + int status; + +- bl_hdr.flags = 0; +- bl_hdr.image_no = cpu_to_le32(adapter->priv->coex_mode); +- bl_hdr.check_sum = cpu_to_le32( +- *(u32 *)&flash_content[CHECK_SUM_OFFSET]); +- bl_hdr.flash_start_address = cpu_to_le32( +- *(u32 *)&flash_content[ADDR_OFFSET]); +- bl_hdr.flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); ++ bl_hdr = kzalloc(sizeof(*bl_hdr), GFP_KERNEL); ++ if (!bl_hdr) ++ return -ENOMEM; ++ ++ bl_hdr->flags = 0; ++ bl_hdr->image_no = cpu_to_le32(adapter->priv->coex_mode); ++ bl_hdr->check_sum = ++ cpu_to_le32(*(u32 *)&flash_content[CHECK_SUM_OFFSET]); ++ bl_hdr->flash_start_address = ++ cpu_to_le32(*(u32 *)&flash_content[ADDR_OFFSET]); ++ bl_hdr->flash_len = cpu_to_le32(*(u32 *)&flash_content[LEN_OFFSET]); + write_len = sizeof(struct bl_header); + + if (adapter->rsi_host_intf == RSI_HOST_INTF_USB) { + write_addr = PING_BUFFER_ADDRESS; + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } else { + write_addr = PING_BUFFER_ADDRESS >> 16; +@@ -587,20 +591,23 @@ static int bl_write_header(struct rsi_hw *adapter, u8 *flash_content, + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return status; ++ goto fail; + } + write_addr = RSI_SD_REQUEST_MASTER | + (PING_BUFFER_ADDRESS & 0xFFFF); + status = hif_ops->write_reg_multiple(adapter, write_addr, +- (u8 *)&bl_hdr, write_len); ++ (u8 *)bl_hdr, write_len); + if (status < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to load Version/CRC structure\n", + __func__); +- return status; ++ goto fail; + } + } +- return 0; ++ status = 0; ++fail: ++ kfree(bl_hdr); ++ return status; + } + + static u32 read_flash_capacity(struct rsi_hw *adapter) +diff --git a/drivers/net/wireless/rsi/rsi_91x_sdio.c b/drivers/net/wireless/rsi/rsi_91x_sdio.c +index 370161ca2a1c..0362967874aa 100644 +--- a/drivers/net/wireless/rsi/rsi_91x_sdio.c ++++ b/drivers/net/wireless/rsi/rsi_91x_sdio.c +@@ -161,7 +161,6 @@ static void rsi_reset_card(struct sdio_func *pfunction) + int err; + struct mmc_card *card = pfunction->card; + struct mmc_host *host = card->host; +- s32 bit = (fls(host->ocr_avail) - 1); + u8 cmd52_resp; + u32 clock, resp, i; + u16 rca; +@@ -181,7 +180,6 @@ static void rsi_reset_card(struct sdio_func *pfunction) + msleep(20); + + /* Initialize the SDIO card */ +- host->ios.vdd = bit; + host->ios.chip_select = MMC_CS_DONTCARE; + host->ios.bus_mode = MMC_BUSMODE_OPENDRAIN; + host->ios.power_mode = MMC_POWER_UP; +@@ -970,17 +968,21 @@ static void ulp_read_write(struct rsi_hw *adapter, u16 addr, u32 data, + /*This function resets and re-initializes the chip.*/ + static void rsi_reset_chip(struct rsi_hw *adapter) + { +- __le32 data; ++ u8 *data; + u8 sdio_interrupt_status = 0; + u8 request = 1; + int ret; + ++ data = kzalloc(sizeof(u32), GFP_KERNEL); ++ if (!data) ++ return; ++ + rsi_dbg(INFO_ZONE, "Writing disable to wakeup register\n"); + ret = rsi_sdio_write_register(adapter, 0, SDIO_WAKEUP_REG, &request); + if (ret < 0) { + rsi_dbg(ERR_ZONE, + "%s: Failed to write SDIO wakeup register\n", __func__); +- return; ++ goto err; + } + msleep(20); + ret = rsi_sdio_read_register(adapter, RSI_FN1_INT_REGISTER, +@@ -988,7 +990,7 @@ static void rsi_reset_chip(struct rsi_hw *adapter) + if (ret < 0) { + rsi_dbg(ERR_ZONE, "%s: Failed to Read Intr Status Register\n", + __func__); +- return; ++ goto err; + } + rsi_dbg(INFO_ZONE, "%s: Intr Status Register value = %d\n", + __func__, sdio_interrupt_status); +@@ -998,17 +1000,17 @@ static void rsi_reset_chip(struct rsi_hw *adapter) + rsi_dbg(ERR_ZONE, + "%s: Unable to set ms word to common reg\n", + __func__); +- return; ++ goto err; + } + +- data = TA_HOLD_THREAD_VALUE; ++ put_unaligned_le32(TA_HOLD_THREAD_VALUE, data); + if (rsi_sdio_write_register_multiple(adapter, TA_HOLD_THREAD_REG | + RSI_SD_REQUEST_MASTER, +- (u8 *)&data, 4)) { ++ data, 4)) { + rsi_dbg(ERR_ZONE, + "%s: Unable to hold Thread-Arch processor threads\n", + __func__); +- return; ++ goto err; + } + + /* This msleep will ensure Thread-Arch processor to go to hold +@@ -1029,6 +1031,9 @@ static void rsi_reset_chip(struct rsi_hw *adapter) + * read write operations to complete for chip reset. + */ + msleep(500); ++err: ++ kfree(data); ++ return; + } + + /** +diff --git a/drivers/net/wireless/rsi/rsi_sdio.h b/drivers/net/wireless/rsi/rsi_sdio.h +index 903392039200..6788fbbdd166 100644 +--- a/drivers/net/wireless/rsi/rsi_sdio.h ++++ b/drivers/net/wireless/rsi/rsi_sdio.h +@@ -85,7 +85,7 @@ enum sdio_interrupt_type { + #define TA_SOFT_RST_CLR 0 + #define TA_SOFT_RST_SET BIT(0) + #define TA_PC_ZERO 0 +-#define TA_HOLD_THREAD_VALUE cpu_to_le32(0xF) ++#define TA_HOLD_THREAD_VALUE 0xF + #define TA_RELEASE_THREAD_VALUE cpu_to_le32(0xF) + #define TA_BASE_ADDR 0x2200 + #define MISC_CFG_BASE_ADDR 0x4105 +diff --git a/drivers/net/wireless/ti/wlcore/sdio.c b/drivers/net/wireless/ti/wlcore/sdio.c +index f8a1fea64e25..219d1a86b92e 100644 +--- a/drivers/net/wireless/ti/wlcore/sdio.c ++++ b/drivers/net/wireless/ti/wlcore/sdio.c +@@ -406,6 +406,11 @@ static int wl1271_suspend(struct device *dev) + mmc_pm_flag_t sdio_flags; + int ret = 0; + ++ if (!wl) { ++ dev_err(dev, "no wilink module was probed\n"); ++ goto out; ++ } ++ + dev_dbg(dev, "wl1271 suspend. wow_enabled: %d\n", + wl->wow_enabled); + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index f07b9c9bb5ba..dfc076f9ee4b 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -87,6 +87,7 @@ struct netfront_cb { + /* IRQ name is queue name with "-tx" or "-rx" appended */ + #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) + ++static DECLARE_WAIT_QUEUE_HEAD(module_load_q); + static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); + + struct netfront_stats { +@@ -239,7 +240,7 @@ static void rx_refill_timeout(unsigned long data) + static int netfront_tx_slot_available(struct netfront_queue *queue) + { + return (queue->tx.req_prod_pvt - queue->tx.rsp_cons) < +- (NET_TX_RING_SIZE - MAX_SKB_FRAGS - 2); ++ (NET_TX_RING_SIZE - XEN_NETIF_NR_SLOTS_MIN - 1); + } + + static void xennet_maybe_wake_tx(struct netfront_queue *queue) +@@ -790,7 +791,7 @@ static int xennet_get_responses(struct netfront_queue *queue, + RING_IDX cons = queue->rx.rsp_cons; + struct sk_buff *skb = xennet_get_rx_skb(queue, cons); + grant_ref_t ref = xennet_get_rx_ref(queue, cons); +- int max = MAX_SKB_FRAGS + (rx->status <= RX_COPY_THRESHOLD); ++ int max = XEN_NETIF_NR_SLOTS_MIN + (rx->status <= RX_COPY_THRESHOLD); + int slots = 1; + int err = 0; + unsigned long ret; +@@ -1330,6 +1331,11 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + netif_carrier_off(netdev); + + xenbus_switch_state(dev, XenbusStateInitialising); ++ wait_event(module_load_q, ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateClosed && ++ xenbus_read_driver_state(dev->otherend) != ++ XenbusStateUnknown); + return netdev; + + exit: +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index 4cac4755abef..f5643d107cc6 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -2519,6 +2519,9 @@ static pci_ers_result_t nvme_slot_reset(struct pci_dev *pdev) + + static void nvme_error_resume(struct pci_dev *pdev) + { ++ struct nvme_dev *dev = pci_get_drvdata(pdev); ++ ++ flush_work(&dev->ctrl.reset_work); + pci_cleanup_aer_uncorrect_error_status(pdev); + } + +@@ -2562,6 +2565,8 @@ static const struct pci_device_id nvme_id_table[] = { + .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE(0x1d1d, 0x2807), /* CNEX WL */ + .driver_data = NVME_QUIRK_LIGHTNVM, }, ++ { PCI_DEVICE(0x1d1d, 0x2601), /* CNEX Granby */ ++ .driver_data = NVME_QUIRK_LIGHTNVM, }, + { PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001) }, + { PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2003) }, +diff --git a/drivers/nvme/host/rdma.c b/drivers/nvme/host/rdma.c +index 93a082e0bdd4..48a831d58e7a 100644 +--- a/drivers/nvme/host/rdma.c ++++ b/drivers/nvme/host/rdma.c +@@ -796,7 +796,7 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, + if (error) { + dev_err(ctrl->ctrl.device, + "prop_get NVME_REG_CAP failed\n"); +- goto out_cleanup_queue; ++ goto out_stop_queue; + } + + ctrl->ctrl.sqsize = +@@ -804,23 +804,25 @@ static int nvme_rdma_configure_admin_queue(struct nvme_rdma_ctrl *ctrl, + + error = nvme_enable_ctrl(&ctrl->ctrl, ctrl->ctrl.cap); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + ctrl->ctrl.max_hw_sectors = + (ctrl->max_fr_pages - 1) << (ilog2(SZ_4K) - 9); + + error = nvme_init_identify(&ctrl->ctrl); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + error = nvme_rdma_alloc_qe(ctrl->queues[0].device->dev, + &ctrl->async_event_sqe, sizeof(struct nvme_command), + DMA_TO_DEVICE); + if (error) +- goto out_cleanup_queue; ++ goto out_stop_queue; + + return 0; + ++out_stop_queue: ++ nvme_rdma_stop_queue(&ctrl->queues[0]); + out_cleanup_queue: + if (new) + blk_cleanup_queue(ctrl->ctrl.admin_q); +diff --git a/drivers/nvmem/core.c b/drivers/nvmem/core.c +index d12e5de78e70..2afafd5d8915 100644 +--- a/drivers/nvmem/core.c ++++ b/drivers/nvmem/core.c +@@ -1049,6 +1049,8 @@ static inline void *nvmem_cell_prepare_write_buffer(struct nvmem_cell *cell, + + /* setup the first byte with lsb bits from nvmem */ + rc = nvmem_reg_read(nvmem, cell->offset, &v, 1); ++ if (rc) ++ goto err; + *b++ |= GENMASK(bit_offset - 1, 0) & v; + + /* setup rest of the byte if any */ +@@ -1067,11 +1069,16 @@ static inline void *nvmem_cell_prepare_write_buffer(struct nvmem_cell *cell, + /* setup the last byte with msb bits from nvmem */ + rc = nvmem_reg_read(nvmem, + cell->offset + cell->bytes - 1, &v, 1); ++ if (rc) ++ goto err; + *p |= GENMASK(7, (nbits + bit_offset) % BITS_PER_BYTE) & v; + + } + + return buf; ++err: ++ kfree(buf); ++ return ERR_PTR(rc); + } + + /** +diff --git a/drivers/pci/host/pci-xgene.c b/drivers/pci/host/pci-xgene.c +index 087645116ecb..c78fd9c2cf8c 100644 +--- a/drivers/pci/host/pci-xgene.c ++++ b/drivers/pci/host/pci-xgene.c +@@ -686,7 +686,6 @@ static int xgene_pcie_probe_bridge(struct platform_device *pdev) + + bus = bridge->bus; + +- pci_scan_child_bus(bus); + pci_assign_unassigned_bus_resources(bus); + list_for_each_entry(child, &bus->children, node) + pcie_bus_configure_settings(child); +diff --git a/drivers/pci/hotplug/pciehp_hpc.c b/drivers/pci/hotplug/pciehp_hpc.c +index 05832b597e53..46c2ee2caf28 100644 +--- a/drivers/pci/hotplug/pciehp_hpc.c ++++ b/drivers/pci/hotplug/pciehp_hpc.c +@@ -863,6 +863,13 @@ struct controller *pcie_init(struct pcie_device *dev) + if (pdev->hotplug_user_indicators) + slot_cap &= ~(PCI_EXP_SLTCAP_AIP | PCI_EXP_SLTCAP_PIP); + ++ /* ++ * We assume no Thunderbolt controllers support Command Complete events, ++ * but some controllers falsely claim they do. ++ */ ++ if (pdev->is_thunderbolt) ++ slot_cap |= PCI_EXP_SLTCAP_NCCS; ++ + ctrl->slot_cap = slot_cap; + mutex_init(&ctrl->ctrl_lock); + init_waitqueue_head(&ctrl->queue); +diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c +index 00fa4278c1f4..c3f0473d1afa 100644 +--- a/drivers/pci/pci-sysfs.c ++++ b/drivers/pci/pci-sysfs.c +@@ -305,13 +305,16 @@ static ssize_t enable_store(struct device *dev, struct device_attribute *attr, + if (!capable(CAP_SYS_ADMIN)) + return -EPERM; + +- if (!val) { +- if (pci_is_enabled(pdev)) +- pci_disable_device(pdev); +- else +- result = -EIO; +- } else ++ device_lock(dev); ++ if (dev->driver) ++ result = -EBUSY; ++ else if (val) + result = pci_enable_device(pdev); ++ else if (pci_is_enabled(pdev)) ++ pci_disable_device(pdev); ++ else ++ result = -EIO; ++ device_unlock(dev); + + return result < 0 ? result : count; + } +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index f285cd74088e..4bccaf688aad 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -516,12 +516,14 @@ static void devm_pci_release_host_bridge_dev(struct device *dev) + + if (bridge->release_fn) + bridge->release_fn(bridge); ++ ++ pci_free_resource_list(&bridge->windows); + } + + static void pci_release_host_bridge_dev(struct device *dev) + { + devm_pci_release_host_bridge_dev(dev); +- pci_free_host_bridge(to_pci_host_bridge(dev)); ++ kfree(to_pci_host_bridge(dev)); + } + + struct pci_host_bridge *pci_alloc_host_bridge(size_t priv) +diff --git a/drivers/pinctrl/pinctrl-at91-pio4.c b/drivers/pinctrl/pinctrl-at91-pio4.c +index b1ca838dd80a..e61e2f8c91ce 100644 +--- a/drivers/pinctrl/pinctrl-at91-pio4.c ++++ b/drivers/pinctrl/pinctrl-at91-pio4.c +@@ -576,8 +576,10 @@ static int atmel_pctl_dt_node_to_map(struct pinctrl_dev *pctldev, + for_each_child_of_node(np_config, np) { + ret = atmel_pctl_dt_subnode_to_map(pctldev, np, map, + &reserved_maps, num_maps); +- if (ret < 0) ++ if (ret < 0) { ++ of_node_put(np); + break; ++ } + } + } + +diff --git a/drivers/regulator/cpcap-regulator.c b/drivers/regulator/cpcap-regulator.c +index f541b80f1b54..bd910fe123d9 100644 +--- a/drivers/regulator/cpcap-regulator.c ++++ b/drivers/regulator/cpcap-regulator.c +@@ -222,7 +222,7 @@ static unsigned int cpcap_map_mode(unsigned int mode) + case CPCAP_BIT_AUDIO_LOW_PWR: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +diff --git a/drivers/regulator/of_regulator.c b/drivers/regulator/of_regulator.c +index c9875355905d..a3bf7c993723 100644 +--- a/drivers/regulator/of_regulator.c ++++ b/drivers/regulator/of_regulator.c +@@ -31,6 +31,7 @@ static void of_get_regulation_constraints(struct device_node *np, + struct regulation_constraints *constraints = &(*init_data)->constraints; + struct regulator_state *suspend_state; + struct device_node *suspend_np; ++ unsigned int mode; + int ret, i; + u32 pval; + +@@ -124,11 +125,11 @@ static void of_get_regulation_constraints(struct device_node *np, + + if (!of_property_read_u32(np, "regulator-initial-mode", &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", np->name, pval); + else +- constraints->initial_mode = ret; ++ constraints->initial_mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +@@ -163,12 +164,12 @@ static void of_get_regulation_constraints(struct device_node *np, + if (!of_property_read_u32(suspend_np, "regulator-mode", + &pval)) { + if (desc && desc->of_map_mode) { +- ret = desc->of_map_mode(pval); +- if (ret == -EINVAL) ++ mode = desc->of_map_mode(pval); ++ if (mode == REGULATOR_MODE_INVALID) + pr_err("%s: invalid mode %u\n", + np->name, pval); + else +- suspend_state->mode = ret; ++ suspend_state->mode = mode; + } else { + pr_warn("%s: mapping for mode %d not defined\n", + np->name, pval); +diff --git a/drivers/regulator/pfuze100-regulator.c b/drivers/regulator/pfuze100-regulator.c +index 63922a2167e5..659e516455be 100644 +--- a/drivers/regulator/pfuze100-regulator.c ++++ b/drivers/regulator/pfuze100-regulator.c +@@ -158,6 +158,7 @@ static const struct regulator_ops pfuze100_sw_regulator_ops = { + static const struct regulator_ops pfuze100_swb_regulator_ops = { + .enable = regulator_enable_regmap, + .disable = regulator_disable_regmap, ++ .is_enabled = regulator_is_enabled_regmap, + .list_voltage = regulator_list_voltage_table, + .map_voltage = regulator_map_voltage_ascend, + .set_voltage_sel = regulator_set_voltage_sel_regmap, +diff --git a/drivers/regulator/twl-regulator.c b/drivers/regulator/twl-regulator.c +index a4456db5849d..884c7505ed91 100644 +--- a/drivers/regulator/twl-regulator.c ++++ b/drivers/regulator/twl-regulator.c +@@ -274,7 +274,7 @@ static inline unsigned int twl4030reg_map_mode(unsigned int mode) + case RES_STATE_SLEEP: + return REGULATOR_MODE_STANDBY; + default: +- return -EINVAL; ++ return REGULATOR_MODE_INVALID; + } + } + +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index 9eb32ead63db..e4f951e968a4 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -359,6 +359,11 @@ int rtc_set_alarm(struct rtc_device *rtc, struct rtc_wkalrm *alarm) + { + int err; + ++ if (!rtc->ops) ++ return -ENODEV; ++ else if (!rtc->ops->set_alarm) ++ return -EINVAL; ++ + err = rtc_valid_tm(&alarm->time); + if (err != 0) + return err; +diff --git a/drivers/rtc/rtc-tps6586x.c b/drivers/rtc/rtc-tps6586x.c +index a3418a8a3796..97fdc99bfeef 100644 +--- a/drivers/rtc/rtc-tps6586x.c ++++ b/drivers/rtc/rtc-tps6586x.c +@@ -276,14 +276,15 @@ static int tps6586x_rtc_probe(struct platform_device *pdev) + device_init_wakeup(&pdev->dev, 1); + + platform_set_drvdata(pdev, rtc); +- rtc->rtc = devm_rtc_device_register(&pdev->dev, dev_name(&pdev->dev), +- &tps6586x_rtc_ops, THIS_MODULE); ++ rtc->rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc->rtc)) { + ret = PTR_ERR(rtc->rtc); +- dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ dev_err(&pdev->dev, "RTC allocate device: ret %d\n", ret); + goto fail_rtc_register; + } + ++ rtc->rtc->ops = &tps6586x_rtc_ops; ++ + ret = devm_request_threaded_irq(&pdev->dev, rtc->irq, NULL, + tps6586x_rtc_irq, + IRQF_ONESHOT, +@@ -294,6 +295,13 @@ static int tps6586x_rtc_probe(struct platform_device *pdev) + goto fail_rtc_register; + } + disable_irq(rtc->irq); ++ ++ ret = rtc_register_device(rtc->rtc); ++ if (ret) { ++ dev_err(&pdev->dev, "RTC device register: ret %d\n", ret); ++ goto fail_rtc_register; ++ } ++ + return 0; + + fail_rtc_register: +diff --git a/drivers/rtc/rtc-tps65910.c b/drivers/rtc/rtc-tps65910.c +index d0244d7979fc..a56b526db89a 100644 +--- a/drivers/rtc/rtc-tps65910.c ++++ b/drivers/rtc/rtc-tps65910.c +@@ -380,6 +380,10 @@ static int tps65910_rtc_probe(struct platform_device *pdev) + if (!tps_rtc) + return -ENOMEM; + ++ tps_rtc->rtc = devm_rtc_allocate_device(&pdev->dev); ++ if (IS_ERR(tps_rtc->rtc)) ++ return PTR_ERR(tps_rtc->rtc); ++ + /* Clear pending interrupts */ + ret = regmap_read(tps65910->regmap, TPS65910_RTC_STATUS, &rtc_reg); + if (ret < 0) +@@ -421,10 +425,10 @@ static int tps65910_rtc_probe(struct platform_device *pdev) + tps_rtc->irq = irq; + device_set_wakeup_capable(&pdev->dev, 1); + +- tps_rtc->rtc = devm_rtc_device_register(&pdev->dev, pdev->name, +- &tps65910_rtc_ops, THIS_MODULE); +- if (IS_ERR(tps_rtc->rtc)) { +- ret = PTR_ERR(tps_rtc->rtc); ++ tps_rtc->rtc->ops = &tps65910_rtc_ops; ++ ++ ret = rtc_register_device(tps_rtc->rtc); ++ if (ret) { + dev_err(&pdev->dev, "RTC device register: err %d\n", ret); + return ret; + } +diff --git a/drivers/rtc/rtc-vr41xx.c b/drivers/rtc/rtc-vr41xx.c +index 7ce22967fd16..7ed010714f29 100644 +--- a/drivers/rtc/rtc-vr41xx.c ++++ b/drivers/rtc/rtc-vr41xx.c +@@ -292,13 +292,14 @@ static int rtc_probe(struct platform_device *pdev) + goto err_rtc1_iounmap; + } + +- rtc = devm_rtc_device_register(&pdev->dev, rtc_name, &vr41xx_rtc_ops, +- THIS_MODULE); ++ rtc = devm_rtc_allocate_device(&pdev->dev); + if (IS_ERR(rtc)) { + retval = PTR_ERR(rtc); + goto err_iounmap_all; + } + ++ rtc->ops = &vr41xx_rtc_ops; ++ + rtc->max_user_freq = MAX_PERIODIC_RATE; + + spin_lock_irq(&rtc_lock); +@@ -340,6 +341,10 @@ static int rtc_probe(struct platform_device *pdev) + + dev_info(&pdev->dev, "Real Time Clock of NEC VR4100 series\n"); + ++ retval = rtc_register_device(rtc); ++ if (retval) ++ goto err_iounmap_all; ++ + return 0; + + err_iounmap_all: +diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c +index b415ba42ca73..599447032e50 100644 +--- a/drivers/s390/scsi/zfcp_dbf.c ++++ b/drivers/s390/scsi/zfcp_dbf.c +@@ -285,6 +285,8 @@ void zfcp_dbf_rec_trig(char *tag, struct zfcp_adapter *adapter, + struct list_head *entry; + unsigned long flags; + ++ lockdep_assert_held(&adapter->erp_lock); ++ + if (unlikely(!debug_level_enabled(dbf->rec, level))) + return; + +diff --git a/drivers/scsi/3w-9xxx.c b/drivers/scsi/3w-9xxx.c +index 00e7968a1d70..a1388842e17e 100644 +--- a/drivers/scsi/3w-9xxx.c ++++ b/drivers/scsi/3w-9xxx.c +@@ -886,6 +886,11 @@ static int twa_chrdev_open(struct inode *inode, struct file *file) + unsigned int minor_number; + int retval = TW_IOCTL_ERROR_OS_ENODEV; + ++ if (!capable(CAP_SYS_ADMIN)) { ++ retval = -EACCES; ++ goto out; ++ } ++ + minor_number = iminor(inode); + if (minor_number >= twa_device_extension_count) + goto out; +diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c +index 33261b690774..f6179e3d6953 100644 +--- a/drivers/scsi/3w-xxxx.c ++++ b/drivers/scsi/3w-xxxx.c +@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *inode, struct file *file) + + dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n"); + ++ if (!capable(CAP_SYS_ADMIN)) ++ return -EACCES; ++ + minor_number = iminor(inode); + if (minor_number >= tw_device_extension_count) + return -ENODEV; +diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c +index 0b6467206f8e..737314cac8d8 100644 +--- a/drivers/scsi/cxlflash/main.c ++++ b/drivers/scsi/cxlflash/main.c +@@ -946,9 +946,9 @@ static void cxlflash_remove(struct pci_dev *pdev) + return; + } + +- /* If a Task Management Function is active, wait for it to complete +- * before continuing with remove. +- */ ++ /* Yield to running recovery threads before continuing with remove */ ++ wait_event(cfg->reset_waitq, cfg->state != STATE_RESET && ++ cfg->state != STATE_PROBING); + spin_lock_irqsave(&cfg->tmf_slock, lock_flags); + if (cfg->tmf_active) + wait_event_interruptible_lock_irq(cfg->tmf_waitq, +@@ -1303,7 +1303,10 @@ static void afu_err_intr_init(struct afu *afu) + for (i = 0; i < afu->num_hwqs; i++) { + hwq = get_hwq(afu, i); + +- writeq_be(SISL_MSI_SYNC_ERROR, &hwq->host_map->ctx_ctrl); ++ reg = readq_be(&hwq->host_map->ctx_ctrl); ++ WARN_ON((reg & SISL_CTX_CTRL_LISN_MASK) != 0); ++ reg |= SISL_MSI_SYNC_ERROR; ++ writeq_be(reg, &hwq->host_map->ctx_ctrl); + writeq_be(SISL_ISTATUS_MASK, &hwq->host_map->intr_mask); + } + } +diff --git a/drivers/scsi/cxlflash/sislite.h b/drivers/scsi/cxlflash/sislite.h +index 09daa86670fc..0892fb1f0a1e 100644 +--- a/drivers/scsi/cxlflash/sislite.h ++++ b/drivers/scsi/cxlflash/sislite.h +@@ -284,6 +284,7 @@ struct sisl_host_map { + __be64 cmd_room; + __be64 ctx_ctrl; /* least significant byte or b56:63 is LISN# */ + #define SISL_CTX_CTRL_UNMAP_SECTOR 0x8000000000000000ULL /* b0 */ ++#define SISL_CTX_CTRL_LISN_MASK (0xFFULL) + __be64 mbox_w; /* restricted use */ + __be64 sq_start; /* Submission Queue (R/W): write sequence and */ + __be64 sq_end; /* inclusion semantics are the same as RRQ */ +diff --git a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +index 2e5fa9717be8..871962b2e2f6 100644 +--- a/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c ++++ b/drivers/scsi/hisi_sas/hisi_sas_v3_hw.c +@@ -328,10 +328,11 @@ enum { + #define DIR_TO_DEVICE 2 + #define DIR_RESERVED 3 + +-#define CMD_IS_UNCONSTRAINT(cmd) \ +- ((cmd == ATA_CMD_READ_LOG_EXT) || \ +- (cmd == ATA_CMD_READ_LOG_DMA_EXT) || \ +- (cmd == ATA_CMD_DEV_RESET)) ++#define FIS_CMD_IS_UNCONSTRAINED(fis) \ ++ ((fis.command == ATA_CMD_READ_LOG_EXT) || \ ++ (fis.command == ATA_CMD_READ_LOG_DMA_EXT) || \ ++ ((fis.command == ATA_CMD_DEV_RESET) && \ ++ ((fis.control & ATA_SRST) != 0))) + + static u32 hisi_sas_read32(struct hisi_hba *hisi_hba, u32 off) + { +@@ -1044,7 +1045,7 @@ static int prep_ata_v3_hw(struct hisi_hba *hisi_hba, + << CMD_HDR_FRAME_TYPE_OFF; + dw1 |= sas_dev->device_id << CMD_HDR_DEV_ID_OFF; + +- if (CMD_IS_UNCONSTRAINT(task->ata_task.fis.command)) ++ if (FIS_CMD_IS_UNCONSTRAINED(task->ata_task.fis)) + dw1 |= 1 << CMD_HDR_UNCON_CMD_OFF; + + hdr->dw1 = cpu_to_le32(dw1); +diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c +index 7195cff51d4c..9b6f5d024dba 100644 +--- a/drivers/scsi/megaraid.c ++++ b/drivers/scsi/megaraid.c +@@ -4199,6 +4199,9 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) + int irq, i, j; + int error = -ENODEV; + ++ if (hba_count >= MAX_CONTROLLERS) ++ goto out; ++ + if (pci_enable_device(pdev)) + goto out; + pci_set_master(pdev); +diff --git a/drivers/scsi/megaraid/megaraid_sas_fusion.c b/drivers/scsi/megaraid/megaraid_sas_fusion.c +index d8f626567f59..06a2e3d9fc5b 100644 +--- a/drivers/scsi/megaraid/megaraid_sas_fusion.c ++++ b/drivers/scsi/megaraid/megaraid_sas_fusion.c +@@ -2677,6 +2677,9 @@ megasas_build_syspd_fusion(struct megasas_instance *instance, + pRAID_Context->timeout_value = cpu_to_le16(os_timeout_value); + pRAID_Context->virtual_disk_tgt_id = cpu_to_le16(device_id); + } else { ++ if (os_timeout_value) ++ os_timeout_value++; ++ + /* system pd Fast Path */ + io_request->Function = MPI2_FUNCTION_SCSI_IO_REQUEST; + timeout_limit = (scmd->device->type == TYPE_DISK) ? +diff --git a/drivers/scsi/qedf/qedf_main.c b/drivers/scsi/qedf/qedf_main.c +index 7c0064500cc5..382edb79a0de 100644 +--- a/drivers/scsi/qedf/qedf_main.c ++++ b/drivers/scsi/qedf/qedf_main.c +@@ -1649,6 +1649,15 @@ static int qedf_vport_destroy(struct fc_vport *vport) + struct Scsi_Host *shost = vport_to_shost(vport); + struct fc_lport *n_port = shost_priv(shost); + struct fc_lport *vn_port = vport->dd_data; ++ struct qedf_ctx *qedf = lport_priv(vn_port); ++ ++ if (!qedf) { ++ QEDF_ERR(NULL, "qedf is NULL.\n"); ++ goto out; ++ } ++ ++ /* Set unloading bit on vport qedf_ctx to prevent more I/O */ ++ set_bit(QEDF_UNLOADING, &qedf->flags); + + mutex_lock(&n_port->lp_mutex); + list_del(&vn_port->list); +@@ -1675,6 +1684,7 @@ static int qedf_vport_destroy(struct fc_vport *vport) + if (vn_port->host) + scsi_host_put(vn_port->host); + ++out: + return 0; + } + +diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c +index a5e30e9449ef..375cede0c534 100644 +--- a/drivers/scsi/scsi_dh.c ++++ b/drivers/scsi/scsi_dh.c +@@ -58,7 +58,10 @@ static const struct scsi_dh_blist scsi_dh_blist[] = { + {"IBM", "3526", "rdac", }, + {"IBM", "3542", "rdac", }, + {"IBM", "3552", "rdac", }, +- {"SGI", "TP9", "rdac", }, ++ {"SGI", "TP9300", "rdac", }, ++ {"SGI", "TP9400", "rdac", }, ++ {"SGI", "TP9500", "rdac", }, ++ {"SGI", "TP9700", "rdac", }, + {"SGI", "IS", "rdac", }, + {"STK", "OPENstorage", "rdac", }, + {"STK", "FLEXLINE 380", "rdac", }, +diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c +index 3bb1f6cc297a..21c81c1feac5 100644 +--- a/drivers/scsi/ufs/ufshcd.c ++++ b/drivers/scsi/ufs/ufshcd.c +@@ -4947,6 +4947,7 @@ static void ufshcd_exception_event_handler(struct work_struct *work) + hba = container_of(work, struct ufs_hba, eeh_work); + + pm_runtime_get_sync(hba->dev); ++ scsi_block_requests(hba->host); + err = ufshcd_get_ee_status(hba, &status); + if (err) { + dev_err(hba->dev, "%s: failed to get exception status %d\n", +@@ -4960,6 +4961,7 @@ static void ufshcd_exception_event_handler(struct work_struct *work) + ufshcd_bkops_exception_event_handler(hba); + + out: ++ scsi_unblock_requests(hba->host); + pm_runtime_put_sync(hba->dev); + return; + } +@@ -6761,9 +6763,16 @@ static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on, + if (list_empty(head)) + goto out; + +- ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * before disabling the clocks managed here. ++ */ ++ if (!on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, PRE_CHANGE); ++ if (ret) ++ return ret; ++ } + + list_for_each_entry(clki, head, list) { + if (!IS_ERR_OR_NULL(clki->clk)) { +@@ -6787,9 +6796,16 @@ static int __ufshcd_setup_clocks(struct ufs_hba *hba, bool on, + } + } + +- ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); +- if (ret) +- return ret; ++ /* ++ * vendor specific setup_clocks ops may depend on clocks managed by ++ * this standard driver hence call the vendor specific setup_clocks ++ * after enabling the clocks managed here. ++ */ ++ if (on) { ++ ret = ufshcd_vops_setup_clocks(hba, on, POST_CHANGE); ++ if (ret) ++ return ret; ++ } + + out: + if (ret) { +diff --git a/drivers/soc/imx/gpcv2.c b/drivers/soc/imx/gpcv2.c +index afc7ecc3c187..f4e3bd40c72e 100644 +--- a/drivers/soc/imx/gpcv2.c ++++ b/drivers/soc/imx/gpcv2.c +@@ -155,7 +155,7 @@ static int imx7_gpc_pu_pgc_sw_pdn_req(struct generic_pm_domain *genpd) + return imx7_gpc_pu_pgc_sw_pxx_req(genpd, false); + } + +-static struct imx7_pgc_domain imx7_pgc_domains[] = { ++static const struct imx7_pgc_domain imx7_pgc_domains[] = { + [IMX7_POWER_DOMAIN_MIPI_PHY] = { + .genpd = { + .name = "mipi-phy", +@@ -321,11 +321,6 @@ static int imx_gpcv2_probe(struct platform_device *pdev) + continue; + } + +- domain = &imx7_pgc_domains[domain_index]; +- domain->regmap = regmap; +- domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; +- domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; +- + pd_pdev = platform_device_alloc("imx7-pgc-domain", + domain_index); + if (!pd_pdev) { +@@ -334,7 +329,20 @@ static int imx_gpcv2_probe(struct platform_device *pdev) + return -ENOMEM; + } + +- pd_pdev->dev.platform_data = domain; ++ ret = platform_device_add_data(pd_pdev, ++ &imx7_pgc_domains[domain_index], ++ sizeof(imx7_pgc_domains[domain_index])); ++ if (ret) { ++ platform_device_put(pd_pdev); ++ of_node_put(np); ++ return ret; ++ } ++ ++ domain = pd_pdev->dev.platform_data; ++ domain->regmap = regmap; ++ domain->genpd.power_on = imx7_gpc_pu_pgc_sw_pup_req; ++ domain->genpd.power_off = imx7_gpc_pu_pgc_sw_pdn_req; ++ + pd_pdev->dev.parent = dev; + pd_pdev->dev.of_node = np; + +diff --git a/drivers/spi/spi-meson-spicc.c b/drivers/spi/spi-meson-spicc.c +index 7f8429635502..a5b0df7e6131 100644 +--- a/drivers/spi/spi-meson-spicc.c ++++ b/drivers/spi/spi-meson-spicc.c +@@ -574,10 +574,15 @@ static int meson_spicc_probe(struct platform_device *pdev) + master->max_speed_hz = rate >> 2; + + ret = devm_spi_register_master(&pdev->dev, master); +- if (!ret) +- return 0; ++ if (ret) { ++ dev_err(&pdev->dev, "spi master registration failed\n"); ++ goto out_clk; ++ } + +- dev_err(&pdev->dev, "spi master registration failed\n"); ++ return 0; ++ ++out_clk: ++ clk_disable_unprepare(spicc->core); + + out_master: + spi_master_put(master); +diff --git a/drivers/spi/spi-s3c64xx.c b/drivers/spi/spi-s3c64xx.c +index b392cca8fa4f..1a6ec226d6e4 100644 +--- a/drivers/spi/spi-s3c64xx.c ++++ b/drivers/spi/spi-s3c64xx.c +@@ -1273,8 +1273,6 @@ static int s3c64xx_spi_resume(struct device *dev) + if (ret < 0) + return ret; + +- s3c64xx_spi_hwinit(sdd, sdd->port_id); +- + return spi_master_resume(master); + } + #endif /* CONFIG_PM_SLEEP */ +@@ -1312,6 +1310,8 @@ static int s3c64xx_spi_runtime_resume(struct device *dev) + if (ret != 0) + goto err_disable_src_clk; + ++ s3c64xx_spi_hwinit(sdd, sdd->port_id); ++ + return 0; + + err_disable_src_clk: +diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c +index 52056535f54e..0fea18ab970e 100644 +--- a/drivers/spi/spi-sh-msiof.c ++++ b/drivers/spi/spi-sh-msiof.c +@@ -555,14 +555,16 @@ static int sh_msiof_spi_setup(struct spi_device *spi) + + /* Configure native chip select mode/polarity early */ + clr = MDR1_SYNCMD_MASK; +- set = MDR1_TRMD | TMDR1_PCON | MDR1_SYNCMD_SPI; ++ set = MDR1_SYNCMD_SPI; + if (spi->mode & SPI_CS_HIGH) + clr |= BIT(MDR1_SYNCAC_SHIFT); + else + set |= BIT(MDR1_SYNCAC_SHIFT); + pm_runtime_get_sync(&p->pdev->dev); + tmp = sh_msiof_read(p, TMDR1) & ~clr; +- sh_msiof_write(p, TMDR1, tmp | set); ++ sh_msiof_write(p, TMDR1, tmp | set | MDR1_TRMD | TMDR1_PCON); ++ tmp = sh_msiof_read(p, RMDR1) & ~clr; ++ sh_msiof_write(p, RMDR1, tmp | set); + pm_runtime_put(&p->pdev->dev); + p->native_cs_high = spi->mode & SPI_CS_HIGH; + p->native_cs_inited = true; +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index 84dfef4bd6ae..f85d30dc9187 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -1222,6 +1222,7 @@ static void __spi_pump_messages(struct spi_controller *ctlr, bool in_kthread) + if (!was_busy && ctlr->auto_runtime_pm) { + ret = pm_runtime_get_sync(ctlr->dev.parent); + if (ret < 0) { ++ pm_runtime_put_noidle(ctlr->dev.parent); + dev_err(&ctlr->dev, "Failed to power device: %d\n", + ret); + mutex_unlock(&ctlr->io_mutex); +diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +index 284cdd44a2ee..8b92cf06d063 100644 +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd.c +@@ -1710,7 +1710,7 @@ int kiblnd_fmr_pool_map(struct kib_fmr_poolset *fps, struct kib_tx *tx, + return 0; + } + spin_unlock(&fps->fps_lock); +- rc = -EBUSY; ++ rc = -EAGAIN; + } + + spin_lock(&fps->fps_lock); +diff --git a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +index 29e10021b906..4b4a20149894 100644 +--- a/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c ++++ b/drivers/staging/lustre/lnet/klnds/o2iblnd/o2iblnd_cb.c +@@ -47,7 +47,7 @@ static int kiblnd_init_rdma(struct kib_conn *conn, struct kib_tx *tx, int type, + __u64 dstcookie); + static void kiblnd_queue_tx_locked(struct kib_tx *tx, struct kib_conn *conn); + static void kiblnd_queue_tx(struct kib_tx *tx, struct kib_conn *conn); +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx); ++static void kiblnd_unmap_tx(struct kib_tx *tx); + static void kiblnd_check_sends_locked(struct kib_conn *conn); + + static void +@@ -65,7 +65,7 @@ kiblnd_tx_done(struct lnet_ni *ni, struct kib_tx *tx) + LASSERT(!tx->tx_waiting); /* mustn't be awaiting peer response */ + LASSERT(tx->tx_pool); + +- kiblnd_unmap_tx(ni, tx); ++ kiblnd_unmap_tx(tx); + + /* tx may have up to 2 lnet msgs to finalise */ + lntmsg[0] = tx->tx_lntmsg[0]; tx->tx_lntmsg[0] = NULL; +@@ -590,13 +590,9 @@ kiblnd_fmr_map_tx(struct kib_net *net, struct kib_tx *tx, struct kib_rdma_desc * + return 0; + } + +-static void kiblnd_unmap_tx(struct lnet_ni *ni, struct kib_tx *tx) ++static void kiblnd_unmap_tx(struct kib_tx *tx) + { +- struct kib_net *net = ni->ni_data; +- +- LASSERT(net); +- +- if (net->ibn_fmr_ps) ++ if (tx->fmr.fmr_pfmr || tx->fmr.fmr_frd) + kiblnd_fmr_pool_unmap(&tx->fmr, tx->tx_status); + + if (tx->tx_nfrags) { +@@ -1289,11 +1285,6 @@ kiblnd_connect_peer(struct kib_peer *peer) + goto failed2; + } + +- LASSERT(cmid->device); +- CDEBUG(D_NET, "%s: connection bound to %s:%pI4h:%s\n", +- libcfs_nid2str(peer->ibp_nid), dev->ibd_ifname, +- &dev->ibd_ifip, cmid->device->name); +- + return; + + failed2: +@@ -2995,8 +2986,19 @@ kiblnd_cm_callback(struct rdma_cm_id *cmid, struct rdma_cm_event *event) + } else { + rc = rdma_resolve_route( + cmid, *kiblnd_tunables.kib_timeout * 1000); +- if (!rc) ++ if (!rc) { ++ struct kib_net *net = peer->ibp_ni->ni_data; ++ struct kib_dev *dev = net->ibn_dev; ++ ++ CDEBUG(D_NET, "%s: connection bound to "\ ++ "%s:%pI4h:%s\n", ++ libcfs_nid2str(peer->ibp_nid), ++ dev->ibd_ifname, ++ &dev->ibd_ifip, cmid->device->name); ++ + return 0; ++ } ++ + /* Can't initiate route resolution */ + CERROR("Can't resolve route for %s: %d\n", + libcfs_nid2str(peer->ibp_nid), rc); +diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c +index b5d84f3f6071..11e01c48f51a 100644 +--- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c ++++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c +@@ -1571,8 +1571,10 @@ struct ldlm_lock *ldlm_lock_create(struct ldlm_namespace *ns, + return ERR_CAST(res); + + lock = ldlm_lock_new(res); +- if (!lock) ++ if (!lock) { ++ ldlm_resource_putref(res); + return ERR_PTR(-ENOMEM); ++ } + + lock->l_req_mode = mode; + lock->l_ast_data = data; +@@ -1615,6 +1617,8 @@ out: + return ERR_PTR(rc); + } + ++ ++ + /** + * Enqueue (request) a lock. + * On the client this is called from ldlm_cli_enqueue_fini +diff --git a/drivers/staging/lustre/lustre/llite/xattr.c b/drivers/staging/lustre/lustre/llite/xattr.c +index 0be55623bac4..364d697b2690 100644 +--- a/drivers/staging/lustre/lustre/llite/xattr.c ++++ b/drivers/staging/lustre/lustre/llite/xattr.c +@@ -93,7 +93,11 @@ ll_xattr_set_common(const struct xattr_handler *handler, + __u64 valid; + int rc; + +- if (flags == XATTR_REPLACE) { ++ /* When setxattr() is called with a size of 0 the value is ++ * unconditionally replaced by "". When removexattr() is ++ * called we get a NULL value and XATTR_REPLACE for flags. ++ */ ++ if (!value && flags == XATTR_REPLACE) { + ll_stats_ops_tally(ll_i2sbi(inode), LPROC_LL_REMOVEXATTR, 1); + valid = OBD_MD_FLXATTRRM; + } else { +diff --git a/drivers/staging/media/atomisp/i2c/ov2680.c b/drivers/staging/media/atomisp/i2c/ov2680.c +index 51b7d61df0f5..179576224319 100644 +--- a/drivers/staging/media/atomisp/i2c/ov2680.c ++++ b/drivers/staging/media/atomisp/i2c/ov2680.c +@@ -396,12 +396,11 @@ static long __ov2680_set_exposure(struct v4l2_subdev *sd, int coarse_itg, + { + struct i2c_client *client = v4l2_get_subdevdata(sd); + struct ov2680_device *dev = to_ov2680_sensor(sd); +- u16 vts,hts; ++ u16 vts; + int ret,exp_val; + + dev_dbg(&client->dev, "+++++++__ov2680_set_exposure coarse_itg %d, gain %d, digitgain %d++\n",coarse_itg, gain, digitgain); + +- hts = ov2680_res[dev->fmt_idx].pixels_per_line; + vts = ov2680_res[dev->fmt_idx].lines_per_frame; + + /* group hold */ +@@ -1190,7 +1189,8 @@ static int ov2680_detect(struct i2c_client *client) + OV2680_SC_CMMN_SUB_ID, &high); + revision = (u8) high & 0x0f; + +- dev_info(&client->dev, "sensor_revision id = 0x%x\n", id); ++ dev_info(&client->dev, "sensor_revision id = 0x%x, rev= %d\n", ++ id, revision); + + return 0; + } +diff --git a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c +index 0592ac1f2832..cfe6bb610014 100644 +--- a/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c ++++ b/drivers/staging/media/atomisp/pci/atomisp2/atomisp_compat_ioctl32.c +@@ -81,7 +81,7 @@ static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, + get_user(kp->flags, &up->flags)) + return -EFAULT; + +- kp->base = compat_ptr(tmp); ++ kp->base = (void __force *)compat_ptr(tmp); + get_v4l2_pix_format((struct v4l2_pix_format *)&kp->fmt, &up->fmt); + return 0; + } +@@ -232,10 +232,10 @@ static int get_atomisp_dvs_6axis_config32(struct atomisp_dvs_6axis_config *kp, + get_user(ycoords_uv, &up->ycoords_uv)) + return -EFAULT; + +- kp->xcoords_y = compat_ptr(xcoords_y); +- kp->ycoords_y = compat_ptr(ycoords_y); +- kp->xcoords_uv = compat_ptr(xcoords_uv); +- kp->ycoords_uv = compat_ptr(ycoords_uv); ++ kp->xcoords_y = (void __force *)compat_ptr(xcoords_y); ++ kp->ycoords_y = (void __force *)compat_ptr(ycoords_y); ++ kp->xcoords_uv = (void __force *)compat_ptr(xcoords_uv); ++ kp->ycoords_uv = (void __force *)compat_ptr(ycoords_uv); + return 0; + } + +@@ -296,7 +296,7 @@ static int get_atomisp_metadata_stat32(struct atomisp_metadata *kp, + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -360,7 +360,7 @@ static int get_atomisp_metadata_by_type_stat32( + return -EFAULT; + + kp->data = compat_ptr(data); +- kp->effective_width = compat_ptr(effective_width); ++ kp->effective_width = (void __force *)compat_ptr(effective_width); + return 0; + } + +@@ -437,7 +437,7 @@ static int get_atomisp_overlay32(struct atomisp_overlay *kp, + get_user(kp->overlay_start_x, &up->overlay_start_y)) + return -EFAULT; + +- kp->frame = compat_ptr(frame); ++ kp->frame = (void __force *)compat_ptr(frame); + return 0; + } + +@@ -481,7 +481,7 @@ static int get_atomisp_calibration_group32( + get_user(calb_grp_values, &up->calb_grp_values)) + return -EFAULT; + +- kp->calb_grp_values = compat_ptr(calb_grp_values); ++ kp->calb_grp_values = (void __force *)compat_ptr(calb_grp_values); + return 0; + } + +@@ -703,8 +703,8 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, + return -EFAULT; + + while (n >= 0) { +- compat_uptr_t *src = (compat_uptr_t *)up + n; +- uintptr_t *dst = (uintptr_t *)kp + n; ++ compat_uptr_t __user *src = ((compat_uptr_t __user *)up) + n; ++ uintptr_t *dst = ((uintptr_t *)kp) + n; + + if (get_user((*dst), src)) + return -EFAULT; +@@ -751,12 +751,12 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, + #endif + return -EFAULT; + +- kp->shading_table = user_ptr + offset; ++ kp->shading_table = (void __force *)user_ptr + offset; + offset = sizeof(struct atomisp_shading_table); + if (!kp->shading_table) + return -EFAULT; + +- if (copy_to_user(kp->shading_table, ++ if (copy_to_user((void __user *)kp->shading_table, + &karg.shading_table, + sizeof(struct atomisp_shading_table))) + return -EFAULT; +@@ -777,13 +777,14 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, + #endif + return -EFAULT; + +- kp->morph_table = user_ptr + offset; ++ kp->morph_table = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_morph_table); + if (!kp->morph_table) + return -EFAULT; + +- if (copy_to_user(kp->morph_table, &karg.morph_table, +- sizeof(struct atomisp_morph_table))) ++ if (copy_to_user((void __user *)kp->morph_table, ++ &karg.morph_table, ++ sizeof(struct atomisp_morph_table))) + return -EFAULT; + } + +@@ -802,13 +803,14 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, + #endif + return -EFAULT; + +- kp->dvs2_coefs = user_ptr + offset; ++ kp->dvs2_coefs = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dis_coefficients); + if (!kp->dvs2_coefs) + return -EFAULT; + +- if (copy_to_user(kp->dvs2_coefs, &karg.dvs2_coefs, +- sizeof(struct atomisp_dis_coefficients))) ++ if (copy_to_user((void __user *)kp->dvs2_coefs, ++ &karg.dvs2_coefs, ++ sizeof(struct atomisp_dis_coefficients))) + return -EFAULT; + } + /* handle dvs 6axis configuration */ +@@ -826,13 +828,14 @@ static int get_atomisp_parameters32(struct atomisp_parameters *kp, + #endif + return -EFAULT; + +- kp->dvs_6axis_config = user_ptr + offset; ++ kp->dvs_6axis_config = (void __force *)user_ptr + offset; + offset += sizeof(struct atomisp_dvs_6axis_config); + if (!kp->dvs_6axis_config) + return -EFAULT; + +- if (copy_to_user(kp->dvs_6axis_config, &karg.dvs_6axis_config, +- sizeof(struct atomisp_dvs_6axis_config))) ++ if (copy_to_user((void __user *)kp->dvs_6axis_config, ++ &karg.dvs_6axis_config, ++ sizeof(struct atomisp_dvs_6axis_config))) + return -EFAULT; + } + } +@@ -891,7 +894,7 @@ static int get_atomisp_sensor_ae_bracketing_lut( + get_user(lut, &up->lut)) + return -EFAULT; + +- kp->lut = compat_ptr(lut); ++ kp->lut = (void __force *)compat_ptr(lut); + return 0; + } + +diff --git a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +index 486be990d7fc..a457034818c3 100644 +--- a/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c ++++ b/drivers/staging/vc04_services/interface/vchiq_arm/vchiq_core.c +@@ -601,6 +601,7 @@ reserve_space(VCHIQ_STATE_T *state, size_t space, int is_blocking) + } + + if (tx_pos == (state->slot_queue_available * VCHIQ_SLOT_SIZE)) { ++ up(&state->slot_available_event); + pr_warn("%s: invalid tx_pos: %d\n", __func__, tx_pos); + return NULL; + } +diff --git a/drivers/thermal/samsung/exynos_tmu.c b/drivers/thermal/samsung/exynos_tmu.c +index ac83f721db24..d60069b5dc98 100644 +--- a/drivers/thermal/samsung/exynos_tmu.c ++++ b/drivers/thermal/samsung/exynos_tmu.c +@@ -598,6 +598,7 @@ static int exynos5433_tmu_initialize(struct platform_device *pdev) + threshold_code = temp_to_code(data, temp); + + rising_threshold = readl(data->base + rising_reg_offset); ++ rising_threshold &= ~(0xff << j * 8); + rising_threshold |= (threshold_code << j * 8); + writel(rising_threshold, data->base + rising_reg_offset); + +diff --git a/drivers/tty/hvc/hvc_opal.c b/drivers/tty/hvc/hvc_opal.c +index 16331a90c1e8..9da8474fe50a 100644 +--- a/drivers/tty/hvc/hvc_opal.c ++++ b/drivers/tty/hvc/hvc_opal.c +@@ -332,7 +332,6 @@ static void udbg_init_opal_common(void) + udbg_putc = udbg_opal_putc; + udbg_getc = udbg_opal_getc; + udbg_getc_poll = udbg_opal_getc_poll; +- tb_ticks_per_usec = 0x200; /* Make udelay not suck */ + } + + void __init hvc_opal_init_early(void) +diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c +index 64338442050e..899e8fe5e00f 100644 +--- a/drivers/tty/pty.c ++++ b/drivers/tty/pty.c +@@ -110,16 +110,19 @@ static void pty_unthrottle(struct tty_struct *tty) + static int pty_write(struct tty_struct *tty, const unsigned char *buf, int c) + { + struct tty_struct *to = tty->link; ++ unsigned long flags; + + if (tty->stopped) + return 0; + + if (c > 0) { ++ spin_lock_irqsave(&to->port->lock, flags); + /* Stuff the data into the input queue of the other end */ + c = tty_insert_flip_string(to->port, buf, c); + /* And shovel */ + if (c) + tty_flip_buffer_push(to->port); ++ spin_unlock_irqrestore(&to->port->lock, flags); + } + return c; + } +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index a8bc48b26c23..a9db0887edca 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -3361,6 +3361,10 @@ static int wait_for_connected(struct usb_device *udev, + while (delay_ms < 2000) { + if (status || *portstatus & USB_PORT_STAT_CONNECTION) + break; ++ if (!port_is_power_on(hub, *portstatus)) { ++ status = -ENODEV; ++ break; ++ } + msleep(20); + delay_ms += 20; + status = hub_port_status(hub, *port1, portstatus, portchange); +diff --git a/drivers/usb/gadget/udc/renesas_usb3.c b/drivers/usb/gadget/udc/renesas_usb3.c +index 4cfa72cb0a91..c12a1a6554ba 100644 +--- a/drivers/usb/gadget/udc/renesas_usb3.c ++++ b/drivers/usb/gadget/udc/renesas_usb3.c +@@ -334,6 +334,7 @@ struct renesas_usb3 { + struct usb_gadget_driver *driver; + struct extcon_dev *extcon; + struct work_struct extcon_work; ++ struct dentry *dentry; + + struct renesas_usb3_ep *usb3_ep; + int num_usb3_eps; +@@ -2397,8 +2398,12 @@ static void renesas_usb3_debugfs_init(struct renesas_usb3 *usb3, + + file = debugfs_create_file("b_device", 0644, root, usb3, + &renesas_usb3_b_device_fops); +- if (!file) ++ if (!file) { + dev_info(dev, "%s: Can't create debugfs mode\n", __func__); ++ debugfs_remove_recursive(root); ++ } else { ++ usb3->dentry = root; ++ } + } + + /*------- platform_driver ------------------------------------------------*/ +@@ -2406,6 +2411,7 @@ static int renesas_usb3_remove(struct platform_device *pdev) + { + struct renesas_usb3 *usb3 = platform_get_drvdata(pdev); + ++ debugfs_remove_recursive(usb3->dentry); + device_remove_file(&pdev->dev, &dev_attr_role); + + usb_del_gadget_udc(&usb3->gadget); +diff --git a/drivers/vfio/mdev/mdev_core.c b/drivers/vfio/mdev/mdev_core.c +index 126991046eb7..0212f0ee8aea 100644 +--- a/drivers/vfio/mdev/mdev_core.c ++++ b/drivers/vfio/mdev/mdev_core.c +@@ -66,34 +66,6 @@ uuid_le mdev_uuid(struct mdev_device *mdev) + } + EXPORT_SYMBOL(mdev_uuid); + +-static int _find_mdev_device(struct device *dev, void *data) +-{ +- struct mdev_device *mdev; +- +- if (!dev_is_mdev(dev)) +- return 0; +- +- mdev = to_mdev_device(dev); +- +- if (uuid_le_cmp(mdev->uuid, *(uuid_le *)data) == 0) +- return 1; +- +- return 0; +-} +- +-static bool mdev_device_exist(struct mdev_parent *parent, uuid_le uuid) +-{ +- struct device *dev; +- +- dev = device_find_child(parent->dev, &uuid, _find_mdev_device); +- if (dev) { +- put_device(dev); +- return true; +- } +- +- return false; +-} +- + /* Should be called holding parent_list_lock */ + static struct mdev_parent *__find_parent_device(struct device *dev) + { +@@ -221,7 +193,6 @@ int mdev_register_device(struct device *dev, const struct mdev_parent_ops *ops) + } + + kref_init(&parent->ref); +- mutex_init(&parent->lock); + + parent->dev = dev; + parent->ops = ops; +@@ -297,6 +268,10 @@ static void mdev_device_release(struct device *dev) + { + struct mdev_device *mdev = to_mdev_device(dev); + ++ mutex_lock(&mdev_list_lock); ++ list_del(&mdev->next); ++ mutex_unlock(&mdev_list_lock); ++ + dev_dbg(&mdev->dev, "MDEV: destroying\n"); + kfree(mdev); + } +@@ -304,7 +279,7 @@ static void mdev_device_release(struct device *dev) + int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid) + { + int ret; +- struct mdev_device *mdev; ++ struct mdev_device *mdev, *tmp; + struct mdev_parent *parent; + struct mdev_type *type = to_mdev_type(kobj); + +@@ -312,21 +287,28 @@ int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid) + if (!parent) + return -EINVAL; + +- mutex_lock(&parent->lock); ++ mutex_lock(&mdev_list_lock); + + /* Check for duplicate */ +- if (mdev_device_exist(parent, uuid)) { +- ret = -EEXIST; +- goto create_err; ++ list_for_each_entry(tmp, &mdev_list, next) { ++ if (!uuid_le_cmp(tmp->uuid, uuid)) { ++ mutex_unlock(&mdev_list_lock); ++ ret = -EEXIST; ++ goto mdev_fail; ++ } + } + + mdev = kzalloc(sizeof(*mdev), GFP_KERNEL); + if (!mdev) { ++ mutex_unlock(&mdev_list_lock); + ret = -ENOMEM; +- goto create_err; ++ goto mdev_fail; + } + + memcpy(&mdev->uuid, &uuid, sizeof(uuid_le)); ++ list_add(&mdev->next, &mdev_list); ++ mutex_unlock(&mdev_list_lock); ++ + mdev->parent = parent; + kref_init(&mdev->ref); + +@@ -338,35 +320,28 @@ int mdev_device_create(struct kobject *kobj, struct device *dev, uuid_le uuid) + ret = device_register(&mdev->dev); + if (ret) { + put_device(&mdev->dev); +- goto create_err; ++ goto mdev_fail; + } + + ret = mdev_device_create_ops(kobj, mdev); + if (ret) +- goto create_failed; ++ goto create_fail; + + ret = mdev_create_sysfs_files(&mdev->dev, type); + if (ret) { + mdev_device_remove_ops(mdev, true); +- goto create_failed; ++ goto create_fail; + } + + mdev->type_kobj = kobj; ++ mdev->active = true; + dev_dbg(&mdev->dev, "MDEV: created\n"); + +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- +- return ret; ++ return 0; + +-create_failed: ++create_fail: + device_unregister(&mdev->dev); +- +-create_err: +- mutex_unlock(&parent->lock); ++mdev_fail: + mdev_put_parent(parent); + return ret; + } +@@ -377,44 +352,39 @@ int mdev_device_remove(struct device *dev, bool force_remove) + struct mdev_parent *parent; + struct mdev_type *type; + int ret; +- bool found = false; + + mdev = to_mdev_device(dev); + + mutex_lock(&mdev_list_lock); + list_for_each_entry(tmp, &mdev_list, next) { +- if (tmp == mdev) { +- found = true; ++ if (tmp == mdev) + break; +- } + } + +- if (found) +- list_del(&mdev->next); ++ if (tmp != mdev) { ++ mutex_unlock(&mdev_list_lock); ++ return -ENODEV; ++ } + +- mutex_unlock(&mdev_list_lock); ++ if (!mdev->active) { ++ mutex_unlock(&mdev_list_lock); ++ return -EAGAIN; ++ } + +- if (!found) +- return -ENODEV; ++ mdev->active = false; ++ mutex_unlock(&mdev_list_lock); + + type = to_mdev_type(mdev->type_kobj); + parent = mdev->parent; +- mutex_lock(&parent->lock); + + ret = mdev_device_remove_ops(mdev, force_remove); + if (ret) { +- mutex_unlock(&parent->lock); +- +- mutex_lock(&mdev_list_lock); +- list_add(&mdev->next, &mdev_list); +- mutex_unlock(&mdev_list_lock); +- ++ mdev->active = true; + return ret; + } + + mdev_remove_sysfs_files(dev, type); + device_unregister(dev); +- mutex_unlock(&parent->lock); + mdev_put_parent(parent); + + return 0; +diff --git a/drivers/vfio/mdev/mdev_private.h b/drivers/vfio/mdev/mdev_private.h +index a9cefd70a705..b5819b7d7ef7 100644 +--- a/drivers/vfio/mdev/mdev_private.h ++++ b/drivers/vfio/mdev/mdev_private.h +@@ -20,7 +20,6 @@ struct mdev_parent { + struct device *dev; + const struct mdev_parent_ops *ops; + struct kref ref; +- struct mutex lock; + struct list_head next; + struct kset *mdev_types_kset; + struct list_head type_list; +@@ -34,6 +33,7 @@ struct mdev_device { + struct kref ref; + struct list_head next; + struct kobject *type_kobj; ++ bool active; + }; + + #define to_mdev_device(dev) container_of(dev, struct mdev_device, dev) +diff --git a/drivers/vfio/platform/vfio_platform_common.c b/drivers/vfio/platform/vfio_platform_common.c +index 4c27f4be3c3d..aa9e792110e3 100644 +--- a/drivers/vfio/platform/vfio_platform_common.c ++++ b/drivers/vfio/platform/vfio_platform_common.c +@@ -681,18 +681,23 @@ int vfio_platform_probe_common(struct vfio_platform_device *vdev, + group = vfio_iommu_group_get(dev); + if (!group) { + pr_err("VFIO: No IOMMU group for device %s\n", vdev->name); +- return -EINVAL; ++ ret = -EINVAL; ++ goto put_reset; + } + + ret = vfio_add_group_dev(dev, &vfio_platform_ops, vdev); +- if (ret) { +- vfio_iommu_group_put(group, dev); +- return ret; +- } ++ if (ret) ++ goto put_iommu; + + mutex_init(&vdev->igate); + + return 0; ++ ++put_iommu: ++ vfio_iommu_group_put(group, dev); ++put_reset: ++ vfio_platform_put_reset(vdev); ++ return ret; + } + EXPORT_SYMBOL_GPL(vfio_platform_probe_common); + +diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c +index d639378e36ac..50eeb74ddc0a 100644 +--- a/drivers/vfio/vfio_iommu_type1.c ++++ b/drivers/vfio/vfio_iommu_type1.c +@@ -83,6 +83,7 @@ struct vfio_dma { + size_t size; /* Map size (bytes) */ + int prot; /* IOMMU_READ/WRITE */ + bool iommu_mapped; ++ bool lock_cap; /* capable(CAP_IPC_LOCK) */ + struct task_struct *task; + struct rb_root pfn_list; /* Ex-user pinned pfn list */ + }; +@@ -246,29 +247,25 @@ static int vfio_iova_put_vfio_pfn(struct vfio_dma *dma, struct vfio_pfn *vpfn) + return ret; + } + +-static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap) ++static int vfio_lock_acct(struct vfio_dma *dma, long npage, bool async) + { + struct mm_struct *mm; +- bool is_current; + int ret; + + if (!npage) + return 0; + +- is_current = (task->mm == current->mm); +- +- mm = is_current ? task->mm : get_task_mm(task); ++ mm = async ? get_task_mm(dma->task) : dma->task->mm; + if (!mm) + return -ESRCH; /* process exited */ + + ret = down_write_killable(&mm->mmap_sem); + if (!ret) { + if (npage > 0) { +- if (lock_cap ? !*lock_cap : +- !has_capability(task, CAP_IPC_LOCK)) { ++ if (!dma->lock_cap) { + unsigned long limit; + +- limit = task_rlimit(task, ++ limit = task_rlimit(dma->task, + RLIMIT_MEMLOCK) >> PAGE_SHIFT; + + if (mm->locked_vm + npage > limit) +@@ -282,7 +279,7 @@ static int vfio_lock_acct(struct task_struct *task, long npage, bool *lock_cap) + up_write(&mm->mmap_sem); + } + +- if (!is_current) ++ if (async) + mmput(mm); + + return ret; +@@ -391,7 +388,7 @@ static int vaddr_get_pfn(struct mm_struct *mm, unsigned long vaddr, + */ + static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + long npage, unsigned long *pfn_base, +- bool lock_cap, unsigned long limit) ++ unsigned long limit) + { + unsigned long pfn = 0; + long ret, pinned = 0, lock_acct = 0; +@@ -414,7 +411,7 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + * pages are already counted against the user. + */ + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && current->mm->locked_vm + 1 > limit) { ++ if (!dma->lock_cap && current->mm->locked_vm + 1 > limit) { + put_pfn(*pfn_base, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", __func__, + limit << PAGE_SHIFT); +@@ -440,7 +437,7 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + } + + if (!rsvd && !vfio_find_vpfn(dma, iova)) { +- if (!lock_cap && ++ if (!dma->lock_cap && + current->mm->locked_vm + lock_acct + 1 > limit) { + put_pfn(pfn, dma->prot); + pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", +@@ -453,7 +450,7 @@ static long vfio_pin_pages_remote(struct vfio_dma *dma, unsigned long vaddr, + } + + out: +- ret = vfio_lock_acct(current, lock_acct, &lock_cap); ++ ret = vfio_lock_acct(dma, lock_acct, false); + + unpin_out: + if (ret) { +@@ -484,7 +481,7 @@ static long vfio_unpin_pages_remote(struct vfio_dma *dma, dma_addr_t iova, + } + + if (do_accounting) +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + + return unlocked; + } +@@ -501,7 +498,7 @@ static int vfio_pin_page_external(struct vfio_dma *dma, unsigned long vaddr, + + ret = vaddr_get_pfn(mm, vaddr, dma->prot, pfn_base); + if (!ret && do_accounting && !is_invalid_reserved_pfn(*pfn_base)) { +- ret = vfio_lock_acct(dma->task, 1, NULL); ++ ret = vfio_lock_acct(dma, 1, true); + if (ret) { + put_pfn(*pfn_base, dma->prot); + if (ret == -ENOMEM) +@@ -528,7 +525,7 @@ static int vfio_unpin_page_external(struct vfio_dma *dma, dma_addr_t iova, + unlocked = vfio_iova_put_vfio_pfn(dma, vpfn); + + if (do_accounting) +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + + return unlocked; + } +@@ -723,7 +720,7 @@ static long vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma, + + dma->iommu_mapped = false; + if (do_accounting) { +- vfio_lock_acct(dma->task, -unlocked, NULL); ++ vfio_lock_acct(dma, -unlocked, true); + return 0; + } + return unlocked; +@@ -935,14 +932,12 @@ static int vfio_pin_map_dma(struct vfio_iommu *iommu, struct vfio_dma *dma, + size_t size = map_size; + long npage; + unsigned long pfn, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret = 0; + + while (size) { + /* Pin a contiguous chunk of memory */ + npage = vfio_pin_pages_remote(dma, vaddr + dma->size, +- size >> PAGE_SHIFT, &pfn, +- lock_cap, limit); ++ size >> PAGE_SHIFT, &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1017,8 +1012,36 @@ static int vfio_dma_do_map(struct vfio_iommu *iommu, + dma->iova = iova; + dma->vaddr = vaddr; + dma->prot = prot; +- get_task_struct(current); +- dma->task = current; ++ ++ /* ++ * We need to be able to both add to a task's locked memory and test ++ * against the locked memory limit and we need to be able to do both ++ * outside of this call path as pinning can be asynchronous via the ++ * external interfaces for mdev devices. RLIMIT_MEMLOCK requires a ++ * task_struct and VM locked pages requires an mm_struct, however ++ * holding an indefinite mm reference is not recommended, therefore we ++ * only hold a reference to a task. We could hold a reference to ++ * current, however QEMU uses this call path through vCPU threads, ++ * which can be killed resulting in a NULL mm and failure in the unmap ++ * path when called via a different thread. Avoid this problem by ++ * using the group_leader as threads within the same group require ++ * both CLONE_THREAD and CLONE_VM and will therefore use the same ++ * mm_struct. ++ * ++ * Previously we also used the task for testing CAP_IPC_LOCK at the ++ * time of pinning and accounting, however has_capability() makes use ++ * of real_cred, a copy-on-write field, so we can't guarantee that it ++ * matches group_leader, or in fact that it might not change by the ++ * time it's evaluated. If a process were to call MAP_DMA with ++ * CAP_IPC_LOCK but later drop it, it doesn't make sense that they ++ * possibly see different results for an iommu_mapped vfio_dma vs ++ * externally mapped. Therefore track CAP_IPC_LOCK in vfio_dma at the ++ * time of calling MAP_DMA. ++ */ ++ get_task_struct(current->group_leader); ++ dma->task = current->group_leader; ++ dma->lock_cap = capable(CAP_IPC_LOCK); ++ + dma->pfn_list = RB_ROOT; + + /* Insert zero-sized and grow as we map chunks of it */ +@@ -1053,7 +1076,6 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + struct vfio_domain *d; + struct rb_node *n; + unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; +- bool lock_cap = capable(CAP_IPC_LOCK); + int ret; + + /* Arbitrarily pick the first domain in the list for lookups */ +@@ -1100,8 +1122,7 @@ static int vfio_iommu_replay(struct vfio_iommu *iommu, + + npage = vfio_pin_pages_remote(dma, vaddr, + n >> PAGE_SHIFT, +- &pfn, lock_cap, +- limit); ++ &pfn, limit); + if (npage <= 0) { + WARN_ON(!npage); + ret = (int)npage; +@@ -1378,7 +1399,7 @@ static void vfio_iommu_unmap_unpin_reaccount(struct vfio_iommu *iommu) + if (!is_invalid_reserved_pfn(vpfn->pfn)) + locked++; + } +- vfio_lock_acct(dma->task, locked - unlocked, NULL); ++ vfio_lock_acct(dma, locked - unlocked, true); + } + } + +diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c +index 1c2289ddd555..0fa7d2bd0e48 100644 +--- a/drivers/video/backlight/pwm_bl.c ++++ b/drivers/video/backlight/pwm_bl.c +@@ -301,14 +301,14 @@ static int pwm_backlight_probe(struct platform_device *pdev) + + /* + * If the GPIO is not known to be already configured as output, that +- * is, if gpiod_get_direction returns either GPIOF_DIR_IN or -EINVAL, +- * change the direction to output and set the GPIO as active. ++ * is, if gpiod_get_direction returns either 1 or -EINVAL, change the ++ * direction to output and set the GPIO as active. + * Do not force the GPIO to active when it was already output as it + * could cause backlight flickering or we would enable the backlight too + * early. Leave the decision of the initial backlight state for later. + */ + if (pb->enable_gpio && +- gpiod_get_direction(pb->enable_gpio) != GPIOF_DIR_OUT) ++ gpiod_get_direction(pb->enable_gpio) != 0) + gpiod_direction_output(pb->enable_gpio, 1); + + pb->power_supply = devm_regulator_get(&pdev->dev, "power"); +diff --git a/drivers/watchdog/da9063_wdt.c b/drivers/watchdog/da9063_wdt.c +index 2a20fc163ed0..4c62ad74aec0 100644 +--- a/drivers/watchdog/da9063_wdt.c ++++ b/drivers/watchdog/da9063_wdt.c +@@ -102,10 +102,23 @@ static int da9063_wdt_set_timeout(struct watchdog_device *wdd, + { + struct da9063 *da9063 = watchdog_get_drvdata(wdd); + unsigned int selector; +- int ret; ++ int ret = 0; + + selector = da9063_wdt_timeout_to_sel(timeout); +- ret = _da9063_wdt_set_timeout(da9063, selector); ++ ++ /* ++ * There are two cases when a set_timeout() will be called: ++ * 1. The watchdog is off and someone wants to set the timeout for the ++ * further use. ++ * 2. The watchdog is already running and a new timeout value should be ++ * set. ++ * ++ * The watchdog can't store a timeout value not equal zero without ++ * enabling the watchdog, so the timeout must be buffered by the driver. ++ */ ++ if (watchdog_active(wdd)) ++ ret = _da9063_wdt_set_timeout(da9063, selector); ++ + if (ret) + dev_err(da9063->dev, "Failed to set watchdog timeout (err = %d)\n", + ret); +diff --git a/fs/block_dev.c b/fs/block_dev.c +index 789f55e851ae..3323eec5c164 100644 +--- a/fs/block_dev.c ++++ b/fs/block_dev.c +@@ -231,7 +231,7 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter, + + ret = bio_iov_iter_get_pages(&bio, iter); + if (unlikely(ret)) +- return ret; ++ goto out; + ret = bio.bi_iter.bi_size; + + if (iov_iter_rw(iter) == READ) { +@@ -260,12 +260,13 @@ __blkdev_direct_IO_simple(struct kiocb *iocb, struct iov_iter *iter, + put_page(bvec->bv_page); + } + +- if (vecs != inline_vecs) +- kfree(vecs); +- + if (unlikely(bio.bi_status)) + ret = blk_status_to_errno(bio.bi_status); + ++out: ++ if (vecs != inline_vecs) ++ kfree(vecs); ++ + bio_uninit(&bio); + + return ret; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index f5b90dc137ec..28a58f40f3a4 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -3162,6 +3162,9 @@ out: + /* once for the tree */ + btrfs_put_ordered_extent(ordered_extent); + ++ /* Try to release some metadata so we don't get an OOM but don't wait */ ++ btrfs_btree_balance_dirty_nodelay(fs_info); ++ + return ret; + } + +@@ -4737,7 +4740,10 @@ delete: + extent_num_bytes, 0, + btrfs_header_owner(leaf), + ino, extent_offset); +- BUG_ON(ret); ++ if (ret) { ++ btrfs_abort_transaction(trans, ret); ++ break; ++ } + if (btrfs_should_throttle_delayed_refs(trans, fs_info)) + btrfs_async_run_delayed_refs(fs_info, + trans->delayed_ref_updates * 2, +@@ -5496,13 +5502,18 @@ void btrfs_evict_inode(struct inode *inode) + trans->block_rsv = rsv; + + ret = btrfs_truncate_inode_items(trans, root, inode, 0, 0); +- if (ret != -ENOSPC && ret != -EAGAIN) ++ if (ret) { ++ trans->block_rsv = &fs_info->trans_block_rsv; ++ btrfs_end_transaction(trans); ++ btrfs_btree_balance_dirty(fs_info); ++ if (ret != -ENOSPC && ret != -EAGAIN) { ++ btrfs_orphan_del(NULL, BTRFS_I(inode)); ++ btrfs_free_block_rsv(fs_info, rsv); ++ goto no_delete; ++ } ++ } else { + break; +- +- trans->block_rsv = &fs_info->trans_block_rsv; +- btrfs_end_transaction(trans); +- trans = NULL; +- btrfs_btree_balance_dirty(fs_info); ++ } + } + + btrfs_free_block_rsv(fs_info, rsv); +@@ -5511,12 +5522,8 @@ void btrfs_evict_inode(struct inode *inode) + * Errors here aren't a big deal, it just means we leave orphan items + * in the tree. They will be cleaned up on the next mount. + */ +- if (ret == 0) { +- trans->block_rsv = root->orphan_block_rsv; +- btrfs_orphan_del(trans, BTRFS_I(inode)); +- } else { +- btrfs_orphan_del(NULL, BTRFS_I(inode)); +- } ++ trans->block_rsv = root->orphan_block_rsv; ++ btrfs_orphan_del(trans, BTRFS_I(inode)); + + trans->block_rsv = &fs_info->trans_block_rsv; + if (!(root == fs_info->tree_root || +diff --git a/fs/btrfs/qgroup.c b/fs/btrfs/qgroup.c +index e172d4843eae..473ad5985aa3 100644 +--- a/fs/btrfs/qgroup.c ++++ b/fs/btrfs/qgroup.c +@@ -2499,6 +2499,21 @@ out: + spin_unlock(&fs_info->qgroup_lock); + } + ++/* ++ * Check if the leaf is the last leaf. Which means all node pointers ++ * are at their last position. ++ */ ++static bool is_last_leaf(struct btrfs_path *path) ++{ ++ int i; ++ ++ for (i = 1; i < BTRFS_MAX_LEVEL && path->nodes[i]; i++) { ++ if (path->slots[i] != btrfs_header_nritems(path->nodes[i]) - 1) ++ return false; ++ } ++ return true; ++} ++ + /* + * returns < 0 on error, 0 when more leafs are to be scanned. + * returns 1 when done. +@@ -2512,6 +2527,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path, + struct ulist *roots = NULL; + struct seq_list tree_mod_seq_elem = SEQ_LIST_INIT(tree_mod_seq_elem); + u64 num_bytes; ++ bool done; + int slot; + int ret; + +@@ -2540,6 +2556,7 @@ qgroup_rescan_leaf(struct btrfs_fs_info *fs_info, struct btrfs_path *path, + mutex_unlock(&fs_info->qgroup_rescan_lock); + return ret; + } ++ done = is_last_leaf(path); + + btrfs_item_key_to_cpu(path->nodes[0], &found, + btrfs_header_nritems(path->nodes[0]) - 1); +@@ -2586,6 +2603,8 @@ out: + } + btrfs_put_tree_mod_seq(fs_info, &tree_mod_seq_elem); + ++ if (done && !ret) ++ ret = 1; + return ret; + } + +diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c +index bf4e22df7c97..e1b4a59485df 100644 +--- a/fs/btrfs/tree-log.c ++++ b/fs/btrfs/tree-log.c +@@ -3041,8 +3041,11 @@ out_wake_log_root: + mutex_unlock(&log_root_tree->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&log_root_tree->log_commit_wait[index2])) + wake_up(&log_root_tree->log_commit_wait[index2]); + out: +@@ -3053,8 +3056,11 @@ out: + mutex_unlock(&root->log_mutex); + + /* +- * The barrier before waitqueue_active is implied by mutex_unlock ++ * The barrier before waitqueue_active is needed so all the updates ++ * above are seen by the woken threads. It might not be necessary, but ++ * proving that seems to be hard. + */ ++ smp_mb(); + if (waitqueue_active(&root->log_commit_wait[index1])) + wake_up(&root->log_commit_wait[index1]); + return ret; +diff --git a/fs/ceph/super.c b/fs/ceph/super.c +index 48ffe720bf09..b79b1211a2b5 100644 +--- a/fs/ceph/super.c ++++ b/fs/ceph/super.c +@@ -254,7 +254,7 @@ static int parse_fsopt_token(char *c, void *private) + case Opt_rasize: + if (intval < 0) + return -EINVAL; +- fsopt->rasize = ALIGN(intval + PAGE_SIZE - 1, PAGE_SIZE); ++ fsopt->rasize = ALIGN(intval, PAGE_SIZE); + break; + case Opt_caps_wanted_delay_min: + if (intval < 1) +diff --git a/fs/crypto/crypto.c b/fs/crypto/crypto.c +index d262a93d9b31..daf2683f0655 100644 +--- a/fs/crypto/crypto.c ++++ b/fs/crypto/crypto.c +@@ -446,8 +446,17 @@ fail: + */ + static int __init fscrypt_init(void) + { ++ /* ++ * Use an unbound workqueue to allow bios to be decrypted in parallel ++ * even when they happen to complete on the same CPU. This sacrifices ++ * locality, but it's worthwhile since decryption is CPU-intensive. ++ * ++ * Also use a high-priority workqueue to prioritize decryption work, ++ * which blocks reads from completing, over regular application tasks. ++ */ + fscrypt_read_workqueue = alloc_workqueue("fscrypt_read_queue", +- WQ_HIGHPRI, 0); ++ WQ_UNBOUND | WQ_HIGHPRI, ++ num_online_cpus()); + if (!fscrypt_read_workqueue) + goto fail; + +diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c +index 9c9eafd6bd76..70266a3355dc 100644 +--- a/fs/ext4/balloc.c ++++ b/fs/ext4/balloc.c +@@ -379,6 +379,8 @@ static int ext4_validate_block_bitmap(struct super_block *sb, + return -EFSCORRUPTED; + + ext4_lock_group(sb, block_group); ++ if (buffer_verified(bh)) ++ goto verified; + if (unlikely(!ext4_block_bitmap_csum_verify(sb, block_group, + desc, bh))) { + ext4_unlock_group(sb, block_group); +@@ -401,6 +403,7 @@ static int ext4_validate_block_bitmap(struct super_block *sb, + return -EFSCORRUPTED; + } + set_buffer_verified(bh); ++verified: + ext4_unlock_group(sb, block_group); + return 0; + } +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index 95341bc2b3b7..2f46564d3fca 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -91,6 +91,8 @@ static int ext4_validate_inode_bitmap(struct super_block *sb, + return -EFSCORRUPTED; + + ext4_lock_group(sb, block_group); ++ if (buffer_verified(bh)) ++ goto verified; + blk = ext4_inode_bitmap(sb, desc); + if (!ext4_inode_bitmap_csum_verify(sb, block_group, desc, bh, + EXT4_INODES_PER_GROUP(sb) / 8)) { +@@ -108,6 +110,7 @@ static int ext4_validate_inode_bitmap(struct super_block *sb, + return -EFSBADCRC; + } + set_buffer_verified(bh); ++verified: + ext4_unlock_group(sb, block_group); + return 0; + } +@@ -1394,7 +1397,10 @@ int ext4_init_inode_table(struct super_block *sb, ext4_group_t group, + ext4_itable_unused_count(sb, gdp)), + sbi->s_inodes_per_block); + +- if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group)) { ++ if ((used_blks < 0) || (used_blks > sbi->s_itb_per_group) || ++ ((group == 0) && ((EXT4_INODES_PER_GROUP(sb) - ++ ext4_itable_unused_count(sb, gdp)) < ++ EXT4_FIRST_INO(sb)))) { + ext4_error(sb, "Something is wrong with group %u: " + "used itable blocks: %d; " + "itable unused count: %u", +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index 7d498f4a3f90..b549cfd2d7d3 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -688,6 +688,10 @@ int ext4_try_to_write_inline_data(struct address_space *mapping, + goto convert; + } + ++ ret = ext4_journal_get_write_access(handle, iloc.bh); ++ if (ret) ++ goto out; ++ + flags |= AOP_FLAG_NOFS; + + page = grab_cache_page_write_begin(mapping, 0, flags); +@@ -716,7 +720,7 @@ int ext4_try_to_write_inline_data(struct address_space *mapping, + out_up_read: + up_read(&EXT4_I(inode)->xattr_sem); + out: +- if (handle) ++ if (handle && (ret != 1)) + ext4_journal_stop(handle); + brelse(iloc.bh); + return ret; +@@ -758,6 +762,7 @@ int ext4_write_inline_data_end(struct inode *inode, loff_t pos, unsigned len, + + ext4_write_unlock_xattr(inode, &no_expand); + brelse(iloc.bh); ++ mark_inode_dirty(inode); + out: + return copied; + } +@@ -904,7 +909,6 @@ retry_journal: + goto out; + } + +- + page = grab_cache_page_write_begin(mapping, 0, flags); + if (!page) { + ret = -ENOMEM; +@@ -922,6 +926,9 @@ retry_journal: + if (ret < 0) + goto out_release_page; + } ++ ret = ext4_journal_get_write_access(handle, iloc.bh); ++ if (ret) ++ goto out_release_page; + + up_read(&EXT4_I(inode)->xattr_sem); + *pagep = page; +@@ -942,7 +949,6 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, + unsigned len, unsigned copied, + struct page *page) + { +- int i_size_changed = 0; + int ret; + + ret = ext4_write_inline_data_end(inode, pos, len, copied, page); +@@ -960,10 +966,8 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, + * But it's important to update i_size while still holding page lock: + * page writeout could otherwise come in and zero beyond i_size. + */ +- if (pos+copied > inode->i_size) { ++ if (pos+copied > inode->i_size) + i_size_write(inode, pos+copied); +- i_size_changed = 1; +- } + unlock_page(page); + put_page(page); + +@@ -973,8 +977,7 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, + * ordering of page lock and transaction start for journaling + * filesystems. + */ +- if (i_size_changed) +- mark_inode_dirty(inode); ++ mark_inode_dirty(inode); + + return copied; + } +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index c2efe4d2ad87..f9baa59de0e2 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -1388,9 +1388,10 @@ static int ext4_write_end(struct file *file, + loff_t old_size = inode->i_size; + int ret = 0, ret2; + int i_size_changed = 0; ++ int inline_data = ext4_has_inline_data(inode); + + trace_ext4_write_end(inode, pos, len, copied); +- if (ext4_has_inline_data(inode)) { ++ if (inline_data) { + ret = ext4_write_inline_data_end(inode, pos, len, + copied, page); + if (ret < 0) { +@@ -1418,7 +1419,7 @@ static int ext4_write_end(struct file *file, + * ordering of page lock and transaction start for journaling + * filesystems. + */ +- if (i_size_changed) ++ if (i_size_changed || inline_data) + ext4_mark_inode_dirty(handle, inode); + + if (pos + len > inode->i_size && ext4_can_truncate(inode)) +@@ -1492,6 +1493,7 @@ static int ext4_journalled_write_end(struct file *file, + int partial = 0; + unsigned from, to; + int size_changed = 0; ++ int inline_data = ext4_has_inline_data(inode); + + trace_ext4_journalled_write_end(inode, pos, len, copied); + from = pos & (PAGE_SIZE - 1); +@@ -1499,7 +1501,7 @@ static int ext4_journalled_write_end(struct file *file, + + BUG_ON(!ext4_handle_valid(handle)); + +- if (ext4_has_inline_data(inode)) { ++ if (inline_data) { + ret = ext4_write_inline_data_end(inode, pos, len, + copied, page); + if (ret < 0) { +@@ -1530,7 +1532,7 @@ static int ext4_journalled_write_end(struct file *file, + if (old_size < pos) + pagecache_isize_extended(inode, old_size, pos); + +- if (size_changed) { ++ if (size_changed || inline_data) { + ret2 = ext4_mark_inode_dirty(handle, inode); + if (!ret) + ret = ret2; +@@ -2027,11 +2029,7 @@ static int __ext4_journalled_writepage(struct page *page, + } + + if (inline_data) { +- BUFFER_TRACE(inode_bh, "get write access"); +- ret = ext4_journal_get_write_access(handle, inode_bh); +- +- err = ext4_handle_dirty_metadata(handle, inode, inode_bh); +- ++ ret = ext4_mark_inode_dirty(handle, inode); + } else { + ret = ext4_walk_page_buffers(handle, page_bufs, 0, len, NULL, + do_journal_get_write_access); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index fc32a67a7a19..6b0c1ea95196 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3103,14 +3103,8 @@ static ext4_group_t ext4_has_uninit_itable(struct super_block *sb) + if (!gdp) + continue; + +- if (gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED)) +- continue; +- if (group != 0) ++ if (!(gdp->bg_flags & cpu_to_le16(EXT4_BG_INODE_ZEROED))) + break; +- ext4_error(sb, "Inode table for bg 0 marked as " +- "needing zeroing"); +- if (sb_rdonly(sb)) +- return ngroups; + } + + return group; +diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c +index 36b535207c88..85142e5df88b 100644 +--- a/fs/f2fs/data.c ++++ b/fs/f2fs/data.c +@@ -1601,7 +1601,13 @@ out: + + redirty_out: + redirty_page_for_writepage(wbc, page); +- if (!err) ++ /* ++ * pageout() in MM traslates EAGAIN, so calls handle_write_error() ++ * -> mapping_set_error() -> set_bit(AS_EIO, ...). ++ * file_write_and_wait_range() will see EIO error, which is critical ++ * to return value of fsync() followed by atomic_write failure to user. ++ */ ++ if (!err || wbc->for_reclaim) + return AOP_WRITEPAGE_ACTIVATE; + unlock_page(page); + return err; +diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c +index 72c6a9e9a9b4..87e654c53c31 100644 +--- a/fs/f2fs/file.c ++++ b/fs/f2fs/file.c +@@ -1630,6 +1630,8 @@ static int f2fs_ioc_start_atomic_write(struct file *filp) + + inode_lock(inode); + ++ down_write(&F2FS_I(inode)->dio_rwsem[WRITE]); ++ + if (f2fs_is_atomic_file(inode)) + goto out; + +@@ -1659,6 +1661,7 @@ inc_stat: + stat_inc_atomic_write(inode); + stat_update_max_atomic_write(inode); + out: ++ up_write(&F2FS_I(inode)->dio_rwsem[WRITE]); + inode_unlock(inode); + mnt_drop_write_file(filp); + return ret; +@@ -1808,9 +1811,11 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + if (get_user(in, (__u32 __user *)arg)) + return -EFAULT; + +- ret = mnt_want_write_file(filp); +- if (ret) +- return ret; ++ if (in != F2FS_GOING_DOWN_FULLSYNC) { ++ ret = mnt_want_write_file(filp); ++ if (ret) ++ return ret; ++ } + + switch (in) { + case F2FS_GOING_DOWN_FULLSYNC: +@@ -1838,7 +1843,8 @@ static int f2fs_ioc_shutdown(struct file *filp, unsigned long arg) + } + f2fs_update_time(sbi, REQ_TIME); + out: +- mnt_drop_write_file(filp); ++ if (in != F2FS_GOING_DOWN_FULLSYNC) ++ mnt_drop_write_file(filp); + return ret; + } + +@@ -2490,7 +2496,9 @@ static int f2fs_ioc_setproject(struct file *filp, __u32 projid) + } + f2fs_put_page(ipage, 1); + +- dquot_initialize(inode); ++ err = dquot_initialize(inode); ++ if (err) ++ goto out_unlock; + + transfer_to[PRJQUOTA] = dqget(sb, make_kqid_projid(kprojid)); + if (!IS_ERR(transfer_to[PRJQUOTA])) { +diff --git a/fs/f2fs/gc.c b/fs/f2fs/gc.c +index e5673a9b2619..f2f897cd23c9 100644 +--- a/fs/f2fs/gc.c ++++ b/fs/f2fs/gc.c +@@ -768,9 +768,14 @@ retry: + set_cold_data(page); + + err = do_write_data_page(&fio); +- if (err == -ENOMEM && is_dirty) { +- congestion_wait(BLK_RW_ASYNC, HZ/50); +- goto retry; ++ if (err) { ++ clear_cold_data(page); ++ if (err == -ENOMEM) { ++ congestion_wait(BLK_RW_ASYNC, HZ/50); ++ goto retry; ++ } ++ if (is_dirty) ++ set_page_dirty(page); + } + } + out: +diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c +index 271516db8939..7c05bd4222b2 100644 +--- a/fs/f2fs/segment.c ++++ b/fs/f2fs/segment.c +@@ -225,6 +225,8 @@ static int __revoke_inmem_pages(struct inode *inode, + + lock_page(page); + ++ f2fs_wait_on_page_writeback(page, DATA, true); ++ + if (recover) { + struct dnode_of_data dn; + struct node_info ni; +@@ -435,6 +437,9 @@ void f2fs_balance_fs(struct f2fs_sb_info *sbi, bool need) + + void f2fs_balance_fs_bg(struct f2fs_sb_info *sbi) + { ++ if (unlikely(is_sbi_flag_set(sbi, SBI_POR_DOING))) ++ return; ++ + /* try to shrink extent cache when there is no enough memory */ + if (!available_free_memory(sbi, EXTENT_CACHE)) + f2fs_shrink_extent_tree(sbi, EXTENT_CACHE_SHRINK_NUMBER); +diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c +index 933c3d529e65..400c00058bad 100644 +--- a/fs/f2fs/super.c ++++ b/fs/f2fs/super.c +@@ -2663,6 +2663,12 @@ static int __init init_f2fs_fs(void) + { + int err; + ++ if (PAGE_SIZE != F2FS_BLKSIZE) { ++ printk("F2FS not supported on PAGE_SIZE(%lu) != %d\n", ++ PAGE_SIZE, F2FS_BLKSIZE); ++ return -EINVAL; ++ } ++ + f2fs_build_trace_ios(); + + err = init_inodecache(); +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 928bbc397818..43fbf4495090 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -745,6 +745,13 @@ static int nfs41_sequence_process(struct rpc_task *task, + slot->slot_nr, + slot->seq_nr); + goto out_retry; ++ case -NFS4ERR_RETRY_UNCACHED_REP: ++ case -NFS4ERR_SEQ_FALSE_RETRY: ++ /* ++ * The server thinks we tried to replay a request. ++ * Retry the call after bumping the sequence ID. ++ */ ++ goto retry_new_seq; + case -NFS4ERR_BADSLOT: + /* + * The slot id we used was probably retired. Try again +@@ -769,10 +776,6 @@ static int nfs41_sequence_process(struct rpc_task *task, + goto retry_nowait; + } + goto session_recover; +- case -NFS4ERR_SEQ_FALSE_RETRY: +- if (interrupted) +- goto retry_new_seq; +- goto session_recover; + default: + /* Just update the slot sequence no. */ + slot->seq_done = 1; +@@ -2692,7 +2695,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + if (ret != 0) + goto out; + +- state = nfs4_opendata_to_nfs4_state(opendata); ++ state = _nfs4_opendata_to_nfs4_state(opendata); + ret = PTR_ERR(state); + if (IS_ERR(state)) + goto out; +@@ -2728,6 +2731,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, + nfs4_schedule_stateid_recovery(server, state); + } + out: ++ nfs4_sequence_free_slot(&opendata->o_res.seq_res); + return ret; + } + +diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c +index 7b34534210ce..96867fb159bf 100644 +--- a/fs/nfs/pnfs.c ++++ b/fs/nfs/pnfs.c +@@ -1126,7 +1126,7 @@ _pnfs_return_layout(struct inode *ino) + LIST_HEAD(tmp_list); + nfs4_stateid stateid; + int status = 0; +- bool send; ++ bool send, valid_layout; + + dprintk("NFS: %s for inode %lu\n", __func__, ino->i_ino); + +@@ -1147,6 +1147,7 @@ _pnfs_return_layout(struct inode *ino) + goto out_put_layout_hdr; + spin_lock(&ino->i_lock); + } ++ valid_layout = pnfs_layout_is_valid(lo); + pnfs_clear_layoutcommit(ino, &tmp_list); + pnfs_mark_matching_lsegs_invalid(lo, &tmp_list, NULL, 0); + +@@ -1160,7 +1161,8 @@ _pnfs_return_layout(struct inode *ino) + } + + /* Don't send a LAYOUTRETURN if list was initially empty */ +- if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags)) { ++ if (!test_bit(NFS_LAYOUT_RETURN_REQUESTED, &lo->plh_flags) || ++ !valid_layout) { + spin_unlock(&ino->i_lock); + dprintk("NFS: %s no layout segments to return\n", __func__); + goto out_put_layout_hdr; +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index f6588cc6816c..c1e923334012 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -1586,6 +1586,8 @@ nfsd4_decode_getdeviceinfo(struct nfsd4_compoundargs *argp, + gdev->gd_maxcount = be32_to_cpup(p++); + num = be32_to_cpup(p++); + if (num) { ++ if (num > 1000) ++ goto xdr_error; + READ_BUF(4 * num); + gdev->gd_notify_types = be32_to_cpup(p++); + for (i = 1; i < num; i++) { +diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c +index b8f8d666e8d4..ba20393d60ef 100644 +--- a/fs/overlayfs/super.c ++++ b/fs/overlayfs/super.c +@@ -232,6 +232,7 @@ static void ovl_put_super(struct super_block *sb) + kfree(ufs); + } + ++/* Sync real dirty inodes in upper filesystem (if it exists) */ + static int ovl_sync_fs(struct super_block *sb, int wait) + { + struct ovl_fs *ufs = sb->s_fs_info; +@@ -240,14 +241,24 @@ static int ovl_sync_fs(struct super_block *sb, int wait) + + if (!ufs->upper_mnt) + return 0; +- upper_sb = ufs->upper_mnt->mnt_sb; +- if (!upper_sb->s_op->sync_fs) ++ ++ /* ++ * If this is a sync(2) call or an emergency sync, all the super blocks ++ * will be iterated, including upper_sb, so no need to do anything. ++ * ++ * If this is a syncfs(2) call, then we do need to call ++ * sync_filesystem() on upper_sb, but enough if we do it when being ++ * called with wait == 1. ++ */ ++ if (!wait) + return 0; + +- /* real inodes have already been synced by sync_filesystem(ovl_sb) */ ++ upper_sb = ufs->upper_mnt->mnt_sb; ++ + down_read(&upper_sb->s_umount); +- ret = upper_sb->s_op->sync_fs(upper_sb, wait); ++ ret = sync_filesystem(upper_sb); + up_read(&upper_sb->s_umount); ++ + return ret; + } + +diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c +index 6f337fff38c4..519522d39bde 100644 +--- a/fs/proc/task_mmu.c ++++ b/fs/proc/task_mmu.c +@@ -1275,8 +1275,9 @@ static pagemap_entry_t pte_to_pagemap_entry(struct pagemapread *pm, + if (pte_swp_soft_dirty(pte)) + flags |= PM_SOFT_DIRTY; + entry = pte_to_swp_entry(pte); +- frame = swp_type(entry) | +- (swp_offset(entry) << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) ++ frame = swp_type(entry) | ++ (swp_offset(entry) << MAX_SWAPFILES_SHIFT); + flags |= PM_SWAP; + if (is_migration_entry(entry)) + page = migration_entry_to_page(entry); +@@ -1327,11 +1328,14 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + #ifdef CONFIG_ARCH_ENABLE_THP_MIGRATION + else if (is_swap_pmd(pmd)) { + swp_entry_t entry = pmd_to_swp_entry(pmd); +- unsigned long offset = swp_offset(entry); ++ unsigned long offset; + +- offset += (addr & ~PMD_MASK) >> PAGE_SHIFT; +- frame = swp_type(entry) | +- (offset << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ offset = swp_offset(entry) + ++ ((addr & ~PMD_MASK) >> PAGE_SHIFT); ++ frame = swp_type(entry) | ++ (offset << MAX_SWAPFILES_SHIFT); ++ } + flags |= PM_SWAP; + if (pmd_swp_soft_dirty(pmd)) + flags |= PM_SOFT_DIRTY; +@@ -1349,10 +1353,12 @@ static int pagemap_pmd_range(pmd_t *pmdp, unsigned long addr, unsigned long end, + err = add_to_pagemap(addr, &pme, pm); + if (err) + break; +- if (pm->show_pfn && (flags & PM_PRESENT)) +- frame++; +- else if (flags & PM_SWAP) +- frame += (1 << MAX_SWAPFILES_SHIFT); ++ if (pm->show_pfn) { ++ if (flags & PM_PRESENT) ++ frame++; ++ else if (flags & PM_SWAP) ++ frame += (1 << MAX_SWAPFILES_SHIFT); ++ } + } + spin_unlock(ptl); + return err; +diff --git a/fs/squashfs/cache.c b/fs/squashfs/cache.c +index 23813c078cc9..0839efa720b3 100644 +--- a/fs/squashfs/cache.c ++++ b/fs/squashfs/cache.c +@@ -350,6 +350,9 @@ int squashfs_read_metadata(struct super_block *sb, void *buffer, + + TRACE("Entered squashfs_read_metadata [%llx:%x]\n", *block, *offset); + ++ if (unlikely(length < 0)) ++ return -EIO; ++ + while (length) { + entry = squashfs_cache_get(sb, msblk->block_cache, *block, 0); + if (entry->error) { +diff --git a/fs/squashfs/file.c b/fs/squashfs/file.c +index 13d80947bf9e..fcff2e0487fe 100644 +--- a/fs/squashfs/file.c ++++ b/fs/squashfs/file.c +@@ -194,7 +194,11 @@ static long long read_indexes(struct super_block *sb, int n, + } + + for (i = 0; i < blocks; i++) { +- int size = le32_to_cpu(blist[i]); ++ int size = squashfs_block_size(blist[i]); ++ if (size < 0) { ++ err = size; ++ goto failure; ++ } + block += SQUASHFS_COMPRESSED_SIZE_BLOCK(size); + } + n -= blocks; +@@ -367,7 +371,7 @@ static int read_blocklist(struct inode *inode, int index, u64 *block) + sizeof(size)); + if (res < 0) + return res; +- return le32_to_cpu(size); ++ return squashfs_block_size(size); + } + + /* Copy data into page cache */ +diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c +index 0ed6edbc5c71..86ad9a4b8c36 100644 +--- a/fs/squashfs/fragment.c ++++ b/fs/squashfs/fragment.c +@@ -61,9 +61,7 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, + return size; + + *fragment_block = le64_to_cpu(fragment_entry.start_block); +- size = le32_to_cpu(fragment_entry.size); +- +- return size; ++ return squashfs_block_size(fragment_entry.size); + } + + +diff --git a/fs/squashfs/squashfs_fs.h b/fs/squashfs/squashfs_fs.h +index 24d12fd14177..4e6853f084d0 100644 +--- a/fs/squashfs/squashfs_fs.h ++++ b/fs/squashfs/squashfs_fs.h +@@ -129,6 +129,12 @@ + + #define SQUASHFS_COMPRESSED_BLOCK(B) (!((B) & SQUASHFS_COMPRESSED_BIT_BLOCK)) + ++static inline int squashfs_block_size(__le32 raw) ++{ ++ u32 size = le32_to_cpu(raw); ++ return (size >> 25) ? -EIO : size; ++} ++ + /* + * Inode number ops. Inodes consist of a compressed block number, and an + * uncompressed offset within that block +diff --git a/include/drm/drm_dp_helper.h b/include/drm/drm_dp_helper.h +index b17476a6909c..8fd7cb5297ab 100644 +--- a/include/drm/drm_dp_helper.h ++++ b/include/drm/drm_dp_helper.h +@@ -453,6 +453,7 @@ + # define DP_PSR_FRAME_CAPTURE (1 << 3) + # define DP_PSR_SELECTIVE_UPDATE (1 << 4) + # define DP_PSR_IRQ_HPD_WITH_CRC_ERRORS (1 << 5) ++# define DP_PSR_ENABLE_PSR2 (1 << 6) /* eDP 1.4a */ + + #define DP_ADAPTER_CTRL 0x1a0 + # define DP_ADAPTER_CTRL_FORCE_LOAD_SENSE (1 << 0) +diff --git a/include/linux/delayacct.h b/include/linux/delayacct.h +index 5e335b6203f4..31c865d1842e 100644 +--- a/include/linux/delayacct.h ++++ b/include/linux/delayacct.h +@@ -29,7 +29,7 @@ + + #ifdef CONFIG_TASK_DELAY_ACCT + struct task_delay_info { +- spinlock_t lock; ++ raw_spinlock_t lock; + unsigned int flags; /* Private per-task flags */ + + /* For each stat XXX, add following, aligned appropriately +@@ -124,7 +124,7 @@ static inline void delayacct_blkio_start(void) + + static inline void delayacct_blkio_end(struct task_struct *p) + { +- if (current->delays) ++ if (p->delays) + __delayacct_blkio_end(p); + delayacct_clear_flag(DELAYACCT_PF_BLKIO); + } +diff --git a/include/linux/dma-iommu.h b/include/linux/dma-iommu.h +index 92f20832fd28..e8ca5e654277 100644 +--- a/include/linux/dma-iommu.h ++++ b/include/linux/dma-iommu.h +@@ -17,6 +17,7 @@ + #define __DMA_IOMMU_H + + #ifdef __KERNEL__ ++#include + #include + + #ifdef CONFIG_IOMMU_DMA +diff --git a/include/linux/mmc/sdio_ids.h b/include/linux/mmc/sdio_ids.h +index cdd66a5fbd5e..0a7abe8a407f 100644 +--- a/include/linux/mmc/sdio_ids.h ++++ b/include/linux/mmc/sdio_ids.h +@@ -35,6 +35,7 @@ + #define SDIO_DEVICE_ID_BROADCOM_4335_4339 0x4335 + #define SDIO_DEVICE_ID_BROADCOM_4339 0x4339 + #define SDIO_DEVICE_ID_BROADCOM_43362 0xa962 ++#define SDIO_DEVICE_ID_BROADCOM_43364 0xa9a4 + #define SDIO_DEVICE_ID_BROADCOM_43430 0xa9a6 + #define SDIO_DEVICE_ID_BROADCOM_4345 0x4345 + #define SDIO_DEVICE_ID_BROADCOM_43455 0xa9bf +diff --git a/include/linux/netfilter/ipset/ip_set_timeout.h b/include/linux/netfilter/ipset/ip_set_timeout.h +index bfb3531fd88a..7ad8ddf9ca8a 100644 +--- a/include/linux/netfilter/ipset/ip_set_timeout.h ++++ b/include/linux/netfilter/ipset/ip_set_timeout.h +@@ -65,8 +65,14 @@ ip_set_timeout_set(unsigned long *timeout, u32 value) + static inline u32 + ip_set_timeout_get(const unsigned long *timeout) + { +- return *timeout == IPSET_ELEM_PERMANENT ? 0 : +- jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ u32 t; ++ ++ if (*timeout == IPSET_ELEM_PERMANENT) ++ return 0; ++ ++ t = jiffies_to_msecs(*timeout - jiffies)/MSEC_PER_SEC; ++ /* Zero value in userspace means no timeout */ ++ return t == 0 ? 1 : t; + } + + #endif /* __KERNEL__ */ +diff --git a/include/linux/regulator/consumer.h b/include/linux/regulator/consumer.h +index df176d7c2b87..25602afd4844 100644 +--- a/include/linux/regulator/consumer.h ++++ b/include/linux/regulator/consumer.h +@@ -80,6 +80,7 @@ struct regmap; + * These modes can be OR'ed together to make up a mask of valid register modes. + */ + ++#define REGULATOR_MODE_INVALID 0x0 + #define REGULATOR_MODE_FAST 0x1 + #define REGULATOR_MODE_NORMAL 0x2 + #define REGULATOR_MODE_IDLE 0x4 +diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h +index 74fc82d22310..868b60a79c0b 100644 +--- a/include/linux/serial_core.h ++++ b/include/linux/serial_core.h +@@ -348,7 +348,8 @@ struct earlycon_device { + }; + + struct earlycon_id { +- char name[16]; ++ char name[15]; ++ char name_term; /* In case compiler didn't '\0' term name */ + char compatible[128]; + int (*setup)(struct earlycon_device *, const char *options); + }; +diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h +index 34f053a150a9..cf2862bd134a 100644 +--- a/include/linux/thread_info.h ++++ b/include/linux/thread_info.h +@@ -43,11 +43,7 @@ enum { + #define THREAD_ALIGN THREAD_SIZE + #endif + +-#if IS_ENABLED(CONFIG_DEBUG_STACK_USAGE) || IS_ENABLED(CONFIG_DEBUG_KMEMLEAK) +-# define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO) +-#else +-# define THREADINFO_GFP (GFP_KERNEL_ACCOUNT) +-#endif ++#define THREADINFO_GFP (GFP_KERNEL_ACCOUNT | __GFP_ZERO) + + /* + * flag set/clear/test wrappers +diff --git a/include/net/tcp.h b/include/net/tcp.h +index 3173dd12b8cc..686e33ea76e7 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -372,7 +372,7 @@ ssize_t tcp_splice_read(struct socket *sk, loff_t *ppos, + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); + +-void tcp_enter_quickack_mode(struct sock *sk); ++void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks); + static inline void tcp_dec_quickack_mode(struct sock *sk, + const unsigned int pkts) + { +diff --git a/include/soc/tegra/mc.h b/include/soc/tegra/mc.h +index 44202ff897fd..f759e0918037 100644 +--- a/include/soc/tegra/mc.h ++++ b/include/soc/tegra/mc.h +@@ -99,6 +99,8 @@ struct tegra_mc_soc { + u8 client_id_mask; + + const struct tegra_smmu_soc *smmu; ++ ++ u32 intmask; + }; + + struct tegra_mc { +diff --git a/include/uapi/sound/asoc.h b/include/uapi/sound/asoc.h +index 69c37ecbff7e..f3c4b46e39d8 100644 +--- a/include/uapi/sound/asoc.h ++++ b/include/uapi/sound/asoc.h +@@ -139,6 +139,11 @@ + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_CHANNELS (1 << 1) + #define SND_SOC_TPLG_DAI_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + ++/* DAI clock gating */ ++#define SND_SOC_TPLG_DAI_CLK_GATE_UNDEFINED 0 ++#define SND_SOC_TPLG_DAI_CLK_GATE_GATED 1 ++#define SND_SOC_TPLG_DAI_CLK_GATE_CONT 2 ++ + /* DAI physical PCM data formats. + * Add new formats to the end of the list. + */ +@@ -160,6 +165,18 @@ + #define SND_SOC_TPLG_LNK_FLGBIT_SYMMETRIC_SAMPLEBITS (1 << 2) + #define SND_SOC_TPLG_LNK_FLGBIT_VOICE_WAKEUP (1 << 3) + ++/* DAI topology BCLK parameter ++ * For the backwards capability, by default codec is bclk master ++ */ ++#define SND_SOC_TPLG_BCLK_CM 0 /* codec is bclk master */ ++#define SND_SOC_TPLG_BCLK_CS 1 /* codec is bclk slave */ ++ ++/* DAI topology FSYNC parameter ++ * For the backwards capability, by default codec is fsync master ++ */ ++#define SND_SOC_TPLG_FSYNC_CM 0 /* codec is fsync master */ ++#define SND_SOC_TPLG_FSYNC_CS 1 /* codec is fsync slave */ ++ + /* + * Block Header. + * This header precedes all object and object arrays below. +@@ -312,11 +329,11 @@ struct snd_soc_tplg_hw_config { + __le32 size; /* in bytes of this structure */ + __le32 id; /* unique ID - - used to match */ + __le32 fmt; /* SND_SOC_DAI_FORMAT_ format value */ +- __u8 clock_gated; /* 1 if clock can be gated to save power */ ++ __u8 clock_gated; /* SND_SOC_TPLG_DAI_CLK_GATE_ value */ + __u8 invert_bclk; /* 1 for inverted BCLK, 0 for normal */ + __u8 invert_fsync; /* 1 for inverted frame clock, 0 for normal */ +- __u8 bclk_master; /* 1 for master of BCLK, 0 for slave */ +- __u8 fsync_master; /* 1 for master of FSYNC, 0 for slave */ ++ __u8 bclk_master; /* SND_SOC_TPLG_BCLK_ value */ ++ __u8 fsync_master; /* SND_SOC_TPLG_FSYNC_ value */ + __u8 mclk_direction; /* 0 for input, 1 for output */ + __le16 reserved; /* for 32bit alignment */ + __le32 mclk_rate; /* MCLK or SYSCLK freqency in Hz */ +diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c +index 0b0aa5854dac..8dd4063647c2 100644 +--- a/kernel/auditfilter.c ++++ b/kernel/auditfilter.c +@@ -407,7 +407,7 @@ static int audit_field_valid(struct audit_entry *entry, struct audit_field *f) + return -EINVAL; + break; + case AUDIT_EXE: +- if (f->op != Audit_equal) ++ if (f->op != Audit_not_equal && f->op != Audit_equal) + return -EINVAL; + if (entry->rule.listnr != AUDIT_FILTER_EXIT) + return -EINVAL; +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index ecc23e25c9eb..677053a2fb57 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -471,6 +471,8 @@ static int audit_filter_rules(struct task_struct *tsk, + break; + case AUDIT_EXE: + result = audit_exe_compare(tsk, rule->exe); ++ if (f->op == Audit_not_equal) ++ result = !result; + break; + case AUDIT_UID: + result = audit_uid_comparator(cred->uid, f->op, f->uid); +diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c +index 3ceb269c0ebd..450e2cd31ed6 100644 +--- a/kernel/bpf/verifier.c ++++ b/kernel/bpf/verifier.c +@@ -4110,7 +4110,7 @@ static int replace_map_fd_with_map_ptr(struct bpf_verifier_env *env) + /* hold the map. If the program is rejected by verifier, + * the map will be released by release_maps() or it + * will be used by the valid program until it's unloaded +- * and all maps are released in free_bpf_prog_info() ++ * and all maps are released in free_used_maps() + */ + map = bpf_map_inc(map, false); + if (IS_ERR(map)) { +@@ -4623,7 +4623,7 @@ free_log_buf: + vfree(log_buf); + if (!env->prog->aux->used_maps) + /* if we didn't copy map pointers into bpf_prog_info, release +- * them now. Otherwise free_bpf_prog_info() will release them. ++ * them now. Otherwise free_used_maps() will release them. + */ + release_maps(env); + *prog = env->prog; +diff --git a/kernel/delayacct.c b/kernel/delayacct.c +index e2764d767f18..ca8ac2824f0b 100644 +--- a/kernel/delayacct.c ++++ b/kernel/delayacct.c +@@ -44,23 +44,24 @@ void __delayacct_tsk_init(struct task_struct *tsk) + { + tsk->delays = kmem_cache_zalloc(delayacct_cache, GFP_KERNEL); + if (tsk->delays) +- spin_lock_init(&tsk->delays->lock); ++ raw_spin_lock_init(&tsk->delays->lock); + } + + /* + * Finish delay accounting for a statistic using its timestamps (@start), + * accumalator (@total) and @count + */ +-static void delayacct_end(spinlock_t *lock, u64 *start, u64 *total, u32 *count) ++static void delayacct_end(raw_spinlock_t *lock, u64 *start, u64 *total, ++ u32 *count) + { + s64 ns = ktime_get_ns() - *start; + unsigned long flags; + + if (ns > 0) { +- spin_lock_irqsave(lock, flags); ++ raw_spin_lock_irqsave(lock, flags); + *total += ns; + (*count)++; +- spin_unlock_irqrestore(lock, flags); ++ raw_spin_unlock_irqrestore(lock, flags); + } + } + +@@ -127,7 +128,7 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk) + + /* zero XXX_total, non-zero XXX_count implies XXX stat overflowed */ + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + tmp = d->blkio_delay_total + tsk->delays->blkio_delay; + d->blkio_delay_total = (tmp < d->blkio_delay_total) ? 0 : tmp; + tmp = d->swapin_delay_total + tsk->delays->swapin_delay; +@@ -137,7 +138,7 @@ int __delayacct_add_tsk(struct taskstats *d, struct task_struct *tsk) + d->blkio_count += tsk->delays->blkio_count; + d->swapin_count += tsk->delays->swapin_count; + d->freepages_count += tsk->delays->freepages_count; +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + + return 0; + } +@@ -147,10 +148,10 @@ __u64 __delayacct_blkio_ticks(struct task_struct *tsk) + __u64 ret; + unsigned long flags; + +- spin_lock_irqsave(&tsk->delays->lock, flags); ++ raw_spin_lock_irqsave(&tsk->delays->lock, flags); + ret = nsec_to_clock_t(tsk->delays->blkio_delay + + tsk->delays->swapin_delay); +- spin_unlock_irqrestore(&tsk->delays->lock, flags); ++ raw_spin_unlock_irqrestore(&tsk->delays->lock, flags); + return ret; + } + +diff --git a/kernel/fork.c b/kernel/fork.c +index 98c91bd341b4..91907a3701ce 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -215,10 +215,9 @@ static unsigned long *alloc_thread_stack_node(struct task_struct *tsk, int node) + if (!s) + continue; + +-#ifdef CONFIG_DEBUG_KMEMLEAK + /* Clear stale pointers from reused stack. */ + memset(s->addr, 0, THREAD_SIZE); +-#endif ++ + tsk->stack_vm_area = s; + return s->addr; + } +diff --git a/kernel/hung_task.c b/kernel/hung_task.c +index 751593ed7c0b..32b479468e4d 100644 +--- a/kernel/hung_task.c ++++ b/kernel/hung_task.c +@@ -44,6 +44,7 @@ int __read_mostly sysctl_hung_task_warnings = 10; + + static int __read_mostly did_panic; + static bool hung_task_show_lock; ++static bool hung_task_call_panic; + + static struct task_struct *watchdog_task; + +@@ -127,10 +128,8 @@ static void check_hung_task(struct task_struct *t, unsigned long timeout) + touch_nmi_watchdog(); + + if (sysctl_hung_task_panic) { +- if (hung_task_show_lock) +- debug_show_all_locks(); +- trigger_all_cpu_backtrace(); +- panic("hung_task: blocked tasks"); ++ hung_task_show_lock = true; ++ hung_task_call_panic = true; + } + } + +@@ -193,6 +192,10 @@ static void check_hung_uninterruptible_tasks(unsigned long timeout) + rcu_read_unlock(); + if (hung_task_show_lock) + debug_show_all_locks(); ++ if (hung_task_call_panic) { ++ trigger_all_cpu_backtrace(); ++ panic("hung_task: blocked tasks"); ++ } + } + + static long hung_timeout_jiffies(unsigned long last_checked, +diff --git a/kernel/kcov.c b/kernel/kcov.c +index b11ef6e51f7e..f1e060b04ef6 100644 +--- a/kernel/kcov.c ++++ b/kernel/kcov.c +@@ -108,7 +108,8 @@ static void kcov_put(struct kcov *kcov) + + void kcov_task_init(struct task_struct *t) + { +- t->kcov_mode = KCOV_MODE_DISABLED; ++ WRITE_ONCE(t->kcov_mode, KCOV_MODE_DISABLED); ++ barrier(); + t->kcov_size = 0; + t->kcov_area = NULL; + t->kcov = NULL; +diff --git a/kernel/kthread.c b/kernel/kthread.c +index 1ef8f3a5b072..4e6d85b63201 100644 +--- a/kernel/kthread.c ++++ b/kernel/kthread.c +@@ -311,8 +311,14 @@ struct task_struct *__kthread_create_on_node(int (*threadfn)(void *data), + task = create->result; + if (!IS_ERR(task)) { + static const struct sched_param param = { .sched_priority = 0 }; ++ char name[TASK_COMM_LEN]; + +- vsnprintf(task->comm, sizeof(task->comm), namefmt, args); ++ /* ++ * task is already visible to other tasks, so updating ++ * COMM must be protected. ++ */ ++ vsnprintf(name, sizeof(name), namefmt, args); ++ set_task_comm(task, name); + /* + * root may have changed our (kthreadd's) priority or CPU mask. + * The kernel thread should not inherit these properties. +diff --git a/kernel/power/suspend.c b/kernel/power/suspend.c +index 0685c4499431..c0bc2c89697a 100644 +--- a/kernel/power/suspend.c ++++ b/kernel/power/suspend.c +@@ -60,7 +60,7 @@ static const struct platform_s2idle_ops *s2idle_ops; + static DECLARE_WAIT_QUEUE_HEAD(s2idle_wait_head); + + enum s2idle_states __read_mostly s2idle_state; +-static DEFINE_SPINLOCK(s2idle_lock); ++static DEFINE_RAW_SPINLOCK(s2idle_lock); + + void s2idle_set_ops(const struct platform_s2idle_ops *ops) + { +@@ -78,12 +78,12 @@ static void s2idle_enter(void) + { + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, true); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + if (pm_wakeup_pending()) + goto out; + + s2idle_state = S2IDLE_STATE_ENTER; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + get_online_cpus(); + cpuidle_resume(); +@@ -97,11 +97,11 @@ static void s2idle_enter(void) + cpuidle_pause(); + put_online_cpus(); + +- spin_lock_irq(&s2idle_lock); ++ raw_spin_lock_irq(&s2idle_lock); + + out: + s2idle_state = S2IDLE_STATE_NONE; +- spin_unlock_irq(&s2idle_lock); ++ raw_spin_unlock_irq(&s2idle_lock); + + trace_suspend_resume(TPS("machine_suspend"), PM_SUSPEND_TO_IDLE, false); + } +@@ -156,12 +156,12 @@ void s2idle_wake(void) + { + unsigned long flags; + +- spin_lock_irqsave(&s2idle_lock, flags); ++ raw_spin_lock_irqsave(&s2idle_lock, flags); + if (s2idle_state > S2IDLE_STATE_NONE) { + s2idle_state = S2IDLE_STATE_WAKE; + wake_up(&s2idle_wait_head); + } +- spin_unlock_irqrestore(&s2idle_lock, flags); ++ raw_spin_unlock_irqrestore(&s2idle_lock, flags); + } + EXPORT_SYMBOL_GPL(s2idle_wake); + +diff --git a/kernel/printk/printk_safe.c b/kernel/printk/printk_safe.c +index d989cc238198..64825b2df3a5 100644 +--- a/kernel/printk/printk_safe.c ++++ b/kernel/printk/printk_safe.c +@@ -284,7 +284,7 @@ void printk_safe_flush_on_panic(void) + * Make sure that we could access the main ring buffer. + * Do not risk a double release when more CPUs are up. + */ +- if (in_nmi() && raw_spin_is_locked(&logbuf_lock)) { ++ if (raw_spin_is_locked(&logbuf_lock)) { + if (num_online_cpus() > 1) + return; + +diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c +index 2f6fa95de2d8..1ff523dae6e2 100644 +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -37,7 +37,7 @@ struct cpu_stop_done { + struct cpu_stopper { + struct task_struct *thread; + +- spinlock_t lock; ++ raw_spinlock_t lock; + bool enabled; /* is this stopper enabled? */ + struct list_head works; /* list of pending works */ + +@@ -81,13 +81,13 @@ static bool cpu_stop_queue_work(unsigned int cpu, struct cpu_stop_work *work) + unsigned long flags; + bool enabled; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + enabled = stopper->enabled; + if (enabled) + __cpu_stop_queue_work(stopper, work, &wakeq); + else if (work->done) + cpu_stop_signal_done(work->done); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + + wake_up_q(&wakeq); + +@@ -237,8 +237,8 @@ static int cpu_stop_queue_two_works(int cpu1, struct cpu_stop_work *work1, + DEFINE_WAKE_Q(wakeq); + int err; + retry: +- spin_lock_irq(&stopper1->lock); +- spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); ++ raw_spin_lock_irq(&stopper1->lock); ++ raw_spin_lock_nested(&stopper2->lock, SINGLE_DEPTH_NESTING); + + err = -ENOENT; + if (!stopper1->enabled || !stopper2->enabled) +@@ -261,8 +261,8 @@ retry: + __cpu_stop_queue_work(stopper1, work1, &wakeq); + __cpu_stop_queue_work(stopper2, work2, &wakeq); + unlock: +- spin_unlock(&stopper2->lock); +- spin_unlock_irq(&stopper1->lock); ++ raw_spin_unlock(&stopper2->lock); ++ raw_spin_unlock_irq(&stopper1->lock); + + if (unlikely(err == -EDEADLK)) { + while (stop_cpus_in_progress) +@@ -461,9 +461,9 @@ static int cpu_stop_should_run(unsigned int cpu) + unsigned long flags; + int run; + +- spin_lock_irqsave(&stopper->lock, flags); ++ raw_spin_lock_irqsave(&stopper->lock, flags); + run = !list_empty(&stopper->works); +- spin_unlock_irqrestore(&stopper->lock, flags); ++ raw_spin_unlock_irqrestore(&stopper->lock, flags); + return run; + } + +@@ -474,13 +474,13 @@ static void cpu_stopper_thread(unsigned int cpu) + + repeat: + work = NULL; +- spin_lock_irq(&stopper->lock); ++ raw_spin_lock_irq(&stopper->lock); + if (!list_empty(&stopper->works)) { + work = list_first_entry(&stopper->works, + struct cpu_stop_work, list); + list_del_init(&work->list); + } +- spin_unlock_irq(&stopper->lock); ++ raw_spin_unlock_irq(&stopper->lock); + + if (work) { + cpu_stop_fn_t fn = work->fn; +@@ -554,7 +554,7 @@ static int __init cpu_stop_init(void) + for_each_possible_cpu(cpu) { + struct cpu_stopper *stopper = &per_cpu(cpu_stopper, cpu); + +- spin_lock_init(&stopper->lock); ++ raw_spin_lock_init(&stopper->lock); + INIT_LIST_HEAD(&stopper->works); + } + +diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c +index b413fab7d75b..43254c5e7e16 100644 +--- a/kernel/trace/trace_events_trigger.c ++++ b/kernel/trace/trace_events_trigger.c +@@ -680,6 +680,8 @@ event_trigger_callback(struct event_command *cmd_ops, + goto out_free; + + out_reg: ++ /* Up the trigger_data count to make sure reg doesn't free it on failure */ ++ event_trigger_init(trigger_ops, trigger_data); + ret = cmd_ops->reg(glob, trigger_ops, trigger_data, file); + /* + * The above returns on success the # of functions enabled, +@@ -687,11 +689,13 @@ event_trigger_callback(struct event_command *cmd_ops, + * Consider no functions a failure too. + */ + if (!ret) { ++ cmd_ops->unreg(glob, trigger_ops, trigger_data, file); + ret = -ENOENT; +- goto out_free; +- } else if (ret < 0) +- goto out_free; +- ret = 0; ++ } else if (ret > 0) ++ ret = 0; ++ ++ /* Down the counter of trigger_data or free it if not used anymore */ ++ event_trigger_free(trigger_ops, trigger_data); + out: + return ret; + +@@ -1392,6 +1396,9 @@ int event_enable_trigger_func(struct event_command *cmd_ops, + goto out; + } + ++ /* Up the trigger_data count to make sure nothing frees it on failure */ ++ event_trigger_init(trigger_ops, trigger_data); ++ + if (trigger) { + number = strsep(&trigger, ":"); + +@@ -1442,6 +1449,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops, + goto out_disable; + /* Just return zero, not the number of enabled functions */ + ret = 0; ++ event_trigger_free(trigger_ops, trigger_data); + out: + return ret; + +@@ -1452,7 +1460,7 @@ int event_enable_trigger_func(struct event_command *cmd_ops, + out_free: + if (cmd_ops->set_filter) + cmd_ops->set_filter(NULL, trigger_data, NULL); +- kfree(trigger_data); ++ event_trigger_free(trigger_ops, trigger_data); + kfree(enable_data); + goto out; + } +diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c +index f8d3bd974bcc..ea20274a105a 100644 +--- a/kernel/trace/trace_kprobe.c ++++ b/kernel/trace/trace_kprobe.c +@@ -376,11 +376,10 @@ static struct trace_kprobe *find_trace_kprobe(const char *event, + static int + enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file) + { ++ struct event_file_link *link = NULL; + int ret = 0; + + if (file) { +- struct event_file_link *link; +- + link = kmalloc(sizeof(*link), GFP_KERNEL); + if (!link) { + ret = -ENOMEM; +@@ -400,6 +399,18 @@ enable_trace_kprobe(struct trace_kprobe *tk, struct trace_event_file *file) + else + ret = enable_kprobe(&tk->rp.kp); + } ++ ++ if (ret) { ++ if (file) { ++ /* Notice the if is true on not WARN() */ ++ if (!WARN_ON_ONCE(!link)) ++ list_del_rcu(&link->list); ++ kfree(link); ++ tk->tp.flags &= ~TP_FLAG_TRACE; ++ } else { ++ tk->tp.flags &= ~TP_FLAG_PROFILE; ++ } ++ } + out: + return ret; + } +diff --git a/mm/slub.c b/mm/slub.c +index c38e71cea6d3..10e54c4acd19 100644 +--- a/mm/slub.c ++++ b/mm/slub.c +@@ -708,7 +708,7 @@ void object_err(struct kmem_cache *s, struct page *page, + print_trailer(s, page, object); + } + +-static void slab_err(struct kmem_cache *s, struct page *page, ++static __printf(3, 4) void slab_err(struct kmem_cache *s, struct page *page, + const char *fmt, ...) + { + va_list args; +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index ebff729cc956..9ff21a12ea00 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1519,7 +1519,7 @@ static void __vunmap(const void *addr, int deallocate_pages) + addr)) + return; + +- area = remove_vm_area(addr); ++ area = find_vmap_area((unsigned long)addr)->vm; + if (unlikely(!area)) { + WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n", + addr); +@@ -1529,6 +1529,7 @@ static void __vunmap(const void *addr, int deallocate_pages) + debug_check_no_locks_freed(addr, get_vm_area_size(area)); + debug_check_no_obj_freed(addr, get_vm_area_size(area)); + ++ remove_vm_area(addr); + if (deallocate_pages) { + int i; + +diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c +index 67eebcb113f3..5bbdd05d0cd3 100644 +--- a/net/ipv4/fib_frontend.c ++++ b/net/ipv4/fib_frontend.c +@@ -282,19 +282,19 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb) + return ip_hdr(skb)->daddr; + + in_dev = __in_dev_get_rcu(dev); +- BUG_ON(!in_dev); + + net = dev_net(dev); + + scope = RT_SCOPE_UNIVERSE; + if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) { ++ bool vmark = in_dev && IN_DEV_SRC_VMARK(in_dev); + struct flowi4 fl4 = { + .flowi4_iif = LOOPBACK_IFINDEX, + .flowi4_oif = l3mdev_master_ifindex_rcu(dev), + .daddr = ip_hdr(skb)->saddr, + .flowi4_tos = RT_TOS(ip_hdr(skb)->tos), + .flowi4_scope = scope, +- .flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0, ++ .flowi4_mark = vmark ? skb->mark : 0, + }; + if (!fib_lookup(net, &fl4, &res, 0)) + return FIB_RES_PREFSRC(net, res); +diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c +index abdebca848c9..f0782c91514c 100644 +--- a/net/ipv4/ipconfig.c ++++ b/net/ipv4/ipconfig.c +@@ -781,6 +781,11 @@ static void __init ic_bootp_init_ext(u8 *e) + */ + static inline void __init ic_bootp_init(void) + { ++ /* Re-initialise all name servers to NONE, in case any were set via the ++ * "ip=" or "nfsaddrs=" kernel command line parameters: any IP addresses ++ * specified there will already have been decoded but are no longer ++ * needed ++ */ + ic_nameservers_predef(); + + dev_add_pack(&bootp_packet_type); +@@ -1402,6 +1407,13 @@ static int __init ip_auto_config(void) + int err; + unsigned int i; + ++ /* Initialise all name servers to NONE (but only if the "ip=" or ++ * "nfsaddrs=" kernel command line parameters weren't decoded, otherwise ++ * we'll overwrite the IP addresses specified there) ++ */ ++ if (ic_set_manually == 0) ++ ic_nameservers_predef(); ++ + #ifdef CONFIG_PROC_FS + proc_create("pnp", S_IRUGO, init_net.proc_net, &pnp_seq_fops); + #endif /* CONFIG_PROC_FS */ +@@ -1622,6 +1634,7 @@ static int __init ip_auto_config_setup(char *addrs) + return 1; + } + ++ /* Initialise all name servers to NONE */ + ic_nameservers_predef(); + + /* Parse string for static IP assignment. */ +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index 9a0b952dd09b..06f247ca9197 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -353,6 +353,10 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain) + /* Reduce delayed ACKs by rounding up cwnd to the next even number. */ + cwnd = (cwnd + 1) & ~1U; + ++ /* Ensure gain cycling gets inflight above BDP even for small BDPs. */ ++ if (bbr->mode == BBR_PROBE_BW && gain > BBR_UNIT) ++ cwnd += 2; ++ + return cwnd; + } + +diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c +index c78fb53988a1..1a9b88c8cf72 100644 +--- a/net/ipv4/tcp_dctcp.c ++++ b/net/ipv4/tcp_dctcp.c +@@ -138,7 +138,7 @@ static void dctcp_ce_state_0_to_1(struct sock *sk) + */ + if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) + __tcp_send_ack(sk, ca->prior_rcv_nxt); +- tcp_enter_quickack_mode(sk); ++ tcp_enter_quickack_mode(sk, 1); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +@@ -159,7 +159,7 @@ static void dctcp_ce_state_1_to_0(struct sock *sk) + */ + if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) + __tcp_send_ack(sk, ca->prior_rcv_nxt); +- tcp_enter_quickack_mode(sk); ++ tcp_enter_quickack_mode(sk, 1); + } + + ca->prior_rcv_nxt = tp->rcv_nxt; +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index b86e7b8beb1d..bdabd748f4bc 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -198,21 +198,23 @@ static void tcp_measure_rcv_mss(struct sock *sk, const struct sk_buff *skb) + } + } + +-static void tcp_incr_quickack(struct sock *sk) ++static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks) + { + struct inet_connection_sock *icsk = inet_csk(sk); + unsigned int quickacks = tcp_sk(sk)->rcv_wnd / (2 * icsk->icsk_ack.rcv_mss); + + if (quickacks == 0) + quickacks = 2; ++ quickacks = min(quickacks, max_quickacks); + if (quickacks > icsk->icsk_ack.quick) +- icsk->icsk_ack.quick = min(quickacks, TCP_MAX_QUICKACKS); ++ icsk->icsk_ack.quick = quickacks; + } + +-void tcp_enter_quickack_mode(struct sock *sk) ++void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks) + { + struct inet_connection_sock *icsk = inet_csk(sk); +- tcp_incr_quickack(sk); ++ ++ tcp_incr_quickack(sk, max_quickacks); + icsk->icsk_ack.pingpong = 0; + icsk->icsk_ack.ato = TCP_ATO_MIN; + } +@@ -248,8 +250,10 @@ static void tcp_ecn_withdraw_cwr(struct tcp_sock *tp) + tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR; + } + +-static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) ++static void __tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb) + { ++ struct tcp_sock *tp = tcp_sk(sk); ++ + switch (TCP_SKB_CB(skb)->ip_dsfield & INET_ECN_MASK) { + case INET_ECN_NOT_ECT: + /* Funny extension: if ECT is not set on a segment, +@@ -257,31 +261,31 @@ static void __tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) + * it is probably a retransmit. + */ + if (tp->ecn_flags & TCP_ECN_SEEN) +- tcp_enter_quickack_mode((struct sock *)tp); ++ tcp_enter_quickack_mode(sk, 2); + break; + case INET_ECN_CE: +- if (tcp_ca_needs_ecn((struct sock *)tp)) +- tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_IS_CE); ++ if (tcp_ca_needs_ecn(sk)) ++ tcp_ca_event(sk, CA_EVENT_ECN_IS_CE); + + if (!(tp->ecn_flags & TCP_ECN_DEMAND_CWR)) { + /* Better not delay acks, sender can have a very low cwnd */ +- tcp_enter_quickack_mode((struct sock *)tp); ++ tcp_enter_quickack_mode(sk, 2); + tp->ecn_flags |= TCP_ECN_DEMAND_CWR; + } + tp->ecn_flags |= TCP_ECN_SEEN; + break; + default: +- if (tcp_ca_needs_ecn((struct sock *)tp)) +- tcp_ca_event((struct sock *)tp, CA_EVENT_ECN_NO_CE); ++ if (tcp_ca_needs_ecn(sk)) ++ tcp_ca_event(sk, CA_EVENT_ECN_NO_CE); + tp->ecn_flags |= TCP_ECN_SEEN; + break; + } + } + +-static void tcp_ecn_check_ce(struct tcp_sock *tp, const struct sk_buff *skb) ++static void tcp_ecn_check_ce(struct sock *sk, const struct sk_buff *skb) + { +- if (tp->ecn_flags & TCP_ECN_OK) +- __tcp_ecn_check_ce(tp, skb); ++ if (tcp_sk(sk)->ecn_flags & TCP_ECN_OK) ++ __tcp_ecn_check_ce(sk, skb); + } + + static void tcp_ecn_rcv_synack(struct tcp_sock *tp, const struct tcphdr *th) +@@ -686,7 +690,7 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb) + /* The _first_ data packet received, initialize + * delayed ACK engine. + */ +- tcp_incr_quickack(sk); ++ tcp_incr_quickack(sk, TCP_MAX_QUICKACKS); + icsk->icsk_ack.ato = TCP_ATO_MIN; + } else { + int m = now - icsk->icsk_ack.lrcvtime; +@@ -702,13 +706,13 @@ static void tcp_event_data_recv(struct sock *sk, struct sk_buff *skb) + /* Too long gap. Apparently sender failed to + * restart window, so that we send ACKs quickly. + */ +- tcp_incr_quickack(sk); ++ tcp_incr_quickack(sk, TCP_MAX_QUICKACKS); + sk_mem_reclaim(sk); + } + } + icsk->icsk_ack.lrcvtime = now; + +- tcp_ecn_check_ce(tp, skb); ++ tcp_ecn_check_ce(sk, skb); + + if (skb->len >= 128) + tcp_grow_window(sk, skb); +@@ -4160,7 +4164,7 @@ static void tcp_send_dupack(struct sock *sk, const struct sk_buff *skb) + if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq && + before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) { + NET_INC_STATS(sock_net(sk), LINUX_MIB_DELAYEDACKLOST); +- tcp_enter_quickack_mode(sk); ++ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); + + if (tcp_is_sack(tp) && sysctl_tcp_dsack) { + u32 end_seq = TCP_SKB_CB(skb)->end_seq; +@@ -4441,7 +4445,7 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb) + u32 seq, end_seq; + bool fragstolen; + +- tcp_ecn_check_ce(tp, skb); ++ tcp_ecn_check_ce(sk, skb); + + if (unlikely(tcp_try_rmem_schedule(sk, skb, skb->truesize))) { + NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPOFODROP); +@@ -4710,7 +4714,7 @@ queue_and_out: + tcp_dsack_set(sk, TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq); + + out_of_window: +- tcp_enter_quickack_mode(sk); ++ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); + inet_csk_schedule_ack(sk); + drop: + tcp_drop(sk, skb); +@@ -4721,8 +4725,6 @@ drop: + if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt + tcp_receive_window(tp))) + goto out_of_window; + +- tcp_enter_quickack_mode(sk); +- + if (before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) { + /* Partial packet, seq < rcv_next < end_seq */ + SOCK_DEBUG(sk, "partial packet: rcv_next %X seq %X - %X\n", +@@ -5793,7 +5795,7 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, + * to stand against the temptation 8) --ANK + */ + inet_csk_schedule_ack(sk); +- tcp_enter_quickack_mode(sk); ++ tcp_enter_quickack_mode(sk, TCP_MAX_QUICKACKS); + inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, + TCP_DELACK_MAX, TCP_RTO_MAX); + +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index 51063d9ed0f7..dfd268166e42 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -1241,7 +1241,10 @@ IPSET_TOKEN(HTYPE, _create)(struct net *net, struct ip_set *set, + pr_debug("Create set %s with family %s\n", + set->name, set->family == NFPROTO_IPV4 ? "inet" : "inet6"); + +-#ifndef IP_SET_PROTO_UNDEF ++#ifdef IP_SET_PROTO_UNDEF ++ if (set->family != NFPROTO_UNSPEC) ++ return -IPSET_ERR_INVALID_FAMILY; ++#else + if (!(set->family == NFPROTO_IPV4 || set->family == NFPROTO_IPV6)) + return -IPSET_ERR_INVALID_FAMILY; + #endif +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 85b549e84104..9a945024a0b6 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -2710,12 +2710,13 @@ static struct nft_set *nf_tables_set_lookup_byid(const struct net *net, + u32 id = ntohl(nla_get_be32(nla)); + + list_for_each_entry(trans, &net->nft.commit_list, list) { +- struct nft_set *set = nft_trans_set(trans); ++ if (trans->msg_type == NFT_MSG_NEWSET) { ++ struct nft_set *set = nft_trans_set(trans); + +- if (trans->msg_type == NFT_MSG_NEWSET && +- id == nft_trans_set_id(trans) && +- nft_active_genmask(set, genmask)) +- return set; ++ if (id == nft_trans_set_id(trans) && ++ nft_active_genmask(set, genmask)) ++ return set; ++ } + } + return ERR_PTR(-ENOENT); + } +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index b3932846f6c4..b2fcbf012056 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -977,6 +977,11 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + return err; + } + ++ if (nlk->ngroups == 0) ++ groups = 0; ++ else ++ groups &= (1ULL << nlk->ngroups) - 1; ++ + bound = nlk->bound; + if (bound) { + /* Ensure nlk->portid is up-to-date. */ +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 7e334fd31c15..f8553179bdd7 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -379,6 +379,7 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id) + + static int read_idmap[READING_MAX_ID] = { + [READING_FIRMWARE] = FIRMWARE_CHECK, ++ [READING_FIRMWARE_PREALLOC_BUFFER] = FIRMWARE_CHECK, + [READING_MODULE] = MODULE_CHECK, + [READING_KEXEC_IMAGE] = KEXEC_KERNEL_CHECK, + [READING_KEXEC_INITRAMFS] = KEXEC_INITRAMFS_CHECK, +diff --git a/sound/pci/emu10k1/emupcm.c b/sound/pci/emu10k1/emupcm.c +index 2683b9717215..56be1630bd3e 100644 +--- a/sound/pci/emu10k1/emupcm.c ++++ b/sound/pci/emu10k1/emupcm.c +@@ -1850,7 +1850,9 @@ int snd_emu10k1_pcm_efx(struct snd_emu10k1 *emu, int device) + if (!kctl) + return -ENOMEM; + kctl->id.device = device; +- snd_ctl_add(emu->card, kctl); ++ err = snd_ctl_add(emu->card, kctl); ++ if (err < 0) ++ return err; + + snd_pcm_lib_preallocate_pages_for_all(pcm, SNDRV_DMA_TYPE_DEV, snd_dma_pci_data(emu->pci), 64*1024, 64*1024); + +diff --git a/sound/pci/emu10k1/memory.c b/sound/pci/emu10k1/memory.c +index 4f1f69be1865..8c778fa33031 100644 +--- a/sound/pci/emu10k1/memory.c ++++ b/sound/pci/emu10k1/memory.c +@@ -237,13 +237,13 @@ __found_pages: + static int is_valid_page(struct snd_emu10k1 *emu, dma_addr_t addr) + { + if (addr & ~emu->dma_mask) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "max memory size is 0x%lx (addr = 0x%lx)!!\n", + emu->dma_mask, (unsigned long)addr); + return 0; + } + if (addr & (EMUPAGESIZE-1)) { +- dev_err(emu->card->dev, "page is not aligned\n"); ++ dev_err_ratelimited(emu->card->dev, "page is not aligned\n"); + return 0; + } + return 1; +@@ -334,7 +334,7 @@ snd_emu10k1_alloc_pages(struct snd_emu10k1 *emu, struct snd_pcm_substream *subst + else + addr = snd_pcm_sgbuf_get_addr(substream, ofs); + if (! is_valid_page(emu, addr)) { +- dev_err(emu->card->dev, ++ dev_err_ratelimited(emu->card->dev, + "emu: failure page = %d\n", idx); + mutex_unlock(&hdr->block_mutex); + return NULL; +diff --git a/sound/pci/fm801.c b/sound/pci/fm801.c +index 73a67bc3586b..e3fb9c61017c 100644 +--- a/sound/pci/fm801.c ++++ b/sound/pci/fm801.c +@@ -1068,11 +1068,19 @@ static int snd_fm801_mixer(struct fm801 *chip) + if ((err = snd_ac97_mixer(chip->ac97_bus, &ac97, &chip->ac97_sec)) < 0) + return err; + } +- for (i = 0; i < FM801_CONTROLS; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ for (i = 0; i < FM801_CONTROLS; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls[i], chip)); ++ if (err < 0) ++ return err; ++ } + if (chip->multichannel) { +- for (i = 0; i < FM801_CONTROLS_MULTI; i++) +- snd_ctl_add(chip->card, snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ for (i = 0; i < FM801_CONTROLS_MULTI; i++) { ++ err = snd_ctl_add(chip->card, ++ snd_ctl_new1(&snd_fm801_controls_multi[i], chip)); ++ if (err < 0) ++ return err; ++ } + } + return 0; + } +diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c +index 3e73d5c6ccfc..119f3b504765 100644 +--- a/sound/pci/hda/patch_ca0132.c ++++ b/sound/pci/hda/patch_ca0132.c +@@ -38,6 +38,10 @@ + /* Enable this to see controls for tuning purpose. */ + /*#define ENABLE_TUNING_CONTROLS*/ + ++#ifdef ENABLE_TUNING_CONTROLS ++#include ++#endif ++ + #define FLOAT_ZERO 0x00000000 + #define FLOAT_ONE 0x3f800000 + #define FLOAT_TWO 0x40000000 +@@ -3067,8 +3071,8 @@ static int equalizer_ctl_put(struct snd_kcontrol *kcontrol, + return 1; + } + +-static const DECLARE_TLV_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); +-static const DECLARE_TLV_DB_SCALE(eq_db_scale, -2400, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(voice_focus_db_scale, 2000, 100, 0); ++static const SNDRV_CTL_TLVD_DECLARE_DB_SCALE(eq_db_scale, -2400, 100, 0); + + static int add_tuning_control(struct hda_codec *codec, + hda_nid_t pnid, hda_nid_t nid, +diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c +index 94b88b897c3b..3d0dab8282ad 100644 +--- a/sound/soc/soc-pcm.c ++++ b/sound/soc/soc-pcm.c +@@ -1779,8 +1779,10 @@ int dpcm_be_dai_shutdown(struct snd_soc_pcm_runtime *fe, int stream) + continue; + + if ((be->dpcm[stream].state != SND_SOC_DPCM_STATE_HW_FREE) && +- (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) +- continue; ++ (be->dpcm[stream].state != SND_SOC_DPCM_STATE_OPEN)) { ++ soc_pcm_hw_free(be_substream); ++ be->dpcm[stream].state = SND_SOC_DPCM_STATE_HW_FREE; ++ } + + dev_dbg(be->dev, "ASoC: close BE %s\n", + be->dai_link->name); +diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c +index 30cdad2eab7f..c1619860a5de 100644 +--- a/sound/soc/soc-topology.c ++++ b/sound/soc/soc-topology.c +@@ -1997,6 +1997,13 @@ static void set_link_hw_format(struct snd_soc_dai_link *link, + + link->dai_fmt = hw_config->fmt & SND_SOC_DAIFMT_FORMAT_MASK; + ++ /* clock gating */ ++ if (hw_config->clock_gated == SND_SOC_TPLG_DAI_CLK_GATE_GATED) ++ link->dai_fmt |= SND_SOC_DAIFMT_GATED; ++ else if (hw_config->clock_gated == ++ SND_SOC_TPLG_DAI_CLK_GATE_CONT) ++ link->dai_fmt |= SND_SOC_DAIFMT_CONT; ++ + /* clock signal polarity */ + invert_bclk = hw_config->invert_bclk; + invert_fsync = hw_config->invert_fsync; +@@ -2010,13 +2017,15 @@ static void set_link_hw_format(struct snd_soc_dai_link *link, + link->dai_fmt |= SND_SOC_DAIFMT_IB_IF; + + /* clock masters */ +- bclk_master = hw_config->bclk_master; +- fsync_master = hw_config->fsync_master; +- if (!bclk_master && !fsync_master) ++ bclk_master = (hw_config->bclk_master == ++ SND_SOC_TPLG_BCLK_CM); ++ fsync_master = (hw_config->fsync_master == ++ SND_SOC_TPLG_FSYNC_CM); ++ if (bclk_master && fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFM; +- else if (bclk_master && !fsync_master) +- link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; + else if (!bclk_master && fsync_master) ++ link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFM; ++ else if (bclk_master && !fsync_master) + link->dai_fmt |= SND_SOC_DAIFMT_CBM_CFS; + else + link->dai_fmt |= SND_SOC_DAIFMT_CBS_CFS; +diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c +index 3cbfae6604f9..d8a46d46bcd2 100644 +--- a/sound/usb/pcm.c ++++ b/sound/usb/pcm.c +@@ -1311,7 +1311,7 @@ static void retire_capture_urb(struct snd_usb_substream *subs, + if (bytes % (runtime->sample_bits >> 3) != 0) { + int oldbytes = bytes; + bytes = frames * stride; +- dev_warn(&subs->dev->dev, ++ dev_warn_ratelimited(&subs->dev->dev, + "Corrected urb data len. %d->%d\n", + oldbytes, bytes); + } +diff --git a/tools/perf/util/parse-events.y b/tools/perf/util/parse-events.y +index e81a20ea8d7d..988310cd3049 100644 +--- a/tools/perf/util/parse-events.y ++++ b/tools/perf/util/parse-events.y +@@ -72,6 +72,7 @@ static void inc_group_count(struct list_head *list, + %type value_sym + %type event_config + %type opt_event_config ++%type opt_pmu_config + %type event_term + %type event_pmu + %type event_legacy_symbol +@@ -223,7 +224,7 @@ event_def: event_pmu | + event_bpf_file + + event_pmu: +-PE_NAME opt_event_config ++PE_NAME opt_pmu_config + { + struct list_head *list, *orig_terms, *terms; + +@@ -486,6 +487,17 @@ opt_event_config: + $$ = NULL; + } + ++opt_pmu_config: ++'/' event_config '/' ++{ ++ $$ = $2; ++} ++| ++'/' '/' ++{ ++ $$ = NULL; ++} ++ + start_terms: event_config + { + struct parse_events_state *parse_state = _parse_state; +diff --git a/tools/testing/selftests/intel_pstate/run.sh b/tools/testing/selftests/intel_pstate/run.sh +index c670359becc6..928978804342 100755 +--- a/tools/testing/selftests/intel_pstate/run.sh ++++ b/tools/testing/selftests/intel_pstate/run.sh +@@ -30,9 +30,12 @@ + + EVALUATE_ONLY=0 + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + if ! uname -m | sed -e s/i.86/x86/ -e s/x86_64/x86/ | grep -q x86; then + echo "$0 # Skipped: Test can only run on x86 architectures." +- exit 0 ++ exit $ksft_skip + fi + + max_cpus=$(($(nproc)-1)) +@@ -48,11 +51,12 @@ function run_test () { + + echo "sleeping for 5 seconds" + sleep 5 +- num_freqs=$(cat /proc/cpuinfo | grep MHz | sort -u | wc -l) +- if [ $num_freqs -le 2 ]; then +- cat /proc/cpuinfo | grep MHz | sort -u | tail -1 > /tmp/result.$1 ++ grep MHz /proc/cpuinfo | sort -u > /tmp/result.freqs ++ num_freqs=$(wc -l /tmp/result.freqs | awk ' { print $1 } ') ++ if [ $num_freqs -ge 2 ]; then ++ tail -n 1 /tmp/result.freqs > /tmp/result.$1 + else +- cat /proc/cpuinfo | grep MHz | sort -u > /tmp/result.$1 ++ cp /tmp/result.freqs /tmp/result.$1 + fi + ./msr 0 >> /tmp/result.$1 + +@@ -82,21 +86,20 @@ _max_freq=$(cpupower frequency-info -l | tail -1 | awk ' { print $2 } ') + max_freq=$(($_max_freq / 1000)) + + +-for freq in `seq $max_freq -100 $min_freq` ++[ $EVALUATE_ONLY -eq 0 ] && for freq in `seq $max_freq -100 $min_freq` + do + echo "Setting maximum frequency to $freq" + cpupower frequency-set -g powersave --max=${freq}MHz >& /dev/null +- [ $EVALUATE_ONLY -eq 0 ] && run_test $freq ++ run_test $freq + done + +-echo "==============================================================================" ++[ $EVALUATE_ONLY -eq 0 ] && cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null + ++echo "==============================================================================" + echo "The marketing frequency of the cpu is $mkt_freq MHz" + echo "The maximum frequency of the cpu is $max_freq MHz" + echo "The minimum frequency of the cpu is $min_freq MHz" + +-cpupower frequency-set -g powersave --max=${max_freq}MHz >& /dev/null +- + # make a pretty table + echo "Target Actual Difference MSR(0x199) max_perf_pct" + for freq in `seq $max_freq -100 $min_freq` +@@ -104,10 +107,6 @@ do + result_freq=$(cat /tmp/result.${freq} | grep "cpu MHz" | awk ' { print $4 } ' | awk -F "." ' { print $1 } ') + msr=$(cat /tmp/result.${freq} | grep "msr" | awk ' { print $3 } ') + max_perf_pct=$(cat /tmp/result.${freq} | grep "max_perf_pct" | awk ' { print $2 } ' ) +- if [ $result_freq -eq $freq ]; then +- echo " $freq $result_freq 0 $msr $(($max_perf_pct*3300))" +- else +- echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" +- fi ++ echo " $freq $result_freq $(($result_freq-$freq)) $msr $(($max_perf_pct*$max_freq))" + done + exit 0 +diff --git a/tools/testing/selftests/memfd/run_tests.sh b/tools/testing/selftests/memfd/run_tests.sh +index daabb350697c..bf83db61013a 100755 +--- a/tools/testing/selftests/memfd/run_tests.sh ++++ b/tools/testing/selftests/memfd/run_tests.sh +@@ -1,6 +1,9 @@ + #!/bin/bash + # please run as root + ++# Kselftest framework requirement - SKIP code is 4. ++ksft_skip=4 ++ + # + # Normal tests requiring no special resources + # +@@ -29,12 +32,13 @@ if [ -n "$freepgs" ] && [ $freepgs -lt $hpages_test ]; then + nr_hugepgs=`cat /proc/sys/vm/nr_hugepages` + hpages_needed=`expr $hpages_test - $freepgs` + ++ if [ $UID != 0 ]; then ++ echo "Please run memfd with hugetlbfs test as root" ++ exit $ksft_skip ++ fi ++ + echo 3 > /proc/sys/vm/drop_caches + echo $(( $hpages_needed + $nr_hugepgs )) > /proc/sys/vm/nr_hugepages +- if [ $? -ne 0 ]; then +- echo "Please run this test as root" +- exit 1 +- fi + while read name size unit; do + if [ "$name" = "HugePages_Free:" ]; then + freepgs=$size +@@ -53,7 +57,7 @@ if [ $freepgs -lt $hpages_test ]; then + fi + printf "Not enough huge pages available (%d < %d)\n" \ + $freepgs $needpgs +- exit 1 ++ exit $ksft_skip + fi + + # +diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c +index d1fc0f9f00fb..ed8c9d360c0f 100644 +--- a/tools/usb/usbip/libsrc/vhci_driver.c ++++ b/tools/usb/usbip/libsrc/vhci_driver.c +@@ -135,11 +135,11 @@ static int refresh_imported_device_list(void) + return 0; + } + +-static int get_nports(void) ++static int get_nports(struct udev_device *hc_device) + { + const char *attr_nports; + +- attr_nports = udev_device_get_sysattr_value(vhci_driver->hc_device, "nports"); ++ attr_nports = udev_device_get_sysattr_value(hc_device, "nports"); + if (!attr_nports) { + err("udev_device_get_sysattr_value nports failed"); + return -1; +@@ -242,35 +242,41 @@ static int read_record(int rhport, char *host, unsigned long host_len, + + int usbip_vhci_driver_open(void) + { ++ int nports; ++ struct udev_device *hc_device; ++ + udev_context = udev_new(); + if (!udev_context) { + err("udev_new failed"); + return -1; + } + +- vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver)); +- + /* will be freed in usbip_driver_close() */ +- vhci_driver->hc_device = ++ hc_device = + udev_device_new_from_subsystem_sysname(udev_context, + USBIP_VHCI_BUS_TYPE, + USBIP_VHCI_DEVICE_NAME); +- if (!vhci_driver->hc_device) { ++ if (!hc_device) { + err("udev_device_new_from_subsystem_sysname failed"); + goto err; + } + +- vhci_driver->nports = get_nports(); +- dbg("available ports: %d", vhci_driver->nports); +- +- if (vhci_driver->nports <= 0) { ++ nports = get_nports(hc_device); ++ if (nports <= 0) { + err("no available ports"); + goto err; +- } else if (vhci_driver->nports > MAXNPORT) { +- err("port number exceeds %d", MAXNPORT); ++ } ++ dbg("available ports: %d", nports); ++ ++ vhci_driver = calloc(1, sizeof(struct usbip_vhci_driver) + ++ nports * sizeof(struct usbip_imported_device)); ++ if (!vhci_driver) { ++ err("vhci_driver allocation failed"); + goto err; + } + ++ vhci_driver->nports = nports; ++ vhci_driver->hc_device = hc_device; + vhci_driver->ncontrollers = get_ncontrollers(); + dbg("available controllers: %d", vhci_driver->ncontrollers); + +@@ -285,7 +291,7 @@ int usbip_vhci_driver_open(void) + return 0; + + err: +- udev_device_unref(vhci_driver->hc_device); ++ udev_device_unref(hc_device); + + if (vhci_driver) + free(vhci_driver); +diff --git a/tools/usb/usbip/libsrc/vhci_driver.h b/tools/usb/usbip/libsrc/vhci_driver.h +index 418b404d5121..6c9aca216705 100644 +--- a/tools/usb/usbip/libsrc/vhci_driver.h ++++ b/tools/usb/usbip/libsrc/vhci_driver.h +@@ -13,7 +13,6 @@ + + #define USBIP_VHCI_BUS_TYPE "platform" + #define USBIP_VHCI_DEVICE_NAME "vhci_hcd.0" +-#define MAXNPORT 128 + + enum hub_speed { + HUB_SPEED_HIGH = 0, +@@ -41,7 +40,7 @@ struct usbip_vhci_driver { + + int ncontrollers; + int nports; +- struct usbip_imported_device idev[MAXNPORT]; ++ struct usbip_imported_device idev[]; + }; + + +diff --git a/tools/usb/usbip/src/usbip_detach.c b/tools/usb/usbip/src/usbip_detach.c +index 9db9d21bb2ec..6a8db858caa5 100644 +--- a/tools/usb/usbip/src/usbip_detach.c ++++ b/tools/usb/usbip/src/usbip_detach.c +@@ -43,7 +43,7 @@ void usbip_detach_usage(void) + + static int detach_port(char *port) + { +- int ret; ++ int ret = 0; + uint8_t portnum; + char path[PATH_MAX+1]; + +@@ -73,9 +73,12 @@ static int detach_port(char *port) + } + + ret = usbip_vhci_detach_device(portnum); +- if (ret < 0) +- return -1; ++ if (ret < 0) { ++ ret = -1; ++ goto call_driver_close; ++ } + ++call_driver_close: + usbip_vhci_driver_close(); + + return ret; diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.60-61.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.60-61.patch new file mode 100644 index 000000000000..d7a40832de96 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.60-61.patch @@ -0,0 +1,909 @@ +diff --git a/Makefile b/Makefile +index 5b48ec630990..4bd65eabd298 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 60 ++SUBLEVEL = 61 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S +index f7bfa701219b..0fae7096ae23 100644 +--- a/arch/x86/entry/entry_64.S ++++ b/arch/x86/entry/entry_64.S +@@ -933,7 +933,7 @@ ENTRY(\sym) + + call \do_sym + +- jmp error_exit /* %ebx: no swapgs flag */ ++ jmp error_exit + .endif + END(\sym) + .endm +@@ -1166,7 +1166,6 @@ END(paranoid_exit) + + /* + * Save all registers in pt_regs, and switch GS if needed. +- * Return: EBX=0: came from user mode; EBX=1: otherwise + */ + ENTRY(error_entry) + UNWIND_HINT_FUNC +@@ -1213,7 +1212,6 @@ ENTRY(error_entry) + * for these here too. + */ + .Lerror_kernelspace: +- incl %ebx + leaq native_irq_return_iret(%rip), %rcx + cmpq %rcx, RIP+8(%rsp) + je .Lerror_bad_iret +@@ -1247,28 +1245,20 @@ ENTRY(error_entry) + + /* + * Pretend that the exception came from user mode: set up pt_regs +- * as if we faulted immediately after IRET and clear EBX so that +- * error_exit knows that we will be returning to user mode. ++ * as if we faulted immediately after IRET. + */ + mov %rsp, %rdi + call fixup_bad_iret + mov %rax, %rsp +- decl %ebx + jmp .Lerror_entry_from_usermode_after_swapgs + END(error_entry) + +- +-/* +- * On entry, EBX is a "return to kernel mode" flag: +- * 1: already in kernel mode, don't need SWAPGS +- * 0: user gsbase is loaded, we need SWAPGS and standard preparation for return to usermode +- */ + ENTRY(error_exit) + UNWIND_HINT_REGS + DISABLE_INTERRUPTS(CLBR_ANY) + TRACE_IRQS_OFF +- testl %ebx, %ebx +- jnz retint_kernel ++ testb $3, CS(%rsp) ++ jz retint_kernel + jmp retint_user + END(error_exit) + +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index ebdcc368a2d3..f48a51335538 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -580,6 +580,9 @@ static u32 skx_deadline_rev(void) + case 0x04: return 0x02000014; + } + ++ if (boot_cpu_data.x86_stepping > 4) ++ return 0; ++ + return ~0U; + } + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 90747865205d..8d000fde1414 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -7354,6 +7354,8 @@ static int enter_vmx_operation(struct kvm_vcpu *vcpu) + HRTIMER_MODE_REL_PINNED); + vmx->nested.preemption_timer.function = vmx_preemption_timer_fn; + ++ vmx->nested.vpid02 = allocate_vpid(); ++ + vmx->nested.vmxon = true; + return 0; + +@@ -9802,10 +9804,8 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) + goto free_vmcs; + } + +- if (nested) { ++ if (nested) + nested_vmx_setup_ctls_msrs(vmx); +- vmx->nested.vpid02 = allocate_vpid(); +- } + + vmx->nested.posted_intr_nv = -1; + vmx->nested.current_vmptr = -1ull; +@@ -9822,7 +9822,6 @@ static struct kvm_vcpu *vmx_create_vcpu(struct kvm *kvm, unsigned int id) + return &vmx->vcpu; + + free_vmcs: +- free_vpid(vmx->nested.vpid02); + free_loaded_vmcs(vmx->loaded_vmcs); + free_msrs: + kfree(vmx->guest_msrs); +diff --git a/drivers/crypto/padlock-aes.c b/drivers/crypto/padlock-aes.c +index c939f18f70cc..7685f557dcc0 100644 +--- a/drivers/crypto/padlock-aes.c ++++ b/drivers/crypto/padlock-aes.c +@@ -266,6 +266,8 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, + return; + } + ++ count -= initial; ++ + if (initial) + asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ + : "+S"(input), "+D"(output) +@@ -273,7 +275,7 @@ static inline void padlock_xcrypt_ecb(const u8 *input, u8 *output, void *key, + + asm volatile (".byte 0xf3,0x0f,0xa7,0xc8" /* rep xcryptecb */ + : "+S"(input), "+D"(output) +- : "d"(control_word), "b"(key), "c"(count - initial)); ++ : "d"(control_word), "b"(key), "c"(count)); + } + + static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, +@@ -284,6 +286,8 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, + if (count < cbc_fetch_blocks) + return cbc_crypt(input, output, key, iv, control_word, count); + ++ count -= initial; ++ + if (initial) + asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ + : "+S" (input), "+D" (output), "+a" (iv) +@@ -291,7 +295,7 @@ static inline u8 *padlock_xcrypt_cbc(const u8 *input, u8 *output, void *key, + + asm volatile (".byte 0xf3,0x0f,0xa7,0xd0" /* rep xcryptcbc */ + : "+S" (input), "+D" (output), "+a" (iv) +- : "d" (control_word), "b" (key), "c" (count-initial)); ++ : "d" (control_word), "b" (key), "c" (count)); + return iv; + } + +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 77c56264c05b..17590cb2b80d 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -352,6 +352,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + vc4_state->x_scaling[0] = VC4_SCALING_TPZ; + if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) + vc4_state->y_scaling[0] = VC4_SCALING_TPZ; ++ } else { ++ vc4_state->x_scaling[1] = VC4_SCALING_NONE; ++ vc4_state->y_scaling[1] = VC4_SCALING_NONE; + } + + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && +diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c +index b8229d7b0ff5..f836ed1dd300 100644 +--- a/drivers/infiniband/core/uverbs_cmd.c ++++ b/drivers/infiniband/core/uverbs_cmd.c +@@ -1981,15 +1981,64 @@ static int modify_qp(struct ib_uverbs_file *file, + goto release_qp; + } + +- if ((cmd->base.attr_mask & IB_QP_AV) && +- !rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { +- ret = -EINVAL; +- goto release_qp; ++ if ((cmd->base.attr_mask & IB_QP_AV)) { ++ if (!rdma_is_port_valid(qp->device, cmd->base.dest.port_num)) { ++ ret = -EINVAL; ++ goto release_qp; ++ } ++ ++ if (cmd->base.attr_mask & IB_QP_STATE && ++ cmd->base.qp_state == IB_QPS_RTR) { ++ /* We are in INIT->RTR TRANSITION (if we are not, ++ * this transition will be rejected in subsequent checks). ++ * In the INIT->RTR transition, we cannot have IB_QP_PORT set, ++ * but the IB_QP_STATE flag is required. ++ * ++ * Since kernel 3.14 (commit dbf727de7440), the uverbs driver, ++ * when IB_QP_AV is set, has required inclusion of a valid ++ * port number in the primary AV. (AVs are created and handled ++ * differently for infiniband and ethernet (RoCE) ports). ++ * ++ * Check the port number included in the primary AV against ++ * the port number in the qp struct, which was set (and saved) ++ * in the RST->INIT transition. ++ */ ++ if (cmd->base.dest.port_num != qp->real_qp->port) { ++ ret = -EINVAL; ++ goto release_qp; ++ } ++ } else { ++ /* We are in SQD->SQD. (If we are not, this transition will ++ * be rejected later in the verbs layer checks). ++ * Check for both IB_QP_PORT and IB_QP_AV, these can be set ++ * together in the SQD->SQD transition. ++ * ++ * If only IP_QP_AV was set, add in IB_QP_PORT as well (the ++ * verbs layer driver does not track primary port changes ++ * resulting from path migration. Thus, in SQD, if the primary ++ * AV is modified, the primary port should also be modified). ++ * ++ * Note that in this transition, the IB_QP_STATE flag ++ * is not allowed. ++ */ ++ if (((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) ++ == (IB_QP_AV | IB_QP_PORT)) && ++ cmd->base.port_num != cmd->base.dest.port_num) { ++ ret = -EINVAL; ++ goto release_qp; ++ } ++ if ((cmd->base.attr_mask & (IB_QP_AV | IB_QP_PORT)) ++ == IB_QP_AV) { ++ cmd->base.attr_mask |= IB_QP_PORT; ++ cmd->base.port_num = cmd->base.dest.port_num; ++ } ++ } + } + + if ((cmd->base.attr_mask & IB_QP_ALT_PATH) && + (!rdma_is_port_valid(qp->device, cmd->base.alt_port_num) || +- !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num))) { ++ !rdma_is_port_valid(qp->device, cmd->base.alt_dest.port_num) || ++ cmd->base.alt_port_num != cmd->base.alt_dest.port_num)) { + ret = -EINVAL; + goto release_qp; + } +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 00245b73c224..15aedb64a02b 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1687,6 +1687,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + goto err_upper_unlink; + } + ++ bond->nest_level = dev_get_nest_level(bond_dev) + 1; ++ + /* If the mode uses primary, then the following is handled by + * bond_change_active_slave(). + */ +@@ -1734,7 +1736,6 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + if (bond_mode_uses_xmit_hash(bond)) + bond_update_slave_arr(bond, NULL); + +- bond->nest_level = dev_get_nest_level(bond_dev); + + netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", + slave_dev->name, +@@ -3379,6 +3380,13 @@ static void bond_fold_stats(struct rtnl_link_stats64 *_res, + } + } + ++static int bond_get_nest_level(struct net_device *bond_dev) ++{ ++ struct bonding *bond = netdev_priv(bond_dev); ++ ++ return bond->nest_level; ++} ++ + static void bond_get_stats(struct net_device *bond_dev, + struct rtnl_link_stats64 *stats) + { +@@ -3387,7 +3395,7 @@ static void bond_get_stats(struct net_device *bond_dev, + struct list_head *iter; + struct slave *slave; + +- spin_lock(&bond->stats_lock); ++ spin_lock_nested(&bond->stats_lock, bond_get_nest_level(bond_dev)); + memcpy(stats, &bond->bond_stats, sizeof(*stats)); + + rcu_read_lock(); +@@ -4182,6 +4190,7 @@ static const struct net_device_ops bond_netdev_ops = { + .ndo_neigh_setup = bond_neigh_setup, + .ndo_vlan_rx_add_vid = bond_vlan_rx_add_vid, + .ndo_vlan_rx_kill_vid = bond_vlan_rx_kill_vid, ++ .ndo_get_lock_subclass = bond_get_nest_level, + #ifdef CONFIG_NET_POLL_CONTROLLER + .ndo_netpoll_setup = bond_netpoll_setup, + .ndo_netpoll_cleanup = bond_netpoll_cleanup, +@@ -4680,6 +4689,7 @@ static int bond_init(struct net_device *bond_dev) + if (!bond->wq) + return -ENOMEM; + ++ bond->nest_level = SINGLE_DEPTH_NESTING; + netdev_lockdep_set_classes(bond_dev); + + list_add_tail(&bond->bond_list, &bn->dev_list); +diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c +index b00358297424..d0846ae9e0e4 100644 +--- a/drivers/net/can/usb/ems_usb.c ++++ b/drivers/net/can/usb/ems_usb.c +@@ -1071,6 +1071,7 @@ static void ems_usb_disconnect(struct usb_interface *intf) + usb_free_urb(dev->intr_urb); + + kfree(dev->intr_in_buffer); ++ kfree(dev->tx_msg_buffer); + } + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index 667415301066..f697084937c3 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -1616,7 +1616,7 @@ int mlx5_eswitch_init(struct mlx5_core_dev *dev) + int vport_num; + int err; + +- if (!MLX5_VPORT_MANAGER(dev)) ++ if (!MLX5_ESWITCH_MANAGER(dev)) + return 0; + + esw_info(dev, +@@ -1689,7 +1689,7 @@ abort: + + void mlx5_eswitch_cleanup(struct mlx5_eswitch *esw) + { +- if (!esw || !MLX5_VPORT_MANAGER(esw->dev)) ++ if (!esw || !MLX5_ESWITCH_MANAGER(esw->dev)) + return; + + esw_info(esw->dev, "cleanup\n"); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +index 8d375e51a526..6a393b16a1fc 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +@@ -257,7 +257,7 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + return -ENOMEM; + + /* Enable pci device */ +- ret = pcim_enable_device(pdev); ++ ret = pci_enable_device(pdev); + if (ret) { + dev_err(&pdev->dev, "%s: ERROR: failed to enable device\n", + __func__); +@@ -300,9 +300,45 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + static void stmmac_pci_remove(struct pci_dev *pdev) + { + stmmac_dvr_remove(&pdev->dev); ++ pci_disable_device(pdev); + } + +-static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_suspend, stmmac_resume); ++static int stmmac_pci_suspend(struct device *dev) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev); ++ int ret; ++ ++ ret = stmmac_suspend(dev); ++ if (ret) ++ return ret; ++ ++ ret = pci_save_state(pdev); ++ if (ret) ++ return ret; ++ ++ pci_disable_device(pdev); ++ pci_wake_from_d3(pdev, true); ++ return 0; ++} ++ ++static int stmmac_pci_resume(struct device *dev) ++{ ++ struct pci_dev *pdev = to_pci_dev(dev); ++ int ret; ++ ++ pci_restore_state(pdev); ++ pci_set_power_state(pdev, PCI_D0); ++ ++ ret = pci_enable_device(pdev); ++ if (ret) ++ return ret; ++ ++ pci_set_master(pdev); ++ ++ return stmmac_resume(dev); ++} ++ ++static SIMPLE_DEV_PM_OPS(stmmac_pm_ops, stmmac_pci_suspend, stmmac_pci_resume); + + /* synthetic ID, no official vendor */ + #define PCI_VENDOR_ID_STMMAC 0x700 +diff --git a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c +index 73da5e63a609..2c80c722feca 100644 +--- a/drivers/net/wireless/intel/iwlwifi/cfg/9000.c ++++ b/drivers/net/wireless/intel/iwlwifi/cfg/9000.c +@@ -177,6 +177,17 @@ const struct iwl_cfg iwl9260_2ac_cfg = { + .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, + }; + ++const struct iwl_cfg iwl9260_killer_2ac_cfg = { ++ .name = "Killer (R) Wireless-AC 1550 Wireless Network Adapter (9260NGW)", ++ .fw_name_pre = IWL9260A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9260B_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++}; ++ + const struct iwl_cfg iwl9270_2ac_cfg = { + .name = "Intel(R) Dual Band Wireless AC 9270", + .fw_name_pre = IWL9260A_FW_PRE, +@@ -266,6 +277,34 @@ const struct iwl_cfg iwl9560_2ac_cfg_soc = { + .soc_latency = 5000, + }; + ++const struct iwl_cfg iwl9560_killer_2ac_cfg_soc = { ++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++}; ++ ++const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc = { ++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++}; ++ + const struct iwl_cfg iwl9460_2ac_cfg_shared_clk = { + .name = "Intel(R) Dual Band Wireless AC 9460", + .fw_name_pre = IWL9000A_FW_PRE, +@@ -326,6 +365,36 @@ const struct iwl_cfg iwl9560_2ac_cfg_shared_clk = { + .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK + }; + ++const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk = { ++ .name = "Killer (R) Wireless-AC 1550i Wireless Network Adapter (9560NGW)", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ ++const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk = { ++ .name = "Killer (R) Wireless-AC 1550s Wireless Network Adapter (9560NGW)", ++ .fw_name_pre = IWL9000A_FW_PRE, ++ .fw_name_pre_b_or_c_step = IWL9000B_FW_PRE, ++ .fw_name_pre_rf_next_step = IWL9000RFB_FW_PRE, ++ IWL_DEVICE_9000, ++ .ht_params = &iwl9000_ht_params, ++ .nvm_ver = IWL9000_NVM_VERSION, ++ .nvm_calib_ver = IWL9000_TX_POWER_VERSION, ++ .max_ht_ampdu_exponent = IEEE80211_HT_MAX_AMPDU_64K, ++ .integrated = true, ++ .soc_latency = 5000, ++ .extra_phy_cfg_flags = FW_PHY_CFG_SHARED_CLK ++}; ++ + MODULE_FIRMWARE(IWL9000A_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL9000B_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); + MODULE_FIRMWARE(IWL9000RFB_MODULE_FIRMWARE(IWL9000_UCODE_API_MAX)); +diff --git a/drivers/net/wireless/intel/iwlwifi/iwl-config.h b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +index 85fe1a928adc..70f3c327eb4a 100644 +--- a/drivers/net/wireless/intel/iwlwifi/iwl-config.h ++++ b/drivers/net/wireless/intel/iwlwifi/iwl-config.h +@@ -470,6 +470,7 @@ extern const struct iwl_cfg iwl8265_2ac_sdio_cfg; + extern const struct iwl_cfg iwl4165_2ac_sdio_cfg; + extern const struct iwl_cfg iwl9160_2ac_cfg; + extern const struct iwl_cfg iwl9260_2ac_cfg; ++extern const struct iwl_cfg iwl9260_killer_2ac_cfg; + extern const struct iwl_cfg iwl9270_2ac_cfg; + extern const struct iwl_cfg iwl9460_2ac_cfg; + extern const struct iwl_cfg iwl9560_2ac_cfg; +@@ -477,10 +478,14 @@ extern const struct iwl_cfg iwl9460_2ac_cfg_soc; + extern const struct iwl_cfg iwl9461_2ac_cfg_soc; + extern const struct iwl_cfg iwl9462_2ac_cfg_soc; + extern const struct iwl_cfg iwl9560_2ac_cfg_soc; ++extern const struct iwl_cfg iwl9560_killer_2ac_cfg_soc; ++extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_soc; + extern const struct iwl_cfg iwl9460_2ac_cfg_shared_clk; + extern const struct iwl_cfg iwl9461_2ac_cfg_shared_clk; + extern const struct iwl_cfg iwl9462_2ac_cfg_shared_clk; + extern const struct iwl_cfg iwl9560_2ac_cfg_shared_clk; ++extern const struct iwl_cfg iwl9560_killer_2ac_cfg_shared_clk; ++extern const struct iwl_cfg iwl9560_killer_s_2ac_cfg_shared_clk; + extern const struct iwl_cfg iwla000_2ac_cfg_hr; + extern const struct iwl_cfg iwla000_2ac_cfg_hr_cdb; + extern const struct iwl_cfg iwla000_2ac_cfg_jf; +diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +index 9a8605abb00a..4cbc6cb8bf89 100644 +--- a/drivers/net/wireless/intel/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/intel/iwlwifi/pcie/drv.c +@@ -543,6 +543,9 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2526, 0x1210, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x1410, iwl9270_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x1420, iwl9460_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0x1550, iwl9260_killer_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2526, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x1610, iwl9270_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x2034, iwl9560_2ac_cfg_soc)}, +@@ -552,6 +555,7 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2526, 0x40A4, iwl9460_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0x4234, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2526, 0x42A4, iwl9462_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2526, 0x8014, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2526, 0xA014, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0010, iwl9160_2ac_cfg)}, + {IWL_PCI_DEVICE(0x271B, 0x0014, iwl9160_2ac_cfg)}, +@@ -576,6 +580,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x2720, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x2720, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x2720, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x2720, 0x4030, iwl9560_2ac_cfg)}, +@@ -602,6 +608,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x30DC, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x30DC, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x30DC, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x30DC, 0x4030, iwl9560_2ac_cfg_soc)}, +@@ -628,6 +636,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x31DC, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x31DC, 0x1030, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1551, iwl9560_killer_s_2ac_cfg_shared_clk)}, ++ {IWL_PCI_DEVICE(0x31DC, 0x1552, iwl9560_killer_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x2030, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x2034, iwl9560_2ac_cfg_shared_clk)}, + {IWL_PCI_DEVICE(0x31DC, 0x4030, iwl9560_2ac_cfg_shared_clk)}, +@@ -654,6 +664,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x34F0, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x34F0, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x34F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x34F0, 0x4030, iwl9560_2ac_cfg_soc)}, +@@ -680,6 +692,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x3DF0, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x3DF0, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x3DF0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x3DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x3DF0, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x3DF0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x3DF0, 0x4030, iwl9560_2ac_cfg_soc)}, +@@ -706,6 +720,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x43F0, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x43F0, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x43F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x43F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x43F0, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x43F0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x43F0, 0x4030, iwl9560_2ac_cfg_soc)}, +@@ -741,6 +757,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0x9DF0, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0x9DF0, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0x9DF0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2010, iwl9460_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0x9DF0, 0x2034, iwl9560_2ac_cfg_soc)}, +@@ -769,6 +787,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0xA0F0, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0xA0F0, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA0F0, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA0F0, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA0F0, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA0F0, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA0F0, 0x4030, iwl9560_2ac_cfg_soc)}, +@@ -795,6 +815,8 @@ static const struct pci_device_id iwl_hw_card_ids[] = { + {IWL_PCI_DEVICE(0xA370, 0x1010, iwl9260_2ac_cfg)}, + {IWL_PCI_DEVICE(0xA370, 0x1030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x1210, iwl9260_2ac_cfg)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1551, iwl9560_killer_s_2ac_cfg_soc)}, ++ {IWL_PCI_DEVICE(0xA370, 0x1552, iwl9560_killer_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x2030, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x2034, iwl9560_2ac_cfg_soc)}, + {IWL_PCI_DEVICE(0xA370, 0x4030, iwl9560_2ac_cfg_soc)}, +diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c +index 4d49fb8f2bbc..3a406b40f150 100644 +--- a/drivers/scsi/sg.c ++++ b/drivers/scsi/sg.c +@@ -2186,6 +2186,7 @@ sg_add_sfp(Sg_device * sdp) + write_lock_irqsave(&sdp->sfd_lock, iflags); + if (atomic_read(&sdp->detaching)) { + write_unlock_irqrestore(&sdp->sfd_lock, iflags); ++ kfree(sfp); + return ERR_PTR(-ENODEV); + } + list_add_tail(&sfp->sfd_siblings, &sdp->sfds); +diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c +index f0b3a0b9d42f..36c9fbf70d44 100644 +--- a/drivers/virtio/virtio_balloon.c ++++ b/drivers/virtio/virtio_balloon.c +@@ -490,7 +490,9 @@ static int virtballoon_migratepage(struct balloon_dev_info *vb_dev_info, + tell_host(vb, vb->inflate_vq); + + /* balloon's page migration 2nd step -- deflate "page" */ ++ spin_lock_irqsave(&vb_dev_info->pages_lock, flags); + balloon_page_delete(page); ++ spin_unlock_irqrestore(&vb_dev_info->pages_lock, flags); + vb->num_pfns = VIRTIO_BALLOON_PAGES_PER_PAGE; + set_page_pfns(vb, vb->pfns, page); + tell_host(vb, vb->deflate_vq); +diff --git a/fs/squashfs/block.c b/fs/squashfs/block.c +index 2751476e6b6e..f098b9f1c396 100644 +--- a/fs/squashfs/block.c ++++ b/fs/squashfs/block.c +@@ -167,6 +167,8 @@ int squashfs_read_data(struct super_block *sb, u64 index, int length, + } + + if (compressed) { ++ if (!msblk->stream) ++ goto read_failure; + length = squashfs_decompress(msblk, bh, b, offset, length, + output); + if (length < 0) +diff --git a/fs/squashfs/fragment.c b/fs/squashfs/fragment.c +index 86ad9a4b8c36..0681feab4a84 100644 +--- a/fs/squashfs/fragment.c ++++ b/fs/squashfs/fragment.c +@@ -49,11 +49,16 @@ int squashfs_frag_lookup(struct super_block *sb, unsigned int fragment, + u64 *fragment_block) + { + struct squashfs_sb_info *msblk = sb->s_fs_info; +- int block = SQUASHFS_FRAGMENT_INDEX(fragment); +- int offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); +- u64 start_block = le64_to_cpu(msblk->fragment_index[block]); ++ int block, offset, size; + struct squashfs_fragment_entry fragment_entry; +- int size; ++ u64 start_block; ++ ++ if (fragment >= msblk->fragments) ++ return -EIO; ++ block = SQUASHFS_FRAGMENT_INDEX(fragment); ++ offset = SQUASHFS_FRAGMENT_INDEX_OFFSET(fragment); ++ ++ start_block = le64_to_cpu(msblk->fragment_index[block]); + + size = squashfs_read_metadata(sb, &fragment_entry, &start_block, + &offset, sizeof(fragment_entry)); +diff --git a/fs/squashfs/squashfs_fs_sb.h b/fs/squashfs/squashfs_fs_sb.h +index 1da565cb50c3..ef69c31947bf 100644 +--- a/fs/squashfs/squashfs_fs_sb.h ++++ b/fs/squashfs/squashfs_fs_sb.h +@@ -75,6 +75,7 @@ struct squashfs_sb_info { + unsigned short block_log; + long long bytes_used; + unsigned int inodes; ++ unsigned int fragments; + int xattr_ids; + }; + #endif +diff --git a/fs/squashfs/super.c b/fs/squashfs/super.c +index cf01e15a7b16..1516bb779b8d 100644 +--- a/fs/squashfs/super.c ++++ b/fs/squashfs/super.c +@@ -175,6 +175,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) + msblk->inode_table = le64_to_cpu(sblk->inode_table_start); + msblk->directory_table = le64_to_cpu(sblk->directory_table_start); + msblk->inodes = le32_to_cpu(sblk->inodes); ++ msblk->fragments = le32_to_cpu(sblk->fragments); + flags = le16_to_cpu(sblk->flags); + + TRACE("Found valid superblock on %pg\n", sb->s_bdev); +@@ -185,7 +186,7 @@ static int squashfs_fill_super(struct super_block *sb, void *data, int silent) + TRACE("Filesystem size %lld bytes\n", msblk->bytes_used); + TRACE("Block size %d\n", msblk->block_size); + TRACE("Number of inodes %d\n", msblk->inodes); +- TRACE("Number of fragments %d\n", le32_to_cpu(sblk->fragments)); ++ TRACE("Number of fragments %d\n", msblk->fragments); + TRACE("Number of ids %d\n", le16_to_cpu(sblk->no_ids)); + TRACE("sblk->inode_table_start %llx\n", msblk->inode_table); + TRACE("sblk->directory_table_start %llx\n", msblk->directory_table); +@@ -272,7 +273,7 @@ allocate_id_index_table: + sb->s_export_op = &squashfs_export_ops; + + handle_fragments: +- fragments = le32_to_cpu(sblk->fragments); ++ fragments = msblk->fragments; + if (fragments == 0) + goto check_directory_table; + +diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c +index f6ed92524a03..3eda623e4cb4 100644 +--- a/fs/userfaultfd.c ++++ b/fs/userfaultfd.c +@@ -628,8 +628,10 @@ static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx, + /* the various vma->vm_userfaultfd_ctx still points to it */ + down_write(&mm->mmap_sem); + for (vma = mm->mmap; vma; vma = vma->vm_next) +- if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) ++ if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) { + vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX; ++ vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING); ++ } + up_write(&mm->mmap_sem); + + userfaultfd_ctx_put(release_new_ctx); +diff --git a/kernel/auditsc.c b/kernel/auditsc.c +index 677053a2fb57..76d789d6cea0 100644 +--- a/kernel/auditsc.c ++++ b/kernel/auditsc.c +@@ -1274,8 +1274,12 @@ static void show_special(struct audit_context *context, int *call_panic) + break; + case AUDIT_KERN_MODULE: + audit_log_format(ab, "name="); +- audit_log_untrustedstring(ab, context->module.name); +- kfree(context->module.name); ++ if (context->module.name) { ++ audit_log_untrustedstring(ab, context->module.name); ++ kfree(context->module.name); ++ } else ++ audit_log_format(ab, "(null)"); ++ + break; + } + audit_log_end(ab); +@@ -2387,8 +2391,9 @@ void __audit_log_kern_module(char *name) + { + struct audit_context *context = current->audit_context; + +- context->module.name = kmalloc(strlen(name) + 1, GFP_KERNEL); +- strcpy(context->module.name, name); ++ context->module.name = kstrdup(name, GFP_KERNEL); ++ if (!context->module.name) ++ audit_log_lost("out of memory in __audit_log_kern_module"); + context->type = AUDIT_KERN_MODULE; + } + +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 865e29e62bad..242e74b9d454 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -1219,6 +1219,9 @@ int dsa_slave_suspend(struct net_device *slave_dev) + { + struct dsa_slave_priv *p = netdev_priv(slave_dev); + ++ if (!netif_running(slave_dev)) ++ return 0; ++ + netif_device_detach(slave_dev); + + if (p->phy) { +@@ -1236,6 +1239,9 @@ int dsa_slave_resume(struct net_device *slave_dev) + { + struct dsa_slave_priv *p = netdev_priv(slave_dev); + ++ if (!netif_running(slave_dev)) ++ return 0; ++ + netif_device_attach(slave_dev); + + if (p->phy) { +diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c +index e691705f0a85..ba4454ecdf0f 100644 +--- a/net/ipv4/inet_fragment.c ++++ b/net/ipv4/inet_fragment.c +@@ -356,11 +356,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf, + { + struct inet_frag_queue *q; + +- if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { +- inet_frag_schedule_worker(f); +- return NULL; +- } +- + q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC); + if (!q) + return NULL; +@@ -397,6 +392,11 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, + struct inet_frag_queue *q; + int depth = 0; + ++ if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh) { ++ inet_frag_schedule_worker(f); ++ return NULL; ++ } ++ + if (frag_mem_limit(nf) > nf->low_thresh) + inet_frag_schedule_worker(f); + +diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c +index df8fe0503de0..4cb1befc3949 100644 +--- a/net/ipv4/ip_fragment.c ++++ b/net/ipv4/ip_fragment.c +@@ -447,11 +447,16 @@ found: + int i = end - FRAG_CB(next)->offset; /* overlap is 'i' bytes */ + + if (i < next->len) { ++ int delta = -next->truesize; ++ + /* Eat head of the next overlapped fragment + * and leave the loop. The next ones cannot overlap. + */ + if (!pskb_pull(next, i)) + goto err; ++ delta += next->truesize; ++ if (delta) ++ add_frag_mem_limit(qp->q.net, delta); + FRAG_CB(next)->offset += i; + qp->q.meat -= i; + if (next->ip_summed != CHECKSUM_UNNECESSARY) +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index b2fcbf012056..68c9d1833b95 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -63,6 +63,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -647,6 +648,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol, + + if (protocol < 0 || protocol >= MAX_LINKS) + return -EPROTONOSUPPORT; ++ protocol = array_index_nospec(protocol, MAX_LINKS); + + netlink_lock_table(); + #ifdef CONFIG_MODULES +diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c +index 3028298ca561..62b1581d44a5 100644 +--- a/net/rxrpc/call_accept.c ++++ b/net/rxrpc/call_accept.c +@@ -115,9 +115,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx, + while (*pp) { + parent = *pp; + xcall = rb_entry(parent, struct rxrpc_call, sock_node); +- if (user_call_ID < call->user_call_ID) ++ if (user_call_ID < xcall->user_call_ID) + pp = &(*pp)->rb_left; +- else if (user_call_ID > call->user_call_ID) ++ else if (user_call_ID > xcall->user_call_ID) + pp = &(*pp)->rb_right; + else + goto id_in_use; +diff --git a/net/socket.c b/net/socket.c +index 8b2bef6cfe42..d27922639a20 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -89,6 +89,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -2443,6 +2444,7 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args) + + if (call < 1 || call > SYS_SENDMMSG) + return -EINVAL; ++ call = array_index_nospec(call, SYS_SENDMMSG + 1); + + len = nargs[call]; + if (len > sizeof(a)) diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.61-62.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.61-62.patch new file mode 100644 index 000000000000..a1d7ceb78983 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.61-62.patch @@ -0,0 +1,797 @@ +diff --git a/Makefile b/Makefile +index 4bd65eabd298..d407ecfdee0b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 61 ++SUBLEVEL = 62 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/i2c/busses/i2c-imx.c b/drivers/i2c/busses/i2c-imx.c +index f96830ffd9f1..75c6b98585ba 100644 +--- a/drivers/i2c/busses/i2c-imx.c ++++ b/drivers/i2c/busses/i2c-imx.c +@@ -376,6 +376,7 @@ static int i2c_imx_dma_xfer(struct imx_i2c_struct *i2c_imx, + goto err_desc; + } + ++ reinit_completion(&dma->cmd_complete); + txdesc->callback = i2c_imx_dma_callback; + txdesc->callback_param = i2c_imx; + if (dma_submit_error(dmaengine_submit(txdesc))) { +@@ -619,7 +620,6 @@ static int i2c_imx_dma_write(struct imx_i2c_struct *i2c_imx, + * The first byte must be transmitted by the CPU. + */ + imx_i2c_write_reg(msgs->addr << 1, i2c_imx, IMX_I2C_I2DR); +- reinit_completion(&i2c_imx->dma->cmd_complete); + time_left = wait_for_completion_timeout( + &i2c_imx->dma->cmd_complete, + msecs_to_jiffies(DMA_TIMEOUT)); +@@ -678,7 +678,6 @@ static int i2c_imx_dma_read(struct imx_i2c_struct *i2c_imx, + if (result) + return result; + +- reinit_completion(&i2c_imx->dma->cmd_complete); + time_left = wait_for_completion_timeout( + &i2c_imx->dma->cmd_complete, + msecs_to_jiffies(DMA_TIMEOUT)); +diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c +index f0b06b14e782..16249b0953ff 100644 +--- a/drivers/idle/intel_idle.c ++++ b/drivers/idle/intel_idle.c +@@ -1061,7 +1061,7 @@ static const struct idle_cpu idle_cpu_dnv = { + }; + + #define ICPU(model, cpu) \ +- { X86_VENDOR_INTEL, 6, model, X86_FEATURE_MWAIT, (unsigned long)&cpu } ++ { X86_VENDOR_INTEL, 6, model, X86_FEATURE_ANY, (unsigned long)&cpu } + + static const struct x86_cpu_id intel_idle_ids[] __initconst = { + ICPU(INTEL_FAM6_NEHALEM_EP, idle_cpu_nehalem), +@@ -1125,6 +1125,11 @@ static int __init intel_idle_probe(void) + return -ENODEV; + } + ++ if (!boot_cpu_has(X86_FEATURE_MWAIT)) { ++ pr_debug("Please enable MWAIT in BIOS SETUP\n"); ++ return -ENODEV; ++ } ++ + if (boot_cpu_data.cpuid_level < CPUID_MWAIT_LEAF) + return -ENODEV; + +diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c +index f5643d107cc6..a67d03716510 100644 +--- a/drivers/nvme/host/pci.c ++++ b/drivers/nvme/host/pci.c +@@ -77,7 +77,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown); + * Represents an NVM Express device. Each nvme_dev is a PCI function. + */ + struct nvme_dev { +- struct nvme_queue **queues; ++ struct nvme_queue *queues; + struct blk_mq_tag_set tagset; + struct blk_mq_tag_set admin_tagset; + u32 __iomem *dbs; +@@ -348,7 +348,7 @@ static int nvme_admin_init_hctx(struct blk_mq_hw_ctx *hctx, void *data, + unsigned int hctx_idx) + { + struct nvme_dev *dev = data; +- struct nvme_queue *nvmeq = dev->queues[0]; ++ struct nvme_queue *nvmeq = &dev->queues[0]; + + WARN_ON(hctx_idx != 0); + WARN_ON(dev->admin_tagset.tags[0] != hctx->tags); +@@ -370,7 +370,7 @@ static int nvme_init_hctx(struct blk_mq_hw_ctx *hctx, void *data, + unsigned int hctx_idx) + { + struct nvme_dev *dev = data; +- struct nvme_queue *nvmeq = dev->queues[hctx_idx + 1]; ++ struct nvme_queue *nvmeq = &dev->queues[hctx_idx + 1]; + + if (!nvmeq->tags) + nvmeq->tags = &dev->tagset.tags[hctx_idx]; +@@ -386,7 +386,7 @@ static int nvme_init_request(struct blk_mq_tag_set *set, struct request *req, + struct nvme_dev *dev = set->driver_data; + struct nvme_iod *iod = blk_mq_rq_to_pdu(req); + int queue_idx = (set == &dev->tagset) ? hctx_idx + 1 : 0; +- struct nvme_queue *nvmeq = dev->queues[queue_idx]; ++ struct nvme_queue *nvmeq = &dev->queues[queue_idx]; + + BUG_ON(!nvmeq); + iod->nvmeq = nvmeq; +@@ -900,7 +900,7 @@ static int nvme_poll(struct blk_mq_hw_ctx *hctx, unsigned int tag) + static void nvme_pci_submit_async_event(struct nvme_ctrl *ctrl, int aer_idx) + { + struct nvme_dev *dev = to_nvme_dev(ctrl); +- struct nvme_queue *nvmeq = dev->queues[0]; ++ struct nvme_queue *nvmeq = &dev->queues[0]; + struct nvme_command c; + + memset(&c, 0, sizeof(c)); +@@ -1146,7 +1146,6 @@ static void nvme_free_queue(struct nvme_queue *nvmeq) + if (nvmeq->sq_cmds) + dma_free_coherent(nvmeq->q_dmadev, SQ_SIZE(nvmeq->q_depth), + nvmeq->sq_cmds, nvmeq->sq_dma_addr); +- kfree(nvmeq); + } + + static void nvme_free_queues(struct nvme_dev *dev, int lowest) +@@ -1154,10 +1153,8 @@ static void nvme_free_queues(struct nvme_dev *dev, int lowest) + int i; + + for (i = dev->ctrl.queue_count - 1; i >= lowest; i--) { +- struct nvme_queue *nvmeq = dev->queues[i]; + dev->ctrl.queue_count--; +- dev->queues[i] = NULL; +- nvme_free_queue(nvmeq); ++ nvme_free_queue(&dev->queues[i]); + } + } + +@@ -1189,10 +1186,8 @@ static int nvme_suspend_queue(struct nvme_queue *nvmeq) + + static void nvme_disable_admin_queue(struct nvme_dev *dev, bool shutdown) + { +- struct nvme_queue *nvmeq = dev->queues[0]; ++ struct nvme_queue *nvmeq = &dev->queues[0]; + +- if (!nvmeq) +- return; + if (nvme_suspend_queue(nvmeq)) + return; + +@@ -1246,13 +1241,13 @@ static int nvme_alloc_sq_cmds(struct nvme_dev *dev, struct nvme_queue *nvmeq, + return 0; + } + +-static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid, +- int depth, int node) ++static int nvme_alloc_queue(struct nvme_dev *dev, int qid, ++ int depth, int node) + { +- struct nvme_queue *nvmeq = kzalloc_node(sizeof(*nvmeq), GFP_KERNEL, +- node); +- if (!nvmeq) +- return NULL; ++ struct nvme_queue *nvmeq = &dev->queues[qid]; ++ ++ if (dev->ctrl.queue_count > qid) ++ return 0; + + nvmeq->cqes = dma_zalloc_coherent(dev->dev, CQ_SIZE(depth), + &nvmeq->cq_dma_addr, GFP_KERNEL); +@@ -1271,17 +1266,15 @@ static struct nvme_queue *nvme_alloc_queue(struct nvme_dev *dev, int qid, + nvmeq->q_depth = depth; + nvmeq->qid = qid; + nvmeq->cq_vector = -1; +- dev->queues[qid] = nvmeq; + dev->ctrl.queue_count++; + +- return nvmeq; ++ return 0; + + free_cqdma: + dma_free_coherent(dev->dev, CQ_SIZE(depth), (void *)nvmeq->cqes, + nvmeq->cq_dma_addr); + free_nvmeq: +- kfree(nvmeq); +- return NULL; ++ return -ENOMEM; + } + + static int queue_request_irq(struct nvme_queue *nvmeq) +@@ -1468,14 +1461,12 @@ static int nvme_pci_configure_admin_queue(struct nvme_dev *dev) + if (result < 0) + return result; + +- nvmeq = dev->queues[0]; +- if (!nvmeq) { +- nvmeq = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH, +- dev_to_node(dev->dev)); +- if (!nvmeq) +- return -ENOMEM; +- } ++ result = nvme_alloc_queue(dev, 0, NVME_AQ_DEPTH, ++ dev_to_node(dev->dev)); ++ if (result) ++ return result; + ++ nvmeq = &dev->queues[0]; + aqa = nvmeq->q_depth - 1; + aqa |= aqa << 16; + +@@ -1505,7 +1496,7 @@ static int nvme_create_io_queues(struct nvme_dev *dev) + + for (i = dev->ctrl.queue_count; i <= dev->max_qid; i++) { + /* vector == qid - 1, match nvme_create_queue */ +- if (!nvme_alloc_queue(dev, i, dev->q_depth, ++ if (nvme_alloc_queue(dev, i, dev->q_depth, + pci_irq_get_node(to_pci_dev(dev->dev), i - 1))) { + ret = -ENOMEM; + break; +@@ -1514,7 +1505,7 @@ static int nvme_create_io_queues(struct nvme_dev *dev) + + max = min(dev->max_qid, dev->ctrl.queue_count - 1); + for (i = dev->online_queues; i <= max; i++) { +- ret = nvme_create_queue(dev->queues[i], i); ++ ret = nvme_create_queue(&dev->queues[i], i); + if (ret) + break; + } +@@ -1770,7 +1761,7 @@ static int nvme_setup_host_mem(struct nvme_dev *dev) + + static int nvme_setup_io_queues(struct nvme_dev *dev) + { +- struct nvme_queue *adminq = dev->queues[0]; ++ struct nvme_queue *adminq = &dev->queues[0]; + struct pci_dev *pdev = to_pci_dev(dev->dev); + int result, nr_io_queues; + unsigned long size; +@@ -1896,7 +1887,7 @@ static void nvme_disable_io_queues(struct nvme_dev *dev, int queues) + retry: + timeout = ADMIN_TIMEOUT; + for (; i > 0; i--, sent++) +- if (nvme_delete_queue(dev->queues[i], opcode)) ++ if (nvme_delete_queue(&dev->queues[i], opcode)) + break; + + while (sent--) { +@@ -2081,7 +2072,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) + + queues = dev->online_queues - 1; + for (i = dev->ctrl.queue_count - 1; i > 0; i--) +- nvme_suspend_queue(dev->queues[i]); ++ nvme_suspend_queue(&dev->queues[i]); + + if (dead) { + /* A device might become IO incapable very soon during +@@ -2089,7 +2080,7 @@ static void nvme_dev_disable(struct nvme_dev *dev, bool shutdown) + * queue_count can be 0 here. + */ + if (dev->ctrl.queue_count) +- nvme_suspend_queue(dev->queues[0]); ++ nvme_suspend_queue(&dev->queues[0]); + } else { + nvme_disable_io_queues(dev, queues); + nvme_disable_admin_queue(dev, shutdown); +@@ -2345,7 +2336,8 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) + dev = kzalloc_node(sizeof(*dev), GFP_KERNEL, node); + if (!dev) + return -ENOMEM; +- dev->queues = kzalloc_node((num_possible_cpus() + 1) * sizeof(void *), ++ ++ dev->queues = kzalloc_node((num_possible_cpus() + 1) * sizeof(struct nvme_queue), + GFP_KERNEL, node); + if (!dev->queues) + goto free; +diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c +index 8e21211b904b..b7a5d1065378 100644 +--- a/drivers/nvme/target/fc.c ++++ b/drivers/nvme/target/fc.c +@@ -58,8 +58,8 @@ struct nvmet_fc_ls_iod { + struct work_struct work; + } __aligned(sizeof(unsigned long long)); + ++/* desired maximum for a single sequence - if sg list allows it */ + #define NVMET_FC_MAX_SEQ_LENGTH (256 * 1024) +-#define NVMET_FC_MAX_XFR_SGENTS (NVMET_FC_MAX_SEQ_LENGTH / PAGE_SIZE) + + enum nvmet_fcp_datadir { + NVMET_FCP_NODATA, +@@ -74,6 +74,7 @@ struct nvmet_fc_fcp_iod { + struct nvme_fc_cmd_iu cmdiubuf; + struct nvme_fc_ersp_iu rspiubuf; + dma_addr_t rspdma; ++ struct scatterlist *next_sg; + struct scatterlist *data_sg; + int data_sg_cnt; + u32 total_length; +@@ -1000,8 +1001,7 @@ nvmet_fc_register_targetport(struct nvmet_fc_port_info *pinfo, + INIT_LIST_HEAD(&newrec->assoc_list); + kref_init(&newrec->ref); + ida_init(&newrec->assoc_cnt); +- newrec->max_sg_cnt = min_t(u32, NVMET_FC_MAX_XFR_SGENTS, +- template->max_sgl_segments); ++ newrec->max_sg_cnt = template->max_sgl_segments; + + ret = nvmet_fc_alloc_ls_iodlist(newrec); + if (ret) { +@@ -1717,6 +1717,7 @@ nvmet_fc_alloc_tgt_pgs(struct nvmet_fc_fcp_iod *fod) + ((fod->io_dir == NVMET_FCP_WRITE) ? + DMA_FROM_DEVICE : DMA_TO_DEVICE)); + /* note: write from initiator perspective */ ++ fod->next_sg = fod->data_sg; + + return 0; + +@@ -1874,24 +1875,49 @@ nvmet_fc_transfer_fcp_data(struct nvmet_fc_tgtport *tgtport, + struct nvmet_fc_fcp_iod *fod, u8 op) + { + struct nvmefc_tgt_fcp_req *fcpreq = fod->fcpreq; ++ struct scatterlist *sg = fod->next_sg; + unsigned long flags; +- u32 tlen; ++ u32 remaininglen = fod->total_length - fod->offset; ++ u32 tlen = 0; + int ret; + + fcpreq->op = op; + fcpreq->offset = fod->offset; + fcpreq->timeout = NVME_FC_TGTOP_TIMEOUT_SEC; + +- tlen = min_t(u32, tgtport->max_sg_cnt * PAGE_SIZE, +- (fod->total_length - fod->offset)); ++ /* ++ * for next sequence: ++ * break at a sg element boundary ++ * attempt to keep sequence length capped at ++ * NVMET_FC_MAX_SEQ_LENGTH but allow sequence to ++ * be longer if a single sg element is larger ++ * than that amount. This is done to avoid creating ++ * a new sg list to use for the tgtport api. ++ */ ++ fcpreq->sg = sg; ++ fcpreq->sg_cnt = 0; ++ while (tlen < remaininglen && ++ fcpreq->sg_cnt < tgtport->max_sg_cnt && ++ tlen + sg_dma_len(sg) < NVMET_FC_MAX_SEQ_LENGTH) { ++ fcpreq->sg_cnt++; ++ tlen += sg_dma_len(sg); ++ sg = sg_next(sg); ++ } ++ if (tlen < remaininglen && fcpreq->sg_cnt == 0) { ++ fcpreq->sg_cnt++; ++ tlen += min_t(u32, sg_dma_len(sg), remaininglen); ++ sg = sg_next(sg); ++ } ++ if (tlen < remaininglen) ++ fod->next_sg = sg; ++ else ++ fod->next_sg = NULL; ++ + fcpreq->transfer_length = tlen; + fcpreq->transferred_length = 0; + fcpreq->fcp_error = 0; + fcpreq->rsplen = 0; + +- fcpreq->sg = &fod->data_sg[fod->offset / PAGE_SIZE]; +- fcpreq->sg_cnt = DIV_ROUND_UP(tlen, PAGE_SIZE); +- + /* + * If the last READDATA request: check if LLDD supports + * combined xfr with response. +diff --git a/drivers/pci/pci-acpi.c b/drivers/pci/pci-acpi.c +index a8da543b3814..4708eb9df71b 100644 +--- a/drivers/pci/pci-acpi.c ++++ b/drivers/pci/pci-acpi.c +@@ -624,7 +624,7 @@ void acpi_pci_add_bus(struct pci_bus *bus) + union acpi_object *obj; + struct pci_host_bridge *bridge; + +- if (acpi_pci_disabled || !bus->bridge) ++ if (acpi_pci_disabled || !bus->bridge || !ACPI_HANDLE(bus->bridge)) + return; + + acpi_pci_slot_enumerate(bus); +diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c +index 9ce28c4f9812..b09d29931393 100644 +--- a/drivers/scsi/qla2xxx/qla_attr.c ++++ b/drivers/scsi/qla2xxx/qla_attr.c +@@ -2142,6 +2142,7 @@ qla24xx_vport_delete(struct fc_vport *fc_vport) + msleep(1000); + + qla24xx_disable_vp(vha); ++ qla2x00_wait_for_sess_deletion(vha); + + vha->flags.delete_progress = 1; + +diff --git a/drivers/scsi/qla2xxx/qla_gbl.h b/drivers/scsi/qla2xxx/qla_gbl.h +index f852ca60c49f..89706341514e 100644 +--- a/drivers/scsi/qla2xxx/qla_gbl.h ++++ b/drivers/scsi/qla2xxx/qla_gbl.h +@@ -200,6 +200,7 @@ void qla2x00_handle_login_done_event(struct scsi_qla_host *, fc_port_t *, + uint16_t *); + int qla24xx_post_gnl_work(struct scsi_qla_host *, fc_port_t *); + int qla24xx_async_abort_cmd(srb_t *); ++void qla2x00_wait_for_sess_deletion(scsi_qla_host_t *); + + /* + * Global Functions in qla_mid.c source file. +diff --git a/drivers/scsi/qla2xxx/qla_gs.c b/drivers/scsi/qla2xxx/qla_gs.c +index 59ecc4eda6cd..2a19ec0660cb 100644 +--- a/drivers/scsi/qla2xxx/qla_gs.c ++++ b/drivers/scsi/qla2xxx/qla_gs.c +@@ -3368,6 +3368,10 @@ int qla24xx_async_gpnid(scsi_qla_host_t *vha, port_id_t *id) + return rval; + + done_free_sp: ++ spin_lock_irqsave(&vha->hw->vport_slock, flags); ++ list_del(&sp->elem); ++ spin_unlock_irqrestore(&vha->hw->vport_slock, flags); ++ + if (sp->u.iocb_cmd.u.ctarg.req) { + dma_free_coherent(&vha->hw->pdev->dev, + sizeof(struct ct_sns_pkt), +diff --git a/drivers/scsi/qla2xxx/qla_init.c b/drivers/scsi/qla2xxx/qla_init.c +index bcde6130f121..1d42d38f5a45 100644 +--- a/drivers/scsi/qla2xxx/qla_init.c ++++ b/drivers/scsi/qla2xxx/qla_init.c +@@ -1326,11 +1326,10 @@ qla2x00_async_tm_cmd(fc_port_t *fcport, uint32_t flags, uint32_t lun, + + wait_for_completion(&tm_iocb->u.tmf.comp); + +- rval = tm_iocb->u.tmf.comp_status == CS_COMPLETE ? +- QLA_SUCCESS : QLA_FUNCTION_FAILED; ++ rval = tm_iocb->u.tmf.data; + +- if ((rval != QLA_SUCCESS) || tm_iocb->u.tmf.data) { +- ql_dbg(ql_dbg_taskm, vha, 0x8030, ++ if (rval != QLA_SUCCESS) { ++ ql_log(ql_log_warn, vha, 0x8030, + "TM IOCB failed (%x).\n", rval); + } + +diff --git a/drivers/scsi/qla2xxx/qla_inline.h b/drivers/scsi/qla2xxx/qla_inline.h +index 9a2c86eacf44..3f5a0f0f8b62 100644 +--- a/drivers/scsi/qla2xxx/qla_inline.h ++++ b/drivers/scsi/qla2xxx/qla_inline.h +@@ -221,6 +221,8 @@ qla2xxx_get_qpair_sp(struct qla_qpair *qpair, fc_port_t *fcport, gfp_t flag) + sp->fcport = fcport; + sp->iocbs = 1; + sp->vha = qpair->vha; ++ INIT_LIST_HEAD(&sp->elem); ++ + done: + if (!sp) + QLA_QPAIR_MARK_NOT_BUSY(qpair); +diff --git a/drivers/scsi/qla2xxx/qla_mid.c b/drivers/scsi/qla2xxx/qla_mid.c +index d77dde89118e..375a88e18afe 100644 +--- a/drivers/scsi/qla2xxx/qla_mid.c ++++ b/drivers/scsi/qla2xxx/qla_mid.c +@@ -152,10 +152,15 @@ qla24xx_disable_vp(scsi_qla_host_t *vha) + { + unsigned long flags; + int ret; ++ fc_port_t *fcport; + + ret = qla24xx_control_vp(vha, VCE_COMMAND_DISABLE_VPS_LOGO_ALL); + atomic_set(&vha->loop_state, LOOP_DOWN); + atomic_set(&vha->loop_down_timer, LOOP_DOWN_TIME); ++ list_for_each_entry(fcport, &vha->vp_fcports, list) ++ fcport->logout_on_delete = 0; ++ ++ qla2x00_mark_all_devices_lost(vha, 0); + + /* Remove port id from vp target map */ + spin_lock_irqsave(&vha->hw->vport_slock, flags); +diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c +index 1be76695e692..7d7fb5bbb600 100644 +--- a/drivers/scsi/qla2xxx/qla_os.c ++++ b/drivers/scsi/qla2xxx/qla_os.c +@@ -1136,7 +1136,7 @@ static inline int test_fcport_count(scsi_qla_host_t *vha) + * qla2x00_wait_for_sess_deletion can only be called from remove_one. + * it has dependency on UNLOADING flag to stop device discovery + */ +-static void ++void + qla2x00_wait_for_sess_deletion(scsi_qla_host_t *vha) + { + qla2x00_mark_all_devices_lost(vha, 0); +@@ -5794,8 +5794,9 @@ qla2x00_do_dpc(void *data) + set_bit(ISP_ABORT_NEEDED, &base_vha->dpc_flags); + } + +- if (test_and_clear_bit(ISP_ABORT_NEEDED, +- &base_vha->dpc_flags)) { ++ if (test_and_clear_bit ++ (ISP_ABORT_NEEDED, &base_vha->dpc_flags) && ++ !test_bit(UNLOADING, &base_vha->dpc_flags)) { + + ql_dbg(ql_dbg_dpc, base_vha, 0x4007, + "ISP abort scheduled.\n"); +diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c +index 7fa50e12f18e..5b62e06567a3 100644 +--- a/fs/btrfs/extent_io.c ++++ b/fs/btrfs/extent_io.c +@@ -4280,6 +4280,7 @@ int try_release_extent_mapping(struct extent_map_tree *map, + struct extent_map *em; + u64 start = page_offset(page); + u64 end = start + PAGE_SIZE - 1; ++ struct btrfs_inode *btrfs_inode = BTRFS_I(page->mapping->host); + + if (gfpflags_allow_blocking(mask) && + page->mapping->host->i_size > SZ_16M) { +@@ -4302,6 +4303,8 @@ int try_release_extent_mapping(struct extent_map_tree *map, + extent_map_end(em) - 1, + EXTENT_LOCKED | EXTENT_WRITEBACK, + 0, NULL)) { ++ set_bit(BTRFS_INODE_NEEDS_FULL_SYNC, ++ &btrfs_inode->runtime_flags); + remove_extent_mapping(map, em); + /* once for the rb tree */ + free_extent_map(em); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 6b0c1ea95196..f30d2bf40471 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2301,7 +2301,7 @@ static int ext4_check_descriptors(struct super_block *sb, + struct ext4_sb_info *sbi = EXT4_SB(sb); + ext4_fsblk_t first_block = le32_to_cpu(sbi->s_es->s_first_data_block); + ext4_fsblk_t last_block; +- ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0) + 1; ++ ext4_fsblk_t last_bg_block = sb_block + ext4_bg_num_gdb(sb, 0); + ext4_fsblk_t block_bitmap; + ext4_fsblk_t inode_bitmap; + ext4_fsblk_t inode_table; +@@ -4038,13 +4038,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + goto failed_mount2; + } + } ++ sbi->s_gdb_count = db_count; + if (!ext4_check_descriptors(sb, logical_sb_block, &first_not_zeroed)) { + ext4_msg(sb, KERN_ERR, "group descriptors corrupted!"); + ret = -EFSCORRUPTED; + goto failed_mount2; + } + +- sbi->s_gdb_count = db_count; + get_random_bytes(&sbi->s_next_generation, sizeof(u32)); + spin_lock_init(&sbi->s_next_gen_lock); + +diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c +index c60f3d32ee91..a6797986b625 100644 +--- a/fs/jfs/xattr.c ++++ b/fs/jfs/xattr.c +@@ -491,15 +491,17 @@ static int ea_get(struct inode *inode, struct ea_buffer *ea_buf, int min_size) + if (size > PSIZE) { + /* + * To keep the rest of the code simple. Allocate a +- * contiguous buffer to work with ++ * contiguous buffer to work with. Make the buffer large ++ * enough to make use of the whole extent. + */ +- ea_buf->xattr = kmalloc(size, GFP_KERNEL); ++ ea_buf->max_size = (size + sb->s_blocksize - 1) & ++ ~(sb->s_blocksize - 1); ++ ++ ea_buf->xattr = kmalloc(ea_buf->max_size, GFP_KERNEL); + if (ea_buf->xattr == NULL) + return -ENOMEM; + + ea_buf->flag = EA_MALLOC; +- ea_buf->max_size = (size + sb->s_blocksize - 1) & +- ~(sb->s_blocksize - 1); + + if (ea_size == 0) + return 0; +diff --git a/fs/xfs/libxfs/xfs_attr_leaf.c b/fs/xfs/libxfs/xfs_attr_leaf.c +index 5c16db86b38f..40e53a4fc0a6 100644 +--- a/fs/xfs/libxfs/xfs_attr_leaf.c ++++ b/fs/xfs/libxfs/xfs_attr_leaf.c +@@ -785,9 +785,8 @@ xfs_attr_shortform_to_leaf(xfs_da_args_t *args) + ASSERT(blkno == 0); + error = xfs_attr3_leaf_create(args, blkno, &bp); + if (error) { +- error = xfs_da_shrink_inode(args, 0, bp); +- bp = NULL; +- if (error) ++ /* xfs_attr3_leaf_create may not have instantiated a block */ ++ if (bp && (xfs_da_shrink_inode(args, 0, bp) != 0)) + goto out; + xfs_idata_realloc(dp, size, XFS_ATTR_FORK); /* try to put */ + memcpy(ifp->if_u1.if_data, tmpbuffer, size); /* it back */ +diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c +index 43005fbe8b1e..544b5211221c 100644 +--- a/fs/xfs/xfs_icache.c ++++ b/fs/xfs/xfs_icache.c +@@ -305,6 +305,46 @@ xfs_reinit_inode( + return error; + } + ++/* ++ * If we are allocating a new inode, then check what was returned is ++ * actually a free, empty inode. If we are not allocating an inode, ++ * then check we didn't find a free inode. ++ * ++ * Returns: ++ * 0 if the inode free state matches the lookup context ++ * -ENOENT if the inode is free and we are not allocating ++ * -EFSCORRUPTED if there is any state mismatch at all ++ */ ++static int ++xfs_iget_check_free_state( ++ struct xfs_inode *ip, ++ int flags) ++{ ++ if (flags & XFS_IGET_CREATE) { ++ /* should be a free inode */ ++ if (VFS_I(ip)->i_mode != 0) { ++ xfs_warn(ip->i_mount, ++"Corruption detected! Free inode 0x%llx not marked free! (mode 0x%x)", ++ ip->i_ino, VFS_I(ip)->i_mode); ++ return -EFSCORRUPTED; ++ } ++ ++ if (ip->i_d.di_nblocks != 0) { ++ xfs_warn(ip->i_mount, ++"Corruption detected! Free inode 0x%llx has blocks allocated!", ++ ip->i_ino); ++ return -EFSCORRUPTED; ++ } ++ return 0; ++ } ++ ++ /* should be an allocated inode */ ++ if (VFS_I(ip)->i_mode == 0) ++ return -ENOENT; ++ ++ return 0; ++} ++ + /* + * Check the validity of the inode we just found it the cache + */ +@@ -354,12 +394,12 @@ xfs_iget_cache_hit( + } + + /* +- * If lookup is racing with unlink return an error immediately. ++ * Check the inode free state is valid. This also detects lookup ++ * racing with unlinks. + */ +- if (VFS_I(ip)->i_mode == 0 && !(flags & XFS_IGET_CREATE)) { +- error = -ENOENT; ++ error = xfs_iget_check_free_state(ip, flags); ++ if (error) + goto out_error; +- } + + /* + * If IRECLAIMABLE is set, we've torn down the VFS inode already. +@@ -475,10 +515,14 @@ xfs_iget_cache_miss( + + trace_xfs_iget_miss(ip); + +- if ((VFS_I(ip)->i_mode == 0) && !(flags & XFS_IGET_CREATE)) { +- error = -ENOENT; ++ ++ /* ++ * Check the inode free state is valid. This also detects lookup ++ * racing with unlinks. ++ */ ++ error = xfs_iget_check_free_state(ip, flags); ++ if (error) + goto out_destroy; +- } + + /* + * Preload the radix tree so we can insert safely under the +diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h +index 289e4d54e3e0..5caa062a02b2 100644 +--- a/include/linux/ring_buffer.h ++++ b/include/linux/ring_buffer.h +@@ -160,6 +160,7 @@ void ring_buffer_record_enable(struct ring_buffer *buffer); + void ring_buffer_record_off(struct ring_buffer *buffer); + void ring_buffer_record_on(struct ring_buffer *buffer); + int ring_buffer_record_is_on(struct ring_buffer *buffer); ++int ring_buffer_record_is_set_on(struct ring_buffer *buffer); + void ring_buffer_record_disable_cpu(struct ring_buffer *buffer, int cpu); + void ring_buffer_record_enable_cpu(struct ring_buffer *buffer, int cpu); + +diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c +index b02caa442776..069311541577 100644 +--- a/kernel/irq/manage.c ++++ b/kernel/irq/manage.c +@@ -1030,6 +1030,13 @@ static int irq_setup_forced_threading(struct irqaction *new) + if (new->flags & (IRQF_NO_THREAD | IRQF_PERCPU | IRQF_ONESHOT)) + return 0; + ++ /* ++ * No further action required for interrupts which are requested as ++ * threaded interrupts already ++ */ ++ if (new->handler == irq_default_primary_handler) ++ return 0; ++ + new->flags |= IRQF_ONESHOT; + + /* +@@ -1037,7 +1044,7 @@ static int irq_setup_forced_threading(struct irqaction *new) + * thread handler. We force thread them as well by creating a + * secondary action. + */ +- if (new->handler != irq_default_primary_handler && new->thread_fn) { ++ if (new->handler && new->thread_fn) { + /* Allocate the secondary action */ + new->secondary = kzalloc(sizeof(struct irqaction), GFP_KERNEL); + if (!new->secondary) +diff --git a/kernel/softirq.c b/kernel/softirq.c +index e89c3b0cff6d..f40ac7191257 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -382,7 +382,7 @@ static inline void tick_irq_exit(void) + + /* Make sure that timer wheel updates are propagated */ + if ((idle_cpu(cpu) && !need_resched()) || tick_nohz_full_cpu(cpu)) { +- if (!in_interrupt()) ++ if (!in_irq()) + tick_nohz_irq_exit(); + } + #endif +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index bb2af74e6b62..ea3c062e7e1c 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -676,7 +676,7 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now) + + static inline bool local_timer_softirq_pending(void) + { +- return local_softirq_pending() & TIMER_SOFTIRQ; ++ return local_softirq_pending() & BIT(TIMER_SOFTIRQ); + } + + static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 36f018b15392..fd7809004297 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -3109,6 +3109,22 @@ int ring_buffer_record_is_on(struct ring_buffer *buffer) + return !atomic_read(&buffer->record_disabled); + } + ++/** ++ * ring_buffer_record_is_set_on - return true if the ring buffer is set writable ++ * @buffer: The ring buffer to see if write is set enabled ++ * ++ * Returns true if the ring buffer is set writable by ring_buffer_record_on(). ++ * Note that this does NOT mean it is in a writable state. ++ * ++ * It may return true when the ring buffer has been disabled by ++ * ring_buffer_record_disable(), as that is a temporary disabling of ++ * the ring buffer. ++ */ ++int ring_buffer_record_is_set_on(struct ring_buffer *buffer) ++{ ++ return !(atomic_read(&buffer->record_disabled) & RB_BUFFER_OFF); ++} ++ + /** + * ring_buffer_record_disable_cpu - stop all writes into the cpu_buffer + * @buffer: The ring buffer to stop writes to. +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index e268750bd4ad..20919489883f 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1366,6 +1366,12 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu) + + arch_spin_lock(&tr->max_lock); + ++ /* Inherit the recordable setting from trace_buffer */ ++ if (ring_buffer_record_is_set_on(tr->trace_buffer.buffer)) ++ ring_buffer_record_on(tr->max_buffer.buffer); ++ else ++ ring_buffer_record_off(tr->max_buffer.buffer); ++ + buf = tr->trace_buffer.buffer; + tr->trace_buffer.buffer = tr->max_buffer.buffer; + tr->max_buffer.buffer = buf; +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 68c9d1833b95..c67abda5d639 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -981,8 +981,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + + if (nlk->ngroups == 0) + groups = 0; +- else +- groups &= (1ULL << nlk->ngroups) - 1; ++ else if (nlk->ngroups < 8*sizeof(groups)) ++ groups &= (1UL << nlk->ngroups) - 1; + + bound = nlk->bound; + if (bound) { diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.62-63.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.62-63.patch new file mode 100644 index 000000000000..cff73c55b5e1 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.62-63.patch @@ -0,0 +1,5609 @@ +diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu +index 8355e79350b7..6cae60929cb6 100644 +--- a/Documentation/ABI/testing/sysfs-devices-system-cpu ++++ b/Documentation/ABI/testing/sysfs-devices-system-cpu +@@ -379,6 +379,7 @@ What: /sys/devices/system/cpu/vulnerabilities + /sys/devices/system/cpu/vulnerabilities/spectre_v1 + /sys/devices/system/cpu/vulnerabilities/spectre_v2 + /sys/devices/system/cpu/vulnerabilities/spec_store_bypass ++ /sys/devices/system/cpu/vulnerabilities/l1tf + Date: January 2018 + Contact: Linux kernel mailing list + Description: Information about CPU vulnerabilities +@@ -390,3 +391,26 @@ Description: Information about CPU vulnerabilities + "Not affected" CPU is not affected by the vulnerability + "Vulnerable" CPU is affected and no mitigation in effect + "Mitigation: $M" CPU is affected and mitigation $M is in effect ++ ++ Details about the l1tf file can be found in ++ Documentation/admin-guide/l1tf.rst ++ ++What: /sys/devices/system/cpu/smt ++ /sys/devices/system/cpu/smt/active ++ /sys/devices/system/cpu/smt/control ++Date: June 2018 ++Contact: Linux kernel mailing list ++Description: Control Symetric Multi Threading (SMT) ++ ++ active: Tells whether SMT is active (enabled and siblings online) ++ ++ control: Read/write interface to control SMT. Possible ++ values: ++ ++ "on" SMT is enabled ++ "off" SMT is disabled ++ "forceoff" SMT is force disabled. Cannot be changed. ++ "notsupported" SMT is not supported by the CPU ++ ++ If control status is "forceoff" or "notsupported" writes ++ are rejected. +diff --git a/Documentation/admin-guide/index.rst b/Documentation/admin-guide/index.rst +index 5bb9161dbe6a..78f8f00c369f 100644 +--- a/Documentation/admin-guide/index.rst ++++ b/Documentation/admin-guide/index.rst +@@ -17,6 +17,15 @@ etc. + kernel-parameters + devices + ++This section describes CPU vulnerabilities and provides an overview of the ++possible mitigations along with guidance for selecting mitigations if they ++are configurable at compile, boot or run time. ++ ++.. toctree:: ++ :maxdepth: 1 ++ ++ l1tf ++ + Here is a set of documents aimed at users who are trying to track down + problems and bugs in particular. + +diff --git a/Documentation/admin-guide/kernel-parameters.txt b/Documentation/admin-guide/kernel-parameters.txt +index d6d7669e667f..9841bad6f271 100644 +--- a/Documentation/admin-guide/kernel-parameters.txt ++++ b/Documentation/admin-guide/kernel-parameters.txt +@@ -1888,10 +1888,84 @@ + (virtualized real and unpaged mode) on capable + Intel chips. Default is 1 (enabled) + ++ kvm-intel.vmentry_l1d_flush=[KVM,Intel] Mitigation for L1 Terminal Fault ++ CVE-2018-3620. ++ ++ Valid arguments: never, cond, always ++ ++ always: L1D cache flush on every VMENTER. ++ cond: Flush L1D on VMENTER only when the code between ++ VMEXIT and VMENTER can leak host memory. ++ never: Disables the mitigation ++ ++ Default is cond (do L1 cache flush in specific instances) ++ + kvm-intel.vpid= [KVM,Intel] Disable Virtual Processor Identification + feature (tagged TLBs) on capable Intel chips. + Default is 1 (enabled) + ++ l1tf= [X86] Control mitigation of the L1TF vulnerability on ++ affected CPUs ++ ++ The kernel PTE inversion protection is unconditionally ++ enabled and cannot be disabled. ++ ++ full ++ Provides all available mitigations for the ++ L1TF vulnerability. Disables SMT and ++ enables all mitigations in the ++ hypervisors, i.e. unconditional L1D flush. ++ ++ SMT control and L1D flush control via the ++ sysfs interface is still possible after ++ boot. Hypervisors will issue a warning ++ when the first VM is started in a ++ potentially insecure configuration, ++ i.e. SMT enabled or L1D flush disabled. ++ ++ full,force ++ Same as 'full', but disables SMT and L1D ++ flush runtime control. Implies the ++ 'nosmt=force' command line option. ++ (i.e. sysfs control of SMT is disabled.) ++ ++ flush ++ Leaves SMT enabled and enables the default ++ hypervisor mitigation, i.e. conditional ++ L1D flush. ++ ++ SMT control and L1D flush control via the ++ sysfs interface is still possible after ++ boot. Hypervisors will issue a warning ++ when the first VM is started in a ++ potentially insecure configuration, ++ i.e. SMT enabled or L1D flush disabled. ++ ++ flush,nosmt ++ ++ Disables SMT and enables the default ++ hypervisor mitigation. ++ ++ SMT control and L1D flush control via the ++ sysfs interface is still possible after ++ boot. Hypervisors will issue a warning ++ when the first VM is started in a ++ potentially insecure configuration, ++ i.e. SMT enabled or L1D flush disabled. ++ ++ flush,nowarn ++ Same as 'flush', but hypervisors will not ++ warn when a VM is started in a potentially ++ insecure configuration. ++ ++ off ++ Disables hypervisor mitigations and doesn't ++ emit any warnings. ++ ++ Default is 'flush'. ++ ++ For details see: Documentation/admin-guide/l1tf.rst ++ + l2cr= [PPC] + + l3cr= [PPC] +@@ -2595,6 +2669,10 @@ + nosmt [KNL,S390] Disable symmetric multithreading (SMT). + Equivalent to smt=1. + ++ [KNL,x86] Disable symmetric multithreading (SMT). ++ nosmt=force: Force disable SMT, cannot be undone ++ via the sysfs control file. ++ + nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2 + (indirect branch prediction) vulnerability. System may + allow data leaks with this option, which is equivalent +diff --git a/Documentation/admin-guide/l1tf.rst b/Documentation/admin-guide/l1tf.rst +new file mode 100644 +index 000000000000..bae52b845de0 +--- /dev/null ++++ b/Documentation/admin-guide/l1tf.rst +@@ -0,0 +1,610 @@ ++L1TF - L1 Terminal Fault ++======================== ++ ++L1 Terminal Fault is a hardware vulnerability which allows unprivileged ++speculative access to data which is available in the Level 1 Data Cache ++when the page table entry controlling the virtual address, which is used ++for the access, has the Present bit cleared or other reserved bits set. ++ ++Affected processors ++------------------- ++ ++This vulnerability affects a wide range of Intel processors. The ++vulnerability is not present on: ++ ++ - Processors from AMD, Centaur and other non Intel vendors ++ ++ - Older processor models, where the CPU family is < 6 ++ ++ - A range of Intel ATOM processors (Cedarview, Cloverview, Lincroft, ++ Penwell, Pineview, Silvermont, Airmont, Merrifield) ++ ++ - The Intel XEON PHI family ++ ++ - Intel processors which have the ARCH_CAP_RDCL_NO bit set in the ++ IA32_ARCH_CAPABILITIES MSR. If the bit is set the CPU is not affected ++ by the Meltdown vulnerability either. These CPUs should become ++ available by end of 2018. ++ ++Whether a processor is affected or not can be read out from the L1TF ++vulnerability file in sysfs. See :ref:`l1tf_sys_info`. ++ ++Related CVEs ++------------ ++ ++The following CVE entries are related to the L1TF vulnerability: ++ ++ ============= ================= ============================== ++ CVE-2018-3615 L1 Terminal Fault SGX related aspects ++ CVE-2018-3620 L1 Terminal Fault OS, SMM related aspects ++ CVE-2018-3646 L1 Terminal Fault Virtualization related aspects ++ ============= ================= ============================== ++ ++Problem ++------- ++ ++If an instruction accesses a virtual address for which the relevant page ++table entry (PTE) has the Present bit cleared or other reserved bits set, ++then speculative execution ignores the invalid PTE and loads the referenced ++data if it is present in the Level 1 Data Cache, as if the page referenced ++by the address bits in the PTE was still present and accessible. ++ ++While this is a purely speculative mechanism and the instruction will raise ++a page fault when it is retired eventually, the pure act of loading the ++data and making it available to other speculative instructions opens up the ++opportunity for side channel attacks to unprivileged malicious code, ++similar to the Meltdown attack. ++ ++While Meltdown breaks the user space to kernel space protection, L1TF ++allows to attack any physical memory address in the system and the attack ++works across all protection domains. It allows an attack of SGX and also ++works from inside virtual machines because the speculation bypasses the ++extended page table (EPT) protection mechanism. ++ ++ ++Attack scenarios ++---------------- ++ ++1. Malicious user space ++^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ Operating Systems store arbitrary information in the address bits of a ++ PTE which is marked non present. This allows a malicious user space ++ application to attack the physical memory to which these PTEs resolve. ++ In some cases user-space can maliciously influence the information ++ encoded in the address bits of the PTE, thus making attacks more ++ deterministic and more practical. ++ ++ The Linux kernel contains a mitigation for this attack vector, PTE ++ inversion, which is permanently enabled and has no performance ++ impact. The kernel ensures that the address bits of PTEs, which are not ++ marked present, never point to cacheable physical memory space. ++ ++ A system with an up to date kernel is protected against attacks from ++ malicious user space applications. ++ ++2. Malicious guest in a virtual machine ++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ The fact that L1TF breaks all domain protections allows malicious guest ++ OSes, which can control the PTEs directly, and malicious guest user ++ space applications, which run on an unprotected guest kernel lacking the ++ PTE inversion mitigation for L1TF, to attack physical host memory. ++ ++ A special aspect of L1TF in the context of virtualization is symmetric ++ multi threading (SMT). The Intel implementation of SMT is called ++ HyperThreading. The fact that Hyperthreads on the affected processors ++ share the L1 Data Cache (L1D) is important for this. As the flaw allows ++ only to attack data which is present in L1D, a malicious guest running ++ on one Hyperthread can attack the data which is brought into the L1D by ++ the context which runs on the sibling Hyperthread of the same physical ++ core. This context can be host OS, host user space or a different guest. ++ ++ If the processor does not support Extended Page Tables, the attack is ++ only possible, when the hypervisor does not sanitize the content of the ++ effective (shadow) page tables. ++ ++ While solutions exist to mitigate these attack vectors fully, these ++ mitigations are not enabled by default in the Linux kernel because they ++ can affect performance significantly. The kernel provides several ++ mechanisms which can be utilized to address the problem depending on the ++ deployment scenario. The mitigations, their protection scope and impact ++ are described in the next sections. ++ ++ The default mitigations and the rationale for choosing them are explained ++ at the end of this document. See :ref:`default_mitigations`. ++ ++.. _l1tf_sys_info: ++ ++L1TF system information ++----------------------- ++ ++The Linux kernel provides a sysfs interface to enumerate the current L1TF ++status of the system: whether the system is vulnerable, and which ++mitigations are active. The relevant sysfs file is: ++ ++/sys/devices/system/cpu/vulnerabilities/l1tf ++ ++The possible values in this file are: ++ ++ =========================== =============================== ++ 'Not affected' The processor is not vulnerable ++ 'Mitigation: PTE Inversion' The host protection is active ++ =========================== =============================== ++ ++If KVM/VMX is enabled and the processor is vulnerable then the following ++information is appended to the 'Mitigation: PTE Inversion' part: ++ ++ - SMT status: ++ ++ ===================== ================ ++ 'VMX: SMT vulnerable' SMT is enabled ++ 'VMX: SMT disabled' SMT is disabled ++ ===================== ================ ++ ++ - L1D Flush mode: ++ ++ ================================ ==================================== ++ 'L1D vulnerable' L1D flushing is disabled ++ ++ 'L1D conditional cache flushes' L1D flush is conditionally enabled ++ ++ 'L1D cache flushes' L1D flush is unconditionally enabled ++ ================================ ==================================== ++ ++The resulting grade of protection is discussed in the following sections. ++ ++ ++Host mitigation mechanism ++------------------------- ++ ++The kernel is unconditionally protected against L1TF attacks from malicious ++user space running on the host. ++ ++ ++Guest mitigation mechanisms ++--------------------------- ++ ++.. _l1d_flush: ++ ++1. L1D flush on VMENTER ++^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ To make sure that a guest cannot attack data which is present in the L1D ++ the hypervisor flushes the L1D before entering the guest. ++ ++ Flushing the L1D evicts not only the data which should not be accessed ++ by a potentially malicious guest, it also flushes the guest ++ data. Flushing the L1D has a performance impact as the processor has to ++ bring the flushed guest data back into the L1D. Depending on the ++ frequency of VMEXIT/VMENTER and the type of computations in the guest ++ performance degradation in the range of 1% to 50% has been observed. For ++ scenarios where guest VMEXIT/VMENTER are rare the performance impact is ++ minimal. Virtio and mechanisms like posted interrupts are designed to ++ confine the VMEXITs to a bare minimum, but specific configurations and ++ application scenarios might still suffer from a high VMEXIT rate. ++ ++ The kernel provides two L1D flush modes: ++ - conditional ('cond') ++ - unconditional ('always') ++ ++ The conditional mode avoids L1D flushing after VMEXITs which execute ++ only audited code paths before the corresponding VMENTER. These code ++ paths have been verified that they cannot expose secrets or other ++ interesting data to an attacker, but they can leak information about the ++ address space layout of the hypervisor. ++ ++ Unconditional mode flushes L1D on all VMENTER invocations and provides ++ maximum protection. It has a higher overhead than the conditional ++ mode. The overhead cannot be quantified correctly as it depends on the ++ workload scenario and the resulting number of VMEXITs. ++ ++ The general recommendation is to enable L1D flush on VMENTER. The kernel ++ defaults to conditional mode on affected processors. ++ ++ **Note**, that L1D flush does not prevent the SMT problem because the ++ sibling thread will also bring back its data into the L1D which makes it ++ attackable again. ++ ++ L1D flush can be controlled by the administrator via the kernel command ++ line and sysfs control files. See :ref:`mitigation_control_command_line` ++ and :ref:`mitigation_control_kvm`. ++ ++.. _guest_confinement: ++ ++2. Guest VCPU confinement to dedicated physical cores ++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ To address the SMT problem, it is possible to make a guest or a group of ++ guests affine to one or more physical cores. The proper mechanism for ++ that is to utilize exclusive cpusets to ensure that no other guest or ++ host tasks can run on these cores. ++ ++ If only a single guest or related guests run on sibling SMT threads on ++ the same physical core then they can only attack their own memory and ++ restricted parts of the host memory. ++ ++ Host memory is attackable, when one of the sibling SMT threads runs in ++ host OS (hypervisor) context and the other in guest context. The amount ++ of valuable information from the host OS context depends on the context ++ which the host OS executes, i.e. interrupts, soft interrupts and kernel ++ threads. The amount of valuable data from these contexts cannot be ++ declared as non-interesting for an attacker without deep inspection of ++ the code. ++ ++ **Note**, that assigning guests to a fixed set of physical cores affects ++ the ability of the scheduler to do load balancing and might have ++ negative effects on CPU utilization depending on the hosting ++ scenario. Disabling SMT might be a viable alternative for particular ++ scenarios. ++ ++ For further information about confining guests to a single or to a group ++ of cores consult the cpusets documentation: ++ ++ https://www.kernel.org/doc/Documentation/cgroup-v1/cpusets.txt ++ ++.. _interrupt_isolation: ++ ++3. Interrupt affinity ++^^^^^^^^^^^^^^^^^^^^^ ++ ++ Interrupts can be made affine to logical CPUs. This is not universally ++ true because there are types of interrupts which are truly per CPU ++ interrupts, e.g. the local timer interrupt. Aside of that multi queue ++ devices affine their interrupts to single CPUs or groups of CPUs per ++ queue without allowing the administrator to control the affinities. ++ ++ Moving the interrupts, which can be affinity controlled, away from CPUs ++ which run untrusted guests, reduces the attack vector space. ++ ++ Whether the interrupts with are affine to CPUs, which run untrusted ++ guests, provide interesting data for an attacker depends on the system ++ configuration and the scenarios which run on the system. While for some ++ of the interrupts it can be assumed that they won't expose interesting ++ information beyond exposing hints about the host OS memory layout, there ++ is no way to make general assumptions. ++ ++ Interrupt affinity can be controlled by the administrator via the ++ /proc/irq/$NR/smp_affinity[_list] files. Limited documentation is ++ available at: ++ ++ https://www.kernel.org/doc/Documentation/IRQ-affinity.txt ++ ++.. _smt_control: ++ ++4. SMT control ++^^^^^^^^^^^^^^ ++ ++ To prevent the SMT issues of L1TF it might be necessary to disable SMT ++ completely. Disabling SMT can have a significant performance impact, but ++ the impact depends on the hosting scenario and the type of workloads. ++ The impact of disabling SMT needs also to be weighted against the impact ++ of other mitigation solutions like confining guests to dedicated cores. ++ ++ The kernel provides a sysfs interface to retrieve the status of SMT and ++ to control it. It also provides a kernel command line interface to ++ control SMT. ++ ++ The kernel command line interface consists of the following options: ++ ++ =========== ========================================================== ++ nosmt Affects the bring up of the secondary CPUs during boot. The ++ kernel tries to bring all present CPUs online during the ++ boot process. "nosmt" makes sure that from each physical ++ core only one - the so called primary (hyper) thread is ++ activated. Due to a design flaw of Intel processors related ++ to Machine Check Exceptions the non primary siblings have ++ to be brought up at least partially and are then shut down ++ again. "nosmt" can be undone via the sysfs interface. ++ ++ nosmt=force Has the same effect as "nosmt" but it does not allow to ++ undo the SMT disable via the sysfs interface. ++ =========== ========================================================== ++ ++ The sysfs interface provides two files: ++ ++ - /sys/devices/system/cpu/smt/control ++ - /sys/devices/system/cpu/smt/active ++ ++ /sys/devices/system/cpu/smt/control: ++ ++ This file allows to read out the SMT control state and provides the ++ ability to disable or (re)enable SMT. The possible states are: ++ ++ ============== =================================================== ++ on SMT is supported by the CPU and enabled. All ++ logical CPUs can be onlined and offlined without ++ restrictions. ++ ++ off SMT is supported by the CPU and disabled. Only ++ the so called primary SMT threads can be onlined ++ and offlined without restrictions. An attempt to ++ online a non-primary sibling is rejected ++ ++ forceoff Same as 'off' but the state cannot be controlled. ++ Attempts to write to the control file are rejected. ++ ++ notsupported The processor does not support SMT. It's therefore ++ not affected by the SMT implications of L1TF. ++ Attempts to write to the control file are rejected. ++ ============== =================================================== ++ ++ The possible states which can be written into this file to control SMT ++ state are: ++ ++ - on ++ - off ++ - forceoff ++ ++ /sys/devices/system/cpu/smt/active: ++ ++ This file reports whether SMT is enabled and active, i.e. if on any ++ physical core two or more sibling threads are online. ++ ++ SMT control is also possible at boot time via the l1tf kernel command ++ line parameter in combination with L1D flush control. See ++ :ref:`mitigation_control_command_line`. ++ ++5. Disabling EPT ++^^^^^^^^^^^^^^^^ ++ ++ Disabling EPT for virtual machines provides full mitigation for L1TF even ++ with SMT enabled, because the effective page tables for guests are ++ managed and sanitized by the hypervisor. Though disabling EPT has a ++ significant performance impact especially when the Meltdown mitigation ++ KPTI is enabled. ++ ++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter. ++ ++There is ongoing research and development for new mitigation mechanisms to ++address the performance impact of disabling SMT or EPT. ++ ++.. _mitigation_control_command_line: ++ ++Mitigation control on the kernel command line ++--------------------------------------------- ++ ++The kernel command line allows to control the L1TF mitigations at boot ++time with the option "l1tf=". The valid arguments for this option are: ++ ++ ============ ============================================================= ++ full Provides all available mitigations for the L1TF ++ vulnerability. Disables SMT and enables all mitigations in ++ the hypervisors, i.e. unconditional L1D flushing ++ ++ SMT control and L1D flush control via the sysfs interface ++ is still possible after boot. Hypervisors will issue a ++ warning when the first VM is started in a potentially ++ insecure configuration, i.e. SMT enabled or L1D flush ++ disabled. ++ ++ full,force Same as 'full', but disables SMT and L1D flush runtime ++ control. Implies the 'nosmt=force' command line option. ++ (i.e. sysfs control of SMT is disabled.) ++ ++ flush Leaves SMT enabled and enables the default hypervisor ++ mitigation, i.e. conditional L1D flushing ++ ++ SMT control and L1D flush control via the sysfs interface ++ is still possible after boot. Hypervisors will issue a ++ warning when the first VM is started in a potentially ++ insecure configuration, i.e. SMT enabled or L1D flush ++ disabled. ++ ++ flush,nosmt Disables SMT and enables the default hypervisor mitigation, ++ i.e. conditional L1D flushing. ++ ++ SMT control and L1D flush control via the sysfs interface ++ is still possible after boot. Hypervisors will issue a ++ warning when the first VM is started in a potentially ++ insecure configuration, i.e. SMT enabled or L1D flush ++ disabled. ++ ++ flush,nowarn Same as 'flush', but hypervisors will not warn when a VM is ++ started in a potentially insecure configuration. ++ ++ off Disables hypervisor mitigations and doesn't emit any ++ warnings. ++ ============ ============================================================= ++ ++The default is 'flush'. For details about L1D flushing see :ref:`l1d_flush`. ++ ++ ++.. _mitigation_control_kvm: ++ ++Mitigation control for KVM - module parameter ++------------------------------------------------------------- ++ ++The KVM hypervisor mitigation mechanism, flushing the L1D cache when ++entering a guest, can be controlled with a module parameter. ++ ++The option/parameter is "kvm-intel.vmentry_l1d_flush=". It takes the ++following arguments: ++ ++ ============ ============================================================== ++ always L1D cache flush on every VMENTER. ++ ++ cond Flush L1D on VMENTER only when the code between VMEXIT and ++ VMENTER can leak host memory which is considered ++ interesting for an attacker. This still can leak host memory ++ which allows e.g. to determine the hosts address space layout. ++ ++ never Disables the mitigation ++ ============ ============================================================== ++ ++The parameter can be provided on the kernel command line, as a module ++parameter when loading the modules and at runtime modified via the sysfs ++file: ++ ++/sys/module/kvm_intel/parameters/vmentry_l1d_flush ++ ++The default is 'cond'. If 'l1tf=full,force' is given on the kernel command ++line, then 'always' is enforced and the kvm-intel.vmentry_l1d_flush ++module parameter is ignored and writes to the sysfs file are rejected. ++ ++ ++Mitigation selection guide ++-------------------------- ++ ++1. No virtualization in use ++^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ The system is protected by the kernel unconditionally and no further ++ action is required. ++ ++2. Virtualization with trusted guests ++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ ++ If the guest comes from a trusted source and the guest OS kernel is ++ guaranteed to have the L1TF mitigations in place the system is fully ++ protected against L1TF and no further action is required. ++ ++ To avoid the overhead of the default L1D flushing on VMENTER the ++ administrator can disable the flushing via the kernel command line and ++ sysfs control files. See :ref:`mitigation_control_command_line` and ++ :ref:`mitigation_control_kvm`. ++ ++ ++3. Virtualization with untrusted guests ++^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ++ ++3.1. SMT not supported or disabled ++"""""""""""""""""""""""""""""""""" ++ ++ If SMT is not supported by the processor or disabled in the BIOS or by ++ the kernel, it's only required to enforce L1D flushing on VMENTER. ++ ++ Conditional L1D flushing is the default behaviour and can be tuned. See ++ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`. ++ ++3.2. EPT not supported or disabled ++"""""""""""""""""""""""""""""""""" ++ ++ If EPT is not supported by the processor or disabled in the hypervisor, ++ the system is fully protected. SMT can stay enabled and L1D flushing on ++ VMENTER is not required. ++ ++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' parameter. ++ ++3.3. SMT and EPT supported and active ++""""""""""""""""""""""""""""""""""""" ++ ++ If SMT and EPT are supported and active then various degrees of ++ mitigations can be employed: ++ ++ - L1D flushing on VMENTER: ++ ++ L1D flushing on VMENTER is the minimal protection requirement, but it ++ is only potent in combination with other mitigation methods. ++ ++ Conditional L1D flushing is the default behaviour and can be tuned. See ++ :ref:`mitigation_control_command_line` and :ref:`mitigation_control_kvm`. ++ ++ - Guest confinement: ++ ++ Confinement of guests to a single or a group of physical cores which ++ are not running any other processes, can reduce the attack surface ++ significantly, but interrupts, soft interrupts and kernel threads can ++ still expose valuable data to a potential attacker. See ++ :ref:`guest_confinement`. ++ ++ - Interrupt isolation: ++ ++ Isolating the guest CPUs from interrupts can reduce the attack surface ++ further, but still allows a malicious guest to explore a limited amount ++ of host physical memory. This can at least be used to gain knowledge ++ about the host address space layout. The interrupts which have a fixed ++ affinity to the CPUs which run the untrusted guests can depending on ++ the scenario still trigger soft interrupts and schedule kernel threads ++ which might expose valuable information. See ++ :ref:`interrupt_isolation`. ++ ++The above three mitigation methods combined can provide protection to a ++certain degree, but the risk of the remaining attack surface has to be ++carefully analyzed. For full protection the following methods are ++available: ++ ++ - Disabling SMT: ++ ++ Disabling SMT and enforcing the L1D flushing provides the maximum ++ amount of protection. This mitigation is not depending on any of the ++ above mitigation methods. ++ ++ SMT control and L1D flushing can be tuned by the command line ++ parameters 'nosmt', 'l1tf', 'kvm-intel.vmentry_l1d_flush' and at run ++ time with the matching sysfs control files. See :ref:`smt_control`, ++ :ref:`mitigation_control_command_line` and ++ :ref:`mitigation_control_kvm`. ++ ++ - Disabling EPT: ++ ++ Disabling EPT provides the maximum amount of protection as well. It is ++ not depending on any of the above mitigation methods. SMT can stay ++ enabled and L1D flushing is not required, but the performance impact is ++ significant. ++ ++ EPT can be disabled in the hypervisor via the 'kvm-intel.ept' ++ parameter. ++ ++3.4. Nested virtual machines ++"""""""""""""""""""""""""""" ++ ++When nested virtualization is in use, three operating systems are involved: ++the bare metal hypervisor, the nested hypervisor and the nested virtual ++machine. VMENTER operations from the nested hypervisor into the nested ++guest will always be processed by the bare metal hypervisor. If KVM is the ++bare metal hypervisor it wiil: ++ ++ - Flush the L1D cache on every switch from the nested hypervisor to the ++ nested virtual machine, so that the nested hypervisor's secrets are not ++ exposed to the nested virtual machine; ++ ++ - Flush the L1D cache on every switch from the nested virtual machine to ++ the nested hypervisor; this is a complex operation, and flushing the L1D ++ cache avoids that the bare metal hypervisor's secrets are exposed to the ++ nested virtual machine; ++ ++ - Instruct the nested hypervisor to not perform any L1D cache flush. This ++ is an optimization to avoid double L1D flushing. ++ ++ ++.. _default_mitigations: ++ ++Default mitigations ++------------------- ++ ++ The kernel default mitigations for vulnerable processors are: ++ ++ - PTE inversion to protect against malicious user space. This is done ++ unconditionally and cannot be controlled. ++ ++ - L1D conditional flushing on VMENTER when EPT is enabled for ++ a guest. ++ ++ The kernel does not by default enforce the disabling of SMT, which leaves ++ SMT systems vulnerable when running untrusted guests with EPT enabled. ++ ++ The rationale for this choice is: ++ ++ - Force disabling SMT can break existing setups, especially with ++ unattended updates. ++ ++ - If regular users run untrusted guests on their machine, then L1TF is ++ just an add on to other malware which might be embedded in an untrusted ++ guest, e.g. spam-bots or attacks on the local network. ++ ++ There is no technical way to prevent a user from running untrusted code ++ on their machines blindly. ++ ++ - It's technically extremely unlikely and from today's knowledge even ++ impossible that L1TF can be exploited via the most popular attack ++ mechanisms like JavaScript because these mechanisms have no way to ++ control PTEs. If this would be possible and not other mitigation would ++ be possible, then the default might be different. ++ ++ - The administrators of cloud and hosting setups have to carefully ++ analyze the risk for their scenarios and make the appropriate ++ mitigation choices, which might even vary across their deployed ++ machines and also result in other changes of their overall setup. ++ There is no way for the kernel to provide a sensible default for this ++ kind of scenarios. +diff --git a/Documentation/virtual/kvm/api.txt b/Documentation/virtual/kvm/api.txt +index 88ad78c6f605..5d12166bd66b 100644 +--- a/Documentation/virtual/kvm/api.txt ++++ b/Documentation/virtual/kvm/api.txt +@@ -123,14 +123,15 @@ memory layout to fit in user mode), check KVM_CAP_MIPS_VZ and use the + flag KVM_VM_MIPS_VZ. + + +-4.3 KVM_GET_MSR_INDEX_LIST ++4.3 KVM_GET_MSR_INDEX_LIST, KVM_GET_MSR_FEATURE_INDEX_LIST + +-Capability: basic ++Capability: basic, KVM_CAP_GET_MSR_FEATURES for KVM_GET_MSR_FEATURE_INDEX_LIST + Architectures: x86 +-Type: system ++Type: system ioctl + Parameters: struct kvm_msr_list (in/out) + Returns: 0 on success; -1 on error + Errors: ++ EFAULT: the msr index list cannot be read from or written to + E2BIG: the msr index list is to be to fit in the array specified by + the user. + +@@ -139,16 +140,23 @@ struct kvm_msr_list { + __u32 indices[0]; + }; + +-This ioctl returns the guest msrs that are supported. The list varies +-by kvm version and host processor, but does not change otherwise. The +-user fills in the size of the indices array in nmsrs, and in return +-kvm adjusts nmsrs to reflect the actual number of msrs and fills in +-the indices array with their numbers. ++The user fills in the size of the indices array in nmsrs, and in return ++kvm adjusts nmsrs to reflect the actual number of msrs and fills in the ++indices array with their numbers. ++ ++KVM_GET_MSR_INDEX_LIST returns the guest msrs that are supported. The list ++varies by kvm version and host processor, but does not change otherwise. + + Note: if kvm indicates supports MCE (KVM_CAP_MCE), then the MCE bank MSRs are + not returned in the MSR list, as different vcpus can have a different number + of banks, as set via the KVM_X86_SETUP_MCE ioctl. + ++KVM_GET_MSR_FEATURE_INDEX_LIST returns the list of MSRs that can be passed ++to the KVM_GET_MSRS system ioctl. This lets userspace probe host capabilities ++and processor features that are exposed via MSRs (e.g., VMX capabilities). ++This list also varies by kvm version and host processor, but does not change ++otherwise. ++ + + 4.4 KVM_CHECK_EXTENSION + +@@ -475,14 +483,22 @@ Support for this has been removed. Use KVM_SET_GUEST_DEBUG instead. + + 4.18 KVM_GET_MSRS + +-Capability: basic ++Capability: basic (vcpu), KVM_CAP_GET_MSR_FEATURES (system) + Architectures: x86 +-Type: vcpu ioctl ++Type: system ioctl, vcpu ioctl + Parameters: struct kvm_msrs (in/out) +-Returns: 0 on success, -1 on error ++Returns: number of msrs successfully returned; ++ -1 on error ++ ++When used as a system ioctl: ++Reads the values of MSR-based features that are available for the VM. This ++is similar to KVM_GET_SUPPORTED_CPUID, but it returns MSR indices and values. ++The list of msr-based features can be obtained using KVM_GET_MSR_FEATURE_INDEX_LIST ++in a system ioctl. + ++When used as a vcpu ioctl: + Reads model-specific registers from the vcpu. Supported msr indices can +-be obtained using KVM_GET_MSR_INDEX_LIST. ++be obtained using KVM_GET_MSR_INDEX_LIST in a system ioctl. + + struct kvm_msrs { + __u32 nmsrs; /* number of msrs in entries */ +diff --git a/Makefile b/Makefile +index d407ecfdee0b..f3bb9428b3dc 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 62 ++SUBLEVEL = 63 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/Kconfig b/arch/Kconfig +index 400b9e1b2f27..4e01862f58e4 100644 +--- a/arch/Kconfig ++++ b/arch/Kconfig +@@ -13,6 +13,9 @@ config KEXEC_CORE + config HAVE_IMA_KEXEC + bool + ++config HOTPLUG_SMT ++ bool ++ + config OPROFILE + tristate "OProfile system profiling" + depends on PROFILING +diff --git a/arch/arm/boot/dts/imx6sx.dtsi b/arch/arm/boot/dts/imx6sx.dtsi +index 6c7eb54be9e2..d64438bfa68b 100644 +--- a/arch/arm/boot/dts/imx6sx.dtsi ++++ b/arch/arm/boot/dts/imx6sx.dtsi +@@ -1305,7 +1305,7 @@ + 0x82000000 0 0x08000000 0x08000000 0 0x00f00000>; + bus-range = <0x00 0xff>; + num-lanes = <1>; +- interrupts = ; ++ interrupts = ; + clocks = <&clks IMX6SX_CLK_PCIE_REF_125M>, + <&clks IMX6SX_CLK_PCIE_AXI>, + <&clks IMX6SX_CLK_LVDS1_OUT>, +diff --git a/arch/parisc/Kconfig b/arch/parisc/Kconfig +index 1fd3eb5b66c6..89e684fd795f 100644 +--- a/arch/parisc/Kconfig ++++ b/arch/parisc/Kconfig +@@ -201,7 +201,7 @@ config PREFETCH + + config MLONGCALLS + bool "Enable the -mlong-calls compiler option for big kernels" +- def_bool y if (!MODULES) ++ default y + depends on PA8X00 + help + If you configure the kernel to include many drivers built-in instead +diff --git a/arch/parisc/include/asm/barrier.h b/arch/parisc/include/asm/barrier.h +new file mode 100644 +index 000000000000..dbaaca84f27f +--- /dev/null ++++ b/arch/parisc/include/asm/barrier.h +@@ -0,0 +1,32 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef __ASM_BARRIER_H ++#define __ASM_BARRIER_H ++ ++#ifndef __ASSEMBLY__ ++ ++/* The synchronize caches instruction executes as a nop on systems in ++ which all memory references are performed in order. */ ++#define synchronize_caches() __asm__ __volatile__ ("sync" : : : "memory") ++ ++#if defined(CONFIG_SMP) ++#define mb() do { synchronize_caches(); } while (0) ++#define rmb() mb() ++#define wmb() mb() ++#define dma_rmb() mb() ++#define dma_wmb() mb() ++#else ++#define mb() barrier() ++#define rmb() barrier() ++#define wmb() barrier() ++#define dma_rmb() barrier() ++#define dma_wmb() barrier() ++#endif ++ ++#define __smp_mb() mb() ++#define __smp_rmb() mb() ++#define __smp_wmb() mb() ++ ++#include ++ ++#endif /* !__ASSEMBLY__ */ ++#endif /* __ASM_BARRIER_H */ +diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S +index e95207c0565e..1b4732e20137 100644 +--- a/arch/parisc/kernel/entry.S ++++ b/arch/parisc/kernel/entry.S +@@ -481,6 +481,8 @@ + /* Release pa_tlb_lock lock without reloading lock address. */ + .macro tlb_unlock0 spc,tmp + #ifdef CONFIG_SMP ++ or,COND(=) %r0,\spc,%r0 ++ sync + or,COND(=) %r0,\spc,%r0 + stw \spc,0(\tmp) + #endif +diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S +index 67b0f7532e83..3e163df49cf3 100644 +--- a/arch/parisc/kernel/pacache.S ++++ b/arch/parisc/kernel/pacache.S +@@ -354,6 +354,7 @@ ENDPROC_CFI(flush_data_cache_local) + .macro tlb_unlock la,flags,tmp + #ifdef CONFIG_SMP + ldi 1,\tmp ++ sync + stw \tmp,0(\la) + mtsm \flags + #endif +diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S +index e775f80ae28c..4886a6db42e9 100644 +--- a/arch/parisc/kernel/syscall.S ++++ b/arch/parisc/kernel/syscall.S +@@ -633,6 +633,7 @@ cas_action: + sub,<> %r28, %r25, %r0 + 2: stw,ma %r24, 0(%r26) + /* Free lock */ ++ sync + stw,ma %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + /* Clear thread register indicator */ +@@ -647,6 +648,7 @@ cas_action: + 3: + /* Error occurred on load or store */ + /* Free lock */ ++ sync + stw %r20, 0(%sr2,%r20) + #if ENABLE_LWS_DEBUG + stw %r0, 4(%sr2,%r20) +@@ -848,6 +850,7 @@ cas2_action: + + cas2_end: + /* Free lock */ ++ sync + stw,ma %r20, 0(%sr2,%r20) + /* Enable interrupts */ + ssm PSW_SM_I, %r0 +@@ -858,6 +861,7 @@ cas2_end: + 22: + /* Error occurred on load or store */ + /* Free lock */ ++ sync + stw %r20, 0(%sr2,%r20) + ssm PSW_SM_I, %r0 + ldo 1(%r0),%r28 +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 7483cd514c32..1c63a4b5320d 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -176,6 +176,7 @@ config X86 + select HAVE_SYSCALL_TRACEPOINTS + select HAVE_UNSTABLE_SCHED_CLOCK + select HAVE_USER_RETURN_NOTIFIER ++ select HOTPLUG_SMT if SMP + select IRQ_FORCED_THREADING + select PCI_LOCKLESS_CONFIG + select PERF_EVENTS +diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h +index 5f01671c68f2..a1ed92aae12a 100644 +--- a/arch/x86/include/asm/apic.h ++++ b/arch/x86/include/asm/apic.h +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #define ARCH_APICTIMER_STOPS_ON_C3 1 + +@@ -613,12 +614,20 @@ extern int default_check_phys_apicid_present(int phys_apicid); + #endif + + #endif /* CONFIG_X86_LOCAL_APIC */ ++ ++#ifdef CONFIG_SMP ++bool apic_id_is_primary_thread(unsigned int id); ++#else ++static inline bool apic_id_is_primary_thread(unsigned int id) { return false; } ++#endif ++ + extern void irq_enter(void); + extern void irq_exit(void); + + static inline void entering_irq(void) + { + irq_enter(); ++ kvm_set_cpu_l1tf_flush_l1d(); + } + + static inline void entering_ack_irq(void) +@@ -631,6 +640,7 @@ static inline void ipi_entering_ack_irq(void) + { + irq_enter(); + ack_APIC_irq(); ++ kvm_set_cpu_l1tf_flush_l1d(); + } + + static inline void exiting_irq(void) +diff --git a/arch/x86/include/asm/cpufeatures.h b/arch/x86/include/asm/cpufeatures.h +index 403e97d5e243..8418462298e7 100644 +--- a/arch/x86/include/asm/cpufeatures.h ++++ b/arch/x86/include/asm/cpufeatures.h +@@ -219,6 +219,7 @@ + #define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */ + #define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */ + #define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ ++#define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */ + + /* Virtualization flags: Linux defined, word 8 */ + #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ +@@ -338,6 +339,7 @@ + #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ + #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ + #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_FLUSH_L1D (18*32+28) /* Flush L1D cache */ + #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ + #define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ + +@@ -370,5 +372,6 @@ + #define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ + #define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ + #define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ ++#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */ + + #endif /* _ASM_X86_CPUFEATURES_H */ +diff --git a/arch/x86/include/asm/dmi.h b/arch/x86/include/asm/dmi.h +index 0ab2ab27ad1f..b825cb201251 100644 +--- a/arch/x86/include/asm/dmi.h ++++ b/arch/x86/include/asm/dmi.h +@@ -4,8 +4,8 @@ + + #include + #include ++#include + +-#include + #include + + static __always_inline __init void *dmi_alloc(unsigned len) +diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h +index 51cc979dd364..486c843273c4 100644 +--- a/arch/x86/include/asm/hardirq.h ++++ b/arch/x86/include/asm/hardirq.h +@@ -3,10 +3,12 @@ + #define _ASM_X86_HARDIRQ_H + + #include +-#include + + typedef struct { +- unsigned int __softirq_pending; ++ u16 __softirq_pending; ++#if IS_ENABLED(CONFIG_KVM_INTEL) ++ u8 kvm_cpu_l1tf_flush_l1d; ++#endif + unsigned int __nmi_count; /* arch dependent */ + #ifdef CONFIG_X86_LOCAL_APIC + unsigned int apic_timer_irqs; /* arch dependent */ +@@ -62,4 +64,24 @@ extern u64 arch_irq_stat_cpu(unsigned int cpu); + extern u64 arch_irq_stat(void); + #define arch_irq_stat arch_irq_stat + ++ ++#if IS_ENABLED(CONFIG_KVM_INTEL) ++static inline void kvm_set_cpu_l1tf_flush_l1d(void) ++{ ++ __this_cpu_write(irq_stat.kvm_cpu_l1tf_flush_l1d, 1); ++} ++ ++static inline void kvm_clear_cpu_l1tf_flush_l1d(void) ++{ ++ __this_cpu_write(irq_stat.kvm_cpu_l1tf_flush_l1d, 0); ++} ++ ++static inline bool kvm_get_cpu_l1tf_flush_l1d(void) ++{ ++ return __this_cpu_read(irq_stat.kvm_cpu_l1tf_flush_l1d); ++} ++#else /* !IS_ENABLED(CONFIG_KVM_INTEL) */ ++static inline void kvm_set_cpu_l1tf_flush_l1d(void) { } ++#endif /* IS_ENABLED(CONFIG_KVM_INTEL) */ ++ + #endif /* _ASM_X86_HARDIRQ_H */ +diff --git a/arch/x86/include/asm/irqflags.h b/arch/x86/include/asm/irqflags.h +index c4fc17220df9..c14f2a74b2be 100644 +--- a/arch/x86/include/asm/irqflags.h ++++ b/arch/x86/include/asm/irqflags.h +@@ -13,6 +13,8 @@ + * Interrupt control: + */ + ++/* Declaration required for gcc < 4.9 to prevent -Werror=missing-prototypes */ ++extern inline unsigned long native_save_fl(void); + extern inline unsigned long native_save_fl(void) + { + unsigned long flags; +diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h +index 174b9c41efce..4015b88383ce 100644 +--- a/arch/x86/include/asm/kvm_host.h ++++ b/arch/x86/include/asm/kvm_host.h +@@ -17,6 +17,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -506,6 +507,7 @@ struct kvm_vcpu_arch { + u64 smbase; + bool tpr_access_reporting; + u64 ia32_xss; ++ u64 microcode_version; + + /* + * Paging state of the vcpu +@@ -693,6 +695,9 @@ struct kvm_vcpu_arch { + + /* be preempted when it's in kernel-mode(cpl=0) */ + bool preempted_in_kernel; ++ ++ /* Flush the L1 Data cache for L1TF mitigation on VMENTER */ ++ bool l1tf_flush_l1d; + }; + + struct kvm_lpage_info { +@@ -862,6 +867,7 @@ struct kvm_vcpu_stat { + u64 signal_exits; + u64 irq_window_exits; + u64 nmi_window_exits; ++ u64 l1d_flush; + u64 halt_exits; + u64 halt_successful_poll; + u64 halt_attempted_poll; +@@ -1061,6 +1067,8 @@ struct kvm_x86_ops { + void (*cancel_hv_timer)(struct kvm_vcpu *vcpu); + + void (*setup_mce)(struct kvm_vcpu *vcpu); ++ ++ int (*get_msr_feature)(struct kvm_msr_entry *entry); + }; + + struct kvm_arch_async_pf { +@@ -1366,6 +1374,7 @@ int kvm_cpu_get_interrupt(struct kvm_vcpu *v); + void kvm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event); + void kvm_vcpu_reload_apic_access_page(struct kvm_vcpu *vcpu); + ++u64 kvm_get_arch_capabilities(void); + void kvm_define_shared_msr(unsigned index, u32 msr); + int kvm_set_shared_msr(unsigned index, u64 val, u64 mask); + +diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h +index 504b21692d32..ef7eec669a1b 100644 +--- a/arch/x86/include/asm/msr-index.h ++++ b/arch/x86/include/asm/msr-index.h +@@ -70,12 +70,19 @@ + #define MSR_IA32_ARCH_CAPABILITIES 0x0000010a + #define ARCH_CAP_RDCL_NO (1 << 0) /* Not susceptible to Meltdown */ + #define ARCH_CAP_IBRS_ALL (1 << 1) /* Enhanced IBRS support */ ++#define ARCH_CAP_SKIP_VMENTRY_L1DFLUSH (1 << 3) /* Skip L1D flush on vmentry */ + #define ARCH_CAP_SSB_NO (1 << 4) /* + * Not susceptible to Speculative Store Bypass + * attack, so no Speculative Store Bypass + * control required. + */ + ++#define MSR_IA32_FLUSH_CMD 0x0000010b ++#define L1D_FLUSH (1 << 0) /* ++ * Writeback and invalidate the ++ * L1 data cache. ++ */ ++ + #define MSR_IA32_BBL_CR_CTL 0x00000119 + #define MSR_IA32_BBL_CR_CTL3 0x0000011e + +diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h +index aa30c3241ea7..0d5c739eebd7 100644 +--- a/arch/x86/include/asm/page_32_types.h ++++ b/arch/x86/include/asm/page_32_types.h +@@ -29,8 +29,13 @@ + #define N_EXCEPTION_STACKS 1 + + #ifdef CONFIG_X86_PAE +-/* 44=32+12, the limit we can fit into an unsigned long pfn */ +-#define __PHYSICAL_MASK_SHIFT 44 ++/* ++ * This is beyond the 44 bit limit imposed by the 32bit long pfns, ++ * but we need the full mask to make sure inverted PROT_NONE ++ * entries have all the host bits set in a guest. ++ * The real limit is still 44 bits. ++ */ ++#define __PHYSICAL_MASK_SHIFT 52 + #define __VIRTUAL_MASK_SHIFT 32 + + #else /* !CONFIG_X86_PAE */ +diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h +index 685ffe8a0eaf..60d0f9015317 100644 +--- a/arch/x86/include/asm/pgtable-2level.h ++++ b/arch/x86/include/asm/pgtable-2level.h +@@ -95,4 +95,21 @@ static inline unsigned long pte_bitop(unsigned long value, unsigned int rightshi + #define __pte_to_swp_entry(pte) ((swp_entry_t) { (pte).pte_low }) + #define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val }) + ++/* No inverted PFNs on 2 level page tables */ ++ ++static inline u64 protnone_mask(u64 val) ++{ ++ return 0; ++} ++ ++static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask) ++{ ++ return val; ++} ++ ++static inline bool __pte_needs_invert(u64 val) ++{ ++ return false; ++} ++ + #endif /* _ASM_X86_PGTABLE_2LEVEL_H */ +diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h +index bc4af5453802..9dc19b4a2a87 100644 +--- a/arch/x86/include/asm/pgtable-3level.h ++++ b/arch/x86/include/asm/pgtable-3level.h +@@ -206,12 +206,43 @@ static inline pud_t native_pudp_get_and_clear(pud_t *pudp) + #endif + + /* Encode and de-code a swap entry */ ++#define SWP_TYPE_BITS 5 ++ ++#define SWP_OFFSET_FIRST_BIT (_PAGE_BIT_PROTNONE + 1) ++ ++/* We always extract/encode the offset by shifting it all the way up, and then down again */ ++#define SWP_OFFSET_SHIFT (SWP_OFFSET_FIRST_BIT + SWP_TYPE_BITS) ++ + #define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > 5) + #define __swp_type(x) (((x).val) & 0x1f) + #define __swp_offset(x) ((x).val >> 5) + #define __swp_entry(type, offset) ((swp_entry_t){(type) | (offset) << 5}) +-#define __pte_to_swp_entry(pte) ((swp_entry_t){ (pte).pte_high }) +-#define __swp_entry_to_pte(x) ((pte_t){ { .pte_high = (x).val } }) ++ ++/* ++ * Normally, __swp_entry() converts from arch-independent swp_entry_t to ++ * arch-dependent swp_entry_t, and __swp_entry_to_pte() just stores the result ++ * to pte. But here we have 32bit swp_entry_t and 64bit pte, and need to use the ++ * whole 64 bits. Thus, we shift the "real" arch-dependent conversion to ++ * __swp_entry_to_pte() through the following helper macro based on 64bit ++ * __swp_entry(). ++ */ ++#define __swp_pteval_entry(type, offset) ((pteval_t) { \ ++ (~(pteval_t)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \ ++ | ((pteval_t)(type) << (64 - SWP_TYPE_BITS)) }) ++ ++#define __swp_entry_to_pte(x) ((pte_t){ .pte = \ ++ __swp_pteval_entry(__swp_type(x), __swp_offset(x)) }) ++/* ++ * Analogically, __pte_to_swp_entry() doesn't just extract the arch-dependent ++ * swp_entry_t, but also has to convert it from 64bit to the 32bit ++ * intermediate representation, using the following macros based on 64bit ++ * __swp_type() and __swp_offset(). ++ */ ++#define __pteval_swp_type(x) ((unsigned long)((x).pte >> (64 - SWP_TYPE_BITS))) ++#define __pteval_swp_offset(x) ((unsigned long)(~((x).pte) << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT)) ++ ++#define __pte_to_swp_entry(pte) (__swp_entry(__pteval_swp_type(pte), \ ++ __pteval_swp_offset(pte))) + + #define gup_get_pte gup_get_pte + /* +@@ -260,4 +291,6 @@ static inline pte_t gup_get_pte(pte_t *ptep) + return pte; + } + ++#include ++ + #endif /* _ASM_X86_PGTABLE_3LEVEL_H */ +diff --git a/arch/x86/include/asm/pgtable-invert.h b/arch/x86/include/asm/pgtable-invert.h +new file mode 100644 +index 000000000000..44b1203ece12 +--- /dev/null ++++ b/arch/x86/include/asm/pgtable-invert.h +@@ -0,0 +1,32 @@ ++/* SPDX-License-Identifier: GPL-2.0 */ ++#ifndef _ASM_PGTABLE_INVERT_H ++#define _ASM_PGTABLE_INVERT_H 1 ++ ++#ifndef __ASSEMBLY__ ++ ++static inline bool __pte_needs_invert(u64 val) ++{ ++ return !(val & _PAGE_PRESENT); ++} ++ ++/* Get a mask to xor with the page table entry to get the correct pfn. */ ++static inline u64 protnone_mask(u64 val) ++{ ++ return __pte_needs_invert(val) ? ~0ull : 0; ++} ++ ++static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask) ++{ ++ /* ++ * When a PTE transitions from NONE to !NONE or vice-versa ++ * invert the PFN part to stop speculation. ++ * pte_pfn undoes this when needed. ++ */ ++ if (__pte_needs_invert(oldval) != __pte_needs_invert(val)) ++ val = (val & ~mask) | (~val & mask); ++ return val; ++} ++ ++#endif /* __ASSEMBLY__ */ ++ ++#endif +diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h +index 5c790e93657d..6a4b1a54ff47 100644 +--- a/arch/x86/include/asm/pgtable.h ++++ b/arch/x86/include/asm/pgtable.h +@@ -185,19 +185,29 @@ static inline int pte_special(pte_t pte) + return pte_flags(pte) & _PAGE_SPECIAL; + } + ++/* Entries that were set to PROT_NONE are inverted */ ++ ++static inline u64 protnone_mask(u64 val); ++ + static inline unsigned long pte_pfn(pte_t pte) + { +- return (pte_val(pte) & PTE_PFN_MASK) >> PAGE_SHIFT; ++ phys_addr_t pfn = pte_val(pte); ++ pfn ^= protnone_mask(pfn); ++ return (pfn & PTE_PFN_MASK) >> PAGE_SHIFT; + } + + static inline unsigned long pmd_pfn(pmd_t pmd) + { +- return (pmd_val(pmd) & pmd_pfn_mask(pmd)) >> PAGE_SHIFT; ++ phys_addr_t pfn = pmd_val(pmd); ++ pfn ^= protnone_mask(pfn); ++ return (pfn & pmd_pfn_mask(pmd)) >> PAGE_SHIFT; + } + + static inline unsigned long pud_pfn(pud_t pud) + { +- return (pud_val(pud) & pud_pfn_mask(pud)) >> PAGE_SHIFT; ++ phys_addr_t pfn = pud_val(pud); ++ pfn ^= protnone_mask(pfn); ++ return (pfn & pud_pfn_mask(pud)) >> PAGE_SHIFT; + } + + static inline unsigned long p4d_pfn(p4d_t p4d) +@@ -400,11 +410,6 @@ static inline pmd_t pmd_mkwrite(pmd_t pmd) + return pmd_set_flags(pmd, _PAGE_RW); + } + +-static inline pmd_t pmd_mknotpresent(pmd_t pmd) +-{ +- return pmd_clear_flags(pmd, _PAGE_PRESENT | _PAGE_PROTNONE); +-} +- + static inline pud_t pud_set_flags(pud_t pud, pudval_t set) + { + pudval_t v = native_pud_val(pud); +@@ -459,11 +464,6 @@ static inline pud_t pud_mkwrite(pud_t pud) + return pud_set_flags(pud, _PAGE_RW); + } + +-static inline pud_t pud_mknotpresent(pud_t pud) +-{ +- return pud_clear_flags(pud, _PAGE_PRESENT | _PAGE_PROTNONE); +-} +- + #ifdef CONFIG_HAVE_ARCH_SOFT_DIRTY + static inline int pte_soft_dirty(pte_t pte) + { +@@ -528,25 +528,45 @@ static inline pgprotval_t massage_pgprot(pgprot_t pgprot) + + static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot) + { +- return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) | +- massage_pgprot(pgprot)); ++ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT; ++ pfn ^= protnone_mask(pgprot_val(pgprot)); ++ pfn &= PTE_PFN_MASK; ++ return __pte(pfn | massage_pgprot(pgprot)); + } + + static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot) + { +- return __pmd(((phys_addr_t)page_nr << PAGE_SHIFT) | +- massage_pgprot(pgprot)); ++ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT; ++ pfn ^= protnone_mask(pgprot_val(pgprot)); ++ pfn &= PHYSICAL_PMD_PAGE_MASK; ++ return __pmd(pfn | massage_pgprot(pgprot)); + } + + static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot) + { +- return __pud(((phys_addr_t)page_nr << PAGE_SHIFT) | +- massage_pgprot(pgprot)); ++ phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT; ++ pfn ^= protnone_mask(pgprot_val(pgprot)); ++ pfn &= PHYSICAL_PUD_PAGE_MASK; ++ return __pud(pfn | massage_pgprot(pgprot)); + } + ++static inline pmd_t pmd_mknotpresent(pmd_t pmd) ++{ ++ return pfn_pmd(pmd_pfn(pmd), ++ __pgprot(pmd_flags(pmd) & ~(_PAGE_PRESENT|_PAGE_PROTNONE))); ++} ++ ++static inline pud_t pud_mknotpresent(pud_t pud) ++{ ++ return pfn_pud(pud_pfn(pud), ++ __pgprot(pud_flags(pud) & ~(_PAGE_PRESENT|_PAGE_PROTNONE))); ++} ++ ++static inline u64 flip_protnone_guard(u64 oldval, u64 val, u64 mask); ++ + static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) + { +- pteval_t val = pte_val(pte); ++ pteval_t val = pte_val(pte), oldval = val; + + /* + * Chop off the NX bit (if present), and add the NX portion of +@@ -554,17 +574,17 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot) + */ + val &= _PAGE_CHG_MASK; + val |= massage_pgprot(newprot) & ~_PAGE_CHG_MASK; +- ++ val = flip_protnone_guard(oldval, val, PTE_PFN_MASK); + return __pte(val); + } + + static inline pmd_t pmd_modify(pmd_t pmd, pgprot_t newprot) + { +- pmdval_t val = pmd_val(pmd); ++ pmdval_t val = pmd_val(pmd), oldval = val; + + val &= _HPAGE_CHG_MASK; + val |= massage_pgprot(newprot) & ~_HPAGE_CHG_MASK; +- ++ val = flip_protnone_guard(oldval, val, PHYSICAL_PMD_PAGE_MASK); + return __pmd(val); + } + +@@ -1274,6 +1294,14 @@ static inline bool pud_access_permitted(pud_t pud, bool write) + return __pte_access_permitted(pud_val(pud), write); + } + ++#define __HAVE_ARCH_PFN_MODIFY_ALLOWED 1 ++extern bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot); ++ ++static inline bool arch_has_pfn_modify_check(void) ++{ ++ return boot_cpu_has_bug(X86_BUG_L1TF); ++} ++ + #include + #endif /* __ASSEMBLY__ */ + +diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h +index 1149d2112b2e..4ecb72831938 100644 +--- a/arch/x86/include/asm/pgtable_64.h ++++ b/arch/x86/include/asm/pgtable_64.h +@@ -276,7 +276,7 @@ static inline int pgd_large(pgd_t pgd) { return 0; } + * + * | ... | 11| 10| 9|8|7|6|5| 4| 3|2| 1|0| <- bit number + * | ... |SW3|SW2|SW1|G|L|D|A|CD|WT|U| W|P| <- bit names +- * | OFFSET (14->63) | TYPE (9-13) |0|0|X|X| X| X|X|SD|0| <- swp entry ++ * | TYPE (59-63) | ~OFFSET (9-58) |0|0|X|X| X| X|X|SD|0| <- swp entry + * + * G (8) is aliased and used as a PROT_NONE indicator for + * !present ptes. We need to start storing swap entries above +@@ -289,20 +289,34 @@ static inline int pgd_large(pgd_t pgd) { return 0; } + * + * Bit 7 in swp entry should be 0 because pmd_present checks not only P, + * but also L and G. ++ * ++ * The offset is inverted by a binary not operation to make the high ++ * physical bits set. + */ +-#define SWP_TYPE_FIRST_BIT (_PAGE_BIT_PROTNONE + 1) +-#define SWP_TYPE_BITS 5 +-/* Place the offset above the type: */ +-#define SWP_OFFSET_FIRST_BIT (SWP_TYPE_FIRST_BIT + SWP_TYPE_BITS) ++#define SWP_TYPE_BITS 5 ++ ++#define SWP_OFFSET_FIRST_BIT (_PAGE_BIT_PROTNONE + 1) ++ ++/* We always extract/encode the offset by shifting it all the way up, and then down again */ ++#define SWP_OFFSET_SHIFT (SWP_OFFSET_FIRST_BIT+SWP_TYPE_BITS) + + #define MAX_SWAPFILES_CHECK() BUILD_BUG_ON(MAX_SWAPFILES_SHIFT > SWP_TYPE_BITS) + +-#define __swp_type(x) (((x).val >> (SWP_TYPE_FIRST_BIT)) \ +- & ((1U << SWP_TYPE_BITS) - 1)) +-#define __swp_offset(x) ((x).val >> SWP_OFFSET_FIRST_BIT) +-#define __swp_entry(type, offset) ((swp_entry_t) { \ +- ((type) << (SWP_TYPE_FIRST_BIT)) \ +- | ((offset) << SWP_OFFSET_FIRST_BIT) }) ++/* Extract the high bits for type */ ++#define __swp_type(x) ((x).val >> (64 - SWP_TYPE_BITS)) ++ ++/* Shift up (to get rid of type), then down to get value */ ++#define __swp_offset(x) (~(x).val << SWP_TYPE_BITS >> SWP_OFFSET_SHIFT) ++ ++/* ++ * Shift the offset up "too far" by TYPE bits, then down again ++ * The offset is inverted by a binary not operation to make the high ++ * physical bits set. ++ */ ++#define __swp_entry(type, offset) ((swp_entry_t) { \ ++ (~(unsigned long)(offset) << SWP_OFFSET_SHIFT >> SWP_TYPE_BITS) \ ++ | ((unsigned long)(type) << (64-SWP_TYPE_BITS)) }) ++ + #define __pte_to_swp_entry(pte) ((swp_entry_t) { pte_val((pte)) }) + #define __pmd_to_swp_entry(pmd) ((swp_entry_t) { pmd_val((pmd)) }) + #define __swp_entry_to_pte(x) ((pte_t) { .pte = (x).val }) +@@ -346,5 +360,7 @@ static inline bool gup_fast_permitted(unsigned long start, int nr_pages, + return true; + } + ++#include ++ + #endif /* !__ASSEMBLY__ */ + #endif /* _ASM_X86_PGTABLE_64_H */ +diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h +index 3222c7746cb1..0e856c0628b3 100644 +--- a/arch/x86/include/asm/processor.h ++++ b/arch/x86/include/asm/processor.h +@@ -180,6 +180,11 @@ extern const struct seq_operations cpuinfo_op; + + extern void cpu_detect(struct cpuinfo_x86 *c); + ++static inline unsigned long l1tf_pfn_limit(void) ++{ ++ return BIT(boot_cpu_data.x86_phys_bits - 1 - PAGE_SHIFT) - 1; ++} ++ + extern void early_cpu_init(void); + extern void identify_boot_cpu(void); + extern void identify_secondary_cpu(struct cpuinfo_x86 *); +@@ -969,4 +974,16 @@ bool xen_set_default_idle(void); + void stop_this_cpu(void *dummy); + void df_debug(struct pt_regs *regs, long error_code); + void microcode_check(void); ++ ++enum l1tf_mitigations { ++ L1TF_MITIGATION_OFF, ++ L1TF_MITIGATION_FLUSH_NOWARN, ++ L1TF_MITIGATION_FLUSH, ++ L1TF_MITIGATION_FLUSH_NOSMT, ++ L1TF_MITIGATION_FULL, ++ L1TF_MITIGATION_FULL_FORCE ++}; ++ ++extern enum l1tf_mitigations l1tf_mitigation; ++ + #endif /* _ASM_X86_PROCESSOR_H */ +diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h +index 461f53d27708..fe2ee61880a8 100644 +--- a/arch/x86/include/asm/smp.h ++++ b/arch/x86/include/asm/smp.h +@@ -170,7 +170,6 @@ static inline int wbinvd_on_all_cpus(void) + wbinvd(); + return 0; + } +-#define smp_num_siblings 1 + #endif /* CONFIG_SMP */ + + extern unsigned disabled_cpus; +diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h +index c1d2a9892352..453cf38a1c33 100644 +--- a/arch/x86/include/asm/topology.h ++++ b/arch/x86/include/asm/topology.h +@@ -123,13 +123,17 @@ static inline int topology_max_smt_threads(void) + } + + int topology_update_package_map(unsigned int apicid, unsigned int cpu); +-extern int topology_phys_to_logical_pkg(unsigned int pkg); ++int topology_phys_to_logical_pkg(unsigned int pkg); ++bool topology_is_primary_thread(unsigned int cpu); ++bool topology_smt_supported(void); + #else + #define topology_max_packages() (1) + static inline int + topology_update_package_map(unsigned int apicid, unsigned int cpu) { return 0; } + static inline int topology_phys_to_logical_pkg(unsigned int pkg) { return 0; } + static inline int topology_max_smt_threads(void) { return 1; } ++static inline bool topology_is_primary_thread(unsigned int cpu) { return true; } ++static inline bool topology_smt_supported(void) { return false; } + #endif + + static inline void arch_fix_phys_package_id(int num, u32 slot) +diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h +index 7c300299e12e..08c14aec26ac 100644 +--- a/arch/x86/include/asm/vmx.h ++++ b/arch/x86/include/asm/vmx.h +@@ -571,4 +571,15 @@ enum vm_instruction_error_number { + VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID = 28, + }; + ++enum vmx_l1d_flush_state { ++ VMENTER_L1D_FLUSH_AUTO, ++ VMENTER_L1D_FLUSH_NEVER, ++ VMENTER_L1D_FLUSH_COND, ++ VMENTER_L1D_FLUSH_ALWAYS, ++ VMENTER_L1D_FLUSH_EPT_DISABLED, ++ VMENTER_L1D_FLUSH_NOT_REQUIRED, ++}; ++ ++extern enum vmx_l1d_flush_state l1tf_vmx_mitigation; ++ + #endif +diff --git a/arch/x86/kernel/apic/apic.c b/arch/x86/kernel/apic/apic.c +index f48a51335538..2e64178f284d 100644 +--- a/arch/x86/kernel/apic/apic.c ++++ b/arch/x86/kernel/apic/apic.c +@@ -34,6 +34,7 @@ + #include + #include + #include ++#include + + #include + #include +@@ -56,6 +57,7 @@ + #include + #include + #include ++#include + + unsigned int num_processors; + +@@ -2092,6 +2094,23 @@ static int cpuid_to_apicid[] = { + [0 ... NR_CPUS - 1] = -1, + }; + ++#ifdef CONFIG_SMP ++/** ++ * apic_id_is_primary_thread - Check whether APIC ID belongs to a primary thread ++ * @id: APIC ID to check ++ */ ++bool apic_id_is_primary_thread(unsigned int apicid) ++{ ++ u32 mask; ++ ++ if (smp_num_siblings == 1) ++ return true; ++ /* Isolate the SMT bit(s) in the APICID and check for 0 */ ++ mask = (1U << (fls(smp_num_siblings) - 1)) - 1; ++ return !(apicid & mask); ++} ++#endif ++ + /* + * Should use this API to allocate logical CPU IDs to keep nr_logical_cpuids + * and cpuid_to_apicid[] synchronized. +diff --git a/arch/x86/kernel/apic/htirq.c b/arch/x86/kernel/apic/htirq.c +index 56ccf9346b08..741de281ed5d 100644 +--- a/arch/x86/kernel/apic/htirq.c ++++ b/arch/x86/kernel/apic/htirq.c +@@ -16,6 +16,8 @@ + #include + #include + #include ++#include ++ + #include + #include + #include +diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c +index 3b89b27945ff..96a8a68f9c79 100644 +--- a/arch/x86/kernel/apic/io_apic.c ++++ b/arch/x86/kernel/apic/io_apic.c +@@ -33,6 +33,7 @@ + + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/apic/msi.c b/arch/x86/kernel/apic/msi.c +index 9b18be764422..f10e7f93b0e2 100644 +--- a/arch/x86/kernel/apic/msi.c ++++ b/arch/x86/kernel/apic/msi.c +@@ -12,6 +12,7 @@ + */ + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c +index 2ce1c708b8ee..b958082c74a7 100644 +--- a/arch/x86/kernel/apic/vector.c ++++ b/arch/x86/kernel/apic/vector.c +@@ -11,6 +11,7 @@ + * published by the Free Software Foundation. + */ + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c +index 90574f731c05..dda741bd5789 100644 +--- a/arch/x86/kernel/cpu/amd.c ++++ b/arch/x86/kernel/cpu/amd.c +@@ -298,7 +298,6 @@ static int nearby_node(int apicid) + } + #endif + +-#ifdef CONFIG_SMP + /* + * Fix up cpu_core_id for pre-F17h systems to be in the + * [0 .. cores_per_node - 1] range. Not really needed but +@@ -315,6 +314,13 @@ static void legacy_fixup_core_id(struct cpuinfo_x86 *c) + c->cpu_core_id %= cus_per_node; + } + ++ ++static void amd_get_topology_early(struct cpuinfo_x86 *c) ++{ ++ if (cpu_has(c, X86_FEATURE_TOPOEXT)) ++ smp_num_siblings = ((cpuid_ebx(0x8000001e) >> 8) & 0xff) + 1; ++} ++ + /* + * Fixup core topology information for + * (1) AMD multi-node processors +@@ -333,7 +339,6 @@ static void amd_get_topology(struct cpuinfo_x86 *c) + cpuid(0x8000001e, &eax, &ebx, &ecx, &edx); + + node_id = ecx & 0xff; +- smp_num_siblings = ((ebx >> 8) & 0xff) + 1; + + if (c->x86 == 0x15) + c->cu_id = ebx & 0xff; +@@ -376,7 +381,6 @@ static void amd_get_topology(struct cpuinfo_x86 *c) + legacy_fixup_core_id(c); + } + } +-#endif + + /* + * On a AMD dual core setup the lower bits of the APIC id distinguish the cores. +@@ -384,7 +388,6 @@ static void amd_get_topology(struct cpuinfo_x86 *c) + */ + static void amd_detect_cmp(struct cpuinfo_x86 *c) + { +-#ifdef CONFIG_SMP + unsigned bits; + int cpu = smp_processor_id(); + +@@ -396,16 +399,11 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c) + /* use socket ID also for last level cache */ + per_cpu(cpu_llc_id, cpu) = c->phys_proc_id; + amd_get_topology(c); +-#endif + } + + u16 amd_get_nb_id(int cpu) + { +- u16 id = 0; +-#ifdef CONFIG_SMP +- id = per_cpu(cpu_llc_id, cpu); +-#endif +- return id; ++ return per_cpu(cpu_llc_id, cpu); + } + EXPORT_SYMBOL_GPL(amd_get_nb_id); + +@@ -579,6 +577,7 @@ static void bsp_init_amd(struct cpuinfo_x86 *c) + + static void early_init_amd(struct cpuinfo_x86 *c) + { ++ u64 value; + u32 dummy; + + early_init_amd_mc(c); +@@ -668,6 +667,22 @@ static void early_init_amd(struct cpuinfo_x86 *c) + clear_cpu_cap(c, X86_FEATURE_SME); + } + } ++ ++ /* Re-enable TopologyExtensions if switched off by BIOS */ ++ if (c->x86 == 0x15 && ++ (c->x86_model >= 0x10 && c->x86_model <= 0x6f) && ++ !cpu_has(c, X86_FEATURE_TOPOEXT)) { ++ ++ if (msr_set_bit(0xc0011005, 54) > 0) { ++ rdmsrl(0xc0011005, value); ++ if (value & BIT_64(54)) { ++ set_cpu_cap(c, X86_FEATURE_TOPOEXT); ++ pr_info_once(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n"); ++ } ++ } ++ } ++ ++ amd_get_topology_early(c); + } + + static void init_amd_k8(struct cpuinfo_x86 *c) +@@ -759,19 +774,6 @@ static void init_amd_bd(struct cpuinfo_x86 *c) + { + u64 value; + +- /* re-enable TopologyExtensions if switched off by BIOS */ +- if ((c->x86_model >= 0x10) && (c->x86_model <= 0x6f) && +- !cpu_has(c, X86_FEATURE_TOPOEXT)) { +- +- if (msr_set_bit(0xc0011005, 54) > 0) { +- rdmsrl(0xc0011005, value); +- if (value & BIT_64(54)) { +- set_cpu_cap(c, X86_FEATURE_TOPOEXT); +- pr_info_once(FW_INFO "CPU: Re-enabling disabled Topology Extensions Support.\n"); +- } +- } +- } +- + /* + * The way access filter has a performance penalty on some workloads. + * Disable it on the affected CPUs. +@@ -835,15 +837,8 @@ static void init_amd(struct cpuinfo_x86 *c) + + cpu_detect_cache_sizes(c); + +- /* Multi core CPU? */ +- if (c->extended_cpuid_level >= 0x80000008) { +- amd_detect_cmp(c); +- srat_detect_node(c); +- } +- +-#ifdef CONFIG_X86_32 +- detect_ht(c); +-#endif ++ amd_detect_cmp(c); ++ srat_detect_node(c); + + init_amd_cacheinfo(c); + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index 7416fc206b4a..edfc64a8a154 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -22,14 +22,17 @@ + #include + #include + #include ++#include + #include + #include + #include + #include + #include ++#include + + static void __init spectre_v2_select_mitigation(void); + static void __init ssb_select_mitigation(void); ++static void __init l1tf_select_mitigation(void); + + /* + * Our boot-time value of the SPEC_CTRL MSR. We read it once so that any +@@ -55,6 +58,12 @@ void __init check_bugs(void) + { + identify_boot_cpu(); + ++ /* ++ * identify_boot_cpu() initialized SMT support information, let the ++ * core code know. ++ */ ++ cpu_smt_check_topology_early(); ++ + if (!IS_ENABLED(CONFIG_SMP)) { + pr_info("CPU: "); + print_cpu_info(&boot_cpu_data); +@@ -81,6 +90,8 @@ void __init check_bugs(void) + */ + ssb_select_mitigation(); + ++ l1tf_select_mitigation(); ++ + #ifdef CONFIG_X86_32 + /* + * Check whether we are able to run this kernel safely on SMP. +@@ -311,23 +322,6 @@ static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) + return cmd; + } + +-/* Check for Skylake-like CPUs (for RSB handling) */ +-static bool __init is_skylake_era(void) +-{ +- if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && +- boot_cpu_data.x86 == 6) { +- switch (boot_cpu_data.x86_model) { +- case INTEL_FAM6_SKYLAKE_MOBILE: +- case INTEL_FAM6_SKYLAKE_DESKTOP: +- case INTEL_FAM6_SKYLAKE_X: +- case INTEL_FAM6_KABYLAKE_MOBILE: +- case INTEL_FAM6_KABYLAKE_DESKTOP: +- return true; +- } +- } +- return false; +-} +- + static void __init spectre_v2_select_mitigation(void) + { + enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); +@@ -388,22 +382,15 @@ retpoline_auto: + pr_info("%s\n", spectre_v2_strings[mode]); + + /* +- * If neither SMEP nor PTI are available, there is a risk of +- * hitting userspace addresses in the RSB after a context switch +- * from a shallow call stack to a deeper one. To prevent this fill +- * the entire RSB, even when using IBRS. ++ * If spectre v2 protection has been enabled, unconditionally fill ++ * RSB during a context switch; this protects against two independent ++ * issues: + * +- * Skylake era CPUs have a separate issue with *underflow* of the +- * RSB, when they will predict 'ret' targets from the generic BTB. +- * The proper mitigation for this is IBRS. If IBRS is not supported +- * or deactivated in favour of retpolines the RSB fill on context +- * switch is required. ++ * - RSB underflow (and switch to BTB) on Skylake+ ++ * - SpectreRSB variant of spectre v2 on X86_BUG_SPECTRE_V2 CPUs + */ +- if ((!boot_cpu_has(X86_FEATURE_PTI) && +- !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) { +- setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); +- pr_info("Spectre v2 mitigation: Filling RSB on context switch\n"); +- } ++ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); ++ pr_info("Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch\n"); + + /* Initialize Indirect Branch Prediction Barrier if supported */ + if (boot_cpu_has(X86_FEATURE_IBPB)) { +@@ -654,8 +641,121 @@ void x86_spec_ctrl_setup_ap(void) + x86_amd_ssb_disable(); + } + ++#undef pr_fmt ++#define pr_fmt(fmt) "L1TF: " fmt ++ ++/* Default mitigation for L1TF-affected CPUs */ ++enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_FLUSH; ++#if IS_ENABLED(CONFIG_KVM_INTEL) ++EXPORT_SYMBOL_GPL(l1tf_mitigation); ++ ++enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO; ++EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation); ++#endif ++ ++static void __init l1tf_select_mitigation(void) ++{ ++ u64 half_pa; ++ ++ if (!boot_cpu_has_bug(X86_BUG_L1TF)) ++ return; ++ ++ switch (l1tf_mitigation) { ++ case L1TF_MITIGATION_OFF: ++ case L1TF_MITIGATION_FLUSH_NOWARN: ++ case L1TF_MITIGATION_FLUSH: ++ break; ++ case L1TF_MITIGATION_FLUSH_NOSMT: ++ case L1TF_MITIGATION_FULL: ++ cpu_smt_disable(false); ++ break; ++ case L1TF_MITIGATION_FULL_FORCE: ++ cpu_smt_disable(true); ++ break; ++ } ++ ++#if CONFIG_PGTABLE_LEVELS == 2 ++ pr_warn("Kernel not compiled for PAE. No mitigation for L1TF\n"); ++ return; ++#endif ++ ++ /* ++ * This is extremely unlikely to happen because almost all ++ * systems have far more MAX_PA/2 than RAM can be fit into ++ * DIMM slots. ++ */ ++ half_pa = (u64)l1tf_pfn_limit() << PAGE_SHIFT; ++ if (e820__mapped_any(half_pa, ULLONG_MAX - half_pa, E820_TYPE_RAM)) { ++ pr_warn("System has more than MAX_PA/2 memory. L1TF mitigation not effective.\n"); ++ return; ++ } ++ ++ setup_force_cpu_cap(X86_FEATURE_L1TF_PTEINV); ++} ++ ++static int __init l1tf_cmdline(char *str) ++{ ++ if (!boot_cpu_has_bug(X86_BUG_L1TF)) ++ return 0; ++ ++ if (!str) ++ return -EINVAL; ++ ++ if (!strcmp(str, "off")) ++ l1tf_mitigation = L1TF_MITIGATION_OFF; ++ else if (!strcmp(str, "flush,nowarn")) ++ l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOWARN; ++ else if (!strcmp(str, "flush")) ++ l1tf_mitigation = L1TF_MITIGATION_FLUSH; ++ else if (!strcmp(str, "flush,nosmt")) ++ l1tf_mitigation = L1TF_MITIGATION_FLUSH_NOSMT; ++ else if (!strcmp(str, "full")) ++ l1tf_mitigation = L1TF_MITIGATION_FULL; ++ else if (!strcmp(str, "full,force")) ++ l1tf_mitigation = L1TF_MITIGATION_FULL_FORCE; ++ ++ return 0; ++} ++early_param("l1tf", l1tf_cmdline); ++ ++#undef pr_fmt ++ + #ifdef CONFIG_SYSFS + ++#define L1TF_DEFAULT_MSG "Mitigation: PTE Inversion" ++ ++#if IS_ENABLED(CONFIG_KVM_INTEL) ++static const char *l1tf_vmx_states[] = { ++ [VMENTER_L1D_FLUSH_AUTO] = "auto", ++ [VMENTER_L1D_FLUSH_NEVER] = "vulnerable", ++ [VMENTER_L1D_FLUSH_COND] = "conditional cache flushes", ++ [VMENTER_L1D_FLUSH_ALWAYS] = "cache flushes", ++ [VMENTER_L1D_FLUSH_EPT_DISABLED] = "EPT disabled", ++ [VMENTER_L1D_FLUSH_NOT_REQUIRED] = "flush not necessary" ++}; ++ ++static ssize_t l1tf_show_state(char *buf) ++{ ++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) ++ return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG); ++ ++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_EPT_DISABLED || ++ (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER && ++ cpu_smt_control == CPU_SMT_ENABLED)) ++ return sprintf(buf, "%s; VMX: %s\n", L1TF_DEFAULT_MSG, ++ l1tf_vmx_states[l1tf_vmx_mitigation]); ++ ++ return sprintf(buf, "%s; VMX: %s, SMT %s\n", L1TF_DEFAULT_MSG, ++ l1tf_vmx_states[l1tf_vmx_mitigation], ++ cpu_smt_control == CPU_SMT_ENABLED ? "vulnerable" : "disabled"); ++} ++#else ++static ssize_t l1tf_show_state(char *buf) ++{ ++ return sprintf(buf, "%s\n", L1TF_DEFAULT_MSG); ++} ++#endif ++ + static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr, + char *buf, unsigned int bug) + { +@@ -681,6 +781,10 @@ static ssize_t cpu_show_common(struct device *dev, struct device_attribute *attr + case X86_BUG_SPEC_STORE_BYPASS: + return sprintf(buf, "%s\n", ssb_strings[ssb_mode]); + ++ case X86_BUG_L1TF: ++ if (boot_cpu_has(X86_FEATURE_L1TF_PTEINV)) ++ return l1tf_show_state(buf); ++ break; + default: + break; + } +@@ -707,4 +811,9 @@ ssize_t cpu_show_spec_store_bypass(struct device *dev, struct device_attribute * + { + return cpu_show_common(dev, attr, buf, X86_BUG_SPEC_STORE_BYPASS); + } ++ ++ssize_t cpu_show_l1tf(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return cpu_show_common(dev, attr, buf, X86_BUG_L1TF); ++} + #endif +diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c +index 48e98964ecad..dd02ee4fa8cd 100644 +--- a/arch/x86/kernel/cpu/common.c ++++ b/arch/x86/kernel/cpu/common.c +@@ -66,6 +66,13 @@ cpumask_var_t cpu_callin_mask; + /* representing cpus for which sibling maps can be computed */ + cpumask_var_t cpu_sibling_setup_mask; + ++/* Number of siblings per CPU package */ ++int smp_num_siblings = 1; ++EXPORT_SYMBOL(smp_num_siblings); ++ ++/* Last level cache ID of each logical CPU */ ++DEFINE_PER_CPU_READ_MOSTLY(u16, cpu_llc_id) = BAD_APICID; ++ + /* correctly size the local cpu masks */ + void __init setup_cpu_local_masks(void) + { +@@ -614,33 +621,36 @@ static void cpu_detect_tlb(struct cpuinfo_x86 *c) + tlb_lld_4m[ENTRIES], tlb_lld_1g[ENTRIES]); + } + +-void detect_ht(struct cpuinfo_x86 *c) ++int detect_ht_early(struct cpuinfo_x86 *c) + { + #ifdef CONFIG_SMP + u32 eax, ebx, ecx, edx; +- int index_msb, core_bits; +- static bool printed; + + if (!cpu_has(c, X86_FEATURE_HT)) +- return; ++ return -1; + + if (cpu_has(c, X86_FEATURE_CMP_LEGACY)) +- goto out; ++ return -1; + + if (cpu_has(c, X86_FEATURE_XTOPOLOGY)) +- return; ++ return -1; + + cpuid(1, &eax, &ebx, &ecx, &edx); + + smp_num_siblings = (ebx & 0xff0000) >> 16; +- +- if (smp_num_siblings == 1) { ++ if (smp_num_siblings == 1) + pr_info_once("CPU0: Hyper-Threading is disabled\n"); +- goto out; +- } ++#endif ++ return 0; ++} + +- if (smp_num_siblings <= 1) +- goto out; ++void detect_ht(struct cpuinfo_x86 *c) ++{ ++#ifdef CONFIG_SMP ++ int index_msb, core_bits; ++ ++ if (detect_ht_early(c) < 0) ++ return; + + index_msb = get_count_order(smp_num_siblings); + c->phys_proc_id = apic->phys_pkg_id(c->initial_apicid, index_msb); +@@ -653,15 +663,6 @@ void detect_ht(struct cpuinfo_x86 *c) + + c->cpu_core_id = apic->phys_pkg_id(c->initial_apicid, index_msb) & + ((1 << core_bits) - 1); +- +-out: +- if (!printed && (c->x86_max_cores * smp_num_siblings) > 1) { +- pr_info("CPU: Physical Processor ID: %d\n", +- c->phys_proc_id); +- pr_info("CPU: Processor Core ID: %d\n", +- c->cpu_core_id); +- printed = 1; +- } + #endif + } + +@@ -933,6 +934,21 @@ static const __initconst struct x86_cpu_id cpu_no_spec_store_bypass[] = { + {} + }; + ++static const __initconst struct x86_cpu_id cpu_no_l1tf[] = { ++ /* in addition to cpu_no_speculation */ ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT1 }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_SILVERMONT2 }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_AIRMONT }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MERRIFIELD }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_MOOREFIELD }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GOLDMONT }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_DENVERTON }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_ATOM_GEMINI_LAKE }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNL }, ++ { X86_VENDOR_INTEL, 6, INTEL_FAM6_XEON_PHI_KNM }, ++ {} ++}; ++ + static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) + { + u64 ia32_cap = 0; +@@ -958,6 +974,11 @@ static void __init cpu_set_bug_bits(struct cpuinfo_x86 *c) + return; + + setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); ++ ++ if (x86_match_cpu(cpu_no_l1tf)) ++ return; ++ ++ setup_force_cpu_bug(X86_BUG_L1TF); + } + + /* +diff --git a/arch/x86/kernel/cpu/cpu.h b/arch/x86/kernel/cpu/cpu.h +index 37672d299e35..cca588407dca 100644 +--- a/arch/x86/kernel/cpu/cpu.h ++++ b/arch/x86/kernel/cpu/cpu.h +@@ -47,6 +47,8 @@ extern const struct cpu_dev *const __x86_cpu_dev_start[], + + extern void get_cpu_cap(struct cpuinfo_x86 *c); + extern void cpu_detect_cache_sizes(struct cpuinfo_x86 *c); ++extern int detect_extended_topology_early(struct cpuinfo_x86 *c); ++extern int detect_ht_early(struct cpuinfo_x86 *c); + + unsigned int aperfmperf_get_khz(int cpu); + +diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c +index 0b2330e19169..278be092b300 100644 +--- a/arch/x86/kernel/cpu/intel.c ++++ b/arch/x86/kernel/cpu/intel.c +@@ -301,6 +301,13 @@ static void early_init_intel(struct cpuinfo_x86 *c) + } + + check_mpx_erratum(c); ++ ++ /* ++ * Get the number of SMT siblings early from the extended topology ++ * leaf, if available. Otherwise try the legacy SMT detection. ++ */ ++ if (detect_extended_topology_early(c) < 0) ++ detect_ht_early(c); + } + + #ifdef CONFIG_X86_32 +diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c +index 4fc0e08a30b9..387a8f44fba1 100644 +--- a/arch/x86/kernel/cpu/microcode/core.c ++++ b/arch/x86/kernel/cpu/microcode/core.c +@@ -509,12 +509,20 @@ static struct platform_device *microcode_pdev; + + static int check_online_cpus(void) + { +- if (num_online_cpus() == num_present_cpus()) +- return 0; ++ unsigned int cpu; + +- pr_err("Not all CPUs online, aborting microcode update.\n"); ++ /* ++ * Make sure all CPUs are online. It's fine for SMT to be disabled if ++ * all the primary threads are still online. ++ */ ++ for_each_present_cpu(cpu) { ++ if (topology_is_primary_thread(cpu) && !cpu_online(cpu)) { ++ pr_err("Not all CPUs online, aborting microcode update.\n"); ++ return -EINVAL; ++ } ++ } + +- return -EINVAL; ++ return 0; + } + + static atomic_t late_cpus_in; +diff --git a/arch/x86/kernel/cpu/topology.c b/arch/x86/kernel/cpu/topology.c +index b099024d339c..19c6e800e816 100644 +--- a/arch/x86/kernel/cpu/topology.c ++++ b/arch/x86/kernel/cpu/topology.c +@@ -27,16 +27,13 @@ + * exists, use it for populating initial_apicid and cpu topology + * detection. + */ +-void detect_extended_topology(struct cpuinfo_x86 *c) ++int detect_extended_topology_early(struct cpuinfo_x86 *c) + { + #ifdef CONFIG_SMP +- unsigned int eax, ebx, ecx, edx, sub_index; +- unsigned int ht_mask_width, core_plus_mask_width; +- unsigned int core_select_mask, core_level_siblings; +- static bool printed; ++ unsigned int eax, ebx, ecx, edx; + + if (c->cpuid_level < 0xb) +- return; ++ return -1; + + cpuid_count(0xb, SMT_LEVEL, &eax, &ebx, &ecx, &edx); + +@@ -44,7 +41,7 @@ void detect_extended_topology(struct cpuinfo_x86 *c) + * check if the cpuid leaf 0xb is actually implemented. + */ + if (ebx == 0 || (LEAFB_SUBTYPE(ecx) != SMT_TYPE)) +- return; ++ return -1; + + set_cpu_cap(c, X86_FEATURE_XTOPOLOGY); + +@@ -52,10 +49,30 @@ void detect_extended_topology(struct cpuinfo_x86 *c) + * initial apic id, which also represents 32-bit extended x2apic id. + */ + c->initial_apicid = edx; ++ smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx); ++#endif ++ return 0; ++} ++ ++/* ++ * Check for extended topology enumeration cpuid leaf 0xb and if it ++ * exists, use it for populating initial_apicid and cpu topology ++ * detection. ++ */ ++void detect_extended_topology(struct cpuinfo_x86 *c) ++{ ++#ifdef CONFIG_SMP ++ unsigned int eax, ebx, ecx, edx, sub_index; ++ unsigned int ht_mask_width, core_plus_mask_width; ++ unsigned int core_select_mask, core_level_siblings; ++ ++ if (detect_extended_topology_early(c) < 0) ++ return; + + /* + * Populate HT related information from sub-leaf level 0. + */ ++ cpuid_count(0xb, SMT_LEVEL, &eax, &ebx, &ecx, &edx); + core_level_siblings = smp_num_siblings = LEVEL_MAX_SIBLINGS(ebx); + core_plus_mask_width = ht_mask_width = BITS_SHIFT_NEXT_LEVEL(eax); + +@@ -86,15 +103,5 @@ void detect_extended_topology(struct cpuinfo_x86 *c) + c->apicid = apic->phys_pkg_id(c->initial_apicid, 0); + + c->x86_max_cores = (core_level_siblings / smp_num_siblings); +- +- if (!printed) { +- pr_info("CPU: Physical Processor ID: %d\n", +- c->phys_proc_id); +- if (c->x86_max_cores > 1) +- pr_info("CPU: Processor Core ID: %d\n", +- c->cpu_core_id); +- printed = 1; +- } +- return; + #endif + } +diff --git a/arch/x86/kernel/fpu/core.c b/arch/x86/kernel/fpu/core.c +index f92a6593de1e..2ea85b32421a 100644 +--- a/arch/x86/kernel/fpu/core.c ++++ b/arch/x86/kernel/fpu/core.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #include + #include +diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c +index 01ebcb6f263e..7acb87cb2da8 100644 +--- a/arch/x86/kernel/ftrace.c ++++ b/arch/x86/kernel/ftrace.c +@@ -27,6 +27,7 @@ + + #include + #include ++#include + #include + #include + +diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c +index 8ce4212e2b8d..afa1a204bc6d 100644 +--- a/arch/x86/kernel/hpet.c ++++ b/arch/x86/kernel/hpet.c +@@ -1,6 +1,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/i8259.c b/arch/x86/kernel/i8259.c +index 8f5cb2c7060c..02abc134367f 100644 +--- a/arch/x86/kernel/i8259.c ++++ b/arch/x86/kernel/i8259.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/idt.c b/arch/x86/kernel/idt.c +index 0c5256653d6c..38c3d5790970 100644 +--- a/arch/x86/kernel/idt.c ++++ b/arch/x86/kernel/idt.c +@@ -8,6 +8,7 @@ + #include + #include + #include ++#include + + struct idt_data { + unsigned int vector; +diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c +index aa9d51eea9d0..3c2326b59820 100644 +--- a/arch/x86/kernel/irq.c ++++ b/arch/x86/kernel/irq.c +@@ -10,6 +10,7 @@ + #include + #include + #include ++#include + + #include + #include +diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c +index c1bdbd3d3232..95600a99ae93 100644 +--- a/arch/x86/kernel/irq_32.c ++++ b/arch/x86/kernel/irq_32.c +@@ -11,6 +11,7 @@ + + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c +index d86e344f5b3d..0469cd078db1 100644 +--- a/arch/x86/kernel/irq_64.c ++++ b/arch/x86/kernel/irq_64.c +@@ -11,6 +11,7 @@ + + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c +index 1e4094eba15e..40f83d0d7b8a 100644 +--- a/arch/x86/kernel/irqinit.c ++++ b/arch/x86/kernel/irqinit.c +@@ -5,6 +5,7 @@ + #include + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c +index f1030c522e06..65452d555f05 100644 +--- a/arch/x86/kernel/kprobes/core.c ++++ b/arch/x86/kernel/kprobes/core.c +@@ -63,6 +63,7 @@ + #include + #include + #include ++#include + + #include "common.h" + +@@ -394,8 +395,6 @@ int __copy_instruction(u8 *dest, u8 *src, struct insn *insn) + - (u8 *) dest; + if ((s64) (s32) newdisp != newdisp) { + pr_err("Kprobes error: new displacement does not fit into s32 (%llx)\n", newdisp); +- pr_err("\tSrc: %p, Dest: %p, old disp: %x\n", +- src, dest, insn->displacement.value); + return 0; + } + disp = (u8 *) dest + insn_offset_displacement(insn); +@@ -621,8 +620,7 @@ static int reenter_kprobe(struct kprobe *p, struct pt_regs *regs, + * Raise a BUG or we'll continue in an endless reentering loop + * and eventually a stack overflow. + */ +- printk(KERN_WARNING "Unrecoverable kprobe detected at %p.\n", +- p->addr); ++ pr_err("Unrecoverable kprobe detected.\n"); + dump_kprobe(p); + BUG(); + default: +diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c +index e1df9ef5d78c..f3559b84cd75 100644 +--- a/arch/x86/kernel/paravirt.c ++++ b/arch/x86/kernel/paravirt.c +@@ -88,10 +88,12 @@ unsigned paravirt_patch_call(void *insnbuf, + struct branch *b = insnbuf; + unsigned long delta = (unsigned long)target - (addr+5); + +- if (tgt_clobbers & ~site_clobbers) +- return len; /* target would clobber too much for this site */ +- if (len < 5) ++ if (len < 5) { ++#ifdef CONFIG_RETPOLINE ++ WARN_ONCE("Failing to patch indirect CALL in %ps\n", (void *)addr); ++#endif + return len; /* call too long for patch site */ ++ } + + b->opcode = 0xe8; /* call */ + b->delta = delta; +@@ -106,8 +108,12 @@ unsigned paravirt_patch_jmp(void *insnbuf, const void *target, + struct branch *b = insnbuf; + unsigned long delta = (unsigned long)target - (addr+5); + +- if (len < 5) ++ if (len < 5) { ++#ifdef CONFIG_RETPOLINE ++ WARN_ONCE("Failing to patch indirect JMP in %ps\n", (void *)addr); ++#endif + return len; /* call too long for patch site */ ++ } + + b->opcode = 0xe9; /* jmp */ + b->delta = delta; +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index efbcf5283520..dcb00acb6583 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -852,6 +852,12 @@ void __init setup_arch(char **cmdline_p) + memblock_reserve(__pa_symbol(_text), + (unsigned long)__bss_stop - (unsigned long)_text); + ++ /* ++ * Make sure page 0 is always reserved because on systems with ++ * L1TF its contents can be leaked to user processes. ++ */ ++ memblock_reserve(0, PAGE_SIZE); ++ + early_reserve_initrd(); + + /* +diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c +index 5c574dff4c1a..04adc8d60aed 100644 +--- a/arch/x86/kernel/smp.c ++++ b/arch/x86/kernel/smp.c +@@ -261,6 +261,7 @@ __visible void __irq_entry smp_reschedule_interrupt(struct pt_regs *regs) + { + ack_APIC_irq(); + inc_irq_stat(irq_resched_count); ++ kvm_set_cpu_l1tf_flush_l1d(); + + if (trace_resched_ipi_enabled()) { + /* +diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c +index 344d3c160f8d..5ebb0dbcf4f7 100644 +--- a/arch/x86/kernel/smpboot.c ++++ b/arch/x86/kernel/smpboot.c +@@ -78,13 +78,7 @@ + #include + #include + #include +- +-/* Number of siblings per CPU package */ +-int smp_num_siblings = 1; +-EXPORT_SYMBOL(smp_num_siblings); +- +-/* Last level cache ID of each logical CPU */ +-DEFINE_PER_CPU_READ_MOSTLY(u16, cpu_llc_id) = BAD_APICID; ++#include + + /* representing HT siblings of each logical CPU */ + DEFINE_PER_CPU_READ_MOSTLY(cpumask_var_t, cpu_sibling_map); +@@ -311,6 +305,23 @@ found: + return 0; + } + ++/** ++ * topology_is_primary_thread - Check whether CPU is the primary SMT thread ++ * @cpu: CPU to check ++ */ ++bool topology_is_primary_thread(unsigned int cpu) ++{ ++ return apic_id_is_primary_thread(per_cpu(x86_cpu_to_apicid, cpu)); ++} ++ ++/** ++ * topology_smt_supported - Check whether SMT is supported by the CPUs ++ */ ++bool topology_smt_supported(void) ++{ ++ return smp_num_siblings > 1; ++} ++ + /** + * topology_phys_to_logical_pkg - Map a physical package id to a logical + * +diff --git a/arch/x86/kernel/time.c b/arch/x86/kernel/time.c +index 879af864d99a..49a5c394f3ed 100644 +--- a/arch/x86/kernel/time.c ++++ b/arch/x86/kernel/time.c +@@ -12,6 +12,7 @@ + + #include + #include ++#include + #include + #include + #include +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 2ef2f1fe875b..00e2ae033a0f 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -3825,6 +3825,7 @@ int kvm_handle_page_fault(struct kvm_vcpu *vcpu, u64 error_code, + { + int r = 1; + ++ vcpu->arch.l1tf_flush_l1d = true; + switch (vcpu->arch.apf.host_apf_reason) { + default: + trace_kvm_page_fault(fault_address, error_code); +diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c +index cfa155078ebb..282bbcbf3b6a 100644 +--- a/arch/x86/kvm/svm.c ++++ b/arch/x86/kvm/svm.c +@@ -175,6 +175,8 @@ struct vcpu_svm { + uint64_t sysenter_eip; + uint64_t tsc_aux; + ++ u64 msr_decfg; ++ + u64 next_rip; + + u64 host_user_msrs[NR_HOST_SAVE_USER_MSRS]; +@@ -1616,6 +1618,7 @@ static void svm_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + u32 dummy; + u32 eax = 1; + ++ vcpu->arch.microcode_version = 0x01000065; + svm->spec_ctrl = 0; + svm->virt_spec_ctrl = 0; + +@@ -3555,6 +3558,22 @@ static int cr8_write_interception(struct vcpu_svm *svm) + return 0; + } + ++static int svm_get_msr_feature(struct kvm_msr_entry *msr) ++{ ++ msr->data = 0; ++ ++ switch (msr->index) { ++ case MSR_F10H_DECFG: ++ if (boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) ++ msr->data |= MSR_F10H_DECFG_LFENCE_SERIALIZE; ++ break; ++ default: ++ return 1; ++ } ++ ++ return 0; ++} ++ + static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + { + struct vcpu_svm *svm = to_svm(vcpu); +@@ -3637,9 +3656,6 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + + msr_info->data = svm->virt_spec_ctrl; + break; +- case MSR_IA32_UCODE_REV: +- msr_info->data = 0x01000065; +- break; + case MSR_F15H_IC_CFG: { + + int family, model; +@@ -3657,6 +3673,9 @@ static int svm_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + msr_info->data = 0x1E; + } + break; ++ case MSR_F10H_DECFG: ++ msr_info->data = svm->msr_decfg; ++ break; + default: + return kvm_get_msr_common(vcpu, msr_info); + } +@@ -3845,6 +3864,24 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) + case MSR_VM_IGNNE: + vcpu_unimpl(vcpu, "unimplemented wrmsr: 0x%x data 0x%llx\n", ecx, data); + break; ++ case MSR_F10H_DECFG: { ++ struct kvm_msr_entry msr_entry; ++ ++ msr_entry.index = msr->index; ++ if (svm_get_msr_feature(&msr_entry)) ++ return 1; ++ ++ /* Check the supported bits */ ++ if (data & ~msr_entry.data) ++ return 1; ++ ++ /* Don't allow the guest to change a bit, #GP */ ++ if (!msr->host_initiated && (data ^ msr_entry.data)) ++ return 1; ++ ++ svm->msr_decfg = data; ++ break; ++ } + case MSR_IA32_APICBASE: + if (kvm_vcpu_apicv_active(vcpu)) + avic_update_vapic_bar(to_svm(vcpu), data); +@@ -5588,6 +5625,7 @@ static struct kvm_x86_ops svm_x86_ops __ro_after_init = { + .vcpu_unblocking = svm_vcpu_unblocking, + + .update_bp_intercept = update_bp_intercept, ++ .get_msr_feature = svm_get_msr_feature, + .get_msr = svm_get_msr, + .set_msr = svm_set_msr, + .get_segment_base = svm_get_segment_base, +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 8d000fde1414..f015ca3997d9 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -191,6 +191,150 @@ module_param(ple_window_max, int, S_IRUGO); + + extern const ulong vmx_return; + ++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_should_flush); ++static DEFINE_STATIC_KEY_FALSE(vmx_l1d_flush_cond); ++static DEFINE_MUTEX(vmx_l1d_flush_mutex); ++ ++/* Storage for pre module init parameter parsing */ ++static enum vmx_l1d_flush_state __read_mostly vmentry_l1d_flush_param = VMENTER_L1D_FLUSH_AUTO; ++ ++static const struct { ++ const char *option; ++ enum vmx_l1d_flush_state cmd; ++} vmentry_l1d_param[] = { ++ {"auto", VMENTER_L1D_FLUSH_AUTO}, ++ {"never", VMENTER_L1D_FLUSH_NEVER}, ++ {"cond", VMENTER_L1D_FLUSH_COND}, ++ {"always", VMENTER_L1D_FLUSH_ALWAYS}, ++}; ++ ++#define L1D_CACHE_ORDER 4 ++static void *vmx_l1d_flush_pages; ++ ++static int vmx_setup_l1d_flush(enum vmx_l1d_flush_state l1tf) ++{ ++ struct page *page; ++ unsigned int i; ++ ++ if (!enable_ept) { ++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_EPT_DISABLED; ++ return 0; ++ } ++ ++ if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) { ++ u64 msr; ++ ++ rdmsrl(MSR_IA32_ARCH_CAPABILITIES, msr); ++ if (msr & ARCH_CAP_SKIP_VMENTRY_L1DFLUSH) { ++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_NOT_REQUIRED; ++ return 0; ++ } ++ } ++ ++ /* If set to auto use the default l1tf mitigation method */ ++ if (l1tf == VMENTER_L1D_FLUSH_AUTO) { ++ switch (l1tf_mitigation) { ++ case L1TF_MITIGATION_OFF: ++ l1tf = VMENTER_L1D_FLUSH_NEVER; ++ break; ++ case L1TF_MITIGATION_FLUSH_NOWARN: ++ case L1TF_MITIGATION_FLUSH: ++ case L1TF_MITIGATION_FLUSH_NOSMT: ++ l1tf = VMENTER_L1D_FLUSH_COND; ++ break; ++ case L1TF_MITIGATION_FULL: ++ case L1TF_MITIGATION_FULL_FORCE: ++ l1tf = VMENTER_L1D_FLUSH_ALWAYS; ++ break; ++ } ++ } else if (l1tf_mitigation == L1TF_MITIGATION_FULL_FORCE) { ++ l1tf = VMENTER_L1D_FLUSH_ALWAYS; ++ } ++ ++ if (l1tf != VMENTER_L1D_FLUSH_NEVER && !vmx_l1d_flush_pages && ++ !boot_cpu_has(X86_FEATURE_FLUSH_L1D)) { ++ page = alloc_pages(GFP_KERNEL, L1D_CACHE_ORDER); ++ if (!page) ++ return -ENOMEM; ++ vmx_l1d_flush_pages = page_address(page); ++ ++ /* ++ * Initialize each page with a different pattern in ++ * order to protect against KSM in the nested ++ * virtualization case. ++ */ ++ for (i = 0; i < 1u << L1D_CACHE_ORDER; ++i) { ++ memset(vmx_l1d_flush_pages + i * PAGE_SIZE, i + 1, ++ PAGE_SIZE); ++ } ++ } ++ ++ l1tf_vmx_mitigation = l1tf; ++ ++ if (l1tf != VMENTER_L1D_FLUSH_NEVER) ++ static_branch_enable(&vmx_l1d_should_flush); ++ else ++ static_branch_disable(&vmx_l1d_should_flush); ++ ++ if (l1tf == VMENTER_L1D_FLUSH_COND) ++ static_branch_enable(&vmx_l1d_flush_cond); ++ else ++ static_branch_disable(&vmx_l1d_flush_cond); ++ return 0; ++} ++ ++static int vmentry_l1d_flush_parse(const char *s) ++{ ++ unsigned int i; ++ ++ if (s) { ++ for (i = 0; i < ARRAY_SIZE(vmentry_l1d_param); i++) { ++ if (sysfs_streq(s, vmentry_l1d_param[i].option)) ++ return vmentry_l1d_param[i].cmd; ++ } ++ } ++ return -EINVAL; ++} ++ ++static int vmentry_l1d_flush_set(const char *s, const struct kernel_param *kp) ++{ ++ int l1tf, ret; ++ ++ if (!boot_cpu_has(X86_BUG_L1TF)) ++ return 0; ++ ++ l1tf = vmentry_l1d_flush_parse(s); ++ if (l1tf < 0) ++ return l1tf; ++ ++ /* ++ * Has vmx_init() run already? If not then this is the pre init ++ * parameter parsing. In that case just store the value and let ++ * vmx_init() do the proper setup after enable_ept has been ++ * established. ++ */ ++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_AUTO) { ++ vmentry_l1d_flush_param = l1tf; ++ return 0; ++ } ++ ++ mutex_lock(&vmx_l1d_flush_mutex); ++ ret = vmx_setup_l1d_flush(l1tf); ++ mutex_unlock(&vmx_l1d_flush_mutex); ++ return ret; ++} ++ ++static int vmentry_l1d_flush_get(char *s, const struct kernel_param *kp) ++{ ++ return sprintf(s, "%s\n", vmentry_l1d_param[l1tf_vmx_mitigation].option); ++} ++ ++static const struct kernel_param_ops vmentry_l1d_flush_ops = { ++ .set = vmentry_l1d_flush_set, ++ .get = vmentry_l1d_flush_get, ++}; ++module_param_cb(vmentry_l1d_flush, &vmentry_l1d_flush_ops, NULL, 0644); ++ + #define NR_AUTOLOAD_MSRS 8 + + struct vmcs { +@@ -567,6 +711,11 @@ static inline int pi_test_sn(struct pi_desc *pi_desc) + (unsigned long *)&pi_desc->control); + } + ++struct vmx_msrs { ++ unsigned int nr; ++ struct vmx_msr_entry val[NR_AUTOLOAD_MSRS]; ++}; ++ + struct vcpu_vmx { + struct kvm_vcpu vcpu; + unsigned long host_rsp; +@@ -600,9 +749,8 @@ struct vcpu_vmx { + struct loaded_vmcs *loaded_vmcs; + bool __launched; /* temporary, used in vmx_vcpu_run */ + struct msr_autoload { +- unsigned nr; +- struct vmx_msr_entry guest[NR_AUTOLOAD_MSRS]; +- struct vmx_msr_entry host[NR_AUTOLOAD_MSRS]; ++ struct vmx_msrs guest; ++ struct vmx_msrs host; + } msr_autoload; + struct { + int loaded; +@@ -1967,9 +2115,20 @@ static void clear_atomic_switch_msr_special(struct vcpu_vmx *vmx, + vm_exit_controls_clearbit(vmx, exit); + } + ++static int find_msr(struct vmx_msrs *m, unsigned int msr) ++{ ++ unsigned int i; ++ ++ for (i = 0; i < m->nr; ++i) { ++ if (m->val[i].index == msr) ++ return i; ++ } ++ return -ENOENT; ++} ++ + static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr) + { +- unsigned i; ++ int i; + struct msr_autoload *m = &vmx->msr_autoload; + + switch (msr) { +@@ -1990,18 +2149,21 @@ static void clear_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr) + } + break; + } ++ i = find_msr(&m->guest, msr); ++ if (i < 0) ++ goto skip_guest; ++ --m->guest.nr; ++ m->guest.val[i] = m->guest.val[m->guest.nr]; ++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr); + +- for (i = 0; i < m->nr; ++i) +- if (m->guest[i].index == msr) +- break; +- +- if (i == m->nr) ++skip_guest: ++ i = find_msr(&m->host, msr); ++ if (i < 0) + return; +- --m->nr; +- m->guest[i] = m->guest[m->nr]; +- m->host[i] = m->host[m->nr]; +- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->nr); +- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->nr); ++ ++ --m->host.nr; ++ m->host.val[i] = m->host.val[m->host.nr]; ++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr); + } + + static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx, +@@ -2016,9 +2178,9 @@ static void add_atomic_switch_msr_special(struct vcpu_vmx *vmx, + } + + static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr, +- u64 guest_val, u64 host_val) ++ u64 guest_val, u64 host_val, bool entry_only) + { +- unsigned i; ++ int i, j = 0; + struct msr_autoload *m = &vmx->msr_autoload; + + switch (msr) { +@@ -2053,24 +2215,31 @@ static void add_atomic_switch_msr(struct vcpu_vmx *vmx, unsigned msr, + wrmsrl(MSR_IA32_PEBS_ENABLE, 0); + } + +- for (i = 0; i < m->nr; ++i) +- if (m->guest[i].index == msr) +- break; ++ i = find_msr(&m->guest, msr); ++ if (!entry_only) ++ j = find_msr(&m->host, msr); + +- if (i == NR_AUTOLOAD_MSRS) { ++ if (i == NR_AUTOLOAD_MSRS || j == NR_AUTOLOAD_MSRS) { + printk_once(KERN_WARNING "Not enough msr switch entries. " + "Can't add msr %x\n", msr); + return; +- } else if (i == m->nr) { +- ++m->nr; +- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->nr); +- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->nr); + } ++ if (i < 0) { ++ i = m->guest.nr++; ++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, m->guest.nr); ++ } ++ m->guest.val[i].index = msr; ++ m->guest.val[i].value = guest_val; + +- m->guest[i].index = msr; +- m->guest[i].value = guest_val; +- m->host[i].index = msr; +- m->host[i].value = host_val; ++ if (entry_only) ++ return; ++ ++ if (j < 0) { ++ j = m->host.nr++; ++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, m->host.nr); ++ } ++ m->host.val[j].index = msr; ++ m->host.val[j].value = host_val; + } + + static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) +@@ -2114,7 +2283,7 @@ static bool update_transition_efer(struct vcpu_vmx *vmx, int efer_offset) + guest_efer &= ~EFER_LME; + if (guest_efer != host_efer) + add_atomic_switch_msr(vmx, MSR_EFER, +- guest_efer, host_efer); ++ guest_efer, host_efer, false); + return false; + } else { + guest_efer &= ~ignore_bits; +@@ -3266,6 +3435,11 @@ static inline bool vmx_feature_control_msr_valid(struct kvm_vcpu *vcpu, + return !(val & ~valid_bits); + } + ++static int vmx_get_msr_feature(struct kvm_msr_entry *msr) ++{ ++ return 1; ++} ++ + /* + * Reads an msr value (of 'msr_index') into 'pdata'. + * Returns 0 on success, non-0 otherwise. +@@ -3523,7 +3697,7 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + vcpu->arch.ia32_xss = data; + if (vcpu->arch.ia32_xss != host_xss) + add_atomic_switch_msr(vmx, MSR_IA32_XSS, +- vcpu->arch.ia32_xss, host_xss); ++ vcpu->arch.ia32_xss, host_xss, false); + else + clear_atomic_switch_msr(vmx, MSR_IA32_XSS); + break; +@@ -5714,9 +5888,9 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) + + vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0); + vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0); +- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host)); ++ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val)); + vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0); +- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest)); ++ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val)); + + if (vmcs_config.vmentry_ctrl & VM_ENTRY_LOAD_IA32_PAT) + vmcs_write64(GUEST_IA32_PAT, vmx->vcpu.arch.pat); +@@ -5736,8 +5910,7 @@ static int vmx_vcpu_setup(struct vcpu_vmx *vmx) + ++vmx->nmsrs; + } + +- if (boot_cpu_has(X86_FEATURE_ARCH_CAPABILITIES)) +- rdmsrl(MSR_IA32_ARCH_CAPABILITIES, vmx->arch_capabilities); ++ vmx->arch_capabilities = kvm_get_arch_capabilities(); + + vm_exit_controls_init(vmx, vmcs_config.vmexit_ctrl); + +@@ -5770,6 +5943,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) + vmx->rmode.vm86_active = 0; + vmx->spec_ctrl = 0; + ++ vcpu->arch.microcode_version = 0x100000000ULL; + vmx->vcpu.arch.regs[VCPU_REGS_RDX] = get_rdx_init_val(); + kvm_set_cr8(vcpu, 0); + +@@ -8987,6 +9161,79 @@ static int vmx_handle_exit(struct kvm_vcpu *vcpu) + } + } + ++/* ++ * Software based L1D cache flush which is used when microcode providing ++ * the cache control MSR is not loaded. ++ * ++ * The L1D cache is 32 KiB on Nehalem and later microarchitectures, but to ++ * flush it is required to read in 64 KiB because the replacement algorithm ++ * is not exactly LRU. This could be sized at runtime via topology ++ * information but as all relevant affected CPUs have 32KiB L1D cache size ++ * there is no point in doing so. ++ */ ++#define L1D_CACHE_ORDER 4 ++static void *vmx_l1d_flush_pages; ++ ++static void vmx_l1d_flush(struct kvm_vcpu *vcpu) ++{ ++ int size = PAGE_SIZE << L1D_CACHE_ORDER; ++ ++ /* ++ * This code is only executed when the the flush mode is 'cond' or ++ * 'always' ++ */ ++ if (static_branch_likely(&vmx_l1d_flush_cond)) { ++ bool flush_l1d; ++ ++ /* ++ * Clear the per-vcpu flush bit, it gets set again ++ * either from vcpu_run() or from one of the unsafe ++ * VMEXIT handlers. ++ */ ++ flush_l1d = vcpu->arch.l1tf_flush_l1d; ++ vcpu->arch.l1tf_flush_l1d = false; ++ ++ /* ++ * Clear the per-cpu flush bit, it gets set again from ++ * the interrupt handlers. ++ */ ++ flush_l1d |= kvm_get_cpu_l1tf_flush_l1d(); ++ kvm_clear_cpu_l1tf_flush_l1d(); ++ ++ if (!flush_l1d) ++ return; ++ } ++ ++ vcpu->stat.l1d_flush++; ++ ++ if (static_cpu_has(X86_FEATURE_FLUSH_L1D)) { ++ wrmsrl(MSR_IA32_FLUSH_CMD, L1D_FLUSH); ++ return; ++ } ++ ++ asm volatile( ++ /* First ensure the pages are in the TLB */ ++ "xorl %%eax, %%eax\n" ++ ".Lpopulate_tlb:\n\t" ++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t" ++ "addl $4096, %%eax\n\t" ++ "cmpl %%eax, %[size]\n\t" ++ "jne .Lpopulate_tlb\n\t" ++ "xorl %%eax, %%eax\n\t" ++ "cpuid\n\t" ++ /* Now fill the cache */ ++ "xorl %%eax, %%eax\n" ++ ".Lfill_cache:\n" ++ "movzbl (%[flush_pages], %%" _ASM_AX "), %%ecx\n\t" ++ "addl $64, %%eax\n\t" ++ "cmpl %%eax, %[size]\n\t" ++ "jne .Lfill_cache\n\t" ++ "lfence\n" ++ :: [flush_pages] "r" (vmx_l1d_flush_pages), ++ [size] "r" (size) ++ : "eax", "ebx", "ecx", "edx"); ++} ++ + static void update_cr8_intercept(struct kvm_vcpu *vcpu, int tpr, int irr) + { + struct vmcs12 *vmcs12 = get_vmcs12(vcpu); +@@ -9390,7 +9637,7 @@ static void atomic_switch_perf_msrs(struct vcpu_vmx *vmx) + clear_atomic_switch_msr(vmx, msrs[i].msr); + else + add_atomic_switch_msr(vmx, msrs[i].msr, msrs[i].guest, +- msrs[i].host); ++ msrs[i].host, false); + } + + static void vmx_arm_hv_timer(struct kvm_vcpu *vcpu) +@@ -9483,6 +9730,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) + + vmx->__launched = vmx->loaded_vmcs->launched; + ++ if (static_branch_unlikely(&vmx_l1d_should_flush)) ++ vmx_l1d_flush(vcpu); ++ + asm( + /* Store host registers */ + "push %%" _ASM_DX "; push %%" _ASM_BP ";" +@@ -9835,6 +10085,37 @@ free_vcpu: + return ERR_PTR(err); + } + ++#define L1TF_MSG_SMT "L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n" ++#define L1TF_MSG_L1D "L1TF CPU bug present and virtualization mitigation disabled, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/l1tf.html for details.\n" ++ ++static int vmx_vm_init(struct kvm *kvm) ++{ ++ if (boot_cpu_has(X86_BUG_L1TF) && enable_ept) { ++ switch (l1tf_mitigation) { ++ case L1TF_MITIGATION_OFF: ++ case L1TF_MITIGATION_FLUSH_NOWARN: ++ /* 'I explicitly don't care' is set */ ++ break; ++ case L1TF_MITIGATION_FLUSH: ++ case L1TF_MITIGATION_FLUSH_NOSMT: ++ case L1TF_MITIGATION_FULL: ++ /* ++ * Warn upon starting the first VM in a potentially ++ * insecure environment. ++ */ ++ if (cpu_smt_control == CPU_SMT_ENABLED) ++ pr_warn_once(L1TF_MSG_SMT); ++ if (l1tf_vmx_mitigation == VMENTER_L1D_FLUSH_NEVER) ++ pr_warn_once(L1TF_MSG_L1D); ++ break; ++ case L1TF_MITIGATION_FULL_FORCE: ++ /* Flush is enforced */ ++ break; ++ } ++ } ++ return 0; ++} ++ + static void __init vmx_check_processor_compat(void *rtn) + { + struct vmcs_config vmcs_conf; +@@ -10774,10 +11055,10 @@ static int prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, + * Set the MSR load/store lists to match L0's settings. + */ + vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0); +- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.nr); +- vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host)); +- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.nr); +- vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest)); ++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); ++ vmcs_write64(VM_EXIT_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.host.val)); ++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr); ++ vmcs_write64(VM_ENTRY_MSR_LOAD_ADDR, __pa(vmx->msr_autoload.guest.val)); + + /* + * HOST_RSP is normally set correctly in vmx_vcpu_run() just before +@@ -11202,6 +11483,9 @@ static int nested_vmx_run(struct kvm_vcpu *vcpu, bool launch) + if (ret) + return ret; + ++ /* Hide L1D cache contents from the nested guest. */ ++ vmx->vcpu.arch.l1tf_flush_l1d = true; ++ + /* + * If we're entering a halted L2 vcpu and the L2 vcpu won't be woken + * by event injection, halt vcpu. +@@ -11712,8 +11996,8 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, + vmx_segment_cache_clear(vmx); + + /* Update any VMCS fields that might have changed while L2 ran */ +- vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.nr); +- vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.nr); ++ vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, vmx->msr_autoload.host.nr); ++ vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, vmx->msr_autoload.guest.nr); + vmcs_write64(TSC_OFFSET, vcpu->arch.tsc_offset); + if (vmx->hv_deadline_tsc == -1) + vmcs_clear_bits(PIN_BASED_VM_EXEC_CONTROL, +@@ -12225,6 +12509,8 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { + .cpu_has_accelerated_tpr = report_flexpriority, + .has_emulated_msr = vmx_has_emulated_msr, + ++ .vm_init = vmx_vm_init, ++ + .vcpu_create = vmx_create_vcpu, + .vcpu_free = vmx_free_vcpu, + .vcpu_reset = vmx_vcpu_reset, +@@ -12234,6 +12520,7 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { + .vcpu_put = vmx_vcpu_put, + + .update_bp_intercept = update_exception_bitmap, ++ .get_msr_feature = vmx_get_msr_feature, + .get_msr = vmx_get_msr, + .set_msr = vmx_set_msr, + .get_segment_base = vmx_get_segment_base, +@@ -12341,22 +12628,18 @@ static struct kvm_x86_ops vmx_x86_ops __ro_after_init = { + .setup_mce = vmx_setup_mce, + }; + +-static int __init vmx_init(void) ++static void vmx_cleanup_l1d_flush(void) + { +- int r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx), +- __alignof__(struct vcpu_vmx), THIS_MODULE); +- if (r) +- return r; +- +-#ifdef CONFIG_KEXEC_CORE +- rcu_assign_pointer(crash_vmclear_loaded_vmcss, +- crash_vmclear_local_loaded_vmcss); +-#endif +- +- return 0; ++ if (vmx_l1d_flush_pages) { ++ free_pages((unsigned long)vmx_l1d_flush_pages, L1D_CACHE_ORDER); ++ vmx_l1d_flush_pages = NULL; ++ } ++ /* Restore state so sysfs ignores VMX */ ++ l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO; + } + +-static void __exit vmx_exit(void) ++ ++static void vmx_exit(void) + { + #ifdef CONFIG_KEXEC_CORE + RCU_INIT_POINTER(crash_vmclear_loaded_vmcss, NULL); +@@ -12364,7 +12647,40 @@ static void __exit vmx_exit(void) + #endif + + kvm_exit(); ++ ++ vmx_cleanup_l1d_flush(); + } ++module_exit(vmx_exit) + ++static int __init vmx_init(void) ++{ ++ int r; ++ ++ r = kvm_init(&vmx_x86_ops, sizeof(struct vcpu_vmx), ++ __alignof__(struct vcpu_vmx), THIS_MODULE); ++ if (r) ++ return r; ++ ++ /* ++ * Must be called after kvm_init() so enable_ept is properly set ++ * up. Hand the parameter mitigation value in which was stored in ++ * the pre module init parser. If no parameter was given, it will ++ * contain 'auto' which will be turned into the default 'cond' ++ * mitigation mode. ++ */ ++ if (boot_cpu_has(X86_BUG_L1TF)) { ++ r = vmx_setup_l1d_flush(vmentry_l1d_flush_param); ++ if (r) { ++ vmx_exit(); ++ return r; ++ } ++ } ++ ++#ifdef CONFIG_KEXEC_CORE ++ rcu_assign_pointer(crash_vmclear_loaded_vmcss, ++ crash_vmclear_local_loaded_vmcss); ++#endif ++ ++ return 0; ++} + module_init(vmx_init) +-module_exit(vmx_exit) +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 2f3fe25639b3..5c2c09f6c1c3 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -181,6 +181,7 @@ struct kvm_stats_debugfs_item debugfs_entries[] = { + { "irq_injections", VCPU_STAT(irq_injections) }, + { "nmi_injections", VCPU_STAT(nmi_injections) }, + { "req_event", VCPU_STAT(req_event) }, ++ { "l1d_flush", VCPU_STAT(l1d_flush) }, + { "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) }, + { "mmu_pte_write", VM_STAT(mmu_pte_write) }, + { "mmu_pte_updated", VM_STAT(mmu_pte_updated) }, +@@ -1041,6 +1042,71 @@ static u32 emulated_msrs[] = { + + static unsigned num_emulated_msrs; + ++/* ++ * List of msr numbers which are used to expose MSR-based features that ++ * can be used by a hypervisor to validate requested CPU features. ++ */ ++static u32 msr_based_features[] = { ++ MSR_F10H_DECFG, ++ MSR_IA32_UCODE_REV, ++ MSR_IA32_ARCH_CAPABILITIES, ++}; ++ ++static unsigned int num_msr_based_features; ++ ++u64 kvm_get_arch_capabilities(void) ++{ ++ u64 data; ++ ++ rdmsrl_safe(MSR_IA32_ARCH_CAPABILITIES, &data); ++ ++ /* ++ * If we're doing cache flushes (either "always" or "cond") ++ * we will do one whenever the guest does a vmlaunch/vmresume. ++ * If an outer hypervisor is doing the cache flush for us ++ * (VMENTER_L1D_FLUSH_NESTED_VM), we can safely pass that ++ * capability to the guest too, and if EPT is disabled we're not ++ * vulnerable. Overall, only VMENTER_L1D_FLUSH_NEVER will ++ * require a nested hypervisor to do a flush of its own. ++ */ ++ if (l1tf_vmx_mitigation != VMENTER_L1D_FLUSH_NEVER) ++ data |= ARCH_CAP_SKIP_VMENTRY_L1DFLUSH; ++ ++ return data; ++} ++EXPORT_SYMBOL_GPL(kvm_get_arch_capabilities); ++ ++static int kvm_get_msr_feature(struct kvm_msr_entry *msr) ++{ ++ switch (msr->index) { ++ case MSR_IA32_ARCH_CAPABILITIES: ++ msr->data = kvm_get_arch_capabilities(); ++ break; ++ case MSR_IA32_UCODE_REV: ++ rdmsrl_safe(msr->index, &msr->data); ++ break; ++ default: ++ if (kvm_x86_ops->get_msr_feature(msr)) ++ return 1; ++ } ++ return 0; ++} ++ ++static int do_get_msr_feature(struct kvm_vcpu *vcpu, unsigned index, u64 *data) ++{ ++ struct kvm_msr_entry msr; ++ int r; ++ ++ msr.index = index; ++ r = kvm_get_msr_feature(&msr); ++ if (r) ++ return r; ++ ++ *data = msr.data; ++ ++ return 0; ++} ++ + bool kvm_valid_efer(struct kvm_vcpu *vcpu, u64 efer) + { + if (efer & efer_reserved_bits) +@@ -2156,7 +2222,6 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + + switch (msr) { + case MSR_AMD64_NB_CFG: +- case MSR_IA32_UCODE_REV: + case MSR_IA32_UCODE_WRITE: + case MSR_VM_HSAVE_PA: + case MSR_AMD64_PATCH_LOADER: +@@ -2164,6 +2229,10 @@ int kvm_set_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + case MSR_AMD64_DC_CFG: + break; + ++ case MSR_IA32_UCODE_REV: ++ if (msr_info->host_initiated) ++ vcpu->arch.microcode_version = data; ++ break; + case MSR_EFER: + return set_efer(vcpu, data); + case MSR_K7_HWCR: +@@ -2450,7 +2519,7 @@ int kvm_get_msr_common(struct kvm_vcpu *vcpu, struct msr_data *msr_info) + msr_info->data = 0; + break; + case MSR_IA32_UCODE_REV: +- msr_info->data = 0x100000000ULL; ++ msr_info->data = vcpu->arch.microcode_version; + break; + case MSR_MTRRcap: + case 0x200 ... 0x2ff: +@@ -2600,13 +2669,11 @@ static int __msr_io(struct kvm_vcpu *vcpu, struct kvm_msrs *msrs, + int (*do_msr)(struct kvm_vcpu *vcpu, + unsigned index, u64 *data)) + { +- int i, idx; ++ int i; + +- idx = srcu_read_lock(&vcpu->kvm->srcu); + for (i = 0; i < msrs->nmsrs; ++i) + if (do_msr(vcpu, entries[i].index, &entries[i].data)) + break; +- srcu_read_unlock(&vcpu->kvm->srcu, idx); + + return i; + } +@@ -2705,6 +2772,7 @@ int kvm_vm_ioctl_check_extension(struct kvm *kvm, long ext) + case KVM_CAP_SET_BOOT_CPU_ID: + case KVM_CAP_SPLIT_IRQCHIP: + case KVM_CAP_IMMEDIATE_EXIT: ++ case KVM_CAP_GET_MSR_FEATURES: + r = 1; + break; + case KVM_CAP_ADJUST_CLOCK: +@@ -2819,6 +2887,31 @@ long kvm_arch_dev_ioctl(struct file *filp, + goto out; + r = 0; + break; ++ case KVM_GET_MSR_FEATURE_INDEX_LIST: { ++ struct kvm_msr_list __user *user_msr_list = argp; ++ struct kvm_msr_list msr_list; ++ unsigned int n; ++ ++ r = -EFAULT; ++ if (copy_from_user(&msr_list, user_msr_list, sizeof(msr_list))) ++ goto out; ++ n = msr_list.nmsrs; ++ msr_list.nmsrs = num_msr_based_features; ++ if (copy_to_user(user_msr_list, &msr_list, sizeof(msr_list))) ++ goto out; ++ r = -E2BIG; ++ if (n < msr_list.nmsrs) ++ goto out; ++ r = -EFAULT; ++ if (copy_to_user(user_msr_list->indices, &msr_based_features, ++ num_msr_based_features * sizeof(u32))) ++ goto out; ++ r = 0; ++ break; ++ } ++ case KVM_GET_MSRS: ++ r = msr_io(NULL, argp, do_get_msr_feature, 1); ++ break; + } + default: + r = -EINVAL; +@@ -3553,12 +3646,18 @@ long kvm_arch_vcpu_ioctl(struct file *filp, + r = 0; + break; + } +- case KVM_GET_MSRS: ++ case KVM_GET_MSRS: { ++ int idx = srcu_read_lock(&vcpu->kvm->srcu); + r = msr_io(vcpu, argp, do_get_msr, 1); ++ srcu_read_unlock(&vcpu->kvm->srcu, idx); + break; +- case KVM_SET_MSRS: ++ } ++ case KVM_SET_MSRS: { ++ int idx = srcu_read_lock(&vcpu->kvm->srcu); + r = msr_io(vcpu, argp, do_set_msr, 0); ++ srcu_read_unlock(&vcpu->kvm->srcu, idx); + break; ++ } + case KVM_TPR_ACCESS_REPORTING: { + struct kvm_tpr_access_ctl tac; + +@@ -4333,6 +4432,19 @@ static void kvm_init_msr_list(void) + j++; + } + num_emulated_msrs = j; ++ ++ for (i = j = 0; i < ARRAY_SIZE(msr_based_features); i++) { ++ struct kvm_msr_entry msr; ++ ++ msr.index = msr_based_features[i]; ++ if (kvm_get_msr_feature(&msr)) ++ continue; ++ ++ if (j < i) ++ msr_based_features[j] = msr_based_features[i]; ++ j++; ++ } ++ num_msr_based_features = j; + } + + static int vcpu_mmio_write(struct kvm_vcpu *vcpu, gpa_t addr, int len, +@@ -4573,6 +4685,9 @@ static int emulator_write_std(struct x86_emulate_ctxt *ctxt, gva_t addr, void *v + int kvm_write_guest_virt_system(struct kvm_vcpu *vcpu, gva_t addr, void *val, + unsigned int bytes, struct x86_exception *exception) + { ++ /* kvm_write_guest_virt_system can pull in tons of pages. */ ++ vcpu->arch.l1tf_flush_l1d = true; ++ + return kvm_write_guest_virt_helper(addr, val, bytes, vcpu, + PFERR_WRITE_MASK, exception); + } +@@ -5701,6 +5816,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, + bool writeback = true; + bool write_fault_to_spt = vcpu->arch.write_fault_to_shadow_pgtable; + ++ vcpu->arch.l1tf_flush_l1d = true; ++ + /* + * Clear write_fault_to_shadow_pgtable here to ensure it is + * never reused. +@@ -7146,6 +7263,7 @@ static int vcpu_run(struct kvm_vcpu *vcpu) + struct kvm *kvm = vcpu->kvm; + + vcpu->srcu_idx = srcu_read_lock(&kvm->srcu); ++ vcpu->arch.l1tf_flush_l1d = true; + + for (;;) { + if (kvm_vcpu_running(vcpu)) { +@@ -8153,6 +8271,7 @@ void kvm_arch_vcpu_uninit(struct kvm_vcpu *vcpu) + + void kvm_arch_sched_in(struct kvm_vcpu *vcpu, int cpu) + { ++ vcpu->arch.l1tf_flush_l1d = true; + kvm_x86_ops->sched_in(vcpu, cpu); + } + +diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c +index 0133d26f16be..c2faff548f59 100644 +--- a/arch/x86/mm/fault.c ++++ b/arch/x86/mm/fault.c +@@ -24,6 +24,7 @@ + #include /* emulate_vsyscall */ + #include /* struct vm86 */ + #include /* vma_pkey() */ ++#include + + #define CREATE_TRACE_POINTS + #include +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index 071cbbbb60d9..37f60dfd7e4e 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -4,6 +4,8 @@ + #include + #include + #include /* for max_low_pfn */ ++#include ++#include + + #include + #include +@@ -880,3 +882,26 @@ void update_cache_mode_entry(unsigned entry, enum page_cache_mode cache) + __cachemode2pte_tbl[cache] = __cm_idx2pte(entry); + __pte2cachemode_tbl[entry] = cache; + } ++ ++#ifdef CONFIG_SWAP ++unsigned long max_swapfile_size(void) ++{ ++ unsigned long pages; ++ ++ pages = generic_max_swapfile_size(); ++ ++ if (boot_cpu_has_bug(X86_BUG_L1TF)) { ++ /* Limit the swap file size to MAX_PA/2 for L1TF workaround */ ++ unsigned long l1tf_limit = l1tf_pfn_limit() + 1; ++ /* ++ * We encode swap offsets also with 3 bits below those for pfn ++ * which makes the usable limit higher. ++ */ ++#if CONFIG_PGTABLE_LEVELS > 2 ++ l1tf_limit <<= PAGE_SHIFT - SWP_OFFSET_FIRST_BIT; ++#endif ++ pages = min_t(unsigned long, l1tf_limit, pages); ++ } ++ return pages; ++} ++#endif +diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c +index 7c8686709636..79eb55ce69a9 100644 +--- a/arch/x86/mm/kmmio.c ++++ b/arch/x86/mm/kmmio.c +@@ -126,24 +126,29 @@ static struct kmmio_fault_page *get_kmmio_fault_page(unsigned long addr) + + static void clear_pmd_presence(pmd_t *pmd, bool clear, pmdval_t *old) + { ++ pmd_t new_pmd; + pmdval_t v = pmd_val(*pmd); + if (clear) { +- *old = v & _PAGE_PRESENT; +- v &= ~_PAGE_PRESENT; +- } else /* presume this has been called with clear==true previously */ +- v |= *old; +- set_pmd(pmd, __pmd(v)); ++ *old = v; ++ new_pmd = pmd_mknotpresent(*pmd); ++ } else { ++ /* Presume this has been called with clear==true previously */ ++ new_pmd = __pmd(*old); ++ } ++ set_pmd(pmd, new_pmd); + } + + static void clear_pte_presence(pte_t *pte, bool clear, pteval_t *old) + { + pteval_t v = pte_val(*pte); + if (clear) { +- *old = v & _PAGE_PRESENT; +- v &= ~_PAGE_PRESENT; +- } else /* presume this has been called with clear==true previously */ +- v |= *old; +- set_pte_atomic(pte, __pte(v)); ++ *old = v; ++ /* Nothing should care about address */ ++ pte_clear(&init_mm, 0, pte); ++ } else { ++ /* Presume this has been called with clear==true previously */ ++ set_pte_atomic(pte, __pte(*old)); ++ } + } + + static int clear_page_presence(struct kmmio_fault_page *f, bool clear) +diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c +index a99679826846..5f4805d69aab 100644 +--- a/arch/x86/mm/mmap.c ++++ b/arch/x86/mm/mmap.c +@@ -174,3 +174,24 @@ const char *arch_vma_name(struct vm_area_struct *vma) + return "[mpx]"; + return NULL; + } ++ ++/* ++ * Only allow root to set high MMIO mappings to PROT_NONE. ++ * This prevents an unpriv. user to set them to PROT_NONE and invert ++ * them, then pointing to valid memory for L1TF speculation. ++ * ++ * Note: for locked down kernels may want to disable the root override. ++ */ ++bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot) ++{ ++ if (!boot_cpu_has_bug(X86_BUG_L1TF)) ++ return true; ++ if (!__pte_needs_invert(pgprot_val(prot))) ++ return true; ++ /* If it's real memory always allow */ ++ if (pfn_valid(pfn)) ++ return true; ++ if (pfn > l1tf_pfn_limit() && !capable(CAP_SYS_ADMIN)) ++ return false; ++ return true; ++} +diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c +index 4085897fef64..464f53da3a6f 100644 +--- a/arch/x86/mm/pageattr.c ++++ b/arch/x86/mm/pageattr.c +@@ -1006,8 +1006,8 @@ static long populate_pmd(struct cpa_data *cpa, + + pmd = pmd_offset(pud, start); + +- set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | +- massage_pgprot(pmd_pgprot))); ++ set_pmd(pmd, pmd_mkhuge(pfn_pmd(cpa->pfn, ++ canon_pgprot(pmd_pgprot)))); + + start += PMD_SIZE; + cpa->pfn += PMD_SIZE >> PAGE_SHIFT; +@@ -1079,8 +1079,8 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, p4d_t *p4d, + * Map everything starting from the Gb boundary, possibly with 1G pages + */ + while (boot_cpu_has(X86_FEATURE_GBPAGES) && end - start >= PUD_SIZE) { +- set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | +- massage_pgprot(pud_pgprot))); ++ set_pud(pud, pud_mkhuge(pfn_pud(cpa->pfn, ++ canon_pgprot(pud_pgprot)))); + + start += PUD_SIZE; + cpa->pfn += PUD_SIZE >> PAGE_SHIFT; +diff --git a/arch/x86/mm/pti.c b/arch/x86/mm/pti.c +index ce38f165489b..d6f11accd37a 100644 +--- a/arch/x86/mm/pti.c ++++ b/arch/x86/mm/pti.c +@@ -45,6 +45,7 @@ + #include + #include + #include ++#include + + #undef pr_fmt + #define pr_fmt(fmt) "Kernel/User page tables isolation: " fmt +diff --git a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c +index 4f5fa65a1011..2acd6be13375 100644 +--- a/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c ++++ b/arch/x86/platform/intel-mid/device_libs/platform_mrfld_wdt.c +@@ -18,6 +18,7 @@ + #include + #include + #include ++#include + + #define TANGIER_EXT_TIMER0_MSI 12 + +diff --git a/arch/x86/platform/uv/tlb_uv.c b/arch/x86/platform/uv/tlb_uv.c +index 0b530c53de1f..34f9a9ce6236 100644 +--- a/arch/x86/platform/uv/tlb_uv.c ++++ b/arch/x86/platform/uv/tlb_uv.c +@@ -1285,6 +1285,7 @@ void uv_bau_message_interrupt(struct pt_regs *regs) + struct msg_desc msgdesc; + + ack_APIC_irq(); ++ kvm_set_cpu_l1tf_flush_l1d(); + time_start = get_cycles(); + + bcp = &per_cpu(bau_control, smp_processor_id()); +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index c9081c6671f0..df208af3cd74 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -3,6 +3,7 @@ + #endif + #include + #include ++#include + + #include + #include +diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c +index 433f14bcab15..93758b528d8f 100644 +--- a/drivers/base/cpu.c ++++ b/drivers/base/cpu.c +@@ -527,16 +527,24 @@ ssize_t __weak cpu_show_spec_store_bypass(struct device *dev, + return sprintf(buf, "Not affected\n"); + } + ++ssize_t __weak cpu_show_l1tf(struct device *dev, ++ struct device_attribute *attr, char *buf) ++{ ++ return sprintf(buf, "Not affected\n"); ++} ++ + static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); + static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); + static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); + static DEVICE_ATTR(spec_store_bypass, 0444, cpu_show_spec_store_bypass, NULL); ++static DEVICE_ATTR(l1tf, 0444, cpu_show_l1tf, NULL); + + static struct attribute *cpu_root_vulnerabilities_attrs[] = { + &dev_attr_meltdown.attr, + &dev_attr_spectre_v1.attr, + &dev_attr_spectre_v2.attr, + &dev_attr_spec_store_bypass.attr, ++ &dev_attr_l1tf.attr, + NULL + }; + +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index 6aef3bde10d7..c823914b3a80 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -115,12 +115,12 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) + struct sk_buff *skb = hu->tx_skb; + + if (!skb) { +- read_lock(&hu->proto_lock); ++ percpu_down_read(&hu->proto_lock); + + if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) + skb = hu->proto->dequeue(hu); + +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + } else { + hu->tx_skb = NULL; + } +@@ -130,7 +130,14 @@ static inline struct sk_buff *hci_uart_dequeue(struct hci_uart *hu) + + int hci_uart_tx_wakeup(struct hci_uart *hu) + { +- read_lock(&hu->proto_lock); ++ /* This may be called in an IRQ context, so we can't sleep. Therefore ++ * we try to acquire the lock only, and if that fails we assume the ++ * tty is being closed because that is the only time the write lock is ++ * acquired. If, however, at some point in the future the write lock ++ * is also acquired in other situations, then this must be revisited. ++ */ ++ if (!percpu_down_read_trylock(&hu->proto_lock)) ++ return 0; + + if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) + goto no_schedule; +@@ -145,7 +152,7 @@ int hci_uart_tx_wakeup(struct hci_uart *hu) + schedule_work(&hu->write_work); + + no_schedule: +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + + return 0; + } +@@ -247,12 +254,12 @@ static int hci_uart_flush(struct hci_dev *hdev) + tty_ldisc_flush(tty); + tty_driver_flush_buffer(tty); + +- read_lock(&hu->proto_lock); ++ percpu_down_read(&hu->proto_lock); + + if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) + hu->proto->flush(hu); + +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + + return 0; + } +@@ -275,15 +282,15 @@ static int hci_uart_send_frame(struct hci_dev *hdev, struct sk_buff *skb) + BT_DBG("%s: type %d len %d", hdev->name, hci_skb_pkt_type(skb), + skb->len); + +- read_lock(&hu->proto_lock); ++ percpu_down_read(&hu->proto_lock); + + if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) { +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + return -EUNATCH; + } + + hu->proto->enqueue(hu, skb); +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + + hci_uart_tx_wakeup(hu); + +@@ -486,7 +493,7 @@ static int hci_uart_tty_open(struct tty_struct *tty) + INIT_WORK(&hu->init_ready, hci_uart_init_work); + INIT_WORK(&hu->write_work, hci_uart_write_work); + +- rwlock_init(&hu->proto_lock); ++ percpu_init_rwsem(&hu->proto_lock); + + /* Flush any pending characters in the driver */ + tty_driver_flush_buffer(tty); +@@ -503,7 +510,6 @@ static void hci_uart_tty_close(struct tty_struct *tty) + { + struct hci_uart *hu = tty->disc_data; + struct hci_dev *hdev; +- unsigned long flags; + + BT_DBG("tty %p", tty); + +@@ -518,9 +524,9 @@ static void hci_uart_tty_close(struct tty_struct *tty) + hci_uart_close(hdev); + + if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) { +- write_lock_irqsave(&hu->proto_lock, flags); ++ percpu_down_write(&hu->proto_lock); + clear_bit(HCI_UART_PROTO_READY, &hu->flags); +- write_unlock_irqrestore(&hu->proto_lock, flags); ++ percpu_up_write(&hu->proto_lock); + + cancel_work_sync(&hu->write_work); + +@@ -582,10 +588,10 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, + if (!hu || tty != hu->tty) + return; + +- read_lock(&hu->proto_lock); ++ percpu_down_read(&hu->proto_lock); + + if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) { +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + return; + } + +@@ -593,7 +599,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, + * tty caller + */ + hu->proto->recv(hu, data, count); +- read_unlock(&hu->proto_lock); ++ percpu_up_read(&hu->proto_lock); + + if (hu->hdev) + hu->hdev->stat.byte_rx += count; +diff --git a/drivers/bluetooth/hci_serdev.c b/drivers/bluetooth/hci_serdev.c +index b725ac4f7ff6..52e6d4d1608e 100644 +--- a/drivers/bluetooth/hci_serdev.c ++++ b/drivers/bluetooth/hci_serdev.c +@@ -304,6 +304,7 @@ int hci_uart_register_device(struct hci_uart *hu, + hci_set_drvdata(hdev, hu); + + INIT_WORK(&hu->write_work, hci_uart_write_work); ++ percpu_init_rwsem(&hu->proto_lock); + + /* Only when vendor specific setup callback is provided, consider + * the manufacturer information valid. This avoids filling in the +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index d9cd95d81149..66e8c68e4607 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -87,7 +87,7 @@ struct hci_uart { + struct work_struct write_work; + + const struct hci_uart_proto *proto; +- rwlock_t proto_lock; /* Stop work for proto close */ ++ struct percpu_rw_semaphore proto_lock; /* Stop work for proto close */ + void *priv; + + struct sk_buff *tx_skb; +diff --git a/drivers/gpu/drm/i915/intel_lpe_audio.c b/drivers/gpu/drm/i915/intel_lpe_audio.c +index 3bf65288ffff..2fdf302ebdad 100644 +--- a/drivers/gpu/drm/i915/intel_lpe_audio.c ++++ b/drivers/gpu/drm/i915/intel_lpe_audio.c +@@ -62,6 +62,7 @@ + + #include + #include ++#include + #include + #include + +diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c +index 3baddfc997d1..b49ca02b399d 100644 +--- a/drivers/mtd/nand/qcom_nandc.c ++++ b/drivers/mtd/nand/qcom_nandc.c +@@ -2544,6 +2544,9 @@ static int qcom_nand_host_init(struct qcom_nand_controller *nandc, + + nand_set_flash_node(chip, dn); + mtd->name = devm_kasprintf(dev, GFP_KERNEL, "qcom_nand.%d", host->cs); ++ if (!mtd->name) ++ return -ENOMEM; ++ + mtd->owner = THIS_MODULE; + mtd->dev.parent = dev; + +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index dfc076f9ee4b..d5e790dd589a 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -894,7 +894,6 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, + struct sk_buff *skb, + struct sk_buff_head *list) + { +- struct skb_shared_info *shinfo = skb_shinfo(skb); + RING_IDX cons = queue->rx.rsp_cons; + struct sk_buff *nskb; + +@@ -903,15 +902,16 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, + RING_GET_RESPONSE(&queue->rx, ++cons); + skb_frag_t *nfrag = &skb_shinfo(nskb)->frags[0]; + +- if (shinfo->nr_frags == MAX_SKB_FRAGS) { ++ if (skb_shinfo(skb)->nr_frags == MAX_SKB_FRAGS) { + unsigned int pull_to = NETFRONT_SKB_CB(skb)->pull_to; + + BUG_ON(pull_to <= skb_headlen(skb)); + __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); + } +- BUG_ON(shinfo->nr_frags >= MAX_SKB_FRAGS); ++ BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); + +- skb_add_rx_frag(skb, shinfo->nr_frags, skb_frag_page(nfrag), ++ skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, ++ skb_frag_page(nfrag), + rx->offset, rx->status, PAGE_SIZE); + + skb_shinfo(nskb)->nr_frags = 0; +diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c +index 4523d7e1bcb9..ffc87a956d97 100644 +--- a/drivers/pci/host/pci-hyperv.c ++++ b/drivers/pci/host/pci-hyperv.c +@@ -53,6 +53,8 @@ + #include + #include + #include ++#include ++ + #include + #include + #include +diff --git a/drivers/phy/mediatek/phy-mtk-tphy.c b/drivers/phy/mediatek/phy-mtk-tphy.c +index 721a2a1c97ef..a63bba12aee4 100644 +--- a/drivers/phy/mediatek/phy-mtk-tphy.c ++++ b/drivers/phy/mediatek/phy-mtk-tphy.c +@@ -438,9 +438,9 @@ static void u2_phy_instance_init(struct mtk_tphy *tphy, + u32 index = instance->index; + u32 tmp; + +- /* switch to USB function. (system register, force ip into usb mode) */ ++ /* switch to USB function, and enable usb pll */ + tmp = readl(com + U3P_U2PHYDTM0); +- tmp &= ~P2C_FORCE_UART_EN; ++ tmp &= ~(P2C_FORCE_UART_EN | P2C_FORCE_SUSPENDM); + tmp |= P2C_RG_XCVRSEL_VAL(1) | P2C_RG_DATAIN_VAL(0); + writel(tmp, com + U3P_U2PHYDTM0); + +@@ -500,10 +500,8 @@ static void u2_phy_instance_power_on(struct mtk_tphy *tphy, + u32 index = instance->index; + u32 tmp; + +- /* (force_suspendm=0) (let suspendm=1, enable usb 480MHz pll) */ + tmp = readl(com + U3P_U2PHYDTM0); +- tmp &= ~(P2C_FORCE_SUSPENDM | P2C_RG_XCVRSEL); +- tmp &= ~(P2C_RG_DATAIN | P2C_DTM0_PART_MASK); ++ tmp &= ~(P2C_RG_XCVRSEL | P2C_RG_DATAIN | P2C_DTM0_PART_MASK); + writel(tmp, com + U3P_U2PHYDTM0); + + /* OTG Enable */ +@@ -538,7 +536,6 @@ static void u2_phy_instance_power_off(struct mtk_tphy *tphy, + + tmp = readl(com + U3P_U2PHYDTM0); + tmp &= ~(P2C_RG_XCVRSEL | P2C_RG_DATAIN); +- tmp |= P2C_FORCE_SUSPENDM; + writel(tmp, com + U3P_U2PHYDTM0); + + /* OTG Disable */ +@@ -546,18 +543,16 @@ static void u2_phy_instance_power_off(struct mtk_tphy *tphy, + tmp &= ~PA6_RG_U2_OTG_VBUSCMP_EN; + writel(tmp, com + U3P_USBPHYACR6); + +- /* let suspendm=0, set utmi into analog power down */ +- tmp = readl(com + U3P_U2PHYDTM0); +- tmp &= ~P2C_RG_SUSPENDM; +- writel(tmp, com + U3P_U2PHYDTM0); +- udelay(1); +- + tmp = readl(com + U3P_U2PHYDTM1); + tmp &= ~(P2C_RG_VBUSVALID | P2C_RG_AVALID); + tmp |= P2C_RG_SESSEND; + writel(tmp, com + U3P_U2PHYDTM1); + + if (tphy->pdata->avoid_rx_sen_degradation && index) { ++ tmp = readl(com + U3P_U2PHYDTM0); ++ tmp &= ~(P2C_RG_SUSPENDM | P2C_FORCE_SUSPENDM); ++ writel(tmp, com + U3P_U2PHYDTM0); ++ + tmp = readl(com + U3D_U2PHYDCR0); + tmp &= ~P2C_RG_SIF_U2PLL_FORCE_ON; + writel(tmp, com + U3D_U2PHYDCR0); +diff --git a/drivers/scsi/hosts.c b/drivers/scsi/hosts.c +index dd9464920456..ef22b275d050 100644 +--- a/drivers/scsi/hosts.c ++++ b/drivers/scsi/hosts.c +@@ -474,6 +474,7 @@ struct Scsi_Host *scsi_host_alloc(struct scsi_host_template *sht, int privsize) + shost->dma_boundary = 0xffffffff; + + shost->use_blk_mq = scsi_use_blk_mq; ++ shost->use_blk_mq = scsi_use_blk_mq || shost->hostt->force_blk_mq; + + device_initialize(&shost->shost_gendev); + dev_set_name(&shost->shost_gendev, "host%d", shost->host_no); +diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c +index 604a39dba5d0..5b4b7f9be2d7 100644 +--- a/drivers/scsi/hpsa.c ++++ b/drivers/scsi/hpsa.c +@@ -1040,11 +1040,7 @@ static void set_performant_mode(struct ctlr_info *h, struct CommandList *c, + c->busaddr |= 1 | (h->blockFetchTable[c->Header.SGList] << 1); + if (unlikely(!h->msix_vectors)) + return; +- if (likely(reply_queue == DEFAULT_REPLY_QUEUE)) +- c->Header.ReplyQueue = +- raw_smp_processor_id() % h->nreply_queues; +- else +- c->Header.ReplyQueue = reply_queue % h->nreply_queues; ++ c->Header.ReplyQueue = reply_queue; + } + } + +@@ -1058,10 +1054,7 @@ static void set_ioaccel1_performant_mode(struct ctlr_info *h, + * Tell the controller to post the reply to the queue for this + * processor. This seems to give the best I/O throughput. + */ +- if (likely(reply_queue == DEFAULT_REPLY_QUEUE)) +- cp->ReplyQueue = smp_processor_id() % h->nreply_queues; +- else +- cp->ReplyQueue = reply_queue % h->nreply_queues; ++ cp->ReplyQueue = reply_queue; + /* + * Set the bits in the address sent down to include: + * - performant mode bit (bit 0) +@@ -1082,10 +1075,7 @@ static void set_ioaccel2_tmf_performant_mode(struct ctlr_info *h, + /* Tell the controller to post the reply to the queue for this + * processor. This seems to give the best I/O throughput. + */ +- if (likely(reply_queue == DEFAULT_REPLY_QUEUE)) +- cp->reply_queue = smp_processor_id() % h->nreply_queues; +- else +- cp->reply_queue = reply_queue % h->nreply_queues; ++ cp->reply_queue = reply_queue; + /* Set the bits in the address sent down to include: + * - performant mode bit not used in ioaccel mode 2 + * - pull count (bits 0-3) +@@ -1104,10 +1094,7 @@ static void set_ioaccel2_performant_mode(struct ctlr_info *h, + * Tell the controller to post the reply to the queue for this + * processor. This seems to give the best I/O throughput. + */ +- if (likely(reply_queue == DEFAULT_REPLY_QUEUE)) +- cp->reply_queue = smp_processor_id() % h->nreply_queues; +- else +- cp->reply_queue = reply_queue % h->nreply_queues; ++ cp->reply_queue = reply_queue; + /* + * Set the bits in the address sent down to include: + * - performant mode bit not used in ioaccel mode 2 +@@ -1152,6 +1139,8 @@ static void __enqueue_cmd_and_start_io(struct ctlr_info *h, + { + dial_down_lockup_detection_during_fw_flash(h, c); + atomic_inc(&h->commands_outstanding); ++ ++ reply_queue = h->reply_map[raw_smp_processor_id()]; + switch (c->cmd_type) { + case CMD_IOACCEL1: + set_ioaccel1_performant_mode(h, c, reply_queue); +@@ -7244,6 +7233,26 @@ static void hpsa_disable_interrupt_mode(struct ctlr_info *h) + h->msix_vectors = 0; + } + ++static void hpsa_setup_reply_map(struct ctlr_info *h) ++{ ++ const struct cpumask *mask; ++ unsigned int queue, cpu; ++ ++ for (queue = 0; queue < h->msix_vectors; queue++) { ++ mask = pci_irq_get_affinity(h->pdev, queue); ++ if (!mask) ++ goto fallback; ++ ++ for_each_cpu(cpu, mask) ++ h->reply_map[cpu] = queue; ++ } ++ return; ++ ++fallback: ++ for_each_possible_cpu(cpu) ++ h->reply_map[cpu] = 0; ++} ++ + /* If MSI/MSI-X is supported by the kernel we will try to enable it on + * controllers that are capable. If not, we use legacy INTx mode. + */ +@@ -7639,6 +7648,10 @@ static int hpsa_pci_init(struct ctlr_info *h) + err = hpsa_interrupt_mode(h); + if (err) + goto clean1; ++ ++ /* setup mapping between CPU and reply queue */ ++ hpsa_setup_reply_map(h); ++ + err = hpsa_pci_find_memory_BAR(h->pdev, &h->paddr); + if (err) + goto clean2; /* intmode+region, pci */ +@@ -8284,6 +8297,28 @@ static struct workqueue_struct *hpsa_create_controller_wq(struct ctlr_info *h, + return wq; + } + ++static void hpda_free_ctlr_info(struct ctlr_info *h) ++{ ++ kfree(h->reply_map); ++ kfree(h); ++} ++ ++static struct ctlr_info *hpda_alloc_ctlr_info(void) ++{ ++ struct ctlr_info *h; ++ ++ h = kzalloc(sizeof(*h), GFP_KERNEL); ++ if (!h) ++ return NULL; ++ ++ h->reply_map = kzalloc(sizeof(*h->reply_map) * nr_cpu_ids, GFP_KERNEL); ++ if (!h->reply_map) { ++ kfree(h); ++ return NULL; ++ } ++ return h; ++} ++ + static int hpsa_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) + { + int dac, rc; +@@ -8321,7 +8356,7 @@ reinit_after_soft_reset: + * the driver. See comments in hpsa.h for more info. + */ + BUILD_BUG_ON(sizeof(struct CommandList) % COMMANDLIST_ALIGNMENT); +- h = kzalloc(sizeof(*h), GFP_KERNEL); ++ h = hpda_alloc_ctlr_info(); + if (!h) { + dev_err(&pdev->dev, "Failed to allocate controller head\n"); + return -ENOMEM; +@@ -8726,7 +8761,7 @@ static void hpsa_remove_one(struct pci_dev *pdev) + h->lockup_detected = NULL; /* init_one 2 */ + /* (void) pci_disable_pcie_error_reporting(pdev); */ /* init_one 1 */ + +- kfree(h); /* init_one 1 */ ++ hpda_free_ctlr_info(h); /* init_one 1 */ + } + + static int hpsa_suspend(__attribute__((unused)) struct pci_dev *pdev, +diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h +index 018f980a701c..fb9f5e7f8209 100644 +--- a/drivers/scsi/hpsa.h ++++ b/drivers/scsi/hpsa.h +@@ -158,6 +158,7 @@ struct bmic_controller_parameters { + #pragma pack() + + struct ctlr_info { ++ unsigned int *reply_map; + int ctlr; + char devname[8]; + char *product_name; +diff --git a/drivers/scsi/qla2xxx/qla_iocb.c b/drivers/scsi/qla2xxx/qla_iocb.c +index 63bea6a65d51..8d579bf0fc81 100644 +--- a/drivers/scsi/qla2xxx/qla_iocb.c ++++ b/drivers/scsi/qla2xxx/qla_iocb.c +@@ -2128,34 +2128,11 @@ __qla2x00_alloc_iocbs(struct qla_qpair *qpair, srb_t *sp) + req_cnt = 1; + handle = 0; + +- if (!sp) +- goto skip_cmd_array; +- +- /* Check for room in outstanding command list. */ +- handle = req->current_outstanding_cmd; +- for (index = 1; index < req->num_outstanding_cmds; index++) { +- handle++; +- if (handle == req->num_outstanding_cmds) +- handle = 1; +- if (!req->outstanding_cmds[handle]) +- break; +- } +- if (index == req->num_outstanding_cmds) { +- ql_log(ql_log_warn, vha, 0x700b, +- "No room on outstanding cmd array.\n"); +- goto queuing_error; +- } +- +- /* Prep command array. */ +- req->current_outstanding_cmd = handle; +- req->outstanding_cmds[handle] = sp; +- sp->handle = handle; +- +- /* Adjust entry-counts as needed. */ +- if (sp->type != SRB_SCSI_CMD) ++ if (sp && (sp->type != SRB_SCSI_CMD)) { ++ /* Adjust entry-counts as needed. */ + req_cnt = sp->iocbs; ++ } + +-skip_cmd_array: + /* Check for room on request queue. */ + if (req->cnt < req_cnt + 2) { + if (ha->mqenable || IS_QLA83XX(ha) || IS_QLA27XX(ha)) +@@ -2179,6 +2156,28 @@ skip_cmd_array: + if (req->cnt < req_cnt + 2) + goto queuing_error; + ++ if (sp) { ++ /* Check for room in outstanding command list. */ ++ handle = req->current_outstanding_cmd; ++ for (index = 1; index < req->num_outstanding_cmds; index++) { ++ handle++; ++ if (handle == req->num_outstanding_cmds) ++ handle = 1; ++ if (!req->outstanding_cmds[handle]) ++ break; ++ } ++ if (index == req->num_outstanding_cmds) { ++ ql_log(ql_log_warn, vha, 0x700b, ++ "No room on outstanding cmd array.\n"); ++ goto queuing_error; ++ } ++ ++ /* Prep command array. */ ++ req->current_outstanding_cmd = handle; ++ req->outstanding_cmds[handle] = sp; ++ sp->handle = handle; ++ } ++ + /* Prep packet */ + req->cnt -= req_cnt; + pkt = req->ring_ptr; +@@ -2191,6 +2190,8 @@ skip_cmd_array: + pkt->handle = handle; + } + ++ return pkt; ++ + queuing_error: + qpair->tgt_counters.num_alloc_iocb_failed++; + return pkt; +diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c +index 3f3cb72e0c0c..d0389b20574d 100644 +--- a/drivers/scsi/sr.c ++++ b/drivers/scsi/sr.c +@@ -523,18 +523,26 @@ static int sr_init_command(struct scsi_cmnd *SCpnt) + static int sr_block_open(struct block_device *bdev, fmode_t mode) + { + struct scsi_cd *cd; ++ struct scsi_device *sdev; + int ret = -ENXIO; + ++ cd = scsi_cd_get(bdev->bd_disk); ++ if (!cd) ++ goto out; ++ ++ sdev = cd->device; ++ scsi_autopm_get_device(sdev); + check_disk_change(bdev); + + mutex_lock(&sr_mutex); +- cd = scsi_cd_get(bdev->bd_disk); +- if (cd) { +- ret = cdrom_open(&cd->cdi, bdev, mode); +- if (ret) +- scsi_cd_put(cd); +- } ++ ret = cdrom_open(&cd->cdi, bdev, mode); + mutex_unlock(&sr_mutex); ++ ++ scsi_autopm_put_device(sdev); ++ if (ret) ++ scsi_cd_put(cd); ++ ++out: + return ret; + } + +@@ -562,6 +570,8 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd, + if (ret) + goto out; + ++ scsi_autopm_get_device(sdev); ++ + /* + * Send SCSI addressing ioctls directly to mid level, send other + * ioctls to cdrom/block level. +@@ -570,15 +580,18 @@ static int sr_block_ioctl(struct block_device *bdev, fmode_t mode, unsigned cmd, + case SCSI_IOCTL_GET_IDLUN: + case SCSI_IOCTL_GET_BUS_NUMBER: + ret = scsi_ioctl(sdev, cmd, argp); +- goto out; ++ goto put; + } + + ret = cdrom_ioctl(&cd->cdi, bdev, mode, cmd, arg); + if (ret != -ENOSYS) +- goto out; ++ goto put; + + ret = scsi_ioctl(sdev, cmd, argp); + ++put: ++ scsi_autopm_put_device(sdev); ++ + out: + mutex_unlock(&sr_mutex); + return ret; +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 7c28e8d4955a..54e3a0f6844c 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -91,9 +91,6 @@ struct virtio_scsi_vq { + struct virtio_scsi_target_state { + seqcount_t tgt_seq; + +- /* Count of outstanding requests. */ +- atomic_t reqs; +- + /* Currently active virtqueue for requests sent to this target. */ + struct virtio_scsi_vq *req_vq; + }; +@@ -152,8 +149,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf) + struct virtio_scsi_cmd *cmd = buf; + struct scsi_cmnd *sc = cmd->sc; + struct virtio_scsi_cmd_resp *resp = &cmd->resp.cmd; +- struct virtio_scsi_target_state *tgt = +- scsi_target(sc->device)->hostdata; + + dev_dbg(&sc->device->sdev_gendev, + "cmd %p response %u status %#02x sense_len %u\n", +@@ -210,8 +205,6 @@ static void virtscsi_complete_cmd(struct virtio_scsi *vscsi, void *buf) + } + + sc->scsi_done(sc); +- +- atomic_dec(&tgt->reqs); + } + + static void virtscsi_vq_done(struct virtio_scsi *vscsi, +@@ -580,10 +573,7 @@ static int virtscsi_queuecommand_single(struct Scsi_Host *sh, + struct scsi_cmnd *sc) + { + struct virtio_scsi *vscsi = shost_priv(sh); +- struct virtio_scsi_target_state *tgt = +- scsi_target(sc->device)->hostdata; + +- atomic_inc(&tgt->reqs); + return virtscsi_queuecommand(vscsi, &vscsi->req_vqs[0], sc); + } + +@@ -596,55 +586,11 @@ static struct virtio_scsi_vq *virtscsi_pick_vq_mq(struct virtio_scsi *vscsi, + return &vscsi->req_vqs[hwq]; + } + +-static struct virtio_scsi_vq *virtscsi_pick_vq(struct virtio_scsi *vscsi, +- struct virtio_scsi_target_state *tgt) +-{ +- struct virtio_scsi_vq *vq; +- unsigned long flags; +- u32 queue_num; +- +- local_irq_save(flags); +- if (atomic_inc_return(&tgt->reqs) > 1) { +- unsigned long seq; +- +- do { +- seq = read_seqcount_begin(&tgt->tgt_seq); +- vq = tgt->req_vq; +- } while (read_seqcount_retry(&tgt->tgt_seq, seq)); +- } else { +- /* no writes can be concurrent because of atomic_t */ +- write_seqcount_begin(&tgt->tgt_seq); +- +- /* keep previous req_vq if a reader just arrived */ +- if (unlikely(atomic_read(&tgt->reqs) > 1)) { +- vq = tgt->req_vq; +- goto unlock; +- } +- +- queue_num = smp_processor_id(); +- while (unlikely(queue_num >= vscsi->num_queues)) +- queue_num -= vscsi->num_queues; +- tgt->req_vq = vq = &vscsi->req_vqs[queue_num]; +- unlock: +- write_seqcount_end(&tgt->tgt_seq); +- } +- local_irq_restore(flags); +- +- return vq; +-} +- + static int virtscsi_queuecommand_multi(struct Scsi_Host *sh, + struct scsi_cmnd *sc) + { + struct virtio_scsi *vscsi = shost_priv(sh); +- struct virtio_scsi_target_state *tgt = +- scsi_target(sc->device)->hostdata; +- struct virtio_scsi_vq *req_vq; +- +- if (shost_use_blk_mq(sh)) +- req_vq = virtscsi_pick_vq_mq(vscsi, sc); +- else +- req_vq = virtscsi_pick_vq(vscsi, tgt); ++ struct virtio_scsi_vq *req_vq = virtscsi_pick_vq_mq(vscsi, sc); + + return virtscsi_queuecommand(vscsi, req_vq, sc); + } +@@ -775,7 +721,6 @@ static int virtscsi_target_alloc(struct scsi_target *starget) + return -ENOMEM; + + seqcount_init(&tgt->tgt_seq); +- atomic_set(&tgt->reqs, 0); + tgt->req_vq = &vscsi->req_vqs[0]; + + starget->hostdata = tgt; +@@ -823,6 +768,7 @@ static struct scsi_host_template virtscsi_host_template_single = { + .target_alloc = virtscsi_target_alloc, + .target_destroy = virtscsi_target_destroy, + .track_queue_depth = 1, ++ .force_blk_mq = 1, + }; + + static struct scsi_host_template virtscsi_host_template_multi = { +@@ -844,6 +790,7 @@ static struct scsi_host_template virtscsi_host_template_multi = { + .target_destroy = virtscsi_target_destroy, + .map_queues = virtscsi_map_queues, + .track_queue_depth = 1, ++ .force_blk_mq = 1, + }; + + #define virtscsi_config_get(vdev, fld) \ +diff --git a/fs/dcache.c b/fs/dcache.c +index 5f31a93150d1..8d4935978fec 100644 +--- a/fs/dcache.c ++++ b/fs/dcache.c +@@ -357,14 +357,11 @@ static void dentry_unlink_inode(struct dentry * dentry) + __releases(dentry->d_inode->i_lock) + { + struct inode *inode = dentry->d_inode; +- bool hashed = !d_unhashed(dentry); + +- if (hashed) +- raw_write_seqcount_begin(&dentry->d_seq); ++ raw_write_seqcount_begin(&dentry->d_seq); + __d_clear_type_and_inode(dentry); + hlist_del_init(&dentry->d_u.d_alias); +- if (hashed) +- raw_write_seqcount_end(&dentry->d_seq); ++ raw_write_seqcount_end(&dentry->d_seq); + spin_unlock(&dentry->d_lock); + spin_unlock(&inode->i_lock); + if (!inode->i_nlink) +@@ -1922,10 +1919,12 @@ struct dentry *d_make_root(struct inode *root_inode) + + if (root_inode) { + res = __d_alloc(root_inode->i_sb, NULL); +- if (res) ++ if (res) { ++ res->d_flags |= DCACHE_RCUACCESS; + d_instantiate(res, root_inode); +- else ++ } else { + iput(root_inode); ++ } + } + return res; + } +diff --git a/fs/namespace.c b/fs/namespace.c +index 1eb3bfd8be5a..9dc146e7b5e0 100644 +--- a/fs/namespace.c ++++ b/fs/namespace.c +@@ -659,12 +659,21 @@ int __legitimize_mnt(struct vfsmount *bastard, unsigned seq) + return 0; + mnt = real_mount(bastard); + mnt_add_count(mnt, 1); ++ smp_mb(); // see mntput_no_expire() + if (likely(!read_seqretry(&mount_lock, seq))) + return 0; + if (bastard->mnt_flags & MNT_SYNC_UMOUNT) { + mnt_add_count(mnt, -1); + return 1; + } ++ lock_mount_hash(); ++ if (unlikely(bastard->mnt_flags & MNT_DOOMED)) { ++ mnt_add_count(mnt, -1); ++ unlock_mount_hash(); ++ return 1; ++ } ++ unlock_mount_hash(); ++ /* caller will mntput() */ + return -1; + } + +@@ -1195,12 +1204,27 @@ static DECLARE_DELAYED_WORK(delayed_mntput_work, delayed_mntput); + static void mntput_no_expire(struct mount *mnt) + { + rcu_read_lock(); +- mnt_add_count(mnt, -1); +- if (likely(mnt->mnt_ns)) { /* shouldn't be the last one */ ++ if (likely(READ_ONCE(mnt->mnt_ns))) { ++ /* ++ * Since we don't do lock_mount_hash() here, ++ * ->mnt_ns can change under us. However, if it's ++ * non-NULL, then there's a reference that won't ++ * be dropped until after an RCU delay done after ++ * turning ->mnt_ns NULL. So if we observe it ++ * non-NULL under rcu_read_lock(), the reference ++ * we are dropping is not the final one. ++ */ ++ mnt_add_count(mnt, -1); + rcu_read_unlock(); + return; + } + lock_mount_hash(); ++ /* ++ * make sure that if __legitimize_mnt() has not seen us grab ++ * mount_lock, we'll see their refcount increment here. ++ */ ++ smp_mb(); ++ mnt_add_count(mnt, -1); + if (mnt_get_count(mnt)) { + rcu_read_unlock(); + unlock_mount_hash(); +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 2142bceaeb75..46a2f5d9aa25 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -1055,6 +1055,18 @@ int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn, + static inline void init_espfix_bsp(void) { } + #endif + ++#ifndef __HAVE_ARCH_PFN_MODIFY_ALLOWED ++static inline bool pfn_modify_allowed(unsigned long pfn, pgprot_t prot) ++{ ++ return true; ++} ++ ++static inline bool arch_has_pfn_modify_check(void) ++{ ++ return false; ++} ++#endif /* !_HAVE_ARCH_PFN_MODIFY_ALLOWED */ ++ + #endif /* !__ASSEMBLY__ */ + + #ifndef io_remap_pfn_range +diff --git a/include/linux/compiler-clang.h b/include/linux/compiler-clang.h +index 070f85d92c15..28b76f0894d4 100644 +--- a/include/linux/compiler-clang.h ++++ b/include/linux/compiler-clang.h +@@ -17,6 +17,9 @@ + */ + #define __UNIQUE_ID(prefix) __PASTE(__PASTE(__UNIQUE_ID_, prefix), __COUNTER__) + ++#undef __no_sanitize_address ++#define __no_sanitize_address __attribute__((no_sanitize("address"))) ++ + /* Clang doesn't have a way to turn it off per-function, yet. */ + #ifdef __noretpoline + #undef __noretpoline +diff --git a/include/linux/cpu.h b/include/linux/cpu.h +index 9546bf2fe310..2a378d261914 100644 +--- a/include/linux/cpu.h ++++ b/include/linux/cpu.h +@@ -30,7 +30,7 @@ struct cpu { + }; + + extern void boot_cpu_init(void); +-extern void boot_cpu_state_init(void); ++extern void boot_cpu_hotplug_init(void); + extern void cpu_init(void); + extern void trap_init(void); + +@@ -55,6 +55,8 @@ extern ssize_t cpu_show_spectre_v2(struct device *dev, + struct device_attribute *attr, char *buf); + extern ssize_t cpu_show_spec_store_bypass(struct device *dev, + struct device_attribute *attr, char *buf); ++extern ssize_t cpu_show_l1tf(struct device *dev, ++ struct device_attribute *attr, char *buf); + + extern __printf(4, 5) + struct device *cpu_device_create(struct device *parent, void *drvdata, +@@ -176,4 +178,23 @@ void cpuhp_report_idle_dead(void); + static inline void cpuhp_report_idle_dead(void) { } + #endif /* #ifdef CONFIG_HOTPLUG_CPU */ + ++enum cpuhp_smt_control { ++ CPU_SMT_ENABLED, ++ CPU_SMT_DISABLED, ++ CPU_SMT_FORCE_DISABLED, ++ CPU_SMT_NOT_SUPPORTED, ++}; ++ ++#if defined(CONFIG_SMP) && defined(CONFIG_HOTPLUG_SMT) ++extern enum cpuhp_smt_control cpu_smt_control; ++extern void cpu_smt_disable(bool force); ++extern void cpu_smt_check_topology_early(void); ++extern void cpu_smt_check_topology(void); ++#else ++# define cpu_smt_control (CPU_SMT_ENABLED) ++static inline void cpu_smt_disable(bool force) { } ++static inline void cpu_smt_check_topology_early(void) { } ++static inline void cpu_smt_check_topology(void) { } ++#endif ++ + #endif /* _LINUX_CPU_H_ */ +diff --git a/include/linux/swapfile.h b/include/linux/swapfile.h +index 06bd7b096167..e06febf62978 100644 +--- a/include/linux/swapfile.h ++++ b/include/linux/swapfile.h +@@ -10,5 +10,7 @@ extern spinlock_t swap_lock; + extern struct plist_head swap_active_head; + extern struct swap_info_struct *swap_info[]; + extern int try_to_unuse(unsigned int, bool, unsigned long); ++extern unsigned long generic_max_swapfile_size(void); ++extern unsigned long max_swapfile_size(void); + + #endif /* _LINUX_SWAPFILE_H */ +diff --git a/include/scsi/scsi_host.h b/include/scsi/scsi_host.h +index a8b7bf879ced..9c1e4bad6581 100644 +--- a/include/scsi/scsi_host.h ++++ b/include/scsi/scsi_host.h +@@ -452,6 +452,9 @@ struct scsi_host_template { + /* True if the controller does not support WRITE SAME */ + unsigned no_write_same:1; + ++ /* True if the low-level driver supports blk-mq only */ ++ unsigned force_blk_mq:1; ++ + /* + * Countdown for host blocking with no commands outstanding. + */ +diff --git a/include/uapi/linux/kvm.h b/include/uapi/linux/kvm.h +index 857bad91c454..27c62abb6c9e 100644 +--- a/include/uapi/linux/kvm.h ++++ b/include/uapi/linux/kvm.h +@@ -761,6 +761,7 @@ struct kvm_ppc_resize_hpt { + #define KVM_TRACE_PAUSE __KVM_DEPRECATED_MAIN_0x07 + #define KVM_TRACE_DISABLE __KVM_DEPRECATED_MAIN_0x08 + #define KVM_GET_EMULATED_CPUID _IOWR(KVMIO, 0x09, struct kvm_cpuid2) ++#define KVM_GET_MSR_FEATURE_INDEX_LIST _IOWR(KVMIO, 0x0a, struct kvm_msr_list) + + /* + * Extension capability list. +@@ -932,6 +933,7 @@ struct kvm_ppc_resize_hpt { + #define KVM_CAP_HYPERV_SYNIC2 148 + #define KVM_CAP_HYPERV_VP_INDEX 149 + #define KVM_CAP_S390_BPB 152 ++#define KVM_CAP_GET_MSR_FEATURES 153 + + #ifdef KVM_CAP_IRQ_ROUTING + +diff --git a/init/main.c b/init/main.c +index 0d88f37febcb..c4a45145e102 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -543,8 +543,8 @@ asmlinkage __visible void __init start_kernel(void) + setup_command_line(command_line); + setup_nr_cpu_ids(); + setup_per_cpu_areas(); +- boot_cpu_state_init(); + smp_prepare_boot_cpu(); /* arch-specific boot-cpu hooks */ ++ boot_cpu_hotplug_init(); + + build_all_zonelists(NULL); + page_alloc_init(); +diff --git a/kernel/cpu.c b/kernel/cpu.c +index f21bfa3172d8..8f02f9b6e046 100644 +--- a/kernel/cpu.c ++++ b/kernel/cpu.c +@@ -60,6 +60,7 @@ struct cpuhp_cpu_state { + bool rollback; + bool single; + bool bringup; ++ bool booted_once; + struct hlist_node *node; + struct hlist_node *last; + enum cpuhp_state cb_state; +@@ -346,6 +347,85 @@ void cpu_hotplug_enable(void) + EXPORT_SYMBOL_GPL(cpu_hotplug_enable); + #endif /* CONFIG_HOTPLUG_CPU */ + ++#ifdef CONFIG_HOTPLUG_SMT ++enum cpuhp_smt_control cpu_smt_control __read_mostly = CPU_SMT_ENABLED; ++EXPORT_SYMBOL_GPL(cpu_smt_control); ++ ++static bool cpu_smt_available __read_mostly; ++ ++void __init cpu_smt_disable(bool force) ++{ ++ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED || ++ cpu_smt_control == CPU_SMT_NOT_SUPPORTED) ++ return; ++ ++ if (force) { ++ pr_info("SMT: Force disabled\n"); ++ cpu_smt_control = CPU_SMT_FORCE_DISABLED; ++ } else { ++ cpu_smt_control = CPU_SMT_DISABLED; ++ } ++} ++ ++/* ++ * The decision whether SMT is supported can only be done after the full ++ * CPU identification. Called from architecture code before non boot CPUs ++ * are brought up. ++ */ ++void __init cpu_smt_check_topology_early(void) ++{ ++ if (!topology_smt_supported()) ++ cpu_smt_control = CPU_SMT_NOT_SUPPORTED; ++} ++ ++/* ++ * If SMT was disabled by BIOS, detect it here, after the CPUs have been ++ * brought online. This ensures the smt/l1tf sysfs entries are consistent ++ * with reality. cpu_smt_available is set to true during the bringup of non ++ * boot CPUs when a SMT sibling is detected. Note, this may overwrite ++ * cpu_smt_control's previous setting. ++ */ ++void __init cpu_smt_check_topology(void) ++{ ++ if (!cpu_smt_available) ++ cpu_smt_control = CPU_SMT_NOT_SUPPORTED; ++} ++ ++static int __init smt_cmdline_disable(char *str) ++{ ++ cpu_smt_disable(str && !strcmp(str, "force")); ++ return 0; ++} ++early_param("nosmt", smt_cmdline_disable); ++ ++static inline bool cpu_smt_allowed(unsigned int cpu) ++{ ++ if (topology_is_primary_thread(cpu)) ++ return true; ++ ++ /* ++ * If the CPU is not a 'primary' thread and the booted_once bit is ++ * set then the processor has SMT support. Store this information ++ * for the late check of SMT support in cpu_smt_check_topology(). ++ */ ++ if (per_cpu(cpuhp_state, cpu).booted_once) ++ cpu_smt_available = true; ++ ++ if (cpu_smt_control == CPU_SMT_ENABLED) ++ return true; ++ ++ /* ++ * On x86 it's required to boot all logical CPUs at least once so ++ * that the init code can get a chance to set CR4.MCE on each ++ * CPU. Otherwise, a broadacasted MCE observing CR4.MCE=0b on any ++ * core will shutdown the machine. ++ */ ++ return !per_cpu(cpuhp_state, cpu).booted_once; ++} ++#else ++static inline bool cpu_smt_allowed(unsigned int cpu) { return true; } ++#endif ++ + static inline enum cpuhp_state + cpuhp_set_state(struct cpuhp_cpu_state *st, enum cpuhp_state target) + { +@@ -426,6 +506,16 @@ static int bringup_wait_for_ap(unsigned int cpu) + stop_machine_unpark(cpu); + kthread_unpark(st->thread); + ++ /* ++ * SMT soft disabling on X86 requires to bring the CPU out of the ++ * BIOS 'wait for SIPI' state in order to set the CR4.MCE bit. The ++ * CPU marked itself as booted_once in cpu_notify_starting() so the ++ * cpu_smt_allowed() check will now return false if this is not the ++ * primary sibling. ++ */ ++ if (!cpu_smt_allowed(cpu)) ++ return -ECANCELED; ++ + if (st->target <= CPUHP_AP_ONLINE_IDLE) + return 0; + +@@ -758,7 +848,6 @@ static int takedown_cpu(unsigned int cpu) + + /* Park the smpboot threads */ + kthread_park(per_cpu_ptr(&cpuhp_state, cpu)->thread); +- smpboot_park_threads(cpu); + + /* + * Prevent irq alloc/free while the dying cpu reorganizes the +@@ -911,20 +1000,19 @@ out: + return ret; + } + ++static int cpu_down_maps_locked(unsigned int cpu, enum cpuhp_state target) ++{ ++ if (cpu_hotplug_disabled) ++ return -EBUSY; ++ return _cpu_down(cpu, 0, target); ++} ++ + static int do_cpu_down(unsigned int cpu, enum cpuhp_state target) + { + int err; + + cpu_maps_update_begin(); +- +- if (cpu_hotplug_disabled) { +- err = -EBUSY; +- goto out; +- } +- +- err = _cpu_down(cpu, 0, target); +- +-out: ++ err = cpu_down_maps_locked(cpu, target); + cpu_maps_update_done(); + return err; + } +@@ -953,6 +1041,7 @@ void notify_cpu_starting(unsigned int cpu) + int ret; + + rcu_cpu_starting(cpu); /* Enables RCU usage on this CPU. */ ++ st->booted_once = true; + while (st->state < target) { + st->state++; + ret = cpuhp_invoke_callback(cpu, st->state, true, NULL, NULL); +@@ -1062,6 +1151,10 @@ static int do_cpu_up(unsigned int cpu, enum cpuhp_state target) + err = -EBUSY; + goto out; + } ++ if (!cpu_smt_allowed(cpu)) { ++ err = -EPERM; ++ goto out; ++ } + + err = _cpu_up(cpu, 0, target); + out: +@@ -1344,7 +1437,7 @@ static struct cpuhp_step cpuhp_ap_states[] = { + [CPUHP_AP_SMPBOOT_THREADS] = { + .name = "smpboot/threads:online", + .startup.single = smpboot_unpark_threads, +- .teardown.single = NULL, ++ .teardown.single = smpboot_park_threads, + }, + [CPUHP_AP_IRQ_AFFINITY_ONLINE] = { + .name = "irq/affinity:online", +@@ -1918,10 +2011,172 @@ static const struct attribute_group cpuhp_cpu_root_attr_group = { + NULL + }; + ++#ifdef CONFIG_HOTPLUG_SMT ++ ++static const char *smt_states[] = { ++ [CPU_SMT_ENABLED] = "on", ++ [CPU_SMT_DISABLED] = "off", ++ [CPU_SMT_FORCE_DISABLED] = "forceoff", ++ [CPU_SMT_NOT_SUPPORTED] = "notsupported", ++}; ++ ++static ssize_t ++show_smt_control(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ return snprintf(buf, PAGE_SIZE - 2, "%s\n", smt_states[cpu_smt_control]); ++} ++ ++static void cpuhp_offline_cpu_device(unsigned int cpu) ++{ ++ struct device *dev = get_cpu_device(cpu); ++ ++ dev->offline = true; ++ /* Tell user space about the state change */ ++ kobject_uevent(&dev->kobj, KOBJ_OFFLINE); ++} ++ ++static void cpuhp_online_cpu_device(unsigned int cpu) ++{ ++ struct device *dev = get_cpu_device(cpu); ++ ++ dev->offline = false; ++ /* Tell user space about the state change */ ++ kobject_uevent(&dev->kobj, KOBJ_ONLINE); ++} ++ ++static int cpuhp_smt_disable(enum cpuhp_smt_control ctrlval) ++{ ++ int cpu, ret = 0; ++ ++ cpu_maps_update_begin(); ++ for_each_online_cpu(cpu) { ++ if (topology_is_primary_thread(cpu)) ++ continue; ++ ret = cpu_down_maps_locked(cpu, CPUHP_OFFLINE); ++ if (ret) ++ break; ++ /* ++ * As this needs to hold the cpu maps lock it's impossible ++ * to call device_offline() because that ends up calling ++ * cpu_down() which takes cpu maps lock. cpu maps lock ++ * needs to be held as this might race against in kernel ++ * abusers of the hotplug machinery (thermal management). ++ * ++ * So nothing would update device:offline state. That would ++ * leave the sysfs entry stale and prevent onlining after ++ * smt control has been changed to 'off' again. This is ++ * called under the sysfs hotplug lock, so it is properly ++ * serialized against the regular offline usage. ++ */ ++ cpuhp_offline_cpu_device(cpu); ++ } ++ if (!ret) ++ cpu_smt_control = ctrlval; ++ cpu_maps_update_done(); ++ return ret; ++} ++ ++static int cpuhp_smt_enable(void) ++{ ++ int cpu, ret = 0; ++ ++ cpu_maps_update_begin(); ++ cpu_smt_control = CPU_SMT_ENABLED; ++ for_each_present_cpu(cpu) { ++ /* Skip online CPUs and CPUs on offline nodes */ ++ if (cpu_online(cpu) || !node_online(cpu_to_node(cpu))) ++ continue; ++ ret = _cpu_up(cpu, 0, CPUHP_ONLINE); ++ if (ret) ++ break; ++ /* See comment in cpuhp_smt_disable() */ ++ cpuhp_online_cpu_device(cpu); ++ } ++ cpu_maps_update_done(); ++ return ret; ++} ++ ++static ssize_t ++store_smt_control(struct device *dev, struct device_attribute *attr, ++ const char *buf, size_t count) ++{ ++ int ctrlval, ret; ++ ++ if (sysfs_streq(buf, "on")) ++ ctrlval = CPU_SMT_ENABLED; ++ else if (sysfs_streq(buf, "off")) ++ ctrlval = CPU_SMT_DISABLED; ++ else if (sysfs_streq(buf, "forceoff")) ++ ctrlval = CPU_SMT_FORCE_DISABLED; ++ else ++ return -EINVAL; ++ ++ if (cpu_smt_control == CPU_SMT_FORCE_DISABLED) ++ return -EPERM; ++ ++ if (cpu_smt_control == CPU_SMT_NOT_SUPPORTED) ++ return -ENODEV; ++ ++ ret = lock_device_hotplug_sysfs(); ++ if (ret) ++ return ret; ++ ++ if (ctrlval != cpu_smt_control) { ++ switch (ctrlval) { ++ case CPU_SMT_ENABLED: ++ ret = cpuhp_smt_enable(); ++ break; ++ case CPU_SMT_DISABLED: ++ case CPU_SMT_FORCE_DISABLED: ++ ret = cpuhp_smt_disable(ctrlval); ++ break; ++ } ++ } ++ ++ unlock_device_hotplug(); ++ return ret ? ret : count; ++} ++static DEVICE_ATTR(control, 0644, show_smt_control, store_smt_control); ++ ++static ssize_t ++show_smt_active(struct device *dev, struct device_attribute *attr, char *buf) ++{ ++ bool active = topology_max_smt_threads() > 1; ++ ++ return snprintf(buf, PAGE_SIZE - 2, "%d\n", active); ++} ++static DEVICE_ATTR(active, 0444, show_smt_active, NULL); ++ ++static struct attribute *cpuhp_smt_attrs[] = { ++ &dev_attr_control.attr, ++ &dev_attr_active.attr, ++ NULL ++}; ++ ++static const struct attribute_group cpuhp_smt_attr_group = { ++ .attrs = cpuhp_smt_attrs, ++ .name = "smt", ++ NULL ++}; ++ ++static int __init cpu_smt_state_init(void) ++{ ++ return sysfs_create_group(&cpu_subsys.dev_root->kobj, ++ &cpuhp_smt_attr_group); ++} ++ ++#else ++static inline int cpu_smt_state_init(void) { return 0; } ++#endif ++ + static int __init cpuhp_sysfs_init(void) + { + int cpu, ret; + ++ ret = cpu_smt_state_init(); ++ if (ret) ++ return ret; ++ + ret = sysfs_create_group(&cpu_subsys.dev_root->kobj, + &cpuhp_cpu_root_attr_group); + if (ret) +@@ -2022,7 +2277,10 @@ void __init boot_cpu_init(void) + /* + * Must be called _AFTER_ setting up the per_cpu areas + */ +-void __init boot_cpu_state_init(void) ++void __init boot_cpu_hotplug_init(void) + { +- per_cpu_ptr(&cpuhp_state, smp_processor_id())->state = CPUHP_ONLINE; ++#ifdef CONFIG_SMP ++ this_cpu_write(cpuhp_state.booted_once, true); ++#endif ++ this_cpu_write(cpuhp_state.state, CPUHP_ONLINE); + } +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index 31615d1ae44c..4e89ed8a0fb2 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -5615,6 +5615,18 @@ int sched_cpu_activate(unsigned int cpu) + struct rq *rq = cpu_rq(cpu); + struct rq_flags rf; + ++#ifdef CONFIG_SCHED_SMT ++ /* ++ * The sched_smt_present static key needs to be evaluated on every ++ * hotplug event because at boot time SMT might be disabled when ++ * the number of booted CPUs is limited. ++ * ++ * If then later a sibling gets hotplugged, then the key would stay ++ * off and SMT scheduling would never be functional. ++ */ ++ if (cpumask_weight(cpu_smt_mask(cpu)) > 1) ++ static_branch_enable_cpuslocked(&sched_smt_present); ++#endif + set_cpu_active(cpu, true); + + if (sched_smp_initialized) { +@@ -5710,22 +5722,6 @@ int sched_cpu_dying(unsigned int cpu) + } + #endif + +-#ifdef CONFIG_SCHED_SMT +-DEFINE_STATIC_KEY_FALSE(sched_smt_present); +- +-static void sched_init_smt(void) +-{ +- /* +- * We've enumerated all CPUs and will assume that if any CPU +- * has SMT siblings, CPU0 will too. +- */ +- if (cpumask_weight(cpu_smt_mask(0)) > 1) +- static_branch_enable(&sched_smt_present); +-} +-#else +-static inline void sched_init_smt(void) { } +-#endif +- + void __init sched_init_smp(void) + { + cpumask_var_t non_isolated_cpus; +@@ -5755,8 +5751,6 @@ void __init sched_init_smp(void) + init_sched_rt_class(); + init_sched_dl_class(); + +- sched_init_smt(); +- + sched_smp_initialized = true; + } + +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index 5c09ddf8c832..0cc7098c6dfd 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -5631,6 +5631,7 @@ find_idlest_cpu(struct sched_group *group, struct task_struct *p, int this_cpu) + } + + #ifdef CONFIG_SCHED_SMT ++DEFINE_STATIC_KEY_FALSE(sched_smt_present); + + static inline void set_idle_cores(int cpu, int val) + { +diff --git a/kernel/smp.c b/kernel/smp.c +index c94dd85c8d41..2d1da290f144 100644 +--- a/kernel/smp.c ++++ b/kernel/smp.c +@@ -584,6 +584,8 @@ void __init smp_init(void) + num_nodes, (num_nodes > 1 ? "s" : ""), + num_cpus, (num_cpus > 1 ? "s" : "")); + ++ /* Final decision about SMT support */ ++ cpu_smt_check_topology(); + /* Any cleanup work */ + smp_cpus_done(setup_max_cpus); + } +diff --git a/kernel/softirq.c b/kernel/softirq.c +index f40ac7191257..a4c87cf27f9d 100644 +--- a/kernel/softirq.c ++++ b/kernel/softirq.c +@@ -79,12 +79,16 @@ static void wakeup_softirqd(void) + + /* + * If ksoftirqd is scheduled, we do not want to process pending softirqs +- * right now. Let ksoftirqd handle this at its own rate, to get fairness. ++ * right now. Let ksoftirqd handle this at its own rate, to get fairness, ++ * unless we're doing some of the synchronous softirqs. + */ +-static bool ksoftirqd_running(void) ++#define SOFTIRQ_NOW_MASK ((1 << HI_SOFTIRQ) | (1 << TASKLET_SOFTIRQ)) ++static bool ksoftirqd_running(unsigned long pending) + { + struct task_struct *tsk = __this_cpu_read(ksoftirqd); + ++ if (pending & SOFTIRQ_NOW_MASK) ++ return false; + return tsk && (tsk->state == TASK_RUNNING); + } + +@@ -324,7 +328,7 @@ asmlinkage __visible void do_softirq(void) + + pending = local_softirq_pending(); + +- if (pending && !ksoftirqd_running()) ++ if (pending && !ksoftirqd_running(pending)) + do_softirq_own_stack(); + + local_irq_restore(flags); +@@ -351,7 +355,7 @@ void irq_enter(void) + + static inline void invoke_softirq(void) + { +- if (ksoftirqd_running()) ++ if (ksoftirqd_running(local_softirq_pending())) + return; + + if (!force_irqthreads) { +diff --git a/kernel/stop_machine.c b/kernel/stop_machine.c +index 1ff523dae6e2..e190d1ef3a23 100644 +--- a/kernel/stop_machine.c ++++ b/kernel/stop_machine.c +@@ -260,6 +260,15 @@ retry: + err = 0; + __cpu_stop_queue_work(stopper1, work1, &wakeq); + __cpu_stop_queue_work(stopper2, work2, &wakeq); ++ /* ++ * The waking up of stopper threads has to happen ++ * in the same scheduling context as the queueing. ++ * Otherwise, there is a possibility of one of the ++ * above stoppers being woken up by another CPU, ++ * and preempting us. This will cause us to n ot ++ * wake up the other stopper forever. ++ */ ++ preempt_disable(); + unlock: + raw_spin_unlock(&stopper2->lock); + raw_spin_unlock_irq(&stopper1->lock); +@@ -271,7 +280,6 @@ unlock: + } + + if (!err) { +- preempt_disable(); + wake_up_q(&wakeq); + preempt_enable(); + } +diff --git a/mm/memory.c b/mm/memory.c +index fc7779165dcf..5539b1975091 100644 +--- a/mm/memory.c ++++ b/mm/memory.c +@@ -1887,6 +1887,9 @@ int vm_insert_pfn_prot(struct vm_area_struct *vma, unsigned long addr, + if (addr < vma->vm_start || addr >= vma->vm_end) + return -EFAULT; + ++ if (!pfn_modify_allowed(pfn, pgprot)) ++ return -EACCES; ++ + track_pfn_insert(vma, &pgprot, __pfn_to_pfn_t(pfn, PFN_DEV)); + + ret = insert_pfn(vma, addr, __pfn_to_pfn_t(pfn, PFN_DEV), pgprot, +@@ -1908,6 +1911,9 @@ static int __vm_insert_mixed(struct vm_area_struct *vma, unsigned long addr, + + track_pfn_insert(vma, &pgprot, pfn); + ++ if (!pfn_modify_allowed(pfn_t_to_pfn(pfn), pgprot)) ++ return -EACCES; ++ + /* + * If we don't have pte special, then we have to use the pfn_valid() + * based VM_MIXEDMAP scheme (see vm_normal_page), and thus we *must* +@@ -1955,6 +1961,7 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, + { + pte_t *pte; + spinlock_t *ptl; ++ int err = 0; + + pte = pte_alloc_map_lock(mm, pmd, addr, &ptl); + if (!pte) +@@ -1962,12 +1969,16 @@ static int remap_pte_range(struct mm_struct *mm, pmd_t *pmd, + arch_enter_lazy_mmu_mode(); + do { + BUG_ON(!pte_none(*pte)); ++ if (!pfn_modify_allowed(pfn, prot)) { ++ err = -EACCES; ++ break; ++ } + set_pte_at(mm, addr, pte, pte_mkspecial(pfn_pte(pfn, prot))); + pfn++; + } while (pte++, addr += PAGE_SIZE, addr != end); + arch_leave_lazy_mmu_mode(); + pte_unmap_unlock(pte - 1, ptl); +- return 0; ++ return err; + } + + static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud, +@@ -1976,6 +1987,7 @@ static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud, + { + pmd_t *pmd; + unsigned long next; ++ int err; + + pfn -= addr >> PAGE_SHIFT; + pmd = pmd_alloc(mm, pud, addr); +@@ -1984,9 +1996,10 @@ static inline int remap_pmd_range(struct mm_struct *mm, pud_t *pud, + VM_BUG_ON(pmd_trans_huge(*pmd)); + do { + next = pmd_addr_end(addr, end); +- if (remap_pte_range(mm, pmd, addr, next, +- pfn + (addr >> PAGE_SHIFT), prot)) +- return -ENOMEM; ++ err = remap_pte_range(mm, pmd, addr, next, ++ pfn + (addr >> PAGE_SHIFT), prot); ++ if (err) ++ return err; + } while (pmd++, addr = next, addr != end); + return 0; + } +@@ -1997,6 +2010,7 @@ static inline int remap_pud_range(struct mm_struct *mm, p4d_t *p4d, + { + pud_t *pud; + unsigned long next; ++ int err; + + pfn -= addr >> PAGE_SHIFT; + pud = pud_alloc(mm, p4d, addr); +@@ -2004,9 +2018,10 @@ static inline int remap_pud_range(struct mm_struct *mm, p4d_t *p4d, + return -ENOMEM; + do { + next = pud_addr_end(addr, end); +- if (remap_pmd_range(mm, pud, addr, next, +- pfn + (addr >> PAGE_SHIFT), prot)) +- return -ENOMEM; ++ err = remap_pmd_range(mm, pud, addr, next, ++ pfn + (addr >> PAGE_SHIFT), prot); ++ if (err) ++ return err; + } while (pud++, addr = next, addr != end); + return 0; + } +@@ -2017,6 +2032,7 @@ static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd, + { + p4d_t *p4d; + unsigned long next; ++ int err; + + pfn -= addr >> PAGE_SHIFT; + p4d = p4d_alloc(mm, pgd, addr); +@@ -2024,9 +2040,10 @@ static inline int remap_p4d_range(struct mm_struct *mm, pgd_t *pgd, + return -ENOMEM; + do { + next = p4d_addr_end(addr, end); +- if (remap_pud_range(mm, p4d, addr, next, +- pfn + (addr >> PAGE_SHIFT), prot)) +- return -ENOMEM; ++ err = remap_pud_range(mm, p4d, addr, next, ++ pfn + (addr >> PAGE_SHIFT), prot); ++ if (err) ++ return err; + } while (p4d++, addr = next, addr != end); + return 0; + } +diff --git a/mm/mprotect.c b/mm/mprotect.c +index 58b629bb70de..60864e19421e 100644 +--- a/mm/mprotect.c ++++ b/mm/mprotect.c +@@ -292,6 +292,42 @@ unsigned long change_protection(struct vm_area_struct *vma, unsigned long start, + return pages; + } + ++static int prot_none_pte_entry(pte_t *pte, unsigned long addr, ++ unsigned long next, struct mm_walk *walk) ++{ ++ return pfn_modify_allowed(pte_pfn(*pte), *(pgprot_t *)(walk->private)) ? ++ 0 : -EACCES; ++} ++ ++static int prot_none_hugetlb_entry(pte_t *pte, unsigned long hmask, ++ unsigned long addr, unsigned long next, ++ struct mm_walk *walk) ++{ ++ return pfn_modify_allowed(pte_pfn(*pte), *(pgprot_t *)(walk->private)) ? ++ 0 : -EACCES; ++} ++ ++static int prot_none_test(unsigned long addr, unsigned long next, ++ struct mm_walk *walk) ++{ ++ return 0; ++} ++ ++static int prot_none_walk(struct vm_area_struct *vma, unsigned long start, ++ unsigned long end, unsigned long newflags) ++{ ++ pgprot_t new_pgprot = vm_get_page_prot(newflags); ++ struct mm_walk prot_none_walk = { ++ .pte_entry = prot_none_pte_entry, ++ .hugetlb_entry = prot_none_hugetlb_entry, ++ .test_walk = prot_none_test, ++ .mm = current->mm, ++ .private = &new_pgprot, ++ }; ++ ++ return walk_page_range(start, end, &prot_none_walk); ++} ++ + int + mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, + unsigned long start, unsigned long end, unsigned long newflags) +@@ -309,6 +345,19 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev, + return 0; + } + ++ /* ++ * Do PROT_NONE PFN permission checks here when we can still ++ * bail out without undoing a lot of state. This is a rather ++ * uncommon case, so doesn't need to be very optimized. ++ */ ++ if (arch_has_pfn_modify_check() && ++ (vma->vm_flags & (VM_PFNMAP|VM_MIXEDMAP)) && ++ (newflags & (VM_READ|VM_WRITE|VM_EXEC)) == 0) { ++ error = prot_none_walk(vma, start, end, newflags); ++ if (error) ++ return error; ++ } ++ + /* + * If we make a private mapping writable we increase our commit; + * but (without finer accounting) cannot reduce our commit if we +diff --git a/mm/swapfile.c b/mm/swapfile.c +index 03d2ce288d83..8cbc7d6fd52e 100644 +--- a/mm/swapfile.c ++++ b/mm/swapfile.c +@@ -2902,6 +2902,35 @@ static int claim_swapfile(struct swap_info_struct *p, struct inode *inode) + return 0; + } + ++ ++/* ++ * Find out how many pages are allowed for a single swap device. There ++ * are two limiting factors: ++ * 1) the number of bits for the swap offset in the swp_entry_t type, and ++ * 2) the number of bits in the swap pte, as defined by the different ++ * architectures. ++ * ++ * In order to find the largest possible bit mask, a swap entry with ++ * swap type 0 and swap offset ~0UL is created, encoded to a swap pte, ++ * decoded to a swp_entry_t again, and finally the swap offset is ++ * extracted. ++ * ++ * This will mask all the bits from the initial ~0UL mask that can't ++ * be encoded in either the swp_entry_t or the architecture definition ++ * of a swap pte. ++ */ ++unsigned long generic_max_swapfile_size(void) ++{ ++ return swp_offset(pte_to_swp_entry( ++ swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1; ++} ++ ++/* Can be overridden by an architecture for additional checks. */ ++__weak unsigned long max_swapfile_size(void) ++{ ++ return generic_max_swapfile_size(); ++} ++ + static unsigned long read_swap_header(struct swap_info_struct *p, + union swap_header *swap_header, + struct inode *inode) +@@ -2937,22 +2966,7 @@ static unsigned long read_swap_header(struct swap_info_struct *p, + p->cluster_next = 1; + p->cluster_nr = 0; + +- /* +- * Find out how many pages are allowed for a single swap +- * device. There are two limiting factors: 1) the number +- * of bits for the swap offset in the swp_entry_t type, and +- * 2) the number of bits in the swap pte as defined by the +- * different architectures. In order to find the +- * largest possible bit mask, a swap entry with swap type 0 +- * and swap offset ~0UL is created, encoded to a swap pte, +- * decoded to a swp_entry_t again, and finally the swap +- * offset is extracted. This will mask all the bits from +- * the initial ~0UL mask that can't be encoded in either +- * the swp_entry_t or the architecture definition of a +- * swap pte. +- */ +- maxpages = swp_offset(pte_to_swp_entry( +- swp_entry_to_pte(swp_entry(0, ~0UL)))) + 1; ++ maxpages = max_swapfile_size(); + last_page = swap_header->info.last_page; + if (!last_page) { + pr_warn("Empty swap-file\n"); +diff --git a/tools/arch/x86/include/asm/cpufeatures.h b/tools/arch/x86/include/asm/cpufeatures.h +index 403e97d5e243..8418462298e7 100644 +--- a/tools/arch/x86/include/asm/cpufeatures.h ++++ b/tools/arch/x86/include/asm/cpufeatures.h +@@ -219,6 +219,7 @@ + #define X86_FEATURE_IBPB ( 7*32+26) /* Indirect Branch Prediction Barrier */ + #define X86_FEATURE_STIBP ( 7*32+27) /* Single Thread Indirect Branch Predictors */ + #define X86_FEATURE_ZEN ( 7*32+28) /* "" CPU is AMD family 0x17 (Zen) */ ++#define X86_FEATURE_L1TF_PTEINV ( 7*32+29) /* "" L1TF workaround PTE inversion */ + + /* Virtualization flags: Linux defined, word 8 */ + #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ +@@ -338,6 +339,7 @@ + #define X86_FEATURE_PCONFIG (18*32+18) /* Intel PCONFIG */ + #define X86_FEATURE_SPEC_CTRL (18*32+26) /* "" Speculation Control (IBRS + IBPB) */ + #define X86_FEATURE_INTEL_STIBP (18*32+27) /* "" Single Thread Indirect Branch Predictors */ ++#define X86_FEATURE_FLUSH_L1D (18*32+28) /* Flush L1D cache */ + #define X86_FEATURE_ARCH_CAPABILITIES (18*32+29) /* IA32_ARCH_CAPABILITIES MSR (Intel) */ + #define X86_FEATURE_SPEC_CTRL_SSBD (18*32+31) /* "" Speculative Store Bypass Disable */ + +@@ -370,5 +372,6 @@ + #define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ + #define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ + #define X86_BUG_SPEC_STORE_BYPASS X86_BUG(17) /* CPU is affected by speculative store bypass attack */ ++#define X86_BUG_L1TF X86_BUG(18) /* CPU is affected by L1 Terminal Fault */ + + #endif /* _ASM_X86_CPUFEATURES_H */ diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.63-64.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.63-64.patch new file mode 100644 index 000000000000..b4a1f5f5831d --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.63-64.patch @@ -0,0 +1,1527 @@ +diff --git a/Documentation/process/changes.rst b/Documentation/process/changes.rst +index 560beaef5a7c..73fcdcd52b87 100644 +--- a/Documentation/process/changes.rst ++++ b/Documentation/process/changes.rst +@@ -33,7 +33,7 @@ GNU C 3.2 gcc --version + GNU make 3.81 make --version + binutils 2.20 ld -v + util-linux 2.10o fdformat --version +-module-init-tools 0.9.10 depmod -V ++kmod 13 depmod -V + e2fsprogs 1.41.4 e2fsck -V + jfsutils 1.1.3 fsck.jfs -V + reiserfsprogs 3.6.3 reiserfsck -V +@@ -141,12 +141,6 @@ is not build with ``CONFIG_KALLSYMS`` and you have no way to rebuild and + reproduce the Oops with that option, then you can still decode that Oops + with ksymoops. + +-Module-Init-Tools +------------------ +- +-A new module loader is now in the kernel that requires ``module-init-tools`` +-to use. It is backward compatible with the 2.4.x series kernels. +- + Mkinitrd + -------- + +@@ -346,16 +340,17 @@ Util-linux + + - + ++Kmod ++---- ++ ++- ++- ++ + Ksymoops + -------- + + - + +-Module-Init-Tools +------------------ +- +-- +- + Mkinitrd + -------- + +diff --git a/Makefile b/Makefile +index f3bb9428b3dc..025156791e90 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 63 ++SUBLEVEL = 64 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/arm64/mm/mmu.c b/arch/arm64/mm/mmu.c +index f6b877d2726d..6ac0d32d60a5 100644 +--- a/arch/arm64/mm/mmu.c ++++ b/arch/arm64/mm/mmu.c +@@ -938,12 +938,12 @@ int pmd_clear_huge(pmd_t *pmd) + return 1; + } + +-int pud_free_pmd_page(pud_t *pud) ++int pud_free_pmd_page(pud_t *pud, unsigned long addr) + { + return pud_none(*pud); + } + +-int pmd_free_pte_page(pmd_t *pmd) ++int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) + { + return pmd_none(*pmd); + } +diff --git a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S +index 16c4ccb1f154..d2364c55bbde 100644 +--- a/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S ++++ b/arch/x86/crypto/sha256-mb/sha256_mb_mgr_flush_avx2.S +@@ -265,7 +265,7 @@ ENTRY(sha256_mb_mgr_get_comp_job_avx2) + vpinsrd $1, _args_digest+1*32(state, idx, 4), %xmm0, %xmm0 + vpinsrd $2, _args_digest+2*32(state, idx, 4), %xmm0, %xmm0 + vpinsrd $3, _args_digest+3*32(state, idx, 4), %xmm0, %xmm0 +- vmovd _args_digest(state , idx, 4) , %xmm0 ++ vmovd _args_digest+4*32(state, idx, 4), %xmm1 + vpinsrd $1, _args_digest+5*32(state, idx, 4), %xmm1, %xmm1 + vpinsrd $2, _args_digest+6*32(state, idx, 4), %xmm1, %xmm1 + vpinsrd $3, _args_digest+7*32(state, idx, 4), %xmm1, %xmm1 +diff --git a/arch/x86/include/asm/i8259.h b/arch/x86/include/asm/i8259.h +index 5cdcdbd4d892..89789e8c80f6 100644 +--- a/arch/x86/include/asm/i8259.h ++++ b/arch/x86/include/asm/i8259.h +@@ -3,6 +3,7 @@ + #define _ASM_X86_I8259_H + + #include ++#include + + extern unsigned int cached_irq_mask; + +diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c +index edfc64a8a154..d07addb99b71 100644 +--- a/arch/x86/kernel/cpu/bugs.c ++++ b/arch/x86/kernel/cpu/bugs.c +@@ -648,10 +648,9 @@ void x86_spec_ctrl_setup_ap(void) + enum l1tf_mitigations l1tf_mitigation __ro_after_init = L1TF_MITIGATION_FLUSH; + #if IS_ENABLED(CONFIG_KVM_INTEL) + EXPORT_SYMBOL_GPL(l1tf_mitigation); +- ++#endif + enum vmx_l1d_flush_state l1tf_vmx_mitigation = VMENTER_L1D_FLUSH_AUTO; + EXPORT_SYMBOL_GPL(l1tf_vmx_mitigation); +-#endif + + static void __init l1tf_select_mitigation(void) + { +diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c +index c03c85e4fb6a..2bdb8e8a9d7c 100644 +--- a/arch/x86/mm/pgtable.c ++++ b/arch/x86/mm/pgtable.c +@@ -712,28 +712,50 @@ int pmd_clear_huge(pmd_t *pmd) + return 0; + } + ++#ifdef CONFIG_X86_64 + /** + * pud_free_pmd_page - Clear pud entry and free pmd page. + * @pud: Pointer to a PUD. ++ * @addr: Virtual address associated with pud. + * +- * Context: The pud range has been unmaped and TLB purged. ++ * Context: The pud range has been unmapped and TLB purged. + * Return: 1 if clearing the entry succeeded. 0 otherwise. ++ * ++ * NOTE: Callers must allow a single page allocation. + */ +-int pud_free_pmd_page(pud_t *pud) ++int pud_free_pmd_page(pud_t *pud, unsigned long addr) + { +- pmd_t *pmd; ++ pmd_t *pmd, *pmd_sv; ++ pte_t *pte; + int i; + + if (pud_none(*pud)) + return 1; + + pmd = (pmd_t *)pud_page_vaddr(*pud); ++ pmd_sv = (pmd_t *)__get_free_page(GFP_KERNEL); ++ if (!pmd_sv) ++ return 0; + +- for (i = 0; i < PTRS_PER_PMD; i++) +- if (!pmd_free_pte_page(&pmd[i])) +- return 0; ++ for (i = 0; i < PTRS_PER_PMD; i++) { ++ pmd_sv[i] = pmd[i]; ++ if (!pmd_none(pmd[i])) ++ pmd_clear(&pmd[i]); ++ } + + pud_clear(pud); ++ ++ /* INVLPG to clear all paging-structure caches */ ++ flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1); ++ ++ for (i = 0; i < PTRS_PER_PMD; i++) { ++ if (!pmd_none(pmd_sv[i])) { ++ pte = (pte_t *)pmd_page_vaddr(pmd_sv[i]); ++ free_page((unsigned long)pte); ++ } ++ } ++ ++ free_page((unsigned long)pmd_sv); + free_page((unsigned long)pmd); + + return 1; +@@ -742,11 +764,12 @@ int pud_free_pmd_page(pud_t *pud) + /** + * pmd_free_pte_page - Clear pmd entry and free pte page. + * @pmd: Pointer to a PMD. ++ * @addr: Virtual address associated with pmd. + * +- * Context: The pmd range has been unmaped and TLB purged. ++ * Context: The pmd range has been unmapped and TLB purged. + * Return: 1 if clearing the entry succeeded. 0 otherwise. + */ +-int pmd_free_pte_page(pmd_t *pmd) ++int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) + { + pte_t *pte; + +@@ -755,8 +778,30 @@ int pmd_free_pte_page(pmd_t *pmd) + + pte = (pte_t *)pmd_page_vaddr(*pmd); + pmd_clear(pmd); ++ ++ /* INVLPG to clear all paging-structure caches */ ++ flush_tlb_kernel_range(addr, addr + PAGE_SIZE-1); ++ + free_page((unsigned long)pte); + + return 1; + } ++ ++#else /* !CONFIG_X86_64 */ ++ ++int pud_free_pmd_page(pud_t *pud, unsigned long addr) ++{ ++ return pud_none(*pud); ++} ++ ++/* ++ * Disable free page handling on x86-PAE. This assures that ioremap() ++ * does not update sync'd pmd entries. See vmalloc_sync_one(). ++ */ ++int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) ++{ ++ return pmd_none(*pmd); ++} ++ ++#endif /* CONFIG_X86_64 */ + #endif /* CONFIG_HAVE_ARCH_HUGE_VMAP */ +diff --git a/block/bfq-iosched.c b/block/bfq-iosched.c +index 4a4b7d3c909a..3b44bd28fc45 100644 +--- a/block/bfq-iosched.c ++++ b/block/bfq-iosched.c +@@ -1203,6 +1203,24 @@ static unsigned int bfq_wr_duration(struct bfq_data *bfqd) + return dur; + } + ++/* ++ * Return the farthest future time instant according to jiffies ++ * macros. ++ */ ++static unsigned long bfq_greatest_from_now(void) ++{ ++ return jiffies + MAX_JIFFY_OFFSET; ++} ++ ++/* ++ * Return the farthest past time instant according to jiffies ++ * macros. ++ */ ++static unsigned long bfq_smallest_from_now(void) ++{ ++ return jiffies - MAX_JIFFY_OFFSET; ++} ++ + static void bfq_update_bfqq_wr_on_rq_arrival(struct bfq_data *bfqd, + struct bfq_queue *bfqq, + unsigned int old_wr_coeff, +@@ -1217,7 +1235,19 @@ static void bfq_update_bfqq_wr_on_rq_arrival(struct bfq_data *bfqd, + bfqq->wr_coeff = bfqd->bfq_wr_coeff; + bfqq->wr_cur_max_time = bfq_wr_duration(bfqd); + } else { +- bfqq->wr_start_at_switch_to_srt = jiffies; ++ /* ++ * No interactive weight raising in progress ++ * here: assign minus infinity to ++ * wr_start_at_switch_to_srt, to make sure ++ * that, at the end of the soft-real-time ++ * weight raising periods that is starting ++ * now, no interactive weight-raising period ++ * may be wrongly considered as still in ++ * progress (and thus actually started by ++ * mistake). ++ */ ++ bfqq->wr_start_at_switch_to_srt = ++ bfq_smallest_from_now(); + bfqq->wr_coeff = bfqd->bfq_wr_coeff * + BFQ_SOFTRT_WEIGHT_FACTOR; + bfqq->wr_cur_max_time = +@@ -2896,24 +2926,6 @@ static unsigned long bfq_bfqq_softrt_next_start(struct bfq_data *bfqd, + jiffies + nsecs_to_jiffies(bfqq->bfqd->bfq_slice_idle) + 4); + } + +-/* +- * Return the farthest future time instant according to jiffies +- * macros. +- */ +-static unsigned long bfq_greatest_from_now(void) +-{ +- return jiffies + MAX_JIFFY_OFFSET; +-} +- +-/* +- * Return the farthest past time instant according to jiffies +- * macros. +- */ +-static unsigned long bfq_smallest_from_now(void) +-{ +- return jiffies - MAX_JIFFY_OFFSET; +-} +- + /** + * bfq_bfqq_expire - expire a queue. + * @bfqd: device owning the queue. +diff --git a/crypto/ablkcipher.c b/crypto/ablkcipher.c +index d880a4897159..4ee7c041bb82 100644 +--- a/crypto/ablkcipher.c ++++ b/crypto/ablkcipher.c +@@ -71,11 +71,9 @@ static inline u8 *ablkcipher_get_spot(u8 *start, unsigned int len) + return max(start, end_page); + } + +-static inline unsigned int ablkcipher_done_slow(struct ablkcipher_walk *walk, +- unsigned int bsize) ++static inline void ablkcipher_done_slow(struct ablkcipher_walk *walk, ++ unsigned int n) + { +- unsigned int n = bsize; +- + for (;;) { + unsigned int len_this_page = scatterwalk_pagelen(&walk->out); + +@@ -87,17 +85,13 @@ static inline unsigned int ablkcipher_done_slow(struct ablkcipher_walk *walk, + n -= len_this_page; + scatterwalk_start(&walk->out, sg_next(walk->out.sg)); + } +- +- return bsize; + } + +-static inline unsigned int ablkcipher_done_fast(struct ablkcipher_walk *walk, +- unsigned int n) ++static inline void ablkcipher_done_fast(struct ablkcipher_walk *walk, ++ unsigned int n) + { + scatterwalk_advance(&walk->in, n); + scatterwalk_advance(&walk->out, n); +- +- return n; + } + + static int ablkcipher_walk_next(struct ablkcipher_request *req, +@@ -107,39 +101,40 @@ int ablkcipher_walk_done(struct ablkcipher_request *req, + struct ablkcipher_walk *walk, int err) + { + struct crypto_tfm *tfm = req->base.tfm; +- unsigned int nbytes = 0; ++ unsigned int n; /* bytes processed */ ++ bool more; + +- if (likely(err >= 0)) { +- unsigned int n = walk->nbytes - err; ++ if (unlikely(err < 0)) ++ goto finish; + +- if (likely(!(walk->flags & ABLKCIPHER_WALK_SLOW))) +- n = ablkcipher_done_fast(walk, n); +- else if (WARN_ON(err)) { +- err = -EINVAL; +- goto err; +- } else +- n = ablkcipher_done_slow(walk, n); ++ n = walk->nbytes - err; ++ walk->total -= n; ++ more = (walk->total != 0); + +- nbytes = walk->total - n; +- err = 0; ++ if (likely(!(walk->flags & ABLKCIPHER_WALK_SLOW))) { ++ ablkcipher_done_fast(walk, n); ++ } else { ++ if (WARN_ON(err)) { ++ /* unexpected case; didn't process all bytes */ ++ err = -EINVAL; ++ goto finish; ++ } ++ ablkcipher_done_slow(walk, n); + } + +- scatterwalk_done(&walk->in, 0, nbytes); +- scatterwalk_done(&walk->out, 1, nbytes); +- +-err: +- walk->total = nbytes; +- walk->nbytes = nbytes; ++ scatterwalk_done(&walk->in, 0, more); ++ scatterwalk_done(&walk->out, 1, more); + +- if (nbytes) { ++ if (more) { + crypto_yield(req->base.flags); + return ablkcipher_walk_next(req, walk); + } +- ++ err = 0; ++finish: ++ walk->nbytes = 0; + if (walk->iv != req->info) + memcpy(req->info, walk->iv, tfm->crt_ablkcipher.ivsize); + kfree(walk->iv_buffer); +- + return err; + } + EXPORT_SYMBOL_GPL(ablkcipher_walk_done); +diff --git a/crypto/blkcipher.c b/crypto/blkcipher.c +index 6c43a0a17a55..d84c6920ada9 100644 +--- a/crypto/blkcipher.c ++++ b/crypto/blkcipher.c +@@ -71,19 +71,18 @@ static inline u8 *blkcipher_get_spot(u8 *start, unsigned int len) + return max(start, end_page); + } + +-static inline unsigned int blkcipher_done_slow(struct blkcipher_walk *walk, +- unsigned int bsize) ++static inline void blkcipher_done_slow(struct blkcipher_walk *walk, ++ unsigned int bsize) + { + u8 *addr; + + addr = (u8 *)ALIGN((unsigned long)walk->buffer, walk->alignmask + 1); + addr = blkcipher_get_spot(addr, bsize); + scatterwalk_copychunks(addr, &walk->out, bsize, 1); +- return bsize; + } + +-static inline unsigned int blkcipher_done_fast(struct blkcipher_walk *walk, +- unsigned int n) ++static inline void blkcipher_done_fast(struct blkcipher_walk *walk, ++ unsigned int n) + { + if (walk->flags & BLKCIPHER_WALK_COPY) { + blkcipher_map_dst(walk); +@@ -97,49 +96,48 @@ static inline unsigned int blkcipher_done_fast(struct blkcipher_walk *walk, + + scatterwalk_advance(&walk->in, n); + scatterwalk_advance(&walk->out, n); +- +- return n; + } + + int blkcipher_walk_done(struct blkcipher_desc *desc, + struct blkcipher_walk *walk, int err) + { +- unsigned int nbytes = 0; ++ unsigned int n; /* bytes processed */ ++ bool more; + +- if (likely(err >= 0)) { +- unsigned int n = walk->nbytes - err; ++ if (unlikely(err < 0)) ++ goto finish; + +- if (likely(!(walk->flags & BLKCIPHER_WALK_SLOW))) +- n = blkcipher_done_fast(walk, n); +- else if (WARN_ON(err)) { +- err = -EINVAL; +- goto err; +- } else +- n = blkcipher_done_slow(walk, n); ++ n = walk->nbytes - err; ++ walk->total -= n; ++ more = (walk->total != 0); + +- nbytes = walk->total - n; +- err = 0; ++ if (likely(!(walk->flags & BLKCIPHER_WALK_SLOW))) { ++ blkcipher_done_fast(walk, n); ++ } else { ++ if (WARN_ON(err)) { ++ /* unexpected case; didn't process all bytes */ ++ err = -EINVAL; ++ goto finish; ++ } ++ blkcipher_done_slow(walk, n); + } + +- scatterwalk_done(&walk->in, 0, nbytes); +- scatterwalk_done(&walk->out, 1, nbytes); ++ scatterwalk_done(&walk->in, 0, more); ++ scatterwalk_done(&walk->out, 1, more); + +-err: +- walk->total = nbytes; +- walk->nbytes = nbytes; +- +- if (nbytes) { ++ if (more) { + crypto_yield(desc->flags); + return blkcipher_walk_next(desc, walk); + } +- ++ err = 0; ++finish: ++ walk->nbytes = 0; + if (walk->iv != desc->info) + memcpy(desc->info, walk->iv, walk->ivsize); + if (walk->buffer != walk->page) + kfree(walk->buffer); + if (walk->page) + free_page((unsigned long)walk->page); +- + return err; + } + EXPORT_SYMBOL_GPL(blkcipher_walk_done); +diff --git a/crypto/skcipher.c b/crypto/skcipher.c +index 11af5fd6a443..e319421a32e7 100644 +--- a/crypto/skcipher.c ++++ b/crypto/skcipher.c +@@ -95,7 +95,7 @@ static inline u8 *skcipher_get_spot(u8 *start, unsigned int len) + return max(start, end_page); + } + +-static int skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize) ++static void skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize) + { + u8 *addr; + +@@ -103,23 +103,24 @@ static int skcipher_done_slow(struct skcipher_walk *walk, unsigned int bsize) + addr = skcipher_get_spot(addr, bsize); + scatterwalk_copychunks(addr, &walk->out, bsize, + (walk->flags & SKCIPHER_WALK_PHYS) ? 2 : 1); +- return 0; + } + + int skcipher_walk_done(struct skcipher_walk *walk, int err) + { +- unsigned int n = walk->nbytes - err; +- unsigned int nbytes; ++ unsigned int n; /* bytes processed */ ++ bool more; ++ ++ if (unlikely(err < 0)) ++ goto finish; + +- nbytes = walk->total - n; ++ n = walk->nbytes - err; ++ walk->total -= n; ++ more = (walk->total != 0); + +- if (unlikely(err < 0)) { +- nbytes = 0; +- n = 0; +- } else if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS | +- SKCIPHER_WALK_SLOW | +- SKCIPHER_WALK_COPY | +- SKCIPHER_WALK_DIFF)))) { ++ if (likely(!(walk->flags & (SKCIPHER_WALK_PHYS | ++ SKCIPHER_WALK_SLOW | ++ SKCIPHER_WALK_COPY | ++ SKCIPHER_WALK_DIFF)))) { + unmap_src: + skcipher_unmap_src(walk); + } else if (walk->flags & SKCIPHER_WALK_DIFF) { +@@ -131,28 +132,28 @@ unmap_src: + skcipher_unmap_dst(walk); + } else if (unlikely(walk->flags & SKCIPHER_WALK_SLOW)) { + if (WARN_ON(err)) { ++ /* unexpected case; didn't process all bytes */ + err = -EINVAL; +- nbytes = 0; +- } else +- n = skcipher_done_slow(walk, n); ++ goto finish; ++ } ++ skcipher_done_slow(walk, n); ++ goto already_advanced; + } + +- if (err > 0) +- err = 0; +- +- walk->total = nbytes; +- walk->nbytes = nbytes; +- + scatterwalk_advance(&walk->in, n); + scatterwalk_advance(&walk->out, n); +- scatterwalk_done(&walk->in, 0, nbytes); +- scatterwalk_done(&walk->out, 1, nbytes); ++already_advanced: ++ scatterwalk_done(&walk->in, 0, more); ++ scatterwalk_done(&walk->out, 1, more); + +- if (nbytes) { ++ if (more) { + crypto_yield(walk->flags & SKCIPHER_WALK_SLEEP ? + CRYPTO_TFM_REQ_MAY_SLEEP : 0); + return skcipher_walk_next(walk); + } ++ err = 0; ++finish: ++ walk->nbytes = 0; + + /* Short-circuit for the common/fast path. */ + if (!((unsigned long)walk->buffer | (unsigned long)walk->page)) +@@ -399,7 +400,7 @@ static int skcipher_copy_iv(struct skcipher_walk *walk) + unsigned size; + u8 *iv; + +- aligned_bs = ALIGN(bs, alignmask); ++ aligned_bs = ALIGN(bs, alignmask + 1); + + /* Minimum size to align buffer by alignmask. */ + size = alignmask & ~a; +diff --git a/crypto/vmac.c b/crypto/vmac.c +index df76a816cfb2..bb2fc787d615 100644 +--- a/crypto/vmac.c ++++ b/crypto/vmac.c +@@ -1,6 +1,10 @@ + /* +- * Modified to interface to the Linux kernel ++ * VMAC: Message Authentication Code using Universal Hashing ++ * ++ * Reference: https://tools.ietf.org/html/draft-krovetz-vmac-01 ++ * + * Copyright (c) 2009, Intel Corporation. ++ * Copyright (c) 2018, Google Inc. + * + * This program is free software; you can redistribute it and/or modify it + * under the terms and conditions of the GNU General Public License, +@@ -16,14 +20,15 @@ + * Place - Suite 330, Boston, MA 02111-1307 USA. + */ + +-/* -------------------------------------------------------------------------- +- * VMAC and VHASH Implementation by Ted Krovetz (tdk@acm.org) and Wei Dai. +- * This implementation is herby placed in the public domain. +- * The authors offers no warranty. Use at your own risk. +- * Please send bug reports to the authors. +- * Last modified: 17 APR 08, 1700 PDT +- * ----------------------------------------------------------------------- */ ++/* ++ * Derived from: ++ * VMAC and VHASH Implementation by Ted Krovetz (tdk@acm.org) and Wei Dai. ++ * This implementation is herby placed in the public domain. ++ * The authors offers no warranty. Use at your own risk. ++ * Last modified: 17 APR 08, 1700 PDT ++ */ + ++#include + #include + #include + #include +@@ -31,9 +36,35 @@ + #include + #include + #include +-#include + #include + ++/* ++ * User definable settings. ++ */ ++#define VMAC_TAG_LEN 64 ++#define VMAC_KEY_SIZE 128/* Must be 128, 192 or 256 */ ++#define VMAC_KEY_LEN (VMAC_KEY_SIZE/8) ++#define VMAC_NHBYTES 128/* Must 2^i for any 3 < i < 13 Standard = 128*/ ++ ++/* per-transform (per-key) context */ ++struct vmac_tfm_ctx { ++ struct crypto_cipher *cipher; ++ u64 nhkey[(VMAC_NHBYTES/8)+2*(VMAC_TAG_LEN/64-1)]; ++ u64 polykey[2*VMAC_TAG_LEN/64]; ++ u64 l3key[2*VMAC_TAG_LEN/64]; ++}; ++ ++/* per-request context */ ++struct vmac_desc_ctx { ++ union { ++ u8 partial[VMAC_NHBYTES]; /* partial block */ ++ __le64 partial_words[VMAC_NHBYTES / 8]; ++ }; ++ unsigned int partial_size; /* size of the partial block */ ++ bool first_block_processed; ++ u64 polytmp[2*VMAC_TAG_LEN/64]; /* running total of L2-hash */ ++}; ++ + /* + * Constants and masks + */ +@@ -318,13 +349,6 @@ static void poly_step_func(u64 *ahi, u64 *alo, + } while (0) + #endif + +-static void vhash_abort(struct vmac_ctx *ctx) +-{ +- ctx->polytmp[0] = ctx->polykey[0] ; +- ctx->polytmp[1] = ctx->polykey[1] ; +- ctx->first_block_processed = 0; +-} +- + static u64 l3hash(u64 p1, u64 p2, u64 k1, u64 k2, u64 len) + { + u64 rh, rl, t, z = 0; +@@ -364,280 +388,209 @@ static u64 l3hash(u64 p1, u64 p2, u64 k1, u64 k2, u64 len) + return rl; + } + +-static void vhash_update(const unsigned char *m, +- unsigned int mbytes, /* Pos multiple of VMAC_NHBYTES */ +- struct vmac_ctx *ctx) ++/* L1 and L2-hash one or more VMAC_NHBYTES-byte blocks */ ++static void vhash_blocks(const struct vmac_tfm_ctx *tctx, ++ struct vmac_desc_ctx *dctx, ++ const __le64 *mptr, unsigned int blocks) + { +- u64 rh, rl, *mptr; +- const u64 *kptr = (u64 *)ctx->nhkey; +- int i; +- u64 ch, cl; +- u64 pkh = ctx->polykey[0]; +- u64 pkl = ctx->polykey[1]; +- +- if (!mbytes) +- return; +- +- BUG_ON(mbytes % VMAC_NHBYTES); +- +- mptr = (u64 *)m; +- i = mbytes / VMAC_NHBYTES; /* Must be non-zero */ +- +- ch = ctx->polytmp[0]; +- cl = ctx->polytmp[1]; +- +- if (!ctx->first_block_processed) { +- ctx->first_block_processed = 1; ++ const u64 *kptr = tctx->nhkey; ++ const u64 pkh = tctx->polykey[0]; ++ const u64 pkl = tctx->polykey[1]; ++ u64 ch = dctx->polytmp[0]; ++ u64 cl = dctx->polytmp[1]; ++ u64 rh, rl; ++ ++ if (!dctx->first_block_processed) { ++ dctx->first_block_processed = true; + nh_vmac_nhbytes(mptr, kptr, VMAC_NHBYTES/8, rh, rl); + rh &= m62; + ADD128(ch, cl, rh, rl); + mptr += (VMAC_NHBYTES/sizeof(u64)); +- i--; ++ blocks--; + } + +- while (i--) { ++ while (blocks--) { + nh_vmac_nhbytes(mptr, kptr, VMAC_NHBYTES/8, rh, rl); + rh &= m62; + poly_step(ch, cl, pkh, pkl, rh, rl); + mptr += (VMAC_NHBYTES/sizeof(u64)); + } + +- ctx->polytmp[0] = ch; +- ctx->polytmp[1] = cl; ++ dctx->polytmp[0] = ch; ++ dctx->polytmp[1] = cl; + } + +-static u64 vhash(unsigned char m[], unsigned int mbytes, +- u64 *tagl, struct vmac_ctx *ctx) ++static int vmac_setkey(struct crypto_shash *tfm, ++ const u8 *key, unsigned int keylen) + { +- u64 rh, rl, *mptr; +- const u64 *kptr = (u64 *)ctx->nhkey; +- int i, remaining; +- u64 ch, cl; +- u64 pkh = ctx->polykey[0]; +- u64 pkl = ctx->polykey[1]; +- +- mptr = (u64 *)m; +- i = mbytes / VMAC_NHBYTES; +- remaining = mbytes % VMAC_NHBYTES; +- +- if (ctx->first_block_processed) { +- ch = ctx->polytmp[0]; +- cl = ctx->polytmp[1]; +- } else if (i) { +- nh_vmac_nhbytes(mptr, kptr, VMAC_NHBYTES/8, ch, cl); +- ch &= m62; +- ADD128(ch, cl, pkh, pkl); +- mptr += (VMAC_NHBYTES/sizeof(u64)); +- i--; +- } else if (remaining) { +- nh_16(mptr, kptr, 2*((remaining+15)/16), ch, cl); +- ch &= m62; +- ADD128(ch, cl, pkh, pkl); +- mptr += (VMAC_NHBYTES/sizeof(u64)); +- goto do_l3; +- } else {/* Empty String */ +- ch = pkh; cl = pkl; +- goto do_l3; +- } +- +- while (i--) { +- nh_vmac_nhbytes(mptr, kptr, VMAC_NHBYTES/8, rh, rl); +- rh &= m62; +- poly_step(ch, cl, pkh, pkl, rh, rl); +- mptr += (VMAC_NHBYTES/sizeof(u64)); +- } +- if (remaining) { +- nh_16(mptr, kptr, 2*((remaining+15)/16), rh, rl); +- rh &= m62; +- poly_step(ch, cl, pkh, pkl, rh, rl); +- } +- +-do_l3: +- vhash_abort(ctx); +- remaining *= 8; +- return l3hash(ch, cl, ctx->l3key[0], ctx->l3key[1], remaining); +-} ++ struct vmac_tfm_ctx *tctx = crypto_shash_ctx(tfm); ++ __be64 out[2]; ++ u8 in[16] = { 0 }; ++ unsigned int i; ++ int err; + +-static u64 vmac(unsigned char m[], unsigned int mbytes, +- const unsigned char n[16], u64 *tagl, +- struct vmac_ctx_t *ctx) +-{ +- u64 *in_n, *out_p; +- u64 p, h; +- int i; +- +- in_n = ctx->__vmac_ctx.cached_nonce; +- out_p = ctx->__vmac_ctx.cached_aes; +- +- i = n[15] & 1; +- if ((*(u64 *)(n+8) != in_n[1]) || (*(u64 *)(n) != in_n[0])) { +- in_n[0] = *(u64 *)(n); +- in_n[1] = *(u64 *)(n+8); +- ((unsigned char *)in_n)[15] &= 0xFE; +- crypto_cipher_encrypt_one(ctx->child, +- (unsigned char *)out_p, (unsigned char *)in_n); +- +- ((unsigned char *)in_n)[15] |= (unsigned char)(1-i); ++ if (keylen != VMAC_KEY_LEN) { ++ crypto_shash_set_flags(tfm, CRYPTO_TFM_RES_BAD_KEY_LEN); ++ return -EINVAL; + } +- p = be64_to_cpup(out_p + i); +- h = vhash(m, mbytes, (u64 *)0, &ctx->__vmac_ctx); +- return le64_to_cpu(p + h); +-} + +-static int vmac_set_key(unsigned char user_key[], struct vmac_ctx_t *ctx) +-{ +- u64 in[2] = {0}, out[2]; +- unsigned i; +- int err = 0; +- +- err = crypto_cipher_setkey(ctx->child, user_key, VMAC_KEY_LEN); ++ err = crypto_cipher_setkey(tctx->cipher, key, keylen); + if (err) + return err; + + /* Fill nh key */ +- ((unsigned char *)in)[0] = 0x80; +- for (i = 0; i < sizeof(ctx->__vmac_ctx.nhkey)/8; i += 2) { +- crypto_cipher_encrypt_one(ctx->child, +- (unsigned char *)out, (unsigned char *)in); +- ctx->__vmac_ctx.nhkey[i] = be64_to_cpup(out); +- ctx->__vmac_ctx.nhkey[i+1] = be64_to_cpup(out+1); +- ((unsigned char *)in)[15] += 1; ++ in[0] = 0x80; ++ for (i = 0; i < ARRAY_SIZE(tctx->nhkey); i += 2) { ++ crypto_cipher_encrypt_one(tctx->cipher, (u8 *)out, in); ++ tctx->nhkey[i] = be64_to_cpu(out[0]); ++ tctx->nhkey[i+1] = be64_to_cpu(out[1]); ++ in[15]++; + } + + /* Fill poly key */ +- ((unsigned char *)in)[0] = 0xC0; +- in[1] = 0; +- for (i = 0; i < sizeof(ctx->__vmac_ctx.polykey)/8; i += 2) { +- crypto_cipher_encrypt_one(ctx->child, +- (unsigned char *)out, (unsigned char *)in); +- ctx->__vmac_ctx.polytmp[i] = +- ctx->__vmac_ctx.polykey[i] = +- be64_to_cpup(out) & mpoly; +- ctx->__vmac_ctx.polytmp[i+1] = +- ctx->__vmac_ctx.polykey[i+1] = +- be64_to_cpup(out+1) & mpoly; +- ((unsigned char *)in)[15] += 1; ++ in[0] = 0xC0; ++ in[15] = 0; ++ for (i = 0; i < ARRAY_SIZE(tctx->polykey); i += 2) { ++ crypto_cipher_encrypt_one(tctx->cipher, (u8 *)out, in); ++ tctx->polykey[i] = be64_to_cpu(out[0]) & mpoly; ++ tctx->polykey[i+1] = be64_to_cpu(out[1]) & mpoly; ++ in[15]++; + } + + /* Fill ip key */ +- ((unsigned char *)in)[0] = 0xE0; +- in[1] = 0; +- for (i = 0; i < sizeof(ctx->__vmac_ctx.l3key)/8; i += 2) { ++ in[0] = 0xE0; ++ in[15] = 0; ++ for (i = 0; i < ARRAY_SIZE(tctx->l3key); i += 2) { + do { +- crypto_cipher_encrypt_one(ctx->child, +- (unsigned char *)out, (unsigned char *)in); +- ctx->__vmac_ctx.l3key[i] = be64_to_cpup(out); +- ctx->__vmac_ctx.l3key[i+1] = be64_to_cpup(out+1); +- ((unsigned char *)in)[15] += 1; +- } while (ctx->__vmac_ctx.l3key[i] >= p64 +- || ctx->__vmac_ctx.l3key[i+1] >= p64); ++ crypto_cipher_encrypt_one(tctx->cipher, (u8 *)out, in); ++ tctx->l3key[i] = be64_to_cpu(out[0]); ++ tctx->l3key[i+1] = be64_to_cpu(out[1]); ++ in[15]++; ++ } while (tctx->l3key[i] >= p64 || tctx->l3key[i+1] >= p64); + } + +- /* Invalidate nonce/aes cache and reset other elements */ +- ctx->__vmac_ctx.cached_nonce[0] = (u64)-1; /* Ensure illegal nonce */ +- ctx->__vmac_ctx.cached_nonce[1] = (u64)0; /* Ensure illegal nonce */ +- ctx->__vmac_ctx.first_block_processed = 0; +- +- return err; ++ return 0; + } + +-static int vmac_setkey(struct crypto_shash *parent, +- const u8 *key, unsigned int keylen) ++static int vmac_init(struct shash_desc *desc) + { +- struct vmac_ctx_t *ctx = crypto_shash_ctx(parent); ++ const struct vmac_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm); ++ struct vmac_desc_ctx *dctx = shash_desc_ctx(desc); + +- if (keylen != VMAC_KEY_LEN) { +- crypto_shash_set_flags(parent, CRYPTO_TFM_RES_BAD_KEY_LEN); +- return -EINVAL; +- } +- +- return vmac_set_key((u8 *)key, ctx); +-} +- +-static int vmac_init(struct shash_desc *pdesc) +-{ ++ dctx->partial_size = 0; ++ dctx->first_block_processed = false; ++ memcpy(dctx->polytmp, tctx->polykey, sizeof(dctx->polytmp)); + return 0; + } + +-static int vmac_update(struct shash_desc *pdesc, const u8 *p, +- unsigned int len) ++static int vmac_update(struct shash_desc *desc, const u8 *p, unsigned int len) + { +- struct crypto_shash *parent = pdesc->tfm; +- struct vmac_ctx_t *ctx = crypto_shash_ctx(parent); +- int expand; +- int min; +- +- expand = VMAC_NHBYTES - ctx->partial_size > 0 ? +- VMAC_NHBYTES - ctx->partial_size : 0; +- +- min = len < expand ? len : expand; +- +- memcpy(ctx->partial + ctx->partial_size, p, min); +- ctx->partial_size += min; +- +- if (len < expand) +- return 0; +- +- vhash_update(ctx->partial, VMAC_NHBYTES, &ctx->__vmac_ctx); +- ctx->partial_size = 0; +- +- len -= expand; +- p += expand; ++ const struct vmac_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm); ++ struct vmac_desc_ctx *dctx = shash_desc_ctx(desc); ++ unsigned int n; ++ ++ if (dctx->partial_size) { ++ n = min(len, VMAC_NHBYTES - dctx->partial_size); ++ memcpy(&dctx->partial[dctx->partial_size], p, n); ++ dctx->partial_size += n; ++ p += n; ++ len -= n; ++ if (dctx->partial_size == VMAC_NHBYTES) { ++ vhash_blocks(tctx, dctx, dctx->partial_words, 1); ++ dctx->partial_size = 0; ++ } ++ } + +- if (len % VMAC_NHBYTES) { +- memcpy(ctx->partial, p + len - (len % VMAC_NHBYTES), +- len % VMAC_NHBYTES); +- ctx->partial_size = len % VMAC_NHBYTES; ++ if (len >= VMAC_NHBYTES) { ++ n = round_down(len, VMAC_NHBYTES); ++ /* TODO: 'p' may be misaligned here */ ++ vhash_blocks(tctx, dctx, (const __le64 *)p, n / VMAC_NHBYTES); ++ p += n; ++ len -= n; + } + +- vhash_update(p, len - len % VMAC_NHBYTES, &ctx->__vmac_ctx); ++ if (len) { ++ memcpy(dctx->partial, p, len); ++ dctx->partial_size = len; ++ } + + return 0; + } + +-static int vmac_final(struct shash_desc *pdesc, u8 *out) ++static u64 vhash_final(const struct vmac_tfm_ctx *tctx, ++ struct vmac_desc_ctx *dctx) + { +- struct crypto_shash *parent = pdesc->tfm; +- struct vmac_ctx_t *ctx = crypto_shash_ctx(parent); +- vmac_t mac; +- u8 nonce[16] = {}; +- +- /* vmac() ends up accessing outside the array bounds that +- * we specify. In appears to access up to the next 2-word +- * boundary. We'll just be uber cautious and zero the +- * unwritten bytes in the buffer. +- */ +- if (ctx->partial_size) { +- memset(ctx->partial + ctx->partial_size, 0, +- VMAC_NHBYTES - ctx->partial_size); ++ unsigned int partial = dctx->partial_size; ++ u64 ch = dctx->polytmp[0]; ++ u64 cl = dctx->polytmp[1]; ++ ++ /* L1 and L2-hash the final block if needed */ ++ if (partial) { ++ /* Zero-pad to next 128-bit boundary */ ++ unsigned int n = round_up(partial, 16); ++ u64 rh, rl; ++ ++ memset(&dctx->partial[partial], 0, n - partial); ++ nh_16(dctx->partial_words, tctx->nhkey, n / 8, rh, rl); ++ rh &= m62; ++ if (dctx->first_block_processed) ++ poly_step(ch, cl, tctx->polykey[0], tctx->polykey[1], ++ rh, rl); ++ else ++ ADD128(ch, cl, rh, rl); + } +- mac = vmac(ctx->partial, ctx->partial_size, nonce, NULL, ctx); +- memcpy(out, &mac, sizeof(vmac_t)); +- memzero_explicit(&mac, sizeof(vmac_t)); +- memset(&ctx->__vmac_ctx, 0, sizeof(struct vmac_ctx)); +- ctx->partial_size = 0; ++ ++ /* L3-hash the 128-bit output of L2-hash */ ++ return l3hash(ch, cl, tctx->l3key[0], tctx->l3key[1], partial * 8); ++} ++ ++static int vmac_final(struct shash_desc *desc, u8 *out) ++{ ++ const struct vmac_tfm_ctx *tctx = crypto_shash_ctx(desc->tfm); ++ struct vmac_desc_ctx *dctx = shash_desc_ctx(desc); ++ static const u8 nonce[16] = {}; /* TODO: this is insecure */ ++ union { ++ u8 bytes[16]; ++ __be64 pads[2]; ++ } block; ++ int index; ++ u64 hash, pad; ++ ++ /* Finish calculating the VHASH of the message */ ++ hash = vhash_final(tctx, dctx); ++ ++ /* Generate pseudorandom pad by encrypting the nonce */ ++ memcpy(&block, nonce, 16); ++ index = block.bytes[15] & 1; ++ block.bytes[15] &= ~1; ++ crypto_cipher_encrypt_one(tctx->cipher, block.bytes, block.bytes); ++ pad = be64_to_cpu(block.pads[index]); ++ ++ /* The VMAC is the sum of VHASH and the pseudorandom pad */ ++ put_unaligned_le64(hash + pad, out); + return 0; + } + + static int vmac_init_tfm(struct crypto_tfm *tfm) + { +- struct crypto_cipher *cipher; +- struct crypto_instance *inst = (void *)tfm->__crt_alg; ++ struct crypto_instance *inst = crypto_tfm_alg_instance(tfm); + struct crypto_spawn *spawn = crypto_instance_ctx(inst); +- struct vmac_ctx_t *ctx = crypto_tfm_ctx(tfm); ++ struct vmac_tfm_ctx *tctx = crypto_tfm_ctx(tfm); ++ struct crypto_cipher *cipher; + + cipher = crypto_spawn_cipher(spawn); + if (IS_ERR(cipher)) + return PTR_ERR(cipher); + +- ctx->child = cipher; ++ tctx->cipher = cipher; + return 0; + } + + static void vmac_exit_tfm(struct crypto_tfm *tfm) + { +- struct vmac_ctx_t *ctx = crypto_tfm_ctx(tfm); +- crypto_free_cipher(ctx->child); ++ struct vmac_tfm_ctx *tctx = crypto_tfm_ctx(tfm); ++ ++ crypto_free_cipher(tctx->cipher); + } + + static int vmac_create(struct crypto_template *tmpl, struct rtattr **tb) +@@ -655,6 +608,10 @@ static int vmac_create(struct crypto_template *tmpl, struct rtattr **tb) + if (IS_ERR(alg)) + return PTR_ERR(alg); + ++ err = -EINVAL; ++ if (alg->cra_blocksize != 16) ++ goto out_put_alg; ++ + inst = shash_alloc_instance("vmac", alg); + err = PTR_ERR(inst); + if (IS_ERR(inst)) +@@ -670,11 +627,12 @@ static int vmac_create(struct crypto_template *tmpl, struct rtattr **tb) + inst->alg.base.cra_blocksize = alg->cra_blocksize; + inst->alg.base.cra_alignmask = alg->cra_alignmask; + +- inst->alg.digestsize = sizeof(vmac_t); +- inst->alg.base.cra_ctxsize = sizeof(struct vmac_ctx_t); ++ inst->alg.base.cra_ctxsize = sizeof(struct vmac_tfm_ctx); + inst->alg.base.cra_init = vmac_init_tfm; + inst->alg.base.cra_exit = vmac_exit_tfm; + ++ inst->alg.descsize = sizeof(struct vmac_desc_ctx); ++ inst->alg.digestsize = VMAC_TAG_LEN / 8; + inst->alg.init = vmac_init; + inst->alg.update = vmac_update; + inst->alg.final = vmac_final; +diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c +index 572b6c7303ed..f14695e744d0 100644 +--- a/drivers/acpi/apei/ghes.c ++++ b/drivers/acpi/apei/ghes.c +@@ -114,19 +114,7 @@ static DEFINE_MUTEX(ghes_list_mutex); + * from BIOS to Linux can be determined only in NMI, IRQ or timer + * handler, but general ioremap can not be used in atomic context, so + * the fixmap is used instead. +- */ +- +-/* +- * Two virtual pages are used, one for IRQ/PROCESS context, the other for +- * NMI context (optionally). +- */ +-#define GHES_IOREMAP_PAGES 2 +-#define GHES_IOREMAP_IRQ_PAGE(base) (base) +-#define GHES_IOREMAP_NMI_PAGE(base) ((base) + PAGE_SIZE) +- +-/* virtual memory area for atomic ioremap */ +-static struct vm_struct *ghes_ioremap_area; +-/* ++ * + * These 2 spinlocks are used to prevent the fixmap entries from being used + * simultaneously. + */ +@@ -141,23 +129,6 @@ static atomic_t ghes_estatus_cache_alloced; + + static int ghes_panic_timeout __read_mostly = 30; + +-static int ghes_ioremap_init(void) +-{ +- ghes_ioremap_area = __get_vm_area(PAGE_SIZE * GHES_IOREMAP_PAGES, +- VM_IOREMAP, VMALLOC_START, VMALLOC_END); +- if (!ghes_ioremap_area) { +- pr_err(GHES_PFX "Failed to allocate virtual memory area for atomic ioremap.\n"); +- return -ENOMEM; +- } +- +- return 0; +-} +- +-static void ghes_ioremap_exit(void) +-{ +- free_vm_area(ghes_ioremap_area); +-} +- + static void __iomem *ghes_ioremap_pfn_nmi(u64 pfn) + { + phys_addr_t paddr; +@@ -1247,13 +1218,9 @@ static int __init ghes_init(void) + + ghes_nmi_init_cxt(); + +- rc = ghes_ioremap_init(); +- if (rc) +- goto err; +- + rc = ghes_estatus_pool_init(); + if (rc) +- goto err_ioremap_exit; ++ goto err; + + rc = ghes_estatus_pool_expand(GHES_ESTATUS_CACHE_AVG_SIZE * + GHES_ESTATUS_CACHE_ALLOCED_MAX); +@@ -1277,8 +1244,6 @@ static int __init ghes_init(void) + return 0; + err_pool_exit: + ghes_estatus_pool_exit(); +-err_ioremap_exit: +- ghes_ioremap_exit(); + err: + return rc; + } +diff --git a/drivers/clk/sunxi-ng/ccu-sun4i-a10.c b/drivers/clk/sunxi-ng/ccu-sun4i-a10.c +index 286b0049b7b6..a48fde191c0a 100644 +--- a/drivers/clk/sunxi-ng/ccu-sun4i-a10.c ++++ b/drivers/clk/sunxi-ng/ccu-sun4i-a10.c +@@ -223,7 +223,7 @@ static struct ccu_mux cpu_clk = { + .hw.init = CLK_HW_INIT_PARENTS("cpu", + cpu_parents, + &ccu_mux_ops, +- CLK_IS_CRITICAL), ++ CLK_SET_RATE_PARENT | CLK_IS_CRITICAL), + } + }; + +diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c +index 0e2011636fbb..c53c7ac992f8 100644 +--- a/drivers/firmware/qemu_fw_cfg.c ++++ b/drivers/firmware/qemu_fw_cfg.c +@@ -582,9 +582,10 @@ static int fw_cfg_sysfs_remove(struct platform_device *pdev) + { + pr_debug("fw_cfg: unloading.\n"); + fw_cfg_sysfs_cache_cleanup(); ++ sysfs_remove_file(fw_cfg_top_ko, &fw_cfg_rev_attr.attr); ++ fw_cfg_io_cleanup(); + fw_cfg_kset_unregister_recursive(fw_cfg_fname_kset); + fw_cfg_kobj_cleanup(fw_cfg_sel_ko); +- fw_cfg_io_cleanup(); + return 0; + } + +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h +index 46a2f5d9aa25..f00421dfacbd 100644 +--- a/include/asm-generic/pgtable.h ++++ b/include/asm-generic/pgtable.h +@@ -991,8 +991,8 @@ int pud_set_huge(pud_t *pud, phys_addr_t addr, pgprot_t prot); + int pmd_set_huge(pmd_t *pmd, phys_addr_t addr, pgprot_t prot); + int pud_clear_huge(pud_t *pud); + int pmd_clear_huge(pmd_t *pmd); +-int pud_free_pmd_page(pud_t *pud); +-int pmd_free_pte_page(pmd_t *pmd); ++int pud_free_pmd_page(pud_t *pud, unsigned long addr); ++int pmd_free_pte_page(pmd_t *pmd, unsigned long addr); + #else /* !CONFIG_HAVE_ARCH_HUGE_VMAP */ + static inline int p4d_set_huge(p4d_t *p4d, phys_addr_t addr, pgprot_t prot) + { +@@ -1018,11 +1018,11 @@ static inline int pmd_clear_huge(pmd_t *pmd) + { + return 0; + } +-static inline int pud_free_pmd_page(pud_t *pud) ++static inline int pud_free_pmd_page(pud_t *pud, unsigned long addr) + { + return 0; + } +-static inline int pmd_free_pte_page(pmd_t *pmd) ++static inline int pmd_free_pte_page(pmd_t *pmd, unsigned long addr) + { + return 0; + } +diff --git a/include/crypto/vmac.h b/include/crypto/vmac.h +deleted file mode 100644 +index 6b700c7b2fe1..000000000000 +--- a/include/crypto/vmac.h ++++ /dev/null +@@ -1,63 +0,0 @@ +-/* +- * Modified to interface to the Linux kernel +- * Copyright (c) 2009, Intel Corporation. +- * +- * This program is free software; you can redistribute it and/or modify it +- * under the terms and conditions of the GNU General Public License, +- * version 2, as published by the Free Software Foundation. +- * +- * This program is distributed in the hope it will be useful, but WITHOUT +- * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or +- * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for +- * more details. +- * +- * You should have received a copy of the GNU General Public License along with +- * this program; if not, write to the Free Software Foundation, Inc., 59 Temple +- * Place - Suite 330, Boston, MA 02111-1307 USA. +- */ +- +-#ifndef __CRYPTO_VMAC_H +-#define __CRYPTO_VMAC_H +- +-/* -------------------------------------------------------------------------- +- * VMAC and VHASH Implementation by Ted Krovetz (tdk@acm.org) and Wei Dai. +- * This implementation is herby placed in the public domain. +- * The authors offers no warranty. Use at your own risk. +- * Please send bug reports to the authors. +- * Last modified: 17 APR 08, 1700 PDT +- * ----------------------------------------------------------------------- */ +- +-/* +- * User definable settings. +- */ +-#define VMAC_TAG_LEN 64 +-#define VMAC_KEY_SIZE 128/* Must be 128, 192 or 256 */ +-#define VMAC_KEY_LEN (VMAC_KEY_SIZE/8) +-#define VMAC_NHBYTES 128/* Must 2^i for any 3 < i < 13 Standard = 128*/ +- +-/* +- * This implementation uses u32 and u64 as names for unsigned 32- +- * and 64-bit integer types. These are defined in C99 stdint.h. The +- * following may need adaptation if you are not running a C99 or +- * Microsoft C environment. +- */ +-struct vmac_ctx { +- u64 nhkey[(VMAC_NHBYTES/8)+2*(VMAC_TAG_LEN/64-1)]; +- u64 polykey[2*VMAC_TAG_LEN/64]; +- u64 l3key[2*VMAC_TAG_LEN/64]; +- u64 polytmp[2*VMAC_TAG_LEN/64]; +- u64 cached_nonce[2]; +- u64 cached_aes[2]; +- int first_block_processed; +-}; +- +-typedef u64 vmac_t; +- +-struct vmac_ctx_t { +- struct crypto_cipher *child; +- struct vmac_ctx __vmac_ctx; +- u8 partial[VMAC_NHBYTES]; /* partial block */ +- int partial_size; /* size of the partial block */ +-}; +- +-#endif /* __CRYPTO_VMAC_H */ +diff --git a/include/trace/events/sched.h b/include/trace/events/sched.h +index d447f24df970..0812cd5408c9 100644 +--- a/include/trace/events/sched.h ++++ b/include/trace/events/sched.h +@@ -116,9 +116,9 @@ static inline long __trace_sched_switch_state(bool preempt, struct task_struct * + * RUNNING (we will not have dequeued if state != RUNNING). + */ + if (preempt) +- return TASK_STATE_MAX; ++ return TASK_REPORT_MAX; + +- return __get_task_state(p); ++ return 1 << __get_task_state(p); + } + #endif /* CREATE_TRACE_POINTS */ + +@@ -164,7 +164,7 @@ TRACE_EVENT(sched_switch, + { 0x40, "P" }, { 0x80, "I" }) : + "R", + +- __entry->prev_state & TASK_STATE_MAX ? "+" : "", ++ __entry->prev_state & TASK_REPORT_MAX ? "+" : "", + __entry->next_comm, __entry->next_pid, __entry->next_prio) + ); + +diff --git a/lib/ioremap.c b/lib/ioremap.c +index 54e5bbaa3200..517f5853ffed 100644 +--- a/lib/ioremap.c ++++ b/lib/ioremap.c +@@ -92,7 +92,7 @@ static inline int ioremap_pmd_range(pud_t *pud, unsigned long addr, + if (ioremap_pmd_enabled() && + ((next - addr) == PMD_SIZE) && + IS_ALIGNED(phys_addr + addr, PMD_SIZE) && +- pmd_free_pte_page(pmd)) { ++ pmd_free_pte_page(pmd, addr)) { + if (pmd_set_huge(pmd, phys_addr + addr, prot)) + continue; + } +@@ -119,7 +119,7 @@ static inline int ioremap_pud_range(p4d_t *p4d, unsigned long addr, + if (ioremap_pud_enabled() && + ((next - addr) == PUD_SIZE) && + IS_ALIGNED(phys_addr + addr, PUD_SIZE) && +- pud_free_pmd_page(pud)) { ++ pud_free_pmd_page(pud, addr)) { + if (pud_set_huge(pud, phys_addr + addr, prot)) + continue; + } +diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c +index 8112893037bd..cef3754408d4 100644 +--- a/net/bluetooth/hidp/core.c ++++ b/net/bluetooth/hidp/core.c +@@ -431,8 +431,8 @@ static void hidp_del_timer(struct hidp_session *session) + del_timer(&session->timer); + } + +-static void hidp_process_report(struct hidp_session *session, +- int type, const u8 *data, int len, int intr) ++static void hidp_process_report(struct hidp_session *session, int type, ++ const u8 *data, unsigned int len, int intr) + { + if (len > HID_MAX_BUFFER_SIZE) + len = HID_MAX_BUFFER_SIZE; +diff --git a/scripts/depmod.sh b/scripts/depmod.sh +index 9831cca31240..f41b0a4b575c 100755 +--- a/scripts/depmod.sh ++++ b/scripts/depmod.sh +@@ -11,10 +11,16 @@ DEPMOD=$1 + KERNELRELEASE=$2 + SYMBOL_PREFIX=$3 + +-if ! test -r System.map -a -x "$DEPMOD"; then ++if ! test -r System.map ; then + exit 0 + fi + ++if [ -z $(command -v $DEPMOD) ]; then ++ echo "'make modules_install' requires $DEPMOD. Please install it." >&2 ++ echo "This is probably in the kmod package." >&2 ++ exit 1 ++fi ++ + # older versions of depmod don't support -P + # support was added in module-init-tools 3.13 + if test -n "$SYMBOL_PREFIX"; then +diff --git a/sound/soc/codecs/msm8916-wcd-digital.c b/sound/soc/codecs/msm8916-wcd-digital.c +index 694db27b11fa..13354d6304a8 100644 +--- a/sound/soc/codecs/msm8916-wcd-digital.c ++++ b/sound/soc/codecs/msm8916-wcd-digital.c +@@ -238,7 +238,7 @@ static const struct soc_enum rx_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( + static const struct soc_enum rx2_mix1_inp_enum[] = { + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 3, 6, rx_mix1_text), +- SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B1_CTL, 0, 6, rx_mix1_text), ++ SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX2_B2_CTL, 0, 6, rx_mix1_text), + }; + + /* RX2 MIX2 */ +@@ -249,7 +249,7 @@ static const struct soc_enum rx2_mix2_inp1_chain_enum = SOC_ENUM_SINGLE( + static const struct soc_enum rx3_mix1_inp_enum[] = { + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), + SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 3, 6, rx_mix1_text), +- SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B1_CTL, 0, 6, rx_mix1_text), ++ SOC_ENUM_SINGLE(LPASS_CDC_CONN_RX3_B2_CTL, 0, 6, rx_mix1_text), + }; + + /* DEC */ +diff --git a/sound/soc/intel/boards/cht_bsw_max98090_ti.c b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +index 20755ecc7f9e..a02dec251afe 100644 +--- a/sound/soc/intel/boards/cht_bsw_max98090_ti.c ++++ b/sound/soc/intel/boards/cht_bsw_max98090_ti.c +@@ -116,23 +116,19 @@ static int cht_codec_init(struct snd_soc_pcm_runtime *runtime) + struct cht_mc_private *ctx = snd_soc_card_get_drvdata(runtime->card); + struct snd_soc_jack *jack = &ctx->jack; + +- /** +- * TI supports 4 butons headset detection +- * KEY_MEDIA +- * KEY_VOICECOMMAND +- * KEY_VOLUMEUP +- * KEY_VOLUMEDOWN +- */ +- if (ctx->ts3a227e_present) +- jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE | +- SND_JACK_BTN_0 | SND_JACK_BTN_1 | +- SND_JACK_BTN_2 | SND_JACK_BTN_3; +- else +- jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE; ++ if (ctx->ts3a227e_present) { ++ /* ++ * The jack has already been created in the ++ * cht_max98090_headset_init() function. ++ */ ++ snd_soc_jack_notifier_register(jack, &cht_jack_nb); ++ return 0; ++ } ++ ++ jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE; + + ret = snd_soc_card_jack_new(runtime->card, "Headset Jack", + jack_type, jack, NULL, 0); +- + if (ret) { + dev_err(runtime->dev, "Headset Jack creation failed %d\n", ret); + return ret; +@@ -188,6 +184,27 @@ static int cht_max98090_headset_init(struct snd_soc_component *component) + { + struct snd_soc_card *card = component->card; + struct cht_mc_private *ctx = snd_soc_card_get_drvdata(card); ++ struct snd_soc_jack *jack = &ctx->jack; ++ int jack_type; ++ int ret; ++ ++ /* ++ * TI supports 4 butons headset detection ++ * KEY_MEDIA ++ * KEY_VOICECOMMAND ++ * KEY_VOLUMEUP ++ * KEY_VOLUMEDOWN ++ */ ++ jack_type = SND_JACK_HEADPHONE | SND_JACK_MICROPHONE | ++ SND_JACK_BTN_0 | SND_JACK_BTN_1 | ++ SND_JACK_BTN_2 | SND_JACK_BTN_3; ++ ++ ret = snd_soc_card_jack_new(card, "Headset Jack", jack_type, ++ jack, NULL, 0); ++ if (ret) { ++ dev_err(card->dev, "Headset Jack creation failed %d\n", ret); ++ return ret; ++ } + + return ts3a227e_enable_jack_detect(component, &ctx->jack); + } +diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c +index 2684a2ba33cd..e28edb1f7263 100644 +--- a/sound/soc/sh/rcar/adg.c ++++ b/sound/soc/sh/rcar/adg.c +@@ -479,10 +479,10 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv, + } + + if (req_rate[0] % 48000 == 0) +- adg->flags = AUDIO_OUT_48; ++ adg->flags |= AUDIO_OUT_48; + + if (of_get_property(np, "clkout-lr-asynchronous", NULL)) +- adg->flags = LRCLK_ASYNC; ++ adg->flags |= LRCLK_ASYNC; + + /* + * This driver is assuming that AUDIO_CLKA/AUDIO_CLKB/AUDIO_CLKC diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.64-65.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.64-65.patch new file mode 100644 index 000000000000..305f29191a1a --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.64-65.patch @@ -0,0 +1,37 @@ +diff --git a/Makefile b/Makefile +index 025156791e90..7995690ff1aa 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 64 ++SUBLEVEL = 65 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/x86/include/asm/pgtable-invert.h b/arch/x86/include/asm/pgtable-invert.h +index 44b1203ece12..a0c1525f1b6f 100644 +--- a/arch/x86/include/asm/pgtable-invert.h ++++ b/arch/x86/include/asm/pgtable-invert.h +@@ -4,9 +4,18 @@ + + #ifndef __ASSEMBLY__ + ++/* ++ * A clear pte value is special, and doesn't get inverted. ++ * ++ * Note that even users that only pass a pgprot_t (rather ++ * than a full pte) won't trigger the special zero case, ++ * because even PAGE_NONE has _PAGE_PROTNONE | _PAGE_ACCESSED ++ * set. So the all zero case really is limited to just the ++ * cleared page table entry case. ++ */ + static inline bool __pte_needs_invert(u64 val) + { +- return !(val & _PAGE_PRESENT); ++ return val && !(val & _PAGE_PRESENT); + } + + /* Get a mask to xor with the page table entry to get the correct pfn. */ diff --git a/patch/kernel/mvebu64-default/0004-patch-4.14.65-66.patch b/patch/kernel/mvebu64-default/0004-patch-4.14.65-66.patch new file mode 100644 index 000000000000..149a83cc0a09 --- /dev/null +++ b/patch/kernel/mvebu64-default/0004-patch-4.14.65-66.patch @@ -0,0 +1,683 @@ +diff --git a/Makefile b/Makefile +index 7995690ff1aa..e69d0d091742 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 65 ++SUBLEVEL = 66 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c +index 2ef0ad6a33d6..7a0af16f86f2 100644 +--- a/drivers/acpi/sleep.c ++++ b/drivers/acpi/sleep.c +@@ -338,6 +338,14 @@ static const struct dmi_system_id acpisleep_dmi_table[] __initconst = { + DMI_MATCH(DMI_PRODUCT_NAME, "K54HR"), + }, + }, ++ { ++ .callback = init_nvs_save_s3, ++ .ident = "Asus 1025C", ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK COMPUTER INC."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "1025C"), ++ }, ++ }, + /* + * https://bugzilla.kernel.org/show_bug.cgi?id=189431 + * Lenovo G50-45 is a platform later than 2012, but needs nvs memory +diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c +index 38a5bb764c7b..598724ffde4e 100644 +--- a/drivers/isdn/i4l/isdn_common.c ++++ b/drivers/isdn/i4l/isdn_common.c +@@ -1640,13 +1640,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) + } else + return -EINVAL; + case IIOCDBGVAR: +- if (arg) { +- if (copy_to_user(argp, &dev, sizeof(ulong))) +- return -EFAULT; +- return 0; +- } else +- return -EINVAL; +- break; ++ return -EINVAL; + default: + if ((cmd & IIOCDRVCTL) == IIOCDRVCTL) + cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK; +diff --git a/drivers/misc/sram.c b/drivers/misc/sram.c +index fc0415771c00..4dd0d868ff88 100644 +--- a/drivers/misc/sram.c ++++ b/drivers/misc/sram.c +@@ -407,13 +407,20 @@ static int sram_probe(struct platform_device *pdev) + if (init_func) { + ret = init_func(); + if (ret) +- return ret; ++ goto err_disable_clk; + } + + dev_dbg(sram->dev, "SRAM pool: %zu KiB @ 0x%p\n", + gen_pool_size(sram->pool) / 1024, sram->virt_base); + + return 0; ++ ++err_disable_clk: ++ if (sram->clk) ++ clk_disable_unprepare(sram->clk); ++ sram_free_partitions(sram); ++ ++ return ret; + } + + static int sram_remove(struct platform_device *pdev) +diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +index 36fddb199160..f4b3554b0b67 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -752,7 +752,7 @@ static int hw_atl_b0_hw_packet_filter_set(struct aq_hw_s *self, + + rpfl2promiscuous_mode_en_set(self, IS_FILTER_ENABLED(IFF_PROMISC)); + rpfl2multicast_flr_en_set(self, +- IS_FILTER_ENABLED(IFF_MULTICAST), 0); ++ IS_FILTER_ENABLED(IFF_ALLMULTI), 0); + + rpfl2_accept_all_mc_packets_set(self, + IS_FILTER_ENABLED(IFF_ALLMULTI)); +diff --git a/drivers/tty/serial/8250/8250_dw.c b/drivers/tty/serial/8250/8250_dw.c +index 3015789265dd..27c5b2b46b8d 100644 +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -260,7 +260,7 @@ static void dw8250_set_termios(struct uart_port *p, struct ktermios *termios, + long rate; + int ret; + +- if (IS_ERR(d->clk) || !old) ++ if (IS_ERR(d->clk)) + goto out; + + clk_disable_unprepare(d->clk); +@@ -672,6 +672,7 @@ static const struct acpi_device_id dw8250_acpi_match[] = { + { "APMC0D08", 0}, + { "AMD0020", 0 }, + { "AMDI0020", 0 }, ++ { "BRCM2032", 0 }, + { "HISI0031", 0 }, + { }, + }; +diff --git a/drivers/tty/serial/8250/8250_exar.c b/drivers/tty/serial/8250/8250_exar.c +index e0aa5f03004c..411b4b03457b 100644 +--- a/drivers/tty/serial/8250/8250_exar.c ++++ b/drivers/tty/serial/8250/8250_exar.c +@@ -436,7 +436,11 @@ static irqreturn_t exar_misc_handler(int irq, void *data) + struct exar8250 *priv = data; + + /* Clear all PCI interrupts by reading INT0. No effect on IIR */ +- ioread8(priv->virt + UART_EXAR_INT0); ++ readb(priv->virt + UART_EXAR_INT0); ++ ++ /* Clear INT0 for Expansion Interface slave ports, too */ ++ if (priv->board->num_ports > 8) ++ readb(priv->virt + 0x2000 + UART_EXAR_INT0); + + return IRQ_HANDLED; + } +diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c +index be456ea27ab2..ecf3d631bc09 100644 +--- a/drivers/tty/serial/8250/8250_port.c ++++ b/drivers/tty/serial/8250/8250_port.c +@@ -94,8 +94,7 @@ static const struct serial8250_config uart_config[] = { + .name = "16550A", + .fifo_size = 16, + .tx_loadsz = 16, +- .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10 | +- UART_FCR_CLEAR_RCVR | UART_FCR_CLEAR_XMIT, ++ .fcr = UART_FCR_ENABLE_FIFO | UART_FCR_R_TRIG_10, + .rxtrig_bytes = {1, 4, 8, 14}, + .flags = UART_CAP_FIFO, + }, +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index d4124551fb56..0600dadd6a0c 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -199,6 +199,8 @@ static void option_instat_callback(struct urb *urb); + #define DELL_PRODUCT_5800_V2_MINICARD_VZW 0x8196 /* Novatel E362 */ + #define DELL_PRODUCT_5804_MINICARD_ATT 0x819b /* Novatel E371 */ + ++#define DELL_PRODUCT_5821E 0x81d7 ++ + #define KYOCERA_VENDOR_ID 0x0c88 + #define KYOCERA_PRODUCT_KPC650 0x17da + #define KYOCERA_PRODUCT_KPC680 0x180a +@@ -1033,6 +1035,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_MINICARD_VZW, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5800_V2_MINICARD_VZW, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(DELL_VENDOR_ID, DELL_PRODUCT_5804_MINICARD_ATT, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5821E), ++ .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) }, /* ADU-E100, ADU-310 */ + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) }, + { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) }, +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 34c5a75f98a7..2153e67eeeee 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -55,6 +55,8 @@ static const struct usb_device_id id_table[] = { + .driver_info = PL2303_QUIRK_ENDPOINT_HACK }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485), + .driver_info = PL2303_QUIRK_ENDPOINT_HACK }, ++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC232B), ++ .driver_info = PL2303_QUIRK_ENDPOINT_HACK }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, + { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index 123289085ee2..cec7141245ef 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -29,6 +29,7 @@ + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 + #define ATEN_PRODUCT_UC485 0x2021 ++#define ATEN_PRODUCT_UC232B 0x2022 + #define ATEN_PRODUCT_ID2 0x2118 + + #define IODATA_VENDOR_ID 0x04bb +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 4c4ac4705ac0..a9c5564b6b65 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -773,9 +773,9 @@ static void sierra_close(struct usb_serial_port *port) + kfree(urb->transfer_buffer); + usb_free_urb(urb); + usb_autopm_put_interface_async(serial->interface); +- spin_lock(&portdata->lock); ++ spin_lock_irq(&portdata->lock); + portdata->outstanding_urbs--; +- spin_unlock(&portdata->lock); ++ spin_unlock_irq(&portdata->lock); + } + + sierra_stop_rx_urbs(port); +diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c +index 244e5256c526..3cf74f54c7a1 100644 +--- a/drivers/vhost/vhost.c ++++ b/drivers/vhost/vhost.c +@@ -1578,9 +1578,12 @@ int vhost_init_device_iotlb(struct vhost_dev *d, bool enabled) + d->iotlb = niotlb; + + for (i = 0; i < d->nvqs; ++i) { +- mutex_lock(&d->vqs[i]->mutex); +- d->vqs[i]->iotlb = niotlb; +- mutex_unlock(&d->vqs[i]->mutex); ++ struct vhost_virtqueue *vq = d->vqs[i]; ++ ++ mutex_lock(&vq->mutex); ++ vq->iotlb = niotlb; ++ __vhost_vq_meta_reset(vq); ++ mutex_unlock(&vq->mutex); + } + + vhost_umem_clean(oiotlb); +diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h +index f9fb566e75cf..5fb3f6361090 100644 +--- a/include/net/af_vsock.h ++++ b/include/net/af_vsock.h +@@ -62,7 +62,8 @@ struct vsock_sock { + struct list_head pending_links; + struct list_head accept_queue; + bool rejected; +- struct delayed_work dwork; ++ struct delayed_work connect_work; ++ struct delayed_work pending_work; + struct delayed_work close_work; + bool close_work_scheduled; + u32 peer_shutdown; +@@ -75,7 +76,6 @@ struct vsock_sock { + + s64 vsock_stream_has_data(struct vsock_sock *vsk); + s64 vsock_stream_has_space(struct vsock_sock *vsk); +-void vsock_pending_work(struct work_struct *work); + struct sock *__vsock_create(struct net *net, + struct socket *sock, + struct sock *parent, +diff --git a/include/net/llc.h b/include/net/llc.h +index dc35f25eb679..890a87318014 100644 +--- a/include/net/llc.h ++++ b/include/net/llc.h +@@ -116,6 +116,11 @@ static inline void llc_sap_hold(struct llc_sap *sap) + refcount_inc(&sap->refcnt); + } + ++static inline bool llc_sap_hold_safe(struct llc_sap *sap) ++{ ++ return refcount_inc_not_zero(&sap->refcnt); ++} ++ + void llc_sap_close(struct llc_sap *sap); + + static inline void llc_sap_put(struct llc_sap *sap) +diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c +index 795e920a3281..81fe3949c158 100644 +--- a/net/bluetooth/sco.c ++++ b/net/bluetooth/sco.c +@@ -393,7 +393,8 @@ static void sco_sock_cleanup_listen(struct sock *parent) + */ + static void sco_sock_kill(struct sock *sk) + { +- if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket) ++ if (!sock_flag(sk, SOCK_ZAPPED) || sk->sk_socket || ++ sock_flag(sk, SOCK_DEAD)) + return; + + BT_DBG("sk %p state %d", sk, sk->sk_state); +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index 3887bc115762..fc31c02d616c 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -228,14 +228,16 @@ static void ccid2_cwnd_restart(struct sock *sk, const u32 now) + struct ccid2_hc_tx_sock *hc = ccid2_hc_tx_sk(sk); + u32 cwnd = hc->tx_cwnd, restart_cwnd, + iwnd = rfc3390_bytes_to_packets(dccp_sk(sk)->dccps_mss_cache); ++ s32 delta = now - hc->tx_lsndtime; + + hc->tx_ssthresh = max(hc->tx_ssthresh, (cwnd >> 1) + (cwnd >> 2)); + + /* don't reduce cwnd below the initial window (IW) */ + restart_cwnd = min(cwnd, iwnd); +- cwnd >>= (now - hc->tx_lsndtime) / hc->tx_rto; +- hc->tx_cwnd = max(cwnd, restart_cwnd); + ++ while ((delta -= hc->tx_rto) >= 0 && cwnd > restart_cwnd) ++ cwnd >>= 1; ++ hc->tx_cwnd = max(cwnd, restart_cwnd); + hc->tx_cwnd_stamp = now; + hc->tx_cwnd_used = 0; + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 84ee2eb88121..ee8dbd228fe2 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1134,12 +1134,8 @@ route_lookup: + max_headroom += 8; + mtu -= 8; + } +- if (skb->protocol == htons(ETH_P_IPV6)) { +- if (mtu < IPV6_MIN_MTU) +- mtu = IPV6_MIN_MTU; +- } else if (mtu < 576) { +- mtu = 576; +- } ++ mtu = max(mtu, skb->protocol == htons(ETH_P_IPV6) ? ++ IPV6_MIN_MTU : IPV4_MIN_MTU); + + skb_dst_update_pmtu(skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { +diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c +index 316869df91e8..5c87f1d3e525 100644 +--- a/net/l2tp/l2tp_core.c ++++ b/net/l2tp/l2tp_core.c +@@ -1211,7 +1211,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len + + /* Get routing info from the tunnel socket */ + skb_dst_drop(skb); +- skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0))); ++ skb_dst_set(skb, sk_dst_check(sk, 0)); + + inet = inet_sk(sk); + fl = &inet->cork.fl; +diff --git a/net/llc/llc_core.c b/net/llc/llc_core.c +index 89041260784c..260b3dc1b4a2 100644 +--- a/net/llc/llc_core.c ++++ b/net/llc/llc_core.c +@@ -73,8 +73,8 @@ struct llc_sap *llc_sap_find(unsigned char sap_value) + + rcu_read_lock_bh(); + sap = __llc_sap_find(sap_value); +- if (sap) +- llc_sap_hold(sap); ++ if (!sap || !llc_sap_hold_safe(sap)) ++ sap = NULL; + rcu_read_unlock_bh(); + return sap; + } +diff --git a/net/sched/cls_matchall.c b/net/sched/cls_matchall.c +index 3684153cd8a9..6499aecfbfc4 100644 +--- a/net/sched/cls_matchall.c ++++ b/net/sched/cls_matchall.c +@@ -112,6 +112,8 @@ static void mall_destroy(struct tcf_proto *tp) + if (!head) + return; + ++ tcf_unbind_filter(tp, &head->res); ++ + if (tc_should_offload(dev, head->flags)) + mall_destroy_hw_filter(tp, head, (unsigned long) head); + +diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c +index a76937ee0b2d..52829fdc280b 100644 +--- a/net/sched/cls_tcindex.c ++++ b/net/sched/cls_tcindex.c +@@ -464,11 +464,6 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + tcf_bind_filter(tp, &cr.res, base); + } + +- if (old_r) +- tcf_exts_change(&r->exts, &e); +- else +- tcf_exts_change(&cr.exts, &e); +- + if (old_r && old_r != r) { + err = tcindex_filter_result_init(old_r); + if (err < 0) { +@@ -479,12 +474,15 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base, + + oldp = p; + r->res = cr.res; ++ tcf_exts_change(&r->exts, &e); ++ + rcu_assign_pointer(tp->root, cp); + + if (r == &new_filter_result) { + struct tcindex_filter *nfp; + struct tcindex_filter __rcu **fp; + ++ f->result.res = r->res; + tcf_exts_change(&f->result.exts, &r->exts); + + fp = cp->h + (handle % cp->hash); +diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c +index dfc8c51e4d74..f2fd556c1233 100644 +--- a/net/vmw_vsock/af_vsock.c ++++ b/net/vmw_vsock/af_vsock.c +@@ -449,14 +449,14 @@ static int vsock_send_shutdown(struct sock *sk, int mode) + return transport->shutdown(vsock_sk(sk), mode); + } + +-void vsock_pending_work(struct work_struct *work) ++static void vsock_pending_work(struct work_struct *work) + { + struct sock *sk; + struct sock *listener; + struct vsock_sock *vsk; + bool cleanup; + +- vsk = container_of(work, struct vsock_sock, dwork.work); ++ vsk = container_of(work, struct vsock_sock, pending_work.work); + sk = sk_vsock(vsk); + listener = vsk->listener; + cleanup = true; +@@ -496,7 +496,6 @@ out: + sock_put(sk); + sock_put(listener); + } +-EXPORT_SYMBOL_GPL(vsock_pending_work); + + /**** SOCKET OPERATIONS ****/ + +@@ -595,6 +594,8 @@ static int __vsock_bind(struct sock *sk, struct sockaddr_vm *addr) + return retval; + } + ++static void vsock_connect_timeout(struct work_struct *work); ++ + struct sock *__vsock_create(struct net *net, + struct socket *sock, + struct sock *parent, +@@ -637,6 +638,8 @@ struct sock *__vsock_create(struct net *net, + vsk->sent_request = false; + vsk->ignore_connecting_rst = false; + vsk->peer_shutdown = 0; ++ INIT_DELAYED_WORK(&vsk->connect_work, vsock_connect_timeout); ++ INIT_DELAYED_WORK(&vsk->pending_work, vsock_pending_work); + + psk = parent ? vsock_sk(parent) : NULL; + if (parent) { +@@ -1116,7 +1119,7 @@ static void vsock_connect_timeout(struct work_struct *work) + struct vsock_sock *vsk; + int cancel = 0; + +- vsk = container_of(work, struct vsock_sock, dwork.work); ++ vsk = container_of(work, struct vsock_sock, connect_work.work); + sk = sk_vsock(vsk); + + lock_sock(sk); +@@ -1220,9 +1223,7 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, + * timeout fires. + */ + sock_hold(sk); +- INIT_DELAYED_WORK(&vsk->dwork, +- vsock_connect_timeout); +- schedule_delayed_work(&vsk->dwork, timeout); ++ schedule_delayed_work(&vsk->connect_work, timeout); + + /* Skip ahead to preserve error code set above. */ + goto out_wait; +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 10ae7823a19d..d5be519b0271 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -1091,8 +1091,7 @@ static int vmci_transport_recv_listen(struct sock *sk, + vpending->listener = sk; + sock_hold(sk); + sock_hold(pending); +- INIT_DELAYED_WORK(&vpending->dwork, vsock_pending_work); +- schedule_delayed_work(&vpending->dwork, HZ); ++ schedule_delayed_work(&vpending->pending_work, HZ); + + out: + return err; +diff --git a/sound/core/memalloc.c b/sound/core/memalloc.c +index 7f89d3c79a4b..753d5fc4b284 100644 +--- a/sound/core/memalloc.c ++++ b/sound/core/memalloc.c +@@ -242,16 +242,12 @@ int snd_dma_alloc_pages_fallback(int type, struct device *device, size_t size, + int err; + + while ((err = snd_dma_alloc_pages(type, device, size, dmab)) < 0) { +- size_t aligned_size; + if (err != -ENOMEM) + return err; + if (size <= PAGE_SIZE) + return -ENOMEM; +- aligned_size = PAGE_SIZE << get_order(size); +- if (size != aligned_size) +- size = aligned_size; +- else +- size >>= 1; ++ size >>= 1; ++ size = PAGE_SIZE << get_order(size); + } + if (! dmab->area) + return -ENOMEM; +diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c +index 289ae6bb81d9..8ebbca554e99 100644 +--- a/sound/core/seq/seq_virmidi.c ++++ b/sound/core/seq/seq_virmidi.c +@@ -163,6 +163,7 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream, + int count, res; + unsigned char buf[32], *pbuf; + unsigned long flags; ++ bool check_resched = !in_atomic(); + + if (up) { + vmidi->trigger = 1; +@@ -200,6 +201,15 @@ static void snd_virmidi_output_trigger(struct snd_rawmidi_substream *substream, + vmidi->event.type = SNDRV_SEQ_EVENT_NONE; + } + } ++ if (!check_resched) ++ continue; ++ /* do temporary unlock & cond_resched() for avoiding ++ * CPU soft lockup, which may happen via a write from ++ * a huge rawmidi buffer ++ */ ++ spin_unlock_irqrestore(&substream->runtime->lock, flags); ++ cond_resched(); ++ spin_lock_irqsave(&substream->runtime->lock, flags); + } + out: + spin_unlock_irqrestore(&substream->runtime->lock, flags); +diff --git a/sound/pci/cs5535audio/cs5535audio.h b/sound/pci/cs5535audio/cs5535audio.h +index f4fcdf93f3c8..d84620a0c26c 100644 +--- a/sound/pci/cs5535audio/cs5535audio.h ++++ b/sound/pci/cs5535audio/cs5535audio.h +@@ -67,9 +67,9 @@ struct cs5535audio_dma_ops { + }; + + struct cs5535audio_dma_desc { +- u32 addr; +- u16 size; +- u16 ctlreserved; ++ __le32 addr; ++ __le16 size; ++ __le16 ctlreserved; + }; + + struct cs5535audio_dma { +diff --git a/sound/pci/cs5535audio/cs5535audio_pcm.c b/sound/pci/cs5535audio/cs5535audio_pcm.c +index ee7065f6e162..326caec854e1 100644 +--- a/sound/pci/cs5535audio/cs5535audio_pcm.c ++++ b/sound/pci/cs5535audio/cs5535audio_pcm.c +@@ -158,8 +158,8 @@ static int cs5535audio_build_dma_packets(struct cs5535audio *cs5535au, + lastdesc->addr = cpu_to_le32((u32) dma->desc_buf.addr); + lastdesc->size = 0; + lastdesc->ctlreserved = cpu_to_le16(PRD_JMP); +- jmpprd_addr = cpu_to_le32(lastdesc->addr + +- (sizeof(struct cs5535audio_dma_desc)*periods)); ++ jmpprd_addr = (u32)dma->desc_buf.addr + ++ sizeof(struct cs5535audio_dma_desc) * periods; + + dma->substream = substream; + dma->period_bytes = period_bytes; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index 62fbdbe74b93..22c13ad6a9ae 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2205,7 +2205,7 @@ out_free: + */ + static struct snd_pci_quirk power_save_blacklist[] = { + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ +- SND_PCI_QUIRK(0x1849, 0x0c0c, "Asrock B85M-ITX", 0), ++ SND_PCI_QUIRK(0x1849, 0xc892, "Asrock B85M-ITX", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1525104 */ + SND_PCI_QUIRK(0x1043, 0x8733, "Asus Prime X370-Pro", 0), + /* https://bugzilla.redhat.com/show_bug.cgi?id=1572975 */ +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 88ce2f1022e1..16197ad4512a 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -211,6 +211,7 @@ static void cx_auto_reboot_notify(struct hda_codec *codec) + struct conexant_spec *spec = codec->spec; + + switch (codec->core.vendor_id) { ++ case 0x14f12008: /* CX8200 */ + case 0x14f150f2: /* CX20722 */ + case 0x14f150f4: /* CX20724 */ + break; +@@ -218,13 +219,14 @@ static void cx_auto_reboot_notify(struct hda_codec *codec) + return; + } + +- /* Turn the CX20722 codec into D3 to avoid spurious noises ++ /* Turn the problematic codec into D3 to avoid spurious noises + from the internal speaker during (and after) reboot */ + cx_auto_turn_eapd(codec, spec->num_eapds, spec->eapds, false); + + snd_hda_codec_set_power_to_all(codec, codec->core.afg, AC_PWRST_D3); + snd_hda_codec_write(codec, codec->core.afg, 0, + AC_VERB_SET_POWER_STATE, AC_PWRST_D3); ++ msleep(10); + } + + static void cx_auto_free(struct hda_codec *codec) +diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c +index d4298af6d3ee..c0d0bf44f365 100644 +--- a/sound/pci/vx222/vx222_ops.c ++++ b/sound/pci/vx222/vx222_ops.c +@@ -275,7 +275,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, + length >>= 2; /* in 32bit words */ + /* Transfer using pseudo-dma. */ + for (; length > 0; length--) { +- outl(cpu_to_le32(*addr), port); ++ outl(*addr, port); + addr++; + } + addr = (u32 *)runtime->dma_area; +@@ -285,7 +285,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, + count >>= 2; /* in 32bit words */ + /* Transfer using pseudo-dma. */ + for (; count > 0; count--) { +- outl(cpu_to_le32(*addr), port); ++ outl(*addr, port); + addr++; + } + +@@ -313,7 +313,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, + length >>= 2; /* in 32bit words */ + /* Transfer using pseudo-dma. */ + for (; length > 0; length--) +- *addr++ = le32_to_cpu(inl(port)); ++ *addr++ = inl(port); + addr = (u32 *)runtime->dma_area; + pipe->hw_ptr = 0; + } +@@ -321,7 +321,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, + count >>= 2; /* in 32bit words */ + /* Transfer using pseudo-dma. */ + for (; count > 0; count--) +- *addr++ = le32_to_cpu(inl(port)); ++ *addr++ = inl(port); + + vx2_release_pseudo_dma(chip); + } +diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c +index 8cde40226355..4c4ef1fec69f 100644 +--- a/sound/pcmcia/vx/vxp_ops.c ++++ b/sound/pcmcia/vx/vxp_ops.c +@@ -375,7 +375,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, + length >>= 1; /* in 16bit words */ + /* Transfer using pseudo-dma. */ + for (; length > 0; length--) { +- outw(cpu_to_le16(*addr), port); ++ outw(*addr, port); + addr++; + } + addr = (unsigned short *)runtime->dma_area; +@@ -385,7 +385,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, + count >>= 1; /* in 16bit words */ + /* Transfer using pseudo-dma. */ + for (; count > 0; count--) { +- outw(cpu_to_le16(*addr), port); ++ outw(*addr, port); + addr++; + } + vx_release_pseudo_dma(chip); +@@ -417,7 +417,7 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, + length >>= 1; /* in 16bit words */ + /* Transfer using pseudo-dma. */ + for (; length > 0; length--) +- *addr++ = le16_to_cpu(inw(port)); ++ *addr++ = inw(port); + addr = (unsigned short *)runtime->dma_area; + pipe->hw_ptr = 0; + } +@@ -425,12 +425,12 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, + count >>= 1; /* in 16bit words */ + /* Transfer using pseudo-dma. */ + for (; count > 1; count--) +- *addr++ = le16_to_cpu(inw(port)); ++ *addr++ = inw(port); + /* Disable DMA */ + pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK; + vx_outb(chip, DIALOG, pchip->regDIALOG); + /* Read the last word (16 bits) */ +- *addr = le16_to_cpu(inw(port)); ++ *addr = inw(port); + /* Disable 16-bit accesses */ + pchip->regDIALOG &= ~VXP_DLG_DMA16_SEL_MASK; + vx_outb(chip, DIALOG, pchip->regDIALOG); diff --git a/patch/kernel/mvebu64-default/0001-aufs4.4-20170911.patch b/patch/kernel/mvebu64-default/0005-aufs4.14-20171218.patch similarity index 89% rename from patch/kernel/mvebu64-default/0001-aufs4.4-20170911.patch rename to patch/kernel/mvebu64-default/0005-aufs4.14-20171218.patch index f314b04a1c42..fb5ec8df6992 100644 --- a/patch/kernel/mvebu64-default/0001-aufs4.4-20170911.patch +++ b/patch/kernel/mvebu64-default/0005-aufs4.14-20171218.patch @@ -1291,6 +1291,151 @@ index 0000000..1578469 + where the source and the target exists and selects the higher + one. If the selected branch is readonly, then aufs follows the + copyup policy. +diff --git a/Documentation/filesystems/aufs/design/06dirren.dot b/Documentation/filesystems/aufs/design/06dirren.dot +new file mode 100644 +index 0000000..2d62bb6 +--- /dev/null ++++ b/Documentation/filesystems/aufs/design/06dirren.dot +@@ -0,0 +1,31 @@ ++ ++// to view this graph, run dot(1) command in GRAPHVIZ. ++ ++digraph G { ++node [shape=box]; ++whinfo [label="detailed info file\n(lower_brid_root-hinum, h_inum, namelen, old name)"]; ++ ++node [shape=oval]; ++ ++aufs_rename -> whinfo [label="store/remove"]; ++ ++node [shape=oval]; ++inode_list [label="h_inum list in branch\ncache"]; ++ ++node [shape=box]; ++whinode [label="h_inum list file"]; ++ ++node [shape=oval]; ++brmgmt [label="br_add/del/mod/umount"]; ++ ++brmgmt -> inode_list [label="create/remove"]; ++brmgmt -> whinode [label="load/store"]; ++ ++inode_list -> whinode [style=dashed,dir=both]; ++ ++aufs_rename -> inode_list [label="add/del"]; ++ ++aufs_lookup -> inode_list [label="search"]; ++ ++aufs_lookup -> whinfo [label="load/remove"]; ++} +diff --git a/Documentation/filesystems/aufs/design/06dirren.txt b/Documentation/filesystems/aufs/design/06dirren.txt +new file mode 100644 +index 0000000..3037d77 +--- /dev/null ++++ b/Documentation/filesystems/aufs/design/06dirren.txt +@@ -0,0 +1,102 @@ ++ ++# Copyright (C) 2017 Junjiro R. Okajima ++# ++# This program is free software; you can redistribute it and/or modify ++# it under the terms of the GNU General Public License as published by ++# the Free Software Foundation; either version 2 of the License, or ++# (at your option) any later version. ++# ++# This program is distributed in the hope that it will be useful, ++# but WITHOUT ANY WARRANTY; without even the implied warranty of ++# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++# GNU General Public License for more details. ++# ++# You should have received a copy of the GNU General Public License ++# along with this program. If not, see . ++ ++Special handling for renaming a directory (DIRREN) ++---------------------------------------------------------------------- ++First, let's assume we have a simple usecase. ++ ++- /u = /rw + /ro ++- /rw/dirA exists ++- /ro/dirA and /ro/dirA/file exist too ++- there is no dirB on both branches ++- a user issues rename("dirA", "dirB") ++ ++Now, what should aufs behave against this rename(2)? ++There are a few possible cases. ++ ++A. returns EROFS. ++ since dirA exists on a readonly branch which cannot be renamed. ++B. returns EXDEV. ++ it is possible to copy-up dirA (only the dir itself), but the child ++ entries ("file" in this case) should not be. it must be a bad ++ approach to copy-up recursively. ++C. returns a success. ++ even the branch /ro is readonly, aufs tries renaming it. Obviously it ++ is a violation of aufs' policy. ++D. construct an extra information which indicates that /ro/dirA should ++ be handled as the name of dirB. ++ overlayfs has a similar feature called REDIRECT. ++ ++Until now, aufs implements the case B only which returns EXDEV, and ++expects the userspace application behaves like mv(1) which tries ++issueing rename(2) recursively. ++ ++A new aufs feature called DIRREN is introduced which implements the case ++D. There are several "extra information" added. ++ ++1. detailed info per renamed directory ++ path: /rw/dirB/$AUFS_WH_DR_INFO_PFX. ++2. the inode-number list of directories on a branch ++ path: /rw/dirB/$AUFS_WH_DR_BRHINO ++ ++The filename of "detailed info per directory" represents the lower ++branch, and its format is ++- a type of the branch id ++ one of these. ++ + uuid (not implemented yet) ++ + fsid ++ + dev ++- the inode-number of the branch root dir ++ ++And it contains these info in a single regular file. ++- magic number ++- branch's inode-number of the logically renamed dir ++- the name of the before-renamed dir ++ ++The "detailed info per directory" file is created in aufs rename(2), and ++loaded in any lookup. ++The info is considered in lookup for the matching case only. Here ++"matching" means that the root of branch (in the info filename) is same ++to the current looking-up branch. After looking-up the before-renamed ++name, the inode-number is compared. And the matched dentry is used. ++ ++The "inode-number list of directories" is a regular file which contains ++simply the inode-numbers on the branch. The file is created or updated ++in removing the branch, and loaded in adding the branch. Its lifetime is ++equal to the branch. ++The list is refered in lookup, and when the current target inode is ++found in the list, the aufs tries loading the "detailed info per ++directory" and get the changed and valid name of the dir. ++ ++Theoretically these "extra informaiton" may be able to be put into XATTR ++in the dir inode. But aufs doesn't choose this way because ++1. XATTR may not be supported by the branch (or its configuration) ++2. XATTR may have its size limit. ++3. XATTR may be less easy to convert than a regular file, when the ++ format of the info is changed in the future. ++At the same time, I agree that the regular file approach is much slower ++than XATTR approach. So, in the future, aufs may take the XATTR or other ++better approach. ++ ++This DIRREN feature is enabled by aufs configuration, and is activated ++by a new mount option. ++ ++For the more complicated case, there is a work with UDBA option, which ++is to dected the direct access to the branches (by-passing aufs) and to ++maintain the cashes in aufs. Since a single cached aufs dentry may ++contains two names, before- and after-rename, the name comparision in ++UDBA handler may not work correctly. In this case, the behaviour will be ++equivalen to udba=reval case. diff --git a/Documentation/filesystems/aufs/design/06fhsm.txt b/Documentation/filesystems/aufs/design/06fhsm.txt new file mode 100644 index 0000000..9216478 @@ -1773,10 +1918,10 @@ index 0000000..b7ba75d +Currently this approach is applied to address_space_operations for +regular files only. diff --git a/MAINTAINERS b/MAINTAINERS -index 7875f7b..6a5590c 100644 +index 2811a21..02b6deb 100644 --- a/MAINTAINERS +++ b/MAINTAINERS -@@ -2033,6 +2033,19 @@ F: include/linux/audit.h +@@ -2465,6 +2465,19 @@ F: include/linux/audit.h F: include/uapi/linux/audit.h F: kernel/audit* @@ -1797,10 +1942,10 @@ index 7875f7b..6a5590c 100644 M: Miguel Ojeda Sandonis W: http://miguelojeda.es/auxdisplay.htm diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index 1c36de9..6e34657 100644 +index a2a0dce..5d8095e 100644 --- a/drivers/block/loop.c +++ b/drivers/block/loop.c -@@ -712,6 +712,24 @@ static inline int is_loop_device(struct file *file) +@@ -686,6 +686,24 @@ static inline int is_loop_device(struct file *file) return i && S_ISBLK(i->i_mode) && MAJOR(i->i_rdev) == LOOP_MAJOR; } @@ -1826,10 +1971,10 @@ index 1c36de9..6e34657 100644 static ssize_t loop_attr_show(struct device *dev, char *page, diff --git a/fs/Kconfig b/fs/Kconfig -index a5d2dc3..64ba8bb 100644 +index 7aee6d6..ec92031 100644 --- a/fs/Kconfig +++ b/fs/Kconfig -@@ -222,6 +222,7 @@ source "fs/pstore/Kconfig" +@@ -248,6 +248,7 @@ source "fs/pstore/Kconfig" source "fs/sysv/Kconfig" source "fs/ufs/Kconfig" source "fs/exofs/Kconfig" @@ -1838,20 +1983,21 @@ index a5d2dc3..64ba8bb 100644 endif # MISC_FILESYSTEMS diff --git a/fs/Makefile b/fs/Makefile -index 3b54070..77ed517 100644 +index ef772f1..51779e6 100644 --- a/fs/Makefile +++ b/fs/Makefile -@@ -127,3 +127,4 @@ obj-y += exofs/ # Multiple modules +@@ -129,3 +129,4 @@ obj-y += exofs/ # Multiple modules obj-$(CONFIG_CEPH_FS) += ceph/ obj-$(CONFIG_PSTORE) += pstore/ obj-$(CONFIG_EFIVAR_FS) += efivarfs/ +obj-$(CONFIG_AUFS_FS) += aufs/ diff --git a/fs/aufs/Kconfig b/fs/aufs/Kconfig new file mode 100644 -index 0000000..63560ce +index 0000000..9f43642 --- /dev/null +++ b/fs/aufs/Kconfig -@@ -0,0 +1,185 @@ +@@ -0,0 +1,199 @@ ++# SPDX-License-Identifier: GPL-2.0 +config AUFS_FS + tristate "Aufs (Advanced multi layered unification filesystem) support" + help @@ -1970,6 +2116,19 @@ index 0000000..63560ce + shows better performance in most cases. + See detail in aufs.5. + ++config AUFS_DIRREN ++ bool "Workaround for rename(2)-ing a directory" ++ help ++ By default, aufs returns EXDEV error in renameing a dir who has ++ his child on the lower branch, since it is a bad idea to issue ++ rename(2) internally for every lower branch. But user may not ++ accept this behaviour. So here is a workaround to allow such ++ rename(2) and store some extra infromation on the writable ++ branch. Obviously this costs high (and I don't like it). ++ To use this feature, you need to enable this configuration AND ++ to specify the mount option `dirren.' ++ See details in aufs.5 and the design documents. ++ +config AUFS_SHWH + bool "Show whiteouts" + help @@ -2039,10 +2198,11 @@ index 0000000..63560ce +endif diff --git a/fs/aufs/Makefile b/fs/aufs/Makefile new file mode 100644 -index 0000000..c7a501e +index 0000000..2c819a6 --- /dev/null +++ b/fs/aufs/Makefile -@@ -0,0 +1,44 @@ +@@ -0,0 +1,46 @@ ++# SPDX-License-Identifier: GPL-2.0 + +include ${src}/magic.mk +ifeq (${CONFIG_AUFS_FS},m) @@ -2081,6 +2241,7 @@ index 0000000..c7a501e +aufs-$(CONFIG_AUFS_EXPORT) += export.o +aufs-$(CONFIG_AUFS_XATTR) += xattr.o +aufs-$(CONFIG_FS_POSIX_ACL) += posix_acl.o ++aufs-$(CONFIG_AUFS_DIRREN) += dirren.o +aufs-$(CONFIG_AUFS_FHSM) += fhsm.o +aufs-$(CONFIG_AUFS_POLL) += poll.o +aufs-$(CONFIG_AUFS_RDU) += rdu.o @@ -2089,10 +2250,10 @@ index 0000000..c7a501e +aufs-$(CONFIG_AUFS_MAGIC_SYSRQ) += sysrq.o diff --git a/fs/aufs/aufs.h b/fs/aufs/aufs.h new file mode 100644 -index 0000000..7f5eb78 +index 0000000..f725331 --- /dev/null +++ b/fs/aufs/aufs.h -@@ -0,0 +1,59 @@ +@@ -0,0 +1,60 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -2135,15 +2296,16 @@ index 0000000..7f5eb78 +#include "dbgaufs.h" +#include "dentry.h" +#include "dir.h" ++#include "dirren.h" +#include "dynop.h" +#include "file.h" +#include "fstype.h" ++#include "hbl.h" +#include "inode.h" +#include "loop.h" +#include "module.h" +#include "opts.h" +#include "rwsem.h" -+#include "spl.h" +#include "super.h" +#include "sysaufs.h" +#include "vfsub.h" @@ -2154,10 +2316,10 @@ index 0000000..7f5eb78 +#endif /* __AUFS_H__ */ diff --git a/fs/aufs/branch.c b/fs/aufs/branch.c new file mode 100644 -index 0000000..8108470 +index 0000000..ac9c535 --- /dev/null +++ b/fs/aufs/branch.c -@@ -0,0 +1,1420 @@ +@@ -0,0 +1,1432 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -2193,6 +2355,8 @@ index 0000000..8108470 + struct au_dykey **key; + + au_hnotify_fin_br(br); ++ /* always, regardless the mount option */ ++ au_dr_hino_free(&br->br_dirren); + + if (br->br_xino.xi_file) + fput(br->br_xino.xi_file); @@ -2297,7 +2461,7 @@ index 0000000..8108470 + goto out; + add_branch->br_xino.xi_nondir.total = 8; /* initial size */ + add_branch->br_xino.xi_nondir.array -+ = kcalloc(sizeof(ino_t), add_branch->br_xino.xi_nondir.total, ++ = kcalloc(add_branch->br_xino.xi_nondir.total, sizeof(ino_t), + GFP_NOFS); + if (unlikely(!add_branch->br_xino.xi_nondir.array)) + goto out_br; @@ -2467,7 +2631,7 @@ index 0000000..8108470 +{ + int err, old_perm; + aufs_bindex_t bindex; -+ struct mutex *h_mtx; ++ struct inode *h_inode; + struct au_wbr *wbr; + struct au_hinode *hdir; + struct dentry *h_dentry; @@ -2480,15 +2644,15 @@ index 0000000..8108470 + old_perm = br->br_perm; + br->br_perm = new_perm; + hdir = NULL; -+ h_mtx = NULL; ++ h_inode = NULL; + bindex = au_br_index(sb, br->br_id); + if (0 <= bindex) { + hdir = au_hi(d_inode(sb->s_root), bindex); -+ au_hn_imtx_lock_nested(hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_PARENT); + } else { + h_dentry = au_br_dentry(br); -+ h_mtx = &d_inode(h_dentry)->i_mutex; -+ mutex_lock_nested(h_mtx, AuLsc_I_PARENT); ++ h_inode = d_inode(h_dentry); ++ inode_lock_nested(h_inode, AuLsc_I_PARENT); + } + if (!wbr) + err = au_wh_init(br, sb); @@ -2498,9 +2662,9 @@ index 0000000..8108470 + wbr_wh_write_unlock(wbr); + } + if (hdir) -+ au_hn_imtx_unlock(hdir); ++ au_hn_inode_unlock(hdir); + else -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + vfsub_mnt_drop_write(au_br_mnt(br)); + br->br_perm = old_perm; + @@ -2561,6 +2725,11 @@ index 0000000..8108470 + br->br_id = au_new_br_id(sb); + AuDebugOn(br->br_id < 0); + ++ /* always, regardless the given option */ ++ err = au_dr_br_init(sb, br, &add->path); ++ if (unlikely(err)) ++ goto out_err; ++ + if (au_br_writable(add->perm)) { + err = au_wbr_init(br, sb, add->perm); + if (unlikely(err)) @@ -2666,6 +2835,7 @@ index 0000000..8108470 + root = sb->s_root; + root_inode = d_inode(root); + IMustLock(root_inode); ++ IiMustWriteLock(root_inode); + err = test_add(sb, add, remount); + if (unlikely(err < 0)) + goto out; @@ -2726,14 +2896,15 @@ index 0000000..8108470 +{ + unsigned long long n; + struct file **p, *f; -+ struct au_sphlhead *files; ++ struct hlist_bl_head *files; ++ struct hlist_bl_node *pos; + struct au_finfo *finfo; + + n = 0; + p = a; + files = &au_sbi(sb)->si_files; -+ spin_lock(&files->spin); -+ hlist_for_each_entry(finfo, &files->head, fi_hlist) { ++ hlist_bl_lock(files); ++ hlist_bl_for_each_entry(finfo, pos, files, fi_hlist) { + f = finfo->fi_file; + if (file_count(f) + && !special_file(file_inode(f)->i_mode)) { @@ -2743,7 +2914,7 @@ index 0000000..8108470 + AuDebugOn(n > max); + } + } -+ spin_unlock(&files->spin); ++ hlist_bl_unlock(files); + + return n; +} @@ -3146,6 +3317,9 @@ index 0000000..8108470 + au_br_do_del_hip(au_ii(inode), bindex, bbot); + au_sbilist_unlock(); + ++ /* ignore an error */ ++ au_dr_br_fin(sb, br); /* always, regardless the mount option */ ++ + dput(h_root); + iput(h_inode); + au_br_do_free(br); @@ -3580,10 +3754,10 @@ index 0000000..8108470 +} diff --git a/fs/aufs/branch.h b/fs/aufs/branch.h new file mode 100644 -index 0000000..e9591cf +index 0000000..c09218b --- /dev/null +++ b/fs/aufs/branch.h -@@ -0,0 +1,321 @@ +@@ -0,0 +1,333 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -3611,6 +3785,7 @@ index 0000000..e9591cf +#ifdef __KERNEL__ + +#include ++#include "dirren.h" +#include "dynop.h" +#include "rwsem.h" +#include "super.h" @@ -3708,6 +3883,8 @@ index 0000000..e9591cf + /* entries under sysfs per mount-point */ + struct au_brsysfs br_sysfs[AuBrSysfs_Last]; +#endif ++ ++ struct au_dr_br br_dirren; +}; + +/* ---------------------------------------------------------------------- */ @@ -3754,7 +3931,7 @@ index 0000000..e9591cf + +static inline int au_br_rdonly(struct au_branch *br) +{ -+ return ((au_br_sb(br)->s_flags & MS_RDONLY) ++ return (sb_rdonly(au_br_sb(br)) + || !au_br_writable(br->br_perm)) + ? -EROFS : 0; +} @@ -3874,15 +4051,24 @@ index 0000000..e9591cf + +/* ---------------------------------------------------------------------- */ + ++#define wbr_wh_read_lock(wbr) au_rw_read_lock(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_write_lock(wbr) au_rw_write_lock(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_read_trylock(wbr) au_rw_read_trylock(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_write_trylock(wbr) au_rw_write_trylock(&(wbr)->wbr_wh_rwsem) +/* -+ * wbr_wh_read_lock, wbr_wh_write_lock -+ * wbr_wh_read_unlock, wbr_wh_write_unlock, wbr_wh_downgrade_lock -+ */ -+AuSimpleRwsemFuncs(wbr_wh, struct au_wbr *wbr, &wbr->wbr_wh_rwsem); ++#define wbr_wh_read_trylock_nested(wbr) \ ++ au_rw_read_trylock_nested(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_write_trylock_nested(wbr) \ ++ au_rw_write_trylock_nested(&(wbr)->wbr_wh_rwsem) ++*/ + -+#define WbrWhMustNoWaiters(wbr) AuRwMustNoWaiters(&wbr->wbr_wh_rwsem) -+#define WbrWhMustAnyLock(wbr) AuRwMustAnyLock(&wbr->wbr_wh_rwsem) -+#define WbrWhMustWriteLock(wbr) AuRwMustWriteLock(&wbr->wbr_wh_rwsem) ++#define wbr_wh_read_unlock(wbr) au_rw_read_unlock(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_write_unlock(wbr) au_rw_write_unlock(&(wbr)->wbr_wh_rwsem) ++#define wbr_wh_downgrade_lock(wbr) au_rw_dgrade_lock(&(wbr)->wbr_wh_rwsem) ++ ++#define WbrWhMustNoWaiters(wbr) AuRwMustNoWaiters(&(wbr)->wbr_wh_rwsem) ++#define WbrWhMustAnyLock(wbr) AuRwMustAnyLock(&(wbr)->wbr_wh_rwsem) ++#define WbrWhMustWriteLock(wbr) AuRwMustWriteLock(&(wbr)->wbr_wh_rwsem) + +/* ---------------------------------------------------------------------- */ + @@ -3907,10 +4093,11 @@ index 0000000..e9591cf +#endif /* __AUFS_BRANCH_H__ */ diff --git a/fs/aufs/conf.mk b/fs/aufs/conf.mk new file mode 100644 -index 0000000..0bbb2d3 +index 0000000..12782f8 --- /dev/null +++ b/fs/aufs/conf.mk -@@ -0,0 +1,38 @@ +@@ -0,0 +1,40 @@ ++# SPDX-License-Identifier: GPL-2.0 + +AuConfStr = CONFIG_AUFS_FS=${CONFIG_AUFS_FS} + @@ -3927,6 +4114,7 @@ index 0000000..0bbb2d3 + XATTR \ + FHSM \ + RDU \ ++ DIRREN \ + SHWH \ + BR_RAMFS \ + BR_FUSE POLL \ @@ -3951,10 +4139,10 @@ index 0000000..0bbb2d3 +-include ${srctree}/${src}/conf_priv.mk diff --git a/fs/aufs/cpup.c b/fs/aufs/cpup.c new file mode 100644 -index 0000000..f383e78 +index 0000000..e096069 --- /dev/null +++ b/fs/aufs/cpup.c -@@ -0,0 +1,1383 @@ +@@ -0,0 +1,1442 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -4195,7 +4383,7 @@ index 0000000..f383e78 + size_t sz, rbytes, wbytes; + unsigned char all_zero; + char *p, *zp; -+ struct mutex *h_mtx; ++ struct inode *h_inode; + /* reduce stack usage */ + struct iattr *ia; + @@ -4275,12 +4463,12 @@ index 0000000..f383e78 + ia->ia_size = dst->f_pos; + ia->ia_valid = ATTR_SIZE | ATTR_FILE; + ia->ia_file = dst; -+ h_mtx = &file_inode(dst)->i_mutex; -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD2); ++ h_inode = file_inode(dst); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD2); + /* no delegation since it is just created */ + err = vfsub_notify_change(&dst->f_path, ia, + /*delegated*/NULL); -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + } + } + @@ -4322,6 +4510,59 @@ index 0000000..f383e78 + return err; +} + ++static int au_do_copy(struct file *dst, struct file *src, loff_t len) ++{ ++ int err; ++ struct super_block *h_src_sb; ++ struct inode *h_src_inode; ++ ++ h_src_inode = file_inode(src); ++ h_src_sb = h_src_inode->i_sb; ++ ++ /* XFS acquires inode_lock */ ++ if (!au_test_xfs(h_src_sb)) ++ err = au_copy_file(dst, src, len); ++ else { ++ inode_unlock_shared(h_src_inode); ++ err = au_copy_file(dst, src, len); ++ vfsub_inode_lock_shared_nested(h_src_inode, AuLsc_I_CHILD); ++ } ++ ++ return err; ++} ++ ++static int au_clone_or_copy(struct file *dst, struct file *src, loff_t len) ++{ ++ int err; ++ struct super_block *h_src_sb; ++ struct inode *h_src_inode; ++ ++ h_src_inode = file_inode(src); ++ h_src_sb = h_src_inode->i_sb; ++ if (h_src_sb != file_inode(dst)->i_sb ++ || !dst->f_op->clone_file_range) { ++ err = au_do_copy(dst, src, len); ++ goto out; ++ } ++ ++ if (!au_test_nfs(h_src_sb)) { ++ inode_unlock_shared(h_src_inode); ++ err = vfsub_clone_file_range(src, dst, len); ++ vfsub_inode_lock_shared_nested(h_src_inode, AuLsc_I_CHILD); ++ } else ++ err = vfsub_clone_file_range(src, dst, len); ++ /* older XFS has a condition in cloning */ ++ if (unlikely(err != -EOPNOTSUPP)) ++ goto out; ++ ++ /* the backend fs on NFS may not support cloning */ ++ err = au_do_copy(dst, src, len); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ +/* + * to support a sparse file which is opened with O_APPEND, + * we need to close the file. @@ -4350,7 +4591,8 @@ index 0000000..f383e78 + .label = &&out_src + } + }; -+ struct super_block *sb; ++ struct super_block *sb, *h_src_sb; ++ struct inode *h_src_inode; + struct task_struct *tsk = current; + + /* bsrc branch can be ro/rw. */ @@ -4366,15 +4608,17 @@ index 0000000..f383e78 + } + + /* try stopping to update while we copyup */ -+ IMustLock(d_inode(file[SRC].dentry)); -+ err = au_copy_file(file[DST].file, file[SRC].file, cpg->len); ++ h_src_inode = d_inode(file[SRC].dentry); ++ h_src_sb = h_src_inode->i_sb; ++ if (!au_test_nfs(h_src_sb)) ++ IMustLock(h_src_inode); ++ err = au_clone_or_copy(file[DST].file, file[SRC].file, cpg->len); + + /* i wonder if we had O_NO_DELAY_FPUT flag */ + if (tsk->flags & PF_KTHREAD) + __fput_sync(file[DST].file); + else { -+ WARN(1, "%pD\nPlease report this warning to aufs-users ML", -+ file[DST].file); ++ /* it happend actually */ + fput(file[DST].file); + /* + * too bad. @@ -4408,26 +4652,32 @@ index 0000000..f383e78 + cpg->len = l; + if (cpg->len) { + /* try stopping to update while we are referencing */ -+ mutex_lock_nested(&h_src_inode->i_mutex, AuLsc_I_CHILD); ++ vfsub_inode_lock_shared_nested(h_src_inode, AuLsc_I_CHILD); + au_pin_hdir_unlock(cpg->pin); + + h_path.dentry = au_h_dptr(cpg->dentry, cpg->bsrc); + h_path.mnt = au_sbr_mnt(cpg->dentry->d_sb, cpg->bsrc); + h_src_attr->iflags = h_src_inode->i_flags; + if (!au_test_nfs(h_src_inode->i_sb)) -+ err = vfs_getattr(&h_path, &h_src_attr->st); ++ err = vfsub_getattr(&h_path, &h_src_attr->st); + else { -+ mutex_unlock(&h_src_inode->i_mutex); -+ err = vfs_getattr(&h_path, &h_src_attr->st); -+ mutex_lock_nested(&h_src_inode->i_mutex, AuLsc_I_CHILD); ++ inode_unlock_shared(h_src_inode); ++ err = vfsub_getattr(&h_path, &h_src_attr->st); ++ vfsub_inode_lock_shared_nested(h_src_inode, ++ AuLsc_I_CHILD); + } + if (unlikely(err)) { -+ mutex_unlock(&h_src_inode->i_mutex); ++ inode_unlock_shared(h_src_inode); + goto out; + } + h_src_attr->valid = 1; -+ err = au_cp_regular(cpg); -+ mutex_unlock(&h_src_inode->i_mutex); ++ if (!au_test_nfs(h_src_inode->i_sb)) { ++ err = au_cp_regular(cpg); ++ inode_unlock_shared(h_src_inode); ++ } else { ++ inode_unlock_shared(h_src_inode); ++ err = au_cp_regular(cpg); ++ } + rerr = au_pin_hdir_relock(cpg->pin); + if (!err && rerr) + err = rerr; @@ -4453,12 +4703,6 @@ index 0000000..f383e78 + char *k; + char __user *u; + } sym; -+ struct inode *h_inode = d_inode(h_src); -+ const struct inode_operations *h_iop = h_inode->i_op; -+ -+ err = -ENOSYS; -+ if (unlikely(!h_iop->readlink)) -+ goto out; + + err = -ENOMEM; + sym.k = (void *)__get_free_page(GFP_NOFS); @@ -4468,7 +4712,7 @@ index 0000000..f383e78 + /* unnecessary to support mmap_sem since symlink is not mmap-able */ + old_fs = get_fs(); + set_fs(KERNEL_DS); -+ symlen = h_iop->readlink(h_src, sym.u, PATH_MAX); ++ symlen = vfs_readlink(h_src, sym.u, PATH_MAX); + err = symlen; + set_fs(old_fs); + @@ -4668,7 +4912,8 @@ index 0000000..f383e78 + IMustLock(h_dir); + AuDbg("%pd %pd\n", h_dentry, h_path->dentry); + /* no delegation since it is just created */ -+ err = vfsub_rename(h_dir, h_dentry, h_dir, h_path, /*delegated*/NULL); ++ err = vfsub_rename(h_dir, h_dentry, h_dir, h_path, /*delegated*/NULL, ++ /*flags*/0); + dput(h_path->dentry); + +out: @@ -4681,6 +4926,8 @@ index 0000000..f383e78 + * @len is for truncating when it is -1 copyup the entire file. + * in link/rename cases, @dst_parent may be different from the real one. + * basic->bsrc can be larger than basic->bdst. ++ * aufs doesn't touch the credential so ++ * security_inode_copy_up{,_xattr}() are unnecrssary. + */ +static int au_cpup_single(struct au_cp_generic *cpg, struct dentry *dst_parent) +{ @@ -4778,7 +5025,7 @@ index 0000000..f383e78 + if (unlikely(err)) + goto out_rev; + dst_inode = d_inode(h_dst); -+ mutex_lock_nested(&dst_inode->i_mutex, AuLsc_I_CHILD2); ++ inode_lock_nested(dst_inode, AuLsc_I_CHILD2); + /* todo: necessary? */ + /* au_pin_hdir_unlock(cpg->pin); */ + @@ -4786,7 +5033,7 @@ index 0000000..f383e78 + if (unlikely(err)) { + /* todo: necessary? */ + /* au_pin_hdir_relock(cpg->pin); */ /* ignore an error */ -+ mutex_unlock(&dst_inode->i_mutex); ++ inode_unlock(dst_inode); + goto out_rev; + } + @@ -4796,7 +5043,7 @@ index 0000000..f383e78 + if (unlikely(err)) { + /* ignore an error */ + /* au_pin_hdir_relock(cpg->pin); */ -+ mutex_unlock(&dst_inode->i_mutex); ++ inode_unlock(dst_inode); + goto out_rev; + } + } @@ -4808,7 +5055,7 @@ index 0000000..f383e78 + + /* todo: necessary? */ + /* err = au_pin_hdir_relock(cpg->pin); */ -+ mutex_unlock(&dst_inode->i_mutex); ++ inode_unlock(dst_inode); + if (unlikely(err)) + goto out_rev; + @@ -5186,7 +5433,7 @@ index 0000000..f383e78 + h_tmpdir = d_inode(h_orph); + au_set_h_iptr(dir, bdst, au_igrab(h_tmpdir), /*flags*/0); + -+ mutex_lock_nested(&h_tmpdir->i_mutex, AuLsc_I_PARENT3); ++ inode_lock_nested(h_tmpdir, AuLsc_I_PARENT3); + /* todo: au_h_open_pre()? */ + + pin_orig = cpg->pin; @@ -5210,7 +5457,7 @@ index 0000000..f383e78 + } + + if (h_orph) { -+ mutex_unlock(&h_tmpdir->i_mutex); ++ inode_unlock(h_tmpdir); + /* todo: au_h_open_post()? */ + au_set_h_iptr(dir, bdst, au_igrab(h_dir), /*flags*/0); + au_set_h_dptr(parent, bdst, h_parent); @@ -5340,10 +5587,10 @@ index 0000000..f383e78 +} diff --git a/fs/aufs/cpup.h b/fs/aufs/cpup.h new file mode 100644 -index 0000000..9c20116 +index 0000000..894e076 --- /dev/null +++ b/fs/aufs/cpup.h -@@ -0,0 +1,94 @@ +@@ -0,0 +1,99 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -5405,6 +5652,11 @@ index 0000000..9c20116 +#define AuCpup_RWDST (1 << 5) /* force write target even if + the branch is marked as RO */ + ++#ifndef CONFIG_AUFS_BR_HFSPLUS ++#undef AuCpup_HOPEN ++#define AuCpup_HOPEN 0 ++#endif ++ +#define au_ftest_cpup(flags, name) ((flags) & AuCpup_##name) +#define au_fset_cpup(flags, name) \ + do { (flags) |= AuCpup_##name; } while (0) @@ -5440,10 +5692,10 @@ index 0000000..9c20116 +#endif /* __AUFS_CPUP_H__ */ diff --git a/fs/aufs/dbgaufs.c b/fs/aufs/dbgaufs.c new file mode 100644 -index 0000000..30913f4 +index 0000000..aa92374 --- /dev/null +++ b/fs/aufs/dbgaufs.c -@@ -0,0 +1,438 @@ +@@ -0,0 +1,437 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -5508,15 +5760,15 @@ index 0000000..30913f4 + if (!xf) + goto out; + -+ err = vfs_getattr(&xf->f_path, &st); ++ err = vfsub_getattr(&xf->f_path, &st); + if (!err) { + if (do_fcnt) + p->n = snprintf -+ (p->a, sizeof(p->a), "%ld, %llux%lu %lld\n", ++ (p->a, sizeof(p->a), "%ld, %llux%u %lld\n", + (long)file_count(xf), st.blocks, st.blksize, + (long long)st.size); + else -+ p->n = snprintf(p->a, sizeof(p->a), "%llux%lu %lld\n", ++ p->n = snprintf(p->a, sizeof(p->a), "%llux%u %lld\n", + st.blocks, st.blksize, + (long long)st.size); + AuDebugOn(p->n >= sizeof(p->a)); @@ -5560,7 +5812,7 @@ index 0000000..30913f4 + struct dbgaufs_plink_arg *p; + struct au_sbinfo *sbinfo; + struct super_block *sb; -+ struct au_sphlhead *sphl; ++ struct hlist_bl_head *hbl; + + err = -ENOMEM; + p = (void *)get_zeroed_page(GFP_NOFS); @@ -5580,10 +5832,9 @@ index 0000000..30913f4 + limit -= n; + + sum = 0; -+ for (i = 0, sphl = sbinfo->si_plink; -+ i < AuPlink_NHASH; -+ i++, sphl++) { -+ n = au_sphl_count(sphl); ++ for (i = 0, hbl = sbinfo->si_plink; i < AuPlink_NHASH; ++ i++, hbl++) { ++ n = au_hbl_count(hbl); + sum += n; + + n = snprintf(p->a + p->n, limit, "%lu ", n); @@ -6311,7 +6562,7 @@ index 0000000..92d6f91 +#endif /* __AUFS_DCSUB_H__ */ diff --git a/fs/aufs/debug.c b/fs/aufs/debug.c new file mode 100644 -index 0000000..12cc993 +index 0000000..6cfcb14 --- /dev/null +++ b/fs/aufs/debug.c @@ -0,0 +1,440 @@ @@ -6663,7 +6914,7 @@ index 0000000..12cc993 + return; + dpri("nw %d, gen %u, kobj %d\n", + atomic_read(&sbinfo->si_nowait.nw_len), sbinfo->si_generation, -+ atomic_read(&sbinfo->si_kobj.kref.refcount)); ++ kref_read(&sbinfo->si_kobj.kref)); + for (bindex = 0; bindex <= sbinfo->si_bbot; bindex++) + do_pri_br(bindex, sbinfo->si_branch[0 + bindex]); +} @@ -6988,10 +7239,10 @@ index 0000000..270628d +#endif /* __AUFS_DEBUG_H__ */ diff --git a/fs/aufs/dentry.c b/fs/aufs/dentry.c new file mode 100644 -index 0000000..054bd9f +index 0000000..230db04 --- /dev/null +++ b/fs/aufs/dentry.c -@@ -0,0 +1,1130 @@ +@@ -0,0 +1,1152 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -7016,19 +7267,13 @@ index 0000000..054bd9f +#include +#include "aufs.h" + -+struct au_do_lookup_args { -+ unsigned int flags; -+ mode_t type; -+}; -+ +/* + * returns positive/negative dentry, NULL or an error. + * NULL means whiteout-ed or not-found. + */ +static struct dentry* +au_do_lookup(struct dentry *h_parent, struct dentry *dentry, -+ aufs_bindex_t bindex, struct qstr *wh_name, -+ struct au_do_lookup_args *args) ++ aufs_bindex_t bindex, struct au_do_lookup_args *args) +{ + struct dentry *h_dentry; + struct inode *h_inode; @@ -7043,7 +7288,7 @@ index 0000000..054bd9f + br = au_sbr(dentry->d_sb, bindex); + wh_able = !!au_br_whable(br->br_perm); + if (wh_able) -+ wh_found = au_wh_test(h_parent, wh_name, ignore_perm); ++ wh_found = au_wh_test(h_parent, &args->whname, ignore_perm); + h_dentry = ERR_PTR(wh_found); + if (!wh_found) + goto real_lookup; @@ -7058,9 +7303,9 @@ index 0000000..054bd9f + +real_lookup: + if (!ignore_perm) -+ h_dentry = vfsub_lkup_one(&dentry->d_name, h_parent); ++ h_dentry = vfsub_lkup_one(args->name, h_parent); + else -+ h_dentry = au_sio_lkup_one(&dentry->d_name, h_parent); ++ h_dentry = au_sio_lkup_one(args->name, h_parent); + if (IS_ERR(h_dentry)) { + if (PTR_ERR(h_dentry) == -ENAMETOOLONG + && !allow_neg) @@ -7075,6 +7320,13 @@ index 0000000..054bd9f + } else if (wh_found + || (args->type && args->type != (h_inode->i_mode & S_IFMT))) + goto out_neg; ++ else if (au_ftest_lkup(args->flags, DIRREN) ++ /* && h_inode */ ++ && !au_dr_lkup_h_ino(args, bindex, h_inode->i_ino)) { ++ AuDbg("b%d %pd ignored hi%llu\n", bindex, h_dentry, ++ (unsigned long long)h_inode->i_ino); ++ goto out_neg; ++ } + + if (au_dbbot(dentry) <= bindex) + au_set_dbbot(dentry, bindex); @@ -7087,9 +7339,9 @@ index 0000000..054bd9f + || (d_really_is_positive(dentry) && !d_is_dir(dentry))) + goto out; /* success */ + -+ mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD); ++ vfsub_inode_lock_shared_nested(h_inode, AuLsc_I_CHILD); + opq = au_diropq_test(h_dentry); -+ mutex_unlock(&h_inode->i_mutex); ++ inode_unlock_shared(h_inode); + if (opq > 0) + au_set_dbdiropq(dentry, bindex); + else if (unlikely(opq < 0)) { @@ -7123,26 +7375,28 @@ index 0000000..054bd9f +{ + int npositive, err; + aufs_bindex_t bindex, btail, bdiropq; -+ unsigned char isdir, dirperm1; -+ struct qstr whname; ++ unsigned char isdir, dirperm1, dirren; + struct au_do_lookup_args args = { -+ .flags = flags ++ .flags = flags, ++ .name = &dentry->d_name + }; -+ const struct qstr *name = &dentry->d_name; + struct dentry *parent; + struct super_block *sb; + + sb = dentry->d_sb; -+ err = au_test_shwh(sb, name); ++ err = au_test_shwh(sb, args.name); + if (unlikely(err)) + goto out; + -+ err = au_wh_name_alloc(&whname, name); ++ err = au_wh_name_alloc(&args.whname, args.name); + if (unlikely(err)) + goto out; + + isdir = !!d_is_dir(dentry); + dirperm1 = !!au_opt_test(au_mntflags(sb), DIRPERM1); ++ dirren = !!au_opt_test(au_mntflags(sb), DIRREN); ++ if (dirren) ++ au_fset_lkup(args.flags, DIRREN); + + npositive = 0; + parent = dget_parent(dentry); @@ -7150,6 +7404,7 @@ index 0000000..054bd9f + for (bindex = btop; bindex <= btail; bindex++) { + struct dentry *h_parent, *h_dentry; + struct inode *h_inode, *h_dir; ++ struct au_branch *br; + + h_dentry = au_h_dptr(dentry, bindex); + if (h_dentry) { @@ -7161,11 +7416,17 @@ index 0000000..054bd9f + if (!h_parent || !d_is_dir(h_parent)) + continue; + ++ if (dirren) { ++ /* if the inum matches, then use the prepared name */ ++ err = au_dr_lkup_name(&args, bindex); ++ if (unlikely(err)) ++ goto out_parent; ++ } ++ + h_dir = d_inode(h_parent); -+ mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT); -+ h_dentry = au_do_lookup(h_parent, dentry, bindex, &whname, -+ &args); -+ mutex_unlock(&h_dir->i_mutex); ++ vfsub_inode_lock_shared_nested(h_dir, AuLsc_I_PARENT); ++ h_dentry = au_do_lookup(h_parent, dentry, bindex, &args); ++ inode_unlock_shared(h_dir); + err = PTR_ERR(h_dentry); + if (IS_ERR(h_dentry)) + goto out_parent; @@ -7192,6 +7453,15 @@ index 0000000..054bd9f + if (bdiropq >= 0 && bdiropq <= bindex) + break; + } ++ br = au_sbr(sb, bindex); ++ if (dirren ++ && au_dr_hino_test_add(&br->br_dirren, h_inode->i_ino, ++ /*add_ent*/NULL)) { ++ /* prepare next name to lookup */ ++ err = au_dr_lkup(&args, dentry, bindex); ++ if (unlikely(err)) ++ goto out_parent; ++ } + } + + if (npositive) { @@ -7208,7 +7478,9 @@ index 0000000..054bd9f + +out_parent: + dput(parent); -+ kfree(whname.name); ++ kfree(args.whname.name); ++ if (dirren) ++ au_dr_lkup_fin(&args); +out: + return err; +} @@ -7817,7 +8089,7 @@ index 0000000..054bd9f + +/* todo: remove this */ +static int h_d_revalidate(struct dentry *dentry, struct inode *inode, -+ unsigned int flags, int do_udba) ++ unsigned int flags, int do_udba, int dirren) +{ + int err; + umode_t mode, h_mode; @@ -7868,7 +8140,7 @@ index 0000000..054bd9f + && !is_root + && ((!h_nfs + && (unhashed != !!d_unhashed(h_dentry) -+ || (!tmpfile ++ || (!tmpfile && !dirren + && !au_qstreq(name, h_name)) + )) + || (h_nfs @@ -8009,7 +8281,7 @@ index 0000000..054bd9f +{ + int valid, err; + unsigned int sigen; -+ unsigned char do_udba; ++ unsigned char do_udba, dirren; + struct super_block *sb; + struct inode *inode; + @@ -8082,7 +8354,8 @@ index 0000000..054bd9f + } + } + -+ err = h_d_revalidate(dentry, inode, flags, do_udba); ++ dirren = !!au_opt_test(au_mntflags(sb), DIRREN); ++ err = h_d_revalidate(dentry, inode, flags, do_udba, dirren); + if (unlikely(!err && do_udba && au_dbtop(dentry) < 0)) { + err = -EIO; + AuDbg("both of real entry and whiteout found, %p, err %d\n", @@ -8124,10 +8397,10 @@ index 0000000..054bd9f +}; diff --git a/fs/aufs/dentry.h b/fs/aufs/dentry.h new file mode 100644 -index 0000000..adb40ed +index 0000000..ea45862 --- /dev/null +++ b/fs/aufs/dentry.h -@@ -0,0 +1,252 @@ +@@ -0,0 +1,266 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -8155,6 +8428,7 @@ index 0000000..adb40ed +#ifdef __KERNEL__ + +#include ++#include "dirren.h" +#include "rwsem.h" + +struct au_hdentry { @@ -8176,12 +8450,25 @@ index 0000000..adb40ed +/* flags for au_lkup_dentry() */ +#define AuLkup_ALLOW_NEG 1 +#define AuLkup_IGNORE_PERM (1 << 1) ++#define AuLkup_DIRREN (1 << 2) +#define au_ftest_lkup(flags, name) ((flags) & AuLkup_##name) +#define au_fset_lkup(flags, name) \ + do { (flags) |= AuLkup_##name; } while (0) +#define au_fclr_lkup(flags, name) \ + do { (flags) &= ~AuLkup_##name; } while (0) + ++#ifndef CONFIG_AUFS_DIRREN ++#undef AuLkup_DIRREN ++#define AuLkup_DIRREN 0 ++#endif ++ ++struct au_do_lookup_args { ++ unsigned int flags; ++ mode_t type; ++ struct qstr whname, *name; ++ struct au_dr_lookup dirren; ++}; ++ +/* ---------------------------------------------------------------------- */ + +/* dentry.c */ @@ -8382,7 +8669,7 @@ index 0000000..adb40ed +#endif /* __AUFS_DENTRY_H__ */ diff --git a/fs/aufs/dinfo.c b/fs/aufs/dinfo.c new file mode 100644 -index 0000000..e78d18a +index 0000000..8b19f94 --- /dev/null +++ b/fs/aufs/dinfo.c @@ -0,0 +1,553 @@ @@ -8664,11 +8951,11 @@ index 0000000..e78d18a + || d_inode(d1) == d_inode(d2) + || d1->d_sb != d2->d_sb); + -+ if (isdir && au_test_subdir(d1, d2)) { ++ if ((isdir && au_test_subdir(d1, d2)) ++ || d1 < d2) { + di_write_lock_child(d1); + di_write_lock_child2(d2); + } else { -+ /* there should be no races */ + di_write_lock_child(d2); + di_write_lock_child2(d1); + } @@ -8680,11 +8967,11 @@ index 0000000..e78d18a + || d_inode(d1) == d_inode(d2) + || d1->d_sb != d2->d_sb); + -+ if (isdir && au_test_subdir(d1, d2)) { ++ if ((isdir && au_test_subdir(d1, d2)) ++ || d1 < d2) { + di_write_lock_parent(d1); + di_write_lock_parent2(d2); + } else { -+ /* there should be no races */ + di_write_lock_parent(d2); + di_write_lock_parent2(d1); + } @@ -8941,10 +9228,10 @@ index 0000000..e78d18a +} diff --git a/fs/aufs/dir.c b/fs/aufs/dir.c new file mode 100644 -index 0000000..41aa2c6 +index 0000000..8dffb00 --- /dev/null +++ b/fs/aufs/dir.c -@@ -0,0 +1,761 @@ +@@ -0,0 +1,759 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -9087,14 +9374,14 @@ index 0000000..41aa2c6 + if (err) + goto out_unlock; + hdir = au_hi(dir, btop); -+ au_hn_imtx_lock_nested(hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_PARENT); + h_dir = au_h_iptr(dir, btop); + if (h_dir->i_nlink + && timespec_compare(&h_dir->i_mtime, &dt.dt_mtime) < 0) { + dt.dt_h_path = h_path; + au_dtime_revert(&dt); + } -+ au_hn_imtx_unlock(hdir); ++ au_hn_inode_unlock(hdir); + vfsub_mnt_drop_write(h_path.mnt); + au_cpup_attr_timesizes(dir); + @@ -9276,8 +9563,8 @@ index 0000000..41aa2c6 + finfo = au_fi(file); + fidir = finfo->fi_hdir; + if (fidir) { -+ au_sphl_del(&finfo->fi_hlist, -+ &au_sbi(file->f_path.dentry->d_sb)->si_files); ++ au_hbl_del(&finfo->fi_hlist, ++ &au_sbi(file->f_path.dentry->d_sb)->si_files); + vdir_cache = fidir->fd_vdir_cache; /* lock-free */ + if (vdir_cache) + au_vdir_free(vdir_cache); @@ -9362,7 +9649,7 @@ index 0000000..41aa2c6 + struct super_block *sb; + struct inode *inode; + -+ err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1); ++ err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1, /*fi_lsc*/0); + if (unlikely(err)) + goto out; + @@ -9391,13 +9678,11 @@ index 0000000..41aa2c6 + struct dentry *dentry; + struct inode *inode; + struct super_block *sb; -+ struct mutex *mtx; + + err = 0; + dentry = file->f_path.dentry; + inode = d_inode(dentry); -+ mtx = &inode->i_mutex; -+ mutex_lock(mtx); ++ inode_lock(inode); + sb = dentry->d_sb; + si_noflush_read_lock(sb); + if (file) @@ -9412,13 +9697,13 @@ index 0000000..41aa2c6 + fi_write_unlock(file); + + si_read_unlock(sb); -+ mutex_unlock(mtx); ++ inode_unlock(inode); + return err; +} + +/* ---------------------------------------------------------------------- */ + -+static int aufs_iterate(struct file *file, struct dir_context *ctx) ++static int aufs_iterate_shared(struct file *file, struct dir_context *ctx) +{ + int err; + struct dentry *dentry; @@ -9433,7 +9718,7 @@ index 0000000..41aa2c6 + + sb = dentry->d_sb; + si_read_lock(sb, AuLock_FLUSH); -+ err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1); ++ err = au_reval_and_lock_fdi(file, reopen_dir, /*wlock*/1, /*fi_lsc*/0); + if (unlikely(err)) + goto out; + err = au_alive_dir(dentry); @@ -9586,9 +9871,9 @@ index 0000000..41aa2c6 + h_dentry = au_h_dptr(dentry, arg->bindex); + h_inode = d_inode(h_dentry); + /* todo: i_mode changes anytime? */ -+ mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD); ++ vfsub_inode_lock_shared_nested(h_inode, AuLsc_I_CHILD); + err = au_test_h_perm_sio(h_inode, MAY_EXEC | MAY_READ); -+ mutex_unlock(&h_inode->i_mutex); ++ inode_unlock_shared(h_inode); + if (!err) + err = do_test_empty(dentry, arg); + else { @@ -9696,7 +9981,7 @@ index 0000000..41aa2c6 + .owner = THIS_MODULE, + .llseek = default_llseek, + .read = generic_read_dir, -+ .iterate = aufs_iterate, ++ .iterate_shared = aufs_iterate_shared, + .unlocked_ioctl = aufs_ioctl_dir, +#ifdef CONFIG_COMPAT + .compat_ioctl = aufs_compat_ioctl_dir, @@ -9843,9 +10128,1475 @@ index 0000000..b107309 + +#endif /* __KERNEL__ */ +#endif /* __AUFS_DIR_H__ */ +diff --git a/fs/aufs/dirren.c b/fs/aufs/dirren.c +new file mode 100644 +index 0000000..3c53b9d +--- /dev/null ++++ b/fs/aufs/dirren.c +@@ -0,0 +1,1315 @@ ++/* ++ * Copyright (C) 2017 Junjiro R. Okajima ++ * ++ * This program, aufs is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++/* ++ * special handling in renaming a directoy ++ * in order to support looking-up the before-renamed name on the lower readonly ++ * branches ++ */ ++ ++#include ++#include "aufs.h" ++ ++static void au_dr_hino_del(struct au_dr_br *dr, struct au_dr_hino *ent) ++{ ++ int idx; ++ ++ idx = au_dr_ihash(ent->dr_h_ino); ++ au_hbl_del(&ent->dr_hnode, dr->dr_h_ino + idx); ++} ++ ++static int au_dr_hino_test_empty(struct au_dr_br *dr) ++{ ++ int ret, i; ++ struct hlist_bl_head *hbl; ++ ++ ret = 1; ++ for (i = 0; ret && i < AuDirren_NHASH; i++) { ++ hbl = dr->dr_h_ino + i; ++ hlist_bl_lock(hbl); ++ ret &= hlist_bl_empty(hbl); ++ hlist_bl_unlock(hbl); ++ } ++ ++ return ret; ++} ++ ++static struct au_dr_hino *au_dr_hino_find(struct au_dr_br *dr, ino_t ino) ++{ ++ struct au_dr_hino *found, *ent; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; ++ int idx; ++ ++ found = NULL; ++ idx = au_dr_ihash(ino); ++ hbl = dr->dr_h_ino + idx; ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(ent, pos, hbl, dr_hnode) ++ if (ent->dr_h_ino == ino) { ++ found = ent; ++ break; ++ } ++ hlist_bl_unlock(hbl); ++ ++ return found; ++} ++ ++int au_dr_hino_test_add(struct au_dr_br *dr, ino_t ino, ++ struct au_dr_hino *add_ent) ++{ ++ int found, idx; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; ++ struct au_dr_hino *ent; ++ ++ found = 0; ++ idx = au_dr_ihash(ino); ++ hbl = dr->dr_h_ino + idx; ++#if 0 ++ { ++ struct hlist_bl_node *tmp; ++ ++ hlist_bl_for_each_entry_safe(ent, pos, tmp, hbl, dr_hnode) ++ AuDbg("hi%llu\n", (unsigned long long)ent->dr_h_ino); ++ } ++#endif ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(ent, pos, hbl, dr_hnode) ++ if (ent->dr_h_ino == ino) { ++ found = 1; ++ break; ++ } ++ if (!found && add_ent) ++ hlist_bl_add_head(&add_ent->dr_hnode, hbl); ++ hlist_bl_unlock(hbl); ++ ++ if (!found && add_ent) ++ AuDbg("i%llu added\n", (unsigned long long)add_ent->dr_h_ino); ++ ++ return found; ++} ++ ++void au_dr_hino_free(struct au_dr_br *dr) ++{ ++ int i; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos, *tmp; ++ struct au_dr_hino *ent; ++ ++ /* SiMustWriteLock(sb); */ ++ ++ for (i = 0; i < AuDirren_NHASH; i++) { ++ hbl = dr->dr_h_ino + i; ++ /* no spinlock since sbinfo must be write-locked */ ++ hlist_bl_for_each_entry_safe(ent, pos, tmp, hbl, dr_hnode) ++ kfree(ent); ++ INIT_HLIST_BL_HEAD(hbl); ++ } ++} ++ ++/* returns the number of inodes or an error */ ++static int au_dr_hino_store(struct super_block *sb, struct au_branch *br, ++ struct file *hinofile) ++{ ++ int err, i; ++ ssize_t ssz; ++ loff_t pos, oldsize; ++ __be64 u64; ++ struct inode *hinoinode; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *n1, *n2; ++ struct au_dr_hino *ent; ++ ++ SiMustWriteLock(sb); ++ AuDebugOn(!au_br_writable(br->br_perm)); ++ ++ hinoinode = file_inode(hinofile); ++ oldsize = i_size_read(hinoinode); ++ ++ err = 0; ++ pos = 0; ++ hbl = br->br_dirren.dr_h_ino; ++ for (i = 0; !err && i < AuDirren_NHASH; i++, hbl++) { ++ /* no bit-lock since sbinfo must be write-locked */ ++ hlist_bl_for_each_entry_safe(ent, n1, n2, hbl, dr_hnode) { ++ AuDbg("hi%llu, %pD2\n", ++ (unsigned long long)ent->dr_h_ino, hinofile); ++ u64 = cpu_to_be64(ent->dr_h_ino); ++ ssz = vfsub_write_k(hinofile, &u64, sizeof(u64), &pos); ++ if (ssz == sizeof(u64)) ++ continue; ++ ++ /* write error */ ++ pr_err("ssz %zd, %pD2\n", ssz, hinofile); ++ err = -ENOSPC; ++ if (ssz < 0) ++ err = ssz; ++ break; ++ } ++ } ++ /* regardless the error */ ++ if (pos < oldsize) { ++ err = vfsub_trunc(&hinofile->f_path, pos, /*attr*/0, hinofile); ++ AuTraceErr(err); ++ } ++ ++ AuTraceErr(err); ++ return err; ++} ++ ++static int au_dr_hino_load(struct au_dr_br *dr, struct file *hinofile) ++{ ++ int err, hidx; ++ ssize_t ssz; ++ size_t sz, n; ++ loff_t pos; ++ uint64_t u64; ++ struct au_dr_hino *ent; ++ struct inode *hinoinode; ++ struct hlist_bl_head *hbl; ++ ++ err = 0; ++ pos = 0; ++ hbl = dr->dr_h_ino; ++ hinoinode = file_inode(hinofile); ++ sz = i_size_read(hinoinode); ++ AuDebugOn(sz % sizeof(u64)); ++ n = sz / sizeof(u64); ++ while (n--) { ++ ssz = vfsub_read_k(hinofile, &u64, sizeof(u64), &pos); ++ if (unlikely(ssz != sizeof(u64))) { ++ pr_err("ssz %zd, %pD2\n", ssz, hinofile); ++ err = -EINVAL; ++ if (ssz < 0) ++ err = ssz; ++ goto out_free; ++ } ++ ++ ent = kmalloc(sizeof(*ent), GFP_NOFS); ++ if (!ent) { ++ err = -ENOMEM; ++ AuTraceErr(err); ++ goto out_free; ++ } ++ ent->dr_h_ino = be64_to_cpu((__force __be64)u64); ++ AuDbg("hi%llu, %pD2\n", ++ (unsigned long long)ent->dr_h_ino, hinofile); ++ hidx = au_dr_ihash(ent->dr_h_ino); ++ au_hbl_add(&ent->dr_hnode, hbl + hidx); ++ } ++ goto out; /* success */ ++ ++out_free: ++ au_dr_hino_free(dr); ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++/* ++ * @bindex/@br is a switch to distinguish whether suspending hnotify or not. ++ * @path is a switch to distinguish load and store. ++ */ ++static int au_dr_hino(struct super_block *sb, aufs_bindex_t bindex, ++ struct au_branch *br, const struct path *path) ++{ ++ int err, flags; ++ unsigned char load, suspend; ++ struct file *hinofile; ++ struct au_hinode *hdir; ++ struct inode *dir, *delegated; ++ struct path hinopath; ++ struct qstr hinoname = QSTR_INIT(AUFS_WH_DR_BRHINO, ++ sizeof(AUFS_WH_DR_BRHINO) - 1); ++ ++ AuDebugOn(bindex < 0 && !br); ++ AuDebugOn(bindex >= 0 && br); ++ ++ err = -EINVAL; ++ suspend = !br; ++ if (suspend) ++ br = au_sbr(sb, bindex); ++ load = !!path; ++ if (!load) { ++ path = &br->br_path; ++ AuDebugOn(!au_br_writable(br->br_perm)); ++ if (unlikely(!au_br_writable(br->br_perm))) ++ goto out; ++ } ++ ++ hdir = NULL; ++ if (suspend) { ++ dir = d_inode(sb->s_root); ++ hdir = au_hinode(au_ii(dir), bindex); ++ dir = hdir->hi_inode; ++ au_hn_inode_lock_nested(hdir, AuLsc_I_CHILD); ++ } else { ++ dir = d_inode(path->dentry); ++ inode_lock_nested(dir, AuLsc_I_CHILD); ++ } ++ hinopath.dentry = vfsub_lkup_one(&hinoname, path->dentry); ++ err = PTR_ERR(hinopath.dentry); ++ if (IS_ERR(hinopath.dentry)) ++ goto out_unlock; ++ ++ err = 0; ++ flags = O_RDONLY; ++ if (load) { ++ if (d_is_negative(hinopath.dentry)) ++ goto out_dput; /* success */ ++ } else { ++ if (au_dr_hino_test_empty(&br->br_dirren)) { ++ if (d_is_positive(hinopath.dentry)) { ++ delegated = NULL; ++ err = vfsub_unlink(dir, &hinopath, &delegated, ++ /*force*/0); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ pr_err("ignored err %d, %pd2\n", ++ err, hinopath.dentry); ++ if (unlikely(err == -EWOULDBLOCK)) ++ iput(delegated); ++ err = 0; ++ } ++ goto out_dput; ++ } else if (!d_is_positive(hinopath.dentry)) { ++ err = vfsub_create(dir, &hinopath, 0600, ++ /*want_excl*/false); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ goto out_dput; ++ } ++ flags = O_WRONLY; ++ } ++ hinopath.mnt = path->mnt; ++ hinofile = vfsub_dentry_open(&hinopath, flags); ++ if (suspend) ++ au_hn_inode_unlock(hdir); ++ else ++ inode_unlock(dir); ++ dput(hinopath.dentry); ++ AuTraceErrPtr(hinofile); ++ if (IS_ERR(hinofile)) { ++ err = PTR_ERR(hinofile); ++ goto out; ++ } ++ ++ if (load) ++ err = au_dr_hino_load(&br->br_dirren, hinofile); ++ else ++ err = au_dr_hino_store(sb, br, hinofile); ++ fput(hinofile); ++ goto out; ++ ++out_dput: ++ dput(hinopath.dentry); ++out_unlock: ++ if (suspend) ++ au_hn_inode_unlock(hdir); ++ else ++ inode_unlock(dir); ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++static int au_dr_brid_init(struct au_dr_brid *brid, const struct path *path) ++{ ++ int err; ++ struct kstatfs kstfs; ++ dev_t dev; ++ struct dentry *dentry; ++ struct super_block *sb; ++ ++ err = vfs_statfs((void *)path, &kstfs); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ goto out; ++ ++ /* todo: support for UUID */ ++ ++ if (kstfs.f_fsid.val[0] || kstfs.f_fsid.val[1]) { ++ brid->type = AuBrid_FSID; ++ brid->fsid = kstfs.f_fsid; ++ } else { ++ dentry = path->dentry; ++ sb = dentry->d_sb; ++ dev = sb->s_dev; ++ if (dev) { ++ brid->type = AuBrid_DEV; ++ brid->dev = dev; ++ } ++ } ++ ++out: ++ return err; ++} ++ ++int au_dr_br_init(struct super_block *sb, struct au_branch *br, ++ const struct path *path) ++{ ++ int err, i; ++ struct au_dr_br *dr; ++ struct hlist_bl_head *hbl; ++ ++ dr = &br->br_dirren; ++ hbl = dr->dr_h_ino; ++ for (i = 0; i < AuDirren_NHASH; i++, hbl++) ++ INIT_HLIST_BL_HEAD(hbl); ++ ++ err = au_dr_brid_init(&dr->dr_brid, path); ++ if (unlikely(err)) ++ goto out; ++ ++ if (au_opt_test(au_mntflags(sb), DIRREN)) ++ err = au_dr_hino(sb, /*bindex*/-1, br, path); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++int au_dr_br_fin(struct super_block *sb, struct au_branch *br) ++{ ++ int err; ++ ++ err = 0; ++ if (au_br_writable(br->br_perm)) ++ err = au_dr_hino(sb, /*bindex*/-1, br, /*path*/NULL); ++ if (!err) ++ au_dr_hino_free(&br->br_dirren); ++ ++ return err; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++static int au_brid_str(struct au_dr_brid *brid, struct inode *h_inode, ++ char *buf, size_t sz) ++{ ++ int err; ++ unsigned int major, minor; ++ char *p; ++ ++ p = buf; ++ err = snprintf(p, sz, "%d_", brid->type); ++ AuDebugOn(err > sz); ++ p += err; ++ sz -= err; ++ switch (brid->type) { ++ case AuBrid_Unset: ++ return -EINVAL; ++ case AuBrid_UUID: ++ err = snprintf(p, sz, "%pU", brid->uuid.b); ++ break; ++ case AuBrid_FSID: ++ err = snprintf(p, sz, "%08x-%08x", ++ brid->fsid.val[0], brid->fsid.val[1]); ++ break; ++ case AuBrid_DEV: ++ major = MAJOR(brid->dev); ++ minor = MINOR(brid->dev); ++ if (major <= 0xff && minor <= 0xff) ++ err = snprintf(p, sz, "%02x%02x", major, minor); ++ else ++ err = snprintf(p, sz, "%03x:%05x", major, minor); ++ break; ++ } ++ AuDebugOn(err > sz); ++ p += err; ++ sz -= err; ++ err = snprintf(p, sz, "_%llu", (unsigned long long)h_inode->i_ino); ++ AuDebugOn(err > sz); ++ p += err; ++ sz -= err; ++ ++ return p - buf; ++} ++ ++static int au_drinfo_name(struct au_branch *br, char *name, int len) ++{ ++ int rlen; ++ struct dentry *br_dentry; ++ struct inode *br_inode; ++ ++ br_dentry = au_br_dentry(br); ++ br_inode = d_inode(br_dentry); ++ rlen = au_brid_str(&br->br_dirren.dr_brid, br_inode, name, len); ++ AuDebugOn(rlen >= AUFS_DIRREN_ENV_VAL_SZ); ++ AuDebugOn(rlen > len); ++ ++ return rlen; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++/* ++ * from the given @h_dentry, construct drinfo at @*fdata. ++ * when the size of @*fdata is not enough, reallocate and return new @fdata and ++ * @allocated. ++ */ ++static int au_drinfo_construct(struct au_drinfo_fdata **fdata, ++ struct dentry *h_dentry, ++ unsigned char *allocated) ++{ ++ int err, v; ++ struct au_drinfo_fdata *f, *p; ++ struct au_drinfo *drinfo; ++ struct inode *h_inode; ++ struct qstr *qname; ++ ++ err = 0; ++ f = *fdata; ++ h_inode = d_inode(h_dentry); ++ qname = &h_dentry->d_name; ++ drinfo = &f->drinfo; ++ drinfo->ino = (__force uint64_t)cpu_to_be64(h_inode->i_ino); ++ drinfo->oldnamelen = qname->len; ++ if (*allocated < sizeof(*f) + qname->len) { ++ v = roundup_pow_of_two(*allocated + qname->len); ++ p = au_krealloc(f, v, GFP_NOFS, /*may_shrink*/0); ++ if (unlikely(!p)) { ++ err = -ENOMEM; ++ AuTraceErr(err); ++ goto out; ++ } ++ f = p; ++ *fdata = f; ++ *allocated = v; ++ drinfo = &f->drinfo; ++ } ++ memcpy(drinfo->oldname, qname->name, qname->len); ++ AuDbg("i%llu, %.*s\n", ++ be64_to_cpu((__force __be64)drinfo->ino), drinfo->oldnamelen, ++ drinfo->oldname); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++/* callers have to free the return value */ ++static struct au_drinfo *au_drinfo_read_k(struct file *file, ino_t h_ino) ++{ ++ struct au_drinfo *ret, *drinfo; ++ struct au_drinfo_fdata fdata; ++ int len; ++ loff_t pos; ++ ssize_t ssz; ++ ++ ret = ERR_PTR(-EIO); ++ pos = 0; ++ ssz = vfsub_read_k(file, &fdata, sizeof(fdata), &pos); ++ if (unlikely(ssz != sizeof(fdata))) { ++ AuIOErr("ssz %zd, %u, %pD2\n", ++ ssz, (unsigned int)sizeof(fdata), file); ++ goto out; ++ } ++ ++ fdata.magic = ntohl((__force __be32)fdata.magic); ++ switch (fdata.magic) { ++ case AUFS_DRINFO_MAGIC_V1: ++ break; ++ default: ++ AuIOErr("magic-num 0x%x, 0x%x, %pD2\n", ++ fdata.magic, AUFS_DRINFO_MAGIC_V1, file); ++ goto out; ++ } ++ ++ drinfo = &fdata.drinfo; ++ len = drinfo->oldnamelen; ++ if (!len) { ++ AuIOErr("broken drinfo %pD2\n", file); ++ goto out; ++ } ++ ++ ret = NULL; ++ drinfo->ino = be64_to_cpu((__force __be64)drinfo->ino); ++ if (unlikely(h_ino && drinfo->ino != h_ino)) { ++ AuDbg("ignored i%llu, i%llu, %pD2\n", ++ (unsigned long long)drinfo->ino, ++ (unsigned long long)h_ino, file); ++ goto out; /* success */ ++ } ++ ++ ret = kmalloc(sizeof(*ret) + len, GFP_NOFS); ++ if (unlikely(!ret)) { ++ ret = ERR_PTR(-ENOMEM); ++ AuTraceErrPtr(ret); ++ goto out; ++ } ++ ++ *ret = *drinfo; ++ ssz = vfsub_read_k(file, (void *)ret->oldname, len, &pos); ++ if (unlikely(ssz != len)) { ++ kfree(ret); ++ ret = ERR_PTR(-EIO); ++ AuIOErr("ssz %zd, %u, %pD2\n", ssz, len, file); ++ goto out; ++ } ++ ++ AuDbg("oldname %.*s\n", ret->oldnamelen, ret->oldname); ++ ++out: ++ return ret; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++/* in order to be revertible */ ++struct au_drinfo_rev_elm { ++ int created; ++ struct dentry *info_dentry; ++ struct au_drinfo *info_last; ++}; ++ ++struct au_drinfo_rev { ++ unsigned char already; ++ aufs_bindex_t nelm; ++ struct au_drinfo_rev_elm elm[0]; ++}; ++ ++/* todo: isn't it too large? */ ++struct au_drinfo_store { ++ struct path h_ppath; ++ struct dentry *h_dentry; ++ struct au_drinfo_fdata *fdata; ++ char *infoname; /* inside of whname, just after PFX */ ++ char whname[sizeof(AUFS_WH_DR_INFO_PFX) + AUFS_DIRREN_ENV_VAL_SZ]; ++ aufs_bindex_t btgt, btail; ++ unsigned char no_sio, ++ allocated, /* current size of *fdata */ ++ infonamelen, /* room size for p */ ++ whnamelen, /* length of the genarated name */ ++ renameback; /* renamed back */ ++}; ++ ++/* on rename(2) error, the caller should revert it using @elm */ ++static int au_drinfo_do_store(struct au_drinfo_store *w, ++ struct au_drinfo_rev_elm *elm) ++{ ++ int err, len; ++ ssize_t ssz; ++ loff_t pos; ++ struct path infopath = { ++ .mnt = w->h_ppath.mnt ++ }; ++ struct inode *h_dir, *h_inode, *delegated; ++ struct file *infofile; ++ struct qstr *qname; ++ ++ AuDebugOn(elm ++ && memcmp(elm, page_address(ZERO_PAGE(0)), sizeof(*elm))); ++ ++ infopath.dentry = vfsub_lookup_one_len(w->whname, w->h_ppath.dentry, ++ w->whnamelen); ++ AuTraceErrPtr(infopath.dentry); ++ if (IS_ERR(infopath.dentry)) { ++ err = PTR_ERR(infopath.dentry); ++ goto out; ++ } ++ ++ err = 0; ++ h_dir = d_inode(w->h_ppath.dentry); ++ if (elm && d_is_negative(infopath.dentry)) { ++ err = vfsub_create(h_dir, &infopath, 0600, /*want_excl*/true); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ goto out_dput; ++ elm->created = 1; ++ elm->info_dentry = dget(infopath.dentry); ++ } ++ ++ infofile = vfsub_dentry_open(&infopath, O_RDWR); ++ AuTraceErrPtr(infofile); ++ if (IS_ERR(infofile)) { ++ err = PTR_ERR(infofile); ++ goto out_dput; ++ } ++ ++ h_inode = d_inode(infopath.dentry); ++ if (elm && i_size_read(h_inode)) { ++ h_inode = d_inode(w->h_dentry); ++ elm->info_last = au_drinfo_read_k(infofile, h_inode->i_ino); ++ AuTraceErrPtr(elm->info_last); ++ if (IS_ERR(elm->info_last)) { ++ err = PTR_ERR(elm->info_last); ++ elm->info_last = NULL; ++ AuDebugOn(elm->info_dentry); ++ goto out_fput; ++ } ++ } ++ ++ if (elm && w->renameback) { ++ delegated = NULL; ++ err = vfsub_unlink(h_dir, &infopath, &delegated, /*force*/0); ++ AuTraceErr(err); ++ if (unlikely(err == -EWOULDBLOCK)) ++ iput(delegated); ++ goto out_fput; ++ } ++ ++ pos = 0; ++ qname = &w->h_dentry->d_name; ++ len = sizeof(*w->fdata) + qname->len; ++ if (!elm) ++ len = sizeof(*w->fdata) + w->fdata->drinfo.oldnamelen; ++ ssz = vfsub_write_k(infofile, w->fdata, len, &pos); ++ if (ssz == len) { ++ AuDbg("hi%llu, %.*s\n", w->fdata->drinfo.ino, ++ w->fdata->drinfo.oldnamelen, w->fdata->drinfo.oldname); ++ goto out_fput; /* success */ ++ } else { ++ err = -EIO; ++ if (ssz < 0) ++ err = ssz; ++ /* the caller should revert it using @elm */ ++ } ++ ++out_fput: ++ fput(infofile); ++out_dput: ++ dput(infopath.dentry); ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++struct au_call_drinfo_do_store_args { ++ int *errp; ++ struct au_drinfo_store *w; ++ struct au_drinfo_rev_elm *elm; ++}; ++ ++static void au_call_drinfo_do_store(void *args) ++{ ++ struct au_call_drinfo_do_store_args *a = args; ++ ++ *a->errp = au_drinfo_do_store(a->w, a->elm); ++} ++ ++static int au_drinfo_store_sio(struct au_drinfo_store *w, ++ struct au_drinfo_rev_elm *elm) ++{ ++ int err, wkq_err; ++ ++ if (w->no_sio) ++ err = au_drinfo_do_store(w, elm); ++ else { ++ struct au_call_drinfo_do_store_args a = { ++ .errp = &err, ++ .w = w, ++ .elm = elm ++ }; ++ wkq_err = au_wkq_wait(au_call_drinfo_do_store, &a); ++ if (unlikely(wkq_err)) ++ err = wkq_err; ++ } ++ AuTraceErr(err); ++ ++ return err; ++} ++ ++static int au_drinfo_store_work_init(struct au_drinfo_store *w, ++ aufs_bindex_t btgt) ++{ ++ int err; ++ ++ memset(w, 0, sizeof(*w)); ++ w->allocated = roundup_pow_of_two(sizeof(*w->fdata) + 40); ++ strcpy(w->whname, AUFS_WH_DR_INFO_PFX); ++ w->infoname = w->whname + sizeof(AUFS_WH_DR_INFO_PFX) - 1; ++ w->infonamelen = sizeof(w->whname) - sizeof(AUFS_WH_DR_INFO_PFX); ++ w->btgt = btgt; ++ w->no_sio = !!uid_eq(current_fsuid(), GLOBAL_ROOT_UID); ++ ++ err = -ENOMEM; ++ w->fdata = kcalloc(1, w->allocated, GFP_NOFS); ++ if (unlikely(!w->fdata)) { ++ AuTraceErr(err); ++ goto out; ++ } ++ w->fdata->magic = (__force uint32_t)htonl(AUFS_DRINFO_MAGIC_V1); ++ err = 0; ++ ++out: ++ return err; ++} ++ ++static void au_drinfo_store_work_fin(struct au_drinfo_store *w) ++{ ++ kfree(w->fdata); ++} ++ ++static void au_drinfo_store_rev(struct au_drinfo_rev *rev, ++ struct au_drinfo_store *w) ++{ ++ struct au_drinfo_rev_elm *elm; ++ struct inode *h_dir, *delegated; ++ int err, nelm; ++ struct path infopath = { ++ .mnt = w->h_ppath.mnt ++ }; ++ ++ h_dir = d_inode(w->h_ppath.dentry); ++ IMustLock(h_dir); ++ ++ err = 0; ++ elm = rev->elm; ++ for (nelm = rev->nelm; nelm > 0; nelm--, elm++) { ++ AuDebugOn(elm->created && elm->info_last); ++ if (elm->created) { ++ AuDbg("here\n"); ++ delegated = NULL; ++ infopath.dentry = elm->info_dentry; ++ err = vfsub_unlink(h_dir, &infopath, &delegated, ++ !w->no_sio); ++ AuTraceErr(err); ++ if (unlikely(err == -EWOULDBLOCK)) ++ iput(delegated); ++ dput(elm->info_dentry); ++ } else if (elm->info_last) { ++ AuDbg("here\n"); ++ w->fdata->drinfo = *elm->info_last; ++ memcpy(w->fdata->drinfo.oldname, ++ elm->info_last->oldname, ++ elm->info_last->oldnamelen); ++ err = au_drinfo_store_sio(w, /*elm*/NULL); ++ kfree(elm->info_last); ++ } ++ if (unlikely(err)) ++ AuIOErr("%d, %s\n", err, w->whname); ++ /* go on even if err */ ++ } ++} ++ ++/* caller has to call au_dr_rename_fin() later */ ++static int au_drinfo_store(struct dentry *dentry, aufs_bindex_t btgt, ++ struct qstr *dst_name, void *_rev) ++{ ++ int err, sz, nelm; ++ aufs_bindex_t bindex, btail; ++ struct au_drinfo_store work; ++ struct au_drinfo_rev *rev, **p; ++ struct au_drinfo_rev_elm *elm; ++ struct super_block *sb; ++ struct au_branch *br; ++ struct au_hinode *hdir; ++ ++ err = au_drinfo_store_work_init(&work, btgt); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ goto out; ++ ++ err = -ENOMEM; ++ btail = au_dbtaildir(dentry); ++ nelm = btail - btgt; ++ sz = sizeof(*rev) + sizeof(*elm) * nelm; ++ rev = kcalloc(1, sz, GFP_NOFS); ++ if (unlikely(!rev)) { ++ AuTraceErr(err); ++ goto out_args; ++ } ++ rev->nelm = nelm; ++ elm = rev->elm; ++ p = _rev; ++ *p = rev; ++ ++ err = 0; ++ sb = dentry->d_sb; ++ work.h_ppath.dentry = au_h_dptr(dentry, btgt); ++ work.h_ppath.mnt = au_sbr_mnt(sb, btgt); ++ hdir = au_hi(d_inode(dentry), btgt); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_CHILD); ++ for (bindex = btgt + 1; bindex <= btail; bindex++, elm++) { ++ work.h_dentry = au_h_dptr(dentry, bindex); ++ if (!work.h_dentry) ++ continue; ++ ++ err = au_drinfo_construct(&work.fdata, work.h_dentry, ++ &work.allocated); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ break; ++ ++ work.renameback = au_qstreq(&work.h_dentry->d_name, dst_name); ++ br = au_sbr(sb, bindex); ++ work.whnamelen = sizeof(AUFS_WH_DR_INFO_PFX) - 1; ++ work.whnamelen += au_drinfo_name(br, work.infoname, ++ work.infonamelen); ++ AuDbg("whname %.*s, i%llu, %.*s\n", ++ work.whnamelen, work.whname, ++ be64_to_cpu((__force __be64)work.fdata->drinfo.ino), ++ work.fdata->drinfo.oldnamelen, ++ work.fdata->drinfo.oldname); ++ ++ err = au_drinfo_store_sio(&work, elm); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ break; ++ } ++ if (unlikely(err)) { ++ /* revert all drinfo */ ++ au_drinfo_store_rev(rev, &work); ++ kfree(rev); ++ *p = NULL; ++ } ++ au_hn_inode_unlock(hdir); ++ ++out_args: ++ au_drinfo_store_work_fin(&work); ++out: ++ return err; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++int au_dr_rename(struct dentry *src, aufs_bindex_t bindex, ++ struct qstr *dst_name, void *_rev) ++{ ++ int err, already; ++ ino_t ino; ++ struct super_block *sb; ++ struct au_branch *br; ++ struct au_dr_br *dr; ++ struct dentry *h_dentry; ++ struct inode *h_inode; ++ struct au_dr_hino *ent; ++ struct au_drinfo_rev *rev, **p; ++ ++ AuDbg("bindex %d\n", bindex); ++ ++ err = -ENOMEM; ++ ent = kmalloc(sizeof(*ent), GFP_NOFS); ++ if (unlikely(!ent)) ++ goto out; ++ ++ sb = src->d_sb; ++ br = au_sbr(sb, bindex); ++ dr = &br->br_dirren; ++ h_dentry = au_h_dptr(src, bindex); ++ h_inode = d_inode(h_dentry); ++ ino = h_inode->i_ino; ++ ent->dr_h_ino = ino; ++ already = au_dr_hino_test_add(dr, ino, ent); ++ AuDbg("b%d, hi%llu, already %d\n", ++ bindex, (unsigned long long)ino, already); ++ ++ err = au_drinfo_store(src, bindex, dst_name, _rev); ++ AuTraceErr(err); ++ if (!err) { ++ p = _rev; ++ rev = *p; ++ rev->already = already; ++ goto out; /* success */ ++ } ++ ++ /* revert */ ++ if (!already) ++ au_dr_hino_del(dr, ent); ++ kfree(ent); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++void au_dr_rename_fin(struct dentry *src, aufs_bindex_t btgt, void *_rev) ++{ ++ struct au_drinfo_rev *rev; ++ struct au_drinfo_rev_elm *elm; ++ int nelm; ++ ++ rev = _rev; ++ elm = rev->elm; ++ for (nelm = rev->nelm; nelm > 0; nelm--, elm++) { ++ dput(elm->info_dentry); ++ kfree(elm->info_last); ++ } ++ kfree(rev); ++} ++ ++void au_dr_rename_rev(struct dentry *src, aufs_bindex_t btgt, void *_rev) ++{ ++ int err; ++ struct au_drinfo_store work; ++ struct au_drinfo_rev *rev = _rev; ++ struct super_block *sb; ++ struct au_branch *br; ++ struct inode *h_inode; ++ struct au_dr_br *dr; ++ struct au_dr_hino *ent; ++ ++ err = au_drinfo_store_work_init(&work, btgt); ++ if (unlikely(err)) ++ goto out; ++ ++ sb = src->d_sb; ++ br = au_sbr(sb, btgt); ++ work.h_ppath.dentry = au_h_dptr(src, btgt); ++ work.h_ppath.mnt = au_br_mnt(br); ++ au_drinfo_store_rev(rev, &work); ++ au_drinfo_store_work_fin(&work); ++ if (rev->already) ++ goto out; ++ ++ dr = &br->br_dirren; ++ h_inode = d_inode(work.h_ppath.dentry); ++ ent = au_dr_hino_find(dr, h_inode->i_ino); ++ BUG_ON(!ent); ++ au_dr_hino_del(dr, ent); ++ kfree(ent); ++ ++out: ++ kfree(rev); ++ if (unlikely(err)) ++ pr_err("failed to remove dirren info\n"); ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++static struct au_drinfo *au_drinfo_do_load(struct path *h_ppath, ++ char *whname, int whnamelen, ++ struct dentry **info_dentry) ++{ ++ struct au_drinfo *drinfo; ++ struct file *f; ++ struct inode *h_dir; ++ struct path infopath; ++ int unlocked; ++ ++ AuDbg("%pd/%.*s\n", h_ppath->dentry, whnamelen, whname); ++ ++ *info_dentry = NULL; ++ drinfo = NULL; ++ unlocked = 0; ++ h_dir = d_inode(h_ppath->dentry); ++ vfsub_inode_lock_shared_nested(h_dir, AuLsc_I_PARENT); ++ infopath.dentry = vfsub_lookup_one_len(whname, h_ppath->dentry, ++ whnamelen); ++ if (IS_ERR(infopath.dentry)) { ++ drinfo = (void *)infopath.dentry; ++ goto out; ++ } ++ ++ if (d_is_negative(infopath.dentry)) ++ goto out_dput; /* success */ ++ ++ infopath.mnt = h_ppath->mnt; ++ f = vfsub_dentry_open(&infopath, O_RDONLY); ++ inode_unlock_shared(h_dir); ++ unlocked = 1; ++ if (IS_ERR(f)) { ++ drinfo = (void *)f; ++ goto out_dput; ++ } ++ ++ drinfo = au_drinfo_read_k(f, /*h_ino*/0); ++ if (IS_ERR_OR_NULL(drinfo)) ++ goto out_fput; ++ ++ AuDbg("oldname %.*s\n", drinfo->oldnamelen, drinfo->oldname); ++ *info_dentry = dget(infopath.dentry); /* keep it alive */ ++ ++out_fput: ++ fput(f); ++out_dput: ++ dput(infopath.dentry); ++out: ++ if (!unlocked) ++ inode_unlock_shared(h_dir); ++ AuTraceErrPtr(drinfo); ++ return drinfo; ++} ++ ++struct au_drinfo_do_load_args { ++ struct au_drinfo **drinfop; ++ struct path *h_ppath; ++ char *whname; ++ int whnamelen; ++ struct dentry **info_dentry; ++}; ++ ++static void au_call_drinfo_do_load(void *args) ++{ ++ struct au_drinfo_do_load_args *a = args; ++ ++ *a->drinfop = au_drinfo_do_load(a->h_ppath, a->whname, a->whnamelen, ++ a->info_dentry); ++} ++ ++struct au_drinfo_load { ++ struct path h_ppath; ++ struct qstr *qname; ++ unsigned char no_sio; ++ ++ aufs_bindex_t ninfo; ++ struct au_drinfo **drinfo; ++}; ++ ++static int au_drinfo_load(struct au_drinfo_load *w, aufs_bindex_t bindex, ++ struct au_branch *br) ++{ ++ int err, wkq_err, whnamelen, e; ++ char whname[sizeof(AUFS_WH_DR_INFO_PFX) + AUFS_DIRREN_ENV_VAL_SZ] ++ = AUFS_WH_DR_INFO_PFX; ++ struct au_drinfo *drinfo; ++ struct qstr oldname; ++ struct inode *h_dir, *delegated; ++ struct dentry *info_dentry; ++ struct path infopath; ++ ++ whnamelen = sizeof(AUFS_WH_DR_INFO_PFX) - 1; ++ whnamelen += au_drinfo_name(br, whname + whnamelen, ++ sizeof(whname) - whnamelen); ++ if (w->no_sio) ++ drinfo = au_drinfo_do_load(&w->h_ppath, whname, whnamelen, ++ &info_dentry); ++ else { ++ struct au_drinfo_do_load_args args = { ++ .drinfop = &drinfo, ++ .h_ppath = &w->h_ppath, ++ .whname = whname, ++ .whnamelen = whnamelen, ++ .info_dentry = &info_dentry ++ }; ++ wkq_err = au_wkq_wait(au_call_drinfo_do_load, &args); ++ if (unlikely(wkq_err)) ++ drinfo = ERR_PTR(wkq_err); ++ } ++ err = PTR_ERR(drinfo); ++ if (IS_ERR_OR_NULL(drinfo)) ++ goto out; ++ ++ err = 0; ++ oldname.len = drinfo->oldnamelen; ++ oldname.name = drinfo->oldname; ++ if (au_qstreq(w->qname, &oldname)) { ++ /* the name is renamed back */ ++ kfree(drinfo); ++ drinfo = NULL; ++ ++ infopath.dentry = info_dentry; ++ infopath.mnt = w->h_ppath.mnt; ++ h_dir = d_inode(w->h_ppath.dentry); ++ delegated = NULL; ++ inode_lock_nested(h_dir, AuLsc_I_PARENT); ++ e = vfsub_unlink(h_dir, &infopath, &delegated, !w->no_sio); ++ inode_unlock(h_dir); ++ if (unlikely(e)) ++ AuIOErr("ignored %d, %pd2\n", e, &infopath.dentry); ++ if (unlikely(e == -EWOULDBLOCK)) ++ iput(delegated); ++ } ++ kfree(w->drinfo[bindex]); ++ w->drinfo[bindex] = drinfo; ++ dput(info_dentry); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++static void au_dr_lkup_free(struct au_drinfo **drinfo, int n) ++{ ++ struct au_drinfo **p = drinfo; ++ ++ while (n-- > 0) ++ kfree(*drinfo++); ++ kfree(p); ++} ++ ++int au_dr_lkup(struct au_do_lookup_args *lkup, struct dentry *dentry, ++ aufs_bindex_t btgt) ++{ ++ int err, ninfo; ++ struct au_drinfo_load w; ++ aufs_bindex_t bindex, bbot; ++ struct au_branch *br; ++ struct inode *h_dir; ++ struct au_dr_hino *ent; ++ struct super_block *sb; ++ ++ AuDbg("%.*s, name %.*s, whname %.*s, b%d\n", ++ AuLNPair(&dentry->d_name), AuLNPair(&lkup->dirren.dr_name), ++ AuLNPair(&lkup->whname), btgt); ++ ++ sb = dentry->d_sb; ++ bbot = au_sbbot(sb); ++ w.ninfo = bbot + 1; ++ if (!lkup->dirren.drinfo) { ++ lkup->dirren.drinfo = kcalloc(w.ninfo, ++ sizeof(*lkup->dirren.drinfo), ++ GFP_NOFS); ++ if (unlikely(!lkup->dirren.drinfo)) { ++ err = -ENOMEM; ++ goto out; ++ } ++ lkup->dirren.ninfo = w.ninfo; ++ } ++ w.drinfo = lkup->dirren.drinfo; ++ w.no_sio = !!uid_eq(current_fsuid(), GLOBAL_ROOT_UID); ++ w.h_ppath.dentry = au_h_dptr(dentry, btgt); ++ AuDebugOn(!w.h_ppath.dentry); ++ w.h_ppath.mnt = au_sbr_mnt(sb, btgt); ++ w.qname = &dentry->d_name; ++ ++ ninfo = 0; ++ for (bindex = btgt + 1; bindex <= bbot; bindex++) { ++ br = au_sbr(sb, bindex); ++ err = au_drinfo_load(&w, bindex, br); ++ if (unlikely(err)) ++ goto out_free; ++ if (w.drinfo[bindex]) ++ ninfo++; ++ } ++ if (!ninfo) { ++ br = au_sbr(sb, btgt); ++ h_dir = d_inode(w.h_ppath.dentry); ++ ent = au_dr_hino_find(&br->br_dirren, h_dir->i_ino); ++ AuDebugOn(!ent); ++ au_dr_hino_del(&br->br_dirren, ent); ++ kfree(ent); ++ } ++ goto out; /* success */ ++ ++out_free: ++ au_dr_lkup_free(lkup->dirren.drinfo, lkup->dirren.ninfo); ++ lkup->dirren.ninfo = 0; ++ lkup->dirren.drinfo = NULL; ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++void au_dr_lkup_fin(struct au_do_lookup_args *lkup) ++{ ++ au_dr_lkup_free(lkup->dirren.drinfo, lkup->dirren.ninfo); ++} ++ ++int au_dr_lkup_name(struct au_do_lookup_args *lkup, aufs_bindex_t btgt) ++{ ++ int err; ++ struct au_drinfo *drinfo; ++ ++ err = 0; ++ if (!lkup->dirren.drinfo) ++ goto out; ++ AuDebugOn(lkup->dirren.ninfo < btgt + 1); ++ drinfo = lkup->dirren.drinfo[btgt + 1]; ++ if (!drinfo) ++ goto out; ++ ++ kfree(lkup->whname.name); ++ lkup->whname.name = NULL; ++ lkup->dirren.dr_name.len = drinfo->oldnamelen; ++ lkup->dirren.dr_name.name = drinfo->oldname; ++ lkup->name = &lkup->dirren.dr_name; ++ err = au_wh_name_alloc(&lkup->whname, lkup->name); ++ if (!err) ++ AuDbg("name %.*s, whname %.*s, b%d\n", ++ AuLNPair(lkup->name), AuLNPair(&lkup->whname), ++ btgt); ++ ++out: ++ AuTraceErr(err); ++ return err; ++} ++ ++int au_dr_lkup_h_ino(struct au_do_lookup_args *lkup, aufs_bindex_t bindex, ++ ino_t h_ino) ++{ ++ int match; ++ struct au_drinfo *drinfo; ++ ++ match = 1; ++ if (!lkup->dirren.drinfo) ++ goto out; ++ AuDebugOn(lkup->dirren.ninfo < bindex + 1); ++ drinfo = lkup->dirren.drinfo[bindex + 1]; ++ if (!drinfo) ++ goto out; ++ ++ match = (drinfo->ino == h_ino); ++ AuDbg("match %d\n", match); ++ ++out: ++ return match; ++} ++ ++/* ---------------------------------------------------------------------- */ ++ ++int au_dr_opt_set(struct super_block *sb) ++{ ++ int err; ++ aufs_bindex_t bindex, bbot; ++ struct au_branch *br; ++ ++ err = 0; ++ bbot = au_sbbot(sb); ++ for (bindex = 0; !err && bindex <= bbot; bindex++) { ++ br = au_sbr(sb, bindex); ++ err = au_dr_hino(sb, bindex, /*br*/NULL, &br->br_path); ++ } ++ ++ return err; ++} ++ ++int au_dr_opt_flush(struct super_block *sb) ++{ ++ int err; ++ aufs_bindex_t bindex, bbot; ++ struct au_branch *br; ++ ++ err = 0; ++ bbot = au_sbbot(sb); ++ for (bindex = 0; !err && bindex <= bbot; bindex++) { ++ br = au_sbr(sb, bindex); ++ if (au_br_writable(br->br_perm)) ++ err = au_dr_hino(sb, bindex, /*br*/NULL, /*path*/NULL); ++ } ++ ++ return err; ++} ++ ++int au_dr_opt_clr(struct super_block *sb, int no_flush) ++{ ++ int err; ++ aufs_bindex_t bindex, bbot; ++ struct au_branch *br; ++ ++ err = 0; ++ if (!no_flush) { ++ err = au_dr_opt_flush(sb); ++ if (unlikely(err)) ++ goto out; ++ } ++ ++ bbot = au_sbbot(sb); ++ for (bindex = 0; bindex <= bbot; bindex++) { ++ br = au_sbr(sb, bindex); ++ au_dr_hino_free(&br->br_dirren); ++ } ++ ++out: ++ return err; ++} +diff --git a/fs/aufs/dirren.h b/fs/aufs/dirren.h +new file mode 100644 +index 0000000..7f1790e +--- /dev/null ++++ b/fs/aufs/dirren.h +@@ -0,0 +1,139 @@ ++/* ++ * Copyright (C) 2017 Junjiro R. Okajima ++ * ++ * This program, aufs is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++/* ++ * renamed dir info ++ */ ++ ++#ifndef __AUFS_DIRREN_H__ ++#define __AUFS_DIRREN_H__ ++ ++#ifdef __KERNEL__ ++ ++#include ++#include ++#include ++#include "hbl.h" ++ ++#define AuDirren_NHASH 100 ++ ++#ifdef CONFIG_AUFS_DIRREN ++enum au_brid_type { ++ AuBrid_Unset, ++ AuBrid_UUID, ++ AuBrid_FSID, ++ AuBrid_DEV ++}; ++ ++struct au_dr_brid { ++ enum au_brid_type type; ++ union { ++ uuid_t uuid; /* unimplemented yet */ ++ fsid_t fsid; ++ dev_t dev; ++ }; ++}; ++ ++/* 20 is the max digits length of ulong 64 */ ++/* brid-type "_" uuid "_" inum */ ++#define AUFS_DIRREN_FNAME_SZ (1 + 1 + UUID_STRING_LEN + 20) ++#define AUFS_DIRREN_ENV_VAL_SZ (AUFS_DIRREN_FNAME_SZ + 1 + 20) ++ ++struct au_dr_hino { ++ struct hlist_bl_node dr_hnode; ++ ino_t dr_h_ino; ++}; ++ ++struct au_dr_br { ++ struct hlist_bl_head dr_h_ino[AuDirren_NHASH]; ++ struct au_dr_brid dr_brid; ++}; ++ ++struct au_dr_lookup { ++ /* dr_name is pointed by struct au_do_lookup_args.name */ ++ struct qstr dr_name; /* subset of dr_info */ ++ aufs_bindex_t ninfo; ++ struct au_drinfo **drinfo; ++}; ++#else ++struct au_dr_hino; ++/* empty */ ++struct au_dr_br { }; ++struct au_dr_lookup { }; ++#endif ++ ++/* ---------------------------------------------------------------------- */ ++ ++struct au_branch; ++struct au_do_lookup_args; ++struct au_hinode; ++#ifdef CONFIG_AUFS_DIRREN ++int au_dr_hino_test_add(struct au_dr_br *dr, ino_t h_ino, ++ struct au_dr_hino *add_ent); ++void au_dr_hino_free(struct au_dr_br *dr); ++int au_dr_br_init(struct super_block *sb, struct au_branch *br, ++ const struct path *path); ++int au_dr_br_fin(struct super_block *sb, struct au_branch *br); ++int au_dr_rename(struct dentry *src, aufs_bindex_t bindex, ++ struct qstr *dst_name, void *_rev); ++void au_dr_rename_fin(struct dentry *src, aufs_bindex_t btgt, void *rev); ++void au_dr_rename_rev(struct dentry *src, aufs_bindex_t bindex, void *rev); ++int au_dr_lkup(struct au_do_lookup_args *lkup, struct dentry *dentry, ++ aufs_bindex_t bindex); ++int au_dr_lkup_name(struct au_do_lookup_args *lkup, aufs_bindex_t btgt); ++int au_dr_lkup_h_ino(struct au_do_lookup_args *lkup, aufs_bindex_t bindex, ++ ino_t h_ino); ++void au_dr_lkup_fin(struct au_do_lookup_args *lkup); ++int au_dr_opt_set(struct super_block *sb); ++int au_dr_opt_flush(struct super_block *sb); ++int au_dr_opt_clr(struct super_block *sb, int no_flush); ++#else ++AuStubInt0(au_dr_hino_test_add, struct au_dr_br *dr, ino_t h_ino, ++ struct au_dr_hino *add_ent); ++AuStubVoid(au_dr_hino_free, struct au_dr_br *dr); ++AuStubInt0(au_dr_br_init, struct super_block *sb, struct au_branch *br, ++ const struct path *path); ++AuStubInt0(au_dr_br_fin, struct super_block *sb, struct au_branch *br); ++AuStubInt0(au_dr_rename, struct dentry *src, aufs_bindex_t bindex, ++ struct qstr *dst_name, void *_rev); ++AuStubVoid(au_dr_rename_fin, struct dentry *src, aufs_bindex_t btgt, void *rev); ++AuStubVoid(au_dr_rename_rev, struct dentry *src, aufs_bindex_t bindex, ++ void *rev); ++AuStubInt0(au_dr_lkup, struct au_do_lookup_args *lkup, struct dentry *dentry, ++ aufs_bindex_t bindex); ++AuStubInt0(au_dr_lkup_name, struct au_do_lookup_args *lkup, aufs_bindex_t btgt); ++AuStubInt0(au_dr_lkup_h_ino, struct au_do_lookup_args *lkup, ++ aufs_bindex_t bindex, ino_t h_ino); ++AuStubVoid(au_dr_lkup_fin, struct au_do_lookup_args *lkup); ++AuStubInt0(au_dr_opt_set, struct super_block *sb); ++AuStubInt0(au_dr_opt_flush, struct super_block *sb); ++AuStubInt0(au_dr_opt_clr, struct super_block *sb, int no_flush); ++#endif ++ ++/* ---------------------------------------------------------------------- */ ++ ++#ifdef CONFIG_AUFS_DIRREN ++static inline int au_dr_ihash(ino_t h_ino) ++{ ++ return h_ino % AuDirren_NHASH; ++} ++#else ++AuStubInt0(au_dr_ihash, ino_t h_ino); ++#endif ++ ++#endif /* __KERNEL__ */ ++#endif /* __AUFS_DIRREN_H__ */ diff --git a/fs/aufs/dynop.c b/fs/aufs/dynop.c new file mode 100644 -index 0000000..917bbd3 +index 0000000..72fd326 --- /dev/null +++ b/fs/aufs/dynop.c @@ -0,0 +1,369 @@ @@ -9878,23 +11629,23 @@ index 0000000..917bbd3 + * How large will these lists be? + * Usually just a few elements, 20-30 at most for each, I guess. + */ -+static struct au_sphlhead dynop[AuDyLast]; ++static struct hlist_bl_head dynop[AuDyLast]; + -+static struct au_dykey *dy_gfind_get(struct au_sphlhead *sphl, const void *h_op) ++static struct au_dykey *dy_gfind_get(struct hlist_bl_head *hbl, ++ const void *h_op) +{ + struct au_dykey *key, *tmp; -+ struct hlist_head *head; ++ struct hlist_bl_node *pos; + + key = NULL; -+ head = &sphl->head; -+ rcu_read_lock(); -+ hlist_for_each_entry_rcu(tmp, head, dk_hnode) ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(tmp, pos, hbl, dk_hnode) + if (tmp->dk_op.dy_hop == h_op) { + key = tmp; + kref_get(&key->dk_kref); + break; + } -+ rcu_read_unlock(); ++ hlist_bl_unlock(hbl); + + return key; +} @@ -9935,24 +11686,23 @@ index 0000000..917bbd3 +} + +/* kref_get() if @key is already added */ -+static struct au_dykey *dy_gadd(struct au_sphlhead *sphl, struct au_dykey *key) ++static struct au_dykey *dy_gadd(struct hlist_bl_head *hbl, struct au_dykey *key) +{ + struct au_dykey *tmp, *found; -+ struct hlist_head *head; ++ struct hlist_bl_node *pos; + const void *h_op = key->dk_op.dy_hop; + + found = NULL; -+ head = &sphl->head; -+ spin_lock(&sphl->spin); -+ hlist_for_each_entry(tmp, head, dk_hnode) ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(tmp, pos, hbl, dk_hnode) + if (tmp->dk_op.dy_hop == h_op) { + kref_get(&tmp->dk_kref); + found = tmp; + break; + } + if (!found) -+ hlist_add_head_rcu(&key->dk_hnode, head); -+ spin_unlock(&sphl->spin); ++ hlist_bl_add_head(&key->dk_hnode, hbl); ++ hlist_bl_unlock(hbl); + + if (!found) + DyPrSym(key); @@ -9971,11 +11721,11 @@ index 0000000..917bbd3 +static void dy_free(struct kref *kref) +{ + struct au_dykey *key; -+ struct au_sphlhead *sphl; ++ struct hlist_bl_head *hbl; + + key = container_of(kref, struct au_dykey, dk_kref); -+ sphl = dynop + key->dk_op.dy_type; -+ au_sphl_del_rcu(&key->dk_hnode, sphl); ++ hbl = dynop + key->dk_op.dy_type; ++ au_hbl_del(&key->dk_hnode, hbl); + call_rcu(&key->dk_rcu, dy_free_rcu); +} + @@ -10040,6 +11790,8 @@ index 0000000..917bbd3 + /* this one will be changed according to an aufs mount option */ + DySetAop(direct_IO); + DySetAop(migratepage); ++ DySetAop(isolate_page); ++ DySetAop(putback_page); + DySetAop(launder_page); + DySetAop(is_partially_uptodate); + DySetAop(is_dirty_writeback); @@ -10060,7 +11812,7 @@ index 0000000..917bbd3 +static struct au_dykey *dy_get(struct au_dynop *op, struct au_branch *br) +{ + struct au_dykey *key, *old; -+ struct au_sphlhead *sphl; ++ struct hlist_bl_head *hbl; + struct op { + unsigned int sz; + void (*set)(struct au_dykey *key, const void *h_op, @@ -10074,8 +11826,8 @@ index 0000000..917bbd3 + }; + const struct op *p; + -+ sphl = dynop + op->dy_type; -+ key = dy_gfind_get(sphl, op->dy_hop); ++ hbl = dynop + op->dy_type; ++ key = dy_gfind_get(hbl, op->dy_hop); + if (key) + goto out_add; /* success */ + @@ -10089,7 +11841,7 @@ index 0000000..917bbd3 + key->dk_op.dy_hop = op->dy_hop; + kref_init(&key->dk_kref); + p->set(key, op->dy_hop, au_br_sb(br)); -+ old = dy_gadd(sphl, key); ++ old = dy_gadd(hbl, key); + if (old) { + kfree(key); + key = old; @@ -10186,16 +11938,15 @@ index 0000000..917bbd3 + +void au_dy_arefresh(int do_dx) +{ -+ struct au_sphlhead *sphl; -+ struct hlist_head *head; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; + struct au_dykey *key; + -+ sphl = dynop + AuDy_AOP; -+ head = &sphl->head; -+ spin_lock(&sphl->spin); -+ hlist_for_each_entry(key, head, dk_hnode) ++ hbl = dynop + AuDy_AOP; ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(key, pos, hbl, dk_hnode) + dy_adx((void *)key, do_dx); -+ spin_unlock(&sphl->spin); ++ hlist_bl_unlock(hbl); +} + +/* ---------------------------------------------------------------------- */ @@ -10208,7 +11959,7 @@ index 0000000..917bbd3 + BUILD_BUG_ON(offsetof(struct au_dyaop, da_key)); + + for (i = 0; i < AuDyLast; i++) -+ au_sphl_init(dynop + i); ++ INIT_HLIST_BL_HEAD(dynop + i); +} + +void au_dy_fin(void) @@ -10216,11 +11967,11 @@ index 0000000..917bbd3 + int i; + + for (i = 0; i < AuDyLast; i++) -+ WARN_ON(!hlist_empty(&dynop[i].head)); ++ WARN_ON(!hlist_bl_empty(dynop + i)); +} diff --git a/fs/aufs/dynop.h b/fs/aufs/dynop.h new file mode 100644 -index 0000000..c19c675 +index 0000000..e379dd1 --- /dev/null +++ b/fs/aufs/dynop.h @@ -0,0 +1,74 @@ @@ -10265,7 +12016,7 @@ index 0000000..c19c675 + +struct au_dykey { + union { -+ struct hlist_node dk_hnode; ++ struct hlist_bl_node dk_hnode; + struct rcu_head dk_rcu; + }; + struct au_dynop dk_op; @@ -10300,10 +12051,10 @@ index 0000000..c19c675 +#endif /* __AUFS_DYNOP_H__ */ diff --git a/fs/aufs/export.c b/fs/aufs/export.c new file mode 100644 -index 0000000..4b44838 +index 0000000..34b391c --- /dev/null +++ b/fs/aufs/export.c -@@ -0,0 +1,838 @@ +@@ -0,0 +1,836 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -10711,9 +12462,7 @@ index 0000000..4b44838 + + /* do not call vfsub_lkup_one() */ + dir = d_inode(parent); -+ mutex_lock(&dir->i_mutex); -+ dentry = vfsub_lookup_one_len(arg.name, parent, arg.namelen); -+ mutex_unlock(&dir->i_mutex); ++ dentry = vfsub_lookup_one_len_unlocked(arg.name, parent, arg.namelen); + AuTraceErrPtr(dentry); + if (IS_ERR(dentry)) + goto out_name; @@ -11144,10 +12893,10 @@ index 0000000..4b44838 +} diff --git a/fs/aufs/f_op.c b/fs/aufs/f_op.c new file mode 100644 -index 0000000..c01ceb0 +index 0000000..535ba56 --- /dev/null +++ b/fs/aufs/f_op.c -@@ -0,0 +1,772 @@ +@@ -0,0 +1,817 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -11251,8 +13000,8 @@ index 0000000..c01ceb0 + aufs_bindex_t bindex; + + finfo = au_fi(file); -+ au_sphl_del(&finfo->fi_hlist, -+ &au_sbi(file->f_path.dentry->d_sb)->si_files); ++ au_hbl_del(&finfo->fi_hlist, ++ &au_sbi(file->f_path.dentry->d_sb)->si_files); + bindex = finfo->fi_btop; + if (bindex >= 0) + au_set_h_fptr(file, bindex, NULL); @@ -11290,12 +13039,12 @@ index 0000000..c01ceb0 + */ + +/* Callers should call au_read_post() or fput() in the end */ -+struct file *au_read_pre(struct file *file, int keep_fi) ++struct file *au_read_pre(struct file *file, int keep_fi, unsigned int lsc) +{ + struct file *h_file; + int err; + -+ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0); ++ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/0, lsc); + if (!err) { + di_read_unlock(file->f_path.dentry, AuLock_IR); + h_file = au_hf_top(file); @@ -11316,6 +13065,10 @@ index 0000000..c01ceb0 +} + +struct au_write_pre { ++ /* input */ ++ unsigned int lsc; ++ ++ /* output */ + blkcnt_t blks; + aufs_bindex_t btop; +}; @@ -11331,9 +13084,13 @@ index 0000000..c01ceb0 + struct file *h_file; + struct dentry *dentry; + int err; ++ unsigned int lsc; + struct au_pin pin; + -+ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1); ++ lsc = 0; ++ if (wpre) ++ lsc = wpre->lsc; ++ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1, lsc); + h_file = ERR_PTR(err); + if (unlikely(err)) + goto out; @@ -11394,7 +13151,7 @@ index 0000000..c01ceb0 + sb = inode->i_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/0); ++ h_file = au_read_pre(file, /*keep_fi*/0, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -11422,11 +13179,11 @@ index 0000000..c01ceb0 + struct super_block *sb = inode->i_sb; + + while (1) { -+ mutex_lock(&inode->i_mutex); ++ inode_lock(inode); + err = si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLM); + if (!err) + break; -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + si_read_lock(sb, AuLock_NOPLMW); + si_read_unlock(sb); + } @@ -11444,6 +13201,7 @@ index 0000000..c01ceb0 + inode = file_inode(file); + au_mtx_and_read_lock(inode); + ++ wpre.lsc = 0; + h_file = au_write_pre(file, /*do_ready*/1, &wpre); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) @@ -11454,7 +13212,7 @@ index 0000000..c01ceb0 + +out: + si_read_unlock(inode->i_sb); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + return err; +} + @@ -11503,7 +13261,7 @@ index 0000000..c01ceb0 + sb = inode->i_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/1); ++ h_file = au_read_pre(file, /*keep_fi*/1, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -11538,6 +13296,7 @@ index 0000000..c01ceb0 + inode = file_inode(file); + au_mtx_and_read_lock(inode); + ++ wpre.lsc = 0; + h_file = au_write_pre(file, /*do_ready*/1, &wpre); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) @@ -11548,7 +13307,7 @@ index 0000000..c01ceb0 + +out: + si_read_unlock(inode->i_sb); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + return err; +} + @@ -11565,7 +13324,7 @@ index 0000000..c01ceb0 + sb = inode->i_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/0); ++ h_file = au_read_pre(file, /*keep_fi*/0, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -11592,6 +13351,7 @@ index 0000000..c01ceb0 + inode = file_inode(file); + au_mtx_and_read_lock(inode); + ++ wpre.lsc = 0; + h_file = au_write_pre(file, /*do_ready*/1, &wpre); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) @@ -11602,7 +13362,7 @@ index 0000000..c01ceb0 + +out: + si_read_unlock(inode->i_sb); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + return err; +} + @@ -11617,6 +13377,7 @@ index 0000000..c01ceb0 + inode = file_inode(file); + au_mtx_and_read_lock(inode); + ++ wpre.lsc = 0; + h_file = au_write_pre(file, /*do_ready*/1, &wpre); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) @@ -11629,10 +13390,92 @@ index 0000000..c01ceb0 + +out: + si_read_unlock(inode->i_sb); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + return err; +} + ++static ssize_t aufs_copy_file_range(struct file *src, loff_t src_pos, ++ struct file *dst, loff_t dst_pos, ++ size_t len, unsigned int flags) ++{ ++ ssize_t err; ++ struct au_write_pre wpre; ++ enum { SRC, DST }; ++ struct { ++ struct inode *inode; ++ struct file *h_file; ++ struct super_block *h_sb; ++ } a[2]; ++#define a_src a[SRC] ++#define a_dst a[DST] ++ ++ err = -EINVAL; ++ a_src.inode = file_inode(src); ++ if (unlikely(!S_ISREG(a_src.inode->i_mode))) ++ goto out; ++ a_dst.inode = file_inode(dst); ++ if (unlikely(!S_ISREG(a_dst.inode->i_mode))) ++ goto out; ++ ++ au_mtx_and_read_lock(a_dst.inode); ++ /* ++ * in order to match the order in di_write_lock2_{child,parent}(), ++ * use f_path.dentry for this comparision. ++ */ ++ if (src->f_path.dentry < dst->f_path.dentry) { ++ a_src.h_file = au_read_pre(src, /*keep_fi*/1, AuLsc_FI_1); ++ err = PTR_ERR(a_src.h_file); ++ if (IS_ERR(a_src.h_file)) ++ goto out_si; ++ ++ wpre.lsc = AuLsc_FI_2; ++ a_dst.h_file = au_write_pre(dst, /*do_ready*/1, &wpre); ++ err = PTR_ERR(a_dst.h_file); ++ if (IS_ERR(a_dst.h_file)) { ++ au_read_post(a_src.inode, a_src.h_file); ++ goto out_si; ++ } ++ } else { ++ wpre.lsc = AuLsc_FI_1; ++ a_dst.h_file = au_write_pre(dst, /*do_ready*/1, &wpre); ++ err = PTR_ERR(a_dst.h_file); ++ if (IS_ERR(a_dst.h_file)) ++ goto out_si; ++ ++ a_src.h_file = au_read_pre(src, /*keep_fi*/1, AuLsc_FI_2); ++ err = PTR_ERR(a_src.h_file); ++ if (IS_ERR(a_src.h_file)) { ++ au_write_post(a_dst.inode, a_dst.h_file, &wpre, ++ /*written*/0); ++ goto out_si; ++ } ++ } ++ ++ err = -EXDEV; ++ a_src.h_sb = file_inode(a_src.h_file)->i_sb; ++ a_dst.h_sb = file_inode(a_dst.h_file)->i_sb; ++ if (unlikely(a_src.h_sb != a_dst.h_sb)) { ++ AuDbgFile(src); ++ AuDbgFile(dst); ++ goto out_file; ++ } ++ ++ err = vfsub_copy_file_range(a_src.h_file, src_pos, a_dst.h_file, ++ dst_pos, len, flags); ++ ++out_file: ++ au_write_post(a_dst.inode, a_dst.h_file, &wpre, err); ++ fi_read_unlock(src); ++ au_read_post(a_src.inode, a_src.h_file); ++out_si: ++ si_read_unlock(a_dst.inode->i_sb); ++ inode_unlock(a_dst.inode); ++out: ++ return err; ++#undef a_src ++#undef a_dst ++} ++ +/* ---------------------------------------------------------------------- */ + +/* @@ -11723,7 +13566,7 @@ index 0000000..c01ceb0 + * au_flag_conv(vma->vm_flags)); + */ + if (!err) -+ err = h_file->f_op->mmap(h_file, vma); ++ err = call_mmap(h_file, vma); + if (!err) { + au_vm_prfile_set(vma, file); + fsstack_copy_attr_atime(inode, file_inode(h_file)); @@ -11762,6 +13605,7 @@ index 0000000..c01ceb0 + inode = file_inode(file); + au_mtx_and_read_lock(inode); + ++ wpre.lsc = 0; + h_file = au_write_pre(file, /*do_ready*/1, &wpre); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) @@ -11772,61 +13616,11 @@ index 0000000..c01ceb0 + +out_unlock: + si_read_unlock(inode->i_sb); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); +out: + return err; +} + -+/* no one supports this operation, currently */ -+#if 0 -+static int aufs_aio_fsync_nondir(struct kiocb *kio, int datasync) -+{ -+ int err; -+ struct au_write_pre wpre; -+ struct inode *inode; -+ struct file *file, *h_file; -+ -+ err = 0; /* -EBADF; */ /* posix? */ -+ if (unlikely(!(file->f_mode & FMODE_WRITE))) -+ goto out; -+ -+ file = kio->ki_filp; -+ inode = file_inode(file); -+ au_mtx_and_read_lock(inode); -+ -+ h_file = au_write_pre(file, /*do_ready*/1, &wpre); -+ err = PTR_ERR(h_file); -+ if (IS_ERR(h_file)) -+ goto out_unlock; -+ -+ err = -ENOSYS; -+ h_file = au_hf_top(file); -+ if (h_file->f_op->aio_fsync) { -+ struct mutex *h_mtx; -+ -+ h_mtx = &file_inode(h_file)->i_mutex; -+ if (!is_sync_kiocb(kio)) { -+ get_file(h_file); -+ fput(file); -+ } -+ kio->ki_filp = h_file; -+ err = h_file->f_op->aio_fsync(kio, datasync); -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD); -+ if (!err) -+ vfsub_update_h_iattr(&h_file->f_path, /*did*/NULL); -+ /*ignore*/ -+ mutex_unlock(h_mtx); -+ } -+ au_write_post(inode, h_file, &wpre, /*written*/0); -+ -+out_unlock: -+ si_read_unlock(inode->sb); -+ mutex_unlock(&inode->i_mutex); -+out: -+ return err; -+} -+#endif -+ +static int aufs_fasync(int fd, struct file *file, int flag) +{ + int err; @@ -11836,7 +13630,7 @@ index 0000000..c01ceb0 + sb = file->f_path.dentry->d_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/0); ++ h_file = au_read_pre(file, /*keep_fi*/0, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -11859,7 +13653,7 @@ index 0000000..c01ceb0 + sb = file->f_path.dentry->d_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/0); ++ h_file = au_read_pre(file, /*keep_fi*/0, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -11908,7 +13702,6 @@ index 0000000..c01ceb0 + .flush = aufs_flush_nondir, + .release = aufs_release_nondir, + .fsync = aufs_fsync_nondir, -+ /* .aio_fsync = aufs_aio_fsync_nondir, */ + .fasync = aufs_fasync, + /* .sendpage = aufs_sendpage, */ + .setfl = aufs_setfl, @@ -11918,7 +13711,8 @@ index 0000000..c01ceb0 + .aio_splice_write = aufs_aio_splice_write, + .aio_splice_read = aufs_aio_splice_read, +#endif -+ .fallocate = aufs_fallocate ++ .fallocate = aufs_fallocate, ++ .copy_file_range = aufs_copy_file_range +}; diff --git a/fs/aufs/fhsm.c b/fs/aufs/fhsm.c new file mode 100644 @@ -12354,10 +14148,10 @@ index 0000000..ef6f99e +} diff --git a/fs/aufs/file.c b/fs/aufs/file.c new file mode 100644 -index 0000000..000cf06 +index 0000000..26f8701 --- /dev/null +++ b/fs/aufs/file.c -@@ -0,0 +1,837 @@ +@@ -0,0 +1,856 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -12468,7 +14262,7 @@ index 0000000..000cf06 + +static int au_cmoo(struct dentry *dentry) +{ -+ int err, cmoo; ++ int err, cmoo, matched; + unsigned int udba; + struct path h_path; + struct au_pin pin; @@ -12503,9 +14297,12 @@ index 0000000..000cf06 + sbinfo = au_sbi(sb); + fhsm = &sbinfo->si_fhsm; + pid = au_fhsm_pid(fhsm); -+ if (pid -+ && (current->pid == pid -+ || current->real_parent->pid == pid)) ++ rcu_read_lock(); ++ matched = (pid ++ && (current->pid == pid ++ || rcu_dereference(current->real_parent)->pid == pid)); ++ rcu_read_unlock(); ++ if (matched) + goto out; + + br = au_sbr(sb, cpg.bsrc); @@ -12601,15 +14398,22 @@ index 0000000..000cf06 + di_write_lock_child(dentry); + err = au_cmoo(dentry); + di_downgrade_lock(dentry, AuLock_IR); -+ if (!err) -+ err = args->open(file, vfsub_file_flags(file), NULL); ++ if (!err) { ++ if (!aopen) ++ err = args->open(file, vfsub_file_flags(file), NULL); ++ else { ++ lockdep_off(); ++ err = args->open(file, vfsub_file_flags(file), NULL); ++ lockdep_on(); ++ } ++ } + di_read_unlock(dentry, AuLock_IR); + + finfo = au_fi(file); + if (!err) { + finfo->fi_file = file; -+ au_sphl_add(&finfo->fi_hlist, -+ &au_sbi(file->f_path.dentry->d_sb)->si_files); ++ au_hbl_add(&finfo->fi_hlist, ++ &au_sbi(file->f_path.dentry->d_sb)->si_files); + } + if (!aopen) + fi_write_unlock(file); @@ -12624,6 +14428,7 @@ index 0000000..000cf06 + } + +out: ++ AuTraceErr(err); + return err; +} + @@ -13065,7 +14870,7 @@ index 0000000..000cf06 + +/* common function to regular file and dir */ +int au_reval_and_lock_fdi(struct file *file, int (*reopen)(struct file *file), -+ int wlock) ++ int wlock, unsigned int fi_lsc) +{ + int err; + unsigned int sigen, figen; @@ -13078,9 +14883,12 @@ index 0000000..000cf06 + dentry = file->f_path.dentry; + inode = d_inode(dentry); + sigen = au_sigen(dentry->d_sb); -+ fi_write_lock(file); ++ fi_write_lock_nested(file, fi_lsc); + figen = au_figen(file); -+ di_write_lock_child(dentry); ++ if (!fi_lsc) ++ di_write_lock_child(dentry); ++ else ++ di_write_lock_child2(dentry); + btop = au_dbtop(dentry); + pseudo_link = (btop != au_ibtop(inode)); + if (sigen == figen && !pseudo_link && au_fbtop(file) == btop) { @@ -13124,8 +14932,7 @@ index 0000000..000cf06 +} + +/* it will never be called, but necessary to support O_DIRECT */ -+static ssize_t aufs_direct_IO(struct kiocb *iocb, struct iov_iter *iter, -+ loff_t offset) ++static ssize_t aufs_direct_IO(struct kiocb *iocb, struct iov_iter *iter) +{ BUG(); return 0; } + +/* they will never be called. */ @@ -13153,6 +14960,10 @@ index 0000000..000cf06 + struct page *page, enum migrate_mode mode) +{ AuUnsupport(); return 0; } +#endif ++static bool aufs_isolate_page(struct page *page, isolate_mode_t mode) ++{ AuUnsupport(); return true; } ++static void aufs_putback_page(struct page *page) ++{ AuUnsupport(); } +static int aufs_launder_page(struct page *page) +{ AuUnsupport(); return 0; } +static int aufs_is_partially_uptodate(struct page *page, @@ -13187,6 +14998,8 @@ index 0000000..000cf06 + .releasepage = aufs_releasepage, + /* is fallback_migrate_page ok? */ + /* .migratepage = aufs_migratepage, */ ++ .isolate_page = aufs_isolate_page, ++ .putback_page = aufs_putback_page, + .launder_page = aufs_launder_page, + .is_partially_uptodate = aufs_is_partially_uptodate, + .is_dirty_writeback = aufs_is_dirty_writeback, @@ -13197,10 +15010,10 @@ index 0000000..000cf06 +}; diff --git a/fs/aufs/file.h b/fs/aufs/file.h new file mode 100644 -index 0000000..71f58f0 +index 0000000..0a75f44 --- /dev/null +++ b/fs/aufs/file.h -@@ -0,0 +1,291 @@ +@@ -0,0 +1,340 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -13229,6 +15042,7 @@ index 0000000..71f58f0 + +#include +#include ++#include +#include +#include "rwsem.h" + @@ -13265,7 +15079,7 @@ index 0000000..71f58f0 + }; + struct au_fidir *fi_hdir; /* for dir only */ + -+ struct hlist_node fi_hlist; ++ struct hlist_bl_node fi_hlist; + struct file *fi_file; /* very ugly */ +} ____cacheline_aligned_in_smp; + @@ -13288,7 +15102,7 @@ index 0000000..71f58f0 +struct au_pin; +int au_ready_to_write(struct file *file, loff_t len, struct au_pin *pin); +int au_reval_and_lock_fdi(struct file *file, int (*reopen)(struct file *file), -+ int wlock); ++ int wlock, unsigned int fi_lsc); +int au_do_flush(struct file *file, fl_owner_t id, + int (*flush)(struct file *file, fl_owner_t id)); + @@ -13314,7 +15128,7 @@ index 0000000..71f58f0 +extern const struct file_operations aufs_file_fop; +int au_do_open_nondir(struct file *file, int flags, struct file *h_file); +int aufs_release_nondir(struct inode *inode __maybe_unused, struct file *file); -+struct file *au_read_pre(struct file *file, int keep_fi); ++struct file *au_read_pre(struct file *file, int keep_fi, unsigned int lsc); + +/* finfo.c */ +void au_hfput(struct au_hfile *hf, int execed); @@ -13347,11 +15161,59 @@ index 0000000..71f58f0 + +/* ---------------------------------------------------------------------- */ + ++#define fi_read_lock(f) au_rw_read_lock(&au_fi(f)->fi_rwsem) ++#define fi_write_lock(f) au_rw_write_lock(&au_fi(f)->fi_rwsem) ++#define fi_read_trylock(f) au_rw_read_trylock(&au_fi(f)->fi_rwsem) ++#define fi_write_trylock(f) au_rw_write_trylock(&au_fi(f)->fi_rwsem) ++/* ++#define fi_read_trylock_nested(f) \ ++ au_rw_read_trylock_nested(&au_fi(f)->fi_rwsem) ++#define fi_write_trylock_nested(f) \ ++ au_rw_write_trylock_nested(&au_fi(f)->fi_rwsem) ++*/ ++ ++#define fi_read_unlock(f) au_rw_read_unlock(&au_fi(f)->fi_rwsem) ++#define fi_write_unlock(f) au_rw_write_unlock(&au_fi(f)->fi_rwsem) ++#define fi_downgrade_lock(f) au_rw_dgrade_lock(&au_fi(f)->fi_rwsem) ++ ++/* lock subclass for finfo */ ++enum { ++ AuLsc_FI_1, ++ AuLsc_FI_2 ++}; ++ ++static inline void fi_read_lock_nested(struct file *f, unsigned int lsc) ++{ ++ au_rw_read_lock_nested(&au_fi(f)->fi_rwsem, lsc); ++} ++ ++static inline void fi_write_lock_nested(struct file *f, unsigned int lsc) ++{ ++ au_rw_write_lock_nested(&au_fi(f)->fi_rwsem, lsc); ++} ++ +/* -+ * fi_read_lock, fi_write_lock, -+ * fi_read_unlock, fi_write_unlock, fi_downgrade_lock ++ * fi_read_lock_1, fi_write_lock_1, ++ * fi_read_lock_2, fi_write_lock_2 + */ -+AuSimpleRwsemFuncs(fi, struct file *f, &au_fi(f)->fi_rwsem); ++#define AuReadLockFunc(name) \ ++static inline void fi_read_lock_##name(struct file *f) \ ++{ fi_read_lock_nested(f, AuLsc_FI_##name); } ++ ++#define AuWriteLockFunc(name) \ ++static inline void fi_write_lock_##name(struct file *f) \ ++{ fi_write_lock_nested(f, AuLsc_FI_##name); } ++ ++#define AuRWLockFuncs(name) \ ++ AuReadLockFunc(name) \ ++ AuWriteLockFunc(name) ++ ++AuRWLockFuncs(1); ++AuRWLockFuncs(2); ++ ++#undef AuReadLockFunc ++#undef AuWriteLockFunc ++#undef AuRWLockFuncs + +#define FiMustNoWaiters(f) AuRwMustNoWaiters(&au_fi(f)->fi_rwsem) +#define FiMustAnyLock(f) AuRwMustAnyLock(&au_fi(f)->fi_rwsem) @@ -14052,12 +15914,82 @@ index 0000000..4624f1e + +#endif /* __KERNEL__ */ +#endif /* __AUFS_FSTYPE_H__ */ +diff --git a/fs/aufs/hbl.h b/fs/aufs/hbl.h +new file mode 100644 +index 0000000..971f793 +--- /dev/null ++++ b/fs/aufs/hbl.h +@@ -0,0 +1,64 @@ ++/* ++ * Copyright (C) 2017 Junjiro R. Okajima ++ * ++ * This program, aufs is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License as published by ++ * the Free Software Foundation; either version 2 of the License, or ++ * (at your option) any later version. ++ * ++ * This program is distributed in the hope that it will be useful, ++ * but WITHOUT ANY WARRANTY; without even the implied warranty of ++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the ++ * GNU General Public License for more details. ++ * ++ * You should have received a copy of the GNU General Public License ++ * along with this program. If not, see . ++ */ ++ ++/* ++ * helpers for hlist_bl.h ++ */ ++ ++#ifndef __AUFS_HBL_H__ ++#define __AUFS_HBL_H__ ++ ++#ifdef __KERNEL__ ++ ++#include ++ ++static inline void au_hbl_add(struct hlist_bl_node *node, ++ struct hlist_bl_head *hbl) ++{ ++ hlist_bl_lock(hbl); ++ hlist_bl_add_head(node, hbl); ++ hlist_bl_unlock(hbl); ++} ++ ++static inline void au_hbl_del(struct hlist_bl_node *node, ++ struct hlist_bl_head *hbl) ++{ ++ hlist_bl_lock(hbl); ++ hlist_bl_del(node); ++ hlist_bl_unlock(hbl); ++} ++ ++#define au_hbl_for_each(pos, head) \ ++ for (pos = hlist_bl_first(head); \ ++ pos; \ ++ pos = pos->next) ++ ++static inline unsigned long au_hbl_count(struct hlist_bl_head *hbl) ++{ ++ unsigned long cnt; ++ struct hlist_bl_node *pos; ++ ++ cnt = 0; ++ hlist_bl_lock(hbl); ++ au_hbl_for_each(pos, hbl) ++ cnt++; ++ hlist_bl_unlock(hbl); ++ return cnt; ++} ++ ++#endif /* __KERNEL__ */ ++#endif /* __AUFS_HBL_H__ */ diff --git a/fs/aufs/hfsnotify.c b/fs/aufs/hfsnotify.c new file mode 100644 -index 0000000..49ba77d +index 0000000..e2a1647 --- /dev/null +++ b/fs/aufs/hfsnotify.c -@@ -0,0 +1,287 @@ +@@ -0,0 +1,289 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -14114,15 +16046,15 @@ index 0000000..49ba77d + AuDebugOn(!br->br_hfsn); + + mark = &hn->hn_mark; -+ fsnotify_init_mark(mark, au_hfsn_free_mark); ++ fsnotify_init_mark(mark, br->br_hfsn->hfsn_group); + mark->mask = AuHfsnMask; + /* + * by udba rename or rmdir, aufs assign a new inode to the known + * h_inode, so specify 1 to allow dups. + */ + lockdep_off(); -+ err = fsnotify_add_mark(mark, br->br_hfsn->hfsn_group, hinode->hi_inode, -+ /*mnt*/NULL, /*allow_dups*/1); ++ err = fsnotify_add_mark(mark, hinode->hi_inode, /*mnt*/NULL, ++ /*allow_dups*/1); + lockdep_on(); + + return err; @@ -14223,8 +16155,9 @@ index 0000000..49ba77d + struct inode *inode, + struct fsnotify_mark *inode_mark, + struct fsnotify_mark *vfsmount_mark, -+ u32 mask, void *data, int data_type, -+ const unsigned char *file_name, u32 cookie) ++ u32 mask, const void *data, int data_type, ++ const unsigned char *file_name, u32 cookie, ++ struct fsnotify_iter_info *iter_info) +{ + int err; + struct au_hnotify *hnotify; @@ -14263,7 +16196,8 @@ index 0000000..49ba77d + +static struct fsnotify_ops au_hfsn_ops = { + .handle_event = au_hfsn_handle_event, -+ .free_group_priv = au_hfsn_free_group ++ .free_group_priv = au_hfsn_free_group, ++ .free_mark = au_hfsn_free_mark +}; + +/* ---------------------------------------------------------------------- */ @@ -14409,10 +16343,10 @@ index 0000000..b5b6547 +} diff --git a/fs/aufs/hnotify.c b/fs/aufs/hnotify.c new file mode 100644 -index 0000000..63e9ddc +index 0000000..16ee231 --- /dev/null +++ b/fs/aufs/hnotify.c -@@ -0,0 +1,711 @@ +@@ -0,0 +1,719 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -14498,7 +16432,7 @@ index 0000000..63e9ddc + if (!hi) + continue; + -+ /* mutex_lock_nested(&hi->i_mutex, AuLsc_I_CHILD); */ ++ /* inode_lock_nested(hi, AuLsc_I_CHILD); */ + iwhdentry = au_hi_wh(inode, bindex); + if (iwhdentry) + dget(iwhdentry); @@ -14508,7 +16442,7 @@ index 0000000..63e9ddc + flags & ~AuHi_XINO); + iput(hi); + dput(iwhdentry); -+ /* mutex_unlock(&hi->i_mutex); */ ++ /* inode_unlock(hi); */ + } +} + @@ -14737,11 +16671,11 @@ index 0000000..63e9ddc + if (au_ftest_hnjob(a->flags, TRYXINO0) + && a->inode + && a->h_inode) { -+ mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD); ++ vfsub_inode_lock_shared_nested(a->h_inode, AuLsc_I_CHILD); + if (!a->h_inode->i_nlink + && !(a->h_inode->i_state & I_LINKABLE)) + hn_xino(a->inode, a->h_inode); /* ignore this error */ -+ mutex_unlock(&a->h_inode->i_mutex); ++ inode_unlock_shared(a->h_inode); + } + + /* make the generation obsolete */ @@ -14877,6 +16811,14 @@ index 0000000..63e9ddc + AuDebugOn(!sbinfo); + si_write_lock(sb, AuLock_NOPLMW); + ++ if (au_opt_test(sbinfo->si_mntflags, DIRREN)) ++ switch (a->mask & FS_EVENTS_POSS_ON_CHILD) { ++ case FS_MOVED_FROM: ++ case FS_MOVED_TO: ++ AuWarn1("DIRREN with UDBA may not work correctly " ++ "for the direct rename(2)\n"); ++ } ++ + ii_read_lock_parent(a->dir); + bfound = -1; + bbot = au_ibbot(a->dir); @@ -15126,10 +17068,10 @@ index 0000000..63e9ddc +} diff --git a/fs/aufs/i_op.c b/fs/aufs/i_op.c new file mode 100644 -index 0000000..e317098 +index 0000000..592d4d1 --- /dev/null +++ b/fs/aufs/i_op.c -@@ -0,0 +1,1531 @@ +@@ -0,0 +1,1459 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -15163,12 +17105,15 @@ index 0000000..e317098 + int err; + const unsigned char write_mask = !!(mask & (MAY_WRITE | MAY_APPEND)); + ++ err = -EPERM; ++ if (write_mask && IS_IMMUTABLE(h_inode)) ++ goto out; ++ + err = -EACCES; -+ if ((write_mask && IS_IMMUTABLE(h_inode)) -+ || ((mask & MAY_EXEC) -+ && S_ISREG(h_inode->i_mode) -+ && (path_noexec(h_path) -+ || !(h_inode->i_mode & S_IXUGO)))) ++ if (((mask & MAY_EXEC) ++ && S_ISREG(h_inode->i_mode) ++ && (path_noexec(h_path) ++ || !(h_inode->i_mode & S_IXUGO)))) + goto out; + + /* @@ -15381,13 +17326,14 @@ index 0000000..e317098 +/* ---------------------------------------------------------------------- */ + +struct aopen_node { -+ struct hlist_node hlist; ++ struct hlist_bl_node hblist; + struct file *file, *h_file; +}; + +static int au_do_aopen(struct inode *inode, struct file *file) +{ -+ struct au_sphlhead *aopen; ++ struct hlist_bl_head *aopen; ++ struct hlist_bl_node *pos; + struct aopen_node *node; + struct au_do_open_args args = { + .aopen = 1, @@ -15395,13 +17341,13 @@ index 0000000..e317098 + }; + + aopen = &au_sbi(inode->i_sb)->si_aopen; -+ spin_lock(&aopen->spin); -+ hlist_for_each_entry(node, &aopen->head, hlist) ++ hlist_bl_lock(aopen); ++ hlist_bl_for_each_entry(node, pos, aopen, hblist) + if (node->file == file) { + args.h_file = node->h_file; + break; + } -+ spin_unlock(&aopen->spin); ++ hlist_bl_unlock(aopen); + /* AuDebugOn(!args.h_file); */ + + return au_do_open(file, &args); @@ -15414,7 +17360,7 @@ index 0000000..e317098 + int err, unlocked, h_opened = *opened; + unsigned int lkup_flags; + struct dentry *parent, *d; -+ struct au_sphlhead *aopen; ++ struct hlist_bl_head *aopen; + struct vfsub_aopen_args args = { + .open_flag = open_flag, + .create_mode = create_mode, @@ -15500,9 +17446,9 @@ index 0000000..e317098 + args.file = NULL; + } + aopen = &au_sbi(dir->i_sb)->si_aopen; -+ au_sphl_add(&aopen_node.hlist, aopen); ++ au_hbl_add(&aopen_node.hblist, aopen); + err = finish_open(file, dentry, au_do_aopen, opened); -+ au_sphl_del(&aopen_node.hlist, aopen); ++ au_hbl_del(&aopen_node.hblist, aopen); + AuTraceErr(err); + AuDbgFile(file); + if (aopen_node.h_file) @@ -15560,10 +17506,10 @@ index 0000000..e317098 + if (!err && add_entry && !au_ftest_wrdir(add_entry, TMPFILE)) { + h_parent = au_h_dptr(parent, bcpup); + h_dir = d_inode(h_parent); -+ mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT); ++ vfsub_inode_lock_shared_nested(h_dir, AuLsc_I_PARENT); + err = au_lkup_neg(dentry, bcpup, /*wh*/0); + /* todo: no unlock here */ -+ mutex_unlock(&h_dir->i_mutex); ++ inode_unlock_shared(h_dir); + + AuDbg("bcpup %d\n", bcpup); + if (!err) { @@ -15666,7 +17612,7 @@ index 0000000..e317098 +void au_pin_hdir_unlock(struct au_pin *p) +{ + if (p->hdir) -+ au_hn_imtx_unlock(p->hdir); ++ au_hn_inode_unlock(p->hdir); +} + +int au_pin_hdir_lock(struct au_pin *p) @@ -15678,7 +17624,7 @@ index 0000000..e317098 + goto out; + + /* even if an error happens later, keep this lock */ -+ au_hn_imtx_lock_nested(p->hdir, p->lsc_hi); ++ au_hn_inode_lock_nested(p->hdir, p->lsc_hi); + + err = -EBUSY; + if (unlikely(p->hdir->hi_inode != d_inode(p->h_parent))) @@ -15719,17 +17665,17 @@ index 0000000..e317098 + return err; +} + -+void au_pin_hdir_set_owner(struct au_pin *p, struct task_struct *task) ++static void au_pin_hdir_set_owner(struct au_pin *p, struct task_struct *task) +{ -+#if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP) -+ p->hdir->hi_inode->i_mutex.owner = task; ++#if !defined(CONFIG_RWSEM_GENERIC_SPINLOCK) && defined(CONFIG_RWSEM_SPIN_ON_OWNER) ++ p->hdir->hi_inode->i_rwsem.owner = task; +#endif +} + +void au_pin_hdir_acquire_nest(struct au_pin *p) +{ + if (p->hdir) { -+ mutex_acquire_nest(&p->hdir->hi_inode->i_mutex.dep_map, ++ rwsem_acquire_nest(&p->hdir->hi_inode->i_rwsem.dep_map, + p->lsc_hi, 0, NULL, _RET_IP_); + au_pin_hdir_set_owner(p, current); + } @@ -15739,7 +17685,7 @@ index 0000000..e317098 +{ + if (p->hdir) { + au_pin_hdir_set_owner(p, p->task); -+ mutex_release(&p->hdir->hi_inode->i_mutex.dep_map, 1, _RET_IP_); ++ rwsem_release(&p->hdir->hi_inode->i_rwsem.dep_map, 1, _RET_IP_); + } +} + @@ -15947,10 +17893,10 @@ index 0000000..e317098 + a->h_path.dentry = au_h_dptr(dentry, btop); + a->h_inode = d_inode(a->h_path.dentry); + if (ia && (ia->ia_valid & ATTR_SIZE)) { -+ mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD); ++ vfsub_inode_lock_shared_nested(a->h_inode, AuLsc_I_CHILD); + if (ia->ia_size < i_size_read(a->h_inode)) + sz = ia->ia_size; -+ mutex_unlock(&a->h_inode->i_mutex); ++ inode_unlock_shared(a->h_inode); + } + + hi_wh = NULL; @@ -16010,7 +17956,7 @@ index 0000000..e317098 + } +out: + if (!err) -+ mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD); ++ inode_lock_nested(a->h_inode, AuLsc_I_CHILD); + return err; +} + @@ -16025,6 +17971,10 @@ index 0000000..e317098 + inode = d_inode(dentry); + IMustLock(inode); + ++ err = setattr_prepare(dentry, ia); ++ if (unlikely(err)) ++ goto out; ++ + err = -ENOMEM; + a = kzalloc(sizeof(*a), GFP_NOFS); + if (unlikely(!a)) @@ -16043,7 +17993,8 @@ index 0000000..e317098 + /* currently ftruncate(2) only */ + AuDebugOn(!d_is_reg(dentry)); + file = ia->ia_file; -+ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1); ++ err = au_reval_and_lock_fdi(file, au_reopen_nondir, /*wlock*/1, ++ /*fi_lsc*/0); + if (unlikely(err)) + goto out_si; + ia->ia_file = au_hf_top(file); @@ -16094,9 +18045,9 @@ index 0000000..e317098 + f = NULL; + if (ia->ia_valid & ATTR_FILE) + f = ia->ia_file; -+ mutex_unlock(&a->h_inode->i_mutex); ++ inode_unlock(a->h_inode); + err = vfsub_trunc(&a->h_path, ia->ia_size, ia->ia_valid, f); -+ mutex_lock_nested(&a->h_inode->i_mutex, AuLsc_I_CHILD); ++ inode_lock_nested(a->h_inode, AuLsc_I_CHILD); + } else { + delegated = NULL; + while (1) { @@ -16119,7 +18070,7 @@ index 0000000..e317098 + au_cpup_attr_changeable(inode); + +out_unlock: -+ mutex_unlock(&a->h_inode->i_mutex); ++ inode_unlock(a->h_inode); + au_unpin(&a->pin); + if (unlikely(err)) + au_update_dbtop(dentry); @@ -16168,15 +18119,15 @@ index 0000000..e317098 + return err; +} + -+ssize_t au_srxattr(struct dentry *dentry, struct au_srxattr *arg) ++ssize_t au_sxattr(struct dentry *dentry, struct inode *inode, ++ struct au_sxattr *arg) +{ + int err; + struct path h_path; + struct super_block *sb; + struct au_icpup_args *a; -+ struct inode *inode, *h_inode; ++ struct inode *h_inode; + -+ inode = d_inode(dentry); + IMustLock(inode); + + err = -ENOMEM; @@ -16195,20 +18146,19 @@ index 0000000..e317098 + if (unlikely(err)) + goto out_di; + -+ mutex_unlock(&a->h_inode->i_mutex); ++ inode_unlock(a->h_inode); + switch (arg->type) { + case AU_XATTR_SET: ++ AuDebugOn(d_is_negative(h_path.dentry)); + err = vfsub_setxattr(h_path.dentry, + arg->u.set.name, arg->u.set.value, + arg->u.set.size, arg->u.set.flags); + break; -+ case AU_XATTR_REMOVE: -+ err = vfsub_removexattr(h_path.dentry, arg->u.remove.name); -+ break; + case AU_ACL_SET: + err = -EOPNOTSUPP; + h_inode = d_inode(h_path.dentry); + if (h_inode->i_op->set_acl) ++ /* this will call posix_acl_update_mode */ + err = h_inode->i_op->set_acl(h_inode, + arg->u.acl_set.acl, + arg->u.acl_set.type); @@ -16262,7 +18212,7 @@ index 0000000..e317098 +} + +/* -+ * common routine for aufs_getattr() and aufs_getxattr(). ++ * common routine for aufs_getattr() and au_getxattr(). + * returns zero or negative (an error). + * @dentry will be read-locked in success. + */ @@ -16339,15 +18289,17 @@ index 0000000..e317098 + return err; +} + -+static int aufs_getattr(struct vfsmount *mnt __maybe_unused, -+ struct dentry *dentry, struct kstat *st) ++static int aufs_getattr(const struct path *path, struct kstat *st, ++ u32 request, unsigned int query) +{ + int err; + unsigned char positive; + struct path h_path; ++ struct dentry *dentry; + struct inode *inode; + struct super_block *sb; + ++ dentry = path->dentry; + inode = d_inode(dentry); + sb = dentry->d_sb; + err = si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLM); @@ -16362,7 +18314,8 @@ index 0000000..e317098 + + positive = d_is_positive(h_path.dentry); + if (positive) -+ err = vfs_getattr(&h_path, st); ++ /* no vfsub version */ ++ err = vfs_getattr(&h_path, st, request, query); + if (!err) { + if (positive) + au_refresh_iattr(inode, st, @@ -16385,62 +18338,20 @@ index 0000000..e317098 + +/* ---------------------------------------------------------------------- */ + -+/* -+ * Assumption: -+ * - the number of symlinks is not so many. -+ * -+ * Structure: -+ * - sbinfo (instead of iinfo) contains an hlist of struct au_symlink. -+ * If iinfo contained the hlist, then it would be rather large waste of memory -+ * I am afraid. -+ * - struct au_symlink contains the necessary info for h_inode follow_link() and -+ * put_link(). -+ */ -+ -+struct au_symlink { -+ union { -+ struct hlist_node hlist; -+ struct rcu_head rcu; -+ }; -+ -+ struct inode *h_inode; -+ void *h_cookie; -+}; -+ -+static void au_symlink_add(struct super_block *sb, struct au_symlink *slink, -+ struct inode *h_inode, void *cookie) -+{ -+ struct au_sbinfo *sbinfo; -+ -+ ihold(h_inode); -+ slink->h_inode = h_inode; -+ slink->h_cookie = cookie; -+ sbinfo = au_sbi(sb); -+ au_sphl_add(&slink->hlist, &sbinfo->si_symlink); -+} -+ -+static void au_symlink_del(struct super_block *sb, struct au_symlink *slink) -+{ -+ struct au_sbinfo *sbinfo; -+ -+ /* do not iput() within rcu */ -+ iput(slink->h_inode); -+ slink->h_inode = NULL; -+ sbinfo = au_sbi(sb); -+ au_sphl_del_rcu(&slink->hlist, &sbinfo->si_symlink); -+ kfree_rcu(slink, rcu); -+} -+ -+static const char *aufs_follow_link(struct dentry *dentry, void **cookie) ++static const char *aufs_get_link(struct dentry *dentry, struct inode *inode, ++ struct delayed_call *done) +{ + const char *ret; -+ struct inode *inode, *h_inode; + struct dentry *h_dentry; -+ struct au_symlink *slink; ++ struct inode *h_inode; + int err; + aufs_bindex_t bindex; + + ret = NULL; /* suppress a warning */ ++ err = -ECHILD; ++ if (!dentry) ++ goto out; ++ + err = aufs_read_lock(dentry, AuLock_IR | AuLock_GEN); + if (unlikely(err)) + goto out; @@ -16453,12 +18364,7 @@ index 0000000..e317098 + inode = d_inode(dentry); + bindex = au_ibtop(inode); + h_inode = au_h_iptr(inode, bindex); -+ if (unlikely(!h_inode->i_op->follow_link)) -+ goto out_unlock; -+ -+ err = -ENOMEM; -+ slink = kmalloc(sizeof(*slink), GFP_NOFS); -+ if (unlikely(!slink)) ++ if (unlikely(!h_inode->i_op->get_link)) + goto out_unlock; + + err = -EBUSY; @@ -16472,28 +18378,20 @@ index 0000000..e317098 + h_dentry = d_find_any_alias(h_inode); + if (IS_ERR(h_dentry)) { + err = PTR_ERR(h_dentry); -+ goto out_free; ++ goto out_unlock; + } + } + if (unlikely(!h_dentry)) -+ goto out_free; ++ goto out_unlock; + + err = 0; -+ AuDbg("%pf\n", h_inode->i_op->follow_link); ++ AuDbg("%pf\n", h_inode->i_op->get_link); + AuDbgDentry(h_dentry); -+ ret = h_inode->i_op->follow_link(h_dentry, cookie); ++ ret = vfs_get_link(h_dentry, done); + dput(h_dentry); ++ if (IS_ERR(ret)) ++ err = PTR_ERR(ret); + -+ if (!IS_ERR_OR_NULL(ret)) { -+ au_symlink_add(inode->i_sb, slink, h_inode, *cookie); -+ *cookie = slink; -+ AuDbg("slink %p\n", slink); -+ goto out_unlock; /* success */ -+ } -+ -+out_free: -+ slink->h_inode = NULL; -+ kfree_rcu(slink, rcu); +out_unlock: + aufs_read_unlock(dentry, AuLock_IR); +out: @@ -16503,21 +18401,6 @@ index 0000000..e317098 + return ret; +} + -+static void aufs_put_link(struct inode *inode, void *cookie) -+{ -+ struct au_symlink *slink; -+ struct inode *h_inode; -+ -+ slink = cookie; -+ AuDbg("slink %p\n", slink); -+ h_inode = slink->h_inode; -+ AuDbg("%pf\n", h_inode->i_op->put_link); -+ AuDbgInode(h_inode); -+ if (h_inode->i_op->put_link) -+ h_inode->i_op->put_link(h_inode, slink->h_cookie); -+ au_symlink_del(inode->i_sb, slink); -+} -+ +/* ---------------------------------------------------------------------- */ + +static int au_is_special(struct inode *inode) @@ -16541,7 +18424,6 @@ index 0000000..e317098 + lockdep_off(); + si_read_lock(sb, AuLock_FLUSH); + ii_write_lock_child(inode); -+ lockdep_on(); + + err = 0; + bindex = au_ibtop(inode); @@ -16569,7 +18451,6 @@ index 0000000..e317098 + AuDebugOn(1); + } + -+ lockdep_off(); + if (!err) + au_cpup_attr_timesizes(inode); + ii_write_unlock(inode); @@ -16598,15 +18479,10 @@ index 0000000..e317098 + .getattr = aufs_getattr, + +#ifdef CONFIG_AUFS_XATTR -+ .setxattr = aufs_setxattr, -+ .getxattr = aufs_getxattr, + .listxattr = aufs_listxattr, -+ .removexattr = aufs_removexattr, +#endif + -+ .readlink = generic_readlink, -+ .follow_link = aufs_follow_link, -+ .put_link = aufs_put_link, ++ .get_link = aufs_get_link, + + /* .update_time = aufs_update_time */ + }, @@ -16631,10 +18507,7 @@ index 0000000..e317098 + .getattr = aufs_getattr, + +#ifdef CONFIG_AUFS_XATTR -+ .setxattr = aufs_setxattr, -+ .getxattr = aufs_getxattr, + .listxattr = aufs_listxattr, -+ .removexattr = aufs_removexattr, +#endif + + .update_time = aufs_update_time, @@ -16652,10 +18525,7 @@ index 0000000..e317098 + .getattr = aufs_getattr, + +#ifdef CONFIG_AUFS_XATTR -+ .setxattr = aufs_setxattr, -+ .getxattr = aufs_getxattr, + .listxattr = aufs_listxattr, -+ .removexattr = aufs_removexattr, +#endif + + .update_time = aufs_update_time @@ -16663,10 +18533,10 @@ index 0000000..e317098 +}; diff --git a/fs/aufs/i_op_add.c b/fs/aufs/i_op_add.c new file mode 100644 -index 0000000..77fb7fa +index 0000000..a678e72 --- /dev/null +++ b/fs/aufs/i_op_add.c -@@ -0,0 +1,924 @@ +@@ -0,0 +1,920 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -17083,7 +18953,7 @@ index 0000000..77fb7fa + }; + + /* copy-up may happen */ -+ mutex_lock(&dir->i_mutex); ++ inode_lock(dir); + + sb = dir->i_sb; + err = si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLM); @@ -17124,18 +18994,11 @@ index 0000000..77fb7fa + goto out_parent; + + h_parent = au_h_dptr(parent, bindex); -+ err = inode_permission(d_inode(h_parent), MAY_WRITE | MAY_EXEC); -+ if (unlikely(err)) -+ goto out_mnt; -+ -+ err = -ENOMEM; -+ h_dentry = d_alloc(h_parent, &dentry->d_name); -+ if (unlikely(!h_dentry)) ++ h_dentry = vfs_tmpfile(h_parent, mode, /*open_flag*/0); ++ if (IS_ERR(h_dentry)) { ++ err = PTR_ERR(h_dentry); + goto out_mnt; -+ -+ err = h_dir->i_op->tmpfile(h_dir, h_dentry, mode); -+ if (unlikely(err)) -+ goto out_dentry; ++ } + + au_set_dbtop(dentry, bindex); + au_set_dbbot(dentry, bindex); @@ -17156,9 +19019,8 @@ index 0000000..77fb7fa + if (au_ibtop(dir) == au_dbtop(dentry)) + au_cpup_attr_timesizes(dir); + } -+ -+out_dentry: + dput(h_dentry); ++ +out_mnt: + vfsub_mnt_drop_write(h_mnt); +out_parent: @@ -17172,7 +19034,7 @@ index 0000000..77fb7fa +out_si: + si_read_unlock(sb); +out: -+ mutex_unlock(&dir->i_mutex); ++ inode_unlock(dir); + return err; +} + @@ -17381,6 +19243,10 @@ index 0000000..77fb7fa + goto out_parent; + } + ++ /* ++ * aufs doesn't touch the credential so ++ * security_dentry_create_files_as() is unnecrssary. ++ */ + if (au_opt_test(au_mntflags(sb), PLINK)) { + if (a->bdst < a->bsrc + /* && h_src_dentry->d_sb != a->h_path.dentry->d_sb */) @@ -17491,7 +19357,7 @@ index 0000000..77fb7fa + unsigned char diropq; + struct path h_path; + struct dentry *wh_dentry, *parent, *opq_dentry; -+ struct mutex *h_mtx; ++ struct inode *h_inode; + struct super_block *sb; + struct { + struct au_pin pin; @@ -17534,12 +19400,12 @@ index 0000000..77fb7fa + + /* make the dir opaque */ + diropq = 0; -+ h_mtx = &d_inode(h_path.dentry)->i_mutex; ++ h_inode = d_inode(h_path.dentry); + if (wh_dentry + || au_opt_test(au_mntflags(sb), ALWAYS_DIROPQ)) { -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + opq_dentry = au_diropq_create(dentry, bindex); -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + err = PTR_ERR(opq_dentry); + if (IS_ERR(opq_dentry)) + goto out_dir; @@ -17556,9 +19422,9 @@ index 0000000..77fb7fa + /* revert */ + if (diropq) { + AuLabel(revert opq); -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + rerr = au_diropq_remove(dentry, bindex); -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + if (rerr) { + AuIOErr("%pd reverting diropq failed(%d, %d)\n", + dentry, err, rerr); @@ -18110,10 +19976,10 @@ index 0000000..f67b74b +} diff --git a/fs/aufs/i_op_ren.c b/fs/aufs/i_op_ren.c new file mode 100644 -index 0000000..ba00792 +index 0000000..22124b1 --- /dev/null +++ b/fs/aufs/i_op_ren.c -@@ -0,0 +1,1015 @@ +@@ -0,0 +1,1246 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -18141,27 +20007,37 @@ index 0000000..ba00792 +enum { AuSRC, AuDST, AuSrcDst }; +enum { AuPARENT, AuCHILD, AuParentChild }; + -+#define AuRen_ISDIR 1 -+#define AuRen_ISSAMEDIR (1 << 1) -+#define AuRen_WHSRC (1 << 2) -+#define AuRen_WHDST (1 << 3) -+#define AuRen_MNT_WRITE (1 << 4) -+#define AuRen_DT_DSTDIR (1 << 5) -+#define AuRen_DIROPQ (1 << 6) ++#define AuRen_ISDIR_SRC 1 ++#define AuRen_ISDIR_DST (1 << 1) ++#define AuRen_ISSAMEDIR (1 << 2) ++#define AuRen_WHSRC (1 << 3) ++#define AuRen_WHDST (1 << 4) ++#define AuRen_MNT_WRITE (1 << 5) ++#define AuRen_DT_DSTDIR (1 << 6) ++#define AuRen_DIROPQ_SRC (1 << 7) ++#define AuRen_DIROPQ_DST (1 << 8) ++#define AuRen_DIRREN (1 << 9) ++#define AuRen_DROPPED_SRC (1 << 10) ++#define AuRen_DROPPED_DST (1 << 11) +#define au_ftest_ren(flags, name) ((flags) & AuRen_##name) +#define au_fset_ren(flags, name) \ + do { (flags) |= AuRen_##name; } while (0) +#define au_fclr_ren(flags, name) \ + do { (flags) &= ~AuRen_##name; } while (0) + ++#ifndef CONFIG_AUFS_DIRREN ++#undef AuRen_DIRREN ++#define AuRen_DIRREN 0 ++#endif ++ +struct au_ren_args { + struct { + struct dentry *dentry, *h_dentry, *parent, *h_parent, + *wh_dentry; + struct inode *dir, *inode; -+ struct au_hinode *hdir; ++ struct au_hinode *hdir, *hinode; + struct au_dtime dt[AuParentChild]; -+ aufs_bindex_t btop; ++ aufs_bindex_t btop, bdiropq; + } sd[AuSrcDst]; + +#define src_dentry sd[AuSRC].dentry @@ -18172,9 +20048,11 @@ index 0000000..ba00792 +#define src_h_parent sd[AuSRC].h_parent +#define src_wh_dentry sd[AuSRC].wh_dentry +#define src_hdir sd[AuSRC].hdir ++#define src_hinode sd[AuSRC].hinode +#define src_h_dir sd[AuSRC].hdir->hi_inode +#define src_dt sd[AuSRC].dt +#define src_btop sd[AuSRC].btop ++#define src_bdiropq sd[AuSRC].bdiropq + +#define dst_dentry sd[AuDST].dentry +#define dst_dir sd[AuDST].dir @@ -18184,21 +20062,27 @@ index 0000000..ba00792 +#define dst_h_parent sd[AuDST].h_parent +#define dst_wh_dentry sd[AuDST].wh_dentry +#define dst_hdir sd[AuDST].hdir ++#define dst_hinode sd[AuDST].hinode +#define dst_h_dir sd[AuDST].hdir->hi_inode +#define dst_dt sd[AuDST].dt +#define dst_btop sd[AuDST].btop ++#define dst_bdiropq sd[AuDST].bdiropq + + struct dentry *h_trap; + struct au_branch *br; -+ struct au_hinode *src_hinode; + struct path h_path; + struct au_nhash whlist; -+ aufs_bindex_t btgt, src_bwh, src_bdiropq; ++ aufs_bindex_t btgt, src_bwh; + -+ unsigned int flags; ++ struct { ++ unsigned short auren_flags; ++ unsigned char flags; /* syscall parameter */ ++ unsigned char exchange; ++ } __packed; + + struct au_whtmp_rmdir *thargs; + struct dentry *h_dst; ++ struct au_hinode *h_root; +}; + +/* ---------------------------------------------------------------------- */ @@ -18217,16 +20101,29 @@ index 0000000..ba00792 + err = -EIO; \ +} while (0) + -+static void au_ren_rev_diropq(int err, struct au_ren_args *a) ++static void au_ren_do_rev_diropq(int err, struct au_ren_args *a, int idx) +{ + int rerr; ++ struct dentry *d; ++#define src_or_dst(member) a->sd[idx].member + -+ au_hn_imtx_lock_nested(a->src_hinode, AuLsc_I_CHILD); -+ rerr = au_diropq_remove(a->src_dentry, a->btgt); -+ au_hn_imtx_unlock(a->src_hinode); -+ au_set_dbdiropq(a->src_dentry, a->src_bdiropq); ++ d = src_or_dst(dentry); /* {src,dst}_dentry */ ++ au_hn_inode_lock_nested(src_or_dst(hinode), AuLsc_I_CHILD); ++ rerr = au_diropq_remove(d, a->btgt); ++ au_hn_inode_unlock(src_or_dst(hinode)); ++ au_set_dbdiropq(d, src_or_dst(bdiropq)); + if (rerr) -+ RevertFailure("remove diropq %pd", a->src_dentry); ++ RevertFailure("remove diropq %pd", d); ++ ++#undef src_or_dst_ ++} ++ ++static void au_ren_rev_diropq(int err, struct au_ren_args *a) ++{ ++ if (au_ftest_ren(a->auren_flags, DIROPQ_SRC)) ++ au_ren_do_rev_diropq(err, a, AuSRC); ++ if (au_ftest_ren(a->auren_flags, DIROPQ_DST)) ++ au_ren_do_rev_diropq(err, a, AuDST); +} + +static void au_ren_rev_rename(int err, struct au_ren_args *a) @@ -18245,7 +20142,7 @@ index 0000000..ba00792 + delegated = NULL; + rerr = vfsub_rename(a->dst_h_dir, + au_h_dptr(a->src_dentry, a->btgt), -+ a->src_h_dir, &a->h_path, &delegated); ++ a->src_h_dir, &a->h_path, &delegated, a->flags); + if (unlikely(rerr == -EWOULDBLOCK)) { + pr_warn("cannot retry for NFSv4 delegation" + " for an internal rename\n"); @@ -18278,7 +20175,7 @@ index 0000000..ba00792 + + delegated = NULL; + rerr = vfsub_rename(a->dst_h_dir, a->h_dst, a->dst_h_dir, &a->h_path, -+ &delegated); ++ &delegated, a->flags); + if (unlikely(rerr == -EWOULDBLOCK)) { + pr_warn("cannot retry for NFSv4 delegation" + " for an internal rename\n"); @@ -18320,13 +20217,11 @@ index 0000000..ba00792 + d = a->src_dentry; + if (au_dbtop(d) == a->btgt) { + a->h_path.dentry = a->dst_h_dentry; -+ if (au_ftest_ren(a->flags, DIROPQ) -+ && au_dbdiropq(d) == a->btgt) -+ au_fclr_ren(a->flags, DIROPQ); + AuDebugOn(au_dbtop(d) != a->btgt); + delegated = NULL; + err = vfsub_rename(a->src_h_dir, au_h_dptr(d, a->btgt), -+ a->dst_h_dir, &a->h_path, &delegated); ++ a->dst_h_dir, &a->h_path, &delegated, ++ a->flags); + if (unlikely(err == -EWOULDBLOCK)) { + pr_warn("cannot retry for NFSv4 delegation" + " for an internal rename\n"); @@ -18370,127 +20265,186 @@ index 0000000..ba00792 +} + +/* make it 'opaque' dir. */ -+static int au_ren_diropq(struct au_ren_args *a) ++static int au_ren_do_diropq(struct au_ren_args *a, int idx) +{ + int err; -+ struct dentry *diropq; ++ struct dentry *d, *diropq; ++#define src_or_dst(member) a->sd[idx].member + + err = 0; -+ a->src_bdiropq = au_dbdiropq(a->src_dentry); -+ a->src_hinode = au_hi(a->src_inode, a->btgt); -+ au_hn_imtx_lock_nested(a->src_hinode, AuLsc_I_CHILD); -+ diropq = au_diropq_create(a->src_dentry, a->btgt); -+ au_hn_imtx_unlock(a->src_hinode); ++ d = src_or_dst(dentry); /* {src,dst}_dentry */ ++ src_or_dst(bdiropq) = au_dbdiropq(d); ++ src_or_dst(hinode) = au_hi(src_or_dst(inode), a->btgt); ++ au_hn_inode_lock_nested(src_or_dst(hinode), AuLsc_I_CHILD); ++ diropq = au_diropq_create(d, a->btgt); ++ au_hn_inode_unlock(src_or_dst(hinode)); + if (IS_ERR(diropq)) + err = PTR_ERR(diropq); + else + dput(diropq); + ++#undef src_or_dst_ + return err; +} + -+static int do_rename(struct au_ren_args *a) ++static int au_ren_diropq(struct au_ren_args *a) +{ + int err; -+ struct dentry *d, *h_d; ++ unsigned char always; ++ struct dentry *d; + -+ /* prepare workqueue args for asynchronous rmdir */ -+ h_d = a->dst_h_dentry; -+ if (au_ftest_ren(a->flags, ISDIR) && d_is_positive(h_d)) { -+ err = -ENOMEM; -+ a->thargs = au_whtmp_rmdir_alloc(a->src_dentry->d_sb, GFP_NOFS); -+ if (unlikely(!a->thargs)) ++ err = 0; ++ d = a->dst_dentry; /* already renamed on the branch */ ++ always = !!au_opt_test(au_mntflags(d->d_sb), ALWAYS_DIROPQ); ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC) ++ && !au_ftest_ren(a->auren_flags, DIRREN) ++ && a->btgt != au_dbdiropq(a->src_dentry) ++ && (a->dst_wh_dentry ++ || a->btgt <= au_dbdiropq(d) ++ /* hide the lower to keep xino */ ++ /* the lowers may not be a dir, but we hide them anyway */ ++ || a->btgt < au_dbbot(d) ++ || always)) { ++ AuDbg("here\n"); ++ err = au_ren_do_diropq(a, AuSRC); ++ if (unlikely(err)) + goto out; -+ a->h_dst = dget(h_d); -+ } -+ -+ /* create whiteout for src_dentry */ -+ if (au_ftest_ren(a->flags, WHSRC)) { -+ a->src_bwh = au_dbwh(a->src_dentry); -+ AuDebugOn(a->src_bwh >= 0); -+ a->src_wh_dentry -+ = au_wh_create(a->src_dentry, a->btgt, a->src_h_parent); -+ err = PTR_ERR(a->src_wh_dentry); -+ if (IS_ERR(a->src_wh_dentry)) -+ goto out_thargs; -+ } -+ -+ /* lookup whiteout for dentry */ -+ if (au_ftest_ren(a->flags, WHDST)) { -+ h_d = au_wh_lkup(a->dst_h_parent, &a->dst_dentry->d_name, -+ a->br); -+ err = PTR_ERR(h_d); -+ if (IS_ERR(h_d)) -+ goto out_whsrc; -+ if (d_is_negative(h_d)) -+ dput(h_d); -+ else -+ a->dst_wh_dentry = h_d; ++ au_fset_ren(a->auren_flags, DIROPQ_SRC); + } ++ if (!a->exchange) ++ goto out; /* success */ + -+ /* rename dentry to tmpwh */ -+ if (a->thargs) { -+ err = au_whtmp_ren(a->dst_h_dentry, a->br); ++ d = a->src_dentry; /* already renamed on the branch */ ++ if (au_ftest_ren(a->auren_flags, ISDIR_DST) ++ && a->btgt != au_dbdiropq(a->dst_dentry) ++ && (a->btgt < au_dbdiropq(d) ++ || a->btgt < au_dbbot(d) ++ || always)) { ++ AuDbgDentry(a->src_dentry); ++ AuDbgDentry(a->dst_dentry); ++ err = au_ren_do_diropq(a, AuDST); + if (unlikely(err)) -+ goto out_whdst; ++ goto out_rev_src; ++ au_fset_ren(a->auren_flags, DIROPQ_DST); ++ } ++ goto out; /* success */ + -+ d = a->dst_dentry; -+ au_set_h_dptr(d, a->btgt, NULL); -+ err = au_lkup_neg(d, a->btgt, /*wh*/0); -+ if (unlikely(err)) -+ goto out_whtmp; -+ a->dst_h_dentry = au_h_dptr(d, a->btgt); ++out_rev_src: ++ AuDbg("err %d, reverting src\n", err); ++ au_ren_rev_diropq(err, a); ++out: ++ return err; ++} ++ ++static int do_rename(struct au_ren_args *a) ++{ ++ int err; ++ struct dentry *d, *h_d; ++ ++ if (!a->exchange) { ++ /* prepare workqueue args for asynchronous rmdir */ ++ h_d = a->dst_h_dentry; ++ if (au_ftest_ren(a->auren_flags, ISDIR_DST) ++ /* && !au_ftest_ren(a->auren_flags, DIRREN) */ ++ && d_is_positive(h_d)) { ++ err = -ENOMEM; ++ a->thargs = au_whtmp_rmdir_alloc(a->src_dentry->d_sb, ++ GFP_NOFS); ++ if (unlikely(!a->thargs)) ++ goto out; ++ a->h_dst = dget(h_d); ++ } ++ ++ /* create whiteout for src_dentry */ ++ if (au_ftest_ren(a->auren_flags, WHSRC)) { ++ a->src_bwh = au_dbwh(a->src_dentry); ++ AuDebugOn(a->src_bwh >= 0); ++ a->src_wh_dentry = au_wh_create(a->src_dentry, a->btgt, ++ a->src_h_parent); ++ err = PTR_ERR(a->src_wh_dentry); ++ if (IS_ERR(a->src_wh_dentry)) ++ goto out_thargs; ++ } ++ ++ /* lookup whiteout for dentry */ ++ if (au_ftest_ren(a->auren_flags, WHDST)) { ++ h_d = au_wh_lkup(a->dst_h_parent, ++ &a->dst_dentry->d_name, a->br); ++ err = PTR_ERR(h_d); ++ if (IS_ERR(h_d)) ++ goto out_whsrc; ++ if (d_is_negative(h_d)) ++ dput(h_d); ++ else ++ a->dst_wh_dentry = h_d; ++ } ++ ++ /* rename dentry to tmpwh */ ++ if (a->thargs) { ++ err = au_whtmp_ren(a->dst_h_dentry, a->br); ++ if (unlikely(err)) ++ goto out_whdst; ++ ++ d = a->dst_dentry; ++ au_set_h_dptr(d, a->btgt, NULL); ++ err = au_lkup_neg(d, a->btgt, /*wh*/0); ++ if (unlikely(err)) ++ goto out_whtmp; ++ a->dst_h_dentry = au_h_dptr(d, a->btgt); ++ } + } + + BUG_ON(d_is_positive(a->dst_h_dentry) && a->src_btop != a->btgt); ++#if 0 ++ BUG_ON(!au_ftest_ren(a->auren_flags, DIRREN) ++ && d_is_positive(a->dst_h_dentry) ++ && a->src_btop != a->btgt); ++#endif + + /* rename by vfs_rename or cpup */ -+ d = a->dst_dentry; -+ if (au_ftest_ren(a->flags, ISDIR) -+ && (a->dst_wh_dentry -+ || au_dbdiropq(d) == a->btgt -+ /* hide the lower to keep xino */ -+ || a->btgt < au_dbbot(d) -+ || au_opt_test(au_mntflags(d->d_sb), ALWAYS_DIROPQ))) -+ au_fset_ren(a->flags, DIROPQ); + err = au_ren_or_cpup(a); + if (unlikely(err)) + /* leave the copied-up one */ + goto out_whtmp; + + /* make dir opaque */ -+ if (au_ftest_ren(a->flags, DIROPQ)) { -+ err = au_ren_diropq(a); -+ if (unlikely(err)) -+ goto out_rename; -+ } ++ err = au_ren_diropq(a); ++ if (unlikely(err)) ++ goto out_rename; + + /* update target timestamps */ ++ if (a->exchange) { ++ AuDebugOn(au_dbtop(a->dst_dentry) != a->btgt); ++ a->h_path.dentry = au_h_dptr(a->dst_dentry, a->btgt); ++ vfsub_update_h_iattr(&a->h_path, /*did*/NULL); /*ignore*/ ++ a->dst_inode->i_ctime = d_inode(a->h_path.dentry)->i_ctime; ++ } + AuDebugOn(au_dbtop(a->src_dentry) != a->btgt); + a->h_path.dentry = au_h_dptr(a->src_dentry, a->btgt); + vfsub_update_h_iattr(&a->h_path, /*did*/NULL); /*ignore*/ + a->src_inode->i_ctime = d_inode(a->h_path.dentry)->i_ctime; + -+ /* remove whiteout for dentry */ -+ if (a->dst_wh_dentry) { -+ a->h_path.dentry = a->dst_wh_dentry; -+ err = au_wh_unlink_dentry(a->dst_h_dir, &a->h_path, -+ a->dst_dentry); -+ if (unlikely(err)) -+ goto out_diropq; -+ } ++ if (!a->exchange) { ++ /* remove whiteout for dentry */ ++ if (a->dst_wh_dentry) { ++ a->h_path.dentry = a->dst_wh_dentry; ++ err = au_wh_unlink_dentry(a->dst_h_dir, &a->h_path, ++ a->dst_dentry); ++ if (unlikely(err)) ++ goto out_diropq; ++ } + -+ /* remove whtmp */ -+ if (a->thargs) -+ au_ren_del_whtmp(a); /* ignore this error */ ++ /* remove whtmp */ ++ if (a->thargs) ++ au_ren_del_whtmp(a); /* ignore this error */ + -+ au_fhsm_wrote(a->src_dentry->d_sb, a->btgt, /*force*/0); ++ au_fhsm_wrote(a->src_dentry->d_sb, a->btgt, /*force*/0); ++ } + err = 0; + goto out_success; + +out_diropq: -+ if (au_ftest_ren(a->flags, DIROPQ)) -+ au_ren_rev_diropq(err, a); ++ au_ren_rev_diropq(err, a); +out_rename: + au_ren_rev_rename(err, a); + dput(a->h_dst); @@ -18528,25 +20482,35 @@ index 0000000..ba00792 +} + +/* -+ * test if @dentry dir can be rename source or not. -+ * if it can, return 0 and @children is filled. ++ * test if @a->src_dentry dir can be rename source or not. ++ * if it can, return 0. + * success means, + * - it is a logically empty dir. + * - or, it exists on writable branch and has no children including whiteouts -+ * on the lower branch. ++ * on the lower branch unless DIRREN is on. + */ -+static int may_rename_srcdir(struct dentry *dentry, aufs_bindex_t btgt) ++static int may_rename_srcdir(struct au_ren_args *a) +{ + int err; + unsigned int rdhash; -+ aufs_bindex_t btop; ++ aufs_bindex_t btop, btgt; ++ struct dentry *dentry; ++ struct super_block *sb; ++ struct au_sbinfo *sbinfo; ++ ++ dentry = a->src_dentry; ++ sb = dentry->d_sb; ++ sbinfo = au_sbi(sb); ++ if (au_opt_test(sbinfo->si_mntflags, DIRREN)) ++ au_fset_ren(a->auren_flags, DIRREN); + ++ btgt = a->btgt; + btop = au_dbtop(dentry); + if (btop != btgt) { + struct au_nhash whlist; + -+ SiMustAnyLock(dentry->d_sb); -+ rdhash = au_sbi(dentry->d_sb)->si_rdhash; ++ SiMustAnyLock(sb); ++ rdhash = sbinfo->si_rdhash; + if (!rdhash) + rdhash = au_rdhash_est(au_dir_size(/*file*/NULL, + dentry)); @@ -18565,9 +20529,13 @@ index 0000000..ba00792 + +out: + if (err == -ENOTEMPTY) { -+ AuWarn1("renaming dir who has child(ren) on multiple branches," -+ " is not supported\n"); -+ err = -EXDEV; ++ if (au_ftest_ren(a->auren_flags, DIRREN)) { ++ err = 0; ++ } else { ++ AuWarn1("renaming dir who has child(ren) on multiple " ++ "branches, is not supported\n"); ++ err = -EXDEV; ++ } + } + return err; +} @@ -18583,7 +20551,7 @@ index 0000000..ba00792 + SiMustAnyLock(d->d_sb); + + err = 0; -+ if (au_ftest_ren(a->flags, ISDIR) && a->dst_inode) { ++ if (au_ftest_ren(a->auren_flags, ISDIR_DST) && a->dst_inode) { + rdhash = au_sbi(d->d_sb)->si_rdhash; + if (!rdhash) + rdhash = au_rdhash_est(au_dir_size(/*file*/NULL, d)); @@ -18591,9 +20559,12 @@ index 0000000..ba00792 + if (unlikely(err)) + goto out; + -+ au_set_dbtop(d, a->dst_btop); -+ err = may_rename_dstdir(d, &a->whlist); -+ au_set_dbtop(d, a->btgt); ++ if (!a->exchange) { ++ au_set_dbtop(d, a->dst_btop); ++ err = may_rename_dstdir(d, &a->whlist); ++ au_set_dbtop(d, a->btgt); ++ } else ++ err = may_rename_srcdir(a); + } + a->dst_h_dentry = au_h_dptr(d, au_dbtop(d)); + if (unlikely(err)) @@ -18601,8 +20572,8 @@ index 0000000..ba00792 + + d = a->src_dentry; + a->src_h_dentry = au_h_dptr(d, au_dbtop(d)); -+ if (au_ftest_ren(a->flags, ISDIR)) { -+ err = may_rename_srcdir(d, a->btgt); ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC)) { ++ err = may_rename_srcdir(a); + if (unlikely(err)) { + au_nhash_wh_free(&a->whlist); + a->whlist.nh_num = 0; @@ -18625,7 +20596,7 @@ index 0000000..ba00792 + + if (a->src_btop == a->btgt) { + err = au_may_del(a->src_dentry, a->btgt, a->src_h_parent, -+ au_ftest_ren(a->flags, ISDIR)); ++ au_ftest_ren(a->auren_flags, ISDIR_SRC)); + if (unlikely(err)) + goto out; + err = -EINVAL; @@ -18642,7 +20613,7 @@ index 0000000..ba00792 + goto out; + + err = -EIO; -+ isdir = !!au_ftest_ren(a->flags, ISDIR); ++ isdir = !!au_ftest_ren(a->auren_flags, ISDIR_DST); + if (d_really_is_negative(a->dst_dentry)) { + if (d_is_negative(a->dst_h_dentry)) + err = au_may_add(a->dst_dentry, a->btgt, @@ -18692,7 +20663,10 @@ index 0000000..ba00792 +{ + vfsub_unlock_rename(a->src_h_parent, a->src_hdir, + a->dst_h_parent, a->dst_hdir); -+ if (au_ftest_ren(a->flags, MNT_WRITE)) ++ if (au_ftest_ren(a->auren_flags, DIRREN) ++ && a->h_root) ++ au_hn_inode_unlock(a->h_root); ++ if (au_ftest_ren(a->auren_flags, MNT_WRITE)) + vfsub_mnt_drop_write(au_br_mnt(a->br)); +} + @@ -18710,7 +20684,24 @@ index 0000000..ba00792 + err = vfsub_mnt_want_write(au_br_mnt(a->br)); + if (unlikely(err)) + goto out; -+ au_fset_ren(a->flags, MNT_WRITE); ++ au_fset_ren(a->auren_flags, MNT_WRITE); ++ if (au_ftest_ren(a->auren_flags, DIRREN)) { ++ struct dentry *root; ++ struct inode *dir; ++ ++ /* ++ * sbinfo is already locked, so this ii_read_lock is ++ * unnecessary. but our debugging feature checks it. ++ */ ++ root = a->src_inode->i_sb->s_root; ++ if (root != a->src_parent && root != a->dst_parent) { ++ dir = d_inode(root); ++ ii_read_lock_parent3(dir); ++ a->h_root = au_hi(dir, a->btgt); ++ ii_read_unlock(dir); ++ au_hn_inode_lock_nested(a->h_root, AuLsc_I_PARENT3); ++ } ++ } + a->h_trap = vfsub_lock_rename(a->src_h_parent, a->src_hdir, + a->dst_h_parent, a->dst_hdir); + udba = au_opt_udba(a->src_dentry->d_sb); @@ -18743,20 +20734,30 @@ index 0000000..ba00792 + + dir = a->dst_dir; + dir->i_version++; -+ if (au_ftest_ren(a->flags, ISDIR)) { ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC)) { + /* is this updating defined in POSIX? */ + au_cpup_attr_timesizes(a->src_inode); + au_cpup_attr_nlink(dir, /*force*/1); + } -+ + au_dir_ts(dir, a->btgt); + -+ if (au_ftest_ren(a->flags, ISSAMEDIR)) ++ if (a->exchange) { ++ dir = a->src_dir; ++ dir->i_version++; ++ if (au_ftest_ren(a->auren_flags, ISDIR_DST)) { ++ /* is this updating defined in POSIX? */ ++ au_cpup_attr_timesizes(a->dst_inode); ++ au_cpup_attr_nlink(dir, /*force*/1); ++ } ++ au_dir_ts(dir, a->btgt); ++ } ++ ++ if (au_ftest_ren(a->auren_flags, ISSAMEDIR)) + return; + + dir = a->src_dir; + dir->i_version++; -+ if (au_ftest_ren(a->flags, ISDIR)) ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC)) + au_cpup_attr_nlink(dir, /*force*/1); + au_dir_ts(dir, a->btgt); +} @@ -18776,13 +20777,16 @@ index 0000000..ba00792 + + i = a->dst_inode; + if (i) { -+ if (!au_ftest_ren(a->flags, ISDIR)) -+ vfsub_drop_nlink(i); -+ else { -+ vfsub_dead_dir(i); -+ au_cpup_attr_timesizes(i); -+ } -+ au_update_dbrange(d, /*do_put_zero*/1); ++ if (!a->exchange) { ++ if (!au_ftest_ren(a->auren_flags, ISDIR_DST)) ++ vfsub_drop_nlink(i); ++ else { ++ vfsub_dead_dir(i); ++ au_cpup_attr_timesizes(i); ++ } ++ au_update_dbrange(d, /*do_put_zero*/1); ++ } else ++ au_cpup_attr_nlink(i, /*force*/1); + } else { + bbot = a->btgt; + for (bindex = au_dbtop(d); bindex < bbot; bindex++) @@ -18793,6 +20797,14 @@ index 0000000..ba00792 + au_update_dbrange(d, /*do_put_zero*/0); + } + ++ if (a->exchange ++ || au_ftest_ren(a->auren_flags, DIRREN)) { ++ d_drop(a->src_dentry); ++ if (au_ftest_ren(a->auren_flags, DIRREN)) ++ au_set_dbwh(a->src_dentry, -1); ++ return; ++ } ++ + d = a->src_dentry; + au_set_dbwh(d, -1); + bbot = au_dbbot(d); @@ -18855,7 +20867,8 @@ index 0000000..ba00792 + + a->src_btop = au_dbtop(a->src_dentry); + a->dst_btop = au_dbtop(a->dst_dentry); -+ if (au_ftest_ren(a->flags, ISDIR)) ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC) ++ || au_ftest_ren(a->auren_flags, ISDIR_DST)) + au_fset_wrdir(wr_dir_args.flags, ISDIR); + wr_dir_args.force_btgt = a->src_btop; + if (a->dst_inode && a->dst_btop < a->src_btop) @@ -18863,6 +20876,8 @@ index 0000000..ba00792 + wr_dir_args.force_btgt = au_wbr(a->dst_dentry, wr_dir_args.force_btgt); + err = au_wr_dir(a->dst_dentry, a->src_dentry, &wr_dir_args); + a->btgt = err; ++ if (a->exchange) ++ au_update_dbtop(a->dst_dentry); + + return err; +} @@ -18871,19 +20886,20 @@ index 0000000..ba00792 +{ + a->h_path.dentry = a->src_h_parent; + au_dtime_store(a->src_dt + AuPARENT, a->src_parent, &a->h_path); -+ if (!au_ftest_ren(a->flags, ISSAMEDIR)) { ++ if (!au_ftest_ren(a->auren_flags, ISSAMEDIR)) { + a->h_path.dentry = a->dst_h_parent; + au_dtime_store(a->dst_dt + AuPARENT, a->dst_parent, &a->h_path); + } + -+ au_fclr_ren(a->flags, DT_DSTDIR); -+ if (!au_ftest_ren(a->flags, ISDIR)) ++ au_fclr_ren(a->auren_flags, DT_DSTDIR); ++ if (!au_ftest_ren(a->auren_flags, ISDIR_SRC) ++ && !a->exchange) + return; + + a->h_path.dentry = a->src_h_dentry; + au_dtime_store(a->src_dt + AuCHILD, a->src_dentry, &a->h_path); + if (d_is_positive(a->dst_h_dentry)) { -+ au_fset_ren(a->flags, DT_DSTDIR); ++ au_fset_ren(a->auren_flags, DT_DSTDIR); + a->h_path.dentry = a->dst_h_dentry; + au_dtime_store(a->dst_dt + AuCHILD, a->dst_dentry, &a->h_path); + } @@ -18892,25 +20908,25 @@ index 0000000..ba00792 +static void au_ren_rev_dt(int err, struct au_ren_args *a) +{ + struct dentry *h_d; -+ struct mutex *h_mtx; ++ struct inode *h_inode; + + au_dtime_revert(a->src_dt + AuPARENT); -+ if (!au_ftest_ren(a->flags, ISSAMEDIR)) ++ if (!au_ftest_ren(a->auren_flags, ISSAMEDIR)) + au_dtime_revert(a->dst_dt + AuPARENT); + -+ if (au_ftest_ren(a->flags, ISDIR) && err != -EIO) { ++ if (au_ftest_ren(a->auren_flags, ISDIR_SRC) && err != -EIO) { + h_d = a->src_dt[AuCHILD].dt_h_path.dentry; -+ h_mtx = &d_inode(h_d)->i_mutex; -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD); ++ h_inode = d_inode(h_d); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + au_dtime_revert(a->src_dt + AuCHILD); -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + -+ if (au_ftest_ren(a->flags, DT_DSTDIR)) { ++ if (au_ftest_ren(a->auren_flags, DT_DSTDIR)) { + h_d = a->dst_dt[AuCHILD].dt_h_path.dentry; -+ h_mtx = &d_inode(h_d)->i_mutex; -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD); ++ h_inode = d_inode(h_d); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + au_dtime_revert(a->dst_dt + AuCHILD); -+ mutex_unlock(h_mtx); ++ inode_unlock(h_inode); + } + } +} @@ -18918,22 +20934,31 @@ index 0000000..ba00792 +/* ---------------------------------------------------------------------- */ + +int aufs_rename(struct inode *_src_dir, struct dentry *_src_dentry, -+ struct inode *_dst_dir, struct dentry *_dst_dentry) ++ struct inode *_dst_dir, struct dentry *_dst_dentry, ++ unsigned int _flags) +{ -+ int err, flags; ++ int err, lock_flags; ++ void *rev; + /* reduce stack space */ + struct au_ren_args *a; ++ struct au_pin pin; + -+ AuDbg("%pd, %pd\n", _src_dentry, _dst_dentry); ++ AuDbg("%pd, %pd, 0x%x\n", _src_dentry, _dst_dentry, _flags); + IMustLock(_src_dir); + IMustLock(_dst_dir); + ++ err = -EINVAL; ++ if (unlikely(_flags & RENAME_WHITEOUT)) ++ goto out; ++ + err = -ENOMEM; + BUILD_BUG_ON(sizeof(*a) > PAGE_SIZE); + a = kzalloc(sizeof(*a), GFP_NOFS); + if (unlikely(!a)) + goto out; + ++ a->flags = _flags; ++ a->exchange = _flags & RENAME_EXCHANGE; + a->src_dir = _src_dir; + a->src_dentry = _src_dentry; + a->src_inode = NULL; @@ -18947,20 +20972,34 @@ index 0000000..ba00792 + a->dst_inode = d_inode(a->dst_dentry); + a->dst_parent = a->dst_dentry->d_parent; /* dir inode is locked */ + if (a->dst_inode) { -+ IMustLock(a->dst_inode); ++ /* ++ * if EXCHANGE && src is non-dir && dst is dir, ++ * dst is not locked. ++ */ ++ /* IMustLock(a->dst_inode); */ + au_igrab(a->dst_inode); + } + + err = -ENOTDIR; -+ flags = AuLock_FLUSH | AuLock_NOPLM | AuLock_GEN; ++ lock_flags = AuLock_FLUSH | AuLock_NOPLM | AuLock_GEN; + if (d_is_dir(a->src_dentry)) { -+ au_fset_ren(a->flags, ISDIR); -+ if (unlikely(d_really_is_positive(a->dst_dentry) ++ au_fset_ren(a->auren_flags, ISDIR_SRC); ++ if (unlikely(!a->exchange ++ && d_really_is_positive(a->dst_dentry) + && !d_is_dir(a->dst_dentry))) + goto out_free; -+ flags |= AuLock_DIRS; ++ lock_flags |= AuLock_DIRS; ++ } ++ if (a->dst_inode && d_is_dir(a->dst_dentry)) { ++ au_fset_ren(a->auren_flags, ISDIR_DST); ++ if (unlikely(!a->exchange ++ && d_really_is_positive(a->src_dentry) ++ && !d_is_dir(a->src_dentry))) ++ goto out_free; ++ lock_flags |= AuLock_DIRS; + } -+ err = aufs_read_and_write_lock2(a->dst_dentry, a->src_dentry, flags); ++ err = aufs_read_and_write_lock2(a->dst_dentry, a->src_dentry, ++ lock_flags); + if (unlikely(err)) + goto out_free; + @@ -18970,14 +21009,14 @@ index 0000000..ba00792 + err = -ENOENT; + if (a->dst_inode) { + /* -+ * If it is a dir, VFS unhash dst_dentry before this ++ * If it is a dir, VFS unhash it before this + * function. It means we cannot rely upon d_unhashed(). + */ + if (unlikely(!a->dst_inode->i_nlink)) + goto out_unlock; -+ if (!S_ISDIR(a->dst_inode->i_mode)) { ++ if (!au_ftest_ren(a->auren_flags, ISDIR_DST)) { + err = au_d_hashed_positive(a->dst_dentry); -+ if (unlikely(err)) ++ if (unlikely(err && !a->exchange)) + goto out_unlock; + } else if (unlikely(IS_DEADDIR(a->dst_inode))) + goto out_unlock; @@ -18993,7 +21032,7 @@ index 0000000..ba00792 + if (unlikely(d_inode(a->dst_parent) == d_inode(a->src_dentry))) + goto out_unlock; + -+ au_fset_ren(a->flags, ISSAMEDIR); /* temporary */ ++ au_fset_ren(a->auren_flags, ISSAMEDIR); /* temporary */ + di_write_lock_parent(a->dst_parent); + + /* which branch we process */ @@ -19010,39 +21049,43 @@ index 0000000..ba00792 + + /* prepare the writable parent dir on the same branch */ + if (a->dst_btop == a->btgt) { -+ au_fset_ren(a->flags, WHDST); ++ au_fset_ren(a->auren_flags, WHDST); + } else { + err = au_cpup_dirs(a->dst_dentry, a->btgt); + if (unlikely(err)) + goto out_children; + } + -+ if (a->src_dir != a->dst_dir) { -+ /* -+ * this temporary unlock is safe, -+ * because both dir->i_mutex are locked. -+ */ -+ di_write_unlock(a->dst_parent); -+ di_write_lock_parent(a->src_parent); -+ err = au_wr_dir_need_wh(a->src_dentry, -+ au_ftest_ren(a->flags, ISDIR), -+ &a->btgt); -+ di_write_unlock(a->src_parent); -+ di_write_lock2_parent(a->src_parent, a->dst_parent, /*isdir*/1); -+ au_fclr_ren(a->flags, ISSAMEDIR); -+ } else -+ err = au_wr_dir_need_wh(a->src_dentry, -+ au_ftest_ren(a->flags, ISDIR), -+ &a->btgt); ++ err = 0; ++ if (!a->exchange) { ++ if (a->src_dir != a->dst_dir) { ++ /* ++ * this temporary unlock is safe, ++ * because both dir->i_mutex are locked. ++ */ ++ di_write_unlock(a->dst_parent); ++ di_write_lock_parent(a->src_parent); ++ err = au_wr_dir_need_wh(a->src_dentry, ++ au_ftest_ren(a->auren_flags, ++ ISDIR_SRC), ++ &a->btgt); ++ di_write_unlock(a->src_parent); ++ di_write_lock2_parent(a->src_parent, a->dst_parent, ++ /*isdir*/1); ++ au_fclr_ren(a->auren_flags, ISSAMEDIR); ++ } else ++ err = au_wr_dir_need_wh(a->src_dentry, ++ au_ftest_ren(a->auren_flags, ++ ISDIR_SRC), ++ &a->btgt); ++ } + if (unlikely(err < 0)) + goto out_children; + if (err) -+ au_fset_ren(a->flags, WHSRC); ++ au_fset_ren(a->auren_flags, WHSRC); + + /* cpup src */ + if (a->src_btop != a->btgt) { -+ struct au_pin pin; -+ + err = au_pin(&pin, a->src_dentry, a->btgt, + au_opt_udba(a->src_dentry->d_sb), + AuPin_DI_LOCKED | AuPin_MNT_WRITE); @@ -19063,7 +21106,32 @@ index 0000000..ba00792 + goto out_children; + a->src_btop = a->btgt; + a->src_h_dentry = au_h_dptr(a->src_dentry, a->btgt); -+ au_fset_ren(a->flags, WHSRC); ++ if (!a->exchange) ++ au_fset_ren(a->auren_flags, WHSRC); ++ } ++ ++ /* cpup dst */ ++ if (a->exchange && a->dst_inode ++ && a->dst_btop != a->btgt) { ++ err = au_pin(&pin, a->dst_dentry, a->btgt, ++ au_opt_udba(a->dst_dentry->d_sb), ++ AuPin_DI_LOCKED | AuPin_MNT_WRITE); ++ if (!err) { ++ struct au_cp_generic cpg = { ++ .dentry = a->dst_dentry, ++ .bdst = a->btgt, ++ .bsrc = a->dst_btop, ++ .len = -1, ++ .pin = &pin, ++ .flags = AuCpup_DTIME | AuCpup_HOPEN ++ }; ++ err = au_sio_cpup_simple(&cpg); ++ au_unpin(&pin); ++ } ++ if (unlikely(err)) ++ goto out_children; ++ a->dst_btop = a->btgt; ++ a->dst_h_dentry = au_h_dptr(a->dst_dentry, a->btgt); + } + + /* lock them all */ @@ -19072,20 +21140,34 @@ index 0000000..ba00792 + /* leave the copied-up one */ + goto out_children; + -+ if (!au_opt_test(au_mntflags(a->dst_dir->i_sb), UDBA_NONE)) -+ err = au_may_ren(a); -+ else if (unlikely(a->dst_dentry->d_name.len > AUFS_MAX_NAMELEN)) -+ err = -ENAMETOOLONG; -+ if (unlikely(err)) -+ goto out_hdir; ++ if (!a->exchange) { ++ if (!au_opt_test(au_mntflags(a->dst_dir->i_sb), UDBA_NONE)) ++ err = au_may_ren(a); ++ else if (unlikely(a->dst_dentry->d_name.len > AUFS_MAX_NAMELEN)) ++ err = -ENAMETOOLONG; ++ if (unlikely(err)) ++ goto out_hdir; ++ } + + /* store timestamps to be revertible */ + au_ren_dt(a); + ++ /* store dirren info */ ++ if (au_ftest_ren(a->auren_flags, DIRREN)) { ++ err = au_dr_rename(a->src_dentry, a->btgt, ++ &a->dst_dentry->d_name, &rev); ++ AuTraceErr(err); ++ if (unlikely(err)) ++ goto out_dt; ++ } ++ + /* here we go */ + err = do_rename(a); + if (unlikely(err)) -+ goto out_dt; ++ goto out_dirren; ++ ++ if (au_ftest_ren(a->auren_flags, DIRREN)) ++ au_dr_rename_fin(a->src_dentry, a->btgt, rev); + + /* update dir attributes */ + au_ren_refresh_dir(a); @@ -19095,6 +21177,9 @@ index 0000000..ba00792 + + goto out_hdir; /* success */ + ++out_dirren: ++ if (au_ftest_ren(a->auren_flags, DIRREN)) ++ au_dr_rename_rev(a->src_dentry, a->btgt, rev); +out_dt: + au_ren_rev_dt(err, a); +out_hdir: @@ -19107,14 +21192,26 @@ index 0000000..ba00792 + au_set_dbtop(a->dst_dentry, a->dst_btop); + } +out_parent: -+ if (!err) -+ d_move(a->src_dentry, a->dst_dentry); -+ else { ++ if (!err) { ++ if (d_unhashed(a->src_dentry)) ++ au_fset_ren(a->auren_flags, DROPPED_SRC); ++ if (d_unhashed(a->dst_dentry)) ++ au_fset_ren(a->auren_flags, DROPPED_DST); ++ if (!a->exchange) ++ d_move(a->src_dentry, a->dst_dentry); ++ else { ++ d_exchange(a->src_dentry, a->dst_dentry); ++ if (au_ftest_ren(a->auren_flags, DROPPED_DST)) ++ d_drop(a->dst_dentry); ++ } ++ if (au_ftest_ren(a->auren_flags, DROPPED_SRC)) ++ d_drop(a->src_dentry); ++ } else { + au_update_dbtop(a->dst_dentry); + if (!a->dst_inode) + d_drop(a->dst_dentry); + } -+ if (au_ftest_ren(a->flags, ISSAMEDIR)) ++ if (au_ftest_ren(a->auren_flags, ISSAMEDIR)) + di_write_unlock(a->dst_parent); + else + di_write_unlock2(a->src_parent, a->dst_parent); @@ -19955,7 +22052,7 @@ index 0000000..d361e25 +} diff --git a/fs/aufs/inode.h b/fs/aufs/inode.h new file mode 100644 -index 0000000..61f01e7 +index 0000000..9e9eb6d --- /dev/null +++ b/fs/aufs/inode.h @@ -0,0 +1,695 @@ @@ -20039,7 +22136,7 @@ index 0000000..61f01e7 +struct au_icntnr { + struct au_iinfo iinfo; + struct inode vfs_inode; -+ struct hlist_node plink; ++ struct hlist_bl_node plink; +} ____cacheline_aligned_in_smp; + +/* au_pin flags */ @@ -20072,7 +22169,6 @@ index 0000000..61f01e7 +void au_pin_hdir_unlock(struct au_pin *p); +int au_pin_hdir_lock(struct au_pin *p); +int au_pin_hdir_relock(struct au_pin *p); -+void au_pin_hdir_set_owner(struct au_pin *p, struct task_struct *task); +void au_pin_hdir_acquire_nest(struct au_pin *p); +void au_pin_hdir_release(struct au_pin *p); + @@ -20195,7 +22291,8 @@ index 0000000..61f01e7 +/* i_op_ren.c */ +int au_wbr(struct dentry *dentry, aufs_bindex_t btgt); +int aufs_rename(struct inode *src_dir, struct dentry *src_dentry, -+ struct inode *dir, struct dentry *dentry); ++ struct inode *dir, struct dentry *dentry, ++ unsigned int flags); + +/* iinfo.c */ +struct inode *au_h_iptr(struct inode *inode, aufs_bindex_t bindex); @@ -20268,17 +22365,11 @@ index 0000000..61f01e7 +int au_cpup_xattr(struct dentry *h_dst, struct dentry *h_src, int ignore_flags, + unsigned int verbose); +ssize_t aufs_listxattr(struct dentry *dentry, char *list, size_t size); -+ssize_t aufs_getxattr(struct dentry *dentry, const char *name, void *value, -+ size_t size); -+int aufs_setxattr(struct dentry *dentry, const char *name, const void *value, -+ size_t size, int flags); -+int aufs_removexattr(struct dentry *dentry, const char *name); -+ -+/* void au_xattr_init(struct super_block *sb); */ ++void au_xattr_init(struct super_block *sb); +#else +AuStubInt0(au_cpup_xattr, struct dentry *h_dst, struct dentry *h_src, + int ignore_flags, unsigned int verbose); -+/* AuStubVoid(au_xattr_init, struct super_block *sb); */ ++AuStubVoid(au_xattr_init, struct super_block *sb); +#endif + +#ifdef CONFIG_FS_POSIX_ACL @@ -20289,11 +22380,10 @@ index 0000000..61f01e7 +#if IS_ENABLED(CONFIG_AUFS_XATTR) || IS_ENABLED(CONFIG_FS_POSIX_ACL) +enum { + AU_XATTR_SET, -+ AU_XATTR_REMOVE, + AU_ACL_SET +}; + -+struct au_srxattr { ++struct au_sxattr { + int type; + union { + struct { @@ -20303,15 +22393,13 @@ index 0000000..61f01e7 + int flags; + } set; + struct { -+ const char *name; -+ } remove; -+ struct { + struct posix_acl *acl; + int type; + } acl_set; + } u; +}; -+ssize_t au_srxattr(struct dentry *dentry, struct au_srxattr *arg); ++ssize_t au_sxattr(struct dentry *dentry, struct inode *inode, ++ struct au_sxattr *arg); +#endif + +/* ---------------------------------------------------------------------- */ @@ -20364,10 +22452,9 @@ index 0000000..61f01e7 +#undef AuWriteLockFunc +#undef AuRWLockFuncs + -+/* -+ * ii_read_unlock, ii_write_unlock, ii_downgrade_lock -+ */ -+AuSimpleUnlockRwsemFuncs(ii, struct inode *i, &au_ii(i)->ii_rwsem); ++#define ii_read_unlock(i) au_rw_read_unlock(&au_ii(i)->ii_rwsem) ++#define ii_write_unlock(i) au_rw_write_unlock(&au_ii(i)->ii_rwsem) ++#define ii_downgrade_lock(i) au_rw_dgrade_lock(&au_ii(i)->ii_rwsem) + +#define IiMustNoWaiters(i) AuRwMustNoWaiters(&au_ii(i)->ii_rwsem) +#define IiMustAnyLock(i) AuRwMustAnyLock(&au_ii(i)->ii_rwsem) @@ -20633,23 +22720,33 @@ index 0000000..61f01e7 + au_hn_ctl(hdir, /*do_set*/1); +} + -+static inline void au_hn_imtx_lock(struct au_hinode *hdir) ++static inline void au_hn_inode_lock(struct au_hinode *hdir) +{ -+ mutex_lock(&hdir->hi_inode->i_mutex); ++ inode_lock(hdir->hi_inode); + au_hn_suspend(hdir); +} + -+static inline void au_hn_imtx_lock_nested(struct au_hinode *hdir, ++static inline void au_hn_inode_lock_nested(struct au_hinode *hdir, + unsigned int sc __maybe_unused) +{ -+ mutex_lock_nested(&hdir->hi_inode->i_mutex, sc); ++ inode_lock_nested(hdir->hi_inode, sc); ++ au_hn_suspend(hdir); ++} ++ ++#if 0 /* unused */ ++#include "vfsub.h" ++static inline void au_hn_inode_lock_shared_nested(struct au_hinode *hdir, ++ unsigned int sc) ++{ ++ vfsub_inode_lock_shared_nested(hdir->hi_inode, sc); + au_hn_suspend(hdir); +} ++#endif + -+static inline void au_hn_imtx_unlock(struct au_hinode *hdir) ++static inline void au_hn_inode_unlock(struct au_hinode *hdir) +{ + au_hn_resume(hdir); -+ mutex_unlock(&hdir->hi_inode->i_mutex); ++ inode_unlock(hdir->hi_inode); +} + +#endif /* __KERNEL__ */ @@ -21092,10 +23189,11 @@ index 0000000..9b02d32 +#endif /* __AUFS_LOOP_H__ */ diff --git a/fs/aufs/magic.mk b/fs/aufs/magic.mk new file mode 100644 -index 0000000..4f83bdf +index 0000000..7bc9eef --- /dev/null +++ b/fs/aufs/magic.mk -@@ -0,0 +1,30 @@ +@@ -0,0 +1,31 @@ ++# SPDX-License-Identifier: GPL-2.0 + +# defined in ${srctree}/fs/fuse/inode.c +# tristate @@ -21128,7 +23226,7 @@ index 0000000..4f83bdf +endif diff --git a/fs/aufs/module.c b/fs/aufs/module.c new file mode 100644 -index 0000000..3ca7c70 +index 0000000..744242a --- /dev/null +++ b/fs/aufs/module.c @@ -0,0 +1,266 @@ @@ -21266,7 +23364,7 @@ index 0000000..3ca7c70 + * iterate_supers_type() doesn't protect us from + * remounting (branch management) + */ -+struct au_sphlhead au_sbilist; ++struct hlist_bl_head au_sbilist; +#endif + +/* @@ -21507,7 +23605,7 @@ index 0000000..4f5727c +#endif /* __AUFS_MODULE_H__ */ diff --git a/fs/aufs/mvdown.c b/fs/aufs/mvdown.c new file mode 100644 -index 0000000..97619dd +index 0000000..d961d4c --- /dev/null +++ b/fs/aufs/mvdown.c @@ -0,0 +1,704 @@ @@ -21589,7 +23687,7 @@ index 0000000..97619dd + for (bindex++; bindex <= bbot; bindex++) { + br = au_sbr(sb, bindex); + if (au_br_fhsm(br->br_perm) -+ && (!(au_br_sb(br)->s_flags & MS_RDONLY))) ++ && !sb_rdonly(au_br_sb(br))) + return bindex; + } + else if (!(a->mvdown.flags & AUFS_MVDOWN_ROLOWER)) @@ -21601,7 +23699,7 @@ index 0000000..97619dd + else + for (bindex++; bindex <= bbot; bindex++) { + br = au_sbr(sb, bindex); -+ if (!(au_br_sb(br)->s_flags & MS_RDONLY)) { ++ if (!sb_rdonly(au_br_sb(br))) { + if (au_br_rdonly(br)) + a->mvdown.flags + |= AUFS_MVDOWN_ROLOWER_R; @@ -22172,14 +24270,14 @@ index 0000000..97619dd + dmsg = !!(args->mvdown.flags & AUFS_MVDOWN_DMSG); + args->parent = dget_parent(dentry); + args->dir = d_inode(args->parent); -+ mutex_lock_nested(&args->dir->i_mutex, I_MUTEX_PARENT); ++ inode_lock_nested(args->dir, I_MUTEX_PARENT); + dput(args->parent); + if (unlikely(args->parent != dentry->d_parent)) { + AU_MVD_PR(dmsg, "parent dir is moved\n"); + goto out_dir; + } + -+ mutex_lock_nested(&inode->i_mutex, I_MUTEX_CHILD); ++ inode_lock_nested(inode, I_MUTEX_CHILD); + err = aufs_read_lock(dentry, AuLock_DW | AuLock_FLUSH | AuLock_NOPLMW); + if (unlikely(err)) + goto out_inode; @@ -22203,9 +24301,9 @@ index 0000000..97619dd + di_write_unlock(args->parent); + aufs_read_unlock(dentry, AuLock_DW); +out_inode: -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); +out_dir: -+ mutex_unlock(&args->dir->i_mutex); ++ inode_unlock(args->dir); +out_free: + e = copy_to_user(uarg, &args->mvdown, sizeof(args->mvdown)); + if (unlikely(e)) @@ -22217,10 +24315,10 @@ index 0000000..97619dd +} diff --git a/fs/aufs/opts.c b/fs/aufs/opts.c new file mode 100644 -index 0000000..885464d +index 0000000..3b18e75 --- /dev/null +++ b/fs/aufs/opts.c -@@ -0,0 +1,1868 @@ +@@ -0,0 +1,1891 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -22270,6 +24368,7 @@ index 0000000..885464d + Opt_verbose, Opt_noverbose, + Opt_sum, Opt_nosum, Opt_wsum, + Opt_dirperm1, Opt_nodirperm1, ++ Opt_dirren, Opt_nodirren, + Opt_acl, Opt_noacl, + Opt_tail, Opt_ignore, Opt_ignore_silent, Opt_err +}; @@ -22324,10 +24423,18 @@ index 0000000..885464d + {Opt_dio, "dio"}, + {Opt_nodio, "nodio"}, + ++#ifdef CONFIG_AUFS_DIRREN ++ {Opt_dirren, "dirren"}, ++ {Opt_nodirren, "nodirren"}, ++#else ++ {Opt_ignore, "dirren"}, ++ {Opt_ignore_silent, "nodirren"}, ++#endif ++ +#ifdef CONFIG_AUFS_FHSM + {Opt_fhsm_sec, "fhsm_sec=%d"}, +#else -+ {Opt_ignore_silent, "fhsm_sec=%d"}, ++ {Opt_ignore, "fhsm_sec=%d"}, +#endif + + {Opt_diropq_a, "diropq=always"}, @@ -22340,7 +24447,7 @@ index 0000000..885464d + + /* keep them temporary */ + {Opt_ignore_silent, "nodlgt"}, -+ {Opt_ignore_silent, "clean_plink"}, ++ {Opt_ignore, "clean_plink"}, + +#ifdef CONFIG_AUFS_SHWH + {Opt_shwh, "shwh"}, @@ -22378,7 +24485,7 @@ index 0000000..885464d + {Opt_acl, "acl"}, + {Opt_noacl, "noacl"}, +#else -+ {Opt_ignore_silent, "acl"}, ++ {Opt_ignore, "acl"}, + {Opt_ignore_silent, "noacl"}, +#endif + @@ -22661,28 +24768,6 @@ index 0000000..885464d + {-1, NULL} +}; + -+/* -+ * cf. linux/lib/parser.c and cmdline.c -+ * gave up calling memparse() since it uses simple_strtoull() instead of -+ * kstrto...(). -+ */ -+static int noinline_for_stack -+au_match_ull(substring_t *s, unsigned long long *result) -+{ -+ int err; -+ unsigned int len; -+ char a[32]; -+ -+ err = -ERANGE; -+ len = s->to - s->from; -+ if (len + 1 <= sizeof(a)) { -+ memcpy(a, s->from, len); -+ a[len] = '\0'; -+ err = kstrtoull(a, 0, result); -+ } -+ return err; -+} -+ +static int au_wbr_mfs_wmark(substring_t *arg, char *str, + struct au_opt_wbr_create *create) +{ @@ -22690,7 +24775,7 @@ index 0000000..885464d + unsigned long long ull; + + err = 0; -+ if (!au_match_ull(arg, &ull)) ++ if (!match_u64(arg, &ull)) + create->mfsrr_watermark = ull; + else { + pr_err("bad integer in %s\n", str); @@ -22966,6 +25051,12 @@ index 0000000..885464d + case Opt_fhsm_sec: + AuDbg("fhsm_sec %u\n", opt->fhsm_second); + break; ++ case Opt_dirren: ++ AuLabel(dirren); ++ break; ++ case Opt_nodirren: ++ AuLabel(nodirren); ++ break; + case Opt_acl: + AuLabel(acl); + break; @@ -23416,6 +25507,8 @@ index 0000000..885464d + case Opt_wsum: + case Opt_rdblk_def: + case Opt_rdhash_def: ++ case Opt_dirren: ++ case Opt_nodirren: + case Opt_acl: + case Opt_noacl: + err = 0; @@ -23682,6 +25775,28 @@ index 0000000..885464d + au_fclr_opts(opts->flags, TRUNC_XIB); + break; + ++ case Opt_dirren: ++ err = 1; ++ if (!au_opt_test(sbinfo->si_mntflags, DIRREN)) { ++ err = au_dr_opt_set(sb); ++ if (!err) ++ err = 1; ++ } ++ if (err == 1) ++ au_opt_set(sbinfo->si_mntflags, DIRREN); ++ break; ++ case Opt_nodirren: ++ err = 1; ++ if (au_opt_test(sbinfo->si_mntflags, DIRREN)) { ++ err = au_dr_opt_clr(sb, au_ftest_opts(opts->flags, ++ DR_FLUSHED)); ++ if (!err) ++ err = 1; ++ } ++ if (err == 1) ++ au_opt_clr(sbinfo->si_mntflags, DIRREN); ++ break; ++ + case Opt_acl: + sb->s_flags |= MS_POSIXACL; + break; @@ -23901,13 +26016,13 @@ index 0000000..885464d + continue; + + hdir = au_hi(dir, bindex); -+ au_hn_imtx_lock_nested(hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_PARENT); + if (wbr) + wbr_wh_write_lock(wbr); + err = au_wh_init(br, sb); + if (wbr) + wbr_wh_write_unlock(wbr); -+ au_hn_imtx_unlock(hdir); ++ au_hn_inode_unlock(hdir); + + if (!err && do_free) { + kfree(wbr); @@ -24039,7 +26154,11 @@ index 0000000..885464d + + SiMustWriteLock(sb); + -+ err = 0; ++ err = au_dr_opt_flush(sb); ++ if (unlikely(err)) ++ goto out; ++ au_fset_opts(opts->flags, DR_FLUSHED); ++ + dir = d_inode(sb->s_root); + sbinfo = au_sbi(sb); + opt_xino = NULL; @@ -24080,6 +26199,8 @@ index 0000000..885464d + au_fset_opts(opts->flags, REFRESH); + + AuDbg("status 0x%x\n", opts->flags); ++ ++out: + return err; +} + @@ -24091,10 +26212,10 @@ index 0000000..885464d +} diff --git a/fs/aufs/opts.h b/fs/aufs/opts.h new file mode 100644 -index 0000000..c156995 +index 0000000..abcbaf6 --- /dev/null +++ b/fs/aufs/opts.h -@@ -0,0 +1,213 @@ +@@ -0,0 +1,224 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -24144,11 +26265,16 @@ index 0000000..c156995 +#define AuOpt_WARN_PERM (1 << 12) /* warn when add-branch */ +#define AuOpt_VERBOSE (1 << 13) /* busy inode when del-branch */ +#define AuOpt_DIO (1 << 14) /* direct io */ ++#define AuOpt_DIRREN (1 << 15) /* directory rename */ + +#ifndef CONFIG_AUFS_HNOTIFY +#undef AuOpt_UDBA_HNOTIFY +#define AuOpt_UDBA_HNOTIFY 0 +#endif ++#ifndef CONFIG_AUFS_DIRREN ++#undef AuOpt_DIRREN ++#define AuOpt_DIRREN 0 ++#endif +#ifndef CONFIG_AUFS_SHWH +#undef AuOpt_SHWH +#define AuOpt_SHWH 0 @@ -24273,12 +26399,18 @@ index 0000000..c156995 +#define AuOpts_TRUNC_XIB (1 << 2) +#define AuOpts_REFRESH_DYAOP (1 << 3) +#define AuOpts_REFRESH_IDOP (1 << 4) ++#define AuOpts_DR_FLUSHED (1 << 5) +#define au_ftest_opts(flags, name) ((flags) & AuOpts_##name) +#define au_fset_opts(flags, name) \ + do { (flags) |= AuOpts_##name; } while (0) +#define au_fclr_opts(flags, name) \ + do { (flags) &= ~AuOpts_##name; } while (0) + ++#ifndef CONFIG_AUFS_DIRREN ++#undef AuOpts_DR_FLUSHED ++#define AuOpts_DR_FLUSHED 0 ++#endif ++ +struct au_opts { + struct au_opt *opt; + int max_opt; @@ -24310,10 +26442,10 @@ index 0000000..c156995 +#endif /* __AUFS_OPTS_H__ */ diff --git a/fs/aufs/plink.c b/fs/aufs/plink.c new file mode 100644 -index 0000000..1780fb1 +index 0000000..f16a2d9 --- /dev/null +++ b/fs/aufs/plink.c -@@ -0,0 +1,514 @@ +@@ -0,0 +1,515 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -24451,7 +26583,8 @@ index 0000000..1780fb1 +{ + int i; + struct au_sbinfo *sbinfo; -+ struct hlist_head *plink_hlist; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; + struct au_icntnr *icntnr; + + SiMustAnyLock(sb); @@ -24461,11 +26594,11 @@ index 0000000..1780fb1 + AuDebugOn(au_plink_maint(sb, AuLock_NOPLM)); + + for (i = 0; i < AuPlink_NHASH; i++) { -+ plink_hlist = &sbinfo->si_plink[i].head; -+ rcu_read_lock(); -+ hlist_for_each_entry_rcu(icntnr, plink_hlist, plink) ++ hbl = sbinfo->si_plink + i; ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(icntnr, pos, hbl, plink) + AuDbg("%lu\n", icntnr->vfs_inode.i_ino); -+ rcu_read_unlock(); ++ hlist_bl_unlock(hbl); + } +} +#endif @@ -24475,7 +26608,8 @@ index 0000000..1780fb1 +{ + int found, i; + struct au_sbinfo *sbinfo; -+ struct hlist_head *plink_hlist; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; + struct au_icntnr *icntnr; + + sbinfo = au_sbi(inode->i_sb); @@ -24485,14 +26619,14 @@ index 0000000..1780fb1 + + found = 0; + i = au_plink_hash(inode->i_ino); -+ plink_hlist = &sbinfo->si_plink[i].head; -+ rcu_read_lock(); -+ hlist_for_each_entry_rcu(icntnr, plink_hlist, plink) ++ hbl = sbinfo->si_plink + i; ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(icntnr, pos, hbl, plink) + if (&icntnr->vfs_inode == inode) { + found = 1; + break; + } -+ rcu_read_unlock(); ++ hlist_bl_unlock(hbl); + return found; +} + @@ -24528,12 +26662,12 @@ index 0000000..1780fb1 + struct au_branch *br) +{ + struct dentry *h_dentry; -+ struct mutex *h_mtx; ++ struct inode *h_inode; + -+ h_mtx = &d_inode(h_parent)->i_mutex; -+ mutex_lock_nested(h_mtx, AuLsc_I_CHILD2); ++ h_inode = d_inode(h_parent); ++ vfsub_inode_lock_shared_nested(h_inode, AuLsc_I_CHILD2); + h_dentry = vfsub_lkup_one(tgtname, h_parent); -+ mutex_unlock(h_mtx); ++ inode_unlock_shared(h_inode); + return h_dentry; +} + @@ -24586,7 +26720,7 @@ index 0000000..1780fb1 + struct inode *h_dir, *delegated; + + h_dir = d_inode(h_parent); -+ mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_CHILD2); ++ inode_lock_nested(h_dir, AuLsc_I_CHILD2); +again: + h_path.dentry = vfsub_lkup_one(tgt, h_parent); + err = PTR_ERR(h_path.dentry); @@ -24622,7 +26756,7 @@ index 0000000..1780fb1 + dput(h_path.dentry); + +out: -+ mutex_unlock(&h_dir->i_mutex); ++ inode_unlock(h_dir); + return err; +} + @@ -24680,9 +26814,9 @@ index 0000000..1780fb1 +{ + struct super_block *sb; + struct au_sbinfo *sbinfo; -+ struct hlist_head *plink_hlist; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos; + struct au_icntnr *icntnr; -+ struct au_sphlhead *sphl; + int found, err, cnt, i; + + sb = inode->i_sb; @@ -24695,12 +26829,11 @@ index 0000000..1780fb1 + return; + + i = au_plink_hash(inode->i_ino); -+ sphl = sbinfo->si_plink + i; -+ plink_hlist = &sphl->head; ++ hbl = sbinfo->si_plink + i; + au_igrab(inode); + -+ spin_lock(&sphl->spin); -+ hlist_for_each_entry(icntnr, plink_hlist, plink) { ++ hlist_bl_lock(hbl); ++ hlist_bl_for_each_entry(icntnr, pos, hbl, plink) { + if (&icntnr->vfs_inode == inode) { + found = 1; + break; @@ -24708,11 +26841,11 @@ index 0000000..1780fb1 + } + if (!found) { + icntnr = container_of(inode, struct au_icntnr, vfs_inode); -+ hlist_add_head_rcu(&icntnr->plink, plink_hlist); ++ hlist_bl_add_head(&icntnr->plink, hbl); + } -+ spin_unlock(&sphl->spin); ++ hlist_bl_unlock(hbl); + if (!found) { -+ cnt = au_sphl_count(sphl); ++ cnt = au_hbl_count(hbl); +#define msg "unexpectedly unblanced or too many pseudo-links" + if (cnt > AUFS_PLINK_WARN) + AuWarn1(msg ", %d\n", cnt); @@ -24720,7 +26853,7 @@ index 0000000..1780fb1 + err = whplink(h_dentry, inode, bindex, au_sbr(sb, bindex)); + if (unlikely(err)) { + pr_warn("err %d, damaged pseudo link.\n", err); -+ au_sphl_del_rcu(&icntnr->plink, sphl); ++ au_hbl_del(&icntnr->plink, hbl); + iput(&icntnr->vfs_inode); + } + } else @@ -24732,8 +26865,8 @@ index 0000000..1780fb1 +{ + int i, warned; + struct au_sbinfo *sbinfo; -+ struct hlist_head *plink_hlist; -+ struct hlist_node *tmp; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos, *tmp; + struct au_icntnr *icntnr; + + SiMustWriteLock(sb); @@ -24745,14 +26878,14 @@ index 0000000..1780fb1 + /* no spin_lock since sbinfo is write-locked */ + warned = 0; + for (i = 0; i < AuPlink_NHASH; i++) { -+ plink_hlist = &sbinfo->si_plink[i].head; -+ if (!warned && verbose && !hlist_empty(plink_hlist)) { ++ hbl = sbinfo->si_plink + i; ++ if (!warned && verbose && !hlist_bl_empty(hbl)) { + pr_warn("pseudo-link is not flushed"); + warned = 1; + } -+ hlist_for_each_entry_safe(icntnr, tmp, plink_hlist, plink) ++ hlist_bl_for_each_entry_safe(icntnr, pos, tmp, hbl, plink) + iput(&icntnr->vfs_inode); -+ INIT_HLIST_HEAD(plink_hlist); ++ INIT_HLIST_BL_HEAD(hbl); + } +} + @@ -24800,8 +26933,8 @@ index 0000000..1780fb1 +void au_plink_half_refresh(struct super_block *sb, aufs_bindex_t br_id) +{ + struct au_sbinfo *sbinfo; -+ struct hlist_head *plink_hlist; -+ struct hlist_node *tmp; ++ struct hlist_bl_head *hbl; ++ struct hlist_bl_node *pos, *tmp; + struct au_icntnr *icntnr; + struct inode *inode; + int i, do_put; @@ -24812,15 +26945,15 @@ index 0000000..1780fb1 + AuDebugOn(!au_opt_test(au_mntflags(sb), PLINK)); + AuDebugOn(au_plink_maint(sb, AuLock_NOPLM)); + -+ /* no spin_lock since sbinfo is write-locked */ ++ /* no bit_lock since sbinfo is write-locked */ + for (i = 0; i < AuPlink_NHASH; i++) { -+ plink_hlist = &sbinfo->si_plink[i].head; -+ hlist_for_each_entry_safe(icntnr, tmp, plink_hlist, plink) { ++ hbl = sbinfo->si_plink + i; ++ hlist_bl_for_each_entry_safe(icntnr, pos, tmp, hbl, plink) { + inode = au_igrab(&icntnr->vfs_inode); + ii_write_lock_child(inode); + do_put = au_plink_do_half_refresh(inode, br_id); + if (do_put) { -+ hlist_del(&icntnr->plink); ++ hlist_bl_del(&icntnr->plink); + iput(inode); + } + ii_write_unlock(inode); @@ -24830,7 +26963,7 @@ index 0000000..1780fb1 +} diff --git a/fs/aufs/poll.c b/fs/aufs/poll.c new file mode 100644 -index 0000000..cf7abdf +index 0000000..1aea194 --- /dev/null +++ b/fs/aufs/poll.c @@ -0,0 +1,52 @@ @@ -24870,7 +27003,7 @@ index 0000000..cf7abdf + sb = file->f_path.dentry->d_sb; + si_read_lock(sb, AuLock_FLUSH | AuLock_NOPLMW); + -+ h_file = au_read_pre(file, /*keep_fi*/0); ++ h_file = au_read_pre(file, /*keep_fi*/0, /*lsc*/0); + err = PTR_ERR(h_file); + if (IS_ERR(h_file)) + goto out; @@ -24888,10 +27021,10 @@ index 0000000..cf7abdf +} diff --git a/fs/aufs/posix_acl.c b/fs/aufs/posix_acl.c new file mode 100644 -index 0000000..aa6257a +index 0000000..816a47c --- /dev/null +++ b/fs/aufs/posix_acl.c -@@ -0,0 +1,98 @@ +@@ -0,0 +1,102 @@ +/* + * Copyright (C) 2014-2017 Junjiro R. Okajima + * @@ -24943,6 +27076,8 @@ index 0000000..aa6257a + + /* always topmost only */ + acl = get_acl(h_inode, type); ++ if (!IS_ERR_OR_NULL(acl)) ++ set_cached_acl(inode, type, acl); + +out: + ii_read_unlock(inode); @@ -24957,7 +27092,7 @@ index 0000000..aa6257a + int err; + ssize_t ssz; + struct dentry *dentry; -+ struct au_srxattr arg = { ++ struct au_sxattr arg = { + .type = AU_ACL_SET, + .u.acl_set = { + .acl = acl, @@ -24965,7 +27100,8 @@ index 0000000..aa6257a + }, + }; + -+ mutex_lock(&inode->i_mutex); ++ IMustLock(inode); ++ + if (inode->i_ino == AUFS_ROOT_INO) + dentry = dget(inode->i_sb->s_root); + else { @@ -24980,22 +27116,23 @@ index 0000000..aa6257a + } + } + -+ ssz = au_srxattr(dentry, &arg); ++ ssz = au_sxattr(dentry, inode, &arg); + dput(dentry); + err = ssz; -+ if (ssz >= 0) ++ if (ssz >= 0) { + err = 0; ++ set_cached_acl(inode, type, acl); ++ } + +out: -+ mutex_unlock(&inode->i_mutex); + return err; +} diff --git a/fs/aufs/procfs.c b/fs/aufs/procfs.c new file mode 100644 -index 0000000..b94c003 +index 0000000..7d69697 --- /dev/null +++ b/fs/aufs/procfs.c -@@ -0,0 +1,169 @@ +@@ -0,0 +1,170 @@ +/* + * Copyright (C) 2010-2017 Junjiro R. Okajima + * @@ -25047,6 +27184,7 @@ index 0000000..b94c003 + int err; + struct super_block *sb; + struct au_sbinfo *sbinfo; ++ struct hlist_bl_node *pos; + + err = -EBUSY; + if (unlikely(file->private_data)) @@ -25054,14 +27192,14 @@ index 0000000..b94c003 + + sb = NULL; + /* don't use au_sbilist_lock() here */ -+ spin_lock(&au_sbilist.spin); -+ hlist_for_each_entry(sbinfo, &au_sbilist.head, si_list) ++ hlist_bl_lock(&au_sbilist); ++ hlist_bl_for_each_entry(sbinfo, pos, &au_sbilist, si_list) + if (id == sysaufs_si_id(sbinfo)) { + kobject_get(&sbinfo->si_kobj); + sb = sbinfo->si_sb; + break; + } -+ spin_unlock(&au_sbilist.spin); ++ hlist_bl_unlock(&au_sbilist); + + err = -EINVAL; + if (unlikely(!sb)) @@ -25167,10 +27305,10 @@ index 0000000..b94c003 +} diff --git a/fs/aufs/rdu.c b/fs/aufs/rdu.c new file mode 100644 -index 0000000..5fdc2d9 +index 0000000..1f0d8c6 --- /dev/null +++ b/fs/aufs/rdu.c -@@ -0,0 +1,388 @@ +@@ -0,0 +1,381 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -25321,7 +27459,7 @@ index 0000000..5fdc2d9 + arg.end += rdu->sz; + + err = -ENOTDIR; -+ if (unlikely(!file->f_op->iterate)) ++ if (unlikely(!file->f_op->iterate && !file->f_op->iterate_shared)) + goto out; + + err = security_file_permission(file, MAY_READ); @@ -25331,14 +27469,7 @@ index 0000000..5fdc2d9 + + dentry = file->f_path.dentry; + inode = d_inode(dentry); -+#if 1 -+ mutex_lock(&inode->i_mutex); -+#else -+ err = mutex_lock_killable(&inode->i_mutex); -+ AuTraceErr(err); -+ if (unlikely(err)) -+ goto out; -+#endif ++ inode_lock_shared(inode); + + arg.sb = inode->i_sb; + err = si_read_lock(arg.sb, AuLock_FLUSH | AuLock_NOPLM); @@ -25395,7 +27526,7 @@ index 0000000..5fdc2d9 +out_si: + si_read_unlock(arg.sb); +out_mtx: -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock_shared(inode); +out: + AuTraceErr(err); + return err; @@ -25561,10 +27692,10 @@ index 0000000..5fdc2d9 +#endif diff --git a/fs/aufs/rwsem.h b/fs/aufs/rwsem.h new file mode 100644 -index 0000000..2abe89f +index 0000000..07c6f21 --- /dev/null +++ b/fs/aufs/rwsem.h -@@ -0,0 +1,198 @@ +@@ -0,0 +1,72 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -25593,182 +27724,56 @@ index 0000000..2abe89f + +#include "debug.h" + -+struct au_rwsem { -+ struct rw_semaphore rwsem; -+#ifdef CONFIG_AUFS_DEBUG -+ /* just for debugging, not almighty counter */ -+ atomic_t rcnt, wcnt; -+#endif -+}; -+ -+#ifdef CONFIG_LOCKDEP -+#define au_lockdep_set_name(rw) \ -+ lockdep_set_class_and_name(&(rw)->rwsem, \ -+ /*original key*/(rw)->rwsem.dep_map.key, \ -+ /*name*/#rw) -+#else -+#define au_lockdep_set_name(rw) do {} while (0) -+#endif -+ -+#ifdef CONFIG_AUFS_DEBUG -+#define AuDbgCntInit(rw) do { \ -+ atomic_set(&(rw)->rcnt, 0); \ -+ atomic_set(&(rw)->wcnt, 0); \ -+ smp_mb(); /* atomic set */ \ -+} while (0) -+ -+#define AuDbgCnt(rw, cnt) atomic_read(&(rw)->cnt) -+#define AuDbgCntInc(rw, cnt) atomic_inc(&(rw)->cnt) -+#define AuDbgCntDec(rw, cnt) WARN_ON(atomic_dec_return(&(rw)->cnt) < 0) -+#define AuDbgRcntInc(rw) AuDbgCntInc(rw, rcnt) -+#define AuDbgRcntDec(rw) AuDbgCntDec(rw, rcnt) -+#define AuDbgWcntInc(rw) AuDbgCntInc(rw, wcnt) -+#define AuDbgWcntDec(rw) AuDbgCntDec(rw, wcnt) -+#else -+#define AuDbgCnt(rw, cnt) 0 -+#define AuDbgCntInit(rw) do {} while (0) -+#define AuDbgRcntInc(rw) do {} while (0) -+#define AuDbgRcntDec(rw) do {} while (0) -+#define AuDbgWcntInc(rw) do {} while (0) -+#define AuDbgWcntDec(rw) do {} while (0) -+#endif /* CONFIG_AUFS_DEBUG */ ++/* in the futre, the name 'au_rwsem' will be totally gone */ ++#define au_rwsem rw_semaphore + +/* to debug easier, do not make them inlined functions */ -+#define AuRwMustNoWaiters(rw) AuDebugOn(rwsem_is_contended(&(rw)->rwsem)) ++#define AuRwMustNoWaiters(rw) AuDebugOn(rwsem_is_contended(rw)) +/* rwsem_is_locked() is unusable */ -+#define AuRwMustReadLock(rw) AuDebugOn(AuDbgCnt(rw, rcnt) <= 0) -+#define AuRwMustWriteLock(rw) AuDebugOn(AuDbgCnt(rw, wcnt) <= 0) -+#define AuRwMustAnyLock(rw) AuDebugOn(AuDbgCnt(rw, rcnt) <= 0 \ -+ && AuDbgCnt(rw, wcnt) <= 0) -+#define AuRwDestroy(rw) AuDebugOn(AuDbgCnt(rw, rcnt) \ -+ || AuDbgCnt(rw, wcnt)) -+ -+#define au_rw_init(rw) do { \ -+ AuDbgCntInit(rw); \ -+ init_rwsem(&(rw)->rwsem); \ -+ au_lockdep_set_name(rw); \ -+ } while (0) ++#define AuRwMustReadLock(rw) AuDebugOn(!lockdep_recursing(current) \ ++ && debug_locks \ ++ && !lockdep_is_held_type(rw, 1)) ++#define AuRwMustWriteLock(rw) AuDebugOn(!lockdep_recursing(current) \ ++ && debug_locks \ ++ && !lockdep_is_held_type(rw, 0)) ++#define AuRwMustAnyLock(rw) AuDebugOn(!lockdep_recursing(current) \ ++ && debug_locks \ ++ && !lockdep_is_held(rw)) ++#define AuRwDestroy(rw) AuDebugOn(!lockdep_recursing(current) \ ++ && debug_locks \ ++ && lockdep_is_held(rw)) ++ ++#define au_rw_init(rw) init_rwsem(rw) + +#define au_rw_init_wlock(rw) do { \ + au_rw_init(rw); \ -+ down_write(&(rw)->rwsem); \ -+ AuDbgWcntInc(rw); \ ++ down_write(rw); \ + } while (0) + -+#define au_rw_init_wlock_nested(rw, lsc) do { \ -+ au_rw_init(rw); \ -+ down_write_nested(&(rw)->rwsem, lsc); \ -+ AuDbgWcntInc(rw); \ ++#define au_rw_init_wlock_nested(rw, lsc) do { \ ++ au_rw_init(rw); \ ++ down_write_nested(rw, lsc); \ + } while (0) + -+static inline void au_rw_read_lock(struct au_rwsem *rw) -+{ -+ down_read(&rw->rwsem); -+ AuDbgRcntInc(rw); -+} -+ -+static inline void au_rw_read_lock_nested(struct au_rwsem *rw, unsigned int lsc) -+{ -+ down_read_nested(&rw->rwsem, lsc); -+ AuDbgRcntInc(rw); -+} -+ -+static inline void au_rw_read_unlock(struct au_rwsem *rw) -+{ -+ AuRwMustReadLock(rw); -+ AuDbgRcntDec(rw); -+ up_read(&rw->rwsem); -+} -+ -+static inline void au_rw_dgrade_lock(struct au_rwsem *rw) -+{ -+ AuRwMustWriteLock(rw); -+ AuDbgRcntInc(rw); -+ AuDbgWcntDec(rw); -+ downgrade_write(&rw->rwsem); -+} -+ -+static inline void au_rw_write_lock(struct au_rwsem *rw) -+{ -+ down_write(&rw->rwsem); -+ AuDbgWcntInc(rw); -+} -+ -+static inline void au_rw_write_lock_nested(struct au_rwsem *rw, -+ unsigned int lsc) -+{ -+ down_write_nested(&rw->rwsem, lsc); -+ AuDbgWcntInc(rw); -+} -+ -+static inline void au_rw_write_unlock(struct au_rwsem *rw) -+{ -+ AuRwMustWriteLock(rw); -+ AuDbgWcntDec(rw); -+ up_write(&rw->rwsem); -+} -+ -+/* why is not _nested version defined */ -+static inline int au_rw_read_trylock(struct au_rwsem *rw) -+{ -+ int ret; -+ -+ ret = down_read_trylock(&rw->rwsem); -+ if (ret) -+ AuDbgRcntInc(rw); -+ return ret; -+} -+ -+static inline int au_rw_write_trylock(struct au_rwsem *rw) -+{ -+ int ret; -+ -+ ret = down_write_trylock(&rw->rwsem); -+ if (ret) -+ AuDbgWcntInc(rw); -+ return ret; -+} -+ -+#undef AuDbgCntDec -+#undef AuDbgRcntInc -+#undef AuDbgRcntDec -+#undef AuDbgWcntDec -+ -+#define AuSimpleLockRwsemFuncs(prefix, param, rwsem) \ -+static inline void prefix##_read_lock(param) \ -+{ au_rw_read_lock(rwsem); } \ -+static inline void prefix##_write_lock(param) \ -+{ au_rw_write_lock(rwsem); } \ -+static inline int prefix##_read_trylock(param) \ -+{ return au_rw_read_trylock(rwsem); } \ -+static inline int prefix##_write_trylock(param) \ -+{ return au_rw_write_trylock(rwsem); } -+/* why is not _nested version defined */ -+/* static inline void prefix##_read_trylock_nested(param, lsc) -+{ au_rw_read_trylock_nested(rwsem, lsc)); } -+static inline void prefix##_write_trylock_nestd(param, lsc) -+{ au_rw_write_trylock_nested(rwsem, lsc); } */ -+ -+#define AuSimpleUnlockRwsemFuncs(prefix, param, rwsem) \ -+static inline void prefix##_read_unlock(param) \ -+{ au_rw_read_unlock(rwsem); } \ -+static inline void prefix##_write_unlock(param) \ -+{ au_rw_write_unlock(rwsem); } \ -+static inline void prefix##_downgrade_lock(param) \ -+{ au_rw_dgrade_lock(rwsem); } -+ -+#define AuSimpleRwsemFuncs(prefix, param, rwsem) \ -+ AuSimpleLockRwsemFuncs(prefix, param, rwsem) \ -+ AuSimpleUnlockRwsemFuncs(prefix, param, rwsem) ++#define au_rw_read_lock(rw) down_read(rw) ++#define au_rw_read_lock_nested(rw, lsc) down_read_nested(rw, lsc) ++#define au_rw_read_unlock(rw) up_read(rw) ++#define au_rw_dgrade_lock(rw) downgrade_write(rw) ++#define au_rw_write_lock(rw) down_write(rw) ++#define au_rw_write_lock_nested(rw, lsc) down_write_nested(rw, lsc) ++#define au_rw_write_unlock(rw) up_write(rw) ++/* why is not _nested version defined? */ ++#define au_rw_read_trylock(rw) down_read_trylock(rw) ++#define au_rw_write_trylock(rw) down_write_trylock(rw) + +#endif /* __KERNEL__ */ +#endif /* __AUFS_RWSEM_H__ */ diff --git a/fs/aufs/sbinfo.c b/fs/aufs/sbinfo.c new file mode 100644 -index 0000000..1f98c23 +index 0000000..30be8c9 --- /dev/null +++ b/fs/aufs/sbinfo.c -@@ -0,0 +1,308 @@ +@@ -0,0 +1,304 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -25803,7 +27808,7 @@ index 0000000..1f98c23 + + sbinfo = container_of(kobj, struct au_sbinfo, si_kobj); + for (i = 0; i < AuPlink_NHASH; i++) -+ AuDebugOn(!hlist_empty(&sbinfo->si_plink[i].head)); ++ AuDebugOn(!hlist_bl_empty(sbinfo->si_plink + i)); + AuDebugOn(atomic_read(&sbinfo->si_nowait.nw_len)); + + AuDebugOn(percpu_counter_sum(&sbinfo->si_ninodes)); @@ -25811,8 +27816,6 @@ index 0000000..1f98c23 + AuDebugOn(percpu_counter_sum(&sbinfo->si_nfiles)); + percpu_counter_destroy(&sbinfo->si_nfiles); + -+ AuDebugOn(!hlist_empty(&sbinfo->si_symlink.head)); -+ + au_rw_write_lock(&sbinfo->si_rwsem); + au_br_free(sbinfo); + au_rw_write_unlock(&sbinfo->si_rwsem); @@ -25861,8 +27864,6 @@ index 0000000..1f98c23 + + sbinfo->si_mntflags = au_opts_plink(AuOpt_Def); + -+ au_sphl_init(&sbinfo->si_symlink); -+ + sbinfo->si_xino_jiffy = jiffies; + sbinfo->si_xino_expire + = msecs_to_jiffies(AUFS_XINO_DEF_SEC * MSEC_PER_SEC); @@ -25870,7 +27871,7 @@ index 0000000..1f98c23 + sbinfo->si_xino_brid = -1; + /* leave si_xib_last_pindex and si_xib_next_bit */ + -+ au_sphl_init(&sbinfo->si_aopen); ++ INIT_HLIST_BL_HEAD(&sbinfo->si_aopen); + + sbinfo->si_rdcache = msecs_to_jiffies(AUFS_RDCACHE_DEF * MSEC_PER_SEC); + sbinfo->si_rdblk = AUFS_RDBLK_DEF; @@ -25878,11 +27879,11 @@ index 0000000..1f98c23 + sbinfo->si_dirwh = AUFS_DIRWH_DEF; + + for (i = 0; i < AuPlink_NHASH; i++) -+ au_sphl_init(sbinfo->si_plink + i); ++ INIT_HLIST_BL_HEAD(sbinfo->si_plink + i); + init_waitqueue_head(&sbinfo->si_plink_wq); + spin_lock_init(&sbinfo->si_plink_maint_lock); + -+ au_sphl_init(&sbinfo->si_files); ++ INIT_HLIST_BL_HEAD(&sbinfo->si_files); + + /* with getattr by default */ + sbinfo->si_iop_array = aufs_iop; @@ -26077,131 +28078,12 @@ index 0000000..1f98c23 + di_write_unlock2(d1, d2); + si_read_unlock(d1->d_sb); +} -diff --git a/fs/aufs/spl.h b/fs/aufs/spl.h -new file mode 100644 -index 0000000..2845873 ---- /dev/null -+++ b/fs/aufs/spl.h -@@ -0,0 +1,113 @@ -+/* -+ * Copyright (C) 2005-2017 Junjiro R. Okajima -+ * -+ * This program, aufs is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License as published by -+ * the Free Software Foundation; either version 2 of the License, or -+ * (at your option) any later version. -+ * -+ * This program is distributed in the hope that it will be useful, -+ * but WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the -+ * GNU General Public License for more details. -+ * -+ * You should have received a copy of the GNU General Public License -+ * along with this program. If not, see . -+ */ -+ -+/* -+ * simple list protected by a spinlock -+ */ -+ -+#ifndef __AUFS_SPL_H__ -+#define __AUFS_SPL_H__ -+ -+#ifdef __KERNEL__ -+ -+#if 0 -+struct au_splhead { -+ spinlock_t spin; -+ struct list_head head; -+}; -+ -+static inline void au_spl_init(struct au_splhead *spl) -+{ -+ spin_lock_init(&spl->spin); -+ INIT_LIST_HEAD(&spl->head); -+} -+ -+static inline void au_spl_add(struct list_head *list, struct au_splhead *spl) -+{ -+ spin_lock(&spl->spin); -+ list_add(list, &spl->head); -+ spin_unlock(&spl->spin); -+} -+ -+static inline void au_spl_del(struct list_head *list, struct au_splhead *spl) -+{ -+ spin_lock(&spl->spin); -+ list_del(list); -+ spin_unlock(&spl->spin); -+} -+ -+static inline void au_spl_del_rcu(struct list_head *list, -+ struct au_splhead *spl) -+{ -+ spin_lock(&spl->spin); -+ list_del_rcu(list); -+ spin_unlock(&spl->spin); -+} -+#endif -+ -+/* ---------------------------------------------------------------------- */ -+ -+struct au_sphlhead { -+ spinlock_t spin; -+ struct hlist_head head; -+}; -+ -+static inline void au_sphl_init(struct au_sphlhead *sphl) -+{ -+ spin_lock_init(&sphl->spin); -+ INIT_HLIST_HEAD(&sphl->head); -+} -+ -+static inline void au_sphl_add(struct hlist_node *hlist, -+ struct au_sphlhead *sphl) -+{ -+ spin_lock(&sphl->spin); -+ hlist_add_head(hlist, &sphl->head); -+ spin_unlock(&sphl->spin); -+} -+ -+static inline void au_sphl_del(struct hlist_node *hlist, -+ struct au_sphlhead *sphl) -+{ -+ spin_lock(&sphl->spin); -+ hlist_del(hlist); -+ spin_unlock(&sphl->spin); -+} -+ -+static inline void au_sphl_del_rcu(struct hlist_node *hlist, -+ struct au_sphlhead *sphl) -+{ -+ spin_lock(&sphl->spin); -+ hlist_del_rcu(hlist); -+ spin_unlock(&sphl->spin); -+} -+ -+static inline unsigned long au_sphl_count(struct au_sphlhead *sphl) -+{ -+ unsigned long cnt; -+ struct hlist_node *pos; -+ -+ cnt = 0; -+ spin_lock(&sphl->spin); -+ hlist_for_each(pos, &sphl->head) -+ cnt++; -+ spin_unlock(&sphl->spin); -+ return cnt; -+} -+ -+#endif /* __KERNEL__ */ -+#endif /* __AUFS_SPL_H__ */ diff --git a/fs/aufs/super.c b/fs/aufs/super.c new file mode 100644 -index 0000000..c20a7b9 +index 0000000..a02f68b --- /dev/null +++ b/fs/aufs/super.c -@@ -0,0 +1,1044 @@ +@@ -0,0 +1,1046 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -26492,6 +28374,7 @@ index 0000000..c20a7b9 + + au_fhsm_show(m, sbinfo); + ++ AuBool(DIRREN, dirren); + AuBool(SUM, sum); + /* AuBool(SUM_W, wsum); */ + AuBool(WARN_PERM, warn_perm); @@ -27013,7 +28896,7 @@ index 0000000..c20a7b9 + + sbinfo = au_sbi(sb); + inode = d_inode(root); -+ mutex_lock(&inode->i_mutex); ++ inode_lock(inode); + err = si_write_lock(sb, AuLock_FLUSH | AuLock_NOPLM); + if (unlikely(err)) + goto out_mtx; @@ -27036,7 +28919,7 @@ index 0000000..c20a7b9 + aufs_write_unlock(root); + +out_mtx: -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); +out_opts: + free_page((unsigned long)opts.opt); +out: @@ -27133,7 +29016,7 @@ index 0000000..c20a7b9 + sb->s_maxbytes = 0; + sb->s_stack_depth = 1; + au_export_init(sb); -+ /* au_xattr_init(sb); */ ++ au_xattr_init(sb); + + err = alloc_root(sb); + if (unlikely(err)) { @@ -27155,7 +29038,7 @@ index 0000000..c20a7b9 + goto out_root; + + /* lock vfs_inode first, then aufs. */ -+ mutex_lock(&inode->i_mutex); ++ inode_lock(inode); + aufs_write_lock(root); + err = au_opts_mount(sb, &opts); + au_opts_free(&opts); @@ -27167,7 +29050,7 @@ index 0000000..c20a7b9 + au_refresh_iop(inode, /*force_getattr*/0); + } + aufs_write_unlock(root); -+ mutex_unlock(&inode->i_mutex); ++ inode_unlock(inode); + if (!err) + goto out_opts; /* success */ + @@ -27230,6 +29113,7 @@ index 0000000..c20a7b9 + if (au_opt_test(sbinfo->si_mntflags, PLINK)) + au_plink_put(sb, /*verbose*/1); + au_xino_clr(sb); ++ au_dr_opt_flush(sb); + sbinfo->si_sb = NULL; + aufs_write_unlock(sb->s_root); + au_nwt_flush(&sbinfo->si_nowait); @@ -27248,10 +29132,10 @@ index 0000000..c20a7b9 +}; diff --git a/fs/aufs/super.h b/fs/aufs/super.h new file mode 100644 -index 0000000..bcddbfd +index 0000000..95d0825 --- /dev/null +++ b/fs/aufs/super.h -@@ -0,0 +1,619 @@ +@@ -0,0 +1,626 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -27280,8 +29164,8 @@ index 0000000..bcddbfd + +#include +#include ++#include "hbl.h" +#include "rwsem.h" -+#include "spl.h" +#include "wkq.h" + +/* policies to select one among multiple writable branches */ @@ -27382,9 +29266,6 @@ index 0000000..bcddbfd + /* include/asm-ia64/siginfo.h defines a macro named si_flags */ + unsigned int si_mntflags; + -+ /* symlink to follow_link() and put_link() */ -+ struct au_sphlhead si_symlink; -+ + /* external inode number (bitmap and translation table) */ + vfs_readf_t si_xread; + vfs_writef_t si_xwrite; @@ -27406,7 +29287,7 @@ index 0000000..bcddbfd +#endif + + /* dirty trick to suppoer atomic_open */ -+ struct au_sphlhead si_aopen; ++ struct hlist_bl_head si_aopen; + + /* vdir parameters */ + unsigned long si_rdcache; /* max cache time in jiffies */ @@ -27422,13 +29303,13 @@ index 0000000..bcddbfd + unsigned int si_dirwh; + + /* pseudo_link list */ -+ struct au_sphlhead si_plink[AuPlink_NHASH]; ++ struct hlist_bl_head si_plink[AuPlink_NHASH]; + wait_queue_head_t si_plink_wq; + spinlock_t si_plink_maint_lock; + pid_t si_plink_maint_pid; + + /* file list */ -+ struct au_sphlhead si_files; ++ struct hlist_bl_head si_files; + + /* with/without getattr, brother of sb->s_d_op */ + struct inode_operations *si_iop_array; @@ -27450,7 +29331,7 @@ index 0000000..bcddbfd +#endif + +#ifdef CONFIG_AUFS_SBILIST -+ struct hlist_node si_list; ++ struct hlist_bl_node si_list; +#endif + + /* dirty, necessary for unmounting, sysfs and sysrq */ @@ -27502,6 +29383,7 @@ index 0000000..bcddbfd +#define AuLock_IW (1 << 2) /* write-lock inode */ +#define AuLock_FLUSH (1 << 3) /* wait for 'nowait' tasks */ +#define AuLock_DIRS (1 << 4) /* target is a pair of dirs */ ++ /* except RENAME_EXCHANGE */ +#define AuLock_NOPLM (1 << 5) /* return err in plm mode */ +#define AuLock_NOPLMW (1 << 6) /* wait for plm mode ends */ +#define AuLock_GEN (1 << 7) /* test digen/iigen */ @@ -27624,32 +29506,32 @@ index 0000000..bcddbfd + +#ifdef CONFIG_AUFS_SBILIST +/* module.c */ -+extern struct au_sphlhead au_sbilist; ++extern struct hlist_bl_head au_sbilist; + +static inline void au_sbilist_init(void) +{ -+ au_sphl_init(&au_sbilist); ++ INIT_HLIST_BL_HEAD(&au_sbilist); +} + +static inline void au_sbilist_add(struct super_block *sb) +{ -+ au_sphl_add(&au_sbi(sb)->si_list, &au_sbilist); ++ au_hbl_add(&au_sbi(sb)->si_list, &au_sbilist); +} + +static inline void au_sbilist_del(struct super_block *sb) +{ -+ au_sphl_del(&au_sbi(sb)->si_list, &au_sbilist); ++ au_hbl_del(&au_sbi(sb)->si_list, &au_sbilist); +} + +#ifdef CONFIG_AUFS_MAGIC_SYSRQ +static inline void au_sbilist_lock(void) +{ -+ spin_lock(&au_sbilist.spin); ++ hlist_bl_lock(&au_sbilist); +} + +static inline void au_sbilist_unlock(void) +{ -+ spin_unlock(&au_sbilist.spin); ++ hlist_bl_unlock(&au_sbilist); +} +#define AuGFP_SBILIST GFP_ATOMIC +#else @@ -27715,11 +29597,20 @@ index 0000000..bcddbfd +/* ---------------------------------------------------------------------- */ + +/* lock superblock. mainly for entry point functions */ -+/* -+ * __si_read_lock, __si_write_lock, -+ * __si_read_unlock, __si_write_unlock, __si_downgrade_lock -+ */ -+AuSimpleRwsemFuncs(__si, struct super_block *sb, &au_sbi(sb)->si_rwsem); ++#define __si_read_lock(sb) au_rw_read_lock(&au_sbi(sb)->si_rwsem) ++#define __si_write_lock(sb) au_rw_write_lock(&au_sbi(sb)->si_rwsem) ++#define __si_read_trylock(sb) au_rw_read_trylock(&au_sbi(sb)->si_rwsem) ++#define __si_write_trylock(sb) au_rw_write_trylock(&au_sbi(sb)->si_rwsem) ++/* ++#define __si_read_trylock_nested(sb) \ ++ au_rw_read_trylock_nested(&au_sbi(sb)->si_rwsem) ++#define __si_write_trylock_nested(sb) \ ++ au_rw_write_trylock_nested(&au_sbi(sb)->si_rwsem) ++*/ ++ ++#define __si_read_unlock(sb) au_rw_read_unlock(&au_sbi(sb)->si_rwsem) ++#define __si_write_unlock(sb) au_rw_write_unlock(&au_sbi(sb)->si_rwsem) ++#define __si_downgrade_lock(sb) au_rw_dgrade_lock(&au_sbi(sb)->si_rwsem) + +#define SiMustNoWaiters(sb) AuRwMustNoWaiters(&au_sbi(sb)->si_rwsem) +#define SiMustAnyLock(sb) AuRwMustAnyLock(&au_sbi(sb)->si_rwsem) @@ -28472,10 +30363,10 @@ index 0000000..096bde9 +} diff --git a/fs/aufs/sysrq.c b/fs/aufs/sysrq.c new file mode 100644 -index 0000000..98d5ad2 +index 0000000..97c68ab --- /dev/null +++ b/fs/aufs/sysrq.c -@@ -0,0 +1,157 @@ +@@ -0,0 +1,159 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -28508,7 +30399,8 @@ index 0000000..98d5ad2 + char *plevel; + struct au_sbinfo *sbinfo; + struct file *file; -+ struct au_sphlhead *files; ++ struct hlist_bl_head *files; ++ struct hlist_bl_node *pos; + struct au_finfo *finfo; + + plevel = au_plevel; @@ -28567,8 +30459,8 @@ index 0000000..98d5ad2 +#endif + pr("files\n"); + files = &au_sbi(sb)->si_files; -+ spin_lock(&files->spin); -+ hlist_for_each_entry(finfo, &files->head, fi_hlist) { ++ hlist_bl_lock(files); ++ hlist_bl_for_each_entry(finfo, pos, files, fi_hlist) { + umode_t mode; + + file = finfo->fi_file; @@ -28576,7 +30468,7 @@ index 0000000..98d5ad2 + if (!special_file(mode)) + au_dpri_file(file); + } -+ spin_unlock(&files->spin); ++ hlist_bl_unlock(files); + pr("done\n"); + +#undef pr @@ -28593,10 +30485,11 @@ index 0000000..98d5ad2 +static void au_sysrq(int key __maybe_unused) +{ + struct au_sbinfo *sbinfo; ++ struct hlist_bl_node *pos; + + lockdep_off(); + au_sbilist_lock(); -+ hlist_for_each_entry(sbinfo, &au_sbilist.head, si_list) ++ hlist_bl_for_each_entry(sbinfo, pos, &au_sbilist, si_list) + sysrq_sb(sbinfo->si_sb); + au_sbilist_unlock(); + lockdep_on(); @@ -28635,10 +30528,10 @@ index 0000000..98d5ad2 +} diff --git a/fs/aufs/vdir.c b/fs/aufs/vdir.c new file mode 100644 -index 0000000..1e0c396 +index 0000000..b7583e9 --- /dev/null +++ b/fs/aufs/vdir.c -@@ -0,0 +1,891 @@ +@@ -0,0 +1,892 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -29280,6 +31173,7 @@ index 0000000..1e0c396 + err = 0; + inode = file_inode(file); + IMustLock(inode); ++ IiMustWriteLock(inode); + SiMustAnyLock(inode->i_sb); + + allocated = NULL; @@ -29532,10 +31426,10 @@ index 0000000..1e0c396 +} diff --git a/fs/aufs/vfsub.c b/fs/aufs/vfsub.c new file mode 100644 -index 0000000..b2ad9d8 +index 0000000..00f189d --- /dev/null +++ b/fs/aufs/vfsub.c -@@ -0,0 +1,882 @@ +@@ -0,0 +1,894 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -29557,26 +31451,20 @@ index 0000000..b2ad9d8 + * sub-routines for VFS + */ + ++#include +#include +#include +#include +#include -+#ifdef CONFIG_AUFS_BR_FUSE -+#include "../fs/mount.h" -+#endif +#include "aufs.h" + +#ifdef CONFIG_AUFS_BR_FUSE +int vfsub_test_mntns(struct vfsmount *mnt, struct super_block *h_sb) +{ -+ struct nsproxy *ns; -+ + if (!au_test_fuse(h_sb) || !au_userns) + return 0; + -+ ns = current->nsproxy; -+ /* no {get,put}_nsproxy(ns) */ -+ return real_mount(mnt)->mnt_ns == ns->mnt_ns ? 0 : -EACCES; ++ return is_current_mnt_ns(mnt) ? 0 : -EACCES; +} +#endif + @@ -29610,7 +31498,7 @@ index 0000000..b2ad9d8 + h_sb = h_path->dentry->d_sb; + *did = (!au_test_fs_remote(h_sb) && au_test_fs_refresh_iattr(h_sb)); + if (*did) -+ err = vfs_getattr(h_path, &st); ++ err = vfsub_getattr(h_path, &st); + + return err; +} @@ -29708,6 +31596,24 @@ index 0000000..b2ad9d8 + return err; +} + ++struct dentry *vfsub_lookup_one_len_unlocked(const char *name, ++ struct dentry *parent, int len) ++{ ++ struct path path = { ++ .mnt = NULL ++ }; ++ ++ path.dentry = lookup_one_len_unlocked(name, parent, len); ++ if (IS_ERR(path.dentry)) ++ goto out; ++ if (d_is_positive(path.dentry)) ++ vfsub_update_h_iattr(&path, /*did*/NULL); /*ignore*/ ++ ++out: ++ AuTraceErrPtr(path.dentry); ++ return path.dentry; ++} ++ +struct dentry *vfsub_lookup_one_len(const char *name, struct dentry *parent, + int len) +{ @@ -29918,7 +31824,7 @@ index 0000000..b2ad9d8 + +int vfsub_rename(struct inode *src_dir, struct dentry *src_dentry, + struct inode *dir, struct path *path, -+ struct inode **delegated_inode) ++ struct inode **delegated_inode, unsigned int flags) +{ + int err; + struct path tmp = { @@ -29939,7 +31845,7 @@ index 0000000..b2ad9d8 + + lockdep_off(); + err = vfs_rename(src_dir, src_dentry, dir, path->dentry, -+ delegated_inode, /*flags*/0); ++ delegated_inode, flags); + lockdep_on(); + if (!err) { + int did; @@ -30420,10 +32326,10 @@ index 0000000..b2ad9d8 +} diff --git a/fs/aufs/vfsub.h b/fs/aufs/vfsub.h new file mode 100644 -index 0000000..05dec4e +index 0000000..a64b8f0 --- /dev/null +++ b/fs/aufs/vfsub.h -@@ -0,0 +1,316 @@ +@@ -0,0 +1,360 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -30478,7 +32384,14 @@ index 0000000..05dec4e + +/* to debug easier, do not make them inlined functions */ +#define MtxMustLock(mtx) AuDebugOn(!mutex_is_locked(mtx)) -+#define IMustLock(i) MtxMustLock(&(i)->i_mutex) ++#define IMustLock(i) AuDebugOn(!inode_is_locked(i)) ++ ++/* why VFS doesn't define it? */ ++static inline ++void vfsub_inode_lock_shared_nested(struct inode *inode, unsigned int sc) ++{ ++ down_read_nested(&inode->i_rwsem, sc); ++} + +/* ---------------------------------------------------------------------- */ + @@ -30497,7 +32410,7 @@ index 0000000..05dec4e + +static inline int vfsub_native_ro(struct inode *inode) +{ -+ return (inode->i_sb->s_flags & MS_RDONLY) ++ return sb_rdonly(inode->i_sb) + || IS_RDONLY(inode) + /* || IS_APPEND(inode) */ + || IS_IMMUTABLE(inode); @@ -30527,6 +32440,8 @@ index 0000000..05dec4e + struct vfsub_aopen_args *args, struct au_branch *br); +int vfsub_kern_path(const char *name, unsigned int flags, struct path *path); + ++struct dentry *vfsub_lookup_one_len_unlocked(const char *name, ++ struct dentry *parent, int len); +struct dentry *vfsub_lookup_one_len(const char *name, struct dentry *parent, + int len); + @@ -30589,7 +32504,7 @@ index 0000000..05dec4e + struct path *path, struct inode **delegated_inode); +int vfsub_rename(struct inode *src_hdir, struct dentry *src_dentry, + struct inode *hdir, struct path *path, -+ struct inode **delegated_inode); ++ struct inode **delegated_inode, unsigned int flags); +int vfsub_mkdir(struct inode *dir, struct path *path, int mode); +int vfsub_rmdir(struct inode *dir, struct path *path); + @@ -30690,6 +32605,36 @@ index 0000000..05dec4e + struct file *h_file); +int vfsub_fsync(struct file *file, struct path *path, int datasync); + ++/* ++ * re-use branch fs's ioctl(FICLONE) while aufs itself doesn't support such ++ * ioctl. ++ */ ++static inline int vfsub_clone_file_range(struct file *src, struct file *dst, ++ u64 len) ++{ ++ int err; ++ ++ lockdep_off(); ++ err = vfs_clone_file_range(src, 0, dst, 0, len); ++ lockdep_on(); ++ ++ return err; ++} ++ ++/* copy_file_range(2) is a systemcall */ ++static inline ssize_t vfsub_copy_file_range(struct file *src, loff_t src_pos, ++ struct file *dst, loff_t dst_pos, ++ size_t len, unsigned int flags) ++{ ++ ssize_t ssz; ++ ++ lockdep_off(); ++ ssz = vfs_copy_file_range(src, src_pos, dst, dst_pos, len, flags); ++ lockdep_on(); ++ ++ return ssz; ++} ++ +/* ---------------------------------------------------------------------- */ + +static inline loff_t vfsub_llseek(struct file *file, loff_t offset, int origin) @@ -30713,6 +32658,11 @@ index 0000000..05dec4e +int vfsub_unlink(struct inode *dir, struct path *path, + struct inode **delegated_inode, int force); + ++static inline int vfsub_getattr(const struct path *path, struct kstat *st) ++{ ++ return vfs_getattr(path, st, STATX_BASIC_STATS, AT_STATX_SYNC_AS_STAT); ++} ++ +/* ---------------------------------------------------------------------- */ + +static inline int vfsub_setxattr(struct dentry *dentry, const char *name, @@ -30742,7 +32692,7 @@ index 0000000..05dec4e +#endif /* __AUFS_VFSUB_H__ */ diff --git a/fs/aufs/wbr_policy.c b/fs/aufs/wbr_policy.c new file mode 100644 -index 0000000..492d7b4 +index 0000000..a28296d --- /dev/null +++ b/fs/aufs/wbr_policy.c @@ -0,0 +1,830 @@ @@ -30888,17 +32838,17 @@ index 0000000..492d7b4 + if (!au_ftest_cpdown(*flags, PARENT_OPQ) && bopq <= bdst) + au_fset_cpdown(*flags, PARENT_OPQ); + h_inode = d_inode(h_path.dentry); -+ mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + if (au_ftest_cpdown(*flags, WHED)) { + err = au_cpdown_dir_opq(dentry, bdst, flags); + if (unlikely(err)) { -+ mutex_unlock(&h_inode->i_mutex); ++ inode_unlock(h_inode); + goto out_dir; + } + } + + err = au_cpdown_attr(&h_path, au_h_dptr(dentry, btop)); -+ mutex_unlock(&h_inode->i_mutex); ++ inode_unlock(h_inode); + if (unlikely(err)) + goto out_opq; + @@ -30919,9 +32869,9 @@ index 0000000..492d7b4 + /* revert */ +out_opq: + if (au_ftest_cpdown(*flags, DIROPQ)) { -+ mutex_lock_nested(&h_inode->i_mutex, AuLsc_I_CHILD); ++ inode_lock_nested(h_inode, AuLsc_I_CHILD); + rerr = au_diropq_remove(dentry, bdst); -+ mutex_unlock(&h_inode->i_mutex); ++ inode_unlock(h_inode); + if (unlikely(rerr)) { + AuIOErr("failed removing diropq for %pd b%d (%d)\n", + dentry, bdst, rerr); @@ -31578,10 +33528,10 @@ index 0000000..492d7b4 +}; diff --git a/fs/aufs/whout.c b/fs/aufs/whout.c new file mode 100644 -index 0000000..1eb5aba +index 0000000..05c069e --- /dev/null +++ b/fs/aufs/whout.c -@@ -0,0 +1,1060 @@ +@@ -0,0 +1,1061 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -31775,7 +33725,8 @@ index 0000000..1eb5aba + + /* under the same dir, no need to lock_rename() */ + delegated = NULL; -+ err = vfsub_rename(h_dir, h_dentry, h_dir, &h_path, &delegated); ++ err = vfsub_rename(h_dir, h_dentry, h_dir, &h_path, &delegated, ++ /*flags*/0); + AuTraceErr(err); + if (unlikely(err == -EWOULDBLOCK)) { + pr_warn("cannot retry for NFSv4 delegation" @@ -32150,7 +34101,7 @@ index 0000000..1eb5aba + h_root = au_h_dptr(a->sb->s_root, bindex); + AuDebugOn(h_root != au_br_dentry(a->br)); + -+ au_hn_imtx_lock_nested(hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_PARENT); + wbr_wh_write_lock(wbr); + err = au_h_verify(wbr->wbr_whbase, au_opt_udba(a->sb), hdir->hi_inode, + h_root, a->br); @@ -32174,7 +34125,7 @@ index 0000000..1eb5aba + if (!err) + err = au_wh_init(a->br, a->sb); + wbr_wh_write_unlock(wbr); -+ au_hn_imtx_unlock(hdir); ++ au_hn_inode_unlock(hdir); + di_read_unlock(a->sb->s_root, AuLock_IR); + if (!err) + au_fhsm_wrote(a->sb, bindex, /*force*/0); @@ -32526,7 +34477,7 @@ index 0000000..1eb5aba + + br = au_sbr(dir->i_sb, bindex); + wh_inode = d_inode(wh_dentry); -+ mutex_lock_nested(&wh_inode->i_mutex, AuLsc_I_CHILD); ++ inode_lock_nested(wh_inode, AuLsc_I_CHILD); + + /* + * someone else might change some whiteouts while we were sleeping. @@ -32548,7 +34499,7 @@ index 0000000..1eb5aba + if (unlikely(wkq_err)) + err = wkq_err; + } -+ mutex_unlock(&wh_inode->i_mutex); ++ inode_unlock(wh_inode); + + if (!err) { + h_tmp.dentry = wh_dentry; @@ -32584,7 +34535,7 @@ index 0000000..1eb5aba + struct au_hinode *hdir; + + /* rmdir by nfsd may cause deadlock with this i_mutex */ -+ /* mutex_lock(&a->dir->i_mutex); */ ++ /* inode_lock(a->dir); */ + err = -EROFS; + sb = a->dir->i_sb; + si_read_lock(sb, !AuLock_FLUSH); @@ -32602,19 +34553,19 @@ index 0000000..1eb5aba + err = vfsub_mnt_want_write(au_br_mnt(a->br)); + if (unlikely(err)) + goto out_mnt; -+ au_hn_imtx_lock_nested(hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(hdir, AuLsc_I_PARENT); + err = au_h_verify(a->wh_dentry, au_opt_udba(sb), h_dir, h_parent, + a->br); + if (!err) + err = au_whtmp_rmdir(a->dir, bindex, a->wh_dentry, &a->whlist); -+ au_hn_imtx_unlock(hdir); ++ au_hn_inode_unlock(hdir); + vfsub_mnt_drop_write(au_br_mnt(a->br)); + +out_mnt: + dput(h_parent); + ii_write_unlock(a->dir); +out: -+ /* mutex_unlock(&a->dir->i_mutex); */ ++ /* inode_unlock(a->dir); */ + au_whtmp_rmdir_free(a); + si_read_unlock(sb); + au_nwt_done(&au_sbi(sb)->si_nowait); @@ -32735,10 +34686,10 @@ index 0000000..eb4b182 +#endif /* __AUFS_WHOUT_H__ */ diff --git a/fs/aufs/wkq.c b/fs/aufs/wkq.c new file mode 100644 -index 0000000..7371d91 +index 0000000..802571c --- /dev/null +++ b/fs/aufs/wkq.c -@@ -0,0 +1,213 @@ +@@ -0,0 +1,390 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -32777,10 +34728,177 @@ index 0000000..7371d91 + au_wkq_func_t func; + void *args; + ++#ifdef CONFIG_LOCKDEP ++ int dont_check; ++ struct held_lock **hlock; ++#endif ++ + struct completion *comp; +}; + +/* ---------------------------------------------------------------------- */ ++/* ++ * Aufs passes some operations to the workqueue such as the internal copyup. ++ * This scheme looks rather unnatural for LOCKDEP debugging feature, since the ++ * job run by workqueue depends upon the locks acquired in the other task. ++ * Delegating a small operation to the workqueue, aufs passes its lockdep ++ * information too. And the job in the workqueue restores the info in order to ++ * pretend as if it acquired those locks. This is just to make LOCKDEP work ++ * correctly and expectedly. ++ */ ++ ++#ifndef CONFIG_LOCKDEP ++AuStubInt0(au_wkq_lockdep_alloc, struct au_wkinfo *wkinfo); ++AuStubVoid(au_wkq_lockdep_free, struct au_wkinfo *wkinfo); ++AuStubVoid(au_wkq_lockdep_pre, struct au_wkinfo *wkinfo); ++AuStubVoid(au_wkq_lockdep_post, struct au_wkinfo *wkinfo); ++AuStubVoid(au_wkq_lockdep_init, struct au_wkinfo *wkinfo); ++#else ++static void au_wkq_lockdep_init(struct au_wkinfo *wkinfo) ++{ ++ wkinfo->hlock = NULL; ++ wkinfo->dont_check = 0; ++} ++ ++/* ++ * 1: matched ++ * 0: unmatched ++ */ ++static int au_wkq_lockdep_test(struct lock_class_key *key, const char *name) ++{ ++ static DEFINE_SPINLOCK(spin); ++ static struct { ++ char *name; ++ struct lock_class_key *key; ++ } a[] = { ++ { .name = "&sbinfo->si_rwsem" }, ++ { .name = "&finfo->fi_rwsem" }, ++ { .name = "&dinfo->di_rwsem" }, ++ { .name = "&iinfo->ii_rwsem" } ++ }; ++ static int set; ++ int i; ++ ++ /* lockless read from 'set.' see below */ ++ if (set == ARRAY_SIZE(a)) { ++ for (i = 0; i < ARRAY_SIZE(a); i++) ++ if (a[i].key == key) ++ goto match; ++ goto unmatch; ++ } ++ ++ spin_lock(&spin); ++ if (set) ++ for (i = 0; i < ARRAY_SIZE(a); i++) ++ if (a[i].key == key) { ++ spin_unlock(&spin); ++ goto match; ++ } ++ for (i = 0; i < ARRAY_SIZE(a); i++) { ++ if (a[i].key) { ++ if (unlikely(a[i].key == key)) { /* rare but possible */ ++ spin_unlock(&spin); ++ goto match; ++ } else ++ continue; ++ } ++ if (strstr(a[i].name, name)) { ++ /* ++ * the order of these three lines is important for the ++ * lockless read above. ++ */ ++ a[i].key = key; ++ spin_unlock(&spin); ++ set++; ++ /* AuDbg("%d, %s\n", set, name); */ ++ goto match; ++ } ++ } ++ spin_unlock(&spin); ++ goto unmatch; ++ ++match: ++ return 1; ++unmatch: ++ return 0; ++} ++ ++static int au_wkq_lockdep_alloc(struct au_wkinfo *wkinfo) ++{ ++ int err, n; ++ struct task_struct *curr; ++ struct held_lock **hl, *held_locks, *p; ++ ++ err = 0; ++ curr = current; ++ wkinfo->dont_check = lockdep_recursing(curr); ++ if (wkinfo->dont_check) ++ goto out; ++ n = curr->lockdep_depth; ++ if (!n) ++ goto out; ++ ++ err = -ENOMEM; ++ wkinfo->hlock = kmalloc_array(n + 1, sizeof(*wkinfo->hlock), GFP_NOFS); ++ if (unlikely(!wkinfo->hlock)) ++ goto out; ++ ++ err = 0; ++#if 0 ++ if (0 && au_debug_test()) /* left for debugging */ ++ lockdep_print_held_locks(curr); ++#endif ++ held_locks = curr->held_locks; ++ hl = wkinfo->hlock; ++ while (n--) { ++ p = held_locks++; ++ if (au_wkq_lockdep_test(p->instance->key, p->instance->name)) ++ *hl++ = p; ++ } ++ *hl = NULL; ++ ++out: ++ return err; ++} ++ ++static void au_wkq_lockdep_free(struct au_wkinfo *wkinfo) ++{ ++ kfree(wkinfo->hlock); ++} ++ ++static void au_wkq_lockdep_pre(struct au_wkinfo *wkinfo) ++{ ++ struct held_lock *p, **hl = wkinfo->hlock; ++ int subclass; ++ ++ if (wkinfo->dont_check) ++ lockdep_off(); ++ if (!hl) ++ return; ++ while ((p = *hl++)) { /* assignment */ ++ subclass = lockdep_hlock_class(p)->subclass; ++ /* AuDbg("%s, %d\n", p->instance->name, subclass); */ ++ if (p->read) ++ rwsem_acquire_read(p->instance, subclass, 0, ++ /*p->acquire_ip*/_RET_IP_); ++ else ++ rwsem_acquire(p->instance, subclass, 0, ++ /*p->acquire_ip*/_RET_IP_); ++ } ++} ++ ++static void au_wkq_lockdep_post(struct au_wkinfo *wkinfo) ++{ ++ struct held_lock *p, **hl = wkinfo->hlock; ++ ++ if (wkinfo->dont_check) ++ lockdep_on(); ++ if (!hl) ++ return; ++ while ((p = *hl++)) /* assignment */ ++ rwsem_release(p->instance, 0, /*p->acquire_ip*/_RET_IP_); ++} ++#endif + +static void wkq_func(struct work_struct *wk) +{ @@ -32789,7 +34907,9 @@ index 0000000..7371d91 + AuDebugOn(!uid_eq(current_fsuid(), GLOBAL_ROOT_UID)); + AuDebugOn(rlimit(RLIMIT_FSIZE) != RLIM_INFINITY); + ++ au_wkq_lockdep_pre(wkinfo); + wkinfo->func(wkinfo->args); ++ au_wkq_lockdep_post(wkinfo); + if (au_ftest_wkq(wkinfo->flags, WAIT)) + complete(wkinfo->comp); + else { @@ -32877,16 +34997,23 @@ index 0000000..7371d91 + }; + + err = au_wkq_comp_alloc(&wkinfo, &comp); ++ if (unlikely(err)) ++ goto out; ++ err = au_wkq_lockdep_alloc(&wkinfo); ++ if (unlikely(err)) ++ goto out_comp; + if (!err) { + au_wkq_run(&wkinfo); + /* no timeout, no interrupt */ + wait_for_completion(wkinfo.comp); -+ au_wkq_comp_free(comp); -+ destroy_work_on_stack(&wkinfo.wk); + } ++ au_wkq_lockdep_free(&wkinfo); + ++out_comp: ++ au_wkq_comp_free(comp); ++out: ++ destroy_work_on_stack(&wkinfo.wk); + return err; -+ +} + +/* @@ -32913,6 +35040,7 @@ index 0000000..7371d91 + wkinfo->func = func; + wkinfo->args = args; + wkinfo->comp = NULL; ++ au_wkq_lockdep_init(wkinfo); + kobject_get(wkinfo->kobj); + __module_get(THIS_MODULE); /* todo: ?? */ + @@ -32954,10 +35082,10 @@ index 0000000..7371d91 +} diff --git a/fs/aufs/wkq.h b/fs/aufs/wkq.h new file mode 100644 -index 0000000..a0a253b +index 0000000..ac1cd5e --- /dev/null +++ b/fs/aufs/wkq.h -@@ -0,0 +1,91 @@ +@@ -0,0 +1,93 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -32985,6 +35113,8 @@ index 0000000..a0a253b + +#ifdef __KERNEL__ + ++#include ++ +struct super_block; + +/* ---------------------------------------------------------------------- */ @@ -33051,10 +35181,10 @@ index 0000000..a0a253b +#endif /* __AUFS_WKQ_H__ */ diff --git a/fs/aufs/xattr.c b/fs/aufs/xattr.c new file mode 100644 -index 0000000..bee1da2 +index 0000000..ffff4ef --- /dev/null +++ b/fs/aufs/xattr.c -@@ -0,0 +1,363 @@ +@@ -0,0 +1,355 @@ +/* + * Copyright (C) 2014-2017 Junjiro R. Okajima + * @@ -33076,6 +35206,8 @@ index 0000000..bee1da2 + * handling xattr functions + */ + ++#include ++#include +#include +#include "aufs.h" + @@ -33145,9 +35277,9 @@ index 0000000..bee1da2 + + /* unlock it temporary */ + h_idst = d_inode(h_dst); -+ mutex_unlock(&h_idst->i_mutex); ++ inode_unlock(h_idst); + err = vfsub_setxattr(h_dst, name, *buf, ssz, /*flags*/0); -+ mutex_lock_nested(&h_idst->i_mutex, AuLsc_I_CHILD2); ++ inode_lock_nested(h_idst, AuLsc_I_CHILD2); + if (unlikely(err)) { + if (verbose || au_debug_test()) + pr_err("%s, err %d\n", name, err); @@ -33170,9 +35302,9 @@ index 0000000..bee1da2 + /* there should not be the parent-child relationship between them */ + h_isrc = d_inode(h_src); + h_idst = d_inode(h_dst); -+ mutex_unlock(&h_idst->i_mutex); -+ mutex_lock_nested(&h_isrc->i_mutex, AuLsc_I_CHILD); -+ mutex_lock_nested(&h_idst->i_mutex, AuLsc_I_CHILD2); ++ inode_unlock(h_idst); ++ vfsub_inode_lock_shared_nested(h_isrc, AuLsc_I_CHILD); ++ inode_lock_nested(h_idst, AuLsc_I_CHILD2); + unlocked = 0; + + /* some filesystems don't list POSIX ACL, for example tmpfs */ @@ -33197,7 +35329,7 @@ index 0000000..bee1da2 + goto out; + err = vfs_listxattr(h_src, p, ssz); + } -+ mutex_unlock(&h_isrc->i_mutex); ++ inode_unlock_shared(h_isrc); + unlocked = 1; + AuDbg("err %d, ssz %zd\n", err, ssz); + if (unlikely(err < 0)) @@ -33239,7 +35371,7 @@ index 0000000..bee1da2 + kfree(o); +out: + if (!unlocked) -+ mutex_unlock(&h_isrc->i_mutex); ++ inode_unlock_shared(h_isrc); + AuTraceErr(err); + return err; +} @@ -33307,6 +35439,7 @@ index 0000000..bee1da2 + arg->u.list.list, arg->u.list.size); + break; + case AU_XATTR_GET: ++ AuDebugOn(d_is_negative(h_path.dentry)); + err = vfs_getxattr(h_path.dentry, + arg->u.get.name, arg->u.get.value, + arg->u.get.size); @@ -33337,8 +35470,9 @@ index 0000000..bee1da2 + return au_lgxattr(dentry, &arg); +} + -+ssize_t aufs_getxattr(struct dentry *dentry, const char *name, void *value, -+ size_t size) ++static ssize_t au_getxattr(struct dentry *dentry, ++ struct inode *inode __maybe_unused, ++ const char *name, void *value, size_t size) +{ + struct au_lgxattr arg = { + .type = AU_XATTR_GET, @@ -33352,10 +35486,11 @@ index 0000000..bee1da2 + return au_lgxattr(dentry, &arg); +} + -+int aufs_setxattr(struct dentry *dentry, const char *name, const void *value, -+ size_t size, int flags) ++static int au_setxattr(struct dentry *dentry, struct inode *inode, ++ const char *name, const void *value, size_t size, ++ int flags) +{ -+ struct au_srxattr arg = { ++ struct au_sxattr arg = { + .type = AU_XATTR_SET, + .u.set = { + .name = name, @@ -33365,65 +35500,52 @@ index 0000000..bee1da2 + }, + }; + -+ return au_srxattr(dentry, &arg); -+} -+ -+int aufs_removexattr(struct dentry *dentry, const char *name) -+{ -+ struct au_srxattr arg = { -+ .type = AU_XATTR_REMOVE, -+ .u.remove = { -+ .name = name -+ }, -+ }; -+ -+ return au_srxattr(dentry, &arg); ++ return au_sxattr(dentry, inode, &arg); +} + +/* ---------------------------------------------------------------------- */ + -+#if 0 -+static size_t au_xattr_list(struct dentry *dentry, char *list, size_t list_size, -+ const char *name, size_t name_len, int type) -+{ -+ return aufs_listxattr(dentry, list, list_size); -+} -+ -+static int au_xattr_get(struct dentry *dentry, const char *name, void *buffer, -+ size_t size, int type) ++static int au_xattr_get(const struct xattr_handler *handler, ++ struct dentry *dentry, struct inode *inode, ++ const char *name, void *buffer, size_t size) +{ -+ return aufs_getxattr(dentry, name, buffer, size); ++ return au_getxattr(dentry, inode, name, buffer, size); +} + -+static int au_xattr_set(struct dentry *dentry, const char *name, -+ const void *value, size_t size, int flags, int type) ++static int au_xattr_set(const struct xattr_handler *handler, ++ struct dentry *dentry, struct inode *inode, ++ const char *name, const void *value, size_t size, ++ int flags) +{ -+ return aufs_setxattr(dentry, name, value, size, flags); ++ return au_setxattr(dentry, inode, name, value, size, flags); +} + +static const struct xattr_handler au_xattr_handler = { -+ /* no prefix, no flags */ -+ .list = au_xattr_list, ++ .name = "", ++ .prefix = "", + .get = au_xattr_get, + .set = au_xattr_set -+ /* why no remove? */ +}; + +static const struct xattr_handler *au_xattr_handlers[] = { -+ &au_xattr_handler ++#ifdef CONFIG_FS_POSIX_ACL ++ &posix_acl_access_xattr_handler, ++ &posix_acl_default_xattr_handler, ++#endif ++ &au_xattr_handler, /* must be last */ ++ NULL +}; + +void au_xattr_init(struct super_block *sb) +{ -+ /* sb->s_xattr = au_xattr_handlers; */ ++ sb->s_xattr = au_xattr_handlers; +} -+#endif diff --git a/fs/aufs/xino.c b/fs/aufs/xino.c new file mode 100644 -index 0000000..586f042 +index 0000000..6c12fe6 --- /dev/null +++ b/fs/aufs/xino.c -@@ -0,0 +1,1415 @@ +@@ -0,0 +1,1418 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -33570,8 +35692,11 @@ index 0000000..586f042 + lockdep_off(); + err = do_xino_fwrite(func, file, buf, size, pos); + lockdep_on(); -+ } else ++ } else { ++ lockdep_off(); + err = xino_fwrite_wkq(func, file, buf, size, pos); ++ lockdep_on(); ++ } + + return err; +} @@ -33656,7 +35781,7 @@ index 0000000..586f042 +struct au_xino_lock_dir { + struct au_hinode *hdir; + struct dentry *parent; -+ struct mutex *mtx; ++ struct inode *dir; +}; + +static void au_xino_lock_dir(struct super_block *sb, struct file *xino, @@ -33671,20 +35796,20 @@ index 0000000..586f042 + bindex = au_br_index(sb, brid); + if (bindex >= 0) { + ldir->hdir = au_hi(d_inode(sb->s_root), bindex); -+ au_hn_imtx_lock_nested(ldir->hdir, AuLsc_I_PARENT); ++ au_hn_inode_lock_nested(ldir->hdir, AuLsc_I_PARENT); + } else { + ldir->parent = dget_parent(xino->f_path.dentry); -+ ldir->mtx = &d_inode(ldir->parent)->i_mutex; -+ mutex_lock_nested(ldir->mtx, AuLsc_I_PARENT); ++ ldir->dir = d_inode(ldir->parent); ++ inode_lock_nested(ldir->dir, AuLsc_I_PARENT); + } +} + +static void au_xino_unlock_dir(struct au_xino_lock_dir *ldir) +{ + if (ldir->hdir) -+ au_hn_imtx_unlock(ldir->hdir); ++ au_hn_inode_unlock(ldir->hdir); + else { -+ mutex_unlock(ldir->mtx); ++ inode_unlock(ldir->dir); + dput(ldir->parent); + } +} @@ -34197,13 +36322,13 @@ index 0000000..586f042 + inode = file_inode(file); + h_parent = dget_parent(file->f_path.dentry); + h_dir = d_inode(h_parent); -+ mutex_lock_nested(&h_dir->i_mutex, AuLsc_I_PARENT); ++ inode_lock_nested(h_dir, AuLsc_I_PARENT); + /* mnt_want_write() is unnecessary here */ + /* no delegation since it is just created */ + if (inode->i_nlink) + err = vfsub_unlink(h_dir, &file->f_path, /*delegated*/NULL, + /*force*/0); -+ mutex_unlock(&h_dir->i_mutex); ++ inode_unlock(h_dir); + dput(h_parent); + if (unlikely(err)) { + if (!silent) @@ -34640,14 +36765,14 @@ index 0000000..586f042 + + au_opt_set(sbinfo->si_mntflags, XINO); + dir = d_inode(parent); -+ mutex_lock_nested(&dir->i_mutex, AuLsc_I_PARENT); ++ inode_lock_nested(dir, AuLsc_I_PARENT); + /* mnt_want_write() is unnecessary here */ + err = au_xino_set_xib(sb, xino->file); + if (!err) + err = au_xigen_set(sb, xino->file); + if (!err) + err = au_xino_set_br(sb, xino->file); -+ mutex_unlock(&dir->i_mutex); ++ inode_unlock(dir); + if (!err) + goto out; /* success */ + @@ -34840,10 +36965,10 @@ index 0000000..586f042 + return err; +} diff --git a/fs/dcache.c b/fs/dcache.c -index 5bf7b4a..75c08d4 100644 +index 34c852a..ccc2bcd 100644 --- a/fs/dcache.c +++ b/fs/dcache.c -@@ -1187,7 +1187,7 @@ enum d_walk_ret { +@@ -1197,7 +1197,7 @@ enum d_walk_ret { * * The @enter() and @finish() callbacks are called with d_lock held. */ @@ -34852,19 +36977,27 @@ index 5bf7b4a..75c08d4 100644 enum d_walk_ret (*enter)(void *, struct dentry *), void (*finish)(void *)) { -@@ -1292,6 +1292,7 @@ rename_retry: +@@ -1305,6 +1305,7 @@ static void d_walk(struct dentry *parent, void *data, seq = 1; goto again; } +EXPORT_SYMBOL_GPL(d_walk); - /* - * Search for at least 1 mount point in the dentry's subdirs. + struct check_mount { + struct vfsmount *mnt; +@@ -2894,6 +2895,7 @@ void d_exchange(struct dentry *dentry1, struct dentry *dentry2) + + write_sequnlock(&rename_lock); + } ++EXPORT_SYMBOL_GPL(d_exchange); + + /** + * d_ancestor - search for an ancestor diff --git a/fs/exec.c b/fs/exec.c -index 9c5ee2a..8823c26 100644 +index acec119..87ed1a3 100644 --- a/fs/exec.c +++ b/fs/exec.c -@@ -104,6 +104,7 @@ bool path_noexec(const struct path *path) +@@ -109,6 +109,7 @@ bool path_noexec(const struct path *path) return (path->mnt->mnt_flags & MNT_NOEXEC) || (path->mnt->mnt_sb->s_iflags & SB_I_NOEXEC); } @@ -34873,10 +37006,10 @@ index 9c5ee2a..8823c26 100644 #ifdef CONFIG_USELIB /* diff --git a/fs/fcntl.c b/fs/fcntl.c -index 5df9149..2e87e07 100644 +index 0345a46..e8c9dc3 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c -@@ -29,7 +29,7 @@ +@@ -32,7 +32,7 @@ #define SETFL_MASK (O_APPEND | O_NONBLOCK | O_NDELAY | O_DIRECT | O_NOATIME) @@ -34885,7 +37018,7 @@ index 5df9149..2e87e07 100644 { struct inode * inode = file_inode(filp); int error = 0; -@@ -59,6 +59,8 @@ static int setfl(int fd, struct file * filp, unsigned long arg) +@@ -63,6 +63,8 @@ static int setfl(int fd, struct file * filp, unsigned long arg) if (filp->f_op->check_flags) error = filp->f_op->check_flags(arg); @@ -34894,7 +37027,7 @@ index 5df9149..2e87e07 100644 if (error) return error; -@@ -79,6 +81,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg) +@@ -83,6 +85,7 @@ static int setfl(int fd, struct file * filp, unsigned long arg) out: return error; } @@ -34903,10 +37036,10 @@ index 5df9149..2e87e07 100644 static void f_modown(struct file *filp, struct pid *pid, enum pid_type type, int force) diff --git a/fs/file_table.c b/fs/file_table.c -index ad17e05..ae9f267 100644 +index 61517f5..c6bab39 100644 --- a/fs/file_table.c +++ b/fs/file_table.c -@@ -147,6 +147,7 @@ over: +@@ -148,6 +148,7 @@ struct file *get_empty_filp(void) } return ERR_PTR(-ENFILE); } @@ -34937,12 +37070,12 @@ index ad17e05..ae9f267 100644 +EXPORT_SYMBOL_GPL(put_filp); void __init files_init(void) - { + { diff --git a/fs/inode.c b/fs/inode.c -index b0edef5..c76d850 100644 +index d1e35b5..f31a6c7 100644 --- a/fs/inode.c +++ b/fs/inode.c -@@ -1584,7 +1584,7 @@ EXPORT_SYMBOL(generic_update_time); +@@ -1655,7 +1655,7 @@ EXPORT_SYMBOL(generic_update_time); * This does the actual work of updating an inodes time or version. Must have * had called mnt_want_write() before calling this. */ @@ -34951,7 +37084,7 @@ index b0edef5..c76d850 100644 { int (*update_time)(struct inode *, struct timespec *, int); -@@ -1593,6 +1593,7 @@ static int update_time(struct inode *inode, struct timespec *time, int flags) +@@ -1664,6 +1664,7 @@ static int update_time(struct inode *inode, struct timespec *time, int flags) return update_time(inode, time, flags); } @@ -34960,10 +37093,10 @@ index b0edef5..c76d850 100644 /** * touch_atime - update the access time diff --git a/fs/namespace.c b/fs/namespace.c -index ec4078d..29ede75 100644 +index adae9ff..c6254c4 100644 --- a/fs/namespace.c +++ b/fs/namespace.c -@@ -467,6 +467,7 @@ void __mnt_drop_write(struct vfsmount *mnt) +@@ -517,6 +517,7 @@ void __mnt_drop_write(struct vfsmount *mnt) mnt_dec_writers(real_mount(mnt)); preempt_enable(); } @@ -34971,7 +37104,21 @@ index ec4078d..29ede75 100644 /** * mnt_drop_write - give up write access to a mount -@@ -1834,6 +1835,7 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, +@@ -846,6 +847,13 @@ static inline int check_mnt(struct mount *mnt) + return mnt->mnt_ns == current->nsproxy->mnt_ns; + } + ++/* for aufs, CONFIG_AUFS_BR_FUSE */ ++int is_current_mnt_ns(struct vfsmount *mnt) ++{ ++ return check_mnt(real_mount(mnt)); ++} ++EXPORT_SYMBOL_GPL(is_current_mnt_ns); ++ + /* + * vfsmount lock must be held for write + */ +@@ -1881,6 +1889,7 @@ int iterate_mounts(int (*f)(struct vfsmount *, void *), void *arg, } return 0; } @@ -34980,7 +37127,7 @@ index ec4078d..29ede75 100644 static void cleanup_group_ids(struct mount *mnt, struct mount *end) { diff --git a/fs/notify/group.c b/fs/notify/group.c -index 18eb30c..f3ece77 100644 +index 3235753..14a2d48 100644 --- a/fs/notify/group.c +++ b/fs/notify/group.c @@ -22,6 +22,7 @@ @@ -34991,7 +37138,7 @@ index 18eb30c..f3ece77 100644 #include #include "fsnotify.h" -@@ -91,6 +92,7 @@ void fsnotify_get_group(struct fsnotify_group *group) +@@ -109,6 +110,7 @@ void fsnotify_get_group(struct fsnotify_group *group) { atomic_inc(&group->refcnt); } @@ -34999,7 +37146,7 @@ index 18eb30c..f3ece77 100644 /* * Drop a reference to a group. Free it if it's through. -@@ -100,6 +102,7 @@ void fsnotify_put_group(struct fsnotify_group *group) +@@ -118,6 +120,7 @@ void fsnotify_put_group(struct fsnotify_group *group) if (atomic_dec_and_test(&group->refcnt)) fsnotify_final_destroy_group(group); } @@ -35007,7 +37154,7 @@ index 18eb30c..f3ece77 100644 /* * Create a new fsnotify_group and hold a reference for the group returned. -@@ -128,6 +131,7 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops) +@@ -147,6 +150,7 @@ struct fsnotify_group *fsnotify_alloc_group(const struct fsnotify_ops *ops) return group; } @@ -35016,54 +37163,54 @@ index 18eb30c..f3ece77 100644 int fsnotify_fasync(int fd, struct file *file, int on) { diff --git a/fs/notify/mark.c b/fs/notify/mark.c -index fc0df44..8175f3c 100644 +index 258d990..9a80ee8 100644 --- a/fs/notify/mark.c +++ b/fs/notify/mark.c -@@ -109,6 +109,7 @@ void fsnotify_put_mark(struct fsnotify_mark *mark) - mark->free_mark(mark); - } +@@ -124,6 +124,7 @@ static void __fsnotify_recalc_mask(struct fsnotify_mark_connector *conn) + else if (conn->flags & FSNOTIFY_OBJ_TYPE_VFSMOUNT) + real_mount(conn->mnt)->mnt_fsnotify_mask = new_mask; } +EXPORT_SYMBOL_GPL(fsnotify_put_mark); - /* Calculate mask of events for a list of marks */ - u32 fsnotify_recalc_mask(struct hlist_head *head) -@@ -208,6 +209,7 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark, + /* + * Calculate mask of events for a list of marks. The caller must make sure +@@ -392,6 +393,7 @@ void fsnotify_destroy_mark(struct fsnotify_mark *mark, mutex_unlock(&group->mark_mutex); fsnotify_free_mark(mark); } +EXPORT_SYMBOL_GPL(fsnotify_destroy_mark); - void fsnotify_destroy_marks(struct hlist_head *head, spinlock_t *lock) - { -@@ -392,6 +394,7 @@ err: - + /* + * Sorting function for lists of fsnotify marks. +@@ -604,6 +606,7 @@ int fsnotify_add_mark_locked(struct fsnotify_mark *mark, struct inode *inode, + fsnotify_put_mark(mark); return ret; } +EXPORT_SYMBOL_GPL(fsnotify_add_mark); - int fsnotify_add_mark(struct fsnotify_mark *mark, struct fsnotify_group *group, - struct inode *inode, struct vfsmount *mnt, int allow_dups) -@@ -492,6 +495,7 @@ void fsnotify_init_mark(struct fsnotify_mark *mark, - atomic_set(&mark->refcnt, 1); - mark->free_mark = free_mark; + int fsnotify_add_mark(struct fsnotify_mark *mark, struct inode *inode, + struct vfsmount *mnt, int allow_dups) +@@ -739,6 +742,7 @@ void fsnotify_init_mark(struct fsnotify_mark *mark, + fsnotify_get_group(group); + mark->group = group; } +EXPORT_SYMBOL_GPL(fsnotify_init_mark); - static int fsnotify_mark_destroy(void *ignored) - { + /* + * Destroy all marks in destroy_list, waits for SRCU period to finish before diff --git a/fs/open.c b/fs/open.c -index fbc5c7b..6280e93 100644 +index 7ea1184..6e2e241 100644 --- a/fs/open.c +++ b/fs/open.c @@ -64,6 +64,7 @@ int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs, - mutex_unlock(&dentry->d_inode->i_mutex); + inode_unlock(dentry->d_inode); return ret; } +EXPORT_SYMBOL_GPL(do_truncate); - long vfs_truncate(struct path *path, loff_t length) + long vfs_truncate(const struct path *path, loff_t length) { -@@ -678,6 +679,7 @@ int open_check_o_direct(struct file *f) +@@ -691,6 +692,7 @@ int open_check_o_direct(struct file *f) } return 0; } @@ -35072,10 +37219,10 @@ index fbc5c7b..6280e93 100644 static int do_dentry_open(struct file *f, struct inode *inode, diff --git a/fs/proc/base.c b/fs/proc/base.c -index f7b1bea..21d86fb 100644 +index 9d357b2..11f4f23 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c -@@ -1918,7 +1918,7 @@ static int proc_map_files_get_link(struct dentry *dentry, struct path *path) +@@ -1988,7 +1988,7 @@ static int map_files_get_link(struct dentry *dentry, struct path *path) down_read(&mm->mmap_sem); vma = find_exact_vma(mm, vm_start, vm_end); if (vma && vma->vm_file) { @@ -35085,7 +37232,7 @@ index f7b1bea..21d86fb 100644 rc = 0; } diff --git a/fs/proc/nommu.c b/fs/proc/nommu.c -index f8595e8..cb8eda0 100644 +index 7563437..7c0dc0f 100644 --- a/fs/proc/nommu.c +++ b/fs/proc/nommu.c @@ -45,7 +45,10 @@ static int nommu_region_show(struct seq_file *m, struct vm_region *region) @@ -35101,10 +37248,10 @@ index f8595e8..cb8eda0 100644 ino = inode->i_ino; } diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index 12c4937..157a309 100644 +index 6744bd7..6d4dea3 100644 --- a/fs/proc/task_mmu.c +++ b/fs/proc/task_mmu.c -@@ -337,7 +337,10 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) +@@ -310,7 +310,10 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) const char *name = NULL; if (file) { @@ -35116,7 +37263,7 @@ index 12c4937..157a309 100644 dev = inode->i_sb->s_dev; ino = inode->i_ino; pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT; -@@ -1588,7 +1591,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) +@@ -1739,7 +1742,7 @@ static int show_numa_map(struct seq_file *m, void *v, int is_pid) struct proc_maps_private *proc_priv = &numa_priv->proc_maps; struct vm_area_struct *vma = v; struct numa_maps *md = &numa_priv->md; @@ -35126,10 +37273,10 @@ index 12c4937..157a309 100644 struct mm_walk walk = { .hugetlb_entry = gather_hugetlb_stats, diff --git a/fs/proc/task_nommu.c b/fs/proc/task_nommu.c -index faacb0c..17b43be 100644 +index 5b62f57..dfb4a3b 100644 --- a/fs/proc/task_nommu.c +++ b/fs/proc/task_nommu.c -@@ -163,7 +163,10 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma, +@@ -156,7 +156,10 @@ static int nommu_vma_show(struct seq_file *m, struct vm_area_struct *vma, file = vma->vm_file; if (file) { @@ -35142,12 +37289,20 @@ index faacb0c..17b43be 100644 ino = inode->i_ino; pgoff = (loff_t)vma->vm_pgoff << PAGE_SHIFT; diff --git a/fs/read_write.c b/fs/read_write.c -index bfd1a5d..f09c149 100644 +index 0046d72..b2a68e5 100644 --- a/fs/read_write.c +++ b/fs/read_write.c -@@ -494,6 +494,30 @@ ssize_t __vfs_write(struct file *file, const char __user *p, size_t count, +@@ -454,6 +454,7 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos) + + return ret; + } ++EXPORT_SYMBOL_GPL(vfs_read); + + static ssize_t new_sync_write(struct file *filp, const char __user *buf, size_t len, loff_t *ppos) + { +@@ -484,6 +485,30 @@ ssize_t __vfs_write(struct file *file, const char __user *p, size_t count, + return -EINVAL; } - EXPORT_SYMBOL(__vfs_write); +vfs_readf_t vfs_readf(struct file *file) +{ @@ -35173,14 +37328,22 @@ index bfd1a5d..f09c149 100644 +} +EXPORT_SYMBOL_GPL(vfs_writef); + - ssize_t __kernel_write(struct file *file, const char *buf, size_t count, loff_t *pos) + ssize_t __kernel_write(struct file *file, const void *buf, size_t count, loff_t *pos) { mm_segment_t old_fs; +@@ -552,6 +577,7 @@ ssize_t vfs_write(struct file *file, const char __user *buf, size_t count, loff_ + + return ret; + } ++EXPORT_SYMBOL_GPL(vfs_write); + + static inline loff_t file_pos_read(struct file *file) + { diff --git a/fs/splice.c b/fs/splice.c -index 8398974..220cff2 100644 +index f3084cc..7ab89d2 100644 --- a/fs/splice.c +++ b/fs/splice.c -@@ -1114,8 +1114,8 @@ EXPORT_SYMBOL(generic_splice_sendpage); +@@ -837,8 +837,8 @@ EXPORT_SYMBOL(generic_splice_sendpage); /* * Attempt to initiate a splice from pipe to file. */ @@ -35191,7 +37354,7 @@ index 8398974..220cff2 100644 { ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); -@@ -1127,13 +1127,14 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, +@@ -850,13 +850,14 @@ static long do_splice_from(struct pipe_inode_info *pipe, struct file *out, return splice_write(pipe, out, ppos, len, flags); } @@ -35209,7 +37372,7 @@ index 8398974..220cff2 100644 { ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); -@@ -1153,6 +1154,7 @@ static long do_splice_to(struct file *in, loff_t *ppos, +@@ -879,6 +880,7 @@ static long do_splice_to(struct file *in, loff_t *ppos, return splice_read(in, ppos, pipe, len, flags); } @@ -35218,10 +37381,10 @@ index 8398974..220cff2 100644 /** * splice_direct_to_actor - splices data directly between two non-pipes diff --git a/fs/sync.c b/fs/sync.c -index dd5d171..cd284a8 100644 +index 83ac79a..e3386ea 100644 --- a/fs/sync.c +++ b/fs/sync.c -@@ -27,7 +27,7 @@ +@@ -28,7 +28,7 @@ * wait == 1 case since in that case write_inode() functions do * sync_dirty_buffer() and thus effectively write one block at a time. */ @@ -35230,7 +37393,7 @@ index dd5d171..cd284a8 100644 { if (wait) sync_inodes_sb(sb); -@@ -38,6 +38,7 @@ static int __sync_filesystem(struct super_block *sb, int wait) +@@ -39,6 +39,7 @@ static int __sync_filesystem(struct super_block *sb, int wait) sb->s_op->sync_fs(sb, wait); return __sync_blockdev(sb->s_bdev, wait); } @@ -35239,42 +37402,42 @@ index dd5d171..cd284a8 100644 /* * Write out and wait upon all dirty data associated with this diff --git a/fs/xattr.c b/fs/xattr.c -index 76f01bf..7c72931 100644 +index 61cd28b..35570cd 100644 --- a/fs/xattr.c +++ b/fs/xattr.c -@@ -207,6 +207,7 @@ vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value, +@@ -297,6 +297,7 @@ vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value, *xattr_value = value; return error; } +EXPORT_SYMBOL_GPL(vfs_getxattr_alloc); - /* Compare an extended attribute value with the given value */ - int vfs_xattr_cmp(struct dentry *dentry, const char *xattr_name, + ssize_t + __vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name, diff --git a/include/linux/file.h b/include/linux/file.h -index f87d308..9a290b3 100644 +index 279720d..76e38ea 100644 --- a/include/linux/file.h +++ b/include/linux/file.h -@@ -19,6 +19,7 @@ struct dentry; +@@ -20,6 +20,7 @@ struct dentry; struct path; - extern struct file *alloc_file(struct path *, fmode_t mode, + extern struct file *alloc_file(const struct path *, fmode_t mode, const struct file_operations *fop); +extern struct file *get_empty_filp(void); static inline void fput_light(struct file *file, int fput_needed) { diff --git a/include/linux/fs.h b/include/linux/fs.h -index c8decb7..c949d92 100644 +index 440281f..cc0f438 100644 --- a/include/linux/fs.h +++ b/include/linux/fs.h -@@ -1274,6 +1274,7 @@ extern void fasync_free(struct fasync_struct *); +@@ -1265,6 +1265,7 @@ extern void fasync_free(struct fasync_struct *); /* can be called from interrupts */ extern void kill_fasync(struct fasync_struct **, int, int); +extern int setfl(int fd, struct file * filp, unsigned long arg); extern void __f_setown(struct file *filp, struct pid *, enum pid_type, int force); - extern void f_setown(struct file *filp, unsigned long arg, int force); + extern int f_setown(struct file *filp, unsigned long arg, int force); extern void f_delown(struct file *filp); -@@ -1660,6 +1661,7 @@ struct file_operations { +@@ -1711,6 +1712,7 @@ struct file_operations { ssize_t (*sendpage) (struct file *, struct page *, int, size_t, loff_t *, int); unsigned long (*get_unmapped_area)(struct file *, unsigned long, unsigned long, unsigned long, unsigned long); int (*check_flags)(int); @@ -35282,7 +37445,7 @@ index c8decb7..c949d92 100644 int (*flock) (struct file *, int, struct file_lock *); ssize_t (*splice_write)(struct pipe_inode_info *, struct file *, loff_t *, size_t, unsigned int); ssize_t (*splice_read)(struct file *, loff_t *, struct pipe_inode_info *, size_t, unsigned int); -@@ -1713,6 +1715,12 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, +@@ -1781,6 +1783,12 @@ ssize_t rw_copy_check_uvector(int type, const struct iovec __user * uvector, struct iovec *fast_pointer, struct iovec **ret_pointer); @@ -35293,9 +37456,9 @@ index c8decb7..c949d92 100644 +vfs_writef_t vfs_writef(struct file *file); + extern ssize_t __vfs_read(struct file *, char __user *, size_t, loff_t *); - extern ssize_t __vfs_write(struct file *, const char __user *, size_t, loff_t *); extern ssize_t vfs_read(struct file *, char __user *, size_t, loff_t *); -@@ -2062,6 +2070,7 @@ extern int current_umask(void); + extern ssize_t vfs_write(struct file *, const char __user *, size_t, loff_t *); +@@ -2183,6 +2191,7 @@ extern int current_umask(void); extern void ihold(struct inode * inode); extern void iput(struct inode *); extern int generic_update_time(struct inode *, struct timespec *, int); @@ -35303,19 +37466,40 @@ index c8decb7..c949d92 100644 /* /sys/fs */ extern struct kobject *fs_kobj; -@@ -2337,6 +2346,7 @@ static inline int sb_is_blkdev_sb(struct super_block *sb) - return 0; +@@ -2463,6 +2472,7 @@ static inline bool sb_is_blkdev_sb(struct super_block *sb) + return false; } #endif +extern int __sync_filesystem(struct super_block *, int); extern int sync_filesystem(struct super_block *); extern const struct file_operations def_blk_fops; extern const struct file_operations def_chr_fops; +diff --git a/include/linux/lockdep.h b/include/linux/lockdep.h +index f301d31..c26f5b4 100644 +--- a/include/linux/lockdep.h ++++ b/include/linux/lockdep.h +@@ -406,6 +406,8 @@ static inline int lockdep_match_key(struct lockdep_map *lock, + return lock->key == key; + } + ++struct lock_class *lockdep_hlock_class(struct held_lock *hlock); ++ + /* + * Acquire a lock. + * +@@ -530,6 +532,7 @@ struct lock_class_key { }; + + #define lockdep_depth(tsk) (0) + ++#define lockdep_is_held(lock) (1) + #define lockdep_is_held_type(l, r) (1) + + #define lockdep_assert_held(l) do { (void)(l); } while (0) diff --git a/include/linux/mm.h b/include/linux/mm.h -index e51aafb..a317754 100644 +index f50dead..f135141 100644 --- a/include/linux/mm.h +++ b/include/linux/mm.h -@@ -1197,6 +1197,28 @@ static inline int fixup_user_fault(struct task_struct *tsk, +@@ -1350,6 +1350,28 @@ static inline int fixup_user_fault(struct task_struct *tsk, } #endif @@ -35341,14 +37525,14 @@ index e51aafb..a317754 100644 +#define vmr_fput(region) vmr_do_fput(region, __func__, __LINE__) +#endif /* !CONFIG_MMU */ + - extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, int write); + extern int access_process_vm(struct task_struct *tsk, unsigned long addr, void *buf, int len, + unsigned int gup_flags); extern int access_remote_vm(struct mm_struct *mm, unsigned long addr, - void *buf, int len, int write); diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index b32cb7a..56e2863 100644 +index c85f11d..a63875a 100644 --- a/include/linux/mm_types.h +++ b/include/linux/mm_types.h -@@ -272,6 +272,7 @@ struct vm_region { +@@ -261,6 +261,7 @@ struct vm_region { unsigned long vm_top; /* region allocated to here */ unsigned long vm_pgoff; /* the offset in vm_file corresponding to vm_start */ struct file *vm_file; /* the backing file or NULL */ @@ -35356,22 +37540,41 @@ index b32cb7a..56e2863 100644 int vm_usage; /* region usage count (access under nommu_region_sem) */ bool vm_icache_flushed : 1; /* true if the icache has been flushed for -@@ -353,6 +354,7 @@ struct vm_area_struct { +@@ -335,6 +336,7 @@ struct vm_area_struct { unsigned long vm_pgoff; /* Offset (within vm_file) in PAGE_SIZE - units, *not* PAGE_CACHE_SIZE */ + units */ struct file * vm_file; /* File we map to (can be NULL). */ + struct file *vm_prfile; /* shadow of vm_file */ void * vm_private_data; /* was vm_pte (shared mem) */ - #ifndef CONFIG_MMU + atomic_long_t swap_readahead_info; +diff --git a/include/linux/mnt_namespace.h b/include/linux/mnt_namespace.h +index 3594208..24f5fd1 100644 +--- a/include/linux/mnt_namespace.h ++++ b/include/linux/mnt_namespace.h +@@ -6,11 +6,14 @@ + struct mnt_namespace; + struct fs_struct; + struct user_namespace; ++struct vfsmount; + + extern struct mnt_namespace *copy_mnt_ns(unsigned long, struct mnt_namespace *, + struct user_namespace *, struct fs_struct *); + extern void put_mnt_ns(struct mnt_namespace *ns); + ++extern int is_current_mnt_ns(struct vfsmount *mnt); ++ + extern const struct file_operations proc_mounts_operations; + extern const struct file_operations proc_mountinfo_operations; + extern const struct file_operations proc_mountstats_operations; diff --git a/include/linux/splice.h b/include/linux/splice.h -index da2751d..2e0fca6 100644 +index 74b4911..19789fb 100644 --- a/include/linux/splice.h +++ b/include/linux/splice.h -@@ -83,4 +83,10 @@ extern void splice_shrink_spd(struct splice_pipe_desc *); - extern void spd_release_page(struct splice_pipe_desc *, unsigned int); +@@ -87,4 +87,10 @@ extern void splice_shrink_spd(struct splice_pipe_desc *); extern const struct pipe_buf_operations page_cache_pipe_buf_ops; + extern const struct pipe_buf_operations default_pipe_buf_ops; + +extern long do_splice_from(struct pipe_inode_info *pipe, struct file *out, + loff_t *ppos, size_t len, unsigned int flags); @@ -35379,24 +37582,12 @@ index da2751d..2e0fca6 100644 + struct pipe_inode_info *pipe, size_t len, + unsigned int flags); #endif -diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild -index ebd10e6..32152e7 100644 ---- a/include/uapi/linux/Kbuild -+++ b/include/uapi/linux/Kbuild -@@ -59,6 +59,7 @@ header-y += atmsvc.h - header-y += atm_tcp.h - header-y += atm_zatm.h - header-y += audit.h -+header-y += aufs_type.h - header-y += auto_fs4.h - header-y += auto_fs.h - header-y += auxvec.h diff --git a/include/uapi/linux/aufs_type.h b/include/uapi/linux/aufs_type.h new file mode 100644 -index 0000000..aa5877d +index 0000000..82c2398 --- /dev/null +++ b/include/uapi/linux/aufs_type.h -@@ -0,0 +1,419 @@ +@@ -0,0 +1,447 @@ +/* + * Copyright (C) 2005-2017 Junjiro R. Okajima + * @@ -35438,7 +37629,7 @@ index 0000000..aa5877d + +#include + -+#define AUFS_VERSION "4.4-20170911" ++#define AUFS_VERSION "4.14-20171218" + +/* todo? move this to linux-2.6.19/include/magic.h */ +#define AUFS_SUPER_MAGIC ('a' << 24 | 'u' << 16 | 'f' << 8 | 's') @@ -35500,6 +37691,13 @@ index 0000000..aa5877d +#define AUFS_PLINK_MAINT_DIR "fs/" AUFS_NAME +#define AUFS_PLINK_MAINT_PATH AUFS_PLINK_MAINT_DIR "/" AUFS_PLINK_MAINT_NAME + ++/* dirren, renamed dir */ ++#define AUFS_DR_INFO_PFX AUFS_WH_PFX ".dr." ++#define AUFS_DR_BRHINO_NAME AUFS_WH_PFX "hino" ++/* whiteouted doubly */ ++#define AUFS_WH_DR_INFO_PFX AUFS_WH_PFX AUFS_DR_INFO_PFX ++#define AUFS_WH_DR_BRHINO AUFS_WH_PFX AUFS_DR_BRHINO_NAME ++ +#define AUFS_DIROPQ_NAME AUFS_WH_PFX ".opq" /* whiteouted doubly */ +#define AUFS_WH_DIROPQ AUFS_WH_PFX AUFS_DIROPQ_NAME + @@ -35718,6 +37916,27 @@ index 0000000..aa5877d + +/* ---------------------------------------------------------------------- */ + ++/* dirren. the branch is identified by the filename who contains this */ ++struct au_drinfo { ++ uint64_t ino; ++ union { ++ uint8_t oldnamelen; ++ uint64_t _padding; ++ }; ++ uint8_t oldname[0]; ++} __aligned(8); ++ ++struct au_drinfo_fdata { ++ uint32_t magic; ++ struct au_drinfo drinfo; ++} __aligned(8); ++ ++#define AUFS_DRINFO_MAGIC_V1 ('a' << 24 | 'd' << 16 | 'r' << 8 | 0x01) ++/* future */ ++#define AUFS_DRINFO_MAGIC_V2 ('a' << 24 | 'd' << 16 | 'r' << 8 | 0x02) ++ ++/* ---------------------------------------------------------------------- */ ++ +struct aufs_wbr_fd { + uint32_t oflags; + int16_t brid; @@ -35817,10 +38036,10 @@ index 0000000..aa5877d + +#endif /* __AUFS_TYPE_H__ */ diff --git a/kernel/fork.c b/kernel/fork.c -index f44790d..89a096c 100644 +index 500ce64..ea8729e 100644 --- a/kernel/fork.c +++ b/kernel/fork.c -@@ -472,7 +472,7 @@ static int dup_mmap(struct mm_struct *mm, struct mm_struct *oldmm) +@@ -676,7 +676,7 @@ static __latent_entropy int dup_mmap(struct mm_struct *mm, struct inode *inode = file_inode(file); struct address_space *mapping = file->f_mapping; @@ -35829,22 +38048,44 @@ index f44790d..89a096c 100644 if (tmp->vm_flags & VM_DENYWRITE) atomic_dec(&inode->i_writecount); i_mmap_lock_write(mapping); +diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c +index e36e652..895a1ba 100644 +--- a/kernel/locking/lockdep.c ++++ b/kernel/locking/lockdep.c +@@ -144,7 +144,7 @@ static struct lock_list list_entries[MAX_LOCKDEP_ENTRIES]; + unsigned long nr_lock_classes; + static struct lock_class lock_classes[MAX_LOCKDEP_KEYS]; + +-static inline struct lock_class *hlock_class(struct held_lock *hlock) ++inline struct lock_class *lockdep_hlock_class(struct held_lock *hlock) + { + if (!hlock->class_idx) { + /* +@@ -155,6 +155,8 @@ static inline struct lock_class *hlock_class(struct held_lock *hlock) + } + return lock_classes + hlock->class_idx - 1; + } ++EXPORT_SYMBOL_GPL(lockdep_hlock_class); ++#define hlock_class(hlock) lockdep_hlock_class(hlock) + + #ifdef CONFIG_LOCK_STAT + static DEFINE_PER_CPU(struct lock_class_stats[MAX_LOCKDEP_KEYS], cpu_lock_stats); diff --git a/kernel/task_work.c b/kernel/task_work.c -index 53fa971..bce3211 100644 +index 0fef395..83fb1ec 100644 --- a/kernel/task_work.c +++ b/kernel/task_work.c -@@ -118,3 +118,4 @@ void task_work_run(void) +@@ -116,3 +116,4 @@ void task_work_run(void) } while (work); } } +EXPORT_SYMBOL_GPL(task_work_run); diff --git a/mm/Makefile b/mm/Makefile -index 2ed4319..e3a53f5 100644 +index 4659b93..8448884 100644 --- a/mm/Makefile +++ b/mm/Makefile -@@ -21,7 +21,7 @@ obj-y := filemap.o mempool.o oom_kill.o \ +@@ -40,7 +40,7 @@ obj-y := filemap.o mempool.o oom_kill.o \ mm_init.o mmu_context.o percpu.o slab_common.o \ - compaction.o vmacache.o \ + compaction.o vmacache.o swap_slots.o \ interval_tree.o list_lru.o workingset.o \ - debug.o $(mmu-y) + prfile.o debug.o $(mmu-y) @@ -35852,36 +38093,23 @@ index 2ed4319..e3a53f5 100644 obj-y += init-mm.o diff --git a/mm/filemap.c b/mm/filemap.c -index 69f75c7..9cacd97 100644 +index 594d73f..7183aef 100644 --- a/mm/filemap.c +++ b/mm/filemap.c -@@ -2143,7 +2143,7 @@ int filemap_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) +@@ -2590,7 +2590,7 @@ int filemap_page_mkwrite(struct vm_fault *vmf) int ret = VM_FAULT_LOCKED; sb_start_pagefault(inode->i_sb); -- file_update_time(vma->vm_file); -+ vma_file_update_time(vma); +- file_update_time(vmf->vma->vm_file); ++ vma_file_update_time(vmf->vma); lock_page(page); if (page->mapping != inode->i_mapping) { unlock_page(page); -diff --git a/mm/memory.c b/mm/memory.c -index 9ac5517..0bac6d9 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -2076,7 +2076,7 @@ static inline int wp_page_reuse(struct mm_struct *mm, - } - - if (!page_mkwrite) -- file_update_time(vma->vm_file); -+ vma_file_update_time(vma); - } - - return VM_FAULT_WRITE; diff --git a/mm/mmap.c b/mm/mmap.c -index 859adf2..acebb7f 100644 +index 0de87a3..59329bd 100644 --- a/mm/mmap.c +++ b/mm/mmap.c -@@ -287,7 +287,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) +@@ -171,7 +171,7 @@ static struct vm_area_struct *remove_vma(struct vm_area_struct *vma) if (vma->vm_ops && vma->vm_ops->close) vma->vm_ops->close(vma); if (vma->vm_file) @@ -35890,7 +38118,7 @@ index 859adf2..acebb7f 100644 mpol_put(vma_policy(vma)); kmem_cache_free(vm_area_cachep, vma); return next; -@@ -917,7 +917,7 @@ again: remove_next = 1 + (end > next->vm_end); +@@ -896,7 +896,7 @@ int __vma_adjust(struct vm_area_struct *vma, unsigned long start, if (remove_next) { if (file) { uprobe_munmap(next, next->vm_start, next->vm_end); @@ -35899,7 +38127,7 @@ index 859adf2..acebb7f 100644 } if (next->anon_vma) anon_vma_merge(vma, next); -@@ -1720,8 +1720,8 @@ out: +@@ -1746,8 +1746,8 @@ unsigned long mmap_region(struct file *file, unsigned long addr, return addr; unmap_and_free_vma: @@ -35909,7 +38137,7 @@ index 859adf2..acebb7f 100644 /* Undo any partial mapping done by a device driver. */ unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end); -@@ -2540,7 +2540,7 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2571,7 +2571,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, goto out_free_mpol; if (new->vm_file) @@ -35918,7 +38146,7 @@ index 859adf2..acebb7f 100644 if (new->vm_ops && new->vm_ops->open) new->vm_ops->open(new); -@@ -2559,7 +2559,7 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, +@@ -2590,7 +2590,7 @@ int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma, if (new->vm_ops && new->vm_ops->close) new->vm_ops->close(new); if (new->vm_file) @@ -35927,16 +38155,16 @@ index 859adf2..acebb7f 100644 unlink_anon_vmas(new); out_free_mpol: mpol_put(vma_policy(new)); -@@ -2702,7 +2702,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, +@@ -2752,7 +2752,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, struct vm_area_struct *vma; unsigned long populate = 0; unsigned long ret = -EINVAL; - struct file *file; + struct file *file, *prfile; - pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. " - "See Documentation/vm/remap_file_pages.txt.\n", -@@ -2770,10 +2770,27 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, + pr_warn_once("%s (%d) uses deprecated remap_file_pages() syscall. See Documentation/vm/remap_file_pages.txt.\n", + current->comm, current->pid); +@@ -2827,10 +2827,27 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size, } } @@ -35945,7 +38173,7 @@ index 859adf2..acebb7f 100644 + file = vma->vm_file; + prfile = vma->vm_prfile; ret = do_mmap_pgoff(vma->vm_file, start, size, - prot, flags, pgoff, &populate); + prot, flags, pgoff, &populate, NULL); + if (!IS_ERR_VALUE(ret) && file && prfile) { + struct vm_area_struct *new_vma; + @@ -35965,7 +38193,7 @@ index 859adf2..acebb7f 100644 out: up_write(&mm->mmap_sem); if (populate) -@@ -3043,7 +3060,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, +@@ -3138,7 +3155,7 @@ struct vm_area_struct *copy_vma(struct vm_area_struct **vmap, if (anon_vma_clone(new_vma, vma)) goto out_free_mempol; if (new_vma->vm_file) @@ -35975,10 +38203,10 @@ index 859adf2..acebb7f 100644 new_vma->vm_ops->open(new_vma); vma_link(mm, new_vma, prev, rb_link, rb_parent); diff --git a/mm/nommu.c b/mm/nommu.c -index 92be862..29179f7 100644 +index 17c00d9..4bcdf94 100644 --- a/mm/nommu.c +++ b/mm/nommu.c -@@ -671,7 +671,7 @@ static void __put_nommu_region(struct vm_region *region) +@@ -641,7 +641,7 @@ static void __put_nommu_region(struct vm_region *region) up_write(&nommu_region_sem); if (region->vm_file) @@ -35987,7 +38215,7 @@ index 92be862..29179f7 100644 /* IO memory and memory shared directly out of the pagecache * from ramfs/tmpfs mustn't be released here */ -@@ -829,7 +829,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma) +@@ -799,7 +799,7 @@ static void delete_vma(struct mm_struct *mm, struct vm_area_struct *vma) if (vma->vm_ops && vma->vm_ops->close) vma->vm_ops->close(vma); if (vma->vm_file) @@ -35996,7 +38224,7 @@ index 92be862..29179f7 100644 put_nommu_region(vma->vm_region); kmem_cache_free(vm_area_cachep, vma); } -@@ -1355,7 +1355,7 @@ unsigned long do_mmap(struct file *file, +@@ -1321,7 +1321,7 @@ unsigned long do_mmap(struct file *file, goto error_just_free; } } @@ -36005,7 +38233,7 @@ index 92be862..29179f7 100644 kmem_cache_free(vm_region_jar, region); region = pregion; result = start; -@@ -1430,10 +1430,10 @@ error_just_free: +@@ -1396,10 +1396,10 @@ unsigned long do_mmap(struct file *file, up_write(&nommu_region_sem); error: if (region->vm_file) @@ -36020,11 +38248,12 @@ index 92be862..29179f7 100644 diff --git a/mm/prfile.c b/mm/prfile.c new file mode 100644 -index 0000000..1ef053b +index 0000000..3f56669 --- /dev/null +++ b/mm/prfile.c -@@ -0,0 +1,85 @@ +@@ -0,0 +1,86 @@ +/* ++ * SPDX-License-Identifier: GPL-2.0 + * Mainly for aufs which mmap(2) different file and wants to print different + * path in /proc/PID/maps. + * Call these functions via macros defined in linux/mm.h. @@ -36110,10 +38339,10 @@ index 0000000..1ef053b +} +#endif /* !CONFIG_MMU */ diff --git a/security/commoncap.c b/security/commoncap.c -index 7fa251a..b965cb1 100644 +index 7b01431..0e157a3 100644 --- a/security/commoncap.c +++ b/security/commoncap.c -@@ -1069,12 +1069,14 @@ int cap_mmap_addr(unsigned long addr) +@@ -1267,12 +1267,14 @@ int cap_mmap_addr(unsigned long addr) } return ret; } @@ -36129,10 +38358,10 @@ index 7fa251a..b965cb1 100644 #ifdef CONFIG_SECURITY diff --git a/security/device_cgroup.c b/security/device_cgroup.c -index 03c1652..f88c84b 100644 +index 5ef7e52..e2e959d 100644 --- a/security/device_cgroup.c +++ b/security/device_cgroup.c -@@ -7,6 +7,7 @@ +@@ -8,6 +8,7 @@ #include #include #include @@ -36140,7 +38369,7 @@ index 03c1652..f88c84b 100644 #include #include #include -@@ -849,6 +850,7 @@ int __devcgroup_inode_permission(struct inode *inode, int mask) +@@ -850,6 +851,7 @@ int __devcgroup_inode_permission(struct inode *inode, int mask) return __devcgroup_check_permission(type, imajor(inode), iminor(inode), access); } @@ -36149,58 +38378,58 @@ index 03c1652..f88c84b 100644 int devcgroup_inode_mknod(int mode, dev_t dev) { diff --git a/security/security.c b/security/security.c -index 46f405c..bc8514e 100644 +index 4bf0f57..b30d1e1 100644 --- a/security/security.c +++ b/security/security.c -@@ -433,6 +433,7 @@ int security_path_rmdir(struct path *dir, struct dentry *dentry) +@@ -530,6 +530,7 @@ int security_path_rmdir(const struct path *dir, struct dentry *dentry) return 0; return call_int_hook(path_rmdir, 0, dir, dentry); } +EXPORT_SYMBOL_GPL(security_path_rmdir); - int security_path_unlink(struct path *dir, struct dentry *dentry) + int security_path_unlink(const struct path *dir, struct dentry *dentry) { -@@ -449,6 +450,7 @@ int security_path_symlink(struct path *dir, struct dentry *dentry, +@@ -546,6 +547,7 @@ int security_path_symlink(const struct path *dir, struct dentry *dentry, return 0; return call_int_hook(path_symlink, 0, dir, dentry, old_name); } +EXPORT_SYMBOL_GPL(security_path_symlink); - int security_path_link(struct dentry *old_dentry, struct path *new_dir, + int security_path_link(struct dentry *old_dentry, const struct path *new_dir, struct dentry *new_dentry) -@@ -457,6 +459,7 @@ int security_path_link(struct dentry *old_dentry, struct path *new_dir, +@@ -554,6 +556,7 @@ int security_path_link(struct dentry *old_dentry, const struct path *new_dir, return 0; return call_int_hook(path_link, 0, old_dentry, new_dir, new_dentry); } +EXPORT_SYMBOL_GPL(security_path_link); - int security_path_rename(struct path *old_dir, struct dentry *old_dentry, - struct path *new_dir, struct dentry *new_dentry, -@@ -484,6 +487,7 @@ int security_path_truncate(struct path *path) + int security_path_rename(const struct path *old_dir, struct dentry *old_dentry, + const struct path *new_dir, struct dentry *new_dentry, +@@ -581,6 +584,7 @@ int security_path_truncate(const struct path *path) return 0; return call_int_hook(path_truncate, 0, path); } +EXPORT_SYMBOL_GPL(security_path_truncate); - int security_path_chmod(struct path *path, umode_t mode) + int security_path_chmod(const struct path *path, umode_t mode) { -@@ -491,6 +495,7 @@ int security_path_chmod(struct path *path, umode_t mode) +@@ -588,6 +592,7 @@ int security_path_chmod(const struct path *path, umode_t mode) return 0; return call_int_hook(path_chmod, 0, path, mode); } +EXPORT_SYMBOL_GPL(security_path_chmod); - int security_path_chown(struct path *path, kuid_t uid, kgid_t gid) + int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) { -@@ -498,6 +503,7 @@ int security_path_chown(struct path *path, kuid_t uid, kgid_t gid) +@@ -595,6 +600,7 @@ int security_path_chown(const struct path *path, kuid_t uid, kgid_t gid) return 0; return call_int_hook(path_chown, 0, path, uid, gid); } +EXPORT_SYMBOL_GPL(security_path_chown); - int security_path_chroot(struct path *path) + int security_path_chroot(const struct path *path) { -@@ -583,6 +589,7 @@ int security_inode_readlink(struct dentry *dentry) +@@ -680,6 +686,7 @@ int security_inode_readlink(struct dentry *dentry) return 0; return call_int_hook(inode_readlink, 0, dentry); } @@ -36208,7 +38437,7 @@ index 46f405c..bc8514e 100644 int security_inode_follow_link(struct dentry *dentry, struct inode *inode, bool rcu) -@@ -598,6 +605,7 @@ int security_inode_permission(struct inode *inode, int mask) +@@ -695,6 +702,7 @@ int security_inode_permission(struct inode *inode, int mask) return 0; return call_int_hook(inode_permission, 0, inode, mask); } @@ -36216,7 +38445,7 @@ index 46f405c..bc8514e 100644 int security_inode_setattr(struct dentry *dentry, struct iattr *attr) { -@@ -736,6 +744,7 @@ int security_file_permission(struct file *file, int mask) +@@ -866,6 +874,7 @@ int security_file_permission(struct file *file, int mask) return fsnotify_perm(file, mask); } @@ -36224,7 +38453,7 @@ index 46f405c..bc8514e 100644 int security_file_alloc(struct file *file) { -@@ -795,6 +804,7 @@ int security_mmap_file(struct file *file, unsigned long prot, +@@ -925,6 +934,7 @@ int security_mmap_file(struct file *file, unsigned long prot, return ret; return ima_file_mmap(file, prot); } diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.52-53.patch b/patch/kernel/mvebu64-default/03-patch-4.4.52-53.patch deleted file mode 100644 index e4bbcaf9566e..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.52-53.patch +++ /dev/null @@ -1,8420 +0,0 @@ -diff --git a/Documentation/Makefile b/Documentation/Makefile -index bc0548201755..fc759598c4c9 100644 ---- a/Documentation/Makefile -+++ b/Documentation/Makefile -@@ -1,4 +1,4 @@ - subdir-y := accounting auxdisplay blackfin connector \ -- filesystems filesystems ia64 laptops mic misc-devices \ -+ filesystems filesystems ia64 laptops misc-devices \ - networking pcmcia prctl ptp spi timers vDSO video4linux \ - watchdog -diff --git a/Documentation/mic/Makefile b/Documentation/mic/Makefile -deleted file mode 100644 -index a191d453badf..000000000000 ---- a/Documentation/mic/Makefile -+++ /dev/null -@@ -1 +0,0 @@ --subdir-y := mpssd -diff --git a/Documentation/mic/mpssd/.gitignore b/Documentation/mic/mpssd/.gitignore -deleted file mode 100644 -index 8b7c72f07c92..000000000000 ---- a/Documentation/mic/mpssd/.gitignore -+++ /dev/null -@@ -1 +0,0 @@ --mpssd -diff --git a/Documentation/mic/mpssd/Makefile b/Documentation/mic/mpssd/Makefile -deleted file mode 100644 -index 06871b0c08a6..000000000000 ---- a/Documentation/mic/mpssd/Makefile -+++ /dev/null -@@ -1,21 +0,0 @@ --ifndef CROSS_COMPILE --# List of programs to build --hostprogs-$(CONFIG_X86_64) := mpssd -- --mpssd-objs := mpssd.o sysfs.o -- --# Tell kbuild to always build the programs --always := $(hostprogs-y) -- --HOSTCFLAGS += -I$(objtree)/usr/include -I$(srctree)/tools/include -- --ifdef DEBUG --HOSTCFLAGS += -DDEBUG=$(DEBUG) --endif -- --HOSTLOADLIBES_mpssd := -lpthread -- --install: -- install mpssd /usr/sbin/mpssd -- install micctrl /usr/sbin/micctrl --endif -diff --git a/Documentation/mic/mpssd/micctrl b/Documentation/mic/mpssd/micctrl -deleted file mode 100755 -index 8f2629b41c5f..000000000000 ---- a/Documentation/mic/mpssd/micctrl -+++ /dev/null -@@ -1,173 +0,0 @@ --#!/bin/bash --# Intel MIC Platform Software Stack (MPSS) --# --# Copyright(c) 2013 Intel Corporation. --# --# This program is free software; you can redistribute it and/or modify --# it under the terms of the GNU General Public License, version 2, as --# published by the Free Software Foundation. --# --# This program is distributed in the hope that it will be useful, but --# WITHOUT ANY WARRANTY; without even the implied warranty of --# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU --# General Public License for more details. --# --# The full GNU General Public License is included in this distribution in --# the file called "COPYING". --# --# Intel MIC User Space Tools. --# --# micctrl - Controls MIC boot/start/stop. --# --# chkconfig: 2345 95 05 --# description: start MPSS stack processing. --# --### BEGIN INIT INFO --# Provides: micctrl --### END INIT INFO -- --# Source function library. --. /etc/init.d/functions -- --sysfs="/sys/class/mic" -- --_status() --{ -- f=$sysfs/$1 -- echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`" --} -- --status() --{ -- if [ "`echo $1 | head -c3`" == "mic" ]; then -- _status $1 -- return $? -- fi -- for f in $sysfs/* -- do -- _status `basename $f` -- RETVAL=$? -- [ $RETVAL -ne 0 ] && return $RETVAL -- done -- return 0 --} -- --_reset() --{ -- f=$sysfs/$1 -- echo reset > $f/state --} -- --reset() --{ -- if [ "`echo $1 | head -c3`" == "mic" ]; then -- _reset $1 -- return $? -- fi -- for f in $sysfs/* -- do -- _reset `basename $f` -- RETVAL=$? -- [ $RETVAL -ne 0 ] && return $RETVAL -- done -- return 0 --} -- --_boot() --{ -- f=$sysfs/$1 -- echo "linux" > $f/bootmode -- echo "mic/uos.img" > $f/firmware -- echo "mic/$1.image" > $f/ramdisk -- echo "boot" > $f/state --} -- --boot() --{ -- if [ "`echo $1 | head -c3`" == "mic" ]; then -- _boot $1 -- return $? -- fi -- for f in $sysfs/* -- do -- _boot `basename $f` -- RETVAL=$? -- [ $RETVAL -ne 0 ] && return $RETVAL -- done -- return 0 --} -- --_shutdown() --{ -- f=$sysfs/$1 -- echo shutdown > $f/state --} -- --shutdown() --{ -- if [ "`echo $1 | head -c3`" == "mic" ]; then -- _shutdown $1 -- return $? -- fi -- for f in $sysfs/* -- do -- _shutdown `basename $f` -- RETVAL=$? -- [ $RETVAL -ne 0 ] && return $RETVAL -- done -- return 0 --} -- --_wait() --{ -- f=$sysfs/$1 -- while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ] -- do -- sleep 1 -- echo -e "Waiting for $1 to go offline" -- done --} -- --wait() --{ -- if [ "`echo $1 | head -c3`" == "mic" ]; then -- _wait $1 -- return $? -- fi -- # Wait for the cards to go offline -- for f in $sysfs/* -- do -- _wait `basename $f` -- RETVAL=$? -- [ $RETVAL -ne 0 ] && return $RETVAL -- done -- return 0 --} -- --if [ ! -d "$sysfs" ]; then -- echo -e $"Module unloaded " -- exit 3 --fi -- --case $1 in -- -s) -- status $2 -- ;; -- -r) -- reset $2 -- ;; -- -b) -- boot $2 -- ;; -- -S) -- shutdown $2 -- ;; -- -w) -- wait $2 -- ;; -- *) -- echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}" -- exit 2 --esac -- --exit $? -diff --git a/Documentation/mic/mpssd/mpss b/Documentation/mic/mpssd/mpss -deleted file mode 100755 -index 09ea90931649..000000000000 ---- a/Documentation/mic/mpssd/mpss -+++ /dev/null -@@ -1,200 +0,0 @@ --#!/bin/bash --# Intel MIC Platform Software Stack (MPSS) --# --# Copyright(c) 2013 Intel Corporation. --# --# This program is free software; you can redistribute it and/or modify --# it under the terms of the GNU General Public License, version 2, as --# published by the Free Software Foundation. --# --# This program is distributed in the hope that it will be useful, but --# WITHOUT ANY WARRANTY; without even the implied warranty of --# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU --# General Public License for more details. --# --# The full GNU General Public License is included in this distribution in --# the file called "COPYING". --# --# Intel MIC User Space Tools. --# --# mpss Start mpssd. --# --# chkconfig: 2345 95 05 --# description: start MPSS stack processing. --# --### BEGIN INIT INFO --# Provides: mpss --# Required-Start: --# Required-Stop: --# Short-Description: MPSS stack control --# Description: MPSS stack control --### END INIT INFO -- --# Source function library. --. /etc/init.d/functions -- --exec=/usr/sbin/mpssd --sysfs="/sys/class/mic" --mic_modules="mic_host mic_x100_dma scif" -- --start() --{ -- [ -x $exec ] || exit 5 -- -- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then -- echo -e $"MPSSD already running! " -- success -- echo -- return 0 -- fi -- -- echo -e $"Starting MPSS Stack" -- echo -e $"Loading MIC drivers:" $mic_modules -- -- modprobe -a $mic_modules -- RETVAL=$? -- if [ $RETVAL -ne 0 ]; then -- failure -- echo -- return $RETVAL -- fi -- -- # Start the daemon -- echo -n $"Starting MPSSD " -- $exec -- RETVAL=$? -- if [ $RETVAL -ne 0 ]; then -- failure -- echo -- return $RETVAL -- fi -- success -- echo -- -- sleep 5 -- -- # Boot the cards -- micctrl -b -- -- # Wait till ping works -- for f in $sysfs/* -- do -- count=100 -- ipaddr=`cat $f/cmdline` -- ipaddr=${ipaddr#*address,} -- ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1` -- while [ $count -ge 0 ] -- do -- echo -e "Pinging "`basename $f`" " -- ping -c 1 $ipaddr &> /dev/null -- RETVAL=$? -- if [ $RETVAL -eq 0 ]; then -- success -- break -- fi -- sleep 1 -- count=`expr $count - 1` -- done -- [ $RETVAL -ne 0 ] && failure || success -- echo -- done -- return $RETVAL --} -- --stop() --{ -- echo -e $"Shutting down MPSS Stack: " -- -- # Bail out if module is unloaded -- if [ ! -d "$sysfs" ]; then -- echo -n $"Module unloaded " -- success -- echo -- return 0 -- fi -- -- # Shut down the cards. -- micctrl -S -- -- # Wait for the cards to go offline -- for f in $sysfs/* -- do -- while [ "`cat $f/state`" != "ready" ] -- do -- sleep 1 -- echo -e "Waiting for "`basename $f`" to become ready" -- done -- done -- -- # Display the status of the cards -- micctrl -s -- -- # Kill MPSSD now -- echo -n $"Killing MPSSD" -- killall -9 mpssd 2>/dev/null -- RETVAL=$? -- [ $RETVAL -ne 0 ] && failure || success -- echo -- return $RETVAL --} -- --restart() --{ -- stop -- sleep 5 -- start --} -- --status() --{ -- micctrl -s -- if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then -- echo "mpssd is running" -- else -- echo "mpssd is stopped" -- fi -- return 0 --} -- --unload() --{ -- if [ ! -d "$sysfs" ]; then -- echo -n $"No MIC_HOST Module: " -- success -- echo -- return -- fi -- -- stop -- -- sleep 5 -- echo -n $"Removing MIC drivers:" $mic_modules -- modprobe -r $mic_modules -- RETVAL=$? -- [ $RETVAL -ne 0 ] && failure || success -- echo -- return $RETVAL --} -- --case $1 in -- start) -- start -- ;; -- stop) -- stop -- ;; -- restart) -- restart -- ;; -- status) -- status -- ;; -- unload) -- unload -- ;; -- *) -- echo $"Usage: $0 {start|stop|restart|status|unload}" -- exit 2 --esac -- --exit $? -diff --git a/Documentation/mic/mpssd/mpssd.c b/Documentation/mic/mpssd/mpssd.c -deleted file mode 100644 -index c99a75968c01..000000000000 ---- a/Documentation/mic/mpssd/mpssd.c -+++ /dev/null -@@ -1,1826 +0,0 @@ --/* -- * Intel MIC Platform Software Stack (MPSS) -- * -- * Copyright(c) 2013 Intel Corporation. -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License, version 2, as -- * published by the Free Software Foundation. -- * -- * This program is distributed in the hope that it will be useful, but -- * WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -- * General Public License for more details. -- * -- * The full GNU General Public License is included in this distribution in -- * the file called "COPYING". -- * -- * Intel MIC User Space Tools. -- */ -- --#define _GNU_SOURCE -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include "mpssd.h" --#include --#include --#include -- --static void *init_mic(void *arg); -- --static FILE *logfp; --static struct mic_info mic_list; -- --#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) -- --#define min_t(type, x, y) ({ \ -- type __min1 = (x); \ -- type __min2 = (y); \ -- __min1 < __min2 ? __min1 : __min2; }) -- --/* align addr on a size boundary - adjust address up/down if needed */ --#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1))) --#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size) -- --/* align addr on a size boundary - adjust address up if needed */ --#define _ALIGN(addr, size) _ALIGN_UP(addr, size) -- --/* to align the pointer to the (next) page boundary */ --#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE) -- --#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x)) -- --#define GSO_ENABLED 1 --#define MAX_GSO_SIZE (64 * 1024) --#define ETH_H_LEN 14 --#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64)) --#define MIC_DEVICE_PAGE_END 0x1000 -- --#ifndef VIRTIO_NET_HDR_F_DATA_VALID --#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */ --#endif -- --static struct { -- struct mic_device_desc dd; -- struct mic_vqconfig vqconfig[2]; -- __u32 host_features, guest_acknowledgements; -- struct virtio_console_config cons_config; --} virtcons_dev_page = { -- .dd = { -- .type = VIRTIO_ID_CONSOLE, -- .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig), -- .feature_len = sizeof(virtcons_dev_page.host_features), -- .config_len = sizeof(virtcons_dev_page.cons_config), -- }, -- .vqconfig[0] = { -- .num = htole16(MIC_VRING_ENTRIES), -- }, -- .vqconfig[1] = { -- .num = htole16(MIC_VRING_ENTRIES), -- }, --}; -- --static struct { -- struct mic_device_desc dd; -- struct mic_vqconfig vqconfig[2]; -- __u32 host_features, guest_acknowledgements; -- struct virtio_net_config net_config; --} virtnet_dev_page = { -- .dd = { -- .type = VIRTIO_ID_NET, -- .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig), -- .feature_len = sizeof(virtnet_dev_page.host_features), -- .config_len = sizeof(virtnet_dev_page.net_config), -- }, -- .vqconfig[0] = { -- .num = htole16(MIC_VRING_ENTRIES), -- }, -- .vqconfig[1] = { -- .num = htole16(MIC_VRING_ENTRIES), -- }, --#if GSO_ENABLED -- .host_features = htole32( -- 1 << VIRTIO_NET_F_CSUM | -- 1 << VIRTIO_NET_F_GSO | -- 1 << VIRTIO_NET_F_GUEST_TSO4 | -- 1 << VIRTIO_NET_F_GUEST_TSO6 | -- 1 << VIRTIO_NET_F_GUEST_ECN), --#else -- .host_features = 0, --#endif --}; -- --static const char *mic_config_dir = "/etc/mpss"; --static const char *virtblk_backend = "VIRTBLK_BACKEND"; --static struct { -- struct mic_device_desc dd; -- struct mic_vqconfig vqconfig[1]; -- __u32 host_features, guest_acknowledgements; -- struct virtio_blk_config blk_config; --} virtblk_dev_page = { -- .dd = { -- .type = VIRTIO_ID_BLOCK, -- .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig), -- .feature_len = sizeof(virtblk_dev_page.host_features), -- .config_len = sizeof(virtblk_dev_page.blk_config), -- }, -- .vqconfig[0] = { -- .num = htole16(MIC_VRING_ENTRIES), -- }, -- .host_features = -- htole32(1<name, strerror(errno)); -- return ret; -- } -- } -- if (pid < 0) { -- mpsslog("%s fork failed errno %s\n", -- mic->name, strerror(errno)); -- return ret; -- } -- -- ret = waitpid(pid, NULL, 0); -- if (ret < 0) { -- mpsslog("%s waitpid failed errno %s\n", -- mic->name, strerror(errno)); -- return ret; -- } -- -- snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id + 1); -- -- pid = fork(); -- if (pid == 0) { -- ifargv[0] = "ip"; -- ifargv[1] = "addr"; -- ifargv[2] = "add"; -- ifargv[3] = ipaddr; -- ifargv[4] = "dev"; -- ifargv[5] = dev; -- ifargv[6] = NULL; -- mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr); -- ret = execvp("ip", ifargv); -- if (ret < 0) { -- mpsslog("%s execvp failed errno %s\n", -- mic->name, strerror(errno)); -- return ret; -- } -- } -- if (pid < 0) { -- mpsslog("%s fork failed errno %s\n", -- mic->name, strerror(errno)); -- return ret; -- } -- -- ret = waitpid(pid, NULL, 0); -- if (ret < 0) { -- mpsslog("%s waitpid failed errno %s\n", -- mic->name, strerror(errno)); -- return ret; -- } -- mpsslog("MIC name %s %s %d DONE!\n", -- mic->name, __func__, __LINE__); -- return 0; --} -- --static int tun_alloc(struct mic_info *mic, char *dev) --{ -- struct ifreq ifr; -- int fd, err; --#if GSO_ENABLED -- unsigned offload; --#endif -- fd = open("/dev/net/tun", O_RDWR); -- if (fd < 0) { -- mpsslog("Could not open /dev/net/tun %s\n", strerror(errno)); -- goto done; -- } -- -- memset(&ifr, 0, sizeof(ifr)); -- -- ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR; -- if (*dev) -- strncpy(ifr.ifr_name, dev, IFNAMSIZ); -- -- err = ioctl(fd, TUNSETIFF, (void *)&ifr); -- if (err < 0) { -- mpsslog("%s %s %d TUNSETIFF failed %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- close(fd); -- return err; -- } --#if GSO_ENABLED -- offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | TUN_F_TSO_ECN; -- -- err = ioctl(fd, TUNSETOFFLOAD, offload); -- if (err < 0) { -- mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- close(fd); -- return err; -- } --#endif -- strcpy(dev, ifr.ifr_name); -- mpsslog("Created TAP %s\n", dev); --done: -- return fd; --} -- --#define NET_FD_VIRTIO_NET 0 --#define NET_FD_TUN 1 --#define MAX_NET_FD 2 -- --static void set_dp(struct mic_info *mic, int type, void *dp) --{ -- switch (type) { -- case VIRTIO_ID_CONSOLE: -- mic->mic_console.console_dp = dp; -- return; -- case VIRTIO_ID_NET: -- mic->mic_net.net_dp = dp; -- return; -- case VIRTIO_ID_BLOCK: -- mic->mic_virtblk.block_dp = dp; -- return; -- } -- mpsslog("%s %s %d not found\n", mic->name, __func__, type); -- assert(0); --} -- --static void *get_dp(struct mic_info *mic, int type) --{ -- switch (type) { -- case VIRTIO_ID_CONSOLE: -- return mic->mic_console.console_dp; -- case VIRTIO_ID_NET: -- return mic->mic_net.net_dp; -- case VIRTIO_ID_BLOCK: -- return mic->mic_virtblk.block_dp; -- } -- mpsslog("%s %s %d not found\n", mic->name, __func__, type); -- assert(0); -- return NULL; --} -- --static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type) --{ -- struct mic_device_desc *d; -- int i; -- void *dp = get_dp(mic, type); -- -- for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE; -- i += mic_total_desc_size(d)) { -- d = dp + i; -- -- /* End of list */ -- if (d->type == 0) -- break; -- -- if (d->type == -1) -- continue; -- -- mpsslog("%s %s d-> type %d d %p\n", -- mic->name, __func__, d->type, d); -- -- if (d->type == (__u8)type) -- return d; -- } -- mpsslog("%s %s %d not found\n", mic->name, __func__, type); -- return NULL; --} -- --/* See comments in vhost.c for explanation of next_desc() */ --static unsigned next_desc(struct vring_desc *desc) --{ -- unsigned int next; -- -- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) -- return -1U; -- next = le16toh(desc->next); -- return next; --} -- --/* Sum up all the IOVEC length */ --static ssize_t --sum_iovec_len(struct mic_copy_desc *copy) --{ -- ssize_t sum = 0; -- int i; -- -- for (i = 0; i < copy->iovcnt; i++) -- sum += copy->iov[i].iov_len; -- return sum; --} -- --static inline void verify_out_len(struct mic_info *mic, -- struct mic_copy_desc *copy) --{ -- if (copy->out_len != sum_iovec_len(copy)) { -- mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n", -- mic->name, __func__, __LINE__, -- copy->out_len, sum_iovec_len(copy)); -- assert(copy->out_len == sum_iovec_len(copy)); -- } --} -- --/* Display an iovec */ --static void --disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy, -- const char *s, int line) --{ -- int i; -- -- for (i = 0; i < copy->iovcnt; i++) -- mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n", -- mic->name, s, line, i, -- copy->iov[i].iov_base, copy->iov[i].iov_len); --} -- --static inline __u16 read_avail_idx(struct mic_vring *vr) --{ -- return ACCESS_ONCE(vr->info->avail_idx); --} -- --static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr, -- struct mic_copy_desc *copy, ssize_t len) --{ -- copy->vr_idx = tx ? 0 : 1; -- copy->update_used = true; -- if (type == VIRTIO_ID_NET) -- copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr); -- else -- copy->iov[0].iov_len = len; --} -- --/* Central API which triggers the copies */ --static int --mic_virtio_copy(struct mic_info *mic, int fd, -- struct mic_vring *vr, struct mic_copy_desc *copy) --{ -- int ret; -- -- ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy); -- if (ret) { -- mpsslog("%s %s %d errno %s ret %d\n", -- mic->name, __func__, __LINE__, -- strerror(errno), ret); -- } -- return ret; --} -- --static inline unsigned _vring_size(unsigned int num, unsigned long align) --{ -- return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) -- + align - 1) & ~(align - 1)) -- + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num; --} -- --/* -- * This initialization routine requires at least one -- * vring i.e. vr0. vr1 is optional. -- */ --static void * --init_vr(struct mic_info *mic, int fd, int type, -- struct mic_vring *vr0, struct mic_vring *vr1, int num_vq) --{ -- int vr_size; -- char *va; -- -- vr_size = PAGE_ALIGN(_vring_size(MIC_VRING_ENTRIES, -- MIC_VIRTIO_RING_ALIGN) + -- sizeof(struct _mic_vring_info)); -- va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq, -- PROT_READ, MAP_SHARED, fd, 0); -- if (MAP_FAILED == va) { -- mpsslog("%s %s %d mmap failed errno %s\n", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- goto done; -- } -- set_dp(mic, type, va); -- vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END]; -- vr0->info = vr0->va + -- _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN); -- vring_init(&vr0->vr, -- MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN); -- mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ", -- __func__, mic->name, vr0->va, vr0->info, vr_size, -- _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); -- mpsslog("magic 0x%x expected 0x%x\n", -- le32toh(vr0->info->magic), MIC_MAGIC + type); -- assert(le32toh(vr0->info->magic) == MIC_MAGIC + type); -- if (vr1) { -- vr1->va = (struct mic_vring *) -- &va[MIC_DEVICE_PAGE_END + vr_size]; -- vr1->info = vr1->va + _vring_size(MIC_VRING_ENTRIES, -- MIC_VIRTIO_RING_ALIGN); -- vring_init(&vr1->vr, -- MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN); -- mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ", -- __func__, mic->name, vr1->va, vr1->info, vr_size, -- _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); -- mpsslog("magic 0x%x expected 0x%x\n", -- le32toh(vr1->info->magic), MIC_MAGIC + type + 1); -- assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1); -- } --done: -- return va; --} -- --static int --wait_for_card_driver(struct mic_info *mic, int fd, int type) --{ -- struct pollfd pollfd; -- int err; -- struct mic_device_desc *desc = get_device_desc(mic, type); -- __u8 prev_status; -- -- if (!desc) -- return -ENODEV; -- prev_status = desc->status; -- pollfd.fd = fd; -- mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n", -- mic->name, __func__, type, desc->status); -- -- while (1) { -- pollfd.events = POLLIN; -- pollfd.revents = 0; -- err = poll(&pollfd, 1, -1); -- if (err < 0) { -- mpsslog("%s %s poll failed %s\n", -- mic->name, __func__, strerror(errno)); -- continue; -- } -- -- if (pollfd.revents) { -- if (desc->status != prev_status) { -- mpsslog("%s %s Waiting... desc-> type %d " -- "status 0x%x\n", -- mic->name, __func__, type, -- desc->status); -- prev_status = desc->status; -- } -- if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) { -- mpsslog("%s %s poll.revents %d\n", -- mic->name, __func__, pollfd.revents); -- mpsslog("%s %s desc-> type %d status 0x%x\n", -- mic->name, __func__, type, -- desc->status); -- break; -- } -- } -- } -- return 0; --} -- --/* Spin till we have some descriptors */ --static void --spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr) --{ -- __u16 avail_idx = read_avail_idx(vr); -- -- while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) { --#ifdef DEBUG -- mpsslog("%s %s waiting for desc avail %d info_avail %d\n", -- mic->name, __func__, -- le16toh(vr->vr.avail->idx), vr->info->avail_idx); --#endif -- sched_yield(); -- } --} -- --static void * --virtio_net(void *arg) --{ -- static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)]; -- static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64))); -- struct iovec vnet_iov[2][2] = { -- { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) }, -- { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } }, -- { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) }, -- { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } }, -- }; -- struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1]; -- struct mic_info *mic = (struct mic_info *)arg; -- char if_name[IFNAMSIZ]; -- struct pollfd net_poll[MAX_NET_FD]; -- struct mic_vring tx_vr, rx_vr; -- struct mic_copy_desc copy; -- struct mic_device_desc *desc; -- int err; -- -- snprintf(if_name, IFNAMSIZ, "mic%d", mic->id); -- mic->mic_net.tap_fd = tun_alloc(mic, if_name); -- if (mic->mic_net.tap_fd < 0) -- goto done; -- -- if (tap_configure(mic, if_name)) -- goto done; -- mpsslog("MIC name %s id %d\n", mic->name, mic->id); -- -- net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd; -- net_poll[NET_FD_VIRTIO_NET].events = POLLIN; -- net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd; -- net_poll[NET_FD_TUN].events = POLLIN; -- -- if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd, -- VIRTIO_ID_NET, &tx_vr, &rx_vr, -- virtnet_dev_page.dd.num_vq)) { -- mpsslog("%s init_vr failed %s\n", -- mic->name, strerror(errno)); -- goto done; -- } -- -- copy.iovcnt = 2; -- desc = get_device_desc(mic, VIRTIO_ID_NET); -- -- while (1) { -- ssize_t len; -- -- net_poll[NET_FD_VIRTIO_NET].revents = 0; -- net_poll[NET_FD_TUN].revents = 0; -- -- /* Start polling for data from tap and virtio net */ -- err = poll(net_poll, 2, -1); -- if (err < 0) { -- mpsslog("%s poll failed %s\n", -- __func__, strerror(errno)); -- continue; -- } -- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) { -- err = wait_for_card_driver(mic, -- mic->mic_net.virtio_net_fd, -- VIRTIO_ID_NET); -- if (err) { -- mpsslog("%s %s %d Exiting...\n", -- mic->name, __func__, __LINE__); -- break; -- } -- } -- /* -- * Check if there is data to be read from TUN and write to -- * virtio net fd if there is. -- */ -- if (net_poll[NET_FD_TUN].revents & POLLIN) { -- copy.iov = iov0; -- len = readv(net_poll[NET_FD_TUN].fd, -- copy.iov, copy.iovcnt); -- if (len > 0) { -- struct virtio_net_hdr *hdr -- = (struct virtio_net_hdr *)vnet_hdr[0]; -- -- /* Disable checksums on the card since we are on -- a reliable PCIe link */ -- hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID; --#ifdef DEBUG -- mpsslog("%s %s %d hdr->flags 0x%x ", mic->name, -- __func__, __LINE__, hdr->flags); -- mpsslog("copy.out_len %d hdr->gso_type 0x%x\n", -- copy.out_len, hdr->gso_type); --#endif --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, __LINE__); -- mpsslog("%s %s %d read from tap 0x%lx\n", -- mic->name, __func__, __LINE__, -- len); --#endif -- spin_for_descriptors(mic, &tx_vr); -- txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©, -- len); -- -- err = mic_virtio_copy(mic, -- mic->mic_net.virtio_net_fd, &tx_vr, -- ©); -- if (err < 0) { -- mpsslog("%s %s %d mic_virtio_copy %s\n", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- } -- if (!err) -- verify_out_len(mic, ©); --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, __LINE__); -- mpsslog("%s %s %d wrote to net 0x%lx\n", -- mic->name, __func__, __LINE__, -- sum_iovec_len(©)); --#endif -- /* Reinitialize IOV for next run */ -- iov0[1].iov_len = MAX_NET_PKT_SIZE; -- } else if (len < 0) { -- disp_iovec(mic, ©, __func__, __LINE__); -- mpsslog("%s %s %d read failed %s ", mic->name, -- __func__, __LINE__, strerror(errno)); -- mpsslog("cnt %d sum %zd\n", -- copy.iovcnt, sum_iovec_len(©)); -- } -- } -- -- /* -- * Check if there is data to be read from virtio net and -- * write to TUN if there is. -- */ -- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) { -- while (rx_vr.info->avail_idx != -- le16toh(rx_vr.vr.avail->idx)) { -- copy.iov = iov1; -- txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©, -- MAX_NET_PKT_SIZE -- + sizeof(struct virtio_net_hdr)); -- -- err = mic_virtio_copy(mic, -- mic->mic_net.virtio_net_fd, &rx_vr, -- ©); -- if (!err) { --#ifdef DEBUG -- struct virtio_net_hdr *hdr -- = (struct virtio_net_hdr *) -- vnet_hdr[1]; -- -- mpsslog("%s %s %d hdr->flags 0x%x, ", -- mic->name, __func__, __LINE__, -- hdr->flags); -- mpsslog("out_len %d gso_type 0x%x\n", -- copy.out_len, -- hdr->gso_type); --#endif -- /* Set the correct output iov_len */ -- iov1[1].iov_len = copy.out_len - -- sizeof(struct virtio_net_hdr); -- verify_out_len(mic, ©); --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, -- __LINE__); -- mpsslog("%s %s %d ", -- mic->name, __func__, __LINE__); -- mpsslog("read from net 0x%lx\n", -- sum_iovec_len(copy)); --#endif -- len = writev(net_poll[NET_FD_TUN].fd, -- copy.iov, copy.iovcnt); -- if (len != sum_iovec_len(©)) { -- mpsslog("Tun write failed %s ", -- strerror(errno)); -- mpsslog("len 0x%zx ", len); -- mpsslog("read_len 0x%zx\n", -- sum_iovec_len(©)); -- } else { --#ifdef DEBUG -- disp_iovec(mic, ©, __func__, -- __LINE__); -- mpsslog("%s %s %d ", -- mic->name, __func__, -- __LINE__); -- mpsslog("wrote to tap 0x%lx\n", -- len); --#endif -- } -- } else { -- mpsslog("%s %s %d mic_virtio_copy %s\n", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- break; -- } -- } -- } -- if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR) -- mpsslog("%s: %s: POLLERR\n", __func__, mic->name); -- } --done: -- pthread_exit(NULL); --} -- --/* virtio_console */ --#define VIRTIO_CONSOLE_FD 0 --#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1) --#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */ --#define MAX_BUFFER_SIZE PAGE_SIZE -- --static void * --virtio_console(void *arg) --{ -- static __u8 vcons_buf[2][PAGE_SIZE]; -- struct iovec vcons_iov[2] = { -- { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) }, -- { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) }, -- }; -- struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1]; -- struct mic_info *mic = (struct mic_info *)arg; -- int err; -- struct pollfd console_poll[MAX_CONSOLE_FD]; -- int pty_fd; -- char *pts_name; -- ssize_t len; -- struct mic_vring tx_vr, rx_vr; -- struct mic_copy_desc copy; -- struct mic_device_desc *desc; -- -- pty_fd = posix_openpt(O_RDWR); -- if (pty_fd < 0) { -- mpsslog("can't open a pseudoterminal master device: %s\n", -- strerror(errno)); -- goto _return; -- } -- pts_name = ptsname(pty_fd); -- if (pts_name == NULL) { -- mpsslog("can't get pts name\n"); -- goto _close_pty; -- } -- printf("%s console message goes to %s\n", mic->name, pts_name); -- mpsslog("%s console message goes to %s\n", mic->name, pts_name); -- err = grantpt(pty_fd); -- if (err < 0) { -- mpsslog("can't grant access: %s %s\n", -- pts_name, strerror(errno)); -- goto _close_pty; -- } -- err = unlockpt(pty_fd); -- if (err < 0) { -- mpsslog("can't unlock a pseudoterminal: %s %s\n", -- pts_name, strerror(errno)); -- goto _close_pty; -- } -- console_poll[MONITOR_FD].fd = pty_fd; -- console_poll[MONITOR_FD].events = POLLIN; -- -- console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd; -- console_poll[VIRTIO_CONSOLE_FD].events = POLLIN; -- -- if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd, -- VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr, -- virtcons_dev_page.dd.num_vq)) { -- mpsslog("%s init_vr failed %s\n", -- mic->name, strerror(errno)); -- goto _close_pty; -- } -- -- copy.iovcnt = 1; -- desc = get_device_desc(mic, VIRTIO_ID_CONSOLE); -- -- for (;;) { -- console_poll[MONITOR_FD].revents = 0; -- console_poll[VIRTIO_CONSOLE_FD].revents = 0; -- err = poll(console_poll, MAX_CONSOLE_FD, -1); -- if (err < 0) { -- mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__, -- strerror(errno)); -- continue; -- } -- if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) { -- err = wait_for_card_driver(mic, -- mic->mic_console.virtio_console_fd, -- VIRTIO_ID_CONSOLE); -- if (err) { -- mpsslog("%s %s %d Exiting...\n", -- mic->name, __func__, __LINE__); -- break; -- } -- } -- -- if (console_poll[MONITOR_FD].revents & POLLIN) { -- copy.iov = iov0; -- len = readv(pty_fd, copy.iov, copy.iovcnt); -- if (len > 0) { --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, __LINE__); -- mpsslog("%s %s %d read from tap 0x%lx\n", -- mic->name, __func__, __LINE__, -- len); --#endif -- spin_for_descriptors(mic, &tx_vr); -- txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr, -- ©, len); -- -- err = mic_virtio_copy(mic, -- mic->mic_console.virtio_console_fd, -- &tx_vr, ©); -- if (err < 0) { -- mpsslog("%s %s %d mic_virtio_copy %s\n", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- } -- if (!err) -- verify_out_len(mic, ©); --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, __LINE__); -- mpsslog("%s %s %d wrote to net 0x%lx\n", -- mic->name, __func__, __LINE__, -- sum_iovec_len(copy)); --#endif -- /* Reinitialize IOV for next run */ -- iov0->iov_len = PAGE_SIZE; -- } else if (len < 0) { -- disp_iovec(mic, ©, __func__, __LINE__); -- mpsslog("%s %s %d read failed %s ", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- mpsslog("cnt %d sum %zd\n", -- copy.iovcnt, sum_iovec_len(©)); -- } -- } -- -- if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) { -- while (rx_vr.info->avail_idx != -- le16toh(rx_vr.vr.avail->idx)) { -- copy.iov = iov1; -- txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr, -- ©, PAGE_SIZE); -- -- err = mic_virtio_copy(mic, -- mic->mic_console.virtio_console_fd, -- &rx_vr, ©); -- if (!err) { -- /* Set the correct output iov_len */ -- iov1->iov_len = copy.out_len; -- verify_out_len(mic, ©); --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, -- __LINE__); -- mpsslog("%s %s %d ", -- mic->name, __func__, __LINE__); -- mpsslog("read from net 0x%lx\n", -- sum_iovec_len(copy)); --#endif -- len = writev(pty_fd, -- copy.iov, copy.iovcnt); -- if (len != sum_iovec_len(©)) { -- mpsslog("Tun write failed %s ", -- strerror(errno)); -- mpsslog("len 0x%zx ", len); -- mpsslog("read_len 0x%zx\n", -- sum_iovec_len(©)); -- } else { --#ifdef DEBUG -- disp_iovec(mic, copy, __func__, -- __LINE__); -- mpsslog("%s %s %d ", -- mic->name, __func__, -- __LINE__); -- mpsslog("wrote to tap 0x%lx\n", -- len); --#endif -- } -- } else { -- mpsslog("%s %s %d mic_virtio_copy %s\n", -- mic->name, __func__, __LINE__, -- strerror(errno)); -- break; -- } -- } -- } -- if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR) -- mpsslog("%s: %s: POLLERR\n", __func__, mic->name); -- } --_close_pty: -- close(pty_fd); --_return: -- pthread_exit(NULL); --} -- --static void --add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd) --{ -- char path[PATH_MAX]; -- int fd, err; -- -- snprintf(path, PATH_MAX, "/dev/mic%d", mic->id); -- fd = open(path, O_RDWR); -- if (fd < 0) { -- mpsslog("Could not open %s %s\n", path, strerror(errno)); -- return; -- } -- -- err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd); -- if (err < 0) { -- mpsslog("Could not add %d %s\n", dd->type, strerror(errno)); -- close(fd); -- return; -- } -- switch (dd->type) { -- case VIRTIO_ID_NET: -- mic->mic_net.virtio_net_fd = fd; -- mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name); -- break; -- case VIRTIO_ID_CONSOLE: -- mic->mic_console.virtio_console_fd = fd; -- mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name); -- break; -- case VIRTIO_ID_BLOCK: -- mic->mic_virtblk.virtio_block_fd = fd; -- mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name); -- break; -- } --} -- --static bool --set_backend_file(struct mic_info *mic) --{ -- FILE *config; -- char buff[PATH_MAX], *line, *evv, *p; -- -- snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id); -- config = fopen(buff, "r"); -- if (config == NULL) -- return false; -- do { /* look for "virtblk_backend=XXXX" */ -- line = fgets(buff, PATH_MAX, config); -- if (line == NULL) -- break; -- if (*line == '#') -- continue; -- p = strchr(line, '\n'); -- if (p) -- *p = '\0'; -- } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0); -- fclose(config); -- if (line == NULL) -- return false; -- evv = strchr(line, '='); -- if (evv == NULL) -- return false; -- mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1); -- if (mic->mic_virtblk.backend_file == NULL) { -- mpsslog("%s %d can't allocate memory\n", mic->name, mic->id); -- return false; -- } -- strcpy(mic->mic_virtblk.backend_file, evv + 1); -- return true; --} -- --#define SECTOR_SIZE 512 --static bool --set_backend_size(struct mic_info *mic) --{ -- mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0, -- SEEK_END); -- if (mic->mic_virtblk.backend_size < 0) { -- mpsslog("%s: can't seek: %s\n", -- mic->name, mic->mic_virtblk.backend_file); -- return false; -- } -- virtblk_dev_page.blk_config.capacity = -- mic->mic_virtblk.backend_size / SECTOR_SIZE; -- if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0) -- virtblk_dev_page.blk_config.capacity++; -- -- virtblk_dev_page.blk_config.capacity = -- htole64(virtblk_dev_page.blk_config.capacity); -- -- return true; --} -- --static bool --open_backend(struct mic_info *mic) --{ -- if (!set_backend_file(mic)) -- goto _error_exit; -- mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR); -- if (mic->mic_virtblk.backend < 0) { -- mpsslog("%s: can't open: %s\n", mic->name, -- mic->mic_virtblk.backend_file); -- goto _error_free; -- } -- if (!set_backend_size(mic)) -- goto _error_close; -- mic->mic_virtblk.backend_addr = mmap(NULL, -- mic->mic_virtblk.backend_size, -- PROT_READ|PROT_WRITE, MAP_SHARED, -- mic->mic_virtblk.backend, 0L); -- if (mic->mic_virtblk.backend_addr == MAP_FAILED) { -- mpsslog("%s: can't map: %s %s\n", -- mic->name, mic->mic_virtblk.backend_file, -- strerror(errno)); -- goto _error_close; -- } -- return true; -- -- _error_close: -- close(mic->mic_virtblk.backend); -- _error_free: -- free(mic->mic_virtblk.backend_file); -- _error_exit: -- return false; --} -- --static void --close_backend(struct mic_info *mic) --{ -- munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size); -- close(mic->mic_virtblk.backend); -- free(mic->mic_virtblk.backend_file); --} -- --static bool --start_virtblk(struct mic_info *mic, struct mic_vring *vring) --{ -- if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) { -- mpsslog("%s: blk_config is not 8 byte aligned.\n", -- mic->name); -- return false; -- } -- add_virtio_device(mic, &virtblk_dev_page.dd); -- if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd, -- VIRTIO_ID_BLOCK, vring, NULL, -- virtblk_dev_page.dd.num_vq)) { -- mpsslog("%s init_vr failed %s\n", -- mic->name, strerror(errno)); -- return false; -- } -- return true; --} -- --static void --stop_virtblk(struct mic_info *mic) --{ -- int vr_size, ret; -- -- vr_size = PAGE_ALIGN(_vring_size(MIC_VRING_ENTRIES, -- MIC_VIRTIO_RING_ALIGN) + -- sizeof(struct _mic_vring_info)); -- ret = munmap(mic->mic_virtblk.block_dp, -- MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq); -- if (ret < 0) -- mpsslog("%s munmap errno %d\n", mic->name, errno); -- close(mic->mic_virtblk.virtio_block_fd); --} -- --static __u8 --header_error_check(struct vring_desc *desc) --{ -- if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) { -- mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n", -- __func__, __LINE__); -- return -EIO; -- } -- if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) { -- mpsslog("%s() %d: alone\n", -- __func__, __LINE__); -- return -EIO; -- } -- if (le16toh(desc->flags) & VRING_DESC_F_WRITE) { -- mpsslog("%s() %d: not read\n", -- __func__, __LINE__); -- return -EIO; -- } -- return 0; --} -- --static int --read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx) --{ -- struct iovec iovec; -- struct mic_copy_desc copy; -- -- iovec.iov_len = sizeof(*hdr); -- iovec.iov_base = hdr; -- copy.iov = &iovec; -- copy.iovcnt = 1; -- copy.vr_idx = 0; /* only one vring on virtio_block */ -- copy.update_used = false; /* do not update used index */ -- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); --} -- --static int --transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt) --{ -- struct mic_copy_desc copy; -- -- copy.iov = iovec; -- copy.iovcnt = iovcnt; -- copy.vr_idx = 0; /* only one vring on virtio_block */ -- copy.update_used = false; /* do not update used index */ -- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); --} -- --static __u8 --status_error_check(struct vring_desc *desc) --{ -- if (le32toh(desc->len) != sizeof(__u8)) { -- mpsslog("%s() %d: length is not sizeof(status)\n", -- __func__, __LINE__); -- return -EIO; -- } -- return 0; --} -- --static int --write_status(int fd, __u8 *status) --{ -- struct iovec iovec; -- struct mic_copy_desc copy; -- -- iovec.iov_base = status; -- iovec.iov_len = sizeof(*status); -- copy.iov = &iovec; -- copy.iovcnt = 1; -- copy.vr_idx = 0; /* only one vring on virtio_block */ -- copy.update_used = true; /* Update used index */ -- return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); --} -- --#ifndef VIRTIO_BLK_T_GET_ID --#define VIRTIO_BLK_T_GET_ID 8 --#endif -- --static void * --virtio_block(void *arg) --{ -- struct mic_info *mic = (struct mic_info *)arg; -- int ret; -- struct pollfd block_poll; -- struct mic_vring vring; -- __u16 avail_idx; -- __u32 desc_idx; -- struct vring_desc *desc; -- struct iovec *iovec, *piov; -- __u8 status; -- __u32 buffer_desc_idx; -- struct virtio_blk_outhdr hdr; -- void *fos; -- -- for (;;) { /* forever */ -- if (!open_backend(mic)) { /* No virtblk */ -- for (mic->mic_virtblk.signaled = 0; -- !mic->mic_virtblk.signaled;) -- sleep(1); -- continue; -- } -- -- /* backend file is specified. */ -- if (!start_virtblk(mic, &vring)) -- goto _close_backend; -- iovec = malloc(sizeof(*iovec) * -- le32toh(virtblk_dev_page.blk_config.seg_max)); -- if (!iovec) { -- mpsslog("%s: can't alloc iovec: %s\n", -- mic->name, strerror(ENOMEM)); -- goto _stop_virtblk; -- } -- -- block_poll.fd = mic->mic_virtblk.virtio_block_fd; -- block_poll.events = POLLIN; -- for (mic->mic_virtblk.signaled = 0; -- !mic->mic_virtblk.signaled;) { -- block_poll.revents = 0; -- /* timeout in 1 sec to see signaled */ -- ret = poll(&block_poll, 1, 1000); -- if (ret < 0) { -- mpsslog("%s %d: poll failed: %s\n", -- __func__, __LINE__, -- strerror(errno)); -- continue; -- } -- -- if (!(block_poll.revents & POLLIN)) { --#ifdef DEBUG -- mpsslog("%s %d: block_poll.revents=0x%x\n", -- __func__, __LINE__, block_poll.revents); --#endif -- continue; -- } -- -- /* POLLIN */ -- while (vring.info->avail_idx != -- le16toh(vring.vr.avail->idx)) { -- /* read header element */ -- avail_idx = -- vring.info->avail_idx & -- (vring.vr.num - 1); -- desc_idx = le16toh( -- vring.vr.avail->ring[avail_idx]); -- desc = &vring.vr.desc[desc_idx]; --#ifdef DEBUG -- mpsslog("%s() %d: avail_idx=%d ", -- __func__, __LINE__, -- vring.info->avail_idx); -- mpsslog("vring.vr.num=%d desc=%p\n", -- vring.vr.num, desc); --#endif -- status = header_error_check(desc); -- ret = read_header( -- mic->mic_virtblk.virtio_block_fd, -- &hdr, desc_idx); -- if (ret < 0) { -- mpsslog("%s() %d %s: ret=%d %s\n", -- __func__, __LINE__, -- mic->name, ret, -- strerror(errno)); -- break; -- } -- /* buffer element */ -- piov = iovec; -- status = 0; -- fos = mic->mic_virtblk.backend_addr + -- (hdr.sector * SECTOR_SIZE); -- buffer_desc_idx = next_desc(desc); -- desc_idx = buffer_desc_idx; -- for (desc = &vring.vr.desc[buffer_desc_idx]; -- desc->flags & VRING_DESC_F_NEXT; -- desc_idx = next_desc(desc), -- desc = &vring.vr.desc[desc_idx]) { -- piov->iov_len = desc->len; -- piov->iov_base = fos; -- piov++; -- fos += desc->len; -- } -- /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */ -- if (hdr.type & ~(VIRTIO_BLK_T_OUT | -- VIRTIO_BLK_T_GET_ID)) { -- /* -- VIRTIO_BLK_T_IN - does not do -- anything. Probably for documenting. -- VIRTIO_BLK_T_SCSI_CMD - for -- virtio_scsi. -- VIRTIO_BLK_T_FLUSH - turned off in -- config space. -- VIRTIO_BLK_T_BARRIER - defined but not -- used in anywhere. -- */ -- mpsslog("%s() %d: type %x ", -- __func__, __LINE__, -- hdr.type); -- mpsslog("is not supported\n"); -- status = -ENOTSUP; -- -- } else { -- ret = transfer_blocks( -- mic->mic_virtblk.virtio_block_fd, -- iovec, -- piov - iovec); -- if (ret < 0 && -- status != 0) -- status = ret; -- } -- /* write status and update used pointer */ -- if (status != 0) -- status = status_error_check(desc); -- ret = write_status( -- mic->mic_virtblk.virtio_block_fd, -- &status); --#ifdef DEBUG -- mpsslog("%s() %d: write status=%d on desc=%p\n", -- __func__, __LINE__, -- status, desc); --#endif -- } -- } -- free(iovec); --_stop_virtblk: -- stop_virtblk(mic); --_close_backend: -- close_backend(mic); -- } /* forever */ -- -- pthread_exit(NULL); --} -- --static void --reset(struct mic_info *mic) --{ --#define RESET_TIMEOUT 120 -- int i = RESET_TIMEOUT; -- setsysfs(mic->name, "state", "reset"); -- while (i) { -- char *state; -- state = readsysfs(mic->name, "state"); -- if (!state) -- goto retry; -- mpsslog("%s: %s %d state %s\n", -- mic->name, __func__, __LINE__, state); -- -- if (!strcmp(state, "ready")) { -- free(state); -- break; -- } -- free(state); --retry: -- sleep(1); -- i--; -- } --} -- --static int --get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status) --{ -- if (!strcmp(shutdown_status, "nop")) -- return MIC_NOP; -- if (!strcmp(shutdown_status, "crashed")) -- return MIC_CRASHED; -- if (!strcmp(shutdown_status, "halted")) -- return MIC_HALTED; -- if (!strcmp(shutdown_status, "poweroff")) -- return MIC_POWER_OFF; -- if (!strcmp(shutdown_status, "restart")) -- return MIC_RESTART; -- mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status); -- /* Invalid state */ -- assert(0); --}; -- --static int get_mic_state(struct mic_info *mic) --{ -- char *state = NULL; -- enum mic_states mic_state; -- -- while (!state) { -- state = readsysfs(mic->name, "state"); -- sleep(1); -- } -- mpsslog("%s: %s %d state %s\n", -- mic->name, __func__, __LINE__, state); -- -- if (!strcmp(state, "ready")) { -- mic_state = MIC_READY; -- } else if (!strcmp(state, "booting")) { -- mic_state = MIC_BOOTING; -- } else if (!strcmp(state, "online")) { -- mic_state = MIC_ONLINE; -- } else if (!strcmp(state, "shutting_down")) { -- mic_state = MIC_SHUTTING_DOWN; -- } else if (!strcmp(state, "reset_failed")) { -- mic_state = MIC_RESET_FAILED; -- } else if (!strcmp(state, "resetting")) { -- mic_state = MIC_RESETTING; -- } else { -- mpsslog("%s: BUG invalid state %s\n", mic->name, state); -- assert(0); -- } -- -- free(state); -- return mic_state; --}; -- --static void mic_handle_shutdown(struct mic_info *mic) --{ --#define SHUTDOWN_TIMEOUT 60 -- int i = SHUTDOWN_TIMEOUT; -- char *shutdown_status; -- while (i) { -- shutdown_status = readsysfs(mic->name, "shutdown_status"); -- if (!shutdown_status) { -- sleep(1); -- continue; -- } -- mpsslog("%s: %s %d shutdown_status %s\n", -- mic->name, __func__, __LINE__, shutdown_status); -- switch (get_mic_shutdown_status(mic, shutdown_status)) { -- case MIC_RESTART: -- mic->restart = 1; -- case MIC_HALTED: -- case MIC_POWER_OFF: -- case MIC_CRASHED: -- free(shutdown_status); -- goto reset; -- default: -- break; -- } -- free(shutdown_status); -- sleep(1); -- i--; -- } --reset: -- if (!i) -- mpsslog("%s: %s %d timing out waiting for shutdown_status %s\n", -- mic->name, __func__, __LINE__, shutdown_status); -- reset(mic); --} -- --static int open_state_fd(struct mic_info *mic) --{ -- char pathname[PATH_MAX]; -- int fd; -- -- snprintf(pathname, PATH_MAX - 1, "%s/%s/%s", -- MICSYSFSDIR, mic->name, "state"); -- -- fd = open(pathname, O_RDONLY); -- if (fd < 0) -- mpsslog("%s: opening file %s failed %s\n", -- mic->name, pathname, strerror(errno)); -- return fd; --} -- --static int block_till_state_change(int fd, struct mic_info *mic) --{ -- struct pollfd ufds[1]; -- char value[PAGE_SIZE]; -- int ret; -- -- ufds[0].fd = fd; -- ufds[0].events = POLLERR | POLLPRI; -- ret = poll(ufds, 1, -1); -- if (ret < 0) { -- mpsslog("%s: %s %d poll failed %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- return ret; -- } -- -- ret = lseek(fd, 0, SEEK_SET); -- if (ret < 0) { -- mpsslog("%s: %s %d Failed to seek to 0: %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- return ret; -- } -- -- ret = read(fd, value, sizeof(value)); -- if (ret < 0) { -- mpsslog("%s: %s %d Failed to read sysfs entry: %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- return ret; -- } -- -- return 0; --} -- --static void * --mic_config(void *arg) --{ -- struct mic_info *mic = (struct mic_info *)arg; -- int fd, ret, stat = 0; -- -- fd = open_state_fd(mic); -- if (fd < 0) { -- mpsslog("%s: %s %d open state fd failed %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- goto exit; -- } -- -- do { -- ret = block_till_state_change(fd, mic); -- if (ret < 0) { -- mpsslog("%s: %s %d block_till_state_change error %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- goto close_exit; -- } -- -- switch (get_mic_state(mic)) { -- case MIC_SHUTTING_DOWN: -- mic_handle_shutdown(mic); -- break; -- case MIC_READY: -- case MIC_RESET_FAILED: -- ret = kill(mic->pid, SIGTERM); -- mpsslog("%s: %s %d kill pid %d ret %d\n", -- mic->name, __func__, __LINE__, -- mic->pid, ret); -- if (!ret) { -- ret = waitpid(mic->pid, &stat, -- WIFSIGNALED(stat)); -- mpsslog("%s: %s %d waitpid ret %d pid %d\n", -- mic->name, __func__, __LINE__, -- ret, mic->pid); -- } -- if (mic->boot_on_resume) { -- setsysfs(mic->name, "state", "boot"); -- mic->boot_on_resume = 0; -- } -- goto close_exit; -- default: -- break; -- } -- } while (1); -- --close_exit: -- close(fd); --exit: -- init_mic(mic); -- pthread_exit(NULL); --} -- --static void --set_cmdline(struct mic_info *mic) --{ -- char buffer[PATH_MAX]; -- int len; -- -- len = snprintf(buffer, PATH_MAX, -- "clocksource=tsc highres=off nohz=off "); -- len += snprintf(buffer + len, PATH_MAX - len, -- "cpufreq_on;corec6_off;pc3_off;pc6_off "); -- len += snprintf(buffer + len, PATH_MAX - len, -- "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0", -- mic->id + 1); -- -- setsysfs(mic->name, "cmdline", buffer); -- mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer); -- snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id + 1); -- mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer); --} -- --static void --set_log_buf_info(struct mic_info *mic) --{ -- int fd; -- off_t len; -- char system_map[] = "/lib/firmware/mic/System.map"; -- char *map, *temp, log_buf[17] = {'\0'}; -- -- fd = open(system_map, O_RDONLY); -- if (fd < 0) { -- mpsslog("%s: Opening System.map failed: %d\n", -- mic->name, errno); -- return; -- } -- len = lseek(fd, 0, SEEK_END); -- if (len < 0) { -- mpsslog("%s: Reading System.map size failed: %d\n", -- mic->name, errno); -- close(fd); -- return; -- } -- map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0); -- if (map == MAP_FAILED) { -- mpsslog("%s: mmap of System.map failed: %d\n", -- mic->name, errno); -- close(fd); -- return; -- } -- temp = strstr(map, "__log_buf"); -- if (!temp) { -- mpsslog("%s: __log_buf not found: %d\n", mic->name, errno); -- munmap(map, len); -- close(fd); -- return; -- } -- strncpy(log_buf, temp - 19, 16); -- setsysfs(mic->name, "log_buf_addr", log_buf); -- mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf); -- temp = strstr(map, "log_buf_len"); -- if (!temp) { -- mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno); -- munmap(map, len); -- close(fd); -- return; -- } -- strncpy(log_buf, temp - 19, 16); -- setsysfs(mic->name, "log_buf_len", log_buf); -- mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf); -- munmap(map, len); -- close(fd); --} -- --static void --change_virtblk_backend(int x, siginfo_t *siginfo, void *p) --{ -- struct mic_info *mic; -- -- for (mic = mic_list.next; mic != NULL; mic = mic->next) -- mic->mic_virtblk.signaled = 1/* true */; --} -- --static void --set_mic_boot_params(struct mic_info *mic) --{ -- set_log_buf_info(mic); -- set_cmdline(mic); --} -- --static void * --init_mic(void *arg) --{ -- struct mic_info *mic = (struct mic_info *)arg; -- struct sigaction ignore = { -- .sa_flags = 0, -- .sa_handler = SIG_IGN -- }; -- struct sigaction act = { -- .sa_flags = SA_SIGINFO, -- .sa_sigaction = change_virtblk_backend, -- }; -- char buffer[PATH_MAX]; -- int err, fd; -- -- /* -- * Currently, one virtio block device is supported for each MIC card -- * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon. -- * The signal informs the virtio block backend about a change in the -- * configuration file which specifies the virtio backend file name on -- * the host. Virtio block backend then re-reads the configuration file -- * and switches to the new block device. This signalling mechanism may -- * not be required once multiple virtio block devices are supported by -- * the MIC daemon. -- */ -- sigaction(SIGUSR1, &ignore, NULL); --retry: -- fd = open_state_fd(mic); -- if (fd < 0) { -- mpsslog("%s: %s %d open state fd failed %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- sleep(2); -- goto retry; -- } -- -- if (mic->restart) { -- snprintf(buffer, PATH_MAX, "boot"); -- setsysfs(mic->name, "state", buffer); -- mpsslog("%s restarting mic %d\n", -- mic->name, mic->restart); -- mic->restart = 0; -- } -- -- while (1) { -- while (block_till_state_change(fd, mic)) { -- mpsslog("%s: %s %d block_till_state_change error %s\n", -- mic->name, __func__, __LINE__, strerror(errno)); -- sleep(2); -- continue; -- } -- -- if (get_mic_state(mic) == MIC_BOOTING) -- break; -- } -- -- mic->pid = fork(); -- switch (mic->pid) { -- case 0: -- add_virtio_device(mic, &virtcons_dev_page.dd); -- add_virtio_device(mic, &virtnet_dev_page.dd); -- err = pthread_create(&mic->mic_console.console_thread, NULL, -- virtio_console, mic); -- if (err) -- mpsslog("%s virtcons pthread_create failed %s\n", -- mic->name, strerror(err)); -- err = pthread_create(&mic->mic_net.net_thread, NULL, -- virtio_net, mic); -- if (err) -- mpsslog("%s virtnet pthread_create failed %s\n", -- mic->name, strerror(err)); -- err = pthread_create(&mic->mic_virtblk.block_thread, NULL, -- virtio_block, mic); -- if (err) -- mpsslog("%s virtblk pthread_create failed %s\n", -- mic->name, strerror(err)); -- sigemptyset(&act.sa_mask); -- err = sigaction(SIGUSR1, &act, NULL); -- if (err) -- mpsslog("%s sigaction SIGUSR1 failed %s\n", -- mic->name, strerror(errno)); -- while (1) -- sleep(60); -- case -1: -- mpsslog("fork failed MIC name %s id %d errno %d\n", -- mic->name, mic->id, errno); -- break; -- default: -- err = pthread_create(&mic->config_thread, NULL, -- mic_config, mic); -- if (err) -- mpsslog("%s mic_config pthread_create failed %s\n", -- mic->name, strerror(err)); -- } -- -- return NULL; --} -- --static void --start_daemon(void) --{ -- struct mic_info *mic; -- int err; -- -- for (mic = mic_list.next; mic; mic = mic->next) { -- set_mic_boot_params(mic); -- err = pthread_create(&mic->init_thread, NULL, init_mic, mic); -- if (err) -- mpsslog("%s init_mic pthread_create failed %s\n", -- mic->name, strerror(err)); -- } -- -- while (1) -- sleep(60); --} -- --static int --init_mic_list(void) --{ -- struct mic_info *mic = &mic_list; -- struct dirent *file; -- DIR *dp; -- int cnt = 0; -- -- dp = opendir(MICSYSFSDIR); -- if (!dp) -- return 0; -- -- while ((file = readdir(dp)) != NULL) { -- if (!strncmp(file->d_name, "mic", 3)) { -- mic->next = calloc(1, sizeof(struct mic_info)); -- if (mic->next) { -- mic = mic->next; -- mic->id = atoi(&file->d_name[3]); -- mic->name = malloc(strlen(file->d_name) + 16); -- if (mic->name) -- strcpy(mic->name, file->d_name); -- mpsslog("MIC name %s id %d\n", mic->name, -- mic->id); -- cnt++; -- } -- } -- } -- -- closedir(dp); -- return cnt; --} -- --void --mpsslog(char *format, ...) --{ -- va_list args; -- char buffer[4096]; -- char ts[52], *ts1; -- time_t t; -- -- if (logfp == NULL) -- return; -- -- va_start(args, format); -- vsprintf(buffer, format, args); -- va_end(args); -- -- time(&t); -- ts1 = ctime_r(&t, ts); -- ts1[strlen(ts1) - 1] = '\0'; -- fprintf(logfp, "%s: %s", ts1, buffer); -- -- fflush(logfp); --} -- --int --main(int argc, char *argv[]) --{ -- int cnt; -- pid_t pid; -- -- myname = argv[0]; -- -- logfp = fopen(LOGFILE_NAME, "a+"); -- if (!logfp) { -- fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME); -- exit(1); -- } -- pid = fork(); -- switch (pid) { -- case 0: -- break; -- case -1: -- exit(2); -- default: -- exit(0); -- } -- -- mpsslog("MIC Daemon start\n"); -- -- cnt = init_mic_list(); -- if (cnt == 0) { -- mpsslog("MIC module not loaded\n"); -- exit(3); -- } -- mpsslog("MIC found %d devices\n", cnt); -- -- start_daemon(); -- -- exit(0); --} -diff --git a/Documentation/mic/mpssd/mpssd.h b/Documentation/mic/mpssd/mpssd.h -deleted file mode 100644 -index 8bd64944aacc..000000000000 ---- a/Documentation/mic/mpssd/mpssd.h -+++ /dev/null -@@ -1,103 +0,0 @@ --/* -- * Intel MIC Platform Software Stack (MPSS) -- * -- * Copyright(c) 2013 Intel Corporation. -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License, version 2, as -- * published by the Free Software Foundation. -- * -- * This program is distributed in the hope that it will be useful, but -- * WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -- * General Public License for more details. -- * -- * The full GNU General Public License is included in this distribution in -- * the file called "COPYING". -- * -- * Intel MIC User Space Tools. -- */ --#ifndef _MPSSD_H_ --#define _MPSSD_H_ -- --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include --#include -- --#define MICSYSFSDIR "/sys/class/mic" --#define LOGFILE_NAME "/var/log/mpssd" --#define PAGE_SIZE 4096 -- --struct mic_console_info { -- pthread_t console_thread; -- int virtio_console_fd; -- void *console_dp; --}; -- --struct mic_net_info { -- pthread_t net_thread; -- int virtio_net_fd; -- int tap_fd; -- void *net_dp; --}; -- --struct mic_virtblk_info { -- pthread_t block_thread; -- int virtio_block_fd; -- void *block_dp; -- volatile sig_atomic_t signaled; -- char *backend_file; -- int backend; -- void *backend_addr; -- long backend_size; --}; -- --struct mic_info { -- int id; -- char *name; -- pthread_t config_thread; -- pthread_t init_thread; -- pid_t pid; -- struct mic_console_info mic_console; -- struct mic_net_info mic_net; -- struct mic_virtblk_info mic_virtblk; -- int restart; -- int boot_on_resume; -- struct mic_info *next; --}; -- --__attribute__((format(printf, 1, 2))) --void mpsslog(char *format, ...); --char *readsysfs(char *dir, char *entry); --int setsysfs(char *dir, char *entry, char *value); --#endif -diff --git a/Documentation/mic/mpssd/sysfs.c b/Documentation/mic/mpssd/sysfs.c -deleted file mode 100644 -index 8dd326936083..000000000000 ---- a/Documentation/mic/mpssd/sysfs.c -+++ /dev/null -@@ -1,102 +0,0 @@ --/* -- * Intel MIC Platform Software Stack (MPSS) -- * -- * Copyright(c) 2013 Intel Corporation. -- * -- * This program is free software; you can redistribute it and/or modify -- * it under the terms of the GNU General Public License, version 2, as -- * published by the Free Software Foundation. -- * -- * This program is distributed in the hope that it will be useful, but -- * WITHOUT ANY WARRANTY; without even the implied warranty of -- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -- * General Public License for more details. -- * -- * The full GNU General Public License is included in this distribution in -- * the file called "COPYING". -- * -- * Intel MIC User Space Tools. -- */ -- --#include "mpssd.h" -- --#define PAGE_SIZE 4096 -- --char * --readsysfs(char *dir, char *entry) --{ -- char filename[PATH_MAX]; -- char value[PAGE_SIZE]; -- char *string = NULL; -- int fd; -- int len; -- -- if (dir == NULL) -- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); -- else -- snprintf(filename, PATH_MAX, -- "%s/%s/%s", MICSYSFSDIR, dir, entry); -- -- fd = open(filename, O_RDONLY); -- if (fd < 0) { -- mpsslog("Failed to open sysfs entry '%s': %s\n", -- filename, strerror(errno)); -- return NULL; -- } -- -- len = read(fd, value, sizeof(value)); -- if (len < 0) { -- mpsslog("Failed to read sysfs entry '%s': %s\n", -- filename, strerror(errno)); -- goto readsys_ret; -- } -- if (len == 0) -- goto readsys_ret; -- -- value[len - 1] = '\0'; -- -- string = malloc(strlen(value) + 1); -- if (string) -- strcpy(string, value); -- --readsys_ret: -- close(fd); -- return string; --} -- --int --setsysfs(char *dir, char *entry, char *value) --{ -- char filename[PATH_MAX]; -- char *oldvalue; -- int fd, ret = 0; -- -- if (dir == NULL) -- snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); -- else -- snprintf(filename, PATH_MAX, "%s/%s/%s", -- MICSYSFSDIR, dir, entry); -- -- oldvalue = readsysfs(dir, entry); -- -- fd = open(filename, O_RDWR); -- if (fd < 0) { -- ret = errno; -- mpsslog("Failed to open sysfs entry '%s': %s\n", -- filename, strerror(errno)); -- goto done; -- } -- -- if (!oldvalue || strcmp(value, oldvalue)) { -- if (write(fd, value, strlen(value)) < 0) { -- ret = errno; -- mpsslog("Failed to write new sysfs entry '%s': %s\n", -- filename, strerror(errno)); -- } -- } -- close(fd); --done: -- if (oldvalue) -- free(oldvalue); -- return ret; --} -diff --git a/Makefile b/Makefile -index 671e183bd507..10aec937e9e4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 52 -+SUBLEVEL = 53 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/at91-sama5d2_xplained.dts b/arch/arm/boot/dts/at91-sama5d2_xplained.dts -index e74df327cdd3..20618a897c99 100644 ---- a/arch/arm/boot/dts/at91-sama5d2_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d2_xplained.dts -@@ -122,6 +122,8 @@ - uart1: serial@f8020000 { - pinctrl-names = "default"; - pinctrl-0 = <&pinctrl_uart1_default>; -+ atmel,use-dma-rx; -+ atmel,use-dma-tx; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/at91-sama5d4_xplained.dts b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -index da84e65b56ef..e27024cdf48b 100644 ---- a/arch/arm/boot/dts/at91-sama5d4_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d4_xplained.dts -@@ -110,6 +110,8 @@ - }; - - usart3: serial@fc00c000 { -+ atmel,use-dma-rx; -+ atmel,use-dma-tx; - status = "okay"; - }; - -diff --git a/arch/arm/include/asm/kvm_mmu.h b/arch/arm/include/asm/kvm_mmu.h -index 405aa1883307..23d5cad56ddc 100644 ---- a/arch/arm/include/asm/kvm_mmu.h -+++ b/arch/arm/include/asm/kvm_mmu.h -@@ -204,18 +204,12 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn, - * and iterate over the range. - */ - -- bool need_flush = !vcpu_has_cache_enabled(vcpu) || ipa_uncached; -- - VM_BUG_ON(size & ~PAGE_MASK); - -- if (!need_flush && !icache_is_pipt()) -- goto vipt_cache; -- - while (size) { - void *va = kmap_atomic_pfn(pfn); - -- if (need_flush) -- kvm_flush_dcache_to_poc(va, PAGE_SIZE); -+ kvm_flush_dcache_to_poc(va, PAGE_SIZE); - - if (icache_is_pipt()) - __cpuc_coherent_user_range((unsigned long)va, -@@ -227,7 +221,6 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn, - kunmap_atomic(va); - } - --vipt_cache: - if (!icache_is_pipt() && !icache_is_vivt_asid_tagged()) { - /* any kind of VIPT cache */ - __flush_icache_all(); -diff --git a/arch/arm64/include/asm/kvm_mmu.h b/arch/arm64/include/asm/kvm_mmu.h -index 61505676d085..819b21a9851c 100644 ---- a/arch/arm64/include/asm/kvm_mmu.h -+++ b/arch/arm64/include/asm/kvm_mmu.h -@@ -236,8 +236,7 @@ static inline void __coherent_cache_guest_page(struct kvm_vcpu *vcpu, pfn_t pfn, - { - void *va = page_address(pfn_to_page(pfn)); - -- if (!vcpu_has_cache_enabled(vcpu) || ipa_uncached) -- kvm_flush_dcache_to_poc(va, size); -+ kvm_flush_dcache_to_poc(va, size); - - if (!icache_is_aliasing()) { /* PIPT */ - flush_icache_range((unsigned long)va, -diff --git a/arch/mips/bcm47xx/buttons.c b/arch/mips/bcm47xx/buttons.c -index 52caa75bfe4e..e2f50d690624 100644 ---- a/arch/mips/bcm47xx/buttons.c -+++ b/arch/mips/bcm47xx/buttons.c -@@ -17,6 +17,12 @@ - .active_low = 1, \ - } - -+#define BCM47XX_GPIO_KEY_H(_gpio, _code) \ -+ { \ -+ .code = _code, \ -+ .gpio = _gpio, \ -+ } -+ - /* Asus */ - - static const struct gpio_keys_button -@@ -79,8 +85,8 @@ bcm47xx_buttons_asus_wl500gpv2[] __initconst = { - - static const struct gpio_keys_button - bcm47xx_buttons_asus_wl500w[] __initconst = { -- BCM47XX_GPIO_KEY(6, KEY_RESTART), -- BCM47XX_GPIO_KEY(7, KEY_WPS_BUTTON), -+ BCM47XX_GPIO_KEY_H(6, KEY_RESTART), -+ BCM47XX_GPIO_KEY_H(7, KEY_WPS_BUTTON), - }; - - static const struct gpio_keys_button -diff --git a/arch/mips/cavium-octeon/octeon-memcpy.S b/arch/mips/cavium-octeon/octeon-memcpy.S -index 64e08df51d65..8b7004132491 100644 ---- a/arch/mips/cavium-octeon/octeon-memcpy.S -+++ b/arch/mips/cavium-octeon/octeon-memcpy.S -@@ -208,18 +208,18 @@ EXC( STORE t2, UNIT(6)(dst), s_exc_p10u) - ADD src, src, 16*NBYTES - EXC( STORE t3, UNIT(7)(dst), s_exc_p9u) - ADD dst, dst, 16*NBYTES --EXC( LOAD t0, UNIT(-8)(src), l_exc_copy) --EXC( LOAD t1, UNIT(-7)(src), l_exc_copy) --EXC( LOAD t2, UNIT(-6)(src), l_exc_copy) --EXC( LOAD t3, UNIT(-5)(src), l_exc_copy) -+EXC( LOAD t0, UNIT(-8)(src), l_exc_copy_rewind16) -+EXC( LOAD t1, UNIT(-7)(src), l_exc_copy_rewind16) -+EXC( LOAD t2, UNIT(-6)(src), l_exc_copy_rewind16) -+EXC( LOAD t3, UNIT(-5)(src), l_exc_copy_rewind16) - EXC( STORE t0, UNIT(-8)(dst), s_exc_p8u) - EXC( STORE t1, UNIT(-7)(dst), s_exc_p7u) - EXC( STORE t2, UNIT(-6)(dst), s_exc_p6u) - EXC( STORE t3, UNIT(-5)(dst), s_exc_p5u) --EXC( LOAD t0, UNIT(-4)(src), l_exc_copy) --EXC( LOAD t1, UNIT(-3)(src), l_exc_copy) --EXC( LOAD t2, UNIT(-2)(src), l_exc_copy) --EXC( LOAD t3, UNIT(-1)(src), l_exc_copy) -+EXC( LOAD t0, UNIT(-4)(src), l_exc_copy_rewind16) -+EXC( LOAD t1, UNIT(-3)(src), l_exc_copy_rewind16) -+EXC( LOAD t2, UNIT(-2)(src), l_exc_copy_rewind16) -+EXC( LOAD t3, UNIT(-1)(src), l_exc_copy_rewind16) - EXC( STORE t0, UNIT(-4)(dst), s_exc_p4u) - EXC( STORE t1, UNIT(-3)(dst), s_exc_p3u) - EXC( STORE t2, UNIT(-2)(dst), s_exc_p2u) -@@ -383,6 +383,10 @@ done: - nop - END(memcpy) - -+l_exc_copy_rewind16: -+ /* Rewind src and dst by 16*NBYTES for l_exc_copy */ -+ SUB src, src, 16*NBYTES -+ SUB dst, dst, 16*NBYTES - l_exc_copy: - /* - * Copy bytes from src until faulting load address (or until a -diff --git a/arch/mips/include/asm/checksum.h b/arch/mips/include/asm/checksum.h -index 3ceacde5eb6e..17f89f9670b2 100644 ---- a/arch/mips/include/asm/checksum.h -+++ b/arch/mips/include/asm/checksum.h -@@ -186,7 +186,9 @@ static inline __wsum csum_tcpudp_nofold(__be32 saddr, - " daddu %0, %4 \n" - " dsll32 $1, %0, 0 \n" - " daddu %0, $1 \n" -+ " sltu $1, %0, $1 \n" - " dsra32 %0, %0, 0 \n" -+ " addu %0, $1 \n" - #endif - " .set pop" - : "=r" (sum) -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 44a6f25e902e..fc537d1b649d 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -191,11 +191,9 @@ struct mips_frame_info { - #define J_TARGET(pc,target) \ - (((unsigned long)(pc) & 0xf0000000) | ((target) << 2)) - --static inline int is_ra_save_ins(union mips_instruction *ip) -+static inline int is_ra_save_ins(union mips_instruction *ip, int *poff) - { - #ifdef CONFIG_CPU_MICROMIPS -- union mips_instruction mmi; -- - /* - * swsp ra,offset - * swm16 reglist,offset(sp) -@@ -205,29 +203,71 @@ static inline int is_ra_save_ins(union mips_instruction *ip) - * - * microMIPS is way more fun... - */ -- if (mm_insn_16bit(ip->halfword[0])) { -- mmi.word = (ip->halfword[0] << 16); -- return (mmi.mm16_r5_format.opcode == mm_swsp16_op && -- mmi.mm16_r5_format.rt == 31) || -- (mmi.mm16_m_format.opcode == mm_pool16c_op && -- mmi.mm16_m_format.func == mm_swm16_op); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ switch (ip->mm16_r5_format.opcode) { -+ case mm_swsp16_op: -+ if (ip->mm16_r5_format.rt != 31) -+ return 0; -+ -+ *poff = ip->mm16_r5_format.simmediate; -+ *poff = (*poff << 2) / sizeof(ulong); -+ return 1; -+ -+ case mm_pool16c_op: -+ switch (ip->mm16_m_format.func) { -+ case mm_swm16_op: -+ *poff = ip->mm16_m_format.imm; -+ *poff += 1 + ip->mm16_m_format.rlist; -+ *poff = (*poff << 2) / sizeof(ulong); -+ return 1; -+ -+ default: -+ return 0; -+ } -+ -+ default: -+ return 0; -+ } - } -- else { -- mmi.halfword[0] = ip->halfword[1]; -- mmi.halfword[1] = ip->halfword[0]; -- return (mmi.mm_m_format.opcode == mm_pool32b_op && -- mmi.mm_m_format.rd > 9 && -- mmi.mm_m_format.base == 29 && -- mmi.mm_m_format.func == mm_swm32_func) || -- (mmi.i_format.opcode == mm_sw32_op && -- mmi.i_format.rs == 29 && -- mmi.i_format.rt == 31); -+ -+ switch (ip->i_format.opcode) { -+ case mm_sw32_op: -+ if (ip->i_format.rs != 29) -+ return 0; -+ if (ip->i_format.rt != 31) -+ return 0; -+ -+ *poff = ip->i_format.simmediate / sizeof(ulong); -+ return 1; -+ -+ case mm_pool32b_op: -+ switch (ip->mm_m_format.func) { -+ case mm_swm32_func: -+ if (ip->mm_m_format.rd < 0x10) -+ return 0; -+ if (ip->mm_m_format.base != 29) -+ return 0; -+ -+ *poff = ip->mm_m_format.simmediate; -+ *poff += (ip->mm_m_format.rd & 0xf) * sizeof(u32); -+ *poff /= sizeof(ulong); -+ return 1; -+ default: -+ return 0; -+ } -+ -+ default: -+ return 0; - } - #else - /* sw / sd $ra, offset($sp) */ -- return (ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && -- ip->i_format.rs == 29 && -- ip->i_format.rt == 31; -+ if ((ip->i_format.opcode == sw_op || ip->i_format.opcode == sd_op) && -+ ip->i_format.rs == 29 && ip->i_format.rt == 31) { -+ *poff = ip->i_format.simmediate / sizeof(ulong); -+ return 1; -+ } -+ -+ return 0; - #endif - } - -@@ -242,13 +282,16 @@ static inline int is_jump_ins(union mips_instruction *ip) - * - * microMIPS is kind of more fun... - */ -- union mips_instruction mmi; -- -- mmi.word = (ip->halfword[0] << 16); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ if ((ip->mm16_r5_format.opcode == mm_pool16c_op && -+ (ip->mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op)) -+ return 1; -+ return 0; -+ } - -- if ((mmi.mm16_r5_format.opcode == mm_pool16c_op && -- (mmi.mm16_r5_format.rt & mm_jr16_op) == mm_jr16_op) || -- ip->j_format.opcode == mm_jal32_op) -+ if (ip->j_format.opcode == mm_j32_op) -+ return 1; -+ if (ip->j_format.opcode == mm_jal32_op) - return 1; - if (ip->r_format.opcode != mm_pool32a_op || - ip->r_format.func != mm_pool32axf_op) -@@ -276,15 +319,13 @@ static inline int is_sp_move_ins(union mips_instruction *ip) - * - * microMIPS is not more fun... - */ -- if (mm_insn_16bit(ip->halfword[0])) { -- union mips_instruction mmi; -- -- mmi.word = (ip->halfword[0] << 16); -- return (mmi.mm16_r3_format.opcode == mm_pool16d_op && -- mmi.mm16_r3_format.simmediate && mm_addiusp_func) || -- (mmi.mm16_r5_format.opcode == mm_pool16d_op && -- mmi.mm16_r5_format.rt == 29); -+ if (mm_insn_16bit(ip->halfword[1])) { -+ return (ip->mm16_r3_format.opcode == mm_pool16d_op && -+ ip->mm16_r3_format.simmediate && mm_addiusp_func) || -+ (ip->mm16_r5_format.opcode == mm_pool16d_op && -+ ip->mm16_r5_format.rt == 29); - } -+ - return ip->mm_i_format.opcode == mm_addiu32_op && - ip->mm_i_format.rt == 29 && ip->mm_i_format.rs == 29; - #else -@@ -299,30 +340,36 @@ static inline int is_sp_move_ins(union mips_instruction *ip) - - static int get_frame_info(struct mips_frame_info *info) - { --#ifdef CONFIG_CPU_MICROMIPS -- union mips_instruction *ip = (void *) (((char *) info->func) - 1); --#else -- union mips_instruction *ip = info->func; --#endif -- unsigned max_insns = info->func_size / sizeof(union mips_instruction); -- unsigned i; -+ bool is_mmips = IS_ENABLED(CONFIG_CPU_MICROMIPS); -+ union mips_instruction insn, *ip, *ip_end; -+ const unsigned int max_insns = 128; -+ unsigned int i; - - info->pc_offset = -1; - info->frame_size = 0; - -+ ip = (void *)msk_isa16_mode((ulong)info->func); - if (!ip) - goto err; - -- if (max_insns == 0) -- max_insns = 128U; /* unknown function size */ -- max_insns = min(128U, max_insns); -+ ip_end = (void *)ip + info->func_size; - -- for (i = 0; i < max_insns; i++, ip++) { -+ for (i = 0; i < max_insns && ip < ip_end; i++, ip++) { -+ if (is_mmips && mm_insn_16bit(ip->halfword[0])) { -+ insn.halfword[0] = 0; -+ insn.halfword[1] = ip->halfword[0]; -+ } else if (is_mmips) { -+ insn.halfword[0] = ip->halfword[1]; -+ insn.halfword[1] = ip->halfword[0]; -+ } else { -+ insn.word = ip->word; -+ } - -- if (is_jump_ins(ip)) -+ if (is_jump_ins(&insn)) - break; -+ - if (!info->frame_size) { -- if (is_sp_move_ins(ip)) -+ if (is_sp_move_ins(&insn)) - { - #ifdef CONFIG_CPU_MICROMIPS - if (mm_insn_16bit(ip->halfword[0])) -@@ -345,11 +392,9 @@ static int get_frame_info(struct mips_frame_info *info) - } - continue; - } -- if (info->pc_offset == -1 && is_ra_save_ins(ip)) { -- info->pc_offset = -- ip->i_format.simmediate / sizeof(long); -+ if (info->pc_offset == -1 && -+ is_ra_save_ins(&insn, &info->pc_offset)) - break; -- } - } - if (info->frame_size && info->pc_offset >= 0) /* nested */ - return 0; -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 80554e8f6037..3e390a4e3897 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -545,7 +545,7 @@ void __init ltq_soc_init(void) - clkdev_add_pmu("1a800000.pcie", "msi", 1, 1, PMU1_PCIE2_MSI); - clkdev_add_pmu("1a800000.pcie", "pdi", 1, 1, PMU1_PCIE2_PDI); - clkdev_add_pmu("1a800000.pcie", "ctl", 1, 1, PMU1_PCIE2_CTL); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | PMU_PPE_DP); -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | PMU_PPE_DP); - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); - clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); - } else if (of_machine_is_compatible("lantiq,ar10")) { -@@ -553,7 +553,7 @@ void __init ltq_soc_init(void) - ltq_ar10_fpi_hz(), ltq_ar10_pp32_hz()); - clkdev_add_pmu("1e101000.usb", "ctl", 1, 0, PMU_USB0); - clkdev_add_pmu("1e106000.usb", "ctl", 1, 0, PMU_USB1); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, PMU_SWITCH | -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, PMU_SWITCH | - PMU_PPE_DP | PMU_PPE_TC); - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); - clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); -@@ -575,11 +575,11 @@ void __init ltq_soc_init(void) - clkdev_add_pmu(NULL, "ahb", 1, 0, PMU_AHBM | PMU_AHBS); - - clkdev_add_pmu("1da00000.usif", "NULL", 1, 0, PMU_USIF); -- clkdev_add_pmu("1e108000.eth", NULL, 1, 0, -+ clkdev_add_pmu("1e108000.eth", NULL, 0, 0, - PMU_SWITCH | PMU_PPE_DPLUS | PMU_PPE_DPLUM | - PMU_PPE_EMA | PMU_PPE_TC | PMU_PPE_SLL01 | - PMU_PPE_QSB | PMU_PPE_TOP); -- clkdev_add_pmu("1f203000.rcu", "gphy", 1, 0, PMU_GPHY); -+ clkdev_add_pmu("1f203000.rcu", "gphy", 0, 0, PMU_GPHY); - clkdev_add_pmu("1e103000.sdio", NULL, 1, 0, PMU_SDIO); - clkdev_add_pmu("1e103100.deu", NULL, 1, 0, PMU_DEU); - clkdev_add_pmu("1e116000.mei", "dfe", 1, 0, PMU_DFE); -diff --git a/arch/mips/mm/sc-ip22.c b/arch/mips/mm/sc-ip22.c -index dc7c5a5214a9..efaf364fe581 100644 ---- a/arch/mips/mm/sc-ip22.c -+++ b/arch/mips/mm/sc-ip22.c -@@ -31,26 +31,40 @@ static inline void indy_sc_wipe(unsigned long first, unsigned long last) - unsigned long tmp; - - __asm__ __volatile__( -- ".set\tpush\t\t\t# indy_sc_wipe\n\t" -- ".set\tnoreorder\n\t" -- ".set\tmips3\n\t" -- ".set\tnoat\n\t" -- "mfc0\t%2, $12\n\t" -- "li\t$1, 0x80\t\t\t# Go 64 bit\n\t" -- "mtc0\t$1, $12\n\t" -- -- "dli\t$1, 0x9000000080000000\n\t" -- "or\t%0, $1\t\t\t# first line to flush\n\t" -- "or\t%1, $1\t\t\t# last line to flush\n\t" -- ".set\tat\n\t" -- -- "1:\tsw\t$0, 0(%0)\n\t" -- "bne\t%0, %1, 1b\n\t" -- " daddu\t%0, 32\n\t" -- -- "mtc0\t%2, $12\t\t\t# Back to 32 bit\n\t" -- "nop; nop; nop; nop;\n\t" -- ".set\tpop" -+ " .set push # indy_sc_wipe \n" -+ " .set noreorder \n" -+ " .set mips3 \n" -+ " .set noat \n" -+ " mfc0 %2, $12 \n" -+ " li $1, 0x80 # Go 64 bit \n" -+ " mtc0 $1, $12 \n" -+ " \n" -+ " # \n" -+ " # Open code a dli $1, 0x9000000080000000 \n" -+ " # \n" -+ " # Required because binutils 2.25 will happily accept \n" -+ " # 64 bit instructions in .set mips3 mode but puke on \n" -+ " # 64 bit constants when generating 32 bit ELF \n" -+ " # \n" -+ " lui $1,0x9000 \n" -+ " dsll $1,$1,0x10 \n" -+ " ori $1,$1,0x8000 \n" -+ " dsll $1,$1,0x10 \n" -+ " \n" -+ " or %0, $1 # first line to flush \n" -+ " or %1, $1 # last line to flush \n" -+ " .set at \n" -+ " \n" -+ "1: sw $0, 0(%0) \n" -+ " bne %0, %1, 1b \n" -+ " daddu %0, 32 \n" -+ " \n" -+ " mtc0 %2, $12 # Back to 32 bit \n" -+ " nop # pipeline hazard \n" -+ " nop \n" -+ " nop \n" -+ " nop \n" -+ " .set pop \n" - : "=r" (first), "=r" (last), "=&r" (tmp) - : "0" (first), "1" (last)); - } -diff --git a/arch/powerpc/kernel/hw_breakpoint.c b/arch/powerpc/kernel/hw_breakpoint.c -index 05e804cdecaa..fdf48785d3e9 100644 ---- a/arch/powerpc/kernel/hw_breakpoint.c -+++ b/arch/powerpc/kernel/hw_breakpoint.c -@@ -227,8 +227,10 @@ int __kprobes hw_breakpoint_handler(struct die_args *args) - rcu_read_lock(); - - bp = __this_cpu_read(bp_per_reg); -- if (!bp) -+ if (!bp) { -+ rc = NOTIFY_DONE; - goto out; -+ } - info = counter_arch_bp(bp); - - /* -diff --git a/crypto/testmgr.h b/crypto/testmgr.h -index da0a8fd765f4..0e02c60a57b6 100644 ---- a/crypto/testmgr.h -+++ b/crypto/testmgr.h -@@ -21778,7 +21778,7 @@ static struct aead_testvec aes_ccm_enc_tv_template[] = { - "\x09\x75\x9a\x9b\x3c\x9b\x27\x39", - .klen = 32, - .iv = "\x03\xf9\xd9\x4e\x63\xb5\x3d\x9d" -- "\x43\xf6\x1e\x50", -+ "\x43\xf6\x1e\x50\0\0\0\0", - .assoc = "\x57\xf5\x6b\x8b\x57\x5c\x3d\x3b" - "\x13\x02\x01\x0c\x83\x4c\x96\x35" - "\x8e\xd6\x39\xcf\x7d\x14\x9b\x94" -diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c -index 59d8d0d14824..327f9e374b44 100644 ---- a/drivers/bcma/main.c -+++ b/drivers/bcma/main.c -@@ -640,8 +640,11 @@ static int bcma_device_probe(struct device *dev) - drv); - int err = 0; - -+ get_device(dev); - if (adrv->probe) - err = adrv->probe(core); -+ if (err) -+ put_device(dev); - - return err; - } -@@ -654,6 +657,7 @@ static int bcma_device_remove(struct device *dev) - - if (adrv->remove) - adrv->remove(core); -+ put_device(dev); - - return 0; - } -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index ab0b2dd3f629..cec36d5c24f5 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1108,9 +1108,12 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - if ((unsigned int) info->lo_encrypt_key_size > LO_KEY_SIZE) - return -EINVAL; - -+ /* I/O need to be drained during transfer transition */ -+ blk_mq_freeze_queue(lo->lo_queue); -+ - err = loop_release_xfer(lo); - if (err) -- return err; -+ goto exit; - - if (info->lo_encrypt_type) { - unsigned int type = info->lo_encrypt_type; -@@ -1125,12 +1128,14 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - - err = loop_init_xfer(lo, xfer, info); - if (err) -- return err; -+ goto exit; - - if (lo->lo_offset != info->lo_offset || - lo->lo_sizelimit != info->lo_sizelimit) -- if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) -- return -EFBIG; -+ if (figure_loop_size(lo, info->lo_offset, info->lo_sizelimit)) { -+ err = -EFBIG; -+ goto exit; -+ } - - loop_config_discard(lo); - -@@ -1148,13 +1153,6 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - (info->lo_flags & LO_FLAGS_AUTOCLEAR)) - lo->lo_flags ^= LO_FLAGS_AUTOCLEAR; - -- if ((info->lo_flags & LO_FLAGS_PARTSCAN) && -- !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { -- lo->lo_flags |= LO_FLAGS_PARTSCAN; -- lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; -- loop_reread_partitions(lo, lo->lo_device); -- } -- - lo->lo_encrypt_key_size = info->lo_encrypt_key_size; - lo->lo_init[0] = info->lo_init[0]; - lo->lo_init[1] = info->lo_init[1]; -@@ -1167,7 +1165,17 @@ loop_set_status(struct loop_device *lo, const struct loop_info64 *info) - /* update dio if lo_offset or transfer is changed */ - __loop_update_dio(lo, lo->use_dio); - -- return 0; -+ exit: -+ blk_mq_unfreeze_queue(lo->lo_queue); -+ -+ if (!err && (info->lo_flags & LO_FLAGS_PARTSCAN) && -+ !(lo->lo_flags & LO_FLAGS_PARTSCAN)) { -+ lo->lo_flags |= LO_FLAGS_PARTSCAN; -+ lo->lo_disk->flags &= ~GENHD_FL_NO_PART_SCAN; -+ loop_reread_partitions(lo, lo->lo_device); -+ } -+ -+ return err; - } - - static int -diff --git a/drivers/dma/ipu/ipu_irq.c b/drivers/dma/ipu/ipu_irq.c -index dd184b50e5b4..284627806b88 100644 ---- a/drivers/dma/ipu/ipu_irq.c -+++ b/drivers/dma/ipu/ipu_irq.c -@@ -272,7 +272,7 @@ static void ipu_irq_handler(struct irq_desc *desc) - u32 status; - int i, line; - -- for (i = IPU_IRQ_NR_FN_BANKS; i < IPU_IRQ_NR_BANKS; i++) { -+ for (i = 0; i < IPU_IRQ_NR_BANKS; i++) { - struct ipu_irq_bank *bank = irq_bank + i; - - raw_spin_lock(&bank_lock); -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 63194a9a7189..89fd0113aa5c 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -422,7 +422,7 @@ int hv_synic_alloc(void) - goto err; - } - -- for_each_online_cpu(cpu) { -+ for_each_present_cpu(cpu) { - hv_context.event_dpc[cpu] = kmalloc(size, GFP_ATOMIC); - if (hv_context.event_dpc[cpu] == NULL) { - pr_err("Unable to allocate event dpc\n"); -@@ -461,6 +461,8 @@ int hv_synic_alloc(void) - pr_err("Unable to allocate post msg page\n"); - goto err; - } -+ -+ INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); - } - - return 0; -@@ -485,7 +487,7 @@ void hv_synic_free(void) - int cpu; - - kfree(hv_context.hv_numa_map); -- for_each_online_cpu(cpu) -+ for_each_present_cpu(cpu) - hv_synic_free_cpu(cpu); - } - -@@ -555,8 +557,6 @@ void hv_synic_init(void *arg) - rdmsrl(HV_X64_MSR_VP_INDEX, vp_index); - hv_context.vp_index[cpu] = (u32)vp_index; - -- INIT_LIST_HEAD(&hv_context.percpu_list[cpu]); -- - /* - * Register the per-cpu clockevent source. - */ -diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c -index c37a71e13de0..1fb02dcbc500 100644 ---- a/drivers/hv/hv_fcopy.c -+++ b/drivers/hv/hv_fcopy.c -@@ -61,6 +61,7 @@ static DECLARE_WORK(fcopy_send_work, fcopy_send_data); - static const char fcopy_devname[] = "vmbus/hv_fcopy"; - static u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - /* - * This state maintains the version number registered by the daemon. - */ -@@ -312,12 +313,14 @@ static void fcopy_on_reset(void) - - if (cancel_delayed_work_sync(&fcopy_timeout_work)) - fcopy_respond_to_host(HV_E_FAIL); -+ complete(&release_event); - } - - int hv_fcopy_init(struct hv_util_service *srv) - { - recv_buffer = srv->recv_buffer; - -+ init_completion(&release_event); - /* - * When this driver loads, the user level daemon that - * processes the host requests may not yet be running. -@@ -339,4 +342,5 @@ void hv_fcopy_deinit(void) - fcopy_transaction.state = HVUTIL_DEVICE_DYING; - cancel_delayed_work_sync(&fcopy_timeout_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c -index 2a3420c4ca59..ce4d3a935491 100644 ---- a/drivers/hv/hv_kvp.c -+++ b/drivers/hv/hv_kvp.c -@@ -86,6 +86,7 @@ static DECLARE_WORK(kvp_sendkey_work, kvp_send_key); - static const char kvp_devname[] = "vmbus/hv_kvp"; - static u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - /* - * Register the kernel component with the user-level daemon. - * As part of this registration, pass the LIC version number. -@@ -682,6 +683,7 @@ static void kvp_on_reset(void) - if (cancel_delayed_work_sync(&kvp_timeout_work)) - kvp_respond_to_host(NULL, HV_E_FAIL); - kvp_transaction.state = HVUTIL_DEVICE_INIT; -+ complete(&release_event); - } - - int -@@ -689,6 +691,7 @@ hv_kvp_init(struct hv_util_service *srv) - { - recv_buffer = srv->recv_buffer; - -+ init_completion(&release_event); - /* - * When this driver loads, the user level daemon that - * processes the host requests may not yet be running. -@@ -711,4 +714,5 @@ void hv_kvp_deinit(void) - cancel_delayed_work_sync(&kvp_timeout_work); - cancel_work_sync(&kvp_sendkey_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/hv/hv_snapshot.c b/drivers/hv/hv_snapshot.c -index 81882d4848bd..faad79ae318a 100644 ---- a/drivers/hv/hv_snapshot.c -+++ b/drivers/hv/hv_snapshot.c -@@ -66,6 +66,7 @@ static int dm_reg_value; - static const char vss_devname[] = "vmbus/hv_vss"; - static __u8 *recv_buffer; - static struct hvutil_transport *hvt; -+static struct completion release_event; - - static void vss_send_op(struct work_struct *dummy); - static void vss_timeout_func(struct work_struct *dummy); -@@ -326,11 +327,13 @@ static void vss_on_reset(void) - if (cancel_delayed_work_sync(&vss_timeout_work)) - vss_respond_to_host(HV_E_FAIL); - vss_transaction.state = HVUTIL_DEVICE_INIT; -+ complete(&release_event); - } - - int - hv_vss_init(struct hv_util_service *srv) - { -+ init_completion(&release_event); - if (vmbus_proto_version < VERSION_WIN8_1) { - pr_warn("Integration service 'Backup (volume snapshot)'" - " not supported on this host version.\n"); -@@ -360,4 +363,5 @@ void hv_vss_deinit(void) - cancel_delayed_work_sync(&vss_timeout_work); - cancel_work_sync(&vss_send_op_work); - hvutil_transport_destroy(hvt); -+ wait_for_completion(&release_event); - } -diff --git a/drivers/iio/pressure/mpl115.c b/drivers/iio/pressure/mpl115.c -index a0d7deeac62f..3f90985d545e 100644 ---- a/drivers/iio/pressure/mpl115.c -+++ b/drivers/iio/pressure/mpl115.c -@@ -136,6 +136,7 @@ static const struct iio_chan_spec mpl115_channels[] = { - { - .type = IIO_TEMP, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -+ .info_mask_shared_by_type = - BIT(IIO_CHAN_INFO_OFFSET) | BIT(IIO_CHAN_INFO_SCALE), - }, - }; -diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c -index 01b2e0b18878..0f5b8767ec2e 100644 ---- a/drivers/iio/pressure/mpl3115.c -+++ b/drivers/iio/pressure/mpl3115.c -@@ -182,7 +182,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { - { - .type = IIO_PRESSURE, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- BIT(IIO_CHAN_INFO_SCALE), -+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .scan_index = 0, - .scan_type = { - .sign = 'u', -@@ -195,7 +195,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { - { - .type = IIO_TEMP, - .info_mask_separate = BIT(IIO_CHAN_INFO_RAW), -- BIT(IIO_CHAN_INFO_SCALE), -+ .info_mask_shared_by_type = BIT(IIO_CHAN_INFO_SCALE), - .scan_index = 1, - .scan_type = { - .sign = 's', -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index c9dcad6a53bf..3f5741a3e728 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -3349,6 +3349,9 @@ static int cma_accept_iw(struct rdma_id_private *id_priv, - struct iw_cm_conn_param iw_param; - int ret; - -+ if (!conn_param) -+ return -EINVAL; -+ - ret = cma_modify_qp_rtr(id_priv, conn_param); - if (ret) - return ret; -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 9413b0726237..f0fc6f7b5d98 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -3238,13 +3238,14 @@ static int __init init_dmars(void) - iommu_identity_mapping |= IDENTMAP_GFX; - #endif - -+ check_tylersburg_isoch(); -+ - if (iommu_identity_mapping) { - ret = si_domain_init(hw_pass_through); - if (ret) - goto free_iommu; - } - -- check_tylersburg_isoch(); - - /* - * If we copied translations from a previous kernel in the kdump -diff --git a/drivers/md/dm-cache-target.c b/drivers/md/dm-cache-target.c -index 515f83e7d9ab..b59615ddf6ba 100644 ---- a/drivers/md/dm-cache-target.c -+++ b/drivers/md/dm-cache-target.c -@@ -251,7 +251,7 @@ struct cache { - /* - * Fields for converting from sectors to blocks. - */ -- uint32_t sectors_per_block; -+ sector_t sectors_per_block; - int sectors_per_block_shift; - - spinlock_t lock; -@@ -3547,11 +3547,11 @@ static void cache_status(struct dm_target *ti, status_type_t type, - - residency = policy_residency(cache->policy); - -- DMEMIT("%u %llu/%llu %u %llu/%llu %u %u %u %u %u %u %lu ", -+ DMEMIT("%u %llu/%llu %llu %llu/%llu %u %u %u %u %u %u %lu ", - (unsigned)DM_CACHE_METADATA_BLOCK_SIZE, - (unsigned long long)(nr_blocks_metadata - nr_free_blocks_metadata), - (unsigned long long)nr_blocks_metadata, -- cache->sectors_per_block, -+ (unsigned long long)cache->sectors_per_block, - (unsigned long long) from_cblock(residency), - (unsigned long long) from_cblock(cache->cache_size), - (unsigned) atomic_read(&cache->stats.read_hit), -diff --git a/drivers/md/dm-stats.c b/drivers/md/dm-stats.c -index 8289804ccd99..d5ea9f28ae70 100644 ---- a/drivers/md/dm-stats.c -+++ b/drivers/md/dm-stats.c -@@ -175,6 +175,7 @@ static void dm_stat_free(struct rcu_head *head) - int cpu; - struct dm_stat *s = container_of(head, struct dm_stat, rcu_head); - -+ kfree(s->histogram_boundaries); - kfree(s->program_id); - kfree(s->aux_data); - for_each_possible_cpu(cpu) { -diff --git a/drivers/md/linear.c b/drivers/md/linear.c -index b7fe7e9fc777..6ba3227e29b2 100644 ---- a/drivers/md/linear.c -+++ b/drivers/md/linear.c -@@ -52,18 +52,26 @@ static inline struct dev_info *which_dev(struct mddev *mddev, sector_t sector) - return conf->disks + lo; - } - -+/* -+ * In linear_congested() conf->raid_disks is used as a copy of -+ * mddev->raid_disks to iterate conf->disks[], because conf->raid_disks -+ * and conf->disks[] are created in linear_conf(), they are always -+ * consitent with each other, but mddev->raid_disks does not. -+ */ - static int linear_congested(struct mddev *mddev, int bits) - { - struct linear_conf *conf; - int i, ret = 0; - -- conf = mddev->private; -+ rcu_read_lock(); -+ conf = rcu_dereference(mddev->private); - -- for (i = 0; i < mddev->raid_disks && !ret ; i++) { -+ for (i = 0; i < conf->raid_disks && !ret ; i++) { - struct request_queue *q = bdev_get_queue(conf->disks[i].rdev->bdev); - ret |= bdi_congested(&q->backing_dev_info, bits); - } - -+ rcu_read_unlock(); - return ret; - } - -@@ -143,6 +151,19 @@ static struct linear_conf *linear_conf(struct mddev *mddev, int raid_disks) - conf->disks[i-1].end_sector + - conf->disks[i].rdev->sectors; - -+ /* -+ * conf->raid_disks is copy of mddev->raid_disks. The reason to -+ * keep a copy of mddev->raid_disks in struct linear_conf is, -+ * mddev->raid_disks may not be consistent with pointers number of -+ * conf->disks[] when it is updated in linear_add() and used to -+ * iterate old conf->disks[] earray in linear_congested(). -+ * Here conf->raid_disks is always consitent with number of -+ * pointers in conf->disks[] array, and mddev->private is updated -+ * with rcu_assign_pointer() in linear_addr(), such race can be -+ * avoided. -+ */ -+ conf->raid_disks = raid_disks; -+ - return conf; - - out: -@@ -195,15 +216,23 @@ static int linear_add(struct mddev *mddev, struct md_rdev *rdev) - if (!newconf) - return -ENOMEM; - -+ /* newconf->raid_disks already keeps a copy of * the increased -+ * value of mddev->raid_disks, WARN_ONCE() is just used to make -+ * sure of this. It is possible that oldconf is still referenced -+ * in linear_congested(), therefore kfree_rcu() is used to free -+ * oldconf until no one uses it anymore. -+ */ - mddev_suspend(mddev); -- oldconf = mddev->private; -+ oldconf = rcu_dereference(mddev->private); - mddev->raid_disks++; -- mddev->private = newconf; -+ WARN_ONCE(mddev->raid_disks != newconf->raid_disks, -+ "copied raid_disks doesn't match mddev->raid_disks"); -+ rcu_assign_pointer(mddev->private, newconf); - md_set_array_sectors(mddev, linear_size(mddev, 0, 0)); - set_capacity(mddev->gendisk, mddev->array_sectors); - mddev_resume(mddev); - revalidate_disk(mddev->gendisk); -- kfree(oldconf); -+ kfree_rcu(oldconf, rcu); - return 0; - } - -diff --git a/drivers/md/linear.h b/drivers/md/linear.h -index b685ddd7d7f7..8d392e6098b3 100644 ---- a/drivers/md/linear.h -+++ b/drivers/md/linear.h -@@ -10,6 +10,7 @@ struct linear_conf - { - struct rcu_head rcu; - sector_t array_sectors; -+ int raid_disks; /* a copy of mddev->raid_disks */ - struct dev_info disks[0]; - }; - #endif -diff --git a/drivers/media/pci/dm1105/Kconfig b/drivers/media/pci/dm1105/Kconfig -index 173daf0c0847..14fa7e40f2a6 100644 ---- a/drivers/media/pci/dm1105/Kconfig -+++ b/drivers/media/pci/dm1105/Kconfig -@@ -1,6 +1,6 @@ - config DVB_DM1105 - tristate "SDMC DM1105 based PCI cards" -- depends on DVB_CORE && PCI && I2C -+ depends on DVB_CORE && PCI && I2C && I2C_ALGOBIT - select DVB_PLL if MEDIA_SUBDRV_AUTOSELECT - select DVB_STV0299 if MEDIA_SUBDRV_AUTOSELECT - select DVB_STV0288 if MEDIA_SUBDRV_AUTOSELECT -diff --git a/drivers/media/platform/am437x/am437x-vpfe.c b/drivers/media/platform/am437x/am437x-vpfe.c -index ba780c45f645..572bc043b62d 100644 ---- a/drivers/media/platform/am437x/am437x-vpfe.c -+++ b/drivers/media/platform/am437x/am437x-vpfe.c -@@ -1576,7 +1576,7 @@ static int vpfe_s_fmt(struct file *file, void *priv, - return -EBUSY; - } - -- ret = vpfe_try_fmt(file, priv, &format); -+ ret = __vpfe_get_format(vpfe, &format, &bpp); - if (ret) - return ret; - -diff --git a/drivers/media/usb/uvc/uvc_queue.c b/drivers/media/usb/uvc/uvc_queue.c -index cfb868a48b5f..ff6feff21e94 100644 ---- a/drivers/media/usb/uvc/uvc_queue.c -+++ b/drivers/media/usb/uvc/uvc_queue.c -@@ -416,7 +416,7 @@ struct uvc_buffer *uvc_queue_next_buffer(struct uvc_video_queue *queue, - nextbuf = NULL; - spin_unlock_irqrestore(&queue->irqlock, flags); - -- buf->state = buf->error ? VB2_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; -+ buf->state = buf->error ? UVC_BUF_STATE_ERROR : UVC_BUF_STATE_DONE; - vb2_set_plane_payload(&buf->buf.vb2_buf, 0, buf->bytesused); - vb2_buffer_done(&buf->buf.vb2_buf, VB2_BUF_STATE_DONE); - -diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c -index a731720f1d13..449b2a47f9a8 100644 ---- a/drivers/net/can/usb/usb_8dev.c -+++ b/drivers/net/can/usb/usb_8dev.c -@@ -954,8 +954,8 @@ static int usb_8dev_probe(struct usb_interface *intf, - for (i = 0; i < MAX_TX_URBS; i++) - priv->tx_contexts[i].echo_index = MAX_TX_URBS; - -- priv->cmd_msg_buffer = kzalloc(sizeof(struct usb_8dev_cmd_msg), -- GFP_KERNEL); -+ priv->cmd_msg_buffer = devm_kzalloc(&intf->dev, sizeof(struct usb_8dev_cmd_msg), -+ GFP_KERNEL); - if (!priv->cmd_msg_buffer) - goto cleanup_candev; - -@@ -969,7 +969,7 @@ static int usb_8dev_probe(struct usb_interface *intf, - if (err) { - netdev_err(netdev, - "couldn't register CAN device: %d\n", err); -- goto cleanup_cmd_msg_buffer; -+ goto cleanup_candev; - } - - err = usb_8dev_cmd_version(priv, &version); -@@ -990,9 +990,6 @@ static int usb_8dev_probe(struct usb_interface *intf, - cleanup_unregister_candev: - unregister_netdev(priv->netdev); - --cleanup_cmd_msg_buffer: -- kfree(priv->cmd_msg_buffer); -- - cleanup_candev: - free_candev(netdev); - -diff --git a/drivers/net/wireless/ath/ath5k/mac80211-ops.c b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -index dc44cfef7517..16e052d02c94 100644 ---- a/drivers/net/wireless/ath/ath5k/mac80211-ops.c -+++ b/drivers/net/wireless/ath/ath5k/mac80211-ops.c -@@ -502,8 +502,7 @@ ath5k_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - break; - return -EOPNOTSUPP; - default: -- WARN_ON(1); -- return -EINVAL; -+ return -EOPNOTSUPP; - } - - mutex_lock(&ah->lock); -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -index 694ca2e680e5..74670e08e6da 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -+++ b/drivers/net/wireless/ath/ath9k/ar9003_eeprom.h -@@ -73,13 +73,13 @@ - #define AR9300_OTP_BASE \ - ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30000 : 0x14000) - #define AR9300_OTP_STATUS \ -- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x30018 : 0x15f18) -+ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x31018 : 0x15f18) - #define AR9300_OTP_STATUS_TYPE 0x7 - #define AR9300_OTP_STATUS_VALID 0x4 - #define AR9300_OTP_STATUS_ACCESS_BUSY 0x2 - #define AR9300_OTP_STATUS_SM_BUSY 0x1 - #define AR9300_OTP_READ_DATA \ -- ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3001c : 0x15f1c) -+ ((AR_SREV_9340(ah) || AR_SREV_9550(ah)) ? 0x3101c : 0x15f1c) - - enum targetPowerHTRates { - HT_TARGET_RATE_0_8_16, -diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h -index b42f4a963ef4..a660e40f2df1 100644 ---- a/drivers/net/wireless/ath/ath9k/ath9k.h -+++ b/drivers/net/wireless/ath/ath9k/ath9k.h -@@ -959,6 +959,7 @@ struct ath_softc { - struct survey_info *cur_survey; - struct survey_info survey[ATH9K_NUM_CHANNELS]; - -+ spinlock_t intr_lock; - struct tasklet_struct intr_tq; - struct tasklet_struct bcon_tasklet; - struct ath_hw *sc_ah; -diff --git a/drivers/net/wireless/ath/ath9k/init.c b/drivers/net/wireless/ath/ath9k/init.c -index bc70ce62bc03..0f5672f5c9ba 100644 ---- a/drivers/net/wireless/ath/ath9k/init.c -+++ b/drivers/net/wireless/ath/ath9k/init.c -@@ -619,6 +619,7 @@ static int ath9k_init_softc(u16 devid, struct ath_softc *sc, - common->bt_ant_diversity = 1; - - spin_lock_init(&common->cc_lock); -+ spin_lock_init(&sc->intr_lock); - spin_lock_init(&sc->sc_serial_rw); - spin_lock_init(&sc->sc_pm_lock); - spin_lock_init(&sc->chan_lock); -diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c -index bba85d1a6cd1..d937c39b3a0b 100644 ---- a/drivers/net/wireless/ath/ath9k/mac.c -+++ b/drivers/net/wireless/ath/ath9k/mac.c -@@ -805,21 +805,12 @@ void ath9k_hw_disable_interrupts(struct ath_hw *ah) - } - EXPORT_SYMBOL(ath9k_hw_disable_interrupts); - --void ath9k_hw_enable_interrupts(struct ath_hw *ah) -+static void __ath9k_hw_enable_interrupts(struct ath_hw *ah) - { - struct ath_common *common = ath9k_hw_common(ah); - u32 sync_default = AR_INTR_SYNC_DEFAULT; - u32 async_mask; - -- if (!(ah->imask & ATH9K_INT_GLOBAL)) -- return; -- -- if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { -- ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -- atomic_read(&ah->intr_ref_cnt)); -- return; -- } -- - if (AR_SREV_9340(ah) || AR_SREV_9550(ah) || AR_SREV_9531(ah) || - AR_SREV_9561(ah)) - sync_default &= ~AR_INTR_SYNC_HOST1_FATAL; -@@ -841,6 +832,39 @@ void ath9k_hw_enable_interrupts(struct ath_hw *ah) - ath_dbg(common, INTERRUPT, "AR_IMR 0x%x IER 0x%x\n", - REG_READ(ah, AR_IMR), REG_READ(ah, AR_IER)); - } -+ -+void ath9k_hw_resume_interrupts(struct ath_hw *ah) -+{ -+ struct ath_common *common = ath9k_hw_common(ah); -+ -+ if (!(ah->imask & ATH9K_INT_GLOBAL)) -+ return; -+ -+ if (atomic_read(&ah->intr_ref_cnt) != 0) { -+ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -+ atomic_read(&ah->intr_ref_cnt)); -+ return; -+ } -+ -+ __ath9k_hw_enable_interrupts(ah); -+} -+EXPORT_SYMBOL(ath9k_hw_resume_interrupts); -+ -+void ath9k_hw_enable_interrupts(struct ath_hw *ah) -+{ -+ struct ath_common *common = ath9k_hw_common(ah); -+ -+ if (!(ah->imask & ATH9K_INT_GLOBAL)) -+ return; -+ -+ if (!atomic_inc_and_test(&ah->intr_ref_cnt)) { -+ ath_dbg(common, INTERRUPT, "Do not enable IER ref count %d\n", -+ atomic_read(&ah->intr_ref_cnt)); -+ return; -+ } -+ -+ __ath9k_hw_enable_interrupts(ah); -+} - EXPORT_SYMBOL(ath9k_hw_enable_interrupts); - - void ath9k_hw_set_interrupts(struct ath_hw *ah) -diff --git a/drivers/net/wireless/ath/ath9k/mac.h b/drivers/net/wireless/ath/ath9k/mac.h -index 7fbf7f965f61..1b63d26f30ce 100644 ---- a/drivers/net/wireless/ath/ath9k/mac.h -+++ b/drivers/net/wireless/ath/ath9k/mac.h -@@ -748,6 +748,7 @@ void ath9k_hw_set_interrupts(struct ath_hw *ah); - void ath9k_hw_enable_interrupts(struct ath_hw *ah); - void ath9k_hw_disable_interrupts(struct ath_hw *ah); - void ath9k_hw_kill_interrupts(struct ath_hw *ah); -+void ath9k_hw_resume_interrupts(struct ath_hw *ah); - - void ar9002_hw_attach_mac_ops(struct ath_hw *ah); - -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index 8c5d2cf9c979..b114e57a823f 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -373,21 +373,20 @@ void ath9k_tasklet(unsigned long data) - struct ath_common *common = ath9k_hw_common(ah); - enum ath_reset_type type; - unsigned long flags; -- u32 status = sc->intrstatus; -+ u32 status; - u32 rxmask; - -+ spin_lock_irqsave(&sc->intr_lock, flags); -+ status = sc->intrstatus; -+ sc->intrstatus = 0; -+ spin_unlock_irqrestore(&sc->intr_lock, flags); -+ - ath9k_ps_wakeup(sc); - spin_lock(&sc->sc_pcu_lock); - - if (status & ATH9K_INT_FATAL) { - type = RESET_TYPE_FATAL_INT; - ath9k_queue_reset(sc, type); -- -- /* -- * Increment the ref. counter here so that -- * interrupts are enabled in the reset routine. -- */ -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, "FATAL: Skipping interrupts\n"); - goto out; - } -@@ -403,11 +402,6 @@ void ath9k_tasklet(unsigned long data) - type = RESET_TYPE_BB_WATCHDOG; - ath9k_queue_reset(sc, type); - -- /* -- * Increment the ref. counter here so that -- * interrupts are enabled in the reset routine. -- */ -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, - "BB_WATCHDOG: Skipping interrupts\n"); - goto out; -@@ -420,7 +414,6 @@ void ath9k_tasklet(unsigned long data) - if ((sc->gtt_cnt >= MAX_GTT_CNT) && !ath9k_hw_check_alive(ah)) { - type = RESET_TYPE_TX_GTT; - ath9k_queue_reset(sc, type); -- atomic_inc(&ah->intr_ref_cnt); - ath_dbg(common, RESET, - "GTT: Skipping interrupts\n"); - goto out; -@@ -477,7 +470,7 @@ void ath9k_tasklet(unsigned long data) - ath9k_btcoex_handle_interrupt(sc, status); - - /* re-enable hardware interrupt */ -- ath9k_hw_enable_interrupts(ah); -+ ath9k_hw_resume_interrupts(ah); - out: - spin_unlock(&sc->sc_pcu_lock); - ath9k_ps_restore(sc); -@@ -541,7 +534,9 @@ irqreturn_t ath_isr(int irq, void *dev) - return IRQ_NONE; - - /* Cache the status */ -- sc->intrstatus = status; -+ spin_lock(&sc->intr_lock); -+ sc->intrstatus |= status; -+ spin_unlock(&sc->intr_lock); - - if (status & SCHED_INTR) - sched = true; -@@ -587,7 +582,7 @@ chip_reset: - - if (sched) { - /* turn off every interrupt */ -- ath9k_hw_disable_interrupts(ah); -+ ath9k_hw_kill_interrupts(ah); - tasklet_schedule(&sc->intr_tq); - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.h b/drivers/net/wireless/realtek/rtlwifi/pci.h -index 5da6703942d9..672f81ea02d0 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.h -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.h -@@ -275,10 +275,10 @@ struct mp_adapter { - }; - - struct rtl_pci_priv { -+ struct bt_coexist_info bt_coexist; -+ struct rtl_led_ctl ledctl; - struct rtl_pci dev; - struct mp_adapter ndis_adapter; -- struct rtl_led_ctl ledctl; -- struct bt_coexist_info bt_coexist; - }; - - #define rtl_pcipriv(hw) (((struct rtl_pci_priv *)(rtl_priv(hw))->priv)) -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -index 5f14308e8eb3..b1601441991d 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/hw.c -@@ -1003,7 +1003,7 @@ static void _rtl92ee_hw_configure(struct ieee80211_hw *hw) - rtl_write_word(rtlpriv, REG_SIFS_TRX, 0x100a); - - /* Note Data sheet don't define */ -- rtl_write_word(rtlpriv, 0x4C7, 0x80); -+ rtl_write_byte(rtlpriv, 0x4C7, 0x80); - - rtl_write_byte(rtlpriv, REG_RX_PKT_LIMIT, 0x20); - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index bbb789f8990b..c2103e7a8132 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) - } - if (0 == tmp) { - read_addr = REG_DBI_RDATA + addr % 4; -- ret = rtl_read_word(rtlpriv, read_addr); -+ ret = rtl_read_byte(rtlpriv, read_addr); - } - return ret; - } -diff --git a/drivers/net/wireless/realtek/rtlwifi/usb.h b/drivers/net/wireless/realtek/rtlwifi/usb.h -index 685273ca9561..441c4412130c 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/usb.h -+++ b/drivers/net/wireless/realtek/rtlwifi/usb.h -@@ -150,8 +150,9 @@ struct rtl_usb { - }; - - struct rtl_usb_priv { -- struct rtl_usb dev; -+ struct bt_coexist_info bt_coexist; - struct rtl_led_ctl ledctl; -+ struct rtl_usb dev; - }; - - #define rtl_usbpriv(hw) (((struct rtl_usb_priv *)(rtl_priv(hw))->priv)) -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 732ac71b82cd..88dbbeb8569b 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -4273,12 +4273,13 @@ static void regulator_summary_show_subtree(struct seq_file *s, - seq_puts(s, "\n"); - - list_for_each_entry(consumer, &rdev->consumer_list, list) { -- if (consumer->dev->class == ®ulator_class) -+ if (consumer->dev && consumer->dev->class == ®ulator_class) - continue; - - seq_printf(s, "%*s%-*s ", - (level + 1) * 3 + 1, "", -- 30 - (level + 1) * 3, dev_name(consumer->dev)); -+ 30 - (level + 1) * 3, -+ consumer->dev ? dev_name(consumer->dev) : "deviceless"); - - switch (rdev->desc->type) { - case REGULATOR_VOLTAGE: -diff --git a/drivers/rtc/rtc-sun6i.c b/drivers/rtc/rtc-sun6i.c -index c169a2cd4727..e29cc9fca0bf 100644 ---- a/drivers/rtc/rtc-sun6i.c -+++ b/drivers/rtc/rtc-sun6i.c -@@ -37,9 +37,11 @@ - - /* Control register */ - #define SUN6I_LOSC_CTRL 0x0000 -+#define SUN6I_LOSC_CTRL_KEY (0x16aa << 16) - #define SUN6I_LOSC_CTRL_ALM_DHMS_ACC BIT(9) - #define SUN6I_LOSC_CTRL_RTC_HMS_ACC BIT(8) - #define SUN6I_LOSC_CTRL_RTC_YMD_ACC BIT(7) -+#define SUN6I_LOSC_CTRL_EXT_OSC BIT(0) - #define SUN6I_LOSC_CTRL_ACC_MASK GENMASK(9, 7) - - /* RTC */ -@@ -114,13 +116,17 @@ struct sun6i_rtc_dev { - void __iomem *base; - int irq; - unsigned long alarm; -+ -+ spinlock_t lock; - }; - - static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) - { - struct sun6i_rtc_dev *chip = (struct sun6i_rtc_dev *) id; -+ irqreturn_t ret = IRQ_NONE; - u32 val; - -+ spin_lock(&chip->lock); - val = readl(chip->base + SUN6I_ALRM_IRQ_STA); - - if (val & SUN6I_ALRM_IRQ_STA_CNT_IRQ_PEND) { -@@ -129,10 +135,11 @@ static irqreturn_t sun6i_rtc_alarmirq(int irq, void *id) - - rtc_update_irq(chip->rtc, 1, RTC_AF | RTC_IRQF); - -- return IRQ_HANDLED; -+ ret = IRQ_HANDLED; - } -+ spin_unlock(&chip->lock); - -- return IRQ_NONE; -+ return ret; - } - - static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) -@@ -140,6 +147,7 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) - u32 alrm_val = 0; - u32 alrm_irq_val = 0; - u32 alrm_wake_val = 0; -+ unsigned long flags; - - if (to) { - alrm_val = SUN6I_ALRM_EN_CNT_EN; -@@ -150,9 +158,11 @@ static void sun6i_rtc_setaie(int to, struct sun6i_rtc_dev *chip) - chip->base + SUN6I_ALRM_IRQ_STA); - } - -+ spin_lock_irqsave(&chip->lock, flags); - writel(alrm_val, chip->base + SUN6I_ALRM_EN); - writel(alrm_irq_val, chip->base + SUN6I_ALRM_IRQ_EN); - writel(alrm_wake_val, chip->base + SUN6I_ALARM_CONFIG); -+ spin_unlock_irqrestore(&chip->lock, flags); - } - - static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) -@@ -191,11 +201,15 @@ static int sun6i_rtc_gettime(struct device *dev, struct rtc_time *rtc_tm) - static int sun6i_rtc_getalarm(struct device *dev, struct rtc_wkalrm *wkalrm) - { - struct sun6i_rtc_dev *chip = dev_get_drvdata(dev); -+ unsigned long flags; - u32 alrm_st; - u32 alrm_en; - -+ spin_lock_irqsave(&chip->lock, flags); - alrm_en = readl(chip->base + SUN6I_ALRM_IRQ_EN); - alrm_st = readl(chip->base + SUN6I_ALRM_IRQ_STA); -+ spin_unlock_irqrestore(&chip->lock, flags); -+ - wkalrm->enabled = !!(alrm_en & SUN6I_ALRM_EN_CNT_EN); - wkalrm->pending = !!(alrm_st & SUN6I_ALRM_EN_CNT_EN); - rtc_time_to_tm(chip->alarm, &wkalrm->time); -@@ -356,6 +370,7 @@ static int sun6i_rtc_probe(struct platform_device *pdev) - chip = devm_kzalloc(&pdev->dev, sizeof(*chip), GFP_KERNEL); - if (!chip) - return -ENOMEM; -+ spin_lock_init(&chip->lock); - - platform_set_drvdata(pdev, chip); - chip->dev = &pdev->dev; -@@ -404,6 +419,10 @@ static int sun6i_rtc_probe(struct platform_device *pdev) - /* disable alarm wakeup */ - writel(0, chip->base + SUN6I_ALARM_CONFIG); - -+ /* switch to the external, more precise, oscillator */ -+ writel(SUN6I_LOSC_CTRL_KEY | SUN6I_LOSC_CTRL_EXT_OSC, -+ chip->base + SUN6I_LOSC_CTRL); -+ - chip->rtc = rtc_device_register("rtc-sun6i", &pdev->dev, - &sun6i_rtc_ops, THIS_MODULE); - if (IS_ERR(chip->rtc)) { -diff --git a/drivers/scsi/aacraid/src.c b/drivers/scsi/aacraid/src.c -index bc0203f3d243..e415e1c58eb5 100644 ---- a/drivers/scsi/aacraid/src.c -+++ b/drivers/scsi/aacraid/src.c -@@ -413,16 +413,23 @@ static int aac_src_check_health(struct aac_dev *dev) - u32 status = src_readl(dev, MUnit.OMR); - - /* -+ * Check to see if the board panic'd. -+ */ -+ if (unlikely(status & KERNEL_PANIC)) -+ goto err_blink; -+ -+ /* - * Check to see if the board failed any self tests. - */ - if (unlikely(status & SELF_TEST_FAILED)) -- return -1; -+ goto err_out; - - /* -- * Check to see if the board panic'd. -+ * Check to see if the board failed any self tests. - */ -- if (unlikely(status & KERNEL_PANIC)) -- return (status >> 16) & 0xFF; -+ if (unlikely(status & MONITOR_PANIC)) -+ goto err_out; -+ - /* - * Wait for the adapter to be up and running. - */ -@@ -432,6 +439,12 @@ static int aac_src_check_health(struct aac_dev *dev) - * Everything is OK - */ - return 0; -+ -+err_out: -+ return -1; -+ -+err_blink: -+ return (status > 16) & 0xFF; - } - - /** -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index 33ec4fa39ccb..f224cdb2fce4 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -1182,6 +1182,7 @@ struct lpfc_mbx_wq_create { - #define lpfc_mbx_wq_create_page_size_SHIFT 0 - #define lpfc_mbx_wq_create_page_size_MASK 0x000000FF - #define lpfc_mbx_wq_create_page_size_WORD word1 -+#define LPFC_WQ_PAGE_SIZE_4096 0x1 - #define lpfc_mbx_wq_create_wqe_size_SHIFT 8 - #define lpfc_mbx_wq_create_wqe_size_MASK 0x0000000F - #define lpfc_mbx_wq_create_wqe_size_WORD word1 -@@ -1253,6 +1254,7 @@ struct rq_context { - #define lpfc_rq_context_page_size_SHIFT 0 /* Version 1 Only */ - #define lpfc_rq_context_page_size_MASK 0x000000FF - #define lpfc_rq_context_page_size_WORD word0 -+#define LPFC_RQ_PAGE_SIZE_4096 0x1 - uint32_t reserved1; - uint32_t word2; - #define lpfc_rq_context_cq_id_SHIFT 16 -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 92dfd6a5178c..f5aeda8f014f 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -13475,7 +13475,7 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, - LPFC_WQ_WQE_SIZE_128); - bf_set(lpfc_mbx_wq_create_page_size, - &wq_create->u.request_1, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ LPFC_WQ_PAGE_SIZE_4096); - page = wq_create->u.request_1.page; - break; - } -@@ -13501,8 +13501,9 @@ lpfc_wq_create(struct lpfc_hba *phba, struct lpfc_queue *wq, - LPFC_WQ_WQE_SIZE_128); - break; - } -- bf_set(lpfc_mbx_wq_create_page_size, &wq_create->u.request_1, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ bf_set(lpfc_mbx_wq_create_page_size, -+ &wq_create->u.request_1, -+ LPFC_WQ_PAGE_SIZE_4096); - page = wq_create->u.request_1.page; - break; - default: -@@ -13688,7 +13689,7 @@ lpfc_rq_create(struct lpfc_hba *phba, struct lpfc_queue *hrq, - LPFC_RQE_SIZE_8); - bf_set(lpfc_rq_context_page_size, - &rq_create->u.request.context, -- (PAGE_SIZE/SLI4_PAGE_SIZE)); -+ LPFC_RQ_PAGE_SIZE_4096); - } else { - switch (hrq->entry_count) { - default: -diff --git a/drivers/scsi/scsi_dh.c b/drivers/scsi/scsi_dh.c -index e7649ed3f667..4d655b568269 100644 ---- a/drivers/scsi/scsi_dh.c -+++ b/drivers/scsi/scsi_dh.c -@@ -289,20 +289,6 @@ int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh) - } - EXPORT_SYMBOL_GPL(scsi_unregister_device_handler); - --static struct scsi_device *get_sdev_from_queue(struct request_queue *q) --{ -- struct scsi_device *sdev; -- unsigned long flags; -- -- spin_lock_irqsave(q->queue_lock, flags); -- sdev = q->queuedata; -- if (!sdev || !get_device(&sdev->sdev_gendev)) -- sdev = NULL; -- spin_unlock_irqrestore(q->queue_lock, flags); -- -- return sdev; --} -- - /* - * scsi_dh_activate - activate the path associated with the scsi_device - * corresponding to the given request queue. -@@ -321,7 +307,7 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data) - struct scsi_device *sdev; - int err = SCSI_DH_NOSYS; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) { - if (fn) - fn(data, err); -@@ -368,7 +354,7 @@ int scsi_dh_set_params(struct request_queue *q, const char *params) - struct scsi_device *sdev; - int err = -SCSI_DH_NOSYS; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return err; - -@@ -391,7 +377,7 @@ int scsi_dh_attach(struct request_queue *q, const char *name) - struct scsi_device_handler *scsi_dh; - int err = 0; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return -ENODEV; - -@@ -429,7 +415,7 @@ const char *scsi_dh_attached_handler_name(struct request_queue *q, gfp_t gfp) - struct scsi_device *sdev; - const char *handler_name = NULL; - -- sdev = get_sdev_from_queue(q); -+ sdev = scsi_device_from_queue(q); - if (!sdev) - return NULL; - -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index 8558e3886960..887045ae5d10 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -2215,6 +2215,29 @@ void scsi_mq_destroy_tags(struct Scsi_Host *shost) - blk_mq_free_tag_set(&shost->tag_set); - } - -+/** -+ * scsi_device_from_queue - return sdev associated with a request_queue -+ * @q: The request queue to return the sdev from -+ * -+ * Return the sdev associated with a request queue or NULL if the -+ * request_queue does not reference a SCSI device. -+ */ -+struct scsi_device *scsi_device_from_queue(struct request_queue *q) -+{ -+ struct scsi_device *sdev = NULL; -+ -+ if (q->mq_ops) { -+ if (q->mq_ops == &scsi_mq_ops) -+ sdev = q->queuedata; -+ } else if (q->request_fn == scsi_request_fn) -+ sdev = q->queuedata; -+ if (!sdev || !get_device(&sdev->sdev_gendev)) -+ sdev = NULL; -+ -+ return sdev; -+} -+EXPORT_SYMBOL_GPL(scsi_device_from_queue); -+ - /* - * Function: scsi_block_requests() - * -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 6ee50742f6a5..78430ef28ea4 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -1398,11 +1398,15 @@ static int media_not_present(struct scsi_disk *sdkp, - **/ - static unsigned int sd_check_events(struct gendisk *disk, unsigned int clearing) - { -- struct scsi_disk *sdkp = scsi_disk(disk); -- struct scsi_device *sdp = sdkp->device; -+ struct scsi_disk *sdkp = scsi_disk_get(disk); -+ struct scsi_device *sdp; - struct scsi_sense_hdr *sshdr = NULL; - int retval; - -+ if (!sdkp) -+ return 0; -+ -+ sdp = sdkp->device; - SCSI_LOG_HLQUEUE(3, sd_printk(KERN_INFO, sdkp, "sd_check_events\n")); - - /* -@@ -1459,6 +1463,7 @@ out: - kfree(sshdr); - retval = sdp->changed ? DISK_EVENT_MEDIA_CHANGE : 0; - sdp->changed = 0; -+ scsi_disk_put(sdkp); - return retval; - } - -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 0f636cc4c809..cd5c1c060481 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -135,6 +135,8 @@ struct hv_fc_wwn_packet { - #define SRB_FLAGS_PORT_DRIVER_RESERVED 0x0F000000 - #define SRB_FLAGS_CLASS_DRIVER_RESERVED 0xF0000000 - -+#define SP_UNTAGGED ((unsigned char) ~0) -+#define SRB_SIMPLE_TAG_REQUEST 0x20 - - /* - * Platform neutral description of a scsi request - -@@ -354,6 +356,7 @@ enum storvsc_request_type { - #define SRB_STATUS_SUCCESS 0x01 - #define SRB_STATUS_ABORTED 0x02 - #define SRB_STATUS_ERROR 0x04 -+#define SRB_STATUS_DATA_OVERRUN 0x12 - - #define SRB_STATUS(status) \ - (status & ~(SRB_STATUS_AUTOSENSE_VALID | SRB_STATUS_QUEUE_FROZEN)) -@@ -864,6 +867,13 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, - switch (SRB_STATUS(vm_srb->srb_status)) { - case SRB_STATUS_ERROR: - /* -+ * Let upper layer deal with error when -+ * sense message is present. -+ */ -+ -+ if (vm_srb->srb_status & SRB_STATUS_AUTOSENSE_VALID) -+ break; -+ /* - * If there is an error; offline the device since all - * error recovery strategies would have already been - * deployed on the host side. However, if the command -@@ -927,6 +937,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request) - struct hv_host_device *host_dev = shost_priv(scmnd->device->host); - struct scsi_sense_hdr sense_hdr; - struct vmscsi_request *vm_srb; -+ u32 data_transfer_length; - struct Scsi_Host *host; - struct storvsc_device *stor_dev; - struct hv_device *dev = host_dev->dev; -@@ -937,6 +948,7 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request) - host = stor_dev->host; - - vm_srb = &cmd_request->vstor_packet.vm_srb; -+ data_transfer_length = vm_srb->data_transfer_length; - - scmnd->result = vm_srb->scsi_status; - -@@ -947,13 +959,20 @@ static void storvsc_command_completion(struct storvsc_cmd_request *cmd_request) - &sense_hdr); - } - -- if (vm_srb->srb_status != SRB_STATUS_SUCCESS) -+ if (vm_srb->srb_status != SRB_STATUS_SUCCESS) { - storvsc_handle_error(vm_srb, scmnd, host, sense_hdr.asc, - sense_hdr.ascq); -+ /* -+ * The Windows driver set data_transfer_length on -+ * SRB_STATUS_DATA_OVERRUN. On other errors, this value -+ * is untouched. In these cases we set it to 0. -+ */ -+ if (vm_srb->srb_status != SRB_STATUS_DATA_OVERRUN) -+ data_transfer_length = 0; -+ } - - scsi_set_resid(scmnd, -- cmd_request->payload->range.len - -- vm_srb->data_transfer_length); -+ cmd_request->payload->range.len - data_transfer_length); - - scmnd->scsi_done(scmnd); - -@@ -1409,6 +1428,13 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - vm_srb->win8_extension.srb_flags |= - SRB_FLAGS_DISABLE_SYNCH_TRANSFER; - -+ if (scmnd->device->tagged_supported) { -+ vm_srb->win8_extension.srb_flags |= -+ (SRB_FLAGS_QUEUE_ACTION_ENABLE | SRB_FLAGS_NO_QUEUE_FREEZE); -+ vm_srb->win8_extension.queue_tag = SP_UNTAGGED; -+ vm_srb->win8_extension.queue_action = SRB_SIMPLE_TAG_REQUEST; -+ } -+ - /* Build the SRB */ - switch (scmnd->sc_data_direction) { - case DMA_TO_DEVICE: -diff --git a/drivers/staging/rtl8188eu/core/rtw_recv.c b/drivers/staging/rtl8188eu/core/rtw_recv.c -index 110b8c0b6cd7..0f2fe34e14c2 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_recv.c -+++ b/drivers/staging/rtl8188eu/core/rtw_recv.c -@@ -1405,6 +1405,9 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) - ptr = recvframe_pull(precvframe, (rmv_len-sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); - } - -+ if (!ptr) -+ return _FAIL; -+ - memcpy(ptr, pattrib->dst, ETH_ALEN); - memcpy(ptr+ETH_ALEN, pattrib->src, ETH_ALEN); - -diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c -index 4ff530155187..04ac23cc47a8 100644 ---- a/drivers/staging/rtl8712/rtl871x_recv.c -+++ b/drivers/staging/rtl8712/rtl871x_recv.c -@@ -641,11 +641,16 @@ sint r8712_wlanhdr_to_ethhdr(union recv_frame *precvframe) - /* append rx status for mp test packets */ - ptr = recvframe_pull(precvframe, (rmv_len - - sizeof(struct ethhdr) + 2) - 24); -+ if (!ptr) -+ return _FAIL; - memcpy(ptr, get_rxmem(precvframe), 24); - ptr += 24; -- } else -+ } else { - ptr = recvframe_pull(precvframe, (rmv_len - - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0))); -+ if (!ptr) -+ return _FAIL; -+ } - - memcpy(ptr, pattrib->dst, ETH_ALEN); - memcpy(ptr + ETH_ALEN, pattrib->src, ETH_ALEN); -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index bd810c109277..6ed80b05d674 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -3436,7 +3436,7 @@ iscsit_build_sendtargets_response(struct iscsi_cmd *cmd, - - if ((tpg->tpg_attrib.generate_node_acls == 0) && - (tpg->tpg_attrib.demo_mode_discovery == 0) && -- (!core_tpg_get_initiator_node_acl(&tpg->tpg_se_tpg, -+ (!target_tpg_has_node_acl(&tpg->tpg_se_tpg, - cmd->conn->sess->sess_ops->InitiatorName))) { - continue; - } -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index 5fb9dd7f08bb..028854cda97b 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -75,9 +75,21 @@ struct se_node_acl *core_tpg_get_initiator_node_acl( - unsigned char *initiatorname) - { - struct se_node_acl *acl; -- -+ /* -+ * Obtain se_node_acl->acl_kref using fabric driver provided -+ * initiatorname[] during node acl endpoint lookup driven by -+ * new se_session login. -+ * -+ * The reference is held until se_session shutdown -> release -+ * occurs via fabric driver invoked transport_deregister_session() -+ * or transport_free_session() code. -+ */ - mutex_lock(&tpg->acl_node_mutex); - acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname); -+ if (acl) { -+ if (!kref_get_unless_zero(&acl->acl_kref)) -+ acl = NULL; -+ } - mutex_unlock(&tpg->acl_node_mutex); - - return acl; -@@ -232,6 +244,25 @@ static void target_add_node_acl(struct se_node_acl *acl) - acl->initiatorname); - } - -+bool target_tpg_has_node_acl(struct se_portal_group *tpg, -+ const char *initiatorname) -+{ -+ struct se_node_acl *acl; -+ bool found = false; -+ -+ mutex_lock(&tpg->acl_node_mutex); -+ list_for_each_entry(acl, &tpg->acl_node_list, acl_list) { -+ if (!strcmp(acl->initiatorname, initiatorname)) { -+ found = true; -+ break; -+ } -+ } -+ mutex_unlock(&tpg->acl_node_mutex); -+ -+ return found; -+} -+EXPORT_SYMBOL(target_tpg_has_node_acl); -+ - struct se_node_acl *core_tpg_check_initiator_node_acl( - struct se_portal_group *tpg, - unsigned char *initiatorname) -@@ -248,6 +279,15 @@ struct se_node_acl *core_tpg_check_initiator_node_acl( - acl = target_alloc_node_acl(tpg, initiatorname); - if (!acl) - return NULL; -+ /* -+ * When allocating a dynamically generated node_acl, go ahead -+ * and take the extra kref now before returning to the fabric -+ * driver caller. -+ * -+ * Note this reference will be released at session shutdown -+ * time within transport_free_session() code. -+ */ -+ kref_get(&acl->acl_kref); - acl->dynamic_node_acl = 1; - - /* -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index aa517c4fadb9..befe22744802 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -341,7 +341,6 @@ void __transport_register_session( - &buf[0], PR_REG_ISID_LEN); - se_sess->sess_bin_isid = get_unaligned_be64(&buf[0]); - } -- kref_get(&se_nacl->acl_kref); - - spin_lock_irq(&se_nacl->nacl_sess_lock); - /* -@@ -424,14 +423,27 @@ static void target_complete_nacl(struct kref *kref) - { - struct se_node_acl *nacl = container_of(kref, - struct se_node_acl, acl_kref); -+ struct se_portal_group *se_tpg = nacl->se_tpg; - -- complete(&nacl->acl_free_comp); -+ if (!nacl->dynamic_stop) { -+ complete(&nacl->acl_free_comp); -+ return; -+ } -+ -+ mutex_lock(&se_tpg->acl_node_mutex); -+ list_del(&nacl->acl_list); -+ mutex_unlock(&se_tpg->acl_node_mutex); -+ -+ core_tpg_wait_for_nacl_pr_ref(nacl); -+ core_free_device_list_for_node(nacl, se_tpg); -+ kfree(nacl); - } - - void target_put_nacl(struct se_node_acl *nacl) - { - kref_put(&nacl->acl_kref, target_complete_nacl); - } -+EXPORT_SYMBOL(target_put_nacl); - - void transport_deregister_session_configfs(struct se_session *se_sess) - { -@@ -464,6 +476,42 @@ EXPORT_SYMBOL(transport_deregister_session_configfs); - - void transport_free_session(struct se_session *se_sess) - { -+ struct se_node_acl *se_nacl = se_sess->se_node_acl; -+ -+ /* -+ * Drop the se_node_acl->nacl_kref obtained from within -+ * core_tpg_get_initiator_node_acl(). -+ */ -+ if (se_nacl) { -+ struct se_portal_group *se_tpg = se_nacl->se_tpg; -+ const struct target_core_fabric_ops *se_tfo = se_tpg->se_tpg_tfo; -+ unsigned long flags; -+ -+ se_sess->se_node_acl = NULL; -+ -+ /* -+ * Also determine if we need to drop the extra ->cmd_kref if -+ * it had been previously dynamically generated, and -+ * the endpoint is not caching dynamic ACLs. -+ */ -+ mutex_lock(&se_tpg->acl_node_mutex); -+ if (se_nacl->dynamic_node_acl && -+ !se_tfo->tpg_check_demo_mode_cache(se_tpg)) { -+ spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags); -+ if (list_empty(&se_nacl->acl_sess_list)) -+ se_nacl->dynamic_stop = true; -+ spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); -+ -+ if (se_nacl->dynamic_stop) -+ list_del(&se_nacl->acl_list); -+ } -+ mutex_unlock(&se_tpg->acl_node_mutex); -+ -+ if (se_nacl->dynamic_stop) -+ target_put_nacl(se_nacl); -+ -+ target_put_nacl(se_nacl); -+ } - if (se_sess->sess_cmd_map) { - percpu_ida_destroy(&se_sess->sess_tag_pool); - kvfree(se_sess->sess_cmd_map); -@@ -475,16 +523,12 @@ EXPORT_SYMBOL(transport_free_session); - void transport_deregister_session(struct se_session *se_sess) - { - struct se_portal_group *se_tpg = se_sess->se_tpg; -- const struct target_core_fabric_ops *se_tfo; -- struct se_node_acl *se_nacl; - unsigned long flags; -- bool comp_nacl = true, drop_nacl = false; - - if (!se_tpg) { - transport_free_session(se_sess); - return; - } -- se_tfo = se_tpg->se_tpg_tfo; - - spin_lock_irqsave(&se_tpg->session_lock, flags); - list_del(&se_sess->sess_list); -@@ -492,37 +536,16 @@ void transport_deregister_session(struct se_session *se_sess) - se_sess->fabric_sess_ptr = NULL; - spin_unlock_irqrestore(&se_tpg->session_lock, flags); - -- /* -- * Determine if we need to do extra work for this initiator node's -- * struct se_node_acl if it had been previously dynamically generated. -- */ -- se_nacl = se_sess->se_node_acl; -- -- mutex_lock(&se_tpg->acl_node_mutex); -- if (se_nacl && se_nacl->dynamic_node_acl) { -- if (!se_tfo->tpg_check_demo_mode_cache(se_tpg)) { -- list_del(&se_nacl->acl_list); -- se_tpg->num_node_acls--; -- drop_nacl = true; -- } -- } -- mutex_unlock(&se_tpg->acl_node_mutex); -- -- if (drop_nacl) { -- core_tpg_wait_for_nacl_pr_ref(se_nacl); -- core_free_device_list_for_node(se_nacl, se_tpg); -- kfree(se_nacl); -- comp_nacl = false; -- } - pr_debug("TARGET_CORE[%s]: Deregistered fabric_sess\n", - se_tpg->se_tpg_tfo->get_fabric_name()); - /* - * If last kref is dropping now for an explicit NodeACL, awake sleeping - * ->acl_free_comp caller to wakeup configfs se_node_acl->acl_group -- * removal context. -+ * removal context from within transport_free_session() code. -+ * -+ * For dynamic ACL, target_put_nacl() uses target_complete_nacl() -+ * to release all remaining generate_node_acl=1 created ACL resources. - */ -- if (se_nacl && comp_nacl) -- target_put_nacl(se_nacl); - - transport_free_session(se_sess); - } -diff --git a/drivers/usb/gadget/udc/fsl_udc_core.c b/drivers/usb/gadget/udc/fsl_udc_core.c -index aab5221d6c2e..aac0ce8aeb0b 100644 ---- a/drivers/usb/gadget/udc/fsl_udc_core.c -+++ b/drivers/usb/gadget/udc/fsl_udc_core.c -@@ -1249,6 +1249,12 @@ static const struct usb_gadget_ops fsl_gadget_ops = { - .udc_stop = fsl_udc_stop, - }; - -+/* -+ * Empty complete function used by this driver to fill in the req->complete -+ * field when creating a request since the complete field is mandatory. -+ */ -+static void fsl_noop_complete(struct usb_ep *ep, struct usb_request *req) { } -+ - /* Set protocol stall on ep0, protocol stall will automatically be cleared - on new transaction */ - static void ep0stall(struct fsl_udc *udc) -@@ -1283,7 +1289,7 @@ static int ep0_prime_status(struct fsl_udc *udc, int direction) - req->req.length = 0; - req->req.status = -EINPROGRESS; - req->req.actual = 0; -- req->req.complete = NULL; -+ req->req.complete = fsl_noop_complete; - req->dtd_count = 0; - - ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); -@@ -1366,7 +1372,7 @@ static void ch9getstatus(struct fsl_udc *udc, u8 request_type, u16 value, - req->req.length = 2; - req->req.status = -EINPROGRESS; - req->req.actual = 0; -- req->req.complete = NULL; -+ req->req.complete = fsl_noop_complete; - req->dtd_count = 0; - - ret = usb_gadget_map_request(&ep->udc->gadget, &req->req, ep_is_in(ep)); -diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c -index b03d3b867fca..9a9c82a4d35d 100644 ---- a/drivers/usb/musb/da8xx.c -+++ b/drivers/usb/musb/da8xx.c -@@ -458,15 +458,11 @@ static int da8xx_musb_exit(struct musb *musb) - } - - static const struct musb_platform_ops da8xx_ops = { -- .quirks = MUSB_DMA_CPPI | MUSB_INDEXED_EP, -+ .quirks = MUSB_INDEXED_EP, - .init = da8xx_musb_init, - .exit = da8xx_musb_exit, - - .fifo_mode = 2, --#ifdef CONFIG_USB_TI_CPPI_DMA -- .dma_init = cppi_dma_controller_create, -- .dma_exit = cppi_dma_controller_destroy, --#endif - .enable = da8xx_musb_enable, - .disable = da8xx_musb_disable, - -diff --git a/drivers/w1/masters/ds2490.c b/drivers/w1/masters/ds2490.c -index 049a884a756f..59d74d1b47a8 100644 ---- a/drivers/w1/masters/ds2490.c -+++ b/drivers/w1/masters/ds2490.c -@@ -153,6 +153,9 @@ struct ds_device - */ - u16 spu_bit; - -+ u8 st_buf[ST_SIZE]; -+ u8 byte_buf; -+ - struct w1_bus_master master; - }; - -@@ -174,7 +177,6 @@ struct ds_status - u8 data_in_buffer_status; - u8 reserved1; - u8 reserved2; -- - }; - - static struct usb_device_id ds_id_table [] = { -@@ -244,28 +246,6 @@ static int ds_send_control(struct ds_device *dev, u16 value, u16 index) - return err; - } - --static int ds_recv_status_nodump(struct ds_device *dev, struct ds_status *st, -- unsigned char *buf, int size) --{ -- int count, err; -- -- memset(st, 0, sizeof(*st)); -- -- count = 0; -- err = usb_interrupt_msg(dev->udev, usb_rcvintpipe(dev->udev, -- dev->ep[EP_STATUS]), buf, size, &count, 1000); -- if (err < 0) { -- pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", -- dev->ep[EP_STATUS], err); -- return err; -- } -- -- if (count >= sizeof(*st)) -- memcpy(st, buf, sizeof(*st)); -- -- return count; --} -- - static inline void ds_print_msg(unsigned char *buf, unsigned char *str, int off) - { - pr_info("%45s: %8x\n", str, buf[off]); -@@ -324,6 +304,35 @@ static void ds_dump_status(struct ds_device *dev, unsigned char *buf, int count) - } - } - -+static int ds_recv_status(struct ds_device *dev, struct ds_status *st, -+ bool dump) -+{ -+ int count, err; -+ -+ if (st) -+ memset(st, 0, sizeof(*st)); -+ -+ count = 0; -+ err = usb_interrupt_msg(dev->udev, -+ usb_rcvintpipe(dev->udev, -+ dev->ep[EP_STATUS]), -+ dev->st_buf, sizeof(dev->st_buf), -+ &count, 1000); -+ if (err < 0) { -+ pr_err("Failed to read 1-wire data from 0x%x: err=%d.\n", -+ dev->ep[EP_STATUS], err); -+ return err; -+ } -+ -+ if (dump) -+ ds_dump_status(dev, dev->st_buf, count); -+ -+ if (st && count >= sizeof(*st)) -+ memcpy(st, dev->st_buf, sizeof(*st)); -+ -+ return count; -+} -+ - static void ds_reset_device(struct ds_device *dev) - { - ds_send_control_cmd(dev, CTL_RESET_DEVICE, 0); -@@ -344,7 +353,6 @@ static void ds_reset_device(struct ds_device *dev) - static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) - { - int count, err; -- struct ds_status st; - - /* Careful on size. If size is less than what is available in - * the input buffer, the device fails the bulk transfer and -@@ -359,14 +367,9 @@ static int ds_recv_data(struct ds_device *dev, unsigned char *buf, int size) - err = usb_bulk_msg(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN]), - buf, size, &count, 1000); - if (err < 0) { -- u8 buf[ST_SIZE]; -- int count; -- - pr_info("Clearing ep0x%x.\n", dev->ep[EP_DATA_IN]); - usb_clear_halt(dev->udev, usb_rcvbulkpipe(dev->udev, dev->ep[EP_DATA_IN])); -- -- count = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); -- ds_dump_status(dev, buf, count); -+ ds_recv_status(dev, NULL, true); - return err; - } - -@@ -404,7 +407,6 @@ int ds_stop_pulse(struct ds_device *dev, int limit) - { - struct ds_status st; - int count = 0, err = 0; -- u8 buf[ST_SIZE]; - - do { - err = ds_send_control(dev, CTL_HALT_EXE_IDLE, 0); -@@ -413,7 +415,7 @@ int ds_stop_pulse(struct ds_device *dev, int limit) - err = ds_send_control(dev, CTL_RESUME_EXE, 0); - if (err) - break; -- err = ds_recv_status_nodump(dev, &st, buf, sizeof(buf)); -+ err = ds_recv_status(dev, &st, false); - if (err) - break; - -@@ -456,18 +458,17 @@ int ds_detect(struct ds_device *dev, struct ds_status *st) - - static int ds_wait_status(struct ds_device *dev, struct ds_status *st) - { -- u8 buf[ST_SIZE]; - int err, count = 0; - - do { - st->status = 0; -- err = ds_recv_status_nodump(dev, st, buf, sizeof(buf)); -+ err = ds_recv_status(dev, st, false); - #if 0 - if (err >= 0) { - int i; - printk("0x%x: count=%d, status: ", dev->ep[EP_STATUS], err); - for (i=0; ist_buf[i]); - printk("\n"); - } - #endif -@@ -485,7 +486,7 @@ static int ds_wait_status(struct ds_device *dev, struct ds_status *st) - * can do something with it). - */ - if (err > 16 || count >= 100 || err < 0) -- ds_dump_status(dev, buf, err); -+ ds_dump_status(dev, dev->st_buf, err); - - /* Extended data isn't an error. Well, a short is, but the dump - * would have already told the user that and we can't do anything -@@ -608,7 +609,6 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) - { - int err; - struct ds_status st; -- u8 rbyte; - - err = ds_send_control(dev, COMM_BYTE_IO | COMM_IM | dev->spu_bit, byte); - if (err) -@@ -621,11 +621,11 @@ static int ds_write_byte(struct ds_device *dev, u8 byte) - if (err) - return err; - -- err = ds_recv_data(dev, &rbyte, sizeof(rbyte)); -+ err = ds_recv_data(dev, &dev->byte_buf, 1); - if (err < 0) - return err; - -- return !(byte == rbyte); -+ return !(byte == dev->byte_buf); - } - - static int ds_read_byte(struct ds_device *dev, u8 *byte) -@@ -712,7 +712,6 @@ static void ds9490r_search(void *data, struct w1_master *master, - int err; - u16 value, index; - struct ds_status st; -- u8 st_buf[ST_SIZE]; - int search_limit; - int found = 0; - int i; -@@ -724,7 +723,12 @@ static void ds9490r_search(void *data, struct w1_master *master, - /* FIFO 128 bytes, bulk packet size 64, read a multiple of the - * packet size. - */ -- u64 buf[2*64/8]; -+ const size_t bufsize = 2 * 64; -+ u64 *buf; -+ -+ buf = kmalloc(bufsize, GFP_KERNEL); -+ if (!buf) -+ return; - - mutex_lock(&master->bus_mutex); - -@@ -745,10 +749,9 @@ static void ds9490r_search(void *data, struct w1_master *master, - do { - schedule_timeout(jtime); - -- if (ds_recv_status_nodump(dev, &st, st_buf, sizeof(st_buf)) < -- sizeof(st)) { -+ err = ds_recv_status(dev, &st, false); -+ if (err < 0 || err < sizeof(st)) - break; -- } - - if (st.data_in_buffer_status) { - /* Bulk in can receive partial ids, but when it does -@@ -758,7 +761,7 @@ static void ds9490r_search(void *data, struct w1_master *master, - * bulk without first checking if status says there - * is data to read. - */ -- err = ds_recv_data(dev, (u8 *)buf, sizeof(buf)); -+ err = ds_recv_data(dev, (u8 *)buf, bufsize); - if (err < 0) - break; - for (i = 0; i < err/8; ++i) { -@@ -794,9 +797,14 @@ static void ds9490r_search(void *data, struct w1_master *master, - } - search_out: - mutex_unlock(&master->bus_mutex); -+ kfree(buf); - } - - #if 0 -+/* -+ * FIXME: if this disabled code is ever used in the future all ds_send_data() -+ * calls must be changed to use a DMAable buffer. -+ */ - static int ds_match_access(struct ds_device *dev, u64 init) - { - int err; -@@ -845,13 +853,12 @@ static int ds_set_path(struct ds_device *dev, u64 init) - - static u8 ds9490r_touch_bit(void *data, u8 bit) - { -- u8 ret; - struct ds_device *dev = data; - -- if (ds_touch_bit(dev, bit, &ret)) -+ if (ds_touch_bit(dev, bit, &dev->byte_buf)) - return 0; - -- return ret; -+ return dev->byte_buf; - } - - #if 0 -@@ -866,13 +873,12 @@ static u8 ds9490r_read_bit(void *data) - { - struct ds_device *dev = data; - int err; -- u8 bit = 0; - -- err = ds_touch_bit(dev, 1, &bit); -+ err = ds_touch_bit(dev, 1, &dev->byte_buf); - if (err) - return 0; - -- return bit & 1; -+ return dev->byte_buf & 1; - } - #endif - -@@ -887,32 +893,52 @@ static u8 ds9490r_read_byte(void *data) - { - struct ds_device *dev = data; - int err; -- u8 byte = 0; - -- err = ds_read_byte(dev, &byte); -+ err = ds_read_byte(dev, &dev->byte_buf); - if (err) - return 0; - -- return byte; -+ return dev->byte_buf; - } - - static void ds9490r_write_block(void *data, const u8 *buf, int len) - { - struct ds_device *dev = data; -+ u8 *tbuf; -+ -+ if (len <= 0) -+ return; -+ -+ tbuf = kmalloc(len, GFP_KERNEL); -+ if (!tbuf) -+ return; - -- ds_write_block(dev, (u8 *)buf, len); -+ memcpy(tbuf, buf, len); -+ ds_write_block(dev, tbuf, len); -+ -+ kfree(tbuf); - } - - static u8 ds9490r_read_block(void *data, u8 *buf, int len) - { - struct ds_device *dev = data; - int err; -+ u8 *tbuf; - -- err = ds_read_block(dev, buf, len); -- if (err < 0) -+ if (len <= 0) -+ return 0; -+ -+ tbuf = kmalloc(len, GFP_KERNEL); -+ if (!tbuf) - return 0; - -- return len; -+ err = ds_read_block(dev, tbuf, len); -+ if (err >= 0) -+ memcpy(buf, tbuf, len); -+ -+ kfree(tbuf); -+ -+ return err >= 0 ? len : 0; - } - - static u8 ds9490r_reset(void *data) -diff --git a/drivers/w1/w1.c b/drivers/w1/w1.c -index c9a7ff67d395..39886edfa222 100644 ---- a/drivers/w1/w1.c -+++ b/drivers/w1/w1.c -@@ -763,6 +763,7 @@ int w1_attach_slave_device(struct w1_master *dev, struct w1_reg_num *rn) - dev_err(&dev->dev, "%s: Attaching %s failed.\n", __func__, - sl->name); - w1_family_put(sl->family); -+ atomic_dec(&sl->master->refcnt); - kfree(sl); - return err; - } -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 9da42ace762a..8a456f9b8a44 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -5362,7 +5362,8 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - ext4_lblk_t stop, *iterator, ex_start, ex_end; - - /* Let path point to the last extent */ -- path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, 0); -+ path = ext4_find_extent(inode, EXT_MAX_BLOCKS - 1, NULL, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - -@@ -5371,15 +5372,15 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - if (!extent) - goto out; - -- stop = le32_to_cpu(extent->ee_block) + -- ext4_ext_get_actual_len(extent); -+ stop = le32_to_cpu(extent->ee_block); - - /* - * In case of left shift, Don't start shifting extents until we make - * sure the hole is big enough to accommodate the shift. - */ - if (SHIFT == SHIFT_LEFT) { -- path = ext4_find_extent(inode, start - 1, &path, 0); -+ path = ext4_find_extent(inode, start - 1, &path, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - depth = path->p_depth; -@@ -5411,9 +5412,14 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - else - iterator = &stop; - -- /* Its safe to start updating extents */ -- while (start < stop) { -- path = ext4_find_extent(inode, *iterator, &path, 0); -+ /* -+ * Its safe to start updating extents. Start and stop are unsigned, so -+ * in case of right shift if extent with 0 block is reached, iterator -+ * becomes NULL to indicate the end of the loop. -+ */ -+ while (iterator && start <= stop) { -+ path = ext4_find_extent(inode, *iterator, &path, -+ EXT4_EX_NOCACHE); - if (IS_ERR(path)) - return PTR_ERR(path); - depth = path->p_depth; -@@ -5440,8 +5446,11 @@ ext4_ext_shift_extents(struct inode *inode, handle_t *handle, - ext4_ext_get_actual_len(extent); - } else { - extent = EXT_FIRST_EXTENT(path[depth].p_hdr); -- *iterator = le32_to_cpu(extent->ee_block) > 0 ? -- le32_to_cpu(extent->ee_block) - 1 : 0; -+ if (le32_to_cpu(extent->ee_block) > 0) -+ *iterator = le32_to_cpu(extent->ee_block) - 1; -+ else -+ /* Beginning is reached, end of the loop */ -+ iterator = NULL; - /* Update path extent in case we need to stop */ - while (le32_to_cpu(extent->ee_block) < start) - extent++; -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index 8968a93e2150..d4be4e23bc21 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -933,8 +933,15 @@ int ext4_da_write_inline_data_end(struct inode *inode, loff_t pos, - struct page *page) - { - int i_size_changed = 0; -+ int ret; - -- copied = ext4_write_inline_data_end(inode, pos, len, copied, page); -+ ret = ext4_write_inline_data_end(inode, pos, len, copied, page); -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); -+ return ret; -+ } -+ copied = ret; - - /* - * No need to use i_size_read() here, the i_size -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 10690e5ba2eb..e0f862146793 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1165,8 +1165,11 @@ static int ext4_write_end(struct file *file, - if (ext4_has_inline_data(inode)) { - ret = ext4_write_inline_data_end(inode, pos, len, - copied, page); -- if (ret < 0) -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); - goto errout; -+ } - copied = ret; - } else - copied = block_write_end(file, mapping, pos, -@@ -1220,7 +1223,9 @@ errout: - * set the buffer to be dirty, since in data=journalled mode we need - * to call ext4_handle_dirty_metadata() instead. - */ --static void zero_new_buffers(struct page *page, unsigned from, unsigned to) -+static void ext4_journalled_zero_new_buffers(handle_t *handle, -+ struct page *page, -+ unsigned from, unsigned to) - { - unsigned int block_start = 0, block_end; - struct buffer_head *head, *bh; -@@ -1237,7 +1242,7 @@ static void zero_new_buffers(struct page *page, unsigned from, unsigned to) - size = min(to, block_end) - start; - - zero_user(page, start, size); -- set_buffer_uptodate(bh); -+ write_end_fn(handle, bh); - } - clear_buffer_new(bh); - } -@@ -1266,18 +1271,25 @@ static int ext4_journalled_write_end(struct file *file, - - BUG_ON(!ext4_handle_valid(handle)); - -- if (ext4_has_inline_data(inode)) -- copied = ext4_write_inline_data_end(inode, pos, len, -- copied, page); -- else { -- if (copied < len) { -- if (!PageUptodate(page)) -- copied = 0; -- zero_new_buffers(page, from+copied, to); -+ if (ext4_has_inline_data(inode)) { -+ ret = ext4_write_inline_data_end(inode, pos, len, -+ copied, page); -+ if (ret < 0) { -+ unlock_page(page); -+ put_page(page); -+ goto errout; - } -- -+ copied = ret; -+ } else if (unlikely(copied < len) && !PageUptodate(page)) { -+ copied = 0; -+ ext4_journalled_zero_new_buffers(handle, page, from, to); -+ } else { -+ if (unlikely(copied < len)) -+ ext4_journalled_zero_new_buffers(handle, page, -+ from + copied, to); - ret = ext4_walk_page_buffers(handle, page_buffers(page), from, -- to, &partial, write_end_fn); -+ from + copied, &partial, -+ write_end_fn); - if (!partial) - SetPageUptodate(page); - } -@@ -1303,6 +1315,7 @@ static int ext4_journalled_write_end(struct file *file, - */ - ext4_orphan_add(handle, inode); - -+errout: - ret2 = ext4_journal_stop(handle); - if (!ret) - ret = ret2; -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index b7a3957a9dca..84cd77663e1f 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -3120,6 +3120,13 @@ ext4_mb_normalize_request(struct ext4_allocation_context *ac, - if (ar->pright && start + size - 1 >= ar->lright) - size -= start + size - ar->lright; - -+ /* -+ * Trim allocation request for filesystems with artificially small -+ * groups. -+ */ -+ if (size > EXT4_BLOCKS_PER_GROUP(ac->ac_sb)) -+ size = EXT4_BLOCKS_PER_GROUP(ac->ac_sb); -+ - end = start + size; - - /* check we don't cross already preallocated blocks */ -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index b405a7b74ce0..6fe8e30eeb99 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -793,6 +793,7 @@ static void ext4_put_super(struct super_block *sb) - { - struct ext4_sb_info *sbi = EXT4_SB(sb); - struct ext4_super_block *es = sbi->s_es; -+ int aborted = 0; - int i, err; - - ext4_unregister_li_request(sb); -@@ -802,9 +803,10 @@ static void ext4_put_super(struct super_block *sb) - destroy_workqueue(sbi->rsv_conversion_wq); - - if (sbi->s_journal) { -+ aborted = is_journal_aborted(sbi->s_journal); - err = jbd2_journal_destroy(sbi->s_journal); - sbi->s_journal = NULL; -- if (err < 0) -+ if ((err < 0) && !aborted) - ext4_abort(sb, "Couldn't clean up the journal"); - } - -@@ -816,7 +818,7 @@ static void ext4_put_super(struct super_block *sb) - ext4_ext_release(sb); - ext4_xattr_put_super(sb); - -- if (!(sb->s_flags & MS_RDONLY)) { -+ if (!(sb->s_flags & MS_RDONLY) && !aborted) { - ext4_clear_feature_journal_needs_recovery(sb); - es->s_state = cpu_to_le16(sbi->s_mount_state); - } -@@ -3746,7 +3748,8 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - * root first: it may be modified in the journal! - */ - if (!test_opt(sb, NOLOAD) && ext4_has_feature_journal(sb)) { -- if (ext4_load_journal(sb, es, journal_devnum)) -+ err = ext4_load_journal(sb, es, journal_devnum); -+ if (err) - goto failed_mount3a; - } else if (test_opt(sb, NOLOAD) && !(sb->s_flags & MS_RDONLY) && - ext4_has_feature_journal_needs_recovery(sb)) { -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 8821c380a71a..11538a8be9f0 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -100,6 +100,7 @@ static void fuse_file_put(struct fuse_file *ff, bool sync) - iput(req->misc.release.inode); - fuse_put_request(ff->fc, req); - } else if (sync) { -+ __set_bit(FR_FORCE, &req->flags); - __clear_bit(FR_BACKGROUND, &req->flags); - fuse_request_send(ff->fc, req); - iput(req->misc.release.inode); -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 32e74710b1aa..9cd8c92b953d 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -651,9 +651,11 @@ int gfs2_glock_get(struct gfs2_sbd *sdp, u64 number, - struct kmem_cache *cachep; - int ret, tries = 0; - -+ rcu_read_lock(); - gl = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); - if (gl && !lockref_get_not_dead(&gl->gl_lockref)) - gl = NULL; -+ rcu_read_unlock(); - - *glp = gl; - if (gl) -@@ -721,15 +723,18 @@ again: - - if (ret == -EEXIST) { - ret = 0; -+ rcu_read_lock(); - tmp = rhashtable_lookup_fast(&gl_hash_table, &name, ht_parms); - if (tmp == NULL || !lockref_get_not_dead(&tmp->gl_lockref)) { - if (++tries < 100) { -+ rcu_read_unlock(); - cond_resched(); - goto again; - } - tmp = NULL; - ret = -ENOMEM; - } -+ rcu_read_unlock(); - } else { - WARN_ON_ONCE(ret); - } -diff --git a/fs/jbd2/transaction.c b/fs/jbd2/transaction.c -index fa1b8e0dcacf..a2e724053919 100644 ---- a/fs/jbd2/transaction.c -+++ b/fs/jbd2/transaction.c -@@ -1876,7 +1876,9 @@ static void __jbd2_journal_temp_unlink_buffer(struct journal_head *jh) - - __blist_del_buffer(list, jh); - jh->b_jlist = BJ_None; -- if (test_clear_buffer_jbddirty(bh)) -+ if (transaction && is_journal_aborted(transaction->t_journal)) -+ clear_buffer_jbddirty(bh); -+ else if (test_clear_buffer_jbddirty(bh)) - mark_buffer_dirty(bh); /* Expose it to the VM */ - } - -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 9a524e763c3e..4e3679b25b9b 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -2452,6 +2452,7 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, - ret = PTR_ERR(state); - if (IS_ERR(state)) - goto out; -+ ctx->state = state; - if (server->caps & NFS_CAP_POSIX_LOCK) - set_bit(NFS_STATE_POSIX_LOCKS, &state->flags); - -@@ -2474,7 +2475,6 @@ static int _nfs4_open_and_get_state(struct nfs4_opendata *opendata, - if (ret != 0) - goto out; - -- ctx->state = state; - if (d_inode(dentry) == state->inode) { - nfs_inode_attach_open_context(ctx); - if (read_seqcount_retry(&sp->so_reclaim_seqcount, seq)) -@@ -4711,7 +4711,7 @@ out: - */ - static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen) - { -- struct page *pages[NFS4ACL_MAXPAGES] = {NULL, }; -+ struct page *pages[NFS4ACL_MAXPAGES + 1] = {NULL, }; - struct nfs_getaclargs args = { - .fh = NFS_FH(inode), - .acl_pages = pages, -@@ -4725,13 +4725,9 @@ static ssize_t __nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t bu - .rpc_argp = &args, - .rpc_resp = &res, - }; -- unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE); -+ unsigned int npages = DIV_ROUND_UP(buflen, PAGE_SIZE) + 1; - int ret = -ENOMEM, i; - -- /* As long as we're doing a round trip to the server anyway, -- * let's be prepared for a page of acl data. */ -- if (npages == 0) -- npages = 1; - if (npages > ARRAY_SIZE(pages)) - return -ERANGE; - -diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c -index 4e4441216804..1cb50bb898b0 100644 ---- a/fs/nfs/nfs4xdr.c -+++ b/fs/nfs/nfs4xdr.c -@@ -2487,7 +2487,7 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr, - encode_compound_hdr(xdr, req, &hdr); - encode_sequence(xdr, &args->seq_args, &hdr); - encode_putfh(xdr, args->fh, &hdr); -- replen = hdr.replen + op_decode_hdr_maxsz + 1; -+ replen = hdr.replen + op_decode_hdr_maxsz; - encode_getattr_two(xdr, FATTR4_WORD0_ACL, 0, &hdr); - - xdr_inline_pages(&req->rq_rcv_buf, replen << 2, -diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c -index 994d66fbb446..91e0c5429b4d 100644 ---- a/fs/nfsd/vfs.c -+++ b/fs/nfsd/vfs.c -@@ -369,7 +369,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - __be32 err; - int host_err; - bool get_write_count; -- int size_change = 0; -+ bool size_change = (iap->ia_valid & ATTR_SIZE); - - if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) - accmode |= NFSD_MAY_WRITE|NFSD_MAY_OWNER_OVERRIDE; -@@ -382,11 +382,11 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - /* Get inode */ - err = fh_verify(rqstp, fhp, ftype, accmode); - if (err) -- goto out; -+ return err; - if (get_write_count) { - host_err = fh_want_write(fhp); - if (host_err) -- return nfserrno(host_err); -+ goto out; - } - - dentry = fhp->fh_dentry; -@@ -397,20 +397,28 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - iap->ia_valid &= ~ATTR_MODE; - - if (!iap->ia_valid) -- goto out; -+ return 0; - - nfsd_sanitize_attrs(inode, iap); - -+ if (check_guard && guardtime != inode->i_ctime.tv_sec) -+ return nfserr_notsync; -+ - /* - * The size case is special, it changes the file in addition to the -- * attributes. -+ * attributes, and file systems don't expect it to be mixed with -+ * "random" attribute changes. We thus split out the size change -+ * into a separate call to ->setattr, and do the rest as a separate -+ * setattr call. - */ -- if (iap->ia_valid & ATTR_SIZE) { -+ if (size_change) { - err = nfsd_get_write_access(rqstp, fhp, iap); - if (err) -- goto out; -- size_change = 1; -+ return err; -+ } - -+ fh_lock(fhp); -+ if (size_change) { - /* - * RFC5661, Section 18.30.4: - * Changing the size of a file with SETATTR indirectly -@@ -418,29 +426,36 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, - * - * (and similar for the older RFCs) - */ -- if (iap->ia_size != i_size_read(inode)) -- iap->ia_valid |= ATTR_MTIME; -- } -+ struct iattr size_attr = { -+ .ia_valid = ATTR_SIZE | ATTR_CTIME | ATTR_MTIME, -+ .ia_size = iap->ia_size, -+ }; - -- iap->ia_valid |= ATTR_CTIME; -+ host_err = notify_change(dentry, &size_attr, NULL); -+ if (host_err) -+ goto out_unlock; -+ iap->ia_valid &= ~ATTR_SIZE; - -- if (check_guard && guardtime != inode->i_ctime.tv_sec) { -- err = nfserr_notsync; -- goto out_put_write_access; -+ /* -+ * Avoid the additional setattr call below if the only other -+ * attribute that the client sends is the mtime, as we update -+ * it as part of the size change above. -+ */ -+ if ((iap->ia_valid & ~ATTR_MTIME) == 0) -+ goto out_unlock; - } - -- fh_lock(fhp); -+ iap->ia_valid |= ATTR_CTIME; - host_err = notify_change(dentry, iap, NULL); -- fh_unlock(fhp); -- err = nfserrno(host_err); - --out_put_write_access: -+out_unlock: -+ fh_unlock(fhp); - if (size_change) - put_write_access(inode); -- if (!err) -- err = nfserrno(commit_metadata(fhp)); - out: -- return err; -+ if (!host_err) -+ host_err = commit_metadata(fhp); -+ return nfserrno(host_err); - } - - #if defined(CONFIG_NFSD_V4) -diff --git a/include/linux/intel-iommu.h b/include/linux/intel-iommu.h -index d49e26c6cdc7..23e129ef6726 100644 ---- a/include/linux/intel-iommu.h -+++ b/include/linux/intel-iommu.h -@@ -153,8 +153,8 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) - #define DMA_TLB_GLOBAL_FLUSH (((u64)1) << 60) - #define DMA_TLB_DSI_FLUSH (((u64)2) << 60) - #define DMA_TLB_PSI_FLUSH (((u64)3) << 60) --#define DMA_TLB_IIRG(type) ((type >> 60) & 7) --#define DMA_TLB_IAIG(val) (((val) >> 57) & 7) -+#define DMA_TLB_IIRG(type) ((type >> 60) & 3) -+#define DMA_TLB_IAIG(val) (((val) >> 57) & 3) - #define DMA_TLB_READ_DRAIN (((u64)1) << 49) - #define DMA_TLB_WRITE_DRAIN (((u64)1) << 48) - #define DMA_TLB_DID(id) (((u64)((id) & 0xffff)) << 32) -@@ -164,9 +164,9 @@ static inline void dmar_writeq(void __iomem *addr, u64 val) - - /* INVALID_DESC */ - #define DMA_CCMD_INVL_GRANU_OFFSET 61 --#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 3) --#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 3) --#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 3) -+#define DMA_ID_TLB_GLOBAL_FLUSH (((u64)1) << 4) -+#define DMA_ID_TLB_DSI_FLUSH (((u64)2) << 4) -+#define DMA_ID_TLB_PSI_FLUSH (((u64)3) << 4) - #define DMA_ID_TLB_READ_DRAIN (((u64)1) << 7) - #define DMA_ID_TLB_WRITE_DRAIN (((u64)1) << 6) - #define DMA_ID_TLB_DID(id) (((u64)((id & 0xffff) << 16))) -@@ -316,8 +316,8 @@ enum { - #define QI_DEV_EIOTLB_SIZE (((u64)1) << 11) - #define QI_DEV_EIOTLB_GLOB(g) ((u64)g) - #define QI_DEV_EIOTLB_PASID(p) (((u64)p) << 32) --#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 32) --#define QI_DEV_EIOTLB_QDEP(qd) (((qd) & 0x1f) << 16) -+#define QI_DEV_EIOTLB_SID(sid) ((u64)((sid) & 0xffff) << 16) -+#define QI_DEV_EIOTLB_QDEP(qd) ((u64)((qd) & 0x1f) << 4) - #define QI_DEV_EIOTLB_MAX_INVS 32 - - #define QI_PGRP_IDX(idx) (((u64)(idx)) << 55) -diff --git a/include/rdma/ib_sa.h b/include/rdma/ib_sa.h -index 301969552d0a..b43e64d69734 100644 ---- a/include/rdma/ib_sa.h -+++ b/include/rdma/ib_sa.h -@@ -138,12 +138,12 @@ struct ib_sa_path_rec { - union ib_gid sgid; - __be16 dlid; - __be16 slid; -- int raw_traffic; -+ u8 raw_traffic; - /* reserved */ - __be32 flow_label; - u8 hop_limit; - u8 traffic_class; -- int reversible; -+ u8 reversible; - u8 numb_path; - __be16 pkey; - __be16 qos_class; -@@ -204,7 +204,7 @@ struct ib_sa_mcmember_rec { - u8 hop_limit; - u8 scope; - u8 join_state; -- int proxy_join; -+ u8 proxy_join; - }; - - /* Service Record Component Mask Sec 15.2.5.14 Ver 1.1 */ -diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h -index 4f6ba34cdee6..293b9a7f53bc 100644 ---- a/include/scsi/scsi_device.h -+++ b/include/scsi/scsi_device.h -@@ -307,6 +307,7 @@ extern void scsi_remove_device(struct scsi_device *); - extern int scsi_unregister_device_handler(struct scsi_device_handler *scsi_dh); - void scsi_attach_vpd(struct scsi_device *sdev); - -+extern struct scsi_device *scsi_device_from_queue(struct request_queue *q); - extern int scsi_device_get(struct scsi_device *); - extern void scsi_device_put(struct scsi_device *); - extern struct scsi_device *scsi_device_lookup(struct Scsi_Host *, -diff --git a/include/soc/at91/at91sam9_ddrsdr.h b/include/soc/at91/at91sam9_ddrsdr.h -index dc10c52e0e91..393362bdb860 100644 ---- a/include/soc/at91/at91sam9_ddrsdr.h -+++ b/include/soc/at91/at91sam9_ddrsdr.h -@@ -81,6 +81,7 @@ - #define AT91_DDRSDRC_LPCB_POWER_DOWN 2 - #define AT91_DDRSDRC_LPCB_DEEP_POWER_DOWN 3 - #define AT91_DDRSDRC_CLKFR (1 << 2) /* Clock Frozen */ -+#define AT91_DDRSDRC_LPDDR2_PWOFF (1 << 3) /* LPDDR Power Off */ - #define AT91_DDRSDRC_PASR (7 << 4) /* Partial Array Self Refresh */ - #define AT91_DDRSDRC_TCSR (3 << 8) /* Temperature Compensated Self Refresh */ - #define AT91_DDRSDRC_DS (3 << 10) /* Drive Strength */ -@@ -96,7 +97,9 @@ - #define AT91_DDRSDRC_MD_SDR 0 - #define AT91_DDRSDRC_MD_LOW_POWER_SDR 1 - #define AT91_DDRSDRC_MD_LOW_POWER_DDR 3 -+#define AT91_DDRSDRC_MD_LPDDR3 5 - #define AT91_DDRSDRC_MD_DDR2 6 /* [SAM9 Only] */ -+#define AT91_DDRSDRC_MD_LPDDR2 7 - #define AT91_DDRSDRC_DBW (1 << 4) /* Data Bus Width */ - #define AT91_DDRSDRC_DBW_32BITS (0 << 4) - #define AT91_DDRSDRC_DBW_16BITS (1 << 4) -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 6afc6f388edf..800fe16cc36f 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -544,6 +544,7 @@ struct se_node_acl { - /* Used to signal demo mode created ACL, disabled by default */ - bool dynamic_node_acl; - bool acl_stop:1; -+ bool dynamic_stop; - u32 queue_depth; - u32 acl_index; - enum target_prot_type saved_prot_type; -diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h -index ce9ea736f1d7..97069ecabe49 100644 ---- a/include/target/target_core_fabric.h -+++ b/include/target/target_core_fabric.h -@@ -168,6 +168,8 @@ void core_allocate_nexus_loss_ua(struct se_node_acl *acl); - - struct se_node_acl *core_tpg_get_initiator_node_acl(struct se_portal_group *tpg, - unsigned char *); -+bool target_tpg_has_node_acl(struct se_portal_group *tpg, -+ const char *); - struct se_node_acl *core_tpg_check_initiator_node_acl(struct se_portal_group *, - unsigned char *); - int core_tpg_set_initiator_node_queue_depth(struct se_portal_group *, -diff --git a/ipc/shm.c b/ipc/shm.c -index 3174634ca4e5..4982a4e7f009 100644 ---- a/ipc/shm.c -+++ b/ipc/shm.c -@@ -1083,8 +1083,8 @@ out_unlock1: - * "raddr" thing points to kernel space, and there has to be a wrapper around - * this. - */ --long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, -- unsigned long shmlba) -+long do_shmat(int shmid, char __user *shmaddr, int shmflg, -+ ulong *raddr, unsigned long shmlba) - { - struct shmid_kernel *shp; - unsigned long addr; -@@ -1105,8 +1105,13 @@ long do_shmat(int shmid, char __user *shmaddr, int shmflg, ulong *raddr, - goto out; - else if ((addr = (ulong)shmaddr)) { - if (addr & (shmlba - 1)) { -- if (shmflg & SHM_RND) -- addr &= ~(shmlba - 1); /* round down */ -+ /* -+ * Round down to the nearest multiple of shmlba. -+ * For sane do_mmap_pgoff() parameters, avoid -+ * round downs that trigger nil-page and MAP_FIXED. -+ */ -+ if ((shmflg & SHM_RND) && addr >= shmlba) -+ addr &= ~(shmlba - 1); - else - #ifndef __ARCH_FORCE_SHMLBA - if (addr & ~PAGE_MASK) -diff --git a/kernel/membarrier.c b/kernel/membarrier.c -index 536c727a56e9..9f9284f37f8d 100644 ---- a/kernel/membarrier.c -+++ b/kernel/membarrier.c -@@ -16,6 +16,7 @@ - - #include - #include -+#include - - /* - * Bitmask made from a "or" of all commands within enum membarrier_cmd, -@@ -51,6 +52,9 @@ - */ - SYSCALL_DEFINE2(membarrier, int, cmd, int, flags) - { -+ /* MEMBARRIER_CMD_SHARED is not compatible with nohz_full. */ -+ if (tick_nohz_full_enabled()) -+ return -ENOSYS; - if (unlikely(flags)) - return -EINVAL; - switch (cmd) { -diff --git a/mm/filemap.c b/mm/filemap.c -index c33c31d75a2b..69f75c77c098 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -865,9 +865,12 @@ void page_endio(struct page *page, int rw, int err) - unlock_page(page); - } else { /* rw == WRITE */ - if (err) { -+ struct address_space *mapping; -+ - SetPageError(page); -- if (page->mapping) -- mapping_set_error(page->mapping, err); -+ mapping = page_mapping(page); -+ if (mapping) -+ mapping_set_error(mapping, err); - } - end_page_writeback(page); - } -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 6a117213feb8..6f9005dcca2e 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -2467,7 +2467,7 @@ static bool zone_local(struct zone *local_zone, struct zone *zone) - - static bool zone_allows_reclaim(struct zone *local_zone, struct zone *zone) - { -- return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) < -+ return node_distance(zone_to_nid(local_zone), zone_to_nid(zone)) <= - RECLAIM_DISTANCE; - } - #else /* CONFIG_NUMA */ -diff --git a/mm/vmpressure.c b/mm/vmpressure.c -index c5afd573d7da..3fb15c25af87 100644 ---- a/mm/vmpressure.c -+++ b/mm/vmpressure.c -@@ -112,9 +112,16 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, - unsigned long reclaimed) - { - unsigned long scale = scanned + reclaimed; -- unsigned long pressure; -+ unsigned long pressure = 0; - - /* -+ * reclaimed can be greater than scanned in cases -+ * like THP, where the scanned is 1 and reclaimed -+ * could be 512 -+ */ -+ if (reclaimed >= scanned) -+ goto out; -+ /* - * We calculate the ratio (in percents) of how many pages were - * scanned vs. reclaimed in a given time frame (window). Note that - * time is in VM reclaimer's "ticks", i.e. number of pages -@@ -124,6 +131,7 @@ static enum vmpressure_levels vmpressure_calc_level(unsigned long scanned, - pressure = scale - (reclaimed * scale / scanned); - pressure = pressure * 100 / scale; - -+out: - pr_debug("%s: %3lu (s: %lu r: %lu)\n", __func__, pressure, - scanned, reclaimed); - -diff --git a/samples/mic/mpssd/.gitignore b/samples/mic/mpssd/.gitignore -new file mode 100644 -index 000000000000..8b7c72f07c92 ---- /dev/null -+++ b/samples/mic/mpssd/.gitignore -@@ -0,0 +1 @@ -+mpssd -diff --git a/samples/mic/mpssd/Makefile b/samples/mic/mpssd/Makefile -new file mode 100644 -index 000000000000..3e3ef91fed6b ---- /dev/null -+++ b/samples/mic/mpssd/Makefile -@@ -0,0 +1,27 @@ -+ifndef CROSS_COMPILE -+uname_M := $(shell uname -m 2>/dev/null || echo not) -+ARCH ?= $(shell echo $(uname_M) | sed -e s/i.86/x86/ -e s/x86_64/x86/) -+ -+ifeq ($(ARCH),x86) -+ -+PROGS := mpssd -+CC = $(CROSS_COMPILE)gcc -+CFLAGS := -I../../../usr/include -I../../../tools/include -+ -+ifdef DEBUG -+CFLAGS += -DDEBUG=$(DEBUG) -+endif -+ -+all: $(PROGS) -+mpssd: mpssd.c sysfs.c -+ $(CC) $(CFLAGS) mpssd.c sysfs.c -o mpssd -lpthread -+ -+install: -+ install mpssd /usr/sbin/mpssd -+ install micctrl /usr/sbin/micctrl -+ -+clean: -+ rm -fr $(PROGS) -+ -+endif -+endif -diff --git a/samples/mic/mpssd/micctrl b/samples/mic/mpssd/micctrl -new file mode 100644 -index 000000000000..8f2629b41c5f ---- /dev/null -+++ b/samples/mic/mpssd/micctrl -@@ -0,0 +1,173 @@ -+#!/bin/bash -+# Intel MIC Platform Software Stack (MPSS) -+# -+# Copyright(c) 2013 Intel Corporation. -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License, version 2, as -+# published by the Free Software Foundation. -+# -+# This program is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# The full GNU General Public License is included in this distribution in -+# the file called "COPYING". -+# -+# Intel MIC User Space Tools. -+# -+# micctrl - Controls MIC boot/start/stop. -+# -+# chkconfig: 2345 95 05 -+# description: start MPSS stack processing. -+# -+### BEGIN INIT INFO -+# Provides: micctrl -+### END INIT INFO -+ -+# Source function library. -+. /etc/init.d/functions -+ -+sysfs="/sys/class/mic" -+ -+_status() -+{ -+ f=$sysfs/$1 -+ echo -e $1 state: "`cat $f/state`" shutdown_status: "`cat $f/shutdown_status`" -+} -+ -+status() -+{ -+ if [ "`echo $1 | head -c3`" == "mic" ]; then -+ _status $1 -+ return $? -+ fi -+ for f in $sysfs/* -+ do -+ _status `basename $f` -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && return $RETVAL -+ done -+ return 0 -+} -+ -+_reset() -+{ -+ f=$sysfs/$1 -+ echo reset > $f/state -+} -+ -+reset() -+{ -+ if [ "`echo $1 | head -c3`" == "mic" ]; then -+ _reset $1 -+ return $? -+ fi -+ for f in $sysfs/* -+ do -+ _reset `basename $f` -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && return $RETVAL -+ done -+ return 0 -+} -+ -+_boot() -+{ -+ f=$sysfs/$1 -+ echo "linux" > $f/bootmode -+ echo "mic/uos.img" > $f/firmware -+ echo "mic/$1.image" > $f/ramdisk -+ echo "boot" > $f/state -+} -+ -+boot() -+{ -+ if [ "`echo $1 | head -c3`" == "mic" ]; then -+ _boot $1 -+ return $? -+ fi -+ for f in $sysfs/* -+ do -+ _boot `basename $f` -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && return $RETVAL -+ done -+ return 0 -+} -+ -+_shutdown() -+{ -+ f=$sysfs/$1 -+ echo shutdown > $f/state -+} -+ -+shutdown() -+{ -+ if [ "`echo $1 | head -c3`" == "mic" ]; then -+ _shutdown $1 -+ return $? -+ fi -+ for f in $sysfs/* -+ do -+ _shutdown `basename $f` -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && return $RETVAL -+ done -+ return 0 -+} -+ -+_wait() -+{ -+ f=$sysfs/$1 -+ while [ "`cat $f/state`" != "offline" -a "`cat $f/state`" != "online" ] -+ do -+ sleep 1 -+ echo -e "Waiting for $1 to go offline" -+ done -+} -+ -+wait() -+{ -+ if [ "`echo $1 | head -c3`" == "mic" ]; then -+ _wait $1 -+ return $? -+ fi -+ # Wait for the cards to go offline -+ for f in $sysfs/* -+ do -+ _wait `basename $f` -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && return $RETVAL -+ done -+ return 0 -+} -+ -+if [ ! -d "$sysfs" ]; then -+ echo -e $"Module unloaded " -+ exit 3 -+fi -+ -+case $1 in -+ -s) -+ status $2 -+ ;; -+ -r) -+ reset $2 -+ ;; -+ -b) -+ boot $2 -+ ;; -+ -S) -+ shutdown $2 -+ ;; -+ -w) -+ wait $2 -+ ;; -+ *) -+ echo $"Usage: $0 {-s (status) |-r (reset) |-b (boot) |-S (shutdown) |-w (wait)}" -+ exit 2 -+esac -+ -+exit $? -diff --git a/samples/mic/mpssd/mpss b/samples/mic/mpssd/mpss -new file mode 100644 -index 000000000000..09ea90931649 ---- /dev/null -+++ b/samples/mic/mpssd/mpss -@@ -0,0 +1,200 @@ -+#!/bin/bash -+# Intel MIC Platform Software Stack (MPSS) -+# -+# Copyright(c) 2013 Intel Corporation. -+# -+# This program is free software; you can redistribute it and/or modify -+# it under the terms of the GNU General Public License, version 2, as -+# published by the Free Software Foundation. -+# -+# This program is distributed in the hope that it will be useful, but -+# WITHOUT ANY WARRANTY; without even the implied warranty of -+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+# General Public License for more details. -+# -+# The full GNU General Public License is included in this distribution in -+# the file called "COPYING". -+# -+# Intel MIC User Space Tools. -+# -+# mpss Start mpssd. -+# -+# chkconfig: 2345 95 05 -+# description: start MPSS stack processing. -+# -+### BEGIN INIT INFO -+# Provides: mpss -+# Required-Start: -+# Required-Stop: -+# Short-Description: MPSS stack control -+# Description: MPSS stack control -+### END INIT INFO -+ -+# Source function library. -+. /etc/init.d/functions -+ -+exec=/usr/sbin/mpssd -+sysfs="/sys/class/mic" -+mic_modules="mic_host mic_x100_dma scif" -+ -+start() -+{ -+ [ -x $exec ] || exit 5 -+ -+ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -1`" = "mpssd" ]; then -+ echo -e $"MPSSD already running! " -+ success -+ echo -+ return 0 -+ fi -+ -+ echo -e $"Starting MPSS Stack" -+ echo -e $"Loading MIC drivers:" $mic_modules -+ -+ modprobe -a $mic_modules -+ RETVAL=$? -+ if [ $RETVAL -ne 0 ]; then -+ failure -+ echo -+ return $RETVAL -+ fi -+ -+ # Start the daemon -+ echo -n $"Starting MPSSD " -+ $exec -+ RETVAL=$? -+ if [ $RETVAL -ne 0 ]; then -+ failure -+ echo -+ return $RETVAL -+ fi -+ success -+ echo -+ -+ sleep 5 -+ -+ # Boot the cards -+ micctrl -b -+ -+ # Wait till ping works -+ for f in $sysfs/* -+ do -+ count=100 -+ ipaddr=`cat $f/cmdline` -+ ipaddr=${ipaddr#*address,} -+ ipaddr=`echo $ipaddr | cut -d, -f1 | cut -d\; -f1` -+ while [ $count -ge 0 ] -+ do -+ echo -e "Pinging "`basename $f`" " -+ ping -c 1 $ipaddr &> /dev/null -+ RETVAL=$? -+ if [ $RETVAL -eq 0 ]; then -+ success -+ break -+ fi -+ sleep 1 -+ count=`expr $count - 1` -+ done -+ [ $RETVAL -ne 0 ] && failure || success -+ echo -+ done -+ return $RETVAL -+} -+ -+stop() -+{ -+ echo -e $"Shutting down MPSS Stack: " -+ -+ # Bail out if module is unloaded -+ if [ ! -d "$sysfs" ]; then -+ echo -n $"Module unloaded " -+ success -+ echo -+ return 0 -+ fi -+ -+ # Shut down the cards. -+ micctrl -S -+ -+ # Wait for the cards to go offline -+ for f in $sysfs/* -+ do -+ while [ "`cat $f/state`" != "ready" ] -+ do -+ sleep 1 -+ echo -e "Waiting for "`basename $f`" to become ready" -+ done -+ done -+ -+ # Display the status of the cards -+ micctrl -s -+ -+ # Kill MPSSD now -+ echo -n $"Killing MPSSD" -+ killall -9 mpssd 2>/dev/null -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && failure || success -+ echo -+ return $RETVAL -+} -+ -+restart() -+{ -+ stop -+ sleep 5 -+ start -+} -+ -+status() -+{ -+ micctrl -s -+ if [ "`ps -e | awk '{print $4}' | grep mpssd | head -n 1`" = "mpssd" ]; then -+ echo "mpssd is running" -+ else -+ echo "mpssd is stopped" -+ fi -+ return 0 -+} -+ -+unload() -+{ -+ if [ ! -d "$sysfs" ]; then -+ echo -n $"No MIC_HOST Module: " -+ success -+ echo -+ return -+ fi -+ -+ stop -+ -+ sleep 5 -+ echo -n $"Removing MIC drivers:" $mic_modules -+ modprobe -r $mic_modules -+ RETVAL=$? -+ [ $RETVAL -ne 0 ] && failure || success -+ echo -+ return $RETVAL -+} -+ -+case $1 in -+ start) -+ start -+ ;; -+ stop) -+ stop -+ ;; -+ restart) -+ restart -+ ;; -+ status) -+ status -+ ;; -+ unload) -+ unload -+ ;; -+ *) -+ echo $"Usage: $0 {start|stop|restart|status|unload}" -+ exit 2 -+esac -+ -+exit $? -diff --git a/samples/mic/mpssd/mpssd.c b/samples/mic/mpssd/mpssd.c -new file mode 100644 -index 000000000000..c99a75968c01 ---- /dev/null -+++ b/samples/mic/mpssd/mpssd.c -@@ -0,0 +1,1826 @@ -+/* -+ * Intel MIC Platform Software Stack (MPSS) -+ * -+ * Copyright(c) 2013 Intel Corporation. -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License, version 2, as -+ * published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * The full GNU General Public License is included in this distribution in -+ * the file called "COPYING". -+ * -+ * Intel MIC User Space Tools. -+ */ -+ -+#define _GNU_SOURCE -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include "mpssd.h" -+#include -+#include -+#include -+ -+static void *init_mic(void *arg); -+ -+static FILE *logfp; -+static struct mic_info mic_list; -+ -+#define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0])) -+ -+#define min_t(type, x, y) ({ \ -+ type __min1 = (x); \ -+ type __min2 = (y); \ -+ __min1 < __min2 ? __min1 : __min2; }) -+ -+/* align addr on a size boundary - adjust address up/down if needed */ -+#define _ALIGN_DOWN(addr, size) ((addr)&(~((size)-1))) -+#define _ALIGN_UP(addr, size) _ALIGN_DOWN(addr + size - 1, size) -+ -+/* align addr on a size boundary - adjust address up if needed */ -+#define _ALIGN(addr, size) _ALIGN_UP(addr, size) -+ -+/* to align the pointer to the (next) page boundary */ -+#define PAGE_ALIGN(addr) _ALIGN(addr, PAGE_SIZE) -+ -+#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x)) -+ -+#define GSO_ENABLED 1 -+#define MAX_GSO_SIZE (64 * 1024) -+#define ETH_H_LEN 14 -+#define MAX_NET_PKT_SIZE (_ALIGN_UP(MAX_GSO_SIZE + ETH_H_LEN, 64)) -+#define MIC_DEVICE_PAGE_END 0x1000 -+ -+#ifndef VIRTIO_NET_HDR_F_DATA_VALID -+#define VIRTIO_NET_HDR_F_DATA_VALID 2 /* Csum is valid */ -+#endif -+ -+static struct { -+ struct mic_device_desc dd; -+ struct mic_vqconfig vqconfig[2]; -+ __u32 host_features, guest_acknowledgements; -+ struct virtio_console_config cons_config; -+} virtcons_dev_page = { -+ .dd = { -+ .type = VIRTIO_ID_CONSOLE, -+ .num_vq = ARRAY_SIZE(virtcons_dev_page.vqconfig), -+ .feature_len = sizeof(virtcons_dev_page.host_features), -+ .config_len = sizeof(virtcons_dev_page.cons_config), -+ }, -+ .vqconfig[0] = { -+ .num = htole16(MIC_VRING_ENTRIES), -+ }, -+ .vqconfig[1] = { -+ .num = htole16(MIC_VRING_ENTRIES), -+ }, -+}; -+ -+static struct { -+ struct mic_device_desc dd; -+ struct mic_vqconfig vqconfig[2]; -+ __u32 host_features, guest_acknowledgements; -+ struct virtio_net_config net_config; -+} virtnet_dev_page = { -+ .dd = { -+ .type = VIRTIO_ID_NET, -+ .num_vq = ARRAY_SIZE(virtnet_dev_page.vqconfig), -+ .feature_len = sizeof(virtnet_dev_page.host_features), -+ .config_len = sizeof(virtnet_dev_page.net_config), -+ }, -+ .vqconfig[0] = { -+ .num = htole16(MIC_VRING_ENTRIES), -+ }, -+ .vqconfig[1] = { -+ .num = htole16(MIC_VRING_ENTRIES), -+ }, -+#if GSO_ENABLED -+ .host_features = htole32( -+ 1 << VIRTIO_NET_F_CSUM | -+ 1 << VIRTIO_NET_F_GSO | -+ 1 << VIRTIO_NET_F_GUEST_TSO4 | -+ 1 << VIRTIO_NET_F_GUEST_TSO6 | -+ 1 << VIRTIO_NET_F_GUEST_ECN), -+#else -+ .host_features = 0, -+#endif -+}; -+ -+static const char *mic_config_dir = "/etc/mpss"; -+static const char *virtblk_backend = "VIRTBLK_BACKEND"; -+static struct { -+ struct mic_device_desc dd; -+ struct mic_vqconfig vqconfig[1]; -+ __u32 host_features, guest_acknowledgements; -+ struct virtio_blk_config blk_config; -+} virtblk_dev_page = { -+ .dd = { -+ .type = VIRTIO_ID_BLOCK, -+ .num_vq = ARRAY_SIZE(virtblk_dev_page.vqconfig), -+ .feature_len = sizeof(virtblk_dev_page.host_features), -+ .config_len = sizeof(virtblk_dev_page.blk_config), -+ }, -+ .vqconfig[0] = { -+ .num = htole16(MIC_VRING_ENTRIES), -+ }, -+ .host_features = -+ htole32(1<name, strerror(errno)); -+ return ret; -+ } -+ } -+ if (pid < 0) { -+ mpsslog("%s fork failed errno %s\n", -+ mic->name, strerror(errno)); -+ return ret; -+ } -+ -+ ret = waitpid(pid, NULL, 0); -+ if (ret < 0) { -+ mpsslog("%s waitpid failed errno %s\n", -+ mic->name, strerror(errno)); -+ return ret; -+ } -+ -+ snprintf(ipaddr, IFNAMSIZ, "172.31.%d.254/24", mic->id + 1); -+ -+ pid = fork(); -+ if (pid == 0) { -+ ifargv[0] = "ip"; -+ ifargv[1] = "addr"; -+ ifargv[2] = "add"; -+ ifargv[3] = ipaddr; -+ ifargv[4] = "dev"; -+ ifargv[5] = dev; -+ ifargv[6] = NULL; -+ mpsslog("Configuring %s ipaddr %s\n", dev, ipaddr); -+ ret = execvp("ip", ifargv); -+ if (ret < 0) { -+ mpsslog("%s execvp failed errno %s\n", -+ mic->name, strerror(errno)); -+ return ret; -+ } -+ } -+ if (pid < 0) { -+ mpsslog("%s fork failed errno %s\n", -+ mic->name, strerror(errno)); -+ return ret; -+ } -+ -+ ret = waitpid(pid, NULL, 0); -+ if (ret < 0) { -+ mpsslog("%s waitpid failed errno %s\n", -+ mic->name, strerror(errno)); -+ return ret; -+ } -+ mpsslog("MIC name %s %s %d DONE!\n", -+ mic->name, __func__, __LINE__); -+ return 0; -+} -+ -+static int tun_alloc(struct mic_info *mic, char *dev) -+{ -+ struct ifreq ifr; -+ int fd, err; -+#if GSO_ENABLED -+ unsigned offload; -+#endif -+ fd = open("/dev/net/tun", O_RDWR); -+ if (fd < 0) { -+ mpsslog("Could not open /dev/net/tun %s\n", strerror(errno)); -+ goto done; -+ } -+ -+ memset(&ifr, 0, sizeof(ifr)); -+ -+ ifr.ifr_flags = IFF_TAP | IFF_NO_PI | IFF_VNET_HDR; -+ if (*dev) -+ strncpy(ifr.ifr_name, dev, IFNAMSIZ); -+ -+ err = ioctl(fd, TUNSETIFF, (void *)&ifr); -+ if (err < 0) { -+ mpsslog("%s %s %d TUNSETIFF failed %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ close(fd); -+ return err; -+ } -+#if GSO_ENABLED -+ offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_TSO6 | TUN_F_TSO_ECN; -+ -+ err = ioctl(fd, TUNSETOFFLOAD, offload); -+ if (err < 0) { -+ mpsslog("%s %s %d TUNSETOFFLOAD failed %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ close(fd); -+ return err; -+ } -+#endif -+ strcpy(dev, ifr.ifr_name); -+ mpsslog("Created TAP %s\n", dev); -+done: -+ return fd; -+} -+ -+#define NET_FD_VIRTIO_NET 0 -+#define NET_FD_TUN 1 -+#define MAX_NET_FD 2 -+ -+static void set_dp(struct mic_info *mic, int type, void *dp) -+{ -+ switch (type) { -+ case VIRTIO_ID_CONSOLE: -+ mic->mic_console.console_dp = dp; -+ return; -+ case VIRTIO_ID_NET: -+ mic->mic_net.net_dp = dp; -+ return; -+ case VIRTIO_ID_BLOCK: -+ mic->mic_virtblk.block_dp = dp; -+ return; -+ } -+ mpsslog("%s %s %d not found\n", mic->name, __func__, type); -+ assert(0); -+} -+ -+static void *get_dp(struct mic_info *mic, int type) -+{ -+ switch (type) { -+ case VIRTIO_ID_CONSOLE: -+ return mic->mic_console.console_dp; -+ case VIRTIO_ID_NET: -+ return mic->mic_net.net_dp; -+ case VIRTIO_ID_BLOCK: -+ return mic->mic_virtblk.block_dp; -+ } -+ mpsslog("%s %s %d not found\n", mic->name, __func__, type); -+ assert(0); -+ return NULL; -+} -+ -+static struct mic_device_desc *get_device_desc(struct mic_info *mic, int type) -+{ -+ struct mic_device_desc *d; -+ int i; -+ void *dp = get_dp(mic, type); -+ -+ for (i = sizeof(struct mic_bootparam); i < PAGE_SIZE; -+ i += mic_total_desc_size(d)) { -+ d = dp + i; -+ -+ /* End of list */ -+ if (d->type == 0) -+ break; -+ -+ if (d->type == -1) -+ continue; -+ -+ mpsslog("%s %s d-> type %d d %p\n", -+ mic->name, __func__, d->type, d); -+ -+ if (d->type == (__u8)type) -+ return d; -+ } -+ mpsslog("%s %s %d not found\n", mic->name, __func__, type); -+ return NULL; -+} -+ -+/* See comments in vhost.c for explanation of next_desc() */ -+static unsigned next_desc(struct vring_desc *desc) -+{ -+ unsigned int next; -+ -+ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) -+ return -1U; -+ next = le16toh(desc->next); -+ return next; -+} -+ -+/* Sum up all the IOVEC length */ -+static ssize_t -+sum_iovec_len(struct mic_copy_desc *copy) -+{ -+ ssize_t sum = 0; -+ int i; -+ -+ for (i = 0; i < copy->iovcnt; i++) -+ sum += copy->iov[i].iov_len; -+ return sum; -+} -+ -+static inline void verify_out_len(struct mic_info *mic, -+ struct mic_copy_desc *copy) -+{ -+ if (copy->out_len != sum_iovec_len(copy)) { -+ mpsslog("%s %s %d BUG copy->out_len 0x%x len 0x%zx\n", -+ mic->name, __func__, __LINE__, -+ copy->out_len, sum_iovec_len(copy)); -+ assert(copy->out_len == sum_iovec_len(copy)); -+ } -+} -+ -+/* Display an iovec */ -+static void -+disp_iovec(struct mic_info *mic, struct mic_copy_desc *copy, -+ const char *s, int line) -+{ -+ int i; -+ -+ for (i = 0; i < copy->iovcnt; i++) -+ mpsslog("%s %s %d copy->iov[%d] addr %p len 0x%zx\n", -+ mic->name, s, line, i, -+ copy->iov[i].iov_base, copy->iov[i].iov_len); -+} -+ -+static inline __u16 read_avail_idx(struct mic_vring *vr) -+{ -+ return ACCESS_ONCE(vr->info->avail_idx); -+} -+ -+static inline void txrx_prepare(int type, bool tx, struct mic_vring *vr, -+ struct mic_copy_desc *copy, ssize_t len) -+{ -+ copy->vr_idx = tx ? 0 : 1; -+ copy->update_used = true; -+ if (type == VIRTIO_ID_NET) -+ copy->iov[1].iov_len = len - sizeof(struct virtio_net_hdr); -+ else -+ copy->iov[0].iov_len = len; -+} -+ -+/* Central API which triggers the copies */ -+static int -+mic_virtio_copy(struct mic_info *mic, int fd, -+ struct mic_vring *vr, struct mic_copy_desc *copy) -+{ -+ int ret; -+ -+ ret = ioctl(fd, MIC_VIRTIO_COPY_DESC, copy); -+ if (ret) { -+ mpsslog("%s %s %d errno %s ret %d\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno), ret); -+ } -+ return ret; -+} -+ -+static inline unsigned _vring_size(unsigned int num, unsigned long align) -+{ -+ return ((sizeof(struct vring_desc) * num + sizeof(__u16) * (3 + num) -+ + align - 1) & ~(align - 1)) -+ + sizeof(__u16) * 3 + sizeof(struct vring_used_elem) * num; -+} -+ -+/* -+ * This initialization routine requires at least one -+ * vring i.e. vr0. vr1 is optional. -+ */ -+static void * -+init_vr(struct mic_info *mic, int fd, int type, -+ struct mic_vring *vr0, struct mic_vring *vr1, int num_vq) -+{ -+ int vr_size; -+ char *va; -+ -+ vr_size = PAGE_ALIGN(_vring_size(MIC_VRING_ENTRIES, -+ MIC_VIRTIO_RING_ALIGN) + -+ sizeof(struct _mic_vring_info)); -+ va = mmap(NULL, MIC_DEVICE_PAGE_END + vr_size * num_vq, -+ PROT_READ, MAP_SHARED, fd, 0); -+ if (MAP_FAILED == va) { -+ mpsslog("%s %s %d mmap failed errno %s\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ goto done; -+ } -+ set_dp(mic, type, va); -+ vr0->va = (struct mic_vring *)&va[MIC_DEVICE_PAGE_END]; -+ vr0->info = vr0->va + -+ _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN); -+ vring_init(&vr0->vr, -+ MIC_VRING_ENTRIES, vr0->va, MIC_VIRTIO_RING_ALIGN); -+ mpsslog("%s %s vr0 %p vr0->info %p vr_size 0x%x vring 0x%x ", -+ __func__, mic->name, vr0->va, vr0->info, vr_size, -+ _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); -+ mpsslog("magic 0x%x expected 0x%x\n", -+ le32toh(vr0->info->magic), MIC_MAGIC + type); -+ assert(le32toh(vr0->info->magic) == MIC_MAGIC + type); -+ if (vr1) { -+ vr1->va = (struct mic_vring *) -+ &va[MIC_DEVICE_PAGE_END + vr_size]; -+ vr1->info = vr1->va + _vring_size(MIC_VRING_ENTRIES, -+ MIC_VIRTIO_RING_ALIGN); -+ vring_init(&vr1->vr, -+ MIC_VRING_ENTRIES, vr1->va, MIC_VIRTIO_RING_ALIGN); -+ mpsslog("%s %s vr1 %p vr1->info %p vr_size 0x%x vring 0x%x ", -+ __func__, mic->name, vr1->va, vr1->info, vr_size, -+ _vring_size(MIC_VRING_ENTRIES, MIC_VIRTIO_RING_ALIGN)); -+ mpsslog("magic 0x%x expected 0x%x\n", -+ le32toh(vr1->info->magic), MIC_MAGIC + type + 1); -+ assert(le32toh(vr1->info->magic) == MIC_MAGIC + type + 1); -+ } -+done: -+ return va; -+} -+ -+static int -+wait_for_card_driver(struct mic_info *mic, int fd, int type) -+{ -+ struct pollfd pollfd; -+ int err; -+ struct mic_device_desc *desc = get_device_desc(mic, type); -+ __u8 prev_status; -+ -+ if (!desc) -+ return -ENODEV; -+ prev_status = desc->status; -+ pollfd.fd = fd; -+ mpsslog("%s %s Waiting .... desc-> type %d status 0x%x\n", -+ mic->name, __func__, type, desc->status); -+ -+ while (1) { -+ pollfd.events = POLLIN; -+ pollfd.revents = 0; -+ err = poll(&pollfd, 1, -1); -+ if (err < 0) { -+ mpsslog("%s %s poll failed %s\n", -+ mic->name, __func__, strerror(errno)); -+ continue; -+ } -+ -+ if (pollfd.revents) { -+ if (desc->status != prev_status) { -+ mpsslog("%s %s Waiting... desc-> type %d " -+ "status 0x%x\n", -+ mic->name, __func__, type, -+ desc->status); -+ prev_status = desc->status; -+ } -+ if (desc->status & VIRTIO_CONFIG_S_DRIVER_OK) { -+ mpsslog("%s %s poll.revents %d\n", -+ mic->name, __func__, pollfd.revents); -+ mpsslog("%s %s desc-> type %d status 0x%x\n", -+ mic->name, __func__, type, -+ desc->status); -+ break; -+ } -+ } -+ } -+ return 0; -+} -+ -+/* Spin till we have some descriptors */ -+static void -+spin_for_descriptors(struct mic_info *mic, struct mic_vring *vr) -+{ -+ __u16 avail_idx = read_avail_idx(vr); -+ -+ while (avail_idx == le16toh(ACCESS_ONCE(vr->vr.avail->idx))) { -+#ifdef DEBUG -+ mpsslog("%s %s waiting for desc avail %d info_avail %d\n", -+ mic->name, __func__, -+ le16toh(vr->vr.avail->idx), vr->info->avail_idx); -+#endif -+ sched_yield(); -+ } -+} -+ -+static void * -+virtio_net(void *arg) -+{ -+ static __u8 vnet_hdr[2][sizeof(struct virtio_net_hdr)]; -+ static __u8 vnet_buf[2][MAX_NET_PKT_SIZE] __attribute__ ((aligned(64))); -+ struct iovec vnet_iov[2][2] = { -+ { { .iov_base = vnet_hdr[0], .iov_len = sizeof(vnet_hdr[0]) }, -+ { .iov_base = vnet_buf[0], .iov_len = sizeof(vnet_buf[0]) } }, -+ { { .iov_base = vnet_hdr[1], .iov_len = sizeof(vnet_hdr[1]) }, -+ { .iov_base = vnet_buf[1], .iov_len = sizeof(vnet_buf[1]) } }, -+ }; -+ struct iovec *iov0 = vnet_iov[0], *iov1 = vnet_iov[1]; -+ struct mic_info *mic = (struct mic_info *)arg; -+ char if_name[IFNAMSIZ]; -+ struct pollfd net_poll[MAX_NET_FD]; -+ struct mic_vring tx_vr, rx_vr; -+ struct mic_copy_desc copy; -+ struct mic_device_desc *desc; -+ int err; -+ -+ snprintf(if_name, IFNAMSIZ, "mic%d", mic->id); -+ mic->mic_net.tap_fd = tun_alloc(mic, if_name); -+ if (mic->mic_net.tap_fd < 0) -+ goto done; -+ -+ if (tap_configure(mic, if_name)) -+ goto done; -+ mpsslog("MIC name %s id %d\n", mic->name, mic->id); -+ -+ net_poll[NET_FD_VIRTIO_NET].fd = mic->mic_net.virtio_net_fd; -+ net_poll[NET_FD_VIRTIO_NET].events = POLLIN; -+ net_poll[NET_FD_TUN].fd = mic->mic_net.tap_fd; -+ net_poll[NET_FD_TUN].events = POLLIN; -+ -+ if (MAP_FAILED == init_vr(mic, mic->mic_net.virtio_net_fd, -+ VIRTIO_ID_NET, &tx_vr, &rx_vr, -+ virtnet_dev_page.dd.num_vq)) { -+ mpsslog("%s init_vr failed %s\n", -+ mic->name, strerror(errno)); -+ goto done; -+ } -+ -+ copy.iovcnt = 2; -+ desc = get_device_desc(mic, VIRTIO_ID_NET); -+ -+ while (1) { -+ ssize_t len; -+ -+ net_poll[NET_FD_VIRTIO_NET].revents = 0; -+ net_poll[NET_FD_TUN].revents = 0; -+ -+ /* Start polling for data from tap and virtio net */ -+ err = poll(net_poll, 2, -1); -+ if (err < 0) { -+ mpsslog("%s poll failed %s\n", -+ __func__, strerror(errno)); -+ continue; -+ } -+ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) { -+ err = wait_for_card_driver(mic, -+ mic->mic_net.virtio_net_fd, -+ VIRTIO_ID_NET); -+ if (err) { -+ mpsslog("%s %s %d Exiting...\n", -+ mic->name, __func__, __LINE__); -+ break; -+ } -+ } -+ /* -+ * Check if there is data to be read from TUN and write to -+ * virtio net fd if there is. -+ */ -+ if (net_poll[NET_FD_TUN].revents & POLLIN) { -+ copy.iov = iov0; -+ len = readv(net_poll[NET_FD_TUN].fd, -+ copy.iov, copy.iovcnt); -+ if (len > 0) { -+ struct virtio_net_hdr *hdr -+ = (struct virtio_net_hdr *)vnet_hdr[0]; -+ -+ /* Disable checksums on the card since we are on -+ a reliable PCIe link */ -+ hdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID; -+#ifdef DEBUG -+ mpsslog("%s %s %d hdr->flags 0x%x ", mic->name, -+ __func__, __LINE__, hdr->flags); -+ mpsslog("copy.out_len %d hdr->gso_type 0x%x\n", -+ copy.out_len, hdr->gso_type); -+#endif -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, __LINE__); -+ mpsslog("%s %s %d read from tap 0x%lx\n", -+ mic->name, __func__, __LINE__, -+ len); -+#endif -+ spin_for_descriptors(mic, &tx_vr); -+ txrx_prepare(VIRTIO_ID_NET, 1, &tx_vr, ©, -+ len); -+ -+ err = mic_virtio_copy(mic, -+ mic->mic_net.virtio_net_fd, &tx_vr, -+ ©); -+ if (err < 0) { -+ mpsslog("%s %s %d mic_virtio_copy %s\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ } -+ if (!err) -+ verify_out_len(mic, ©); -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, __LINE__); -+ mpsslog("%s %s %d wrote to net 0x%lx\n", -+ mic->name, __func__, __LINE__, -+ sum_iovec_len(©)); -+#endif -+ /* Reinitialize IOV for next run */ -+ iov0[1].iov_len = MAX_NET_PKT_SIZE; -+ } else if (len < 0) { -+ disp_iovec(mic, ©, __func__, __LINE__); -+ mpsslog("%s %s %d read failed %s ", mic->name, -+ __func__, __LINE__, strerror(errno)); -+ mpsslog("cnt %d sum %zd\n", -+ copy.iovcnt, sum_iovec_len(©)); -+ } -+ } -+ -+ /* -+ * Check if there is data to be read from virtio net and -+ * write to TUN if there is. -+ */ -+ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLIN) { -+ while (rx_vr.info->avail_idx != -+ le16toh(rx_vr.vr.avail->idx)) { -+ copy.iov = iov1; -+ txrx_prepare(VIRTIO_ID_NET, 0, &rx_vr, ©, -+ MAX_NET_PKT_SIZE -+ + sizeof(struct virtio_net_hdr)); -+ -+ err = mic_virtio_copy(mic, -+ mic->mic_net.virtio_net_fd, &rx_vr, -+ ©); -+ if (!err) { -+#ifdef DEBUG -+ struct virtio_net_hdr *hdr -+ = (struct virtio_net_hdr *) -+ vnet_hdr[1]; -+ -+ mpsslog("%s %s %d hdr->flags 0x%x, ", -+ mic->name, __func__, __LINE__, -+ hdr->flags); -+ mpsslog("out_len %d gso_type 0x%x\n", -+ copy.out_len, -+ hdr->gso_type); -+#endif -+ /* Set the correct output iov_len */ -+ iov1[1].iov_len = copy.out_len - -+ sizeof(struct virtio_net_hdr); -+ verify_out_len(mic, ©); -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, -+ __LINE__); -+ mpsslog("%s %s %d ", -+ mic->name, __func__, __LINE__); -+ mpsslog("read from net 0x%lx\n", -+ sum_iovec_len(copy)); -+#endif -+ len = writev(net_poll[NET_FD_TUN].fd, -+ copy.iov, copy.iovcnt); -+ if (len != sum_iovec_len(©)) { -+ mpsslog("Tun write failed %s ", -+ strerror(errno)); -+ mpsslog("len 0x%zx ", len); -+ mpsslog("read_len 0x%zx\n", -+ sum_iovec_len(©)); -+ } else { -+#ifdef DEBUG -+ disp_iovec(mic, ©, __func__, -+ __LINE__); -+ mpsslog("%s %s %d ", -+ mic->name, __func__, -+ __LINE__); -+ mpsslog("wrote to tap 0x%lx\n", -+ len); -+#endif -+ } -+ } else { -+ mpsslog("%s %s %d mic_virtio_copy %s\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ break; -+ } -+ } -+ } -+ if (net_poll[NET_FD_VIRTIO_NET].revents & POLLERR) -+ mpsslog("%s: %s: POLLERR\n", __func__, mic->name); -+ } -+done: -+ pthread_exit(NULL); -+} -+ -+/* virtio_console */ -+#define VIRTIO_CONSOLE_FD 0 -+#define MONITOR_FD (VIRTIO_CONSOLE_FD + 1) -+#define MAX_CONSOLE_FD (MONITOR_FD + 1) /* must be the last one + 1 */ -+#define MAX_BUFFER_SIZE PAGE_SIZE -+ -+static void * -+virtio_console(void *arg) -+{ -+ static __u8 vcons_buf[2][PAGE_SIZE]; -+ struct iovec vcons_iov[2] = { -+ { .iov_base = vcons_buf[0], .iov_len = sizeof(vcons_buf[0]) }, -+ { .iov_base = vcons_buf[1], .iov_len = sizeof(vcons_buf[1]) }, -+ }; -+ struct iovec *iov0 = &vcons_iov[0], *iov1 = &vcons_iov[1]; -+ struct mic_info *mic = (struct mic_info *)arg; -+ int err; -+ struct pollfd console_poll[MAX_CONSOLE_FD]; -+ int pty_fd; -+ char *pts_name; -+ ssize_t len; -+ struct mic_vring tx_vr, rx_vr; -+ struct mic_copy_desc copy; -+ struct mic_device_desc *desc; -+ -+ pty_fd = posix_openpt(O_RDWR); -+ if (pty_fd < 0) { -+ mpsslog("can't open a pseudoterminal master device: %s\n", -+ strerror(errno)); -+ goto _return; -+ } -+ pts_name = ptsname(pty_fd); -+ if (pts_name == NULL) { -+ mpsslog("can't get pts name\n"); -+ goto _close_pty; -+ } -+ printf("%s console message goes to %s\n", mic->name, pts_name); -+ mpsslog("%s console message goes to %s\n", mic->name, pts_name); -+ err = grantpt(pty_fd); -+ if (err < 0) { -+ mpsslog("can't grant access: %s %s\n", -+ pts_name, strerror(errno)); -+ goto _close_pty; -+ } -+ err = unlockpt(pty_fd); -+ if (err < 0) { -+ mpsslog("can't unlock a pseudoterminal: %s %s\n", -+ pts_name, strerror(errno)); -+ goto _close_pty; -+ } -+ console_poll[MONITOR_FD].fd = pty_fd; -+ console_poll[MONITOR_FD].events = POLLIN; -+ -+ console_poll[VIRTIO_CONSOLE_FD].fd = mic->mic_console.virtio_console_fd; -+ console_poll[VIRTIO_CONSOLE_FD].events = POLLIN; -+ -+ if (MAP_FAILED == init_vr(mic, mic->mic_console.virtio_console_fd, -+ VIRTIO_ID_CONSOLE, &tx_vr, &rx_vr, -+ virtcons_dev_page.dd.num_vq)) { -+ mpsslog("%s init_vr failed %s\n", -+ mic->name, strerror(errno)); -+ goto _close_pty; -+ } -+ -+ copy.iovcnt = 1; -+ desc = get_device_desc(mic, VIRTIO_ID_CONSOLE); -+ -+ for (;;) { -+ console_poll[MONITOR_FD].revents = 0; -+ console_poll[VIRTIO_CONSOLE_FD].revents = 0; -+ err = poll(console_poll, MAX_CONSOLE_FD, -1); -+ if (err < 0) { -+ mpsslog("%s %d: poll failed: %s\n", __func__, __LINE__, -+ strerror(errno)); -+ continue; -+ } -+ if (!(desc->status & VIRTIO_CONFIG_S_DRIVER_OK)) { -+ err = wait_for_card_driver(mic, -+ mic->mic_console.virtio_console_fd, -+ VIRTIO_ID_CONSOLE); -+ if (err) { -+ mpsslog("%s %s %d Exiting...\n", -+ mic->name, __func__, __LINE__); -+ break; -+ } -+ } -+ -+ if (console_poll[MONITOR_FD].revents & POLLIN) { -+ copy.iov = iov0; -+ len = readv(pty_fd, copy.iov, copy.iovcnt); -+ if (len > 0) { -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, __LINE__); -+ mpsslog("%s %s %d read from tap 0x%lx\n", -+ mic->name, __func__, __LINE__, -+ len); -+#endif -+ spin_for_descriptors(mic, &tx_vr); -+ txrx_prepare(VIRTIO_ID_CONSOLE, 1, &tx_vr, -+ ©, len); -+ -+ err = mic_virtio_copy(mic, -+ mic->mic_console.virtio_console_fd, -+ &tx_vr, ©); -+ if (err < 0) { -+ mpsslog("%s %s %d mic_virtio_copy %s\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ } -+ if (!err) -+ verify_out_len(mic, ©); -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, __LINE__); -+ mpsslog("%s %s %d wrote to net 0x%lx\n", -+ mic->name, __func__, __LINE__, -+ sum_iovec_len(copy)); -+#endif -+ /* Reinitialize IOV for next run */ -+ iov0->iov_len = PAGE_SIZE; -+ } else if (len < 0) { -+ disp_iovec(mic, ©, __func__, __LINE__); -+ mpsslog("%s %s %d read failed %s ", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ mpsslog("cnt %d sum %zd\n", -+ copy.iovcnt, sum_iovec_len(©)); -+ } -+ } -+ -+ if (console_poll[VIRTIO_CONSOLE_FD].revents & POLLIN) { -+ while (rx_vr.info->avail_idx != -+ le16toh(rx_vr.vr.avail->idx)) { -+ copy.iov = iov1; -+ txrx_prepare(VIRTIO_ID_CONSOLE, 0, &rx_vr, -+ ©, PAGE_SIZE); -+ -+ err = mic_virtio_copy(mic, -+ mic->mic_console.virtio_console_fd, -+ &rx_vr, ©); -+ if (!err) { -+ /* Set the correct output iov_len */ -+ iov1->iov_len = copy.out_len; -+ verify_out_len(mic, ©); -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, -+ __LINE__); -+ mpsslog("%s %s %d ", -+ mic->name, __func__, __LINE__); -+ mpsslog("read from net 0x%lx\n", -+ sum_iovec_len(copy)); -+#endif -+ len = writev(pty_fd, -+ copy.iov, copy.iovcnt); -+ if (len != sum_iovec_len(©)) { -+ mpsslog("Tun write failed %s ", -+ strerror(errno)); -+ mpsslog("len 0x%zx ", len); -+ mpsslog("read_len 0x%zx\n", -+ sum_iovec_len(©)); -+ } else { -+#ifdef DEBUG -+ disp_iovec(mic, copy, __func__, -+ __LINE__); -+ mpsslog("%s %s %d ", -+ mic->name, __func__, -+ __LINE__); -+ mpsslog("wrote to tap 0x%lx\n", -+ len); -+#endif -+ } -+ } else { -+ mpsslog("%s %s %d mic_virtio_copy %s\n", -+ mic->name, __func__, __LINE__, -+ strerror(errno)); -+ break; -+ } -+ } -+ } -+ if (console_poll[NET_FD_VIRTIO_NET].revents & POLLERR) -+ mpsslog("%s: %s: POLLERR\n", __func__, mic->name); -+ } -+_close_pty: -+ close(pty_fd); -+_return: -+ pthread_exit(NULL); -+} -+ -+static void -+add_virtio_device(struct mic_info *mic, struct mic_device_desc *dd) -+{ -+ char path[PATH_MAX]; -+ int fd, err; -+ -+ snprintf(path, PATH_MAX, "/dev/mic%d", mic->id); -+ fd = open(path, O_RDWR); -+ if (fd < 0) { -+ mpsslog("Could not open %s %s\n", path, strerror(errno)); -+ return; -+ } -+ -+ err = ioctl(fd, MIC_VIRTIO_ADD_DEVICE, dd); -+ if (err < 0) { -+ mpsslog("Could not add %d %s\n", dd->type, strerror(errno)); -+ close(fd); -+ return; -+ } -+ switch (dd->type) { -+ case VIRTIO_ID_NET: -+ mic->mic_net.virtio_net_fd = fd; -+ mpsslog("Added VIRTIO_ID_NET for %s\n", mic->name); -+ break; -+ case VIRTIO_ID_CONSOLE: -+ mic->mic_console.virtio_console_fd = fd; -+ mpsslog("Added VIRTIO_ID_CONSOLE for %s\n", mic->name); -+ break; -+ case VIRTIO_ID_BLOCK: -+ mic->mic_virtblk.virtio_block_fd = fd; -+ mpsslog("Added VIRTIO_ID_BLOCK for %s\n", mic->name); -+ break; -+ } -+} -+ -+static bool -+set_backend_file(struct mic_info *mic) -+{ -+ FILE *config; -+ char buff[PATH_MAX], *line, *evv, *p; -+ -+ snprintf(buff, PATH_MAX, "%s/mpssd%03d.conf", mic_config_dir, mic->id); -+ config = fopen(buff, "r"); -+ if (config == NULL) -+ return false; -+ do { /* look for "virtblk_backend=XXXX" */ -+ line = fgets(buff, PATH_MAX, config); -+ if (line == NULL) -+ break; -+ if (*line == '#') -+ continue; -+ p = strchr(line, '\n'); -+ if (p) -+ *p = '\0'; -+ } while (strncmp(line, virtblk_backend, strlen(virtblk_backend)) != 0); -+ fclose(config); -+ if (line == NULL) -+ return false; -+ evv = strchr(line, '='); -+ if (evv == NULL) -+ return false; -+ mic->mic_virtblk.backend_file = malloc(strlen(evv) + 1); -+ if (mic->mic_virtblk.backend_file == NULL) { -+ mpsslog("%s %d can't allocate memory\n", mic->name, mic->id); -+ return false; -+ } -+ strcpy(mic->mic_virtblk.backend_file, evv + 1); -+ return true; -+} -+ -+#define SECTOR_SIZE 512 -+static bool -+set_backend_size(struct mic_info *mic) -+{ -+ mic->mic_virtblk.backend_size = lseek(mic->mic_virtblk.backend, 0, -+ SEEK_END); -+ if (mic->mic_virtblk.backend_size < 0) { -+ mpsslog("%s: can't seek: %s\n", -+ mic->name, mic->mic_virtblk.backend_file); -+ return false; -+ } -+ virtblk_dev_page.blk_config.capacity = -+ mic->mic_virtblk.backend_size / SECTOR_SIZE; -+ if ((mic->mic_virtblk.backend_size % SECTOR_SIZE) != 0) -+ virtblk_dev_page.blk_config.capacity++; -+ -+ virtblk_dev_page.blk_config.capacity = -+ htole64(virtblk_dev_page.blk_config.capacity); -+ -+ return true; -+} -+ -+static bool -+open_backend(struct mic_info *mic) -+{ -+ if (!set_backend_file(mic)) -+ goto _error_exit; -+ mic->mic_virtblk.backend = open(mic->mic_virtblk.backend_file, O_RDWR); -+ if (mic->mic_virtblk.backend < 0) { -+ mpsslog("%s: can't open: %s\n", mic->name, -+ mic->mic_virtblk.backend_file); -+ goto _error_free; -+ } -+ if (!set_backend_size(mic)) -+ goto _error_close; -+ mic->mic_virtblk.backend_addr = mmap(NULL, -+ mic->mic_virtblk.backend_size, -+ PROT_READ|PROT_WRITE, MAP_SHARED, -+ mic->mic_virtblk.backend, 0L); -+ if (mic->mic_virtblk.backend_addr == MAP_FAILED) { -+ mpsslog("%s: can't map: %s %s\n", -+ mic->name, mic->mic_virtblk.backend_file, -+ strerror(errno)); -+ goto _error_close; -+ } -+ return true; -+ -+ _error_close: -+ close(mic->mic_virtblk.backend); -+ _error_free: -+ free(mic->mic_virtblk.backend_file); -+ _error_exit: -+ return false; -+} -+ -+static void -+close_backend(struct mic_info *mic) -+{ -+ munmap(mic->mic_virtblk.backend_addr, mic->mic_virtblk.backend_size); -+ close(mic->mic_virtblk.backend); -+ free(mic->mic_virtblk.backend_file); -+} -+ -+static bool -+start_virtblk(struct mic_info *mic, struct mic_vring *vring) -+{ -+ if (((unsigned long)&virtblk_dev_page.blk_config % 8) != 0) { -+ mpsslog("%s: blk_config is not 8 byte aligned.\n", -+ mic->name); -+ return false; -+ } -+ add_virtio_device(mic, &virtblk_dev_page.dd); -+ if (MAP_FAILED == init_vr(mic, mic->mic_virtblk.virtio_block_fd, -+ VIRTIO_ID_BLOCK, vring, NULL, -+ virtblk_dev_page.dd.num_vq)) { -+ mpsslog("%s init_vr failed %s\n", -+ mic->name, strerror(errno)); -+ return false; -+ } -+ return true; -+} -+ -+static void -+stop_virtblk(struct mic_info *mic) -+{ -+ int vr_size, ret; -+ -+ vr_size = PAGE_ALIGN(_vring_size(MIC_VRING_ENTRIES, -+ MIC_VIRTIO_RING_ALIGN) + -+ sizeof(struct _mic_vring_info)); -+ ret = munmap(mic->mic_virtblk.block_dp, -+ MIC_DEVICE_PAGE_END + vr_size * virtblk_dev_page.dd.num_vq); -+ if (ret < 0) -+ mpsslog("%s munmap errno %d\n", mic->name, errno); -+ close(mic->mic_virtblk.virtio_block_fd); -+} -+ -+static __u8 -+header_error_check(struct vring_desc *desc) -+{ -+ if (le32toh(desc->len) != sizeof(struct virtio_blk_outhdr)) { -+ mpsslog("%s() %d: length is not sizeof(virtio_blk_outhd)\n", -+ __func__, __LINE__); -+ return -EIO; -+ } -+ if (!(le16toh(desc->flags) & VRING_DESC_F_NEXT)) { -+ mpsslog("%s() %d: alone\n", -+ __func__, __LINE__); -+ return -EIO; -+ } -+ if (le16toh(desc->flags) & VRING_DESC_F_WRITE) { -+ mpsslog("%s() %d: not read\n", -+ __func__, __LINE__); -+ return -EIO; -+ } -+ return 0; -+} -+ -+static int -+read_header(int fd, struct virtio_blk_outhdr *hdr, __u32 desc_idx) -+{ -+ struct iovec iovec; -+ struct mic_copy_desc copy; -+ -+ iovec.iov_len = sizeof(*hdr); -+ iovec.iov_base = hdr; -+ copy.iov = &iovec; -+ copy.iovcnt = 1; -+ copy.vr_idx = 0; /* only one vring on virtio_block */ -+ copy.update_used = false; /* do not update used index */ -+ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); -+} -+ -+static int -+transfer_blocks(int fd, struct iovec *iovec, __u32 iovcnt) -+{ -+ struct mic_copy_desc copy; -+ -+ copy.iov = iovec; -+ copy.iovcnt = iovcnt; -+ copy.vr_idx = 0; /* only one vring on virtio_block */ -+ copy.update_used = false; /* do not update used index */ -+ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); -+} -+ -+static __u8 -+status_error_check(struct vring_desc *desc) -+{ -+ if (le32toh(desc->len) != sizeof(__u8)) { -+ mpsslog("%s() %d: length is not sizeof(status)\n", -+ __func__, __LINE__); -+ return -EIO; -+ } -+ return 0; -+} -+ -+static int -+write_status(int fd, __u8 *status) -+{ -+ struct iovec iovec; -+ struct mic_copy_desc copy; -+ -+ iovec.iov_base = status; -+ iovec.iov_len = sizeof(*status); -+ copy.iov = &iovec; -+ copy.iovcnt = 1; -+ copy.vr_idx = 0; /* only one vring on virtio_block */ -+ copy.update_used = true; /* Update used index */ -+ return ioctl(fd, MIC_VIRTIO_COPY_DESC, ©); -+} -+ -+#ifndef VIRTIO_BLK_T_GET_ID -+#define VIRTIO_BLK_T_GET_ID 8 -+#endif -+ -+static void * -+virtio_block(void *arg) -+{ -+ struct mic_info *mic = (struct mic_info *)arg; -+ int ret; -+ struct pollfd block_poll; -+ struct mic_vring vring; -+ __u16 avail_idx; -+ __u32 desc_idx; -+ struct vring_desc *desc; -+ struct iovec *iovec, *piov; -+ __u8 status; -+ __u32 buffer_desc_idx; -+ struct virtio_blk_outhdr hdr; -+ void *fos; -+ -+ for (;;) { /* forever */ -+ if (!open_backend(mic)) { /* No virtblk */ -+ for (mic->mic_virtblk.signaled = 0; -+ !mic->mic_virtblk.signaled;) -+ sleep(1); -+ continue; -+ } -+ -+ /* backend file is specified. */ -+ if (!start_virtblk(mic, &vring)) -+ goto _close_backend; -+ iovec = malloc(sizeof(*iovec) * -+ le32toh(virtblk_dev_page.blk_config.seg_max)); -+ if (!iovec) { -+ mpsslog("%s: can't alloc iovec: %s\n", -+ mic->name, strerror(ENOMEM)); -+ goto _stop_virtblk; -+ } -+ -+ block_poll.fd = mic->mic_virtblk.virtio_block_fd; -+ block_poll.events = POLLIN; -+ for (mic->mic_virtblk.signaled = 0; -+ !mic->mic_virtblk.signaled;) { -+ block_poll.revents = 0; -+ /* timeout in 1 sec to see signaled */ -+ ret = poll(&block_poll, 1, 1000); -+ if (ret < 0) { -+ mpsslog("%s %d: poll failed: %s\n", -+ __func__, __LINE__, -+ strerror(errno)); -+ continue; -+ } -+ -+ if (!(block_poll.revents & POLLIN)) { -+#ifdef DEBUG -+ mpsslog("%s %d: block_poll.revents=0x%x\n", -+ __func__, __LINE__, block_poll.revents); -+#endif -+ continue; -+ } -+ -+ /* POLLIN */ -+ while (vring.info->avail_idx != -+ le16toh(vring.vr.avail->idx)) { -+ /* read header element */ -+ avail_idx = -+ vring.info->avail_idx & -+ (vring.vr.num - 1); -+ desc_idx = le16toh( -+ vring.vr.avail->ring[avail_idx]); -+ desc = &vring.vr.desc[desc_idx]; -+#ifdef DEBUG -+ mpsslog("%s() %d: avail_idx=%d ", -+ __func__, __LINE__, -+ vring.info->avail_idx); -+ mpsslog("vring.vr.num=%d desc=%p\n", -+ vring.vr.num, desc); -+#endif -+ status = header_error_check(desc); -+ ret = read_header( -+ mic->mic_virtblk.virtio_block_fd, -+ &hdr, desc_idx); -+ if (ret < 0) { -+ mpsslog("%s() %d %s: ret=%d %s\n", -+ __func__, __LINE__, -+ mic->name, ret, -+ strerror(errno)); -+ break; -+ } -+ /* buffer element */ -+ piov = iovec; -+ status = 0; -+ fos = mic->mic_virtblk.backend_addr + -+ (hdr.sector * SECTOR_SIZE); -+ buffer_desc_idx = next_desc(desc); -+ desc_idx = buffer_desc_idx; -+ for (desc = &vring.vr.desc[buffer_desc_idx]; -+ desc->flags & VRING_DESC_F_NEXT; -+ desc_idx = next_desc(desc), -+ desc = &vring.vr.desc[desc_idx]) { -+ piov->iov_len = desc->len; -+ piov->iov_base = fos; -+ piov++; -+ fos += desc->len; -+ } -+ /* Returning NULLs for VIRTIO_BLK_T_GET_ID. */ -+ if (hdr.type & ~(VIRTIO_BLK_T_OUT | -+ VIRTIO_BLK_T_GET_ID)) { -+ /* -+ VIRTIO_BLK_T_IN - does not do -+ anything. Probably for documenting. -+ VIRTIO_BLK_T_SCSI_CMD - for -+ virtio_scsi. -+ VIRTIO_BLK_T_FLUSH - turned off in -+ config space. -+ VIRTIO_BLK_T_BARRIER - defined but not -+ used in anywhere. -+ */ -+ mpsslog("%s() %d: type %x ", -+ __func__, __LINE__, -+ hdr.type); -+ mpsslog("is not supported\n"); -+ status = -ENOTSUP; -+ -+ } else { -+ ret = transfer_blocks( -+ mic->mic_virtblk.virtio_block_fd, -+ iovec, -+ piov - iovec); -+ if (ret < 0 && -+ status != 0) -+ status = ret; -+ } -+ /* write status and update used pointer */ -+ if (status != 0) -+ status = status_error_check(desc); -+ ret = write_status( -+ mic->mic_virtblk.virtio_block_fd, -+ &status); -+#ifdef DEBUG -+ mpsslog("%s() %d: write status=%d on desc=%p\n", -+ __func__, __LINE__, -+ status, desc); -+#endif -+ } -+ } -+ free(iovec); -+_stop_virtblk: -+ stop_virtblk(mic); -+_close_backend: -+ close_backend(mic); -+ } /* forever */ -+ -+ pthread_exit(NULL); -+} -+ -+static void -+reset(struct mic_info *mic) -+{ -+#define RESET_TIMEOUT 120 -+ int i = RESET_TIMEOUT; -+ setsysfs(mic->name, "state", "reset"); -+ while (i) { -+ char *state; -+ state = readsysfs(mic->name, "state"); -+ if (!state) -+ goto retry; -+ mpsslog("%s: %s %d state %s\n", -+ mic->name, __func__, __LINE__, state); -+ -+ if (!strcmp(state, "ready")) { -+ free(state); -+ break; -+ } -+ free(state); -+retry: -+ sleep(1); -+ i--; -+ } -+} -+ -+static int -+get_mic_shutdown_status(struct mic_info *mic, char *shutdown_status) -+{ -+ if (!strcmp(shutdown_status, "nop")) -+ return MIC_NOP; -+ if (!strcmp(shutdown_status, "crashed")) -+ return MIC_CRASHED; -+ if (!strcmp(shutdown_status, "halted")) -+ return MIC_HALTED; -+ if (!strcmp(shutdown_status, "poweroff")) -+ return MIC_POWER_OFF; -+ if (!strcmp(shutdown_status, "restart")) -+ return MIC_RESTART; -+ mpsslog("%s: BUG invalid status %s\n", mic->name, shutdown_status); -+ /* Invalid state */ -+ assert(0); -+}; -+ -+static int get_mic_state(struct mic_info *mic) -+{ -+ char *state = NULL; -+ enum mic_states mic_state; -+ -+ while (!state) { -+ state = readsysfs(mic->name, "state"); -+ sleep(1); -+ } -+ mpsslog("%s: %s %d state %s\n", -+ mic->name, __func__, __LINE__, state); -+ -+ if (!strcmp(state, "ready")) { -+ mic_state = MIC_READY; -+ } else if (!strcmp(state, "booting")) { -+ mic_state = MIC_BOOTING; -+ } else if (!strcmp(state, "online")) { -+ mic_state = MIC_ONLINE; -+ } else if (!strcmp(state, "shutting_down")) { -+ mic_state = MIC_SHUTTING_DOWN; -+ } else if (!strcmp(state, "reset_failed")) { -+ mic_state = MIC_RESET_FAILED; -+ } else if (!strcmp(state, "resetting")) { -+ mic_state = MIC_RESETTING; -+ } else { -+ mpsslog("%s: BUG invalid state %s\n", mic->name, state); -+ assert(0); -+ } -+ -+ free(state); -+ return mic_state; -+}; -+ -+static void mic_handle_shutdown(struct mic_info *mic) -+{ -+#define SHUTDOWN_TIMEOUT 60 -+ int i = SHUTDOWN_TIMEOUT; -+ char *shutdown_status; -+ while (i) { -+ shutdown_status = readsysfs(mic->name, "shutdown_status"); -+ if (!shutdown_status) { -+ sleep(1); -+ continue; -+ } -+ mpsslog("%s: %s %d shutdown_status %s\n", -+ mic->name, __func__, __LINE__, shutdown_status); -+ switch (get_mic_shutdown_status(mic, shutdown_status)) { -+ case MIC_RESTART: -+ mic->restart = 1; -+ case MIC_HALTED: -+ case MIC_POWER_OFF: -+ case MIC_CRASHED: -+ free(shutdown_status); -+ goto reset; -+ default: -+ break; -+ } -+ free(shutdown_status); -+ sleep(1); -+ i--; -+ } -+reset: -+ if (!i) -+ mpsslog("%s: %s %d timing out waiting for shutdown_status %s\n", -+ mic->name, __func__, __LINE__, shutdown_status); -+ reset(mic); -+} -+ -+static int open_state_fd(struct mic_info *mic) -+{ -+ char pathname[PATH_MAX]; -+ int fd; -+ -+ snprintf(pathname, PATH_MAX - 1, "%s/%s/%s", -+ MICSYSFSDIR, mic->name, "state"); -+ -+ fd = open(pathname, O_RDONLY); -+ if (fd < 0) -+ mpsslog("%s: opening file %s failed %s\n", -+ mic->name, pathname, strerror(errno)); -+ return fd; -+} -+ -+static int block_till_state_change(int fd, struct mic_info *mic) -+{ -+ struct pollfd ufds[1]; -+ char value[PAGE_SIZE]; -+ int ret; -+ -+ ufds[0].fd = fd; -+ ufds[0].events = POLLERR | POLLPRI; -+ ret = poll(ufds, 1, -1); -+ if (ret < 0) { -+ mpsslog("%s: %s %d poll failed %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ return ret; -+ } -+ -+ ret = lseek(fd, 0, SEEK_SET); -+ if (ret < 0) { -+ mpsslog("%s: %s %d Failed to seek to 0: %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ return ret; -+ } -+ -+ ret = read(fd, value, sizeof(value)); -+ if (ret < 0) { -+ mpsslog("%s: %s %d Failed to read sysfs entry: %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ return ret; -+ } -+ -+ return 0; -+} -+ -+static void * -+mic_config(void *arg) -+{ -+ struct mic_info *mic = (struct mic_info *)arg; -+ int fd, ret, stat = 0; -+ -+ fd = open_state_fd(mic); -+ if (fd < 0) { -+ mpsslog("%s: %s %d open state fd failed %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ goto exit; -+ } -+ -+ do { -+ ret = block_till_state_change(fd, mic); -+ if (ret < 0) { -+ mpsslog("%s: %s %d block_till_state_change error %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ goto close_exit; -+ } -+ -+ switch (get_mic_state(mic)) { -+ case MIC_SHUTTING_DOWN: -+ mic_handle_shutdown(mic); -+ break; -+ case MIC_READY: -+ case MIC_RESET_FAILED: -+ ret = kill(mic->pid, SIGTERM); -+ mpsslog("%s: %s %d kill pid %d ret %d\n", -+ mic->name, __func__, __LINE__, -+ mic->pid, ret); -+ if (!ret) { -+ ret = waitpid(mic->pid, &stat, -+ WIFSIGNALED(stat)); -+ mpsslog("%s: %s %d waitpid ret %d pid %d\n", -+ mic->name, __func__, __LINE__, -+ ret, mic->pid); -+ } -+ if (mic->boot_on_resume) { -+ setsysfs(mic->name, "state", "boot"); -+ mic->boot_on_resume = 0; -+ } -+ goto close_exit; -+ default: -+ break; -+ } -+ } while (1); -+ -+close_exit: -+ close(fd); -+exit: -+ init_mic(mic); -+ pthread_exit(NULL); -+} -+ -+static void -+set_cmdline(struct mic_info *mic) -+{ -+ char buffer[PATH_MAX]; -+ int len; -+ -+ len = snprintf(buffer, PATH_MAX, -+ "clocksource=tsc highres=off nohz=off "); -+ len += snprintf(buffer + len, PATH_MAX - len, -+ "cpufreq_on;corec6_off;pc3_off;pc6_off "); -+ len += snprintf(buffer + len, PATH_MAX - len, -+ "ifcfg=static;address,172.31.%d.1;netmask,255.255.255.0", -+ mic->id + 1); -+ -+ setsysfs(mic->name, "cmdline", buffer); -+ mpsslog("%s: Command line: \"%s\"\n", mic->name, buffer); -+ snprintf(buffer, PATH_MAX, "172.31.%d.1", mic->id + 1); -+ mpsslog("%s: IPADDR: \"%s\"\n", mic->name, buffer); -+} -+ -+static void -+set_log_buf_info(struct mic_info *mic) -+{ -+ int fd; -+ off_t len; -+ char system_map[] = "/lib/firmware/mic/System.map"; -+ char *map, *temp, log_buf[17] = {'\0'}; -+ -+ fd = open(system_map, O_RDONLY); -+ if (fd < 0) { -+ mpsslog("%s: Opening System.map failed: %d\n", -+ mic->name, errno); -+ return; -+ } -+ len = lseek(fd, 0, SEEK_END); -+ if (len < 0) { -+ mpsslog("%s: Reading System.map size failed: %d\n", -+ mic->name, errno); -+ close(fd); -+ return; -+ } -+ map = mmap(NULL, len, PROT_READ, MAP_PRIVATE, fd, 0); -+ if (map == MAP_FAILED) { -+ mpsslog("%s: mmap of System.map failed: %d\n", -+ mic->name, errno); -+ close(fd); -+ return; -+ } -+ temp = strstr(map, "__log_buf"); -+ if (!temp) { -+ mpsslog("%s: __log_buf not found: %d\n", mic->name, errno); -+ munmap(map, len); -+ close(fd); -+ return; -+ } -+ strncpy(log_buf, temp - 19, 16); -+ setsysfs(mic->name, "log_buf_addr", log_buf); -+ mpsslog("%s: log_buf_addr: %s\n", mic->name, log_buf); -+ temp = strstr(map, "log_buf_len"); -+ if (!temp) { -+ mpsslog("%s: log_buf_len not found: %d\n", mic->name, errno); -+ munmap(map, len); -+ close(fd); -+ return; -+ } -+ strncpy(log_buf, temp - 19, 16); -+ setsysfs(mic->name, "log_buf_len", log_buf); -+ mpsslog("%s: log_buf_len: %s\n", mic->name, log_buf); -+ munmap(map, len); -+ close(fd); -+} -+ -+static void -+change_virtblk_backend(int x, siginfo_t *siginfo, void *p) -+{ -+ struct mic_info *mic; -+ -+ for (mic = mic_list.next; mic != NULL; mic = mic->next) -+ mic->mic_virtblk.signaled = 1/* true */; -+} -+ -+static void -+set_mic_boot_params(struct mic_info *mic) -+{ -+ set_log_buf_info(mic); -+ set_cmdline(mic); -+} -+ -+static void * -+init_mic(void *arg) -+{ -+ struct mic_info *mic = (struct mic_info *)arg; -+ struct sigaction ignore = { -+ .sa_flags = 0, -+ .sa_handler = SIG_IGN -+ }; -+ struct sigaction act = { -+ .sa_flags = SA_SIGINFO, -+ .sa_sigaction = change_virtblk_backend, -+ }; -+ char buffer[PATH_MAX]; -+ int err, fd; -+ -+ /* -+ * Currently, one virtio block device is supported for each MIC card -+ * at a time. Any user (or test) can send a SIGUSR1 to the MIC daemon. -+ * The signal informs the virtio block backend about a change in the -+ * configuration file which specifies the virtio backend file name on -+ * the host. Virtio block backend then re-reads the configuration file -+ * and switches to the new block device. This signalling mechanism may -+ * not be required once multiple virtio block devices are supported by -+ * the MIC daemon. -+ */ -+ sigaction(SIGUSR1, &ignore, NULL); -+retry: -+ fd = open_state_fd(mic); -+ if (fd < 0) { -+ mpsslog("%s: %s %d open state fd failed %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ sleep(2); -+ goto retry; -+ } -+ -+ if (mic->restart) { -+ snprintf(buffer, PATH_MAX, "boot"); -+ setsysfs(mic->name, "state", buffer); -+ mpsslog("%s restarting mic %d\n", -+ mic->name, mic->restart); -+ mic->restart = 0; -+ } -+ -+ while (1) { -+ while (block_till_state_change(fd, mic)) { -+ mpsslog("%s: %s %d block_till_state_change error %s\n", -+ mic->name, __func__, __LINE__, strerror(errno)); -+ sleep(2); -+ continue; -+ } -+ -+ if (get_mic_state(mic) == MIC_BOOTING) -+ break; -+ } -+ -+ mic->pid = fork(); -+ switch (mic->pid) { -+ case 0: -+ add_virtio_device(mic, &virtcons_dev_page.dd); -+ add_virtio_device(mic, &virtnet_dev_page.dd); -+ err = pthread_create(&mic->mic_console.console_thread, NULL, -+ virtio_console, mic); -+ if (err) -+ mpsslog("%s virtcons pthread_create failed %s\n", -+ mic->name, strerror(err)); -+ err = pthread_create(&mic->mic_net.net_thread, NULL, -+ virtio_net, mic); -+ if (err) -+ mpsslog("%s virtnet pthread_create failed %s\n", -+ mic->name, strerror(err)); -+ err = pthread_create(&mic->mic_virtblk.block_thread, NULL, -+ virtio_block, mic); -+ if (err) -+ mpsslog("%s virtblk pthread_create failed %s\n", -+ mic->name, strerror(err)); -+ sigemptyset(&act.sa_mask); -+ err = sigaction(SIGUSR1, &act, NULL); -+ if (err) -+ mpsslog("%s sigaction SIGUSR1 failed %s\n", -+ mic->name, strerror(errno)); -+ while (1) -+ sleep(60); -+ case -1: -+ mpsslog("fork failed MIC name %s id %d errno %d\n", -+ mic->name, mic->id, errno); -+ break; -+ default: -+ err = pthread_create(&mic->config_thread, NULL, -+ mic_config, mic); -+ if (err) -+ mpsslog("%s mic_config pthread_create failed %s\n", -+ mic->name, strerror(err)); -+ } -+ -+ return NULL; -+} -+ -+static void -+start_daemon(void) -+{ -+ struct mic_info *mic; -+ int err; -+ -+ for (mic = mic_list.next; mic; mic = mic->next) { -+ set_mic_boot_params(mic); -+ err = pthread_create(&mic->init_thread, NULL, init_mic, mic); -+ if (err) -+ mpsslog("%s init_mic pthread_create failed %s\n", -+ mic->name, strerror(err)); -+ } -+ -+ while (1) -+ sleep(60); -+} -+ -+static int -+init_mic_list(void) -+{ -+ struct mic_info *mic = &mic_list; -+ struct dirent *file; -+ DIR *dp; -+ int cnt = 0; -+ -+ dp = opendir(MICSYSFSDIR); -+ if (!dp) -+ return 0; -+ -+ while ((file = readdir(dp)) != NULL) { -+ if (!strncmp(file->d_name, "mic", 3)) { -+ mic->next = calloc(1, sizeof(struct mic_info)); -+ if (mic->next) { -+ mic = mic->next; -+ mic->id = atoi(&file->d_name[3]); -+ mic->name = malloc(strlen(file->d_name) + 16); -+ if (mic->name) -+ strcpy(mic->name, file->d_name); -+ mpsslog("MIC name %s id %d\n", mic->name, -+ mic->id); -+ cnt++; -+ } -+ } -+ } -+ -+ closedir(dp); -+ return cnt; -+} -+ -+void -+mpsslog(char *format, ...) -+{ -+ va_list args; -+ char buffer[4096]; -+ char ts[52], *ts1; -+ time_t t; -+ -+ if (logfp == NULL) -+ return; -+ -+ va_start(args, format); -+ vsprintf(buffer, format, args); -+ va_end(args); -+ -+ time(&t); -+ ts1 = ctime_r(&t, ts); -+ ts1[strlen(ts1) - 1] = '\0'; -+ fprintf(logfp, "%s: %s", ts1, buffer); -+ -+ fflush(logfp); -+} -+ -+int -+main(int argc, char *argv[]) -+{ -+ int cnt; -+ pid_t pid; -+ -+ myname = argv[0]; -+ -+ logfp = fopen(LOGFILE_NAME, "a+"); -+ if (!logfp) { -+ fprintf(stderr, "cannot open logfile '%s'\n", LOGFILE_NAME); -+ exit(1); -+ } -+ pid = fork(); -+ switch (pid) { -+ case 0: -+ break; -+ case -1: -+ exit(2); -+ default: -+ exit(0); -+ } -+ -+ mpsslog("MIC Daemon start\n"); -+ -+ cnt = init_mic_list(); -+ if (cnt == 0) { -+ mpsslog("MIC module not loaded\n"); -+ exit(3); -+ } -+ mpsslog("MIC found %d devices\n", cnt); -+ -+ start_daemon(); -+ -+ exit(0); -+} -diff --git a/samples/mic/mpssd/mpssd.h b/samples/mic/mpssd/mpssd.h -new file mode 100644 -index 000000000000..8bd64944aacc ---- /dev/null -+++ b/samples/mic/mpssd/mpssd.h -@@ -0,0 +1,103 @@ -+/* -+ * Intel MIC Platform Software Stack (MPSS) -+ * -+ * Copyright(c) 2013 Intel Corporation. -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License, version 2, as -+ * published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * The full GNU General Public License is included in this distribution in -+ * the file called "COPYING". -+ * -+ * Intel MIC User Space Tools. -+ */ -+#ifndef _MPSSD_H_ -+#define _MPSSD_H_ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#define MICSYSFSDIR "/sys/class/mic" -+#define LOGFILE_NAME "/var/log/mpssd" -+#define PAGE_SIZE 4096 -+ -+struct mic_console_info { -+ pthread_t console_thread; -+ int virtio_console_fd; -+ void *console_dp; -+}; -+ -+struct mic_net_info { -+ pthread_t net_thread; -+ int virtio_net_fd; -+ int tap_fd; -+ void *net_dp; -+}; -+ -+struct mic_virtblk_info { -+ pthread_t block_thread; -+ int virtio_block_fd; -+ void *block_dp; -+ volatile sig_atomic_t signaled; -+ char *backend_file; -+ int backend; -+ void *backend_addr; -+ long backend_size; -+}; -+ -+struct mic_info { -+ int id; -+ char *name; -+ pthread_t config_thread; -+ pthread_t init_thread; -+ pid_t pid; -+ struct mic_console_info mic_console; -+ struct mic_net_info mic_net; -+ struct mic_virtblk_info mic_virtblk; -+ int restart; -+ int boot_on_resume; -+ struct mic_info *next; -+}; -+ -+__attribute__((format(printf, 1, 2))) -+void mpsslog(char *format, ...); -+char *readsysfs(char *dir, char *entry); -+int setsysfs(char *dir, char *entry, char *value); -+#endif -diff --git a/samples/mic/mpssd/sysfs.c b/samples/mic/mpssd/sysfs.c -new file mode 100644 -index 000000000000..8dd326936083 ---- /dev/null -+++ b/samples/mic/mpssd/sysfs.c -@@ -0,0 +1,102 @@ -+/* -+ * Intel MIC Platform Software Stack (MPSS) -+ * -+ * Copyright(c) 2013 Intel Corporation. -+ * -+ * This program is free software; you can redistribute it and/or modify -+ * it under the terms of the GNU General Public License, version 2, as -+ * published by the Free Software Foundation. -+ * -+ * This program is distributed in the hope that it will be useful, but -+ * WITHOUT ANY WARRANTY; without even the implied warranty of -+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU -+ * General Public License for more details. -+ * -+ * The full GNU General Public License is included in this distribution in -+ * the file called "COPYING". -+ * -+ * Intel MIC User Space Tools. -+ */ -+ -+#include "mpssd.h" -+ -+#define PAGE_SIZE 4096 -+ -+char * -+readsysfs(char *dir, char *entry) -+{ -+ char filename[PATH_MAX]; -+ char value[PAGE_SIZE]; -+ char *string = NULL; -+ int fd; -+ int len; -+ -+ if (dir == NULL) -+ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); -+ else -+ snprintf(filename, PATH_MAX, -+ "%s/%s/%s", MICSYSFSDIR, dir, entry); -+ -+ fd = open(filename, O_RDONLY); -+ if (fd < 0) { -+ mpsslog("Failed to open sysfs entry '%s': %s\n", -+ filename, strerror(errno)); -+ return NULL; -+ } -+ -+ len = read(fd, value, sizeof(value)); -+ if (len < 0) { -+ mpsslog("Failed to read sysfs entry '%s': %s\n", -+ filename, strerror(errno)); -+ goto readsys_ret; -+ } -+ if (len == 0) -+ goto readsys_ret; -+ -+ value[len - 1] = '\0'; -+ -+ string = malloc(strlen(value) + 1); -+ if (string) -+ strcpy(string, value); -+ -+readsys_ret: -+ close(fd); -+ return string; -+} -+ -+int -+setsysfs(char *dir, char *entry, char *value) -+{ -+ char filename[PATH_MAX]; -+ char *oldvalue; -+ int fd, ret = 0; -+ -+ if (dir == NULL) -+ snprintf(filename, PATH_MAX, "%s/%s", MICSYSFSDIR, entry); -+ else -+ snprintf(filename, PATH_MAX, "%s/%s/%s", -+ MICSYSFSDIR, dir, entry); -+ -+ oldvalue = readsysfs(dir, entry); -+ -+ fd = open(filename, O_RDWR); -+ if (fd < 0) { -+ ret = errno; -+ mpsslog("Failed to open sysfs entry '%s': %s\n", -+ filename, strerror(errno)); -+ goto done; -+ } -+ -+ if (!oldvalue || strcmp(value, oldvalue)) { -+ if (write(fd, value, strlen(value)) < 0) { -+ ret = errno; -+ mpsslog("Failed to write new sysfs entry '%s': %s\n", -+ filename, strerror(errno)); -+ } -+ } -+ close(fd); -+done: -+ if (oldvalue) -+ free(oldvalue); -+ return ret; -+} -diff --git a/samples/seccomp/bpf-helper.h b/samples/seccomp/bpf-helper.h -index 38ee70f3cd5b..1d8de9edd858 100644 ---- a/samples/seccomp/bpf-helper.h -+++ b/samples/seccomp/bpf-helper.h -@@ -138,7 +138,7 @@ union arg64 { - #define ARG_32(idx) \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)) - --/* Loads hi into A and lo in X */ -+/* Loads lo into M[0] and hi into M[1] and A */ - #define ARG_64(idx) \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, LO_ARG(idx)), \ - BPF_STMT(BPF_ST, 0), /* lo -> M[0] */ \ -@@ -153,88 +153,107 @@ union arg64 { - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (value), 1, 0), \ - jt - --/* Checks the lo, then swaps to check the hi. A=lo,X=hi */ -+#define JA32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JGE32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JGT32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ -+ jt -+ -+#define JLE32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ -+ jt -+ -+#define JLT32(value, jt) \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ -+ jt -+ -+/* -+ * All the JXX64 checks assume lo is saved in M[0] and hi is saved in both -+ * A and M[1]. This invariant is kept by restoring A if necessary. -+ */ - #define JEQ64(lo, hi, jt) \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ - BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (lo != arg.lo) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JNE64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 5, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (hi != arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo != arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -- --#define JA32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (value), 0, 1), \ -- jt -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JA64(lo, hi, jt) \ -+ /* if (hi & arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (hi), 3, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo & arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JSET+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - --#define JGE32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 0, 1), \ -- jt -- --#define JLT32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (value), 1, 0), \ -- jt -- --/* Shortcut checking if hi > arg.hi. */ - #define JGE64(lo, hi, jt) \ -+ /* if (hi > arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo >= arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -- jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -- --#define JLT64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - --#define JGT32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 0, 1), \ -- jt -- --#define JLE32(value, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (value), 1, 0), \ -- jt -- --/* Check hi > args.hi first, then do the GE checking */ - #define JGT64(lo, hi, jt) \ -+ /* if (hi > arg.hi) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 4, 0), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo > arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 0, 2), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define JLE64(lo, hi, jt) \ -- BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (hi), 6, 0), \ -- BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 3), \ -- BPF_STMT(BPF_LD+BPF_MEM, 0), /* swap in lo */ \ -+ /* if (hi < arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo <= arg.lo) goto MATCH; */ \ - BPF_JUMP(BPF_JMP+BPF_JGT+BPF_K, (lo), 2, 0), \ -- BPF_STMT(BPF_LD+BPF_MEM, 1), /* passed: swap hi back in */ \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ -+ jt, \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) -+ -+#define JLT64(lo, hi, jt) \ -+ /* if (hi < arg.hi) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (hi), 0, 4), \ -+ /* if (hi != arg.hi) goto NOMATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, (hi), 0, 5), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 0), \ -+ /* if (lo < arg.lo) goto MATCH; */ \ -+ BPF_JUMP(BPF_JMP+BPF_JGE+BPF_K, (lo), 2, 0), \ -+ BPF_STMT(BPF_LD+BPF_MEM, 1), \ - jt, \ -- BPF_STMT(BPF_LD+BPF_MEM, 1) /* failed: swap hi back in */ -+ BPF_STMT(BPF_LD+BPF_MEM, 1) - - #define LOAD_SYSCALL_NR \ - BPF_STMT(BPF_LD+BPF_W+BPF_ABS, \ -diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c -index 1d5acbe0c08b..86240d02b530 100644 ---- a/sound/core/seq/seq_fifo.c -+++ b/sound/core/seq/seq_fifo.c -@@ -135,6 +135,7 @@ int snd_seq_fifo_event_in(struct snd_seq_fifo *f, - f->tail = cell; - if (f->head == NULL) - f->head = cell; -+ cell->next = NULL; - f->cells++; - spin_unlock_irqrestore(&f->lock, flags); - -@@ -214,6 +215,8 @@ void snd_seq_fifo_cell_putback(struct snd_seq_fifo *f, - spin_lock_irqsave(&f->lock, flags); - cell->next = f->head; - f->head = cell; -+ if (!f->tail) -+ f->tail = cell; - f->cells++; - spin_unlock_irqrestore(&f->lock, flags); - } -diff --git a/sound/core/timer.c b/sound/core/timer.c -index ae4ea2e2e7fe..278a332f97bd 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -1700,9 +1700,21 @@ static int snd_timer_user_params(struct file *file, - return -EBADFD; - if (copy_from_user(¶ms, _params, sizeof(params))) - return -EFAULT; -- if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE) && params.ticks < 1) { -- err = -EINVAL; -- goto _end; -+ if (!(t->hw.flags & SNDRV_TIMER_HW_SLAVE)) { -+ u64 resolution; -+ -+ if (params.ticks < 1) { -+ err = -EINVAL; -+ goto _end; -+ } -+ -+ /* Don't allow resolution less than 1ms */ -+ resolution = snd_timer_resolution(tu->timeri); -+ resolution *= params.ticks; -+ if (resolution < 1000000) { -+ err = -EINVAL; -+ goto _end; -+ } - } - if (params.queue_size > 0 && - (params.queue_size < 32 || params.queue_size > 1024)) { -diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c -index 9667cbfb0ca2..ab4cdab5cfa5 100644 ---- a/sound/pci/ctxfi/cthw20k1.c -+++ b/sound/pci/ctxfi/cthw20k1.c -@@ -27,12 +27,6 @@ - #include "cthw20k1.h" - #include "ct20k1reg.h" - --#if BITS_PER_LONG == 32 --#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ --#else --#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ --#endif -- - struct hw20k1 { - struct hw hw; - spinlock_t reg_20k1_lock; -@@ -1904,19 +1898,18 @@ static int hw_card_start(struct hw *hw) - { - int err; - struct pci_dev *pci = hw->pci; -+ const unsigned int dma_bits = BITS_PER_LONG; - - err = pci_enable_device(pci); - if (err < 0) - return err; - - /* Set DMA transfer mask */ -- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || -- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { -- dev_err(hw->card->dev, -- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", -- CT_XFI_DMA_MASK); -- err = -ENXIO; -- goto error1; -+ if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); -+ } else { -+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); - } - - if (!hw->io_base) { -diff --git a/sound/pci/ctxfi/cthw20k2.c b/sound/pci/ctxfi/cthw20k2.c -index 9dc2950e1ab7..d86678c2a957 100644 ---- a/sound/pci/ctxfi/cthw20k2.c -+++ b/sound/pci/ctxfi/cthw20k2.c -@@ -26,12 +26,6 @@ - #include "cthw20k2.h" - #include "ct20k2reg.h" - --#if BITS_PER_LONG == 32 --#define CT_XFI_DMA_MASK DMA_BIT_MASK(32) /* 32 bit PTE */ --#else --#define CT_XFI_DMA_MASK DMA_BIT_MASK(64) /* 64 bit PTE */ --#endif -- - struct hw20k2 { - struct hw hw; - /* for i2c */ -@@ -2029,19 +2023,18 @@ static int hw_card_start(struct hw *hw) - int err = 0; - struct pci_dev *pci = hw->pci; - unsigned int gctl; -+ const unsigned int dma_bits = BITS_PER_LONG; - - err = pci_enable_device(pci); - if (err < 0) - return err; - - /* Set DMA transfer mask */ -- if (dma_set_mask(&pci->dev, CT_XFI_DMA_MASK) < 0 || -- dma_set_coherent_mask(&pci->dev, CT_XFI_DMA_MASK) < 0) { -- dev_err(hw->card->dev, -- "architecture does not support PCI busmaster DMA with mask 0x%llx\n", -- CT_XFI_DMA_MASK); -- err = -ENXIO; -- goto error1; -+ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); -+ } else { -+ dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); -+ dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(32)); - } - - if (!hw->io_base) { -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index ad4a1e9a3ae1..8f3e5e9d8bdb 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2208,9 +2208,9 @@ static const struct pci_device_id azx_ids[] = { - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, - /* Lewisburg */ - { PCI_DEVICE(0x8086, 0xa1f0), -- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, - { PCI_DEVICE(0x8086, 0xa270), -- .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -+ .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_SKYLAKE }, - /* Lynx Point-LP */ - { PCI_DEVICE(0x8086, 0x9c20), - .driver_data = AZX_DRIVER_PCH | AZX_DCAPS_INTEL_PCH }, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 00c50d58f108..cf0785ddbd14 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5560,6 +5560,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE), - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), -+ SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), - SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), -@@ -5674,6 +5675,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460), - SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), -+ SND_PCI_QUIRK(0x17aa, 0x3112, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY), - SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI), - SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC), - SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP), -@@ -6047,6 +6049,12 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC298_STANDARD_PINS, - {0x17, 0x90170150}), -+ SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_SPK_VOLUME, -+ {0x12, 0xb7a60140}, -+ {0x13, 0xb7a60150}, -+ {0x17, 0x90170110}, -+ {0x1a, 0x03011020}, -+ {0x21, 0x03211030}), - {} - }; - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.53-54.patch b/patch/kernel/mvebu64-default/03-patch-4.4.53-54.patch deleted file mode 100644 index 471f5a81a90c..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.53-54.patch +++ /dev/null @@ -1,1611 +0,0 @@ -diff --git a/Makefile b/Makefile -index 10aec937e9e4..7f54ac081cf3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 53 -+SUBLEVEL = 54 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/s390/include/asm/processor.h b/arch/s390/include/asm/processor.h -index c1ea67db8404..c61ed7890cef 100644 ---- a/arch/s390/include/asm/processor.h -+++ b/arch/s390/include/asm/processor.h -@@ -74,7 +74,8 @@ extern void execve_tail(void); - * User space process size: 2GB for 31 bit, 4TB or 8PT for 64 bit. - */ - --#define TASK_SIZE_OF(tsk) ((tsk)->mm->context.asce_limit) -+#define TASK_SIZE_OF(tsk) ((tsk)->mm ? \ -+ (tsk)->mm->context.asce_limit : TASK_MAX_SIZE) - #define TASK_UNMAPPED_BASE (test_thread_flag(TIF_31BIT) ? \ - (1UL << 30) : (1UL << 41)) - #define TASK_SIZE TASK_SIZE_OF(current) -diff --git a/arch/s390/kernel/setup.c b/arch/s390/kernel/setup.c -index 1f581eb61bc2..d097d71685df 100644 ---- a/arch/s390/kernel/setup.c -+++ b/arch/s390/kernel/setup.c -@@ -805,10 +805,10 @@ static void __init setup_randomness(void) - { - struct sysinfo_3_2_2 *vmms; - -- vmms = (struct sysinfo_3_2_2 *) alloc_page(GFP_KERNEL); -- if (vmms && stsi(vmms, 3, 2, 2) == 0 && vmms->count) -- add_device_randomness(&vmms, vmms->count); -- free_page((unsigned long) vmms); -+ vmms = (struct sysinfo_3_2_2 *) memblock_alloc(PAGE_SIZE, PAGE_SIZE); -+ if (stsi(vmms, 3, 2, 2) == 0 && vmms->count) -+ add_device_randomness(&vmms->vm, sizeof(vmms->vm[0]) * vmms->count); -+ memblock_free((unsigned long) vmms, PAGE_SIZE); - } - - /* -diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c -index 575dc123bda2..23e3f5d77a24 100644 ---- a/arch/s390/kvm/kvm-s390.c -+++ b/arch/s390/kvm/kvm-s390.c -@@ -295,6 +295,9 @@ int kvm_vm_ioctl_get_dirty_log(struct kvm *kvm, - struct kvm_memory_slot *memslot; - int is_dirty = 0; - -+ if (kvm_is_ucontrol(kvm)) -+ return -EINVAL; -+ - mutex_lock(&kvm->slots_lock); - - r = -EINVAL; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 64f60a48def1..3a7ae80dc49d 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -3499,7 +3499,7 @@ static void fix_rmode_seg(int seg, struct kvm_segment *save) - } - - vmcs_write16(sf->selector, var.selector); -- vmcs_write32(sf->base, var.base); -+ vmcs_writel(sf->base, var.base); - vmcs_write32(sf->limit, var.limit); - vmcs_write32(sf->ar_bytes, vmx_segment_access_rights(&var)); - } -@@ -7905,7 +7905,7 @@ static void kvm_flush_pml_buffers(struct kvm *kvm) - static void vmx_dump_sel(char *name, uint32_t sel) - { - pr_err("%s sel=0x%04x, attr=0x%05x, limit=0x%08x, base=0x%016lx\n", -- name, vmcs_read32(sel), -+ name, vmcs_read16(sel), - vmcs_read32(sel + GUEST_ES_AR_BYTES - GUEST_ES_SELECTOR), - vmcs_read32(sel + GUEST_ES_LIMIT - GUEST_ES_SELECTOR), - vmcs_readl(sel + GUEST_ES_BASE - GUEST_ES_SELECTOR)); -diff --git a/arch/xtensa/kernel/setup.c b/arch/xtensa/kernel/setup.c -index 9735691f37f1..49ccbd9022f6 100644 ---- a/arch/xtensa/kernel/setup.c -+++ b/arch/xtensa/kernel/setup.c -@@ -133,6 +133,8 @@ static int __init parse_tag_initrd(const bp_tag_t* tag) - - __tagtable(BP_TAG_INITRD, parse_tag_initrd); - -+#endif /* CONFIG_BLK_DEV_INITRD */ -+ - #ifdef CONFIG_OF - - static int __init parse_tag_fdt(const bp_tag_t *tag) -@@ -145,8 +147,6 @@ __tagtable(BP_TAG_FDT, parse_tag_fdt); - - #endif /* CONFIG_OF */ - --#endif /* CONFIG_BLK_DEV_INITRD */ -- - static int __init parse_tag_cmdline(const bp_tag_t* tag) - { - strlcpy(command_line, (char *)(tag->data), COMMAND_LINE_SIZE); -diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c -index 0beaa52df66b..5df8e1234505 100644 ---- a/drivers/bluetooth/ath3k.c -+++ b/drivers/bluetooth/ath3k.c -@@ -94,6 +94,7 @@ static const struct usb_device_id ath3k_table[] = { - { USB_DEVICE(0x04CA, 0x300f) }, - { USB_DEVICE(0x04CA, 0x3010) }, - { USB_DEVICE(0x04CA, 0x3014) }, -+ { USB_DEVICE(0x04CA, 0x3018) }, - { USB_DEVICE(0x0930, 0x0219) }, - { USB_DEVICE(0x0930, 0x021c) }, - { USB_DEVICE(0x0930, 0x0220) }, -@@ -160,6 +161,7 @@ static const struct usb_device_id ath3k_blist_tbl[] = { - { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index c306b483de60..cd6b141b9825 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -208,6 +208,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x04ca, 0x300f), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3010), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x04ca, 0x3014), .driver_info = BTUSB_ATH3012 }, -+ { USB_DEVICE(0x04ca, 0x3018), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0219), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x021c), .driver_info = BTUSB_ATH3012 }, - { USB_DEVICE(0x0930, 0x0220), .driver_info = BTUSB_ATH3012 }, -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -index c161eeda417b..267749a94c5a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -@@ -3704,9 +3704,15 @@ static void dce_v11_0_encoder_add(struct amdgpu_device *adev, - default: - encoder->possible_crtcs = 0x3; - break; -+ case 3: -+ encoder->possible_crtcs = 0x7; -+ break; - case 4: - encoder->possible_crtcs = 0xf; - break; -+ case 5: -+ encoder->possible_crtcs = 0x1f; -+ break; - case 6: - encoder->possible_crtcs = 0x3f; - break; -diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c -index 810c51d92b99..30672a3df8a9 100644 ---- a/drivers/gpu/drm/ast/ast_post.c -+++ b/drivers/gpu/drm/ast/ast_post.c -@@ -58,13 +58,9 @@ bool ast_is_vga_enabled(struct drm_device *dev) - /* TODO 1180 */ - } else { - ch = ast_io_read8(ast, AST_IO_VGA_ENABLE_PORT); -- if (ch) { -- ast_open_key(ast); -- ch = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xb6, 0xff); -- return ch & 0x04; -- } -+ return !!(ch & 0x01); - } -- return 0; -+ return false; - } - - static const u8 extreginfo[] = { 0x0f, 0x04, 0x1c, 0xff }; -@@ -375,8 +371,8 @@ void ast_post_gpu(struct drm_device *dev) - pci_write_config_dword(ast->dev->pdev, 0x04, reg); - - ast_enable_vga(dev); -- ast_enable_mmio(dev); - ast_open_key(ast); -+ ast_enable_mmio(dev); - ast_set_def_ext_reg(dev); - - if (ast->chip == AST2300 || ast->chip == AST2400) -@@ -1630,12 +1626,44 @@ static void ast_init_dram_2300(struct drm_device *dev) - temp |= 0x73; - ast_write32(ast, 0x12008, temp); - -+ param.dram_freq = 396; - param.dram_type = AST_DDR3; -+ temp = ast_mindwm(ast, 0x1e6e2070); - if (temp & 0x01000000) - param.dram_type = AST_DDR2; -- param.dram_chipid = ast->dram_type; -- param.dram_freq = ast->mclk; -- param.vram_size = ast->vram_size; -+ switch (temp & 0x18000000) { -+ case 0: -+ param.dram_chipid = AST_DRAM_512Mx16; -+ break; -+ default: -+ case 0x08000000: -+ param.dram_chipid = AST_DRAM_1Gx16; -+ break; -+ case 0x10000000: -+ param.dram_chipid = AST_DRAM_2Gx16; -+ break; -+ case 0x18000000: -+ param.dram_chipid = AST_DRAM_4Gx16; -+ break; -+ } -+ switch (temp & 0x0c) { -+ default: -+ case 0x00: -+ param.vram_size = AST_VIDMEM_SIZE_8M; -+ break; -+ -+ case 0x04: -+ param.vram_size = AST_VIDMEM_SIZE_16M; -+ break; -+ -+ case 0x08: -+ param.vram_size = AST_VIDMEM_SIZE_32M; -+ break; -+ -+ case 0x0c: -+ param.vram_size = AST_VIDMEM_SIZE_64M; -+ break; -+ } - - if (param.dram_type == AST_DDR3) { - get_ddr3_info(ast, ¶m); -diff --git a/drivers/gpu/drm/drm_atomic_helper.c b/drivers/gpu/drm/drm_atomic_helper.c -index 1ac29d703c12..ea443fafb934 100644 ---- a/drivers/gpu/drm/drm_atomic_helper.c -+++ b/drivers/gpu/drm/drm_atomic_helper.c -@@ -265,7 +265,7 @@ mode_fixup(struct drm_atomic_state *state) - struct drm_connector *connector; - struct drm_connector_state *conn_state; - int i; -- bool ret; -+ int ret; - - for_each_crtc_in_state(state, crtc, crtc_state, i) { - if (!crtc_state->mode_changed && -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index 8c9ac021608f..cc1e16fd7e76 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -144,6 +144,9 @@ static struct edid_quirk { - - /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */ - { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC }, -+ -+ /* Rotel RSX-1058 forwards sink's EDID but only does HDMI 1.1*/ -+ { "ETR", 13896, EDID_QUIRK_FORCE_8BPC }, - }; - - /* -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index 3f802163f7d4..e7c18519274a 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -6803,7 +6803,18 @@ static void ivybridge_init_clock_gating(struct drm_device *dev) - - static void vlv_init_display_clock_gating(struct drm_i915_private *dev_priv) - { -- I915_WRITE(DSPCLK_GATE_D, VRHUNIT_CLOCK_GATE_DISABLE); -+ u32 val; -+ -+ /* -+ * On driver load, a pipe may be active and driving a DSI display. -+ * Preserve DPOUNIT_CLOCK_GATE_DISABLE to avoid the pipe getting stuck -+ * (and never recovering) in this case. intel_dsi_post_disable() will -+ * clear it when we turn off the display. -+ */ -+ val = I915_READ(DSPCLK_GATE_D); -+ val &= DPOUNIT_CLOCK_GATE_DISABLE; -+ val |= VRHUNIT_CLOCK_GATE_DISABLE; -+ I915_WRITE(DSPCLK_GATE_D, val); - - /* - * Disable trickle feed and enable pnd deadline calculation -diff --git a/drivers/gpu/drm/ttm/ttm_bo.c b/drivers/gpu/drm/ttm/ttm_bo.c -index 4ae8b56b1847..037c38bb5333 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo.c -+++ b/drivers/gpu/drm/ttm/ttm_bo.c -@@ -1621,7 +1621,6 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink) - struct ttm_buffer_object *bo; - int ret = -EBUSY; - int put_count; -- uint32_t swap_placement = (TTM_PL_FLAG_CACHED | TTM_PL_FLAG_SYSTEM); - - spin_lock(&glob->lru_lock); - list_for_each_entry(bo, &glob->swap_lru, swap) { -@@ -1657,7 +1656,8 @@ static int ttm_bo_swapout(struct ttm_mem_shrink *shrink) - if (unlikely(ret != 0)) - goto out; - -- if ((bo->mem.placement & swap_placement) != swap_placement) { -+ if (bo->mem.mem_type != TTM_PL_SYSTEM || -+ bo->ttm->caching_state != tt_cached) { - struct ttm_mem_reg evict_mem; - - evict_mem = bo->mem; -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 89fd0113aa5c..57c191798699 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -219,7 +219,7 @@ int hv_init(void) - /* See if the hypercall page is already set */ - rdmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64); - -- virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_EXEC); -+ virtaddr = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL_RX); - - if (!virtaddr) - goto cleanup; -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -index 3ba7de5f9379..2018d24344de 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -@@ -1488,12 +1488,14 @@ static ssize_t set_mode(struct device *d, struct device_attribute *attr, - - ret = ipoib_set_mode(dev, buf); - -- rtnl_unlock(); -- -- if (!ret) -- return count; -+ /* The assumption is that the function ipoib_set_mode returned -+ * with the rtnl held by it, if not the value -EBUSY returned, -+ * then no need to rtnl_unlock -+ */ -+ if (ret != -EBUSY) -+ rtnl_unlock(); - -- return ret; -+ return (!ret || ret == -EBUSY) ? count : ret; - } - - static DEVICE_ATTR(mode, S_IWUSR | S_IRUGO, show_mode, set_mode); -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c -index 8a4d10452d61..8efcff1beb8f 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c -@@ -464,8 +464,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf) - priv->tx_wr.wr.send_flags &= ~IB_SEND_IP_CSUM; - - ipoib_flush_paths(dev); -- rtnl_lock(); -- return 0; -+ return (!rtnl_trylock()) ? -EBUSY : 0; - } - - if (!strcmp(buf, "datagram\n")) { -@@ -474,8 +473,7 @@ int ipoib_set_mode(struct net_device *dev, const char *buf) - dev_set_mtu(dev, min(priv->mcast_mtu, dev->mtu)); - rtnl_unlock(); - ipoib_flush_paths(dev); -- rtnl_lock(); -- return 0; -+ return (!rtnl_trylock()) ? -EBUSY : 0; - } - - return -EINVAL; -@@ -628,6 +626,14 @@ void ipoib_mark_paths_invalid(struct net_device *dev) - spin_unlock_irq(&priv->lock); - } - -+static void push_pseudo_header(struct sk_buff *skb, const char *daddr) -+{ -+ struct ipoib_pseudo_header *phdr; -+ -+ phdr = (struct ipoib_pseudo_header *)skb_push(skb, sizeof(*phdr)); -+ memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN); -+} -+ - void ipoib_flush_paths(struct net_device *dev) - { - struct ipoib_dev_priv *priv = netdev_priv(dev); -@@ -852,8 +858,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, - } - if (skb_queue_len(&neigh->queue) < - IPOIB_MAX_PATH_REC_QUEUE) { -- /* put pseudoheader back on for next time */ -- skb_push(skb, IPOIB_PSEUDO_LEN); -+ push_pseudo_header(skb, neigh->daddr); - __skb_queue_tail(&neigh->queue, skb); - } else { - ipoib_warn(priv, "queue length limit %d. Packet drop.\n", -@@ -871,10 +876,12 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, - - if (!path->query && path_rec_start(dev, path)) - goto err_path; -- if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) -+ if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) { -+ push_pseudo_header(skb, neigh->daddr); - __skb_queue_tail(&neigh->queue, skb); -- else -+ } else { - goto err_drop; -+ } - } - - spin_unlock_irqrestore(&priv->lock, flags); -@@ -910,8 +917,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, - } - if (path) { - if (skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) { -- /* put pseudoheader back on for next time */ -- skb_push(skb, IPOIB_PSEUDO_LEN); -+ push_pseudo_header(skb, phdr->hwaddr); - __skb_queue_tail(&path->queue, skb); - } else { - ++dev->stats.tx_dropped; -@@ -943,8 +949,7 @@ static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, - return; - } else if ((path->query || !path_rec_start(dev, path)) && - skb_queue_len(&path->queue) < IPOIB_MAX_PATH_REC_QUEUE) { -- /* put pseudoheader back on for next time */ -- skb_push(skb, IPOIB_PSEUDO_LEN); -+ push_pseudo_header(skb, phdr->hwaddr); - __skb_queue_tail(&path->queue, skb); - } else { - ++dev->stats.tx_dropped; -@@ -1025,8 +1030,7 @@ send_using_neigh: - } - - if (skb_queue_len(&neigh->queue) < IPOIB_MAX_PATH_REC_QUEUE) { -- /* put pseudoheader back on for next time */ -- skb_push(skb, sizeof(*phdr)); -+ push_pseudo_header(skb, phdr->hwaddr); - spin_lock_irqsave(&priv->lock, flags); - __skb_queue_tail(&neigh->queue, skb); - spin_unlock_irqrestore(&priv->lock, flags); -@@ -1058,7 +1062,6 @@ static int ipoib_hard_header(struct sk_buff *skb, - unsigned short type, - const void *daddr, const void *saddr, unsigned len) - { -- struct ipoib_pseudo_header *phdr; - struct ipoib_header *header; - - header = (struct ipoib_header *) skb_push(skb, sizeof *header); -@@ -1071,8 +1074,7 @@ static int ipoib_hard_header(struct sk_buff *skb, - * destination address into skb hard header so we can figure out where - * to send the packet later. - */ -- phdr = (struct ipoib_pseudo_header *) skb_push(skb, sizeof(*phdr)); -- memcpy(phdr->hwaddr, daddr, INFINIBAND_ALEN); -+ push_pseudo_header(skb, daddr); - - return IPOIB_HARD_LEN; - } -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index 5f0f4fc58f43..e397f1b0af09 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -1787,17 +1787,24 @@ static void srp_process_rsp(struct srp_rdma_ch *ch, struct srp_rsp *rsp) - if (unlikely(rsp->tag & SRP_TAG_TSK_MGMT)) { - spin_lock_irqsave(&ch->lock, flags); - ch->req_lim += be32_to_cpu(rsp->req_lim_delta); -+ if (rsp->tag == ch->tsk_mgmt_tag) { -+ ch->tsk_mgmt_status = -1; -+ if (be32_to_cpu(rsp->resp_data_len) >= 4) -+ ch->tsk_mgmt_status = rsp->data[3]; -+ complete(&ch->tsk_mgmt_done); -+ } else { -+ shost_printk(KERN_ERR, target->scsi_host, -+ "Received tsk mgmt response too late for tag %#llx\n", -+ rsp->tag); -+ } - spin_unlock_irqrestore(&ch->lock, flags); -- -- ch->tsk_mgmt_status = -1; -- if (be32_to_cpu(rsp->resp_data_len) >= 4) -- ch->tsk_mgmt_status = rsp->data[3]; -- complete(&ch->tsk_mgmt_done); - } else { - scmnd = scsi_host_find_tag(target->scsi_host, rsp->tag); -- if (scmnd) { -+ if (scmnd && scmnd->host_scribble) { - req = (void *)scmnd->host_scribble; - scmnd = srp_claim_req(ch, req, NULL, scmnd); -+ } else { -+ scmnd = NULL; - } - if (!scmnd) { - shost_printk(KERN_ERR, target->scsi_host, -@@ -2469,19 +2476,18 @@ srp_change_queue_depth(struct scsi_device *sdev, int qdepth) - } - - static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun, -- u8 func) -+ u8 func, u8 *status) - { - struct srp_target_port *target = ch->target; - struct srp_rport *rport = target->rport; - struct ib_device *dev = target->srp_host->srp_dev->dev; - struct srp_iu *iu; - struct srp_tsk_mgmt *tsk_mgmt; -+ int res; - - if (!ch->connected || target->qp_in_error) - return -1; - -- init_completion(&ch->tsk_mgmt_done); -- - /* - * Lock the rport mutex to avoid that srp_create_ch_ib() is - * invoked while a task management function is being sent. -@@ -2504,10 +2510,16 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun, - - tsk_mgmt->opcode = SRP_TSK_MGMT; - int_to_scsilun(lun, &tsk_mgmt->lun); -- tsk_mgmt->tag = req_tag | SRP_TAG_TSK_MGMT; - tsk_mgmt->tsk_mgmt_func = func; - tsk_mgmt->task_tag = req_tag; - -+ spin_lock_irq(&ch->lock); -+ ch->tsk_mgmt_tag = (ch->tsk_mgmt_tag + 1) | SRP_TAG_TSK_MGMT; -+ tsk_mgmt->tag = ch->tsk_mgmt_tag; -+ spin_unlock_irq(&ch->lock); -+ -+ init_completion(&ch->tsk_mgmt_done); -+ - ib_dma_sync_single_for_device(dev, iu->dma, sizeof *tsk_mgmt, - DMA_TO_DEVICE); - if (srp_post_send(ch, iu, sizeof(*tsk_mgmt))) { -@@ -2516,13 +2528,15 @@ static int srp_send_tsk_mgmt(struct srp_rdma_ch *ch, u64 req_tag, u64 lun, - - return -1; - } -+ res = wait_for_completion_timeout(&ch->tsk_mgmt_done, -+ msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS)); -+ if (res > 0 && status) -+ *status = ch->tsk_mgmt_status; - mutex_unlock(&rport->mutex); - -- if (!wait_for_completion_timeout(&ch->tsk_mgmt_done, -- msecs_to_jiffies(SRP_ABORT_TIMEOUT_MS))) -- return -1; -+ WARN_ON_ONCE(res < 0); - -- return 0; -+ return res > 0 ? 0 : -1; - } - - static int srp_abort(struct scsi_cmnd *scmnd) -@@ -2548,7 +2562,7 @@ static int srp_abort(struct scsi_cmnd *scmnd) - shost_printk(KERN_ERR, target->scsi_host, - "Sending SRP abort for tag %#x\n", tag); - if (srp_send_tsk_mgmt(ch, tag, scmnd->device->lun, -- SRP_TSK_ABORT_TASK) == 0) -+ SRP_TSK_ABORT_TASK, NULL) == 0) - ret = SUCCESS; - else if (target->rport->state == SRP_RPORT_LOST) - ret = FAST_IO_FAIL; -@@ -2566,14 +2580,15 @@ static int srp_reset_device(struct scsi_cmnd *scmnd) - struct srp_target_port *target = host_to_target(scmnd->device->host); - struct srp_rdma_ch *ch; - int i; -+ u8 status; - - shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n"); - - ch = &target->ch[0]; - if (srp_send_tsk_mgmt(ch, SRP_TAG_NO_REQ, scmnd->device->lun, -- SRP_TSK_LUN_RESET)) -+ SRP_TSK_LUN_RESET, &status)) - return FAILED; -- if (ch->tsk_mgmt_status) -+ if (status) - return FAILED; - - for (i = 0; i < target->ch_count; i++) { -diff --git a/drivers/infiniband/ulp/srp/ib_srp.h b/drivers/infiniband/ulp/srp/ib_srp.h -index f6af531f9f32..109eea94d0f9 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.h -+++ b/drivers/infiniband/ulp/srp/ib_srp.h -@@ -168,6 +168,7 @@ struct srp_rdma_ch { - int max_ti_iu_len; - int comp_vector; - -+ u64 tsk_mgmt_tag; - struct completion tsk_mgmt_done; - u8 tsk_mgmt_status; - bool connected; -diff --git a/drivers/net/ieee802154/fakelb.c b/drivers/net/ieee802154/fakelb.c -index 860d4aed8274..43617ded3773 100644 ---- a/drivers/net/ieee802154/fakelb.c -+++ b/drivers/net/ieee802154/fakelb.c -@@ -30,7 +30,7 @@ - static int numlbs = 2; - - static LIST_HEAD(fakelb_phys); --static DEFINE_SPINLOCK(fakelb_phys_lock); -+static DEFINE_MUTEX(fakelb_phys_lock); - - static LIST_HEAD(fakelb_ifup_phys); - static DEFINE_RWLOCK(fakelb_ifup_phys_lock); -@@ -180,9 +180,9 @@ static int fakelb_add_one(struct device *dev) - if (err) - goto err_reg; - -- spin_lock(&fakelb_phys_lock); -+ mutex_lock(&fakelb_phys_lock); - list_add_tail(&phy->list, &fakelb_phys); -- spin_unlock(&fakelb_phys_lock); -+ mutex_unlock(&fakelb_phys_lock); - - return 0; - -@@ -214,10 +214,10 @@ static int fakelb_probe(struct platform_device *pdev) - return 0; - - err_slave: -- spin_lock(&fakelb_phys_lock); -+ mutex_lock(&fakelb_phys_lock); - list_for_each_entry_safe(phy, tmp, &fakelb_phys, list) - fakelb_del(phy); -- spin_unlock(&fakelb_phys_lock); -+ mutex_unlock(&fakelb_phys_lock); - return err; - } - -@@ -225,10 +225,10 @@ static int fakelb_remove(struct platform_device *pdev) - { - struct fakelb_phy *phy, *tmp; - -- spin_lock(&fakelb_phys_lock); -+ mutex_lock(&fakelb_phys_lock); - list_for_each_entry_safe(phy, tmp, &fakelb_phys, list) - fakelb_del(phy); -- spin_unlock(&fakelb_phys_lock); -+ mutex_unlock(&fakelb_phys_lock); - return 0; - } - -diff --git a/drivers/pwm/pwm-pca9685.c b/drivers/pwm/pwm-pca9685.c -index 117fccf7934a..01a6a83f625d 100644 ---- a/drivers/pwm/pwm-pca9685.c -+++ b/drivers/pwm/pwm-pca9685.c -@@ -65,7 +65,6 @@ - #define PCA9685_MAXCHAN 0x10 - - #define LED_FULL (1 << 4) --#define MODE1_RESTART (1 << 7) - #define MODE1_SLEEP (1 << 4) - #define MODE2_INVRT (1 << 4) - #define MODE2_OUTDRV (1 << 2) -@@ -117,16 +116,6 @@ static int pca9685_pwm_config(struct pwm_chip *chip, struct pwm_device *pwm, - udelay(500); - - pca->period_ns = period_ns; -- -- /* -- * If the duty cycle did not change, restart PWM with -- * the same duty cycle to period ratio and return. -- */ -- if (duty_ns == pca->duty_ns) { -- regmap_update_bits(pca->regmap, PCA9685_MODE1, -- MODE1_RESTART, 0x1); -- return 0; -- } - } else { - dev_err(chip->dev, - "prescaler not set: period out of bounds!\n"); -diff --git a/drivers/s390/block/dcssblk.c b/drivers/s390/block/dcssblk.c -index 94a8f4ab57bc..ae1dc37e4068 100644 ---- a/drivers/s390/block/dcssblk.c -+++ b/drivers/s390/block/dcssblk.c -@@ -892,7 +892,7 @@ dcssblk_direct_access (struct block_device *bdev, sector_t secnum, - dev_info = bdev->bd_disk->private_data; - if (!dev_info) - return -ENODEV; -- dev_sz = dev_info->end - dev_info->start; -+ dev_sz = dev_info->end - dev_info->start + 1; - offset = secnum * 512; - addr = (void *) (dev_info->start + offset); - *pfn = virt_to_phys(addr) >> PAGE_SHIFT; -diff --git a/drivers/s390/cio/qdio_thinint.c b/drivers/s390/cio/qdio_thinint.c -index 5d06253c2a7a..30e9fbbff051 100644 ---- a/drivers/s390/cio/qdio_thinint.c -+++ b/drivers/s390/cio/qdio_thinint.c -@@ -147,11 +147,11 @@ static inline void tiqdio_call_inq_handlers(struct qdio_irq *irq) - struct qdio_q *q; - int i; - -- for_each_input_queue(irq, q, i) { -- if (!references_shared_dsci(irq) && -- has_multiple_inq_on_dsci(irq)) -- xchg(q->irq_ptr->dsci, 0); -+ if (!references_shared_dsci(irq) && -+ has_multiple_inq_on_dsci(irq)) -+ xchg(irq->dsci, 0); - -+ for_each_input_queue(irq, q, i) { - if (q->u.in.queue_start_poll) { - /* skip if polling is enabled or already in work */ - if (test_and_set_bit(QDIO_QUEUE_IRQS_DISABLED, -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index 356c80fbb304..bb6a6c35324a 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -77,12 +77,16 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun) - &deve->read_bytes); - - se_lun = rcu_dereference(deve->se_lun); -+ -+ if (!percpu_ref_tryget_live(&se_lun->lun_ref)) { -+ se_lun = NULL; -+ goto out_unlock; -+ } -+ - se_cmd->se_lun = rcu_dereference(deve->se_lun); - se_cmd->pr_res_key = deve->pr_res_key; - se_cmd->orig_fe_lun = unpacked_lun; - se_cmd->se_cmd_flags |= SCF_SE_LUN_CMD; -- -- percpu_ref_get(&se_lun->lun_ref); - se_cmd->lun_ref_active = true; - - if ((se_cmd->data_direction == DMA_TO_DEVICE) && -@@ -96,6 +100,7 @@ transport_lookup_cmd_lun(struct se_cmd *se_cmd, u64 unpacked_lun) - goto ref_dev; - } - } -+out_unlock: - rcu_read_unlock(); - - if (!se_lun) { -@@ -826,6 +831,7 @@ struct se_device *target_alloc_device(struct se_hba *hba, const char *name) - xcopy_lun = &dev->xcopy_lun; - rcu_assign_pointer(xcopy_lun->lun_se_dev, dev); - init_completion(&xcopy_lun->lun_ref_comp); -+ init_completion(&xcopy_lun->lun_shutdown_comp); - INIT_LIST_HEAD(&xcopy_lun->lun_deve_list); - INIT_LIST_HEAD(&xcopy_lun->lun_dev_link); - mutex_init(&xcopy_lun->lun_tg_pt_md_mutex); -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index 028854cda97b..2794c6ec5c3c 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -539,7 +539,7 @@ static void core_tpg_lun_ref_release(struct percpu_ref *ref) - { - struct se_lun *lun = container_of(ref, struct se_lun, lun_ref); - -- complete(&lun->lun_ref_comp); -+ complete(&lun->lun_shutdown_comp); - } - - int core_tpg_register( -@@ -666,6 +666,7 @@ struct se_lun *core_tpg_alloc_lun( - lun->lun_link_magic = SE_LUN_LINK_MAGIC; - atomic_set(&lun->lun_acl_count, 0); - init_completion(&lun->lun_ref_comp); -+ init_completion(&lun->lun_shutdown_comp); - INIT_LIST_HEAD(&lun->lun_deve_list); - INIT_LIST_HEAD(&lun->lun_dev_link); - atomic_set(&lun->lun_tg_pt_secondary_offline, 0); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index befe22744802..df2059984e14 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -2680,10 +2680,39 @@ void target_wait_for_sess_cmds(struct se_session *se_sess) - } - EXPORT_SYMBOL(target_wait_for_sess_cmds); - -+static void target_lun_confirm(struct percpu_ref *ref) -+{ -+ struct se_lun *lun = container_of(ref, struct se_lun, lun_ref); -+ -+ complete(&lun->lun_ref_comp); -+} -+ - void transport_clear_lun_ref(struct se_lun *lun) - { -- percpu_ref_kill(&lun->lun_ref); -+ /* -+ * Mark the percpu-ref as DEAD, switch to atomic_t mode, drop -+ * the initial reference and schedule confirm kill to be -+ * executed after one full RCU grace period has completed. -+ */ -+ percpu_ref_kill_and_confirm(&lun->lun_ref, target_lun_confirm); -+ /* -+ * The first completion waits for percpu_ref_switch_to_atomic_rcu() -+ * to call target_lun_confirm after lun->lun_ref has been marked -+ * as __PERCPU_REF_DEAD on all CPUs, and switches to atomic_t -+ * mode so that percpu_ref_tryget_live() lookup of lun->lun_ref -+ * fails for all new incoming I/O. -+ */ - wait_for_completion(&lun->lun_ref_comp); -+ /* -+ * The second completion waits for percpu_ref_put_many() to -+ * invoke ->release() after lun->lun_ref has switched to -+ * atomic_t mode, and lun->lun_ref.count has reached zero. -+ * -+ * At this point all target-core lun->lun_ref references have -+ * been dropped via transport_lun_remove_cmd(), and it's safe -+ * to proceed with the remaining LUN shutdown. -+ */ -+ wait_for_completion(&lun->lun_shutdown_comp); - } - - static bool -diff --git a/drivers/tty/n_hdlc.c b/drivers/tty/n_hdlc.c -index 644ddb841d9f..6d1e2f746ab4 100644 ---- a/drivers/tty/n_hdlc.c -+++ b/drivers/tty/n_hdlc.c -@@ -114,7 +114,7 @@ - #define DEFAULT_TX_BUF_COUNT 3 - - struct n_hdlc_buf { -- struct n_hdlc_buf *link; -+ struct list_head list_item; - int count; - char buf[1]; - }; -@@ -122,8 +122,7 @@ struct n_hdlc_buf { - #define N_HDLC_BUF_SIZE (sizeof(struct n_hdlc_buf) + maxframe) - - struct n_hdlc_buf_list { -- struct n_hdlc_buf *head; -- struct n_hdlc_buf *tail; -+ struct list_head list; - int count; - spinlock_t spinlock; - }; -@@ -136,7 +135,6 @@ struct n_hdlc_buf_list { - * @backup_tty - TTY to use if tty gets closed - * @tbusy - reentrancy flag for tx wakeup code - * @woke_up - FIXME: describe this field -- * @tbuf - currently transmitting tx buffer - * @tx_buf_list - list of pending transmit frame buffers - * @rx_buf_list - list of received frame buffers - * @tx_free_buf_list - list unused transmit frame buffers -@@ -149,7 +147,6 @@ struct n_hdlc { - struct tty_struct *backup_tty; - int tbusy; - int woke_up; -- struct n_hdlc_buf *tbuf; - struct n_hdlc_buf_list tx_buf_list; - struct n_hdlc_buf_list rx_buf_list; - struct n_hdlc_buf_list tx_free_buf_list; -@@ -159,7 +156,8 @@ struct n_hdlc { - /* - * HDLC buffer list manipulation functions - */ --static void n_hdlc_buf_list_init(struct n_hdlc_buf_list *list); -+static void n_hdlc_buf_return(struct n_hdlc_buf_list *buf_list, -+ struct n_hdlc_buf *buf); - static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, - struct n_hdlc_buf *buf); - static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *list); -@@ -209,16 +207,9 @@ static void flush_tx_queue(struct tty_struct *tty) - { - struct n_hdlc *n_hdlc = tty2n_hdlc(tty); - struct n_hdlc_buf *buf; -- unsigned long flags; - - while ((buf = n_hdlc_buf_get(&n_hdlc->tx_buf_list))) - n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, buf); -- spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock, flags); -- if (n_hdlc->tbuf) { -- n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, n_hdlc->tbuf); -- n_hdlc->tbuf = NULL; -- } -- spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); - } - - static struct tty_ldisc_ops n_hdlc_ldisc = { -@@ -284,7 +275,6 @@ static void n_hdlc_release(struct n_hdlc *n_hdlc) - } else - break; - } -- kfree(n_hdlc->tbuf); - kfree(n_hdlc); - - } /* end of n_hdlc_release() */ -@@ -403,13 +393,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) - n_hdlc->woke_up = 0; - spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock, flags); - -- /* get current transmit buffer or get new transmit */ -- /* buffer from list of pending transmit buffers */ -- -- tbuf = n_hdlc->tbuf; -- if (!tbuf) -- tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); -- -+ tbuf = n_hdlc_buf_get(&n_hdlc->tx_buf_list); - while (tbuf) { - if (debuglevel >= DEBUG_LEVEL_INFO) - printk("%s(%d)sending frame %p, count=%d\n", -@@ -421,7 +405,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) - - /* rollback was possible and has been done */ - if (actual == -ERESTARTSYS) { -- n_hdlc->tbuf = tbuf; -+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); - break; - } - /* if transmit error, throw frame away by */ -@@ -436,10 +420,7 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) - - /* free current transmit buffer */ - n_hdlc_buf_put(&n_hdlc->tx_free_buf_list, tbuf); -- -- /* this tx buffer is done */ -- n_hdlc->tbuf = NULL; -- -+ - /* wait up sleeping writers */ - wake_up_interruptible(&tty->write_wait); - -@@ -449,10 +430,12 @@ static void n_hdlc_send_frames(struct n_hdlc *n_hdlc, struct tty_struct *tty) - if (debuglevel >= DEBUG_LEVEL_INFO) - printk("%s(%d)frame %p pending\n", - __FILE__,__LINE__,tbuf); -- -- /* buffer not accepted by driver */ -- /* set this buffer as pending buffer */ -- n_hdlc->tbuf = tbuf; -+ -+ /* -+ * the buffer was not accepted by driver, -+ * return it back into tx queue -+ */ -+ n_hdlc_buf_return(&n_hdlc->tx_buf_list, tbuf); - break; - } - } -@@ -750,7 +733,8 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, - int error = 0; - int count; - unsigned long flags; -- -+ struct n_hdlc_buf *buf = NULL; -+ - if (debuglevel >= DEBUG_LEVEL_INFO) - printk("%s(%d)n_hdlc_tty_ioctl() called %d\n", - __FILE__,__LINE__,cmd); -@@ -764,8 +748,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, - /* report count of read data available */ - /* in next available frame (if any) */ - spin_lock_irqsave(&n_hdlc->rx_buf_list.spinlock,flags); -- if (n_hdlc->rx_buf_list.head) -- count = n_hdlc->rx_buf_list.head->count; -+ buf = list_first_entry_or_null(&n_hdlc->rx_buf_list.list, -+ struct n_hdlc_buf, list_item); -+ if (buf) -+ count = buf->count; - else - count = 0; - spin_unlock_irqrestore(&n_hdlc->rx_buf_list.spinlock,flags); -@@ -777,8 +763,10 @@ static int n_hdlc_tty_ioctl(struct tty_struct *tty, struct file *file, - count = tty_chars_in_buffer(tty); - /* add size of next output frame in queue */ - spin_lock_irqsave(&n_hdlc->tx_buf_list.spinlock,flags); -- if (n_hdlc->tx_buf_list.head) -- count += n_hdlc->tx_buf_list.head->count; -+ buf = list_first_entry_or_null(&n_hdlc->tx_buf_list.list, -+ struct n_hdlc_buf, list_item); -+ if (buf) -+ count += buf->count; - spin_unlock_irqrestore(&n_hdlc->tx_buf_list.spinlock,flags); - error = put_user(count, (int __user *)arg); - break; -@@ -826,14 +814,14 @@ static unsigned int n_hdlc_tty_poll(struct tty_struct *tty, struct file *filp, - poll_wait(filp, &tty->write_wait, wait); - - /* set bits for operations that won't block */ -- if (n_hdlc->rx_buf_list.head) -+ if (!list_empty(&n_hdlc->rx_buf_list.list)) - mask |= POLLIN | POLLRDNORM; /* readable */ - if (test_bit(TTY_OTHER_CLOSED, &tty->flags)) - mask |= POLLHUP; - if (tty_hung_up_p(filp)) - mask |= POLLHUP; - if (!tty_is_writelocked(tty) && -- n_hdlc->tx_free_buf_list.head) -+ !list_empty(&n_hdlc->tx_free_buf_list.list)) - mask |= POLLOUT | POLLWRNORM; /* writable */ - } - return mask; -@@ -853,11 +841,16 @@ static struct n_hdlc *n_hdlc_alloc(void) - if (!n_hdlc) - return NULL; - -- n_hdlc_buf_list_init(&n_hdlc->rx_free_buf_list); -- n_hdlc_buf_list_init(&n_hdlc->tx_free_buf_list); -- n_hdlc_buf_list_init(&n_hdlc->rx_buf_list); -- n_hdlc_buf_list_init(&n_hdlc->tx_buf_list); -- -+ spin_lock_init(&n_hdlc->rx_free_buf_list.spinlock); -+ spin_lock_init(&n_hdlc->tx_free_buf_list.spinlock); -+ spin_lock_init(&n_hdlc->rx_buf_list.spinlock); -+ spin_lock_init(&n_hdlc->tx_buf_list.spinlock); -+ -+ INIT_LIST_HEAD(&n_hdlc->rx_free_buf_list.list); -+ INIT_LIST_HEAD(&n_hdlc->tx_free_buf_list.list); -+ INIT_LIST_HEAD(&n_hdlc->rx_buf_list.list); -+ INIT_LIST_HEAD(&n_hdlc->tx_buf_list.list); -+ - /* allocate free rx buffer list */ - for(i=0;ispinlock); --} /* end of n_hdlc_buf_list_init() */ -+ unsigned long flags; -+ -+ spin_lock_irqsave(&buf_list->spinlock, flags); -+ -+ list_add(&buf->list_item, &buf_list->list); -+ buf_list->count++; -+ -+ spin_unlock_irqrestore(&buf_list->spinlock, flags); -+} - - /** - * n_hdlc_buf_put - add specified HDLC buffer to tail of specified list -- * @list - pointer to buffer list -+ * @buf_list - pointer to buffer list - * @buf - pointer to buffer - */ --static void n_hdlc_buf_put(struct n_hdlc_buf_list *list, -+static void n_hdlc_buf_put(struct n_hdlc_buf_list *buf_list, - struct n_hdlc_buf *buf) - { - unsigned long flags; -- spin_lock_irqsave(&list->spinlock,flags); -- -- buf->link=NULL; -- if (list->tail) -- list->tail->link = buf; -- else -- list->head = buf; -- list->tail = buf; -- (list->count)++; -- -- spin_unlock_irqrestore(&list->spinlock,flags); -- -+ -+ spin_lock_irqsave(&buf_list->spinlock, flags); -+ -+ list_add_tail(&buf->list_item, &buf_list->list); -+ buf_list->count++; -+ -+ spin_unlock_irqrestore(&buf_list->spinlock, flags); - } /* end of n_hdlc_buf_put() */ - - /** - * n_hdlc_buf_get - remove and return an HDLC buffer from list -- * @list - pointer to HDLC buffer list -+ * @buf_list - pointer to HDLC buffer list - * - * Remove and return an HDLC buffer from the head of the specified HDLC buffer - * list. - * Returns a pointer to HDLC buffer if available, otherwise %NULL. - */ --static struct n_hdlc_buf* n_hdlc_buf_get(struct n_hdlc_buf_list *list) -+static struct n_hdlc_buf *n_hdlc_buf_get(struct n_hdlc_buf_list *buf_list) - { - unsigned long flags; - struct n_hdlc_buf *buf; -- spin_lock_irqsave(&list->spinlock,flags); -- -- buf = list->head; -+ -+ spin_lock_irqsave(&buf_list->spinlock, flags); -+ -+ buf = list_first_entry_or_null(&buf_list->list, -+ struct n_hdlc_buf, list_item); - if (buf) { -- list->head = buf->link; -- (list->count)--; -+ list_del(&buf->list_item); -+ buf_list->count--; - } -- if (!list->head) -- list->tail = NULL; -- -- spin_unlock_irqrestore(&list->spinlock,flags); -+ -+ spin_unlock_irqrestore(&buf_list->spinlock, flags); - return buf; -- - } /* end of n_hdlc_buf_get() */ - - static char hdlc_banner[] __initdata = -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 029de3f99752..5b24ffd93649 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -2880,6 +2880,8 @@ enum pci_board_num_t { - pbn_b0_4_1152000_200, - pbn_b0_8_1152000_200, - -+ pbn_b0_4_1250000, -+ - pbn_b0_2_1843200, - pbn_b0_4_1843200, - -@@ -3113,6 +3115,13 @@ static struct pciserial_board pci_boards[] = { - .uart_offset = 0x200, - }, - -+ [pbn_b0_4_1250000] = { -+ .flags = FL_BASE0, -+ .num_ports = 4, -+ .base_baud = 1250000, -+ .uart_offset = 8, -+ }, -+ - [pbn_b0_2_1843200] = { - .flags = FL_BASE0, - .num_ports = 2, -@@ -5778,6 +5787,10 @@ static struct pci_device_id serial_pci_tbl[] = { - { PCI_DEVICE(0x1c29, 0x1108), .driver_data = pbn_fintek_8 }, - { PCI_DEVICE(0x1c29, 0x1112), .driver_data = pbn_fintek_12 }, - -+ /* MKS Tenta SCOM-080x serial cards */ -+ { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 }, -+ { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 }, -+ - /* - * These entries match devices with class COMMUNICATION_SERIAL, - * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index 239bc9cba28c..f54f77037d22 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -644,6 +644,9 @@ static void __unregister_request(struct ceph_mds_client *mdsc, - { - dout("__unregister_request %p tid %lld\n", req, req->r_tid); - -+ /* Never leave an unregistered request on an unsafe list! */ -+ list_del_init(&req->r_unsafe_item); -+ - if (req->r_tid == mdsc->oldest_tid) { - struct rb_node *p = rb_next(&req->r_node); - mdsc->oldest_tid = 0; -@@ -1051,7 +1054,6 @@ static void cleanup_session_requests(struct ceph_mds_client *mdsc, - while (!list_empty(&session->s_unsafe)) { - req = list_first_entry(&session->s_unsafe, - struct ceph_mds_request, r_unsafe_item); -- list_del_init(&req->r_unsafe_item); - pr_warn_ratelimited(" dropping unsafe request %llu\n", - req->r_tid); - __unregister_request(mdsc, req); -@@ -2477,7 +2479,6 @@ static void handle_reply(struct ceph_mds_session *session, struct ceph_msg *msg) - * useful we could do with a revised return value. - */ - dout("got safe reply %llu, mds%d\n", tid, mds); -- list_del_init(&req->r_unsafe_item); - - /* last unsafe request during umount? */ - if (mdsc->stopping && !__get_oldest_req(mdsc)) -diff --git a/fs/fat/inode.c b/fs/fat/inode.c -index 509411dd3698..cf644d52c0cf 100644 ---- a/fs/fat/inode.c -+++ b/fs/fat/inode.c -@@ -1269,6 +1269,16 @@ out: - return 0; - } - -+static void fat_dummy_inode_init(struct inode *inode) -+{ -+ /* Initialize this dummy inode to work as no-op. */ -+ MSDOS_I(inode)->mmu_private = 0; -+ MSDOS_I(inode)->i_start = 0; -+ MSDOS_I(inode)->i_logstart = 0; -+ MSDOS_I(inode)->i_attrs = 0; -+ MSDOS_I(inode)->i_pos = 0; -+} -+ - static int fat_read_root(struct inode *inode) - { - struct msdos_sb_info *sbi = MSDOS_SB(inode->i_sb); -@@ -1713,12 +1723,13 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat, - fat_inode = new_inode(sb); - if (!fat_inode) - goto out_fail; -- MSDOS_I(fat_inode)->i_pos = 0; -+ fat_dummy_inode_init(fat_inode); - sbi->fat_inode = fat_inode; - - fsinfo_inode = new_inode(sb); - if (!fsinfo_inode) - goto out_fail; -+ fat_dummy_inode_init(fsinfo_inode); - fsinfo_inode->i_ino = MSDOS_FSINFO_INO; - sbi->fsinfo_inode = fsinfo_inode; - insert_inode_hash(fsinfo_inode); -diff --git a/fs/mount.h b/fs/mount.h -index 14db05d424f7..3dc7dea5a357 100644 ---- a/fs/mount.h -+++ b/fs/mount.h -@@ -86,7 +86,6 @@ static inline int is_mounted(struct vfsmount *mnt) - } - - extern struct mount *__lookup_mnt(struct vfsmount *, struct dentry *); --extern struct mount *__lookup_mnt_last(struct vfsmount *, struct dentry *); - - extern int __legitimize_mnt(struct vfsmount *, unsigned); - extern bool legitimize_mnt(struct vfsmount *, unsigned); -diff --git a/fs/namespace.c b/fs/namespace.c -index da98a1bbd8b5..7df3d406d3e0 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -638,28 +638,6 @@ struct mount *__lookup_mnt(struct vfsmount *mnt, struct dentry *dentry) - } - - /* -- * find the last mount at @dentry on vfsmount @mnt. -- * mount_lock must be held. -- */ --struct mount *__lookup_mnt_last(struct vfsmount *mnt, struct dentry *dentry) --{ -- struct mount *p, *res = NULL; -- p = __lookup_mnt(mnt, dentry); -- if (!p) -- goto out; -- if (!(p->mnt.mnt_flags & MNT_UMOUNT)) -- res = p; -- hlist_for_each_entry_continue(p, mnt_hash) { -- if (&p->mnt_parent->mnt != mnt || p->mnt_mountpoint != dentry) -- break; -- if (!(p->mnt.mnt_flags & MNT_UMOUNT)) -- res = p; -- } --out: -- return res; --} -- --/* - * lookup_mnt - Return the first child mount mounted at path - * - * "First" means first mounted chronologically. If you create the -@@ -879,6 +857,13 @@ void mnt_set_mountpoint(struct mount *mnt, - hlist_add_head(&child_mnt->mnt_mp_list, &mp->m_list); - } - -+static void __attach_mnt(struct mount *mnt, struct mount *parent) -+{ -+ hlist_add_head_rcu(&mnt->mnt_hash, -+ m_hash(&parent->mnt, mnt->mnt_mountpoint)); -+ list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); -+} -+ - /* - * vfsmount lock must be held for write - */ -@@ -887,28 +872,45 @@ static void attach_mnt(struct mount *mnt, - struct mountpoint *mp) - { - mnt_set_mountpoint(parent, mp, mnt); -- hlist_add_head_rcu(&mnt->mnt_hash, m_hash(&parent->mnt, mp->m_dentry)); -- list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); -+ __attach_mnt(mnt, parent); - } - --static void attach_shadowed(struct mount *mnt, -- struct mount *parent, -- struct mount *shadows) -+void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, struct mount *mnt) - { -- if (shadows) { -- hlist_add_behind_rcu(&mnt->mnt_hash, &shadows->mnt_hash); -- list_add(&mnt->mnt_child, &shadows->mnt_child); -- } else { -- hlist_add_head_rcu(&mnt->mnt_hash, -- m_hash(&parent->mnt, mnt->mnt_mountpoint)); -- list_add_tail(&mnt->mnt_child, &parent->mnt_mounts); -- } -+ struct mountpoint *old_mp = mnt->mnt_mp; -+ struct dentry *old_mountpoint = mnt->mnt_mountpoint; -+ struct mount *old_parent = mnt->mnt_parent; -+ -+ list_del_init(&mnt->mnt_child); -+ hlist_del_init(&mnt->mnt_mp_list); -+ hlist_del_init_rcu(&mnt->mnt_hash); -+ -+ attach_mnt(mnt, parent, mp); -+ -+ put_mountpoint(old_mp); -+ -+ /* -+ * Safely avoid even the suggestion this code might sleep or -+ * lock the mount hash by taking advantage of the knowledge that -+ * mnt_change_mountpoint will not release the final reference -+ * to a mountpoint. -+ * -+ * During mounting, the mount passed in as the parent mount will -+ * continue to use the old mountpoint and during unmounting, the -+ * old mountpoint will continue to exist until namespace_unlock, -+ * which happens well after mnt_change_mountpoint. -+ */ -+ spin_lock(&old_mountpoint->d_lock); -+ old_mountpoint->d_lockref.count--; -+ spin_unlock(&old_mountpoint->d_lock); -+ -+ mnt_add_count(old_parent, -1); - } - - /* - * vfsmount lock must be held for write - */ --static void commit_tree(struct mount *mnt, struct mount *shadows) -+static void commit_tree(struct mount *mnt) - { - struct mount *parent = mnt->mnt_parent; - struct mount *m; -@@ -923,7 +925,7 @@ static void commit_tree(struct mount *mnt, struct mount *shadows) - - list_splice(&head, n->list.prev); - -- attach_shadowed(mnt, parent, shadows); -+ __attach_mnt(mnt, parent); - touch_mnt_namespace(n); - } - -@@ -1718,7 +1720,6 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, - continue; - - for (s = r; s; s = next_mnt(s, r)) { -- struct mount *t = NULL; - if (!(flag & CL_COPY_UNBINDABLE) && - IS_MNT_UNBINDABLE(s)) { - s = skip_mnt_tree(s); -@@ -1740,14 +1741,7 @@ struct mount *copy_tree(struct mount *mnt, struct dentry *dentry, - goto out; - lock_mount_hash(); - list_add_tail(&q->mnt_list, &res->mnt_list); -- mnt_set_mountpoint(parent, p->mnt_mp, q); -- if (!list_empty(&parent->mnt_mounts)) { -- t = list_last_entry(&parent->mnt_mounts, -- struct mount, mnt_child); -- if (t->mnt_mp != p->mnt_mp) -- t = NULL; -- } -- attach_shadowed(q, parent, t); -+ attach_mnt(q, parent, p->mnt_mp); - unlock_mount_hash(); - } - } -@@ -1925,10 +1919,18 @@ static int attach_recursive_mnt(struct mount *source_mnt, - struct path *parent_path) - { - HLIST_HEAD(tree_list); -+ struct mountpoint *smp; - struct mount *child, *p; - struct hlist_node *n; - int err; - -+ /* Preallocate a mountpoint in case the new mounts need -+ * to be tucked under other mounts. -+ */ -+ smp = get_mountpoint(source_mnt->mnt.mnt_root); -+ if (IS_ERR(smp)) -+ return PTR_ERR(smp); -+ - if (IS_MNT_SHARED(dest_mnt)) { - err = invent_group_ids(source_mnt, true); - if (err) -@@ -1948,16 +1950,19 @@ static int attach_recursive_mnt(struct mount *source_mnt, - touch_mnt_namespace(source_mnt->mnt_ns); - } else { - mnt_set_mountpoint(dest_mnt, dest_mp, source_mnt); -- commit_tree(source_mnt, NULL); -+ commit_tree(source_mnt); - } - - hlist_for_each_entry_safe(child, n, &tree_list, mnt_hash) { - struct mount *q; - hlist_del_init(&child->mnt_hash); -- q = __lookup_mnt_last(&child->mnt_parent->mnt, -- child->mnt_mountpoint); -- commit_tree(child, q); -+ q = __lookup_mnt(&child->mnt_parent->mnt, -+ child->mnt_mountpoint); -+ if (q) -+ mnt_change_mountpoint(child, smp, q); -+ commit_tree(child); - } -+ put_mountpoint(smp); - unlock_mount_hash(); - - return 0; -@@ -1970,6 +1975,10 @@ static int attach_recursive_mnt(struct mount *source_mnt, - unlock_mount_hash(); - cleanup_group_ids(source_mnt, NULL); - out: -+ read_seqlock_excl(&mount_lock); -+ put_mountpoint(smp); -+ read_sequnlock_excl(&mount_lock); -+ - return err; - } - -diff --git a/fs/pnode.c b/fs/pnode.c -index 99899705b105..b9f2af59b9a6 100644 ---- a/fs/pnode.c -+++ b/fs/pnode.c -@@ -324,6 +324,21 @@ out: - return ret; - } - -+static struct mount *find_topper(struct mount *mnt) -+{ -+ /* If there is exactly one mount covering mnt completely return it. */ -+ struct mount *child; -+ -+ if (!list_is_singular(&mnt->mnt_mounts)) -+ return NULL; -+ -+ child = list_first_entry(&mnt->mnt_mounts, struct mount, mnt_child); -+ if (child->mnt_mountpoint != mnt->mnt.mnt_root) -+ return NULL; -+ -+ return child; -+} -+ - /* - * return true if the refcount is greater than count - */ -@@ -344,9 +359,8 @@ static inline int do_refcount_check(struct mount *mnt, int count) - */ - int propagate_mount_busy(struct mount *mnt, int refcnt) - { -- struct mount *m, *child; -+ struct mount *m, *child, *topper; - struct mount *parent = mnt->mnt_parent; -- int ret = 0; - - if (mnt == parent) - return do_refcount_check(mnt, refcnt); -@@ -361,12 +375,24 @@ int propagate_mount_busy(struct mount *mnt, int refcnt) - - for (m = propagation_next(parent, parent); m; - m = propagation_next(m, parent)) { -- child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint); -- if (child && list_empty(&child->mnt_mounts) && -- (ret = do_refcount_check(child, 1))) -- break; -+ int count = 1; -+ child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint); -+ if (!child) -+ continue; -+ -+ /* Is there exactly one mount on the child that covers -+ * it completely whose reference should be ignored? -+ */ -+ topper = find_topper(child); -+ if (topper) -+ count += 1; -+ else if (!list_empty(&child->mnt_mounts)) -+ continue; -+ -+ if (do_refcount_check(child, count)) -+ return 1; - } -- return ret; -+ return 0; - } - - /* -@@ -383,7 +409,7 @@ void propagate_mount_unlock(struct mount *mnt) - - for (m = propagation_next(parent, parent); m; - m = propagation_next(m, parent)) { -- child = __lookup_mnt_last(&m->mnt, mnt->mnt_mountpoint); -+ child = __lookup_mnt(&m->mnt, mnt->mnt_mountpoint); - if (child) - child->mnt.mnt_flags &= ~MNT_LOCKED; - } -@@ -401,9 +427,11 @@ static void mark_umount_candidates(struct mount *mnt) - - for (m = propagation_next(parent, parent); m; - m = propagation_next(m, parent)) { -- struct mount *child = __lookup_mnt_last(&m->mnt, -+ struct mount *child = __lookup_mnt(&m->mnt, - mnt->mnt_mountpoint); -- if (child && (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m))) { -+ if (!child || (child->mnt.mnt_flags & MNT_UMOUNT)) -+ continue; -+ if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) { - SET_MNT_MARK(child); - } - } -@@ -422,8 +450,8 @@ static void __propagate_umount(struct mount *mnt) - - for (m = propagation_next(parent, parent); m; - m = propagation_next(m, parent)) { -- -- struct mount *child = __lookup_mnt_last(&m->mnt, -+ struct mount *topper; -+ struct mount *child = __lookup_mnt(&m->mnt, - mnt->mnt_mountpoint); - /* - * umount the child only if the child has no children -@@ -432,6 +460,15 @@ static void __propagate_umount(struct mount *mnt) - if (!child || !IS_MNT_MARKED(child)) - continue; - CLEAR_MNT_MARK(child); -+ -+ /* If there is exactly one mount covering all of child -+ * replace child with that mount. -+ */ -+ topper = find_topper(child); -+ if (topper) -+ mnt_change_mountpoint(child->mnt_parent, child->mnt_mp, -+ topper); -+ - if (list_empty(&child->mnt_mounts)) { - list_del_init(&child->mnt_child); - child->mnt.mnt_flags |= MNT_UMOUNT; -diff --git a/fs/pnode.h b/fs/pnode.h -index 0fcdbe7ca648..623f01772bec 100644 ---- a/fs/pnode.h -+++ b/fs/pnode.h -@@ -49,6 +49,8 @@ int get_dominating_id(struct mount *mnt, const struct path *root); - unsigned int mnt_get_count(struct mount *mnt); - void mnt_set_mountpoint(struct mount *, struct mountpoint *, - struct mount *); -+void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, -+ struct mount *mnt); - struct mount *copy_tree(struct mount *, struct dentry *, int); - bool is_path_reachable(struct mount *, struct dentry *, - const struct path *root); -diff --git a/include/linux/ceph/osdmap.h b/include/linux/ceph/osdmap.h -index e55c08bc3a96..0abc56140c83 100644 ---- a/include/linux/ceph/osdmap.h -+++ b/include/linux/ceph/osdmap.h -@@ -49,7 +49,7 @@ static inline bool ceph_can_shift_osds(struct ceph_pg_pool_info *pool) - case CEPH_POOL_TYPE_EC: - return false; - default: -- BUG_ON(1); -+ BUG(); - } - } - -diff --git a/include/linux/lockd/lockd.h b/include/linux/lockd/lockd.h -index c15373894a42..b37dee3acaba 100644 ---- a/include/linux/lockd/lockd.h -+++ b/include/linux/lockd/lockd.h -@@ -355,7 +355,8 @@ static inline int nlm_privileged_requester(const struct svc_rqst *rqstp) - static inline int nlm_compare_locks(const struct file_lock *fl1, - const struct file_lock *fl2) - { -- return fl1->fl_pid == fl2->fl_pid -+ return file_inode(fl1->fl_file) == file_inode(fl2->fl_file) -+ && fl1->fl_pid == fl2->fl_pid - && fl1->fl_owner == fl2->fl_owner - && fl1->fl_start == fl2->fl_start - && fl1->fl_end == fl2->fl_end -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 800fe16cc36f..ed66414b91f0 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -740,6 +740,7 @@ struct se_lun { - struct config_group lun_group; - struct se_port_stat_grps port_stat_grps; - struct completion lun_ref_comp; -+ struct completion lun_shutdown_comp; - struct percpu_ref lun_ref; - struct list_head lun_dev_link; - struct hlist_node link; -diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c -index 00a43a70e1fc..0402fa45b343 100644 ---- a/net/mac80211/pm.c -+++ b/net/mac80211/pm.c -@@ -168,6 +168,7 @@ int __ieee80211_suspend(struct ieee80211_hw *hw, struct cfg80211_wowlan *wowlan) - break; - } - -+ flush_delayed_work(&sdata->dec_tailroom_needed_wk); - drv_remove_interface(local, sdata); - } - -diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl -index d08e214ec6e7..223d88e25e05 100755 ---- a/tools/testing/ktest/ktest.pl -+++ b/tools/testing/ktest/ktest.pl -@@ -2629,7 +2629,7 @@ sub do_run_test { - } - - waitpid $child_pid, 0; -- $child_exit = $?; -+ $child_exit = $? >> 8; - - my $end_time = time; - $test_time = $end_time - $start_time; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.54-55.patch b/patch/kernel/mvebu64-default/03-patch-4.4.54-55.patch deleted file mode 100644 index 5d29ecf30365..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.54-55.patch +++ /dev/null @@ -1,1203 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7f54ac081cf3..d9cc21df444d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 54 -+SUBLEVEL = 55 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/configs/ip22_defconfig b/arch/mips/configs/ip22_defconfig -index 57ed466e00db..2f140d75d01c 100644 ---- a/arch/mips/configs/ip22_defconfig -+++ b/arch/mips/configs/ip22_defconfig -@@ -68,8 +68,8 @@ CONFIG_NETFILTER_NETLINK_QUEUE=m - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig -index 48e16d98b2cc..b15508447366 100644 ---- a/arch/mips/configs/ip27_defconfig -+++ b/arch/mips/configs/ip27_defconfig -@@ -134,7 +134,7 @@ CONFIG_LIBFC=m - CONFIG_SCSI_QLOGIC_1280=y - CONFIG_SCSI_PMCRAID=m - CONFIG_SCSI_BFA_FC=m --CONFIG_SCSI_DH=m -+CONFIG_SCSI_DH=y - CONFIG_SCSI_DH_RDAC=m - CONFIG_SCSI_DH_HP_SW=m - CONFIG_SCSI_DH_EMC=m -@@ -206,7 +206,6 @@ CONFIG_MLX4_EN=m - # CONFIG_MLX4_DEBUG is not set - CONFIG_TEHUTI=m - CONFIG_BNX2X=m --CONFIG_QLGE=m - CONFIG_SFC=m - CONFIG_BE2NET=m - CONFIG_LIBERTAS_THINFIRM=m -diff --git a/arch/mips/configs/lemote2f_defconfig b/arch/mips/configs/lemote2f_defconfig -index 004cf52d1b7d..c24b87819ccb 100644 ---- a/arch/mips/configs/lemote2f_defconfig -+++ b/arch/mips/configs/lemote2f_defconfig -@@ -39,7 +39,7 @@ CONFIG_HIBERNATION=y - CONFIG_PM_STD_PARTITION="/dev/hda3" - CONFIG_CPU_FREQ=y - CONFIG_CPU_FREQ_DEBUG=y --CONFIG_CPU_FREQ_STAT=m -+CONFIG_CPU_FREQ_STAT=y - CONFIG_CPU_FREQ_STAT_DETAILS=y - CONFIG_CPU_FREQ_DEFAULT_GOV_ONDEMAND=y - CONFIG_CPU_FREQ_GOV_POWERSAVE=m -diff --git a/arch/mips/configs/malta_defconfig b/arch/mips/configs/malta_defconfig -index 5afb4840aec7..739ccd0dca64 100644 ---- a/arch/mips/configs/malta_defconfig -+++ b/arch/mips/configs/malta_defconfig -@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/malta_kvm_defconfig b/arch/mips/configs/malta_kvm_defconfig -index 98f13879bb8f..47f4ecf125ba 100644 ---- a/arch/mips/configs/malta_kvm_defconfig -+++ b/arch/mips/configs/malta_kvm_defconfig -@@ -60,8 +60,8 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/malta_kvm_guest_defconfig b/arch/mips/configs/malta_kvm_guest_defconfig -index 3b5d5913f548..e79d325aa085 100644 ---- a/arch/mips/configs/malta_kvm_guest_defconfig -+++ b/arch/mips/configs/malta_kvm_guest_defconfig -@@ -59,8 +59,8 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/maltaup_xpa_defconfig b/arch/mips/configs/maltaup_xpa_defconfig -index 732215732751..ae87ad86243b 100644 ---- a/arch/mips/configs/maltaup_xpa_defconfig -+++ b/arch/mips/configs/maltaup_xpa_defconfig -@@ -61,8 +61,8 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/nlm_xlp_defconfig b/arch/mips/configs/nlm_xlp_defconfig -index b3d1d37f85ea..47492fee2952 100644 ---- a/arch/mips/configs/nlm_xlp_defconfig -+++ b/arch/mips/configs/nlm_xlp_defconfig -@@ -111,7 +111,7 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/configs/nlm_xlr_defconfig b/arch/mips/configs/nlm_xlr_defconfig -index 3d8016d6cf3e..472a818f1eb8 100644 ---- a/arch/mips/configs/nlm_xlr_defconfig -+++ b/arch/mips/configs/nlm_xlr_defconfig -@@ -91,7 +91,7 @@ CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_SECMARK=y - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/mips/dec/int-handler.S b/arch/mips/dec/int-handler.S -index 8c6f508e59de..554d1da97743 100644 ---- a/arch/mips/dec/int-handler.S -+++ b/arch/mips/dec/int-handler.S -@@ -146,7 +146,25 @@ - /* - * Find irq with highest priority - */ -- PTR_LA t1,cpu_mask_nr_tbl -+ # open coded PTR_LA t1, cpu_mask_nr_tbl -+#if (_MIPS_SZPTR == 32) -+ # open coded la t1, cpu_mask_nr_tbl -+ lui t1, %hi(cpu_mask_nr_tbl) -+ addiu t1, %lo(cpu_mask_nr_tbl) -+ -+#endif -+#if (_MIPS_SZPTR == 64) -+ # open coded dla t1, cpu_mask_nr_tbl -+ .set push -+ .set noat -+ lui t1, %highest(cpu_mask_nr_tbl) -+ lui AT, %hi(cpu_mask_nr_tbl) -+ daddiu t1, t1, %higher(cpu_mask_nr_tbl) -+ daddiu AT, AT, %lo(cpu_mask_nr_tbl) -+ dsll t1, 32 -+ daddu t1, t1, AT -+ .set pop -+#endif - 1: lw t2,(t1) - nop - and t2,t0 -@@ -195,7 +213,25 @@ - /* - * Find irq with highest priority - */ -- PTR_LA t1,asic_mask_nr_tbl -+ # open coded PTR_LA t1,asic_mask_nr_tbl -+#if (_MIPS_SZPTR == 32) -+ # open coded la t1, asic_mask_nr_tbl -+ lui t1, %hi(asic_mask_nr_tbl) -+ addiu t1, %lo(asic_mask_nr_tbl) -+ -+#endif -+#if (_MIPS_SZPTR == 64) -+ # open coded dla t1, asic_mask_nr_tbl -+ .set push -+ .set noat -+ lui t1, %highest(asic_mask_nr_tbl) -+ lui AT, %hi(asic_mask_nr_tbl) -+ daddiu t1, t1, %higher(asic_mask_nr_tbl) -+ daddiu AT, AT, %lo(asic_mask_nr_tbl) -+ dsll t1, 32 -+ daddu t1, t1, AT -+ .set pop -+#endif - 2: lw t2,(t1) - nop - and t2,t0 -diff --git a/arch/mips/netlogic/common/reset.S b/arch/mips/netlogic/common/reset.S -index edbab9b8691f..c474981a6c0d 100644 ---- a/arch/mips/netlogic/common/reset.S -+++ b/arch/mips/netlogic/common/reset.S -@@ -50,7 +50,6 @@ - #include - #include - --#define CP0_EBASE $15 - #define SYS_CPU_COHERENT_BASE CKSEG1ADDR(XLP_DEFAULT_IO_BASE) + \ - XLP_IO_SYS_OFFSET(0) + XLP_IO_PCI_HDRSZ + \ - SYS_CPU_NONCOHERENT_MODE * 4 -@@ -92,7 +91,7 @@ - * registers. On XLPII CPUs, usual cache instructions work. - */ - .macro xlp_flush_l1_dcache -- mfc0 t0, CP0_EBASE, 0 -+ mfc0 t0, CP0_PRID - andi t0, t0, PRID_IMP_MASK - slt t1, t0, 0x1200 - beqz t1, 15f -@@ -171,7 +170,7 @@ FEXPORT(nlm_reset_entry) - nop - - 1: /* Entry point on core wakeup */ -- mfc0 t0, CP0_EBASE, 0 /* processor ID */ -+ mfc0 t0, CP0_PRID /* processor ID */ - andi t0, PRID_IMP_MASK - li t1, 0x1500 /* XLP 9xx */ - beq t0, t1, 2f /* does not need to set coherent */ -@@ -182,8 +181,8 @@ FEXPORT(nlm_reset_entry) - nop - - /* set bit in SYS coherent register for the core */ -- mfc0 t0, CP0_EBASE, 1 -- mfc0 t1, CP0_EBASE, 1 -+ mfc0 t0, CP0_EBASE -+ mfc0 t1, CP0_EBASE - srl t1, 5 - andi t1, 0x3 /* t1 <- node */ - li t2, 0x40000 -@@ -232,7 +231,7 @@ EXPORT(nlm_boot_siblings) - - * NOTE: All GPR contents are lost after the mtcr above! - */ -- mfc0 v0, CP0_EBASE, 1 -+ mfc0 v0, CP0_EBASE - andi v0, 0x3ff /* v0 <- node/core */ - - /* -diff --git a/arch/mips/netlogic/common/smpboot.S b/arch/mips/netlogic/common/smpboot.S -index 805355b0bd05..f0cc4c9de2bb 100644 ---- a/arch/mips/netlogic/common/smpboot.S -+++ b/arch/mips/netlogic/common/smpboot.S -@@ -48,8 +48,6 @@ - #include - #include - --#define CP0_EBASE $15 -- - .set noreorder - .set noat - .set arch=xlr /* for mfcr/mtcr, XLR is sufficient */ -@@ -86,7 +84,7 @@ NESTED(nlm_boot_secondary_cpus, 16, sp) - PTR_L gp, 0(t1) - - /* a0 has the processor id */ -- mfc0 a0, CP0_EBASE, 1 -+ mfc0 a0, CP0_EBASE - andi a0, 0x3ff /* a0 <- node/core */ - PTR_LA t0, nlm_early_init_secondary - jalr t0 -diff --git a/arch/mips/ralink/prom.c b/arch/mips/ralink/prom.c -index 39a9142f71be..7ecb4af79b7b 100644 ---- a/arch/mips/ralink/prom.c -+++ b/arch/mips/ralink/prom.c -@@ -30,8 +30,10 @@ const char *get_system_type(void) - return soc_info.sys_type; - } - --static __init void prom_init_cmdline(int argc, char **argv) -+static __init void prom_init_cmdline(void) - { -+ int argc; -+ char **argv; - int i; - - pr_debug("prom: fw_arg0=%08x fw_arg1=%08x fw_arg2=%08x fw_arg3=%08x\n", -@@ -60,14 +62,11 @@ static __init void prom_init_cmdline(int argc, char **argv) - - void __init prom_init(void) - { -- int argc; -- char **argv; -- - prom_soc_init(&soc_info); - - pr_info("SoC Type: %s\n", get_system_type()); - -- prom_init_cmdline(argc, argv); -+ prom_init_cmdline(); - } - - void __init prom_free_prom_memory(void) -diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c -index 844f5cd55c8f..15506a1ff22a 100644 ---- a/arch/mips/ralink/rt288x.c -+++ b/arch/mips/ralink/rt288x.c -@@ -40,16 +40,6 @@ static struct rt2880_pmx_group rt2880_pinmux_data_act[] = { - { 0 } - }; - --static void rt288x_wdt_reset(void) --{ -- u32 t; -- -- /* enable WDT reset output on pin SRAM_CS_N */ -- t = rt_sysc_r32(SYSC_REG_CLKCFG); -- t |= CLKCFG_SRAM_CS_N_WDT; -- rt_sysc_w32(t, SYSC_REG_CLKCFG); --} -- - void __init ralink_clk_init(void) - { - unsigned long cpu_rate, wmac_rate = 40000000; -diff --git a/arch/mips/ralink/rt305x.c b/arch/mips/ralink/rt305x.c -index 9e4572592065..15b32cd01906 100644 ---- a/arch/mips/ralink/rt305x.c -+++ b/arch/mips/ralink/rt305x.c -@@ -89,17 +89,6 @@ static struct rt2880_pmx_group rt5350_pinmux_data[] = { - { 0 } - }; - --static void rt305x_wdt_reset(void) --{ -- u32 t; -- -- /* enable WDT reset output on pin SRAM_CS_N */ -- t = rt_sysc_r32(SYSC_REG_SYSTEM_CONFIG); -- t |= RT305X_SYSCFG_SRAM_CS0_MODE_WDT << -- RT305X_SYSCFG_SRAM_CS0_MODE_SHIFT; -- rt_sysc_w32(t, SYSC_REG_SYSTEM_CONFIG); --} -- - static unsigned long rt5350_get_mem_size(void) - { - void __iomem *sysc = (void __iomem *) KSEG1ADDR(RT305X_SYSC_BASE); -diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c -index 582995aaaf4e..f42834c7f007 100644 ---- a/arch/mips/ralink/rt3883.c -+++ b/arch/mips/ralink/rt3883.c -@@ -63,16 +63,6 @@ static struct rt2880_pmx_group rt3883_pinmux_data[] = { - { 0 } - }; - --static void rt3883_wdt_reset(void) --{ -- u32 t; -- -- /* enable WDT reset output on GPIO 2 */ -- t = rt_sysc_r32(RT3883_SYSC_REG_SYSCFG1); -- t |= RT3883_SYSCFG1_GPIO2_AS_WDT_OUT; -- rt_sysc_w32(t, RT3883_SYSC_REG_SYSCFG1); --} -- - void __init ralink_clk_init(void) - { - unsigned long cpu_rate, sys_rate; -diff --git a/arch/mips/sgi-ip22/Platform b/arch/mips/sgi-ip22/Platform -index b7a4b7e04c38..e8f6b3a42a48 100644 ---- a/arch/mips/sgi-ip22/Platform -+++ b/arch/mips/sgi-ip22/Platform -@@ -25,7 +25,7 @@ endif - # Simplified: what IP22 does at 128MB+ in ksegN, IP28 does at 512MB+ in xkphys - # - ifdef CONFIG_SGI_IP28 -- ifeq ($(call cc-option-yn,-mr10k-cache-barrier=store), n) -+ ifeq ($(call cc-option-yn,-march=r10000 -mr10k-cache-barrier=store), n) - $(error gcc doesn't support needed option -mr10k-cache-barrier=store) - endif - endif -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index dc885b30f7a6..4014881e9843 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -1806,8 +1806,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - goto instr_done; - - case LARX: -- if (regs->msr & MSR_LE) -- return 0; - if (op.ea & (size - 1)) - break; /* can't handle misaligned */ - err = -EFAULT; -@@ -1829,8 +1827,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - goto ldst_done; - - case STCX: -- if (regs->msr & MSR_LE) -- return 0; - if (op.ea & (size - 1)) - break; /* can't handle misaligned */ - err = -EFAULT; -@@ -1854,8 +1850,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - goto ldst_done; - - case LOAD: -- if (regs->msr & MSR_LE) -- return 0; - err = read_mem(®s->gpr[op.reg], op.ea, size, regs); - if (!err) { - if (op.type & SIGNEXT) -@@ -1867,8 +1861,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - - #ifdef CONFIG_PPC_FPU - case LOAD_FP: -- if (regs->msr & MSR_LE) -- return 0; - if (size == 4) - err = do_fp_load(op.reg, do_lfs, op.ea, size, regs); - else -@@ -1877,15 +1869,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - #endif - #ifdef CONFIG_ALTIVEC - case LOAD_VMX: -- if (regs->msr & MSR_LE) -- return 0; - err = do_vec_load(op.reg, do_lvx, op.ea & ~0xfUL, regs); - goto ldst_done; - #endif - #ifdef CONFIG_VSX - case LOAD_VSX: -- if (regs->msr & MSR_LE) -- return 0; - err = do_vsx_load(op.reg, do_lxvd2x, op.ea, regs); - goto ldst_done; - #endif -@@ -1908,8 +1896,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - goto instr_done; - - case STORE: -- if (regs->msr & MSR_LE) -- return 0; - if ((op.type & UPDATE) && size == sizeof(long) && - op.reg == 1 && op.update_reg == 1 && - !(regs->msr & MSR_PR) && -@@ -1922,8 +1908,6 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - - #ifdef CONFIG_PPC_FPU - case STORE_FP: -- if (regs->msr & MSR_LE) -- return 0; - if (size == 4) - err = do_fp_store(op.reg, do_stfs, op.ea, size, regs); - else -@@ -1932,15 +1916,11 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) - #endif - #ifdef CONFIG_ALTIVEC - case STORE_VMX: -- if (regs->msr & MSR_LE) -- return 0; - err = do_vec_store(op.reg, do_stvx, op.ea & ~0xfUL, regs); - goto ldst_done; - #endif - #ifdef CONFIG_VSX - case STORE_VSX: -- if (regs->msr & MSR_LE) -- return 0; - err = do_vsx_store(op.reg, do_stxvd2x, op.ea, regs); - goto ldst_done; - #endif -diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c -index 171e09bb8ea2..f7c3a61040bd 100644 ---- a/arch/s390/kernel/crash_dump.c -+++ b/arch/s390/kernel/crash_dump.c -@@ -23,6 +23,8 @@ - #define PTR_SUB(x, y) (((char *) (x)) - ((unsigned long) (y))) - #define PTR_DIFF(x, y) ((unsigned long)(((char *) (x)) - ((unsigned long) (y)))) - -+#define LINUX_NOTE_NAME "LINUX" -+ - static struct memblock_region oldmem_region; - - static struct memblock_type oldmem_type = { -@@ -312,7 +314,7 @@ static void *nt_fpregset(void *ptr, struct save_area *sa) - static void *nt_s390_timer(void *ptr, struct save_area *sa) - { - return nt_init(ptr, NT_S390_TIMER, &sa->timer, sizeof(sa->timer), -- KEXEC_CORE_NOTE_NAME); -+ LINUX_NOTE_NAME); - } - - /* -@@ -321,7 +323,7 @@ static void *nt_s390_timer(void *ptr, struct save_area *sa) - static void *nt_s390_tod_cmp(void *ptr, struct save_area *sa) - { - return nt_init(ptr, NT_S390_TODCMP, &sa->clk_cmp, -- sizeof(sa->clk_cmp), KEXEC_CORE_NOTE_NAME); -+ sizeof(sa->clk_cmp), LINUX_NOTE_NAME); - } - - /* -@@ -330,7 +332,7 @@ static void *nt_s390_tod_cmp(void *ptr, struct save_area *sa) - static void *nt_s390_tod_preg(void *ptr, struct save_area *sa) - { - return nt_init(ptr, NT_S390_TODPREG, &sa->tod_reg, -- sizeof(sa->tod_reg), KEXEC_CORE_NOTE_NAME); -+ sizeof(sa->tod_reg), LINUX_NOTE_NAME); - } - - /* -@@ -339,7 +341,7 @@ static void *nt_s390_tod_preg(void *ptr, struct save_area *sa) - static void *nt_s390_ctrs(void *ptr, struct save_area *sa) - { - return nt_init(ptr, NT_S390_CTRS, &sa->ctrl_regs, -- sizeof(sa->ctrl_regs), KEXEC_CORE_NOTE_NAME); -+ sizeof(sa->ctrl_regs), LINUX_NOTE_NAME); - } - - /* -@@ -348,7 +350,7 @@ static void *nt_s390_ctrs(void *ptr, struct save_area *sa) - static void *nt_s390_prefix(void *ptr, struct save_area *sa) - { - return nt_init(ptr, NT_S390_PREFIX, &sa->pref_reg, -- sizeof(sa->pref_reg), KEXEC_CORE_NOTE_NAME); -+ sizeof(sa->pref_reg), LINUX_NOTE_NAME); - } - - /* -@@ -357,7 +359,7 @@ static void *nt_s390_prefix(void *ptr, struct save_area *sa) - static void *nt_s390_vx_high(void *ptr, __vector128 *vx_regs) - { - return nt_init(ptr, NT_S390_VXRS_HIGH, &vx_regs[16], -- 16 * sizeof(__vector128), KEXEC_CORE_NOTE_NAME); -+ 16 * sizeof(__vector128), LINUX_NOTE_NAME); - } - - /* -@@ -370,12 +372,12 @@ static void *nt_s390_vx_low(void *ptr, __vector128 *vx_regs) - int i; - - note = (Elf64_Nhdr *)ptr; -- note->n_namesz = strlen(KEXEC_CORE_NOTE_NAME) + 1; -+ note->n_namesz = strlen(LINUX_NOTE_NAME) + 1; - note->n_descsz = 16 * 8; - note->n_type = NT_S390_VXRS_LOW; - len = sizeof(Elf64_Nhdr); - -- memcpy(ptr + len, KEXEC_CORE_NOTE_NAME, note->n_namesz); -+ memcpy(ptr + len, LINUX_NOTE_NAME, note->n_namesz); - len = roundup(len + note->n_namesz, 4); - - ptr += len; -diff --git a/arch/s390/mm/pgtable.c b/arch/s390/mm/pgtable.c -index 8345ae1f117d..05ae254f84cf 100644 ---- a/arch/s390/mm/pgtable.c -+++ b/arch/s390/mm/pgtable.c -@@ -1237,11 +1237,28 @@ EXPORT_SYMBOL_GPL(s390_reset_cmma); - */ - bool gmap_test_and_clear_dirty(unsigned long address, struct gmap *gmap) - { -+ pgd_t *pgd; -+ pud_t *pud; -+ pmd_t *pmd; - pte_t *pte; - spinlock_t *ptl; - bool dirty = false; - -- pte = get_locked_pte(gmap->mm, address, &ptl); -+ pgd = pgd_offset(gmap->mm, address); -+ pud = pud_alloc(gmap->mm, pgd, address); -+ if (!pud) -+ return false; -+ pmd = pmd_alloc(gmap->mm, pud, address); -+ if (!pmd) -+ return false; -+ /* We can't run guests backed by huge pages, but userspace can -+ * still set them up and then try to migrate them without any -+ * migration support. -+ */ -+ if (pmd_large(*pmd)) -+ return true; -+ -+ pte = pte_alloc_map_lock(gmap->mm, pmd, address, &ptl); - if (unlikely(!pte)) - return false; - -diff --git a/crypto/Makefile b/crypto/Makefile -index 82fbff180ad3..03e66097eb0c 100644 ---- a/crypto/Makefile -+++ b/crypto/Makefile -@@ -62,6 +62,7 @@ obj-$(CONFIG_CRYPTO_SHA1) += sha1_generic.o - obj-$(CONFIG_CRYPTO_SHA256) += sha256_generic.o - obj-$(CONFIG_CRYPTO_SHA512) += sha512_generic.o - obj-$(CONFIG_CRYPTO_WP512) += wp512.o -+CFLAGS_wp512.o := $(call cc-option,-fno-schedule-insns) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 - obj-$(CONFIG_CRYPTO_TGR192) += tgr192.o - obj-$(CONFIG_CRYPTO_GF128MUL) += gf128mul.o - obj-$(CONFIG_CRYPTO_ECB) += ecb.o -@@ -85,6 +86,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH_COMMON) += blowfish_common.o - obj-$(CONFIG_CRYPTO_TWOFISH) += twofish_generic.o - obj-$(CONFIG_CRYPTO_TWOFISH_COMMON) += twofish_common.o - obj-$(CONFIG_CRYPTO_SERPENT) += serpent_generic.o -+CFLAGS_serpent_generic.o := $(call cc-option,-fsched-pressure) # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=79149 - obj-$(CONFIG_CRYPTO_AES) += aes_generic.o - obj-$(CONFIG_CRYPTO_CAMELLIA) += camellia_generic.o - obj-$(CONFIG_CRYPTO_CAST_COMMON) += cast_common.o -diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c -index c097f477c74c..14c2a07c9f3f 100644 ---- a/drivers/acpi/nfit.c -+++ b/drivers/acpi/nfit.c -@@ -965,7 +965,7 @@ static size_t sizeof_nfit_set_info(int num_mappings) - + num_mappings * sizeof(struct nfit_set_info_map); - } - --static int cmp_map(const void *m0, const void *m1) -+static int cmp_map_compat(const void *m0, const void *m1) - { - const struct nfit_set_info_map *map0 = m0; - const struct nfit_set_info_map *map1 = m1; -@@ -974,6 +974,14 @@ static int cmp_map(const void *m0, const void *m1) - sizeof(u64)); - } - -+static int cmp_map(const void *m0, const void *m1) -+{ -+ const struct nfit_set_info_map *map0 = m0; -+ const struct nfit_set_info_map *map1 = m1; -+ -+ return map0->region_offset - map1->region_offset; -+} -+ - /* Retrieve the nth entry referencing this spa */ - static struct acpi_nfit_memory_map *memdev_from_spa( - struct acpi_nfit_desc *acpi_desc, u16 range_index, int n) -@@ -1029,6 +1037,12 @@ static int acpi_nfit_init_interleave_set(struct acpi_nfit_desc *acpi_desc, - sort(&info->mapping[0], nr, sizeof(struct nfit_set_info_map), - cmp_map, NULL); - nd_set->cookie = nd_fletcher64(info, sizeof_nfit_set_info(nr), 0); -+ -+ /* support namespaces created with the wrong sort order */ -+ sort(&info->mapping[0], nr, sizeof(struct nfit_set_info_map), -+ cmp_map_compat, NULL); -+ nd_set->altcookie = nd_fletcher64(info, sizeof_nfit_set_info(nr), 0); -+ - ndr_desc->nd_set = nd_set; - devm_kfree(dev, info); - -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 3384a3eef917..397f0454100b 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -1467,11 +1467,62 @@ void dm_accept_partial_bio(struct bio *bio, unsigned n_sectors) - } - EXPORT_SYMBOL_GPL(dm_accept_partial_bio); - -+/* -+ * Flush current->bio_list when the target map method blocks. -+ * This fixes deadlocks in snapshot and possibly in other targets. -+ */ -+struct dm_offload { -+ struct blk_plug plug; -+ struct blk_plug_cb cb; -+}; -+ -+static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule) -+{ -+ struct dm_offload *o = container_of(cb, struct dm_offload, cb); -+ struct bio_list list; -+ struct bio *bio; -+ -+ INIT_LIST_HEAD(&o->cb.list); -+ -+ if (unlikely(!current->bio_list)) -+ return; -+ -+ list = *current->bio_list; -+ bio_list_init(current->bio_list); -+ -+ while ((bio = bio_list_pop(&list))) { -+ struct bio_set *bs = bio->bi_pool; -+ if (unlikely(!bs) || bs == fs_bio_set) { -+ bio_list_add(current->bio_list, bio); -+ continue; -+ } -+ -+ spin_lock(&bs->rescue_lock); -+ bio_list_add(&bs->rescue_list, bio); -+ queue_work(bs->rescue_workqueue, &bs->rescue_work); -+ spin_unlock(&bs->rescue_lock); -+ } -+} -+ -+static void dm_offload_start(struct dm_offload *o) -+{ -+ blk_start_plug(&o->plug); -+ o->cb.callback = flush_current_bio_list; -+ list_add(&o->cb.list, ¤t->plug->cb_list); -+} -+ -+static void dm_offload_end(struct dm_offload *o) -+{ -+ list_del(&o->cb.list); -+ blk_finish_plug(&o->plug); -+} -+ - static void __map_bio(struct dm_target_io *tio) - { - int r; - sector_t sector; - struct mapped_device *md; -+ struct dm_offload o; - struct bio *clone = &tio->clone; - struct dm_target *ti = tio->ti; - -@@ -1484,7 +1535,11 @@ static void __map_bio(struct dm_target_io *tio) - */ - atomic_inc(&tio->io->io_count); - sector = clone->bi_iter.bi_sector; -+ -+ dm_offload_start(&o); - r = ti->type->map(ti, clone); -+ dm_offload_end(&o); -+ - if (r == DM_MAPIO_REMAPPED) { - /* the bio has been remapped so dispatch it */ - -diff --git a/drivers/mtd/maps/pmcmsp-flash.c b/drivers/mtd/maps/pmcmsp-flash.c -index f9fa3fad728e..2051f28ddac6 100644 ---- a/drivers/mtd/maps/pmcmsp-flash.c -+++ b/drivers/mtd/maps/pmcmsp-flash.c -@@ -139,15 +139,13 @@ static int __init init_msp_flash(void) - } - - msp_maps[i].bankwidth = 1; -- msp_maps[i].name = kmalloc(7, GFP_KERNEL); -+ msp_maps[i].name = kstrndup(flash_name, 7, GFP_KERNEL); - if (!msp_maps[i].name) { - iounmap(msp_maps[i].virt); - kfree(msp_parts[i]); - goto cleanup_loop; - } - -- msp_maps[i].name = strncpy(msp_maps[i].name, flash_name, 7); -- - for (j = 0; j < pcnt; j++) { - part_name[5] = '0' + i; - part_name[7] = '0' + j; -diff --git a/drivers/net/ethernet/ti/cpmac.c b/drivers/net/ethernet/ti/cpmac.c -index d52ea3008946..7e8bce46e6b4 100644 ---- a/drivers/net/ethernet/ti/cpmac.c -+++ b/drivers/net/ethernet/ti/cpmac.c -@@ -1237,7 +1237,7 @@ int cpmac_init(void) - goto fail_alloc; - } - --#warning FIXME: unhardcode gpio&reset bits -+ /* FIXME: unhardcode gpio&reset bits */ - ar7_gpio_disable(26); - ar7_gpio_disable(27); - ar7_device_reset(AR7_RESET_BIT_CPMAC_LO); -diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c -index 62120c38d56b..aae7379af4e4 100644 ---- a/drivers/nvdimm/namespace_devs.c -+++ b/drivers/nvdimm/namespace_devs.c -@@ -1534,6 +1534,7 @@ static int select_pmem_id(struct nd_region *nd_region, u8 *pmem_id) - static int find_pmem_label_set(struct nd_region *nd_region, - struct nd_namespace_pmem *nspm) - { -+ u64 altcookie = nd_region_interleave_set_altcookie(nd_region); - u64 cookie = nd_region_interleave_set_cookie(nd_region); - struct nd_namespace_label *nd_label; - u8 select_id[NSLABEL_UUID_LEN]; -@@ -1542,8 +1543,10 @@ static int find_pmem_label_set(struct nd_region *nd_region, - int rc = -ENODEV, l; - u16 i; - -- if (cookie == 0) -+ if (cookie == 0) { -+ dev_dbg(&nd_region->dev, "invalid interleave-set-cookie\n"); - return -ENXIO; -+ } - - /* - * Find a complete set of labels by uuid. By definition we can start -@@ -1552,13 +1555,24 @@ static int find_pmem_label_set(struct nd_region *nd_region, - for_each_label(l, nd_label, nd_region->mapping[0].labels) { - u64 isetcookie = __le64_to_cpu(nd_label->isetcookie); - -- if (isetcookie != cookie) -- continue; -+ if (isetcookie != cookie) { -+ dev_dbg(&nd_region->dev, "invalid cookie in label: %pUb\n", -+ nd_label->uuid); -+ if (isetcookie != altcookie) -+ continue; -+ -+ dev_dbg(&nd_region->dev, "valid altcookie in label: %pUb\n", -+ nd_label->uuid); -+ } -+ -+ for (i = 0; nd_region->ndr_mappings; i++) { -+ if (has_uuid_at_pos(nd_region, nd_label->uuid, cookie, i)) -+ continue; -+ if (has_uuid_at_pos(nd_region, nd_label->uuid, altcookie, i)) -+ continue; -+ break; -+ } - -- for (i = 0; nd_region->ndr_mappings; i++) -- if (!has_uuid_at_pos(nd_region, nd_label->uuid, -- cookie, i)) -- break; - if (i < nd_region->ndr_mappings) { - /* - * Give up if we don't find an instance of a -diff --git a/drivers/nvdimm/nd.h b/drivers/nvdimm/nd.h -index 417e521d299c..fc870e55bb66 100644 ---- a/drivers/nvdimm/nd.h -+++ b/drivers/nvdimm/nd.h -@@ -245,6 +245,7 @@ struct nd_region *to_nd_region(struct device *dev); - int nd_region_to_nstype(struct nd_region *nd_region); - int nd_region_register_namespaces(struct nd_region *nd_region, int *err); - u64 nd_region_interleave_set_cookie(struct nd_region *nd_region); -+u64 nd_region_interleave_set_altcookie(struct nd_region *nd_region); - void nvdimm_bus_lock(struct device *dev); - void nvdimm_bus_unlock(struct device *dev); - bool is_nvdimm_bus_locked(struct device *dev); -diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c -index 9521696c9385..dc2e919daa39 100644 ---- a/drivers/nvdimm/region_devs.c -+++ b/drivers/nvdimm/region_devs.c -@@ -379,6 +379,15 @@ u64 nd_region_interleave_set_cookie(struct nd_region *nd_region) - return 0; - } - -+u64 nd_region_interleave_set_altcookie(struct nd_region *nd_region) -+{ -+ struct nd_interleave_set *nd_set = nd_region->nd_set; -+ -+ if (nd_set) -+ return nd_set->altcookie; -+ return 0; -+} -+ - /* - * Upon successful probe/remove, take/release a reference on the - * associated interleave set (if present), and plant new btt + namespace -diff --git a/drivers/scsi/mvsas/mv_sas.c b/drivers/scsi/mvsas/mv_sas.c -index 9c780740fb82..e712fe745955 100644 ---- a/drivers/scsi/mvsas/mv_sas.c -+++ b/drivers/scsi/mvsas/mv_sas.c -@@ -737,8 +737,8 @@ static int mvs_task_prep(struct sas_task *task, struct mvs_info *mvi, int is_tmf - mv_dprintk("device %016llx not ready.\n", - SAS_ADDR(dev->sas_addr)); - -- rc = SAS_PHY_DOWN; -- return rc; -+ rc = SAS_PHY_DOWN; -+ return rc; - } - tei.port = dev->port->lldd_port; - if (tei.port && !tei.port->port_attached && !tmf) { -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 237ef5573c18..6deb06147202 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -1030,8 +1030,10 @@ static int s3c64xx_serial_startup(struct uart_port *port) - if (ourport->dma) { - ret = s3c24xx_serial_request_dma(ourport); - if (ret < 0) { -- dev_warn(port->dev, "DMA request failed\n"); -- return ret; -+ dev_warn(port->dev, -+ "DMA request failed, DMA will not be used\n"); -+ devm_kfree(port->dev, ourport->dma); -+ ourport->dma = NULL; - } - } - -diff --git a/drivers/usb/dwc3/gadget.h b/drivers/usb/dwc3/gadget.h -index 18ae3eaa8b6f..ccd9694f8e36 100644 ---- a/drivers/usb/dwc3/gadget.h -+++ b/drivers/usb/dwc3/gadget.h -@@ -28,23 +28,23 @@ struct dwc3; - #define gadget_to_dwc(g) (container_of(g, struct dwc3, gadget)) - - /* DEPCFG parameter 1 */ --#define DWC3_DEPCFG_INT_NUM(n) ((n) << 0) -+#define DWC3_DEPCFG_INT_NUM(n) (((n) & 0x1f) << 0) - #define DWC3_DEPCFG_XFER_COMPLETE_EN (1 << 8) - #define DWC3_DEPCFG_XFER_IN_PROGRESS_EN (1 << 9) - #define DWC3_DEPCFG_XFER_NOT_READY_EN (1 << 10) - #define DWC3_DEPCFG_FIFO_ERROR_EN (1 << 11) - #define DWC3_DEPCFG_STREAM_EVENT_EN (1 << 13) --#define DWC3_DEPCFG_BINTERVAL_M1(n) ((n) << 16) -+#define DWC3_DEPCFG_BINTERVAL_M1(n) (((n) & 0xff) << 16) - #define DWC3_DEPCFG_STREAM_CAPABLE (1 << 24) --#define DWC3_DEPCFG_EP_NUMBER(n) ((n) << 25) -+#define DWC3_DEPCFG_EP_NUMBER(n) (((n) & 0x1f) << 25) - #define DWC3_DEPCFG_BULK_BASED (1 << 30) - #define DWC3_DEPCFG_FIFO_BASED (1 << 31) - - /* DEPCFG parameter 0 */ --#define DWC3_DEPCFG_EP_TYPE(n) ((n) << 1) --#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) ((n) << 3) --#define DWC3_DEPCFG_FIFO_NUMBER(n) ((n) << 17) --#define DWC3_DEPCFG_BURST_SIZE(n) ((n) << 22) -+#define DWC3_DEPCFG_EP_TYPE(n) (((n) & 0x3) << 1) -+#define DWC3_DEPCFG_MAX_PACKET_SIZE(n) (((n) & 0x7ff) << 3) -+#define DWC3_DEPCFG_FIFO_NUMBER(n) (((n) & 0x1f) << 17) -+#define DWC3_DEPCFG_BURST_SIZE(n) (((n) & 0xf) << 22) - #define DWC3_DEPCFG_DATA_SEQ_NUM(n) ((n) << 26) - /* This applies for core versions earlier than 1.94a */ - #define DWC3_DEPCFG_IGN_SEQ_NUM (1 << 31) -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index cfda1a1c0ab6..9ad5145d3103 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1643,11 +1643,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) - spin_lock_irqsave(&func->ffs->eps_lock, flags); - do { - struct usb_endpoint_descriptor *ds; -+ struct usb_ss_ep_comp_descriptor *comp_desc = NULL; -+ int needs_comp_desc = false; - int desc_idx; - -- if (ffs->gadget->speed == USB_SPEED_SUPER) -+ if (ffs->gadget->speed == USB_SPEED_SUPER) { - desc_idx = 2; -- else if (ffs->gadget->speed == USB_SPEED_HIGH) -+ needs_comp_desc = true; -+ } else if (ffs->gadget->speed == USB_SPEED_HIGH) - desc_idx = 1; - else - desc_idx = 0; -@@ -1664,6 +1667,14 @@ static int ffs_func_eps_enable(struct ffs_function *func) - - ep->ep->driver_data = ep; - ep->ep->desc = ds; -+ -+ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + -+ USB_DT_ENDPOINT_SIZE); -+ ep->ep->maxburst = comp_desc->bMaxBurst + 1; -+ -+ if (needs_comp_desc) -+ ep->ep->comp_desc = comp_desc; -+ - ret = usb_ep_enable(ep->ep); - if (likely(!ret)) { - epfile->ep = ep; -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index 22d067cd5aa3..6610f7a023d3 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -1033,6 +1033,8 @@ static int dummy_udc_probe(struct platform_device *pdev) - int rc; - - dum = *((void **)dev_get_platdata(&pdev->dev)); -+ /* Clear usb_gadget region for new registration to udc-core */ -+ memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); - dum->gadget.name = gadget_name; - dum->gadget.ops = &dummy_ops; - dum->gadget.max_speed = USB_SPEED_SUPER; -diff --git a/drivers/usb/host/xhci-dbg.c b/drivers/usb/host/xhci-dbg.c -index 74c42f722678..3425154baf8b 100644 ---- a/drivers/usb/host/xhci-dbg.c -+++ b/drivers/usb/host/xhci-dbg.c -@@ -111,7 +111,7 @@ static void xhci_print_cap_regs(struct xhci_hcd *xhci) - xhci_dbg(xhci, "RTSOFF 0x%x:\n", temp & RTSOFF_MASK); - - /* xhci 1.1 controllers have the HCCPARAMS2 register */ -- if (hci_version > 100) { -+ if (hci_version > 0x100) { - temp = readl(&xhci->cap_regs->hcc_params2); - xhci_dbg(xhci, "HCC PARAMS2 0x%x:\n", (unsigned int) temp); - xhci_dbg(xhci, " HC %s Force save context capability", -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index 1950e87b4219..775690bed4c0 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -787,12 +787,6 @@ static int iowarrior_probe(struct usb_interface *interface, - iface_desc = interface->cur_altsetting; - dev->product_id = le16_to_cpu(udev->descriptor.idProduct); - -- if (iface_desc->desc.bNumEndpoints < 1) { -- dev_err(&interface->dev, "Invalid number of endpoints\n"); -- retval = -EINVAL; -- goto error; -- } -- - /* set up the endpoint information */ - for (i = 0; i < iface_desc->desc.bNumEndpoints; ++i) { - endpoint = &iface_desc->endpoint[i].desc; -@@ -803,6 +797,21 @@ static int iowarrior_probe(struct usb_interface *interface, - /* this one will match for the IOWarrior56 only */ - dev->int_out_endpoint = endpoint; - } -+ -+ if (!dev->int_in_endpoint) { -+ dev_err(&interface->dev, "no interrupt-in endpoint found\n"); -+ retval = -ENODEV; -+ goto error; -+ } -+ -+ if (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) { -+ if (!dev->int_out_endpoint) { -+ dev_err(&interface->dev, "no interrupt-out endpoint found\n"); -+ retval = -ENODEV; -+ goto error; -+ } -+ } -+ - /* we have to check the report_size often, so remember it in the endianness suitable for our machine */ - dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint); - if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) && -diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c -index 3df7b7ec178e..e0b1fe2f60e1 100644 ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1483,16 +1483,20 @@ static int digi_read_oob_callback(struct urb *urb) - struct usb_serial *serial = port->serial; - struct tty_struct *tty; - struct digi_port *priv = usb_get_serial_port_data(port); -+ unsigned char *buf = urb->transfer_buffer; - int opcode, line, status, val; - int i; - unsigned int rts; - -+ if (urb->actual_length < 4) -+ return -1; -+ - /* handle each oob command */ -- for (i = 0; i < urb->actual_length - 3;) { -- opcode = ((unsigned char *)urb->transfer_buffer)[i++]; -- line = ((unsigned char *)urb->transfer_buffer)[i++]; -- status = ((unsigned char *)urb->transfer_buffer)[i++]; -- val = ((unsigned char *)urb->transfer_buffer)[i++]; -+ for (i = 0; i < urb->actual_length - 3; i += 4) { -+ opcode = buf[i]; -+ line = buf[i + 1]; -+ status = buf[i + 2]; -+ val = buf[i + 3]; - - dev_dbg(&port->dev, "digi_read_oob_callback: opcode=%d, line=%d, status=%d, val=%d\n", - opcode, line, status, val); -diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c -index c02808a30436..f1a8fdcd8674 100644 ---- a/drivers/usb/serial/io_ti.c -+++ b/drivers/usb/serial/io_ti.c -@@ -1674,6 +1674,12 @@ static void edge_interrupt_callback(struct urb *urb) - function = TIUMP_GET_FUNC_FROM_CODE(data[0]); - dev_dbg(dev, "%s - port_number %d, function %d, info 0x%x\n", __func__, - port_number, function, data[1]); -+ -+ if (port_number >= edge_serial->serial->num_ports) { -+ dev_err(dev, "bad port number %d\n", port_number); -+ goto exit; -+ } -+ - port = edge_serial->serial->port[port_number]; - edge_port = usb_get_serial_port_data(port); - if (!edge_port) { -@@ -1755,7 +1761,7 @@ static void edge_bulk_in_callback(struct urb *urb) - - port_number = edge_port->port->port_number; - -- if (edge_port->lsr_event) { -+ if (urb->actual_length > 0 && edge_port->lsr_event) { - edge_port->lsr_event = 0; - dev_dbg(dev, "%s ===== Port %u LSR Status = %02x, Data = %02x ======\n", - __func__, port_number, edge_port->lsr_mask, *data); -diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c -index a180b17d2432..76564b3bebb9 100644 ---- a/drivers/usb/serial/omninet.c -+++ b/drivers/usb/serial/omninet.c -@@ -142,12 +142,6 @@ static int omninet_port_remove(struct usb_serial_port *port) - - static int omninet_open(struct tty_struct *tty, struct usb_serial_port *port) - { -- struct usb_serial *serial = port->serial; -- struct usb_serial_port *wport; -- -- wport = serial->port[1]; -- tty_port_tty_set(&wport->port, tty); -- - return usb_serial_generic_open(tty, port); - } - -diff --git a/drivers/usb/serial/safe_serial.c b/drivers/usb/serial/safe_serial.c -index b2dff0f14743..236ea43f7815 100644 ---- a/drivers/usb/serial/safe_serial.c -+++ b/drivers/usb/serial/safe_serial.c -@@ -205,6 +205,11 @@ static void safe_process_read_urb(struct urb *urb) - if (!safe) - goto out; - -+ if (length < 2) { -+ dev_err(&port->dev, "malformed packet\n"); -+ return; -+ } -+ - fcs = fcs_compute10(data, length, CRC10_INITFCS); - if (fcs) { - dev_err(&port->dev, "%s - bad CRC %x\n", __func__, fcs); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index e0f862146793..7dcc97eadb12 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -3573,6 +3573,10 @@ static int ext4_block_truncate_page(handle_t *handle, - unsigned blocksize; - struct inode *inode = mapping->host; - -+ /* If we are processing an encrypted inode during orphan list handling */ -+ if (ext4_encrypted_inode(inode) && !ext4_has_encryption_key(inode)) -+ return 0; -+ - blocksize = inode->i_sb->s_blocksize; - length = blocksize - (offset & (blocksize - 1)); - -diff --git a/include/linux/libnvdimm.h b/include/linux/libnvdimm.h -index 3f021dc5da8c..30201b9be7bc 100644 ---- a/include/linux/libnvdimm.h -+++ b/include/linux/libnvdimm.h -@@ -83,6 +83,8 @@ struct nd_cmd_desc { - - struct nd_interleave_set { - u64 cookie; -+ /* compatibility with initial buggy Linux implementation */ -+ u64 altcookie; - }; - - struct nd_region_desc { -diff --git a/include/trace/events/syscalls.h b/include/trace/events/syscalls.h -index 14e49c798135..b35533b94277 100644 ---- a/include/trace/events/syscalls.h -+++ b/include/trace/events/syscalls.h -@@ -1,5 +1,6 @@ - #undef TRACE_SYSTEM - #define TRACE_SYSTEM raw_syscalls -+#undef TRACE_INCLUDE_FILE - #define TRACE_INCLUDE_FILE syscalls - - #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ) -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index 43eefe9d834c..e25b93a4267d 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -4150,24 +4150,6 @@ static void mem_cgroup_id_get_many(struct mem_cgroup *memcg, unsigned int n) - atomic_add(n, &memcg->id.ref); - } - --static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg) --{ -- while (!atomic_inc_not_zero(&memcg->id.ref)) { -- /* -- * The root cgroup cannot be destroyed, so it's refcount must -- * always be >= 1. -- */ -- if (WARN_ON_ONCE(memcg == root_mem_cgroup)) { -- VM_BUG_ON(1); -- break; -- } -- memcg = parent_mem_cgroup(memcg); -- if (!memcg) -- memcg = root_mem_cgroup; -- } -- return memcg; --} -- - static void mem_cgroup_id_put_many(struct mem_cgroup *memcg, unsigned int n) - { - if (atomic_sub_and_test(n, &memcg->id.ref)) { -@@ -5751,6 +5733,24 @@ static int __init mem_cgroup_init(void) - subsys_initcall(mem_cgroup_init); - - #ifdef CONFIG_MEMCG_SWAP -+static struct mem_cgroup *mem_cgroup_id_get_online(struct mem_cgroup *memcg) -+{ -+ while (!atomic_inc_not_zero(&memcg->id.ref)) { -+ /* -+ * The root cgroup cannot be destroyed, so it's refcount must -+ * always be >= 1. -+ */ -+ if (WARN_ON_ONCE(memcg == root_mem_cgroup)) { -+ VM_BUG_ON(1); -+ break; -+ } -+ memcg = parent_mem_cgroup(memcg); -+ if (!memcg) -+ memcg = root_mem_cgroup; -+ } -+ return memcg; -+} -+ - /** - * mem_cgroup_swapout - transfer a memsw charge to swap - * @page: page whose memsw charge to transfer diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.55-56.patch b/patch/kernel/mvebu64-default/03-patch-4.4.55-56.patch deleted file mode 100644 index cf1f3dfb086b..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.55-56.patch +++ /dev/null @@ -1,2116 +0,0 @@ -diff --git a/Documentation/networking/netlink_mmap.txt b/Documentation/networking/netlink_mmap.txt -deleted file mode 100644 -index 54f10478e8e3..000000000000 ---- a/Documentation/networking/netlink_mmap.txt -+++ /dev/null -@@ -1,332 +0,0 @@ --This file documents how to use memory mapped I/O with netlink. -- --Author: Patrick McHardy -- --Overview ---------- -- --Memory mapped netlink I/O can be used to increase throughput and decrease --overhead of unicast receive and transmit operations. Some netlink subsystems --require high throughput, these are mainly the netfilter subsystems --nfnetlink_queue and nfnetlink_log, but it can also help speed up large --dump operations of f.i. the routing database. -- --Memory mapped netlink I/O used two circular ring buffers for RX and TX which --are mapped into the processes address space. -- --The RX ring is used by the kernel to directly construct netlink messages into --user-space memory without copying them as done with regular socket I/O, --additionally as long as the ring contains messages no recvmsg() or poll() --syscalls have to be issued by user-space to get more message. -- --The TX ring is used to process messages directly from user-space memory, the --kernel processes all messages contained in the ring using a single sendmsg() --call. -- --Usage overview ---------------- -- --In order to use memory mapped netlink I/O, user-space needs three main changes: -- --- ring setup --- conversion of the RX path to get messages from the ring instead of recvmsg() --- conversion of the TX path to construct messages into the ring -- --Ring setup is done using setsockopt() to provide the ring parameters to the --kernel, then a call to mmap() to map the ring into the processes address space: -- --- setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, ¶ms, sizeof(params)); --- setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, ¶ms, sizeof(params)); --- ring = mmap(NULL, size, PROT_READ | PROT_WRITE, MAP_SHARED, fd, 0) -- --Usage of either ring is optional, but even if only the RX ring is used the --mapping still needs to be writable in order to update the frame status after --processing. -- --Conversion of the reception path involves calling poll() on the file --descriptor, once the socket is readable the frames from the ring are --processed in order until no more messages are available, as indicated by --a status word in the frame header. -- --On kernel side, in order to make use of memory mapped I/O on receive, the --originating netlink subsystem needs to support memory mapped I/O, otherwise --it will use an allocated socket buffer as usual and the contents will be -- copied to the ring on transmission, nullifying most of the performance gains. --Dumps of kernel databases automatically support memory mapped I/O. -- --Conversion of the transmit path involves changing message construction to --use memory from the TX ring instead of (usually) a buffer declared on the --stack and setting up the frame header appropriately. Optionally poll() can --be used to wait for free frames in the TX ring. -- --Structured and definitions for using memory mapped I/O are contained in --. -- --RX and TX rings ------------------ -- --Each ring contains a number of continuous memory blocks, containing frames of --fixed size dependent on the parameters used for ring setup. -- --Ring: [ block 0 ] -- [ frame 0 ] -- [ frame 1 ] -- [ block 1 ] -- [ frame 2 ] -- [ frame 3 ] -- ... -- [ block n ] -- [ frame 2 * n ] -- [ frame 2 * n + 1 ] -- --The blocks are only visible to the kernel, from the point of view of user-space --the ring just contains the frames in a continuous memory zone. -- --The ring parameters used for setting up the ring are defined as follows: -- --struct nl_mmap_req { -- unsigned int nm_block_size; -- unsigned int nm_block_nr; -- unsigned int nm_frame_size; -- unsigned int nm_frame_nr; --}; -- --Frames are grouped into blocks, where each block is a continuous region of memory --and holds nm_block_size / nm_frame_size frames. The total number of frames in --the ring is nm_frame_nr. The following invariants hold: -- --- frames_per_block = nm_block_size / nm_frame_size -- --- nm_frame_nr = frames_per_block * nm_block_nr -- --Some parameters are constrained, specifically: -- --- nm_block_size must be a multiple of the architectures memory page size. -- The getpagesize() function can be used to get the page size. -- --- nm_frame_size must be equal or larger to NL_MMAP_HDRLEN, IOW a frame must be -- able to hold at least the frame header -- --- nm_frame_size must be smaller or equal to nm_block_size -- --- nm_frame_size must be a multiple of NL_MMAP_MSG_ALIGNMENT -- --- nm_frame_nr must equal the actual number of frames as specified above. -- --When the kernel can't allocate physically continuous memory for a ring block, --it will fall back to use physically discontinuous memory. This might affect --performance negatively, in order to avoid this the nm_frame_size parameter --should be chosen to be as small as possible for the required frame size and --the number of blocks should be increased instead. -- --Ring frames -------------- -- --Each frames contain a frame header, consisting of a synchronization word and some --meta-data, and the message itself. -- --Frame: [ header message ] -- --The frame header is defined as follows: -- --struct nl_mmap_hdr { -- unsigned int nm_status; -- unsigned int nm_len; -- __u32 nm_group; -- /* credentials */ -- __u32 nm_pid; -- __u32 nm_uid; -- __u32 nm_gid; --}; -- --- nm_status is used for synchronizing processing between the kernel and user- -- space and specifies ownership of the frame as well as the operation to perform -- --- nm_len contains the length of the message contained in the data area -- --- nm_group specified the destination multicast group of message -- --- nm_pid, nm_uid and nm_gid contain the netlink pid, UID and GID of the sending -- process. These values correspond to the data available using SOCK_PASSCRED in -- the SCM_CREDENTIALS cmsg. -- --The possible values in the status word are: -- --- NL_MMAP_STATUS_UNUSED: -- RX ring: frame belongs to the kernel and contains no message -- for user-space. Approriate action is to invoke poll() -- to wait for new messages. -- -- TX ring: frame belongs to user-space and can be used for -- message construction. -- --- NL_MMAP_STATUS_RESERVED: -- RX ring only: frame is currently used by the kernel for message -- construction and contains no valid message yet. -- Appropriate action is to invoke poll() to wait for -- new messages. -- --- NL_MMAP_STATUS_VALID: -- RX ring: frame contains a valid message. Approriate action is -- to process the message and release the frame back to -- the kernel by setting the status to -- NL_MMAP_STATUS_UNUSED or queue the frame by setting the -- status to NL_MMAP_STATUS_SKIP. -- -- TX ring: the frame contains a valid message from user-space to -- be processed by the kernel. After completing processing -- the kernel will release the frame back to user-space by -- setting the status to NL_MMAP_STATUS_UNUSED. -- --- NL_MMAP_STATUS_COPY: -- RX ring only: a message is ready to be processed but could not be -- stored in the ring, either because it exceeded the -- frame size or because the originating subsystem does -- not support memory mapped I/O. Appropriate action is -- to invoke recvmsg() to receive the message and release -- the frame back to the kernel by setting the status to -- NL_MMAP_STATUS_UNUSED. -- --- NL_MMAP_STATUS_SKIP: -- RX ring only: user-space queued the message for later processing, but -- processed some messages following it in the ring. The -- kernel should skip this frame when looking for unused -- frames. -- --The data area of a frame begins at a offset of NL_MMAP_HDRLEN relative to the --frame header. -- --TX limitations ---------------- -- --As of Jan 2015 the message is always copied from the ring frame to an --allocated buffer due to unresolved security concerns. --See commit 4682a0358639b29cf ("netlink: Always copy on mmap TX."). -- --Example --------- -- --Ring setup: -- -- unsigned int block_size = 16 * getpagesize(); -- struct nl_mmap_req req = { -- .nm_block_size = block_size, -- .nm_block_nr = 64, -- .nm_frame_size = 16384, -- .nm_frame_nr = 64 * block_size / 16384, -- }; -- unsigned int ring_size; -- void *rx_ring, *tx_ring; -- -- /* Configure ring parameters */ -- if (setsockopt(fd, SOL_NETLINK, NETLINK_RX_RING, &req, sizeof(req)) < 0) -- exit(1); -- if (setsockopt(fd, SOL_NETLINK, NETLINK_TX_RING, &req, sizeof(req)) < 0) -- exit(1) -- -- /* Calculate size of each individual ring */ -- ring_size = req.nm_block_nr * req.nm_block_size; -- -- /* Map RX/TX rings. The TX ring is located after the RX ring */ -- rx_ring = mmap(NULL, 2 * ring_size, PROT_READ | PROT_WRITE, -- MAP_SHARED, fd, 0); -- if ((long)rx_ring == -1L) -- exit(1); -- tx_ring = rx_ring + ring_size: -- --Message reception: -- --This example assumes some ring parameters of the ring setup are available. -- -- unsigned int frame_offset = 0; -- struct nl_mmap_hdr *hdr; -- struct nlmsghdr *nlh; -- unsigned char buf[16384]; -- ssize_t len; -- -- while (1) { -- struct pollfd pfds[1]; -- -- pfds[0].fd = fd; -- pfds[0].events = POLLIN | POLLERR; -- pfds[0].revents = 0; -- -- if (poll(pfds, 1, -1) < 0 && errno != -EINTR) -- exit(1); -- -- /* Check for errors. Error handling omitted */ -- if (pfds[0].revents & POLLERR) -- -- -- /* If no new messages, poll again */ -- if (!(pfds[0].revents & POLLIN)) -- continue; -- -- /* Process all frames */ -- while (1) { -- /* Get next frame header */ -- hdr = rx_ring + frame_offset; -- -- if (hdr->nm_status == NL_MMAP_STATUS_VALID) { -- /* Regular memory mapped frame */ -- nlh = (void *)hdr + NL_MMAP_HDRLEN; -- len = hdr->nm_len; -- -- /* Release empty message immediately. May happen -- * on error during message construction. -- */ -- if (len == 0) -- goto release; -- } else if (hdr->nm_status == NL_MMAP_STATUS_COPY) { -- /* Frame queued to socket receive queue */ -- len = recv(fd, buf, sizeof(buf), MSG_DONTWAIT); -- if (len <= 0) -- break; -- nlh = buf; -- } else -- /* No more messages to process, continue polling */ -- break; -- -- process_msg(nlh); --release: -- /* Release frame back to the kernel */ -- hdr->nm_status = NL_MMAP_STATUS_UNUSED; -- -- /* Advance frame offset to next frame */ -- frame_offset = (frame_offset + frame_size) % ring_size; -- } -- } -- --Message transmission: -- --This example assumes some ring parameters of the ring setup are available. --A single message is constructed and transmitted, to send multiple messages --at once they would be constructed in consecutive frames before a final call --to sendto(). -- -- unsigned int frame_offset = 0; -- struct nl_mmap_hdr *hdr; -- struct nlmsghdr *nlh; -- struct sockaddr_nl addr = { -- .nl_family = AF_NETLINK, -- }; -- -- hdr = tx_ring + frame_offset; -- if (hdr->nm_status != NL_MMAP_STATUS_UNUSED) -- /* No frame available. Use poll() to avoid. */ -- exit(1); -- -- nlh = (void *)hdr + NL_MMAP_HDRLEN; -- -- /* Build message */ -- build_message(nlh); -- -- /* Fill frame header: length and status need to be set */ -- hdr->nm_len = nlh->nlmsg_len; -- hdr->nm_status = NL_MMAP_STATUS_VALID; -- -- if (sendto(fd, NULL, 0, 0, &addr, sizeof(addr)) < 0) -- exit(1); -- -- /* Advance frame offset to next frame */ -- frame_offset = (frame_offset + frame_size) % ring_size; -diff --git a/Makefile b/Makefile -index d9cc21df444d..cf9303a5d621 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 55 -+SUBLEVEL = 56 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c -index 1a8256dd6729..5b2f2306fbcc 100644 ---- a/arch/x86/kernel/cpu/perf_event.c -+++ b/arch/x86/kernel/cpu/perf_event.c -@@ -1996,8 +1996,8 @@ static int x86_pmu_event_init(struct perf_event *event) - - static void refresh_pce(void *ignored) - { -- if (current->mm) -- load_mm_cr4(current->mm); -+ if (current->active_mm) -+ load_mm_cr4(current->active_mm); - } - - static void x86_pmu_event_mapped(struct perf_event *event) -diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c -index f129a9af6357..b6b0077da1af 100644 ---- a/arch/x86/kernel/head64.c -+++ b/arch/x86/kernel/head64.c -@@ -4,6 +4,7 @@ - * Copyright (C) 2000 Andrea Arcangeli SuSE - */ - -+#define DISABLE_BRANCH_PROFILING - #include - #include - #include -diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c -index d470cf219a2d..4e5ac46adc9d 100644 ---- a/arch/x86/mm/kasan_init_64.c -+++ b/arch/x86/mm/kasan_init_64.c -@@ -1,3 +1,4 @@ -+#define DISABLE_BRANCH_PROFILING - #define pr_fmt(fmt) "kasan: " fmt - #include - #include -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index d6b619667f1a..349aecbc210a 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -345,6 +345,7 @@ static netdev_tx_t is_ip_tx_frame(struct sk_buff *skb, struct net_device *dev) - - static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) - { -+ int len = skb->len; - netdev_tx_t ret = is_ip_tx_frame(skb, dev); - - if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) { -@@ -352,7 +353,7 @@ static netdev_tx_t vrf_xmit(struct sk_buff *skb, struct net_device *dev) - - u64_stats_update_begin(&dstats->syncp); - dstats->tx_pkts++; -- dstats->tx_bytes += skb->len; -+ dstats->tx_bytes += len; - u64_stats_update_end(&dstats->syncp); - } else { - this_cpu_inc(dev->dstats->tx_drps); -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 6fa8e165878e..590750ab6564 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2600,7 +2600,7 @@ static int vxlan_validate(struct nlattr *tb[], struct nlattr *data[]) - - if (data[IFLA_VXLAN_ID]) { - __u32 id = nla_get_u32(data[IFLA_VXLAN_ID]); -- if (id >= VXLAN_VID_MASK) -+ if (id >= VXLAN_N_VID) - return -ERANGE; - } - -diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c -index 8a9feb341f31..dd561f916f0b 100644 ---- a/fs/ext4/crypto_policy.c -+++ b/fs/ext4/crypto_policy.c -@@ -156,6 +156,12 @@ int ext4_is_child_context_consistent_with_parent(struct inode *parent, - WARN_ON(1); /* Should never happen */ - return 0; - } -+ -+ /* No restrictions on file types which are never encrypted */ -+ if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && -+ !S_ISLNK(child->i_mode)) -+ return 1; -+ - /* no restrictions if the parent directory is not encrypted */ - if (!ext4_encrypted_inode(parent)) - return 1; -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index 1fb12f9c97a6..789e2d6724a9 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -633,8 +633,12 @@ resizefs_out: - if (err) - goto encryption_policy_out; - -+ mutex_lock(&inode->i_mutex); -+ - err = ext4_process_policy(&policy, inode); - -+ mutex_unlock(&inode->i_mutex); -+ - mnt_drop_write_file(filp); - encryption_policy_out: - return err; -diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c -index e504f548b64e..5bbd1989d5e6 100644 ---- a/fs/f2fs/crypto_policy.c -+++ b/fs/f2fs/crypto_policy.c -@@ -149,6 +149,11 @@ int f2fs_is_child_context_consistent_with_parent(struct inode *parent, - BUG_ON(1); - } - -+ /* No restrictions on file types which are never encrypted */ -+ if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && -+ !S_ISLNK(child->i_mode)) -+ return 1; -+ - /* no restrictions if the parent directory is not encrypted */ - if (!f2fs_encrypted_inode(parent)) - return 1; -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index a197215ad52b..4b449d263333 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -1535,12 +1535,19 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg) - #ifdef CONFIG_F2FS_FS_ENCRYPTION - struct f2fs_encryption_policy policy; - struct inode *inode = file_inode(filp); -+ int err; - - if (copy_from_user(&policy, (struct f2fs_encryption_policy __user *)arg, - sizeof(policy))) - return -EFAULT; - -- return f2fs_process_policy(&policy, inode); -+ mutex_lock(&inode->i_mutex); -+ -+ err = f2fs_process_policy(&policy, inode); -+ -+ mutex_unlock(&inode->i_mutex); -+ -+ return err; - #else - return -EOPNOTSUPP; - #endif -diff --git a/include/linux/dccp.h b/include/linux/dccp.h -index 61d042bbbf60..68449293c4b6 100644 ---- a/include/linux/dccp.h -+++ b/include/linux/dccp.h -@@ -163,6 +163,7 @@ struct dccp_request_sock { - __u64 dreq_isr; - __u64 dreq_gsr; - __be32 dreq_service; -+ spinlock_t dreq_lock; - struct list_head dreq_featneg; - __u32 dreq_timestamp_echo; - __u32 dreq_timestamp_time; -diff --git a/include/uapi/linux/netlink.h b/include/uapi/linux/netlink.h -index f095155d8749..0dba4e4ed2be 100644 ---- a/include/uapi/linux/netlink.h -+++ b/include/uapi/linux/netlink.h -@@ -107,8 +107,10 @@ struct nlmsgerr { - #define NETLINK_PKTINFO 3 - #define NETLINK_BROADCAST_ERROR 4 - #define NETLINK_NO_ENOBUFS 5 -+#ifndef __KERNEL__ - #define NETLINK_RX_RING 6 - #define NETLINK_TX_RING 7 -+#endif - #define NETLINK_LISTEN_ALL_NSID 8 - #define NETLINK_LIST_MEMBERSHIPS 9 - #define NETLINK_CAP_ACK 10 -@@ -134,6 +136,7 @@ struct nl_mmap_hdr { - __u32 nm_gid; - }; - -+#ifndef __KERNEL__ - enum nl_mmap_status { - NL_MMAP_STATUS_UNUSED, - NL_MMAP_STATUS_RESERVED, -@@ -145,6 +148,7 @@ enum nl_mmap_status { - #define NL_MMAP_MSG_ALIGNMENT NLMSG_ALIGNTO - #define NL_MMAP_MSG_ALIGN(sz) __ALIGN_KERNEL(sz, NL_MMAP_MSG_ALIGNMENT) - #define NL_MMAP_HDRLEN NL_MMAP_MSG_ALIGN(sizeof(struct nl_mmap_hdr)) -+#endif - - #define NET_MAJOR 36 /* Major 36 is reserved for networking */ - -diff --git a/include/uapi/linux/netlink_diag.h b/include/uapi/linux/netlink_diag.h -index f2159d30d1f5..d79399394b46 100644 ---- a/include/uapi/linux/netlink_diag.h -+++ b/include/uapi/linux/netlink_diag.h -@@ -48,6 +48,8 @@ enum { - - #define NDIAG_SHOW_MEMINFO 0x00000001 /* show memory info of a socket */ - #define NDIAG_SHOW_GROUPS 0x00000002 /* show groups of a netlink socket */ -+#ifndef __KERNEL__ - #define NDIAG_SHOW_RING_CFG 0x00000004 /* show ring configuration */ -+#endif - - #endif -diff --git a/include/uapi/linux/packet_diag.h b/include/uapi/linux/packet_diag.h -index d08c63f3dd6f..0c5d5dd61b6a 100644 ---- a/include/uapi/linux/packet_diag.h -+++ b/include/uapi/linux/packet_diag.h -@@ -64,7 +64,7 @@ struct packet_diag_mclist { - __u32 pdmc_count; - __u16 pdmc_type; - __u16 pdmc_alen; -- __u8 pdmc_addr[MAX_ADDR_LEN]; -+ __u8 pdmc_addr[32]; /* MAX_ADDR_LEN */ - }; - - struct packet_diag_ring { -diff --git a/kernel/futex.c b/kernel/futex.c -index 9d251dc3ec40..3057dabf726f 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -2690,7 +2690,6 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - { - struct hrtimer_sleeper timeout, *to = NULL; - struct rt_mutex_waiter rt_waiter; -- struct rt_mutex *pi_mutex = NULL; - struct futex_hash_bucket *hb; - union futex_key key2 = FUTEX_KEY_INIT; - struct futex_q q = futex_q_init; -@@ -2774,6 +2773,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - if (q.pi_state && (q.pi_state->owner != current)) { - spin_lock(q.lock_ptr); - ret = fixup_pi_state_owner(uaddr2, &q, current); -+ if (ret && rt_mutex_owner(&q.pi_state->pi_mutex) == current) -+ rt_mutex_unlock(&q.pi_state->pi_mutex); - /* - * Drop the reference to the pi state which - * the requeue_pi() code acquired for us. -@@ -2782,6 +2783,8 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - spin_unlock(q.lock_ptr); - } - } else { -+ struct rt_mutex *pi_mutex; -+ - /* - * We have been woken up by futex_unlock_pi(), a timeout, or a - * signal. futex_unlock_pi() will not destroy the lock_ptr nor -@@ -2805,18 +2808,19 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags, - if (res) - ret = (res < 0) ? res : 0; - -+ /* -+ * If fixup_pi_state_owner() faulted and was unable to handle -+ * the fault, unlock the rt_mutex and return the fault to -+ * userspace. -+ */ -+ if (ret && rt_mutex_owner(pi_mutex) == current) -+ rt_mutex_unlock(pi_mutex); -+ - /* Unqueue and drop the lock. */ - unqueue_me_pi(&q); - } - -- /* -- * If fixup_pi_state_owner() faulted and was unable to handle the -- * fault, unlock the rt_mutex and return the fault to userspace. -- */ -- if (ret == -EFAULT) { -- if (pi_mutex && rt_mutex_owner(pi_mutex) == current) -- rt_mutex_unlock(pi_mutex); -- } else if (ret == -EINTR) { -+ if (ret == -EINTR) { - /* - * We've already been requeued, but cannot restart by calling - * futex_lock_pi() directly. We could restart this syscall, but -diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c -index f7fba74108a9..e24754a0e052 100644 ---- a/net/bridge/br_input.c -+++ b/net/bridge/br_input.c -@@ -29,6 +29,7 @@ EXPORT_SYMBOL(br_should_route_hook); - static int - br_netif_receive_skb(struct net *net, struct sock *sk, struct sk_buff *skb) - { -+ br_drop_fake_rtable(skb); - return netif_receive_skb(skb); - } - -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 7ddbe7ec81d6..97fc19f001bf 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -516,21 +516,6 @@ static unsigned int br_nf_pre_routing(void *priv, - } - - --/* PF_BRIDGE/LOCAL_IN ************************************************/ --/* The packet is locally destined, which requires a real -- * dst_entry, so detach the fake one. On the way up, the -- * packet would pass through PRE_ROUTING again (which already -- * took place when the packet entered the bridge), but we -- * register an IPv4 PRE_ROUTING 'sabotage' hook that will -- * prevent this from happening. */ --static unsigned int br_nf_local_in(void *priv, -- struct sk_buff *skb, -- const struct nf_hook_state *state) --{ -- br_drop_fake_rtable(skb); -- return NF_ACCEPT; --} -- - /* PF_BRIDGE/FORWARD *************************************************/ - static int br_nf_forward_finish(struct net *net, struct sock *sk, struct sk_buff *skb) - { -@@ -901,12 +886,6 @@ static struct nf_hook_ops br_nf_ops[] __read_mostly = { - .priority = NF_BR_PRI_BRNF, - }, - { -- .hook = br_nf_local_in, -- .pf = NFPROTO_BRIDGE, -- .hooknum = NF_BR_LOCAL_IN, -- .priority = NF_BR_PRI_BRNF, -- }, -- { - .hook = br_nf_forward_ip, - .pf = NFPROTO_BRIDGE, - .hooknum = NF_BR_FORWARD, -diff --git a/net/core/dev.c b/net/core/dev.c -index 08215a85c742..48399d8ce614 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1677,27 +1677,54 @@ EXPORT_SYMBOL_GPL(net_dec_ingress_queue); - static struct static_key netstamp_needed __read_mostly; - #ifdef HAVE_JUMP_LABEL - static atomic_t netstamp_needed_deferred; -+static atomic_t netstamp_wanted; - static void netstamp_clear(struct work_struct *work) - { - int deferred = atomic_xchg(&netstamp_needed_deferred, 0); -+ int wanted; - -- while (deferred--) -- static_key_slow_dec(&netstamp_needed); -+ wanted = atomic_add_return(deferred, &netstamp_wanted); -+ if (wanted > 0) -+ static_key_enable(&netstamp_needed); -+ else -+ static_key_disable(&netstamp_needed); - } - static DECLARE_WORK(netstamp_work, netstamp_clear); - #endif - - void net_enable_timestamp(void) - { -+#ifdef HAVE_JUMP_LABEL -+ int wanted; -+ -+ while (1) { -+ wanted = atomic_read(&netstamp_wanted); -+ if (wanted <= 0) -+ break; -+ if (atomic_cmpxchg(&netstamp_wanted, wanted, wanted + 1) == wanted) -+ return; -+ } -+ atomic_inc(&netstamp_needed_deferred); -+ schedule_work(&netstamp_work); -+#else - static_key_slow_inc(&netstamp_needed); -+#endif - } - EXPORT_SYMBOL(net_enable_timestamp); - - void net_disable_timestamp(void) - { - #ifdef HAVE_JUMP_LABEL -- /* net_disable_timestamp() can be called from non process context */ -- atomic_inc(&netstamp_needed_deferred); -+ int wanted; -+ -+ while (1) { -+ wanted = atomic_read(&netstamp_wanted); -+ if (wanted <= 1) -+ break; -+ if (atomic_cmpxchg(&netstamp_wanted, wanted, wanted - 1) == wanted) -+ return; -+ } -+ atomic_dec(&netstamp_needed_deferred); - schedule_work(&netstamp_work); - #else - static_key_slow_dec(&netstamp_needed); -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 4968b5ddea69..73dfd7729bc9 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -3678,13 +3678,14 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, - if (!skb_may_tx_timestamp(sk, false)) - return; - -- /* take a reference to prevent skb_orphan() from freeing the socket */ -- sock_hold(sk); -- -- *skb_hwtstamps(skb) = *hwtstamps; -- __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); -- -- sock_put(sk); -+ /* Take a reference to prevent skb_orphan() from freeing the socket, -+ * but only if the socket refcount is not zero. -+ */ -+ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { -+ *skb_hwtstamps(skb) = *hwtstamps; -+ __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); -+ sock_put(sk); -+ } - } - EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); - -@@ -3735,7 +3736,7 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) - { - struct sock *sk = skb->sk; - struct sock_exterr_skb *serr; -- int err; -+ int err = 1; - - skb->wifi_acked_valid = 1; - skb->wifi_acked = acked; -@@ -3745,14 +3746,15 @@ void skb_complete_wifi_ack(struct sk_buff *skb, bool acked) - serr->ee.ee_errno = ENOMSG; - serr->ee.ee_origin = SO_EE_ORIGIN_TXSTATUS; - -- /* take a reference to prevent skb_orphan() from freeing the socket */ -- sock_hold(sk); -- -- err = sock_queue_err_skb(sk, skb); -+ /* Take a reference to prevent skb_orphan() from freeing the socket, -+ * but only if the socket refcount is not zero. -+ */ -+ if (likely(atomic_inc_not_zero(&sk->sk_refcnt))) { -+ err = sock_queue_err_skb(sk, skb); -+ sock_put(sk); -+ } - if (err) - kfree_skb(skb); -- -- sock_put(sk); - } - EXPORT_SYMBOL_GPL(skb_complete_wifi_ack); - -diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c -index f053198e730c..5e3a7302f774 100644 ---- a/net/dccp/ccids/ccid2.c -+++ b/net/dccp/ccids/ccid2.c -@@ -749,6 +749,7 @@ static void ccid2_hc_tx_exit(struct sock *sk) - for (i = 0; i < hc->tx_seqbufc; i++) - kfree(hc->tx_seqbuf[i]); - hc->tx_seqbufc = 0; -+ dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks); - } - - static void ccid2_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb) -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 0759f5b9180e..6467bf392e1b 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -289,7 +289,8 @@ static void dccp_v4_err(struct sk_buff *skb, u32 info) - - switch (type) { - case ICMP_REDIRECT: -- dccp_do_redirect(skb, sk); -+ if (!sock_owned_by_user(sk)) -+ dccp_do_redirect(skb, sk); - goto out; - case ICMP_SOURCE_QUENCH: - /* Just silently ignore these. */ -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 27c4e81efa24..8113ad58fcb4 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -122,10 +122,12 @@ static void dccp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - np = inet6_sk(sk); - - if (type == NDISC_REDIRECT) { -- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); -+ if (!sock_owned_by_user(sk)) { -+ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); - -- if (dst) -- dst->ops->redirect(dst, sk, skb); -+ if (dst) -+ dst->ops->redirect(dst, sk, skb); -+ } - goto out; - } - -diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c -index 1994f8af646b..68eed344b471 100644 ---- a/net/dccp/minisocks.c -+++ b/net/dccp/minisocks.c -@@ -122,6 +122,7 @@ struct sock *dccp_create_openreq_child(const struct sock *sk, - /* It is still raw copy of parent, so invalidate - * destructor and make plain sk_free() */ - newsk->sk_destruct = NULL; -+ bh_unlock_sock(newsk); - sk_free(newsk); - return NULL; - } -@@ -145,6 +146,13 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb, - struct dccp_request_sock *dreq = dccp_rsk(req); - bool own_req; - -+ /* TCP/DCCP listeners became lockless. -+ * DCCP stores complex state in its request_sock, so we need -+ * a protection for them, now this code runs without being protected -+ * by the parent (listener) lock. -+ */ -+ spin_lock_bh(&dreq->dreq_lock); -+ - /* Check for retransmitted REQUEST */ - if (dccp_hdr(skb)->dccph_type == DCCP_PKT_REQUEST) { - -@@ -159,7 +167,7 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb, - inet_rtx_syn_ack(sk, req); - } - /* Network Duplicate, discard packet */ -- return NULL; -+ goto out; - } - - DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_PACKET_ERROR; -@@ -185,20 +193,20 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb, - - child = inet_csk(sk)->icsk_af_ops->syn_recv_sock(sk, skb, req, NULL, - req, &own_req); -- if (!child) -- goto listen_overflow; -- -- return inet_csk_complete_hashdance(sk, child, req, own_req); -+ if (child) { -+ child = inet_csk_complete_hashdance(sk, child, req, own_req); -+ goto out; -+ } - --listen_overflow: -- dccp_pr_debug("listen_overflow!\n"); - DCCP_SKB_CB(skb)->dccpd_reset_code = DCCP_RESET_CODE_TOO_BUSY; - drop: - if (dccp_hdr(skb)->dccph_type != DCCP_PKT_RESET) - req->rsk_ops->send_reset(sk, skb); - - inet_csk_reqsk_queue_drop(sk, req); -- return NULL; -+out: -+ spin_unlock_bh(&dreq->dreq_lock); -+ return child; - } - - EXPORT_SYMBOL_GPL(dccp_check_req); -@@ -249,6 +257,7 @@ int dccp_reqsk_init(struct request_sock *req, - { - struct dccp_request_sock *dreq = dccp_rsk(req); - -+ spin_lock_init(&dreq->dreq_lock); - inet_rsk(req)->ir_rmt_port = dccp_hdr(skb)->dccph_sport; - inet_rsk(req)->ir_num = ntohs(dccp_hdr(skb)->dccph_dport); - inet_rsk(req)->acked = 0; -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index ef2f527a119b..da4d68d78590 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1958,6 +1958,7 @@ int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr, - { - int res; - -+ tos &= IPTOS_RT_MASK; - rcu_read_lock(); - - /* Multicast recognition logic is moved from route cache to here. -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index b58a38eea059..198fc2314c82 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -271,10 +271,13 @@ EXPORT_SYMBOL(tcp_v4_connect); - */ - void tcp_v4_mtu_reduced(struct sock *sk) - { -- struct dst_entry *dst; - struct inet_sock *inet = inet_sk(sk); -- u32 mtu = tcp_sk(sk)->mtu_info; -+ struct dst_entry *dst; -+ u32 mtu; - -+ if ((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) -+ return; -+ mtu = tcp_sk(sk)->mtu_info; - dst = inet_csk_update_pmtu(sk, mtu); - if (!dst) - return; -@@ -420,7 +423,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) - - switch (type) { - case ICMP_REDIRECT: -- do_redirect(icmp_skb, sk); -+ if (!sock_owned_by_user(sk)) -+ do_redirect(icmp_skb, sk); - goto out; - case ICMP_SOURCE_QUENCH: - /* Just silently ignore these. */ -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index 193ba1fa8a9a..ebb34d0c5e80 100644 ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -223,7 +223,8 @@ void tcp_delack_timer_handler(struct sock *sk) - - sk_mem_reclaim_partial(sk); - -- if (sk->sk_state == TCP_CLOSE || !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) -+ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || -+ !(icsk->icsk_ack.pending & ICSK_ACK_TIMER)) - goto out; - - if (time_after(icsk->icsk_ack.timeout, jiffies)) { -@@ -504,7 +505,8 @@ void tcp_write_timer_handler(struct sock *sk) - struct inet_connection_sock *icsk = inet_csk(sk); - int event; - -- if (sk->sk_state == TCP_CLOSE || !icsk->icsk_pending) -+ if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN)) || -+ !icsk->icsk_pending) - goto out; - - if (time_after(icsk->icsk_timeout, jiffies)) { -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 34cf46d74554..85bf86458706 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -903,6 +903,8 @@ add: - ins = &rt->dst.rt6_next; - iter = *ins; - while (iter) { -+ if (iter->rt6i_metric > rt->rt6i_metric) -+ break; - if (rt6_qualify_for_ecmp(iter)) { - *ins = iter->dst.rt6_next; - fib6_purge_rt(iter, fn, info->nl_net); -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 58900c21e4e4..8004532fa882 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -742,13 +742,14 @@ slow_path: - * Fragment the datagram. - */ - -- *prevhdr = NEXTHDR_FRAGMENT; - troom = rt->dst.dev->needed_tailroom; - - /* - * Keep copying data until we run out. - */ - while (left > 0) { -+ u8 *fragnexthdr_offset; -+ - len = left; - /* IF: it doesn't fit, use 'mtu' - the data space left */ - if (len > mtu) -@@ -793,6 +794,10 @@ slow_path: - */ - skb_copy_from_linear_data(skb, skb_network_header(frag), hlen); - -+ fragnexthdr_offset = skb_network_header(frag); -+ fragnexthdr_offset += prevhdr - skb_network_header(skb); -+ *fragnexthdr_offset = NEXTHDR_FRAGMENT; -+ - /* - * Build fragment header. - */ -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 0a8610b33d79..bdcc4d9cedd3 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -680,6 +680,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p) - u->link = p->link; - u->i_key = p->i_key; - u->o_key = p->o_key; -+ if (u->i_key) -+ u->i_flags |= GRE_KEY; -+ if (u->o_key) -+ u->o_flags |= GRE_KEY; - u->proto = p->proto; - - memcpy(u->name, p->name, sizeof(u->name)); -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 76a8c8057a23..1a63c4deef26 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -376,10 +376,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - np = inet6_sk(sk); - - if (type == NDISC_REDIRECT) { -- struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); -+ if (!sock_owned_by_user(sk)) { -+ struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie); - -- if (dst) -- dst->ops->redirect(dst, sk, skb); -+ if (dst) -+ dst->ops->redirect(dst, sk, skb); -+ } - goto out; - } - -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index 445b7cd0826a..48ab93842322 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -383,7 +383,7 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb) - drop: - IP_INC_STATS(sock_net(sk), IPSTATS_MIB_INDISCARDS); - kfree_skb(skb); -- return -1; -+ return 0; - } - - /* Userspace will call sendmsg() on the tunnel socket to send L2TP -diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c -index 881bc2072809..52cfc4478511 100644 ---- a/net/mpls/af_mpls.c -+++ b/net/mpls/af_mpls.c -@@ -1567,6 +1567,7 @@ static void mpls_net_exit(struct net *net) - for (index = 0; index < platform_labels; index++) { - struct mpls_route *rt = rtnl_dereference(platform_label[index]); - RCU_INIT_POINTER(platform_label[index], NULL); -+ mpls_notify_route(net, index, rt, NULL, NULL); - mpls_rt_free(rt); - } - rtnl_unlock(); -diff --git a/net/netlink/Kconfig b/net/netlink/Kconfig -index 2c5e95e9bfbd..5d6e8c05b3d4 100644 ---- a/net/netlink/Kconfig -+++ b/net/netlink/Kconfig -@@ -2,15 +2,6 @@ - # Netlink Sockets - # - --config NETLINK_MMAP -- bool "NETLINK: mmaped IO" -- ---help--- -- This option enables support for memory mapped netlink IO. This -- reduces overhead by avoiding copying data between kernel- and -- userspace. -- -- If unsure, say N. -- - config NETLINK_DIAG - tristate "NETLINK: socket monitoring interface" - default n -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 360700a2f46c..8e33019d8e7b 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -225,7 +225,7 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb, - - dev_hold(dev); - -- if (netlink_skb_is_mmaped(skb) || is_vmalloc_addr(skb->head)) -+ if (is_vmalloc_addr(skb->head)) - nskb = netlink_to_full_skb(skb, GFP_ATOMIC); - else - nskb = skb_clone(skb, GFP_ATOMIC); -@@ -300,610 +300,8 @@ static void netlink_rcv_wake(struct sock *sk) - wake_up_interruptible(&nlk->wait); - } - --#ifdef CONFIG_NETLINK_MMAP --static bool netlink_rx_is_mmaped(struct sock *sk) --{ -- return nlk_sk(sk)->rx_ring.pg_vec != NULL; --} -- --static bool netlink_tx_is_mmaped(struct sock *sk) --{ -- return nlk_sk(sk)->tx_ring.pg_vec != NULL; --} -- --static __pure struct page *pgvec_to_page(const void *addr) --{ -- if (is_vmalloc_addr(addr)) -- return vmalloc_to_page(addr); -- else -- return virt_to_page(addr); --} -- --static void free_pg_vec(void **pg_vec, unsigned int order, unsigned int len) --{ -- unsigned int i; -- -- for (i = 0; i < len; i++) { -- if (pg_vec[i] != NULL) { -- if (is_vmalloc_addr(pg_vec[i])) -- vfree(pg_vec[i]); -- else -- free_pages((unsigned long)pg_vec[i], order); -- } -- } -- kfree(pg_vec); --} -- --static void *alloc_one_pg_vec_page(unsigned long order) --{ -- void *buffer; -- gfp_t gfp_flags = GFP_KERNEL | __GFP_COMP | __GFP_ZERO | -- __GFP_NOWARN | __GFP_NORETRY; -- -- buffer = (void *)__get_free_pages(gfp_flags, order); -- if (buffer != NULL) -- return buffer; -- -- buffer = vzalloc((1 << order) * PAGE_SIZE); -- if (buffer != NULL) -- return buffer; -- -- gfp_flags &= ~__GFP_NORETRY; -- return (void *)__get_free_pages(gfp_flags, order); --} -- --static void **alloc_pg_vec(struct netlink_sock *nlk, -- struct nl_mmap_req *req, unsigned int order) --{ -- unsigned int block_nr = req->nm_block_nr; -- unsigned int i; -- void **pg_vec; -- -- pg_vec = kcalloc(block_nr, sizeof(void *), GFP_KERNEL); -- if (pg_vec == NULL) -- return NULL; -- -- for (i = 0; i < block_nr; i++) { -- pg_vec[i] = alloc_one_pg_vec_page(order); -- if (pg_vec[i] == NULL) -- goto err1; -- } -- -- return pg_vec; --err1: -- free_pg_vec(pg_vec, order, block_nr); -- return NULL; --} -- -- --static void --__netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, bool tx_ring, void **pg_vec, -- unsigned int order) --{ -- struct netlink_sock *nlk = nlk_sk(sk); -- struct sk_buff_head *queue; -- struct netlink_ring *ring; -- -- queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue; -- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -- -- spin_lock_bh(&queue->lock); -- -- ring->frame_max = req->nm_frame_nr - 1; -- ring->head = 0; -- ring->frame_size = req->nm_frame_size; -- ring->pg_vec_pages = req->nm_block_size / PAGE_SIZE; -- -- swap(ring->pg_vec_len, req->nm_block_nr); -- swap(ring->pg_vec_order, order); -- swap(ring->pg_vec, pg_vec); -- -- __skb_queue_purge(queue); -- spin_unlock_bh(&queue->lock); -- -- WARN_ON(atomic_read(&nlk->mapped)); -- -- if (pg_vec) -- free_pg_vec(pg_vec, order, req->nm_block_nr); --} -- --static int netlink_set_ring(struct sock *sk, struct nl_mmap_req *req, -- bool tx_ring) --{ -- struct netlink_sock *nlk = nlk_sk(sk); -- struct netlink_ring *ring; -- void **pg_vec = NULL; -- unsigned int order = 0; -- -- ring = tx_ring ? &nlk->tx_ring : &nlk->rx_ring; -- -- if (atomic_read(&nlk->mapped)) -- return -EBUSY; -- if (atomic_read(&ring->pending)) -- return -EBUSY; -- -- if (req->nm_block_nr) { -- if (ring->pg_vec != NULL) -- return -EBUSY; -- -- if ((int)req->nm_block_size <= 0) -- return -EINVAL; -- if (!PAGE_ALIGNED(req->nm_block_size)) -- return -EINVAL; -- if (req->nm_frame_size < NL_MMAP_HDRLEN) -- return -EINVAL; -- if (!IS_ALIGNED(req->nm_frame_size, NL_MMAP_MSG_ALIGNMENT)) -- return -EINVAL; -- -- ring->frames_per_block = req->nm_block_size / -- req->nm_frame_size; -- if (ring->frames_per_block == 0) -- return -EINVAL; -- if (ring->frames_per_block * req->nm_block_nr != -- req->nm_frame_nr) -- return -EINVAL; -- -- order = get_order(req->nm_block_size); -- pg_vec = alloc_pg_vec(nlk, req, order); -- if (pg_vec == NULL) -- return -ENOMEM; -- } else { -- if (req->nm_frame_nr) -- return -EINVAL; -- } -- -- mutex_lock(&nlk->pg_vec_lock); -- if (atomic_read(&nlk->mapped) == 0) { -- __netlink_set_ring(sk, req, tx_ring, pg_vec, order); -- mutex_unlock(&nlk->pg_vec_lock); -- return 0; -- } -- -- mutex_unlock(&nlk->pg_vec_lock); -- -- if (pg_vec) -- free_pg_vec(pg_vec, order, req->nm_block_nr); -- -- return -EBUSY; --} -- --static void netlink_mm_open(struct vm_area_struct *vma) --{ -- struct file *file = vma->vm_file; -- struct socket *sock = file->private_data; -- struct sock *sk = sock->sk; -- -- if (sk) -- atomic_inc(&nlk_sk(sk)->mapped); --} -- --static void netlink_mm_close(struct vm_area_struct *vma) --{ -- struct file *file = vma->vm_file; -- struct socket *sock = file->private_data; -- struct sock *sk = sock->sk; -- -- if (sk) -- atomic_dec(&nlk_sk(sk)->mapped); --} -- --static const struct vm_operations_struct netlink_mmap_ops = { -- .open = netlink_mm_open, -- .close = netlink_mm_close, --}; -- --static int netlink_mmap(struct file *file, struct socket *sock, -- struct vm_area_struct *vma) --{ -- struct sock *sk = sock->sk; -- struct netlink_sock *nlk = nlk_sk(sk); -- struct netlink_ring *ring; -- unsigned long start, size, expected; -- unsigned int i; -- int err = -EINVAL; -- -- if (vma->vm_pgoff) -- return -EINVAL; -- -- mutex_lock(&nlk->pg_vec_lock); -- -- expected = 0; -- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { -- if (ring->pg_vec == NULL) -- continue; -- expected += ring->pg_vec_len * ring->pg_vec_pages * PAGE_SIZE; -- } -- -- if (expected == 0) -- goto out; -- -- size = vma->vm_end - vma->vm_start; -- if (size != expected) -- goto out; -- -- start = vma->vm_start; -- for (ring = &nlk->rx_ring; ring <= &nlk->tx_ring; ring++) { -- if (ring->pg_vec == NULL) -- continue; -- -- for (i = 0; i < ring->pg_vec_len; i++) { -- struct page *page; -- void *kaddr = ring->pg_vec[i]; -- unsigned int pg_num; -- -- for (pg_num = 0; pg_num < ring->pg_vec_pages; pg_num++) { -- page = pgvec_to_page(kaddr); -- err = vm_insert_page(vma, start, page); -- if (err < 0) -- goto out; -- start += PAGE_SIZE; -- kaddr += PAGE_SIZE; -- } -- } -- } -- -- atomic_inc(&nlk->mapped); -- vma->vm_ops = &netlink_mmap_ops; -- err = 0; --out: -- mutex_unlock(&nlk->pg_vec_lock); -- return err; --} -- --static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len) --{ --#if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1 -- struct page *p_start, *p_end; -- -- /* First page is flushed through netlink_{get,set}_status */ -- p_start = pgvec_to_page(hdr + PAGE_SIZE); -- p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1); -- while (p_start <= p_end) { -- flush_dcache_page(p_start); -- p_start++; -- } --#endif --} -- --static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr) --{ -- smp_rmb(); -- flush_dcache_page(pgvec_to_page(hdr)); -- return hdr->nm_status; --} -- --static void netlink_set_status(struct nl_mmap_hdr *hdr, -- enum nl_mmap_status status) --{ -- smp_mb(); -- hdr->nm_status = status; -- flush_dcache_page(pgvec_to_page(hdr)); --} -- --static struct nl_mmap_hdr * --__netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos) --{ -- unsigned int pg_vec_pos, frame_off; -- -- pg_vec_pos = pos / ring->frames_per_block; -- frame_off = pos % ring->frames_per_block; -- -- return ring->pg_vec[pg_vec_pos] + (frame_off * ring->frame_size); --} -- --static struct nl_mmap_hdr * --netlink_lookup_frame(const struct netlink_ring *ring, unsigned int pos, -- enum nl_mmap_status status) --{ -- struct nl_mmap_hdr *hdr; -- -- hdr = __netlink_lookup_frame(ring, pos); -- if (netlink_get_status(hdr) != status) -- return NULL; -- -- return hdr; --} -- --static struct nl_mmap_hdr * --netlink_current_frame(const struct netlink_ring *ring, -- enum nl_mmap_status status) --{ -- return netlink_lookup_frame(ring, ring->head, status); --} -- --static void netlink_increment_head(struct netlink_ring *ring) --{ -- ring->head = ring->head != ring->frame_max ? ring->head + 1 : 0; --} -- --static void netlink_forward_ring(struct netlink_ring *ring) --{ -- unsigned int head = ring->head; -- const struct nl_mmap_hdr *hdr; -- -- do { -- hdr = __netlink_lookup_frame(ring, ring->head); -- if (hdr->nm_status == NL_MMAP_STATUS_UNUSED) -- break; -- if (hdr->nm_status != NL_MMAP_STATUS_SKIP) -- break; -- netlink_increment_head(ring); -- } while (ring->head != head); --} -- --static bool netlink_has_valid_frame(struct netlink_ring *ring) --{ -- unsigned int head = ring->head, pos = head; -- const struct nl_mmap_hdr *hdr; -- -- do { -- hdr = __netlink_lookup_frame(ring, pos); -- if (hdr->nm_status == NL_MMAP_STATUS_VALID) -- return true; -- pos = pos != 0 ? pos - 1 : ring->frame_max; -- } while (pos != head); -- -- return false; --} -- --static bool netlink_dump_space(struct netlink_sock *nlk) --{ -- struct netlink_ring *ring = &nlk->rx_ring; -- struct nl_mmap_hdr *hdr; -- unsigned int n; -- -- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); -- if (hdr == NULL) -- return false; -- -- n = ring->head + ring->frame_max / 2; -- if (n > ring->frame_max) -- n -= ring->frame_max; -- -- hdr = __netlink_lookup_frame(ring, n); -- -- return hdr->nm_status == NL_MMAP_STATUS_UNUSED; --} -- --static unsigned int netlink_poll(struct file *file, struct socket *sock, -- poll_table *wait) --{ -- struct sock *sk = sock->sk; -- struct netlink_sock *nlk = nlk_sk(sk); -- unsigned int mask; -- int err; -- -- if (nlk->rx_ring.pg_vec != NULL) { -- /* Memory mapped sockets don't call recvmsg(), so flow control -- * for dumps is performed here. A dump is allowed to continue -- * if at least half the ring is unused. -- */ -- while (nlk->cb_running && netlink_dump_space(nlk)) { -- err = netlink_dump(sk); -- if (err < 0) { -- sk->sk_err = -err; -- sk->sk_error_report(sk); -- break; -- } -- } -- netlink_rcv_wake(sk); -- } -- -- mask = datagram_poll(file, sock, wait); -- -- /* We could already have received frames in the normal receive -- * queue, that will show up as NL_MMAP_STATUS_COPY in the ring, -- * so if mask contains pollin/etc already, there's no point -- * walking the ring. -- */ -- if ((mask & (POLLIN | POLLRDNORM)) != (POLLIN | POLLRDNORM)) { -- spin_lock_bh(&sk->sk_receive_queue.lock); -- if (nlk->rx_ring.pg_vec) { -- if (netlink_has_valid_frame(&nlk->rx_ring)) -- mask |= POLLIN | POLLRDNORM; -- } -- spin_unlock_bh(&sk->sk_receive_queue.lock); -- } -- -- spin_lock_bh(&sk->sk_write_queue.lock); -- if (nlk->tx_ring.pg_vec) { -- if (netlink_current_frame(&nlk->tx_ring, NL_MMAP_STATUS_UNUSED)) -- mask |= POLLOUT | POLLWRNORM; -- } -- spin_unlock_bh(&sk->sk_write_queue.lock); -- -- return mask; --} -- --static struct nl_mmap_hdr *netlink_mmap_hdr(struct sk_buff *skb) --{ -- return (struct nl_mmap_hdr *)(skb->head - NL_MMAP_HDRLEN); --} -- --static void netlink_ring_setup_skb(struct sk_buff *skb, struct sock *sk, -- struct netlink_ring *ring, -- struct nl_mmap_hdr *hdr) --{ -- unsigned int size; -- void *data; -- -- size = ring->frame_size - NL_MMAP_HDRLEN; -- data = (void *)hdr + NL_MMAP_HDRLEN; -- -- skb->head = data; -- skb->data = data; -- skb_reset_tail_pointer(skb); -- skb->end = skb->tail + size; -- skb->len = 0; -- -- skb->destructor = netlink_skb_destructor; -- NETLINK_CB(skb).flags |= NETLINK_SKB_MMAPED; -- NETLINK_CB(skb).sk = sk; --} -- --static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg, -- u32 dst_portid, u32 dst_group, -- struct scm_cookie *scm) --{ -- struct netlink_sock *nlk = nlk_sk(sk); -- struct netlink_ring *ring; -- struct nl_mmap_hdr *hdr; -- struct sk_buff *skb; -- unsigned int maxlen; -- int err = 0, len = 0; -- -- mutex_lock(&nlk->pg_vec_lock); -- -- ring = &nlk->tx_ring; -- maxlen = ring->frame_size - NL_MMAP_HDRLEN; -- -- do { -- unsigned int nm_len; -- -- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID); -- if (hdr == NULL) { -- if (!(msg->msg_flags & MSG_DONTWAIT) && -- atomic_read(&nlk->tx_ring.pending)) -- schedule(); -- continue; -- } -- -- nm_len = ACCESS_ONCE(hdr->nm_len); -- if (nm_len > maxlen) { -- err = -EINVAL; -- goto out; -- } -- -- netlink_frame_flush_dcache(hdr, nm_len); -- -- skb = alloc_skb(nm_len, GFP_KERNEL); -- if (skb == NULL) { -- err = -ENOBUFS; -- goto out; -- } -- __skb_put(skb, nm_len); -- memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len); -- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); -- -- netlink_increment_head(ring); -- -- NETLINK_CB(skb).portid = nlk->portid; -- NETLINK_CB(skb).dst_group = dst_group; -- NETLINK_CB(skb).creds = scm->creds; -- -- err = security_netlink_send(sk, skb); -- if (err) { -- kfree_skb(skb); -- goto out; -- } -- -- if (unlikely(dst_group)) { -- atomic_inc(&skb->users); -- netlink_broadcast(sk, skb, dst_portid, dst_group, -- GFP_KERNEL); -- } -- err = netlink_unicast(sk, skb, dst_portid, -- msg->msg_flags & MSG_DONTWAIT); -- if (err < 0) -- goto out; -- len += err; -- -- } while (hdr != NULL || -- (!(msg->msg_flags & MSG_DONTWAIT) && -- atomic_read(&nlk->tx_ring.pending))); -- -- if (len > 0) -- err = len; --out: -- mutex_unlock(&nlk->pg_vec_lock); -- return err; --} -- --static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb) --{ -- struct nl_mmap_hdr *hdr; -- -- hdr = netlink_mmap_hdr(skb); -- hdr->nm_len = skb->len; -- hdr->nm_group = NETLINK_CB(skb).dst_group; -- hdr->nm_pid = NETLINK_CB(skb).creds.pid; -- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); -- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); -- netlink_frame_flush_dcache(hdr, hdr->nm_len); -- netlink_set_status(hdr, NL_MMAP_STATUS_VALID); -- -- NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED; -- kfree_skb(skb); --} -- --static void netlink_ring_set_copied(struct sock *sk, struct sk_buff *skb) --{ -- struct netlink_sock *nlk = nlk_sk(sk); -- struct netlink_ring *ring = &nlk->rx_ring; -- struct nl_mmap_hdr *hdr; -- -- spin_lock_bh(&sk->sk_receive_queue.lock); -- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); -- if (hdr == NULL) { -- spin_unlock_bh(&sk->sk_receive_queue.lock); -- kfree_skb(skb); -- netlink_overrun(sk); -- return; -- } -- netlink_increment_head(ring); -- __skb_queue_tail(&sk->sk_receive_queue, skb); -- spin_unlock_bh(&sk->sk_receive_queue.lock); -- -- hdr->nm_len = skb->len; -- hdr->nm_group = NETLINK_CB(skb).dst_group; -- hdr->nm_pid = NETLINK_CB(skb).creds.pid; -- hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid); -- hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid); -- netlink_set_status(hdr, NL_MMAP_STATUS_COPY); --} -- --#else /* CONFIG_NETLINK_MMAP */ --#define netlink_rx_is_mmaped(sk) false --#define netlink_tx_is_mmaped(sk) false --#define netlink_mmap sock_no_mmap --#define netlink_poll datagram_poll --#define netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, scm) 0 --#endif /* CONFIG_NETLINK_MMAP */ -- - static void netlink_skb_destructor(struct sk_buff *skb) - { --#ifdef CONFIG_NETLINK_MMAP -- struct nl_mmap_hdr *hdr; -- struct netlink_ring *ring; -- struct sock *sk; -- -- /* If a packet from the kernel to userspace was freed because of an -- * error without being delivered to userspace, the kernel must reset -- * the status. In the direction userspace to kernel, the status is -- * always reset here after the packet was processed and freed. -- */ -- if (netlink_skb_is_mmaped(skb)) { -- hdr = netlink_mmap_hdr(skb); -- sk = NETLINK_CB(skb).sk; -- -- if (NETLINK_CB(skb).flags & NETLINK_SKB_TX) { -- netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED); -- ring = &nlk_sk(sk)->tx_ring; -- } else { -- if (!(NETLINK_CB(skb).flags & NETLINK_SKB_DELIVERED)) { -- hdr->nm_len = 0; -- netlink_set_status(hdr, NL_MMAP_STATUS_VALID); -- } -- ring = &nlk_sk(sk)->rx_ring; -- } -- -- WARN_ON(atomic_read(&ring->pending) == 0); -- atomic_dec(&ring->pending); -- sock_put(sk); -- -- skb->head = NULL; -- } --#endif - if (is_vmalloc_addr(skb->head)) { - if (!skb->cloned || - !atomic_dec_return(&(skb_shinfo(skb)->dataref))) -@@ -936,18 +334,6 @@ static void netlink_sock_destruct(struct sock *sk) - } - - skb_queue_purge(&sk->sk_receive_queue); --#ifdef CONFIG_NETLINK_MMAP -- if (1) { -- struct nl_mmap_req req; -- -- memset(&req, 0, sizeof(req)); -- if (nlk->rx_ring.pg_vec) -- __netlink_set_ring(sk, &req, false, NULL, 0); -- memset(&req, 0, sizeof(req)); -- if (nlk->tx_ring.pg_vec) -- __netlink_set_ring(sk, &req, true, NULL, 0); -- } --#endif /* CONFIG_NETLINK_MMAP */ - - if (!sock_flag(sk, SOCK_DEAD)) { - printk(KERN_ERR "Freeing alive netlink socket %p\n", sk); -@@ -1201,9 +587,6 @@ static int __netlink_create(struct net *net, struct socket *sock, - mutex_init(nlk->cb_mutex); - } - init_waitqueue_head(&nlk->wait); --#ifdef CONFIG_NETLINK_MMAP -- mutex_init(&nlk->pg_vec_lock); --#endif - - sk->sk_destruct = netlink_sock_destruct; - sk->sk_protocol = protocol; -@@ -1745,8 +1128,7 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb, - nlk = nlk_sk(sk); - - if ((atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf || -- test_bit(NETLINK_S_CONGESTED, &nlk->state)) && -- !netlink_skb_is_mmaped(skb)) { -+ test_bit(NETLINK_S_CONGESTED, &nlk->state))) { - DECLARE_WAITQUEUE(wait, current); - if (!*timeo) { - if (!ssk || netlink_is_kernel(ssk)) -@@ -1784,14 +1166,7 @@ static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb) - - netlink_deliver_tap(skb); - --#ifdef CONFIG_NETLINK_MMAP -- if (netlink_skb_is_mmaped(skb)) -- netlink_queue_mmaped_skb(sk, skb); -- else if (netlink_rx_is_mmaped(sk)) -- netlink_ring_set_copied(sk, skb); -- else --#endif /* CONFIG_NETLINK_MMAP */ -- skb_queue_tail(&sk->sk_receive_queue, skb); -+ skb_queue_tail(&sk->sk_receive_queue, skb); - sk->sk_data_ready(sk); - return len; - } -@@ -1815,9 +1190,6 @@ static struct sk_buff *netlink_trim(struct sk_buff *skb, gfp_t allocation) - int delta; - - WARN_ON(skb->sk != NULL); -- if (netlink_skb_is_mmaped(skb)) -- return skb; -- - delta = skb->end - skb->tail; - if (is_vmalloc_addr(skb->head) || delta * 2 < skb->truesize) - return skb; -@@ -1897,71 +1269,6 @@ struct sk_buff *__netlink_alloc_skb(struct sock *ssk, unsigned int size, - unsigned int ldiff, u32 dst_portid, - gfp_t gfp_mask) - { --#ifdef CONFIG_NETLINK_MMAP -- unsigned int maxlen, linear_size; -- struct sock *sk = NULL; -- struct sk_buff *skb; -- struct netlink_ring *ring; -- struct nl_mmap_hdr *hdr; -- -- sk = netlink_getsockbyportid(ssk, dst_portid); -- if (IS_ERR(sk)) -- goto out; -- -- ring = &nlk_sk(sk)->rx_ring; -- /* fast-path without atomic ops for common case: non-mmaped receiver */ -- if (ring->pg_vec == NULL) -- goto out_put; -- -- /* We need to account the full linear size needed as a ring -- * slot cannot have non-linear parts. -- */ -- linear_size = size + ldiff; -- if (ring->frame_size - NL_MMAP_HDRLEN < linear_size) -- goto out_put; -- -- skb = alloc_skb_head(gfp_mask); -- if (skb == NULL) -- goto err1; -- -- spin_lock_bh(&sk->sk_receive_queue.lock); -- /* check again under lock */ -- if (ring->pg_vec == NULL) -- goto out_free; -- -- /* check again under lock */ -- maxlen = ring->frame_size - NL_MMAP_HDRLEN; -- if (maxlen < linear_size) -- goto out_free; -- -- netlink_forward_ring(ring); -- hdr = netlink_current_frame(ring, NL_MMAP_STATUS_UNUSED); -- if (hdr == NULL) -- goto err2; -- -- netlink_ring_setup_skb(skb, sk, ring, hdr); -- netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED); -- atomic_inc(&ring->pending); -- netlink_increment_head(ring); -- -- spin_unlock_bh(&sk->sk_receive_queue.lock); -- return skb; -- --err2: -- kfree_skb(skb); -- spin_unlock_bh(&sk->sk_receive_queue.lock); -- netlink_overrun(sk); --err1: -- sock_put(sk); -- return NULL; -- --out_free: -- kfree_skb(skb); -- spin_unlock_bh(&sk->sk_receive_queue.lock); --out_put: -- sock_put(sk); --out: --#endif - return alloc_skb(size, gfp_mask); - } - EXPORT_SYMBOL_GPL(__netlink_alloc_skb); -@@ -2242,8 +1549,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, - if (level != SOL_NETLINK) - return -ENOPROTOOPT; - -- if (optname != NETLINK_RX_RING && optname != NETLINK_TX_RING && -- optlen >= sizeof(int) && -+ if (optlen >= sizeof(int) && - get_user(val, (unsigned int __user *)optval)) - return -EFAULT; - -@@ -2296,25 +1602,6 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, - } - err = 0; - break; --#ifdef CONFIG_NETLINK_MMAP -- case NETLINK_RX_RING: -- case NETLINK_TX_RING: { -- struct nl_mmap_req req; -- -- /* Rings might consume more memory than queue limits, require -- * CAP_NET_ADMIN. -- */ -- if (!capable(CAP_NET_ADMIN)) -- return -EPERM; -- if (optlen < sizeof(req)) -- return -EINVAL; -- if (copy_from_user(&req, optval, sizeof(req))) -- return -EFAULT; -- err = netlink_set_ring(sk, &req, -- optname == NETLINK_TX_RING); -- break; -- } --#endif /* CONFIG_NETLINK_MMAP */ - case NETLINK_LISTEN_ALL_NSID: - if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_BROADCAST)) - return -EPERM; -@@ -2484,18 +1771,6 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) - smp_rmb(); - } - -- /* It's a really convoluted way for userland to ask for mmaped -- * sendmsg(), but that's what we've got... -- */ -- if (netlink_tx_is_mmaped(sk) && -- iter_is_iovec(&msg->msg_iter) && -- msg->msg_iter.nr_segs == 1 && -- msg->msg_iter.iov->iov_base == NULL) { -- err = netlink_mmap_sendmsg(sk, msg, dst_portid, dst_group, -- &scm); -- goto out; -- } -- - err = -EMSGSIZE; - if (len > sk->sk_sndbuf - 32) - goto out; -@@ -2812,8 +2087,7 @@ static int netlink_dump(struct sock *sk) - goto errout_skb; - } - -- if (!netlink_rx_is_mmaped(sk) && -- atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) -+ if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) - goto errout_skb; - - /* NLMSG_GOODSIZE is small to avoid high order allocations being -@@ -2902,16 +2176,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, - struct netlink_sock *nlk; - int ret; - -- /* Memory mapped dump requests need to be copied to avoid looping -- * on the pending state in netlink_mmap_sendmsg() while the CB hold -- * a reference to the skb. -- */ -- if (netlink_skb_is_mmaped(skb)) { -- skb = skb_copy(skb, GFP_KERNEL); -- if (skb == NULL) -- return -ENOBUFS; -- } else -- atomic_inc(&skb->users); -+ atomic_inc(&skb->users); - - sk = netlink_lookup(sock_net(ssk), ssk->sk_protocol, NETLINK_CB(skb).portid); - if (sk == NULL) { -@@ -3255,7 +2520,7 @@ static const struct proto_ops netlink_ops = { - .socketpair = sock_no_socketpair, - .accept = sock_no_accept, - .getname = netlink_getname, -- .poll = netlink_poll, -+ .poll = datagram_poll, - .ioctl = sock_no_ioctl, - .listen = sock_no_listen, - .shutdown = sock_no_shutdown, -@@ -3263,7 +2528,7 @@ static const struct proto_ops netlink_ops = { - .getsockopt = netlink_getsockopt, - .sendmsg = netlink_sendmsg, - .recvmsg = netlink_recvmsg, -- .mmap = netlink_mmap, -+ .mmap = sock_no_mmap, - .sendpage = sock_no_sendpage, - }; - -diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h -index df32cb92d9fc..ea4600aea6b0 100644 ---- a/net/netlink/af_netlink.h -+++ b/net/netlink/af_netlink.h -@@ -45,12 +45,6 @@ struct netlink_sock { - int (*netlink_bind)(struct net *net, int group); - void (*netlink_unbind)(struct net *net, int group); - struct module *module; --#ifdef CONFIG_NETLINK_MMAP -- struct mutex pg_vec_lock; -- struct netlink_ring rx_ring; -- struct netlink_ring tx_ring; -- atomic_t mapped; --#endif /* CONFIG_NETLINK_MMAP */ - - struct rhash_head node; - struct rcu_head rcu; -@@ -62,15 +56,6 @@ static inline struct netlink_sock *nlk_sk(struct sock *sk) - return container_of(sk, struct netlink_sock, sk); - } - --static inline bool netlink_skb_is_mmaped(const struct sk_buff *skb) --{ --#ifdef CONFIG_NETLINK_MMAP -- return NETLINK_CB(skb).flags & NETLINK_SKB_MMAPED; --#else -- return false; --#endif /* CONFIG_NETLINK_MMAP */ --} -- - struct netlink_table { - struct rhashtable hash; - struct hlist_head mc_list; -diff --git a/net/netlink/diag.c b/net/netlink/diag.c -index 3ee63a3cff30..8dd836a8dd60 100644 ---- a/net/netlink/diag.c -+++ b/net/netlink/diag.c -@@ -8,41 +8,6 @@ - - #include "af_netlink.h" - --#ifdef CONFIG_NETLINK_MMAP --static int sk_diag_put_ring(struct netlink_ring *ring, int nl_type, -- struct sk_buff *nlskb) --{ -- struct netlink_diag_ring ndr; -- -- ndr.ndr_block_size = ring->pg_vec_pages << PAGE_SHIFT; -- ndr.ndr_block_nr = ring->pg_vec_len; -- ndr.ndr_frame_size = ring->frame_size; -- ndr.ndr_frame_nr = ring->frame_max + 1; -- -- return nla_put(nlskb, nl_type, sizeof(ndr), &ndr); --} -- --static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb) --{ -- struct netlink_sock *nlk = nlk_sk(sk); -- int ret; -- -- mutex_lock(&nlk->pg_vec_lock); -- ret = sk_diag_put_ring(&nlk->rx_ring, NETLINK_DIAG_RX_RING, nlskb); -- if (!ret) -- ret = sk_diag_put_ring(&nlk->tx_ring, NETLINK_DIAG_TX_RING, -- nlskb); -- mutex_unlock(&nlk->pg_vec_lock); -- -- return ret; --} --#else --static int sk_diag_put_rings_cfg(struct sock *sk, struct sk_buff *nlskb) --{ -- return 0; --} --#endif -- - static int sk_diag_dump_groups(struct sock *sk, struct sk_buff *nlskb) - { - struct netlink_sock *nlk = nlk_sk(sk); -@@ -87,10 +52,6 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, - sock_diag_put_meminfo(sk, skb, NETLINK_DIAG_MEMINFO)) - goto out_nlmsg_trim; - -- if ((req->ndiag_show & NDIAG_SHOW_RING_CFG) && -- sk_diag_put_rings_cfg(sk, skb)) -- goto out_nlmsg_trim; -- - nlmsg_end(skb, nlh); - return 0; - -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d805cd577a60..3975ac809934 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3021,7 +3021,7 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - int addr_len) - { - struct sock *sk = sock->sk; -- char name[15]; -+ char name[sizeof(uaddr->sa_data) + 1]; - - /* - * Check legality -@@ -3029,7 +3029,11 @@ static int packet_bind_spkt(struct socket *sock, struct sockaddr *uaddr, - - if (addr_len != sizeof(struct sockaddr)) - return -EINVAL; -- strlcpy(name, uaddr->sa_data, sizeof(name)); -+ /* uaddr->sa_data comes from the userspace, it's not guaranteed to be -+ * zero-terminated. -+ */ -+ memcpy(name, uaddr->sa_data, sizeof(uaddr->sa_data)); -+ name[sizeof(uaddr->sa_data)] = 0; - - return packet_do_bind(sk, name, 0, pkt_sk(sk)->num); - } -diff --git a/net/sched/act_api.c b/net/sched/act_api.c -index 06e7c4a37245..694a06f1e0d5 100644 ---- a/net/sched/act_api.c -+++ b/net/sched/act_api.c -@@ -820,10 +820,8 @@ static int tca_action_flush(struct net *net, struct nlattr *nla, - goto out_module_put; - - err = a.ops->walk(skb, &dcb, RTM_DELACTION, &a); -- if (err < 0) -+ if (err <= 0) - goto out_module_put; -- if (err == 0) -- goto noflush_out; - - nla_nest_end(skb, nest); - -@@ -840,7 +838,6 @@ static int tca_action_flush(struct net *net, struct nlattr *nla, - out_module_put: - module_put(a.ops->owner); - err_out: --noflush_out: - kfree_skb(skb); - return err; - } -diff --git a/net/sched/act_connmark.c b/net/sched/act_connmark.c -index bb41699c6c49..7ecb14f3db54 100644 ---- a/net/sched/act_connmark.c -+++ b/net/sched/act_connmark.c -@@ -109,6 +109,9 @@ static int tcf_connmark_init(struct net *net, struct nlattr *nla, - if (ret < 0) - return ret; - -+ if (!tb[TCA_CONNMARK_PARMS]) -+ return -EINVAL; -+ - parm = nla_data(tb[TCA_CONNMARK_PARMS]); - - if (!tcf_hash_check(parm->index, a, bind)) { diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.56-57.patch b/patch/kernel/mvebu64-default/03-patch-4.4.56-57.patch deleted file mode 100644 index ccf9ed3652c8..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.56-57.patch +++ /dev/null @@ -1,1096 +0,0 @@ -diff --git a/Makefile b/Makefile -index cf9303a5d621..841675e63a38 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 56 -+SUBLEVEL = 57 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/powerpc/boot/zImage.lds.S b/arch/powerpc/boot/zImage.lds.S -index 861e72109df2..f080abfc2f83 100644 ---- a/arch/powerpc/boot/zImage.lds.S -+++ b/arch/powerpc/boot/zImage.lds.S -@@ -68,6 +68,7 @@ SECTIONS - } - - #ifdef CONFIG_PPC64_BOOT_WRAPPER -+ . = ALIGN(256); - .got : - { - __toc_start = .; -diff --git a/arch/powerpc/kvm/emulate.c b/arch/powerpc/kvm/emulate.c -index 5cc2e7af3a7b..b379146de55b 100644 ---- a/arch/powerpc/kvm/emulate.c -+++ b/arch/powerpc/kvm/emulate.c -@@ -302,7 +302,6 @@ int kvmppc_emulate_instruction(struct kvm_run *run, struct kvm_vcpu *vcpu) - advance = 0; - printk(KERN_ERR "Couldn't emulate instruction 0x%08x " - "(op %d xop %d)\n", inst, get_op(inst), get_xop(inst)); -- kvmppc_core_queue_program(vcpu, 0); - } - } - -diff --git a/arch/s390/pci/pci_dma.c b/arch/s390/pci/pci_dma.c -index 3a40f718baef..4004e03267cd 100644 ---- a/arch/s390/pci/pci_dma.c -+++ b/arch/s390/pci/pci_dma.c -@@ -455,7 +455,7 @@ int zpci_dma_init_device(struct zpci_dev *zdev) - zdev->dma_table = dma_alloc_cpu_table(); - if (!zdev->dma_table) { - rc = -ENOMEM; -- goto out_clean; -+ goto out; - } - - /* -@@ -475,18 +475,22 @@ int zpci_dma_init_device(struct zpci_dev *zdev) - zdev->iommu_bitmap = vzalloc(zdev->iommu_pages / 8); - if (!zdev->iommu_bitmap) { - rc = -ENOMEM; -- goto out_reg; -+ goto free_dma_table; - } - - rc = zpci_register_ioat(zdev, 0, zdev->start_dma, zdev->end_dma, - (u64) zdev->dma_table); - if (rc) -- goto out_reg; -- return 0; -+ goto free_bitmap; - --out_reg: -+ return 0; -+free_bitmap: -+ vfree(zdev->iommu_bitmap); -+ zdev->iommu_bitmap = NULL; -+free_dma_table: - dma_free_cpu_table(zdev->dma_table); --out_clean: -+ zdev->dma_table = NULL; -+out: - return rc; - } - -diff --git a/arch/x86/crypto/ghash-clmulni-intel_glue.c b/arch/x86/crypto/ghash-clmulni-intel_glue.c -index 440df0c7a2ee..a69321a77783 100644 ---- a/arch/x86/crypto/ghash-clmulni-intel_glue.c -+++ b/arch/x86/crypto/ghash-clmulni-intel_glue.c -@@ -219,6 +219,29 @@ static int ghash_async_final(struct ahash_request *req) - } - } - -+static int ghash_async_import(struct ahash_request *req, const void *in) -+{ -+ struct ahash_request *cryptd_req = ahash_request_ctx(req); -+ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); -+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -+ -+ ghash_async_init(req); -+ memcpy(dctx, in, sizeof(*dctx)); -+ return 0; -+ -+} -+ -+static int ghash_async_export(struct ahash_request *req, void *out) -+{ -+ struct ahash_request *cryptd_req = ahash_request_ctx(req); -+ struct shash_desc *desc = cryptd_shash_desc(cryptd_req); -+ struct ghash_desc_ctx *dctx = shash_desc_ctx(desc); -+ -+ memcpy(out, dctx, sizeof(*dctx)); -+ return 0; -+ -+} -+ - static int ghash_async_digest(struct ahash_request *req) - { - struct crypto_ahash *tfm = crypto_ahash_reqtfm(req); -@@ -288,8 +311,11 @@ static struct ahash_alg ghash_async_alg = { - .final = ghash_async_final, - .setkey = ghash_async_setkey, - .digest = ghash_async_digest, -+ .export = ghash_async_export, -+ .import = ghash_async_import, - .halg = { - .digestsize = GHASH_DIGEST_SIZE, -+ .statesize = sizeof(struct ghash_desc_ctx), - .base = { - .cra_name = "ghash", - .cra_driver_name = "ghash-clmulni", -diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c -index 9e2ba5c6e1dd..f42e78de1e10 100644 ---- a/arch/x86/xen/spinlock.c -+++ b/arch/x86/xen/spinlock.c -@@ -27,6 +27,12 @@ static bool xen_pvspin = true; - - static void xen_qlock_kick(int cpu) - { -+ int irq = per_cpu(lock_kicker_irq, cpu); -+ -+ /* Don't kick if the target's kicker interrupt is not initialized. */ -+ if (irq == -1) -+ return; -+ - xen_send_IPI_one(cpu, XEN_SPIN_UNLOCK_VECTOR); - } - -diff --git a/crypto/cryptd.c b/crypto/cryptd.c -index e7aa904cb20b..26a504db3f53 100644 ---- a/crypto/cryptd.c -+++ b/crypto/cryptd.c -@@ -642,6 +642,7 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, - inst->alg.halg.base.cra_flags = type; - - inst->alg.halg.digestsize = salg->digestsize; -+ inst->alg.halg.statesize = salg->statesize; - inst->alg.halg.base.cra_ctxsize = sizeof(struct cryptd_hash_ctx); - - inst->alg.halg.base.cra_init = cryptd_hash_init_tfm; -diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c -index a0ceb41d5ccc..b4f3930266b1 100644 ---- a/crypto/mcryptd.c -+++ b/crypto/mcryptd.c -@@ -531,6 +531,7 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, - inst->alg.halg.base.cra_flags = type; - - inst->alg.halg.digestsize = salg->digestsize; -+ inst->alg.halg.statesize = salg->statesize; - inst->alg.halg.base.cra_ctxsize = sizeof(struct mcryptd_hash_ctx); - - inst->alg.halg.base.cra_init = mcryptd_hash_init_tfm; -diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c -index 5fdac394207a..549cdbed7b0e 100644 ---- a/drivers/acpi/acpi_video.c -+++ b/drivers/acpi/acpi_video.c -@@ -1211,6 +1211,9 @@ static int acpi_video_device_enumerate(struct acpi_video_bus *video) - union acpi_object *dod = NULL; - union acpi_object *obj; - -+ if (!video->cap._DOD) -+ return AE_NOT_EXIST; -+ - status = acpi_evaluate_object(video->device->handle, "_DOD", NULL, &buffer); - if (!ACPI_SUCCESS(status)) { - ACPI_EXCEPTION((AE_INFO, status, "Evaluating _DOD")); -diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c -index 65f7eecc45b0..f10a107614b4 100644 ---- a/drivers/char/tpm/tpm_tis.c -+++ b/drivers/char/tpm/tpm_tis.c -@@ -401,7 +401,7 @@ static void disable_interrupts(struct tpm_chip *chip) - iowrite32(intmask, - chip->vendor.iobase + - TPM_INT_ENABLE(chip->vendor.locality)); -- free_irq(chip->vendor.irq, chip); -+ devm_free_irq(chip->pdev, chip->vendor.irq, chip); - chip->vendor.irq = 0; - } - -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 8412ce5f93a7..86fa9fdc8323 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -626,9 +626,11 @@ static ssize_t show_cpuinfo_cur_freq(struct cpufreq_policy *policy, - char *buf) - { - unsigned int cur_freq = __cpufreq_get(policy); -- if (!cur_freq) -- return sprintf(buf, ""); -- return sprintf(buf, "%u\n", cur_freq); -+ -+ if (cur_freq) -+ return sprintf(buf, "%u\n", cur_freq); -+ -+ return sprintf(buf, "\n"); - } - - /** -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c -index 7c42ff670080..a0924330d125 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_irq.c -@@ -25,6 +25,7 @@ - * Alex Deucher - * Jerome Glisse - */ -+#include - #include - #include - #include -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 57c191798699..ddbf7e7e0d98 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -274,7 +274,7 @@ cleanup: - * - * This routine is called normally during driver unloading or exiting. - */ --void hv_cleanup(void) -+void hv_cleanup(bool crash) - { - union hv_x64_msr_hypercall_contents hypercall_msr; - -@@ -284,7 +284,8 @@ void hv_cleanup(void) - if (hv_context.hypercall_page) { - hypercall_msr.as_uint64 = 0; - wrmsrl(HV_X64_MSR_HYPERCALL, hypercall_msr.as_uint64); -- vfree(hv_context.hypercall_page); -+ if (!crash) -+ vfree(hv_context.hypercall_page); - hv_context.hypercall_page = NULL; - } - -@@ -304,7 +305,8 @@ void hv_cleanup(void) - - hypercall_msr.as_uint64 = 0; - wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64); -- vfree(hv_context.tsc_page); -+ if (!crash) -+ vfree(hv_context.tsc_page); - hv_context.tsc_page = NULL; - } - #endif -diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c -index b853b4b083bd..43af91362be5 100644 ---- a/drivers/hv/hv_balloon.c -+++ b/drivers/hv/hv_balloon.c -@@ -714,7 +714,7 @@ static bool pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) - * If the pfn range we are dealing with is not in the current - * "hot add block", move on. - */ -- if ((start_pfn >= has->end_pfn)) -+ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn) - continue; - /* - * If the current hot add-request extends beyond -@@ -768,7 +768,7 @@ static unsigned long handle_pg_range(unsigned long pg_start, - * If the pfn range we are dealing with is not in the current - * "hot add block", move on. - */ -- if ((start_pfn >= has->end_pfn)) -+ if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn) - continue; - - old_covered_state = has->covered_end_pfn; -diff --git a/drivers/hv/hyperv_vmbus.h b/drivers/hv/hyperv_vmbus.h -index 12156db2e88e..75e383e6d03d 100644 ---- a/drivers/hv/hyperv_vmbus.h -+++ b/drivers/hv/hyperv_vmbus.h -@@ -581,7 +581,7 @@ struct hv_ring_buffer_debug_info { - - extern int hv_init(void); - --extern void hv_cleanup(void); -+extern void hv_cleanup(bool crash); - - extern int hv_post_message(union hv_connection_id connection_id, - enum hv_message_type message_type, -diff --git a/drivers/hv/vmbus_drv.c b/drivers/hv/vmbus_drv.c -index 509ed9731630..802dcb409030 100644 ---- a/drivers/hv/vmbus_drv.c -+++ b/drivers/hv/vmbus_drv.c -@@ -889,7 +889,7 @@ err_alloc: - bus_unregister(&hv_bus); - - err_cleanup: -- hv_cleanup(); -+ hv_cleanup(false); - - return ret; - } -@@ -1254,7 +1254,7 @@ static void hv_kexec_handler(void) - vmbus_initiate_unload(); - for_each_online_cpu(cpu) - smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1); -- hv_cleanup(); -+ hv_cleanup(false); - }; - - static void hv_crash_handler(struct pt_regs *regs) -@@ -1266,7 +1266,7 @@ static void hv_crash_handler(struct pt_regs *regs) - * for kdump. - */ - hv_synic_cleanup(NULL); -- hv_cleanup(); -+ hv_cleanup(true); - }; - - static int __init hv_acpi_init(void) -@@ -1330,7 +1330,7 @@ static void __exit vmbus_exit(void) - &hyperv_panic_block); - } - bus_unregister(&hv_bus); -- hv_cleanup(); -+ hv_cleanup(false); - for_each_online_cpu(cpu) { - tasklet_kill(hv_context.event_dpc[cpu]); - smp_call_function_single(cpu, hv_synic_cleanup, NULL, 1); -diff --git a/drivers/isdn/gigaset/bas-gigaset.c b/drivers/isdn/gigaset/bas-gigaset.c -index aecec6d32463..7f1c625b08ec 100644 ---- a/drivers/isdn/gigaset/bas-gigaset.c -+++ b/drivers/isdn/gigaset/bas-gigaset.c -@@ -2317,6 +2317,9 @@ static int gigaset_probe(struct usb_interface *interface, - return -ENODEV; - } - -+ if (hostif->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - dev_info(&udev->dev, - "%s: Device matched (Vendor: 0x%x, Product: 0x%x)\n", - __func__, le16_to_cpu(udev->descriptor.idVendor), -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index ebb0dd612ebd..122af340a531 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1477,7 +1477,25 @@ static void make_request(struct mddev *mddev, struct bio *bio) - split = bio; - } - -+ /* -+ * If a bio is splitted, the first part of bio will pass -+ * barrier but the bio is queued in current->bio_list (see -+ * generic_make_request). If there is a raise_barrier() called -+ * here, the second part of bio can't pass barrier. But since -+ * the first part bio isn't dispatched to underlaying disks -+ * yet, the barrier is never released, hence raise_barrier will -+ * alays wait. We have a deadlock. -+ * Note, this only happens in read path. For write path, the -+ * first part of bio is dispatched in a schedule() call -+ * (because of blk plug) or offloaded to raid10d. -+ * Quitting from the function immediately can change the bio -+ * order queued in bio_list and avoid the deadlock. -+ */ - __make_request(mddev, split); -+ if (split != bio && bio_data_dir(bio) == READ) { -+ generic_make_request(bio); -+ break; -+ } - } while (split != bio); - - /* In case raid10d snuck in to freeze_array */ -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index e8a09ff9e724..c8a7802d2953 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -197,65 +197,6 @@ static void *init_ppi_data(struct rndis_message *msg, u32 ppi_size, - return ppi; - } - --union sub_key { -- u64 k; -- struct { -- u8 pad[3]; -- u8 kb; -- u32 ka; -- }; --}; -- --/* Toeplitz hash function -- * data: network byte order -- * return: host byte order -- */ --static u32 comp_hash(u8 *key, int klen, void *data, int dlen) --{ -- union sub_key subk; -- int k_next = 4; -- u8 dt; -- int i, j; -- u32 ret = 0; -- -- subk.k = 0; -- subk.ka = ntohl(*(u32 *)key); -- -- for (i = 0; i < dlen; i++) { -- subk.kb = key[k_next]; -- k_next = (k_next + 1) % klen; -- dt = ((u8 *)data)[i]; -- for (j = 0; j < 8; j++) { -- if (dt & 0x80) -- ret ^= subk.ka; -- dt <<= 1; -- subk.k <<= 1; -- } -- } -- -- return ret; --} -- --static bool netvsc_set_hash(u32 *hash, struct sk_buff *skb) --{ -- struct flow_keys flow; -- int data_len; -- -- if (!skb_flow_dissect_flow_keys(skb, &flow, 0) || -- !(flow.basic.n_proto == htons(ETH_P_IP) || -- flow.basic.n_proto == htons(ETH_P_IPV6))) -- return false; -- -- if (flow.basic.ip_proto == IPPROTO_TCP) -- data_len = 12; -- else -- data_len = 8; -- -- *hash = comp_hash(netvsc_hash_key, HASH_KEYLEN, &flow, data_len); -- -- return true; --} -- - static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb, - void *accel_priv, select_queue_fallback_t fallback) - { -@@ -268,11 +209,9 @@ static u16 netvsc_select_queue(struct net_device *ndev, struct sk_buff *skb, - if (nvsc_dev == NULL || ndev->real_num_tx_queues <= 1) - return 0; - -- if (netvsc_set_hash(&hash, skb)) { -- q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] % -- ndev->real_num_tx_queues; -- skb_set_hash(skb, hash, PKT_HASH_TYPE_L3); -- } -+ hash = skb_get_hash(skb); -+ q_idx = nvsc_dev->send_table[hash % VRSS_SEND_TAB_SIZE] % -+ ndev->real_num_tx_queues; - - return q_idx; - } -diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c -index a009ae34c5ef..930f0f25c1ce 100644 ---- a/drivers/pinctrl/intel/pinctrl-cherryview.c -+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c -@@ -1466,12 +1466,11 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq) - offset += range->npins; - } - -- /* Mask and clear all interrupts */ -- chv_writel(0, pctrl->regs + CHV_INTMASK); -+ /* Clear all interrupts */ - chv_writel(0xffff, pctrl->regs + CHV_INTSTAT); - - ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0, -- handle_simple_irq, IRQ_TYPE_NONE); -+ handle_bad_irq, IRQ_TYPE_NONE); - if (ret) { - dev_err(pctrl->dev, "failed to add IRQ chip\n"); - goto fail; -diff --git a/drivers/scsi/cxlflash/common.h b/drivers/scsi/cxlflash/common.h -index 5ada9268a450..a8ac4c0a1493 100644 ---- a/drivers/scsi/cxlflash/common.h -+++ b/drivers/scsi/cxlflash/common.h -@@ -34,7 +34,6 @@ extern const struct file_operations cxlflash_cxl_fops; - sectors - */ - --#define NUM_RRQ_ENTRY 16 /* for master issued cmds */ - #define MAX_RHT_PER_CONTEXT (PAGE_SIZE / sizeof(struct sisl_rht_entry)) - - /* AFU command retry limit */ -@@ -48,9 +47,12 @@ extern const struct file_operations cxlflash_cxl_fops; - index derivation - */ - --#define CXLFLASH_MAX_CMDS 16 -+#define CXLFLASH_MAX_CMDS 256 - #define CXLFLASH_MAX_CMDS_PER_LUN CXLFLASH_MAX_CMDS - -+/* RRQ for master issued cmds */ -+#define NUM_RRQ_ENTRY CXLFLASH_MAX_CMDS -+ - - static inline void check_sizes(void) - { -@@ -149,7 +151,7 @@ struct afu_cmd { - struct afu { - /* Stuff requiring alignment go first. */ - -- u64 rrq_entry[NUM_RRQ_ENTRY]; /* 128B RRQ */ -+ u64 rrq_entry[NUM_RRQ_ENTRY]; /* 2K RRQ */ - /* - * Command & data for AFU commands. - */ -diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c -index c86847c68448..2882bcac918a 100644 ---- a/drivers/scsi/cxlflash/main.c -+++ b/drivers/scsi/cxlflash/main.c -@@ -2305,7 +2305,7 @@ static struct scsi_host_template driver_template = { - .eh_device_reset_handler = cxlflash_eh_device_reset_handler, - .eh_host_reset_handler = cxlflash_eh_host_reset_handler, - .change_queue_depth = cxlflash_change_queue_depth, -- .cmd_per_lun = 16, -+ .cmd_per_lun = CXLFLASH_MAX_CMDS_PER_LUN, - .can_queue = CXLFLASH_MAX_CMDS, - .this_id = -1, - .sg_tablesize = SG_NONE, /* No scatter gather support */ -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index 6bffd91b973a..c1ccf1ee99ea 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -560,8 +560,12 @@ static void iscsi_complete_task(struct iscsi_task *task, int state) - WARN_ON_ONCE(task->state == ISCSI_TASK_FREE); - task->state = state; - -- if (!list_empty(&task->running)) -+ spin_lock_bh(&conn->taskqueuelock); -+ if (!list_empty(&task->running)) { -+ pr_debug_once("%s while task on list", __func__); - list_del_init(&task->running); -+ } -+ spin_unlock_bh(&conn->taskqueuelock); - - if (conn->task == task) - conn->task = NULL; -@@ -783,7 +787,9 @@ __iscsi_conn_send_pdu(struct iscsi_conn *conn, struct iscsi_hdr *hdr, - if (session->tt->xmit_task(task)) - goto free_task; - } else { -+ spin_lock_bh(&conn->taskqueuelock); - list_add_tail(&task->running, &conn->mgmtqueue); -+ spin_unlock_bh(&conn->taskqueuelock); - iscsi_conn_queue_work(conn); - } - -@@ -1474,8 +1480,10 @@ void iscsi_requeue_task(struct iscsi_task *task) - * this may be on the requeue list already if the xmit_task callout - * is handling the r2ts while we are adding new ones - */ -+ spin_lock_bh(&conn->taskqueuelock); - if (list_empty(&task->running)) - list_add_tail(&task->running, &conn->requeue); -+ spin_unlock_bh(&conn->taskqueuelock); - iscsi_conn_queue_work(conn); - } - EXPORT_SYMBOL_GPL(iscsi_requeue_task); -@@ -1512,22 +1520,26 @@ static int iscsi_data_xmit(struct iscsi_conn *conn) - * only have one nop-out as a ping from us and targets should not - * overflow us with nop-ins - */ -+ spin_lock_bh(&conn->taskqueuelock); - check_mgmt: - while (!list_empty(&conn->mgmtqueue)) { - conn->task = list_entry(conn->mgmtqueue.next, - struct iscsi_task, running); - list_del_init(&conn->task->running); -+ spin_unlock_bh(&conn->taskqueuelock); - if (iscsi_prep_mgmt_task(conn, conn->task)) { - /* regular RX path uses back_lock */ - spin_lock_bh(&conn->session->back_lock); - __iscsi_put_task(conn->task); - spin_unlock_bh(&conn->session->back_lock); - conn->task = NULL; -+ spin_lock_bh(&conn->taskqueuelock); - continue; - } - rc = iscsi_xmit_task(conn); - if (rc) - goto done; -+ spin_lock_bh(&conn->taskqueuelock); - } - - /* process pending command queue */ -@@ -1535,19 +1547,24 @@ check_mgmt: - conn->task = list_entry(conn->cmdqueue.next, struct iscsi_task, - running); - list_del_init(&conn->task->running); -+ spin_unlock_bh(&conn->taskqueuelock); - if (conn->session->state == ISCSI_STATE_LOGGING_OUT) { - fail_scsi_task(conn->task, DID_IMM_RETRY); -+ spin_lock_bh(&conn->taskqueuelock); - continue; - } - rc = iscsi_prep_scsi_cmd_pdu(conn->task); - if (rc) { - if (rc == -ENOMEM || rc == -EACCES) { -+ spin_lock_bh(&conn->taskqueuelock); - list_add_tail(&conn->task->running, - &conn->cmdqueue); - conn->task = NULL; -+ spin_unlock_bh(&conn->taskqueuelock); - goto done; - } else - fail_scsi_task(conn->task, DID_ABORT); -+ spin_lock_bh(&conn->taskqueuelock); - continue; - } - rc = iscsi_xmit_task(conn); -@@ -1558,6 +1575,7 @@ check_mgmt: - * we need to check the mgmt queue for nops that need to - * be sent to aviod starvation - */ -+ spin_lock_bh(&conn->taskqueuelock); - if (!list_empty(&conn->mgmtqueue)) - goto check_mgmt; - } -@@ -1577,12 +1595,15 @@ check_mgmt: - conn->task = task; - list_del_init(&conn->task->running); - conn->task->state = ISCSI_TASK_RUNNING; -+ spin_unlock_bh(&conn->taskqueuelock); - rc = iscsi_xmit_task(conn); - if (rc) - goto done; -+ spin_lock_bh(&conn->taskqueuelock); - if (!list_empty(&conn->mgmtqueue)) - goto check_mgmt; - } -+ spin_unlock_bh(&conn->taskqueuelock); - spin_unlock_bh(&conn->session->frwd_lock); - return -ENODATA; - -@@ -1738,7 +1759,9 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) - goto prepd_reject; - } - } else { -+ spin_lock_bh(&conn->taskqueuelock); - list_add_tail(&task->running, &conn->cmdqueue); -+ spin_unlock_bh(&conn->taskqueuelock); - iscsi_conn_queue_work(conn); - } - -@@ -2900,6 +2923,7 @@ iscsi_conn_setup(struct iscsi_cls_session *cls_session, int dd_size, - INIT_LIST_HEAD(&conn->mgmtqueue); - INIT_LIST_HEAD(&conn->cmdqueue); - INIT_LIST_HEAD(&conn->requeue); -+ spin_lock_init(&conn->taskqueuelock); - INIT_WORK(&conn->xmitwork, iscsi_xmitworker); - - /* allocate login_task used for the login/text sequences */ -diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c -index c14ab6c3ae40..60c21093f865 100644 ---- a/drivers/scsi/lpfc/lpfc_init.c -+++ b/drivers/scsi/lpfc/lpfc_init.c -@@ -11387,6 +11387,7 @@ static struct pci_driver lpfc_driver = { - .id_table = lpfc_id_table, - .probe = lpfc_pci_probe_one, - .remove = lpfc_pci_remove_one, -+ .shutdown = lpfc_pci_remove_one, - .suspend = lpfc_pci_suspend_one, - .resume = lpfc_pci_resume_one, - .err_handler = &lpfc_err_handler, -diff --git a/drivers/target/target_core_pscsi.c b/drivers/target/target_core_pscsi.c -index de18790eb21c..d72a4058fd08 100644 ---- a/drivers/target/target_core_pscsi.c -+++ b/drivers/target/target_core_pscsi.c -@@ -154,7 +154,7 @@ static void pscsi_tape_read_blocksize(struct se_device *dev, - - buf = kzalloc(12, GFP_KERNEL); - if (!buf) -- return; -+ goto out_free; - - memset(cdb, 0, MAX_COMMAND_SIZE); - cdb[0] = MODE_SENSE; -@@ -169,9 +169,10 @@ static void pscsi_tape_read_blocksize(struct se_device *dev, - * If MODE_SENSE still returns zero, set the default value to 1024. - */ - sdev->sector_size = (buf[9] << 16) | (buf[10] << 8) | (buf[11]); -+out_free: - if (!sdev->sector_size) - sdev->sector_size = 1024; --out_free: -+ - kfree(buf); - } - -@@ -314,9 +315,10 @@ static int pscsi_add_device_to_list(struct se_device *dev, - sd->lun, sd->queue_depth); - } - -- dev->dev_attrib.hw_block_size = sd->sector_size; -+ dev->dev_attrib.hw_block_size = -+ min_not_zero((int)sd->sector_size, 512); - dev->dev_attrib.hw_max_sectors = -- min_t(int, sd->host->max_sectors, queue_max_hw_sectors(q)); -+ min_not_zero(sd->host->max_sectors, queue_max_hw_sectors(q)); - dev->dev_attrib.hw_queue_depth = sd->queue_depth; - - /* -@@ -339,8 +341,10 @@ static int pscsi_add_device_to_list(struct se_device *dev, - /* - * For TYPE_TAPE, attempt to determine blocksize with MODE_SENSE. - */ -- if (sd->type == TYPE_TAPE) -+ if (sd->type == TYPE_TAPE) { - pscsi_tape_read_blocksize(dev, sd); -+ dev->dev_attrib.hw_block_size = sd->sector_size; -+ } - return 0; - } - -@@ -406,7 +410,7 @@ static int pscsi_create_type_disk(struct se_device *dev, struct scsi_device *sd) - /* - * Called with struct Scsi_Host->host_lock called. - */ --static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd) -+static int pscsi_create_type_nondisk(struct se_device *dev, struct scsi_device *sd) - __releases(sh->host_lock) - { - struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr; -@@ -433,28 +437,6 @@ static int pscsi_create_type_rom(struct se_device *dev, struct scsi_device *sd) - return 0; - } - --/* -- * Called with struct Scsi_Host->host_lock called. -- */ --static int pscsi_create_type_other(struct se_device *dev, -- struct scsi_device *sd) -- __releases(sh->host_lock) --{ -- struct pscsi_hba_virt *phv = dev->se_hba->hba_ptr; -- struct Scsi_Host *sh = sd->host; -- int ret; -- -- spin_unlock_irq(sh->host_lock); -- ret = pscsi_add_device_to_list(dev, sd); -- if (ret) -- return ret; -- -- pr_debug("CORE_PSCSI[%d] - Added Type: %s for %d:%d:%d:%llu\n", -- phv->phv_host_id, scsi_device_type(sd->type), sh->host_no, -- sd->channel, sd->id, sd->lun); -- return 0; --} -- - static int pscsi_configure_device(struct se_device *dev) - { - struct se_hba *hba = dev->se_hba; -@@ -542,11 +524,8 @@ static int pscsi_configure_device(struct se_device *dev) - case TYPE_DISK: - ret = pscsi_create_type_disk(dev, sd); - break; -- case TYPE_ROM: -- ret = pscsi_create_type_rom(dev, sd); -- break; - default: -- ret = pscsi_create_type_other(dev, sd); -+ ret = pscsi_create_type_nondisk(dev, sd); - break; - } - -@@ -611,8 +590,7 @@ static void pscsi_free_device(struct se_device *dev) - else if (pdv->pdv_lld_host) - scsi_host_put(pdv->pdv_lld_host); - -- if ((sd->type == TYPE_DISK) || (sd->type == TYPE_ROM)) -- scsi_device_put(sd); -+ scsi_device_put(sd); - - pdv->pdv_sd = NULL; - } -@@ -1088,7 +1066,6 @@ static sector_t pscsi_get_blocks(struct se_device *dev) - if (pdv->pdv_bd && pdv->pdv_bd->bd_part) - return pdv->pdv_bd->bd_part->nr_sects; - -- dump_stack(); - return 0; - } - -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index 2e27b1034ede..90c5dffc9fa4 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -1096,9 +1096,15 @@ sbc_parse_cdb(struct se_cmd *cmd, struct sbc_ops *ops) - return ret; - break; - case VERIFY: -+ case VERIFY_16: - size = 0; -- sectors = transport_get_sectors_10(cdb); -- cmd->t_task_lba = transport_lba_32(cdb); -+ if (cdb[0] == VERIFY) { -+ sectors = transport_get_sectors_10(cdb); -+ cmd->t_task_lba = transport_lba_32(cdb); -+ } else { -+ sectors = transport_get_sectors_16(cdb); -+ cmd->t_task_lba = transport_lba_64(cdb); -+ } - cmd->execute_cmd = sbc_emulate_noop; - goto check_lba; - case REZERO_UNIT: -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index f44ce09367bc..5724d7c41e29 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -966,7 +966,7 @@ static void usb_bus_init (struct usb_bus *bus) - bus->bandwidth_allocated = 0; - bus->bandwidth_int_reqs = 0; - bus->bandwidth_isoc_reqs = 0; -- mutex_init(&bus->usb_address0_mutex); -+ mutex_init(&bus->devnum_next_mutex); - - INIT_LIST_HEAD (&bus->bus_list); - } -@@ -2497,6 +2497,14 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver, - return NULL; - } - if (primary_hcd == NULL) { -+ hcd->address0_mutex = kmalloc(sizeof(*hcd->address0_mutex), -+ GFP_KERNEL); -+ if (!hcd->address0_mutex) { -+ kfree(hcd); -+ dev_dbg(dev, "hcd address0 mutex alloc failed\n"); -+ return NULL; -+ } -+ mutex_init(hcd->address0_mutex); - hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex), - GFP_KERNEL); - if (!hcd->bandwidth_mutex) { -@@ -2508,6 +2516,7 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver, - dev_set_drvdata(dev, hcd); - } else { - mutex_lock(&usb_port_peer_mutex); -+ hcd->address0_mutex = primary_hcd->address0_mutex; - hcd->bandwidth_mutex = primary_hcd->bandwidth_mutex; - hcd->primary_hcd = primary_hcd; - primary_hcd->primary_hcd = primary_hcd; -@@ -2564,24 +2573,23 @@ EXPORT_SYMBOL_GPL(usb_create_hcd); - * Don't deallocate the bandwidth_mutex until the last shared usb_hcd is - * deallocated. - * -- * Make sure to only deallocate the bandwidth_mutex when the primary HCD is -- * freed. When hcd_release() is called for either hcd in a peer set -- * invalidate the peer's ->shared_hcd and ->primary_hcd pointers to -- * block new peering attempts -+ * Make sure to deallocate the bandwidth_mutex only when the last HCD is -+ * freed. When hcd_release() is called for either hcd in a peer set, -+ * invalidate the peer's ->shared_hcd and ->primary_hcd pointers. - */ - static void hcd_release(struct kref *kref) - { - struct usb_hcd *hcd = container_of (kref, struct usb_hcd, kref); - - mutex_lock(&usb_port_peer_mutex); -- if (usb_hcd_is_primary_hcd(hcd)) -- kfree(hcd->bandwidth_mutex); - if (hcd->shared_hcd) { - struct usb_hcd *peer = hcd->shared_hcd; - - peer->shared_hcd = NULL; -- if (peer->primary_hcd == hcd) -- peer->primary_hcd = NULL; -+ peer->primary_hcd = NULL; -+ } else { -+ kfree(hcd->address0_mutex); -+ kfree(hcd->bandwidth_mutex); - } - mutex_unlock(&usb_port_peer_mutex); - kfree(hcd); -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 780db8bb2262..f52d8abf6979 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1980,7 +1980,7 @@ static void choose_devnum(struct usb_device *udev) - struct usb_bus *bus = udev->bus; - - /* be safe when more hub events are proceed in parallel */ -- mutex_lock(&bus->usb_address0_mutex); -+ mutex_lock(&bus->devnum_next_mutex); - if (udev->wusb) { - devnum = udev->portnum + 1; - BUG_ON(test_bit(devnum, bus->devmap.devicemap)); -@@ -1998,7 +1998,7 @@ static void choose_devnum(struct usb_device *udev) - set_bit(devnum, bus->devmap.devicemap); - udev->devnum = devnum; - } -- mutex_unlock(&bus->usb_address0_mutex); -+ mutex_unlock(&bus->devnum_next_mutex); - } - - static void release_devnum(struct usb_device *udev) -@@ -4262,7 +4262,7 @@ hub_port_init(struct usb_hub *hub, struct usb_device *udev, int port1, - if (oldspeed == USB_SPEED_LOW) - delay = HUB_LONG_RESET_TIME; - -- mutex_lock(&hdev->bus->usb_address0_mutex); -+ mutex_lock(hcd->address0_mutex); - - /* Reset the device; full speed may morph to high speed */ - /* FIXME a USB 2.0 device may morph into SuperSpeed on reset. */ -@@ -4548,7 +4548,7 @@ fail: - hub_port_disable(hub, port1, 0); - update_devnum(udev, devnum); /* for disconnect processing */ - } -- mutex_unlock(&hdev->bus->usb_address0_mutex); -+ mutex_unlock(hcd->address0_mutex); - return retval; - } - -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 6fe8e30eeb99..68345a9e59b8 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3666,7 +3666,7 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / - EXT4_DESC_PER_BLOCK(sb); - if (ext4_has_feature_meta_bg(sb)) { -- if (le32_to_cpu(es->s_first_meta_bg) >= db_count) { -+ if (le32_to_cpu(es->s_first_meta_bg) > db_count) { - ext4_msg(sb, KERN_WARNING, - "first meta block group too large: %u " - "(group descriptor block count %u)", -diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h -index de7b4f97ac75..be519416c112 100644 ---- a/fs/gfs2/incore.h -+++ b/fs/gfs2/incore.h -@@ -207,7 +207,7 @@ struct lm_lockname { - struct gfs2_sbd *ln_sbd; - u64 ln_number; - unsigned int ln_type; --}; -+} __packed __aligned(sizeof(int)); - - #define lm_name_equal(name1, name2) \ - (((name1)->ln_number == (name2)->ln_number) && \ -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 12891ffd4bf0..8c75af6b7d5b 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -371,14 +371,13 @@ struct usb_bus { - - int devnum_next; /* Next open device number in - * round-robin allocation */ -+ struct mutex devnum_next_mutex; /* devnum_next mutex */ - - struct usb_devmap devmap; /* device address allocation map */ - struct usb_device *root_hub; /* Root hub */ - struct usb_bus *hs_companion; /* Companion EHCI bus, if any */ - struct list_head bus_list; /* list of busses */ - -- struct mutex usb_address0_mutex; /* unaddressed device mutex */ -- - int bandwidth_allocated; /* on this bus: how much of the time - * reserved for periodic (intr/iso) - * requests is used, on average? -diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h -index f89c24bd53a4..3993b21f3d11 100644 ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -180,6 +180,7 @@ struct usb_hcd { - * bandwidth_mutex should be dropped after a successful control message - * to the device, or resetting the bandwidth after a failed attempt. - */ -+ struct mutex *address0_mutex; - struct mutex *bandwidth_mutex; - struct usb_hcd *shared_hcd; - struct usb_hcd *primary_hcd; -diff --git a/include/scsi/libiscsi.h b/include/scsi/libiscsi.h -index 4d1c46aac331..c7b1dc713cdd 100644 ---- a/include/scsi/libiscsi.h -+++ b/include/scsi/libiscsi.h -@@ -196,6 +196,7 @@ struct iscsi_conn { - struct iscsi_task *task; /* xmit task in progress */ - - /* xmit */ -+ spinlock_t taskqueuelock; /* protects the next three lists */ - struct list_head mgmtqueue; /* mgmt (control) xmit queue */ - struct list_head cmdqueue; /* data-path cmd queue */ - struct list_head requeue; /* tasks needing another run */ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 9bbe9ac23cf2..e4b5494f05f8 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -9230,7 +9230,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn) - ret = inherit_task_group(event, parent, parent_ctx, - child, ctxn, &inherited_all); - if (ret) -- break; -+ goto out_unlock; - } - - /* -@@ -9246,7 +9246,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn) - ret = inherit_task_group(event, parent, parent_ctx, - child, ctxn, &inherited_all); - if (ret) -- break; -+ goto out_unlock; - } - - raw_spin_lock_irqsave(&parent_ctx->lock, flags); -@@ -9274,6 +9274,7 @@ static int perf_event_init_context(struct task_struct *child, int ctxn) - } - - raw_spin_unlock_irqrestore(&parent_ctx->lock, flags); -+out_unlock: - mutex_unlock(&parent_ctx->mutex); - - perf_unpin_context(parent_ctx); -diff --git a/kernel/fork.c b/kernel/fork.c -index 2e55b53399de..278a2ddad351 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -331,13 +331,14 @@ void set_task_stack_end_magic(struct task_struct *tsk) - *stackend = STACK_END_MAGIC; /* for overflow detection */ - } - --static struct task_struct *dup_task_struct(struct task_struct *orig) -+static struct task_struct *dup_task_struct(struct task_struct *orig, int node) - { - struct task_struct *tsk; - struct thread_info *ti; -- int node = tsk_fork_get_node(orig); - int err; - -+ if (node == NUMA_NO_NODE) -+ node = tsk_fork_get_node(orig); - tsk = alloc_task_struct_node(node); - if (!tsk) - return NULL; -@@ -1270,7 +1271,8 @@ static struct task_struct *copy_process(unsigned long clone_flags, - int __user *child_tidptr, - struct pid *pid, - int trace, -- unsigned long tls) -+ unsigned long tls, -+ int node) - { - int retval; - struct task_struct *p; -@@ -1323,7 +1325,7 @@ static struct task_struct *copy_process(unsigned long clone_flags, - goto fork_out; - - retval = -ENOMEM; -- p = dup_task_struct(current); -+ p = dup_task_struct(current, node); - if (!p) - goto fork_out; - -@@ -1699,7 +1701,8 @@ static inline void init_idle_pids(struct pid_link *links) - struct task_struct *fork_idle(int cpu) - { - struct task_struct *task; -- task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0); -+ task = copy_process(CLONE_VM, 0, 0, NULL, &init_struct_pid, 0, 0, -+ cpu_to_node(cpu)); - if (!IS_ERR(task)) { - init_idle_pids(task->pids); - init_idle(task, cpu); -@@ -1744,7 +1747,7 @@ long _do_fork(unsigned long clone_flags, - } - - p = copy_process(clone_flags, stack_start, stack_size, -- child_tidptr, NULL, trace, tls); -+ child_tidptr, NULL, trace, tls, NUMA_NO_NODE); - /* - * Do this prior waking up the new thread - the thread pointer - * might get invalid after that point, if the thread exits quickly. -diff --git a/mm/percpu.c b/mm/percpu.c -index 1f376bce413c..ef6353f0adbd 100644 ---- a/mm/percpu.c -+++ b/mm/percpu.c -@@ -1012,8 +1012,11 @@ area_found: - mutex_unlock(&pcpu_alloc_mutex); - } - -- if (chunk != pcpu_reserved_chunk) -+ if (chunk != pcpu_reserved_chunk) { -+ spin_lock_irqsave(&pcpu_lock, flags); - pcpu_nr_empty_pop_pages -= occ_pages; -+ spin_unlock_irqrestore(&pcpu_lock, flags); -+ } - - if (pcpu_nr_empty_pop_pages < PCPU_EMPTY_POP_PAGES_LOW) - pcpu_schedule_balance_work(); diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.57-58.patch b/patch/kernel/mvebu64-default/03-patch-4.4.57-58.patch deleted file mode 100644 index 628aea1976fd..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.57-58.patch +++ /dev/null @@ -1,2653 +0,0 @@ -diff --git a/Makefile b/Makefile -index 841675e63a38..3efe2ea99e2d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 57 -+SUBLEVEL = 58 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/sama5d2.dtsi b/arch/arm/boot/dts/sama5d2.dtsi -index 4dfca8fc49b3..1bc61ece2589 100644 ---- a/arch/arm/boot/dts/sama5d2.dtsi -+++ b/arch/arm/boot/dts/sama5d2.dtsi -@@ -856,6 +856,13 @@ - compatible = "atmel,at91sam9260-usart"; - reg = <0xf801c000 0x100>; - interrupts = <24 IRQ_TYPE_LEVEL_HIGH 7>; -+ dmas = <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(35))>, -+ <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(36))>; -+ dma-names = "tx", "rx"; - clocks = <&uart0_clk>; - clock-names = "usart"; - status = "disabled"; -@@ -865,6 +872,13 @@ - compatible = "atmel,at91sam9260-usart"; - reg = <0xf8020000 0x100>; - interrupts = <25 IRQ_TYPE_LEVEL_HIGH 7>; -+ dmas = <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(37))>, -+ <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(38))>; -+ dma-names = "tx", "rx"; - clocks = <&uart1_clk>; - clock-names = "usart"; - status = "disabled"; -@@ -874,6 +888,13 @@ - compatible = "atmel,at91sam9260-usart"; - reg = <0xf8024000 0x100>; - interrupts = <26 IRQ_TYPE_LEVEL_HIGH 7>; -+ dmas = <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(39))>, -+ <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(40))>; -+ dma-names = "tx", "rx"; - clocks = <&uart2_clk>; - clock-names = "usart"; - status = "disabled"; -@@ -985,6 +1006,13 @@ - compatible = "atmel,at91sam9260-usart"; - reg = <0xfc008000 0x100>; - interrupts = <27 IRQ_TYPE_LEVEL_HIGH 7>; -+ dmas = <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(41))>, -+ <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(42))>; -+ dma-names = "tx", "rx"; - clocks = <&uart3_clk>; - clock-names = "usart"; - status = "disabled"; -@@ -993,6 +1021,13 @@ - uart4: serial@fc00c000 { - compatible = "atmel,at91sam9260-usart"; - reg = <0xfc00c000 0x100>; -+ dmas = <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(43))>, -+ <&dma0 -+ (AT91_XDMAC_DT_MEM_IF(0) | AT91_XDMAC_DT_PER_IF(1) | -+ AT91_XDMAC_DT_PERID(44))>; -+ dma-names = "tx", "rx"; - interrupts = <28 IRQ_TYPE_LEVEL_HIGH 7>; - clocks = <&uart4_clk>; - clock-names = "usart"; -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index 23726fb31741..d687f860a2da 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -286,6 +286,22 @@ static void at91_ddr_standby(void) - at91_ramc_write(1, AT91_DDRSDRC_LPR, saved_lpr1); - } - -+static void sama5d3_ddr_standby(void) -+{ -+ u32 lpr0; -+ u32 saved_lpr0; -+ -+ saved_lpr0 = at91_ramc_read(0, AT91_DDRSDRC_LPR); -+ lpr0 = saved_lpr0 & ~AT91_DDRSDRC_LPCB; -+ lpr0 |= AT91_DDRSDRC_LPCB_POWER_DOWN; -+ -+ at91_ramc_write(0, AT91_DDRSDRC_LPR, lpr0); -+ -+ cpu_do_idle(); -+ -+ at91_ramc_write(0, AT91_DDRSDRC_LPR, saved_lpr0); -+} -+ - /* We manage both DDRAM/SDRAM controllers, we need more than one value to - * remember. - */ -@@ -320,7 +336,7 @@ static const struct of_device_id const ramc_ids[] __initconst = { - { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby }, - { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby }, - { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby }, -- { .compatible = "atmel,sama5d3-ddramc", .data = at91_ddr_standby }, -+ { .compatible = "atmel,sama5d3-ddramc", .data = sama5d3_ddr_standby }, - { /*sentinel*/ } - }; - -diff --git a/arch/x86/kernel/cpu/mshyperv.c b/arch/x86/kernel/cpu/mshyperv.c -index cfc4a966e2b9..83b5f7a323a9 100644 ---- a/arch/x86/kernel/cpu/mshyperv.c -+++ b/arch/x86/kernel/cpu/mshyperv.c -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - - struct ms_hyperv_info ms_hyperv; - EXPORT_SYMBOL_GPL(ms_hyperv); -@@ -157,6 +158,26 @@ static unsigned char hv_get_nmi_reason(void) - return 0; - } - -+#ifdef CONFIG_X86_LOCAL_APIC -+/* -+ * Prior to WS2016 Debug-VM sends NMIs to all CPUs which makes -+ * it dificult to process CHANNELMSG_UNLOAD in case of crash. Handle -+ * unknown NMI on the first CPU which gets it. -+ */ -+static int hv_nmi_unknown(unsigned int val, struct pt_regs *regs) -+{ -+ static atomic_t nmi_cpu = ATOMIC_INIT(-1); -+ -+ if (!unknown_nmi_panic) -+ return NMI_DONE; -+ -+ if (atomic_cmpxchg(&nmi_cpu, -1, raw_smp_processor_id()) != -1) -+ return NMI_HANDLED; -+ -+ return NMI_DONE; -+} -+#endif -+ - static void __init ms_hyperv_init_platform(void) - { - /* -@@ -182,6 +203,9 @@ static void __init ms_hyperv_init_platform(void) - printk(KERN_INFO "HyperV: LAPIC Timer Frequency: %#x\n", - lapic_timer_frequency); - } -+ -+ register_nmi_handler(NMI_UNKNOWN, hv_nmi_unknown, NMI_FLAG_FIRST, -+ "hv_nmi_unknown"); - #endif - - if (ms_hyperv.features & HV_X64_MSR_TIME_REF_COUNT_AVAILABLE) -diff --git a/arch/x86/pci/xen.c b/arch/x86/pci/xen.c -index c6d6efed392a..7575f0798194 100644 ---- a/arch/x86/pci/xen.c -+++ b/arch/x86/pci/xen.c -@@ -231,23 +231,14 @@ static int xen_hvm_setup_msi_irqs(struct pci_dev *dev, int nvec, int type) - return 1; - - for_each_pci_msi_entry(msidesc, dev) { -- __pci_read_msi_msg(msidesc, &msg); -- pirq = MSI_ADDR_EXT_DEST_ID(msg.address_hi) | -- ((msg.address_lo >> MSI_ADDR_DEST_ID_SHIFT) & 0xff); -- if (msg.data != XEN_PIRQ_MSI_DATA || -- xen_irq_from_pirq(pirq) < 0) { -- pirq = xen_allocate_pirq_msi(dev, msidesc); -- if (pirq < 0) { -- irq = -ENODEV; -- goto error; -- } -- xen_msi_compose_msg(dev, pirq, &msg); -- __pci_write_msi_msg(msidesc, &msg); -- dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq); -- } else { -- dev_dbg(&dev->dev, -- "xen: msi already bound to pirq=%d\n", pirq); -+ pirq = xen_allocate_pirq_msi(dev, msidesc); -+ if (pirq < 0) { -+ irq = -ENODEV; -+ goto error; - } -+ xen_msi_compose_msg(dev, pirq, &msg); -+ __pci_write_msi_msg(msidesc, &msg); -+ dev_dbg(&dev->dev, "xen: msi bound to pirq=%d\n", pirq); - irq = xen_bind_pirq_msi_to_irq(dev, msidesc, pirq, - (type == PCI_CAP_ID_MSI) ? nvec : 1, - (type == PCI_CAP_ID_MSIX) ? -diff --git a/block/scsi_ioctl.c b/block/scsi_ioctl.c -index 0774799942e0..c6fee7437be4 100644 ---- a/block/scsi_ioctl.c -+++ b/block/scsi_ioctl.c -@@ -182,6 +182,9 @@ static void blk_set_cmd_filter_defaults(struct blk_cmd_filter *filter) - __set_bit(WRITE_16, filter->write_ok); - __set_bit(WRITE_LONG, filter->write_ok); - __set_bit(WRITE_LONG_2, filter->write_ok); -+ __set_bit(WRITE_SAME, filter->write_ok); -+ __set_bit(WRITE_SAME_16, filter->write_ok); -+ __set_bit(WRITE_SAME_32, filter->write_ok); - __set_bit(ERASE, filter->write_ok); - __set_bit(GPCMD_MODE_SELECT_10, filter->write_ok); - __set_bit(MODE_SELECT, filter->write_ok); -diff --git a/crypto/algif_hash.c b/crypto/algif_hash.c -index 68a5ceaa04c8..8d8b3eeba725 100644 ---- a/crypto/algif_hash.c -+++ b/crypto/algif_hash.c -@@ -184,7 +184,7 @@ static int hash_accept(struct socket *sock, struct socket *newsock, int flags) - struct alg_sock *ask = alg_sk(sk); - struct hash_ctx *ctx = ask->private; - struct ahash_request *req = &ctx->req; -- char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req))]; -+ char state[crypto_ahash_statesize(crypto_ahash_reqtfm(req)) ? : 1]; - struct sock *sk2; - struct alg_sock *ask2; - struct hash_ctx *ctx2; -diff --git a/drivers/acpi/blacklist.c b/drivers/acpi/blacklist.c -index 96809cd99ace..2f24b578bcaf 100644 ---- a/drivers/acpi/blacklist.c -+++ b/drivers/acpi/blacklist.c -@@ -346,6 +346,34 @@ static struct dmi_system_id acpi_osi_dmi_table[] __initdata = { - DMI_MATCH(DMI_PRODUCT_NAME, "XPS 13 9343"), - }, - }, -+ { -+ .callback = dmi_enable_rev_override, -+ .ident = "DELL Precision 5520", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 5520"), -+ }, -+ }, -+ { -+ .callback = dmi_enable_rev_override, -+ .ident = "DELL Precision 3520", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Precision 3520"), -+ }, -+ }, -+ /* -+ * Resolves a quirk with the Dell Latitude 3350 that -+ * causes the ethernet adapter to not function. -+ */ -+ { -+ .callback = dmi_enable_rev_override, -+ .ident = "DELL Latitude 3350", -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Latitude 3350"), -+ }, -+ }, - #endif - {} - }; -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 86fa9fdc8323..38b363f4316b 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -1186,6 +1186,9 @@ static int cpufreq_online(unsigned int cpu) - for_each_cpu(j, policy->related_cpus) - per_cpu(cpufreq_cpu_data, j) = policy; - write_unlock_irqrestore(&cpufreq_driver_lock, flags); -+ } else { -+ policy->min = policy->user_policy.min; -+ policy->max = policy->user_policy.max; - } - - if (cpufreq_driver->get && !cpufreq_driver->setpolicy) { -diff --git a/drivers/iio/adc/ti_am335x_adc.c b/drivers/iio/adc/ti_am335x_adc.c -index 0470fc843d4e..9b6854607d73 100644 ---- a/drivers/iio/adc/ti_am335x_adc.c -+++ b/drivers/iio/adc/ti_am335x_adc.c -@@ -151,7 +151,9 @@ static irqreturn_t tiadc_irq_h(int irq, void *private) - { - struct iio_dev *indio_dev = private; - struct tiadc_device *adc_dev = iio_priv(indio_dev); -- unsigned int status, config; -+ unsigned int status, config, adc_fsm; -+ unsigned short count = 0; -+ - status = tiadc_readl(adc_dev, REG_IRQSTATUS); - - /* -@@ -165,6 +167,15 @@ static irqreturn_t tiadc_irq_h(int irq, void *private) - tiadc_writel(adc_dev, REG_CTRL, config); - tiadc_writel(adc_dev, REG_IRQSTATUS, IRQENB_FIFO1OVRRUN - | IRQENB_FIFO1UNDRFLW | IRQENB_FIFO1THRES); -+ -+ /* wait for idle state. -+ * ADC needs to finish the current conversion -+ * before disabling the module -+ */ -+ do { -+ adc_fsm = tiadc_readl(adc_dev, REG_ADCFSM); -+ } while (adc_fsm != 0x10 && count++ < 100); -+ - tiadc_writel(adc_dev, REG_CTRL, (config | CNTRLREG_TSCSSENB)); - return IRQ_HANDLED; - } else if (status & IRQENB_FIFO1THRES) { -diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -index 595511022795..0a86ef43e781 100644 ---- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -@@ -51,8 +51,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) - st->report_state.report_id, - st->report_state.index, - HID_USAGE_SENSOR_PROP_REPORTING_STATE_ALL_EVENTS_ENUM); -- -- poll_value = hid_sensor_read_poll_value(st); - } else { - int val; - -@@ -89,7 +87,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) - sensor_hub_get_feature(st->hsdev, st->power_state.report_id, - st->power_state.index, - sizeof(state_val), &state_val); -- if (state && poll_value) -+ if (state) -+ poll_value = hid_sensor_read_poll_value(st); -+ if (poll_value > 0) - msleep_interruptible(poll_value * 2); - - return 0; -diff --git a/drivers/input/joystick/iforce/iforce-usb.c b/drivers/input/joystick/iforce/iforce-usb.c -index d96aa27dfcdc..db64adfbe1af 100644 ---- a/drivers/input/joystick/iforce/iforce-usb.c -+++ b/drivers/input/joystick/iforce/iforce-usb.c -@@ -141,6 +141,9 @@ static int iforce_usb_probe(struct usb_interface *intf, - - interface = intf->cur_altsetting; - -+ if (interface->desc.bNumEndpoints < 2) -+ return -ENODEV; -+ - epirq = &interface->endpoint[0].desc; - epout = &interface->endpoint[1].desc; - -diff --git a/drivers/input/misc/cm109.c b/drivers/input/misc/cm109.c -index 9365535ba7f1..50a7faa504f7 100644 ---- a/drivers/input/misc/cm109.c -+++ b/drivers/input/misc/cm109.c -@@ -675,6 +675,10 @@ static int cm109_usb_probe(struct usb_interface *intf, - int error = -ENOMEM; - - interface = intf->cur_altsetting; -+ -+ if (interface->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - endpoint = &interface->endpoint[0].desc; - - if (!usb_endpoint_is_int_in(endpoint)) -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index 9c0ea36913b4..f4e8fbec6a94 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -1667,6 +1667,10 @@ static int ims_pcu_parse_cdc_data(struct usb_interface *intf, struct ims_pcu *pc - return -EINVAL; - - alt = pcu->ctrl_intf->cur_altsetting; -+ -+ if (alt->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - pcu->ep_ctrl = &alt->endpoint[0].desc; - pcu->max_ctrl_size = usb_endpoint_maxp(pcu->ep_ctrl); - -diff --git a/drivers/input/misc/yealink.c b/drivers/input/misc/yealink.c -index 79c964c075f1..6e7ff9561d92 100644 ---- a/drivers/input/misc/yealink.c -+++ b/drivers/input/misc/yealink.c -@@ -875,6 +875,10 @@ static int usb_probe(struct usb_interface *intf, const struct usb_device_id *id) - int ret, pipe, i; - - interface = intf->cur_altsetting; -+ -+ if (interface->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - endpoint = &interface->endpoint[0].desc; - if (!usb_endpoint_is_int_in(endpoint)) - return -ENODEV; -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index ed1935f300a7..da5458dfb1e3 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -218,17 +218,19 @@ static int elan_query_product(struct elan_tp_data *data) - - static int elan_check_ASUS_special_fw(struct elan_tp_data *data) - { -- if (data->ic_type != 0x0E) -- return false; -- -- switch (data->product_id) { -- case 0x05 ... 0x07: -- case 0x09: -- case 0x13: -+ if (data->ic_type == 0x0E) { -+ switch (data->product_id) { -+ case 0x05 ... 0x07: -+ case 0x09: -+ case 0x13: -+ return true; -+ } -+ } else if (data->ic_type == 0x08 && data->product_id == 0x26) { -+ /* ASUS EeeBook X205TA */ - return true; -- default: -- return false; - } -+ -+ return false; - } - - static int __elan_initialize(struct elan_tp_data *data) -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 0cdd95801a25..25eab453f2b2 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -120,6 +120,13 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { - }, - }, - { -+ /* Dell Embedded Box PC 3000 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."), -+ DMI_MATCH(DMI_PRODUCT_NAME, "Embedded Box PC 3000"), -+ }, -+ }, -+ { - /* OQO Model 01 */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "OQO"), -diff --git a/drivers/input/tablet/hanwang.c b/drivers/input/tablet/hanwang.c -index cd852059b99e..df4bea96d7ed 100644 ---- a/drivers/input/tablet/hanwang.c -+++ b/drivers/input/tablet/hanwang.c -@@ -340,6 +340,9 @@ static int hanwang_probe(struct usb_interface *intf, const struct usb_device_id - int error; - int i; - -+ if (intf->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - hanwang = kzalloc(sizeof(struct hanwang), GFP_KERNEL); - input_dev = input_allocate_device(); - if (!hanwang || !input_dev) { -diff --git a/drivers/input/tablet/kbtab.c b/drivers/input/tablet/kbtab.c -index d2ac7c2b5b82..2812f9236b7d 100644 ---- a/drivers/input/tablet/kbtab.c -+++ b/drivers/input/tablet/kbtab.c -@@ -122,6 +122,9 @@ static int kbtab_probe(struct usb_interface *intf, const struct usb_device_id *i - struct input_dev *input_dev; - int error = -ENOMEM; - -+ if (intf->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - kbtab = kzalloc(sizeof(struct kbtab), GFP_KERNEL); - input_dev = input_allocate_device(); - if (!kbtab || !input_dev) -diff --git a/drivers/input/touchscreen/sur40.c b/drivers/input/touchscreen/sur40.c -index 45b466e3bbe8..0146e2c74649 100644 ---- a/drivers/input/touchscreen/sur40.c -+++ b/drivers/input/touchscreen/sur40.c -@@ -500,6 +500,9 @@ static int sur40_probe(struct usb_interface *interface, - if (iface_desc->desc.bInterfaceClass != 0xFF) - return -ENODEV; - -+ if (iface_desc->desc.bNumEndpoints < 5) -+ return -ENODEV; -+ - /* Use endpoint #4 (0x86). */ - endpoint = &iface_desc->endpoint[4].desc; - if (endpoint->bEndpointAddress != TOUCH_ENDPOINT) -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index f0fc6f7b5d98..0628372f3591 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -908,7 +908,7 @@ static struct intel_iommu *device_to_iommu(struct device *dev, u8 *bus, u8 *devf - * which we used for the IOMMU lookup. Strictly speaking - * we could do this for all PCI devices; we only need to - * get the BDF# from the scope table for ACPI matches. */ -- if (pdev->is_virtfn) -+ if (pdev && pdev->is_virtfn) - goto got_pdev; - - *bus = drhd->devices[i].bus; -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 122af340a531..a92979e704e3 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1072,6 +1072,8 @@ static void __make_request(struct mddev *mddev, struct bio *bio) - int max_sectors; - int sectors; - -+ md_write_start(mddev, bio); -+ - /* - * Register the new request and wait if the reconstruction - * thread has put up a bar for new requests. -@@ -1455,8 +1457,6 @@ static void make_request(struct mddev *mddev, struct bio *bio) - return; - } - -- md_write_start(mddev, bio); -- - do { - - /* -diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c -index 5cefca95734e..885f689ac870 100644 ---- a/drivers/media/usb/uvc/uvc_driver.c -+++ b/drivers/media/usb/uvc/uvc_driver.c -@@ -1595,6 +1595,114 @@ static const char *uvc_print_chain(struct uvc_video_chain *chain) - return buffer; - } - -+static struct uvc_video_chain *uvc_alloc_chain(struct uvc_device *dev) -+{ -+ struct uvc_video_chain *chain; -+ -+ chain = kzalloc(sizeof(*chain), GFP_KERNEL); -+ if (chain == NULL) -+ return NULL; -+ -+ INIT_LIST_HEAD(&chain->entities); -+ mutex_init(&chain->ctrl_mutex); -+ chain->dev = dev; -+ v4l2_prio_init(&chain->prio); -+ -+ return chain; -+} -+ -+/* -+ * Fallback heuristic for devices that don't connect units and terminals in a -+ * valid chain. -+ * -+ * Some devices have invalid baSourceID references, causing uvc_scan_chain() -+ * to fail, but if we just take the entities we can find and put them together -+ * in the most sensible chain we can think of, turns out they do work anyway. -+ * Note: This heuristic assumes there is a single chain. -+ * -+ * At the time of writing, devices known to have such a broken chain are -+ * - Acer Integrated Camera (5986:055a) -+ * - Realtek rtl157a7 (0bda:57a7) -+ */ -+static int uvc_scan_fallback(struct uvc_device *dev) -+{ -+ struct uvc_video_chain *chain; -+ struct uvc_entity *iterm = NULL; -+ struct uvc_entity *oterm = NULL; -+ struct uvc_entity *entity; -+ struct uvc_entity *prev; -+ -+ /* -+ * Start by locating the input and output terminals. We only support -+ * devices with exactly one of each for now. -+ */ -+ list_for_each_entry(entity, &dev->entities, list) { -+ if (UVC_ENTITY_IS_ITERM(entity)) { -+ if (iterm) -+ return -EINVAL; -+ iterm = entity; -+ } -+ -+ if (UVC_ENTITY_IS_OTERM(entity)) { -+ if (oterm) -+ return -EINVAL; -+ oterm = entity; -+ } -+ } -+ -+ if (iterm == NULL || oterm == NULL) -+ return -EINVAL; -+ -+ /* Allocate the chain and fill it. */ -+ chain = uvc_alloc_chain(dev); -+ if (chain == NULL) -+ return -ENOMEM; -+ -+ if (uvc_scan_chain_entity(chain, oterm) < 0) -+ goto error; -+ -+ prev = oterm; -+ -+ /* -+ * Add all Processing and Extension Units with two pads. The order -+ * doesn't matter much, use reverse list traversal to connect units in -+ * UVC descriptor order as we build the chain from output to input. This -+ * leads to units appearing in the order meant by the manufacturer for -+ * the cameras known to require this heuristic. -+ */ -+ list_for_each_entry_reverse(entity, &dev->entities, list) { -+ if (entity->type != UVC_VC_PROCESSING_UNIT && -+ entity->type != UVC_VC_EXTENSION_UNIT) -+ continue; -+ -+ if (entity->num_pads != 2) -+ continue; -+ -+ if (uvc_scan_chain_entity(chain, entity) < 0) -+ goto error; -+ -+ prev->baSourceID[0] = entity->id; -+ prev = entity; -+ } -+ -+ if (uvc_scan_chain_entity(chain, iterm) < 0) -+ goto error; -+ -+ prev->baSourceID[0] = iterm->id; -+ -+ list_add_tail(&chain->list, &dev->chains); -+ -+ uvc_trace(UVC_TRACE_PROBE, -+ "Found a video chain by fallback heuristic (%s).\n", -+ uvc_print_chain(chain)); -+ -+ return 0; -+ -+error: -+ kfree(chain); -+ return -EINVAL; -+} -+ - /* - * Scan the device for video chains and register video devices. - * -@@ -1617,15 +1725,10 @@ static int uvc_scan_device(struct uvc_device *dev) - if (term->chain.next || term->chain.prev) - continue; - -- chain = kzalloc(sizeof(*chain), GFP_KERNEL); -+ chain = uvc_alloc_chain(dev); - if (chain == NULL) - return -ENOMEM; - -- INIT_LIST_HEAD(&chain->entities); -- mutex_init(&chain->ctrl_mutex); -- chain->dev = dev; -- v4l2_prio_init(&chain->prio); -- - term->flags |= UVC_ENTITY_FLAG_DEFAULT; - - if (uvc_scan_chain(chain, term) < 0) { -@@ -1639,6 +1742,9 @@ static int uvc_scan_device(struct uvc_device *dev) - list_add_tail(&chain->list, &dev->chains); - } - -+ if (list_empty(&dev->chains)) -+ uvc_scan_fallback(dev); -+ - if (list_empty(&dev->chains)) { - uvc_printk(KERN_INFO, "No valid video chain found.\n"); - return -1; -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index bda164089904..62d37d2ac557 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -1274,7 +1274,9 @@ clock_set: - return; - } - timeout--; -- mdelay(1); -+ spin_unlock_irq(&host->lock); -+ usleep_range(900, 1100); -+ spin_lock_irq(&host->lock); - } - - clk |= SDHCI_CLOCK_CARD_EN; -diff --git a/drivers/mmc/host/ushc.c b/drivers/mmc/host/ushc.c -index d2c386f09d69..1d843357422e 100644 ---- a/drivers/mmc/host/ushc.c -+++ b/drivers/mmc/host/ushc.c -@@ -426,6 +426,9 @@ static int ushc_probe(struct usb_interface *intf, const struct usb_device_id *id - struct ushc_data *ushc; - int ret; - -+ if (intf->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - mmc = mmc_alloc_host(sizeof(struct ushc_data), &intf->dev); - if (mmc == NULL) - return -ENOMEM; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -index b6fa89102526..66ba1e0ff37e 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h -@@ -913,8 +913,8 @@ - #define RX_PACKET_ATTRIBUTES_CSUM_DONE_WIDTH 1 - #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_INDEX 1 - #define RX_PACKET_ATTRIBUTES_VLAN_CTAG_WIDTH 1 --#define RX_PACKET_ATTRIBUTES_INCOMPLETE_INDEX 2 --#define RX_PACKET_ATTRIBUTES_INCOMPLETE_WIDTH 1 -+#define RX_PACKET_ATTRIBUTES_LAST_INDEX 2 -+#define RX_PACKET_ATTRIBUTES_LAST_WIDTH 1 - #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_INDEX 3 - #define RX_PACKET_ATTRIBUTES_CONTEXT_NEXT_WIDTH 1 - #define RX_PACKET_ATTRIBUTES_CONTEXT_INDEX 4 -@@ -923,6 +923,8 @@ - #define RX_PACKET_ATTRIBUTES_RX_TSTAMP_WIDTH 1 - #define RX_PACKET_ATTRIBUTES_RSS_HASH_INDEX 6 - #define RX_PACKET_ATTRIBUTES_RSS_HASH_WIDTH 1 -+#define RX_PACKET_ATTRIBUTES_FIRST_INDEX 7 -+#define RX_PACKET_ATTRIBUTES_FIRST_WIDTH 1 - - #define RX_NORMAL_DESC0_OVT_INDEX 0 - #define RX_NORMAL_DESC0_OVT_WIDTH 16 -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -index f6a7161e3b85..5e6238e0b2bd 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -@@ -1658,10 +1658,15 @@ static int xgbe_dev_read(struct xgbe_channel *channel) - - /* Get the header length */ - if (XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, FD)) { -+ XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, -+ FIRST, 1); - rdata->rx.hdr_len = XGMAC_GET_BITS_LE(rdesc->desc2, - RX_NORMAL_DESC2, HL); - if (rdata->rx.hdr_len) - pdata->ext_stats.rx_split_header_packets++; -+ } else { -+ XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, -+ FIRST, 0); - } - - /* Get the RSS hash */ -@@ -1684,19 +1689,16 @@ static int xgbe_dev_read(struct xgbe_channel *channel) - } - } - -- /* Get the packet length */ -- rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL); -- -- if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) { -- /* Not all the data has been transferred for this packet */ -- XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, -- INCOMPLETE, 1); -+ /* Not all the data has been transferred for this packet */ -+ if (!XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, LD)) - return 0; -- } - - /* This is the last of the data for this packet */ - XGMAC_SET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, -- INCOMPLETE, 0); -+ LAST, 1); -+ -+ /* Get the packet length */ -+ rdata->rx.len = XGMAC_GET_BITS_LE(rdesc->desc3, RX_NORMAL_DESC3, PL); - - /* Set checksum done indicator as appropriate */ - if (netdev->features & NETIF_F_RXCSUM) -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index 53ce1222b11d..865b7e0b133b 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -1760,13 +1760,12 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata, - { - struct sk_buff *skb; - u8 *packet; -- unsigned int copy_len; - - skb = napi_alloc_skb(napi, rdata->rx.hdr.dma_len); - if (!skb) - return NULL; - -- /* Start with the header buffer which may contain just the header -+ /* Pull in the header buffer which may contain just the header - * or the header plus data - */ - dma_sync_single_range_for_cpu(pdata->dev, rdata->rx.hdr.dma_base, -@@ -1775,30 +1774,49 @@ static struct sk_buff *xgbe_create_skb(struct xgbe_prv_data *pdata, - - packet = page_address(rdata->rx.hdr.pa.pages) + - rdata->rx.hdr.pa.pages_offset; -- copy_len = (rdata->rx.hdr_len) ? rdata->rx.hdr_len : len; -- copy_len = min(rdata->rx.hdr.dma_len, copy_len); -- skb_copy_to_linear_data(skb, packet, copy_len); -- skb_put(skb, copy_len); -- -- len -= copy_len; -- if (len) { -- /* Add the remaining data as a frag */ -- dma_sync_single_range_for_cpu(pdata->dev, -- rdata->rx.buf.dma_base, -- rdata->rx.buf.dma_off, -- rdata->rx.buf.dma_len, -- DMA_FROM_DEVICE); -- -- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, -- rdata->rx.buf.pa.pages, -- rdata->rx.buf.pa.pages_offset, -- len, rdata->rx.buf.dma_len); -- rdata->rx.buf.pa.pages = NULL; -- } -+ skb_copy_to_linear_data(skb, packet, len); -+ skb_put(skb, len); - - return skb; - } - -+static unsigned int xgbe_rx_buf1_len(struct xgbe_ring_data *rdata, -+ struct xgbe_packet_data *packet) -+{ -+ /* Always zero if not the first descriptor */ -+ if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, FIRST)) -+ return 0; -+ -+ /* First descriptor with split header, return header length */ -+ if (rdata->rx.hdr_len) -+ return rdata->rx.hdr_len; -+ -+ /* First descriptor but not the last descriptor and no split header, -+ * so the full buffer was used -+ */ -+ if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST)) -+ return rdata->rx.hdr.dma_len; -+ -+ /* First descriptor and last descriptor and no split header, so -+ * calculate how much of the buffer was used -+ */ -+ return min_t(unsigned int, rdata->rx.hdr.dma_len, rdata->rx.len); -+} -+ -+static unsigned int xgbe_rx_buf2_len(struct xgbe_ring_data *rdata, -+ struct xgbe_packet_data *packet, -+ unsigned int len) -+{ -+ /* Always the full buffer if not the last descriptor */ -+ if (!XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, LAST)) -+ return rdata->rx.buf.dma_len; -+ -+ /* Last descriptor so calculate how much of the buffer was used -+ * for the last bit of data -+ */ -+ return rdata->rx.len - len; -+} -+ - static int xgbe_tx_poll(struct xgbe_channel *channel) - { - struct xgbe_prv_data *pdata = channel->pdata; -@@ -1881,8 +1899,8 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) - struct napi_struct *napi; - struct sk_buff *skb; - struct skb_shared_hwtstamps *hwtstamps; -- unsigned int incomplete, error, context_next, context; -- unsigned int len, rdesc_len, max_len; -+ unsigned int last, error, context_next, context; -+ unsigned int len, buf1_len, buf2_len, max_len; - unsigned int received = 0; - int packet_count = 0; - -@@ -1892,7 +1910,7 @@ static int xgbe_rx_poll(struct xgbe_channel *channel, int budget) - if (!ring) - return 0; - -- incomplete = 0; -+ last = 0; - context_next = 0; - - napi = (pdata->per_channel_irq) ? &channel->napi : &pdata->napi; -@@ -1926,9 +1944,8 @@ read_again: - received++; - ring->cur++; - -- incomplete = XGMAC_GET_BITS(packet->attributes, -- RX_PACKET_ATTRIBUTES, -- INCOMPLETE); -+ last = XGMAC_GET_BITS(packet->attributes, RX_PACKET_ATTRIBUTES, -+ LAST); - context_next = XGMAC_GET_BITS(packet->attributes, - RX_PACKET_ATTRIBUTES, - CONTEXT_NEXT); -@@ -1937,7 +1954,7 @@ read_again: - CONTEXT); - - /* Earlier error, just drain the remaining data */ -- if ((incomplete || context_next) && error) -+ if ((!last || context_next) && error) - goto read_again; - - if (error || packet->errors) { -@@ -1949,16 +1966,22 @@ read_again: - } - - if (!context) { -- /* Length is cumulative, get this descriptor's length */ -- rdesc_len = rdata->rx.len - len; -- len += rdesc_len; -+ /* Get the data length in the descriptor buffers */ -+ buf1_len = xgbe_rx_buf1_len(rdata, packet); -+ len += buf1_len; -+ buf2_len = xgbe_rx_buf2_len(rdata, packet, len); -+ len += buf2_len; - -- if (rdesc_len && !skb) { -+ if (!skb) { - skb = xgbe_create_skb(pdata, napi, rdata, -- rdesc_len); -- if (!skb) -+ buf1_len); -+ if (!skb) { - error = 1; -- } else if (rdesc_len) { -+ goto skip_data; -+ } -+ } -+ -+ if (buf2_len) { - dma_sync_single_range_for_cpu(pdata->dev, - rdata->rx.buf.dma_base, - rdata->rx.buf.dma_off, -@@ -1968,13 +1991,14 @@ read_again: - skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, - rdata->rx.buf.pa.pages, - rdata->rx.buf.pa.pages_offset, -- rdesc_len, -+ buf2_len, - rdata->rx.buf.dma_len); - rdata->rx.buf.pa.pages = NULL; - } - } - -- if (incomplete || context_next) -+skip_data: -+ if (!last || context_next) - goto read_again; - - if (!skb) -@@ -2033,7 +2057,7 @@ next_packet: - } - - /* Check if we need to save state before leaving */ -- if (received && (incomplete || context_next)) { -+ if (received && (!last || context_next)) { - rdata = XGBE_GET_DESC_DATA(ring, ring->cur); - rdata->state_saved = 1; - rdata->state.skb = skb; -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index 91627561c58d..f971d92f7b41 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -3495,7 +3495,8 @@ static int bcmgenet_suspend(struct device *d) - - bcmgenet_netif_stop(dev); - -- phy_suspend(priv->phydev); -+ if (!device_may_wakeup(d)) -+ phy_suspend(priv->phydev); - - netif_device_detach(dev); - -@@ -3592,7 +3593,8 @@ static int bcmgenet_resume(struct device *d) - - netif_device_attach(dev); - -- phy_resume(priv->phydev); -+ if (!device_may_wakeup(d)) -+ phy_resume(priv->phydev); - - if (priv->eee.eee_enabled) - bcmgenet_eee_enable_set(dev, true); -diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c -index 8bdfe53754ba..e96d1f95bb47 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmmii.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c -@@ -220,20 +220,6 @@ void bcmgenet_phy_power_set(struct net_device *dev, bool enable) - udelay(60); - } - --static void bcmgenet_internal_phy_setup(struct net_device *dev) --{ -- struct bcmgenet_priv *priv = netdev_priv(dev); -- u32 reg; -- -- /* Power up PHY */ -- bcmgenet_phy_power_set(dev, true); -- /* enable APD */ -- reg = bcmgenet_ext_readl(priv, EXT_EXT_PWR_MGMT); -- reg |= EXT_PWR_DN_EN_LD; -- bcmgenet_ext_writel(priv, reg, EXT_EXT_PWR_MGMT); -- bcmgenet_mii_reset(dev); --} -- - static void bcmgenet_moca_phy_setup(struct bcmgenet_priv *priv) - { - u32 reg; -@@ -281,7 +267,6 @@ int bcmgenet_mii_config(struct net_device *dev) - - if (priv->internal_phy) { - phy_name = "internal PHY"; -- bcmgenet_internal_phy_setup(dev); - } else if (priv->phy_interface == PHY_INTERFACE_MODE_MOCA) { - phy_name = "MoCA"; - bcmgenet_moca_phy_setup(priv); -diff --git a/drivers/net/ethernet/intel/igb/e1000_phy.c b/drivers/net/ethernet/intel/igb/e1000_phy.c -index 23ec28f43f6d..afaa98d1d4e4 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_phy.c -+++ b/drivers/net/ethernet/intel/igb/e1000_phy.c -@@ -77,6 +77,10 @@ s32 igb_get_phy_id(struct e1000_hw *hw) - s32 ret_val = 0; - u16 phy_id; - -+ /* ensure PHY page selection to fix misconfigured i210 */ -+ if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211)) -+ phy->ops.write_reg(hw, I347AT4_PAGE_SELECT, 0); -+ - ret_val = phy->ops.read_reg(hw, PHY_ID1, &phy_id); - if (ret_val) - goto out; -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -index cf0098596e85..e9408f5e2a1d 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c -@@ -197,6 +197,10 @@ static inline void mlx5e_build_rx_skb(struct mlx5_cqe64 *cqe, - if (lro_num_seg > 1) { - mlx5e_lro_update_hdr(skb, cqe); - skb_shinfo(skb)->gso_size = DIV_ROUND_UP(cqe_bcnt, lro_num_seg); -+ /* Subtract one since we already counted this as one -+ * "regular" packet in mlx5e_complete_rx_cqe() -+ */ -+ rq->stats.packets += lro_num_seg - 1; - rq->stats.lro_packets++; - rq->stats.lro_bytes += cqe_bcnt; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index ba115ec7aa92..1e611980cf99 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -85,7 +85,7 @@ static struct mlx5_profile profile[] = { - [2] = { - .mask = MLX5_PROF_MASK_QP_SIZE | - MLX5_PROF_MASK_MR_CACHE, -- .log_max_qp = 17, -+ .log_max_qp = 18, - .mr_cache[0] = { - .size = 500, - .limit = 250 -diff --git a/drivers/parport/share.c b/drivers/parport/share.c -index 5ce5ef211bdb..754f21fd9768 100644 ---- a/drivers/parport/share.c -+++ b/drivers/parport/share.c -@@ -936,8 +936,10 @@ parport_register_dev_model(struct parport *port, const char *name, - * pardevice fields. -arca - */ - port->ops->init_state(par_dev, par_dev->state); -- port->proc_device = par_dev; -- parport_device_proc_register(par_dev); -+ if (!test_and_set_bit(PARPORT_DEVPROC_REGISTERED, &port->devflags)) { -+ port->proc_device = par_dev; -+ parport_device_proc_register(par_dev); -+ } - - return par_dev; - -diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c -index 31f31d460fc9..357527712539 100644 ---- a/drivers/pci/iov.c -+++ b/drivers/pci/iov.c -@@ -303,13 +303,6 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn) - return rc; - } - -- pci_iov_set_numvfs(dev, nr_virtfn); -- iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE; -- pci_cfg_access_lock(dev); -- pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl); -- msleep(100); -- pci_cfg_access_unlock(dev); -- - iov->initial_VFs = initial; - if (nr_virtfn < initial) - initial = nr_virtfn; -@@ -320,6 +313,13 @@ static int sriov_enable(struct pci_dev *dev, int nr_virtfn) - goto err_pcibios; - } - -+ pci_iov_set_numvfs(dev, nr_virtfn); -+ iov->ctrl |= PCI_SRIOV_CTRL_VFE | PCI_SRIOV_CTRL_MSE; -+ pci_cfg_access_lock(dev); -+ pci_write_config_word(dev, iov->pos + PCI_SRIOV_CTRL, iov->ctrl); -+ msleep(100); -+ pci_cfg_access_unlock(dev); -+ - for (i = 0; i < initial; i++) { - rc = virtfn_add(dev, i, 0); - if (rc) -@@ -555,21 +555,61 @@ void pci_iov_release(struct pci_dev *dev) - } - - /** -- * pci_iov_resource_bar - get position of the SR-IOV BAR -+ * pci_iov_update_resource - update a VF BAR - * @dev: the PCI device - * @resno: the resource number - * -- * Returns position of the BAR encapsulated in the SR-IOV capability. -+ * Update a VF BAR in the SR-IOV capability of a PF. - */ --int pci_iov_resource_bar(struct pci_dev *dev, int resno) -+void pci_iov_update_resource(struct pci_dev *dev, int resno) - { -- if (resno < PCI_IOV_RESOURCES || resno > PCI_IOV_RESOURCE_END) -- return 0; -+ struct pci_sriov *iov = dev->is_physfn ? dev->sriov : NULL; -+ struct resource *res = dev->resource + resno; -+ int vf_bar = resno - PCI_IOV_RESOURCES; -+ struct pci_bus_region region; -+ u16 cmd; -+ u32 new; -+ int reg; -+ -+ /* -+ * The generic pci_restore_bars() path calls this for all devices, -+ * including VFs and non-SR-IOV devices. If this is not a PF, we -+ * have nothing to do. -+ */ -+ if (!iov) -+ return; -+ -+ pci_read_config_word(dev, iov->pos + PCI_SRIOV_CTRL, &cmd); -+ if ((cmd & PCI_SRIOV_CTRL_VFE) && (cmd & PCI_SRIOV_CTRL_MSE)) { -+ dev_WARN(&dev->dev, "can't update enabled VF BAR%d %pR\n", -+ vf_bar, res); -+ return; -+ } -+ -+ /* -+ * Ignore unimplemented BARs, unused resource slots for 64-bit -+ * BARs, and non-movable resources, e.g., those described via -+ * Enhanced Allocation. -+ */ -+ if (!res->flags) -+ return; -+ -+ if (res->flags & IORESOURCE_UNSET) -+ return; -+ -+ if (res->flags & IORESOURCE_PCI_FIXED) -+ return; - -- BUG_ON(!dev->is_physfn); -+ pcibios_resource_to_bus(dev->bus, ®ion, res); -+ new = region.start; -+ new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK; - -- return dev->sriov->pos + PCI_SRIOV_BAR + -- 4 * (resno - PCI_IOV_RESOURCES); -+ reg = iov->pos + PCI_SRIOV_BAR + 4 * vf_bar; -+ pci_write_config_dword(dev, reg, new); -+ if (res->flags & IORESOURCE_MEM_64) { -+ new = region.start >> 16 >> 16; -+ pci_write_config_dword(dev, reg + 4, new); -+ } - } - - resource_size_t __weak pcibios_iov_resource_alignment(struct pci_dev *dev, -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index e311a9bf2c90..0e53488f8ec1 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -519,10 +519,6 @@ static void pci_restore_bars(struct pci_dev *dev) - { - int i; - -- /* Per SR-IOV spec 3.4.1.11, VF BARs are RO zero */ -- if (dev->is_virtfn) -- return; -- - for (i = 0; i < PCI_BRIDGE_RESOURCES; i++) - pci_update_resource(dev, i); - } -@@ -4472,36 +4468,6 @@ int pci_select_bars(struct pci_dev *dev, unsigned long flags) - } - EXPORT_SYMBOL(pci_select_bars); - --/** -- * pci_resource_bar - get position of the BAR associated with a resource -- * @dev: the PCI device -- * @resno: the resource number -- * @type: the BAR type to be filled in -- * -- * Returns BAR position in config space, or 0 if the BAR is invalid. -- */ --int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type) --{ -- int reg; -- -- if (resno < PCI_ROM_RESOURCE) { -- *type = pci_bar_unknown; -- return PCI_BASE_ADDRESS_0 + 4 * resno; -- } else if (resno == PCI_ROM_RESOURCE) { -- *type = pci_bar_mem32; -- return dev->rom_base_reg; -- } else if (resno < PCI_BRIDGE_RESOURCES) { -- /* device specific resource */ -- *type = pci_bar_unknown; -- reg = pci_iov_resource_bar(dev, resno); -- if (reg) -- return reg; -- } -- -- dev_err(&dev->dev, "BAR %d: invalid resource\n", resno); -- return 0; --} -- - /* Some architectures require additional programming to enable VGA */ - static arch_set_vga_state_t arch_set_vga_state; - -diff --git a/drivers/pci/pci.h b/drivers/pci/pci.h -index d390fc1475ec..c43e448873ca 100644 ---- a/drivers/pci/pci.h -+++ b/drivers/pci/pci.h -@@ -232,7 +232,6 @@ bool pci_bus_read_dev_vendor_id(struct pci_bus *bus, int devfn, u32 *pl, - int pci_setup_device(struct pci_dev *dev); - int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, - struct resource *res, unsigned int reg); --int pci_resource_bar(struct pci_dev *dev, int resno, enum pci_bar_type *type); - void pci_configure_ari(struct pci_dev *dev); - void __pci_bus_size_bridges(struct pci_bus *bus, - struct list_head *realloc_head); -@@ -276,7 +275,7 @@ static inline void pci_restore_ats_state(struct pci_dev *dev) - #ifdef CONFIG_PCI_IOV - int pci_iov_init(struct pci_dev *dev); - void pci_iov_release(struct pci_dev *dev); --int pci_iov_resource_bar(struct pci_dev *dev, int resno); -+void pci_iov_update_resource(struct pci_dev *dev, int resno); - resource_size_t pci_sriov_resource_alignment(struct pci_dev *dev, int resno); - void pci_restore_iov_state(struct pci_dev *dev); - int pci_iov_bus_range(struct pci_bus *bus); -@@ -290,10 +289,6 @@ static inline void pci_iov_release(struct pci_dev *dev) - - { - } --static inline int pci_iov_resource_bar(struct pci_dev *dev, int resno) --{ -- return 0; --} - static inline void pci_restore_iov_state(struct pci_dev *dev) - { - } -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index 71d9a6d1bd56..b83df942794f 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -226,7 +226,8 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, - mask64 = (u32)PCI_BASE_ADDRESS_MEM_MASK; - } - } else { -- res->flags |= (l & IORESOURCE_ROM_ENABLE); -+ if (l & PCI_ROM_ADDRESS_ENABLE) -+ res->flags |= IORESOURCE_ROM_ENABLE; - l64 = l & PCI_ROM_ADDRESS_MASK; - sz64 = sz & PCI_ROM_ADDRESS_MASK; - mask64 = (u32)PCI_ROM_ADDRESS_MASK; -diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c -index eb0ad530dc43..3eea7fc5e1a2 100644 ---- a/drivers/pci/rom.c -+++ b/drivers/pci/rom.c -@@ -31,6 +31,11 @@ int pci_enable_rom(struct pci_dev *pdev) - if (!res->flags) - return -1; - -+ /* -+ * Ideally pci_update_resource() would update the ROM BAR address, -+ * and we would only set the enable bit here. But apparently some -+ * devices have buggy ROM BARs that read as zero when disabled. -+ */ - pcibios_resource_to_bus(pdev->bus, ®ion, res); - pci_read_config_dword(pdev, pdev->rom_base_reg, &rom_addr); - rom_addr &= ~PCI_ROM_ADDRESS_MASK; -diff --git a/drivers/pci/setup-res.c b/drivers/pci/setup-res.c -index 604011e047d6..25062966cbfa 100644 ---- a/drivers/pci/setup-res.c -+++ b/drivers/pci/setup-res.c -@@ -25,21 +25,18 @@ - #include - #include "pci.h" - -- --void pci_update_resource(struct pci_dev *dev, int resno) -+static void pci_std_update_resource(struct pci_dev *dev, int resno) - { - struct pci_bus_region region; - bool disable; - u16 cmd; - u32 new, check, mask; - int reg; -- enum pci_bar_type type; - struct resource *res = dev->resource + resno; - -- if (dev->is_virtfn) { -- dev_warn(&dev->dev, "can't update VF BAR%d\n", resno); -+ /* Per SR-IOV spec 3.4.1.11, VF BARs are RO zero */ -+ if (dev->is_virtfn) - return; -- } - - /* - * Ignore resources for unimplemented BARs and unused resource slots -@@ -60,21 +57,34 @@ void pci_update_resource(struct pci_dev *dev, int resno) - return; - - pcibios_resource_to_bus(dev->bus, ®ion, res); -+ new = region.start; - -- new = region.start | (res->flags & PCI_REGION_FLAG_MASK); -- if (res->flags & IORESOURCE_IO) -+ if (res->flags & IORESOURCE_IO) { - mask = (u32)PCI_BASE_ADDRESS_IO_MASK; -- else -+ new |= res->flags & ~PCI_BASE_ADDRESS_IO_MASK; -+ } else if (resno == PCI_ROM_RESOURCE) { -+ mask = (u32)PCI_ROM_ADDRESS_MASK; -+ } else { - mask = (u32)PCI_BASE_ADDRESS_MEM_MASK; -+ new |= res->flags & ~PCI_BASE_ADDRESS_MEM_MASK; -+ } - -- reg = pci_resource_bar(dev, resno, &type); -- if (!reg) -- return; -- if (type != pci_bar_unknown) { -+ if (resno < PCI_ROM_RESOURCE) { -+ reg = PCI_BASE_ADDRESS_0 + 4 * resno; -+ } else if (resno == PCI_ROM_RESOURCE) { -+ -+ /* -+ * Apparently some Matrox devices have ROM BARs that read -+ * as zero when disabled, so don't update ROM BARs unless -+ * they're enabled. See https://lkml.org/lkml/2005/8/30/138. -+ */ - if (!(res->flags & IORESOURCE_ROM_ENABLE)) - return; -+ -+ reg = dev->rom_base_reg; - new |= PCI_ROM_ADDRESS_ENABLE; -- } -+ } else -+ return; - - /* - * We can't update a 64-bit BAR atomically, so when possible, -@@ -110,6 +120,16 @@ void pci_update_resource(struct pci_dev *dev, int resno) - pci_write_config_word(dev, PCI_COMMAND, cmd); - } - -+void pci_update_resource(struct pci_dev *dev, int resno) -+{ -+ if (resno <= PCI_ROM_RESOURCE) -+ pci_std_update_resource(dev, resno); -+#ifdef CONFIG_PCI_IOV -+ else if (resno >= PCI_IOV_RESOURCES && resno <= PCI_IOV_RESOURCE_END) -+ pci_iov_update_resource(dev, resno); -+#endif -+} -+ - int pci_claim_resource(struct pci_dev *dev, int resource) - { - struct resource *res = &dev->resource[resource]; -diff --git a/drivers/s390/crypto/ap_bus.c b/drivers/s390/crypto/ap_bus.c -index 24ec282e15d8..7c3b8d3516e3 100644 ---- a/drivers/s390/crypto/ap_bus.c -+++ b/drivers/s390/crypto/ap_bus.c -@@ -1651,6 +1651,9 @@ static void ap_scan_bus(struct work_struct *unused) - ap_dev->queue_depth = queue_depth; - ap_dev->raw_hwtype = device_type; - ap_dev->device_type = device_type; -+ /* CEX6 toleration: map to CEX5 */ -+ if (device_type == AP_DEVICE_TYPE_CEX6) -+ ap_dev->device_type = AP_DEVICE_TYPE_CEX5; - ap_dev->functions = device_functions; - spin_lock_init(&ap_dev->lock); - INIT_LIST_HEAD(&ap_dev->pendingq); -diff --git a/drivers/s390/crypto/ap_bus.h b/drivers/s390/crypto/ap_bus.h -index 6adcbdf225d1..cc741e948170 100644 ---- a/drivers/s390/crypto/ap_bus.h -+++ b/drivers/s390/crypto/ap_bus.h -@@ -105,6 +105,7 @@ static inline int ap_test_bit(unsigned int *ptr, unsigned int nr) - #define AP_DEVICE_TYPE_CEX3C 9 - #define AP_DEVICE_TYPE_CEX4 10 - #define AP_DEVICE_TYPE_CEX5 11 -+#define AP_DEVICE_TYPE_CEX6 12 - - /* - * Known function facilities -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 5b24ffd93649..83ff1724ec79 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -57,6 +57,7 @@ struct serial_private { - unsigned int nr; - void __iomem *remapped_bar[PCI_NUM_BAR_RESOURCES]; - struct pci_serial_quirk *quirk; -+ const struct pciserial_board *board; - int line[0]; - }; - -@@ -4058,6 +4059,7 @@ pciserial_init_ports(struct pci_dev *dev, const struct pciserial_board *board) - } - } - priv->nr = i; -+ priv->board = board; - return priv; - - err_deinit: -@@ -4068,7 +4070,7 @@ err_out: - } - EXPORT_SYMBOL_GPL(pciserial_init_ports); - --void pciserial_remove_ports(struct serial_private *priv) -+void pciserial_detach_ports(struct serial_private *priv) - { - struct pci_serial_quirk *quirk; - int i; -@@ -4088,7 +4090,11 @@ void pciserial_remove_ports(struct serial_private *priv) - quirk = find_quirk(priv->dev); - if (quirk->exit) - quirk->exit(priv->dev); -+} - -+void pciserial_remove_ports(struct serial_private *priv) -+{ -+ pciserial_detach_ports(priv); - kfree(priv); - } - EXPORT_SYMBOL_GPL(pciserial_remove_ports); -@@ -5819,7 +5825,7 @@ static pci_ers_result_t serial8250_io_error_detected(struct pci_dev *dev, - return PCI_ERS_RESULT_DISCONNECT; - - if (priv) -- pciserial_suspend_ports(priv); -+ pciserial_detach_ports(priv); - - pci_disable_device(dev); - -@@ -5844,9 +5850,18 @@ static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev) - static void serial8250_io_resume(struct pci_dev *dev) - { - struct serial_private *priv = pci_get_drvdata(dev); -+ const struct pciserial_board *board; - -- if (priv) -- pciserial_resume_ports(priv); -+ if (!priv) -+ return; -+ -+ board = priv->board; -+ kfree(priv); -+ priv = pciserial_init_ports(dev, board); -+ -+ if (!IS_ERR(priv)) { -+ pci_set_drvdata(dev, priv); -+ } - } - - static const struct pci_error_handlers serial8250_err_handler = { -diff --git a/drivers/usb/class/usbtmc.c b/drivers/usb/class/usbtmc.c -index deaddb950c20..24337ac3323f 100644 ---- a/drivers/usb/class/usbtmc.c -+++ b/drivers/usb/class/usbtmc.c -@@ -1105,7 +1105,7 @@ static int usbtmc_probe(struct usb_interface *intf, - - dev_dbg(&intf->dev, "%s called\n", __func__); - -- data = kmalloc(sizeof(*data), GFP_KERNEL); -+ data = kzalloc(sizeof(*data), GFP_KERNEL); - if (!data) - return -ENOMEM; - -@@ -1163,6 +1163,12 @@ static int usbtmc_probe(struct usb_interface *intf, - } - } - -+ if (!data->bulk_out || !data->bulk_in) { -+ dev_err(&intf->dev, "bulk endpoints not found\n"); -+ retcode = -ENODEV; -+ goto err_put; -+ } -+ - retcode = get_capabilities(data); - if (retcode) - dev_err(&intf->dev, "can't read capabilities\n"); -@@ -1186,6 +1192,7 @@ static int usbtmc_probe(struct usb_interface *intf, - error_register: - sysfs_remove_group(&intf->dev.kobj, &capability_attr_grp); - sysfs_remove_group(&intf->dev.kobj, &data_attr_grp); -+err_put: - kref_put(&data->kref, usbtmc_delete); - return retcode; - } -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index ac30a051ad71..325cbc9c35d8 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -246,6 +246,16 @@ static int usb_parse_endpoint(struct device *ddev, int cfgno, int inum, - - /* - * Adjust bInterval for quirked devices. -+ */ -+ /* -+ * This quirk fixes bIntervals reported in ms. -+ */ -+ if (to_usb_device(ddev)->quirks & -+ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL) { -+ n = clamp(fls(d->bInterval) + 3, i, j); -+ i = j = n; -+ } -+ /* - * This quirk fixes bIntervals reported in - * linear microframes. - */ -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index f52d8abf6979..9e62c93af96e 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4199,7 +4199,7 @@ static void hub_set_initial_usb2_lpm_policy(struct usb_device *udev) - struct usb_hub *hub = usb_hub_to_struct_hub(udev->parent); - int connect_type = USB_PORT_CONNECT_TYPE_UNKNOWN; - -- if (!udev->usb2_hw_lpm_capable) -+ if (!udev->usb2_hw_lpm_capable || !udev->bos) - return; - - if (hub) -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 24f9f98968a5..96b21b0dac1e 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -170,6 +170,14 @@ static const struct usb_device_id usb_quirk_list[] = { - /* M-Systems Flash Disk Pioneers */ - { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Baum Vario Ultra */ -+ { USB_DEVICE(0x0904, 0x6101), .driver_info = -+ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, -+ { USB_DEVICE(0x0904, 0x6102), .driver_info = -+ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, -+ { USB_DEVICE(0x0904, 0x6103), .driver_info = -+ USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL }, -+ - /* Keytouch QWERTY Panel keyboard */ - { USB_DEVICE(0x0926, 0x3333), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -diff --git a/drivers/usb/gadget/function/f_acm.c b/drivers/usb/gadget/function/f_acm.c -index 2fa1e80a3ce7..67e474b13fca 100644 ---- a/drivers/usb/gadget/function/f_acm.c -+++ b/drivers/usb/gadget/function/f_acm.c -@@ -535,13 +535,15 @@ static int acm_notify_serial_state(struct f_acm *acm) - { - struct usb_composite_dev *cdev = acm->port.func.config->cdev; - int status; -+ __le16 serial_state; - - spin_lock(&acm->lock); - if (acm->notify_req) { - dev_dbg(&cdev->gadget->dev, "acm ttyGS%d serial state %04x\n", - acm->port_num, acm->serial_state); -+ serial_state = cpu_to_le16(acm->serial_state); - status = acm_cdc_notify(acm, USB_CDC_NOTIFY_SERIAL_STATE, -- 0, &acm->serial_state, sizeof(acm->serial_state)); -+ 0, &serial_state, sizeof(acm->serial_state)); - } else { - acm->pending = true; - status = 0; -diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c -index 29b41b5dee04..c7689d05356c 100644 ---- a/drivers/usb/gadget/function/f_uvc.c -+++ b/drivers/usb/gadget/function/f_uvc.c -@@ -625,7 +625,7 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) - uvc_ss_streaming_comp.bMaxBurst = opts->streaming_maxburst; - uvc_ss_streaming_comp.wBytesPerInterval = - cpu_to_le16(max_packet_size * max_packet_mult * -- opts->streaming_maxburst); -+ (opts->streaming_maxburst + 1)); - - /* Allocate endpoints. */ - ep = usb_ep_autoconfig(cdev->gadget, &uvc_control_ep); -diff --git a/drivers/usb/misc/idmouse.c b/drivers/usb/misc/idmouse.c -index 4e38683c653c..6d4e75785710 100644 ---- a/drivers/usb/misc/idmouse.c -+++ b/drivers/usb/misc/idmouse.c -@@ -346,6 +346,9 @@ static int idmouse_probe(struct usb_interface *interface, - if (iface_desc->desc.bInterfaceClass != 0x0A) - return -ENODEV; - -+ if (iface_desc->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - /* allocate memory for our device state and initialize it */ - dev = kzalloc(sizeof(*dev), GFP_KERNEL); - if (dev == NULL) -diff --git a/drivers/usb/misc/lvstest.c b/drivers/usb/misc/lvstest.c -index 86b4e4b2ab9a..383fa007348f 100644 ---- a/drivers/usb/misc/lvstest.c -+++ b/drivers/usb/misc/lvstest.c -@@ -370,6 +370,10 @@ static int lvs_rh_probe(struct usb_interface *intf, - - hdev = interface_to_usbdev(intf); - desc = intf->cur_altsetting; -+ -+ if (desc->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - endpoint = &desc->endpoint[0].desc; - - /* valid only for SS root hub */ -diff --git a/drivers/usb/misc/uss720.c b/drivers/usb/misc/uss720.c -index bbd029c9c725..442b6631162e 100644 ---- a/drivers/usb/misc/uss720.c -+++ b/drivers/usb/misc/uss720.c -@@ -711,6 +711,11 @@ static int uss720_probe(struct usb_interface *intf, - - interface = intf->cur_altsetting; - -+ if (interface->desc.bNumEndpoints < 3) { -+ usb_put_dev(usbdev); -+ return -ENODEV; -+ } -+ - /* - * Allocate parport interface - */ -diff --git a/drivers/usb/musb/musb_cppi41.c b/drivers/usb/musb/musb_cppi41.c -index e499b862a946..88f26ac2a185 100644 ---- a/drivers/usb/musb/musb_cppi41.c -+++ b/drivers/usb/musb/musb_cppi41.c -@@ -250,8 +250,27 @@ static void cppi41_dma_callback(void *private_data) - transferred < cppi41_channel->packet_sz) - cppi41_channel->prog_len = 0; - -- if (cppi41_channel->is_tx) -- empty = musb_is_tx_fifo_empty(hw_ep); -+ if (cppi41_channel->is_tx) { -+ u8 type; -+ -+ if (is_host_active(musb)) -+ type = hw_ep->out_qh->type; -+ else -+ type = hw_ep->ep_in.type; -+ -+ if (type == USB_ENDPOINT_XFER_ISOC) -+ /* -+ * Don't use the early-TX-interrupt workaround below -+ * for Isoch transfter. Since Isoch are periodic -+ * transfer, by the time the next transfer is -+ * scheduled, the current one should be done already. -+ * -+ * This avoids audio playback underrun issue. -+ */ -+ empty = true; -+ else -+ empty = musb_is_tx_fifo_empty(hw_ep); -+ } - - if (!cppi41_channel->is_tx || empty) { - cppi41_trans_done(cppi41_channel); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 42cc72e54c05..af67a0de6b5d 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -233,6 +233,14 @@ static void option_instat_callback(struct urb *urb); - #define BANDRICH_PRODUCT_1012 0x1012 - - #define QUALCOMM_VENDOR_ID 0x05C6 -+/* These Quectel products use Qualcomm's vendor ID */ -+#define QUECTEL_PRODUCT_UC20 0x9003 -+#define QUECTEL_PRODUCT_UC15 0x9090 -+ -+#define QUECTEL_VENDOR_ID 0x2c7c -+/* These Quectel products use Quectel's vendor ID */ -+#define QUECTEL_PRODUCT_EC21 0x0121 -+#define QUECTEL_PRODUCT_EC25 0x0125 - - #define CMOTECH_VENDOR_ID 0x16d8 - #define CMOTECH_PRODUCT_6001 0x6001 -@@ -1161,7 +1169,14 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */ - { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */ -- { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9003), /* Quectel UC20 */ -+ /* Quectel products using Qualcomm vendor ID */ -+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, -+ { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ /* Quectel products using Quectel vendor ID */ -+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 696458db7e3c..38b3f0d8cd58 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -169,6 +169,8 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x413c, 0x81a9)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81b1)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ -+ {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ -+ {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ - - /* Huawei devices */ - {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */ -diff --git a/drivers/usb/wusbcore/wa-hc.c b/drivers/usb/wusbcore/wa-hc.c -index 252c7bd9218a..d01496fd27fe 100644 ---- a/drivers/usb/wusbcore/wa-hc.c -+++ b/drivers/usb/wusbcore/wa-hc.c -@@ -39,6 +39,9 @@ int wa_create(struct wahc *wa, struct usb_interface *iface, - int result; - struct device *dev = &iface->dev; - -+ if (iface->cur_altsetting->desc.bNumEndpoints < 3) -+ return -ENODEV; -+ - result = wa_rpipes_create(wa); - if (result < 0) - goto error_rpipes_create; -diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c -index 0257f35cfb9d..e75bbe5a10cd 100644 ---- a/drivers/uwb/hwa-rc.c -+++ b/drivers/uwb/hwa-rc.c -@@ -825,6 +825,9 @@ static int hwarc_probe(struct usb_interface *iface, - struct hwarc *hwarc; - struct device *dev = &iface->dev; - -+ if (iface->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - result = -ENOMEM; - uwb_rc = uwb_rc_alloc(); - if (uwb_rc == NULL) { -diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c -index 2bfc846ac071..6345e85822a4 100644 ---- a/drivers/uwb/i1480/dfu/usb.c -+++ b/drivers/uwb/i1480/dfu/usb.c -@@ -362,6 +362,9 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id) - result); - } - -+ if (iface->cur_altsetting->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - result = -ENOMEM; - i1480_usb = kzalloc(sizeof(*i1480_usb), GFP_KERNEL); - if (i1480_usb == NULL) { -diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c -index 0582b72ef377..1a9f18b40be6 100644 ---- a/drivers/vfio/vfio_iommu_spapr_tce.c -+++ b/drivers/vfio/vfio_iommu_spapr_tce.c -@@ -511,6 +511,12 @@ static long tce_iommu_build_v2(struct tce_container *container, - unsigned long hpa; - enum dma_data_direction dirtmp; - -+ if (!tbl->it_userspace) { -+ ret = tce_iommu_userspace_view_alloc(tbl); -+ if (ret) -+ return ret; -+ } -+ - for (i = 0; i < pages; ++i) { - struct mm_iommu_table_group_mem_t *mem = NULL; - unsigned long *pua = IOMMU_TABLE_USERSPACE_ENTRY(tbl, -@@ -584,15 +590,6 @@ static long tce_iommu_create_table(struct tce_container *container, - WARN_ON(!ret && !(*ptbl)->it_ops->free); - WARN_ON(!ret && ((*ptbl)->it_allocated_size != table_size)); - -- if (!ret && container->v2) { -- ret = tce_iommu_userspace_view_alloc(*ptbl); -- if (ret) -- (*ptbl)->it_ops->free(*ptbl); -- } -- -- if (ret) -- decrement_locked_vm(table_size >> PAGE_SHIFT); -- - return ret; - } - -@@ -1064,10 +1061,7 @@ static int tce_iommu_take_ownership(struct tce_container *container, - if (!tbl || !tbl->it_map) - continue; - -- rc = tce_iommu_userspace_view_alloc(tbl); -- if (!rc) -- rc = iommu_take_ownership(tbl); -- -+ rc = iommu_take_ownership(tbl); - if (rc) { - for (j = 0; j < i; ++j) - iommu_release_ownership( -diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c -index 6e92917ba77a..4e3c78d88832 100644 ---- a/drivers/video/console/fbcon.c -+++ b/drivers/video/console/fbcon.c -@@ -1168,6 +1168,8 @@ static void fbcon_free_font(struct display *p, bool freefont) - p->userfont = 0; - } - -+static void set_vc_hi_font(struct vc_data *vc, bool set); -+ - static void fbcon_deinit(struct vc_data *vc) - { - struct display *p = &fb_display[vc->vc_num]; -@@ -1203,6 +1205,9 @@ finished: - if (free_font) - vc->vc_font.data = NULL; - -+ if (vc->vc_hi_font_mask) -+ set_vc_hi_font(vc, false); -+ - if (!con_is_bound(&fb_con)) - fbcon_exit(); - -@@ -2439,32 +2444,10 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font) - return 0; - } - --static int fbcon_do_set_font(struct vc_data *vc, int w, int h, -- const u8 * data, int userfont) -+/* set/clear vc_hi_font_mask and update vc attrs accordingly */ -+static void set_vc_hi_font(struct vc_data *vc, bool set) - { -- struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; -- struct fbcon_ops *ops = info->fbcon_par; -- struct display *p = &fb_display[vc->vc_num]; -- int resize; -- int cnt; -- char *old_data = NULL; -- -- if (CON_IS_VISIBLE(vc) && softback_lines) -- fbcon_set_origin(vc); -- -- resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); -- if (p->userfont) -- old_data = vc->vc_font.data; -- if (userfont) -- cnt = FNTCHARCNT(data); -- else -- cnt = 256; -- vc->vc_font.data = (void *)(p->fontdata = data); -- if ((p->userfont = userfont)) -- REFCOUNT(data)++; -- vc->vc_font.width = w; -- vc->vc_font.height = h; -- if (vc->vc_hi_font_mask && cnt == 256) { -+ if (!set) { - vc->vc_hi_font_mask = 0; - if (vc->vc_can_do_color) { - vc->vc_complement_mask >>= 1; -@@ -2487,7 +2470,7 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, - ((c & 0xfe00) >> 1) | (c & 0xff); - vc->vc_attr >>= 1; - } -- } else if (!vc->vc_hi_font_mask && cnt == 512) { -+ } else { - vc->vc_hi_font_mask = 0x100; - if (vc->vc_can_do_color) { - vc->vc_complement_mask <<= 1; -@@ -2519,8 +2502,38 @@ static int fbcon_do_set_font(struct vc_data *vc, int w, int h, - } else - vc->vc_video_erase_char = c & ~0x100; - } -- - } -+} -+ -+static int fbcon_do_set_font(struct vc_data *vc, int w, int h, -+ const u8 * data, int userfont) -+{ -+ struct fb_info *info = registered_fb[con2fb_map[vc->vc_num]]; -+ struct fbcon_ops *ops = info->fbcon_par; -+ struct display *p = &fb_display[vc->vc_num]; -+ int resize; -+ int cnt; -+ char *old_data = NULL; -+ -+ if (CON_IS_VISIBLE(vc) && softback_lines) -+ fbcon_set_origin(vc); -+ -+ resize = (w != vc->vc_font.width) || (h != vc->vc_font.height); -+ if (p->userfont) -+ old_data = vc->vc_font.data; -+ if (userfont) -+ cnt = FNTCHARCNT(data); -+ else -+ cnt = 256; -+ vc->vc_font.data = (void *)(p->fontdata = data); -+ if ((p->userfont = userfont)) -+ REFCOUNT(data)++; -+ vc->vc_font.width = w; -+ vc->vc_font.height = h; -+ if (vc->vc_hi_font_mask && cnt == 256) -+ set_vc_hi_font(vc, false); -+ else if (!vc->vc_hi_font_mask && cnt == 512) -+ set_vc_hi_font(vc, true); - - if (resize) { - int cols, rows; -diff --git a/drivers/xen/xen-acpi-processor.c b/drivers/xen/xen-acpi-processor.c -index 611f9c11da85..2e319d0c395d 100644 ---- a/drivers/xen/xen-acpi-processor.c -+++ b/drivers/xen/xen-acpi-processor.c -@@ -27,10 +27,10 @@ - #include - #include - #include -+#include - #include - #include - #include --#include - #include - #include - -@@ -466,15 +466,33 @@ static int xen_upload_processor_pm_data(void) - return rc; - } - --static int xen_acpi_processor_resume(struct notifier_block *nb, -- unsigned long action, void *data) -+static void xen_acpi_processor_resume_worker(struct work_struct *dummy) - { -+ int rc; -+ - bitmap_zero(acpi_ids_done, nr_acpi_bits); -- return xen_upload_processor_pm_data(); -+ -+ rc = xen_upload_processor_pm_data(); -+ if (rc != 0) -+ pr_info("ACPI data upload failed, error = %d\n", rc); -+} -+ -+static void xen_acpi_processor_resume(void) -+{ -+ static DECLARE_WORK(wq, xen_acpi_processor_resume_worker); -+ -+ /* -+ * xen_upload_processor_pm_data() calls non-atomic code. -+ * However, the context for xen_acpi_processor_resume is syscore -+ * with only the boot CPU online and in an atomic context. -+ * -+ * So defer the upload for some point safer. -+ */ -+ schedule_work(&wq); - } - --struct notifier_block xen_acpi_processor_resume_nb = { -- .notifier_call = xen_acpi_processor_resume, -+static struct syscore_ops xap_syscore_ops = { -+ .resume = xen_acpi_processor_resume, - }; - - static int __init xen_acpi_processor_init(void) -@@ -527,7 +545,7 @@ static int __init xen_acpi_processor_init(void) - if (rc) - goto err_unregister; - -- xen_resume_notifier_register(&xen_acpi_processor_resume_nb); -+ register_syscore_ops(&xap_syscore_ops); - - return 0; - err_unregister: -@@ -544,7 +562,7 @@ static void __exit xen_acpi_processor_exit(void) - { - int i; - -- xen_resume_notifier_unregister(&xen_acpi_processor_resume_nb); -+ unregister_syscore_ops(&xap_syscore_ops); - kfree(acpi_ids_done); - kfree(acpi_id_present); - kfree(acpi_id_cst_present); -diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c -index d4be4e23bc21..dad8e7bdf0a6 100644 ---- a/fs/ext4/inline.c -+++ b/fs/ext4/inline.c -@@ -1158,10 +1158,9 @@ static int ext4_finish_convert_inline_dir(handle_t *handle, - set_buffer_uptodate(dir_block); - err = ext4_handle_dirty_dirent_node(handle, inode, dir_block); - if (err) -- goto out; -+ return err; - set_buffer_verified(dir_block); --out: -- return err; -+ return ext4_mark_inode_dirty(handle, inode); - } - - static int ext4_convert_inline_data_nolock(handle_t *handle, -diff --git a/fs/xfs/libxfs/xfs_inode_buf.c b/fs/xfs/libxfs/xfs_inode_buf.c -index 1aabfda669b0..7183b7ea065b 100644 ---- a/fs/xfs/libxfs/xfs_inode_buf.c -+++ b/fs/xfs/libxfs/xfs_inode_buf.c -@@ -299,6 +299,14 @@ xfs_dinode_verify( - if (dip->di_magic != cpu_to_be16(XFS_DINODE_MAGIC)) - return false; - -+ /* don't allow invalid i_size */ -+ if (be64_to_cpu(dip->di_size) & (1ULL << 63)) -+ return false; -+ -+ /* No zero-length symlinks. */ -+ if (S_ISLNK(be16_to_cpu(dip->di_mode)) && dip->di_size == 0) -+ return false; -+ - /* only version 3 or greater inodes are extensively verified here */ - if (dip->di_version < 3) - return true; -diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c -index dbae6490a79a..832764ee035a 100644 ---- a/fs/xfs/xfs_bmap_util.c -+++ b/fs/xfs/xfs_bmap_util.c -@@ -1713,6 +1713,7 @@ xfs_swap_extents( - xfs_trans_t *tp; - xfs_bstat_t *sbp = &sxp->sx_stat; - xfs_ifork_t *tempifp, *ifp, *tifp; -+ xfs_extnum_t nextents; - int src_log_flags, target_log_flags; - int error = 0; - int aforkblks = 0; -@@ -1899,7 +1900,8 @@ xfs_swap_extents( - * pointer. Otherwise it's already NULL or - * pointing to the extent. - */ -- if (ip->i_d.di_nextents <= XFS_INLINE_EXTS) { -+ nextents = ip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t); -+ if (nextents <= XFS_INLINE_EXTS) { - ifp->if_u1.if_extents = - ifp->if_u2.if_inline_ext; - } -@@ -1918,7 +1920,8 @@ xfs_swap_extents( - * pointer. Otherwise it's already NULL or - * pointing to the extent. - */ -- if (tip->i_d.di_nextents <= XFS_INLINE_EXTS) { -+ nextents = tip->i_df.if_bytes / (uint)sizeof(xfs_bmbt_rec_t); -+ if (nextents <= XFS_INLINE_EXTS) { - tifp->if_u1.if_extents = - tifp->if_u2.if_inline_ext; - } -diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c -index eb1b8c8acfcb..8146b0cf20ce 100644 ---- a/fs/xfs/xfs_buf.c -+++ b/fs/xfs/xfs_buf.c -@@ -375,6 +375,7 @@ retry: - out_free_pages: - for (i = 0; i < bp->b_page_count; i++) - __free_page(bp->b_pages[i]); -+ bp->b_flags &= ~_XBF_PAGES; - return error; - } - -diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h -index 1d0043dc34e4..de2a722fe3cf 100644 ---- a/include/linux/usb/quirks.h -+++ b/include/linux/usb/quirks.h -@@ -50,4 +50,10 @@ - /* device can't handle Link Power Management */ - #define USB_QUIRK_NO_LPM BIT(10) - -+/* -+ * Device reports its bInterval as linear frames instead of the -+ * USB 2.0 calculation. -+ */ -+#define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL BIT(11) -+ - #endif /* __LINUX_USB_QUIRKS_H */ -diff --git a/net/ceph/osdmap.c b/net/ceph/osdmap.c -index ddc3573894b0..bc95e48d5cfb 100644 ---- a/net/ceph/osdmap.c -+++ b/net/ceph/osdmap.c -@@ -1265,7 +1265,6 @@ static int decode_new_up_state_weight(void **p, void *end, - if ((map->osd_state[osd] & CEPH_OSD_EXISTS) && - (xorstate & CEPH_OSD_EXISTS)) { - pr_info("osd%d does not exist\n", osd); -- map->osd_weight[osd] = CEPH_OSD_IN; - ret = set_primary_affinity(map, osd, - CEPH_OSD_DEFAULT_PRIMARY_AFFINITY); - if (ret) -diff --git a/net/core/sock.c b/net/core/sock.c -index f4c0917e66b5..9c708a5fb751 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1459,6 +1459,11 @@ void sk_destruct(struct sock *sk) - pr_debug("%s: optmem leakage (%d bytes) detected\n", - __func__, atomic_read(&sk->sk_omem_alloc)); - -+ if (sk->sk_frag.page) { -+ put_page(sk->sk_frag.page); -+ sk->sk_frag.page = NULL; -+ } -+ - if (sk->sk_peer_cred) - put_cred(sk->sk_peer_cred); - put_pid(sk->sk_peer_pid); -@@ -1552,6 +1557,12 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - is_charged = sk_filter_charge(newsk, filter); - - if (unlikely(!is_charged || xfrm_sk_clone_policy(newsk, sk))) { -+ /* We need to make sure that we don't uncharge the new -+ * socket if we couldn't charge it in the first place -+ * as otherwise we uncharge the parent's filter. -+ */ -+ if (!is_charged) -+ RCU_INIT_POINTER(newsk->sk_filter, NULL); - /* It is still raw copy of parent, so invalidate - * destructor and make plain sk_free() */ - newsk->sk_destruct = NULL; -@@ -2691,11 +2702,6 @@ void sk_common_release(struct sock *sk) - - sk_refcnt_debug_release(sk); - -- if (sk->sk_frag.page) { -- put_page(sk->sk_frag.page); -- sk->sk_frag.page = NULL; -- } -- - sock_put(sk); - } - EXPORT_SYMBOL(sk_common_release); -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 4e60dae86df5..1adba44f8fbc 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1080,7 +1080,8 @@ static void nl_fib_input(struct sk_buff *skb) - - net = sock_net(skb->sk); - nlh = nlmsg_hdr(skb); -- if (skb->len < NLMSG_HDRLEN || skb->len < nlh->nlmsg_len || -+ if (skb->len < nlmsg_total_size(sizeof(*frn)) || -+ skb->len < nlh->nlmsg_len || - nlmsg_len(nlh) < sizeof(*frn)) - return; - -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 7cc0f8aac28f..818630cec54f 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -5435,6 +5435,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb) - struct inet_connection_sock *icsk = inet_csk(sk); - - tcp_set_state(sk, TCP_ESTABLISHED); -+ icsk->icsk_ack.lrcvtime = tcp_time_stamp; - - if (skb) { - icsk->icsk_af_ops->sk_rx_dst_set(sk, skb); -@@ -5647,7 +5648,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb, - * to stand against the temptation 8) --ANK - */ - inet_csk_schedule_ack(sk); -- icsk->icsk_ack.lrcvtime = tcp_time_stamp; - tcp_enter_quickack_mode(sk); - inet_csk_reset_xmit_timer(sk, ICSK_TIME_DACK, - TCP_DELACK_MAX, TCP_RTO_MAX); -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 9475a2748a9a..019db68bdb9f 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -472,6 +472,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, - newtp->mdev_us = jiffies_to_usecs(TCP_TIMEOUT_INIT); - newtp->rtt_min[0].rtt = ~0U; - newicsk->icsk_rto = TCP_TIMEOUT_INIT; -+ newicsk->icsk_ack.lrcvtime = tcp_time_stamp; - - newtp->packets_out = 0; - newtp->retrans_out = 0; -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index d1bd4a45ca2d..d26b28def310 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -588,7 +588,7 @@ static int ip_tun_from_nlattr(const struct nlattr *attr, - ipv4 = true; - break; - case OVS_TUNNEL_KEY_ATTR_IPV6_SRC: -- SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.dst, -+ SW_FLOW_KEY_PUT(match, tun_key.u.ipv6.src, - nla_get_in6_addr(a), is_mask); - ipv6 = true; - break; -diff --git a/net/unix/garbage.c b/net/unix/garbage.c -index 6a0d48525fcf..c36757e72844 100644 ---- a/net/unix/garbage.c -+++ b/net/unix/garbage.c -@@ -146,6 +146,7 @@ void unix_notinflight(struct user_struct *user, struct file *fp) - if (s) { - struct unix_sock *u = unix_sk(s); - -+ BUG_ON(!atomic_long_read(&u->inflight)); - BUG_ON(list_empty(&u->link)); - - if (atomic_long_dec_and_test(&u->inflight)) -@@ -341,6 +342,14 @@ void unix_gc(void) - } - list_del(&cursor); - -+ /* Now gc_candidates contains only garbage. Restore original -+ * inflight counters for these as well, and remove the skbuffs -+ * which are creating the cycle(s). -+ */ -+ skb_queue_head_init(&hitlist); -+ list_for_each_entry(u, &gc_candidates, link) -+ scan_children(&u->sk, inc_inflight, &hitlist); -+ - /* not_cycle_list contains those sockets which do not make up a - * cycle. Restore these to the inflight list. - */ -@@ -350,14 +359,6 @@ void unix_gc(void) - list_move_tail(&u->link, &gc_inflight_list); - } - -- /* Now gc_candidates contains only garbage. Restore original -- * inflight counters for these as well, and remove the skbuffs -- * which are creating the cycle(s). -- */ -- skb_queue_head_init(&hitlist); -- list_for_each_entry(u, &gc_candidates, link) -- scan_children(&u->sk, inc_inflight, &hitlist); -- - spin_unlock(&unix_gc_lock); - - /* Here we are. Hitlist is filled. Die. */ -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 1f0de6d74daa..9d0953e5734f 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -492,21 +492,17 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb, - { - int err; - -- rtnl_lock(); -- - if (!cb->args[0]) { - err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, - nl80211_fam.attrbuf, nl80211_fam.maxattr, - nl80211_policy); - if (err) -- goto out_unlock; -+ return err; - - *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), - nl80211_fam.attrbuf); -- if (IS_ERR(*wdev)) { -- err = PTR_ERR(*wdev); -- goto out_unlock; -- } -+ if (IS_ERR(*wdev)) -+ return PTR_ERR(*wdev); - *rdev = wiphy_to_rdev((*wdev)->wiphy); - /* 0 is the first index - add 1 to parse only once */ - cb->args[0] = (*rdev)->wiphy_idx + 1; -@@ -516,10 +512,8 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb, - struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); - struct wireless_dev *tmp; - -- if (!wiphy) { -- err = -ENODEV; -- goto out_unlock; -- } -+ if (!wiphy) -+ return -ENODEV; - *rdev = wiphy_to_rdev(wiphy); - *wdev = NULL; - -@@ -530,21 +524,11 @@ static int nl80211_prepare_wdev_dump(struct sk_buff *skb, - } - } - -- if (!*wdev) { -- err = -ENODEV; -- goto out_unlock; -- } -+ if (!*wdev) -+ return -ENODEV; - } - - return 0; -- out_unlock: -- rtnl_unlock(); -- return err; --} -- --static void nl80211_finish_wdev_dump(struct cfg80211_registered_device *rdev) --{ -- rtnl_unlock(); - } - - /* IE validation */ -@@ -3884,9 +3868,10 @@ static int nl80211_dump_station(struct sk_buff *skb, - int sta_idx = cb->args[2]; - int err; - -+ rtnl_lock(); - err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); - if (err) -- return err; -+ goto out_err; - - if (!wdev->netdev) { - err = -EINVAL; -@@ -3922,7 +3907,7 @@ static int nl80211_dump_station(struct sk_buff *skb, - cb->args[2] = sta_idx; - err = skb->len; - out_err: -- nl80211_finish_wdev_dump(rdev); -+ rtnl_unlock(); - - return err; - } -@@ -4639,9 +4624,10 @@ static int nl80211_dump_mpath(struct sk_buff *skb, - int path_idx = cb->args[2]; - int err; - -+ rtnl_lock(); - err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); - if (err) -- return err; -+ goto out_err; - - if (!rdev->ops->dump_mpath) { - err = -EOPNOTSUPP; -@@ -4675,7 +4661,7 @@ static int nl80211_dump_mpath(struct sk_buff *skb, - cb->args[2] = path_idx; - err = skb->len; - out_err: -- nl80211_finish_wdev_dump(rdev); -+ rtnl_unlock(); - return err; - } - -@@ -4835,9 +4821,10 @@ static int nl80211_dump_mpp(struct sk_buff *skb, - int path_idx = cb->args[2]; - int err; - -+ rtnl_lock(); - err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); - if (err) -- return err; -+ goto out_err; - - if (!rdev->ops->dump_mpp) { - err = -EOPNOTSUPP; -@@ -4870,7 +4857,7 @@ static int nl80211_dump_mpp(struct sk_buff *skb, - cb->args[2] = path_idx; - err = skb->len; - out_err: -- nl80211_finish_wdev_dump(rdev); -+ rtnl_unlock(); - return err; - } - -@@ -6806,9 +6793,12 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) - int start = cb->args[2], idx = 0; - int err; - -+ rtnl_lock(); - err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); -- if (err) -+ if (err) { -+ rtnl_unlock(); - return err; -+ } - - wdev_lock(wdev); - spin_lock_bh(&rdev->bss_lock); -@@ -6831,7 +6821,7 @@ static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb) - wdev_unlock(wdev); - - cb->args[2] = idx; -- nl80211_finish_wdev_dump(rdev); -+ rtnl_unlock(); - - return skb->len; - } -@@ -6915,9 +6905,10 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) - int res; - bool radio_stats; - -+ rtnl_lock(); - res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev); - if (res) -- return res; -+ goto out_err; - - /* prepare_wdev_dump parsed the attributes */ - radio_stats = nl80211_fam.attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS]; -@@ -6958,7 +6949,7 @@ static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb) - cb->args[2] = survey_idx; - res = skb->len; - out_err: -- nl80211_finish_wdev_dump(rdev); -+ rtnl_unlock(); - return res; - } - -@@ -10158,17 +10149,13 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb, - void *data = NULL; - unsigned int data_len = 0; - -- rtnl_lock(); -- - if (cb->args[0]) { - /* subtract the 1 again here */ - struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1); - struct wireless_dev *tmp; - -- if (!wiphy) { -- err = -ENODEV; -- goto out_unlock; -- } -+ if (!wiphy) -+ return -ENODEV; - *rdev = wiphy_to_rdev(wiphy); - *wdev = NULL; - -@@ -10189,13 +10176,11 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb, - nl80211_fam.attrbuf, nl80211_fam.maxattr, - nl80211_policy); - if (err) -- goto out_unlock; -+ return err; - - if (!nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID] || -- !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) { -- err = -EINVAL; -- goto out_unlock; -- } -+ !nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) -+ return -EINVAL; - - *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), - nl80211_fam.attrbuf); -@@ -10204,10 +10189,8 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb, - - *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), - nl80211_fam.attrbuf); -- if (IS_ERR(*rdev)) { -- err = PTR_ERR(*rdev); -- goto out_unlock; -- } -+ if (IS_ERR(*rdev)) -+ return PTR_ERR(*rdev); - - vid = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_ID]); - subcmd = nla_get_u32(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_SUBCMD]); -@@ -10220,19 +10203,15 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb, - if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd) - continue; - -- if (!vcmd->dumpit) { -- err = -EOPNOTSUPP; -- goto out_unlock; -- } -+ if (!vcmd->dumpit) -+ return -EOPNOTSUPP; - - vcmd_idx = i; - break; - } - -- if (vcmd_idx < 0) { -- err = -EOPNOTSUPP; -- goto out_unlock; -- } -+ if (vcmd_idx < 0) -+ return -EOPNOTSUPP; - - if (nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]) { - data = nla_data(nl80211_fam.attrbuf[NL80211_ATTR_VENDOR_DATA]); -@@ -10249,9 +10228,6 @@ static int nl80211_prepare_vendor_dump(struct sk_buff *skb, - - /* keep rtnl locked in successful case */ - return 0; -- out_unlock: -- rtnl_unlock(); -- return err; - } - - static int nl80211_vendor_cmd_dump(struct sk_buff *skb, -@@ -10266,9 +10242,10 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb, - int err; - struct nlattr *vendor_data; - -+ rtnl_lock(); - err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev); - if (err) -- return err; -+ goto out; - - vcmd_idx = cb->args[2]; - data = (void *)cb->args[3]; -@@ -10277,18 +10254,26 @@ static int nl80211_vendor_cmd_dump(struct sk_buff *skb, - - if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV | - WIPHY_VENDOR_CMD_NEED_NETDEV)) { -- if (!wdev) -- return -EINVAL; -+ if (!wdev) { -+ err = -EINVAL; -+ goto out; -+ } - if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV && -- !wdev->netdev) -- return -EINVAL; -+ !wdev->netdev) { -+ err = -EINVAL; -+ goto out; -+ } - - if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) { - if (wdev->netdev && -- !netif_running(wdev->netdev)) -- return -ENETDOWN; -- if (!wdev->netdev && !wdev->p2p_started) -- return -ENETDOWN; -+ !netif_running(wdev->netdev)) { -+ err = -ENETDOWN; -+ goto out; -+ } -+ if (!wdev->netdev && !wdev->p2p_started) { -+ err = -ENETDOWN; -+ goto out; -+ } - } - } - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 58e79e02f217..c67f9c212dd1 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1921,6 +1921,7 @@ static int snd_seq_ioctl_set_client_pool(struct snd_seq_client *client, - info.output_pool != client->pool->size)) { - if (snd_seq_write_pool_allocated(client)) { - /* remove all existing cells */ -+ snd_seq_pool_mark_closing(client->pool); - snd_seq_queue_client_leave_cells(client->number); - snd_seq_pool_done(client->pool); - } -diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c -index 86240d02b530..3f4efcb85df5 100644 ---- a/sound/core/seq/seq_fifo.c -+++ b/sound/core/seq/seq_fifo.c -@@ -70,6 +70,9 @@ void snd_seq_fifo_delete(struct snd_seq_fifo **fifo) - return; - *fifo = NULL; - -+ if (f->pool) -+ snd_seq_pool_mark_closing(f->pool); -+ - snd_seq_fifo_clear(f); - - /* wake up clients if any */ -diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c -index dfa5156f3585..5847c4475bf3 100644 ---- a/sound/core/seq/seq_memory.c -+++ b/sound/core/seq/seq_memory.c -@@ -414,6 +414,18 @@ int snd_seq_pool_init(struct snd_seq_pool *pool) - return 0; - } - -+/* refuse the further insertion to the pool */ -+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool) -+{ -+ unsigned long flags; -+ -+ if (snd_BUG_ON(!pool)) -+ return; -+ spin_lock_irqsave(&pool->lock, flags); -+ pool->closing = 1; -+ spin_unlock_irqrestore(&pool->lock, flags); -+} -+ - /* remove events */ - int snd_seq_pool_done(struct snd_seq_pool *pool) - { -@@ -424,10 +436,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) - return -EINVAL; - - /* wait for closing all threads */ -- spin_lock_irqsave(&pool->lock, flags); -- pool->closing = 1; -- spin_unlock_irqrestore(&pool->lock, flags); -- - if (waitqueue_active(&pool->output_sleep)) - wake_up(&pool->output_sleep); - -@@ -484,6 +492,7 @@ int snd_seq_pool_delete(struct snd_seq_pool **ppool) - *ppool = NULL; - if (pool == NULL) - return 0; -+ snd_seq_pool_mark_closing(pool); - snd_seq_pool_done(pool); - kfree(pool); - return 0; -diff --git a/sound/core/seq/seq_memory.h b/sound/core/seq/seq_memory.h -index 4a2ec779b8a7..32f959c17786 100644 ---- a/sound/core/seq/seq_memory.h -+++ b/sound/core/seq/seq_memory.h -@@ -84,6 +84,7 @@ static inline int snd_seq_total_cells(struct snd_seq_pool *pool) - int snd_seq_pool_init(struct snd_seq_pool *pool); - - /* done pool - free events */ -+void snd_seq_pool_mark_closing(struct snd_seq_pool *pool); - int snd_seq_pool_done(struct snd_seq_pool *pool); - - /* create pool */ -diff --git a/sound/pci/ctxfi/cthw20k1.c b/sound/pci/ctxfi/cthw20k1.c -index ab4cdab5cfa5..79edd88d5cd0 100644 ---- a/sound/pci/ctxfi/cthw20k1.c -+++ b/sound/pci/ctxfi/cthw20k1.c -@@ -1905,7 +1905,7 @@ static int hw_card_start(struct hw *hw) - return err; - - /* Set DMA transfer mask */ -- if (dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { -+ if (!dma_set_mask(&pci->dev, DMA_BIT_MASK(dma_bits))) { - dma_set_coherent_mask(&pci->dev, DMA_BIT_MASK(dma_bits)); - } else { - dma_set_mask(&pci->dev, DMA_BIT_MASK(32)); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index cf0785ddbd14..1d4f34379f56 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -6040,6 +6040,8 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - ALC295_STANDARD_PINS, - {0x17, 0x21014040}, - {0x18, 0x21a19050}), -+ SND_HDA_PIN_QUIRK(0x10ec0295, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, -+ ALC295_STANDARD_PINS), - SND_HDA_PIN_QUIRK(0x10ec0298, 0x1028, "Dell", ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC298_STANDARD_PINS, - {0x17, 0x90170110}), diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.58-59.patch b/patch/kernel/mvebu64-default/03-patch-4.4.58-59.patch deleted file mode 100644 index 49788f7d8686..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.58-59.patch +++ /dev/null @@ -1,548 +0,0 @@ -diff --git a/Makefile b/Makefile -index 3efe2ea99e2d..083724c6ca4d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 58 -+SUBLEVEL = 59 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/c6x/kernel/ptrace.c b/arch/c6x/kernel/ptrace.c -index 3c494e84444d..a511ac16a8e3 100644 ---- a/arch/c6x/kernel/ptrace.c -+++ b/arch/c6x/kernel/ptrace.c -@@ -69,46 +69,6 @@ static int gpr_get(struct task_struct *target, - 0, sizeof(*regs)); - } - --static int gpr_set(struct task_struct *target, -- const struct user_regset *regset, -- unsigned int pos, unsigned int count, -- const void *kbuf, const void __user *ubuf) --{ -- int ret; -- struct pt_regs *regs = task_pt_regs(target); -- -- /* Don't copyin TSR or CSR */ -- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- ®s, -- 0, PT_TSR * sizeof(long)); -- if (ret) -- return ret; -- -- ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, -- PT_TSR * sizeof(long), -- (PT_TSR + 1) * sizeof(long)); -- if (ret) -- return ret; -- -- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- ®s, -- (PT_TSR + 1) * sizeof(long), -- PT_CSR * sizeof(long)); -- if (ret) -- return ret; -- -- ret = user_regset_copyin_ignore(&pos, &count, &kbuf, &ubuf, -- PT_CSR * sizeof(long), -- (PT_CSR + 1) * sizeof(long)); -- if (ret) -- return ret; -- -- ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- ®s, -- (PT_CSR + 1) * sizeof(long), -1); -- return ret; --} -- - enum c6x_regset { - REGSET_GPR, - }; -@@ -120,7 +80,6 @@ static const struct user_regset c6x_regsets[] = { - .size = sizeof(u32), - .align = sizeof(u32), - .get = gpr_get, -- .set = gpr_set - }, - }; - -diff --git a/arch/h8300/kernel/ptrace.c b/arch/h8300/kernel/ptrace.c -index 92075544a19a..0dc1c8f622bc 100644 ---- a/arch/h8300/kernel/ptrace.c -+++ b/arch/h8300/kernel/ptrace.c -@@ -95,7 +95,8 @@ static int regs_get(struct task_struct *target, - long *reg = (long *)®s; - - /* build user regs in buffer */ -- for (r = 0; r < ARRAY_SIZE(register_offset); r++) -+ BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0); -+ for (r = 0; r < sizeof(regs) / sizeof(long); r++) - *reg++ = h8300_get_reg(target, r); - - return user_regset_copyout(&pos, &count, &kbuf, &ubuf, -@@ -113,7 +114,8 @@ static int regs_set(struct task_struct *target, - long *reg; - - /* build user regs in buffer */ -- for (reg = (long *)®s, r = 0; r < ARRAY_SIZE(register_offset); r++) -+ BUILD_BUG_ON(sizeof(regs) % sizeof(long) != 0); -+ for (reg = (long *)®s, r = 0; r < sizeof(regs) / sizeof(long); r++) - *reg++ = h8300_get_reg(target, r); - - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -@@ -122,7 +124,7 @@ static int regs_set(struct task_struct *target, - return ret; - - /* write back to pt_regs */ -- for (reg = (long *)®s, r = 0; r < ARRAY_SIZE(register_offset); r++) -+ for (reg = (long *)®s, r = 0; r < sizeof(regs) / sizeof(long); r++) - h8300_put_reg(target, r, *reg++); - return 0; - } -diff --git a/arch/metag/kernel/ptrace.c b/arch/metag/kernel/ptrace.c -index 7563628822bd..5e2dc7defd2c 100644 ---- a/arch/metag/kernel/ptrace.c -+++ b/arch/metag/kernel/ptrace.c -@@ -24,6 +24,16 @@ - * user_regset definitions. - */ - -+static unsigned long user_txstatus(const struct pt_regs *regs) -+{ -+ unsigned long data = (unsigned long)regs->ctx.Flags; -+ -+ if (regs->ctx.SaveMask & TBICTX_CBUF_BIT) -+ data |= USER_GP_REGS_STATUS_CATCH_BIT; -+ -+ return data; -+} -+ - int metag_gp_regs_copyout(const struct pt_regs *regs, - unsigned int pos, unsigned int count, - void *kbuf, void __user *ubuf) -@@ -62,9 +72,7 @@ int metag_gp_regs_copyout(const struct pt_regs *regs, - if (ret) - goto out; - /* TXSTATUS */ -- data = (unsigned long)regs->ctx.Flags; -- if (regs->ctx.SaveMask & TBICTX_CBUF_BIT) -- data |= USER_GP_REGS_STATUS_CATCH_BIT; -+ data = user_txstatus(regs); - ret = user_regset_copyout(&pos, &count, &kbuf, &ubuf, - &data, 4*25, 4*26); - if (ret) -@@ -119,6 +127,7 @@ int metag_gp_regs_copyin(struct pt_regs *regs, - if (ret) - goto out; - /* TXSTATUS */ -+ data = user_txstatus(regs); - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &data, 4*25, 4*26); - if (ret) -@@ -244,6 +253,8 @@ int metag_rp_state_copyin(struct pt_regs *regs, - unsigned long long *ptr; - int ret, i; - -+ if (count < 4*13) -+ return -EINVAL; - /* Read the entire pipeline before making any changes */ - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &rp, 0, 4*13); -@@ -303,7 +314,7 @@ static int metag_tls_set(struct task_struct *target, - const void *kbuf, const void __user *ubuf) - { - int ret; -- void __user *tls; -+ void __user *tls = target->thread.tls_ptr; - - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, &tls, 0, -1); - if (ret) -diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c -index 74d581569778..c95bf18260f8 100644 ---- a/arch/mips/kernel/ptrace.c -+++ b/arch/mips/kernel/ptrace.c -@@ -485,7 +485,8 @@ static int fpr_set(struct task_struct *target, - &target->thread.fpu, - 0, sizeof(elf_fpregset_t)); - -- for (i = 0; i < NUM_FPU_REGS; i++) { -+ BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); -+ for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) { - err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &fpr_val, i * sizeof(elf_fpreg_t), - (i + 1) * sizeof(elf_fpreg_t)); -diff --git a/arch/sparc/kernel/ptrace_64.c b/arch/sparc/kernel/ptrace_64.c -index 9ddc4928a089..c1566170964f 100644 ---- a/arch/sparc/kernel/ptrace_64.c -+++ b/arch/sparc/kernel/ptrace_64.c -@@ -311,7 +311,7 @@ static int genregs64_set(struct task_struct *target, - } - - if (!ret) { -- unsigned long y; -+ unsigned long y = regs->y; - - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &y, -diff --git a/drivers/pinctrl/qcom/pinctrl-msm.c b/drivers/pinctrl/qcom/pinctrl-msm.c -index 146264a41ec8..9736f9be5447 100644 ---- a/drivers/pinctrl/qcom/pinctrl-msm.c -+++ b/drivers/pinctrl/qcom/pinctrl-msm.c -@@ -597,10 +597,6 @@ static void msm_gpio_irq_unmask(struct irq_data *d) - - spin_lock_irqsave(&pctrl->lock, flags); - -- val = readl(pctrl->regs + g->intr_status_reg); -- val &= ~BIT(g->intr_status_bit); -- writel(val, pctrl->regs + g->intr_status_reg); -- - val = readl(pctrl->regs + g->intr_cfg_reg); - val |= BIT(g->intr_enable_bit); - writel(val, pctrl->regs + g->intr_cfg_reg); -diff --git a/drivers/virtio/virtio_balloon.c b/drivers/virtio/virtio_balloon.c -index 56f7e2521202..01d15dca940e 100644 ---- a/drivers/virtio/virtio_balloon.c -+++ b/drivers/virtio/virtio_balloon.c -@@ -416,6 +416,8 @@ static int init_vqs(struct virtio_balloon *vb) - * Prime this virtqueue with one buffer so the hypervisor can - * use it to signal us later (it can't be broken yet!). - */ -+ update_balloon_stats(vb); -+ - sg_init_one(&sg, vb->stats, sizeof vb->stats); - if (virtqueue_add_outbuf(vb->stats_vq, &sg, 1, vb, GFP_KERNEL) - < 0) -diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c -index 9a16d1e75a49..505f8afde57c 100644 ---- a/fs/ext4/crypto_key.c -+++ b/fs/ext4/crypto_key.c -@@ -88,8 +88,6 @@ void ext4_free_crypt_info(struct ext4_crypt_info *ci) - if (!ci) - return; - -- if (ci->ci_keyring_key) -- key_put(ci->ci_keyring_key); - crypto_free_ablkcipher(ci->ci_ctfm); - kmem_cache_free(ext4_crypt_info_cachep, ci); - } -@@ -111,7 +109,7 @@ void ext4_free_encryption_info(struct inode *inode, - ext4_free_crypt_info(ci); - } - --int _ext4_get_encryption_info(struct inode *inode) -+int ext4_get_encryption_info(struct inode *inode) - { - struct ext4_inode_info *ei = EXT4_I(inode); - struct ext4_crypt_info *crypt_info; -@@ -128,22 +126,15 @@ int _ext4_get_encryption_info(struct inode *inode) - char mode; - int res; - -+ if (ei->i_crypt_info) -+ return 0; -+ - if (!ext4_read_workqueue) { - res = ext4_init_crypto(); - if (res) - return res; - } - --retry: -- crypt_info = ACCESS_ONCE(ei->i_crypt_info); -- if (crypt_info) { -- if (!crypt_info->ci_keyring_key || -- key_validate(crypt_info->ci_keyring_key) == 0) -- return 0; -- ext4_free_encryption_info(inode, crypt_info); -- goto retry; -- } -- - res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION, - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, - &ctx, sizeof(ctx)); -@@ -166,7 +157,6 @@ retry: - crypt_info->ci_data_mode = ctx.contents_encryption_mode; - crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; - crypt_info->ci_ctfm = NULL; -- crypt_info->ci_keyring_key = NULL; - memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, - sizeof(crypt_info->ci_master_key)); - if (S_ISREG(inode->i_mode)) -@@ -206,7 +196,6 @@ retry: - keyring_key = NULL; - goto out; - } -- crypt_info->ci_keyring_key = keyring_key; - if (keyring_key->type != &key_type_logon) { - printk_once(KERN_WARNING - "ext4: key type must be logon\n"); -@@ -253,16 +242,13 @@ got_key: - ext4_encryption_key_size(mode)); - if (res) - goto out; -- memzero_explicit(raw_key, sizeof(raw_key)); -- if (cmpxchg(&ei->i_crypt_info, NULL, crypt_info) != NULL) { -- ext4_free_crypt_info(crypt_info); -- goto retry; -- } -- return 0; - -+ if (cmpxchg(&ei->i_crypt_info, NULL, crypt_info) == NULL) -+ crypt_info = NULL; - out: - if (res == -ENOKEY) - res = 0; -+ key_put(keyring_key); - ext4_free_crypt_info(crypt_info); - memzero_explicit(raw_key, sizeof(raw_key)); - return res; -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index cd5914495ad7..362d59b24f1d 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2330,23 +2330,11 @@ static inline void ext4_fname_free_filename(struct ext4_filename *fname) { } - /* crypto_key.c */ - void ext4_free_crypt_info(struct ext4_crypt_info *ci); - void ext4_free_encryption_info(struct inode *inode, struct ext4_crypt_info *ci); --int _ext4_get_encryption_info(struct inode *inode); - - #ifdef CONFIG_EXT4_FS_ENCRYPTION - int ext4_has_encryption_key(struct inode *inode); - --static inline int ext4_get_encryption_info(struct inode *inode) --{ -- struct ext4_crypt_info *ci = EXT4_I(inode)->i_crypt_info; -- -- if (!ci || -- (ci->ci_keyring_key && -- (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | -- (1 << KEY_FLAG_REVOKED) | -- (1 << KEY_FLAG_DEAD))))) -- return _ext4_get_encryption_info(inode); -- return 0; --} -+int ext4_get_encryption_info(struct inode *inode); - - static inline struct ext4_crypt_info *ext4_encryption_info(struct inode *inode) - { -diff --git a/fs/ext4/ext4_crypto.h b/fs/ext4/ext4_crypto.h -index ac7d4e813796..1b17b05b9f4d 100644 ---- a/fs/ext4/ext4_crypto.h -+++ b/fs/ext4/ext4_crypto.h -@@ -78,7 +78,6 @@ struct ext4_crypt_info { - char ci_filename_mode; - char ci_flags; - struct crypto_ablkcipher *ci_ctfm; -- struct key *ci_keyring_key; - char ci_master_key[EXT4_KEY_DESCRIPTOR_SIZE]; - }; - -diff --git a/fs/f2fs/crypto_key.c b/fs/f2fs/crypto_key.c -index 5de2d866a25c..18595d7a0efc 100644 ---- a/fs/f2fs/crypto_key.c -+++ b/fs/f2fs/crypto_key.c -@@ -92,7 +92,6 @@ static void f2fs_free_crypt_info(struct f2fs_crypt_info *ci) - if (!ci) - return; - -- key_put(ci->ci_keyring_key); - crypto_free_ablkcipher(ci->ci_ctfm); - kmem_cache_free(f2fs_crypt_info_cachep, ci); - } -@@ -113,7 +112,7 @@ void f2fs_free_encryption_info(struct inode *inode, struct f2fs_crypt_info *ci) - f2fs_free_crypt_info(ci); - } - --int _f2fs_get_encryption_info(struct inode *inode) -+int f2fs_get_encryption_info(struct inode *inode) - { - struct f2fs_inode_info *fi = F2FS_I(inode); - struct f2fs_crypt_info *crypt_info; -@@ -129,18 +128,12 @@ int _f2fs_get_encryption_info(struct inode *inode) - char mode; - int res; - -+ if (fi->i_crypt_info) -+ return 0; -+ - res = f2fs_crypto_initialize(); - if (res) - return res; --retry: -- crypt_info = ACCESS_ONCE(fi->i_crypt_info); -- if (crypt_info) { -- if (!crypt_info->ci_keyring_key || -- key_validate(crypt_info->ci_keyring_key) == 0) -- return 0; -- f2fs_free_encryption_info(inode, crypt_info); -- goto retry; -- } - - res = f2fs_getxattr(inode, F2FS_XATTR_INDEX_ENCRYPTION, - F2FS_XATTR_NAME_ENCRYPTION_CONTEXT, -@@ -159,7 +152,6 @@ retry: - crypt_info->ci_data_mode = ctx.contents_encryption_mode; - crypt_info->ci_filename_mode = ctx.filenames_encryption_mode; - crypt_info->ci_ctfm = NULL; -- crypt_info->ci_keyring_key = NULL; - memcpy(crypt_info->ci_master_key, ctx.master_key_descriptor, - sizeof(crypt_info->ci_master_key)); - if (S_ISREG(inode->i_mode)) -@@ -197,7 +189,6 @@ retry: - keyring_key = NULL; - goto out; - } -- crypt_info->ci_keyring_key = keyring_key; - BUG_ON(keyring_key->type != &key_type_logon); - ukp = user_key_payload(keyring_key); - if (ukp->datalen != sizeof(struct f2fs_encryption_key)) { -@@ -230,17 +221,12 @@ retry: - if (res) - goto out; - -- memzero_explicit(raw_key, sizeof(raw_key)); -- if (cmpxchg(&fi->i_crypt_info, NULL, crypt_info) != NULL) { -- f2fs_free_crypt_info(crypt_info); -- goto retry; -- } -- return 0; -- -+ if (cmpxchg(&fi->i_crypt_info, NULL, crypt_info) == NULL) -+ crypt_info = NULL; - out: - if (res == -ENOKEY && !S_ISREG(inode->i_mode)) - res = 0; -- -+ key_put(keyring_key); - f2fs_free_crypt_info(crypt_info); - memzero_explicit(raw_key, sizeof(raw_key)); - return res; -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index 9db5500d63d9..b1aeca83f4be 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -2149,7 +2149,6 @@ void f2fs_end_io_crypto_work(struct f2fs_crypto_ctx *, struct bio *); - - /* crypto_key.c */ - void f2fs_free_encryption_info(struct inode *, struct f2fs_crypt_info *); --int _f2fs_get_encryption_info(struct inode *inode); - - /* crypto_fname.c */ - bool f2fs_valid_filenames_enc_mode(uint32_t); -@@ -2170,18 +2169,7 @@ void f2fs_exit_crypto(void); - - int f2fs_has_encryption_key(struct inode *); - --static inline int f2fs_get_encryption_info(struct inode *inode) --{ -- struct f2fs_crypt_info *ci = F2FS_I(inode)->i_crypt_info; -- -- if (!ci || -- (ci->ci_keyring_key && -- (ci->ci_keyring_key->flags & ((1 << KEY_FLAG_INVALIDATED) | -- (1 << KEY_FLAG_REVOKED) | -- (1 << KEY_FLAG_DEAD))))) -- return _f2fs_get_encryption_info(inode); -- return 0; --} -+int f2fs_get_encryption_info(struct inode *inode); - - void f2fs_fname_crypto_free_buffer(struct f2fs_str *); - int f2fs_fname_setup_filename(struct inode *, const struct qstr *, -diff --git a/fs/f2fs/f2fs_crypto.h b/fs/f2fs/f2fs_crypto.h -index c2c1c2b63b25..f113f1a1e8c1 100644 ---- a/fs/f2fs/f2fs_crypto.h -+++ b/fs/f2fs/f2fs_crypto.h -@@ -79,7 +79,6 @@ struct f2fs_crypt_info { - char ci_filename_mode; - char ci_flags; - struct crypto_ablkcipher *ci_ctfm; -- struct key *ci_keyring_key; - char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE]; - }; - -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 8b0a15e285f9..e984f059e5fc 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -1771,12 +1771,11 @@ static void switched_to_dl(struct rq *rq, struct task_struct *p) - #ifdef CONFIG_SMP - if (p->nr_cpus_allowed > 1 && rq->dl.overloaded) - queue_push_tasks(rq); --#else -+#endif - if (dl_task(rq->curr)) - check_preempt_curr_dl(rq, p, 0); - else - resched_curr(rq); --#endif - } - } - -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 8ec86abe0ea1..78ae5c1d9412 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -2136,10 +2136,9 @@ static void switched_to_rt(struct rq *rq, struct task_struct *p) - #ifdef CONFIG_SMP - if (p->nr_cpus_allowed > 1 && rq->rt.overloaded) - queue_push_tasks(rq); --#else -+#endif /* CONFIG_SMP */ - if (p->prio < rq->curr->prio) - resched_curr(rq); --#endif /* CONFIG_SMP */ - } - } - -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index b5e665b3cfb0..36a50ef9295d 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -3030,6 +3030,11 @@ static int __net_init xfrm_net_init(struct net *net) - { - int rv; - -+ /* Initialize the per-net locks here */ -+ spin_lock_init(&net->xfrm.xfrm_state_lock); -+ rwlock_init(&net->xfrm.xfrm_policy_lock); -+ mutex_init(&net->xfrm.xfrm_cfg_mutex); -+ - rv = xfrm_statistics_init(net); - if (rv < 0) - goto out_statistics; -@@ -3046,11 +3051,6 @@ static int __net_init xfrm_net_init(struct net *net) - if (rv < 0) - goto out; - -- /* Initialize the per-net locks here */ -- spin_lock_init(&net->xfrm.xfrm_state_lock); -- rwlock_init(&net->xfrm.xfrm_policy_lock); -- mutex_init(&net->xfrm.xfrm_cfg_mutex); -- - return 0; - - out: -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 805681a7d356..7a5a64e70b4d 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es - up = nla_data(rp); - ulen = xfrm_replay_state_esn_len(up); - -- if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) -+ /* Check the overall length and the internal bitmap length to avoid -+ * potential overflow. */ -+ if (nla_len(rp) < ulen || -+ xfrm_replay_state_esn_len(replay_esn) != ulen || -+ replay_esn->bmp_len != up->bmp_len) -+ return -EINVAL; -+ -+ if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) - return -EINVAL; - - return 0; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.59-60.patch b/patch/kernel/mvebu64-default/03-patch-4.4.59-60.patch deleted file mode 100644 index ad96b856cbab..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.59-60.patch +++ /dev/null @@ -1,1175 +0,0 @@ -diff --git a/Makefile b/Makefile -index 083724c6ca4d..fb7c2b40753d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 59 -+SUBLEVEL = 60 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c -index 2e7f60c9fc5d..51cdc46a87e2 100644 ---- a/arch/mips/lantiq/irq.c -+++ b/arch/mips/lantiq/irq.c -@@ -269,6 +269,11 @@ static void ltq_hw5_irqdispatch(void) - DEFINE_HWx_IRQDISPATCH(5) - #endif - -+static void ltq_hw_irq_handler(struct irq_desc *desc) -+{ -+ ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2); -+} -+ - #ifdef CONFIG_MIPS_MT_SMP - void __init arch_init_ipiirq(int irq, struct irqaction *action) - { -@@ -313,23 +318,19 @@ static struct irqaction irq_call = { - asmlinkage void plat_irq_dispatch(void) - { - unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM; -- unsigned int i; -- -- if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) { -- do_IRQ(MIPS_CPU_TIMER_IRQ); -- goto out; -- } else { -- for (i = 0; i < MAX_IM; i++) { -- if (pending & (CAUSEF_IP2 << i)) { -- ltq_hw_irqdispatch(i); -- goto out; -- } -- } -+ int irq; -+ -+ if (!pending) { -+ spurious_interrupt(); -+ return; - } -- pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status()); - --out: -- return; -+ pending >>= CAUSEB_IP; -+ while (pending) { -+ irq = fls(pending) - 1; -+ do_IRQ(MIPS_CPU_IRQ_BASE + irq); -+ pending &= ~BIT(irq); -+ } - } - - static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw) -@@ -354,11 +355,6 @@ static const struct irq_domain_ops irq_domain_ops = { - .map = icu_map, - }; - --static struct irqaction cascade = { -- .handler = no_action, -- .name = "cascade", --}; -- - int __init icu_of_init(struct device_node *node, struct device_node *parent) - { - struct device_node *eiu_node; -@@ -390,7 +386,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent) - mips_cpu_irq_init(); - - for (i = 0; i < MAX_IM; i++) -- setup_irq(i + 2, &cascade); -+ irq_set_chained_handler(i + 2, ltq_hw_irq_handler); - - if (cpu_has_vint) { - pr_info("Setting up vectored interrupts\n"); -diff --git a/arch/x86/xen/setup.c b/arch/x86/xen/setup.c -index e345891450c3..df8844a1853a 100644 ---- a/arch/x86/xen/setup.c -+++ b/arch/x86/xen/setup.c -@@ -713,10 +713,9 @@ static void __init xen_reserve_xen_mfnlist(void) - size = PFN_PHYS(xen_start_info->nr_p2m_frames); - } - -- if (!xen_is_e820_reserved(start, size)) { -- memblock_reserve(start, size); -+ memblock_reserve(start, size); -+ if (!xen_is_e820_reserved(start, size)) - return; -- } - - #ifdef CONFIG_X86_32 - /* -@@ -727,6 +726,7 @@ static void __init xen_reserve_xen_mfnlist(void) - BUG(); - #else - xen_relocate_p2m(); -+ memblock_free(start, size); - #endif - } - -diff --git a/block/bio.c b/block/bio.c -index 46e2cc1d4016..14263fab94d3 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -373,10 +373,14 @@ static void punt_bios_to_rescuer(struct bio_set *bs) - bio_list_init(&punt); - bio_list_init(&nopunt); - -- while ((bio = bio_list_pop(current->bio_list))) -+ while ((bio = bio_list_pop(¤t->bio_list[0]))) - bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio); -+ current->bio_list[0] = nopunt; - -- *current->bio_list = nopunt; -+ bio_list_init(&nopunt); -+ while ((bio = bio_list_pop(¤t->bio_list[1]))) -+ bio_list_add(bio->bi_pool == bs ? &punt : &nopunt, bio); -+ current->bio_list[1] = nopunt; - - spin_lock(&bs->rescue_lock); - bio_list_merge(&bs->rescue_list, &punt); -@@ -464,7 +468,9 @@ struct bio *bio_alloc_bioset(gfp_t gfp_mask, int nr_iovecs, struct bio_set *bs) - * we retry with the original gfp_flags. - */ - -- if (current->bio_list && !bio_list_empty(current->bio_list)) -+ if (current->bio_list && -+ (!bio_list_empty(¤t->bio_list[0]) || -+ !bio_list_empty(¤t->bio_list[1]))) - gfp_mask &= ~__GFP_DIRECT_RECLAIM; - - p = mempool_alloc(bs->bio_pool, gfp_mask); -diff --git a/block/blk-core.c b/block/blk-core.c -index 4fab5d610805..ef083e7a37c5 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -2021,7 +2021,14 @@ end_io: - */ - blk_qc_t generic_make_request(struct bio *bio) - { -- struct bio_list bio_list_on_stack; -+ /* -+ * bio_list_on_stack[0] contains bios submitted by the current -+ * make_request_fn. -+ * bio_list_on_stack[1] contains bios that were submitted before -+ * the current make_request_fn, but that haven't been processed -+ * yet. -+ */ -+ struct bio_list bio_list_on_stack[2]; - blk_qc_t ret = BLK_QC_T_NONE; - - if (!generic_make_request_checks(bio)) -@@ -2038,7 +2045,7 @@ blk_qc_t generic_make_request(struct bio *bio) - * should be added at the tail - */ - if (current->bio_list) { -- bio_list_add(current->bio_list, bio); -+ bio_list_add(¤t->bio_list[0], bio); - goto out; - } - -@@ -2057,24 +2064,39 @@ blk_qc_t generic_make_request(struct bio *bio) - * bio_list, and call into ->make_request() again. - */ - BUG_ON(bio->bi_next); -- bio_list_init(&bio_list_on_stack); -- current->bio_list = &bio_list_on_stack; -+ bio_list_init(&bio_list_on_stack[0]); -+ current->bio_list = bio_list_on_stack; - do { - struct request_queue *q = bdev_get_queue(bio->bi_bdev); - - if (likely(blk_queue_enter(q, __GFP_DIRECT_RECLAIM) == 0)) { -+ struct bio_list lower, same; -+ -+ /* Create a fresh bio_list for all subordinate requests */ -+ bio_list_on_stack[1] = bio_list_on_stack[0]; -+ bio_list_init(&bio_list_on_stack[0]); - - ret = q->make_request_fn(q, bio); - - blk_queue_exit(q); -- -- bio = bio_list_pop(current->bio_list); -+ /* sort new bios into those for a lower level -+ * and those for the same level -+ */ -+ bio_list_init(&lower); -+ bio_list_init(&same); -+ while ((bio = bio_list_pop(&bio_list_on_stack[0])) != NULL) -+ if (q == bdev_get_queue(bio->bi_bdev)) -+ bio_list_add(&same, bio); -+ else -+ bio_list_add(&lower, bio); -+ /* now assemble so we handle the lowest level first */ -+ bio_list_merge(&bio_list_on_stack[0], &lower); -+ bio_list_merge(&bio_list_on_stack[0], &same); -+ bio_list_merge(&bio_list_on_stack[0], &bio_list_on_stack[1]); - } else { -- struct bio *bio_next = bio_list_pop(current->bio_list); -- - bio_io_error(bio); -- bio = bio_next; - } -+ bio = bio_list_pop(&bio_list_on_stack[0]); - } while (bio); - current->bio_list = NULL; /* deactivate */ - -diff --git a/drivers/acpi/Makefile b/drivers/acpi/Makefile -index 675eaf337178..b9cebca376f9 100644 ---- a/drivers/acpi/Makefile -+++ b/drivers/acpi/Makefile -@@ -2,7 +2,6 @@ - # Makefile for the Linux ACPI interpreter - # - --ccflags-y := -Os - ccflags-$(CONFIG_ACPI_DEBUG) += -DACPI_DEBUG_OUTPUT - - # -diff --git a/drivers/acpi/acpi_platform.c b/drivers/acpi/acpi_platform.c -index 296b7a14893a..5365ff6e69c1 100644 ---- a/drivers/acpi/acpi_platform.c -+++ b/drivers/acpi/acpi_platform.c -@@ -24,9 +24,11 @@ - ACPI_MODULE_NAME("platform"); - - static const struct acpi_device_id forbidden_id_list[] = { -- {"PNP0000", 0}, /* PIC */ -- {"PNP0100", 0}, /* Timer */ -- {"PNP0200", 0}, /* AT DMA Controller */ -+ {"PNP0000", 0}, /* PIC */ -+ {"PNP0100", 0}, /* Timer */ -+ {"PNP0200", 0}, /* AT DMA Controller */ -+ {"ACPI0009", 0}, /* IOxAPIC */ -+ {"ACPI000A", 0}, /* IOAPIC */ - {"", 0}, - }; - -diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c -index 35310336dd0a..d684e2b79d2b 100644 ---- a/drivers/gpu/drm/radeon/radeon_ttm.c -+++ b/drivers/gpu/drm/radeon/radeon_ttm.c -@@ -213,8 +213,8 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo, - rbo->placement.num_busy_placement = 0; - for (i = 0; i < rbo->placement.num_placement; i++) { - if (rbo->placements[i].flags & TTM_PL_FLAG_VRAM) { -- if (rbo->placements[0].fpfn < fpfn) -- rbo->placements[0].fpfn = fpfn; -+ if (rbo->placements[i].fpfn < fpfn) -+ rbo->placements[i].fpfn = fpfn; - } else { - rbo->placement.busy_placement = - &rbo->placements[i]; -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 397f0454100b..320eb3c4bb6b 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -1481,26 +1481,29 @@ static void flush_current_bio_list(struct blk_plug_cb *cb, bool from_schedule) - struct dm_offload *o = container_of(cb, struct dm_offload, cb); - struct bio_list list; - struct bio *bio; -+ int i; - - INIT_LIST_HEAD(&o->cb.list); - - if (unlikely(!current->bio_list)) - return; - -- list = *current->bio_list; -- bio_list_init(current->bio_list); -- -- while ((bio = bio_list_pop(&list))) { -- struct bio_set *bs = bio->bi_pool; -- if (unlikely(!bs) || bs == fs_bio_set) { -- bio_list_add(current->bio_list, bio); -- continue; -+ for (i = 0; i < 2; i++) { -+ list = current->bio_list[i]; -+ bio_list_init(¤t->bio_list[i]); -+ -+ while ((bio = bio_list_pop(&list))) { -+ struct bio_set *bs = bio->bi_pool; -+ if (unlikely(!bs) || bs == fs_bio_set) { -+ bio_list_add(¤t->bio_list[i], bio); -+ continue; -+ } -+ -+ spin_lock(&bs->rescue_lock); -+ bio_list_add(&bs->rescue_list, bio); -+ queue_work(bs->rescue_workqueue, &bs->rescue_work); -+ spin_unlock(&bs->rescue_lock); - } -- -- spin_lock(&bs->rescue_lock); -- bio_list_add(&bs->rescue_list, bio); -- queue_work(bs->rescue_workqueue, &bs->rescue_work); -- spin_unlock(&bs->rescue_lock); - } - } - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 515554c7365b..9be39988bf06 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -877,7 +877,8 @@ static sector_t wait_barrier(struct r1conf *conf, struct bio *bio) - ((conf->start_next_window < - conf->next_resync + RESYNC_SECTORS) && - current->bio_list && -- !bio_list_empty(current->bio_list))), -+ (!bio_list_empty(¤t->bio_list[0]) || -+ !bio_list_empty(¤t->bio_list[1])))), - conf->resync_lock); - conf->nr_waiting--; - } -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index a92979e704e3..e5ee4e9e0ea5 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -946,7 +946,8 @@ static void wait_barrier(struct r10conf *conf) - !conf->barrier || - (conf->nr_pending && - current->bio_list && -- !bio_list_empty(current->bio_list)), -+ (!bio_list_empty(¤t->bio_list[0]) || -+ !bio_list_empty(¤t->bio_list[1]))), - conf->resync_lock); - conf->nr_waiting--; - } -diff --git a/drivers/power/reset/at91-poweroff.c b/drivers/power/reset/at91-poweroff.c -index e9e24df35f26..2579f025b90b 100644 ---- a/drivers/power/reset/at91-poweroff.c -+++ b/drivers/power/reset/at91-poweroff.c -@@ -14,9 +14,12 @@ - #include - #include - #include -+#include - #include - #include - -+#include -+ - #define AT91_SHDW_CR 0x00 /* Shut Down Control Register */ - #define AT91_SHDW_SHDW BIT(0) /* Shut Down command */ - #define AT91_SHDW_KEY (0xa5 << 24) /* KEY Password */ -@@ -50,6 +53,7 @@ static const char *shdwc_wakeup_modes[] = { - - static void __iomem *at91_shdwc_base; - static struct clk *sclk; -+static void __iomem *mpddrc_base; - - static void __init at91_wakeup_status(void) - { -@@ -73,6 +77,29 @@ static void at91_poweroff(void) - writel(AT91_SHDW_KEY | AT91_SHDW_SHDW, at91_shdwc_base + AT91_SHDW_CR); - } - -+static void at91_lpddr_poweroff(void) -+{ -+ asm volatile( -+ /* Align to cache lines */ -+ ".balign 32\n\t" -+ -+ /* Ensure AT91_SHDW_CR is in the TLB by reading it */ -+ " ldr r6, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ /* Power down SDRAM0 */ -+ " str %1, [%0, #" __stringify(AT91_DDRSDRC_LPR) "]\n\t" -+ /* Shutdown CPU */ -+ " str %3, [%2, #" __stringify(AT91_SHDW_CR) "]\n\t" -+ -+ " b .\n\t" -+ : -+ : "r" (mpddrc_base), -+ "r" cpu_to_le32(AT91_DDRSDRC_LPDDR2_PWOFF), -+ "r" (at91_shdwc_base), -+ "r" cpu_to_le32(AT91_SHDW_KEY | AT91_SHDW_SHDW) -+ : "r0"); -+} -+ - static int at91_poweroff_get_wakeup_mode(struct device_node *np) - { - const char *pm; -@@ -124,6 +151,8 @@ static void at91_poweroff_dt_set_wakeup_mode(struct platform_device *pdev) - static int __init at91_poweroff_probe(struct platform_device *pdev) - { - struct resource *res; -+ struct device_node *np; -+ u32 ddr_type; - int ret; - - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); -@@ -150,12 +179,30 @@ static int __init at91_poweroff_probe(struct platform_device *pdev) - - pm_power_off = at91_poweroff; - -+ np = of_find_compatible_node(NULL, NULL, "atmel,sama5d3-ddramc"); -+ if (!np) -+ return 0; -+ -+ mpddrc_base = of_iomap(np, 0); -+ of_node_put(np); -+ -+ if (!mpddrc_base) -+ return 0; -+ -+ ddr_type = readl(mpddrc_base + AT91_DDRSDRC_MDR) & AT91_DDRSDRC_MD; -+ if ((ddr_type == AT91_DDRSDRC_MD_LPDDR2) || -+ (ddr_type == AT91_DDRSDRC_MD_LPDDR3)) -+ pm_power_off = at91_lpddr_poweroff; -+ else -+ iounmap(mpddrc_base); -+ - return 0; - } - - static int __exit at91_poweroff_remove(struct platform_device *pdev) - { -- if (pm_power_off == at91_poweroff) -+ if (pm_power_off == at91_poweroff || -+ pm_power_off == at91_lpddr_poweroff) - pm_power_off = NULL; - - clk_disable_unprepare(sclk); -@@ -163,6 +210,11 @@ static int __exit at91_poweroff_remove(struct platform_device *pdev) - return 0; - } - -+static const struct of_device_id at91_ramc_of_match[] = { -+ { .compatible = "atmel,sama5d3-ddramc", }, -+ { /* sentinel */ } -+}; -+ - static const struct of_device_id at91_poweroff_of_match[] = { - { .compatible = "atmel,at91sam9260-shdwc", }, - { .compatible = "atmel,at91sam9rl-shdwc", }, -diff --git a/drivers/rtc/rtc-s35390a.c b/drivers/rtc/rtc-s35390a.c -index f40afdd0e5f5..00662dd28d66 100644 ---- a/drivers/rtc/rtc-s35390a.c -+++ b/drivers/rtc/rtc-s35390a.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - - #define S35390A_CMD_STATUS1 0 - #define S35390A_CMD_STATUS2 1 -@@ -34,10 +35,14 @@ - #define S35390A_ALRM_BYTE_HOURS 1 - #define S35390A_ALRM_BYTE_MINS 2 - -+/* flags for STATUS1 */ - #define S35390A_FLAG_POC 0x01 - #define S35390A_FLAG_BLD 0x02 -+#define S35390A_FLAG_INT2 0x04 - #define S35390A_FLAG_24H 0x40 - #define S35390A_FLAG_RESET 0x80 -+ -+/* flag for STATUS2 */ - #define S35390A_FLAG_TEST 0x01 - - #define S35390A_INT2_MODE_MASK 0xF0 -@@ -94,19 +99,63 @@ static int s35390a_get_reg(struct s35390a *s35390a, int reg, char *buf, int len) - return 0; - } - --static int s35390a_reset(struct s35390a *s35390a) -+/* -+ * Returns <0 on error, 0 if rtc is setup fine and 1 if the chip was reset. -+ * To keep the information if an irq is pending, pass the value read from -+ * STATUS1 to the caller. -+ */ -+static int s35390a_reset(struct s35390a *s35390a, char *status1) - { -- char buf[1]; -- -- if (s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)) < 0) -- return -EIO; -- -- if (!(buf[0] & (S35390A_FLAG_POC | S35390A_FLAG_BLD))) -+ char buf; -+ int ret; -+ unsigned initcount = 0; -+ -+ ret = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, status1, 1); -+ if (ret < 0) -+ return ret; -+ -+ if (*status1 & S35390A_FLAG_POC) -+ /* -+ * Do not communicate for 0.5 seconds since the power-on -+ * detection circuit is in operation. -+ */ -+ msleep(500); -+ else if (!(*status1 & S35390A_FLAG_BLD)) -+ /* -+ * If both POC and BLD are unset everything is fine. -+ */ - return 0; - -- buf[0] |= (S35390A_FLAG_RESET | S35390A_FLAG_24H); -- buf[0] &= 0xf0; -- return s35390a_set_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)); -+ /* -+ * At least one of POC and BLD are set, so reinitialise chip. Keeping -+ * this information in the hardware to know later that the time isn't -+ * valid is unfortunately not possible because POC and BLD are cleared -+ * on read. So the reset is best done now. -+ * -+ * The 24H bit is kept over reset, so set it already here. -+ */ -+initialize: -+ *status1 = S35390A_FLAG_24H; -+ buf = S35390A_FLAG_RESET | S35390A_FLAG_24H; -+ ret = s35390a_set_reg(s35390a, S35390A_CMD_STATUS1, &buf, 1); -+ -+ if (ret < 0) -+ return ret; -+ -+ ret = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, &buf, 1); -+ if (ret < 0) -+ return ret; -+ -+ if (buf & (S35390A_FLAG_POC | S35390A_FLAG_BLD)) { -+ /* Try up to five times to reset the chip */ -+ if (initcount < 5) { -+ ++initcount; -+ goto initialize; -+ } else -+ return -EIO; -+ } -+ -+ return 1; - } - - static int s35390a_disable_test_mode(struct s35390a *s35390a) -@@ -242,6 +291,8 @@ static int s35390a_set_alarm(struct i2c_client *client, struct rtc_wkalrm *alm) - - if (alm->time.tm_wday != -1) - buf[S35390A_ALRM_BYTE_WDAY] = bin2bcd(alm->time.tm_wday) | 0x80; -+ else -+ buf[S35390A_ALRM_BYTE_WDAY] = 0; - - buf[S35390A_ALRM_BYTE_HOURS] = s35390a_hr2reg(s35390a, - alm->time.tm_hour) | 0x80; -@@ -265,27 +316,61 @@ static int s35390a_read_alarm(struct i2c_client *client, struct rtc_wkalrm *alm) - char buf[3], sts; - int i, err; - -+ /* -+ * initialize all members to -1 to signal the core that they are not -+ * defined by the hardware. -+ */ -+ alm->time.tm_sec = -1; -+ alm->time.tm_min = -1; -+ alm->time.tm_hour = -1; -+ alm->time.tm_mday = -1; -+ alm->time.tm_mon = -1; -+ alm->time.tm_year = -1; -+ alm->time.tm_wday = -1; -+ alm->time.tm_yday = -1; -+ alm->time.tm_isdst = -1; -+ - err = s35390a_get_reg(s35390a, S35390A_CMD_STATUS2, &sts, sizeof(sts)); - if (err < 0) - return err; - -- if (bitrev8(sts) != S35390A_INT2_MODE_ALARM) -- return -EINVAL; -+ if ((bitrev8(sts) & S35390A_INT2_MODE_MASK) != S35390A_INT2_MODE_ALARM) { -+ /* -+ * When the alarm isn't enabled, the register to configure -+ * the alarm time isn't accessible. -+ */ -+ alm->enabled = 0; -+ return 0; -+ } else { -+ alm->enabled = 1; -+ } - - err = s35390a_get_reg(s35390a, S35390A_CMD_INT2_REG1, buf, sizeof(buf)); - if (err < 0) - return err; - - /* This chip returns the bits of each byte in reverse order */ -- for (i = 0; i < 3; ++i) { -+ for (i = 0; i < 3; ++i) - buf[i] = bitrev8(buf[i]); -- buf[i] &= ~0x80; -- } - -- alm->time.tm_wday = bcd2bin(buf[S35390A_ALRM_BYTE_WDAY]); -- alm->time.tm_hour = s35390a_reg2hr(s35390a, -- buf[S35390A_ALRM_BYTE_HOURS]); -- alm->time.tm_min = bcd2bin(buf[S35390A_ALRM_BYTE_MINS]); -+ /* -+ * B0 of the three matching registers is an enable flag. Iff it is set -+ * the configured value is used for matching. -+ */ -+ if (buf[S35390A_ALRM_BYTE_WDAY] & 0x80) -+ alm->time.tm_wday = -+ bcd2bin(buf[S35390A_ALRM_BYTE_WDAY] & ~0x80); -+ -+ if (buf[S35390A_ALRM_BYTE_HOURS] & 0x80) -+ alm->time.tm_hour = -+ s35390a_reg2hr(s35390a, -+ buf[S35390A_ALRM_BYTE_HOURS] & ~0x80); -+ -+ if (buf[S35390A_ALRM_BYTE_MINS] & 0x80) -+ alm->time.tm_min = bcd2bin(buf[S35390A_ALRM_BYTE_MINS] & ~0x80); -+ -+ /* alarm triggers always at s=0 */ -+ alm->time.tm_sec = 0; - - dev_dbg(&client->dev, "%s: alm is mins=%d, hours=%d, wday=%d\n", - __func__, alm->time.tm_min, alm->time.tm_hour, -@@ -327,11 +412,11 @@ static struct i2c_driver s35390a_driver; - static int s35390a_probe(struct i2c_client *client, - const struct i2c_device_id *id) - { -- int err; -+ int err, err_reset; - unsigned int i; - struct s35390a *s35390a; - struct rtc_time tm; -- char buf[1]; -+ char buf, status1; - - if (!i2c_check_functionality(client->adapter, I2C_FUNC_I2C)) { - err = -ENODEV; -@@ -360,29 +445,35 @@ static int s35390a_probe(struct i2c_client *client, - } - } - -- err = s35390a_reset(s35390a); -- if (err < 0) { -+ err_reset = s35390a_reset(s35390a, &status1); -+ if (err_reset < 0) { -+ err = err_reset; - dev_err(&client->dev, "error resetting chip\n"); - goto exit_dummy; - } - -- err = s35390a_disable_test_mode(s35390a); -- if (err < 0) { -- dev_err(&client->dev, "error disabling test mode\n"); -- goto exit_dummy; -- } -- -- err = s35390a_get_reg(s35390a, S35390A_CMD_STATUS1, buf, sizeof(buf)); -- if (err < 0) { -- dev_err(&client->dev, "error checking 12/24 hour mode\n"); -- goto exit_dummy; -- } -- if (buf[0] & S35390A_FLAG_24H) -+ if (status1 & S35390A_FLAG_24H) - s35390a->twentyfourhour = 1; - else - s35390a->twentyfourhour = 0; - -- if (s35390a_get_datetime(client, &tm) < 0) -+ if (status1 & S35390A_FLAG_INT2) { -+ /* disable alarm (and maybe test mode) */ -+ buf = 0; -+ err = s35390a_set_reg(s35390a, S35390A_CMD_STATUS2, &buf, 1); -+ if (err < 0) { -+ dev_err(&client->dev, "error disabling alarm"); -+ goto exit_dummy; -+ } -+ } else { -+ err = s35390a_disable_test_mode(s35390a); -+ if (err < 0) { -+ dev_err(&client->dev, "error disabling test mode\n"); -+ goto exit_dummy; -+ } -+ } -+ -+ if (err_reset > 0 || s35390a_get_datetime(client, &tm) < 0) - dev_warn(&client->dev, "clock needs to be set\n"); - - device_set_wakeup_capable(&client->dev, 1); -@@ -395,6 +486,10 @@ static int s35390a_probe(struct i2c_client *client, - err = PTR_ERR(s35390a->rtc); - goto exit_dummy; - } -+ -+ if (status1 & S35390A_FLAG_INT2) -+ rtc_update_irq(s35390a->rtc, 1, RTC_AF); -+ - return 0; - - exit_dummy: -diff --git a/drivers/scsi/libsas/sas_ata.c b/drivers/scsi/libsas/sas_ata.c -index 9c706d8c1441..6f5e2720ffad 100644 ---- a/drivers/scsi/libsas/sas_ata.c -+++ b/drivers/scsi/libsas/sas_ata.c -@@ -218,7 +218,7 @@ static unsigned int sas_ata_qc_issue(struct ata_queued_cmd *qc) - task->num_scatter = qc->n_elem; - } else { - for_each_sg(qc->sg, sg, qc->n_elem, si) -- xfer += sg->length; -+ xfer += sg_dma_len(sg); - - task->total_xfer_len = xfer; - task->num_scatter = si; -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.h b/drivers/scsi/mpt3sas/mpt3sas_base.h -index 92648a5ea2d2..63f5965acc89 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.h -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.h -@@ -390,6 +390,7 @@ struct MPT3SAS_TARGET { - * @eedp_enable: eedp support enable bit - * @eedp_type: 0(type_1), 1(type_2), 2(type_3) - * @eedp_block_length: block size -+ * @ata_command_pending: SATL passthrough outstanding for device - */ - struct MPT3SAS_DEVICE { - struct MPT3SAS_TARGET *sas_target; -@@ -398,6 +399,17 @@ struct MPT3SAS_DEVICE { - u8 configured_lun; - u8 block; - u8 tlr_snoop_check; -+ /* -+ * Bug workaround for SATL handling: the mpt2/3sas firmware -+ * doesn't return BUSY or TASK_SET_FULL for subsequent -+ * commands while a SATL pass through is in operation as the -+ * spec requires, it simply does nothing with them until the -+ * pass through completes, causing them possibly to timeout if -+ * the passthrough is a long executing command (like format or -+ * secure erase). This variable allows us to do the right -+ * thing while a SATL command is pending. -+ */ -+ unsigned long ata_command_pending; - }; - - #define MPT3_CMD_NOT_USED 0x8000 /* free */ -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index f6a8e9958e75..8a5fbdb45cfd 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -3707,9 +3707,18 @@ _scsih_temp_threshold_events(struct MPT3SAS_ADAPTER *ioc, - } - } - --static inline bool ata_12_16_cmd(struct scsi_cmnd *scmd) -+static int _scsih_set_satl_pending(struct scsi_cmnd *scmd, bool pending) - { -- return (scmd->cmnd[0] == ATA_12 || scmd->cmnd[0] == ATA_16); -+ struct MPT3SAS_DEVICE *priv = scmd->device->hostdata; -+ -+ if (scmd->cmnd[0] != ATA_12 && scmd->cmnd[0] != ATA_16) -+ return 0; -+ -+ if (pending) -+ return test_and_set_bit(0, &priv->ata_command_pending); -+ -+ clear_bit(0, &priv->ata_command_pending); -+ return 0; - } - - /** -@@ -3733,9 +3742,7 @@ _scsih_flush_running_cmds(struct MPT3SAS_ADAPTER *ioc) - if (!scmd) - continue; - count++; -- if (ata_12_16_cmd(scmd)) -- scsi_internal_device_unblock(scmd->device, -- SDEV_RUNNING); -+ _scsih_set_satl_pending(scmd, false); - mpt3sas_base_free_smid(ioc, smid); - scsi_dma_unmap(scmd); - if (ioc->pci_error_recovery) -@@ -3866,13 +3873,6 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) - if (ioc->logging_level & MPT_DEBUG_SCSI) - scsi_print_command(scmd); - -- /* -- * Lock the device for any subsequent command until command is -- * done. -- */ -- if (ata_12_16_cmd(scmd)) -- scsi_internal_device_block(scmd->device); -- - sas_device_priv_data = scmd->device->hostdata; - if (!sas_device_priv_data || !sas_device_priv_data->sas_target) { - scmd->result = DID_NO_CONNECT << 16; -@@ -3886,6 +3886,19 @@ scsih_qcmd(struct Scsi_Host *shost, struct scsi_cmnd *scmd) - return 0; - } - -+ /* -+ * Bug work around for firmware SATL handling. The loop -+ * is based on atomic operations and ensures consistency -+ * since we're lockless at this point -+ */ -+ do { -+ if (test_bit(0, &sas_device_priv_data->ata_command_pending)) { -+ scmd->result = SAM_STAT_BUSY; -+ scmd->scsi_done(scmd); -+ return 0; -+ } -+ } while (_scsih_set_satl_pending(scmd, true)); -+ - sas_target_priv_data = sas_device_priv_data->sas_target; - - /* invalid device handle */ -@@ -4445,8 +4458,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - if (scmd == NULL) - return 1; - -- if (ata_12_16_cmd(scmd)) -- scsi_internal_device_unblock(scmd->device, SDEV_RUNNING); -+ _scsih_set_satl_pending(scmd, false); - - mpi_request = mpt3sas_base_get_msg_frame(ioc, smid); - -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index dedcff9cabb5..6514636431ab 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1008,6 +1008,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - result = get_user(val, ip); - if (result) - return result; -+ if (val > SG_MAX_CDB_SIZE) -+ return -ENOMEM; - sfp->next_cmd_len = (val > 0) ? val : 0; - return 0; - case SG_GET_VERSION_NUM: -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index a0f911641b04..a15070a7fcd6 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -1987,6 +1987,11 @@ static void atmel_flush_buffer(struct uart_port *port) - atmel_uart_writel(port, ATMEL_PDC_TCR, 0); - atmel_port->pdc_tx.ofs = 0; - } -+ /* -+ * in uart_flush_buffer(), the xmit circular buffer has just -+ * been cleared, so we have to reset tx_len accordingly. -+ */ -+ atmel_port->tx_len = 0; - } - - /* -@@ -2499,6 +2504,9 @@ static void atmel_console_write(struct console *co, const char *s, u_int count) - pdc_tx = atmel_uart_readl(port, ATMEL_PDC_PTSR) & ATMEL_PDC_TXTEN; - atmel_uart_writel(port, ATMEL_PDC_PTCR, ATMEL_PDC_TXTDIS); - -+ /* Make sure that tx path is actually able to send characters */ -+ atmel_uart_writel(port, ATMEL_US_CR, ATMEL_US_TXEN); -+ - uart_console_write(port, s, count, atmel_console_putchar); - - /* -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 5724d7c41e29..ca2cbdb3aa67 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -499,8 +499,10 @@ static int rh_call_control (struct usb_hcd *hcd, struct urb *urb) - */ - tbuf_size = max_t(u16, sizeof(struct usb_hub_descriptor), wLength); - tbuf = kzalloc(tbuf_size, GFP_KERNEL); -- if (!tbuf) -- return -ENOMEM; -+ if (!tbuf) { -+ status = -ENOMEM; -+ goto err_alloc; -+ } - - bufp = tbuf; - -@@ -705,6 +707,7 @@ error: - } - - kfree(tbuf); -+ err_alloc: - - /* any errors get returned through the urb completion */ - spin_lock_irq(&hcd_root_hub_lock); -diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h -index c923350ca20a..d7ce4e3280db 100644 ---- a/include/linux/kvm_host.h -+++ b/include/linux/kvm_host.h -@@ -182,8 +182,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, - int len, void *val); - int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, - int len, struct kvm_io_device *dev); --int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, -- struct kvm_io_device *dev); -+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, -+ struct kvm_io_device *dev); - - #ifdef CONFIG_KVM_ASYNC_PF - struct kvm_async_pf { -diff --git a/kernel/padata.c b/kernel/padata.c -index b38bea9c466a..401227e3967c 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -189,19 +189,20 @@ static struct padata_priv *padata_get_next(struct parallel_data *pd) - - reorder = &next_queue->reorder; - -+ spin_lock(&reorder->lock); - if (!list_empty(&reorder->list)) { - padata = list_entry(reorder->list.next, - struct padata_priv, list); - -- spin_lock(&reorder->lock); - list_del_init(&padata->list); - atomic_dec(&pd->reorder_objects); -- spin_unlock(&reorder->lock); - - pd->processed++; - -+ spin_unlock(&reorder->lock); - goto out; - } -+ spin_unlock(&reorder->lock); - - if (__this_cpu_read(pd->pqueue->cpu_index) == next_queue->cpu_index) { - padata = ERR_PTR(-ENODATA); -diff --git a/mm/hugetlb.c b/mm/hugetlb.c -index ea11123a9249..7294301d8495 100644 ---- a/mm/hugetlb.c -+++ b/mm/hugetlb.c -@@ -4362,6 +4362,7 @@ follow_huge_pmd(struct mm_struct *mm, unsigned long address, - { - struct page *page = NULL; - spinlock_t *ptl; -+ pte_t pte; - retry: - ptl = pmd_lockptr(mm, pmd); - spin_lock(ptl); -@@ -4371,12 +4372,13 @@ retry: - */ - if (!pmd_huge(*pmd)) - goto out; -- if (pmd_present(*pmd)) { -+ pte = huge_ptep_get((pte_t *)pmd); -+ if (pte_present(pte)) { - page = pmd_page(*pmd) + ((address & ~PMD_MASK) >> PAGE_SHIFT); - if (flags & FOLL_GET) - get_page(page); - } else { -- if (is_hugetlb_entry_migration(huge_ptep_get((pte_t *)pmd))) { -+ if (is_hugetlb_entry_migration(pte)) { - spin_unlock(ptl); - __migration_entry_wait(mm, (pte_t *)pmd, ptl); - goto retry; -diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c -index b8d927c56494..a6b2f2138c9d 100644 ---- a/net/ceph/messenger.c -+++ b/net/ceph/messenger.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -478,11 +479,16 @@ static int ceph_tcp_connect(struct ceph_connection *con) - { - struct sockaddr_storage *paddr = &con->peer_addr.in_addr; - struct socket *sock; -+ unsigned int noio_flag; - int ret; - - BUG_ON(con->sock); -+ -+ /* sock_create_kern() allocates with GFP_KERNEL */ -+ noio_flag = memalloc_noio_save(); - ret = sock_create_kern(read_pnet(&con->msgr->net), paddr->ss_family, - SOCK_STREAM, IPPROTO_TCP, &sock); -+ memalloc_noio_restore(noio_flag); - if (ret) - return ret; - sock->sk->sk_allocation = GFP_NOFS; -diff --git a/sound/core/seq/seq_fifo.c b/sound/core/seq/seq_fifo.c -index 3f4efcb85df5..3490d21ab9e7 100644 ---- a/sound/core/seq/seq_fifo.c -+++ b/sound/core/seq/seq_fifo.c -@@ -265,6 +265,10 @@ int snd_seq_fifo_resize(struct snd_seq_fifo *f, int poolsize) - /* NOTE: overflow flag is not cleared */ - spin_unlock_irqrestore(&f->lock, flags); - -+ /* close the old pool and wait until all users are gone */ -+ snd_seq_pool_mark_closing(oldpool); -+ snd_use_lock_sync(&f->use_lock); -+ - /* release cells in old pool */ - for (cell = oldhead; cell; cell = next) { - next = cell->next; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 1d4f34379f56..46a34039ecdc 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4831,6 +4831,7 @@ enum { - ALC292_FIXUP_DISABLE_AAMIX, - ALC293_FIXUP_DISABLE_AAMIX_MULTIJACK, - ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, -+ ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, - ALC275_FIXUP_DELL_XPS, - ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE, - ALC293_FIXUP_LENOVO_SPK_NOISE, -@@ -5429,6 +5430,15 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC269_FIXUP_HEADSET_MODE - }, -+ [ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x18, 0x01a1913c }, /* use as headset mic, without its own jack detect */ -+ { } -+ }, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_HEADSET_MODE -+ }, - [ALC275_FIXUP_DELL_XPS] = { - .type = HDA_FIXUP_VERBS, - .v.verbs = (const struct hda_verb[]) { -@@ -5501,7 +5511,7 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc298_fixup_speaker_volume, - .chained = true, -- .chain_id = ALC298_FIXUP_DELL1_MIC_NO_PRESENCE, -+ .chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE, - }, - [ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = { - .type = HDA_FIXUP_PINS, -diff --git a/sound/soc/atmel/atmel-classd.c b/sound/soc/atmel/atmel-classd.c -index 8276675730ef..78a985629607 100644 ---- a/sound/soc/atmel/atmel-classd.c -+++ b/sound/soc/atmel/atmel-classd.c -@@ -343,7 +343,7 @@ static int atmel_classd_codec_dai_digital_mute(struct snd_soc_dai *codec_dai, - } - - #define CLASSD_ACLK_RATE_11M2896_MPY_8 (112896 * 100 * 8) --#define CLASSD_ACLK_RATE_12M288_MPY_8 (12228 * 1000 * 8) -+#define CLASSD_ACLK_RATE_12M288_MPY_8 (12288 * 1000 * 8) - - static struct { - int rate; -diff --git a/virt/kvm/eventfd.c b/virt/kvm/eventfd.c -index 46dbc0a7dfc1..49001fa84ead 100644 ---- a/virt/kvm/eventfd.c -+++ b/virt/kvm/eventfd.c -@@ -868,7 +868,8 @@ kvm_deassign_ioeventfd_idx(struct kvm *kvm, enum kvm_bus bus_idx, - continue; - - kvm_io_bus_unregister_dev(kvm, bus_idx, &p->dev); -- kvm->buses[bus_idx]->ioeventfd_count--; -+ if (kvm->buses[bus_idx]) -+ kvm->buses[bus_idx]->ioeventfd_count--; - ioeventfd_release(p); - ret = 0; - break; -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index 336ed267c407..cb092bd9965b 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -654,8 +654,11 @@ static void kvm_destroy_vm(struct kvm *kvm) - list_del(&kvm->vm_list); - spin_unlock(&kvm_lock); - kvm_free_irq_routing(kvm); -- for (i = 0; i < KVM_NR_BUSES; i++) -- kvm_io_bus_destroy(kvm->buses[i]); -+ for (i = 0; i < KVM_NR_BUSES; i++) { -+ if (kvm->buses[i]) -+ kvm_io_bus_destroy(kvm->buses[i]); -+ kvm->buses[i] = NULL; -+ } - kvm_coalesced_mmio_free(kvm); - #if defined(CONFIG_MMU_NOTIFIER) && defined(KVM_ARCH_WANT_MMU_NOTIFIER) - mmu_notifier_unregister(&kvm->mmu_notifier, kvm->mm); -@@ -3271,6 +3274,8 @@ int kvm_io_bus_write(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, - }; - - bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); -+ if (!bus) -+ return -ENOMEM; - r = __kvm_io_bus_write(vcpu, bus, &range, val); - return r < 0 ? r : 0; - } -@@ -3288,6 +3293,8 @@ int kvm_io_bus_write_cookie(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, - }; - - bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); -+ if (!bus) -+ return -ENOMEM; - - /* First try the device referenced by cookie. */ - if ((cookie >= 0) && (cookie < bus->dev_count) && -@@ -3338,6 +3345,8 @@ int kvm_io_bus_read(struct kvm_vcpu *vcpu, enum kvm_bus bus_idx, gpa_t addr, - }; - - bus = srcu_dereference(vcpu->kvm->buses[bus_idx], &vcpu->kvm->srcu); -+ if (!bus) -+ return -ENOMEM; - r = __kvm_io_bus_read(vcpu, bus, &range, val); - return r < 0 ? r : 0; - } -@@ -3350,6 +3359,9 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, - struct kvm_io_bus *new_bus, *bus; - - bus = kvm->buses[bus_idx]; -+ if (!bus) -+ return -ENOMEM; -+ - /* exclude ioeventfd which is limited by maximum fd */ - if (bus->dev_count - bus->ioeventfd_count > NR_IOBUS_DEVS - 1) - return -ENOSPC; -@@ -3369,37 +3381,41 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, - } - - /* Caller must hold slots_lock. */ --int kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, -- struct kvm_io_device *dev) -+void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, -+ struct kvm_io_device *dev) - { -- int i, r; -+ int i; - struct kvm_io_bus *new_bus, *bus; - - bus = kvm->buses[bus_idx]; -- r = -ENOENT; -+ if (!bus) -+ return; -+ - for (i = 0; i < bus->dev_count; i++) - if (bus->range[i].dev == dev) { -- r = 0; - break; - } - -- if (r) -- return r; -+ if (i == bus->dev_count) -+ return; - - new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * - sizeof(struct kvm_io_range)), GFP_KERNEL); -- if (!new_bus) -- return -ENOMEM; -+ if (!new_bus) { -+ pr_err("kvm: failed to shrink bus, removing it completely\n"); -+ goto broken; -+ } - - memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); - new_bus->dev_count--; - memcpy(new_bus->range + i, bus->range + i + 1, - (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); - -+broken: - rcu_assign_pointer(kvm->buses[bus_idx], new_bus); - synchronize_srcu_expedited(&kvm->srcu); - kfree(bus); -- return r; -+ return; - } - - static struct notifier_block kvm_cpu_notifier = { diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.60-61.patch b/patch/kernel/mvebu64-default/03-patch-4.4.60-61.patch deleted file mode 100644 index 642a5bd6b441..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.60-61.patch +++ /dev/null @@ -1,1527 +0,0 @@ -diff --git a/Makefile b/Makefile -index fb7c2b40753d..ef5045b8201d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 60 -+SUBLEVEL = 61 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index 11b6595c2672..f91ee2f27b41 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -796,6 +796,7 @@ void stage2_unmap_vm(struct kvm *kvm) - int idx; - - idx = srcu_read_lock(&kvm->srcu); -+ down_read(¤t->mm->mmap_sem); - spin_lock(&kvm->mmu_lock); - - slots = kvm_memslots(kvm); -@@ -803,6 +804,7 @@ void stage2_unmap_vm(struct kvm *kvm) - stage2_unmap_memslot(kvm, memslot); - - spin_unlock(&kvm->mmu_lock); -+ up_read(¤t->mm->mmap_sem); - srcu_read_unlock(&kvm->srcu, idx); - } - -@@ -1759,6 +1761,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - (KVM_PHYS_SIZE >> PAGE_SHIFT)) - return -EFAULT; - -+ down_read(¤t->mm->mmap_sem); - /* - * A memory region could potentially cover multiple VMAs, and any holes - * between them, so iterate over all of them to find out if we can map -@@ -1802,8 +1805,10 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - pa += vm_start - vma->vm_start; - - /* IO region dirty page logging not allowed */ -- if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) -- return -EINVAL; -+ if (memslot->flags & KVM_MEM_LOG_DIRTY_PAGES) { -+ ret = -EINVAL; -+ goto out; -+ } - - ret = kvm_phys_addr_ioremap(kvm, gpa, pa, - vm_end - vm_start, -@@ -1815,7 +1820,7 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - } while (hva < reg_end); - - if (change == KVM_MR_FLAGS_ONLY) -- return ret; -+ goto out; - - spin_lock(&kvm->mmu_lock); - if (ret) -@@ -1823,6 +1828,8 @@ int kvm_arch_prepare_memory_region(struct kvm *kvm, - else - stage2_flush_memslot(kvm, memslot); - spin_unlock(&kvm->mmu_lock); -+out: -+ up_read(¤t->mm->mmap_sem); - return ret; - } - -diff --git a/arch/metag/include/asm/uaccess.h b/arch/metag/include/asm/uaccess.h -index 273e61225c27..07238b39638c 100644 ---- a/arch/metag/include/asm/uaccess.h -+++ b/arch/metag/include/asm/uaccess.h -@@ -197,20 +197,21 @@ extern long __must_check strnlen_user(const char __user *src, long count); - - #define strlen_user(str) strnlen_user(str, 32767) - --extern unsigned long __must_check __copy_user_zeroing(void *to, -- const void __user *from, -- unsigned long n); -+extern unsigned long raw_copy_from_user(void *to, const void __user *from, -+ unsigned long n); - - static inline unsigned long - copy_from_user(void *to, const void __user *from, unsigned long n) - { -+ unsigned long res = n; - if (likely(access_ok(VERIFY_READ, from, n))) -- return __copy_user_zeroing(to, from, n); -- memset(to, 0, n); -- return n; -+ res = raw_copy_from_user(to, from, n); -+ if (unlikely(res)) -+ memset(to + (n - res), 0, res); -+ return res; - } - --#define __copy_from_user(to, from, n) __copy_user_zeroing(to, from, n) -+#define __copy_from_user(to, from, n) raw_copy_from_user(to, from, n) - #define __copy_from_user_inatomic __copy_from_user - - extern unsigned long __must_check __copy_user(void __user *to, -diff --git a/arch/metag/lib/usercopy.c b/arch/metag/lib/usercopy.c -index b3ebfe9c8e88..2792fc621088 100644 ---- a/arch/metag/lib/usercopy.c -+++ b/arch/metag/lib/usercopy.c -@@ -29,7 +29,6 @@ - COPY \ - "1:\n" \ - " .section .fixup,\"ax\"\n" \ -- " MOV D1Ar1,#0\n" \ - FIXUP \ - " MOVT D1Ar1,#HI(1b)\n" \ - " JUMP D1Ar1,#LO(1b)\n" \ -@@ -260,27 +259,31 @@ - "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ - "22:\n" \ - "MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -- "SUB %3, %3, #32\n" \ - "23:\n" \ -- "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -+ "SUB %3, %3, #32\n" \ - "24:\n" \ -+ "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -+ "25:\n" \ - "MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "26:\n" \ - "SUB %3, %3, #32\n" \ - "DCACHE [%1+#-64], D0Ar6\n" \ - "BR $Lloop"id"\n" \ - \ - "MOV RAPF, %1\n" \ -- "25:\n" \ -+ "27:\n" \ - "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "26:\n" \ -+ "28:\n" \ - "MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "29:\n" \ - "SUB %3, %3, #32\n" \ -- "27:\n" \ -+ "30:\n" \ - "MGETL D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "28:\n" \ -+ "31:\n" \ - "MSETL [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "32:\n" \ - "SUB %0, %0, #8\n" \ -- "29:\n" \ -+ "33:\n" \ - "SETL [%0++], D0.7, D1.7\n" \ - "SUB %3, %3, #32\n" \ - "1:" \ -@@ -312,11 +315,15 @@ - " .long 26b,3b\n" \ - " .long 27b,3b\n" \ - " .long 28b,3b\n" \ -- " .long 29b,4b\n" \ -+ " .long 29b,3b\n" \ -+ " .long 30b,3b\n" \ -+ " .long 31b,3b\n" \ -+ " .long 32b,3b\n" \ -+ " .long 33b,4b\n" \ - " .previous\n" \ - : "=r" (to), "=r" (from), "=r" (ret), "=d" (n) \ - : "0" (to), "1" (from), "2" (ret), "3" (n) \ -- : "D1Ar1", "D0Ar2", "memory") -+ : "D1Ar1", "D0Ar2", "cc", "memory") - - /* rewind 'to' and 'from' pointers when a fault occurs - * -@@ -342,7 +349,7 @@ - #define __asm_copy_to_user_64bit_rapf_loop(to, from, ret, n, id)\ - __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id, \ - "LSR D0Ar2, D0Ar2, #8\n" \ -- "AND D0Ar2, D0Ar2, #0x7\n" \ -+ "ANDS D0Ar2, D0Ar2, #0x7\n" \ - "ADDZ D0Ar2, D0Ar2, #4\n" \ - "SUB D0Ar2, D0Ar2, #1\n" \ - "MOV D1Ar1, #4\n" \ -@@ -403,47 +410,55 @@ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ - "22:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -- "SUB %3, %3, #16\n" \ - "23:\n" \ -- "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "24:\n" \ -- "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ - "SUB %3, %3, #16\n" \ -- "25:\n" \ -+ "24:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "26:\n" \ -+ "25:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "26:\n" \ - "SUB %3, %3, #16\n" \ - "27:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ - "28:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "29:\n" \ -+ "SUB %3, %3, #16\n" \ -+ "30:\n" \ -+ "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -+ "31:\n" \ -+ "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "32:\n" \ - "SUB %3, %3, #16\n" \ - "DCACHE [%1+#-64], D0Ar6\n" \ - "BR $Lloop"id"\n" \ - \ - "MOV RAPF, %1\n" \ -- "29:\n" \ -+ "33:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "30:\n" \ -+ "34:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "35:\n" \ - "SUB %3, %3, #16\n" \ -- "31:\n" \ -+ "36:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "32:\n" \ -+ "37:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "38:\n" \ - "SUB %3, %3, #16\n" \ -- "33:\n" \ -+ "39:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "34:\n" \ -+ "40:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "41:\n" \ - "SUB %3, %3, #16\n" \ -- "35:\n" \ -+ "42:\n" \ - "MGETD D0FrT, D0.5, D0.6, D0.7, [%1++]\n" \ -- "36:\n" \ -+ "43:\n" \ - "MSETD [%0++], D0FrT, D0.5, D0.6, D0.7\n" \ -+ "44:\n" \ - "SUB %0, %0, #4\n" \ -- "37:\n" \ -+ "45:\n" \ - "SETD [%0++], D0.7\n" \ - "SUB %3, %3, #16\n" \ - "1:" \ -@@ -483,11 +498,19 @@ - " .long 34b,3b\n" \ - " .long 35b,3b\n" \ - " .long 36b,3b\n" \ -- " .long 37b,4b\n" \ -+ " .long 37b,3b\n" \ -+ " .long 38b,3b\n" \ -+ " .long 39b,3b\n" \ -+ " .long 40b,3b\n" \ -+ " .long 41b,3b\n" \ -+ " .long 42b,3b\n" \ -+ " .long 43b,3b\n" \ -+ " .long 44b,3b\n" \ -+ " .long 45b,4b\n" \ - " .previous\n" \ - : "=r" (to), "=r" (from), "=r" (ret), "=d" (n) \ - : "0" (to), "1" (from), "2" (ret), "3" (n) \ -- : "D1Ar1", "D0Ar2", "memory") -+ : "D1Ar1", "D0Ar2", "cc", "memory") - - /* rewind 'to' and 'from' pointers when a fault occurs - * -@@ -513,7 +536,7 @@ - #define __asm_copy_to_user_32bit_rapf_loop(to, from, ret, n, id)\ - __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id, \ - "LSR D0Ar2, D0Ar2, #8\n" \ -- "AND D0Ar2, D0Ar2, #0x7\n" \ -+ "ANDS D0Ar2, D0Ar2, #0x7\n" \ - "ADDZ D0Ar2, D0Ar2, #4\n" \ - "SUB D0Ar2, D0Ar2, #1\n" \ - "MOV D1Ar1, #4\n" \ -@@ -538,23 +561,31 @@ unsigned long __copy_user(void __user *pdst, const void *psrc, - if ((unsigned long) src & 1) { - __asm_copy_to_user_1(dst, src, retn); - n--; -+ if (retn) -+ return retn + n; - } - if ((unsigned long) dst & 1) { - /* Worst case - byte copy */ - while (n > 0) { - __asm_copy_to_user_1(dst, src, retn); - n--; -+ if (retn) -+ return retn + n; - } - } - if (((unsigned long) src & 2) && n >= 2) { - __asm_copy_to_user_2(dst, src, retn); - n -= 2; -+ if (retn) -+ return retn + n; - } - if ((unsigned long) dst & 2) { - /* Second worst case - word copy */ - while (n >= 2) { - __asm_copy_to_user_2(dst, src, retn); - n -= 2; -+ if (retn) -+ return retn + n; - } - } - -@@ -569,6 +600,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc, - while (n >= 8) { - __asm_copy_to_user_8x64(dst, src, retn); - n -= 8; -+ if (retn) -+ return retn + n; - } - } - if (n >= RAPF_MIN_BUF_SIZE) { -@@ -581,6 +614,8 @@ unsigned long __copy_user(void __user *pdst, const void *psrc, - while (n >= 8) { - __asm_copy_to_user_8x64(dst, src, retn); - n -= 8; -+ if (retn) -+ return retn + n; - } - } - #endif -@@ -588,11 +623,15 @@ unsigned long __copy_user(void __user *pdst, const void *psrc, - while (n >= 16) { - __asm_copy_to_user_16(dst, src, retn); - n -= 16; -+ if (retn) -+ return retn + n; - } - - while (n >= 4) { - __asm_copy_to_user_4(dst, src, retn); - n -= 4; -+ if (retn) -+ return retn + n; - } - - switch (n) { -@@ -609,6 +648,10 @@ unsigned long __copy_user(void __user *pdst, const void *psrc, - break; - } - -+ /* -+ * If we get here, retn correctly reflects the number of failing -+ * bytes. -+ */ - return retn; - } - EXPORT_SYMBOL(__copy_user); -@@ -617,16 +660,14 @@ EXPORT_SYMBOL(__copy_user); - __asm_copy_user_cont(to, from, ret, \ - " GETB D1Ar1,[%1++]\n" \ - "2: SETB [%0++],D1Ar1\n", \ -- "3: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -+ "3: ADD %2,%2,#1\n", \ - " .long 2b,3b\n") - - #define __asm_copy_from_user_2x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ - __asm_copy_user_cont(to, from, ret, \ - " GETW D1Ar1,[%1++]\n" \ - "2: SETW [%0++],D1Ar1\n" COPY, \ -- "3: ADD %2,%2,#2\n" \ -- " SETW [%0++],D1Ar1\n" FIXUP, \ -+ "3: ADD %2,%2,#2\n" FIXUP, \ - " .long 2b,3b\n" TENTRY) - - #define __asm_copy_from_user_2(to, from, ret) \ -@@ -636,145 +677,26 @@ EXPORT_SYMBOL(__copy_user); - __asm_copy_from_user_2x_cont(to, from, ret, \ - " GETB D1Ar1,[%1++]\n" \ - "4: SETB [%0++],D1Ar1\n", \ -- "5: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -+ "5: ADD %2,%2,#1\n", \ - " .long 4b,5b\n") - - #define __asm_copy_from_user_4x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ - __asm_copy_user_cont(to, from, ret, \ - " GETD D1Ar1,[%1++]\n" \ - "2: SETD [%0++],D1Ar1\n" COPY, \ -- "3: ADD %2,%2,#4\n" \ -- " SETD [%0++],D1Ar1\n" FIXUP, \ -+ "3: ADD %2,%2,#4\n" FIXUP, \ - " .long 2b,3b\n" TENTRY) - - #define __asm_copy_from_user_4(to, from, ret) \ - __asm_copy_from_user_4x_cont(to, from, ret, "", "", "") - --#define __asm_copy_from_user_5(to, from, ret) \ -- __asm_copy_from_user_4x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "4: SETB [%0++],D1Ar1\n", \ -- "5: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 4b,5b\n") -- --#define __asm_copy_from_user_6x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_4x_cont(to, from, ret, \ -- " GETW D1Ar1,[%1++]\n" \ -- "4: SETW [%0++],D1Ar1\n" COPY, \ -- "5: ADD %2,%2,#2\n" \ -- " SETW [%0++],D1Ar1\n" FIXUP, \ -- " .long 4b,5b\n" TENTRY) -- --#define __asm_copy_from_user_6(to, from, ret) \ -- __asm_copy_from_user_6x_cont(to, from, ret, "", "", "") -- --#define __asm_copy_from_user_7(to, from, ret) \ -- __asm_copy_from_user_6x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "6: SETB [%0++],D1Ar1\n", \ -- "7: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 6b,7b\n") -- --#define __asm_copy_from_user_8x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_4x_cont(to, from, ret, \ -- " GETD D1Ar1,[%1++]\n" \ -- "4: SETD [%0++],D1Ar1\n" COPY, \ -- "5: ADD %2,%2,#4\n" \ -- " SETD [%0++],D1Ar1\n" FIXUP, \ -- " .long 4b,5b\n" TENTRY) -- --#define __asm_copy_from_user_8(to, from, ret) \ -- __asm_copy_from_user_8x_cont(to, from, ret, "", "", "") -- --#define __asm_copy_from_user_9(to, from, ret) \ -- __asm_copy_from_user_8x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "6: SETB [%0++],D1Ar1\n", \ -- "7: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 6b,7b\n") -- --#define __asm_copy_from_user_10x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_8x_cont(to, from, ret, \ -- " GETW D1Ar1,[%1++]\n" \ -- "6: SETW [%0++],D1Ar1\n" COPY, \ -- "7: ADD %2,%2,#2\n" \ -- " SETW [%0++],D1Ar1\n" FIXUP, \ -- " .long 6b,7b\n" TENTRY) -- --#define __asm_copy_from_user_10(to, from, ret) \ -- __asm_copy_from_user_10x_cont(to, from, ret, "", "", "") -- --#define __asm_copy_from_user_11(to, from, ret) \ -- __asm_copy_from_user_10x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "8: SETB [%0++],D1Ar1\n", \ -- "9: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 8b,9b\n") -- --#define __asm_copy_from_user_12x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_8x_cont(to, from, ret, \ -- " GETD D1Ar1,[%1++]\n" \ -- "6: SETD [%0++],D1Ar1\n" COPY, \ -- "7: ADD %2,%2,#4\n" \ -- " SETD [%0++],D1Ar1\n" FIXUP, \ -- " .long 6b,7b\n" TENTRY) -- --#define __asm_copy_from_user_12(to, from, ret) \ -- __asm_copy_from_user_12x_cont(to, from, ret, "", "", "") -- --#define __asm_copy_from_user_13(to, from, ret) \ -- __asm_copy_from_user_12x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "8: SETB [%0++],D1Ar1\n", \ -- "9: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 8b,9b\n") -- --#define __asm_copy_from_user_14x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_12x_cont(to, from, ret, \ -- " GETW D1Ar1,[%1++]\n" \ -- "8: SETW [%0++],D1Ar1\n" COPY, \ -- "9: ADD %2,%2,#2\n" \ -- " SETW [%0++],D1Ar1\n" FIXUP, \ -- " .long 8b,9b\n" TENTRY) -- --#define __asm_copy_from_user_14(to, from, ret) \ -- __asm_copy_from_user_14x_cont(to, from, ret, "", "", "") -- --#define __asm_copy_from_user_15(to, from, ret) \ -- __asm_copy_from_user_14x_cont(to, from, ret, \ -- " GETB D1Ar1,[%1++]\n" \ -- "10: SETB [%0++],D1Ar1\n", \ -- "11: ADD %2,%2,#1\n" \ -- " SETB [%0++],D1Ar1\n", \ -- " .long 10b,11b\n") -- --#define __asm_copy_from_user_16x_cont(to, from, ret, COPY, FIXUP, TENTRY) \ -- __asm_copy_from_user_12x_cont(to, from, ret, \ -- " GETD D1Ar1,[%1++]\n" \ -- "8: SETD [%0++],D1Ar1\n" COPY, \ -- "9: ADD %2,%2,#4\n" \ -- " SETD [%0++],D1Ar1\n" FIXUP, \ -- " .long 8b,9b\n" TENTRY) -- --#define __asm_copy_from_user_16(to, from, ret) \ -- __asm_copy_from_user_16x_cont(to, from, ret, "", "", "") -- - #define __asm_copy_from_user_8x64(to, from, ret) \ - asm volatile ( \ - " GETL D0Ar2,D1Ar1,[%1++]\n" \ - "2: SETL [%0++],D0Ar2,D1Ar1\n" \ - "1:\n" \ - " .section .fixup,\"ax\"\n" \ -- " MOV D1Ar1,#0\n" \ -- " MOV D0Ar2,#0\n" \ - "3: ADD %2,%2,#8\n" \ -- " SETL [%0++],D0Ar2,D1Ar1\n" \ - " MOVT D0Ar2,#HI(1b)\n" \ - " JUMP D0Ar2,#LO(1b)\n" \ - " .previous\n" \ -@@ -789,36 +711,57 @@ EXPORT_SYMBOL(__copy_user); - * - * Rationale: - * A fault occurs while reading from user buffer, which is the -- * source. Since the fault is at a single address, we only -- * need to rewind by 8 bytes. -+ * source. - * Since we don't write to kernel buffer until we read first, - * the kernel buffer is at the right state and needn't be -- * corrected. -+ * corrected, but the source must be rewound to the beginning of -+ * the block, which is LSM_STEP*8 bytes. -+ * LSM_STEP is bits 10:8 in TXSTATUS which is already read -+ * and stored in D0Ar2 -+ * -+ * NOTE: If a fault occurs at the last operation in M{G,S}ETL -+ * LSM_STEP will be 0. ie: we do 4 writes in our case, if -+ * a fault happens at the 4th write, LSM_STEP will be 0 -+ * instead of 4. The code copes with that. - */ - #define __asm_copy_from_user_64bit_rapf_loop(to, from, ret, n, id) \ - __asm_copy_user_64bit_rapf_loop(to, from, ret, n, id, \ -- "SUB %1, %1, #8\n") -+ "LSR D0Ar2, D0Ar2, #5\n" \ -+ "ANDS D0Ar2, D0Ar2, #0x38\n" \ -+ "ADDZ D0Ar2, D0Ar2, #32\n" \ -+ "SUB %1, %1, D0Ar2\n") - - /* rewind 'from' pointer when a fault occurs - * - * Rationale: - * A fault occurs while reading from user buffer, which is the -- * source. Since the fault is at a single address, we only -- * need to rewind by 4 bytes. -+ * source. - * Since we don't write to kernel buffer until we read first, - * the kernel buffer is at the right state and needn't be -- * corrected. -+ * corrected, but the source must be rewound to the beginning of -+ * the block, which is LSM_STEP*4 bytes. -+ * LSM_STEP is bits 10:8 in TXSTATUS which is already read -+ * and stored in D0Ar2 -+ * -+ * NOTE: If a fault occurs at the last operation in M{G,S}ETL -+ * LSM_STEP will be 0. ie: we do 4 writes in our case, if -+ * a fault happens at the 4th write, LSM_STEP will be 0 -+ * instead of 4. The code copes with that. - */ - #define __asm_copy_from_user_32bit_rapf_loop(to, from, ret, n, id) \ - __asm_copy_user_32bit_rapf_loop(to, from, ret, n, id, \ -- "SUB %1, %1, #4\n") -+ "LSR D0Ar2, D0Ar2, #6\n" \ -+ "ANDS D0Ar2, D0Ar2, #0x1c\n" \ -+ "ADDZ D0Ar2, D0Ar2, #16\n" \ -+ "SUB %1, %1, D0Ar2\n") - - --/* Copy from user to kernel, zeroing the bytes that were inaccessible in -- userland. The return-value is the number of bytes that were -- inaccessible. */ --unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, -- unsigned long n) -+/* -+ * Copy from user to kernel. The return-value is the number of bytes that were -+ * inaccessible. -+ */ -+unsigned long raw_copy_from_user(void *pdst, const void __user *psrc, -+ unsigned long n) - { - register char *dst asm ("A0.2") = pdst; - register const char __user *src asm ("A1.2") = psrc; -@@ -830,6 +773,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - if ((unsigned long) src & 1) { - __asm_copy_from_user_1(dst, src, retn); - n--; -+ if (retn) -+ return retn + n; - } - if ((unsigned long) dst & 1) { - /* Worst case - byte copy */ -@@ -837,12 +782,14 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - __asm_copy_from_user_1(dst, src, retn); - n--; - if (retn) -- goto copy_exception_bytes; -+ return retn + n; - } - } - if (((unsigned long) src & 2) && n >= 2) { - __asm_copy_from_user_2(dst, src, retn); - n -= 2; -+ if (retn) -+ return retn + n; - } - if ((unsigned long) dst & 2) { - /* Second worst case - word copy */ -@@ -850,16 +797,10 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - __asm_copy_from_user_2(dst, src, retn); - n -= 2; - if (retn) -- goto copy_exception_bytes; -+ return retn + n; - } - } - -- /* We only need one check after the unalignment-adjustments, -- because if both adjustments were done, either both or -- neither reference had an exception. */ -- if (retn != 0) -- goto copy_exception_bytes; -- - #ifdef USE_RAPF - /* 64 bit copy loop */ - if (!(((unsigned long) src | (unsigned long) dst) & 7)) { -@@ -872,7 +813,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - __asm_copy_from_user_8x64(dst, src, retn); - n -= 8; - if (retn) -- goto copy_exception_bytes; -+ return retn + n; - } - } - -@@ -888,7 +829,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - __asm_copy_from_user_8x64(dst, src, retn); - n -= 8; - if (retn) -- goto copy_exception_bytes; -+ return retn + n; - } - } - #endif -@@ -898,7 +839,7 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - n -= 4; - - if (retn) -- goto copy_exception_bytes; -+ return retn + n; - } - - /* If we get here, there were no memory read faults. */ -@@ -924,21 +865,8 @@ unsigned long __copy_user_zeroing(void *pdst, const void __user *psrc, - /* If we get here, retn correctly reflects the number of failing - bytes. */ - return retn; -- -- copy_exception_bytes: -- /* We already have "retn" bytes cleared, and need to clear the -- remaining "n" bytes. A non-optimized simple byte-for-byte in-line -- memset is preferred here, since this isn't speed-critical code and -- we'd rather have this a leaf-function than calling memset. */ -- { -- char *endp; -- for (endp = dst + n; dst < endp; dst++) -- *dst = 0; -- } -- -- return retn + n; - } --EXPORT_SYMBOL(__copy_user_zeroing); -+EXPORT_SYMBOL(raw_copy_from_user); - - #define __asm_clear_8x64(to, ret) \ - asm volatile ( \ -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index db459612de44..75bfca69e418 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -1412,7 +1412,7 @@ config CPU_MIPS32_R6 - select CPU_SUPPORTS_MSA - select GENERIC_CSUM - select HAVE_KVM -- select MIPS_O32_FP64_SUPPORT -+ select MIPS_O32_FP64_SUPPORT if 32BIT - help - Choose this option to build a kernel for release 6 or later of the - MIPS32 architecture. New MIPS processors, starting with the Warrior -diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h -index 40196bebe849..2365ce0ad8f2 100644 ---- a/arch/mips/include/asm/spinlock.h -+++ b/arch/mips/include/asm/spinlock.h -@@ -112,7 +112,7 @@ static inline void arch_spin_lock(arch_spinlock_t *lock) - " andi %[ticket], %[ticket], 0xffff \n" - " bne %[ticket], %[my_ticket], 4f \n" - " subu %[ticket], %[my_ticket], %[ticket] \n" -- "2: \n" -+ "2: .insn \n" - " .subsection 2 \n" - "4: andi %[ticket], %[ticket], 0xffff \n" - " sll %[ticket], 5 \n" -@@ -187,7 +187,7 @@ static inline unsigned int arch_spin_trylock(arch_spinlock_t *lock) - " sc %[ticket], %[ticket_ptr] \n" - " beqz %[ticket], 1b \n" - " li %[ticket], 1 \n" -- "2: \n" -+ "2: .insn \n" - " .subsection 2 \n" - "3: b 2b \n" - " li %[ticket], 0 \n" -@@ -367,7 +367,7 @@ static inline int arch_read_trylock(arch_rwlock_t *rw) - " .set reorder \n" - __WEAK_LLSC_MB - " li %2, 1 \n" -- "2: \n" -+ "2: .insn \n" - : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp), "=&r" (ret) - : GCC_OFF_SMALL_ASM() (rw->lock) - : "memory"); -@@ -407,7 +407,7 @@ static inline int arch_write_trylock(arch_rwlock_t *rw) - " lui %1, 0x8000 \n" - " sc %1, %0 \n" - " li %2, 1 \n" -- "2: \n" -+ "2: .insn \n" - : "=" GCC_OFF_SMALL_ASM() (rw->lock), "=&r" (tmp), - "=&r" (ret) - : GCC_OFF_SMALL_ASM() (rw->lock) -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index 3e390a4e3897..daf580ce5ca2 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -467,7 +467,7 @@ void __init ltq_soc_init(void) - - if (!np_xbar) - panic("Failed to load xbar nodes from devicetree"); -- if (of_address_to_resource(np_pmu, 0, &res_xbar)) -+ if (of_address_to_resource(np_xbar, 0, &res_xbar)) - panic("Failed to get xbar resources"); - if (request_mem_region(res_xbar.start, resource_size(&res_xbar), - res_xbar.name) < 0) -diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c -index 29f73e00253d..63b7d6f82d24 100644 ---- a/arch/mips/mm/tlbex.c -+++ b/arch/mips/mm/tlbex.c -@@ -757,7 +757,8 @@ static void build_huge_update_entries(u32 **p, unsigned int pte, - static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r, - struct uasm_label **l, - unsigned int pte, -- unsigned int ptr) -+ unsigned int ptr, -+ unsigned int flush) - { - #ifdef CONFIG_SMP - UASM_i_SC(p, pte, 0, ptr); -@@ -766,6 +767,22 @@ static void build_huge_handler_tail(u32 **p, struct uasm_reloc **r, - #else - UASM_i_SW(p, pte, 0, ptr); - #endif -+ if (cpu_has_ftlb && flush) { -+ BUG_ON(!cpu_has_tlbinv); -+ -+ UASM_i_MFC0(p, ptr, C0_ENTRYHI); -+ uasm_i_ori(p, ptr, ptr, MIPS_ENTRYHI_EHINV); -+ UASM_i_MTC0(p, ptr, C0_ENTRYHI); -+ build_tlb_write_entry(p, l, r, tlb_indexed); -+ -+ uasm_i_xori(p, ptr, ptr, MIPS_ENTRYHI_EHINV); -+ UASM_i_MTC0(p, ptr, C0_ENTRYHI); -+ build_huge_update_entries(p, pte, ptr); -+ build_huge_tlb_write_entry(p, l, r, pte, tlb_random, 0); -+ -+ return; -+ } -+ - build_huge_update_entries(p, pte, ptr); - build_huge_tlb_write_entry(p, l, r, pte, tlb_indexed, 0); - } -@@ -2082,7 +2099,7 @@ static void build_r4000_tlb_load_handler(void) - uasm_l_tlbl_goaround2(&l, p); - } - uasm_i_ori(&p, wr.r1, wr.r1, (_PAGE_ACCESSED | _PAGE_VALID)); -- build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2); -+ build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1); - #endif - - uasm_l_nopage_tlbl(&l, p); -@@ -2137,7 +2154,7 @@ static void build_r4000_tlb_store_handler(void) - build_tlb_probe_entry(&p); - uasm_i_ori(&p, wr.r1, wr.r1, - _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY); -- build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2); -+ build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 1); - #endif - - uasm_l_nopage_tlbs(&l, p); -@@ -2193,7 +2210,7 @@ static void build_r4000_tlb_modify_handler(void) - build_tlb_probe_entry(&p); - uasm_i_ori(&p, wr.r1, wr.r1, - _PAGE_ACCESSED | _PAGE_MODIFIED | _PAGE_VALID | _PAGE_DIRTY); -- build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2); -+ build_huge_handler_tail(&p, &r, &l, wr.r1, wr.r2, 0); - #endif - - uasm_l_nopage_tlbm(&l, p); -diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c -index f42834c7f007..3c575093f8f1 100644 ---- a/arch/mips/ralink/rt3883.c -+++ b/arch/mips/ralink/rt3883.c -@@ -36,7 +36,7 @@ static struct rt2880_pmx_func uartlite_func[] = { FUNC("uartlite", 0, 15, 2) }; - static struct rt2880_pmx_func jtag_func[] = { FUNC("jtag", 0, 17, 5) }; - static struct rt2880_pmx_func mdio_func[] = { FUNC("mdio", 0, 22, 2) }; - static struct rt2880_pmx_func lna_a_func[] = { FUNC("lna a", 0, 32, 3) }; --static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna a", 0, 35, 3) }; -+static struct rt2880_pmx_func lna_g_func[] = { FUNC("lna g", 0, 35, 3) }; - static struct rt2880_pmx_func pci_func[] = { - FUNC("pci-dev", 0, 40, 32), - FUNC("pci-host2", 1, 40, 32), -@@ -44,7 +44,7 @@ static struct rt2880_pmx_func pci_func[] = { - FUNC("pci-fnc", 3, 40, 32) - }; - static struct rt2880_pmx_func ge1_func[] = { FUNC("ge1", 0, 72, 12) }; --static struct rt2880_pmx_func ge2_func[] = { FUNC("ge1", 0, 84, 12) }; -+static struct rt2880_pmx_func ge2_func[] = { FUNC("ge2", 0, 84, 12) }; - - static struct rt2880_pmx_group rt3883_pinmux_data[] = { - GRP("i2c", i2c_func, 1, RT3883_GPIO_MODE_I2C), -diff --git a/arch/nios2/kernel/prom.c b/arch/nios2/kernel/prom.c -index 718dd197909f..de73beb36910 100644 ---- a/arch/nios2/kernel/prom.c -+++ b/arch/nios2/kernel/prom.c -@@ -48,6 +48,13 @@ void * __init early_init_dt_alloc_memory_arch(u64 size, u64 align) - return alloc_bootmem_align(size, align); - } - -+int __init early_init_dt_reserve_memory_arch(phys_addr_t base, phys_addr_t size, -+ bool nomap) -+{ -+ reserve_bootmem(base, size, BOOTMEM_DEFAULT); -+ return 0; -+} -+ - void __init early_init_devtree(void *params) - { - __be32 *dtb = (u32 *)__dtb_start; -diff --git a/arch/nios2/kernel/setup.c b/arch/nios2/kernel/setup.c -index a4ff86d58d5c..6c4e351a7930 100644 ---- a/arch/nios2/kernel/setup.c -+++ b/arch/nios2/kernel/setup.c -@@ -195,6 +195,9 @@ void __init setup_arch(char **cmdline_p) - } - #endif /* CONFIG_BLK_DEV_INITRD */ - -+ early_init_fdt_reserve_self(); -+ early_init_fdt_scan_reserved_mem(); -+ - unflatten_and_copy_device_tree(); - - setup_cpuinfo(); -diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c -index 86150fbb42c3..91e5c1758b5c 100644 ---- a/arch/powerpc/kernel/align.c -+++ b/arch/powerpc/kernel/align.c -@@ -808,14 +808,25 @@ int fix_alignment(struct pt_regs *regs) - nb = aligninfo[instr].len; - flags = aligninfo[instr].flags; - -- /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */ -- if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) { -- nb = 8; -- flags = LD+SW; -- } else if (IS_XFORM(instruction) && -- ((instruction >> 1) & 0x3ff) == 660) { -- nb = 8; -- flags = ST+SW; -+ /* -+ * Handle some cases which give overlaps in the DSISR values. -+ */ -+ if (IS_XFORM(instruction)) { -+ switch (get_xop(instruction)) { -+ case 532: /* ldbrx */ -+ nb = 8; -+ flags = LD+SW; -+ break; -+ case 660: /* stdbrx */ -+ nb = 8; -+ flags = ST+SW; -+ break; -+ case 20: /* lwarx */ -+ case 84: /* ldarx */ -+ case 116: /* lharx */ -+ case 276: /* lqarx */ -+ return 0; /* not emulated ever */ -+ } - } - - /* Byteswap little endian loads and stores */ -diff --git a/arch/powerpc/mm/hash_native_64.c b/arch/powerpc/mm/hash_native_64.c -index c8822af10a58..19d9b2d2d212 100644 ---- a/arch/powerpc/mm/hash_native_64.c -+++ b/arch/powerpc/mm/hash_native_64.c -@@ -645,6 +645,10 @@ static void native_flush_hash_range(unsigned long number, int local) - unsigned long psize = batch->psize; - int ssize = batch->ssize; - int i; -+ unsigned int use_local; -+ -+ use_local = local && mmu_has_feature(MMU_FTR_TLBIEL) && -+ mmu_psize_defs[psize].tlbiel && !cxl_ctx_in_use(); - - local_irq_save(flags); - -@@ -671,8 +675,7 @@ static void native_flush_hash_range(unsigned long number, int local) - } pte_iterate_hashed_end(); - } - -- if (mmu_has_feature(MMU_FTR_TLBIEL) && -- mmu_psize_defs[psize].tlbiel && local) { -+ if (use_local) { - asm volatile("ptesync":::"memory"); - for (i = 0; i < number; i++) { - vpn = batch->vpn[i]; -diff --git a/arch/s390/boot/compressed/misc.c b/arch/s390/boot/compressed/misc.c -index 4da604ebf6fd..ca15613eaaa4 100644 ---- a/arch/s390/boot/compressed/misc.c -+++ b/arch/s390/boot/compressed/misc.c -@@ -141,31 +141,34 @@ static void check_ipl_parmblock(void *start, unsigned long size) - - unsigned long decompress_kernel(void) - { -- unsigned long output_addr; -- unsigned char *output; -+ void *output, *kernel_end; - -- output_addr = ((unsigned long) &_end + HEAP_SIZE + 4095UL) & -4096UL; -- check_ipl_parmblock((void *) 0, output_addr + SZ__bss_start); -- memset(&_bss, 0, &_ebss - &_bss); -- free_mem_ptr = (unsigned long)&_end; -- free_mem_end_ptr = free_mem_ptr + HEAP_SIZE; -- output = (unsigned char *) output_addr; -+ output = (void *) ALIGN((unsigned long) &_end + HEAP_SIZE, PAGE_SIZE); -+ kernel_end = output + SZ__bss_start; -+ check_ipl_parmblock((void *) 0, (unsigned long) kernel_end); - - #ifdef CONFIG_BLK_DEV_INITRD - /* - * Move the initrd right behind the end of the decompressed -- * kernel image. -+ * kernel image. This also prevents initrd corruption caused by -+ * bss clearing since kernel_end will always be located behind the -+ * current bss section.. - */ -- if (INITRD_START && INITRD_SIZE && -- INITRD_START < (unsigned long) output + SZ__bss_start) { -- check_ipl_parmblock(output + SZ__bss_start, -- INITRD_START + INITRD_SIZE); -- memmove(output + SZ__bss_start, -- (void *) INITRD_START, INITRD_SIZE); -- INITRD_START = (unsigned long) output + SZ__bss_start; -+ if (INITRD_START && INITRD_SIZE && kernel_end > (void *) INITRD_START) { -+ check_ipl_parmblock(kernel_end, INITRD_SIZE); -+ memmove(kernel_end, (void *) INITRD_START, INITRD_SIZE); -+ INITRD_START = (unsigned long) kernel_end; - } - #endif - -+ /* -+ * Clear bss section. free_mem_ptr and free_mem_end_ptr need to be -+ * initialized afterwards since they reside in bss. -+ */ -+ memset(&_bss, 0, &_ebss - &_bss); -+ free_mem_ptr = (unsigned long) &_end; -+ free_mem_end_ptr = free_mem_ptr + HEAP_SIZE; -+ - puts("Uncompressing Linux... "); - __decompress(input_data, input_len, NULL, NULL, output, 0, NULL, error); - puts("Ok, booting the kernel.\n"); -diff --git a/arch/s390/include/asm/uaccess.h b/arch/s390/include/asm/uaccess.h -index 5c7381c5ad7f..c8d837f0fbbc 100644 ---- a/arch/s390/include/asm/uaccess.h -+++ b/arch/s390/include/asm/uaccess.h -@@ -150,7 +150,7 @@ unsigned long __must_check __copy_to_user(void __user *to, const void *from, - " jg 2b\n" \ - ".popsection\n" \ - EX_TABLE(0b,3b) EX_TABLE(1b,3b) \ -- : "=d" (__rc), "=Q" (*(to)) \ -+ : "=d" (__rc), "+Q" (*(to)) \ - : "d" (size), "Q" (*(from)), \ - "d" (__reg0), "K" (-EFAULT) \ - : "cc"); \ -diff --git a/drivers/gpu/drm/ttm/ttm_object.c b/drivers/gpu/drm/ttm/ttm_object.c -index 4f5fa8d65fe9..144367c0c28f 100644 ---- a/drivers/gpu/drm/ttm/ttm_object.c -+++ b/drivers/gpu/drm/ttm/ttm_object.c -@@ -179,7 +179,7 @@ int ttm_base_object_init(struct ttm_object_file *tfile, - if (unlikely(ret != 0)) - goto out_err0; - -- ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL); -+ ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false); - if (unlikely(ret != 0)) - goto out_err1; - -@@ -318,7 +318,8 @@ EXPORT_SYMBOL(ttm_ref_object_exists); - - int ttm_ref_object_add(struct ttm_object_file *tfile, - struct ttm_base_object *base, -- enum ttm_ref_type ref_type, bool *existed) -+ enum ttm_ref_type ref_type, bool *existed, -+ bool require_existed) - { - struct drm_open_hash *ht = &tfile->ref_hash[ref_type]; - struct ttm_ref_object *ref; -@@ -345,6 +346,9 @@ int ttm_ref_object_add(struct ttm_object_file *tfile, - } - - rcu_read_unlock(); -+ if (require_existed) -+ return -EPERM; -+ - ret = ttm_mem_global_alloc(mem_glob, sizeof(*ref), - false, false); - if (unlikely(ret != 0)) -@@ -635,7 +639,7 @@ int ttm_prime_fd_to_handle(struct ttm_object_file *tfile, - prime = (struct ttm_prime_object *) dma_buf->priv; - base = &prime->base; - *handle = base->hash.key; -- ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL); -+ ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, false); - - dma_buf_put(dma_buf); - -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -index 8e689b439890..6c649f7b5929 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c -@@ -539,7 +539,7 @@ int vmw_fence_create(struct vmw_fence_manager *fman, - struct vmw_fence_obj **p_fence) - { - struct vmw_fence_obj *fence; -- int ret; -+ int ret; - - fence = kzalloc(sizeof(*fence), GFP_KERNEL); - if (unlikely(fence == NULL)) -@@ -702,6 +702,41 @@ void vmw_fence_fifo_up(struct vmw_fence_manager *fman) - } - - -+/** -+ * vmw_fence_obj_lookup - Look up a user-space fence object -+ * -+ * @tfile: A struct ttm_object_file identifying the caller. -+ * @handle: A handle identifying the fence object. -+ * @return: A struct vmw_user_fence base ttm object on success or -+ * an error pointer on failure. -+ * -+ * The fence object is looked up and type-checked. The caller needs -+ * to have opened the fence object first, but since that happens on -+ * creation and fence objects aren't shareable, that's not an -+ * issue currently. -+ */ -+static struct ttm_base_object * -+vmw_fence_obj_lookup(struct ttm_object_file *tfile, u32 handle) -+{ -+ struct ttm_base_object *base = ttm_base_object_lookup(tfile, handle); -+ -+ if (!base) { -+ pr_err("Invalid fence object handle 0x%08lx.\n", -+ (unsigned long)handle); -+ return ERR_PTR(-EINVAL); -+ } -+ -+ if (base->refcount_release != vmw_user_fence_base_release) { -+ pr_err("Invalid fence object handle 0x%08lx.\n", -+ (unsigned long)handle); -+ ttm_base_object_unref(&base); -+ return ERR_PTR(-EINVAL); -+ } -+ -+ return base; -+} -+ -+ - int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data, - struct drm_file *file_priv) - { -@@ -727,13 +762,9 @@ int vmw_fence_obj_wait_ioctl(struct drm_device *dev, void *data, - arg->kernel_cookie = jiffies + wait_timeout; - } - -- base = ttm_base_object_lookup(tfile, arg->handle); -- if (unlikely(base == NULL)) { -- printk(KERN_ERR "Wait invalid fence object handle " -- "0x%08lx.\n", -- (unsigned long)arg->handle); -- return -EINVAL; -- } -+ base = vmw_fence_obj_lookup(tfile, arg->handle); -+ if (IS_ERR(base)) -+ return PTR_ERR(base); - - fence = &(container_of(base, struct vmw_user_fence, base)->fence); - -@@ -772,13 +803,9 @@ int vmw_fence_obj_signaled_ioctl(struct drm_device *dev, void *data, - struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; - struct vmw_private *dev_priv = vmw_priv(dev); - -- base = ttm_base_object_lookup(tfile, arg->handle); -- if (unlikely(base == NULL)) { -- printk(KERN_ERR "Fence signaled invalid fence object handle " -- "0x%08lx.\n", -- (unsigned long)arg->handle); -- return -EINVAL; -- } -+ base = vmw_fence_obj_lookup(tfile, arg->handle); -+ if (IS_ERR(base)) -+ return PTR_ERR(base); - - fence = &(container_of(base, struct vmw_user_fence, base)->fence); - fman = fman_from_fence(fence); -@@ -1093,6 +1120,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, - (struct drm_vmw_fence_event_arg *) data; - struct vmw_fence_obj *fence = NULL; - struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv); -+ struct ttm_object_file *tfile = vmw_fp->tfile; - struct drm_vmw_fence_rep __user *user_fence_rep = - (struct drm_vmw_fence_rep __user *)(unsigned long) - arg->fence_rep; -@@ -1106,24 +1134,18 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, - */ - if (arg->handle) { - struct ttm_base_object *base = -- ttm_base_object_lookup_for_ref(dev_priv->tdev, -- arg->handle); -- -- if (unlikely(base == NULL)) { -- DRM_ERROR("Fence event invalid fence object handle " -- "0x%08lx.\n", -- (unsigned long)arg->handle); -- return -EINVAL; -- } -+ vmw_fence_obj_lookup(tfile, arg->handle); -+ -+ if (IS_ERR(base)) -+ return PTR_ERR(base); -+ - fence = &(container_of(base, struct vmw_user_fence, - base)->fence); - (void) vmw_fence_obj_reference(fence); - - if (user_fence_rep != NULL) { -- bool existed; -- - ret = ttm_ref_object_add(vmw_fp->tfile, base, -- TTM_REF_USAGE, &existed); -+ TTM_REF_USAGE, NULL, false); - if (unlikely(ret != 0)) { - DRM_ERROR("Failed to reference a fence " - "object.\n"); -@@ -1166,8 +1188,7 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data, - return 0; - out_no_create: - if (user_fence_rep != NULL) -- ttm_ref_object_base_unref(vmw_fpriv(file_priv)->tfile, -- handle, TTM_REF_USAGE); -+ ttm_ref_object_base_unref(tfile, handle, TTM_REF_USAGE); - out_no_ref_obj: - vmw_fence_obj_unreference(&fence); - return ret; -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c -index b8c6a03c8c54..5ec24fd801cd 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_ioctl.c -@@ -114,8 +114,6 @@ int vmw_getparam_ioctl(struct drm_device *dev, void *data, - param->value = dev_priv->has_dx; - break; - default: -- DRM_ERROR("Illegal vmwgfx get param request: %d\n", -- param->param); - return -EINVAL; - } - -@@ -186,7 +184,7 @@ int vmw_get_cap_3d_ioctl(struct drm_device *dev, void *data, - bool gb_objects = !!(dev_priv->capabilities & SVGA_CAP_GBOBJECTS); - struct vmw_fpriv *vmw_fp = vmw_fpriv(file_priv); - -- if (unlikely(arg->pad64 != 0)) { -+ if (unlikely(arg->pad64 != 0 || arg->max_size == 0)) { - DRM_ERROR("Illegal GET_3D_CAP argument.\n"); - return -EINVAL; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -index e57667ca7557..dbca128a9aa6 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_resource.c -@@ -591,7 +591,7 @@ static int vmw_user_dmabuf_synccpu_grab(struct vmw_user_dma_buffer *user_bo, - return ret; - - ret = ttm_ref_object_add(tfile, &user_bo->prime.base, -- TTM_REF_SYNCCPU_WRITE, &existed); -+ TTM_REF_SYNCCPU_WRITE, &existed, false); - if (ret != 0 || existed) - ttm_bo_synccpu_write_release(&user_bo->dma.base); - -@@ -775,7 +775,7 @@ int vmw_user_dmabuf_reference(struct ttm_object_file *tfile, - - *handle = user_bo->prime.base.hash.key; - return ttm_ref_object_add(tfile, &user_bo->prime.base, -- TTM_REF_USAGE, NULL); -+ TTM_REF_USAGE, NULL, false); - } - - /* -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -index 7d620e82e000..c9c04ccccdd9 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -@@ -715,11 +715,14 @@ int vmw_surface_define_ioctl(struct drm_device *dev, void *data, - 128; - - num_sizes = 0; -- for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) -+ for (i = 0; i < DRM_VMW_MAX_SURFACE_FACES; ++i) { -+ if (req->mip_levels[i] > DRM_VMW_MAX_MIP_LEVELS) -+ return -EINVAL; - num_sizes += req->mip_levels[i]; -+ } - -- if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * -- DRM_VMW_MAX_MIP_LEVELS) -+ if (num_sizes > DRM_VMW_MAX_SURFACE_FACES * DRM_VMW_MAX_MIP_LEVELS || -+ num_sizes == 0) - return -EINVAL; - - size = vmw_user_surface_size + 128 + -@@ -904,17 +907,16 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv, - uint32_t handle; - struct ttm_base_object *base; - int ret; -+ bool require_exist = false; - - if (handle_type == DRM_VMW_HANDLE_PRIME) { - ret = ttm_prime_fd_to_handle(tfile, u_handle, &handle); - if (unlikely(ret != 0)) - return ret; - } else { -- if (unlikely(drm_is_render_client(file_priv))) { -- DRM_ERROR("Render client refused legacy " -- "surface reference.\n"); -- return -EACCES; -- } -+ if (unlikely(drm_is_render_client(file_priv))) -+ require_exist = true; -+ - if (ACCESS_ONCE(vmw_fpriv(file_priv)->locked_master)) { - DRM_ERROR("Locked master refused legacy " - "surface reference.\n"); -@@ -942,17 +944,14 @@ vmw_surface_handle_reference(struct vmw_private *dev_priv, - - /* - * Make sure the surface creator has the same -- * authenticating master. -+ * authenticating master, or is already registered with us. - */ - if (drm_is_primary_client(file_priv) && -- user_srf->master != file_priv->master) { -- DRM_ERROR("Trying to reference surface outside of" -- " master domain.\n"); -- ret = -EACCES; -- goto out_bad_resource; -- } -+ user_srf->master != file_priv->master) -+ require_exist = true; - -- ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL); -+ ret = ttm_ref_object_add(tfile, base, TTM_REF_USAGE, NULL, -+ require_exist); - if (unlikely(ret != 0)) { - DRM_ERROR("Could not add a reference to a surface.\n"); - goto out_bad_resource; -diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c -index acb3b303d800..90841abd3ce4 100644 ---- a/drivers/iio/gyro/bmg160_core.c -+++ b/drivers/iio/gyro/bmg160_core.c -@@ -28,6 +28,7 @@ - #include - #include - #include -+#include - #include "bmg160.h" - - #define BMG160_IRQ_NAME "bmg160_event" -@@ -53,6 +54,9 @@ - #define BMG160_NO_FILTER 0 - #define BMG160_DEF_BW 100 - -+#define BMG160_GYRO_REG_RESET 0x14 -+#define BMG160_GYRO_RESET_VAL 0xb6 -+ - #define BMG160_REG_INT_MAP_0 0x17 - #define BMG160_INT_MAP_0_BIT_ANY BIT(1) - -@@ -186,6 +190,14 @@ static int bmg160_chip_init(struct bmg160_data *data) - int ret; - unsigned int val; - -+ /* -+ * Reset chip to get it in a known good state. A delay of 30ms after -+ * reset is required according to the datasheet. -+ */ -+ regmap_write(data->regmap, BMG160_GYRO_REG_RESET, -+ BMG160_GYRO_RESET_VAL); -+ usleep_range(30000, 30700); -+ - ret = regmap_read(data->regmap, BMG160_REG_CHIP_ID, &val); - if (ret < 0) { - dev_err(data->dev, "Error reading reg_chip_id\n"); -diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c -index 3f2a3d611e4b..9c6357c03905 100644 ---- a/drivers/staging/android/ashmem.c -+++ b/drivers/staging/android/ashmem.c -@@ -392,6 +392,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma) - ret = PTR_ERR(vmfile); - goto out; - } -+ vmfile->f_mode |= FMODE_LSEEK; - asma->file = vmfile; - } - get_file(asma->file); -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 2fa754c5fd62..6cb5c4b30e78 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -952,6 +952,10 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, - return -EINVAL; - } - -+ /* SMB2 TREE_CONNECT request must be called with TreeId == 0 */ -+ if (tcon) -+ tcon->tid = 0; -+ - rc = small_smb2_init(SMB2_TREE_CONNECT, tcon, (void **) &req); - if (rc) { - kfree(unc_path); -diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c -index b803213d1307..39c75a86c67f 100644 ---- a/fs/sysfs/file.c -+++ b/fs/sysfs/file.c -@@ -108,7 +108,7 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf, - { - const struct sysfs_ops *ops = sysfs_file_ops(of->kn); - struct kobject *kobj = of->kn->parent->priv; -- size_t len; -+ ssize_t len; - - /* - * If buf != of->prealloc_buf, we don't know how -@@ -117,13 +117,15 @@ static ssize_t sysfs_kf_read(struct kernfs_open_file *of, char *buf, - if (WARN_ON_ONCE(buf != of->prealloc_buf)) - return 0; - len = ops->show(kobj, of->kn->priv, buf); -+ if (len < 0) -+ return len; - if (pos) { - if (len <= pos) - return 0; - len -= pos; - memmove(buf, buf + pos, len); - } -- return min(count, len); -+ return min_t(ssize_t, count, len); - } - - /* kernfs write callback for regular sysfs files */ -diff --git a/include/drm/ttm/ttm_object.h b/include/drm/ttm/ttm_object.h -index ed953f98f0e1..1487011fe057 100644 ---- a/include/drm/ttm/ttm_object.h -+++ b/include/drm/ttm/ttm_object.h -@@ -229,6 +229,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base); - * @ref_type: The type of reference. - * @existed: Upon completion, indicates that an identical reference object - * already existed, and the refcount was upped on that object instead. -+ * @require_existed: Fail with -EPERM if an identical ref object didn't -+ * already exist. - * - * Checks that the base object is shareable and adds a ref object to it. - * -@@ -243,7 +245,8 @@ extern void ttm_base_object_unref(struct ttm_base_object **p_base); - */ - extern int ttm_ref_object_add(struct ttm_object_file *tfile, - struct ttm_base_object *base, -- enum ttm_ref_type ref_type, bool *existed); -+ enum ttm_ref_type ref_type, bool *existed, -+ bool require_existed); - - extern bool ttm_ref_object_exists(struct ttm_object_file *tfile, - struct ttm_base_object *base); -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index a46c40bfb5f6..c7e8ed99c953 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -151,11 +151,17 @@ static void ptrace_unfreeze_traced(struct task_struct *task) - - WARN_ON(!task->ptrace || task->parent != current); - -+ /* -+ * PTRACE_LISTEN can allow ptrace_trap_notify to wake us up remotely. -+ * Recheck state under the lock to close this race. -+ */ - spin_lock_irq(&task->sighand->siglock); -- if (__fatal_signal_pending(task)) -- wake_up_state(task, __TASK_TRACED); -- else -- task->state = TASK_TRACED; -+ if (task->state == __TASK_TRACED) { -+ if (__fatal_signal_pending(task)) -+ wake_up_state(task, __TASK_TRACED); -+ else -+ task->state = TASK_TRACED; -+ } - spin_unlock_irq(&task->sighand->siglock); - } - -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index acbb0e73d3a2..7d7f99b0db47 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -4875,9 +4875,9 @@ static __init int test_ringbuffer(void) - rb_data[cpu].cnt = cpu; - rb_threads[cpu] = kthread_create(rb_test, &rb_data[cpu], - "rbtester/%d", cpu); -- if (WARN_ON(!rb_threads[cpu])) { -+ if (WARN_ON(IS_ERR(rb_threads[cpu]))) { - pr_cont("FAILED\n"); -- ret = -1; -+ ret = PTR_ERR(rb_threads[cpu]); - goto out_free; - } - -@@ -4887,9 +4887,9 @@ static __init int test_ringbuffer(void) - - /* Now create the rb hammer! */ - rb_hammer = kthread_run(rb_hammer_test, NULL, "rbhammer"); -- if (WARN_ON(!rb_hammer)) { -+ if (WARN_ON(IS_ERR(rb_hammer))) { - pr_cont("FAILED\n"); -- ret = -1; -+ ret = PTR_ERR(rb_hammer); - goto out_free; - } - -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index a4217fe60dff..e09b1a0e2cfe 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -1492,7 +1492,6 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy, - COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask, - compat_ulong_t, maxnode) - { -- long err = 0; - unsigned long __user *nm = NULL; - unsigned long nr_bits, alloc_size; - DECLARE_BITMAP(bm, MAX_NUMNODES); -@@ -1501,14 +1500,13 @@ COMPAT_SYSCALL_DEFINE3(set_mempolicy, int, mode, compat_ulong_t __user *, nmask, - alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8; - - if (nmask) { -- err = compat_get_bitmap(bm, nmask, nr_bits); -+ if (compat_get_bitmap(bm, nmask, nr_bits)) -+ return -EFAULT; - nm = compat_alloc_user_space(alloc_size); -- err |= copy_to_user(nm, bm, alloc_size); -+ if (copy_to_user(nm, bm, alloc_size)) -+ return -EFAULT; - } - -- if (err) -- return -EFAULT; -- - return sys_set_mempolicy(mode, nm, nr_bits+1); - } - -@@ -1516,7 +1514,6 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len, - compat_ulong_t, mode, compat_ulong_t __user *, nmask, - compat_ulong_t, maxnode, compat_ulong_t, flags) - { -- long err = 0; - unsigned long __user *nm = NULL; - unsigned long nr_bits, alloc_size; - nodemask_t bm; -@@ -1525,14 +1522,13 @@ COMPAT_SYSCALL_DEFINE6(mbind, compat_ulong_t, start, compat_ulong_t, len, - alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8; - - if (nmask) { -- err = compat_get_bitmap(nodes_addr(bm), nmask, nr_bits); -+ if (compat_get_bitmap(nodes_addr(bm), nmask, nr_bits)) -+ return -EFAULT; - nm = compat_alloc_user_space(alloc_size); -- err |= copy_to_user(nm, nodes_addr(bm), alloc_size); -+ if (copy_to_user(nm, nodes_addr(bm), alloc_size)) -+ return -EFAULT; - } - -- if (err) -- return -EFAULT; -- - return sys_mbind(start, len, mode, nm, nr_bits+1, flags); - } - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.61-62.patch b/patch/kernel/mvebu64-default/03-patch-4.4.61-62.patch deleted file mode 100644 index ee4be8e1fdc4..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.61-62.patch +++ /dev/null @@ -1,839 +0,0 @@ -diff --git a/Makefile b/Makefile -index ef5045b8201d..0309acc34472 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 61 -+SUBLEVEL = 62 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index 75bfca69e418..d5cfa937d622 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -9,6 +9,7 @@ config MIPS - select HAVE_CONTEXT_TRACKING - select HAVE_GENERIC_DMA_COHERENT - select HAVE_IDE -+ select HAVE_IRQ_EXIT_ON_IRQ_STACK - select HAVE_OPROFILE - select HAVE_PERF_EVENTS - select PERF_USE_VMALLOC -diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h -index 15e0fecbc300..ebb9efb02502 100644 ---- a/arch/mips/include/asm/irq.h -+++ b/arch/mips/include/asm/irq.h -@@ -17,6 +17,18 @@ - - #include - -+#define IRQ_STACK_SIZE THREAD_SIZE -+ -+extern void *irq_stack[NR_CPUS]; -+ -+static inline bool on_irq_stack(int cpu, unsigned long sp) -+{ -+ unsigned long low = (unsigned long)irq_stack[cpu]; -+ unsigned long high = low + IRQ_STACK_SIZE; -+ -+ return (low <= sp && sp <= high); -+} -+ - #ifdef CONFIG_I8259 - static inline int irq_canonicalize(int irq) - { -diff --git a/arch/mips/include/asm/stackframe.h b/arch/mips/include/asm/stackframe.h -index a71da576883c..5347f130f536 100644 ---- a/arch/mips/include/asm/stackframe.h -+++ b/arch/mips/include/asm/stackframe.h -@@ -216,12 +216,19 @@ - LONG_S $25, PT_R25(sp) - LONG_S $28, PT_R28(sp) - LONG_S $31, PT_R31(sp) -+ -+ /* Set thread_info if we're coming from user mode */ -+ mfc0 k0, CP0_STATUS -+ sll k0, 3 /* extract cu0 bit */ -+ bltz k0, 9f -+ - ori $28, sp, _THREAD_MASK - xori $28, _THREAD_MASK - #ifdef CONFIG_CPU_CAVIUM_OCTEON - .set mips64 - pref 0, 0($28) /* Prefetch the current pointer */ - #endif -+9: - .set pop - .endm - -diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c -index 154e2039ea5e..ec053ce7bb38 100644 ---- a/arch/mips/kernel/asm-offsets.c -+++ b/arch/mips/kernel/asm-offsets.c -@@ -101,6 +101,7 @@ void output_thread_info_defines(void) - OFFSET(TI_REGS, thread_info, regs); - DEFINE(_THREAD_SIZE, THREAD_SIZE); - DEFINE(_THREAD_MASK, THREAD_MASK); -+ DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE); - BLANK(); - } - -diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S -index baa7b6fc0a60..619e30e2c4f0 100644 ---- a/arch/mips/kernel/genex.S -+++ b/arch/mips/kernel/genex.S -@@ -188,9 +188,44 @@ NESTED(handle_int, PT_SIZE, sp) - - LONG_L s0, TI_REGS($28) - LONG_S sp, TI_REGS($28) -- PTR_LA ra, ret_from_irq -- PTR_LA v0, plat_irq_dispatch -- jr v0 -+ -+ /* -+ * SAVE_ALL ensures we are using a valid kernel stack for the thread. -+ * Check if we are already using the IRQ stack. -+ */ -+ move s1, sp # Preserve the sp -+ -+ /* Get IRQ stack for this CPU */ -+ ASM_CPUID_MFC0 k0, ASM_SMP_CPUID_REG -+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32) -+ lui k1, %hi(irq_stack) -+#else -+ lui k1, %highest(irq_stack) -+ daddiu k1, %higher(irq_stack) -+ dsll k1, 16 -+ daddiu k1, %hi(irq_stack) -+ dsll k1, 16 -+#endif -+ LONG_SRL k0, SMP_CPUID_PTRSHIFT -+ LONG_ADDU k1, k0 -+ LONG_L t0, %lo(irq_stack)(k1) -+ -+ # Check if already on IRQ stack -+ PTR_LI t1, ~(_THREAD_SIZE-1) -+ and t1, t1, sp -+ beq t0, t1, 2f -+ -+ /* Switch to IRQ stack */ -+ li t1, _IRQ_STACK_SIZE -+ PTR_ADD sp, t0, t1 -+ -+2: -+ jal plat_irq_dispatch -+ -+ /* Restore sp */ -+ move sp, s1 -+ -+ j ret_from_irq - #ifdef CONFIG_CPU_MICROMIPS - nop - #endif -@@ -263,8 +298,44 @@ NESTED(except_vec_vi_handler, 0, sp) - - LONG_L s0, TI_REGS($28) - LONG_S sp, TI_REGS($28) -- PTR_LA ra, ret_from_irq -- jr v0 -+ -+ /* -+ * SAVE_ALL ensures we are using a valid kernel stack for the thread. -+ * Check if we are already using the IRQ stack. -+ */ -+ move s1, sp # Preserve the sp -+ -+ /* Get IRQ stack for this CPU */ -+ ASM_CPUID_MFC0 k0, ASM_SMP_CPUID_REG -+#if defined(CONFIG_32BIT) || defined(KBUILD_64BIT_SYM32) -+ lui k1, %hi(irq_stack) -+#else -+ lui k1, %highest(irq_stack) -+ daddiu k1, %higher(irq_stack) -+ dsll k1, 16 -+ daddiu k1, %hi(irq_stack) -+ dsll k1, 16 -+#endif -+ LONG_SRL k0, SMP_CPUID_PTRSHIFT -+ LONG_ADDU k1, k0 -+ LONG_L t0, %lo(irq_stack)(k1) -+ -+ # Check if already on IRQ stack -+ PTR_LI t1, ~(_THREAD_SIZE-1) -+ and t1, t1, sp -+ beq t0, t1, 2f -+ -+ /* Switch to IRQ stack */ -+ li t1, _IRQ_STACK_SIZE -+ PTR_ADD sp, t0, t1 -+ -+2: -+ jalr v0 -+ -+ /* Restore sp */ -+ move sp, s1 -+ -+ j ret_from_irq - END(except_vec_vi_handler) - - /* -diff --git a/arch/mips/kernel/irq.c b/arch/mips/kernel/irq.c -index 8eb5af805964..dc1180a8bfa1 100644 ---- a/arch/mips/kernel/irq.c -+++ b/arch/mips/kernel/irq.c -@@ -25,6 +25,8 @@ - #include - #include - -+void *irq_stack[NR_CPUS]; -+ - /* - * 'what should we do if we get a hw irq event on an illegal vector'. - * each architecture has to answer this themselves. -@@ -55,6 +57,15 @@ void __init init_IRQ(void) - irq_set_noprobe(i); - - arch_init_irq(); -+ -+ for_each_possible_cpu(i) { -+ int irq_pages = IRQ_STACK_SIZE / PAGE_SIZE; -+ void *s = (void *)__get_free_pages(GFP_KERNEL, irq_pages); -+ -+ irq_stack[i] = s; -+ pr_debug("CPU%d IRQ stack at 0x%p - 0x%p\n", i, -+ irq_stack[i], irq_stack[i] + IRQ_STACK_SIZE); -+ } - } - - #ifdef CONFIG_DEBUG_STACKOVERFLOW -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index fc537d1b649d..8c26ecac930d 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -552,7 +553,19 @@ EXPORT_SYMBOL(unwind_stack_by_address); - unsigned long unwind_stack(struct task_struct *task, unsigned long *sp, - unsigned long pc, unsigned long *ra) - { -- unsigned long stack_page = (unsigned long)task_stack_page(task); -+ unsigned long stack_page = 0; -+ int cpu; -+ -+ for_each_possible_cpu(cpu) { -+ if (on_irq_stack(cpu, *sp)) { -+ stack_page = (unsigned long)irq_stack[cpu]; -+ break; -+ } -+ } -+ -+ if (!stack_page) -+ stack_page = (unsigned long)task_stack_page(task); -+ - return unwind_stack_by_address(stack_page, sp, pc, ra); - } - #endif -diff --git a/block/blk-mq.c b/block/blk-mq.c -index d8d63c38bf29..0d1af3e44efb 100644 ---- a/block/blk-mq.c -+++ b/block/blk-mq.c -@@ -1470,7 +1470,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set, - INIT_LIST_HEAD(&tags->page_list); - - tags->rqs = kzalloc_node(set->queue_depth * sizeof(struct request *), -- GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY, -+ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY, - set->numa_node); - if (!tags->rqs) { - blk_mq_free_tags(tags); -@@ -1496,7 +1496,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set, - - do { - page = alloc_pages_node(set->numa_node, -- GFP_KERNEL | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO, -+ GFP_NOIO | __GFP_NOWARN | __GFP_NORETRY | __GFP_ZERO, - this_order); - if (page) - break; -@@ -1517,7 +1517,7 @@ static struct blk_mq_tags *blk_mq_init_rq_map(struct blk_mq_tag_set *set, - * Allow kmemleak to scan these pages as they contain pointers - * to additional allocations like via ops->init_request(). - */ -- kmemleak_alloc(p, order_to_size(this_order), 1, GFP_KERNEL); -+ kmemleak_alloc(p, order_to_size(this_order), 1, GFP_NOIO); - entries_per_page = order_to_size(this_order) / rq_size; - to_do = min(entries_per_page, set->queue_depth - i); - left -= to_do * rq_size; -diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c -index 69d4a1326fee..53e61459c69f 100644 ---- a/drivers/crypto/caam/ctrl.c -+++ b/drivers/crypto/caam/ctrl.c -@@ -278,7 +278,8 @@ static int deinstantiate_rng(struct device *ctrldev, int state_handle_mask) - /* Try to run it through DECO0 */ - ret = run_descriptor_deco0(ctrldev, desc, &status); - -- if (ret || status) { -+ if (ret || -+ (status && status != JRSTA_SSRC_JUMP_HALT_CC)) { - dev_err(ctrldev, - "Failed to deinstantiate RNG4 SH%d\n", - sh_idx); -diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h -index fb9f647bb5cd..5044f2257e89 100644 ---- a/drivers/gpu/drm/i915/i915_drv.h -+++ b/drivers/gpu/drm/i915/i915_drv.h -@@ -1159,7 +1159,7 @@ struct intel_gen6_power_mgmt { - struct intel_rps_client semaphores, mmioflips; - - /* manual wa residency calculations */ -- struct intel_rps_ei up_ei, down_ei; -+ struct intel_rps_ei ei; - - /* - * Protects RPS/RC6 register access and PCU communication. -diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c -index 0f42a2782afc..b7b0a38acd67 100644 ---- a/drivers/gpu/drm/i915/i915_irq.c -+++ b/drivers/gpu/drm/i915/i915_irq.c -@@ -994,68 +994,51 @@ static void vlv_c0_read(struct drm_i915_private *dev_priv, - ei->media_c0 = I915_READ(VLV_MEDIA_C0_COUNT); - } - --static bool vlv_c0_above(struct drm_i915_private *dev_priv, -- const struct intel_rps_ei *old, -- const struct intel_rps_ei *now, -- int threshold) --{ -- u64 time, c0; -- unsigned int mul = 100; -- -- if (old->cz_clock == 0) -- return false; -- -- if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH) -- mul <<= 8; -- -- time = now->cz_clock - old->cz_clock; -- time *= threshold * dev_priv->czclk_freq; -- -- /* Workload can be split between render + media, e.g. SwapBuffers -- * being blitted in X after being rendered in mesa. To account for -- * this we need to combine both engines into our activity counter. -- */ -- c0 = now->render_c0 - old->render_c0; -- c0 += now->media_c0 - old->media_c0; -- c0 *= mul * VLV_CZ_CLOCK_TO_MILLI_SEC; -- -- return c0 >= time; --} -- - void gen6_rps_reset_ei(struct drm_i915_private *dev_priv) - { -- vlv_c0_read(dev_priv, &dev_priv->rps.down_ei); -- dev_priv->rps.up_ei = dev_priv->rps.down_ei; -+ memset(&dev_priv->rps.ei, 0, sizeof(dev_priv->rps.ei)); - } - - static u32 vlv_wa_c0_ei(struct drm_i915_private *dev_priv, u32 pm_iir) - { -+ const struct intel_rps_ei *prev = &dev_priv->rps.ei; - struct intel_rps_ei now; - u32 events = 0; - -- if ((pm_iir & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) == 0) -+ if ((pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) == 0) - return 0; - - vlv_c0_read(dev_priv, &now); - if (now.cz_clock == 0) - return 0; - -- if (pm_iir & GEN6_PM_RP_DOWN_EI_EXPIRED) { -- if (!vlv_c0_above(dev_priv, -- &dev_priv->rps.down_ei, &now, -- dev_priv->rps.down_threshold)) -- events |= GEN6_PM_RP_DOWN_THRESHOLD; -- dev_priv->rps.down_ei = now; -- } -+ if (prev->cz_clock) { -+ u64 time, c0; -+ unsigned int mul; - -- if (pm_iir & GEN6_PM_RP_UP_EI_EXPIRED) { -- if (vlv_c0_above(dev_priv, -- &dev_priv->rps.up_ei, &now, -- dev_priv->rps.up_threshold)) -- events |= GEN6_PM_RP_UP_THRESHOLD; -- dev_priv->rps.up_ei = now; -+ mul = VLV_CZ_CLOCK_TO_MILLI_SEC * 100; /* scale to threshold% */ -+ if (I915_READ(VLV_COUNTER_CONTROL) & VLV_COUNT_RANGE_HIGH) -+ mul <<= 8; -+ -+ time = now.cz_clock - prev->cz_clock; -+ time *= dev_priv->czclk_freq; -+ -+ /* Workload can be split between render + media, -+ * e.g. SwapBuffers being blitted in X after being rendered in -+ * mesa. To account for this we need to combine both engines -+ * into our activity counter. -+ */ -+ c0 = now.render_c0 - prev->render_c0; -+ c0 += now.media_c0 - prev->media_c0; -+ c0 *= mul; -+ -+ if (c0 > time * dev_priv->rps.up_threshold) -+ events = GEN6_PM_RP_UP_THRESHOLD; -+ else if (c0 < time * dev_priv->rps.down_threshold) -+ events = GEN6_PM_RP_DOWN_THRESHOLD; - } - -+ dev_priv->rps.ei = now; - return events; - } - -@@ -4390,7 +4373,7 @@ void intel_irq_init(struct drm_i915_private *dev_priv) - /* Let's track the enabled rps events */ - if (IS_VALLEYVIEW(dev_priv) && !IS_CHERRYVIEW(dev_priv)) - /* WaGsvRC0ResidencyMethod:vlv */ -- dev_priv->pm_rps_events = GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED; -+ dev_priv->pm_rps_events = GEN6_PM_RP_UP_EI_EXPIRED; - else - dev_priv->pm_rps_events = GEN6_PM_RPS_EVENTS; - -diff --git a/drivers/gpu/drm/i915/intel_pm.c b/drivers/gpu/drm/i915/intel_pm.c -index e7c18519274a..fd4690ed93c0 100644 ---- a/drivers/gpu/drm/i915/intel_pm.c -+++ b/drivers/gpu/drm/i915/intel_pm.c -@@ -4376,6 +4376,12 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val) - break; - } - -+ /* When byt can survive without system hang with dynamic -+ * sw freq adjustments, this restriction can be lifted. -+ */ -+ if (IS_VALLEYVIEW(dev_priv)) -+ goto skip_hw_write; -+ - I915_WRITE(GEN6_RP_UP_EI, - GT_INTERVAL_FROM_US(dev_priv, ei_up)); - I915_WRITE(GEN6_RP_UP_THRESHOLD, -@@ -4394,6 +4400,7 @@ static void gen6_set_rps_thresholds(struct drm_i915_private *dev_priv, u8 val) - GEN6_RP_UP_BUSY_AVG | - GEN6_RP_DOWN_IDLE_AVG); - -+skip_hw_write: - dev_priv->rps.power = new_power; - dev_priv->rps.up_threshold = threshold_up; - dev_priv->rps.down_threshold = threshold_down; -@@ -4404,8 +4411,9 @@ static u32 gen6_rps_pm_mask(struct drm_i915_private *dev_priv, u8 val) - { - u32 mask = 0; - -+ /* We use UP_EI_EXPIRED interupts for both up/down in manual mode */ - if (val > dev_priv->rps.min_freq_softlimit) -- mask |= GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT; -+ mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_DOWN_THRESHOLD | GEN6_PM_RP_DOWN_TIMEOUT; - if (val < dev_priv->rps.max_freq_softlimit) - mask |= GEN6_PM_RP_UP_EI_EXPIRED | GEN6_PM_RP_UP_THRESHOLD; - -@@ -4509,7 +4517,7 @@ void gen6_rps_busy(struct drm_i915_private *dev_priv) - { - mutex_lock(&dev_priv->rps.hw_lock); - if (dev_priv->rps.enabled) { -- if (dev_priv->pm_rps_events & (GEN6_PM_RP_DOWN_EI_EXPIRED | GEN6_PM_RP_UP_EI_EXPIRED)) -+ if (dev_priv->pm_rps_events & GEN6_PM_RP_UP_EI_EXPIRED) - gen6_rps_reset_ei(dev_priv); - I915_WRITE(GEN6_PMINTRMSK, - gen6_rps_pm_mask(dev_priv, dev_priv->rps.cur_freq)); -diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c -index c0720c1ee4c9..5abab8800891 100644 ---- a/drivers/mtd/bcm47xxpart.c -+++ b/drivers/mtd/bcm47xxpart.c -@@ -225,12 +225,10 @@ static int bcm47xxpart_parse(struct mtd_info *master, - - last_trx_part = curr_part - 1; - -- /* -- * We have whole TRX scanned, skip to the next part. Use -- * roundown (not roundup), as the loop will increase -- * offset in next step. -- */ -- offset = rounddown(offset + trx->length, blocksize); -+ /* Jump to the end of TRX */ -+ offset = roundup(offset + trx->length, blocksize); -+ /* Next loop iteration will increase the offset */ -+ offset -= blocksize; - continue; - } - -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 7af870a3c549..855c43d8f7e0 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -58,7 +58,7 @@ static struct kobj_type ktype_veth_pool; - - static const char ibmveth_driver_name[] = "ibmveth"; - static const char ibmveth_driver_string[] = "IBM Power Virtual Ethernet Driver"; --#define ibmveth_driver_version "1.05" -+#define ibmveth_driver_version "1.06" - - MODULE_AUTHOR("Santiago Leon "); - MODULE_DESCRIPTION("IBM Power Virtual Ethernet Driver"); -@@ -137,6 +137,11 @@ static inline int ibmveth_rxq_frame_offset(struct ibmveth_adapter *adapter) - return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_OFF_MASK; - } - -+static inline int ibmveth_rxq_large_packet(struct ibmveth_adapter *adapter) -+{ -+ return ibmveth_rxq_flags(adapter) & IBMVETH_RXQ_LRG_PKT; -+} -+ - static inline int ibmveth_rxq_frame_length(struct ibmveth_adapter *adapter) - { - return be32_to_cpu(adapter->rx_queue.queue_addr[adapter->rx_queue.index].length); -@@ -1172,6 +1177,45 @@ map_failed: - goto retry_bounce; - } - -+static void ibmveth_rx_mss_helper(struct sk_buff *skb, u16 mss, int lrg_pkt) -+{ -+ int offset = 0; -+ -+ /* only TCP packets will be aggregated */ -+ if (skb->protocol == htons(ETH_P_IP)) { -+ struct iphdr *iph = (struct iphdr *)skb->data; -+ -+ if (iph->protocol == IPPROTO_TCP) { -+ offset = iph->ihl * 4; -+ skb_shinfo(skb)->gso_type = SKB_GSO_TCPV4; -+ } else { -+ return; -+ } -+ } else if (skb->protocol == htons(ETH_P_IPV6)) { -+ struct ipv6hdr *iph6 = (struct ipv6hdr *)skb->data; -+ -+ if (iph6->nexthdr == IPPROTO_TCP) { -+ offset = sizeof(struct ipv6hdr); -+ skb_shinfo(skb)->gso_type = SKB_GSO_TCPV6; -+ } else { -+ return; -+ } -+ } else { -+ return; -+ } -+ /* if mss is not set through Large Packet bit/mss in rx buffer, -+ * expect that the mss will be written to the tcp header checksum. -+ */ -+ if (lrg_pkt) { -+ skb_shinfo(skb)->gso_size = mss; -+ } else if (offset) { -+ struct tcphdr *tcph = (struct tcphdr *)(skb->data + offset); -+ -+ skb_shinfo(skb)->gso_size = ntohs(tcph->check); -+ tcph->check = 0; -+ } -+} -+ - static int ibmveth_poll(struct napi_struct *napi, int budget) - { - struct ibmveth_adapter *adapter = -@@ -1180,6 +1224,7 @@ static int ibmveth_poll(struct napi_struct *napi, int budget) - int frames_processed = 0; - unsigned long lpar_rc; - struct iphdr *iph; -+ u16 mss = 0; - - restart_poll: - while (frames_processed < budget) { -@@ -1197,9 +1242,21 @@ restart_poll: - int length = ibmveth_rxq_frame_length(adapter); - int offset = ibmveth_rxq_frame_offset(adapter); - int csum_good = ibmveth_rxq_csum_good(adapter); -+ int lrg_pkt = ibmveth_rxq_large_packet(adapter); - - skb = ibmveth_rxq_get_buffer(adapter); - -+ /* if the large packet bit is set in the rx queue -+ * descriptor, the mss will be written by PHYP eight -+ * bytes from the start of the rx buffer, which is -+ * skb->data at this stage -+ */ -+ if (lrg_pkt) { -+ __be64 *rxmss = (__be64 *)(skb->data + 8); -+ -+ mss = (u16)be64_to_cpu(*rxmss); -+ } -+ - new_skb = NULL; - if (length < rx_copybreak) - new_skb = netdev_alloc_skb(netdev, length); -@@ -1233,11 +1290,15 @@ restart_poll: - if (iph->check == 0xffff) { - iph->check = 0; - iph->check = ip_fast_csum((unsigned char *)iph, iph->ihl); -- adapter->rx_large_packets++; - } - } - } - -+ if (length > netdev->mtu + ETH_HLEN) { -+ ibmveth_rx_mss_helper(skb, mss, lrg_pkt); -+ adapter->rx_large_packets++; -+ } -+ - napi_gro_receive(napi, skb); /* send it up */ - - netdev->stats.rx_packets++; -diff --git a/drivers/net/ethernet/ibm/ibmveth.h b/drivers/net/ethernet/ibm/ibmveth.h -index 4eade67fe30c..7acda04d034e 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.h -+++ b/drivers/net/ethernet/ibm/ibmveth.h -@@ -209,6 +209,7 @@ struct ibmveth_rx_q_entry { - #define IBMVETH_RXQ_TOGGLE 0x80000000 - #define IBMVETH_RXQ_TOGGLE_SHIFT 31 - #define IBMVETH_RXQ_VALID 0x40000000 -+#define IBMVETH_RXQ_LRG_PKT 0x04000000 - #define IBMVETH_RXQ_NO_CSUM 0x02000000 - #define IBMVETH_RXQ_CSUM_GOOD 0x01000000 - #define IBMVETH_RXQ_OFF_MASK 0x0000FFFF -diff --git a/drivers/net/ethernet/mellanox/mlx4/cq.c b/drivers/net/ethernet/mellanox/mlx4/cq.c -index 3348e646db70..6eba58044456 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/cq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/cq.c -@@ -101,13 +101,19 @@ void mlx4_cq_completion(struct mlx4_dev *dev, u32 cqn) - { - struct mlx4_cq *cq; - -+ rcu_read_lock(); - cq = radix_tree_lookup(&mlx4_priv(dev)->cq_table.tree, - cqn & (dev->caps.num_cqs - 1)); -+ rcu_read_unlock(); -+ - if (!cq) { - mlx4_dbg(dev, "Completion event for bogus CQ %08x\n", cqn); - return; - } - -+ /* Acessing the CQ outside of rcu_read_lock is safe, because -+ * the CQ is freed only after interrupt handling is completed. -+ */ - ++cq->arm_sn; - - cq->comp(cq); -@@ -118,23 +124,19 @@ void mlx4_cq_event(struct mlx4_dev *dev, u32 cqn, int event_type) - struct mlx4_cq_table *cq_table = &mlx4_priv(dev)->cq_table; - struct mlx4_cq *cq; - -- spin_lock(&cq_table->lock); -- -+ rcu_read_lock(); - cq = radix_tree_lookup(&cq_table->tree, cqn & (dev->caps.num_cqs - 1)); -- if (cq) -- atomic_inc(&cq->refcount); -- -- spin_unlock(&cq_table->lock); -+ rcu_read_unlock(); - - if (!cq) { -- mlx4_warn(dev, "Async event for bogus CQ %08x\n", cqn); -+ mlx4_dbg(dev, "Async event for bogus CQ %08x\n", cqn); - return; - } - -+ /* Acessing the CQ outside of rcu_read_lock is safe, because -+ * the CQ is freed only after interrupt handling is completed. -+ */ - cq->event(cq, event_type); -- -- if (atomic_dec_and_test(&cq->refcount)) -- complete(&cq->free); - } - - static int mlx4_SW2HW_CQ(struct mlx4_dev *dev, struct mlx4_cmd_mailbox *mailbox, -@@ -301,9 +303,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, - if (err) - return err; - -- spin_lock_irq(&cq_table->lock); -+ spin_lock(&cq_table->lock); - err = radix_tree_insert(&cq_table->tree, cq->cqn, cq); -- spin_unlock_irq(&cq_table->lock); -+ spin_unlock(&cq_table->lock); - if (err) - goto err_icm; - -@@ -347,9 +349,9 @@ int mlx4_cq_alloc(struct mlx4_dev *dev, int nent, - return 0; - - err_radix: -- spin_lock_irq(&cq_table->lock); -+ spin_lock(&cq_table->lock); - radix_tree_delete(&cq_table->tree, cq->cqn); -- spin_unlock_irq(&cq_table->lock); -+ spin_unlock(&cq_table->lock); - - err_icm: - mlx4_cq_free_icm(dev, cq->cqn); -@@ -368,15 +370,15 @@ void mlx4_cq_free(struct mlx4_dev *dev, struct mlx4_cq *cq) - if (err) - mlx4_warn(dev, "HW2SW_CQ failed (%d) for CQN %06x\n", err, cq->cqn); - -+ spin_lock(&cq_table->lock); -+ radix_tree_delete(&cq_table->tree, cq->cqn); -+ spin_unlock(&cq_table->lock); -+ - synchronize_irq(priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq); - if (priv->eq_table.eq[MLX4_CQ_TO_EQ_VECTOR(cq->vector)].irq != - priv->eq_table.eq[MLX4_EQ_ASYNC].irq) - synchronize_irq(priv->eq_table.eq[MLX4_EQ_ASYNC].irq); - -- spin_lock_irq(&cq_table->lock); -- radix_tree_delete(&cq_table->tree, cq->cqn); -- spin_unlock_irq(&cq_table->lock); -- - if (atomic_dec_and_test(&cq->refcount)) - complete(&cq->free); - wait_for_completion(&cq->free); -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -index 28a4b34310b2..82bf1b539d87 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -@@ -439,8 +439,14 @@ int mlx4_en_activate_rx_rings(struct mlx4_en_priv *priv) - ring->cqn = priv->rx_cq[ring_ind]->mcq.cqn; - - ring->stride = stride; -- if (ring->stride <= TXBB_SIZE) -+ if (ring->stride <= TXBB_SIZE) { -+ /* Stamp first unused send wqe */ -+ __be32 *ptr = (__be32 *)ring->buf; -+ __be32 stamp = cpu_to_be32(1 << STAMP_SHIFT); -+ *ptr = stamp; -+ /* Move pointer to start of rx section */ - ring->buf += TXBB_SIZE; -+ } - - ring->log_stride = ffs(ring->stride) - 1; - ring->buf_size = ring->size * ring->stride; -diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -index d314d96dcb1c..d1fc7fa87b05 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c -@@ -2955,6 +2955,9 @@ int mlx4_RST2INIT_QP_wrapper(struct mlx4_dev *dev, int slave, - put_res(dev, slave, srqn, RES_SRQ); - qp->srq = srq; - } -+ -+ /* Save param3 for dynamic changes from VST back to VGT */ -+ qp->param3 = qpc->param3; - put_res(dev, slave, rcqn, RES_CQ); - put_res(dev, slave, mtt_base, RES_MTT); - res_end_move(dev, slave, RES_QP, qpn); -@@ -3747,7 +3750,6 @@ int mlx4_INIT2RTR_QP_wrapper(struct mlx4_dev *dev, int slave, - int qpn = vhcr->in_modifier & 0x7fffff; - struct res_qp *qp; - u8 orig_sched_queue; -- __be32 orig_param3 = qpc->param3; - u8 orig_vlan_control = qpc->pri_path.vlan_control; - u8 orig_fvl_rx = qpc->pri_path.fvl_rx; - u8 orig_pri_path_fl = qpc->pri_path.fl; -@@ -3789,7 +3791,6 @@ out: - */ - if (!err) { - qp->sched_queue = orig_sched_queue; -- qp->param3 = orig_param3; - qp->vlan_control = orig_vlan_control; - qp->fvl_rx = orig_fvl_rx; - qp->pri_path_fl = orig_pri_path_fl; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 9e62c93af96e..7c2d87befb51 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2602,8 +2602,15 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1, - if (ret < 0) - return ret; - -- /* The port state is unknown until the reset completes. */ -- if (!(portstatus & USB_PORT_STAT_RESET)) -+ /* -+ * The port state is unknown until the reset completes. -+ * -+ * On top of that, some chips may require additional time -+ * to re-establish a connection after the reset is complete, -+ * so also wait for the connection to be re-established. -+ */ -+ if (!(portstatus & USB_PORT_STAT_RESET) && -+ (portstatus & USB_PORT_STAT_CONNECTION)) - break; - - /* switch to the long delay after two short delay failures */ -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index 210ff64857e1..ec7a50f98f57 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -235,6 +235,7 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, - int status) - { - struct dwc3 *dwc = dep->dwc; -+ unsigned int unmap_after_complete = false; - int i; - - if (req->queued) { -@@ -259,11 +260,19 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, - if (req->request.status == -EINPROGRESS) - req->request.status = status; - -- if (dwc->ep0_bounced && dep->number <= 1) -+ /* -+ * NOTICE we don't want to unmap before calling ->complete() if we're -+ * dealing with a bounced ep0 request. If we unmap it here, we would end -+ * up overwritting the contents of req->buf and this could confuse the -+ * gadget driver. -+ */ -+ if (dwc->ep0_bounced && dep->number <= 1) { - dwc->ep0_bounced = false; -- -- usb_gadget_unmap_request(&dwc->gadget, &req->request, -- req->direction); -+ unmap_after_complete = true; -+ } else { -+ usb_gadget_unmap_request(&dwc->gadget, -+ &req->request, req->direction); -+ } - - dev_dbg(dwc->dev, "request %p from %s completed %d/%d ===> %d\n", - req, dep->name, req->request.actual, -@@ -282,6 +282,10 @@ void dwc3_gadget_giveback(struct dwc3_ep *dep, struct dwc3_request *req, - spin_unlock(&dwc->lock); - usb_gadget_giveback_request(&dep->endpoint, &req->request); - spin_lock(&dwc->lock); -+ -+ if (unmap_after_complete) -+ usb_gadget_unmap_request(&dwc->gadget, -+ &req->request, req->direction); - } - - int dwc3_send_gadget_generic_command(struct dwc3 *dwc, unsigned cmd, u32 param) -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 3975ac809934..d76800108ddb 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4138,8 +4138,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - if (unlikely(!PAGE_ALIGNED(req->tp_block_size))) - goto out; - if (po->tp_version >= TPACKET_V3 && -- (int)(req->tp_block_size - -- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) -+ req->tp_block_size <= -+ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) - goto out; - if (unlikely(req->tp_frame_size < po->tp_hdrlen + - po->tp_reserve)) diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.62-63.patch b/patch/kernel/mvebu64-default/03-patch-4.4.62-63.patch deleted file mode 100644 index 74a615c79b30..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.62-63.patch +++ /dev/null @@ -1,1801 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0309acc34472..ec52973043f6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 62 -+SUBLEVEL = 63 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig -index d5cfa937d622..8b0424abc84c 100644 ---- a/arch/mips/Kconfig -+++ b/arch/mips/Kconfig -@@ -1413,7 +1413,7 @@ config CPU_MIPS32_R6 - select CPU_SUPPORTS_MSA - select GENERIC_CSUM - select HAVE_KVM -- select MIPS_O32_FP64_SUPPORT if 32BIT -+ select MIPS_O32_FP64_SUPPORT - help - Choose this option to build a kernel for release 6 or later of the - MIPS32 architecture. New MIPS processors, starting with the Warrior -@@ -1464,7 +1464,7 @@ config CPU_MIPS64_R6 - select CPU_SUPPORTS_HIGHMEM - select CPU_SUPPORTS_MSA - select GENERIC_CSUM -- select MIPS_O32_FP64_SUPPORT if MIPS32_O32 -+ select MIPS_O32_FP64_SUPPORT if 32BIT || MIPS32_O32 - help - Choose this option to build a kernel for release 6 or later of the - MIPS64 architecture. New MIPS processors, starting with the Warrior -diff --git a/arch/mips/lantiq/irq.c b/arch/mips/lantiq/irq.c -index 51cdc46a87e2..2e7f60c9fc5d 100644 ---- a/arch/mips/lantiq/irq.c -+++ b/arch/mips/lantiq/irq.c -@@ -269,11 +269,6 @@ static void ltq_hw5_irqdispatch(void) - DEFINE_HWx_IRQDISPATCH(5) - #endif - --static void ltq_hw_irq_handler(struct irq_desc *desc) --{ -- ltq_hw_irqdispatch(irq_desc_get_irq(desc) - 2); --} -- - #ifdef CONFIG_MIPS_MT_SMP - void __init arch_init_ipiirq(int irq, struct irqaction *action) - { -@@ -318,19 +313,23 @@ static struct irqaction irq_call = { - asmlinkage void plat_irq_dispatch(void) - { - unsigned int pending = read_c0_status() & read_c0_cause() & ST0_IM; -- int irq; -- -- if (!pending) { -- spurious_interrupt(); -- return; -+ unsigned int i; -+ -+ if ((MIPS_CPU_TIMER_IRQ == 7) && (pending & CAUSEF_IP7)) { -+ do_IRQ(MIPS_CPU_TIMER_IRQ); -+ goto out; -+ } else { -+ for (i = 0; i < MAX_IM; i++) { -+ if (pending & (CAUSEF_IP2 << i)) { -+ ltq_hw_irqdispatch(i); -+ goto out; -+ } -+ } - } -+ pr_alert("Spurious IRQ: CAUSE=0x%08x\n", read_c0_status()); - -- pending >>= CAUSEB_IP; -- while (pending) { -- irq = fls(pending) - 1; -- do_IRQ(MIPS_CPU_IRQ_BASE + irq); -- pending &= ~BIT(irq); -- } -+out: -+ return; - } - - static int icu_map(struct irq_domain *d, unsigned int irq, irq_hw_number_t hw) -@@ -355,6 +354,11 @@ static const struct irq_domain_ops irq_domain_ops = { - .map = icu_map, - }; - -+static struct irqaction cascade = { -+ .handler = no_action, -+ .name = "cascade", -+}; -+ - int __init icu_of_init(struct device_node *node, struct device_node *parent) - { - struct device_node *eiu_node; -@@ -386,7 +390,7 @@ int __init icu_of_init(struct device_node *node, struct device_node *parent) - mips_cpu_irq_init(); - - for (i = 0; i < MAX_IM; i++) -- irq_set_chained_handler(i + 2, ltq_hw_irq_handler); -+ setup_irq(i + 2, &cascade); - - if (cpu_has_vint) { - pr_info("Setting up vectored interrupts\n"); -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index 5c03a6a9b054..a20823210ac0 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -220,6 +220,15 @@ static void cpu_ready_for_interrupts(void) - unsigned long lpcr = mfspr(SPRN_LPCR); - mtspr(SPRN_LPCR, lpcr | LPCR_AIL_3); - } -+ -+ /* -+ * Fixup HFSCR:TM based on CPU features. The bit is set by our -+ * early asm init because at that point we haven't updated our -+ * CPU features from firmware and device-tree. Here we have, -+ * so let's do it. -+ */ -+ if (cpu_has_feature(CPU_FTR_HVMODE) && !cpu_has_feature(CPU_FTR_TM_COMP)) -+ mtspr(SPRN_HFSCR, mfspr(SPRN_HFSCR) & ~HFSCR_TM); - } - - /* -diff --git a/arch/x86/entry/vdso/vdso32-setup.c b/arch/x86/entry/vdso/vdso32-setup.c -index 08a317a9ae4b..a7508d7e20b7 100644 ---- a/arch/x86/entry/vdso/vdso32-setup.c -+++ b/arch/x86/entry/vdso/vdso32-setup.c -@@ -31,8 +31,10 @@ static int __init vdso32_setup(char *s) - { - vdso32_enabled = simple_strtoul(s, NULL, 0); - -- if (vdso32_enabled > 1) -+ if (vdso32_enabled > 1) { - pr_warn("vdso32 values other than 0 and 1 are no longer allowed; vdso disabled\n"); -+ vdso32_enabled = 0; -+ } - - return 1; - } -@@ -63,13 +65,18 @@ subsys_initcall(sysenter_setup); - /* Register vsyscall32 into the ABI table */ - #include - -+static const int zero; -+static const int one = 1; -+ - static struct ctl_table abi_table2[] = { - { - .procname = "vsyscall32", - .data = &vdso32_enabled, - .maxlen = sizeof(int), - .mode = 0644, -- .proc_handler = proc_dointvec -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = (int *)&zero, -+ .extra2 = (int *)&one, - }, - {} - }; -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index 1514753fd435..d262f985bbc8 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -278,7 +278,7 @@ struct task_struct; - - #define ARCH_DLINFO_IA32 \ - do { \ -- if (vdso32_enabled) { \ -+ if (VDSO_CURRENT_BASE) { \ - NEW_AUX_ENT(AT_SYSINFO, VDSO_ENTRY); \ - NEW_AUX_ENT(AT_SYSINFO_EHDR, VDSO_CURRENT_BASE); \ - } \ -diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c -index 659f01e165d5..8900400230c6 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c -@@ -410,6 +410,9 @@ static void intel_pmu_lbr_read_32(struct cpu_hw_events *cpuc) - cpuc->lbr_entries[i].to = msr_lastbranch.to; - cpuc->lbr_entries[i].mispred = 0; - cpuc->lbr_entries[i].predicted = 0; -+ cpuc->lbr_entries[i].in_tx = 0; -+ cpuc->lbr_entries[i].abort = 0; -+ cpuc->lbr_entries[i].cycles = 0; - cpuc->lbr_entries[i].reserved = 0; - } - cpuc->lbr_stack.nr = i; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 3a7ae80dc49d..0a472e9865c5 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -6678,14 +6678,20 @@ static int nested_vmx_check_vmptr(struct kvm_vcpu *vcpu, int exit_reason, - } - - page = nested_get_page(vcpu, vmptr); -- if (page == NULL || -- *(u32 *)kmap(page) != VMCS12_REVISION) { -+ if (page == NULL) { - nested_vmx_failInvalid(vcpu); -+ skip_emulated_instruction(vcpu); -+ return 1; -+ } -+ if (*(u32 *)kmap(page) != VMCS12_REVISION) { - kunmap(page); -+ nested_release_page_clean(page); -+ nested_vmx_failInvalid(vcpu); - skip_emulated_instruction(vcpu); - return 1; - } - kunmap(page); -+ nested_release_page_clean(page); - vmx->nested.vmxon_ptr = vmptr; - break; - case EXIT_REASON_VMCLEAR: -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 493f54172b4a..3aebbd6c6f5f 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -628,21 +628,40 @@ void __init init_mem_mapping(void) - * devmem_is_allowed() checks to see if /dev/mem access to a certain address - * is valid. The argument is a physical page number. - * -- * -- * On x86, access has to be given to the first megabyte of ram because that area -- * contains BIOS code and data regions used by X and dosemu and similar apps. -- * Access has to be given to non-kernel-ram areas as well, these contain the PCI -- * mmio resources as well as potential bios/acpi data regions. -+ * On x86, access has to be given to the first megabyte of RAM because that -+ * area traditionally contains BIOS code and data regions used by X, dosemu, -+ * and similar apps. Since they map the entire memory range, the whole range -+ * must be allowed (for mapping), but any areas that would otherwise be -+ * disallowed are flagged as being "zero filled" instead of rejected. -+ * Access has to be given to non-kernel-ram areas as well, these contain the -+ * PCI mmio resources as well as potential bios/acpi data regions. - */ - int devmem_is_allowed(unsigned long pagenr) - { -- if (pagenr < 256) -- return 1; -- if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) -+ if (page_is_ram(pagenr)) { -+ /* -+ * For disallowed memory regions in the low 1MB range, -+ * request that the page be shown as all zeros. -+ */ -+ if (pagenr < 256) -+ return 2; -+ -+ return 0; -+ } -+ -+ /* -+ * This must follow RAM test, since System RAM is considered a -+ * restricted resource under CONFIG_STRICT_IOMEM. -+ */ -+ if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) { -+ /* Low 1MB bypasses iomem restrictions. */ -+ if (pagenr < 256) -+ return 1; -+ - return 0; -- if (!page_is_ram(pagenr)) -- return 1; -- return 0; -+ } -+ -+ return 1; - } - - void free_init_pages(char *what, unsigned long begin, unsigned long end) -diff --git a/crypto/ahash.c b/crypto/ahash.c -index dac1c24e9c3e..f9caf0f74199 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -31,6 +31,7 @@ struct ahash_request_priv { - crypto_completion_t complete; - void *data; - u8 *result; -+ u32 flags; - void *ubuf[] CRYPTO_MINALIGN_ATTR; - }; - -@@ -270,6 +271,8 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt) - priv->result = req->result; - priv->complete = req->base.complete; - priv->data = req->base.data; -+ priv->flags = req->base.flags; -+ - /* - * WARNING: We do not backup req->priv here! The req->priv - * is for internal use of the Crypto API and the -@@ -284,38 +287,44 @@ static int ahash_save_req(struct ahash_request *req, crypto_completion_t cplt) - return 0; - } - --static void ahash_restore_req(struct ahash_request *req) -+static void ahash_restore_req(struct ahash_request *req, int err) - { - struct ahash_request_priv *priv = req->priv; - -+ if (!err) -+ memcpy(priv->result, req->result, -+ crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -+ - /* Restore the original crypto request. */ - req->result = priv->result; -- req->base.complete = priv->complete; -- req->base.data = priv->data; -+ -+ ahash_request_set_callback(req, priv->flags, -+ priv->complete, priv->data); - req->priv = NULL; - - /* Free the req->priv.priv from the ADJUSTED request. */ - kzfree(priv); - } - --static void ahash_op_unaligned_finish(struct ahash_request *req, int err) -+static void ahash_notify_einprogress(struct ahash_request *req) - { - struct ahash_request_priv *priv = req->priv; -+ struct crypto_async_request oreq; - -- if (err == -EINPROGRESS) -- return; -- -- if (!err) -- memcpy(priv->result, req->result, -- crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -+ oreq.data = priv->data; - -- ahash_restore_req(req); -+ priv->complete(&oreq, -EINPROGRESS); - } - - static void ahash_op_unaligned_done(struct crypto_async_request *req, int err) - { - struct ahash_request *areq = req->data; - -+ if (err == -EINPROGRESS) { -+ ahash_notify_einprogress(areq); -+ return; -+ } -+ - /* - * Restore the original request, see ahash_op_unaligned() for what - * goes where. -@@ -326,7 +335,7 @@ static void ahash_op_unaligned_done(struct crypto_async_request *req, int err) - */ - - /* First copy req->result into req->priv.result */ -- ahash_op_unaligned_finish(areq, err); -+ ahash_restore_req(areq, err); - - /* Complete the ORIGINAL request. */ - areq->base.complete(&areq->base, err); -@@ -342,7 +351,12 @@ static int ahash_op_unaligned(struct ahash_request *req, - return err; - - err = op(req); -- ahash_op_unaligned_finish(req, err); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; -+ -+ ahash_restore_req(req, err); - - return err; - } -@@ -377,25 +391,14 @@ int crypto_ahash_digest(struct ahash_request *req) - } - EXPORT_SYMBOL_GPL(crypto_ahash_digest); - --static void ahash_def_finup_finish2(struct ahash_request *req, int err) -+static void ahash_def_finup_done2(struct crypto_async_request *req, int err) - { -- struct ahash_request_priv *priv = req->priv; -+ struct ahash_request *areq = req->data; - - if (err == -EINPROGRESS) - return; - -- if (!err) -- memcpy(priv->result, req->result, -- crypto_ahash_digestsize(crypto_ahash_reqtfm(req))); -- -- ahash_restore_req(req); --} -- --static void ahash_def_finup_done2(struct crypto_async_request *req, int err) --{ -- struct ahash_request *areq = req->data; -- -- ahash_def_finup_finish2(areq, err); -+ ahash_restore_req(areq, err); - - areq->base.complete(&areq->base, err); - } -@@ -406,11 +409,15 @@ static int ahash_def_finup_finish1(struct ahash_request *req, int err) - goto out; - - req->base.complete = ahash_def_finup_done2; -- req->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; -+ - err = crypto_ahash_reqtfm(req)->final(req); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; - - out: -- ahash_def_finup_finish2(req, err); -+ ahash_restore_req(req, err); - return err; - } - -@@ -418,7 +425,16 @@ static void ahash_def_finup_done1(struct crypto_async_request *req, int err) - { - struct ahash_request *areq = req->data; - -+ if (err == -EINPROGRESS) { -+ ahash_notify_einprogress(areq); -+ return; -+ } -+ -+ areq->base.flags &= ~CRYPTO_TFM_REQ_MAY_SLEEP; -+ - err = ahash_def_finup_finish1(areq, err); -+ if (areq->priv) -+ return; - - areq->base.complete(&areq->base, err); - } -@@ -433,6 +449,11 @@ static int ahash_def_finup(struct ahash_request *req) - return err; - - err = tfm->update(req); -+ if (err == -EINPROGRESS || -+ (err == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) -+ return err; -+ - return ahash_def_finup_finish1(req, err); - } - -diff --git a/drivers/acpi/nfit.c b/drivers/acpi/nfit.c -index 14c2a07c9f3f..67d7489ced01 100644 ---- a/drivers/acpi/nfit.c -+++ b/drivers/acpi/nfit.c -@@ -979,7 +979,11 @@ static int cmp_map(const void *m0, const void *m1) - const struct nfit_set_info_map *map0 = m0; - const struct nfit_set_info_map *map1 = m1; - -- return map0->region_offset - map1->region_offset; -+ if (map0->region_offset < map1->region_offset) -+ return -1; -+ else if (map0->region_offset > map1->region_offset) -+ return 1; -+ return 0; - } - - /* Retrieve the nth entry referencing this spa */ -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 1648de80e230..62a93b685c54 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -574,13 +574,13 @@ static int zram_decompress_page(struct zram *zram, char *mem, u32 index) - - if (!handle || zram_test_flag(meta, index, ZRAM_ZERO)) { - bit_spin_unlock(ZRAM_ACCESS, &meta->table[index].value); -- clear_page(mem); -+ memset(mem, 0, PAGE_SIZE); - return 0; - } - - cmem = zs_map_object(meta->mem_pool, handle, ZS_MM_RO); - if (size == PAGE_SIZE) -- copy_page(mem, cmem); -+ memcpy(mem, cmem, PAGE_SIZE); - else - ret = zcomp_decompress(zram->comp, cmem, size, mem); - zs_unmap_object(meta->mem_pool, handle); -@@ -738,7 +738,7 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, - - if ((clen == PAGE_SIZE) && !is_partial_io(bvec)) { - src = kmap_atomic(page); -- copy_page(cmem, src); -+ memcpy(cmem, src, PAGE_SIZE); - kunmap_atomic(src); - } else { - memcpy(cmem, src, clen); -diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig -index a043107da2af..3143db57ce44 100644 ---- a/drivers/char/Kconfig -+++ b/drivers/char/Kconfig -@@ -583,10 +583,12 @@ config TELCLOCK - controlling the behavior of this hardware. - - config DEVPORT -- bool -- depends on !M68K -+ bool "/dev/port character device" - depends on ISA || PCI - default y -+ help -+ Say Y here if you want to support the /dev/port device. The /dev/port -+ device is similar to /dev/mem, but for I/O ports. - - source "drivers/s390/char/Kconfig" - -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 6b1721f978c2..e901463d4972 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -59,6 +59,10 @@ static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t size) - #endif - - #ifdef CONFIG_STRICT_DEVMEM -+static inline int page_is_allowed(unsigned long pfn) -+{ -+ return devmem_is_allowed(pfn); -+} - static inline int range_is_allowed(unsigned long pfn, unsigned long size) - { - u64 from = ((u64)pfn) << PAGE_SHIFT; -@@ -78,6 +82,10 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size) - return 1; - } - #else -+static inline int page_is_allowed(unsigned long pfn) -+{ -+ return 1; -+} - static inline int range_is_allowed(unsigned long pfn, unsigned long size) - { - return 1; -@@ -125,23 +133,31 @@ static ssize_t read_mem(struct file *file, char __user *buf, - - while (count > 0) { - unsigned long remaining; -+ int allowed; - - sz = size_inside_page(p, count); - -- if (!range_is_allowed(p >> PAGE_SHIFT, count)) -+ allowed = page_is_allowed(p >> PAGE_SHIFT); -+ if (!allowed) - return -EPERM; -+ if (allowed == 2) { -+ /* Show zeros for restricted memory. */ -+ remaining = clear_user(buf, sz); -+ } else { -+ /* -+ * On ia64 if a page has been mapped somewhere as -+ * uncached, then it must also be accessed uncached -+ * by the kernel or data corruption may occur. -+ */ -+ ptr = xlate_dev_mem_ptr(p); -+ if (!ptr) -+ return -EFAULT; - -- /* -- * On ia64 if a page has been mapped somewhere as uncached, then -- * it must also be accessed uncached by the kernel or data -- * corruption may occur. -- */ -- ptr = xlate_dev_mem_ptr(p); -- if (!ptr) -- return -EFAULT; -+ remaining = copy_to_user(buf, ptr, sz); -+ -+ unxlate_dev_mem_ptr(p, ptr); -+ } - -- remaining = copy_to_user(buf, ptr, sz); -- unxlate_dev_mem_ptr(p, ptr); - if (remaining) - return -EFAULT; - -@@ -184,30 +200,36 @@ static ssize_t write_mem(struct file *file, const char __user *buf, - #endif - - while (count > 0) { -+ int allowed; -+ - sz = size_inside_page(p, count); - -- if (!range_is_allowed(p >> PAGE_SHIFT, sz)) -+ allowed = page_is_allowed(p >> PAGE_SHIFT); -+ if (!allowed) - return -EPERM; - -- /* -- * On ia64 if a page has been mapped somewhere as uncached, then -- * it must also be accessed uncached by the kernel or data -- * corruption may occur. -- */ -- ptr = xlate_dev_mem_ptr(p); -- if (!ptr) { -- if (written) -- break; -- return -EFAULT; -- } -+ /* Skip actual writing when a page is marked as restricted. */ -+ if (allowed == 1) { -+ /* -+ * On ia64 if a page has been mapped somewhere as -+ * uncached, then it must also be accessed uncached -+ * by the kernel or data corruption may occur. -+ */ -+ ptr = xlate_dev_mem_ptr(p); -+ if (!ptr) { -+ if (written) -+ break; -+ return -EFAULT; -+ } - -- copied = copy_from_user(ptr, buf, sz); -- unxlate_dev_mem_ptr(p, ptr); -- if (copied) { -- written += sz - copied; -- if (written) -- break; -- return -EFAULT; -+ copied = copy_from_user(ptr, buf, sz); -+ unxlate_dev_mem_ptr(p, ptr); -+ if (copied) { -+ written += sz - copied; -+ if (written) -+ break; -+ return -EFAULT; -+ } - } - - buf += sz; -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 090183f812be..31e8ae916ba0 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1130,6 +1130,8 @@ static int put_chars(u32 vtermno, const char *buf, int count) - { - struct port *port; - struct scatterlist sg[1]; -+ void *data; -+ int ret; - - if (unlikely(early_put_chars)) - return early_put_chars(vtermno, buf, count); -@@ -1138,8 +1140,14 @@ static int put_chars(u32 vtermno, const char *buf, int count) - if (!port) - return -EPIPE; - -- sg_init_one(sg, buf, count); -- return __send_to_port(port, sg, 1, count, (void *)buf, false); -+ data = kmemdup(buf, count, GFP_ATOMIC); -+ if (!data) -+ return -ENOMEM; -+ -+ sg_init_one(sg, data, count); -+ ret = __send_to_port(port, sg, 1, count, data, false); -+ kfree(data); -+ return ret; - } - - /* -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c -index ece9f4102c0e..7f8acb3ebfcd 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/device/base.c -@@ -714,7 +714,7 @@ nv4a_chipset = { - .i2c = nv04_i2c_new, - .imem = nv40_instmem_new, - .mc = nv44_mc_new, -- .mmu = nv44_mmu_new, -+ .mmu = nv04_mmu_new, - .pci = nv40_pci_new, - .therm = nv40_therm_new, - .timer = nv41_timer_new, -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c -index d4d8942b1347..e55f8302d08a 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv31.c -@@ -198,7 +198,7 @@ nv31_mpeg_intr(struct nvkm_engine *engine) - } - - if (type == 0x00000010) { -- if (!nv31_mpeg_mthd(mpeg, mthd, data)) -+ if (nv31_mpeg_mthd(mpeg, mthd, data)) - show &= ~0x01000000; - } - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c -index d433cfa4a8ab..36af0a8927fc 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/mpeg/nv44.c -@@ -172,7 +172,7 @@ nv44_mpeg_intr(struct nvkm_engine *engine) - } - - if (type == 0x00000010) { -- if (!nv44_mpeg_mthd(subdev->device, mthd, data)) -+ if (nv44_mpeg_mthd(subdev->device, mthd, data)) - show &= ~0x01000000; - } - } -diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c -index 16f000a76de5..3258baf3282e 100644 ---- a/drivers/input/joystick/xpad.c -+++ b/drivers/input/joystick/xpad.c -@@ -189,6 +189,7 @@ static const struct xpad_device { - { 0x1430, 0x8888, "TX6500+ Dance Pad (first generation)", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX }, - { 0x146b, 0x0601, "BigBen Interactive XBOX 360 Controller", 0, XTYPE_XBOX360 }, - { 0x1532, 0x0037, "Razer Sabertooth", 0, XTYPE_XBOX360 }, -+ { 0x1532, 0x0a03, "Razer Wildcat", 0, XTYPE_XBOXONE }, - { 0x15e4, 0x3f00, "Power A Mini Pro Elite", 0, XTYPE_XBOX360 }, - { 0x15e4, 0x3f0a, "Xbox Airflo wired controller", 0, XTYPE_XBOX360 }, - { 0x15e4, 0x3f10, "Batarang Xbox 360 controller", 0, XTYPE_XBOX360 }, -@@ -310,6 +311,7 @@ static struct usb_device_id xpad_table[] = { - XPAD_XBOX360_VENDOR(0x1689), /* Razer Onza */ - XPAD_XBOX360_VENDOR(0x24c6), /* PowerA Controllers */ - XPAD_XBOX360_VENDOR(0x1532), /* Razer Sabertooth */ -+ XPAD_XBOXONE_VENDOR(0x1532), /* Razer Wildcat */ - XPAD_XBOX360_VENDOR(0x15e4), /* Numark X-Box 360 controllers */ - XPAD_XBOX360_VENDOR(0x162e), /* Joytech X-Box 360 controllers */ - { } -diff --git a/drivers/irqchip/irq-imx-gpcv2.c b/drivers/irqchip/irq-imx-gpcv2.c -index 15af9a9753e5..2d203b422129 100644 ---- a/drivers/irqchip/irq-imx-gpcv2.c -+++ b/drivers/irqchip/irq-imx-gpcv2.c -@@ -230,6 +230,8 @@ static int __init imx_gpcv2_irqchip_init(struct device_node *node, - return -ENOMEM; - } - -+ raw_spin_lock_init(&cd->rlock); -+ - cd->gpc_base = of_iomap(node, 0); - if (!cd->gpc_base) { - pr_err("fsl-gpcv2: unable to map gpc registers\n"); -diff --git a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c -index f5df9eaba04f..9757f35cd5f5 100644 ---- a/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c -+++ b/drivers/media/usb/dvb-usb-v2/dvb_usb_core.c -@@ -1010,8 +1010,8 @@ EXPORT_SYMBOL(dvb_usbv2_probe); - void dvb_usbv2_disconnect(struct usb_interface *intf) - { - struct dvb_usb_device *d = usb_get_intfdata(intf); -- const char *name = d->name; -- struct device dev = d->udev->dev; -+ const char *devname = kstrdup(dev_name(&d->udev->dev), GFP_KERNEL); -+ const char *drvname = d->name; - - dev_dbg(&d->udev->dev, "%s: bInterfaceNumber=%d\n", __func__, - intf->cur_altsetting->desc.bInterfaceNumber); -@@ -1021,8 +1021,9 @@ void dvb_usbv2_disconnect(struct usb_interface *intf) - - dvb_usbv2_exit(d); - -- dev_info(&dev, "%s: '%s' successfully deinitialized and disconnected\n", -- KBUILD_MODNAME, name); -+ pr_info("%s: '%s:%s' successfully deinitialized and disconnected\n", -+ KBUILD_MODNAME, drvname, devname); -+ kfree(devname); - } - EXPORT_SYMBOL(dvb_usbv2_disconnect); - -diff --git a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -index 733a7ff7b207..caad3b5c01ad 100644 ---- a/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -+++ b/drivers/media/usb/dvb-usb/dvb-usb-firmware.c -@@ -35,42 +35,51 @@ static int usb_cypress_writemem(struct usb_device *udev,u16 addr,u8 *data, u8 le - - int usb_cypress_load_firmware(struct usb_device *udev, const struct firmware *fw, int type) - { -- struct hexline hx; -- u8 reset; -- int ret,pos=0; -+ struct hexline *hx; -+ u8 *buf; -+ int ret, pos = 0; -+ u16 cpu_cs_register = cypress[type].cpu_cs_register; -+ -+ buf = kmalloc(sizeof(*hx), GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ hx = (struct hexline *)buf; - - /* stop the CPU */ -- reset = 1; -- if ((ret = usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1)) != 1) -+ buf[0] = 1; -+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) - err("could not stop the USB controller CPU."); - -- while ((ret = dvb_usb_get_hexline(fw,&hx,&pos)) > 0) { -- deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n",hx.addr,hx.len,hx.chk); -- ret = usb_cypress_writemem(udev,hx.addr,hx.data,hx.len); -+ while ((ret = dvb_usb_get_hexline(fw, hx, &pos)) > 0) { -+ deb_fw("writing to address 0x%04x (buffer: 0x%02x %02x)\n", hx->addr, hx->len, hx->chk); -+ ret = usb_cypress_writemem(udev, hx->addr, hx->data, hx->len); - -- if (ret != hx.len) { -+ if (ret != hx->len) { - err("error while transferring firmware " - "(transferred size: %d, block size: %d)", -- ret,hx.len); -+ ret, hx->len); - ret = -EINVAL; - break; - } - } - if (ret < 0) { - err("firmware download failed at %d with %d",pos,ret); -+ kfree(buf); - return ret; - } - - if (ret == 0) { - /* restart the CPU */ -- reset = 0; -- if (ret || usb_cypress_writemem(udev,cypress[type].cpu_cs_register,&reset,1) != 1) { -+ buf[0] = 0; -+ if (usb_cypress_writemem(udev, cpu_cs_register, buf, 1) != 1) { - err("could not restart the USB controller CPU."); - ret = -EINVAL; - } - } else - ret = -EIO; - -+ kfree(buf); -+ - return ret; - } - EXPORT_SYMBOL(usb_cypress_load_firmware); -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index 855c43d8f7e0..f9e4988ea30e 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1179,7 +1179,9 @@ map_failed: - - static void ibmveth_rx_mss_helper(struct sk_buff *skb, u16 mss, int lrg_pkt) - { -+ struct tcphdr *tcph; - int offset = 0; -+ int hdr_len; - - /* only TCP packets will be aggregated */ - if (skb->protocol == htons(ETH_P_IP)) { -@@ -1206,14 +1208,20 @@ static void ibmveth_rx_mss_helper(struct sk_buff *skb, u16 mss, int lrg_pkt) - /* if mss is not set through Large Packet bit/mss in rx buffer, - * expect that the mss will be written to the tcp header checksum. - */ -+ tcph = (struct tcphdr *)(skb->data + offset); - if (lrg_pkt) { - skb_shinfo(skb)->gso_size = mss; - } else if (offset) { -- struct tcphdr *tcph = (struct tcphdr *)(skb->data + offset); -- - skb_shinfo(skb)->gso_size = ntohs(tcph->check); - tcph->check = 0; - } -+ -+ if (skb_shinfo(skb)->gso_size) { -+ hdr_len = offset + tcph->doff * 4; -+ skb_shinfo(skb)->gso_segs = -+ DIV_ROUND_UP(skb->len - hdr_len, -+ skb_shinfo(skb)->gso_size); -+ } - } - - static int ibmveth_poll(struct napi_struct *napi, int budget) -diff --git a/drivers/net/usb/catc.c b/drivers/net/usb/catc.c -index 4e2b26a88b15..2aa1a1d29cb4 100644 ---- a/drivers/net/usb/catc.c -+++ b/drivers/net/usb/catc.c -@@ -777,7 +777,7 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id - struct net_device *netdev; - struct catc *catc; - u8 broadcast[ETH_ALEN]; -- int i, pktsz; -+ int pktsz, ret; - - if (usb_set_interface(usbdev, - intf->altsetting->desc.bInterfaceNumber, 1)) { -@@ -812,12 +812,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id - if ((!catc->ctrl_urb) || (!catc->tx_urb) || - (!catc->rx_urb) || (!catc->irq_urb)) { - dev_err(&intf->dev, "No free urbs available.\n"); -- usb_free_urb(catc->ctrl_urb); -- usb_free_urb(catc->tx_urb); -- usb_free_urb(catc->rx_urb); -- usb_free_urb(catc->irq_urb); -- free_netdev(netdev); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto fail_free; - } - - /* The F5U011 has the same vendor/product as the netmate but a device version of 0x130 */ -@@ -845,15 +841,24 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id - catc->irq_buf, 2, catc_irq_done, catc, 1); - - if (!catc->is_f5u011) { -+ u32 *buf; -+ int i; -+ - dev_dbg(dev, "Checking memory size\n"); - -- i = 0x12345678; -- catc_write_mem(catc, 0x7a80, &i, 4); -- i = 0x87654321; -- catc_write_mem(catc, 0xfa80, &i, 4); -- catc_read_mem(catc, 0x7a80, &i, 4); -+ buf = kmalloc(4, GFP_KERNEL); -+ if (!buf) { -+ ret = -ENOMEM; -+ goto fail_free; -+ } -+ -+ *buf = 0x12345678; -+ catc_write_mem(catc, 0x7a80, buf, 4); -+ *buf = 0x87654321; -+ catc_write_mem(catc, 0xfa80, buf, 4); -+ catc_read_mem(catc, 0x7a80, buf, 4); - -- switch (i) { -+ switch (*buf) { - case 0x12345678: - catc_set_reg(catc, TxBufCount, 8); - catc_set_reg(catc, RxBufCount, 32); -@@ -868,6 +873,8 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id - dev_dbg(dev, "32k Memory\n"); - break; - } -+ -+ kfree(buf); - - dev_dbg(dev, "Getting MAC from SEEROM.\n"); - -@@ -914,16 +921,21 @@ static int catc_probe(struct usb_interface *intf, const struct usb_device_id *id - usb_set_intfdata(intf, catc); - - SET_NETDEV_DEV(netdev, &intf->dev); -- if (register_netdev(netdev) != 0) { -- usb_set_intfdata(intf, NULL); -- usb_free_urb(catc->ctrl_urb); -- usb_free_urb(catc->tx_urb); -- usb_free_urb(catc->rx_urb); -- usb_free_urb(catc->irq_urb); -- free_netdev(netdev); -- return -EIO; -- } -+ ret = register_netdev(netdev); -+ if (ret) -+ goto fail_clear_intfdata; -+ - return 0; -+ -+fail_clear_intfdata: -+ usb_set_intfdata(intf, NULL); -+fail_free: -+ usb_free_urb(catc->ctrl_urb); -+ usb_free_urb(catc->tx_urb); -+ usb_free_urb(catc->rx_urb); -+ usb_free_urb(catc->irq_urb); -+ free_netdev(netdev); -+ return ret; - } - - static void catc_disconnect(struct usb_interface *intf) -diff --git a/drivers/net/usb/pegasus.c b/drivers/net/usb/pegasus.c -index f84080215915..17fac0121e56 100644 ---- a/drivers/net/usb/pegasus.c -+++ b/drivers/net/usb/pegasus.c -@@ -126,40 +126,61 @@ static void async_ctrl_callback(struct urb *urb) - - static int get_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data) - { -+ u8 *buf; - int ret; - -+ buf = kmalloc(size, GFP_NOIO); -+ if (!buf) -+ return -ENOMEM; -+ - ret = usb_control_msg(pegasus->usb, usb_rcvctrlpipe(pegasus->usb, 0), - PEGASUS_REQ_GET_REGS, PEGASUS_REQT_READ, 0, -- indx, data, size, 1000); -+ indx, buf, size, 1000); - if (ret < 0) - netif_dbg(pegasus, drv, pegasus->net, - "%s returned %d\n", __func__, ret); -+ else if (ret <= size) -+ memcpy(data, buf, ret); -+ kfree(buf); - return ret; - } - --static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, void *data) -+static int set_registers(pegasus_t *pegasus, __u16 indx, __u16 size, -+ const void *data) - { -+ u8 *buf; - int ret; - -+ buf = kmemdup(data, size, GFP_NOIO); -+ if (!buf) -+ return -ENOMEM; -+ - ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0), - PEGASUS_REQ_SET_REGS, PEGASUS_REQT_WRITE, 0, -- indx, data, size, 100); -+ indx, buf, size, 100); - if (ret < 0) - netif_dbg(pegasus, drv, pegasus->net, - "%s returned %d\n", __func__, ret); -+ kfree(buf); - return ret; - } - - static int set_register(pegasus_t *pegasus, __u16 indx, __u8 data) - { -+ u8 *buf; - int ret; - -+ buf = kmemdup(&data, 1, GFP_NOIO); -+ if (!buf) -+ return -ENOMEM; -+ - ret = usb_control_msg(pegasus->usb, usb_sndctrlpipe(pegasus->usb, 0), - PEGASUS_REQ_SET_REG, PEGASUS_REQT_WRITE, data, -- indx, &data, 1, 1000); -+ indx, buf, 1, 1000); - if (ret < 0) - netif_dbg(pegasus, drv, pegasus->net, - "%s returned %d\n", __func__, ret); -+ kfree(buf); - return ret; - } - -diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c -index d37b7dce2d40..39672984dde1 100644 ---- a/drivers/net/usb/rtl8150.c -+++ b/drivers/net/usb/rtl8150.c -@@ -155,16 +155,36 @@ static const char driver_name [] = "rtl8150"; - */ - static int get_registers(rtl8150_t * dev, u16 indx, u16 size, void *data) - { -- return usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), -- RTL8150_REQ_GET_REGS, RTL8150_REQT_READ, -- indx, 0, data, size, 500); -+ void *buf; -+ int ret; -+ -+ buf = kmalloc(size, GFP_NOIO); -+ if (!buf) -+ return -ENOMEM; -+ -+ ret = usb_control_msg(dev->udev, usb_rcvctrlpipe(dev->udev, 0), -+ RTL8150_REQ_GET_REGS, RTL8150_REQT_READ, -+ indx, 0, buf, size, 500); -+ if (ret > 0 && ret <= size) -+ memcpy(data, buf, ret); -+ kfree(buf); -+ return ret; - } - --static int set_registers(rtl8150_t * dev, u16 indx, u16 size, void *data) -+static int set_registers(rtl8150_t * dev, u16 indx, u16 size, const void *data) - { -- return usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), -- RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE, -- indx, 0, data, size, 500); -+ void *buf; -+ int ret; -+ -+ buf = kmemdup(data, size, GFP_NOIO); -+ if (!buf) -+ return -ENOMEM; -+ -+ ret = usb_control_msg(dev->udev, usb_sndctrlpipe(dev->udev, 0), -+ RTL8150_REQ_SET_REGS, RTL8150_REQT_WRITE, -+ indx, 0, buf, size, 500); -+ kfree(buf); -+ return ret; - } - - static void async_set_reg_cb(struct urb *urb) -diff --git a/drivers/net/wireless/ath/ath9k/common-spectral.c b/drivers/net/wireless/ath/ath9k/common-spectral.c -index a8762711ad74..03945731eb65 100644 ---- a/drivers/net/wireless/ath/ath9k/common-spectral.c -+++ b/drivers/net/wireless/ath/ath9k/common-spectral.c -@@ -528,6 +528,9 @@ int ath_cmn_process_fft(struct ath_spec_scan_priv *spec_priv, struct ieee80211_h - if (!(radar_info->pulse_bw_info & SPECTRAL_SCAN_BITMASK)) - return 0; - -+ if (!spec_priv->rfs_chan_spec_scan) -+ return 1; -+ - /* Output buffers are full, no need to process anything - * since there is no space to put the result anyway - */ -@@ -1072,7 +1075,7 @@ static struct rchan_callbacks rfs_spec_scan_cb = { - - void ath9k_cmn_spectral_deinit_debug(struct ath_spec_scan_priv *spec_priv) - { -- if (config_enabled(CONFIG_ATH9K_DEBUGFS)) { -+ if (config_enabled(CONFIG_ATH9K_DEBUGFS) && spec_priv->rfs_chan_spec_scan) { - relay_close(spec_priv->rfs_chan_spec_scan); - spec_priv->rfs_chan_spec_scan = NULL; - } -@@ -1086,6 +1089,9 @@ void ath9k_cmn_spectral_init_debug(struct ath_spec_scan_priv *spec_priv, - debugfs_phy, - 1024, 256, &rfs_spec_scan_cb, - NULL); -+ if (!spec_priv->rfs_chan_spec_scan) -+ return; -+ - debugfs_create_file("spectral_scan_ctl", - S_IRUSR | S_IWUSR, - debugfs_phy, spec_priv, -diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c -index 5f47356d6942..254b0ee37039 100644 ---- a/drivers/nvdimm/bus.c -+++ b/drivers/nvdimm/bus.c -@@ -590,8 +590,14 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm, - rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len); - if (rc < 0) - goto out_unlock; -+ nvdimm_bus_unlock(&nvdimm_bus->dev); -+ - if (copy_to_user(p, buf, buf_len)) - rc = -EFAULT; -+ -+ vfree(buf); -+ return rc; -+ - out_unlock: - nvdimm_bus_unlock(&nvdimm_bus->dev); - out: -diff --git a/drivers/platform/x86/acer-wmi.c b/drivers/platform/x86/acer-wmi.c -index 1062fa42ff26..b2cdc1a1ad4f 100644 ---- a/drivers/platform/x86/acer-wmi.c -+++ b/drivers/platform/x86/acer-wmi.c -@@ -1816,11 +1816,24 @@ static int __init acer_wmi_enable_lm(void) - return status; - } - -+#define ACER_WMID_ACCEL_HID "BST0001" -+ - static acpi_status __init acer_wmi_get_handle_cb(acpi_handle ah, u32 level, - void *ctx, void **retval) - { -+ struct acpi_device *dev; -+ -+ if (!strcmp(ctx, "SENR")) { -+ if (acpi_bus_get_device(ah, &dev)) -+ return AE_OK; -+ if (!strcmp(ACER_WMID_ACCEL_HID, acpi_device_hid(dev))) -+ return AE_OK; -+ } else -+ return AE_OK; -+ - *(acpi_handle *)retval = ah; -- return AE_OK; -+ -+ return AE_CTRL_TERMINATE; - } - - static int __init acer_wmi_get_handle(const char *name, const char *prop, -@@ -1847,7 +1860,7 @@ static int __init acer_wmi_accel_setup(void) - { - int err; - -- err = acer_wmi_get_handle("SENR", "BST0001", &gsensor_handle); -+ err = acer_wmi_get_handle("SENR", ACER_WMID_ACCEL_HID, &gsensor_handle); - if (err) - return err; - -@@ -2185,10 +2198,11 @@ static int __init acer_wmi_init(void) - err = acer_wmi_input_setup(); - if (err) - return err; -+ err = acer_wmi_accel_setup(); -+ if (err) -+ return err; - } - -- acer_wmi_accel_setup(); -- - err = platform_driver_register(&acer_platform_driver); - if (err) { - pr_err("Unable to register platform driver\n"); -diff --git a/drivers/rtc/rtc-tegra.c b/drivers/rtc/rtc-tegra.c -index 60232bd366ef..71216aa68905 100644 ---- a/drivers/rtc/rtc-tegra.c -+++ b/drivers/rtc/rtc-tegra.c -@@ -18,6 +18,7 @@ - * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA. - */ - #include -+#include - #include - #include - #include -@@ -59,6 +60,7 @@ struct tegra_rtc_info { - struct platform_device *pdev; - struct rtc_device *rtc_dev; - void __iomem *rtc_base; /* NULL if not initialized. */ -+ struct clk *clk; - int tegra_rtc_irq; /* alarm and periodic irq */ - spinlock_t tegra_rtc_lock; - }; -@@ -332,6 +334,14 @@ static int __init tegra_rtc_probe(struct platform_device *pdev) - if (info->tegra_rtc_irq <= 0) - return -EBUSY; - -+ info->clk = devm_clk_get(&pdev->dev, NULL); -+ if (IS_ERR(info->clk)) -+ return PTR_ERR(info->clk); -+ -+ ret = clk_prepare_enable(info->clk); -+ if (ret < 0) -+ return ret; -+ - /* set context info. */ - info->pdev = pdev; - spin_lock_init(&info->tegra_rtc_lock); -@@ -352,7 +362,7 @@ static int __init tegra_rtc_probe(struct platform_device *pdev) - ret = PTR_ERR(info->rtc_dev); - dev_err(&pdev->dev, "Unable to register device (err=%d).\n", - ret); -- return ret; -+ goto disable_clk; - } - - ret = devm_request_irq(&pdev->dev, info->tegra_rtc_irq, -@@ -362,12 +372,25 @@ static int __init tegra_rtc_probe(struct platform_device *pdev) - dev_err(&pdev->dev, - "Unable to request interrupt for device (err=%d).\n", - ret); -- return ret; -+ goto disable_clk; - } - - dev_notice(&pdev->dev, "Tegra internal Real Time Clock\n"); - - return 0; -+ -+disable_clk: -+ clk_disable_unprepare(info->clk); -+ return ret; -+} -+ -+static int tegra_rtc_remove(struct platform_device *pdev) -+{ -+ struct tegra_rtc_info *info = platform_get_drvdata(pdev); -+ -+ clk_disable_unprepare(info->clk); -+ -+ return 0; - } - - #ifdef CONFIG_PM_SLEEP -@@ -419,6 +442,7 @@ static void tegra_rtc_shutdown(struct platform_device *pdev) - - MODULE_ALIAS("platform:tegra_rtc"); - static struct platform_driver tegra_rtc_driver = { -+ .remove = tegra_rtc_remove, - .shutdown = tegra_rtc_shutdown, - .driver = { - .name = "tegra_rtc", -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 78430ef28ea4..4d5207dff960 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2051,6 +2051,22 @@ static void read_capacity_error(struct scsi_disk *sdkp, struct scsi_device *sdp, - - #define READ_CAPACITY_RETRIES_ON_RESET 10 - -+/* -+ * Ensure that we don't overflow sector_t when CONFIG_LBDAF is not set -+ * and the reported logical block size is bigger than 512 bytes. Note -+ * that last_sector is a u64 and therefore logical_to_sectors() is not -+ * applicable. -+ */ -+static bool sd_addressable_capacity(u64 lba, unsigned int sector_size) -+{ -+ u64 last_sector = (lba + 1ULL) << (ilog2(sector_size) - 9); -+ -+ if (sizeof(sector_t) == 4 && last_sector > U32_MAX) -+ return false; -+ -+ return true; -+} -+ - static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp, - unsigned char *buffer) - { -@@ -2116,7 +2132,7 @@ static int read_capacity_16(struct scsi_disk *sdkp, struct scsi_device *sdp, - return -ENODEV; - } - -- if ((sizeof(sdkp->capacity) == 4) && (lba >= 0xffffffffULL)) { -+ if (!sd_addressable_capacity(lba, sector_size)) { - sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a " - "kernel compiled with support for large block " - "devices.\n"); -@@ -2202,7 +2218,7 @@ static int read_capacity_10(struct scsi_disk *sdkp, struct scsi_device *sdp, - return sector_size; - } - -- if ((sizeof(sdkp->capacity) == 4) && (lba == 0xffffffff)) { -+ if (!sd_addressable_capacity(lba, sector_size)) { - sd_printk(KERN_ERR, sdkp, "Too big for this kernel. Use a " - "kernel compiled with support for large block " - "devices.\n"); -@@ -2888,7 +2904,8 @@ static int sd_revalidate_disk(struct gendisk *disk) - q->limits.io_opt = logical_to_bytes(sdp, sdkp->opt_xfer_blocks); - rw_max = logical_to_sectors(sdp, sdkp->opt_xfer_blocks); - } else -- rw_max = BLK_DEF_MAX_SECTORS; -+ rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), -+ (sector_t)BLK_DEF_MAX_SECTORS); - - /* Combine with controller limits */ - q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); -diff --git a/drivers/scsi/sr.c b/drivers/scsi/sr.c -index 64c867405ad4..804586aeaffe 100644 ---- a/drivers/scsi/sr.c -+++ b/drivers/scsi/sr.c -@@ -834,6 +834,7 @@ static void get_capabilities(struct scsi_cd *cd) - unsigned char *buffer; - struct scsi_mode_data data; - struct scsi_sense_hdr sshdr; -+ unsigned int ms_len = 128; - int rc, n; - - static const char *loadmech[] = -@@ -860,10 +861,11 @@ static void get_capabilities(struct scsi_cd *cd) - scsi_test_unit_ready(cd->device, SR_TIMEOUT, MAX_RETRIES, &sshdr); - - /* ask for mode page 0x2a */ -- rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, 128, -+ rc = scsi_mode_sense(cd->device, 0, 0x2a, buffer, ms_len, - SR_TIMEOUT, 3, &data, NULL); - -- if (!scsi_status_is_good(rc)) { -+ if (!scsi_status_is_good(rc) || data.length > ms_len || -+ data.header_length + data.block_descriptor_length > data.length) { - /* failed, drive doesn't have capabilities mode page */ - cd->cdi.speed = 1; - cd->cdi.mask |= (CDC_CD_R | CDC_CD_RW | CDC_DVD_R | -diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c -index 2cbea2af7cd0..6d1b0acbc5b3 100644 ---- a/drivers/target/iscsi/iscsi_target_parameters.c -+++ b/drivers/target/iscsi/iscsi_target_parameters.c -@@ -781,22 +781,6 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param) - if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH)) - SET_PSTATE_REPLY_OPTIONAL(param); - /* -- * The GlobalSAN iSCSI Initiator for MacOSX does -- * not respond to MaxBurstLength, FirstBurstLength, -- * DefaultTime2Wait or DefaultTime2Retain parameter keys. -- * So, we set them to 'reply optional' here, and assume the -- * the defaults from iscsi_parameters.h if the initiator -- * is not RFC compliant and the keys are not negotiated. -- */ -- if (!strcmp(param->name, MAXBURSTLENGTH)) -- SET_PSTATE_REPLY_OPTIONAL(param); -- if (!strcmp(param->name, FIRSTBURSTLENGTH)) -- SET_PSTATE_REPLY_OPTIONAL(param); -- if (!strcmp(param->name, DEFAULTTIME2WAIT)) -- SET_PSTATE_REPLY_OPTIONAL(param); -- if (!strcmp(param->name, DEFAULTTIME2RETAIN)) -- SET_PSTATE_REPLY_OPTIONAL(param); -- /* - * Required for gPXE iSCSI boot client - */ - if (!strcmp(param->name, MAXCONNECTIONS)) -diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c -index 428b0d9e3dba..93590521ae33 100644 ---- a/drivers/target/iscsi/iscsi_target_util.c -+++ b/drivers/target/iscsi/iscsi_target_util.c -@@ -731,21 +731,23 @@ void iscsit_free_cmd(struct iscsi_cmd *cmd, bool shutdown) - { - struct se_cmd *se_cmd = NULL; - int rc; -+ bool op_scsi = false; - /* - * Determine if a struct se_cmd is associated with - * this struct iscsi_cmd. - */ - switch (cmd->iscsi_opcode) { - case ISCSI_OP_SCSI_CMD: -- se_cmd = &cmd->se_cmd; -- __iscsit_free_cmd(cmd, true, shutdown); -+ op_scsi = true; - /* - * Fallthrough - */ - case ISCSI_OP_SCSI_TMFUNC: -- rc = transport_generic_free_cmd(&cmd->se_cmd, shutdown); -- if (!rc && shutdown && se_cmd && se_cmd->se_sess) { -- __iscsit_free_cmd(cmd, true, shutdown); -+ se_cmd = &cmd->se_cmd; -+ __iscsit_free_cmd(cmd, op_scsi, shutdown); -+ rc = transport_generic_free_cmd(se_cmd, shutdown); -+ if (!rc && shutdown && se_cmd->se_sess) { -+ __iscsit_free_cmd(cmd, op_scsi, shutdown); - target_put_sess_cmd(se_cmd); - } - break; -diff --git a/drivers/tty/serial/atmel_serial.c b/drivers/tty/serial/atmel_serial.c -index a15070a7fcd6..53e4d5056db7 100644 ---- a/drivers/tty/serial/atmel_serial.c -+++ b/drivers/tty/serial/atmel_serial.c -@@ -810,6 +810,11 @@ static void atmel_complete_tx_dma(void *arg) - */ - if (!uart_circ_empty(xmit)) - tasklet_schedule(&atmel_port->tasklet); -+ else if ((port->rs485.flags & SER_RS485_ENABLED) && -+ !(port->rs485.flags & SER_RS485_RX_DURING_TX)) { -+ /* DMA done, stop TX, start RX for RS485 */ -+ atmel_start_rx(port); -+ } - - spin_unlock_irqrestore(&port->lock, flags); - } -@@ -912,12 +917,6 @@ static void atmel_tx_dma(struct uart_port *port) - desc->callback = atmel_complete_tx_dma; - desc->callback_param = atmel_port; - atmel_port->cookie_tx = dmaengine_submit(desc); -- -- } else { -- if (port->rs485.flags & SER_RS485_ENABLED) { -- /* DMA done, stop TX, start RX for RS485 */ -- atmel_start_rx(port); -- } - } - - if (uart_circ_chars_pending(xmit) < WAKEUP_CHARS) -diff --git a/drivers/video/fbdev/xen-fbfront.c b/drivers/video/fbdev/xen-fbfront.c -index 0567d517eed3..ea2f19f5fbde 100644 ---- a/drivers/video/fbdev/xen-fbfront.c -+++ b/drivers/video/fbdev/xen-fbfront.c -@@ -644,7 +644,6 @@ static void xenfb_backend_changed(struct xenbus_device *dev, - break; - - case XenbusStateInitWait: --InitWait: - xenbus_switch_state(dev, XenbusStateConnected); - break; - -@@ -655,7 +654,8 @@ InitWait: - * get Connected twice here. - */ - if (dev->state != XenbusStateConnected) -- goto InitWait; /* no InitWait seen yet, fudge it */ -+ /* no InitWait seen yet, fudge it */ -+ xenbus_switch_state(dev, XenbusStateConnected); - - if (xenbus_scanf(XBT_NIL, info->xbdev->otherend, - "request-update", "%d", &val) < 0) -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index 72f270d4bd17..a0c0a49b6620 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -2545,7 +2545,7 @@ cifs_write_from_iter(loff_t offset, size_t len, struct iov_iter *from, - wdata->credits = credits; - - if (!wdata->cfile->invalidHandle || -- !cifs_reopen_file(wdata->cfile, false)) -+ !(rc = cifs_reopen_file(wdata->cfile, false))) - rc = server->ops->async_writev(wdata, - cifs_uncached_writedata_release); - if (rc) { -@@ -2958,7 +2958,7 @@ cifs_send_async_read(loff_t offset, size_t len, struct cifsFileInfo *open_file, - rdata->credits = credits; - - if (!rdata->cfile->invalidHandle || -- !cifs_reopen_file(rdata->cfile, true)) -+ !(rc = cifs_reopen_file(rdata->cfile, true))) - rc = server->ops->async_readv(rdata); - error: - if (rc) { -@@ -3544,7 +3544,7 @@ static int cifs_readpages(struct file *file, struct address_space *mapping, - } - - if (!rdata->cfile->invalidHandle || -- !cifs_reopen_file(rdata->cfile, true)) -+ !(rc = cifs_reopen_file(rdata->cfile, true))) - rc = server->ops->async_readv(rdata); - if (rc) { - add_credits_and_wake_if(server, rdata->credits, 0); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 7dcc97eadb12..817a937de733 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -71,10 +71,9 @@ static __u32 ext4_inode_csum(struct inode *inode, struct ext4_inode *raw, - csum = ext4_chksum(sbi, csum, (__u8 *)&dummy_csum, - csum_size); - offset += csum_size; -- csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -- EXT4_INODE_SIZE(inode->i_sb) - -- offset); - } -+ csum = ext4_chksum(sbi, csum, (__u8 *)raw + offset, -+ EXT4_INODE_SIZE(inode->i_sb) - offset); - } - - return csum; -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index d598b9c809c1..db1a1427c27a 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -803,7 +803,14 @@ static inline void clear_soft_dirty(struct vm_area_struct *vma, - static inline void clear_soft_dirty_pmd(struct vm_area_struct *vma, - unsigned long addr, pmd_t *pmdp) - { -- pmd_t pmd = pmdp_huge_get_and_clear(vma->vm_mm, addr, pmdp); -+ pmd_t pmd = *pmdp; -+ -+ /* See comment in change_huge_pmd() */ -+ pmdp_invalidate(vma, addr, pmdp); -+ if (pmd_dirty(*pmdp)) -+ pmd = pmd_mkdirty(pmd); -+ if (pmd_young(*pmdp)) -+ pmd = pmd_mkyoung(pmd); - - pmd = pmd_wrprotect(pmd); - pmd = pmd_clear_soft_dirty(pmd); -diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h -index 3b4af1d7c7e9..a25414ce2898 100644 ---- a/include/crypto/internal/hash.h -+++ b/include/crypto/internal/hash.h -@@ -173,6 +173,16 @@ static inline struct ahash_instance *ahash_alloc_instance( - return crypto_alloc_instance2(name, alg, ahash_instance_headroom()); - } - -+static inline void ahash_request_complete(struct ahash_request *req, int err) -+{ -+ req->base.complete(&req->base, err); -+} -+ -+static inline u32 ahash_request_flags(struct ahash_request *req) -+{ -+ return req->base.flags; -+} -+ - static inline struct crypto_ahash *crypto_spawn_ahash( - struct crypto_ahash_spawn *spawn) - { -diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h -index cb91b44f5f78..ad2bcf647b9a 100644 ---- a/include/linux/cgroup.h -+++ b/include/linux/cgroup.h -@@ -528,6 +528,25 @@ static inline void pr_cont_cgroup_path(struct cgroup *cgrp) - pr_cont_kernfs_path(cgrp->kn); - } - -+static inline void cgroup_init_kthreadd(void) -+{ -+ /* -+ * kthreadd is inherited by all kthreads, keep it in the root so -+ * that the new kthreads are guaranteed to stay in the root until -+ * initialization is finished. -+ */ -+ current->no_cgroup_migration = 1; -+} -+ -+static inline void cgroup_kthread_ready(void) -+{ -+ /* -+ * This kthread finished initialization. The creator should have -+ * set PF_NO_SETAFFINITY if this kthread should stay in the root. -+ */ -+ current->no_cgroup_migration = 0; -+} -+ - #else /* !CONFIG_CGROUPS */ - - struct cgroup_subsys_state; -@@ -551,6 +570,8 @@ static inline void cgroup_free(struct task_struct *p) {} - - static inline int cgroup_init_early(void) { return 0; } - static inline int cgroup_init(void) { return 0; } -+static inline void cgroup_init_kthreadd(void) {} -+static inline void cgroup_kthread_ready(void) {} - - #endif /* !CONFIG_CGROUPS */ - -diff --git a/include/linux/sched.h b/include/linux/sched.h -index ce0f61dcd887..352213b360d7 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1475,6 +1475,10 @@ struct task_struct { - #ifdef CONFIG_COMPAT_BRK - unsigned brk_randomized:1; - #endif -+#ifdef CONFIG_CGROUPS -+ /* disallow userland-initiated cgroup migration */ -+ unsigned no_cgroup_migration:1; -+#endif - - unsigned long atomic_flags; /* Flags needing atomic access. */ - -diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index 127c63e02d52..4cb94b678e9f 100644 ---- a/kernel/cgroup.c -+++ b/kernel/cgroup.c -@@ -2752,11 +2752,12 @@ static ssize_t __cgroup_procs_write(struct kernfs_open_file *of, char *buf, - tsk = tsk->group_leader; - - /* -- * Workqueue threads may acquire PF_NO_SETAFFINITY and become -- * trapped in a cpuset, or RT worker may be born in a cgroup -- * with no rt_runtime allocated. Just say no. -+ * kthreads may acquire PF_NO_SETAFFINITY during initialization. -+ * If userland migrates such a kthread to a non-root cgroup, it can -+ * become trapped in a cpuset, or RT kthread may be born in a -+ * cgroup with no rt_runtime allocated. Just say no. - */ -- if (tsk == kthreadd_task || (tsk->flags & PF_NO_SETAFFINITY)) { -+ if (tsk->no_cgroup_migration || (tsk->flags & PF_NO_SETAFFINITY)) { - ret = -EINVAL; - goto out_unlock_rcu; - } -diff --git a/kernel/kthread.c b/kernel/kthread.c -index 9ff173dca1ae..850b255649a2 100644 ---- a/kernel/kthread.c -+++ b/kernel/kthread.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - - static DEFINE_SPINLOCK(kthread_create_lock); -@@ -205,6 +206,7 @@ static int kthread(void *_create) - ret = -EINTR; - - if (!test_bit(KTHREAD_SHOULD_STOP, &self.flags)) { -+ cgroup_kthread_ready(); - __kthread_parkme(&self); - ret = threadfn(data); - } -@@ -510,6 +512,7 @@ int kthreadd(void *unused) - set_mems_allowed(node_states[N_MEMORY]); - - current->flags |= PF_NOFREEZE; -+ cgroup_init_kthreadd(); - - for (;;) { - set_current_state(TASK_INTERRUPTIBLE); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 3f743b147247..34b2a0d5cf1a 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -3677,23 +3677,24 @@ static void __enable_ftrace_function_probe(struct ftrace_ops_hash *old_hash) - ftrace_probe_registered = 1; - } - --static void __disable_ftrace_function_probe(void) -+static bool __disable_ftrace_function_probe(void) - { - int i; - - if (!ftrace_probe_registered) -- return; -+ return false; - - for (i = 0; i < FTRACE_FUNC_HASHSIZE; i++) { - struct hlist_head *hhd = &ftrace_func_hash[i]; - if (hhd->first) -- return; -+ return false; - } - - /* no more funcs left */ - ftrace_shutdown(&trace_probe_ops, 0); - - ftrace_probe_registered = 0; -+ return true; - } - - -@@ -3820,6 +3821,7 @@ static void - __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - void *data, int flags) - { -+ struct ftrace_ops_hash old_hash_ops; - struct ftrace_func_entry *rec_entry; - struct ftrace_func_probe *entry; - struct ftrace_func_probe *p; -@@ -3831,6 +3833,7 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - struct hlist_node *tmp; - char str[KSYM_SYMBOL_LEN]; - int i, ret; -+ bool disabled; - - if (glob && (strcmp(glob, "*") == 0 || !strlen(glob))) - func_g.search = NULL; -@@ -3849,6 +3852,10 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - - mutex_lock(&trace_probe_ops.func_hash->regex_lock); - -+ old_hash_ops.filter_hash = old_hash; -+ /* Probes only have filters */ -+ old_hash_ops.notrace_hash = NULL; -+ - hash = alloc_and_copy_ftrace_hash(FTRACE_HASH_DEFAULT_BITS, *orig_hash); - if (!hash) - /* Hmm, should report this somehow */ -@@ -3886,12 +3893,17 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - } - } - mutex_lock(&ftrace_lock); -- __disable_ftrace_function_probe(); -+ disabled = __disable_ftrace_function_probe(); - /* - * Remove after the disable is called. Otherwise, if the last - * probe is removed, a null hash means *all enabled*. - */ - ret = ftrace_hash_move(&trace_probe_ops, 1, orig_hash, hash); -+ -+ /* still need to update the function call sites */ -+ if (ftrace_enabled && !disabled) -+ ftrace_run_modify_code(&trace_probe_ops, FTRACE_UPDATE_CALLS, -+ &old_hash_ops); - synchronize_sched(); - if (!ret) - free_ftrace_hash_rcu(old_hash); -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 36bf4c3fe4f5..9f0aa255e288 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -2084,6 +2084,8 @@ static int ip6_route_del(struct fib6_config *cfg) - continue; - if (cfg->fc_metric && cfg->fc_metric != rt->rt6i_metric) - continue; -+ if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol) -+ continue; - dst_hold(&rt->dst); - read_unlock_bh(&table->tb6_lock); - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 138f2d667212..5758818435f3 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4422,6 +4422,12 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - if (!asoc) - return -EINVAL; - -+ /* If there is a thread waiting on more sndbuf space for -+ * sending on this asoc, it cannot be peeled. -+ */ -+ if (waitqueue_active(&asoc->wait)) -+ return -EBUSY; -+ - /* An association cannot be branched off from an already peeled-off - * socket, nor is this supported for tcp style sockets. - */ -@@ -6960,8 +6966,6 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - */ - release_sock(sk); - current_timeo = schedule_timeout(current_timeo); -- if (sk != asoc->base.sk) -- goto do_error; - lock_sock(sk); - - *timeo_p = current_timeo; -diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c -index 06095cc8815e..1f0687d8e3d7 100644 ---- a/net/sunrpc/auth_gss/auth_gss.c -+++ b/net/sunrpc/auth_gss/auth_gss.c -@@ -541,9 +541,13 @@ gss_setup_upcall(struct gss_auth *gss_auth, struct rpc_cred *cred) - return gss_new; - gss_msg = gss_add_msg(gss_new); - if (gss_msg == gss_new) { -- int res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg); -+ int res; -+ atomic_inc(&gss_msg->count); -+ res = rpc_queue_upcall(gss_new->pipe, &gss_new->msg); - if (res) { - gss_unhash_msg(gss_new); -+ atomic_dec(&gss_msg->count); -+ gss_release_msg(gss_new); - gss_msg = ERR_PTR(res); - } - } else -@@ -836,6 +840,7 @@ gss_pipe_destroy_msg(struct rpc_pipe_msg *msg) - warn_gssd(); - gss_release_msg(gss_msg); - } -+ gss_release_msg(gss_msg); - } - - static void gss_pipe_dentry_destroy(struct dentry *dir, diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.63-64.patch b/patch/kernel/mvebu64-default/03-patch-4.4.63-64.patch deleted file mode 100644 index 9d503a345e96..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.63-64.patch +++ /dev/null @@ -1,1016 +0,0 @@ -diff --git a/Makefile b/Makefile -index ec52973043f6..17708f5dc169 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 63 -+SUBLEVEL = 64 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index f91ee2f27b41..01cf10556081 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -300,6 +300,14 @@ static void unmap_range(struct kvm *kvm, pgd_t *pgdp, - next = kvm_pgd_addr_end(addr, end); - if (!pgd_none(*pgd)) - unmap_puds(kvm, pgd, addr, next); -+ /* -+ * If we are dealing with a large range in -+ * stage2 table, release the kvm->mmu_lock -+ * to prevent starvation and lockup detector -+ * warnings. -+ */ -+ if (kvm && (next != end)) -+ cond_resched_lock(&kvm->mmu_lock); - } while (pgd++, addr = next, addr != end); - } - -@@ -738,6 +746,7 @@ int kvm_alloc_stage2_pgd(struct kvm *kvm) - */ - static void unmap_stage2_range(struct kvm *kvm, phys_addr_t start, u64 size) - { -+ assert_spin_locked(&kvm->mmu_lock); - unmap_range(kvm, kvm->arch.pgd, start, size); - } - -@@ -824,7 +833,10 @@ void kvm_free_stage2_pgd(struct kvm *kvm) - if (kvm->arch.pgd == NULL) - return; - -+ spin_lock(&kvm->mmu_lock); - unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); -+ spin_unlock(&kvm->mmu_lock); -+ - kvm_free_hwpgd(kvm_get_hwpgd(kvm)); - if (KVM_PREALLOC_LEVEL > 0) - kfree(kvm->arch.pgd); -diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S -index edba294620db..f6fd0332c3a2 100644 ---- a/arch/powerpc/kernel/entry_64.S -+++ b/arch/powerpc/kernel/entry_64.S -@@ -716,7 +716,7 @@ resume_kernel: - - addi r8,r1,INT_FRAME_SIZE /* Get the kprobed function entry */ - -- lwz r3,GPR1(r1) -+ ld r3,GPR1(r1) - subi r3,r3,INT_FRAME_SIZE /* dst: Allocate a trampoline exception frame */ - mr r4,r1 /* src: current exception frame */ - mr r1,r3 /* Reroute the trampoline frame to r1 */ -@@ -730,8 +730,8 @@ resume_kernel: - addi r6,r6,8 - bdnz 2b - -- /* Do real store operation to complete stwu */ -- lwz r5,GPR1(r1) -+ /* Do real store operation to complete stdu */ -+ ld r5,GPR1(r1) - std r8,0(r5) - - /* Clear _TIF_EMULATE_STACK_STORE flag */ -diff --git a/arch/s390/include/asm/pgtable.h b/arch/s390/include/asm/pgtable.h -index 024f85f947ae..e2c0e4eab037 100644 ---- a/arch/s390/include/asm/pgtable.h -+++ b/arch/s390/include/asm/pgtable.h -@@ -829,6 +829,8 @@ static inline void set_pte_at(struct mm_struct *mm, unsigned long addr, - { - pgste_t pgste; - -+ if (pte_present(entry)) -+ pte_val(entry) &= ~_PAGE_UNUSED; - if (mm_has_pgste(mm)) { - pgste = pgste_get_lock(ptep); - pgste_val(pgste) &= ~_PGSTE_GPS_ZERO; -diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h -index d8ce3ec816ab..bd8ce6bcdfc9 100644 ---- a/arch/x86/include/asm/pmem.h -+++ b/arch/x86/include/asm/pmem.h -@@ -72,8 +72,8 @@ static inline void arch_wmb_pmem(void) - * @size: number of bytes to write back - * - * Write back a cache range using the CLWB (cache line write back) -- * instruction. This function requires explicit ordering with an -- * arch_wmb_pmem() call. This API is internal to the x86 PMEM implementation. -+ * instruction. Note that @size is internally rounded up to be cache -+ * line size aligned. - */ - static inline void __arch_wb_cache_pmem(void *vaddr, size_t size) - { -@@ -87,15 +87,6 @@ static inline void __arch_wb_cache_pmem(void *vaddr, size_t size) - clwb(p); - } - --/* -- * copy_from_iter_nocache() on x86 only uses non-temporal stores for iovec -- * iterators, so for other types (bvec & kvec) we must do a cache write-back. -- */ --static inline bool __iter_needs_pmem_wb(struct iov_iter *i) --{ -- return iter_is_iovec(i) == false; --} -- - /** - * arch_copy_from_iter_pmem - copy data from an iterator to PMEM - * @addr: PMEM destination address -@@ -114,8 +105,36 @@ static inline size_t arch_copy_from_iter_pmem(void __pmem *addr, size_t bytes, - /* TODO: skip the write-back by always using non-temporal stores */ - len = copy_from_iter_nocache(vaddr, bytes, i); - -- if (__iter_needs_pmem_wb(i)) -- __arch_wb_cache_pmem(vaddr, bytes); -+ /* -+ * In the iovec case on x86_64 copy_from_iter_nocache() uses -+ * non-temporal stores for the bulk of the transfer, but we need -+ * to manually flush if the transfer is unaligned. A cached -+ * memory copy is used when destination or size is not naturally -+ * aligned. That is: -+ * - Require 8-byte alignment when size is 8 bytes or larger. -+ * - Require 4-byte alignment when size is 4 bytes. -+ * -+ * In the non-iovec case the entire destination needs to be -+ * flushed. -+ */ -+ if (iter_is_iovec(i)) { -+ unsigned long flushed, dest = (unsigned long) addr; -+ -+ if (bytes < 8) { -+ if (!IS_ALIGNED(dest, 4) || (bytes != 4)) -+ __arch_wb_cache_pmem(addr, 1); -+ } else { -+ if (!IS_ALIGNED(dest, 8)) { -+ dest = ALIGN(dest, boot_cpu_data.x86_clflush_size); -+ __arch_wb_cache_pmem(addr, 1); -+ } -+ -+ flushed = dest - (unsigned long) addr; -+ if (bytes > flushed && !IS_ALIGNED(bytes - flushed, 8)) -+ __arch_wb_cache_pmem(addr + bytes - 1, 1); -+ } -+ } else -+ __arch_wb_cache_pmem(addr, bytes); - - return len; - } -diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c -index e99b15077e94..62aca448726a 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c -+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c -@@ -53,7 +53,7 @@ static const char * const th_names[] = { - "load_store", - "insn_fetch", - "combined_unit", -- "", -+ "decode_unit", - "northbridge", - "execution_unit", - }; -diff --git a/block/genhd.c b/block/genhd.c -index a5bed6bc869d..3032453a89e6 100644 ---- a/block/genhd.c -+++ b/block/genhd.c -@@ -664,7 +664,6 @@ void del_gendisk(struct gendisk *disk) - - kobject_put(disk->part0.holder_dir); - kobject_put(disk->slave_dir); -- disk->driverfs_dev = NULL; - if (!sysfs_deprecated) - sysfs_remove_link(block_depr, dev_name(disk_to_dev(disk))); - pm_runtime_set_memalloc_noio(disk_to_dev(disk), false); -diff --git a/drivers/acpi/power.c b/drivers/acpi/power.c -index fcd4ce6f78d5..1c2b846c5776 100644 ---- a/drivers/acpi/power.c -+++ b/drivers/acpi/power.c -@@ -200,6 +200,7 @@ static int acpi_power_get_list_state(struct list_head *list, int *state) - return -EINVAL; - - /* The state of the list is 'on' IFF all resources are 'on'. */ -+ cur_state = 0; - list_for_each_entry(entry, list, node) { - struct acpi_power_resource *resource = entry->resource; - acpi_handle handle = resource->device.handle; -diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 1ef37c727572..d037454fe7b8 100644 ---- a/drivers/hv/channel.c -+++ b/drivers/hv/channel.c -@@ -73,7 +73,6 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - void *in, *out; - unsigned long flags; - int ret, err = 0; -- unsigned long t; - struct page *page; - - spin_lock_irqsave(&newchannel->lock, flags); -@@ -183,11 +182,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, - goto error1; - } - -- t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ); -- if (t == 0) { -- err = -ETIMEDOUT; -- goto error1; -- } -+ wait_for_completion(&open_info->waitevent); - - spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); - list_del(&open_info->msglistentry); -@@ -375,7 +370,7 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, - struct vmbus_channel_gpadl_header *gpadlmsg; - struct vmbus_channel_gpadl_body *gpadl_body; - struct vmbus_channel_msginfo *msginfo = NULL; -- struct vmbus_channel_msginfo *submsginfo; -+ struct vmbus_channel_msginfo *submsginfo, *tmp; - u32 msgcount; - struct list_head *curr; - u32 next_gpadl_handle; -@@ -437,6 +432,13 @@ cleanup: - list_del(&msginfo->msglistentry); - spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); - -+ if (msgcount > 1) { -+ list_for_each_entry_safe(submsginfo, tmp, &msginfo->submsglist, -+ msglistentry) { -+ kfree(submsginfo); -+ } -+ } -+ - kfree(msginfo); - return ret; - } -diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c -index 4fc2e8836e60..2bbc53025549 100644 ---- a/drivers/hv/connection.c -+++ b/drivers/hv/connection.c -@@ -429,7 +429,7 @@ int vmbus_post_msg(void *buffer, size_t buflen) - union hv_connection_id conn_id; - int ret = 0; - int retries = 0; -- u32 msec = 1; -+ u32 usec = 1; - - conn_id.asu32 = 0; - conn_id.u.id = VMBUS_MESSAGE_CONNECTION_ID; -@@ -462,9 +462,9 @@ int vmbus_post_msg(void *buffer, size_t buflen) - } - - retries++; -- msleep(msec); -- if (msec < 2048) -- msec *= 2; -+ udelay(usec); -+ if (usec < 2048) -+ usec *= 2; - } - return ret; - } -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index ddbf7e7e0d98..8ce1f2e22912 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -305,9 +305,10 @@ void hv_cleanup(bool crash) - - hypercall_msr.as_uint64 = 0; - wrmsrl(HV_X64_MSR_REFERENCE_TSC, hypercall_msr.as_uint64); -- if (!crash) -+ if (!crash) { - vfree(hv_context.tsc_page); -- hv_context.tsc_page = NULL; -+ hv_context.tsc_page = NULL; -+ } - } - #endif - } -diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c -index 43af91362be5..354da7f207b7 100644 ---- a/drivers/hv/hv_balloon.c -+++ b/drivers/hv/hv_balloon.c -@@ -430,16 +430,27 @@ struct dm_info_msg { - * currently hot added. We hot add in multiples of 128M - * chunks; it is possible that we may not be able to bring - * online all the pages in the region. The range -- * covered_end_pfn defines the pages that can -+ * covered_start_pfn:covered_end_pfn defines the pages that can - * be brough online. - */ - - struct hv_hotadd_state { - struct list_head list; - unsigned long start_pfn; -+ unsigned long covered_start_pfn; - unsigned long covered_end_pfn; - unsigned long ha_end_pfn; - unsigned long end_pfn; -+ /* -+ * A list of gaps. -+ */ -+ struct list_head gap_list; -+}; -+ -+struct hv_hotadd_gap { -+ struct list_head list; -+ unsigned long start_pfn; -+ unsigned long end_pfn; - }; - - struct balloon_state { -@@ -595,18 +606,46 @@ static struct notifier_block hv_memory_nb = { - .priority = 0 - }; - -+/* Check if the particular page is backed and can be onlined and online it. */ -+static void hv_page_online_one(struct hv_hotadd_state *has, struct page *pg) -+{ -+ unsigned long cur_start_pgp; -+ unsigned long cur_end_pgp; -+ struct hv_hotadd_gap *gap; -+ -+ cur_start_pgp = (unsigned long)pfn_to_page(has->covered_start_pfn); -+ cur_end_pgp = (unsigned long)pfn_to_page(has->covered_end_pfn); -+ -+ /* The page is not backed. */ -+ if (((unsigned long)pg < cur_start_pgp) || -+ ((unsigned long)pg >= cur_end_pgp)) -+ return; -+ -+ /* Check for gaps. */ -+ list_for_each_entry(gap, &has->gap_list, list) { -+ cur_start_pgp = (unsigned long) -+ pfn_to_page(gap->start_pfn); -+ cur_end_pgp = (unsigned long) -+ pfn_to_page(gap->end_pfn); -+ if (((unsigned long)pg >= cur_start_pgp) && -+ ((unsigned long)pg < cur_end_pgp)) { -+ return; -+ } -+ } - --static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size) -+ /* This frame is currently backed; online the page. */ -+ __online_page_set_limits(pg); -+ __online_page_increment_counters(pg); -+ __online_page_free(pg); -+} -+ -+static void hv_bring_pgs_online(struct hv_hotadd_state *has, -+ unsigned long start_pfn, unsigned long size) - { - int i; - -- for (i = 0; i < size; i++) { -- struct page *pg; -- pg = pfn_to_page(start_pfn + i); -- __online_page_set_limits(pg); -- __online_page_increment_counters(pg); -- __online_page_free(pg); -- } -+ for (i = 0; i < size; i++) -+ hv_page_online_one(has, pfn_to_page(start_pfn + i)); - } - - static void hv_mem_hot_add(unsigned long start, unsigned long size, -@@ -682,26 +721,25 @@ static void hv_online_page(struct page *pg) - - list_for_each(cur, &dm_device.ha_region_list) { - has = list_entry(cur, struct hv_hotadd_state, list); -- cur_start_pgp = (unsigned long)pfn_to_page(has->start_pfn); -- cur_end_pgp = (unsigned long)pfn_to_page(has->covered_end_pfn); -+ cur_start_pgp = (unsigned long) -+ pfn_to_page(has->start_pfn); -+ cur_end_pgp = (unsigned long)pfn_to_page(has->end_pfn); - -- if (((unsigned long)pg >= cur_start_pgp) && -- ((unsigned long)pg < cur_end_pgp)) { -- /* -- * This frame is currently backed; online the -- * page. -- */ -- __online_page_set_limits(pg); -- __online_page_increment_counters(pg); -- __online_page_free(pg); -- } -+ /* The page belongs to a different HAS. */ -+ if (((unsigned long)pg < cur_start_pgp) || -+ ((unsigned long)pg >= cur_end_pgp)) -+ continue; -+ -+ hv_page_online_one(has, pg); -+ break; - } - } - --static bool pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) -+static int pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) - { - struct list_head *cur; - struct hv_hotadd_state *has; -+ struct hv_hotadd_gap *gap; - unsigned long residual, new_inc; - - if (list_empty(&dm_device.ha_region_list)) -@@ -716,6 +754,24 @@ static bool pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) - */ - if (start_pfn < has->start_pfn || start_pfn >= has->end_pfn) - continue; -+ -+ /* -+ * If the current start pfn is not where the covered_end -+ * is, create a gap and update covered_end_pfn. -+ */ -+ if (has->covered_end_pfn != start_pfn) { -+ gap = kzalloc(sizeof(struct hv_hotadd_gap), GFP_ATOMIC); -+ if (!gap) -+ return -ENOMEM; -+ -+ INIT_LIST_HEAD(&gap->list); -+ gap->start_pfn = has->covered_end_pfn; -+ gap->end_pfn = start_pfn; -+ list_add_tail(&gap->list, &has->gap_list); -+ -+ has->covered_end_pfn = start_pfn; -+ } -+ - /* - * If the current hot add-request extends beyond - * our current limit; extend it. -@@ -732,19 +788,10 @@ static bool pfn_covered(unsigned long start_pfn, unsigned long pfn_cnt) - has->end_pfn += new_inc; - } - -- /* -- * If the current start pfn is not where the covered_end -- * is, update it. -- */ -- -- if (has->covered_end_pfn != start_pfn) -- has->covered_end_pfn = start_pfn; -- -- return true; -- -+ return 1; - } - -- return false; -+ return 0; - } - - static unsigned long handle_pg_range(unsigned long pg_start, -@@ -783,6 +830,8 @@ static unsigned long handle_pg_range(unsigned long pg_start, - if (pgs_ol > pfn_cnt) - pgs_ol = pfn_cnt; - -+ has->covered_end_pfn += pgs_ol; -+ pfn_cnt -= pgs_ol; - /* - * Check if the corresponding memory block is already - * online by checking its last previously backed page. -@@ -791,10 +840,8 @@ static unsigned long handle_pg_range(unsigned long pg_start, - */ - if (start_pfn > has->start_pfn && - !PageReserved(pfn_to_page(start_pfn - 1))) -- hv_bring_pgs_online(start_pfn, pgs_ol); -+ hv_bring_pgs_online(has, start_pfn, pgs_ol); - -- has->covered_end_pfn += pgs_ol; -- pfn_cnt -= pgs_ol; - } - - if ((has->ha_end_pfn < has->end_pfn) && (pfn_cnt > 0)) { -@@ -832,13 +879,19 @@ static unsigned long process_hot_add(unsigned long pg_start, - unsigned long rg_size) - { - struct hv_hotadd_state *ha_region = NULL; -+ int covered; - - if (pfn_cnt == 0) - return 0; - -- if (!dm_device.host_specified_ha_region) -- if (pfn_covered(pg_start, pfn_cnt)) -+ if (!dm_device.host_specified_ha_region) { -+ covered = pfn_covered(pg_start, pfn_cnt); -+ if (covered < 0) -+ return 0; -+ -+ if (covered) - goto do_pg_range; -+ } - - /* - * If the host has specified a hot-add range; deal with it first. -@@ -850,10 +903,12 @@ static unsigned long process_hot_add(unsigned long pg_start, - return 0; - - INIT_LIST_HEAD(&ha_region->list); -+ INIT_LIST_HEAD(&ha_region->gap_list); - - list_add_tail(&ha_region->list, &dm_device.ha_region_list); - ha_region->start_pfn = rg_start; - ha_region->ha_end_pfn = rg_start; -+ ha_region->covered_start_pfn = pg_start; - ha_region->covered_end_pfn = pg_start; - ha_region->end_pfn = rg_start + rg_size; - } -@@ -1581,6 +1636,7 @@ static int balloon_remove(struct hv_device *dev) - struct hv_dynmem_device *dm = hv_get_drvdata(dev); - struct list_head *cur, *tmp; - struct hv_hotadd_state *has; -+ struct hv_hotadd_gap *gap, *tmp_gap; - - if (dm->num_pages_ballooned != 0) - pr_warn("Ballooned pages: %d\n", dm->num_pages_ballooned); -@@ -1597,6 +1653,10 @@ static int balloon_remove(struct hv_device *dev) - #endif - list_for_each_safe(cur, tmp, &dm->ha_region_list) { - has = list_entry(cur, struct hv_hotadd_state, list); -+ list_for_each_entry_safe(gap, tmp_gap, &has->gap_list, list) { -+ list_del(&gap->list); -+ kfree(gap); -+ } - list_del(&has->list); - kfree(has); - } -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 43482ae1e049..1a2b2620421e 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1122,6 +1122,7 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, - * Asus UX32VD 0x361f02 00, 15, 0e clickpad - * Avatar AVIU-145A2 0x361f00 ? clickpad - * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons -+ * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons - * Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons - * Fujitsu T725 0x470f01 05, 12, 09 2 hw buttons - * Fujitsu H730 0x570f00 c0, 14, 0c 3 hw buttons (**) -@@ -1528,6 +1529,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = { - }, - }, - { -+ /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E547"), -+ }, -+ }, -+ { - /* Fujitsu LIFEBOOK E554 does not work with crc_enabled == 0 */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c -index 1f1582f6cccb..8d838779fd1b 100644 ---- a/drivers/mmc/host/sdhci-esdhc-imx.c -+++ b/drivers/mmc/host/sdhci-esdhc-imx.c -@@ -804,6 +804,7 @@ static int esdhc_change_pinstate(struct sdhci_host *host, - - switch (uhs) { - case MMC_TIMING_UHS_SDR50: -+ case MMC_TIMING_UHS_DDR50: - pinctrl = imx_data->pins_100mhz; - break; - case MMC_TIMING_UHS_SDR104: -diff --git a/drivers/mtd/ubi/upd.c b/drivers/mtd/ubi/upd.c -index 0134ba32a057..39712560b4c1 100644 ---- a/drivers/mtd/ubi/upd.c -+++ b/drivers/mtd/ubi/upd.c -@@ -148,11 +148,11 @@ int ubi_start_update(struct ubi_device *ubi, struct ubi_volume *vol, - return err; - } - -- if (bytes == 0) { -- err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL); -- if (err) -- return err; -+ err = ubi_wl_flush(ubi, UBI_ALL, UBI_ALL); -+ if (err) -+ return err; - -+ if (bytes == 0) { - err = clear_update_marker(ubi, vol, 0); - if (err) - return err; -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index b76883606e4b..94906aaa9b7c 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -906,7 +906,6 @@ struct cifs_tcon { - bool use_persistent:1; /* use persistent instead of durable handles */ - #ifdef CONFIG_CIFS_SMB2 - bool print:1; /* set if connection to printer share */ -- bool bad_network_name:1; /* set if ret status STATUS_BAD_NETWORK_NAME */ - __le32 capabilities; - __u32 share_flags; - __u32 maximal_access; -diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c -index fc537c29044e..87b87e091e8e 100644 ---- a/fs/cifs/smb1ops.c -+++ b/fs/cifs/smb1ops.c -@@ -1015,6 +1015,15 @@ cifs_dir_needs_close(struct cifsFileInfo *cfile) - return !cfile->srch_inf.endOfSearch && !cfile->invalidHandle; - } - -+static bool -+cifs_can_echo(struct TCP_Server_Info *server) -+{ -+ if (server->tcpStatus == CifsGood) -+ return true; -+ -+ return false; -+} -+ - struct smb_version_operations smb1_operations = { - .send_cancel = send_nt_cancel, - .compare_fids = cifs_compare_fids, -@@ -1049,6 +1058,7 @@ struct smb_version_operations smb1_operations = { - .get_dfs_refer = CIFSGetDFSRefer, - .qfs_tcon = cifs_qfs_tcon, - .is_path_accessible = cifs_is_path_accessible, -+ .can_echo = cifs_can_echo, - .query_path_info = cifs_query_path_info, - .query_file_info = cifs_query_file_info, - .get_srv_inum = cifs_get_srv_inum, -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 6cb5c4b30e78..6cb2603f8a5c 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -932,9 +932,6 @@ SMB2_tcon(const unsigned int xid, struct cifs_ses *ses, const char *tree, - else - return -EIO; - -- if (tcon && tcon->bad_network_name) -- return -ENOENT; -- - if ((tcon && tcon->seal) && - ((ses->server->capabilities & SMB2_GLOBAL_CAP_ENCRYPTION) == 0)) { - cifs_dbg(VFS, "encryption requested but no server support"); -@@ -1036,8 +1033,6 @@ tcon_exit: - tcon_error_exit: - if (rsp->hdr.Status == STATUS_BAD_NETWORK_NAME) { - cifs_dbg(VFS, "BAD_NETWORK_NAME: %s\n", tree); -- if (tcon) -- tcon->bad_network_name = true; - } - goto tcon_exit; - } -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 7d7f99b0db47..1275175b0946 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -3440,11 +3440,23 @@ EXPORT_SYMBOL_GPL(ring_buffer_iter_reset); - int ring_buffer_iter_empty(struct ring_buffer_iter *iter) - { - struct ring_buffer_per_cpu *cpu_buffer; -+ struct buffer_page *reader; -+ struct buffer_page *head_page; -+ struct buffer_page *commit_page; -+ unsigned commit; - - cpu_buffer = iter->cpu_buffer; - -- return iter->head_page == cpu_buffer->commit_page && -- iter->head == rb_commit_index(cpu_buffer); -+ /* Remember, trace recording is off when iterator is in use */ -+ reader = cpu_buffer->reader_page; -+ head_page = cpu_buffer->head_page; -+ commit_page = cpu_buffer->commit_page; -+ commit = rb_page_commit(commit_page); -+ -+ return ((iter->head_page == commit_page && iter->head == commit) || -+ (iter->head_page == reader && commit_page == head_page && -+ head_page->read == commit && -+ iter->head == rb_page_commit(cpu_buffer->reader_page))); - } - EXPORT_SYMBOL_GPL(ring_buffer_iter_empty); - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 059233abcfcf..4c21c0b7dc91 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6060,11 +6060,13 @@ ftrace_trace_snapshot_callback(struct ftrace_hash *hash, - return ret; - - out_reg: -- ret = register_ftrace_function_probe(glob, ops, count); -+ ret = alloc_snapshot(&global_trace); -+ if (ret < 0) -+ goto out; - -- if (ret >= 0) -- alloc_snapshot(&global_trace); -+ ret = register_ftrace_function_probe(glob, ops, count); - -+ out: - return ret < 0 ? ret : 0; - } - -diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c -index 2b528389409f..9f0915f72702 100644 ---- a/net/mac80211/rx.c -+++ b/net/mac80211/rx.c -@@ -3396,6 +3396,27 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) - !ether_addr_equal(bssid, hdr->addr1)) - return false; - } -+ -+ /* -+ * 802.11-2016 Table 9-26 says that for data frames, A1 must be -+ * the BSSID - we've checked that already but may have accepted -+ * the wildcard (ff:ff:ff:ff:ff:ff). -+ * -+ * It also says: -+ * The BSSID of the Data frame is determined as follows: -+ * a) If the STA is contained within an AP or is associated -+ * with an AP, the BSSID is the address currently in use -+ * by the STA contained in the AP. -+ * -+ * So we should not accept data frames with an address that's -+ * multicast. -+ * -+ * Accepting it also opens a security problem because stations -+ * could encrypt it with the GTK and inject traffic that way. -+ */ -+ if (ieee80211_is_data(hdr->frame_control) && multicast) -+ return false; -+ - return true; - case NL80211_IFTYPE_WDS: - if (bssid || !ieee80211_is_data(hdr->frame_control)) -diff --git a/net/tipc/node.c b/net/tipc/node.c -index 3926b561f873..d468aad6163e 100644 ---- a/net/tipc/node.c -+++ b/net/tipc/node.c -@@ -102,9 +102,10 @@ static unsigned int tipc_hashfn(u32 addr) - - static void tipc_node_kref_release(struct kref *kref) - { -- struct tipc_node *node = container_of(kref, struct tipc_node, kref); -+ struct tipc_node *n = container_of(kref, struct tipc_node, kref); - -- tipc_node_delete(node); -+ kfree(n->bc_entry.link); -+ kfree_rcu(n, rcu); - } - - void tipc_node_put(struct tipc_node *node) -@@ -216,21 +217,20 @@ static void tipc_node_delete(struct tipc_node *node) - { - list_del_rcu(&node->list); - hlist_del_rcu(&node->hash); -- kfree(node->bc_entry.link); -- kfree_rcu(node, rcu); -+ tipc_node_put(node); -+ -+ del_timer_sync(&node->timer); -+ tipc_node_put(node); - } - - void tipc_node_stop(struct net *net) - { -- struct tipc_net *tn = net_generic(net, tipc_net_id); -+ struct tipc_net *tn = tipc_net(net); - struct tipc_node *node, *t_node; - - spin_lock_bh(&tn->node_list_lock); -- list_for_each_entry_safe(node, t_node, &tn->node_list, list) { -- if (del_timer(&node->timer)) -- tipc_node_put(node); -- tipc_node_put(node); -- } -+ list_for_each_entry_safe(node, t_node, &tn->node_list, list) -+ tipc_node_delete(node); - spin_unlock_bh(&tn->node_list_lock); - } - -@@ -313,9 +313,7 @@ static void tipc_node_timeout(unsigned long data) - if (rc & TIPC_LINK_DOWN_EVT) - tipc_node_link_down(n, bearer_id, false); - } -- if (!mod_timer(&n->timer, jiffies + n->keepalive_intv)) -- tipc_node_get(n); -- tipc_node_put(n); -+ mod_timer(&n->timer, jiffies + n->keepalive_intv); - } - - /** -diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c -index 0a369bb440e7..662bdd20a748 100644 ---- a/net/vmw_vsock/vmci_transport.c -+++ b/net/vmw_vsock/vmci_transport.c -@@ -842,7 +842,7 @@ static void vmci_transport_peer_detach_cb(u32 sub_id, - * qp_handle. - */ - if (vmci_handle_is_invalid(e_payload->handle) || -- vmci_handle_is_equal(trans->qp_handle, e_payload->handle)) -+ !vmci_handle_is_equal(trans->qp_handle, e_payload->handle)) - return; - - /* We don't ask for delayed CBs when we subscribe to this event (we -@@ -2154,7 +2154,7 @@ module_exit(vmci_transport_exit); - - MODULE_AUTHOR("VMware, Inc."); - MODULE_DESCRIPTION("VMCI transport for Virtual Sockets"); --MODULE_VERSION("1.0.2.0-k"); -+MODULE_VERSION("1.0.3.0-k"); - MODULE_LICENSE("GPL v2"); - MODULE_ALIAS("vmware_vsock"); - MODULE_ALIAS_NETPROTO(PF_VSOCK); -diff --git a/security/keys/gc.c b/security/keys/gc.c -index addf060399e0..9cb4fe4478a1 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -46,7 +46,7 @@ static unsigned long key_gc_flags; - * immediately unlinked. - */ - struct key_type key_type_dead = { -- .name = "dead", -+ .name = ".dead", - }; - - /* -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index 1c3872aeed14..442e350c209d 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -271,7 +271,8 @@ error: - * Create and join an anonymous session keyring or join a named session - * keyring, creating it if necessary. A named session keyring must have Search - * permission for it to be joined. Session keyrings without this permit will -- * be skipped over. -+ * be skipped over. It is not permitted for userspace to create or join -+ * keyrings whose name begin with a dot. - * - * If successful, the ID of the joined session keyring will be returned. - */ -@@ -288,12 +289,16 @@ long keyctl_join_session_keyring(const char __user *_name) - ret = PTR_ERR(name); - goto error; - } -+ -+ ret = -EPERM; -+ if (name[0] == '.') -+ goto error_name; - } - - /* join the session */ - ret = join_session_keyring(name); -+error_name: - kfree(name); -- - error: - return ret; - } -@@ -1223,8 +1228,8 @@ error: - * Read or set the default keyring in which request_key() will cache keys and - * return the old setting. - * -- * If a process keyring is specified then this will be created if it doesn't -- * yet exist. The old setting will be returned if successful. -+ * If a thread or process keyring is specified then it will be created if it -+ * doesn't yet exist. The old setting will be returned if successful. - */ - long keyctl_set_reqkey_keyring(int reqkey_defl) - { -@@ -1249,11 +1254,8 @@ long keyctl_set_reqkey_keyring(int reqkey_defl) - - case KEY_REQKEY_DEFL_PROCESS_KEYRING: - ret = install_process_keyring_to_cred(new); -- if (ret < 0) { -- if (ret != -EEXIST) -- goto error; -- ret = 0; -- } -+ if (ret < 0) -+ goto error; - goto set; - - case KEY_REQKEY_DEFL_DEFAULT: -diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index e6d50172872f..4ed909142956 100644 ---- a/security/keys/process_keys.c -+++ b/security/keys/process_keys.c -@@ -125,13 +125,18 @@ error: - } - - /* -- * Install a fresh thread keyring directly to new credentials. This keyring is -- * allowed to overrun the quota. -+ * Install a thread keyring to the given credentials struct if it didn't have -+ * one already. This is allowed to overrun the quota. -+ * -+ * Return: 0 if a thread keyring is now present; -errno on failure. - */ - int install_thread_keyring_to_cred(struct cred *new) - { - struct key *keyring; - -+ if (new->thread_keyring) -+ return 0; -+ - keyring = keyring_alloc("_tid", new->uid, new->gid, new, - KEY_POS_ALL | KEY_USR_VIEW, - KEY_ALLOC_QUOTA_OVERRUN, NULL); -@@ -143,7 +148,9 @@ int install_thread_keyring_to_cred(struct cred *new) - } - - /* -- * Install a fresh thread keyring, discarding the old one. -+ * Install a thread keyring to the current task if it didn't have one already. -+ * -+ * Return: 0 if a thread keyring is now present; -errno on failure. - */ - static int install_thread_keyring(void) - { -@@ -154,8 +161,6 @@ static int install_thread_keyring(void) - if (!new) - return -ENOMEM; - -- BUG_ON(new->thread_keyring); -- - ret = install_thread_keyring_to_cred(new); - if (ret < 0) { - abort_creds(new); -@@ -166,17 +171,17 @@ static int install_thread_keyring(void) - } - - /* -- * Install a process keyring directly to a credentials struct. -+ * Install a process keyring to the given credentials struct if it didn't have -+ * one already. This is allowed to overrun the quota. - * -- * Returns -EEXIST if there was already a process keyring, 0 if one installed, -- * and other value on any other error -+ * Return: 0 if a process keyring is now present; -errno on failure. - */ - int install_process_keyring_to_cred(struct cred *new) - { - struct key *keyring; - - if (new->process_keyring) -- return -EEXIST; -+ return 0; - - keyring = keyring_alloc("_pid", new->uid, new->gid, new, - KEY_POS_ALL | KEY_USR_VIEW, -@@ -189,11 +194,9 @@ int install_process_keyring_to_cred(struct cred *new) - } - - /* -- * Make sure a process keyring is installed for the current process. The -- * existing process keyring is not replaced. -+ * Install a process keyring to the current task if it didn't have one already. - * -- * Returns 0 if there is a process keyring by the end of this function, some -- * error otherwise. -+ * Return: 0 if a process keyring is now present; -errno on failure. - */ - static int install_process_keyring(void) - { -@@ -207,14 +210,18 @@ static int install_process_keyring(void) - ret = install_process_keyring_to_cred(new); - if (ret < 0) { - abort_creds(new); -- return ret != -EEXIST ? ret : 0; -+ return ret; - } - - return commit_creds(new); - } - - /* -- * Install a session keyring directly to a credentials struct. -+ * Install the given keyring as the session keyring of the given credentials -+ * struct, replacing the existing one if any. If the given keyring is NULL, -+ * then install a new anonymous session keyring. -+ * -+ * Return: 0 on success; -errno on failure. - */ - int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) - { -@@ -249,8 +256,11 @@ int install_session_keyring_to_cred(struct cred *cred, struct key *keyring) - } - - /* -- * Install a session keyring, discarding the old one. If a keyring is not -- * supplied, an empty one is invented. -+ * Install the given keyring as the session keyring of the current task, -+ * replacing the existing one if any. If the given keyring is NULL, then -+ * install a new anonymous session keyring. -+ * -+ * Return: 0 on success; -errno on failure. - */ - static int install_session_keyring(struct key *keyring) - { -diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c -index 0d9f48ec42bb..bc7adb84e679 100644 ---- a/tools/hv/hv_kvp_daemon.c -+++ b/tools/hv/hv_kvp_daemon.c -@@ -1433,7 +1433,7 @@ int main(int argc, char *argv[]) - openlog("KVP", 0, LOG_USER); - syslog(LOG_INFO, "KVP starting; pid is:%d", getpid()); - -- kvp_fd = open("/dev/vmbus/hv_kvp", O_RDWR); -+ kvp_fd = open("/dev/vmbus/hv_kvp", O_RDWR | O_CLOEXEC); - - if (kvp_fd < 0) { - syslog(LOG_ERR, "open /dev/vmbus/hv_kvp failed; error: %d %s", diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.64-65.patch b/patch/kernel/mvebu64-default/03-patch-4.4.64-65.patch deleted file mode 100644 index c8da77fdc46c..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.64-65.patch +++ /dev/null @@ -1,920 +0,0 @@ -diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt -index 302b5ed616a6..35e17f748ca7 100644 ---- a/Documentation/sysctl/fs.txt -+++ b/Documentation/sysctl/fs.txt -@@ -265,6 +265,13 @@ aio-nr can grow to. - - ============================================================== - -+mount-max: -+ -+This denotes the maximum number of mounts that may exist -+in a mount namespace. -+ -+============================================================== -+ - - 2. /proc/sys/fs/binfmt_misc - ---------------------------------------------------------- -diff --git a/Makefile b/Makefile -index 17708f5dc169..ddaef04f528a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 64 -+SUBLEVEL = 65 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c -index 4e941f00b600..082ff5608455 100644 ---- a/drivers/media/tuners/tuner-xc2028.c -+++ b/drivers/media/tuners/tuner-xc2028.c -@@ -1403,11 +1403,12 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - * in order to avoid troubles during device release. - */ - kfree(priv->ctrl.fname); -+ priv->ctrl.fname = NULL; - memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); - if (p->fname) { - priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL); - if (priv->ctrl.fname == NULL) -- rc = -ENOMEM; -+ return -ENOMEM; - } - - /* -diff --git a/drivers/net/wireless/hostap/hostap_hw.c b/drivers/net/wireless/hostap/hostap_hw.c -index 6df3ee561d52..515aa3f993f3 100644 ---- a/drivers/net/wireless/hostap/hostap_hw.c -+++ b/drivers/net/wireless/hostap/hostap_hw.c -@@ -836,25 +836,30 @@ static int hfa384x_get_rid(struct net_device *dev, u16 rid, void *buf, int len, - spin_lock_bh(&local->baplock); - - res = hfa384x_setup_bap(dev, BAP0, rid, 0); -- if (!res) -- res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec)); -+ if (res) -+ goto unlock; -+ -+ res = hfa384x_from_bap(dev, BAP0, &rec, sizeof(rec)); -+ if (res) -+ goto unlock; - - if (le16_to_cpu(rec.len) == 0) { - /* RID not available */ - res = -ENODATA; -+ goto unlock; - } - - rlen = (le16_to_cpu(rec.len) - 1) * 2; -- if (!res && exact_len && rlen != len) { -+ if (exact_len && rlen != len) { - printk(KERN_DEBUG "%s: hfa384x_get_rid - RID len mismatch: " - "rid=0x%04x, len=%d (expected %d)\n", - dev->name, rid, rlen, len); - res = -ENODATA; - } - -- if (!res) -- res = hfa384x_from_bap(dev, BAP0, buf, len); -+ res = hfa384x_from_bap(dev, BAP0, buf, len); - -+unlock: - spin_unlock_bh(&local->baplock); - mutex_unlock(&local->rid_bap_mtx); - -diff --git a/drivers/tty/nozomi.c b/drivers/tty/nozomi.c -index 80f9de907563..5cc80b80c82b 100644 ---- a/drivers/tty/nozomi.c -+++ b/drivers/tty/nozomi.c -@@ -823,7 +823,7 @@ static int receive_data(enum port_type index, struct nozomi *dc) - struct tty_struct *tty = tty_port_tty_get(&port->port); - int i, ret; - -- read_mem32((u32 *) &size, addr, 4); -+ size = __le32_to_cpu(readl(addr)); - /* DBG1( "%d bytes port: %d", size, index); */ - - if (tty && test_bit(TTY_THROTTLED, &tty->flags)) { -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 9982cb176ce8..830e2fd47642 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -562,8 +562,9 @@ static long vfio_pci_ioctl(void *device_data, - - } else if (cmd == VFIO_DEVICE_SET_IRQS) { - struct vfio_irq_set hdr; -+ size_t size; - u8 *data = NULL; -- int ret = 0; -+ int max, ret = 0; - - minsz = offsetofend(struct vfio_irq_set, count); - -@@ -571,23 +572,31 @@ static long vfio_pci_ioctl(void *device_data, - return -EFAULT; - - if (hdr.argsz < minsz || hdr.index >= VFIO_PCI_NUM_IRQS || -+ hdr.count >= (U32_MAX - hdr.start) || - hdr.flags & ~(VFIO_IRQ_SET_DATA_TYPE_MASK | - VFIO_IRQ_SET_ACTION_TYPE_MASK)) - return -EINVAL; - -- if (!(hdr.flags & VFIO_IRQ_SET_DATA_NONE)) { -- size_t size; -- int max = vfio_pci_get_irq_count(vdev, hdr.index); -+ max = vfio_pci_get_irq_count(vdev, hdr.index); -+ if (hdr.start >= max || hdr.start + hdr.count > max) -+ return -EINVAL; - -- if (hdr.flags & VFIO_IRQ_SET_DATA_BOOL) -- size = sizeof(uint8_t); -- else if (hdr.flags & VFIO_IRQ_SET_DATA_EVENTFD) -- size = sizeof(int32_t); -- else -- return -EINVAL; -+ switch (hdr.flags & VFIO_IRQ_SET_DATA_TYPE_MASK) { -+ case VFIO_IRQ_SET_DATA_NONE: -+ size = 0; -+ break; -+ case VFIO_IRQ_SET_DATA_BOOL: -+ size = sizeof(uint8_t); -+ break; -+ case VFIO_IRQ_SET_DATA_EVENTFD: -+ size = sizeof(int32_t); -+ break; -+ default: -+ return -EINVAL; -+ } - -- if (hdr.argsz - minsz < hdr.count * size || -- hdr.start >= max || hdr.start + hdr.count > max) -+ if (size) { -+ if (hdr.argsz - minsz < hdr.count * size) - return -EINVAL; - - data = memdup_user((void __user *)(arg + minsz), -diff --git a/drivers/vfio/pci/vfio_pci_intrs.c b/drivers/vfio/pci/vfio_pci_intrs.c -index 20e9a86d2dcf..5c8f767b6368 100644 ---- a/drivers/vfio/pci/vfio_pci_intrs.c -+++ b/drivers/vfio/pci/vfio_pci_intrs.c -@@ -255,7 +255,7 @@ static int vfio_msi_enable(struct vfio_pci_device *vdev, int nvec, bool msix) - if (!is_irq_none(vdev)) - return -EINVAL; - -- vdev->ctx = kzalloc(nvec * sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL); -+ vdev->ctx = kcalloc(nvec, sizeof(struct vfio_pci_irq_ctx), GFP_KERNEL); - if (!vdev->ctx) - return -ENOMEM; - -diff --git a/fs/gfs2/dir.c b/fs/gfs2/dir.c -index ad8a5b757cc7..a443c6e54412 100644 ---- a/fs/gfs2/dir.c -+++ b/fs/gfs2/dir.c -@@ -760,7 +760,7 @@ static int get_first_leaf(struct gfs2_inode *dip, u32 index, - int error; - - error = get_leaf_nr(dip, index, &leaf_no); -- if (!error) -+ if (!IS_ERR_VALUE(error)) - error = get_leaf(dip, leaf_no, bh_out); - - return error; -@@ -976,7 +976,7 @@ static int dir_split_leaf(struct inode *inode, const struct qstr *name) - - index = name->hash >> (32 - dip->i_depth); - error = get_leaf_nr(dip, index, &leaf_no); -- if (error) -+ if (IS_ERR_VALUE(error)) - return error; - - /* Get the old leaf block */ -diff --git a/fs/mount.h b/fs/mount.h -index 3dc7dea5a357..13a4ebbbaa74 100644 ---- a/fs/mount.h -+++ b/fs/mount.h -@@ -13,6 +13,8 @@ struct mnt_namespace { - u64 seq; /* Sequence number to prevent loops */ - wait_queue_head_t poll; - u64 event; -+ unsigned int mounts; /* # of mounts in the namespace */ -+ unsigned int pending_mounts; - }; - - struct mnt_pcp { -diff --git a/fs/namespace.c b/fs/namespace.c -index 7df3d406d3e0..f26d18d69712 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -27,6 +27,9 @@ - #include "pnode.h" - #include "internal.h" - -+/* Maximum number of mounts in a mount namespace */ -+unsigned int sysctl_mount_max __read_mostly = 100000; -+ - static unsigned int m_hash_mask __read_mostly; - static unsigned int m_hash_shift __read_mostly; - static unsigned int mp_hash_mask __read_mostly; -@@ -925,6 +928,9 @@ static void commit_tree(struct mount *mnt) - - list_splice(&head, n->list.prev); - -+ n->mounts += n->pending_mounts; -+ n->pending_mounts = 0; -+ - __attach_mnt(mnt, parent); - touch_mnt_namespace(n); - } -@@ -1445,11 +1451,16 @@ static void umount_tree(struct mount *mnt, enum umount_tree_flags how) - propagate_umount(&tmp_list); - - while (!list_empty(&tmp_list)) { -+ struct mnt_namespace *ns; - bool disconnect; - p = list_first_entry(&tmp_list, struct mount, mnt_list); - list_del_init(&p->mnt_expire); - list_del_init(&p->mnt_list); -- __touch_mnt_namespace(p->mnt_ns); -+ ns = p->mnt_ns; -+ if (ns) { -+ ns->mounts--; -+ __touch_mnt_namespace(ns); -+ } - p->mnt_ns = NULL; - if (how & UMOUNT_SYNC) - p->mnt.mnt_flags |= MNT_SYNC_UMOUNT; -@@ -1850,6 +1861,28 @@ static int invent_group_ids(struct mount *mnt, bool recurse) - return 0; - } - -+int count_mounts(struct mnt_namespace *ns, struct mount *mnt) -+{ -+ unsigned int max = READ_ONCE(sysctl_mount_max); -+ unsigned int mounts = 0, old, pending, sum; -+ struct mount *p; -+ -+ for (p = mnt; p; p = next_mnt(p, mnt)) -+ mounts++; -+ -+ old = ns->mounts; -+ pending = ns->pending_mounts; -+ sum = old + pending; -+ if ((old > sum) || -+ (pending > sum) || -+ (max < sum) || -+ (mounts > (max - sum))) -+ return -ENOSPC; -+ -+ ns->pending_mounts = pending + mounts; -+ return 0; -+} -+ - /* - * @source_mnt : mount tree to be attached - * @nd : place the mount tree @source_mnt is attached -@@ -1919,6 +1952,7 @@ static int attach_recursive_mnt(struct mount *source_mnt, - struct path *parent_path) - { - HLIST_HEAD(tree_list); -+ struct mnt_namespace *ns = dest_mnt->mnt_ns; - struct mountpoint *smp; - struct mount *child, *p; - struct hlist_node *n; -@@ -1931,6 +1965,13 @@ static int attach_recursive_mnt(struct mount *source_mnt, - if (IS_ERR(smp)) - return PTR_ERR(smp); - -+ /* Is there space to add these mounts to the mount namespace? */ -+ if (!parent_path) { -+ err = count_mounts(ns, source_mnt); -+ if (err) -+ goto out; -+ } -+ - if (IS_MNT_SHARED(dest_mnt)) { - err = invent_group_ids(source_mnt, true); - if (err) -@@ -1970,11 +2011,14 @@ static int attach_recursive_mnt(struct mount *source_mnt, - out_cleanup_ids: - while (!hlist_empty(&tree_list)) { - child = hlist_entry(tree_list.first, struct mount, mnt_hash); -+ child->mnt_parent->mnt_ns->pending_mounts = 0; - umount_tree(child, UMOUNT_SYNC); - } - unlock_mount_hash(); - cleanup_group_ids(source_mnt, NULL); - out: -+ ns->pending_mounts = 0; -+ - read_seqlock_excl(&mount_lock); - put_mountpoint(smp); - read_sequnlock_excl(&mount_lock); -@@ -2804,6 +2848,8 @@ static struct mnt_namespace *alloc_mnt_ns(struct user_namespace *user_ns) - init_waitqueue_head(&new_ns->poll); - new_ns->event = 0; - new_ns->user_ns = get_user_ns(user_ns); -+ new_ns->mounts = 0; -+ new_ns->pending_mounts = 0; - return new_ns; - } - -@@ -2853,6 +2899,7 @@ struct mnt_namespace *copy_mnt_ns(unsigned long flags, struct mnt_namespace *ns, - q = new; - while (p) { - q->mnt_ns = new_ns; -+ new_ns->mounts++; - if (new_fs) { - if (&p->mnt == new_fs->root.mnt) { - new_fs->root.mnt = mntget(&q->mnt); -@@ -2891,6 +2938,7 @@ static struct mnt_namespace *create_mnt_ns(struct vfsmount *m) - struct mount *mnt = real_mount(m); - mnt->mnt_ns = new_ns; - new_ns->root = mnt; -+ new_ns->mounts++; - list_add(&mnt->mnt_list, &new_ns->list); - } else { - mntput(m); -diff --git a/fs/pnode.c b/fs/pnode.c -index b9f2af59b9a6..b394ca5307ec 100644 ---- a/fs/pnode.c -+++ b/fs/pnode.c -@@ -259,7 +259,7 @@ static int propagate_one(struct mount *m) - read_sequnlock_excl(&mount_lock); - } - hlist_add_head(&child->mnt_hash, list); -- return 0; -+ return count_mounts(m->mnt_ns, child); - } - - /* -diff --git a/fs/pnode.h b/fs/pnode.h -index 623f01772bec..dc87e65becd2 100644 ---- a/fs/pnode.h -+++ b/fs/pnode.h -@@ -54,4 +54,5 @@ void mnt_change_mountpoint(struct mount *parent, struct mountpoint *mp, - struct mount *copy_tree(struct mount *, struct dentry *, int); - bool is_path_reachable(struct mount *, struct dentry *, - const struct path *root); -+int count_mounts(struct mnt_namespace *ns, struct mount *mnt); - #endif /* _LINUX_PNODE_H */ -diff --git a/include/linux/mount.h b/include/linux/mount.h -index f822c3c11377..dc6cd800cd5d 100644 ---- a/include/linux/mount.h -+++ b/include/linux/mount.h -@@ -95,4 +95,6 @@ extern void mark_mounts_for_expiry(struct list_head *mounts); - - extern dev_t name_to_dev_t(const char *name); - -+extern unsigned int sysctl_mount_max; -+ - #endif /* _LINUX_MOUNT_H */ -diff --git a/kernel/events/core.c b/kernel/events/core.c -index e4b5494f05f8..784ab8fe8714 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -8250,6 +8250,37 @@ static int perf_event_set_clock(struct perf_event *event, clockid_t clk_id) - return 0; - } - -+/* -+ * Variation on perf_event_ctx_lock_nested(), except we take two context -+ * mutexes. -+ */ -+static struct perf_event_context * -+__perf_event_ctx_lock_double(struct perf_event *group_leader, -+ struct perf_event_context *ctx) -+{ -+ struct perf_event_context *gctx; -+ -+again: -+ rcu_read_lock(); -+ gctx = READ_ONCE(group_leader->ctx); -+ if (!atomic_inc_not_zero(&gctx->refcount)) { -+ rcu_read_unlock(); -+ goto again; -+ } -+ rcu_read_unlock(); -+ -+ mutex_lock_double(&gctx->mutex, &ctx->mutex); -+ -+ if (group_leader->ctx != gctx) { -+ mutex_unlock(&ctx->mutex); -+ mutex_unlock(&gctx->mutex); -+ put_ctx(gctx); -+ goto again; -+ } -+ -+ return gctx; -+} -+ - /** - * sys_perf_event_open - open a performance event, associate it to a task/cpu - * -@@ -8486,8 +8517,26 @@ SYSCALL_DEFINE5(perf_event_open, - } - - if (move_group) { -- gctx = group_leader->ctx; -- mutex_lock_double(&gctx->mutex, &ctx->mutex); -+ gctx = __perf_event_ctx_lock_double(group_leader, ctx); -+ -+ /* -+ * Check if we raced against another sys_perf_event_open() call -+ * moving the software group underneath us. -+ */ -+ if (!(group_leader->group_flags & PERF_GROUP_SOFTWARE)) { -+ /* -+ * If someone moved the group out from under us, check -+ * if this new event wound up on the same ctx, if so -+ * its the regular !move_group case, otherwise fail. -+ */ -+ if (gctx != ctx) { -+ err = -EINVAL; -+ goto err_locked; -+ } else { -+ perf_event_ctx_unlock(group_leader, gctx); -+ move_group = 0; -+ } -+ } - } else { - mutex_lock(&ctx->mutex); - } -@@ -8582,7 +8631,7 @@ SYSCALL_DEFINE5(perf_event_open, - perf_unpin_context(ctx); - - if (move_group) -- mutex_unlock(&gctx->mutex); -+ perf_event_ctx_unlock(group_leader, gctx); - mutex_unlock(&ctx->mutex); - - if (task) { -@@ -8610,7 +8659,7 @@ SYSCALL_DEFINE5(perf_event_open, - - err_locked: - if (move_group) -- mutex_unlock(&gctx->mutex); -+ perf_event_ctx_unlock(group_leader, gctx); - mutex_unlock(&ctx->mutex); - /* err_file: */ - fput(event_file); -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 2f0d157258a2..300d64162aff 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -65,6 +65,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -1749,6 +1750,14 @@ static struct ctl_table fs_table[] = { - .mode = 0644, - .proc_handler = proc_doulongvec_minmax, - }, -+ { -+ .procname = "mount-max", -+ .data = &sysctl_mount_max, -+ .maxlen = sizeof(unsigned int), -+ .mode = 0644, -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &one, -+ }, - { } - }; - -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 3a00512addbc..37a3b05d175c 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -154,17 +154,18 @@ void ping_hash(struct sock *sk) - void ping_unhash(struct sock *sk) - { - struct inet_sock *isk = inet_sk(sk); -+ - pr_debug("ping_unhash(isk=%p,isk->num=%u)\n", isk, isk->inet_num); -+ write_lock_bh(&ping_table.lock); - if (sk_hashed(sk)) { -- write_lock_bh(&ping_table.lock); - hlist_nulls_del(&sk->sk_nulls_node); - sk_nulls_node_init(&sk->sk_nulls_node); - sock_put(sk); - isk->inet_num = 0; - isk->inet_sport = 0; - sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); -- write_unlock_bh(&ping_table.lock); - } -+ write_unlock_bh(&ping_table.lock); - } - EXPORT_SYMBOL_GPL(ping_unhash); - -diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c -index 77afe913d03d..9adedba78eea 100644 ---- a/net/netfilter/nfnetlink.c -+++ b/net/netfilter/nfnetlink.c -@@ -326,10 +326,12 @@ replay: - nlh = nlmsg_hdr(skb); - err = 0; - -- if (nlmsg_len(nlh) < sizeof(struct nfgenmsg) || -- skb->len < nlh->nlmsg_len) { -- err = -EINVAL; -- goto ack; -+ if (nlh->nlmsg_len < NLMSG_HDRLEN || -+ skb->len < nlh->nlmsg_len || -+ nlmsg_len(nlh) < sizeof(struct nfgenmsg)) { -+ nfnl_err_reset(&err_list); -+ status |= NFNL_BATCH_FAILURE; -+ goto done; - } - - /* Only requests are handled by the kernel */ -diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c -index 648f2a67f314..cb1381513c82 100644 ---- a/net/tipc/bearer.c -+++ b/net/tipc/bearer.c -@@ -381,6 +381,10 @@ int tipc_enable_l2_media(struct net *net, struct tipc_bearer *b, - dev = dev_get_by_name(net, driver_name); - if (!dev) - return -ENODEV; -+ if (tipc_mtu_bad(dev, 0)) { -+ dev_put(dev); -+ return -EINVAL; -+ } - - /* Associate TIPC bearer with L2 bearer */ - rcu_assign_pointer(b->media_ptr, dev); -@@ -570,14 +574,19 @@ static int tipc_l2_device_event(struct notifier_block *nb, unsigned long evt, - if (!b_ptr) - return NOTIFY_DONE; - -- b_ptr->mtu = dev->mtu; -- - switch (evt) { - case NETDEV_CHANGE: - if (netif_carrier_ok(dev)) - break; - case NETDEV_GOING_DOWN: -+ tipc_reset_bearer(net, b_ptr); -+ break; - case NETDEV_CHANGEMTU: -+ if (tipc_mtu_bad(dev, 0)) { -+ bearer_disable(net, b_ptr); -+ break; -+ } -+ b_ptr->mtu = dev->mtu; - tipc_reset_bearer(net, b_ptr); - break; - case NETDEV_CHANGEADDR: -diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h -index 552185bc4773..5f11e18b1fa1 100644 ---- a/net/tipc/bearer.h -+++ b/net/tipc/bearer.h -@@ -39,6 +39,7 @@ - - #include "netlink.h" - #include "core.h" -+#include "msg.h" - #include - - #define MAX_MEDIA 3 -@@ -61,6 +62,9 @@ - #define TIPC_MEDIA_TYPE_IB 2 - #define TIPC_MEDIA_TYPE_UDP 3 - -+/* minimum bearer MTU */ -+#define TIPC_MIN_BEARER_MTU (MAX_H_SIZE + INT_H_SIZE) -+ - /** - * struct tipc_node_map - set of node identifiers - * @count: # of nodes in set -@@ -226,4 +230,13 @@ void tipc_bearer_xmit(struct net *net, u32 bearer_id, - void tipc_bearer_bc_xmit(struct net *net, u32 bearer_id, - struct sk_buff_head *xmitq); - -+/* check if device MTU is too low for tipc headers */ -+static inline bool tipc_mtu_bad(struct net_device *dev, unsigned int reserve) -+{ -+ if (dev->mtu >= TIPC_MIN_BEARER_MTU + reserve) -+ return false; -+ netdev_warn(dev, "MTU too low for tipc bearer\n"); -+ return true; -+} -+ - #endif /* _TIPC_BEARER_H */ -diff --git a/net/tipc/core.c b/net/tipc/core.c -index 03a842870c52..e2bdb07a49a2 100644 ---- a/net/tipc/core.c -+++ b/net/tipc/core.c -@@ -69,6 +69,7 @@ static int __net_init tipc_init_net(struct net *net) - if (err) - goto out_nametbl; - -+ INIT_LIST_HEAD(&tn->dist_queue); - err = tipc_topsrv_start(net); - if (err) - goto out_subscr; -diff --git a/net/tipc/core.h b/net/tipc/core.h -index 18e95a8020cd..fe3b89e9cde4 100644 ---- a/net/tipc/core.h -+++ b/net/tipc/core.h -@@ -103,6 +103,9 @@ struct tipc_net { - spinlock_t nametbl_lock; - struct name_table *nametbl; - -+ /* Name dist queue */ -+ struct list_head dist_queue; -+ - /* Topology subscription server */ - struct tipc_server *topsrv; - atomic_t subscription_count; -diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c -index f51c8bdbea1c..c4c151bc000c 100644 ---- a/net/tipc/name_distr.c -+++ b/net/tipc/name_distr.c -@@ -40,11 +40,6 @@ - - int sysctl_tipc_named_timeout __read_mostly = 2000; - --/** -- * struct tipc_dist_queue - queue holding deferred name table updates -- */ --static struct list_head tipc_dist_queue = LIST_HEAD_INIT(tipc_dist_queue); -- - struct distr_queue_item { - struct distr_item i; - u32 dtype; -@@ -67,6 +62,8 @@ static void publ_to_item(struct distr_item *i, struct publication *p) - - /** - * named_prepare_buf - allocate & initialize a publication message -+ * -+ * The buffer returned is of size INT_H_SIZE + payload size - */ - static struct sk_buff *named_prepare_buf(struct net *net, u32 type, u32 size, - u32 dest) -@@ -171,9 +168,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list, - struct publication *publ; - struct sk_buff *skb = NULL; - struct distr_item *item = NULL; -- uint msg_dsz = (tipc_node_get_mtu(net, dnode, 0) / ITEM_SIZE) * -- ITEM_SIZE; -- uint msg_rem = msg_dsz; -+ u32 msg_dsz = ((tipc_node_get_mtu(net, dnode, 0) - INT_H_SIZE) / -+ ITEM_SIZE) * ITEM_SIZE; -+ u32 msg_rem = msg_dsz; - - list_for_each_entry(publ, pls, local_list) { - /* Prepare next buffer: */ -@@ -340,9 +337,11 @@ static bool tipc_update_nametbl(struct net *net, struct distr_item *i, - * tipc_named_add_backlog - add a failed name table update to the backlog - * - */ --static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node) -+static void tipc_named_add_backlog(struct net *net, struct distr_item *i, -+ u32 type, u32 node) - { - struct distr_queue_item *e; -+ struct tipc_net *tn = net_generic(net, tipc_net_id); - unsigned long now = get_jiffies_64(); - - e = kzalloc(sizeof(*e), GFP_ATOMIC); -@@ -352,7 +351,7 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node) - e->node = node; - e->expires = now + msecs_to_jiffies(sysctl_tipc_named_timeout); - memcpy(e, i, sizeof(*i)); -- list_add_tail(&e->next, &tipc_dist_queue); -+ list_add_tail(&e->next, &tn->dist_queue); - } - - /** -@@ -362,10 +361,11 @@ static void tipc_named_add_backlog(struct distr_item *i, u32 type, u32 node) - void tipc_named_process_backlog(struct net *net) - { - struct distr_queue_item *e, *tmp; -+ struct tipc_net *tn = net_generic(net, tipc_net_id); - char addr[16]; - unsigned long now = get_jiffies_64(); - -- list_for_each_entry_safe(e, tmp, &tipc_dist_queue, next) { -+ list_for_each_entry_safe(e, tmp, &tn->dist_queue, next) { - if (time_after(e->expires, now)) { - if (!tipc_update_nametbl(net, &e->i, e->node, e->dtype)) - continue; -@@ -405,7 +405,7 @@ void tipc_named_rcv(struct net *net, struct sk_buff_head *inputq) - node = msg_orignode(msg); - while (count--) { - if (!tipc_update_nametbl(net, item, node, mtype)) -- tipc_named_add_backlog(item, mtype, node); -+ tipc_named_add_backlog(net, item, mtype, node); - item++; - } - kfree_skb(skb); -diff --git a/net/tipc/node.c b/net/tipc/node.c -index d468aad6163e..2df0b98d4a32 100644 ---- a/net/tipc/node.c -+++ b/net/tipc/node.c -@@ -728,7 +728,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt) - state = SELF_UP_PEER_UP; - break; - case SELF_LOST_CONTACT_EVT: -- state = SELF_DOWN_PEER_LEAVING; -+ state = SELF_DOWN_PEER_DOWN; - break; - case SELF_ESTABL_CONTACT_EVT: - case PEER_LOST_CONTACT_EVT: -@@ -747,7 +747,7 @@ static void tipc_node_fsm_evt(struct tipc_node *n, int evt) - state = SELF_UP_PEER_UP; - break; - case PEER_LOST_CONTACT_EVT: -- state = SELF_LEAVING_PEER_DOWN; -+ state = SELF_DOWN_PEER_DOWN; - break; - case SELF_LOST_CONTACT_EVT: - case PEER_ESTABL_CONTACT_EVT: -diff --git a/net/tipc/socket.c b/net/tipc/socket.c -index b26b7a127773..65171f8e8c45 100644 ---- a/net/tipc/socket.c -+++ b/net/tipc/socket.c -@@ -777,9 +777,11 @@ void tipc_sk_mcast_rcv(struct net *net, struct sk_buff_head *arrvq, - * @tsk: receiving socket - * @skb: pointer to message buffer. - */ --static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb) -+static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb, -+ struct sk_buff_head *xmitq) - { - struct sock *sk = &tsk->sk; -+ u32 onode = tsk_own_node(tsk); - struct tipc_msg *hdr = buf_msg(skb); - int mtyp = msg_type(hdr); - int conn_cong; -@@ -792,7 +794,8 @@ static void tipc_sk_proto_rcv(struct tipc_sock *tsk, struct sk_buff *skb) - - if (mtyp == CONN_PROBE) { - msg_set_type(hdr, CONN_PROBE_REPLY); -- tipc_sk_respond(sk, skb, TIPC_OK); -+ if (tipc_msg_reverse(onode, &skb, TIPC_OK)) -+ __skb_queue_tail(xmitq, skb); - return; - } else if (mtyp == CONN_ACK) { - conn_cong = tsk_conn_cong(tsk); -@@ -1647,7 +1650,8 @@ static unsigned int rcvbuf_limit(struct sock *sk, struct sk_buff *buf) - * - * Returns true if message was added to socket receive queue, otherwise false - */ --static bool filter_rcv(struct sock *sk, struct sk_buff *skb) -+static bool filter_rcv(struct sock *sk, struct sk_buff *skb, -+ struct sk_buff_head *xmitq) - { - struct socket *sock = sk->sk_socket; - struct tipc_sock *tsk = tipc_sk(sk); -@@ -1657,7 +1661,7 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb) - int usr = msg_user(hdr); - - if (unlikely(msg_user(hdr) == CONN_MANAGER)) { -- tipc_sk_proto_rcv(tsk, skb); -+ tipc_sk_proto_rcv(tsk, skb, xmitq); - return false; - } - -@@ -1700,7 +1704,8 @@ static bool filter_rcv(struct sock *sk, struct sk_buff *skb) - return true; - - reject: -- tipc_sk_respond(sk, skb, err); -+ if (tipc_msg_reverse(tsk_own_node(tsk), &skb, err)) -+ __skb_queue_tail(xmitq, skb); - return false; - } - -@@ -1716,9 +1721,24 @@ reject: - static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb) - { - unsigned int truesize = skb->truesize; -+ struct sk_buff_head xmitq; -+ u32 dnode, selector; - -- if (likely(filter_rcv(sk, skb))) -+ __skb_queue_head_init(&xmitq); -+ -+ if (likely(filter_rcv(sk, skb, &xmitq))) { - atomic_add(truesize, &tipc_sk(sk)->dupl_rcvcnt); -+ return 0; -+ } -+ -+ if (skb_queue_empty(&xmitq)) -+ return 0; -+ -+ /* Send response/rejected message */ -+ skb = __skb_dequeue(&xmitq); -+ dnode = msg_destnode(buf_msg(skb)); -+ selector = msg_origport(buf_msg(skb)); -+ tipc_node_xmit_skb(sock_net(sk), skb, dnode, selector); - return 0; - } - -@@ -1732,12 +1752,13 @@ static int tipc_backlog_rcv(struct sock *sk, struct sk_buff *skb) - * Caller must hold socket lock - */ - static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, -- u32 dport) -+ u32 dport, struct sk_buff_head *xmitq) - { -+ unsigned long time_limit = jiffies + 2; -+ struct sk_buff *skb; - unsigned int lim; - atomic_t *dcnt; -- struct sk_buff *skb; -- unsigned long time_limit = jiffies + 2; -+ u32 onode; - - while (skb_queue_len(inputq)) { - if (unlikely(time_after_eq(jiffies, time_limit))) -@@ -1749,20 +1770,22 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, - - /* Add message directly to receive queue if possible */ - if (!sock_owned_by_user(sk)) { -- filter_rcv(sk, skb); -+ filter_rcv(sk, skb, xmitq); - continue; - } - - /* Try backlog, compensating for double-counted bytes */ - dcnt = &tipc_sk(sk)->dupl_rcvcnt; -- if (sk->sk_backlog.len) -+ if (!sk->sk_backlog.len) - atomic_set(dcnt, 0); - lim = rcvbuf_limit(sk, skb) + atomic_read(dcnt); - if (likely(!sk_add_backlog(sk, skb, lim))) - continue; - - /* Overload => reject message back to sender */ -- tipc_sk_respond(sk, skb, TIPC_ERR_OVERLOAD); -+ onode = tipc_own_addr(sock_net(sk)); -+ if (tipc_msg_reverse(onode, &skb, TIPC_ERR_OVERLOAD)) -+ __skb_queue_tail(xmitq, skb); - break; - } - } -@@ -1775,12 +1798,14 @@ static void tipc_sk_enqueue(struct sk_buff_head *inputq, struct sock *sk, - */ - void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq) - { -+ struct sk_buff_head xmitq; - u32 dnode, dport = 0; - int err; - struct tipc_sock *tsk; - struct sock *sk; - struct sk_buff *skb; - -+ __skb_queue_head_init(&xmitq); - while (skb_queue_len(inputq)) { - dport = tipc_skb_peek_port(inputq, dport); - tsk = tipc_sk_lookup(net, dport); -@@ -1788,9 +1813,14 @@ void tipc_sk_rcv(struct net *net, struct sk_buff_head *inputq) - if (likely(tsk)) { - sk = &tsk->sk; - if (likely(spin_trylock_bh(&sk->sk_lock.slock))) { -- tipc_sk_enqueue(inputq, sk, dport); -+ tipc_sk_enqueue(inputq, sk, dport, &xmitq); - spin_unlock_bh(&sk->sk_lock.slock); - } -+ /* Send pending response/rejected messages, if any */ -+ while ((skb = __skb_dequeue(&xmitq))) { -+ dnode = msg_destnode(buf_msg(skb)); -+ tipc_node_xmit_skb(net, skb, dnode, dport); -+ } - sock_put(sk); - continue; - } -diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c -index 6af78c6276b4..78d6b78de29d 100644 ---- a/net/tipc/udp_media.c -+++ b/net/tipc/udp_media.c -@@ -52,7 +52,7 @@ - /* IANA assigned UDP port */ - #define UDP_PORT_DEFAULT 6118 - --#define UDP_MIN_HEADROOM 28 -+#define UDP_MIN_HEADROOM 48 - - static const struct nla_policy tipc_nl_udp_policy[TIPC_NLA_UDP_MAX + 1] = { - [TIPC_NLA_UDP_UNSPEC] = {.type = NLA_UNSPEC}, -@@ -376,6 +376,11 @@ static int tipc_udp_enable(struct net *net, struct tipc_bearer *b, - udp_conf.local_ip.s_addr = htonl(INADDR_ANY); - udp_conf.use_udp_checksums = false; - ub->ifindex = dev->ifindex; -+ if (tipc_mtu_bad(dev, sizeof(struct iphdr) + -+ sizeof(struct udphdr))) { -+ err = -EINVAL; -+ goto err; -+ } - b->mtu = dev->mtu - sizeof(struct iphdr) - - sizeof(struct udphdr); - #if IS_ENABLED(CONFIG_IPV6) diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.65-66.patch b/patch/kernel/mvebu64-default/03-patch-4.4.65-66.patch deleted file mode 100644 index 1fe8b7a72123..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.65-66.patch +++ /dev/null @@ -1,1309 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/clock/sunxi.txt b/Documentation/devicetree/bindings/clock/sunxi.txt -index 8a47b77abfca..e8c74a6e738b 100644 ---- a/Documentation/devicetree/bindings/clock/sunxi.txt -+++ b/Documentation/devicetree/bindings/clock/sunxi.txt -@@ -18,6 +18,7 @@ Required properties: - "allwinner,sun4i-a10-cpu-clk" - for the CPU multiplexer clock - "allwinner,sun4i-a10-axi-clk" - for the AXI clock - "allwinner,sun8i-a23-axi-clk" - for the AXI clock on A23 -+ "allwinner,sun4i-a10-gates-clk" - for generic gates on all compatible SoCs - "allwinner,sun4i-a10-axi-gates-clk" - for the AXI gates - "allwinner,sun4i-a10-ahb-clk" - for the AHB clock - "allwinner,sun5i-a13-ahb-clk" - for the AHB clock on A13 -@@ -43,6 +44,7 @@ Required properties: - "allwinner,sun6i-a31-apb0-gates-clk" - for the APB0 gates on A31 - "allwinner,sun7i-a20-apb0-gates-clk" - for the APB0 gates on A20 - "allwinner,sun8i-a23-apb0-gates-clk" - for the APB0 gates on A23 -+ "allwinner,sun8i-h3-apb0-gates-clk" - for the APB0 gates on H3 - "allwinner,sun9i-a80-apb0-gates-clk" - for the APB0 gates on A80 - "allwinner,sun4i-a10-apb1-clk" - for the APB1 clock - "allwinner,sun9i-a80-apb1-clk" - for the APB1 bus clock on A80 -diff --git a/Makefile b/Makefile -index ddaef04f528a..1cd052823c03 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 65 -+SUBLEVEL = 66 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/entry-arcv2.h b/arch/arc/include/asm/entry-arcv2.h -index b5ff87e6f4b7..aee1a77934cf 100644 ---- a/arch/arc/include/asm/entry-arcv2.h -+++ b/arch/arc/include/asm/entry-arcv2.h -@@ -16,6 +16,7 @@ - ; - ; Now manually save: r12, sp, fp, gp, r25 - -+ PUSH r30 - PUSH r12 - - ; Saving pt_regs->sp correctly requires some extra work due to the way -@@ -72,6 +73,7 @@ - POPAX AUX_USER_SP - 1: - POP r12 -+ POP r30 - - .endm - -diff --git a/arch/arc/include/asm/ptrace.h b/arch/arc/include/asm/ptrace.h -index 69095da1fcfd..47111d565a95 100644 ---- a/arch/arc/include/asm/ptrace.h -+++ b/arch/arc/include/asm/ptrace.h -@@ -84,7 +84,7 @@ struct pt_regs { - unsigned long fp; - unsigned long sp; /* user/kernel sp depending on where we came from */ - -- unsigned long r12; -+ unsigned long r12, r30; - - /*------- Below list auto saved by h/w -----------*/ - unsigned long r0, r1, r2, r3, r4, r5, r6, r7, r8, r9, r10, r11; -diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c -index f86692dbcfd5..83fc403aec3c 100644 ---- a/arch/arm/mach-omap2/timer.c -+++ b/arch/arm/mach-omap2/timer.c -@@ -496,8 +496,7 @@ void __init omap_init_time(void) - __omap_sync32k_timer_init(1, "timer_32k_ck", "ti,timer-alwon", - 2, "timer_sys_ck", NULL, false); - -- if (of_have_populated_dt()) -- clocksource_probe(); -+ clocksource_probe(); - } - - #if defined(CONFIG_ARCH_OMAP3) || defined(CONFIG_SOC_AM43XX) -@@ -505,6 +504,8 @@ void __init omap3_secure_sync32k_timer_init(void) - { - __omap_sync32k_timer_init(12, "secure_32k_fck", "ti,timer-secure", - 2, "timer_sys_ck", NULL, false); -+ -+ clocksource_probe(); - } - #endif /* CONFIG_ARCH_OMAP3 */ - -@@ -513,6 +514,8 @@ void __init omap3_gptimer_timer_init(void) - { - __omap_sync32k_timer_init(2, "timer_sys_ck", NULL, - 1, "timer_sys_ck", "ti,timer-alwon", true); -+ -+ clocksource_probe(); - } - #endif - -diff --git a/arch/mips/kernel/crash.c b/arch/mips/kernel/crash.c -index d434d5d5ae6e..610f0f3bdb34 100644 ---- a/arch/mips/kernel/crash.c -+++ b/arch/mips/kernel/crash.c -@@ -14,12 +14,22 @@ static int crashing_cpu = -1; - static cpumask_t cpus_in_crash = CPU_MASK_NONE; - - #ifdef CONFIG_SMP --static void crash_shutdown_secondary(void *ignore) -+static void crash_shutdown_secondary(void *passed_regs) - { -- struct pt_regs *regs; -+ struct pt_regs *regs = passed_regs; - int cpu = smp_processor_id(); - -- regs = task_pt_regs(current); -+ /* -+ * If we are passed registers, use those. Otherwise get the -+ * regs from the last interrupt, which should be correct, as -+ * we are in an interrupt. But if the regs are not there, -+ * pull them from the top of the stack. They are probably -+ * wrong, but we need something to keep from crashing again. -+ */ -+ if (!regs) -+ regs = get_irq_regs(); -+ if (!regs) -+ regs = task_pt_regs(current); - - if (!cpu_online(cpu)) - return; -diff --git a/arch/mips/kernel/elf.c b/arch/mips/kernel/elf.c -index 4a4d9e067c89..3afffc30ee12 100644 ---- a/arch/mips/kernel/elf.c -+++ b/arch/mips/kernel/elf.c -@@ -206,7 +206,7 @@ int arch_check_elf(void *_ehdr, bool has_interpreter, - else if ((prog_req.fr1 && prog_req.frdefault) || - (prog_req.single && !prog_req.frdefault)) - /* Make sure 64-bit MIPS III/IV/64R1 will not pick FR1 */ -- state->overall_fp_mode = ((current_cpu_data.fpu_id & MIPS_FPIR_F64) && -+ state->overall_fp_mode = ((raw_current_cpu_data.fpu_id & MIPS_FPIR_F64) && - cpu_has_mips_r2_r6) ? - FP_FR1 : FP_FR0; - else if (prog_req.fr1) -diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c -index de63d36af895..732d6171ac6a 100644 ---- a/arch/mips/kernel/kgdb.c -+++ b/arch/mips/kernel/kgdb.c -@@ -244,9 +244,6 @@ static int compute_signal(int tt) - void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p) - { - int reg; -- struct thread_info *ti = task_thread_info(p); -- unsigned long ksp = (unsigned long)ti + THREAD_SIZE - 32; -- struct pt_regs *regs = (struct pt_regs *)ksp - 1; - #if (KGDB_GDB_REG_SIZE == 32) - u32 *ptr = (u32 *)gdb_regs; - #else -@@ -254,25 +251,46 @@ void sleeping_thread_to_gdb_regs(unsigned long *gdb_regs, struct task_struct *p) - #endif - - for (reg = 0; reg < 16; reg++) -- *(ptr++) = regs->regs[reg]; -+ *(ptr++) = 0; - - /* S0 - S7 */ -- for (reg = 16; reg < 24; reg++) -- *(ptr++) = regs->regs[reg]; -+ *(ptr++) = p->thread.reg16; -+ *(ptr++) = p->thread.reg17; -+ *(ptr++) = p->thread.reg18; -+ *(ptr++) = p->thread.reg19; -+ *(ptr++) = p->thread.reg20; -+ *(ptr++) = p->thread.reg21; -+ *(ptr++) = p->thread.reg22; -+ *(ptr++) = p->thread.reg23; - - for (reg = 24; reg < 28; reg++) - *(ptr++) = 0; - - /* GP, SP, FP, RA */ -- for (reg = 28; reg < 32; reg++) -- *(ptr++) = regs->regs[reg]; -- -- *(ptr++) = regs->cp0_status; -- *(ptr++) = regs->lo; -- *(ptr++) = regs->hi; -- *(ptr++) = regs->cp0_badvaddr; -- *(ptr++) = regs->cp0_cause; -- *(ptr++) = regs->cp0_epc; -+ *(ptr++) = (long)p; -+ *(ptr++) = p->thread.reg29; -+ *(ptr++) = p->thread.reg30; -+ *(ptr++) = p->thread.reg31; -+ -+ *(ptr++) = p->thread.cp0_status; -+ -+ /* lo, hi */ -+ *(ptr++) = 0; -+ *(ptr++) = 0; -+ -+ /* -+ * BadVAddr, Cause -+ * Ideally these would come from the last exception frame up the stack -+ * but that requires unwinding, otherwise we can't know much for sure. -+ */ -+ *(ptr++) = 0; -+ *(ptr++) = 0; -+ -+ /* -+ * PC -+ * use return address (RA), i.e. the moment after return from resume() -+ */ -+ *(ptr++) = p->thread.reg31; - } - - void kgdb_arch_set_pc(struct pt_regs *regs, unsigned long pc) -diff --git a/arch/sparc/include/asm/pgtable_64.h b/arch/sparc/include/asm/pgtable_64.h -index 408b715c95a5..9d81579f3d54 100644 ---- a/arch/sparc/include/asm/pgtable_64.h -+++ b/arch/sparc/include/asm/pgtable_64.h -@@ -668,26 +668,27 @@ static inline unsigned long pmd_pfn(pmd_t pmd) - return pte_pfn(pte); - } - --#ifdef CONFIG_TRANSPARENT_HUGEPAGE --static inline unsigned long pmd_dirty(pmd_t pmd) -+#define __HAVE_ARCH_PMD_WRITE -+static inline unsigned long pmd_write(pmd_t pmd) - { - pte_t pte = __pte(pmd_val(pmd)); - -- return pte_dirty(pte); -+ return pte_write(pte); - } - --static inline unsigned long pmd_young(pmd_t pmd) -+#ifdef CONFIG_TRANSPARENT_HUGEPAGE -+static inline unsigned long pmd_dirty(pmd_t pmd) - { - pte_t pte = __pte(pmd_val(pmd)); - -- return pte_young(pte); -+ return pte_dirty(pte); - } - --static inline unsigned long pmd_write(pmd_t pmd) -+static inline unsigned long pmd_young(pmd_t pmd) - { - pte_t pte = __pte(pmd_val(pmd)); - -- return pte_write(pte); -+ return pte_young(pte); - } - - static inline unsigned long pmd_trans_huge(pmd_t pmd) -diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c -index 3d3414c14792..965655afdbb6 100644 ---- a/arch/sparc/mm/init_64.c -+++ b/arch/sparc/mm/init_64.c -@@ -1493,7 +1493,7 @@ bool kern_addr_valid(unsigned long addr) - if ((long)addr < 0L) { - unsigned long pa = __pa(addr); - -- if ((addr >> max_phys_bits) != 0UL) -+ if ((pa >> max_phys_bits) != 0UL) - return false; - - return pfn_valid(pa >> PAGE_SHIFT); -diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c -index 311bcf338f07..bfc587579dc3 100644 ---- a/arch/x86/kernel/ftrace.c -+++ b/arch/x86/kernel/ftrace.c -@@ -977,6 +977,18 @@ void prepare_ftrace_return(unsigned long self_addr, unsigned long *parent, - unsigned long return_hooker = (unsigned long) - &return_to_handler; - -+ /* -+ * When resuming from suspend-to-ram, this function can be indirectly -+ * called from early CPU startup code while the CPU is in real mode, -+ * which would fail miserably. Make sure the stack pointer is a -+ * virtual address. -+ * -+ * This check isn't as accurate as virt_addr_valid(), but it should be -+ * good enough for this purpose, and it's fast. -+ */ -+ if (unlikely((long)__builtin_frame_address(0) >= 0)) -+ return; -+ - if (unlikely(ftrace_graph_is_dead())) - return; - -diff --git a/arch/x86/xen/time.c b/arch/x86/xen/time.c -index f1ba6a092854..8846257d8792 100644 ---- a/arch/x86/xen/time.c -+++ b/arch/x86/xen/time.c -@@ -343,11 +343,11 @@ static int xen_vcpuop_set_next_event(unsigned long delta, - WARN_ON(!clockevent_state_oneshot(evt)); - - single.timeout_abs_ns = get_abs_timeout(delta); -- single.flags = VCPU_SSHOTTMR_future; -+ /* Get an event anyway, even if the timeout is already expired */ -+ single.flags = 0; - - ret = HYPERVISOR_vcpu_op(VCPUOP_set_singleshot_timer, cpu, &single); -- -- BUG_ON(ret != 0 && ret != -ETIME); -+ BUG_ON(ret != 0); - - return ret; - } -diff --git a/crypto/testmgr.c b/crypto/testmgr.c -index d4944318ca1f..5f15f45fcc9f 100644 ---- a/crypto/testmgr.c -+++ b/crypto/testmgr.c -@@ -488,6 +488,8 @@ static int __test_aead(struct crypto_aead *tfm, int enc, - aead_request_set_callback(req, CRYPTO_TFM_REQ_MAY_BACKLOG, - tcrypt_complete, &result); - -+ iv_len = crypto_aead_ivsize(tfm); -+ - for (i = 0, j = 0; i < tcount; i++) { - if (template[i].np) - continue; -@@ -508,7 +510,6 @@ static int __test_aead(struct crypto_aead *tfm, int enc, - - memcpy(input, template[i].input, template[i].ilen); - memcpy(assoc, template[i].assoc, template[i].alen); -- iv_len = crypto_aead_ivsize(tfm); - if (template[i].iv) - memcpy(iv, template[i].iv, iv_len); - else -@@ -617,7 +618,7 @@ static int __test_aead(struct crypto_aead *tfm, int enc, - j++; - - if (template[i].iv) -- memcpy(iv, template[i].iv, MAX_IVLEN); -+ memcpy(iv, template[i].iv, iv_len); - else - memset(iv, 0, MAX_IVLEN); - -diff --git a/drivers/clk/sunxi/clk-simple-gates.c b/drivers/clk/sunxi/clk-simple-gates.c -index 0214c6548afd..97cb4221de25 100644 ---- a/drivers/clk/sunxi/clk-simple-gates.c -+++ b/drivers/clk/sunxi/clk-simple-gates.c -@@ -98,6 +98,8 @@ static void __init sunxi_simple_gates_init(struct device_node *node) - sunxi_simple_gates_setup(node, NULL, 0); - } - -+CLK_OF_DECLARE(sun4i_a10_gates, "allwinner,sun4i-a10-gates-clk", -+ sunxi_simple_gates_init); - CLK_OF_DECLARE(sun4i_a10_apb0, "allwinner,sun4i-a10-apb0-gates-clk", - sunxi_simple_gates_init); - CLK_OF_DECLARE(sun4i_a10_apb1, "allwinner,sun4i-a10-apb1-gates-clk", -diff --git a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c -index 7e9154c7f1db..d1c9525d81eb 100644 ---- a/drivers/gpu/drm/amd/amdgpu/kv_dpm.c -+++ b/drivers/gpu/drm/amd/amdgpu/kv_dpm.c -@@ -2258,7 +2258,7 @@ static void kv_apply_state_adjust_rules(struct amdgpu_device *adev, - if (pi->caps_stable_p_state) { - stable_p_state_sclk = (max_limits->sclk * 75) / 100; - -- for (i = table->count - 1; i >= 0; i++) { -+ for (i = table->count - 1; i >= 0; i--) { - if (stable_p_state_sclk >= table->entries[i].clk) { - stable_p_state_sclk = table->entries[i].clk; - break; -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 25eab453f2b2..e7b96f1ac2c5 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -685,6 +685,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "20046"), - }, - }, -+ { -+ /* Clevo P650RS, 650RP6, Sager NP8152-S, and others */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 9be39988bf06..d81be5e471d0 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -570,7 +570,7 @@ static int read_balance(struct r1conf *conf, struct r1bio *r1_bio, int *max_sect - if (best_dist_disk < 0) { - if (is_badblock(rdev, this_sector, sectors, - &first_bad, &bad_sectors)) { -- if (first_bad < this_sector) -+ if (first_bad <= this_sector) - /* Cannot use this */ - continue; - best_good_sectors = first_bad - this_sector; -diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c -index 082ff5608455..317ef63ee789 100644 ---- a/drivers/media/tuners/tuner-xc2028.c -+++ b/drivers/media/tuners/tuner-xc2028.c -@@ -1407,8 +1407,10 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); - if (p->fname) { - priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL); -- if (priv->ctrl.fname == NULL) -- return -ENOMEM; -+ if (priv->ctrl.fname == NULL) { -+ rc = -ENOMEM; -+ goto unlock; -+ } - } - - /* -@@ -1440,6 +1442,7 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - } else - priv->state = XC2028_WAITING_FIRMWARE; - } -+unlock: - mutex_unlock(&priv->lock); - - return rc; -diff --git a/drivers/net/ethernet/cavium/liquidio/lio_main.c b/drivers/net/ethernet/cavium/liquidio/lio_main.c -index 7445da218bd9..cc1725616f9d 100644 ---- a/drivers/net/ethernet/cavium/liquidio/lio_main.c -+++ b/drivers/net/ethernet/cavium/liquidio/lio_main.c -@@ -2823,7 +2823,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev) - if (!g) { - netif_info(lio, tx_err, lio->netdev, - "Transmit scatter gather: glist null!\n"); -- goto lio_xmit_failed; -+ goto lio_xmit_dma_failed; - } - - cmdsetup.s.gather = 1; -@@ -2894,7 +2894,7 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev) - else - status = octnet_send_nic_data_pkt(oct, &ndata, xmit_more); - if (status == IQ_SEND_FAILED) -- goto lio_xmit_failed; -+ goto lio_xmit_dma_failed; - - netif_info(lio, tx_queued, lio->netdev, "Transmit queued successfully\n"); - -@@ -2908,12 +2908,13 @@ static int liquidio_xmit(struct sk_buff *skb, struct net_device *netdev) - - return NETDEV_TX_OK; - -+lio_xmit_dma_failed: -+ dma_unmap_single(&oct->pci_dev->dev, ndata.cmd.dptr, -+ ndata.datasize, DMA_TO_DEVICE); - lio_xmit_failed: - stats->tx_dropped++; - netif_info(lio, tx_err, lio->netdev, "IQ%d Transmit dropped:%llu\n", - iq_no, stats->tx_dropped); -- dma_unmap_single(&oct->pci_dev->dev, ndata.cmd.dptr, -- ndata.datasize, DMA_TO_DEVICE); - recv_buffer_free(skb); - return NETDEV_TX_OK; - } -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 06c8bfeaccd6..40cd86614677 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -1110,6 +1110,7 @@ static int macvlan_port_create(struct net_device *dev) - static void macvlan_port_destroy(struct net_device *dev) - { - struct macvlan_port *port = macvlan_port_get_rtnl(dev); -+ struct sk_buff *skb; - - dev->priv_flags &= ~IFF_MACVLAN_PORT; - netdev_rx_handler_unregister(dev); -@@ -1118,7 +1119,15 @@ static void macvlan_port_destroy(struct net_device *dev) - * but we need to cancel it and purge left skbs if any. - */ - cancel_work_sync(&port->bc_work); -- __skb_queue_purge(&port->bc_queue); -+ -+ while ((skb = __skb_dequeue(&port->bc_queue))) { -+ const struct macvlan_dev *src = MACVLAN_SKB_CB(skb)->src; -+ -+ if (src) -+ dev_put(src->dev); -+ -+ kfree_skb(skb); -+ } - - kfree_rcu(port, rcu); - } -diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c -index e6cefd0e3262..84b9cca152eb 100644 ---- a/drivers/net/phy/dp83640.c -+++ b/drivers/net/phy/dp83640.c -@@ -1436,8 +1436,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev, - skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT; - skb_queue_tail(&dp83640->rx_queue, skb); - schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT); -- } else { -- netif_rx_ni(skb); - } - - return true; -diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c -index bba0ca786aaa..851c0e121807 100644 ---- a/drivers/net/phy/phy.c -+++ b/drivers/net/phy/phy.c -@@ -538,7 +538,7 @@ void phy_stop_machine(struct phy_device *phydev) - cancel_delayed_work_sync(&phydev->state_queue); - - mutex_lock(&phydev->lock); -- if (phydev->state > PHY_UP) -+ if (phydev->state > PHY_UP && phydev->state != PHY_HALTED) - phydev->state = PHY_UP; - mutex_unlock(&phydev->lock); - } -diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c -index 88dbbeb8569b..f9b8c44677eb 100644 ---- a/drivers/regulator/core.c -+++ b/drivers/regulator/core.c -@@ -1519,6 +1519,7 @@ static int regulator_resolve_supply(struct regulator_dev *rdev) - ret = regulator_enable(rdev->supply); - if (ret < 0) { - _regulator_put(rdev->supply); -+ rdev->supply = NULL; - return ret; - } - } -diff --git a/drivers/usb/gadget/function/f_midi.c b/drivers/usb/gadget/function/f_midi.c -index 898a570319f1..af60cc3714c1 100644 ---- a/drivers/usb/gadget/function/f_midi.c -+++ b/drivers/usb/gadget/function/f_midi.c -@@ -361,7 +361,9 @@ static int f_midi_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - /* allocate a bunch of read buffers and queue them all at once. */ - for (i = 0; i < midi->qlen && err == 0; i++) { - struct usb_request *req = -- midi_alloc_ep_req(midi->out_ep, midi->buflen); -+ midi_alloc_ep_req(midi->out_ep, -+ max_t(unsigned, midi->buflen, -+ bulk_out_desc.wMaxPacketSize)); - if (req == NULL) - return -ENOMEM; - -diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c -index 263002f0389d..7c23363ecf19 100644 ---- a/fs/ext4/xattr.c -+++ b/fs/ext4/xattr.c -@@ -233,6 +233,27 @@ ext4_xattr_check_block(struct inode *inode, struct buffer_head *bh) - return error; - } - -+static int -+__xattr_check_inode(struct inode *inode, struct ext4_xattr_ibody_header *header, -+ void *end, const char *function, unsigned int line) -+{ -+ struct ext4_xattr_entry *entry = IFIRST(header); -+ int error = -EFSCORRUPTED; -+ -+ if (((void *) header >= end) || -+ (header->h_magic != le32_to_cpu(EXT4_XATTR_MAGIC))) -+ goto errout; -+ error = ext4_xattr_check_names(entry, end, entry); -+errout: -+ if (error) -+ __ext4_error_inode(inode, function, line, 0, -+ "corrupted in-inode xattr"); -+ return error; -+} -+ -+#define xattr_check_inode(inode, header, end) \ -+ __xattr_check_inode((inode), (header), (end), __func__, __LINE__) -+ - static inline int - ext4_xattr_check_entry(struct ext4_xattr_entry *entry, size_t size) - { -@@ -344,7 +365,7 @@ ext4_xattr_ibody_get(struct inode *inode, int name_index, const char *name, - header = IHDR(inode, raw_inode); - entry = IFIRST(header); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(entry, end, entry); -+ error = xattr_check_inode(inode, header, end); - if (error) - goto cleanup; - error = ext4_xattr_find_entry(&entry, name_index, name, -@@ -475,7 +496,7 @@ ext4_xattr_ibody_list(struct dentry *dentry, char *buffer, size_t buffer_size) - raw_inode = ext4_raw_inode(&iloc); - header = IHDR(inode, raw_inode); - end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; -- error = ext4_xattr_check_names(IFIRST(header), end, IFIRST(header)); -+ error = xattr_check_inode(inode, header, end); - if (error) - goto cleanup; - error = ext4_xattr_list_entries(dentry, IFIRST(header), -@@ -991,8 +1012,7 @@ int ext4_xattr_ibody_find(struct inode *inode, struct ext4_xattr_info *i, - is->s.here = is->s.first; - is->s.end = (void *)raw_inode + EXT4_SB(inode->i_sb)->s_inode_size; - if (ext4_test_inode_state(inode, EXT4_STATE_XATTR)) { -- error = ext4_xattr_check_names(IFIRST(header), is->s.end, -- IFIRST(header)); -+ error = xattr_check_inode(inode, header, is->s.end); - if (error) - return error; - /* Find the named attribute. */ -@@ -1293,6 +1313,10 @@ retry: - last = entry; - total_ino = sizeof(struct ext4_xattr_ibody_header); - -+ error = xattr_check_inode(inode, header, end); -+ if (error) -+ goto cleanup; -+ - free = ext4_xattr_free_space(last, &min_offs, base, &total_ino); - if (free >= isize_diff) { - entry = IFIRST(header); -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 3a65e0132352..16462e702f96 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -918,6 +918,79 @@ static loff_t max_file_size(unsigned bits) - return result; - } - -+static inline bool sanity_check_area_boundary(struct super_block *sb, -+ struct f2fs_super_block *raw_super) -+{ -+ u32 segment0_blkaddr = le32_to_cpu(raw_super->segment0_blkaddr); -+ u32 cp_blkaddr = le32_to_cpu(raw_super->cp_blkaddr); -+ u32 sit_blkaddr = le32_to_cpu(raw_super->sit_blkaddr); -+ u32 nat_blkaddr = le32_to_cpu(raw_super->nat_blkaddr); -+ u32 ssa_blkaddr = le32_to_cpu(raw_super->ssa_blkaddr); -+ u32 main_blkaddr = le32_to_cpu(raw_super->main_blkaddr); -+ u32 segment_count_ckpt = le32_to_cpu(raw_super->segment_count_ckpt); -+ u32 segment_count_sit = le32_to_cpu(raw_super->segment_count_sit); -+ u32 segment_count_nat = le32_to_cpu(raw_super->segment_count_nat); -+ u32 segment_count_ssa = le32_to_cpu(raw_super->segment_count_ssa); -+ u32 segment_count_main = le32_to_cpu(raw_super->segment_count_main); -+ u32 segment_count = le32_to_cpu(raw_super->segment_count); -+ u32 log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg); -+ -+ if (segment0_blkaddr != cp_blkaddr) { -+ f2fs_msg(sb, KERN_INFO, -+ "Mismatch start address, segment0(%u) cp_blkaddr(%u)", -+ segment0_blkaddr, cp_blkaddr); -+ return true; -+ } -+ -+ if (cp_blkaddr + (segment_count_ckpt << log_blocks_per_seg) != -+ sit_blkaddr) { -+ f2fs_msg(sb, KERN_INFO, -+ "Wrong CP boundary, start(%u) end(%u) blocks(%u)", -+ cp_blkaddr, sit_blkaddr, -+ segment_count_ckpt << log_blocks_per_seg); -+ return true; -+ } -+ -+ if (sit_blkaddr + (segment_count_sit << log_blocks_per_seg) != -+ nat_blkaddr) { -+ f2fs_msg(sb, KERN_INFO, -+ "Wrong SIT boundary, start(%u) end(%u) blocks(%u)", -+ sit_blkaddr, nat_blkaddr, -+ segment_count_sit << log_blocks_per_seg); -+ return true; -+ } -+ -+ if (nat_blkaddr + (segment_count_nat << log_blocks_per_seg) != -+ ssa_blkaddr) { -+ f2fs_msg(sb, KERN_INFO, -+ "Wrong NAT boundary, start(%u) end(%u) blocks(%u)", -+ nat_blkaddr, ssa_blkaddr, -+ segment_count_nat << log_blocks_per_seg); -+ return true; -+ } -+ -+ if (ssa_blkaddr + (segment_count_ssa << log_blocks_per_seg) != -+ main_blkaddr) { -+ f2fs_msg(sb, KERN_INFO, -+ "Wrong SSA boundary, start(%u) end(%u) blocks(%u)", -+ ssa_blkaddr, main_blkaddr, -+ segment_count_ssa << log_blocks_per_seg); -+ return true; -+ } -+ -+ if (main_blkaddr + (segment_count_main << log_blocks_per_seg) != -+ segment0_blkaddr + (segment_count << log_blocks_per_seg)) { -+ f2fs_msg(sb, KERN_INFO, -+ "Wrong MAIN_AREA boundary, start(%u) end(%u) blocks(%u)", -+ main_blkaddr, -+ segment0_blkaddr + (segment_count << log_blocks_per_seg), -+ segment_count_main << log_blocks_per_seg); -+ return true; -+ } -+ -+ return false; -+} -+ - static int sanity_check_raw_super(struct super_block *sb, - struct f2fs_super_block *raw_super) - { -@@ -947,6 +1020,14 @@ static int sanity_check_raw_super(struct super_block *sb, - return 1; - } - -+ /* check log blocks per segment */ -+ if (le32_to_cpu(raw_super->log_blocks_per_seg) != 9) { -+ f2fs_msg(sb, KERN_INFO, -+ "Invalid log blocks per segment (%u)\n", -+ le32_to_cpu(raw_super->log_blocks_per_seg)); -+ return 1; -+ } -+ - /* Currently, support 512/1024/2048/4096 bytes sector size */ - if (le32_to_cpu(raw_super->log_sectorsize) > - F2FS_MAX_LOG_SECTOR_SIZE || -@@ -965,6 +1046,23 @@ static int sanity_check_raw_super(struct super_block *sb, - le32_to_cpu(raw_super->log_sectorsize)); - return 1; - } -+ -+ /* check reserved ino info */ -+ if (le32_to_cpu(raw_super->node_ino) != 1 || -+ le32_to_cpu(raw_super->meta_ino) != 2 || -+ le32_to_cpu(raw_super->root_ino) != 3) { -+ f2fs_msg(sb, KERN_INFO, -+ "Invalid Fs Meta Ino: node(%u) meta(%u) root(%u)", -+ le32_to_cpu(raw_super->node_ino), -+ le32_to_cpu(raw_super->meta_ino), -+ le32_to_cpu(raw_super->root_ino)); -+ return 1; -+ } -+ -+ /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */ -+ if (sanity_check_area_boundary(sb, raw_super)) -+ return 1; -+ - return 0; - } - -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index ad4e2377dd63..5be1fa6b676d 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -656,6 +656,37 @@ static __be32 map_new_errors(u32 vers, __be32 nfserr) - return nfserr; - } - -+/* -+ * A write procedure can have a large argument, and a read procedure can -+ * have a large reply, but no NFSv2 or NFSv3 procedure has argument and -+ * reply that can both be larger than a page. The xdr code has taken -+ * advantage of this assumption to be a sloppy about bounds checking in -+ * some cases. Pending a rewrite of the NFSv2/v3 xdr code to fix that -+ * problem, we enforce these assumptions here: -+ */ -+static bool nfs_request_too_big(struct svc_rqst *rqstp, -+ struct svc_procedure *proc) -+{ -+ /* -+ * The ACL code has more careful bounds-checking and is not -+ * susceptible to this problem: -+ */ -+ if (rqstp->rq_prog != NFS_PROGRAM) -+ return false; -+ /* -+ * Ditto NFSv4 (which can in theory have argument and reply both -+ * more than a page): -+ */ -+ if (rqstp->rq_vers >= 4) -+ return false; -+ /* The reply will be small, we're OK: */ -+ if (proc->pc_xdrressize > 0 && -+ proc->pc_xdrressize < XDR_QUADLEN(PAGE_SIZE)) -+ return false; -+ -+ return rqstp->rq_arg.len > PAGE_SIZE; -+} -+ - int - nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp) - { -@@ -668,6 +699,11 @@ nfsd_dispatch(struct svc_rqst *rqstp, __be32 *statp) - rqstp->rq_vers, rqstp->rq_proc); - proc = rqstp->rq_procinfo; - -+ if (nfs_request_too_big(rqstp, proc)) { -+ dprintk("nfsd: NFSv%d argument too large\n", rqstp->rq_vers); -+ *statp = rpc_garbage_args; -+ return 1; -+ } - /* - * Give the xdr decoder a chance to change this if it wants - * (necessary in the NFSv4.0 compound case) -diff --git a/include/uapi/linux/ipv6_route.h b/include/uapi/linux/ipv6_route.h -index f6598d1c886e..316e838b7470 100644 ---- a/include/uapi/linux/ipv6_route.h -+++ b/include/uapi/linux/ipv6_route.h -@@ -34,7 +34,7 @@ - #define RTF_PREF(pref) ((pref) << 27) - #define RTF_PREF_MASK 0x18000000 - --#define RTF_PCPU 0x40000000 -+#define RTF_PCPU 0x40000000 /* read-only: can not be set by user */ - #define RTF_LOCAL 0x80000000 - - -diff --git a/net/9p/client.c b/net/9p/client.c -index ea79ee9a7348..f5feac4ff4ec 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -2101,6 +2101,10 @@ int p9_client_readdir(struct p9_fid *fid, char *data, u32 count, u64 offset) - trace_9p_protocol_dump(clnt, req->rc); - goto free_and_error; - } -+ if (rsize < count) { -+ pr_err("bogus RREADDIR count (%d > %d)\n", count, rsize); -+ count = rsize; -+ } - - p9_debug(P9_DEBUG_9P, "<<< RREADDIR count %d\n", count); - -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index 769cece9b00b..ae92131c4f89 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -859,7 +859,8 @@ static void neigh_probe(struct neighbour *neigh) - if (skb) - skb = skb_clone(skb, GFP_ATOMIC); - write_unlock(&neigh->lock); -- neigh->ops->solicit(neigh, skb); -+ if (neigh->ops->solicit) -+ neigh->ops->solicit(neigh, skb); - atomic_inc(&neigh->probes); - kfree_skb(skb); - } -diff --git a/net/core/netpoll.c b/net/core/netpoll.c -index 94acfc89ad97..440aa9f6e0a8 100644 ---- a/net/core/netpoll.c -+++ b/net/core/netpoll.c -@@ -105,15 +105,21 @@ static void queue_process(struct work_struct *work) - while ((skb = skb_dequeue(&npinfo->txq))) { - struct net_device *dev = skb->dev; - struct netdev_queue *txq; -+ unsigned int q_index; - - if (!netif_device_present(dev) || !netif_running(dev)) { - kfree_skb(skb); - continue; - } - -- txq = skb_get_tx_queue(dev, skb); -- - local_irq_save(flags); -+ /* check if skb->queue_mapping is still valid */ -+ q_index = skb_get_queue_mapping(skb); -+ if (unlikely(q_index >= dev->real_num_tx_queues)) { -+ q_index = q_index % dev->real_num_tx_queues; -+ skb_set_queue_mapping(skb, q_index); -+ } -+ txq = netdev_get_tx_queue(dev, q_index); - HARD_TX_LOCK(dev, txq, smp_processor_id()); - if (netif_xmit_frozen_or_stopped(txq) || - netpoll_start_xmit(skb, dev, txq) != NETDEV_TX_OK) { -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index da4d68d78590..375248b900ba 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -2559,7 +2559,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh) - skb_reset_network_header(skb); - - /* Bugfix: need to give ip_route_input enough of an IP header to not gag. */ -- ip_hdr(skb)->protocol = IPPROTO_ICMP; -+ ip_hdr(skb)->protocol = IPPROTO_UDP; - skb_reserve(skb, MAX_HEADER + sizeof(struct iphdr)); - - src = tb[RTA_SRC] ? nla_get_in_addr(tb[RTA_SRC]) : 0; -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 600dcda840d1..e1d51370977b 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2260,6 +2260,7 @@ int tcp_disconnect(struct sock *sk, int flags) - tcp_init_send_head(sk); - memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); - __sk_dst_reset(sk); -+ tcp_saved_syn_free(tp); - - WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 6c6161763c2f..97cb02dc5f02 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1049,7 +1049,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - struct ip6_tnl *t = netdev_priv(dev); - struct net *net = t->net; - struct net_device_stats *stats = &t->dev->stats; -- struct ipv6hdr *ipv6h = ipv6_hdr(skb); -+ struct ipv6hdr *ipv6h; - struct ipv6_tel_txoption opt; - struct dst_entry *dst = NULL, *ndst = NULL; - struct net_device *tdev; -@@ -1061,26 +1061,28 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - - /* NBMA tunnel */ - if (ipv6_addr_any(&t->parms.raddr)) { -- struct in6_addr *addr6; -- struct neighbour *neigh; -- int addr_type; -+ if (skb->protocol == htons(ETH_P_IPV6)) { -+ struct in6_addr *addr6; -+ struct neighbour *neigh; -+ int addr_type; - -- if (!skb_dst(skb)) -- goto tx_err_link_failure; -+ if (!skb_dst(skb)) -+ goto tx_err_link_failure; - -- neigh = dst_neigh_lookup(skb_dst(skb), -- &ipv6_hdr(skb)->daddr); -- if (!neigh) -- goto tx_err_link_failure; -+ neigh = dst_neigh_lookup(skb_dst(skb), -+ &ipv6_hdr(skb)->daddr); -+ if (!neigh) -+ goto tx_err_link_failure; - -- addr6 = (struct in6_addr *)&neigh->primary_key; -- addr_type = ipv6_addr_type(addr6); -+ addr6 = (struct in6_addr *)&neigh->primary_key; -+ addr_type = ipv6_addr_type(addr6); - -- if (addr_type == IPV6_ADDR_ANY) -- addr6 = &ipv6_hdr(skb)->daddr; -+ if (addr_type == IPV6_ADDR_ANY) -+ addr6 = &ipv6_hdr(skb)->daddr; - -- memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); -- neigh_release(neigh); -+ memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); -+ neigh_release(neigh); -+ } - } else if (!(t->parms.flags & - (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) { - /* enable the cache only only if the routing decision does -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index d9843e5a667f..8361d73ab653 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -774,7 +774,8 @@ failure: - * Delete a VIF entry - */ - --static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head) -+static int mif6_delete(struct mr6_table *mrt, int vifi, int notify, -+ struct list_head *head) - { - struct mif_device *v; - struct net_device *dev; -@@ -820,7 +821,7 @@ static int mif6_delete(struct mr6_table *mrt, int vifi, struct list_head *head) - dev->ifindex, &in6_dev->cnf); - } - -- if (v->flags & MIFF_REGISTER) -+ if ((v->flags & MIFF_REGISTER) && !notify) - unregister_netdevice_queue(dev, head); - - dev_put(dev); -@@ -1330,7 +1331,6 @@ static int ip6mr_device_event(struct notifier_block *this, - struct mr6_table *mrt; - struct mif_device *v; - int ct; -- LIST_HEAD(list); - - if (event != NETDEV_UNREGISTER) - return NOTIFY_DONE; -@@ -1339,10 +1339,9 @@ static int ip6mr_device_event(struct notifier_block *this, - v = &mrt->vif6_table[0]; - for (ct = 0; ct < mrt->maxvif; ct++, v++) { - if (v->dev == dev) -- mif6_delete(mrt, ct, &list); -+ mif6_delete(mrt, ct, 1, NULL); - } - } -- unregister_netdevice_many(&list); - - return NOTIFY_DONE; - } -@@ -1551,7 +1550,7 @@ static void mroute_clean_tables(struct mr6_table *mrt, bool all) - for (i = 0; i < mrt->maxvif; i++) { - if (!all && (mrt->vif6_table[i].flags & VIFF_STATIC)) - continue; -- mif6_delete(mrt, i, &list); -+ mif6_delete(mrt, i, 0, &list); - } - unregister_netdevice_many(&list); - -@@ -1704,7 +1703,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns - if (copy_from_user(&mifi, optval, sizeof(mifi_t))) - return -EFAULT; - rtnl_lock(); -- ret = mif6_delete(mrt, mifi, NULL); -+ ret = mif6_delete(mrt, mifi, 0, NULL); - rtnl_unlock(); - return ret; - -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index 8bca90d6d915..a625f69a28dd 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -1144,8 +1144,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg) - spin_lock_bh(&sk->sk_receive_queue.lock); - skb = skb_peek(&sk->sk_receive_queue); - if (skb) -- amount = skb_tail_pointer(skb) - -- skb_transport_header(skb); -+ amount = skb->len; - spin_unlock_bh(&sk->sk_receive_queue.lock); - return put_user(amount, (int __user *)arg); - } -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 9f0aa255e288..6c91d5c4a92c 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1758,6 +1758,10 @@ static struct rt6_info *ip6_route_info_create(struct fib6_config *cfg) - int addr_type; - int err = -EINVAL; - -+ /* RTF_PCPU is an internal flag; can not be set by userspace */ -+ if (cfg->fc_flags & RTF_PCPU) -+ goto out; -+ - if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128) - goto out; - #ifndef CONFIG_IPV6_SUBTREES -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index ec17cbe8a02b..d3dec414fd44 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -278,7 +278,8 @@ struct l2tp_session *l2tp_session_find(struct net *net, struct l2tp_tunnel *tunn - } - EXPORT_SYMBOL_GPL(l2tp_session_find); - --struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) -+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth, -+ bool do_ref) - { - int hash; - struct l2tp_session *session; -@@ -288,6 +289,9 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) - for (hash = 0; hash < L2TP_HASH_SIZE; hash++) { - hlist_for_each_entry(session, &tunnel->session_hlist[hash], hlist) { - if (++count > nth) { -+ l2tp_session_inc_refcount(session); -+ if (do_ref && session->ref) -+ session->ref(session); - read_unlock_bh(&tunnel->hlist_lock); - return session; - } -@@ -298,7 +302,7 @@ struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth) - - return NULL; - } --EXPORT_SYMBOL_GPL(l2tp_session_find_nth); -+EXPORT_SYMBOL_GPL(l2tp_session_get_nth); - - /* Lookup a session by interface name. - * This is very inefficient but is only used by management interfaces. -diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h -index 763e8e241ce3..555d962a62d2 100644 ---- a/net/l2tp/l2tp_core.h -+++ b/net/l2tp/l2tp_core.h -@@ -243,7 +243,8 @@ out: - struct l2tp_session *l2tp_session_find(struct net *net, - struct l2tp_tunnel *tunnel, - u32 session_id); --struct l2tp_session *l2tp_session_find_nth(struct l2tp_tunnel *tunnel, int nth); -+struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth, -+ bool do_ref); - struct l2tp_session *l2tp_session_find_by_ifname(struct net *net, char *ifname); - struct l2tp_tunnel *l2tp_tunnel_find(struct net *net, u32 tunnel_id); - struct l2tp_tunnel *l2tp_tunnel_find_nth(struct net *net, int nth); -diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c -index 2d6760a2ae34..d100aed3d06f 100644 ---- a/net/l2tp/l2tp_debugfs.c -+++ b/net/l2tp/l2tp_debugfs.c -@@ -53,7 +53,7 @@ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd) - - static void l2tp_dfs_next_session(struct l2tp_dfs_seq_data *pd) - { -- pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx); -+ pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true); - pd->session_idx++; - - if (pd->session == NULL) { -@@ -238,10 +238,14 @@ static int l2tp_dfs_seq_show(struct seq_file *m, void *v) - } - - /* Show the tunnel or session context */ -- if (pd->session == NULL) -+ if (!pd->session) { - l2tp_dfs_seq_tunnel_show(m, pd->tunnel); -- else -+ } else { - l2tp_dfs_seq_session_show(m, pd->session); -+ if (pd->session->deref) -+ pd->session->deref(pd->session); -+ l2tp_session_dec_refcount(pd->session); -+ } - - out: - return 0; -diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c -index 2caaa84ce92d..665cc74df5c5 100644 ---- a/net/l2tp/l2tp_netlink.c -+++ b/net/l2tp/l2tp_netlink.c -@@ -827,7 +827,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback - goto out; - } - -- session = l2tp_session_find_nth(tunnel, si); -+ session = l2tp_session_get_nth(tunnel, si, false); - if (session == NULL) { - ti++; - tunnel = NULL; -@@ -837,8 +837,11 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback - - if (l2tp_nl_session_send(skb, NETLINK_CB(cb->skb).portid, - cb->nlh->nlmsg_seq, NLM_F_MULTI, -- session, L2TP_CMD_SESSION_GET) < 0) -+ session, L2TP_CMD_SESSION_GET) < 0) { -+ l2tp_session_dec_refcount(session); - break; -+ } -+ l2tp_session_dec_refcount(session); - - si++; - } -diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c -index 1ad18c55064c..8ab9c5d74416 100644 ---- a/net/l2tp/l2tp_ppp.c -+++ b/net/l2tp/l2tp_ppp.c -@@ -467,6 +467,10 @@ static void pppol2tp_session_close(struct l2tp_session *session) - static void pppol2tp_session_destruct(struct sock *sk) - { - struct l2tp_session *session = sk->sk_user_data; -+ -+ skb_queue_purge(&sk->sk_receive_queue); -+ skb_queue_purge(&sk->sk_write_queue); -+ - if (session) { - sk->sk_user_data = NULL; - BUG_ON(session->magic != L2TP_SESSION_MAGIC); -@@ -505,9 +509,6 @@ static int pppol2tp_release(struct socket *sock) - l2tp_session_queue_purge(session); - sock_put(sk); - } -- skb_queue_purge(&sk->sk_receive_queue); -- skb_queue_purge(&sk->sk_write_queue); -- - release_sock(sk); - - /* This will delete the session context via -@@ -1574,7 +1575,7 @@ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd) - - static void pppol2tp_next_session(struct net *net, struct pppol2tp_seq_data *pd) - { -- pd->session = l2tp_session_find_nth(pd->tunnel, pd->session_idx); -+ pd->session = l2tp_session_get_nth(pd->tunnel, pd->session_idx, true); - pd->session_idx++; - - if (pd->session == NULL) { -@@ -1701,10 +1702,14 @@ static int pppol2tp_seq_show(struct seq_file *m, void *v) - - /* Show the tunnel or session context. - */ -- if (pd->session == NULL) -+ if (!pd->session) { - pppol2tp_seq_tunnel_show(m, pd->tunnel); -- else -+ } else { - pppol2tp_seq_session_show(m, pd->session); -+ if (pd->session->deref) -+ pd->session->deref(pd->session); -+ l2tp_session_dec_refcount(pd->session); -+ } - - out: - return 0; -@@ -1863,4 +1868,4 @@ MODULE_DESCRIPTION("PPP over L2TP over UDP"); - MODULE_LICENSE("GPL"); - MODULE_VERSION(PPPOL2TP_DRV_VERSION); - MODULE_ALIAS("pppox-proto-" __stringify(PX_PROTO_OL2TP)); --MODULE_ALIAS_L2TP_PWTYPE(11); -+MODULE_ALIAS_L2TP_PWTYPE(7); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index d76800108ddb..f8d6a0ca9c03 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3626,6 +3626,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; -+ if (val > INT_MAX) -+ return -EINVAL; - po->tp_reserve = val; - return 0; - } -@@ -4150,6 +4152,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - rb->frames_per_block = req->tp_block_size / req->tp_frame_size; - if (unlikely(rb->frames_per_block == 0)) - goto out; -+ if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr)) -+ goto out; - if (unlikely((rb->frames_per_block * req->tp_block_nr) != - req->tp_frame_nr)) - goto out; -diff --git a/net/rds/cong.c b/net/rds/cong.c -index e6144b8246fd..6641bcf7c185 100644 ---- a/net/rds/cong.c -+++ b/net/rds/cong.c -@@ -299,7 +299,7 @@ void rds_cong_set_bit(struct rds_cong_map *map, __be16 port) - i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS; - off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS; - -- __set_bit_le(off, (void *)map->m_page_addrs[i]); -+ set_bit_le(off, (void *)map->m_page_addrs[i]); - } - - void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port) -@@ -313,7 +313,7 @@ void rds_cong_clear_bit(struct rds_cong_map *map, __be16 port) - i = be16_to_cpu(port) / RDS_CONG_MAP_PAGE_BITS; - off = be16_to_cpu(port) % RDS_CONG_MAP_PAGE_BITS; - -- __clear_bit_le(off, (void *)map->m_page_addrs[i]); -+ clear_bit_le(off, (void *)map->m_page_addrs[i]); - } - - static int rds_cong_test_bit(struct rds_cong_map *map, __be16 port) -diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c -index e384d6aefa3a..1090a52c03cd 100644 ---- a/net/sched/act_mirred.c -+++ b/net/sched/act_mirred.c -@@ -36,14 +36,15 @@ static DEFINE_SPINLOCK(mirred_list_lock); - static void tcf_mirred_release(struct tc_action *a, int bind) - { - struct tcf_mirred *m = to_mirred(a); -- struct net_device *dev = rcu_dereference_protected(m->tcfm_dev, 1); -+ struct net_device *dev; - - /* We could be called either in a RCU callback or with RTNL lock held. */ - spin_lock_bh(&mirred_list_lock); - list_del(&m->tcfm_list); -- spin_unlock_bh(&mirred_list_lock); -+ dev = rcu_dereference_protected(m->tcfm_dev, 1); - if (dev) - dev_put(dev); -+ spin_unlock_bh(&mirred_list_lock); - } - - static const struct nla_policy mirred_policy[TCA_MIRRED_MAX + 1] = { -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 5758818435f3..c96d666cef29 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -6394,6 +6394,9 @@ int sctp_inet_listen(struct socket *sock, int backlog) - if (sock->state != SS_UNCONNECTED) - goto out; - -+ if (!sctp_sstate(sk, LISTENING) && !sctp_sstate(sk, CLOSED)) -+ goto out; -+ - /* If backlog is zero, disable listening. */ - if (!backlog) { - if (sctp_sstate(sk, CLOSED)) -diff --git a/sound/core/seq/seq_lock.c b/sound/core/seq/seq_lock.c -index 3b693e924db7..12ba83367b1b 100644 ---- a/sound/core/seq/seq_lock.c -+++ b/sound/core/seq/seq_lock.c -@@ -28,19 +28,16 @@ - /* wait until all locks are released */ - void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line) - { -- int max_count = 5 * HZ; -+ int warn_count = 5 * HZ; - - if (atomic_read(lockp) < 0) { - pr_warn("ALSA: seq_lock: lock trouble [counter = %d] in %s:%d\n", atomic_read(lockp), file, line); - return; - } - while (atomic_read(lockp) > 0) { -- if (max_count == 0) { -- pr_warn("ALSA: seq_lock: timeout [%d left] in %s:%d\n", atomic_read(lockp), file, line); -- break; -- } -+ if (warn_count-- == 0) -+ pr_warn("ALSA: seq_lock: waiting [%d left] in %s:%d\n", atomic_read(lockp), file, line); - schedule_timeout_uninterruptible(1); -- max_count--; - } - } - -diff --git a/sound/firewire/lib.h b/sound/firewire/lib.h -index f3f6f84c48d6..bb5f8cdea3e2 100644 ---- a/sound/firewire/lib.h -+++ b/sound/firewire/lib.h -@@ -42,7 +42,7 @@ struct snd_fw_async_midi_port { - - struct snd_rawmidi_substream *substream; - snd_fw_async_midi_port_fill fill; -- unsigned int consume_bytes; -+ int consume_bytes; - }; - - int snd_fw_async_midi_port_init(struct snd_fw_async_midi_port *port, diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.66-67.patch b/patch/kernel/mvebu64-default/03-patch-4.4.66-67.patch deleted file mode 100644 index aafd894f61c8..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.66-67.patch +++ /dev/null @@ -1,948 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1cd052823c03..c987902ae1ee 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 66 -+SUBLEVEL = 67 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/block/drbd/drbd_bitmap.c b/drivers/block/drbd/drbd_bitmap.c -index 9462d2752850..8bdc34dbaedf 100644 ---- a/drivers/block/drbd/drbd_bitmap.c -+++ b/drivers/block/drbd/drbd_bitmap.c -@@ -479,8 +479,14 @@ void drbd_bm_cleanup(struct drbd_device *device) - * this masks out the remaining bits. - * Returns the number of bits cleared. - */ -+#ifndef BITS_PER_PAGE - #define BITS_PER_PAGE (1UL << (PAGE_SHIFT + 3)) - #define BITS_PER_PAGE_MASK (BITS_PER_PAGE - 1) -+#else -+# if BITS_PER_PAGE != (1UL << (PAGE_SHIFT + 3)) -+# error "ambiguous BITS_PER_PAGE" -+# endif -+#endif - #define BITS_PER_LONG_MASK (BITS_PER_LONG - 1) - static int bm_clear_surplus(struct drbd_bitmap *b) - { -diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c -index 3eff35c2d453..2684605fe67f 100644 ---- a/drivers/infiniband/hw/qib/qib_qp.c -+++ b/drivers/infiniband/hw/qib/qib_qp.c -@@ -41,13 +41,13 @@ - - #include "qib.h" - --#define BITS_PER_PAGE (PAGE_SIZE*BITS_PER_BYTE) --#define BITS_PER_PAGE_MASK (BITS_PER_PAGE-1) -+#define RVT_BITS_PER_PAGE (PAGE_SIZE*BITS_PER_BYTE) -+#define RVT_BITS_PER_PAGE_MASK (RVT_BITS_PER_PAGE-1) - - static inline unsigned mk_qpn(struct qib_qpn_table *qpt, - struct qpn_map *map, unsigned off) - { -- return (map - qpt->map) * BITS_PER_PAGE + off; -+ return (map - qpt->map) * RVT_BITS_PER_PAGE + off; - } - - static inline unsigned find_next_offset(struct qib_qpn_table *qpt, -@@ -59,7 +59,7 @@ static inline unsigned find_next_offset(struct qib_qpn_table *qpt, - if (((off & qpt->mask) >> 1) >= n) - off = (off | qpt->mask) + 2; - } else -- off = find_next_zero_bit(map->page, BITS_PER_PAGE, off); -+ off = find_next_zero_bit(map->page, RVT_BITS_PER_PAGE, off); - return off; - } - -@@ -147,8 +147,8 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt, - qpn = 2; - if (qpt->mask && ((qpn & qpt->mask) >> 1) >= dd->n_krcv_queues) - qpn = (qpn | qpt->mask) + 2; -- offset = qpn & BITS_PER_PAGE_MASK; -- map = &qpt->map[qpn / BITS_PER_PAGE]; -+ offset = qpn & RVT_BITS_PER_PAGE_MASK; -+ map = &qpt->map[qpn / RVT_BITS_PER_PAGE]; - max_scan = qpt->nmaps - !offset; - for (i = 0;;) { - if (unlikely(!map->page)) { -@@ -173,7 +173,7 @@ static int alloc_qpn(struct qib_devdata *dd, struct qib_qpn_table *qpt, - * We just need to be sure we don't loop - * forever. - */ -- } while (offset < BITS_PER_PAGE && qpn < QPN_MAX); -+ } while (offset < RVT_BITS_PER_PAGE && qpn < QPN_MAX); - /* - * In order to keep the number of pages allocated to a - * minimum, we scan the all existing pages before increasing -@@ -204,9 +204,9 @@ static void free_qpn(struct qib_qpn_table *qpt, u32 qpn) - { - struct qpn_map *map; - -- map = qpt->map + qpn / BITS_PER_PAGE; -+ map = qpt->map + qpn / RVT_BITS_PER_PAGE; - if (map->page) -- clear_bit(qpn & BITS_PER_PAGE_MASK, map->page); -+ clear_bit(qpn & RVT_BITS_PER_PAGE_MASK, map->page); - } - - static inline unsigned qpn_hash(struct qib_ibdev *dev, u32 qpn) -diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c -index 80a439543259..e503279c34fc 100644 ---- a/drivers/md/dm-ioctl.c -+++ b/drivers/md/dm-ioctl.c -@@ -1843,7 +1843,7 @@ static int ctl_ioctl(uint command, struct dm_ioctl __user *user) - if (r) - goto out; - -- param->data_size = sizeof(*param); -+ param->data_size = offsetof(struct dm_ioctl, data); - r = fn(param, input_param_size); - - if (unlikely(param->flags & DM_BUFFER_FULL_FLAG) && -diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig -index 54479c481a7a..8a25adced79f 100644 ---- a/drivers/mtd/chips/Kconfig -+++ b/drivers/mtd/chips/Kconfig -@@ -111,6 +111,7 @@ config MTD_MAP_BANK_WIDTH_16 - - config MTD_MAP_BANK_WIDTH_32 - bool "Support 256-bit buswidth" if MTD_CFI_GEOMETRY -+ select MTD_COMPLEX_MAPPINGS if HAS_IOMEM - default n - help - If you wish to support CFI devices on a physical bus which is -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 49056c33be74..21e5b9ed1ead 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -12031,7 +12031,7 @@ static int tg3_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom, - int ret; - u32 offset, len, b_offset, odd_len; - u8 *buf; -- __be32 start, end; -+ __be32 start = 0, end; - - if (tg3_flag(tp, NO_NVRAM) || - eeprom->magic != TG3_EEPROM_MAGIC) -diff --git a/drivers/scsi/cxlflash/main.c b/drivers/scsi/cxlflash/main.c -index 2882bcac918a..0b096730c72a 100644 ---- a/drivers/scsi/cxlflash/main.c -+++ b/drivers/scsi/cxlflash/main.c -@@ -996,6 +996,8 @@ static int wait_port_online(__be64 __iomem *fc_regs, u32 delay_us, u32 nretry) - do { - msleep(delay_us / 1000); - status = readq_be(&fc_regs[FC_MTIP_STATUS / 8]); -+ if (status == U64_MAX) -+ nretry /= 2; - } while ((status & FC_MTIP_STATUS_MASK) != FC_MTIP_STATUS_ONLINE && - nretry--); - -@@ -1027,6 +1029,8 @@ static int wait_port_offline(__be64 __iomem *fc_regs, u32 delay_us, u32 nretry) - do { - msleep(delay_us / 1000); - status = readq_be(&fc_regs[FC_MTIP_STATUS / 8]); -+ if (status == U64_MAX) -+ nretry /= 2; - } while ((status & FC_MTIP_STATUS_MASK) != FC_MTIP_STATUS_OFFLINE && - nretry--); - -@@ -1137,7 +1141,7 @@ static const struct asyc_intr_info ainfo[] = { - {SISL_ASTATUS_FC0_LOGI_F, "login failed", 0, CLR_FC_ERROR}, - {SISL_ASTATUS_FC0_LOGI_S, "login succeeded", 0, SCAN_HOST}, - {SISL_ASTATUS_FC0_LINK_DN, "link down", 0, 0}, -- {SISL_ASTATUS_FC0_LINK_UP, "link up", 0, SCAN_HOST}, -+ {SISL_ASTATUS_FC0_LINK_UP, "link up", 0, 0}, - {SISL_ASTATUS_FC1_OTHER, "other error", 1, CLR_FC_ERROR | LINK_RESET}, - {SISL_ASTATUS_FC1_LOGO, "target initiated LOGO", 1, 0}, - {SISL_ASTATUS_FC1_CRC_T, "CRC threshold exceeded", 1, LINK_RESET}, -@@ -1145,7 +1149,7 @@ static const struct asyc_intr_info ainfo[] = { - {SISL_ASTATUS_FC1_LOGI_F, "login failed", 1, CLR_FC_ERROR}, - {SISL_ASTATUS_FC1_LOGI_S, "login succeeded", 1, SCAN_HOST}, - {SISL_ASTATUS_FC1_LINK_DN, "link down", 1, 0}, -- {SISL_ASTATUS_FC1_LINK_UP, "link up", 1, SCAN_HOST}, -+ {SISL_ASTATUS_FC1_LINK_UP, "link up", 1, 0}, - {0x0, "", 0, 0} /* terminator */ - }; - -@@ -1962,6 +1966,11 @@ retry: - * cxlflash_eh_host_reset_handler() - reset the host adapter - * @scp: SCSI command from stack identifying host. - * -+ * Following a reset, the state is evaluated again in case an EEH occurred -+ * during the reset. In such a scenario, the host reset will either yield -+ * until the EEH recovery is complete or return success or failure based -+ * upon the current device state. -+ * - * Return: - * SUCCESS as defined in scsi/scsi.h - * FAILED as defined in scsi/scsi.h -@@ -1993,7 +2002,8 @@ static int cxlflash_eh_host_reset_handler(struct scsi_cmnd *scp) - } else - cfg->state = STATE_NORMAL; - wake_up_all(&cfg->reset_waitq); -- break; -+ ssleep(1); -+ /* fall through */ - case STATE_RESET: - wait_event(cfg->reset_waitq, cfg->state != STATE_RESET); - if (cfg->state == STATE_NORMAL) -@@ -2534,6 +2544,9 @@ static void drain_ioctls(struct cxlflash_cfg *cfg) - * @pdev: PCI device struct. - * @state: PCI channel state. - * -+ * When an EEH occurs during an active reset, wait until the reset is -+ * complete and then take action based upon the device state. -+ * - * Return: PCI_ERS_RESULT_NEED_RESET or PCI_ERS_RESULT_DISCONNECT - */ - static pci_ers_result_t cxlflash_pci_error_detected(struct pci_dev *pdev, -@@ -2547,6 +2560,10 @@ static pci_ers_result_t cxlflash_pci_error_detected(struct pci_dev *pdev, - - switch (state) { - case pci_channel_io_frozen: -+ wait_event(cfg->reset_waitq, cfg->state != STATE_RESET); -+ if (cfg->state == STATE_FAILTERM) -+ return PCI_ERS_RESULT_DISCONNECT; -+ - cfg->state = STATE_RESET; - scsi_block_requests(cfg->host); - drain_ioctls(cfg); -diff --git a/drivers/staging/rdma/ehca/ehca_mrmw.c b/drivers/staging/rdma/ehca/ehca_mrmw.c -index f914b30999f8..4d52ca42644a 100644 ---- a/drivers/staging/rdma/ehca/ehca_mrmw.c -+++ b/drivers/staging/rdma/ehca/ehca_mrmw.c -@@ -1921,7 +1921,7 @@ static int ehca_set_pagebuf_user2(struct ehca_mr_pginfo *pginfo, - u64 *kpage) - { - int ret = 0; -- u64 pgaddr, prev_pgaddr; -+ u64 pgaddr, prev_pgaddr = 0; - u32 j = 0; - int kpages_per_hwpage = pginfo->hwpage_size / PAGE_SIZE; - int nr_kpages = kpages_per_hwpage; -@@ -2417,6 +2417,7 @@ static int ehca_reg_bmap_mr_rpages(struct ehca_shca *shca, - ehca_err(&shca->ib_device, "kpage alloc failed"); - return -ENOMEM; - } -+ hret = H_SUCCESS; - for (top = 0; top < EHCA_MAP_ENTRIES; top++) { - if (!ehca_bmap_valid(ehca_bmap->top[top])) - continue; -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index 83ff1724ec79..cf3da51a3536 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -5850,17 +5850,15 @@ static pci_ers_result_t serial8250_io_slot_reset(struct pci_dev *dev) - static void serial8250_io_resume(struct pci_dev *dev) - { - struct serial_private *priv = pci_get_drvdata(dev); -- const struct pciserial_board *board; -+ struct serial_private *new; - - if (!priv) - return; - -- board = priv->board; -- kfree(priv); -- priv = pciserial_init_ports(dev, board); -- -- if (!IS_ERR(priv)) { -- pci_set_drvdata(dev, priv); -+ new = pciserial_init_ports(dev, priv->board); -+ if (!IS_ERR(new)) { -+ pci_set_drvdata(dev, new); -+ kfree(priv); - } - } - -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index 94906aaa9b7c..e2f6a79e9b01 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -227,6 +227,7 @@ struct smb_version_operations { - /* verify the message */ - int (*check_message)(char *, unsigned int); - bool (*is_oplock_break)(char *, struct TCP_Server_Info *); -+ int (*handle_cancelled_mid)(char *, struct TCP_Server_Info *); - void (*downgrade_oplock)(struct TCP_Server_Info *, - struct cifsInodeInfo *, bool); - /* process transaction2 response */ -@@ -1289,12 +1290,19 @@ struct mid_q_entry { - void *callback_data; /* general purpose pointer for callback */ - void *resp_buf; /* pointer to received SMB header */ - int mid_state; /* wish this were enum but can not pass to wait_event */ -+ unsigned int mid_flags; - __le16 command; /* smb command code */ - bool large_buf:1; /* if valid response, is pointer to large buf */ - bool multiRsp:1; /* multiple trans2 responses for one request */ - bool multiEnd:1; /* both received */ - }; - -+struct close_cancelled_open { -+ struct cifs_fid fid; -+ struct cifs_tcon *tcon; -+ struct work_struct work; -+}; -+ - /* Make code in transport.c a little cleaner by moving - update of optional stats into function below */ - #ifdef CONFIG_CIFS_STATS2 -@@ -1426,6 +1434,9 @@ static inline void free_dfs_info_array(struct dfs_info3_param *param, - #define MID_RESPONSE_MALFORMED 0x10 - #define MID_SHUTDOWN 0x20 - -+/* Flags */ -+#define MID_WAIT_CANCELLED 1 /* Cancelled while waiting for response */ -+ - /* Types of response buffer returned from SendReceive2 */ - #define CIFS_NO_BUFFER 0 /* Response buffer not returned */ - #define CIFS_SMALL_BUFFER 1 -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index b1104ed8f54c..5e2f8b8ca08a 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -1424,6 +1424,8 @@ cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid) - - length = discard_remaining_data(server); - dequeue_mid(mid, rdata->result); -+ mid->resp_buf = server->smallbuf; -+ server->smallbuf = NULL; - return length; - } - -@@ -1538,6 +1540,8 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) - return cifs_readv_discard(server, mid); - - dequeue_mid(mid, false); -+ mid->resp_buf = server->smallbuf; -+ server->smallbuf = NULL; - return length; - } - -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 5d59f25521ce..156bc18eac69 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -924,10 +924,19 @@ cifs_demultiplex_thread(void *p) - - server->lstrp = jiffies; - if (mid_entry != NULL) { -+ if ((mid_entry->mid_flags & MID_WAIT_CANCELLED) && -+ mid_entry->mid_state == MID_RESPONSE_RECEIVED && -+ server->ops->handle_cancelled_mid) -+ server->ops->handle_cancelled_mid( -+ mid_entry->resp_buf, -+ server); -+ - if (!mid_entry->multiRsp || mid_entry->multiEnd) - mid_entry->callback(mid_entry); -- } else if (!server->ops->is_oplock_break || -- !server->ops->is_oplock_break(buf, server)) { -+ } else if (server->ops->is_oplock_break && -+ server->ops->is_oplock_break(buf, server)) { -+ cifs_dbg(FYI, "Received oplock break\n"); -+ } else { - cifs_dbg(VFS, "No task to wake, unknown frame received! NumMids %d\n", - atomic_read(&midCount)); - cifs_dump_mem("Received Data is: ", buf, -diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c -index e5bc85e49be7..76ccf20fbfb7 100644 ---- a/fs/cifs/smb2misc.c -+++ b/fs/cifs/smb2misc.c -@@ -630,3 +630,47 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server) - cifs_dbg(FYI, "Can not process oplock break for non-existent connection\n"); - return false; - } -+ -+void -+smb2_cancelled_close_fid(struct work_struct *work) -+{ -+ struct close_cancelled_open *cancelled = container_of(work, -+ struct close_cancelled_open, work); -+ -+ cifs_dbg(VFS, "Close unmatched open\n"); -+ -+ SMB2_close(0, cancelled->tcon, cancelled->fid.persistent_fid, -+ cancelled->fid.volatile_fid); -+ cifs_put_tcon(cancelled->tcon); -+ kfree(cancelled); -+} -+ -+int -+smb2_handle_cancelled_mid(char *buffer, struct TCP_Server_Info *server) -+{ -+ struct smb2_hdr *hdr = (struct smb2_hdr *)buffer; -+ struct smb2_create_rsp *rsp = (struct smb2_create_rsp *)buffer; -+ struct cifs_tcon *tcon; -+ struct close_cancelled_open *cancelled; -+ -+ if (hdr->Command != SMB2_CREATE || hdr->Status != STATUS_SUCCESS) -+ return 0; -+ -+ cancelled = kzalloc(sizeof(*cancelled), GFP_KERNEL); -+ if (!cancelled) -+ return -ENOMEM; -+ -+ tcon = smb2_find_smb_tcon(server, hdr->SessionId, hdr->TreeId); -+ if (!tcon) { -+ kfree(cancelled); -+ return -ENOENT; -+ } -+ -+ cancelled->fid.persistent_fid = rsp->PersistentFileId; -+ cancelled->fid.volatile_fid = rsp->VolatileFileId; -+ cancelled->tcon = tcon; -+ INIT_WORK(&cancelled->work, smb2_cancelled_close_fid); -+ queue_work(cifsiod_wq, &cancelled->work); -+ -+ return 0; -+} -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index be34b4860675..087918c4612a 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -1511,6 +1511,7 @@ struct smb_version_operations smb20_operations = { - .clear_stats = smb2_clear_stats, - .print_stats = smb2_print_stats, - .is_oplock_break = smb2_is_valid_oplock_break, -+ .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, - .need_neg = smb2_need_neg, - .negotiate = smb2_negotiate, -@@ -1589,6 +1590,7 @@ struct smb_version_operations smb21_operations = { - .clear_stats = smb2_clear_stats, - .print_stats = smb2_print_stats, - .is_oplock_break = smb2_is_valid_oplock_break, -+ .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, - .need_neg = smb2_need_neg, - .negotiate = smb2_negotiate, -@@ -1670,6 +1672,7 @@ struct smb_version_operations smb30_operations = { - .print_stats = smb2_print_stats, - .dump_share_caps = smb2_dump_share_caps, - .is_oplock_break = smb2_is_valid_oplock_break, -+ .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, - .need_neg = smb2_need_neg, - .negotiate = smb2_negotiate, -@@ -1757,6 +1760,7 @@ struct smb_version_operations smb311_operations = { - .print_stats = smb2_print_stats, - .dump_share_caps = smb2_dump_share_caps, - .is_oplock_break = smb2_is_valid_oplock_break, -+ .handle_cancelled_mid = smb2_handle_cancelled_mid, - .downgrade_oplock = smb2_downgrade_oplock, - .need_neg = smb2_need_neg, - .negotiate = smb2_negotiate, -diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h -index 0a406ae78129..adc5234486c3 100644 ---- a/fs/cifs/smb2proto.h -+++ b/fs/cifs/smb2proto.h -@@ -47,6 +47,10 @@ extern struct mid_q_entry *smb2_setup_request(struct cifs_ses *ses, - struct smb_rqst *rqst); - extern struct mid_q_entry *smb2_setup_async_request( - struct TCP_Server_Info *server, struct smb_rqst *rqst); -+extern struct cifs_ses *smb2_find_smb_ses(struct TCP_Server_Info *server, -+ __u64 ses_id); -+extern struct cifs_tcon *smb2_find_smb_tcon(struct TCP_Server_Info *server, -+ __u64 ses_id, __u32 tid); - extern int smb2_calc_signature(struct smb_rqst *rqst, - struct TCP_Server_Info *server); - extern int smb3_calc_signature(struct smb_rqst *rqst, -@@ -157,6 +161,9 @@ extern int SMB2_set_compression(const unsigned int xid, struct cifs_tcon *tcon, - extern int SMB2_oplock_break(const unsigned int xid, struct cifs_tcon *tcon, - const u64 persistent_fid, const u64 volatile_fid, - const __u8 oplock_level); -+extern int smb2_handle_cancelled_mid(char *buffer, -+ struct TCP_Server_Info *server); -+void smb2_cancelled_close_fid(struct work_struct *work); - extern int SMB2_QFS_info(const unsigned int xid, struct cifs_tcon *tcon, - u64 persistent_file_id, u64 volatile_file_id, - struct kstatfs *FSData); -diff --git a/fs/cifs/smb2transport.c b/fs/cifs/smb2transport.c -index d4c5b6f109a7..69e3b322bbfe 100644 ---- a/fs/cifs/smb2transport.c -+++ b/fs/cifs/smb2transport.c -@@ -115,22 +115,68 @@ smb3_crypto_shash_allocate(struct TCP_Server_Info *server) - } - - static struct cifs_ses * --smb2_find_smb_ses(struct smb2_hdr *smb2hdr, struct TCP_Server_Info *server) -+smb2_find_smb_ses_unlocked(struct TCP_Server_Info *server, __u64 ses_id) - { - struct cifs_ses *ses; - -- spin_lock(&cifs_tcp_ses_lock); - list_for_each_entry(ses, &server->smb_ses_list, smb_ses_list) { -- if (ses->Suid != smb2hdr->SessionId) -+ if (ses->Suid != ses_id) - continue; -- spin_unlock(&cifs_tcp_ses_lock); - return ses; - } -+ -+ return NULL; -+} -+ -+struct cifs_ses * -+smb2_find_smb_ses(struct TCP_Server_Info *server, __u64 ses_id) -+{ -+ struct cifs_ses *ses; -+ -+ spin_lock(&cifs_tcp_ses_lock); -+ ses = smb2_find_smb_ses_unlocked(server, ses_id); - spin_unlock(&cifs_tcp_ses_lock); - -+ return ses; -+} -+ -+static struct cifs_tcon * -+smb2_find_smb_sess_tcon_unlocked(struct cifs_ses *ses, __u32 tid) -+{ -+ struct cifs_tcon *tcon; -+ -+ list_for_each_entry(tcon, &ses->tcon_list, tcon_list) { -+ if (tcon->tid != tid) -+ continue; -+ ++tcon->tc_count; -+ return tcon; -+ } -+ - return NULL; - } - -+/* -+ * Obtain tcon corresponding to the tid in the given -+ * cifs_ses -+ */ -+ -+struct cifs_tcon * -+smb2_find_smb_tcon(struct TCP_Server_Info *server, __u64 ses_id, __u32 tid) -+{ -+ struct cifs_ses *ses; -+ struct cifs_tcon *tcon; -+ -+ spin_lock(&cifs_tcp_ses_lock); -+ ses = smb2_find_smb_ses_unlocked(server, ses_id); -+ if (!ses) { -+ spin_unlock(&cifs_tcp_ses_lock); -+ return NULL; -+ } -+ tcon = smb2_find_smb_sess_tcon_unlocked(ses, tid); -+ spin_unlock(&cifs_tcp_ses_lock); -+ -+ return tcon; -+} - - int - smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) -@@ -143,7 +189,7 @@ smb2_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) - struct smb2_hdr *smb2_pdu = (struct smb2_hdr *)iov[0].iov_base; - struct cifs_ses *ses; - -- ses = smb2_find_smb_ses(smb2_pdu, server); -+ ses = smb2_find_smb_ses(server, smb2_pdu->SessionId); - if (!ses) { - cifs_dbg(VFS, "%s: Could not find session\n", __func__); - return 0; -@@ -314,7 +360,7 @@ smb3_calc_signature(struct smb_rqst *rqst, struct TCP_Server_Info *server) - struct smb2_hdr *smb2_pdu = (struct smb2_hdr *)iov[0].iov_base; - struct cifs_ses *ses; - -- ses = smb2_find_smb_ses(smb2_pdu, server); -+ ses = smb2_find_smb_ses(server, smb2_pdu->SessionId); - if (!ses) { - cifs_dbg(VFS, "%s: Could not find session\n", __func__); - return 0; -diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c -index 87abe8ed074c..54af10204e83 100644 ---- a/fs/cifs/transport.c -+++ b/fs/cifs/transport.c -@@ -786,9 +786,11 @@ SendReceive2(const unsigned int xid, struct cifs_ses *ses, - - rc = wait_for_response(ses->server, midQ); - if (rc != 0) { -+ cifs_dbg(FYI, "Cancelling wait for mid %llu\n", midQ->mid); - send_cancel(ses->server, buf, midQ); - spin_lock(&GlobalMid_Lock); - if (midQ->mid_state == MID_REQUEST_SUBMITTED) { -+ midQ->mid_flags |= MID_WAIT_CANCELLED; - midQ->callback = DeleteMidQEntry; - spin_unlock(&GlobalMid_Lock); - cifs_small_buf_release(buf); -diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c -index 1a0835073663..9d6c2dcf1bd0 100644 ---- a/fs/ext4/crypto.c -+++ b/fs/ext4/crypto.c -@@ -34,6 +34,7 @@ - #include - #include - #include -+#include - - #include "ext4_extents.h" - #include "xattr.h" -@@ -469,3 +470,61 @@ uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size) - return size; - return 0; - } -+ -+/* -+ * Validate dentries for encrypted directories to make sure we aren't -+ * potentially caching stale data after a key has been added or -+ * removed. -+ */ -+static int ext4_d_revalidate(struct dentry *dentry, unsigned int flags) -+{ -+ struct dentry *dir; -+ struct ext4_crypt_info *ci; -+ int dir_has_key, cached_with_key; -+ -+ if (flags & LOOKUP_RCU) -+ return -ECHILD; -+ -+ dir = dget_parent(dentry); -+ if (!ext4_encrypted_inode(d_inode(dir))) { -+ dput(dir); -+ return 0; -+ } -+ ci = EXT4_I(d_inode(dir))->i_crypt_info; -+ -+ /* this should eventually be an flag in d_flags */ -+ cached_with_key = dentry->d_fsdata != NULL; -+ dir_has_key = (ci != NULL); -+ dput(dir); -+ -+ /* -+ * If the dentry was cached without the key, and it is a -+ * negative dentry, it might be a valid name. We can't check -+ * if the key has since been made available due to locking -+ * reasons, so we fail the validation so ext4_lookup() can do -+ * this check. -+ * -+ * We also fail the validation if the dentry was created with -+ * the key present, but we no longer have the key, or vice versa. -+ */ -+ if ((!cached_with_key && d_is_negative(dentry)) || -+ (!cached_with_key && dir_has_key) || -+ (cached_with_key && !dir_has_key)) { -+#if 0 /* Revalidation debug */ -+ char buf[80]; -+ char *cp = simple_dname(dentry, buf, sizeof(buf)); -+ -+ if (IS_ERR(cp)) -+ cp = (char *) "???"; -+ pr_err("revalidate: %s %p %d %d %d\n", cp, dentry->d_fsdata, -+ cached_with_key, d_is_negative(dentry), -+ dir_has_key); -+#endif -+ return 0; -+ } -+ return 1; -+} -+ -+const struct dentry_operations ext4_encrypted_d_ops = { -+ .d_revalidate = ext4_d_revalidate, -+}; -diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c -index 1d1bca74f844..6d17f31a31d7 100644 ---- a/fs/ext4/dir.c -+++ b/fs/ext4/dir.c -@@ -111,6 +111,12 @@ static int ext4_readdir(struct file *file, struct dir_context *ctx) - int dir_has_error = 0; - struct ext4_str fname_crypto_str = {.name = NULL, .len = 0}; - -+ if (ext4_encrypted_inode(inode)) { -+ err = ext4_get_encryption_info(inode); -+ if (err && err != -ENOKEY) -+ return err; -+ } -+ - if (is_dx_dir(inode)) { - err = ext4_dx_readdir(file, ctx); - if (err != ERR_BAD_DX_DIR) { -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 362d59b24f1d..3de9bb357b4f 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2268,6 +2268,7 @@ struct page *ext4_encrypt(struct inode *inode, - struct page *plaintext_page); - int ext4_decrypt(struct page *page); - int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex); -+extern const struct dentry_operations ext4_encrypted_d_ops; - - #ifdef CONFIG_EXT4_FS_ENCRYPTION - int ext4_init_crypto(void); -diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c -index 789e2d6724a9..bcd7c4788903 100644 ---- a/fs/ext4/ioctl.c -+++ b/fs/ext4/ioctl.c -@@ -622,6 +622,9 @@ resizefs_out: - struct ext4_encryption_policy policy; - int err = 0; - -+ if (!ext4_has_feature_encrypt(sb)) -+ return -EOPNOTSUPP; -+ - if (copy_from_user(&policy, - (struct ext4_encryption_policy __user *)arg, - sizeof(policy))) { -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 573b4cbb0cb9..fafa903ab3c0 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1557,6 +1557,24 @@ static struct dentry *ext4_lookup(struct inode *dir, struct dentry *dentry, unsi - struct ext4_dir_entry_2 *de; - struct buffer_head *bh; - -+ if (ext4_encrypted_inode(dir)) { -+ int res = ext4_get_encryption_info(dir); -+ -+ /* -+ * This should be a properly defined flag for -+ * dentry->d_flags when we uplift this to the VFS. -+ * d_fsdata is set to (void *) 1 if if the dentry is -+ * created while the directory was encrypted and we -+ * don't have access to the key. -+ */ -+ dentry->d_fsdata = NULL; -+ if (ext4_encryption_info(dir)) -+ dentry->d_fsdata = (void *) 1; -+ d_set_d_op(dentry, &ext4_encrypted_d_ops); -+ if (res && res != -ENOKEY) -+ return ERR_PTR(res); -+ } -+ - if (dentry->d_name.len > EXT4_NAME_LEN) - return ERR_PTR(-ENAMETOOLONG); - -diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c -index 00575d776d91..7162ab7bc093 100644 ---- a/fs/nfsd/nfs3xdr.c -+++ b/fs/nfsd/nfs3xdr.c -@@ -358,6 +358,7 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - { - unsigned int len, v, hdr, dlen; - u32 max_blocksize = svc_max_payload(rqstp); -+ struct kvec *head = rqstp->rq_arg.head; - - p = decode_fh(p, &args->fh); - if (!p) -@@ -367,6 +368,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - args->count = ntohl(*p++); - args->stable = ntohl(*p++); - len = args->len = ntohl(*p++); -+ if ((void *)p > head->iov_base + head->iov_len) -+ return 0; - /* - * The count must equal the amount of data passed. - */ -@@ -377,9 +380,8 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - * Check to make sure that we got the right number of - * bytes. - */ -- hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; -- dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len -- - hdr; -+ hdr = (void*)p - head->iov_base; -+ dlen = head->iov_len + rqstp->rq_arg.page_len - hdr; - /* - * Round the length of the data which was specified up to - * the next multiple of XDR units and then compare that -@@ -396,7 +398,7 @@ nfs3svc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - len = args->len = max_blocksize; - } - rqstp->rq_vec[0].iov_base = (void*)p; -- rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr; -+ rqstp->rq_vec[0].iov_len = head->iov_len - hdr; - v = 0; - while (len > rqstp->rq_vec[v].iov_len) { - len -= rqstp->rq_vec[v].iov_len; -@@ -471,6 +473,8 @@ nfs3svc_decode_symlinkargs(struct svc_rqst *rqstp, __be32 *p, - /* first copy and check from the first page */ - old = (char*)p; - vec = &rqstp->rq_arg.head[0]; -+ if ((void *)old > vec->iov_base + vec->iov_len) -+ return 0; - avail = vec->iov_len - (old - (char*)vec->iov_base); - while (len && avail && *old) { - *new++ = *old++; -diff --git a/fs/nfsd/nfsxdr.c b/fs/nfsd/nfsxdr.c -index 79d964aa8079..bf913201a6ad 100644 ---- a/fs/nfsd/nfsxdr.c -+++ b/fs/nfsd/nfsxdr.c -@@ -280,6 +280,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - struct nfsd_writeargs *args) - { - unsigned int len, hdr, dlen; -+ struct kvec *head = rqstp->rq_arg.head; - int v; - - p = decode_fh(p, &args->fh); -@@ -300,9 +301,10 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - * Check to make sure that we got the right number of - * bytes. - */ -- hdr = (void*)p - rqstp->rq_arg.head[0].iov_base; -- dlen = rqstp->rq_arg.head[0].iov_len + rqstp->rq_arg.page_len -- - hdr; -+ hdr = (void*)p - head->iov_base; -+ if (hdr > head->iov_len) -+ return 0; -+ dlen = head->iov_len + rqstp->rq_arg.page_len - hdr; - - /* - * Round the length of the data which was specified up to -@@ -316,7 +318,7 @@ nfssvc_decode_writeargs(struct svc_rqst *rqstp, __be32 *p, - return 0; - - rqstp->rq_vec[0].iov_base = (void*)p; -- rqstp->rq_vec[0].iov_len = rqstp->rq_arg.head[0].iov_len - hdr; -+ rqstp->rq_vec[0].iov_len = head->iov_len - hdr; - v = 0; - while (len > rqstp->rq_vec[v].iov_len) { - len -= rqstp->rq_vec[v].iov_len; -diff --git a/fs/timerfd.c b/fs/timerfd.c -index 053818dd6c18..1327a02ec778 100644 ---- a/fs/timerfd.c -+++ b/fs/timerfd.c -@@ -40,6 +40,7 @@ struct timerfd_ctx { - short unsigned settime_flags; /* to show in fdinfo */ - struct rcu_head rcu; - struct list_head clist; -+ spinlock_t cancel_lock; - bool might_cancel; - }; - -@@ -112,7 +113,7 @@ void timerfd_clock_was_set(void) - rcu_read_unlock(); - } - --static void timerfd_remove_cancel(struct timerfd_ctx *ctx) -+static void __timerfd_remove_cancel(struct timerfd_ctx *ctx) - { - if (ctx->might_cancel) { - ctx->might_cancel = false; -@@ -122,6 +123,13 @@ static void timerfd_remove_cancel(struct timerfd_ctx *ctx) - } - } - -+static void timerfd_remove_cancel(struct timerfd_ctx *ctx) -+{ -+ spin_lock(&ctx->cancel_lock); -+ __timerfd_remove_cancel(ctx); -+ spin_unlock(&ctx->cancel_lock); -+} -+ - static bool timerfd_canceled(struct timerfd_ctx *ctx) - { - if (!ctx->might_cancel || ctx->moffs.tv64 != KTIME_MAX) -@@ -132,6 +140,7 @@ static bool timerfd_canceled(struct timerfd_ctx *ctx) - - static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) - { -+ spin_lock(&ctx->cancel_lock); - if ((ctx->clockid == CLOCK_REALTIME || - ctx->clockid == CLOCK_REALTIME_ALARM) && - (flags & TFD_TIMER_ABSTIME) && (flags & TFD_TIMER_CANCEL_ON_SET)) { -@@ -141,9 +150,10 @@ static void timerfd_setup_cancel(struct timerfd_ctx *ctx, int flags) - list_add_rcu(&ctx->clist, &cancel_list); - spin_unlock(&cancel_lock); - } -- } else if (ctx->might_cancel) { -- timerfd_remove_cancel(ctx); -+ } else { -+ __timerfd_remove_cancel(ctx); - } -+ spin_unlock(&ctx->cancel_lock); - } - - static ktime_t timerfd_get_remaining(struct timerfd_ctx *ctx) -@@ -395,6 +405,7 @@ SYSCALL_DEFINE2(timerfd_create, int, clockid, int, flags) - return -ENOMEM; - - init_waitqueue_head(&ctx->wqh); -+ spin_lock_init(&ctx->cancel_lock); - ctx->clockid = clockid; - - if (isalarm(ctx)) -diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h -index 366cf77953b5..806d0ab845e0 100644 ---- a/include/linux/mtd/map.h -+++ b/include/linux/mtd/map.h -@@ -122,18 +122,13 @@ - #endif - - #ifdef CONFIG_MTD_MAP_BANK_WIDTH_32 --# ifdef map_bankwidth --# undef map_bankwidth --# define map_bankwidth(map) ((map)->bankwidth) --# undef map_bankwidth_is_large --# define map_bankwidth_is_large(map) (map_bankwidth(map) > BITS_PER_LONG/8) --# undef map_words --# define map_words(map) map_calc_words(map) --# else --# define map_bankwidth(map) 32 --# define map_bankwidth_is_large(map) (1) --# define map_words(map) map_calc_words(map) --# endif -+/* always use indirect access for 256-bit to preserve kernel stack */ -+# undef map_bankwidth -+# define map_bankwidth(map) ((map)->bankwidth) -+# undef map_bankwidth_is_large -+# define map_bankwidth_is_large(map) (map_bankwidth(map) > BITS_PER_LONG/8) -+# undef map_words -+# define map_words(map) map_calc_words(map) - #define map_bankwidth_is_32(map) (map_bankwidth(map) == 32) - #undef MAX_MAP_BANKWIDTH - #define MAX_MAP_BANKWIDTH 32 -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 8e33019d8e7b..acfb16fdcd55 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2107,7 +2107,7 @@ static int netlink_dump(struct sock *sk) - if (!skb) { - alloc_size = alloc_min_size; - skb = netlink_alloc_skb(sk, alloc_size, nlk->portid, -- (GFP_KERNEL & ~__GFP_DIRECT_RECLAIM)); -+ GFP_KERNEL); - } - if (!skb) - goto errout_skb; -diff --git a/sound/ppc/awacs.c b/sound/ppc/awacs.c -index 09da7b52bc2e..1468e4b7bf93 100644 ---- a/sound/ppc/awacs.c -+++ b/sound/ppc/awacs.c -@@ -991,6 +991,7 @@ snd_pmac_awacs_init(struct snd_pmac *chip) - if (err < 0) - return err; - } -+ master_vol = NULL; - if (pm7500) - err = build_mixers(chip, - ARRAY_SIZE(snd_pmac_awacs_mixers_pmac7500), -diff --git a/sound/soc/intel/boards/bytcr_rt5640.c b/sound/soc/intel/boards/bytcr_rt5640.c -index 7a5c9a36c1db..daba8c56b43b 100644 ---- a/sound/soc/intel/boards/bytcr_rt5640.c -+++ b/sound/soc/intel/boards/bytcr_rt5640.c -@@ -139,7 +139,7 @@ static struct snd_soc_dai_link byt_dailink[] = { - .codec_dai_name = "snd-soc-dummy-dai", - .codec_name = "snd-soc-dummy", - .platform_name = "sst-mfld-platform", -- .ignore_suspend = 1, -+ .nonatomic = true, - .dynamic = 1, - .dpcm_playback = 1, - .dpcm_capture = 1, -@@ -166,6 +166,7 @@ static struct snd_soc_dai_link byt_dailink[] = { - | SND_SOC_DAIFMT_CBS_CFS, - .be_hw_params_fixup = byt_codec_fixup, - .ignore_suspend = 1, -+ .nonatomic = true, - .dpcm_playback = 1, - .dpcm_capture = 1, - .ops = &byt_be_ssp2_ops, diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.67-68.patch b/patch/kernel/mvebu64-default/03-patch-4.4.67-68.patch deleted file mode 100644 index 29d3db30add0..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.67-68.patch +++ /dev/null @@ -1,2093 +0,0 @@ -diff --git a/Makefile b/Makefile -index c987902ae1ee..e6c7990497e7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 67 -+SUBLEVEL = 68 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kernel/Makefile b/arch/arm/kernel/Makefile -index af9e59bf3831..3c789496297f 100644 ---- a/arch/arm/kernel/Makefile -+++ b/arch/arm/kernel/Makefile -@@ -73,7 +73,6 @@ obj-$(CONFIG_IWMMXT) += iwmmxt.o - obj-$(CONFIG_PERF_EVENTS) += perf_regs.o perf_callchain.o - obj-$(CONFIG_HW_PERF_EVENTS) += perf_event_xscale.o perf_event_v6.o \ - perf_event_v7.o --CFLAGS_pj4-cp0.o := -marm - AFLAGS_iwmmxt.o := -Wa,-mcpu=iwmmxt - obj-$(CONFIG_ARM_CPU_TOPOLOGY) += topology.o - obj-$(CONFIG_VDSO) += vdso.o -diff --git a/arch/arm/kernel/pj4-cp0.c b/arch/arm/kernel/pj4-cp0.c -index 8153e36b2491..7c9248b74d3f 100644 ---- a/arch/arm/kernel/pj4-cp0.c -+++ b/arch/arm/kernel/pj4-cp0.c -@@ -66,9 +66,13 @@ static void __init pj4_cp_access_write(u32 value) - - __asm__ __volatile__ ( - "mcr p15, 0, %1, c1, c0, 2\n\t" -+#ifdef CONFIG_THUMB2_KERNEL -+ "isb\n\t" -+#else - "mrc p15, 0, %0, c1, c0, 2\n\t" - "mov %0, %0\n\t" - "sub pc, pc, #4\n\t" -+#endif - : "=r" (temp) : "r" (value)); - } - -diff --git a/arch/arm/mach-omap2/omap-headsmp.S b/arch/arm/mach-omap2/omap-headsmp.S -index 6d1dffca6c7b..748dde9fa4a5 100644 ---- a/arch/arm/mach-omap2/omap-headsmp.S -+++ b/arch/arm/mach-omap2/omap-headsmp.S -@@ -17,6 +17,7 @@ - - #include - #include -+#include - - #include "omap44xx.h" - -@@ -56,7 +57,7 @@ wait_2: ldr r2, =AUX_CORE_BOOT0_PA @ read from AuxCoreBoot0 - cmp r0, r4 - bne wait_2 - ldr r12, =API_HYP_ENTRY -- adr r0, hyp_boot -+ badr r0, hyp_boot - smc #0 - hyp_boot: - b secondary_startup -diff --git a/arch/arm64/net/bpf_jit_comp.c b/arch/arm64/net/bpf_jit_comp.c -index b162ad70effc..6297140dd84f 100644 ---- a/arch/arm64/net/bpf_jit_comp.c -+++ b/arch/arm64/net/bpf_jit_comp.c -@@ -728,14 +728,14 @@ static int build_body(struct jit_ctx *ctx) - int ret; - - ret = build_insn(insn, ctx); -- -- if (ctx->image == NULL) -- ctx->offset[i] = ctx->idx; -- - if (ret > 0) { - i++; -+ if (ctx->image == NULL) -+ ctx->offset[i] = ctx->idx; - continue; - } -+ if (ctx->image == NULL) -+ ctx->offset[i] = ctx->idx; - if (ret) - return ret; - } -diff --git a/arch/mips/kernel/mips-r2-to-r6-emul.c b/arch/mips/kernel/mips-r2-to-r6-emul.c -index af27334d6809..e3384065f5e7 100644 ---- a/arch/mips/kernel/mips-r2-to-r6-emul.c -+++ b/arch/mips/kernel/mips-r2-to-r6-emul.c -@@ -434,8 +434,8 @@ static int multu_func(struct pt_regs *regs, u32 ir) - rs = regs->regs[MIPSInst_RS(ir)]; - res = (u64)rt * (u64)rs; - rt = res; -- regs->lo = (s64)rt; -- regs->hi = (s64)(res >> 32); -+ regs->lo = (s64)(s32)rt; -+ regs->hi = (s64)(s32)(res >> 32); - - MIPS_R2_STATS(muls); - -@@ -671,9 +671,9 @@ static int maddu_func(struct pt_regs *regs, u32 ir) - res += ((((s64)rt) << 32) | (u32)rs); - - rt = res; -- regs->lo = (s64)rt; -+ regs->lo = (s64)(s32)rt; - rs = res >> 32; -- regs->hi = (s64)rs; -+ regs->hi = (s64)(s32)rs; - - MIPS_R2_STATS(dsps); - -@@ -729,9 +729,9 @@ static int msubu_func(struct pt_regs *regs, u32 ir) - res = ((((s64)rt) << 32) | (u32)rs) - res; - - rt = res; -- regs->lo = (s64)rt; -+ regs->lo = (s64)(s32)rt; - rs = res >> 32; -- regs->hi = (s64)rs; -+ regs->hi = (s64)(s32)rs; - - MIPS_R2_STATS(dsps); - -diff --git a/arch/powerpc/platforms/powernv/opal-wrappers.S b/arch/powerpc/platforms/powernv/opal-wrappers.S -index e45b88a5d7e0..ae877c7b3905 100644 ---- a/arch/powerpc/platforms/powernv/opal-wrappers.S -+++ b/arch/powerpc/platforms/powernv/opal-wrappers.S -@@ -148,7 +148,7 @@ opal_tracepoint_entry: - opal_tracepoint_return: - std r3,STK_REG(R31)(r1) - mr r4,r3 -- ld r0,STK_REG(R23)(r1) -+ ld r3,STK_REG(R23)(r1) - bl __trace_opal_exit - ld r3,STK_REG(R31)(r1) - addi r1,r1,STACKFRAMESIZE -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 8ca533b8c606..1e5d2f07416b 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -1875,6 +1875,7 @@ static struct irq_chip ioapic_chip __read_mostly = { - .irq_ack = irq_chip_ack_parent, - .irq_eoi = ioapic_ack_level, - .irq_set_affinity = ioapic_set_affinity, -+ .irq_retrigger = irq_chip_retrigger_hierarchy, - .flags = IRQCHIP_SKIP_SET_WAKE, - }; - -@@ -1886,6 +1887,7 @@ static struct irq_chip ioapic_ir_chip __read_mostly = { - .irq_ack = irq_chip_ack_parent, - .irq_eoi = ioapic_ir_ack_level, - .irq_set_affinity = ioapic_set_affinity, -+ .irq_retrigger = irq_chip_retrigger_hierarchy, - .flags = IRQCHIP_SKIP_SET_WAKE, - }; - -diff --git a/arch/x86/kernel/kprobes/common.h b/arch/x86/kernel/kprobes/common.h -index c6ee63f927ab..d688826e5736 100644 ---- a/arch/x86/kernel/kprobes/common.h -+++ b/arch/x86/kernel/kprobes/common.h -@@ -67,7 +67,7 @@ - #endif - - /* Ensure if the instruction can be boostable */ --extern int can_boost(kprobe_opcode_t *instruction); -+extern int can_boost(kprobe_opcode_t *instruction, void *addr); - /* Recover instruction if given address is probed */ - extern unsigned long recover_probed_instruction(kprobe_opcode_t *buf, - unsigned long addr); -diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c -index 023c442c33bb..99d293ea2b49 100644 ---- a/arch/x86/kernel/kprobes/core.c -+++ b/arch/x86/kernel/kprobes/core.c -@@ -163,12 +163,12 @@ NOKPROBE_SYMBOL(skip_prefixes); - * Returns non-zero if opcode is boostable. - * RIP relative instructions are adjusted at copying time in 64 bits mode - */ --int can_boost(kprobe_opcode_t *opcodes) -+int can_boost(kprobe_opcode_t *opcodes, void *addr) - { - kprobe_opcode_t opcode; - kprobe_opcode_t *orig_opcodes = opcodes; - -- if (search_exception_tables((unsigned long)opcodes)) -+ if (search_exception_tables((unsigned long)addr)) - return 0; /* Page fault may occur on this address. */ - - retry: -@@ -413,7 +413,7 @@ static int arch_copy_kprobe(struct kprobe *p) - * __copy_instruction can modify the displacement of the instruction, - * but it doesn't affect boostable check. - */ -- if (can_boost(p->ainsn.insn)) -+ if (can_boost(p->ainsn.insn, p->addr)) - p->ainsn.boostable = 0; - else - p->ainsn.boostable = -1; -diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c -index 7b3b9d15c47a..c9d488f3e4cd 100644 ---- a/arch/x86/kernel/kprobes/opt.c -+++ b/arch/x86/kernel/kprobes/opt.c -@@ -177,7 +177,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src) - - while (len < RELATIVEJUMP_SIZE) { - ret = __copy_instruction(dest + len, src + len); -- if (!ret || !can_boost(dest + len)) -+ if (!ret || !can_boost(dest + len, src + len)) - return -EINVAL; - len += ret; - } -diff --git a/arch/x86/kernel/pci-calgary_64.c b/arch/x86/kernel/pci-calgary_64.c -index 0497f719977d..c055e9a4e547 100644 ---- a/arch/x86/kernel/pci-calgary_64.c -+++ b/arch/x86/kernel/pci-calgary_64.c -@@ -296,7 +296,7 @@ static void iommu_free(struct iommu_table *tbl, dma_addr_t dma_addr, - - /* were we called with bad_dma_address? */ - badend = DMA_ERROR_CODE + (EMERGENCY_PAGES * PAGE_SIZE); -- if (unlikely((dma_addr >= DMA_ERROR_CODE) && (dma_addr < badend))) { -+ if (unlikely(dma_addr < badend)) { - WARN(1, KERN_ERR "Calgary: driver tried unmapping bad DMA " - "address 0x%Lx\n", dma_addr); - return; -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 2e1fd586b895..642e9c93a097 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -818,12 +818,6 @@ void kvm_cpuid(struct kvm_vcpu *vcpu, u32 *eax, u32 *ebx, u32 *ecx, u32 *edx) - if (!best) - best = check_cpuid_limit(vcpu, function, index); - -- /* -- * Perfmon not yet supported for L2 guest. -- */ -- if (is_guest_mode(vcpu) && function == 0xa) -- best = NULL; -- - if (best) { - *eax = best->eax; - *ebx = best->ebx; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 0a472e9865c5..50ca8f409a7c 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -7754,8 +7754,6 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) - case EXIT_REASON_TASK_SWITCH: - return true; - case EXIT_REASON_CPUID: -- if (kvm_register_read(vcpu, VCPU_REGS_RAX) == 0xa) -- return false; - return true; - case EXIT_REASON_HLT: - return nested_cpu_has(vmcs12, CPU_BASED_HLT_EXITING); -@@ -7840,6 +7838,9 @@ static bool nested_vmx_exit_handled(struct kvm_vcpu *vcpu) - return nested_cpu_has2(vmcs12, SECONDARY_EXEC_XSAVES); - case EXIT_REASON_PCOMMIT: - return nested_cpu_has2(vmcs12, SECONDARY_EXEC_PCOMMIT); -+ case EXIT_REASON_PML_FULL: -+ /* We don't expose PML support to L1. */ -+ return false; - default: - return true; - } -@@ -9759,6 +9760,18 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) - - } - -+ if (enable_pml) { -+ /* -+ * Conceptually we want to copy the PML address and index from -+ * vmcs01 here, and then back to vmcs01 on nested vmexit. But, -+ * since we always flush the log on each vmexit, this happens -+ * to be equivalent to simply resetting the fields in vmcs02. -+ */ -+ ASSERT(vmx->pml_pg); -+ vmcs_write64(PML_ADDRESS, page_to_phys(vmx->pml_pg)); -+ vmcs_write16(GUEST_PML_INDEX, PML_ENTITY_NUM - 1); -+ } -+ - if (nested_cpu_has_ept(vmcs12)) { - kvm_mmu_unload(vcpu); - nested_ept_init_mmu_context(vcpu); -diff --git a/arch/x86/platform/intel-mid/device_libs/platform_wdt.c b/arch/x86/platform/intel-mid/device_libs/platform_wdt.c -index de734134bc8d..40c616495da7 100644 ---- a/arch/x86/platform/intel-mid/device_libs/platform_wdt.c -+++ b/arch/x86/platform/intel-mid/device_libs/platform_wdt.c -@@ -17,7 +17,7 @@ - #include - #include - --#define TANGIER_EXT_TIMER0_MSI 15 -+#define TANGIER_EXT_TIMER0_MSI 12 - - static struct platform_device wdt_dev = { - .name = "intel_mid_wdt", -diff --git a/block/blk-integrity.c b/block/blk-integrity.c -index d69c5c79f98e..319f2e4f4a8b 100644 ---- a/block/blk-integrity.c -+++ b/block/blk-integrity.c -@@ -417,7 +417,7 @@ void blk_integrity_register(struct gendisk *disk, struct blk_integrity *template - bi->tuple_size = template->tuple_size; - bi->tag_size = template->tag_size; - -- blk_integrity_revalidate(disk); -+ disk->queue->backing_dev_info.capabilities |= BDI_CAP_STABLE_WRITES; - } - EXPORT_SYMBOL(blk_integrity_register); - -@@ -430,26 +430,11 @@ EXPORT_SYMBOL(blk_integrity_register); - */ - void blk_integrity_unregister(struct gendisk *disk) - { -- blk_integrity_revalidate(disk); -+ disk->queue->backing_dev_info.capabilities &= ~BDI_CAP_STABLE_WRITES; - memset(&disk->queue->integrity, 0, sizeof(struct blk_integrity)); - } - EXPORT_SYMBOL(blk_integrity_unregister); - --void blk_integrity_revalidate(struct gendisk *disk) --{ -- struct blk_integrity *bi = &disk->queue->integrity; -- -- if (!(disk->flags & GENHD_FL_UP)) -- return; -- -- if (bi->profile) -- disk->queue->backing_dev_info.capabilities |= -- BDI_CAP_STABLE_WRITES; -- else -- disk->queue->backing_dev_info.capabilities &= -- ~BDI_CAP_STABLE_WRITES; --} -- - void blk_integrity_add(struct gendisk *disk) - { - if (kobject_init_and_add(&disk->integrity_kobj, &integrity_ktype, -diff --git a/block/partition-generic.c b/block/partition-generic.c -index a241e3900bc9..3c062699f28b 100644 ---- a/block/partition-generic.c -+++ b/block/partition-generic.c -@@ -435,7 +435,6 @@ rescan: - - if (disk->fops->revalidate_disk) - disk->fops->revalidate_disk(disk); -- blk_integrity_revalidate(disk); - check_disk_size_change(disk, bdev); - bdev->bd_invalidated = 0; - if (!get_capacity(disk) || !(state = check_partition(disk, bdev))) -diff --git a/drivers/clk/Makefile b/drivers/clk/Makefile -index 820714c72d36..af9e9aff49e5 100644 ---- a/drivers/clk/Makefile -+++ b/drivers/clk/Makefile -@@ -78,7 +78,9 @@ obj-$(CONFIG_ARCH_TEGRA) += tegra/ - obj-$(CONFIG_ARCH_OMAP2PLUS) += ti/ - obj-$(CONFIG_ARCH_U8500) += ux500/ - obj-$(CONFIG_COMMON_CLK_VERSATILE) += versatile/ -+ifeq ($(CONFIG_COMMON_CLK), y) - obj-$(CONFIG_X86) += x86/ -+endif - obj-$(CONFIG_ARCH_ZX) += zte/ - obj-$(CONFIG_ARCH_ZYNQ) += zynq/ - obj-$(CONFIG_H8300) += h8300/ -diff --git a/drivers/gpu/drm/ttm/ttm_bo_vm.c b/drivers/gpu/drm/ttm/ttm_bo_vm.c -index 8fb7213277cc..b75391495778 100644 ---- a/drivers/gpu/drm/ttm/ttm_bo_vm.c -+++ b/drivers/gpu/drm/ttm/ttm_bo_vm.c -@@ -66,8 +66,11 @@ static int ttm_bo_vm_fault_idle(struct ttm_buffer_object *bo, - if (vmf->flags & FAULT_FLAG_RETRY_NOWAIT) - goto out_unlock; - -+ ttm_bo_reference(bo); - up_read(&vma->vm_mm->mmap_sem); - (void) ttm_bo_wait(bo, false, true, false); -+ ttm_bo_unreserve(bo); -+ ttm_bo_unref(&bo); - goto out_unlock; - } - -@@ -114,8 +117,10 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - - if (vmf->flags & FAULT_FLAG_ALLOW_RETRY) { - if (!(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { -+ ttm_bo_reference(bo); - up_read(&vma->vm_mm->mmap_sem); - (void) ttm_bo_wait_unreserved(bo); -+ ttm_bo_unref(&bo); - } - - return VM_FAULT_RETRY; -@@ -160,6 +165,13 @@ static int ttm_bo_vm_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - ret = ttm_bo_vm_fault_idle(bo, vma, vmf); - if (unlikely(ret != 0)) { - retval = ret; -+ -+ if (retval == VM_FAULT_RETRY && -+ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { -+ /* The BO has already been unreserved. */ -+ return retval; -+ } -+ - goto out_unlock; - } - -diff --git a/drivers/leds/leds-ktd2692.c b/drivers/leds/leds-ktd2692.c -index feca07be85f5..1eb9fb33db38 100644 ---- a/drivers/leds/leds-ktd2692.c -+++ b/drivers/leds/leds-ktd2692.c -@@ -296,15 +296,15 @@ static int ktd2692_parse_dt(struct ktd2692_context *led, struct device *dev, - return -ENXIO; - - led->ctrl_gpio = devm_gpiod_get(dev, "ctrl", GPIOD_ASIS); -- if (IS_ERR(led->ctrl_gpio)) { -- ret = PTR_ERR(led->ctrl_gpio); -+ ret = PTR_ERR_OR_ZERO(led->ctrl_gpio); -+ if (ret) { - dev_err(dev, "cannot get ctrl-gpios %d\n", ret); - return ret; - } - - led->aux_gpio = devm_gpiod_get(dev, "aux", GPIOD_ASIS); -- if (IS_ERR(led->aux_gpio)) { -- ret = PTR_ERR(led->aux_gpio); -+ ret = PTR_ERR_OR_ZERO(led->aux_gpio); -+ if (ret) { - dev_err(dev, "cannot get aux-gpios %d\n", ret); - return ret; - } -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 07f5f239cb65..4744919440e0 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -2473,7 +2473,8 @@ static int bnxt_alloc_ntp_fltrs(struct bnxt *bp) - INIT_HLIST_HEAD(&bp->ntp_fltr_hash_tbl[i]); - - bp->ntp_fltr_count = 0; -- bp->ntp_fltr_bmap = kzalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR), -+ bp->ntp_fltr_bmap = kcalloc(BITS_TO_LONGS(BNXT_NTP_FLTR_MAX_FLTR), -+ sizeof(long), - GFP_KERNEL); - - if (!bp->ntp_fltr_bmap) -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/core.c b/drivers/net/wireless/brcm80211/brcmfmac/core.c -index b5ab98ee1445..82753e7c7e7c 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/core.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/core.c -@@ -211,7 +211,7 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, - int ret; - struct brcmf_if *ifp = netdev_priv(ndev); - struct brcmf_pub *drvr = ifp->drvr; -- struct ethhdr *eh = (struct ethhdr *)(skb->data); -+ struct ethhdr *eh; - - brcmf_dbg(DATA, "Enter, idx=%d\n", ifp->bssidx); - -@@ -232,22 +232,13 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, - goto done; - } - -- /* Make sure there's enough room for any header */ -- if (skb_headroom(skb) < drvr->hdrlen) { -- struct sk_buff *skb2; -- -- brcmf_dbg(INFO, "%s: insufficient headroom\n", -+ /* Make sure there's enough writable headroom*/ -+ ret = skb_cow_head(skb, drvr->hdrlen); -+ if (ret < 0) { -+ brcmf_err("%s: skb_cow_head failed\n", - brcmf_ifname(drvr, ifp->bssidx)); -- drvr->bus_if->tx_realloc++; -- skb2 = skb_realloc_headroom(skb, drvr->hdrlen); - dev_kfree_skb(skb); -- skb = skb2; -- if (skb == NULL) { -- brcmf_err("%s: skb_realloc_headroom failed\n", -- brcmf_ifname(drvr, ifp->bssidx)); -- ret = -ENOMEM; -- goto done; -- } -+ goto done; - } - - /* validate length for ether packet */ -@@ -257,6 +248,8 @@ static netdev_tx_t brcmf_netdev_start_xmit(struct sk_buff *skb, - goto done; - } - -+ eh = (struct ethhdr *)(skb->data); -+ - if (eh->h_proto == htons(ETH_P_PAE)) - atomic_inc(&ifp->pend_8021x_cnt); - -diff --git a/drivers/net/wireless/mwifiex/11n_aggr.c b/drivers/net/wireless/mwifiex/11n_aggr.c -index aa498e0d2204..49f3e17c28ea 100644 ---- a/drivers/net/wireless/mwifiex/11n_aggr.c -+++ b/drivers/net/wireless/mwifiex/11n_aggr.c -@@ -101,13 +101,6 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv, - { - struct txpd *local_tx_pd; - struct mwifiex_txinfo *tx_info = MWIFIEX_SKB_TXCB(skb); -- unsigned int pad; -- int headroom = (priv->adapter->iface_type == -- MWIFIEX_USB) ? 0 : INTF_HEADER_LEN; -- -- pad = ((void *)skb->data - sizeof(*local_tx_pd) - -- headroom - NULL) & (MWIFIEX_DMA_ALIGN_SZ - 1); -- skb_push(skb, pad); - - skb_push(skb, sizeof(*local_tx_pd)); - -@@ -121,12 +114,10 @@ mwifiex_11n_form_amsdu_txpd(struct mwifiex_private *priv, - local_tx_pd->bss_num = priv->bss_num; - local_tx_pd->bss_type = priv->bss_type; - /* Always zero as the data is followed by struct txpd */ -- local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd) + -- pad); -+ local_tx_pd->tx_pkt_offset = cpu_to_le16(sizeof(struct txpd)); - local_tx_pd->tx_pkt_type = cpu_to_le16(PKT_TYPE_AMSDU); - local_tx_pd->tx_pkt_length = cpu_to_le16(skb->len - -- sizeof(*local_tx_pd) - -- pad); -+ sizeof(*local_tx_pd)); - - if (tx_info->flags & MWIFIEX_BUF_FLAG_TDLS_PKT) - local_tx_pd->flags |= MWIFIEX_TXPD_FLAGS_TDLS_PACKET; -@@ -190,7 +181,11 @@ mwifiex_11n_aggregate_pkt(struct mwifiex_private *priv, - ra_list_flags); - return -1; - } -- skb_reserve(skb_aggr, MWIFIEX_MIN_DATA_HEADER_LEN); -+ -+ /* skb_aggr->data already 64 byte align, just reserve bus interface -+ * header and txpd. -+ */ -+ skb_reserve(skb_aggr, headroom + sizeof(struct txpd)); - tx_info_aggr = MWIFIEX_SKB_TXCB(skb_aggr); - - memset(tx_info_aggr, 0, sizeof(*tx_info_aggr)); -diff --git a/drivers/net/wireless/mwifiex/debugfs.c b/drivers/net/wireless/mwifiex/debugfs.c -index 9824d8dd2b44..45d97b64ef84 100644 ---- a/drivers/net/wireless/mwifiex/debugfs.c -+++ b/drivers/net/wireless/mwifiex/debugfs.c -@@ -115,7 +115,8 @@ mwifiex_info_read(struct file *file, char __user *ubuf, - if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_STA) { - p += sprintf(p, "multicast_count=\"%d\"\n", - netdev_mc_count(netdev)); -- p += sprintf(p, "essid=\"%s\"\n", info.ssid.ssid); -+ p += sprintf(p, "essid=\"%.*s\"\n", info.ssid.ssid_len, -+ info.ssid.ssid); - p += sprintf(p, "bssid=\"%pM\"\n", info.bssid); - p += sprintf(p, "channel=\"%d\"\n", (int) info.bss_chan); - p += sprintf(p, "country_code = \"%s\"\n", info.country_code); -diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c -index d6c4f0f60839..6cfa2969b123 100644 ---- a/drivers/net/wireless/mwifiex/sta_ioctl.c -+++ b/drivers/net/wireless/mwifiex/sta_ioctl.c -@@ -1098,8 +1098,6 @@ int mwifiex_set_encode(struct mwifiex_private *priv, struct key_params *kp, - encrypt_key.is_rx_seq_valid = true; - } - } else { -- if (GET_BSS_ROLE(priv) == MWIFIEX_BSS_ROLE_UAP) -- return 0; - encrypt_key.key_disable = true; - if (mac_addr) - memcpy(encrypt_key.mac_addr, mac_addr, ETH_ALEN); -diff --git a/drivers/phy/Kconfig b/drivers/phy/Kconfig -index 03cb3ea2d2c0..b5679fb67591 100644 ---- a/drivers/phy/Kconfig -+++ b/drivers/phy/Kconfig -@@ -368,6 +368,7 @@ config PHY_QCOM_UFS - config PHY_TUSB1210 - tristate "TI TUSB1210 ULPI PHY module" - depends on USB_ULPI_BUS -+ depends on EXTCON || !EXTCON # if EXTCON=m, this cannot be built-in - select GENERIC_PHY - help - Support for TI TUSB1210 USB ULPI PHY. -diff --git a/drivers/power/bq24190_charger.c b/drivers/power/bq24190_charger.c -index f5746b9f4e83..f05d2773fe00 100644 ---- a/drivers/power/bq24190_charger.c -+++ b/drivers/power/bq24190_charger.c -@@ -144,10 +144,7 @@ - * so the first read after a fault returns the latched value and subsequent - * reads return the current value. In order to return the fault status - * to the user, have the interrupt handler save the reg's value and retrieve -- * it in the appropriate health/status routine. Each routine has its own -- * flag indicating whether it should use the value stored by the last run -- * of the interrupt handler or do an actual reg read. That way each routine -- * can report back whatever fault may have occured. -+ * it in the appropriate health/status routine. - */ - struct bq24190_dev_info { - struct i2c_client *client; -@@ -159,10 +156,6 @@ struct bq24190_dev_info { - unsigned int gpio_int; - unsigned int irq; - struct mutex f_reg_lock; -- bool first_time; -- bool charger_health_valid; -- bool battery_health_valid; -- bool battery_status_valid; - u8 f_reg; - u8 ss_reg; - u8 watchdog; -@@ -636,21 +629,11 @@ static int bq24190_charger_get_health(struct bq24190_dev_info *bdi, - union power_supply_propval *val) - { - u8 v; -- int health, ret; -+ int health; - - mutex_lock(&bdi->f_reg_lock); -- -- if (bdi->charger_health_valid) { -- v = bdi->f_reg; -- bdi->charger_health_valid = false; -- mutex_unlock(&bdi->f_reg_lock); -- } else { -- mutex_unlock(&bdi->f_reg_lock); -- -- ret = bq24190_read(bdi, BQ24190_REG_F, &v); -- if (ret < 0) -- return ret; -- } -+ v = bdi->f_reg; -+ mutex_unlock(&bdi->f_reg_lock); - - if (v & BQ24190_REG_F_BOOST_FAULT_MASK) { - /* -@@ -937,18 +920,8 @@ static int bq24190_battery_get_status(struct bq24190_dev_info *bdi, - int status, ret; - - mutex_lock(&bdi->f_reg_lock); -- -- if (bdi->battery_status_valid) { -- chrg_fault = bdi->f_reg; -- bdi->battery_status_valid = false; -- mutex_unlock(&bdi->f_reg_lock); -- } else { -- mutex_unlock(&bdi->f_reg_lock); -- -- ret = bq24190_read(bdi, BQ24190_REG_F, &chrg_fault); -- if (ret < 0) -- return ret; -- } -+ chrg_fault = bdi->f_reg; -+ mutex_unlock(&bdi->f_reg_lock); - - chrg_fault &= BQ24190_REG_F_CHRG_FAULT_MASK; - chrg_fault >>= BQ24190_REG_F_CHRG_FAULT_SHIFT; -@@ -996,21 +969,11 @@ static int bq24190_battery_get_health(struct bq24190_dev_info *bdi, - union power_supply_propval *val) - { - u8 v; -- int health, ret; -+ int health; - - mutex_lock(&bdi->f_reg_lock); -- -- if (bdi->battery_health_valid) { -- v = bdi->f_reg; -- bdi->battery_health_valid = false; -- mutex_unlock(&bdi->f_reg_lock); -- } else { -- mutex_unlock(&bdi->f_reg_lock); -- -- ret = bq24190_read(bdi, BQ24190_REG_F, &v); -- if (ret < 0) -- return ret; -- } -+ v = bdi->f_reg; -+ mutex_unlock(&bdi->f_reg_lock); - - if (v & BQ24190_REG_F_BAT_FAULT_MASK) { - health = POWER_SUPPLY_HEALTH_OVERVOLTAGE; -@@ -1197,9 +1160,12 @@ static const struct power_supply_desc bq24190_battery_desc = { - static irqreturn_t bq24190_irq_handler_thread(int irq, void *data) - { - struct bq24190_dev_info *bdi = data; -- bool alert_userspace = false; -+ const u8 battery_mask_ss = BQ24190_REG_SS_CHRG_STAT_MASK; -+ const u8 battery_mask_f = BQ24190_REG_F_BAT_FAULT_MASK -+ | BQ24190_REG_F_NTC_FAULT_MASK; -+ bool alert_charger = false, alert_battery = false; - u8 ss_reg = 0, f_reg = 0; -- int ret; -+ int i, ret; - - pm_runtime_get_sync(bdi->dev); - -@@ -1209,6 +1175,32 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data) - goto out; - } - -+ i = 0; -+ do { -+ ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg); -+ if (ret < 0) { -+ dev_err(bdi->dev, "Can't read F reg: %d\n", ret); -+ goto out; -+ } -+ } while (f_reg && ++i < 2); -+ -+ if (f_reg != bdi->f_reg) { -+ dev_info(bdi->dev, -+ "Fault: boost %d, charge %d, battery %d, ntc %d\n", -+ !!(f_reg & BQ24190_REG_F_BOOST_FAULT_MASK), -+ !!(f_reg & BQ24190_REG_F_CHRG_FAULT_MASK), -+ !!(f_reg & BQ24190_REG_F_BAT_FAULT_MASK), -+ !!(f_reg & BQ24190_REG_F_NTC_FAULT_MASK)); -+ -+ mutex_lock(&bdi->f_reg_lock); -+ if ((bdi->f_reg & battery_mask_f) != (f_reg & battery_mask_f)) -+ alert_battery = true; -+ if ((bdi->f_reg & ~battery_mask_f) != (f_reg & ~battery_mask_f)) -+ alert_charger = true; -+ bdi->f_reg = f_reg; -+ mutex_unlock(&bdi->f_reg_lock); -+ } -+ - if (ss_reg != bdi->ss_reg) { - /* - * The device is in host mode so when PG_STAT goes from 1->0 -@@ -1225,47 +1217,17 @@ static irqreturn_t bq24190_irq_handler_thread(int irq, void *data) - ret); - } - -+ if ((bdi->ss_reg & battery_mask_ss) != (ss_reg & battery_mask_ss)) -+ alert_battery = true; -+ if ((bdi->ss_reg & ~battery_mask_ss) != (ss_reg & ~battery_mask_ss)) -+ alert_charger = true; - bdi->ss_reg = ss_reg; -- alert_userspace = true; -- } -- -- mutex_lock(&bdi->f_reg_lock); -- -- ret = bq24190_read(bdi, BQ24190_REG_F, &f_reg); -- if (ret < 0) { -- mutex_unlock(&bdi->f_reg_lock); -- dev_err(bdi->dev, "Can't read F reg: %d\n", ret); -- goto out; - } - -- if (f_reg != bdi->f_reg) { -- bdi->f_reg = f_reg; -- bdi->charger_health_valid = true; -- bdi->battery_health_valid = true; -- bdi->battery_status_valid = true; -- -- alert_userspace = true; -- } -- -- mutex_unlock(&bdi->f_reg_lock); -- -- /* -- * Sometimes bq24190 gives a steady trickle of interrupts even -- * though the watchdog timer is turned off and neither the STATUS -- * nor FAULT registers have changed. Weed out these sprurious -- * interrupts so userspace isn't alerted for no reason. -- * In addition, the chip always generates an interrupt after -- * register reset so we should ignore that one (the very first -- * interrupt received). -- */ -- if (alert_userspace) { -- if (!bdi->first_time) { -- power_supply_changed(bdi->charger); -- power_supply_changed(bdi->battery); -- } else { -- bdi->first_time = false; -- } -- } -+ if (alert_charger) -+ power_supply_changed(bdi->charger); -+ if (alert_battery) -+ power_supply_changed(bdi->battery); - - out: - pm_runtime_put_sync(bdi->dev); -@@ -1300,6 +1262,10 @@ static int bq24190_hw_init(struct bq24190_dev_info *bdi) - goto out; - - ret = bq24190_set_mode_host(bdi); -+ if (ret < 0) -+ goto out; -+ -+ ret = bq24190_read(bdi, BQ24190_REG_SS, &bdi->ss_reg); - out: - pm_runtime_put_sync(bdi->dev); - return ret; -@@ -1375,10 +1341,8 @@ static int bq24190_probe(struct i2c_client *client, - bdi->model = id->driver_data; - strncpy(bdi->model_name, id->name, I2C_NAME_SIZE); - mutex_init(&bdi->f_reg_lock); -- bdi->first_time = true; -- bdi->charger_health_valid = false; -- bdi->battery_health_valid = false; -- bdi->battery_status_valid = false; -+ bdi->f_reg = 0; -+ bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */ - - i2c_set_clientdata(client, bdi); - -@@ -1392,22 +1356,13 @@ static int bq24190_probe(struct i2c_client *client, - return -EINVAL; - } - -- ret = devm_request_threaded_irq(dev, bdi->irq, NULL, -- bq24190_irq_handler_thread, -- IRQF_TRIGGER_RISING | IRQF_ONESHOT, -- "bq24190-charger", bdi); -- if (ret < 0) { -- dev_err(dev, "Can't set up irq handler\n"); -- goto out1; -- } -- - pm_runtime_enable(dev); - pm_runtime_resume(dev); - - ret = bq24190_hw_init(bdi); - if (ret < 0) { - dev_err(dev, "Hardware init failed\n"); -- goto out2; -+ goto out1; - } - - charger_cfg.drv_data = bdi; -@@ -1418,7 +1373,7 @@ static int bq24190_probe(struct i2c_client *client, - if (IS_ERR(bdi->charger)) { - dev_err(dev, "Can't register charger\n"); - ret = PTR_ERR(bdi->charger); -- goto out2; -+ goto out1; - } - - battery_cfg.drv_data = bdi; -@@ -1427,24 +1382,34 @@ static int bq24190_probe(struct i2c_client *client, - if (IS_ERR(bdi->battery)) { - dev_err(dev, "Can't register battery\n"); - ret = PTR_ERR(bdi->battery); -- goto out3; -+ goto out2; - } - - ret = bq24190_sysfs_create_group(bdi); - if (ret) { - dev_err(dev, "Can't create sysfs entries\n"); -+ goto out3; -+ } -+ -+ ret = devm_request_threaded_irq(dev, bdi->irq, NULL, -+ bq24190_irq_handler_thread, -+ IRQF_TRIGGER_FALLING | IRQF_ONESHOT, -+ "bq24190-charger", bdi); -+ if (ret < 0) { -+ dev_err(dev, "Can't set up irq handler\n"); - goto out4; - } - - return 0; - - out4: -- power_supply_unregister(bdi->battery); -+ bq24190_sysfs_remove_group(bdi); - out3: -- power_supply_unregister(bdi->charger); -+ power_supply_unregister(bdi->battery); - out2: -- pm_runtime_disable(dev); -+ power_supply_unregister(bdi->charger); - out1: -+ pm_runtime_disable(dev); - if (bdi->gpio_int) - gpio_free(bdi->gpio_int); - -@@ -1488,12 +1453,13 @@ static int bq24190_pm_resume(struct device *dev) - struct i2c_client *client = to_i2c_client(dev); - struct bq24190_dev_info *bdi = i2c_get_clientdata(client); - -- bdi->charger_health_valid = false; -- bdi->battery_health_valid = false; -- bdi->battery_status_valid = false; -+ bdi->f_reg = 0; -+ bdi->ss_reg = BQ24190_REG_SS_VBUS_STAT_MASK; /* impossible state */ - - pm_runtime_get_sync(bdi->dev); - bq24190_register_reset(bdi); -+ bq24190_set_mode_host(bdi); -+ bq24190_read(bdi, BQ24190_REG_SS, &bdi->ss_reg); - pm_runtime_put_sync(bdi->dev); - - /* Things may have changed while suspended so alert upper layer */ -diff --git a/drivers/scsi/Kconfig b/drivers/scsi/Kconfig -index 64eed87d34a8..433c5e3d5733 100644 ---- a/drivers/scsi/Kconfig -+++ b/drivers/scsi/Kconfig -@@ -1637,7 +1637,7 @@ config ATARI_SCSI_RESET_BOOT - - config MAC_SCSI - tristate "Macintosh NCR5380 SCSI" -- depends on MAC && SCSI=y -+ depends on MAC && SCSI - select SCSI_SPI_ATTRS - help - This is the NCR 5380 SCSI controller included on most of the 68030 -diff --git a/drivers/staging/emxx_udc/emxx_udc.c b/drivers/staging/emxx_udc/emxx_udc.c -index 4e6c16af40fc..91ff8fb0cc3a 100644 ---- a/drivers/staging/emxx_udc/emxx_udc.c -+++ b/drivers/staging/emxx_udc/emxx_udc.c -@@ -3181,7 +3181,7 @@ static const struct { - }; - - /*-------------------------------------------------------------------------*/ --static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc) -+static void nbu2ss_drv_ep_init(struct nbu2ss_udc *udc) - { - int i; - -@@ -3211,7 +3211,7 @@ static void __init nbu2ss_drv_ep_init(struct nbu2ss_udc *udc) - - /*-------------------------------------------------------------------------*/ - /* platform_driver */ --static int __init nbu2ss_drv_contest_init( -+static int nbu2ss_drv_contest_init( - struct platform_device *pdev, - struct nbu2ss_udc *udc) - { -diff --git a/drivers/staging/wlan-ng/p80211netdev.c b/drivers/staging/wlan-ng/p80211netdev.c -index a9c1e0bafa62..e35fbece3d2f 100644 ---- a/drivers/staging/wlan-ng/p80211netdev.c -+++ b/drivers/staging/wlan-ng/p80211netdev.c -@@ -232,7 +232,7 @@ static int p80211_convert_to_ether(wlandevice_t *wlandev, struct sk_buff *skb) - struct p80211_hdr_a3 *hdr; - - hdr = (struct p80211_hdr_a3 *) skb->data; -- if (p80211_rx_typedrop(wlandev, hdr->fc)) -+ if (p80211_rx_typedrop(wlandev, le16_to_cpu(hdr->fc))) - return CONV_TO_ETHER_SKIPPED; - - /* perform mcast filtering: allow my local address through but reject -diff --git a/drivers/tty/serial/8250/8250_omap.c b/drivers/tty/serial/8250/8250_omap.c -index a2c0734c76e2..e8dd296fb25b 100644 ---- a/drivers/tty/serial/8250/8250_omap.c -+++ b/drivers/tty/serial/8250/8250_omap.c -@@ -1235,7 +1235,8 @@ static int omap8250_probe(struct platform_device *pdev) - pm_runtime_put_autosuspend(&pdev->dev); - return 0; - err: -- pm_runtime_put(&pdev->dev); -+ pm_runtime_dont_use_autosuspend(&pdev->dev); -+ pm_runtime_put_sync(&pdev->dev); - pm_runtime_disable(&pdev->dev); - return ret; - } -@@ -1244,6 +1245,7 @@ static int omap8250_remove(struct platform_device *pdev) - { - struct omap8250_priv *priv = platform_get_drvdata(pdev); - -+ pm_runtime_dont_use_autosuspend(&pdev->dev); - pm_runtime_put_sync(&pdev->dev); - pm_runtime_disable(&pdev->dev); - serial8250_unregister_port(priv->line); -@@ -1343,6 +1345,10 @@ static int omap8250_runtime_suspend(struct device *dev) - struct omap8250_priv *priv = dev_get_drvdata(dev); - struct uart_8250_port *up; - -+ /* In case runtime-pm tries this before we are setup */ -+ if (!priv) -+ return 0; -+ - up = serial8250_get_port(priv->line); - /* - * When using 'no_console_suspend', the console UART must not be -diff --git a/drivers/usb/chipidea/ci.h b/drivers/usb/chipidea/ci.h -index 41d7cf6d63ba..858c30814497 100644 ---- a/drivers/usb/chipidea/ci.h -+++ b/drivers/usb/chipidea/ci.h -@@ -428,9 +428,6 @@ int hw_port_test_set(struct ci_hdrc *ci, u8 mode); - - u8 hw_port_test_get(struct ci_hdrc *ci); - --int hw_wait_reg(struct ci_hdrc *ci, enum ci_hw_regs reg, u32 mask, -- u32 value, unsigned int timeout_ms); -- - void ci_platform_configure(struct ci_hdrc *ci); - - #endif /* __DRIVERS_USB_CHIPIDEA_CI_H */ -diff --git a/drivers/usb/chipidea/core.c b/drivers/usb/chipidea/core.c -index ba4a2a1eb3ff..939c6ad71068 100644 ---- a/drivers/usb/chipidea/core.c -+++ b/drivers/usb/chipidea/core.c -@@ -518,38 +518,6 @@ int hw_device_reset(struct ci_hdrc *ci) - return 0; - } - --/** -- * hw_wait_reg: wait the register value -- * -- * Sometimes, it needs to wait register value before going on. -- * Eg, when switch to device mode, the vbus value should be lower -- * than OTGSC_BSV before connects to host. -- * -- * @ci: the controller -- * @reg: register index -- * @mask: mast bit -- * @value: the bit value to wait -- * @timeout_ms: timeout in millisecond -- * -- * This function returns an error code if timeout -- */ --int hw_wait_reg(struct ci_hdrc *ci, enum ci_hw_regs reg, u32 mask, -- u32 value, unsigned int timeout_ms) --{ -- unsigned long elapse = jiffies + msecs_to_jiffies(timeout_ms); -- -- while (hw_read(ci, reg, mask) != value) { -- if (time_after(jiffies, elapse)) { -- dev_err(ci->dev, "timeout waiting for %08x in %d\n", -- mask, reg); -- return -ETIMEDOUT; -- } -- msleep(20); -- } -- -- return 0; --} -- - static irqreturn_t ci_irq(int irq, void *data) - { - struct ci_hdrc *ci = data; -diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c -index 03b6743461d1..0cf149edddd8 100644 ---- a/drivers/usb/chipidea/otg.c -+++ b/drivers/usb/chipidea/otg.c -@@ -44,12 +44,15 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u32 mask) - else - val &= ~OTGSC_BSVIS; - -- cable->changed = false; -- - if (cable->state) - val |= OTGSC_BSV; - else - val &= ~OTGSC_BSV; -+ -+ if (cable->enabled) -+ val |= OTGSC_BSVIE; -+ else -+ val &= ~OTGSC_BSVIE; - } - - cable = &ci->platdata->id_extcon; -@@ -59,15 +62,18 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u32 mask) - else - val &= ~OTGSC_IDIS; - -- cable->changed = false; -- - if (cable->state) - val |= OTGSC_ID; - else - val &= ~OTGSC_ID; -+ -+ if (cable->enabled) -+ val |= OTGSC_IDIE; -+ else -+ val &= ~OTGSC_IDIE; - } - -- return val; -+ return val & mask; - } - - /** -@@ -77,6 +83,36 @@ u32 hw_read_otgsc(struct ci_hdrc *ci, u32 mask) - */ - void hw_write_otgsc(struct ci_hdrc *ci, u32 mask, u32 data) - { -+ struct ci_hdrc_cable *cable; -+ -+ cable = &ci->platdata->vbus_extcon; -+ if (!IS_ERR(cable->edev)) { -+ if (data & mask & OTGSC_BSVIS) -+ cable->changed = false; -+ -+ /* Don't enable vbus interrupt if using external notifier */ -+ if (data & mask & OTGSC_BSVIE) { -+ cable->enabled = true; -+ data &= ~OTGSC_BSVIE; -+ } else if (mask & OTGSC_BSVIE) { -+ cable->enabled = false; -+ } -+ } -+ -+ cable = &ci->platdata->id_extcon; -+ if (!IS_ERR(cable->edev)) { -+ if (data & mask & OTGSC_IDIS) -+ cable->changed = false; -+ -+ /* Don't enable id interrupt if using external notifier */ -+ if (data & mask & OTGSC_IDIE) { -+ cable->enabled = true; -+ data &= ~OTGSC_IDIE; -+ } else if (mask & OTGSC_IDIE) { -+ cable->enabled = false; -+ } -+ } -+ - hw_write(ci, OP_OTGSC, mask | OTGSC_INT_STATUS_BITS, data); - } - -@@ -104,7 +140,31 @@ void ci_handle_vbus_change(struct ci_hdrc *ci) - usb_gadget_vbus_disconnect(&ci->gadget); - } - --#define CI_VBUS_STABLE_TIMEOUT_MS 5000 -+/** -+ * When we switch to device mode, the vbus value should be lower -+ * than OTGSC_BSV before connecting to host. -+ * -+ * @ci: the controller -+ * -+ * This function returns an error code if timeout -+ */ -+static int hw_wait_vbus_lower_bsv(struct ci_hdrc *ci) -+{ -+ unsigned long elapse = jiffies + msecs_to_jiffies(5000); -+ u32 mask = OTGSC_BSV; -+ -+ while (hw_read_otgsc(ci, mask)) { -+ if (time_after(jiffies, elapse)) { -+ dev_err(ci->dev, "timeout waiting for %08x in OTGSC\n", -+ mask); -+ return -ETIMEDOUT; -+ } -+ msleep(20); -+ } -+ -+ return 0; -+} -+ - static void ci_handle_id_switch(struct ci_hdrc *ci) - { - enum ci_role role = ci_otg_role(ci); -@@ -116,9 +176,11 @@ static void ci_handle_id_switch(struct ci_hdrc *ci) - ci_role_stop(ci); - - if (role == CI_ROLE_GADGET) -- /* wait vbus lower than OTGSC_BSV */ -- hw_wait_reg(ci, OP_OTGSC, OTGSC_BSV, 0, -- CI_VBUS_STABLE_TIMEOUT_MS); -+ /* -+ * wait vbus lower than OTGSC_BSV before connecting -+ * to host -+ */ -+ hw_wait_vbus_lower_bsv(ci); - - ci_role_start(ci, role); - } -diff --git a/drivers/usb/host/ehci-exynos.c b/drivers/usb/host/ehci-exynos.c -index df538fd10aa4..46f5354c534d 100644 ---- a/drivers/usb/host/ehci-exynos.c -+++ b/drivers/usb/host/ehci-exynos.c -@@ -77,10 +77,12 @@ static int exynos_ehci_get_phy(struct device *dev, - if (IS_ERR(phy)) { - ret = PTR_ERR(phy); - if (ret == -EPROBE_DEFER) { -+ of_node_put(child); - return ret; - } else if (ret != -ENOSYS && ret != -ENODEV) { - dev_err(dev, - "Error retrieving usb2 phy: %d\n", ret); -+ of_node_put(child); - return ret; - } - } -diff --git a/drivers/usb/host/ohci-exynos.c b/drivers/usb/host/ohci-exynos.c -index 2cd105be7319..6865b919403f 100644 ---- a/drivers/usb/host/ohci-exynos.c -+++ b/drivers/usb/host/ohci-exynos.c -@@ -66,10 +66,12 @@ static int exynos_ohci_get_phy(struct device *dev, - if (IS_ERR(phy)) { - ret = PTR_ERR(phy); - if (ret == -EPROBE_DEFER) { -+ of_node_put(child); - return ret; - } else if (ret != -ENOSYS && ret != -ENODEV) { - dev_err(dev, - "Error retrieving usb2 phy: %d\n", ret); -+ of_node_put(child); - return ret; - } - } -diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c -index 7812052dc700..754fc3e41005 100644 ---- a/drivers/usb/serial/ark3116.c -+++ b/drivers/usb/serial/ark3116.c -@@ -373,23 +373,29 @@ static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port) - dev_dbg(&port->dev, - "%s - usb_serial_generic_open failed: %d\n", - __func__, result); -- goto err_out; -+ goto err_free; - } - - /* remove any data still left: also clears error state */ - ark3116_read_reg(serial, UART_RX, buf); - - /* read modem status */ -- priv->msr = ark3116_read_reg(serial, UART_MSR, buf); -+ result = ark3116_read_reg(serial, UART_MSR, buf); -+ if (result < 0) -+ goto err_close; -+ priv->msr = *buf; -+ - /* read line status */ -- priv->lsr = ark3116_read_reg(serial, UART_LSR, buf); -+ result = ark3116_read_reg(serial, UART_LSR, buf); -+ if (result < 0) -+ goto err_close; -+ priv->lsr = *buf; - - result = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL); - if (result) { - dev_err(&port->dev, "submit irq_in urb failed %d\n", - result); -- ark3116_close(port); -- goto err_out; -+ goto err_close; - } - - /* activate interrupts */ -@@ -402,8 +408,15 @@ static int ark3116_open(struct tty_struct *tty, struct usb_serial_port *port) - if (tty) - ark3116_set_termios(tty, port, NULL); - --err_out: - kfree(buf); -+ -+ return 0; -+ -+err_close: -+ usb_serial_generic_close(port); -+err_free: -+ kfree(buf); -+ - return result; - } - -diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c -index e0b1fe2f60e1..be93b9ff2d98 100644 ---- a/drivers/usb/serial/digi_acceleport.c -+++ b/drivers/usb/serial/digi_acceleport.c -@@ -1399,25 +1399,30 @@ static int digi_read_inb_callback(struct urb *urb) - { - struct usb_serial_port *port = urb->context; - struct digi_port *priv = usb_get_serial_port_data(port); -- int opcode = ((unsigned char *)urb->transfer_buffer)[0]; -- int len = ((unsigned char *)urb->transfer_buffer)[1]; -- int port_status = ((unsigned char *)urb->transfer_buffer)[2]; -- unsigned char *data = ((unsigned char *)urb->transfer_buffer) + 3; -+ unsigned char *buf = urb->transfer_buffer; -+ int opcode; -+ int len; -+ int port_status; -+ unsigned char *data; - int flag, throttled; -- int status = urb->status; -- -- /* do not process callbacks on closed ports */ -- /* but do continue the read chain */ -- if (urb->status == -ENOENT) -- return 0; - - /* short/multiple packet check */ -+ if (urb->actual_length < 2) { -+ dev_warn(&port->dev, "short packet received\n"); -+ return -1; -+ } -+ -+ opcode = buf[0]; -+ len = buf[1]; -+ - if (urb->actual_length != len + 2) { -- dev_err(&port->dev, "%s: INCOMPLETE OR MULTIPLE PACKET, " -- "status=%d, port=%d, opcode=%d, len=%d, " -- "actual_length=%d, status=%d\n", __func__, status, -- priv->dp_port_num, opcode, len, urb->actual_length, -- port_status); -+ dev_err(&port->dev, "malformed packet received: port=%d, opcode=%d, len=%d, actual_length=%u\n", -+ priv->dp_port_num, opcode, len, urb->actual_length); -+ return -1; -+ } -+ -+ if (opcode == DIGI_CMD_RECEIVE_DATA && len < 1) { -+ dev_err(&port->dev, "malformed data packet received\n"); - return -1; - } - -@@ -1431,6 +1436,9 @@ static int digi_read_inb_callback(struct urb *urb) - - /* receive data */ - if (opcode == DIGI_CMD_RECEIVE_DATA) { -+ port_status = buf[2]; -+ data = &buf[3]; -+ - /* get flag from port_status */ - flag = 0; - -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 19a98116c2ab..b3a21fcbbaf9 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1439,10 +1439,13 @@ static int read_latency_timer(struct usb_serial_port *port) - FTDI_SIO_GET_LATENCY_TIMER_REQUEST_TYPE, - 0, priv->interface, - buf, 1, WDR_TIMEOUT); -- if (rv < 0) -+ if (rv < 1) { - dev_err(&port->dev, "Unable to read latency timer: %i\n", rv); -- else -+ if (rv >= 0) -+ rv = -EIO; -+ } else { - priv->latency = buf[0]; -+ } - - kfree(buf); - -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index b63a6c3899c5..749e1b674145 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -492,20 +492,24 @@ static int get_epic_descriptor(struct edgeport_serial *ep) - int result; - struct usb_serial *serial = ep->serial; - struct edgeport_product_info *product_info = &ep->product_info; -- struct edge_compatibility_descriptor *epic = &ep->epic_descriptor; -+ struct edge_compatibility_descriptor *epic; - struct edge_compatibility_bits *bits; - struct device *dev = &serial->dev->dev; - - ep->is_epic = 0; -+ -+ epic = kmalloc(sizeof(*epic), GFP_KERNEL); -+ if (!epic) -+ return -ENOMEM; -+ - result = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), - USB_REQUEST_ION_GET_EPIC_DESC, - 0xC0, 0x00, 0x00, -- &ep->epic_descriptor, -- sizeof(struct edge_compatibility_descriptor), -+ epic, sizeof(*epic), - 300); -- -- if (result > 0) { -+ if (result == sizeof(*epic)) { - ep->is_epic = 1; -+ memcpy(&ep->epic_descriptor, epic, sizeof(*epic)); - memset(product_info, 0, sizeof(struct edgeport_product_info)); - - product_info->NumPorts = epic->NumPorts; -@@ -534,8 +538,16 @@ static int get_epic_descriptor(struct edgeport_serial *ep) - dev_dbg(dev, " IOSPWriteLCR : %s\n", bits->IOSPWriteLCR ? "TRUE": "FALSE"); - dev_dbg(dev, " IOSPSetBaudRate : %s\n", bits->IOSPSetBaudRate ? "TRUE": "FALSE"); - dev_dbg(dev, " TrueEdgeport : %s\n", bits->TrueEdgeport ? "TRUE": "FALSE"); -+ -+ result = 0; -+ } else if (result >= 0) { -+ dev_warn(&serial->interface->dev, "short epic descriptor received: %d\n", -+ result); -+ result = -EIO; - } - -+ kfree(epic); -+ - return result; - } - -@@ -2097,8 +2109,7 @@ static int rom_write(struct usb_serial *serial, __u16 extAddr, __u16 addr, - * rom_read - * reads a number of bytes from the Edgeport device starting at the given - * address. -- * If successful returns the number of bytes read, otherwise it returns -- * a negative error number of the problem. -+ * Returns zero on success or a negative error number. - ****************************************************************************/ - static int rom_read(struct usb_serial *serial, __u16 extAddr, - __u16 addr, __u16 length, __u8 *data) -@@ -2123,12 +2134,17 @@ static int rom_read(struct usb_serial *serial, __u16 extAddr, - USB_REQUEST_ION_READ_ROM, - 0xC0, addr, extAddr, transfer_buffer, - current_length, 300); -- if (result < 0) -+ if (result < current_length) { -+ if (result >= 0) -+ result = -EIO; - break; -+ } - memcpy(data, transfer_buffer, current_length); - length -= current_length; - addr += current_length; - data += current_length; -+ -+ result = 0; - } - - kfree(transfer_buffer); -@@ -2585,9 +2601,10 @@ static void get_manufacturing_desc(struct edgeport_serial *edge_serial) - EDGE_MANUF_DESC_LEN, - (__u8 *)(&edge_serial->manuf_descriptor)); - -- if (response < 1) -- dev_err(dev, "error in getting manufacturer descriptor\n"); -- else { -+ if (response < 0) { -+ dev_err(dev, "error in getting manufacturer descriptor: %d\n", -+ response); -+ } else { - char string[30]; - dev_dbg(dev, "**Manufacturer Descriptor\n"); - dev_dbg(dev, " RomSize: %dK\n", -@@ -2644,9 +2661,10 @@ static void get_boot_desc(struct edgeport_serial *edge_serial) - EDGE_BOOT_DESC_LEN, - (__u8 *)(&edge_serial->boot_descriptor)); - -- if (response < 1) -- dev_err(dev, "error in getting boot descriptor\n"); -- else { -+ if (response < 0) { -+ dev_err(dev, "error in getting boot descriptor: %d\n", -+ response); -+ } else { - dev_dbg(dev, "**Boot Descriptor:\n"); - dev_dbg(dev, " BootCodeLength: %d\n", - le16_to_cpu(edge_serial->boot_descriptor.BootCodeLength)); -@@ -2789,7 +2807,7 @@ static int edge_startup(struct usb_serial *serial) - dev_info(&serial->dev->dev, "%s detected\n", edge_serial->name); - - /* Read the epic descriptor */ -- if (get_epic_descriptor(edge_serial) <= 0) { -+ if (get_epic_descriptor(edge_serial) < 0) { - /* memcpy descriptor to Supports structures */ - memcpy(&edge_serial->epic_descriptor.Supports, descriptor, - sizeof(struct edge_compatibility_bits)); -diff --git a/drivers/usb/serial/keyspan_pda.c b/drivers/usb/serial/keyspan_pda.c -index 930be98d59b3..6b0942428917 100644 ---- a/drivers/usb/serial/keyspan_pda.c -+++ b/drivers/usb/serial/keyspan_pda.c -@@ -139,6 +139,7 @@ static void keyspan_pda_rx_interrupt(struct urb *urb) - { - struct usb_serial_port *port = urb->context; - unsigned char *data = urb->transfer_buffer; -+ unsigned int len = urb->actual_length; - int retval; - int status = urb->status; - struct keyspan_pda_private *priv; -@@ -159,18 +160,26 @@ static void keyspan_pda_rx_interrupt(struct urb *urb) - goto exit; - } - -+ if (len < 1) { -+ dev_warn(&port->dev, "short message received\n"); -+ goto exit; -+ } -+ - /* see if the message is data or a status interrupt */ - switch (data[0]) { - case 0: - /* rest of message is rx data */ -- if (urb->actual_length) { -- tty_insert_flip_string(&port->port, data + 1, -- urb->actual_length - 1); -- tty_flip_buffer_push(&port->port); -- } -+ if (len < 2) -+ break; -+ tty_insert_flip_string(&port->port, data + 1, len - 1); -+ tty_flip_buffer_push(&port->port); - break; - case 1: - /* status interrupt */ -+ if (len < 3) { -+ dev_warn(&port->dev, "short interrupt message received\n"); -+ break; -+ } - dev_dbg(&port->dev, "rx int, d1=%d, d2=%d\n", data[1], data[2]); - switch (data[1]) { - case 1: /* modemline change */ -diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c -index 89726f702202..9bf82c262c5b 100644 ---- a/drivers/usb/serial/mct_u232.c -+++ b/drivers/usb/serial/mct_u232.c -@@ -322,8 +322,12 @@ static int mct_u232_get_modem_stat(struct usb_serial_port *port, - MCT_U232_GET_REQUEST_TYPE, - 0, 0, buf, MCT_U232_GET_MODEM_STAT_SIZE, - WDR_TIMEOUT); -- if (rc < 0) { -+ if (rc < MCT_U232_GET_MODEM_STAT_SIZE) { - dev_err(&port->dev, "Get MODEM STATus failed (error = %d)\n", rc); -+ -+ if (rc >= 0) -+ rc = -EIO; -+ - *msr = 0; - } else { - *msr = buf[0]; -diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c -index a3ed07c58754..af0c87276299 100644 ---- a/drivers/usb/serial/quatech2.c -+++ b/drivers/usb/serial/quatech2.c -@@ -188,22 +188,22 @@ static inline int qt2_setdevice(struct usb_device *dev, u8 *data) - } - - --static inline int qt2_getdevice(struct usb_device *dev, u8 *data) --{ -- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -- QT_SET_GET_DEVICE, 0xc0, 0, 0, -- data, 3, QT2_USB_TIMEOUT); --} -- - static inline int qt2_getregister(struct usb_device *dev, - u8 uart, - u8 reg, - u8 *data) - { -- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -- QT_SET_GET_REGISTER, 0xc0, reg, -- uart, data, sizeof(*data), QT2_USB_TIMEOUT); -+ int ret; -+ -+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -+ QT_SET_GET_REGISTER, 0xc0, reg, -+ uart, data, sizeof(*data), QT2_USB_TIMEOUT); -+ if (ret < sizeof(*data)) { -+ if (ret >= 0) -+ ret = -EIO; -+ } - -+ return ret; - } - - static inline int qt2_setregister(struct usb_device *dev, -@@ -372,9 +372,11 @@ static int qt2_open(struct tty_struct *tty, struct usb_serial_port *port) - 0xc0, 0, - device_port, data, 2, QT2_USB_TIMEOUT); - -- if (status < 0) { -+ if (status < 2) { - dev_err(&port->dev, "%s - open port failed %i\n", __func__, - status); -+ if (status >= 0) -+ status = -EIO; - kfree(data); - return status; - } -diff --git a/drivers/usb/serial/ssu100.c b/drivers/usb/serial/ssu100.c -index 70a098de429f..886e1294b120 100644 ---- a/drivers/usb/serial/ssu100.c -+++ b/drivers/usb/serial/ssu100.c -@@ -80,9 +80,17 @@ static inline int ssu100_setdevice(struct usb_device *dev, u8 *data) - - static inline int ssu100_getdevice(struct usb_device *dev, u8 *data) - { -- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -- QT_SET_GET_DEVICE, 0xc0, 0, 0, -- data, 3, 300); -+ int ret; -+ -+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -+ QT_SET_GET_DEVICE, 0xc0, 0, 0, -+ data, 3, 300); -+ if (ret < 3) { -+ if (ret >= 0) -+ ret = -EIO; -+ } -+ -+ return ret; - } - - static inline int ssu100_getregister(struct usb_device *dev, -@@ -90,10 +98,17 @@ static inline int ssu100_getregister(struct usb_device *dev, - unsigned short reg, - u8 *data) - { -- return usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -- QT_SET_GET_REGISTER, 0xc0, reg, -- uart, data, sizeof(*data), 300); -+ int ret; -+ -+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), -+ QT_SET_GET_REGISTER, 0xc0, reg, -+ uart, data, sizeof(*data), 300); -+ if (ret < sizeof(*data)) { -+ if (ret >= 0) -+ ret = -EIO; -+ } - -+ return ret; - } - - -@@ -289,8 +304,10 @@ static int ssu100_open(struct tty_struct *tty, struct usb_serial_port *port) - QT_OPEN_CLOSE_CHANNEL, - QT_TRANSFER_IN, 0x01, - 0, data, 2, 300); -- if (result < 0) { -+ if (result < 2) { - dev_dbg(&port->dev, "%s - open failed %i\n", __func__, result); -+ if (result >= 0) -+ result = -EIO; - kfree(data); - return result; - } -diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c -index 535fcfafc097..fe7f5ace6064 100644 ---- a/drivers/usb/serial/ti_usb_3410_5052.c -+++ b/drivers/usb/serial/ti_usb_3410_5052.c -@@ -1352,13 +1352,10 @@ static int ti_command_out_sync(struct ti_device *tdev, __u8 command, - (USB_TYPE_VENDOR | USB_RECIP_DEVICE | USB_DIR_OUT), - value, moduleid, data, size, 1000); - -- if (status == size) -- status = 0; -- -- if (status > 0) -- status = -ECOMM; -+ if (status < 0) -+ return status; - -- return status; -+ return 0; - } - - -@@ -1374,8 +1371,7 @@ static int ti_command_in_sync(struct ti_device *tdev, __u8 command, - - if (status == size) - status = 0; -- -- if (status > 0) -+ else if (status >= 0) - status = -ECOMM; - - return status; -diff --git a/fs/9p/acl.c b/fs/9p/acl.c -index 929b618da43b..c30c6ceac2c4 100644 ---- a/fs/9p/acl.c -+++ b/fs/9p/acl.c -@@ -283,6 +283,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, - case ACL_TYPE_ACCESS: - if (acl) { - struct iattr iattr; -+ struct posix_acl *old_acl = acl; - - retval = posix_acl_update_mode(inode, &iattr.ia_mode, &acl); - if (retval) -@@ -293,6 +294,7 @@ static int v9fs_xattr_set_acl(const struct xattr_handler *handler, - * by the mode bits. So don't - * update ACL. - */ -+ posix_acl_release(old_acl); - value = NULL; - size = 0; - } -diff --git a/fs/block_dev.c b/fs/block_dev.c -index 198aea66fe71..e5733bb537c9 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -1098,7 +1098,6 @@ int revalidate_disk(struct gendisk *disk) - - if (disk->fops->revalidate_disk) - ret = disk->fops->revalidate_disk(disk); -- blk_integrity_revalidate(disk); - bdev = bdget_disk(disk, 0); - if (!bdev) - return ret; -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 16462e702f96..86e1cb899957 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1059,6 +1059,13 @@ static int sanity_check_raw_super(struct super_block *sb, - return 1; - } - -+ if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) { -+ f2fs_msg(sb, KERN_INFO, -+ "Invalid segment count (%u)", -+ le32_to_cpu(raw_super->segment_count)); -+ return 1; -+ } -+ - /* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */ - if (sanity_check_area_boundary(sb, raw_super)) - return 1; -diff --git a/include/linux/f2fs_fs.h b/include/linux/f2fs_fs.h -index 25c6324a0dd0..3d6e6ce44c5c 100644 ---- a/include/linux/f2fs_fs.h -+++ b/include/linux/f2fs_fs.h -@@ -284,6 +284,12 @@ struct f2fs_nat_block { - #define SIT_ENTRY_PER_BLOCK (PAGE_CACHE_SIZE / sizeof(struct f2fs_sit_entry)) - - /* -+ * F2FS uses 4 bytes to represent block address. As a result, supported size of -+ * disk is 16 TB and it equals to 16 * 1024 * 1024 / 2 segments. -+ */ -+#define F2FS_MAX_SEGMENT ((16 * 1024 * 1024) / 2) -+ -+/* - * Note that f2fs_sit_entry->vblocks has the following bit-field information. - * [15:10] : allocation type such as CURSEG_XXXX_TYPE - * [9:0] : valid block count -diff --git a/include/linux/genhd.h b/include/linux/genhd.h -index 847cc1d91634..5012fcdb4c9e 100644 ---- a/include/linux/genhd.h -+++ b/include/linux/genhd.h -@@ -742,11 +742,9 @@ static inline void part_nr_sects_write(struct hd_struct *part, sector_t size) - #if defined(CONFIG_BLK_DEV_INTEGRITY) - extern void blk_integrity_add(struct gendisk *); - extern void blk_integrity_del(struct gendisk *); --extern void blk_integrity_revalidate(struct gendisk *); - #else /* CONFIG_BLK_DEV_INTEGRITY */ - static inline void blk_integrity_add(struct gendisk *disk) { } - static inline void blk_integrity_del(struct gendisk *disk) { } --static inline void blk_integrity_revalidate(struct gendisk *disk) { } - #endif /* CONFIG_BLK_DEV_INTEGRITY */ - - #else /* CONFIG_BLOCK */ -diff --git a/include/linux/usb/chipidea.h b/include/linux/usb/chipidea.h -index 5dd75fa47dd8..f9be467d6695 100644 ---- a/include/linux/usb/chipidea.h -+++ b/include/linux/usb/chipidea.h -@@ -14,6 +14,7 @@ struct ci_hdrc; - * struct ci_hdrc_cable - structure for external connector cable state tracking - * @state: current state of the line - * @changed: set to true when extcon event happen -+ * @enabled: set to true if we've enabled the vbus or id interrupt - * @edev: device which generate events - * @ci: driver state of the chipidea device - * @nb: hold event notification callback -@@ -22,6 +23,7 @@ struct ci_hdrc; - struct ci_hdrc_cable { - bool state; - bool changed; -+ bool enabled; - struct extcon_dev *edev; - struct ci_hdrc *ci; - struct notifier_block nb; -diff --git a/include/net/addrconf.h b/include/net/addrconf.h -index 78003dfb8539..18dd7a3caf2f 100644 ---- a/include/net/addrconf.h -+++ b/include/net/addrconf.h -@@ -19,6 +19,8 @@ - #define ADDRCONF_TIMER_FUZZ (HZ / 4) - #define ADDRCONF_TIMER_FUZZ_MAX (HZ) - -+#define ADDRCONF_NOTIFY_PRIORITY 0 -+ - #include - #include - -diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h -index 295d291269e2..6275d651f76e 100644 ---- a/include/net/ip6_route.h -+++ b/include/net/ip6_route.h -@@ -77,6 +77,7 @@ static inline struct dst_entry *ip6_route_output(struct net *net, - struct dst_entry *ip6_route_lookup(struct net *net, struct flowi6 *fl6, - int flags); - -+void ip6_route_init_special_entries(void); - int ip6_route_init(void); - void ip6_route_cleanup(void); - -diff --git a/lib/test_bpf.c b/lib/test_bpf.c -index 10cd1860e5b0..7e26aea3e404 100644 ---- a/lib/test_bpf.c -+++ b/lib/test_bpf.c -@@ -4315,6 +4315,51 @@ static struct bpf_test tests[] = { - { }, - { { 0, 1 } }, - }, -+ { -+ /* Mainly testing JIT + imm64 here. */ -+ "JMP_JGE_X: ldimm64 test 1", -+ .u.insns_int = { -+ BPF_ALU32_IMM(BPF_MOV, R0, 0), -+ BPF_LD_IMM64(R1, 3), -+ BPF_LD_IMM64(R2, 2), -+ BPF_JMP_REG(BPF_JGE, R1, R2, 2), -+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL), -+ BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL), -+ BPF_EXIT_INSN(), -+ }, -+ INTERNAL, -+ { }, -+ { { 0, 0xeeeeeeeeU } }, -+ }, -+ { -+ "JMP_JGE_X: ldimm64 test 2", -+ .u.insns_int = { -+ BPF_ALU32_IMM(BPF_MOV, R0, 0), -+ BPF_LD_IMM64(R1, 3), -+ BPF_LD_IMM64(R2, 2), -+ BPF_JMP_REG(BPF_JGE, R1, R2, 0), -+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL), -+ BPF_EXIT_INSN(), -+ }, -+ INTERNAL, -+ { }, -+ { { 0, 0xffffffffU } }, -+ }, -+ { -+ "JMP_JGE_X: ldimm64 test 3", -+ .u.insns_int = { -+ BPF_ALU32_IMM(BPF_MOV, R0, 1), -+ BPF_LD_IMM64(R1, 3), -+ BPF_LD_IMM64(R2, 2), -+ BPF_JMP_REG(BPF_JGE, R1, R2, 4), -+ BPF_LD_IMM64(R0, 0xffffffffffffffffUL), -+ BPF_LD_IMM64(R0, 0xeeeeeeeeeeeeeeeeUL), -+ BPF_EXIT_INSN(), -+ }, -+ INTERNAL, -+ { }, -+ { { 0, 1 } }, -+ }, - /* BPF_JMP | BPF_JNE | BPF_X */ - { - "JMP_JNE_X: if (3 != 2) return 1", -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index b94e165a4f79..fe38ef58997c 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1018,7 +1018,7 @@ static int rtnl_phys_port_name_fill(struct sk_buff *skb, struct net_device *dev) - return err; - } - -- if (nla_put(skb, IFLA_PHYS_PORT_NAME, strlen(name), name)) -+ if (nla_put_string(skb, IFLA_PHYS_PORT_NAME, name)) - return -EMSGSIZE; - - return 0; -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index 7113bae4e6a0..8f2cd7d09720 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -354,6 +354,9 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, - rt->dst.dev->mtu); - return -EMSGSIZE; - } -+ if (length < sizeof(struct iphdr)) -+ return -EINVAL; -+ - if (flags&MSG_PROBE) - goto out; - -diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c -index 1e70fa8fa793..3861dedd5365 100644 ---- a/net/ipv4/tcp_lp.c -+++ b/net/ipv4/tcp_lp.c -@@ -264,13 +264,15 @@ static void tcp_lp_pkts_acked(struct sock *sk, u32 num_acked, s32 rtt_us) - { - struct tcp_sock *tp = tcp_sk(sk); - struct lp *lp = inet_csk_ca(sk); -+ u32 delta; - - if (rtt_us > 0) - tcp_lp_rtt_sample(sk, rtt_us); - - /* calc inference */ -- if (tcp_time_stamp > tp->rx_opt.rcv_tsecr) -- lp->inference = 3 * (tcp_time_stamp - tp->rx_opt.rcv_tsecr); -+ delta = tcp_time_stamp - tp->rx_opt.rcv_tsecr; -+ if ((s32)delta > 0) -+ lp->inference = 3 * delta; - - /* test if within inference */ - if (lp->last_drop && (tcp_time_stamp - lp->last_drop < lp->inference)) -diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c -index 019db68bdb9f..4c1c94fa8f08 100644 ---- a/net/ipv4/tcp_minisocks.c -+++ b/net/ipv4/tcp_minisocks.c -@@ -547,6 +547,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk, - newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len; - newtp->rx_opt.mss_clamp = req->mss; - tcp_ecn_openreq_child(newtp, req); -+ newtp->fastopen_req = NULL; - newtp->fastopen_rsk = NULL; - newtp->syn_data_acked = 0; - newtp->rack.mstamp.v64 = 0; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index de95714d021c..3fdcdc730f71 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1221,7 +1221,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, - * eventually). The difference is that pulled data not copied, but - * immediately discarded. - */ --static void __pskb_trim_head(struct sk_buff *skb, int len) -+static int __pskb_trim_head(struct sk_buff *skb, int len) - { - struct skb_shared_info *shinfo; - int i, k, eat; -@@ -1231,7 +1231,7 @@ static void __pskb_trim_head(struct sk_buff *skb, int len) - __skb_pull(skb, eat); - len -= eat; - if (!len) -- return; -+ return 0; - } - eat = len; - k = 0; -@@ -1257,23 +1257,28 @@ static void __pskb_trim_head(struct sk_buff *skb, int len) - skb_reset_tail_pointer(skb); - skb->data_len -= len; - skb->len = skb->data_len; -+ return len; - } - - /* Remove acked data from a packet in the transmit queue. */ - int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len) - { -+ u32 delta_truesize; -+ - if (skb_unclone(skb, GFP_ATOMIC)) - return -ENOMEM; - -- __pskb_trim_head(skb, len); -+ delta_truesize = __pskb_trim_head(skb, len); - - TCP_SKB_CB(skb)->seq += len; - skb->ip_summed = CHECKSUM_PARTIAL; - -- skb->truesize -= len; -- sk->sk_wmem_queued -= len; -- sk_mem_uncharge(sk, len); -- sock_set_flag(sk, SOCK_QUEUE_SHRUNK); -+ if (delta_truesize) { -+ skb->truesize -= delta_truesize; -+ sk->sk_wmem_queued -= delta_truesize; -+ sk_mem_uncharge(sk, delta_truesize); -+ sock_set_flag(sk, SOCK_QUEUE_SHRUNK); -+ } - - /* Any change of skb->len requires recalculation of tso factor. */ - if (tcp_skb_pcount(skb) > 1) -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 253186a35567..7090fef372cc 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3306,6 +3306,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, - */ - static struct notifier_block ipv6_dev_notf = { - .notifier_call = addrconf_notify, -+ .priority = ADDRCONF_NOTIFY_PRIORITY, - }; - - static void addrconf_type_change(struct net_device *dev, unsigned long event) -@@ -5940,6 +5941,8 @@ int __init addrconf_init(void) - goto errlo; - } - -+ ip6_route_init_special_entries(); -+ - for (i = 0; i < IN6_ADDR_HSIZE; i++) - INIT_HLIST_HEAD(&inet6_addr_lst[i]); - -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index a625f69a28dd..c93ede16795d 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -630,6 +630,8 @@ static int rawv6_send_hdrinc(struct sock *sk, struct msghdr *msg, int length, - ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu); - return -EMSGSIZE; - } -+ if (length < sizeof(struct ipv6hdr)) -+ return -EINVAL; - if (flags&MSG_PROBE) - goto out; - -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 6c91d5c4a92c..8f4177a1d4f5 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3363,7 +3363,10 @@ static int ip6_route_dev_notify(struct notifier_block *this, - struct net_device *dev = netdev_notifier_info_to_dev(ptr); - struct net *net = dev_net(dev); - -- if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) { -+ if (!(dev->flags & IFF_LOOPBACK)) -+ return NOTIFY_OK; -+ -+ if (event == NETDEV_REGISTER) { - net->ipv6.ip6_null_entry->dst.dev = dev; - net->ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(dev); - #ifdef CONFIG_IPV6_MULTIPLE_TABLES -@@ -3372,6 +3375,12 @@ static int ip6_route_dev_notify(struct notifier_block *this, - net->ipv6.ip6_blk_hole_entry->dst.dev = dev; - net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev); - #endif -+ } else if (event == NETDEV_UNREGISTER) { -+ in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev); -+#ifdef CONFIG_IPV6_MULTIPLE_TABLES -+ in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev); -+ in6_dev_put(net->ipv6.ip6_blk_hole_entry->rt6i_idev); -+#endif - } - - return NOTIFY_OK; -@@ -3678,9 +3687,24 @@ static struct pernet_operations ip6_route_net_late_ops = { - - static struct notifier_block ip6_route_dev_notifier = { - .notifier_call = ip6_route_dev_notify, -- .priority = 0, -+ .priority = ADDRCONF_NOTIFY_PRIORITY - 10, - }; - -+void __init ip6_route_init_special_entries(void) -+{ -+ /* Registering of the loopback is done before this portion of code, -+ * the loopback reference in rt6_info will not be taken, do it -+ * manually for init_net */ -+ init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev; -+ init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -+ #ifdef CONFIG_IPV6_MULTIPLE_TABLES -+ init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev; -+ init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -+ init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev; -+ init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -+ #endif -+} -+ - int __init ip6_route_init(void) - { - int ret; -@@ -3707,17 +3731,6 @@ int __init ip6_route_init(void) - - ip6_dst_blackhole_ops.kmem_cachep = ip6_dst_ops_template.kmem_cachep; - -- /* Registering of the loopback is done before this portion of code, -- * the loopback reference in rt6_info will not be taken, do it -- * manually for init_net */ -- init_net.ipv6.ip6_null_entry->dst.dev = init_net.loopback_dev; -- init_net.ipv6.ip6_null_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -- #ifdef CONFIG_IPV6_MULTIPLE_TABLES -- init_net.ipv6.ip6_prohibit_entry->dst.dev = init_net.loopback_dev; -- init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -- init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev; -- init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev); -- #endif - ret = fib6_init(); - if (ret) - goto out_register_subsys; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index 8f3e5e9d8bdb..e6de496bffbe 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2166,7 +2166,20 @@ static void azx_remove(struct pci_dev *pci) - /* cancel the pending probing work */ - chip = card->private_data; - hda = container_of(chip, struct hda_intel, chip); -+ /* FIXME: below is an ugly workaround. -+ * Both device_release_driver() and driver_probe_device() -+ * take *both* the device's and its parent's lock before -+ * calling the remove() and probe() callbacks. The codec -+ * probe takes the locks of both the codec itself and its -+ * parent, i.e. the PCI controller dev. Meanwhile, when -+ * the PCI controller is unbound, it takes its lock, too -+ * ==> ouch, a deadlock! -+ * As a workaround, we unlock temporarily here the controller -+ * device during cancel_work_sync() call. -+ */ -+ device_unlock(&pci->dev); - cancel_work_sync(&hda->probe_work); -+ device_lock(&pci->dev); - - snd_card_free(card); - } -diff --git a/tools/power/cpupower/utils/helpers/cpuid.c b/tools/power/cpupower/utils/helpers/cpuid.c -index 93b0aa74ca03..39c2c7d067bb 100644 ---- a/tools/power/cpupower/utils/helpers/cpuid.c -+++ b/tools/power/cpupower/utils/helpers/cpuid.c -@@ -156,6 +156,7 @@ out: - */ - case 0x2C: /* Westmere EP - Gulftown */ - cpu_info->caps |= CPUPOWER_CAP_HAS_TURBO_RATIO; -+ break; - case 0x2A: /* SNB */ - case 0x2D: /* SNB Xeon */ - case 0x3A: /* IVB */ diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.68-69.patch b/patch/kernel/mvebu64-default/03-patch-4.4.68-69.patch deleted file mode 100644 index d834c776b398..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.68-69.patch +++ /dev/null @@ -1,2887 +0,0 @@ -diff --git a/Makefile b/Makefile -index e6c7990497e7..dc5df61ea4be 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 68 -+SUBLEVEL = 69 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h -index 9011a88353de..ed1e9206f830 100644 ---- a/arch/x86/boot/boot.h -+++ b/arch/x86/boot/boot.h -@@ -16,7 +16,7 @@ - #ifndef BOOT_BOOT_H - #define BOOT_BOOT_H - --#define STACK_SIZE 512 /* Minimum number of bytes for stack */ -+#define STACK_SIZE 1024 /* Minimum number of bytes for stack */ - - #ifndef __ASSEMBLY__ - -diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h -index bd8ce6bcdfc9..6503526d7b24 100644 ---- a/arch/x86/include/asm/pmem.h -+++ b/arch/x86/include/asm/pmem.h -@@ -122,7 +122,7 @@ static inline size_t arch_copy_from_iter_pmem(void __pmem *addr, size_t bytes, - - if (bytes < 8) { - if (!IS_ALIGNED(dest, 4) || (bytes != 4)) -- __arch_wb_cache_pmem(addr, 1); -+ __arch_wb_cache_pmem(addr, bytes); - } else { - if (!IS_ALIGNED(dest, 8)) { - dest = ALIGN(dest, boot_cpu_data.x86_clflush_size); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index e75095fa414e..281899da19d4 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -2960,6 +2960,12 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu, - | KVM_VCPUEVENT_VALID_SMM)) - return -EINVAL; - -+ /* INITs are latched while in SMM */ -+ if (events->flags & KVM_VCPUEVENT_VALID_SMM && -+ (events->smi.smm || events->smi.pending) && -+ vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED) -+ return -EINVAL; -+ - process_nmi(vcpu); - vcpu->arch.exception.pending = events->exception.injected; - vcpu->arch.exception.nr = events->exception.nr; -@@ -6993,6 +6999,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu, - mp_state->mp_state != KVM_MP_STATE_RUNNABLE) - return -EINVAL; - -+ /* INITs are latched while in SMM */ -+ if ((is_smm(vcpu) || vcpu->arch.smi_pending) && -+ (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED || -+ mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED)) -+ return -EINVAL; -+ - if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) { - vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED; - set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events); -diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c -index a629694ee750..e14c43a2d187 100644 ---- a/arch/x86/um/ptrace_64.c -+++ b/arch/x86/um/ptrace_64.c -@@ -121,7 +121,7 @@ int poke_user(struct task_struct *child, long addr, long data) - else if ((addr >= offsetof(struct user, u_debugreg[0])) && - (addr <= offsetof(struct user, u_debugreg[7]))) { - addr -= offsetof(struct user, u_debugreg[0]); -- addr = addr >> 2; -+ addr = addr >> 3; - if ((addr == 4) || (addr == 5)) - return -EIO; - child->thread.arch.debugregs[addr] = data; -diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c -index 1e56ff583459..63146c378f1e 100644 ---- a/arch/x86/xen/mmu.c -+++ b/arch/x86/xen/mmu.c -@@ -2038,7 +2038,8 @@ static unsigned long __init xen_read_phys_ulong(phys_addr_t addr) - - /* - * Translate a virtual address to a physical one without relying on mapped -- * page tables. -+ * page tables. Don't rely on big pages being aligned in (guest) physical -+ * space! - */ - static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) - { -@@ -2059,7 +2060,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) - sizeof(pud))); - if (!pud_present(pud)) - return 0; -- pa = pud_pfn(pud) << PAGE_SHIFT; -+ pa = pud_val(pud) & PTE_PFN_MASK; - if (pud_large(pud)) - return pa + (vaddr & ~PUD_MASK); - -@@ -2067,7 +2068,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr) - sizeof(pmd))); - if (!pmd_present(pmd)) - return 0; -- pa = pmd_pfn(pmd) << PAGE_SHIFT; -+ pa = pmd_val(pmd) & PTE_PFN_MASK; - if (pmd_large(pmd)) - return pa + (vaddr & ~PMD_MASK); - -diff --git a/block/blk-integrity.c b/block/blk-integrity.c -index 319f2e4f4a8b..478f572cb1e7 100644 ---- a/block/blk-integrity.c -+++ b/block/blk-integrity.c -@@ -412,7 +412,8 @@ void blk_integrity_register(struct gendisk *disk, struct blk_integrity *template - - bi->flags = BLK_INTEGRITY_VERIFY | BLK_INTEGRITY_GENERATE | - template->flags; -- bi->interval_exp = ilog2(queue_logical_block_size(disk->queue)); -+ bi->interval_exp = template->interval_exp ? : -+ ilog2(queue_logical_block_size(disk->queue)); - bi->profile = template->profile ? template->profile : &nop_profile; - bi->tuple_size = template->tuple_size; - bi->tag_size = template->tag_size; -diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c -index 6d4d4569447e..faea9d728fd2 100644 ---- a/crypto/algif_aead.c -+++ b/crypto/algif_aead.c -@@ -29,6 +29,11 @@ struct aead_sg_list { - struct scatterlist sg[ALG_MAX_PAGES]; - }; - -+struct aead_tfm { -+ struct crypto_aead *aead; -+ bool has_key; -+}; -+ - struct aead_ctx { - struct aead_sg_list tsgl; - /* -@@ -513,24 +518,146 @@ static struct proto_ops algif_aead_ops = { - .poll = aead_poll, - }; - -+static int aead_check_key(struct socket *sock) -+{ -+ int err = 0; -+ struct sock *psk; -+ struct alg_sock *pask; -+ struct aead_tfm *tfm; -+ struct sock *sk = sock->sk; -+ struct alg_sock *ask = alg_sk(sk); -+ -+ lock_sock(sk); -+ if (ask->refcnt) -+ goto unlock_child; -+ -+ psk = ask->parent; -+ pask = alg_sk(ask->parent); -+ tfm = pask->private; -+ -+ err = -ENOKEY; -+ lock_sock_nested(psk, SINGLE_DEPTH_NESTING); -+ if (!tfm->has_key) -+ goto unlock; -+ -+ if (!pask->refcnt++) -+ sock_hold(psk); -+ -+ ask->refcnt = 1; -+ sock_put(psk); -+ -+ err = 0; -+ -+unlock: -+ release_sock(psk); -+unlock_child: -+ release_sock(sk); -+ -+ return err; -+} -+ -+static int aead_sendmsg_nokey(struct socket *sock, struct msghdr *msg, -+ size_t size) -+{ -+ int err; -+ -+ err = aead_check_key(sock); -+ if (err) -+ return err; -+ -+ return aead_sendmsg(sock, msg, size); -+} -+ -+static ssize_t aead_sendpage_nokey(struct socket *sock, struct page *page, -+ int offset, size_t size, int flags) -+{ -+ int err; -+ -+ err = aead_check_key(sock); -+ if (err) -+ return err; -+ -+ return aead_sendpage(sock, page, offset, size, flags); -+} -+ -+static int aead_recvmsg_nokey(struct socket *sock, struct msghdr *msg, -+ size_t ignored, int flags) -+{ -+ int err; -+ -+ err = aead_check_key(sock); -+ if (err) -+ return err; -+ -+ return aead_recvmsg(sock, msg, ignored, flags); -+} -+ -+static struct proto_ops algif_aead_ops_nokey = { -+ .family = PF_ALG, -+ -+ .connect = sock_no_connect, -+ .socketpair = sock_no_socketpair, -+ .getname = sock_no_getname, -+ .ioctl = sock_no_ioctl, -+ .listen = sock_no_listen, -+ .shutdown = sock_no_shutdown, -+ .getsockopt = sock_no_getsockopt, -+ .mmap = sock_no_mmap, -+ .bind = sock_no_bind, -+ .accept = sock_no_accept, -+ .setsockopt = sock_no_setsockopt, -+ -+ .release = af_alg_release, -+ .sendmsg = aead_sendmsg_nokey, -+ .sendpage = aead_sendpage_nokey, -+ .recvmsg = aead_recvmsg_nokey, -+ .poll = aead_poll, -+}; -+ - static void *aead_bind(const char *name, u32 type, u32 mask) - { -- return crypto_alloc_aead(name, type, mask); -+ struct aead_tfm *tfm; -+ struct crypto_aead *aead; -+ -+ tfm = kzalloc(sizeof(*tfm), GFP_KERNEL); -+ if (!tfm) -+ return ERR_PTR(-ENOMEM); -+ -+ aead = crypto_alloc_aead(name, type, mask); -+ if (IS_ERR(aead)) { -+ kfree(tfm); -+ return ERR_CAST(aead); -+ } -+ -+ tfm->aead = aead; -+ -+ return tfm; - } - - static void aead_release(void *private) - { -- crypto_free_aead(private); -+ struct aead_tfm *tfm = private; -+ -+ crypto_free_aead(tfm->aead); -+ kfree(tfm); - } - - static int aead_setauthsize(void *private, unsigned int authsize) - { -- return crypto_aead_setauthsize(private, authsize); -+ struct aead_tfm *tfm = private; -+ -+ return crypto_aead_setauthsize(tfm->aead, authsize); - } - - static int aead_setkey(void *private, const u8 *key, unsigned int keylen) - { -- return crypto_aead_setkey(private, key, keylen); -+ struct aead_tfm *tfm = private; -+ int err; -+ -+ err = crypto_aead_setkey(tfm->aead, key, keylen); -+ tfm->has_key = !err; -+ -+ return err; - } - - static void aead_sock_destruct(struct sock *sk) -@@ -546,12 +673,14 @@ static void aead_sock_destruct(struct sock *sk) - af_alg_release_parent(sk); - } - --static int aead_accept_parent(void *private, struct sock *sk) -+static int aead_accept_parent_nokey(void *private, struct sock *sk) - { - struct aead_ctx *ctx; - struct alg_sock *ask = alg_sk(sk); -- unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(private); -- unsigned int ivlen = crypto_aead_ivsize(private); -+ struct aead_tfm *tfm = private; -+ struct crypto_aead *aead = tfm->aead; -+ unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(aead); -+ unsigned int ivlen = crypto_aead_ivsize(aead); - - ctx = sock_kmalloc(sk, len, GFP_KERNEL); - if (!ctx) -@@ -577,7 +706,7 @@ static int aead_accept_parent(void *private, struct sock *sk) - - ask->private = ctx; - -- aead_request_set_tfm(&ctx->aead_req, private); -+ aead_request_set_tfm(&ctx->aead_req, aead); - aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG, - af_alg_complete, &ctx->completion); - -@@ -586,13 +715,25 @@ static int aead_accept_parent(void *private, struct sock *sk) - return 0; - } - -+static int aead_accept_parent(void *private, struct sock *sk) -+{ -+ struct aead_tfm *tfm = private; -+ -+ if (!tfm->has_key) -+ return -ENOKEY; -+ -+ return aead_accept_parent_nokey(private, sk); -+} -+ - static const struct af_alg_type algif_type_aead = { - .bind = aead_bind, - .release = aead_release, - .setkey = aead_setkey, - .setauthsize = aead_setauthsize, - .accept = aead_accept_parent, -+ .accept_nokey = aead_accept_parent_nokey, - .ops = &algif_aead_ops, -+ .ops_nokey = &algif_aead_ops_nokey, - .name = "aead", - .owner = THIS_MODULE - }; -diff --git a/drivers/Makefile b/drivers/Makefile -index 795d0ca714bf..098997f2cc3a 100644 ---- a/drivers/Makefile -+++ b/drivers/Makefile -@@ -98,6 +98,7 @@ obj-$(CONFIG_USB_PHY) += usb/ - obj-$(CONFIG_USB) += usb/ - obj-$(CONFIG_PCI) += usb/ - obj-$(CONFIG_USB_GADGET) += usb/ -+obj-$(CONFIG_OF) += usb/ - obj-$(CONFIG_SERIO) += input/serio/ - obj-$(CONFIG_GAMEPORT) += input/gameport/ - obj-$(CONFIG_INPUT) += input/ -diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c -index cb852cc750b7..f9b569ef3dd7 100644 ---- a/drivers/bluetooth/hci_bcm.c -+++ b/drivers/bluetooth/hci_bcm.c -@@ -287,6 +287,9 @@ static int bcm_open(struct hci_uart *hu) - - hu->priv = bcm; - -+ if (!hu->tty->dev) -+ goto out; -+ - mutex_lock(&bcm_device_lock); - list_for_each(p, &bcm_device_list) { - struct bcm_device *dev = list_entry(p, struct bcm_device, list); -@@ -307,7 +310,7 @@ static int bcm_open(struct hci_uart *hu) - } - - mutex_unlock(&bcm_device_lock); -- -+out: - return 0; - } - -diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c -index b9065506a847..0c63fce0c1e0 100644 ---- a/drivers/bluetooth/hci_intel.c -+++ b/drivers/bluetooth/hci_intel.c -@@ -307,6 +307,9 @@ static int intel_set_power(struct hci_uart *hu, bool powered) - struct list_head *p; - int err = -ENODEV; - -+ if (!hu->tty->dev) -+ return err; -+ - mutex_lock(&intel_device_list_lock); - - list_for_each(p, &intel_device_list) { -@@ -379,6 +382,9 @@ static void intel_busy_work(struct work_struct *work) - struct intel_data *intel = container_of(work, struct intel_data, - busy_work); - -+ if (!intel->hu->tty->dev) -+ return; -+ - /* Link is busy, delay the suspend */ - mutex_lock(&intel_device_list_lock); - list_for_each(p, &intel_device_list) { -@@ -913,6 +919,8 @@ done: - list_for_each(p, &intel_device_list) { - struct intel_device *dev = list_entry(p, struct intel_device, - list); -+ if (!hu->tty->dev) -+ break; - if (hu->tty->dev->parent == dev->pdev->dev.parent) { - if (device_may_wakeup(&dev->pdev->dev)) - idev = dev; -@@ -1094,6 +1102,9 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) - - BT_DBG("hu %p skb %p", hu, skb); - -+ if (!hu->tty->dev) -+ goto out_enqueue; -+ - /* Be sure our controller is resumed and potential LPM transaction - * completed before enqueuing any packet. - */ -@@ -1110,7 +1121,7 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb) - } - } - mutex_unlock(&intel_device_list_lock); -- -+out_enqueue: - skb_queue_tail(&intel->txq, skb); - - return 0; -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index 90e624662257..0d83cfb9708f 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -888,6 +888,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, - * for details on the intricacies of this. - */ - int left; -+ unsigned char *data_to_send; - - ssif_inc_stat(ssif_info, sent_messages_parts); - -@@ -896,6 +897,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, - left = 32; - /* Length byte. */ - ssif_info->multi_data[ssif_info->multi_pos] = left; -+ data_to_send = ssif_info->multi_data + ssif_info->multi_pos; - ssif_info->multi_pos += left; - if (left < 32) - /* -@@ -909,7 +911,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result, - rv = ssif_i2c_send(ssif_info, msg_written_handler, - I2C_SMBUS_WRITE, - SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE, -- ssif_info->multi_data + ssif_info->multi_pos, -+ data_to_send, - I2C_SMBUS_BLOCK_DATA); - if (rv < 0) { - /* request failed, just return the error. */ -diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c -index b1f37d4095fa..e76d52a203a7 100644 ---- a/drivers/infiniband/core/sysfs.c -+++ b/drivers/infiniband/core/sysfs.c -@@ -863,7 +863,7 @@ err_put: - free_port_list_attributes(device); - - err_unregister: -- device_unregister(class_dev); -+ device_del(class_dev); - - err: - return ret; -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 77ddf2fa8625..8763fb832b01 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -2491,6 +2491,7 @@ err_counter: - mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]); - - err_map: -+ mlx4_ib_free_eqs(dev, ibdev); - iounmap(ibdev->uar_map); - - err_uar: -diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c -index 36ec8aa048aa..0b5bb0cee6f9 100644 ---- a/drivers/infiniband/hw/mlx4/mcg.c -+++ b/drivers/infiniband/hw/mlx4/mcg.c -@@ -1105,7 +1105,8 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy - while ((p = rb_first(&ctx->mcg_table)) != NULL) { - group = rb_entry(p, struct mcast_group, node); - if (atomic_read(&group->refcount)) -- mcg_warn_group(group, "group refcount %d!!! (pointer %p)\n", atomic_read(&group->refcount), group); -+ mcg_debug_group(group, "group refcount %d!!! (pointer %p)\n", -+ atomic_read(&group->refcount), group); - - force_clean_group(group); - } -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c -index 6bd5740e2691..09396bd7b02d 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c -@@ -281,8 +281,11 @@ void ipoib_delete_debug_files(struct net_device *dev) - { - struct ipoib_dev_priv *priv = netdev_priv(dev); - -+ WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n"); -+ WARN_ONCE(!priv->path_dentry, "null path debug file\n"); - debugfs_remove(priv->mcg_dentry); - debugfs_remove(priv->path_dentry); -+ priv->mcg_dentry = priv->path_dentry = NULL; - } - - int ipoib_register_debugfs(void) -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c -index 8efcff1beb8f..6699ecd855f0 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c -@@ -106,6 +106,33 @@ static struct ib_client ipoib_client = { - .get_net_dev_by_params = ipoib_get_net_dev_by_params, - }; - -+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG -+static int ipoib_netdev_event(struct notifier_block *this, -+ unsigned long event, void *ptr) -+{ -+ struct netdev_notifier_info *ni = ptr; -+ struct net_device *dev = ni->dev; -+ -+ if (dev->netdev_ops->ndo_open != ipoib_open) -+ return NOTIFY_DONE; -+ -+ switch (event) { -+ case NETDEV_REGISTER: -+ ipoib_create_debug_files(dev); -+ break; -+ case NETDEV_CHANGENAME: -+ ipoib_delete_debug_files(dev); -+ ipoib_create_debug_files(dev); -+ break; -+ case NETDEV_UNREGISTER: -+ ipoib_delete_debug_files(dev); -+ break; -+ } -+ -+ return NOTIFY_DONE; -+} -+#endif -+ - int ipoib_open(struct net_device *dev) - { - struct ipoib_dev_priv *priv = netdev_priv(dev); -@@ -1595,8 +1622,6 @@ void ipoib_dev_cleanup(struct net_device *dev) - - ASSERT_RTNL(); - -- ipoib_delete_debug_files(dev); -- - /* Delete any child interfaces first */ - list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) { - /* Stop GC on child */ -@@ -1908,8 +1933,6 @@ static struct net_device *ipoib_add_port(const char *format, - goto register_failed; - } - -- ipoib_create_debug_files(priv->dev); -- - if (ipoib_cm_add_mode_attr(priv->dev)) - goto sysfs_failed; - if (ipoib_add_pkey_attr(priv->dev)) -@@ -1924,7 +1947,6 @@ static struct net_device *ipoib_add_port(const char *format, - return priv->dev; - - sysfs_failed: -- ipoib_delete_debug_files(priv->dev); - unregister_netdev(priv->dev); - - register_failed: -@@ -2006,6 +2028,12 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data) - kfree(dev_list); - } - -+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG -+static struct notifier_block ipoib_netdev_notifier = { -+ .notifier_call = ipoib_netdev_event, -+}; -+#endif -+ - static int __init ipoib_init_module(void) - { - int ret; -@@ -2057,6 +2085,9 @@ static int __init ipoib_init_module(void) - if (ret) - goto err_client; - -+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG -+ register_netdevice_notifier(&ipoib_netdev_notifier); -+#endif - return 0; - - err_client: -@@ -2074,6 +2105,9 @@ err_fs: - - static void __exit ipoib_cleanup_module(void) - { -+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG -+ unregister_netdevice_notifier(&ipoib_netdev_notifier); -+#endif - ipoib_netlink_fini(); - ib_unregister_client(&ipoib_client); - ib_sa_unregister_client(&ipoib_sa_client); -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -index fca1a882de27..57a34f87dedf 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -@@ -85,8 +85,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv, - goto register_failed; - } - -- ipoib_create_debug_files(priv->dev); -- - /* RTNL childs don't need proprietary sysfs entries */ - if (type == IPOIB_LEGACY_CHILD) { - if (ipoib_cm_add_mode_attr(priv->dev)) -@@ -107,7 +105,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv, - - sysfs_failed: - result = -ENOMEM; -- ipoib_delete_debug_files(priv->dev); - unregister_netdevice(priv->dev); - - register_failed: -diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c -index 665bf3285618..32e76c5ee741 100644 ---- a/drivers/md/dm-era-target.c -+++ b/drivers/md/dm-era-target.c -@@ -961,15 +961,15 @@ static int metadata_commit(struct era_metadata *md) - } - } - -- r = save_sm_root(md); -+ r = dm_tm_pre_commit(md->tm); - if (r) { -- DMERR("%s: save_sm_root failed", __func__); -+ DMERR("%s: pre commit failed", __func__); - return r; - } - -- r = dm_tm_pre_commit(md->tm); -+ r = save_sm_root(md); - if (r) { -- DMERR("%s: pre commit failed", __func__); -+ DMERR("%s: save_sm_root failed", __func__); - return r; - } - -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 1e1bef349487..6decf4a95ce1 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -6351,12 +6351,13 @@ static u64 ath10k_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) - - static int ath10k_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct ath10k *ar = hw->priv; - struct ath10k_vif *arvif = ath10k_vif_to_arvif(vif); -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; - - ath10k_dbg(ar, ATH10K_DBG_MAC, "mac ampdu vdev_id %i sta %pM tid %hu action %d\n", - arvif->vdev_id, sta->addr, tid, action); -diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_main.c b/drivers/net/wireless/ath/ath9k/htc_drv_main.c -index a680a970b7f7..e4281438c04f 100644 ---- a/drivers/net/wireless/ath/ath9k/htc_drv_main.c -+++ b/drivers/net/wireless/ath/ath9k/htc_drv_main.c -@@ -1657,13 +1657,14 @@ static void ath9k_htc_reset_tsf(struct ieee80211_hw *hw, - - static int ath9k_htc_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, -- u16 tid, u16 *ssn, u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct ath9k_htc_priv *priv = hw->priv; - struct ath9k_htc_sta *ista; - int ret = 0; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; - - mutex_lock(&priv->mutex); - ath9k_htc_ps_wakeup(priv); -diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c -index b114e57a823f..3abc64574116 100644 ---- a/drivers/net/wireless/ath/ath9k/main.c -+++ b/drivers/net/wireless/ath/ath9k/main.c -@@ -1855,14 +1855,16 @@ static void ath9k_reset_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) - - static int ath9k_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, -- u16 tid, u16 *ssn, u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct ath_softc *sc = hw->priv; - struct ath_common *common = ath9k_hw_common(sc->sc_ah); - bool flush = false; - int ret = 0; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - - mutex_lock(&sc->mutex); - -diff --git a/drivers/net/wireless/ath/carl9170/main.c b/drivers/net/wireless/ath/carl9170/main.c -index 19d3d64416bf..4d1527a2e292 100644 ---- a/drivers/net/wireless/ath/carl9170/main.c -+++ b/drivers/net/wireless/ath/carl9170/main.c -@@ -1413,10 +1413,12 @@ static void carl9170_ampdu_work(struct work_struct *work) - - static int carl9170_op_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, -- u16 tid, u16 *ssn, u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - struct ar9170 *ar = hw->priv; - struct carl9170_sta_info *sta_info = (void *) sta->drv_priv; - struct carl9170_sta_tid *tid_info; -diff --git a/drivers/net/wireless/ath/wcn36xx/main.c b/drivers/net/wireless/ath/wcn36xx/main.c -index 7c169abdbafe..a27279c2c695 100644 ---- a/drivers/net/wireless/ath/wcn36xx/main.c -+++ b/drivers/net/wireless/ath/wcn36xx/main.c -@@ -857,12 +857,14 @@ static int wcn36xx_resume(struct ieee80211_hw *hw) - - static int wcn36xx_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct wcn36xx *wcn = hw->priv; - struct wcn36xx_sta *sta_priv = NULL; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - - wcn36xx_dbg(WCN36XX_DBG_MAC, "mac ampdu action action %d tid %d\n", - action, tid); -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c -index bec2dc1ca2e4..61ae2768132a 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/mac80211_if.c -@@ -818,13 +818,15 @@ brcms_ops_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - static int - brcms_ops_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct brcms_info *wl = hw->priv; - struct scb *scb = &wl->wlc->pri_scb; - int status; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u8 buf_size = params->buf_size; - - if (WARN_ON(scb->magic != SCB_MAGIC)) - return -EIDRM; -diff --git a/drivers/net/wireless/cw1200/sta.c b/drivers/net/wireless/cw1200/sta.c -index 95a7fdb3cc1c..c602a1e674ca 100644 ---- a/drivers/net/wireless/cw1200/sta.c -+++ b/drivers/net/wireless/cw1200/sta.c -@@ -2135,9 +2135,7 @@ void cw1200_mcast_timeout(unsigned long arg) - - int cw1200_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - /* Aggregation is implemented fully in firmware, - * including block ack negotiation. Do not allow -diff --git a/drivers/net/wireless/cw1200/sta.h b/drivers/net/wireless/cw1200/sta.h -index bebb3379017f..a0bacaa39b31 100644 ---- a/drivers/net/wireless/cw1200/sta.h -+++ b/drivers/net/wireless/cw1200/sta.h -@@ -109,9 +109,7 @@ void cw1200_bss_info_changed(struct ieee80211_hw *dev, - u32 changed); - int cw1200_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu); -+ struct ieee80211_ampdu_params *params); - - void cw1200_suspend_resume(struct cw1200_common *priv, - struct wsm_suspend_resume *arg); -diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c -index 6656215a13a9..04b0349a6ad9 100644 ---- a/drivers/net/wireless/iwlegacy/4965-mac.c -+++ b/drivers/net/wireless/iwlegacy/4965-mac.c -@@ -5982,12 +5982,14 @@ il4965_mac_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - - int - il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 * ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct il_priv *il = hw->priv; - int ret = -EINVAL; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - - D_HT("A-MPDU action on addr %pM tid %d\n", sta->addr, tid); - -diff --git a/drivers/net/wireless/iwlegacy/4965.h b/drivers/net/wireless/iwlegacy/4965.h -index 8ab8706f9422..e432715e02d8 100644 ---- a/drivers/net/wireless/iwlegacy/4965.h -+++ b/drivers/net/wireless/iwlegacy/4965.h -@@ -182,9 +182,7 @@ void il4965_mac_update_tkip_key(struct ieee80211_hw *hw, - struct ieee80211_sta *sta, u32 iv32, - u16 *phase1key); - int il4965_mac_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 * ssn, -- u8 buf_size, bool amsdu); -+ struct ieee80211_ampdu_params *params); - int il4965_mac_sta_add(struct ieee80211_hw *hw, struct ieee80211_vif *vif, - struct ieee80211_sta *sta); - void -diff --git a/drivers/net/wireless/iwlwifi/dvm/mac80211.c b/drivers/net/wireless/iwlwifi/dvm/mac80211.c -index b3ad34e8bf5a..1eb1a823a111 100644 ---- a/drivers/net/wireless/iwlwifi/dvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/dvm/mac80211.c -@@ -729,12 +729,15 @@ static inline bool iwl_enable_tx_ampdu(const struct iwl_cfg *cfg) - - static int iwlagn_mac_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct iwl_priv *priv = IWL_MAC80211_GET_DVM(hw); - int ret = -EINVAL; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; -+ u8 buf_size = params->buf_size; - struct iwl_station_priv *sta_priv = (void *) sta->drv_priv; - - IWL_DEBUG_HT(priv, "A-MPDU action on addr %pM tid %d\n", -diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -index ce12717e656a..1a8ea775de08 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -@@ -826,13 +826,16 @@ iwl_mvm_ampdu_check_trigger(struct iwl_mvm *mvm, struct ieee80211_vif *vif, - - static int iwl_mvm_mac_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, -- u16 *ssn, u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct iwl_mvm *mvm = IWL_MAC80211_GET_MVM(hw); - int ret; - bool tx_agg_ref = false; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; -+ u8 buf_size = params->buf_size; - - IWL_DEBUG_HT(mvm, "A-MPDU action on addr %pM tid %d: action %d\n", - sta->addr, tid, action); -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 0cd95120bc78..d59769e858f4 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -1817,10 +1817,12 @@ static int mac80211_hwsim_testmode_cmd(struct ieee80211_hw *hw, - - static int mac80211_hwsim_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ - switch (action) { - case IEEE80211_AMPDU_TX_START: - ieee80211_start_tx_ba_cb_irqsafe(vif, sta->addr, tid); -diff --git a/drivers/net/wireless/mediatek/mt7601u/main.c b/drivers/net/wireless/mediatek/mt7601u/main.c -index f715eee39851..e70dd9523911 100644 ---- a/drivers/net/wireless/mediatek/mt7601u/main.c -+++ b/drivers/net/wireless/mediatek/mt7601u/main.c -@@ -334,11 +334,13 @@ static int mt7601u_set_rts_threshold(struct ieee80211_hw *hw, u32 value) - - static int - mt76_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, u8 buf_size, -- bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct mt7601u_dev *dev = hw->priv; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - struct mt76_sta *msta = (struct mt76_sta *) sta->drv_priv; - - WARN_ON(msta->wcid.idx > GROUP_WCID(0)); -diff --git a/drivers/net/wireless/mwl8k.c b/drivers/net/wireless/mwl8k.c -index 30e3aaae32e2..088429d0a634 100644 ---- a/drivers/net/wireless/mwl8k.c -+++ b/drivers/net/wireless/mwl8k.c -@@ -5421,11 +5421,13 @@ static int mwl8k_get_survey(struct ieee80211_hw *hw, int idx, - - static int - mwl8k_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { -- -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; -+ u8 buf_size = params->buf_size; - int i, rc = 0; - struct mwl8k_priv *priv = hw->priv; - struct mwl8k_ampdu_stream *stream; -diff --git a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -index 6aed923a709a..7d820c395375 100644 ---- a/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -+++ b/drivers/net/wireless/realtek/rtl8xxxu/rtl8xxxu.c -@@ -5375,13 +5375,13 @@ static int rtl8xxxu_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd, - - static int - rtl8xxxu_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, u8 buf_size, -- bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct rtl8xxxu_priv *priv = hw->priv; - struct device *dev = &priv->udev->dev; - u8 ampdu_factor, ampdu_density; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; - - switch (action) { - case IEEE80211_AMPDU_TX_START: -diff --git a/drivers/net/wireless/realtek/rtlwifi/core.c b/drivers/net/wireless/realtek/rtlwifi/core.c -index e36d8c456275..8b537a5a4b01 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/core.c -+++ b/drivers/net/wireless/realtek/rtlwifi/core.c -@@ -1369,11 +1369,13 @@ static void rtl_op_sta_notify(struct ieee80211_hw *hw, - - static int rtl_op_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct rtl_priv *rtlpriv = rtl_priv(hw); -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - - switch (action) { - case IEEE80211_AMPDU_TX_START: -diff --git a/drivers/net/wireless/rsi/rsi_91x_mac80211.c b/drivers/net/wireless/rsi/rsi_91x_mac80211.c -index b5bcc933a2a6..4df992de7d07 100644 ---- a/drivers/net/wireless/rsi/rsi_91x_mac80211.c -+++ b/drivers/net/wireless/rsi/rsi_91x_mac80211.c -@@ -659,29 +659,24 @@ static int rsi_mac80211_set_key(struct ieee80211_hw *hw, - * informs the f/w regarding this. - * @hw: Pointer to the ieee80211_hw structure. - * @vif: Pointer to the ieee80211_vif structure. -- * @action: ieee80211_ampdu_mlme_action enum. -- * @sta: Pointer to the ieee80211_sta structure. -- * @tid: Traffic identifier. -- * @ssn: Pointer to ssn value. -- * @buf_size: Buffer size (for kernel version > 2.6.38). -- * @amsdu: is AMSDU in AMPDU allowed -+ * @params: Pointer to A-MPDU action parameters - * - * Return: status: 0 on success, negative error code on failure. - */ - static int rsi_mac80211_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, -- unsigned short tid, -- unsigned short *ssn, -- unsigned char buf_size, -- bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - int status = -EOPNOTSUPP; - struct rsi_hw *adapter = hw->priv; - struct rsi_common *common = adapter->priv; - u16 seq_no = 0; - u8 ii = 0; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; -+ u8 buf_size = params->buf_size; - - for (ii = 0; ii < RSI_MAX_VIFS; ii++) { - if (vif == adapter->vifs[ii]) -diff --git a/drivers/net/wireless/rt2x00/rt2800lib.c b/drivers/net/wireless/rt2x00/rt2800lib.c -index 9733b31a780d..69c1c09687a3 100644 ---- a/drivers/net/wireless/rt2x00/rt2800lib.c -+++ b/drivers/net/wireless/rt2x00/rt2800lib.c -@@ -7935,10 +7935,11 @@ u64 rt2800_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif) - EXPORT_SYMBOL_GPL(rt2800_get_tsf); - - int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; - struct rt2x00_sta *sta_priv = (struct rt2x00_sta *)sta->drv_priv; - int ret = 0; - -diff --git a/drivers/net/wireless/rt2x00/rt2800lib.h b/drivers/net/wireless/rt2x00/rt2800lib.h -index 440790b92b19..83f1a44fb9b4 100644 ---- a/drivers/net/wireless/rt2x00/rt2800lib.h -+++ b/drivers/net/wireless/rt2x00/rt2800lib.h -@@ -218,9 +218,7 @@ int rt2800_conf_tx(struct ieee80211_hw *hw, - const struct ieee80211_tx_queue_params *params); - u64 rt2800_get_tsf(struct ieee80211_hw *hw, struct ieee80211_vif *vif); - int rt2800_ampdu_action(struct ieee80211_hw *hw, struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu); -+ struct ieee80211_ampdu_params *params); - int rt2800_get_survey(struct ieee80211_hw *hw, int idx, - struct survey_info *survey); - void rt2800_disable_wpdma(struct rt2x00_dev *rt2x00dev); -diff --git a/drivers/net/wireless/ti/wl18xx/event.c b/drivers/net/wireless/ti/wl18xx/event.c -index 09c7e098f460..085ef5c87262 100644 ---- a/drivers/net/wireless/ti/wl18xx/event.c -+++ b/drivers/net/wireless/ti/wl18xx/event.c -@@ -206,5 +206,33 @@ int wl18xx_process_mailbox_events(struct wl1271 *wl) - mbox->sc_pwd_len, - mbox->sc_pwd); - -+ if (vector & RX_BA_WIN_SIZE_CHANGE_EVENT_ID) { -+ struct wl12xx_vif *wlvif; -+ struct ieee80211_vif *vif; -+ struct ieee80211_sta *sta; -+ u8 link_id = mbox->rx_ba_link_id; -+ u8 win_size = mbox->rx_ba_win_size; -+ const u8 *addr; -+ -+ wlvif = wl->links[link_id].wlvif; -+ vif = wl12xx_wlvif_to_vif(wlvif); -+ -+ /* Update RX aggregation window size and call -+ * MAC routine to stop active RX aggregations for this link -+ */ -+ if (wlvif->bss_type != BSS_TYPE_AP_BSS) -+ addr = vif->bss_conf.bssid; -+ else -+ addr = wl->links[link_id].addr; -+ -+ sta = ieee80211_find_sta(vif, addr); -+ if (sta) { -+ sta->max_rx_aggregation_subframes = win_size; -+ ieee80211_stop_rx_ba_session(vif, -+ wl->links[link_id].ba_bitmap, -+ addr); -+ } -+ } -+ - return 0; - } -diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h -index f3d4f13379cb..9495fadc8093 100644 ---- a/drivers/net/wireless/ti/wl18xx/event.h -+++ b/drivers/net/wireless/ti/wl18xx/event.h -@@ -38,6 +38,7 @@ enum { - REMAIN_ON_CHANNEL_COMPLETE_EVENT_ID = BIT(18), - DFS_CHANNELS_CONFIG_COMPLETE_EVENT = BIT(19), - PERIODIC_SCAN_REPORT_EVENT_ID = BIT(20), -+ RX_BA_WIN_SIZE_CHANGE_EVENT_ID = BIT(21), - SMART_CONFIG_SYNC_EVENT_ID = BIT(22), - SMART_CONFIG_DECODE_EVENT_ID = BIT(23), - TIME_SYNC_EVENT_ID = BIT(24), -diff --git a/drivers/net/wireless/ti/wl18xx/main.c b/drivers/net/wireless/ti/wl18xx/main.c -index 50cce42089a5..47f355e92193 100644 ---- a/drivers/net/wireless/ti/wl18xx/main.c -+++ b/drivers/net/wireless/ti/wl18xx/main.c -@@ -1029,7 +1029,8 @@ static int wl18xx_boot(struct wl1271 *wl) - DFS_CHANNELS_CONFIG_COMPLETE_EVENT | - SMART_CONFIG_SYNC_EVENT_ID | - SMART_CONFIG_DECODE_EVENT_ID | -- TIME_SYNC_EVENT_ID; -+ TIME_SYNC_EVENT_ID | -+ RX_BA_WIN_SIZE_CHANGE_EVENT_ID; - - wl->ap_event_mask = MAX_TX_FAILURE_EVENT_ID; - -diff --git a/drivers/net/wireless/ti/wlcore/acx.c b/drivers/net/wireless/ti/wlcore/acx.c -index f28fa3b5029d..0646c9b6f8d7 100644 ---- a/drivers/net/wireless/ti/wlcore/acx.c -+++ b/drivers/net/wireless/ti/wlcore/acx.c -@@ -1419,7 +1419,8 @@ out: - - /* setup BA session receiver setting in the FW. */ - int wl12xx_acx_set_ba_receiver_session(struct wl1271 *wl, u8 tid_index, -- u16 ssn, bool enable, u8 peer_hlid) -+ u16 ssn, bool enable, u8 peer_hlid, -+ u8 win_size) - { - struct wl1271_acx_ba_receiver_setup *acx; - int ret; -@@ -1435,7 +1436,7 @@ int wl12xx_acx_set_ba_receiver_session(struct wl1271 *wl, u8 tid_index, - acx->hlid = peer_hlid; - acx->tid = tid_index; - acx->enable = enable; -- acx->win_size = wl->conf.ht.rx_ba_win_size; -+ acx->win_size = win_size; - acx->ssn = ssn; - - ret = wlcore_cmd_configure_failsafe(wl, ACX_BA_SESSION_RX_SETUP, acx, -diff --git a/drivers/net/wireless/ti/wlcore/acx.h b/drivers/net/wireless/ti/wlcore/acx.h -index 954d57ec98f4..524aea495dff 100644 ---- a/drivers/net/wireless/ti/wlcore/acx.h -+++ b/drivers/net/wireless/ti/wlcore/acx.h -@@ -1112,7 +1112,8 @@ int wl1271_acx_set_ht_information(struct wl1271 *wl, - int wl12xx_acx_set_ba_initiator_policy(struct wl1271 *wl, - struct wl12xx_vif *wlvif); - int wl12xx_acx_set_ba_receiver_session(struct wl1271 *wl, u8 tid_index, -- u16 ssn, bool enable, u8 peer_hlid); -+ u16 ssn, bool enable, u8 peer_hlid, -+ u8 win_size); - int wl12xx_acx_tsf_info(struct wl1271 *wl, struct wl12xx_vif *wlvif, - u64 *mactime); - int wl1271_acx_ps_rx_streaming(struct wl1271 *wl, struct wl12xx_vif *wlvif, -diff --git a/drivers/net/wireless/ti/wlcore/main.c b/drivers/net/wireless/ti/wlcore/main.c -index ec7f6af3fab2..7b27c7e23af2 100644 ---- a/drivers/net/wireless/ti/wlcore/main.c -+++ b/drivers/net/wireless/ti/wlcore/main.c -@@ -5261,14 +5261,16 @@ out: - - static int wl1271_op_ampdu_action(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - struct wl1271 *wl = hw->priv; - struct wl12xx_vif *wlvif = wl12xx_vif_to_data(vif); - int ret; - u8 hlid, *ba_bitmap; -+ struct ieee80211_sta *sta = params->sta; -+ enum ieee80211_ampdu_mlme_action action = params->action; -+ u16 tid = params->tid; -+ u16 *ssn = ¶ms->ssn; - - wl1271_debug(DEBUG_MAC80211, "mac80211 ampdu action %d tid %d", action, - tid); -@@ -5326,7 +5328,9 @@ static int wl1271_op_ampdu_action(struct ieee80211_hw *hw, - } - - ret = wl12xx_acx_set_ba_receiver_session(wl, tid, *ssn, true, -- hlid); -+ hlid, -+ params->buf_size); -+ - if (!ret) { - *ba_bitmap |= BIT(tid); - wl->ba_rx_session_count++; -@@ -5347,7 +5351,7 @@ static int wl1271_op_ampdu_action(struct ieee80211_hw *hw, - } - - ret = wl12xx_acx_set_ba_receiver_session(wl, tid, 0, false, -- hlid); -+ hlid, 0); - if (!ret) { - *ba_bitmap &= ~BIT(tid); - wl->ba_rx_session_count--; -diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c -index b87192e0f9aa..109becdabc24 100644 ---- a/drivers/staging/comedi/drivers/jr3_pci.c -+++ b/drivers/staging/comedi/drivers/jr3_pci.c -@@ -610,7 +610,7 @@ static void jr3_pci_poll_dev(unsigned long data) - s = &dev->subdevices[i]; - spriv = s->private; - -- if (now > spriv->next_time_min) { -+ if (time_after_eq(now, spriv->next_time_min)) { - struct jr3_pci_poll_delay sub_delay; - - sub_delay = jr3_pci_poll_subdevice(s); -@@ -726,11 +726,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev, - s->insn_read = jr3_pci_ai_insn_read; - - spriv = jr3_pci_alloc_spriv(dev, s); -- if (spriv) { -- /* Channel specific range and maxdata */ -- s->range_table_list = spriv->range_table_list; -- s->maxdata_list = spriv->maxdata_list; -- } -+ if (!spriv) -+ return -ENOMEM; -+ -+ /* Channel specific range and maxdata */ -+ s->range_table_list = spriv->range_table_list; -+ s->maxdata_list = spriv->maxdata_list; - } - - /* Reset DSP card */ -diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c -index 445f83615575..fb4f3fea6c66 100644 ---- a/drivers/staging/gdm724x/gdm_mux.c -+++ b/drivers/staging/gdm724x/gdm_mux.c -@@ -670,14 +670,14 @@ static int __init gdm_usb_mux_init(void) - - static void __exit gdm_usb_mux_exit(void) - { -- unregister_lte_tty_driver(); -- - if (mux_rx_wq) { - flush_workqueue(mux_rx_wq); - destroy_workqueue(mux_rx_wq); - } - - usb_deregister(&gdm_mux_driver); -+ unregister_lte_tty_driver(); -+ - } - - module_init(gdm_usb_mux_init); -diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c -index c975c3b87093..cfc3017fd64a 100644 ---- a/drivers/staging/vt6656/usbpipe.c -+++ b/drivers/staging/vt6656/usbpipe.c -@@ -50,15 +50,25 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value, - u16 index, u16 length, u8 *buffer) - { - int status = 0; -+ u8 *usb_buffer; - - if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags)) - return STATUS_FAILURE; - - mutex_lock(&priv->usb_lock); - -+ usb_buffer = kmemdup(buffer, length, GFP_KERNEL); -+ if (!usb_buffer) { -+ mutex_unlock(&priv->usb_lock); -+ return -ENOMEM; -+ } -+ - status = usb_control_msg(priv->usb, -- usb_sndctrlpipe(priv->usb, 0), request, 0x40, value, -- index, buffer, length, USB_CTL_WAIT); -+ usb_sndctrlpipe(priv->usb, 0), -+ request, 0x40, value, -+ index, usb_buffer, length, USB_CTL_WAIT); -+ -+ kfree(usb_buffer); - - mutex_unlock(&priv->usb_lock); - -@@ -78,15 +88,28 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value, - u16 index, u16 length, u8 *buffer) - { - int status; -+ u8 *usb_buffer; - - if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags)) - return STATUS_FAILURE; - - mutex_lock(&priv->usb_lock); - -+ usb_buffer = kmalloc(length, GFP_KERNEL); -+ if (!usb_buffer) { -+ mutex_unlock(&priv->usb_lock); -+ return -ENOMEM; -+ } -+ - status = usb_control_msg(priv->usb, -- usb_rcvctrlpipe(priv->usb, 0), request, 0xc0, value, -- index, buffer, length, USB_CTL_WAIT); -+ usb_rcvctrlpipe(priv->usb, 0), -+ request, 0xc0, value, -+ index, usb_buffer, length, USB_CTL_WAIT); -+ -+ if (status == length) -+ memcpy(buffer, usb_buffer, length); -+ -+ kfree(usb_buffer); - - mutex_unlock(&priv->usb_lock); - -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 6ed80b05d674..200d3de8bc1e 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -4821,6 +4821,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force) - continue; - } - atomic_set(&sess->session_reinstatement, 1); -+ atomic_set(&sess->session_fall_back_to_erl0, 1); - spin_unlock(&sess->conn_lock); - - list_move_tail(&se_sess->sess_list, &free_list); -diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c -index b4bfd706ac94..dc1bd1f1bdfe 100644 ---- a/drivers/target/iscsi/iscsi_target_configfs.c -+++ b/drivers/target/iscsi/iscsi_target_configfs.c -@@ -725,11 +725,8 @@ static ssize_t lio_target_nacl_cmdsn_depth_store(struct config_item *item, - - if (iscsit_get_tpg(tpg) < 0) - return -EINVAL; -- /* -- * iscsit_tpg_set_initiator_node_queue_depth() assumes force=1 -- */ -- ret = iscsit_tpg_set_initiator_node_queue_depth(tpg, -- config_item_name(acl_ci), cmdsn_depth, 1); -+ -+ ret = core_tpg_set_initiator_node_queue_depth(se_nacl, cmdsn_depth); - - pr_debug("LIO_Target_ConfigFS: %s/%s Set CmdSN Window: %u for" - "InitiatorName: %s\n", config_item_name(wwn_ci), -@@ -1593,42 +1590,31 @@ static int lio_tpg_check_prot_fabric_only( - } - - /* -- * Called with spin_lock_irq(struct se_portal_group->session_lock) held -- * or not held. -- * -- * Also, this function calls iscsit_inc_session_usage_count() on the -+ * This function calls iscsit_inc_session_usage_count() on the - * struct iscsi_session in question. - */ - static int lio_tpg_shutdown_session(struct se_session *se_sess) - { - struct iscsi_session *sess = se_sess->fabric_sess_ptr; -- struct se_portal_group *se_tpg = se_sess->se_tpg; -- bool local_lock = false; -- -- if (!spin_is_locked(&se_tpg->session_lock)) { -- spin_lock_irq(&se_tpg->session_lock); -- local_lock = true; -- } -+ struct se_portal_group *se_tpg = &sess->tpg->tpg_se_tpg; - -+ spin_lock_bh(&se_tpg->session_lock); - spin_lock(&sess->conn_lock); - if (atomic_read(&sess->session_fall_back_to_erl0) || - atomic_read(&sess->session_logout) || - (sess->time2retain_timer_flags & ISCSI_TF_EXPIRED)) { - spin_unlock(&sess->conn_lock); -- if (local_lock) -- spin_unlock_irq(&sess->conn_lock); -+ spin_unlock_bh(&se_tpg->session_lock); - return 0; - } - atomic_set(&sess->session_reinstatement, 1); -+ atomic_set(&sess->session_fall_back_to_erl0, 1); - spin_unlock(&sess->conn_lock); - - iscsit_stop_time2retain_timer(sess); -- spin_unlock_irq(&se_tpg->session_lock); -+ spin_unlock_bh(&se_tpg->session_lock); - - iscsit_stop_session(sess, 1, 1); -- if (!local_lock) -- spin_lock_irq(&se_tpg->session_lock); -- - return 1; - } - -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index 316f66172335..4a137b0ae3dc 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -195,6 +195,7 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn) - initiatorname_param->value) && - (sess_p->sess_ops->SessionType == sessiontype))) { - atomic_set(&sess_p->session_reinstatement, 1); -+ atomic_set(&sess_p->session_fall_back_to_erl0, 1); - spin_unlock(&sess_p->conn_lock); - iscsit_inc_session_usage_count(sess_p); - iscsit_stop_time2retain_timer(sess_p); -diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c -index 68261b7dcefe..205a509b0dfb 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.c -+++ b/drivers/target/iscsi/iscsi_target_tpg.c -@@ -589,16 +589,6 @@ int iscsit_tpg_del_network_portal( - return iscsit_tpg_release_np(tpg_np, tpg, np); - } - --int iscsit_tpg_set_initiator_node_queue_depth( -- struct iscsi_portal_group *tpg, -- unsigned char *initiatorname, -- u32 queue_depth, -- int force) --{ -- return core_tpg_set_initiator_node_queue_depth(&tpg->tpg_se_tpg, -- initiatorname, queue_depth, force); --} -- - int iscsit_ta_authentication(struct iscsi_portal_group *tpg, u32 authentication) - { - unsigned char buf1[256], buf2[256], *none = NULL; -diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h -index 9db32bd24cd4..2da211920c18 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.h -+++ b/drivers/target/iscsi/iscsi_target_tpg.h -@@ -26,8 +26,6 @@ extern struct iscsi_tpg_np *iscsit_tpg_add_network_portal(struct iscsi_portal_gr - int); - extern int iscsit_tpg_del_network_portal(struct iscsi_portal_group *, - struct iscsi_tpg_np *); --extern int iscsit_tpg_set_initiator_node_queue_depth(struct iscsi_portal_group *, -- unsigned char *, u32, int); - extern int iscsit_ta_authentication(struct iscsi_portal_group *, u32); - extern int iscsit_ta_login_timeout(struct iscsi_portal_group *, u32); - extern int iscsit_ta_netif_timeout(struct iscsi_portal_group *, u32); -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 79291869bce6..041a56987845 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -594,8 +594,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents, - if (ret < 0) - return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - -- if (ret) -- target_complete_cmd(cmd, SAM_STAT_GOOD); -+ target_complete_cmd(cmd, SAM_STAT_GOOD); - return 0; - } - -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index 90c5dffc9fa4..608117819366 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -498,8 +498,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes - * been failed with a non-zero SCSI status. - */ - if (cmd->scsi_status) { -- pr_err("compare_and_write_callback: non zero scsi_status:" -+ pr_debug("compare_and_write_callback: non zero scsi_status:" - " 0x%02x\n", cmd->scsi_status); -+ *post_ret = 1; -+ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) -+ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - goto out; - } - -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index 2794c6ec5c3c..899c33b3c734 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -169,28 +169,25 @@ void core_tpg_add_node_to_devs( - mutex_unlock(&tpg->tpg_lun_mutex); - } - --/* core_set_queue_depth_for_node(): -- * -- * -- */ --static int core_set_queue_depth_for_node( -- struct se_portal_group *tpg, -- struct se_node_acl *acl) -+static void -+target_set_nacl_queue_depth(struct se_portal_group *tpg, -+ struct se_node_acl *acl, u32 queue_depth) - { -+ acl->queue_depth = queue_depth; -+ - if (!acl->queue_depth) { -- pr_err("Queue depth for %s Initiator Node: %s is 0," -+ pr_warn("Queue depth for %s Initiator Node: %s is 0," - "defaulting to 1.\n", tpg->se_tpg_tfo->get_fabric_name(), - acl->initiatorname); - acl->queue_depth = 1; - } -- -- return 0; - } - - static struct se_node_acl *target_alloc_node_acl(struct se_portal_group *tpg, - const unsigned char *initiatorname) - { - struct se_node_acl *acl; -+ u32 queue_depth; - - acl = kzalloc(max(sizeof(*acl), tpg->se_tpg_tfo->node_acl_size), - GFP_KERNEL); -@@ -205,24 +202,20 @@ static struct se_node_acl *target_alloc_node_acl(struct se_portal_group *tpg, - spin_lock_init(&acl->nacl_sess_lock); - mutex_init(&acl->lun_entry_mutex); - atomic_set(&acl->acl_pr_ref_count, 0); -+ - if (tpg->se_tpg_tfo->tpg_get_default_depth) -- acl->queue_depth = tpg->se_tpg_tfo->tpg_get_default_depth(tpg); -+ queue_depth = tpg->se_tpg_tfo->tpg_get_default_depth(tpg); - else -- acl->queue_depth = 1; -+ queue_depth = 1; -+ target_set_nacl_queue_depth(tpg, acl, queue_depth); -+ - snprintf(acl->initiatorname, TRANSPORT_IQN_LEN, "%s", initiatorname); - acl->se_tpg = tpg; - acl->acl_index = scsi_get_new_index(SCSI_AUTH_INTR_INDEX); - - tpg->se_tpg_tfo->set_default_node_attributes(acl); - -- if (core_set_queue_depth_for_node(tpg, acl) < 0) -- goto out_free_acl; -- - return acl; -- --out_free_acl: -- kfree(acl); -- return NULL; - } - - static void target_add_node_acl(struct se_node_acl *acl) -@@ -369,7 +362,8 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl) - if (sess->sess_tearing_down != 0) - continue; - -- target_get_session(sess); -+ if (!target_get_session(sess)) -+ continue; - list_move(&sess->sess_acl_list, &sess_list); - } - spin_unlock_irqrestore(&acl->nacl_sess_lock, flags); -@@ -406,108 +400,52 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl) - * - */ - int core_tpg_set_initiator_node_queue_depth( -- struct se_portal_group *tpg, -- unsigned char *initiatorname, -- u32 queue_depth, -- int force) -+ struct se_node_acl *acl, -+ u32 queue_depth) - { -- struct se_session *sess, *init_sess = NULL; -- struct se_node_acl *acl; -+ LIST_HEAD(sess_list); -+ struct se_portal_group *tpg = acl->se_tpg; -+ struct se_session *sess, *sess_tmp; - unsigned long flags; -- int dynamic_acl = 0; -- -- mutex_lock(&tpg->acl_node_mutex); -- acl = __core_tpg_get_initiator_node_acl(tpg, initiatorname); -- if (!acl) { -- pr_err("Access Control List entry for %s Initiator" -- " Node %s does not exists for TPG %hu, ignoring" -- " request.\n", tpg->se_tpg_tfo->get_fabric_name(), -- initiatorname, tpg->se_tpg_tfo->tpg_get_tag(tpg)); -- mutex_unlock(&tpg->acl_node_mutex); -- return -ENODEV; -- } -- if (acl->dynamic_node_acl) { -- acl->dynamic_node_acl = 0; -- dynamic_acl = 1; -- } -- mutex_unlock(&tpg->acl_node_mutex); -- -- spin_lock_irqsave(&tpg->session_lock, flags); -- list_for_each_entry(sess, &tpg->tpg_sess_list, sess_list) { -- if (sess->se_node_acl != acl) -- continue; -- -- if (!force) { -- pr_err("Unable to change queue depth for %s" -- " Initiator Node: %s while session is" -- " operational. To forcefully change the queue" -- " depth and force session reinstatement" -- " use the \"force=1\" parameter.\n", -- tpg->se_tpg_tfo->get_fabric_name(), initiatorname); -- spin_unlock_irqrestore(&tpg->session_lock, flags); -- -- mutex_lock(&tpg->acl_node_mutex); -- if (dynamic_acl) -- acl->dynamic_node_acl = 1; -- mutex_unlock(&tpg->acl_node_mutex); -- return -EEXIST; -- } -- /* -- * Determine if the session needs to be closed by our context. -- */ -- if (!tpg->se_tpg_tfo->shutdown_session(sess)) -- continue; -- -- init_sess = sess; -- break; -- } -+ int rc; - - /* - * User has requested to change the queue depth for a Initiator Node. - * Change the value in the Node's struct se_node_acl, and call -- * core_set_queue_depth_for_node() to add the requested queue depth. -- * -- * Finally call tpg->se_tpg_tfo->close_session() to force session -- * reinstatement to occur if there is an active session for the -- * $FABRIC_MOD Initiator Node in question. -+ * target_set_nacl_queue_depth() to set the new queue depth. - */ -- acl->queue_depth = queue_depth; -+ target_set_nacl_queue_depth(tpg, acl, queue_depth); -+ -+ spin_lock_irqsave(&acl->nacl_sess_lock, flags); -+ list_for_each_entry_safe(sess, sess_tmp, &acl->acl_sess_list, -+ sess_acl_list) { -+ if (sess->sess_tearing_down != 0) -+ continue; -+ if (!target_get_session(sess)) -+ continue; -+ spin_unlock_irqrestore(&acl->nacl_sess_lock, flags); - -- if (core_set_queue_depth_for_node(tpg, acl) < 0) { -- spin_unlock_irqrestore(&tpg->session_lock, flags); - /* -- * Force session reinstatement if -- * core_set_queue_depth_for_node() failed, because we assume -- * the $FABRIC_MOD has already the set session reinstatement -- * bit from tpg->se_tpg_tfo->shutdown_session() called above. -+ * Finally call tpg->se_tpg_tfo->close_session() to force session -+ * reinstatement to occur if there is an active session for the -+ * $FABRIC_MOD Initiator Node in question. - */ -- if (init_sess) -- tpg->se_tpg_tfo->close_session(init_sess); -- -- mutex_lock(&tpg->acl_node_mutex); -- if (dynamic_acl) -- acl->dynamic_node_acl = 1; -- mutex_unlock(&tpg->acl_node_mutex); -- return -EINVAL; -+ rc = tpg->se_tpg_tfo->shutdown_session(sess); -+ target_put_session(sess); -+ if (!rc) { -+ spin_lock_irqsave(&acl->nacl_sess_lock, flags); -+ continue; -+ } -+ target_put_session(sess); -+ spin_lock_irqsave(&acl->nacl_sess_lock, flags); - } -- spin_unlock_irqrestore(&tpg->session_lock, flags); -- /* -- * If the $FABRIC_MOD session for the Initiator Node ACL exists, -- * forcefully shutdown the $FABRIC_MOD session/nexus. -- */ -- if (init_sess) -- tpg->se_tpg_tfo->close_session(init_sess); -+ spin_unlock_irqrestore(&acl->nacl_sess_lock, flags); - - pr_debug("Successfully changed queue depth to: %d for Initiator" -- " Node: %s on %s Target Portal Group: %u\n", queue_depth, -- initiatorname, tpg->se_tpg_tfo->get_fabric_name(), -+ " Node: %s on %s Target Portal Group: %u\n", acl->queue_depth, -+ acl->initiatorname, tpg->se_tpg_tfo->get_fabric_name(), - tpg->se_tpg_tfo->tpg_get_tag(tpg)); - -- mutex_lock(&tpg->acl_node_mutex); -- if (dynamic_acl) -- acl->dynamic_node_acl = 1; -- mutex_unlock(&tpg->acl_node_mutex); -- - return 0; - } - EXPORT_SYMBOL(core_tpg_set_initiator_node_queue_depth); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index df2059984e14..af301414a9f3 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -383,9 +383,9 @@ static void target_release_session(struct kref *kref) - se_tpg->se_tpg_tfo->close_session(se_sess); - } - --void target_get_session(struct se_session *se_sess) -+int target_get_session(struct se_session *se_sess) - { -- kref_get(&se_sess->sess_kref); -+ return kref_get_unless_zero(&se_sess->sess_kref); - } - EXPORT_SYMBOL(target_get_session); - -diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c -index 807d80145686..96aa0ad32497 100644 ---- a/drivers/tty/pty.c -+++ b/drivers/tty/pty.c -@@ -216,16 +216,11 @@ static int pty_signal(struct tty_struct *tty, int sig) - static void pty_flush_buffer(struct tty_struct *tty) - { - struct tty_struct *to = tty->link; -- struct tty_ldisc *ld; - - if (!to) - return; - -- ld = tty_ldisc_ref(to); -- tty_buffer_flush(to, ld); -- if (ld) -- tty_ldisc_deref(ld); -- -+ tty_buffer_flush(to, NULL); - if (to->packet) { - spin_lock_irq(&tty->ctrl_lock); - tty->ctrl_status |= TIOCPKT_FLUSHWRITE; -diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c -index 24280d9a05e9..de1c143b475f 100644 ---- a/drivers/tty/serial/omap-serial.c -+++ b/drivers/tty/serial/omap-serial.c -@@ -1712,7 +1712,8 @@ static int serial_omap_probe(struct platform_device *pdev) - return 0; - - err_add_port: -- pm_runtime_put(&pdev->dev); -+ pm_runtime_dont_use_autosuspend(&pdev->dev); -+ pm_runtime_put_sync(&pdev->dev); - pm_runtime_disable(&pdev->dev); - pm_qos_remove_request(&up->pm_qos_request); - device_init_wakeup(up->dev, false); -@@ -1725,9 +1726,13 @@ static int serial_omap_remove(struct platform_device *dev) - { - struct uart_omap_port *up = platform_get_drvdata(dev); - -+ pm_runtime_get_sync(up->dev); -+ -+ uart_remove_one_port(&serial_omap_reg, &up->port); -+ -+ pm_runtime_dont_use_autosuspend(up->dev); - pm_runtime_put_sync(up->dev); - pm_runtime_disable(up->dev); -- uart_remove_one_port(&serial_omap_reg, &up->port); - pm_qos_remove_request(&up->pm_qos_request); - device_init_wakeup(&dev->dev, false); - -diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c -index 6deb06147202..e6bc1a6be4a4 100644 ---- a/drivers/tty/serial/samsung.c -+++ b/drivers/tty/serial/samsung.c -@@ -900,14 +900,13 @@ static int s3c24xx_serial_request_dma(struct s3c24xx_uart_port *p) - return -ENOMEM; - } - -- dma->rx_addr = dma_map_single(dma->rx_chan->device->dev, dma->rx_buf, -+ dma->rx_addr = dma_map_single(p->port.dev, dma->rx_buf, - dma->rx_size, DMA_FROM_DEVICE); - - spin_lock_irqsave(&p->port.lock, flags); - - /* TX buffer */ -- dma->tx_addr = dma_map_single(dma->tx_chan->device->dev, -- p->port.state->xmit.buf, -+ dma->tx_addr = dma_map_single(p->port.dev, p->port.state->xmit.buf, - UART_XMIT_SIZE, DMA_TO_DEVICE); - - spin_unlock_irqrestore(&p->port.lock, flags); -@@ -921,7 +920,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p) - - if (dma->rx_chan) { - dmaengine_terminate_all(dma->rx_chan); -- dma_unmap_single(dma->rx_chan->device->dev, dma->rx_addr, -+ dma_unmap_single(p->port.dev, dma->rx_addr, - dma->rx_size, DMA_FROM_DEVICE); - kfree(dma->rx_buf); - dma_release_channel(dma->rx_chan); -@@ -930,7 +929,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p) - - if (dma->tx_chan) { - dmaengine_terminate_all(dma->tx_chan); -- dma_unmap_single(dma->tx_chan->device->dev, dma->tx_addr, -+ dma_unmap_single(p->port.dev, dma->tx_addr, - UART_XMIT_SIZE, DMA_TO_DEVICE); - dma_release_channel(dma->tx_chan); - dma->tx_chan = NULL; -diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c -index dadd1e8dfe09..0bb380a9fcf7 100644 ---- a/drivers/usb/core/driver.c -+++ b/drivers/usb/core/driver.c -@@ -1328,6 +1328,24 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg) - */ - if (udev->parent && !PMSG_IS_AUTO(msg)) - status = 0; -+ -+ /* -+ * If the device is inaccessible, don't try to resume -+ * suspended interfaces and just return the error. -+ */ -+ if (status && status != -EBUSY) { -+ int err; -+ u16 devstat; -+ -+ err = usb_get_status(udev, USB_RECIP_DEVICE, 0, -+ &devstat); -+ if (err) { -+ dev_err(&udev->dev, -+ "Failed to suspend device, error %d\n", -+ status); -+ goto done; -+ } -+ } - } - - /* If the suspend failed, resume interfaces that did get suspended */ -@@ -1760,6 +1778,9 @@ static int autosuspend_check(struct usb_device *udev) - int w, i; - struct usb_interface *intf; - -+ if (udev->state == USB_STATE_NOTATTACHED) -+ return -ENODEV; -+ - /* Fail if autosuspend is disabled, or any interfaces are in use, or - * any interface drivers require remote wakeup but it isn't available. - */ -diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c -index ea337a718cc1..b3de806085f0 100644 ---- a/drivers/usb/core/file.c -+++ b/drivers/usb/core/file.c -@@ -26,6 +26,7 @@ - #define MAX_USB_MINORS 256 - static const struct file_operations *usb_minors[MAX_USB_MINORS]; - static DECLARE_RWSEM(minor_rwsem); -+static DEFINE_MUTEX(init_usb_class_mutex); - - static int usb_open(struct inode *inode, struct file *file) - { -@@ -108,8 +109,9 @@ static void release_usb_class(struct kref *kref) - - static void destroy_usb_class(void) - { -- if (usb_class) -- kref_put(&usb_class->kref, release_usb_class); -+ mutex_lock(&init_usb_class_mutex); -+ kref_put(&usb_class->kref, release_usb_class); -+ mutex_unlock(&init_usb_class_mutex); - } - - int usb_major_init(void) -@@ -171,7 +173,10 @@ int usb_register_dev(struct usb_interface *intf, - if (intf->minor >= 0) - return -EADDRINUSE; - -+ mutex_lock(&init_usb_class_mutex); - retval = init_usb_class(); -+ mutex_unlock(&init_usb_class_mutex); -+ - if (retval) - return retval; - -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 7c2d87befb51..67961231cbbd 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1048,6 +1048,9 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - - portstatus = portchange = 0; - status = hub_port_status(hub, port1, &portstatus, &portchange); -+ if (status) -+ goto abort; -+ - if (udev || (portstatus & USB_PORT_STAT_CONNECTION)) - dev_dbg(&port_dev->dev, "status %04x change %04x\n", - portstatus, portchange); -@@ -1180,7 +1183,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type) - - /* Scan all ports that need attention */ - kick_hub_wq(hub); -- -+ abort: - if (type == HUB_INIT2 || type == HUB_INIT3) { - /* Allow autosuspend if it was suppressed */ - disconnected: -@@ -2068,6 +2071,12 @@ void usb_disconnect(struct usb_device **pdev) - dev_info(&udev->dev, "USB disconnect, device number %d\n", - udev->devnum); - -+ /* -+ * Ensure that the pm runtime code knows that the USB device -+ * is in the process of being disconnected. -+ */ -+ pm_runtime_barrier(&udev->dev); -+ - usb_lock_device(udev); - - hub_disconnect_children(udev); -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 998a738e6359..5d70d46239bb 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -2493,7 +2493,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags) - (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) | - xhci->cmd_ring->cycle_state; - xhci_dbg_trace(xhci, trace_xhci_dbg_init, -- "// Setting command ring address to 0x%x", val); -+ "// Setting command ring address to 0x%016llx", val_64); - xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring); - xhci_dbg_cmd_ptrs(xhci); - -diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c -index 1624b09d9748..2e947dc94e32 100644 ---- a/drivers/usb/misc/usbtest.c -+++ b/drivers/usb/misc/usbtest.c -@@ -135,6 +135,7 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf) - case USB_ENDPOINT_XFER_INT: - if (dev->info->intr) - goto try_intr; -+ continue; - case USB_ENDPOINT_XFER_ISOC: - if (dev->info->iso) - goto try_iso; -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index b3a21fcbbaf9..dbd441c1c2ad 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -873,6 +873,7 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID, - USB_CLASS_VENDOR_SPEC, - USB_SUBCLASS_VENDOR_SPEC, 0x00) }, -+ { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) }, - { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) }, - { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 48ee04c94a75..71fb9e59db71 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -873,6 +873,12 @@ - #define FIC_VID 0x1457 - #define FIC_NEO1973_DEBUG_PID 0x5118 - -+/* -+ * Actel / Microsemi -+ */ -+#define ACTEL_VID 0x1514 -+#define MICROSEMI_ARROW_SF2PLUS_BOARD_PID 0x2008 -+ - /* Olimex */ - #define OLIMEX_VID 0x15BA - #define OLIMEX_ARM_USB_OCD_PID 0x0003 -diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c -index ecb826eefe02..2fa280671c1e 100644 ---- a/drivers/vfio/vfio_iommu_type1.c -+++ b/drivers/vfio/vfio_iommu_type1.c -@@ -130,57 +130,34 @@ static void vfio_unlink_dma(struct vfio_iommu *iommu, struct vfio_dma *old) - rb_erase(&old->node, &iommu->dma_list); - } - --struct vwork { -- struct mm_struct *mm; -- long npage; -- struct work_struct work; --}; -- --/* delayed decrement/increment for locked_vm */ --static void vfio_lock_acct_bg(struct work_struct *work) -+static int vfio_lock_acct(long npage, bool *lock_cap) - { -- struct vwork *vwork = container_of(work, struct vwork, work); -- struct mm_struct *mm; -- -- mm = vwork->mm; -- down_write(&mm->mmap_sem); -- mm->locked_vm += vwork->npage; -- up_write(&mm->mmap_sem); -- mmput(mm); -- kfree(vwork); --} -+ int ret = 0; - --static void vfio_lock_acct(long npage) --{ -- struct vwork *vwork; -- struct mm_struct *mm; -+ if (!npage) -+ return 0; - -- if (!current->mm || !npage) -- return; /* process exited or nothing to do */ -+ if (!current->mm) -+ return -ESRCH; /* process exited */ - -- if (down_write_trylock(¤t->mm->mmap_sem)) { -- current->mm->locked_vm += npage; -- up_write(¤t->mm->mmap_sem); -- return; -- } -+ down_write(¤t->mm->mmap_sem); -+ if (npage > 0) { -+ if (lock_cap ? !*lock_cap : !capable(CAP_IPC_LOCK)) { -+ unsigned long limit; - -- /* -- * Couldn't get mmap_sem lock, so must setup to update -- * mm->locked_vm later. If locked_vm were atomic, we -- * wouldn't need this silliness -- */ -- vwork = kmalloc(sizeof(struct vwork), GFP_KERNEL); -- if (!vwork) -- return; -- mm = get_task_mm(current); -- if (!mm) { -- kfree(vwork); -- return; -+ limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; -+ -+ if (current->mm->locked_vm + npage > limit) -+ ret = -ENOMEM; -+ } - } -- INIT_WORK(&vwork->work, vfio_lock_acct_bg); -- vwork->mm = mm; -- vwork->npage = npage; -- schedule_work(&vwork->work); -+ -+ if (!ret) -+ current->mm->locked_vm += npage; -+ -+ up_write(¤t->mm->mmap_sem); -+ -+ return ret; - } - - /* -@@ -262,9 +239,9 @@ static int vaddr_get_pfn(unsigned long vaddr, int prot, unsigned long *pfn) - static long vfio_pin_pages(unsigned long vaddr, long npage, - int prot, unsigned long *pfn_base) - { -- unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; -+ unsigned long pfn = 0, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT; - bool lock_cap = capable(CAP_IPC_LOCK); -- long ret, i; -+ long ret, i = 1; - bool rsvd; - - if (!current->mm) -@@ -283,16 +260,11 @@ static long vfio_pin_pages(unsigned long vaddr, long npage, - return -ENOMEM; - } - -- if (unlikely(disable_hugepages)) { -- if (!rsvd) -- vfio_lock_acct(1); -- return 1; -- } -+ if (unlikely(disable_hugepages)) -+ goto out; - - /* Lock all the consecutive pages from pfn_base */ -- for (i = 1, vaddr += PAGE_SIZE; i < npage; i++, vaddr += PAGE_SIZE) { -- unsigned long pfn = 0; -- -+ for (vaddr += PAGE_SIZE; i < npage; i++, vaddr += PAGE_SIZE) { - ret = vaddr_get_pfn(vaddr, prot, &pfn); - if (ret) - break; -@@ -308,12 +280,24 @@ static long vfio_pin_pages(unsigned long vaddr, long npage, - put_pfn(pfn, prot); - pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n", - __func__, limit << PAGE_SHIFT); -- break; -+ ret = -ENOMEM; -+ goto unpin_out; - } - } - -+out: - if (!rsvd) -- vfio_lock_acct(i); -+ ret = vfio_lock_acct(i, &lock_cap); -+ -+unpin_out: -+ if (ret) { -+ if (!rsvd) { -+ for (pfn = *pfn_base ; i ; pfn++, i--) -+ put_pfn(pfn, prot); -+ } -+ -+ return ret; -+ } - - return i; - } -@@ -328,7 +312,7 @@ static long vfio_unpin_pages(unsigned long pfn, long npage, - unlocked += put_pfn(pfn++, prot); - - if (do_accounting) -- vfio_lock_acct(-unlocked); -+ vfio_lock_acct(-unlocked, NULL); - - return unlocked; - } -@@ -390,7 +374,7 @@ static void vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma) - cond_resched(); - } - -- vfio_lock_acct(-unlocked); -+ vfio_lock_acct(-unlocked, NULL); - } - - static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma) -diff --git a/fs/block_dev.c b/fs/block_dev.c -index e5733bb537c9..26bbaaefdff4 100644 ---- a/fs/block_dev.c -+++ b/fs/block_dev.c -@@ -88,12 +88,11 @@ void invalidate_bdev(struct block_device *bdev) - { - struct address_space *mapping = bdev->bd_inode->i_mapping; - -- if (mapping->nrpages == 0) -- return; -- -- invalidate_bh_lrus(); -- lru_add_drain_all(); /* make sure all lru add caches are flushed */ -- invalidate_mapping_pages(mapping, 0, -1); -+ if (mapping->nrpages) { -+ invalidate_bh_lrus(); -+ lru_add_drain_all(); /* make sure all lru add caches are flushed */ -+ invalidate_mapping_pages(mapping, 0, -1); -+ } - /* 99% of the time, we don't need to flush the cleancache on the bdev. - * But, for the strange corners, lets be cautious - */ -diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c -index 819163d8313b..b24275ef97f7 100644 ---- a/fs/ceph/xattr.c -+++ b/fs/ceph/xattr.c -@@ -369,6 +369,7 @@ static int __set_xattr(struct ceph_inode_info *ci, - - if (update_xattr) { - int err = 0; -+ - if (xattr && (flags & XATTR_CREATE)) - err = -EEXIST; - else if (!xattr && (flags & XATTR_REPLACE)) -@@ -376,12 +377,14 @@ static int __set_xattr(struct ceph_inode_info *ci, - if (err) { - kfree(name); - kfree(val); -+ kfree(*newxattr); - return err; - } - if (update_xattr < 0) { - if (xattr) - __remove_xattr(ci, xattr); - kfree(name); -+ kfree(*newxattr); - return 0; - } - } -diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c -index 02b071bf3732..a0b3e7d1be48 100644 ---- a/fs/cifs/cifs_unicode.c -+++ b/fs/cifs/cifs_unicode.c -@@ -83,6 +83,9 @@ convert_sfm_char(const __u16 src_char, char *target) - case SFM_COLON: - *target = ':'; - break; -+ case SFM_DOUBLEQUOTE: -+ *target = '"'; -+ break; - case SFM_ASTERISK: - *target = '*'; - break; -@@ -418,6 +421,9 @@ static __le16 convert_to_sfm_char(char src_char, bool end_of_string) - case ':': - dest_char = cpu_to_le16(SFM_COLON); - break; -+ case '"': -+ dest_char = cpu_to_le16(SFM_DOUBLEQUOTE); -+ break; - case '*': - dest_char = cpu_to_le16(SFM_ASTERISK); - break; -diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h -index 479bc0a941f3..07ade707fa60 100644 ---- a/fs/cifs/cifs_unicode.h -+++ b/fs/cifs/cifs_unicode.h -@@ -57,6 +57,7 @@ - * not conflict (although almost does) with the mapping above. - */ - -+#define SFM_DOUBLEQUOTE ((__u16) 0xF020) - #define SFM_ASTERISK ((__u16) 0xF021) - #define SFM_QUESTION ((__u16) 0xF025) - #define SFM_COLON ((__u16) 0xF022) -@@ -64,8 +65,8 @@ - #define SFM_LESSTHAN ((__u16) 0xF023) - #define SFM_PIPE ((__u16) 0xF027) - #define SFM_SLASH ((__u16) 0xF026) --#define SFM_PERIOD ((__u16) 0xF028) --#define SFM_SPACE ((__u16) 0xF029) -+#define SFM_SPACE ((__u16) 0xF028) -+#define SFM_PERIOD ((__u16) 0xF029) - - /* - * Mapping mechanism to use when one of the seven reserved characters is -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index 5e2f8b8ca08a..b60150e5b5ce 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -717,6 +717,9 @@ CIFSSMBEcho(struct TCP_Server_Info *server) - if (rc) - return rc; - -+ if (server->capabilities & CAP_UNICODE) -+ smb->hdr.Flags2 |= SMBFLG2_UNICODE; -+ - /* set up echo request */ - smb->hdr.Tid = 0xffff; - smb->hdr.WordCount = 1; -diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c -index 35cf990f87d3..a8f5b31636dc 100644 ---- a/fs/cifs/ioctl.c -+++ b/fs/cifs/ioctl.c -@@ -272,6 +272,8 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg) - rc = -EOPNOTSUPP; - break; - case CIFS_IOC_GET_MNT_INFO: -+ if (pSMBFile == NULL) -+ break; - tcon = tlink_tcon(pSMBFile->tlink); - rc = smb_mnt_get_fsinfo(xid, tcon, (void __user *)arg); - break; -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 6cb2603f8a5c..f4afa3b1cc56 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -564,8 +564,12 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) - } - - if (rsplen != sizeof(struct validate_negotiate_info_rsp)) { -- cifs_dbg(VFS, "invalid size of protocol negotiate response\n"); -- return -EIO; -+ cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n", -+ rsplen); -+ -+ /* relax check since Mac returns max bufsize allowed on ioctl */ -+ if (rsplen > CIFSMaxBufSize) -+ return -EIO; - } - - /* check validate negotiate info response matches what we got earlier */ -@@ -1518,8 +1522,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid, - * than one credit. Windows typically sets this smaller, but for some - * ioctls it may be useful to allow server to send more. No point - * limiting what the server can send as long as fits in one credit -+ * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE -+ * (by default, note that it can be overridden to make max larger) -+ * in responses (except for read responses which can be bigger. -+ * We may want to bump this limit up - */ -- req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */ -+ req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize); - - if (is_fsctl) - req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 817a937de733..ccae64dad40c 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -5393,6 +5393,11 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) - file_update_time(vma->vm_file); - - down_read(&EXT4_I(inode)->i_mmap_sem); -+ -+ ret = ext4_convert_inline_data(inode); -+ if (ret) -+ goto out_ret; -+ - /* Delalloc case is easy... */ - if (test_opt(inode->i_sb, DELALLOC) && - !ext4_should_journal_data(inode) && -diff --git a/fs/xattr.c b/fs/xattr.c -index 9b932b95d74e..f0da9d24e9ca 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -442,7 +442,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value, - size = XATTR_SIZE_MAX; - kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN); - if (!kvalue) { -- vvalue = vmalloc(size); -+ vvalue = vzalloc(size); - if (!vvalue) - return -ENOMEM; - kvalue = vvalue; -diff --git a/include/net/mac80211.h b/include/net/mac80211.h -index 760bc4d5a2cf..4e51f9a5a177 100644 ---- a/include/net/mac80211.h -+++ b/include/net/mac80211.h -@@ -1662,6 +1662,9 @@ struct ieee80211_sta_rates { - * @supp_rates: Bitmap of supported rates (per band) - * @ht_cap: HT capabilities of this STA; restricted to our own capabilities - * @vht_cap: VHT capabilities of this STA; restricted to our own capabilities -+ * @max_rx_aggregation_subframes: maximal amount of frames in a single AMPDU -+ * that this station is allowed to transmit to us. -+ * Can be modified by driver. - * @wme: indicates whether the STA supports QoS/WME (if local devices does, - * otherwise always false) - * @drv_priv: data area for driver use, will always be aligned to -@@ -1688,6 +1691,7 @@ struct ieee80211_sta { - u16 aid; - struct ieee80211_sta_ht_cap ht_cap; - struct ieee80211_sta_vht_cap vht_cap; -+ u8 max_rx_aggregation_subframes; - bool wme; - u8 uapsd_queues; - u8 max_sp; -@@ -2674,6 +2678,33 @@ enum ieee80211_ampdu_mlme_action { - }; - - /** -+ * struct ieee80211_ampdu_params - AMPDU action parameters -+ * -+ * @action: the ampdu action, value from %ieee80211_ampdu_mlme_action. -+ * @sta: peer of this AMPDU session -+ * @tid: tid of the BA session -+ * @ssn: start sequence number of the session. TX/RX_STOP can pass 0. When -+ * action is set to %IEEE80211_AMPDU_RX_START the driver passes back the -+ * actual ssn value used to start the session and writes the value here. -+ * @buf_size: reorder buffer size (number of subframes). Valid only when the -+ * action is set to %IEEE80211_AMPDU_RX_START or -+ * %IEEE80211_AMPDU_TX_OPERATIONAL -+ * @amsdu: indicates the peer's ability to receive A-MSDU within A-MPDU. -+ * valid when the action is set to %IEEE80211_AMPDU_TX_OPERATIONAL -+ * @timeout: BA session timeout. Valid only when the action is set to -+ * %IEEE80211_AMPDU_RX_START -+ */ -+struct ieee80211_ampdu_params { -+ enum ieee80211_ampdu_mlme_action action; -+ struct ieee80211_sta *sta; -+ u16 tid; -+ u16 ssn; -+ u8 buf_size; -+ bool amsdu; -+ u16 timeout; -+}; -+ -+/** - * enum ieee80211_frame_release_type - frame release reason - * @IEEE80211_FRAME_RELEASE_PSPOLL: frame released for PS-Poll - * @IEEE80211_FRAME_RELEASE_UAPSD: frame(s) released due to -@@ -3017,13 +3048,9 @@ enum ieee80211_reconfig_type { - * @ampdu_action: Perform a certain A-MPDU action - * The RA/TID combination determines the destination and TID we want - * the ampdu action to be performed for. The action is defined through -- * ieee80211_ampdu_mlme_action. Starting sequence number (@ssn) -- * is the first frame we expect to perform the action on. Notice -- * that TX/RX_STOP can pass NULL for this parameter. -- * The @buf_size parameter is only valid when the action is set to -- * %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's reorder -- * buffer size (number of subframes) for this session -- the driver -- * may neither send aggregates containing more subframes than this -+ * ieee80211_ampdu_mlme_action. -+ * When the action is set to %IEEE80211_AMPDU_TX_OPERATIONAL the driver -+ * may neither send aggregates containing more subframes than @buf_size - * nor send aggregates in a way that lost frames would exceed the - * buffer size. If just limiting the aggregate size, this would be - * possible with a buf_size of 8: -@@ -3034,9 +3061,6 @@ enum ieee80211_reconfig_type { - * buffer size of 8. Correct ways to retransmit #1 would be: - * - TX: 1 or 18 or 81 - * Even "189" would be wrong since 1 could be lost again. -- * The @amsdu parameter is valid when the action is set to -- * %IEEE80211_AMPDU_TX_OPERATIONAL and indicates the peer's ability -- * to receive A-MSDU within A-MPDU. - * - * Returns a negative error code on failure. - * The callback can sleep. -@@ -3378,9 +3402,7 @@ struct ieee80211_ops { - int (*tx_last_beacon)(struct ieee80211_hw *hw); - int (*ampdu_action)(struct ieee80211_hw *hw, - struct ieee80211_vif *vif, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, u16 *ssn, -- u8 buf_size, bool amsdu); -+ struct ieee80211_ampdu_params *params); - int (*get_survey)(struct ieee80211_hw *hw, int idx, - struct survey_info *survey); - void (*rfkill_poll)(struct ieee80211_hw *hw); -diff --git a/include/target/target_core_fabric.h b/include/target/target_core_fabric.h -index 97069ecabe49..5f9b62c129fc 100644 ---- a/include/target/target_core_fabric.h -+++ b/include/target/target_core_fabric.h -@@ -117,7 +117,7 @@ void __transport_register_session(struct se_portal_group *, - struct se_node_acl *, struct se_session *, void *); - void transport_register_session(struct se_portal_group *, - struct se_node_acl *, struct se_session *, void *); --void target_get_session(struct se_session *); -+int target_get_session(struct se_session *); - void target_put_session(struct se_session *); - ssize_t target_show_dynamic_sessions(struct se_portal_group *, char *); - void transport_free_session(struct se_session *); -@@ -172,8 +172,7 @@ bool target_tpg_has_node_acl(struct se_portal_group *tpg, - const char *); - struct se_node_acl *core_tpg_check_initiator_node_acl(struct se_portal_group *, - unsigned char *); --int core_tpg_set_initiator_node_queue_depth(struct se_portal_group *, -- unsigned char *, u32, int); -+int core_tpg_set_initiator_node_queue_depth(struct se_node_acl *, u32); - int core_tpg_set_initiator_node_tag(struct se_portal_group *, - struct se_node_acl *, const char *); - int core_tpg_register(struct se_wwn *, struct se_portal_group *, int); -diff --git a/kernel/padata.c b/kernel/padata.c -index 401227e3967c..ecc7b3f452c7 100644 ---- a/kernel/padata.c -+++ b/kernel/padata.c -@@ -357,7 +357,7 @@ static int padata_setup_cpumasks(struct parallel_data *pd, - - cpumask_and(pd->cpumask.pcpu, pcpumask, cpu_online_mask); - if (!alloc_cpumask_var(&pd->cpumask.cbcpu, GFP_KERNEL)) { -- free_cpumask_var(pd->cpumask.cbcpu); -+ free_cpumask_var(pd->cpumask.pcpu); - return -ENOMEM; - } - -diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c -index b1eb8c09a660..c842f40c1173 100644 ---- a/net/bluetooth/hci_sock.c -+++ b/net/bluetooth/hci_sock.c -@@ -1164,7 +1164,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg, - if (msg->msg_flags & MSG_OOB) - return -EOPNOTSUPP; - -- if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE)) -+ if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE| -+ MSG_CMSG_COMPAT)) - return -EINVAL; - - if (len < 4 || len > HCI_MAX_FRAME_SIZE) -diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c -index 367784be5df2..a830356b94ac 100644 ---- a/net/mac80211/agg-rx.c -+++ b/net/mac80211/agg-rx.c -@@ -7,6 +7,7 @@ - * Copyright 2006-2007 Jiri Benc - * Copyright 2007, Michael Wu - * Copyright 2007-2010, Intel Corporation -+ * Copyright(c) 2015 Intel Deutschland GmbH - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -61,6 +62,14 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, - { - struct ieee80211_local *local = sta->local; - struct tid_ampdu_rx *tid_rx; -+ struct ieee80211_ampdu_params params = { -+ .sta = &sta->sta, -+ .action = IEEE80211_AMPDU_RX_STOP, -+ .tid = tid, -+ .amsdu = false, -+ .timeout = 0, -+ .ssn = 0, -+ }; - - lockdep_assert_held(&sta->ampdu_mlme.mtx); - -@@ -78,8 +87,7 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid, - initiator == WLAN_BACK_RECIPIENT ? "recipient" : "inititator", - (int)reason); - -- if (drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_STOP, -- &sta->sta, tid, NULL, 0, false)) -+ if (drv_ampdu_action(local, sta->sdata, ¶ms)) - sdata_info(sta->sdata, - "HW problem - can not stop rx aggregation for %pM tid %d\n", - sta->sta.addr, tid); -@@ -237,6 +245,15 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, - { - struct ieee80211_local *local = sta->sdata->local; - struct tid_ampdu_rx *tid_agg_rx; -+ struct ieee80211_ampdu_params params = { -+ .sta = &sta->sta, -+ .action = IEEE80211_AMPDU_RX_START, -+ .tid = tid, -+ .amsdu = false, -+ .timeout = timeout, -+ .ssn = start_seq_num, -+ }; -+ - int i, ret = -EOPNOTSUPP; - u16 status = WLAN_STATUS_REQUEST_DECLINED; - -@@ -273,8 +290,12 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, - buf_size = IEEE80211_MAX_AMPDU_BUF; - - /* make sure the size doesn't exceed the maximum supported by the hw */ -- if (buf_size > local->hw.max_rx_aggregation_subframes) -- buf_size = local->hw.max_rx_aggregation_subframes; -+ if (buf_size > sta->sta.max_rx_aggregation_subframes) -+ buf_size = sta->sta.max_rx_aggregation_subframes; -+ params.buf_size = buf_size; -+ -+ ht_dbg(sta->sdata, "AddBA Req buf_size=%d for %pM\n", -+ buf_size, sta->sta.addr); - - /* examine state machine */ - mutex_lock(&sta->ampdu_mlme.mtx); -@@ -322,8 +343,7 @@ void __ieee80211_start_rx_ba_session(struct sta_info *sta, - for (i = 0; i < buf_size; i++) - __skb_queue_head_init(&tid_agg_rx->reorder_buf[i]); - -- ret = drv_ampdu_action(local, sta->sdata, IEEE80211_AMPDU_RX_START, -- &sta->sta, tid, &start_seq_num, 0, false); -+ ret = drv_ampdu_action(local, sta->sdata, ¶ms); - ht_dbg(sta->sdata, "Rx A-MPDU request on %pM tid %d result %d\n", - sta->sta.addr, tid, ret); - if (ret) { -diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c -index ff757181b0a8..4932e9f243a2 100644 ---- a/net/mac80211/agg-tx.c -+++ b/net/mac80211/agg-tx.c -@@ -7,6 +7,7 @@ - * Copyright 2006-2007 Jiri Benc - * Copyright 2007, Michael Wu - * Copyright 2007-2010, Intel Corporation -+ * Copyright(c) 2015 Intel Deutschland GmbH - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -295,7 +296,14 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - { - struct ieee80211_local *local = sta->local; - struct tid_ampdu_tx *tid_tx; -- enum ieee80211_ampdu_mlme_action action; -+ struct ieee80211_ampdu_params params = { -+ .sta = &sta->sta, -+ .tid = tid, -+ .buf_size = 0, -+ .amsdu = false, -+ .timeout = 0, -+ .ssn = 0, -+ }; - int ret; - - lockdep_assert_held(&sta->ampdu_mlme.mtx); -@@ -304,10 +312,10 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - case AGG_STOP_DECLINED: - case AGG_STOP_LOCAL_REQUEST: - case AGG_STOP_PEER_REQUEST: -- action = IEEE80211_AMPDU_TX_STOP_CONT; -+ params.action = IEEE80211_AMPDU_TX_STOP_CONT; - break; - case AGG_STOP_DESTROY_STA: -- action = IEEE80211_AMPDU_TX_STOP_FLUSH; -+ params.action = IEEE80211_AMPDU_TX_STOP_FLUSH; - break; - default: - WARN_ON_ONCE(1); -@@ -330,9 +338,8 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - spin_unlock_bh(&sta->lock); - if (reason != AGG_STOP_DESTROY_STA) - return -EALREADY; -- ret = drv_ampdu_action(local, sta->sdata, -- IEEE80211_AMPDU_TX_STOP_FLUSH_CONT, -- &sta->sta, tid, NULL, 0, false); -+ params.action = IEEE80211_AMPDU_TX_STOP_FLUSH_CONT; -+ ret = drv_ampdu_action(local, sta->sdata, ¶ms); - WARN_ON_ONCE(ret); - return 0; - } -@@ -381,8 +388,7 @@ int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - WLAN_BACK_INITIATOR; - tid_tx->tx_stop = reason == AGG_STOP_LOCAL_REQUEST; - -- ret = drv_ampdu_action(local, sta->sdata, action, -- &sta->sta, tid, NULL, 0, false); -+ ret = drv_ampdu_action(local, sta->sdata, ¶ms); - - /* HW shall not deny going back to legacy */ - if (WARN_ON(ret)) { -@@ -445,7 +451,14 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - struct tid_ampdu_tx *tid_tx; - struct ieee80211_local *local = sta->local; - struct ieee80211_sub_if_data *sdata = sta->sdata; -- u16 start_seq_num; -+ struct ieee80211_ampdu_params params = { -+ .sta = &sta->sta, -+ .action = IEEE80211_AMPDU_TX_START, -+ .tid = tid, -+ .buf_size = 0, -+ .amsdu = false, -+ .timeout = 0, -+ }; - int ret; - - tid_tx = rcu_dereference_protected_tid_tx(sta, tid); -@@ -467,10 +480,8 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - */ - synchronize_net(); - -- start_seq_num = sta->tid_seq[tid] >> 4; -- -- ret = drv_ampdu_action(local, sdata, IEEE80211_AMPDU_TX_START, -- &sta->sta, tid, &start_seq_num, 0, false); -+ params.ssn = sta->tid_seq[tid] >> 4; -+ ret = drv_ampdu_action(local, sdata, ¶ms); - if (ret) { - ht_dbg(sdata, - "BA request denied - HW unavailable for %pM tid %d\n", -@@ -499,7 +510,7 @@ void ieee80211_tx_ba_session_handle_start(struct sta_info *sta, int tid) - - /* send AddBA request */ - ieee80211_send_addba_request(sdata, sta->sta.addr, tid, -- tid_tx->dialog_token, start_seq_num, -+ tid_tx->dialog_token, params.ssn, - IEEE80211_MAX_AMPDU_BUF, - tid_tx->timeout); - } -@@ -684,18 +695,24 @@ static void ieee80211_agg_tx_operational(struct ieee80211_local *local, - struct sta_info *sta, u16 tid) - { - struct tid_ampdu_tx *tid_tx; -+ struct ieee80211_ampdu_params params = { -+ .sta = &sta->sta, -+ .action = IEEE80211_AMPDU_TX_OPERATIONAL, -+ .tid = tid, -+ .timeout = 0, -+ .ssn = 0, -+ }; - - lockdep_assert_held(&sta->ampdu_mlme.mtx); - - tid_tx = rcu_dereference_protected_tid_tx(sta, tid); -+ params.buf_size = tid_tx->buf_size; -+ params.amsdu = tid_tx->amsdu; - - ht_dbg(sta->sdata, "Aggregation is on for %pM tid %d\n", - sta->sta.addr, tid); - -- drv_ampdu_action(local, sta->sdata, -- IEEE80211_AMPDU_TX_OPERATIONAL, -- &sta->sta, tid, NULL, tid_tx->buf_size, -- tid_tx->amsdu); -+ drv_ampdu_action(local, sta->sdata, ¶ms); - - /* - * synchronize with TX path, while splicing the TX path -diff --git a/net/mac80211/driver-ops.c b/net/mac80211/driver-ops.c -index ca1fe5576103..c258f1041d33 100644 ---- a/net/mac80211/driver-ops.c -+++ b/net/mac80211/driver-ops.c -@@ -284,9 +284,7 @@ int drv_switch_vif_chanctx(struct ieee80211_local *local, - - int drv_ampdu_action(struct ieee80211_local *local, - struct ieee80211_sub_if_data *sdata, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, -- u16 *ssn, u8 buf_size, bool amsdu) -+ struct ieee80211_ampdu_params *params) - { - int ret = -EOPNOTSUPP; - -@@ -296,12 +294,10 @@ int drv_ampdu_action(struct ieee80211_local *local, - if (!check_sdata_in_driver(sdata)) - return -EIO; - -- trace_drv_ampdu_action(local, sdata, action, sta, tid, -- ssn, buf_size, amsdu); -+ trace_drv_ampdu_action(local, sdata, params); - - if (local->ops->ampdu_action) -- ret = local->ops->ampdu_action(&local->hw, &sdata->vif, action, -- sta, tid, ssn, buf_size, amsdu); -+ ret = local->ops->ampdu_action(&local->hw, &sdata->vif, params); - - trace_drv_return_int(local, ret); - -diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h -index 154ce4b13406..18b0d65baff0 100644 ---- a/net/mac80211/driver-ops.h -+++ b/net/mac80211/driver-ops.h -@@ -585,9 +585,7 @@ static inline int drv_tx_last_beacon(struct ieee80211_local *local) - - int drv_ampdu_action(struct ieee80211_local *local, - struct ieee80211_sub_if_data *sdata, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, -- u16 *ssn, u8 buf_size, bool amsdu); -+ struct ieee80211_ampdu_params *params); - - static inline int drv_get_survey(struct ieee80211_local *local, int idx, - struct survey_info *survey) -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 67066d048e6f..63ea6cbac5ad 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -329,6 +329,9 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata, - - memcpy(sta->addr, addr, ETH_ALEN); - memcpy(sta->sta.addr, addr, ETH_ALEN); -+ sta->sta.max_rx_aggregation_subframes = -+ local->hw.max_rx_aggregation_subframes; -+ - sta->local = local; - sta->sdata = sdata; - sta->rx_stats.last_rx = jiffies; -diff --git a/net/mac80211/trace.h b/net/mac80211/trace.h -index 56c6d6cfa5a1..913e959b03cf 100644 ---- a/net/mac80211/trace.h -+++ b/net/mac80211/trace.h -@@ -80,7 +80,23 @@ - #define KEY_PR_FMT " cipher:0x%x, flags=%#x, keyidx=%d, hw_key_idx=%d" - #define KEY_PR_ARG __entry->cipher, __entry->flags, __entry->keyidx, __entry->hw_key_idx - -- -+#define AMPDU_ACTION_ENTRY __field(enum ieee80211_ampdu_mlme_action, \ -+ ieee80211_ampdu_mlme_action) \ -+ STA_ENTRY \ -+ __field(u16, tid) \ -+ __field(u16, ssn) \ -+ __field(u8, buf_size) \ -+ __field(bool, amsdu) \ -+ __field(u16, timeout) -+#define AMPDU_ACTION_ASSIGN STA_NAMED_ASSIGN(params->sta); \ -+ __entry->tid = params->tid; \ -+ __entry->ssn = params->ssn; \ -+ __entry->buf_size = params->buf_size; \ -+ __entry->amsdu = params->amsdu; \ -+ __entry->timeout = params->timeout; -+#define AMPDU_ACTION_PR_FMT STA_PR_FMT " tid %d, ssn %d, buf_size %u, amsdu %d, timeout %d" -+#define AMPDU_ACTION_PR_ARG STA_PR_ARG, __entry->tid, __entry->ssn, \ -+ __entry->buf_size, __entry->amsdu, __entry->timeout - - /* - * Tracing for driver callbacks. -@@ -970,38 +986,25 @@ DEFINE_EVENT(local_only_evt, drv_tx_last_beacon, - TRACE_EVENT(drv_ampdu_action, - TP_PROTO(struct ieee80211_local *local, - struct ieee80211_sub_if_data *sdata, -- enum ieee80211_ampdu_mlme_action action, -- struct ieee80211_sta *sta, u16 tid, -- u16 *ssn, u8 buf_size, bool amsdu), -+ struct ieee80211_ampdu_params *params), - -- TP_ARGS(local, sdata, action, sta, tid, ssn, buf_size, amsdu), -+ TP_ARGS(local, sdata, params), - - TP_STRUCT__entry( - LOCAL_ENTRY -- STA_ENTRY -- __field(u32, action) -- __field(u16, tid) -- __field(u16, ssn) -- __field(u8, buf_size) -- __field(bool, amsdu) - VIF_ENTRY -+ AMPDU_ACTION_ENTRY - ), - - TP_fast_assign( - LOCAL_ASSIGN; - VIF_ASSIGN; -- STA_ASSIGN; -- __entry->action = action; -- __entry->tid = tid; -- __entry->ssn = ssn ? *ssn : 0; -- __entry->buf_size = buf_size; -- __entry->amsdu = amsdu; -+ AMPDU_ACTION_ASSIGN; - ), - - TP_printk( -- LOCAL_PR_FMT VIF_PR_FMT STA_PR_FMT " action:%d tid:%d buf:%d amsdu:%d", -- LOCAL_PR_ARG, VIF_PR_ARG, STA_PR_ARG, __entry->action, -- __entry->tid, __entry->buf_size, __entry->amsdu -+ LOCAL_PR_FMT VIF_PR_FMT AMPDU_ACTION_PR_FMT, -+ LOCAL_PR_ARG, VIF_PR_ARG, AMPDU_ACTION_PR_ARG - ) - ); - -diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c -index 31a3035cd4eb..923e59eb82c7 100644 ---- a/tools/testing/selftests/x86/ldt_gdt.c -+++ b/tools/testing/selftests/x86/ldt_gdt.c -@@ -394,6 +394,51 @@ static void *threadproc(void *ctx) - } - } - -+#ifdef __i386__ -+ -+#ifndef SA_RESTORE -+#define SA_RESTORER 0x04000000 -+#endif -+ -+/* -+ * The UAPI header calls this 'struct sigaction', which conflicts with -+ * glibc. Sigh. -+ */ -+struct fake_ksigaction { -+ void *handler; /* the real type is nasty */ -+ unsigned long sa_flags; -+ void (*sa_restorer)(void); -+ unsigned char sigset[8]; -+}; -+ -+static void fix_sa_restorer(int sig) -+{ -+ struct fake_ksigaction ksa; -+ -+ if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) { -+ /* -+ * glibc has a nasty bug: it sometimes writes garbage to -+ * sa_restorer. This interacts quite badly with anything -+ * that fiddles with SS because it can trigger legacy -+ * stack switching. Patch it up. See: -+ * -+ * https://sourceware.org/bugzilla/show_bug.cgi?id=21269 -+ */ -+ if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) { -+ ksa.sa_restorer = NULL; -+ if (syscall(SYS_rt_sigaction, sig, &ksa, NULL, -+ sizeof(ksa.sigset)) != 0) -+ err(1, "rt_sigaction"); -+ } -+ } -+} -+#else -+static void fix_sa_restorer(int sig) -+{ -+ /* 64-bit glibc works fine. */ -+} -+#endif -+ - static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), - int flags) - { -@@ -405,6 +450,7 @@ static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), - if (sigaction(sig, &sa, 0)) - err(1, "sigaction"); - -+ fix_sa_restorer(sig); - } - - static jmp_buf jmpbuf; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.69-70.patch b/patch/kernel/mvebu64-default/03-patch-4.4.69-70.patch deleted file mode 100644 index d81f76cd7213..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.69-70.patch +++ /dev/null @@ -1,3652 +0,0 @@ -diff --git a/Documentation/arm64/tagged-pointers.txt b/Documentation/arm64/tagged-pointers.txt -index d9995f1f51b3..a25a99e82bb1 100644 ---- a/Documentation/arm64/tagged-pointers.txt -+++ b/Documentation/arm64/tagged-pointers.txt -@@ -11,24 +11,56 @@ in AArch64 Linux. - The kernel configures the translation tables so that translations made - via TTBR0 (i.e. userspace mappings) have the top byte (bits 63:56) of - the virtual address ignored by the translation hardware. This frees up --this byte for application use, with the following caveats: -+this byte for application use. - -- (1) The kernel requires that all user addresses passed to EL1 -- are tagged with tag 0x00. This means that any syscall -- parameters containing user virtual addresses *must* have -- their top byte cleared before trapping to the kernel. - -- (2) Non-zero tags are not preserved when delivering signals. -- This means that signal handlers in applications making use -- of tags cannot rely on the tag information for user virtual -- addresses being maintained for fields inside siginfo_t. -- One exception to this rule is for signals raised in response -- to watchpoint debug exceptions, where the tag information -- will be preserved. -+Passing tagged addresses to the kernel -+-------------------------------------- - -- (3) Special care should be taken when using tagged pointers, -- since it is likely that C compilers will not hazard two -- virtual addresses differing only in the upper byte. -+All interpretation of userspace memory addresses by the kernel assumes -+an address tag of 0x00. -+ -+This includes, but is not limited to, addresses found in: -+ -+ - pointer arguments to system calls, including pointers in structures -+ passed to system calls, -+ -+ - the stack pointer (sp), e.g. when interpreting it to deliver a -+ signal, -+ -+ - the frame pointer (x29) and frame records, e.g. when interpreting -+ them to generate a backtrace or call graph. -+ -+Using non-zero address tags in any of these locations may result in an -+error code being returned, a (fatal) signal being raised, or other modes -+of failure. -+ -+For these reasons, passing non-zero address tags to the kernel via -+system calls is forbidden, and using a non-zero address tag for sp is -+strongly discouraged. -+ -+Programs maintaining a frame pointer and frame records that use non-zero -+address tags may suffer impaired or inaccurate debug and profiling -+visibility. -+ -+ -+Preserving tags -+--------------- -+ -+Non-zero tags are not preserved when delivering signals. This means that -+signal handlers in applications making use of tags cannot rely on the -+tag information for user virtual addresses being maintained for fields -+inside siginfo_t. One exception to this rule is for signals raised in -+response to watchpoint debug exceptions, where the tag information will -+be preserved. - - The architecture prevents the use of a tagged PC, so the upper byte will - be set to a sign-extension of bit 55 on exception return. -+ -+ -+Other considerations -+-------------------- -+ -+Special care should be taken when using tagged pointers, since it is -+likely that C compilers will not hazard two virtual addresses differing -+only in the upper byte. -diff --git a/Makefile b/Makefile -index dc5df61ea4be..a5ecb29c6ed3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 69 -+SUBLEVEL = 70 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/kernel/osf_sys.c b/arch/alpha/kernel/osf_sys.c -index 6cc08166ff00..63f06a2b1f7f 100644 ---- a/arch/alpha/kernel/osf_sys.c -+++ b/arch/alpha/kernel/osf_sys.c -@@ -1188,8 +1188,10 @@ SYSCALL_DEFINE4(osf_wait4, pid_t, pid, int __user *, ustatus, int, options, - if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur))) - return -EFAULT; - -- err = 0; -- err |= put_user(status, ustatus); -+ err = put_user(status, ustatus); -+ if (ret < 0) -+ return err ? err : ret; -+ - err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec); - err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec); - err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec); -diff --git a/arch/arm/boot/dts/at91-sama5d3_xplained.dts b/arch/arm/boot/dts/at91-sama5d3_xplained.dts -index f3e2b96c06a3..0bd325c314e1 100644 ---- a/arch/arm/boot/dts/at91-sama5d3_xplained.dts -+++ b/arch/arm/boot/dts/at91-sama5d3_xplained.dts -@@ -162,9 +162,10 @@ - }; - - adc0: adc@f8018000 { -+ atmel,adc-vref = <3300>; -+ atmel,adc-channels-used = <0xfe>; - pinctrl-0 = < - &pinctrl_adc0_adtrg -- &pinctrl_adc0_ad0 - &pinctrl_adc0_ad1 - &pinctrl_adc0_ad2 - &pinctrl_adc0_ad3 -@@ -172,8 +173,6 @@ - &pinctrl_adc0_ad5 - &pinctrl_adc0_ad6 - &pinctrl_adc0_ad7 -- &pinctrl_adc0_ad8 -- &pinctrl_adc0_ad9 - >; - status = "okay"; - }; -diff --git a/arch/arm/boot/dts/tegra20-paz00.dts b/arch/arm/boot/dts/tegra20-paz00.dts -index ed7e1009326c..d9ee0fd817e9 100644 ---- a/arch/arm/boot/dts/tegra20-paz00.dts -+++ b/arch/arm/boot/dts/tegra20-paz00.dts -@@ -565,6 +565,7 @@ - regulator-name = "+3VS,vdd_pnl"; - regulator-min-microvolt = <3300000>; - regulator-max-microvolt = <3300000>; -+ regulator-boot-on; - gpio = <&gpio TEGRA_GPIO(A, 4) GPIO_ACTIVE_HIGH>; - enable-active-high; - }; -diff --git a/arch/arm64/include/asm/cmpxchg.h b/arch/arm64/include/asm/cmpxchg.h -index 9ea611ea69df..91ceeb7b4530 100644 ---- a/arch/arm64/include/asm/cmpxchg.h -+++ b/arch/arm64/include/asm/cmpxchg.h -@@ -49,7 +49,7 @@ static inline unsigned long __xchg_case_##name(unsigned long x, \ - " swp" #acq_lse #rel #sz "\t%" #w "3, %" #w "0, %2\n" \ - " nop\n" \ - " " #nop_lse) \ -- : "=&r" (ret), "=&r" (tmp), "+Q" (*(u8 *)ptr) \ -+ : "=&r" (ret), "=&r" (tmp), "+Q" (*(unsigned long *)ptr) \ - : "r" (x) \ - : cl); \ - \ -diff --git a/arch/powerpc/kernel/exceptions-64e.S b/arch/powerpc/kernel/exceptions-64e.S -index 488e6314f993..5cc93f0b52ca 100644 ---- a/arch/powerpc/kernel/exceptions-64e.S -+++ b/arch/powerpc/kernel/exceptions-64e.S -@@ -735,8 +735,14 @@ END_FTR_SECTION_IFSET(CPU_FTR_ALTIVEC) - andis. r15,r14,(DBSR_IC|DBSR_BT)@h - beq+ 1f - -+#ifdef CONFIG_RELOCATABLE -+ ld r15,PACATOC(r13) -+ ld r14,interrupt_base_book3e@got(r15) -+ ld r15,__end_interrupts@got(r15) -+#else - LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) - LOAD_REG_IMMEDIATE(r15,__end_interrupts) -+#endif - cmpld cr0,r10,r14 - cmpld cr1,r10,r15 - blt+ cr0,1f -@@ -799,8 +805,14 @@ kernel_dbg_exc: - andis. r15,r14,(DBSR_IC|DBSR_BT)@h - beq+ 1f - -+#ifdef CONFIG_RELOCATABLE -+ ld r15,PACATOC(r13) -+ ld r14,interrupt_base_book3e@got(r15) -+ ld r15,__end_interrupts@got(r15) -+#else - LOAD_REG_IMMEDIATE(r14,interrupt_base_book3e) - LOAD_REG_IMMEDIATE(r15,__end_interrupts) -+#endif - cmpld cr0,r10,r14 - cmpld cr1,r10,r15 - blt+ cr0,1f -diff --git a/arch/powerpc/kernel/mce.c b/arch/powerpc/kernel/mce.c -index b2eb4686bd8f..da3c4c3f4ec8 100644 ---- a/arch/powerpc/kernel/mce.c -+++ b/arch/powerpc/kernel/mce.c -@@ -204,6 +204,8 @@ static void machine_check_process_queued_event(struct irq_work *work) - { - int index; - -+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE); -+ - /* - * For now just print it to console. - * TODO: log this error event to FSP or nvram. -diff --git a/arch/powerpc/kernel/traps.c b/arch/powerpc/kernel/traps.c -index 37de90f8a845..e4dcb0a43e3f 100644 ---- a/arch/powerpc/kernel/traps.c -+++ b/arch/powerpc/kernel/traps.c -@@ -297,8 +297,6 @@ long machine_check_early(struct pt_regs *regs) - - __this_cpu_inc(irq_stat.mce_exceptions); - -- add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE); -- - if (cur_cpu_spec && cur_cpu_spec->machine_check_early) - handled = cur_cpu_spec->machine_check_early(regs); - return handled; -@@ -704,6 +702,8 @@ void machine_check_exception(struct pt_regs *regs) - - __this_cpu_inc(irq_stat.mce_exceptions); - -+ add_taint(TAINT_MACHINE_CHECK, LOCKDEP_NOW_UNRELIABLE); -+ - /* See if any machine dependent calls. In theory, we would want - * to call the CPU first, and call the ppc_md. one if the CPU - * one returns a positive number. However there is existing code -diff --git a/arch/powerpc/platforms/pseries/dlpar.c b/arch/powerpc/platforms/pseries/dlpar.c -index f244dcb4f2cf..96536c969c9c 100644 ---- a/arch/powerpc/platforms/pseries/dlpar.c -+++ b/arch/powerpc/platforms/pseries/dlpar.c -@@ -280,7 +280,6 @@ int dlpar_detach_node(struct device_node *dn) - if (rc) - return rc; - -- of_node_put(dn); /* Must decrement the refcount */ - return 0; - } - -diff --git a/arch/s390/kernel/crash_dump.c b/arch/s390/kernel/crash_dump.c -index f7c3a61040bd..df4685905015 100644 ---- a/arch/s390/kernel/crash_dump.c -+++ b/arch/s390/kernel/crash_dump.c -@@ -464,6 +464,20 @@ static void *nt_vmcoreinfo(void *ptr) - } - - /* -+ * Initialize final note (needed for /proc/vmcore code) -+ */ -+static void *nt_final(void *ptr) -+{ -+ Elf64_Nhdr *note; -+ -+ note = (Elf64_Nhdr *) ptr; -+ note->n_namesz = 0; -+ note->n_descsz = 0; -+ note->n_type = 0; -+ return PTR_ADD(ptr, sizeof(Elf64_Nhdr)); -+} -+ -+/* - * Initialize ELF header (new kernel) - */ - static void *ehdr_init(Elf64_Ehdr *ehdr, int mem_chunk_cnt) -@@ -553,6 +567,7 @@ static void *notes_init(Elf64_Phdr *phdr, void *ptr, u64 notes_offset) - ptr = fill_cpu_elf_notes(ptr, &sa_ext->sa, sa_ext->vx_regs); - } - ptr = nt_vmcoreinfo(ptr); -+ ptr = nt_final(ptr); - memset(phdr, 0, sizeof(*phdr)); - phdr->p_type = PT_NOTE; - phdr->p_offset = notes_offset; -diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S -index 424e6809ad07..7460df3eec6b 100644 ---- a/arch/s390/kernel/entry.S -+++ b/arch/s390/kernel/entry.S -@@ -308,6 +308,7 @@ ENTRY(system_call) - lg %r14,__LC_VDSO_PER_CPU - lmg %r0,%r10,__PT_R0(%r11) - mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) -+.Lsysc_exit_timer: - stpt __LC_EXIT_TIMER - mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER - lmg %r11,%r15,__PT_R11(%r11) -@@ -593,6 +594,7 @@ ENTRY(io_int_handler) - lg %r14,__LC_VDSO_PER_CPU - lmg %r0,%r10,__PT_R0(%r11) - mvc __LC_RETURN_PSW(16),__PT_PSW(%r11) -+.Lio_exit_timer: - stpt __LC_EXIT_TIMER - mvc __VDSO_ECTG_BASE(16,%r14),__LC_EXIT_TIMER - lmg %r11,%r15,__PT_R11(%r11) -@@ -1118,15 +1120,23 @@ cleanup_critical: - br %r14 - - .Lcleanup_sysc_restore: -+ # check if stpt has been executed - clg %r9,BASED(.Lcleanup_sysc_restore_insn) -+ jh 0f -+ mvc __LC_EXIT_TIMER(8),__LC_ASYNC_ENTER_TIMER -+ cghi %r11,__LC_SAVE_AREA_ASYNC - je 0f -+ mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER -+0: clg %r9,BASED(.Lcleanup_sysc_restore_insn+8) -+ je 1f - lg %r9,24(%r11) # get saved pointer to pt_regs - mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) - mvc 0(64,%r11),__PT_R8(%r9) - lmg %r0,%r7,__PT_R0(%r9) --0: lmg %r8,%r9,__LC_RETURN_PSW -+1: lmg %r8,%r9,__LC_RETURN_PSW - br %r14 - .Lcleanup_sysc_restore_insn: -+ .quad .Lsysc_exit_timer - .quad .Lsysc_done - 4 - - .Lcleanup_io_tif: -@@ -1134,15 +1144,20 @@ cleanup_critical: - br %r14 - - .Lcleanup_io_restore: -+ # check if stpt has been executed - clg %r9,BASED(.Lcleanup_io_restore_insn) -- je 0f -+ jh 0f -+ mvc __LC_EXIT_TIMER(8),__LC_MCCK_ENTER_TIMER -+0: clg %r9,BASED(.Lcleanup_io_restore_insn+8) -+ je 1f - lg %r9,24(%r11) # get saved r11 pointer to pt_regs - mvc __LC_RETURN_PSW(16),__PT_PSW(%r9) - mvc 0(64,%r11),__PT_R8(%r9) - lmg %r0,%r7,__PT_R0(%r9) --0: lmg %r8,%r9,__LC_RETURN_PSW -+1: lmg %r8,%r9,__LC_RETURN_PSW - br %r14 - .Lcleanup_io_restore_insn: -+ .quad .Lio_exit_timer - .quad .Lio_done - 4 - - .Lcleanup_idle: -diff --git a/arch/x86/kernel/fpu/init.c b/arch/x86/kernel/fpu/init.c -index be39b5fde4b9..1011c05b1bd5 100644 ---- a/arch/x86/kernel/fpu/init.c -+++ b/arch/x86/kernel/fpu/init.c -@@ -96,6 +96,7 @@ static void fpu__init_system_early_generic(struct cpuinfo_x86 *c) - * Boot time FPU feature detection code: - */ - unsigned int mxcsr_feature_mask __read_mostly = 0xffffffffu; -+EXPORT_SYMBOL_GPL(mxcsr_feature_mask); - - static void __init fpu__init_system_mxcsr(void) - { -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 281899da19d4..ae2b9cd358f2 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -3140,11 +3140,14 @@ static void kvm_vcpu_ioctl_x86_get_xsave(struct kvm_vcpu *vcpu, - } - } - -+#define XSAVE_MXCSR_OFFSET 24 -+ - static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu, - struct kvm_xsave *guest_xsave) - { - u64 xstate_bv = - *(u64 *)&guest_xsave->region[XSAVE_HDR_OFFSET / sizeof(u32)]; -+ u32 mxcsr = *(u32 *)&guest_xsave->region[XSAVE_MXCSR_OFFSET / sizeof(u32)]; - - if (cpu_has_xsave) { - /* -@@ -3152,11 +3155,13 @@ static int kvm_vcpu_ioctl_x86_set_xsave(struct kvm_vcpu *vcpu, - * CPUID leaf 0xD, index 0, EDX:EAX. This is for compatibility - * with old userspace. - */ -- if (xstate_bv & ~kvm_supported_xcr0()) -+ if (xstate_bv & ~kvm_supported_xcr0() || -+ mxcsr & ~mxcsr_feature_mask) - return -EINVAL; - load_xsave(vcpu, (u8 *)guest_xsave->region); - } else { -- if (xstate_bv & ~XFEATURE_MASK_FPSSE) -+ if (xstate_bv & ~XFEATURE_MASK_FPSSE || -+ mxcsr & ~mxcsr_feature_mask) - return -EINVAL; - memcpy(&vcpu->arch.guest_fpu.state.fxsave, - guest_xsave->region, sizeof(struct fxregs_state)); -@@ -4603,16 +4608,20 @@ emul_write: - - static int kernel_pio(struct kvm_vcpu *vcpu, void *pd) - { -- /* TODO: String I/O for in kernel device */ -- int r; -+ int r = 0, i; - -- if (vcpu->arch.pio.in) -- r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port, -- vcpu->arch.pio.size, pd); -- else -- r = kvm_io_bus_write(vcpu, KVM_PIO_BUS, -- vcpu->arch.pio.port, vcpu->arch.pio.size, -- pd); -+ for (i = 0; i < vcpu->arch.pio.count; i++) { -+ if (vcpu->arch.pio.in) -+ r = kvm_io_bus_read(vcpu, KVM_PIO_BUS, vcpu->arch.pio.port, -+ vcpu->arch.pio.size, pd); -+ else -+ r = kvm_io_bus_write(vcpu, KVM_PIO_BUS, -+ vcpu->arch.pio.port, vcpu->arch.pio.size, -+ pd); -+ if (r) -+ break; -+ pd += vcpu->arch.pio.size; -+ } - return r; - } - -@@ -4650,6 +4659,8 @@ static int emulator_pio_in_emulated(struct x86_emulate_ctxt *ctxt, - if (vcpu->arch.pio.count) - goto data_avail; - -+ memset(vcpu->arch.pio_data, 0, size * count); -+ - ret = emulator_pio_in_out(vcpu, size, port, val, count, true); - if (ret) { - data_avail: -diff --git a/drivers/char/lp.c b/drivers/char/lp.c -index c4094c4e22c1..34ef474a3923 100644 ---- a/drivers/char/lp.c -+++ b/drivers/char/lp.c -@@ -859,7 +859,11 @@ static int __init lp_setup (char *str) - } else if (!strcmp(str, "auto")) { - parport_nr[0] = LP_PARPORT_AUTO; - } else if (!strcmp(str, "none")) { -- parport_nr[parport_ptr++] = LP_PARPORT_NONE; -+ if (parport_ptr < LP_NO) -+ parport_nr[parport_ptr++] = LP_PARPORT_NONE; -+ else -+ printk(KERN_INFO "lp: too many ports, %s ignored.\n", -+ str); - } else if (!strcmp(str, "reset")) { - reset = 1; - } -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index e901463d4972..0975d23031ea 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -343,6 +343,11 @@ static const struct vm_operations_struct mmap_mem_ops = { - static int mmap_mem(struct file *file, struct vm_area_struct *vma) - { - size_t size = vma->vm_end - vma->vm_start; -+ phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; -+ -+ /* It's illegal to wrap around the end of the physical address space. */ -+ if (offset + (phys_addr_t)size < offset) -+ return -EINVAL; - - if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size)) - return -EINVAL; -diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c -index 2b21398c3adc..35308dfff754 100644 ---- a/drivers/char/tpm/tpm_crb.c -+++ b/drivers/char/tpm/tpm_crb.c -@@ -118,8 +118,7 @@ static int crb_recv(struct tpm_chip *chip, u8 *buf, size_t count) - - memcpy_fromio(buf, priv->rsp, 6); - expected = be32_to_cpup((__be32 *) &buf[2]); -- -- if (expected > count) -+ if (expected > count || expected < 6) - return -EIO; - - memcpy_fromio(&buf[6], &priv->rsp[6], expected - 6); -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -index 5b261adb4b69..3a25da4a6e60 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v10_0.c -@@ -1126,23 +1126,10 @@ static u32 dce_v10_0_latency_watermark(struct dce10_wm_params *wm) - a.full = dfixed_const(available_bandwidth); - b.full = dfixed_const(wm->num_heads); - a.full = dfixed_div(a, b); -+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512); -+ tmp = min(dfixed_trunc(a), tmp); - -- b.full = dfixed_const(mc_latency + 512); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(b, c); -- -- c.full = dfixed_const(dmif_size); -- b.full = dfixed_div(c, b); -- -- tmp = min(dfixed_trunc(a), dfixed_trunc(b)); -- -- b.full = dfixed_const(1000); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(c, b); -- c.full = dfixed_const(wm->bytes_per_pixel); -- b.full = dfixed_mul(b, c); -- -- lb_fill_bw = min(tmp, dfixed_trunc(b)); -+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000); - - a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); - b.full = dfixed_const(1000); -@@ -1250,14 +1237,14 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev, - { - struct drm_display_mode *mode = &amdgpu_crtc->base.mode; - struct dce10_wm_params wm_low, wm_high; -- u32 pixel_period; -+ u32 active_time; - u32 line_time = 0; - u32 latency_watermark_a = 0, latency_watermark_b = 0; - u32 tmp, wm_mask, lb_vblank_lead_lines = 0; - - if (amdgpu_crtc->base.enabled && num_heads && mode) { -- pixel_period = 1000000 / (u32)mode->clock; -- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535); -+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; -+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); - - /* watermark for high clocks */ - if (adev->pm.dpm_enabled) { -@@ -1272,7 +1259,7 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev, - - wm_high.disp_clk = mode->clock; - wm_high.src_width = mode->crtc_hdisplay; -- wm_high.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_high.active_time = active_time; - wm_high.blank_time = line_time - wm_high.active_time; - wm_high.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -@@ -1311,7 +1298,7 @@ static void dce_v10_0_program_watermarks(struct amdgpu_device *adev, - - wm_low.disp_clk = mode->clock; - wm_low.src_width = mode->crtc_hdisplay; -- wm_low.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_low.active_time = active_time; - wm_low.blank_time = line_time - wm_low.active_time; - wm_low.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -index 267749a94c5a..d6d3cda77762 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v11_0.c -@@ -1114,23 +1114,10 @@ static u32 dce_v11_0_latency_watermark(struct dce10_wm_params *wm) - a.full = dfixed_const(available_bandwidth); - b.full = dfixed_const(wm->num_heads); - a.full = dfixed_div(a, b); -+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512); -+ tmp = min(dfixed_trunc(a), tmp); - -- b.full = dfixed_const(mc_latency + 512); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(b, c); -- -- c.full = dfixed_const(dmif_size); -- b.full = dfixed_div(c, b); -- -- tmp = min(dfixed_trunc(a), dfixed_trunc(b)); -- -- b.full = dfixed_const(1000); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(c, b); -- c.full = dfixed_const(wm->bytes_per_pixel); -- b.full = dfixed_mul(b, c); -- -- lb_fill_bw = min(tmp, dfixed_trunc(b)); -+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000); - - a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); - b.full = dfixed_const(1000); -@@ -1238,14 +1225,14 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev, - { - struct drm_display_mode *mode = &amdgpu_crtc->base.mode; - struct dce10_wm_params wm_low, wm_high; -- u32 pixel_period; -+ u32 active_time; - u32 line_time = 0; - u32 latency_watermark_a = 0, latency_watermark_b = 0; - u32 tmp, wm_mask, lb_vblank_lead_lines = 0; - - if (amdgpu_crtc->base.enabled && num_heads && mode) { -- pixel_period = 1000000 / (u32)mode->clock; -- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535); -+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; -+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); - - /* watermark for high clocks */ - if (adev->pm.dpm_enabled) { -@@ -1260,7 +1247,7 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev, - - wm_high.disp_clk = mode->clock; - wm_high.src_width = mode->crtc_hdisplay; -- wm_high.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_high.active_time = active_time; - wm_high.blank_time = line_time - wm_high.active_time; - wm_high.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -@@ -1299,7 +1286,7 @@ static void dce_v11_0_program_watermarks(struct amdgpu_device *adev, - - wm_low.disp_clk = mode->clock; - wm_low.src_width = mode->crtc_hdisplay; -- wm_low.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_low.active_time = active_time; - wm_low.blank_time = line_time - wm_low.active_time; - wm_low.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -diff --git a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -index 9b4dcf76ce6c..d6e51d4b04f0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -+++ b/drivers/gpu/drm/amd/amdgpu/dce_v8_0.c -@@ -1096,23 +1096,10 @@ static u32 dce_v8_0_latency_watermark(struct dce8_wm_params *wm) - a.full = dfixed_const(available_bandwidth); - b.full = dfixed_const(wm->num_heads); - a.full = dfixed_div(a, b); -+ tmp = div_u64((u64) dmif_size * (u64) wm->disp_clk, mc_latency + 512); -+ tmp = min(dfixed_trunc(a), tmp); - -- b.full = dfixed_const(mc_latency + 512); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(b, c); -- -- c.full = dfixed_const(dmif_size); -- b.full = dfixed_div(c, b); -- -- tmp = min(dfixed_trunc(a), dfixed_trunc(b)); -- -- b.full = dfixed_const(1000); -- c.full = dfixed_const(wm->disp_clk); -- b.full = dfixed_div(c, b); -- c.full = dfixed_const(wm->bytes_per_pixel); -- b.full = dfixed_mul(b, c); -- -- lb_fill_bw = min(tmp, dfixed_trunc(b)); -+ lb_fill_bw = min(tmp, wm->disp_clk * wm->bytes_per_pixel / 1000); - - a.full = dfixed_const(max_src_lines_per_dst_line * wm->src_width * wm->bytes_per_pixel); - b.full = dfixed_const(1000); -@@ -1220,14 +1207,14 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev, - { - struct drm_display_mode *mode = &amdgpu_crtc->base.mode; - struct dce8_wm_params wm_low, wm_high; -- u32 pixel_period; -+ u32 active_time; - u32 line_time = 0; - u32 latency_watermark_a = 0, latency_watermark_b = 0; - u32 tmp, wm_mask, lb_vblank_lead_lines = 0; - - if (amdgpu_crtc->base.enabled && num_heads && mode) { -- pixel_period = 1000000 / (u32)mode->clock; -- line_time = min((u32)mode->crtc_htotal * pixel_period, (u32)65535); -+ active_time = 1000000UL * (u32)mode->crtc_hdisplay / (u32)mode->clock; -+ line_time = min((u32) (1000000UL * (u32)mode->crtc_htotal / (u32)mode->clock), (u32)65535); - - /* watermark for high clocks */ - if (adev->pm.dpm_enabled) { -@@ -1242,7 +1229,7 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev, - - wm_high.disp_clk = mode->clock; - wm_high.src_width = mode->crtc_hdisplay; -- wm_high.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_high.active_time = active_time; - wm_high.blank_time = line_time - wm_high.active_time; - wm_high.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -@@ -1281,7 +1268,7 @@ static void dce_v8_0_program_watermarks(struct amdgpu_device *adev, - - wm_low.disp_clk = mode->clock; - wm_low.src_width = mode->crtc_hdisplay; -- wm_low.active_time = mode->crtc_hdisplay * pixel_period; -+ wm_low.active_time = active_time; - wm_low.blank_time = line_time - wm_low.active_time; - wm_low.interlaced = false; - if (mode->flags & DRM_MODE_FLAG_INTERLACE) -diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c -index cc1e16fd7e76..c0106fd9fae9 100644 ---- a/drivers/gpu/drm/drm_edid.c -+++ b/drivers/gpu/drm/drm_edid.c -@@ -75,6 +75,8 @@ - #define EDID_QUIRK_FORCE_12BPC (1 << 9) - /* Force 6bpc */ - #define EDID_QUIRK_FORCE_6BPC (1 << 10) -+/* Force 10bpc */ -+#define EDID_QUIRK_FORCE_10BPC (1 << 11) - - struct detailed_mode_closure { - struct drm_connector *connector; -@@ -117,6 +119,9 @@ static struct edid_quirk { - { "FCM", 13600, EDID_QUIRK_PREFER_LARGE_75 | - EDID_QUIRK_DETAILED_IN_CM }, - -+ /* LGD panel of HP zBook 17 G2, eDP 10 bpc, but reports unknown bpc */ -+ { "LGD", 764, EDID_QUIRK_FORCE_10BPC }, -+ - /* LG Philips LCD LP154W01-A5 */ - { "LPL", 0, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE }, - { "LPL", 0x2a00, EDID_QUIRK_DETAILED_USE_MAXIMUM_SIZE }, -@@ -3834,6 +3839,9 @@ int drm_add_edid_modes(struct drm_connector *connector, struct edid *edid) - if (quirks & EDID_QUIRK_FORCE_8BPC) - connector->display_info.bpc = 8; - -+ if (quirks & EDID_QUIRK_FORCE_10BPC) -+ connector->display_info.bpc = 10; -+ - if (quirks & EDID_QUIRK_FORCE_12BPC) - connector->display_info.bpc = 12; - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c -index 949dc6101a58..7c0b58613747 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/base.c -@@ -130,7 +130,7 @@ nvkm_therm_update(struct nvkm_therm *therm, int mode) - poll = false; - } - -- if (list_empty(&therm->alarm.head) && poll) -+ if (poll) - nvkm_timer_alarm(tmr, 1000000000ULL, &therm->alarm); - spin_unlock_irqrestore(&therm->lock, flags); - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c -index 91198d79393a..e2feccec25f5 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fan.c -@@ -83,7 +83,7 @@ nvkm_fan_update(struct nvkm_fan *fan, bool immediate, int target) - spin_unlock_irqrestore(&fan->lock, flags); - - /* schedule next fan update, if not at target speed already */ -- if (list_empty(&fan->alarm.head) && target != duty) { -+ if (target != duty) { - u16 bump_period = fan->bios.bump_period; - u16 slow_down_period = fan->bios.slow_down_period; - u64 delay; -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c -index 59701b7a6597..ff9fbe7950e5 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/fantog.c -@@ -53,7 +53,7 @@ nvkm_fantog_update(struct nvkm_fantog *fan, int percent) - duty = !nvkm_gpio_get(gpio, 0, DCB_GPIO_FAN, 0xff); - nvkm_gpio_set(gpio, 0, DCB_GPIO_FAN, 0xff, duty); - -- if (list_empty(&fan->alarm.head) && percent != (duty * 100)) { -+ if (percent != (duty * 100)) { - u64 next_change = (percent * fan->period_us) / 100; - if (!duty) - next_change = fan->period_us - next_change; -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c -index b9703c02d8ca..9a79e91fdfdc 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/therm/temp.c -@@ -185,7 +185,7 @@ alarm_timer_callback(struct nvkm_alarm *alarm) - spin_unlock_irqrestore(&therm->sensor.alarm_program_lock, flags); - - /* schedule the next poll in one second */ -- if (therm->func->temp_get(therm) >= 0 && list_empty(&alarm->head)) -+ if (therm->func->temp_get(therm) >= 0) - nvkm_timer_alarm(tmr, 1000000000ULL, alarm); - } - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -index d4dae1f12d62..79fcdb43e174 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -@@ -36,23 +36,29 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr) - unsigned long flags; - LIST_HEAD(exec); - -- /* move any due alarms off the pending list */ -+ /* Process pending alarms. */ - spin_lock_irqsave(&tmr->lock, flags); - list_for_each_entry_safe(alarm, atemp, &tmr->alarms, head) { -- if (alarm->timestamp <= nvkm_timer_read(tmr)) -- list_move_tail(&alarm->head, &exec); -+ /* Have we hit the earliest alarm that hasn't gone off? */ -+ if (alarm->timestamp > nvkm_timer_read(tmr)) { -+ /* Schedule it. If we didn't race, we're done. */ -+ tmr->func->alarm_init(tmr, alarm->timestamp); -+ if (alarm->timestamp > nvkm_timer_read(tmr)) -+ break; -+ } -+ -+ /* Move to completed list. We'll drop the lock before -+ * executing the callback so it can reschedule itself. -+ */ -+ list_move_tail(&alarm->head, &exec); - } - -- /* reschedule interrupt for next alarm time */ -- if (!list_empty(&tmr->alarms)) { -- alarm = list_first_entry(&tmr->alarms, typeof(*alarm), head); -- tmr->func->alarm_init(tmr, alarm->timestamp); -- } else { -+ /* Shut down interrupt if no more pending alarms. */ -+ if (list_empty(&tmr->alarms)) - tmr->func->alarm_fini(tmr); -- } - spin_unlock_irqrestore(&tmr->lock, flags); - -- /* execute any pending alarm handlers */ -+ /* Execute completed callbacks. */ - list_for_each_entry_safe(alarm, atemp, &exec, head) { - list_del_init(&alarm->head); - alarm->func(alarm); -@@ -65,24 +71,37 @@ nvkm_timer_alarm(struct nvkm_timer *tmr, u32 nsec, struct nvkm_alarm *alarm) - struct nvkm_alarm *list; - unsigned long flags; - -- alarm->timestamp = nvkm_timer_read(tmr) + nsec; -- -- /* append new alarm to list, in soonest-alarm-first order */ -+ /* Remove alarm from pending list. -+ * -+ * This both protects against the corruption of the list, -+ * and implements alarm rescheduling/cancellation. -+ */ - spin_lock_irqsave(&tmr->lock, flags); -- if (!nsec) { -- if (!list_empty(&alarm->head)) -- list_del(&alarm->head); -- } else { -+ list_del_init(&alarm->head); -+ -+ if (nsec) { -+ /* Insert into pending list, ordered earliest to latest. */ -+ alarm->timestamp = nvkm_timer_read(tmr) + nsec; - list_for_each_entry(list, &tmr->alarms, head) { - if (list->timestamp > alarm->timestamp) - break; - } -+ - list_add_tail(&alarm->head, &list->head); -+ -+ /* Update HW if this is now the earliest alarm. */ -+ list = list_first_entry(&tmr->alarms, typeof(*list), head); -+ if (list == alarm) { -+ tmr->func->alarm_init(tmr, alarm->timestamp); -+ /* This shouldn't happen if callers aren't stupid. -+ * -+ * Worst case scenario is that it'll take roughly -+ * 4 seconds for the next alarm to trigger. -+ */ -+ WARN_ON(alarm->timestamp <= nvkm_timer_read(tmr)); -+ } - } - spin_unlock_irqrestore(&tmr->lock, flags); -- -- /* process pending alarms */ -- nvkm_timer_alarm_trigger(tmr); - } - - void -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c -index 7b9ce87f0617..7f48249f41de 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/nv04.c -@@ -76,8 +76,8 @@ nv04_timer_intr(struct nvkm_timer *tmr) - u32 stat = nvkm_rd32(device, NV04_PTIMER_INTR_0); - - if (stat & 0x00000001) { -- nvkm_timer_alarm_trigger(tmr); - nvkm_wr32(device, NV04_PTIMER_INTR_0, 0x00000001); -+ nvkm_timer_alarm_trigger(tmr); - stat &= ~0x00000001; - } - -diff --git a/drivers/iio/dac/ad7303.c b/drivers/iio/dac/ad7303.c -index e690dd11e99f..4b0f942b8914 100644 ---- a/drivers/iio/dac/ad7303.c -+++ b/drivers/iio/dac/ad7303.c -@@ -184,9 +184,9 @@ static const struct iio_chan_spec_ext_info ad7303_ext_info[] = { - .address = (chan), \ - .scan_type = { \ - .sign = 'u', \ -- .realbits = '8', \ -- .storagebits = '8', \ -- .shift = '0', \ -+ .realbits = 8, \ -+ .storagebits = 8, \ -+ .shift = 0, \ - }, \ - .ext_info = ad7303_ext_info, \ - } -diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c -index a0aedda7dfd7..bf0bd7e03aff 100644 ---- a/drivers/iio/proximity/as3935.c -+++ b/drivers/iio/proximity/as3935.c -@@ -50,7 +50,6 @@ - #define AS3935_TUNE_CAP 0x08 - #define AS3935_CALIBRATE 0x3D - --#define AS3935_WRITE_DATA BIT(15) - #define AS3935_READ_DATA BIT(14) - #define AS3935_ADDRESS(x) ((x) << 8) - -@@ -105,7 +104,7 @@ static int as3935_write(struct as3935_state *st, - { - u8 *buf = st->buf; - -- buf[0] = (AS3935_WRITE_DATA | AS3935_ADDRESS(reg)) >> 8; -+ buf[0] = AS3935_ADDRESS(reg) >> 8; - buf[1] = val; - - return spi_write(st->spi, buf, 2); -diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c -index 34b1adad07aa..6a8024d9d742 100644 ---- a/drivers/infiniband/core/addr.c -+++ b/drivers/infiniband/core/addr.c -@@ -277,8 +277,8 @@ static int addr6_resolve(struct sockaddr_in6 *src_in, - fl6.saddr = src_in->sin6_addr; - fl6.flowi6_oif = addr->bound_dev_if; - -- dst = ip6_route_output(addr->net, NULL, &fl6); -- if ((ret = dst->error)) -+ ret = ipv6_stub->ipv6_dst_lookup(addr->net, NULL, &dst, &fl6); -+ if (ret < 0) - goto put; - - if (ipv6_addr_any(&fl6.saddr)) { -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index 0628372f3591..b92b8a724efb 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -2005,11 +2005,14 @@ static int domain_context_mapping_one(struct dmar_domain *domain, - if (context_copied(context)) { - u16 did_old = context_domain_id(context); - -- if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) -+ if (did_old >= 0 && did_old < cap_ndoms(iommu->cap)) { - iommu->flush.flush_context(iommu, did_old, - (((u16)bus) << 8) | devfn, - DMA_CCMD_MASK_NOBIT, - DMA_CCMD_DEVICE_INVL); -+ iommu->flush.flush_iotlb(iommu, did_old, 0, 0, -+ DMA_TLB_DSI_FLUSH); -+ } - } - - pgd = domain->pgd; -diff --git a/drivers/md/Kconfig b/drivers/md/Kconfig -index 7913fdcfc849..108249f52fa9 100644 ---- a/drivers/md/Kconfig -+++ b/drivers/md/Kconfig -@@ -357,6 +357,7 @@ config DM_LOG_USERSPACE - config DM_RAID - tristate "RAID 1/4/5/6/10 target" - depends on BLK_DEV_DM -+ select MD_RAID0 - select MD_RAID1 - select MD_RAID10 - select MD_RAID456 -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 2dd33085b331..cdceefd0e57d 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -222,7 +222,7 @@ static DEFINE_SPINLOCK(param_spinlock); - * Buffers are freed after this timeout - */ - static unsigned dm_bufio_max_age = DM_BUFIO_DEFAULT_AGE_SECS; --static unsigned dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES; -+static unsigned long dm_bufio_retain_bytes = DM_BUFIO_DEFAULT_RETAIN_BYTES; - - static unsigned long dm_bufio_peak_allocated; - static unsigned long dm_bufio_allocated_kmem_cache; -@@ -914,10 +914,11 @@ static void __get_memory_limit(struct dm_bufio_client *c, - { - unsigned long buffers; - -- if (ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch) { -- mutex_lock(&dm_bufio_clients_lock); -- __cache_size_refresh(); -- mutex_unlock(&dm_bufio_clients_lock); -+ if (unlikely(ACCESS_ONCE(dm_bufio_cache_size) != dm_bufio_cache_size_latch)) { -+ if (mutex_trylock(&dm_bufio_clients_lock)) { -+ __cache_size_refresh(); -+ mutex_unlock(&dm_bufio_clients_lock); -+ } - } - - buffers = dm_bufio_cache_size_per_client >> -@@ -1513,10 +1514,10 @@ static bool __try_evict_buffer(struct dm_buffer *b, gfp_t gfp) - return true; - } - --static unsigned get_retain_buffers(struct dm_bufio_client *c) -+static unsigned long get_retain_buffers(struct dm_bufio_client *c) - { -- unsigned retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes); -- return retain_bytes / c->block_size; -+ unsigned long retain_bytes = ACCESS_ONCE(dm_bufio_retain_bytes); -+ return retain_bytes >> (c->sectors_per_block_bits + SECTOR_SHIFT); - } - - static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan, -@@ -1526,7 +1527,7 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan, - struct dm_buffer *b, *tmp; - unsigned long freed = 0; - unsigned long count = nr_to_scan; -- unsigned retain_target = get_retain_buffers(c); -+ unsigned long retain_target = get_retain_buffers(c); - - for (l = 0; l < LIST_SIZE; l++) { - list_for_each_entry_safe_reverse(b, tmp, &c->lru[l], lru_list) { -@@ -1752,11 +1753,19 @@ static bool older_than(struct dm_buffer *b, unsigned long age_hz) - static void __evict_old_buffers(struct dm_bufio_client *c, unsigned long age_hz) - { - struct dm_buffer *b, *tmp; -- unsigned retain_target = get_retain_buffers(c); -- unsigned count; -+ unsigned long retain_target = get_retain_buffers(c); -+ unsigned long count; -+ LIST_HEAD(write_list); - - dm_bufio_lock(c); - -+ __check_watermark(c, &write_list); -+ if (unlikely(!list_empty(&write_list))) { -+ dm_bufio_unlock(c); -+ __flush_write_list(&write_list); -+ dm_bufio_lock(c); -+ } -+ - count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY]; - list_for_each_entry_safe_reverse(b, tmp, &c->lru[LIST_CLEAN], lru_list) { - if (count <= retain_target) -@@ -1781,6 +1790,8 @@ static void cleanup_old_buffers(void) - - mutex_lock(&dm_bufio_clients_lock); - -+ __cache_size_refresh(); -+ - list_for_each_entry(c, &dm_bufio_all_clients, client_list) - __evict_old_buffers(c, max_age_hz); - -@@ -1904,7 +1915,7 @@ MODULE_PARM_DESC(max_cache_size_bytes, "Size of metadata cache"); - module_param_named(max_age_seconds, dm_bufio_max_age, uint, S_IRUGO | S_IWUSR); - MODULE_PARM_DESC(max_age_seconds, "Max age of a buffer in seconds"); - --module_param_named(retain_bytes, dm_bufio_retain_bytes, uint, S_IRUGO | S_IWUSR); -+module_param_named(retain_bytes, dm_bufio_retain_bytes, ulong, S_IRUGO | S_IWUSR); - MODULE_PARM_DESC(retain_bytes, "Try to keep at least this many bytes cached in memory"); - - module_param_named(peak_allocated_bytes, dm_bufio_peak_allocated, ulong, S_IRUGO | S_IWUSR); -diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c -index 3970cda10080..d3c55d7754af 100644 ---- a/drivers/md/dm-cache-metadata.c -+++ b/drivers/md/dm-cache-metadata.c -@@ -1326,17 +1326,19 @@ void dm_cache_metadata_set_stats(struct dm_cache_metadata *cmd, - - int dm_cache_commit(struct dm_cache_metadata *cmd, bool clean_shutdown) - { -- int r; -+ int r = -EINVAL; - flags_mutator mutator = (clean_shutdown ? set_clean_shutdown : - clear_clean_shutdown); - - WRITE_LOCK(cmd); -+ if (cmd->fail_io) -+ goto out; -+ - r = __commit_transaction(cmd, mutator); - if (r) - goto out; - - r = __begin_transaction(cmd); -- - out: - WRITE_UNLOCK(cmd); - return r; -@@ -1348,7 +1350,8 @@ int dm_cache_get_free_metadata_block_count(struct dm_cache_metadata *cmd, - int r = -EINVAL; - - READ_LOCK(cmd); -- r = dm_sm_get_nr_free(cmd->metadata_sm, result); -+ if (!cmd->fail_io) -+ r = dm_sm_get_nr_free(cmd->metadata_sm, result); - READ_UNLOCK(cmd); - - return r; -@@ -1360,7 +1363,8 @@ int dm_cache_get_metadata_dev_size(struct dm_cache_metadata *cmd, - int r = -EINVAL; - - READ_LOCK(cmd); -- r = dm_sm_get_nr_blocks(cmd->metadata_sm, result); -+ if (!cmd->fail_io) -+ r = dm_sm_get_nr_blocks(cmd->metadata_sm, result); - READ_UNLOCK(cmd); - - return r; -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 911ada643364..3b67afda430b 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -485,11 +485,11 @@ static int __write_initial_superblock(struct dm_pool_metadata *pmd) - if (r < 0) - return r; - -- r = save_sm_roots(pmd); -+ r = dm_tm_pre_commit(pmd->tm); - if (r < 0) - return r; - -- r = dm_tm_pre_commit(pmd->tm); -+ r = save_sm_roots(pmd); - if (r < 0) - return r; - -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index b1ced58eb5e1..a1a68209bd36 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -887,8 +887,12 @@ static int find_key(struct ro_spine *s, dm_block_t block, bool find_highest, - else - *result_key = le64_to_cpu(ro_node(s)->keys[0]); - -- if (next_block || flags & INTERNAL_NODE) -- block = value64(ro_node(s), i); -+ if (next_block || flags & INTERNAL_NODE) { -+ if (find_highest) -+ block = value64(ro_node(s), i); -+ else -+ block = value64(ro_node(s), 0); -+ } - - } while (flags & INTERNAL_NODE); - -diff --git a/drivers/md/persistent-data/dm-space-map-disk.c b/drivers/md/persistent-data/dm-space-map-disk.c -index ebb280a14325..32adf6b4a9c7 100644 ---- a/drivers/md/persistent-data/dm-space-map-disk.c -+++ b/drivers/md/persistent-data/dm-space-map-disk.c -@@ -142,10 +142,23 @@ static int sm_disk_inc_block(struct dm_space_map *sm, dm_block_t b) - - static int sm_disk_dec_block(struct dm_space_map *sm, dm_block_t b) - { -+ int r; -+ uint32_t old_count; - enum allocation_event ev; - struct sm_disk *smd = container_of(sm, struct sm_disk, sm); - -- return sm_ll_dec(&smd->ll, b, &ev); -+ r = sm_ll_dec(&smd->ll, b, &ev); -+ if (!r && (ev == SM_FREE)) { -+ /* -+ * It's only free if it's also free in the last -+ * transaction. -+ */ -+ r = sm_ll_lookup(&smd->old_ll, b, &old_count); -+ if (!r && !old_count) -+ smd->nr_allocated_this_transaction--; -+ } -+ -+ return r; - } - - static int sm_disk_new_block(struct dm_space_map *sm, dm_block_t *b) -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 7af976934441..4384b46cee1a 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -2232,6 +2232,10 @@ static int resize_stripes(struct r5conf *conf, int newsize) - err = -ENOMEM; - - mutex_unlock(&conf->cache_size_mutex); -+ -+ conf->slab_cache = sc; -+ conf->active_name = 1-conf->active_name; -+ - /* Step 4, return new stripes to service */ - while(!list_empty(&newstripes)) { - nsh = list_entry(newstripes.next, struct stripe_head, lru); -@@ -2249,8 +2253,6 @@ static int resize_stripes(struct r5conf *conf, int newsize) - } - /* critical section pass, GFP_NOIO no longer needed */ - -- conf->slab_cache = sc; -- conf->active_name = 1-conf->active_name; - if (!err) - conf->pool_size = newsize; - return err; -diff --git a/drivers/media/dvb-frontends/cxd2841er.c b/drivers/media/dvb-frontends/cxd2841er.c -index fdffb2f0ded8..107853b0fddd 100644 ---- a/drivers/media/dvb-frontends/cxd2841er.c -+++ b/drivers/media/dvb-frontends/cxd2841er.c -@@ -2678,7 +2678,9 @@ static struct dvb_frontend_ops cxd2841er_dvbt_t2_ops = { - FE_CAN_MUTE_TS | - FE_CAN_2G_MODULATION, - .frequency_min = 42000000, -- .frequency_max = 1002000000 -+ .frequency_max = 1002000000, -+ .symbol_rate_min = 870000, -+ .symbol_rate_max = 11700000 - }, - .init = cxd2841er_init_tc, - .sleep = cxd2841er_sleep_tc, -diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc.c b/drivers/media/platform/s5p-mfc/s5p_mfc.c -index c8946f98ced4..7727789dbda1 100644 ---- a/drivers/media/platform/s5p-mfc/s5p_mfc.c -+++ b/drivers/media/platform/s5p-mfc/s5p_mfc.c -@@ -173,6 +173,7 @@ static void s5p_mfc_watchdog_worker(struct work_struct *work) - } - s5p_mfc_clock_on(); - ret = s5p_mfc_init_hw(dev); -+ s5p_mfc_clock_off(); - if (ret) - mfc_err("Failed to reinit FW\n"); - } -diff --git a/drivers/media/rc/mceusb.c b/drivers/media/rc/mceusb.c -index 2cdb740cde48..f838d9c7ed12 100644 ---- a/drivers/media/rc/mceusb.c -+++ b/drivers/media/rc/mceusb.c -@@ -1321,8 +1321,8 @@ static int mceusb_dev_probe(struct usb_interface *intf, - } - } - } -- if (ep_in == NULL) { -- dev_dbg(&intf->dev, "inbound and/or endpoint not found"); -+ if (!ep_in || !ep_out) { -+ dev_dbg(&intf->dev, "required endpoints not found\n"); - return -ENODEV; - } - -diff --git a/drivers/media/tuners/tuner-xc2028.c b/drivers/media/tuners/tuner-xc2028.c -index 317ef63ee789..8d96a22647b3 100644 ---- a/drivers/media/tuners/tuner-xc2028.c -+++ b/drivers/media/tuners/tuner-xc2028.c -@@ -281,6 +281,14 @@ static void free_firmware(struct xc2028_data *priv) - int i; - tuner_dbg("%s called\n", __func__); - -+ /* free allocated f/w string */ -+ if (priv->fname != firmware_name) -+ kfree(priv->fname); -+ priv->fname = NULL; -+ -+ priv->state = XC2028_NO_FIRMWARE; -+ memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); -+ - if (!priv->firm) - return; - -@@ -291,9 +299,6 @@ static void free_firmware(struct xc2028_data *priv) - - priv->firm = NULL; - priv->firm_size = 0; -- priv->state = XC2028_NO_FIRMWARE; -- -- memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); - } - - static int load_all_firmwares(struct dvb_frontend *fe, -@@ -884,9 +889,8 @@ read_not_reliable: - return 0; - - fail: -- priv->state = XC2028_NO_FIRMWARE; -+ free_firmware(priv); - -- memset(&priv->cur_fw, 0, sizeof(priv->cur_fw)); - if (retry_count < 8) { - msleep(50); - retry_count++; -@@ -1332,11 +1336,8 @@ static int xc2028_dvb_release(struct dvb_frontend *fe) - mutex_lock(&xc2028_list_mutex); - - /* only perform final cleanup if this is the last instance */ -- if (hybrid_tuner_report_instance_count(priv) == 1) { -+ if (hybrid_tuner_report_instance_count(priv) == 1) - free_firmware(priv); -- kfree(priv->ctrl.fname); -- priv->ctrl.fname = NULL; -- } - - if (priv) - hybrid_tuner_release_state(priv); -@@ -1399,19 +1400,8 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - - /* - * Copy the config data. -- * For the firmware name, keep a local copy of the string, -- * in order to avoid troubles during device release. - */ -- kfree(priv->ctrl.fname); -- priv->ctrl.fname = NULL; - memcpy(&priv->ctrl, p, sizeof(priv->ctrl)); -- if (p->fname) { -- priv->ctrl.fname = kstrdup(p->fname, GFP_KERNEL); -- if (priv->ctrl.fname == NULL) { -- rc = -ENOMEM; -- goto unlock; -- } -- } - - /* - * If firmware name changed, frees firmware. As free_firmware will -@@ -1426,10 +1416,15 @@ static int xc2028_set_config(struct dvb_frontend *fe, void *priv_cfg) - - if (priv->state == XC2028_NO_FIRMWARE) { - if (!firmware_name[0]) -- priv->fname = priv->ctrl.fname; -+ priv->fname = kstrdup(p->fname, GFP_KERNEL); - else - priv->fname = firmware_name; - -+ if (!priv->fname) { -+ rc = -ENOMEM; -+ goto unlock; -+ } -+ - rc = request_firmware_nowait(THIS_MODULE, 1, - priv->fname, - priv->i2c_props.adap->dev.parent, -diff --git a/drivers/media/usb/cx231xx/cx231xx-audio.c b/drivers/media/usb/cx231xx/cx231xx-audio.c -index de4ae5eb4830..10d8a08e36e6 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-audio.c -+++ b/drivers/media/usb/cx231xx/cx231xx-audio.c -@@ -671,10 +671,8 @@ static int cx231xx_audio_init(struct cx231xx *dev) - - spin_lock_init(&adev->slock); - err = snd_pcm_new(card, "Cx231xx Audio", 0, 0, 1, &pcm); -- if (err < 0) { -- snd_card_free(card); -- return err; -- } -+ if (err < 0) -+ goto err_free_card; - - snd_pcm_set_ops(pcm, SNDRV_PCM_STREAM_CAPTURE, - &snd_cx231xx_pcm_capture); -@@ -688,10 +686,9 @@ static int cx231xx_audio_init(struct cx231xx *dev) - INIT_WORK(&dev->wq_trigger, audio_trigger); - - err = snd_card_register(card); -- if (err < 0) { -- snd_card_free(card); -- return err; -- } -+ if (err < 0) -+ goto err_free_card; -+ - adev->sndcard = card; - adev->udev = dev->udev; - -@@ -701,6 +698,11 @@ static int cx231xx_audio_init(struct cx231xx *dev) - hs_config_info[0].interface_info. - audio_index + 1]; - -+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) { -+ err = -ENODEV; -+ goto err_free_card; -+ } -+ - adev->end_point_addr = - uif->altsetting[0].endpoint[isoc_pipe].desc. - bEndpointAddress; -@@ -710,13 +712,20 @@ static int cx231xx_audio_init(struct cx231xx *dev) - "audio EndPoint Addr 0x%x, Alternate settings: %i\n", - adev->end_point_addr, adev->num_alt); - adev->alt_max_pkt_size = kmalloc(32 * adev->num_alt, GFP_KERNEL); -- -- if (adev->alt_max_pkt_size == NULL) -- return -ENOMEM; -+ if (!adev->alt_max_pkt_size) { -+ err = -ENOMEM; -+ goto err_free_card; -+ } - - for (i = 0; i < adev->num_alt; i++) { -- u16 tmp = -- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc. -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) { -+ err = -ENODEV; -+ goto err_free_pkt_size; -+ } -+ -+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc. - wMaxPacketSize); - adev->alt_max_pkt_size[i] = - (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); -@@ -726,6 +735,13 @@ static int cx231xx_audio_init(struct cx231xx *dev) - } - - return 0; -+ -+err_free_pkt_size: -+ kfree(adev->alt_max_pkt_size); -+err_free_card: -+ snd_card_free(card); -+ -+ return err; - } - - static int cx231xx_audio_fini(struct cx231xx *dev) -diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c -index 8389c162bc89..2c5f76d588ac 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-cards.c -+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c -@@ -1447,6 +1447,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - - uif = udev->actconfig->interface[idx]; - -+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ - dev->video_mode.end_point_addr = uif->altsetting[0].endpoint[isoc_pipe].desc.bEndpointAddress; - dev->video_mode.num_alt = uif->num_altsetting; - -@@ -1460,7 +1463,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - return -ENOMEM; - - for (i = 0; i < dev->video_mode.num_alt; i++) { -- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ -+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe].desc.wMaxPacketSize); - dev->video_mode.alt_max_pkt_size[i] = (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); - dev_dbg(dev->dev, - "Alternate setting %i, max size= %i\n", i, -@@ -1477,6 +1485,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - } - uif = udev->actconfig->interface[idx]; - -+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ - dev->vbi_mode.end_point_addr = - uif->altsetting[0].endpoint[isoc_pipe].desc. - bEndpointAddress; -@@ -1493,8 +1504,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - return -ENOMEM; - - for (i = 0; i < dev->vbi_mode.num_alt; i++) { -- u16 tmp = -- le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ -+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. - desc.wMaxPacketSize); - dev->vbi_mode.alt_max_pkt_size[i] = - (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); -@@ -1514,6 +1529,9 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - } - uif = udev->actconfig->interface[idx]; - -+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ - dev->sliced_cc_mode.end_point_addr = - uif->altsetting[0].endpoint[isoc_pipe].desc. - bEndpointAddress; -@@ -1528,7 +1546,12 @@ static int cx231xx_init_v4l2(struct cx231xx *dev, - return -ENOMEM; - - for (i = 0; i < dev->sliced_cc_mode.num_alt; i++) { -- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) -+ return -ENODEV; -+ -+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[isoc_pipe]. - desc.wMaxPacketSize); - dev->sliced_cc_mode.alt_max_pkt_size[i] = - (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); -@@ -1693,6 +1716,11 @@ static int cx231xx_usb_probe(struct usb_interface *interface, - } - uif = udev->actconfig->interface[idx]; - -+ if (uif->altsetting[0].desc.bNumEndpoints < isoc_pipe + 1) { -+ retval = -ENODEV; -+ goto err_video_alt; -+ } -+ - dev->ts1_mode.end_point_addr = - uif->altsetting[0].endpoint[isoc_pipe]. - desc.bEndpointAddress; -@@ -1710,7 +1738,14 @@ static int cx231xx_usb_probe(struct usb_interface *interface, - } - - for (i = 0; i < dev->ts1_mode.num_alt; i++) { -- u16 tmp = le16_to_cpu(uif->altsetting[i]. -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < isoc_pipe + 1) { -+ retval = -ENODEV; -+ goto err_video_alt; -+ } -+ -+ tmp = le16_to_cpu(uif->altsetting[i]. - endpoint[isoc_pipe].desc. - wMaxPacketSize); - dev->ts1_mode.alt_max_pkt_size[i] = -diff --git a/drivers/media/usb/dvb-usb/dib0700_core.c b/drivers/media/usb/dvb-usb/dib0700_core.c -index ab58f0b9da5c..d1b4b729e814 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_core.c -+++ b/drivers/media/usb/dvb-usb/dib0700_core.c -@@ -783,6 +783,9 @@ int dib0700_rc_setup(struct dvb_usb_device *d, struct usb_interface *intf) - - /* Starting in firmware 1.20, the RC info is provided on a bulk pipe */ - -+ if (intf->altsetting[0].desc.bNumEndpoints < rc_ep + 1) -+ return -ENODEV; -+ - purb = usb_alloc_urb(0, GFP_KERNEL); - if (purb == NULL) { - err("rc usb alloc urb failed"); -diff --git a/drivers/media/usb/dvb-usb/ttusb2.c b/drivers/media/usb/dvb-usb/ttusb2.c -index f10717311e05..dd93c2c8fea9 100644 ---- a/drivers/media/usb/dvb-usb/ttusb2.c -+++ b/drivers/media/usb/dvb-usb/ttusb2.c -@@ -78,6 +78,9 @@ static int ttusb2_msg(struct dvb_usb_device *d, u8 cmd, - u8 *s, *r = NULL; - int ret = 0; - -+ if (4 + rlen > 64) -+ return -EIO; -+ - s = kzalloc(wlen+4, GFP_KERNEL); - if (!s) - return -ENOMEM; -@@ -381,6 +384,22 @@ static int ttusb2_i2c_xfer(struct i2c_adapter *adap,struct i2c_msg msg[],int num - write_read = i+1 < num && (msg[i+1].flags & I2C_M_RD); - read = msg[i].flags & I2C_M_RD; - -+ if (3 + msg[i].len > sizeof(obuf)) { -+ err("i2c wr len=%d too high", msg[i].len); -+ break; -+ } -+ if (write_read) { -+ if (3 + msg[i+1].len > sizeof(ibuf)) { -+ err("i2c rd len=%d too high", msg[i+1].len); -+ break; -+ } -+ } else if (read) { -+ if (3 + msg[i].len > sizeof(ibuf)) { -+ err("i2c rd len=%d too high", msg[i].len); -+ break; -+ } -+ } -+ - obuf[0] = (msg[i].addr << 1) | (write_read | read); - if (read) - obuf[1] = 0; -diff --git a/drivers/media/usb/gspca/konica.c b/drivers/media/usb/gspca/konica.c -index 0712b1bc90b4..0f6d57fbf91b 100644 ---- a/drivers/media/usb/gspca/konica.c -+++ b/drivers/media/usb/gspca/konica.c -@@ -188,6 +188,9 @@ static int sd_start(struct gspca_dev *gspca_dev) - return -EIO; - } - -+ if (alt->desc.bNumEndpoints < 2) -+ return -ENODEV; -+ - packet_size = le16_to_cpu(alt->endpoint[0].desc.wMaxPacketSize); - - n = gspca_dev->cam.cam_mode[gspca_dev->curr_mode].priv; -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index d1dc1a198e3e..91d709efef7a 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1523,7 +1523,14 @@ static int usbvision_probe(struct usb_interface *intf, - } - - for (i = 0; i < usbvision->num_alt; i++) { -- u16 tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc. -+ u16 tmp; -+ -+ if (uif->altsetting[i].desc.bNumEndpoints < 2) { -+ ret = -ENODEV; -+ goto err_pkt; -+ } -+ -+ tmp = le16_to_cpu(uif->altsetting[i].endpoint[1].desc. - wMaxPacketSize); - usbvision->alt_max_pkt_size[i] = - (tmp & 0x07ff) * (((tmp & 0x1800) >> 11) + 1); -diff --git a/drivers/media/usb/zr364xx/zr364xx.c b/drivers/media/usb/zr364xx/zr364xx.c -index 7433ba5c4bad..fd6a3b36208e 100644 ---- a/drivers/media/usb/zr364xx/zr364xx.c -+++ b/drivers/media/usb/zr364xx/zr364xx.c -@@ -604,6 +604,14 @@ static int zr364xx_read_video_callback(struct zr364xx_camera *cam, - ptr = pdest = frm->lpvbits; - - if (frm->ulState == ZR364XX_READ_IDLE) { -+ if (purb->actual_length < 128) { -+ /* header incomplete */ -+ dev_info(&cam->udev->dev, -+ "%s: buffer (%d bytes) too small to hold jpeg header. Discarding.\n", -+ __func__, purb->actual_length); -+ return -EINVAL; -+ } -+ - frm->ulState = ZR364XX_READ_FRAME; - frm->cur_size = 0; - -diff --git a/drivers/net/irda/irda-usb.c b/drivers/net/irda/irda-usb.c -index 25f21968fa5c..de2ea9f2f966 100644 ---- a/drivers/net/irda/irda-usb.c -+++ b/drivers/net/irda/irda-usb.c -@@ -1077,7 +1077,7 @@ static int stir421x_patch_device(struct irda_usb_cb *self) - * are "42101001.sb" or "42101002.sb" - */ - sprintf(stir421x_fw_name, "4210%4X.sb", -- self->usbdev->descriptor.bcdDevice); -+ le16_to_cpu(self->usbdev->descriptor.bcdDevice)); - ret = request_firmware(&fw, stir421x_fw_name, &self->usbdev->dev); - if (ret < 0) - return ret; -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 09052f9e324f..c6f5d9a6bec6 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -754,6 +754,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x413c, 0x81b1, 8)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card */ - {QMI_FIXED_INTF(0x03f0, 0x4e1d, 8)}, /* HP lt4111 LTE/EV-DO/HSPA+ Gobi 4G Module */ - {QMI_FIXED_INTF(0x22de, 0x9061, 3)}, /* WeTelecom WPD-600N */ -+ {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */ - - /* 4. Gobi 1000 devices */ - {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ -diff --git a/drivers/net/wireless/ath/ath9k/hif_usb.c b/drivers/net/wireless/ath/ath9k/hif_usb.c -index 165dd202c365..c92564b3ec85 100644 ---- a/drivers/net/wireless/ath/ath9k/hif_usb.c -+++ b/drivers/net/wireless/ath/ath9k/hif_usb.c -@@ -37,6 +37,7 @@ static struct usb_device_id ath9k_hif_usb_ids[] = { - { USB_DEVICE(0x0cf3, 0xb002) }, /* Ubiquiti WifiStation */ - { USB_DEVICE(0x057c, 0x8403) }, /* AVM FRITZ!WLAN 11N v2 USB */ - { USB_DEVICE(0x0471, 0x209e) }, /* Philips (or NXP) PTA01 */ -+ { USB_DEVICE(0x1eda, 0x2315) }, /* AirTies */ - - { USB_DEVICE(0x0cf3, 0x7015), - .driver_info = AR9287_USB }, /* Atheros */ -@@ -1216,6 +1217,9 @@ static int send_eject_command(struct usb_interface *interface) - u8 bulk_out_ep; - int r; - -+ if (iface_desc->desc.bNumEndpoints < 2) -+ return -ENODEV; -+ - /* Find bulk out endpoint */ - for (r = 1; r >= 0; r--) { - endpoint = &iface_desc->endpoint[r].desc; -diff --git a/drivers/net/wireless/mwifiex/pcie.c b/drivers/net/wireless/mwifiex/pcie.c -index 21192b6f9c64..268e50ba88a5 100644 ---- a/drivers/net/wireless/mwifiex/pcie.c -+++ b/drivers/net/wireless/mwifiex/pcie.c -@@ -947,6 +947,7 @@ static int mwifiex_pcie_delete_cmdrsp_buf(struct mwifiex_adapter *adapter) - if (card && card->cmd_buf) { - mwifiex_unmap_pci_memory(adapter, card->cmd_buf, - PCI_DMA_TODEVICE); -+ dev_kfree_skb_any(card->cmd_buf); - } - return 0; - } -@@ -1513,6 +1514,11 @@ mwifiex_pcie_send_cmd(struct mwifiex_adapter *adapter, struct sk_buff *skb) - return -1; - - card->cmd_buf = skb; -+ /* -+ * Need to keep a reference, since core driver might free up this -+ * buffer before we've unmapped it. -+ */ -+ skb_get(skb); - - /* To send a command, the driver will: - 1. Write the 64bit physical address of the data buffer to -@@ -1610,6 +1616,7 @@ static int mwifiex_pcie_process_cmd_complete(struct mwifiex_adapter *adapter) - if (card->cmd_buf) { - mwifiex_unmap_pci_memory(adapter, card->cmd_buf, - PCI_DMA_TODEVICE); -+ dev_kfree_skb_any(card->cmd_buf); - card->cmd_buf = NULL; - } - -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -index 9b4d8a637915..4b354918e183 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/phy.c -@@ -359,6 +359,107 @@ bool rtl8821ae_phy_rf_config(struct ieee80211_hw *hw) - return rtl8821ae_phy_rf6052_config(hw); - } - -+static void _rtl8812ae_phy_set_rfe_reg_24g(struct ieee80211_hw *hw) -+{ -+ struct rtl_priv *rtlpriv = rtl_priv(hw); -+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); -+ u8 tmp; -+ -+ switch (rtlhal->rfe_type) { -+ case 3: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x54337770); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x54337770); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, 0x900, 0x00000303, 0x1); -+ break; -+ case 4: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77777777); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x001); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x001); -+ break; -+ case 5: -+ rtl_write_byte(rtlpriv, RA_RFE_PINMUX + 2, 0x77); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777); -+ tmp = rtl_read_byte(rtlpriv, RA_RFE_INV + 3); -+ rtl_write_byte(rtlpriv, RA_RFE_INV + 3, tmp & ~0x1); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000); -+ break; -+ case 1: -+ if (rtlpriv->btcoexist.bt_coexistence) { -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, 0xffffff, 0x777777); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, -+ 0x77777777); -+ rtl_set_bbreg(hw, RA_RFE_INV, 0x33f00000, 0x000); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000); -+ break; -+ } -+ case 0: -+ case 2: -+ default: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77777777); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77777777); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x000); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000); -+ break; -+ } -+} -+ -+static void _rtl8812ae_phy_set_rfe_reg_5g(struct ieee80211_hw *hw) -+{ -+ struct rtl_priv *rtlpriv = rtl_priv(hw); -+ struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); -+ u8 tmp; -+ -+ switch (rtlhal->rfe_type) { -+ case 0: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77337717); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337717); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010); -+ break; -+ case 1: -+ if (rtlpriv->btcoexist.bt_coexistence) { -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, 0xffffff, 0x337717); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, -+ 0x77337717); -+ rtl_set_bbreg(hw, RA_RFE_INV, 0x33f00000, 0x000); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000); -+ } else { -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, -+ 0x77337717); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, -+ 0x77337717); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x000); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x000); -+ } -+ break; -+ case 3: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x54337717); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x54337717); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, 0x900, 0x00000303, 0x1); -+ break; -+ case 5: -+ rtl_write_byte(rtlpriv, RA_RFE_PINMUX + 2, 0x33); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337777); -+ tmp = rtl_read_byte(rtlpriv, RA_RFE_INV + 3); -+ rtl_write_byte(rtlpriv, RA_RFE_INV + 3, tmp | 0x1); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010); -+ break; -+ case 2: -+ case 4: -+ default: -+ rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, 0x77337777); -+ rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, 0x77337777); -+ rtl_set_bbreg(hw, RA_RFE_INV, BMASKRFEINV, 0x010); -+ rtl_set_bbreg(hw, RB_RFE_INV, BMASKRFEINV, 0x010); -+ break; -+ } -+} -+ - u32 phy_get_tx_swing_8812A(struct ieee80211_hw *hw, u8 band, - u8 rf_path) - { -@@ -553,14 +654,9 @@ void rtl8821ae_phy_switch_wirelessband(struct ieee80211_hw *hw, u8 band) - /* 0x82C[1:0] = 2b'00 */ - rtl_set_bbreg(hw, 0x82c, 0x3, 0); - } -- if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) { -- rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, -- 0x77777777); -- rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, -- 0x77777777); -- rtl_set_bbreg(hw, RA_RFE_INV, 0x3ff00000, 0x000); -- rtl_set_bbreg(hw, RB_RFE_INV, 0x3ff00000, 0x000); -- } -+ -+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) -+ _rtl8812ae_phy_set_rfe_reg_24g(hw); - - rtl_set_bbreg(hw, RTXPATH, 0xf0, 0x1); - rtl_set_bbreg(hw, RCCK_RX, 0x0f000000, 0x1); -@@ -615,14 +711,8 @@ void rtl8821ae_phy_switch_wirelessband(struct ieee80211_hw *hw, u8 band) - /* 0x82C[1:0] = 2'b00 */ - rtl_set_bbreg(hw, 0x82c, 0x3, 1); - -- if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) { -- rtl_set_bbreg(hw, RA_RFE_PINMUX, BMASKDWORD, -- 0x77337777); -- rtl_set_bbreg(hw, RB_RFE_PINMUX, BMASKDWORD, -- 0x77337777); -- rtl_set_bbreg(hw, RA_RFE_INV, 0x3ff00000, 0x010); -- rtl_set_bbreg(hw, RB_RFE_INV, 0x3ff00000, 0x010); -- } -+ if (rtlhal->hw_type == HARDWARE_TYPE_RTL8812AE) -+ _rtl8812ae_phy_set_rfe_reg_5g(hw); - - rtl_set_bbreg(hw, RTXPATH, 0xf0, 0); - rtl_set_bbreg(hw, RCCK_RX, 0x0f000000, 0xf); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h -index 1d6110f9c1fb..ed69dbe178ff 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/reg.h -@@ -2424,6 +2424,7 @@ - #define BMASKH4BITS 0xf0000000 - #define BMASKOFDM_D 0xffc00000 - #define BMASKCCK 0x3f3f3f3f -+#define BMASKRFEINV 0x3ff00000 - - #define BRFREGOFFSETMASK 0xfffff - -diff --git a/drivers/of/address.c b/drivers/of/address.c -index 9582c5703b3c..4fe5fe21cd49 100644 ---- a/drivers/of/address.c -+++ b/drivers/of/address.c -@@ -260,7 +260,7 @@ struct of_pci_range *of_pci_range_parser_one(struct of_pci_range_parser *parser, - if (!parser->range || parser->range + parser->np > parser->end) - return NULL; - -- range->pci_space = parser->range[0]; -+ range->pci_space = be32_to_cpup(parser->range); - range->flags = of_bus_pci_get_flags(parser->range); - range->pci_addr = of_read_number(parser->range + 1, ns); - range->cpu_addr = of_translate_address(parser->node, -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index d7508704c992..f8b2b5987ea9 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -973,15 +973,19 @@ void pci_remove_legacy_files(struct pci_bus *b) - int pci_mmap_fits(struct pci_dev *pdev, int resno, struct vm_area_struct *vma, - enum pci_mmap_api mmap_api) - { -- unsigned long nr, start, size, pci_start; -+ unsigned long nr, start, size; -+ resource_size_t pci_start = 0, pci_end; - - if (pci_resource_len(pdev, resno) == 0) - return 0; - nr = vma_pages(vma); - start = vma->vm_pgoff; - size = ((pci_resource_len(pdev, resno) - 1) >> PAGE_SHIFT) + 1; -- pci_start = (mmap_api == PCI_MMAP_PROCFS) ? -- pci_resource_start(pdev, resno) >> PAGE_SHIFT : 0; -+ if (mmap_api == PCI_MMAP_PROCFS) { -+ pci_resource_to_user(pdev, resno, &pdev->resource[resno], -+ &pci_start, &pci_end); -+ pci_start >>= PAGE_SHIFT; -+ } - if (start >= pci_start && start < pci_start + size && - start + nr <= pci_start + size) - return 1; -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 0e53488f8ec1..1a14ca8965e6 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -1732,8 +1732,8 @@ static void pci_pme_list_scan(struct work_struct *work) - } - } - if (!list_empty(&pci_pme_list)) -- schedule_delayed_work(&pci_pme_work, -- msecs_to_jiffies(PME_TIMEOUT)); -+ queue_delayed_work(system_freezable_wq, &pci_pme_work, -+ msecs_to_jiffies(PME_TIMEOUT)); - mutex_unlock(&pci_pme_list_mutex); - } - -@@ -1798,8 +1798,9 @@ void pci_pme_active(struct pci_dev *dev, bool enable) - mutex_lock(&pci_pme_list_mutex); - list_add(&pme_dev->list, &pci_pme_list); - if (list_is_singular(&pci_pme_list)) -- schedule_delayed_work(&pci_pme_work, -- msecs_to_jiffies(PME_TIMEOUT)); -+ queue_delayed_work(system_freezable_wq, -+ &pci_pme_work, -+ msecs_to_jiffies(PME_TIMEOUT)); - mutex_unlock(&pci_pme_list_mutex); - } else { - mutex_lock(&pci_pme_list_mutex); -diff --git a/drivers/regulator/tps65023-regulator.c b/drivers/regulator/tps65023-regulator.c -index d2c3d7cc35f5..5ca6d2130593 100644 ---- a/drivers/regulator/tps65023-regulator.c -+++ b/drivers/regulator/tps65023-regulator.c -@@ -311,8 +311,7 @@ static int tps_65023_probe(struct i2c_client *client, - - /* Enable setting output voltage by I2C */ - regmap_update_bits(tps->regmap, TPS65023_REG_CON_CTRL2, -- TPS65023_REG_CTRL2_CORE_ADJ, -- TPS65023_REG_CTRL2_CORE_ADJ); -+ TPS65023_REG_CTRL2_CORE_ADJ, 0); - - return 0; - } -diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -index e9c4f973bba9..79bf13f5c0d1 100644 ---- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -@@ -97,8 +97,9 @@ void rtl92e_set_reg(struct net_device *dev, u8 variable, u8 *val) - - switch (variable) { - case HW_VAR_BSSID: -- rtl92e_writel(dev, BSSIDR, ((u32 *)(val))[0]); -- rtl92e_writew(dev, BSSIDR+2, ((u16 *)(val+2))[0]); -+ /* BSSIDR 2 byte alignment */ -+ rtl92e_writew(dev, BSSIDR, *(u16 *)val); -+ rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(val + 2)); - break; - - case HW_VAR_MEDIA_STATUS: -@@ -626,7 +627,7 @@ void rtl92e_get_eeprom_size(struct net_device *dev) - struct r8192_priv *priv = rtllib_priv(dev); - - RT_TRACE(COMP_INIT, "===========>%s()\n", __func__); -- curCR = rtl92e_readl(dev, EPROM_CMD); -+ curCR = rtl92e_readw(dev, EPROM_CMD); - RT_TRACE(COMP_INIT, "read from Reg Cmd9346CR(%x):%x\n", EPROM_CMD, - curCR); - priv->epromtype = (curCR & EPROM_CMD_9356SEL) ? EEPROM_93C56 : -@@ -963,8 +964,8 @@ static void _rtl92e_net_update(struct net_device *dev) - rtl92e_config_rate(dev, &rate_config); - priv->dot11CurrentPreambleMode = PREAMBLE_AUTO; - priv->basic_rate = rate_config &= 0x15f; -- rtl92e_writel(dev, BSSIDR, ((u32 *)net->bssid)[0]); -- rtl92e_writew(dev, BSSIDR+4, ((u16 *)net->bssid)[2]); -+ rtl92e_writew(dev, BSSIDR, *(u16 *)net->bssid); -+ rtl92e_writel(dev, BSSIDR + 2, *(u32 *)(net->bssid + 2)); - - if (priv->rtllib->iw_mode == IW_MODE_ADHOC) { - rtl92e_writew(dev, ATIMWND, 2); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 96849e2e7435..0b7194086c5a 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -311,6 +311,12 @@ static void acm_ctrl_irq(struct urb *urb) - break; - - case USB_CDC_NOTIFY_SERIAL_STATE: -+ if (le16_to_cpu(dr->wLength) != 2) { -+ dev_dbg(&acm->control->dev, -+ "%s - malformed serial state\n", __func__); -+ break; -+ } -+ - newctrl = get_unaligned_le16(data); - - if (!acm->clocal && (acm->ctrlin & ~newctrl & ACM_CTRL_DCD)) { -@@ -347,11 +353,10 @@ static void acm_ctrl_irq(struct urb *urb) - - default: - dev_dbg(&acm->control->dev, -- "%s - unknown notification %d received: index %d " -- "len %d data0 %d data1 %d\n", -+ "%s - unknown notification %d received: index %d len %d\n", - __func__, -- dr->bNotificationType, dr->wIndex, -- dr->wLength, data[0], data[1]); -+ dr->bNotificationType, dr->wIndex, dr->wLength); -+ - break; - } - exit: -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index f5c92d904ded..54d2d6b604c0 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -373,11 +373,11 @@ static void snoop_urb(struct usb_device *udev, - - if (userurb) { /* Async */ - if (when == SUBMIT) -- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " -+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " - "length %u\n", - userurb, ep, t, d, length); - else -- dev_info(&udev->dev, "userurb %p, ep%d %s-%s, " -+ dev_info(&udev->dev, "userurb %pK, ep%d %s-%s, " - "actual_length %u status %d\n", - userurb, ep, t, d, length, - timeout_or_status); -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index ca2cbdb3aa67..c3f4f2ab7b33 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -1696,7 +1696,7 @@ int usb_hcd_unlink_urb (struct urb *urb, int status) - if (retval == 0) - retval = -EINPROGRESS; - else if (retval != -EIDRM && retval != -EBUSY) -- dev_dbg(&udev->dev, "hcd_unlink_urb %p fail %d\n", -+ dev_dbg(&udev->dev, "hcd_unlink_urb %pK fail %d\n", - urb, retval); - usb_put_dev(udev); - } -@@ -1863,7 +1863,7 @@ rescan: - /* kick hcd */ - unlink1(hcd, urb, -ESHUTDOWN); - dev_dbg (hcd->self.controller, -- "shutdown urb %p ep%d%s%s\n", -+ "shutdown urb %pK ep%d%s%s\n", - urb, usb_endpoint_num(&ep->desc), - is_in ? "in" : "out", - ({ char *s; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 67961231cbbd..b627392ad52a 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -358,7 +358,8 @@ static void usb_set_lpm_parameters(struct usb_device *udev) - } - - /* USB 2.0 spec Section 11.24.4.5 */ --static int get_hub_descriptor(struct usb_device *hdev, void *data) -+static int get_hub_descriptor(struct usb_device *hdev, -+ struct usb_hub_descriptor *desc) - { - int i, ret, size; - unsigned dtype; -@@ -374,10 +375,18 @@ static int get_hub_descriptor(struct usb_device *hdev, void *data) - for (i = 0; i < 3; i++) { - ret = usb_control_msg(hdev, usb_rcvctrlpipe(hdev, 0), - USB_REQ_GET_DESCRIPTOR, USB_DIR_IN | USB_RT_HUB, -- dtype << 8, 0, data, size, -+ dtype << 8, 0, desc, size, - USB_CTRL_GET_TIMEOUT); -- if (ret >= (USB_DT_HUB_NONVAR_SIZE + 2)) -+ if (hub_is_superspeed(hdev)) { -+ if (ret == size) -+ return ret; -+ } else if (ret >= USB_DT_HUB_NONVAR_SIZE + 2) { -+ /* Make sure we have the DeviceRemovable field. */ -+ size = USB_DT_HUB_NONVAR_SIZE + desc->bNbrPorts / 8 + 1; -+ if (ret < size) -+ return -EMSGSIZE; - return ret; -+ } - } - return -EINVAL; - } -@@ -1295,7 +1304,7 @@ static int hub_configure(struct usb_hub *hub, - } - mutex_init(&hub->status_mutex); - -- hub->descriptor = kmalloc(sizeof(*hub->descriptor), GFP_KERNEL); -+ hub->descriptor = kzalloc(sizeof(*hub->descriptor), GFP_KERNEL); - if (!hub->descriptor) { - ret = -ENOMEM; - goto fail; -@@ -1303,7 +1312,7 @@ static int hub_configure(struct usb_hub *hub, - - /* Request the entire hub descriptor. - * hub->descriptor can handle USB_MAXCHILDREN ports, -- * but the hub can/will return fewer bytes here. -+ * but a (non-SS) hub can/will return fewer bytes here. - */ - ret = get_hub_descriptor(hdev, hub->descriptor); - if (ret < 0) { -diff --git a/drivers/usb/core/urb.c b/drivers/usb/core/urb.c -index c601e25b609f..e43ef7d2d00e 100644 ---- a/drivers/usb/core/urb.c -+++ b/drivers/usb/core/urb.c -@@ -335,7 +335,7 @@ int usb_submit_urb(struct urb *urb, gfp_t mem_flags) - if (!urb || !urb->complete) - return -EINVAL; - if (urb->hcpriv) { -- WARN_ONCE(1, "URB %p submitted while active\n", urb); -+ WARN_ONCE(1, "URB %pK submitted while active\n", urb); - return -EBUSY; - } - -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 5d70d46239bb..cf6bbaff42d0 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1709,7 +1709,7 @@ static int scratchpad_alloc(struct xhci_hcd *xhci, gfp_t flags) - xhci->dcbaa->dev_context_ptrs[0] = cpu_to_le64(xhci->scratchpad->sp_dma); - for (i = 0; i < num_sp; i++) { - dma_addr_t dma; -- void *buf = dma_alloc_coherent(dev, xhci->page_size, &dma, -+ void *buf = dma_zalloc_coherent(dev, xhci->page_size, &dma, - flags); - if (!buf) - goto fail_sp5; -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index dd262f418140..30c4ae80c8f9 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -52,6 +52,7 @@ - #define PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI 0x0aa8 - #define PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI 0x1aa8 - #define PCI_DEVICE_ID_INTEL_APL_XHCI 0x5aa8 -+#define PCI_DEVICE_ID_INTEL_DNV_XHCI 0x19d0 - - static const char hcd_name[] = "xhci_hcd"; - -@@ -167,12 +168,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_M_XHCI || - pdev->device == PCI_DEVICE_ID_INTEL_BROXTON_B_XHCI || -- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) { -+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) { - xhci->quirks |= XHCI_PME_STUCK_QUIRK; - } - if (pdev->vendor == PCI_VENDOR_ID_INTEL && - (pdev->device == PCI_DEVICE_ID_INTEL_CHERRYVIEW_XHCI || -- pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI)) -+ pdev->device == PCI_DEVICE_ID_INTEL_APL_XHCI || -+ pdev->device == PCI_DEVICE_ID_INTEL_DNV_XHCI)) - xhci->quirks |= XHCI_MISSING_CAS; - - if (pdev->vendor == PCI_VENDOR_ID_ETRON && -diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c -index 268829db9e88..062cf8a84a59 100644 ---- a/drivers/usb/host/xhci-plat.c -+++ b/drivers/usb/host/xhci-plat.c -@@ -92,7 +92,7 @@ static int xhci_plat_probe(struct platform_device *pdev) - - irq = platform_get_irq(pdev, 0); - if (irq < 0) -- return -ENODEV; -+ return irq; - - /* Try to set 64-bit DMA first */ - if (WARN_ON(!pdev->dev.dma_mask)) -diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c -index 775690bed4c0..5e43fd881a9c 100644 ---- a/drivers/usb/misc/iowarrior.c -+++ b/drivers/usb/misc/iowarrior.c -@@ -557,7 +557,7 @@ static long iowarrior_ioctl(struct file *file, unsigned int cmd, - info.revision = le16_to_cpu(dev->udev->descriptor.bcdDevice); - - /* 0==UNKNOWN, 1==LOW(usb1.1) ,2=FULL(usb1.1), 3=HIGH(usb2.0) */ -- info.speed = le16_to_cpu(dev->udev->speed); -+ info.speed = dev->udev->speed; - info.if_num = dev->interface->cur_altsetting->desc.bInterfaceNumber; - info.report_size = dev->report_size; - -diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c -index 4dd531ac5a7f..0ec9ee573ffa 100644 ---- a/drivers/usb/misc/legousbtower.c -+++ b/drivers/usb/misc/legousbtower.c -@@ -317,9 +317,16 @@ static int tower_open (struct inode *inode, struct file *file) - int subminor; - int retval = 0; - struct usb_interface *interface; -- struct tower_reset_reply reset_reply; -+ struct tower_reset_reply *reset_reply; - int result; - -+ reset_reply = kmalloc(sizeof(*reset_reply), GFP_KERNEL); -+ -+ if (!reset_reply) { -+ retval = -ENOMEM; -+ goto exit; -+ } -+ - nonseekable_open(inode, file); - subminor = iminor(inode); - -@@ -364,8 +371,8 @@ static int tower_open (struct inode *inode, struct file *file) - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &reset_reply, -- sizeof(reset_reply), -+ reset_reply, -+ sizeof(*reset_reply), - 1000); - if (result < 0) { - dev_err(&dev->udev->dev, -@@ -406,6 +413,7 @@ unlock_exit: - mutex_unlock(&dev->lock); - - exit: -+ kfree(reset_reply); - return retval; - } - -@@ -808,7 +816,7 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - struct lego_usb_tower *dev = NULL; - struct usb_host_interface *iface_desc; - struct usb_endpoint_descriptor* endpoint; -- struct tower_get_version_reply get_version_reply; -+ struct tower_get_version_reply *get_version_reply = NULL; - int i; - int retval = -ENOMEM; - int result; -@@ -898,6 +906,13 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - dev->interrupt_in_interval = interrupt_in_interval ? interrupt_in_interval : dev->interrupt_in_endpoint->bInterval; - dev->interrupt_out_interval = interrupt_out_interval ? interrupt_out_interval : dev->interrupt_out_endpoint->bInterval; - -+ get_version_reply = kmalloc(sizeof(*get_version_reply), GFP_KERNEL); -+ -+ if (!get_version_reply) { -+ retval = -ENOMEM; -+ goto error; -+ } -+ - /* get the firmware version and log it */ - result = usb_control_msg (udev, - usb_rcvctrlpipe(udev, 0), -@@ -905,18 +920,19 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - USB_TYPE_VENDOR | USB_DIR_IN | USB_RECIP_DEVICE, - 0, - 0, -- &get_version_reply, -- sizeof(get_version_reply), -+ get_version_reply, -+ sizeof(*get_version_reply), - 1000); - if (result < 0) { - dev_err(idev, "LEGO USB Tower get version control request failed\n"); - retval = result; - goto error; - } -- dev_info(&interface->dev, "LEGO USB Tower firmware version is %d.%d " -- "build %d\n", get_version_reply.major, -- get_version_reply.minor, -- le16_to_cpu(get_version_reply.build_no)); -+ dev_info(&interface->dev, -+ "LEGO USB Tower firmware version is %d.%d build %d\n", -+ get_version_reply->major, -+ get_version_reply->minor, -+ le16_to_cpu(get_version_reply->build_no)); - - /* we can register the device now, as it is ready */ - usb_set_intfdata (interface, dev); -@@ -937,9 +953,11 @@ static int tower_probe (struct usb_interface *interface, const struct usb_device - USB_MAJOR, dev->minor); - - exit: -+ kfree(get_version_reply); - return retval; - - error: -+ kfree(get_version_reply); - tower_delete(dev); - return retval; - } -diff --git a/drivers/usb/musb/tusb6010_omap.c b/drivers/usb/musb/tusb6010_omap.c -index 4c82077da475..6020024cb87c 100644 ---- a/drivers/usb/musb/tusb6010_omap.c -+++ b/drivers/usb/musb/tusb6010_omap.c -@@ -220,6 +220,7 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz, - u32 dma_remaining; - int src_burst, dst_burst; - u16 csr; -+ u32 psize; - int ch; - s8 dmareq; - s8 sync_dev; -@@ -391,15 +392,19 @@ static int tusb_omap_dma_program(struct dma_channel *channel, u16 packet_sz, - - if (chdat->tx) { - /* Send transfer_packet_sz packets at a time */ -- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, -- chdat->transfer_packet_sz); -+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET); -+ psize &= ~0x7ff; -+ psize |= chdat->transfer_packet_sz; -+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize); - - musb_writel(ep_conf, TUSB_EP_TX_OFFSET, - TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len)); - } else { - /* Receive transfer_packet_sz packets at a time */ -- musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, -- chdat->transfer_packet_sz << 16); -+ psize = musb_readl(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET); -+ psize &= ~(0x7ff << 16); -+ psize |= (chdat->transfer_packet_sz << 16); -+ musb_writel(ep_conf, TUSB_EP_MAX_PACKET_SIZE_OFFSET, psize); - - musb_writel(ep_conf, TUSB_EP_RX_OFFSET, - TUSB_EP_CONFIG_XFR_SIZE(chdat->transfer_len)); -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index dbd441c1c2ad..e0385d6c0abb 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -809,10 +809,10 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(FTDI_VID, FTDI_PROPOX_ISPCABLEIII_PID) }, - { USB_DEVICE(FTDI_VID, CYBER_CORTEX_AV_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -- { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID), -- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -- { USB_DEVICE(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID), -- .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_OCD_H_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_PID, 1) }, -+ { USB_DEVICE_INTERFACE_NUMBER(OLIMEX_VID, OLIMEX_ARM_USB_TINY_H_PID, 1) }, - { USB_DEVICE(FIC_VID, FIC_NEO1973_DEBUG_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(FTDI_VID, FTDI_OOCDLINK_PID), -@@ -1508,9 +1508,9 @@ static int set_serial_info(struct tty_struct *tty, - (new_serial.flags & ASYNC_FLAGS)); - priv->custom_divisor = new_serial.custom_divisor; - -+check_and_exit: - write_latency_timer(port); - --check_and_exit: - if ((old_priv.flags & ASYNC_SPD_MASK) != - (priv->flags & ASYNC_SPD_MASK)) { - if ((priv->flags & ASYNC_SPD_MASK) == ASYNC_SPD_HI) -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 71fb9e59db71..4fcf1cecb6d7 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -882,6 +882,8 @@ - /* Olimex */ - #define OLIMEX_VID 0x15BA - #define OLIMEX_ARM_USB_OCD_PID 0x0003 -+#define OLIMEX_ARM_USB_TINY_PID 0x0004 -+#define OLIMEX_ARM_USB_TINY_H_PID 0x002a - #define OLIMEX_ARM_USB_OCD_H_PID 0x002b - - /* -diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c -index f1a8fdcd8674..e98532feb0cc 100644 ---- a/drivers/usb/serial/io_ti.c -+++ b/drivers/usb/serial/io_ti.c -@@ -2349,8 +2349,11 @@ static void change_port_settings(struct tty_struct *tty, - if (!baud) { - /* pick a default, any default... */ - baud = 9600; -- } else -+ } else { -+ /* Avoid a zero divisor. */ -+ baud = min(baud, 461550); - tty_encode_baud_rate(tty, baud, baud); -+ } - - edge_port->baud_rate = baud; - config->wBaudRate = (__u16)((461550L + baud/2) / baud); -diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c -index 9bf82c262c5b..a6c07c6be25f 100644 ---- a/drivers/usb/serial/mct_u232.c -+++ b/drivers/usb/serial/mct_u232.c -@@ -189,7 +189,7 @@ static int mct_u232_set_baud_rate(struct tty_struct *tty, - return -ENOMEM; - - divisor = mct_u232_calculate_baud_rate(serial, value, &speed); -- put_unaligned_le32(cpu_to_le32(divisor), buf); -+ put_unaligned_le32(divisor, buf); - rc = usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), - MCT_U232_SET_BAUD_RATE_REQUEST, - MCT_U232_SET_REQUEST_TYPE, -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index af67a0de6b5d..3bf61acfc26b 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -281,6 +281,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_LE922_USBCFG0 0x1042 - #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 - #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 -+#define TELIT_PRODUCT_ME910 0x1100 - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 - #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 -@@ -640,6 +641,11 @@ static const struct option_blacklist_info simcom_sim7100e_blacklist = { - .reserved = BIT(5) | BIT(6), - }; - -+static const struct option_blacklist_info telit_me910_blacklist = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(1) | BIT(3), -+}; -+ - static const struct option_blacklist_info telit_le910_blacklist = { - .sendsetup = BIT(0), - .reserved = BIT(1) | BIT(2), -@@ -1235,6 +1241,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg3 }, - { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, TELIT_PRODUCT_LE922_USBCFG5, 0xff), - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), -+ .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 38b3f0d8cd58..fd509ed6cf70 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -162,6 +162,8 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ - {DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */ - {DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */ -+ {DEVICE_SWI(0x1199, 0x907a)}, /* Sierra Wireless EM74xx QDL */ -+ {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */ - {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ -diff --git a/drivers/usb/storage/ene_ub6250.c b/drivers/usb/storage/ene_ub6250.c -index f3cf4cecd2b7..091e8ec7a6c0 100644 ---- a/drivers/usb/storage/ene_ub6250.c -+++ b/drivers/usb/storage/ene_ub6250.c -@@ -446,6 +446,10 @@ struct ms_lib_ctrl { - #define SD_BLOCK_LEN 9 - - struct ene_ub6250_info { -+ -+ /* I/O bounce buffer */ -+ u8 *bbuf; -+ - /* for 6250 code */ - struct SD_STATUS SD_Status; - struct MS_STATUS MS_Status; -@@ -493,8 +497,11 @@ static int ene_load_bincode(struct us_data *us, unsigned char flag); - - static void ene_ub6250_info_destructor(void *extra) - { -+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) extra; -+ - if (!extra) - return; -+ kfree(info->bbuf); - } - - static int ene_send_scsi_cmd(struct us_data *us, u8 fDir, void *buf, int use_sg) -@@ -858,8 +865,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr, - u8 PageNum, u32 *PageBuf, struct ms_lib_type_extdat *ExtraDat) - { - struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; -+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; -+ u8 *bbuf = info->bbuf; - int result; -- u8 ExtBuf[4]; - u32 bn = PhyBlockAddr * 0x20 + PageNum; - - /* printk(KERN_INFO "MS --- MS_ReaderReadPage, -@@ -902,7 +910,7 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr, - bcb->CDB[2] = (unsigned char)(PhyBlockAddr>>16); - bcb->CDB[6] = 0x01; - -- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0); -+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0); - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - -@@ -911,9 +919,9 @@ static int ms_read_readpage(struct us_data *us, u32 PhyBlockAddr, - ExtraDat->status0 = 0x10; /* Not yet,fireware support */ - - ExtraDat->status1 = 0x00; /* Not yet,fireware support */ -- ExtraDat->ovrflg = ExtBuf[0]; -- ExtraDat->mngflg = ExtBuf[1]; -- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]); -+ ExtraDat->ovrflg = bbuf[0]; -+ ExtraDat->mngflg = bbuf[1]; -+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]); - - return USB_STOR_TRANSPORT_GOOD; - } -@@ -1339,8 +1347,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock, - u8 PageNum, struct ms_lib_type_extdat *ExtraDat) - { - struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; -+ struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; -+ u8 *bbuf = info->bbuf; - int result; -- u8 ExtBuf[4]; - - /* printk("MS_LibReadExtra --- PhyBlock = %x, PageNum = %x\n", PhyBlock, PageNum); */ - memset(bcb, 0, sizeof(struct bulk_cb_wrap)); -@@ -1355,7 +1364,7 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock, - bcb->CDB[2] = (unsigned char)(PhyBlock>>16); - bcb->CDB[6] = 0x01; - -- result = ene_send_scsi_cmd(us, FDIR_READ, &ExtBuf, 0); -+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0); - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - -@@ -1363,9 +1372,9 @@ static int ms_lib_read_extra(struct us_data *us, u32 PhyBlock, - ExtraDat->intr = 0x80; /* Not yet, waiting for fireware support */ - ExtraDat->status0 = 0x10; /* Not yet, waiting for fireware support */ - ExtraDat->status1 = 0x00; /* Not yet, waiting for fireware support */ -- ExtraDat->ovrflg = ExtBuf[0]; -- ExtraDat->mngflg = ExtBuf[1]; -- ExtraDat->logadr = memstick_logaddr(ExtBuf[2], ExtBuf[3]); -+ ExtraDat->ovrflg = bbuf[0]; -+ ExtraDat->mngflg = bbuf[1]; -+ ExtraDat->logadr = memstick_logaddr(bbuf[2], bbuf[3]); - - return USB_STOR_TRANSPORT_GOOD; - } -@@ -1569,9 +1578,9 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st) - u16 PhyBlock, newblk, i; - u16 LogStart, LogEnde; - struct ms_lib_type_extdat extdat; -- u8 buf[0x200]; - u32 count = 0, index = 0; - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; -+ u8 *bbuf = info->bbuf; - - for (PhyBlock = 0; PhyBlock < info->MS_Lib.NumberOfPhyBlock;) { - ms_lib_phy_to_log_range(PhyBlock, &LogStart, &LogEnde); -@@ -1585,14 +1594,16 @@ static int ms_lib_scan_logicalblocknumber(struct us_data *us, u16 btBlk1st) - } - - if (count == PhyBlock) { -- ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, &buf); -+ ms_lib_read_extrablock(us, PhyBlock, 0, 0x80, -+ bbuf); - count += 0x80; - } - index = (PhyBlock % 0x80) * 4; - -- extdat.ovrflg = buf[index]; -- extdat.mngflg = buf[index+1]; -- extdat.logadr = memstick_logaddr(buf[index+2], buf[index+3]); -+ extdat.ovrflg = bbuf[index]; -+ extdat.mngflg = bbuf[index+1]; -+ extdat.logadr = memstick_logaddr(bbuf[index+2], -+ bbuf[index+3]); - - if ((extdat.ovrflg & MS_REG_OVR_BKST) != MS_REG_OVR_BKST_OK) { - ms_lib_setacquired_errorblock(us, PhyBlock); -@@ -2075,9 +2086,9 @@ static int ene_ms_init(struct us_data *us) - { - struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; - int result; -- u8 buf[0x200]; - u16 MSP_BlockSize, MSP_UserAreaBlocks; - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; -+ u8 *bbuf = info->bbuf; - - printk(KERN_INFO "transport --- ENE_MSInit\n"); - -@@ -2096,13 +2107,13 @@ static int ene_ms_init(struct us_data *us) - bcb->CDB[0] = 0xF1; - bcb->CDB[1] = 0x01; - -- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0); -+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0); - if (result != USB_STOR_XFER_GOOD) { - printk(KERN_ERR "Execution MS Init Code Fail !!\n"); - return USB_STOR_TRANSPORT_ERROR; - } - /* the same part to test ENE */ -- info->MS_Status = *(struct MS_STATUS *)&buf[0]; -+ info->MS_Status = *(struct MS_STATUS *) bbuf; - - if (info->MS_Status.Insert && info->MS_Status.Ready) { - printk(KERN_INFO "Insert = %x\n", info->MS_Status.Insert); -@@ -2111,15 +2122,15 @@ static int ene_ms_init(struct us_data *us) - printk(KERN_INFO "IsMSPHG = %x\n", info->MS_Status.IsMSPHG); - printk(KERN_INFO "WtP= %x\n", info->MS_Status.WtP); - if (info->MS_Status.IsMSPro) { -- MSP_BlockSize = (buf[6] << 8) | buf[7]; -- MSP_UserAreaBlocks = (buf[10] << 8) | buf[11]; -+ MSP_BlockSize = (bbuf[6] << 8) | bbuf[7]; -+ MSP_UserAreaBlocks = (bbuf[10] << 8) | bbuf[11]; - info->MSP_TotalBlock = MSP_BlockSize * MSP_UserAreaBlocks; - } else { - ms_card_init(us); /* Card is MS (to ms.c)*/ - } - usb_stor_dbg(us, "MS Init Code OK !!\n"); - } else { -- usb_stor_dbg(us, "MS Card Not Ready --- %x\n", buf[0]); -+ usb_stor_dbg(us, "MS Card Not Ready --- %x\n", bbuf[0]); - return USB_STOR_TRANSPORT_ERROR; - } - -@@ -2129,9 +2140,9 @@ static int ene_ms_init(struct us_data *us) - static int ene_sd_init(struct us_data *us) - { - int result; -- u8 buf[0x200]; - struct bulk_cb_wrap *bcb = (struct bulk_cb_wrap *) us->iobuf; - struct ene_ub6250_info *info = (struct ene_ub6250_info *) us->extra; -+ u8 *bbuf = info->bbuf; - - usb_stor_dbg(us, "transport --- ENE_SDInit\n"); - /* SD Init Part-1 */ -@@ -2165,17 +2176,17 @@ static int ene_sd_init(struct us_data *us) - bcb->Flags = US_BULK_FLAG_IN; - bcb->CDB[0] = 0xF1; - -- result = ene_send_scsi_cmd(us, FDIR_READ, &buf, 0); -+ result = ene_send_scsi_cmd(us, FDIR_READ, bbuf, 0); - if (result != USB_STOR_XFER_GOOD) { - usb_stor_dbg(us, "Execution SD Init Code Fail !!\n"); - return USB_STOR_TRANSPORT_ERROR; - } - -- info->SD_Status = *(struct SD_STATUS *)&buf[0]; -+ info->SD_Status = *(struct SD_STATUS *) bbuf; - if (info->SD_Status.Insert && info->SD_Status.Ready) { - struct SD_STATUS *s = &info->SD_Status; - -- ene_get_card_status(us, (unsigned char *)&buf); -+ ene_get_card_status(us, bbuf); - usb_stor_dbg(us, "Insert = %x\n", s->Insert); - usb_stor_dbg(us, "Ready = %x\n", s->Ready); - usb_stor_dbg(us, "IsMMC = %x\n", s->IsMMC); -@@ -2183,7 +2194,7 @@ static int ene_sd_init(struct us_data *us) - usb_stor_dbg(us, "HiSpeed = %x\n", s->HiSpeed); - usb_stor_dbg(us, "WtP = %x\n", s->WtP); - } else { -- usb_stor_dbg(us, "SD Card Not Ready --- %x\n", buf[0]); -+ usb_stor_dbg(us, "SD Card Not Ready --- %x\n", bbuf[0]); - return USB_STOR_TRANSPORT_ERROR; - } - return USB_STOR_TRANSPORT_GOOD; -@@ -2193,13 +2204,15 @@ static int ene_sd_init(struct us_data *us) - static int ene_init(struct us_data *us) - { - int result; -- u8 misc_reg03 = 0; -+ u8 misc_reg03; - struct ene_ub6250_info *info = (struct ene_ub6250_info *)(us->extra); -+ u8 *bbuf = info->bbuf; - -- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03); -+ result = ene_get_card_type(us, REG_CARD_STATUS, bbuf); - if (result != USB_STOR_XFER_GOOD) - return USB_STOR_TRANSPORT_ERROR; - -+ misc_reg03 = bbuf[0]; - if (misc_reg03 & 0x01) { - if (!info->SD_Status.Ready) { - result = ene_sd_init(us); -@@ -2316,8 +2329,9 @@ static int ene_ub6250_probe(struct usb_interface *intf, - const struct usb_device_id *id) - { - int result; -- u8 misc_reg03 = 0; -+ u8 misc_reg03; - struct us_data *us; -+ struct ene_ub6250_info *info; - - result = usb_stor_probe1(&us, intf, id, - (id - ene_ub6250_usb_ids) + ene_ub6250_unusual_dev_list, -@@ -2326,11 +2340,16 @@ static int ene_ub6250_probe(struct usb_interface *intf, - return result; - - /* FIXME: where should the code alloc extra buf ? */ -- if (!us->extra) { -- us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL); -- if (!us->extra) -- return -ENOMEM; -- us->extra_destructor = ene_ub6250_info_destructor; -+ us->extra = kzalloc(sizeof(struct ene_ub6250_info), GFP_KERNEL); -+ if (!us->extra) -+ return -ENOMEM; -+ us->extra_destructor = ene_ub6250_info_destructor; -+ -+ info = (struct ene_ub6250_info *)(us->extra); -+ info->bbuf = kmalloc(512, GFP_KERNEL); -+ if (!info->bbuf) { -+ kfree(us->extra); -+ return -ENOMEM; - } - - us->transport_name = "ene_ub6250"; -@@ -2342,12 +2361,13 @@ static int ene_ub6250_probe(struct usb_interface *intf, - return result; - - /* probe card type */ -- result = ene_get_card_type(us, REG_CARD_STATUS, &misc_reg03); -+ result = ene_get_card_type(us, REG_CARD_STATUS, info->bbuf); - if (result != USB_STOR_XFER_GOOD) { - usb_stor_disconnect(intf); - return USB_STOR_TRANSPORT_ERROR; - } - -+ misc_reg03 = info->bbuf[0]; - if (!(misc_reg03 & 0x01)) { - pr_info("ums_eneub6250: This driver only supports SD/MS cards. " - "It does not support SM cards.\n"); -diff --git a/drivers/uwb/i1480/dfu/usb.c b/drivers/uwb/i1480/dfu/usb.c -index 6345e85822a4..a50cf45e530f 100644 ---- a/drivers/uwb/i1480/dfu/usb.c -+++ b/drivers/uwb/i1480/dfu/usb.c -@@ -341,6 +341,7 @@ error_submit_ep1: - static - int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id) - { -+ struct usb_device *udev = interface_to_usbdev(iface); - struct i1480_usb *i1480_usb; - struct i1480 *i1480; - struct device *dev = &iface->dev; -@@ -352,8 +353,8 @@ int i1480_usb_probe(struct usb_interface *iface, const struct usb_device_id *id) - iface->cur_altsetting->desc.bInterfaceNumber); - goto error; - } -- if (iface->num_altsetting > 1 -- && interface_to_usbdev(iface)->descriptor.idProduct == 0xbabe) { -+ if (iface->num_altsetting > 1 && -+ le16_to_cpu(udev->descriptor.idProduct) == 0xbabe) { - /* Need altsetting #1 [HW QUIRK] or EP1 won't work */ - result = usb_set_interface(interface_to_usbdev(iface), 0, 1); - if (result < 0) -diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c -index 1a11aedc4fe8..9eb5b314ba06 100644 ---- a/drivers/watchdog/pcwd_usb.c -+++ b/drivers/watchdog/pcwd_usb.c -@@ -630,6 +630,9 @@ static int usb_pcwd_probe(struct usb_interface *interface, - return -ENODEV; - } - -+ if (iface_desc->desc.bNumEndpoints < 1) -+ return -ENODEV; -+ - /* check out the endpoint: it has to be Interrupt & IN */ - endpoint = &iface_desc->endpoint[0].desc; - -diff --git a/fs/ceph/acl.c b/fs/ceph/acl.c -index 4d8caeb94a11..bdb9c94335f1 100644 ---- a/fs/ceph/acl.c -+++ b/fs/ceph/acl.c -@@ -128,7 +128,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type) - if (new_mode != old_mode) { - newattrs.ia_mode = new_mode; - newattrs.ia_valid = ATTR_MODE; -- ret = ceph_setattr(dentry, &newattrs); -+ ret = __ceph_setattr(dentry, &newattrs); - if (ret) - goto out_dput; - } -@@ -138,7 +138,7 @@ int ceph_set_acl(struct inode *inode, struct posix_acl *acl, int type) - if (new_mode != old_mode) { - newattrs.ia_mode = old_mode; - newattrs.ia_valid = ATTR_MODE; -- ceph_setattr(dentry, &newattrs); -+ __ceph_setattr(dentry, &newattrs); - } - goto out_dput; - } -diff --git a/fs/ceph/inode.c b/fs/ceph/inode.c -index d98536c8abfc..9f0d99094cc1 100644 ---- a/fs/ceph/inode.c -+++ b/fs/ceph/inode.c -@@ -1773,7 +1773,7 @@ static const struct inode_operations ceph_symlink_iops = { - /* - * setattr - */ --int ceph_setattr(struct dentry *dentry, struct iattr *attr) -+int __ceph_setattr(struct dentry *dentry, struct iattr *attr) - { - struct inode *inode = d_inode(dentry); - struct ceph_inode_info *ci = ceph_inode(inode); -@@ -1975,11 +1975,6 @@ int ceph_setattr(struct dentry *dentry, struct iattr *attr) - if (inode_dirty_flags) - __mark_inode_dirty(inode, inode_dirty_flags); - -- if (ia_valid & ATTR_MODE) { -- err = posix_acl_chmod(inode, attr->ia_mode); -- if (err) -- goto out_put; -- } - - if (mask) { - req->r_inode = inode; -@@ -1993,13 +1988,23 @@ int ceph_setattr(struct dentry *dentry, struct iattr *attr) - ceph_cap_string(dirtied), mask); - - ceph_mdsc_put_request(req); -- if (mask & CEPH_SETATTR_SIZE) -- __ceph_do_pending_vmtruncate(inode); - ceph_free_cap_flush(prealloc_cf); -+ -+ if (err >= 0 && (mask & CEPH_SETATTR_SIZE)) -+ __ceph_do_pending_vmtruncate(inode); -+ - return err; --out_put: -- ceph_mdsc_put_request(req); -- ceph_free_cap_flush(prealloc_cf); -+} -+ -+int ceph_setattr(struct dentry *dentry, struct iattr *attr) -+{ -+ int err; -+ -+ err = __ceph_setattr(dentry, attr); -+ -+ if (err >= 0 && (attr->ia_valid & ATTR_MODE)) -+ err = posix_acl_chmod(d_inode(dentry), attr->ia_mode); -+ - return err; - } - -diff --git a/fs/ceph/super.h b/fs/ceph/super.h -index 75b7d125ce66..8c8cb8fe3d32 100644 ---- a/fs/ceph/super.h -+++ b/fs/ceph/super.h -@@ -788,6 +788,7 @@ static inline int ceph_do_getattr(struct inode *inode, int mask, bool force) - return __ceph_do_getattr(inode, NULL, mask, force); - } - extern int ceph_permission(struct inode *inode, int mask); -+extern int __ceph_setattr(struct dentry *dentry, struct iattr *attr); - extern int ceph_setattr(struct dentry *dentry, struct iattr *attr); - extern int ceph_getattr(struct vfsmount *mnt, struct dentry *dentry, - struct kstat *stat); -diff --git a/fs/ext4/crypto.c b/fs/ext4/crypto.c -index 9d6c2dcf1bd0..f240cef8b326 100644 ---- a/fs/ext4/crypto.c -+++ b/fs/ext4/crypto.c -@@ -94,7 +94,8 @@ void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx) - * Return: An allocated and initialized encryption context on success; error - * value or NULL otherwise. - */ --struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode) -+struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode, -+ gfp_t gfp_flags) - { - struct ext4_crypto_ctx *ctx = NULL; - int res = 0; -@@ -121,7 +122,7 @@ struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode) - list_del(&ctx->free_list); - spin_unlock_irqrestore(&ext4_crypto_ctx_lock, flags); - if (!ctx) { -- ctx = kmem_cache_zalloc(ext4_crypto_ctx_cachep, GFP_NOFS); -+ ctx = kmem_cache_zalloc(ext4_crypto_ctx_cachep, gfp_flags); - if (!ctx) { - res = -ENOMEM; - goto out; -@@ -258,7 +259,8 @@ static int ext4_page_crypto(struct inode *inode, - ext4_direction_t rw, - pgoff_t index, - struct page *src_page, -- struct page *dest_page) -+ struct page *dest_page, -+ gfp_t gfp_flags) - - { - u8 xts_tweak[EXT4_XTS_TWEAK_SIZE]; -@@ -269,7 +271,7 @@ static int ext4_page_crypto(struct inode *inode, - struct crypto_ablkcipher *tfm = ci->ci_ctfm; - int res = 0; - -- req = ablkcipher_request_alloc(tfm, GFP_NOFS); -+ req = ablkcipher_request_alloc(tfm, gfp_flags); - if (!req) { - printk_ratelimited(KERN_ERR - "%s: crypto_request_alloc() failed\n", -@@ -310,9 +312,10 @@ static int ext4_page_crypto(struct inode *inode, - return 0; - } - --static struct page *alloc_bounce_page(struct ext4_crypto_ctx *ctx) -+static struct page *alloc_bounce_page(struct ext4_crypto_ctx *ctx, -+ gfp_t gfp_flags) - { -- ctx->w.bounce_page = mempool_alloc(ext4_bounce_page_pool, GFP_NOWAIT); -+ ctx->w.bounce_page = mempool_alloc(ext4_bounce_page_pool, gfp_flags); - if (ctx->w.bounce_page == NULL) - return ERR_PTR(-ENOMEM); - ctx->flags |= EXT4_WRITE_PATH_FL; -@@ -335,7 +338,8 @@ static struct page *alloc_bounce_page(struct ext4_crypto_ctx *ctx) - * error value or NULL. - */ - struct page *ext4_encrypt(struct inode *inode, -- struct page *plaintext_page) -+ struct page *plaintext_page, -+ gfp_t gfp_flags) - { - struct ext4_crypto_ctx *ctx; - struct page *ciphertext_page = NULL; -@@ -343,17 +347,17 @@ struct page *ext4_encrypt(struct inode *inode, - - BUG_ON(!PageLocked(plaintext_page)); - -- ctx = ext4_get_crypto_ctx(inode); -+ ctx = ext4_get_crypto_ctx(inode, gfp_flags); - if (IS_ERR(ctx)) - return (struct page *) ctx; - - /* The encryption operation will require a bounce page. */ -- ciphertext_page = alloc_bounce_page(ctx); -+ ciphertext_page = alloc_bounce_page(ctx, gfp_flags); - if (IS_ERR(ciphertext_page)) - goto errout; - ctx->w.control_page = plaintext_page; - err = ext4_page_crypto(inode, EXT4_ENCRYPT, plaintext_page->index, -- plaintext_page, ciphertext_page); -+ plaintext_page, ciphertext_page, gfp_flags); - if (err) { - ciphertext_page = ERR_PTR(err); - errout: -@@ -381,8 +385,8 @@ int ext4_decrypt(struct page *page) - { - BUG_ON(!PageLocked(page)); - -- return ext4_page_crypto(page->mapping->host, -- EXT4_DECRYPT, page->index, page, page); -+ return ext4_page_crypto(page->mapping->host, EXT4_DECRYPT, -+ page->index, page, page, GFP_NOFS); - } - - int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex) -@@ -403,11 +407,11 @@ int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex) - - BUG_ON(inode->i_sb->s_blocksize != PAGE_CACHE_SIZE); - -- ctx = ext4_get_crypto_ctx(inode); -+ ctx = ext4_get_crypto_ctx(inode, GFP_NOFS); - if (IS_ERR(ctx)) - return PTR_ERR(ctx); - -- ciphertext_page = alloc_bounce_page(ctx); -+ ciphertext_page = alloc_bounce_page(ctx, GFP_NOWAIT); - if (IS_ERR(ciphertext_page)) { - err = PTR_ERR(ciphertext_page); - goto errout; -@@ -415,11 +419,12 @@ int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex) - - while (len--) { - err = ext4_page_crypto(inode, EXT4_ENCRYPT, lblk, -- ZERO_PAGE(0), ciphertext_page); -+ ZERO_PAGE(0), ciphertext_page, -+ GFP_NOFS); - if (err) - goto errout; - -- bio = bio_alloc(GFP_KERNEL, 1); -+ bio = bio_alloc(GFP_NOWAIT, 1); - if (!bio) { - err = -ENOMEM; - goto errout; -diff --git a/fs/ext4/crypto_fname.c b/fs/ext4/crypto_fname.c -index 2fbef8a14760..2cfe3ffc276f 100644 ---- a/fs/ext4/crypto_fname.c -+++ b/fs/ext4/crypto_fname.c -@@ -343,7 +343,7 @@ int _ext4_fname_disk_to_usr(struct inode *inode, - memcpy(buf+4, &hinfo->minor_hash, 4); - } else - memset(buf, 0, 8); -- memcpy(buf + 8, iname->name + iname->len - 16, 16); -+ memcpy(buf + 8, iname->name + ((iname->len - 17) & ~15), 16); - oname->name[0] = '_'; - ret = digest_encode(buf, 24, oname->name+1); - oname->len = ret + 1; -diff --git a/fs/ext4/crypto_policy.c b/fs/ext4/crypto_policy.c -index dd561f916f0b..e4f4fc4e56ab 100644 ---- a/fs/ext4/crypto_policy.c -+++ b/fs/ext4/crypto_policy.c -@@ -148,26 +148,38 @@ int ext4_get_policy(struct inode *inode, struct ext4_encryption_policy *policy) - int ext4_is_child_context_consistent_with_parent(struct inode *parent, - struct inode *child) - { -- struct ext4_crypt_info *parent_ci, *child_ci; -+ const struct ext4_crypt_info *parent_ci, *child_ci; -+ struct ext4_encryption_context parent_ctx, child_ctx; - int res; - -- if ((parent == NULL) || (child == NULL)) { -- pr_err("parent %p child %p\n", parent, child); -- WARN_ON(1); /* Should never happen */ -- return 0; -- } -- - /* No restrictions on file types which are never encrypted */ - if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && - !S_ISLNK(child->i_mode)) - return 1; - -- /* no restrictions if the parent directory is not encrypted */ -+ /* No restrictions if the parent directory is unencrypted */ - if (!ext4_encrypted_inode(parent)) - return 1; -- /* if the child directory is not encrypted, this is always a problem */ -+ -+ /* Encrypted directories must not contain unencrypted files */ - if (!ext4_encrypted_inode(child)) - return 0; -+ -+ /* -+ * Both parent and child are encrypted, so verify they use the same -+ * encryption policy. Compare the fscrypt_info structs if the keys are -+ * available, otherwise retrieve and compare the fscrypt_contexts. -+ * -+ * Note that the fscrypt_context retrieval will be required frequently -+ * when accessing an encrypted directory tree without the key. -+ * Performance-wise this is not a big deal because we already don't -+ * really optimize for file access without the key (to the extent that -+ * such access is even possible), given that any attempted access -+ * already causes a fscrypt_context retrieval and keyring search. -+ * -+ * In any case, if an unexpected error occurs, fall back to "forbidden". -+ */ -+ - res = ext4_get_encryption_info(parent); - if (res) - return 0; -@@ -176,17 +188,35 @@ int ext4_is_child_context_consistent_with_parent(struct inode *parent, - return 0; - parent_ci = EXT4_I(parent)->i_crypt_info; - child_ci = EXT4_I(child)->i_crypt_info; -- if (!parent_ci && !child_ci) -- return 1; -- if (!parent_ci || !child_ci) -+ if (parent_ci && child_ci) { -+ return memcmp(parent_ci->ci_master_key, child_ci->ci_master_key, -+ EXT4_KEY_DESCRIPTOR_SIZE) == 0 && -+ (parent_ci->ci_data_mode == child_ci->ci_data_mode) && -+ (parent_ci->ci_filename_mode == -+ child_ci->ci_filename_mode) && -+ (parent_ci->ci_flags == child_ci->ci_flags); -+ } -+ -+ res = ext4_xattr_get(parent, EXT4_XATTR_INDEX_ENCRYPTION, -+ EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, -+ &parent_ctx, sizeof(parent_ctx)); -+ if (res != sizeof(parent_ctx)) -+ return 0; -+ -+ res = ext4_xattr_get(child, EXT4_XATTR_INDEX_ENCRYPTION, -+ EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, -+ &child_ctx, sizeof(child_ctx)); -+ if (res != sizeof(child_ctx)) - return 0; - -- return (memcmp(parent_ci->ci_master_key, -- child_ci->ci_master_key, -- EXT4_KEY_DESCRIPTOR_SIZE) == 0 && -- (parent_ci->ci_data_mode == child_ci->ci_data_mode) && -- (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) && -- (parent_ci->ci_flags == child_ci->ci_flags)); -+ return memcmp(parent_ctx.master_key_descriptor, -+ child_ctx.master_key_descriptor, -+ EXT4_KEY_DESCRIPTOR_SIZE) == 0 && -+ (parent_ctx.contents_encryption_mode == -+ child_ctx.contents_encryption_mode) && -+ (parent_ctx.filenames_encryption_mode == -+ child_ctx.filenames_encryption_mode) && -+ (parent_ctx.flags == child_ctx.flags); - } - - /** -diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h -index 3de9bb357b4f..c8ad14c697c4 100644 ---- a/fs/ext4/ext4.h -+++ b/fs/ext4/ext4.h -@@ -2261,11 +2261,13 @@ extern struct kmem_cache *ext4_crypt_info_cachep; - bool ext4_valid_contents_enc_mode(uint32_t mode); - uint32_t ext4_validate_encryption_key_size(uint32_t mode, uint32_t size); - extern struct workqueue_struct *ext4_read_workqueue; --struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode); -+struct ext4_crypto_ctx *ext4_get_crypto_ctx(struct inode *inode, -+ gfp_t gfp_flags); - void ext4_release_crypto_ctx(struct ext4_crypto_ctx *ctx); - void ext4_restore_control_page(struct page *data_page); - struct page *ext4_encrypt(struct inode *inode, -- struct page *plaintext_page); -+ struct page *plaintext_page, -+ gfp_t gfp_flags); - int ext4_decrypt(struct page *page); - int ext4_encrypted_zeroout(struct inode *inode, struct ext4_extent *ex); - extern const struct dentry_operations ext4_encrypted_d_ops; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index fafa903ab3c0..1d007e853f5c 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1243,9 +1243,9 @@ static inline int ext4_match(struct ext4_filename *fname, - if (unlikely(!name)) { - if (fname->usr_fname->name[0] == '_') { - int ret; -- if (de->name_len < 16) -+ if (de->name_len <= 32) - return 0; -- ret = memcmp(de->name + de->name_len - 16, -+ ret = memcmp(de->name + ((de->name_len - 17) & ~15), - fname->crypto_buf.name + 8, 16); - return (ret == 0) ? 1 : 0; - } -diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c -index 17fbe3882b8e..6ca56f5f72b5 100644 ---- a/fs/ext4/page-io.c -+++ b/fs/ext4/page-io.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - - #include "ext4_jbd2.h" - #include "xattr.h" -@@ -485,9 +486,20 @@ int ext4_bio_write_page(struct ext4_io_submit *io, - - if (ext4_encrypted_inode(inode) && S_ISREG(inode->i_mode) && - nr_to_submit) { -- data_page = ext4_encrypt(inode, page); -+ gfp_t gfp_flags = GFP_NOFS; -+ -+ retry_encrypt: -+ data_page = ext4_encrypt(inode, page, gfp_flags); - if (IS_ERR(data_page)) { - ret = PTR_ERR(data_page); -+ if (ret == -ENOMEM && wbc->sync_mode == WB_SYNC_ALL) { -+ if (io->io_bio) { -+ ext4_io_submit(io); -+ congestion_wait(BLK_RW_ASYNC, HZ/50); -+ } -+ gfp_flags |= __GFP_NOFAIL; -+ goto retry_encrypt; -+ } - data_page = NULL; - goto out; - } -diff --git a/fs/ext4/readpage.c b/fs/ext4/readpage.c -index 5dc5e95063de..bc7642f57dc8 100644 ---- a/fs/ext4/readpage.c -+++ b/fs/ext4/readpage.c -@@ -279,7 +279,7 @@ int ext4_mpage_readpages(struct address_space *mapping, - - if (ext4_encrypted_inode(inode) && - S_ISREG(inode->i_mode)) { -- ctx = ext4_get_crypto_ctx(inode); -+ ctx = ext4_get_crypto_ctx(inode, GFP_NOFS); - if (IS_ERR(ctx)) - goto set_error_page; - } -diff --git a/fs/f2fs/crypto_fname.c b/fs/f2fs/crypto_fname.c -index ab377d496a39..38349ed5ea51 100644 ---- a/fs/f2fs/crypto_fname.c -+++ b/fs/f2fs/crypto_fname.c -@@ -333,7 +333,7 @@ int f2fs_fname_disk_to_usr(struct inode *inode, - memset(buf + 4, 0, 4); - } else - memset(buf, 0, 8); -- memcpy(buf + 8, iname->name + iname->len - 16, 16); -+ memcpy(buf + 8, iname->name + ((iname->len - 17) & ~15), 16); - oname->name[0] = '_'; - ret = digest_encode(buf, 24, oname->name + 1); - oname->len = ret + 1; -diff --git a/fs/f2fs/crypto_policy.c b/fs/f2fs/crypto_policy.c -index 5bbd1989d5e6..884f3f0fe29d 100644 ---- a/fs/f2fs/crypto_policy.c -+++ b/fs/f2fs/crypto_policy.c -@@ -141,25 +141,38 @@ int f2fs_get_policy(struct inode *inode, struct f2fs_encryption_policy *policy) - int f2fs_is_child_context_consistent_with_parent(struct inode *parent, - struct inode *child) - { -- struct f2fs_crypt_info *parent_ci, *child_ci; -+ const struct f2fs_crypt_info *parent_ci, *child_ci; -+ struct f2fs_encryption_context parent_ctx, child_ctx; - int res; - -- if ((parent == NULL) || (child == NULL)) { -- pr_err("parent %p child %p\n", parent, child); -- BUG_ON(1); -- } -- - /* No restrictions on file types which are never encrypted */ - if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) && - !S_ISLNK(child->i_mode)) - return 1; - -- /* no restrictions if the parent directory is not encrypted */ -+ /* No restrictions if the parent directory is unencrypted */ - if (!f2fs_encrypted_inode(parent)) - return 1; -- /* if the child directory is not encrypted, this is always a problem */ -+ -+ /* Encrypted directories must not contain unencrypted files */ - if (!f2fs_encrypted_inode(child)) - return 0; -+ -+ /* -+ * Both parent and child are encrypted, so verify they use the same -+ * encryption policy. Compare the fscrypt_info structs if the keys are -+ * available, otherwise retrieve and compare the fscrypt_contexts. -+ * -+ * Note that the fscrypt_context retrieval will be required frequently -+ * when accessing an encrypted directory tree without the key. -+ * Performance-wise this is not a big deal because we already don't -+ * really optimize for file access without the key (to the extent that -+ * such access is even possible), given that any attempted access -+ * already causes a fscrypt_context retrieval and keyring search. -+ * -+ * In any case, if an unexpected error occurs, fall back to "forbidden". -+ */ -+ - res = f2fs_get_encryption_info(parent); - if (res) - return 0; -@@ -168,17 +181,35 @@ int f2fs_is_child_context_consistent_with_parent(struct inode *parent, - return 0; - parent_ci = F2FS_I(parent)->i_crypt_info; - child_ci = F2FS_I(child)->i_crypt_info; -- if (!parent_ci && !child_ci) -- return 1; -- if (!parent_ci || !child_ci) -+ if (parent_ci && child_ci) { -+ return memcmp(parent_ci->ci_master_key, child_ci->ci_master_key, -+ F2FS_KEY_DESCRIPTOR_SIZE) == 0 && -+ (parent_ci->ci_data_mode == child_ci->ci_data_mode) && -+ (parent_ci->ci_filename_mode == -+ child_ci->ci_filename_mode) && -+ (parent_ci->ci_flags == child_ci->ci_flags); -+ } -+ -+ res = f2fs_getxattr(parent, F2FS_XATTR_INDEX_ENCRYPTION, -+ F2FS_XATTR_NAME_ENCRYPTION_CONTEXT, -+ &parent_ctx, sizeof(parent_ctx), NULL); -+ if (res != sizeof(parent_ctx)) -+ return 0; -+ -+ res = f2fs_getxattr(child, F2FS_XATTR_INDEX_ENCRYPTION, -+ F2FS_XATTR_NAME_ENCRYPTION_CONTEXT, -+ &child_ctx, sizeof(child_ctx), NULL); -+ if (res != sizeof(child_ctx)) - return 0; - -- return (memcmp(parent_ci->ci_master_key, -- child_ci->ci_master_key, -- F2FS_KEY_DESCRIPTOR_SIZE) == 0 && -- (parent_ci->ci_data_mode == child_ci->ci_data_mode) && -- (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) && -- (parent_ci->ci_flags == child_ci->ci_flags)); -+ return memcmp(parent_ctx.master_key_descriptor, -+ child_ctx.master_key_descriptor, -+ F2FS_KEY_DESCRIPTOR_SIZE) == 0 && -+ (parent_ctx.contents_encryption_mode == -+ child_ctx.contents_encryption_mode) && -+ (parent_ctx.filenames_encryption_mode == -+ child_ctx.filenames_encryption_mode) && -+ (parent_ctx.flags == child_ctx.flags); - } - - /** -diff --git a/fs/f2fs/dir.c b/fs/f2fs/dir.c -index 7c1678ba8f92..60972a559685 100644 ---- a/fs/f2fs/dir.c -+++ b/fs/f2fs/dir.c -@@ -124,19 +124,29 @@ struct f2fs_dir_entry *find_target_dentry(struct f2fs_filename *fname, - - de = &d->dentry[bit_pos]; - -- /* encrypted case */ -+ if (de->hash_code != namehash) -+ goto not_match; -+ - de_name.name = d->filename[bit_pos]; - de_name.len = le16_to_cpu(de->name_len); - -- /* show encrypted name */ -- if (fname->hash) { -- if (de->hash_code == fname->hash) -- goto found; -- } else if (de_name.len == name->len && -- de->hash_code == namehash && -- !memcmp(de_name.name, name->name, name->len)) -+#ifdef CONFIG_F2FS_FS_ENCRYPTION -+ if (unlikely(!name->name)) { -+ if (fname->usr_fname->name[0] == '_') { -+ if (de_name.len > 32 && -+ !memcmp(de_name.name + ((de_name.len - 17) & ~15), -+ fname->crypto_buf.name + 8, 16)) -+ goto found; -+ goto not_match; -+ } -+ name->name = fname->crypto_buf.name; -+ name->len = fname->crypto_buf.len; -+ } -+#endif -+ if (de_name.len == name->len && -+ !memcmp(de_name.name, name->name, name->len)) - goto found; -- -+not_match: - if (max_slots && max_len > *max_slots) - *max_slots = max_len; - max_len = 0; -@@ -170,7 +180,7 @@ static struct f2fs_dir_entry *find_in_level(struct inode *dir, - int max_slots; - f2fs_hash_t namehash; - -- namehash = f2fs_dentry_hash(&name); -+ namehash = f2fs_dentry_hash(&name, fname); - - f2fs_bug_on(F2FS_I_SB(dir), level > MAX_DIR_HASH_DEPTH); - -@@ -547,7 +557,7 @@ int __f2fs_add_link(struct inode *dir, const struct qstr *name, - - level = 0; - slots = GET_DENTRY_SLOTS(new_name.len); -- dentry_hash = f2fs_dentry_hash(&new_name); -+ dentry_hash = f2fs_dentry_hash(&new_name, NULL); - - current_depth = F2FS_I(dir)->i_current_depth; - if (F2FS_I(dir)->chash == dentry_hash) { -diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h -index b1aeca83f4be..2871576fbca4 100644 ---- a/fs/f2fs/f2fs.h -+++ b/fs/f2fs/f2fs.h -@@ -1722,7 +1722,8 @@ void f2fs_msg(struct super_block *, const char *, const char *, ...); - /* - * hash.c - */ --f2fs_hash_t f2fs_dentry_hash(const struct qstr *); -+f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info, -+ struct f2fs_filename *fname); - - /* - * node.c -diff --git a/fs/f2fs/hash.c b/fs/f2fs/hash.c -index 71b7206c431e..b238d2fec3e5 100644 ---- a/fs/f2fs/hash.c -+++ b/fs/f2fs/hash.c -@@ -70,7 +70,8 @@ static void str2hashbuf(const unsigned char *msg, size_t len, - *buf++ = pad; - } - --f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info) -+f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info, -+ struct f2fs_filename *fname) - { - __u32 hash; - f2fs_hash_t f2fs_hash; -@@ -79,6 +80,10 @@ f2fs_hash_t f2fs_dentry_hash(const struct qstr *name_info) - const unsigned char *name = name_info->name; - size_t len = name_info->len; - -+ /* encrypted bigname case */ -+ if (fname && !fname->disk_name.name) -+ return cpu_to_le32(fname->hash); -+ - if (is_dot_dotdot(name_info)) - return 0; - -diff --git a/fs/f2fs/inline.c b/fs/f2fs/inline.c -index bda7126466c0..ad80f916b64d 100644 ---- a/fs/f2fs/inline.c -+++ b/fs/f2fs/inline.c -@@ -303,7 +303,7 @@ struct f2fs_dir_entry *find_in_inline_dir(struct inode *dir, - if (IS_ERR(ipage)) - return NULL; - -- namehash = f2fs_dentry_hash(&name); -+ namehash = f2fs_dentry_hash(&name, fname); - - inline_dentry = inline_data_addr(ipage); - -@@ -468,7 +468,7 @@ int f2fs_add_inline_entry(struct inode *dir, const struct qstr *name, - - f2fs_wait_on_page_writeback(ipage, NODE); - -- name_hash = f2fs_dentry_hash(name); -+ name_hash = f2fs_dentry_hash(name, NULL); - make_dentry_ptr(NULL, &d, (void *)dentry_blk, 2); - f2fs_update_dentry(ino, mode, &d, name, name_hash, bit_pos); - -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index 12935209deca..c3e1cb481fe0 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -4041,8 +4041,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, - struct nfsd4_getdeviceinfo *gdev) - { - struct xdr_stream *xdr = &resp->xdr; -- const struct nfsd4_layout_ops *ops = -- nfsd4_layout_ops[gdev->gd_layout_type]; -+ const struct nfsd4_layout_ops *ops; - u32 starting_len = xdr->buf->len, needed_len; - __be32 *p; - -@@ -4059,6 +4058,7 @@ nfsd4_encode_getdeviceinfo(struct nfsd4_compoundres *resp, __be32 nfserr, - - /* If maxcount is 0 then just update notifications */ - if (gdev->gd_maxcount != 0) { -+ ops = nfsd4_layout_ops[gdev->gd_layout_type]; - nfserr = ops->encode_getdeviceinfo(xdr, gdev); - if (nfserr) { - /* -@@ -4111,8 +4111,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, - struct nfsd4_layoutget *lgp) - { - struct xdr_stream *xdr = &resp->xdr; -- const struct nfsd4_layout_ops *ops = -- nfsd4_layout_ops[lgp->lg_layout_type]; -+ const struct nfsd4_layout_ops *ops; - __be32 *p; - - dprintk("%s: err %d\n", __func__, nfserr); -@@ -4135,6 +4134,7 @@ nfsd4_encode_layoutget(struct nfsd4_compoundres *resp, __be32 nfserr, - *p++ = cpu_to_be32(lgp->lg_seg.iomode); - *p++ = cpu_to_be32(lgp->lg_layout_type); - -+ ops = nfsd4_layout_ops[lgp->lg_layout_type]; - nfserr = ops->encode_layoutget(xdr, lgp); - out: - kfree(lgp->lg_content); -diff --git a/fs/proc/generic.c b/fs/proc/generic.c -index ff3ffc76a937..3773335791da 100644 ---- a/fs/proc/generic.c -+++ b/fs/proc/generic.c -@@ -469,6 +469,7 @@ struct proc_dir_entry *proc_create_mount_point(const char *name) - ent->data = NULL; - ent->proc_fops = NULL; - ent->proc_iops = NULL; -+ parent->nlink++; - if (proc_register(parent, ent) < 0) { - kfree(ent); - parent->nlink--; -diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h -index 8f6849084248..e23392517db9 100644 ---- a/include/linux/kprobes.h -+++ b/include/linux/kprobes.h -@@ -330,7 +330,9 @@ extern int proc_kprobes_optimization_handler(struct ctl_table *table, - int write, void __user *buffer, - size_t *length, loff_t *ppos); - #endif -- -+extern void wait_for_kprobe_optimizer(void); -+#else -+static inline void wait_for_kprobe_optimizer(void) { } - #endif /* CONFIG_OPTPROBES */ - #ifdef CONFIG_KPROBES_ON_FTRACE - extern void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, -diff --git a/kernel/fork.c b/kernel/fork.c -index 278a2ddad351..0ee630f3ad4b 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -1590,11 +1590,13 @@ static struct task_struct *copy_process(unsigned long clone_flags, - */ - recalc_sigpending(); - if (signal_pending(current)) { -- spin_unlock(¤t->sighand->siglock); -- write_unlock_irq(&tasklist_lock); - retval = -ERESTARTNOINTR; - goto bad_fork_cancel_cgroup; - } -+ if (unlikely(!(ns_of_pid(pid)->nr_hashed & PIDNS_HASH_ADDING))) { -+ retval = -ENOMEM; -+ goto bad_fork_cancel_cgroup; -+ } - - if (likely(p->pid)) { - ptrace_init_task(p, (clone_flags & CLONE_PTRACE) || trace); -@@ -1645,6 +1647,8 @@ static struct task_struct *copy_process(unsigned long clone_flags, - return p; - - bad_fork_cancel_cgroup: -+ spin_unlock(¤t->sighand->siglock); -+ write_unlock_irq(&tasklist_lock); - cgroup_cancel_fork(p, cgrp_ss_priv); - bad_fork_free_pid: - threadgroup_change_end(current); -diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c -index 15206453b12a..e4453d9f788c 100644 ---- a/kernel/irq/chip.c -+++ b/kernel/irq/chip.c -@@ -810,8 +810,8 @@ irq_set_chained_handler_and_data(unsigned int irq, irq_flow_handler_t handle, - if (!desc) - return; - -- __irq_do_set_handler(desc, handle, 1, NULL); - desc->irq_common_data.handler_data = data; -+ __irq_do_set_handler(desc, handle, 1, NULL); - - irq_put_desc_busunlock(desc, flags); - } -diff --git a/kernel/kprobes.c b/kernel/kprobes.c -index d10ab6b9b5e0..695763516908 100644 ---- a/kernel/kprobes.c -+++ b/kernel/kprobes.c -@@ -563,7 +563,7 @@ static void kprobe_optimizer(struct work_struct *work) - } - - /* Wait for completing optimization and unoptimization */ --static void wait_for_kprobe_optimizer(void) -+void wait_for_kprobe_optimizer(void) - { - mutex_lock(&kprobe_mutex); - -diff --git a/kernel/pid_namespace.c b/kernel/pid_namespace.c -index a65ba137fd15..567ecc826bc8 100644 ---- a/kernel/pid_namespace.c -+++ b/kernel/pid_namespace.c -@@ -255,7 +255,7 @@ void zap_pid_ns_processes(struct pid_namespace *pid_ns) - * if reparented. - */ - for (;;) { -- set_current_state(TASK_UNINTERRUPTIBLE); -+ set_current_state(TASK_INTERRUPTIBLE); - if (pid_ns->nr_hashed == init_pids) - break; - schedule(); -diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c -index 8f258f437ac2..812069b66f47 100644 ---- a/kernel/sched/fair.c -+++ b/kernel/sched/fair.c -@@ -3918,6 +3918,26 @@ static void check_enqueue_throttle(struct cfs_rq *cfs_rq) - if (!cfs_bandwidth_used()) - return; - -+ /* Synchronize hierarchical throttle counter: */ -+ if (unlikely(!cfs_rq->throttle_uptodate)) { -+ struct rq *rq = rq_of(cfs_rq); -+ struct cfs_rq *pcfs_rq; -+ struct task_group *tg; -+ -+ cfs_rq->throttle_uptodate = 1; -+ -+ /* Get closest up-to-date node, because leaves go first: */ -+ for (tg = cfs_rq->tg->parent; tg; tg = tg->parent) { -+ pcfs_rq = tg->cfs_rq[cpu_of(rq)]; -+ if (pcfs_rq->throttle_uptodate) -+ break; -+ } -+ if (tg) { -+ cfs_rq->throttle_count = pcfs_rq->throttle_count; -+ cfs_rq->throttled_clock_task = rq_clock_task(rq); -+ } -+ } -+ - /* an active group must be handled by the update_curr()->put() path */ - if (!cfs_rq->runtime_enabled || cfs_rq->curr) - return; -@@ -4233,15 +4253,14 @@ static void dequeue_task_fair(struct rq *rq, struct task_struct *p, int flags) - - /* Don't dequeue parent if it has other entities besides us */ - if (cfs_rq->load.weight) { -+ /* Avoid re-evaluating load for this entity: */ -+ se = parent_entity(se); - /* - * Bias pick_next to pick a task from this cfs_rq, as - * p is sleeping when it is within its sched_slice. - */ -- if (task_sleep && parent_entity(se)) -- set_next_buddy(parent_entity(se)); -- -- /* avoid re-evaluating load for this entity */ -- se = parent_entity(se); -+ if (task_sleep && se && !throttled_hierarchy(cfs_rq)) -+ set_next_buddy(se); - break; - } - flags |= DEQUEUE_SLEEP; -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 0517abd7dd73..4e5db65d1aab 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -417,7 +417,7 @@ struct cfs_rq { - - u64 throttled_clock, throttled_clock_task; - u64 throttled_clock_task_time; -- int throttled, throttle_count; -+ int throttled, throttle_count, throttle_uptodate; - struct list_head throttled_list; - #endif /* CONFIG_CFS_BANDWIDTH */ - #endif /* CONFIG_FAIR_GROUP_SCHED */ -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index c9956440d0e6..12ea4ea619ee 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -1471,6 +1471,11 @@ static __init int kprobe_trace_self_tests_init(void) - - end: - release_all_trace_kprobes(); -+ /* -+ * Wait for the optimizer work to finish. Otherwise it might fiddle -+ * with probes in already freed __init text. -+ */ -+ wait_for_kprobe_optimizer(); - if (warn) - pr_cont("NG: Some tests are failed. Please check them.\n"); - else -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 530e6427f823..47b469663822 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1269,6 +1269,16 @@ out_unlock: - return ret; - } - -+/* -+ * FOLL_FORCE can write to even unwritable pmd's, but only -+ * after we've gone through a COW cycle and they are dirty. -+ */ -+static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags) -+{ -+ return pmd_write(pmd) || -+ ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd)); -+} -+ - struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, - unsigned long addr, - pmd_t *pmd, -@@ -1279,7 +1289,7 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, - - assert_spin_locked(pmd_lockptr(mm, pmd)); - -- if (flags & FOLL_WRITE && !pmd_write(*pmd)) -+ if (flags & FOLL_WRITE && !can_follow_write_pmd(*pmd, flags)) - goto out; - - /* Avoid dumping huge zero page */ -diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c -index 48d0dc89b58d..e735f781e4f3 100644 ---- a/net/ipx/af_ipx.c -+++ b/net/ipx/af_ipx.c -@@ -1168,11 +1168,10 @@ static int ipxitf_ioctl(unsigned int cmd, void __user *arg) - sipx->sipx_network = ipxif->if_netnum; - memcpy(sipx->sipx_node, ipxif->if_node, - sizeof(sipx->sipx_node)); -- rc = -EFAULT; -+ rc = 0; - if (copy_to_user(arg, &ifr, sizeof(ifr))) -- break; -+ rc = -EFAULT; - ipxitf_put(ipxif); -- rc = 0; - break; - } - case SIOCAIPXITFCRT: -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index ed5a9c110b3a..9ce9d5003dcc 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -203,10 +203,11 @@ int ima_appraise_measurement(int func, struct integrity_iint_cache *iint, - - cause = "missing-hash"; - status = INTEGRITY_NOLABEL; -- if (opened & FILE_CREATED) { -+ if (opened & FILE_CREATED) - iint->flags |= IMA_NEW_FILE; -+ if ((iint->flags & IMA_NEW_FILE) && -+ !(iint->flags & IMA_DIGSIG_REQUIRED)) - status = INTEGRITY_PASS; -- } - goto out; - } - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.70-71.patch b/patch/kernel/mvebu64-default/03-patch-4.4.70-71.patch deleted file mode 100644 index 34a572eb6657..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.70-71.patch +++ /dev/null @@ -1,2203 +0,0 @@ -diff --git a/Makefile b/Makefile -index a5ecb29c6ed3..ad91a79aed51 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 70 -+SUBLEVEL = 71 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/sparc/include/asm/pgtable_32.h b/arch/sparc/include/asm/pgtable_32.h -index 91b963a887b7..29c3b400f949 100644 ---- a/arch/sparc/include/asm/pgtable_32.h -+++ b/arch/sparc/include/asm/pgtable_32.h -@@ -91,9 +91,9 @@ extern unsigned long pfn_base; - * ZERO_PAGE is a global shared page that is always zero: used - * for zero-mapped memory areas etc.. - */ --extern unsigned long empty_zero_page; -+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; - --#define ZERO_PAGE(vaddr) (virt_to_page(&empty_zero_page)) -+#define ZERO_PAGE(vaddr) (virt_to_page(empty_zero_page)) - - /* - * In general all page table modifications should use the V8 atomic -diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h -index 29d64b1758ed..be0cc1beed41 100644 ---- a/arch/sparc/include/asm/setup.h -+++ b/arch/sparc/include/asm/setup.h -@@ -16,7 +16,7 @@ extern char reboot_command[]; - */ - extern unsigned char boot_cpu_id; - --extern unsigned long empty_zero_page; -+extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)]; - - extern int serial_console; - static inline int con_is_present(void) -diff --git a/arch/sparc/mm/init_32.c b/arch/sparc/mm/init_32.c -index eb8287155279..3b7092d9ea8f 100644 ---- a/arch/sparc/mm/init_32.c -+++ b/arch/sparc/mm/init_32.c -@@ -301,7 +301,7 @@ void __init mem_init(void) - - - /* Saves us work later. */ -- memset((void *)&empty_zero_page, 0, PAGE_SIZE); -+ memset((void *)empty_zero_page, 0, PAGE_SIZE); - - i = last_valid_pfn >> ((20 - PAGE_SHIFT) + 5); - i += 1; -diff --git a/drivers/char/pcmcia/cm4040_cs.c b/drivers/char/pcmcia/cm4040_cs.c -index fc061f7c2bd1..a7de8ae185a5 100644 ---- a/drivers/char/pcmcia/cm4040_cs.c -+++ b/drivers/char/pcmcia/cm4040_cs.c -@@ -374,7 +374,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf, - - rc = write_sync_reg(SCR_HOST_TO_READER_START, dev); - if (rc <= 0) { -- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc); -+ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc); - DEBUGP(2, dev, "<- cm4040_write (failed)\n"); - if (rc == -ERESTARTSYS) - return rc; -@@ -387,7 +387,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf, - for (i = 0; i < bytes_to_write; i++) { - rc = wait_for_bulk_out_ready(dev); - if (rc <= 0) { -- DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2Zx\n", -+ DEBUGP(5, dev, "wait_for_bulk_out_ready rc=%.2zx\n", - rc); - DEBUGP(2, dev, "<- cm4040_write (failed)\n"); - if (rc == -ERESTARTSYS) -@@ -403,7 +403,7 @@ static ssize_t cm4040_write(struct file *filp, const char __user *buf, - rc = write_sync_reg(SCR_HOST_TO_READER_DONE, dev); - - if (rc <= 0) { -- DEBUGP(5, dev, "write_sync_reg c=%.2Zx\n", rc); -+ DEBUGP(5, dev, "write_sync_reg c=%.2zx\n", rc); - DEBUGP(2, dev, "<- cm4040_write (failed)\n"); - if (rc == -ERESTARTSYS) - return rc; -diff --git a/drivers/gpu/drm/gma500/psb_intel_lvds.c b/drivers/gpu/drm/gma500/psb_intel_lvds.c -index ce0645d0c1e5..61e3a097a478 100644 ---- a/drivers/gpu/drm/gma500/psb_intel_lvds.c -+++ b/drivers/gpu/drm/gma500/psb_intel_lvds.c -@@ -783,20 +783,23 @@ void psb_intel_lvds_init(struct drm_device *dev, - if (scan->type & DRM_MODE_TYPE_PREFERRED) { - mode_dev->panel_fixed_mode = - drm_mode_duplicate(dev, scan); -+ DRM_DEBUG_KMS("Using mode from DDC\n"); - goto out; /* FIXME: check for quirks */ - } - } - - /* Failed to get EDID, what about VBT? do we need this? */ -- if (mode_dev->vbt_mode) -+ if (dev_priv->lfp_lvds_vbt_mode) { - mode_dev->panel_fixed_mode = -- drm_mode_duplicate(dev, mode_dev->vbt_mode); -+ drm_mode_duplicate(dev, dev_priv->lfp_lvds_vbt_mode); - -- if (!mode_dev->panel_fixed_mode) -- if (dev_priv->lfp_lvds_vbt_mode) -- mode_dev->panel_fixed_mode = -- drm_mode_duplicate(dev, -- dev_priv->lfp_lvds_vbt_mode); -+ if (mode_dev->panel_fixed_mode) { -+ mode_dev->panel_fixed_mode->type |= -+ DRM_MODE_TYPE_PREFERRED; -+ DRM_DEBUG_KMS("Using mode from VBT\n"); -+ goto out; -+ } -+ } - - /* - * If we didn't get EDID, try checking if the panel is already turned -@@ -813,6 +816,7 @@ void psb_intel_lvds_init(struct drm_device *dev, - if (mode_dev->panel_fixed_mode) { - mode_dev->panel_fixed_mode->type |= - DRM_MODE_TYPE_PREFERRED; -+ DRM_DEBUG_KMS("Using pre-programmed mode\n"); - goto out; /* FIXME: check for quirks */ - } - } -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index 4a09947be244..3c32f095a873 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -776,6 +776,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev) - u32 vblank_time = r600_dpm_get_vblank_time(rdev); - u32 switch_limit = pi->mem_gddr5 ? 450 : 300; - -+ /* disable mclk switching if the refresh is >120Hz, even if the -+ * blanking period would allow it -+ */ -+ if (r600_dpm_get_vrefresh(rdev) > 120) -+ return true; -+ - if (vblank_time < switch_limit) - return true; - else -diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c -index f81fb2641097..134874cab4c7 100644 ---- a/drivers/gpu/drm/radeon/cik.c -+++ b/drivers/gpu/drm/radeon/cik.c -@@ -7762,7 +7762,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -@@ -7792,7 +7792,7 @@ static inline void cik_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.cik.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_RX_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c -index 32491355a1d4..ba9e6ed4ae54 100644 ---- a/drivers/gpu/drm/radeon/evergreen.c -+++ b/drivers/gpu/drm/radeon/evergreen.c -@@ -4924,7 +4924,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -@@ -4955,7 +4955,7 @@ static void evergreen_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_RX_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c -index cc2fdf0be37a..0e20c08f8977 100644 ---- a/drivers/gpu/drm/radeon/r600.c -+++ b/drivers/gpu/drm/radeon/r600.c -@@ -3945,7 +3945,7 @@ static void r600_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.r600.disp_int_cont2 & DC_HPD6_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c -index f878d6962da5..5cf3a2cbc07e 100644 ---- a/drivers/gpu/drm/radeon/si.c -+++ b/drivers/gpu/drm/radeon/si.c -@@ -6335,7 +6335,7 @@ static inline void si_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -@@ -6366,7 +6366,7 @@ static inline void si_irq_ack(struct radeon_device *rdev) - WREG32(DC_HPD5_INT_CONTROL, tmp); - } - if (rdev->irq.stat_regs.evergreen.disp_int_cont5 & DC_HPD6_RX_INTERRUPT) { -- tmp = RREG32(DC_HPD5_INT_CONTROL); -+ tmp = RREG32(DC_HPD6_INT_CONTROL); - tmp |= DC_HPDx_RX_INT_ACK; - WREG32(DC_HPD6_INT_CONTROL, tmp); - } -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 35e3fd9fadf6..b62c50d1b1e4 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -1440,37 +1440,38 @@ static int wacom_tpc_irq(struct wacom_wac *wacom, size_t len) - { - unsigned char *data = wacom->data; - -- if (wacom->pen_input) -+ if (wacom->pen_input) { - dev_dbg(wacom->pen_input->dev.parent, - "%s: received report #%d\n", __func__, data[0]); -- else if (wacom->touch_input) -+ -+ if (len == WACOM_PKGLEN_PENABLED || -+ data[0] == WACOM_REPORT_PENABLED) -+ return wacom_tpc_pen(wacom); -+ } -+ else if (wacom->touch_input) { - dev_dbg(wacom->touch_input->dev.parent, - "%s: received report #%d\n", __func__, data[0]); - -- switch (len) { -- case WACOM_PKGLEN_TPC1FG: -- return wacom_tpc_single_touch(wacom, len); -+ switch (len) { -+ case WACOM_PKGLEN_TPC1FG: -+ return wacom_tpc_single_touch(wacom, len); - -- case WACOM_PKGLEN_TPC2FG: -- return wacom_tpc_mt_touch(wacom); -+ case WACOM_PKGLEN_TPC2FG: -+ return wacom_tpc_mt_touch(wacom); - -- case WACOM_PKGLEN_PENABLED: -- return wacom_tpc_pen(wacom); -+ default: -+ switch (data[0]) { -+ case WACOM_REPORT_TPC1FG: -+ case WACOM_REPORT_TPCHID: -+ case WACOM_REPORT_TPCST: -+ case WACOM_REPORT_TPC1FGE: -+ return wacom_tpc_single_touch(wacom, len); - -- default: -- switch (data[0]) { -- case WACOM_REPORT_TPC1FG: -- case WACOM_REPORT_TPCHID: -- case WACOM_REPORT_TPCST: -- case WACOM_REPORT_TPC1FGE: -- return wacom_tpc_single_touch(wacom, len); -- -- case WACOM_REPORT_TPCMT: -- case WACOM_REPORT_TPCMT2: -- return wacom_mt_touch(wacom); -+ case WACOM_REPORT_TPCMT: -+ case WACOM_REPORT_TPCMT2: -+ return wacom_mt_touch(wacom); - -- case WACOM_REPORT_PENABLED: -- return wacom_tpc_pen(wacom); -+ } - } - } - -diff --git a/drivers/i2c/busses/i2c-tiny-usb.c b/drivers/i2c/busses/i2c-tiny-usb.c -index 0ed77eeff31e..a2e3dd715380 100644 ---- a/drivers/i2c/busses/i2c-tiny-usb.c -+++ b/drivers/i2c/busses/i2c-tiny-usb.c -@@ -178,22 +178,39 @@ static int usb_read(struct i2c_adapter *adapter, int cmd, - int value, int index, void *data, int len) - { - struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data; -+ void *dmadata = kmalloc(len, GFP_KERNEL); -+ int ret; -+ -+ if (!dmadata) -+ return -ENOMEM; - - /* do control transfer */ -- return usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0), -+ ret = usb_control_msg(dev->usb_dev, usb_rcvctrlpipe(dev->usb_dev, 0), - cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE | -- USB_DIR_IN, value, index, data, len, 2000); -+ USB_DIR_IN, value, index, dmadata, len, 2000); -+ -+ memcpy(data, dmadata, len); -+ kfree(dmadata); -+ return ret; - } - - static int usb_write(struct i2c_adapter *adapter, int cmd, - int value, int index, void *data, int len) - { - struct i2c_tiny_usb *dev = (struct i2c_tiny_usb *)adapter->algo_data; -+ void *dmadata = kmemdup(data, len, GFP_KERNEL); -+ int ret; -+ -+ if (!dmadata) -+ return -ENOMEM; - - /* do control transfer */ -- return usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0), -+ ret = usb_control_msg(dev->usb_dev, usb_sndctrlpipe(dev->usb_dev, 0), - cmd, USB_TYPE_VENDOR | USB_RECIP_INTERFACE, -- value, index, data, len, 2000); -+ value, index, dmadata, len, 2000); -+ -+ kfree(dmadata); -+ return ret; - } - - static void i2c_tiny_usb_free(struct i2c_tiny_usb *dev) -diff --git a/drivers/mmc/host/sdhci-iproc.c b/drivers/mmc/host/sdhci-iproc.c -index 3b423b0ad8e7..f280744578e4 100644 ---- a/drivers/mmc/host/sdhci-iproc.c -+++ b/drivers/mmc/host/sdhci-iproc.c -@@ -156,7 +156,8 @@ static const struct sdhci_ops sdhci_iproc_ops = { - }; - - static const struct sdhci_pltfm_data sdhci_iproc_pltfm_data = { -- .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK, -+ .quirks = SDHCI_QUIRK_DATA_TIMEOUT_USES_SDCLK | -+ SDHCI_QUIRK_MULTIBLOCK_READ_ACMD12, - .quirks2 = SDHCI_QUIRK2_ACMD23_BROKEN, - .ops = &sdhci_iproc_ops, - }; -diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c -index 8a1d9fffd7d6..26255862d1cf 100644 ---- a/drivers/net/ethernet/emulex/benet/be_main.c -+++ b/drivers/net/ethernet/emulex/benet/be_main.c -@@ -5260,9 +5260,11 @@ static netdev_features_t be_features_check(struct sk_buff *skb, - struct be_adapter *adapter = netdev_priv(dev); - u8 l4_hdr = 0; - -- /* The code below restricts offload features for some tunneled packets. -+ /* The code below restricts offload features for some tunneled and -+ * Q-in-Q packets. - * Offload features for normal (non tunnel) packets are unchanged. - */ -+ features = vlan_features_check(skb, features); - if (!skb->encapsulation || - !(adapter->flags & BE_FLAGS_VXLAN_OFFLOADS)) - return features; -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index c6f5d9a6bec6..582d8f0c6266 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -730,6 +730,8 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */ - {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ - {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ -+ {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ -+ {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */ - {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ - {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ - {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 0e2a19e58923..7f7c87762bc6 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -1415,6 +1415,7 @@ static const struct net_device_ops virtnet_netdev = { - #ifdef CONFIG_NET_RX_BUSY_POLL - .ndo_busy_poll = virtnet_busy_poll, - #endif -+ .ndo_features_check = passthru_features_check, - }; - - static void virtnet_config_changed_work(struct work_struct *work) -diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h -index 1766a20ebcb1..741f3ee81cfe 100644 ---- a/drivers/s390/net/qeth_core.h -+++ b/drivers/s390/net/qeth_core.h -@@ -717,6 +717,7 @@ enum qeth_discipline_id { - }; - - struct qeth_discipline { -+ const struct device_type *devtype; - void (*start_poll)(struct ccw_device *, int, unsigned long); - qdio_handler_t *input_handler; - qdio_handler_t *output_handler; -@@ -881,6 +882,9 @@ extern struct qeth_discipline qeth_l2_discipline; - extern struct qeth_discipline qeth_l3_discipline; - extern const struct attribute_group *qeth_generic_attr_groups[]; - extern const struct attribute_group *qeth_osn_attr_groups[]; -+extern const struct attribute_group qeth_device_attr_group; -+extern const struct attribute_group qeth_device_blkt_group; -+extern const struct device_type qeth_generic_devtype; - extern struct workqueue_struct *qeth_wq; - - int qeth_card_hw_is_reachable(struct qeth_card *); -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index 31ac53fa5cee..d10bf3da8e5f 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -5449,10 +5449,12 @@ void qeth_core_free_discipline(struct qeth_card *card) - card->discipline = NULL; - } - --static const struct device_type qeth_generic_devtype = { -+const struct device_type qeth_generic_devtype = { - .name = "qeth_generic", - .groups = qeth_generic_attr_groups, - }; -+EXPORT_SYMBOL_GPL(qeth_generic_devtype); -+ - static const struct device_type qeth_osn_devtype = { - .name = "qeth_osn", - .groups = qeth_osn_attr_groups, -@@ -5578,23 +5580,22 @@ static int qeth_core_probe_device(struct ccwgroup_device *gdev) - goto err_card; - } - -- if (card->info.type == QETH_CARD_TYPE_OSN) -- gdev->dev.type = &qeth_osn_devtype; -- else -- gdev->dev.type = &qeth_generic_devtype; -- - switch (card->info.type) { - case QETH_CARD_TYPE_OSN: - case QETH_CARD_TYPE_OSM: - rc = qeth_core_load_discipline(card, QETH_DISCIPLINE_LAYER2); - if (rc) - goto err_card; -+ -+ gdev->dev.type = (card->info.type != QETH_CARD_TYPE_OSN) -+ ? card->discipline->devtype -+ : &qeth_osn_devtype; - rc = card->discipline->setup(card->gdev); - if (rc) - goto err_disc; -- case QETH_CARD_TYPE_OSD: -- case QETH_CARD_TYPE_OSX: -+ break; - default: -+ gdev->dev.type = &qeth_generic_devtype; - break; - } - -@@ -5650,8 +5651,10 @@ static int qeth_core_set_online(struct ccwgroup_device *gdev) - if (rc) - goto err; - rc = card->discipline->setup(card->gdev); -- if (rc) -+ if (rc) { -+ qeth_core_free_discipline(card); - goto err; -+ } - } - rc = card->discipline->set_online(gdev); - err: -diff --git a/drivers/s390/net/qeth_core_sys.c b/drivers/s390/net/qeth_core_sys.c -index e6e5b9671bf2..fa844b0ff847 100644 ---- a/drivers/s390/net/qeth_core_sys.c -+++ b/drivers/s390/net/qeth_core_sys.c -@@ -409,12 +409,16 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, - - if (card->options.layer2 == newdis) - goto out; -- else { -- card->info.mac_bits = 0; -- if (card->discipline) { -- card->discipline->remove(card->gdev); -- qeth_core_free_discipline(card); -- } -+ if (card->info.type == QETH_CARD_TYPE_OSM) { -+ /* fixed layer, can't switch */ -+ rc = -EOPNOTSUPP; -+ goto out; -+ } -+ -+ card->info.mac_bits = 0; -+ if (card->discipline) { -+ card->discipline->remove(card->gdev); -+ qeth_core_free_discipline(card); - } - - rc = qeth_core_load_discipline(card, newdis); -@@ -422,6 +426,8 @@ static ssize_t qeth_dev_layer2_store(struct device *dev, - goto out; - - rc = card->discipline->setup(card->gdev); -+ if (rc) -+ qeth_core_free_discipline(card); - out: - mutex_unlock(&card->discipline_mutex); - return rc ? rc : count; -@@ -699,10 +705,11 @@ static struct attribute *qeth_blkt_device_attrs[] = { - &dev_attr_inter_jumbo.attr, - NULL, - }; --static struct attribute_group qeth_device_blkt_group = { -+const struct attribute_group qeth_device_blkt_group = { - .name = "blkt", - .attrs = qeth_blkt_device_attrs, - }; -+EXPORT_SYMBOL_GPL(qeth_device_blkt_group); - - static struct attribute *qeth_device_attrs[] = { - &dev_attr_state.attr, -@@ -722,9 +729,10 @@ static struct attribute *qeth_device_attrs[] = { - &dev_attr_switch_attrs.attr, - NULL, - }; --static struct attribute_group qeth_device_attr_group = { -+const struct attribute_group qeth_device_attr_group = { - .attrs = qeth_device_attrs, - }; -+EXPORT_SYMBOL_GPL(qeth_device_attr_group); - - const struct attribute_group *qeth_generic_attr_groups[] = { - &qeth_device_attr_group, -diff --git a/drivers/s390/net/qeth_l2.h b/drivers/s390/net/qeth_l2.h -index 0767556404bd..eb87bf97d38a 100644 ---- a/drivers/s390/net/qeth_l2.h -+++ b/drivers/s390/net/qeth_l2.h -@@ -8,6 +8,8 @@ - - #include "qeth_core.h" - -+extern const struct attribute_group *qeth_l2_attr_groups[]; -+ - int qeth_l2_create_device_attributes(struct device *); - void qeth_l2_remove_device_attributes(struct device *); - void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card); -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index df036b872b05..bf1e0e39334d 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -1027,11 +1027,21 @@ static int qeth_l2_stop(struct net_device *dev) - return 0; - } - -+static const struct device_type qeth_l2_devtype = { -+ .name = "qeth_layer2", -+ .groups = qeth_l2_attr_groups, -+}; -+ - static int qeth_l2_probe_device(struct ccwgroup_device *gdev) - { - struct qeth_card *card = dev_get_drvdata(&gdev->dev); -+ int rc; - -- qeth_l2_create_device_attributes(&gdev->dev); -+ if (gdev->dev.type == &qeth_generic_devtype) { -+ rc = qeth_l2_create_device_attributes(&gdev->dev); -+ if (rc) -+ return rc; -+ } - INIT_LIST_HEAD(&card->vid_list); - hash_init(card->mac_htable); - card->options.layer2 = 1; -@@ -1043,7 +1053,8 @@ static void qeth_l2_remove_device(struct ccwgroup_device *cgdev) - { - struct qeth_card *card = dev_get_drvdata(&cgdev->dev); - -- qeth_l2_remove_device_attributes(&cgdev->dev); -+ if (cgdev->dev.type == &qeth_generic_devtype) -+ qeth_l2_remove_device_attributes(&cgdev->dev); - qeth_set_allowed_threads(card, 0, 1); - wait_event(card->wait_q, qeth_threads_running(card, 0xffffffff) == 0); - -@@ -1101,7 +1112,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card) - case QETH_CARD_TYPE_OSN: - card->dev = alloc_netdev(0, "osn%d", NET_NAME_UNKNOWN, - ether_setup); -- card->dev->flags |= IFF_NOARP; - break; - default: - card->dev = alloc_etherdev(0); -@@ -1114,9 +1124,12 @@ static int qeth_l2_setup_netdev(struct qeth_card *card) - card->dev->watchdog_timeo = QETH_TX_TIMEOUT; - card->dev->mtu = card->info.initial_mtu; - card->dev->netdev_ops = &qeth_l2_netdev_ops; -- card->dev->ethtool_ops = -- (card->info.type != QETH_CARD_TYPE_OSN) ? -- &qeth_l2_ethtool_ops : &qeth_l2_osn_ops; -+ if (card->info.type == QETH_CARD_TYPE_OSN) { -+ card->dev->ethtool_ops = &qeth_l2_osn_ops; -+ card->dev->flags |= IFF_NOARP; -+ } else { -+ card->dev->ethtool_ops = &qeth_l2_ethtool_ops; -+ } - card->dev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; - if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) { - card->dev->hw_features = NETIF_F_IP_CSUM | NETIF_F_RXCSUM; -@@ -1429,6 +1442,7 @@ static int qeth_l2_control_event(struct qeth_card *card, - } - - struct qeth_discipline qeth_l2_discipline = { -+ .devtype = &qeth_l2_devtype, - .start_poll = qeth_qdio_start_poll, - .input_handler = (qdio_handler_t *) qeth_qdio_input_handler, - .output_handler = (qdio_handler_t *) qeth_qdio_output_handler, -diff --git a/drivers/s390/net/qeth_l2_sys.c b/drivers/s390/net/qeth_l2_sys.c -index 692db49e3d2a..a48ed9e7e168 100644 ---- a/drivers/s390/net/qeth_l2_sys.c -+++ b/drivers/s390/net/qeth_l2_sys.c -@@ -272,3 +272,11 @@ void qeth_l2_setup_bridgeport_attrs(struct qeth_card *card) - } else - qeth_bridgeport_an_set(card, 0); - } -+ -+const struct attribute_group *qeth_l2_attr_groups[] = { -+ &qeth_device_attr_group, -+ &qeth_device_blkt_group, -+ /* l2 specific, see l2_{create,remove}_device_attributes(): */ -+ &qeth_l2_bridgeport_attr_group, -+ NULL, -+}; -diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c -index cc4d3c3d8cc5..285fe0b2c753 100644 ---- a/drivers/s390/net/qeth_l3_main.c -+++ b/drivers/s390/net/qeth_l3_main.c -@@ -3227,8 +3227,11 @@ static int qeth_l3_setup_netdev(struct qeth_card *card) - static int qeth_l3_probe_device(struct ccwgroup_device *gdev) - { - struct qeth_card *card = dev_get_drvdata(&gdev->dev); -+ int rc; - -- qeth_l3_create_device_attributes(&gdev->dev); -+ rc = qeth_l3_create_device_attributes(&gdev->dev); -+ if (rc) -+ return rc; - card->options.layer2 = 0; - card->info.hwtrap = 0; - return 0; -@@ -3519,6 +3522,7 @@ static int qeth_l3_control_event(struct qeth_card *card, - } - - struct qeth_discipline qeth_l3_discipline = { -+ .devtype = &qeth_generic_devtype, - .start_poll = qeth_qdio_start_poll, - .input_handler = (qdio_handler_t *) qeth_qdio_input_handler, - .output_handler = (qdio_handler_t *) qeth_qdio_output_handler, -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 8a5fbdb45cfd..e333029e4b6c 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -4452,6 +4452,7 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - struct MPT3SAS_DEVICE *sas_device_priv_data; - u32 response_code = 0; - unsigned long flags; -+ unsigned int sector_sz; - - mpi_reply = mpt3sas_base_get_reply_virt_addr(ioc, reply); - scmd = _scsih_scsi_lookup_get_clear(ioc, smid); -@@ -4510,6 +4511,20 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - } - - xfer_cnt = le32_to_cpu(mpi_reply->TransferCount); -+ -+ /* In case of bogus fw or device, we could end up having -+ * unaligned partial completion. We can force alignment here, -+ * then scsi-ml does not need to handle this misbehavior. -+ */ -+ sector_sz = scmd->device->sector_size; -+ if (unlikely(scmd->request->cmd_type == REQ_TYPE_FS && sector_sz && -+ xfer_cnt % sector_sz)) { -+ sdev_printk(KERN_INFO, scmd->device, -+ "unaligned partial completion avoided (xfer_cnt=%u, sector_sz=%u)\n", -+ xfer_cnt, sector_sz); -+ xfer_cnt = round_down(xfer_cnt, sector_sz); -+ } -+ - scsi_set_resid(scmd, scsi_bufflen(scmd) - xfer_cnt); - if (ioc_status & MPI2_IOCSTATUS_FLAG_LOG_INFO_AVAILABLE) - log_info = le32_to_cpu(mpi_reply->IOCLogInfo); -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index 119c2422aac7..75884aecf920 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -2179,8 +2179,10 @@ xfs_bmap_add_extent_delay_real( - } - temp = xfs_bmap_worst_indlen(bma->ip, temp); - temp2 = xfs_bmap_worst_indlen(bma->ip, temp2); -- diff = (int)(temp + temp2 - startblockval(PREV.br_startblock) - -- (bma->cur ? bma->cur->bc_private.b.allocated : 0)); -+ diff = (int)(temp + temp2 - -+ (startblockval(PREV.br_startblock) - -+ (bma->cur ? -+ bma->cur->bc_private.b.allocated : 0))); - if (diff > 0) { - error = xfs_mod_fdblocks(bma->ip->i_mount, - -((int64_t)diff), false); -@@ -2232,7 +2234,6 @@ xfs_bmap_add_extent_delay_real( - temp = da_new; - if (bma->cur) - temp += bma->cur->bc_private.b.allocated; -- ASSERT(temp <= da_old); - if (temp < da_old) - xfs_mod_fdblocks(bma->ip->i_mount, - (int64_t)(da_old - temp), false); -diff --git a/fs/xfs/libxfs/xfs_btree.c b/fs/xfs/libxfs/xfs_btree.c -index af1bbee5586e..28bc5e78b110 100644 ---- a/fs/xfs/libxfs/xfs_btree.c -+++ b/fs/xfs/libxfs/xfs_btree.c -@@ -4064,7 +4064,7 @@ xfs_btree_change_owner( - xfs_btree_readahead_ptr(cur, ptr, 1); - - /* save for the next iteration of the loop */ -- lptr = *ptr; -+ xfs_btree_copy_ptrs(cur, &lptr, ptr, 1); - } - - /* for each buffer in the level */ -diff --git a/fs/xfs/xfs_attr.h b/fs/xfs/xfs_attr.h -index dd4824589470..234331227c0c 100644 ---- a/fs/xfs/xfs_attr.h -+++ b/fs/xfs/xfs_attr.h -@@ -112,6 +112,7 @@ typedef struct attrlist_cursor_kern { - *========================================================================*/ - - -+/* Return 0 on success, or -errno; other state communicated via *context */ - typedef int (*put_listent_func_t)(struct xfs_attr_list_context *, int, - unsigned char *, int, int, unsigned char *); - -diff --git a/fs/xfs/xfs_attr_list.c b/fs/xfs/xfs_attr_list.c -index 4fa14820e2e2..c8be331a3196 100644 ---- a/fs/xfs/xfs_attr_list.c -+++ b/fs/xfs/xfs_attr_list.c -@@ -108,16 +108,14 @@ xfs_attr_shortform_list(xfs_attr_list_context_t *context) - (int)sfe->namelen, - (int)sfe->valuelen, - &sfe->nameval[sfe->namelen]); -- -+ if (error) -+ return error; - /* - * Either search callback finished early or - * didn't fit it all in the buffer after all. - */ - if (context->seen_enough) - break; -- -- if (error) -- return error; - sfe = XFS_ATTR_SF_NEXTENTRY(sfe); - } - trace_xfs_attr_list_sf_all(context); -@@ -581,7 +579,7 @@ xfs_attr_put_listent( - trace_xfs_attr_list_full(context); - alist->al_more = 1; - context->seen_enough = 1; -- return 1; -+ return 0; - } - - aep = (attrlist_ent_t *)&context->alist[context->firstu]; -diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c -index 832764ee035a..863e1bff403b 100644 ---- a/fs/xfs/xfs_bmap_util.c -+++ b/fs/xfs/xfs_bmap_util.c -@@ -682,7 +682,7 @@ xfs_getbmap( - * extents. - */ - if (map[i].br_startblock == DELAYSTARTBLOCK && -- map[i].br_startoff <= XFS_B_TO_FSB(mp, XFS_ISIZE(ip))) -+ map[i].br_startoff < XFS_B_TO_FSB(mp, XFS_ISIZE(ip))) - ASSERT((iflags & BMV_IF_DELALLOC) != 0); - - if (map[i].br_startblock == HOLESTARTBLOCK && -diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c -index 8146b0cf20ce..dcb70969ff1c 100644 ---- a/fs/xfs/xfs_buf.c -+++ b/fs/xfs/xfs_buf.c -@@ -979,6 +979,8 @@ void - xfs_buf_unlock( - struct xfs_buf *bp) - { -+ ASSERT(xfs_buf_islocked(bp)); -+ - XB_CLEAR_OWNER(bp); - up(&bp->b_sema); - -@@ -1713,6 +1715,28 @@ error: - } - - /* -+ * Cancel a delayed write list. -+ * -+ * Remove each buffer from the list, clear the delwri queue flag and drop the -+ * associated buffer reference. -+ */ -+void -+xfs_buf_delwri_cancel( -+ struct list_head *list) -+{ -+ struct xfs_buf *bp; -+ -+ while (!list_empty(list)) { -+ bp = list_first_entry(list, struct xfs_buf, b_list); -+ -+ xfs_buf_lock(bp); -+ bp->b_flags &= ~_XBF_DELWRI_Q; -+ list_del_init(&bp->b_list); -+ xfs_buf_relse(bp); -+ } -+} -+ -+/* - * Add a buffer to the delayed write list. - * - * This queues a buffer for writeout if it hasn't already been. Note that -diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h -index c75721acd867..149bbd451731 100644 ---- a/fs/xfs/xfs_buf.h -+++ b/fs/xfs/xfs_buf.h -@@ -304,6 +304,7 @@ extern void xfs_buf_iomove(xfs_buf_t *, size_t, size_t, void *, - extern void *xfs_buf_offset(struct xfs_buf *, size_t); - - /* Delayed Write Buffer Routines */ -+extern void xfs_buf_delwri_cancel(struct list_head *); - extern bool xfs_buf_delwri_queue(struct xfs_buf *, struct list_head *); - extern int xfs_buf_delwri_submit(struct list_head *); - extern int xfs_buf_delwri_submit_nowait(struct list_head *); -diff --git a/fs/xfs/xfs_dir2_readdir.c b/fs/xfs/xfs_dir2_readdir.c -index 642d55d10075..2fbf643fa10a 100644 ---- a/fs/xfs/xfs_dir2_readdir.c -+++ b/fs/xfs/xfs_dir2_readdir.c -@@ -406,6 +406,7 @@ xfs_dir2_leaf_readbuf( - - /* - * Do we need more readahead? -+ * Each loop tries to process 1 full dir blk; last may be partial. - */ - blk_start_plug(&plug); - for (mip->ra_index = mip->ra_offset = i = 0; -@@ -416,7 +417,8 @@ xfs_dir2_leaf_readbuf( - * Read-ahead a contiguous directory block. - */ - if (i > mip->ra_current && -- map[mip->ra_index].br_blockcount >= geo->fsbcount) { -+ (map[mip->ra_index].br_blockcount - mip->ra_offset) >= -+ geo->fsbcount) { - xfs_dir3_data_readahead(dp, - map[mip->ra_index].br_startoff + mip->ra_offset, - XFS_FSB_TO_DADDR(dp->i_mount, -@@ -437,14 +439,19 @@ xfs_dir2_leaf_readbuf( - } - - /* -- * Advance offset through the mapping table. -+ * Advance offset through the mapping table, processing a full -+ * dir block even if it is fragmented into several extents. -+ * But stop if we have consumed all valid mappings, even if -+ * it's not yet a full directory block. - */ -- for (j = 0; j < geo->fsbcount; j += length ) { -+ for (j = 0; -+ j < geo->fsbcount && mip->ra_index < mip->map_valid; -+ j += length ) { - /* - * The rest of this extent but not more than a dir - * block. - */ -- length = min_t(int, geo->fsbcount, -+ length = min_t(int, geo->fsbcount - j, - map[mip->ra_index].br_blockcount - - mip->ra_offset); - mip->ra_offset += length; -diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c -index f5392ab2def1..ceea444dafb4 100644 ---- a/fs/xfs/xfs_file.c -+++ b/fs/xfs/xfs_file.c -@@ -1208,7 +1208,7 @@ xfs_find_get_desired_pgoff( - unsigned nr_pages; - unsigned int i; - -- want = min_t(pgoff_t, end - index, PAGEVEC_SIZE); -+ want = min_t(pgoff_t, end - index, PAGEVEC_SIZE - 1) + 1; - nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index, - want); - /* -@@ -1235,17 +1235,6 @@ xfs_find_get_desired_pgoff( - break; - } - -- /* -- * At lease we found one page. If this is the first time we -- * step into the loop, and if the first page index offset is -- * greater than the given search offset, a hole was found. -- */ -- if (type == HOLE_OFF && lastoff == startoff && -- lastoff < page_offset(pvec.pages[0])) { -- found = true; -- break; -- } -- - for (i = 0; i < nr_pages; i++) { - struct page *page = pvec.pages[i]; - loff_t b_offset; -@@ -1257,18 +1246,18 @@ xfs_find_get_desired_pgoff( - * file mapping. However, page->index will not change - * because we have a reference on the page. - * -- * Searching done if the page index is out of range. -- * If the current offset is not reaches the end of -- * the specified search range, there should be a hole -- * between them. -+ * If current page offset is beyond where we've ended, -+ * we've found a hole. - */ -- if (page->index > end) { -- if (type == HOLE_OFF && lastoff < endoff) { -- *offset = lastoff; -- found = true; -- } -+ if (type == HOLE_OFF && lastoff < endoff && -+ lastoff < page_offset(pvec.pages[i])) { -+ found = true; -+ *offset = lastoff; - goto out; - } -+ /* Searching done if the page index is out of range. */ -+ if (page->index > end) -+ goto out; - - lock_page(page); - /* -diff --git a/fs/xfs/xfs_icache.c b/fs/xfs/xfs_icache.c -index d7a490f24ead..adbc1f59969a 100644 ---- a/fs/xfs/xfs_icache.c -+++ b/fs/xfs/xfs_icache.c -@@ -210,14 +210,17 @@ xfs_iget_cache_hit( - - error = inode_init_always(mp->m_super, inode); - if (error) { -+ bool wake; - /* - * Re-initializing the inode failed, and we are in deep - * trouble. Try to re-add it to the reclaim list. - */ - rcu_read_lock(); - spin_lock(&ip->i_flags_lock); -- -+ wake = !!__xfs_iflags_test(ip, XFS_INEW); - ip->i_flags &= ~(XFS_INEW | XFS_IRECLAIM); -+ if (wake) -+ wake_up_bit(&ip->i_flags, __XFS_INEW_BIT); - ASSERT(ip->i_flags & XFS_IRECLAIMABLE); - trace_xfs_iget_reclaim_fail(ip); - goto out_error; -@@ -363,6 +366,22 @@ out_destroy: - return error; - } - -+static void -+xfs_inew_wait( -+ struct xfs_inode *ip) -+{ -+ wait_queue_head_t *wq = bit_waitqueue(&ip->i_flags, __XFS_INEW_BIT); -+ DEFINE_WAIT_BIT(wait, &ip->i_flags, __XFS_INEW_BIT); -+ -+ do { -+ prepare_to_wait(wq, &wait.wait, TASK_UNINTERRUPTIBLE); -+ if (!xfs_iflags_test(ip, XFS_INEW)) -+ break; -+ schedule(); -+ } while (true); -+ finish_wait(wq, &wait.wait); -+} -+ - /* - * Look up an inode by number in the given file system. - * The inode is looked up in the cache held in each AG. -@@ -467,9 +486,11 @@ out_error_or_again: - - STATIC int - xfs_inode_ag_walk_grab( -- struct xfs_inode *ip) -+ struct xfs_inode *ip, -+ int flags) - { - struct inode *inode = VFS_I(ip); -+ bool newinos = !!(flags & XFS_AGITER_INEW_WAIT); - - ASSERT(rcu_read_lock_held()); - -@@ -487,7 +508,8 @@ xfs_inode_ag_walk_grab( - goto out_unlock_noent; - - /* avoid new or reclaimable inodes. Leave for reclaim code to flush */ -- if (__xfs_iflags_test(ip, XFS_INEW | XFS_IRECLAIMABLE | XFS_IRECLAIM)) -+ if ((!newinos && __xfs_iflags_test(ip, XFS_INEW)) || -+ __xfs_iflags_test(ip, XFS_IRECLAIMABLE | XFS_IRECLAIM)) - goto out_unlock_noent; - spin_unlock(&ip->i_flags_lock); - -@@ -515,7 +537,8 @@ xfs_inode_ag_walk( - void *args), - int flags, - void *args, -- int tag) -+ int tag, -+ int iter_flags) - { - uint32_t first_index; - int last_error = 0; -@@ -557,7 +580,7 @@ restart: - for (i = 0; i < nr_found; i++) { - struct xfs_inode *ip = batch[i]; - -- if (done || xfs_inode_ag_walk_grab(ip)) -+ if (done || xfs_inode_ag_walk_grab(ip, iter_flags)) - batch[i] = NULL; - - /* -@@ -585,6 +608,9 @@ restart: - for (i = 0; i < nr_found; i++) { - if (!batch[i]) - continue; -+ if ((iter_flags & XFS_AGITER_INEW_WAIT) && -+ xfs_iflags_test(batch[i], XFS_INEW)) -+ xfs_inew_wait(batch[i]); - error = execute(batch[i], flags, args); - IRELE(batch[i]); - if (error == -EAGAIN) { -@@ -637,12 +663,13 @@ xfs_eofblocks_worker( - } - - int --xfs_inode_ag_iterator( -+xfs_inode_ag_iterator_flags( - struct xfs_mount *mp, - int (*execute)(struct xfs_inode *ip, int flags, - void *args), - int flags, -- void *args) -+ void *args, -+ int iter_flags) - { - struct xfs_perag *pag; - int error = 0; -@@ -652,7 +679,8 @@ xfs_inode_ag_iterator( - ag = 0; - while ((pag = xfs_perag_get(mp, ag))) { - ag = pag->pag_agno + 1; -- error = xfs_inode_ag_walk(mp, pag, execute, flags, args, -1); -+ error = xfs_inode_ag_walk(mp, pag, execute, flags, args, -1, -+ iter_flags); - xfs_perag_put(pag); - if (error) { - last_error = error; -@@ -664,6 +692,17 @@ xfs_inode_ag_iterator( - } - - int -+xfs_inode_ag_iterator( -+ struct xfs_mount *mp, -+ int (*execute)(struct xfs_inode *ip, int flags, -+ void *args), -+ int flags, -+ void *args) -+{ -+ return xfs_inode_ag_iterator_flags(mp, execute, flags, args, 0); -+} -+ -+int - xfs_inode_ag_iterator_tag( - struct xfs_mount *mp, - int (*execute)(struct xfs_inode *ip, int flags, -@@ -680,7 +719,8 @@ xfs_inode_ag_iterator_tag( - ag = 0; - while ((pag = xfs_perag_get_tag(mp, ag, tag))) { - ag = pag->pag_agno + 1; -- error = xfs_inode_ag_walk(mp, pag, execute, flags, args, tag); -+ error = xfs_inode_ag_walk(mp, pag, execute, flags, args, tag, -+ 0); - xfs_perag_put(pag); - if (error) { - last_error = error; -diff --git a/fs/xfs/xfs_icache.h b/fs/xfs/xfs_icache.h -index 62f1f91c32cb..147a79212e63 100644 ---- a/fs/xfs/xfs_icache.h -+++ b/fs/xfs/xfs_icache.h -@@ -48,6 +48,11 @@ struct xfs_eofblocks { - #define XFS_IGET_UNTRUSTED 0x2 - #define XFS_IGET_DONTCACHE 0x4 - -+/* -+ * flags for AG inode iterator -+ */ -+#define XFS_AGITER_INEW_WAIT 0x1 /* wait on new inodes */ -+ - int xfs_iget(struct xfs_mount *mp, struct xfs_trans *tp, xfs_ino_t ino, - uint flags, uint lock_flags, xfs_inode_t **ipp); - -@@ -72,6 +77,9 @@ void xfs_eofblocks_worker(struct work_struct *); - int xfs_inode_ag_iterator(struct xfs_mount *mp, - int (*execute)(struct xfs_inode *ip, int flags, void *args), - int flags, void *args); -+int xfs_inode_ag_iterator_flags(struct xfs_mount *mp, -+ int (*execute)(struct xfs_inode *ip, int flags, void *args), -+ int flags, void *args, int iter_flags); - int xfs_inode_ag_iterator_tag(struct xfs_mount *mp, - int (*execute)(struct xfs_inode *ip, int flags, void *args), - int flags, void *args, int tag); -diff --git a/fs/xfs/xfs_inode.h b/fs/xfs/xfs_inode.h -index ca9e11989cbd..ae1a49845744 100644 ---- a/fs/xfs/xfs_inode.h -+++ b/fs/xfs/xfs_inode.h -@@ -208,7 +208,8 @@ xfs_get_initial_prid(struct xfs_inode *dp) - #define XFS_IRECLAIM (1 << 0) /* started reclaiming this inode */ - #define XFS_ISTALE (1 << 1) /* inode has been staled */ - #define XFS_IRECLAIMABLE (1 << 2) /* inode can be reclaimed */ --#define XFS_INEW (1 << 3) /* inode has just been allocated */ -+#define __XFS_INEW_BIT 3 /* inode has just been allocated */ -+#define XFS_INEW (1 << __XFS_INEW_BIT) - #define XFS_ITRUNCATED (1 << 5) /* truncated down so flush-on-close */ - #define XFS_IDIRTY_RELEASE (1 << 6) /* dirty release already seen */ - #define __XFS_IFLOCK_BIT 7 /* inode is being flushed right now */ -@@ -453,6 +454,7 @@ static inline void xfs_finish_inode_setup(struct xfs_inode *ip) - xfs_iflags_clear(ip, XFS_INEW); - barrier(); - unlock_new_inode(VFS_I(ip)); -+ wake_up_bit(&ip->i_flags, __XFS_INEW_BIT); - } - - static inline void xfs_setup_existing_inode(struct xfs_inode *ip) -diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c -index d42738deec6d..e4a4f82ea13f 100644 ---- a/fs/xfs/xfs_ioctl.c -+++ b/fs/xfs/xfs_ioctl.c -@@ -403,6 +403,7 @@ xfs_attrlist_by_handle( - { - int error = -ENOMEM; - attrlist_cursor_kern_t *cursor; -+ struct xfs_fsop_attrlist_handlereq __user *p = arg; - xfs_fsop_attrlist_handlereq_t al_hreq; - struct dentry *dentry; - char *kbuf; -@@ -435,6 +436,11 @@ xfs_attrlist_by_handle( - if (error) - goto out_kfree; - -+ if (copy_to_user(&p->pos, cursor, sizeof(attrlist_cursor_kern_t))) { -+ error = -EFAULT; -+ goto out_kfree; -+ } -+ - if (copy_to_user(al_hreq.buffer, kbuf, al_hreq.buflen)) - error = -EFAULT; - -@@ -1379,10 +1385,11 @@ xfs_ioc_getbmap( - unsigned int cmd, - void __user *arg) - { -- struct getbmapx bmx; -+ struct getbmapx bmx = { 0 }; - int error; - -- if (copy_from_user(&bmx, arg, sizeof(struct getbmapx))) -+ /* struct getbmap is a strict subset of struct getbmapx. */ -+ if (copy_from_user(&bmx, arg, offsetof(struct getbmapx, bmv_iflags))) - return -EFAULT; - - if (bmx.bmv_count < 2) -diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c -index 532ab79d38fe..572b64a135b3 100644 ---- a/fs/xfs/xfs_qm.c -+++ b/fs/xfs/xfs_qm.c -@@ -1355,12 +1355,7 @@ xfs_qm_quotacheck( - mp->m_qflags |= flags; - - error_return: -- while (!list_empty(&buffer_list)) { -- struct xfs_buf *bp = -- list_first_entry(&buffer_list, struct xfs_buf, b_list); -- list_del_init(&bp->b_list); -- xfs_buf_relse(bp); -- } -+ xfs_buf_delwri_cancel(&buffer_list); - - if (error) { - xfs_warn(mp, -diff --git a/fs/xfs/xfs_qm_syscalls.c b/fs/xfs/xfs_qm_syscalls.c -index 3640c6e896af..4d334440bd94 100644 ---- a/fs/xfs/xfs_qm_syscalls.c -+++ b/fs/xfs/xfs_qm_syscalls.c -@@ -764,5 +764,6 @@ xfs_qm_dqrele_all_inodes( - uint flags) - { - ASSERT(mp->m_quotainfo); -- xfs_inode_ag_iterator(mp, xfs_dqrele_inode, flags, NULL); -+ xfs_inode_ag_iterator_flags(mp, xfs_dqrele_inode, flags, NULL, -+ XFS_AGITER_INEW_WAIT); - } -diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c -index 839b35ca21c6..e6dae28dfa1a 100644 ---- a/fs/xfs/xfs_xattr.c -+++ b/fs/xfs/xfs_xattr.c -@@ -180,7 +180,7 @@ xfs_xattr_put_listent( - arraytop = context->count + prefix_len + namelen + 1; - if (arraytop > context->firstu) { - context->count = -1; /* insufficient space */ -- return 1; -+ return 0; - } - offset = (char *)context->alist + context->count; - strncpy(offset, xfs_xattr_prefix(flags), prefix_len); -@@ -222,12 +222,15 @@ list_one_attr(const char *name, const size_t len, void *data, - } - - ssize_t --xfs_vn_listxattr(struct dentry *dentry, char *data, size_t size) -+xfs_vn_listxattr( -+ struct dentry *dentry, -+ char *data, -+ size_t size) - { - struct xfs_attr_list_context context; - struct attrlist_cursor_kern cursor = { 0 }; -- struct inode *inode = d_inode(dentry); -- int error; -+ struct inode *inode = d_inode(dentry); -+ int error; - - /* - * First read the regular on-disk attributes. -@@ -245,7 +248,9 @@ xfs_vn_listxattr(struct dentry *dentry, char *data, size_t size) - else - context.put_listent = xfs_xattr_put_listent_sizes; - -- xfs_attr_list_int(&context); -+ error = xfs_attr_list_int(&context); -+ if (error) -+ return error; - if (context.count < 0) - return -ERANGE; - -diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h -index 67ce5bd3b56a..19db03dbbd00 100644 ---- a/include/linux/if_vlan.h -+++ b/include/linux/if_vlan.h -@@ -616,15 +616,16 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb) - static inline netdev_features_t vlan_features_check(const struct sk_buff *skb, - netdev_features_t features) - { -- if (skb_vlan_tagged_multi(skb)) -- features = netdev_intersect_features(features, -- NETIF_F_SG | -- NETIF_F_HIGHDMA | -- NETIF_F_FRAGLIST | -- NETIF_F_GEN_CSUM | -- NETIF_F_HW_VLAN_CTAG_TX | -- NETIF_F_HW_VLAN_STAG_TX); -- -+ if (skb_vlan_tagged_multi(skb)) { -+ /* In the case of multi-tagged packets, use a direct mask -+ * instead of using netdev_interesect_features(), to make -+ * sure that only devices supporting NETIF_F_HW_CSUM will -+ * have checksum offloading support. -+ */ -+ features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_HW_CSUM | -+ NETIF_F_FRAGLIST | NETIF_F_HW_VLAN_CTAG_TX | -+ NETIF_F_HW_VLAN_STAG_TX; -+ } - return features; - } - -diff --git a/include/net/dst.h b/include/net/dst.h -index c7329dcd90cc..e4f450617919 100644 ---- a/include/net/dst.h -+++ b/include/net/dst.h -@@ -110,10 +110,16 @@ struct dst_entry { - }; - }; - -+struct dst_metrics { -+ u32 metrics[RTAX_MAX]; -+ atomic_t refcnt; -+}; -+extern const struct dst_metrics dst_default_metrics; -+ - u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old); --extern const u32 dst_default_metrics[]; - - #define DST_METRICS_READ_ONLY 0x1UL -+#define DST_METRICS_REFCOUNTED 0x2UL - #define DST_METRICS_FLAGS 0x3UL - #define __DST_METRICS_PTR(Y) \ - ((u32 *)((Y) & ~DST_METRICS_FLAGS)) -diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h -index 3f98233388fb..bda1721e9622 100644 ---- a/include/net/ip_fib.h -+++ b/include/net/ip_fib.h -@@ -112,11 +112,11 @@ struct fib_info { - unsigned char fib_type; - __be32 fib_prefsrc; - u32 fib_priority; -- u32 *fib_metrics; --#define fib_mtu fib_metrics[RTAX_MTU-1] --#define fib_window fib_metrics[RTAX_WINDOW-1] --#define fib_rtt fib_metrics[RTAX_RTT-1] --#define fib_advmss fib_metrics[RTAX_ADVMSS-1] -+ struct dst_metrics *fib_metrics; -+#define fib_mtu fib_metrics->metrics[RTAX_MTU-1] -+#define fib_window fib_metrics->metrics[RTAX_WINDOW-1] -+#define fib_rtt fib_metrics->metrics[RTAX_RTT-1] -+#define fib_advmss fib_metrics->metrics[RTAX_ADVMSS-1] - int fib_nhs; - #ifdef CONFIG_IP_ROUTE_MULTIPATH - int fib_weight; -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 750b7893ee3a..43aee7ab143e 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1619,12 +1619,8 @@ static int soft_offline_huge_page(struct page *page, int flags) - if (ret) { - pr_info("soft offline: %#lx: migration failed %d, type %lx\n", - pfn, ret, page->flags); -- /* -- * We know that soft_offline_huge_page() tries to migrate -- * only one hugepage pointed to by hpage, so we need not -- * run through the pagelist here. -- */ -- putback_active_hugepage(hpage); -+ if (!list_empty(&pagelist)) -+ putback_movable_pages(&pagelist); - if (ret > 0) - ret = -EIO; - } else { -diff --git a/mm/mlock.c b/mm/mlock.c -index d6006b146fea..9d2e773f3a95 100644 ---- a/mm/mlock.c -+++ b/mm/mlock.c -@@ -277,7 +277,7 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone) - { - int i; - int nr = pagevec_count(pvec); -- int delta_munlocked; -+ int delta_munlocked = -nr; - struct pagevec pvec_putback; - int pgrescued = 0; - -@@ -297,6 +297,8 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone) - continue; - else - __munlock_isolation_failed(page); -+ } else { -+ delta_munlocked++; - } - - /* -@@ -308,7 +310,6 @@ static void __munlock_pagevec(struct pagevec *pvec, struct zone *zone) - pagevec_add(&pvec_putback, pvec->pages[i]); - pvec->pages[i] = NULL; - } -- delta_munlocked = -nr + pagevec_count(&pvec_putback); - __mod_zone_page_state(zone, NR_MLOCK, delta_munlocked); - spin_unlock_irq(&zone->lru_lock); - -diff --git a/mm/slub.c b/mm/slub.c -index 65d5f92d51d2..4cf3a9c768b1 100644 ---- a/mm/slub.c -+++ b/mm/slub.c -@@ -5261,6 +5261,7 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) - char mbuf[64]; - char *buf; - struct slab_attribute *attr = to_slab_attr(slab_attrs[i]); -+ ssize_t len; - - if (!attr || !attr->store || !attr->show) - continue; -@@ -5285,8 +5286,9 @@ static void memcg_propagate_slab_attrs(struct kmem_cache *s) - buf = buffer; - } - -- attr->show(root_cache, buf); -- attr->store(s, buf, strlen(buf)); -+ len = attr->show(root_cache, buf); -+ if (len > 0) -+ attr->store(s, buf, len); - } - - if (buffer) -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index 413d18e37083..ff8bb41d713f 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -768,6 +768,13 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[]) - return -EPROTONOSUPPORT; - } - } -+ -+ if (data[IFLA_BR_VLAN_DEFAULT_PVID]) { -+ __u16 defpvid = nla_get_u16(data[IFLA_BR_VLAN_DEFAULT_PVID]); -+ -+ if (defpvid >= VLAN_VID_MASK) -+ return -EINVAL; -+ } - #endif - - return 0; -diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c -index 8a7ada8bb947..57be733a99bc 100644 ---- a/net/bridge/br_stp_if.c -+++ b/net/bridge/br_stp_if.c -@@ -166,6 +166,7 @@ static void br_stp_start(struct net_bridge *br) - br_debug(br, "using kernel STP\n"); - - /* To start timers on any ports left in blocking */ -+ mod_timer(&br->hello_timer, jiffies + br->hello_time); - br_port_state_selection(br); - } - -diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c -index 5f0f5af0ec35..7dbe6a5c31eb 100644 ---- a/net/bridge/br_stp_timer.c -+++ b/net/bridge/br_stp_timer.c -@@ -40,7 +40,7 @@ static void br_hello_timer_expired(unsigned long arg) - if (br->dev->flags & IFF_UP) { - br_config_bpdu_generation(br); - -- if (br->stp_enabled != BR_USER_STP) -+ if (br->stp_enabled == BR_KERNEL_STP) - mod_timer(&br->hello_timer, - round_jiffies(jiffies + br->hello_time)); - } -diff --git a/net/core/dst.c b/net/core/dst.c -index a1656e3b8d72..d7ad628bf64e 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -151,13 +151,13 @@ int dst_discard_out(struct net *net, struct sock *sk, struct sk_buff *skb) - } - EXPORT_SYMBOL(dst_discard_out); - --const u32 dst_default_metrics[RTAX_MAX + 1] = { -+const struct dst_metrics dst_default_metrics = { - /* This initializer is needed to force linker to place this variable - * into const section. Otherwise it might end into bss section. - * We really want to avoid false sharing on this variable, and catch - * any writes on it. - */ -- [RTAX_MAX] = 0xdeadbeef, -+ .refcnt = ATOMIC_INIT(1), - }; - - void dst_init(struct dst_entry *dst, struct dst_ops *ops, -@@ -169,7 +169,7 @@ void dst_init(struct dst_entry *dst, struct dst_ops *ops, - if (dev) - dev_hold(dev); - dst->ops = ops; -- dst_init_metrics(dst, dst_default_metrics, true); -+ dst_init_metrics(dst, dst_default_metrics.metrics, true); - dst->expires = 0UL; - dst->path = dst; - dst->from = NULL; -@@ -315,25 +315,30 @@ EXPORT_SYMBOL(dst_release); - - u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old) - { -- u32 *p = kmalloc(sizeof(u32) * RTAX_MAX, GFP_ATOMIC); -+ struct dst_metrics *p = kmalloc(sizeof(*p), GFP_ATOMIC); - - if (p) { -- u32 *old_p = __DST_METRICS_PTR(old); -+ struct dst_metrics *old_p = (struct dst_metrics *)__DST_METRICS_PTR(old); - unsigned long prev, new; - -- memcpy(p, old_p, sizeof(u32) * RTAX_MAX); -+ atomic_set(&p->refcnt, 1); -+ memcpy(p->metrics, old_p->metrics, sizeof(p->metrics)); - - new = (unsigned long) p; - prev = cmpxchg(&dst->_metrics, old, new); - - if (prev != old) { - kfree(p); -- p = __DST_METRICS_PTR(prev); -+ p = (struct dst_metrics *)__DST_METRICS_PTR(prev); - if (prev & DST_METRICS_READ_ONLY) - p = NULL; -+ } else if (prev & DST_METRICS_REFCOUNTED) { -+ if (atomic_dec_and_test(&old_p->refcnt)) -+ kfree(old_p); - } - } -- return p; -+ BUILD_BUG_ON(offsetof(struct dst_metrics, metrics) != 0); -+ return (u32 *)p; - } - EXPORT_SYMBOL(dst_cow_metrics_generic); - -@@ -342,7 +347,7 @@ void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old) - { - unsigned long prev, new; - -- new = ((unsigned long) dst_default_metrics) | DST_METRICS_READ_ONLY; -+ new = ((unsigned long) &dst_default_metrics) | DST_METRICS_READ_ONLY; - prev = cmpxchg(&dst->_metrics, old, new); - if (prev == old) - kfree(__DST_METRICS_PTR(old)); -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index fe38ef58997c..d43544ce7550 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1458,13 +1458,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) - cb->nlh->nlmsg_seq, 0, - NLM_F_MULTI, - ext_filter_mask); -- /* If we ran out of room on the first message, -- * we're in trouble -- */ -- WARN_ON((err == -EMSGSIZE) && (skb->len == 0)); - -- if (err < 0) -- goto out; -+ if (err < 0) { -+ if (likely(skb->len)) -+ goto out; -+ -+ goto out_err; -+ } - - nl_dump_check_consistent(cb, nlmsg_hdr(skb)); - cont: -@@ -1472,10 +1472,12 @@ cont: - } - } - out: -+ err = skb->len; -+out_err: - cb->args[1] = idx; - cb->args[0] = h; - -- return skb->len; -+ return err; - } - - int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len) -@@ -3127,8 +3129,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb) - err = br_dev->netdev_ops->ndo_bridge_getlink( - skb, portid, seq, dev, - filter_mask, NLM_F_MULTI); -- if (err < 0 && err != -EOPNOTSUPP) -- break; -+ if (err < 0 && err != -EOPNOTSUPP) { -+ if (likely(skb->len)) -+ break; -+ -+ goto out_err; -+ } - } - idx++; - } -@@ -3139,16 +3145,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb) - seq, dev, - filter_mask, - NLM_F_MULTI); -- if (err < 0 && err != -EOPNOTSUPP) -- break; -+ if (err < 0 && err != -EOPNOTSUPP) { -+ if (likely(skb->len)) -+ break; -+ -+ goto out_err; -+ } - } - idx++; - } - } -+ err = skb->len; -+out_err: - rcu_read_unlock(); - cb->args[0] = idx; - -- return skb->len; -+ return err; - } - - static inline size_t bridge_nlmsg_size(void) -diff --git a/net/core/sock.c b/net/core/sock.c -index 9c708a5fb751..bd2fad27891e 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1690,17 +1690,17 @@ EXPORT_SYMBOL(skb_set_owner_w); - - void skb_orphan_partial(struct sk_buff *skb) - { -- /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc, -- * so we do not completely orphan skb, but transfert all -- * accounted bytes but one, to avoid unexpected reorders. -- */ - if (skb->destructor == sock_wfree - #ifdef CONFIG_INET - || skb->destructor == tcp_wfree - #endif - ) { -- atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc); -- skb->truesize = 1; -+ struct sock *sk = skb->sk; -+ -+ if (atomic_inc_not_zero(&sk->sk_refcnt)) { -+ atomic_sub(skb->truesize, &sk->sk_wmem_alloc); -+ skb->destructor = sock_efree; -+ } - } else { - skb_orphan(skb); - } -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 8113ad58fcb4..3470ad1843bb 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -422,6 +422,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, - newsk->sk_backlog_rcv = dccp_v4_do_rcv; - newnp->pktoptions = NULL; - newnp->opt = NULL; -+ newnp->ipv6_mc_list = NULL; -+ newnp->ipv6_ac_list = NULL; -+ newnp->ipv6_fl_list = NULL; - newnp->mcast_oif = inet6_iif(skb); - newnp->mcast_hops = ipv6_hdr(skb)->hop_limit; - -@@ -486,6 +489,9 @@ static struct sock *dccp_v6_request_recv_sock(const struct sock *sk, - /* Clone RX bits */ - newnp->rxopt.all = np->rxopt.all; - -+ newnp->ipv6_mc_list = NULL; -+ newnp->ipv6_ac_list = NULL; -+ newnp->ipv6_fl_list = NULL; - newnp->pktoptions = NULL; - newnp->opt = NULL; - newnp->mcast_oif = inet6_iif(skb); -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 1adba44f8fbc..66dcb529fd9c 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -757,7 +757,7 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) - unsigned int e = 0, s_e; - struct fib_table *tb; - struct hlist_head *head; -- int dumped = 0; -+ int dumped = 0, err; - - if (nlmsg_len(cb->nlh) >= sizeof(struct rtmsg) && - ((struct rtmsg *) nlmsg_data(cb->nlh))->rtm_flags & RTM_F_CLONED) -@@ -777,20 +777,27 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) - if (dumped) - memset(&cb->args[2], 0, sizeof(cb->args) - - 2 * sizeof(cb->args[0])); -- if (fib_table_dump(tb, skb, cb) < 0) -- goto out; -+ err = fib_table_dump(tb, skb, cb); -+ if (err < 0) { -+ if (likely(skb->len)) -+ goto out; -+ -+ goto out_err; -+ } - dumped = 1; - next: - e++; - } - } - out: -+ err = skb->len; -+out_err: - rcu_read_unlock(); - - cb->args[1] = e; - cb->args[0] = h; - -- return skb->len; -+ return err; - } - - /* Prepare and feed intra-kernel routing request. -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index 67d44aa9e09f..b2504712259f 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -204,6 +204,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp) - static void free_fib_info_rcu(struct rcu_head *head) - { - struct fib_info *fi = container_of(head, struct fib_info, rcu); -+ struct dst_metrics *m; - - change_nexthops(fi) { - if (nexthop_nh->nh_dev) -@@ -214,8 +215,9 @@ static void free_fib_info_rcu(struct rcu_head *head) - rt_fibinfo_free(&nexthop_nh->nh_rth_input); - } endfor_nexthops(fi); - -- if (fi->fib_metrics != (u32 *) dst_default_metrics) -- kfree(fi->fib_metrics); -+ m = fi->fib_metrics; -+ if (m != &dst_default_metrics && atomic_dec_and_test(&m->refcnt)) -+ kfree(m); - kfree(fi); - } - -@@ -982,11 +984,11 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) - val = 255; - if (type == RTAX_FEATURES && (val & ~RTAX_FEATURE_MASK)) - return -EINVAL; -- fi->fib_metrics[type - 1] = val; -+ fi->fib_metrics->metrics[type - 1] = val; - } - - if (ecn_ca) -- fi->fib_metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA; -+ fi->fib_metrics->metrics[RTAX_FEATURES - 1] |= DST_FEATURE_ECN_CA; - - return 0; - } -@@ -1044,11 +1046,12 @@ struct fib_info *fib_create_info(struct fib_config *cfg) - goto failure; - fib_info_cnt++; - if (cfg->fc_mx) { -- fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL); -+ fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL); - if (!fi->fib_metrics) - goto failure; -+ atomic_set(&fi->fib_metrics->refcnt, 1); - } else -- fi->fib_metrics = (u32 *) dst_default_metrics; -+ fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics; - - fi->fib_net = net; - fi->fib_protocol = cfg->fc_protocol; -@@ -1251,7 +1254,7 @@ int fib_dump_info(struct sk_buff *skb, u32 portid, u32 seq, int event, - if (fi->fib_priority && - nla_put_u32(skb, RTA_PRIORITY, fi->fib_priority)) - goto nla_put_failure; -- if (rtnetlink_put_metrics(skb, fi->fib_metrics) < 0) -+ if (rtnetlink_put_metrics(skb, fi->fib_metrics->metrics) < 0) - goto nla_put_failure; - - if (fi->fib_prefsrc && -diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c -index 7c52afb98c42..5c598f99a500 100644 ---- a/net/ipv4/fib_trie.c -+++ b/net/ipv4/fib_trie.c -@@ -1906,6 +1906,8 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb, - - /* rcu_read_lock is hold by caller */ - hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) { -+ int err; -+ - if (i < s_i) { - i++; - continue; -@@ -1916,17 +1918,14 @@ static int fn_trie_dump_leaf(struct key_vector *l, struct fib_table *tb, - continue; - } - -- if (fib_dump_info(skb, NETLINK_CB(cb->skb).portid, -- cb->nlh->nlmsg_seq, -- RTM_NEWROUTE, -- tb->tb_id, -- fa->fa_type, -- xkey, -- KEYLENGTH - fa->fa_slen, -- fa->fa_tos, -- fa->fa_info, NLM_F_MULTI) < 0) { -+ err = fib_dump_info(skb, NETLINK_CB(cb->skb).portid, -+ cb->nlh->nlmsg_seq, RTM_NEWROUTE, -+ tb->tb_id, fa->fa_type, -+ xkey, KEYLENGTH - fa->fa_slen, -+ fa->fa_tos, fa->fa_info, NLM_F_MULTI); -+ if (err < 0) { - cb->args[4] = i; -- return -1; -+ return err; - } - i++; - } -@@ -1948,10 +1947,13 @@ int fib_table_dump(struct fib_table *tb, struct sk_buff *skb, - t_key key = cb->args[3]; - - while ((l = leaf_walk_rcu(&tp, key)) != NULL) { -- if (fn_trie_dump_leaf(l, tb, skb, cb) < 0) { -+ int err; -+ -+ err = fn_trie_dump_leaf(l, tb, skb, cb); -+ if (err < 0) { - cb->args[3] = key; - cb->args[2] = count; -- return -1; -+ return err; - } - - ++count; -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 64148914803a..45fa2aaa3d3f 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -669,6 +669,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk, - inet_sk(newsk)->inet_sport = htons(inet_rsk(req)->ir_num); - newsk->sk_write_space = sk_stream_write_space; - -+ inet_sk(newsk)->mc_list = NULL; -+ - newsk->sk_mark = inet_rsk(req)->ir_mark; - atomic64_set(&newsk->sk_cookie, - atomic64_read(&inet_rsk(req)->ir_cookie)); -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 375248b900ba..c295d882c6e0 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1356,8 +1356,12 @@ static void rt_add_uncached_list(struct rtable *rt) - - static void ipv4_dst_destroy(struct dst_entry *dst) - { -+ struct dst_metrics *p = (struct dst_metrics *)DST_METRICS_PTR(dst); - struct rtable *rt = (struct rtable *) dst; - -+ if (p != &dst_default_metrics && atomic_dec_and_test(&p->refcnt)) -+ kfree(p); -+ - if (!list_empty(&rt->rt_uncached)) { - struct uncached_list *ul = rt->rt_uncached_list; - -@@ -1409,7 +1413,11 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr, - rt->rt_gateway = nh->nh_gw; - rt->rt_uses_gateway = 1; - } -- dst_init_metrics(&rt->dst, fi->fib_metrics, true); -+ dst_init_metrics(&rt->dst, fi->fib_metrics->metrics, true); -+ if (fi->fib_metrics != &dst_default_metrics) { -+ rt->dst._metrics |= DST_METRICS_REFCOUNTED; -+ atomic_inc(&fi->fib_metrics->refcnt); -+ } - #ifdef CONFIG_IP_ROUTE_CLASSID - rt->dst.tclassid = nh->nh_tclassid; - #endif -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index e1d51370977b..4bd8678329d6 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -1071,9 +1071,12 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, - int *copied, size_t size) - { - struct tcp_sock *tp = tcp_sk(sk); -+ struct sockaddr *uaddr = msg->msg_name; - int err, flags; - -- if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE)) -+ if (!(sysctl_tcp_fastopen & TFO_CLIENT_ENABLE) || -+ (uaddr && msg->msg_namelen >= sizeof(uaddr->sa_family) && -+ uaddr->sa_family == AF_UNSPEC)) - return -EOPNOTSUPP; - if (tp->fastopen_req) - return -EALREADY; /* Another Fast Open is in progress */ -@@ -1086,7 +1089,7 @@ static int tcp_sendmsg_fastopen(struct sock *sk, struct msghdr *msg, - tp->fastopen_req->size = size; - - flags = (msg->msg_flags & MSG_DONTWAIT) ? O_NONBLOCK : 0; -- err = __inet_stream_connect(sk->sk_socket, msg->msg_name, -+ err = __inet_stream_connect(sk->sk_socket, uaddr, - msg->msg_namelen, flags); - *copied = tp->fastopen_req->copied; - tcp_free_fastopen_req(tp); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 818630cec54f..87791f803627 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -1134,13 +1134,14 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb, - */ - if (pkt_len > mss) { - unsigned int new_len = (pkt_len / mss) * mss; -- if (!in_sack && new_len < pkt_len) { -+ if (!in_sack && new_len < pkt_len) - new_len += mss; -- if (new_len >= skb->len) -- return 0; -- } - pkt_len = new_len; - } -+ -+ if (pkt_len >= skb->len && !in_sack) -+ return 0; -+ - err = tcp_fragment(sk, skb, pkt_len, mss, GFP_ATOMIC); - if (err < 0) - return err; -@@ -3219,7 +3220,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets, - int delta; - - /* Non-retransmitted hole got filled? That's reordering */ -- if (reord < prior_fackets) -+ if (reord < prior_fackets && reord <= tp->fackets_out) - tcp_update_reordering(sk, tp->fackets_out - reord, 0); - - delta = tcp_is_fack(tp) ? pkts_acked : -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 225f5f7f26ba..568bc0a52ca1 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -62,7 +62,6 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - const struct net_offload *ops; - int proto; - struct frag_hdr *fptr; -- unsigned int unfrag_ip6hlen; - u8 *prevhdr; - int offset = 0; - bool encap, udpfrag; -@@ -121,8 +120,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - skb->network_header = (u8 *)ipv6h - skb->head; - - if (udpfrag) { -- unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr); -- fptr = (struct frag_hdr *)((u8 *)ipv6h + unfrag_ip6hlen); -+ int err = ip6_find_1stfragopt(skb, &prevhdr); -+ if (err < 0) -+ return ERR_PTR(err); -+ fptr = (struct frag_hdr *)((u8 *)ipv6h + err); - fptr->frag_off = htons(offset); - if (skb->next) - fptr->frag_off |= htons(IP6_MF); -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 8004532fa882..1db17efe36c1 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -571,7 +571,10 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - int ptr, offset = 0, err = 0; - u8 *prevhdr, nexthdr = 0; - -- hlen = ip6_find_1stfragopt(skb, &prevhdr); -+ err = ip6_find_1stfragopt(skb, &prevhdr); -+ if (err < 0) -+ goto fail; -+ hlen = err; - nexthdr = *prevhdr; - - mtu = ip6_skb_dst_mtu(skb); -@@ -1429,6 +1432,11 @@ alloc_new_skb: - */ - alloclen += sizeof(struct frag_hdr); - -+ copy = datalen - transhdrlen - fraggap; -+ if (copy < 0) { -+ err = -EINVAL; -+ goto error; -+ } - if (transhdrlen) { - skb = sock_alloc_send_skb(sk, - alloclen + hh_len, -@@ -1478,13 +1486,9 @@ alloc_new_skb: - data += fraggap; - pskb_trim_unique(skb_prev, maxfraglen); - } -- copy = datalen - transhdrlen - fraggap; -- -- if (copy < 0) { -- err = -EINVAL; -- kfree_skb(skb); -- goto error; -- } else if (copy > 0 && getfrag(from, data + transhdrlen, offset, copy, fraggap, skb) < 0) { -+ if (copy > 0 && -+ getfrag(from, data + transhdrlen, offset, -+ copy, fraggap, skb) < 0) { - err = -EFAULT; - kfree_skb(skb); - goto error; -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 1d184322a7b1..8b56c5240429 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -79,14 +79,13 @@ EXPORT_SYMBOL(ipv6_select_ident); - int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - { - u16 offset = sizeof(struct ipv6hdr); -- struct ipv6_opt_hdr *exthdr = -- (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1); - unsigned int packet_len = skb_tail_pointer(skb) - - skb_network_header(skb); - int found_rhdr = 0; - *nexthdr = &ipv6_hdr(skb)->nexthdr; - -- while (offset + 1 <= packet_len) { -+ while (offset <= packet_len) { -+ struct ipv6_opt_hdr *exthdr; - - switch (**nexthdr) { - -@@ -107,13 +106,16 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - return offset; - } - -- offset += ipv6_optlen(exthdr); -- *nexthdr = &exthdr->nexthdr; -+ if (offset + sizeof(struct ipv6_opt_hdr) > packet_len) -+ return -EINVAL; -+ - exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + - offset); -+ offset += ipv6_optlen(exthdr); -+ *nexthdr = &exthdr->nexthdr; - } - -- return offset; -+ return -EINVAL; - } - EXPORT_SYMBOL(ip6_find_1stfragopt); - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 1a63c4deef26..8e958fde6e4b 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -1033,6 +1033,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - newtp->af_specific = &tcp_sock_ipv6_mapped_specific; - #endif - -+ newnp->ipv6_mc_list = NULL; - newnp->ipv6_ac_list = NULL; - newnp->ipv6_fl_list = NULL; - newnp->pktoptions = NULL; -@@ -1102,6 +1103,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - First: no IPv4 options. - */ - newinet->inet_opt = NULL; -+ newnp->ipv6_mc_list = NULL; - newnp->ipv6_ac_list = NULL; - newnp->ipv6_fl_list = NULL; - -diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c -index 7441e1e63893..01582966ffa0 100644 ---- a/net/ipv6/udp_offload.c -+++ b/net/ipv6/udp_offload.c -@@ -29,6 +29,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, - u8 frag_hdr_sz = sizeof(struct frag_hdr); - __wsum csum; - int tnl_hlen; -+ int err; - - mss = skb_shinfo(skb)->gso_size; - if (unlikely(skb->len <= mss)) -@@ -97,7 +98,10 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, - /* Find the unfragmentable header and shift it left by frag_hdr_sz - * bytes to insert fragment header. - */ -- unfrag_ip6hlen = ip6_find_1stfragopt(skb, &prevhdr); -+ err = ip6_find_1stfragopt(skb, &prevhdr); -+ if (err < 0) -+ return ERR_PTR(err); -+ unfrag_ip6hlen = err; - nexthdr = *prevhdr; - *prevhdr = NEXTHDR_FRAGMENT; - unfrag_len = (skb_network_header(skb) - skb_mac_header(skb)) + -diff --git a/net/sctp/input.c b/net/sctp/input.c -index b6493b3f11a9..2d7859c03fd2 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -472,15 +472,14 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb, - struct sctp_association **app, - struct sctp_transport **tpp) - { -+ struct sctp_init_chunk *chunkhdr, _chunkhdr; - union sctp_addr saddr; - union sctp_addr daddr; - struct sctp_af *af; - struct sock *sk = NULL; - struct sctp_association *asoc; - struct sctp_transport *transport = NULL; -- struct sctp_init_chunk *chunkhdr; - __u32 vtag = ntohl(sctphdr->vtag); -- int len = skb->len - ((void *)sctphdr - (void *)skb->data); - - *app = NULL; *tpp = NULL; - -@@ -515,13 +514,16 @@ struct sock *sctp_err_lookup(struct net *net, int family, struct sk_buff *skb, - * discard the packet. - */ - if (vtag == 0) { -- chunkhdr = (void *)sctphdr + sizeof(struct sctphdr); -- if (len < sizeof(struct sctphdr) + sizeof(sctp_chunkhdr_t) -- + sizeof(__be32) || -+ /* chunk header + first 4 octects of init header */ -+ chunkhdr = skb_header_pointer(skb, skb_transport_offset(skb) + -+ sizeof(struct sctphdr), -+ sizeof(struct sctp_chunkhdr) + -+ sizeof(__be32), &_chunkhdr); -+ if (!chunkhdr || - chunkhdr->chunk_hdr.type != SCTP_CID_INIT || -- ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) { -+ ntohl(chunkhdr->init_hdr.init_tag) != asoc->c.my_vtag) - goto out; -- } -+ - } else if (vtag != asoc->c.peer_vtag) { - goto out; - } -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index ce46f1c7f133..7527c168e471 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -239,12 +239,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, - struct sctp_bind_addr *bp; - struct ipv6_pinfo *np = inet6_sk(sk); - struct sctp_sockaddr_entry *laddr; -- union sctp_addr *baddr = NULL; - union sctp_addr *daddr = &t->ipaddr; - union sctp_addr dst_saddr; - struct in6_addr *final_p, final; - __u8 matchlen = 0; -- __u8 bmatchlen; - sctp_scope_t scope; - - memset(fl6, 0, sizeof(struct flowi6)); -@@ -311,23 +309,37 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr, - */ - rcu_read_lock(); - list_for_each_entry_rcu(laddr, &bp->address_list, list) { -- if (!laddr->valid) -+ struct dst_entry *bdst; -+ __u8 bmatchlen; -+ -+ if (!laddr->valid || -+ laddr->state != SCTP_ADDR_SRC || -+ laddr->a.sa.sa_family != AF_INET6 || -+ scope > sctp_scope(&laddr->a)) - continue; -- if ((laddr->state == SCTP_ADDR_SRC) && -- (laddr->a.sa.sa_family == AF_INET6) && -- (scope <= sctp_scope(&laddr->a))) { -- bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); -- if (!baddr || (matchlen < bmatchlen)) { -- baddr = &laddr->a; -- matchlen = bmatchlen; -- } -- } -- } -- if (baddr) { -- fl6->saddr = baddr->v6.sin6_addr; -- fl6->fl6_sport = baddr->v6.sin6_port; -+ -+ fl6->saddr = laddr->a.v6.sin6_addr; -+ fl6->fl6_sport = laddr->a.v6.sin6_port; - final_p = fl6_update_dst(fl6, rcu_dereference(np->opt), &final); -- dst = ip6_dst_lookup_flow(sk, fl6, final_p); -+ bdst = ip6_dst_lookup_flow(sk, fl6, final_p); -+ -+ if (!IS_ERR(bdst) && -+ ipv6_chk_addr(dev_net(bdst->dev), -+ &laddr->a.v6.sin6_addr, bdst->dev, 1)) { -+ if (!IS_ERR_OR_NULL(dst)) -+ dst_release(dst); -+ dst = bdst; -+ break; -+ } -+ -+ bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a); -+ if (matchlen > bmatchlen) -+ continue; -+ -+ if (!IS_ERR_OR_NULL(dst)) -+ dst_release(dst); -+ dst = bdst; -+ matchlen = bmatchlen; - } - rcu_read_unlock(); - -@@ -662,6 +674,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, - newnp = inet6_sk(newsk); - - memcpy(newnp, np, sizeof(struct ipv6_pinfo)); -+ newnp->ipv6_mc_list = NULL; -+ newnp->ipv6_ac_list = NULL; -+ newnp->ipv6_fl_list = NULL; - - rcu_read_lock(); - opt = rcu_dereference(np->opt); -diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c -index 37b70f8e878f..0abab7926dca 100644 ---- a/sound/pci/hda/patch_sigmatel.c -+++ b/sound/pci/hda/patch_sigmatel.c -@@ -1537,6 +1537,8 @@ static const struct snd_pci_quirk stac9200_fixup_tbl[] = { - "Dell Inspiron 1501", STAC_9200_DELL_M26), - SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x01f6, - "unknown Dell", STAC_9200_DELL_M26), -+ SND_PCI_QUIRK(PCI_VENDOR_ID_DELL, 0x0201, -+ "Dell Latitude D430", STAC_9200_DELL_M22), - /* Panasonic */ - SND_PCI_QUIRK(0x10f7, 0x8338, "Panasonic CF-74", STAC_9200_PANASONIC), - /* Gateway machines needs EAPD to be set on resume */ diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.71-72.patch b/patch/kernel/mvebu64-default/03-patch-4.4.71-72.patch deleted file mode 100644 index 9d89deaf488d..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.71-72.patch +++ /dev/null @@ -1,3301 +0,0 @@ -diff --git a/Makefile b/Makefile -index ad91a79aed51..94d663c935c0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 71 -+SUBLEVEL = 72 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/init.S b/arch/arm/kvm/init.S -index 3988e72d16ff..bfc5aae0c280 100644 ---- a/arch/arm/kvm/init.S -+++ b/arch/arm/kvm/init.S -@@ -110,7 +110,6 @@ __do_hyp_init: - @ - Write permission implies XN: disabled - @ - Instruction cache: enabled - @ - Data/Unified cache: enabled -- @ - Memory alignment checks: enabled - @ - MMU: enabled (this code must be run from an identity mapping) - mrc p15, 4, r0, c1, c0, 0 @ HSCR - ldr r2, =HSCTLR_MASK -@@ -118,8 +117,8 @@ __do_hyp_init: - mrc p15, 0, r1, c1, c0, 0 @ SCTLR - ldr r2, =(HSCTLR_EE | HSCTLR_FI | HSCTLR_I | HSCTLR_C) - and r1, r1, r2 -- ARM( ldr r2, =(HSCTLR_M | HSCTLR_A) ) -- THUMB( ldr r2, =(HSCTLR_M | HSCTLR_A | HSCTLR_TE) ) -+ ARM( ldr r2, =(HSCTLR_M) ) -+ THUMB( ldr r2, =(HSCTLR_M | HSCTLR_TE) ) - orr r1, r1, r2 - orr r0, r0, r1 - isb -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index 01cf10556081..1f1ff7e7b9cf 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -869,6 +869,9 @@ static pmd_t *stage2_get_pmd(struct kvm *kvm, struct kvm_mmu_memory_cache *cache - pmd_t *pmd; - - pud = stage2_get_pud(kvm, cache, addr); -+ if (!pud) -+ return NULL; -+ - if (pud_none(*pud)) { - if (!cache) - return NULL; -diff --git a/arch/arm64/include/asm/asm-uaccess.h b/arch/arm64/include/asm/asm-uaccess.h -new file mode 100644 -index 000000000000..be2d2347d995 ---- /dev/null -+++ b/arch/arm64/include/asm/asm-uaccess.h -@@ -0,0 +1,13 @@ -+#ifndef __ASM_ASM_UACCESS_H -+#define __ASM_ASM_UACCESS_H -+ -+/* -+ * Remove the address tag from a virtual address, if present. -+ */ -+ .macro clear_address_tag, dst, addr -+ tst \addr, #(1 << 55) -+ bic \dst, \addr, #(0xff << 56) -+ csel \dst, \dst, \addr, eq -+ .endm -+ -+#endif -diff --git a/arch/arm64/include/asm/barrier.h b/arch/arm64/include/asm/barrier.h -index 9622eb48f894..f2d2c0bbe21b 100644 ---- a/arch/arm64/include/asm/barrier.h -+++ b/arch/arm64/include/asm/barrier.h -@@ -41,23 +41,33 @@ - - #define smp_store_release(p, v) \ - do { \ -+ union { typeof(*p) __val; char __c[1]; } __u = \ -+ { .__val = (__force typeof(*p)) (v) }; \ - compiletime_assert_atomic_type(*p); \ - switch (sizeof(*p)) { \ - case 1: \ - asm volatile ("stlrb %w1, %0" \ -- : "=Q" (*p) : "r" (v) : "memory"); \ -+ : "=Q" (*p) \ -+ : "r" (*(__u8 *)__u.__c) \ -+ : "memory"); \ - break; \ - case 2: \ - asm volatile ("stlrh %w1, %0" \ -- : "=Q" (*p) : "r" (v) : "memory"); \ -+ : "=Q" (*p) \ -+ : "r" (*(__u16 *)__u.__c) \ -+ : "memory"); \ - break; \ - case 4: \ - asm volatile ("stlr %w1, %0" \ -- : "=Q" (*p) : "r" (v) : "memory"); \ -+ : "=Q" (*p) \ -+ : "r" (*(__u32 *)__u.__c) \ -+ : "memory"); \ - break; \ - case 8: \ - asm volatile ("stlr %1, %0" \ -- : "=Q" (*p) : "r" (v) : "memory"); \ -+ : "=Q" (*p) \ -+ : "r" (*(__u64 *)__u.__c) \ -+ : "memory"); \ - break; \ - } \ - } while (0) -diff --git a/arch/arm64/kernel/armv8_deprecated.c b/arch/arm64/kernel/armv8_deprecated.c -index 937f5e58a4d3..478a00b9732b 100644 ---- a/arch/arm64/kernel/armv8_deprecated.c -+++ b/arch/arm64/kernel/armv8_deprecated.c -@@ -305,7 +305,8 @@ static void register_insn_emulation_sysctl(struct ctl_table *table) - ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, \ - CONFIG_ARM64_PAN) \ - : "=&r" (res), "+r" (data), "=&r" (temp) \ -- : "r" (addr), "i" (-EAGAIN), "i" (-EFAULT) \ -+ : "r" ((unsigned long)addr), "i" (-EAGAIN), \ -+ "i" (-EFAULT) \ - : "memory") - - #define __user_swp_asm(data, addr, res, temp) \ -diff --git a/arch/arm64/kernel/entry.S b/arch/arm64/kernel/entry.S -index bd14849beb73..dccd0c2e9023 100644 ---- a/arch/arm64/kernel/entry.S -+++ b/arch/arm64/kernel/entry.S -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - #include - - /* -@@ -316,12 +317,13 @@ el1_da: - /* - * Data abort handling - */ -- mrs x0, far_el1 -+ mrs x3, far_el1 - enable_dbg - // re-enable interrupts if they were enabled in the aborted context - tbnz x23, #7, 1f // PSR_I_BIT - enable_irq - 1: -+ clear_address_tag x0, x3 - mov x2, sp // struct pt_regs - bl do_mem_abort - -@@ -483,7 +485,7 @@ el0_da: - // enable interrupts before calling the main handler - enable_dbg_and_irq - ct_user_exit -- bic x0, x26, #(0xff << 56) -+ clear_address_tag x0, x26 - mov x1, x25 - mov x2, sp - bl do_mem_abort -diff --git a/arch/arm64/kernel/hw_breakpoint.c b/arch/arm64/kernel/hw_breakpoint.c -index b45c95d34b83..eeebfc315526 100644 ---- a/arch/arm64/kernel/hw_breakpoint.c -+++ b/arch/arm64/kernel/hw_breakpoint.c -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - - /* Breakpoint currently in use for each BRP. */ - static DEFINE_PER_CPU(struct perf_event *, bp_on_reg[ARM_MAX_BRP]); -@@ -690,7 +691,7 @@ static int watchpoint_handler(unsigned long addr, unsigned int esr, - - /* Check if the watchpoint value matches. */ - val = read_wb_reg(AARCH64_DBG_REG_WVR, i); -- if (val != (addr & ~alignment_mask)) -+ if (val != (untagged_addr(addr) & ~alignment_mask)) - goto unlock; - - /* Possible match, check the byte address select to confirm. */ -diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h -index 8b3b46b7b0f2..329771559cbb 100644 ---- a/arch/powerpc/include/asm/topology.h -+++ b/arch/powerpc/include/asm/topology.h -@@ -44,8 +44,22 @@ extern void __init dump_numa_cpu_topology(void); - extern int sysfs_add_device_to_node(struct device *dev, int nid); - extern void sysfs_remove_device_from_node(struct device *dev, int nid); - -+static inline int early_cpu_to_node(int cpu) -+{ -+ int nid; -+ -+ nid = numa_cpu_lookup_table[cpu]; -+ -+ /* -+ * Fall back to node 0 if nid is unset (it should be, except bugs). -+ * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)). -+ */ -+ return (nid < 0) ? 0 : nid; -+} - #else - -+static inline int early_cpu_to_node(int cpu) { return 0; } -+ - static inline void dump_numa_cpu_topology(void) {} - - static inline int sysfs_add_device_to_node(struct device *dev, int nid) -diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c -index c314db8b798c..9837c98caabe 100644 ---- a/arch/powerpc/kernel/eeh_driver.c -+++ b/arch/powerpc/kernel/eeh_driver.c -@@ -655,7 +655,7 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus) - */ - #define MAX_WAIT_FOR_RECOVERY 300 - --static void eeh_handle_normal_event(struct eeh_pe *pe) -+static bool eeh_handle_normal_event(struct eeh_pe *pe) - { - struct pci_bus *frozen_bus; - int rc = 0; -@@ -665,7 +665,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) - if (!frozen_bus) { - pr_err("%s: Cannot find PCI bus for PHB#%d-PE#%x\n", - __func__, pe->phb->global_number, pe->addr); -- return; -+ return false; - } - - eeh_pe_update_time_stamp(pe); -@@ -790,7 +790,7 @@ static void eeh_handle_normal_event(struct eeh_pe *pe) - pr_info("EEH: Notify device driver to resume\n"); - eeh_pe_dev_traverse(pe, eeh_report_resume, NULL); - -- return; -+ return false; - - excess_failures: - /* -@@ -831,7 +831,11 @@ perm_error: - pci_lock_rescan_remove(); - pcibios_remove_pci_devices(frozen_bus); - pci_unlock_rescan_remove(); -+ -+ /* The passed PE should no longer be used */ -+ return true; - } -+ return false; - } - - static void eeh_handle_special_event(void) -@@ -897,7 +901,14 @@ static void eeh_handle_special_event(void) - */ - if (rc == EEH_NEXT_ERR_FROZEN_PE || - rc == EEH_NEXT_ERR_FENCED_PHB) { -- eeh_handle_normal_event(pe); -+ /* -+ * eeh_handle_normal_event() can make the PE stale if it -+ * determines that the PE cannot possibly be recovered. -+ * Don't modify the PE state if that's the case. -+ */ -+ if (eeh_handle_normal_event(pe)) -+ continue; -+ - eeh_pe_state_clear(pe, EEH_PE_RECOVERING); - } else { - pci_lock_rescan_remove(); -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index a20823210ac0..fe6e800c1357 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -751,7 +751,7 @@ void __init setup_arch(char **cmdline_p) - - static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align) - { -- return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align, -+ return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align, - __pa(MAX_DMA_ADDRESS)); - } - -@@ -762,7 +762,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size) - - static int pcpu_cpu_distance(unsigned int from, unsigned int to) - { -- if (cpu_to_node(from) == cpu_to_node(to)) -+ if (early_cpu_to_node(from) == early_cpu_to_node(to)) - return LOCAL_DISTANCE; - else - return REMOTE_DISTANCE; -diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c -index e9ff44cd5d86..e8b1027e1b5b 100644 ---- a/arch/powerpc/platforms/pseries/hotplug-memory.c -+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c -@@ -110,6 +110,7 @@ static struct property *dlpar_clone_drconf_property(struct device_node *dn) - for (i = 0; i < num_lmbs; i++) { - lmbs[i].base_addr = be64_to_cpu(lmbs[i].base_addr); - lmbs[i].drc_index = be32_to_cpu(lmbs[i].drc_index); -+ lmbs[i].aa_index = be32_to_cpu(lmbs[i].aa_index); - lmbs[i].flags = be32_to_cpu(lmbs[i].flags); - } - -@@ -553,6 +554,7 @@ static void dlpar_update_drconf_property(struct device_node *dn, - for (i = 0; i < num_lmbs; i++) { - lmbs[i].base_addr = cpu_to_be64(lmbs[i].base_addr); - lmbs[i].drc_index = cpu_to_be32(lmbs[i].drc_index); -+ lmbs[i].aa_index = cpu_to_be32(lmbs[i].aa_index); - lmbs[i].flags = cpu_to_be32(lmbs[i].flags); - } - -diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig -index 56442d2d7bbc..eb9487470141 100644 ---- a/arch/sparc/Kconfig -+++ b/arch/sparc/Kconfig -@@ -182,9 +182,9 @@ config NR_CPUS - int "Maximum number of CPUs" - depends on SMP - range 2 32 if SPARC32 -- range 2 1024 if SPARC64 -+ range 2 4096 if SPARC64 - default 32 if SPARC32 -- default 64 if SPARC64 -+ default 4096 if SPARC64 - - source kernel/Kconfig.hz - -diff --git a/arch/sparc/include/asm/mmu_64.h b/arch/sparc/include/asm/mmu_64.h -index f7de0dbc38af..83b36a5371ff 100644 ---- a/arch/sparc/include/asm/mmu_64.h -+++ b/arch/sparc/include/asm/mmu_64.h -@@ -52,7 +52,7 @@ - #define CTX_NR_MASK TAG_CONTEXT_BITS - #define CTX_HW_MASK (CTX_NR_MASK | CTX_PGSZ_MASK) - --#define CTX_FIRST_VERSION ((_AC(1,UL) << CTX_VERSION_SHIFT) + _AC(1,UL)) -+#define CTX_FIRST_VERSION BIT(CTX_VERSION_SHIFT) - #define CTX_VALID(__ctx) \ - (!(((__ctx.sparc64_ctx_val) ^ tlb_context_cache) & CTX_VERSION_MASK)) - #define CTX_HWBITS(__ctx) ((__ctx.sparc64_ctx_val) & CTX_HW_MASK) -diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h -index b84be675e507..349dd23e2876 100644 ---- a/arch/sparc/include/asm/mmu_context_64.h -+++ b/arch/sparc/include/asm/mmu_context_64.h -@@ -17,13 +17,8 @@ extern spinlock_t ctx_alloc_lock; - extern unsigned long tlb_context_cache; - extern unsigned long mmu_context_bmap[]; - -+DECLARE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm); - void get_new_mmu_context(struct mm_struct *mm); --#ifdef CONFIG_SMP --void smp_new_mmu_context_version(void); --#else --#define smp_new_mmu_context_version() do { } while (0) --#endif -- - int init_new_context(struct task_struct *tsk, struct mm_struct *mm); - void destroy_context(struct mm_struct *mm); - -@@ -74,8 +69,9 @@ void __flush_tlb_mm(unsigned long, unsigned long); - static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, struct task_struct *tsk) - { - unsigned long ctx_valid, flags; -- int cpu; -+ int cpu = smp_processor_id(); - -+ per_cpu(per_cpu_secondary_mm, cpu) = mm; - if (unlikely(mm == &init_mm)) - return; - -@@ -121,7 +117,6 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str - * for the first time, we must flush that context out of the - * local TLB. - */ -- cpu = smp_processor_id(); - if (!ctx_valid || !cpumask_test_cpu(cpu, mm_cpumask(mm))) { - cpumask_set_cpu(cpu, mm_cpumask(mm)); - __flush_tlb_mm(CTX_HWBITS(mm->context), -@@ -131,26 +126,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str - } - - #define deactivate_mm(tsk,mm) do { } while (0) -- --/* Activate a new MM instance for the current task. */ --static inline void activate_mm(struct mm_struct *active_mm, struct mm_struct *mm) --{ -- unsigned long flags; -- int cpu; -- -- spin_lock_irqsave(&mm->context.lock, flags); -- if (!CTX_VALID(mm->context)) -- get_new_mmu_context(mm); -- cpu = smp_processor_id(); -- if (!cpumask_test_cpu(cpu, mm_cpumask(mm))) -- cpumask_set_cpu(cpu, mm_cpumask(mm)); -- -- load_secondary_context(mm); -- __flush_tlb_mm(CTX_HWBITS(mm->context), SECONDARY_CONTEXT); -- tsb_context_switch(mm); -- spin_unlock_irqrestore(&mm->context.lock, flags); --} -- -+#define activate_mm(active_mm, mm) switch_mm(active_mm, mm, NULL) - #endif /* !(__ASSEMBLY__) */ - - #endif /* !(__SPARC64_MMU_CONTEXT_H) */ -diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h -index 266937030546..522b43db2ed3 100644 ---- a/arch/sparc/include/asm/pil.h -+++ b/arch/sparc/include/asm/pil.h -@@ -20,7 +20,6 @@ - #define PIL_SMP_CALL_FUNC 1 - #define PIL_SMP_RECEIVE_SIGNAL 2 - #define PIL_SMP_CAPTURE 3 --#define PIL_SMP_CTX_NEW_VERSION 4 - #define PIL_DEVICE_IRQ 5 - #define PIL_SMP_CALL_FUNC_SNGL 6 - #define PIL_DEFERRED_PCR_WORK 7 -diff --git a/arch/sparc/include/asm/vio.h b/arch/sparc/include/asm/vio.h -index 8174f6cdbbbb..9dca7a892978 100644 ---- a/arch/sparc/include/asm/vio.h -+++ b/arch/sparc/include/asm/vio.h -@@ -327,6 +327,7 @@ struct vio_dev { - int compat_len; - - u64 dev_no; -+ u64 id; - - unsigned long channel_id; - -diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c -index e22416ce56ea..bfbde8c4ffb2 100644 ---- a/arch/sparc/kernel/irq_64.c -+++ b/arch/sparc/kernel/irq_64.c -@@ -1034,17 +1034,26 @@ static void __init init_cpu_send_mondo_info(struct trap_per_cpu *tb) - { - #ifdef CONFIG_SMP - unsigned long page; -+ void *mondo, *p; - -- BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > (PAGE_SIZE - 64)); -+ BUILD_BUG_ON((NR_CPUS * sizeof(u16)) > PAGE_SIZE); -+ -+ /* Make sure mondo block is 64byte aligned */ -+ p = kzalloc(127, GFP_KERNEL); -+ if (!p) { -+ prom_printf("SUN4V: Error, cannot allocate mondo block.\n"); -+ prom_halt(); -+ } -+ mondo = (void *)(((unsigned long)p + 63) & ~0x3f); -+ tb->cpu_mondo_block_pa = __pa(mondo); - - page = get_zeroed_page(GFP_KERNEL); - if (!page) { -- prom_printf("SUN4V: Error, cannot allocate cpu mondo page.\n"); -+ prom_printf("SUN4V: Error, cannot allocate cpu list page.\n"); - prom_halt(); - } - -- tb->cpu_mondo_block_pa = __pa(page); -- tb->cpu_list_pa = __pa(page + 64); -+ tb->cpu_list_pa = __pa(page); - #endif - } - -diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h -index e7f652be9e61..44f32dd4477f 100644 ---- a/arch/sparc/kernel/kernel.h -+++ b/arch/sparc/kernel/kernel.h -@@ -37,7 +37,6 @@ void handle_stdfmna(struct pt_regs *regs, unsigned long sfar, unsigned long sfsr - /* smp_64.c */ - void __irq_entry smp_call_function_client(int irq, struct pt_regs *regs); - void __irq_entry smp_call_function_single_client(int irq, struct pt_regs *regs); --void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs); - void __irq_entry smp_penguin_jailcell(int irq, struct pt_regs *regs); - void __irq_entry smp_receive_signal_client(int irq, struct pt_regs *regs); - -diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index 19cd08d18672..95a9fa0d2195 100644 ---- a/arch/sparc/kernel/smp_64.c -+++ b/arch/sparc/kernel/smp_64.c -@@ -959,37 +959,6 @@ void flush_dcache_page_all(struct mm_struct *mm, struct page *page) - preempt_enable(); - } - --void __irq_entry smp_new_mmu_context_version_client(int irq, struct pt_regs *regs) --{ -- struct mm_struct *mm; -- unsigned long flags; -- -- clear_softint(1 << irq); -- -- /* See if we need to allocate a new TLB context because -- * the version of the one we are using is now out of date. -- */ -- mm = current->active_mm; -- if (unlikely(!mm || (mm == &init_mm))) -- return; -- -- spin_lock_irqsave(&mm->context.lock, flags); -- -- if (unlikely(!CTX_VALID(mm->context))) -- get_new_mmu_context(mm); -- -- spin_unlock_irqrestore(&mm->context.lock, flags); -- -- load_secondary_context(mm); -- __flush_tlb_mm(CTX_HWBITS(mm->context), -- SECONDARY_CONTEXT); --} -- --void smp_new_mmu_context_version(void) --{ -- smp_cross_call(&xcall_new_mmu_context_version, 0, 0, 0); --} -- - #ifdef CONFIG_KGDB - void kgdb_roundup_cpus(unsigned long flags) - { -diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S -index d568c8207af7..395ec1800530 100644 ---- a/arch/sparc/kernel/tsb.S -+++ b/arch/sparc/kernel/tsb.S -@@ -470,13 +470,16 @@ __tsb_context_switch: - .type copy_tsb,#function - copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size - * %o2=new_tsb_base, %o3=new_tsb_size -+ * %o4=page_size_shift - */ - sethi %uhi(TSB_PASS_BITS), %g7 - srlx %o3, 4, %o3 -- add %o0, %o1, %g1 /* end of old tsb */ -+ add %o0, %o1, %o1 /* end of old tsb */ - sllx %g7, 32, %g7 - sub %o3, 1, %o3 /* %o3 == new tsb hash mask */ - -+ mov %o4, %g1 /* page_size_shift */ -+ - 661: prefetcha [%o0] ASI_N, #one_read - .section .tsb_phys_patch, "ax" - .word 661b -@@ -501,9 +504,9 @@ copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size - /* This can definitely be computed faster... */ - srlx %o0, 4, %o5 /* Build index */ - and %o5, 511, %o5 /* Mask index */ -- sllx %o5, PAGE_SHIFT, %o5 /* Put into vaddr position */ -+ sllx %o5, %g1, %o5 /* Put into vaddr position */ - or %o4, %o5, %o4 /* Full VADDR. */ -- srlx %o4, PAGE_SHIFT, %o4 /* Shift down to create index */ -+ srlx %o4, %g1, %o4 /* Shift down to create index */ - and %o4, %o3, %o4 /* Mask with new_tsb_nents-1 */ - sllx %o4, 4, %o4 /* Shift back up into tsb ent offset */ - TSB_STORE(%o2 + %o4, %g2) /* Store TAG */ -@@ -511,7 +514,7 @@ copy_tsb: /* %o0=old_tsb_base, %o1=old_tsb_size - TSB_STORE(%o2 + %o4, %g3) /* Store TTE */ - - 80: add %o0, 16, %o0 -- cmp %o0, %g1 -+ cmp %o0, %o1 - bne,pt %xcc, 90b - nop - -diff --git a/arch/sparc/kernel/ttable_64.S b/arch/sparc/kernel/ttable_64.S -index c6dfdaa29e20..170ead662f2a 100644 ---- a/arch/sparc/kernel/ttable_64.S -+++ b/arch/sparc/kernel/ttable_64.S -@@ -50,7 +50,7 @@ tl0_resv03e: BTRAP(0x3e) BTRAP(0x3f) BTRAP(0x40) - tl0_irq1: TRAP_IRQ(smp_call_function_client, 1) - tl0_irq2: TRAP_IRQ(smp_receive_signal_client, 2) - tl0_irq3: TRAP_IRQ(smp_penguin_jailcell, 3) --tl0_irq4: TRAP_IRQ(smp_new_mmu_context_version_client, 4) -+tl0_irq4: BTRAP(0x44) - #else - tl0_irq1: BTRAP(0x41) - tl0_irq2: BTRAP(0x42) -diff --git a/arch/sparc/kernel/vio.c b/arch/sparc/kernel/vio.c -index cb5789c9f961..34824ca396f0 100644 ---- a/arch/sparc/kernel/vio.c -+++ b/arch/sparc/kernel/vio.c -@@ -284,13 +284,16 @@ static struct vio_dev *vio_create_one(struct mdesc_handle *hp, u64 mp, - if (!id) { - dev_set_name(&vdev->dev, "%s", bus_id_name); - vdev->dev_no = ~(u64)0; -+ vdev->id = ~(u64)0; - } else if (!cfg_handle) { - dev_set_name(&vdev->dev, "%s-%llu", bus_id_name, *id); - vdev->dev_no = *id; -+ vdev->id = ~(u64)0; - } else { - dev_set_name(&vdev->dev, "%s-%llu-%llu", bus_id_name, - *cfg_handle, *id); - vdev->dev_no = *cfg_handle; -+ vdev->id = *id; - } - - vdev->dev.parent = parent; -@@ -333,27 +336,84 @@ static void vio_add(struct mdesc_handle *hp, u64 node) - (void) vio_create_one(hp, node, &root_vdev->dev); - } - -+struct vio_md_node_query { -+ const char *type; -+ u64 dev_no; -+ u64 id; -+}; -+ - static int vio_md_node_match(struct device *dev, void *arg) - { -+ struct vio_md_node_query *query = (struct vio_md_node_query *) arg; - struct vio_dev *vdev = to_vio_dev(dev); - -- if (vdev->mp == (u64) arg) -- return 1; -+ if (vdev->dev_no != query->dev_no) -+ return 0; -+ if (vdev->id != query->id) -+ return 0; -+ if (strcmp(vdev->type, query->type)) -+ return 0; - -- return 0; -+ return 1; - } - - static void vio_remove(struct mdesc_handle *hp, u64 node) - { -+ const char *type; -+ const u64 *id, *cfg_handle; -+ u64 a; -+ struct vio_md_node_query query; - struct device *dev; - -- dev = device_find_child(&root_vdev->dev, (void *) node, -+ type = mdesc_get_property(hp, node, "device-type", NULL); -+ if (!type) { -+ type = mdesc_get_property(hp, node, "name", NULL); -+ if (!type) -+ type = mdesc_node_name(hp, node); -+ } -+ -+ query.type = type; -+ -+ id = mdesc_get_property(hp, node, "id", NULL); -+ cfg_handle = NULL; -+ mdesc_for_each_arc(a, hp, node, MDESC_ARC_TYPE_BACK) { -+ u64 target; -+ -+ target = mdesc_arc_target(hp, a); -+ cfg_handle = mdesc_get_property(hp, target, -+ "cfg-handle", NULL); -+ if (cfg_handle) -+ break; -+ } -+ -+ if (!id) { -+ query.dev_no = ~(u64)0; -+ query.id = ~(u64)0; -+ } else if (!cfg_handle) { -+ query.dev_no = *id; -+ query.id = ~(u64)0; -+ } else { -+ query.dev_no = *cfg_handle; -+ query.id = *id; -+ } -+ -+ dev = device_find_child(&root_vdev->dev, &query, - vio_md_node_match); - if (dev) { - printk(KERN_INFO "VIO: Removing device %s\n", dev_name(dev)); - - device_unregister(dev); - put_device(dev); -+ } else { -+ if (!id) -+ printk(KERN_ERR "VIO: Removed unknown %s node.\n", -+ type); -+ else if (!cfg_handle) -+ printk(KERN_ERR "VIO: Removed unknown %s node %llu.\n", -+ type, *id); -+ else -+ printk(KERN_ERR "VIO: Removed unknown %s node %llu-%llu.\n", -+ type, *cfg_handle, *id); - } - } - -diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c -index 965655afdbb6..384aba109d7c 100644 ---- a/arch/sparc/mm/init_64.c -+++ b/arch/sparc/mm/init_64.c -@@ -656,10 +656,58 @@ EXPORT_SYMBOL(__flush_dcache_range); - - /* get_new_mmu_context() uses "cache + 1". */ - DEFINE_SPINLOCK(ctx_alloc_lock); --unsigned long tlb_context_cache = CTX_FIRST_VERSION - 1; -+unsigned long tlb_context_cache = CTX_FIRST_VERSION; - #define MAX_CTX_NR (1UL << CTX_NR_BITS) - #define CTX_BMAP_SLOTS BITS_TO_LONGS(MAX_CTX_NR) - DECLARE_BITMAP(mmu_context_bmap, MAX_CTX_NR); -+DEFINE_PER_CPU(struct mm_struct *, per_cpu_secondary_mm) = {0}; -+ -+static void mmu_context_wrap(void) -+{ -+ unsigned long old_ver = tlb_context_cache & CTX_VERSION_MASK; -+ unsigned long new_ver, new_ctx, old_ctx; -+ struct mm_struct *mm; -+ int cpu; -+ -+ bitmap_zero(mmu_context_bmap, 1 << CTX_NR_BITS); -+ -+ /* Reserve kernel context */ -+ set_bit(0, mmu_context_bmap); -+ -+ new_ver = (tlb_context_cache & CTX_VERSION_MASK) + CTX_FIRST_VERSION; -+ if (unlikely(new_ver == 0)) -+ new_ver = CTX_FIRST_VERSION; -+ tlb_context_cache = new_ver; -+ -+ /* -+ * Make sure that any new mm that are added into per_cpu_secondary_mm, -+ * are going to go through get_new_mmu_context() path. -+ */ -+ mb(); -+ -+ /* -+ * Updated versions to current on those CPUs that had valid secondary -+ * contexts -+ */ -+ for_each_online_cpu(cpu) { -+ /* -+ * If a new mm is stored after we took this mm from the array, -+ * it will go into get_new_mmu_context() path, because we -+ * already bumped the version in tlb_context_cache. -+ */ -+ mm = per_cpu(per_cpu_secondary_mm, cpu); -+ -+ if (unlikely(!mm || mm == &init_mm)) -+ continue; -+ -+ old_ctx = mm->context.sparc64_ctx_val; -+ if (likely((old_ctx & CTX_VERSION_MASK) == old_ver)) { -+ new_ctx = (old_ctx & ~CTX_VERSION_MASK) | new_ver; -+ set_bit(new_ctx & CTX_NR_MASK, mmu_context_bmap); -+ mm->context.sparc64_ctx_val = new_ctx; -+ } -+ } -+} - - /* Caller does TLB context flushing on local CPU if necessary. - * The caller also ensures that CTX_VALID(mm->context) is false. -@@ -675,48 +723,30 @@ void get_new_mmu_context(struct mm_struct *mm) - { - unsigned long ctx, new_ctx; - unsigned long orig_pgsz_bits; -- int new_version; - - spin_lock(&ctx_alloc_lock); -+retry: -+ /* wrap might have happened, test again if our context became valid */ -+ if (unlikely(CTX_VALID(mm->context))) -+ goto out; - orig_pgsz_bits = (mm->context.sparc64_ctx_val & CTX_PGSZ_MASK); - ctx = (tlb_context_cache + 1) & CTX_NR_MASK; - new_ctx = find_next_zero_bit(mmu_context_bmap, 1 << CTX_NR_BITS, ctx); -- new_version = 0; - if (new_ctx >= (1 << CTX_NR_BITS)) { - new_ctx = find_next_zero_bit(mmu_context_bmap, ctx, 1); - if (new_ctx >= ctx) { -- int i; -- new_ctx = (tlb_context_cache & CTX_VERSION_MASK) + -- CTX_FIRST_VERSION; -- if (new_ctx == 1) -- new_ctx = CTX_FIRST_VERSION; -- -- /* Don't call memset, for 16 entries that's just -- * plain silly... -- */ -- mmu_context_bmap[0] = 3; -- mmu_context_bmap[1] = 0; -- mmu_context_bmap[2] = 0; -- mmu_context_bmap[3] = 0; -- for (i = 4; i < CTX_BMAP_SLOTS; i += 4) { -- mmu_context_bmap[i + 0] = 0; -- mmu_context_bmap[i + 1] = 0; -- mmu_context_bmap[i + 2] = 0; -- mmu_context_bmap[i + 3] = 0; -- } -- new_version = 1; -- goto out; -+ mmu_context_wrap(); -+ goto retry; - } - } -+ if (mm->context.sparc64_ctx_val) -+ cpumask_clear(mm_cpumask(mm)); - mmu_context_bmap[new_ctx>>6] |= (1UL << (new_ctx & 63)); - new_ctx |= (tlb_context_cache & CTX_VERSION_MASK); --out: - tlb_context_cache = new_ctx; - mm->context.sparc64_ctx_val = new_ctx | orig_pgsz_bits; -+out: - spin_unlock(&ctx_alloc_lock); -- -- if (unlikely(new_version)) -- smp_new_mmu_context_version(); - } - - static int numa_enabled = 1; -diff --git a/arch/sparc/mm/tsb.c b/arch/sparc/mm/tsb.c -index 9cdeca0fa955..266411291634 100644 ---- a/arch/sparc/mm/tsb.c -+++ b/arch/sparc/mm/tsb.c -@@ -451,7 +451,8 @@ retry_tsb_alloc: - extern void copy_tsb(unsigned long old_tsb_base, - unsigned long old_tsb_size, - unsigned long new_tsb_base, -- unsigned long new_tsb_size); -+ unsigned long new_tsb_size, -+ unsigned long page_size_shift); - unsigned long old_tsb_base = (unsigned long) old_tsb; - unsigned long new_tsb_base = (unsigned long) new_tsb; - -@@ -459,7 +460,9 @@ retry_tsb_alloc: - old_tsb_base = __pa(old_tsb_base); - new_tsb_base = __pa(new_tsb_base); - } -- copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size); -+ copy_tsb(old_tsb_base, old_size, new_tsb_base, new_size, -+ tsb_index == MM_TSB_BASE ? -+ PAGE_SHIFT : REAL_HPAGE_SHIFT); - } - - mm->context.tsb_block[tsb_index].tsb = new_tsb; -diff --git a/arch/sparc/mm/ultra.S b/arch/sparc/mm/ultra.S -index 5d2fd6cd3189..fcf4d27a38fb 100644 ---- a/arch/sparc/mm/ultra.S -+++ b/arch/sparc/mm/ultra.S -@@ -971,11 +971,6 @@ xcall_capture: - wr %g0, (1 << PIL_SMP_CAPTURE), %set_softint - retry - -- .globl xcall_new_mmu_context_version --xcall_new_mmu_context_version: -- wr %g0, (1 << PIL_SMP_CTX_NEW_VERSION), %set_softint -- retry -- - #ifdef CONFIG_KGDB - .globl xcall_kgdb_capture - xcall_kgdb_capture: -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index 47190bd399e7..cec49ecf5f31 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -161,8 +161,8 @@ void kvm_async_pf_task_wait(u32 token) - */ - rcu_irq_exit(); - native_safe_halt(); -- rcu_irq_enter(); - local_irq_disable(); -+ rcu_irq_enter(); - } - } - if (!n.halted) -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 642e9c93a097..9357b29de9bc 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -737,18 +737,20 @@ out: - static int move_to_next_stateful_cpuid_entry(struct kvm_vcpu *vcpu, int i) - { - struct kvm_cpuid_entry2 *e = &vcpu->arch.cpuid_entries[i]; -- int j, nent = vcpu->arch.cpuid_nent; -+ struct kvm_cpuid_entry2 *ej; -+ int j = i; -+ int nent = vcpu->arch.cpuid_nent; - - e->flags &= ~KVM_CPUID_FLAG_STATE_READ_NEXT; - /* when no next entry is found, the current entry[i] is reselected */ -- for (j = i + 1; ; j = (j + 1) % nent) { -- struct kvm_cpuid_entry2 *ej = &vcpu->arch.cpuid_entries[j]; -- if (ej->function == e->function) { -- ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; -- return j; -- } -- } -- return 0; /* silence gcc, even though control never reaches here */ -+ do { -+ j = (j + 1) % nent; -+ ej = &vcpu->arch.cpuid_entries[j]; -+ } while (ej->function != e->function); -+ -+ ej->flags |= KVM_CPUID_FLAG_STATE_READ_NEXT; -+ -+ return j; - } - - /* find an entry with matching function, matching index (if needed), and that -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 8eb8a934b531..1049c3c9b877 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -3433,12 +3433,15 @@ static int kvm_arch_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn) - return kvm_setup_async_pf(vcpu, gva, kvm_vcpu_gfn_to_hva(vcpu, gfn), &arch); - } - --static bool can_do_async_pf(struct kvm_vcpu *vcpu) -+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu) - { - if (unlikely(!lapic_in_kernel(vcpu) || - kvm_event_needs_reinjection(vcpu))) - return false; - -+ if (is_guest_mode(vcpu)) -+ return false; -+ - return kvm_x86_ops->interrupt_allowed(vcpu); - } - -@@ -3454,7 +3457,7 @@ static bool try_async_pf(struct kvm_vcpu *vcpu, bool prefault, gfn_t gfn, - if (!async) - return false; /* *pfn has correct page already */ - -- if (!prefault && can_do_async_pf(vcpu)) { -+ if (!prefault && kvm_can_do_async_pf(vcpu)) { - trace_kvm_try_async_get_page(gva, gfn); - if (kvm_find_async_pf_gfn(vcpu, gfn)) { - trace_kvm_async_pf_doublefault(gva, gfn); -diff --git a/arch/x86/kvm/mmu.h b/arch/x86/kvm/mmu.h -index 55ffb7b0f95e..e60fc80f8a9c 100644 ---- a/arch/x86/kvm/mmu.h -+++ b/arch/x86/kvm/mmu.h -@@ -74,6 +74,7 @@ enum { - int handle_mmio_page_fault(struct kvm_vcpu *vcpu, u64 addr, bool direct); - void kvm_init_shadow_mmu(struct kvm_vcpu *vcpu); - void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly); -+bool kvm_can_do_async_pf(struct kvm_vcpu *vcpu); - - static inline unsigned int kvm_mmu_available_pages(struct kvm *kvm) - { -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index ae2b9cd358f2..6c82792487e9 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -8245,8 +8245,7 @@ bool kvm_arch_can_inject_async_page_present(struct kvm_vcpu *vcpu) - if (!(vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED)) - return true; - else -- return !kvm_event_needs_reinjection(vcpu) && -- kvm_x86_ops->interrupt_allowed(vcpu); -+ return kvm_can_do_async_pf(vcpu); - } - - void kvm_arch_start_assignment(struct kvm *kvm) -diff --git a/crypto/gcm.c b/crypto/gcm.c -index 1238b3c5a321..0a12c09d7cb2 100644 ---- a/crypto/gcm.c -+++ b/crypto/gcm.c -@@ -152,10 +152,8 @@ static int crypto_gcm_setkey(struct crypto_aead *aead, const u8 *key, - - err = crypto_ablkcipher_encrypt(&data->req); - if (err == -EINPROGRESS || err == -EBUSY) { -- err = wait_for_completion_interruptible( -- &data->result.completion); -- if (!err) -- err = data->result.err; -+ wait_for_completion(&data->result.completion); -+ err = data->result.err; - } - - if (err) -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 0975d23031ea..2898d19fadf5 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -346,7 +346,7 @@ static int mmap_mem(struct file *file, struct vm_area_struct *vma) - phys_addr_t offset = (phys_addr_t)vma->vm_pgoff << PAGE_SHIFT; - - /* It's illegal to wrap around the end of the physical address space. */ -- if (offset + (phys_addr_t)size < offset) -+ if (offset + (phys_addr_t)size - 1 < offset) - return -EINVAL; - - if (!valid_mmap_phys_addr_range(vma->vm_pgoff, size)) -diff --git a/drivers/char/random.c b/drivers/char/random.c -index 491a4dce13fe..1822472dffab 100644 ---- a/drivers/char/random.c -+++ b/drivers/char/random.c -@@ -1798,13 +1798,15 @@ int random_int_secret_init(void) - return 0; - } - -+static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash) -+ __aligned(sizeof(unsigned long)); -+ - /* - * Get a random word for internal kernel use only. Similar to urandom but - * with the goal of minimal entropy pool depletion. As a result, the random - * value is not cryptographically secure but for several uses the cost of - * depleting entropy is too high - */ --static DEFINE_PER_CPU(__u32 [MD5_DIGEST_WORDS], get_random_int_hash); - unsigned int get_random_int(void) - { - __u32 *hash; -@@ -1825,6 +1827,28 @@ unsigned int get_random_int(void) - EXPORT_SYMBOL(get_random_int); - - /* -+ * Same as get_random_int(), but returns unsigned long. -+ */ -+unsigned long get_random_long(void) -+{ -+ __u32 *hash; -+ unsigned long ret; -+ -+ if (arch_get_random_long(&ret)) -+ return ret; -+ -+ hash = get_cpu_var(get_random_int_hash); -+ -+ hash[0] += current->pid + jiffies + random_get_entropy(); -+ md5_transform(hash, random_int_secret); -+ ret = *(unsigned long *)hash; -+ put_cpu_var(get_random_int_hash); -+ -+ return ret; -+} -+EXPORT_SYMBOL(get_random_long); -+ -+/* - * randomize_range() returns a start address such that - * - * [...... .....] -diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c -index 38b363f4316b..ebed319657e7 100644 ---- a/drivers/cpufreq/cpufreq.c -+++ b/drivers/cpufreq/cpufreq.c -@@ -2451,6 +2451,7 @@ int cpufreq_register_driver(struct cpufreq_driver *driver_data) - if (!(cpufreq_driver->flags & CPUFREQ_STICKY) && - list_empty(&cpufreq_policy_list)) { - /* if all ->init() calls failed, unregister */ -+ ret = -ENODEV; - pr_debug("%s: No CPU initialized for driver %s\n", __func__, - driver_data->name); - goto err_if_unreg; -diff --git a/drivers/dma/ep93xx_dma.c b/drivers/dma/ep93xx_dma.c -index 57ff46284f15..c97336a2ba92 100644 ---- a/drivers/dma/ep93xx_dma.c -+++ b/drivers/dma/ep93xx_dma.c -@@ -325,6 +325,8 @@ static int m2p_hw_setup(struct ep93xx_dma_chan *edmac) - | M2P_CONTROL_ENABLE; - m2p_set_control(edmac, control); - -+ edmac->buffer = 0; -+ - return 0; - } - -diff --git a/drivers/dma/sh/usb-dmac.c b/drivers/dma/sh/usb-dmac.c -index b1bc945f008f..56410ea75ac5 100644 ---- a/drivers/dma/sh/usb-dmac.c -+++ b/drivers/dma/sh/usb-dmac.c -@@ -117,7 +117,7 @@ struct usb_dmac { - #define USB_DMASWR 0x0008 - #define USB_DMASWR_SWR (1 << 0) - #define USB_DMAOR 0x0060 --#define USB_DMAOR_AE (1 << 2) -+#define USB_DMAOR_AE (1 << 1) - #define USB_DMAOR_DME (1 << 0) - - #define USB_DMASAR 0x0000 -diff --git a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c -index 57a2e347f04d..0f0094b58d1f 100644 ---- a/drivers/gpu/drm/amd/amdgpu/ci_dpm.c -+++ b/drivers/gpu/drm/amd/amdgpu/ci_dpm.c -@@ -893,6 +893,12 @@ static bool ci_dpm_vblank_too_short(struct amdgpu_device *adev) - u32 vblank_time = amdgpu_dpm_get_vblank_time(adev); - u32 switch_limit = adev->mc.vram_type == AMDGPU_VRAM_TYPE_GDDR5 ? 450 : 300; - -+ /* disable mclk switching if the refresh is >120Hz, even if the -+ * blanking period would allow it -+ */ -+ if (amdgpu_dpm_get_vrefresh(adev) > 120) -+ return true; -+ - if (vblank_time < switch_limit) - return true; - else -diff --git a/drivers/gpu/drm/msm/msm_drv.c b/drivers/gpu/drm/msm/msm_drv.c -index b88ce514eb8e..24d45fc7716c 100644 ---- a/drivers/gpu/drm/msm/msm_drv.c -+++ b/drivers/gpu/drm/msm/msm_drv.c -@@ -986,6 +986,7 @@ static struct drm_driver msm_driver = { - .prime_fd_to_handle = drm_gem_prime_fd_to_handle, - .gem_prime_export = drm_gem_prime_export, - .gem_prime_import = drm_gem_prime_import, -+ .gem_prime_res_obj = msm_gem_prime_res_obj, - .gem_prime_pin = msm_gem_prime_pin, - .gem_prime_unpin = msm_gem_prime_unpin, - .gem_prime_get_sg_table = msm_gem_prime_get_sg_table, -diff --git a/drivers/gpu/drm/msm/msm_drv.h b/drivers/gpu/drm/msm/msm_drv.h -index 3be7a56b14f1..026e156e519c 100644 ---- a/drivers/gpu/drm/msm/msm_drv.h -+++ b/drivers/gpu/drm/msm/msm_drv.h -@@ -212,6 +212,7 @@ struct sg_table *msm_gem_prime_get_sg_table(struct drm_gem_object *obj); - void *msm_gem_prime_vmap(struct drm_gem_object *obj); - void msm_gem_prime_vunmap(struct drm_gem_object *obj, void *vaddr); - int msm_gem_prime_mmap(struct drm_gem_object *obj, struct vm_area_struct *vma); -+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj); - struct drm_gem_object *msm_gem_prime_import_sg_table(struct drm_device *dev, - struct dma_buf_attachment *attach, struct sg_table *sg); - int msm_gem_prime_pin(struct drm_gem_object *obj); -diff --git a/drivers/gpu/drm/msm/msm_gem_prime.c b/drivers/gpu/drm/msm/msm_gem_prime.c -index 121975b07cd4..1fbddc5c7281 100644 ---- a/drivers/gpu/drm/msm/msm_gem_prime.c -+++ b/drivers/gpu/drm/msm/msm_gem_prime.c -@@ -70,3 +70,10 @@ void msm_gem_prime_unpin(struct drm_gem_object *obj) - if (!obj->import_attach) - msm_gem_put_pages(obj); - } -+ -+struct reservation_object *msm_gem_prime_res_obj(struct drm_gem_object *obj) -+{ -+ struct msm_gem_object *msm_obj = to_msm_bo(obj); -+ -+ return msm_obj->resv; -+} -diff --git a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h -index 82d3e28918fd..7e4f24ae7de8 100644 ---- a/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h -+++ b/drivers/gpu/drm/nouveau/include/nvkm/subdev/timer.h -@@ -4,6 +4,7 @@ - - struct nvkm_alarm { - struct list_head head; -+ struct list_head exec; - u64 timestamp; - void (*func)(struct nvkm_alarm *); - }; -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -index 79fcdb43e174..46033909d950 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/timer/base.c -@@ -50,7 +50,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr) - /* Move to completed list. We'll drop the lock before - * executing the callback so it can reschedule itself. - */ -- list_move_tail(&alarm->head, &exec); -+ list_del_init(&alarm->head); -+ list_add(&alarm->exec, &exec); - } - - /* Shut down interrupt if no more pending alarms. */ -@@ -59,8 +60,8 @@ nvkm_timer_alarm_trigger(struct nvkm_timer *tmr) - spin_unlock_irqrestore(&tmr->lock, flags); - - /* Execute completed callbacks. */ -- list_for_each_entry_safe(alarm, atemp, &exec, head) { -- list_del_init(&alarm->head); -+ list_for_each_entry_safe(alarm, atemp, &exec, exec) { -+ list_del(&alarm->exec); - alarm->func(alarm); - } - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c -index b6a0806b06bf..a1c68e6a689e 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c -@@ -368,6 +368,8 @@ static void *vmw_local_fifo_reserve(struct vmw_private *dev_priv, - return fifo_state->static_buffer; - else { - fifo_state->dynamic_buffer = vmalloc(bytes); -+ if (!fifo_state->dynamic_buffer) -+ goto out_err; - return fifo_state->dynamic_buffer; - } - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -index c9c04ccccdd9..027987023400 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_surface.c -@@ -1288,11 +1288,14 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, - struct ttm_object_file *tfile = vmw_fpriv(file_priv)->tfile; - int ret; - uint32_t size; -- uint32_t backup_handle; -+ uint32_t backup_handle = 0; - - if (req->multisample_count != 0) - return -EINVAL; - -+ if (req->mip_levels > DRM_VMW_MAX_MIP_LEVELS) -+ return -EINVAL; -+ - if (unlikely(vmw_user_surface_size == 0)) - vmw_user_surface_size = ttm_round_pot(sizeof(*user_srf)) + - 128; -@@ -1328,12 +1331,16 @@ int vmw_gb_surface_define_ioctl(struct drm_device *dev, void *data, - ret = vmw_user_dmabuf_lookup(tfile, req->buffer_handle, - &res->backup, - &user_srf->backup_base); -- if (ret == 0 && res->backup->base.num_pages * PAGE_SIZE < -- res->backup_size) { -- DRM_ERROR("Surface backup buffer is too small.\n"); -- vmw_dmabuf_unreference(&res->backup); -- ret = -EINVAL; -- goto out_unlock; -+ if (ret == 0) { -+ if (res->backup->base.num_pages * PAGE_SIZE < -+ res->backup_size) { -+ DRM_ERROR("Surface backup buffer is too small.\n"); -+ vmw_dmabuf_unreference(&res->backup); -+ ret = -EINVAL; -+ goto out_unlock; -+ } else { -+ backup_handle = req->buffer_handle; -+ } - } - } else if (req->drm_surface_flags & drm_vmw_surface_flag_create_buffer) - ret = vmw_user_dmabuf_alloc(dev_priv, tfile, -diff --git a/drivers/iio/light/ltr501.c b/drivers/iio/light/ltr501.c -index 6bf89d8f3741..b9d1e5c58ec5 100644 ---- a/drivers/iio/light/ltr501.c -+++ b/drivers/iio/light/ltr501.c -@@ -74,9 +74,9 @@ static const int int_time_mapping[] = {100000, 50000, 200000, 400000}; - static const struct reg_field reg_field_it = - REG_FIELD(LTR501_ALS_MEAS_RATE, 3, 4); - static const struct reg_field reg_field_als_intr = -- REG_FIELD(LTR501_INTR, 0, 0); --static const struct reg_field reg_field_ps_intr = - REG_FIELD(LTR501_INTR, 1, 1); -+static const struct reg_field reg_field_ps_intr = -+ REG_FIELD(LTR501_INTR, 0, 0); - static const struct reg_field reg_field_als_rate = - REG_FIELD(LTR501_ALS_MEAS_RATE, 0, 2); - static const struct reg_field reg_field_ps_rate = -diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c -index bf0bd7e03aff..9e6d1cdb7fcd 100644 ---- a/drivers/iio/proximity/as3935.c -+++ b/drivers/iio/proximity/as3935.c -@@ -40,9 +40,9 @@ - #define AS3935_AFE_PWR_BIT BIT(0) - - #define AS3935_INT 0x03 --#define AS3935_INT_MASK 0x07 -+#define AS3935_INT_MASK 0x0f - #define AS3935_EVENT_INT BIT(3) --#define AS3935_NOISE_INT BIT(1) -+#define AS3935_NOISE_INT BIT(0) - - #define AS3935_DATA 0x07 - #define AS3935_DATA_MASK 0x3F -diff --git a/drivers/infiniband/hw/qib/qib_rc.c b/drivers/infiniband/hw/qib/qib_rc.c -index e6b7556d5221..cbc4216091c9 100644 ---- a/drivers/infiniband/hw/qib/qib_rc.c -+++ b/drivers/infiniband/hw/qib/qib_rc.c -@@ -2088,8 +2088,10 @@ send_last: - ret = qib_get_rwqe(qp, 1); - if (ret < 0) - goto nack_op_err; -- if (!ret) -+ if (!ret) { -+ qib_put_ss(&qp->r_sge); - goto rnr_nak; -+ } - wc.ex.imm_data = ohdr->u.rc.imm_data; - hdrsize += 4; - wc.wc_flags = IB_WC_WITH_IMM; -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 1a2b2620421e..6f4dc0fd2ca3 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1122,8 +1122,10 @@ static int elantech_get_resolution_v4(struct psmouse *psmouse, - * Asus UX32VD 0x361f02 00, 15, 0e clickpad - * Avatar AVIU-145A2 0x361f00 ? clickpad - * Fujitsu LIFEBOOK E544 0x470f00 d0, 12, 09 2 hw buttons -+ * Fujitsu LIFEBOOK E546 0x470f00 50, 12, 09 2 hw buttons - * Fujitsu LIFEBOOK E547 0x470f00 50, 12, 09 2 hw buttons - * Fujitsu LIFEBOOK E554 0x570f01 40, 14, 0c 2 hw buttons -+ * Fujitsu LIFEBOOK E557 0x570f01 40, 14, 0c 2 hw buttons - * Fujitsu T725 0x470f01 05, 12, 09 2 hw buttons - * Fujitsu H730 0x570f00 c0, 14, 0c 3 hw buttons (**) - * Gigabyte U2442 0x450f01 58, 17, 0c 2 hw buttons -@@ -1529,6 +1531,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = { - }, - }, - { -+ /* Fujitsu LIFEBOOK E546 does not work with crc_enabled == 0 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E546"), -+ }, -+ }, -+ { - /* Fujitsu LIFEBOOK E547 does not work with crc_enabled == 0 */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -@@ -1550,6 +1559,13 @@ static const struct dmi_system_id elantech_dmi_force_crc_enabled[] = { - }, - }, - { -+ /* Fujitsu LIFEBOOK E557 does not work with crc_enabled == 0 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK E557"), -+ }, -+ }, -+ { - /* Fujitsu LIFEBOOK U745 does not work with crc_enabled == 0 */ - .matches = { - DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c -index 783337d22f36..10a02934bfc0 100644 ---- a/drivers/misc/cxl/file.c -+++ b/drivers/misc/cxl/file.c -@@ -158,11 +158,8 @@ static long afu_ioctl_start_work(struct cxl_context *ctx, - - /* Do this outside the status_mutex to avoid a circular dependency with - * the locking in cxl_mmap_fault() */ -- if (copy_from_user(&work, uwork, -- sizeof(struct cxl_ioctl_start_work))) { -- rc = -EFAULT; -- goto out; -- } -+ if (copy_from_user(&work, uwork, sizeof(work))) -+ return -EFAULT; - - mutex_lock(&ctx->status_mutex); - if (ctx->status != OPENED) { -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -index c82ab87fcbe8..e5911ccb2148 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c -@@ -1949,7 +1949,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, - } - - /* select a non-FCoE queue */ -- return fallback(dev, skb) % BNX2X_NUM_ETH_QUEUES(bp); -+ return fallback(dev, skb) % (BNX2X_NUM_ETH_QUEUES(bp) * bp->max_cos); - } - - void bnx2x_set_num_queues(struct bnx2x *bp) -diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -index 0d147610a06f..090e00650601 100644 ---- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c -@@ -2714,10 +2714,14 @@ static int cxgb_up(struct adapter *adap) - if (err) - goto irq_err; - } -+ -+ mutex_lock(&uld_mutex); - enable_rx(adap); - t4_sge_start(adap); - t4_intr_enable(adap); - adap->flags |= FULL_INIT_DONE; -+ mutex_unlock(&uld_mutex); -+ - notify_ulds(adap, CXGB4_STATE_UP); - #if IS_ENABLED(CONFIG_IPV6) - update_clip(adap); -diff --git a/drivers/net/ethernet/ethoc.c b/drivers/net/ethernet/ethoc.c -index ff665493ca97..52f2230062e7 100644 ---- a/drivers/net/ethernet/ethoc.c -+++ b/drivers/net/ethernet/ethoc.c -@@ -713,6 +713,8 @@ static int ethoc_open(struct net_device *dev) - if (ret) - return ret; - -+ napi_enable(&priv->napi); -+ - ethoc_init_ring(priv, dev->mem_start); - ethoc_reset(priv); - -@@ -725,7 +727,6 @@ static int ethoc_open(struct net_device *dev) - } - - phy_start(priv->phy); -- napi_enable(&priv->napi); - - if (netif_msg_ifup(priv)) { - dev_info(&dev->dev, "I/O: %08lx Memory: %08lx-%08lx\n", -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 590750ab6564..9a986ccd42e5 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -77,6 +77,8 @@ static const u8 all_zeros_mac[ETH_ALEN]; - - static int vxlan_sock_add(struct vxlan_dev *vxlan); - -+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan); -+ - /* per-network namespace private data for this module */ - struct vxlan_net { - struct list_head vxlan_list; -@@ -1052,6 +1054,8 @@ static void __vxlan_sock_release(struct vxlan_sock *vs) - - static void vxlan_sock_release(struct vxlan_dev *vxlan) - { -+ vxlan_vs_del_dev(vxlan); -+ - __vxlan_sock_release(vxlan->vn4_sock); - #if IS_ENABLED(CONFIG_IPV6) - __vxlan_sock_release(vxlan->vn6_sock); -@@ -2255,6 +2259,15 @@ static void vxlan_cleanup(unsigned long arg) - mod_timer(&vxlan->age_timer, next_timer); - } - -+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan) -+{ -+ struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); -+ -+ spin_lock(&vn->sock_lock); -+ hlist_del_init_rcu(&vxlan->hlist); -+ spin_unlock(&vn->sock_lock); -+} -+ - static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan) - { - struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); -@@ -3028,12 +3041,6 @@ static int vxlan_newlink(struct net *src_net, struct net_device *dev, - static void vxlan_dellink(struct net_device *dev, struct list_head *head) - { - struct vxlan_dev *vxlan = netdev_priv(dev); -- struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); -- -- spin_lock(&vn->sock_lock); -- if (!hlist_unhashed(&vxlan->hlist)) -- hlist_del_rcu(&vxlan->hlist); -- spin_unlock(&vn->sock_lock); - - gro_cells_destroy(&vxlan->gro_cells); - list_del(&vxlan->next); -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 1f445f357da1..888e9cfef51a 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -304,7 +304,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue) - queue->rx_skbs[id] = skb; - - ref = gnttab_claim_grant_reference(&queue->gref_rx_head); -- BUG_ON((signed short)ref < 0); -+ WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); - queue->grant_rx_ref[id] = ref; - - page = skb_frag_page(&skb_shinfo(skb)->frags[0]); -@@ -437,7 +437,7 @@ static void xennet_tx_setup_grant(unsigned long gfn, unsigned int offset, - id = get_id_from_freelist(&queue->tx_skb_freelist, queue->tx_skbs); - tx = RING_GET_REQUEST(&queue->tx, queue->tx.req_prod_pvt++); - ref = gnttab_claim_grant_reference(&queue->gref_tx_head); -- BUG_ON((signed short)ref < 0); -+ WARN_ON_ONCE(IS_ERR_VALUE((unsigned long)(int)ref)); - - gnttab_grant_foreign_access_ref(ref, queue->info->xbdev->otherend_id, - gfn, GNTMAP_readonly); -diff --git a/drivers/scsi/qla2xxx/qla_os.c b/drivers/scsi/qla2xxx/qla_os.c -index 3588a56aabb4..5cbf20ab94aa 100644 ---- a/drivers/scsi/qla2xxx/qla_os.c -+++ b/drivers/scsi/qla2xxx/qla_os.c -@@ -2311,10 +2311,10 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - - if (mem_only) { - if (pci_enable_device_mem(pdev)) -- goto probe_out; -+ return ret; - } else { - if (pci_enable_device(pdev)) -- goto probe_out; -+ return ret; - } - - /* This may fail but that's ok */ -@@ -2324,7 +2324,7 @@ qla2x00_probe_one(struct pci_dev *pdev, const struct pci_device_id *id) - if (!ha) { - ql_log_pci(ql_log_fatal, pdev, 0x0009, - "Unable to allocate memory for ha.\n"); -- goto probe_out; -+ goto disable_device; - } - ql_dbg_pci(ql_dbg_init, pdev, 0x000a, - "Memory allocated for ha=%p.\n", ha); -@@ -2923,7 +2923,7 @@ iospace_config_failed: - kfree(ha); - ha = NULL; - --probe_out: -+disable_device: - pci_disable_device(pdev); - return ret; - } -diff --git a/drivers/staging/lustre/lustre/lov/lov_pack.c b/drivers/staging/lustre/lustre/lov/lov_pack.c -index 2fb1e974cc70..e11b1001d1f6 100644 ---- a/drivers/staging/lustre/lustre/lov/lov_pack.c -+++ b/drivers/staging/lustre/lustre/lov/lov_pack.c -@@ -399,18 +399,10 @@ int lov_getstripe(struct obd_export *exp, struct lov_stripe_md *lsm, - struct lov_mds_md *lmmk = NULL; - int rc, lmm_size; - int lum_size; -- mm_segment_t seg; - - if (!lsm) - return -ENODATA; - -- /* -- * "Switch to kernel segment" to allow copying from kernel space by -- * copy_{to,from}_user(). -- */ -- seg = get_fs(); -- set_fs(KERNEL_DS); -- - /* we only need the header part from user space to get lmm_magic and - * lmm_stripe_count, (the header part is common to v1 and v3) */ - lum_size = sizeof(struct lov_user_md_v1); -@@ -485,6 +477,5 @@ int lov_getstripe(struct obd_export *exp, struct lov_stripe_md *lsm, - - obd_free_diskmd(exp, &lmmk); - out_set: -- set_fs(seg); - return rc; - } -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index af301414a9f3..60743bf27f37 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1154,15 +1154,28 @@ target_cmd_size_check(struct se_cmd *cmd, unsigned int size) - if (cmd->unknown_data_length) { - cmd->data_length = size; - } else if (size != cmd->data_length) { -- pr_warn("TARGET_CORE[%s]: Expected Transfer Length:" -+ pr_warn_ratelimited("TARGET_CORE[%s]: Expected Transfer Length:" - " %u does not match SCSI CDB Length: %u for SAM Opcode:" - " 0x%02x\n", cmd->se_tfo->get_fabric_name(), - cmd->data_length, size, cmd->t_task_cdb[0]); - -- if (cmd->data_direction == DMA_TO_DEVICE && -- cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { -- pr_err("Rejecting underflow/overflow WRITE data\n"); -- return TCM_INVALID_CDB_FIELD; -+ if (cmd->data_direction == DMA_TO_DEVICE) { -+ if (cmd->se_cmd_flags & SCF_SCSI_DATA_CDB) { -+ pr_err_ratelimited("Rejecting underflow/overflow" -+ " for WRITE data CDB\n"); -+ return TCM_INVALID_CDB_FIELD; -+ } -+ /* -+ * Some fabric drivers like iscsi-target still expect to -+ * always reject overflow writes. Reject this case until -+ * full fabric driver level support for overflow writes -+ * is introduced tree-wide. -+ */ -+ if (size > cmd->data_length) { -+ pr_err_ratelimited("Rejecting overflow for" -+ " WRITE control CDB\n"); -+ return TCM_INVALID_CDB_FIELD; -+ } - } - /* - * Reject READ_* or WRITE_* with overflow/underflow for -diff --git a/drivers/tty/serial/ifx6x60.c b/drivers/tty/serial/ifx6x60.c -index 88246f7e435a..0f23dda60011 100644 ---- a/drivers/tty/serial/ifx6x60.c -+++ b/drivers/tty/serial/ifx6x60.c -@@ -1378,9 +1378,9 @@ static struct spi_driver ifx_spi_driver = { - static void __exit ifx_spi_exit(void) - { - /* unregister */ -+ spi_unregister_driver(&ifx_spi_driver); - tty_unregister_driver(tty_drv); - put_tty_driver(tty_drv); -- spi_unregister_driver(&ifx_spi_driver); - unregister_reboot_notifier(&ifx_modem_reboot_notifier_block); - } - -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 63a06ab6ba03..235e150d7b81 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -1800,11 +1800,13 @@ static int sci_startup(struct uart_port *port) - - dev_dbg(port->dev, "%s(%d)\n", __func__, port->line); - -+ sci_request_dma(port); -+ - ret = sci_request_irq(s); -- if (unlikely(ret < 0)) -+ if (unlikely(ret < 0)) { -+ sci_free_dma(port); - return ret; -- -- sci_request_dma(port); -+ } - - spin_lock_irqsave(&port->lock, flags); - sci_start_tx(port); -@@ -1834,8 +1836,8 @@ static void sci_shutdown(struct uart_port *port) - } - #endif - -- sci_free_dma(port); - sci_free_irq(s); -+ sci_free_dma(port); - } - - static unsigned int sci_scbrr_calc(struct sci_port *s, unsigned int bps, -diff --git a/drivers/tty/tty_io.c b/drivers/tty/tty_io.c -index 7cef54334b12..1bb629ab8ecc 100644 ---- a/drivers/tty/tty_io.c -+++ b/drivers/tty/tty_io.c -@@ -2070,13 +2070,12 @@ retry_open: - if (tty) { - mutex_unlock(&tty_mutex); - retval = tty_lock_interruptible(tty); -+ tty_kref_put(tty); /* drop kref from tty_driver_lookup_tty() */ - if (retval) { - if (retval == -EINTR) - retval = -ERESTARTSYS; - goto err_unref; - } -- /* safe to drop the kref from tty_driver_lookup_tty() */ -- tty_kref_put(tty); - retval = tty_reopen(tty); - if (retval < 0) { - tty_unlock(tty); -diff --git a/drivers/tty/tty_mutex.c b/drivers/tty/tty_mutex.c -index d09293bc0e04..cff304abb619 100644 ---- a/drivers/tty/tty_mutex.c -+++ b/drivers/tty/tty_mutex.c -@@ -24,10 +24,15 @@ EXPORT_SYMBOL(tty_lock); - - int tty_lock_interruptible(struct tty_struct *tty) - { -+ int ret; -+ - if (WARN(tty->magic != TTY_MAGIC, "L Bad %p\n", tty)) - return -EIO; - tty_kref_get(tty); -- return mutex_lock_interruptible(&tty->legacy_mutex); -+ ret = mutex_lock_interruptible(&tty->legacy_mutex); -+ if (ret) -+ tty_kref_put(tty); -+ return ret; - } - - void __lockfunc tty_unlock(struct tty_struct *tty) -diff --git a/drivers/usb/chipidea/debug.c b/drivers/usb/chipidea/debug.c -index 58c8485a0715..923379972707 100644 ---- a/drivers/usb/chipidea/debug.c -+++ b/drivers/usb/chipidea/debug.c -@@ -295,7 +295,8 @@ static int ci_role_show(struct seq_file *s, void *data) - { - struct ci_hdrc *ci = s->private; - -- seq_printf(s, "%s\n", ci_role(ci)->name); -+ if (ci->role != CI_ROLE_END) -+ seq_printf(s, "%s\n", ci_role(ci)->name); - - return 0; - } -diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c -index d8a045fc1fdb..aff086ca97e4 100644 ---- a/drivers/usb/chipidea/udc.c -+++ b/drivers/usb/chipidea/udc.c -@@ -1982,6 +1982,7 @@ static void udc_id_switch_for_host(struct ci_hdrc *ci) - int ci_hdrc_gadget_init(struct ci_hdrc *ci) - { - struct ci_role_driver *rdrv; -+ int ret; - - if (!hw_read(ci, CAP_DCCPARAMS, DCCPARAMS_DC)) - return -ENXIO; -@@ -1994,7 +1995,10 @@ int ci_hdrc_gadget_init(struct ci_hdrc *ci) - rdrv->stop = udc_id_switch_for_host; - rdrv->irq = udc_irq; - rdrv->name = "gadget"; -- ci->roles[CI_ROLE_GADGET] = rdrv; - -- return udc_start(ci); -+ ret = udc_start(ci); -+ if (!ret) -+ ci->roles[CI_ROLE_GADGET] = rdrv; -+ -+ return ret; - } -diff --git a/drivers/usb/gadget/function/f_mass_storage.c b/drivers/usb/gadget/function/f_mass_storage.c -index a4f664062e0c..a069726da72a 100644 ---- a/drivers/usb/gadget/function/f_mass_storage.c -+++ b/drivers/usb/gadget/function/f_mass_storage.c -@@ -399,7 +399,11 @@ static int fsg_set_halt(struct fsg_dev *fsg, struct usb_ep *ep) - /* Caller must hold fsg->lock */ - static void wakeup_thread(struct fsg_common *common) - { -- smp_wmb(); /* ensure the write of bh->state is complete */ -+ /* -+ * Ensure the reading of thread_wakeup_needed -+ * and the writing of bh->state are completed -+ */ -+ smp_mb(); - /* Tell the main thread that something has happened */ - common->thread_wakeup_needed = 1; - if (common->thread_task) -@@ -630,7 +634,12 @@ static int sleep_thread(struct fsg_common *common, bool can_freeze) - } - __set_current_state(TASK_RUNNING); - common->thread_wakeup_needed = 0; -- smp_rmb(); /* ensure the latest bh->state is visible */ -+ -+ /* -+ * Ensure the writing of thread_wakeup_needed -+ * and the reading of bh->state are completed -+ */ -+ smp_mb(); - return rc; - } - -diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c -index df2e6f783318..527de56f832f 100644 ---- a/drivers/xen/privcmd.c -+++ b/drivers/xen/privcmd.c -@@ -335,8 +335,8 @@ static int mmap_batch_fn(void *data, int nr, void *state) - st->global_error = 1; - } - } -- st->va += PAGE_SIZE * nr; -- st->index += nr; -+ st->va += XEN_PAGE_SIZE * nr; -+ st->index += nr / XEN_PFN_PER_PAGE; - - return 0; - } -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index 2a2e370399ba..c36a03fa7678 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -3854,6 +3854,7 @@ static int update_space_info(struct btrfs_fs_info *info, u64 flags, - info->space_info_kobj, "%s", - alloc_name(found->flags)); - if (ret) { -+ percpu_counter_destroy(&found->total_bytes_pinned); - kfree(found); - return ret; - } -diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c -index 353f4bae658c..d4a6eef31854 100644 ---- a/fs/btrfs/file.c -+++ b/fs/btrfs/file.c -@@ -2771,7 +2771,7 @@ static long btrfs_fallocate(struct file *file, int mode, - if (!ret) - ret = btrfs_prealloc_file_range(inode, mode, - range->start, -- range->len, 1 << inode->i_blkbits, -+ range->len, i_blocksize(inode), - offset + len, &alloc_hint); - list_del(&range->list); - kfree(range); -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 3cff6523f27d..863fa0f1972b 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -7318,8 +7318,8 @@ bool btrfs_page_exists_in_range(struct inode *inode, loff_t start, loff_t end) - int found = false; - void **pagep = NULL; - struct page *page = NULL; -- int start_idx; -- int end_idx; -+ unsigned long start_idx; -+ unsigned long end_idx; - - start_idx = start >> PAGE_CACHE_SHIFT; - -diff --git a/fs/buffer.c b/fs/buffer.c -index 4f4cd959da7c..6f7d519a093b 100644 ---- a/fs/buffer.c -+++ b/fs/buffer.c -@@ -2298,7 +2298,7 @@ static int cont_expand_zero(struct file *file, struct address_space *mapping, - loff_t pos, loff_t *bytes) - { - struct inode *inode = mapping->host; -- unsigned blocksize = 1 << inode->i_blkbits; -+ unsigned int blocksize = i_blocksize(inode); - struct page *page; - void *fsdata; - pgoff_t index, curidx; -@@ -2378,8 +2378,8 @@ int cont_write_begin(struct file *file, struct address_space *mapping, - get_block_t *get_block, loff_t *bytes) - { - struct inode *inode = mapping->host; -- unsigned blocksize = 1 << inode->i_blkbits; -- unsigned zerofrom; -+ unsigned int blocksize = i_blocksize(inode); -+ unsigned int zerofrom; - int err; - - err = cont_expand_zero(file, mapping, pos, bytes); -@@ -2741,7 +2741,7 @@ int nobh_truncate_page(struct address_space *mapping, - struct buffer_head map_bh; - int err; - -- blocksize = 1 << inode->i_blkbits; -+ blocksize = i_blocksize(inode); - length = offset & (blocksize - 1); - - /* Block boundary? Nothing to do */ -@@ -2819,7 +2819,7 @@ int block_truncate_page(struct address_space *mapping, - struct buffer_head *bh; - int err; - -- blocksize = 1 << inode->i_blkbits; -+ blocksize = i_blocksize(inode); - length = offset & (blocksize - 1); - - /* Block boundary? Nothing to do */ -@@ -2931,7 +2931,7 @@ sector_t generic_block_bmap(struct address_space *mapping, sector_t block, - struct inode *inode = mapping->host; - tmp.b_state = 0; - tmp.b_blocknr = 0; -- tmp.b_size = 1 << inode->i_blkbits; -+ tmp.b_size = i_blocksize(inode); - get_block(inode, block, &tmp, 0); - return tmp.b_blocknr; - } -diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c -index b7d218a168fb..c6a1ec110c01 100644 ---- a/fs/ceph/addr.c -+++ b/fs/ceph/addr.c -@@ -697,7 +697,7 @@ static int ceph_writepages_start(struct address_space *mapping, - struct pagevec pvec; - int done = 0; - int rc = 0; -- unsigned wsize = 1 << inode->i_blkbits; -+ unsigned int wsize = i_blocksize(inode); - struct ceph_osd_request *req = NULL; - int do_sync = 0; - loff_t snap_size, i_size; -diff --git a/fs/direct-io.c b/fs/direct-io.c -index 01171d8a6ee9..c772fdf36cd9 100644 ---- a/fs/direct-io.c -+++ b/fs/direct-io.c -@@ -575,7 +575,7 @@ static int dio_set_defer_completion(struct dio *dio) - /* - * Call into the fs to map some more disk blocks. We record the current number - * of available blocks at sdio->blocks_available. These are in units of the -- * fs blocksize, (1 << inode->i_blkbits). -+ * fs blocksize, i_blocksize(inode). - * - * The fs is allowed to map lots of blocks at once. If it wants to do that, - * it uses the passed inode-relative block number as the file offset, as usual. -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 8a456f9b8a44..61d5bfc7318c 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4902,6 +4902,8 @@ static long ext4_zero_range(struct file *file, loff_t offset, - - /* Zero out partial block at the edges of the range */ - ret = ext4_zero_partial_blocks(handle, inode, offset, len); -+ if (ret >= 0) -+ ext4_update_inode_fsync_trans(handle, inode, 1); - - if (file->f_flags & O_SYNC) - ext4_handle_sync(handle); -@@ -5597,6 +5599,7 @@ int ext4_collapse_range(struct inode *inode, loff_t offset, loff_t len) - ext4_handle_sync(handle); - inode->i_mtime = inode->i_ctime = ext4_current_time(inode); - ext4_mark_inode_dirty(handle, inode); -+ ext4_update_inode_fsync_trans(handle, inode, 1); - - out_stop: - ext4_journal_stop(handle); -@@ -5770,6 +5773,8 @@ int ext4_insert_range(struct inode *inode, loff_t offset, loff_t len) - up_write(&EXT4_I(inode)->i_data_sem); - if (IS_SYNC(inode)) - ext4_handle_sync(handle); -+ if (ret >= 0) -+ ext4_update_inode_fsync_trans(handle, inode, 1); - - out_stop: - ext4_journal_stop(handle); -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 0d24ebcd7c9e..8772bfc3415b 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -463,47 +463,27 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, - num = min_t(pgoff_t, end - index, PAGEVEC_SIZE); - nr_pages = pagevec_lookup(&pvec, inode->i_mapping, index, - (pgoff_t)num); -- if (nr_pages == 0) { -- if (whence == SEEK_DATA) -- break; -- -- BUG_ON(whence != SEEK_HOLE); -- /* -- * If this is the first time to go into the loop and -- * offset is not beyond the end offset, it will be a -- * hole at this offset -- */ -- if (lastoff == startoff || lastoff < endoff) -- found = 1; -+ if (nr_pages == 0) - break; -- } -- -- /* -- * If this is the first time to go into the loop and -- * offset is smaller than the first page offset, it will be a -- * hole at this offset. -- */ -- if (lastoff == startoff && whence == SEEK_HOLE && -- lastoff < page_offset(pvec.pages[0])) { -- found = 1; -- break; -- } - - for (i = 0; i < nr_pages; i++) { - struct page *page = pvec.pages[i]; - struct buffer_head *bh, *head; - - /* -- * If the current offset is not beyond the end of given -- * range, it will be a hole. -+ * If current offset is smaller than the page offset, -+ * there is a hole at this offset. - */ -- if (lastoff < endoff && whence == SEEK_HOLE && -- page->index > end) { -+ if (whence == SEEK_HOLE && lastoff < endoff && -+ lastoff < page_offset(pvec.pages[i])) { - found = 1; - *offset = lastoff; - goto out; - } - -+ if (page->index > end) -+ goto out; -+ - lock_page(page); - - if (unlikely(page->mapping != inode->i_mapping)) { -@@ -543,20 +523,18 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, - unlock_page(page); - } - -- /* -- * The no. of pages is less than our desired, that would be a -- * hole in there. -- */ -- if (nr_pages < num && whence == SEEK_HOLE) { -- found = 1; -- *offset = lastoff; -+ /* The no. of pages is less than our desired, we are done. */ -+ if (nr_pages < num) - break; -- } - - index = pvec.pages[i - 1]->index + 1; - pagevec_release(&pvec); - } while (index <= end); - -+ if (whence == SEEK_HOLE && lastoff < endoff) { -+ found = 1; -+ *offset = lastoff; -+ } - out: - pagevec_release(&pvec); - return found; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index ccae64dad40c..1796d1bd9a1d 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -2044,7 +2044,7 @@ static int mpage_process_page_bufs(struct mpage_da_data *mpd, - { - struct inode *inode = mpd->inode; - int err; -- ext4_lblk_t blocks = (i_size_read(inode) + (1 << inode->i_blkbits) - 1) -+ ext4_lblk_t blocks = (i_size_read(inode) + i_blocksize(inode) - 1) - >> inode->i_blkbits; - - do { -@@ -3793,6 +3793,8 @@ int ext4_punch_hole(struct inode *inode, loff_t offset, loff_t length) - - inode->i_mtime = inode->i_ctime = ext4_current_time(inode); - ext4_mark_inode_dirty(handle, inode); -+ if (ret >= 0) -+ ext4_update_inode_fsync_trans(handle, inode, 1); - out_stop: - ext4_journal_stop(handle); - out_dio: -@@ -5162,8 +5164,9 @@ static int ext4_expand_extra_isize(struct inode *inode, - /* No extended attributes present */ - if (!ext4_test_inode_state(inode, EXT4_STATE_XATTR) || - header->h_magic != cpu_to_le32(EXT4_XATTR_MAGIC)) { -- memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE, 0, -- new_extra_isize); -+ memset((void *)raw_inode + EXT4_GOOD_OLD_INODE_SIZE + -+ EXT4_I(inode)->i_extra_isize, 0, -+ new_extra_isize - EXT4_I(inode)->i_extra_isize); - EXT4_I(inode)->i_extra_isize = new_extra_isize; - return 0; - } -diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c -index 7861d801b048..05048fcfd602 100644 ---- a/fs/ext4/move_extent.c -+++ b/fs/ext4/move_extent.c -@@ -187,7 +187,7 @@ mext_page_mkuptodate(struct page *page, unsigned from, unsigned to) - if (PageUptodate(page)) - return 0; - -- blocksize = 1 << inode->i_blkbits; -+ blocksize = i_blocksize(inode); - if (!page_has_buffers(page)) - create_empty_buffers(page, blocksize, 0); - -diff --git a/fs/jfs/super.c b/fs/jfs/super.c -index 8f9176caf098..c8d58c5ac8ae 100644 ---- a/fs/jfs/super.c -+++ b/fs/jfs/super.c -@@ -758,7 +758,7 @@ static ssize_t jfs_quota_read(struct super_block *sb, int type, char *data, - sb->s_blocksize - offset : toread; - - tmp_bh.b_state = 0; -- tmp_bh.b_size = 1 << inode->i_blkbits; -+ tmp_bh.b_size = i_blocksize(inode); - err = jfs_get_block(inode, blk, &tmp_bh, 0); - if (err) - return err; -@@ -798,7 +798,7 @@ static ssize_t jfs_quota_write(struct super_block *sb, int type, - sb->s_blocksize - offset : towrite; - - tmp_bh.b_state = 0; -- tmp_bh.b_size = 1 << inode->i_blkbits; -+ tmp_bh.b_size = i_blocksize(inode); - err = jfs_get_block(inode, blk, &tmp_bh, 1); - if (err) - goto out; -diff --git a/fs/mpage.c b/fs/mpage.c -index 1480d3a18037..6ade29b19494 100644 ---- a/fs/mpage.c -+++ b/fs/mpage.c -@@ -111,7 +111,7 @@ map_buffer_to_page(struct page *page, struct buffer_head *bh, int page_block) - SetPageUptodate(page); - return; - } -- create_empty_buffers(page, 1 << inode->i_blkbits, 0); -+ create_empty_buffers(page, i_blocksize(inode), 0); - } - head = page_buffers(page); - page_bh = head; -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 52ee0b73ab4a..5b21b1ca2341 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -2421,6 +2421,20 @@ int nfs_may_open(struct inode *inode, struct rpc_cred *cred, int openflags) - } - EXPORT_SYMBOL_GPL(nfs_may_open); - -+static int nfs_execute_ok(struct inode *inode, int mask) -+{ -+ struct nfs_server *server = NFS_SERVER(inode); -+ int ret; -+ -+ if (mask & MAY_NOT_BLOCK) -+ ret = nfs_revalidate_inode_rcu(server, inode); -+ else -+ ret = nfs_revalidate_inode(server, inode); -+ if (ret == 0 && !execute_ok(inode)) -+ ret = -EACCES; -+ return ret; -+} -+ - int nfs_permission(struct inode *inode, int mask) - { - struct rpc_cred *cred; -@@ -2438,6 +2452,9 @@ int nfs_permission(struct inode *inode, int mask) - case S_IFLNK: - goto out; - case S_IFREG: -+ if ((mask & MAY_OPEN) && -+ nfs_server_capable(inode, NFS_CAP_ATOMIC_OPEN)) -+ return 0; - break; - case S_IFDIR: - /* -@@ -2470,8 +2487,8 @@ force_lookup: - res = PTR_ERR(cred); - } - out: -- if (!res && (mask & MAY_EXEC) && !execute_ok(inode)) -- res = -EACCES; -+ if (!res && (mask & MAY_EXEC)) -+ res = nfs_execute_ok(inode, mask); - - dfprintk(VFS, "NFS: permission(%s/%lu), mask=0x%x, res=%d\n", - inode->i_sb->s_id, inode->i_ino, mask, res); -diff --git a/fs/nfsd/blocklayout.c b/fs/nfsd/blocklayout.c -index c29d9421bd5e..0976f8dad4ce 100644 ---- a/fs/nfsd/blocklayout.c -+++ b/fs/nfsd/blocklayout.c -@@ -50,7 +50,7 @@ nfsd4_block_proc_layoutget(struct inode *inode, const struct svc_fh *fhp, - { - struct nfsd4_layout_seg *seg = &args->lg_seg; - struct super_block *sb = inode->i_sb; -- u32 block_size = (1 << inode->i_blkbits); -+ u32 block_size = i_blocksize(inode); - struct pnfs_block_extent *bex; - struct iomap iomap; - u32 device_generation = 0; -@@ -151,7 +151,7 @@ nfsd4_block_proc_layoutcommit(struct inode *inode, - int error; - - nr_iomaps = nfsd4_block_decode_layoutupdate(lcp->lc_up_layout, -- lcp->lc_up_len, &iomaps, 1 << inode->i_blkbits); -+ lcp->lc_up_len, &iomaps, i_blocksize(inode)); - if (nr_iomaps < 0) - return nfserrno(nr_iomaps); - -diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c -index 7d5351cd67fb..209dbfc50cd4 100644 ---- a/fs/nfsd/nfs4proc.c -+++ b/fs/nfsd/nfs4proc.c -@@ -1690,6 +1690,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, - opdesc->op_get_currentstateid(cstate, &op->u); - op->status = opdesc->op_func(rqstp, cstate, &op->u); - -+ /* Only from SEQUENCE */ -+ if (cstate->status == nfserr_replay_cache) { -+ dprintk("%s NFS4.1 replay from cache\n", __func__); -+ status = op->status; -+ goto out; -+ } - if (!op->status) { - if (opdesc->op_set_currentstateid) - opdesc->op_set_currentstateid(cstate, &op->u); -@@ -1700,14 +1706,7 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, - if (need_wrongsec_check(rqstp)) - op->status = check_nfsd_access(current_fh->fh_export, rqstp); - } -- - encode_op: -- /* Only from SEQUENCE */ -- if (cstate->status == nfserr_replay_cache) { -- dprintk("%s NFS4.1 replay from cache\n", __func__); -- status = op->status; -- goto out; -- } - if (op->status == nfserr_replay_me) { - op->replay = &cstate->replay_owner->so_replay; - nfsd4_encode_replay(&resp->xdr, op); -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index c3e1cb481fe0..3f68a25f2169 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -2753,9 +2753,16 @@ out_acl: - } - #endif /* CONFIG_NFSD_PNFS */ - if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) { -- status = nfsd4_encode_bitmap(xdr, NFSD_SUPPATTR_EXCLCREAT_WORD0, -- NFSD_SUPPATTR_EXCLCREAT_WORD1, -- NFSD_SUPPATTR_EXCLCREAT_WORD2); -+ u32 supp[3]; -+ -+ supp[0] = nfsd_suppattrs0(minorversion); -+ supp[1] = nfsd_suppattrs1(minorversion); -+ supp[2] = nfsd_suppattrs2(minorversion); -+ supp[0] &= NFSD_SUPPATTR_EXCLCREAT_WORD0; -+ supp[1] &= NFSD_SUPPATTR_EXCLCREAT_WORD1; -+ supp[2] &= NFSD_SUPPATTR_EXCLCREAT_WORD2; -+ -+ status = nfsd4_encode_bitmap(xdr, supp[0], supp[1], supp[2]); - if (status) - goto out; - } -diff --git a/fs/nilfs2/btnode.c b/fs/nilfs2/btnode.c -index a35ae35e6932..cd39b57288c2 100644 ---- a/fs/nilfs2/btnode.c -+++ b/fs/nilfs2/btnode.c -@@ -55,7 +55,7 @@ nilfs_btnode_create_block(struct address_space *btnc, __u64 blocknr) - brelse(bh); - BUG(); - } -- memset(bh->b_data, 0, 1 << inode->i_blkbits); -+ memset(bh->b_data, 0, i_blocksize(inode)); - bh->b_bdev = inode->i_sb->s_bdev; - bh->b_blocknr = blocknr; - set_buffer_mapped(bh); -diff --git a/fs/nilfs2/inode.c b/fs/nilfs2/inode.c -index ac2f64943ff4..00877ef0b120 100644 ---- a/fs/nilfs2/inode.c -+++ b/fs/nilfs2/inode.c -@@ -55,7 +55,7 @@ void nilfs_inode_add_blocks(struct inode *inode, int n) - { - struct nilfs_root *root = NILFS_I(inode)->i_root; - -- inode_add_bytes(inode, (1 << inode->i_blkbits) * n); -+ inode_add_bytes(inode, i_blocksize(inode) * n); - if (root) - atomic64_add(n, &root->blocks_count); - } -@@ -64,7 +64,7 @@ void nilfs_inode_sub_blocks(struct inode *inode, int n) - { - struct nilfs_root *root = NILFS_I(inode)->i_root; - -- inode_sub_bytes(inode, (1 << inode->i_blkbits) * n); -+ inode_sub_bytes(inode, i_blocksize(inode) * n); - if (root) - atomic64_sub(n, &root->blocks_count); - } -diff --git a/fs/nilfs2/mdt.c b/fs/nilfs2/mdt.c -index 1125f40233ff..612a2457243d 100644 ---- a/fs/nilfs2/mdt.c -+++ b/fs/nilfs2/mdt.c -@@ -60,7 +60,7 @@ nilfs_mdt_insert_new_block(struct inode *inode, unsigned long block, - set_buffer_mapped(bh); - - kaddr = kmap_atomic(bh->b_page); -- memset(kaddr + bh_offset(bh), 0, 1 << inode->i_blkbits); -+ memset(kaddr + bh_offset(bh), 0, i_blocksize(inode)); - if (init_block) - init_block(inode, bh, kaddr); - flush_dcache_page(bh->b_page); -@@ -503,7 +503,7 @@ void nilfs_mdt_set_entry_size(struct inode *inode, unsigned entry_size, - struct nilfs_mdt_info *mi = NILFS_MDT(inode); - - mi->mi_entry_size = entry_size; -- mi->mi_entries_per_block = (1 << inode->i_blkbits) / entry_size; -+ mi->mi_entries_per_block = i_blocksize(inode) / entry_size; - mi->mi_first_entry_offset = DIV_ROUND_UP(header_size, entry_size); - } - -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index 3b65adaae7e4..2f27c935bd57 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -719,7 +719,7 @@ static size_t nilfs_lookup_dirty_data_buffers(struct inode *inode, - - lock_page(page); - if (!page_has_buffers(page)) -- create_empty_buffers(page, 1 << inode->i_blkbits, 0); -+ create_empty_buffers(page, i_blocksize(inode), 0); - unlock_page(page); - - bh = head = page_buffers(page); -diff --git a/fs/ocfs2/aops.c b/fs/ocfs2/aops.c -index e6795c7c76a8..e4184bd2a954 100644 ---- a/fs/ocfs2/aops.c -+++ b/fs/ocfs2/aops.c -@@ -1103,7 +1103,7 @@ int ocfs2_map_page_blocks(struct page *page, u64 *p_blkno, - int ret = 0; - struct buffer_head *head, *bh, *wait[2], **wait_bh = wait; - unsigned int block_end, block_start; -- unsigned int bsize = 1 << inode->i_blkbits; -+ unsigned int bsize = i_blocksize(inode); - - if (!page_has_buffers(page)) - create_empty_buffers(page, bsize, 0); -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 56dd3957cc91..1d738723a41a 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -808,7 +808,7 @@ static int ocfs2_write_zero_page(struct inode *inode, u64 abs_from, - /* We know that zero_from is block aligned */ - for (block_start = zero_from; block_start < zero_to; - block_start = block_end) { -- block_end = block_start + (1 << inode->i_blkbits); -+ block_end = block_start + i_blocksize(inode); - - /* - * block_start is block-aligned. Bump it by one to force -diff --git a/fs/reiserfs/file.c b/fs/reiserfs/file.c -index 8f5ccdf81c25..38187300a2b4 100644 ---- a/fs/reiserfs/file.c -+++ b/fs/reiserfs/file.c -@@ -189,7 +189,7 @@ int reiserfs_commit_page(struct inode *inode, struct page *page, - int ret = 0; - - th.t_trans_id = 0; -- blocksize = 1 << inode->i_blkbits; -+ blocksize = i_blocksize(inode); - - if (logit) { - reiserfs_write_lock(s); -diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c -index 3d8e7e671d5b..60ba35087d12 100644 ---- a/fs/reiserfs/inode.c -+++ b/fs/reiserfs/inode.c -@@ -524,7 +524,7 @@ static int reiserfs_get_blocks_direct_io(struct inode *inode, - * referenced in convert_tail_for_hole() that may be called from - * reiserfs_get_block() - */ -- bh_result->b_size = (1 << inode->i_blkbits); -+ bh_result->b_size = i_blocksize(inode); - - ret = reiserfs_get_block(inode, iblock, bh_result, - create | GET_BLOCK_NO_DANGLE); -diff --git a/fs/stat.c b/fs/stat.c -index d4a61d8dc021..004dd77c3b93 100644 ---- a/fs/stat.c -+++ b/fs/stat.c -@@ -31,7 +31,7 @@ void generic_fillattr(struct inode *inode, struct kstat *stat) - stat->atime = inode->i_atime; - stat->mtime = inode->i_mtime; - stat->ctime = inode->i_ctime; -- stat->blksize = (1 << inode->i_blkbits); -+ stat->blksize = i_blocksize(inode); - stat->blocks = inode->i_blocks; - } - -@@ -454,6 +454,7 @@ void __inode_add_bytes(struct inode *inode, loff_t bytes) - inode->i_bytes -= 512; - } - } -+EXPORT_SYMBOL(__inode_add_bytes); - - void inode_add_bytes(struct inode *inode, loff_t bytes) - { -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 566df9b5a6cb..7be3166ba553 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1206,7 +1206,7 @@ int udf_setsize(struct inode *inode, loff_t newsize) - { - int err; - struct udf_inode_info *iinfo; -- int bsize = 1 << inode->i_blkbits; -+ int bsize = i_blocksize(inode); - - if (!(S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode) || - S_ISLNK(inode->i_mode))) -diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c -index dc5fae601c24..637e17cb0edd 100644 ---- a/fs/ufs/balloc.c -+++ b/fs/ufs/balloc.c -@@ -81,7 +81,8 @@ void ufs_free_fragments(struct inode *inode, u64 fragment, unsigned count) - ufs_error (sb, "ufs_free_fragments", - "bit already cleared for fragment %u", i); - } -- -+ -+ inode_sub_bytes(inode, count << uspi->s_fshift); - fs32_add(sb, &ucg->cg_cs.cs_nffree, count); - uspi->cs_total.cs_nffree += count; - fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, count); -@@ -183,6 +184,7 @@ do_more: - ufs_error(sb, "ufs_free_blocks", "freeing free fragment"); - } - ubh_setblock(UCPI_UBH(ucpi), ucpi->c_freeoff, blkno); -+ inode_sub_bytes(inode, uspi->s_fpb << uspi->s_fshift); - if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD) - ufs_clusteracct (sb, ucpi, blkno, 1); - -@@ -494,6 +496,20 @@ u64 ufs_new_fragments(struct inode *inode, void *p, u64 fragment, - return 0; - } - -+static bool try_add_frags(struct inode *inode, unsigned frags) -+{ -+ unsigned size = frags * i_blocksize(inode); -+ spin_lock(&inode->i_lock); -+ __inode_add_bytes(inode, size); -+ if (unlikely((u32)inode->i_blocks != inode->i_blocks)) { -+ __inode_sub_bytes(inode, size); -+ spin_unlock(&inode->i_lock); -+ return false; -+ } -+ spin_unlock(&inode->i_lock); -+ return true; -+} -+ - static u64 ufs_add_fragments(struct inode *inode, u64 fragment, - unsigned oldcount, unsigned newcount) - { -@@ -530,6 +546,9 @@ static u64 ufs_add_fragments(struct inode *inode, u64 fragment, - for (i = oldcount; i < newcount; i++) - if (ubh_isclr (UCPI_UBH(ucpi), ucpi->c_freeoff, fragno + i)) - return 0; -+ -+ if (!try_add_frags(inode, count)) -+ return 0; - /* - * Block can be extended - */ -@@ -647,6 +666,7 @@ cg_found: - ubh_setbit (UCPI_UBH(ucpi), ucpi->c_freeoff, goal + i); - i = uspi->s_fpb - count; - -+ inode_sub_bytes(inode, i << uspi->s_fshift); - fs32_add(sb, &ucg->cg_cs.cs_nffree, i); - uspi->cs_total.cs_nffree += i; - fs32_add(sb, &UFS_SB(sb)->fs_cs(cgno).cs_nffree, i); -@@ -657,6 +677,8 @@ cg_found: - result = ufs_bitmap_search (sb, ucpi, goal, allocsize); - if (result == INVBLOCK) - return 0; -+ if (!try_add_frags(inode, count)) -+ return 0; - for (i = 0; i < count; i++) - ubh_clrbit (UCPI_UBH(ucpi), ucpi->c_freeoff, result + i); - -@@ -716,6 +738,8 @@ norot: - return INVBLOCK; - ucpi->c_rotor = result; - gotit: -+ if (!try_add_frags(inode, uspi->s_fpb)) -+ return 0; - blkno = ufs_fragstoblks(result); - ubh_clrblock (UCPI_UBH(ucpi), ucpi->c_freeoff, blkno); - if ((UFS_SB(sb)->s_flags & UFS_CG_MASK) == UFS_CG_44BSD) -diff --git a/fs/ufs/inode.c b/fs/ufs/inode.c -index a064cf44b143..1f69bb9b1e9d 100644 ---- a/fs/ufs/inode.c -+++ b/fs/ufs/inode.c -@@ -235,7 +235,8 @@ ufs_extend_tail(struct inode *inode, u64 writes_to, - - p = ufs_get_direct_data_ptr(uspi, ufsi, block); - tmp = ufs_new_fragments(inode, p, lastfrag, ufs_data_ptr_to_cpu(sb, p), -- new_size, err, locked_page); -+ new_size - (lastfrag & uspi->s_fpbmask), err, -+ locked_page); - return tmp != 0; - } - -@@ -284,7 +285,7 @@ ufs_inode_getfrag(struct inode *inode, unsigned index, - goal += uspi->s_fpb; - } - tmp = ufs_new_fragments(inode, p, ufs_blknum(new_fragment), -- goal, uspi->s_fpb, err, locked_page); -+ goal, nfrags, err, locked_page); - - if (!tmp) { - *err = -ENOSPC; -@@ -402,7 +403,9 @@ static int ufs_getfrag_block(struct inode *inode, sector_t fragment, struct buff - - if (!create) { - phys64 = ufs_frag_map(inode, offsets, depth); -- goto out; -+ if (phys64) -+ map_bh(bh_result, sb, phys64 + frag); -+ return 0; - } - - /* This code entered only while writing ....? */ -diff --git a/fs/ufs/super.c b/fs/ufs/super.c -index f6390eec02ca..10f364490833 100644 ---- a/fs/ufs/super.c -+++ b/fs/ufs/super.c -@@ -746,6 +746,23 @@ static void ufs_put_super(struct super_block *sb) - return; - } - -+static u64 ufs_max_bytes(struct super_block *sb) -+{ -+ struct ufs_sb_private_info *uspi = UFS_SB(sb)->s_uspi; -+ int bits = uspi->s_apbshift; -+ u64 res; -+ -+ if (bits > 21) -+ res = ~0ULL; -+ else -+ res = UFS_NDADDR + (1LL << bits) + (1LL << (2*bits)) + -+ (1LL << (3*bits)); -+ -+ if (res >= (MAX_LFS_FILESIZE >> uspi->s_bshift)) -+ return MAX_LFS_FILESIZE; -+ return res << uspi->s_bshift; -+} -+ - static int ufs_fill_super(struct super_block *sb, void *data, int silent) - { - struct ufs_sb_info * sbi; -@@ -1212,6 +1229,7 @@ magic_found: - "fast symlink size (%u)\n", uspi->s_maxsymlinklen); - uspi->s_maxsymlinklen = maxsymlen; - } -+ sb->s_maxbytes = ufs_max_bytes(sb); - sb->s_max_links = UFS_LINK_MAX; - - inode = ufs_iget(sb, UFS_ROOTINO); -diff --git a/fs/ufs/util.h b/fs/ufs/util.h -index 954175928240..3f9463f8cf2f 100644 ---- a/fs/ufs/util.h -+++ b/fs/ufs/util.h -@@ -473,15 +473,19 @@ static inline unsigned _ubh_find_last_zero_bit_( - static inline int _ubh_isblockset_(struct ufs_sb_private_info * uspi, - struct ufs_buffer_head * ubh, unsigned begin, unsigned block) - { -+ u8 mask; - switch (uspi->s_fpb) { - case 8: - return (*ubh_get_addr (ubh, begin + block) == 0xff); - case 4: -- return (*ubh_get_addr (ubh, begin + (block >> 1)) == (0x0f << ((block & 0x01) << 2))); -+ mask = 0x0f << ((block & 0x01) << 2); -+ return (*ubh_get_addr (ubh, begin + (block >> 1)) & mask) == mask; - case 2: -- return (*ubh_get_addr (ubh, begin + (block >> 2)) == (0x03 << ((block & 0x03) << 1))); -+ mask = 0x03 << ((block & 0x03) << 1); -+ return (*ubh_get_addr (ubh, begin + (block >> 2)) & mask) == mask; - case 1: -- return (*ubh_get_addr (ubh, begin + (block >> 3)) == (0x01 << (block & 0x07))); -+ mask = 0x01 << (block & 0x07); -+ return (*ubh_get_addr (ubh, begin + (block >> 3)) & mask) == mask; - } - return 0; - } -diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c -index 29e7e5dd5178..187b80267ff9 100644 ---- a/fs/xfs/xfs_aops.c -+++ b/fs/xfs/xfs_aops.c -@@ -288,7 +288,7 @@ xfs_map_blocks( - { - struct xfs_inode *ip = XFS_I(inode); - struct xfs_mount *mp = ip->i_mount; -- ssize_t count = 1 << inode->i_blkbits; -+ ssize_t count = i_blocksize(inode); - xfs_fileoff_t offset_fsb, end_fsb; - int error = 0; - int bmapi_flags = XFS_BMAPI_ENTIRE; -@@ -921,7 +921,7 @@ xfs_aops_discard_page( - break; - } - next_buffer: -- offset += 1 << inode->i_blkbits; -+ offset += i_blocksize(inode); - - } while ((bh = bh->b_this_page) != head); - -@@ -1363,7 +1363,7 @@ xfs_map_trim_size( - offset + mapping_size >= i_size_read(inode)) { - /* limit mapping to block that spans EOF */ - mapping_size = roundup_64(i_size_read(inode) - offset, -- 1 << inode->i_blkbits); -+ i_blocksize(inode)); - } - if (mapping_size > LONG_MAX) - mapping_size = LONG_MAX; -@@ -1395,7 +1395,7 @@ __xfs_get_blocks( - return -EIO; - - offset = (xfs_off_t)iblock << inode->i_blkbits; -- ASSERT(bh_result->b_size >= (1 << inode->i_blkbits)); -+ ASSERT(bh_result->b_size >= i_blocksize(inode)); - size = bh_result->b_size; - - if (!create && direct && offset >= i_size_read(inode)) -@@ -1968,7 +1968,7 @@ xfs_vm_set_page_dirty( - if (offset < end_offset) - set_buffer_dirty(bh); - bh = bh->b_this_page; -- offset += 1 << inode->i_blkbits; -+ offset += i_blocksize(inode); - } while (bh != head); - } - /* -diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c -index ceea444dafb4..3dd47307363f 100644 ---- a/fs/xfs/xfs_file.c -+++ b/fs/xfs/xfs_file.c -@@ -947,7 +947,7 @@ xfs_file_fallocate( - if (error) - goto out_unlock; - } else if (mode & FALLOC_FL_COLLAPSE_RANGE) { -- unsigned blksize_mask = (1 << inode->i_blkbits) - 1; -+ unsigned int blksize_mask = i_blocksize(inode) - 1; - - if (offset & blksize_mask || len & blksize_mask) { - error = -EINVAL; -@@ -969,7 +969,7 @@ xfs_file_fallocate( - if (error) - goto out_unlock; - } else if (mode & FALLOC_FL_INSERT_RANGE) { -- unsigned blksize_mask = (1 << inode->i_blkbits) - 1; -+ unsigned int blksize_mask = i_blocksize(inode) - 1; - - new_size = i_size_read(inode) + len; - if (offset & blksize_mask || len & blksize_mask) { -diff --git a/fs/xfs/xfs_xattr.c b/fs/xfs/xfs_xattr.c -index e6dae28dfa1a..9beaf192b4bb 100644 ---- a/fs/xfs/xfs_xattr.c -+++ b/fs/xfs/xfs_xattr.c -@@ -180,6 +180,7 @@ xfs_xattr_put_listent( - arraytop = context->count + prefix_len + namelen + 1; - if (arraytop > context->firstu) { - context->count = -1; /* insufficient space */ -+ context->seen_enough = 1; - return 0; - } - offset = (char *)context->alist + context->count; -diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h -index ad2bcf647b9a..210ccc4ea44b 100644 ---- a/include/linux/cgroup.h -+++ b/include/linux/cgroup.h -@@ -340,6 +340,26 @@ static inline bool css_tryget_online(struct cgroup_subsys_state *css) - } - - /** -+ * css_is_dying - test whether the specified css is dying -+ * @css: target css -+ * -+ * Test whether @css is in the process of offlining or already offline. In -+ * most cases, ->css_online() and ->css_offline() callbacks should be -+ * enough; however, the actual offline operations are RCU delayed and this -+ * test returns %true also when @css is scheduled to be offlined. -+ * -+ * This is useful, for example, when the use case requires synchronous -+ * behavior with respect to cgroup removal. cgroup removal schedules css -+ * offlining but the css can seem alive while the operation is being -+ * delayed. If the delay affects user visible semantics, this test can be -+ * used to resolve the situation. -+ */ -+static inline bool css_is_dying(struct cgroup_subsys_state *css) -+{ -+ return !(css->flags & CSS_NO_REF) && percpu_ref_is_dying(&css->refcnt); -+} -+ -+/** - * css_put - put a css reference - * @css: target css - * -diff --git a/include/linux/fs.h b/include/linux/fs.h -index e1a123760dbf..c8decb7075d6 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -680,6 +680,11 @@ struct inode { - void *i_private; /* fs or device private pointer */ - }; - -+static inline unsigned int i_blocksize(const struct inode *node) -+{ -+ return (1 << node->i_blkbits); -+} -+ - static inline int inode_unhashed(struct inode *inode) - { - return hlist_unhashed(&inode->i_hash); -diff --git a/include/linux/memblock.h b/include/linux/memblock.h -index 24daf8fc4d7c..76b502c6258f 100644 ---- a/include/linux/memblock.h -+++ b/include/linux/memblock.h -@@ -408,12 +408,20 @@ static inline void early_memtest(phys_addr_t start, phys_addr_t end) - } - #endif - -+extern unsigned long memblock_reserved_memory_within(phys_addr_t start_addr, -+ phys_addr_t end_addr); - #else - static inline phys_addr_t memblock_alloc(phys_addr_t size, phys_addr_t align) - { - return 0; - } - -+static inline unsigned long memblock_reserved_memory_within(phys_addr_t start_addr, -+ phys_addr_t end_addr) -+{ -+ return 0; -+} -+ - #endif /* CONFIG_HAVE_MEMBLOCK */ - - #endif /* __KERNEL__ */ -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index e23a9e704536..5b609a3ce3d7 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -688,6 +688,7 @@ typedef struct pglist_data { - * is the first PFN that needs to be initialised. - */ - unsigned long first_deferred_pfn; -+ unsigned long static_init_size; - #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */ - } pg_data_t; - -diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h -index e13bfdf7f314..81fdf4b8aba4 100644 ---- a/include/linux/ptrace.h -+++ b/include/linux/ptrace.h -@@ -50,7 +50,8 @@ extern int ptrace_request(struct task_struct *child, long request, - unsigned long addr, unsigned long data); - extern void ptrace_notify(int exit_code); - extern void __ptrace_link(struct task_struct *child, -- struct task_struct *new_parent); -+ struct task_struct *new_parent, -+ const struct cred *ptracer_cred); - extern void __ptrace_unlink(struct task_struct *child); - extern void exit_ptrace(struct task_struct *tracer, struct list_head *dead); - #define PTRACE_MODE_READ 0x01 -@@ -202,7 +203,7 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) - - if (unlikely(ptrace) && current->ptrace) { - child->ptrace = current->ptrace; -- __ptrace_link(child, current->parent); -+ __ptrace_link(child, current->parent, current->ptracer_cred); - - if (child->ptrace & PT_SEIZED) - task_set_jobctl_pending(child, JOBCTL_TRAP_STOP); -@@ -211,6 +212,8 @@ static inline void ptrace_init_task(struct task_struct *child, bool ptrace) - - set_tsk_thread_flag(child, TIF_SIGPENDING); - } -+ else -+ child->ptracer_cred = NULL; - } - - /** -diff --git a/include/linux/random.h b/include/linux/random.h -index a75840c1aa71..9c29122037f9 100644 ---- a/include/linux/random.h -+++ b/include/linux/random.h -@@ -34,6 +34,7 @@ extern const struct file_operations random_fops, urandom_fops; - #endif - - unsigned int get_random_int(void); -+unsigned long get_random_long(void); - unsigned long randomize_range(unsigned long start, unsigned long end, unsigned long len); - - u32 prandom_u32(void); -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index d443d9ab0236..3f61c647fc5c 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -1084,9 +1084,6 @@ static inline void skb_copy_hash(struct sk_buff *to, const struct sk_buff *from) - - static inline void skb_sender_cpu_clear(struct sk_buff *skb) - { --#ifdef CONFIG_XPS -- skb->sender_cpu = 0; --#endif - } - - #ifdef NET_SKBUFF_DATA_USES_OFFSET -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index 9a5c9f013784..ad1d6039185d 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -958,6 +958,7 @@ int inet6_hash_connect(struct inet_timewait_death_row *death_row, - */ - extern const struct proto_ops inet6_stream_ops; - extern const struct proto_ops inet6_dgram_ops; -+extern const struct proto_ops inet6_sockraw_ops; - - struct group_source_req; - struct group_filter; -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index b271353d5202..3b5e5430f5d0 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -173,9 +173,9 @@ typedef enum { - } cpuset_flagbits_t; - - /* convenient tests for these bits */ --static inline bool is_cpuset_online(const struct cpuset *cs) -+static inline bool is_cpuset_online(struct cpuset *cs) - { -- return test_bit(CS_ONLINE, &cs->flags); -+ return test_bit(CS_ONLINE, &cs->flags) && !css_is_dying(&cs->css); - } - - static inline int is_cpu_exclusive(const struct cpuset *cs) -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 784ab8fe8714..22350b15b4e7 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6410,6 +6410,21 @@ static void perf_log_itrace_start(struct perf_event *event) - perf_output_end(&handle); - } - -+static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs) -+{ -+ /* -+ * Due to interrupt latency (AKA "skid"), we may enter the -+ * kernel before taking an overflow, even if the PMU is only -+ * counting user events. -+ * To avoid leaking information to userspace, we must always -+ * reject kernel samples when exclude_kernel is set. -+ */ -+ if (event->attr.exclude_kernel && !user_mode(regs)) -+ return false; -+ -+ return true; -+} -+ - /* - * Generic event overflow handling, sampling. - */ -@@ -6457,6 +6472,12 @@ static int __perf_event_overflow(struct perf_event *event, - } - - /* -+ * For security, drop the skid kernel samples if necessary. -+ */ -+ if (!sample_is_allowed(event, regs)) -+ return ret; -+ -+ /* - * XXX event_limit might not quite work as expected on inherited - * events - */ -diff --git a/kernel/fork.c b/kernel/fork.c -index 0ee630f3ad4b..68cfda1c1800 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -368,7 +368,7 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) - set_task_stack_end_magic(tsk); - - #ifdef CONFIG_CC_STACKPROTECTOR -- tsk->stack_canary = get_random_int(); -+ tsk->stack_canary = get_random_long(); - #endif - - /* -diff --git a/kernel/ptrace.c b/kernel/ptrace.c -index c7e8ed99c953..5e2cd1030702 100644 ---- a/kernel/ptrace.c -+++ b/kernel/ptrace.c -@@ -28,19 +28,25 @@ - #include - - -+void __ptrace_link(struct task_struct *child, struct task_struct *new_parent, -+ const struct cred *ptracer_cred) -+{ -+ BUG_ON(!list_empty(&child->ptrace_entry)); -+ list_add(&child->ptrace_entry, &new_parent->ptraced); -+ child->parent = new_parent; -+ child->ptracer_cred = get_cred(ptracer_cred); -+} -+ - /* - * ptrace a task: make the debugger its new parent and - * move it to the ptrace list. - * - * Must be called with the tasklist lock write-held. - */ --void __ptrace_link(struct task_struct *child, struct task_struct *new_parent) -+static void ptrace_link(struct task_struct *child, struct task_struct *new_parent) - { -- BUG_ON(!list_empty(&child->ptrace_entry)); -- list_add(&child->ptrace_entry, &new_parent->ptraced); -- child->parent = new_parent; - rcu_read_lock(); -- child->ptracer_cred = get_cred(__task_cred(new_parent)); -+ __ptrace_link(child, new_parent, __task_cred(new_parent)); - rcu_read_unlock(); - } - -@@ -353,7 +359,7 @@ static int ptrace_attach(struct task_struct *task, long request, - flags |= PT_SEIZED; - task->ptrace = flags; - -- __ptrace_link(task, current); -+ ptrace_link(task, current); - - /* SEIZE doesn't trap tracee on attach */ - if (!seize) -@@ -420,7 +426,7 @@ static int ptrace_traceme(void) - */ - if (!ret && !(current->real_parent->flags & PF_EXITING)) { - current->ptrace = PT_PTRACED; -- __ptrace_link(current, current->real_parent); -+ ptrace_link(current, current->real_parent); - } - } - write_unlock_irq(&tasklist_lock); -diff --git a/lib/test_user_copy.c b/lib/test_user_copy.c -index 0ecef3e4690e..5e6db6b1e3bd 100644 ---- a/lib/test_user_copy.c -+++ b/lib/test_user_copy.c -@@ -58,7 +58,9 @@ static int __init test_user_copy_init(void) - usermem = (char __user *)user_addr; - bad_usermem = (char *)user_addr; - -- /* Legitimate usage: none of these should fail. */ -+ /* -+ * Legitimate usage: none of these copies should fail. -+ */ - ret |= test(copy_from_user(kmem, usermem, PAGE_SIZE), - "legitimate copy_from_user failed"); - ret |= test(copy_to_user(usermem, kmem, PAGE_SIZE), -@@ -68,19 +70,33 @@ static int __init test_user_copy_init(void) - ret |= test(put_user(value, (unsigned long __user *)usermem), - "legitimate put_user failed"); - -- /* Invalid usage: none of these should succeed. */ -+ /* -+ * Invalid usage: none of these copies should succeed. -+ */ -+ -+ /* Reject kernel-to-kernel copies through copy_from_user(). */ - ret |= test(!copy_from_user(kmem, (char __user *)(kmem + PAGE_SIZE), - PAGE_SIZE), - "illegal all-kernel copy_from_user passed"); -+ -+#if 0 -+ /* -+ * When running with SMAP/PAN/etc, this will Oops the kernel -+ * due to the zeroing of userspace memory on failure. This needs -+ * to be tested in LKDTM instead, since this test module does not -+ * expect to explode. -+ */ - ret |= test(!copy_from_user(bad_usermem, (char __user *)kmem, - PAGE_SIZE), - "illegal reversed copy_from_user passed"); -+#endif - ret |= test(!copy_to_user((char __user *)kmem, kmem + PAGE_SIZE, - PAGE_SIZE), - "illegal all-kernel copy_to_user passed"); - ret |= test(!copy_to_user((char __user *)kmem, bad_usermem, - PAGE_SIZE), - "illegal reversed copy_to_user passed"); -+ - ret |= test(!get_user(value, (unsigned long __user *)kmem), - "illegal get_user passed"); - ret |= test(!put_user(value, (unsigned long __user *)kmem), -diff --git a/mm/memblock.c b/mm/memblock.c -index d300f1329814..f8fab45bfdb7 100644 ---- a/mm/memblock.c -+++ b/mm/memblock.c -@@ -1634,6 +1634,30 @@ static void __init_memblock memblock_dump(struct memblock_type *type, char *name - } - } - -+extern unsigned long __init_memblock -+memblock_reserved_memory_within(phys_addr_t start_addr, phys_addr_t end_addr) -+{ -+ struct memblock_type *type = &memblock.reserved; -+ unsigned long size = 0; -+ int idx; -+ -+ for (idx = 0; idx < type->cnt; idx++) { -+ struct memblock_region *rgn = &type->regions[idx]; -+ phys_addr_t start, end; -+ -+ if (rgn->base + rgn->size < start_addr) -+ continue; -+ if (rgn->base > end_addr) -+ continue; -+ -+ start = rgn->base; -+ end = start + rgn->size; -+ size += end - start; -+ } -+ -+ return size; -+} -+ - void __init_memblock __memblock_dump_all(void) - { - pr_info("MEMBLOCK configuration:\n"); -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 6f9005dcca2e..bd17a6bdf131 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -269,6 +269,26 @@ int page_group_by_mobility_disabled __read_mostly; - #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT - static inline void reset_deferred_meminit(pg_data_t *pgdat) - { -+ unsigned long max_initialise; -+ unsigned long reserved_lowmem; -+ -+ /* -+ * Initialise at least 2G of a node but also take into account that -+ * two large system hashes that can take up 1GB for 0.25TB/node. -+ */ -+ max_initialise = max(2UL << (30 - PAGE_SHIFT), -+ (pgdat->node_spanned_pages >> 8)); -+ -+ /* -+ * Compensate the all the memblock reservations (e.g. crash kernel) -+ * from the initial estimation to make sure we will initialize enough -+ * memory to boot. -+ */ -+ reserved_lowmem = memblock_reserved_memory_within(pgdat->node_start_pfn, -+ pgdat->node_start_pfn + max_initialise); -+ max_initialise += reserved_lowmem; -+ -+ pgdat->static_init_size = min(max_initialise, pgdat->node_spanned_pages); - pgdat->first_deferred_pfn = ULONG_MAX; - } - -@@ -302,10 +322,9 @@ static inline bool update_defer_init(pg_data_t *pgdat, - /* Always populate low zones for address-contrained allocations */ - if (zone_end < pgdat_end_pfn(pgdat)) - return true; -- - /* Initialise at least 2G of the highest zone */ - (*nr_initialised)++; -- if (*nr_initialised > (2UL << (30 - PAGE_SHIFT)) && -+ if ((*nr_initialised > pgdat->static_init_size) && - (pfn & (PAGES_PER_SECTION - 1)) == 0) { - pgdat->first_deferred_pfn = pfn; - return false; -@@ -5343,7 +5362,6 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size, - /* pg_data_t should be reset to zero when it's allocated */ - WARN_ON(pgdat->nr_zones || pgdat->classzone_idx); - -- reset_deferred_meminit(pgdat); - pgdat->node_id = nid; - pgdat->node_start_pfn = node_start_pfn; - #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP -@@ -5362,6 +5380,7 @@ void __paginginit free_area_init_node(int nid, unsigned long *zones_size, - (unsigned long)pgdat->node_mem_map); - #endif - -+ reset_deferred_meminit(pgdat); - free_area_init_core(pgdat); - } - -diff --git a/mm/truncate.c b/mm/truncate.c -index 76e35ad97102..f4c8270f7b84 100644 ---- a/mm/truncate.c -+++ b/mm/truncate.c -@@ -732,7 +732,7 @@ EXPORT_SYMBOL(truncate_setsize); - */ - void pagecache_isize_extended(struct inode *inode, loff_t from, loff_t to) - { -- int bsize = 1 << inode->i_blkbits; -+ int bsize = i_blocksize(inode); - loff_t rounded_from; - struct page *page; - pgoff_t index; -diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c -index 57be733a99bc..bcb4559e735d 100644 ---- a/net/bridge/br_stp_if.c -+++ b/net/bridge/br_stp_if.c -@@ -166,7 +166,8 @@ static void br_stp_start(struct net_bridge *br) - br_debug(br, "using kernel STP\n"); - - /* To start timers on any ports left in blocking */ -- mod_timer(&br->hello_timer, jiffies + br->hello_time); -+ if (br->dev->flags & IFF_UP) -+ mod_timer(&br->hello_timer, jiffies + br->hello_time); - br_port_state_selection(br); - } - -diff --git a/net/core/dev.c b/net/core/dev.c -index 48399d8ce614..87b8754f34ac 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -182,7 +182,7 @@ EXPORT_SYMBOL(dev_base_lock); - /* protects napi_hash addition/deletion and napi_gen_id */ - static DEFINE_SPINLOCK(napi_hash_lock); - --static unsigned int napi_gen_id; -+static unsigned int napi_gen_id = NR_CPUS; - static DEFINE_HASHTABLE(napi_hash, 8); - - static seqcount_t devnet_rename_seq; -@@ -3049,7 +3049,9 @@ struct netdev_queue *netdev_pick_tx(struct net_device *dev, - int queue_index = 0; - - #ifdef CONFIG_XPS -- if (skb->sender_cpu == 0) -+ u32 sender_cpu = skb->sender_cpu - 1; -+ -+ if (sender_cpu >= (u32)NR_CPUS) - skb->sender_cpu = raw_smp_processor_id() + 1; - #endif - -@@ -4726,25 +4728,22 @@ EXPORT_SYMBOL_GPL(napi_by_id); - - void napi_hash_add(struct napi_struct *napi) - { -- if (!test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) { -+ if (test_and_set_bit(NAPI_STATE_HASHED, &napi->state)) -+ return; - -- spin_lock(&napi_hash_lock); -+ spin_lock(&napi_hash_lock); - -- /* 0 is not a valid id, we also skip an id that is taken -- * we expect both events to be extremely rare -- */ -- napi->napi_id = 0; -- while (!napi->napi_id) { -- napi->napi_id = ++napi_gen_id; -- if (napi_by_id(napi->napi_id)) -- napi->napi_id = 0; -- } -+ /* 0..NR_CPUS+1 range is reserved for sender_cpu use */ -+ do { -+ if (unlikely(++napi_gen_id < NR_CPUS + 1)) -+ napi_gen_id = NR_CPUS + 1; -+ } while (napi_by_id(napi_gen_id)); -+ napi->napi_id = napi_gen_id; - -- hlist_add_head_rcu(&napi->napi_hash_node, -- &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]); -+ hlist_add_head_rcu(&napi->napi_hash_node, -+ &napi_hash[napi->napi_id % HASH_SIZE(napi_hash)]); - -- spin_unlock(&napi_hash_lock); -- } -+ spin_unlock(&napi_hash_lock); - } - EXPORT_SYMBOL_GPL(napi_hash_add); - -diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c -index afc18e9ca94a..967a47ff78a4 100644 ---- a/net/ipv4/af_inet.c -+++ b/net/ipv4/af_inet.c -@@ -1014,7 +1014,7 @@ static struct inet_protosw inetsw_array[] = - .type = SOCK_DGRAM, - .protocol = IPPROTO_ICMP, - .prot = &ping_prot, -- .ops = &inet_dgram_ops, -+ .ops = &inet_sockraw_ops, - .flags = INET_PROTOSW_REUSE, - }, - -diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c -index 882caa4e72bc..aafe68134763 100644 ---- a/net/ipv4/tcp_cong.c -+++ b/net/ipv4/tcp_cong.c -@@ -183,6 +183,7 @@ void tcp_init_congestion_control(struct sock *sk) - { - const struct inet_connection_sock *icsk = inet_csk(sk); - -+ tcp_sk(sk)->prior_ssthresh = 0; - if (icsk->icsk_ca_ops->init) - icsk->icsk_ca_ops->init(sk); - if (tcp_ca_needs_ecn(sk)) -diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c -index 568bc0a52ca1..9e2ea4ae840d 100644 ---- a/net/ipv6/ip6_offload.c -+++ b/net/ipv6/ip6_offload.c -@@ -121,8 +121,10 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, - - if (udpfrag) { - int err = ip6_find_1stfragopt(skb, &prevhdr); -- if (err < 0) -+ if (err < 0) { -+ kfree_skb_list(segs); - return ERR_PTR(err); -+ } - fptr = (struct frag_hdr *)((u8 *)ipv6h + err); - fptr->frag_off = htons(offset); - if (skb->next) -diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c -index 3e55447b63a4..a830b68e63c9 100644 ---- a/net/ipv6/ping.c -+++ b/net/ipv6/ping.c -@@ -50,7 +50,7 @@ static struct inet_protosw pingv6_protosw = { - .type = SOCK_DGRAM, - .protocol = IPPROTO_ICMPV6, - .prot = &pingv6_prot, -- .ops = &inet6_dgram_ops, -+ .ops = &inet6_sockraw_ops, - .flags = INET_PROTOSW_REUSE, - }; - -diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c -index c93ede16795d..4d52a0e2f60d 100644 ---- a/net/ipv6/raw.c -+++ b/net/ipv6/raw.c -@@ -1303,7 +1303,7 @@ void raw6_proc_exit(void) - #endif /* CONFIG_PROC_FS */ - - /* Same as inet6_dgram_ops, sans udp_poll. */ --static const struct proto_ops inet6_sockraw_ops = { -+const struct proto_ops inet6_sockraw_ops = { - .family = PF_INET6, - .owner = THIS_MODULE, - .release = inet6_release, -diff --git a/net/ipv6/xfrm6_mode_ro.c b/net/ipv6/xfrm6_mode_ro.c -index 0e015906f9ca..07d36573f50b 100644 ---- a/net/ipv6/xfrm6_mode_ro.c -+++ b/net/ipv6/xfrm6_mode_ro.c -@@ -47,6 +47,8 @@ static int xfrm6_ro_output(struct xfrm_state *x, struct sk_buff *skb) - iph = ipv6_hdr(skb); - - hdr_len = x->type->hdr_offset(x, skb, &prevhdr); -+ if (hdr_len < 0) -+ return hdr_len; - skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data); - skb_set_network_header(skb, -x->props.header_len); - skb->transport_header = skb->network_header + hdr_len; -diff --git a/net/ipv6/xfrm6_mode_transport.c b/net/ipv6/xfrm6_mode_transport.c -index 4e344105b3fd..1d3bbe6e1183 100644 ---- a/net/ipv6/xfrm6_mode_transport.c -+++ b/net/ipv6/xfrm6_mode_transport.c -@@ -28,6 +28,8 @@ static int xfrm6_transport_output(struct xfrm_state *x, struct sk_buff *skb) - iph = ipv6_hdr(skb); - - hdr_len = x->type->hdr_offset(x, skb, &prevhdr); -+ if (hdr_len < 0) -+ return hdr_len; - skb_set_mac_header(skb, (prevhdr - x->props.header_len) - skb->data); - skb_set_network_header(skb, -x->props.header_len); - skb->transport_header = skb->network_header + hdr_len; -diff --git a/security/keys/key.c b/security/keys/key.c -index 534808915371..09c10b181881 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -934,12 +934,11 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen) - /* the key must be writable */ - ret = key_permission(key_ref, KEY_NEED_WRITE); - if (ret < 0) -- goto error; -+ return ret; - - /* attempt to update it if supported */ -- ret = -EOPNOTSUPP; - if (!key->type->update) -- goto error; -+ return -EOPNOTSUPP; - - memset(&prep, 0, sizeof(prep)); - prep.data = payload; -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index 442e350c209d..671709d8610d 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -97,7 +97,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, - /* pull the payload in if one was supplied */ - payload = NULL; - -- if (_payload) { -+ if (plen) { - ret = -ENOMEM; - payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN); - if (!payload) { -@@ -327,7 +327,7 @@ long keyctl_update_key(key_serial_t id, - - /* pull the payload in if one was supplied */ - payload = NULL; -- if (_payload) { -+ if (plen) { - ret = -ENOMEM; - payload = kmalloc(plen, GFP_KERNEL); - if (!payload) -diff --git a/sound/core/timer.c b/sound/core/timer.c -index 278a332f97bd..48eaccba82a3 100644 ---- a/sound/core/timer.c -+++ b/sound/core/timer.c -@@ -1621,6 +1621,7 @@ static int snd_timer_user_tselect(struct file *file, - if (err < 0) - goto __err; - -+ tu->qhead = tu->qtail = tu->qused = 0; - kfree(tu->queue); - tu->queue = NULL; - kfree(tu->tqueue); -@@ -1958,6 +1959,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - - tu = file->private_data; - unit = tu->tread ? sizeof(struct snd_timer_tread) : sizeof(struct snd_timer_read); -+ mutex_lock(&tu->ioctl_lock); - spin_lock_irq(&tu->qlock); - while ((long)count - result >= unit) { - while (!tu->qused) { -@@ -1973,7 +1975,9 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - add_wait_queue(&tu->qchange_sleep, &wait); - - spin_unlock_irq(&tu->qlock); -+ mutex_unlock(&tu->ioctl_lock); - schedule(); -+ mutex_lock(&tu->ioctl_lock); - spin_lock_irq(&tu->qlock); - - remove_wait_queue(&tu->qchange_sleep, &wait); -@@ -1993,7 +1997,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - tu->qused--; - spin_unlock_irq(&tu->qlock); - -- mutex_lock(&tu->ioctl_lock); - if (tu->tread) { - if (copy_to_user(buffer, &tu->tqueue[qhead], - sizeof(struct snd_timer_tread))) -@@ -2003,7 +2006,6 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - sizeof(struct snd_timer_read))) - err = -EFAULT; - } -- mutex_unlock(&tu->ioctl_lock); - - spin_lock_irq(&tu->qlock); - if (err < 0) -@@ -2013,6 +2015,7 @@ static ssize_t snd_timer_user_read(struct file *file, char __user *buffer, - } - _error: - spin_unlock_irq(&tu->qlock); -+ mutex_unlock(&tu->ioctl_lock); - return result > 0 ? result : err; - } - -diff --git a/sound/soc/soc-core.c b/sound/soc/soc-core.c -index a1305f827a98..fa6b74a304a7 100644 ---- a/sound/soc/soc-core.c -+++ b/sound/soc/soc-core.c -@@ -1775,6 +1775,9 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card) - for (i = 0; i < card->num_aux_devs; i++) - soc_remove_aux_dev(card, i); - -+ /* free the ALSA card at first; this syncs with pending operations */ -+ snd_card_free(card->snd_card); -+ - /* remove and free each DAI */ - soc_remove_dai_links(card); - -@@ -1786,9 +1789,7 @@ static int soc_cleanup_card_resources(struct snd_soc_card *card) - - snd_soc_dapm_free(&card->dapm); - -- snd_card_free(card->snd_card); - return 0; -- - } - - /* removes a socdev */ diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.72-73.patch b/patch/kernel/mvebu64-default/03-patch-4.4.72-73.patch deleted file mode 100644 index 43d7eb9c83c1..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.72-73.patch +++ /dev/null @@ -1,2192 +0,0 @@ -diff --git a/Makefile b/Makefile -index 94d663c935c0..ba5a70b6e32c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 72 -+SUBLEVEL = 73 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -789,7 +789,7 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) - KBUILD_ARFLAGS := $(call ar-option,D) - - # check for 'asm goto' --ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC)), y) -+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) - KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO - KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO - endif -diff --git a/arch/arm/boot/dts/imx6dl.dtsi b/arch/arm/boot/dts/imx6dl.dtsi -index 4b0ec0703825..8ca9217204a0 100644 ---- a/arch/arm/boot/dts/imx6dl.dtsi -+++ b/arch/arm/boot/dts/imx6dl.dtsi -@@ -30,7 +30,7 @@ - /* kHz uV */ - 996000 1250000 - 792000 1175000 -- 396000 1075000 -+ 396000 1150000 - >; - fsl,soc-operating-points = < - /* ARM kHz SOC-PU uV */ -diff --git a/arch/s390/kernel/entry.S b/arch/s390/kernel/entry.S -index 7460df3eec6b..4612ed7ec2e5 100644 ---- a/arch/s390/kernel/entry.S -+++ b/arch/s390/kernel/entry.S -@@ -229,12 +229,17 @@ ENTRY(sie64a) - lctlg %c1,%c1,__LC_USER_ASCE # load primary asce - .Lsie_done: - # some program checks are suppressing. C code (e.g. do_protection_exception) --# will rewind the PSW by the ILC, which is 4 bytes in case of SIE. Other --# instructions between sie64a and .Lsie_done should not cause program --# interrupts. So lets use a nop (47 00 00 00) as a landing pad. -+# will rewind the PSW by the ILC, which is often 4 bytes in case of SIE. There -+# are some corner cases (e.g. runtime instrumentation) where ILC is unpredictable. -+# Other instructions between sie64a and .Lsie_done should not cause program -+# interrupts. So lets use 3 nops as a landing pad for all possible rewinds. - # See also .Lcleanup_sie --.Lrewind_pad: -- nop 0 -+.Lrewind_pad6: -+ nopr 7 -+.Lrewind_pad4: -+ nopr 7 -+.Lrewind_pad2: -+ nopr 7 - .globl sie_exit - sie_exit: - lg %r14,__SF_EMPTY+8(%r15) # load guest register save area -@@ -247,7 +252,9 @@ sie_exit: - stg %r14,__SF_EMPTY+16(%r15) # set exit reason code - j sie_exit - -- EX_TABLE(.Lrewind_pad,.Lsie_fault) -+ EX_TABLE(.Lrewind_pad6,.Lsie_fault) -+ EX_TABLE(.Lrewind_pad4,.Lsie_fault) -+ EX_TABLE(.Lrewind_pad2,.Lsie_fault) - EX_TABLE(sie_exit,.Lsie_fault) - #endif - -diff --git a/arch/s390/mm/vmem.c b/arch/s390/mm/vmem.c -index ef7d6c8fea66..f354fd84adeb 100644 ---- a/arch/s390/mm/vmem.c -+++ b/arch/s390/mm/vmem.c -@@ -372,7 +372,7 @@ void __init vmem_map_init(void) - ro_end = (unsigned long)&_eshared & PAGE_MASK; - for_each_memblock(memory, reg) { - start = reg->base; -- end = reg->base + reg->size - 1; -+ end = reg->base + reg->size; - if (start >= ro_end || end <= ro_start) - vmem_add_mem(start, end - start, 0); - else if (start >= ro_start && end <= ro_end) -diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c -index d21cd625c0de..cc97a43268ee 100644 ---- a/arch/sparc/kernel/traps_64.c -+++ b/arch/sparc/kernel/traps_64.c -@@ -85,7 +85,7 @@ static void dump_tl1_traplog(struct tl1_traplog *p) - - void bad_trap(struct pt_regs *regs, long lvl) - { -- char buffer[32]; -+ char buffer[36]; - siginfo_t info; - - if (notify_die(DIE_TRAP, "bad trap", regs, -@@ -116,7 +116,7 @@ void bad_trap(struct pt_regs *regs, long lvl) - - void bad_trap_tl1(struct pt_regs *regs, long lvl) - { -- char buffer[32]; -+ char buffer[36]; - - if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs, - 0, lvl, SIGTRAP) == NOTIFY_STOP) -diff --git a/arch/xtensa/include/asm/irq.h b/arch/xtensa/include/asm/irq.h -index f71f88ea7646..19707db966f1 100644 ---- a/arch/xtensa/include/asm/irq.h -+++ b/arch/xtensa/include/asm/irq.h -@@ -29,7 +29,8 @@ static inline void variant_irq_disable(unsigned int irq) { } - # define PLATFORM_NR_IRQS 0 - #endif - #define XTENSA_NR_IRQS XCHAL_NUM_INTERRUPTS --#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS) -+#define NR_IRQS (XTENSA_NR_IRQS + VARIANT_NR_IRQS + PLATFORM_NR_IRQS + 1) -+#define XTENSA_PIC_LINUX_IRQ(hwirq) ((hwirq) + 1) - - #if VARIANT_NR_IRQS == 0 - static inline void variant_init_irq(void) { } -diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c -index 4ac3d23161cf..441694464b1e 100644 ---- a/arch/xtensa/kernel/irq.c -+++ b/arch/xtensa/kernel/irq.c -@@ -34,11 +34,6 @@ asmlinkage void do_IRQ(int hwirq, struct pt_regs *regs) - { - int irq = irq_find_mapping(NULL, hwirq); - -- if (hwirq >= NR_IRQS) { -- printk(KERN_EMERG "%s: cannot handle IRQ %d\n", -- __func__, hwirq); -- } -- - #ifdef CONFIG_DEBUG_STACKOVERFLOW - /* Debugging check for stack overflow: is there less than 1KB free? */ - { -diff --git a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -index dbeea2b440a1..1fda7e20dfcb 100644 ---- a/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -+++ b/arch/xtensa/platforms/xtfpga/include/platform/hardware.h -@@ -24,16 +24,18 @@ - - /* Interrupt configuration. */ - --#define PLATFORM_NR_IRQS 10 -+#define PLATFORM_NR_IRQS 0 - - /* Default assignment of LX60 devices to external interrupts. */ - - #ifdef CONFIG_XTENSA_MX - #define DUART16552_INTNUM XCHAL_EXTINT3_NUM - #define OETH_IRQ XCHAL_EXTINT4_NUM -+#define C67X00_IRQ XCHAL_EXTINT8_NUM - #else - #define DUART16552_INTNUM XCHAL_EXTINT0_NUM - #define OETH_IRQ XCHAL_EXTINT1_NUM -+#define C67X00_IRQ XCHAL_EXTINT5_NUM - #endif - - /* -@@ -63,5 +65,5 @@ - - #define C67X00_PADDR (XCHAL_KIO_PADDR + 0x0D0D0000) - #define C67X00_SIZE 0x10 --#define C67X00_IRQ 5 -+ - #endif /* __XTENSA_XTAVNET_HARDWARE_H */ -diff --git a/arch/xtensa/platforms/xtfpga/setup.c b/arch/xtensa/platforms/xtfpga/setup.c -index e9f65f79cf2e..d1e9439fad45 100644 ---- a/arch/xtensa/platforms/xtfpga/setup.c -+++ b/arch/xtensa/platforms/xtfpga/setup.c -@@ -209,8 +209,8 @@ static struct resource ethoc_res[] = { - .flags = IORESOURCE_MEM, - }, - [2] = { /* IRQ number */ -- .start = OETH_IRQ, -- .end = OETH_IRQ, -+ .start = XTENSA_PIC_LINUX_IRQ(OETH_IRQ), -+ .end = XTENSA_PIC_LINUX_IRQ(OETH_IRQ), - .flags = IORESOURCE_IRQ, - }, - }; -@@ -246,8 +246,8 @@ static struct resource c67x00_res[] = { - .flags = IORESOURCE_MEM, - }, - [1] = { /* IRQ number */ -- .start = C67X00_IRQ, -- .end = C67X00_IRQ, -+ .start = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ), -+ .end = XTENSA_PIC_LINUX_IRQ(C67X00_IRQ), - .flags = IORESOURCE_IRQ, - }, - }; -@@ -280,7 +280,7 @@ static struct resource serial_resource = { - static struct plat_serial8250_port serial_platform_data[] = { - [0] = { - .mapbase = DUART16552_PADDR, -- .irq = DUART16552_INTNUM, -+ .irq = XTENSA_PIC_LINUX_IRQ(DUART16552_INTNUM), - .flags = UPF_BOOT_AUTOCONF | UPF_SKIP_TEST | - UPF_IOREMAP, - .iotype = UPIO_MEM32, -diff --git a/block/partitions/msdos.c b/block/partitions/msdos.c -index 93e7c1b32edd..5610cd537da7 100644 ---- a/block/partitions/msdos.c -+++ b/block/partitions/msdos.c -@@ -300,6 +300,8 @@ static void parse_bsd(struct parsed_partitions *state, - continue; - bsd_start = le32_to_cpu(p->p_offset); - bsd_size = le32_to_cpu(p->p_size); -+ if (memcmp(flavour, "bsd\0", 4) == 0) -+ bsd_start += offset; - if (offset == bsd_start && size == bsd_size) - /* full parent partition, we have it already */ - continue; -diff --git a/drivers/base/power/runtime.c b/drivers/base/power/runtime.c -index 3252429f96af..3a20dc594338 100644 ---- a/drivers/base/power/runtime.c -+++ b/drivers/base/power/runtime.c -@@ -889,13 +889,13 @@ int __pm_runtime_idle(struct device *dev, int rpmflags) - unsigned long flags; - int retval; - -- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); -- - if (rpmflags & RPM_GET_PUT) { - if (!atomic_dec_and_test(&dev->power.usage_count)) - return 0; - } - -+ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); -+ - spin_lock_irqsave(&dev->power.lock, flags); - retval = rpm_idle(dev, rpmflags); - spin_unlock_irqrestore(&dev->power.lock, flags); -@@ -921,13 +921,13 @@ int __pm_runtime_suspend(struct device *dev, int rpmflags) - unsigned long flags; - int retval; - -- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); -- - if (rpmflags & RPM_GET_PUT) { - if (!atomic_dec_and_test(&dev->power.usage_count)) - return 0; - } - -+ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); -+ - spin_lock_irqsave(&dev->power.lock, flags); - retval = rpm_suspend(dev, rpmflags); - spin_unlock_irqrestore(&dev->power.lock, flags); -@@ -952,7 +952,8 @@ int __pm_runtime_resume(struct device *dev, int rpmflags) - unsigned long flags; - int retval; - -- might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe); -+ might_sleep_if(!(rpmflags & RPM_ASYNC) && !dev->power.irq_safe && -+ dev->power.runtime_status != RPM_ACTIVE); - - if (rpmflags & RPM_GET_PUT) - atomic_inc(&dev->power.usage_count); -diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h -index 05f6522c0457..b92139e9b9d8 100644 ---- a/drivers/gpu/drm/ast/ast_drv.h -+++ b/drivers/gpu/drm/ast/ast_drv.h -@@ -113,6 +113,7 @@ struct ast_private { - struct ttm_bo_kmap_obj cache_kmap; - int next_cursor; - bool support_wide_screen; -+ bool DisableP2A; - - enum ast_tx_chip tx_chip_type; - u8 dp501_maxclk; -diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c -index 9b8f0b975ca6..6c021165ca67 100644 ---- a/drivers/gpu/drm/ast/ast_main.c -+++ b/drivers/gpu/drm/ast/ast_main.c -@@ -124,6 +124,12 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - } else - *need_post = false; - -+ /* Check P2A Access */ -+ ast->DisableP2A = true; -+ data = ast_read32(ast, 0xf004); -+ if (data != 0xFFFFFFFF) -+ ast->DisableP2A = false; -+ - /* Check if we support wide screen */ - switch (ast->chip) { - case AST1180: -@@ -140,15 +146,17 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - ast->support_wide_screen = true; - else { - ast->support_wide_screen = false; -- /* Read SCU7c (silicon revision register) */ -- ast_write32(ast, 0xf004, 0x1e6e0000); -- ast_write32(ast, 0xf000, 0x1); -- data = ast_read32(ast, 0x1207c); -- data &= 0x300; -- if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ -- ast->support_wide_screen = true; -- if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ -- ast->support_wide_screen = true; -+ if (ast->DisableP2A == false) { -+ /* Read SCU7c (silicon revision register) */ -+ ast_write32(ast, 0xf004, 0x1e6e0000); -+ ast_write32(ast, 0xf000, 0x1); -+ data = ast_read32(ast, 0x1207c); -+ data &= 0x300; -+ if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ -+ ast->support_wide_screen = true; -+ if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ -+ ast->support_wide_screen = true; -+ } - } - break; - } -@@ -216,80 +224,81 @@ static int ast_get_dram_info(struct drm_device *dev) - uint32_t data, data2; - uint32_t denum, num, div, ref_pll; - -- ast_write32(ast, 0xf004, 0x1e6e0000); -- ast_write32(ast, 0xf000, 0x1); -- -- -- ast_write32(ast, 0x10000, 0xfc600309); -- -- do { -- if (pci_channel_offline(dev->pdev)) -- return -EIO; -- } while (ast_read32(ast, 0x10000) != 0x01); -- data = ast_read32(ast, 0x10004); -- -- if (data & 0x40) -+ if (ast->DisableP2A) -+ { - ast->dram_bus_width = 16; -+ ast->dram_type = AST_DRAM_1Gx16; -+ ast->mclk = 396; -+ } - else -- ast->dram_bus_width = 32; -+ { -+ ast_write32(ast, 0xf004, 0x1e6e0000); -+ ast_write32(ast, 0xf000, 0x1); -+ data = ast_read32(ast, 0x10004); -+ -+ if (data & 0x40) -+ ast->dram_bus_width = 16; -+ else -+ ast->dram_bus_width = 32; -+ -+ if (ast->chip == AST2300 || ast->chip == AST2400) { -+ switch (data & 0x03) { -+ case 0: -+ ast->dram_type = AST_DRAM_512Mx16; -+ break; -+ default: -+ case 1: -+ ast->dram_type = AST_DRAM_1Gx16; -+ break; -+ case 2: -+ ast->dram_type = AST_DRAM_2Gx16; -+ break; -+ case 3: -+ ast->dram_type = AST_DRAM_4Gx16; -+ break; -+ } -+ } else { -+ switch (data & 0x0c) { -+ case 0: -+ case 4: -+ ast->dram_type = AST_DRAM_512Mx16; -+ break; -+ case 8: -+ if (data & 0x40) -+ ast->dram_type = AST_DRAM_1Gx16; -+ else -+ ast->dram_type = AST_DRAM_512Mx32; -+ break; -+ case 0xc: -+ ast->dram_type = AST_DRAM_1Gx32; -+ break; -+ } -+ } - -- if (ast->chip == AST2300 || ast->chip == AST2400) { -- switch (data & 0x03) { -- case 0: -- ast->dram_type = AST_DRAM_512Mx16; -- break; -- default: -- case 1: -- ast->dram_type = AST_DRAM_1Gx16; -- break; -- case 2: -- ast->dram_type = AST_DRAM_2Gx16; -- break; -+ data = ast_read32(ast, 0x10120); -+ data2 = ast_read32(ast, 0x10170); -+ if (data2 & 0x2000) -+ ref_pll = 14318; -+ else -+ ref_pll = 12000; -+ -+ denum = data & 0x1f; -+ num = (data & 0x3fe0) >> 5; -+ data = (data & 0xc000) >> 14; -+ switch (data) { - case 3: -- ast->dram_type = AST_DRAM_4Gx16; -- break; -- } -- } else { -- switch (data & 0x0c) { -- case 0: -- case 4: -- ast->dram_type = AST_DRAM_512Mx16; -+ div = 0x4; - break; -- case 8: -- if (data & 0x40) -- ast->dram_type = AST_DRAM_1Gx16; -- else -- ast->dram_type = AST_DRAM_512Mx32; -+ case 2: -+ case 1: -+ div = 0x2; - break; -- case 0xc: -- ast->dram_type = AST_DRAM_1Gx32; -+ default: -+ div = 0x1; - break; - } -+ ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); - } -- -- data = ast_read32(ast, 0x10120); -- data2 = ast_read32(ast, 0x10170); -- if (data2 & 0x2000) -- ref_pll = 14318; -- else -- ref_pll = 12000; -- -- denum = data & 0x1f; -- num = (data & 0x3fe0) >> 5; -- data = (data & 0xc000) >> 14; -- switch (data) { -- case 3: -- div = 0x4; -- break; -- case 2: -- case 1: -- div = 0x2; -- break; -- default: -- div = 0x1; -- break; -- } -- ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); - return 0; - } - -diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c -index 30672a3df8a9..270e8fb2803f 100644 ---- a/drivers/gpu/drm/ast/ast_post.c -+++ b/drivers/gpu/drm/ast/ast_post.c -@@ -375,12 +375,20 @@ void ast_post_gpu(struct drm_device *dev) - ast_enable_mmio(dev); - ast_set_def_ext_reg(dev); - -- if (ast->chip == AST2300 || ast->chip == AST2400) -- ast_init_dram_2300(dev); -- else -- ast_init_dram_reg(dev); -+ if (ast->DisableP2A == false) -+ { -+ if (ast->chip == AST2300 || ast->chip == AST2400) -+ ast_init_dram_2300(dev); -+ else -+ ast_init_dram_reg(dev); - -- ast_init_3rdtx(dev); -+ ast_init_3rdtx(dev); -+ } -+ else -+ { -+ if (ast->tx_chip_type != AST_TX_NONE) -+ ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x80); /* Enable DVO */ -+ } - } - - /* AST 2300 DRAM settings */ -diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c -index 58a3f7cf2fb3..00de1bf81519 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_display.c -+++ b/drivers/gpu/drm/nouveau/nouveau_display.c -@@ -370,7 +370,8 @@ nouveau_display_init(struct drm_device *dev) - return ret; - - /* enable polling for external displays */ -- drm_kms_helper_poll_enable(dev); -+ if (!dev->mode_config.poll_enabled) -+ drm_kms_helper_poll_enable(dev); - - /* enable hotplug interrupts */ - list_for_each_entry(connector, &dev->mode_config.connector_list, head) { -diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c -index d236fc7c425b..91a61d2cca88 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_drm.c -+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c -@@ -743,7 +743,10 @@ nouveau_pmops_runtime_resume(struct device *dev) - pci_set_master(pdev); - - ret = nouveau_do_resume(drm_dev, true); -- drm_kms_helper_poll_enable(drm_dev); -+ -+ if (!drm_dev->mode_config.poll_enabled) -+ drm_kms_helper_poll_enable(drm_dev); -+ - /* do magic */ - nvif_mask(&device->object, 0x088488, (1 << 25), (1 << 25)); - vga_switcheroo_set_dynamic_switch(pdev, VGA_SWITCHEROO_ON); -diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h -index 2e3a62d38fe9..1621c8ae0fa0 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_fence.h -+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h -@@ -99,6 +99,7 @@ struct nv84_fence_priv { - struct nouveau_bo *bo; - struct nouveau_bo *bo_gart; - u32 *suspend; -+ struct mutex mutex; - }; - - u64 nv84_fence_crtc(struct nouveau_channel *, int); -diff --git a/drivers/gpu/drm/nouveau/nouveau_usif.c b/drivers/gpu/drm/nouveau/nouveau_usif.c -index 6ae1b3494bcd..b7b961233949 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_usif.c -+++ b/drivers/gpu/drm/nouveau/nouveau_usif.c -@@ -313,7 +313,8 @@ usif_ioctl(struct drm_file *filp, void __user *user, u32 argc) - if (nvif_unpack(argv->v0, 0, 0, true)) { - /* block access to objects not created via this interface */ - owner = argv->v0.owner; -- if (argv->v0.object == 0ULL) -+ if (argv->v0.object == 0ULL && -+ argv->v0.type != NVIF_IOCTL_V0_DEL) - argv->v0.owner = NVDRM_OBJECT_ANY; /* except client */ - else - argv->v0.owner = NVDRM_OBJECT_USIF; -diff --git a/drivers/gpu/drm/nouveau/nv84_fence.c b/drivers/gpu/drm/nouveau/nv84_fence.c -index 412c5be5a9ca..7bc26eceda66 100644 ---- a/drivers/gpu/drm/nouveau/nv84_fence.c -+++ b/drivers/gpu/drm/nouveau/nv84_fence.c -@@ -121,8 +121,10 @@ nv84_fence_context_del(struct nouveau_channel *chan) - } - - nouveau_bo_wr32(priv->bo, chan->chid * 16 / 4, fctx->base.sequence); -+ mutex_lock(&priv->mutex); - nouveau_bo_vma_del(priv->bo, &fctx->vma_gart); - nouveau_bo_vma_del(priv->bo, &fctx->vma); -+ mutex_unlock(&priv->mutex); - nouveau_fence_context_del(&fctx->base); - chan->fence = NULL; - nouveau_fence_context_free(&fctx->base); -@@ -148,11 +150,13 @@ nv84_fence_context_new(struct nouveau_channel *chan) - fctx->base.sync32 = nv84_fence_sync32; - fctx->base.sequence = nv84_fence_read(chan); - -+ mutex_lock(&priv->mutex); - ret = nouveau_bo_vma_add(priv->bo, cli->vm, &fctx->vma); - if (ret == 0) { - ret = nouveau_bo_vma_add(priv->bo_gart, cli->vm, - &fctx->vma_gart); - } -+ mutex_unlock(&priv->mutex); - - /* map display semaphore buffers into channel's vm */ - for (i = 0; !ret && i < chan->drm->dev->mode_config.num_crtc; i++) { -@@ -232,6 +236,8 @@ nv84_fence_create(struct nouveau_drm *drm) - priv->base.context_base = fence_context_alloc(priv->base.contexts); - priv->base.uevent = true; - -+ mutex_init(&priv->mutex); -+ - /* Use VRAM if there is any ; otherwise fallback to system memory */ - domain = drm->device.info.ram_size != 0 ? TTM_PL_FLAG_VRAM : - /* -diff --git a/drivers/i2c/busses/i2c-piix4.c b/drivers/i2c/busses/i2c-piix4.c -index 630bce68bf38..b61db9db3ca5 100644 ---- a/drivers/i2c/busses/i2c-piix4.c -+++ b/drivers/i2c/busses/i2c-piix4.c -@@ -54,7 +54,7 @@ - #define SMBSLVDAT (0xC + piix4_smba) - - /* count for request_region */ --#define SMBIOSIZE 8 -+#define SMBIOSIZE 9 - - /* PCI Address Constants */ - #define SMBBA 0x090 -diff --git a/drivers/irqchip/irq-xtensa-mx.c b/drivers/irqchip/irq-xtensa-mx.c -index bb3ac5fe5846..72a391e01011 100644 ---- a/drivers/irqchip/irq-xtensa-mx.c -+++ b/drivers/irqchip/irq-xtensa-mx.c -@@ -142,7 +142,7 @@ static struct irq_chip xtensa_mx_irq_chip = { - int __init xtensa_mx_init_legacy(struct device_node *interrupt_parent) - { - struct irq_domain *root_domain = -- irq_domain_add_legacy(NULL, NR_IRQS, 0, 0, -+ irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0, - &xtensa_mx_irq_domain_ops, - &xtensa_mx_irq_chip); - irq_set_default_host(root_domain); -diff --git a/drivers/irqchip/irq-xtensa-pic.c b/drivers/irqchip/irq-xtensa-pic.c -index 472ae1770964..f728755fa292 100644 ---- a/drivers/irqchip/irq-xtensa-pic.c -+++ b/drivers/irqchip/irq-xtensa-pic.c -@@ -89,7 +89,7 @@ static struct irq_chip xtensa_irq_chip = { - int __init xtensa_pic_init_legacy(struct device_node *interrupt_parent) - { - struct irq_domain *root_domain = -- irq_domain_add_legacy(NULL, NR_IRQS, 0, 0, -+ irq_domain_add_legacy(NULL, NR_IRQS - 1, 1, 0, - &xtensa_irq_domain_ops, &xtensa_irq_chip); - irq_set_default_host(root_domain); - return 0; -diff --git a/drivers/net/ethernet/adaptec/starfire.c b/drivers/net/ethernet/adaptec/starfire.c -index ac7288240d55..f089fa954f42 100644 ---- a/drivers/net/ethernet/adaptec/starfire.c -+++ b/drivers/net/ethernet/adaptec/starfire.c -@@ -1153,6 +1153,12 @@ static void init_ring(struct net_device *dev) - if (skb == NULL) - break; - np->rx_info[i].mapping = pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE); -+ if (pci_dma_mapping_error(np->pci_dev, -+ np->rx_info[i].mapping)) { -+ dev_kfree_skb(skb); -+ np->rx_info[i].skb = NULL; -+ break; -+ } - /* Grrr, we cannot offset to correctly align the IP header. */ - np->rx_ring[i].rxaddr = cpu_to_dma(np->rx_info[i].mapping | RxDescValid); - } -@@ -1183,8 +1189,9 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) - { - struct netdev_private *np = netdev_priv(dev); - unsigned int entry; -+ unsigned int prev_tx; - u32 status; -- int i; -+ int i, j; - - /* - * be cautious here, wrapping the queue has weird semantics -@@ -1202,6 +1209,7 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) - } - #endif /* ZEROCOPY && HAS_BROKEN_FIRMWARE */ - -+ prev_tx = np->cur_tx; - entry = np->cur_tx % TX_RING_SIZE; - for (i = 0; i < skb_num_frags(skb); i++) { - int wrap_ring = 0; -@@ -1235,6 +1243,11 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) - skb_frag_size(this_frag), - PCI_DMA_TODEVICE); - } -+ if (pci_dma_mapping_error(np->pci_dev, -+ np->tx_info[entry].mapping)) { -+ dev->stats.tx_dropped++; -+ goto err_out; -+ } - - np->tx_ring[entry].addr = cpu_to_dma(np->tx_info[entry].mapping); - np->tx_ring[entry].status = cpu_to_le32(status); -@@ -1269,8 +1282,30 @@ static netdev_tx_t start_tx(struct sk_buff *skb, struct net_device *dev) - netif_stop_queue(dev); - - return NETDEV_TX_OK; --} - -+err_out: -+ entry = prev_tx % TX_RING_SIZE; -+ np->tx_info[entry].skb = NULL; -+ if (i > 0) { -+ pci_unmap_single(np->pci_dev, -+ np->tx_info[entry].mapping, -+ skb_first_frag_len(skb), -+ PCI_DMA_TODEVICE); -+ np->tx_info[entry].mapping = 0; -+ entry = (entry + np->tx_info[entry].used_slots) % TX_RING_SIZE; -+ for (j = 1; j < i; j++) { -+ pci_unmap_single(np->pci_dev, -+ np->tx_info[entry].mapping, -+ skb_frag_size( -+ &skb_shinfo(skb)->frags[j-1]), -+ PCI_DMA_TODEVICE); -+ entry++; -+ } -+ } -+ dev_kfree_skb_any(skb); -+ np->cur_tx = prev_tx; -+ return NETDEV_TX_OK; -+} - - /* The interrupt handler does all of the Rx thread work and cleans up - after the Tx thread. */ -@@ -1570,6 +1605,12 @@ static void refill_rx_ring(struct net_device *dev) - break; /* Better luck next round. */ - np->rx_info[entry].mapping = - pci_map_single(np->pci_dev, skb->data, np->rx_buf_sz, PCI_DMA_FROMDEVICE); -+ if (pci_dma_mapping_error(np->pci_dev, -+ np->rx_info[entry].mapping)) { -+ dev_kfree_skb(skb); -+ np->rx_info[entry].skb = NULL; -+ break; -+ } - np->rx_ring[entry].rxaddr = - cpu_to_dma(np->rx_info[entry].mapping | RxDescValid); - } -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 3e233d924cce..6a061f17a44f 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -1999,8 +1999,8 @@ static void free_skb_rx_queue(struct gfar_priv_rx_q *rx_queue) - if (!rxb->page) - continue; - -- dma_unmap_single(rx_queue->dev, rxb->dma, -- PAGE_SIZE, DMA_FROM_DEVICE); -+ dma_unmap_page(rx_queue->dev, rxb->dma, -+ PAGE_SIZE, DMA_FROM_DEVICE); - __free_page(rxb->page); - - rxb->page = NULL; -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_enet.c b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -index 08cef0dfb5db..2fa54b0b0679 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_enet.c -+++ b/drivers/net/ethernet/hisilicon/hns/hns_enet.c -@@ -105,8 +105,8 @@ int hns_nic_net_xmit_hw(struct net_device *ndev, - struct hns_nic_ring_data *ring_data) - { - struct hns_nic_priv *priv = netdev_priv(ndev); -- struct device *dev = priv->dev; - struct hnae_ring *ring = ring_data->ring; -+ struct device *dev = ring_to_dev(ring); - struct netdev_queue *dev_queue; - struct skb_frag_struct *frag; - int buf_num; -diff --git a/drivers/net/ethernet/mellanox/mlx4/catas.c b/drivers/net/ethernet/mellanox/mlx4/catas.c -index 715de8affcc9..e203d0c4e5a3 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/catas.c -+++ b/drivers/net/ethernet/mellanox/mlx4/catas.c -@@ -158,7 +158,7 @@ static int mlx4_reset_slave(struct mlx4_dev *dev) - return -ETIMEDOUT; - } - --static int mlx4_comm_internal_err(u32 slave_read) -+int mlx4_comm_internal_err(u32 slave_read) - { - return (u32)COMM_CHAN_EVENT_INTERNAL_ERR == - (slave_read & (u32)COMM_CHAN_EVENT_INTERNAL_ERR) ? 1 : 0; -diff --git a/drivers/net/ethernet/mellanox/mlx4/intf.c b/drivers/net/ethernet/mellanox/mlx4/intf.c -index 0472941af820..1a134e08f010 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/intf.c -+++ b/drivers/net/ethernet/mellanox/mlx4/intf.c -@@ -218,6 +218,18 @@ void mlx4_unregister_device(struct mlx4_dev *dev) - struct mlx4_interface *intf; - - mlx4_stop_catas_poll(dev); -+ if (dev->persist->interface_state & MLX4_INTERFACE_STATE_DELETION && -+ mlx4_is_slave(dev)) { -+ /* In mlx4_remove_one on a VF */ -+ u32 slave_read = -+ swab32(readl(&mlx4_priv(dev)->mfunc.comm->slave_read)); -+ -+ if (mlx4_comm_internal_err(slave_read)) { -+ mlx4_dbg(dev, "%s: comm channel is down, entering error state.\n", -+ __func__); -+ mlx4_enter_error_state(dev->persist); -+ } -+ } - mutex_lock(&intf_mutex); - - list_for_each_entry(intf, &intf_list, list) -diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h -index e1cf9036af22..f5fdbd53d052 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h -+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h -@@ -1205,6 +1205,7 @@ void mlx4_qp_event(struct mlx4_dev *dev, u32 qpn, int event_type); - void mlx4_srq_event(struct mlx4_dev *dev, u32 srqn, int event_type); - - void mlx4_enter_error_state(struct mlx4_dev_persistent *persist); -+int mlx4_comm_internal_err(u32 slave_read); - - int mlx4_SENSE_PORT(struct mlx4_dev *dev, int port, - enum mlx4_port_type *type); -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 549ad2018e7f..1e61d4da72db 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -171,6 +171,49 @@ static struct mdiobb_ops bb_ops = { - .get_mdio_data = ravb_get_mdio_data, - }; - -+/* Free TX skb function for AVB-IP */ -+static int ravb_tx_free(struct net_device *ndev, int q, bool free_txed_only) -+{ -+ struct ravb_private *priv = netdev_priv(ndev); -+ struct net_device_stats *stats = &priv->stats[q]; -+ struct ravb_tx_desc *desc; -+ int free_num = 0; -+ int entry; -+ u32 size; -+ -+ for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { -+ bool txed; -+ -+ entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] * -+ NUM_TX_DESC); -+ desc = &priv->tx_ring[q][entry]; -+ txed = desc->die_dt == DT_FEMPTY; -+ if (free_txed_only && !txed) -+ break; -+ /* Descriptor type must be checked before all other reads */ -+ dma_rmb(); -+ size = le16_to_cpu(desc->ds_tagl) & TX_DS; -+ /* Free the original skb. */ -+ if (priv->tx_skb[q][entry / NUM_TX_DESC]) { -+ dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr), -+ size, DMA_TO_DEVICE); -+ /* Last packet descriptor? */ -+ if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) { -+ entry /= NUM_TX_DESC; -+ dev_kfree_skb_any(priv->tx_skb[q][entry]); -+ priv->tx_skb[q][entry] = NULL; -+ if (txed) -+ stats->tx_packets++; -+ } -+ free_num++; -+ } -+ if (txed) -+ stats->tx_bytes += size; -+ desc->die_dt = DT_EEMPTY; -+ } -+ return free_num; -+} -+ - /* Free skb's and DMA buffers for Ethernet AVB */ - static void ravb_ring_free(struct net_device *ndev, int q) - { -@@ -186,19 +229,21 @@ static void ravb_ring_free(struct net_device *ndev, int q) - kfree(priv->rx_skb[q]); - priv->rx_skb[q] = NULL; - -- /* Free TX skb ringbuffer */ -- if (priv->tx_skb[q]) { -- for (i = 0; i < priv->num_tx_ring[q]; i++) -- dev_kfree_skb(priv->tx_skb[q][i]); -- } -- kfree(priv->tx_skb[q]); -- priv->tx_skb[q] = NULL; -- - /* Free aligned TX buffers */ - kfree(priv->tx_align[q]); - priv->tx_align[q] = NULL; - - if (priv->rx_ring[q]) { -+ for (i = 0; i < priv->num_rx_ring[q]; i++) { -+ struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i]; -+ -+ if (!dma_mapping_error(ndev->dev.parent, -+ le32_to_cpu(desc->dptr))) -+ dma_unmap_single(ndev->dev.parent, -+ le32_to_cpu(desc->dptr), -+ PKT_BUF_SZ, -+ DMA_FROM_DEVICE); -+ } - ring_size = sizeof(struct ravb_ex_rx_desc) * - (priv->num_rx_ring[q] + 1); - dma_free_coherent(ndev->dev.parent, ring_size, priv->rx_ring[q], -@@ -207,12 +252,20 @@ static void ravb_ring_free(struct net_device *ndev, int q) - } - - if (priv->tx_ring[q]) { -+ ravb_tx_free(ndev, q, false); -+ - ring_size = sizeof(struct ravb_tx_desc) * - (priv->num_tx_ring[q] * NUM_TX_DESC + 1); - dma_free_coherent(ndev->dev.parent, ring_size, priv->tx_ring[q], - priv->tx_desc_dma[q]); - priv->tx_ring[q] = NULL; - } -+ -+ /* Free TX skb ringbuffer. -+ * SKBs are freed by ravb_tx_free() call above. -+ */ -+ kfree(priv->tx_skb[q]); -+ priv->tx_skb[q] = NULL; - } - - /* Format skb and descriptor buffer for Ethernet AVB */ -@@ -420,44 +473,6 @@ static int ravb_dmac_init(struct net_device *ndev) - return 0; - } - --/* Free TX skb function for AVB-IP */ --static int ravb_tx_free(struct net_device *ndev, int q) --{ -- struct ravb_private *priv = netdev_priv(ndev); -- struct net_device_stats *stats = &priv->stats[q]; -- struct ravb_tx_desc *desc; -- int free_num = 0; -- int entry; -- u32 size; -- -- for (; priv->cur_tx[q] - priv->dirty_tx[q] > 0; priv->dirty_tx[q]++) { -- entry = priv->dirty_tx[q] % (priv->num_tx_ring[q] * -- NUM_TX_DESC); -- desc = &priv->tx_ring[q][entry]; -- if (desc->die_dt != DT_FEMPTY) -- break; -- /* Descriptor type must be checked before all other reads */ -- dma_rmb(); -- size = le16_to_cpu(desc->ds_tagl) & TX_DS; -- /* Free the original skb. */ -- if (priv->tx_skb[q][entry / NUM_TX_DESC]) { -- dma_unmap_single(ndev->dev.parent, le32_to_cpu(desc->dptr), -- size, DMA_TO_DEVICE); -- /* Last packet descriptor? */ -- if (entry % NUM_TX_DESC == NUM_TX_DESC - 1) { -- entry /= NUM_TX_DESC; -- dev_kfree_skb_any(priv->tx_skb[q][entry]); -- priv->tx_skb[q][entry] = NULL; -- stats->tx_packets++; -- } -- free_num++; -- } -- stats->tx_bytes += size; -- desc->die_dt = DT_EEMPTY; -- } -- return free_num; --} -- - static void ravb_get_tx_tstamp(struct net_device *ndev) - { - struct ravb_private *priv = netdev_priv(ndev); -@@ -797,7 +812,7 @@ static int ravb_poll(struct napi_struct *napi, int budget) - spin_lock_irqsave(&priv->lock, flags); - /* Clear TX interrupt */ - ravb_write(ndev, ~mask, TIS); -- ravb_tx_free(ndev, q); -+ ravb_tx_free(ndev, q, true); - netif_wake_subqueue(ndev, q); - mmiowb(); - spin_unlock_irqrestore(&priv->lock, flags); -@@ -1393,7 +1408,8 @@ static netdev_tx_t ravb_start_xmit(struct sk_buff *skb, struct net_device *ndev) - - priv->cur_tx[q] += NUM_TX_DESC; - if (priv->cur_tx[q] - priv->dirty_tx[q] > -- (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && !ravb_tx_free(ndev, q)) -+ (priv->num_tx_ring[q] - 1) * NUM_TX_DESC && -+ !ravb_tx_free(ndev, q, true)) - netif_stop_subqueue(ndev, q); - - exit: -diff --git a/drivers/net/ethernet/xilinx/xilinx_emaclite.c b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -index cf468c87ce57..4cb8b85cbf2c 100644 ---- a/drivers/net/ethernet/xilinx/xilinx_emaclite.c -+++ b/drivers/net/ethernet/xilinx/xilinx_emaclite.c -@@ -100,6 +100,14 @@ - /* BUFFER_ALIGN(adr) calculates the number of bytes to the next alignment. */ - #define BUFFER_ALIGN(adr) ((ALIGNMENT - ((u32) adr)) % ALIGNMENT) - -+#ifdef __BIG_ENDIAN -+#define xemaclite_readl ioread32be -+#define xemaclite_writel iowrite32be -+#else -+#define xemaclite_readl ioread32 -+#define xemaclite_writel iowrite32 -+#endif -+ - /** - * struct net_local - Our private per device data - * @ndev: instance of the network device -@@ -158,15 +166,15 @@ static void xemaclite_enable_interrupts(struct net_local *drvdata) - u32 reg_data; - - /* Enable the Tx interrupts for the first Buffer */ -- reg_data = __raw_readl(drvdata->base_addr + XEL_TSR_OFFSET); -- __raw_writel(reg_data | XEL_TSR_XMIT_IE_MASK, -- drvdata->base_addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(drvdata->base_addr + XEL_TSR_OFFSET); -+ xemaclite_writel(reg_data | XEL_TSR_XMIT_IE_MASK, -+ drvdata->base_addr + XEL_TSR_OFFSET); - - /* Enable the Rx interrupts for the first buffer */ -- __raw_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET); -+ xemaclite_writel(XEL_RSR_RECV_IE_MASK, drvdata->base_addr + XEL_RSR_OFFSET); - - /* Enable the Global Interrupt Enable */ -- __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); -+ xemaclite_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); - } - - /** -@@ -181,17 +189,17 @@ static void xemaclite_disable_interrupts(struct net_local *drvdata) - u32 reg_data; - - /* Disable the Global Interrupt Enable */ -- __raw_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); -+ xemaclite_writel(XEL_GIER_GIE_MASK, drvdata->base_addr + XEL_GIER_OFFSET); - - /* Disable the Tx interrupts for the first buffer */ -- reg_data = __raw_readl(drvdata->base_addr + XEL_TSR_OFFSET); -- __raw_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK), -- drvdata->base_addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(drvdata->base_addr + XEL_TSR_OFFSET); -+ xemaclite_writel(reg_data & (~XEL_TSR_XMIT_IE_MASK), -+ drvdata->base_addr + XEL_TSR_OFFSET); - - /* Disable the Rx interrupts for the first buffer */ -- reg_data = __raw_readl(drvdata->base_addr + XEL_RSR_OFFSET); -- __raw_writel(reg_data & (~XEL_RSR_RECV_IE_MASK), -- drvdata->base_addr + XEL_RSR_OFFSET); -+ reg_data = xemaclite_readl(drvdata->base_addr + XEL_RSR_OFFSET); -+ xemaclite_writel(reg_data & (~XEL_RSR_RECV_IE_MASK), -+ drvdata->base_addr + XEL_RSR_OFFSET); - } - - /** -@@ -323,7 +331,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, - byte_count = ETH_FRAME_LEN; - - /* Check if the expected buffer is available */ -- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); - if ((reg_data & (XEL_TSR_XMIT_BUSY_MASK | - XEL_TSR_XMIT_ACTIVE_MASK)) == 0) { - -@@ -336,7 +344,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, - - addr = (void __iomem __force *)((u32 __force)addr ^ - XEL_BUFFER_OFFSET); -- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); - - if ((reg_data & (XEL_TSR_XMIT_BUSY_MASK | - XEL_TSR_XMIT_ACTIVE_MASK)) != 0) -@@ -347,16 +355,16 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, - /* Write the frame to the buffer */ - xemaclite_aligned_write(data, (u32 __force *) addr, byte_count); - -- __raw_writel((byte_count & XEL_TPLR_LENGTH_MASK), -- addr + XEL_TPLR_OFFSET); -+ xemaclite_writel((byte_count & XEL_TPLR_LENGTH_MASK), -+ addr + XEL_TPLR_OFFSET); - - /* Update the Tx Status Register to indicate that there is a - * frame to send. Set the XEL_TSR_XMIT_ACTIVE_MASK flag which - * is used by the interrupt handler to check whether a frame - * has been transmitted */ -- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); - reg_data |= (XEL_TSR_XMIT_BUSY_MASK | XEL_TSR_XMIT_ACTIVE_MASK); -- __raw_writel(reg_data, addr + XEL_TSR_OFFSET); -+ xemaclite_writel(reg_data, addr + XEL_TSR_OFFSET); - - return 0; - } -@@ -371,7 +379,7 @@ static int xemaclite_send_data(struct net_local *drvdata, u8 *data, - * - * Return: Total number of bytes received - */ --static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) -+static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data, int maxlen) - { - void __iomem *addr; - u16 length, proto_type; -@@ -381,7 +389,7 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) - addr = (drvdata->base_addr + drvdata->next_rx_buf_to_use); - - /* Verify which buffer has valid data */ -- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); - - if ((reg_data & XEL_RSR_RECV_DONE_MASK) == XEL_RSR_RECV_DONE_MASK) { - if (drvdata->rx_ping_pong != 0) -@@ -398,27 +406,28 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) - return 0; /* No data was available */ - - /* Verify that buffer has valid data */ -- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); - if ((reg_data & XEL_RSR_RECV_DONE_MASK) != - XEL_RSR_RECV_DONE_MASK) - return 0; /* No data was available */ - } - - /* Get the protocol type of the ethernet frame that arrived */ -- proto_type = ((ntohl(__raw_readl(addr + XEL_HEADER_OFFSET + -+ proto_type = ((ntohl(xemaclite_readl(addr + XEL_HEADER_OFFSET + - XEL_RXBUFF_OFFSET)) >> XEL_HEADER_SHIFT) & - XEL_RPLR_LENGTH_MASK); - - /* Check if received ethernet frame is a raw ethernet frame - * or an IP packet or an ARP packet */ -- if (proto_type > (ETH_FRAME_LEN + ETH_FCS_LEN)) { -+ if (proto_type > ETH_DATA_LEN) { - - if (proto_type == ETH_P_IP) { -- length = ((ntohl(__raw_readl(addr + -+ length = ((ntohl(xemaclite_readl(addr + - XEL_HEADER_IP_LENGTH_OFFSET + - XEL_RXBUFF_OFFSET)) >> - XEL_HEADER_SHIFT) & - XEL_RPLR_LENGTH_MASK); -+ length = min_t(u16, length, ETH_DATA_LEN); - length += ETH_HLEN + ETH_FCS_LEN; - - } else if (proto_type == ETH_P_ARP) -@@ -431,14 +440,17 @@ static u16 xemaclite_recv_data(struct net_local *drvdata, u8 *data) - /* Use the length in the frame, plus the header and trailer */ - length = proto_type + ETH_HLEN + ETH_FCS_LEN; - -+ if (WARN_ON(length > maxlen)) -+ length = maxlen; -+ - /* Read from the EmacLite device */ - xemaclite_aligned_read((u32 __force *) (addr + XEL_RXBUFF_OFFSET), - data, length); - - /* Acknowledge the frame */ -- reg_data = __raw_readl(addr + XEL_RSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_RSR_OFFSET); - reg_data &= ~XEL_RSR_RECV_DONE_MASK; -- __raw_writel(reg_data, addr + XEL_RSR_OFFSET); -+ xemaclite_writel(reg_data, addr + XEL_RSR_OFFSET); - - return length; - } -@@ -465,14 +477,14 @@ static void xemaclite_update_address(struct net_local *drvdata, - - xemaclite_aligned_write(address_ptr, (u32 __force *) addr, ETH_ALEN); - -- __raw_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET); -+ xemaclite_writel(ETH_ALEN, addr + XEL_TPLR_OFFSET); - - /* Update the MAC address in the EmacLite */ -- reg_data = __raw_readl(addr + XEL_TSR_OFFSET); -- __raw_writel(reg_data | XEL_TSR_PROG_MAC_ADDR, addr + XEL_TSR_OFFSET); -+ reg_data = xemaclite_readl(addr + XEL_TSR_OFFSET); -+ xemaclite_writel(reg_data | XEL_TSR_PROG_MAC_ADDR, addr + XEL_TSR_OFFSET); - - /* Wait for EmacLite to finish with the MAC address update */ -- while ((__raw_readl(addr + XEL_TSR_OFFSET) & -+ while ((xemaclite_readl(addr + XEL_TSR_OFFSET) & - XEL_TSR_PROG_MAC_ADDR) != 0) - ; - } -@@ -605,7 +617,7 @@ static void xemaclite_rx_handler(struct net_device *dev) - - skb_reserve(skb, 2); - -- len = xemaclite_recv_data(lp, (u8 *) skb->data); -+ len = xemaclite_recv_data(lp, (u8 *) skb->data, len); - - if (!len) { - dev->stats.rx_errors++; -@@ -642,32 +654,32 @@ static irqreturn_t xemaclite_interrupt(int irq, void *dev_id) - u32 tx_status; - - /* Check if there is Rx Data available */ -- if ((__raw_readl(base_addr + XEL_RSR_OFFSET) & -+ if ((xemaclite_readl(base_addr + XEL_RSR_OFFSET) & - XEL_RSR_RECV_DONE_MASK) || -- (__raw_readl(base_addr + XEL_BUFFER_OFFSET + XEL_RSR_OFFSET) -+ (xemaclite_readl(base_addr + XEL_BUFFER_OFFSET + XEL_RSR_OFFSET) - & XEL_RSR_RECV_DONE_MASK)) - - xemaclite_rx_handler(dev); - - /* Check if the Transmission for the first buffer is completed */ -- tx_status = __raw_readl(base_addr + XEL_TSR_OFFSET); -+ tx_status = xemaclite_readl(base_addr + XEL_TSR_OFFSET); - if (((tx_status & XEL_TSR_XMIT_BUSY_MASK) == 0) && - (tx_status & XEL_TSR_XMIT_ACTIVE_MASK) != 0) { - - tx_status &= ~XEL_TSR_XMIT_ACTIVE_MASK; -- __raw_writel(tx_status, base_addr + XEL_TSR_OFFSET); -+ xemaclite_writel(tx_status, base_addr + XEL_TSR_OFFSET); - - tx_complete = true; - } - - /* Check if the Transmission for the second buffer is completed */ -- tx_status = __raw_readl(base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); -+ tx_status = xemaclite_readl(base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); - if (((tx_status & XEL_TSR_XMIT_BUSY_MASK) == 0) && - (tx_status & XEL_TSR_XMIT_ACTIVE_MASK) != 0) { - - tx_status &= ~XEL_TSR_XMIT_ACTIVE_MASK; -- __raw_writel(tx_status, base_addr + XEL_BUFFER_OFFSET + -- XEL_TSR_OFFSET); -+ xemaclite_writel(tx_status, base_addr + XEL_BUFFER_OFFSET + -+ XEL_TSR_OFFSET); - - tx_complete = true; - } -@@ -700,7 +712,7 @@ static int xemaclite_mdio_wait(struct net_local *lp) - /* wait for the MDIO interface to not be busy or timeout - after some time. - */ -- while (__raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) & -+ while (xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET) & - XEL_MDIOCTRL_MDIOSTS_MASK) { - if (time_before_eq(end, jiffies)) { - WARN_ON(1); -@@ -736,17 +748,17 @@ static int xemaclite_mdio_read(struct mii_bus *bus, int phy_id, int reg) - * MDIO Address register. Set the Status bit in the MDIO Control - * register to start a MDIO read transaction. - */ -- ctrl_reg = __raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); -- __raw_writel(XEL_MDIOADDR_OP_MASK | -- ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), -- lp->base_addr + XEL_MDIOADDR_OFFSET); -- __raw_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, -- lp->base_addr + XEL_MDIOCTRL_OFFSET); -+ ctrl_reg = xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); -+ xemaclite_writel(XEL_MDIOADDR_OP_MASK | -+ ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), -+ lp->base_addr + XEL_MDIOADDR_OFFSET); -+ xemaclite_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, -+ lp->base_addr + XEL_MDIOCTRL_OFFSET); - - if (xemaclite_mdio_wait(lp)) - return -ETIMEDOUT; - -- rc = __raw_readl(lp->base_addr + XEL_MDIORD_OFFSET); -+ rc = xemaclite_readl(lp->base_addr + XEL_MDIORD_OFFSET); - - dev_dbg(&lp->ndev->dev, - "xemaclite_mdio_read(phy_id=%i, reg=%x) == %x\n", -@@ -783,13 +795,13 @@ static int xemaclite_mdio_write(struct mii_bus *bus, int phy_id, int reg, - * Data register. Finally, set the Status bit in the MDIO Control - * register to start a MDIO write transaction. - */ -- ctrl_reg = __raw_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); -- __raw_writel(~XEL_MDIOADDR_OP_MASK & -- ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), -- lp->base_addr + XEL_MDIOADDR_OFFSET); -- __raw_writel(val, lp->base_addr + XEL_MDIOWR_OFFSET); -- __raw_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, -- lp->base_addr + XEL_MDIOCTRL_OFFSET); -+ ctrl_reg = xemaclite_readl(lp->base_addr + XEL_MDIOCTRL_OFFSET); -+ xemaclite_writel(~XEL_MDIOADDR_OP_MASK & -+ ((phy_id << XEL_MDIOADDR_PHYADR_SHIFT) | reg), -+ lp->base_addr + XEL_MDIOADDR_OFFSET); -+ xemaclite_writel(val, lp->base_addr + XEL_MDIOWR_OFFSET); -+ xemaclite_writel(ctrl_reg | XEL_MDIOCTRL_MDIOSTS_MASK, -+ lp->base_addr + XEL_MDIOCTRL_OFFSET); - - return 0; - } -@@ -836,8 +848,8 @@ static int xemaclite_mdio_setup(struct net_local *lp, struct device *dev) - /* Enable the MDIO bus by asserting the enable bit in MDIO Control - * register. - */ -- __raw_writel(XEL_MDIOCTRL_MDIOEN_MASK, -- lp->base_addr + XEL_MDIOCTRL_OFFSET); -+ xemaclite_writel(XEL_MDIOCTRL_MDIOEN_MASK, -+ lp->base_addr + XEL_MDIOCTRL_OFFSET); - - bus = mdiobus_alloc(); - if (!bus) { -@@ -1141,8 +1153,8 @@ static int xemaclite_of_probe(struct platform_device *ofdev) - dev_warn(dev, "No MAC address found\n"); - - /* Clear the Tx CSR's in case this is a restart */ -- __raw_writel(0, lp->base_addr + XEL_TSR_OFFSET); -- __raw_writel(0, lp->base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); -+ xemaclite_writel(0, lp->base_addr + XEL_TSR_OFFSET); -+ xemaclite_writel(0, lp->base_addr + XEL_BUFFER_OFFSET + XEL_TSR_OFFSET); - - /* Set the MAC address in the EmacLite device */ - xemaclite_update_address(lp, ndev->dev_addr); -diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c -index 85828f153445..0758d0816840 100644 ---- a/drivers/net/hamradio/mkiss.c -+++ b/drivers/net/hamradio/mkiss.c -@@ -648,8 +648,8 @@ static void ax_setup(struct net_device *dev) - { - /* Finish setting up the DEVICE info. */ - dev->mtu = AX_MTU; -- dev->hard_header_len = 0; -- dev->addr_len = 0; -+ dev->hard_header_len = AX25_MAX_HEADER_LEN; -+ dev->addr_len = AX25_ADDR_LEN; - dev->type = ARPHRD_AX25; - dev->tx_queue_len = 10; - dev->header_ops = &ax25_header_ops; -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index fbb1867ff25c..1c27e6fb99f9 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -1851,6 +1851,9 @@ static int r8152_poll(struct napi_struct *napi, int budget) - napi_complete(napi); - if (!list_empty(&tp->rx_done)) - napi_schedule(napi); -+ else if (!skb_queue_empty(&tp->tx_queue) && -+ !list_empty(&tp->tx_free)) -+ napi_schedule(napi); - } - - return work_done; -@@ -2990,10 +2993,13 @@ static void set_carrier(struct r8152 *tp) - if (!netif_carrier_ok(netdev)) { - tp->rtl_ops.enable(tp); - set_bit(RTL8152_SET_RX_MODE, &tp->flags); -+ netif_stop_queue(netdev); - napi_disable(&tp->napi); - netif_carrier_on(netdev); - rtl_start_rx(tp); - napi_enable(&tp->napi); -+ netif_wake_queue(netdev); -+ netif_info(tp, link, netdev, "carrier on\n"); - } - } else { - if (netif_carrier_ok(netdev)) { -@@ -3001,6 +3007,7 @@ static void set_carrier(struct r8152 *tp) - napi_disable(&tp->napi); - tp->rtl_ops.disable(tp); - napi_enable(&tp->napi); -+ netif_info(tp, link, netdev, "carrier off\n"); - } - } - } -@@ -3385,12 +3392,12 @@ static int rtl8152_pre_reset(struct usb_interface *intf) - if (!netif_running(netdev)) - return 0; - -+ netif_stop_queue(netdev); - napi_disable(&tp->napi); - clear_bit(WORK_ENABLE, &tp->flags); - usb_kill_urb(tp->intr_urb); - cancel_delayed_work_sync(&tp->schedule); - if (netif_carrier_ok(netdev)) { -- netif_stop_queue(netdev); - mutex_lock(&tp->control); - tp->rtl_ops.disable(tp); - mutex_unlock(&tp->control); -@@ -3415,12 +3422,14 @@ static int rtl8152_post_reset(struct usb_interface *intf) - if (netif_carrier_ok(netdev)) { - mutex_lock(&tp->control); - tp->rtl_ops.enable(tp); -+ rtl_start_rx(tp); - rtl8152_set_rx_mode(netdev); - mutex_unlock(&tp->control); -- netif_wake_queue(netdev); - } - - napi_enable(&tp->napi); -+ netif_wake_queue(netdev); -+ usb_submit_urb(tp->intr_urb, GFP_KERNEL); - - return 0; - } -diff --git a/drivers/net/usb/sierra_net.c b/drivers/net/usb/sierra_net.c -index a251588762ec..0b5a84c9022c 100644 ---- a/drivers/net/usb/sierra_net.c -+++ b/drivers/net/usb/sierra_net.c -@@ -73,8 +73,6 @@ static atomic_t iface_counter = ATOMIC_INIT(0); - /* Private data structure */ - struct sierra_net_data { - -- u8 ethr_hdr_tmpl[ETH_HLEN]; /* ethernet header template for rx'd pkts */ -- - u16 link_up; /* air link up or down */ - u8 tx_hdr_template[4]; /* part of HIP hdr for tx'd packets */ - -@@ -122,6 +120,7 @@ struct param { - - /* LSI Protocol types */ - #define SIERRA_NET_PROTOCOL_UMTS 0x01 -+#define SIERRA_NET_PROTOCOL_UMTS_DS 0x04 - /* LSI Coverage */ - #define SIERRA_NET_COVERAGE_NONE 0x00 - #define SIERRA_NET_COVERAGE_NOPACKET 0x01 -@@ -129,7 +128,8 @@ struct param { - /* LSI Session */ - #define SIERRA_NET_SESSION_IDLE 0x00 - /* LSI Link types */ --#define SIERRA_NET_AS_LINK_TYPE_IPv4 0x00 -+#define SIERRA_NET_AS_LINK_TYPE_IPV4 0x00 -+#define SIERRA_NET_AS_LINK_TYPE_IPV6 0x02 - - struct lsi_umts { - u8 protocol; -@@ -137,9 +137,14 @@ struct lsi_umts { - __be16 length; - /* eventually use a union for the rest - assume umts for now */ - u8 coverage; -- u8 unused2[41]; -+ u8 network_len; /* network name len */ -+ u8 network[40]; /* network name (UCS2, bigendian) */ - u8 session_state; - u8 unused3[33]; -+} __packed; -+ -+struct lsi_umts_single { -+ struct lsi_umts lsi; - u8 link_type; - u8 pdp_addr_len; /* NW-supplied PDP address len */ - u8 pdp_addr[16]; /* NW-supplied PDP address (bigendian)) */ -@@ -158,10 +163,31 @@ struct lsi_umts { - u8 reserved[8]; - } __packed; - -+struct lsi_umts_dual { -+ struct lsi_umts lsi; -+ u8 pdp_addr4_len; /* NW-supplied PDP IPv4 address len */ -+ u8 pdp_addr4[4]; /* NW-supplied PDP IPv4 address (bigendian)) */ -+ u8 pdp_addr6_len; /* NW-supplied PDP IPv6 address len */ -+ u8 pdp_addr6[16]; /* NW-supplied PDP IPv6 address (bigendian)) */ -+ u8 unused4[23]; -+ u8 dns1_addr4_len; /* NW-supplied 1st DNS v4 address len (bigendian) */ -+ u8 dns1_addr4[4]; /* NW-supplied 1st DNS v4 address */ -+ u8 dns1_addr6_len; /* NW-supplied 1st DNS v6 address len */ -+ u8 dns1_addr6[16]; /* NW-supplied 1st DNS v6 address (bigendian)*/ -+ u8 dns2_addr4_len; /* NW-supplied 2nd DNS v4 address len (bigendian) */ -+ u8 dns2_addr4[4]; /* NW-supplied 2nd DNS v4 address */ -+ u8 dns2_addr6_len; /* NW-supplied 2nd DNS v6 address len */ -+ u8 dns2_addr6[16]; /* NW-supplied 2nd DNS v6 address (bigendian)*/ -+ u8 unused5[68]; -+} __packed; -+ - #define SIERRA_NET_LSI_COMMON_LEN 4 --#define SIERRA_NET_LSI_UMTS_LEN (sizeof(struct lsi_umts)) -+#define SIERRA_NET_LSI_UMTS_LEN (sizeof(struct lsi_umts_single)) - #define SIERRA_NET_LSI_UMTS_STATUS_LEN \ - (SIERRA_NET_LSI_UMTS_LEN - SIERRA_NET_LSI_COMMON_LEN) -+#define SIERRA_NET_LSI_UMTS_DS_LEN (sizeof(struct lsi_umts_dual)) -+#define SIERRA_NET_LSI_UMTS_DS_STATUS_LEN \ -+ (SIERRA_NET_LSI_UMTS_DS_LEN - SIERRA_NET_LSI_COMMON_LEN) - - /* Forward definitions */ - static void sierra_sync_timer(unsigned long syncdata); -@@ -191,10 +217,11 @@ static inline void sierra_net_set_private(struct usbnet *dev, - dev->data[0] = (unsigned long)priv; - } - --/* is packet IPv4 */ -+/* is packet IPv4/IPv6 */ - static inline int is_ip(struct sk_buff *skb) - { -- return skb->protocol == cpu_to_be16(ETH_P_IP); -+ return skb->protocol == cpu_to_be16(ETH_P_IP) || -+ skb->protocol == cpu_to_be16(ETH_P_IPV6); - } - - /* -@@ -350,49 +377,54 @@ static inline int sierra_net_is_valid_addrlen(u8 len) - static int sierra_net_parse_lsi(struct usbnet *dev, char *data, int datalen) - { - struct lsi_umts *lsi = (struct lsi_umts *)data; -+ u32 expected_length; - -- if (datalen < sizeof(struct lsi_umts)) { -- netdev_err(dev->net, "%s: Data length %d, exp %Zu\n", -- __func__, datalen, -- sizeof(struct lsi_umts)); -+ if (datalen < sizeof(struct lsi_umts_single)) { -+ netdev_err(dev->net, "%s: Data length %d, exp >= %Zu\n", -+ __func__, datalen, sizeof(struct lsi_umts_single)); - return -1; - } - -- if (lsi->length != cpu_to_be16(SIERRA_NET_LSI_UMTS_STATUS_LEN)) { -- netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n", -- __func__, be16_to_cpu(lsi->length), -- (u32)SIERRA_NET_LSI_UMTS_STATUS_LEN); -- return -1; -+ /* Validate the session state */ -+ if (lsi->session_state == SIERRA_NET_SESSION_IDLE) { -+ netdev_err(dev->net, "Session idle, 0x%02x\n", -+ lsi->session_state); -+ return 0; - } - - /* Validate the protocol - only support UMTS for now */ -- if (lsi->protocol != SIERRA_NET_PROTOCOL_UMTS) { -+ if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS) { -+ struct lsi_umts_single *single = (struct lsi_umts_single *)lsi; -+ -+ /* Validate the link type */ -+ if (single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV4 && -+ single->link_type != SIERRA_NET_AS_LINK_TYPE_IPV6) { -+ netdev_err(dev->net, "Link type unsupported: 0x%02x\n", -+ single->link_type); -+ return -1; -+ } -+ expected_length = SIERRA_NET_LSI_UMTS_STATUS_LEN; -+ } else if (lsi->protocol == SIERRA_NET_PROTOCOL_UMTS_DS) { -+ expected_length = SIERRA_NET_LSI_UMTS_DS_STATUS_LEN; -+ } else { - netdev_err(dev->net, "Protocol unsupported, 0x%02x\n", -- lsi->protocol); -+ lsi->protocol); - return -1; - } - -- /* Validate the link type */ -- if (lsi->link_type != SIERRA_NET_AS_LINK_TYPE_IPv4) { -- netdev_err(dev->net, "Link type unsupported: 0x%02x\n", -- lsi->link_type); -+ if (be16_to_cpu(lsi->length) != expected_length) { -+ netdev_err(dev->net, "%s: LSI_UMTS_STATUS_LEN %d, exp %u\n", -+ __func__, be16_to_cpu(lsi->length), expected_length); - return -1; - } - - /* Validate the coverage */ -- if (lsi->coverage == SIERRA_NET_COVERAGE_NONE -- || lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) { -+ if (lsi->coverage == SIERRA_NET_COVERAGE_NONE || -+ lsi->coverage == SIERRA_NET_COVERAGE_NOPACKET) { - netdev_err(dev->net, "No coverage, 0x%02x\n", lsi->coverage); - return 0; - } - -- /* Validate the session state */ -- if (lsi->session_state == SIERRA_NET_SESSION_IDLE) { -- netdev_err(dev->net, "Session idle, 0x%02x\n", -- lsi->session_state); -- return 0; -- } -- - /* Set link_sense true */ - return 1; - } -@@ -662,7 +694,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) - u8 numendpoints; - u16 fwattr = 0; - int status; -- struct ethhdr *eth; - struct sierra_net_data *priv; - static const u8 sync_tmplate[sizeof(priv->sync_msg)] = { - 0x00, 0x00, SIERRA_NET_HIP_MSYNC_ID, 0x00}; -@@ -700,11 +731,6 @@ static int sierra_net_bind(struct usbnet *dev, struct usb_interface *intf) - dev->net->dev_addr[ETH_ALEN-2] = atomic_inc_return(&iface_counter); - dev->net->dev_addr[ETH_ALEN-1] = ifacenum; - -- /* we will have to manufacture ethernet headers, prepare template */ -- eth = (struct ethhdr *)priv->ethr_hdr_tmpl; -- memcpy(ð->h_dest, dev->net->dev_addr, ETH_ALEN); -- eth->h_proto = cpu_to_be16(ETH_P_IP); -- - /* prepare shutdown message template */ - memcpy(priv->shdwn_msg, shdwn_tmplate, sizeof(priv->shdwn_msg)); - /* set context index initially to 0 - prepares tx hdr template */ -@@ -833,9 +859,14 @@ static int sierra_net_rx_fixup(struct usbnet *dev, struct sk_buff *skb) - - skb_pull(skb, hh.hdrlen); - -- /* We are going to accept this packet, prepare it */ -- memcpy(skb->data, sierra_net_get_private(dev)->ethr_hdr_tmpl, -- ETH_HLEN); -+ /* We are going to accept this packet, prepare it. -+ * In case protocol is IPv6, keep it, otherwise force IPv4. -+ */ -+ skb_reset_mac_header(skb); -+ if (eth_hdr(skb)->h_proto != cpu_to_be16(ETH_P_IPV6)) -+ eth_hdr(skb)->h_proto = cpu_to_be16(ETH_P_IP); -+ eth_zero_addr(eth_hdr(skb)->h_source); -+ memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN); - - /* Last packet in batch handled by usbnet */ - if (hh.payload_len.word == skb->len) -diff --git a/drivers/parport/parport_gsc.c b/drivers/parport/parport_gsc.c -index 6e3a60c78873..50f3bb0dd1f1 100644 ---- a/drivers/parport/parport_gsc.c -+++ b/drivers/parport/parport_gsc.c -@@ -293,7 +293,7 @@ struct parport *parport_gsc_probe_port(unsigned long base, - p->irq = PARPORT_IRQ_NONE; - } - if (p->irq != PARPORT_IRQ_NONE) { -- printk(", irq %d", p->irq); -+ pr_cont(", irq %d", p->irq); - - if (p->dma == PARPORT_DMA_AUTO) { - p->dma = PARPORT_DMA_NONE; -@@ -303,8 +303,8 @@ struct parport *parport_gsc_probe_port(unsigned long base, - is mandatory (see above) */ - p->dma = PARPORT_DMA_NONE; - -- printk(" ["); --#define printmode(x) {if(p->modes&PARPORT_MODE_##x){printk("%s%s",f?",":"",#x);f++;}} -+ pr_cont(" ["); -+#define printmode(x) {if(p->modes&PARPORT_MODE_##x){pr_cont("%s%s",f?",":"",#x);f++;}} - { - int f = 0; - printmode(PCSPP); -@@ -315,7 +315,7 @@ struct parport *parport_gsc_probe_port(unsigned long base, - // printmode(DMA); - } - #undef printmode -- printk("]\n"); -+ pr_cont("]\n"); - - if (p->irq != PARPORT_IRQ_NONE) { - if (request_irq (p->irq, parport_irq_handler, -diff --git a/drivers/pinctrl/berlin/berlin-bg4ct.c b/drivers/pinctrl/berlin/berlin-bg4ct.c -index 09172043d589..c617ec49e9ed 100644 ---- a/drivers/pinctrl/berlin/berlin-bg4ct.c -+++ b/drivers/pinctrl/berlin/berlin-bg4ct.c -@@ -217,7 +217,7 @@ static const struct berlin_desc_group berlin4ct_soc_pinctrl_groups[] = { - BERLIN_PINCTRL_GROUP("SCRD0_CRD_PRES", 0xc, 0x3, 0x15, - BERLIN_PINCTRL_FUNCTION(0x0, "gpio"), /* GPIO20 */ - BERLIN_PINCTRL_FUNCTION(0x1, "scrd0"), /* crd pres */ -- BERLIN_PINCTRL_FUNCTION(0x1, "sd1a")), /* DAT3 */ -+ BERLIN_PINCTRL_FUNCTION(0x3, "sd1a")), /* DAT3 */ - BERLIN_PINCTRL_GROUP("SPI1_SS0n", 0xc, 0x3, 0x18, - BERLIN_PINCTRL_FUNCTION(0x0, "spi1"), /* SS0n */ - BERLIN_PINCTRL_FUNCTION(0x1, "gpio"), /* GPIO37 */ -diff --git a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -index 79bf13f5c0d1..7a8ceb961bb6 100644 ---- a/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -+++ b/drivers/staging/rtl8192e/rtl8192e/r8192E_dev.c -@@ -1185,8 +1185,7 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, - struct cb_desc *cb_desc, struct sk_buff *skb) - { - struct r8192_priv *priv = rtllib_priv(dev); -- dma_addr_t mapping = pci_map_single(priv->pdev, skb->data, skb->len, -- PCI_DMA_TODEVICE); -+ dma_addr_t mapping; - struct tx_fwinfo_8190pci *pTxFwInfo = NULL; - - pTxFwInfo = (struct tx_fwinfo_8190pci *)skb->data; -@@ -1197,8 +1196,6 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, - pTxFwInfo->Short = _rtl92e_query_is_short(pTxFwInfo->TxHT, - pTxFwInfo->TxRate, cb_desc); - -- if (pci_dma_mapping_error(priv->pdev, mapping)) -- netdev_err(dev, "%s(): DMA Mapping error\n", __func__); - if (cb_desc->bAMPDUEnable) { - pTxFwInfo->AllowAggregation = 1; - pTxFwInfo->RxMF = cb_desc->ampdu_factor; -@@ -1233,6 +1230,14 @@ void rtl92e_fill_tx_desc(struct net_device *dev, struct tx_desc *pdesc, - } - - memset((u8 *)pdesc, 0, 12); -+ -+ mapping = pci_map_single(priv->pdev, skb->data, skb->len, -+ PCI_DMA_TODEVICE); -+ if (pci_dma_mapping_error(priv->pdev, mapping)) { -+ netdev_err(dev, "%s(): DMA Mapping error\n", __func__); -+ return; -+ } -+ - pdesc->LINIP = 0; - pdesc->CmdInit = 1; - pdesc->Offset = sizeof(struct tx_fwinfo_8190pci) + 8; -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 156bc18eac69..53a827c6d8b1 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -412,6 +412,9 @@ cifs_reconnect(struct TCP_Server_Info *server) - } - } while (server->tcpStatus == CifsNeedReconnect); - -+ if (server->tcpStatus == CifsNeedNegotiate) -+ mod_delayed_work(cifsiod_wq, &server->echo, 0); -+ - return rc; - } - -@@ -421,18 +424,27 @@ cifs_echo_request(struct work_struct *work) - int rc; - struct TCP_Server_Info *server = container_of(work, - struct TCP_Server_Info, echo.work); -+ unsigned long echo_interval; -+ -+ /* -+ * If we need to renegotiate, set echo interval to zero to -+ * immediately call echo service where we can renegotiate. -+ */ -+ if (server->tcpStatus == CifsNeedNegotiate) -+ echo_interval = 0; -+ else -+ echo_interval = SMB_ECHO_INTERVAL; - - /* -- * We cannot send an echo if it is disabled or until the -- * NEGOTIATE_PROTOCOL request is done, which is indicated by -- * server->ops->need_neg() == true. Also, no need to ping if -- * we got a response recently. -+ * We cannot send an echo if it is disabled. -+ * Also, no need to ping if we got a response recently. - */ - - if (server->tcpStatus == CifsNeedReconnect || -- server->tcpStatus == CifsExiting || server->tcpStatus == CifsNew || -+ server->tcpStatus == CifsExiting || -+ server->tcpStatus == CifsNew || - (server->ops->can_echo && !server->ops->can_echo(server)) || -- time_before(jiffies, server->lstrp + SMB_ECHO_INTERVAL - HZ)) -+ time_before(jiffies, server->lstrp + echo_interval - HZ)) - goto requeue_echo; - - rc = server->ops->echo ? server->ops->echo(server) : -ENOSYS; -diff --git a/fs/fscache/cookie.c b/fs/fscache/cookie.c -index 4304072161aa..40d61077bead 100644 ---- a/fs/fscache/cookie.c -+++ b/fs/fscache/cookie.c -@@ -542,6 +542,7 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate) - hlist_for_each_entry(object, &cookie->backing_objects, cookie_link) { - if (invalidate) - set_bit(FSCACHE_OBJECT_RETIRED, &object->flags); -+ clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags); - fscache_raise_event(object, FSCACHE_OBJECT_EV_KILL); - } - } else { -@@ -560,6 +561,10 @@ void __fscache_disable_cookie(struct fscache_cookie *cookie, bool invalidate) - wait_on_atomic_t(&cookie->n_active, fscache_wait_atomic_t, - TASK_UNINTERRUPTIBLE); - -+ /* Make sure any pending writes are cancelled. */ -+ if (cookie->def->type != FSCACHE_COOKIE_TYPE_INDEX) -+ fscache_invalidate_writes(cookie); -+ - /* Reset the cookie state if it wasn't relinquished */ - if (!test_bit(FSCACHE_COOKIE_RELINQUISHED, &cookie->flags)) { - atomic_inc(&cookie->n_active); -diff --git a/fs/fscache/netfs.c b/fs/fscache/netfs.c -index 9b28649df3a1..a8aa00be4444 100644 ---- a/fs/fscache/netfs.c -+++ b/fs/fscache/netfs.c -@@ -48,6 +48,7 @@ int __fscache_register_netfs(struct fscache_netfs *netfs) - cookie->flags = 1 << FSCACHE_COOKIE_ENABLED; - - spin_lock_init(&cookie->lock); -+ spin_lock_init(&cookie->stores_lock); - INIT_HLIST_HEAD(&cookie->backing_objects); - - /* check the netfs type is not already present */ -diff --git a/fs/fscache/object.c b/fs/fscache/object.c -index 9e792e30f4db..7a182c87f378 100644 ---- a/fs/fscache/object.c -+++ b/fs/fscache/object.c -@@ -30,6 +30,7 @@ static const struct fscache_state *fscache_look_up_object(struct fscache_object - static const struct fscache_state *fscache_object_available(struct fscache_object *, int); - static const struct fscache_state *fscache_parent_ready(struct fscache_object *, int); - static const struct fscache_state *fscache_update_object(struct fscache_object *, int); -+static const struct fscache_state *fscache_object_dead(struct fscache_object *, int); - - #define __STATE_NAME(n) fscache_osm_##n - #define STATE(n) (&__STATE_NAME(n)) -@@ -91,7 +92,7 @@ static WORK_STATE(LOOKUP_FAILURE, "LCFL", fscache_lookup_failure); - static WORK_STATE(KILL_OBJECT, "KILL", fscache_kill_object); - static WORK_STATE(KILL_DEPENDENTS, "KDEP", fscache_kill_dependents); - static WORK_STATE(DROP_OBJECT, "DROP", fscache_drop_object); --static WORK_STATE(OBJECT_DEAD, "DEAD", (void*)2UL); -+static WORK_STATE(OBJECT_DEAD, "DEAD", fscache_object_dead); - - static WAIT_STATE(WAIT_FOR_INIT, "?INI", - TRANSIT_TO(INIT_OBJECT, 1 << FSCACHE_OBJECT_EV_NEW_CHILD)); -@@ -229,6 +230,10 @@ execute_work_state: - event = -1; - if (new_state == NO_TRANSIT) { - _debug("{OBJ%x} %s notrans", object->debug_id, state->name); -+ if (unlikely(state == STATE(OBJECT_DEAD))) { -+ _leave(" [dead]"); -+ return; -+ } - fscache_enqueue_object(object); - event_mask = object->oob_event_mask; - goto unmask_events; -@@ -239,7 +244,7 @@ execute_work_state: - object->state = state = new_state; - - if (state->work) { -- if (unlikely(state->work == ((void *)2UL))) { -+ if (unlikely(state == STATE(OBJECT_DEAD))) { - _leave(" [dead]"); - return; - } -@@ -645,6 +650,12 @@ static const struct fscache_state *fscache_kill_object(struct fscache_object *ob - fscache_mark_object_dead(object); - object->oob_event_mask = 0; - -+ if (test_bit(FSCACHE_OBJECT_RETIRED, &object->flags)) { -+ /* Reject any new read/write ops and abort any that are pending. */ -+ clear_bit(FSCACHE_OBJECT_PENDING_WRITE, &object->flags); -+ fscache_cancel_all_ops(object); -+ } -+ - if (list_empty(&object->dependents) && - object->n_ops == 0 && - object->n_children == 0) -@@ -1077,3 +1088,20 @@ void fscache_object_mark_killed(struct fscache_object *object, - } - } - EXPORT_SYMBOL(fscache_object_mark_killed); -+ -+/* -+ * The object is dead. We can get here if an object gets queued by an event -+ * that would lead to its death (such as EV_KILL) when the dispatcher is -+ * already running (and so can be requeued) but hasn't yet cleared the event -+ * mask. -+ */ -+static const struct fscache_state *fscache_object_dead(struct fscache_object *object, -+ int event) -+{ -+ if (!test_and_set_bit(FSCACHE_OBJECT_RUN_AFTER_DEAD, -+ &object->flags)) -+ return NO_TRANSIT; -+ -+ WARN(true, "FS-Cache object redispatched after death"); -+ return NO_TRANSIT; -+} -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index 82dc3035ea45..e8d1d6c5000c 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1072,6 +1072,7 @@ static void nfs_increment_seqid(int status, struct nfs_seqid *seqid) - case -NFS4ERR_BADXDR: - case -NFS4ERR_RESOURCE: - case -NFS4ERR_NOFILEHANDLE: -+ case -NFS4ERR_MOVED: - /* Non-seqid mutating errors */ - return; - }; -diff --git a/fs/proc/base.c b/fs/proc/base.c -index d2b8c754f627..dd732400578e 100644 ---- a/fs/proc/base.c -+++ b/fs/proc/base.c -@@ -3058,6 +3058,8 @@ int proc_pid_readdir(struct file *file, struct dir_context *ctx) - iter.tgid += 1, iter = next_tgid(ns, iter)) { - char name[PROC_NUMBUF]; - int len; -+ -+ cond_resched(); - if (!has_pid_permissions(ns, iter.task, 2)) - continue; - -diff --git a/fs/romfs/super.c b/fs/romfs/super.c -index 268733cda397..5f4f1882dc7d 100644 ---- a/fs/romfs/super.c -+++ b/fs/romfs/super.c -@@ -74,6 +74,7 @@ - #include - #include - #include -+#include - #include "internal.h" - - static struct kmem_cache *romfs_inode_cachep; -@@ -415,7 +416,22 @@ static void romfs_destroy_inode(struct inode *inode) - static int romfs_statfs(struct dentry *dentry, struct kstatfs *buf) - { - struct super_block *sb = dentry->d_sb; -- u64 id = huge_encode_dev(sb->s_bdev->bd_dev); -+ u64 id = 0; -+ -+ /* When calling huge_encode_dev(), -+ * use sb->s_bdev->bd_dev when, -+ * - CONFIG_ROMFS_ON_BLOCK defined -+ * use sb->s_dev when, -+ * - CONFIG_ROMFS_ON_BLOCK undefined and -+ * - CONFIG_ROMFS_ON_MTD defined -+ * leave id as 0 when, -+ * - CONFIG_ROMFS_ON_BLOCK undefined and -+ * - CONFIG_ROMFS_ON_MTD undefined -+ */ -+ if (sb->s_bdev) -+ id = huge_encode_dev(sb->s_bdev->bd_dev); -+ else if (sb->s_dev) -+ id = huge_encode_dev(sb->s_dev); - - buf->f_type = ROMFS_MAGIC; - buf->f_namelen = ROMFS_MAXFN; -@@ -488,6 +504,11 @@ static int romfs_fill_super(struct super_block *sb, void *data, int silent) - sb->s_flags |= MS_RDONLY | MS_NOATIME; - sb->s_op = &romfs_super_ops; - -+#ifdef CONFIG_ROMFS_ON_MTD -+ /* Use same dev ID from the underlying mtdblock device */ -+ if (sb->s_mtd) -+ sb->s_dev = MKDEV(MTD_BLOCK_MAJOR, sb->s_mtd->index); -+#endif - /* read the image superblock and check it */ - rsb = kmalloc(512, GFP_KERNEL); - if (!rsb) -diff --git a/include/linux/fscache-cache.h b/include/linux/fscache-cache.h -index 604e1526cd00..eb19bf2b2a81 100644 ---- a/include/linux/fscache-cache.h -+++ b/include/linux/fscache-cache.h -@@ -360,6 +360,7 @@ struct fscache_object { - #define FSCACHE_OBJECT_IS_AVAILABLE 5 /* T if object has become active */ - #define FSCACHE_OBJECT_RETIRED 6 /* T if object was retired on relinquishment */ - #define FSCACHE_OBJECT_KILLED_BY_CACHE 7 /* T if object was killed by the cache */ -+#define FSCACHE_OBJECT_RUN_AFTER_DEAD 8 /* T if object has been dispatched after death */ - - struct list_head cache_link; /* link in cache->object_list */ - struct hlist_node cookie_link; /* link in cookie->backing_objects */ -diff --git a/include/linux/log2.h b/include/linux/log2.h -index f38fae23bdac..c373295f359f 100644 ---- a/include/linux/log2.h -+++ b/include/linux/log2.h -@@ -194,6 +194,17 @@ unsigned long __rounddown_pow_of_two(unsigned long n) - * ... and so on. - */ - --#define order_base_2(n) ilog2(roundup_pow_of_two(n)) -+static inline __attribute_const__ -+int __order_base_2(unsigned long n) -+{ -+ return n > 1 ? ilog2(n - 1) + 1 : 0; -+} - -+#define order_base_2(n) \ -+( \ -+ __builtin_constant_p(n) ? ( \ -+ ((n) == 0 || (n) == 1) ? 0 : \ -+ ilog2((n) - 1) + 1) : \ -+ __order_base_2(n) \ -+) - #endif /* _LINUX_LOG2_H */ -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index ad1d6039185d..7a8066b90289 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -744,6 +744,11 @@ static inline __be32 ip6_make_flowlabel(struct net *net, struct sk_buff *skb, - { - u32 hash; - -+ /* @flowlabel may include more than a flow label, eg, the traffic class. -+ * Here we want only the flow label value. -+ */ -+ flowlabel &= IPV6_FLOWLABEL_MASK; -+ - if (flowlabel || - net->ipv6.sysctl.auto_flowlabels == IP6_AUTO_FLOW_LABEL_OFF || - (!autolabel && -diff --git a/mm/kasan/report.c b/mm/kasan/report.c -index 12f222d0224b..b4e31f78ae69 100644 ---- a/mm/kasan/report.c -+++ b/mm/kasan/report.c -@@ -13,6 +13,7 @@ - * - */ - -+#include - #include - #include - #include -@@ -251,6 +252,8 @@ void kasan_report(unsigned long addr, size_t size, - if (likely(!kasan_report_enabled())) - return; - -+ disable_trace_on_warning(); -+ - info.access_addr = (void *)addr; - info.access_size = size; - info.is_write = is_write; -diff --git a/net/core/ethtool.c b/net/core/ethtool.c -index 29edf74846fc..b6bca625b0d2 100644 ---- a/net/core/ethtool.c -+++ b/net/core/ethtool.c -@@ -886,9 +886,12 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr) - if (regs.len > reglen) - regs.len = reglen; - -- regbuf = vzalloc(reglen); -- if (reglen && !regbuf) -- return -ENOMEM; -+ regbuf = NULL; -+ if (reglen) { -+ regbuf = vzalloc(reglen); -+ if (!regbuf) -+ return -ENOMEM; -+ } - - ops->get_regs(dev, ®s, regbuf); - -diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c -index 59b3e0e8fd51..711b4dfa17c3 100644 ---- a/net/ipv4/arp.c -+++ b/net/ipv4/arp.c -@@ -1250,7 +1250,7 @@ void __init arp_init(void) - /* - * ax25 -> ASCII conversion - */ --static char *ax2asc2(ax25_address *a, char *buf) -+static void ax2asc2(ax25_address *a, char *buf) - { - char c, *s; - int n; -@@ -1272,10 +1272,10 @@ static char *ax2asc2(ax25_address *a, char *buf) - *s++ = n + '0'; - *s++ = '\0'; - -- if (*buf == '\0' || *buf == '-') -- return "*"; -- -- return buf; -+ if (*buf == '\0' || *buf == '-') { -+ buf[0] = '*'; -+ buf[1] = '\0'; -+ } - } - #endif /* CONFIG_AX25 */ - -@@ -1309,7 +1309,7 @@ static void arp_format_neigh_entry(struct seq_file *seq, - } - #endif - sprintf(tbuf, "%pI4", n->primary_key); -- seq_printf(seq, "%-16s 0x%-10x0x%-10x%s * %s\n", -+ seq_printf(seq, "%-16s 0x%-10x0x%-10x%-17s * %s\n", - tbuf, hatype, arp_state_to_flags(n), hbuffer, dev->name); - read_unlock(&n->lock); - } -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 7090fef372cc..8cf3fc7c2932 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -3211,9 +3211,15 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, - } - - if (idev) { -- if (idev->if_flags & IF_READY) -- /* device is already configured. */ -+ if (idev->if_flags & IF_READY) { -+ /* device is already configured - -+ * but resend MLD reports, we might -+ * have roamed and need to update -+ * multicast snooping switches -+ */ -+ ipv6_mc_up(idev); - break; -+ } - idev->if_flags |= IF_READY; - } - -diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c -index 428162155280..cae37bfd12ab 100644 ---- a/net/ipv6/datagram.c -+++ b/net/ipv6/datagram.c -@@ -76,18 +76,22 @@ static int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int a - } - } - -- addr_type = ipv6_addr_type(&usin->sin6_addr); -- -- if (addr_type == IPV6_ADDR_ANY) { -+ if (ipv6_addr_any(&usin->sin6_addr)) { - /* - * connect to self - */ -- usin->sin6_addr.s6_addr[15] = 0x01; -+ if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)) -+ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), -+ &usin->sin6_addr); -+ else -+ usin->sin6_addr = in6addr_loopback; - } - -+ addr_type = ipv6_addr_type(&usin->sin6_addr); -+ - daddr = &usin->sin6_addr; - -- if (addr_type == IPV6_ADDR_MAPPED) { -+ if (addr_type & IPV6_ADDR_MAPPED) { - struct sockaddr_in sin; - - if (__ipv6_only_sock(sk)) { -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 1db17efe36c1..19c0d67ce8c4 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1004,6 +1004,9 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, - } - } - #endif -+ if (ipv6_addr_v4mapped(&fl6->saddr) && -+ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) -+ return -EAFNOSUPPORT; - - return 0; - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 8e958fde6e4b..59c908ff251a 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -149,8 +149,13 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, - * connect() to INADDR_ANY means loopback (BSD'ism). - */ - -- if (ipv6_addr_any(&usin->sin6_addr)) -- usin->sin6_addr.s6_addr[15] = 0x1; -+ if (ipv6_addr_any(&usin->sin6_addr)) { -+ if (ipv6_addr_v4mapped(&sk->sk_v6_rcv_saddr)) -+ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), -+ &usin->sin6_addr); -+ else -+ usin->sin6_addr = in6addr_loopback; -+ } - - addr_type = ipv6_addr_type(&usin->sin6_addr); - -@@ -189,7 +194,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr, - * TCP over IPv4 - */ - -- if (addr_type == IPV6_ADDR_MAPPED) { -+ if (addr_type & IPV6_ADDR_MAPPED) { - u32 exthdrlen = icsk->icsk_ext_hdr_len; - struct sockaddr_in sin; - -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index dfa85e7264df..6fd4af3b5b79 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1136,6 +1136,10 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - if (addr_len < SIN6_LEN_RFC2133) - return -EINVAL; - daddr = &sin6->sin6_addr; -+ if (ipv6_addr_any(daddr) && -+ ipv6_addr_v4mapped(&np->saddr)) -+ ipv6_addr_set_v4mapped(htonl(INADDR_LOOPBACK), -+ daddr); - break; - case AF_INET: - goto do_udp_sendmsg; -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index c96d666cef29..956141b71619 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -235,8 +235,12 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk, - sctp_assoc_t id) - { - struct sctp_association *addr_asoc = NULL, *id_asoc = NULL; -- struct sctp_transport *transport; -+ struct sctp_af *af = sctp_get_af_specific(addr->ss_family); - union sctp_addr *laddr = (union sctp_addr *)addr; -+ struct sctp_transport *transport; -+ -+ if (sctp_verify_addr(sk, laddr, af->sockaddr_len)) -+ return NULL; - - addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep, - laddr, -diff --git a/net/tipc/server.c b/net/tipc/server.c -index 922e04a43396..50f5b0ca7b3c 100644 ---- a/net/tipc/server.c -+++ b/net/tipc/server.c -@@ -452,6 +452,11 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid, - if (!con) - return -EINVAL; - -+ if (!test_bit(CF_CONNECTED, &con->flags)) { -+ conn_put(con); -+ return 0; -+ } -+ - e = tipc_alloc_entry(data, len); - if (!e) { - conn_put(con); -@@ -465,12 +470,8 @@ int tipc_conn_sendmsg(struct tipc_server *s, int conid, - list_add_tail(&e->list, &con->outqueue); - spin_unlock_bh(&con->outqueue_lock); - -- if (test_bit(CF_CONNECTED, &con->flags)) { -- if (!queue_work(s->send_wq, &con->swork)) -- conn_put(con); -- } else { -+ if (!queue_work(s->send_wq, &con->swork)) - conn_put(con); -- } - return 0; - } - -@@ -494,7 +495,7 @@ static void tipc_send_to_sock(struct tipc_conn *con) - int ret; - - spin_lock_bh(&con->outqueue_lock); -- while (1) { -+ while (test_bit(CF_CONNECTED, &con->flags)) { - e = list_entry(con->outqueue.next, struct outqueue_entry, - list); - if ((struct list_head *) e == &con->outqueue) diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.73-74.patch b/patch/kernel/mvebu64-default/03-patch-4.4.73-74.patch deleted file mode 100644 index 4c15d4deba5c..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.73-74.patch +++ /dev/null @@ -1,1488 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index ca64ca566099..7c77d7edb851 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -3580,6 +3580,13 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - spia_pedr= - spia_peddr= - -+ stack_guard_gap= [MM] -+ override the default stack gap protection. The value -+ is in page units and it defines how many pages prior -+ to (for stacks growing down) resp. after (for stacks -+ growing up) the main stack are reserved for no other -+ mapping. Default value is 256 pages. -+ - stacktrace [FTRACE] - Enabled the stack tracer on boot up. - -diff --git a/Makefile b/Makefile -index ba5a70b6e32c..1f75507acbf4 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 73 -+SUBLEVEL = 74 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/mm/mmap.c b/arch/arc/mm/mmap.c -index 2e06d56e987b..cf4ae6958240 100644 ---- a/arch/arc/mm/mmap.c -+++ b/arch/arc/mm/mmap.c -@@ -64,7 +64,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/arm/mm/mmap.c b/arch/arm/mm/mmap.c -index 407dc786583a..c469c0665752 100644 ---- a/arch/arm/mm/mmap.c -+++ b/arch/arm/mm/mmap.c -@@ -89,7 +89,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -@@ -140,7 +140,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - addr = PAGE_ALIGN(addr); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/frv/mm/elf-fdpic.c b/arch/frv/mm/elf-fdpic.c -index 836f14707a62..efa59f1f8022 100644 ---- a/arch/frv/mm/elf-fdpic.c -+++ b/arch/frv/mm/elf-fdpic.c -@@ -74,7 +74,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi - addr = PAGE_ALIGN(addr); - vma = find_vma(current->mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - goto success; - } - -diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c -index d8f9b357b222..e9fed8ca9b42 100644 ---- a/arch/mips/kernel/branch.c -+++ b/arch/mips/kernel/branch.c -@@ -816,8 +816,10 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - break; - } - /* Compact branch: BNEZC || JIALC */ -- if (insn.i_format.rs) -+ if (!insn.i_format.rs) { -+ /* JIALC: set $31/ra */ - regs->regs[31] = epc + 4; -+ } - regs->cp0_epc += 8; - break; - #endif -diff --git a/arch/mips/mm/mmap.c b/arch/mips/mm/mmap.c -index 5c81fdd032c3..025cb31aa0a2 100644 ---- a/arch/mips/mm/mmap.c -+++ b/arch/mips/mm/mmap.c -@@ -92,7 +92,7 @@ static unsigned long arch_get_unmapped_area_common(struct file *filp, - - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c -index 5aba01ac457f..4dda73c44fee 100644 ---- a/arch/parisc/kernel/sys_parisc.c -+++ b/arch/parisc/kernel/sys_parisc.c -@@ -88,7 +88,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, - unsigned long len, unsigned long pgoff, unsigned long flags) - { - struct mm_struct *mm = current->mm; -- struct vm_area_struct *vma; -+ struct vm_area_struct *vma, *prev; - unsigned long task_size = TASK_SIZE; - int do_color_align, last_mmap; - struct vm_unmapped_area_info info; -@@ -115,9 +115,10 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, - else - addr = PAGE_ALIGN(addr); - -- vma = find_vma(mm, addr); -+ vma = find_vma_prev(mm, addr, &prev); - if (task_size - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma)) && -+ (!prev || addr >= vm_end_gap(prev))) - goto found_addr; - } - -@@ -141,7 +142,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - const unsigned long len, const unsigned long pgoff, - const unsigned long flags) - { -- struct vm_area_struct *vma; -+ struct vm_area_struct *vma, *prev; - struct mm_struct *mm = current->mm; - unsigned long addr = addr0; - int do_color_align, last_mmap; -@@ -175,9 +176,11 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - addr = COLOR_ALIGN(addr, last_mmap, pgoff); - else - addr = PAGE_ALIGN(addr); -- vma = find_vma(mm, addr); -+ -+ vma = find_vma_prev(mm, addr, &prev); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma)) && -+ (!prev || addr >= vm_end_gap(prev))) - goto found_addr; - } - -diff --git a/arch/powerpc/mm/slice.c b/arch/powerpc/mm/slice.c -index 0f432a702870..6ad12b244770 100644 ---- a/arch/powerpc/mm/slice.c -+++ b/arch/powerpc/mm/slice.c -@@ -105,7 +105,7 @@ static int slice_area_is_free(struct mm_struct *mm, unsigned long addr, - if ((mm->task_size - len) < addr) - return 0; - vma = find_vma(mm, addr); -- return (!vma || (addr + len) <= vma->vm_start); -+ return (!vma || (addr + len) <= vm_start_gap(vma)); - } - - static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice) -diff --git a/arch/s390/mm/mmap.c b/arch/s390/mm/mmap.c -index f2b6b1d9c804..126c4a9b9bf9 100644 ---- a/arch/s390/mm/mmap.c -+++ b/arch/s390/mm/mmap.c -@@ -97,7 +97,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - addr = PAGE_ALIGN(addr); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -@@ -135,7 +135,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - addr = PAGE_ALIGN(addr); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/sh/mm/mmap.c b/arch/sh/mm/mmap.c -index 6777177807c2..7df7d5944188 100644 ---- a/arch/sh/mm/mmap.c -+++ b/arch/sh/mm/mmap.c -@@ -63,7 +63,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, - - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -@@ -113,7 +113,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index c690c8e16a96..7f0f7c01b297 100644 ---- a/arch/sparc/kernel/sys_sparc_64.c -+++ b/arch/sparc/kernel/sys_sparc_64.c -@@ -118,7 +118,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi - - vma = find_vma(mm, addr); - if (task_size - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -@@ -181,7 +181,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - - vma = find_vma(mm, addr); - if (task_size - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c -index da1142401bf4..ffa842b4d7d4 100644 ---- a/arch/sparc/mm/hugetlbpage.c -+++ b/arch/sparc/mm/hugetlbpage.c -@@ -115,7 +115,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - addr = ALIGN(addr, HPAGE_SIZE); - vma = find_vma(mm, addr); - if (task_size - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - if (mm->get_unmapped_area == arch_get_unmapped_area) -diff --git a/arch/tile/mm/hugetlbpage.c b/arch/tile/mm/hugetlbpage.c -index c034dc3fe2d4..c97ee6c7f949 100644 ---- a/arch/tile/mm/hugetlbpage.c -+++ b/arch/tile/mm/hugetlbpage.c -@@ -232,7 +232,7 @@ unsigned long hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - addr = ALIGN(addr, huge_page_size(h)); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - if (current->mm->get_unmapped_area == arch_get_unmapped_area) -diff --git a/arch/x86/kernel/sys_x86_64.c b/arch/x86/kernel/sys_x86_64.c -index 10e0272d789a..136ad7c1ce7b 100644 ---- a/arch/x86/kernel/sys_x86_64.c -+++ b/arch/x86/kernel/sys_x86_64.c -@@ -143,7 +143,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - addr = PAGE_ALIGN(addr); - vma = find_vma(mm, addr); - if (end - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -@@ -186,7 +186,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - addr = PAGE_ALIGN(addr); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/arch/x86/mm/hugetlbpage.c b/arch/x86/mm/hugetlbpage.c -index 42982b26e32b..39bdaf3ac44a 100644 ---- a/arch/x86/mm/hugetlbpage.c -+++ b/arch/x86/mm/hugetlbpage.c -@@ -144,7 +144,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - addr = ALIGN(addr, huge_page_size(h)); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - if (mm->get_unmapped_area == arch_get_unmapped_area) -diff --git a/arch/x86/mm/numa_32.c b/arch/x86/mm/numa_32.c -index 47b6436e41c2..3686a1db25b2 100644 ---- a/arch/x86/mm/numa_32.c -+++ b/arch/x86/mm/numa_32.c -@@ -100,5 +100,6 @@ void __init initmem_init(void) - printk(KERN_DEBUG "High memory starts at vaddr %08lx\n", - (ulong) pfn_to_kaddr(highstart_pfn)); - -+ __vmalloc_start_set = true; - setup_bootmem_allocator(); - } -diff --git a/arch/xtensa/kernel/syscall.c b/arch/xtensa/kernel/syscall.c -index 83cf49685373..3aaaae18417c 100644 ---- a/arch/xtensa/kernel/syscall.c -+++ b/arch/xtensa/kernel/syscall.c -@@ -87,7 +87,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, - /* At this point: (!vmm || addr < vmm->vm_end). */ - if (TASK_SIZE - len < addr) - return -ENOMEM; -- if (!vmm || addr + len <= vmm->vm_start) -+ if (!vmm || addr + len <= vm_start_gap(vmm)) - return addr; - addr = vmm->vm_end; - if (flags & MAP_SHARED) -diff --git a/drivers/cpufreq/cpufreq_conservative.c b/drivers/cpufreq/cpufreq_conservative.c -index 1fa1deb6e91f..c395f9198fd2 100644 ---- a/drivers/cpufreq/cpufreq_conservative.c -+++ b/drivers/cpufreq/cpufreq_conservative.c -@@ -212,8 +212,8 @@ static ssize_t store_down_threshold(struct dbs_data *dbs_data, const char *buf, - int ret; - ret = sscanf(buf, "%u", &input); - -- /* cannot be lower than 11 otherwise freq will not fall */ -- if (ret != 1 || input < 11 || input > 100 || -+ /* cannot be lower than 1 otherwise freq will not fall */ -+ if (ret != 1 || input < 1 || input > 100 || - input >= cs_tuners->up_threshold) - return -EINVAL; - -diff --git a/drivers/iio/proximity/as3935.c b/drivers/iio/proximity/as3935.c -index 9e6d1cdb7fcd..420478924a0c 100644 ---- a/drivers/iio/proximity/as3935.c -+++ b/drivers/iio/proximity/as3935.c -@@ -263,8 +263,6 @@ static irqreturn_t as3935_interrupt_handler(int irq, void *private) - - static void calibrate_as3935(struct as3935_state *st) - { -- mutex_lock(&st->lock); -- - /* mask disturber interrupt bit */ - as3935_write(st, AS3935_INT, BIT(5)); - -@@ -274,8 +272,6 @@ static void calibrate_as3935(struct as3935_state *st) - - mdelay(2); - as3935_write(st, AS3935_TUNE_CAP, (st->tune_cap / TUNE_CAP_DIV)); -- -- mutex_unlock(&st->lock); - } - - #ifdef CONFIG_PM_SLEEP -@@ -312,6 +308,8 @@ static int as3935_resume(struct device *dev) - val &= ~AS3935_AFE_PWR_BIT; - ret = as3935_write(st, AS3935_AFE_GAIN, val); - -+ calibrate_as3935(st); -+ - err_resume: - mutex_unlock(&st->lock); - -diff --git a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c -index e1907cd0c3b7..7613d1fee104 100644 ---- a/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c -+++ b/drivers/media/usb/pvrusb2/pvrusb2-eeprom.c -@@ -123,15 +123,10 @@ int pvr2_eeprom_analyze(struct pvr2_hdw *hdw) - memset(&tvdata,0,sizeof(tvdata)); - - eeprom = pvr2_eeprom_fetch(hdw); -- if (!eeprom) return -EINVAL; -- -- { -- struct i2c_client fake_client; -- /* Newer version expects a useless client interface */ -- fake_client.addr = hdw->eeprom_addr; -- fake_client.adapter = &hdw->i2c_adap; -- tveeprom_hauppauge_analog(&fake_client,&tvdata,eeprom); -- } -+ if (!eeprom) -+ return -EINVAL; -+ -+ tveeprom_hauppauge_analog(NULL, &tvdata, eeprom); - - trace_eeprom("eeprom assumed v4l tveeprom module"); - trace_eeprom("eeprom direct call results:"); -diff --git a/drivers/media/v4l2-core/videobuf2-core.c b/drivers/media/v4l2-core/videobuf2-core.c -index 47f37683893a..3dc9ed2e0774 100644 ---- a/drivers/media/v4l2-core/videobuf2-core.c -+++ b/drivers/media/v4l2-core/videobuf2-core.c -@@ -793,7 +793,7 @@ EXPORT_SYMBOL_GPL(vb2_core_create_bufs); - */ - void *vb2_plane_vaddr(struct vb2_buffer *vb, unsigned int plane_no) - { -- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv) -+ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv) - return NULL; - - return call_ptr_memop(vb, vaddr, vb->planes[plane_no].mem_priv); -diff --git a/drivers/mfd/omap-usb-tll.c b/drivers/mfd/omap-usb-tll.c -index c30290f33430..fe51e9709210 100644 ---- a/drivers/mfd/omap-usb-tll.c -+++ b/drivers/mfd/omap-usb-tll.c -@@ -375,8 +375,8 @@ int omap_tll_init(struct usbhs_omap_platform_data *pdata) - * and use SDR Mode - */ - reg &= ~(OMAP_TLL_CHANNEL_CONF_UTMIAUTOIDLE -- | OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF - | OMAP_TLL_CHANNEL_CONF_ULPIDDRMODE); -+ reg |= OMAP_TLL_CHANNEL_CONF_ULPINOBITSTUFF; - } else if (pdata->port_mode[i] == - OMAP_EHCI_PORT_MODE_HSIC) { - /* -diff --git a/drivers/misc/c2port/c2port-duramar2150.c b/drivers/misc/c2port/c2port-duramar2150.c -index 5484301d57d9..3dc61ea7dc64 100644 ---- a/drivers/misc/c2port/c2port-duramar2150.c -+++ b/drivers/misc/c2port/c2port-duramar2150.c -@@ -129,8 +129,8 @@ static int __init duramar2150_c2port_init(void) - - duramar2150_c2port_dev = c2port_device_register("uc", - &duramar2150_c2port_ops, NULL); -- if (!duramar2150_c2port_dev) { -- ret = -ENODEV; -+ if (IS_ERR(duramar2150_c2port_dev)) { -+ ret = PTR_ERR(duramar2150_c2port_dev); - goto free_region; - } - -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index cbc99d5649af..ae5709354546 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -246,6 +246,8 @@ static int gs_cmd_reset(struct gs_usb *gsusb, struct gs_can *gsdev) - sizeof(*dm), - 1000); - -+ kfree(dm); -+ - return rc; - } - -diff --git a/drivers/staging/rtl8188eu/core/rtw_ap.c b/drivers/staging/rtl8188eu/core/rtw_ap.c -index 3cdb40fea5ee..f5cedbbc552a 100644 ---- a/drivers/staging/rtl8188eu/core/rtw_ap.c -+++ b/drivers/staging/rtl8188eu/core/rtw_ap.c -@@ -894,7 +894,7 @@ int rtw_check_beacon_data(struct adapter *padapter, u8 *pbuf, int len) - return _FAIL; - - -- if (len > MAX_IE_SZ) -+ if (len < 0 || len > MAX_IE_SZ) - return _FAIL; - - pbss_network->IELength = len; -diff --git a/drivers/tty/serial/efm32-uart.c b/drivers/tty/serial/efm32-uart.c -index 195acc868763..5d476916191b 100644 ---- a/drivers/tty/serial/efm32-uart.c -+++ b/drivers/tty/serial/efm32-uart.c -@@ -27,6 +27,7 @@ - #define UARTn_FRAME 0x04 - #define UARTn_FRAME_DATABITS__MASK 0x000f - #define UARTn_FRAME_DATABITS(n) ((n) - 3) -+#define UARTn_FRAME_PARITY__MASK 0x0300 - #define UARTn_FRAME_PARITY_NONE 0x0000 - #define UARTn_FRAME_PARITY_EVEN 0x0200 - #define UARTn_FRAME_PARITY_ODD 0x0300 -@@ -572,12 +573,16 @@ static void efm32_uart_console_get_options(struct efm32_uart_port *efm_port, - 16 * (4 + (clkdiv >> 6))); - - frame = efm32_uart_read32(efm_port, UARTn_FRAME); -- if (frame & UARTn_FRAME_PARITY_ODD) -+ switch (frame & UARTn_FRAME_PARITY__MASK) { -+ case UARTn_FRAME_PARITY_ODD: - *parity = 'o'; -- else if (frame & UARTn_FRAME_PARITY_EVEN) -+ break; -+ case UARTn_FRAME_PARITY_EVEN: - *parity = 'e'; -- else -+ break; -+ default: - *parity = 'n'; -+ } - - *bits = (frame & UARTn_FRAME_DATABITS__MASK) - - UARTn_FRAME_DATABITS(4) + 4; -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index c3f4f2ab7b33..b403596818db 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2511,6 +2511,7 @@ struct usb_hcd *usb_create_shared_hcd(const struct hc_driver *driver, - hcd->bandwidth_mutex = kmalloc(sizeof(*hcd->bandwidth_mutex), - GFP_KERNEL); - if (!hcd->bandwidth_mutex) { -+ kfree(hcd->address0_mutex); - kfree(hcd); - dev_dbg(dev, "hcd bandwidth mutex alloc failed\n"); - return NULL; -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index b627392ad52a..1d59d489a1ad 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -1318,7 +1318,13 @@ static int hub_configure(struct usb_hub *hub, - if (ret < 0) { - message = "can't read hub descriptor"; - goto fail; -- } else if (hub->descriptor->bNbrPorts > USB_MAXCHILDREN) { -+ } -+ -+ maxchild = USB_MAXCHILDREN; -+ if (hub_is_superspeed(hdev)) -+ maxchild = min_t(unsigned, maxchild, USB_SS_MAXPORTS); -+ -+ if (hub->descriptor->bNbrPorts > maxchild) { - message = "hub has too many ports!"; - ret = -ENODEV; - goto fail; -diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c -index 2f1fb7e7aa54..9eba51b92f72 100644 ---- a/drivers/usb/dwc3/dwc3-exynos.c -+++ b/drivers/usb/dwc3/dwc3-exynos.c -@@ -148,7 +148,8 @@ static int dwc3_exynos_probe(struct platform_device *pdev) - exynos->axius_clk = devm_clk_get(dev, "usbdrd30_axius_clk"); - if (IS_ERR(exynos->axius_clk)) { - dev_err(dev, "no AXI UpScaler clk specified\n"); -- return -ENODEV; -+ ret = -ENODEV; -+ goto axius_clk_err; - } - clk_prepare_enable(exynos->axius_clk); - } else { -@@ -206,6 +207,7 @@ err3: - regulator_disable(exynos->vdd33); - err2: - clk_disable_unprepare(exynos->axius_clk); -+axius_clk_err: - clk_disable_unprepare(exynos->susp_clk); - clk_disable_unprepare(exynos->clk); - return ret; -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index de014436fb22..43ce2cfcdb4d 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -1676,9 +1676,10 @@ static void - gadgetfs_suspend (struct usb_gadget *gadget) - { - struct dev_data *dev = get_gadget_data (gadget); -+ unsigned long flags; - - INFO (dev, "suspended from state %d\n", dev->state); -- spin_lock (&dev->lock); -+ spin_lock_irqsave(&dev->lock, flags); - switch (dev->state) { - case STATE_DEV_SETUP: // VERY odd... host died?? - case STATE_DEV_CONNECTED: -@@ -1689,7 +1690,7 @@ gadgetfs_suspend (struct usb_gadget *gadget) - default: - break; - } -- spin_unlock (&dev->lock); -+ spin_unlock_irqrestore(&dev->lock, flags); - } - - static struct usb_gadget_driver gadgetfs_driver = { -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index 6610f7a023d3..64f404a1a072 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -442,23 +442,16 @@ static void set_link_state(struct dummy_hcd *dum_hcd) - /* Report reset and disconnect events to the driver */ - if (dum->driver && (disconnect || reset)) { - stop_activity(dum); -- spin_unlock(&dum->lock); - if (reset) - usb_gadget_udc_reset(&dum->gadget, dum->driver); - else - dum->driver->disconnect(&dum->gadget); -- spin_lock(&dum->lock); - } - } else if (dum_hcd->active != dum_hcd->old_active) { -- if (dum_hcd->old_active && dum->driver->suspend) { -- spin_unlock(&dum->lock); -+ if (dum_hcd->old_active && dum->driver->suspend) - dum->driver->suspend(&dum->gadget); -- spin_lock(&dum->lock); -- } else if (!dum_hcd->old_active && dum->driver->resume) { -- spin_unlock(&dum->lock); -+ else if (!dum_hcd->old_active && dum->driver->resume) - dum->driver->resume(&dum->gadget); -- spin_lock(&dum->lock); -- } - } - - dum_hcd->old_status = dum_hcd->port_status; -@@ -985,7 +978,9 @@ static int dummy_udc_stop(struct usb_gadget *g) - struct dummy_hcd *dum_hcd = gadget_to_dummy_hcd(g); - struct dummy *dum = dum_hcd->dum; - -+ spin_lock_irq(&dum->lock); - dum->driver = NULL; -+ spin_unlock_irq(&dum->lock); - - return 0; - } -@@ -2011,7 +2006,7 @@ ss_hub_descriptor(struct usb_hub_descriptor *desc) - HUB_CHAR_COMMON_OCPM); - desc->bNbrPorts = 1; - desc->u.ss.bHubHdrDecLat = 0x04; /* Worst case: 0.4 micro sec*/ -- desc->u.ss.DeviceRemovable = 0xffff; -+ desc->u.ss.DeviceRemovable = 0; - } - - static inline void hub_descriptor(struct usb_hub_descriptor *desc) -@@ -2023,8 +2018,8 @@ static inline void hub_descriptor(struct usb_hub_descriptor *desc) - HUB_CHAR_INDV_PORT_LPSM | - HUB_CHAR_COMMON_OCPM); - desc->bNbrPorts = 1; -- desc->u.hs.DeviceRemovable[0] = 0xff; -- desc->u.hs.DeviceRemovable[1] = 0xff; -+ desc->u.hs.DeviceRemovable[0] = 0; -+ desc->u.hs.DeviceRemovable[1] = 0xff; /* PortPwrCtrlMask */ - } - - static int dummy_hub_control( -diff --git a/drivers/usb/gadget/udc/net2280.c b/drivers/usb/gadget/udc/net2280.c -index 6706aef907f4..a47de8c31ce9 100644 ---- a/drivers/usb/gadget/udc/net2280.c -+++ b/drivers/usb/gadget/udc/net2280.c -@@ -2425,11 +2425,8 @@ static void stop_activity(struct net2280 *dev, struct usb_gadget_driver *driver) - nuke(&dev->ep[i]); - - /* report disconnect; the driver is already quiesced */ -- if (driver) { -- spin_unlock(&dev->lock); -+ if (driver) - driver->disconnect(&dev->gadget); -- spin_lock(&dev->lock); -- } - - usb_reinit(dev); - } -@@ -3275,8 +3272,6 @@ next_endpoints: - BIT(PCI_RETRY_ABORT_INTERRUPT)) - - static void handle_stat1_irqs(struct net2280 *dev, u32 stat) --__releases(dev->lock) --__acquires(dev->lock) - { - struct net2280_ep *ep; - u32 tmp, num, mask, scratch; -@@ -3317,14 +3312,12 @@ __acquires(dev->lock) - if (disconnect || reset) { - stop_activity(dev, dev->driver); - ep0_start(dev); -- spin_unlock(&dev->lock); - if (reset) - usb_gadget_udc_reset - (&dev->gadget, dev->driver); - else - (dev->driver->disconnect) - (&dev->gadget); -- spin_lock(&dev->lock); - return; - } - } -diff --git a/drivers/usb/host/r8a66597-hcd.c b/drivers/usb/host/r8a66597-hcd.c -index 4cbd0633c5c2..a11c2c8bda53 100644 ---- a/drivers/usb/host/r8a66597-hcd.c -+++ b/drivers/usb/host/r8a66597-hcd.c -@@ -1269,7 +1269,7 @@ static void set_td_timer(struct r8a66597 *r8a66597, struct r8a66597_td *td) - time = 30; - break; - default: -- time = 300; -+ time = 50; - break; - } - -@@ -1785,6 +1785,7 @@ static void r8a66597_td_timer(unsigned long _r8a66597) - pipe = td->pipe; - pipe_stop(r8a66597, pipe); - -+ /* Select a different address or endpoint */ - new_td = td; - do { - list_move_tail(&new_td->queue, -@@ -1794,7 +1795,8 @@ static void r8a66597_td_timer(unsigned long _r8a66597) - new_td = td; - break; - } -- } while (td != new_td && td->address == new_td->address); -+ } while (td != new_td && td->address == new_td->address && -+ td->pipe->info.epnum == new_td->pipe->info.epnum); - - start_transfer(r8a66597, new_td); - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index 30c4ae80c8f9..e8f990642281 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -198,6 +198,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && - pdev->device == 0x1042) - xhci->quirks |= XHCI_BROKEN_STREAMS; -+ if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA && -+ pdev->device == 0x1142) -+ xhci->quirks |= XHCI_TRUST_TX_LENGTH; - - if (xhci->quirks & XHCI_RESET_ON_RESUME) - xhci_dbg_trace(xhci, trace_xhci_dbg_quirks, -diff --git a/fs/configfs/symlink.c b/fs/configfs/symlink.c -index ec5c8325b503..0525ebc3aea2 100644 ---- a/fs/configfs/symlink.c -+++ b/fs/configfs/symlink.c -@@ -83,14 +83,13 @@ static int create_link(struct config_item *parent_item, - ret = -ENOMEM; - sl = kmalloc(sizeof(struct configfs_symlink), GFP_KERNEL); - if (sl) { -- sl->sl_target = config_item_get(item); - spin_lock(&configfs_dirent_lock); - if (target_sd->s_type & CONFIGFS_USET_DROPPING) { - spin_unlock(&configfs_dirent_lock); -- config_item_put(item); - kfree(sl); - return -ENOENT; - } -+ sl->sl_target = config_item_get(item); - list_add(&sl->sl_list, &target_sd->s_links); - spin_unlock(&configfs_dirent_lock); - ret = configfs_create_link(sl, parent_item->ci_dentry, -diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c -index 595ebdb41846..a17da8b57fc6 100644 ---- a/fs/hugetlbfs/inode.c -+++ b/fs/hugetlbfs/inode.c -@@ -191,7 +191,7 @@ hugetlb_get_unmapped_area(struct file *file, unsigned long addr, - addr = ALIGN(addr, huge_page_size(h)); - vma = find_vma(mm, addr); - if (TASK_SIZE - len >= addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma))) - return addr; - } - -diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c -index db1a1427c27a..07ef85e19fbc 100644 ---- a/fs/proc/task_mmu.c -+++ b/fs/proc/task_mmu.c -@@ -295,11 +295,7 @@ show_map_vma(struct seq_file *m, struct vm_area_struct *vma, int is_pid) - - /* We don't show the stack guard page in /proc/maps */ - start = vma->vm_start; -- if (stack_guard_page_start(vma, start)) -- start += PAGE_SIZE; - end = vma->vm_end; -- if (stack_guard_page_end(vma, end)) -- end -= PAGE_SIZE; - - seq_setwidth(m, 25 + sizeof(void *) * 6 - 1); - seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu ", -diff --git a/include/linux/mm.h b/include/linux/mm.h -index f0ffa01c90d9..55f950afb60d 100644 ---- a/include/linux/mm.h -+++ b/include/linux/mm.h -@@ -1278,39 +1278,11 @@ int clear_page_dirty_for_io(struct page *page); - - int get_cmdline(struct task_struct *task, char *buffer, int buflen); - --/* Is the vma a continuation of the stack vma above it? */ --static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr) --{ -- return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN); --} -- - static inline bool vma_is_anonymous(struct vm_area_struct *vma) - { - return !vma->vm_ops; - } - --static inline int stack_guard_page_start(struct vm_area_struct *vma, -- unsigned long addr) --{ -- return (vma->vm_flags & VM_GROWSDOWN) && -- (vma->vm_start == addr) && -- !vma_growsdown(vma->vm_prev, addr); --} -- --/* Is the vma a continuation of the stack vma below it? */ --static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr) --{ -- return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP); --} -- --static inline int stack_guard_page_end(struct vm_area_struct *vma, -- unsigned long addr) --{ -- return (vma->vm_flags & VM_GROWSUP) && -- (vma->vm_end == addr) && -- !vma_growsup(vma->vm_next, addr); --} -- - int vma_is_stack_for_task(struct vm_area_struct *vma, struct task_struct *t); - - extern unsigned long move_page_tables(struct vm_area_struct *vma, -@@ -2012,6 +1984,7 @@ void page_cache_async_readahead(struct address_space *mapping, - pgoff_t offset, - unsigned long size); - -+extern unsigned long stack_guard_gap; - /* Generic expand stack which grows the stack according to GROWS{UP,DOWN} */ - extern int expand_stack(struct vm_area_struct *vma, unsigned long address); - -@@ -2040,6 +2013,30 @@ static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * m - return vma; - } - -+static inline unsigned long vm_start_gap(struct vm_area_struct *vma) -+{ -+ unsigned long vm_start = vma->vm_start; -+ -+ if (vma->vm_flags & VM_GROWSDOWN) { -+ vm_start -= stack_guard_gap; -+ if (vm_start > vma->vm_start) -+ vm_start = 0; -+ } -+ return vm_start; -+} -+ -+static inline unsigned long vm_end_gap(struct vm_area_struct *vma) -+{ -+ unsigned long vm_end = vma->vm_end; -+ -+ if (vma->vm_flags & VM_GROWSUP) { -+ vm_end += stack_guard_gap; -+ if (vm_end < vma->vm_end) -+ vm_end = -PAGE_SIZE; -+ } -+ return vm_end; -+} -+ - static inline unsigned long vma_pages(struct vm_area_struct *vma) - { - return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT; -diff --git a/include/uapi/linux/usb/ch11.h b/include/uapi/linux/usb/ch11.h -index 331499d597fa..9ce10d4a0245 100644 ---- a/include/uapi/linux/usb/ch11.h -+++ b/include/uapi/linux/usb/ch11.h -@@ -22,6 +22,9 @@ - */ - #define USB_MAXCHILDREN 31 - -+/* See USB 3.1 spec Table 10-5 */ -+#define USB_SS_MAXPORTS 15 -+ - /* - * Hub request types - */ -diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c -index 6ead200370da..a079ed14f230 100644 ---- a/kernel/irq/manage.c -+++ b/kernel/irq/manage.c -@@ -1287,8 +1287,10 @@ __setup_irq(unsigned int irq, struct irq_desc *desc, struct irqaction *new) - ret = __irq_set_trigger(desc, - new->flags & IRQF_TRIGGER_MASK); - -- if (ret) -+ if (ret) { -+ irq_release_resources(desc); - goto out_mask; -+ } - } - - desc->istate &= ~(IRQS_AUTODETECT | IRQS_SPURIOUS_DISABLED | \ -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index 7fbba635a549..2c3a23d77704 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -339,7 +339,7 @@ void alarm_start_relative(struct alarm *alarm, ktime_t start) - { - struct alarm_base *base = &alarm_bases[alarm->type]; - -- start = ktime_add(start, base->gettime()); -+ start = ktime_add_safe(start, base->gettime()); - alarm_start(alarm, start); - } - EXPORT_SYMBOL_GPL(alarm_start_relative); -@@ -425,7 +425,7 @@ u64 alarm_forward(struct alarm *alarm, ktime_t now, ktime_t interval) - overrun++; - } - -- alarm->node.expires = ktime_add(alarm->node.expires, interval); -+ alarm->node.expires = ktime_add_safe(alarm->node.expires, interval); - return overrun; - } - EXPORT_SYMBOL_GPL(alarm_forward); -@@ -611,13 +611,21 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, - - /* start the timer */ - timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval); -+ -+ /* -+ * Rate limit to the tick as a hot fix to prevent DOS. Will be -+ * mopped up later. -+ */ -+ if (ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC) -+ timr->it.alarm.interval = ktime_set(0, TICK_NSEC); -+ - exp = timespec_to_ktime(new_setting->it_value); - /* Convert (if necessary) to absolute time */ - if (flags != TIMER_ABSTIME) { - ktime_t now; - - now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime(); -- exp = ktime_add(now, exp); -+ exp = ktime_add_safe(now, exp); - } - - alarm_start(&timr->it.alarm.alarmtimer, exp); -diff --git a/mm/gup.c b/mm/gup.c -index 4b0b7e7d1136..b599526db9f7 100644 ---- a/mm/gup.c -+++ b/mm/gup.c -@@ -312,11 +312,6 @@ static int faultin_page(struct task_struct *tsk, struct vm_area_struct *vma, - /* mlock all present pages, but do not fault in new pages */ - if ((*flags & (FOLL_POPULATE | FOLL_MLOCK)) == FOLL_MLOCK) - return -ENOENT; -- /* For mm_populate(), just skip the stack guard page. */ -- if ((*flags & FOLL_POPULATE) && -- (stack_guard_page_start(vma, address) || -- stack_guard_page_end(vma, address + PAGE_SIZE))) -- return -ENOENT; - if (*flags & FOLL_WRITE) - fault_flags |= FAULT_FLAG_WRITE; - if (nonblocking) -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 43aee7ab143e..091fe9b06663 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -1208,7 +1208,10 @@ int memory_failure(unsigned long pfn, int trapno, int flags) - * page_remove_rmap() in try_to_unmap_one(). So to determine page status - * correctly, we save a copy of the page flags at this time. - */ -- page_flags = p->flags; -+ if (PageHuge(p)) -+ page_flags = hpage->flags; -+ else -+ page_flags = p->flags; - - /* - * unpoison always clear PG_hwpoison inside page lock -diff --git a/mm/memory.c b/mm/memory.c -index 76dcee317714..e6fa13484447 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -2662,40 +2662,6 @@ out_release: - } - - /* -- * This is like a special single-page "expand_{down|up}wards()", -- * except we must first make sure that 'address{-|+}PAGE_SIZE' -- * doesn't hit another vma. -- */ --static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address) --{ -- address &= PAGE_MASK; -- if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) { -- struct vm_area_struct *prev = vma->vm_prev; -- -- /* -- * Is there a mapping abutting this one below? -- * -- * That's only ok if it's the same stack mapping -- * that has gotten split.. -- */ -- if (prev && prev->vm_end == address) -- return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM; -- -- return expand_downwards(vma, address - PAGE_SIZE); -- } -- if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) { -- struct vm_area_struct *next = vma->vm_next; -- -- /* As VM_GROWSDOWN but s/below/above/ */ -- if (next && next->vm_start == address + PAGE_SIZE) -- return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM; -- -- return expand_upwards(vma, address + PAGE_SIZE); -- } -- return 0; --} -- --/* - * We enter with non-exclusive mmap_sem (to exclude vma changes, - * but allow concurrent faults), and pte mapped but not yet locked. - * We return with mmap_sem still held, but pte unmapped and unlocked. -@@ -2715,10 +2681,6 @@ static int do_anonymous_page(struct mm_struct *mm, struct vm_area_struct *vma, - if (vma->vm_flags & VM_SHARED) - return VM_FAULT_SIGBUS; - -- /* Check if we need to add a guard page to the stack */ -- if (check_stack_guard_page(vma, address) < 0) -- return VM_FAULT_SIGSEGV; -- - /* Use the zero-page for reads */ - if (!(flags & FAULT_FLAG_WRITE) && !mm_forbids_zeropage(mm)) { - entry = pte_mkspecial(pfn_pte(my_zero_pfn(address), -diff --git a/mm/mmap.c b/mm/mmap.c -index 455772a05e54..0990f8bc0fbe 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -288,6 +288,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) - unsigned long retval; - unsigned long newbrk, oldbrk; - struct mm_struct *mm = current->mm; -+ struct vm_area_struct *next; - unsigned long min_brk; - bool populate; - -@@ -332,7 +333,8 @@ SYSCALL_DEFINE1(brk, unsigned long, brk) - } - - /* Check against existing mmap mappings. */ -- if (find_vma_intersection(mm, oldbrk, newbrk+PAGE_SIZE)) -+ next = find_vma(mm, oldbrk); -+ if (next && newbrk + PAGE_SIZE > vm_start_gap(next)) - goto out; - - /* Ok, looks good - let it rip. */ -@@ -355,10 +357,22 @@ out: - - static long vma_compute_subtree_gap(struct vm_area_struct *vma) - { -- unsigned long max, subtree_gap; -- max = vma->vm_start; -- if (vma->vm_prev) -- max -= vma->vm_prev->vm_end; -+ unsigned long max, prev_end, subtree_gap; -+ -+ /* -+ * Note: in the rare case of a VM_GROWSDOWN above a VM_GROWSUP, we -+ * allow two stack_guard_gaps between them here, and when choosing -+ * an unmapped area; whereas when expanding we only require one. -+ * That's a little inconsistent, but keeps the code here simpler. -+ */ -+ max = vm_start_gap(vma); -+ if (vma->vm_prev) { -+ prev_end = vm_end_gap(vma->vm_prev); -+ if (max > prev_end) -+ max -= prev_end; -+ else -+ max = 0; -+ } - if (vma->vm_rb.rb_left) { - subtree_gap = rb_entry(vma->vm_rb.rb_left, - struct vm_area_struct, vm_rb)->rb_subtree_gap; -@@ -451,7 +465,7 @@ static void validate_mm(struct mm_struct *mm) - anon_vma_unlock_read(anon_vma); - } - -- highest_address = vma->vm_end; -+ highest_address = vm_end_gap(vma); - vma = vma->vm_next; - i++; - } -@@ -620,7 +634,7 @@ void __vma_link_rb(struct mm_struct *mm, struct vm_area_struct *vma, - if (vma->vm_next) - vma_gap_update(vma->vm_next); - else -- mm->highest_vm_end = vma->vm_end; -+ mm->highest_vm_end = vm_end_gap(vma); - - /* - * vma->vm_prev wasn't known when we followed the rbtree to find the -@@ -866,7 +880,7 @@ again: remove_next = 1 + (end > next->vm_end); - vma_gap_update(vma); - if (end_changed) { - if (!next) -- mm->highest_vm_end = end; -+ mm->highest_vm_end = vm_end_gap(vma); - else if (!adjust_next) - vma_gap_update(next); - } -@@ -909,7 +923,7 @@ again: remove_next = 1 + (end > next->vm_end); - else if (next) - vma_gap_update(next); - else -- mm->highest_vm_end = end; -+ VM_WARN_ON(mm->highest_vm_end != vm_end_gap(vma)); - } - if (insert && file) - uprobe_mmap(insert); -@@ -1741,7 +1755,7 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) - - while (true) { - /* Visit left subtree if it looks promising */ -- gap_end = vma->vm_start; -+ gap_end = vm_start_gap(vma); - if (gap_end >= low_limit && vma->vm_rb.rb_left) { - struct vm_area_struct *left = - rb_entry(vma->vm_rb.rb_left, -@@ -1752,12 +1766,13 @@ unsigned long unmapped_area(struct vm_unmapped_area_info *info) - } - } - -- gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; -+ gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; - check_current: - /* Check if current node has a suitable gap */ - if (gap_start > high_limit) - return -ENOMEM; -- if (gap_end >= low_limit && gap_end - gap_start >= length) -+ if (gap_end >= low_limit && -+ gap_end > gap_start && gap_end - gap_start >= length) - goto found; - - /* Visit right subtree if it looks promising */ -@@ -1779,8 +1794,8 @@ check_current: - vma = rb_entry(rb_parent(prev), - struct vm_area_struct, vm_rb); - if (prev == vma->vm_rb.rb_left) { -- gap_start = vma->vm_prev->vm_end; -- gap_end = vma->vm_start; -+ gap_start = vm_end_gap(vma->vm_prev); -+ gap_end = vm_start_gap(vma); - goto check_current; - } - } -@@ -1844,7 +1859,7 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) - - while (true) { - /* Visit right subtree if it looks promising */ -- gap_start = vma->vm_prev ? vma->vm_prev->vm_end : 0; -+ gap_start = vma->vm_prev ? vm_end_gap(vma->vm_prev) : 0; - if (gap_start <= high_limit && vma->vm_rb.rb_right) { - struct vm_area_struct *right = - rb_entry(vma->vm_rb.rb_right, -@@ -1857,10 +1872,11 @@ unsigned long unmapped_area_topdown(struct vm_unmapped_area_info *info) - - check_current: - /* Check if current node has a suitable gap */ -- gap_end = vma->vm_start; -+ gap_end = vm_start_gap(vma); - if (gap_end < low_limit) - return -ENOMEM; -- if (gap_start <= high_limit && gap_end - gap_start >= length) -+ if (gap_start <= high_limit && -+ gap_end > gap_start && gap_end - gap_start >= length) - goto found; - - /* Visit left subtree if it looks promising */ -@@ -1883,7 +1899,7 @@ check_current: - struct vm_area_struct, vm_rb); - if (prev == vma->vm_rb.rb_right) { - gap_start = vma->vm_prev ? -- vma->vm_prev->vm_end : 0; -+ vm_end_gap(vma->vm_prev) : 0; - goto check_current; - } - } -@@ -1921,7 +1937,7 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - unsigned long len, unsigned long pgoff, unsigned long flags) - { - struct mm_struct *mm = current->mm; -- struct vm_area_struct *vma; -+ struct vm_area_struct *vma, *prev; - struct vm_unmapped_area_info info; - - if (len > TASK_SIZE - mmap_min_addr) -@@ -1932,9 +1948,10 @@ arch_get_unmapped_area(struct file *filp, unsigned long addr, - - if (addr) { - addr = PAGE_ALIGN(addr); -- vma = find_vma(mm, addr); -+ vma = find_vma_prev(mm, addr, &prev); - if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma)) && -+ (!prev || addr >= vm_end_gap(prev))) - return addr; - } - -@@ -1957,7 +1974,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - const unsigned long len, const unsigned long pgoff, - const unsigned long flags) - { -- struct vm_area_struct *vma; -+ struct vm_area_struct *vma, *prev; - struct mm_struct *mm = current->mm; - unsigned long addr = addr0; - struct vm_unmapped_area_info info; -@@ -1972,9 +1989,10 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0, - /* requesting a specific address */ - if (addr) { - addr = PAGE_ALIGN(addr); -- vma = find_vma(mm, addr); -+ vma = find_vma_prev(mm, addr, &prev); - if (TASK_SIZE - len >= addr && addr >= mmap_min_addr && -- (!vma || addr + len <= vma->vm_start)) -+ (!vma || addr + len <= vm_start_gap(vma)) && -+ (!prev || addr >= vm_end_gap(prev))) - return addr; - } - -@@ -2099,21 +2117,19 @@ find_vma_prev(struct mm_struct *mm, unsigned long addr, - * update accounting. This is shared with both the - * grow-up and grow-down cases. - */ --static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, unsigned long grow) -+static int acct_stack_growth(struct vm_area_struct *vma, -+ unsigned long size, unsigned long grow) - { - struct mm_struct *mm = vma->vm_mm; - struct rlimit *rlim = current->signal->rlim; -- unsigned long new_start, actual_size; -+ unsigned long new_start; - - /* address space limit tests */ - if (!may_expand_vm(mm, grow)) - return -ENOMEM; - - /* Stack limit test */ -- actual_size = size; -- if (size && (vma->vm_flags & (VM_GROWSUP | VM_GROWSDOWN))) -- actual_size -= PAGE_SIZE; -- if (actual_size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur)) -+ if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur)) - return -ENOMEM; - - /* mlock limit tests */ -@@ -2151,16 +2167,32 @@ static int acct_stack_growth(struct vm_area_struct *vma, unsigned long size, uns - int expand_upwards(struct vm_area_struct *vma, unsigned long address) - { - struct mm_struct *mm = vma->vm_mm; -+ struct vm_area_struct *next; -+ unsigned long gap_addr; - int error = 0; - - if (!(vma->vm_flags & VM_GROWSUP)) - return -EFAULT; - -- /* Guard against wrapping around to address 0. */ -- if (address < PAGE_ALIGN(address+4)) -- address = PAGE_ALIGN(address+4); -- else -+ /* Guard against exceeding limits of the address space. */ -+ address &= PAGE_MASK; -+ if (address >= TASK_SIZE) - return -ENOMEM; -+ address += PAGE_SIZE; -+ -+ /* Enforce stack_guard_gap */ -+ gap_addr = address + stack_guard_gap; -+ -+ /* Guard against overflow */ -+ if (gap_addr < address || gap_addr > TASK_SIZE) -+ gap_addr = TASK_SIZE; -+ -+ next = vma->vm_next; -+ if (next && next->vm_start < gap_addr) { -+ if (!(next->vm_flags & VM_GROWSUP)) -+ return -ENOMEM; -+ /* Check that both stack segments have the same anon_vma? */ -+ } - - /* We must make sure the anon_vma is allocated. */ - if (unlikely(anon_vma_prepare(vma))) -@@ -2206,7 +2238,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) - if (vma->vm_next) - vma_gap_update(vma->vm_next); - else -- mm->highest_vm_end = address; -+ mm->highest_vm_end = vm_end_gap(vma); - spin_unlock(&mm->page_table_lock); - - perf_event_mmap(vma); -@@ -2227,6 +2259,8 @@ int expand_downwards(struct vm_area_struct *vma, - unsigned long address) - { - struct mm_struct *mm = vma->vm_mm; -+ struct vm_area_struct *prev; -+ unsigned long gap_addr; - int error; - - address &= PAGE_MASK; -@@ -2234,6 +2268,17 @@ int expand_downwards(struct vm_area_struct *vma, - if (error) - return error; - -+ /* Enforce stack_guard_gap */ -+ gap_addr = address - stack_guard_gap; -+ if (gap_addr > address) -+ return -ENOMEM; -+ prev = vma->vm_prev; -+ if (prev && prev->vm_end > gap_addr) { -+ if (!(prev->vm_flags & VM_GROWSDOWN)) -+ return -ENOMEM; -+ /* Check that both stack segments have the same anon_vma? */ -+ } -+ - /* We must make sure the anon_vma is allocated. */ - if (unlikely(anon_vma_prepare(vma))) - return -ENOMEM; -@@ -2289,28 +2334,25 @@ int expand_downwards(struct vm_area_struct *vma, - return error; - } - --/* -- * Note how expand_stack() refuses to expand the stack all the way to -- * abut the next virtual mapping, *unless* that mapping itself is also -- * a stack mapping. We want to leave room for a guard page, after all -- * (the guard page itself is not added here, that is done by the -- * actual page faulting logic) -- * -- * This matches the behavior of the guard page logic (see mm/memory.c: -- * check_stack_guard_page()), which only allows the guard page to be -- * removed under these circumstances. -- */ -+/* enforced gap between the expanding stack and other mappings. */ -+unsigned long stack_guard_gap = 256UL<len - hdrlen - MICHAEL_MIC_LEN; - key = &rx->key->conf.key[NL80211_TKIP_DATA_OFFSET_RX_MIC_KEY]; - michael_mic(key, hdr, data, data_len, mic); -- if (memcmp(mic, data + data_len, MICHAEL_MIC_LEN) != 0) -+ if (crypto_memneq(mic, data + data_len, MICHAEL_MIC_LEN)) - goto mic_fail; - - /* remove Michael MIC from payload */ -@@ -1044,7 +1045,7 @@ ieee80211_crypto_aes_cmac_decrypt(struct ieee80211_rx_data *rx) - bip_aad(skb, aad); - ieee80211_aes_cmac(key->u.aes_cmac.tfm, aad, - skb->data + 24, skb->len - 24, mic); -- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { -+ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { - key->u.aes_cmac.icverrors++; - return RX_DROP_UNUSABLE; - } -@@ -1094,7 +1095,7 @@ ieee80211_crypto_aes_cmac_256_decrypt(struct ieee80211_rx_data *rx) - bip_aad(skb, aad); - ieee80211_aes_cmac_256(key->u.aes_cmac.tfm, aad, - skb->data + 24, skb->len - 24, mic); -- if (memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { -+ if (crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { - key->u.aes_cmac.icverrors++; - return RX_DROP_UNUSABLE; - } -@@ -1198,7 +1199,7 @@ ieee80211_crypto_aes_gmac_decrypt(struct ieee80211_rx_data *rx) - if (ieee80211_aes_gmac(key->u.aes_gmac.tfm, aad, nonce, - skb->data + 24, skb->len - 24, - mic) < 0 || -- memcmp(mic, mmie->mic, sizeof(mmie->mic)) != 0) { -+ crypto_memneq(mic, mmie->mic, sizeof(mmie->mic))) { - key->u.aes_gmac.icverrors++; - return RX_DROP_UNUSABLE; - } diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.74-75.patch b/patch/kernel/mvebu64-default/03-patch-4.4.74-75.patch deleted file mode 100644 index 79dc865672ae..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.74-75.patch +++ /dev/null @@ -1,1018 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1f75507acbf4..696d15d8ad5d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 74 -+SUBLEVEL = 75 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/powerpc/kernel/kprobes.c b/arch/powerpc/kernel/kprobes.c -index 7c053f281406..1138fec3dd65 100644 ---- a/arch/powerpc/kernel/kprobes.c -+++ b/arch/powerpc/kernel/kprobes.c -@@ -514,6 +514,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs) - #endif - #endif - -+ /* -+ * jprobes use jprobe_return() which skips the normal return -+ * path of the function, and this messes up the accounting of the -+ * function graph tracer. -+ * -+ * Pause function graph tracing while performing the jprobe function. -+ */ -+ pause_graph_tracing(); -+ - return 1; - } - -@@ -536,6 +545,8 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs) - * saved regs... - */ - memcpy(regs, &kcb->jprobe_saved_regs, sizeof(struct pt_regs)); -+ /* It's OK to start function graph tracing again */ -+ unpause_graph_tracing(); - preempt_enable_no_resched(); - return 1; - } -diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c -index 3c3a367b6e59..396dc44e783b 100644 ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -2693,6 +2693,27 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) - return -EINVAL; - } - -+ /* -+ * Don't allow entry with a suspended transaction, because -+ * the guest entry/exit code will lose it. -+ * If the guest has TM enabled, save away their TM-related SPRs -+ * (they will get restored by the TM unavailable interrupt). -+ */ -+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM -+ if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs && -+ (current->thread.regs->msr & MSR_TM)) { -+ if (MSR_TM_ACTIVE(current->thread.regs->msr)) { -+ run->exit_reason = KVM_EXIT_FAIL_ENTRY; -+ run->fail_entry.hardware_entry_failure_reason = 0; -+ return -EINVAL; -+ } -+ current->thread.tm_tfhar = mfspr(SPRN_TFHAR); -+ current->thread.tm_tfiar = mfspr(SPRN_TFIAR); -+ current->thread.tm_texasr = mfspr(SPRN_TEXASR); -+ current->thread.regs->msr &= ~MSR_TM; -+ } -+#endif -+ - kvmppc_core_prepare_to_enter(vcpu); - - /* No need to go into the guest when all we'll do is come back out */ -diff --git a/arch/powerpc/mm/slb_low.S b/arch/powerpc/mm/slb_low.S -index 4c48b487698c..0b48ce40d351 100644 ---- a/arch/powerpc/mm/slb_low.S -+++ b/arch/powerpc/mm/slb_low.S -@@ -179,6 +179,16 @@ END_MMU_FTR_SECTION_IFSET(MMU_FTR_1T_SEGMENT) - b slb_finish_load - - 8: /* invalid EA */ -+ /* -+ * It's possible the bad EA is too large to fit in the SLB cache, which -+ * would mean we'd fail to invalidate it on context switch. So mark the -+ * SLB cache as full so we force a full flush. We also set cr7+eq to -+ * mark the address as a kernel address, so slb_finish_load() skips -+ * trying to insert it into the SLB cache. -+ */ -+ li r9,SLB_CACHE_ENTRIES + 1 -+ sth r9,PACASLBCACHEPTR(r13) -+ crset 4*cr7+eq - li r10,0 /* BAD_VSID */ - li r9,0 /* BAD_VSID */ - li r11,SLB_VSID_USER /* flags don't much matter */ -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -index 51a9942cdb40..f4cae5357e40 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -@@ -681,6 +681,10 @@ int amdgpu_atombios_get_clock_info(struct amdgpu_device *adev) - DRM_INFO("Changing default dispclk from %dMhz to 600Mhz\n", - adev->clock.default_dispclk / 100); - adev->clock.default_dispclk = 60000; -+ } else if (adev->clock.default_dispclk <= 60000) { -+ DRM_INFO("Changing default dispclk from %dMhz to 625Mhz\n", -+ adev->clock.default_dispclk / 100); -+ adev->clock.default_dispclk = 62500; - } - adev->clock.dp_extclk = - le16_to_cpu(firmware_info->info_21.usUniphyDPModeExtClkFreq); -diff --git a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c -index 49aa35016653..247b088990dc 100644 ---- a/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c -+++ b/drivers/gpu/drm/amd/amdgpu/atombios_crtc.c -@@ -164,7 +164,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) - struct drm_device *dev = crtc->dev; - struct amdgpu_device *adev = dev->dev_private; - int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); -- ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; -+ ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; - - memset(&args, 0, sizeof(args)); - -@@ -177,7 +177,7 @@ void amdgpu_atombios_crtc_powergate(struct drm_crtc *crtc, int state) - void amdgpu_atombios_crtc_powergate_init(struct amdgpu_device *adev) - { - int index = GetIndexIntoMasterTable(COMMAND, EnableDispPowerGating); -- ENABLE_DISP_POWER_GATING_PARAMETERS_V2_1 args; -+ ENABLE_DISP_POWER_GATING_PS_ALLOCATION args; - - memset(&args, 0, sizeof(args)); - -diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c -index a9b01bcf7d0a..fcecaf5b5526 100644 ---- a/drivers/gpu/drm/radeon/radeon_combios.c -+++ b/drivers/gpu/drm/radeon/radeon_combios.c -@@ -3394,6 +3394,13 @@ void radeon_combios_asic_init(struct drm_device *dev) - rdev->pdev->subsystem_vendor == 0x103c && - rdev->pdev->subsystem_device == 0x280a) - return; -+ /* quirk for rs4xx Toshiba Sattellite L20-183 latop to make it resume -+ * - it hangs on resume inside the dynclk 1 table. -+ */ -+ if (rdev->family == CHIP_RS400 && -+ rdev->pdev->subsystem_vendor == 0x1179 && -+ rdev->pdev->subsystem_device == 0xff31) -+ return; - - /* DYN CLK 1 */ - table = combios_get_table_offset(dev, COMBIOS_DYN_CLK_1_TABLE); -diff --git a/drivers/gpu/drm/radeon/radeon_device.c b/drivers/gpu/drm/radeon/radeon_device.c -index 4aa2cbe4c85f..a77521695c9a 100644 ---- a/drivers/gpu/drm/radeon/radeon_device.c -+++ b/drivers/gpu/drm/radeon/radeon_device.c -@@ -127,6 +127,10 @@ static struct radeon_px_quirk radeon_px_quirk_list[] = { - * https://bugzilla.kernel.org/show_bug.cgi?id=51381 - */ - { PCI_VENDOR_ID_ATI, 0x6840, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, -+ /* Asus K53TK laptop with AMD A6-3420M APU and Radeon 7670m GPU -+ * https://bugs.freedesktop.org/show_bug.cgi?id=101491 -+ */ -+ { PCI_VENDOR_ID_ATI, 0x6741, 0x1043, 0x2122, RADEON_PX_QUIRK_DISABLE_PX }, - /* macbook pro 8.2 */ - { PCI_VENDOR_ID_ATI, 0x6741, PCI_VENDOR_ID_APPLE, 0x00e2, RADEON_PX_QUIRK_LONG_WAKEUP }, - { 0, 0, 0, 0, 0 }, -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index e37030624165..c7f8b70d15ee 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -285,6 +285,9 @@ - #define USB_VENDOR_ID_DEALEXTREAME 0x10c5 - #define USB_DEVICE_ID_DEALEXTREAME_RADIO_SI4701 0x819a - -+#define USB_VENDOR_ID_DELL 0x413c -+#define USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE 0x301a -+ - #define USB_VENDOR_ID_DELORME 0x1163 - #define USB_DEVICE_ID_DELORME_EARTHMATE 0x0100 - #define USB_DEVICE_ID_DELORME_EM_LT20 0x0200 -diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c -index 6ca6ab00fa93..ce1543d69acb 100644 ---- a/drivers/hid/usbhid/hid-quirks.c -+++ b/drivers/hid/usbhid/hid-quirks.c -@@ -72,6 +72,7 @@ static const struct hid_blacklist { - { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET }, -+ { USB_VENDOR_ID_DELL, USB_DEVICE_ID_DELL_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, - { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, - { USB_VENDOR_ID_DRAGONRISE, USB_DEVICE_ID_DRAGONRISE_WIIU, HID_QUIRK_MULTI_INPUT }, - { USB_VENDOR_ID_ELAN, HID_ANY_ID, HID_QUIRK_ALWAYS_POLL }, -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index e7b96f1ac2c5..5be14ad29d46 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -788,6 +788,13 @@ static const struct dmi_system_id __initconst i8042_dmi_notimeout_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK U574"), - }, - }, -+ { -+ /* Fujitsu UH554 laptop */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "FUJITSU"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "LIFEBOOK UH544"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/mtd/spi-nor/spi-nor.c b/drivers/mtd/spi-nor/spi-nor.c -index 37e4135ab213..64d6f053c2a5 100644 ---- a/drivers/mtd/spi-nor/spi-nor.c -+++ b/drivers/mtd/spi-nor/spi-nor.c -@@ -1057,6 +1057,13 @@ static int spansion_quad_enable(struct spi_nor *nor) - return -EINVAL; - } - -+ ret = spi_nor_wait_till_ready(nor); -+ if (ret) { -+ dev_err(nor->dev, -+ "timeout while writing configuration register\n"); -+ return ret; -+ } -+ - /* read back and check it */ - ret = read_cr(nor); - if (!(ret > 0 && (ret & CR_QUAD_EN_SPAN))) { -diff --git a/drivers/net/phy/marvell.c b/drivers/net/phy/marvell.c -index d2701c53ed68..ebec2dceff45 100644 ---- a/drivers/net/phy/marvell.c -+++ b/drivers/net/phy/marvell.c -@@ -822,8 +822,6 @@ static int marvell_read_status(struct phy_device *phydev) - phydev->lp_advertising = mii_stat1000_to_ethtool_lpa_t(lpagb) | - mii_lpa_to_ethtool_lpa_t(lpa); - -- lpa &= adv; -- - if (status & MII_M1011_PHY_STATUS_FULLDUPLEX) - phydev->duplex = DUPLEX_FULL; - else -diff --git a/drivers/net/phy/mdio-bcm-iproc.c b/drivers/net/phy/mdio-bcm-iproc.c -index c0b4e65267af..46fe1ae919a3 100644 ---- a/drivers/net/phy/mdio-bcm-iproc.c -+++ b/drivers/net/phy/mdio-bcm-iproc.c -@@ -81,8 +81,6 @@ static int iproc_mdio_read(struct mii_bus *bus, int phy_id, int reg) - if (rc) - return rc; - -- iproc_mdio_config_clk(priv->base); -- - /* Prepare the read operation */ - cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | - (reg << MII_DATA_RA_SHIFT) | -@@ -112,8 +110,6 @@ static int iproc_mdio_write(struct mii_bus *bus, int phy_id, - if (rc) - return rc; - -- iproc_mdio_config_clk(priv->base); -- - /* Prepare the write operation */ - cmd = (MII_DATA_TA_VAL << MII_DATA_TA_SHIFT) | - (reg << MII_DATA_RA_SHIFT) | -@@ -163,6 +159,8 @@ static int iproc_mdio_probe(struct platform_device *pdev) - bus->read = iproc_mdio_read; - bus->write = iproc_mdio_write; - -+ iproc_mdio_config_clk(priv->base); -+ - rc = of_mdiobus_register(bus, pdev->dev.of_node); - if (rc) { - dev_err(&pdev->dev, "MDIO bus registration failed\n"); -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index 044253dca30a..b8a5a8e8f57d 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -27,6 +27,13 @@ enum { - NVME_NS_LIGHTNVM = 1, - }; - -+/* The below value is the specific amount of delay needed before checking -+ * readiness in case of the PCI_DEVICE(0x1c58, 0x0003), which needs the -+ * NVME_QUIRK_DELAY_BEFORE_CHK_RDY quirk enabled. The value (in ms) was -+ * found empirically. -+ */ -+#define NVME_QUIRK_DELAY_AMOUNT 2000 -+ - /* - * Represents an NVM Express device. Each nvme_dev is a PCI function. - */ -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index c851bc53831c..4c673d45f1bd 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -1633,10 +1633,15 @@ static int nvme_wait_ready(struct nvme_dev *dev, u64 cap, bool enabled) - */ - static int nvme_disable_ctrl(struct nvme_dev *dev, u64 cap) - { -+ struct pci_dev *pdev = to_pci_dev(dev->dev); -+ - dev->ctrl_config &= ~NVME_CC_SHN_MASK; - dev->ctrl_config &= ~NVME_CC_ENABLE; - writel(dev->ctrl_config, &dev->bar->cc); - -+ if (pdev->vendor == 0x1c58 && pdev->device == 0x0003) -+ msleep(NVME_QUIRK_DELAY_AMOUNT); -+ - return nvme_wait_ready(dev, cap, false); - } - -diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c -index 655f79db7899..58048dd5fcd0 100644 ---- a/drivers/of/fdt.c -+++ b/drivers/of/fdt.c -@@ -632,9 +632,12 @@ int __init of_scan_flat_dt(int (*it)(unsigned long node, - const char *pathp; - int offset, rc = 0, depth = -1; - -- for (offset = fdt_next_node(blob, -1, &depth); -- offset >= 0 && depth >= 0 && !rc; -- offset = fdt_next_node(blob, offset, &depth)) { -+ if (!blob) -+ return 0; -+ -+ for (offset = fdt_next_node(blob, -1, &depth); -+ offset >= 0 && depth >= 0 && !rc; -+ offset = fdt_next_node(blob, offset, &depth)) { - - pathp = fdt_get_name(blob, offset, NULL); - if (*pathp == '/') -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 200d3de8bc1e..a180c000e246 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1112,6 +1112,18 @@ iscsit_get_immediate_data(struct iscsi_cmd *cmd, struct iscsi_scsi_req *hdr, - */ - if (dump_payload) - goto after_immediate_data; -+ /* -+ * Check for underflow case where both EDTL and immediate data payload -+ * exceeds what is presented by CDB's TRANSFER LENGTH, and what has -+ * already been set in target_cmd_size_check() as se_cmd->data_length. -+ * -+ * For this special case, fail the command and dump the immediate data -+ * payload. -+ */ -+ if (cmd->first_burst_len > cmd->se_cmd.data_length) { -+ cmd->sense_reason = TCM_INVALID_CDB_FIELD; -+ goto after_immediate_data; -+ } - - immed_ret = iscsit_handle_immediate_data(cmd, hdr, - cmd->first_burst_len); -diff --git a/drivers/target/target_core_internal.h b/drivers/target/target_core_internal.h -index 253a91bff943..272e6f755322 100644 ---- a/drivers/target/target_core_internal.h -+++ b/drivers/target/target_core_internal.h -@@ -132,7 +132,7 @@ int init_se_kmem_caches(void); - void release_se_kmem_caches(void); - u32 scsi_get_new_index(scsi_index_t); - void transport_subsystem_check_init(void); --void transport_cmd_finish_abort(struct se_cmd *, int); -+int transport_cmd_finish_abort(struct se_cmd *, int); - unsigned char *transport_dump_cmd_direction(struct se_cmd *); - void transport_dump_dev_state(struct se_device *, char *, int *); - void transport_dump_dev_info(struct se_device *, struct se_lun *, -diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c -index 46b1991fbb50..c9be953496ec 100644 ---- a/drivers/target/target_core_tmr.c -+++ b/drivers/target/target_core_tmr.c -@@ -75,7 +75,7 @@ void core_tmr_release_req(struct se_tmr_req *tmr) - kfree(tmr); - } - --static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) -+static int core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) - { - unsigned long flags; - bool remove = true, send_tas; -@@ -91,7 +91,7 @@ static void core_tmr_handle_tas_abort(struct se_cmd *cmd, int tas) - transport_send_task_abort(cmd); - } - -- transport_cmd_finish_abort(cmd, remove); -+ return transport_cmd_finish_abort(cmd, remove); - } - - static int target_check_cdb_and_preempt(struct list_head *list, -@@ -185,8 +185,8 @@ void core_tmr_abort_task( - cancel_work_sync(&se_cmd->work); - transport_wait_for_tasks(se_cmd); - -- transport_cmd_finish_abort(se_cmd, true); -- target_put_sess_cmd(se_cmd); -+ if (!transport_cmd_finish_abort(se_cmd, true)) -+ target_put_sess_cmd(se_cmd); - - printk("ABORT_TASK: Sending TMR_FUNCTION_COMPLETE for" - " ref_tag: %llu\n", ref_tag); -@@ -286,8 +286,8 @@ static void core_tmr_drain_tmr_list( - cancel_work_sync(&cmd->work); - transport_wait_for_tasks(cmd); - -- transport_cmd_finish_abort(cmd, 1); -- target_put_sess_cmd(cmd); -+ if (!transport_cmd_finish_abort(cmd, 1)) -+ target_put_sess_cmd(cmd); - } - } - -@@ -385,8 +385,8 @@ static void core_tmr_drain_state_list( - cancel_work_sync(&cmd->work); - transport_wait_for_tasks(cmd); - -- core_tmr_handle_tas_abort(cmd, tas); -- target_put_sess_cmd(cmd); -+ if (!core_tmr_handle_tas_abort(cmd, tas)) -+ target_put_sess_cmd(cmd); - } - } - -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 60743bf27f37..37c77db6e737 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -639,9 +639,10 @@ static void transport_lun_remove_cmd(struct se_cmd *cmd) - percpu_ref_put(&lun->lun_ref); - } - --void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) -+int transport_cmd_finish_abort(struct se_cmd *cmd, int remove) - { - bool ack_kref = (cmd->se_cmd_flags & SCF_ACK_KREF); -+ int ret = 0; - - if (cmd->se_cmd_flags & SCF_SE_LUN_CMD) - transport_lun_remove_cmd(cmd); -@@ -653,9 +654,11 @@ void transport_cmd_finish_abort(struct se_cmd *cmd, int remove) - cmd->se_tfo->aborted_task(cmd); - - if (transport_cmd_check_stop_to_fabric(cmd)) -- return; -+ return 1; - if (remove && ack_kref) -- transport_put_cmd(cmd); -+ ret = transport_put_cmd(cmd); -+ -+ return ret; - } - - static void target_complete_failure_work(struct work_struct *work) -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 9ad5145d3103..6d8f865a2fb7 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -1668,12 +1668,12 @@ static int ffs_func_eps_enable(struct ffs_function *func) - ep->ep->driver_data = ep; - ep->ep->desc = ds; - -- comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + -- USB_DT_ENDPOINT_SIZE); -- ep->ep->maxburst = comp_desc->bMaxBurst + 1; -- -- if (needs_comp_desc) -+ if (needs_comp_desc) { -+ comp_desc = (struct usb_ss_ep_comp_descriptor *)(ds + -+ USB_DT_ENDPOINT_SIZE); -+ ep->ep->maxburst = comp_desc->bMaxBurst + 1; - ep->ep->comp_desc = comp_desc; -+ } - - ret = usb_ep_enable(ep->ep); - if (likely(!ret)) { -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 7fbe19d5279e..81b2b9f808b5 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -215,14 +215,19 @@ done: - - static inline void hub_descriptor(struct usb_hub_descriptor *desc) - { -+ int width; -+ - memset(desc, 0, sizeof(*desc)); - desc->bDescriptorType = USB_DT_HUB; -- desc->bDescLength = 9; - desc->wHubCharacteristics = cpu_to_le16( - HUB_CHAR_INDV_PORT_LPSM | HUB_CHAR_COMMON_OCPM); -+ - desc->bNbrPorts = VHCI_NPORTS; -- desc->u.hs.DeviceRemovable[0] = 0xff; -- desc->u.hs.DeviceRemovable[1] = 0xff; -+ BUILD_BUG_ON(VHCI_NPORTS > USB_MAXCHILDREN); -+ width = desc->bNbrPorts / 8 + 1; -+ desc->bDescLength = USB_DT_HUB_NONVAR_SIZE + 2 * width; -+ memset(&desc->u.hs.DeviceRemovable[0], 0, width); -+ memset(&desc->u.hs.DeviceRemovable[width], 0xff, width); - } - - static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, -diff --git a/fs/autofs4/dev-ioctl.c b/fs/autofs4/dev-ioctl.c -index ac7d921ed984..257425511d10 100644 ---- a/fs/autofs4/dev-ioctl.c -+++ b/fs/autofs4/dev-ioctl.c -@@ -331,7 +331,7 @@ static int autofs_dev_ioctl_fail(struct file *fp, - int status; - - token = (autofs_wqt_t) param->fail.token; -- status = param->fail.status ? param->fail.status : -ENOENT; -+ status = param->fail.status < 0 ? param->fail.status : -ENOENT; - return autofs4_wait_release(sbi, token, status); - } - -diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c -index 87b87e091e8e..efd72e1fae74 100644 ---- a/fs/cifs/smb1ops.c -+++ b/fs/cifs/smb1ops.c -@@ -849,8 +849,13 @@ cifs_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, - struct cifs_fid *fid, __u16 search_flags, - struct cifs_search_info *srch_inf) - { -- return CIFSFindFirst(xid, tcon, path, cifs_sb, -- &fid->netfid, search_flags, srch_inf, true); -+ int rc; -+ -+ rc = CIFSFindFirst(xid, tcon, path, cifs_sb, -+ &fid->netfid, search_flags, srch_inf, true); -+ if (rc) -+ cifs_dbg(FYI, "find first failed=%d\n", rc); -+ return rc; - } - - static int -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 087918c4612a..1d125d3d0d89 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -909,7 +909,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, - rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL); - kfree(utf16_path); - if (rc) { -- cifs_dbg(VFS, "open dir failed\n"); -+ cifs_dbg(FYI, "open dir failed rc=%d\n", rc); - return rc; - } - -@@ -919,7 +919,7 @@ smb2_query_dir_first(const unsigned int xid, struct cifs_tcon *tcon, - rc = SMB2_query_directory(xid, tcon, fid->persistent_fid, - fid->volatile_fid, 0, srch_inf); - if (rc) { -- cifs_dbg(VFS, "query directory failed\n"); -+ cifs_dbg(FYI, "query directory failed rc=%d\n", rc); - SMB2_close(xid, tcon, fid->persistent_fid, fid->volatile_fid); - } - return rc; -diff --git a/fs/exec.c b/fs/exec.c -index 3a6de10d3891..02153068a694 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -206,8 +206,26 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - - if (write) { - unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start; -+ unsigned long ptr_size; - struct rlimit *rlim; - -+ /* -+ * Since the stack will hold pointers to the strings, we -+ * must account for them as well. -+ * -+ * The size calculation is the entire vma while each arg page is -+ * built, so each time we get here it's calculating how far it -+ * is currently (rather than each call being just the newly -+ * added size from the arg page). As a result, we need to -+ * always add the entire size of the pointers, so that on the -+ * last call to get_arg_page() we'll actually have the entire -+ * correct size. -+ */ -+ ptr_size = (bprm->argc + bprm->envc) * sizeof(void *); -+ if (ptr_size > ULONG_MAX - size) -+ goto fail; -+ size += ptr_size; -+ - acct_arg_size(bprm, size / PAGE_SIZE); - - /* -@@ -225,13 +243,15 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - * to work from. - */ - rlim = current->signal->rlim; -- if (size > ACCESS_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) { -- put_page(page); -- return NULL; -- } -+ if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) -+ goto fail; - } - - return page; -+ -+fail: -+ put_page(page); -+ return NULL; - } - - static void put_arg_page(struct page *page) -diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h -index 25247220b4b7..f0f1793cfa49 100644 ---- a/include/linux/timekeeper_internal.h -+++ b/include/linux/timekeeper_internal.h -@@ -29,7 +29,6 @@ - */ - struct tk_read_base { - struct clocksource *clock; -- cycle_t (*read)(struct clocksource *cs); - cycle_t mask; - cycle_t cycle_last; - u32 mult; -diff --git a/kernel/signal.c b/kernel/signal.c -index f3f1f7a972fd..b92a047ddc82 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -503,7 +503,8 @@ int unhandled_signal(struct task_struct *tsk, int sig) - return !tsk->ptrace; - } - --static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) -+static void collect_signal(int sig, struct sigpending *list, siginfo_t *info, -+ bool *resched_timer) - { - struct sigqueue *q, *first = NULL; - -@@ -525,6 +526,12 @@ static void collect_signal(int sig, struct sigpending *list, siginfo_t *info) - still_pending: - list_del_init(&first->list); - copy_siginfo(info, &first->info); -+ -+ *resched_timer = -+ (first->flags & SIGQUEUE_PREALLOC) && -+ (info->si_code == SI_TIMER) && -+ (info->si_sys_private); -+ - __sigqueue_free(first); - } else { - /* -@@ -541,12 +548,12 @@ still_pending: - } - - static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, -- siginfo_t *info) -+ siginfo_t *info, bool *resched_timer) - { - int sig = next_signal(pending, mask); - - if (sig) -- collect_signal(sig, pending, info); -+ collect_signal(sig, pending, info, resched_timer); - return sig; - } - -@@ -558,15 +565,16 @@ static int __dequeue_signal(struct sigpending *pending, sigset_t *mask, - */ - int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) - { -+ bool resched_timer = false; - int signr; - - /* We only dequeue private signals from ourselves, we don't let - * signalfd steal them - */ -- signr = __dequeue_signal(&tsk->pending, mask, info); -+ signr = __dequeue_signal(&tsk->pending, mask, info, &resched_timer); - if (!signr) { - signr = __dequeue_signal(&tsk->signal->shared_pending, -- mask, info); -+ mask, info, &resched_timer); - /* - * itimer signal ? - * -@@ -611,7 +619,7 @@ int dequeue_signal(struct task_struct *tsk, sigset_t *mask, siginfo_t *info) - */ - current->jobctl |= JOBCTL_STOP_DEQUEUED; - } -- if ((info->si_code & __SI_MASK) == __SI_TIMER && info->si_sys_private) { -+ if (resched_timer) { - /* - * Release the siglock to ensure proper locking order - * of timer locks outside of siglocks. Note, we leave -diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 738012d68117..6e4866834d26 100644 ---- a/kernel/time/timekeeping.c -+++ b/kernel/time/timekeeping.c -@@ -116,6 +116,26 @@ static inline void tk_update_sleep_time(struct timekeeper *tk, ktime_t delta) - tk->offs_boot = ktime_add(tk->offs_boot, delta); - } - -+/* -+ * tk_clock_read - atomic clocksource read() helper -+ * -+ * This helper is necessary to use in the read paths because, while the -+ * seqlock ensures we don't return a bad value while structures are updated, -+ * it doesn't protect from potential crashes. There is the possibility that -+ * the tkr's clocksource may change between the read reference, and the -+ * clock reference passed to the read function. This can cause crashes if -+ * the wrong clocksource is passed to the wrong read function. -+ * This isn't necessary to use when holding the timekeeper_lock or doing -+ * a read of the fast-timekeeper tkrs (which is protected by its own locking -+ * and update logic). -+ */ -+static inline u64 tk_clock_read(struct tk_read_base *tkr) -+{ -+ struct clocksource *clock = READ_ONCE(tkr->clock); -+ -+ return clock->read(clock); -+} -+ - #ifdef CONFIG_DEBUG_TIMEKEEPING - #define WARNING_FREQ (HZ*300) /* 5 minute rate-limiting */ - -@@ -173,7 +193,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) - */ - do { - seq = read_seqcount_begin(&tk_core.seq); -- now = tkr->read(tkr->clock); -+ now = tk_clock_read(tkr); - last = tkr->cycle_last; - mask = tkr->mask; - max = tkr->clock->max_cycles; -@@ -207,7 +227,7 @@ static inline cycle_t timekeeping_get_delta(struct tk_read_base *tkr) - cycle_t cycle_now, delta; - - /* read clocksource */ -- cycle_now = tkr->read(tkr->clock); -+ cycle_now = tk_clock_read(tkr); - - /* calculate the delta since the last update_wall_time */ - delta = clocksource_delta(cycle_now, tkr->cycle_last, tkr->mask); -@@ -235,12 +255,10 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock) - - old_clock = tk->tkr_mono.clock; - tk->tkr_mono.clock = clock; -- tk->tkr_mono.read = clock->read; - tk->tkr_mono.mask = clock->mask; -- tk->tkr_mono.cycle_last = tk->tkr_mono.read(clock); -+ tk->tkr_mono.cycle_last = tk_clock_read(&tk->tkr_mono); - - tk->tkr_raw.clock = clock; -- tk->tkr_raw.read = clock->read; - tk->tkr_raw.mask = clock->mask; - tk->tkr_raw.cycle_last = tk->tkr_mono.cycle_last; - -@@ -404,7 +422,7 @@ static __always_inline u64 __ktime_get_fast_ns(struct tk_fast *tkf) - - now += timekeeping_delta_to_ns(tkr, - clocksource_delta( -- tkr->read(tkr->clock), -+ tk_clock_read(tkr), - tkr->cycle_last, - tkr->mask)); - } while (read_seqcount_retry(&tkf->seq, seq)); -@@ -432,6 +450,10 @@ static cycle_t dummy_clock_read(struct clocksource *cs) - return cycles_at_suspend; - } - -+static struct clocksource dummy_clock = { -+ .read = dummy_clock_read, -+}; -+ - /** - * halt_fast_timekeeper - Prevent fast timekeeper from accessing clocksource. - * @tk: Timekeeper to snapshot. -@@ -448,13 +470,13 @@ static void halt_fast_timekeeper(struct timekeeper *tk) - struct tk_read_base *tkr = &tk->tkr_mono; - - memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); -- cycles_at_suspend = tkr->read(tkr->clock); -- tkr_dummy.read = dummy_clock_read; -+ cycles_at_suspend = tk_clock_read(tkr); -+ tkr_dummy.clock = &dummy_clock; - update_fast_timekeeper(&tkr_dummy, &tk_fast_mono); - - tkr = &tk->tkr_raw; - memcpy(&tkr_dummy, tkr, sizeof(tkr_dummy)); -- tkr_dummy.read = dummy_clock_read; -+ tkr_dummy.clock = &dummy_clock; - update_fast_timekeeper(&tkr_dummy, &tk_fast_raw); - } - -@@ -618,11 +640,10 @@ static void timekeeping_update(struct timekeeper *tk, unsigned int action) - */ - static void timekeeping_forward_now(struct timekeeper *tk) - { -- struct clocksource *clock = tk->tkr_mono.clock; - cycle_t cycle_now, delta; - s64 nsec; - -- cycle_now = tk->tkr_mono.read(clock); -+ cycle_now = tk_clock_read(&tk->tkr_mono); - delta = clocksource_delta(cycle_now, tk->tkr_mono.cycle_last, tk->tkr_mono.mask); - tk->tkr_mono.cycle_last = cycle_now; - tk->tkr_raw.cycle_last = cycle_now; -@@ -1405,7 +1426,7 @@ void timekeeping_resume(void) - * The less preferred source will only be tried if there is no better - * usable source. The rtc part is handled separately in rtc core code. - */ -- cycle_now = tk->tkr_mono.read(clock); -+ cycle_now = tk_clock_read(&tk->tkr_mono); - if ((clock->flags & CLOCK_SOURCE_SUSPEND_NONSTOP) && - cycle_now > tk->tkr_mono.cycle_last) { - u64 num, max = ULLONG_MAX; -@@ -1800,7 +1821,7 @@ void update_wall_time(void) - #ifdef CONFIG_ARCH_USES_GETTIMEOFFSET - offset = real_tk->cycle_interval; - #else -- offset = clocksource_delta(tk->tkr_mono.read(tk->tkr_mono.clock), -+ offset = clocksource_delta(tk_clock_read(&tk->tkr_mono), - tk->tkr_mono.cycle_last, tk->tkr_mono.mask); - #endif - -diff --git a/lib/cmdline.c b/lib/cmdline.c -index 8f13cf73c2ec..79069d7938ea 100644 ---- a/lib/cmdline.c -+++ b/lib/cmdline.c -@@ -22,14 +22,14 @@ - * the values[M, M+1, ..., N] into the ints array in get_options. - */ - --static int get_range(char **str, int *pint) -+static int get_range(char **str, int *pint, int n) - { - int x, inc_counter, upper_range; - - (*str)++; - upper_range = simple_strtol((*str), NULL, 0); - inc_counter = upper_range - *pint; -- for (x = *pint; x < upper_range; x++) -+ for (x = *pint; n && x < upper_range; x++, n--) - *pint++ = x; - return inc_counter; - } -@@ -96,7 +96,7 @@ char *get_options(const char *str, int nints, int *ints) - break; - if (res == 3) { - int range_nums; -- range_nums = get_range((char **)&str, ints + i); -+ range_nums = get_range((char **)&str, ints + i, nints - i); - if (range_nums < 0) - break; - /* -diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c -index da3cc09f683e..91d43ab3a961 100644 ---- a/net/rxrpc/ar-key.c -+++ b/net/rxrpc/ar-key.c -@@ -215,7 +215,7 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, - unsigned int *_toklen) - { - const __be32 *xdr = *_xdr; -- unsigned int toklen = *_toklen, n_parts, loop, tmp; -+ unsigned int toklen = *_toklen, n_parts, loop, tmp, paddedlen; - - /* there must be at least one name, and at least #names+1 length - * words */ -@@ -245,16 +245,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, - toklen -= 4; - if (tmp <= 0 || tmp > AFSTOKEN_STRING_MAX) - return -EINVAL; -- if (tmp > toklen) -+ paddedlen = (tmp + 3) & ~3; -+ if (paddedlen > toklen) - return -EINVAL; - princ->name_parts[loop] = kmalloc(tmp + 1, GFP_KERNEL); - if (!princ->name_parts[loop]) - return -ENOMEM; - memcpy(princ->name_parts[loop], xdr, tmp); - princ->name_parts[loop][tmp] = 0; -- tmp = (tmp + 3) & ~3; -- toklen -= tmp; -- xdr += tmp >> 2; -+ toklen -= paddedlen; -+ xdr += paddedlen >> 2; - } - - if (toklen < 4) -@@ -263,16 +263,16 @@ static int rxrpc_krb5_decode_principal(struct krb5_principal *princ, - toklen -= 4; - if (tmp <= 0 || tmp > AFSTOKEN_K5_REALM_MAX) - return -EINVAL; -- if (tmp > toklen) -+ paddedlen = (tmp + 3) & ~3; -+ if (paddedlen > toklen) - return -EINVAL; - princ->realm = kmalloc(tmp + 1, GFP_KERNEL); - if (!princ->realm) - return -ENOMEM; - memcpy(princ->realm, xdr, tmp); - princ->realm[tmp] = 0; -- tmp = (tmp + 3) & ~3; -- toklen -= tmp; -- xdr += tmp >> 2; -+ toklen -= paddedlen; -+ xdr += paddedlen >> 2; - - _debug("%s/...@%s", princ->name_parts[0], princ->realm); - -@@ -291,7 +291,7 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, - unsigned int *_toklen) - { - const __be32 *xdr = *_xdr; -- unsigned int toklen = *_toklen, len; -+ unsigned int toklen = *_toklen, len, paddedlen; - - /* there must be at least one tag and one length word */ - if (toklen <= 8) -@@ -305,15 +305,17 @@ static int rxrpc_krb5_decode_tagged_data(struct krb5_tagged_data *td, - toklen -= 8; - if (len > max_data_size) - return -EINVAL; -+ paddedlen = (len + 3) & ~3; -+ if (paddedlen > toklen) -+ return -EINVAL; - td->data_len = len; - - if (len > 0) { - td->data = kmemdup(xdr, len, GFP_KERNEL); - if (!td->data) - return -ENOMEM; -- len = (len + 3) & ~3; -- toklen -= len; -- xdr += len >> 2; -+ toklen -= paddedlen; -+ xdr += paddedlen >> 2; - } - - _debug("tag %x len %x", td->tag, td->data_len); -@@ -385,7 +387,7 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, - const __be32 **_xdr, unsigned int *_toklen) - { - const __be32 *xdr = *_xdr; -- unsigned int toklen = *_toklen, len; -+ unsigned int toklen = *_toklen, len, paddedlen; - - /* there must be at least one length word */ - if (toklen <= 4) -@@ -397,6 +399,9 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, - toklen -= 4; - if (len > AFSTOKEN_K5_TIX_MAX) - return -EINVAL; -+ paddedlen = (len + 3) & ~3; -+ if (paddedlen > toklen) -+ return -EINVAL; - *_tktlen = len; - - _debug("ticket len %u", len); -@@ -405,9 +410,8 @@ static int rxrpc_krb5_decode_ticket(u8 **_ticket, u16 *_tktlen, - *_ticket = kmemdup(xdr, len, GFP_KERNEL); - if (!*_ticket) - return -ENOMEM; -- len = (len + 3) & ~3; -- toklen -= len; -- xdr += len >> 2; -+ toklen -= paddedlen; -+ xdr += paddedlen >> 2; - } - - *_xdr = xdr; -@@ -550,7 +554,7 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) - { - const __be32 *xdr = prep->data, *token; - const char *cp; -- unsigned int len, tmp, loop, ntoken, toklen, sec_ix; -+ unsigned int len, paddedlen, loop, ntoken, toklen, sec_ix; - size_t datalen = prep->datalen; - int ret; - -@@ -576,22 +580,21 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) - if (len < 1 || len > AFSTOKEN_CELL_MAX) - goto not_xdr; - datalen -= 4; -- tmp = (len + 3) & ~3; -- if (tmp > datalen) -+ paddedlen = (len + 3) & ~3; -+ if (paddedlen > datalen) - goto not_xdr; - - cp = (const char *) xdr; - for (loop = 0; loop < len; loop++) - if (!isprint(cp[loop])) - goto not_xdr; -- if (len < tmp) -- for (; loop < tmp; loop++) -- if (cp[loop]) -- goto not_xdr; -+ for (; loop < paddedlen; loop++) -+ if (cp[loop]) -+ goto not_xdr; - _debug("cellname: [%u/%u] '%*.*s'", -- len, tmp, len, len, (const char *) xdr); -- datalen -= tmp; -- xdr += tmp >> 2; -+ len, paddedlen, len, len, (const char *) xdr); -+ datalen -= paddedlen; -+ xdr += paddedlen >> 2; - - /* get the token count */ - if (datalen < 12) -@@ -612,10 +615,11 @@ static int rxrpc_preparse_xdr(struct key_preparsed_payload *prep) - sec_ix = ntohl(*xdr); - datalen -= 4; - _debug("token: [%x/%zx] %x", toklen, datalen, sec_ix); -- if (toklen < 20 || toklen > datalen) -+ paddedlen = (toklen + 3) & ~3; -+ if (toklen < 20 || toklen > datalen || paddedlen > datalen) - goto not_xdr; -- datalen -= (toklen + 3) & ~3; -- xdr += (toklen + 3) >> 2; -+ datalen -= paddedlen; -+ xdr += paddedlen >> 2; - - } while (--loop > 0); - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.75-76.patch b/patch/kernel/mvebu64-default/03-patch-4.4.75-76.patch deleted file mode 100644 index a8150b6072bb..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.75-76.patch +++ /dev/null @@ -1,2853 +0,0 @@ -diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt -index af70d1541d3a..be61d53e997f 100644 ---- a/Documentation/sysctl/kernel.txt -+++ b/Documentation/sysctl/kernel.txt -@@ -810,14 +810,13 @@ via the /proc/sys interface: - Each write syscall must fully contain the sysctl value to be - written, and multiple writes on the same sysctl file descriptor - will rewrite the sysctl value, regardless of file position. -- 0 - (default) Same behavior as above, but warn about processes that -- perform writes to a sysctl file descriptor when the file position -- is not 0. -- 1 - Respect file position when writing sysctl strings. Multiple writes -- will append to the sysctl value buffer. Anything past the max length -- of the sysctl value buffer will be ignored. Writes to numeric sysctl -- entries must always be at file position 0 and the value must be -- fully contained in the buffer sent in the write syscall. -+ 0 - Same behavior as above, but warn about processes that perform writes -+ to a sysctl file descriptor when the file position is not 0. -+ 1 - (default) Respect file position when writing sysctl strings. Multiple -+ writes will append to the sysctl value buffer. Anything past the max -+ length of the sysctl value buffer will be ignored. Writes to numeric -+ sysctl entries must always be at file position 0 and the value must -+ be fully contained in the buffer sent in the write syscall. - - ============================================================== - -diff --git a/Makefile b/Makefile -index 696d15d8ad5d..902ab134446e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 75 -+SUBLEVEL = 76 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -633,6 +633,12 @@ endif - # Tell gcc to never replace conditional load with a non-conditional one - KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) - -+# check for 'asm goto' -+ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) -+ KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO -+ KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO -+endif -+ - ifdef CONFIG_READABLE_ASM - # Disable optimizations that make assembler listings hard to read. - # reorder blocks reorders the control in the function -@@ -788,12 +794,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) - # use the deterministic mode of AR if available - KBUILD_ARFLAGS := $(call ar-option,D) - --# check for 'asm goto' --ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) -- KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO -- KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO --endif -- - include scripts/Makefile.kasan - include scripts/Makefile.extrawarn - -diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi -index 6f50f672efbd..de8ac998604d 100644 ---- a/arch/arm/boot/dts/bcm5301x.dtsi -+++ b/arch/arm/boot/dts/bcm5301x.dtsi -@@ -54,14 +54,14 @@ - timer@0200 { - compatible = "arm,cortex-a9-global-timer"; - reg = <0x0200 0x100>; -- interrupts = ; -+ interrupts = ; - clocks = <&clk_periph>; - }; - - local-timer@0600 { - compatible = "arm,cortex-a9-twd-timer"; - reg = <0x0600 0x100>; -- interrupts = ; -+ interrupts = ; - clocks = <&clk_periph>; - }; - -diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c -index 4867f5daf82c..e47cffd25c6c 100644 ---- a/arch/arm/mm/mmu.c -+++ b/arch/arm/mm/mmu.c -@@ -1184,15 +1184,15 @@ void __init sanity_check_meminfo(void) - - high_memory = __va(arm_lowmem_limit - 1) + 1; - -+ if (!memblock_limit) -+ memblock_limit = arm_lowmem_limit; -+ - /* - * Round the memblock limit down to a pmd size. This - * helps to ensure that we will allocate memory from the - * last full pmd, which should be mapped. - */ -- if (memblock_limit) -- memblock_limit = round_down(memblock_limit, PMD_SIZE); -- if (!memblock_limit) -- memblock_limit = arm_lowmem_limit; -+ memblock_limit = round_down(memblock_limit, PMD_SIZE); - - memblock_set_current_limit(memblock_limit); - } -diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h -index caafd63b8092..40d1351e7573 100644 ---- a/arch/arm64/include/asm/acpi.h -+++ b/arch/arm64/include/asm/acpi.h -@@ -22,9 +22,9 @@ - #define ACPI_MADT_GICC_LENGTH \ - (acpi_gbl_FADT.header.revision < 6 ? 76 : 80) - --#define BAD_MADT_GICC_ENTRY(entry, end) \ -- (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) || \ -- (entry)->header.length != ACPI_MADT_GICC_LENGTH) -+#define BAD_MADT_GICC_ENTRY(entry, end) \ -+ (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \ -+ (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end)) - - /* Basic configuration for ACPI */ - #ifdef CONFIG_ACPI -diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c -index 3cedd1f95e0f..8ae4067a5eda 100644 ---- a/arch/mips/ath79/common.c -+++ b/arch/mips/ath79/common.c -@@ -76,14 +76,14 @@ void ath79_ddr_set_pci_windows(void) - { - BUG_ON(!ath79_ddr_pci_win_base); - -- __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0); -- __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 1); -- __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 2); -- __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 3); -- __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 4); -- __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 5); -- __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 6); -- __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 7); -+ __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0x0); -+ __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 0x4); -+ __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 0x8); -+ __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 0xc); -+ __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 0x10); -+ __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 0x14); -+ __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 0x18); -+ __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 0x1c); - } - EXPORT_SYMBOL_GPL(ath79_ddr_set_pci_windows); - -diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S -index 7791840cf22c..db07793f7b43 100644 ---- a/arch/mips/kernel/entry.S -+++ b/arch/mips/kernel/entry.S -@@ -11,6 +11,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -137,6 +138,7 @@ work_pending: - andi t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS - beqz t0, work_notifysig - work_resched: -+ TRACE_IRQS_OFF - jal schedule - - local_irq_disable # make sure need_resched and -@@ -173,6 +175,7 @@ syscall_exit_work: - beqz t0, work_pending # trace bit set? - local_irq_enable # could let syscall_trace_leave() - # call schedule() instead -+ TRACE_IRQS_ON - move a0, sp - jal syscall_trace_leave - b resume_userspace -diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c -index f63a289977cc..0b3e58a3189f 100644 ---- a/arch/mips/kernel/pm-cps.c -+++ b/arch/mips/kernel/pm-cps.c -@@ -55,7 +55,6 @@ DECLARE_BITMAP(state_support, CPS_PM_STATE_COUNT); - * state. Actually per-core rather than per-CPU. - */ - static DEFINE_PER_CPU_ALIGNED(u32*, ready_count); --static DEFINE_PER_CPU_ALIGNED(void*, ready_count_alloc); - - /* Indicates online CPUs coupled with the current CPU */ - static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled); -@@ -625,7 +624,6 @@ static int __init cps_gen_core_entries(unsigned cpu) - { - enum cps_pm_state state; - unsigned core = cpu_data[cpu].core; -- unsigned dlinesz = cpu_data[cpu].dcache.linesz; - void *entry_fn, *core_rc; - - for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) { -@@ -645,16 +643,11 @@ static int __init cps_gen_core_entries(unsigned cpu) - } - - if (!per_cpu(ready_count, core)) { -- core_rc = kmalloc(dlinesz * 2, GFP_KERNEL); -+ core_rc = kmalloc(sizeof(u32), GFP_KERNEL); - if (!core_rc) { - pr_err("Failed allocate core %u ready_count\n", core); - return -ENOMEM; - } -- per_cpu(ready_count_alloc, core) = core_rc; -- -- /* Ensure ready_count is aligned to a cacheline boundary */ -- core_rc += dlinesz - 1; -- core_rc = (void *)((unsigned long)core_rc & ~(dlinesz - 1)); - per_cpu(ready_count, core) = core_rc; - } - -diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c -index 99a402231f4d..31ca2edd7218 100644 ---- a/arch/mips/kernel/traps.c -+++ b/arch/mips/kernel/traps.c -@@ -194,6 +194,8 @@ void show_stack(struct task_struct *task, unsigned long *sp) - { - struct pt_regs regs; - mm_segment_t old_fs = get_fs(); -+ -+ regs.cp0_status = KSU_KERNEL; - if (sp) { - regs.regs[29] = (unsigned long)sp; - regs.regs[31] = 0; -diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c -index dfb04fcedb04..48d6349fd9d7 100644 ---- a/arch/mips/ralink/mt7620.c -+++ b/arch/mips/ralink/mt7620.c -@@ -107,31 +107,31 @@ static struct rt2880_pmx_group mt7620a_pinmux_data[] = { - }; - - static struct rt2880_pmx_func pwm1_grp_mt7628[] = { -- FUNC("sdcx", 3, 19, 1), -+ FUNC("sdxc d6", 3, 19, 1), - FUNC("utif", 2, 19, 1), - FUNC("gpio", 1, 19, 1), -- FUNC("pwm", 0, 19, 1), -+ FUNC("pwm1", 0, 19, 1), - }; - - static struct rt2880_pmx_func pwm0_grp_mt7628[] = { -- FUNC("sdcx", 3, 18, 1), -+ FUNC("sdxc d7", 3, 18, 1), - FUNC("utif", 2, 18, 1), - FUNC("gpio", 1, 18, 1), -- FUNC("pwm", 0, 18, 1), -+ FUNC("pwm0", 0, 18, 1), - }; - - static struct rt2880_pmx_func uart2_grp_mt7628[] = { -- FUNC("sdcx", 3, 20, 2), -+ FUNC("sdxc d5 d4", 3, 20, 2), - FUNC("pwm", 2, 20, 2), - FUNC("gpio", 1, 20, 2), -- FUNC("uart", 0, 20, 2), -+ FUNC("uart2", 0, 20, 2), - }; - - static struct rt2880_pmx_func uart1_grp_mt7628[] = { -- FUNC("sdcx", 3, 45, 2), -+ FUNC("sw_r", 3, 45, 2), - FUNC("pwm", 2, 45, 2), - FUNC("gpio", 1, 45, 2), -- FUNC("uart", 0, 45, 2), -+ FUNC("uart1", 0, 45, 2), - }; - - static struct rt2880_pmx_func i2c_grp_mt7628[] = { -@@ -143,21 +143,21 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = { - - static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) }; - static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) }; --static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 15, 38) }; -+static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) }; - static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) }; - - static struct rt2880_pmx_func sd_mode_grp_mt7628[] = { - FUNC("jtag", 3, 22, 8), - FUNC("utif", 2, 22, 8), - FUNC("gpio", 1, 22, 8), -- FUNC("sdcx", 0, 22, 8), -+ FUNC("sdxc", 0, 22, 8), - }; - - static struct rt2880_pmx_func uart0_grp_mt7628[] = { - FUNC("-", 3, 12, 2), - FUNC("-", 2, 12, 2), - FUNC("gpio", 1, 12, 2), -- FUNC("uart", 0, 12, 2), -+ FUNC("uart0", 0, 12, 2), - }; - - static struct rt2880_pmx_func i2s_grp_mt7628[] = { -@@ -171,7 +171,7 @@ static struct rt2880_pmx_func spi_cs1_grp_mt7628[] = { - FUNC("-", 3, 6, 1), - FUNC("refclk", 2, 6, 1), - FUNC("gpio", 1, 6, 1), -- FUNC("spi", 0, 6, 1), -+ FUNC("spi cs1", 0, 6, 1), - }; - - static struct rt2880_pmx_func spis_grp_mt7628[] = { -@@ -188,28 +188,44 @@ static struct rt2880_pmx_func gpio_grp_mt7628[] = { - FUNC("gpio", 0, 11, 1), - }; - --#define MT7628_GPIO_MODE_MASK 0x3 -- --#define MT7628_GPIO_MODE_PWM1 30 --#define MT7628_GPIO_MODE_PWM0 28 --#define MT7628_GPIO_MODE_UART2 26 --#define MT7628_GPIO_MODE_UART1 24 --#define MT7628_GPIO_MODE_I2C 20 --#define MT7628_GPIO_MODE_REFCLK 18 --#define MT7628_GPIO_MODE_PERST 16 --#define MT7628_GPIO_MODE_WDT 14 --#define MT7628_GPIO_MODE_SPI 12 --#define MT7628_GPIO_MODE_SDMODE 10 --#define MT7628_GPIO_MODE_UART0 8 --#define MT7628_GPIO_MODE_I2S 6 --#define MT7628_GPIO_MODE_CS1 4 --#define MT7628_GPIO_MODE_SPIS 2 --#define MT7628_GPIO_MODE_GPIO 0 -+static struct rt2880_pmx_func wled_kn_grp_mt7628[] = { -+ FUNC("rsvd", 3, 35, 1), -+ FUNC("rsvd", 2, 35, 1), -+ FUNC("gpio", 1, 35, 1), -+ FUNC("wled_kn", 0, 35, 1), -+}; -+ -+static struct rt2880_pmx_func wled_an_grp_mt7628[] = { -+ FUNC("rsvd", 3, 44, 1), -+ FUNC("rsvd", 2, 44, 1), -+ FUNC("gpio", 1, 44, 1), -+ FUNC("wled_an", 0, 44, 1), -+}; -+ -+#define MT7628_GPIO_MODE_MASK 0x3 -+ -+#define MT7628_GPIO_MODE_WLED_KN 48 -+#define MT7628_GPIO_MODE_WLED_AN 32 -+#define MT7628_GPIO_MODE_PWM1 30 -+#define MT7628_GPIO_MODE_PWM0 28 -+#define MT7628_GPIO_MODE_UART2 26 -+#define MT7628_GPIO_MODE_UART1 24 -+#define MT7628_GPIO_MODE_I2C 20 -+#define MT7628_GPIO_MODE_REFCLK 18 -+#define MT7628_GPIO_MODE_PERST 16 -+#define MT7628_GPIO_MODE_WDT 14 -+#define MT7628_GPIO_MODE_SPI 12 -+#define MT7628_GPIO_MODE_SDMODE 10 -+#define MT7628_GPIO_MODE_UART0 8 -+#define MT7628_GPIO_MODE_I2S 6 -+#define MT7628_GPIO_MODE_CS1 4 -+#define MT7628_GPIO_MODE_SPIS 2 -+#define MT7628_GPIO_MODE_GPIO 0 - - static struct rt2880_pmx_group mt7628an_pinmux_data[] = { -- GRP_G("pmw1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK, -+ GRP_G("pwm1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK, - 1, MT7628_GPIO_MODE_PWM1), -- GRP_G("pmw1", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK, -+ GRP_G("pwm0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK, - 1, MT7628_GPIO_MODE_PWM0), - GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK, - 1, MT7628_GPIO_MODE_UART2), -@@ -233,6 +249,10 @@ static struct rt2880_pmx_group mt7628an_pinmux_data[] = { - 1, MT7628_GPIO_MODE_SPIS), - GRP_G("gpio", gpio_grp_mt7628, MT7628_GPIO_MODE_MASK, - 1, MT7628_GPIO_MODE_GPIO), -+ GRP_G("wled_an", wled_an_grp_mt7628, MT7628_GPIO_MODE_MASK, -+ 1, MT7628_GPIO_MODE_WLED_AN), -+ GRP_G("wled_kn", wled_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, -+ 1, MT7628_GPIO_MODE_WLED_KN), - { 0 } - }; - -@@ -439,7 +459,7 @@ void __init ralink_clk_init(void) - ralink_clk_add("10000c00.uartlite", periph_rate); - ralink_clk_add("10180000.wmac", xtal_rate); - -- if (IS_ENABLED(CONFIG_USB) && is_mt76x8()) { -+ if (IS_ENABLED(CONFIG_USB) && !is_mt76x8()) { - /* - * When the CPU goes into sleep mode, the BUS clock will be - * too low for USB to function properly. Adjust the busses -diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c -index 15506a1ff22a..9dd67749c592 100644 ---- a/arch/mips/ralink/rt288x.c -+++ b/arch/mips/ralink/rt288x.c -@@ -109,5 +109,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info) - soc_info->mem_size_max = RT2880_MEM_SIZE_MAX; - - rt2880_pinmux_data = rt2880_pinmux_data_act; -- ralink_soc == RT2880_SOC; -+ ralink_soc = RT2880_SOC; - } -diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c -index 98949b0df00a..6696c1986844 100644 ---- a/arch/powerpc/kernel/eeh.c -+++ b/arch/powerpc/kernel/eeh.c -@@ -304,9 +304,17 @@ void eeh_slot_error_detail(struct eeh_pe *pe, int severity) - * - * For pHyp, we have to enable IO for log retrieval. Otherwise, - * 0xFF's is always returned from PCI config space. -+ * -+ * When the @severity is EEH_LOG_PERM, the PE is going to be -+ * removed. Prior to that, the drivers for devices included in -+ * the PE will be closed. The drivers rely on working IO path -+ * to bring the devices to quiet state. Otherwise, PCI traffic -+ * from those devices after they are removed is like to cause -+ * another unexpected EEH error. - */ - if (!(pe->type & EEH_PE_PHB)) { -- if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG)) -+ if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG) || -+ severity == EEH_LOG_PERM) - eeh_pci_enable(pe, EEH_OPT_THAW_MMIO); - - /* -diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h -index d7697ab802f6..8e136b88cdf4 100644 ---- a/arch/s390/include/asm/ctl_reg.h -+++ b/arch/s390/include/asm/ctl_reg.h -@@ -15,7 +15,9 @@ - BUILD_BUG_ON(sizeof(addrtype) != (high - low + 1) * sizeof(long));\ - asm volatile( \ - " lctlg %1,%2,%0\n" \ -- : : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high));\ -+ : \ -+ : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high) \ -+ : "memory"); \ - } - - #define __ctl_store(array, low, high) { \ -diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h -index e9cd7befcb76..19d14ac23ef9 100644 ---- a/arch/x86/include/asm/kvm_emulate.h -+++ b/arch/x86/include/asm/kvm_emulate.h -@@ -221,6 +221,9 @@ struct x86_emulate_ops { - void (*get_cpuid)(struct x86_emulate_ctxt *ctxt, - u32 *eax, u32 *ebx, u32 *ecx, u32 *edx); - void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); -+ -+ unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt); -+ void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags); - }; - - typedef u32 __attribute__((vector_size(16))) sse128_t; -@@ -290,7 +293,6 @@ struct x86_emulate_ctxt { - - /* interruptibility state, as a result of execution of STI or MOV SS */ - int interruptibility; -- int emul_flags; - - bool perm_ok; /* do not check permissions if true */ - bool ud; /* inject an #UD if host doesn't support insn */ -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 1dcea225977d..04b2f3cad7ba 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2531,7 +2531,7 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) - u64 smbase; - int ret; - -- if ((ctxt->emul_flags & X86EMUL_SMM_MASK) == 0) -+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0) - return emulate_ud(ctxt); - - /* -@@ -2580,11 +2580,11 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) - return X86EMUL_UNHANDLEABLE; - } - -- if ((ctxt->emul_flags & X86EMUL_SMM_INSIDE_NMI_MASK) == 0) -+ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0) - ctxt->ops->set_nmi_mask(ctxt, false); - -- ctxt->emul_flags &= ~X86EMUL_SMM_INSIDE_NMI_MASK; -- ctxt->emul_flags &= ~X86EMUL_SMM_MASK; -+ ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) & -+ ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK)); - return X86EMUL_CONTINUE; - } - -@@ -5296,6 +5296,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - const struct x86_emulate_ops *ops = ctxt->ops; - int rc = X86EMUL_CONTINUE; - int saved_dst_type = ctxt->dst.type; -+ unsigned emul_flags; - - ctxt->mem_read.pos = 0; - -@@ -5310,6 +5311,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - goto done; - } - -+ emul_flags = ctxt->ops->get_hflags(ctxt); - if (unlikely(ctxt->d & - (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) { - if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) || -@@ -5343,7 +5345,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - fetch_possible_mmx_operand(ctxt, &ctxt->dst); - } - -- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) { -+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_PRE_EXCEPT); - if (rc != X86EMUL_CONTINUE) -@@ -5372,7 +5374,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - goto done; - } - -- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { -+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_POST_EXCEPT); - if (rc != X86EMUL_CONTINUE) -@@ -5426,7 +5428,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) - - special_insn: - -- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { -+ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { - rc = emulator_check_intercept(ctxt, ctxt->intercept, - X86_ICPT_POST_MEMACCESS); - if (rc != X86EMUL_CONTINUE) -diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c -index ab38af4f4947..23a7c7ba377a 100644 ---- a/arch/x86/kvm/pmu_intel.c -+++ b/arch/x86/kvm/pmu_intel.c -@@ -294,7 +294,7 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu) - ((u64)1 << edx.split.bit_width_fixed) - 1; - } - -- pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) | -+ pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) | - (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED); - pmu->global_ctrl_mask = ~pmu->global_ctrl; - -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 50ca8f409a7c..bbaa11f4e74b 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2264,7 +2264,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr) - if (!(vmcs12->exception_bitmap & (1u << nr))) - return 0; - -- nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason, -+ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI, - vmcs_read32(VM_EXIT_INTR_INFO), - vmcs_readl(EXIT_QUALIFICATION)); - return 1; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 6c82792487e9..8e526c6fd784 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -4844,6 +4844,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector, - - if (var.unusable) { - memset(desc, 0, sizeof(*desc)); -+ if (base3) -+ *base3 = 0; - return false; - } - -@@ -4999,6 +5001,16 @@ static void emulator_set_nmi_mask(struct x86_emulate_ctxt *ctxt, bool masked) - kvm_x86_ops->set_nmi_mask(emul_to_vcpu(ctxt), masked); - } - -+static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt) -+{ -+ return emul_to_vcpu(ctxt)->arch.hflags; -+} -+ -+static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags) -+{ -+ kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags); -+} -+ - static const struct x86_emulate_ops emulate_ops = { - .read_gpr = emulator_read_gpr, - .write_gpr = emulator_write_gpr, -@@ -5038,6 +5050,8 @@ static const struct x86_emulate_ops emulate_ops = { - .intercept = emulator_intercept, - .get_cpuid = emulator_get_cpuid, - .set_nmi_mask = emulator_set_nmi_mask, -+ .get_hflags = emulator_get_hflags, -+ .set_hflags = emulator_set_hflags, - }; - - static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask) -@@ -5090,7 +5104,6 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) - BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK); - BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK); - BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK); -- ctxt->emul_flags = vcpu->arch.hflags; - - init_decode_cache(ctxt); - vcpu->arch.emulate_regs_need_sync_from_vcpu = false; -@@ -5486,8 +5499,6 @@ restart: - unsigned long rflags = kvm_x86_ops->get_rflags(vcpu); - toggle_interruptibility(vcpu, ctxt->interruptibility); - vcpu->arch.emulate_regs_need_sync_to_vcpu = false; -- if (vcpu->arch.hflags != ctxt->emul_flags) -- kvm_set_hflags(vcpu, ctxt->emul_flags); - kvm_rip_write(vcpu, ctxt->eip); - if (r == EMULATE_DONE) - kvm_vcpu_check_singlestep(vcpu, rflags, &r); -@@ -5974,7 +5985,8 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt) - - kvm_x86_ops->patch_hypercall(vcpu, instruction); - -- return emulator_write_emulated(ctxt, rip, instruction, 3, NULL); -+ return emulator_write_emulated(ctxt, rip, instruction, 3, -+ &ctxt->exception); - } - - static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu) -diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c -index ef05755a1900..7ed47b1e6f42 100644 ---- a/arch/x86/mm/mpx.c -+++ b/arch/x86/mm/mpx.c -@@ -293,7 +293,7 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs) - * We were not able to extract an address from the instruction, - * probably because there was something invalid in it. - */ -- if (info->si_addr == (void *)-1) { -+ if (info->si_addr == (void __user *)-1) { - err = -EINVAL; - goto err_out; - } -@@ -525,15 +525,7 @@ int mpx_handle_bd_fault(void) - if (!kernel_managing_mpx_tables(current->mm)) - return -EINVAL; - -- if (do_mpx_bt_fault()) { -- force_sig(SIGSEGV, current); -- /* -- * The force_sig() is essentially "handling" this -- * exception, so we do not pass up the error -- * from do_mpx_bt_fault(). -- */ -- } -- return 0; -+ return do_mpx_bt_fault(); - } - - /* -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 5fb6adaaa796..5a760fd66bec 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -134,8 +134,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask, - { - struct flush_tlb_info info; - -- if (end == 0) -- end = start + PAGE_SIZE; - info.flush_mm = mm; - info.flush_start = start; - info.flush_end = end; -@@ -264,7 +262,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long start) - } - - if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) -- flush_tlb_others(mm_cpumask(mm), mm, start, 0UL); -+ flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE); - - preempt_enable(); - } -diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c -index 9d359e05fad7..8161090a1970 100644 ---- a/block/blk-cgroup.c -+++ b/block/blk-cgroup.c -@@ -788,6 +788,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - { - struct gendisk *disk; - struct blkcg_gq *blkg; -+ struct module *owner; - unsigned int major, minor; - int key_len, part, ret; - char *body; -@@ -804,7 +805,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - if (!disk) - return -ENODEV; - if (part) { -+ owner = disk->fops->owner; - put_disk(disk); -+ module_put(owner); - return -ENODEV; - } - -@@ -820,7 +823,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, - ret = PTR_ERR(blkg); - rcu_read_unlock(); - spin_unlock_irq(disk->queue->queue_lock); -+ owner = disk->fops->owner; - put_disk(disk); -+ module_put(owner); - /* - * If queue was bypassing, we should retry. Do so after a - * short msleep(). It isn't strictly necessary but queue -@@ -851,9 +856,13 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep); - void blkg_conf_finish(struct blkg_conf_ctx *ctx) - __releases(ctx->disk->queue->queue_lock) __releases(rcu) - { -+ struct module *owner; -+ - spin_unlock_irq(ctx->disk->queue->queue_lock); - rcu_read_unlock(); -+ owner = ctx->disk->fops->owner; - put_disk(ctx->disk); -+ module_put(owner); - } - EXPORT_SYMBOL_GPL(blkg_conf_finish); - -diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c -index 31e8ae916ba0..be0b09a0fb44 100644 ---- a/drivers/char/virtio_console.c -+++ b/drivers/char/virtio_console.c -@@ -1864,7 +1864,7 @@ static void config_work_handler(struct work_struct *work) - { - struct ports_device *portdev; - -- portdev = container_of(work, struct ports_device, control_work); -+ portdev = container_of(work, struct ports_device, config_work); - if (!use_multiport(portdev)) { - struct virtio_device *vdev; - struct port *port; -diff --git a/drivers/cpufreq/s3c2416-cpufreq.c b/drivers/cpufreq/s3c2416-cpufreq.c -index d6d425773fa4..5b2db3c6568f 100644 ---- a/drivers/cpufreq/s3c2416-cpufreq.c -+++ b/drivers/cpufreq/s3c2416-cpufreq.c -@@ -400,7 +400,6 @@ static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) - rate = clk_get_rate(s3c_freq->hclk); - if (rate < 133 * 1000 * 1000) { - pr_err("cpufreq: HCLK not at 133MHz\n"); -- clk_put(s3c_freq->hclk); - ret = -EINVAL; - goto err_armclk; - } -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -index 25a3e2485cc2..2bc17a907ecf 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c -@@ -124,6 +124,13 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type, - } - break; - } -+ -+ if (!(*out_ring && (*out_ring)->adev)) { -+ DRM_ERROR("Ring %d is not initialized on IP %d\n", -+ ring, ip_type); -+ return -EINVAL; -+ } -+ - return 0; - } - -diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h -index b92139e9b9d8..b5c64edeb668 100644 ---- a/drivers/gpu/drm/ast/ast_drv.h -+++ b/drivers/gpu/drm/ast/ast_drv.h -@@ -113,7 +113,11 @@ struct ast_private { - struct ttm_bo_kmap_obj cache_kmap; - int next_cursor; - bool support_wide_screen; -- bool DisableP2A; -+ enum { -+ ast_use_p2a, -+ ast_use_dt, -+ ast_use_defaults -+ } config_mode; - - enum ast_tx_chip tx_chip_type; - u8 dp501_maxclk; -diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c -index 6c021165ca67..498a94069e6b 100644 ---- a/drivers/gpu/drm/ast/ast_main.c -+++ b/drivers/gpu/drm/ast/ast_main.c -@@ -62,13 +62,84 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast, - return ret; - } - -+static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev) -+{ -+ struct device_node *np = dev->pdev->dev.of_node; -+ struct ast_private *ast = dev->dev_private; -+ uint32_t data, jregd0, jregd1; -+ -+ /* Defaults */ -+ ast->config_mode = ast_use_defaults; -+ *scu_rev = 0xffffffff; -+ -+ /* Check if we have device-tree properties */ -+ if (np && !of_property_read_u32(np, "aspeed,scu-revision-id", -+ scu_rev)) { -+ /* We do, disable P2A access */ -+ ast->config_mode = ast_use_dt; -+ DRM_INFO("Using device-tree for configuration\n"); -+ return; -+ } -+ -+ /* Not all families have a P2A bridge */ -+ if (dev->pdev->device != PCI_CHIP_AST2000) -+ return; -+ -+ /* -+ * The BMC will set SCU 0x40 D[12] to 1 if the P2 bridge -+ * is disabled. We force using P2A if VGA only mode bit -+ * is set D[7] -+ */ -+ jregd0 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff); -+ jregd1 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd1, 0xff); -+ if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) { -+ /* Double check it's actually working */ -+ data = ast_read32(ast, 0xf004); -+ if (data != 0xFFFFFFFF) { -+ /* P2A works, grab silicon revision */ -+ ast->config_mode = ast_use_p2a; -+ -+ DRM_INFO("Using P2A bridge for configuration\n"); -+ -+ /* Read SCU7c (silicon revision register) */ -+ ast_write32(ast, 0xf004, 0x1e6e0000); -+ ast_write32(ast, 0xf000, 0x1); -+ *scu_rev = ast_read32(ast, 0x1207c); -+ return; -+ } -+ } -+ -+ /* We have a P2A bridge but it's disabled */ -+ DRM_INFO("P2A bridge disabled, using default configuration\n"); -+} - - static int ast_detect_chip(struct drm_device *dev, bool *need_post) - { - struct ast_private *ast = dev->dev_private; -- uint32_t data, jreg; -+ uint32_t jreg, scu_rev; -+ -+ /* -+ * If VGA isn't enabled, we need to enable now or subsequent -+ * access to the scratch registers will fail. We also inform -+ * our caller that it needs to POST the chip -+ * (Assumption: VGA not enabled -> need to POST) -+ */ -+ if (!ast_is_vga_enabled(dev)) { -+ ast_enable_vga(dev); -+ DRM_INFO("VGA not enabled on entry, requesting chip POST\n"); -+ *need_post = true; -+ } else -+ *need_post = false; -+ -+ -+ /* Enable extended register access */ -+ ast_enable_mmio(dev); - ast_open_key(ast); - -+ /* Find out whether P2A works or whether to use device-tree */ -+ ast_detect_config_mode(dev, &scu_rev); -+ -+ /* Identify chipset */ - if (dev->pdev->device == PCI_CHIP_AST1180) { - ast->chip = AST1100; - DRM_INFO("AST 1180 detected\n"); -@@ -80,12 +151,7 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - ast->chip = AST2300; - DRM_INFO("AST 2300 detected\n"); - } else if (dev->pdev->revision >= 0x10) { -- uint32_t data; -- ast_write32(ast, 0xf004, 0x1e6e0000); -- ast_write32(ast, 0xf000, 0x1); -- -- data = ast_read32(ast, 0x1207c); -- switch (data & 0x0300) { -+ switch (scu_rev & 0x0300) { - case 0x0200: - ast->chip = AST1100; - DRM_INFO("AST 1100 detected\n"); -@@ -110,26 +176,6 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - } - } - -- /* -- * If VGA isn't enabled, we need to enable now or subsequent -- * access to the scratch registers will fail. We also inform -- * our caller that it needs to POST the chip -- * (Assumption: VGA not enabled -> need to POST) -- */ -- if (!ast_is_vga_enabled(dev)) { -- ast_enable_vga(dev); -- ast_enable_mmio(dev); -- DRM_INFO("VGA not enabled on entry, requesting chip POST\n"); -- *need_post = true; -- } else -- *need_post = false; -- -- /* Check P2A Access */ -- ast->DisableP2A = true; -- data = ast_read32(ast, 0xf004); -- if (data != 0xFFFFFFFF) -- ast->DisableP2A = false; -- - /* Check if we support wide screen */ - switch (ast->chip) { - case AST1180: -@@ -146,17 +192,12 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - ast->support_wide_screen = true; - else { - ast->support_wide_screen = false; -- if (ast->DisableP2A == false) { -- /* Read SCU7c (silicon revision register) */ -- ast_write32(ast, 0xf004, 0x1e6e0000); -- ast_write32(ast, 0xf000, 0x1); -- data = ast_read32(ast, 0x1207c); -- data &= 0x300; -- if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ -- ast->support_wide_screen = true; -- if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ -- ast->support_wide_screen = true; -- } -+ if (ast->chip == AST2300 && -+ (scu_rev & 0x300) == 0x0) /* ast1300 */ -+ ast->support_wide_screen = true; -+ if (ast->chip == AST2400 && -+ (scu_rev & 0x300) == 0x100) /* ast1400 */ -+ ast->support_wide_screen = true; - } - break; - } -@@ -220,85 +261,102 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) - - static int ast_get_dram_info(struct drm_device *dev) - { -+ struct device_node *np = dev->pdev->dev.of_node; - struct ast_private *ast = dev->dev_private; -- uint32_t data, data2; -- uint32_t denum, num, div, ref_pll; -+ uint32_t mcr_cfg, mcr_scu_mpll, mcr_scu_strap; -+ uint32_t denum, num, div, ref_pll, dsel; - -- if (ast->DisableP2A) -- { -+ switch (ast->config_mode) { -+ case ast_use_dt: -+ /* -+ * If some properties are missing, use reasonable -+ * defaults for AST2400 -+ */ -+ if (of_property_read_u32(np, "aspeed,mcr-configuration", -+ &mcr_cfg)) -+ mcr_cfg = 0x00000577; -+ if (of_property_read_u32(np, "aspeed,mcr-scu-mpll", -+ &mcr_scu_mpll)) -+ mcr_scu_mpll = 0x000050C0; -+ if (of_property_read_u32(np, "aspeed,mcr-scu-strap", -+ &mcr_scu_strap)) -+ mcr_scu_strap = 0; -+ break; -+ case ast_use_p2a: -+ ast_write32(ast, 0xf004, 0x1e6e0000); -+ ast_write32(ast, 0xf000, 0x1); -+ mcr_cfg = ast_read32(ast, 0x10004); -+ mcr_scu_mpll = ast_read32(ast, 0x10120); -+ mcr_scu_strap = ast_read32(ast, 0x10170); -+ break; -+ case ast_use_defaults: -+ default: - ast->dram_bus_width = 16; - ast->dram_type = AST_DRAM_1Gx16; - ast->mclk = 396; -+ return 0; - } -- else -- { -- ast_write32(ast, 0xf004, 0x1e6e0000); -- ast_write32(ast, 0xf000, 0x1); -- data = ast_read32(ast, 0x10004); -- -- if (data & 0x40) -- ast->dram_bus_width = 16; -- else -- ast->dram_bus_width = 32; - -- if (ast->chip == AST2300 || ast->chip == AST2400) { -- switch (data & 0x03) { -- case 0: -- ast->dram_type = AST_DRAM_512Mx16; -- break; -- default: -- case 1: -- ast->dram_type = AST_DRAM_1Gx16; -- break; -- case 2: -- ast->dram_type = AST_DRAM_2Gx16; -- break; -- case 3: -- ast->dram_type = AST_DRAM_4Gx16; -- break; -- } -- } else { -- switch (data & 0x0c) { -- case 0: -- case 4: -- ast->dram_type = AST_DRAM_512Mx16; -- break; -- case 8: -- if (data & 0x40) -- ast->dram_type = AST_DRAM_1Gx16; -- else -- ast->dram_type = AST_DRAM_512Mx32; -- break; -- case 0xc: -- ast->dram_type = AST_DRAM_1Gx32; -- break; -- } -- } -+ if (mcr_cfg & 0x40) -+ ast->dram_bus_width = 16; -+ else -+ ast->dram_bus_width = 32; - -- data = ast_read32(ast, 0x10120); -- data2 = ast_read32(ast, 0x10170); -- if (data2 & 0x2000) -- ref_pll = 14318; -- else -- ref_pll = 12000; -- -- denum = data & 0x1f; -- num = (data & 0x3fe0) >> 5; -- data = (data & 0xc000) >> 14; -- switch (data) { -- case 3: -- div = 0x4; -+ if (ast->chip == AST2300 || ast->chip == AST2400) { -+ switch (mcr_cfg & 0x03) { -+ case 0: -+ ast->dram_type = AST_DRAM_512Mx16; - break; -- case 2: -+ default: - case 1: -- div = 0x2; -+ ast->dram_type = AST_DRAM_1Gx16; - break; -- default: -- div = 0x1; -+ case 2: -+ ast->dram_type = AST_DRAM_2Gx16; -+ break; -+ case 3: -+ ast->dram_type = AST_DRAM_4Gx16; -+ break; -+ } -+ } else { -+ switch (mcr_cfg & 0x0c) { -+ case 0: -+ case 4: -+ ast->dram_type = AST_DRAM_512Mx16; -+ break; -+ case 8: -+ if (mcr_cfg & 0x40) -+ ast->dram_type = AST_DRAM_1Gx16; -+ else -+ ast->dram_type = AST_DRAM_512Mx32; -+ break; -+ case 0xc: -+ ast->dram_type = AST_DRAM_1Gx32; - break; - } -- ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); - } -+ -+ if (mcr_scu_strap & 0x2000) -+ ref_pll = 14318; -+ else -+ ref_pll = 12000; -+ -+ denum = mcr_scu_mpll & 0x1f; -+ num = (mcr_scu_mpll & 0x3fe0) >> 5; -+ dsel = (mcr_scu_mpll & 0xc000) >> 14; -+ switch (dsel) { -+ case 3: -+ div = 0x4; -+ break; -+ case 2: -+ case 1: -+ div = 0x2; -+ break; -+ default: -+ div = 0x1; -+ break; -+ } -+ ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); - return 0; - } - -diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c -index 270e8fb2803f..c7c58becb25d 100644 ---- a/drivers/gpu/drm/ast/ast_post.c -+++ b/drivers/gpu/drm/ast/ast_post.c -@@ -375,17 +375,14 @@ void ast_post_gpu(struct drm_device *dev) - ast_enable_mmio(dev); - ast_set_def_ext_reg(dev); - -- if (ast->DisableP2A == false) -- { -+ if (ast->config_mode == ast_use_p2a) { - if (ast->chip == AST2300 || ast->chip == AST2400) - ast_init_dram_2300(dev); - else - ast_init_dram_reg(dev); - - ast_init_3rdtx(dev); -- } -- else -- { -+ } else { - if (ast->tx_chip_type != AST_TX_NONE) - ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x80); /* Enable DVO */ - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c -index 13db8a2851ed..1f013d45c9e9 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c -@@ -321,6 +321,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man) - list_for_each_entry_safe(entry, next, &man->list, head) - vmw_cmdbuf_res_free(man, entry); - -+ drm_ht_remove(&man->resources); - kfree(man); - } - -diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c -index 0b80633bae91..d4d655a10df1 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.c -+++ b/drivers/hid/i2c-hid/i2c-hid.c -@@ -364,6 +364,15 @@ static int i2c_hid_hwreset(struct i2c_client *client) - if (ret) - return ret; - -+ /* -+ * The HID over I2C specification states that if a DEVICE needs time -+ * after the PWR_ON request, it should utilise CLOCK stretching. -+ * However, it has been observered that the Windows driver provides a -+ * 1ms sleep between the PWR_ON and RESET requests and that some devices -+ * rely on this. -+ */ -+ usleep_range(1000, 5000); -+ - i2c_hid_dbg(ihid, "resetting...\n"); - - ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); -diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c -index 4831eb910fc7..22160e481794 100644 ---- a/drivers/iommu/amd_iommu_v2.c -+++ b/drivers/iommu/amd_iommu_v2.c -@@ -699,9 +699,9 @@ out_clear_state: - - out_unregister: - mmu_notifier_unregister(&pasid_state->mn, mm); -+ mmput(mm); - - out_free: -- mmput(mm); - free_pasid_state(pasid_state); - - out: -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index b92b8a724efb..f9711aceef54 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -1137,7 +1137,7 @@ static void dma_pte_free_level(struct dmar_domain *domain, int level, - if (!dma_pte_present(pte) || dma_pte_superpage(pte)) - goto next; - -- level_pfn = pfn & level_mask(level - 1); -+ level_pfn = pfn & level_mask(level); - level_pte = phys_to_virt(dma_pte_addr(pte)); - - if (level > 2) -diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c -index 515bb8b80952..a070fa39521a 100644 ---- a/drivers/iommu/iommu.c -+++ b/drivers/iommu/iommu.c -@@ -391,36 +391,30 @@ int iommu_group_add_device(struct iommu_group *group, struct device *dev) - device->dev = dev; - - ret = sysfs_create_link(&dev->kobj, &group->kobj, "iommu_group"); -- if (ret) { -- kfree(device); -- return ret; -- } -+ if (ret) -+ goto err_free_device; - - device->name = kasprintf(GFP_KERNEL, "%s", kobject_name(&dev->kobj)); - rename: - if (!device->name) { -- sysfs_remove_link(&dev->kobj, "iommu_group"); -- kfree(device); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto err_remove_link; - } - - ret = sysfs_create_link_nowarn(group->devices_kobj, - &dev->kobj, device->name); - if (ret) { -- kfree(device->name); - if (ret == -EEXIST && i >= 0) { - /* - * Account for the slim chance of collision - * and append an instance to the name. - */ -+ kfree(device->name); - device->name = kasprintf(GFP_KERNEL, "%s.%d", - kobject_name(&dev->kobj), i++); - goto rename; - } -- -- sysfs_remove_link(&dev->kobj, "iommu_group"); -- kfree(device); -- return ret; -+ goto err_free_name; - } - - kobject_get(group->devices_kobj); -@@ -432,8 +426,10 @@ rename: - mutex_lock(&group->mutex); - list_add_tail(&device->list, &group->devices); - if (group->domain) -- __iommu_attach_device(group->domain, dev); -+ ret = __iommu_attach_device(group->domain, dev); - mutex_unlock(&group->mutex); -+ if (ret) -+ goto err_put_group; - - /* Notify any listeners about change to group. */ - blocking_notifier_call_chain(&group->notifier, -@@ -444,6 +440,21 @@ rename: - pr_info("Adding device %s to group %d\n", dev_name(dev), group->id); - - return 0; -+ -+err_put_group: -+ mutex_lock(&group->mutex); -+ list_del(&device->list); -+ mutex_unlock(&group->mutex); -+ dev->iommu_group = NULL; -+ kobject_put(group->devices_kobj); -+err_free_name: -+ kfree(device->name); -+err_remove_link: -+ sysfs_remove_link(&dev->kobj, "iommu_group"); -+err_free_device: -+ kfree(device); -+ pr_err("Failed to add device %s to group %d: %d\n", dev_name(dev), group->id, ret); -+ return ret; - } - EXPORT_SYMBOL_GPL(iommu_group_add_device); - -diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c -index 5abab8800891..9190057535e6 100644 ---- a/drivers/mtd/bcm47xxpart.c -+++ b/drivers/mtd/bcm47xxpart.c -@@ -66,11 +66,13 @@ static const char *bcm47xxpart_trx_data_part_name(struct mtd_info *master, - { - uint32_t buf; - size_t bytes_read; -+ int err; - -- if (mtd_read(master, offset, sizeof(buf), &bytes_read, -- (uint8_t *)&buf) < 0) { -- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", -- offset); -+ err = mtd_read(master, offset, sizeof(buf), &bytes_read, -+ (uint8_t *)&buf); -+ if (err && !mtd_is_bitflip(err)) { -+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", -+ offset, err); - goto out_default; - } - -@@ -95,6 +97,7 @@ static int bcm47xxpart_parse(struct mtd_info *master, - int trx_part = -1; - int last_trx_part = -1; - int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, }; -+ int err; - - /* - * Some really old flashes (like AT45DB*) had smaller erasesize-s, but -@@ -118,8 +121,8 @@ static int bcm47xxpart_parse(struct mtd_info *master, - /* Parse block by block looking for magics */ - for (offset = 0; offset <= master->size - blocksize; - offset += blocksize) { -- /* Nothing more in higher memory */ -- if (offset >= 0x2000000) -+ /* Nothing more in higher memory on BCM47XX (MIPS) */ -+ if (config_enabled(CONFIG_BCM47XX) && offset >= 0x2000000) - break; - - if (curr_part >= BCM47XXPART_MAX_PARTS) { -@@ -128,10 +131,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, - } - - /* Read beginning of the block */ -- if (mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ, -- &bytes_read, (uint8_t *)buf) < 0) { -- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", -- offset); -+ err = mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ, -+ &bytes_read, (uint8_t *)buf); -+ if (err && !mtd_is_bitflip(err)) { -+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", -+ offset, err); - continue; - } - -@@ -252,10 +256,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, - } - - /* Read middle of the block */ -- if (mtd_read(master, offset + 0x8000, 0x4, -- &bytes_read, (uint8_t *)buf) < 0) { -- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", -- offset); -+ err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read, -+ (uint8_t *)buf); -+ if (err && !mtd_is_bitflip(err)) { -+ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", -+ offset, err); - continue; - } - -@@ -275,10 +280,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, - } - - offset = master->size - possible_nvram_sizes[i]; -- if (mtd_read(master, offset, 0x4, &bytes_read, -- (uint8_t *)buf) < 0) { -- pr_err("mtd_read error while reading at offset 0x%X!\n", -- offset); -+ err = mtd_read(master, offset, 0x4, &bytes_read, -+ (uint8_t *)buf); -+ if (err && !mtd_is_bitflip(err)) { -+ pr_err("mtd_read error while reading (offset 0x%X): %d\n", -+ offset, err); - continue; - } - -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -index 5e6238e0b2bd..75e6e7e6baed 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c -@@ -2732,8 +2732,10 @@ static int xgbe_init(struct xgbe_prv_data *pdata) - - /* Flush Tx queues */ - ret = xgbe_flush_tx_queues(pdata); -- if (ret) -+ if (ret) { -+ netdev_err(pdata->netdev, "error flushing TX queues\n"); - return ret; -+ } - - /* - * Initialize DMA related features -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -index 865b7e0b133b..64034ff081a0 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c -@@ -877,7 +877,9 @@ static int xgbe_start(struct xgbe_prv_data *pdata) - - DBGPR("-->xgbe_start\n"); - -- hw_if->init(pdata); -+ ret = hw_if->init(pdata); -+ if (ret) -+ return ret; - - ret = phy_if->phy_start(pdata); - if (ret) -diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c -index b56c9c581359..70da30095b89 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.c -+++ b/drivers/net/ethernet/broadcom/bgmac.c -@@ -255,15 +255,16 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring) - while (ring->start != ring->end) { - int slot_idx = ring->start % BGMAC_TX_RING_SLOTS; - struct bgmac_slot_info *slot = &ring->slots[slot_idx]; -- u32 ctl1; -+ u32 ctl0, ctl1; - int len; - - if (slot_idx == empty_slot) - break; - -+ ctl0 = le32_to_cpu(ring->cpu_base[slot_idx].ctl0); - ctl1 = le32_to_cpu(ring->cpu_base[slot_idx].ctl1); - len = ctl1 & BGMAC_DESC_CTL1_LEN; -- if (ctl1 & BGMAC_DESC_CTL0_SOF) -+ if (ctl0 & BGMAC_DESC_CTL0_SOF) - /* Unmap no longer used buffer */ - dma_unmap_single(dma_dev, slot->dma_addr, len, - DMA_TO_DEVICE); -@@ -469,6 +470,11 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring, - len -= ETH_FCS_LEN; - - skb = build_skb(buf, BGMAC_RX_ALLOC_SIZE); -+ if (unlikely(!skb)) { -+ bgmac_err(bgmac, "build_skb failed\n"); -+ put_page(virt_to_head_page(buf)); -+ break; -+ } - skb_put(skb, BGMAC_RX_FRAME_OFFSET + - BGMAC_RX_BUF_OFFSET + len); - skb_pull(skb, BGMAC_RX_FRAME_OFFSET + -@@ -1302,7 +1308,8 @@ static int bgmac_open(struct net_device *net_dev) - - phy_start(bgmac->phy_dev); - -- netif_carrier_on(net_dev); -+ netif_start_queue(net_dev); -+ - return 0; - } - -diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c -index 1795c935ff02..7b8638ddb673 100644 ---- a/drivers/net/ethernet/emulex/benet/be_cmds.c -+++ b/drivers/net/ethernet/emulex/benet/be_cmds.c -@@ -1052,7 +1052,7 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr, - err: - spin_unlock_bh(&adapter->mcc_lock); - -- if (status == MCC_STATUS_UNAUTHORIZED_REQUEST) -+ if (base_status(status) == MCC_STATUS_UNAUTHORIZED_REQUEST) - status = -EPERM; - - return status; -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 6a061f17a44f..4cd2a7d0124f 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -2939,7 +2939,7 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, - size, GFAR_RXB_TRUESIZE); - - /* try reuse page */ -- if (unlikely(page_count(page) != 1)) -+ if (unlikely(page_count(page) != 1 || page_is_pfmemalloc(page))) - return false; - - /* change offset to the other half */ -diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c -index f9e4988ea30e..2f9b12cf9ee5 100644 ---- a/drivers/net/ethernet/ibm/ibmveth.c -+++ b/drivers/net/ethernet/ibm/ibmveth.c -@@ -1602,8 +1602,11 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) - netdev->netdev_ops = &ibmveth_netdev_ops; - netdev->ethtool_ops = &netdev_ethtool_ops; - SET_NETDEV_DEV(netdev, &dev->dev); -- netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM | -- NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; -+ netdev->hw_features = NETIF_F_SG; -+ if (vio_get_attribute(dev, "ibm,illan-options", NULL) != NULL) { -+ netdev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | -+ NETIF_F_RXCSUM; -+ } - - netdev->features |= netdev->hw_features; - -diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c -index d74f5f4e5782..07eabf72c480 100644 ---- a/drivers/net/ethernet/korina.c -+++ b/drivers/net/ethernet/korina.c -@@ -900,10 +900,10 @@ static void korina_restart_task(struct work_struct *work) - DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR, - &lp->rx_dma_regs->dmasm); - -- korina_free_ring(dev); -- - napi_disable(&lp->napi); - -+ korina_free_ring(dev); -+ - if (korina_init(dev) < 0) { - printk(KERN_ERR "%s: cannot restart device\n", dev->name); - return; -@@ -1064,12 +1064,12 @@ static int korina_close(struct net_device *dev) - tmp = tmp | DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR; - writel(tmp, &lp->rx_dma_regs->dmasm); - -- korina_free_ring(dev); -- - napi_disable(&lp->napi); - - cancel_work_sync(&lp->restart_task); - -+ korina_free_ring(dev); -+ - free_irq(lp->rx_irq, dev); - free_irq(lp->tx_irq, dev); - free_irq(lp->ovr_irq, dev); -diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c -index 603d1c3d3b2e..ff77b8b608bd 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/eq.c -+++ b/drivers/net/ethernet/mellanox/mlx4/eq.c -@@ -542,8 +542,9 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - break; - - case MLX4_EVENT_TYPE_SRQ_LIMIT: -- mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT\n", -- __func__); -+ mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT. srq_no=0x%x, eq 0x%x\n", -+ __func__, be32_to_cpu(eqe->event.srq.srqn), -+ eq->eqn); - case MLX4_EVENT_TYPE_SRQ_CATAS_ERROR: - if (mlx4_is_master(dev)) { - /* forward only to slave owning the SRQ */ -@@ -558,15 +559,19 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) - eq->eqn, eq->cons_index, ret); - break; - } -- mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n", -- __func__, slave, -- be32_to_cpu(eqe->event.srq.srqn), -- eqe->type, eqe->subtype); -+ if (eqe->type == -+ MLX4_EVENT_TYPE_SRQ_CATAS_ERROR) -+ mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n", -+ __func__, slave, -+ be32_to_cpu(eqe->event.srq.srqn), -+ eqe->type, eqe->subtype); - - if (!ret && slave != dev->caps.function) { -- mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n", -- __func__, eqe->type, -- eqe->subtype, slave); -+ if (eqe->type == -+ MLX4_EVENT_TYPE_SRQ_CATAS_ERROR) -+ mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n", -+ __func__, eqe->type, -+ eqe->subtype, slave); - mlx4_slave_event(dev, slave, eqe); - break; - } -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c -index 1e611980cf99..f5c1f4acc57b 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/main.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c -@@ -153,8 +153,9 @@ static struct mlx5_profile profile[] = { - }, - }; - --#define FW_INIT_TIMEOUT_MILI 2000 --#define FW_INIT_WAIT_MS 2 -+#define FW_INIT_TIMEOUT_MILI 2000 -+#define FW_INIT_WAIT_MS 2 -+#define FW_PRE_INIT_TIMEOUT_MILI 10000 - - static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili) - { -@@ -934,6 +935,15 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv) - */ - dev->state = MLX5_DEVICE_STATE_UP; - -+ /* wait for firmware to accept initialization segments configurations -+ */ -+ err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI); -+ if (err) { -+ dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n", -+ FW_PRE_INIT_TIMEOUT_MILI); -+ goto out; -+ } -+ - err = mlx5_cmd_init(dev); - if (err) { - dev_err(&pdev->dev, "Failed initializing command interface, aborting\n"); -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 1e61d4da72db..585e90f8341d 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -221,18 +221,6 @@ static void ravb_ring_free(struct net_device *ndev, int q) - int ring_size; - int i; - -- /* Free RX skb ringbuffer */ -- if (priv->rx_skb[q]) { -- for (i = 0; i < priv->num_rx_ring[q]; i++) -- dev_kfree_skb(priv->rx_skb[q][i]); -- } -- kfree(priv->rx_skb[q]); -- priv->rx_skb[q] = NULL; -- -- /* Free aligned TX buffers */ -- kfree(priv->tx_align[q]); -- priv->tx_align[q] = NULL; -- - if (priv->rx_ring[q]) { - for (i = 0; i < priv->num_rx_ring[q]; i++) { - struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i]; -@@ -261,6 +249,18 @@ static void ravb_ring_free(struct net_device *ndev, int q) - priv->tx_ring[q] = NULL; - } - -+ /* Free RX skb ringbuffer */ -+ if (priv->rx_skb[q]) { -+ for (i = 0; i < priv->num_rx_ring[q]; i++) -+ dev_kfree_skb(priv->rx_skb[q][i]); -+ } -+ kfree(priv->rx_skb[q]); -+ priv->rx_skb[q] = NULL; -+ -+ /* Free aligned TX buffers */ -+ kfree(priv->tx_align[q]); -+ priv->tx_align[q] = NULL; -+ - /* Free TX skb ringbuffer. - * SKBs are freed by ravb_tx_free() call above. - */ -diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c -index d790cb8d9db3..8e832ba8ab24 100644 ---- a/drivers/net/ethernet/sfc/falcon.c -+++ b/drivers/net/ethernet/sfc/falcon.c -@@ -2796,6 +2796,11 @@ const struct efx_nic_type falcon_a1_nic_type = { - .timer_period_max = 1 << FRF_AB_TC_TIMER_VAL_WIDTH, - .offload_features = NETIF_F_IP_CSUM, - .mcdi_max_ver = -1, -+#ifdef CONFIG_SFC_SRIOV -+ .vswitching_probe = efx_port_dummy_op_int, -+ .vswitching_restore = efx_port_dummy_op_int, -+ .vswitching_remove = efx_port_dummy_op_void, -+#endif - }; - - const struct efx_nic_type falcon_b0_nic_type = { -@@ -2897,4 +2902,9 @@ const struct efx_nic_type falcon_b0_nic_type = { - .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE, - .mcdi_max_ver = -1, - .max_rx_ip_filters = FR_BZ_RX_FILTER_TBL0_ROWS, -+#ifdef CONFIG_SFC_SRIOV -+ .vswitching_probe = efx_port_dummy_op_int, -+ .vswitching_restore = efx_port_dummy_op_int, -+ .vswitching_remove = efx_port_dummy_op_void, -+#endif - }; -diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c -index 7f7c87762bc6..8dfc75250583 100644 ---- a/drivers/net/virtio_net.c -+++ b/drivers/net/virtio_net.c -@@ -47,8 +47,16 @@ module_param(gso, bool, 0444); - */ - DECLARE_EWMA(pkt_len, 1, 64) - -+/* With mergeable buffers we align buffer address and use the low bits to -+ * encode its true size. Buffer size is up to 1 page so we need to align to -+ * square root of page size to ensure we reserve enough bits to encode the true -+ * size. -+ */ -+#define MERGEABLE_BUFFER_MIN_ALIGN_SHIFT ((PAGE_SHIFT + 1) / 2) -+ - /* Minimum alignment for mergeable packet buffers. */ --#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, 256) -+#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, \ -+ 1 << MERGEABLE_BUFFER_MIN_ALIGN_SHIFT) - - #define VIRTNET_DRIVER_VERSION "1.0.0" - -diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c -index 9a986ccd42e5..dab3bf6649e6 100644 ---- a/drivers/net/vxlan.c -+++ b/drivers/net/vxlan.c -@@ -2240,7 +2240,7 @@ static void vxlan_cleanup(unsigned long arg) - = container_of(p, struct vxlan_fdb, hlist); - unsigned long timeout; - -- if (f->state & NUD_PERMANENT) -+ if (f->state & (NUD_PERMANENT | NUD_NOARP)) - continue; - - timeout = f->used + vxlan->cfg.age_interval * HZ; -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 888e9cfef51a..34a062ccb11d 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -321,7 +321,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue) - queue->rx.req_prod_pvt = req_prod; - - /* Not enough requests? Try again later. */ -- if (req_prod - queue->rx.rsp_cons < NET_RX_SLOTS_MIN) { -+ if (req_prod - queue->rx.sring->req_prod < NET_RX_SLOTS_MIN) { - mod_timer(&queue->rx_refill_timer, jiffies + (HZ/10)); - return; - } -diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c -index be3bc2f4edd4..09cc64b3b695 100644 ---- a/drivers/platform/x86/ideapad-laptop.c -+++ b/drivers/platform/x86/ideapad-laptop.c -@@ -807,6 +807,7 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data) - case 11: - case 7: - case 6: -+ case 1: - ideapad_input_report(priv, vpc_bit); - break; - case 5: -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 59ced8864b2f..0e6aaef9a038 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -3563,12 +3563,14 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) - } else { - buf_ptr1 = (struct lpfc_dmabuf *) elsiocb->context2; - lpfc_els_free_data(phba, buf_ptr1); -+ elsiocb->context2 = NULL; - } - } - - if (elsiocb->context3) { - buf_ptr = (struct lpfc_dmabuf *) elsiocb->context3; - lpfc_els_free_bpl(phba, buf_ptr); -+ elsiocb->context3 = NULL; - } - lpfc_sli_release_iocbq(phba, elsiocb); - return 0; -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index f5aeda8f014f..38e90d9c2ced 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -5887,18 +5887,25 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba) - - free_vfi_bmask: - kfree(phba->sli4_hba.vfi_bmask); -+ phba->sli4_hba.vfi_bmask = NULL; - free_xri_ids: - kfree(phba->sli4_hba.xri_ids); -+ phba->sli4_hba.xri_ids = NULL; - free_xri_bmask: - kfree(phba->sli4_hba.xri_bmask); -+ phba->sli4_hba.xri_bmask = NULL; - free_vpi_ids: - kfree(phba->vpi_ids); -+ phba->vpi_ids = NULL; - free_vpi_bmask: - kfree(phba->vpi_bmask); -+ phba->vpi_bmask = NULL; - free_rpi_ids: - kfree(phba->sli4_hba.rpi_ids); -+ phba->sli4_hba.rpi_ids = NULL; - free_rpi_bmask: - kfree(phba->sli4_hba.rpi_bmask); -+ phba->sli4_hba.rpi_bmask = NULL; - err_exit: - return rc; - } -diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c -index 0e59731f95ad..1f6a3b86965f 100644 ---- a/drivers/scsi/qla2xxx/qla_isr.c -+++ b/drivers/scsi/qla2xxx/qla_isr.c -@@ -2466,6 +2466,10 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt) - if (pkt->entry_status & RF_BUSY) - res = DID_BUS_BUSY << 16; - -+ if (pkt->entry_type == NOTIFY_ACK_TYPE && -+ pkt->handle == QLA_TGT_SKIP_HANDLE) -+ return; -+ - sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); - if (sp) { - sp->done(ha, sp, res); -diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c -index f57d96984ae4..e6faa0b050d1 100644 ---- a/drivers/scsi/qla2xxx/qla_target.c -+++ b/drivers/scsi/qla2xxx/qla_target.c -@@ -2865,7 +2865,7 @@ static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha, - - pkt->entry_type = NOTIFY_ACK_TYPE; - pkt->entry_count = 1; -- pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK; -+ pkt->handle = QLA_TGT_SKIP_HANDLE; - - nack = (struct nack_to_isp *)pkt; - nack->ox_id = ntfy->ox_id; -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 4d5207dff960..8750c86f95f9 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2566,7 +2566,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer) - if (sdp->broken_fua) { - sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n"); - sdkp->DPOFUA = 0; -- } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { -+ } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw && -+ !sdkp->device->use_16_for_rw) { - sd_first_printk(KERN_NOTICE, sdkp, - "Uses READ/WRITE(6), disabling FUA\n"); - sdkp->DPOFUA = 0; -diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c -index 7dbbb29d24c6..03a2aadf0d3c 100644 ---- a/drivers/scsi/virtio_scsi.c -+++ b/drivers/scsi/virtio_scsi.c -@@ -533,7 +533,9 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi, - { - struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev); - struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc); -+ unsigned long flags; - int req_size; -+ int ret; - - BUG_ON(scsi_sg_count(sc) > shost->sg_tablesize); - -@@ -561,8 +563,15 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi, - req_size = sizeof(cmd->req.cmd); - } - -- if (virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)) != 0) -+ ret = virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)); -+ if (ret == -EIO) { -+ cmd->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET; -+ spin_lock_irqsave(&req_vq->vq_lock, flags); -+ virtscsi_complete_cmd(vscsi, cmd); -+ spin_unlock_irqrestore(&req_vq->vq_lock, flags); -+ } else if (ret != 0) { - return SCSI_MLQUEUE_HOST_BUSY; -+ } - return 0; - } - -diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c -index 7d3af3eacf57..1ddba9ae8c0f 100644 ---- a/drivers/spi/spi-davinci.c -+++ b/drivers/spi/spi-davinci.c -@@ -651,7 +651,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t) - buf = t->rx_buf; - t->rx_dma = dma_map_single(&spi->dev, buf, - t->len, DMA_FROM_DEVICE); -- if (!t->rx_dma) { -+ if (dma_mapping_error(&spi->dev, !t->rx_dma)) { - ret = -EFAULT; - goto err_rx_map; - } -@@ -665,7 +665,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t) - buf = (void *)t->tx_buf; - t->tx_dma = dma_map_single(&spi->dev, buf, - t->len, DMA_TO_DEVICE); -- if (!t->tx_dma) { -+ if (dma_mapping_error(&spi->dev, t->tx_dma)) { - ret = -EFAULT; - goto err_tx_map; - } -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 6d8f865a2fb7..732e6ed5d7b4 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -3463,6 +3463,7 @@ static void ffs_closed(struct ffs_data *ffs) - { - struct ffs_dev *ffs_obj; - struct f_fs_opts *opts; -+ struct config_item *ci; - - ENTER(); - ffs_dev_lock(); -@@ -3486,8 +3487,11 @@ static void ffs_closed(struct ffs_data *ffs) - || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) - goto done; - -- unregister_gadget_item(ffs_obj->opts-> -- func_inst.group.cg_item.ci_parent->ci_parent); -+ ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; -+ ffs_dev_unlock(); -+ -+ unregister_gadget_item(ci); -+ return; - done: - ffs_dev_unlock(); - } -diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c -index 1a9f18b40be6..34e4b3ad8b92 100644 ---- a/drivers/vfio/vfio_iommu_spapr_tce.c -+++ b/drivers/vfio/vfio_iommu_spapr_tce.c -@@ -1163,6 +1163,10 @@ static int tce_iommu_attach_group(void *iommu_data, - /* pr_debug("tce_vfio: Attaching group #%u to iommu %p\n", - iommu_group_id(iommu_group), iommu_group); */ - table_group = iommu_group_get_iommudata(iommu_group); -+ if (!table_group) { -+ ret = -ENODEV; -+ goto unlock_exit; -+ } - - if (tce_groups_attached(container) && (!table_group->ops || - !table_group->ops->take_ownership || -diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c -index e0c98423f2c9..11a72bc2c71b 100644 ---- a/drivers/watchdog/bcm_kona_wdt.c -+++ b/drivers/watchdog/bcm_kona_wdt.c -@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev) - if (!wdt) - return -ENOMEM; - -+ spin_lock_init(&wdt->lock); -+ - res = platform_get_resource(pdev, IORESOURCE_MEM, 0); - wdt->base = devm_ioremap_resource(dev, res); - if (IS_ERR(wdt->base)) -@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev) - return ret; - } - -- spin_lock_init(&wdt->lock); - platform_set_drvdata(pdev, wdt); - watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt); - bcm_kona_wdt_wdd.parent = &pdev->dev; -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 7399782c0998..8a58bbc14de2 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -409,9 +409,9 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page, - if (map == SWIOTLB_MAP_ERROR) - return DMA_ERROR_CODE; - -+ dev_addr = xen_phys_to_bus(map); - xen_dma_map_page(dev, pfn_to_page(map >> PAGE_SHIFT), - dev_addr, map & ~PAGE_MASK, size, dir, attrs); -- dev_addr = xen_phys_to_bus(map); - - /* - * Ensure that the address returned is DMA'ble -@@ -567,13 +567,14 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, - sg_dma_len(sgl) = 0; - return 0; - } -+ dev_addr = xen_phys_to_bus(map); - xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT), - dev_addr, - map & ~PAGE_MASK, - sg->length, - dir, - attrs); -- sg->dma_address = xen_phys_to_bus(map); -+ sg->dma_address = dev_addr; - } else { - /* we are not interested in the dma_addr returned by - * xen_dma_map_page, only in the potential cache flushes executed -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 3a93755e880f..29ef427c0652 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -2295,6 +2295,7 @@ static int elf_core_dump(struct coredump_params *cprm) - goto end_coredump; - } - } -+ dump_truncate(cprm); - - if (!elf_core_write_extra_data(cprm)) - goto end_coredump; -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 863fa0f1972b..a61926cb01c0 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -4397,8 +4397,19 @@ search_again: - if (found_type > min_type) { - del_item = 1; - } else { -- if (item_end < new_size) -+ if (item_end < new_size) { -+ /* -+ * With NO_HOLES mode, for the following mapping -+ * -+ * [0-4k][hole][8k-12k] -+ * -+ * if truncating isize down to 6k, it ends up -+ * isize being 8k. -+ */ -+ if (btrfs_fs_incompat(root->fs_info, NO_HOLES)) -+ last_size = new_size; - break; -+ } - if (found_key.offset >= new_size) - del_item = 1; - else -diff --git a/fs/coredump.c b/fs/coredump.c -index 5d15c4975ba1..a8852293038a 100644 ---- a/fs/coredump.c -+++ b/fs/coredump.c -@@ -810,3 +810,21 @@ int dump_align(struct coredump_params *cprm, int align) - return mod ? dump_skip(cprm, align - mod) : 1; - } - EXPORT_SYMBOL(dump_align); -+ -+/* -+ * Ensures that file size is big enough to contain the current file -+ * postion. This prevents gdb from complaining about a truncated file -+ * if the last "write" to the file was dump_skip. -+ */ -+void dump_truncate(struct coredump_params *cprm) -+{ -+ struct file *file = cprm->file; -+ loff_t offset; -+ -+ if (file->f_op->llseek && file->f_op->llseek != no_llseek) { -+ offset = file->f_op->llseek(file, 0, SEEK_CUR); -+ if (i_size_read(file->f_mapping->host) < offset) -+ do_truncate(file->f_path.dentry, offset, 0, file); -+ } -+} -+EXPORT_SYMBOL(dump_truncate); -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 4e3679b25b9b..8e425f2c5ddd 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -2188,8 +2188,6 @@ static int nfs4_opendata_access(struct rpc_cred *cred, - if ((mask & ~cache.mask & (MAY_READ | MAY_EXEC)) == 0) - return 0; - -- /* even though OPEN succeeded, access is denied. Close the file */ -- nfs4_close_state(state, fmode); - return -EACCES; - } - -diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c -index 709fbbd44c65..acebc350e98d 100644 ---- a/fs/ocfs2/cluster/heartbeat.c -+++ b/fs/ocfs2/cluster/heartbeat.c -@@ -2070,13 +2070,13 @@ unlock: - spin_unlock(&o2hb_live_lock); - } - --static ssize_t o2hb_heartbeat_group_threshold_show(struct config_item *item, -+static ssize_t o2hb_heartbeat_group_dead_threshold_show(struct config_item *item, - char *page) - { - return sprintf(page, "%u\n", o2hb_dead_threshold); - } - --static ssize_t o2hb_heartbeat_group_threshold_store(struct config_item *item, -+static ssize_t o2hb_heartbeat_group_dead_threshold_store(struct config_item *item, - const char *page, size_t count) - { - unsigned long tmp; -@@ -2125,11 +2125,11 @@ static ssize_t o2hb_heartbeat_group_mode_store(struct config_item *item, - - } - --CONFIGFS_ATTR(o2hb_heartbeat_group_, threshold); -+CONFIGFS_ATTR(o2hb_heartbeat_group_, dead_threshold); - CONFIGFS_ATTR(o2hb_heartbeat_group_, mode); - - static struct configfs_attribute *o2hb_heartbeat_group_attrs[] = { -- &o2hb_heartbeat_group_attr_threshold, -+ &o2hb_heartbeat_group_attr_dead_threshold, - &o2hb_heartbeat_group_attr_mode, - NULL, - }; -diff --git a/include/linux/coredump.h b/include/linux/coredump.h -index d016a121a8c4..28ffa94aed6b 100644 ---- a/include/linux/coredump.h -+++ b/include/linux/coredump.h -@@ -14,6 +14,7 @@ struct coredump_params; - extern int dump_skip(struct coredump_params *cprm, size_t nr); - extern int dump_emit(struct coredump_params *cprm, const void *addr, int nr); - extern int dump_align(struct coredump_params *cprm, int align); -+extern void dump_truncate(struct coredump_params *cprm); - #ifdef CONFIG_COREDUMP - extern void do_coredump(const siginfo_t *siginfo); - #else -diff --git a/include/net/xfrm.h b/include/net/xfrm.h -index d6f6e5006ee9..185fb037b332 100644 ---- a/include/net/xfrm.h -+++ b/include/net/xfrm.h -@@ -948,10 +948,6 @@ struct xfrm_dst { - struct flow_cache_object flo; - struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; - int num_pols, num_xfrms; --#ifdef CONFIG_XFRM_SUB_POLICY -- struct flowi *origin; -- struct xfrm_selector *partner; --#endif - u32 xfrm_genid; - u32 policy_genid; - u32 route_mtu_cached; -@@ -967,12 +963,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) - dst_release(xdst->route); - if (likely(xdst->u.dst.xfrm)) - xfrm_state_put(xdst->u.dst.xfrm); --#ifdef CONFIG_XFRM_SUB_POLICY -- kfree(xdst->origin); -- xdst->origin = NULL; -- kfree(xdst->partner); -- xdst->partner = NULL; --#endif - } - #endif - -diff --git a/kernel/panic.c b/kernel/panic.c -index 41e2b54f36b5..1d07cf9af849 100644 ---- a/kernel/panic.c -+++ b/kernel/panic.c -@@ -167,7 +167,7 @@ void panic(const char *fmt, ...) - * Delay timeout seconds before rebooting the machine. - * We can't use the "normal" timers since we just panicked. - */ -- pr_emerg("Rebooting in %d seconds..", panic_timeout); -+ pr_emerg("Rebooting in %d seconds..\n", panic_timeout); - - for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) { - touch_nmi_watchdog(); -diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c -index b0b93fd33af9..f8e8d68ed3fd 100644 ---- a/kernel/sched/loadavg.c -+++ b/kernel/sched/loadavg.c -@@ -201,8 +201,9 @@ void calc_load_exit_idle(void) - struct rq *this_rq = this_rq(); - - /* -- * If we're still before the sample window, we're done. -+ * If we're still before the pending sample window, we're done. - */ -+ this_rq->calc_load_update = calc_load_update; - if (time_before(jiffies, this_rq->calc_load_update)) - return; - -@@ -211,7 +212,6 @@ void calc_load_exit_idle(void) - * accounted through the nohz accounting, so skip the entire deal and - * sync up for the next window. - */ -- this_rq->calc_load_update = calc_load_update; - if (time_before(jiffies, this_rq->calc_load_update + 10)) - this_rq->calc_load_update += LOAD_FREQ; - } -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 300d64162aff..464a7864e4c5 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -174,7 +174,7 @@ extern int no_unaligned_warning; - #define SYSCTL_WRITES_WARN 0 - #define SYSCTL_WRITES_STRICT 1 - --static int sysctl_writes_strict = SYSCTL_WRITES_WARN; -+static int sysctl_writes_strict = SYSCTL_WRITES_STRICT; - - static int proc_do_cad_pid(struct ctl_table *table, int write, - void __user *buffer, size_t *lenp, loff_t *ppos); -diff --git a/lib/swiotlb.c b/lib/swiotlb.c -index 76f29ecba8f4..771234d050c7 100644 ---- a/lib/swiotlb.c -+++ b/lib/swiotlb.c -@@ -452,11 +452,11 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, - : 1UL << (BITS_PER_LONG - IO_TLB_SHIFT); - - /* -- * For mappings greater than a page, we limit the stride (and -- * hence alignment) to a page size. -+ * For mappings greater than or equal to a page, we limit the stride -+ * (and hence alignment) to a page size. - */ - nslots = ALIGN(size, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT; -- if (size > PAGE_SIZE) -+ if (size >= PAGE_SIZE) - stride = (1 << (PAGE_SHIFT - IO_TLB_SHIFT)); - else - stride = 1; -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 47b469663822..6c6f5ccfcda1 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1363,8 +1363,11 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, - */ - if (unlikely(pmd_trans_migrating(*pmdp))) { - page = pmd_page(*pmdp); -+ if (!get_page_unless_zero(page)) -+ goto out_unlock; - spin_unlock(ptl); - wait_on_page_locked(page); -+ put_page(page); - goto out; - } - -@@ -1396,8 +1399,11 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, - - /* Migration could have started since the pmd_trans_migrating check */ - if (!page_locked) { -+ if (!get_page_unless_zero(page)) -+ goto out_unlock; - spin_unlock(ptl); - wait_on_page_locked(page); -+ put_page(page); - page_nid = -1; - goto out; - } -diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c -index 40dd0f9b00d6..09f733b0424a 100644 ---- a/mm/swap_cgroup.c -+++ b/mm/swap_cgroup.c -@@ -205,6 +205,8 @@ void swap_cgroup_swapoff(int type) - struct page *page = map[i]; - if (page) - __free_page(page); -+ if (!(i % SWAP_CLUSTER_MAX)) -+ cond_resched(); - } - vfree(map); - } -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index ad8d6e6b87ca..e20ae2d3c498 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -278,7 +278,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id) - return 0; - - out_free_newdev: -- free_netdev(new_dev); -+ if (new_dev->reg_state == NETREG_UNINITIALIZED) -+ free_netdev(new_dev); - return err; - } - -diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c -index 59ce1fcc220c..71b6ab240dea 100644 ---- a/net/caif/cfpkt_skbuff.c -+++ b/net/caif/cfpkt_skbuff.c -@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx) - { - struct sk_buff *skb; - -- if (likely(in_interrupt())) -- skb = alloc_skb(len + pfx, GFP_ATOMIC); -- else -- skb = alloc_skb(len + pfx, GFP_KERNEL); -- -+ skb = alloc_skb(len + pfx, GFP_ATOMIC); - if (unlikely(skb == NULL)) - return NULL; - -diff --git a/net/core/dev.c b/net/core/dev.c -index 87b8754f34ac..524d8b28e690 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1246,8 +1246,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len) - if (!new_ifalias) - return -ENOMEM; - dev->ifalias = new_ifalias; -+ memcpy(dev->ifalias, alias, len); -+ dev->ifalias[len] = 0; - -- strlcpy(dev->ifalias, alias, len+1); - return len; - } - -diff --git a/net/core/dst.c b/net/core/dst.c -index d7ad628bf64e..e72d706f8d0c 100644 ---- a/net/core/dst.c -+++ b/net/core/dst.c -@@ -462,6 +462,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event, - spin_lock_bh(&dst_garbage.lock); - dst = dst_garbage.list; - dst_garbage.list = NULL; -+ /* The code in dst_ifdown places a hold on the loopback device. -+ * If the gc entry processing is set to expire after a lengthy -+ * interval, this hold can cause netdev_wait_allrefs() to hang -+ * out and wait for a long time -- until the the loopback -+ * interface is released. If we're really unlucky, it'll emit -+ * pr_emerg messages to console too. Reset the interval here, -+ * so dst cleanups occur in a more timely fashion. -+ */ -+ if (dst_garbage.timer_inc > DST_GC_INC) { -+ dst_garbage.timer_inc = DST_GC_INC; -+ dst_garbage.timer_expires = DST_GC_MIN; -+ mod_delayed_work(system_wq, &dst_gc_work, -+ dst_garbage.timer_expires); -+ } - spin_unlock_bh(&dst_garbage.lock); - - if (last) -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index d43544ce7550..2ec5324a7ff7 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -897,6 +897,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, - + nla_total_size(1) /* IFLA_LINKMODE */ - + nla_total_size(4) /* IFLA_CARRIER_CHANGES */ - + nla_total_size(4) /* IFLA_LINK_NETNSID */ -+ + nla_total_size(4) /* IFLA_GROUP */ - + nla_total_size(ext_filter_mask - & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */ - + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */ -@@ -1089,6 +1090,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, - struct ifla_vf_mac vf_mac; - struct ifla_vf_info ivi; - -+ memset(&ivi, 0, sizeof(ivi)); -+ - /* Not all SR-IOV capable drivers support the - * spoofcheck and "RSS query enable" query. Preset to - * -1 so the user space tool can detect that the driver -@@ -1097,7 +1100,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, - ivi.spoofchk = -1; - ivi.rss_query_en = -1; - ivi.trusted = -1; -- memset(ivi.mac, 0, sizeof(ivi.mac)); - /* The default value for VF link state is "auto" - * IFLA_VF_LINK_STATE_AUTO which equals zero - */ -@@ -1370,6 +1372,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = { - [IFLA_PHYS_SWITCH_ID] = { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN }, - [IFLA_LINK_NETNSID] = { .type = NLA_S32 }, - [IFLA_PROTO_DOWN] = { .type = NLA_U8 }, -+ [IFLA_GROUP] = { .type = NLA_U32 }, - }; - - static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { -diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c -index b1dc096d22f8..403593bd2b83 100644 ---- a/net/decnet/dn_route.c -+++ b/net/decnet/dn_route.c -@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt) - call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free); - } - --static inline void dnrt_drop(struct dn_route *rt) --{ -- dst_release(&rt->dst); -- call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free); --} -- - static void dn_dst_check_expire(unsigned long dummy) - { - int i; -@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops) - } - *rtp = rt->dst.dn_next; - rt->dst.dn_next = NULL; -- dnrt_drop(rt); -+ dnrt_free(rt); - break; - } - spin_unlock_bh(&dn_rt_hash_table[i].lock); -@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou - dst_use(&rth->dst, now); - spin_unlock_bh(&dn_rt_hash_table[hash].lock); - -- dnrt_drop(rt); -+ dst_free(&rt->dst); - *rp = rth; - return 0; - } -@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy) - for(; rt; rt = next) { - next = rcu_dereference_raw(rt->dst.dn_next); - RCU_INIT_POINTER(rt->dst.dn_next, NULL); -- dst_free((struct dst_entry *)rt); -+ dnrt_free(rt); - } - - nothing_to_declare: -@@ -1187,7 +1181,7 @@ make_route: - if (dev_out->flags & IFF_LOOPBACK) - flags |= RTCF_LOCAL; - -- rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST); -+ rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST); - if (rt == NULL) - goto e_nobufs; - -diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c -index 85f2fdc360c2..29246bc9a7b4 100644 ---- a/net/decnet/netfilter/dn_rtmsg.c -+++ b/net/decnet/netfilter/dn_rtmsg.c -@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) - { - struct nlmsghdr *nlh = nlmsg_hdr(skb); - -- if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) -+ if (skb->len < sizeof(*nlh) || -+ nlh->nlmsg_len < sizeof(*nlh) || -+ skb->len < nlh->nlmsg_len) - return; - - if (!netlink_capable(skb, CAP_NET_ADMIN)) -diff --git a/net/dsa/slave.c b/net/dsa/slave.c -index 8dfe9fb7ad36..554c2a961ad5 100644 ---- a/net/dsa/slave.c -+++ b/net/dsa/slave.c -@@ -1006,10 +1006,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p, - /* Use already configured phy mode */ - if (p->phy_interface == PHY_INTERFACE_MODE_NA) - p->phy_interface = p->phy->interface; -- phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, -- p->phy_interface); -- -- return 0; -+ return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, -+ p->phy_interface); - } - - static int dsa_slave_phy_setup(struct dsa_slave_priv *p, -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index 17adfdaf5795..3809d523d012 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -1102,6 +1102,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im) - pmc = kzalloc(sizeof(*pmc), GFP_KERNEL); - if (!pmc) - return; -+ spin_lock_init(&pmc->lock); - spin_lock_bh(&im->lock); - pmc->interface = im->interface; - in_dev_hold(in_dev); -@@ -2026,21 +2027,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode, - - static void ip_mc_clear_src(struct ip_mc_list *pmc) - { -- struct ip_sf_list *psf, *nextpsf; -+ struct ip_sf_list *psf, *nextpsf, *tomb, *sources; - -- for (psf = pmc->tomb; psf; psf = nextpsf) { -+ spin_lock_bh(&pmc->lock); -+ tomb = pmc->tomb; -+ pmc->tomb = NULL; -+ sources = pmc->sources; -+ pmc->sources = NULL; -+ pmc->sfmode = MCAST_EXCLUDE; -+ pmc->sfcount[MCAST_INCLUDE] = 0; -+ pmc->sfcount[MCAST_EXCLUDE] = 1; -+ spin_unlock_bh(&pmc->lock); -+ -+ for (psf = tomb; psf; psf = nextpsf) { - nextpsf = psf->sf_next; - kfree(psf); - } -- pmc->tomb = NULL; -- for (psf = pmc->sources; psf; psf = nextpsf) { -+ for (psf = sources; psf; psf = nextpsf) { - nextpsf = psf->sf_next; - kfree(psf); - } -- pmc->sources = NULL; -- pmc->sfmode = MCAST_EXCLUDE; -- pmc->sfcount[MCAST_INCLUDE] = 0; -- pmc->sfcount[MCAST_EXCLUDE] = 1; - } - - /* Join a multicast group -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 8cf3fc7c2932..03dadbf6cc5e 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -291,9 +291,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev, - static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp, - unsigned long delay) - { -- if (!delayed_work_pending(&ifp->dad_work)) -- in6_ifa_hold(ifp); -- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); -+ in6_ifa_hold(ifp); -+ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay)) -+ in6_ifa_put(ifp); - } - - static int snmp6_alloc_dev(struct inet6_dev *idev) -diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c -index ed33abf57abd..9ac4f0cef27d 100644 ---- a/net/ipv6/fib6_rules.c -+++ b/net/ipv6/fib6_rules.c -@@ -32,7 +32,6 @@ struct fib6_rule { - struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, - int flags, pol_lookup_t lookup) - { -- struct rt6_info *rt; - struct fib_lookup_arg arg = { - .lookup_ptr = lookup, - .flags = FIB_LOOKUP_NOREF, -@@ -41,21 +40,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, - fib_rules_lookup(net->ipv6.fib6_rules_ops, - flowi6_to_flowi(fl6), flags, &arg); - -- rt = arg.result; -+ if (arg.result) -+ return arg.result; - -- if (!rt) { -- dst_hold(&net->ipv6.ip6_null_entry->dst); -- return &net->ipv6.ip6_null_entry->dst; -- } -- -- if (rt->rt6i_flags & RTF_REJECT && -- rt->dst.error == -EAGAIN) { -- ip6_rt_put(rt); -- rt = net->ipv6.ip6_null_entry; -- dst_hold(&rt->dst); -- } -- -- return &rt->dst; -+ dst_hold(&net->ipv6.ip6_null_entry->dst); -+ return &net->ipv6.ip6_null_entry->dst; - } - - static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, -@@ -116,7 +105,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, - flp6->saddr = saddr; - } - err = rt->dst.error; -- goto out; -+ if (err != -EAGAIN) -+ goto out; - } - again: - ip6_rt_put(rt); -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 85bf86458706..1ac06723f0d7 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -290,8 +290,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, - struct rt6_info *rt; - - rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags); -- if (rt->rt6i_flags & RTF_REJECT && -- rt->dst.error == -EAGAIN) { -+ if (rt->dst.error == -EAGAIN) { - ip6_rt_put(rt); - rt = net->ipv6.ip6_null_entry; - dst_hold(&rt->dst); -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 19c0d67ce8c4..7d339fc1057f 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1005,8 +1005,10 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, - } - #endif - if (ipv6_addr_v4mapped(&fl6->saddr) && -- !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) -- return -EAFNOSUPPORT; -+ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) { -+ err = -EAFNOSUPPORT; -+ goto out_err_release; -+ } - - return 0; - -diff --git a/net/key/af_key.c b/net/key/af_key.c -index f9c9ecb0cdd3..e67c28e614b9 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, - goto out; - } - -+ err = -ENOBUFS; - key = ext_hdrs[SADB_EXT_KEY_AUTH - 1]; - if (sa->sadb_sa_auth) { - int keysize = 0; -@@ -1146,8 +1147,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, - if (key) - keysize = (key->sadb_key_bits + 7) / 8; - x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL); -- if (!x->aalg) -+ if (!x->aalg) { -+ err = -ENOMEM; - goto out; -+ } - strcpy(x->aalg->alg_name, a->name); - x->aalg->alg_key_len = 0; - if (key) { -@@ -1166,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, - goto out; - } - x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL); -- if (!x->calg) -+ if (!x->calg) { -+ err = -ENOMEM; - goto out; -+ } - strcpy(x->calg->alg_name, a->name); - x->props.calgo = sa->sadb_sa_encrypt; - } else { -@@ -1181,8 +1186,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, - if (key) - keysize = (key->sadb_key_bits + 7) / 8; - x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL); -- if (!x->ealg) -+ if (!x->ealg) { -+ err = -ENOMEM; - goto out; -+ } - strcpy(x->ealg->alg_name, a->name); - x->ealg->alg_key_len = 0; - if (key) { -@@ -1227,8 +1234,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, - struct xfrm_encap_tmpl *natt; - - x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); -- if (!x->encap) -+ if (!x->encap) { -+ err = -ENOMEM; - goto out; -+ } - - natt = x->encap; - n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]; -diff --git a/net/mac80211/main.c b/net/mac80211/main.c -index 175ffcf7fb06..2ee53dc1ddf7 100644 ---- a/net/mac80211/main.c -+++ b/net/mac80211/main.c -@@ -891,12 +891,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) - supp_ht = supp_ht || sband->ht_cap.ht_supported; - supp_vht = supp_vht || sband->vht_cap.vht_supported; - -- if (sband->ht_cap.ht_supported) -- local->rx_chains = -- max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs), -- local->rx_chains); -+ if (!sband->ht_cap.ht_supported) -+ continue; - - /* TODO: consider VHT for RX chains, hopefully it's the same */ -+ local->rx_chains = -+ max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs), -+ local->rx_chains); -+ -+ /* no need to mask, SM_PS_DISABLED has all bits set */ -+ sband->ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED << -+ IEEE80211_HT_CAP_SM_PS_SHIFT; - } - - /* if low-level driver supports AP, we also support VLAN */ -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index 9f5272968abb..e565b2becb14 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -45,6 +45,8 @@ - #include - #include - #include -+#include -+#include - #ifdef CONFIG_NF_NAT_NEEDED - #include - #include -@@ -1798,6 +1800,8 @@ ctnetlink_create_conntrack(struct net *net, - nf_ct_tstamp_ext_add(ct, GFP_ATOMIC); - nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC); - nf_ct_labels_ext_add(ct); -+ nfct_seqadj_ext_add(ct); -+ nfct_synproxy_ext_add(ct); - - /* we must add conntrack extensions before confirmation. */ - ct->status |= IPS_CONFIRMED; -diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c -index b7c43def0dc6..00f798b20b20 100644 ---- a/net/netfilter/xt_TCPMSS.c -+++ b/net/netfilter/xt_TCPMSS.c -@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb, - tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); - tcp_hdrlen = tcph->doff * 4; - -- if (len < tcp_hdrlen) -+ if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr)) - return -1; - - if (info->mss == XT_TCPMSS_CLAMP_PMTU) { -@@ -156,6 +156,10 @@ tcpmss_mangle_packet(struct sk_buff *skb, - if (len > tcp_hdrlen) - return 0; - -+ /* tcph->doff has 4 bits, do not wrap it to 0 */ -+ if (tcp_hdrlen >= 15 * 4) -+ return 0; -+ - /* - * MSS Option not found ?! add it.. - */ -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 956141b71619..3ebf3b652d60 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -239,7 +239,7 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk, - union sctp_addr *laddr = (union sctp_addr *)addr; - struct sctp_transport *transport; - -- if (sctp_verify_addr(sk, laddr, af->sockaddr_len)) -+ if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len)) - return NULL; - - addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep, -diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c -index b2e934ff2448..e05ec54ac53f 100644 ---- a/net/unix/af_unix.c -+++ b/net/unix/af_unix.c -@@ -997,7 +997,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - struct path path = { NULL, NULL }; - - err = -EINVAL; -- if (sunaddr->sun_family != AF_UNIX) -+ if (addr_len < offsetofend(struct sockaddr_un, sun_family) || -+ sunaddr->sun_family != AF_UNIX) - goto out; - - if (addr_len == sizeof(short)) { -@@ -1108,6 +1109,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, - unsigned int hash; - int err; - -+ err = -EINVAL; -+ if (alen < offsetofend(struct sockaddr, sa_family)) -+ goto out; -+ - if (addr->sa_family != AF_UNSPEC) { - err = unix_mkname(sunaddr, alen, &hash); - if (err < 0) -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 36a50ef9295d..8a0fdd870395 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1776,43 +1776,6 @@ free_dst: - goto out; - } - --#ifdef CONFIG_XFRM_SUB_POLICY --static int xfrm_dst_alloc_copy(void **target, const void *src, int size) --{ -- if (!*target) { -- *target = kmalloc(size, GFP_ATOMIC); -- if (!*target) -- return -ENOMEM; -- } -- -- memcpy(*target, src, size); -- return 0; --} --#endif -- --static int xfrm_dst_update_parent(struct dst_entry *dst, -- const struct xfrm_selector *sel) --{ --#ifdef CONFIG_XFRM_SUB_POLICY -- struct xfrm_dst *xdst = (struct xfrm_dst *)dst; -- return xfrm_dst_alloc_copy((void **)&(xdst->partner), -- sel, sizeof(*sel)); --#else -- return 0; --#endif --} -- --static int xfrm_dst_update_origin(struct dst_entry *dst, -- const struct flowi *fl) --{ --#ifdef CONFIG_XFRM_SUB_POLICY -- struct xfrm_dst *xdst = (struct xfrm_dst *)dst; -- return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl)); --#else -- return 0; --#endif --} -- - static int xfrm_expand_policies(const struct flowi *fl, u16 family, - struct xfrm_policy **pols, - int *num_pols, int *num_xfrms) -@@ -1884,16 +1847,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, - - xdst = (struct xfrm_dst *)dst; - xdst->num_xfrms = err; -- if (num_pols > 1) -- err = xfrm_dst_update_parent(dst, &pols[1]->selector); -- else -- err = xfrm_dst_update_origin(dst, fl); -- if (unlikely(err)) { -- dst_free(dst); -- XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); -- return ERR_PTR(err); -- } -- - xdst->num_pols = num_pols; - memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols); - xdst->policy_genid = atomic_read(&pols[0]->genid); -diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h -index 373fcad840ea..776dffa88aee 100644 ---- a/sound/pci/hda/hda_codec.h -+++ b/sound/pci/hda/hda_codec.h -@@ -294,6 +294,8 @@ struct hda_codec { - - #define list_for_each_codec(c, bus) \ - list_for_each_entry(c, &(bus)->core.codec_list, core.list) -+#define list_for_each_codec_safe(c, n, bus) \ -+ list_for_each_entry_safe(c, n, &(bus)->core.codec_list, core.list) - - /* snd_hda_codec_read/write optional flags */ - #define HDA_RW_NO_RESPONSE_FALLBACK (1 << 0) -diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c -index 5baf8b56b6e7..9c6e10fb479f 100644 ---- a/sound/pci/hda/hda_controller.c -+++ b/sound/pci/hda/hda_controller.c -@@ -1128,8 +1128,12 @@ EXPORT_SYMBOL_GPL(azx_probe_codecs); - /* configure each codec instance */ - int azx_codec_configure(struct azx *chip) - { -- struct hda_codec *codec; -- list_for_each_codec(codec, &chip->bus) { -+ struct hda_codec *codec, *next; -+ -+ /* use _safe version here since snd_hda_codec_configure() deregisters -+ * the device upon error and deletes itself from the bus list. -+ */ -+ list_for_each_codec_safe(codec, next, &chip->bus) { - snd_hda_codec_configure(codec); - } - return 0; -diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c -index dc2fa576d60d..689df78f640a 100644 ---- a/sound/pci/hda/hda_generic.c -+++ b/sound/pci/hda/hda_generic.c -@@ -3190,6 +3190,7 @@ static int check_dyn_adc_switch(struct hda_codec *codec) - spec->input_paths[i][nums]); - spec->input_paths[i][nums] = - spec->input_paths[i][n]; -+ spec->input_paths[i][n] = 0; - } - } - nums++; -diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c -index 05012bb178d7..fdd87c7e3e91 100644 ---- a/tools/perf/util/probe-finder.c -+++ b/tools/perf/util/probe-finder.c -@@ -1460,16 +1460,12 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, - Dwarf_Addr _addr = 0, baseaddr = 0; - const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp; - int baseline = 0, lineno = 0, ret = 0; -- bool reloc = false; - --retry: -+ /* We always need to relocate the address for aranges */ -+ if (debuginfo__get_text_offset(dbg, &baseaddr) == 0) -+ addr += baseaddr; - /* Find cu die */ - if (!dwarf_addrdie(dbg->dbg, (Dwarf_Addr)addr, &cudie)) { -- if (!reloc && debuginfo__get_text_offset(dbg, &baseaddr) == 0) { -- addr += baseaddr; -- reloc = true; -- goto retry; -- } - pr_warning("Failed to find debug information for address %lx\n", - addr); - ret = -EINVAL; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.76-77.patch b/patch/kernel/mvebu64-default/03-patch-4.4.76-77.patch deleted file mode 100644 index 4a32231ad2d3..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.76-77.patch +++ /dev/null @@ -1,1575 +0,0 @@ -diff --git a/Makefile b/Makefile -index 902ab134446e..bf49a61d02e2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 76 -+SUBLEVEL = 77 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/include/asm/pat.h b/arch/x86/include/asm/pat.h -index 0b1ff4c1c14e..fffb2794dd89 100644 ---- a/arch/x86/include/asm/pat.h -+++ b/arch/x86/include/asm/pat.h -@@ -7,6 +7,7 @@ - bool pat_enabled(void); - void pat_disable(const char *reason); - extern void pat_init(void); -+extern void init_cache_modes(void); - - extern int reserve_memtype(u64 start, u64 end, - enum page_cache_mode req_pcm, enum page_cache_mode *ret_pcm); -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index d2bbe343fda7..e67b834279b2 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -1048,6 +1048,13 @@ void __init setup_arch(char **cmdline_p) - if (mtrr_trim_uncached_memory(max_pfn)) - max_pfn = e820_end_of_ram_pfn(); - -+ /* -+ * This call is required when the CPU does not support PAT. If -+ * mtrr_bp_init() invoked it already via pat_init() the call has no -+ * effect. -+ */ -+ init_cache_modes(); -+ - #ifdef CONFIG_X86_32 - /* max_low_pfn get updated here */ - find_low_pfn_range(); -diff --git a/arch/x86/lib/copy_user_64.S b/arch/x86/lib/copy_user_64.S -index 27f89c79a44b..423644c230e7 100644 ---- a/arch/x86/lib/copy_user_64.S -+++ b/arch/x86/lib/copy_user_64.S -@@ -80,7 +80,7 @@ ENTRY(copy_user_generic_unrolled) - movl %edx,%ecx - andl $63,%edx - shrl $6,%ecx -- jz 17f -+ jz .L_copy_short_string - 1: movq (%rsi),%r8 - 2: movq 1*8(%rsi),%r9 - 3: movq 2*8(%rsi),%r10 -@@ -101,7 +101,8 @@ ENTRY(copy_user_generic_unrolled) - leaq 64(%rdi),%rdi - decl %ecx - jnz 1b --17: movl %edx,%ecx -+.L_copy_short_string: -+ movl %edx,%ecx - andl $7,%edx - shrl $3,%ecx - jz 20f -@@ -215,6 +216,8 @@ ENDPROC(copy_user_generic_string) - */ - ENTRY(copy_user_enhanced_fast_string) - ASM_STAC -+ cmpl $64,%edx -+ jb .L_copy_short_string /* less then 64 bytes, avoid the costly 'rep' */ - movl %edx,%ecx - 1: rep - movsb -diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c -index 6ad687d104ca..3f1bb4f93a5a 100644 ---- a/arch/x86/mm/pat.c -+++ b/arch/x86/mm/pat.c -@@ -36,14 +36,14 @@ - #undef pr_fmt - #define pr_fmt(fmt) "" fmt - --static bool boot_cpu_done; -- --static int __read_mostly __pat_enabled = IS_ENABLED(CONFIG_X86_PAT); --static void init_cache_modes(void); -+static bool __read_mostly boot_cpu_done; -+static bool __read_mostly pat_disabled = !IS_ENABLED(CONFIG_X86_PAT); -+static bool __read_mostly pat_initialized; -+static bool __read_mostly init_cm_done; - - void pat_disable(const char *reason) - { -- if (!__pat_enabled) -+ if (pat_disabled) - return; - - if (boot_cpu_done) { -@@ -51,10 +51,8 @@ void pat_disable(const char *reason) - return; - } - -- __pat_enabled = 0; -+ pat_disabled = true; - pr_info("x86/PAT: %s\n", reason); -- -- init_cache_modes(); - } - - static int __init nopat(char *str) -@@ -66,7 +64,7 @@ early_param("nopat", nopat); - - bool pat_enabled(void) - { -- return !!__pat_enabled; -+ return pat_initialized; - } - EXPORT_SYMBOL_GPL(pat_enabled); - -@@ -204,6 +202,8 @@ static void __init_cache_modes(u64 pat) - update_cache_mode_entry(i, cache); - } - pr_info("x86/PAT: Configuration [0-7]: %s\n", pat_msg); -+ -+ init_cm_done = true; - } - - #define PAT(x, y) ((u64)PAT_ ## y << ((x)*8)) -@@ -224,6 +224,7 @@ static void pat_bsp_init(u64 pat) - } - - wrmsrl(MSR_IA32_CR_PAT, pat); -+ pat_initialized = true; - - __init_cache_modes(pat); - } -@@ -241,10 +242,9 @@ static void pat_ap_init(u64 pat) - wrmsrl(MSR_IA32_CR_PAT, pat); - } - --static void init_cache_modes(void) -+void init_cache_modes(void) - { - u64 pat = 0; -- static int init_cm_done; - - if (init_cm_done) - return; -@@ -286,8 +286,6 @@ static void init_cache_modes(void) - } - - __init_cache_modes(pat); -- -- init_cm_done = 1; - } - - /** -@@ -305,10 +303,8 @@ void pat_init(void) - u64 pat; - struct cpuinfo_x86 *c = &boot_cpu_data; - -- if (!pat_enabled()) { -- init_cache_modes(); -+ if (pat_disabled) - return; -- } - - if ((c->x86_vendor == X86_VENDOR_INTEL) && - (((c->x86 == 0x6) && (c->x86_model <= 0xd)) || -diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c -index 0c2fae8d929d..73eb7fd4aec4 100644 ---- a/arch/x86/tools/relocs.c -+++ b/arch/x86/tools/relocs.c -@@ -992,11 +992,12 @@ static void emit_relocs(int as_text, int use_real_mode) - die("Segment relocations found but --realmode not specified\n"); - - /* Order the relocations for more efficient processing */ -- sort_relocs(&relocs16); - sort_relocs(&relocs32); - #if ELF_BITS == 64 - sort_relocs(&relocs32neg); - sort_relocs(&relocs64); -+#else -+ sort_relocs(&relocs16); - #endif - - /* Print the relocations */ -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index ba66330cea67..cb4ad6e98b28 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -807,7 +807,7 @@ static ssize_t driver_override_store(struct device *dev, - const char *buf, size_t count) - { - struct platform_device *pdev = to_platform_device(dev); -- char *driver_override, *old = pdev->driver_override, *cp; -+ char *driver_override, *old, *cp; - - if (count > PATH_MAX) - return -EINVAL; -@@ -820,12 +820,15 @@ static ssize_t driver_override_store(struct device *dev, - if (cp) - *cp = '\0'; - -+ device_lock(dev); -+ old = pdev->driver_override; - if (strlen(driver_override)) { - pdev->driver_override = driver_override; - } else { - kfree(driver_override); - pdev->driver_override = NULL; - } -+ device_unlock(dev); - - kfree(old); - -@@ -836,8 +839,12 @@ static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct platform_device *pdev = to_platform_device(dev); -+ ssize_t len; - -- return sprintf(buf, "%s\n", pdev->driver_override); -+ device_lock(dev); -+ len = sprintf(buf, "%s\n", pdev->driver_override); -+ device_unlock(dev); -+ return len; - } - static DEVICE_ATTR_RW(driver_override); - -diff --git a/drivers/gpu/drm/virtio/virtgpu_object.c b/drivers/gpu/drm/virtio/virtgpu_object.c -index f300eba95bb1..1244cdf52859 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_object.c -+++ b/drivers/gpu/drm/virtio/virtgpu_object.c -@@ -81,8 +81,10 @@ int virtio_gpu_object_create(struct virtio_gpu_device *vgdev, - return -ENOMEM; - size = roundup(size, PAGE_SIZE); - ret = drm_gem_object_init(vgdev->ddev, &bo->gem_base, size); -- if (ret != 0) -+ if (ret != 0) { -+ kfree(bo); - return ret; -+ } - bo->dumb = false; - virtio_gpu_init_ttm_placement(bo, pinned); - -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index 1c02deab068f..9eca4b41fa0a 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -2287,6 +2287,10 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file, - if (copy_from_user(&cmd, buf, sizeof cmd)) - return -EFAULT; - -+ if (cmd.port_num < rdma_start_port(ib_dev) || -+ cmd.port_num > rdma_end_port(ib_dev)) -+ return -EINVAL; -+ - INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd, - out_len); - -@@ -2827,6 +2831,10 @@ ssize_t ib_uverbs_create_ah(struct ib_uverbs_file *file, - if (copy_from_user(&cmd, buf, sizeof cmd)) - return -EFAULT; - -+ if (cmd.attr.port_num < rdma_start_port(ib_dev) || -+ cmd.attr.port_num > rdma_end_port(ib_dev)) -+ return -EINVAL; -+ - uobj = kmalloc(sizeof *uobj, GFP_KERNEL); - if (!uobj) - return -ENOMEM; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index eff554a12fb4..0a856cb181e9 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -1866,7 +1866,7 @@ super_1_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors) - } - sb = page_address(rdev->sb_page); - sb->data_size = cpu_to_le64(num_sectors); -- sb->super_offset = rdev->sb_start; -+ sb->super_offset = cpu_to_le64(rdev->sb_start); - sb->sb_csum = calc_sb_1_csum(sb); - md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, - rdev->sb_page); -@@ -2273,7 +2273,7 @@ static bool does_sb_need_changing(struct mddev *mddev) - /* Check if any mddev parameters have changed */ - if ((mddev->dev_sectors != le64_to_cpu(sb->size)) || - (mddev->reshape_position != le64_to_cpu(sb->reshape_position)) || -- (mddev->layout != le64_to_cpu(sb->layout)) || -+ (mddev->layout != le32_to_cpu(sb->layout)) || - (mddev->raid_disks != le32_to_cpu(sb->raid_disks)) || - (mddev->chunk_sectors != le32_to_cpu(sb->chunksize))) - return true; -diff --git a/drivers/media/pci/saa7134/saa7134-i2c.c b/drivers/media/pci/saa7134/saa7134-i2c.c -index 8ef6399d794f..bc957528f69f 100644 ---- a/drivers/media/pci/saa7134/saa7134-i2c.c -+++ b/drivers/media/pci/saa7134/saa7134-i2c.c -@@ -355,12 +355,43 @@ static struct i2c_client saa7134_client_template = { - - /* ----------------------------------------------------------- */ - -+/* On Medion 7134 reading EEPROM needs DVB-T demod i2c gate open */ -+static void saa7134_i2c_eeprom_md7134_gate(struct saa7134_dev *dev) -+{ -+ u8 subaddr = 0x7, dmdregval; -+ u8 data[2]; -+ int ret; -+ struct i2c_msg i2cgatemsg_r[] = { {.addr = 0x08, .flags = 0, -+ .buf = &subaddr, .len = 1}, -+ {.addr = 0x08, -+ .flags = I2C_M_RD, -+ .buf = &dmdregval, .len = 1} -+ }; -+ struct i2c_msg i2cgatemsg_w[] = { {.addr = 0x08, .flags = 0, -+ .buf = data, .len = 2} }; -+ -+ ret = i2c_transfer(&dev->i2c_adap, i2cgatemsg_r, 2); -+ if ((ret == 2) && (dmdregval & 0x2)) { -+ pr_debug("%s: DVB-T demod i2c gate was left closed\n", -+ dev->name); -+ -+ data[0] = subaddr; -+ data[1] = (dmdregval & ~0x2); -+ if (i2c_transfer(&dev->i2c_adap, i2cgatemsg_w, 1) != 1) -+ pr_err("%s: EEPROM i2c gate open failure\n", -+ dev->name); -+ } -+} -+ - static int - saa7134_i2c_eeprom(struct saa7134_dev *dev, unsigned char *eedata, int len) - { - unsigned char buf; - int i,err; - -+ if (dev->board == SAA7134_BOARD_MD7134) -+ saa7134_i2c_eeprom_md7134_gate(dev); -+ - dev->i2c_client.addr = 0xa0 >> 1; - buf = 0; - if (1 != (err = i2c_master_send(&dev->i2c_client,&buf,1))) { -diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c -index 70da30095b89..a5e4b4b93d1b 100644 ---- a/drivers/net/ethernet/broadcom/bgmac.c -+++ b/drivers/net/ethernet/broadcom/bgmac.c -@@ -1583,6 +1583,11 @@ static int bgmac_probe(struct bcma_device *core) - dev_warn(&core->dev, "Using random MAC: %pM\n", mac); - } - -+ /* This (reset &) enable is not preset in specs or reference driver but -+ * Broadcom does it in arch PCI code when enabling fake PCI device. -+ */ -+ bcma_core_enable(core, 0); -+ - /* Allocation and references */ - net_dev = alloc_etherdev(sizeof(*bgmac)); - if (!net_dev) -diff --git a/drivers/net/wireless/ath/ath10k/pci.c b/drivers/net/wireless/ath/ath10k/pci.c -index 930785a724e1..907fd60c4241 100644 ---- a/drivers/net/wireless/ath/ath10k/pci.c -+++ b/drivers/net/wireless/ath/ath10k/pci.c -@@ -3050,7 +3050,7 @@ static int ath10k_pci_probe(struct pci_dev *pdev, - goto err_core_destroy; - } - -- if (QCA_REV_6174(ar)) -+ if (QCA_REV_6174(ar) || QCA_REV_9377(ar)) - ath10k_pci_override_ce_config(ar); - - ret = ath10k_pci_alloc_pipes(ar); -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index d59769e858f4..019d7165a045 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2539,7 +2539,7 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, - - tasklet_hrtimer_init(&data->beacon_timer, - mac80211_hwsim_beacon, -- CLOCK_MONOTONIC_RAW, HRTIMER_MODE_ABS); -+ CLOCK_MONOTONIC, HRTIMER_MODE_ABS); - - spin_lock_bh(&hwsim_radio_lock); - list_add_tail(&data->list, &hwsim_radios); -diff --git a/drivers/pinctrl/freescale/pinctrl-mxs.c b/drivers/pinctrl/freescale/pinctrl-mxs.c -index 6bbda6b4ab50..5da9c95dccb7 100644 ---- a/drivers/pinctrl/freescale/pinctrl-mxs.c -+++ b/drivers/pinctrl/freescale/pinctrl-mxs.c -@@ -195,6 +195,16 @@ static int mxs_pinctrl_get_func_groups(struct pinctrl_dev *pctldev, - return 0; - } - -+static void mxs_pinctrl_rmwl(u32 value, u32 mask, u8 shift, void __iomem *reg) -+{ -+ u32 tmp; -+ -+ tmp = readl(reg); -+ tmp &= ~(mask << shift); -+ tmp |= value << shift; -+ writel(tmp, reg); -+} -+ - static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector, - unsigned group) - { -@@ -212,8 +222,7 @@ static int mxs_pinctrl_set_mux(struct pinctrl_dev *pctldev, unsigned selector, - reg += bank * 0x20 + pin / 16 * 0x10; - shift = pin % 16 * 2; - -- writel(0x3 << shift, reg + CLR); -- writel(g->muxsel[i] << shift, reg + SET); -+ mxs_pinctrl_rmwl(g->muxsel[i], 0x3, shift, reg); - } - - return 0; -@@ -280,8 +289,7 @@ static int mxs_pinconf_group_set(struct pinctrl_dev *pctldev, - /* mA */ - if (config & MA_PRESENT) { - shift = pin % 8 * 4; -- writel(0x3 << shift, reg + CLR); -- writel(ma << shift, reg + SET); -+ mxs_pinctrl_rmwl(ma, 0x3, shift, reg); - } - - /* vol */ -diff --git a/drivers/pinctrl/meson/pinctrl-meson8b.c b/drivers/pinctrl/meson/pinctrl-meson8b.c -index 9677807db364..b505b87661f8 100644 ---- a/drivers/pinctrl/meson/pinctrl-meson8b.c -+++ b/drivers/pinctrl/meson/pinctrl-meson8b.c -@@ -732,8 +732,8 @@ static const char * const sdxc_c_groups[] = { - static const char * const nand_groups[] = { - "nand_io", "nand_io_ce0", "nand_io_ce1", - "nand_io_rb0", "nand_ale", "nand_cle", -- "nand_wen_clk", "nand_ren_clk", "nand_dqs0", -- "nand_dqs1" -+ "nand_wen_clk", "nand_ren_clk", "nand_dqs_0", -+ "nand_dqs_1" - }; - - static const char * const nor_groups[] = { -diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c -index 2b0d70217bbd..699efb1a8c45 100644 ---- a/drivers/pinctrl/sh-pfc/core.c -+++ b/drivers/pinctrl/sh-pfc/core.c -@@ -543,6 +543,9 @@ static int sh_pfc_probe(struct platform_device *pdev) - ret = info->ops->init(pfc); - if (ret < 0) - return ret; -+ -+ /* .init() may have overridden pfc->info */ -+ info = pfc->info; - } - - /* Enable dummy states for those platforms without pinctrl support */ -diff --git a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c -index 87a4f44147c1..42ffa8708abc 100644 ---- a/drivers/pinctrl/sh-pfc/pfc-r8a7791.c -+++ b/drivers/pinctrl/sh-pfc/pfc-r8a7791.c -@@ -1102,7 +1102,7 @@ static const u16 pinmux_data[] = { - PINMUX_IPSR_MSEL(IP6_5_3, FMIN_E, SEL_FM_4), - PINMUX_IPSR_DATA(IP6_7_6, AUDIO_CLKOUT), - PINMUX_IPSR_MSEL(IP6_7_6, MSIOF1_SS1_B, SEL_SOF1_1), -- PINMUX_IPSR_MSEL(IP6_5_3, TX2, SEL_SCIF2_0), -+ PINMUX_IPSR_MSEL(IP6_7_6, TX2, SEL_SCIF2_0), - PINMUX_IPSR_MSEL(IP6_7_6, SCIFA2_TXD, SEL_SCIFA2_0), - PINMUX_IPSR_DATA(IP6_9_8, IRQ0), - PINMUX_IPSR_MSEL(IP6_9_8, SCIFB1_RXD_D, SEL_SCIFB1_3), -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -index 90b973e15982..a7c81e988656 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c -@@ -394,7 +394,7 @@ static const struct sunxi_desc_pin sun8i_a83t_pins[] = { - SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 18), - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out"), -- SUNXI_FUNCTION(0x3, "owa")), /* DOUT */ -+ SUNXI_FUNCTION(0x3, "spdif")), /* DOUT */ - SUNXI_PIN(SUNXI_PINCTRL_PIN(E, 19), - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out")), -diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c -index 7b4af519e17e..8fed55342b0f 100644 ---- a/drivers/staging/comedi/comedi_fops.c -+++ b/drivers/staging/comedi/comedi_fops.c -@@ -2911,6 +2911,7 @@ static int __init comedi_init(void) - dev = comedi_alloc_board_minor(NULL); - if (IS_ERR(dev)) { - comedi_cleanup_board_minors(); -+ class_destroy(comedi_class); - cdev_del(&comedi_cdev); - unregister_chrdev_region(MKDEV(COMEDI_MAJOR, 0), - COMEDI_NUM_MINORS); -diff --git a/drivers/staging/vt6656/main_usb.c b/drivers/staging/vt6656/main_usb.c -index 01e642db311e..f35ee85f61b5 100644 ---- a/drivers/staging/vt6656/main_usb.c -+++ b/drivers/staging/vt6656/main_usb.c -@@ -529,6 +529,9 @@ static int vnt_start(struct ieee80211_hw *hw) - goto free_all; - } - -+ if (vnt_key_init_table(priv)) -+ goto free_all; -+ - priv->int_interval = 1; /* bInterval is set to 1 */ - - vnt_int_start_interrupt(priv); -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 96b21b0dac1e..3116edfcdc18 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -223,6 +223,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Blackmagic Design UltraStudio SDI */ - { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* Hauppauge HVR-950q */ -+ { USB_DEVICE(0x2040, 0x7200), .driver_info = -+ USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* INTEL VALUE SSD */ - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME }, - -diff --git a/drivers/usb/dwc3/dwc3-st.c b/drivers/usb/dwc3/dwc3-st.c -index 5c0adb9c6fb2..81db2fa08cad 100644 ---- a/drivers/usb/dwc3/dwc3-st.c -+++ b/drivers/usb/dwc3/dwc3-st.c -@@ -224,7 +224,7 @@ static int st_dwc3_probe(struct platform_device *pdev) - - dwc3_data->syscfg_reg_off = res->start; - -- dev_vdbg(&pdev->dev, "glue-logic addr 0x%p, syscfg-reg offset 0x%x\n", -+ dev_vdbg(&pdev->dev, "glue-logic addr 0x%pK, syscfg-reg offset 0x%x\n", - dwc3_data->glue_base, dwc3_data->syscfg_reg_off); - - dwc3_data->rstc_pwrdn = devm_reset_control_get(dev, "powerdown"); -diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c -index ec7a50f98f57..d3bd1afd6302 100644 ---- a/drivers/usb/dwc3/gadget.c -+++ b/drivers/usb/dwc3/gadget.c -@@ -1219,7 +1219,7 @@ static int dwc3_gadget_ep_queue(struct usb_ep *ep, struct usb_request *request, - goto out; - } - -- if (WARN(req->dep != dep, "request %p belongs to '%s'\n", -+ if (WARN(req->dep != dep, "request %pK belongs to '%s'\n", - request, req->dep->name)) { - ret = -EINVAL; - goto out; -@@ -1264,7 +1264,7 @@ static int dwc3_gadget_ep_dequeue(struct usb_ep *ep, - dwc3_stop_active_transfer(dwc, dep->number, true); - goto out1; - } -- dev_err(dwc->dev, "request %p was not queued to %s\n", -+ dev_err(dwc->dev, "request %pK was not queued to %s\n", - request, ep->name); - ret = -EINVAL; - goto out0; -@@ -1866,7 +1866,7 @@ static int __dwc3_cleanup_done_trbs(struct dwc3 *dwc, struct dwc3_ep *dep, - * would help. Lets hope that if this occurs, someone - * fixes the root cause instead of looking away :) - */ -- dev_err(dwc->dev, "%s's TRB (%p) still owned by HW\n", -+ dev_err(dwc->dev, "%s's TRB (%pK) still owned by HW\n", - dep->name, trb); - count = trb->size & DWC3_TRB_SIZE_MASK; - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 33cec50978b8..b0dc6da3d970 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -134,6 +134,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */ - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ -+ { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 3bf61acfc26b..ebe51f11105d 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -1877,6 +1877,10 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&four_g_w100_blacklist - }, - { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, -+ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff), -+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, -+ { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff), -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) }, - { USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) }, - { USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) }, -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index fd509ed6cf70..652b4334b26d 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -158,6 +158,7 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x9056)}, /* Sierra Wireless Modem */ - {DEVICE_SWI(0x1199, 0x9060)}, /* Sierra Wireless Modem */ - {DEVICE_SWI(0x1199, 0x9061)}, /* Sierra Wireless Modem */ -+ {DEVICE_SWI(0x1199, 0x9063)}, /* Sierra Wireless EM7305 */ - {DEVICE_SWI(0x1199, 0x9070)}, /* Sierra Wireless MC74xx */ - {DEVICE_SWI(0x1199, 0x9071)}, /* Sierra Wireless MC74xx */ - {DEVICE_SWI(0x1199, 0x9078)}, /* Sierra Wireless EM74xx */ -diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c -index 44ab43fc4fcc..af10f7b131a4 100644 ---- a/drivers/usb/usbip/stub_main.c -+++ b/drivers/usb/usbip/stub_main.c -@@ -262,7 +262,11 @@ void stub_device_cleanup_urbs(struct stub_device *sdev) - kmem_cache_free(stub_priv_cache, priv); - - kfree(urb->transfer_buffer); -+ urb->transfer_buffer = NULL; -+ - kfree(urb->setup_packet); -+ urb->setup_packet = NULL; -+ - usb_free_urb(urb); - } - } -diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c -index dbcabc9dbe0d..021003c4de53 100644 ---- a/drivers/usb/usbip/stub_tx.c -+++ b/drivers/usb/usbip/stub_tx.c -@@ -28,7 +28,11 @@ static void stub_free_priv_and_urb(struct stub_priv *priv) - struct urb *urb = priv->urb; - - kfree(urb->setup_packet); -+ urb->setup_packet = NULL; -+ - kfree(urb->transfer_buffer); -+ urb->transfer_buffer = NULL; -+ - list_del(&priv->list); - kmem_cache_free(stub_priv_cache, priv); - usb_free_urb(urb); -diff --git a/fs/ext4/sysfs.c b/fs/ext4/sysfs.c -index 5d09ea585840..c2ee23acf359 100644 ---- a/fs/ext4/sysfs.c -+++ b/fs/ext4/sysfs.c -@@ -100,7 +100,7 @@ static ssize_t reserved_clusters_store(struct ext4_attr *a, - int ret; - - ret = kstrtoull(skip_spaces(buf), 0, &val); -- if (!ret || val >= clusters) -+ if (ret || val >= clusters) - return -EINVAL; - - atomic64_set(&sbi->s_resv_clusters, val); -diff --git a/fs/fcntl.c b/fs/fcntl.c -index ee85cd4e136a..62376451bbce 100644 ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -740,16 +740,10 @@ static int __init fcntl_init(void) - * Exceptions: O_NONBLOCK is a two bit define on parisc; O_NDELAY - * is defined as O_NONBLOCK on some platforms and not on others. - */ -- BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != HWEIGHT32( -- O_RDONLY | O_WRONLY | O_RDWR | -- O_CREAT | O_EXCL | O_NOCTTY | -- O_TRUNC | O_APPEND | /* O_NONBLOCK | */ -- __O_SYNC | O_DSYNC | FASYNC | -- O_DIRECT | O_LARGEFILE | O_DIRECTORY | -- O_NOFOLLOW | O_NOATIME | O_CLOEXEC | -- __FMODE_EXEC | O_PATH | __O_TMPFILE | -- __FMODE_NONOTIFY -- )); -+ BUILD_BUG_ON(21 - 1 /* for O_RDONLY being 0 */ != -+ HWEIGHT32( -+ (VALID_OPEN_FLAGS & ~(O_NONBLOCK | O_NDELAY)) | -+ __FMODE_EXEC | __FMODE_NONOTIFY)); - - fasync_cache = kmem_cache_create("fasync_cache", - sizeof(struct fasync_struct), 0, SLAB_PANIC, NULL); -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 9cd8c92b953d..070901e76653 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -80,9 +80,9 @@ static struct rhashtable_params ht_parms = { - - static struct rhashtable gl_hash_table; - --void gfs2_glock_free(struct gfs2_glock *gl) -+static void gfs2_glock_dealloc(struct rcu_head *rcu) - { -- struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; -+ struct gfs2_glock *gl = container_of(rcu, struct gfs2_glock, gl_rcu); - - if (gl->gl_ops->go_flags & GLOF_ASPACE) { - kmem_cache_free(gfs2_glock_aspace_cachep, gl); -@@ -90,6 +90,13 @@ void gfs2_glock_free(struct gfs2_glock *gl) - kfree(gl->gl_lksb.sb_lvbptr); - kmem_cache_free(gfs2_glock_cachep, gl); - } -+} -+ -+void gfs2_glock_free(struct gfs2_glock *gl) -+{ -+ struct gfs2_sbd *sdp = gl->gl_name.ln_sbd; -+ -+ call_rcu(&gl->gl_rcu, gfs2_glock_dealloc); - if (atomic_dec_and_test(&sdp->sd_glock_disposal)) - wake_up(&sdp->sd_glock_wait); - } -diff --git a/fs/gfs2/incore.h b/fs/gfs2/incore.h -index be519416c112..4a9077ec9313 100644 ---- a/fs/gfs2/incore.h -+++ b/fs/gfs2/incore.h -@@ -367,6 +367,7 @@ struct gfs2_glock { - loff_t end; - } gl_vm; - }; -+ struct rcu_head gl_rcu; - struct rhash_head gl_node; - }; - -diff --git a/fs/open.c b/fs/open.c -index 157b9940dd73..fbc5c7b230b3 100644 ---- a/fs/open.c -+++ b/fs/open.c -@@ -885,6 +885,12 @@ static inline int build_open_flags(int flags, umode_t mode, struct open_flags *o - int lookup_flags = 0; - int acc_mode; - -+ /* -+ * Clear out all open flags we don't know about so that we don't report -+ * them in fcntl(F_GETFD) or similar interfaces. -+ */ -+ flags &= VALID_OPEN_FLAGS; -+ - if (flags & (O_CREAT | __O_TMPFILE)) - op->mode = (mode & S_IALLUGO) | S_IFREG; - else -diff --git a/include/linux/fcntl.h b/include/linux/fcntl.h -index 76ce329e656d..1b48d9c9a561 100644 ---- a/include/linux/fcntl.h -+++ b/include/linux/fcntl.h -@@ -3,6 +3,12 @@ - - #include - -+/* list of all valid flags for the open/openat flags argument: */ -+#define VALID_OPEN_FLAGS \ -+ (O_RDONLY | O_WRONLY | O_RDWR | O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | \ -+ O_APPEND | O_NDELAY | O_NONBLOCK | O_NDELAY | __O_SYNC | O_DSYNC | \ -+ FASYNC | O_DIRECT | O_LARGEFILE | O_DIRECTORY | O_NOFOLLOW | \ -+ O_NOATIME | O_CLOEXEC | O_PATH | __O_TMPFILE) - - #ifndef force_o_largefile - #define force_o_largefile() (BITS_PER_LONG != 32) -diff --git a/include/linux/usb/hcd.h b/include/linux/usb/hcd.h -index 3993b21f3d11..757c554408ce 100644 ---- a/include/linux/usb/hcd.h -+++ b/include/linux/usb/hcd.h -@@ -560,9 +560,9 @@ extern void usb_ep0_reinit(struct usb_device *); - ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) - - #define EndpointRequest \ -- ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) -+ ((USB_DIR_IN|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) - #define EndpointOutRequest \ -- ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_INTERFACE)<<8) -+ ((USB_DIR_OUT|USB_TYPE_STANDARD|USB_RECIP_ENDPOINT)<<8) - - /* class requests from the USB 2.0 hub spec, table 11-15 */ - /* GetBusState and SetHubDescriptor are optional, omitted */ -diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index 161a1807e6ef..5e24eb0ab5dd 100644 ---- a/ipc/mqueue.c -+++ b/ipc/mqueue.c -@@ -1251,8 +1251,10 @@ retry: - - timeo = MAX_SCHEDULE_TIMEOUT; - ret = netlink_attachskb(sock, nc, &timeo, NULL); -- if (ret == 1) -+ if (ret == 1) { -+ sock = NULL; - goto retry; -+ } - if (ret) { - sock = NULL; - nc = NULL; -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 464a7864e4c5..002ec084124b 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -2067,9 +2067,12 @@ static int do_proc_douintvec_conv(bool *negp, unsigned long *lvalp, - if (write) { - if (*negp) - return -EINVAL; -+ if (*lvalp > UINT_MAX) -+ return -EINVAL; - *valp = *lvalp; - } else { - unsigned int val = *valp; -+ *negp = false; - *lvalp = (unsigned long)val; - } - return 0; -diff --git a/kernel/trace/trace_kprobe.c b/kernel/trace/trace_kprobe.c -index 12ea4ea619ee..e9092a0247bf 100644 ---- a/kernel/trace/trace_kprobe.c -+++ b/kernel/trace/trace_kprobe.c -@@ -659,30 +659,25 @@ static int create_trace_kprobe(int argc, char **argv) - pr_info("Probe point is not specified.\n"); - return -EINVAL; - } -- if (isdigit(argv[1][0])) { -- if (is_return) { -- pr_info("Return probe point must be a symbol.\n"); -- return -EINVAL; -- } -- /* an address specified */ -- ret = kstrtoul(&argv[1][0], 0, (unsigned long *)&addr); -- if (ret) { -- pr_info("Failed to parse address.\n"); -- return ret; -- } -- } else { -+ -+ /* try to parse an address. if that fails, try to read the -+ * input as a symbol. */ -+ if (kstrtoul(argv[1], 0, (unsigned long *)&addr)) { - /* a symbol specified */ - symbol = argv[1]; - /* TODO: support .init module functions */ - ret = traceprobe_split_symbol_offset(symbol, &offset); - if (ret) { -- pr_info("Failed to parse symbol.\n"); -+ pr_info("Failed to parse either an address or a symbol.\n"); - return ret; - } - if (offset && is_return) { - pr_info("Return probe must be used without offset.\n"); - return -EINVAL; - } -+ } else if (is_return) { -+ pr_info("Return probe point must be a symbol.\n"); -+ return -EINVAL; - } - argc -= 2; argv += 2; - -diff --git a/mm/vmscan.c b/mm/vmscan.c -index bfc5050cbd01..440c2df9be82 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -2529,7 +2529,7 @@ static bool shrink_zones(struct zonelist *zonelist, struct scan_control *sc) - if (!populated_zone(zone)) - continue; - -- classzone_idx = requested_highidx; -+ classzone_idx = gfp_zone(sc->gfp_mask); - while (!populated_zone(zone->zone_pgdat->node_zones + - classzone_idx)) - classzone_idx--; -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 87791f803627..8f13b2eaabf8 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -2165,8 +2165,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head) - { - struct tcp_sock *tp = tcp_sk(sk); - struct sk_buff *skb; -- int cnt, oldcnt; -- int err; -+ int cnt, oldcnt, lost; - unsigned int mss; - /* Use SACK to deduce losses of new sequences sent during recovery */ - const u32 loss_high = tcp_is_sack(tp) ? tp->snd_nxt : tp->high_seq; -@@ -2206,9 +2205,10 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head) - break; - - mss = tcp_skb_mss(skb); -- err = tcp_fragment(sk, skb, (packets - oldcnt) * mss, -- mss, GFP_ATOMIC); -- if (err < 0) -+ /* If needed, chop off the prefix to mark as lost. */ -+ lost = (packets - oldcnt) * mss; -+ if (lost < skb->len && -+ tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0) - break; - cnt = packets; - } -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index 696ccfa08d10..31898856682e 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -428,7 +428,7 @@ static int init_blkcipher_desc(struct blkcipher_desc *desc, const u8 *key, - static struct key *request_master_key(struct encrypted_key_payload *epayload, - const u8 **master_key, size_t *master_keylen) - { -- struct key *mkey = NULL; -+ struct key *mkey = ERR_PTR(-EINVAL); - - if (!strncmp(epayload->master_desc, KEY_TRUSTED_PREFIX, - KEY_TRUSTED_PREFIX_LEN)) { -diff --git a/tools/include/linux/compiler.h b/tools/include/linux/compiler.h -index fa7208a32d76..8a679b21f0c4 100644 ---- a/tools/include/linux/compiler.h -+++ b/tools/include/linux/compiler.h -@@ -115,4 +115,13 @@ static __always_inline void __write_once_size(volatile void *p, void *res, int s - #define WRITE_ONCE(x, val) \ - ({ union { typeof(x) __val; char __c[1]; } __u = { .__val = (val) }; __write_once_size(&(x), __u.__c, sizeof(x)); __u.__val; }) - -+ -+#ifndef __fallthrough -+# if defined(__GNUC__) && __GNUC__ >= 7 -+# define __fallthrough __attribute__ ((fallthrough)) -+# else -+# define __fallthrough -+# endif -+#endif -+ - #endif /* _TOOLS_LINUX_COMPILER_H */ -diff --git a/tools/perf/arch/x86/tests/intel-cqm.c b/tools/perf/arch/x86/tests/intel-cqm.c -index d28c1b6a3b54..fa5d17af88b7 100644 ---- a/tools/perf/arch/x86/tests/intel-cqm.c -+++ b/tools/perf/arch/x86/tests/intel-cqm.c -@@ -17,7 +17,7 @@ static pid_t spawn(void) - if (pid) - return pid; - -- while(1); -+ while(1) - sleep(5); - return 0; - } -diff --git a/tools/perf/arch/x86/util/dwarf-regs.c b/tools/perf/arch/x86/util/dwarf-regs.c -index 9223c164e545..1f86ee8fb831 100644 ---- a/tools/perf/arch/x86/util/dwarf-regs.c -+++ b/tools/perf/arch/x86/util/dwarf-regs.c -@@ -63,6 +63,8 @@ struct pt_regs_offset { - # define REG_OFFSET_NAME_32(n, r) {.name = n, .offset = offsetof(struct pt_regs, r)} - #endif - -+/* TODO: switching by dwarf address size */ -+#ifndef __x86_64__ - static const struct pt_regs_offset x86_32_regoffset_table[] = { - REG_OFFSET_NAME_32("%ax", eax), - REG_OFFSET_NAME_32("%cx", ecx), -@@ -75,6 +77,8 @@ static const struct pt_regs_offset x86_32_regoffset_table[] = { - REG_OFFSET_END, - }; - -+#define regoffset_table x86_32_regoffset_table -+#else - static const struct pt_regs_offset x86_64_regoffset_table[] = { - REG_OFFSET_NAME_64("%ax", rax), - REG_OFFSET_NAME_64("%dx", rdx), -@@ -95,11 +99,7 @@ static const struct pt_regs_offset x86_64_regoffset_table[] = { - REG_OFFSET_END, - }; - --/* TODO: switching by dwarf address size */ --#ifdef __x86_64__ - #define regoffset_table x86_64_regoffset_table --#else --#define regoffset_table x86_32_regoffset_table - #endif - - /* Minus 1 for the ending REG_OFFSET_END */ -diff --git a/tools/perf/bench/numa.c b/tools/perf/bench/numa.c -index 492df2752a2d..b4eb5b679081 100644 ---- a/tools/perf/bench/numa.c -+++ b/tools/perf/bench/numa.c -@@ -1570,13 +1570,13 @@ static int __bench_numa(const char *name) - "GB/sec,", "total-speed", "GB/sec total speed"); - - if (g->p.show_details >= 2) { -- char tname[32]; -+ char tname[14 + 2 * 10 + 1]; - struct thread_data *td; - for (p = 0; p < g->p.nr_proc; p++) { - for (t = 0; t < g->p.nr_threads; t++) { -- memset(tname, 0, 32); -+ memset(tname, 0, sizeof(tname)); - td = g->threads + p*g->p.nr_threads + t; -- snprintf(tname, 32, "process%d:thread%d", p, t); -+ snprintf(tname, sizeof(tname), "process%d:thread%d", p, t); - print_res(tname, td->speed_gbs, - "GB/sec", "thread-speed", "GB/sec/thread speed"); - print_res(tname, td->system_time_ns / 1e9, -diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c -index 72b5deb4bd79..20f0e27918dd 100644 ---- a/tools/perf/builtin-script.c -+++ b/tools/perf/builtin-script.c -@@ -1252,21 +1252,19 @@ static int is_directory(const char *base_path, const struct dirent *dent) - return S_ISDIR(st.st_mode); - } - --#define for_each_lang(scripts_path, scripts_dir, lang_dirent, lang_next)\ -- while (!readdir_r(scripts_dir, &lang_dirent, &lang_next) && \ -- lang_next) \ -- if ((lang_dirent.d_type == DT_DIR || \ -- (lang_dirent.d_type == DT_UNKNOWN && \ -- is_directory(scripts_path, &lang_dirent))) && \ -- (strcmp(lang_dirent.d_name, ".")) && \ -- (strcmp(lang_dirent.d_name, ".."))) -- --#define for_each_script(lang_path, lang_dir, script_dirent, script_next)\ -- while (!readdir_r(lang_dir, &script_dirent, &script_next) && \ -- script_next) \ -- if (script_dirent.d_type != DT_DIR && \ -- (script_dirent.d_type != DT_UNKNOWN || \ -- !is_directory(lang_path, &script_dirent))) -+#define for_each_lang(scripts_path, scripts_dir, lang_dirent) \ -+ while ((lang_dirent = readdir(scripts_dir)) != NULL) \ -+ if ((lang_dirent->d_type == DT_DIR || \ -+ (lang_dirent->d_type == DT_UNKNOWN && \ -+ is_directory(scripts_path, lang_dirent))) && \ -+ (strcmp(lang_dirent->d_name, ".")) && \ -+ (strcmp(lang_dirent->d_name, ".."))) -+ -+#define for_each_script(lang_path, lang_dir, script_dirent) \ -+ while ((script_dirent = readdir(lang_dir)) != NULL) \ -+ if (script_dirent->d_type != DT_DIR && \ -+ (script_dirent->d_type != DT_UNKNOWN || \ -+ !is_directory(lang_path, script_dirent))) - - - #define RECORD_SUFFIX "-record" -@@ -1412,7 +1410,7 @@ static int list_available_scripts(const struct option *opt __maybe_unused, - const char *s __maybe_unused, - int unset __maybe_unused) - { -- struct dirent *script_next, *lang_next, script_dirent, lang_dirent; -+ struct dirent *script_dirent, *lang_dirent; - char scripts_path[MAXPATHLEN]; - DIR *scripts_dir, *lang_dir; - char script_path[MAXPATHLEN]; -@@ -1427,19 +1425,19 @@ static int list_available_scripts(const struct option *opt __maybe_unused, - if (!scripts_dir) - return -1; - -- for_each_lang(scripts_path, scripts_dir, lang_dirent, lang_next) { -+ for_each_lang(scripts_path, scripts_dir, lang_dirent) { - snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -- lang_dirent.d_name); -+ lang_dirent->d_name); - lang_dir = opendir(lang_path); - if (!lang_dir) - continue; - -- for_each_script(lang_path, lang_dir, script_dirent, script_next) { -- script_root = get_script_root(&script_dirent, REPORT_SUFFIX); -+ for_each_script(lang_path, lang_dir, script_dirent) { -+ script_root = get_script_root(script_dirent, REPORT_SUFFIX); - if (script_root) { - desc = script_desc__findnew(script_root); - snprintf(script_path, MAXPATHLEN, "%s/%s", -- lang_path, script_dirent.d_name); -+ lang_path, script_dirent->d_name); - read_script_info(desc, script_path); - free(script_root); - } -@@ -1527,7 +1525,7 @@ static int check_ev_match(char *dir_name, char *scriptname, - */ - int find_scripts(char **scripts_array, char **scripts_path_array) - { -- struct dirent *script_next, *lang_next, script_dirent, lang_dirent; -+ struct dirent *script_dirent, *lang_dirent; - char scripts_path[MAXPATHLEN], lang_path[MAXPATHLEN]; - DIR *scripts_dir, *lang_dir; - struct perf_session *session; -@@ -1550,9 +1548,9 @@ int find_scripts(char **scripts_array, char **scripts_path_array) - return -1; - } - -- for_each_lang(scripts_path, scripts_dir, lang_dirent, lang_next) { -+ for_each_lang(scripts_path, scripts_dir, lang_dirent) { - snprintf(lang_path, MAXPATHLEN, "%s/%s", scripts_path, -- lang_dirent.d_name); -+ lang_dirent->d_name); - #ifdef NO_LIBPERL - if (strstr(lang_path, "perl")) - continue; -@@ -1566,16 +1564,16 @@ int find_scripts(char **scripts_array, char **scripts_path_array) - if (!lang_dir) - continue; - -- for_each_script(lang_path, lang_dir, script_dirent, script_next) { -+ for_each_script(lang_path, lang_dir, script_dirent) { - /* Skip those real time scripts: xxxtop.p[yl] */ -- if (strstr(script_dirent.d_name, "top.")) -+ if (strstr(script_dirent->d_name, "top.")) - continue; - sprintf(scripts_path_array[i], "%s/%s", lang_path, -- script_dirent.d_name); -- temp = strchr(script_dirent.d_name, '.'); -+ script_dirent->d_name); -+ temp = strchr(script_dirent->d_name, '.'); - snprintf(scripts_array[i], -- (temp - script_dirent.d_name) + 1, -- "%s", script_dirent.d_name); -+ (temp - script_dirent->d_name) + 1, -+ "%s", script_dirent->d_name); - - if (check_ev_match(lang_path, - scripts_array[i], session)) -@@ -1593,7 +1591,7 @@ int find_scripts(char **scripts_array, char **scripts_path_array) - - static char *get_script_path(const char *script_root, const char *suffix) - { -- struct dirent *script_next, *lang_next, script_dirent, lang_dirent; -+ struct dirent *script_dirent, *lang_dirent; - char scripts_path[MAXPATHLEN]; - char script_path[MAXPATHLEN]; - DIR *scripts_dir, *lang_dir; -@@ -1606,21 +1604,21 @@ static char *get_script_path(const char *script_root, const char *suffix) - if (!scripts_dir) - return NULL; - -- for_each_lang(scripts_path, scripts_dir, lang_dirent, lang_next) { -+ for_each_lang(scripts_path, scripts_dir, lang_dirent) { - snprintf(lang_path, MAXPATHLEN, "%s/%s/bin", scripts_path, -- lang_dirent.d_name); -+ lang_dirent->d_name); - lang_dir = opendir(lang_path); - if (!lang_dir) - continue; - -- for_each_script(lang_path, lang_dir, script_dirent, script_next) { -- __script_root = get_script_root(&script_dirent, suffix); -+ for_each_script(lang_path, lang_dir, script_dirent) { -+ __script_root = get_script_root(script_dirent, suffix); - if (__script_root && !strcmp(script_root, __script_root)) { - free(__script_root); - closedir(lang_dir); - closedir(scripts_dir); - snprintf(script_path, MAXPATHLEN, "%s/%s", -- lang_path, script_dirent.d_name); -+ lang_path, script_dirent->d_name); - return strdup(script_path); - } - free(__script_root); -diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c -index 7e2e72e6d9d1..4a8a02c302d2 100644 ---- a/tools/perf/builtin-top.c -+++ b/tools/perf/builtin-top.c -@@ -636,7 +636,7 @@ repeat: - case -1: - if (errno == EINTR) - continue; -- /* Fall trhu */ -+ __fallthrough; - default: - c = getc(stdin); - tcsetattr(0, TCSAFLUSH, &save); -diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c -index c783d8fd3a80..ebe7115c751a 100644 ---- a/tools/perf/builtin-trace.c -+++ b/tools/perf/builtin-trace.c -@@ -1617,6 +1617,7 @@ static int trace__process_event(struct trace *trace, struct machine *machine, - color_fprintf(trace->output, PERF_COLOR_RED, - "LOST %" PRIu64 " events!\n", event->lost.lost); - ret = machine__process_lost_event(machine, event, sample); -+ break; - default: - ret = machine__process_event(machine, event, sample); - break; -diff --git a/tools/perf/tests/parse-events.c b/tools/perf/tests/parse-events.c -index 636d7b42d844..54af2f2e2ee4 100644 ---- a/tools/perf/tests/parse-events.c -+++ b/tools/perf/tests/parse-events.c -@@ -1727,15 +1727,14 @@ static int test_pmu_events(void) - } - - while (!ret && (ent = readdir(dir))) { --#define MAX_NAME 100 - struct evlist_test e; -- char name[MAX_NAME]; -+ char name[2 * NAME_MAX + 1 + 12 + 3]; - - if (!strcmp(ent->d_name, ".") || - !strcmp(ent->d_name, "..")) - continue; - -- snprintf(name, MAX_NAME, "cpu/event=%s/u", ent->d_name); -+ snprintf(name, sizeof(name), "cpu/event=%s/u", ent->d_name); - - e.name = name; - e.check = test__checkevent_pmu_events; -@@ -1743,11 +1742,10 @@ static int test_pmu_events(void) - ret = test_event(&e); - if (ret) - break; -- snprintf(name, MAX_NAME, "%s:u,cpu/event=%s/u", ent->d_name, ent->d_name); -+ snprintf(name, sizeof(name), "%s:u,cpu/event=%s/u", ent->d_name, ent->d_name); - e.name = name; - e.check = test__checkevent_pmu_events_mix; - ret = test_event(&e); --#undef MAX_NAME - } - - closedir(dir); -diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c -index d4d7cc27252f..718bd46d47fa 100644 ---- a/tools/perf/ui/browsers/annotate.c -+++ b/tools/perf/ui/browsers/annotate.c -@@ -755,11 +755,11 @@ static int annotate_browser__run(struct annotate_browser *browser, - nd = browser->curr_hot; - break; - case K_UNTAB: -- if (nd != NULL) -+ if (nd != NULL) { - nd = rb_next(nd); - if (nd == NULL) - nd = rb_first(&browser->entries); -- else -+ } else - nd = browser->curr_hot; - break; - case K_F1: -diff --git a/tools/perf/util/event.c b/tools/perf/util/event.c -index 956187bf1a85..26cba64345e3 100644 ---- a/tools/perf/util/event.c -+++ b/tools/perf/util/event.c -@@ -416,7 +416,7 @@ static int __event__synthesize_thread(union perf_event *comm_event, - { - char filename[PATH_MAX]; - DIR *tasks; -- struct dirent dirent, *next; -+ struct dirent *dirent; - pid_t tgid, ppid; - int rc = 0; - -@@ -445,11 +445,11 @@ static int __event__synthesize_thread(union perf_event *comm_event, - return 0; - } - -- while (!readdir_r(tasks, &dirent, &next) && next) { -+ while ((dirent = readdir(tasks)) != NULL) { - char *end; - pid_t _pid; - -- _pid = strtol(dirent.d_name, &end, 10); -+ _pid = strtol(dirent->d_name, &end, 10); - if (*end) - continue; - -@@ -558,7 +558,7 @@ int perf_event__synthesize_threads(struct perf_tool *tool, - { - DIR *proc; - char proc_path[PATH_MAX]; -- struct dirent dirent, *next; -+ struct dirent *dirent; - union perf_event *comm_event, *mmap_event, *fork_event; - int err = -1; - -@@ -583,9 +583,9 @@ int perf_event__synthesize_threads(struct perf_tool *tool, - if (proc == NULL) - goto out_free_fork; - -- while (!readdir_r(proc, &dirent, &next) && next) { -+ while ((dirent = readdir(proc)) != NULL) { - char *end; -- pid_t pid = strtol(dirent.d_name, &end, 10); -+ pid_t pid = strtol(dirent->d_name, &end, 10); - - if (*end) /* only interested in proper numerical dirents */ - continue; -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index 71df7acf8643..933a509a90f8 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - #include "../cache.h" - #include "../util.h" -@@ -1708,6 +1709,7 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder) - switch (decoder->packet.type) { - case INTEL_PT_TIP_PGD: - decoder->continuous_period = false; -+ __fallthrough; - case INTEL_PT_TIP_PGE: - case INTEL_PT_TIP: - intel_pt_log("ERROR: Unexpected packet\n"); -@@ -1762,6 +1764,8 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder) - decoder->pge = false; - decoder->continuous_period = false; - intel_pt_clear_tx_flags(decoder); -+ __fallthrough; -+ - case INTEL_PT_TNT: - decoder->have_tma = false; - intel_pt_log("ERROR: Unexpected packet\n"); -@@ -1802,6 +1806,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder) - switch (decoder->packet.type) { - case INTEL_PT_TIP_PGD: - decoder->continuous_period = false; -+ __fallthrough; - case INTEL_PT_TIP_PGE: - case INTEL_PT_TIP: - decoder->pge = decoder->packet.type != INTEL_PT_TIP_PGD; -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -index b1257c816310..9b2fce25162b 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - - #include "intel-pt-pkt-decoder.h" - -@@ -488,6 +489,7 @@ int intel_pt_pkt_desc(const struct intel_pt_pkt *packet, char *buf, - case INTEL_PT_FUP: - if (!(packet->count)) - return snprintf(buf, buf_len, "%s no ip", name); -+ __fallthrough; - case INTEL_PT_CYC: - case INTEL_PT_VMCS: - case INTEL_PT_MTC: -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index a35db828bd0d..38304b7e4f81 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -138,11 +138,11 @@ struct event_symbol event_symbols_sw[PERF_COUNT_SW_MAX] = { - #define PERF_EVENT_TYPE(config) __PERF_EVENT_FIELD(config, TYPE) - #define PERF_EVENT_ID(config) __PERF_EVENT_FIELD(config, EVENT) - --#define for_each_subsystem(sys_dir, sys_dirent, sys_next) \ -- while (!readdir_r(sys_dir, &sys_dirent, &sys_next) && sys_next) \ -- if (sys_dirent.d_type == DT_DIR && \ -- (strcmp(sys_dirent.d_name, ".")) && \ -- (strcmp(sys_dirent.d_name, ".."))) -+#define for_each_subsystem(sys_dir, sys_dirent) \ -+ while ((sys_dirent = readdir(sys_dir)) != NULL) \ -+ if (sys_dirent->d_type == DT_DIR && \ -+ (strcmp(sys_dirent->d_name, ".")) && \ -+ (strcmp(sys_dirent->d_name, ".."))) - - static int tp_event_has_id(struct dirent *sys_dir, struct dirent *evt_dir) - { -@@ -159,12 +159,12 @@ static int tp_event_has_id(struct dirent *sys_dir, struct dirent *evt_dir) - return 0; - } - --#define for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next) \ -- while (!readdir_r(evt_dir, &evt_dirent, &evt_next) && evt_next) \ -- if (evt_dirent.d_type == DT_DIR && \ -- (strcmp(evt_dirent.d_name, ".")) && \ -- (strcmp(evt_dirent.d_name, "..")) && \ -- (!tp_event_has_id(&sys_dirent, &evt_dirent))) -+#define for_each_event(sys_dirent, evt_dir, evt_dirent) \ -+ while ((evt_dirent = readdir(evt_dir)) != NULL) \ -+ if (evt_dirent->d_type == DT_DIR && \ -+ (strcmp(evt_dirent->d_name, ".")) && \ -+ (strcmp(evt_dirent->d_name, "..")) && \ -+ (!tp_event_has_id(sys_dirent, evt_dirent))) - - #define MAX_EVENT_LENGTH 512 - -@@ -173,7 +173,7 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config) - { - struct tracepoint_path *path = NULL; - DIR *sys_dir, *evt_dir; -- struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent; -+ struct dirent *sys_dirent, *evt_dirent; - char id_buf[24]; - int fd; - u64 id; -@@ -184,18 +184,18 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config) - if (!sys_dir) - return NULL; - -- for_each_subsystem(sys_dir, sys_dirent, sys_next) { -+ for_each_subsystem(sys_dir, sys_dirent) { - - snprintf(dir_path, MAXPATHLEN, "%s/%s", tracing_events_path, -- sys_dirent.d_name); -+ sys_dirent->d_name); - evt_dir = opendir(dir_path); - if (!evt_dir) - continue; - -- for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next) { -+ for_each_event(sys_dirent, evt_dir, evt_dirent) { - - snprintf(evt_path, MAXPATHLEN, "%s/%s/id", dir_path, -- evt_dirent.d_name); -+ evt_dirent->d_name); - fd = open(evt_path, O_RDONLY); - if (fd < 0) - continue; -@@ -220,9 +220,9 @@ struct tracepoint_path *tracepoint_id_to_path(u64 config) - free(path); - return NULL; - } -- strncpy(path->system, sys_dirent.d_name, -+ strncpy(path->system, sys_dirent->d_name, - MAX_EVENT_LENGTH); -- strncpy(path->name, evt_dirent.d_name, -+ strncpy(path->name, evt_dirent->d_name, - MAX_EVENT_LENGTH); - return path; - } -@@ -1629,7 +1629,7 @@ void print_tracepoint_events(const char *subsys_glob, const char *event_glob, - bool name_only) - { - DIR *sys_dir, *evt_dir; -- struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent; -+ struct dirent *sys_dirent, *evt_dirent; - char evt_path[MAXPATHLEN]; - char dir_path[MAXPATHLEN]; - char **evt_list = NULL; -@@ -1647,20 +1647,20 @@ restart: - goto out_close_sys_dir; - } - -- for_each_subsystem(sys_dir, sys_dirent, sys_next) { -+ for_each_subsystem(sys_dir, sys_dirent) { - if (subsys_glob != NULL && -- !strglobmatch(sys_dirent.d_name, subsys_glob)) -+ !strglobmatch(sys_dirent->d_name, subsys_glob)) - continue; - - snprintf(dir_path, MAXPATHLEN, "%s/%s", tracing_events_path, -- sys_dirent.d_name); -+ sys_dirent->d_name); - evt_dir = opendir(dir_path); - if (!evt_dir) - continue; - -- for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next) { -+ for_each_event(sys_dirent, evt_dir, evt_dirent) { - if (event_glob != NULL && -- !strglobmatch(evt_dirent.d_name, event_glob)) -+ !strglobmatch(evt_dirent->d_name, event_glob)) - continue; - - if (!evt_num_known) { -@@ -1669,7 +1669,7 @@ restart: - } - - snprintf(evt_path, MAXPATHLEN, "%s:%s", -- sys_dirent.d_name, evt_dirent.d_name); -+ sys_dirent->d_name, evt_dirent->d_name); - - evt_list[evt_i] = strdup(evt_path); - if (evt_list[evt_i] == NULL) -@@ -1722,7 +1722,7 @@ out_close_sys_dir: - int is_valid_tracepoint(const char *event_string) - { - DIR *sys_dir, *evt_dir; -- struct dirent *sys_next, *evt_next, sys_dirent, evt_dirent; -+ struct dirent *sys_dirent, *evt_dirent; - char evt_path[MAXPATHLEN]; - char dir_path[MAXPATHLEN]; - -@@ -1730,17 +1730,17 @@ int is_valid_tracepoint(const char *event_string) - if (!sys_dir) - return 0; - -- for_each_subsystem(sys_dir, sys_dirent, sys_next) { -+ for_each_subsystem(sys_dir, sys_dirent) { - - snprintf(dir_path, MAXPATHLEN, "%s/%s", tracing_events_path, -- sys_dirent.d_name); -+ sys_dirent->d_name); - evt_dir = opendir(dir_path); - if (!evt_dir) - continue; - -- for_each_event(sys_dirent, evt_dir, evt_dirent, evt_next) { -+ for_each_event(sys_dirent, evt_dir, evt_dirent) { - snprintf(evt_path, MAXPATHLEN, "%s:%s", -- sys_dirent.d_name, evt_dirent.d_name); -+ sys_dirent->d_name, evt_dirent->d_name); - if (!strcmp(evt_path, event_string)) { - closedir(evt_dir); - closedir(sys_dir); -diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c -index 6f2a0279476c..593066c68e3d 100644 ---- a/tools/perf/util/pmu.c -+++ b/tools/perf/util/pmu.c -@@ -153,7 +153,7 @@ static int perf_pmu__parse_unit(struct perf_pmu_alias *alias, char *dir, char *n - if (fd == -1) - return -1; - -- sret = read(fd, alias->unit, UNIT_MAX_LEN); -+ sret = read(fd, alias->unit, UNIT_MAX_LEN); - if (sret < 0) - goto error; - -diff --git a/tools/perf/util/scripting-engines/Build b/tools/perf/util/scripting-engines/Build -index 6516e220c247..82d28c67e0f3 100644 ---- a/tools/perf/util/scripting-engines/Build -+++ b/tools/perf/util/scripting-engines/Build -@@ -1,6 +1,6 @@ - libperf-$(CONFIG_LIBPERL) += trace-event-perl.o - libperf-$(CONFIG_LIBPYTHON) += trace-event-python.o - --CFLAGS_trace-event-perl.o += $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-undef -Wno-switch-default -+CFLAGS_trace-event-perl.o += $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -Wno-nested-externs -Wno-undef -Wno-switch-default - - CFLAGS_trace-event-python.o += $(PYTHON_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-shadow -diff --git a/tools/perf/util/strfilter.c b/tools/perf/util/strfilter.c -index bcae659b6546..efb53772e0ec 100644 ---- a/tools/perf/util/strfilter.c -+++ b/tools/perf/util/strfilter.c -@@ -269,6 +269,7 @@ static int strfilter_node__sprint(struct strfilter_node *node, char *buf) - len = strfilter_node__sprint_pt(node->l, buf); - if (len < 0) - return len; -+ __fallthrough; - case '!': - if (buf) { - *(buf + len++) = *node->p; -diff --git a/tools/perf/util/string.c b/tools/perf/util/string.c -index fc8781de62db..accb7ece1d3c 100644 ---- a/tools/perf/util/string.c -+++ b/tools/perf/util/string.c -@@ -21,6 +21,8 @@ s64 perf_atoll(const char *str) - case 'b': case 'B': - if (*p) - goto out_err; -+ -+ __fallthrough; - case '\0': - return length; - default: -diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c -index 0a9ae8014729..829508a21448 100644 ---- a/tools/perf/util/thread.c -+++ b/tools/perf/util/thread.c -@@ -227,7 +227,7 @@ void thread__find_cpumode_addr_location(struct thread *thread, - struct addr_location *al) - { - size_t i; -- const u8 const cpumodes[] = { -+ const u8 cpumodes[] = { - PERF_RECORD_MISC_USER, - PERF_RECORD_MISC_KERNEL, - PERF_RECORD_MISC_GUEST_USER, -diff --git a/tools/perf/util/thread_map.c b/tools/perf/util/thread_map.c -index 6ec3c5ca438f..4e666b95b87e 100644 ---- a/tools/perf/util/thread_map.c -+++ b/tools/perf/util/thread_map.c -@@ -92,8 +92,8 @@ struct thread_map *thread_map__new_by_uid(uid_t uid) - { - DIR *proc; - int max_threads = 32, items, i; -- char path[256]; -- struct dirent dirent, *next, **namelist = NULL; -+ char path[NAME_MAX + 1 + 6]; -+ struct dirent *dirent, **namelist = NULL; - struct thread_map *threads = thread_map__alloc(max_threads); - - if (threads == NULL) -@@ -106,16 +106,16 @@ struct thread_map *thread_map__new_by_uid(uid_t uid) - threads->nr = 0; - atomic_set(&threads->refcnt, 1); - -- while (!readdir_r(proc, &dirent, &next) && next) { -+ while ((dirent = readdir(proc)) != NULL) { - char *end; - bool grow = false; - struct stat st; -- pid_t pid = strtol(dirent.d_name, &end, 10); -+ pid_t pid = strtol(dirent->d_name, &end, 10); - - if (*end) /* only interested in proper numerical dirents */ - continue; - -- snprintf(path, sizeof(path), "/proc/%s", dirent.d_name); -+ snprintf(path, sizeof(path), "/proc/%s", dirent->d_name); - - if (stat(path, &st) != 0) - continue; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.77-78.patch b/patch/kernel/mvebu64-default/03-patch-4.4.77-78.patch deleted file mode 100644 index 7bbeb8ee6c76..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.77-78.patch +++ /dev/null @@ -1,3019 +0,0 @@ -diff --git a/Makefile b/Makefile -index bf49a61d02e2..ac77ae8ee0b1 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 77 -+SUBLEVEL = 78 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/include/asm/elf.h b/arch/arm/include/asm/elf.h -index d2315ffd8f12..f13ae153fb24 100644 ---- a/arch/arm/include/asm/elf.h -+++ b/arch/arm/include/asm/elf.h -@@ -112,12 +112,8 @@ int dump_task_regs(struct task_struct *t, elf_gregset_t *elfregs); - #define CORE_DUMP_USE_REGSET - #define ELF_EXEC_PAGESIZE 4096 - --/* This is the location that an ET_DYN program is loaded if exec'ed. Typical -- use of this is to invoke "./ld.so someprog" to test out a new version of -- the loader. We need to make sure that it is out of the way of the program -- that it will "exec", and that there is sufficient room for the brk. */ -- --#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) -+/* This is the base location for PIE (ET_DYN with INTERP) loads. */ -+#define ELF_ET_DYN_BASE 0x400000UL - - /* When the program starts, a1 contains a pointer to a function to be - registered with atexit, as per the SVR4 ABI. A value of 0 means we -diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h -index 44dd892a4bbe..9e11dbe1cec3 100644 ---- a/arch/arm64/include/asm/elf.h -+++ b/arch/arm64/include/asm/elf.h -@@ -120,12 +120,11 @@ typedef struct user_fpsimd_state elf_fpregset_t; - #define ELF_EXEC_PAGESIZE PAGE_SIZE - - /* -- * This is the location that an ET_DYN program is loaded if exec'ed. Typical -- * use of this is to invoke "./ld.so someprog" to test out a new version of -- * the loader. We need to make sure that it is out of the way of the program -- * that it will "exec", and that there is sufficient room for the brk. -+ * This is the base location for PIE (ET_DYN with INTERP) loads. On -+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * space open for things that want to use the area for 32-bit pointers. - */ --#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3) -+#define ELF_ET_DYN_BASE 0x100000000UL - - /* - * When the program starts, a1 contains a pointer to a function to be -@@ -165,7 +164,8 @@ extern int arch_setup_additional_pages(struct linux_binprm *bprm, - - #ifdef CONFIG_COMPAT - --#define COMPAT_ELF_ET_DYN_BASE (2 * TASK_SIZE_32 / 3) -+/* PIE load location for compat arm. Must match ARM ELF_ET_DYN_BASE. */ -+#define COMPAT_ELF_ET_DYN_BASE 0x000400000UL - - /* AArch32 registers. */ - #define COMPAT_ELF_NGREG 18 -diff --git a/arch/parisc/include/asm/dma-mapping.h b/arch/parisc/include/asm/dma-mapping.h -index d8d60a57183f..f53725202955 100644 ---- a/arch/parisc/include/asm/dma-mapping.h -+++ b/arch/parisc/include/asm/dma-mapping.h -@@ -39,6 +39,8 @@ struct hppa_dma_ops { - ** flush/purge and allocate "regular" cacheable pages for everything. - */ - -+#define DMA_ERROR_CODE (~(dma_addr_t)0) -+ - #ifdef CONFIG_PA11 - extern struct hppa_dma_ops pcxl_dma_ops; - extern struct hppa_dma_ops pcx_dma_ops; -@@ -209,12 +211,13 @@ parisc_walk_tree(struct device *dev) - break; - } - } -- BUG_ON(!dev->platform_data); - return dev->platform_data; - } -- --#define GET_IOC(dev) (HBA_DATA(parisc_walk_tree(dev))->iommu) -- -+ -+#define GET_IOC(dev) ({ \ -+ void *__pdata = parisc_walk_tree(dev); \ -+ __pdata ? HBA_DATA(__pdata)->iommu : NULL; \ -+}) - - #ifdef CONFIG_IOMMU_CCIO - struct parisc_device; -diff --git a/arch/parisc/include/asm/mmu_context.h b/arch/parisc/include/asm/mmu_context.h -index 59be25764433..a81226257878 100644 ---- a/arch/parisc/include/asm/mmu_context.h -+++ b/arch/parisc/include/asm/mmu_context.h -@@ -49,15 +49,26 @@ static inline void load_context(mm_context_t context) - mtctl(__space_to_prot(context), 8); - } - --static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, struct task_struct *tsk) -+static inline void switch_mm_irqs_off(struct mm_struct *prev, -+ struct mm_struct *next, struct task_struct *tsk) - { -- - if (prev != next) { - mtctl(__pa(next->pgd), 25); - load_context(next->context); - } - } - -+static inline void switch_mm(struct mm_struct *prev, -+ struct mm_struct *next, struct task_struct *tsk) -+{ -+ unsigned long flags; -+ -+ local_irq_save(flags); -+ switch_mm_irqs_off(prev, next, tsk); -+ local_irq_restore(flags); -+} -+#define switch_mm_irqs_off switch_mm_irqs_off -+ - #define deactivate_mm(tsk,mm) do { } while (0) - - static inline void activate_mm(struct mm_struct *prev, struct mm_struct *next) -diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S -index d4ffcfbc9885..041e1f9ec129 100644 ---- a/arch/parisc/kernel/syscall_table.S -+++ b/arch/parisc/kernel/syscall_table.S -@@ -361,7 +361,7 @@ - ENTRY_SAME(ni_syscall) /* 263: reserved for vserver */ - ENTRY_SAME(add_key) - ENTRY_SAME(request_key) /* 265 */ -- ENTRY_SAME(keyctl) -+ ENTRY_COMP(keyctl) - ENTRY_SAME(ioprio_set) - ENTRY_SAME(ioprio_get) - ENTRY_SAME(inotify_init) -diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c -index f9064449908a..d8c2f3bcfc18 100644 ---- a/arch/parisc/mm/fault.c -+++ b/arch/parisc/mm/fault.c -@@ -303,7 +303,7 @@ bad_area: - case 15: /* Data TLB miss fault/Data page fault */ - /* send SIGSEGV when outside of vma */ - if (!vma || -- address < vma->vm_start || address > vma->vm_end) { -+ address < vma->vm_start || address >= vma->vm_end) { - si.si_signo = SIGSEGV; - si.si_code = SEGV_MAPERR; - break; -diff --git a/arch/powerpc/include/asm/elf.h b/arch/powerpc/include/asm/elf.h -index ee46ffef608e..743ad7a400d6 100644 ---- a/arch/powerpc/include/asm/elf.h -+++ b/arch/powerpc/include/asm/elf.h -@@ -23,12 +23,13 @@ - #define CORE_DUMP_USE_REGSET - #define ELF_EXEC_PAGESIZE PAGE_SIZE - --/* This is the location that an ET_DYN program is loaded if exec'ed. Typical -- use of this is to invoke "./ld.so someprog" to test out a new version of -- the loader. We need to make sure that it is out of the way of the program -- that it will "exec", and that there is sufficient room for the brk. */ -- --#define ELF_ET_DYN_BASE 0x20000000 -+/* -+ * This is the base location for PIE (ET_DYN with INTERP) loads. On -+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * space open for things that want to use the area for 32-bit pointers. -+ */ -+#define ELF_ET_DYN_BASE (is_32bit_task() ? 0x000400000UL : \ -+ 0x100000000UL) - - #define ELF_CORE_EFLAGS (is_elf2_task() ? 2 : 0) - -diff --git a/arch/s390/include/asm/elf.h b/arch/s390/include/asm/elf.h -index bab6739a1154..b9eb7b1a49d2 100644 ---- a/arch/s390/include/asm/elf.h -+++ b/arch/s390/include/asm/elf.h -@@ -154,14 +154,13 @@ extern unsigned int vdso_enabled; - #define CORE_DUMP_USE_REGSET - #define ELF_EXEC_PAGESIZE 4096 - --/* This is the location that an ET_DYN program is loaded if exec'ed. Typical -- use of this is to invoke "./ld.so someprog" to test out a new version of -- the loader. We need to make sure that it is out of the way of the program -- that it will "exec", and that there is sufficient room for the brk. 64-bit -- tasks are aligned to 4GB. */ --#define ELF_ET_DYN_BASE (is_32bit_task() ? \ -- (STACK_TOP / 3 * 2) : \ -- (STACK_TOP / 3 * 2) & ~((1UL << 32) - 1)) -+/* -+ * This is the base location for PIE (ET_DYN with INTERP) loads. On -+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * space open for things that want to use the area for 32-bit pointers. -+ */ -+#define ELF_ET_DYN_BASE (is_compat_task() ? 0x000400000UL : \ -+ 0x100000000UL) - - /* This yields a mask that user programs can use to figure out what - instruction set this CPU supports. */ -diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c -index dd14616b7739..7de207a11014 100644 ---- a/arch/x86/crypto/sha1_ssse3_glue.c -+++ b/arch/x86/crypto/sha1_ssse3_glue.c -@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data, - - static bool avx2_usable(void) - { -- if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2) -+ if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2) - && boot_cpu_has(X86_FEATURE_BMI1) - && boot_cpu_has(X86_FEATURE_BMI2)) - return true; -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index d262f985bbc8..07cf288b692e 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -245,12 +245,13 @@ extern int force_personality32; - #define CORE_DUMP_USE_REGSET - #define ELF_EXEC_PAGESIZE 4096 - --/* This is the location that an ET_DYN program is loaded if exec'ed. Typical -- use of this is to invoke "./ld.so someprog" to test out a new version of -- the loader. We need to make sure that it is out of the way of the program -- that it will "exec", and that there is sufficient room for the brk. */ -- --#define ELF_ET_DYN_BASE (TASK_SIZE / 3 * 2) -+/* -+ * This is the base location for PIE (ET_DYN with INTERP) loads. On -+ * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * space open for things that want to use the area for 32-bit pointers. -+ */ -+#define ELF_ET_DYN_BASE (mmap_is_ia32() ? 0x000400000UL : \ -+ 0x100000000UL) - - /* This yields a mask that user programs can use to figure out what - instruction set this CPU supports. This could be done in user space, -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 690b4027e17c..37db36fddc88 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -405,6 +405,8 @@ - #define MSR_IA32_TSC_ADJUST 0x0000003b - #define MSR_IA32_BNDCFGS 0x00000d90 - -+#define MSR_IA32_BNDCFGS_RSVD 0x00000ffc -+ - #define MSR_IA32_XSS 0x00000da0 - - #define FEATURE_CONTROL_LOCKED (1<<0) -diff --git a/arch/x86/kvm/cpuid.c b/arch/x86/kvm/cpuid.c -index 9357b29de9bc..83d6369c45f5 100644 ---- a/arch/x86/kvm/cpuid.c -+++ b/arch/x86/kvm/cpuid.c -@@ -46,11 +46,18 @@ static u32 xstate_required_size(u64 xstate_bv, bool compacted) - return ret; - } - -+bool kvm_mpx_supported(void) -+{ -+ return ((host_xcr0 & (XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR)) -+ && kvm_x86_ops->mpx_supported()); -+} -+EXPORT_SYMBOL_GPL(kvm_mpx_supported); -+ - u64 kvm_supported_xcr0(void) - { - u64 xcr0 = KVM_SUPPORTED_XCR0 & host_xcr0; - -- if (!kvm_x86_ops->mpx_supported()) -+ if (!kvm_mpx_supported()) - xcr0 &= ~(XFEATURE_MASK_BNDREGS | XFEATURE_MASK_BNDCSR); - - return xcr0; -@@ -97,7 +104,7 @@ int kvm_update_cpuid(struct kvm_vcpu *vcpu) - if (best && (best->eax & (F(XSAVES) | F(XSAVEC)))) - best->ebx = xstate_required_size(vcpu->arch.xcr0, true); - -- vcpu->arch.eager_fpu = use_eager_fpu() || guest_cpuid_has_mpx(vcpu); -+ vcpu->arch.eager_fpu = use_eager_fpu(); - if (vcpu->arch.eager_fpu) - kvm_x86_ops->fpu_activate(vcpu); - -@@ -295,7 +302,7 @@ static inline int __do_cpuid_ent(struct kvm_cpuid_entry2 *entry, u32 function, - #endif - unsigned f_rdtscp = kvm_x86_ops->rdtscp_supported() ? F(RDTSCP) : 0; - unsigned f_invpcid = kvm_x86_ops->invpcid_supported() ? F(INVPCID) : 0; -- unsigned f_mpx = kvm_x86_ops->mpx_supported() ? F(MPX) : 0; -+ unsigned f_mpx = kvm_mpx_supported() ? F(MPX) : 0; - unsigned f_xsaves = kvm_x86_ops->xsaves_supported() ? F(XSAVES) : 0; - - /* cpuid 1.edx */ -diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h -index 3f5c48ddba45..d1534feefcfe 100644 ---- a/arch/x86/kvm/cpuid.h -+++ b/arch/x86/kvm/cpuid.h -@@ -4,6 +4,7 @@ - #include "x86.h" - - int kvm_update_cpuid(struct kvm_vcpu *vcpu); -+bool kvm_mpx_supported(void); - struct kvm_cpuid_entry2 *kvm_find_cpuid_entry(struct kvm_vcpu *vcpu, - u32 function, u32 index); - int kvm_dev_ioctl_get_cpuid(struct kvm_cpuid2 *cpuid, -@@ -134,20 +135,20 @@ static inline bool guest_cpuid_has_rtm(struct kvm_vcpu *vcpu) - return best && (best->ebx & bit(X86_FEATURE_RTM)); - } - --static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu) -+static inline bool guest_cpuid_has_pcommit(struct kvm_vcpu *vcpu) - { - struct kvm_cpuid_entry2 *best; - - best = kvm_find_cpuid_entry(vcpu, 7, 0); -- return best && (best->ebx & bit(X86_FEATURE_MPX)); -+ return best && (best->ebx & bit(X86_FEATURE_PCOMMIT)); - } - --static inline bool guest_cpuid_has_pcommit(struct kvm_vcpu *vcpu) -+static inline bool guest_cpuid_has_mpx(struct kvm_vcpu *vcpu) - { - struct kvm_cpuid_entry2 *best; - - best = kvm_find_cpuid_entry(vcpu, 7, 0); -- return best && (best->ebx & bit(X86_FEATURE_PCOMMIT)); -+ return best && (best->ebx & bit(X86_FEATURE_MPX)); - } - - static inline bool guest_cpuid_has_rdtscp(struct kvm_vcpu *vcpu) -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index bbaa11f4e74b..b12391119ce8 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -863,7 +863,6 @@ static unsigned long nested_ept_get_cr3(struct kvm_vcpu *vcpu); - static u64 construct_eptp(unsigned long root_hpa); - static void kvm_cpu_vmxon(u64 addr); - static void kvm_cpu_vmxoff(void); --static bool vmx_mpx_supported(void); - static bool vmx_xsaves_supported(void); - static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu); - static int vmx_set_tss_addr(struct kvm *kvm, unsigned int addr); -@@ -2541,7 +2540,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) - VM_EXIT_LOAD_IA32_EFER | VM_EXIT_SAVE_IA32_EFER | - VM_EXIT_SAVE_VMX_PREEMPTION_TIMER | VM_EXIT_ACK_INTR_ON_EXIT; - -- if (vmx_mpx_supported()) -+ if (kvm_mpx_supported()) - vmx->nested.nested_vmx_exit_ctls_high |= VM_EXIT_CLEAR_BNDCFGS; - - /* We support free control of debug control saving. */ -@@ -2562,7 +2561,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) - VM_ENTRY_LOAD_IA32_PAT; - vmx->nested.nested_vmx_entry_ctls_high |= - (VM_ENTRY_ALWAYSON_WITHOUT_TRUE_MSR | VM_ENTRY_LOAD_IA32_EFER); -- if (vmx_mpx_supported()) -+ if (kvm_mpx_supported()) - vmx->nested.nested_vmx_entry_ctls_high |= VM_ENTRY_LOAD_BNDCFGS; - - /* We support free control of debug control loading. */ -@@ -2813,7 +2812,8 @@ static int vmx_get_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - msr_info->data = vmcs_readl(GUEST_SYSENTER_ESP); - break; - case MSR_IA32_BNDCFGS: -- if (!vmx_mpx_supported()) -+ if (!kvm_mpx_supported() || -+ (!msr_info->host_initiated && !guest_cpuid_has_mpx(vcpu))) - return 1; - msr_info->data = vmcs_read64(GUEST_BNDCFGS); - break; -@@ -2890,7 +2890,11 @@ static int vmx_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr_info) - vmcs_writel(GUEST_SYSENTER_ESP, data); - break; - case MSR_IA32_BNDCFGS: -- if (!vmx_mpx_supported()) -+ if (!kvm_mpx_supported() || -+ (!msr_info->host_initiated && !guest_cpuid_has_mpx(vcpu))) -+ return 1; -+ if (is_noncanonical_address(data & PAGE_MASK) || -+ (data & MSR_IA32_BNDCFGS_RSVD)) - return 1; - vmcs_write64(GUEST_BNDCFGS, data); - break; -@@ -3363,7 +3367,7 @@ static void init_vmcs_shadow_fields(void) - for (i = j = 0; i < max_shadow_read_write_fields; i++) { - switch (shadow_read_write_fields[i]) { - case GUEST_BNDCFGS: -- if (!vmx_mpx_supported()) -+ if (!kvm_mpx_supported()) - continue; - break; - default: -@@ -6253,7 +6257,6 @@ static __init int hardware_setup(void) - vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_CS, false); - vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_ESP, false); - vmx_disable_intercept_for_msr(MSR_IA32_SYSENTER_EIP, false); -- vmx_disable_intercept_for_msr(MSR_IA32_BNDCFGS, true); - - memcpy(vmx_msr_bitmap_legacy_x2apic, - vmx_msr_bitmap_legacy, PAGE_SIZE); -@@ -10265,7 +10268,7 @@ static void prepare_vmcs12(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12, - vmcs12->guest_sysenter_cs = vmcs_read32(GUEST_SYSENTER_CS); - vmcs12->guest_sysenter_esp = vmcs_readl(GUEST_SYSENTER_ESP); - vmcs12->guest_sysenter_eip = vmcs_readl(GUEST_SYSENTER_EIP); -- if (vmx_mpx_supported()) -+ if (kvm_mpx_supported()) - vmcs12->guest_bndcfgs = vmcs_read64(GUEST_BNDCFGS); - if (nested_cpu_has_xsaves(vmcs12)) - vmcs12->xss_exit_bitmap = vmcs_read64(XSS_EXIT_BITMAP); -diff --git a/drivers/base/core.c b/drivers/base/core.c -index f18856f5954b..afe045792796 100644 ---- a/drivers/base/core.c -+++ b/drivers/base/core.c -@@ -2094,7 +2094,11 @@ void device_shutdown(void) - pm_runtime_get_noresume(dev); - pm_runtime_barrier(dev); - -- if (dev->bus && dev->bus->shutdown) { -+ if (dev->class && dev->class->shutdown) { -+ if (initcall_debug) -+ dev_info(dev, "shutdown\n"); -+ dev->class->shutdown(dev); -+ } else if (dev->bus && dev->bus->shutdown) { - if (initcall_debug) - dev_info(dev, "shutdown\n"); - dev->bus->shutdown(dev); -diff --git a/drivers/base/power/sysfs.c b/drivers/base/power/sysfs.c -index a7b46798c81d..39efa7e6c0c0 100644 ---- a/drivers/base/power/sysfs.c -+++ b/drivers/base/power/sysfs.c -@@ -268,6 +268,8 @@ static ssize_t pm_qos_latency_tolerance_store(struct device *dev, - value = PM_QOS_LATENCY_TOLERANCE_NO_CONSTRAINT; - else if (!strcmp(buf, "any") || !strcmp(buf, "any\n")) - value = PM_QOS_LATENCY_ANY; -+ else -+ return -EINVAL; - } - ret = dev_pm_qos_update_user_latency_tolerance(dev, value); - return ret < 0 ? ret : n; -diff --git a/drivers/base/power/wakeup.c b/drivers/base/power/wakeup.c -index a1e0b9ab847a..e613633ffe9c 100644 ---- a/drivers/base/power/wakeup.c -+++ b/drivers/base/power/wakeup.c -@@ -60,6 +60,8 @@ static LIST_HEAD(wakeup_sources); - - static DECLARE_WAIT_QUEUE_HEAD(wakeup_count_wait_queue); - -+DEFINE_STATIC_SRCU(wakeup_srcu); -+ - static struct wakeup_source deleted_ws = { - .name = "deleted", - .lock = __SPIN_LOCK_UNLOCKED(deleted_ws.lock), -@@ -198,7 +200,7 @@ void wakeup_source_remove(struct wakeup_source *ws) - spin_lock_irqsave(&events_lock, flags); - list_del_rcu(&ws->entry); - spin_unlock_irqrestore(&events_lock, flags); -- synchronize_rcu(); -+ synchronize_srcu(&wakeup_srcu); - } - EXPORT_SYMBOL_GPL(wakeup_source_remove); - -@@ -330,13 +332,14 @@ void device_wakeup_detach_irq(struct device *dev) - void device_wakeup_arm_wake_irqs(void) - { - struct wakeup_source *ws; -+ int srcuidx; - -- rcu_read_lock(); -+ srcuidx = srcu_read_lock(&wakeup_srcu); - list_for_each_entry_rcu(ws, &wakeup_sources, entry) { - if (ws->wakeirq) - dev_pm_arm_wake_irq(ws->wakeirq); - } -- rcu_read_unlock(); -+ srcu_read_unlock(&wakeup_srcu, srcuidx); - } - - /** -@@ -347,13 +350,14 @@ void device_wakeup_arm_wake_irqs(void) - void device_wakeup_disarm_wake_irqs(void) - { - struct wakeup_source *ws; -+ int srcuidx; - -- rcu_read_lock(); -+ srcuidx = srcu_read_lock(&wakeup_srcu); - list_for_each_entry_rcu(ws, &wakeup_sources, entry) { - if (ws->wakeirq) - dev_pm_disarm_wake_irq(ws->wakeirq); - } -- rcu_read_unlock(); -+ srcu_read_unlock(&wakeup_srcu, srcuidx); - } - - /** -@@ -807,10 +811,10 @@ EXPORT_SYMBOL_GPL(pm_wakeup_event); - void pm_print_active_wakeup_sources(void) - { - struct wakeup_source *ws; -- int active = 0; -+ int srcuidx, active = 0; - struct wakeup_source *last_activity_ws = NULL; - -- rcu_read_lock(); -+ srcuidx = srcu_read_lock(&wakeup_srcu); - list_for_each_entry_rcu(ws, &wakeup_sources, entry) { - if (ws->active) { - pr_info("active wakeup source: %s\n", ws->name); -@@ -826,7 +830,7 @@ void pm_print_active_wakeup_sources(void) - if (!active && last_activity_ws) - pr_info("last active wakeup source: %s\n", - last_activity_ws->name); -- rcu_read_unlock(); -+ srcu_read_unlock(&wakeup_srcu, srcuidx); - } - EXPORT_SYMBOL_GPL(pm_print_active_wakeup_sources); - -@@ -953,8 +957,9 @@ void pm_wakep_autosleep_enabled(bool set) - { - struct wakeup_source *ws; - ktime_t now = ktime_get(); -+ int srcuidx; - -- rcu_read_lock(); -+ srcuidx = srcu_read_lock(&wakeup_srcu); - list_for_each_entry_rcu(ws, &wakeup_sources, entry) { - spin_lock_irq(&ws->lock); - if (ws->autosleep_enabled != set) { -@@ -968,7 +973,7 @@ void pm_wakep_autosleep_enabled(bool set) - } - spin_unlock_irq(&ws->lock); - } -- rcu_read_unlock(); -+ srcu_read_unlock(&wakeup_srcu, srcuidx); - } - #endif /* CONFIG_PM_AUTOSLEEP */ - -@@ -1029,15 +1034,16 @@ static int print_wakeup_source_stats(struct seq_file *m, - static int wakeup_sources_stats_show(struct seq_file *m, void *unused) - { - struct wakeup_source *ws; -+ int srcuidx; - - seq_puts(m, "name\t\tactive_count\tevent_count\twakeup_count\t" - "expire_count\tactive_since\ttotal_time\tmax_time\t" - "last_change\tprevent_suspend_time\n"); - -- rcu_read_lock(); -+ srcuidx = srcu_read_lock(&wakeup_srcu); - list_for_each_entry_rcu(ws, &wakeup_sources, entry) - print_wakeup_source_stats(m, ws); -- rcu_read_unlock(); -+ srcu_read_unlock(&wakeup_srcu, srcuidx); - - print_wakeup_source_stats(m, &deleted_ws); - -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 252142524ff2..6d56877b2e0a 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -36,10 +36,60 @@ static DEFINE_SPINLOCK(driver_lock); - struct class *tpm_class; - dev_t tpm_devt; - --/* -- * tpm_chip_find_get - return tpm_chip for a given chip number -- * @chip_num the device number for the chip -+/** -+ * tpm_try_get_ops() - Get a ref to the tpm_chip -+ * @chip: Chip to ref -+ * -+ * The caller must already have some kind of locking to ensure that chip is -+ * valid. This function will lock the chip so that the ops member can be -+ * accessed safely. The locking prevents tpm_chip_unregister from -+ * completing, so it should not be held for long periods. -+ * -+ * Returns -ERRNO if the chip could not be got. -+ */ -+int tpm_try_get_ops(struct tpm_chip *chip) -+{ -+ int rc = -EIO; -+ -+ get_device(&chip->dev); -+ -+ down_read(&chip->ops_sem); -+ if (!chip->ops) -+ goto out_lock; -+ -+ if (!try_module_get(chip->dev.parent->driver->owner)) -+ goto out_lock; -+ -+ return 0; -+out_lock: -+ up_read(&chip->ops_sem); -+ put_device(&chip->dev); -+ return rc; -+} -+EXPORT_SYMBOL_GPL(tpm_try_get_ops); -+ -+/** -+ * tpm_put_ops() - Release a ref to the tpm_chip -+ * @chip: Chip to put -+ * -+ * This is the opposite pair to tpm_try_get_ops(). After this returns chip may -+ * be kfree'd. - */ -+void tpm_put_ops(struct tpm_chip *chip) -+{ -+ module_put(chip->dev.parent->driver->owner); -+ up_read(&chip->ops_sem); -+ put_device(&chip->dev); -+} -+EXPORT_SYMBOL_GPL(tpm_put_ops); -+ -+/** -+ * tpm_chip_find_get() - return tpm_chip for a given chip number -+ * @chip_num: id to find -+ * -+ * The return'd chip has been tpm_try_get_ops'd and must be released via -+ * tpm_put_ops -+ */ - struct tpm_chip *tpm_chip_find_get(int chip_num) - { - struct tpm_chip *pos, *chip = NULL; -@@ -49,10 +99,10 @@ struct tpm_chip *tpm_chip_find_get(int chip_num) - if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num) - continue; - -- if (try_module_get(pos->pdev->driver->owner)) { -+ /* rcu prevents chip from being free'd */ -+ if (!tpm_try_get_ops(pos)) - chip = pos; -- break; -- } -+ break; - } - rcu_read_unlock(); - return chip; -@@ -74,6 +124,41 @@ static void tpm_dev_release(struct device *dev) - kfree(chip); - } - -+ -+/** -+ * tpm_class_shutdown() - prepare the TPM device for loss of power. -+ * @dev: device to which the chip is associated. -+ * -+ * Issues a TPM2_Shutdown command prior to loss of power, as required by the -+ * TPM 2.0 spec. -+ * Then, calls bus- and device- specific shutdown code. -+ * -+ * XXX: This codepath relies on the fact that sysfs is not enabled for -+ * TPM2: sysfs uses an implicit lock on chip->ops, so this could race if TPM2 -+ * has sysfs support enabled before TPM sysfs's implicit locking is fixed. -+ */ -+static int tpm_class_shutdown(struct device *dev) -+{ -+ struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); -+ -+ if (chip->flags & TPM_CHIP_FLAG_TPM2) { -+ down_write(&chip->ops_sem); -+ tpm2_shutdown(chip, TPM2_SU_CLEAR); -+ chip->ops = NULL; -+ up_write(&chip->ops_sem); -+ } -+ /* Allow bus- and device-specific code to run. Note: since chip->ops -+ * is NULL, more-specific shutdown code will not be able to issue TPM -+ * commands. -+ */ -+ if (dev->bus && dev->bus->shutdown) -+ dev->bus->shutdown(dev); -+ else if (dev->driver && dev->driver->shutdown) -+ dev->driver->shutdown(dev); -+ return 0; -+} -+ -+ - /** - * tpmm_chip_alloc() - allocate a new struct tpm_chip instance - * @dev: device to which the chip is associated -@@ -94,6 +179,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - return ERR_PTR(-ENOMEM); - - mutex_init(&chip->tpm_mutex); -+ init_rwsem(&chip->ops_sem); - INIT_LIST_HEAD(&chip->list); - - chip->ops = ops; -@@ -112,13 +198,12 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - - scnprintf(chip->devname, sizeof(chip->devname), "tpm%d", chip->dev_num); - -- chip->pdev = dev; -- - dev_set_drvdata(dev, chip); - - chip->dev.class = tpm_class; -+ chip->dev.class->shutdown = tpm_class_shutdown; - chip->dev.release = tpm_dev_release; -- chip->dev.parent = chip->pdev; -+ chip->dev.parent = dev; - #ifdef CONFIG_ACPI - chip->dev.groups = chip->groups; - #endif -@@ -133,7 +218,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - device_initialize(&chip->dev); - - cdev_init(&chip->cdev, &tpm_fops); -- chip->cdev.owner = chip->pdev->driver->owner; -+ chip->cdev.owner = dev->driver->owner; - chip->cdev.kobj.parent = &chip->dev.kobj; - - devm_add_action(dev, (void (*)(void *)) put_device, &chip->dev); -@@ -173,6 +258,12 @@ static int tpm_add_char_device(struct tpm_chip *chip) - static void tpm_del_char_device(struct tpm_chip *chip) - { - cdev_del(&chip->cdev); -+ -+ /* Make the driver uncallable. */ -+ down_write(&chip->ops_sem); -+ chip->ops = NULL; -+ up_write(&chip->ops_sem); -+ - device_del(&chip->dev); - } - -@@ -236,9 +327,8 @@ int tpm_chip_register(struct tpm_chip *chip) - chip->flags |= TPM_CHIP_FLAG_REGISTERED; - - if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { -- rc = __compat_only_sysfs_link_entry_to_kobj(&chip->pdev->kobj, -- &chip->dev.kobj, -- "ppi"); -+ rc = __compat_only_sysfs_link_entry_to_kobj( -+ &chip->dev.parent->kobj, &chip->dev.kobj, "ppi"); - if (rc && rc != -ENOENT) { - tpm_chip_unregister(chip); - return rc; -@@ -259,6 +349,9 @@ EXPORT_SYMBOL_GPL(tpm_chip_register); - * Takes the chip first away from the list of available TPM chips and then - * cleans up all the resources reserved by tpm_chip_register(). - * -+ * Once this function returns the driver call backs in 'op's will not be -+ * running and will no longer start. -+ * - * NOTE: This function should be only called before deinitializing chip - * resources. - */ -@@ -273,7 +366,7 @@ void tpm_chip_unregister(struct tpm_chip *chip) - synchronize_rcu(); - - if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) -- sysfs_remove_link(&chip->pdev->kobj, "ppi"); -+ sysfs_remove_link(&chip->dev.parent->kobj, "ppi"); - - tpm1_chip_unregister(chip); - tpm_del_char_device(chip); -diff --git a/drivers/char/tpm/tpm-dev.c b/drivers/char/tpm/tpm-dev.c -index 4f3137d9a35e..912ad30be585 100644 ---- a/drivers/char/tpm/tpm-dev.c -+++ b/drivers/char/tpm/tpm-dev.c -@@ -61,7 +61,7 @@ static int tpm_open(struct inode *inode, struct file *file) - * by the check of is_open variable, which is protected - * by driver_lock. */ - if (test_and_set_bit(0, &chip->is_open)) { -- dev_dbg(chip->pdev, "Another process owns this TPM\n"); -+ dev_dbg(&chip->dev, "Another process owns this TPM\n"); - return -EBUSY; - } - -@@ -79,7 +79,6 @@ static int tpm_open(struct inode *inode, struct file *file) - INIT_WORK(&priv->work, timeout_work); - - file->private_data = priv; -- get_device(chip->pdev); - return 0; - } - -@@ -137,9 +136,18 @@ static ssize_t tpm_write(struct file *file, const char __user *buf, - return -EFAULT; - } - -- /* atomic tpm command send and result receive */ -+ /* atomic tpm command send and result receive. We only hold the ops -+ * lock during this period so that the tpm can be unregistered even if -+ * the char dev is held open. -+ */ -+ if (tpm_try_get_ops(priv->chip)) { -+ mutex_unlock(&priv->buffer_mutex); -+ return -EPIPE; -+ } - out_size = tpm_transmit(priv->chip, priv->data_buffer, - sizeof(priv->data_buffer), 0); -+ -+ tpm_put_ops(priv->chip); - if (out_size < 0) { - mutex_unlock(&priv->buffer_mutex); - return out_size; -@@ -166,7 +174,6 @@ static int tpm_release(struct inode *inode, struct file *file) - file->private_data = NULL; - atomic_set(&priv->data_pending, 0); - clear_bit(0, &priv->chip->is_open); -- put_device(priv->chip->pdev); - kfree(priv); - return 0; - } -diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c -index 17abe52e6365..8588f2e4b9af 100644 ---- a/drivers/char/tpm/tpm-interface.c -+++ b/drivers/char/tpm/tpm-interface.c -@@ -343,7 +343,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, - if (count == 0) - return -ENODATA; - if (count > bufsiz) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "invalid count value %x %zx\n", count, bufsiz); - return -E2BIG; - } -@@ -353,7 +353,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, - - rc = chip->ops->send(chip, (u8 *) buf, count); - if (rc < 0) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "tpm_transmit: tpm_send: error %zd\n", rc); - goto out; - } -@@ -372,7 +372,7 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, - goto out_recv; - - if (chip->ops->req_canceled(chip, status)) { -- dev_err(chip->pdev, "Operation Canceled\n"); -+ dev_err(&chip->dev, "Operation Canceled\n"); - rc = -ECANCELED; - goto out; - } -@@ -382,14 +382,14 @@ ssize_t tpm_transmit(struct tpm_chip *chip, const u8 *buf, size_t bufsiz, - } while (time_before(jiffies, stop)); - - chip->ops->cancel(chip); -- dev_err(chip->pdev, "Operation Timed out\n"); -+ dev_err(&chip->dev, "Operation Timed out\n"); - rc = -ETIME; - goto out; - - out_recv: - rc = chip->ops->recv(chip, (u8 *) buf, bufsiz); - if (rc < 0) -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "tpm_transmit: tpm_recv: error %zd\n", rc); - out: - if (!(flags & TPM_TRANSMIT_UNLOCKED)) -@@ -416,7 +416,7 @@ ssize_t tpm_transmit_cmd(struct tpm_chip *chip, const void *cmd, - - err = be32_to_cpu(header->return_code); - if (err != 0 && desc) -- dev_err(chip->pdev, "A TPM error (%d) occurred %s\n", err, -+ dev_err(&chip->dev, "A TPM error (%d) occurred %s\n", err, - desc); - - return err; -@@ -514,7 +514,7 @@ int tpm_get_timeouts(struct tpm_chip *chip) - if (rc == TPM_ERR_INVALID_POSTINIT) { - /* The TPM is not started, we are the first to talk to it. - Execute a startup command. */ -- dev_info(chip->pdev, "Issuing TPM_STARTUP"); -+ dev_info(&chip->dev, "Issuing TPM_STARTUP"); - if (tpm_startup(chip, TPM_ST_CLEAR)) - return rc; - -@@ -526,7 +526,7 @@ int tpm_get_timeouts(struct tpm_chip *chip) - 0, NULL); - } - if (rc) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "A TPM error (%zd) occurred attempting to determine the timeouts\n", - rc); - goto duration; -@@ -565,7 +565,7 @@ int tpm_get_timeouts(struct tpm_chip *chip) - - /* Report adjusted timeouts */ - if (chip->vendor.timeout_adjusted) { -- dev_info(chip->pdev, -+ dev_info(&chip->dev, - HW_ERR "Adjusting reported timeouts: A %lu->%luus B %lu->%luus C %lu->%luus D %lu->%luus\n", - old_timeout[0], new_timeout[0], - old_timeout[1], new_timeout[1], -@@ -612,7 +612,7 @@ duration: - chip->vendor.duration[TPM_MEDIUM] *= 1000; - chip->vendor.duration[TPM_LONG] *= 1000; - chip->vendor.duration_adjusted = true; -- dev_info(chip->pdev, "Adjusting TPM timeout parameters."); -+ dev_info(&chip->dev, "Adjusting TPM timeout parameters."); - } - return 0; - } -@@ -687,7 +687,7 @@ int tpm_is_tpm2(u32 chip_num) - - rc = (chip->flags & TPM_CHIP_FLAG_TPM2) != 0; - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - - return rc; - } -@@ -716,7 +716,7 @@ int tpm_pcr_read(u32 chip_num, int pcr_idx, u8 *res_buf) - rc = tpm2_pcr_read(chip, pcr_idx, res_buf); - else - rc = tpm_pcr_read_dev(chip, pcr_idx, res_buf); -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return rc; - } - EXPORT_SYMBOL_GPL(tpm_pcr_read); -@@ -751,7 +751,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash) - - if (chip->flags & TPM_CHIP_FLAG_TPM2) { - rc = tpm2_pcr_extend(chip, pcr_idx, hash); -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return rc; - } - -@@ -761,7 +761,7 @@ int tpm_pcr_extend(u32 chip_num, int pcr_idx, const u8 *hash) - rc = tpm_transmit_cmd(chip, &cmd, EXTEND_PCR_RESULT_SIZE, 0, - "attempting extend a PCR value"); - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return rc; - } - EXPORT_SYMBOL_GPL(tpm_pcr_extend); -@@ -802,7 +802,9 @@ int tpm_do_selftest(struct tpm_chip *chip) - * around 300ms while the self test is ongoing, keep trying - * until the self test duration expires. */ - if (rc == -ETIME) { -- dev_info(chip->pdev, HW_ERR "TPM command timed out during continue self test"); -+ dev_info( -+ &chip->dev, HW_ERR -+ "TPM command timed out during continue self test"); - msleep(delay_msec); - continue; - } -@@ -812,7 +814,7 @@ int tpm_do_selftest(struct tpm_chip *chip) - - rc = be32_to_cpu(cmd.header.out.return_code); - if (rc == TPM_ERR_DISABLED || rc == TPM_ERR_DEACTIVATED) { -- dev_info(chip->pdev, -+ dev_info(&chip->dev, - "TPM is disabled/deactivated (0x%X)\n", rc); - /* TPM is disabled and/or deactivated; driver can - * proceed and TPM does handle commands for -@@ -840,7 +842,7 @@ int tpm_send(u32 chip_num, void *cmd, size_t buflen) - - rc = tpm_transmit_cmd(chip, cmd, buflen, 0, "attempting tpm_cmd"); - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return rc; - } - EXPORT_SYMBOL_GPL(tpm_send); -@@ -966,10 +968,10 @@ int tpm_pm_suspend(struct device *dev) - } - - if (rc) -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "Error (%d) sending savestate before suspend\n", rc); - else if (try > 0) -- dev_warn(chip->pdev, "TPM savestate took %dms\n", -+ dev_warn(&chip->dev, "TPM savestate took %dms\n", - try * TPM_TIMEOUT_RETRY); - - return rc; -@@ -1023,7 +1025,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) - - if (chip->flags & TPM_CHIP_FLAG_TPM2) { - err = tpm2_get_random(chip, out, max); -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return err; - } - -@@ -1045,7 +1047,7 @@ int tpm_get_random(u32 chip_num, u8 *out, size_t max) - num_bytes -= recd; - } while (retries-- && total < max); - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return total ? total : -EIO; - } - EXPORT_SYMBOL_GPL(tpm_get_random); -@@ -1071,7 +1073,7 @@ int tpm_seal_trusted(u32 chip_num, struct trusted_key_payload *payload, - - rc = tpm2_seal_trusted(chip, payload, options); - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); - return rc; - } - EXPORT_SYMBOL_GPL(tpm_seal_trusted); -@@ -1097,7 +1099,8 @@ int tpm_unseal_trusted(u32 chip_num, struct trusted_key_payload *payload, - - rc = tpm2_unseal_trusted(chip, payload, options); - -- tpm_chip_put(chip); -+ tpm_put_ops(chip); -+ - return rc; - } - EXPORT_SYMBOL_GPL(tpm_unseal_trusted); -diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c -index f880856aa75e..6a4056a3f7ee 100644 ---- a/drivers/char/tpm/tpm-sysfs.c -+++ b/drivers/char/tpm/tpm-sysfs.c -@@ -284,16 +284,28 @@ static const struct attribute_group tpm_dev_group = { - int tpm_sysfs_add_device(struct tpm_chip *chip) - { - int err; -- err = sysfs_create_group(&chip->pdev->kobj, -+ -+ /* XXX: If you wish to remove this restriction, you must first update -+ * tpm_sysfs to explicitly lock chip->ops. -+ */ -+ if (chip->flags & TPM_CHIP_FLAG_TPM2) -+ return 0; -+ -+ err = sysfs_create_group(&chip->dev.parent->kobj, - &tpm_dev_group); - - if (err) -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "failed to create sysfs attributes, %d\n", err); - return err; - } - - void tpm_sysfs_del_device(struct tpm_chip *chip) - { -- sysfs_remove_group(&chip->pdev->kobj, &tpm_dev_group); -+ /* The sysfs routines rely on an implicit tpm_try_get_ops, this -+ * function is called before ops is null'd and the sysfs core -+ * synchronizes this removal so that no callbacks are running or can -+ * run again -+ */ -+ sysfs_remove_group(&chip->dev.parent->kobj, &tpm_dev_group); - } -diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h -index 2216861f89f1..e21e2c599e66 100644 ---- a/drivers/char/tpm/tpm.h -+++ b/drivers/char/tpm/tpm.h -@@ -171,11 +171,16 @@ enum tpm_chip_flags { - }; - - struct tpm_chip { -- struct device *pdev; /* Device stuff */ - struct device dev; - struct cdev cdev; - -+ /* A driver callback under ops cannot be run unless ops_sem is held -+ * (sometimes implicitly, eg for the sysfs code). ops becomes null -+ * when the driver is unregistered, see tpm_try_get_ops. -+ */ -+ struct rw_semaphore ops_sem; - const struct tpm_class_ops *ops; -+ - unsigned int flags; - - int dev_num; /* /dev/tpm# */ -@@ -201,11 +206,6 @@ struct tpm_chip { - - #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev) - --static inline void tpm_chip_put(struct tpm_chip *chip) --{ -- module_put(chip->pdev->driver->owner); --} -- - static inline int tpm_read_index(int base, int index) - { - outb(index, base); -@@ -517,6 +517,9 @@ extern int wait_for_tpm_stat(struct tpm_chip *, u8, unsigned long, - wait_queue_head_t *, bool); - - struct tpm_chip *tpm_chip_find_get(int chip_num); -+__must_check int tpm_try_get_ops(struct tpm_chip *chip); -+void tpm_put_ops(struct tpm_chip *chip); -+ - extern struct tpm_chip *tpmm_chip_alloc(struct device *dev, - const struct tpm_class_ops *ops); - extern int tpm_chip_register(struct tpm_chip *chip); -diff --git a/drivers/char/tpm/tpm2-cmd.c b/drivers/char/tpm/tpm2-cmd.c -index cb7e4f6b70ba..286bd090a488 100644 ---- a/drivers/char/tpm/tpm2-cmd.c -+++ b/drivers/char/tpm/tpm2-cmd.c -@@ -570,7 +570,7 @@ static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle, - - rc = tpm_buf_init(&buf, TPM2_ST_NO_SESSIONS, TPM2_CC_FLUSH_CONTEXT); - if (rc) { -- dev_warn(chip->pdev, "0x%08x was not flushed, out of memory\n", -+ dev_warn(&chip->dev, "0x%08x was not flushed, out of memory\n", - handle); - return; - } -@@ -580,7 +580,7 @@ static void tpm2_flush_context_cmd(struct tpm_chip *chip, u32 handle, - rc = tpm_transmit_cmd(chip, buf.data, PAGE_SIZE, flags, - "flushing context"); - if (rc) -- dev_warn(chip->pdev, "0x%08x was not flushed, rc=%d\n", handle, -+ dev_warn(&chip->dev, "0x%08x was not flushed, rc=%d\n", handle, - rc); - - tpm_buf_destroy(&buf); -@@ -753,7 +753,7 @@ void tpm2_shutdown(struct tpm_chip *chip, u16 shutdown_type) - * except print the error code on a system failure. - */ - if (rc < 0) -- dev_warn(chip->pdev, "transmit returned %d while stopping the TPM", -+ dev_warn(&chip->dev, "transmit returned %d while stopping the TPM", - rc); - } - EXPORT_SYMBOL_GPL(tpm2_shutdown); -@@ -820,7 +820,7 @@ static int tpm2_start_selftest(struct tpm_chip *chip, bool full) - * immediately. This is a workaround for that. - */ - if (rc == TPM2_RC_TESTING) { -- dev_warn(chip->pdev, "Got RC_TESTING, ignoring\n"); -+ dev_warn(&chip->dev, "Got RC_TESTING, ignoring\n"); - rc = 0; - } - -diff --git a/drivers/char/tpm/tpm_atmel.c b/drivers/char/tpm/tpm_atmel.c -index dfadad0916a1..a48a878f791d 100644 ---- a/drivers/char/tpm/tpm_atmel.c -+++ b/drivers/char/tpm/tpm_atmel.c -@@ -49,7 +49,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count) - for (i = 0; i < 6; i++) { - status = ioread8(chip->vendor.iobase + 1); - if ((status & ATML_STATUS_DATA_AVAIL) == 0) { -- dev_err(chip->pdev, "error reading header\n"); -+ dev_err(&chip->dev, "error reading header\n"); - return -EIO; - } - *buf++ = ioread8(chip->vendor.iobase); -@@ -60,12 +60,12 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count) - size = be32_to_cpu(*native_size); - - if (count < size) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "Recv size(%d) less than available space\n", size); - for (; i < size; i++) { /* clear the waiting data anyway */ - status = ioread8(chip->vendor.iobase + 1); - if ((status & ATML_STATUS_DATA_AVAIL) == 0) { -- dev_err(chip->pdev, "error reading data\n"); -+ dev_err(&chip->dev, "error reading data\n"); - return -EIO; - } - } -@@ -76,7 +76,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count) - for (; i < size; i++) { - status = ioread8(chip->vendor.iobase + 1); - if ((status & ATML_STATUS_DATA_AVAIL) == 0) { -- dev_err(chip->pdev, "error reading data\n"); -+ dev_err(&chip->dev, "error reading data\n"); - return -EIO; - } - *buf++ = ioread8(chip->vendor.iobase); -@@ -86,7 +86,7 @@ static int tpm_atml_recv(struct tpm_chip *chip, u8 *buf, size_t count) - status = ioread8(chip->vendor.iobase + 1); - - if (status & ATML_STATUS_DATA_AVAIL) { -- dev_err(chip->pdev, "data available is stuck\n"); -+ dev_err(&chip->dev, "data available is stuck\n"); - return -EIO; - } - -@@ -97,9 +97,9 @@ static int tpm_atml_send(struct tpm_chip *chip, u8 *buf, size_t count) - { - int i; - -- dev_dbg(chip->pdev, "tpm_atml_send:\n"); -+ dev_dbg(&chip->dev, "tpm_atml_send:\n"); - for (i = 0; i < count; i++) { -- dev_dbg(chip->pdev, "%d 0x%x(%d)\n", i, buf[i], buf[i]); -+ dev_dbg(&chip->dev, "%d 0x%x(%d)\n", i, buf[i], buf[i]); - iowrite8(buf[i], chip->vendor.iobase); - } - -diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c -index 8dfb88b9739c..dd8f0eb3170a 100644 ---- a/drivers/char/tpm/tpm_i2c_atmel.c -+++ b/drivers/char/tpm/tpm_i2c_atmel.c -@@ -52,7 +52,7 @@ struct priv_data { - static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) - { - struct priv_data *priv = chip->vendor.priv; -- struct i2c_client *client = to_i2c_client(chip->pdev); -+ struct i2c_client *client = to_i2c_client(chip->dev.parent); - s32 status; - - priv->len = 0; -@@ -62,7 +62,7 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) - - status = i2c_master_send(client, buf, len); - -- dev_dbg(chip->pdev, -+ dev_dbg(&chip->dev, - "%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__, - (int)min_t(size_t, 64, len), buf, len, status); - return status; -@@ -71,7 +71,7 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len) - static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) - { - struct priv_data *priv = chip->vendor.priv; -- struct i2c_client *client = to_i2c_client(chip->pdev); -+ struct i2c_client *client = to_i2c_client(chip->dev.parent); - struct tpm_output_header *hdr = - (struct tpm_output_header *)priv->buffer; - u32 expected_len; -@@ -88,7 +88,7 @@ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) - return -ENOMEM; - - if (priv->len >= expected_len) { -- dev_dbg(chip->pdev, -+ dev_dbg(&chip->dev, - "%s early(buf=%*ph count=%0zx) -> ret=%d\n", __func__, - (int)min_t(size_t, 64, expected_len), buf, count, - expected_len); -@@ -97,7 +97,7 @@ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) - } - - rc = i2c_master_recv(client, buf, expected_len); -- dev_dbg(chip->pdev, -+ dev_dbg(&chip->dev, - "%s reread(buf=%*ph count=%0zx) -> ret=%d\n", __func__, - (int)min_t(size_t, 64, expected_len), buf, count, - expected_len); -@@ -106,13 +106,13 @@ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count) - - static void i2c_atmel_cancel(struct tpm_chip *chip) - { -- dev_err(chip->pdev, "TPM operation cancellation was requested, but is not supported"); -+ dev_err(&chip->dev, "TPM operation cancellation was requested, but is not supported"); - } - - static u8 i2c_atmel_read_status(struct tpm_chip *chip) - { - struct priv_data *priv = chip->vendor.priv; -- struct i2c_client *client = to_i2c_client(chip->pdev); -+ struct i2c_client *client = to_i2c_client(chip->dev.parent); - int rc; - - /* The TPM fails the I2C read until it is ready, so we do the entire -@@ -125,7 +125,7 @@ static u8 i2c_atmel_read_status(struct tpm_chip *chip) - /* Once the TPM has completed the command the command remains readable - * until another command is issued. */ - rc = i2c_master_recv(client, priv->buffer, sizeof(priv->buffer)); -- dev_dbg(chip->pdev, -+ dev_dbg(&chip->dev, - "%s: sts=%d", __func__, rc); - if (rc <= 0) - return 0; -diff --git a/drivers/char/tpm/tpm_i2c_infineon.c b/drivers/char/tpm/tpm_i2c_infineon.c -index 63d5d22e9e60..f2aa99e34b4b 100644 ---- a/drivers/char/tpm/tpm_i2c_infineon.c -+++ b/drivers/char/tpm/tpm_i2c_infineon.c -@@ -446,7 +446,7 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) - /* read first 10 bytes, including tag, paramsize, and result */ - size = recv_data(chip, buf, TPM_HEADER_SIZE); - if (size < TPM_HEADER_SIZE) { -- dev_err(chip->pdev, "Unable to read header\n"); -+ dev_err(&chip->dev, "Unable to read header\n"); - goto out; - } - -@@ -459,14 +459,14 @@ static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count) - size += recv_data(chip, &buf[TPM_HEADER_SIZE], - expected - TPM_HEADER_SIZE); - if (size < expected) { -- dev_err(chip->pdev, "Unable to read remainder of result\n"); -+ dev_err(&chip->dev, "Unable to read remainder of result\n"); - size = -ETIME; - goto out; - } - - wait_for_stat(chip, TPM_STS_VALID, chip->vendor.timeout_c, &status); - if (status & TPM_STS_DATA_AVAIL) { /* retry? */ -- dev_err(chip->pdev, "Error left over data\n"); -+ dev_err(&chip->dev, "Error left over data\n"); - size = -EIO; - goto out; - } -diff --git a/drivers/char/tpm/tpm_i2c_nuvoton.c b/drivers/char/tpm/tpm_i2c_nuvoton.c -index 847f1597fe9b..a1e1474dda30 100644 ---- a/drivers/char/tpm/tpm_i2c_nuvoton.c -+++ b/drivers/char/tpm/tpm_i2c_nuvoton.c -@@ -96,13 +96,13 @@ static s32 i2c_nuvoton_write_buf(struct i2c_client *client, u8 offset, u8 size, - /* read TPM_STS register */ - static u8 i2c_nuvoton_read_status(struct tpm_chip *chip) - { -- struct i2c_client *client = to_i2c_client(chip->pdev); -+ struct i2c_client *client = to_i2c_client(chip->dev.parent); - s32 status; - u8 data; - - status = i2c_nuvoton_read_buf(client, TPM_STS, 1, &data); - if (status <= 0) { -- dev_err(chip->pdev, "%s() error return %d\n", __func__, -+ dev_err(&chip->dev, "%s() error return %d\n", __func__, - status); - data = TPM_STS_ERR_VAL; - } -@@ -127,13 +127,13 @@ static s32 i2c_nuvoton_write_status(struct i2c_client *client, u8 data) - /* write commandReady to TPM_STS register */ - static void i2c_nuvoton_ready(struct tpm_chip *chip) - { -- struct i2c_client *client = to_i2c_client(chip->pdev); -+ struct i2c_client *client = to_i2c_client(chip->dev.parent); - s32 status; - - /* this causes the current command to be aborted */ - status = i2c_nuvoton_write_status(client, TPM_STS_COMMAND_READY); - if (status < 0) -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "%s() fail to write TPM_STS.commandReady\n", __func__); - } - -@@ -212,7 +212,7 @@ static int i2c_nuvoton_wait_for_stat(struct tpm_chip *chip, u8 mask, u8 value, - return 0; - } while (time_before(jiffies, stop)); - } -- dev_err(chip->pdev, "%s(%02x, %02x) -> timeout\n", __func__, mask, -+ dev_err(&chip->dev, "%s(%02x, %02x) -> timeout\n", __func__, mask, - value); - return -ETIMEDOUT; - } -@@ -240,7 +240,7 @@ static int i2c_nuvoton_recv_data(struct i2c_client *client, - &chip->vendor.read_queue) == 0) { - burst_count = i2c_nuvoton_get_burstcount(client, chip); - if (burst_count < 0) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "%s() fail to read burstCount=%d\n", __func__, - burst_count); - return -EIO; -@@ -249,12 +249,12 @@ static int i2c_nuvoton_recv_data(struct i2c_client *client, - rc = i2c_nuvoton_read_buf(client, TPM_DATA_FIFO_R, - bytes2read, &buf[size]); - if (rc < 0) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "%s() fail on i2c_nuvoton_read_buf()=%d\n", - __func__, rc); - return -EIO; - } -- dev_dbg(chip->pdev, "%s(%d):", __func__, bytes2read); -+ dev_dbg(&chip->dev, "%s(%d):", __func__, bytes2read); - size += bytes2read; - } - -@@ -264,7 +264,7 @@ static int i2c_nuvoton_recv_data(struct i2c_client *client, - /* Read TPM command results */ - static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) - { -- struct device *dev = chip->pdev; -+ struct device *dev = chip->dev.parent; - struct i2c_client *client = to_i2c_client(dev); - s32 rc; - int expected, status, burst_count, retries, size = 0; -@@ -334,7 +334,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) - break; - } - i2c_nuvoton_ready(chip); -- dev_dbg(chip->pdev, "%s() -> %d\n", __func__, size); -+ dev_dbg(&chip->dev, "%s() -> %d\n", __func__, size); - return size; - } - -@@ -347,7 +347,7 @@ static int i2c_nuvoton_recv(struct tpm_chip *chip, u8 *buf, size_t count) - */ - static int i2c_nuvoton_send(struct tpm_chip *chip, u8 *buf, size_t len) - { -- struct device *dev = chip->pdev; -+ struct device *dev = chip->dev.parent; - struct i2c_client *client = to_i2c_client(dev); - u32 ordinal; - size_t count = 0; -diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c -index 6c488e635fdd..e3cf9f3545c5 100644 ---- a/drivers/char/tpm/tpm_infineon.c -+++ b/drivers/char/tpm/tpm_infineon.c -@@ -195,9 +195,9 @@ static int wait(struct tpm_chip *chip, int wait_for_bit) - } - if (i == TPM_MAX_TRIES) { /* timeout occurs */ - if (wait_for_bit == STAT_XFE) -- dev_err(chip->pdev, "Timeout in wait(STAT_XFE)\n"); -+ dev_err(&chip->dev, "Timeout in wait(STAT_XFE)\n"); - if (wait_for_bit == STAT_RDA) -- dev_err(chip->pdev, "Timeout in wait(STAT_RDA)\n"); -+ dev_err(&chip->dev, "Timeout in wait(STAT_RDA)\n"); - return -EIO; - } - return 0; -@@ -220,7 +220,7 @@ static void wait_and_send(struct tpm_chip *chip, u8 sendbyte) - static void tpm_wtx(struct tpm_chip *chip) - { - number_of_wtx++; -- dev_info(chip->pdev, "Granting WTX (%02d / %02d)\n", -+ dev_info(&chip->dev, "Granting WTX (%02d / %02d)\n", - number_of_wtx, TPM_MAX_WTX_PACKAGES); - wait_and_send(chip, TPM_VL_VER); - wait_and_send(chip, TPM_CTRL_WTX); -@@ -231,7 +231,7 @@ static void tpm_wtx(struct tpm_chip *chip) - - static void tpm_wtx_abort(struct tpm_chip *chip) - { -- dev_info(chip->pdev, "Aborting WTX\n"); -+ dev_info(&chip->dev, "Aborting WTX\n"); - wait_and_send(chip, TPM_VL_VER); - wait_and_send(chip, TPM_CTRL_WTX_ABORT); - wait_and_send(chip, 0x00); -@@ -257,7 +257,7 @@ recv_begin: - } - - if (buf[0] != TPM_VL_VER) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "Wrong transport protocol implementation!\n"); - return -EIO; - } -@@ -272,7 +272,7 @@ recv_begin: - } - - if ((size == 0x6D00) && (buf[1] == 0x80)) { -- dev_err(chip->pdev, "Error handling on vendor layer!\n"); -+ dev_err(&chip->dev, "Error handling on vendor layer!\n"); - return -EIO; - } - -@@ -284,7 +284,7 @@ recv_begin: - } - - if (buf[1] == TPM_CTRL_WTX) { -- dev_info(chip->pdev, "WTX-package received\n"); -+ dev_info(&chip->dev, "WTX-package received\n"); - if (number_of_wtx < TPM_MAX_WTX_PACKAGES) { - tpm_wtx(chip); - goto recv_begin; -@@ -295,14 +295,14 @@ recv_begin: - } - - if (buf[1] == TPM_CTRL_WTX_ABORT_ACK) { -- dev_info(chip->pdev, "WTX-abort acknowledged\n"); -+ dev_info(&chip->dev, "WTX-abort acknowledged\n"); - return size; - } - - if (buf[1] == TPM_CTRL_ERROR) { -- dev_err(chip->pdev, "ERROR-package received:\n"); -+ dev_err(&chip->dev, "ERROR-package received:\n"); - if (buf[4] == TPM_INF_NAK) -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "-> Negative acknowledgement" - " - retransmit command!\n"); - return -EIO; -@@ -321,7 +321,7 @@ static int tpm_inf_send(struct tpm_chip *chip, u8 * buf, size_t count) - - ret = empty_fifo(chip, 1); - if (ret) { -- dev_err(chip->pdev, "Timeout while clearing FIFO\n"); -+ dev_err(&chip->dev, "Timeout while clearing FIFO\n"); - return -EIO; - } - -diff --git a/drivers/char/tpm/tpm_nsc.c b/drivers/char/tpm/tpm_nsc.c -index 289389ecef84..766370bed60c 100644 ---- a/drivers/char/tpm/tpm_nsc.c -+++ b/drivers/char/tpm/tpm_nsc.c -@@ -113,7 +113,7 @@ static int nsc_wait_for_ready(struct tpm_chip *chip) - } - while (time_before(jiffies, stop)); - -- dev_info(chip->pdev, "wait for ready failed\n"); -+ dev_info(&chip->dev, "wait for ready failed\n"); - return -EBUSY; - } - -@@ -129,12 +129,12 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count) - return -EIO; - - if (wait_for_stat(chip, NSC_STATUS_F0, NSC_STATUS_F0, &data) < 0) { -- dev_err(chip->pdev, "F0 timeout\n"); -+ dev_err(&chip->dev, "F0 timeout\n"); - return -EIO; - } - if ((data = - inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_NORMAL) { -- dev_err(chip->pdev, "not in normal mode (0x%x)\n", -+ dev_err(&chip->dev, "not in normal mode (0x%x)\n", - data); - return -EIO; - } -@@ -143,7 +143,7 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count) - for (p = buffer; p < &buffer[count]; p++) { - if (wait_for_stat - (chip, NSC_STATUS_OBF, NSC_STATUS_OBF, &data) < 0) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "OBF timeout (while reading data)\n"); - return -EIO; - } -@@ -154,11 +154,11 @@ static int tpm_nsc_recv(struct tpm_chip *chip, u8 * buf, size_t count) - - if ((data & NSC_STATUS_F0) == 0 && - (wait_for_stat(chip, NSC_STATUS_F0, NSC_STATUS_F0, &data) < 0)) { -- dev_err(chip->pdev, "F0 not set\n"); -+ dev_err(&chip->dev, "F0 not set\n"); - return -EIO; - } - if ((data = inb(chip->vendor.base + NSC_DATA)) != NSC_COMMAND_EOC) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "expected end of command(0x%x)\n", data); - return -EIO; - } -@@ -189,19 +189,19 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count) - return -EIO; - - if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) { -- dev_err(chip->pdev, "IBF timeout\n"); -+ dev_err(&chip->dev, "IBF timeout\n"); - return -EIO; - } - - outb(NSC_COMMAND_NORMAL, chip->vendor.base + NSC_COMMAND); - if (wait_for_stat(chip, NSC_STATUS_IBR, NSC_STATUS_IBR, &data) < 0) { -- dev_err(chip->pdev, "IBR timeout\n"); -+ dev_err(&chip->dev, "IBR timeout\n"); - return -EIO; - } - - for (i = 0; i < count; i++) { - if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) { -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - "IBF timeout (while writing data)\n"); - return -EIO; - } -@@ -209,7 +209,7 @@ static int tpm_nsc_send(struct tpm_chip *chip, u8 * buf, size_t count) - } - - if (wait_for_stat(chip, NSC_STATUS_IBF, 0, &data) < 0) { -- dev_err(chip->pdev, "IBF timeout\n"); -+ dev_err(&chip->dev, "IBF timeout\n"); - return -EIO; - } - outb(NSC_COMMAND_EOC, chip->vendor.base + NSC_COMMAND); -diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c -index f10a107614b4..7f13221aeb30 100644 ---- a/drivers/char/tpm/tpm_tis.c -+++ b/drivers/char/tpm/tpm_tis.c -@@ -293,7 +293,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) - /* read first 10 bytes, including tag, paramsize, and result */ - if ((size = - recv_data(chip, buf, TPM_HEADER_SIZE)) < TPM_HEADER_SIZE) { -- dev_err(chip->pdev, "Unable to read header\n"); -+ dev_err(&chip->dev, "Unable to read header\n"); - goto out; - } - -@@ -306,7 +306,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) - if ((size += - recv_data(chip, &buf[TPM_HEADER_SIZE], - expected - TPM_HEADER_SIZE)) < expected) { -- dev_err(chip->pdev, "Unable to read remainder of result\n"); -+ dev_err(&chip->dev, "Unable to read remainder of result\n"); - size = -ETIME; - goto out; - } -@@ -315,7 +315,7 @@ static int tpm_tis_recv(struct tpm_chip *chip, u8 *buf, size_t count) - &chip->vendor.int_queue, false); - status = tpm_tis_status(chip); - if (status & TPM_STS_DATA_AVAIL) { /* retry? */ -- dev_err(chip->pdev, "Error left over data\n"); -+ dev_err(&chip->dev, "Error left over data\n"); - size = -EIO; - goto out; - } -@@ -401,7 +401,7 @@ static void disable_interrupts(struct tpm_chip *chip) - iowrite32(intmask, - chip->vendor.iobase + - TPM_INT_ENABLE(chip->vendor.locality)); -- devm_free_irq(chip->pdev, chip->vendor.irq, chip); -+ devm_free_irq(&chip->dev, chip->vendor.irq, chip); - chip->vendor.irq = 0; - } - -@@ -463,7 +463,7 @@ static int tpm_tis_send(struct tpm_chip *chip, u8 *buf, size_t len) - msleep(1); - if (!priv->irq_tested) { - disable_interrupts(chip); -- dev_err(chip->pdev, -+ dev_err(&chip->dev, - FW_BUG "TPM interrupt not working, polling instead\n"); - } - priv->irq_tested = true; -@@ -533,7 +533,7 @@ static int probe_itpm(struct tpm_chip *chip) - - rc = tpm_tis_send_data(chip, cmd_getticks, len); - if (rc == 0) { -- dev_info(chip->pdev, "Detected an iTPM.\n"); -+ dev_info(&chip->dev, "Detected an iTPM.\n"); - rc = 1; - } else - rc = -EFAULT; -@@ -766,7 +766,7 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info, - if (devm_request_irq - (dev, i, tis_int_probe, IRQF_SHARED, - chip->devname, chip) != 0) { -- dev_info(chip->pdev, -+ dev_info(&chip->dev, - "Unable to request irq: %d for probe\n", - i); - continue; -@@ -818,7 +818,7 @@ static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info, - if (devm_request_irq - (dev, chip->vendor.irq, tis_int_handler, IRQF_SHARED, - chip->devname, chip) != 0) { -- dev_info(chip->pdev, -+ dev_info(&chip->dev, - "Unable to request irq: %d for use\n", - chip->vendor.irq); - chip->vendor.irq = 0; -diff --git a/drivers/crypto/atmel-sha.c b/drivers/crypto/atmel-sha.c -index 0dadb6332f0e..7abe908427df 100644 ---- a/drivers/crypto/atmel-sha.c -+++ b/drivers/crypto/atmel-sha.c -@@ -963,7 +963,9 @@ static int atmel_sha_finup(struct ahash_request *req) - ctx->flags |= SHA_FLAGS_FINUP; - - err1 = atmel_sha_update(req); -- if (err1 == -EINPROGRESS || err1 == -EBUSY) -+ if (err1 == -EINPROGRESS || -+ (err1 == -EBUSY && (ahash_request_flags(req) & -+ CRYPTO_TFM_REQ_MAY_BACKLOG))) - return err1; - - /* -diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c -index 99d5e11db194..e06cc5df30be 100644 ---- a/drivers/crypto/caam/caamhash.c -+++ b/drivers/crypto/caam/caamhash.c -@@ -498,7 +498,7 @@ static int hash_digest_key(struct caam_hash_ctx *ctx, const u8 *key_in, - ret = caam_jr_enqueue(jrdev, desc, split_key_done, &result); - if (!ret) { - /* in progress */ -- wait_for_completion_interruptible(&result.completion); -+ wait_for_completion(&result.completion); - ret = result.err; - #ifdef DEBUG - print_hex_dump(KERN_ERR, -diff --git a/drivers/crypto/caam/key_gen.c b/drivers/crypto/caam/key_gen.c -index e1eaf4ff9762..3ce1d5cdcbd2 100644 ---- a/drivers/crypto/caam/key_gen.c -+++ b/drivers/crypto/caam/key_gen.c -@@ -103,7 +103,7 @@ int gen_split_key(struct device *jrdev, u8 *key_out, int split_key_len, - ret = caam_jr_enqueue(jrdev, desc, split_key_done, &result); - if (!ret) { - /* in progress */ -- wait_for_completion_interruptible(&result.completion); -+ wait_for_completion(&result.completion); - ret = result.err; - #ifdef DEBUG - print_hex_dump(KERN_ERR, "ctx.key@"__stringify(__LINE__)": ", -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 9a8a18aafd5c..6a60936b46e0 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -804,7 +804,7 @@ static void talitos_unregister_rng(struct device *dev) - * crypto alg - */ - #define TALITOS_CRA_PRIORITY 3000 --#define TALITOS_MAX_KEY_SIZE 96 -+#define TALITOS_MAX_KEY_SIZE (AES_MAX_KEY_SIZE + SHA512_BLOCK_SIZE) - #define TALITOS_MAX_IV_LENGTH 16 /* max of AES_BLOCK_SIZE, DES3_EDE_BLOCK_SIZE */ - - struct talitos_ctx { -@@ -1388,6 +1388,11 @@ static int ablkcipher_setkey(struct crypto_ablkcipher *cipher, - { - struct talitos_ctx *ctx = crypto_ablkcipher_ctx(cipher); - -+ if (keylen > TALITOS_MAX_KEY_SIZE) { -+ crypto_ablkcipher_set_flags(cipher, CRYPTO_TFM_RES_BAD_KEY_LEN); -+ return -EINVAL; -+ } -+ - memcpy(&ctx->key, key, keylen); - ctx->keylen = keylen; - -diff --git a/drivers/irqchip/irq-gic-v3.c b/drivers/irqchip/irq-gic-v3.c -index e33c729b9f48..5a1490b046ac 100644 ---- a/drivers/irqchip/irq-gic-v3.c -+++ b/drivers/irqchip/irq-gic-v3.c -@@ -632,6 +632,9 @@ static int gic_set_affinity(struct irq_data *d, const struct cpumask *mask_val, - int enabled; - u64 val; - -+ if (cpu >= nr_cpu_ids) -+ return -EINVAL; -+ - if (gic_irq_in_rdist(d)) - return -EINVAL; - -diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c -index 84b9cca152eb..e83acc608678 100644 ---- a/drivers/net/phy/dp83640.c -+++ b/drivers/net/phy/dp83640.c -@@ -907,7 +907,7 @@ static void decode_txts(struct dp83640_private *dp83640, - if (overflow) { - pr_debug("tx timestamp queue overflow, count %d\n", overflow); - while (skb) { -- skb_complete_tx_timestamp(skb, NULL); -+ kfree_skb(skb); - skb = skb_dequeue(&dp83640->tx_queue); - } - return; -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index e13ad6cdcc22..c8b85f1069ff 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -539,6 +539,8 @@ static int ksz9031_read_status(struct phy_device *phydev) - if ((regval & 0xFF) == 0xFF) { - phy_init_hw(phydev); - phydev->link = 0; -+ if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev)) -+ phydev->drv->config_intr(phydev); - } - - return 0; -diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c -index 349aecbc210a..ac945f8781ac 100644 ---- a/drivers/net/vrf.c -+++ b/drivers/net/vrf.c -@@ -733,15 +733,15 @@ static int vrf_del_slave(struct net_device *dev, struct net_device *port_dev) - static void vrf_dev_uninit(struct net_device *dev) - { - struct net_vrf *vrf = netdev_priv(dev); -- struct slave_queue *queue = &vrf->queue; -- struct list_head *head = &queue->all_slaves; -- struct slave *slave, *next; -+// struct slave_queue *queue = &vrf->queue; -+// struct list_head *head = &queue->all_slaves; -+// struct slave *slave, *next; - - vrf_rtable_destroy(vrf); - vrf_rt6_destroy(vrf); - -- list_for_each_entry_safe(slave, next, head, list) -- vrf_del_slave(dev, slave->dev); -+// list_for_each_entry_safe(slave, next, head, list) -+// vrf_del_slave(dev, slave->dev); - - free_percpu(dev->dstats); - dev->dstats = NULL; -@@ -914,6 +914,14 @@ static int vrf_validate(struct nlattr *tb[], struct nlattr *data[]) - - static void vrf_dellink(struct net_device *dev, struct list_head *head) - { -+ struct net_vrf *vrf = netdev_priv(dev); -+ struct slave_queue *queue = &vrf->queue; -+ struct list_head *all_slaves = &queue->all_slaves; -+ struct slave *slave, *next; -+ -+ list_for_each_entry_safe(slave, next, all_slaves, list) -+ vrf_del_slave(dev, slave->dev); -+ - unregister_netdevice_queue(dev, head); - } - -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -index 70a6985334d5..da5826d788d6 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -@@ -4472,6 +4472,11 @@ brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev, - cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true, - GFP_KERNEL); - } else if (ieee80211_is_action(mgmt->frame_control)) { -+ if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) { -+ brcmf_err("invalid action frame length\n"); -+ err = -EINVAL; -+ goto exit; -+ } - af_params = kzalloc(sizeof(*af_params), GFP_KERNEL); - if (af_params == NULL) { - brcmf_err("unable to allocate frame\n"); -diff --git a/drivers/parisc/ccio-dma.c b/drivers/parisc/ccio-dma.c -index 8e11fb2831cd..34f1d6b41fb9 100644 ---- a/drivers/parisc/ccio-dma.c -+++ b/drivers/parisc/ccio-dma.c -@@ -741,6 +741,8 @@ ccio_map_single(struct device *dev, void *addr, size_t size, - - BUG_ON(!dev); - ioc = GET_IOC(dev); -+ if (!ioc) -+ return DMA_ERROR_CODE; - - BUG_ON(size <= 0); - -@@ -805,6 +807,10 @@ ccio_unmap_single(struct device *dev, dma_addr_t iova, size_t size, - - BUG_ON(!dev); - ioc = GET_IOC(dev); -+ if (!ioc) { -+ WARN_ON(!ioc); -+ return; -+ } - - DBG_RUN("%s() iovp 0x%lx/%x\n", - __func__, (long)iova, size); -@@ -908,6 +914,8 @@ ccio_map_sg(struct device *dev, struct scatterlist *sglist, int nents, - - BUG_ON(!dev); - ioc = GET_IOC(dev); -+ if (!ioc) -+ return 0; - - DBG_RUN_SG("%s() START %d entries\n", __func__, nents); - -@@ -980,6 +988,10 @@ ccio_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - - BUG_ON(!dev); - ioc = GET_IOC(dev); -+ if (!ioc) { -+ WARN_ON(!ioc); -+ return; -+ } - - DBG_RUN_SG("%s() START %d entries, %p,%x\n", - __func__, nents, sg_virt(sglist), sglist->length); -diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c -index a0580afe1713..7b0ca1551d7b 100644 ---- a/drivers/parisc/dino.c -+++ b/drivers/parisc/dino.c -@@ -154,7 +154,10 @@ struct dino_device - }; - - /* Looks nice and keeps the compiler happy */ --#define DINO_DEV(d) ((struct dino_device *) d) -+#define DINO_DEV(d) ({ \ -+ void *__pdata = d; \ -+ BUG_ON(!__pdata); \ -+ (struct dino_device *)__pdata; }) - - - /* -diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c -index 42844c2bc065..d0c2759076a2 100644 ---- a/drivers/parisc/lba_pci.c -+++ b/drivers/parisc/lba_pci.c -@@ -111,8 +111,10 @@ static u32 lba_t32; - - - /* Looks nice and keeps the compiler happy */ --#define LBA_DEV(d) ((struct lba_device *) (d)) -- -+#define LBA_DEV(d) ({ \ -+ void *__pdata = d; \ -+ BUG_ON(!__pdata); \ -+ (struct lba_device *)__pdata; }) - - /* - ** Only allow 8 subsidiary busses per LBA -diff --git a/drivers/parisc/sba_iommu.c b/drivers/parisc/sba_iommu.c -index 225049b492e5..d6326144ce01 100644 ---- a/drivers/parisc/sba_iommu.c -+++ b/drivers/parisc/sba_iommu.c -@@ -691,6 +691,8 @@ static int sba_dma_supported( struct device *dev, u64 mask) - return 0; - - ioc = GET_IOC(dev); -+ if (!ioc) -+ return 0; - - /* - * check if mask is >= than the current max IO Virt Address -@@ -722,6 +724,8 @@ sba_map_single(struct device *dev, void *addr, size_t size, - int pide; - - ioc = GET_IOC(dev); -+ if (!ioc) -+ return DMA_ERROR_CODE; - - /* save offset bits */ - offset = ((dma_addr_t) (long) addr) & ~IOVP_MASK; -@@ -803,6 +807,10 @@ sba_unmap_single(struct device *dev, dma_addr_t iova, size_t size, - DBG_RUN("%s() iovp 0x%lx/%x\n", __func__, (long) iova, size); - - ioc = GET_IOC(dev); -+ if (!ioc) { -+ WARN_ON(!ioc); -+ return; -+ } - offset = iova & ~IOVP_MASK; - iova ^= offset; /* clear offset bits */ - size += offset; -@@ -942,6 +950,8 @@ sba_map_sg(struct device *dev, struct scatterlist *sglist, int nents, - DBG_RUN_SG("%s() START %d entries\n", __func__, nents); - - ioc = GET_IOC(dev); -+ if (!ioc) -+ return 0; - - /* Fast path single entry scatterlists. */ - if (nents == 1) { -@@ -1027,6 +1037,10 @@ sba_unmap_sg(struct device *dev, struct scatterlist *sglist, int nents, - __func__, nents, sg_virt(sglist), sglist->length); - - ioc = GET_IOC(dev); -+ if (!ioc) { -+ WARN_ON(!ioc); -+ return; -+ } - - #ifdef SBA_COLLECT_STATS - ioc->usg_calls++; -diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c -index 5ab54ef4f304..e4f69bddcfb1 100644 ---- a/drivers/tty/vt/vt.c -+++ b/drivers/tty/vt/vt.c -@@ -2708,13 +2708,13 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) - * related to the kernel should not use this. - */ - data = vt_get_shift_state(); -- ret = __put_user(data, p); -+ ret = put_user(data, p); - break; - case TIOCL_GETMOUSEREPORTING: - console_lock(); /* May be overkill */ - data = mouse_reporting(); - console_unlock(); -- ret = __put_user(data, p); -+ ret = put_user(data, p); - break; - case TIOCL_SETVESABLANK: - console_lock(); -@@ -2723,7 +2723,7 @@ int tioclinux(struct tty_struct *tty, unsigned long arg) - break; - case TIOCL_GETKMSGREDIRECT: - data = vt_get_kmsg_redirect(); -- ret = __put_user(data, p); -+ ret = put_user(data, p); - break; - case TIOCL_SETKMSGREDIRECT: - if (!capable(CAP_SYS_ADMIN)) { -diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c -index 29ef427c0652..f44e93d2650d 100644 ---- a/fs/binfmt_elf.c -+++ b/fs/binfmt_elf.c -@@ -905,17 +905,60 @@ static int load_elf_binary(struct linux_binprm *bprm) - elf_flags = MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE; - - vaddr = elf_ppnt->p_vaddr; -+ /* -+ * If we are loading ET_EXEC or we have already performed -+ * the ET_DYN load_addr calculations, proceed normally. -+ */ - if (loc->elf_ex.e_type == ET_EXEC || load_addr_set) { - elf_flags |= MAP_FIXED; - } else if (loc->elf_ex.e_type == ET_DYN) { -- /* Try and get dynamic programs out of the way of the -- * default mmap base, as well as whatever program they -- * might try to exec. This is because the brk will -- * follow the loader, and is not movable. */ -- load_bias = ELF_ET_DYN_BASE - vaddr; -- if (current->flags & PF_RANDOMIZE) -- load_bias += arch_mmap_rnd(); -- load_bias = ELF_PAGESTART(load_bias); -+ /* -+ * This logic is run once for the first LOAD Program -+ * Header for ET_DYN binaries to calculate the -+ * randomization (load_bias) for all the LOAD -+ * Program Headers, and to calculate the entire -+ * size of the ELF mapping (total_size). (Note that -+ * load_addr_set is set to true later once the -+ * initial mapping is performed.) -+ * -+ * There are effectively two types of ET_DYN -+ * binaries: programs (i.e. PIE: ET_DYN with INTERP) -+ * and loaders (ET_DYN without INTERP, since they -+ * _are_ the ELF interpreter). The loaders must -+ * be loaded away from programs since the program -+ * may otherwise collide with the loader (especially -+ * for ET_EXEC which does not have a randomized -+ * position). For example to handle invocations of -+ * "./ld.so someprog" to test out a new version of -+ * the loader, the subsequent program that the -+ * loader loads must avoid the loader itself, so -+ * they cannot share the same load range. Sufficient -+ * room for the brk must be allocated with the -+ * loader as well, since brk must be available with -+ * the loader. -+ * -+ * Therefore, programs are loaded offset from -+ * ELF_ET_DYN_BASE and loaders are loaded into the -+ * independently randomized mmap region (0 load_bias -+ * without MAP_FIXED). -+ */ -+ if (elf_interpreter) { -+ load_bias = ELF_ET_DYN_BASE; -+ if (current->flags & PF_RANDOMIZE) -+ load_bias += arch_mmap_rnd(); -+ elf_flags |= MAP_FIXED; -+ } else -+ load_bias = 0; -+ -+ /* -+ * Since load_bias is used for all subsequent loading -+ * calculations, we must lower it by the first vaddr -+ * so that the remaining calculations based on the -+ * ELF vaddrs will be correctly offset. The result -+ * is then page aligned. -+ */ -+ load_bias = ELF_PAGESTART(load_bias - vaddr); -+ - total_size = total_mapping_size(elf_phdata, - loc->elf_ex.e_phnum); - if (!total_size) { -diff --git a/fs/dcache.c b/fs/dcache.c -index 849c1c1e787b..3000cbb54949 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -1128,11 +1128,12 @@ void shrink_dcache_sb(struct super_block *sb) - LIST_HEAD(dispose); - - freed = list_lru_walk(&sb->s_dentry_lru, -- dentry_lru_isolate_shrink, &dispose, UINT_MAX); -+ dentry_lru_isolate_shrink, &dispose, 1024); - - this_cpu_sub(nr_dentry_unused, freed); - shrink_dentry_list(&dispose); -- } while (freed > 0); -+ cond_resched(); -+ } while (list_lru_count(&sb->s_dentry_lru) > 0); - } - EXPORT_SYMBOL(shrink_dcache_sb); - -diff --git a/fs/exec.c b/fs/exec.c -index 02153068a694..9c5ee2a880aa 100644 ---- a/fs/exec.c -+++ b/fs/exec.c -@@ -206,8 +206,7 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - - if (write) { - unsigned long size = bprm->vma->vm_end - bprm->vma->vm_start; -- unsigned long ptr_size; -- struct rlimit *rlim; -+ unsigned long ptr_size, limit; - - /* - * Since the stack will hold pointers to the strings, we -@@ -236,14 +235,16 @@ static struct page *get_arg_page(struct linux_binprm *bprm, unsigned long pos, - return page; - - /* -- * Limit to 1/4-th the stack size for the argv+env strings. -+ * Limit to 1/4 of the max stack size or 3/4 of _STK_LIM -+ * (whichever is smaller) for the argv+env strings. - * This ensures that: - * - the remaining binfmt code will not run out of stack space, - * - the program will have a reasonable amount of stack left - * to work from. - */ -- rlim = current->signal->rlim; -- if (size > READ_ONCE(rlim[RLIMIT_STACK].rlim_cur) / 4) -+ limit = _STK_LIM / 4 * 3; -+ limit = min(limit, rlimit(RLIMIT_STACK) / 4); -+ if (size > limit) - goto fail; - } - -diff --git a/fs/mount.h b/fs/mount.h -index 13a4ebbbaa74..37c64bbe840c 100644 ---- a/fs/mount.h -+++ b/fs/mount.h -@@ -57,6 +57,7 @@ struct mount { - struct mnt_namespace *mnt_ns; /* containing namespace */ - struct mountpoint *mnt_mp; /* where is it mounted */ - struct hlist_node mnt_mp_list; /* list mounts with the same mountpoint */ -+ struct list_head mnt_umounting; /* list entry for umount propagation */ - #ifdef CONFIG_FSNOTIFY - struct hlist_head mnt_fsnotify_marks; - __u32 mnt_fsnotify_mask; -diff --git a/fs/namespace.c b/fs/namespace.c -index f26d18d69712..ec4078d16eb7 100644 ---- a/fs/namespace.c -+++ b/fs/namespace.c -@@ -237,6 +237,7 @@ static struct mount *alloc_vfsmnt(const char *name) - INIT_LIST_HEAD(&mnt->mnt_slave_list); - INIT_LIST_HEAD(&mnt->mnt_slave); - INIT_HLIST_NODE(&mnt->mnt_mp_list); -+ INIT_LIST_HEAD(&mnt->mnt_umounting); - #ifdef CONFIG_FSNOTIFY - INIT_HLIST_HEAD(&mnt->mnt_fsnotify_marks); - #endif -diff --git a/fs/pnode.c b/fs/pnode.c -index b394ca5307ec..d15c63e97ef1 100644 ---- a/fs/pnode.c -+++ b/fs/pnode.c -@@ -24,6 +24,11 @@ static inline struct mount *first_slave(struct mount *p) - return list_entry(p->mnt_slave_list.next, struct mount, mnt_slave); - } - -+static inline struct mount *last_slave(struct mount *p) -+{ -+ return list_entry(p->mnt_slave_list.prev, struct mount, mnt_slave); -+} -+ - static inline struct mount *next_slave(struct mount *p) - { - return list_entry(p->mnt_slave.next, struct mount, mnt_slave); -@@ -164,6 +169,19 @@ static struct mount *propagation_next(struct mount *m, - } - } - -+static struct mount *skip_propagation_subtree(struct mount *m, -+ struct mount *origin) -+{ -+ /* -+ * Advance m such that propagation_next will not return -+ * the slaves of m. -+ */ -+ if (!IS_MNT_NEW(m) && !list_empty(&m->mnt_slave_list)) -+ m = last_slave(m); -+ -+ return m; -+} -+ - static struct mount *next_group(struct mount *m, struct mount *origin) - { - while (1) { -@@ -415,65 +433,104 @@ void propagate_mount_unlock(struct mount *mnt) - } - } - --/* -- * Mark all mounts that the MNT_LOCKED logic will allow to be unmounted. -- */ --static void mark_umount_candidates(struct mount *mnt) -+static void umount_one(struct mount *mnt, struct list_head *to_umount) - { -- struct mount *parent = mnt->mnt_parent; -- struct mount *m; -- -- BUG_ON(parent == mnt); -- -- for (m = propagation_next(parent, parent); m; -- m = propagation_next(m, parent)) { -- struct mount *child = __lookup_mnt(&m->mnt, -- mnt->mnt_mountpoint); -- if (!child || (child->mnt.mnt_flags & MNT_UMOUNT)) -- continue; -- if (!IS_MNT_LOCKED(child) || IS_MNT_MARKED(m)) { -- SET_MNT_MARK(child); -- } -- } -+ CLEAR_MNT_MARK(mnt); -+ mnt->mnt.mnt_flags |= MNT_UMOUNT; -+ list_del_init(&mnt->mnt_child); -+ list_del_init(&mnt->mnt_umounting); -+ list_move_tail(&mnt->mnt_list, to_umount); - } - - /* - * NOTE: unmounting 'mnt' naturally propagates to all other mounts its - * parent propagates to. - */ --static void __propagate_umount(struct mount *mnt) -+static bool __propagate_umount(struct mount *mnt, -+ struct list_head *to_umount, -+ struct list_head *to_restore) - { -- struct mount *parent = mnt->mnt_parent; -- struct mount *m; -+ bool progress = false; -+ struct mount *child; - -- BUG_ON(parent == mnt); -+ /* -+ * The state of the parent won't change if this mount is -+ * already unmounted or marked as without children. -+ */ -+ if (mnt->mnt.mnt_flags & (MNT_UMOUNT | MNT_MARKED)) -+ goto out; - -- for (m = propagation_next(parent, parent); m; -- m = propagation_next(m, parent)) { -- struct mount *topper; -- struct mount *child = __lookup_mnt(&m->mnt, -- mnt->mnt_mountpoint); -- /* -- * umount the child only if the child has no children -- * and the child is marked safe to unmount. -- */ -- if (!child || !IS_MNT_MARKED(child)) -+ /* Verify topper is the only grandchild that has not been -+ * speculatively unmounted. -+ */ -+ list_for_each_entry(child, &mnt->mnt_mounts, mnt_child) { -+ if (child->mnt_mountpoint == mnt->mnt.mnt_root) - continue; -- CLEAR_MNT_MARK(child); -+ if (!list_empty(&child->mnt_umounting) && IS_MNT_MARKED(child)) -+ continue; -+ /* Found a mounted child */ -+ goto children; -+ } - -- /* If there is exactly one mount covering all of child -- * replace child with that mount. -- */ -- topper = find_topper(child); -- if (topper) -- mnt_change_mountpoint(child->mnt_parent, child->mnt_mp, -- topper); -+ /* Mark mounts that can be unmounted if not locked */ -+ SET_MNT_MARK(mnt); -+ progress = true; -+ -+ /* If a mount is without children and not locked umount it. */ -+ if (!IS_MNT_LOCKED(mnt)) { -+ umount_one(mnt, to_umount); -+ } else { -+children: -+ list_move_tail(&mnt->mnt_umounting, to_restore); -+ } -+out: -+ return progress; -+} -+ -+static void umount_list(struct list_head *to_umount, -+ struct list_head *to_restore) -+{ -+ struct mount *mnt, *child, *tmp; -+ list_for_each_entry(mnt, to_umount, mnt_list) { -+ list_for_each_entry_safe(child, tmp, &mnt->mnt_mounts, mnt_child) { -+ /* topper? */ -+ if (child->mnt_mountpoint == mnt->mnt.mnt_root) -+ list_move_tail(&child->mnt_umounting, to_restore); -+ else -+ umount_one(child, to_umount); -+ } -+ } -+} - -- if (list_empty(&child->mnt_mounts)) { -- list_del_init(&child->mnt_child); -- child->mnt.mnt_flags |= MNT_UMOUNT; -- list_move_tail(&child->mnt_list, &mnt->mnt_list); -+static void restore_mounts(struct list_head *to_restore) -+{ -+ /* Restore mounts to a clean working state */ -+ while (!list_empty(to_restore)) { -+ struct mount *mnt, *parent; -+ struct mountpoint *mp; -+ -+ mnt = list_first_entry(to_restore, struct mount, mnt_umounting); -+ CLEAR_MNT_MARK(mnt); -+ list_del_init(&mnt->mnt_umounting); -+ -+ /* Should this mount be reparented? */ -+ mp = mnt->mnt_mp; -+ parent = mnt->mnt_parent; -+ while (parent->mnt.mnt_flags & MNT_UMOUNT) { -+ mp = parent->mnt_mp; -+ parent = parent->mnt_parent; - } -+ if (parent != mnt->mnt_parent) -+ mnt_change_mountpoint(parent, mp, mnt); -+ } -+} -+ -+static void cleanup_umount_visitations(struct list_head *visited) -+{ -+ while (!list_empty(visited)) { -+ struct mount *mnt = -+ list_first_entry(visited, struct mount, mnt_umounting); -+ list_del_init(&mnt->mnt_umounting); - } - } - -@@ -487,11 +544,68 @@ static void __propagate_umount(struct mount *mnt) - int propagate_umount(struct list_head *list) - { - struct mount *mnt; -+ LIST_HEAD(to_restore); -+ LIST_HEAD(to_umount); -+ LIST_HEAD(visited); -+ -+ /* Find candidates for unmounting */ -+ list_for_each_entry_reverse(mnt, list, mnt_list) { -+ struct mount *parent = mnt->mnt_parent; -+ struct mount *m; -+ -+ /* -+ * If this mount has already been visited it is known that it's -+ * entire peer group and all of their slaves in the propagation -+ * tree for the mountpoint has already been visited and there is -+ * no need to visit them again. -+ */ -+ if (!list_empty(&mnt->mnt_umounting)) -+ continue; -+ -+ list_add_tail(&mnt->mnt_umounting, &visited); -+ for (m = propagation_next(parent, parent); m; -+ m = propagation_next(m, parent)) { -+ struct mount *child = __lookup_mnt(&m->mnt, -+ mnt->mnt_mountpoint); -+ if (!child) -+ continue; -+ -+ if (!list_empty(&child->mnt_umounting)) { -+ /* -+ * If the child has already been visited it is -+ * know that it's entire peer group and all of -+ * their slaves in the propgation tree for the -+ * mountpoint has already been visited and there -+ * is no need to visit this subtree again. -+ */ -+ m = skip_propagation_subtree(m, parent); -+ continue; -+ } else if (child->mnt.mnt_flags & MNT_UMOUNT) { -+ /* -+ * We have come accross an partially unmounted -+ * mount in list that has not been visited yet. -+ * Remember it has been visited and continue -+ * about our merry way. -+ */ -+ list_add_tail(&child->mnt_umounting, &visited); -+ continue; -+ } -+ -+ /* Check the child and parents while progress is made */ -+ while (__propagate_umount(child, -+ &to_umount, &to_restore)) { -+ /* Is the parent a umount candidate? */ -+ child = child->mnt_parent; -+ if (list_empty(&child->mnt_umounting)) -+ break; -+ } -+ } -+ } - -- list_for_each_entry_reverse(mnt, list, mnt_list) -- mark_umount_candidates(mnt); -+ umount_list(&to_umount, &to_restore); -+ restore_mounts(&to_restore); -+ cleanup_umount_visitations(&visited); -+ list_splice_tail(&to_umount, list); - -- list_for_each_entry(mnt, list, mnt_list) -- __propagate_umount(mnt); - return 0; - } -diff --git a/include/linux/device.h b/include/linux/device.h -index b8f411b57dcb..7075a2485ed3 100644 ---- a/include/linux/device.h -+++ b/include/linux/device.h -@@ -368,6 +368,7 @@ int subsys_virtual_register(struct bus_type *subsys, - * @suspend: Used to put the device to sleep mode, usually to a low power - * state. - * @resume: Used to bring the device from the sleep mode. -+ * @shutdown: Called at shut-down time to quiesce the device. - * @ns_type: Callbacks so sysfs can detemine namespaces. - * @namespace: Namespace of the device belongs to this class. - * @pm: The default device power management operations of this class. -@@ -396,6 +397,7 @@ struct class { - - int (*suspend)(struct device *dev, pm_message_t state); - int (*resume)(struct device *dev); -+ int (*shutdown)(struct device *dev); - - const struct kobj_ns_type_operations *ns_type; - const void *(*namespace)(struct device *dev); -diff --git a/include/linux/list_lru.h b/include/linux/list_lru.h -index 2a6b9947aaa3..743b34f56f2b 100644 ---- a/include/linux/list_lru.h -+++ b/include/linux/list_lru.h -@@ -44,6 +44,7 @@ struct list_lru_node { - /* for cgroup aware lrus points to per cgroup lists, otherwise NULL */ - struct list_lru_memcg *memcg_lrus; - #endif -+ long nr_items; - } ____cacheline_aligned_in_smp; - - struct list_lru { -diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h -index 6275d651f76e..b8a8d4239e85 100644 ---- a/include/net/ip6_route.h -+++ b/include/net/ip6_route.h -@@ -21,6 +21,7 @@ struct route_info { - #include - #include - #include -+#include - #include - #include - #include -@@ -208,4 +209,11 @@ static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt, - return daddr; - } - -+static inline bool rt6_duplicate_nexthop(struct rt6_info *a, struct rt6_info *b) -+{ -+ return a->dst.dev == b->dst.dev && -+ a->rt6i_idev == b->rt6i_idev && -+ ipv6_addr_equal(&a->rt6i_gateway, &b->rt6i_gateway) && -+ !lwtunnel_cmp_encap(a->dst.lwtstate, b->dst.lwtstate); -+} - #endif -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 2cbfba78d3db..863e24f1e62e 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -754,6 +754,11 @@ static int check_xadd(struct verifier_env *env, struct bpf_insn *insn) - if (err) - return err; - -+ if (is_pointer_value(env, insn->src_reg)) { -+ verbose("R%d leaks addr into mem\n", insn->src_reg); -+ return -EACCES; -+ } -+ - /* check whether atomic_add can read the memory */ - err = check_mem_access(env, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_READ, -1); -diff --git a/kernel/extable.c b/kernel/extable.c -index e820ccee9846..4f06fc34313f 100644 ---- a/kernel/extable.c -+++ b/kernel/extable.c -@@ -66,7 +66,7 @@ static inline int init_kernel_text(unsigned long addr) - return 0; - } - --int core_kernel_text(unsigned long addr) -+int notrace core_kernel_text(unsigned long addr) - { - if (addr >= (unsigned long)_stext && - addr < (unsigned long)_etext) -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 20253dbc8610..c436426a80dd 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -6123,6 +6123,9 @@ enum s_alloc { - * Build an iteration mask that can exclude certain CPUs from the upwards - * domain traversal. - * -+ * Only CPUs that can arrive at this group should be considered to continue -+ * balancing. -+ * - * Asymmetric node setups can result in situations where the domain tree is of - * unequal depth, make sure to skip domains that already cover the entire - * range. -@@ -6134,18 +6137,31 @@ enum s_alloc { - */ - static void build_group_mask(struct sched_domain *sd, struct sched_group *sg) - { -- const struct cpumask *span = sched_domain_span(sd); -+ const struct cpumask *sg_span = sched_group_cpus(sg); - struct sd_data *sdd = sd->private; - struct sched_domain *sibling; - int i; - -- for_each_cpu(i, span) { -+ for_each_cpu(i, sg_span) { - sibling = *per_cpu_ptr(sdd->sd, i); -- if (!cpumask_test_cpu(i, sched_domain_span(sibling))) -+ -+ /* -+ * Can happen in the asymmetric case, where these siblings are -+ * unused. The mask will not be empty because those CPUs that -+ * do have the top domain _should_ span the domain. -+ */ -+ if (!sibling->child) -+ continue; -+ -+ /* If we would not end up here, we can't continue from here */ -+ if (!cpumask_equal(sg_span, sched_domain_span(sibling->child))) - continue; - - cpumask_set_cpu(i, sched_group_mask(sg)); - } -+ -+ /* We must not have empty masks here */ -+ WARN_ON_ONCE(cpumask_empty(sched_group_mask(sg))); - } - - /* -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 4c21c0b7dc91..c83d59913d78 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -1660,7 +1660,7 @@ tracing_generic_entry_update(struct trace_entry *entry, unsigned long flags, - TRACE_FLAG_IRQS_NOSUPPORT | - #endif - ((pc & HARDIRQ_MASK) ? TRACE_FLAG_HARDIRQ : 0) | -- ((pc & SOFTIRQ_MASK) ? TRACE_FLAG_SOFTIRQ : 0) | -+ ((pc & SOFTIRQ_OFFSET) ? TRACE_FLAG_SOFTIRQ : 0) | - (tif_need_resched() ? TRACE_FLAG_NEED_RESCHED : 0) | - (test_preempt_need_resched() ? TRACE_FLAG_PREEMPT_RESCHED : 0); - } -diff --git a/mm/list_lru.c b/mm/list_lru.c -index 5d8dffd5b57c..786176b1a0ee 100644 ---- a/mm/list_lru.c -+++ b/mm/list_lru.c -@@ -117,6 +117,7 @@ bool list_lru_add(struct list_lru *lru, struct list_head *item) - l = list_lru_from_kmem(nlru, item); - list_add_tail(item, &l->list); - l->nr_items++; -+ nlru->nr_items++; - spin_unlock(&nlru->lock); - return true; - } -@@ -136,6 +137,7 @@ bool list_lru_del(struct list_lru *lru, struct list_head *item) - l = list_lru_from_kmem(nlru, item); - list_del_init(item); - l->nr_items--; -+ nlru->nr_items--; - spin_unlock(&nlru->lock); - return true; - } -@@ -183,15 +185,10 @@ EXPORT_SYMBOL_GPL(list_lru_count_one); - - unsigned long list_lru_count_node(struct list_lru *lru, int nid) - { -- long count = 0; -- int memcg_idx; -+ struct list_lru_node *nlru; - -- count += __list_lru_count_one(lru, nid, -1); -- if (list_lru_memcg_aware(lru)) { -- for_each_memcg_cache_index(memcg_idx) -- count += __list_lru_count_one(lru, nid, memcg_idx); -- } -- return count; -+ nlru = &lru->node[nid]; -+ return nlru->nr_items; - } - EXPORT_SYMBOL_GPL(list_lru_count_node); - -@@ -226,6 +223,7 @@ restart: - assert_spin_locked(&nlru->lock); - case LRU_REMOVED: - isolated++; -+ nlru->nr_items--; - /* - * If the lru lock has been dropped, our list - * traversal is now invalid and so we have to -diff --git a/mm/mmap.c b/mm/mmap.c -index 0990f8bc0fbe..eaa460ddcaf9 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2176,7 +2176,7 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) - - /* Guard against exceeding limits of the address space. */ - address &= PAGE_MASK; -- if (address >= TASK_SIZE) -+ if (address >= (TASK_SIZE & PAGE_MASK)) - return -ENOMEM; - address += PAGE_SIZE; - -diff --git a/net/core/dev.c b/net/core/dev.c -index 524d8b28e690..dc5d3d546150 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -4375,6 +4375,12 @@ struct packet_offload *gro_find_complete_by_type(__be16 type) - } - EXPORT_SYMBOL(gro_find_complete_by_type); - -+static void napi_skb_free_stolen_head(struct sk_buff *skb) -+{ -+ skb_dst_drop(skb); -+ kmem_cache_free(skbuff_head_cache, skb); -+} -+ - static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb) - { - switch (ret) { -@@ -4388,12 +4394,10 @@ static gro_result_t napi_skb_finish(gro_result_t ret, struct sk_buff *skb) - break; - - case GRO_MERGED_FREE: -- if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) { -- skb_dst_drop(skb); -- kmem_cache_free(skbuff_head_cache, skb); -- } else { -+ if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) -+ napi_skb_free_stolen_head(skb); -+ else - __kfree_skb(skb); -- } - break; - - case GRO_HELD: -@@ -4459,10 +4463,16 @@ static gro_result_t napi_frags_finish(struct napi_struct *napi, - break; - - case GRO_DROP: -- case GRO_MERGED_FREE: - napi_reuse_skb(napi, skb); - break; - -+ case GRO_MERGED_FREE: -+ if (NAPI_GRO_CB(skb)->free == NAPI_GRO_FREE_STOLEN_HEAD) -+ napi_skb_free_stolen_head(skb); -+ else -+ napi_reuse_skb(napi, skb); -+ break; -+ - case GRO_MERGED: - break; - } -@@ -7052,8 +7062,8 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, - } else { - netdev_stats_to_stats64(storage, &dev->stats); - } -- storage->rx_dropped += atomic_long_read(&dev->rx_dropped); -- storage->tx_dropped += atomic_long_read(&dev->tx_dropped); -+ storage->rx_dropped += (unsigned long)atomic_long_read(&dev->rx_dropped); -+ storage->tx_dropped += (unsigned long)atomic_long_read(&dev->tx_dropped); - return storage; - } - EXPORT_SYMBOL(dev_get_stats); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 4bd8678329d6..0870a86e9d96 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2263,6 +2263,8 @@ int tcp_disconnect(struct sock *sk, int flags) - tcp_init_send_head(sk); - memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); - __sk_dst_reset(sk); -+ dst_release(sk->sk_rx_dst); -+ sk->sk_rx_dst = NULL; - tcp_saved_syn_free(tp); - - WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 03dadbf6cc5e..735b22b1b4ea 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -1772,17 +1772,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add - - static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed) - { -- if (ifp->flags&IFA_F_PERMANENT) { -- spin_lock_bh(&ifp->lock); -- addrconf_del_dad_work(ifp); -- ifp->flags |= IFA_F_TENTATIVE; -- if (dad_failed) -- ifp->flags |= IFA_F_DADFAILED; -- spin_unlock_bh(&ifp->lock); -- if (dad_failed) -- ipv6_ifa_notify(0, ifp); -- in6_ifa_put(ifp); -- } else if (ifp->flags&IFA_F_TEMPORARY) { -+ if (ifp->flags&IFA_F_TEMPORARY) { - struct inet6_ifaddr *ifpub; - spin_lock_bh(&ifp->lock); - ifpub = ifp->ifpub; -@@ -1795,6 +1785,16 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed) - spin_unlock_bh(&ifp->lock); - } - ipv6_del_addr(ifp); -+ } else if (ifp->flags&IFA_F_PERMANENT || !dad_failed) { -+ spin_lock_bh(&ifp->lock); -+ addrconf_del_dad_work(ifp); -+ ifp->flags |= IFA_F_TENTATIVE; -+ if (dad_failed) -+ ifp->flags |= IFA_F_DADFAILED; -+ spin_unlock_bh(&ifp->lock); -+ if (dad_failed) -+ ipv6_ifa_notify(0, ifp); -+ in6_ifa_put(ifp); - } else { - ipv6_del_addr(ifp); - } -@@ -3143,6 +3143,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, - { - struct net_device *dev = netdev_notifier_info_to_dev(ptr); - struct inet6_dev *idev = __in6_dev_get(dev); -+ struct net *net = dev_net(dev); - int run_pending = 0; - int err; - -@@ -3158,7 +3159,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, - case NETDEV_CHANGEMTU: - /* if MTU under IPV6_MIN_MTU stop IPv6 on this interface. */ - if (dev->mtu < IPV6_MIN_MTU) { -- addrconf_ifdown(dev, 1); -+ addrconf_ifdown(dev, dev != net->loopback_dev); - break; - } - -@@ -3271,7 +3272,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event, - * IPV6_MIN_MTU stop IPv6 on this interface. - */ - if (dev->mtu < IPV6_MIN_MTU) -- addrconf_ifdown(dev, 1); -+ addrconf_ifdown(dev, dev != net->loopback_dev); - } - break; - -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index 1ac06723f0d7..f60e8caea767 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -767,10 +767,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt, - goto next_iter; - } - -- if (iter->dst.dev == rt->dst.dev && -- iter->rt6i_idev == rt->rt6i_idev && -- ipv6_addr_equal(&iter->rt6i_gateway, -- &rt->rt6i_gateway)) { -+ if (rt6_duplicate_nexthop(iter, rt)) { - if (rt->rt6i_nsiblings) - rt->rt6i_nsiblings = 0; - if (!(iter->rt6i_flags & RTF_EXPIRES)) -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 8f4177a1d4f5..ef335070e98a 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -2833,17 +2833,11 @@ static int ip6_route_info_append(struct list_head *rt6_nh_list, - struct rt6_info *rt, struct fib6_config *r_cfg) - { - struct rt6_nh *nh; -- struct rt6_info *rtnh; - int err = -EEXIST; - - list_for_each_entry(nh, rt6_nh_list, next) { - /* check if rt6_info already exists */ -- rtnh = nh->rt6_info; -- -- if (rtnh->dst.dev == rt->dst.dev && -- rtnh->rt6i_idev == rt->rt6i_idev && -- ipv6_addr_equal(&rtnh->rt6i_gateway, -- &rt->rt6i_gateway)) -+ if (rt6_duplicate_nexthop(nh->rt6_info, rt)) - return err; - } - -diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c -index 0936a4a32b47..e353e3255206 100644 ---- a/net/rds/tcp_listen.c -+++ b/net/rds/tcp_listen.c -@@ -78,7 +78,7 @@ int rds_tcp_accept_one(struct socket *sock) - struct inet_sock *inet; - struct rds_tcp_connection *rs_tcp; - -- ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family, -+ ret = sock_create_lite(sock->sk->sk_family, - sock->sk->sk_type, sock->sk->sk_protocol, - &new_sock); - if (ret) -diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c -index 95b560f0b253..6d340cd6e2a7 100644 ---- a/net/sched/sch_api.c -+++ b/net/sched/sch_api.c -@@ -1004,6 +1004,9 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue, - - return sch; - } -+ /* ops->init() failed, we call ->destroy() like qdisc_create_dflt() */ -+ if (ops->destroy) -+ ops->destroy(sch); - err_out3: - dev_put(dev); - kfree((char *) sch - sch->padded); -diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c -index 13d6f83ec491..45d4b2f22f62 100644 ---- a/net/sched/sch_hhf.c -+++ b/net/sched/sch_hhf.c -@@ -636,7 +636,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt) - q->hhf_arrays[i] = hhf_zalloc(HHF_ARRAYS_LEN * - sizeof(u32)); - if (!q->hhf_arrays[i]) { -- hhf_destroy(sch); -+ /* Note: hhf_destroy() will be called -+ * by our caller. -+ */ - return -ENOMEM; - } - } -@@ -647,7 +649,9 @@ static int hhf_init(struct Qdisc *sch, struct nlattr *opt) - q->hhf_valid_bits[i] = hhf_zalloc(HHF_ARRAYS_LEN / - BITS_PER_BYTE); - if (!q->hhf_valid_bits[i]) { -- hhf_destroy(sch); -+ /* Note: hhf_destroy() will be called -+ * by our caller. -+ */ - return -ENOMEM; - } - } -diff --git a/net/sched/sch_mq.c b/net/sched/sch_mq.c -index 3e82f047caaf..d9c84328e7eb 100644 ---- a/net/sched/sch_mq.c -+++ b/net/sched/sch_mq.c -@@ -52,7 +52,7 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt) - /* pre-allocate qdiscs, attachment can't fail */ - priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]), - GFP_KERNEL); -- if (priv->qdiscs == NULL) -+ if (!priv->qdiscs) - return -ENOMEM; - - for (ntx = 0; ntx < dev->num_tx_queues; ntx++) { -@@ -60,18 +60,14 @@ static int mq_init(struct Qdisc *sch, struct nlattr *opt) - qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops, - TC_H_MAKE(TC_H_MAJ(sch->handle), - TC_H_MIN(ntx + 1))); -- if (qdisc == NULL) -- goto err; -+ if (!qdisc) -+ return -ENOMEM; - priv->qdiscs[ntx] = qdisc; - qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT; - } - - sch->flags |= TCQ_F_MQROOT; - return 0; -- --err: -- mq_destroy(sch); -- return -ENOMEM; - } - - static void mq_attach(struct Qdisc *sch) -diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c -index ad70ecf57ce7..66bccc5ff4ea 100644 ---- a/net/sched/sch_mqprio.c -+++ b/net/sched/sch_mqprio.c -@@ -117,20 +117,17 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt) - /* pre-allocate qdisc, attachment can't fail */ - priv->qdiscs = kcalloc(dev->num_tx_queues, sizeof(priv->qdiscs[0]), - GFP_KERNEL); -- if (priv->qdiscs == NULL) { -- err = -ENOMEM; -- goto err; -- } -+ if (!priv->qdiscs) -+ return -ENOMEM; - - for (i = 0; i < dev->num_tx_queues; i++) { - dev_queue = netdev_get_tx_queue(dev, i); - qdisc = qdisc_create_dflt(dev_queue, default_qdisc_ops, - TC_H_MAKE(TC_H_MAJ(sch->handle), - TC_H_MIN(i + 1))); -- if (qdisc == NULL) { -- err = -ENOMEM; -- goto err; -- } -+ if (!qdisc) -+ return -ENOMEM; -+ - priv->qdiscs[i] = qdisc; - qdisc->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT; - } -@@ -143,7 +140,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt) - priv->hw_owned = 1; - err = dev->netdev_ops->ndo_setup_tc(dev, qopt->num_tc); - if (err) -- goto err; -+ return err; - } else { - netdev_set_num_tc(dev, qopt->num_tc); - for (i = 0; i < qopt->num_tc; i++) -@@ -157,10 +154,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt) - - sch->flags |= TCQ_F_MQROOT; - return 0; -- --err: -- mqprio_destroy(sch); -- return err; - } - - static void mqprio_attach(struct Qdisc *sch) -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 498f0a2cb47f..4431e2833e45 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -742,9 +742,10 @@ static int sfq_init(struct Qdisc *sch, struct nlattr *opt) - q->ht = sfq_alloc(sizeof(q->ht[0]) * q->divisor); - q->slots = sfq_alloc(sizeof(q->slots[0]) * q->maxflows); - if (!q->ht || !q->slots) { -- sfq_destroy(sch); -+ /* Note: sfq_destroy() will be called by our caller */ - return -ENOMEM; - } -+ - for (i = 0; i < q->divisor; i++) - q->ht[i] = SFQ_EMPTY_SLOT; - -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 9d0953e5734f..de10e3c0e2a4 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -302,8 +302,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 }, - [NL80211_ATTR_PID] = { .type = NLA_U32 }, - [NL80211_ATTR_4ADDR] = { .type = NLA_U8 }, -- [NL80211_ATTR_PMKID] = { .type = NLA_BINARY, -- .len = WLAN_PMKID_LEN }, -+ [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN }, - [NL80211_ATTR_DURATION] = { .type = NLA_U32 }, - [NL80211_ATTR_COOKIE] = { .type = NLA_U64 }, - [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED }, -@@ -359,6 +358,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { - [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 }, - [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 }, - [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 }, -+ [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 }, - [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 }, - [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED }, - [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 }, -@@ -5705,6 +5705,10 @@ static int validate_scan_freqs(struct nlattr *freqs) - struct nlattr *attr1, *attr2; - int n_channels = 0, tmp1, tmp2; - -+ nla_for_each_nested(attr1, freqs, tmp1) -+ if (nla_len(attr1) != sizeof(u32)) -+ return 0; -+ - nla_for_each_nested(attr1, freqs, tmp1) { - n_channels++; - /* -diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl -index 2b3c22808c3b..6ac6550d751c 100755 ---- a/scripts/checkpatch.pl -+++ b/scripts/checkpatch.pl -@@ -3252,7 +3252,7 @@ sub process { - $fixedline =~ s/\s*=\s*$/ = {/; - fix_insert_line($fixlinenr, $fixedline); - $fixedline = $line; -- $fixedline =~ s/^(.\s*){\s*/$1/; -+ $fixedline =~ s/^(.\s*)\{\s*/$1/; - fix_insert_line($fixlinenr, $fixedline); - } - } -@@ -3602,7 +3602,7 @@ sub process { - my $fixedline = rtrim($prevrawline) . " {"; - fix_insert_line($fixlinenr, $fixedline); - $fixedline = $rawline; -- $fixedline =~ s/^(.\s*){\s*/$1\t/; -+ $fixedline =~ s/^(.\s*)\{\s*/$1\t/; - if ($fixedline !~ /^\+\s*$/) { - fix_insert_line($fixlinenr, $fixedline); - } -@@ -4091,7 +4091,7 @@ sub process { - if (ERROR("SPACING", - "space required before the open brace '{'\n" . $herecurr) && - $fix) { -- $fixed[$fixlinenr] =~ s/^(\+.*(?:do|\))){/$1 {/; -+ $fixed[$fixlinenr] =~ s/^(\+.*(?:do|\)))\{/$1 {/; - } - } - -diff --git a/tools/lib/lockdep/uinclude/linux/lockdep.h b/tools/lib/lockdep/uinclude/linux/lockdep.h -index c808c7d02d21..e69118b2077e 100644 ---- a/tools/lib/lockdep/uinclude/linux/lockdep.h -+++ b/tools/lib/lockdep/uinclude/linux/lockdep.h -@@ -8,7 +8,7 @@ - #include - #include - --#define MAX_LOCK_DEPTH 2000UL -+#define MAX_LOCK_DEPTH 255UL - - #define asmlinkage - #define __visible -diff --git a/tools/testing/selftests/capabilities/test_execve.c b/tools/testing/selftests/capabilities/test_execve.c -index 10a21a958aaf..763f37fecfb8 100644 ---- a/tools/testing/selftests/capabilities/test_execve.c -+++ b/tools/testing/selftests/capabilities/test_execve.c -@@ -138,9 +138,6 @@ static void chdir_to_tmpfs(void) - - if (chdir(cwd) != 0) - err(1, "chdir to private tmpfs"); -- -- if (umount2(".", MNT_DETACH) != 0) -- err(1, "detach private tmpfs"); - } - - static void copy_fromat_to(int fromfd, const char *fromname, const char *toname) -@@ -248,7 +245,7 @@ static int do_tests(int uid, const char *our_path) - err(1, "chown"); - if (chmod("validate_cap_sgidnonroot", S_ISGID | 0710) != 0) - err(1, "chmod"); --} -+ } - - capng_get_caps_process(); - -@@ -384,7 +381,7 @@ static int do_tests(int uid, const char *our_path) - } else { - printf("[RUN]\tNon-root +ia, sgidnonroot => i\n"); - exec_other_validate_cap("./validate_cap_sgidnonroot", -- false, false, true, false); -+ false, false, true, false); - - if (fork_wait()) { - printf("[RUN]\tNon-root +ia, sgidroot => i\n"); diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.78-79.patch b/patch/kernel/mvebu64-default/03-patch-4.4.78-79.patch deleted file mode 100644 index bf34060d43b2..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.78-79.patch +++ /dev/null @@ -1,2607 +0,0 @@ -diff --git a/Makefile b/Makefile -index ac77ae8ee0b1..1440a94b2474 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 78 -+SUBLEVEL = 79 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -619,6 +619,9 @@ include arch/$(SRCARCH)/Makefile - KBUILD_CFLAGS += $(call cc-option,-fno-delete-null-pointer-checks,) - KBUILD_CFLAGS += $(call cc-disable-warning,maybe-uninitialized,) - KBUILD_CFLAGS += $(call cc-disable-warning,frame-address,) -+KBUILD_CFLAGS += $(call cc-disable-warning, format-truncation) -+KBUILD_CFLAGS += $(call cc-disable-warning, format-overflow) -+KBUILD_CFLAGS += $(call cc-disable-warning, int-in-bool-context) - - ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE - KBUILD_CFLAGS += -Os -diff --git a/arch/mips/include/asm/branch.h b/arch/mips/include/asm/branch.h -index de781cf54bc7..da80878f2c0d 100644 ---- a/arch/mips/include/asm/branch.h -+++ b/arch/mips/include/asm/branch.h -@@ -74,10 +74,7 @@ static inline int compute_return_epc(struct pt_regs *regs) - return __microMIPS_compute_return_epc(regs); - if (cpu_has_mips16) - return __MIPS16e_compute_return_epc(regs); -- return regs->cp0_epc; -- } -- -- if (!delay_slot(regs)) { -+ } else if (!delay_slot(regs)) { - regs->cp0_epc += 4; - return 0; - } -diff --git a/arch/mips/kernel/branch.c b/arch/mips/kernel/branch.c -index e9fed8ca9b42..71e8f4c0b8da 100644 ---- a/arch/mips/kernel/branch.c -+++ b/arch/mips/kernel/branch.c -@@ -399,7 +399,7 @@ int __MIPS16e_compute_return_epc(struct pt_regs *regs) - * - * @regs: Pointer to pt_regs - * @insn: branch instruction to decode -- * @returns: -EFAULT on error and forces SIGBUS, and on success -+ * @returns: -EFAULT on error and forces SIGILL, and on success - * returns 0 or BRANCH_LIKELY_TAKEN as appropriate after - * evaluating the branch. - * -@@ -431,7 +431,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - /* Fall through */ - case jr_op: - if (NO_R6EMU && insn.r_format.func == jr_op) -- goto sigill_r6; -+ goto sigill_r2r6; - regs->cp0_epc = regs->regs[insn.r_format.rs]; - break; - } -@@ -446,7 +446,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - switch (insn.i_format.rt) { - case bltzl_op: - if (NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case bltz_op: - if ((long)regs->regs[insn.i_format.rs] < 0) { - epc = epc + 4 + (insn.i_format.simmediate << 2); -@@ -459,7 +459,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - - case bgezl_op: - if (NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case bgez_op: - if ((long)regs->regs[insn.i_format.rs] >= 0) { - epc = epc + 4 + (insn.i_format.simmediate << 2); -@@ -473,10 +473,8 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - case bltzal_op: - case bltzall_op: - if (NO_R6EMU && (insn.i_format.rs || -- insn.i_format.rt == bltzall_op)) { -- ret = -SIGILL; -- break; -- } -+ insn.i_format.rt == bltzall_op)) -+ goto sigill_r2r6; - regs->regs[31] = epc + 8; - /* - * OK we are here either because we hit a NAL -@@ -507,10 +505,8 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - case bgezal_op: - case bgezall_op: - if (NO_R6EMU && (insn.i_format.rs || -- insn.i_format.rt == bgezall_op)) { -- ret = -SIGILL; -- break; -- } -+ insn.i_format.rt == bgezall_op)) -+ goto sigill_r2r6; - regs->regs[31] = epc + 8; - /* - * OK we are here either because we hit a BAL -@@ -556,6 +552,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - /* - * These are unconditional and in j_format. - */ -+ case jalx_op: - case jal_op: - regs->regs[31] = regs->cp0_epc + 8; - case j_op: -@@ -573,7 +570,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - */ - case beql_op: - if (NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case beq_op: - if (regs->regs[insn.i_format.rs] == - regs->regs[insn.i_format.rt]) { -@@ -587,7 +584,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - - case bnel_op: - if (NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case bne_op: - if (regs->regs[insn.i_format.rs] != - regs->regs[insn.i_format.rt]) { -@@ -601,7 +598,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - - case blezl_op: /* not really i_format */ - if (!insn.i_format.rt && NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case blez_op: - /* - * Compact branches for R6 for the -@@ -636,7 +633,7 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - - case bgtzl_op: - if (!insn.i_format.rt && NO_R6EMU) -- goto sigill_r6; -+ goto sigill_r2r6; - case bgtz_op: - /* - * Compact branches for R6 for the -@@ -843,11 +840,12 @@ int __compute_return_epc_for_insn(struct pt_regs *regs, - return ret; - - sigill_dsp: -- printk("%s: DSP branch but not DSP ASE - sending SIGBUS.\n", current->comm); -- force_sig(SIGBUS, current); -+ pr_info("%s: DSP branch but not DSP ASE - sending SIGILL.\n", -+ current->comm); -+ force_sig(SIGILL, current); - return -EFAULT; --sigill_r6: -- pr_info("%s: R2 branch but r2-to-r6 emulator is not preset - sending SIGILL.\n", -+sigill_r2r6: -+ pr_info("%s: R2 branch but r2-to-r6 emulator is not present - sending SIGILL.\n", - current->comm); - force_sig(SIGILL, current); - return -EFAULT; -diff --git a/arch/mips/kernel/proc.c b/arch/mips/kernel/proc.c -index 298b2b773d12..f1fab6ff53e6 100644 ---- a/arch/mips/kernel/proc.c -+++ b/arch/mips/kernel/proc.c -@@ -83,7 +83,7 @@ static int show_cpuinfo(struct seq_file *m, void *v) - } - - seq_printf(m, "isa\t\t\t:"); -- if (cpu_has_mips_r1) -+ if (cpu_has_mips_1) - seq_printf(m, " mips1"); - if (cpu_has_mips_2) - seq_printf(m, "%s", " mips2"); -diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c -index c95bf18260f8..24c115a0721a 100644 ---- a/arch/mips/kernel/ptrace.c -+++ b/arch/mips/kernel/ptrace.c -@@ -927,7 +927,7 @@ asmlinkage void syscall_trace_leave(struct pt_regs *regs) - audit_syscall_exit(regs); - - if (unlikely(test_thread_flag(TIF_SYSCALL_TRACEPOINT))) -- trace_sys_exit(regs, regs->regs[2]); -+ trace_sys_exit(regs, regs_return_value(regs)); - - if (test_thread_flag(TIF_SYSCALL_TRACE)) - tracehook_report_syscall_exit(regs, 0); -diff --git a/arch/mips/kernel/scall32-o32.S b/arch/mips/kernel/scall32-o32.S -index 2d23c834ba96..29b0c5f978e4 100644 ---- a/arch/mips/kernel/scall32-o32.S -+++ b/arch/mips/kernel/scall32-o32.S -@@ -372,7 +372,7 @@ EXPORT(sys_call_table) - PTR sys_writev - PTR sys_cacheflush - PTR sys_cachectl -- PTR sys_sysmips -+ PTR __sys_sysmips - PTR sys_ni_syscall /* 4150 */ - PTR sys_getsid - PTR sys_fdatasync -diff --git a/arch/mips/kernel/scall64-64.S b/arch/mips/kernel/scall64-64.S -index deac63315d0e..a6323a969919 100644 ---- a/arch/mips/kernel/scall64-64.S -+++ b/arch/mips/kernel/scall64-64.S -@@ -312,7 +312,7 @@ EXPORT(sys_call_table) - PTR sys_sched_getaffinity - PTR sys_cacheflush - PTR sys_cachectl -- PTR sys_sysmips -+ PTR __sys_sysmips - PTR sys_io_setup /* 5200 */ - PTR sys_io_destroy - PTR sys_io_getevents -diff --git a/arch/mips/kernel/scall64-n32.S b/arch/mips/kernel/scall64-n32.S -index ee93d5fe61d7..e0fdca8d3abe 100644 ---- a/arch/mips/kernel/scall64-n32.S -+++ b/arch/mips/kernel/scall64-n32.S -@@ -298,7 +298,7 @@ EXPORT(sysn32_call_table) - PTR compat_sys_sched_getaffinity - PTR sys_cacheflush - PTR sys_cachectl -- PTR sys_sysmips -+ PTR __sys_sysmips - PTR compat_sys_io_setup /* 6200 */ - PTR sys_io_destroy - PTR compat_sys_io_getevents -diff --git a/arch/mips/kernel/scall64-o32.S b/arch/mips/kernel/scall64-o32.S -index b77052ec6fb2..87c697181d25 100644 ---- a/arch/mips/kernel/scall64-o32.S -+++ b/arch/mips/kernel/scall64-o32.S -@@ -367,7 +367,7 @@ EXPORT(sys32_call_table) - PTR compat_sys_writev - PTR sys_cacheflush - PTR sys_cachectl -- PTR sys_sysmips -+ PTR __sys_sysmips - PTR sys_ni_syscall /* 4150 */ - PTR sys_getsid - PTR sys_fdatasync -diff --git a/arch/mips/kernel/syscall.c b/arch/mips/kernel/syscall.c -index 53a7ef9a8f32..4234b2d726c5 100644 ---- a/arch/mips/kernel/syscall.c -+++ b/arch/mips/kernel/syscall.c -@@ -28,6 +28,7 @@ - #include - - #include -+#include - #include - #include - #include -@@ -138,10 +139,12 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new) - __asm__ __volatile__ ( - " .set "MIPS_ISA_ARCH_LEVEL" \n" - " li %[err], 0 \n" -- "1: ll %[old], (%[addr]) \n" -+ "1: \n" -+ user_ll("%[old]", "(%[addr])") - " move %[tmp], %[new] \n" -- "2: sc %[tmp], (%[addr]) \n" -- " bnez %[tmp], 4f \n" -+ "2: \n" -+ user_sc("%[tmp]", "(%[addr])") -+ " beqz %[tmp], 4f \n" - "3: \n" - " .insn \n" - " .subsection 2 \n" -@@ -199,6 +202,12 @@ static inline int mips_atomic_set(unsigned long addr, unsigned long new) - unreachable(); - } - -+/* -+ * mips_atomic_set() normally returns directly via syscall_exit potentially -+ * clobbering static registers, so be sure to preserve them. -+ */ -+save_static_function(sys_sysmips); -+ - SYSCALL_DEFINE3(sysmips, long, cmd, long, arg1, long, arg2) - { - switch (cmd) { -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index 734a2c7665ec..6da2e4a6ba39 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -2496,6 +2496,35 @@ dcopuop: - return 0; - } - -+/* -+ * Emulate FPU instructions. -+ * -+ * If we use FPU hardware, then we have been typically called to handle -+ * an unimplemented operation, such as where an operand is a NaN or -+ * denormalized. In that case exit the emulation loop after a single -+ * iteration so as to let hardware execute any subsequent instructions. -+ * -+ * If we have no FPU hardware or it has been disabled, then continue -+ * emulating floating-point instructions until one of these conditions -+ * has occurred: -+ * -+ * - a non-FPU instruction has been encountered, -+ * -+ * - an attempt to emulate has ended with a signal, -+ * -+ * - the ISA mode has been switched. -+ * -+ * We need to terminate the emulation loop if we got switched to the -+ * MIPS16 mode, whether supported or not, so that we do not attempt -+ * to emulate a MIPS16 instruction as a regular MIPS FPU instruction. -+ * Similarly if we got switched to the microMIPS mode and only the -+ * regular MIPS mode is supported, so that we do not attempt to emulate -+ * a microMIPS instruction as a regular MIPS FPU instruction. Or if -+ * we got switched to the regular MIPS mode and only the microMIPS mode -+ * is supported, so that we do not attempt to emulate a regular MIPS -+ * instruction that should cause an Address Error exception instead. -+ * For simplicity we always terminate upon an ISA mode switch. -+ */ - int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - int has_fpu, void *__user *fault_addr) - { -@@ -2581,6 +2610,15 @@ int fpu_emulator_cop1Handler(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - break; - if (sig) - break; -+ /* -+ * We have to check for the ISA bit explicitly here, -+ * because `get_isa16_mode' may return 0 if support -+ * for code compression has been globally disabled, -+ * or otherwise we may produce the wrong signal or -+ * even proceed successfully where we must not. -+ */ -+ if ((xcp->cp0_epc ^ prevepc) & 0x1) -+ break; - - cond_resched(); - } while (xcp->cp0_epc > prevepc); -diff --git a/arch/powerpc/include/asm/atomic.h b/arch/powerpc/include/asm/atomic.h -index 55f106ed12bf..039c4b910615 100644 ---- a/arch/powerpc/include/asm/atomic.h -+++ b/arch/powerpc/include/asm/atomic.h -@@ -460,7 +460,7 @@ static __inline__ int atomic64_add_unless(atomic64_t *v, long a, long u) - * Atomically increments @v by 1, so long as @v is non-zero. - * Returns non-zero if @v was non-zero, and zero otherwise. - */ --static __inline__ long atomic64_inc_not_zero(atomic64_t *v) -+static __inline__ int atomic64_inc_not_zero(atomic64_t *v) - { - long t1, t2; - -@@ -479,7 +479,7 @@ static __inline__ long atomic64_inc_not_zero(atomic64_t *v) - : "r" (&v->counter) - : "cc", "xer", "memory"); - -- return t1; -+ return t1 != 0; - } - - #endif /* __powerpc64__ */ -diff --git a/arch/powerpc/include/asm/reg.h b/arch/powerpc/include/asm/reg.h -index 627d129d7fcb..ca372bbc0ffe 100644 ---- a/arch/powerpc/include/asm/reg.h -+++ b/arch/powerpc/include/asm/reg.h -@@ -1236,7 +1236,7 @@ static inline unsigned long mfvtb (void) - " .llong 0\n" \ - ".previous" \ - : "=r" (rval) \ -- : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL)); \ -+ : "i" (CPU_FTR_CELL_TB_BUG), "i" (SPRN_TBRL) : "cr0"); \ - rval;}) - #else - #define mftb() ({unsigned long rval; \ -diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c -index 4014881e9843..e37162d356d8 100644 ---- a/arch/powerpc/lib/sstep.c -+++ b/arch/powerpc/lib/sstep.c -@@ -687,8 +687,10 @@ int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs, - case 19: - switch ((instr >> 1) & 0x3ff) { - case 0: /* mcrf */ -- rd = (instr >> 21) & 0x1c; -- ra = (instr >> 16) & 0x1c; -+ rd = 7 - ((instr >> 23) & 0x7); -+ ra = 7 - ((instr >> 18) & 0x7); -+ rd *= 4; -+ ra *= 4; - val = (regs->ccr >> ra) & 0xf; - regs->ccr = (regs->ccr & ~(0xfUL << rd)) | (val << rd); - goto instr_done; -@@ -967,6 +969,19 @@ int __kprobes analyse_instr(struct instruction_op *op, struct pt_regs *regs, - #endif - - case 19: /* mfcr */ -+ if ((instr >> 20) & 1) { -+ imm = 0xf0000000UL; -+ for (sh = 0; sh < 8; ++sh) { -+ if (instr & (0x80000 >> sh)) { -+ regs->gpr[rd] = regs->ccr & imm; -+ break; -+ } -+ imm >>= 4; -+ } -+ -+ goto instr_done; -+ } -+ - regs->gpr[rd] = regs->ccr; - regs->gpr[rd] &= 0xffffffffUL; - goto instr_done; -diff --git a/arch/s390/include/asm/syscall.h b/arch/s390/include/asm/syscall.h -index 6ba0bf928909..6bc941be6921 100644 ---- a/arch/s390/include/asm/syscall.h -+++ b/arch/s390/include/asm/syscall.h -@@ -64,6 +64,12 @@ static inline void syscall_get_arguments(struct task_struct *task, - { - unsigned long mask = -1UL; - -+ /* -+ * No arguments for this syscall, there's nothing to do. -+ */ -+ if (!n) -+ return; -+ - BUG_ON(i + n > 6); - #ifdef CONFIG_COMPAT - if (test_tsk_thread_flag(task, TIF_31BIT)) -diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h -index 4c20dd333412..85133b2b8e99 100644 ---- a/arch/x86/include/asm/xen/hypercall.h -+++ b/arch/x86/include/asm/xen/hypercall.h -@@ -43,6 +43,7 @@ - - #include - #include -+#include - - #include - #include -@@ -213,10 +214,12 @@ privcmd_call(unsigned call, - __HYPERCALL_DECLS; - __HYPERCALL_5ARG(a1, a2, a3, a4, a5); - -+ stac(); - asm volatile("call *%[call]" - : __HYPERCALL_5PARAM - : [call] "a" (&hypercall_page[call]) - : __HYPERCALL_CLOBBER5); -+ clac(); - - return (long)__res; - } -diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c -index e75907601a41..1e5eb9f2ff5f 100644 ---- a/arch/x86/kernel/acpi/boot.c -+++ b/arch/x86/kernel/acpi/boot.c -@@ -329,6 +329,14 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, - struct mpc_intsrc mp_irq; - - /* -+ * Check bus_irq boundary. -+ */ -+ if (bus_irq >= NR_IRQS_LEGACY) { -+ pr_warn("Invalid bus_irq %u for legacy override\n", bus_irq); -+ return; -+ } -+ -+ /* - * Convert 'gsi' to 'ioapic.pin'. - */ - ioapic = mp_find_ioapic(gsi); -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 1e5d2f07416b..fc91c98bee01 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2115,7 +2115,7 @@ static inline void __init check_timer(void) - int idx; - idx = find_irq_entry(apic1, pin1, mp_INT); - if (idx != -1 && irq_trigger(idx)) -- unmask_ioapic_irq(irq_get_chip_data(0)); -+ unmask_ioapic_irq(irq_get_irq_data(0)); - } - irq_domain_deactivate_irq(irq_data); - irq_domain_activate_irq(irq_data); -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index a48824deabc5..3f94e5fc110a 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -1373,7 +1373,7 @@ EXPORT_SYMBOL_GPL(pm_genpd_add_subdomain); - int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd, - struct generic_pm_domain *subdomain) - { -- struct gpd_link *link; -+ struct gpd_link *l, *link; - int ret = -EINVAL; - - if (IS_ERR_OR_NULL(genpd) || IS_ERR_OR_NULL(subdomain)) -@@ -1388,7 +1388,7 @@ int pm_genpd_remove_subdomain(struct generic_pm_domain *genpd, - goto out; - } - -- list_for_each_entry(link, &genpd->master_links, master_node) { -+ list_for_each_entry_safe(link, l, &genpd->master_links, master_node) { - if (link->slave != subdomain) - continue; - -@@ -1642,10 +1642,10 @@ EXPORT_SYMBOL_GPL(__of_genpd_add_provider); - */ - void of_genpd_del_provider(struct device_node *np) - { -- struct of_genpd_provider *cp; -+ struct of_genpd_provider *cp, *tmp; - - mutex_lock(&of_genpd_mutex); -- list_for_each_entry(cp, &of_genpd_providers, link) { -+ list_for_each_entry_safe(cp, tmp, &of_genpd_providers, link) { - if (cp->node == np) { - list_del(&cp->link); - of_node_put(cp->node); -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index a084a4751fa9..25372dc381d4 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -3877,6 +3877,9 @@ static void smi_recv_tasklet(unsigned long val) - * because the lower layer is allowed to hold locks while calling - * message delivery. - */ -+ -+ rcu_read_lock(); -+ - if (!run_to_completion) - spin_lock_irqsave(&intf->xmit_msgs_lock, flags); - if (intf->curr_msg == NULL && !intf->in_shutdown) { -@@ -3899,6 +3902,8 @@ static void smi_recv_tasklet(unsigned long val) - if (newmsg) - intf->handlers->sender(intf->send_info, newmsg); - -+ rcu_read_unlock(); -+ - handle_new_recv_msgs(intf); - } - -diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c -index 0d83cfb9708f..f53e8ba2c718 100644 ---- a/drivers/char/ipmi/ipmi_ssif.c -+++ b/drivers/char/ipmi/ipmi_ssif.c -@@ -758,6 +758,11 @@ static void msg_done_handler(struct ssif_info *ssif_info, int result, - result, len, data[2]); - } else if (data[0] != (IPMI_NETFN_APP_REQUEST | 1) << 2 - || data[1] != IPMI_GET_MSG_FLAGS_CMD) { -+ /* -+ * Don't abort here, maybe it was a queued -+ * response to a previous command. -+ */ -+ ipmi_ssif_unlock_cond(ssif_info, flags); - pr_warn(PFX "Invalid response getting flags: %x %x\n", - data[0], data[1]); - } else { -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -index 475c38fe9245..e40a6d8b0b92 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c -@@ -1126,6 +1126,9 @@ static ssize_t amdgpu_ttm_vram_read(struct file *f, char __user *buf, - if (size & 0x3 || *pos & 0x3) - return -EINVAL; - -+ if (*pos >= adev->mc.mc_vram_size) -+ return -ENXIO; -+ - while (size) { - unsigned long flags; - uint32_t value; -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index a3b96d691ac9..58bf94b69186 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -330,6 +330,13 @@ static bool drm_dp_sideband_msg_build(struct drm_dp_sideband_msg_rx *msg, - return false; - } - -+ /* -+ * ignore out-of-order messages or messages that are part of a -+ * failed transaction -+ */ -+ if (!recv_hdr.somt && !msg->have_somt) -+ return false; -+ - /* get length contained in this portion */ - msg->curchunk_len = recv_hdr.msg_len; - msg->curchunk_hdrlen = hdrlen; -@@ -2163,7 +2170,7 @@ out_unlock: - } - EXPORT_SYMBOL(drm_dp_mst_topology_mgr_resume); - --static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up) -+static bool drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up) - { - int len; - u8 replyblock[32]; -@@ -2178,12 +2185,12 @@ static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up) - replyblock, len); - if (ret != len) { - DRM_DEBUG_KMS("failed to read DPCD down rep %d %d\n", len, ret); -- return; -+ return false; - } - ret = drm_dp_sideband_msg_build(msg, replyblock, len, true); - if (!ret) { - DRM_DEBUG_KMS("sideband msg build failed %d\n", replyblock[0]); -- return; -+ return false; - } - replylen = msg->curchunk_len + msg->curchunk_hdrlen; - -@@ -2195,21 +2202,32 @@ static void drm_dp_get_one_sb_msg(struct drm_dp_mst_topology_mgr *mgr, bool up) - ret = drm_dp_dpcd_read(mgr->aux, basereg + curreply, - replyblock, len); - if (ret != len) { -- DRM_DEBUG_KMS("failed to read a chunk\n"); -+ DRM_DEBUG_KMS("failed to read a chunk (len %d, ret %d)\n", -+ len, ret); -+ return false; - } -+ - ret = drm_dp_sideband_msg_build(msg, replyblock, len, false); -- if (ret == false) -+ if (!ret) { - DRM_DEBUG_KMS("failed to build sideband msg\n"); -+ return false; -+ } -+ - curreply += len; - replylen -= len; - } -+ return true; - } - - static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr) - { - int ret = 0; - -- drm_dp_get_one_sb_msg(mgr, false); -+ if (!drm_dp_get_one_sb_msg(mgr, false)) { -+ memset(&mgr->down_rep_recv, 0, -+ sizeof(struct drm_dp_sideband_msg_rx)); -+ return 0; -+ } - - if (mgr->down_rep_recv.have_eomt) { - struct drm_dp_sideband_msg_tx *txmsg; -@@ -2265,7 +2283,12 @@ static int drm_dp_mst_handle_down_rep(struct drm_dp_mst_topology_mgr *mgr) - static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - { - int ret = 0; -- drm_dp_get_one_sb_msg(mgr, true); -+ -+ if (!drm_dp_get_one_sb_msg(mgr, true)) { -+ memset(&mgr->up_req_recv, 0, -+ sizeof(struct drm_dp_sideband_msg_rx)); -+ return 0; -+ } - - if (mgr->up_req_recv.have_eomt) { - struct drm_dp_sideband_msg_req_body msg; -@@ -2317,7 +2340,9 @@ static int drm_dp_mst_handle_up_req(struct drm_dp_mst_topology_mgr *mgr) - DRM_DEBUG_KMS("Got RSN: pn: %d avail_pbn %d\n", msg.u.resource_stat.port_number, msg.u.resource_stat.available_pbn); - } - -- drm_dp_put_mst_branch_device(mstb); -+ if (mstb) -+ drm_dp_put_mst_branch_device(mstb); -+ - memset(&mgr->up_req_recv, 0, sizeof(struct drm_dp_sideband_msg_rx)); - } - return ret; -diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c -index d4ac8c837314..8e86cf7da614 100644 ---- a/drivers/gpu/drm/radeon/atombios_encoders.c -+++ b/drivers/gpu/drm/radeon/atombios_encoders.c -@@ -30,6 +30,7 @@ - #include "radeon_audio.h" - #include "atom.h" - #include -+#include - - extern int atom_debug; - -@@ -2183,9 +2184,17 @@ int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder, int fe_idx) - goto assigned; - } - -- /* on DCE32 and encoder can driver any block so just crtc id */ -+ /* -+ * On DCE32 any encoder can drive any block so usually just use crtc id, -+ * but Apple thinks different at least on iMac10,1, so there use linkb, -+ * otherwise the internal eDP panel will stay dark. -+ */ - if (ASIC_IS_DCE32(rdev)) { -- enc_idx = radeon_crtc->crtc_id; -+ if (dmi_match(DMI_PRODUCT_NAME, "iMac10,1")) -+ enc_idx = (dig->linkb) ? 1 : 0; -+ else -+ enc_idx = radeon_crtc->crtc_id; -+ - goto assigned; - } - -diff --git a/drivers/gpu/drm/radeon/ci_dpm.c b/drivers/gpu/drm/radeon/ci_dpm.c -index 3c32f095a873..2ccf81168d1e 100644 ---- a/drivers/gpu/drm/radeon/ci_dpm.c -+++ b/drivers/gpu/drm/radeon/ci_dpm.c -@@ -782,6 +782,12 @@ bool ci_dpm_vblank_too_short(struct radeon_device *rdev) - if (r600_dpm_get_vrefresh(rdev) > 120) - return true; - -+ /* disable mclk switching if the refresh is >120Hz, even if the -+ * blanking period would allow it -+ */ -+ if (r600_dpm_get_vrefresh(rdev) > 120) -+ return true; -+ - if (vblank_time < switch_limit) - return true; - else -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 3f5741a3e728..43d5166db4c6 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -857,6 +857,8 @@ int rdma_init_qp_attr(struct rdma_cm_id *id, struct ib_qp_attr *qp_attr, - } else - ret = iw_cm_init_qp_attr(id_priv->cm_id.iw, qp_attr, - qp_attr_mask); -+ qp_attr->port_num = id_priv->id.port_num; -+ *qp_attr_mask |= IB_QP_PORT; - } else - ret = -ENOSYS; - -diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c -index 89abfdb539ac..c84c685056b9 100644 ---- a/drivers/input/serio/i8042.c -+++ b/drivers/input/serio/i8042.c -@@ -434,8 +434,10 @@ static int i8042_start(struct serio *serio) - { - struct i8042_port *port = serio->port_data; - -+ spin_lock_irq(&i8042_lock); - port->exists = true; -- mb(); -+ spin_unlock_irq(&i8042_lock); -+ - return 0; - } - -@@ -448,16 +450,20 @@ static void i8042_stop(struct serio *serio) - { - struct i8042_port *port = serio->port_data; - -+ spin_lock_irq(&i8042_lock); - port->exists = false; -+ port->serio = NULL; -+ spin_unlock_irq(&i8042_lock); - - /* -+ * We need to make sure that interrupt handler finishes using -+ * our serio port before we return from this function. - * We synchronize with both AUX and KBD IRQs because there is - * a (very unlikely) chance that AUX IRQ is raised for KBD port - * and vice versa. - */ - synchronize_irq(I8042_AUX_IRQ); - synchronize_irq(I8042_KBD_IRQ); -- port->serio = NULL; - } - - /* -@@ -574,7 +580,7 @@ static irqreturn_t i8042_interrupt(int irq, void *dev_id) - - spin_unlock_irqrestore(&i8042_lock, flags); - -- if (likely(port->exists && !filtered)) -+ if (likely(serio && !filtered)) - serio_interrupt(serio, data, dfl); - - out: -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index d81be5e471d0..f24a9e14021d 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1088,7 +1088,7 @@ static void make_request(struct mddev *mddev, struct bio * bio) - */ - DEFINE_WAIT(w); - for (;;) { -- flush_signals(current); -+ sigset_t full, old; - prepare_to_wait(&conf->wait_barrier, - &w, TASK_INTERRUPTIBLE); - if (bio_end_sector(bio) <= mddev->suspend_lo || -@@ -1097,7 +1097,10 @@ static void make_request(struct mddev *mddev, struct bio * bio) - !md_cluster_ops->area_resyncing(mddev, WRITE, - bio->bi_iter.bi_sector, bio_end_sector(bio)))) - break; -+ sigfillset(&full); -+ sigprocmask(SIG_BLOCK, &full, &old); - schedule(); -+ sigprocmask(SIG_SETMASK, &old, NULL); - } - finish_wait(&conf->wait_barrier, &w); - } -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 4384b46cee1a..fc182c4f2619 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -5279,12 +5279,15 @@ static void make_request(struct mddev *mddev, struct bio * bi) - * userspace, we want an interruptible - * wait. - */ -- flush_signals(current); - prepare_to_wait(&conf->wait_for_overlap, - &w, TASK_INTERRUPTIBLE); - if (logical_sector >= mddev->suspend_lo && - logical_sector < mddev->suspend_hi) { -+ sigset_t full, old; -+ sigfillset(&full); -+ sigprocmask(SIG_BLOCK, &full, &old); - schedule(); -+ sigprocmask(SIG_SETMASK, &old, NULL); - do_prepare = true; - } - goto retry; -@@ -7528,12 +7531,10 @@ static void end_reshape(struct r5conf *conf) - { - - if (!test_bit(MD_RECOVERY_INTR, &conf->mddev->recovery)) { -- struct md_rdev *rdev; - - spin_lock_irq(&conf->device_lock); - conf->previous_raid_disks = conf->raid_disks; -- rdev_for_each(rdev, conf->mddev) -- rdev->data_offset = rdev->new_data_offset; -+ md_finish_reshape(conf->mddev); - smp_wmb(); - conf->reshape_progress = MaxSector; - conf->mddev->reshape_position = MaxSector; -diff --git a/drivers/media/pci/cx88/cx88-cards.c b/drivers/media/pci/cx88/cx88-cards.c -index 8f2556ec3971..61611d1682d1 100644 ---- a/drivers/media/pci/cx88/cx88-cards.c -+++ b/drivers/media/pci/cx88/cx88-cards.c -@@ -3691,7 +3691,14 @@ struct cx88_core *cx88_core_create(struct pci_dev *pci, int nr) - core->nr = nr; - sprintf(core->name, "cx88[%d]", core->nr); - -- core->tvnorm = V4L2_STD_NTSC_M; -+ /* -+ * Note: Setting initial standard here would cause first call to -+ * cx88_set_tvnorm() to return without programming any registers. Leave -+ * it blank for at this point and it will get set later in -+ * cx8800_initdev() -+ */ -+ core->tvnorm = 0; -+ - core->width = 320; - core->height = 240; - core->field = V4L2_FIELD_INTERLACED; -diff --git a/drivers/media/pci/cx88/cx88-video.c b/drivers/media/pci/cx88/cx88-video.c -index aef9acf351f6..abbf5b05b6f5 100644 ---- a/drivers/media/pci/cx88/cx88-video.c -+++ b/drivers/media/pci/cx88/cx88-video.c -@@ -1429,7 +1429,7 @@ static int cx8800_initdev(struct pci_dev *pci_dev, - - /* initial device configuration */ - mutex_lock(&core->lock); -- cx88_set_tvnorm(core, core->tvnorm); -+ cx88_set_tvnorm(core, V4L2_STD_NTSC_M); - v4l2_ctrl_handler_setup(&core->video_hdl); - v4l2_ctrl_handler_setup(&core->audio_hdl); - cx88_video_mux(core, 0); -diff --git a/drivers/media/platform/s5p-jpeg/jpeg-core.c b/drivers/media/platform/s5p-jpeg/jpeg-core.c -index 4a608cbe0fdb..9c6fc09b88e0 100644 ---- a/drivers/media/platform/s5p-jpeg/jpeg-core.c -+++ b/drivers/media/platform/s5p-jpeg/jpeg-core.c -@@ -1098,10 +1098,10 @@ static bool s5p_jpeg_parse_hdr(struct s5p_jpeg_q_data *result, - struct s5p_jpeg_ctx *ctx) - { - int c, components = 0, notfound, n_dht = 0, n_dqt = 0; -- unsigned int height, width, word, subsampling = 0, sos = 0, sof = 0, -- sof_len = 0; -- unsigned int dht[S5P_JPEG_MAX_MARKER], dht_len[S5P_JPEG_MAX_MARKER], -- dqt[S5P_JPEG_MAX_MARKER], dqt_len[S5P_JPEG_MAX_MARKER]; -+ unsigned int height = 0, width = 0, word, subsampling = 0; -+ unsigned int sos = 0, sof = 0, sof_len = 0; -+ unsigned int dht[S5P_JPEG_MAX_MARKER], dht_len[S5P_JPEG_MAX_MARKER]; -+ unsigned int dqt[S5P_JPEG_MAX_MARKER], dqt_len[S5P_JPEG_MAX_MARKER]; - long length; - struct s5p_jpeg_buffer jpeg_buffer; - -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index 65f80b8b9f7a..eb9e7feb9b13 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -1629,7 +1629,7 @@ static void imon_incoming_packet(struct imon_context *ictx, - if (kc == KEY_KEYBOARD && !ictx->release_code) { - ictx->last_keycode = kc; - if (!nomouse) { -- ictx->pad_mouse = ~(ictx->pad_mouse) & 0x1; -+ ictx->pad_mouse = !ictx->pad_mouse; - dev_dbg(dev, "toggling to %s mode\n", - ictx->pad_mouse ? "mouse" : "keyboard"); - spin_unlock_irqrestore(&ictx->kc_lock, flags); -diff --git a/drivers/misc/enclosure.c b/drivers/misc/enclosure.c -index 65fed7146e9b..cc91f7b3d90c 100644 ---- a/drivers/misc/enclosure.c -+++ b/drivers/misc/enclosure.c -@@ -375,6 +375,7 @@ int enclosure_add_device(struct enclosure_device *edev, int component, - struct device *dev) - { - struct enclosure_component *cdev; -+ int err; - - if (!edev || component >= edev->components) - return -EINVAL; -@@ -384,12 +385,17 @@ int enclosure_add_device(struct enclosure_device *edev, int component, - if (cdev->dev == dev) - return -EEXIST; - -- if (cdev->dev) -+ if (cdev->dev) { - enclosure_remove_links(cdev); -- -- put_device(cdev->dev); -+ put_device(cdev->dev); -+ } - cdev->dev = get_device(dev); -- return enclosure_add_links(cdev); -+ err = enclosure_add_links(cdev); -+ if (err) { -+ put_device(cdev->dev); -+ cdev->dev = NULL; -+ } -+ return err; - } - EXPORT_SYMBOL_GPL(enclosure_add_device); - -diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c -index 201425e7f9cb..fbc8c9a9014b 100644 ---- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c -+++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c -@@ -1815,8 +1815,6 @@ static void ar9003_hw_spectral_scan_wait(struct ath_hw *ah) - static void ar9003_hw_tx99_start(struct ath_hw *ah, u32 qnum) - { - REG_SET_BIT(ah, AR_PHY_TEST, PHY_AGC_CLR); -- REG_SET_BIT(ah, 0x9864, 0x7f000); -- REG_SET_BIT(ah, 0x9924, 0x7f00fe); - REG_CLR_BIT(ah, AR_DIAG_SW, AR_DIAG_RX_DIS); - REG_WRITE(ah, AR_CR, AR_CR_RXD); - REG_WRITE(ah, AR_DLCL_IFS(qnum), 0); -diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c -index ac4781f37e78..b4e6304afd40 100644 ---- a/drivers/net/wireless/ath/ath9k/tx99.c -+++ b/drivers/net/wireless/ath/ath9k/tx99.c -@@ -190,22 +190,27 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, - if (strtobool(buf, &start)) - return -EINVAL; - -+ mutex_lock(&sc->mutex); -+ - if (start == sc->tx99_state) { - if (!start) -- return count; -+ goto out; - ath_dbg(common, XMIT, "Resetting TX99\n"); - ath9k_tx99_deinit(sc); - } - - if (!start) { - ath9k_tx99_deinit(sc); -- return count; -+ goto out; - } - - r = ath9k_tx99_init(sc); -- if (r) -+ if (r) { -+ mutex_unlock(&sc->mutex); - return r; -- -+ } -+out: -+ mutex_unlock(&sc->mutex); - return count; - } - -diff --git a/drivers/net/wireless/ti/wlcore/spi.c b/drivers/net/wireless/ti/wlcore/spi.c -index 44f059f7f34e..9ebe00ea8f81 100644 ---- a/drivers/net/wireless/ti/wlcore/spi.c -+++ b/drivers/net/wireless/ti/wlcore/spi.c -@@ -71,7 +71,7 @@ - * only support SPI for 12xx - this code should be reworked when 18xx - * support is introduced - */ --#define SPI_AGGR_BUFFER_SIZE (4 * PAGE_SIZE) -+#define SPI_AGGR_BUFFER_SIZE (4 * SZ_4K) - - /* Maximum number of SPI write chunks */ - #define WSPI_MAX_NUM_OF_CHUNKS \ -diff --git a/drivers/nfc/nfcmrvl/fw_dnld.c b/drivers/nfc/nfcmrvl/fw_dnld.c -index f8dcdf4b24f6..af62c4c854f3 100644 ---- a/drivers/nfc/nfcmrvl/fw_dnld.c -+++ b/drivers/nfc/nfcmrvl/fw_dnld.c -@@ -459,7 +459,7 @@ int nfcmrvl_fw_dnld_init(struct nfcmrvl_private *priv) - - INIT_WORK(&priv->fw_dnld.rx_work, fw_dnld_rx_work); - snprintf(name, sizeof(name), "%s_nfcmrvl_fw_dnld_rx_wq", -- dev_name(priv->dev)); -+ dev_name(&priv->ndev->nfc_dev->dev)); - priv->fw_dnld.rx_wq = create_singlethread_workqueue(name); - if (!priv->fw_dnld.rx_wq) - return -ENOMEM; -@@ -496,6 +496,7 @@ int nfcmrvl_fw_dnld_start(struct nci_dev *ndev, const char *firmware_name) - { - struct nfcmrvl_private *priv = nci_get_drvdata(ndev); - struct nfcmrvl_fw_dnld *fw_dnld = &priv->fw_dnld; -+ int res; - - if (!priv->support_fw_dnld) - return -ENOTSUPP; -@@ -511,7 +512,9 @@ int nfcmrvl_fw_dnld_start(struct nci_dev *ndev, const char *firmware_name) - */ - - /* Retrieve FW binary */ -- if (request_firmware(&fw_dnld->fw, firmware_name, priv->dev) < 0) { -+ res = request_firmware(&fw_dnld->fw, firmware_name, -+ &ndev->nfc_dev->dev); -+ if (res < 0) { - nfc_err(priv->dev, "failed to retrieve FW %s", firmware_name); - return -ENOENT; - } -diff --git a/drivers/nfc/nfcmrvl/main.c b/drivers/nfc/nfcmrvl/main.c -index 51c8240a1672..a446590a71ca 100644 ---- a/drivers/nfc/nfcmrvl/main.c -+++ b/drivers/nfc/nfcmrvl/main.c -@@ -124,12 +124,13 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, - memcpy(&priv->config, pdata, sizeof(*pdata)); - - if (priv->config.reset_n_io) { -- rc = devm_gpio_request_one(dev, -- priv->config.reset_n_io, -- GPIOF_OUT_INIT_LOW, -- "nfcmrvl_reset_n"); -- if (rc < 0) -+ rc = gpio_request_one(priv->config.reset_n_io, -+ GPIOF_OUT_INIT_LOW, -+ "nfcmrvl_reset_n"); -+ if (rc < 0) { -+ priv->config.reset_n_io = 0; - nfc_err(dev, "failed to request reset_n io\n"); -+ } - } - - if (phy == NFCMRVL_PHY_SPI) { -@@ -154,7 +155,13 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, - if (!priv->ndev) { - nfc_err(dev, "nci_allocate_device failed\n"); - rc = -ENOMEM; -- goto error; -+ goto error_free_gpio; -+ } -+ -+ rc = nfcmrvl_fw_dnld_init(priv); -+ if (rc) { -+ nfc_err(dev, "failed to initialize FW download %d\n", rc); -+ goto error_free_dev; - } - - nci_set_drvdata(priv->ndev, priv); -@@ -162,24 +169,22 @@ struct nfcmrvl_private *nfcmrvl_nci_register_dev(enum nfcmrvl_phy phy, - rc = nci_register_device(priv->ndev); - if (rc) { - nfc_err(dev, "nci_register_device failed %d\n", rc); -- goto error_free_dev; -+ goto error_fw_dnld_deinit; - } - - /* Ensure that controller is powered off */ - nfcmrvl_chip_halt(priv); - -- rc = nfcmrvl_fw_dnld_init(priv); -- if (rc) { -- nfc_err(dev, "failed to initialize FW download %d\n", rc); -- goto error_free_dev; -- } -- - nfc_info(dev, "registered with nci successfully\n"); - return priv; - -+error_fw_dnld_deinit: -+ nfcmrvl_fw_dnld_deinit(priv); - error_free_dev: - nci_free_device(priv->ndev); --error: -+error_free_gpio: -+ if (priv->config.reset_n_io) -+ gpio_free(priv->config.reset_n_io); - kfree(priv); - return ERR_PTR(rc); - } -@@ -195,7 +200,7 @@ void nfcmrvl_nci_unregister_dev(struct nfcmrvl_private *priv) - nfcmrvl_fw_dnld_deinit(priv); - - if (priv->config.reset_n_io) -- devm_gpio_free(priv->dev, priv->config.reset_n_io); -+ gpio_free(priv->config.reset_n_io); - - nci_unregister_device(ndev); - nci_free_device(ndev); -diff --git a/drivers/nfc/nfcmrvl/uart.c b/drivers/nfc/nfcmrvl/uart.c -index 83a99e38e7bd..6c0c301611c4 100644 ---- a/drivers/nfc/nfcmrvl/uart.c -+++ b/drivers/nfc/nfcmrvl/uart.c -@@ -109,6 +109,7 @@ static int nfcmrvl_nci_uart_open(struct nci_uart *nu) - struct nfcmrvl_private *priv; - struct nfcmrvl_platform_data *pdata = NULL; - struct nfcmrvl_platform_data config; -+ struct device *dev = nu->tty->dev; - - /* - * Platform data cannot be used here since usually it is already used -@@ -116,9 +117,8 @@ static int nfcmrvl_nci_uart_open(struct nci_uart *nu) - * and check if DT entries were added. - */ - -- if (nu->tty->dev->parent && nu->tty->dev->parent->of_node) -- if (nfcmrvl_uart_parse_dt(nu->tty->dev->parent->of_node, -- &config) == 0) -+ if (dev && dev->parent && dev->parent->of_node) -+ if (nfcmrvl_uart_parse_dt(dev->parent->of_node, &config) == 0) - pdata = &config; - - if (!pdata) { -@@ -131,7 +131,7 @@ static int nfcmrvl_nci_uart_open(struct nci_uart *nu) - } - - priv = nfcmrvl_nci_register_dev(NFCMRVL_PHY_UART, nu, &uart_ops, -- nu->tty->dev, pdata); -+ dev, pdata); - if (IS_ERR(priv)) - return PTR_ERR(priv); - -diff --git a/drivers/of/device.c b/drivers/of/device.c -index e5f47cec75f3..97a280d50d6d 100644 ---- a/drivers/of/device.c -+++ b/drivers/of/device.c -@@ -225,6 +225,7 @@ ssize_t of_device_get_modalias(struct device *dev, char *str, ssize_t len) - - return tsize; - } -+EXPORT_SYMBOL_GPL(of_device_get_modalias); - - /** - * of_device_uevent - Display OF related uevent information -@@ -287,3 +288,4 @@ int of_device_uevent_modalias(struct device *dev, struct kobj_uevent_env *env) - - return 0; - } -+EXPORT_SYMBOL_GPL(of_device_uevent_modalias); -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index d7ffd66814bb..fca925543fae 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -945,6 +945,7 @@ static int pci_pm_thaw_noirq(struct device *dev) - return pci_legacy_resume_early(dev); - - pci_update_current_state(pci_dev, PCI_D0); -+ pci_restore_state(pci_dev); - - if (drv && drv->pm && drv->pm->thaw_noirq) - error = drv->pm->thaw_noirq(dev); -diff --git a/drivers/spmi/spmi.c b/drivers/spmi/spmi.c -index 6b3da1bb0d63..2db681722d2c 100644 ---- a/drivers/spmi/spmi.c -+++ b/drivers/spmi/spmi.c -@@ -364,11 +364,23 @@ static int spmi_drv_remove(struct device *dev) - return 0; - } - -+static int spmi_drv_uevent(struct device *dev, struct kobj_uevent_env *env) -+{ -+ int ret; -+ -+ ret = of_device_uevent_modalias(dev, env); -+ if (ret != -ENODEV) -+ return ret; -+ -+ return 0; -+} -+ - static struct bus_type spmi_bus_type = { - .name = "spmi", - .match = spmi_device_match, - .probe = spmi_drv_probe, - .remove = spmi_drv_remove, -+ .uevent = spmi_drv_uevent, - }; - - /** -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index 82a7c27c517f..02c3feef4e36 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -47,6 +47,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { - {USB_DEVICE(0x2001, 0x330F)}, /* DLink DWA-125 REV D1 */ - {USB_DEVICE(0x2001, 0x3310)}, /* Dlink DWA-123 REV D1 */ - {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ -+ {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ - {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ - {} /* Terminating entry */ - }; -diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c -index dc1bd1f1bdfe..634ad3662ed6 100644 ---- a/drivers/target/iscsi/iscsi_target_configfs.c -+++ b/drivers/target/iscsi/iscsi_target_configfs.c -@@ -868,6 +868,7 @@ DEF_TPG_ATTRIB(default_erl); - DEF_TPG_ATTRIB(t10_pi); - DEF_TPG_ATTRIB(fabric_prot_type); - DEF_TPG_ATTRIB(tpg_enabled_sendtargets); -+DEF_TPG_ATTRIB(login_keys_workaround); - - static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = { - &iscsi_tpg_attrib_attr_authentication, -@@ -883,6 +884,7 @@ static struct configfs_attribute *lio_target_tpg_attrib_attrs[] = { - &iscsi_tpg_attrib_attr_t10_pi, - &iscsi_tpg_attrib_attr_fabric_prot_type, - &iscsi_tpg_attrib_attr_tpg_enabled_sendtargets, -+ &iscsi_tpg_attrib_attr_login_keys_workaround, - NULL, - }; - -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 9fc9117d0f22..549a2bbbf4df 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -818,7 +818,8 @@ static int iscsi_target_handle_csg_zero( - SENDER_TARGET, - login->rsp_buf, - &login->rsp_length, -- conn->param_list); -+ conn->param_list, -+ conn->tpg->tpg_attrib.login_keys_workaround); - if (ret < 0) - return -1; - -@@ -888,7 +889,8 @@ static int iscsi_target_handle_csg_one(struct iscsi_conn *conn, struct iscsi_log - SENDER_TARGET, - login->rsp_buf, - &login->rsp_length, -- conn->param_list); -+ conn->param_list, -+ conn->tpg->tpg_attrib.login_keys_workaround); - if (ret < 0) { - iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_INITIATOR_ERR, - ISCSI_LOGIN_STATUS_INIT_ERR); -diff --git a/drivers/target/iscsi/iscsi_target_parameters.c b/drivers/target/iscsi/iscsi_target_parameters.c -index 6d1b0acbc5b3..76bde76edad1 100644 ---- a/drivers/target/iscsi/iscsi_target_parameters.c -+++ b/drivers/target/iscsi/iscsi_target_parameters.c -@@ -764,7 +764,8 @@ static int iscsi_check_for_auth_key(char *key) - return 0; - } - --static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param) -+static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param, -+ bool keys_workaround) - { - if (IS_TYPE_BOOL_AND(param)) { - if (!strcmp(param->value, NO)) -@@ -772,19 +773,31 @@ static void iscsi_check_proposer_for_optional_reply(struct iscsi_param *param) - } else if (IS_TYPE_BOOL_OR(param)) { - if (!strcmp(param->value, YES)) - SET_PSTATE_REPLY_OPTIONAL(param); -- /* -- * Required for gPXE iSCSI boot client -- */ -- if (!strcmp(param->name, IMMEDIATEDATA)) -- SET_PSTATE_REPLY_OPTIONAL(param); -+ -+ if (keys_workaround) { -+ /* -+ * Required for gPXE iSCSI boot client -+ */ -+ if (!strcmp(param->name, IMMEDIATEDATA)) -+ SET_PSTATE_REPLY_OPTIONAL(param); -+ } - } else if (IS_TYPE_NUMBER(param)) { - if (!strcmp(param->name, MAXRECVDATASEGMENTLENGTH)) - SET_PSTATE_REPLY_OPTIONAL(param); -- /* -- * Required for gPXE iSCSI boot client -- */ -- if (!strcmp(param->name, MAXCONNECTIONS)) -- SET_PSTATE_REPLY_OPTIONAL(param); -+ -+ if (keys_workaround) { -+ /* -+ * Required for Mellanox Flexboot PXE boot ROM -+ */ -+ if (!strcmp(param->name, FIRSTBURSTLENGTH)) -+ SET_PSTATE_REPLY_OPTIONAL(param); -+ -+ /* -+ * Required for gPXE iSCSI boot client -+ */ -+ if (!strcmp(param->name, MAXCONNECTIONS)) -+ SET_PSTATE_REPLY_OPTIONAL(param); -+ } - } else if (IS_PHASE_DECLARATIVE(param)) - SET_PSTATE_REPLY_OPTIONAL(param); - } -@@ -1421,7 +1434,8 @@ int iscsi_encode_text_output( - u8 sender, - char *textbuf, - u32 *length, -- struct iscsi_param_list *param_list) -+ struct iscsi_param_list *param_list, -+ bool keys_workaround) - { - char *output_buf = NULL; - struct iscsi_extra_response *er; -@@ -1457,7 +1471,8 @@ int iscsi_encode_text_output( - *length += 1; - output_buf = textbuf + *length; - SET_PSTATE_PROPOSER(param); -- iscsi_check_proposer_for_optional_reply(param); -+ iscsi_check_proposer_for_optional_reply(param, -+ keys_workaround); - pr_debug("Sending key: %s=%s\n", - param->name, param->value); - } -diff --git a/drivers/target/iscsi/iscsi_target_parameters.h b/drivers/target/iscsi/iscsi_target_parameters.h -index a0751e3f0813..17a58c2913f2 100644 ---- a/drivers/target/iscsi/iscsi_target_parameters.h -+++ b/drivers/target/iscsi/iscsi_target_parameters.h -@@ -40,7 +40,7 @@ extern int iscsi_extract_key_value(char *, char **, char **); - extern int iscsi_update_param_value(struct iscsi_param *, char *); - extern int iscsi_decode_text_input(u8, u8, char *, u32, struct iscsi_conn *); - extern int iscsi_encode_text_output(u8, u8, char *, u32 *, -- struct iscsi_param_list *); -+ struct iscsi_param_list *, bool); - extern int iscsi_check_negotiated_keys(struct iscsi_param_list *); - extern void iscsi_set_connection_parameters(struct iscsi_conn_ops *, - struct iscsi_param_list *); -diff --git a/drivers/target/iscsi/iscsi_target_tpg.c b/drivers/target/iscsi/iscsi_target_tpg.c -index 205a509b0dfb..63e1dcc5914d 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.c -+++ b/drivers/target/iscsi/iscsi_target_tpg.c -@@ -227,6 +227,7 @@ static void iscsit_set_default_tpg_attribs(struct iscsi_portal_group *tpg) - a->t10_pi = TA_DEFAULT_T10_PI; - a->fabric_prot_type = TA_DEFAULT_FABRIC_PROT_TYPE; - a->tpg_enabled_sendtargets = TA_DEFAULT_TPG_ENABLED_SENDTARGETS; -+ a->login_keys_workaround = TA_DEFAULT_LOGIN_KEYS_WORKAROUND; - } - - int iscsit_tpg_add_portal_group(struct iscsi_tiqn *tiqn, struct iscsi_portal_group *tpg) -@@ -899,3 +900,21 @@ int iscsit_ta_tpg_enabled_sendtargets( - - return 0; - } -+ -+int iscsit_ta_login_keys_workaround( -+ struct iscsi_portal_group *tpg, -+ u32 flag) -+{ -+ struct iscsi_tpg_attrib *a = &tpg->tpg_attrib; -+ -+ if ((flag != 0) && (flag != 1)) { -+ pr_err("Illegal value %d\n", flag); -+ return -EINVAL; -+ } -+ -+ a->login_keys_workaround = flag; -+ pr_debug("iSCSI_TPG[%hu] - TPG enabled bit for login keys workaround: %s ", -+ tpg->tpgt, (a->login_keys_workaround) ? "ON" : "OFF"); -+ -+ return 0; -+} -diff --git a/drivers/target/iscsi/iscsi_target_tpg.h b/drivers/target/iscsi/iscsi_target_tpg.h -index 2da211920c18..901a712180f0 100644 ---- a/drivers/target/iscsi/iscsi_target_tpg.h -+++ b/drivers/target/iscsi/iscsi_target_tpg.h -@@ -39,5 +39,6 @@ extern int iscsit_ta_default_erl(struct iscsi_portal_group *, u32); - extern int iscsit_ta_t10_pi(struct iscsi_portal_group *, u32); - extern int iscsit_ta_fabric_prot_type(struct iscsi_portal_group *, u32); - extern int iscsit_ta_tpg_enabled_sendtargets(struct iscsi_portal_group *, u32); -+extern int iscsit_ta_login_keys_workaround(struct iscsi_portal_group *, u32); - - #endif /* ISCSI_TARGET_TPG_H */ -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 37c77db6e737..f71bedea973a 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -728,6 +728,15 @@ void target_complete_cmd(struct se_cmd *cmd, u8 scsi_status) - if (cmd->transport_state & CMD_T_ABORTED || - cmd->transport_state & CMD_T_STOP) { - spin_unlock_irqrestore(&cmd->t_state_lock, flags); -+ /* -+ * If COMPARE_AND_WRITE was stopped by __transport_wait_for_tasks(), -+ * release se_device->caw_sem obtained by sbc_compare_and_write() -+ * since target_complete_ok_work() or target_complete_failure_work() -+ * won't be called to invoke the normal CAW completion callbacks. -+ */ -+ if (cmd->se_cmd_flags & SCF_COMPARE_AND_WRITE) { -+ up(&dev->caw_sem); -+ } - complete_all(&cmd->t_transport_stop_comp); - return; - } else if (!success) { -diff --git a/drivers/thermal/cpu_cooling.c b/drivers/thermal/cpu_cooling.c -index 5b4b47ed948b..87d87ac1c8a0 100644 ---- a/drivers/thermal/cpu_cooling.c -+++ b/drivers/thermal/cpu_cooling.c -@@ -191,8 +191,10 @@ unsigned long cpufreq_cooling_get_level(unsigned int cpu, unsigned int freq) - mutex_lock(&cooling_list_lock); - list_for_each_entry(cpufreq_dev, &cpufreq_dev_list, node) { - if (cpumask_test_cpu(cpu, &cpufreq_dev->allowed_cpus)) { -+ unsigned long level = get_level(cpufreq_dev, freq); -+ - mutex_unlock(&cooling_list_lock); -- return get_level(cpufreq_dev, freq); -+ return level; - } - } - mutex_unlock(&cooling_list_lock); -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 0b7194086c5a..df96f5f88c15 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1759,6 +1759,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x1576, 0x03b1), /* Maretron USB100 */ - .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ - }, -+ { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */ -+ .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ -+ }, - - { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ - .driver_info = CLEAR_HALT_CONDITIONS, -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index e9675e8f0e54..a8a2d5005e6e 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -768,6 +768,9 @@ static u32 xhci_get_port_status(struct usb_hcd *hcd, - clear_bit(wIndex, &bus_state->resuming_ports); - - set_bit(wIndex, &bus_state->rexit_ports); -+ -+ xhci_test_and_clear_bit(xhci, port_array, wIndex, -+ PORT_PLC); - xhci_set_link_state(xhci, port_array, wIndex, - XDEV_U0); - -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index de7dce6eb474..ece0787d62bf 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -856,13 +856,16 @@ static void xhci_kill_endpoint_urbs(struct xhci_hcd *xhci, - (ep->ep_state & EP_GETTING_NO_STREAMS)) { - int stream_id; - -- for (stream_id = 0; stream_id < ep->stream_info->num_streams; -+ for (stream_id = 1; stream_id < ep->stream_info->num_streams; - stream_id++) { -+ ring = ep->stream_info->stream_rings[stream_id]; -+ if (!ring) -+ continue; -+ - xhci_dbg_trace(xhci, trace_xhci_dbg_cancel_urb, - "Killing URBs for slot ID %u, ep index %u, stream %u", -- slot_id, ep_index, stream_id + 1); -- xhci_kill_ring_urbs(xhci, -- ep->stream_info->stream_rings[stream_id]); -+ slot_id, ep_index, stream_id); -+ xhci_kill_ring_urbs(xhci, ring); - } - } else { - ring = ep->ring; -diff --git a/drivers/usb/renesas_usbhs/common.c b/drivers/usb/renesas_usbhs/common.c -index d82fa36c3465..005da0866836 100644 ---- a/drivers/usb/renesas_usbhs/common.c -+++ b/drivers/usb/renesas_usbhs/common.c -@@ -733,8 +733,10 @@ static int usbhsc_resume(struct device *dev) - struct usbhs_priv *priv = dev_get_drvdata(dev); - struct platform_device *pdev = usbhs_priv_to_pdev(priv); - -- if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) -+ if (!usbhsc_flags_has(priv, USBHSF_RUNTIME_PWCTRL)) { - usbhsc_power_ctrl(priv, 1); -+ usbhs_mod_autonomy_mode(priv); -+ } - - usbhs_platform_call(priv, phy_reset, pdev); - -diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c -index efc4fae123a4..8647d2c2a8c4 100644 ---- a/drivers/usb/renesas_usbhs/mod_gadget.c -+++ b/drivers/usb/renesas_usbhs/mod_gadget.c -@@ -37,6 +37,7 @@ struct usbhsg_gpriv; - struct usbhsg_uep { - struct usb_ep ep; - struct usbhs_pipe *pipe; -+ spinlock_t lock; /* protect the pipe */ - - char ep_name[EP_NAME_SIZE]; - -@@ -638,10 +639,16 @@ usbhsg_ep_enable_end: - static int usbhsg_ep_disable(struct usb_ep *ep) - { - struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); -- struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep); -+ struct usbhs_pipe *pipe; -+ unsigned long flags; -+ int ret = 0; - -- if (!pipe) -- return -EINVAL; -+ spin_lock_irqsave(&uep->lock, flags); -+ pipe = usbhsg_uep_to_pipe(uep); -+ if (!pipe) { -+ ret = -EINVAL; -+ goto out; -+ } - - usbhsg_pipe_disable(uep); - usbhs_pipe_free(pipe); -@@ -649,6 +656,9 @@ static int usbhsg_ep_disable(struct usb_ep *ep) - uep->pipe->mod_private = NULL; - uep->pipe = NULL; - -+out: -+ spin_unlock_irqrestore(&uep->lock, flags); -+ - return 0; - } - -@@ -698,8 +708,11 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req) - { - struct usbhsg_uep *uep = usbhsg_ep_to_uep(ep); - struct usbhsg_request *ureq = usbhsg_req_to_ureq(req); -- struct usbhs_pipe *pipe = usbhsg_uep_to_pipe(uep); -+ struct usbhs_pipe *pipe; -+ unsigned long flags; - -+ spin_lock_irqsave(&uep->lock, flags); -+ pipe = usbhsg_uep_to_pipe(uep); - if (pipe) - usbhs_pkt_pop(pipe, usbhsg_ureq_to_pkt(ureq)); - -@@ -708,6 +721,7 @@ static int usbhsg_ep_dequeue(struct usb_ep *ep, struct usb_request *req) - * even if the pipe is NULL. - */ - usbhsg_queue_pop(uep, ureq, -ECONNRESET); -+ spin_unlock_irqrestore(&uep->lock, flags); - - return 0; - } -@@ -854,10 +868,10 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status) - { - struct usbhsg_gpriv *gpriv = usbhsg_priv_to_gpriv(priv); - struct usbhs_mod *mod = usbhs_mod_get_current(priv); -- struct usbhsg_uep *dcp = usbhsg_gpriv_to_dcp(gpriv); -+ struct usbhsg_uep *uep; - struct device *dev = usbhs_priv_to_dev(priv); - unsigned long flags; -- int ret = 0; -+ int ret = 0, i; - - /******************** spin lock ********************/ - usbhs_lock(priv, flags); -@@ -889,7 +903,9 @@ static int usbhsg_try_stop(struct usbhs_priv *priv, u32 status) - usbhs_sys_set_test_mode(priv, 0); - usbhs_sys_function_ctrl(priv, 0); - -- usbhsg_ep_disable(&dcp->ep); -+ /* disable all eps */ -+ usbhsg_for_each_uep_with_dcp(uep, gpriv, i) -+ usbhsg_ep_disable(&uep->ep); - - dev_dbg(dev, "stop gadget\n"); - -@@ -1072,6 +1088,7 @@ int usbhs_mod_gadget_probe(struct usbhs_priv *priv) - ret = -ENOMEM; - goto usbhs_mod_gadget_probe_err_gpriv; - } -+ spin_lock_init(&uep->lock); - - gpriv->transceiver = usb_get_phy(USB_PHY_TYPE_UNDEFINED); - dev_info(dev, "%stransceiver found\n", -diff --git a/drivers/usb/storage/isd200.c b/drivers/usb/storage/isd200.c -index 39afd7045c43..7bb5f8da5357 100644 ---- a/drivers/usb/storage/isd200.c -+++ b/drivers/usb/storage/isd200.c -@@ -1520,8 +1520,11 @@ static void isd200_ata_command(struct scsi_cmnd *srb, struct us_data *us) - - /* Make sure driver was initialized */ - -- if (us->extra == NULL) -+ if (us->extra == NULL) { - usb_stor_dbg(us, "ERROR Driver not initialized\n"); -+ srb->result = DID_ERROR << 16; -+ return; -+ } - - scsi_set_resid(srb, 0); - /* scsi_bufflen might change in protocol translation to ata */ -diff --git a/drivers/vfio/vfio.c b/drivers/vfio/vfio.c -index 6070b793cbcb..1e01e28f40f3 100644 ---- a/drivers/vfio/vfio.c -+++ b/drivers/vfio/vfio.c -@@ -296,6 +296,34 @@ static void vfio_group_put(struct vfio_group *group) - kref_put_mutex(&group->kref, vfio_group_release, &vfio.group_lock); - } - -+struct vfio_group_put_work { -+ struct work_struct work; -+ struct vfio_group *group; -+}; -+ -+static void vfio_group_put_bg(struct work_struct *work) -+{ -+ struct vfio_group_put_work *do_work; -+ -+ do_work = container_of(work, struct vfio_group_put_work, work); -+ -+ vfio_group_put(do_work->group); -+ kfree(do_work); -+} -+ -+static void vfio_group_schedule_put(struct vfio_group *group) -+{ -+ struct vfio_group_put_work *do_work; -+ -+ do_work = kmalloc(sizeof(*do_work), GFP_KERNEL); -+ if (WARN_ON(!do_work)) -+ return; -+ -+ INIT_WORK(&do_work->work, vfio_group_put_bg); -+ do_work->group = group; -+ schedule_work(&do_work->work); -+} -+ - /* Assume group_lock or group reference is held */ - static void vfio_group_get(struct vfio_group *group) - { -@@ -620,7 +648,14 @@ static int vfio_iommu_group_notifier(struct notifier_block *nb, - break; - } - -- vfio_group_put(group); -+ /* -+ * If we're the last reference to the group, the group will be -+ * released, which includes unregistering the iommu group notifier. -+ * We hold a read-lock on that notifier list, unregistering needs -+ * a write-lock... deadlock. Release our reference asynchronously -+ * to avoid that situation. -+ */ -+ vfio_group_schedule_put(group); - return NOTIFY_OK; - } - -@@ -1552,6 +1587,15 @@ void vfio_group_put_external_user(struct vfio_group *group) - } - EXPORT_SYMBOL_GPL(vfio_group_put_external_user); - -+bool vfio_external_group_match_file(struct vfio_group *test_group, -+ struct file *filep) -+{ -+ struct vfio_group *group = filep->private_data; -+ -+ return (filep->f_op == &vfio_group_fops) && (group == test_group); -+} -+EXPORT_SYMBOL_GPL(vfio_external_group_match_file); -+ - int vfio_external_user_iommu_id(struct vfio_group *group) - { - return iommu_group_id(group->iommu_group); -diff --git a/fs/ceph/dir.c b/fs/ceph/dir.c -index 9314b4ea2375..be7d187d53fd 100644 ---- a/fs/ceph/dir.c -+++ b/fs/ceph/dir.c -@@ -247,6 +247,11 @@ static int __dcache_readdir(struct file *file, struct dir_context *ctx, - if (ret < 0) - err = ret; - dput(last); -+ /* last_name no longer match cache index */ -+ if (fi->readdir_cache_idx >= 0) { -+ fi->readdir_cache_idx = -1; -+ fi->dir_release_count = 0; -+ } - } - return err; - } -diff --git a/fs/f2fs/acl.c b/fs/f2fs/acl.c -index e9a8d676c6bc..83dcf7bfd7b8 100644 ---- a/fs/f2fs/acl.c -+++ b/fs/f2fs/acl.c -@@ -213,7 +213,7 @@ static int __f2fs_set_acl(struct inode *inode, int type, - switch (type) { - case ACL_TYPE_ACCESS: - name_index = F2FS_XATTR_INDEX_POSIX_ACL_ACCESS; -- if (acl) { -+ if (acl && !ipage) { - error = posix_acl_update_mode(inode, &inode->i_mode, &acl); - if (error) - return error; -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 5b21b1ca2341..348e0a05bd18 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1135,11 +1135,13 @@ static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags) - /* Force a full look up iff the parent directory has changed */ - if (!nfs_is_exclusive_create(dir, flags) && - nfs_check_verifier(dir, dentry, flags & LOOKUP_RCU)) { -- -- if (nfs_lookup_verify_inode(inode, flags)) { -+ error = nfs_lookup_verify_inode(inode, flags); -+ if (error) { - if (flags & LOOKUP_RCU) - return -ECHILD; -- goto out_zap_parent; -+ if (error == -ESTALE) -+ goto out_zap_parent; -+ goto out_error; - } - goto out_valid; - } -@@ -1163,8 +1165,10 @@ static int nfs_lookup_revalidate(struct dentry *dentry, unsigned int flags) - trace_nfs_lookup_revalidate_enter(dir, dentry, flags); - error = NFS_PROTO(dir)->lookup(dir, &dentry->d_name, fhandle, fattr, label); - trace_nfs_lookup_revalidate_exit(dir, dentry, flags, error); -- if (error) -+ if (error == -ESTALE || error == -ENOENT) - goto out_bad; -+ if (error) -+ goto out_error; - if (nfs_compare_fh(NFS_FH(inode), fhandle)) - goto out_bad; - if ((error = nfs_refresh_inode(inode, fattr)) != 0) -diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c -index f714b98cfd74..668ac19af58f 100644 ---- a/fs/nfs/inode.c -+++ b/fs/nfs/inode.c -@@ -1241,9 +1241,9 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat - return 0; - /* Has the inode gone and changed behind our back? */ - if ((fattr->valid & NFS_ATTR_FATTR_FILEID) && nfsi->fileid != fattr->fileid) -- return -EIO; -+ return -ESTALE; - if ((fattr->valid & NFS_ATTR_FATTR_TYPE) && (inode->i_mode & S_IFMT) != (fattr->mode & S_IFMT)) -- return -EIO; -+ return -ESTALE; - - if ((fattr->valid & NFS_ATTR_FATTR_CHANGE) != 0 && - inode->i_version != fattr->change_attr) -diff --git a/fs/udf/inode.c b/fs/udf/inode.c -index 7be3166ba553..0e659d9c69a1 100644 ---- a/fs/udf/inode.c -+++ b/fs/udf/inode.c -@@ -1235,8 +1235,8 @@ int udf_setsize(struct inode *inode, loff_t newsize) - return err; - } - set_size: -- truncate_setsize(inode, newsize); - up_write(&iinfo->i_data_sem); -+ truncate_setsize(inode, newsize); - } else { - if (iinfo->i_alloc_type == ICBTAG_FLAG_AD_IN_ICB) { - down_write(&iinfo->i_data_sem); -@@ -1253,9 +1253,9 @@ set_size: - udf_get_block); - if (err) - return err; -+ truncate_setsize(inode, newsize); - down_write(&iinfo->i_data_sem); - udf_clear_extent_cache(inode); -- truncate_setsize(inode, newsize); - udf_truncate_extents(inode); - up_write(&iinfo->i_data_sem); - } -diff --git a/include/linux/vfio.h b/include/linux/vfio.h -index ddb440975382..34851bf2e2c8 100644 ---- a/include/linux/vfio.h -+++ b/include/linux/vfio.h -@@ -85,6 +85,8 @@ extern void vfio_unregister_iommu_driver( - */ - extern struct vfio_group *vfio_group_get_external_user(struct file *filep); - extern void vfio_group_put_external_user(struct vfio_group *group); -+extern bool vfio_external_group_match_file(struct vfio_group *group, -+ struct file *filep); - extern int vfio_external_user_iommu_id(struct vfio_group *group); - extern long vfio_external_check_extension(struct vfio_group *group, - unsigned long arg); -diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h -index 373d3342002b..e0efe3fcf739 100644 ---- a/include/target/iscsi/iscsi_target_core.h -+++ b/include/target/iscsi/iscsi_target_core.h -@@ -64,6 +64,14 @@ - #define TA_DEFAULT_FABRIC_PROT_TYPE 0 - /* TPG status needs to be enabled to return sendtargets discovery endpoint info */ - #define TA_DEFAULT_TPG_ENABLED_SENDTARGETS 1 -+/* -+ * Used to control the sending of keys with optional to respond state bit, -+ * as a workaround for non RFC compliant initiators,that do not propose, -+ * nor respond to specific keys required for login to complete. -+ * -+ * See iscsi_check_proposer_for_optional_reply() for more details. -+ */ -+#define TA_DEFAULT_LOGIN_KEYS_WORKAROUND 1 - - #define ISCSI_IOV_DATA_BUFFER 5 - -@@ -765,6 +773,7 @@ struct iscsi_tpg_attrib { - u8 t10_pi; - u32 fabric_prot_type; - u32 tpg_enabled_sendtargets; -+ u32 login_keys_workaround; - struct iscsi_portal_group *tpg; - }; - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 22350b15b4e7..784ab8fe8714 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6410,21 +6410,6 @@ static void perf_log_itrace_start(struct perf_event *event) - perf_output_end(&handle); - } - --static bool sample_is_allowed(struct perf_event *event, struct pt_regs *regs) --{ -- /* -- * Due to interrupt latency (AKA "skid"), we may enter the -- * kernel before taking an overflow, even if the PMU is only -- * counting user events. -- * To avoid leaking information to userspace, we must always -- * reject kernel samples when exclude_kernel is set. -- */ -- if (event->attr.exclude_kernel && !user_mode(regs)) -- return false; -- -- return true; --} -- - /* - * Generic event overflow handling, sampling. - */ -@@ -6472,12 +6457,6 @@ static int __perf_event_overflow(struct perf_event *event, - } - - /* -- * For security, drop the skid kernel samples if necessary. -- */ -- if (!sample_is_allowed(event, regs)) -- return ret; -- -- /* - * XXX event_limit might not quite work as expected on inherited - * events - */ -diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c -index 2c3a23d77704..6fcc367ad531 100644 ---- a/kernel/time/alarmtimer.c -+++ b/kernel/time/alarmtimer.c -@@ -616,7 +616,8 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, - * Rate limit to the tick as a hot fix to prevent DOS. Will be - * mopped up later. - */ -- if (ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC) -+ if (timr->it.alarm.interval.tv64 && -+ ktime_to_ns(timr->it.alarm.interval) < TICK_NSEC) - timr->it.alarm.interval = ktime_set(0, TICK_NSEC); - - exp = timespec_to_ktime(new_setting->it_value); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 34b2a0d5cf1a..eba904bae48c 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -3535,7 +3535,7 @@ match_records(struct ftrace_hash *hash, char *func, int len, char *mod) - int exclude_mod = 0; - int found = 0; - int ret; -- int clear_filter; -+ int clear_filter = 0; - - if (func) { - func_g.type = filter_parse_regex(func, len, &func_g.search, -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index c83d59913d78..d59ebd9d21df 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -6737,6 +6737,7 @@ static int instance_rmdir(const char *name) - } - kfree(tr->topts); - -+ free_cpumask_var(tr->tracing_cpumask); - kfree(tr->name); - kfree(tr); - -diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c -index 4b175df35184..906f88550cd8 100644 ---- a/net/bluetooth/smp.c -+++ b/net/bluetooth/smp.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -524,7 +525,7 @@ bool smp_irk_matches(struct hci_dev *hdev, const u8 irk[16], - if (err) - return false; - -- return !memcmp(bdaddr->b, hash, 3); -+ return !crypto_memneq(bdaddr->b, hash, 3); - } - - int smp_generate_rpa(struct hci_dev *hdev, const u8 irk[16], bdaddr_t *rpa) -@@ -577,7 +578,7 @@ int smp_generate_oob(struct hci_dev *hdev, u8 hash[16], u8 rand[16]) - /* This is unlikely, but we need to check that - * we didn't accidentially generate a debug key. - */ -- if (memcmp(smp->local_sk, debug_sk, 32)) -+ if (crypto_memneq(smp->local_sk, debug_sk, 32)) - break; - } - smp->debug_key = false; -@@ -991,7 +992,7 @@ static u8 smp_random(struct smp_chan *smp) - if (ret) - return SMP_UNSPECIFIED; - -- if (memcmp(smp->pcnf, confirm, sizeof(smp->pcnf)) != 0) { -+ if (crypto_memneq(smp->pcnf, confirm, sizeof(smp->pcnf))) { - BT_ERR("Pairing failed (confirmation values mismatch)"); - return SMP_CONFIRM_FAILED; - } -@@ -1491,7 +1492,7 @@ static u8 sc_passkey_round(struct smp_chan *smp, u8 smp_op) - smp->rrnd, r, cfm)) - return SMP_UNSPECIFIED; - -- if (memcmp(smp->pcnf, cfm, 16)) -+ if (crypto_memneq(smp->pcnf, cfm, 16)) - return SMP_CONFIRM_FAILED; - - smp->passkey_round++; -@@ -1875,7 +1876,7 @@ static u8 sc_send_public_key(struct smp_chan *smp) - /* This is unlikely, but we need to check that - * we didn't accidentially generate a debug key. - */ -- if (memcmp(smp->local_sk, debug_sk, 32)) -+ if (crypto_memneq(smp->local_sk, debug_sk, 32)) - break; - } - } -@@ -2140,7 +2141,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb) - if (err) - return SMP_UNSPECIFIED; - -- if (memcmp(smp->pcnf, cfm, 16)) -+ if (crypto_memneq(smp->pcnf, cfm, 16)) - return SMP_CONFIRM_FAILED; - } else { - smp_send_cmd(conn, SMP_CMD_PAIRING_RANDOM, sizeof(smp->prnd), -@@ -2621,7 +2622,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) - if (err) - return SMP_UNSPECIFIED; - -- if (memcmp(cfm.confirm_val, smp->pcnf, 16)) -+ if (crypto_memneq(cfm.confirm_val, smp->pcnf, 16)) - return SMP_CONFIRM_FAILED; - } - -@@ -2654,7 +2655,7 @@ static int smp_cmd_public_key(struct l2cap_conn *conn, struct sk_buff *skb) - else - hcon->pending_sec_level = BT_SECURITY_FIPS; - -- if (!memcmp(debug_pk, smp->remote_pk, 64)) -+ if (!crypto_memneq(debug_pk, smp->remote_pk, 64)) - set_bit(SMP_FLAG_DEBUG_KEY, &smp->flags); - - if (smp->method == DSP_PASSKEY) { -@@ -2753,7 +2754,7 @@ static int smp_cmd_dhkey_check(struct l2cap_conn *conn, struct sk_buff *skb) - if (err) - return SMP_UNSPECIFIED; - -- if (memcmp(check->e, e, 16)) -+ if (crypto_memneq(check->e, e, 16)) - return SMP_DHKEY_CHECK_FAILED; - - if (!hcon->out) { -@@ -3463,7 +3464,7 @@ static int __init test_ah(struct crypto_blkcipher *tfm_aes) - if (err) - return err; - -- if (memcmp(res, exp, 3)) -+ if (crypto_memneq(res, exp, 3)) - return -EINVAL; - - return 0; -@@ -3493,7 +3494,7 @@ static int __init test_c1(struct crypto_blkcipher *tfm_aes) - if (err) - return err; - -- if (memcmp(res, exp, 16)) -+ if (crypto_memneq(res, exp, 16)) - return -EINVAL; - - return 0; -@@ -3518,7 +3519,7 @@ static int __init test_s1(struct crypto_blkcipher *tfm_aes) - if (err) - return err; - -- if (memcmp(res, exp, 16)) -+ if (crypto_memneq(res, exp, 16)) - return -EINVAL; - - return 0; -@@ -3550,7 +3551,7 @@ static int __init test_f4(struct crypto_hash *tfm_cmac) - if (err) - return err; - -- if (memcmp(res, exp, 16)) -+ if (crypto_memneq(res, exp, 16)) - return -EINVAL; - - return 0; -@@ -3584,10 +3585,10 @@ static int __init test_f5(struct crypto_hash *tfm_cmac) - if (err) - return err; - -- if (memcmp(mackey, exp_mackey, 16)) -+ if (crypto_memneq(mackey, exp_mackey, 16)) - return -EINVAL; - -- if (memcmp(ltk, exp_ltk, 16)) -+ if (crypto_memneq(ltk, exp_ltk, 16)) - return -EINVAL; - - return 0; -@@ -3620,7 +3621,7 @@ static int __init test_f6(struct crypto_hash *tfm_cmac) - if (err) - return err; - -- if (memcmp(res, exp, 16)) -+ if (crypto_memneq(res, exp, 16)) - return -EINVAL; - - return 0; -@@ -3674,7 +3675,7 @@ static int __init test_h6(struct crypto_hash *tfm_cmac) - if (err) - return err; - -- if (memcmp(res, exp, 16)) -+ if (crypto_memneq(res, exp, 16)) - return -EINVAL; - - return 0; -diff --git a/net/key/af_key.c b/net/key/af_key.c -index e67c28e614b9..d8d95b6415e4 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -65,6 +65,10 @@ struct pfkey_sock { - } dump; - }; - -+static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len, -+ xfrm_address_t *saddr, xfrm_address_t *daddr, -+ u16 *family); -+ - static inline struct pfkey_sock *pfkey_sk(struct sock *sk) - { - return (struct pfkey_sock *)sk; -@@ -1922,19 +1926,14 @@ parse_ipsecrequest(struct xfrm_policy *xp, struct sadb_x_ipsecrequest *rq) - - /* addresses present only in tunnel mode */ - if (t->mode == XFRM_MODE_TUNNEL) { -- u8 *sa = (u8 *) (rq + 1); -- int family, socklen; -+ int err; - -- family = pfkey_sockaddr_extract((struct sockaddr *)sa, -- &t->saddr); -- if (!family) -- return -EINVAL; -- -- socklen = pfkey_sockaddr_len(family); -- if (pfkey_sockaddr_extract((struct sockaddr *)(sa + socklen), -- &t->id.daddr) != family) -- return -EINVAL; -- t->encap_family = family; -+ err = parse_sockaddr_pair( -+ (struct sockaddr *)(rq + 1), -+ rq->sadb_x_ipsecrequest_len - sizeof(*rq), -+ &t->saddr, &t->id.daddr, &t->encap_family); -+ if (err) -+ return err; - } else - t->encap_family = xp->family; - -@@ -1954,7 +1953,11 @@ parse_ipsecrequests(struct xfrm_policy *xp, struct sadb_x_policy *pol) - if (pol->sadb_x_policy_len * 8 < sizeof(struct sadb_x_policy)) - return -EINVAL; - -- while (len >= sizeof(struct sadb_x_ipsecrequest)) { -+ while (len >= sizeof(*rq)) { -+ if (len < rq->sadb_x_ipsecrequest_len || -+ rq->sadb_x_ipsecrequest_len < sizeof(*rq)) -+ return -EINVAL; -+ - if ((err = parse_ipsecrequest(xp, rq)) < 0) - return err; - len -= rq->sadb_x_ipsecrequest_len; -@@ -2417,7 +2420,6 @@ out: - return err; - } - --#ifdef CONFIG_NET_KEY_MIGRATE - static int pfkey_sockaddr_pair_size(sa_family_t family) - { - return PFKEY_ALIGN8(pfkey_sockaddr_len(family) * 2); -@@ -2429,7 +2431,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len, - { - int af, socklen; - -- if (ext_len < pfkey_sockaddr_pair_size(sa->sa_family)) -+ if (ext_len < 2 || ext_len < pfkey_sockaddr_pair_size(sa->sa_family)) - return -EINVAL; - - af = pfkey_sockaddr_extract(sa, saddr); -@@ -2445,6 +2447,7 @@ static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len, - return 0; - } - -+#ifdef CONFIG_NET_KEY_MIGRATE - static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, - struct xfrm_migrate *m) - { -@@ -2452,13 +2455,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, - struct sadb_x_ipsecrequest *rq2; - int mode; - -- if (len <= sizeof(struct sadb_x_ipsecrequest) || -- len < rq1->sadb_x_ipsecrequest_len) -+ if (len < sizeof(*rq1) || -+ len < rq1->sadb_x_ipsecrequest_len || -+ rq1->sadb_x_ipsecrequest_len < sizeof(*rq1)) - return -EINVAL; - - /* old endoints */ - err = parse_sockaddr_pair((struct sockaddr *)(rq1 + 1), -- rq1->sadb_x_ipsecrequest_len, -+ rq1->sadb_x_ipsecrequest_len - sizeof(*rq1), - &m->old_saddr, &m->old_daddr, - &m->old_family); - if (err) -@@ -2467,13 +2471,14 @@ static int ipsecrequests_to_migrate(struct sadb_x_ipsecrequest *rq1, int len, - rq2 = (struct sadb_x_ipsecrequest *)((u8 *)rq1 + rq1->sadb_x_ipsecrequest_len); - len -= rq1->sadb_x_ipsecrequest_len; - -- if (len <= sizeof(struct sadb_x_ipsecrequest) || -- len < rq2->sadb_x_ipsecrequest_len) -+ if (len <= sizeof(*rq2) || -+ len < rq2->sadb_x_ipsecrequest_len || -+ rq2->sadb_x_ipsecrequest_len < sizeof(*rq2)) - return -EINVAL; - - /* new endpoints */ - err = parse_sockaddr_pair((struct sockaddr *)(rq2 + 1), -- rq2->sadb_x_ipsecrequest_len, -+ rq2->sadb_x_ipsecrequest_len - sizeof(*rq2), - &m->new_saddr, &m->new_daddr, - &m->new_family); - if (err) -diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c -index 4da560005b0e..dd1649caa2b2 100644 ---- a/net/netfilter/ipvs/ip_vs_core.c -+++ b/net/netfilter/ipvs/ip_vs_core.c -@@ -845,10 +845,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb, - { - unsigned int verdict = NF_DROP; - -- if (IP_VS_FWD_METHOD(cp) != 0) { -- pr_err("shouldn't reach here, because the box is on the " -- "half connection in the tun/dr module.\n"); -- } -+ if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) -+ goto ignore_cp; - - /* Ensure the checksum is correct */ - if (!skb_csum_unnecessary(skb) && ip_vs_checksum_complete(skb, ihl)) { -@@ -882,6 +880,8 @@ static int handle_response_icmp(int af, struct sk_buff *skb, - ip_vs_notrack(skb); - else - ip_vs_update_conntrack(skb, cp, 0); -+ -+ignore_cp: - verdict = NF_ACCEPT; - - out: -@@ -1242,8 +1242,11 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in - */ - cp = pp->conn_out_get(ipvs, af, skb, &iph); - -- if (likely(cp)) -+ if (likely(cp)) { -+ if (IP_VS_FWD_METHOD(cp) != IP_VS_CONN_F_MASQ) -+ goto ignore_cp; - return handle_response(af, skb, pd, cp, &iph, hooknum); -+ } - if (sysctl_nat_icmp_send(ipvs) && - (pp->protocol == IPPROTO_TCP || - pp->protocol == IPPROTO_UDP || -@@ -1285,9 +1288,15 @@ ip_vs_out(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, in - } - } - } -+ -+out: - IP_VS_DBG_PKT(12, af, pp, skb, iph.off, - "ip_vs_out: packet continues traversal as normal"); - return NF_ACCEPT; -+ -+ignore_cp: -+ __ip_vs_conn_put(cp); -+ goto out; - } - - /* -diff --git a/net/nfc/core.c b/net/nfc/core.c -index 1fe3d3b362c0..c5a2c7e733b3 100644 ---- a/net/nfc/core.c -+++ b/net/nfc/core.c -@@ -969,6 +969,8 @@ static void nfc_release(struct device *d) - kfree(se); - } - -+ ida_simple_remove(&nfc_index_ida, dev->idx); -+ - kfree(dev); - } - -@@ -1043,6 +1045,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, - int tx_headroom, int tx_tailroom) - { - struct nfc_dev *dev; -+ int rc; - - if (!ops->start_poll || !ops->stop_poll || !ops->activate_target || - !ops->deactivate_target || !ops->im_transceive) -@@ -1055,6 +1058,15 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, - if (!dev) - return NULL; - -+ rc = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL); -+ if (rc < 0) -+ goto err_free_dev; -+ dev->idx = rc; -+ -+ dev->dev.class = &nfc_class; -+ dev_set_name(&dev->dev, "nfc%d", dev->idx); -+ device_initialize(&dev->dev); -+ - dev->ops = ops; - dev->supported_protocols = supported_protocols; - dev->tx_headroom = tx_headroom; -@@ -1077,6 +1089,11 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, - } - - return dev; -+ -+err_free_dev: -+ kfree(dev); -+ -+ return ERR_PTR(rc); - } - EXPORT_SYMBOL(nfc_allocate_device); - -@@ -1091,14 +1108,6 @@ int nfc_register_device(struct nfc_dev *dev) - - pr_debug("dev_name=%s\n", dev_name(&dev->dev)); - -- dev->idx = ida_simple_get(&nfc_index_ida, 0, 0, GFP_KERNEL); -- if (dev->idx < 0) -- return dev->idx; -- -- dev->dev.class = &nfc_class; -- dev_set_name(&dev->dev, "nfc%d", dev->idx); -- device_initialize(&dev->dev); -- - mutex_lock(&nfc_devlist_mutex); - nfc_devlist_generation++; - rc = device_add(&dev->dev); -@@ -1136,12 +1145,10 @@ EXPORT_SYMBOL(nfc_register_device); - */ - void nfc_unregister_device(struct nfc_dev *dev) - { -- int rc, id; -+ int rc; - - pr_debug("dev_name=%s\n", dev_name(&dev->dev)); - -- id = dev->idx; -- - if (dev->rfkill) { - rfkill_unregister(dev->rfkill); - rfkill_destroy(dev->rfkill); -@@ -1166,8 +1173,6 @@ void nfc_unregister_device(struct nfc_dev *dev) - nfc_devlist_generation++; - device_del(&dev->dev); - mutex_unlock(&nfc_devlist_mutex); -- -- ida_simple_remove(&nfc_index_ida, id); - } - EXPORT_SYMBOL(nfc_unregister_device); - -diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c -index ecf0a0196f18..9c222a106c7f 100644 ---- a/net/nfc/llcp_sock.c -+++ b/net/nfc/llcp_sock.c -@@ -76,7 +76,8 @@ static int llcp_sock_bind(struct socket *sock, struct sockaddr *addr, int alen) - struct sockaddr_nfc_llcp llcp_addr; - int len, ret = 0; - -- if (!addr || addr->sa_family != AF_NFC) -+ if (!addr || alen < offsetofend(struct sockaddr, sa_family) || -+ addr->sa_family != AF_NFC) - return -EINVAL; - - pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family); -@@ -150,7 +151,8 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr *addr, - struct sockaddr_nfc_llcp llcp_addr; - int len, ret = 0; - -- if (!addr || addr->sa_family != AF_NFC) -+ if (!addr || alen < offsetofend(struct sockaddr, sa_family) || -+ addr->sa_family != AF_NFC) - return -EINVAL; - - pr_debug("sk %p addr %p family %d\n", sk, addr, addr->sa_family); -@@ -655,8 +657,7 @@ static int llcp_sock_connect(struct socket *sock, struct sockaddr *_addr, - - pr_debug("sock %p sk %p flags 0x%x\n", sock, sk, flags); - -- if (!addr || len < sizeof(struct sockaddr_nfc) || -- addr->sa_family != AF_NFC) -+ if (!addr || len < sizeof(*addr) || addr->sa_family != AF_NFC) - return -EINVAL; - - if (addr->service_name_len == 0 && addr->dsap == 0) -diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c -index 10c99a578421..67583ad7f610 100644 ---- a/net/nfc/nci/core.c -+++ b/net/nfc/nci/core.c -@@ -1084,8 +1084,7 @@ struct nci_dev *nci_allocate_device(struct nci_ops *ops, - return ndev; - - free_nfc: -- kfree(ndev->nfc_dev); -- -+ nfc_free_device(ndev->nfc_dev); - free_nci: - kfree(ndev); - return NULL; -diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c -index f58c1fba1026..12dfb457275d 100644 ---- a/net/nfc/netlink.c -+++ b/net/nfc/netlink.c -@@ -873,7 +873,9 @@ static int nfc_genl_activate_target(struct sk_buff *skb, struct genl_info *info) - u32 device_idx, target_idx, protocol; - int rc; - -- if (!info->attrs[NFC_ATTR_DEVICE_INDEX]) -+ if (!info->attrs[NFC_ATTR_DEVICE_INDEX] || -+ !info->attrs[NFC_ATTR_TARGET_INDEX] || -+ !info->attrs[NFC_ATTR_PROTOCOLS]) - return -EINVAL; - - device_idx = nla_get_u32(info->attrs[NFC_ATTR_DEVICE_INDEX]); -diff --git a/sound/soc/soc-compress.c b/sound/soc/soc-compress.c -index bb82bb966000..c1addf49c4f2 100644 ---- a/sound/soc/soc-compress.c -+++ b/sound/soc/soc-compress.c -@@ -68,7 +68,8 @@ out: - static int soc_compr_open_fe(struct snd_compr_stream *cstream) - { - struct snd_soc_pcm_runtime *fe = cstream->private_data; -- struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream; -+ struct snd_pcm_substream *fe_substream = -+ fe->pcm->streams[cstream->direction].substream; - struct snd_soc_platform *platform = fe->platform; - struct snd_soc_dpcm *dpcm; - struct snd_soc_dapm_widget_list *list; -@@ -412,7 +413,8 @@ static int soc_compr_set_params_fe(struct snd_compr_stream *cstream, - struct snd_compr_params *params) - { - struct snd_soc_pcm_runtime *fe = cstream->private_data; -- struct snd_pcm_substream *fe_substream = fe->pcm->streams[0].substream; -+ struct snd_pcm_substream *fe_substream = -+ fe->pcm->streams[cstream->direction].substream; - struct snd_soc_platform *platform = fe->platform; - int ret = 0, stream; - -diff --git a/tools/perf/ui/browser.c b/tools/perf/ui/browser.c -index e9703c0829f1..07b5f5951b25 100644 ---- a/tools/perf/ui/browser.c -+++ b/tools/perf/ui/browser.c -@@ -702,7 +702,7 @@ static void __ui_browser__line_arrow_down(struct ui_browser *browser, - ui_browser__gotorc(browser, row, column + 1); - SLsmg_draw_hline(2); - -- if (row++ == 0) -+ if (++row == 0) - goto out; - } else - row = 0; -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index 933a509a90f8..67282a759496 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -64,6 +64,25 @@ enum intel_pt_pkt_state { - INTEL_PT_STATE_FUP_NO_TIP, - }; - -+static inline bool intel_pt_sample_time(enum intel_pt_pkt_state pkt_state) -+{ -+ switch (pkt_state) { -+ case INTEL_PT_STATE_NO_PSB: -+ case INTEL_PT_STATE_NO_IP: -+ case INTEL_PT_STATE_ERR_RESYNC: -+ case INTEL_PT_STATE_IN_SYNC: -+ case INTEL_PT_STATE_TNT: -+ return true; -+ case INTEL_PT_STATE_TIP: -+ case INTEL_PT_STATE_TIP_PGD: -+ case INTEL_PT_STATE_FUP: -+ case INTEL_PT_STATE_FUP_NO_TIP: -+ return false; -+ default: -+ return true; -+ }; -+} -+ - #ifdef INTEL_PT_STRICT - #define INTEL_PT_STATE_ERR1 INTEL_PT_STATE_NO_PSB - #define INTEL_PT_STATE_ERR2 INTEL_PT_STATE_NO_PSB -@@ -98,6 +117,7 @@ struct intel_pt_decoder { - uint64_t timestamp; - uint64_t tsc_timestamp; - uint64_t ref_timestamp; -+ uint64_t sample_timestamp; - uint64_t ret_addr; - uint64_t ctc_timestamp; - uint64_t ctc_delta; -@@ -140,6 +160,7 @@ struct intel_pt_decoder { - unsigned int fup_tx_flags; - unsigned int tx_flags; - uint64_t timestamp_insn_cnt; -+ uint64_t sample_insn_cnt; - uint64_t stuck_ip; - int no_progress; - int stuck_ip_prd; -@@ -896,6 +917,7 @@ static int intel_pt_walk_insn(struct intel_pt_decoder *decoder, - - decoder->tot_insn_cnt += insn_cnt; - decoder->timestamp_insn_cnt += insn_cnt; -+ decoder->sample_insn_cnt += insn_cnt; - decoder->period_insn_cnt += insn_cnt; - - if (err) { -@@ -1876,6 +1898,7 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder) - break; - - case INTEL_PT_PSB: -+ intel_pt_clear_stack(&decoder->stack); - err = intel_pt_walk_psb(decoder); - if (err) - return err; -@@ -1901,6 +1924,8 @@ static int intel_pt_sync_ip(struct intel_pt_decoder *decoder) - { - int err; - -+ decoder->set_fup_tx_flags = false; -+ - intel_pt_log("Scanning for full IP\n"); - err = intel_pt_walk_to_ip(decoder); - if (err) -@@ -2035,7 +2060,7 @@ static int intel_pt_sync(struct intel_pt_decoder *decoder) - - static uint64_t intel_pt_est_timestamp(struct intel_pt_decoder *decoder) - { -- uint64_t est = decoder->timestamp_insn_cnt << 1; -+ uint64_t est = decoder->sample_insn_cnt << 1; - - if (!decoder->cbr || !decoder->max_non_turbo_ratio) - goto out; -@@ -2043,7 +2068,7 @@ static uint64_t intel_pt_est_timestamp(struct intel_pt_decoder *decoder) - est *= decoder->max_non_turbo_ratio; - est /= decoder->cbr; - out: -- return decoder->timestamp + est; -+ return decoder->sample_timestamp + est; - } - - const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) -@@ -2060,6 +2085,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) - break; - case INTEL_PT_STATE_NO_IP: - decoder->last_ip = 0; -+ decoder->ip = 0; - /* Fall through */ - case INTEL_PT_STATE_ERR_RESYNC: - err = intel_pt_sync_ip(decoder); -@@ -2096,15 +2122,24 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) - } - } while (err == -ENOLINK); - -- decoder->state.err = err ? intel_pt_ext_err(err) : 0; -- decoder->state.timestamp = decoder->timestamp; -+ if (err) { -+ decoder->state.err = intel_pt_ext_err(err); -+ decoder->state.from_ip = decoder->ip; -+ decoder->sample_timestamp = decoder->timestamp; -+ decoder->sample_insn_cnt = decoder->timestamp_insn_cnt; -+ } else { -+ decoder->state.err = 0; -+ if (intel_pt_sample_time(decoder->pkt_state)) { -+ decoder->sample_timestamp = decoder->timestamp; -+ decoder->sample_insn_cnt = decoder->timestamp_insn_cnt; -+ } -+ } -+ -+ decoder->state.timestamp = decoder->sample_timestamp; - decoder->state.est_timestamp = intel_pt_est_timestamp(decoder); - decoder->state.cr3 = decoder->cr3; - decoder->state.tot_insn_cnt = decoder->tot_insn_cnt; - -- if (err) -- decoder->state.from_ip = decoder->ip; -- - return &decoder->state; - } - -diff --git a/virt/kvm/vfio.c b/virt/kvm/vfio.c -index 1dd087da6f31..111e09c3f4bf 100644 ---- a/virt/kvm/vfio.c -+++ b/virt/kvm/vfio.c -@@ -47,6 +47,22 @@ static struct vfio_group *kvm_vfio_group_get_external_user(struct file *filep) - return vfio_group; - } - -+static bool kvm_vfio_external_group_match_file(struct vfio_group *group, -+ struct file *filep) -+{ -+ bool ret, (*fn)(struct vfio_group *, struct file *); -+ -+ fn = symbol_get(vfio_external_group_match_file); -+ if (!fn) -+ return false; -+ -+ ret = fn(group, filep); -+ -+ symbol_put(vfio_external_group_match_file); -+ -+ return ret; -+} -+ - static void kvm_vfio_group_put_external_user(struct vfio_group *vfio_group) - { - void (*fn)(struct vfio_group *); -@@ -171,18 +187,13 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg) - if (!f.file) - return -EBADF; - -- vfio_group = kvm_vfio_group_get_external_user(f.file); -- fdput(f); -- -- if (IS_ERR(vfio_group)) -- return PTR_ERR(vfio_group); -- - ret = -ENOENT; - - mutex_lock(&kv->lock); - - list_for_each_entry(kvg, &kv->group_list, node) { -- if (kvg->vfio_group != vfio_group) -+ if (!kvm_vfio_external_group_match_file(kvg->vfio_group, -+ f.file)) - continue; - - list_del(&kvg->node); -@@ -196,7 +207,7 @@ static int kvm_vfio_set_group(struct kvm_device *dev, long attr, u64 arg) - - mutex_unlock(&kv->lock); - -- kvm_vfio_group_put_external_user(vfio_group); -+ fdput(f); - - kvm_vfio_update_coherency(dev); - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.79-80.patch b/patch/kernel/mvebu64-default/03-patch-4.4.79-80.patch deleted file mode 100644 index c267214fb8b8..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.79-80.patch +++ /dev/null @@ -1,3274 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1440a94b2474..dddd55adde24 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 79 -+SUBLEVEL = 80 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/omap3-n900.dts b/arch/arm/boot/dts/omap3-n900.dts -index 5f5e0f3d5b64..27cd4abfc74d 100644 ---- a/arch/arm/boot/dts/omap3-n900.dts -+++ b/arch/arm/boot/dts/omap3-n900.dts -@@ -697,6 +697,8 @@ - vmmc_aux-supply = <&vsim>; - bus-width = <8>; - non-removable; -+ no-sdio; -+ no-sd; - }; - - &mmc3 { -diff --git a/arch/arm/configs/s3c2410_defconfig b/arch/arm/configs/s3c2410_defconfig -index f3142369f594..01116ee1284b 100644 ---- a/arch/arm/configs/s3c2410_defconfig -+++ b/arch/arm/configs/s3c2410_defconfig -@@ -87,9 +87,9 @@ CONFIG_IPV6_TUNNEL=m - CONFIG_NETFILTER=y - CONFIG_NF_CONNTRACK=m - CONFIG_NF_CONNTRACK_EVENTS=y --CONFIG_NF_CT_PROTO_DCCP=m --CONFIG_NF_CT_PROTO_SCTP=m --CONFIG_NF_CT_PROTO_UDPLITE=m -+CONFIG_NF_CT_PROTO_DCCP=y -+CONFIG_NF_CT_PROTO_SCTP=y -+CONFIG_NF_CT_PROTO_UDPLITE=y - CONFIG_NF_CONNTRACK_AMANDA=m - CONFIG_NF_CONNTRACK_FTP=m - CONFIG_NF_CONNTRACK_H323=m -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts -index ce5d848251fa..7b34822d61e9 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts -+++ b/arch/arm64/boot/dts/xilinx/zynqmp-ep108.dts -@@ -26,7 +26,7 @@ - stdout-path = "serial0:115200n8"; - }; - -- memory { -+ memory@0 { - device_type = "memory"; - reg = <0x0 0x0 0x40000000>; - }; -diff --git a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -index 857eda5c7217..172402cc1a0f 100644 ---- a/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -+++ b/arch/arm64/boot/dts/xilinx/zynqmp.dtsi -@@ -71,7 +71,7 @@ - <1 10 0xf01>; - }; - -- amba_apu { -+ amba_apu: amba_apu@0 { - compatible = "simple-bus"; - #address-cells = <2>; - #size-cells = <1>; -@@ -191,7 +191,7 @@ - }; - - i2c0: i2c@ff020000 { -- compatible = "cdns,i2c-r1p10"; -+ compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 17 4>; -@@ -202,7 +202,7 @@ - }; - - i2c1: i2c@ff030000 { -- compatible = "cdns,i2c-r1p10"; -+ compatible = "cdns,i2c-r1p14", "cdns,i2c-r1p10"; - status = "disabled"; - interrupt-parent = <&gic>; - interrupts = <0 18 4>; -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 247bae758e1e..a4b466424a32 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -66,21 +66,21 @@ void show_pte(struct mm_struct *mm, unsigned long addr) - break; - - pud = pud_offset(pgd, addr); -- printk(", *pud=%016llx", pud_val(*pud)); -+ pr_cont(", *pud=%016llx", pud_val(*pud)); - if (pud_none(*pud) || pud_bad(*pud)) - break; - - pmd = pmd_offset(pud, addr); -- printk(", *pmd=%016llx", pmd_val(*pmd)); -+ pr_cont(", *pmd=%016llx", pmd_val(*pmd)); - if (pmd_none(*pmd) || pmd_bad(*pmd)) - break; - - pte = pte_offset_map(pmd, addr); -- printk(", *pte=%016llx", pte_val(*pte)); -+ pr_cont(", *pte=%016llx", pte_val(*pte)); - pte_unmap(pte); - } while(0); - -- printk("\n"); -+ pr_cont("\n"); - } - - #ifdef CONFIG_ARM64_HW_AFDBM -diff --git a/arch/openrisc/kernel/vmlinux.lds.S b/arch/openrisc/kernel/vmlinux.lds.S -index 2d69a853b742..3a08b55609b6 100644 ---- a/arch/openrisc/kernel/vmlinux.lds.S -+++ b/arch/openrisc/kernel/vmlinux.lds.S -@@ -38,6 +38,8 @@ SECTIONS - /* Read-only sections, merged into text segment: */ - . = LOAD_BASE ; - -+ _text = .; -+ - /* _s_kernel_ro must be page aligned */ - . = ALIGN(PAGE_SIZE); - _s_kernel_ro = .; -diff --git a/arch/powerpc/include/asm/topology.h b/arch/powerpc/include/asm/topology.h -index 329771559cbb..8b3b46b7b0f2 100644 ---- a/arch/powerpc/include/asm/topology.h -+++ b/arch/powerpc/include/asm/topology.h -@@ -44,22 +44,8 @@ extern void __init dump_numa_cpu_topology(void); - extern int sysfs_add_device_to_node(struct device *dev, int nid); - extern void sysfs_remove_device_from_node(struct device *dev, int nid); - --static inline int early_cpu_to_node(int cpu) --{ -- int nid; -- -- nid = numa_cpu_lookup_table[cpu]; -- -- /* -- * Fall back to node 0 if nid is unset (it should be, except bugs). -- * This allows callers to safely do NODE_DATA(early_cpu_to_node(cpu)). -- */ -- return (nid < 0) ? 0 : nid; --} - #else - --static inline int early_cpu_to_node(int cpu) { return 0; } -- - static inline void dump_numa_cpu_topology(void) {} - - static inline int sysfs_add_device_to_node(struct device *dev, int nid) -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index fe6e800c1357..a20823210ac0 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -751,7 +751,7 @@ void __init setup_arch(char **cmdline_p) - - static void * __init pcpu_fc_alloc(unsigned int cpu, size_t size, size_t align) - { -- return __alloc_bootmem_node(NODE_DATA(early_cpu_to_node(cpu)), size, align, -+ return __alloc_bootmem_node(NODE_DATA(cpu_to_node(cpu)), size, align, - __pa(MAX_DMA_ADDRESS)); - } - -@@ -762,7 +762,7 @@ static void __init pcpu_fc_free(void *ptr, size_t size) - - static int pcpu_cpu_distance(unsigned int from, unsigned int to) - { -- if (early_cpu_to_node(from) == early_cpu_to_node(to)) -+ if (cpu_to_node(from) == cpu_to_node(to)) - return LOCAL_DISTANCE; - else - return REMOTE_DISTANCE; -diff --git a/arch/powerpc/kvm/book3s_hv.c b/arch/powerpc/kvm/book3s_hv.c -index 396dc44e783b..428563b195c3 100644 ---- a/arch/powerpc/kvm/book3s_hv.c -+++ b/arch/powerpc/kvm/book3s_hv.c -@@ -2687,6 +2687,10 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) - { - int r; - int srcu_idx; -+ unsigned long ebb_regs[3] = {}; /* shut up GCC */ -+ unsigned long user_tar = 0; -+ unsigned long proc_fscr = 0; -+ unsigned int user_vrsave; - - if (!vcpu->arch.sane) { - run->exit_reason = KVM_EXIT_INTERNAL_ERROR; -@@ -2707,10 +2711,11 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) - run->fail_entry.hardware_entry_failure_reason = 0; - return -EINVAL; - } -+ /* Enable TM so we can read the TM SPRs */ -+ mtmsr(mfmsr() | MSR_TM); - current->thread.tm_tfhar = mfspr(SPRN_TFHAR); - current->thread.tm_tfiar = mfspr(SPRN_TFIAR); - current->thread.tm_texasr = mfspr(SPRN_TEXASR); -- current->thread.regs->msr &= ~MSR_TM; - } - #endif - -@@ -2736,6 +2741,17 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) - flush_fp_to_thread(current); - flush_altivec_to_thread(current); - flush_vsx_to_thread(current); -+ -+ /* Save userspace EBB and other register values */ -+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) { -+ ebb_regs[0] = mfspr(SPRN_EBBHR); -+ ebb_regs[1] = mfspr(SPRN_EBBRR); -+ ebb_regs[2] = mfspr(SPRN_BESCR); -+ user_tar = mfspr(SPRN_TAR); -+ proc_fscr = mfspr(SPRN_FSCR); -+ } -+ user_vrsave = mfspr(SPRN_VRSAVE); -+ - vcpu->arch.wqp = &vcpu->arch.vcore->wq; - vcpu->arch.pgdir = current->mm->pgd; - vcpu->arch.state = KVMPPC_VCPU_BUSY_IN_HOST; -@@ -2757,6 +2773,29 @@ static int kvmppc_vcpu_run_hv(struct kvm_run *run, struct kvm_vcpu *vcpu) - } - } while (is_kvmppc_resume_guest(r)); - -+ /* Restore userspace EBB and other register values */ -+ if (cpu_has_feature(CPU_FTR_ARCH_207S)) { -+ mtspr(SPRN_EBBHR, ebb_regs[0]); -+ mtspr(SPRN_EBBRR, ebb_regs[1]); -+ mtspr(SPRN_BESCR, ebb_regs[2]); -+ mtspr(SPRN_TAR, user_tar); -+ mtspr(SPRN_FSCR, proc_fscr); -+ } -+ mtspr(SPRN_VRSAVE, user_vrsave); -+ -+ /* -+ * Since we don't do lazy TM reload, we need to reload -+ * the TM registers here. -+ */ -+#ifdef CONFIG_PPC_TRANSACTIONAL_MEM -+ if (cpu_has_feature(CPU_FTR_TM) && current->thread.regs && -+ (current->thread.regs->msr & MSR_TM)) { -+ mtspr(SPRN_TFHAR, current->thread.tm_tfhar); -+ mtspr(SPRN_TFIAR, current->thread.tm_tfiar); -+ mtspr(SPRN_TEXASR, current->thread.tm_texasr); -+ } -+#endif -+ - out: - vcpu->arch.state = KVMPPC_VCPU_NOTREADY; - atomic_dec(&vcpu->kvm->arch.vcpus_running); -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index 1a743f87b37d..ffab9269bfe4 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -36,6 +36,13 @@ - #define NAPPING_CEDE 1 - #define NAPPING_NOVCPU 2 - -+/* Stack frame offsets for kvmppc_hv_entry */ -+#define SFS 112 -+#define STACK_SLOT_TRAP (SFS-4) -+#define STACK_SLOT_CIABR (SFS-16) -+#define STACK_SLOT_DAWR (SFS-24) -+#define STACK_SLOT_DAWRX (SFS-32) -+ - /* - * Call kvmppc_hv_entry in real mode. - * Must be called with interrupts hard-disabled. -@@ -274,10 +281,10 @@ kvm_novcpu_exit: - bl kvmhv_accumulate_time - #endif - 13: mr r3, r12 -- stw r12, 112-4(r1) -+ stw r12, STACK_SLOT_TRAP(r1) - bl kvmhv_commence_exit - nop -- lwz r12, 112-4(r1) -+ lwz r12, STACK_SLOT_TRAP(r1) - b kvmhv_switch_to_host - - /* -@@ -489,7 +496,7 @@ kvmppc_hv_entry: - */ - mflr r0 - std r0, PPC_LR_STKOFF(r1) -- stdu r1, -112(r1) -+ stdu r1, -SFS(r1) - - /* Save R1 in the PACA */ - std r1, HSTATE_HOST_R1(r13) -@@ -643,6 +650,16 @@ kvmppc_got_guest: - mtspr SPRN_PURR,r7 - mtspr SPRN_SPURR,r8 - -+ /* Save host values of some registers */ -+BEGIN_FTR_SECTION -+ mfspr r5, SPRN_CIABR -+ mfspr r6, SPRN_DAWR -+ mfspr r7, SPRN_DAWRX -+ std r5, STACK_SLOT_CIABR(r1) -+ std r6, STACK_SLOT_DAWR(r1) -+ std r7, STACK_SLOT_DAWRX(r1) -+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) -+ - BEGIN_FTR_SECTION - /* Set partition DABR */ - /* Do this before re-enabling PMU to avoid P7 DABR corruption bug */ -@@ -1266,8 +1283,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) - */ - li r0, 0 - mtspr SPRN_IAMR, r0 -- mtspr SPRN_CIABR, r0 -- mtspr SPRN_DAWRX, r0 -+ mtspr SPRN_PSPB, r0 - mtspr SPRN_TCSCR, r0 - mtspr SPRN_WORT, r0 - /* Set MMCRS to 1<<31 to freeze and disable the SPMC counters */ -@@ -1283,6 +1299,7 @@ END_FTR_SECTION_IFCLR(CPU_FTR_ARCH_207S) - std r6,VCPU_UAMOR(r9) - li r6,0 - mtspr SPRN_AMR,r6 -+ mtspr SPRN_UAMOR, r6 - - /* Switch DSCR back to host value */ - mfspr r8, SPRN_DSCR -@@ -1424,6 +1441,16 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) - slbia - ptesync - -+ /* Restore host values of some registers */ -+BEGIN_FTR_SECTION -+ ld r5, STACK_SLOT_CIABR(r1) -+ ld r6, STACK_SLOT_DAWR(r1) -+ ld r7, STACK_SLOT_DAWRX(r1) -+ mtspr SPRN_CIABR, r5 -+ mtspr SPRN_DAWR, r6 -+ mtspr SPRN_DAWRX, r7 -+END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) -+ - /* - * POWER7/POWER8 guest -> host partition switch code. - * We don't have to lock against tlbies but we do -@@ -1533,8 +1560,8 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) - li r0, KVM_GUEST_MODE_NONE - stb r0, HSTATE_IN_GUEST(r13) - -- ld r0, 112+PPC_LR_STKOFF(r1) -- addi r1, r1, 112 -+ ld r0, SFS+PPC_LR_STKOFF(r1) -+ addi r1, r1, SFS - mtlr r0 - blr - -diff --git a/arch/powerpc/platforms/pseries/reconfig.c b/arch/powerpc/platforms/pseries/reconfig.c -index 7c7fcc042549..fb695f142563 100644 ---- a/arch/powerpc/platforms/pseries/reconfig.c -+++ b/arch/powerpc/platforms/pseries/reconfig.c -@@ -82,7 +82,6 @@ static int pSeries_reconfig_remove_node(struct device_node *np) - - of_detach_node(np); - of_node_put(parent); -- of_node_put(np); /* Must decrement the refcount */ - return 0; - } - -diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd.c b/arch/x86/kernel/cpu/mcheck/mce_amd.c -index 62aca448726a..2116176c1721 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce_amd.c -+++ b/arch/x86/kernel/cpu/mcheck/mce_amd.c -@@ -682,6 +682,9 @@ static int threshold_create_bank(unsigned int cpu, unsigned int bank) - const char *name = th_names[bank]; - int err = 0; - -+ if (!dev) -+ return -ENODEV; -+ - if (is_shared_bank(bank)) { - nb = node_to_amd_nb(amd_get_nb_id(cpu)); - -diff --git a/crypto/authencesn.c b/crypto/authencesn.c -index 0c0468869e25..52154ef21b5e 100644 ---- a/crypto/authencesn.c -+++ b/crypto/authencesn.c -@@ -245,6 +245,9 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - u8 *ihash = ohash + crypto_ahash_digestsize(auth); - u32 tmp[2]; - -+ if (!authsize) -+ goto decrypt; -+ - /* Move high-order bits of sequence number back. */ - scatterwalk_map_and_copy(tmp, dst, 4, 4, 0); - scatterwalk_map_and_copy(tmp + 1, dst, assoclen + cryptlen, 4, 0); -@@ -253,6 +256,8 @@ static int crypto_authenc_esn_decrypt_tail(struct aead_request *req, - if (crypto_memneq(ihash, ohash, authsize)) - return -EBADMSG; - -+decrypt: -+ - sg_init_table(areq_ctx->dst, 2); - dst = scatterwalk_ffwd(areq_ctx->dst, dst, assoclen); - -diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c -index 5ea5dc219f56..73c9c7fa9001 100644 ---- a/drivers/acpi/glue.c -+++ b/drivers/acpi/glue.c -@@ -98,7 +98,15 @@ static int find_child_checks(struct acpi_device *adev, bool check_children) - if (check_children && list_empty(&adev->children)) - return -ENODEV; - -- return sta_present ? FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE; -+ /* -+ * If the device has a _HID (or _CID) returning a valid ACPI/PNP -+ * device ID, it is better to make it look less attractive here, so that -+ * the other device with the same _ADR value (that may not have a valid -+ * device ID) can be matched going forward. [This means a second spec -+ * violation in a row, so whatever we do here is best effort anyway.] -+ */ -+ return sta_present && list_empty(&adev->pnp.ids) ? -+ FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE; - } - - struct acpi_device *acpi_find_child_device(struct acpi_device *parent, -diff --git a/drivers/base/power/domain.c b/drivers/base/power/domain.c -index 3f94e5fc110a..78b0ece0c867 100644 ---- a/drivers/base/power/domain.c -+++ b/drivers/base/power/domain.c -@@ -1188,7 +1188,6 @@ static struct generic_pm_domain_data *genpd_alloc_dev_data(struct device *dev, - } - - dev->power.subsys_data->domain_data = &gpd_data->base; -- dev->pm_domain = &genpd->domain; - - spin_unlock_irq(&dev->power.lock); - -@@ -1207,7 +1206,6 @@ static void genpd_free_dev_data(struct device *dev, - { - spin_lock_irq(&dev->power.lock); - -- dev->pm_domain = NULL; - dev->power.subsys_data->domain_data = NULL; - - spin_unlock_irq(&dev->power.lock); -@@ -1248,6 +1246,8 @@ int __pm_genpd_add_device(struct generic_pm_domain *genpd, struct device *dev, - if (ret) - goto out; - -+ dev->pm_domain = &genpd->domain; -+ - genpd->device_count++; - genpd->max_off_time_changed = true; - -@@ -1299,6 +1299,8 @@ int pm_genpd_remove_device(struct generic_pm_domain *genpd, - if (genpd->detach_dev) - genpd->detach_dev(genpd, dev); - -+ dev->pm_domain = NULL; -+ - list_del_init(&pdd->list_node); - - mutex_unlock(&genpd->lock); -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index 41fb1a917b17..33e23a7a691f 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -595,8 +595,6 @@ int xen_blkif_schedule(void *arg) - unsigned long timeout; - int ret; - -- xen_blkif_get(blkif); -- - while (!kthread_should_stop()) { - if (try_to_freeze()) - continue; -@@ -650,7 +648,6 @@ purge_gnt_list: - print_stats(blkif); - - blkif->xenblkd = NULL; -- xen_blkif_put(blkif); - - return 0; - } -diff --git a/drivers/block/xen-blkback/xenbus.c b/drivers/block/xen-blkback/xenbus.c -index f53cff42f8da..923308201375 100644 ---- a/drivers/block/xen-blkback/xenbus.c -+++ b/drivers/block/xen-blkback/xenbus.c -@@ -221,7 +221,6 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) - if (blkif->xenblkd) { - kthread_stop(blkif->xenblkd); - wake_up(&blkif->shutdown_wq); -- blkif->xenblkd = NULL; - } - - /* The above kthread_stop() guarantees that at this point we -@@ -266,9 +265,10 @@ static int xen_blkif_disconnect(struct xen_blkif *blkif) - - static void xen_blkif_free(struct xen_blkif *blkif) - { -- -- xen_blkif_disconnect(blkif); -+ WARN_ON(xen_blkif_disconnect(blkif)); - xen_vbd_free(&blkif->vbd); -+ kfree(blkif->be->mode); -+ kfree(blkif->be); - - /* Make sure everything is drained before shutting down */ - BUG_ON(blkif->persistent_gnt_c != 0); -@@ -445,8 +445,6 @@ static int xen_blkbk_remove(struct xenbus_device *dev) - xen_blkif_put(be->blkif); - } - -- kfree(be->mode); -- kfree(be); - return 0; - } - -diff --git a/drivers/char/ipmi/ipmi_watchdog.c b/drivers/char/ipmi/ipmi_watchdog.c -index 096f0cef4da1..40d400fe5bb7 100644 ---- a/drivers/char/ipmi/ipmi_watchdog.c -+++ b/drivers/char/ipmi/ipmi_watchdog.c -@@ -1162,10 +1162,11 @@ static int wdog_reboot_handler(struct notifier_block *this, - ipmi_watchdog_state = WDOG_TIMEOUT_NONE; - ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB); - } else if (ipmi_watchdog_state != WDOG_TIMEOUT_NONE) { -- /* Set a long timer to let the reboot happens, but -- reboot if it hangs, but only if the watchdog -+ /* Set a long timer to let the reboot happen or -+ reset if it hangs, but only if the watchdog - timer was already running. */ -- timeout = 120; -+ if (timeout < 120) -+ timeout = 120; - pretimeout = 0; - ipmi_watchdog_state = WDOG_TIMEOUT_RESET; - ipmi_set_timeout(IPMI_SET_TIMEOUT_NO_HB); -diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c -index 6d56877b2e0a..a0d9ac6b6cc9 100644 ---- a/drivers/char/tpm/tpm-chip.c -+++ b/drivers/char/tpm/tpm-chip.c -@@ -29,9 +29,8 @@ - #include "tpm.h" - #include "tpm_eventlog.h" - --static DECLARE_BITMAP(dev_mask, TPM_NUM_DEVICES); --static LIST_HEAD(tpm_chip_list); --static DEFINE_SPINLOCK(driver_lock); -+DEFINE_IDR(dev_nums_idr); -+static DEFINE_MUTEX(idr_lock); - - struct class *tpm_class; - dev_t tpm_devt; -@@ -92,20 +91,30 @@ EXPORT_SYMBOL_GPL(tpm_put_ops); - */ - struct tpm_chip *tpm_chip_find_get(int chip_num) - { -- struct tpm_chip *pos, *chip = NULL; -+ struct tpm_chip *chip, *res = NULL; -+ int chip_prev; -+ -+ mutex_lock(&idr_lock); -+ -+ if (chip_num == TPM_ANY_NUM) { -+ chip_num = 0; -+ do { -+ chip_prev = chip_num; -+ chip = idr_get_next(&dev_nums_idr, &chip_num); -+ if (chip && !tpm_try_get_ops(chip)) { -+ res = chip; -+ break; -+ } -+ } while (chip_prev != chip_num); -+ } else { -+ chip = idr_find_slowpath(&dev_nums_idr, chip_num); -+ if (chip && !tpm_try_get_ops(chip)) -+ res = chip; -+ } - -- rcu_read_lock(); -- list_for_each_entry_rcu(pos, &tpm_chip_list, list) { -- if (chip_num != TPM_ANY_NUM && chip_num != pos->dev_num) -- continue; -+ mutex_unlock(&idr_lock); - -- /* rcu prevents chip from being free'd */ -- if (!tpm_try_get_ops(pos)) -- chip = pos; -- break; -- } -- rcu_read_unlock(); -- return chip; -+ return res; - } - - /** -@@ -118,9 +127,10 @@ static void tpm_dev_release(struct device *dev) - { - struct tpm_chip *chip = container_of(dev, struct tpm_chip, dev); - -- spin_lock(&driver_lock); -- clear_bit(chip->dev_num, dev_mask); -- spin_unlock(&driver_lock); -+ mutex_lock(&idr_lock); -+ idr_remove(&dev_nums_idr, chip->dev_num); -+ mutex_unlock(&idr_lock); -+ - kfree(chip); - } - -@@ -173,6 +183,7 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - const struct tpm_class_ops *ops) - { - struct tpm_chip *chip; -+ int rc; - - chip = kzalloc(sizeof(*chip), GFP_KERNEL); - if (chip == NULL) -@@ -180,21 +191,18 @@ struct tpm_chip *tpmm_chip_alloc(struct device *dev, - - mutex_init(&chip->tpm_mutex); - init_rwsem(&chip->ops_sem); -- INIT_LIST_HEAD(&chip->list); - - chip->ops = ops; - -- spin_lock(&driver_lock); -- chip->dev_num = find_first_zero_bit(dev_mask, TPM_NUM_DEVICES); -- spin_unlock(&driver_lock); -- -- if (chip->dev_num >= TPM_NUM_DEVICES) { -+ mutex_lock(&idr_lock); -+ rc = idr_alloc(&dev_nums_idr, NULL, 0, TPM_NUM_DEVICES, GFP_KERNEL); -+ mutex_unlock(&idr_lock); -+ if (rc < 0) { - dev_err(dev, "No available tpm device numbers\n"); - kfree(chip); -- return ERR_PTR(-ENOMEM); -+ return ERR_PTR(rc); - } -- -- set_bit(chip->dev_num, dev_mask); -+ chip->dev_num = rc; - - scnprintf(chip->devname, sizeof(chip->devname), "tpm%d", chip->dev_num); - -@@ -252,19 +260,28 @@ static int tpm_add_char_device(struct tpm_chip *chip) - return rc; - } - -+ /* Make the chip available. */ -+ mutex_lock(&idr_lock); -+ idr_replace(&dev_nums_idr, chip, chip->dev_num); -+ mutex_unlock(&idr_lock); -+ - return rc; - } - - static void tpm_del_char_device(struct tpm_chip *chip) - { - cdev_del(&chip->cdev); -+ device_del(&chip->dev); -+ -+ /* Make the chip unavailable. */ -+ mutex_lock(&idr_lock); -+ idr_replace(&dev_nums_idr, NULL, chip->dev_num); -+ mutex_unlock(&idr_lock); - - /* Make the driver uncallable. */ - down_write(&chip->ops_sem); - chip->ops = NULL; - up_write(&chip->ops_sem); -- -- device_del(&chip->dev); - } - - static int tpm1_chip_register(struct tpm_chip *chip) -@@ -319,11 +336,6 @@ int tpm_chip_register(struct tpm_chip *chip) - if (rc) - goto out_err; - -- /* Make the chip available. */ -- spin_lock(&driver_lock); -- list_add_tail_rcu(&chip->list, &tpm_chip_list); -- spin_unlock(&driver_lock); -- - chip->flags |= TPM_CHIP_FLAG_REGISTERED; - - if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) { -@@ -360,11 +372,6 @@ void tpm_chip_unregister(struct tpm_chip *chip) - if (!(chip->flags & TPM_CHIP_FLAG_REGISTERED)) - return; - -- spin_lock(&driver_lock); -- list_del_rcu(&chip->list); -- spin_unlock(&driver_lock); -- synchronize_rcu(); -- - if (!(chip->flags & TPM_CHIP_FLAG_TPM2)) - sysfs_remove_link(&chip->dev.parent->kobj, "ppi"); - -diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c -index 8588f2e4b9af..aaa5fa95dede 100644 ---- a/drivers/char/tpm/tpm-interface.c -+++ b/drivers/char/tpm/tpm-interface.c -@@ -1127,6 +1127,7 @@ static int __init tpm_init(void) - - static void __exit tpm_exit(void) - { -+ idr_destroy(&dev_nums_idr); - class_destroy(tpm_class); - unregister_chrdev_region(tpm_devt, TPM_NUM_DEVICES); - } -diff --git a/drivers/char/tpm/tpm-sysfs.c b/drivers/char/tpm/tpm-sysfs.c -index 6a4056a3f7ee..06ac6e9657d2 100644 ---- a/drivers/char/tpm/tpm-sysfs.c -+++ b/drivers/char/tpm/tpm-sysfs.c -@@ -38,6 +38,8 @@ static ssize_t pubek_show(struct device *dev, struct device_attribute *attr, - - struct tpm_chip *chip = dev_get_drvdata(dev); - -+ memset(&tpm_cmd, 0, sizeof(tpm_cmd)); -+ - tpm_cmd.header.in = tpm_readpubek_header; - err = tpm_transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE, 0, - "attempting to read the PUBEK"); -diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h -index e21e2c599e66..772d99b3a8e4 100644 ---- a/drivers/char/tpm/tpm.h -+++ b/drivers/char/tpm/tpm.h -@@ -34,7 +34,7 @@ - enum tpm_const { - TPM_MINOR = 224, /* officially assigned */ - TPM_BUFSIZE = 4096, -- TPM_NUM_DEVICES = 256, -+ TPM_NUM_DEVICES = 65536, - TPM_RETRY = 50, /* 5 seconds */ - }; - -@@ -200,8 +200,6 @@ struct tpm_chip { - acpi_handle acpi_dev_handle; - char ppi_version[TPM_PPI_VERSION_LEN + 1]; - #endif /* CONFIG_ACPI */ -- -- struct list_head list; - }; - - #define to_tpm_chip(d) container_of(d, struct tpm_chip, dev) -@@ -497,6 +495,7 @@ static inline void tpm_buf_append_u32(struct tpm_buf *buf, const u32 value) - extern struct class *tpm_class; - extern dev_t tpm_devt; - extern const struct file_operations tpm_fops; -+extern struct idr dev_nums_idr; - - enum tpm_transmit_flags { - TPM_TRANSMIT_UNLOCKED = BIT(0), -diff --git a/drivers/dma/ioat/hw.h b/drivers/dma/ioat/hw.h -index 690e3b4f8202..b36da3c1073f 100644 ---- a/drivers/dma/ioat/hw.h -+++ b/drivers/dma/ioat/hw.h -@@ -64,6 +64,8 @@ - #define PCI_DEVICE_ID_INTEL_IOAT_BDX8 0x6f2e - #define PCI_DEVICE_ID_INTEL_IOAT_BDX9 0x6f2f - -+#define PCI_DEVICE_ID_INTEL_IOAT_SKX 0x2021 -+ - #define IOAT_VER_1_2 0x12 /* Version 1.2 */ - #define IOAT_VER_2_0 0x20 /* Version 2.0 */ - #define IOAT_VER_3_0 0x30 /* Version 3.0 */ -diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c -index 4ef0c5e07912..abb75ebd65ea 100644 ---- a/drivers/dma/ioat/init.c -+++ b/drivers/dma/ioat/init.c -@@ -105,6 +105,8 @@ static struct pci_device_id ioat_pci_tbl[] = { - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BDX8) }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BDX9) }, - -+ { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_SKX) }, -+ - /* I/OAT v3.3 platforms */ - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BWD0) }, - { PCI_VDEVICE(INTEL, PCI_DEVICE_ID_INTEL_IOAT_BWD1) }, -@@ -250,10 +252,15 @@ static bool is_bdx_ioat(struct pci_dev *pdev) - } - } - -+static inline bool is_skx_ioat(struct pci_dev *pdev) -+{ -+ return (pdev->device == PCI_DEVICE_ID_INTEL_IOAT_SKX) ? true : false; -+} -+ - static bool is_xeon_cb32(struct pci_dev *pdev) - { - return is_jf_ioat(pdev) || is_snb_ioat(pdev) || is_ivb_ioat(pdev) || -- is_hsw_ioat(pdev) || is_bdx_ioat(pdev); -+ is_hsw_ioat(pdev) || is_bdx_ioat(pdev) || is_skx_ioat(pdev); - } - - bool is_bwd_ioat(struct pci_dev *pdev) -@@ -1350,6 +1357,8 @@ static int ioat_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) - - device->version = readb(device->reg_base + IOAT_VER_OFFSET); - if (device->version >= IOAT_VER_3_0) { -+ if (is_skx_ioat(pdev)) -+ device->version = IOAT_VER_3_2; - err = ioat3_dma_probe(device, ioat_dca_enabled); - - if (device->version >= IOAT_VER_3_3) -diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c -index a415edbe61b1..149ec2bd9bc6 100644 ---- a/drivers/dma/ti-dma-crossbar.c -+++ b/drivers/dma/ti-dma-crossbar.c -@@ -146,6 +146,7 @@ static int ti_am335x_xbar_probe(struct platform_device *pdev) - match = of_match_node(ti_am335x_master_match, dma_node); - if (!match) { - dev_err(&pdev->dev, "DMA master is not supported\n"); -+ of_node_put(dma_node); - return -EINVAL; - } - -@@ -310,6 +311,7 @@ static int ti_dra7_xbar_probe(struct platform_device *pdev) - match = of_match_node(ti_dra7_master_match, dma_node); - if (!match) { - dev_err(&pdev->dev, "DMA master is not supported\n"); -+ of_node_put(dma_node); - return -EINVAL; - } - -diff --git a/drivers/gpu/drm/msm/adreno/adreno_gpu.c b/drivers/gpu/drm/msm/adreno/adreno_gpu.c -index a3b54cc76495..b66ffd44ff26 100644 ---- a/drivers/gpu/drm/msm/adreno/adreno_gpu.c -+++ b/drivers/gpu/drm/msm/adreno/adreno_gpu.c -@@ -204,7 +204,14 @@ int adreno_submit(struct msm_gpu *gpu, struct msm_gem_submit *submit, - void adreno_flush(struct msm_gpu *gpu) - { - struct adreno_gpu *adreno_gpu = to_adreno_gpu(gpu); -- uint32_t wptr = get_wptr(gpu->rb); -+ uint32_t wptr; -+ -+ /* -+ * Mask wptr value that we calculate to fit in the HW range. This is -+ * to account for the possibility that the last command fit exactly into -+ * the ringbuffer and rb->next hasn't wrapped to zero yet -+ */ -+ wptr = get_wptr(gpu->rb) & ((gpu->rb->size / 4) - 1); - - /* ensure writes to ringbuffer have hit system memory: */ - mb(); -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index 1847f83b1e33..fed44d4e5b72 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -90,7 +90,8 @@ static int submit_lookup_objects(struct msm_gem_submit *submit, - pagefault_disable(); - } - -- if (submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) { -+ if ((submit_bo.flags & ~MSM_SUBMIT_BO_FLAGS) || -+ !(submit_bo.flags & MSM_SUBMIT_BO_FLAGS)) { - DRM_ERROR("invalid flags: %x\n", submit_bo.flags); - ret = -EINVAL; - goto out_unlock; -diff --git a/drivers/gpu/drm/msm/msm_ringbuffer.c b/drivers/gpu/drm/msm/msm_ringbuffer.c -index 1f14b908b221..ae317271cf81 100644 ---- a/drivers/gpu/drm/msm/msm_ringbuffer.c -+++ b/drivers/gpu/drm/msm/msm_ringbuffer.c -@@ -23,7 +23,8 @@ struct msm_ringbuffer *msm_ringbuffer_new(struct msm_gpu *gpu, int size) - struct msm_ringbuffer *ring; - int ret; - -- size = ALIGN(size, 4); /* size should be dword aligned */ -+ if (WARN_ON(!is_power_of_2(size))) -+ return ERR_PTR(-EINVAL); - - ring = kzalloc(sizeof(*ring), GFP_KERNEL); - if (!ring) { -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c -index c794b2c2d21e..6d8f21290aa2 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bar/gf100.c -@@ -129,7 +129,7 @@ gf100_bar_init(struct nvkm_bar *base) - - if (bar->bar[0].mem) { - addr = nvkm_memory_addr(bar->bar[0].mem) >> 12; -- nvkm_wr32(device, 0x001714, 0xc0000000 | addr); -+ nvkm_wr32(device, 0x001714, 0x80000000 | addr); - } - - return 0; -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -index 48cb19949ca3..9255b9c096b6 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -@@ -282,26 +282,6 @@ static void rcar_du_crtc_update_planes(struct rcar_du_crtc *rcrtc) - * Page Flip - */ - --void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc, -- struct drm_file *file) --{ -- struct drm_pending_vblank_event *event; -- struct drm_device *dev = rcrtc->crtc.dev; -- unsigned long flags; -- -- /* Destroy the pending vertical blanking event associated with the -- * pending page flip, if any, and disable vertical blanking interrupts. -- */ -- spin_lock_irqsave(&dev->event_lock, flags); -- event = rcrtc->event; -- if (event && event->base.file_priv == file) { -- rcrtc->event = NULL; -- event->base.destroy(&event->base); -- drm_crtc_vblank_put(&rcrtc->crtc); -- } -- spin_unlock_irqrestore(&dev->event_lock, flags); --} -- - static void rcar_du_crtc_finish_page_flip(struct rcar_du_crtc *rcrtc) - { - struct drm_pending_vblank_event *event; -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -index 4b95d9d08c49..2bbe3f5aab65 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -@@ -67,8 +67,6 @@ enum rcar_du_output { - - int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index); - void rcar_du_crtc_enable_vblank(struct rcar_du_crtc *rcrtc, bool enable); --void rcar_du_crtc_cancel_page_flip(struct rcar_du_crtc *rcrtc, -- struct drm_file *file); - void rcar_du_crtc_suspend(struct rcar_du_crtc *rcrtc); - void rcar_du_crtc_resume(struct rcar_du_crtc *rcrtc); - -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c -index 40422f6b645e..bf4674aa6405 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c -@@ -144,91 +144,6 @@ MODULE_DEVICE_TABLE(of, rcar_du_of_table); - * DRM operations - */ - --static int rcar_du_unload(struct drm_device *dev) --{ -- struct rcar_du_device *rcdu = dev->dev_private; -- -- if (rcdu->fbdev) -- drm_fbdev_cma_fini(rcdu->fbdev); -- -- drm_kms_helper_poll_fini(dev); -- drm_mode_config_cleanup(dev); -- drm_vblank_cleanup(dev); -- -- dev->irq_enabled = 0; -- dev->dev_private = NULL; -- -- return 0; --} -- --static int rcar_du_load(struct drm_device *dev, unsigned long flags) --{ -- struct platform_device *pdev = dev->platformdev; -- struct device_node *np = pdev->dev.of_node; -- struct rcar_du_device *rcdu; -- struct resource *mem; -- int ret; -- -- if (np == NULL) { -- dev_err(dev->dev, "no platform data\n"); -- return -ENODEV; -- } -- -- rcdu = devm_kzalloc(&pdev->dev, sizeof(*rcdu), GFP_KERNEL); -- if (rcdu == NULL) { -- dev_err(dev->dev, "failed to allocate private data\n"); -- return -ENOMEM; -- } -- -- init_waitqueue_head(&rcdu->commit.wait); -- -- rcdu->dev = &pdev->dev; -- rcdu->info = of_match_device(rcar_du_of_table, rcdu->dev)->data; -- rcdu->ddev = dev; -- dev->dev_private = rcdu; -- -- /* I/O resources */ -- mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -- rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem); -- if (IS_ERR(rcdu->mmio)) -- return PTR_ERR(rcdu->mmio); -- -- /* Initialize vertical blanking interrupts handling. Start with vblank -- * disabled for all CRTCs. -- */ -- ret = drm_vblank_init(dev, (1 << rcdu->info->num_crtcs) - 1); -- if (ret < 0) { -- dev_err(&pdev->dev, "failed to initialize vblank\n"); -- goto done; -- } -- -- /* DRM/KMS objects */ -- ret = rcar_du_modeset_init(rcdu); -- if (ret < 0) { -- dev_err(&pdev->dev, "failed to initialize DRM/KMS (%d)\n", ret); -- goto done; -- } -- -- dev->irq_enabled = 1; -- -- platform_set_drvdata(pdev, rcdu); -- --done: -- if (ret) -- rcar_du_unload(dev); -- -- return ret; --} -- --static void rcar_du_preclose(struct drm_device *dev, struct drm_file *file) --{ -- struct rcar_du_device *rcdu = dev->dev_private; -- unsigned int i; -- -- for (i = 0; i < rcdu->num_crtcs; ++i) -- rcar_du_crtc_cancel_page_flip(&rcdu->crtcs[i], file); --} -- - static void rcar_du_lastclose(struct drm_device *dev) - { - struct rcar_du_device *rcdu = dev->dev_private; -@@ -269,11 +184,7 @@ static const struct file_operations rcar_du_fops = { - static struct drm_driver rcar_du_driver = { - .driver_features = DRIVER_GEM | DRIVER_MODESET | DRIVER_PRIME - | DRIVER_ATOMIC, -- .load = rcar_du_load, -- .unload = rcar_du_unload, -- .preclose = rcar_du_preclose, - .lastclose = rcar_du_lastclose, -- .set_busid = drm_platform_set_busid, - .get_vblank_counter = drm_vblank_no_hw_counter, - .enable_vblank = rcar_du_enable_vblank, - .disable_vblank = rcar_du_disable_vblank, -@@ -333,18 +244,104 @@ static const struct dev_pm_ops rcar_du_pm_ops = { - * Platform driver - */ - --static int rcar_du_probe(struct platform_device *pdev) -+static int rcar_du_remove(struct platform_device *pdev) - { -- return drm_platform_init(&rcar_du_driver, pdev); -+ struct rcar_du_device *rcdu = platform_get_drvdata(pdev); -+ struct drm_device *ddev = rcdu->ddev; -+ -+ mutex_lock(&ddev->mode_config.mutex); -+ drm_connector_unplug_all(ddev); -+ mutex_unlock(&ddev->mode_config.mutex); -+ -+ drm_dev_unregister(ddev); -+ -+ if (rcdu->fbdev) -+ drm_fbdev_cma_fini(rcdu->fbdev); -+ -+ drm_kms_helper_poll_fini(ddev); -+ drm_mode_config_cleanup(ddev); -+ -+ drm_dev_unref(ddev); -+ -+ return 0; - } - --static int rcar_du_remove(struct platform_device *pdev) -+static int rcar_du_probe(struct platform_device *pdev) - { -- struct rcar_du_device *rcdu = platform_get_drvdata(pdev); -+ struct device_node *np = pdev->dev.of_node; -+ struct rcar_du_device *rcdu; -+ struct drm_connector *connector; -+ struct drm_device *ddev; -+ struct resource *mem; -+ int ret; -+ -+ if (np == NULL) { -+ dev_err(&pdev->dev, "no device tree node\n"); -+ return -ENODEV; -+ } -+ -+ /* Allocate and initialize the DRM and R-Car device structures. */ -+ rcdu = devm_kzalloc(&pdev->dev, sizeof(*rcdu), GFP_KERNEL); -+ if (rcdu == NULL) -+ return -ENOMEM; -+ -+ init_waitqueue_head(&rcdu->commit.wait); -+ -+ rcdu->dev = &pdev->dev; -+ rcdu->info = of_match_device(rcar_du_of_table, rcdu->dev)->data; -+ -+ platform_set_drvdata(pdev, rcdu); - -- drm_put_dev(rcdu->ddev); -+ /* I/O resources */ -+ mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); -+ rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem); -+ if (IS_ERR(rcdu->mmio)) -+ ret = PTR_ERR(rcdu->mmio); -+ -+ /* DRM/KMS objects */ -+ ddev = drm_dev_alloc(&rcar_du_driver, &pdev->dev); -+ if (!ddev) -+ return -ENOMEM; -+ -+ drm_dev_set_unique(ddev, dev_name(&pdev->dev)); -+ -+ rcdu->ddev = ddev; -+ ddev->dev_private = rcdu; -+ -+ ret = rcar_du_modeset_init(rcdu); -+ if (ret < 0) { -+ dev_err(&pdev->dev, "failed to initialize DRM/KMS (%d)\n", ret); -+ goto error; -+ } -+ -+ ddev->irq_enabled = 1; -+ -+ /* Register the DRM device with the core and the connectors with -+ * sysfs. -+ */ -+ ret = drm_dev_register(ddev, 0); -+ if (ret) -+ goto error; -+ -+ mutex_lock(&ddev->mode_config.mutex); -+ drm_for_each_connector(connector, ddev) { -+ ret = drm_connector_register(connector); -+ if (ret < 0) -+ break; -+ } -+ mutex_unlock(&ddev->mode_config.mutex); -+ -+ if (ret < 0) -+ goto error; -+ -+ DRM_INFO("Device %s probed\n", dev_name(&pdev->dev)); - - return 0; -+ -+error: -+ rcar_du_remove(pdev); -+ -+ return ret; - } - - static struct platform_driver rcar_du_platform_driver = { -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c b/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c -index 96f2eb43713c..6038be93c58d 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_hdmicon.c -@@ -55,12 +55,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = { - .best_encoder = rcar_du_connector_best_encoder, - }; - --static void rcar_du_hdmi_connector_destroy(struct drm_connector *connector) --{ -- drm_connector_unregister(connector); -- drm_connector_cleanup(connector); --} -- - static enum drm_connector_status - rcar_du_hdmi_connector_detect(struct drm_connector *connector, bool force) - { -@@ -79,7 +73,7 @@ static const struct drm_connector_funcs connector_funcs = { - .reset = drm_atomic_helper_connector_reset, - .detect = rcar_du_hdmi_connector_detect, - .fill_modes = drm_helper_probe_single_connector_modes, -- .destroy = rcar_du_hdmi_connector_destroy, -+ .destroy = drm_connector_cleanup, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - }; -@@ -108,9 +102,6 @@ int rcar_du_hdmi_connector_init(struct rcar_du_device *rcdu, - return ret; - - drm_connector_helper_add(connector, &connector_helper_funcs); -- ret = drm_connector_register(connector); -- if (ret < 0) -- return ret; - - connector->dpms = DRM_MODE_DPMS_OFF; - drm_object_property_set_value(&connector->base, -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c -index ca12e8ca5552..46429c4be8e5 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c -@@ -761,6 +761,13 @@ int rcar_du_modeset_init(struct rcar_du_device *rcdu) - if (ret < 0) - return ret; - -+ /* Initialize vertical blanking interrupts handling. Start with vblank -+ * disabled for all CRTCs. -+ */ -+ ret = drm_vblank_init(dev, (1 << rcdu->info->num_crtcs) - 1); -+ if (ret < 0) -+ return ret; -+ - /* Initialize the groups. */ - num_groups = DIV_ROUND_UP(rcdu->num_crtcs, 2); - -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c -index 0c43032fc693..e905f5da7aaa 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdscon.c -@@ -62,12 +62,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = { - .best_encoder = rcar_du_connector_best_encoder, - }; - --static void rcar_du_lvds_connector_destroy(struct drm_connector *connector) --{ -- drm_connector_unregister(connector); -- drm_connector_cleanup(connector); --} -- - static enum drm_connector_status - rcar_du_lvds_connector_detect(struct drm_connector *connector, bool force) - { -@@ -79,7 +73,7 @@ static const struct drm_connector_funcs connector_funcs = { - .reset = drm_atomic_helper_connector_reset, - .detect = rcar_du_lvds_connector_detect, - .fill_modes = drm_helper_probe_single_connector_modes, -- .destroy = rcar_du_lvds_connector_destroy, -+ .destroy = drm_connector_cleanup, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - }; -@@ -117,9 +111,6 @@ int rcar_du_lvds_connector_init(struct rcar_du_device *rcdu, - return ret; - - drm_connector_helper_add(connector, &connector_helper_funcs); -- ret = drm_connector_register(connector); -- if (ret < 0) -- return ret; - - connector->dpms = DRM_MODE_DPMS_OFF; - drm_object_property_set_value(&connector->base, -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c b/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c -index e0a5d8f93963..9d7e5c99caf6 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_vgacon.c -@@ -31,12 +31,6 @@ static const struct drm_connector_helper_funcs connector_helper_funcs = { - .best_encoder = rcar_du_connector_best_encoder, - }; - --static void rcar_du_vga_connector_destroy(struct drm_connector *connector) --{ -- drm_connector_unregister(connector); -- drm_connector_cleanup(connector); --} -- - static enum drm_connector_status - rcar_du_vga_connector_detect(struct drm_connector *connector, bool force) - { -@@ -48,7 +42,7 @@ static const struct drm_connector_funcs connector_funcs = { - .reset = drm_atomic_helper_connector_reset, - .detect = rcar_du_vga_connector_detect, - .fill_modes = drm_helper_probe_single_connector_modes, -- .destroy = rcar_du_vga_connector_destroy, -+ .destroy = drm_connector_cleanup, - .atomic_duplicate_state = drm_atomic_helper_connector_duplicate_state, - .atomic_destroy_state = drm_atomic_helper_connector_destroy_state, - }; -@@ -76,9 +70,6 @@ int rcar_du_vga_connector_init(struct rcar_du_device *rcdu, - return ret; - - drm_connector_helper_add(connector, &connector_helper_funcs); -- ret = drm_connector_register(connector); -- if (ret < 0) -- return ret; - - connector->dpms = DRM_MODE_DPMS_OFF; - drm_object_property_set_value(&connector->base, -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index ecf15cf0c3fd..04fd0f2b6af0 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -471,7 +471,7 @@ static int vmw_cmd_invalid(struct vmw_private *dev_priv, - struct vmw_sw_context *sw_context, - SVGA3dCmdHeader *header) - { -- return capable(CAP_SYS_ADMIN) ? : -EINVAL; -+ return -EINVAL; - } - - static int vmw_cmd_ok(struct vmw_private *dev_priv, -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 936960202cf4..11a051bd8a8b 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -2427,6 +2427,7 @@ static const struct hid_device_id hid_ignore_list[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0002) }, - { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0003) }, - { HID_USB_DEVICE(USB_VENDOR_ID_PANJIT, 0x0004) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_PETZL, USB_DEVICE_ID_PETZL_HEADLAMP) }, - { HID_USB_DEVICE(USB_VENDOR_ID_PHILIPS, USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_POWERCOM, USB_DEVICE_ID_POWERCOM_UPS) }, - #if defined(CONFIG_MOUSE_SYNAPTICS_USB) || defined(CONFIG_MOUSE_SYNAPTICS_USB_MODULE) -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index c7f8b70d15ee..37cbc2ecfc5f 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -777,6 +777,9 @@ - #define USB_VENDOR_ID_PETALYNX 0x18b1 - #define USB_DEVICE_ID_PETALYNX_MAXTER_REMOTE 0x0037 - -+#define USB_VENDOR_ID_PETZL 0x2122 -+#define USB_DEVICE_ID_PETZL_HEADLAMP 0x1234 -+ - #define USB_VENDOR_ID_PHILIPS 0x0471 - #define USB_DEVICE_ID_PHILIPS_IEEE802154_DONGLE 0x0617 - -diff --git a/drivers/infiniband/core/uverbs_cmd.c b/drivers/infiniband/core/uverbs_cmd.c -index 9eca4b41fa0a..b7a73f1a8beb 100644 ---- a/drivers/infiniband/core/uverbs_cmd.c -+++ b/drivers/infiniband/core/uverbs_cmd.c -@@ -2287,8 +2287,9 @@ ssize_t ib_uverbs_modify_qp(struct ib_uverbs_file *file, - if (copy_from_user(&cmd, buf, sizeof cmd)) - return -EFAULT; - -- if (cmd.port_num < rdma_start_port(ib_dev) || -- cmd.port_num > rdma_end_port(ib_dev)) -+ if ((cmd.attr_mask & IB_QP_PORT) && -+ (cmd.port_num < rdma_start_port(ib_dev) || -+ cmd.port_num > rdma_end_port(ib_dev))) - return -EINVAL; - - INIT_UDATA(&udata, buf + sizeof cmd, NULL, in_len - sizeof cmd, -diff --git a/drivers/irqchip/irq-keystone.c b/drivers/irqchip/irq-keystone.c -index deb89d63a728..e684be1bb7c0 100644 ---- a/drivers/irqchip/irq-keystone.c -+++ b/drivers/irqchip/irq-keystone.c -@@ -19,9 +19,9 @@ - #include - #include - #include -+#include - #include - #include --#include - #include - #include - #include -@@ -39,6 +39,7 @@ struct keystone_irq_device { - struct irq_domain *irqd; - struct regmap *devctrl_regs; - u32 devctrl_offset; -+ raw_spinlock_t wa_lock; - }; - - static inline u32 keystone_irq_readl(struct keystone_irq_device *kirq) -@@ -83,17 +84,15 @@ static void keystone_irq_ack(struct irq_data *d) - /* nothing to do here */ - } - --static void keystone_irq_handler(struct irq_desc *desc) -+static irqreturn_t keystone_irq_handler(int irq, void *keystone_irq) - { -- unsigned int irq = irq_desc_get_irq(desc); -- struct keystone_irq_device *kirq = irq_desc_get_handler_data(desc); -+ struct keystone_irq_device *kirq = keystone_irq; -+ unsigned long wa_lock_flags; - unsigned long pending; - int src, virq; - - dev_dbg(kirq->dev, "start irq %d\n", irq); - -- chained_irq_enter(irq_desc_get_chip(desc), desc); -- - pending = keystone_irq_readl(kirq); - keystone_irq_writel(kirq, pending); - -@@ -111,13 +110,15 @@ static void keystone_irq_handler(struct irq_desc *desc) - if (!virq) - dev_warn(kirq->dev, "sporious irq detected hwirq %d, virq %d\n", - src, virq); -+ raw_spin_lock_irqsave(&kirq->wa_lock, wa_lock_flags); - generic_handle_irq(virq); -+ raw_spin_unlock_irqrestore(&kirq->wa_lock, -+ wa_lock_flags); - } - } - -- chained_irq_exit(irq_desc_get_chip(desc), desc); -- - dev_dbg(kirq->dev, "end irq %d\n", irq); -+ return IRQ_HANDLED; - } - - static int keystone_irq_map(struct irq_domain *h, unsigned int virq, -@@ -182,9 +183,16 @@ static int keystone_irq_probe(struct platform_device *pdev) - return -ENODEV; - } - -+ raw_spin_lock_init(&kirq->wa_lock); -+ - platform_set_drvdata(pdev, kirq); - -- irq_set_chained_handler_and_data(kirq->irq, keystone_irq_handler, kirq); -+ ret = request_irq(kirq->irq, keystone_irq_handler, -+ 0, dev_name(dev), kirq); -+ if (ret) { -+ irq_domain_remove(kirq->irqd); -+ return ret; -+ } - - /* clear all source bits */ - keystone_irq_writel(kirq, ~0x0); -@@ -199,6 +207,8 @@ static int keystone_irq_remove(struct platform_device *pdev) - struct keystone_irq_device *kirq = platform_get_drvdata(pdev); - int hwirq; - -+ free_irq(kirq->irq, kirq); -+ - for (hwirq = 0; hwirq < KEYSTONE_N_IRQ; hwirq++) - irq_dispose_mapping(irq_find_mapping(kirq->irqd, hwirq)); - -diff --git a/drivers/irqchip/irq-mxs.c b/drivers/irqchip/irq-mxs.c -index 17304705f2cf..05fa9f7af53c 100644 ---- a/drivers/irqchip/irq-mxs.c -+++ b/drivers/irqchip/irq-mxs.c -@@ -131,12 +131,16 @@ static struct irq_chip mxs_icoll_chip = { - .irq_ack = icoll_ack_irq, - .irq_mask = icoll_mask_irq, - .irq_unmask = icoll_unmask_irq, -+ .flags = IRQCHIP_MASK_ON_SUSPEND | -+ IRQCHIP_SKIP_SET_WAKE, - }; - - static struct irq_chip asm9260_icoll_chip = { - .irq_ack = icoll_ack_irq, - .irq_mask = asm9260_mask_irq, - .irq_unmask = asm9260_unmask_irq, -+ .flags = IRQCHIP_MASK_ON_SUSPEND | -+ IRQCHIP_SKIP_SET_WAKE, - }; - - asmlinkage void __exception_irq_entry icoll_handle_irq(struct pt_regs *regs) -diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c -index 9b856e1890d1..e4c43a17b333 100644 ---- a/drivers/isdn/i4l/isdn_common.c -+++ b/drivers/isdn/i4l/isdn_common.c -@@ -1379,6 +1379,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) - if (arg) { - if (copy_from_user(bname, argp, sizeof(bname) - 1)) - return -EFAULT; -+ bname[sizeof(bname)-1] = 0; - } else - return -EINVAL; - ret = mutex_lock_interruptible(&dev->mtx); -diff --git a/drivers/isdn/i4l/isdn_net.c b/drivers/isdn/i4l/isdn_net.c -index aa5dd5668528..dbad5c431bcb 100644 ---- a/drivers/isdn/i4l/isdn_net.c -+++ b/drivers/isdn/i4l/isdn_net.c -@@ -2611,10 +2611,9 @@ isdn_net_newslave(char *parm) - char newname[10]; - - if (p) { -- /* Slave-Name MUST not be empty */ -- if (!strlen(p + 1)) -+ /* Slave-Name MUST not be empty or overflow 'newname' */ -+ if (strscpy(newname, p + 1, sizeof(newname)) <= 0) - return NULL; -- strcpy(newname, p + 1); - *p = 0; - /* Master must already exist */ - if (!(n = isdn_net_findif(parm))) -diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c -index 9c1e8adaf4fc..bf3fbd00a091 100644 ---- a/drivers/isdn/i4l/isdn_ppp.c -+++ b/drivers/isdn/i4l/isdn_ppp.c -@@ -2364,7 +2364,7 @@ static struct ippp_ccp_reset_state *isdn_ppp_ccp_reset_alloc_state(struct ippp_s - id); - return NULL; - } else { -- rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_KERNEL); -+ rs = kzalloc(sizeof(struct ippp_ccp_reset_state), GFP_ATOMIC); - if (!rs) - return NULL; - rs->state = CCPResetIdle; -diff --git a/drivers/mailbox/mailbox.c b/drivers/mailbox/mailbox.c -index 6a4811f85705..9cf826df89b1 100644 ---- a/drivers/mailbox/mailbox.c -+++ b/drivers/mailbox/mailbox.c -@@ -104,11 +104,14 @@ static void tx_tick(struct mbox_chan *chan, int r) - /* Submit next message */ - msg_submit(chan); - -+ if (!mssg) -+ return; -+ - /* Notify the client */ -- if (mssg && chan->cl->tx_done) -+ if (chan->cl->tx_done) - chan->cl->tx_done(chan->cl, mssg, r); - -- if (chan->cl->tx_block) -+ if (r != -ETIME && chan->cl->tx_block) - complete(&chan->tx_complete); - } - -@@ -261,7 +264,7 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg) - - msg_submit(chan); - -- if (chan->cl->tx_block && chan->active_req) { -+ if (chan->cl->tx_block) { - unsigned long wait; - int ret; - -@@ -272,8 +275,8 @@ int mbox_send_message(struct mbox_chan *chan, void *mssg) - - ret = wait_for_completion_timeout(&chan->tx_complete, wait); - if (ret == 0) { -- t = -EIO; -- tx_tick(chan, -EIO); -+ t = -ETIME; -+ tx_tick(chan, t); - } - } - -diff --git a/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c b/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c -index 8001cde1db1e..503135a4f47a 100644 ---- a/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c -+++ b/drivers/media/i2c/s5c73m3/s5c73m3-ctrls.c -@@ -211,7 +211,7 @@ static int s5c73m3_3a_lock(struct s5c73m3 *state, struct v4l2_ctrl *ctrl) - } - - if ((ctrl->val ^ ctrl->cur.val) & V4L2_LOCK_FOCUS) -- ret = s5c73m3_af_run(state, ~af_lock); -+ ret = s5c73m3_af_run(state, !af_lock); - - return ret; - } -diff --git a/drivers/net/ethernet/mellanox/mlx4/icm.c b/drivers/net/ethernet/mellanox/mlx4/icm.c -index 2a9dd460a95f..e1f9e7cebf8f 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/icm.c -+++ b/drivers/net/ethernet/mellanox/mlx4/icm.c -@@ -118,8 +118,13 @@ static int mlx4_alloc_icm_coherent(struct device *dev, struct scatterlist *mem, - if (!buf) - return -ENOMEM; - -+ if (offset_in_page(buf)) { -+ dma_free_coherent(dev, PAGE_SIZE << order, -+ buf, sg_dma_address(mem)); -+ return -ENOMEM; -+ } -+ - sg_set_buf(mem, buf, PAGE_SIZE << order); -- BUG_ON(mem->offset); - sg_dma_len(mem) = PAGE_SIZE << order; - return 0; - } -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 79ef799f88ab..c5ea1018cb47 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -326,6 +326,7 @@ enum cfg_version { - static const struct pci_device_id rtl8169_pci_tbl[] = { - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8129), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8136), 0, 0, RTL_CFG_2 }, -+ { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8161), 0, 0, RTL_CFG_1 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8167), 0, 0, RTL_CFG_0 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8168), 0, 0, RTL_CFG_1 }, - { PCI_DEVICE(PCI_VENDOR_ID_REALTEK, 0x8169), 0, 0, RTL_CFG_0 }, -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 480f3dae0780..4296066a7ad3 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -750,6 +750,7 @@ static struct sh_eth_cpu_data sh7734_data = { - .tsu = 1, - .hw_crc = 1, - .select_mii = 1, -+ .shift_rd0 = 1, - }; - - /* SH7763 */ -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 0bfbabad4431..1d1e5f7723ab 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1442,7 +1442,7 @@ static struct phy_driver genphy_driver[] = { - .phy_id = 0xffffffff, - .phy_id_mask = 0xffffffff, - .name = "Generic PHY", -- .soft_reset = genphy_soft_reset, -+ .soft_reset = genphy_no_soft_reset, - .config_init = genphy_config_init, - .features = PHY_GBIT_FEATURES | SUPPORTED_MII | - SUPPORTED_AUI | SUPPORTED_FIBRE | -diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c -index f64b25c221e8..cd93220c9b45 100644 ---- a/drivers/net/usb/kaweth.c -+++ b/drivers/net/usb/kaweth.c -@@ -1009,6 +1009,7 @@ static int kaweth_probe( - struct net_device *netdev; - const eth_addr_t bcast_addr = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF }; - int result = 0; -+ int rv = -EIO; - - dev_dbg(dev, - "Kawasaki Device Probe (Device number:%d): 0x%4.4x:0x%4.4x:0x%4.4x\n", -@@ -1029,6 +1030,7 @@ static int kaweth_probe( - kaweth = netdev_priv(netdev); - kaweth->dev = udev; - kaweth->net = netdev; -+ kaweth->intf = intf; - - spin_lock_init(&kaweth->device_lock); - init_waitqueue_head(&kaweth->term_wait); -@@ -1048,6 +1050,10 @@ static int kaweth_probe( - /* Download the firmware */ - dev_info(dev, "Downloading firmware...\n"); - kaweth->firmware_buf = (__u8 *)__get_free_page(GFP_KERNEL); -+ if (!kaweth->firmware_buf) { -+ rv = -ENOMEM; -+ goto err_free_netdev; -+ } - if ((result = kaweth_download_firmware(kaweth, - "kaweth/new_code.bin", - 100, -@@ -1139,8 +1145,6 @@ err_fw: - - dev_dbg(dev, "Initializing net device.\n"); - -- kaweth->intf = intf; -- - kaweth->tx_urb = usb_alloc_urb(0, GFP_KERNEL); - if (!kaweth->tx_urb) - goto err_free_netdev; -@@ -1204,7 +1208,7 @@ err_only_tx: - err_free_netdev: - free_netdev(netdev); - -- return -EIO; -+ return rv; - } - - /**************************************************************** -diff --git a/drivers/net/wireless/ath/ath10k/wmi-ops.h b/drivers/net/wireless/ath/ath10k/wmi-ops.h -index 8f4f6a892581..cfed5808bc4e 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-ops.h -+++ b/drivers/net/wireless/ath/ath10k/wmi-ops.h -@@ -639,6 +639,9 @@ ath10k_wmi_vdev_spectral_conf(struct ath10k *ar, - struct sk_buff *skb; - u32 cmd_id; - -+ if (!ar->wmi.ops->gen_vdev_spectral_conf) -+ return -EOPNOTSUPP; -+ - skb = ar->wmi.ops->gen_vdev_spectral_conf(ar, arg); - if (IS_ERR(skb)) - return PTR_ERR(skb); -@@ -654,6 +657,9 @@ ath10k_wmi_vdev_spectral_enable(struct ath10k *ar, u32 vdev_id, u32 trigger, - struct sk_buff *skb; - u32 cmd_id; - -+ if (!ar->wmi.ops->gen_vdev_spectral_enable) -+ return -EOPNOTSUPP; -+ - skb = ar->wmi.ops->gen_vdev_spectral_enable(ar, vdev_id, trigger, - enable); - if (IS_ERR(skb)) -diff --git a/drivers/net/wireless/ath/wil6210/main.c b/drivers/net/wireless/ath/wil6210/main.c -index bb69a5949aea..85bca557a339 100644 ---- a/drivers/net/wireless/ath/wil6210/main.c -+++ b/drivers/net/wireless/ath/wil6210/main.c -@@ -330,18 +330,19 @@ static void wil_fw_error_worker(struct work_struct *work) - - wil->last_fw_recovery = jiffies; - -+ wil_info(wil, "fw error recovery requested (try %d)...\n", -+ wil->recovery_count); -+ if (!no_fw_recovery) -+ wil->recovery_state = fw_recovery_running; -+ if (wil_wait_for_recovery(wil) != 0) -+ return; -+ - mutex_lock(&wil->mutex); - switch (wdev->iftype) { - case NL80211_IFTYPE_STATION: - case NL80211_IFTYPE_P2P_CLIENT: - case NL80211_IFTYPE_MONITOR: -- wil_info(wil, "fw error recovery requested (try %d)...\n", -- wil->recovery_count); -- if (!no_fw_recovery) -- wil->recovery_state = fw_recovery_running; -- if (0 != wil_wait_for_recovery(wil)) -- break; -- -+ /* silent recovery, upper layers will see disconnect */ - __wil_down(wil); - __wil_up(wil); - break; -diff --git a/drivers/nfc/fdp/i2c.c b/drivers/nfc/fdp/i2c.c -index 532db28145c7..a5d7332dfce5 100644 ---- a/drivers/nfc/fdp/i2c.c -+++ b/drivers/nfc/fdp/i2c.c -@@ -210,14 +210,14 @@ static irqreturn_t fdp_nci_i2c_irq_thread_fn(int irq, void *phy_id) - struct sk_buff *skb; - int r; - -- client = phy->i2c_dev; -- dev_dbg(&client->dev, "%s\n", __func__); -- - if (!phy || irq != phy->i2c_dev->irq) { - WARN_ON_ONCE(1); - return IRQ_NONE; - } - -+ client = phy->i2c_dev; -+ dev_dbg(&client->dev, "%s\n", __func__); -+ - r = fdp_nci_i2c_read(phy, &skb); - - if (r == -EREMOTEIO) -diff --git a/drivers/nvdimm/btt.c b/drivers/nvdimm/btt.c -index efb2c1ceef98..957234272ef7 100644 ---- a/drivers/nvdimm/btt.c -+++ b/drivers/nvdimm/btt.c -@@ -1205,10 +1205,13 @@ static int btt_rw_page(struct block_device *bdev, sector_t sector, - struct page *page, int rw) - { - struct btt *btt = bdev->bd_disk->private_data; -+ int rc; - -- btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector); -- page_endio(page, rw & WRITE, 0); -- return 0; -+ rc = btt_do_bvec(btt, NULL, page, PAGE_CACHE_SIZE, 0, rw, sector); -+ if (rc == 0) -+ page_endio(page, rw & WRITE, 0); -+ -+ return rc; - } - - -diff --git a/drivers/nvmem/imx-ocotp.c b/drivers/nvmem/imx-ocotp.c -index b7971d410b60..74e5360c53f0 100644 ---- a/drivers/nvmem/imx-ocotp.c -+++ b/drivers/nvmem/imx-ocotp.c -@@ -88,7 +88,7 @@ static struct nvmem_config imx_ocotp_nvmem_config = { - - static const struct of_device_id imx_ocotp_dt_ids[] = { - { .compatible = "fsl,imx6q-ocotp", (void *)128 }, -- { .compatible = "fsl,imx6sl-ocotp", (void *)32 }, -+ { .compatible = "fsl,imx6sl-ocotp", (void *)64 }, - { .compatible = "fsl,imx6sx-ocotp", (void *)128 }, - { }, - }; -diff --git a/drivers/scsi/fnic/fnic.h b/drivers/scsi/fnic/fnic.h -index ce129e595b55..5c935847599c 100644 ---- a/drivers/scsi/fnic/fnic.h -+++ b/drivers/scsi/fnic/fnic.h -@@ -248,6 +248,7 @@ struct fnic { - struct completion *remove_wait; /* device remove thread blocks */ - - atomic_t in_flight; /* io counter */ -+ bool internal_reset_inprogress; - u32 _reserved; /* fill hole */ - unsigned long state_flags; /* protected by host lock */ - enum fnic_state state; -diff --git a/drivers/scsi/fnic/fnic_scsi.c b/drivers/scsi/fnic/fnic_scsi.c -index 266b909fe854..82e4bc8c11c5 100644 ---- a/drivers/scsi/fnic/fnic_scsi.c -+++ b/drivers/scsi/fnic/fnic_scsi.c -@@ -2533,6 +2533,19 @@ int fnic_host_reset(struct scsi_cmnd *sc) - unsigned long wait_host_tmo; - struct Scsi_Host *shost = sc->device->host; - struct fc_lport *lp = shost_priv(shost); -+ struct fnic *fnic = lport_priv(lp); -+ unsigned long flags; -+ -+ spin_lock_irqsave(&fnic->fnic_lock, flags); -+ if (fnic->internal_reset_inprogress == 0) { -+ fnic->internal_reset_inprogress = 1; -+ } else { -+ spin_unlock_irqrestore(&fnic->fnic_lock, flags); -+ FNIC_SCSI_DBG(KERN_DEBUG, fnic->lport->host, -+ "host reset in progress skipping another host reset\n"); -+ return SUCCESS; -+ } -+ spin_unlock_irqrestore(&fnic->fnic_lock, flags); - - /* - * If fnic_reset is successful, wait for fabric login to complete -@@ -2553,6 +2566,9 @@ int fnic_host_reset(struct scsi_cmnd *sc) - } - } - -+ spin_lock_irqsave(&fnic->fnic_lock, flags); -+ fnic->internal_reset_inprogress = 0; -+ spin_unlock_irqrestore(&fnic->fnic_lock, flags); - return ret; - } - -diff --git a/drivers/scsi/mpt3sas/mpt3sas_base.c b/drivers/scsi/mpt3sas/mpt3sas_base.c -index 5b2c37f1e908..9b5367294116 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_base.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_base.c -@@ -4981,15 +4981,14 @@ _base_make_ioc_ready(struct MPT3SAS_ADAPTER *ioc, int sleep_flag, - static int - _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) - { -- int r, i; -+ int r, i, index; - unsigned long flags; - u32 reply_address; - u16 smid; - struct _tr_list *delayed_tr, *delayed_tr_next; - u8 hide_flag; - struct adapter_reply_queue *reply_q; -- long reply_post_free; -- u32 reply_post_free_sz, index = 0; -+ Mpi2ReplyDescriptorsUnion_t *reply_post_free_contig; - - dinitprintk(ioc, pr_info(MPT3SAS_FMT "%s\n", ioc->name, - __func__)); -@@ -5061,27 +5060,27 @@ _base_make_ioc_operational(struct MPT3SAS_ADAPTER *ioc, int sleep_flag) - _base_assign_reply_queues(ioc); - - /* initialize Reply Post Free Queue */ -- reply_post_free_sz = ioc->reply_post_queue_depth * -- sizeof(Mpi2DefaultReplyDescriptor_t); -- reply_post_free = (long)ioc->reply_post[index].reply_post_free; -+ index = 0; -+ reply_post_free_contig = ioc->reply_post[0].reply_post_free; - list_for_each_entry(reply_q, &ioc->reply_queue_list, list) { -+ /* -+ * If RDPQ is enabled, switch to the next allocation. -+ * Otherwise advance within the contiguous region. -+ */ -+ if (ioc->rdpq_array_enable) { -+ reply_q->reply_post_free = -+ ioc->reply_post[index++].reply_post_free; -+ } else { -+ reply_q->reply_post_free = reply_post_free_contig; -+ reply_post_free_contig += ioc->reply_post_queue_depth; -+ } -+ - reply_q->reply_post_host_index = 0; -- reply_q->reply_post_free = (Mpi2ReplyDescriptorsUnion_t *) -- reply_post_free; - for (i = 0; i < ioc->reply_post_queue_depth; i++) - reply_q->reply_post_free[i].Words = - cpu_to_le64(ULLONG_MAX); - if (!_base_is_controller_msix_enabled(ioc)) - goto skip_init_reply_post_free_queue; -- /* -- * If RDPQ is enabled, switch to the next allocation. -- * Otherwise advance within the contiguous region. -- */ -- if (ioc->rdpq_array_enable) -- reply_post_free = (long) -- ioc->reply_post[++index].reply_post_free; -- else -- reply_post_free += reply_post_free_sz; - } - skip_init_reply_post_free_queue: - -diff --git a/drivers/scsi/snic/snic_main.c b/drivers/scsi/snic/snic_main.c -index 2b3c25371d76..8175f997e82c 100644 ---- a/drivers/scsi/snic/snic_main.c -+++ b/drivers/scsi/snic/snic_main.c -@@ -584,6 +584,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!pool) { - SNIC_HOST_ERR(shost, "dflt sgl pool creation failed\n"); - -+ ret = -ENOMEM; - goto err_free_res; - } - -@@ -594,6 +595,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!pool) { - SNIC_HOST_ERR(shost, "max sgl pool creation failed\n"); - -+ ret = -ENOMEM; - goto err_free_dflt_sgl_pool; - } - -@@ -604,6 +606,7 @@ snic_probe(struct pci_dev *pdev, const struct pci_device_id *ent) - if (!pool) { - SNIC_HOST_ERR(shost, "snic tmreq info pool creation failed.\n"); - -+ ret = -ENOMEM; - goto err_free_max_sgl_pool; - } - -diff --git a/drivers/spi/spi-dw.c b/drivers/spi/spi-dw.c -index 882cd6618cd5..87a0e47eeae6 100644 ---- a/drivers/spi/spi-dw.c -+++ b/drivers/spi/spi-dw.c -@@ -107,7 +107,10 @@ static const struct file_operations dw_spi_regs_ops = { - - static int dw_spi_debugfs_init(struct dw_spi *dws) - { -- dws->debugfs = debugfs_create_dir("dw_spi", NULL); -+ char name[128]; -+ -+ snprintf(name, 128, "dw_spi-%s", dev_name(&dws->master->dev)); -+ dws->debugfs = debugfs_create_dir(name, NULL); - if (!dws->debugfs) - return -ENOMEM; - -diff --git a/drivers/staging/comedi/comedi_fops.c b/drivers/staging/comedi/comedi_fops.c -index 8fed55342b0f..b831f08e2769 100644 ---- a/drivers/staging/comedi/comedi_fops.c -+++ b/drivers/staging/comedi/comedi_fops.c -@@ -2901,9 +2901,6 @@ static int __init comedi_init(void) - - comedi_class->dev_groups = comedi_dev_groups; - -- /* XXX requires /proc interface */ -- comedi_proc_init(); -- - /* create devices files for legacy/manual use */ - for (i = 0; i < comedi_num_legacy_minors; i++) { - struct comedi_device *dev; -@@ -2921,6 +2918,9 @@ static int __init comedi_init(void) - mutex_unlock(&dev->mutex); - } - -+ /* XXX requires /proc interface */ -+ comedi_proc_init(); -+ - return 0; - } - module_init(comedi_init); -diff --git a/drivers/usb/gadget/function/f_hid.c b/drivers/usb/gadget/function/f_hid.c -index 99285b416308..ee579ba2b59e 100644 ---- a/drivers/usb/gadget/function/f_hid.c -+++ b/drivers/usb/gadget/function/f_hid.c -@@ -539,7 +539,7 @@ static int hidg_set_alt(struct usb_function *f, unsigned intf, unsigned alt) - } - status = usb_ep_enable(hidg->out_ep); - if (status < 0) { -- ERROR(cdev, "Enable IN endpoint FAILED!\n"); -+ ERROR(cdev, "Enable OUT endpoint FAILED!\n"); - goto fail; - } - hidg->out_ep->driver_data = hidg; -diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c -index 830e2fd47642..b31b84f56e8f 100644 ---- a/drivers/vfio/pci/vfio_pci.c -+++ b/drivers/vfio/pci/vfio_pci.c -@@ -902,6 +902,10 @@ static int vfio_pci_mmap(void *device_data, struct vm_area_struct *vma) - return ret; - - vdev->barmap[index] = pci_iomap(pdev, index, 0); -+ if (!vdev->barmap[index]) { -+ pci_release_selected_regions(pdev, 1 << index); -+ return -ENOMEM; -+ } - } - - vma->vm_private_data = vdev; -diff --git a/drivers/vfio/pci/vfio_pci_rdwr.c b/drivers/vfio/pci/vfio_pci_rdwr.c -index 210db24d2204..4d39f7959adf 100644 ---- a/drivers/vfio/pci/vfio_pci_rdwr.c -+++ b/drivers/vfio/pci/vfio_pci_rdwr.c -@@ -190,7 +190,10 @@ ssize_t vfio_pci_vga_rw(struct vfio_pci_device *vdev, char __user *buf, - if (!vdev->has_vga) - return -EINVAL; - -- switch (pos) { -+ if (pos > 0xbfffful) -+ return -EINVAL; -+ -+ switch ((u32)pos) { - case 0xa0000 ... 0xbffff: - count = min(count, (size_t)(0xc0000 - pos)); - iomem = ioremap_nocache(0xa0000, 0xbffff - 0xa0000 + 1); -diff --git a/drivers/video/fbdev/cobalt_lcdfb.c b/drivers/video/fbdev/cobalt_lcdfb.c -index 07675d6f323e..d4530b54479c 100644 ---- a/drivers/video/fbdev/cobalt_lcdfb.c -+++ b/drivers/video/fbdev/cobalt_lcdfb.c -@@ -350,6 +350,11 @@ static int cobalt_lcdfb_probe(struct platform_device *dev) - info->screen_size = resource_size(res); - info->screen_base = devm_ioremap(&dev->dev, res->start, - info->screen_size); -+ if (!info->screen_base) { -+ framebuffer_release(info); -+ return -ENOMEM; -+ } -+ - info->fbops = &cobalt_lcd_fbops; - info->fix = cobalt_lcdfb_fix; - info->fix.smem_start = res->start; -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index a61926cb01c0..bebd6517355d 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -7521,11 +7521,18 @@ static void adjust_dio_outstanding_extents(struct inode *inode, - * within our reservation, otherwise we need to adjust our inode - * counter appropriately. - */ -- if (dio_data->outstanding_extents) { -+ if (dio_data->outstanding_extents >= num_extents) { - dio_data->outstanding_extents -= num_extents; - } else { -+ /* -+ * If dio write length has been split due to no large enough -+ * contiguous space, we need to compensate our inode counter -+ * appropriately. -+ */ -+ u64 num_needed = num_extents - dio_data->outstanding_extents; -+ - spin_lock(&BTRFS_I(inode)->lock); -- BTRFS_I(inode)->outstanding_extents += num_extents; -+ BTRFS_I(inode)->outstanding_extents += num_needed; - spin_unlock(&BTRFS_I(inode)->lock); - } - } -diff --git a/fs/dcache.c b/fs/dcache.c -index 3000cbb54949..3ed642e0a0c2 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -269,6 +269,33 @@ static inline int dname_external(const struct dentry *dentry) - return dentry->d_name.name != dentry->d_iname; - } - -+void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry) -+{ -+ spin_lock(&dentry->d_lock); -+ if (unlikely(dname_external(dentry))) { -+ struct external_name *p = external_name(dentry); -+ atomic_inc(&p->u.count); -+ spin_unlock(&dentry->d_lock); -+ name->name = p->name; -+ } else { -+ memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN); -+ spin_unlock(&dentry->d_lock); -+ name->name = name->inline_name; -+ } -+} -+EXPORT_SYMBOL(take_dentry_name_snapshot); -+ -+void release_dentry_name_snapshot(struct name_snapshot *name) -+{ -+ if (unlikely(name->name != name->inline_name)) { -+ struct external_name *p; -+ p = container_of(name->name, struct external_name, name[0]); -+ if (unlikely(atomic_dec_and_test(&p->u.count))) -+ kfree_rcu(p, u.head); -+ } -+} -+EXPORT_SYMBOL(release_dentry_name_snapshot); -+ - static inline void __d_set_inode_and_type(struct dentry *dentry, - struct inode *inode, - unsigned type_flags) -diff --git a/fs/debugfs/inode.c b/fs/debugfs/inode.c -index 0f5d05bf2131..e49ba072bd64 100644 ---- a/fs/debugfs/inode.c -+++ b/fs/debugfs/inode.c -@@ -669,7 +669,7 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, - { - int error; - struct dentry *dentry = NULL, *trap; -- const char *old_name; -+ struct name_snapshot old_name; - - trap = lock_rename(new_dir, old_dir); - /* Source or destination directories don't exist? */ -@@ -684,19 +684,19 @@ struct dentry *debugfs_rename(struct dentry *old_dir, struct dentry *old_dentry, - if (IS_ERR(dentry) || dentry == trap || d_really_is_positive(dentry)) - goto exit; - -- old_name = fsnotify_oldname_init(old_dentry->d_name.name); -+ take_dentry_name_snapshot(&old_name, old_dentry); - - error = simple_rename(d_inode(old_dir), old_dentry, d_inode(new_dir), - dentry); - if (error) { -- fsnotify_oldname_free(old_name); -+ release_dentry_name_snapshot(&old_name); - goto exit; - } - d_move(old_dentry, dentry); -- fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name, -+ fsnotify_move(d_inode(old_dir), d_inode(new_dir), old_name.name, - d_is_dir(old_dentry), - NULL, old_dentry); -- fsnotify_oldname_free(old_name); -+ release_dentry_name_snapshot(&old_name); - unlock_rename(new_dir, old_dir); - dput(dentry); - return old_dentry; -diff --git a/fs/namei.c b/fs/namei.c -index 0b0acba72a71..3f96ae087488 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -4179,11 +4179,11 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, - { - int error; - bool is_dir = d_is_dir(old_dentry); -- const unsigned char *old_name; - struct inode *source = old_dentry->d_inode; - struct inode *target = new_dentry->d_inode; - bool new_is_dir = false; - unsigned max_links = new_dir->i_sb->s_max_links; -+ struct name_snapshot old_name; - - /* - * Check source == target. -@@ -4237,7 +4237,7 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry, - if (error) - return error; - -- old_name = fsnotify_oldname_init(old_dentry->d_name.name); -+ take_dentry_name_snapshot(&old_name, old_dentry); - dget(new_dentry); - if (!is_dir || (flags & RENAME_EXCHANGE)) - lock_two_nondirectories(source, target); -@@ -4298,14 +4298,14 @@ out: - mutex_unlock(&target->i_mutex); - dput(new_dentry); - if (!error) { -- fsnotify_move(old_dir, new_dir, old_name, is_dir, -+ fsnotify_move(old_dir, new_dir, old_name.name, is_dir, - !(flags & RENAME_EXCHANGE) ? target : NULL, old_dentry); - if (flags & RENAME_EXCHANGE) { - fsnotify_move(new_dir, old_dir, old_dentry->d_name.name, - new_is_dir, NULL, new_dentry); - } - } -- fsnotify_oldname_free(old_name); -+ release_dentry_name_snapshot(&old_name); - - return error; - } -diff --git a/fs/notify/fsnotify.c b/fs/notify/fsnotify.c -index db39de2dd4cb..a64adc2fced9 100644 ---- a/fs/notify/fsnotify.c -+++ b/fs/notify/fsnotify.c -@@ -104,16 +104,20 @@ int __fsnotify_parent(struct path *path, struct dentry *dentry, __u32 mask) - if (unlikely(!fsnotify_inode_watches_children(p_inode))) - __fsnotify_update_child_dentry_flags(p_inode); - else if (p_inode->i_fsnotify_mask & mask) { -+ struct name_snapshot name; -+ - /* we are notifying a parent so come up with the new mask which - * specifies these are events which came from a child. */ - mask |= FS_EVENT_ON_CHILD; - -+ take_dentry_name_snapshot(&name, dentry); - if (path) - ret = fsnotify(p_inode, mask, path, FSNOTIFY_EVENT_PATH, -- dentry->d_name.name, 0); -+ name.name, 0); - else - ret = fsnotify(p_inode, mask, dentry->d_inode, FSNOTIFY_EVENT_INODE, -- dentry->d_name.name, 0); -+ name.name, 0); -+ release_dentry_name_snapshot(&name); - } - - dput(parent); -diff --git a/fs/pstore/ram.c b/fs/pstore/ram.c -index 905caba36529..59d93acc29c7 100644 ---- a/fs/pstore/ram.c -+++ b/fs/pstore/ram.c -@@ -413,7 +413,7 @@ static int ramoops_init_przs(struct device *dev, struct ramoops_context *cxt, - for (i = 0; i < cxt->max_dump_cnt; i++) { - cxt->przs[i] = persistent_ram_new(*paddr, cxt->record_size, 0, - &cxt->ecc_info, -- cxt->memtype); -+ cxt->memtype, 0); - if (IS_ERR(cxt->przs[i])) { - err = PTR_ERR(cxt->przs[i]); - dev_err(dev, "failed to request mem region (0x%zx@0x%llx): %d\n", -@@ -450,7 +450,8 @@ static int ramoops_init_prz(struct device *dev, struct ramoops_context *cxt, - return -ENOMEM; - } - -- *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, cxt->memtype); -+ *prz = persistent_ram_new(*paddr, sz, sig, &cxt->ecc_info, -+ cxt->memtype, 0); - if (IS_ERR(*prz)) { - int err = PTR_ERR(*prz); - -diff --git a/fs/pstore/ram_core.c b/fs/pstore/ram_core.c -index 364d2dffe5a6..27300533c2dd 100644 ---- a/fs/pstore/ram_core.c -+++ b/fs/pstore/ram_core.c -@@ -47,16 +47,15 @@ static inline size_t buffer_start(struct persistent_ram_zone *prz) - return atomic_read(&prz->buffer->start); - } - --static DEFINE_RAW_SPINLOCK(buffer_lock); -- - /* increase and wrap the start pointer, returning the old value */ - static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a) - { - int old; - int new; -- unsigned long flags; -+ unsigned long flags = 0; - -- raw_spin_lock_irqsave(&buffer_lock, flags); -+ if (!(prz->flags & PRZ_FLAG_NO_LOCK)) -+ raw_spin_lock_irqsave(&prz->buffer_lock, flags); - - old = atomic_read(&prz->buffer->start); - new = old + a; -@@ -64,7 +63,8 @@ static size_t buffer_start_add(struct persistent_ram_zone *prz, size_t a) - new -= prz->buffer_size; - atomic_set(&prz->buffer->start, new); - -- raw_spin_unlock_irqrestore(&buffer_lock, flags); -+ if (!(prz->flags & PRZ_FLAG_NO_LOCK)) -+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags); - - return old; - } -@@ -74,9 +74,10 @@ static void buffer_size_add(struct persistent_ram_zone *prz, size_t a) - { - size_t old; - size_t new; -- unsigned long flags; -+ unsigned long flags = 0; - -- raw_spin_lock_irqsave(&buffer_lock, flags); -+ if (!(prz->flags & PRZ_FLAG_NO_LOCK)) -+ raw_spin_lock_irqsave(&prz->buffer_lock, flags); - - old = atomic_read(&prz->buffer->size); - if (old == prz->buffer_size) -@@ -88,7 +89,8 @@ static void buffer_size_add(struct persistent_ram_zone *prz, size_t a) - atomic_set(&prz->buffer->size, new); - - exit: -- raw_spin_unlock_irqrestore(&buffer_lock, flags); -+ if (!(prz->flags & PRZ_FLAG_NO_LOCK)) -+ raw_spin_unlock_irqrestore(&prz->buffer_lock, flags); - } - - static void notrace persistent_ram_encode_rs8(struct persistent_ram_zone *prz, -@@ -448,6 +450,7 @@ static int persistent_ram_post_init(struct persistent_ram_zone *prz, u32 sig, - prz->buffer->sig); - } - -+ /* Rewind missing or invalid memory area. */ - prz->buffer->sig = sig; - persistent_ram_zap(prz); - -@@ -474,7 +477,7 @@ void persistent_ram_free(struct persistent_ram_zone *prz) - - struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, - u32 sig, struct persistent_ram_ecc_info *ecc_info, -- unsigned int memtype) -+ unsigned int memtype, u32 flags) - { - struct persistent_ram_zone *prz; - int ret = -ENOMEM; -@@ -485,6 +488,10 @@ struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, - goto err; - } - -+ /* Initialize general buffer state. */ -+ raw_spin_lock_init(&prz->buffer_lock); -+ prz->flags = flags; -+ - ret = persistent_ram_buffer_map(start, size, prz, memtype); - if (ret) - goto err; -diff --git a/fs/seq_file.c b/fs/seq_file.c -index d672e2fec459..6dc4296eed62 100644 ---- a/fs/seq_file.c -+++ b/fs/seq_file.c -@@ -72,9 +72,10 @@ int seq_open(struct file *file, const struct seq_operations *op) - - mutex_init(&p->lock); - p->op = op; --#ifdef CONFIG_USER_NS -- p->user_ns = file->f_cred->user_ns; --#endif -+ -+ // No refcounting: the lifetime of 'p' is constrained -+ // to the lifetime of the file. -+ p->file = file; - - /* - * Wrappers around seq_open(e.g. swaps_open) need to be -diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c -index 187b80267ff9..a9063ac50c4e 100644 ---- a/fs/xfs/xfs_aops.c -+++ b/fs/xfs/xfs_aops.c -@@ -1426,6 +1426,26 @@ __xfs_get_blocks( - if (error) - goto out_unlock; - -+ /* -+ * The only time we can ever safely find delalloc blocks on direct I/O -+ * is a dio write to post-eof speculative preallocation. All other -+ * scenarios are indicative of a problem or misuse (such as mixing -+ * direct and mapped I/O). -+ * -+ * The file may be unmapped by the time we get here so we cannot -+ * reliably fail the I/O based on mapping. Instead, fail the I/O if this -+ * is a read or a write within eof. Otherwise, carry on but warn as a -+ * precuation if the file happens to be mapped. -+ */ -+ if (direct && imap.br_startblock == DELAYSTARTBLOCK) { -+ if (!create || offset < i_size_read(VFS_I(ip))) { -+ WARN_ON_ONCE(1); -+ error = -EIO; -+ goto out_unlock; -+ } -+ WARN_ON_ONCE(mapping_mapped(VFS_I(ip)->i_mapping)); -+ } -+ - /* for DAX, we convert unwritten extents directly */ - if (create && - (!nimaps || -@@ -1525,7 +1545,6 @@ __xfs_get_blocks( - set_buffer_new(bh_result); - - if (imap.br_startblock == DELAYSTARTBLOCK) { -- BUG_ON(direct); - if (create) { - set_buffer_uptodate(bh_result); - set_buffer_mapped(bh_result); -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index 8d7151eb6ceb..d516847e0fae 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -615,5 +615,11 @@ static inline struct inode *d_real_inode(struct dentry *dentry) - return d_backing_inode(d_real(dentry)); - } - -+struct name_snapshot { -+ const char *name; -+ char inline_name[DNAME_INLINE_LEN]; -+}; -+void take_dentry_name_snapshot(struct name_snapshot *, struct dentry *); -+void release_dentry_name_snapshot(struct name_snapshot *); - - #endif /* __LINUX_DCACHE_H */ -diff --git a/include/linux/fsnotify.h b/include/linux/fsnotify.h -index 7ee1774edee5..a7789559078b 100644 ---- a/include/linux/fsnotify.h -+++ b/include/linux/fsnotify.h -@@ -310,35 +310,4 @@ static inline void fsnotify_change(struct dentry *dentry, unsigned int ia_valid) - } - } - --#if defined(CONFIG_FSNOTIFY) /* notify helpers */ -- --/* -- * fsnotify_oldname_init - save off the old filename before we change it -- */ --static inline const unsigned char *fsnotify_oldname_init(const unsigned char *name) --{ -- return kstrdup(name, GFP_KERNEL); --} -- --/* -- * fsnotify_oldname_free - free the name we got from fsnotify_oldname_init -- */ --static inline void fsnotify_oldname_free(const unsigned char *old_name) --{ -- kfree(old_name); --} -- --#else /* CONFIG_FSNOTIFY */ -- --static inline const char *fsnotify_oldname_init(const unsigned char *name) --{ -- return NULL; --} -- --static inline void fsnotify_oldname_free(const unsigned char *old_name) --{ --} -- --#endif /* CONFIG_FSNOTIFY */ -- - #endif /* _LINUX_FS_NOTIFY_H */ -diff --git a/include/linux/phy.h b/include/linux/phy.h -index 05fde31b6dc6..b64825d6ad26 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -785,6 +785,10 @@ int genphy_read_status(struct phy_device *phydev); - int genphy_suspend(struct phy_device *phydev); - int genphy_resume(struct phy_device *phydev); - int genphy_soft_reset(struct phy_device *phydev); -+static inline int genphy_no_soft_reset(struct phy_device *phydev) -+{ -+ return 0; -+} - void phy_driver_unregister(struct phy_driver *drv); - void phy_drivers_unregister(struct phy_driver *drv, int n); - int phy_driver_register(struct phy_driver *new_driver); -diff --git a/include/linux/pstore_ram.h b/include/linux/pstore_ram.h -index 9c9d6c154c8e..6f4520a82197 100644 ---- a/include/linux/pstore_ram.h -+++ b/include/linux/pstore_ram.h -@@ -23,6 +23,13 @@ - #include - #include - -+/* -+ * Choose whether access to the RAM zone requires locking or not. If a zone -+ * can be written to from different CPUs like with ftrace for example, then -+ * PRZ_FLAG_NO_LOCK is used. For all other cases, locking is required. -+ */ -+#define PRZ_FLAG_NO_LOCK BIT(0) -+ - struct persistent_ram_buffer; - struct rs_control; - -@@ -39,6 +46,8 @@ struct persistent_ram_zone { - void *vaddr; - struct persistent_ram_buffer *buffer; - size_t buffer_size; -+ u32 flags; -+ raw_spinlock_t buffer_lock; - - /* ECC correction */ - char *par_buffer; -@@ -54,7 +63,7 @@ struct persistent_ram_zone { - - struct persistent_ram_zone *persistent_ram_new(phys_addr_t start, size_t size, - u32 sig, struct persistent_ram_ecc_info *ecc_info, -- unsigned int memtype); -+ unsigned int memtype, u32 flags); - void persistent_ram_free(struct persistent_ram_zone *prz); - void persistent_ram_zap(struct persistent_ram_zone *prz); - -diff --git a/include/linux/seq_file.h b/include/linux/seq_file.h -index dde00defbaa5..f3d45dd42695 100644 ---- a/include/linux/seq_file.h -+++ b/include/linux/seq_file.h -@@ -7,13 +7,10 @@ - #include - #include - #include -+#include -+#include - - struct seq_operations; --struct file; --struct path; --struct inode; --struct dentry; --struct user_namespace; - - struct seq_file { - char *buf; -@@ -27,9 +24,7 @@ struct seq_file { - struct mutex lock; - const struct seq_operations *op; - int poll_event; --#ifdef CONFIG_USER_NS -- struct user_namespace *user_ns; --#endif -+ const struct file *file; - void *private; - }; - -@@ -147,7 +142,7 @@ int seq_release_private(struct inode *, struct file *); - static inline struct user_namespace *seq_user_ns(struct seq_file *seq) - { - #ifdef CONFIG_USER_NS -- return seq->user_ns; -+ return seq->file->f_cred->user_ns; - #else - extern struct user_namespace init_user_ns; - return &init_user_ns; -diff --git a/kernel/resource.c b/kernel/resource.c -index 249b1eb1e6e1..a4a94e700fb9 100644 ---- a/kernel/resource.c -+++ b/kernel/resource.c -@@ -105,16 +105,25 @@ static int r_show(struct seq_file *m, void *v) - { - struct resource *root = m->private; - struct resource *r = v, *p; -+ unsigned long long start, end; - int width = root->end < 0x10000 ? 4 : 8; - int depth; - - for (depth = 0, p = r; depth < MAX_IORES_LEVEL; depth++, p = p->parent) - if (p->parent == root) - break; -+ -+ if (file_ns_capable(m->file, &init_user_ns, CAP_SYS_ADMIN)) { -+ start = r->start; -+ end = r->end; -+ } else { -+ start = end = 0; -+ } -+ - seq_printf(m, "%*s%0*llx-%0*llx : %s\n", - depth * 2, "", -- width, (unsigned long long) r->start, -- width, (unsigned long long) r->end, -+ width, start, -+ width, end, - r->name ? r->name : ""); - return 0; - } -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index c436426a80dd..dece705b7f8c 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -5553,7 +5553,6 @@ migration_call(struct notifier_block *nfb, unsigned long action, void *hcpu) - - case CPU_UP_PREPARE: - rq->calc_load_update = calc_load_update; -- account_reset_rq(rq); - break; - - case CPU_ONLINE: -@@ -8253,11 +8252,20 @@ cpu_cgroup_css_alloc(struct cgroup_subsys_state *parent_css) - if (IS_ERR(tg)) - return ERR_PTR(-ENOMEM); - -- sched_online_group(tg, parent); -- - return &tg->css; - } - -+/* Expose task group only after completing cgroup initialization */ -+static int cpu_cgroup_css_online(struct cgroup_subsys_state *css) -+{ -+ struct task_group *tg = css_tg(css); -+ struct task_group *parent = css_tg(css->parent); -+ -+ if (parent) -+ sched_online_group(tg, parent); -+ return 0; -+} -+ - static void cpu_cgroup_css_released(struct cgroup_subsys_state *css) - { - struct task_group *tg = css_tg(css); -@@ -8632,6 +8640,7 @@ static struct cftype cpu_files[] = { - - struct cgroup_subsys cpu_cgrp_subsys = { - .css_alloc = cpu_cgroup_css_alloc, -+ .css_online = cpu_cgroup_css_online, - .css_released = cpu_cgroup_css_released, - .css_free = cpu_cgroup_css_free, - .fork = cpu_cgroup_fork, -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 4e5db65d1aab..55d92a1ca070 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -1770,16 +1770,3 @@ static inline u64 irq_time_read(int cpu) - } - #endif /* CONFIG_64BIT */ - #endif /* CONFIG_IRQ_TIME_ACCOUNTING */ -- --static inline void account_reset_rq(struct rq *rq) --{ --#ifdef CONFIG_IRQ_TIME_ACCOUNTING -- rq->prev_irq_time = 0; --#endif --#ifdef CONFIG_PARAVIRT -- rq->prev_steal_time = 0; --#endif --#ifdef CONFIG_PARAVIRT_TIME_ACCOUNTING -- rq->prev_steal_time_rq = 0; --#endif --} -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index e20ae2d3c498..5e4199d5a388 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -292,6 +292,10 @@ static void vlan_sync_address(struct net_device *dev, - if (ether_addr_equal(vlan->real_dev_addr, dev->dev_addr)) - return; - -+ /* vlan continues to inherit address of lower device */ -+ if (vlan_dev_inherit_address(vlandev, dev)) -+ goto out; -+ - /* vlan address was different from the old address and is equal to - * the new address */ - if (!ether_addr_equal(vlandev->dev_addr, vlan->real_dev_addr) && -@@ -304,6 +308,7 @@ static void vlan_sync_address(struct net_device *dev, - !ether_addr_equal(vlandev->dev_addr, dev->dev_addr)) - dev_uc_add(dev, vlandev->dev_addr); - -+out: - ether_addr_copy(vlan->real_dev_addr, dev->dev_addr); - } - -diff --git a/net/8021q/vlan.h b/net/8021q/vlan.h -index 9d010a09ab98..cc1557978066 100644 ---- a/net/8021q/vlan.h -+++ b/net/8021q/vlan.h -@@ -109,6 +109,8 @@ int vlan_check_real_dev(struct net_device *real_dev, - void vlan_setup(struct net_device *dev); - int register_vlan_dev(struct net_device *dev); - void unregister_vlan_dev(struct net_device *dev, struct list_head *head); -+bool vlan_dev_inherit_address(struct net_device *dev, -+ struct net_device *real_dev); - - static inline u32 vlan_get_ingress_priority(struct net_device *dev, - u16 vlan_tci) -diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c -index fded86508117..ca4dc9031073 100644 ---- a/net/8021q/vlan_dev.c -+++ b/net/8021q/vlan_dev.c -@@ -244,6 +244,17 @@ void vlan_dev_get_realdev_name(const struct net_device *dev, char *result) - strncpy(result, vlan_dev_priv(dev)->real_dev->name, 23); - } - -+bool vlan_dev_inherit_address(struct net_device *dev, -+ struct net_device *real_dev) -+{ -+ if (dev->addr_assign_type != NET_ADDR_STOLEN) -+ return false; -+ -+ ether_addr_copy(dev->dev_addr, real_dev->dev_addr); -+ call_netdevice_notifiers(NETDEV_CHANGEADDR, dev); -+ return true; -+} -+ - static int vlan_dev_open(struct net_device *dev) - { - struct vlan_dev_priv *vlan = vlan_dev_priv(dev); -@@ -254,7 +265,8 @@ static int vlan_dev_open(struct net_device *dev) - !(vlan->flags & VLAN_FLAG_LOOSE_BINDING)) - return -ENETDOWN; - -- if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr)) { -+ if (!ether_addr_equal(dev->dev_addr, real_dev->dev_addr) && -+ !vlan_dev_inherit_address(dev, real_dev)) { - err = dev_uc_add(real_dev, dev->dev_addr); - if (err < 0) - goto out; -@@ -558,8 +570,10 @@ static int vlan_dev_init(struct net_device *dev) - /* ipv6 shared card related stuff */ - dev->dev_id = real_dev->dev_id; - -- if (is_zero_ether_addr(dev->dev_addr)) -- eth_hw_addr_inherit(dev, real_dev); -+ if (is_zero_ether_addr(dev->dev_addr)) { -+ ether_addr_copy(dev->dev_addr, real_dev->dev_addr); -+ dev->addr_assign_type = NET_ADDR_STOLEN; -+ } - if (is_zero_ether_addr(dev->broadcast)) - memcpy(dev->broadcast, real_dev->broadcast, dev->addr_len); - -diff --git a/net/core/dev.c b/net/core/dev.c -index dc5d3d546150..4b0853194a03 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2550,9 +2550,10 @@ EXPORT_SYMBOL(skb_mac_gso_segment); - static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path) - { - if (tx_path) -- return skb->ip_summed != CHECKSUM_PARTIAL; -- else -- return skb->ip_summed == CHECKSUM_NONE; -+ return skb->ip_summed != CHECKSUM_PARTIAL && -+ skb->ip_summed != CHECKSUM_NONE; -+ -+ return skb->ip_summed == CHECKSUM_NONE; - } - - /** -@@ -2571,11 +2572,12 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path) - struct sk_buff *__skb_gso_segment(struct sk_buff *skb, - netdev_features_t features, bool tx_path) - { -+ struct sk_buff *segs; -+ - if (unlikely(skb_needs_check(skb, tx_path))) { - int err; - -- skb_warn_bad_offload(skb); -- -+ /* We're going to init ->check field in TCP or UDP header */ - err = skb_cow_head(skb, 0); - if (err < 0) - return ERR_PTR(err); -@@ -2590,7 +2592,12 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb, - skb_reset_mac_header(skb); - skb_reset_mac_len(skb); - -- return skb_mac_gso_segment(skb, features); -+ segs = skb_mac_gso_segment(skb, features); -+ -+ if (unlikely(skb_needs_check(skb, tx_path))) -+ skb_warn_bad_offload(skb); -+ -+ return segs; - } - EXPORT_SYMBOL(__skb_gso_segment); - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 7d339fc1057f..150b4923fb72 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1361,7 +1361,7 @@ emsgsize: - */ - - cork->length += length; -- if (((length > mtu) || -+ if ((((length + fragheaderlen) > mtu) || - (skb && skb_is_gso(skb))) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO) && -diff --git a/net/key/af_key.c b/net/key/af_key.c -index d8d95b6415e4..2e1050ec2cf0 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -63,6 +63,7 @@ struct pfkey_sock { - } u; - struct sk_buff *skb; - } dump; -+ struct mutex dump_lock; - }; - - static int parse_sockaddr_pair(struct sockaddr *sa, int ext_len, -@@ -143,6 +144,7 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol, - { - struct netns_pfkey *net_pfkey = net_generic(net, pfkey_net_id); - struct sock *sk; -+ struct pfkey_sock *pfk; - int err; - - if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) -@@ -157,6 +159,9 @@ static int pfkey_create(struct net *net, struct socket *sock, int protocol, - if (sk == NULL) - goto out; - -+ pfk = pfkey_sk(sk); -+ mutex_init(&pfk->dump_lock); -+ - sock->ops = &pfkey_ops; - sock_init_data(sock, sk); - -@@ -285,13 +290,23 @@ static int pfkey_do_dump(struct pfkey_sock *pfk) - struct sadb_msg *hdr; - int rc; - -+ mutex_lock(&pfk->dump_lock); -+ if (!pfk->dump.dump) { -+ rc = 0; -+ goto out; -+ } -+ - rc = pfk->dump.dump(pfk); -- if (rc == -ENOBUFS) -- return 0; -+ if (rc == -ENOBUFS) { -+ rc = 0; -+ goto out; -+ } - - if (pfk->dump.skb) { -- if (!pfkey_can_dump(&pfk->sk)) -- return 0; -+ if (!pfkey_can_dump(&pfk->sk)) { -+ rc = 0; -+ goto out; -+ } - - hdr = (struct sadb_msg *) pfk->dump.skb->data; - hdr->sadb_msg_seq = 0; -@@ -302,6 +317,9 @@ static int pfkey_do_dump(struct pfkey_sock *pfk) - } - - pfkey_terminate_dump(pfk); -+ -+out: -+ mutex_unlock(&pfk->dump_lock); - return rc; - } - -@@ -1806,19 +1824,26 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms - struct xfrm_address_filter *filter = NULL; - struct pfkey_sock *pfk = pfkey_sk(sk); - -- if (pfk->dump.dump != NULL) -+ mutex_lock(&pfk->dump_lock); -+ if (pfk->dump.dump != NULL) { -+ mutex_unlock(&pfk->dump_lock); - return -EBUSY; -+ } - - proto = pfkey_satype2proto(hdr->sadb_msg_satype); -- if (proto == 0) -+ if (proto == 0) { -+ mutex_unlock(&pfk->dump_lock); - return -EINVAL; -+ } - - if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { - struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; - - filter = kmalloc(sizeof(*filter), GFP_KERNEL); -- if (filter == NULL) -+ if (filter == NULL) { -+ mutex_unlock(&pfk->dump_lock); - return -ENOMEM; -+ } - - memcpy(&filter->saddr, &xfilter->sadb_x_filter_saddr, - sizeof(xfrm_address_t)); -@@ -1834,6 +1859,7 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms - pfk->dump.dump = pfkey_dump_sa; - pfk->dump.done = pfkey_dump_sa_done; - xfrm_state_walk_init(&pfk->dump.u.state, proto, filter); -+ mutex_unlock(&pfk->dump_lock); - - return pfkey_do_dump(pfk); - } -@@ -2693,14 +2719,18 @@ static int pfkey_spddump(struct sock *sk, struct sk_buff *skb, const struct sadb - { - struct pfkey_sock *pfk = pfkey_sk(sk); - -- if (pfk->dump.dump != NULL) -+ mutex_lock(&pfk->dump_lock); -+ if (pfk->dump.dump != NULL) { -+ mutex_unlock(&pfk->dump_lock); - return -EBUSY; -+ } - - pfk->dump.msg_version = hdr->sadb_msg_version; - pfk->dump.msg_portid = hdr->sadb_msg_pid; - pfk->dump.dump = pfkey_dump_sp; - pfk->dump.done = pfkey_dump_sp_done; - xfrm_policy_walk_init(&pfk->dump.u.policy, XFRM_POLICY_TYPE_MAIN); -+ mutex_unlock(&pfk->dump_lock); - - return pfkey_do_dump(pfk); - } -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 8a0fdd870395..77055a362041 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1216,7 +1216,7 @@ static inline int policy_to_flow_dir(int dir) - } - - static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir, -- const struct flowi *fl) -+ const struct flowi *fl, u16 family) - { - struct xfrm_policy *pol; - struct net *net = sock_net(sk); -@@ -1225,8 +1225,7 @@ static struct xfrm_policy *xfrm_sk_policy_lookup(const struct sock *sk, int dir, - read_lock_bh(&net->xfrm.xfrm_policy_lock); - pol = rcu_dereference(sk->sk_policy[dir]); - if (pol != NULL) { -- bool match = xfrm_selector_match(&pol->selector, fl, -- sk->sk_family); -+ bool match = xfrm_selector_match(&pol->selector, fl, family); - int err = 0; - - if (match) { -@@ -2174,7 +2173,7 @@ struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig, - sk = sk_const_to_full_sk(sk); - if (sk && sk->sk_policy[XFRM_POLICY_OUT]) { - num_pols = 1; -- pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl); -+ pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family); - err = xfrm_expand_policies(fl, family, pols, - &num_pols, &num_xfrms); - if (err < 0) -@@ -2453,7 +2452,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb, - pol = NULL; - sk = sk_to_full_sk(sk); - if (sk && sk->sk_policy[dir]) { -- pol = xfrm_sk_policy_lookup(sk, dir, &fl); -+ pol = xfrm_sk_policy_lookup(sk, dir, &fl, family); - if (IS_ERR(pol)) { - XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR); - return 0; -diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c -index c1b87c5800b1..b3fddba4c084 100644 ---- a/sound/soc/codecs/nau8825.c -+++ b/sound/soc/codecs/nau8825.c -@@ -936,7 +936,8 @@ static void nau8825_fll_apply(struct nau8825 *nau8825, - NAU8825_FLL_INTEGER_MASK, fll_param->fll_int); - /* FLL pre-scaler */ - regmap_update_bits(nau8825->regmap, NAU8825_REG_FLL4, -- NAU8825_FLL_REF_DIV_MASK, fll_param->clk_ref_div); -+ NAU8825_FLL_REF_DIV_MASK, -+ fll_param->clk_ref_div << NAU8825_FLL_REF_DIV_SFT); - /* select divided VCO input */ - regmap_update_bits(nau8825->regmap, NAU8825_REG_FLL5, - NAU8825_FLL_FILTER_SW_MASK, 0x0000); -diff --git a/sound/soc/codecs/nau8825.h b/sound/soc/codecs/nau8825.h -index dff8edb83bfd..a0b220726a63 100644 ---- a/sound/soc/codecs/nau8825.h -+++ b/sound/soc/codecs/nau8825.h -@@ -114,7 +114,8 @@ - #define NAU8825_FLL_INTEGER_MASK (0x3ff << 0) - - /* FLL4 (0x07) */ --#define NAU8825_FLL_REF_DIV_MASK (0x3 << 10) -+#define NAU8825_FLL_REF_DIV_SFT 10 -+#define NAU8825_FLL_REF_DIV_MASK (0x3 << NAU8825_FLL_REF_DIV_SFT) - - /* FLL5 (0x08) */ - #define NAU8825_FLL_FILTER_SW_MASK (0x1 << 14) -diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c -index a564759845f9..5a3f544bb3a8 100644 ---- a/sound/soc/codecs/tlv320aic3x.c -+++ b/sound/soc/codecs/tlv320aic3x.c -@@ -126,6 +126,16 @@ static const struct reg_default aic3x_reg[] = { - { 108, 0x00 }, { 109, 0x00 }, - }; - -+static bool aic3x_volatile_reg(struct device *dev, unsigned int reg) -+{ -+ switch (reg) { -+ case AIC3X_RESET: -+ return true; -+ default: -+ return false; -+ } -+} -+ - static const struct regmap_config aic3x_regmap = { - .reg_bits = 8, - .val_bits = 8, -@@ -133,6 +143,9 @@ static const struct regmap_config aic3x_regmap = { - .max_register = DAC_ICC_ADJ, - .reg_defaults = aic3x_reg, - .num_reg_defaults = ARRAY_SIZE(aic3x_reg), -+ -+ .volatile_reg = aic3x_volatile_reg, -+ - .cache_type = REGCACHE_RBTREE, - }; - -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index 65b936e251ea..a1e605bbc465 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -2073,9 +2073,11 @@ static int dpcm_fe_dai_do_trigger(struct snd_pcm_substream *substream, int cmd) - break; - case SNDRV_PCM_TRIGGER_STOP: - case SNDRV_PCM_TRIGGER_SUSPEND: -- case SNDRV_PCM_TRIGGER_PAUSE_PUSH: - fe->dpcm[stream].state = SND_SOC_DPCM_STATE_STOP; - break; -+ case SNDRV_PCM_TRIGGER_PAUSE_PUSH: -+ fe->dpcm[stream].state = SND_SOC_DPCM_STATE_PAUSED; -+ break; - } - - out: -diff --git a/sound/usb/endpoint.c b/sound/usb/endpoint.c -index be1f511e4f54..ae2981460cd8 100644 ---- a/sound/usb/endpoint.c -+++ b/sound/usb/endpoint.c -@@ -384,6 +384,9 @@ static void snd_complete_urb(struct urb *urb) - if (unlikely(atomic_read(&ep->chip->shutdown))) - goto exit_clear; - -+ if (unlikely(!test_bit(EP_FLAG_RUNNING, &ep->flags))) -+ goto exit_clear; -+ - if (usb_pipeout(ep->pipe)) { - retire_outbound_urb(ep, ctx); - /* can be stopped during retire callback */ -diff --git a/tools/lib/traceevent/plugin_sched_switch.c b/tools/lib/traceevent/plugin_sched_switch.c -index f1ce60065258..ec30c2fcbac0 100644 ---- a/tools/lib/traceevent/plugin_sched_switch.c -+++ b/tools/lib/traceevent/plugin_sched_switch.c -@@ -111,7 +111,7 @@ static int sched_switch_handler(struct trace_seq *s, - trace_seq_printf(s, "%lld ", val); - - if (pevent_get_field_val(s, event, "prev_prio", record, &val, 0) == 0) -- trace_seq_printf(s, "[%lld] ", val); -+ trace_seq_printf(s, "[%d] ", (int) val); - - if (pevent_get_field_val(s, event, "prev_state", record, &val, 0) == 0) - write_state(s, val); -@@ -129,7 +129,7 @@ static int sched_switch_handler(struct trace_seq *s, - trace_seq_printf(s, "%lld", val); - - if (pevent_get_field_val(s, event, "next_prio", record, &val, 0) == 0) -- trace_seq_printf(s, " [%lld]", val); -+ trace_seq_printf(s, " [%d]", (int) val); - - return 0; - } -diff --git a/tools/perf/Makefile.perf b/tools/perf/Makefile.perf -index 929a32ba15f5..b67e006d56cc 100644 ---- a/tools/perf/Makefile.perf -+++ b/tools/perf/Makefile.perf -@@ -563,9 +563,9 @@ install-tests: all install-gtk - $(INSTALL) -d -m 755 '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr'; \ - $(INSTALL) tests/attr/* '$(DESTDIR_SQ)$(perfexec_instdir_SQ)/tests/attr' - --install-bin: install-tools install-tests -+install-bin: install-tools install-tests install-traceevent-plugins - --install: install-bin try-install-man install-traceevent-plugins -+install: install-bin try-install-man - - install-python_ext: - $(PYTHON_WORD) util/setup.py --quiet install --root='/$(DESTDIR_SQ)' -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -index 67282a759496..eeeae0629ad3 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c -@@ -110,6 +110,7 @@ struct intel_pt_decoder { - bool have_tma; - bool have_cyc; - bool fixup_last_mtc; -+ bool have_last_ip; - uint64_t pos; - uint64_t last_ip; - uint64_t ip; -@@ -145,8 +146,6 @@ struct intel_pt_decoder { - bool have_calc_cyc_to_tsc; - int exec_mode; - unsigned int insn_bytes; -- uint64_t sign_bit; -- uint64_t sign_bits; - uint64_t period; - enum intel_pt_period_type period_type; - uint64_t tot_insn_cnt; -@@ -214,9 +213,6 @@ struct intel_pt_decoder *intel_pt_decoder_new(struct intel_pt_params *params) - decoder->data = params->data; - decoder->return_compression = params->return_compression; - -- decoder->sign_bit = (uint64_t)1 << 47; -- decoder->sign_bits = ~(((uint64_t)1 << 48) - 1); -- - decoder->period = params->period; - decoder->period_type = params->period_type; - -@@ -385,21 +381,30 @@ int intel_pt__strerror(int code, char *buf, size_t buflen) - return 0; - } - --static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder, -- const struct intel_pt_pkt *packet, -+static uint64_t intel_pt_calc_ip(const struct intel_pt_pkt *packet, - uint64_t last_ip) - { - uint64_t ip; - - switch (packet->count) { -- case 2: -+ case 1: - ip = (last_ip & (uint64_t)0xffffffffffff0000ULL) | - packet->payload; - break; -- case 4: -+ case 2: - ip = (last_ip & (uint64_t)0xffffffff00000000ULL) | - packet->payload; - break; -+ case 3: -+ ip = packet->payload; -+ /* Sign-extend 6-byte ip */ -+ if (ip & (uint64_t)0x800000000000ULL) -+ ip |= (uint64_t)0xffff000000000000ULL; -+ break; -+ case 4: -+ ip = (last_ip & (uint64_t)0xffff000000000000ULL) | -+ packet->payload; -+ break; - case 6: - ip = packet->payload; - break; -@@ -407,16 +412,13 @@ static uint64_t intel_pt_calc_ip(struct intel_pt_decoder *decoder, - return 0; - } - -- if (ip & decoder->sign_bit) -- return ip | decoder->sign_bits; -- - return ip; - } - - static inline void intel_pt_set_last_ip(struct intel_pt_decoder *decoder) - { -- decoder->last_ip = intel_pt_calc_ip(decoder, &decoder->packet, -- decoder->last_ip); -+ decoder->last_ip = intel_pt_calc_ip(&decoder->packet, decoder->last_ip); -+ decoder->have_last_ip = true; - } - - static inline void intel_pt_set_ip(struct intel_pt_decoder *decoder) -@@ -1436,7 +1438,8 @@ static int intel_pt_walk_psbend(struct intel_pt_decoder *decoder) - - case INTEL_PT_FUP: - decoder->pge = true; -- intel_pt_set_last_ip(decoder); -+ if (decoder->packet.count) -+ intel_pt_set_last_ip(decoder); - break; - - case INTEL_PT_MODE_TSX: -@@ -1640,6 +1643,8 @@ next: - break; - - case INTEL_PT_PSB: -+ decoder->last_ip = 0; -+ decoder->have_last_ip = true; - intel_pt_clear_stack(&decoder->stack); - err = intel_pt_walk_psbend(decoder); - if (err == -EAGAIN) -@@ -1718,6 +1723,13 @@ next: - } - } - -+static inline bool intel_pt_have_ip(struct intel_pt_decoder *decoder) -+{ -+ return decoder->packet.count && -+ (decoder->have_last_ip || decoder->packet.count == 3 || -+ decoder->packet.count == 6); -+} -+ - /* Walk PSB+ packets to get in sync. */ - static int intel_pt_walk_psb(struct intel_pt_decoder *decoder) - { -@@ -1739,8 +1751,7 @@ static int intel_pt_walk_psb(struct intel_pt_decoder *decoder) - - case INTEL_PT_FUP: - decoder->pge = true; -- if (decoder->last_ip || decoder->packet.count == 6 || -- decoder->packet.count == 0) { -+ if (intel_pt_have_ip(decoder)) { - uint64_t current_ip = decoder->ip; - - intel_pt_set_ip(decoder); -@@ -1832,24 +1843,17 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder) - case INTEL_PT_TIP_PGE: - case INTEL_PT_TIP: - decoder->pge = decoder->packet.type != INTEL_PT_TIP_PGD; -- if (decoder->last_ip || decoder->packet.count == 6 || -- decoder->packet.count == 0) -+ if (intel_pt_have_ip(decoder)) - intel_pt_set_ip(decoder); - if (decoder->ip) - return 0; - break; - - case INTEL_PT_FUP: -- if (decoder->overflow) { -- if (decoder->last_ip || -- decoder->packet.count == 6 || -- decoder->packet.count == 0) -- intel_pt_set_ip(decoder); -- if (decoder->ip) -- return 0; -- } -- if (decoder->packet.count) -- intel_pt_set_last_ip(decoder); -+ if (intel_pt_have_ip(decoder)) -+ intel_pt_set_ip(decoder); -+ if (decoder->ip) -+ return 0; - break; - - case INTEL_PT_MTC: -@@ -1898,6 +1902,8 @@ static int intel_pt_walk_to_ip(struct intel_pt_decoder *decoder) - break; - - case INTEL_PT_PSB: -+ decoder->last_ip = 0; -+ decoder->have_last_ip = true; - intel_pt_clear_stack(&decoder->stack); - err = intel_pt_walk_psb(decoder); - if (err) -@@ -2034,6 +2040,7 @@ static int intel_pt_sync(struct intel_pt_decoder *decoder) - - decoder->pge = false; - decoder->continuous_period = false; -+ decoder->have_last_ip = false; - decoder->last_ip = 0; - decoder->ip = 0; - intel_pt_clear_stack(&decoder->stack); -@@ -2042,6 +2049,7 @@ static int intel_pt_sync(struct intel_pt_decoder *decoder) - if (err) - return err; - -+ decoder->have_last_ip = true; - decoder->pkt_state = INTEL_PT_STATE_NO_IP; - - err = intel_pt_walk_psb(decoder); -@@ -2084,6 +2092,7 @@ const struct intel_pt_state *intel_pt_decode(struct intel_pt_decoder *decoder) - err = intel_pt_sync(decoder); - break; - case INTEL_PT_STATE_NO_IP: -+ decoder->have_last_ip = false; - decoder->last_ip = 0; - decoder->ip = 0; - /* Fall through */ -diff --git a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -index 9b2fce25162b..7528ae4f7e28 100644 ---- a/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -+++ b/tools/perf/util/intel-pt-decoder/intel-pt-pkt-decoder.c -@@ -293,36 +293,46 @@ static int intel_pt_get_ip(enum intel_pt_pkt_type type, unsigned int byte, - const unsigned char *buf, size_t len, - struct intel_pt_pkt *packet) - { -- switch (byte >> 5) { -+ int ip_len; -+ -+ packet->count = byte >> 5; -+ -+ switch (packet->count) { - case 0: -- packet->count = 0; -+ ip_len = 0; - break; - case 1: - if (len < 3) - return INTEL_PT_NEED_MORE_BYTES; -- packet->count = 2; -+ ip_len = 2; - packet->payload = le16_to_cpu(*(uint16_t *)(buf + 1)); - break; - case 2: - if (len < 5) - return INTEL_PT_NEED_MORE_BYTES; -- packet->count = 4; -+ ip_len = 4; - packet->payload = le32_to_cpu(*(uint32_t *)(buf + 1)); - break; - case 3: -- case 6: -+ case 4: - if (len < 7) - return INTEL_PT_NEED_MORE_BYTES; -- packet->count = 6; -+ ip_len = 6; - memcpy_le64(&packet->payload, buf + 1, 6); - break; -+ case 6: -+ if (len < 9) -+ return INTEL_PT_NEED_MORE_BYTES; -+ ip_len = 8; -+ packet->payload = le64_to_cpu(*(uint64_t *)(buf + 1)); -+ break; - default: - return INTEL_PT_BAD_PACKET; - } - - packet->type = type; - -- return packet->count + 1; -+ return ip_len + 1; - } - - static int intel_pt_get_mode(const unsigned char *buf, size_t len, -diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c -index 27ae382feb2d..7c97ecaeae48 100644 ---- a/tools/perf/util/symbol-elf.c -+++ b/tools/perf/util/symbol-elf.c -@@ -488,6 +488,12 @@ int sysfs__read_build_id(const char *filename, void *build_id, size_t size) - break; - } else { - int n = namesz + descsz; -+ -+ if (n > (int)sizeof(bf)) { -+ n = sizeof(bf); -+ pr_debug("%s: truncating reading of build id in sysfs file %s: n_namesz=%u, n_descsz=%u.\n", -+ __func__, filename, nhdr.n_namesz, nhdr.n_descsz); -+ } - if (read(fd, bf, n) != n) - break; - } diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.80-81.patch b/patch/kernel/mvebu64-default/03-patch-4.4.80-81.patch deleted file mode 100644 index 25d10c069580..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.80-81.patch +++ /dev/null @@ -1,2082 +0,0 @@ -diff --git a/Makefile b/Makefile -index dddd55adde24..d049e53a6960 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 80 -+SUBLEVEL = 81 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/armada-388-gp.dts b/arch/arm/boot/dts/armada-388-gp.dts -index cd316021d6ce..6c1b45c1af66 100644 ---- a/arch/arm/boot/dts/armada-388-gp.dts -+++ b/arch/arm/boot/dts/armada-388-gp.dts -@@ -89,7 +89,7 @@ - pinctrl-names = "default"; - pinctrl-0 = <&pca0_pins>; - interrupt-parent = <&gpio0>; -- interrupts = <18 IRQ_TYPE_EDGE_FALLING>; -+ interrupts = <18 IRQ_TYPE_LEVEL_LOW>; - gpio-controller; - #gpio-cells = <2>; - interrupt-controller; -@@ -101,7 +101,7 @@ - compatible = "nxp,pca9555"; - pinctrl-names = "default"; - interrupt-parent = <&gpio0>; -- interrupts = <18 IRQ_TYPE_EDGE_FALLING>; -+ interrupts = <18 IRQ_TYPE_LEVEL_LOW>; - gpio-controller; - #gpio-cells = <2>; - interrupt-controller; -diff --git a/arch/arm/include/asm/ftrace.h b/arch/arm/include/asm/ftrace.h -index bfe2a2f5a644..22b73112b75f 100644 ---- a/arch/arm/include/asm/ftrace.h -+++ b/arch/arm/include/asm/ftrace.h -@@ -54,6 +54,24 @@ static inline void *return_address(unsigned int level) - - #define ftrace_return_address(n) return_address(n) - -+#define ARCH_HAS_SYSCALL_MATCH_SYM_NAME -+ -+static inline bool arch_syscall_match_sym_name(const char *sym, -+ const char *name) -+{ -+ if (!strcmp(sym, "sys_mmap2")) -+ sym = "sys_mmap_pgoff"; -+ else if (!strcmp(sym, "sys_statfs64_wrapper")) -+ sym = "sys_statfs64"; -+ else if (!strcmp(sym, "sys_fstatfs64_wrapper")) -+ sym = "sys_fstatfs64"; -+ else if (!strcmp(sym, "sys_arm_fadvise64_64")) -+ sym = "sys_fadvise64_64"; -+ -+ /* Ignore case since sym may start with "SyS" instead of "sys" */ -+ return !strcasecmp(sym, name); -+} -+ - #endif /* ifndef __ASSEMBLY__ */ - - #endif /* _ASM_ARM_FTRACE */ -diff --git a/arch/sparc/include/asm/trap_block.h b/arch/sparc/include/asm/trap_block.h -index ec9c04de3664..ff05992dae7a 100644 ---- a/arch/sparc/include/asm/trap_block.h -+++ b/arch/sparc/include/asm/trap_block.h -@@ -54,6 +54,7 @@ extern struct trap_per_cpu trap_block[NR_CPUS]; - void init_cur_cpu_trap(struct thread_info *); - void setup_tba(void); - extern int ncpus_probed; -+extern u64 cpu_mondo_counter[NR_CPUS]; - - unsigned long real_hard_smp_processor_id(void); - -diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index 95a9fa0d2195..4511caa3b7e9 100644 ---- a/arch/sparc/kernel/smp_64.c -+++ b/arch/sparc/kernel/smp_64.c -@@ -617,22 +617,48 @@ retry: - } - } - --/* Multi-cpu list version. */ -+#define CPU_MONDO_COUNTER(cpuid) (cpu_mondo_counter[cpuid]) -+#define MONDO_USEC_WAIT_MIN 2 -+#define MONDO_USEC_WAIT_MAX 100 -+#define MONDO_RETRY_LIMIT 500000 -+ -+/* Multi-cpu list version. -+ * -+ * Deliver xcalls to 'cnt' number of cpus in 'cpu_list'. -+ * Sometimes not all cpus receive the mondo, requiring us to re-send -+ * the mondo until all cpus have received, or cpus are truly stuck -+ * unable to receive mondo, and we timeout. -+ * Occasionally a target cpu strand is borrowed briefly by hypervisor to -+ * perform guest service, such as PCIe error handling. Consider the -+ * service time, 1 second overall wait is reasonable for 1 cpu. -+ * Here two in-between mondo check wait time are defined: 2 usec for -+ * single cpu quick turn around and up to 100usec for large cpu count. -+ * Deliver mondo to large number of cpus could take longer, we adjusts -+ * the retry count as long as target cpus are making forward progress. -+ */ - static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt) - { -- int retries, this_cpu, prev_sent, i, saw_cpu_error; -+ int this_cpu, tot_cpus, prev_sent, i, rem; -+ int usec_wait, retries, tot_retries; -+ u16 first_cpu = 0xffff; -+ unsigned long xc_rcvd = 0; - unsigned long status; -+ int ecpuerror_id = 0; -+ int enocpu_id = 0; - u16 *cpu_list; -+ u16 cpu; - - this_cpu = smp_processor_id(); -- - cpu_list = __va(tb->cpu_list_pa); -- -- saw_cpu_error = 0; -- retries = 0; -+ usec_wait = cnt * MONDO_USEC_WAIT_MIN; -+ if (usec_wait > MONDO_USEC_WAIT_MAX) -+ usec_wait = MONDO_USEC_WAIT_MAX; -+ retries = tot_retries = 0; -+ tot_cpus = cnt; - prev_sent = 0; -+ - do { -- int forward_progress, n_sent; -+ int n_sent, mondo_delivered, target_cpu_busy; - - status = sun4v_cpu_mondo_send(cnt, - tb->cpu_list_pa, -@@ -640,94 +666,113 @@ static void hypervisor_xcall_deliver(struct trap_per_cpu *tb, int cnt) - - /* HV_EOK means all cpus received the xcall, we're done. */ - if (likely(status == HV_EOK)) -- break; -+ goto xcall_done; -+ -+ /* If not these non-fatal errors, panic */ -+ if (unlikely((status != HV_EWOULDBLOCK) && -+ (status != HV_ECPUERROR) && -+ (status != HV_ENOCPU))) -+ goto fatal_errors; - - /* First, see if we made any forward progress. -+ * -+ * Go through the cpu_list, count the target cpus that have -+ * received our mondo (n_sent), and those that did not (rem). -+ * Re-pack cpu_list with the cpus remain to be retried in the -+ * front - this simplifies tracking the truly stalled cpus. - * - * The hypervisor indicates successful sends by setting - * cpu list entries to the value 0xffff. -+ * -+ * EWOULDBLOCK means some target cpus did not receive the -+ * mondo and retry usually helps. -+ * -+ * ECPUERROR means at least one target cpu is in error state, -+ * it's usually safe to skip the faulty cpu and retry. -+ * -+ * ENOCPU means one of the target cpu doesn't belong to the -+ * domain, perhaps offlined which is unexpected, but not -+ * fatal and it's okay to skip the offlined cpu. - */ -+ rem = 0; - n_sent = 0; - for (i = 0; i < cnt; i++) { -- if (likely(cpu_list[i] == 0xffff)) -+ cpu = cpu_list[i]; -+ if (likely(cpu == 0xffff)) { - n_sent++; -+ } else if ((status == HV_ECPUERROR) && -+ (sun4v_cpu_state(cpu) == HV_CPU_STATE_ERROR)) { -+ ecpuerror_id = cpu + 1; -+ } else if (status == HV_ENOCPU && !cpu_online(cpu)) { -+ enocpu_id = cpu + 1; -+ } else { -+ cpu_list[rem++] = cpu; -+ } - } - -- forward_progress = 0; -- if (n_sent > prev_sent) -- forward_progress = 1; -+ /* No cpu remained, we're done. */ -+ if (rem == 0) -+ break; - -- prev_sent = n_sent; -+ /* Otherwise, update the cpu count for retry. */ -+ cnt = rem; - -- /* If we get a HV_ECPUERROR, then one or more of the cpus -- * in the list are in error state. Use the cpu_state() -- * hypervisor call to find out which cpus are in error state. -+ /* Record the overall number of mondos received by the -+ * first of the remaining cpus. - */ -- if (unlikely(status == HV_ECPUERROR)) { -- for (i = 0; i < cnt; i++) { -- long err; -- u16 cpu; -+ if (first_cpu != cpu_list[0]) { -+ first_cpu = cpu_list[0]; -+ xc_rcvd = CPU_MONDO_COUNTER(first_cpu); -+ } - -- cpu = cpu_list[i]; -- if (cpu == 0xffff) -- continue; -+ /* Was any mondo delivered successfully? */ -+ mondo_delivered = (n_sent > prev_sent); -+ prev_sent = n_sent; - -- err = sun4v_cpu_state(cpu); -- if (err == HV_CPU_STATE_ERROR) { -- saw_cpu_error = (cpu + 1); -- cpu_list[i] = 0xffff; -- } -- } -- } else if (unlikely(status != HV_EWOULDBLOCK)) -- goto fatal_mondo_error; -+ /* or, was any target cpu busy processing other mondos? */ -+ target_cpu_busy = (xc_rcvd < CPU_MONDO_COUNTER(first_cpu)); -+ xc_rcvd = CPU_MONDO_COUNTER(first_cpu); - -- /* Don't bother rewriting the CPU list, just leave the -- * 0xffff and non-0xffff entries in there and the -- * hypervisor will do the right thing. -- * -- * Only advance timeout state if we didn't make any -- * forward progress. -+ /* Retry count is for no progress. If we're making progress, -+ * reset the retry count. - */ -- if (unlikely(!forward_progress)) { -- if (unlikely(++retries > 10000)) -- goto fatal_mondo_timeout; -- -- /* Delay a little bit to let other cpus catch up -- * on their cpu mondo queue work. -- */ -- udelay(2 * cnt); -+ if (likely(mondo_delivered || target_cpu_busy)) { -+ tot_retries += retries; -+ retries = 0; -+ } else if (unlikely(retries > MONDO_RETRY_LIMIT)) { -+ goto fatal_mondo_timeout; - } -- } while (1); - -- if (unlikely(saw_cpu_error)) -- goto fatal_mondo_cpu_error; -+ /* Delay a little bit to let other cpus catch up on -+ * their cpu mondo queue work. -+ */ -+ if (!mondo_delivered) -+ udelay(usec_wait); - -- return; -+ retries++; -+ } while (1); - --fatal_mondo_cpu_error: -- printk(KERN_CRIT "CPU[%d]: SUN4V mondo cpu error, some target cpus " -- "(including %d) were in error state\n", -- this_cpu, saw_cpu_error - 1); -+xcall_done: -+ if (unlikely(ecpuerror_id > 0)) { -+ pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) was in error state\n", -+ this_cpu, ecpuerror_id - 1); -+ } else if (unlikely(enocpu_id > 0)) { -+ pr_crit("CPU[%d]: SUN4V mondo cpu error, target cpu(%d) does not belong to the domain\n", -+ this_cpu, enocpu_id - 1); -+ } - return; - -+fatal_errors: -+ /* fatal errors include bad alignment, etc */ -+ pr_crit("CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) mondo_block_pa(%lx)\n", -+ this_cpu, tot_cpus, tb->cpu_list_pa, tb->cpu_mondo_block_pa); -+ panic("Unexpected SUN4V mondo error %lu\n", status); -+ - fatal_mondo_timeout: -- printk(KERN_CRIT "CPU[%d]: SUN4V mondo timeout, no forward " -- " progress after %d retries.\n", -- this_cpu, retries); -- goto dump_cpu_list_and_out; -- --fatal_mondo_error: -- printk(KERN_CRIT "CPU[%d]: Unexpected SUN4V mondo error %lu\n", -- this_cpu, status); -- printk(KERN_CRIT "CPU[%d]: Args were cnt(%d) cpulist_pa(%lx) " -- "mondo_block_pa(%lx)\n", -- this_cpu, cnt, tb->cpu_list_pa, tb->cpu_mondo_block_pa); -- --dump_cpu_list_and_out: -- printk(KERN_CRIT "CPU[%d]: CPU list [ ", this_cpu); -- for (i = 0; i < cnt; i++) -- printk("%u ", cpu_list[i]); -- printk("]\n"); -+ /* some cpus being non-responsive to the cpu mondo */ -+ pr_crit("CPU[%d]: SUN4V mondo timeout, cpu(%d) made no forward progress after %d retries. Total target cpus(%d).\n", -+ this_cpu, first_cpu, (tot_retries + retries), tot_cpus); -+ panic("SUN4V mondo timeout panic\n"); - } - - static void (*xcall_deliver_impl)(struct trap_per_cpu *, int); -diff --git a/arch/sparc/kernel/sun4v_ivec.S b/arch/sparc/kernel/sun4v_ivec.S -index 559bc5e9c199..34631995859a 100644 ---- a/arch/sparc/kernel/sun4v_ivec.S -+++ b/arch/sparc/kernel/sun4v_ivec.S -@@ -26,6 +26,21 @@ sun4v_cpu_mondo: - ldxa [%g0] ASI_SCRATCHPAD, %g4 - sub %g4, TRAP_PER_CPU_FAULT_INFO, %g4 - -+ /* Get smp_processor_id() into %g3 */ -+ sethi %hi(trap_block), %g5 -+ or %g5, %lo(trap_block), %g5 -+ sub %g4, %g5, %g3 -+ srlx %g3, TRAP_BLOCK_SZ_SHIFT, %g3 -+ -+ /* Increment cpu_mondo_counter[smp_processor_id()] */ -+ sethi %hi(cpu_mondo_counter), %g5 -+ or %g5, %lo(cpu_mondo_counter), %g5 -+ sllx %g3, 3, %g3 -+ add %g5, %g3, %g5 -+ ldx [%g5], %g3 -+ add %g3, 1, %g3 -+ stx %g3, [%g5] -+ - /* Get CPU mondo queue base phys address into %g7. */ - ldx [%g4 + TRAP_PER_CPU_CPU_MONDO_PA], %g7 - -diff --git a/arch/sparc/kernel/traps_64.c b/arch/sparc/kernel/traps_64.c -index cc97a43268ee..d883c5951e8b 100644 ---- a/arch/sparc/kernel/traps_64.c -+++ b/arch/sparc/kernel/traps_64.c -@@ -2659,6 +2659,7 @@ void do_getpsr(struct pt_regs *regs) - } - } - -+u64 cpu_mondo_counter[NR_CPUS] = {0}; - struct trap_per_cpu trap_block[NR_CPUS]; - EXPORT_SYMBOL(trap_block); - -diff --git a/arch/x86/boot/string.c b/arch/x86/boot/string.c -index 318b8465d302..06ceddb3a22e 100644 ---- a/arch/x86/boot/string.c -+++ b/arch/x86/boot/string.c -@@ -14,6 +14,7 @@ - - #include - #include "ctype.h" -+#include "string.h" - - int memcmp(const void *s1, const void *s2, size_t len) - { -diff --git a/arch/x86/boot/string.h b/arch/x86/boot/string.h -index 725e820602b1..113588ddb43f 100644 ---- a/arch/x86/boot/string.h -+++ b/arch/x86/boot/string.h -@@ -18,4 +18,13 @@ int memcmp(const void *s1, const void *s2, size_t len); - #define memset(d,c,l) __builtin_memset(d,c,l) - #define memcmp __builtin_memcmp - -+extern int strcmp(const char *str1, const char *str2); -+extern int strncmp(const char *cs, const char *ct, size_t count); -+extern size_t strlen(const char *s); -+extern char *strstr(const char *s1, const char *s2); -+extern size_t strnlen(const char *s, size_t maxlen); -+extern unsigned int atou(const char *s); -+extern unsigned long long simple_strtoull(const char *cp, char **endp, -+ unsigned int base); -+ - #endif /* BOOT_STRING_H */ -diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c -index cec49ecf5f31..32187f8a49b4 100644 ---- a/arch/x86/kernel/kvm.c -+++ b/arch/x86/kernel/kvm.c -@@ -151,6 +151,8 @@ void kvm_async_pf_task_wait(u32 token) - if (hlist_unhashed(&n.link)) - break; - -+ rcu_irq_exit(); -+ - if (!n.halted) { - local_irq_enable(); - schedule(); -@@ -159,11 +161,11 @@ void kvm_async_pf_task_wait(u32 token) - /* - * We cannot reschedule. So halt. - */ -- rcu_irq_exit(); - native_safe_halt(); - local_irq_disable(); -- rcu_irq_enter(); - } -+ -+ rcu_irq_enter(); - } - if (!n.halted) - finish_wait(&n.wq, &wait); -diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c -index e417e1a1d02c..5b2aee83d776 100644 ---- a/drivers/ata/libata-scsi.c -+++ b/drivers/ata/libata-scsi.c -@@ -2832,10 +2832,12 @@ static unsigned int atapi_xlat(struct ata_queued_cmd *qc) - static struct ata_device *ata_find_dev(struct ata_port *ap, int devno) - { - if (!sata_pmp_attached(ap)) { -- if (likely(devno < ata_link_max_devices(&ap->link))) -+ if (likely(devno >= 0 && -+ devno < ata_link_max_devices(&ap->link))) - return &ap->link.device[devno]; - } else { -- if (likely(devno < ap->nr_pmp_links)) -+ if (likely(devno >= 0 && -+ devno < ap->nr_pmp_links)) - return &ap->pmp_link[devno].device[0]; - } - -diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c -index 6ca35495a5be..1e5cd39d0cc2 100644 ---- a/drivers/block/virtio_blk.c -+++ b/drivers/block/virtio_blk.c -@@ -641,11 +641,12 @@ static int virtblk_probe(struct virtio_device *vdev) - if (err) - goto out_put_disk; - -- q = vblk->disk->queue = blk_mq_init_queue(&vblk->tag_set); -+ q = blk_mq_init_queue(&vblk->tag_set); - if (IS_ERR(q)) { - err = -ENOMEM; - goto out_free_tags; - } -+ vblk->disk->queue = q; - - q->queuedata = vblk; - -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_drv.c b/drivers/gpu/drm/rcar-du/rcar_du_drv.c -index bf4674aa6405..bb9cd35d7fdf 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_drv.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_drv.c -@@ -296,7 +296,7 @@ static int rcar_du_probe(struct platform_device *pdev) - mem = platform_get_resource(pdev, IORESOURCE_MEM, 0); - rcdu->mmio = devm_ioremap_resource(&pdev->dev, mem); - if (IS_ERR(rcdu->mmio)) -- ret = PTR_ERR(rcdu->mmio); -+ return PTR_ERR(rcdu->mmio); - - /* DRM/KMS objects */ - ddev = drm_dev_alloc(&rcar_du_driver, &pdev->dev); -diff --git a/drivers/gpu/drm/virtio/virtgpu_fb.c b/drivers/gpu/drm/virtio/virtgpu_fb.c -index 6a81e084593b..2b59d80a09b8 100644 ---- a/drivers/gpu/drm/virtio/virtgpu_fb.c -+++ b/drivers/gpu/drm/virtio/virtgpu_fb.c -@@ -338,7 +338,7 @@ static int virtio_gpufb_create(struct drm_fb_helper *helper, - info->fbops = &virtio_gpufb_ops; - info->pixmap.flags = FB_PIXMAP_SYSTEM; - -- info->screen_base = obj->vmap; -+ info->screen_buffer = obj->vmap; - info->screen_size = obj->gem_base.size; - drm_fb_helper_fill_fix(info, fb->pitches[0], fb->depth); - drm_fb_helper_fill_var(info, &vfbdev->helper, -diff --git a/drivers/infiniband/ulp/isert/ib_isert.c b/drivers/infiniband/ulp/isert/ib_isert.c -index b0edb66a291b..0b7f5a701c60 100644 ---- a/drivers/infiniband/ulp/isert/ib_isert.c -+++ b/drivers/infiniband/ulp/isert/ib_isert.c -@@ -1581,7 +1581,7 @@ isert_rcv_completion(struct iser_rx_desc *desc, - struct isert_conn *isert_conn, - u32 xfer_len) - { -- struct ib_device *ib_dev = isert_conn->cm_id->device; -+ struct ib_device *ib_dev = isert_conn->device->ib_device; - struct iscsi_hdr *hdr; - u64 rx_dma; - int rx_buflen; -diff --git a/drivers/media/pci/saa7164/saa7164-bus.c b/drivers/media/pci/saa7164/saa7164-bus.c -index a18fe5d47238..b4857cd7069e 100644 ---- a/drivers/media/pci/saa7164/saa7164-bus.c -+++ b/drivers/media/pci/saa7164/saa7164-bus.c -@@ -393,11 +393,11 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg, - msg_tmp.size = le16_to_cpu((__force __le16)msg_tmp.size); - msg_tmp.command = le32_to_cpu((__force __le32)msg_tmp.command); - msg_tmp.controlselector = le16_to_cpu((__force __le16)msg_tmp.controlselector); -+ memcpy(msg, &msg_tmp, sizeof(*msg)); - - /* No need to update the read positions, because this was a peek */ - /* If the caller specifically want to peek, return */ - if (peekonly) { -- memcpy(msg, &msg_tmp, sizeof(*msg)); - goto peekout; - } - -@@ -442,21 +442,15 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg, - space_rem = bus->m_dwSizeGetRing - curr_grp; - - if (space_rem < sizeof(*msg)) { -- /* msg wraps around the ring */ -- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, space_rem); -- memcpy_fromio((u8 *)msg + space_rem, bus->m_pdwGetRing, -- sizeof(*msg) - space_rem); - if (buf) - memcpy_fromio(buf, bus->m_pdwGetRing + sizeof(*msg) - - space_rem, buf_size); - - } else if (space_rem == sizeof(*msg)) { -- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg)); - if (buf) - memcpy_fromio(buf, bus->m_pdwGetRing, buf_size); - } else { - /* Additional data wraps around the ring */ -- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg)); - if (buf) { - memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + - sizeof(*msg), space_rem - sizeof(*msg)); -@@ -469,15 +463,10 @@ int saa7164_bus_get(struct saa7164_dev *dev, struct tmComResInfo* msg, - - } else { - /* No wrapping */ -- memcpy_fromio(msg, bus->m_pdwGetRing + curr_grp, sizeof(*msg)); - if (buf) - memcpy_fromio(buf, bus->m_pdwGetRing + curr_grp + sizeof(*msg), - buf_size); - } -- /* Convert from little endian to CPU */ -- msg->size = le16_to_cpu((__force __le16)msg->size); -- msg->command = le32_to_cpu((__force __le32)msg->command); -- msg->controlselector = le16_to_cpu((__force __le16)msg->controlselector); - - /* Update the read positions, adjusting the ring */ - saa7164_writel(bus->m_dwGetReadPos, new_grp); -diff --git a/drivers/media/platform/davinci/vpfe_capture.c b/drivers/media/platform/davinci/vpfe_capture.c -index 7767e072d623..1f656a3a84b9 100644 ---- a/drivers/media/platform/davinci/vpfe_capture.c -+++ b/drivers/media/platform/davinci/vpfe_capture.c -@@ -1709,27 +1709,9 @@ static long vpfe_param_handler(struct file *file, void *priv, - - switch (cmd) { - case VPFE_CMD_S_CCDC_RAW_PARAMS: -+ ret = -EINVAL; - v4l2_warn(&vpfe_dev->v4l2_dev, -- "VPFE_CMD_S_CCDC_RAW_PARAMS: experimental ioctl\n"); -- if (ccdc_dev->hw_ops.set_params) { -- ret = ccdc_dev->hw_ops.set_params(param); -- if (ret) { -- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, -- "Error setting parameters in CCDC\n"); -- goto unlock_out; -- } -- ret = vpfe_get_ccdc_image_format(vpfe_dev, -- &vpfe_dev->fmt); -- if (ret < 0) { -- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, -- "Invalid image format at CCDC\n"); -- goto unlock_out; -- } -- } else { -- ret = -EINVAL; -- v4l2_dbg(1, debug, &vpfe_dev->v4l2_dev, -- "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n"); -- } -+ "VPFE_CMD_S_CCDC_RAW_PARAMS not supported\n"); - break; - default: - ret = -ENOTTY; -diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c -index a32659fcd266..efc21b1da211 100644 ---- a/drivers/media/rc/ir-lirc-codec.c -+++ b/drivers/media/rc/ir-lirc-codec.c -@@ -254,7 +254,7 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd, - return 0; - - case LIRC_GET_REC_RESOLUTION: -- val = dev->rx_resolution; -+ val = dev->rx_resolution / 1000; - break; - - case LIRC_SET_WIDEBAND_RECEIVER: -diff --git a/drivers/net/ethernet/aurora/nb8800.c b/drivers/net/ethernet/aurora/nb8800.c -index ecc4a334c507..0a54e7dac0ab 100644 ---- a/drivers/net/ethernet/aurora/nb8800.c -+++ b/drivers/net/ethernet/aurora/nb8800.c -@@ -608,7 +608,7 @@ static void nb8800_mac_config(struct net_device *dev) - mac_mode |= HALF_DUPLEX; - - if (gigabit) { -- if (priv->phy_mode == PHY_INTERFACE_MODE_RGMII) -+ if (phy_interface_is_rgmii(dev->phydev)) - mac_mode |= RGMII_MODE; - - mac_mode |= GMAC_MODE; -@@ -1295,11 +1295,10 @@ static int nb8800_tangox_init(struct net_device *dev) - break; - - case PHY_INTERFACE_MODE_RGMII: -- pad_mode = PAD_MODE_RGMII; -- break; -- -+ case PHY_INTERFACE_MODE_RGMII_ID: -+ case PHY_INTERFACE_MODE_RGMII_RXID: - case PHY_INTERFACE_MODE_RGMII_TXID: -- pad_mode = PAD_MODE_RGMII | PAD_MODE_GTX_CLK_DELAY; -+ pad_mode = PAD_MODE_RGMII; - break; - - default: -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 21e5b9ed1ead..3613469dc5c6 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -8722,11 +8722,14 @@ static void tg3_free_consistent(struct tg3 *tp) - tg3_mem_rx_release(tp); - tg3_mem_tx_release(tp); - -+ /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ -+ tg3_full_lock(tp, 0); - if (tp->hw_stats) { - dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), - tp->hw_stats, tp->stats_mapping); - tp->hw_stats = NULL; - } -+ tg3_full_unlock(tp); - } - - /* -diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -index cc199063612a..6c66d2979795 100644 ---- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c -@@ -630,6 +630,10 @@ static void dump_command(struct mlx5_core_dev *dev, - pr_debug("\n"); - } - -+static void free_msg(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *msg); -+static void mlx5_free_cmd_msg(struct mlx5_core_dev *dev, -+ struct mlx5_cmd_msg *msg); -+ - static void cmd_work_handler(struct work_struct *work) - { - struct mlx5_cmd_work_ent *ent = container_of(work, struct mlx5_cmd_work_ent, work); -@@ -638,16 +642,27 @@ static void cmd_work_handler(struct work_struct *work) - struct mlx5_cmd_layout *lay; - struct semaphore *sem; - unsigned long flags; -+ int alloc_ret; - - sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem; - down(sem); - if (!ent->page_queue) { -- ent->idx = alloc_ent(cmd); -- if (ent->idx < 0) { -+ alloc_ret = alloc_ent(cmd); -+ if (alloc_ret < 0) { -+ if (ent->callback) { -+ ent->callback(-EAGAIN, ent->context); -+ mlx5_free_cmd_msg(dev, ent->out); -+ free_msg(dev, ent->in); -+ free_cmd(ent); -+ } else { -+ ent->ret = -EAGAIN; -+ complete(&ent->done); -+ } - mlx5_core_err(dev, "failed to allocate command entry\n"); - up(sem); - return; - } -+ ent->idx = alloc_ret; - } else { - ent->idx = cmd->max_reg_cmds; - spin_lock_irqsave(&cmd->alloc_lock, flags); -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 4296066a7ad3..479af106aaeb 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -819,6 +819,7 @@ static struct sh_eth_cpu_data r8a7740_data = { - .rpadir_value = 2 << 16, - .no_trimd = 1, - .no_ade = 1, -+ .hw_crc = 1, - .tsu = 1, - .select_mii = 1, - .shift_rd0 = 1, -diff --git a/drivers/net/irda/mcs7780.c b/drivers/net/irda/mcs7780.c -index bca6a1e72d1d..e1bb802d4a4d 100644 ---- a/drivers/net/irda/mcs7780.c -+++ b/drivers/net/irda/mcs7780.c -@@ -141,9 +141,19 @@ static int mcs_set_reg(struct mcs_cb *mcs, __u16 reg, __u16 val) - static int mcs_get_reg(struct mcs_cb *mcs, __u16 reg, __u16 * val) - { - struct usb_device *dev = mcs->usbdev; -- int ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, -- MCS_RD_RTYPE, 0, reg, val, 2, -- msecs_to_jiffies(MCS_CTRL_TIMEOUT)); -+ void *dmabuf; -+ int ret; -+ -+ dmabuf = kmalloc(sizeof(__u16), GFP_KERNEL); -+ if (!dmabuf) -+ return -ENOMEM; -+ -+ ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, -+ MCS_RD_RTYPE, 0, reg, dmabuf, 2, -+ msecs_to_jiffies(MCS_CTRL_TIMEOUT)); -+ -+ memcpy(val, dmabuf, sizeof(__u16)); -+ kfree(dmabuf); - - return ret; - } -diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c -index 32f10662f4ac..7242dd4b3238 100644 ---- a/drivers/net/phy/dp83867.c -+++ b/drivers/net/phy/dp83867.c -@@ -29,6 +29,7 @@ - #define MII_DP83867_MICR 0x12 - #define MII_DP83867_ISR 0x13 - #define DP83867_CTRL 0x1f -+#define DP83867_CFG3 0x1e - - /* Extended Registers */ - #define DP83867_RGMIICTL 0x0032 -@@ -89,6 +90,8 @@ static int dp83867_config_intr(struct phy_device *phydev) - micr_status |= - (MII_DP83867_MICR_AN_ERR_INT_EN | - MII_DP83867_MICR_SPEED_CHNG_INT_EN | -+ MII_DP83867_MICR_AUTONEG_COMP_INT_EN | -+ MII_DP83867_MICR_LINK_STS_CHNG_INT_EN | - MII_DP83867_MICR_DUP_MODE_CHNG_INT_EN | - MII_DP83867_MICR_SLEEP_MODE_CHNG_INT_EN); - -@@ -184,6 +187,13 @@ static int dp83867_config_init(struct phy_device *phydev) - DP83867_DEVADDR, phydev->addr, delay); - } - -+ /* Enable Interrupt output INT_OE in CFG3 register */ -+ if (phy_interrupt_is_valid(phydev)) { -+ val = phy_read(phydev, DP83867_CFG3); -+ val |= BIT(7); -+ phy_write(phydev, DP83867_CFG3, val); -+ } -+ - return 0; - } - -diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c -index 1d1e5f7723ab..8179727d3423 100644 ---- a/drivers/net/phy/phy_device.c -+++ b/drivers/net/phy/phy_device.c -@@ -1368,6 +1368,8 @@ static int phy_remove(struct device *dev) - { - struct phy_device *phydev = to_phy_device(dev); - -+ cancel_delayed_work_sync(&phydev->state_queue); -+ - mutex_lock(&phydev->lock); - phydev->state = PHY_DOWN; - mutex_unlock(&phydev->lock); -diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h -index 0333ab0fd926..34173b5e886f 100644 ---- a/drivers/net/xen-netback/common.h -+++ b/drivers/net/xen-netback/common.h -@@ -201,6 +201,7 @@ struct xenvif_queue { /* Per-queue data for xenvif */ - unsigned long remaining_credit; - struct timer_list credit_timeout; - u64 credit_window_start; -+ bool rate_limited; - - /* Statistics */ - struct xenvif_stats stats; -diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c -index e7bd63eb2876..60b26f32d31d 100644 ---- a/drivers/net/xen-netback/interface.c -+++ b/drivers/net/xen-netback/interface.c -@@ -105,7 +105,11 @@ static int xenvif_poll(struct napi_struct *napi, int budget) - - if (work_done < budget) { - napi_complete(napi); -- xenvif_napi_schedule_or_enable_events(queue); -+ /* If the queue is rate-limited, it shall be -+ * rescheduled in the timer callback. -+ */ -+ if (likely(!queue->rate_limited)) -+ xenvif_napi_schedule_or_enable_events(queue); - } - - return work_done; -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 1049c34e7d43..72ee1c305cc4 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -687,6 +687,7 @@ static void tx_add_credit(struct xenvif_queue *queue) - max_credit = ULONG_MAX; /* wrapped: clamp to ULONG_MAX */ - - queue->remaining_credit = min(max_credit, max_burst); -+ queue->rate_limited = false; - } - - void xenvif_tx_credit_callback(unsigned long data) -@@ -1184,8 +1185,10 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size) - msecs_to_jiffies(queue->credit_usec / 1000); - - /* Timer could already be pending in rare cases. */ -- if (timer_pending(&queue->credit_timeout)) -+ if (timer_pending(&queue->credit_timeout)) { -+ queue->rate_limited = true; - return true; -+ } - - /* Passed the point where we can replenish credit? */ - if (time_after_eq64(now, next_credit)) { -@@ -1200,6 +1203,7 @@ static bool tx_credit_exceeded(struct xenvif_queue *queue, unsigned size) - mod_timer(&queue->credit_timeout, - next_credit); - queue->credit_window_start = next_credit; -+ queue->rate_limited = true; - - return true; - } -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 6b942d9e5b74..1ed85dfc008d 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -329,12 +329,15 @@ qla2x00_sysfs_read_optrom(struct file *filp, struct kobject *kobj, - struct qla_hw_data *ha = vha->hw; - ssize_t rval = 0; - -+ mutex_lock(&ha->optrom_mutex); -+ - if (ha->optrom_state != QLA_SREADING) -- return 0; -+ goto out; - -- mutex_lock(&ha->optrom_mutex); - rval = memory_read_from_buffer(buf, count, &off, ha->optrom_buffer, - ha->optrom_region_size); -+ -+out: - mutex_unlock(&ha->optrom_mutex); - - return rval; -@@ -349,14 +352,19 @@ qla2x00_sysfs_write_optrom(struct file *filp, struct kobject *kobj, - struct device, kobj))); - struct qla_hw_data *ha = vha->hw; - -- if (ha->optrom_state != QLA_SWRITING) -+ mutex_lock(&ha->optrom_mutex); -+ -+ if (ha->optrom_state != QLA_SWRITING) { -+ mutex_unlock(&ha->optrom_mutex); - return -EINVAL; -- if (off > ha->optrom_region_size) -+ } -+ if (off > ha->optrom_region_size) { -+ mutex_unlock(&ha->optrom_mutex); - return -ERANGE; -+ } - if (off + count > ha->optrom_region_size) - count = ha->optrom_region_size - off; - -- mutex_lock(&ha->optrom_mutex); - memcpy(&ha->optrom_buffer[off], buf, count); - mutex_unlock(&ha->optrom_mutex); - -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index a180c000e246..31d5d9c0e10b 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -3965,6 +3965,8 @@ int iscsi_target_tx_thread(void *arg) - { - int ret = 0; - struct iscsi_conn *conn = arg; -+ bool conn_freed = false; -+ - /* - * Allow ourselves to be interrupted by SIGINT so that a - * connection recovery / failure event can be triggered externally. -@@ -3990,12 +3992,14 @@ get_immediate: - goto transport_err; - - ret = iscsit_handle_response_queue(conn); -- if (ret == 1) -+ if (ret == 1) { - goto get_immediate; -- else if (ret == -ECONNRESET) -+ } else if (ret == -ECONNRESET) { -+ conn_freed = true; - goto out; -- else if (ret < 0) -+ } else if (ret < 0) { - goto transport_err; -+ } - } - - transport_err: -@@ -4005,8 +4009,13 @@ transport_err: - * responsible for cleaning up the early connection failure. - */ - if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN) -- iscsit_take_action_for_connection_exit(conn); -+ iscsit_take_action_for_connection_exit(conn, &conn_freed); - out: -+ if (!conn_freed) { -+ while (!kthread_should_stop()) { -+ msleep(100); -+ } -+ } - return 0; - } - -@@ -4105,6 +4114,7 @@ int iscsi_target_rx_thread(void *arg) - u32 checksum = 0, digest = 0; - struct iscsi_conn *conn = arg; - struct kvec iov; -+ bool conn_freed = false; - /* - * Allow ourselves to be interrupted by SIGINT so that a - * connection recovery / failure event can be triggered externally. -@@ -4116,7 +4126,7 @@ int iscsi_target_rx_thread(void *arg) - */ - rc = wait_for_completion_interruptible(&conn->rx_login_comp); - if (rc < 0 || iscsi_target_check_conn_state(conn)) -- return 0; -+ goto out; - - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { - struct completion comp; -@@ -4201,7 +4211,13 @@ int iscsi_target_rx_thread(void *arg) - transport_err: - if (!signal_pending(current)) - atomic_set(&conn->transport_failed, 1); -- iscsit_take_action_for_connection_exit(conn); -+ iscsit_take_action_for_connection_exit(conn, &conn_freed); -+out: -+ if (!conn_freed) { -+ while (!kthread_should_stop()) { -+ msleep(100); -+ } -+ } - return 0; - } - -@@ -4575,8 +4591,11 @@ static void iscsit_logout_post_handler_closesession( - * always sleep waiting for RX/TX thread shutdown to complete - * within iscsit_close_connection(). - */ -- if (conn->conn_transport->transport_type == ISCSI_TCP) -+ if (conn->conn_transport->transport_type == ISCSI_TCP) { - sleep = cmpxchg(&conn->tx_thread_active, true, false); -+ if (!sleep) -+ return; -+ } - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); -@@ -4592,8 +4611,11 @@ static void iscsit_logout_post_handler_samecid( - { - int sleep = 1; - -- if (conn->conn_transport->transport_type == ISCSI_TCP) -+ if (conn->conn_transport->transport_type == ISCSI_TCP) { - sleep = cmpxchg(&conn->tx_thread_active, true, false); -+ if (!sleep) -+ return; -+ } - - atomic_set(&conn->conn_logout_remove, 0); - complete(&conn->conn_logout_comp); -diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c -index 210f6e4830e3..6c88fb021444 100644 ---- a/drivers/target/iscsi/iscsi_target_erl0.c -+++ b/drivers/target/iscsi/iscsi_target_erl0.c -@@ -930,8 +930,10 @@ static void iscsit_handle_connection_cleanup(struct iscsi_conn *conn) - } - } - --void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn) -+void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn, bool *conn_freed) - { -+ *conn_freed = false; -+ - spin_lock_bh(&conn->state_lock); - if (atomic_read(&conn->connection_exit)) { - spin_unlock_bh(&conn->state_lock); -@@ -942,6 +944,7 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn) - if (conn->conn_state == TARG_CONN_STATE_IN_LOGOUT) { - spin_unlock_bh(&conn->state_lock); - iscsit_close_connection(conn); -+ *conn_freed = true; - return; - } - -@@ -955,4 +958,5 @@ void iscsit_take_action_for_connection_exit(struct iscsi_conn *conn) - spin_unlock_bh(&conn->state_lock); - - iscsit_handle_connection_cleanup(conn); -+ *conn_freed = true; - } -diff --git a/drivers/target/iscsi/iscsi_target_erl0.h b/drivers/target/iscsi/iscsi_target_erl0.h -index a9e2f9497fb2..fbc1d84a63c3 100644 ---- a/drivers/target/iscsi/iscsi_target_erl0.h -+++ b/drivers/target/iscsi/iscsi_target_erl0.h -@@ -9,6 +9,6 @@ extern int iscsit_stop_time2retain_timer(struct iscsi_session *); - extern void iscsit_connection_reinstatement_rcfr(struct iscsi_conn *); - extern void iscsit_cause_connection_reinstatement(struct iscsi_conn *, int); - extern void iscsit_fall_back_to_erl0(struct iscsi_session *); --extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *); -+extern void iscsit_take_action_for_connection_exit(struct iscsi_conn *, bool *); - - #endif /*** ISCSI_TARGET_ERL0_H ***/ -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index 4a137b0ae3dc..b19edffa7d98 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -1436,5 +1436,9 @@ int iscsi_target_login_thread(void *arg) - break; - } - -+ while (!kthread_should_stop()) { -+ msleep(100); -+ } -+ - return 0; - } -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 549a2bbbf4df..58c629aec73c 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -489,14 +489,60 @@ static void iscsi_target_restore_sock_callbacks(struct iscsi_conn *conn) - - static int iscsi_target_do_login(struct iscsi_conn *, struct iscsi_login *); - --static bool iscsi_target_sk_state_check(struct sock *sk) -+static bool __iscsi_target_sk_check_close(struct sock *sk) - { - if (sk->sk_state == TCP_CLOSE_WAIT || sk->sk_state == TCP_CLOSE) { -- pr_debug("iscsi_target_sk_state_check: TCP_CLOSE_WAIT|TCP_CLOSE," -+ pr_debug("__iscsi_target_sk_check_close: TCP_CLOSE_WAIT|TCP_CLOSE," - "returning FALSE\n"); -- return false; -+ return true; - } -- return true; -+ return false; -+} -+ -+static bool iscsi_target_sk_check_close(struct iscsi_conn *conn) -+{ -+ bool state = false; -+ -+ if (conn->sock) { -+ struct sock *sk = conn->sock->sk; -+ -+ read_lock_bh(&sk->sk_callback_lock); -+ state = (__iscsi_target_sk_check_close(sk) || -+ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)); -+ read_unlock_bh(&sk->sk_callback_lock); -+ } -+ return state; -+} -+ -+static bool iscsi_target_sk_check_flag(struct iscsi_conn *conn, unsigned int flag) -+{ -+ bool state = false; -+ -+ if (conn->sock) { -+ struct sock *sk = conn->sock->sk; -+ -+ read_lock_bh(&sk->sk_callback_lock); -+ state = test_bit(flag, &conn->login_flags); -+ read_unlock_bh(&sk->sk_callback_lock); -+ } -+ return state; -+} -+ -+static bool iscsi_target_sk_check_and_clear(struct iscsi_conn *conn, unsigned int flag) -+{ -+ bool state = false; -+ -+ if (conn->sock) { -+ struct sock *sk = conn->sock->sk; -+ -+ write_lock_bh(&sk->sk_callback_lock); -+ state = (__iscsi_target_sk_check_close(sk) || -+ test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)); -+ if (!state) -+ clear_bit(flag, &conn->login_flags); -+ write_unlock_bh(&sk->sk_callback_lock); -+ } -+ return state; - } - - static void iscsi_target_login_drop(struct iscsi_conn *conn, struct iscsi_login *login) -@@ -536,6 +582,20 @@ static void iscsi_target_do_login_rx(struct work_struct *work) - - pr_debug("entering iscsi_target_do_login_rx, conn: %p, %s:%d\n", - conn, current->comm, current->pid); -+ /* -+ * If iscsi_target_do_login_rx() has been invoked by ->sk_data_ready() -+ * before initial PDU processing in iscsi_target_start_negotiation() -+ * has completed, go ahead and retry until it's cleared. -+ * -+ * Otherwise if the TCP connection drops while this is occuring, -+ * iscsi_target_start_negotiation() will detect the failure, call -+ * cancel_delayed_work_sync(&conn->login_work), and cleanup the -+ * remaining iscsi connection resources from iscsi_np process context. -+ */ -+ if (iscsi_target_sk_check_flag(conn, LOGIN_FLAGS_INITIAL_PDU)) { -+ schedule_delayed_work(&conn->login_work, msecs_to_jiffies(10)); -+ return; -+ } - - spin_lock(&tpg->tpg_state_lock); - state = (tpg->tpg_state == TPG_STATE_ACTIVE); -@@ -543,26 +603,12 @@ static void iscsi_target_do_login_rx(struct work_struct *work) - - if (!state) { - pr_debug("iscsi_target_do_login_rx: tpg_state != TPG_STATE_ACTIVE\n"); -- iscsi_target_restore_sock_callbacks(conn); -- iscsi_target_login_drop(conn, login); -- iscsit_deaccess_np(np, tpg, tpg_np); -- return; -+ goto err; - } - -- if (conn->sock) { -- struct sock *sk = conn->sock->sk; -- -- read_lock_bh(&sk->sk_callback_lock); -- state = iscsi_target_sk_state_check(sk); -- read_unlock_bh(&sk->sk_callback_lock); -- -- if (!state) { -- pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n"); -- iscsi_target_restore_sock_callbacks(conn); -- iscsi_target_login_drop(conn, login); -- iscsit_deaccess_np(np, tpg, tpg_np); -- return; -- } -+ if (iscsi_target_sk_check_close(conn)) { -+ pr_debug("iscsi_target_do_login_rx, TCP state CLOSE\n"); -+ goto err; - } - - conn->login_kworker = current; -@@ -580,34 +626,29 @@ static void iscsi_target_do_login_rx(struct work_struct *work) - flush_signals(current); - conn->login_kworker = NULL; - -- if (rc < 0) { -- iscsi_target_restore_sock_callbacks(conn); -- iscsi_target_login_drop(conn, login); -- iscsit_deaccess_np(np, tpg, tpg_np); -- return; -- } -+ if (rc < 0) -+ goto err; - - pr_debug("iscsi_target_do_login_rx after rx_login_io, %p, %s:%d\n", - conn, current->comm, current->pid); - - rc = iscsi_target_do_login(conn, login); - if (rc < 0) { -- iscsi_target_restore_sock_callbacks(conn); -- iscsi_target_login_drop(conn, login); -- iscsit_deaccess_np(np, tpg, tpg_np); -+ goto err; - } else if (!rc) { -- if (conn->sock) { -- struct sock *sk = conn->sock->sk; -- -- write_lock_bh(&sk->sk_callback_lock); -- clear_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags); -- write_unlock_bh(&sk->sk_callback_lock); -- } -+ if (iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_READ_ACTIVE)) -+ goto err; - } else if (rc == 1) { - iscsi_target_nego_release(conn); - iscsi_post_login_handler(np, conn, zero_tsih); - iscsit_deaccess_np(np, tpg, tpg_np); - } -+ return; -+ -+err: -+ iscsi_target_restore_sock_callbacks(conn); -+ iscsi_target_login_drop(conn, login); -+ iscsit_deaccess_np(np, tpg, tpg_np); - } - - static void iscsi_target_do_cleanup(struct work_struct *work) -@@ -655,31 +696,54 @@ static void iscsi_target_sk_state_change(struct sock *sk) - orig_state_change(sk); - return; - } -+ state = __iscsi_target_sk_check_close(sk); -+ pr_debug("__iscsi_target_sk_close_change: state: %d\n", state); -+ - if (test_bit(LOGIN_FLAGS_READ_ACTIVE, &conn->login_flags)) { - pr_debug("Got LOGIN_FLAGS_READ_ACTIVE=1 sk_state_change" - " conn: %p\n", conn); -+ if (state) -+ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags); - write_unlock_bh(&sk->sk_callback_lock); - orig_state_change(sk); - return; - } -- if (test_and_set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) { -+ if (test_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags)) { - pr_debug("Got LOGIN_FLAGS_CLOSED=1 sk_state_change conn: %p\n", - conn); - write_unlock_bh(&sk->sk_callback_lock); - orig_state_change(sk); - return; - } -+ /* -+ * If the TCP connection has dropped, go ahead and set LOGIN_FLAGS_CLOSED, -+ * but only queue conn->login_work -> iscsi_target_do_login_rx() -+ * processing if LOGIN_FLAGS_INITIAL_PDU has already been cleared. -+ * -+ * When iscsi_target_do_login_rx() runs, iscsi_target_sk_check_close() -+ * will detect the dropped TCP connection from delayed workqueue context. -+ * -+ * If LOGIN_FLAGS_INITIAL_PDU is still set, which means the initial -+ * iscsi_target_start_negotiation() is running, iscsi_target_do_login() -+ * via iscsi_target_sk_check_close() or iscsi_target_start_negotiation() -+ * via iscsi_target_sk_check_and_clear() is responsible for detecting the -+ * dropped TCP connection in iscsi_np process context, and cleaning up -+ * the remaining iscsi connection resources. -+ */ -+ if (state) { -+ pr_debug("iscsi_target_sk_state_change got failed state\n"); -+ set_bit(LOGIN_FLAGS_CLOSED, &conn->login_flags); -+ state = test_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags); -+ write_unlock_bh(&sk->sk_callback_lock); - -- state = iscsi_target_sk_state_check(sk); -- write_unlock_bh(&sk->sk_callback_lock); -- -- pr_debug("iscsi_target_sk_state_change: state: %d\n", state); -+ orig_state_change(sk); - -- if (!state) { -- pr_debug("iscsi_target_sk_state_change got failed state\n"); -- schedule_delayed_work(&conn->login_cleanup_work, 0); -+ if (!state) -+ schedule_delayed_work(&conn->login_work, 0); - return; - } -+ write_unlock_bh(&sk->sk_callback_lock); -+ - orig_state_change(sk); - } - -@@ -944,6 +1008,15 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo - if (iscsi_target_handle_csg_one(conn, login) < 0) - return -1; - if (login_rsp->flags & ISCSI_FLAG_LOGIN_TRANSIT) { -+ /* -+ * Check to make sure the TCP connection has not -+ * dropped asynchronously while session reinstatement -+ * was occuring in this kthread context, before -+ * transitioning to full feature phase operation. -+ */ -+ if (iscsi_target_sk_check_close(conn)) -+ return -1; -+ - login->tsih = conn->sess->tsih; - login->login_complete = 1; - iscsi_target_restore_sock_callbacks(conn); -@@ -970,21 +1043,6 @@ static int iscsi_target_do_login(struct iscsi_conn *conn, struct iscsi_login *lo - break; - } - -- if (conn->sock) { -- struct sock *sk = conn->sock->sk; -- bool state; -- -- read_lock_bh(&sk->sk_callback_lock); -- state = iscsi_target_sk_state_check(sk); -- read_unlock_bh(&sk->sk_callback_lock); -- -- if (!state) { -- pr_debug("iscsi_target_do_login() failed state for" -- " conn: %p\n", conn); -- return -1; -- } -- } -- - return 0; - } - -@@ -1248,16 +1306,28 @@ int iscsi_target_start_negotiation( - { - int ret; - -+ if (conn->sock) { -+ struct sock *sk = conn->sock->sk; -+ -+ write_lock_bh(&sk->sk_callback_lock); -+ set_bit(LOGIN_FLAGS_READY, &conn->login_flags); -+ set_bit(LOGIN_FLAGS_INITIAL_PDU, &conn->login_flags); -+ write_unlock_bh(&sk->sk_callback_lock); -+ } -+ /* -+ * If iscsi_target_do_login returns zero to signal more PDU -+ * exchanges are required to complete the login, go ahead and -+ * clear LOGIN_FLAGS_INITIAL_PDU but only if the TCP connection -+ * is still active. -+ * -+ * Otherwise if TCP connection dropped asynchronously, go ahead -+ * and perform connection cleanup now. -+ */ - ret = iscsi_target_do_login(conn, login); -- if (!ret) { -- if (conn->sock) { -- struct sock *sk = conn->sock->sk; -+ if (!ret && iscsi_target_sk_check_and_clear(conn, LOGIN_FLAGS_INITIAL_PDU)) -+ ret = -1; - -- write_lock_bh(&sk->sk_callback_lock); -- set_bit(LOGIN_FLAGS_READY, &conn->login_flags); -- write_unlock_bh(&sk->sk_callback_lock); -- } -- } else if (ret < 0) { -+ if (ret < 0) { - cancel_delayed_work_sync(&conn->login_work); - cancel_delayed_work_sync(&conn->login_cleanup_work); - iscsi_target_restore_sock_callbacks(conn); -diff --git a/drivers/target/target_core_fabric_configfs.c b/drivers/target/target_core_fabric_configfs.c -index f916d18ccb48..b070ddf1dc37 100644 ---- a/drivers/target/target_core_fabric_configfs.c -+++ b/drivers/target/target_core_fabric_configfs.c -@@ -92,6 +92,11 @@ static int target_fabric_mappedlun_link( - pr_err("Source se_lun->lun_se_dev does not exist\n"); - return -EINVAL; - } -+ if (lun->lun_shutdown) { -+ pr_err("Unable to create mappedlun symlink because" -+ " lun->lun_shutdown=true\n"); -+ return -EINVAL; -+ } - se_tpg = lun->lun_tpg; - - nacl_ci = &lun_acl_ci->ci_parent->ci_group->cg_item; -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index 899c33b3c734..f69f4902dc07 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -673,6 +673,8 @@ void core_tpg_remove_lun( - */ - struct se_device *dev = rcu_dereference_raw(lun->lun_se_dev); - -+ lun->lun_shutdown = true; -+ - core_clear_lun_from_tpg(lun, tpg); - /* - * Wait for any active I/O references to percpu se_lun->lun_ref to -@@ -694,6 +696,8 @@ void core_tpg_remove_lun( - } - if (!(dev->se_hba->hba_flags & HBA_FLAGS_INTERNAL_USE)) - hlist_del_rcu(&lun->link); -+ -+ lun->lun_shutdown = false; - mutex_unlock(&tpg->tpg_lun_mutex); - - percpu_ref_exit(&lun->lun_ref); -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 8772bfc3415b..45ef9975caec 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -500,6 +500,8 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, - lastoff = page_offset(page); - bh = head = page_buffers(page); - do { -+ if (lastoff + bh->b_size <= startoff) -+ goto next; - if (buffer_uptodate(bh) || - buffer_unwritten(bh)) { - if (whence == SEEK_DATA) -@@ -514,6 +516,7 @@ static int ext4_find_unwritten_pgoff(struct inode *inode, - unlock_page(page); - goto out; - } -+next: - lastoff += bh->b_size; - bh = bh->b_this_page; - } while (bh != head); -diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c -index 34038e3598d5..74516efd874c 100644 ---- a/fs/ext4/resize.c -+++ b/fs/ext4/resize.c -@@ -1926,7 +1926,8 @@ retry: - n_desc_blocks = o_desc_blocks + - le16_to_cpu(es->s_reserved_gdt_blocks); - n_group = n_desc_blocks * EXT4_DESC_PER_BLOCK(sb); -- n_blocks_count = n_group * EXT4_BLOCKS_PER_GROUP(sb); -+ n_blocks_count = (ext4_fsblk_t)n_group * -+ EXT4_BLOCKS_PER_GROUP(sb); - n_group--; /* set to last group number */ - } - -diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c -index 86e1cb899957..4f666368aa85 100644 ---- a/fs/f2fs/super.c -+++ b/fs/f2fs/super.c -@@ -1078,6 +1078,8 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) - unsigned int total, fsmeta; - struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi); - struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi); -+ unsigned int main_segs, blocks_per_seg; -+ int i; - - total = le32_to_cpu(raw_super->segment_count); - fsmeta = le32_to_cpu(raw_super->segment_count_ckpt); -@@ -1089,6 +1091,20 @@ static int sanity_check_ckpt(struct f2fs_sb_info *sbi) - if (unlikely(fsmeta >= total)) - return 1; - -+ main_segs = le32_to_cpu(raw_super->segment_count_main); -+ blocks_per_seg = sbi->blocks_per_seg; -+ -+ for (i = 0; i < NR_CURSEG_NODE_TYPE; i++) { -+ if (le32_to_cpu(ckpt->cur_node_segno[i]) >= main_segs || -+ le16_to_cpu(ckpt->cur_node_blkoff[i]) >= blocks_per_seg) -+ return 1; -+ } -+ for (i = 0; i < NR_CURSEG_DATA_TYPE; i++) { -+ if (le32_to_cpu(ckpt->cur_data_segno[i]) >= main_segs || -+ le16_to_cpu(ckpt->cur_data_blkoff[i]) >= blocks_per_seg) -+ return 1; -+ } -+ - if (unlikely(f2fs_cp_error(sbi))) { - f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck"); - return 1; -diff --git a/include/linux/mm_types.h b/include/linux/mm_types.h -index 2ccccbfcd532..36f4695aa604 100644 ---- a/include/linux/mm_types.h -+++ b/include/linux/mm_types.h -@@ -503,6 +503,10 @@ struct mm_struct { - * PROT_NONE or PROT_NUMA mapped page. - */ - bool tlb_flush_pending; -+#endif -+#ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH -+ /* See flush_tlb_batched_pending() */ -+ bool tlb_flush_batched; - #endif - struct uprobes_state uprobes_state; - #ifdef CONFIG_X86_INTEL_MPX -diff --git a/include/linux/sched.h b/include/linux/sched.h -index 352213b360d7..eff7c1fad26f 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -801,6 +801,16 @@ struct signal_struct { - - #define SIGNAL_UNKILLABLE 0x00000040 /* for init: ignore fatal signals */ - -+#define SIGNAL_STOP_MASK (SIGNAL_CLD_MASK | SIGNAL_STOP_STOPPED | \ -+ SIGNAL_STOP_CONTINUED) -+ -+static inline void signal_set_stop_flags(struct signal_struct *sig, -+ unsigned int flags) -+{ -+ WARN_ON(sig->flags & (SIGNAL_GROUP_EXIT|SIGNAL_GROUP_COREDUMP)); -+ sig->flags = (sig->flags & ~SIGNAL_STOP_MASK) | flags; -+} -+ - /* If true, all threads except ->group_exit_task have pending SIGKILL */ - static inline int signal_group_exit(const struct signal_struct *sig) - { -diff --git a/include/linux/slab.h b/include/linux/slab.h -index 2037a861e367..8a2a9ffaf5de 100644 ---- a/include/linux/slab.h -+++ b/include/linux/slab.h -@@ -203,7 +203,7 @@ size_t ksize(const void *); - * (PAGE_SIZE*2). Larger requests are passed to the page allocator. - */ - #define KMALLOC_SHIFT_HIGH (PAGE_SHIFT + 1) --#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT) -+#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1) - #ifndef KMALLOC_SHIFT_LOW - #define KMALLOC_SHIFT_LOW 3 - #endif -@@ -216,7 +216,7 @@ size_t ksize(const void *); - * be allocated from the same page. - */ - #define KMALLOC_SHIFT_HIGH PAGE_SHIFT --#define KMALLOC_SHIFT_MAX 30 -+#define KMALLOC_SHIFT_MAX (MAX_ORDER + PAGE_SHIFT - 1) - #ifndef KMALLOC_SHIFT_LOW - #define KMALLOC_SHIFT_LOW 3 - #endif -diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h -index 0197358f1e81..262d5c95dfc8 100644 ---- a/include/linux/workqueue.h -+++ b/include/linux/workqueue.h -@@ -311,6 +311,7 @@ enum { - - __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */ - __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ -+ __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */ - - WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */ - WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */ -@@ -408,7 +409,8 @@ __alloc_workqueue_key(const char *fmt, unsigned int flags, int max_active, - * Pointer to the allocated workqueue on success, %NULL on failure. - */ - #define alloc_ordered_workqueue(fmt, flags, args...) \ -- alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | (flags), 1, ##args) -+ alloc_workqueue(fmt, WQ_UNBOUND | __WQ_ORDERED | \ -+ __WQ_ORDERED_EXPLICIT | (flags), 1, ##args) - - #define create_workqueue(name) \ - alloc_workqueue("%s", WQ_MEM_RECLAIM, 1, (name)) -diff --git a/include/net/iw_handler.h b/include/net/iw_handler.h -index e0f4109e64c6..c2aa73e5e6bb 100644 ---- a/include/net/iw_handler.h -+++ b/include/net/iw_handler.h -@@ -556,7 +556,8 @@ iwe_stream_add_point(struct iw_request_info *info, char *stream, char *ends, - memcpy(stream + lcp_len, - ((char *) &iwe->u) + IW_EV_POINT_OFF, - IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN); -- memcpy(stream + point_len, extra, iwe->u.data.length); -+ if (iwe->u.data.length && extra) -+ memcpy(stream + point_len, extra, iwe->u.data.length); - stream += event_len; - } - return stream; -diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h -index ce13cf20f625..d33b17ba51d2 100644 ---- a/include/net/sctp/sctp.h -+++ b/include/net/sctp/sctp.h -@@ -444,6 +444,8 @@ _sctp_walk_params((pos), (chunk), ntohs((chunk)->chunk_hdr.length), member) - - #define _sctp_walk_params(pos, chunk, end, member)\ - for (pos.v = chunk->member;\ -+ (pos.v + offsetof(struct sctp_paramhdr, length) + sizeof(pos.p->length) <=\ -+ (void *)chunk + end) &&\ - pos.v <= (void *)chunk + end - ntohs(pos.p->length) &&\ - ntohs(pos.p->length) >= sizeof(sctp_paramhdr_t);\ - pos.v += WORD_ROUND(ntohs(pos.p->length))) -@@ -454,6 +456,8 @@ _sctp_walk_errors((err), (chunk_hdr), ntohs((chunk_hdr)->length)) - #define _sctp_walk_errors(err, chunk_hdr, end)\ - for (err = (sctp_errhdr_t *)((void *)chunk_hdr + \ - sizeof(sctp_chunkhdr_t));\ -+ ((void *)err + offsetof(sctp_errhdr_t, length) + sizeof(err->length) <=\ -+ (void *)chunk_hdr + end) &&\ - (void *)err <= (void *)chunk_hdr + end - ntohs(err->length) &&\ - ntohs(err->length) >= sizeof(sctp_errhdr_t); \ - err = (sctp_errhdr_t *)((void *)err + WORD_ROUND(ntohs(err->length)))) -diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h -index e0efe3fcf739..fdda45f26f75 100644 ---- a/include/target/iscsi/iscsi_target_core.h -+++ b/include/target/iscsi/iscsi_target_core.h -@@ -562,6 +562,7 @@ struct iscsi_conn { - #define LOGIN_FLAGS_READ_ACTIVE 1 - #define LOGIN_FLAGS_CLOSED 2 - #define LOGIN_FLAGS_READY 4 -+#define LOGIN_FLAGS_INITIAL_PDU 8 - unsigned long login_flags; - struct delayed_work login_work; - struct delayed_work login_cleanup_work; -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index ed66414b91f0..1adf8739980c 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -714,6 +714,7 @@ struct se_lun { - #define SE_LUN_LINK_MAGIC 0xffff7771 - u32 lun_link_magic; - u32 lun_access; -+ bool lun_shutdown; - u32 lun_index; - - /* RELATIVE TARGET PORT IDENTIFER */ -diff --git a/kernel/signal.c b/kernel/signal.c -index b92a047ddc82..5d50ea899b6d 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -346,7 +346,7 @@ static bool task_participate_group_stop(struct task_struct *task) - * fresh group stop. Read comment in do_signal_stop() for details. - */ - if (!sig->group_stop_count && !(sig->flags & SIGNAL_STOP_STOPPED)) { -- sig->flags = SIGNAL_STOP_STOPPED; -+ signal_set_stop_flags(sig, SIGNAL_STOP_STOPPED); - return true; - } - return false; -@@ -845,7 +845,7 @@ static bool prepare_signal(int sig, struct task_struct *p, bool force) - * will take ->siglock, notice SIGNAL_CLD_MASK, and - * notify its parent. See get_signal_to_deliver(). - */ -- signal->flags = why | SIGNAL_STOP_CONTINUED; -+ signal_set_stop_flags(signal, why | SIGNAL_STOP_CONTINUED); - signal->group_stop_count = 0; - signal->group_exit_code = 0; - } -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 2c2f971f3e75..23231237f2e2 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -3647,8 +3647,12 @@ static int apply_workqueue_attrs_locked(struct workqueue_struct *wq, - return -EINVAL; - - /* creating multiple pwqs breaks ordering guarantee */ -- if (WARN_ON((wq->flags & __WQ_ORDERED) && !list_empty(&wq->pwqs))) -- return -EINVAL; -+ if (!list_empty(&wq->pwqs)) { -+ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT)) -+ return -EINVAL; -+ -+ wq->flags &= ~__WQ_ORDERED; -+ } - - ctx = apply_wqattrs_prepare(wq, attrs); - -@@ -3834,6 +3838,16 @@ struct workqueue_struct *__alloc_workqueue_key(const char *fmt, - struct workqueue_struct *wq; - struct pool_workqueue *pwq; - -+ /* -+ * Unbound && max_active == 1 used to imply ordered, which is no -+ * longer the case on NUMA machines due to per-node pools. While -+ * alloc_ordered_workqueue() is the right way to create an ordered -+ * workqueue, keep the previous behavior to avoid subtle breakages -+ * on NUMA. -+ */ -+ if ((flags & WQ_UNBOUND) && max_active == 1) -+ flags |= __WQ_ORDERED; -+ - /* see the comment above the definition of WQ_POWER_EFFICIENT */ - if ((flags & WQ_POWER_EFFICIENT) && wq_power_efficient) - flags |= WQ_UNBOUND; -@@ -4022,13 +4036,14 @@ void workqueue_set_max_active(struct workqueue_struct *wq, int max_active) - struct pool_workqueue *pwq; - - /* disallow meddling with max_active for ordered workqueues */ -- if (WARN_ON(wq->flags & __WQ_ORDERED)) -+ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT)) - return; - - max_active = wq_clamp_max_active(max_active, wq->flags, wq->name); - - mutex_lock(&wq->mutex); - -+ wq->flags &= ~__WQ_ORDERED; - wq->saved_max_active = max_active; - - for_each_pwq(pwq, wq) -@@ -5154,7 +5169,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq) - * attributes breaks ordering guarantee. Disallow exposing ordered - * workqueues. - */ -- if (WARN_ON(wq->flags & __WQ_ORDERED)) -+ if (WARN_ON(wq->flags & __WQ_ORDERED_EXPLICIT)) - return -EINVAL; - - wq->wq_dev = wq_dev = kzalloc(sizeof(*wq_dev), GFP_KERNEL); -diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug -index 8c15b29d5adc..b53b375e14bd 100644 ---- a/lib/Kconfig.debug -+++ b/lib/Kconfig.debug -@@ -145,7 +145,7 @@ config DEBUG_INFO_REDUCED - - config DEBUG_INFO_SPLIT - bool "Produce split debuginfo in .dwo files" -- depends on DEBUG_INFO -+ depends on DEBUG_INFO && !FRV - help - Generate debug info into separate .dwo files. This significantly - reduces the build directory size for builds with DEBUG_INFO, -diff --git a/mm/internal.h b/mm/internal.h -index 6979b2bd3227..f63f4393d633 100644 ---- a/mm/internal.h -+++ b/mm/internal.h -@@ -453,6 +453,7 @@ struct tlbflush_unmap_batch; - #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH - void try_to_unmap_flush(void); - void try_to_unmap_flush_dirty(void); -+void flush_tlb_batched_pending(struct mm_struct *mm); - #else - static inline void try_to_unmap_flush(void) - { -@@ -460,6 +461,8 @@ static inline void try_to_unmap_flush(void) - static inline void try_to_unmap_flush_dirty(void) - { - } -- -+static inline void flush_tlb_batched_pending(struct mm_struct *mm) -+{ -+} - #endif /* CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH */ - #endif /* __MM_INTERNAL_H */ -diff --git a/mm/memory.c b/mm/memory.c -index e6fa13484447..9ac55172aa7b 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -1127,6 +1127,7 @@ again: - init_rss_vec(rss); - start_pte = pte_offset_map_lock(mm, pmd, addr, &ptl); - pte = start_pte; -+ flush_tlb_batched_pending(mm); - arch_enter_lazy_mmu_mode(); - do { - pte_t ptent = *pte; -diff --git a/mm/mprotect.c b/mm/mprotect.c -index ef5be8eaab00..c0b4b2a49462 100644 ---- a/mm/mprotect.c -+++ b/mm/mprotect.c -@@ -72,6 +72,7 @@ static unsigned long change_pte_range(struct vm_area_struct *vma, pmd_t *pmd, - if (!pte) - return 0; - -+ flush_tlb_batched_pending(vma->vm_mm); - arch_enter_lazy_mmu_mode(); - do { - oldpte = *pte; -diff --git a/mm/mremap.c b/mm/mremap.c -index c25bc6268e46..fe7b7f65f4f4 100644 ---- a/mm/mremap.c -+++ b/mm/mremap.c -@@ -135,6 +135,7 @@ static void move_ptes(struct vm_area_struct *vma, pmd_t *old_pmd, - new_ptl = pte_lockptr(mm, new_pmd); - if (new_ptl != old_ptl) - spin_lock_nested(new_ptl, SINGLE_DEPTH_NESTING); -+ flush_tlb_batched_pending(vma->vm_mm); - arch_enter_lazy_mmu_mode(); - - for (; old_addr < old_end; old_pte++, old_addr += PAGE_SIZE, -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index bd17a6bdf131..f9d648fce8cd 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -1527,14 +1527,14 @@ int move_freepages(struct zone *zone, - #endif - - for (page = start_page; page <= end_page;) { -- /* Make sure we are not inadvertently changing nodes */ -- VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page); -- - if (!pfn_valid_within(page_to_pfn(page))) { - page++; - continue; - } - -+ /* Make sure we are not inadvertently changing nodes */ -+ VM_BUG_ON_PAGE(page_to_nid(page) != zone_to_nid(zone), page); -+ - if (!PageBuddy(page)) { - page++; - continue; -@@ -5847,8 +5847,8 @@ unsigned long free_reserved_area(void *start, void *end, int poison, char *s) - } - - if (pages && s) -- pr_info("Freeing %s memory: %ldK (%p - %p)\n", -- s, pages << (PAGE_SHIFT - 10), start, end); -+ pr_info("Freeing %s memory: %ldK\n", -+ s, pages << (PAGE_SHIFT - 10)); - - return pages; - } -diff --git a/mm/rmap.c b/mm/rmap.c -index b577fbb98d4b..ede183c32f45 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -648,6 +648,13 @@ static void set_tlb_ubc_flush_pending(struct mm_struct *mm, - cpumask_or(&tlb_ubc->cpumask, &tlb_ubc->cpumask, mm_cpumask(mm)); - tlb_ubc->flush_required = true; - -+ /* -+ * Ensure compiler does not re-order the setting of tlb_flush_batched -+ * before the PTE is cleared. -+ */ -+ barrier(); -+ mm->tlb_flush_batched = true; -+ - /* - * If the PTE was dirty then it's best to assume it's writable. The - * caller must use try_to_unmap_flush_dirty() or try_to_unmap_flush() -@@ -675,6 +682,35 @@ static bool should_defer_flush(struct mm_struct *mm, enum ttu_flags flags) - - return should_defer; - } -+ -+/* -+ * Reclaim unmaps pages under the PTL but do not flush the TLB prior to -+ * releasing the PTL if TLB flushes are batched. It's possible for a parallel -+ * operation such as mprotect or munmap to race between reclaim unmapping -+ * the page and flushing the page. If this race occurs, it potentially allows -+ * access to data via a stale TLB entry. Tracking all mm's that have TLB -+ * batching in flight would be expensive during reclaim so instead track -+ * whether TLB batching occurred in the past and if so then do a flush here -+ * if required. This will cost one additional flush per reclaim cycle paid -+ * by the first operation at risk such as mprotect and mumap. -+ * -+ * This must be called under the PTL so that an access to tlb_flush_batched -+ * that is potentially a "reclaim vs mprotect/munmap/etc" race will synchronise -+ * via the PTL. -+ */ -+void flush_tlb_batched_pending(struct mm_struct *mm) -+{ -+ if (mm->tlb_flush_batched) { -+ flush_tlb_mm(mm); -+ -+ /* -+ * Do not allow the compiler to re-order the clearing of -+ * tlb_flush_batched before the tlb is flushed. -+ */ -+ barrier(); -+ mm->tlb_flush_batched = false; -+ } -+} - #else - static void set_tlb_ubc_flush_pending(struct mm_struct *mm, - struct page *page, bool writable) -diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c -index b94b1d293506..151e047ce072 100644 ---- a/net/core/dev_ioctl.c -+++ b/net/core/dev_ioctl.c -@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg) - - if (copy_from_user(&ifr, arg, sizeof(struct ifreq))) - return -EFAULT; -+ ifr.ifr_name[IFNAMSIZ-1] = 0; - - error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex); - if (error) -diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c -index 2ec5324a7ff7..5b3d611d8b5f 100644 ---- a/net/core/rtnetlink.c -+++ b/net/core/rtnetlink.c -@@ -1742,7 +1742,8 @@ static int do_setlink(const struct sk_buff *skb, - struct sockaddr *sa; - int len; - -- len = sizeof(sa_family_t) + dev->addr_len; -+ len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len, -+ sizeof(*sa)); - sa = kmalloc(len, GFP_KERNEL); - if (!sa) { - err = -ENOMEM; -diff --git a/net/dccp/feat.c b/net/dccp/feat.c -index 1704948e6a12..f227f002c73d 100644 ---- a/net/dccp/feat.c -+++ b/net/dccp/feat.c -@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk) - * singleton values (which always leads to failure). - * These settings can still (later) be overridden via sockopts. - */ -- if (ccid_get_builtin_ccids(&tx.val, &tx.len) || -- ccid_get_builtin_ccids(&rx.val, &rx.len)) -+ if (ccid_get_builtin_ccids(&tx.val, &tx.len)) - return -ENOBUFS; -+ if (ccid_get_builtin_ccids(&rx.val, &rx.len)) { -+ kfree(tx.val); -+ return -ENOBUFS; -+ } - - if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) || - !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len)) -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index 6467bf392e1b..e217f17997a4 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -635,6 +635,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb) - goto drop_and_free; - - inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); -+ reqsk_put(req); - return 0; - - drop_and_free: -diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c -index 3470ad1843bb..09a9ab65f4e1 100644 ---- a/net/dccp/ipv6.c -+++ b/net/dccp/ipv6.c -@@ -376,6 +376,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb) - goto drop_and_free; - - inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT); -+ reqsk_put(req); - return 0; - - drop_and_free: -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 66dcb529fd9c..0cb240c749bf 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1319,13 +1319,14 @@ static struct pernet_operations fib_net_ops = { - - void __init ip_fib_init(void) - { -- rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL); -- rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL); -- rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL); -+ fib_trie_init(); - - register_pernet_subsys(&fib_net_ops); -+ - register_netdevice_notifier(&fib_netdev_notifier); - register_inetaddr_notifier(&fib_inetaddr_notifier); - -- fib_trie_init(); -+ rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL); -+ rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL); -+ rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL); - } -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 2b7283303650..5d58a6703a43 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -922,7 +922,8 @@ static int __ip_append_data(struct sock *sk, - csummode = CHECKSUM_PARTIAL; - - cork->length += length; -- if (((length > mtu) || (skb && skb_is_gso(skb))) && -+ if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) || -+ (skb && skb_is_gso(skb))) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len && - (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) { -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index 4cbe9f0a4281..731b91409625 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) - treq = tcp_rsk(req); - treq->rcv_isn = ntohl(th->seq) - 1; - treq->snt_isn = cookie; -+ treq->txhash = net_tx_rndhash(); - req->mss = mss; - ireq->ir_num = ntohs(th->dest); - ireq->ir_rmt_port = th->source; -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 150b4923fb72..0de3245ea42f 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -647,8 +647,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb, - *prevhdr = NEXTHDR_FRAGMENT; - tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC); - if (!tmp_hdr) { -- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), -- IPSTATS_MIB_FRAGFAILS); - err = -ENOMEM; - goto fail; - } -@@ -767,8 +765,6 @@ slow_path: - frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) + - hroom + troom, GFP_ATOMIC); - if (!frag) { -- IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), -- IPSTATS_MIB_FRAGFAILS); - err = -ENOMEM; - goto fail; - } -@@ -1361,7 +1357,7 @@ emsgsize: - */ - - cork->length += length; -- if ((((length + fragheaderlen) > mtu) || -+ if ((((length + (skb ? skb->len : headersize)) > mtu) || - (skb && skb_is_gso(skb))) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO) && -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index 8b56c5240429..f9f02581c4ca 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident); - - int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - { -- u16 offset = sizeof(struct ipv6hdr); -+ unsigned int offset = sizeof(struct ipv6hdr); - unsigned int packet_len = skb_tail_pointer(skb) - - skb_network_header(skb); - int found_rhdr = 0; -@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - - while (offset <= packet_len) { - struct ipv6_opt_hdr *exthdr; -+ unsigned int len; - - switch (**nexthdr) { - -@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - - exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + - offset); -- offset += ipv6_optlen(exthdr); -+ len = ipv6_optlen(exthdr); -+ if (len + offset >= IPV6_MAXPLEN) -+ return -EINVAL; -+ offset += len; - *nexthdr = &exthdr->nexthdr; - } - -diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c -index eaf7ac496d50..aee87282d352 100644 ---- a/net/ipv6/syncookies.c -+++ b/net/ipv6/syncookies.c -@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) - treq->snt_synack.v64 = 0; - treq->rcv_isn = ntohl(th->seq) - 1; - treq->snt_isn = cookie; -+ treq->txhash = net_tx_rndhash(); - - /* - * We need to lookup the dst_entry to get the correct window size. -diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c -index ad58d2a6284e..6a2507f24b0f 100644 ---- a/net/openvswitch/conntrack.c -+++ b/net/openvswitch/conntrack.c -@@ -577,8 +577,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, - - nla_for_each_nested(a, attr, rem) { - int type = nla_type(a); -- int maxlen = ovs_ct_attr_lens[type].maxlen; -- int minlen = ovs_ct_attr_lens[type].minlen; -+ int maxlen; -+ int minlen; - - if (type > OVS_CT_ATTR_MAX) { - OVS_NLERR(log, -@@ -586,6 +586,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info, - type, OVS_CT_ATTR_MAX); - return -EINVAL; - } -+ -+ maxlen = ovs_ct_attr_lens[type].maxlen; -+ minlen = ovs_ct_attr_lens[type].minlen; - if (nla_len(a) < minlen || nla_len(a) > maxlen) { - OVS_NLERR(log, - "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)", -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index f8d6a0ca9c03..061771ca2582 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -4225,7 +4225,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, - register_prot_hook(sk); - } - spin_unlock(&po->bind_lock); -- if (closing && (po->tp_version > TPACKET_V2)) { -+ if (pg_vec && (po->tp_version > TPACKET_V2)) { - /* Because we don't support block-based V3 on tx-ring */ - if (!tx_ring) - prb_shutdown_retire_blk_timer(po, rb_queue); -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 46a34039ecdc..5cab24f52825 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -2233,6 +2233,7 @@ static const struct snd_pci_quirk alc882_fixup_tbl[] = { - SND_PCI_QUIRK(0x1043, 0x8691, "ASUS ROG Ranger VIII", ALC882_FIXUP_GPIO3), - SND_PCI_QUIRK(0x104d, 0x9047, "Sony Vaio TT", ALC889_FIXUP_VAIO_TT), - SND_PCI_QUIRK(0x104d, 0x905a, "Sony Vaio Z", ALC882_FIXUP_NO_PRIMARY_HP), -+ SND_PCI_QUIRK(0x104d, 0x9060, "Sony Vaio VPCL14M1R", ALC882_FIXUP_NO_PRIMARY_HP), - SND_PCI_QUIRK(0x104d, 0x9043, "Sony Vaio VGC-LN51JGB", ALC882_FIXUP_NO_PRIMARY_HP), - SND_PCI_QUIRK(0x104d, 0x9044, "Sony VAIO AiO", ALC882_FIXUP_NO_PRIMARY_HP), - -diff --git a/sound/soc/soc-pcm.c b/sound/soc/soc-pcm.c -index a1e605bbc465..977066ba1769 100644 ---- a/sound/soc/soc-pcm.c -+++ b/sound/soc/soc-pcm.c -@@ -181,6 +181,10 @@ int dpcm_dapm_stream_event(struct snd_soc_pcm_runtime *fe, int dir, - dev_dbg(be->dev, "ASoC: BE %s event %d dir %d\n", - be->dai_link->name, event, dir); - -+ if ((event == SND_SOC_DAPM_STREAM_STOP) && -+ (be->dpcm[dir].users >= 1)) -+ continue; -+ - snd_soc_dapm_stream_event(be, dir, event); - } - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.81-82.patch b/patch/kernel/mvebu64-default/03-patch-4.4.81-82.patch deleted file mode 100644 index f61b7675a27a..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.81-82.patch +++ /dev/null @@ -1,330 +0,0 @@ -diff --git a/Makefile b/Makefile -index d049e53a6960..52f2dd8dcebd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 81 -+SUBLEVEL = 82 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index 1f1ff7e7b9cf..ba079e279b58 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -1629,12 +1629,16 @@ static int kvm_test_age_hva_handler(struct kvm *kvm, gpa_t gpa, void *data) - - int kvm_age_hva(struct kvm *kvm, unsigned long start, unsigned long end) - { -+ if (!kvm->arch.pgd) -+ return 0; - trace_kvm_age_hva(start, end); - return handle_hva_to_gpa(kvm, start, end, kvm_age_hva_handler, NULL); - } - - int kvm_test_age_hva(struct kvm *kvm, unsigned long hva) - { -+ if (!kvm->arch.pgd) -+ return 0; - trace_kvm_test_age_hva(hva); - return handle_hva_to_gpa(kvm, hva, hva, kvm_test_age_hva_handler, NULL); - } -diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c -index 0e2919dd8df3..1395eeb6005f 100644 ---- a/arch/s390/net/bpf_jit_comp.c -+++ b/arch/s390/net/bpf_jit_comp.c -@@ -1250,7 +1250,8 @@ static int bpf_jit_prog(struct bpf_jit *jit, struct bpf_prog *fp) - insn_count = bpf_jit_insn(jit, fp, i); - if (insn_count < 0) - return -1; -- jit->addrs[i + 1] = jit->prg; /* Next instruction address */ -+ /* Next instruction address */ -+ jit->addrs[i + insn_count] = jit->prg; - } - bpf_jit_epilogue(jit); - -diff --git a/arch/sparc/include/asm/mmu_context_64.h b/arch/sparc/include/asm/mmu_context_64.h -index 349dd23e2876..0cdeb2b483a0 100644 ---- a/arch/sparc/include/asm/mmu_context_64.h -+++ b/arch/sparc/include/asm/mmu_context_64.h -@@ -25,9 +25,11 @@ void destroy_context(struct mm_struct *mm); - void __tsb_context_switch(unsigned long pgd_pa, - struct tsb_config *tsb_base, - struct tsb_config *tsb_huge, -- unsigned long tsb_descr_pa); -+ unsigned long tsb_descr_pa, -+ unsigned long secondary_ctx); - --static inline void tsb_context_switch(struct mm_struct *mm) -+static inline void tsb_context_switch_ctx(struct mm_struct *mm, -+ unsigned long ctx) - { - __tsb_context_switch(__pa(mm->pgd), - &mm->context.tsb_block[0], -@@ -38,9 +40,12 @@ static inline void tsb_context_switch(struct mm_struct *mm) - #else - NULL - #endif -- , __pa(&mm->context.tsb_descr[0])); -+ , __pa(&mm->context.tsb_descr[0]), -+ ctx); - } - -+#define tsb_context_switch(X) tsb_context_switch_ctx(X, 0) -+ - void tsb_grow(struct mm_struct *mm, - unsigned long tsb_index, - unsigned long mm_rss); -@@ -110,8 +115,7 @@ static inline void switch_mm(struct mm_struct *old_mm, struct mm_struct *mm, str - * cpu0 to update it's TSB because at that point the cpu_vm_mask - * only had cpu1 set in it. - */ -- load_secondary_context(mm); -- tsb_context_switch(mm); -+ tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context)); - - /* Any time a processor runs a context on an address space - * for the first time, we must flush that context out of the -diff --git a/arch/sparc/kernel/tsb.S b/arch/sparc/kernel/tsb.S -index 395ec1800530..7d961f6e3907 100644 ---- a/arch/sparc/kernel/tsb.S -+++ b/arch/sparc/kernel/tsb.S -@@ -375,6 +375,7 @@ tsb_flush: - * %o1: TSB base config pointer - * %o2: TSB huge config pointer, or NULL if none - * %o3: Hypervisor TSB descriptor physical address -+ * %o4: Secondary context to load, if non-zero - * - * We have to run this whole thing with interrupts - * disabled so that the current cpu doesn't change -@@ -387,6 +388,17 @@ __tsb_context_switch: - rdpr %pstate, %g1 - wrpr %g1, PSTATE_IE, %pstate - -+ brz,pn %o4, 1f -+ mov SECONDARY_CONTEXT, %o5 -+ -+661: stxa %o4, [%o5] ASI_DMMU -+ .section .sun4v_1insn_patch, "ax" -+ .word 661b -+ stxa %o4, [%o5] ASI_MMU -+ .previous -+ flush %g6 -+ -+1: - TRAP_LOAD_TRAP_BLOCK(%g2, %g3) - - stx %o0, [%g2 + TRAP_PER_CPU_PGD_PADDR] -diff --git a/arch/sparc/power/hibernate.c b/arch/sparc/power/hibernate.c -index 17bd2e167e07..df707a8ad311 100644 ---- a/arch/sparc/power/hibernate.c -+++ b/arch/sparc/power/hibernate.c -@@ -35,6 +35,5 @@ void restore_processor_state(void) - { - struct mm_struct *mm = current->active_mm; - -- load_secondary_context(mm); -- tsb_context_switch(mm); -+ tsb_context_switch_ctx(mm, CTX_HWBITS(mm->context)); - } -diff --git a/mm/mempool.c b/mm/mempool.c -index 004d42b1dfaf..7924f4f58a6d 100644 ---- a/mm/mempool.c -+++ b/mm/mempool.c -@@ -135,8 +135,8 @@ static void *remove_element(mempool_t *pool) - void *element = pool->elements[--pool->curr_nr]; - - BUG_ON(pool->curr_nr < 0); -- check_element(pool, element); - kasan_unpoison_element(pool, element); -+ check_element(pool, element); - return element; - } - -diff --git a/net/core/dev.c b/net/core/dev.c -index 4b0853194a03..24d243084aab 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2551,7 +2551,7 @@ static inline bool skb_needs_check(struct sk_buff *skb, bool tx_path) - { - if (tx_path) - return skb->ip_summed != CHECKSUM_PARTIAL && -- skb->ip_summed != CHECKSUM_NONE; -+ skb->ip_summed != CHECKSUM_UNNECESSARY; - - return skb->ip_summed == CHECKSUM_NONE; - } -diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c -index 5d58a6703a43..09c73dd541c5 100644 ---- a/net/ipv4/ip_output.c -+++ b/net/ipv4/ip_output.c -@@ -922,11 +922,12 @@ static int __ip_append_data(struct sock *sk, - csummode = CHECKSUM_PARTIAL; - - cork->length += length; -- if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) || -- (skb && skb_is_gso(skb))) && -+ if ((skb && skb_is_gso(skb)) || -+ (((length + (skb ? skb->len : fragheaderlen)) > mtu) && -+ (skb_queue_len(queue) <= 1) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len && -- (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) { -+ (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx)) { - err = ip_ufo_append_data(sk, queue, getfrag, from, length, - hh_len, fragheaderlen, transhdrlen, - maxfraglen, flags); -@@ -1242,6 +1243,7 @@ ssize_t ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page, - return -EINVAL; - - if ((size + skb->len > mtu) && -+ (skb_queue_len(&sk->sk_write_queue) == 1) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO)) { - if (skb->ip_summed != CHECKSUM_PARTIAL) -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 8f13b2eaabf8..f0dabd125c43 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -2503,8 +2503,8 @@ static inline void tcp_end_cwnd_reduction(struct sock *sk) - struct tcp_sock *tp = tcp_sk(sk); - - /* Reset cwnd to ssthresh in CWR or Recovery (unless it's undone) */ -- if (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || -- (tp->undo_marker && tp->snd_ssthresh < TCP_INFINITE_SSTHRESH)) { -+ if (tp->snd_ssthresh < TCP_INFINITE_SSTHRESH && -+ (inet_csk(sk)->icsk_ca_state == TCP_CA_CWR || tp->undo_marker)) { - tp->snd_cwnd = tp->snd_ssthresh; - tp->snd_cwnd_stamp = tcp_time_stamp; - } -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 3fdcdc730f71..850d1b5bfd81 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -3256,6 +3256,9 @@ int tcp_connect(struct sock *sk) - struct sk_buff *buff; - int err; - -+ if (inet_csk(sk)->icsk_af_ops->rebuild_header(sk)) -+ return -EHOSTUNREACH; /* Routing failure or similar. */ -+ - tcp_connect_init(sk); - - if (unlikely(tp->repair)) { -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index ebb34d0c5e80..1ec12a4f327e 100644 ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -606,7 +606,8 @@ static void tcp_keepalive_timer (unsigned long data) - goto death; - } - -- if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE) -+ if (!sock_flag(sk, SOCK_KEEPOPEN) || -+ ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT))) - goto out; - - elapsed = keepalive_time_when(tp); -diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c -index e9513e397c4f..301e60829c7e 100644 ---- a/net/ipv4/udp.c -+++ b/net/ipv4/udp.c -@@ -819,7 +819,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4) - if (is_udplite) /* UDP-Lite */ - csum = udplite_csum(skb); - -- else if (sk->sk_no_check_tx) { /* UDP csum disabled */ -+ else if (sk->sk_no_check_tx && !skb_is_gso(skb)) { /* UDP csum off */ - - skb->ip_summed = CHECKSUM_NONE; - goto send; -diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c -index 6396f1c80ae9..6dfc3daf7c21 100644 ---- a/net/ipv4/udp_offload.c -+++ b/net/ipv4/udp_offload.c -@@ -231,7 +231,7 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb, - if (uh->check == 0) - uh->check = CSUM_MANGLED_0; - -- skb->ip_summed = CHECKSUM_NONE; -+ skb->ip_summed = CHECKSUM_UNNECESSARY; - - /* Fragment the skb. IP headers of the fragments are updated in - * inet_gso_segment() -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 0de3245ea42f..e22339fad10b 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1357,11 +1357,12 @@ emsgsize: - */ - - cork->length += length; -- if ((((length + (skb ? skb->len : headersize)) > mtu) || -- (skb && skb_is_gso(skb))) && -+ if ((skb && skb_is_gso(skb)) || -+ (((length + (skb ? skb->len : headersize)) > mtu) && -+ (skb_queue_len(queue) <= 1) && - (sk->sk_protocol == IPPROTO_UDP) && - (rt->dst.dev->features & NETIF_F_UFO) && -- (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) { -+ (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk))) { - err = ip6_ufo_append_data(sk, queue, getfrag, from, length, - hh_len, fragheaderlen, exthdrlen, - transhdrlen, mtu, flags, fl6); -diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c -index 01582966ffa0..2e3c12eeca07 100644 ---- a/net/ipv6/udp_offload.c -+++ b/net/ipv6/udp_offload.c -@@ -86,7 +86,7 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, - if (uh->check == 0) - uh->check = CSUM_MANGLED_0; - -- skb->ip_summed = CHECKSUM_NONE; -+ skb->ip_summed = CHECKSUM_UNNECESSARY; - - /* Check if there is enough headroom to insert fragment header. */ - tnl_hlen = skb_tnl_header_len(skb); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 061771ca2582..148ec130d99d 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3622,14 +3622,19 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv - - if (optlen != sizeof(val)) - return -EINVAL; -- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) -- return -EBUSY; - if (copy_from_user(&val, optval, sizeof(val))) - return -EFAULT; - if (val > INT_MAX) - return -EINVAL; -- po->tp_reserve = val; -- return 0; -+ lock_sock(sk); -+ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) { -+ ret = -EBUSY; -+ } else { -+ po->tp_reserve = val; -+ ret = 0; -+ } -+ release_sock(sk); -+ return ret; - } - case PACKET_LOSS: - { -diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c -index d05869646515..0915d448ba23 100644 ---- a/net/sched/act_ipt.c -+++ b/net/sched/act_ipt.c -@@ -42,8 +42,8 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int - return PTR_ERR(target); - - t->u.kernel.target = target; -+ memset(&par, 0, sizeof(par)); - par.table = table; -- par.entryinfo = NULL; - par.target = target; - par.targinfo = t->data; - par.hook_mask = hook; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.82-83.patch b/patch/kernel/mvebu64-default/03-patch-4.4.82-83.patch deleted file mode 100644 index 104c0c33181e..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.82-83.patch +++ /dev/null @@ -1,476 +0,0 @@ -diff --git a/Makefile b/Makefile -index 52f2dd8dcebd..7f67b35caf99 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 82 -+SUBLEVEL = 83 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c -index fa24d5196615..c7122919a8c0 100644 ---- a/drivers/iio/accel/bmc150-accel-core.c -+++ b/drivers/iio/accel/bmc150-accel-core.c -@@ -194,7 +194,6 @@ struct bmc150_accel_data { - struct device *dev; - int irq; - struct bmc150_accel_interrupt interrupts[BMC150_ACCEL_INTERRUPTS]; -- atomic_t active_intr; - struct bmc150_accel_trigger triggers[BMC150_ACCEL_TRIGGERS]; - struct mutex mutex; - u8 fifo_mode, watermark; -@@ -489,11 +488,6 @@ static int bmc150_accel_set_interrupt(struct bmc150_accel_data *data, int i, - goto out_fix_power_state; - } - -- if (state) -- atomic_inc(&data->active_intr); -- else -- atomic_dec(&data->active_intr); -- - return 0; - - out_fix_power_state: -@@ -1704,8 +1698,7 @@ static int bmc150_accel_resume(struct device *dev) - struct bmc150_accel_data *data = iio_priv(indio_dev); - - mutex_lock(&data->mutex); -- if (atomic_read(&data->active_intr)) -- bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); -+ bmc150_accel_set_mode(data, BMC150_ACCEL_SLEEP_MODE_NORMAL, 0); - bmc150_accel_fifo_set_mode(data); - mutex_unlock(&data->mutex); - -diff --git a/drivers/iio/adc/vf610_adc.c b/drivers/iio/adc/vf610_adc.c -index b10f629cc44b..1dbc2143cdfc 100644 ---- a/drivers/iio/adc/vf610_adc.c -+++ b/drivers/iio/adc/vf610_adc.c -@@ -77,7 +77,7 @@ - #define VF610_ADC_ADSTS_MASK 0x300 - #define VF610_ADC_ADLPC_EN 0x80 - #define VF610_ADC_ADHSC_EN 0x400 --#define VF610_ADC_REFSEL_VALT 0x100 -+#define VF610_ADC_REFSEL_VALT 0x800 - #define VF610_ADC_REFSEL_VBG 0x1000 - #define VF610_ADC_ADTRG_HARD 0x2000 - #define VF610_ADC_AVGS_8 0x4000 -diff --git a/drivers/iio/light/tsl2563.c b/drivers/iio/light/tsl2563.c -index 12731d6b89ec..ec1b2e798cc1 100644 ---- a/drivers/iio/light/tsl2563.c -+++ b/drivers/iio/light/tsl2563.c -@@ -626,7 +626,7 @@ static irqreturn_t tsl2563_event_handler(int irq, void *private) - struct tsl2563_chip *chip = iio_priv(dev_info); - - iio_push_event(dev_info, -- IIO_UNMOD_EVENT_CODE(IIO_LIGHT, -+ IIO_UNMOD_EVENT_CODE(IIO_INTENSITY, - 0, - IIO_EV_TYPE_THRESH, - IIO_EV_DIR_EITHER), -diff --git a/drivers/pinctrl/samsung/pinctrl-exynos.c b/drivers/pinctrl/samsung/pinctrl-exynos.c -index 71ccf6a90b22..2551e4adb33f 100644 ---- a/drivers/pinctrl/samsung/pinctrl-exynos.c -+++ b/drivers/pinctrl/samsung/pinctrl-exynos.c -@@ -194,8 +194,6 @@ static int exynos_irq_request_resources(struct irq_data *irqd) - - spin_unlock_irqrestore(&bank->slock, flags); - -- exynos_irq_unmask(irqd); -- - return 0; - } - -@@ -216,8 +214,6 @@ static void exynos_irq_release_resources(struct irq_data *irqd) - shift = irqd->hwirq * bank_type->fld_width[PINCFG_TYPE_FUNC]; - mask = (1 << bank_type->fld_width[PINCFG_TYPE_FUNC]) - 1; - -- exynos_irq_mask(irqd); -- - spin_lock_irqsave(&bank->slock, flags); - - con = readl(d->virt_base + reg_con); -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c -index 862a096c5dba..be5c71df148d 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun4i-a10.c -@@ -811,6 +811,7 @@ static const struct sunxi_desc_pin sun4i_a10_pins[] = { - SUNXI_FUNCTION(0x2, "lcd1"), /* D16 */ - SUNXI_FUNCTION(0x3, "pata"), /* ATAD12 */ - SUNXI_FUNCTION(0x4, "keypad"), /* IN6 */ -+ SUNXI_FUNCTION(0x5, "sim"), /* DET */ - SUNXI_FUNCTION_IRQ(0x6, 16), /* EINT16 */ - SUNXI_FUNCTION(0x7, "csi1")), /* D16 */ - SUNXI_PIN(SUNXI_PINCTRL_PIN(H, 17), -diff --git a/drivers/staging/iio/resolver/ad2s1210.c b/drivers/staging/iio/resolver/ad2s1210.c -index d97aa2827412..8eb7179da342 100644 ---- a/drivers/staging/iio/resolver/ad2s1210.c -+++ b/drivers/staging/iio/resolver/ad2s1210.c -@@ -468,7 +468,7 @@ static int ad2s1210_read_raw(struct iio_dev *indio_dev, - long m) - { - struct ad2s1210_state *st = iio_priv(indio_dev); -- bool negative; -+ u16 negative; - int ret = 0; - u16 pos; - s16 vel; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 31d5d9c0e10b..1ff1c83e2df5 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -418,6 +418,7 @@ int iscsit_reset_np_thread( - return 0; - } - np->np_thread_state = ISCSI_NP_THREAD_RESET; -+ atomic_inc(&np->np_reset_count); - - if (np->np_thread) { - spin_unlock_bh(&np->np_thread_lock); -@@ -1996,6 +1997,7 @@ iscsit_setup_text_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - cmd->cmd_sn = be32_to_cpu(hdr->cmdsn); - cmd->exp_stat_sn = be32_to_cpu(hdr->exp_statsn); - cmd->data_direction = DMA_NONE; -+ kfree(cmd->text_in_ptr); - cmd->text_in_ptr = NULL; - - return 0; -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index b19edffa7d98..bc2cbffec27e 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -1219,9 +1219,11 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - flush_signals(current); - - spin_lock_bh(&np->np_thread_lock); -- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { -+ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { - np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; -+ spin_unlock_bh(&np->np_thread_lock); - complete(&np->np_restart_comp); -+ return 1; - } else if (np->np_thread_state == ISCSI_NP_THREAD_SHUTDOWN) { - spin_unlock_bh(&np->np_thread_lock); - goto exit; -@@ -1254,7 +1256,8 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - goto exit; - } else if (rc < 0) { - spin_lock_bh(&np->np_thread_lock); -- if (np->np_thread_state == ISCSI_NP_THREAD_RESET) { -+ if (atomic_dec_if_positive(&np->np_reset_count) >= 0) { -+ np->np_thread_state = ISCSI_NP_THREAD_ACTIVE; - spin_unlock_bh(&np->np_thread_lock); - complete(&np->np_restart_comp); - iscsit_put_transport(conn->conn_transport); -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index b403596818db..5c0952995280 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -1851,7 +1851,7 @@ void usb_hcd_flush_endpoint(struct usb_device *udev, - /* No more submits can occur */ - spin_lock_irq(&hcd_urb_list_lock); - rescan: -- list_for_each_entry (urb, &ep->urb_list, urb_list) { -+ list_for_each_entry_reverse(urb, &ep->urb_list, urb_list) { - int is_in; - - if (urb->unlinked) -@@ -2448,6 +2448,8 @@ void usb_hc_died (struct usb_hcd *hcd) - } - if (usb_hcd_is_primary_hcd(hcd) && hcd->shared_hcd) { - hcd = hcd->shared_hcd; -+ clear_bit(HCD_FLAG_RH_RUNNING, &hcd->flags); -+ set_bit(HCD_FLAG_DEAD, &hcd->flags); - if (hcd->rh_registered) { - clear_bit(HCD_FLAG_POLL_RH, &hcd->flags); - -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 1d59d489a1ad..cdf4be3939f5 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4661,7 +4661,8 @@ hub_power_remaining(struct usb_hub *hub) - static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - u16 portchange) - { -- int status, i; -+ int status = -ENODEV; -+ int i; - unsigned unit_load; - struct usb_device *hdev = hub->hdev; - struct usb_hcd *hcd = bus_to_hcd(hdev->bus); -@@ -4865,9 +4866,10 @@ loop: - - done: - hub_port_disable(hub, port1, 1); -- if (hcd->driver->relinquish_port && !hub->hdev->parent) -- hcd->driver->relinquish_port(hcd, port1); -- -+ if (hcd->driver->relinquish_port && !hub->hdev->parent) { -+ if (status != -ENOTCONN && status != -ENODEV) -+ hcd->driver->relinquish_port(hcd, port1); -+ } - } - - /* Handle physical or logical connection change events. -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 3116edfcdc18..574da2b4529c 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -150,6 +150,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* appletouch */ - { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ -+ { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Avision AV600U */ - { USB_DEVICE(0x0638, 0x0a13), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -@@ -249,6 +252,7 @@ static const struct usb_device_id usb_amd_resume_quirk_list[] = { - { USB_DEVICE(0x093a, 0x2500), .driver_info = USB_QUIRK_RESET_RESUME }, - { USB_DEVICE(0x093a, 0x2510), .driver_info = USB_QUIRK_RESET_RESUME }, - { USB_DEVICE(0x093a, 0x2521), .driver_info = USB_QUIRK_RESET_RESUME }, -+ { USB_DEVICE(0x03f0, 0x2b4a), .driver_info = USB_QUIRK_RESET_RESUME }, - - /* Logitech Optical Mouse M90/M100 */ - { USB_DEVICE(0x046d, 0xc05a), .driver_info = USB_QUIRK_RESET_RESUME }, -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index f9400564cb72..03b9a372636f 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -89,6 +89,7 @@ enum amd_chipset_gen { - AMD_CHIPSET_HUDSON2, - AMD_CHIPSET_BOLTON, - AMD_CHIPSET_YANGTZE, -+ AMD_CHIPSET_TAISHAN, - AMD_CHIPSET_UNKNOWN, - }; - -@@ -132,6 +133,11 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo) - pinfo->sb_type.gen = AMD_CHIPSET_SB700; - else if (rev >= 0x40 && rev <= 0x4f) - pinfo->sb_type.gen = AMD_CHIPSET_SB800; -+ } -+ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, -+ 0x145c, NULL); -+ if (pinfo->smbus_dev) { -+ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; - } else { - pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, - PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL); -@@ -251,11 +257,12 @@ int usb_hcd_amd_remote_wakeup_quirk(struct pci_dev *pdev) - { - /* Make sure amd chipset type has already been initialized */ - usb_amd_find_chipset_info(); -- if (amd_chipset.sb_type.gen != AMD_CHIPSET_YANGTZE) -- return 0; -- -- dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); -- return 1; -+ if (amd_chipset.sb_type.gen == AMD_CHIPSET_YANGTZE || -+ amd_chipset.sb_type.gen == AMD_CHIPSET_TAISHAN) { -+ dev_dbg(&pdev->dev, "QUIRK: Enable AMD remote wakeup fix\n"); -+ return 1; -+ } -+ return 0; - } - EXPORT_SYMBOL_GPL(usb_hcd_amd_remote_wakeup_quirk); - -diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c -index 13d5614f37f1..0d843e0f8055 100644 ---- a/drivers/usb/musb/musb_host.c -+++ b/drivers/usb/musb/musb_host.c -@@ -138,6 +138,7 @@ static void musb_h_tx_flush_fifo(struct musb_hw_ep *ep) - "Could not flush host TX%d fifo: csr: %04x\n", - ep->epnum, csr)) - return; -+ mdelay(1); - } - } - -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index b0dc6da3d970..41a6513646de 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -135,6 +135,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8998) }, /* KCF Technologies PRN */ - { USB_DEVICE(0x10C4, 0x8A2A) }, /* HubZ dual ZigBee and Z-Wave dongle */ - { USB_DEVICE(0x10C4, 0x8A5E) }, /* CEL EM3588 ZigBee USB Stick Long Range */ -+ { USB_DEVICE(0x10C4, 0x8B34) }, /* Qivicon ZigBee USB Radio Stick */ - { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */ - { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index ebe51f11105d..fe123153b1a5 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2025,6 +2025,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ - { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x7e11, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/A3 */ -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 1db4b61bdf7b..a51b28379850 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, - { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, -+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_UC485) }, - { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, - { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, - { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 09d9be88209e..3b5a15d1dc0d 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -27,6 +27,7 @@ - #define ATEN_VENDOR_ID 0x0557 - #define ATEN_VENDOR_ID2 0x0547 - #define ATEN_PRODUCT_ID 0x2008 -+#define ATEN_PRODUCT_UC485 0x2021 - #define ATEN_PRODUCT_ID2 0x2118 - - #define IODATA_VENDOR_ID 0x04bb -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index 53341a77d89f..a37ed1e59e99 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -123,9 +123,9 @@ UNUSUAL_DEV(0x0bc2, 0xab2a, 0x0000, 0x9999, - /* Reported-by: Benjamin Tissoires */ - UNUSUAL_DEV(0x13fd, 0x3940, 0x0000, 0x9999, - "Initio Corporation", -- "", -+ "INIC-3069", - USB_SC_DEVICE, USB_PR_DEVICE, NULL, -- US_FL_NO_ATA_1X), -+ US_FL_NO_ATA_1X | US_FL_IGNORE_RESIDUE), - - /* Reported-by: Tom Arild Naess */ - UNUSUAL_DEV(0x152d, 0x0539, 0x0000, 0x9999, -diff --git a/fs/fuse/file.c b/fs/fuse/file.c -index 11538a8be9f0..1a063cbfe503 100644 ---- a/fs/fuse/file.c -+++ b/fs/fuse/file.c -@@ -46,7 +46,7 @@ struct fuse_file *fuse_file_alloc(struct fuse_conn *fc) - { - struct fuse_file *ff; - -- ff = kmalloc(sizeof(struct fuse_file), GFP_KERNEL); -+ ff = kzalloc(sizeof(struct fuse_file), GFP_KERNEL); - if (unlikely(!ff)) - return NULL; - -diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig -index f31fd0dd92c6..b1daeafbea92 100644 ---- a/fs/nfs/Kconfig -+++ b/fs/nfs/Kconfig -@@ -121,6 +121,7 @@ config PNFS_FILE_LAYOUT - config PNFS_BLOCK - tristate - depends on NFS_V4_1 && BLK_DEV_DM -+ depends on 64BIT || LBDAF - default NFS_V4 - - config PNFS_OBJLAYOUT -diff --git a/fs/nfs/flexfilelayout/flexfilelayoutdev.c b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -index e125e55de86d..2603d7589946 100644 ---- a/fs/nfs/flexfilelayout/flexfilelayoutdev.c -+++ b/fs/nfs/flexfilelayout/flexfilelayoutdev.c -@@ -30,6 +30,7 @@ void nfs4_ff_layout_free_deviceid(struct nfs4_ff_layout_ds *mirror_ds) - { - nfs4_print_deviceid(&mirror_ds->id_node.deviceid); - nfs4_pnfs_ds_put(mirror_ds->ds); -+ kfree(mirror_ds->ds_versions); - kfree_rcu(mirror_ds, id_node.rcu); - } - -diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h -index 85a868ccb493..8397dc235e84 100644 ---- a/include/linux/cpuset.h -+++ b/include/linux/cpuset.h -@@ -16,6 +16,7 @@ - - #ifdef CONFIG_CPUSETS - -+extern struct static_key cpusets_pre_enable_key; - extern struct static_key cpusets_enabled_key; - static inline bool cpusets_enabled(void) - { -@@ -30,12 +31,14 @@ static inline int nr_cpusets(void) - - static inline void cpuset_inc(void) - { -+ static_key_slow_inc(&cpusets_pre_enable_key); - static_key_slow_inc(&cpusets_enabled_key); - } - - static inline void cpuset_dec(void) - { - static_key_slow_dec(&cpusets_enabled_key); -+ static_key_slow_dec(&cpusets_pre_enable_key); - } - - extern int cpuset_init(void); -@@ -104,7 +107,7 @@ extern void cpuset_print_current_mems_allowed(void); - */ - static inline unsigned int read_mems_allowed_begin(void) - { -- if (!cpusets_enabled()) -+ if (!static_key_false(&cpusets_pre_enable_key)) - return 0; - - return read_seqcount_begin(¤t->mems_allowed_seq); -@@ -118,7 +121,7 @@ static inline unsigned int read_mems_allowed_begin(void) - */ - static inline bool read_mems_allowed_retry(unsigned int seq) - { -- if (!cpusets_enabled()) -+ if (!static_key_false(&cpusets_enabled_key)) - return false; - - return read_seqcount_retry(¤t->mems_allowed_seq, seq); -diff --git a/include/target/iscsi/iscsi_target_core.h b/include/target/iscsi/iscsi_target_core.h -index fdda45f26f75..22f442ab85f9 100644 ---- a/include/target/iscsi/iscsi_target_core.h -+++ b/include/target/iscsi/iscsi_target_core.h -@@ -784,6 +784,7 @@ struct iscsi_np { - int np_sock_type; - enum np_thread_state_table np_thread_state; - bool enabled; -+ atomic_t np_reset_count; - enum iscsi_timer_flags_table np_login_timer_flags; - u32 np_exports; - enum np_flags_table np_flags; -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 3b5e5430f5d0..8ccd66a97c8b 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -60,6 +60,7 @@ - #include - #include - -+struct static_key cpusets_pre_enable_key __read_mostly = STATIC_KEY_INIT_FALSE; - struct static_key cpusets_enabled_key __read_mostly = STATIC_KEY_INIT_FALSE; - - /* See "Frequency meter" comments, below. */ -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index f9d648fce8cd..53286b2f5b1c 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -6804,7 +6804,7 @@ int alloc_contig_range(unsigned long start, unsigned long end, - - /* Make sure the range is really isolated. */ - if (test_pages_isolated(outer_start, end, false)) { -- pr_info("%s: [%lx, %lx) PFNs busy\n", -+ pr_info_ratelimited("%s: [%lx, %lx) PFNs busy\n", - __func__, outer_start, end); - ret = -EBUSY; - goto done; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.83-84.patch b/patch/kernel/mvebu64-default/03-patch-4.4.83-84.patch deleted file mode 100644 index 74a42d331227..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.83-84.patch +++ /dev/null @@ -1,761 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7f67b35caf99..9d77ac063ec0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 83 -+SUBLEVEL = 84 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/include/asm/elf.h b/arch/arm64/include/asm/elf.h -index 9e11dbe1cec3..329c127e13dc 100644 ---- a/arch/arm64/include/asm/elf.h -+++ b/arch/arm64/include/asm/elf.h -@@ -121,10 +121,10 @@ typedef struct user_fpsimd_state elf_fpregset_t; - - /* - * This is the base location for PIE (ET_DYN with INTERP) loads. On -- * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * 64-bit, this is above 4GB to leave the entire 32-bit address - * space open for things that want to use the area for 32-bit pointers. - */ --#define ELF_ET_DYN_BASE 0x100000000UL -+#define ELF_ET_DYN_BASE (2 * TASK_SIZE_64 / 3) - - /* - * When the program starts, a1 contains a pointer to a function to be -diff --git a/arch/x86/crypto/sha1_avx2_x86_64_asm.S b/arch/x86/crypto/sha1_avx2_x86_64_asm.S -index 1cd792db15ef..1eab79c9ac48 100644 ---- a/arch/x86/crypto/sha1_avx2_x86_64_asm.S -+++ b/arch/x86/crypto/sha1_avx2_x86_64_asm.S -@@ -117,11 +117,10 @@ - .set T1, REG_T1 - .endm - --#define K_BASE %r8 - #define HASH_PTR %r9 -+#define BLOCKS_CTR %r8 - #define BUFFER_PTR %r10 - #define BUFFER_PTR2 %r13 --#define BUFFER_END %r11 - - #define PRECALC_BUF %r14 - #define WK_BUF %r15 -@@ -205,14 +204,14 @@ - * blended AVX2 and ALU instruction scheduling - * 1 vector iteration per 8 rounds - */ -- vmovdqu ((i * 2) + PRECALC_OFFSET)(BUFFER_PTR), W_TMP -+ vmovdqu (i * 2)(BUFFER_PTR), W_TMP - .elseif ((i & 7) == 1) -- vinsertf128 $1, (((i-1) * 2)+PRECALC_OFFSET)(BUFFER_PTR2),\ -+ vinsertf128 $1, ((i-1) * 2)(BUFFER_PTR2),\ - WY_TMP, WY_TMP - .elseif ((i & 7) == 2) - vpshufb YMM_SHUFB_BSWAP, WY_TMP, WY - .elseif ((i & 7) == 4) -- vpaddd K_XMM(K_BASE), WY, WY_TMP -+ vpaddd K_XMM + K_XMM_AR(%rip), WY, WY_TMP - .elseif ((i & 7) == 7) - vmovdqu WY_TMP, PRECALC_WK(i&~7) - -@@ -255,7 +254,7 @@ - vpxor WY, WY_TMP, WY_TMP - .elseif ((i & 7) == 7) - vpxor WY_TMP2, WY_TMP, WY -- vpaddd K_XMM(K_BASE), WY, WY_TMP -+ vpaddd K_XMM + K_XMM_AR(%rip), WY, WY_TMP - vmovdqu WY_TMP, PRECALC_WK(i&~7) - - PRECALC_ROTATE_WY -@@ -291,7 +290,7 @@ - vpsrld $30, WY, WY - vpor WY, WY_TMP, WY - .elseif ((i & 7) == 7) -- vpaddd K_XMM(K_BASE), WY, WY_TMP -+ vpaddd K_XMM + K_XMM_AR(%rip), WY, WY_TMP - vmovdqu WY_TMP, PRECALC_WK(i&~7) - - PRECALC_ROTATE_WY -@@ -446,6 +445,16 @@ - - .endm - -+/* Add constant only if (%2 > %3) condition met (uses RTA as temp) -+ * %1 + %2 >= %3 ? %4 : 0 -+ */ -+.macro ADD_IF_GE a, b, c, d -+ mov \a, RTA -+ add $\d, RTA -+ cmp $\c, \b -+ cmovge RTA, \a -+.endm -+ - /* - * macro implements 80 rounds of SHA-1, for multiple blocks with s/w pipelining - */ -@@ -463,13 +472,16 @@ - lea (2*4*80+32)(%rsp), WK_BUF - - # Precalc WK for first 2 blocks -- PRECALC_OFFSET = 0 -+ ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 2, 64 - .set i, 0 - .rept 160 - PRECALC i - .set i, i + 1 - .endr -- PRECALC_OFFSET = 128 -+ -+ /* Go to next block if needed */ -+ ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 3, 128 -+ ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128 - xchg WK_BUF, PRECALC_BUF - - .align 32 -@@ -479,8 +491,8 @@ _loop: - * we use K_BASE value as a signal of a last block, - * it is set below by: cmovae BUFFER_PTR, K_BASE - */ -- cmp K_BASE, BUFFER_PTR -- jne _begin -+ test BLOCKS_CTR, BLOCKS_CTR -+ jnz _begin - .align 32 - jmp _end - .align 32 -@@ -512,10 +524,10 @@ _loop0: - .set j, j+2 - .endr - -- add $(2*64), BUFFER_PTR /* move to next odd-64-byte block */ -- cmp BUFFER_END, BUFFER_PTR /* is current block the last one? */ -- cmovae K_BASE, BUFFER_PTR /* signal the last iteration smartly */ -- -+ /* Update Counter */ -+ sub $1, BLOCKS_CTR -+ /* Move to the next block only if needed*/ -+ ADD_IF_GE BUFFER_PTR, BLOCKS_CTR, 4, 128 - /* - * rounds - * 60,62,64,66,68 -@@ -532,8 +544,8 @@ _loop0: - UPDATE_HASH 12(HASH_PTR), D - UPDATE_HASH 16(HASH_PTR), E - -- cmp K_BASE, BUFFER_PTR /* is current block the last one? */ -- je _loop -+ test BLOCKS_CTR, BLOCKS_CTR -+ jz _loop - - mov TB, B - -@@ -575,10 +587,10 @@ _loop2: - .set j, j+2 - .endr - -- add $(2*64), BUFFER_PTR2 /* move to next even-64-byte block */ -- -- cmp BUFFER_END, BUFFER_PTR2 /* is current block the last one */ -- cmovae K_BASE, BUFFER_PTR /* signal the last iteration smartly */ -+ /* update counter */ -+ sub $1, BLOCKS_CTR -+ /* Move to the next block only if needed*/ -+ ADD_IF_GE BUFFER_PTR2, BLOCKS_CTR, 4, 128 - - jmp _loop3 - _loop3: -@@ -641,19 +653,12 @@ _loop3: - - avx2_zeroupper - -- lea K_XMM_AR(%rip), K_BASE -- -+ /* Setup initial values */ - mov CTX, HASH_PTR - mov BUF, BUFFER_PTR -- lea 64(BUF), BUFFER_PTR2 -- -- shl $6, CNT /* mul by 64 */ -- add BUF, CNT -- add $64, CNT -- mov CNT, BUFFER_END - -- cmp BUFFER_END, BUFFER_PTR2 -- cmovae K_BASE, BUFFER_PTR2 -+ mov BUF, BUFFER_PTR2 -+ mov CNT, BLOCKS_CTR - - xmm_mov BSWAP_SHUFB_CTL(%rip), YMM_SHUFB_BSWAP - -diff --git a/arch/x86/crypto/sha1_ssse3_glue.c b/arch/x86/crypto/sha1_ssse3_glue.c -index 7de207a11014..dd14616b7739 100644 ---- a/arch/x86/crypto/sha1_ssse3_glue.c -+++ b/arch/x86/crypto/sha1_ssse3_glue.c -@@ -201,7 +201,7 @@ asmlinkage void sha1_transform_avx2(u32 *digest, const char *data, - - static bool avx2_usable(void) - { -- if (false && avx_usable() && boot_cpu_has(X86_FEATURE_AVX2) -+ if (avx_usable() && boot_cpu_has(X86_FEATURE_AVX2) - && boot_cpu_has(X86_FEATURE_BMI1) - && boot_cpu_has(X86_FEATURE_BMI2)) - return true; -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index a55697d19824..cc0f2f5da19b 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -1190,6 +1190,8 @@ ENTRY(nmi) - * other IST entries. - */ - -+ ASM_CLAC -+ - /* Use %rdx as our temp variable throughout */ - pushq %rdx - -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index 07cf288b692e..bcd3d6199464 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -247,11 +247,11 @@ extern int force_personality32; - - /* - * This is the base location for PIE (ET_DYN with INTERP) loads. On -- * 64-bit, this is raised to 4GB to leave the entire 32-bit address -+ * 64-bit, this is above 4GB to leave the entire 32-bit address - * space open for things that want to use the area for 32-bit pointers. - */ - #define ELF_ET_DYN_BASE (mmap_is_ia32() ? 0x000400000UL : \ -- 0x100000000UL) -+ (TASK_SIZE / 3 * 2)) - - /* This yields a mask that user programs can use to figure out what - instruction set this CPU supports. This could be done in user space, -diff --git a/arch/x86/kernel/cpu/perf_event_intel_lbr.c b/arch/x86/kernel/cpu/perf_event_intel_lbr.c -index 8900400230c6..2cdae69d7e0b 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_lbr.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_lbr.c -@@ -153,7 +153,7 @@ static void __intel_pmu_lbr_enable(bool pmi) - */ - if (cpuc->lbr_sel) - lbr_select = cpuc->lbr_sel->config; -- if (!pmi) -+ if (!pmi && cpuc->lbr_sel) - wrmsrl(MSR_LBR_SELECT, lbr_select); - - rdmsrl(MSR_IA32_DEBUGCTLMSR, debugctl); -@@ -432,8 +432,10 @@ static void intel_pmu_lbr_read_64(struct cpu_hw_events *cpuc) - int out = 0; - int num = x86_pmu.lbr_nr; - -- if (cpuc->lbr_sel->config & LBR_CALL_STACK) -- num = tos; -+ if (cpuc->lbr_sel) { -+ if (cpuc->lbr_sel->config & LBR_CALL_STACK) -+ num = tos; -+ } - - for (i = 0; i < num; i++) { - unsigned long lbr_idx = (tos - i) & mask; -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index da5458dfb1e3..98d4e515587a 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1235,6 +1235,10 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0100", 0 }, - { "ELAN0600", 0 }, - { "ELAN0605", 0 }, -+ { "ELAN0608", 0 }, -+ { "ELAN0605", 0 }, -+ { "ELAN0609", 0 }, -+ { "ELAN060B", 0 }, - { "ELAN1000", 0 }, - { } - }; -diff --git a/drivers/irqchip/irq-atmel-aic-common.c b/drivers/irqchip/irq-atmel-aic-common.c -index 37199b9b2cfa..831a195cb806 100644 ---- a/drivers/irqchip/irq-atmel-aic-common.c -+++ b/drivers/irqchip/irq-atmel-aic-common.c -@@ -148,9 +148,9 @@ void __init aic_common_rtc_irq_fixup(struct device_node *root) - struct device_node *np; - void __iomem *regs; - -- np = of_find_compatible_node(root, NULL, "atmel,at91rm9200-rtc"); -+ np = of_find_compatible_node(NULL, NULL, "atmel,at91rm9200-rtc"); - if (!np) -- np = of_find_compatible_node(root, NULL, -+ np = of_find_compatible_node(NULL, NULL, - "atmel,at91sam9x5-rtc"); - - if (!np) -@@ -202,7 +202,6 @@ void __init aic_common_irq_fixup(const struct of_device_id *matches) - return; - - match = of_match_node(matches, root); -- of_node_put(root); - - if (match) { - void (*fixup)(struct device_node *) = match->data; -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 582d8f0c6266..958af3b1af7f 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -707,6 +707,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ - {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ - {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ -+ {QMI_FIXED_INTF(0x2001, 0x7e35, 4)}, /* D-Link DWM-222 */ - {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ - {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ - {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ -diff --git a/drivers/parisc/dino.c b/drivers/parisc/dino.c -index 7b0ca1551d7b..005ea632ba53 100644 ---- a/drivers/parisc/dino.c -+++ b/drivers/parisc/dino.c -@@ -954,7 +954,7 @@ static int __init dino_probe(struct parisc_device *dev) - - dino_dev->hba.dev = dev; - dino_dev->hba.base_addr = ioremap_nocache(hpa, 4096); -- dino_dev->hba.lmmio_space_offset = 0; /* CPU addrs == bus addrs */ -+ dino_dev->hba.lmmio_space_offset = PCI_F_EXTEND; - spin_lock_init(&dino_dev->dinosaur_pen); - dino_dev->hba.iommu = ccio_get_iommu(dev); - -diff --git a/drivers/usb/core/usb-acpi.c b/drivers/usb/core/usb-acpi.c -index 2776cfe64c09..ef9cf4a21afe 100644 ---- a/drivers/usb/core/usb-acpi.c -+++ b/drivers/usb/core/usb-acpi.c -@@ -127,6 +127,22 @@ out: - */ - #define USB_ACPI_LOCATION_VALID (1 << 31) - -+static struct acpi_device *usb_acpi_find_port(struct acpi_device *parent, -+ int raw) -+{ -+ struct acpi_device *adev; -+ -+ if (!parent) -+ return NULL; -+ -+ list_for_each_entry(adev, &parent->children, node) { -+ if (acpi_device_adr(adev) == raw) -+ return adev; -+ } -+ -+ return acpi_find_child_device(parent, raw, false); -+} -+ - static struct acpi_device *usb_acpi_find_companion(struct device *dev) - { - struct usb_device *udev; -@@ -174,8 +190,10 @@ static struct acpi_device *usb_acpi_find_companion(struct device *dev) - int raw; - - raw = usb_hcd_find_raw_port_number(hcd, port1); -- adev = acpi_find_child_device(ACPI_COMPANION(&udev->dev), -- raw, false); -+ -+ adev = usb_acpi_find_port(ACPI_COMPANION(&udev->dev), -+ raw); -+ - if (!adev) - return NULL; - } else { -@@ -186,7 +204,9 @@ static struct acpi_device *usb_acpi_find_companion(struct device *dev) - return NULL; - - acpi_bus_get_device(parent_handle, &adev); -- adev = acpi_find_child_device(adev, port1, false); -+ -+ adev = usb_acpi_find_port(adev, port1); -+ - if (!adev) - return NULL; - } -diff --git a/drivers/xen/biomerge.c b/drivers/xen/biomerge.c -index 4da69dbf7dca..1bdd02a6d6ac 100644 ---- a/drivers/xen/biomerge.c -+++ b/drivers/xen/biomerge.c -@@ -10,8 +10,7 @@ bool xen_biovec_phys_mergeable(const struct bio_vec *vec1, - unsigned long bfn1 = pfn_to_bfn(page_to_pfn(vec1->bv_page)); - unsigned long bfn2 = pfn_to_bfn(page_to_pfn(vec2->bv_page)); - -- return __BIOVEC_PHYS_MERGEABLE(vec1, vec2) && -- ((bfn1 == bfn2) || ((bfn1+1) == bfn2)); -+ return bfn1 + PFN_DOWN(vec1->bv_offset + vec1->bv_len) == bfn2; - #else - /* - * XXX: Add support for merging bio_vec when using different page -diff --git a/include/linux/pid.h b/include/linux/pid.h -index 23705a53abba..97b745ddece5 100644 ---- a/include/linux/pid.h -+++ b/include/linux/pid.h -@@ -8,7 +8,9 @@ enum pid_type - PIDTYPE_PID, - PIDTYPE_PGID, - PIDTYPE_SID, -- PIDTYPE_MAX -+ PIDTYPE_MAX, -+ /* only valid to __task_pid_nr_ns() */ -+ __PIDTYPE_TGID - }; - - /* -diff --git a/include/linux/sched.h b/include/linux/sched.h -index eff7c1fad26f..e887c8d6f395 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1949,31 +1949,8 @@ static inline pid_t task_tgid_nr(struct task_struct *tsk) - return tsk->tgid; - } - --pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns); -- --static inline pid_t task_tgid_vnr(struct task_struct *tsk) --{ -- return pid_vnr(task_tgid(tsk)); --} -- - - static inline int pid_alive(const struct task_struct *p); --static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns) --{ -- pid_t pid = 0; -- -- rcu_read_lock(); -- if (pid_alive(tsk)) -- pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns); -- rcu_read_unlock(); -- -- return pid; --} -- --static inline pid_t task_ppid_nr(const struct task_struct *tsk) --{ -- return task_ppid_nr_ns(tsk, &init_pid_ns); --} - - static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk, - struct pid_namespace *ns) -@@ -1998,6 +1975,33 @@ static inline pid_t task_session_vnr(struct task_struct *tsk) - return __task_pid_nr_ns(tsk, PIDTYPE_SID, NULL); - } - -+static inline pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns) -+{ -+ return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, ns); -+} -+ -+static inline pid_t task_tgid_vnr(struct task_struct *tsk) -+{ -+ return __task_pid_nr_ns(tsk, __PIDTYPE_TGID, NULL); -+} -+ -+static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns) -+{ -+ pid_t pid = 0; -+ -+ rcu_read_lock(); -+ if (pid_alive(tsk)) -+ pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns); -+ rcu_read_unlock(); -+ -+ return pid; -+} -+ -+static inline pid_t task_ppid_nr(const struct task_struct *tsk) -+{ -+ return task_ppid_nr_ns(tsk, &init_pid_ns); -+} -+ - /* obsolete, do not use */ - static inline pid_t task_pgrp_nr(struct task_struct *tsk) - { -diff --git a/kernel/audit_watch.c b/kernel/audit_watch.c -index 939945a5649c..a162661c9d60 100644 ---- a/kernel/audit_watch.c -+++ b/kernel/audit_watch.c -@@ -457,13 +457,15 @@ void audit_remove_watch_rule(struct audit_krule *krule) - list_del(&krule->rlist); - - if (list_empty(&watch->rules)) { -+ /* -+ * audit_remove_watch() drops our reference to 'parent' which -+ * can get freed. Grab our own reference to be safe. -+ */ -+ audit_get_parent(parent); - audit_remove_watch(watch); -- -- if (list_empty(&parent->watches)) { -- audit_get_parent(parent); -+ if (list_empty(&parent->watches)) - fsnotify_destroy_mark(&parent->mark, audit_watch_group); -- audit_put_parent(parent); -- } -+ audit_put_parent(parent); - } - } - -diff --git a/kernel/pid.c b/kernel/pid.c -index 78b3d9f80d44..b17263be9082 100644 ---- a/kernel/pid.c -+++ b/kernel/pid.c -@@ -526,8 +526,11 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, - if (!ns) - ns = task_active_pid_ns(current); - if (likely(pid_alive(task))) { -- if (type != PIDTYPE_PID) -+ if (type != PIDTYPE_PID) { -+ if (type == __PIDTYPE_TGID) -+ type = PIDTYPE_PID; - task = task->group_leader; -+ } - nr = pid_nr_ns(rcu_dereference(task->pids[type].pid), ns); - } - rcu_read_unlock(); -@@ -536,12 +539,6 @@ pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type, - } - EXPORT_SYMBOL(__task_pid_nr_ns); - --pid_t task_tgid_nr_ns(struct task_struct *tsk, struct pid_namespace *ns) --{ -- return pid_nr_ns(task_tgid(tsk), ns); --} --EXPORT_SYMBOL(task_tgid_nr_ns); -- - struct pid_namespace *task_active_pid_ns(struct task_struct *tsk) - { - return ns_of_pid(task_pid(tsk)); -diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index e09b1a0e2cfe..c947014d128a 100644 ---- a/mm/mempolicy.c -+++ b/mm/mempolicy.c -@@ -894,11 +894,6 @@ static long do_get_mempolicy(int *policy, nodemask_t *nmask, - *policy |= (pol->flags & MPOL_MODE_FLAGS); - } - -- if (vma) { -- up_read(¤t->mm->mmap_sem); -- vma = NULL; -- } -- - err = 0; - if (nmask) { - if (mpol_store_user_nodemask(pol)) { -diff --git a/mm/migrate.c b/mm/migrate.c -index 72c09dea6526..afedcfab60e2 100644 ---- a/mm/migrate.c -+++ b/mm/migrate.c -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - - #include - -@@ -1483,7 +1484,6 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, - const int __user *, nodes, - int __user *, status, int, flags) - { -- const struct cred *cred = current_cred(), *tcred; - struct task_struct *task; - struct mm_struct *mm; - int err; -@@ -1507,14 +1507,9 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, unsigned long, nr_pages, - - /* - * Check if this process has the right to modify the specified -- * process. The right exists if the process has administrative -- * capabilities, superuser privileges or the same -- * userid as the target process. -+ * process. Use the regular "ptrace_may_access()" checks. - */ -- tcred = __task_cred(task); -- if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) && -- !uid_eq(cred->uid, tcred->suid) && !uid_eq(cred->uid, tcred->uid) && -- !capable(CAP_SYS_NICE)) { -+ if (!ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) { - rcu_read_unlock(); - err = -EPERM; - goto out; -diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c -index 1a9545965c0d..531ca55f1af6 100644 ---- a/net/netfilter/nf_conntrack_extend.c -+++ b/net/netfilter/nf_conntrack_extend.c -@@ -53,7 +53,11 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, - - rcu_read_lock(); - t = rcu_dereference(nf_ct_ext_types[id]); -- BUG_ON(t == NULL); -+ if (!t) { -+ rcu_read_unlock(); -+ return NULL; -+ } -+ - off = ALIGN(sizeof(struct nf_ct_ext), t->align); - len = off + t->len + var_alloc_len; - alloc_size = t->alloc_size + var_alloc_len; -@@ -88,7 +92,10 @@ void *__nf_ct_ext_add_length(struct nf_conn *ct, enum nf_ct_ext_id id, - - rcu_read_lock(); - t = rcu_dereference(nf_ct_ext_types[id]); -- BUG_ON(t == NULL); -+ if (!t) { -+ rcu_read_unlock(); -+ return NULL; -+ } - - newoff = ALIGN(old->len, t->align); - newlen = newoff + t->len + var_alloc_len; -@@ -186,6 +193,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type) - RCU_INIT_POINTER(nf_ct_ext_types[type->id], NULL); - update_alloc_size(type); - mutex_unlock(&nf_ct_ext_type_mutex); -- rcu_barrier(); /* Wait for completion of call_rcu()'s */ -+ synchronize_rcu(); - } - EXPORT_SYMBOL_GPL(nf_ct_extend_unregister); -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index c67f9c212dd1..e326c1d80416 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1530,19 +1530,14 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, - void __user *arg) - { - struct snd_seq_queue_info info; -- int result; - struct snd_seq_queue *q; - - if (copy_from_user(&info, arg, sizeof(info))) - return -EFAULT; - -- result = snd_seq_queue_alloc(client->number, info.locked, info.flags); -- if (result < 0) -- return result; -- -- q = queueptr(result); -- if (q == NULL) -- return -EINVAL; -+ q = snd_seq_queue_alloc(client->number, info.locked, info.flags); -+ if (IS_ERR(q)) -+ return PTR_ERR(q); - - info.queue = q->queue; - info.locked = q->locked; -@@ -1552,7 +1547,7 @@ static int snd_seq_ioctl_create_queue(struct snd_seq_client *client, - if (! info.name[0]) - snprintf(info.name, sizeof(info.name), "Queue-%d", q->queue); - strlcpy(q->name, info.name, sizeof(q->name)); -- queuefree(q); -+ snd_use_lock_free(&q->use_lock); - - if (copy_to_user(arg, &info, sizeof(info))) - return -EFAULT; -diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c -index 450c5187eecb..79e0c5604ef8 100644 ---- a/sound/core/seq/seq_queue.c -+++ b/sound/core/seq/seq_queue.c -@@ -184,22 +184,26 @@ void __exit snd_seq_queues_delete(void) - static void queue_use(struct snd_seq_queue *queue, int client, int use); - - /* allocate a new queue - -- * return queue index value or negative value for error -+ * return pointer to new queue or ERR_PTR(-errno) for error -+ * The new queue's use_lock is set to 1. It is the caller's responsibility to -+ * call snd_use_lock_free(&q->use_lock). - */ --int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags) -+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int info_flags) - { - struct snd_seq_queue *q; - - q = queue_new(client, locked); - if (q == NULL) -- return -ENOMEM; -+ return ERR_PTR(-ENOMEM); - q->info_flags = info_flags; - queue_use(q, client, 1); -+ snd_use_lock_use(&q->use_lock); - if (queue_list_add(q) < 0) { -+ snd_use_lock_free(&q->use_lock); - queue_delete(q); -- return -ENOMEM; -+ return ERR_PTR(-ENOMEM); - } -- return q->queue; -+ return q; - } - - /* delete a queue - queue must be owned by the client */ -diff --git a/sound/core/seq/seq_queue.h b/sound/core/seq/seq_queue.h -index 30c8111477f6..719093489a2c 100644 ---- a/sound/core/seq/seq_queue.h -+++ b/sound/core/seq/seq_queue.h -@@ -71,7 +71,7 @@ void snd_seq_queues_delete(void); - - - /* create new queue (constructor) */ --int snd_seq_queue_alloc(int client, int locked, unsigned int flags); -+struct snd_seq_queue *snd_seq_queue_alloc(int client, int locked, unsigned int flags); - - /* delete queue (destructor) */ - int snd_seq_queue_delete(int client, int queueid); -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 499b03c8281d..696de5ac69be 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -541,6 +541,8 @@ int snd_usb_mixer_vol_tlv(struct snd_kcontrol *kcontrol, int op_flag, - - if (size < sizeof(scale)) - return -ENOMEM; -+ if (cval->min_mute) -+ scale[0] = SNDRV_CTL_TLVT_DB_MINMAX_MUTE; - scale[2] = cval->dBmin; - scale[3] = cval->dBmax; - if (copy_to_user(_tlv, scale, sizeof(scale))) -diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h -index 3417ef347e40..2b4b067646ab 100644 ---- a/sound/usb/mixer.h -+++ b/sound/usb/mixer.h -@@ -64,6 +64,7 @@ struct usb_mixer_elem_info { - int cached; - int cache_val[MAX_CHANNELS]; - u8 initialized; -+ u8 min_mute; - void *private_data; - }; - -diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c -index 04991b009132..5d2fc5f58bfe 100644 ---- a/sound/usb/mixer_quirks.c -+++ b/sound/usb/mixer_quirks.c -@@ -1873,6 +1873,12 @@ void snd_usb_mixer_fu_apply_quirk(struct usb_mixer_interface *mixer, - if (unitid == 7 && cval->control == UAC_FU_VOLUME) - snd_dragonfly_quirk_db_scale(mixer, cval, kctl); - break; -+ /* lowest playback value is muted on C-Media devices */ -+ case USB_ID(0x0d8c, 0x000c): -+ case USB_ID(0x0d8c, 0x0014): -+ if (strstr(kctl->id.name, "Playback")) -+ cval->min_mute = 1; -+ break; - } - } - -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 29f38e2b4ca9..1cc20d138dae 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1143,6 +1143,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip) - case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */ - case USB_ID(0x05A3, 0x9420): /* ELP HD USB Camera */ - case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */ -+ case USB_ID(0x1395, 0x740a): /* Sennheiser DECT */ - case USB_ID(0x1901, 0x0191): /* GE B850V3 CP2114 audio interface */ - case USB_ID(0x1de7, 0x0013): /* Phoenix Audio MT202exe */ - case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */ diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.84-85.patch b/patch/kernel/mvebu64-default/03-patch-4.4.84-85.patch deleted file mode 100644 index 27aa21d04797..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.84-85.patch +++ /dev/null @@ -1,1511 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9d77ac063ec0..0f3d843f42a7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 84 -+SUBLEVEL = 85 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h -index 210ef3e72332..0ddd7144c492 100644 ---- a/arch/arc/include/asm/cache.h -+++ b/arch/arc/include/asm/cache.h -@@ -88,7 +88,9 @@ extern int ioc_exists; - #define ARC_REG_SLC_FLUSH 0x904 - #define ARC_REG_SLC_INVALIDATE 0x905 - #define ARC_REG_SLC_RGN_START 0x914 -+#define ARC_REG_SLC_RGN_START1 0x915 - #define ARC_REG_SLC_RGN_END 0x916 -+#define ARC_REG_SLC_RGN_END1 0x917 - - /* Bit val in SLC_CONTROL */ - #define SLC_CTRL_IM 0x040 -diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c -index d81b6d7e11e7..9a84cbdd44b0 100644 ---- a/arch/arc/mm/cache.c -+++ b/arch/arc/mm/cache.c -@@ -543,6 +543,7 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op) - static DEFINE_SPINLOCK(lock); - unsigned long flags; - unsigned int ctrl; -+ phys_addr_t end; - - spin_lock_irqsave(&lock, flags); - -@@ -572,8 +573,16 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op) - * END needs to be setup before START (latter triggers the operation) - * END can't be same as START, so add (l2_line_sz - 1) to sz - */ -- write_aux_reg(ARC_REG_SLC_RGN_END, (paddr + sz + l2_line_sz - 1)); -- write_aux_reg(ARC_REG_SLC_RGN_START, paddr); -+ end = paddr + sz + l2_line_sz - 1; -+ if (is_pae40_enabled()) -+ write_aux_reg(ARC_REG_SLC_RGN_END1, upper_32_bits(end)); -+ -+ write_aux_reg(ARC_REG_SLC_RGN_END, lower_32_bits(end)); -+ -+ if (is_pae40_enabled()) -+ write_aux_reg(ARC_REG_SLC_RGN_START1, upper_32_bits(paddr)); -+ -+ write_aux_reg(ARC_REG_SLC_RGN_START, lower_32_bits(paddr)); - - while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY); - -diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c -index eac4f3b02df9..bb81cd05f0bc 100644 ---- a/drivers/acpi/apei/ghes.c -+++ b/drivers/acpi/apei/ghes.c -@@ -1067,6 +1067,7 @@ static int ghes_remove(struct platform_device *ghes_dev) - if (list_empty(&ghes_sci)) - unregister_acpi_hed_notifier(&ghes_notifier_sci); - mutex_unlock(&ghes_list_mutex); -+ synchronize_rcu(); - break; - case ACPI_HEST_NOTIFY_NMI: - ghes_nmi_remove(ghes); -diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c -index ccdc8db16bb8..fa2cf2dc4e33 100644 ---- a/drivers/acpi/ioapic.c -+++ b/drivers/acpi/ioapic.c -@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data) - struct resource *res = data; - struct resource_win win; - -+ /* -+ * We might assign this to 'res' later, make sure all pointers are -+ * cleared before the resource is added to the global list -+ */ -+ memset(&win, 0, sizeof(win)); -+ - res->flags = 0; - if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM) == 0) - return AE_OK; -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 47ddfefe2443..5531f020e561 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -1718,8 +1718,12 @@ static void binder_transaction(struct binder_proc *proc, - list_add_tail(&t->work.entry, target_list); - tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE; - list_add_tail(&tcomplete->entry, &thread->todo); -- if (target_wait) -- wake_up_interruptible(target_wait); -+ if (target_wait) { -+ if (reply || !(t->flags & TF_ONE_WAY)) -+ wake_up_interruptible_sync(target_wait); -+ else -+ wake_up_interruptible(target_wait); -+ } - return; - - err_get_unused_fd_failed: -@@ -2865,7 +2869,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma) - const char *failure_string; - struct binder_buffer *buffer; - -- if (proc->tsk != current) -+ if (proc->tsk != current->group_leader) - return -EINVAL; - - if ((vma->vm_end - vma->vm_start) > SZ_4M) -@@ -2966,8 +2970,8 @@ static int binder_open(struct inode *nodp, struct file *filp) - proc = kzalloc(sizeof(*proc), GFP_KERNEL); - if (proc == NULL) - return -ENOMEM; -- get_task_struct(current); -- proc->tsk = current; -+ get_task_struct(current->group_leader); -+ proc->tsk = current->group_leader; - INIT_LIST_HEAD(&proc->todo); - init_waitqueue_head(&proc->wait); - proc->default_priority = task_nice(current); -diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c -index 6253775b8d9c..50d74e5ce41b 100644 ---- a/drivers/gpu/drm/drm_atomic.c -+++ b/drivers/gpu/drm/drm_atomic.c -@@ -1247,6 +1247,9 @@ int drm_atomic_check_only(struct drm_atomic_state *state) - if (config->funcs->atomic_check) - ret = config->funcs->atomic_check(state->dev, state); - -+ if (ret) -+ return ret; -+ - if (!state->allow_modeset) { - for_each_crtc_in_state(state, crtc, crtc_state, i) { - if (drm_atomic_crtc_needs_modeset(crtc_state)) { -@@ -1257,7 +1260,7 @@ int drm_atomic_check_only(struct drm_atomic_state *state) - } - } - -- return ret; -+ return 0; - } - EXPORT_SYMBOL(drm_atomic_check_only); - -diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c -index b205224f1a44..9147113139be 100644 ---- a/drivers/gpu/drm/drm_gem.c -+++ b/drivers/gpu/drm/drm_gem.c -@@ -715,13 +715,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data) - struct drm_gem_object *obj = ptr; - struct drm_device *dev = obj->dev; - -+ if (dev->driver->gem_close_object) -+ dev->driver->gem_close_object(obj, file_priv); -+ - if (drm_core_check_feature(dev, DRIVER_PRIME)) - drm_gem_remove_prime_handles(obj, file_priv); - drm_vma_node_revoke(&obj->vma_node, file_priv->filp); - -- if (dev->driver->gem_close_object) -- dev->driver->gem_close_object(obj, file_priv); -- - drm_gem_object_handle_unreference_unlocked(obj); - - return 0; -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -index 9255b9c096b6..9befd624a5f0 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -@@ -148,8 +148,8 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) - rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? OTAR2 : OTAR, 0); - - /* Signal polarities */ -- value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? 0 : DSMR_VSL) -- | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? 0 : DSMR_HSL) -+ value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? DSMR_VSL : 0) -+ | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? DSMR_HSL : 0) - | DSMR_DIPM_DE | DSMR_CSPM; - rcar_du_crtc_write(rcrtc, DSMR, value); - -@@ -171,7 +171,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc) - mode->crtc_vsync_start - 1); - rcar_du_crtc_write(rcrtc, VCR, mode->crtc_vtotal - 1); - -- rcar_du_crtc_write(rcrtc, DESR, mode->htotal - mode->hsync_start); -+ rcar_du_crtc_write(rcrtc, DESR, mode->htotal - mode->hsync_start - 1); - rcar_du_crtc_write(rcrtc, DEWR, mode->hdisplay); - } - -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c -index 46429c4be8e5..2b75a4891dec 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c -@@ -642,13 +642,13 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu, - } - - ret = rcar_du_encoder_init(rcdu, enc_type, output, encoder, connector); -- of_node_put(encoder); -- of_node_put(connector); -- - if (ret && ret != -EPROBE_DEFER) - dev_warn(rcdu->dev, -- "failed to initialize encoder %s (%d), skipping\n", -- encoder->full_name, ret); -+ "failed to initialize encoder %s on output %u (%d), skipping\n", -+ of_node_full_name(encoder), output, ret); -+ -+ of_node_put(encoder); -+ of_node_put(connector); - - return ret; - } -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c -index 85043c5bad03..873e04aa9352 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c -@@ -56,11 +56,11 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds, - return ret; - - /* PLL clock configuration */ -- if (freq <= 38000) -+ if (freq < 39000) - pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_38M; -- else if (freq <= 60000) -+ else if (freq < 61000) - pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_60M; -- else if (freq <= 121000) -+ else if (freq < 121000) - pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_121M; - else - pllcr = LVDPLLCR_PLLDLYCNT_150M; -@@ -102,7 +102,7 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds, - /* Turn the PLL on, wait for the startup delay, and turn the output - * on. - */ -- lvdcr0 |= LVDCR0_PLLEN; -+ lvdcr0 |= LVDCR0_PLLON; - rcar_lvds_write(lvds, LVDCR0, lvdcr0); - - usleep_range(100, 150); -diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h -index 77cf9289ab65..b1eafd097a79 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h -+++ b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h -@@ -18,7 +18,7 @@ - #define LVDCR0_DMD (1 << 12) - #define LVDCR0_LVMD_MASK (0xf << 8) - #define LVDCR0_LVMD_SHIFT 8 --#define LVDCR0_PLLEN (1 << 4) -+#define LVDCR0_PLLON (1 << 4) - #define LVDCR0_BEN (1 << 2) - #define LVDCR0_LVEN (1 << 1) - #define LVDCR0_LVRES (1 << 0) -diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c -index 6b00061c3746..a2ae2213ef3e 100644 ---- a/drivers/i2c/busses/i2c-designware-platdrv.c -+++ b/drivers/i2c/busses/i2c-designware-platdrv.c -@@ -294,7 +294,7 @@ static void dw_i2c_plat_complete(struct device *dev) - #endif - - #ifdef CONFIG_PM --static int dw_i2c_plat_suspend(struct device *dev) -+static int dw_i2c_plat_runtime_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct dw_i2c_dev *i_dev = platform_get_drvdata(pdev); -@@ -318,11 +318,21 @@ static int dw_i2c_plat_resume(struct device *dev) - return 0; - } - -+#ifdef CONFIG_PM_SLEEP -+static int dw_i2c_plat_suspend(struct device *dev) -+{ -+ pm_runtime_resume(dev); -+ return dw_i2c_plat_runtime_suspend(dev); -+} -+#endif -+ - static const struct dev_pm_ops dw_i2c_dev_pm_ops = { - .prepare = dw_i2c_plat_prepare, - .complete = dw_i2c_plat_complete, - SET_SYSTEM_SLEEP_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume) -- SET_RUNTIME_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume, NULL) -+ SET_RUNTIME_PM_OPS(dw_i2c_plat_runtime_suspend, -+ dw_i2c_plat_resume, -+ NULL) - }; - - #define DW_I2C_DEV_PMOPS (&dw_i2c_dev_pm_ops) -diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -index 0a86ef43e781..a8db38db622e 100644 ---- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -+++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c -@@ -36,8 +36,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) - s32 poll_value = 0; - - if (state) { -- if (!atomic_read(&st->user_requested_state)) -- return 0; - if (sensor_hub_device_open(st->hsdev)) - return -EIO; - -@@ -84,6 +82,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state) - &report_val); - } - -+ pr_debug("HID_SENSOR %s set power_state %d report_state %d\n", -+ st->pdev->name, state_val, report_val); -+ - sensor_hub_get_feature(st->hsdev, st->power_state.report_id, - st->power_state.index, - sizeof(state_val), &state_val); -@@ -107,6 +108,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state) - ret = pm_runtime_get_sync(&st->pdev->dev); - else { - pm_runtime_mark_last_busy(&st->pdev->dev); -+ pm_runtime_use_autosuspend(&st->pdev->dev); - ret = pm_runtime_put_autosuspend(&st->pdev->dev); - } - if (ret < 0) { -@@ -175,8 +177,6 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name, - /* Default to 3 seconds, but can be changed from sysfs */ - pm_runtime_set_autosuspend_delay(&attrb->pdev->dev, - 3000); -- pm_runtime_use_autosuspend(&attrb->pdev->dev); -- - return ret; - error_unreg_trigger: - iio_trigger_unregister(trig); -diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c -index 2485b88ee1b6..1880105cc8c4 100644 ---- a/drivers/iio/imu/adis16480.c -+++ b/drivers/iio/imu/adis16480.c -@@ -696,7 +696,7 @@ static const struct adis16480_chip_info adis16480_chip_info[] = { - .gyro_max_val = IIO_RAD_TO_DEGREE(22500), - .gyro_max_scale = 450, - .accel_max_val = IIO_M_S_2_TO_G(12500), -- .accel_max_scale = 5, -+ .accel_max_scale = 10, - }, - [ADIS16485] = { - .channels = adis16485_channels, -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 98d4e515587a..681dce15fbc8 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1234,6 +1234,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0000", 0 }, - { "ELAN0100", 0 }, - { "ELAN0600", 0 }, -+ { "ELAN0602", 0 }, - { "ELAN0605", 0 }, - { "ELAN0608", 0 }, - { "ELAN0605", 0 }, -diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c -index 354d47ecd66a..ce6ff9b301bb 100644 ---- a/drivers/input/mouse/trackpoint.c -+++ b/drivers/input/mouse/trackpoint.c -@@ -265,7 +265,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *fir - if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID))) - return -1; - -- if (param[0] != TP_MAGIC_IDENT) -+ /* add new TP ID. */ -+ if (!(param[0] & TP_MAGIC_IDENT)) - return -1; - - if (firmware_id) -diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h -index 5617ed3a7d7a..88055755f82e 100644 ---- a/drivers/input/mouse/trackpoint.h -+++ b/drivers/input/mouse/trackpoint.h -@@ -21,8 +21,9 @@ - #define TP_COMMAND 0xE2 /* Commands start with this */ - - #define TP_READ_ID 0xE1 /* Sent for device identification */ --#define TP_MAGIC_IDENT 0x01 /* Sent after a TP_READ_ID followed */ -+#define TP_MAGIC_IDENT 0x03 /* Sent after a TP_READ_ID followed */ - /* by the firmware ID */ -+ /* Firmware ID includes 0x1, 0x2, 0x3 */ - - - /* -diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h -index a2661381ddfc..d2774197fe58 100644 ---- a/drivers/misc/mei/hw-me-regs.h -+++ b/drivers/misc/mei/hw-me-regs.h -@@ -125,6 +125,11 @@ - #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */ - #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */ - -+#define MEI_DEV_ID_LBG 0xA1BA /* Lewisburg (SPT) */ -+ -+#define MEI_DEV_ID_BXT_M 0x1A9A /* Broxton M */ -+#define MEI_DEV_ID_APL_I 0x5A9A /* Apollo Lake I */ -+ - /* - * MEI HW Section - */ -diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c -index 01e20384ac44..adab5bbb642a 100644 ---- a/drivers/misc/mei/pci-me.c -+++ b/drivers/misc/mei/pci-me.c -@@ -86,10 +86,14 @@ static const struct pci_device_id mei_me_pci_tbl[] = { - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)}, - - {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)}, - {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)}, - -+ {MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)}, -+ {MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)}, -+ - /* required last entry */ - {0, } - }; -diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c -index ecc6fb9ca92f..3bbdf60f8908 100644 ---- a/drivers/ntb/ntb_transport.c -+++ b/drivers/ntb/ntb_transport.c -@@ -599,7 +599,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt, - if (!mw->virt_addr) - return -ENOMEM; - -- if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count) -+ if (mw_num < qp_count % mw_count) - num_qps_mw = qp_count / mw_count + 1; - else - num_qps_mw = qp_count / mw_count; -@@ -947,7 +947,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt, - qp->event_handler = NULL; - ntb_qp_link_down_reset(qp); - -- if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count) -+ if (mw_num < qp_count % mw_count) - num_qps_mw = qp_count / mw_count + 1; - else - num_qps_mw = qp_count / mw_count; -@@ -1065,8 +1065,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev) - qp_count = ilog2(qp_bitmap); - if (max_num_clients && max_num_clients < qp_count) - qp_count = max_num_clients; -- else if (mw_count < qp_count) -- qp_count = mw_count; -+ else if (nt->mw_count < qp_count) -+ qp_count = nt->mw_count; - - qp_bitmap &= BIT_ULL(qp_count) - 1; - -diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -index 02c3feef4e36..c2d2c17550a7 100644 ---- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c -+++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c -@@ -49,6 +49,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = { - {USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */ - {USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */ - {USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */ -+ {USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */ - {} /* Terminating entry */ - }; - -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index 26a3b389a265..fa8df3fef6fc 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -183,15 +183,20 @@ cifs_bp_rename_retry: - } - - /* -+ * Don't allow path components longer than the server max. - * Don't allow the separator character in a path component. - * The VFS will not allow "/", but "\" is allowed by posix. - */ - static int --check_name(struct dentry *direntry) -+check_name(struct dentry *direntry, struct cifs_tcon *tcon) - { - struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb); - int i; - -+ if (unlikely(direntry->d_name.len > -+ tcon->fsAttrInfo.MaxPathNameComponentLength)) -+ return -ENAMETOOLONG; -+ - if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) { - for (i = 0; i < direntry->d_name.len; i++) { - if (direntry->d_name.name[i] == '\\') { -@@ -489,10 +494,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, - return finish_no_open(file, res); - } - -- rc = check_name(direntry); -- if (rc) -- return rc; -- - xid = get_xid(); - - cifs_dbg(FYI, "parent inode = 0x%p name is: %pd and dentry = 0x%p\n", -@@ -505,6 +506,11 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, - } - - tcon = tlink_tcon(tlink); -+ -+ rc = check_name(direntry, tcon); -+ if (rc) -+ goto out_free_xid; -+ - server = tcon->ses->server; - - if (server->ops->new_lease_key) -@@ -765,7 +771,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry, - } - pTcon = tlink_tcon(tlink); - -- rc = check_name(direntry); -+ rc = check_name(direntry, pTcon); - if (rc) - goto lookup_out; - -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index f4afa3b1cc56..6c484ddf26a9 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -2768,8 +2768,8 @@ copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf, - kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) * - le32_to_cpu(pfs_inf->SectorsPerAllocationUnit); - kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits); -- kst->f_bfree = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits); -- kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); -+ kst->f_bfree = kst->f_bavail = -+ le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits); - return; - } - -diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c -index 3f68a25f2169..544672b440de 100644 ---- a/fs/nfsd/nfs4xdr.c -+++ b/fs/nfsd/nfs4xdr.c -@@ -129,7 +129,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp) - argp->p = page_address(argp->pagelist[0]); - argp->pagelist++; - if (argp->pagelen < PAGE_SIZE) { -- argp->end = argp->p + (argp->pagelen>>2); -+ argp->end = argp->p + XDR_QUADLEN(argp->pagelen); - argp->pagelen = 0; - } else { - argp->end = argp->p + (PAGE_SIZE>>2); -@@ -1246,9 +1246,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write) - argp->pagelen -= pages * PAGE_SIZE; - len -= pages * PAGE_SIZE; - -- argp->p = (__be32 *)page_address(argp->pagelist[0]); -- argp->pagelist++; -- argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE); -+ next_decode_page(argp); - } - argp->p += XDR_QUADLEN(len); - -diff --git a/include/net/ip.h b/include/net/ip.h -index b450d8653b30..7476bb10ff37 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -314,7 +314,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, - !forwarding) - return dst_mtu(dst); - -- return min(dst->dev->mtu, IP_MAX_MTU); -+ return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU); - } - - static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb) -@@ -327,7 +327,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb) - return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding); - } - -- return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU); -+ return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU); - } - - u32 ip_idents_reserve(u32 hash, int segs); -diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h -index e5bba897d206..7a5d6a073165 100644 ---- a/include/net/sch_generic.h -+++ b/include/net/sch_generic.h -@@ -717,8 +717,11 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new, - old = *pold; - *pold = new; - if (old != NULL) { -- qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog); -+ unsigned int qlen = old->q.qlen; -+ unsigned int backlog = old->qstats.backlog; -+ - qdisc_reset(old); -+ qdisc_tree_reduce_backlog(old, qlen, backlog); - } - sch_tree_unlock(sch); - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 784ab8fe8714..3697063dd09a 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -8473,28 +8473,27 @@ SYSCALL_DEFINE5(perf_event_open, - goto err_context; - - /* -- * Do not allow to attach to a group in a different -- * task or CPU context: -+ * Make sure we're both events for the same CPU; -+ * grouping events for different CPUs is broken; since -+ * you can never concurrently schedule them anyhow. - */ -- if (move_group) { -- /* -- * Make sure we're both on the same task, or both -- * per-cpu events. -- */ -- if (group_leader->ctx->task != ctx->task) -- goto err_context; -+ if (group_leader->cpu != event->cpu) -+ goto err_context; - -- /* -- * Make sure we're both events for the same CPU; -- * grouping events for different CPUs is broken; since -- * you can never concurrently schedule them anyhow. -- */ -- if (group_leader->cpu != event->cpu) -- goto err_context; -- } else { -- if (group_leader->ctx != ctx) -- goto err_context; -- } -+ /* -+ * Make sure we're both on the same task, or both -+ * per-CPU events. -+ */ -+ if (group_leader->ctx->task != ctx->task) -+ goto err_context; -+ -+ /* -+ * Do not allow to attach to a group in a different task -+ * or CPU context. If we're moving SW events, we'll fix -+ * this up later, so allow that. -+ */ -+ if (!move_group && group_leader->ctx != ctx) -+ goto err_context; - - /* - * Only a group leader can be exclusive or pinned -diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c -index 6816302542b2..f0e5408499b6 100644 ---- a/kernel/trace/trace_events_filter.c -+++ b/kernel/trace/trace_events_filter.c -@@ -1979,6 +1979,10 @@ static int create_filter(struct trace_event_call *call, - if (err && set_str) - append_filter_err(ps, filter); - } -+ if (err && !set_str) { -+ free_event_filter(filter); -+ filter = NULL; -+ } - create_filter_finish(ps); - - *filterp = filter; -diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c -index 1641367e54ca..69f56073b337 100644 ---- a/net/bluetooth/bnep/core.c -+++ b/net/bluetooth/bnep/core.c -@@ -484,16 +484,16 @@ static int bnep_session(void *arg) - struct net_device *dev = s->dev; - struct sock *sk = s->sock->sk; - struct sk_buff *skb; -- wait_queue_t wait; -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); - - BT_DBG(""); - - set_user_nice(current, -15); - -- init_waitqueue_entry(&wait, current); - add_wait_queue(sk_sleep(sk), &wait); - while (1) { -- set_current_state(TASK_INTERRUPTIBLE); -+ /* Ensure session->terminate is updated */ -+ smp_mb__before_atomic(); - - if (atomic_read(&s->terminate)) - break; -@@ -515,9 +515,8 @@ static int bnep_session(void *arg) - break; - netif_wake_queue(dev); - -- schedule(); -+ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); - } -- __set_current_state(TASK_RUNNING); - remove_wait_queue(sk_sleep(sk), &wait); - - /* Cleanup session */ -@@ -663,7 +662,7 @@ int bnep_del_connection(struct bnep_conndel_req *req) - s = __bnep_get_session(req->dst); - if (s) { - atomic_inc(&s->terminate); -- wake_up_process(s->task); -+ wake_up_interruptible(sk_sleep(s->sock->sk)); - } else - err = -ENOENT; - -diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c -index 298ed37010e6..3a39fd523e40 100644 ---- a/net/bluetooth/cmtp/core.c -+++ b/net/bluetooth/cmtp/core.c -@@ -281,16 +281,16 @@ static int cmtp_session(void *arg) - struct cmtp_session *session = arg; - struct sock *sk = session->sock->sk; - struct sk_buff *skb; -- wait_queue_t wait; -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); - - BT_DBG("session %p", session); - - set_user_nice(current, -15); - -- init_waitqueue_entry(&wait, current); - add_wait_queue(sk_sleep(sk), &wait); - while (1) { -- set_current_state(TASK_INTERRUPTIBLE); -+ /* Ensure session->terminate is updated */ -+ smp_mb__before_atomic(); - - if (atomic_read(&session->terminate)) - break; -@@ -307,9 +307,8 @@ static int cmtp_session(void *arg) - - cmtp_process_transmit(session); - -- schedule(); -+ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); - } -- __set_current_state(TASK_RUNNING); - remove_wait_queue(sk_sleep(sk), &wait); - - down_write(&cmtp_session_sem); -@@ -394,7 +393,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock) - err = cmtp_attach_device(session); - if (err < 0) { - atomic_inc(&session->terminate); -- wake_up_process(session->task); -+ wake_up_interruptible(sk_sleep(session->sock->sk)); - up_write(&cmtp_session_sem); - return err; - } -@@ -432,7 +431,11 @@ int cmtp_del_connection(struct cmtp_conndel_req *req) - - /* Stop session thread */ - atomic_inc(&session->terminate); -- wake_up_process(session->task); -+ -+ /* Ensure session->terminate is updated */ -+ smp_mb__after_atomic(); -+ -+ wake_up_interruptible(sk_sleep(session->sock->sk)); - } else - err = -ENOENT; - -diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c -index 0bec4588c3c8..1fc076420d1e 100644 ---- a/net/bluetooth/hidp/core.c -+++ b/net/bluetooth/hidp/core.c -@@ -36,6 +36,7 @@ - #define VERSION "1.2" - - static DECLARE_RWSEM(hidp_session_sem); -+static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq); - static LIST_HEAD(hidp_session_list); - - static unsigned char hidp_keycode[256] = { -@@ -1068,12 +1069,12 @@ static int hidp_session_start_sync(struct hidp_session *session) - * Wake up session thread and notify it to stop. This is asynchronous and - * returns immediately. Call this whenever a runtime error occurs and you want - * the session to stop. -- * Note: wake_up_process() performs any necessary memory-barriers for us. -+ * Note: wake_up_interruptible() performs any necessary memory-barriers for us. - */ - static void hidp_session_terminate(struct hidp_session *session) - { - atomic_inc(&session->terminate); -- wake_up_process(session->task); -+ wake_up_interruptible(&hidp_session_wq); - } - - /* -@@ -1180,7 +1181,9 @@ static void hidp_session_run(struct hidp_session *session) - struct sock *ctrl_sk = session->ctrl_sock->sk; - struct sock *intr_sk = session->intr_sock->sk; - struct sk_buff *skb; -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); - -+ add_wait_queue(&hidp_session_wq, &wait); - for (;;) { - /* - * This thread can be woken up two ways: -@@ -1188,12 +1191,10 @@ static void hidp_session_run(struct hidp_session *session) - * session->terminate flag and wakes this thread up. - * - Via modifying the socket state of ctrl/intr_sock. This - * thread is woken up by ->sk_state_changed(). -- * -- * Note: set_current_state() performs any necessary -- * memory-barriers for us. - */ -- set_current_state(TASK_INTERRUPTIBLE); - -+ /* Ensure session->terminate is updated */ -+ smp_mb__before_atomic(); - if (atomic_read(&session->terminate)) - break; - -@@ -1227,11 +1228,22 @@ static void hidp_session_run(struct hidp_session *session) - hidp_process_transmit(session, &session->ctrl_transmit, - session->ctrl_sock); - -- schedule(); -+ wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); - } -+ remove_wait_queue(&hidp_session_wq, &wait); - - atomic_inc(&session->terminate); -- set_current_state(TASK_RUNNING); -+ -+ /* Ensure session->terminate is updated */ -+ smp_mb__after_atomic(); -+} -+ -+static int hidp_session_wake_function(wait_queue_t *wait, -+ unsigned int mode, -+ int sync, void *key) -+{ -+ wake_up_interruptible(&hidp_session_wq); -+ return false; - } - - /* -@@ -1244,7 +1256,8 @@ static void hidp_session_run(struct hidp_session *session) - static int hidp_session_thread(void *arg) - { - struct hidp_session *session = arg; -- wait_queue_t ctrl_wait, intr_wait; -+ DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function); -+ DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function); - - BT_DBG("session %p", session); - -@@ -1254,8 +1267,6 @@ static int hidp_session_thread(void *arg) - set_user_nice(current, -15); - hidp_set_timer(session); - -- init_waitqueue_entry(&ctrl_wait, current); -- init_waitqueue_entry(&intr_wait, current); - add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait); - add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait); - /* This memory barrier is paired with wq_has_sleeper(). See -diff --git a/net/dccp/proto.c b/net/dccp/proto.c -index 9fe25bf63296..b68168fcc06a 100644 ---- a/net/dccp/proto.c -+++ b/net/dccp/proto.c -@@ -24,6 +24,7 @@ - #include - - #include -+#include - #include - #include - -@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type) - - EXPORT_SYMBOL_GPL(dccp_packet_name); - -+static void dccp_sk_destruct(struct sock *sk) -+{ -+ struct dccp_sock *dp = dccp_sk(sk); -+ -+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); -+ dp->dccps_hc_tx_ccid = NULL; -+ inet_sock_destruct(sk); -+} -+ - int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized) - { - struct dccp_sock *dp = dccp_sk(sk); -@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized) - icsk->icsk_syn_retries = sysctl_dccp_request_retries; - sk->sk_state = DCCP_CLOSED; - sk->sk_write_space = dccp_write_space; -+ sk->sk_destruct = dccp_sk_destruct; - icsk->icsk_sync_mss = dccp_sync_mss; - dp->dccps_mss_cache = 536; - dp->dccps_rate_last = jiffies; -@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk) - { - struct dccp_sock *dp = dccp_sk(sk); - -- /* -- * DCCP doesn't use sk_write_queue, just sk_send_head -- * for retransmissions -- */ -+ __skb_queue_purge(&sk->sk_write_queue); - if (sk->sk_send_head != NULL) { - kfree_skb(sk->sk_send_head); - sk->sk_send_head = NULL; -@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk) - dp->dccps_hc_rx_ackvec = NULL; - } - ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); -- ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); -- dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL; -+ dp->dccps_hc_rx_ccid = NULL; - - /* clean up feature negotiation state */ - dccp_feat_list_purge(&dp->dccps_featneg); -diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c -index b2504712259f..313e3c11a15a 100644 ---- a/net/ipv4/fib_semantics.c -+++ b/net/ipv4/fib_semantics.c -@@ -1044,15 +1044,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg) - fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL); - if (!fi) - goto failure; -- fib_info_cnt++; - if (cfg->fc_mx) { - fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL); -- if (!fi->fib_metrics) -- goto failure; -+ if (unlikely(!fi->fib_metrics)) { -+ kfree(fi); -+ return ERR_PTR(err); -+ } - atomic_set(&fi->fib_metrics->refcnt, 1); -- } else -+ } else { - fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics; -- -+ } -+ fib_info_cnt++; - fi->fib_net = net; - fi->fib_protocol = cfg->fc_protocol; - fi->fib_scope = cfg->fc_scope; -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index c295d882c6e0..0294f7c99c85 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -1241,7 +1241,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) - if (mtu) - return mtu; - -- mtu = dst->dev->mtu; -+ mtu = READ_ONCE(dst->dev->mtu); - - if (unlikely(dst_metric_locked(dst, RTAX_MTU))) { - if (rt->rt_uses_gateway && mtu > 576) -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index f0dabd125c43..c4bbf704ff9c 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -3028,8 +3028,7 @@ void tcp_rearm_rto(struct sock *sk) - /* delta may not be positive if the socket is locked - * when the retrans timer fires and is rescheduled. - */ -- if (delta > 0) -- rto = delta; -+ rto = max(delta, 1); - } - inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto, - TCP_RTO_MAX); -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index f60e8caea767..aad8cdf15472 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -892,6 +892,8 @@ add: - } - nsiblings = iter->rt6i_nsiblings; - fib6_purge_rt(iter, fn, info->nl_net); -+ if (fn->rr_ptr == iter) -+ fn->rr_ptr = NULL; - rt6_release(iter); - - if (nsiblings) { -@@ -904,6 +906,8 @@ add: - if (rt6_qualify_for_ecmp(iter)) { - *ins = iter->dst.rt6_next; - fib6_purge_rt(iter, fn, info->nl_net); -+ if (fn->rr_ptr == iter) -+ fn->rr_ptr = NULL; - rt6_release(iter); - nsiblings--; - } else { -@@ -992,7 +996,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, - /* Create subtree root node */ - sfn = node_alloc(); - if (!sfn) -- goto st_failure; -+ goto failure; - - sfn->leaf = info->nl_net->ipv6.ip6_null_entry; - atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref); -@@ -1008,12 +1012,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, - - if (IS_ERR(sn)) { - /* If it is failed, discard just allocated -- root, and then (in st_failure) stale node -+ root, and then (in failure) stale node - in main tree. - */ - node_free(sfn); - err = PTR_ERR(sn); -- goto st_failure; -+ goto failure; - } - - /* Now link new subtree to main tree */ -@@ -1027,7 +1031,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, - - if (IS_ERR(sn)) { - err = PTR_ERR(sn); -- goto st_failure; -+ goto failure; - } - } - -@@ -1069,22 +1073,22 @@ out: - atomic_inc(&pn->leaf->rt6i_ref); - } - #endif -- if (!(rt->dst.flags & DST_NOCACHE)) -- dst_free(&rt->dst); -+ goto failure; - } - return err; - --#ifdef CONFIG_IPV6_SUBTREES -- /* Subtree creation failed, probably main tree node -- is orphan. If it is, shoot it. -+failure: -+ /* fn->leaf could be NULL if fn is an intermediate node and we -+ * failed to add the new route to it in both subtree creation -+ * failure and fib6_add_rt2node() failure case. -+ * In both cases, fib6_repair_tree() should be called to fix -+ * fn->leaf. - */ --st_failure: - if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT))) - fib6_repair_tree(info->nl_net, fn); - if (!(rt->dst.flags & DST_NOCACHE)) - dst_free(&rt->dst); - return err; --#endif - } - - /* -diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c -index 8d2f7c9b491d..4a116d766c15 100644 ---- a/net/irda/af_irda.c -+++ b/net/irda/af_irda.c -@@ -2227,7 +2227,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname, - { - struct sock *sk = sock->sk; - struct irda_sock *self = irda_sk(sk); -- struct irda_device_list list; -+ struct irda_device_list list = { 0 }; - struct irda_device_info *discoveries; - struct irda_ias_set * ias_opt; /* IAS get/query params */ - struct ias_object * ias_obj; /* Object in IAS */ -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 2e1050ec2cf0..94bf810ad242 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2, - #define BROADCAST_ONE 1 - #define BROADCAST_REGISTERED 2 - #define BROADCAST_PROMISC_ONLY 4 --static int pfkey_broadcast(struct sk_buff *skb, -+static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation, - int broadcast_flags, struct sock *one_sk, - struct net *net) - { -@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb, - rcu_read_unlock(); - - if (one_sk != NULL) -- err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk); -+ err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk); - - kfree_skb(skb2); - kfree_skb(skb); -@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk) - hdr = (struct sadb_msg *) pfk->dump.skb->data; - hdr->sadb_msg_seq = 0; - hdr->sadb_msg_errno = rc; -- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, -+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, - &pfk->sk, sock_net(&pfk->sk)); - pfk->dump.skb = NULL; - } -@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk) - hdr->sadb_msg_len = (sizeof(struct sadb_msg) / - sizeof(uint64_t)); - -- pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk)); -+ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk)); - - return 0; - } -@@ -1396,7 +1396,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_ - - xfrm_state_put(x); - -- pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net); -+ pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net); - - return 0; - } -@@ -1483,7 +1483,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c) - hdr->sadb_msg_seq = c->seq; - hdr->sadb_msg_pid = c->portid; - -- pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x)); -+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x)); - - return 0; - } -@@ -1596,7 +1596,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg - out_hdr->sadb_msg_reserved = 0; - out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; - out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; -- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk)); -+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk)); - - return 0; - } -@@ -1701,8 +1701,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad - return -ENOBUFS; - } - -- pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk)); -- -+ pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk, -+ sock_net(sk)); - return 0; - } - -@@ -1720,7 +1720,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr) - hdr->sadb_msg_errno = (uint8_t) 0; - hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); - -- return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk)); -+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk, -+ sock_net(sk)); - } - - static int key_notify_sa_flush(const struct km_event *c) -@@ -1741,7 +1742,7 @@ static int key_notify_sa_flush(const struct km_event *c) - hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); - hdr->sadb_msg_reserved = 0; - -- pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net); -+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); - - return 0; - } -@@ -1798,7 +1799,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr) - out_hdr->sadb_msg_pid = pfk->dump.msg_portid; - - if (pfk->dump.skb) -- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, -+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, - &pfk->sk, sock_net(&pfk->sk)); - pfk->dump.skb = out_skb; - -@@ -1886,7 +1887,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb - new_hdr->sadb_msg_errno = 0; - } - -- pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk)); -+ pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk)); - return 0; - } - -@@ -2219,7 +2220,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev - out_hdr->sadb_msg_errno = 0; - out_hdr->sadb_msg_seq = c->seq; - out_hdr->sadb_msg_pid = c->portid; -- pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp)); -+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp)); - return 0; - - } -@@ -2439,7 +2440,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc - out_hdr->sadb_msg_errno = 0; - out_hdr->sadb_msg_seq = hdr->sadb_msg_seq; - out_hdr->sadb_msg_pid = hdr->sadb_msg_pid; -- pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp)); -+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp)); - err = 0; - - out: -@@ -2695,7 +2696,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr) - out_hdr->sadb_msg_pid = pfk->dump.msg_portid; - - if (pfk->dump.skb) -- pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE, -+ pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE, - &pfk->sk, sock_net(&pfk->sk)); - pfk->dump.skb = out_skb; - -@@ -2752,7 +2753,7 @@ static int key_notify_policy_flush(const struct km_event *c) - hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC; - hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t)); - hdr->sadb_msg_reserved = 0; -- pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net); -+ pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net); - return 0; - - } -@@ -2814,7 +2815,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb - void *ext_hdrs[SADB_EXT_MAX]; - int err; - -- pfkey_broadcast(skb_clone(skb, GFP_KERNEL), -+ pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL, - BROADCAST_PROMISC_ONLY, NULL, sock_net(sk)); - - memset(ext_hdrs, 0, sizeof(ext_hdrs)); -@@ -3036,7 +3037,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c) - out_hdr->sadb_msg_seq = 0; - out_hdr->sadb_msg_pid = 0; - -- pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x)); -+ pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, -+ xs_net(x)); - return 0; - } - -@@ -3226,7 +3228,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct - xfrm_ctx->ctx_len); - } - -- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x)); -+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, -+ xs_net(x)); - } - - static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt, -@@ -3424,7 +3427,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr, - n_port->sadb_x_nat_t_port_port = sport; - n_port->sadb_x_nat_t_port_reserved = 0; - -- return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x)); -+ return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL, -+ xs_net(x)); - } - - #ifdef CONFIG_NET_KEY_MIGRATE -@@ -3616,7 +3620,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - } - - /* broadcast migrate message to sockets */ -- pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net); -+ pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net); - - return 0; - -diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c -index 0915d448ba23..075b0d22f213 100644 ---- a/net/sched/act_ipt.c -+++ b/net/sched/act_ipt.c -@@ -34,6 +34,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int - { - struct xt_tgchk_param par; - struct xt_target *target; -+ struct ipt_entry e = {}; - int ret = 0; - - target = xt_request_find_target(AF_INET, t->u.user.name, -@@ -44,6 +45,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int - t->u.kernel.target = target; - memset(&par, 0, sizeof(par)); - par.table = table; -+ par.entryinfo = &e; - par.target = target; - par.targinfo = t->data; - par.hook_mask = hook; -diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c -index 4431e2833e45..3f2c3eed04da 100644 ---- a/net/sched/sch_sfq.c -+++ b/net/sched/sch_sfq.c -@@ -434,6 +434,7 @@ congestion_drop: - qdisc_drop(head, sch); - - slot_queue_add(slot, skb); -+ qdisc_tree_reduce_backlog(sch, 0, delta); - return NET_XMIT_CN; - } - -@@ -465,8 +466,10 @@ enqueue: - /* Return Congestion Notification only if we dropped a packet - * from this flow. - */ -- if (qlen != slot->qlen) -+ if (qlen != slot->qlen) { -+ qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb)); - return NET_XMIT_CN; -+ } - - /* As we dropped a packet, better let upper stack know this */ - qdisc_tree_reduce_backlog(sch, 1, dropped); -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index 7527c168e471..e33e9bd4ed5a 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -510,7 +510,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr, - { - addr->sa.sa_family = AF_INET6; - addr->v6.sin6_port = port; -+ addr->v6.sin6_flowinfo = 0; - addr->v6.sin6_addr = *saddr; -+ addr->v6.sin6_scope_id = 0; - } - - /* Compare addresses exactly. -diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c -index a0c90572d0e5..f86c6555a539 100644 ---- a/net/tipc/netlink_compat.c -+++ b/net/tipc/netlink_compat.c -@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd, - arg = nlmsg_new(0, GFP_KERNEL); - if (!arg) { - kfree_skb(msg->rep); -+ msg->rep = NULL; - return -ENOMEM; - } - - err = __tipc_nl_compat_dumpit(cmd, msg, arg); -- if (err) -+ if (err) { - kfree_skb(msg->rep); -- -+ msg->rep = NULL; -+ } - kfree_skb(arg); - - return err; -diff --git a/sound/core/control.c b/sound/core/control.c -index b4fe9b002512..bd01d492f46a 100644 ---- a/sound/core/control.c -+++ b/sound/core/control.c -@@ -1126,7 +1126,7 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, - mutex_lock(&ue->card->user_ctl_lock); - change = ue->tlv_data_size != size; - if (!change) -- change = memcmp(ue->tlv_data, new_data, size); -+ change = memcmp(ue->tlv_data, new_data, size) != 0; - kfree(ue->tlv_data); - ue->tlv_data = new_data; - ue->tlv_data_size = size; -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index 46f7b023f69c..ac5de4365e15 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -854,6 +854,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC), -+ SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI), - SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004), -diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c -index 54c33204541f..ff6fcd9f92f7 100644 ---- a/sound/soc/generic/simple-card.c -+++ b/sound/soc/generic/simple-card.c -@@ -100,7 +100,7 @@ static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream, - if (ret && ret != -ENOTSUPP) - goto err; - } -- -+ return 0; - err: - return ret; - } -diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c -index 2a5b3a293cd2..b123734f9fbd 100644 ---- a/sound/soc/sh/rcar/adg.c -+++ b/sound/soc/sh/rcar/adg.c -@@ -437,7 +437,7 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv, - struct device *dev = rsnd_priv_to_dev(priv); - struct device_node *np = dev->of_node; - u32 ckr, rbgx, rbga, rbgb; -- u32 rate, req_rate, div; -+ u32 rate, req_rate = 0, div; - uint32_t count = 0; - unsigned long req_48kHz_rate, req_441kHz_rate; - int i; -diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c -index deed48ef28b8..362446c36c9e 100644 ---- a/sound/soc/sh/rcar/core.c -+++ b/sound/soc/sh/rcar/core.c -@@ -192,19 +192,16 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod, - struct rsnd_priv *priv = rsnd_mod_to_priv(mod); - struct rsnd_dai_stream *io; - struct rsnd_dai *rdai; -- int i, j; -- -- for_each_rsnd_dai(rdai, priv, j) { -+ int i; - -- for (i = 0; i < RSND_MOD_MAX; i++) { -- io = &rdai->playback; -- if (mod == io->mod[i]) -- callback(mod, io); -+ for_each_rsnd_dai(rdai, priv, i) { -+ io = &rdai->playback; -+ if (mod == io->mod[mod->type]) -+ callback(mod, io); - -- io = &rdai->capture; -- if (mod == io->mod[i]) -- callback(mod, io); -- } -+ io = &rdai->capture; -+ if (mod == io->mod[mod->type]) -+ callback(mod, io); - } - } - -@@ -1019,7 +1016,7 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl, - } - } - -- if (change) -+ if (change && cfg->update) - cfg->update(cfg->io, mod); - - return change; -diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c -index 68b439ed22d7..460d29cbaaa5 100644 ---- a/sound/soc/sh/rcar/src.c -+++ b/sound/soc/sh/rcar/src.c -@@ -691,13 +691,27 @@ static int _rsnd_src_stop_gen2(struct rsnd_mod *mod) - { - rsnd_src_irq_disable_gen2(mod); - -- rsnd_mod_write(mod, SRC_CTRL, 0); -+ /* -+ * stop SRC output only -+ * see rsnd_src_quit_gen2 -+ */ -+ rsnd_mod_write(mod, SRC_CTRL, 0x01); - - rsnd_src_error_record_gen2(mod); - - return rsnd_src_stop(mod); - } - -+static int rsnd_src_quit_gen2(struct rsnd_mod *mod, -+ struct rsnd_dai_stream *io, -+ struct rsnd_priv *priv) -+{ -+ /* stop both out/in */ -+ rsnd_mod_write(mod, SRC_CTRL, 0); -+ -+ return 0; -+} -+ - static void __rsnd_src_interrupt_gen2(struct rsnd_mod *mod, - struct rsnd_dai_stream *io) - { -@@ -971,7 +985,7 @@ static struct rsnd_mod_ops rsnd_src_gen2_ops = { - .probe = rsnd_src_probe_gen2, - .remove = rsnd_src_remove_gen2, - .init = rsnd_src_init_gen2, -- .quit = rsnd_src_quit, -+ .quit = rsnd_src_quit_gen2, - .start = rsnd_src_start_gen2, - .stop = rsnd_src_stop_gen2, - .hw_params = rsnd_src_hw_params, -diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c -index 1427ec21bd7e..c62a2947ac14 100644 ---- a/sound/soc/sh/rcar/ssi.c -+++ b/sound/soc/sh/rcar/ssi.c -@@ -39,6 +39,7 @@ - #define SCKP (1 << 13) /* Serial Bit Clock Polarity */ - #define SWSP (1 << 12) /* Serial WS Polarity */ - #define SDTA (1 << 10) /* Serial Data Alignment */ -+#define PDTA (1 << 9) /* Parallel Data Alignment */ - #define DEL (1 << 8) /* Serial Data Delay */ - #define CKDV(v) (v << 4) /* Serial Clock Division Ratio */ - #define TRMD (1 << 1) /* Transmit/Receive Mode Select */ -@@ -286,7 +287,7 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, - struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io); - u32 cr; - -- cr = FORCE; -+ cr = FORCE | PDTA; - - /* - * always use 32bit system word for easy clock calculation. diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.85-86.patch b/patch/kernel/mvebu64-default/03-patch-4.4.85-86.patch deleted file mode 100644 index a20d51922873..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.85-86.patch +++ /dev/null @@ -1,393 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0f3d843f42a7..1207bf6a0e7a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 85 -+SUBLEVEL = 86 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/kernel/fpsimd.c b/arch/arm64/kernel/fpsimd.c -index 4c46c54a3ad7..6638903f0cb9 100644 ---- a/arch/arm64/kernel/fpsimd.c -+++ b/arch/arm64/kernel/fpsimd.c -@@ -157,9 +157,11 @@ void fpsimd_thread_switch(struct task_struct *next) - - void fpsimd_flush_thread(void) - { -+ preempt_disable(); - memset(¤t->thread.fpsimd_state, 0, sizeof(struct fpsimd_state)); - fpsimd_flush_task_state(current); - set_thread_flag(TIF_FOREIGN_FPSTATE); -+ preempt_enable(); - } - - /* -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index a4b466424a32..7fabf49f2aeb 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -313,8 +313,11 @@ retry: - * signal first. We do not need to release the mmap_sem because it - * would already be released in __lock_page_or_retry in mm/filemap.c. - */ -- if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) -+ if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) { -+ if (!user_mode(regs)) -+ goto no_context; - return 0; -+ } - - /* - * Major/minor page fault accounting is only done on the initial -diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h -index de25aad07853..9016b4b70375 100644 ---- a/arch/x86/include/asm/io.h -+++ b/arch/x86/include/asm/io.h -@@ -304,13 +304,13 @@ static inline unsigned type in##bwl##_p(int port) \ - static inline void outs##bwl(int port, const void *addr, unsigned long count) \ - { \ - asm volatile("rep; outs" #bwl \ -- : "+S"(addr), "+c"(count) : "d"(port)); \ -+ : "+S"(addr), "+c"(count) : "d"(port) : "memory"); \ - } \ - \ - static inline void ins##bwl(int port, void *addr, unsigned long count) \ - { \ - asm volatile("rep; ins" #bwl \ -- : "+D"(addr), "+c"(count) : "d"(port)); \ -+ : "+D"(addr), "+c"(count) : "d"(port) : "memory"); \ - } - - BUILDIO(b, b, char) -diff --git a/drivers/gpu/drm/i915/intel_uncore.c b/drivers/gpu/drm/i915/intel_uncore.c -index cc91ae832ffb..6fd7b50c5747 100644 ---- a/drivers/gpu/drm/i915/intel_uncore.c -+++ b/drivers/gpu/drm/i915/intel_uncore.c -@@ -635,7 +635,8 @@ hsw_unclaimed_reg_detect(struct drm_i915_private *dev_priv) - "enabling oneshot unclaimed register reporting. " - "Please use i915.mmio_debug=N for more information.\n"); - __raw_i915_write32(dev_priv, FPGA_DBG, FPGA_DBG_RM_NOCLAIM); -- i915.mmio_debug = mmio_debug_once--; -+ i915.mmio_debug = mmio_debug_once; -+ mmio_debug_once = false; - } - } - -diff --git a/drivers/i2c/busses/i2c-jz4780.c b/drivers/i2c/busses/i2c-jz4780.c -index f325663c27c5..4b58e8aaf5c5 100644 ---- a/drivers/i2c/busses/i2c-jz4780.c -+++ b/drivers/i2c/busses/i2c-jz4780.c -@@ -786,10 +786,6 @@ static int jz4780_i2c_probe(struct platform_device *pdev) - - jz4780_i2c_writew(i2c, JZ4780_I2C_INTM, 0x0); - -- i2c->cmd = 0; -- memset(i2c->cmd_buf, 0, BUFSIZE); -- memset(i2c->data_buf, 0, BUFSIZE); -- - i2c->irq = platform_get_irq(pdev, 0); - ret = devm_request_irq(&pdev->dev, i2c->irq, jz4780_i2c_irq, 0, - dev_name(&pdev->dev), i2c); -diff --git a/drivers/net/wireless/p54/fwio.c b/drivers/net/wireless/p54/fwio.c -index 257a9eadd595..4ac6764f4897 100644 ---- a/drivers/net/wireless/p54/fwio.c -+++ b/drivers/net/wireless/p54/fwio.c -@@ -488,7 +488,7 @@ int p54_scan(struct p54_common *priv, u16 mode, u16 dwell) - - entry += sizeof(__le16); - chan->pa_points_per_curve = 8; -- memset(chan->curve_data, 0, sizeof(*chan->curve_data)); -+ memset(chan->curve_data, 0, sizeof(chan->curve_data)); - memcpy(chan->curve_data, entry, - sizeof(struct p54_pa_curve_data_sample) * - min((u8)8, curve_data->points_per_channel)); -diff --git a/drivers/scsi/isci/remote_node_context.c b/drivers/scsi/isci/remote_node_context.c -index 1910100638a2..00602abec0ea 100644 ---- a/drivers/scsi/isci/remote_node_context.c -+++ b/drivers/scsi/isci/remote_node_context.c -@@ -66,6 +66,9 @@ const char *rnc_state_name(enum scis_sds_remote_node_context_states state) - { - static const char * const strings[] = RNC_STATES; - -+ if (state >= ARRAY_SIZE(strings)) -+ return "UNKNOWN"; -+ - return strings[state]; - } - #undef C -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index 0e6aaef9a038..c74f74ab981c 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1054,7 +1054,10 @@ stop_rr_fcf_flogi: - lpfc_sli4_unreg_all_rpis(vport); - } - } -- lpfc_issue_reg_vfi(vport); -+ -+ /* Do not register VFI if the driver aborted FLOGI */ -+ if (!lpfc_error_lost_link(irsp)) -+ lpfc_issue_reg_vfi(vport); - lpfc_nlp_put(ndlp); - goto out; - } -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 6514636431ab..8a9e139e2853 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -153,6 +153,7 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ - struct sg_device *parentdp; /* owning device */ - wait_queue_head_t read_wait; /* queue read until command done */ - rwlock_t rq_list_lock; /* protect access to list in req_arr */ -+ struct mutex f_mutex; /* protect against changes in this fd */ - int timeout; /* defaults to SG_DEFAULT_TIMEOUT */ - int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */ - Sg_scatter_hold reserve; /* buffer held for this file descriptor */ -@@ -166,6 +167,7 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ - unsigned char next_cmd_len; /* 0: automatic, >0: use on next write() */ - char keep_orphan; /* 0 -> drop orphan (def), 1 -> keep for read() */ - char mmap_called; /* 0 -> mmap() never called on this fd */ -+ char res_in_use; /* 1 -> 'reserve' array in use */ - struct kref f_ref; - struct execute_work ew; - } Sg_fd; -@@ -209,7 +211,6 @@ static void sg_remove_sfp(struct kref *); - static Sg_request *sg_get_rq_mark(Sg_fd * sfp, int pack_id); - static Sg_request *sg_add_request(Sg_fd * sfp); - static int sg_remove_request(Sg_fd * sfp, Sg_request * srp); --static int sg_res_in_use(Sg_fd * sfp); - static Sg_device *sg_get_dev(int dev); - static void sg_device_destroy(struct kref *kref); - -@@ -625,6 +626,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) - } - buf += SZ_SG_HEADER; - __get_user(opcode, buf); -+ mutex_lock(&sfp->f_mutex); - if (sfp->next_cmd_len > 0) { - cmd_size = sfp->next_cmd_len; - sfp->next_cmd_len = 0; /* reset so only this write() effected */ -@@ -633,6 +635,7 @@ sg_write(struct file *filp, const char __user *buf, size_t count, loff_t * ppos) - if ((opcode >= 0xc0) && old_hdr.twelve_byte) - cmd_size = 12; - } -+ mutex_unlock(&sfp->f_mutex); - SCSI_LOG_TIMEOUT(4, sg_printk(KERN_INFO, sdp, - "sg_write: scsi opcode=0x%02x, cmd_size=%d\n", (int) opcode, cmd_size)); - /* Determine buffer size. */ -@@ -732,7 +735,7 @@ sg_new_write(Sg_fd *sfp, struct file *file, const char __user *buf, - sg_remove_request(sfp, srp); - return -EINVAL; /* either MMAP_IO or DIRECT_IO (not both) */ - } -- if (sg_res_in_use(sfp)) { -+ if (sfp->res_in_use) { - sg_remove_request(sfp, srp); - return -EBUSY; /* reserve buffer already being used */ - } -@@ -902,7 +905,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - return result; - if (val) { - sfp->low_dma = 1; -- if ((0 == sfp->low_dma) && (0 == sg_res_in_use(sfp))) { -+ if ((0 == sfp->low_dma) && !sfp->res_in_use) { - val = (int) sfp->reserve.bufflen; - sg_remove_scat(sfp, &sfp->reserve); - sg_build_reserve(sfp, val); -@@ -977,12 +980,18 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - return -EINVAL; - val = min_t(int, val, - max_sectors_bytes(sdp->device->request_queue)); -+ mutex_lock(&sfp->f_mutex); - if (val != sfp->reserve.bufflen) { -- if (sg_res_in_use(sfp) || sfp->mmap_called) -+ if (sfp->mmap_called || -+ sfp->res_in_use) { -+ mutex_unlock(&sfp->f_mutex); - return -EBUSY; -+ } -+ - sg_remove_scat(sfp, &sfp->reserve); - sg_build_reserve(sfp, val); - } -+ mutex_unlock(&sfp->f_mutex); - return 0; - case SG_GET_RESERVED_SIZE: - val = min_t(int, sfp->reserve.bufflen, -@@ -1737,13 +1746,22 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) - md = &map_data; - - if (md) { -- if (!sg_res_in_use(sfp) && dxfer_len <= rsv_schp->bufflen) -+ mutex_lock(&sfp->f_mutex); -+ if (dxfer_len <= rsv_schp->bufflen && -+ !sfp->res_in_use) { -+ sfp->res_in_use = 1; - sg_link_reserve(sfp, srp, dxfer_len); -- else { -+ } else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) { -+ mutex_unlock(&sfp->f_mutex); -+ return -EBUSY; -+ } else { - res = sg_build_indirect(req_schp, sfp, dxfer_len); -- if (res) -+ if (res) { -+ mutex_unlock(&sfp->f_mutex); - return res; -+ } - } -+ mutex_unlock(&sfp->f_mutex); - - md->pages = req_schp->pages; - md->page_order = req_schp->page_order; -@@ -2034,6 +2052,8 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp) - req_schp->sglist_len = 0; - sfp->save_scat_len = 0; - srp->res_used = 0; -+ /* Called without mutex lock to avoid deadlock */ -+ sfp->res_in_use = 0; - } - - static Sg_request * -@@ -2145,6 +2165,7 @@ sg_add_sfp(Sg_device * sdp) - rwlock_init(&sfp->rq_list_lock); - - kref_init(&sfp->f_ref); -+ mutex_init(&sfp->f_mutex); - sfp->timeout = SG_DEFAULT_TIMEOUT; - sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER; - sfp->force_packid = SG_DEF_FORCE_PACK_ID; -@@ -2220,20 +2241,6 @@ sg_remove_sfp(struct kref *kref) - schedule_work(&sfp->ew.work); - } - --static int --sg_res_in_use(Sg_fd * sfp) --{ -- const Sg_request *srp; -- unsigned long iflags; -- -- read_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (srp = sfp->headrp; srp; srp = srp->nextrp) -- if (srp->res_used) -- break; -- read_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- return srp ? 1 : 0; --} -- - #ifdef CONFIG_SCSI_PROC_FS - static int - sg_idr_max_id(int id, void *p, void *data) -diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c -index 9c62a6f9757a..600c67ef8a03 100644 ---- a/fs/btrfs/volumes.c -+++ b/fs/btrfs/volumes.c -@@ -108,7 +108,7 @@ const struct btrfs_raid_attr btrfs_raid_array[BTRFS_NR_RAID_TYPES] = { - }, - }; - --const u64 const btrfs_raid_group[BTRFS_NR_RAID_TYPES] = { -+const u64 btrfs_raid_group[BTRFS_NR_RAID_TYPES] = { - [BTRFS_RAID_RAID10] = BTRFS_BLOCK_GROUP_RAID10, - [BTRFS_RAID_RAID1] = BTRFS_BLOCK_GROUP_RAID1, - [BTRFS_RAID_DUP] = BTRFS_BLOCK_GROUP_DUP, -diff --git a/include/linux/lightnvm.h b/include/linux/lightnvm.h -index 782d4e814e21..4bc4b1b13193 100644 ---- a/include/linux/lightnvm.h -+++ b/include/linux/lightnvm.h -@@ -310,6 +310,7 @@ static inline struct ppa_addr dev_to_generic_addr(struct nvm_dev *dev, - { - struct ppa_addr l; - -+ l.ppa = 0; - /* - * (r.ppa << X offset) & X len bitmask. X eq. blk, pg, etc. - */ -diff --git a/kernel/gcov/base.c b/kernel/gcov/base.c -index 7080ae1eb6c1..f850e906564b 100644 ---- a/kernel/gcov/base.c -+++ b/kernel/gcov/base.c -@@ -98,6 +98,12 @@ void __gcov_merge_icall_topn(gcov_type *counters, unsigned int n_counters) - } - EXPORT_SYMBOL(__gcov_merge_icall_topn); - -+void __gcov_exit(void) -+{ -+ /* Unused. */ -+} -+EXPORT_SYMBOL(__gcov_exit); -+ - /** - * gcov_enable_events - enable event reporting through gcov_event() - * -diff --git a/kernel/gcov/gcc_4_7.c b/kernel/gcov/gcc_4_7.c -index e25e92fb44fa..46a18e72bce6 100644 ---- a/kernel/gcov/gcc_4_7.c -+++ b/kernel/gcov/gcc_4_7.c -@@ -18,7 +18,9 @@ - #include - #include "gcov.h" - --#if __GNUC__ == 5 && __GNUC_MINOR__ >= 1 -+#if (__GNUC__ >= 7) -+#define GCOV_COUNTERS 9 -+#elif (__GNUC__ > 5) || (__GNUC__ == 5 && __GNUC_MINOR__ >= 1) - #define GCOV_COUNTERS 10 - #elif __GNUC__ == 4 && __GNUC_MINOR__ >= 9 - #define GCOV_COUNTERS 9 -diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c -index 74177189063c..d3125c169684 100644 ---- a/sound/pci/au88x0/au88x0_core.c -+++ b/sound/pci/au88x0/au88x0_core.c -@@ -2150,8 +2150,7 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - stream->resources, en, - VORTEX_RESOURCE_SRC)) < 0) { - memset(stream->resources, 0, -- sizeof(unsigned char) * -- VORTEX_RESOURCE_LAST); -+ sizeof(stream->resources)); - return -EBUSY; - } - if (stream->type != VORTEX_PCM_A3D) { -@@ -2161,7 +2160,7 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - VORTEX_RESOURCE_MIXIN)) < 0) { - memset(stream->resources, - 0, -- sizeof(unsigned char) * VORTEX_RESOURCE_LAST); -+ sizeof(stream->resources)); - return -EBUSY; - } - } -@@ -2174,8 +2173,7 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - stream->resources, en, - VORTEX_RESOURCE_A3D)) < 0) { - memset(stream->resources, 0, -- sizeof(unsigned char) * -- VORTEX_RESOURCE_LAST); -+ sizeof(stream->resources)); - dev_err(vortex->card->dev, - "out of A3D sources. Sorry\n"); - return -EBUSY; -@@ -2289,8 +2287,7 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - VORTEX_RESOURCE_MIXOUT)) - < 0) { - memset(stream->resources, 0, -- sizeof(unsigned char) * -- VORTEX_RESOURCE_LAST); -+ sizeof(stream->resources)); - return -EBUSY; - } - if ((src[i] = -@@ -2298,8 +2295,7 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - stream->resources, en, - VORTEX_RESOURCE_SRC)) < 0) { - memset(stream->resources, 0, -- sizeof(unsigned char) * -- VORTEX_RESOURCE_LAST); -+ sizeof(stream->resources)); - return -EBUSY; - } - } diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.86-87.patch b/patch/kernel/mvebu64-default/03-patch-4.4.86-87.patch deleted file mode 100644 index 5292853d3590..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.86-87.patch +++ /dev/null @@ -1,408 +0,0 @@ -diff --git a/Makefile b/Makefile -index 1207bf6a0e7a..f6838187b568 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 86 -+SUBLEVEL = 87 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/include/asm/types.h b/arch/alpha/include/asm/types.h -index 4cb4b6d3452c..0bc66e1d3a7e 100644 ---- a/arch/alpha/include/asm/types.h -+++ b/arch/alpha/include/asm/types.h -@@ -1,6 +1,6 @@ - #ifndef _ALPHA_TYPES_H - #define _ALPHA_TYPES_H - --#include -+#include - - #endif /* _ALPHA_TYPES_H */ -diff --git a/arch/alpha/include/uapi/asm/types.h b/arch/alpha/include/uapi/asm/types.h -index 9fd3cd459777..8d1024d7be05 100644 ---- a/arch/alpha/include/uapi/asm/types.h -+++ b/arch/alpha/include/uapi/asm/types.h -@@ -9,8 +9,18 @@ - * need to be careful to avoid a name clashes. - */ - --#ifndef __KERNEL__ -+/* -+ * This is here because we used to use l64 for alpha -+ * and we don't want to impact user mode with our change to ll64 -+ * in the kernel. -+ * -+ * However, some user programs are fine with this. They can -+ * flag __SANE_USERSPACE_TYPES__ to get int-ll64.h here. -+ */ -+#if !defined(__SANE_USERSPACE_TYPES__) && !defined(__KERNEL__) - #include -+#else -+#include - #endif - - #endif /* _UAPI_ALPHA_TYPES_H */ -diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c -index ba079e279b58..e8835d4e173c 100644 ---- a/arch/arm/kvm/mmu.c -+++ b/arch/arm/kvm/mmu.c -@@ -824,24 +824,25 @@ void stage2_unmap_vm(struct kvm *kvm) - * Walks the level-1 page table pointed to by kvm->arch.pgd and frees all - * underlying level-2 and level-3 tables before freeing the actual level-1 table - * and setting the struct pointer to NULL. -- * -- * Note we don't need locking here as this is only called when the VM is -- * destroyed, which can only be done once. - */ - void kvm_free_stage2_pgd(struct kvm *kvm) - { -- if (kvm->arch.pgd == NULL) -- return; -+ void *pgd = NULL; -+ void *hwpgd = NULL; - - spin_lock(&kvm->mmu_lock); -- unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); -+ if (kvm->arch.pgd) { -+ unmap_stage2_range(kvm, 0, KVM_PHYS_SIZE); -+ pgd = READ_ONCE(kvm->arch.pgd); -+ hwpgd = kvm_get_hwpgd(kvm); -+ kvm->arch.pgd = NULL; -+ } - spin_unlock(&kvm->mmu_lock); - -- kvm_free_hwpgd(kvm_get_hwpgd(kvm)); -- if (KVM_PREALLOC_LEVEL > 0) -- kfree(kvm->arch.pgd); -- -- kvm->arch.pgd = NULL; -+ if (hwpgd) -+ kvm_free_hwpgd(hwpgd); -+ if (KVM_PREALLOC_LEVEL > 0 && pgd) -+ kfree(pgd); - } - - static pud_t *stage2_get_pud(struct kvm *kvm, struct kvm_mmu_memory_cache *cache, -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index f5e9f9310b48..b3b0004ea8ac 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -86,8 +86,13 @@ static void skcipher_free_async_sgls(struct skcipher_async_req *sreq) - } - sgl = sreq->tsg; - n = sg_nents(sgl); -- for_each_sg(sgl, sg, n, i) -- put_page(sg_page(sg)); -+ for_each_sg(sgl, sg, n, i) { -+ struct page *page = sg_page(sg); -+ -+ /* some SGs may not have a page mapped */ -+ if (page && atomic_read(&page->_count)) -+ put_page(page); -+ } - - kfree(sreq->tsg); - } -diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c -index 025c429050c0..5d8dfe027b30 100644 ---- a/drivers/gpu/drm/ttm/ttm_page_alloc.c -+++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c -@@ -612,7 +612,7 @@ static void ttm_page_pool_fill_locked(struct ttm_page_pool *pool, - } else { - pr_err("Failed to fill pool (%p)\n", pool); - /* If we have any pages left put them to the pool. */ -- list_for_each_entry(p, &pool->list, lru) { -+ list_for_each_entry(p, &new_pages, lru) { - ++cpages; - } - list_splice(&new_pages, &pool->list); -diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c -index 7ba795b24e75..639d1a9c8793 100644 ---- a/drivers/i2c/busses/i2c-ismt.c -+++ b/drivers/i2c/busses/i2c-ismt.c -@@ -339,8 +339,10 @@ static int ismt_process_desc(const struct ismt_desc *desc, - break; - case I2C_SMBUS_BLOCK_DATA: - case I2C_SMBUS_I2C_BLOCK_DATA: -- memcpy(&data->block[1], dma_buffer, desc->rxbytes); -- data->block[0] = desc->rxbytes; -+ if (desc->rxbytes != dma_buffer[0] + 1) -+ return -EMSGSIZE; -+ -+ memcpy(data->block, dma_buffer, desc->rxbytes); - break; - } - return 0; -diff --git a/drivers/irqchip/irq-mips-gic.c b/drivers/irqchip/irq-mips-gic.c -index 9e17ef27a183..6f1dbd52ec91 100644 ---- a/drivers/irqchip/irq-mips-gic.c -+++ b/drivers/irqchip/irq-mips-gic.c -@@ -915,8 +915,11 @@ static int __init gic_of_init(struct device_node *node, - gic_len = resource_size(&res); - } - -- if (mips_cm_present()) -+ if (mips_cm_present()) { - write_gcr_gic_base(gic_base | CM_GCR_GIC_BASE_GICEN_MSK); -+ /* Ensure GIC region is enabled before trying to access it */ -+ __sync(); -+ } - gic_present = true; - - __gic_init(gic_base, gic_len, cpu_vec, 0, node); -diff --git a/drivers/net/wireless/ti/wl1251/main.c b/drivers/net/wireless/ti/wl1251/main.c -index cd4777954f87..9bee3f11898a 100644 ---- a/drivers/net/wireless/ti/wl1251/main.c -+++ b/drivers/net/wireless/ti/wl1251/main.c -@@ -1567,6 +1567,7 @@ struct ieee80211_hw *wl1251_alloc_hw(void) - - wl->state = WL1251_STATE_OFF; - mutex_init(&wl->mutex); -+ spin_lock_init(&wl->wl_lock); - - wl->tx_mgmt_frm_rate = DEFAULT_HW_GEN_TX_RATE; - wl->tx_mgmt_frm_mod = DEFAULT_HW_GEN_MODULATION_TYPE; -diff --git a/fs/ceph/addr.c b/fs/ceph/addr.c -index c6a1ec110c01..22bae2b434e2 100644 ---- a/fs/ceph/addr.c -+++ b/fs/ceph/addr.c -@@ -189,7 +189,7 @@ static int ceph_releasepage(struct page *page, gfp_t g) - /* - * read a single page, without unlocking it. - */ --static int readpage_nounlock(struct file *filp, struct page *page) -+static int ceph_do_readpage(struct file *filp, struct page *page) - { - struct inode *inode = file_inode(filp); - struct ceph_inode_info *ci = ceph_inode(inode); -@@ -219,7 +219,7 @@ static int readpage_nounlock(struct file *filp, struct page *page) - - err = ceph_readpage_from_fscache(inode, page); - if (err == 0) -- goto out; -+ return -EINPROGRESS; - - dout("readpage inode %p file %p page %p index %lu\n", - inode, filp, page, page->index); -@@ -249,8 +249,11 @@ out: - - static int ceph_readpage(struct file *filp, struct page *page) - { -- int r = readpage_nounlock(filp, page); -- unlock_page(page); -+ int r = ceph_do_readpage(filp, page); -+ if (r != -EINPROGRESS) -+ unlock_page(page); -+ else -+ r = 0; - return r; - } - -@@ -1094,7 +1097,7 @@ retry_locked: - goto retry_locked; - r = writepage_nounlock(page, NULL); - if (r < 0) -- goto fail_nosnap; -+ goto fail_unlock; - goto retry_locked; - } - -@@ -1122,11 +1125,14 @@ retry_locked: - } - - /* we need to read it. */ -- r = readpage_nounlock(file, page); -- if (r < 0) -- goto fail_nosnap; -+ r = ceph_do_readpage(file, page); -+ if (r < 0) { -+ if (r == -EINPROGRESS) -+ return -EAGAIN; -+ goto fail_unlock; -+ } - goto retry_locked; --fail_nosnap: -+fail_unlock: - unlock_page(page); - return r; - } -diff --git a/fs/ceph/cache.c b/fs/ceph/cache.c -index a4766ded1ba7..ff1cfd7b1083 100644 ---- a/fs/ceph/cache.c -+++ b/fs/ceph/cache.c -@@ -224,13 +224,7 @@ void ceph_fscache_unregister_inode_cookie(struct ceph_inode_info* ci) - fscache_relinquish_cookie(cookie, 0); - } - --static void ceph_vfs_readpage_complete(struct page *page, void *data, int error) --{ -- if (!error) -- SetPageUptodate(page); --} -- --static void ceph_vfs_readpage_complete_unlock(struct page *page, void *data, int error) -+static void ceph_readpage_from_fscache_complete(struct page *page, void *data, int error) - { - if (!error) - SetPageUptodate(page); -@@ -259,7 +253,7 @@ int ceph_readpage_from_fscache(struct inode *inode, struct page *page) - return -ENOBUFS; - - ret = fscache_read_or_alloc_page(ci->fscache, page, -- ceph_vfs_readpage_complete, NULL, -+ ceph_readpage_from_fscache_complete, NULL, - GFP_KERNEL); - - switch (ret) { -@@ -288,7 +282,7 @@ int ceph_readpages_from_fscache(struct inode *inode, - return -ENOBUFS; - - ret = fscache_read_or_alloc_pages(ci->fscache, mapping, pages, nr_pages, -- ceph_vfs_readpage_complete_unlock, -+ ceph_readpage_from_fscache_complete, - NULL, mapping_gfp_mask(mapping)); - - switch (ret) { -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index fa8df3fef6fc..297e05c9e2b0 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -194,7 +194,7 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon) - int i; - - if (unlikely(direntry->d_name.len > -- tcon->fsAttrInfo.MaxPathNameComponentLength)) -+ le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength))) - return -ENAMETOOLONG; - - if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) { -diff --git a/fs/cifs/smb2pdu.h b/fs/cifs/smb2pdu.h -index b8f553b32dda..aacb15bd56fe 100644 ---- a/fs/cifs/smb2pdu.h -+++ b/fs/cifs/smb2pdu.h -@@ -82,8 +82,8 @@ - - #define NUMBER_OF_SMB2_COMMANDS 0x0013 - --/* BB FIXME - analyze following length BB */ --#define MAX_SMB2_HDR_SIZE 0x78 /* 4 len + 64 hdr + (2*24 wct) + 2 bct + 2 pad */ -+/* 4 len + 52 transform hdr + 64 hdr + 56 create rsp */ -+#define MAX_SMB2_HDR_SIZE 0x00b0 - - #define SMB2_PROTO_NUMBER cpu_to_le32(0x424d53fe) - -diff --git a/fs/eventpoll.c b/fs/eventpoll.c -index 1e009cad8d5c..1b08556776ce 100644 ---- a/fs/eventpoll.c -+++ b/fs/eventpoll.c -@@ -518,8 +518,13 @@ static void ep_remove_wait_queue(struct eppoll_entry *pwq) - wait_queue_head_t *whead; - - rcu_read_lock(); -- /* If it is cleared by POLLFREE, it should be rcu-safe */ -- whead = rcu_dereference(pwq->whead); -+ /* -+ * If it is cleared by POLLFREE, it should be rcu-safe. -+ * If we read NULL we need a barrier paired with -+ * smp_store_release() in ep_poll_callback(), otherwise -+ * we rely on whead->lock. -+ */ -+ whead = smp_load_acquire(&pwq->whead); - if (whead) - remove_wait_queue(whead, &pwq->wait); - rcu_read_unlock(); -@@ -1003,17 +1008,6 @@ static int ep_poll_callback(wait_queue_t *wait, unsigned mode, int sync, void *k - struct epitem *epi = ep_item_from_wait(wait); - struct eventpoll *ep = epi->ep; - -- if ((unsigned long)key & POLLFREE) { -- ep_pwq_from_wait(wait)->whead = NULL; -- /* -- * whead = NULL above can race with ep_remove_wait_queue() -- * which can do another remove_wait_queue() after us, so we -- * can't use __remove_wait_queue(). whead->lock is held by -- * the caller. -- */ -- list_del_init(&wait->task_list); -- } -- - spin_lock_irqsave(&ep->lock, flags); - - /* -@@ -1078,6 +1072,23 @@ out_unlock: - if (pwake) - ep_poll_safewake(&ep->poll_wait); - -+ -+ if ((unsigned long)key & POLLFREE) { -+ /* -+ * If we race with ep_remove_wait_queue() it can miss -+ * ->whead = NULL and do another remove_wait_queue() after -+ * us, so we can't use __remove_wait_queue(). -+ */ -+ list_del_init(&wait->task_list); -+ /* -+ * ->whead != NULL protects us from the race with ep_free() -+ * or ep_remove(), ep_remove_wait_queue() takes whead->lock -+ * held by the caller. Once we nullify it, nothing protects -+ * ep/epi or even wait. -+ */ -+ smp_store_release(&ep_pwq_from_wait(wait)->whead, NULL); -+ } -+ - return 1; - } - -diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h -index fc824e2828f3..5d2add1a6c96 100644 ---- a/include/asm-generic/topology.h -+++ b/include/asm-generic/topology.h -@@ -48,7 +48,11 @@ - #define parent_node(node) ((void)(node),0) - #endif - #ifndef cpumask_of_node --#define cpumask_of_node(node) ((void)node, cpu_online_mask) -+ #ifdef CONFIG_NEED_MULTIPLE_NODES -+ #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask) -+ #else -+ #define cpumask_of_node(node) ((void)node, cpu_online_mask) -+ #endif - #endif - #ifndef pcibus_to_node - #define pcibus_to_node(bus) ((void)(bus), -1) -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 8ccd66a97c8b..2924b6faa469 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -1910,6 +1910,7 @@ static struct cftype files[] = { - { - .name = "memory_pressure", - .read_u64 = cpuset_read_u64, -+ .private = FILE_MEMORY_PRESSURE, - }, - - { -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 77055a362041..0e01250f2072 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -3275,9 +3275,15 @@ int xfrm_migrate(const struct xfrm_selector *sel, u8 dir, u8 type, - struct xfrm_state *x_new[XFRM_MAX_DEPTH]; - struct xfrm_migrate *mp; - -+ /* Stage 0 - sanity checks */ - if ((err = xfrm_migrate_check(m, num_migrate)) < 0) - goto out; - -+ if (dir >= XFRM_POLICY_MAX) { -+ err = -EINVAL; -+ goto out; -+ } -+ - /* Stage 1 - find policy */ - if ((pol = xfrm_migrate_policy_find(sel, dir, type, net)) == NULL) { - err = -ENOENT; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.87-88.patch b/patch/kernel/mvebu64-default/03-patch-4.4.87-88.patch deleted file mode 100644 index efec1acbb28c..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.87-88.patch +++ /dev/null @@ -1,1154 +0,0 @@ -diff --git a/Makefile b/Makefile -index f6838187b568..788d90a0051b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 87 -+SUBLEVEL = 88 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index c095455d496e..0d20cd594017 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -314,8 +314,11 @@ retry: - * signal first. We do not need to release the mmap_sem because - * it would already be released in __lock_page_or_retry in - * mm/filemap.c. */ -- if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) -+ if ((fault & VM_FAULT_RETRY) && fatal_signal_pending(current)) { -+ if (!user_mode(regs)) -+ goto no_context; - return 0; -+ } - - /* - * Major/minor page fault accounting is only done on the -diff --git a/drivers/ata/pata_amd.c b/drivers/ata/pata_amd.c -index 8d4d959a821c..8706533db57b 100644 ---- a/drivers/ata/pata_amd.c -+++ b/drivers/ata/pata_amd.c -@@ -616,6 +616,7 @@ static const struct pci_device_id amd[] = { - { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP73_IDE), 8 }, - { PCI_VDEVICE(NVIDIA, PCI_DEVICE_ID_NVIDIA_NFORCE_MCP77_IDE), 8 }, - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), 9 }, -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), 9 }, - - { }, - }; -diff --git a/drivers/ata/pata_cs5536.c b/drivers/ata/pata_cs5536.c -index 6c15a554efbe..dc1255294628 100644 ---- a/drivers/ata/pata_cs5536.c -+++ b/drivers/ata/pata_cs5536.c -@@ -289,6 +289,7 @@ static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id) - - static const struct pci_device_id cs5536[] = { - { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), }, -+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_DEV_IDE), }, - { }, - }; - -diff --git a/drivers/base/bus.c b/drivers/base/bus.c -index 500592486e88..0346e46e2871 100644 ---- a/drivers/base/bus.c -+++ b/drivers/base/bus.c -@@ -737,7 +737,7 @@ int bus_add_driver(struct device_driver *drv) - - out_unregister: - kobject_put(&priv->kobj); -- kfree(drv->p); -+ /* drv->p is freed in driver_release() */ - drv->p = NULL; - out_put_bus: - bus_put(bus); -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index cd6b141b9825..7bb8055bd10c 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -333,6 +333,7 @@ static const struct usb_device_id blacklist_table[] = { - { USB_DEVICE(0x13d3, 0x3410), .driver_info = BTUSB_REALTEK }, - { USB_DEVICE(0x13d3, 0x3416), .driver_info = BTUSB_REALTEK }, - { USB_DEVICE(0x13d3, 0x3459), .driver_info = BTUSB_REALTEK }, -+ { USB_DEVICE(0x13d3, 0x3494), .driver_info = BTUSB_REALTEK }, - - /* Additional Realtek 8821AE Bluetooth devices */ - { USB_DEVICE(0x0b05, 0x17dc), .driver_info = BTUSB_REALTEK }, -diff --git a/drivers/gpu/drm/i2c/adv7511.c b/drivers/gpu/drm/i2c/adv7511.c -index 00416f23b5cb..dba5c0ea0827 100644 ---- a/drivers/gpu/drm/i2c/adv7511.c -+++ b/drivers/gpu/drm/i2c/adv7511.c -@@ -36,7 +36,10 @@ struct adv7511 { - bool edid_read; - - wait_queue_head_t wq; -+ struct work_struct hpd_work; -+ - struct drm_encoder *encoder; -+ struct drm_connector connector; - - bool embedded_sync; - enum adv7511_sync_polarity vsync_polarity; -@@ -48,6 +51,10 @@ struct adv7511 { - struct gpio_desc *gpio_pd; - }; - -+static const int edid_i2c_addr = 0x7e; -+static const int packet_i2c_addr = 0x70; -+static const int cec_i2c_addr = 0x78; -+ - static struct adv7511 *encoder_to_adv7511(struct drm_encoder *encoder) - { - return to_encoder_slave(encoder)->slave_priv; -@@ -362,12 +369,19 @@ static void adv7511_power_on(struct adv7511 *adv7511) - { - adv7511->current_edid_segment = -1; - -- regmap_write(adv7511->regmap, ADV7511_REG_INT(0), -- ADV7511_INT0_EDID_READY); -- regmap_write(adv7511->regmap, ADV7511_REG_INT(1), -- ADV7511_INT1_DDC_ERROR); - regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER, - ADV7511_POWER_POWER_DOWN, 0); -+ if (adv7511->i2c_main->irq) { -+ /* -+ * Documentation says the INT_ENABLE registers are reset in -+ * POWER_DOWN mode. My 7511w preserved the bits, however. -+ * Still, let's be safe and stick to the documentation. -+ */ -+ regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(0), -+ ADV7511_INT0_EDID_READY); -+ regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(1), -+ ADV7511_INT1_DDC_ERROR); -+ } - - /* - * Per spec it is allowed to pulse the HDP signal to indicate that the -@@ -422,7 +436,27 @@ static bool adv7511_hpd(struct adv7511 *adv7511) - return false; - } - --static int adv7511_irq_process(struct adv7511 *adv7511) -+static void adv7511_hpd_work(struct work_struct *work) -+{ -+ struct adv7511 *adv7511 = container_of(work, struct adv7511, hpd_work); -+ enum drm_connector_status status; -+ unsigned int val; -+ int ret; -+ ret = regmap_read(adv7511->regmap, ADV7511_REG_STATUS, &val); -+ if (ret < 0) -+ status = connector_status_disconnected; -+ else if (val & ADV7511_STATUS_HPD) -+ status = connector_status_connected; -+ else -+ status = connector_status_disconnected; -+ -+ if (adv7511->connector.status != status) { -+ adv7511->connector.status = status; -+ drm_kms_helper_hotplug_event(adv7511->connector.dev); -+ } -+} -+ -+static int adv7511_irq_process(struct adv7511 *adv7511, bool process_hpd) - { - unsigned int irq0, irq1; - int ret; -@@ -438,8 +472,8 @@ static int adv7511_irq_process(struct adv7511 *adv7511) - regmap_write(adv7511->regmap, ADV7511_REG_INT(0), irq0); - regmap_write(adv7511->regmap, ADV7511_REG_INT(1), irq1); - -- if (irq0 & ADV7511_INT0_HDP && adv7511->encoder) -- drm_helper_hpd_irq_event(adv7511->encoder->dev); -+ if (process_hpd && irq0 & ADV7511_INT0_HDP && adv7511->encoder) -+ schedule_work(&adv7511->hpd_work); - - if (irq0 & ADV7511_INT0_EDID_READY || irq1 & ADV7511_INT1_DDC_ERROR) { - adv7511->edid_read = true; -@@ -456,7 +490,7 @@ static irqreturn_t adv7511_irq_handler(int irq, void *devid) - struct adv7511 *adv7511 = devid; - int ret; - -- ret = adv7511_irq_process(adv7511); -+ ret = adv7511_irq_process(adv7511, true); - return ret < 0 ? IRQ_NONE : IRQ_HANDLED; - } - -@@ -473,7 +507,7 @@ static int adv7511_wait_for_edid(struct adv7511 *adv7511, int timeout) - adv7511->edid_read, msecs_to_jiffies(timeout)); - } else { - for (; timeout > 0; timeout -= 25) { -- ret = adv7511_irq_process(adv7511); -+ ret = adv7511_irq_process(adv7511, false); - if (ret < 0) - break; - -@@ -567,13 +601,18 @@ static int adv7511_get_modes(struct drm_encoder *encoder, - - /* Reading the EDID only works if the device is powered */ - if (!adv7511->powered) { -- regmap_write(adv7511->regmap, ADV7511_REG_INT(0), -- ADV7511_INT0_EDID_READY); -- regmap_write(adv7511->regmap, ADV7511_REG_INT(1), -- ADV7511_INT1_DDC_ERROR); - regmap_update_bits(adv7511->regmap, ADV7511_REG_POWER, - ADV7511_POWER_POWER_DOWN, 0); -+ if (adv7511->i2c_main->irq) { -+ regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(0), -+ ADV7511_INT0_EDID_READY); -+ regmap_write(adv7511->regmap, ADV7511_REG_INT_ENABLE(1), -+ ADV7511_INT1_DDC_ERROR); -+ } - adv7511->current_edid_segment = -1; -+ /* Reset the EDID_I2C_ADDR register as it might be cleared */ -+ regmap_write(adv7511->regmap, ADV7511_REG_EDID_I2C_ADDR, -+ edid_i2c_addr); - } - - edid = drm_do_get_edid(connector, adv7511_get_edid_block, adv7511); -@@ -849,10 +888,6 @@ static int adv7511_parse_dt(struct device_node *np, - return 0; - } - --static const int edid_i2c_addr = 0x7e; --static const int packet_i2c_addr = 0x70; --static const int cec_i2c_addr = 0x78; -- - static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) - { - struct adv7511_link_config link_config; -@@ -913,6 +948,8 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id) - if (!adv7511->i2c_edid) - return -ENOMEM; - -+ INIT_WORK(&adv7511->hpd_work, adv7511_hpd_work); -+ - if (i2c->irq) { - init_waitqueue_head(&adv7511->wq); - -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c -index d671dcfaff3c..4896474da320 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c -@@ -180,6 +180,10 @@ nvkm_pci_new_(const struct nvkm_pci_func *func, struct nvkm_device *device, - } - } - -+#ifdef __BIG_ENDIAN -+ pci->msi = false; -+#endif -+ - pci->msi = nvkm_boolopt(device->cfgopt, "NvMSI", pci->msi); - if (pci->msi && func->msi_rearm) { - pci->msi = pci_enable_msi(pci->pdev) == 0; -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index d57a2f75dccf..32c6a40a408f 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -72,6 +72,16 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa2a6), - .driver_data = (kernel_ulong_t)0, - }, -+ { -+ /* Cannon Lake H */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xa326), -+ .driver_data = (kernel_ulong_t)0, -+ }, -+ { -+ /* Cannon Lake LP */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6), -+ .driver_data = (kernel_ulong_t)0, -+ }, - { 0 }, - }; - -diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c -index ce6ff9b301bb..7e2dc5e56632 100644 ---- a/drivers/input/mouse/trackpoint.c -+++ b/drivers/input/mouse/trackpoint.c -@@ -381,8 +381,8 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties) - return 0; - - if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) { -- psmouse_warn(psmouse, "failed to get extended button data\n"); -- button_info = 0; -+ psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n"); -+ button_info = 0x33; - } - - psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL); -diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c -index 531de256d58d..05de75360fa4 100644 ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -1607,6 +1607,12 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode) - goto err_wmi_detach; - } - -+ /* If firmware indicates Full Rx Reorder support it must be used in a -+ * slightly different manner. Let HTT code know. -+ */ -+ ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER, -+ ar->wmi.svc_map)); -+ - status = ath10k_htt_rx_alloc(&ar->htt); - if (status) { - ath10k_err(ar, "failed to alloc htt rx: %d\n", status); -@@ -1669,12 +1675,6 @@ int ath10k_core_start(struct ath10k *ar, enum ath10k_firmware_mode mode) - goto err_hif_stop; - } - -- /* If firmware indicates Full Rx Reorder support it must be used in a -- * slightly different manner. Let HTT code know. -- */ -- ar->htt.rx_ring.in_ord_rx = !!(test_bit(WMI_SERVICE_RX_FULL_REORDER, -- ar->wmi.svc_map)); -- - status = ath10k_htt_rx_ring_refill(ar); - if (status) { - ath10k_err(ar, "failed to refill htt rx ring: %d\n", status); -diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c -index c3331d6201c3..9a8982f581c5 100644 ---- a/drivers/net/wireless/mwifiex/cfg80211.c -+++ b/drivers/net/wireless/mwifiex/cfg80211.c -@@ -3740,7 +3740,7 @@ int mwifiex_init_channel_scan_gap(struct mwifiex_adapter *adapter) - if (adapter->config_bands & BAND_A) - n_channels_a = mwifiex_band_5ghz.n_channels; - -- adapter->num_in_chan_stats = max_t(u32, n_channels_bg, n_channels_a); -+ adapter->num_in_chan_stats = n_channels_bg + n_channels_a; - adapter->chan_stats = vmalloc(sizeof(*adapter->chan_stats) * - adapter->num_in_chan_stats); - -diff --git a/drivers/net/wireless/mwifiex/scan.c b/drivers/net/wireless/mwifiex/scan.c -index c20017ced566..fb98f42cb5e7 100644 ---- a/drivers/net/wireless/mwifiex/scan.c -+++ b/drivers/net/wireless/mwifiex/scan.c -@@ -2170,6 +2170,12 @@ mwifiex_update_chan_statistics(struct mwifiex_private *priv, - sizeof(struct mwifiex_chan_stats); - - for (i = 0 ; i < num_chan; i++) { -+ if (adapter->survey_idx >= adapter->num_in_chan_stats) { -+ mwifiex_dbg(adapter, WARN, -+ "FW reported too many channel results (max %d)\n", -+ adapter->num_in_chan_stats); -+ return; -+ } - chan_stats.chan_num = fw_chan_stats->chan_num; - chan_stats.bandcfg = fw_chan_stats->bandcfg; - chan_stats.flags = fw_chan_stats->flags; -diff --git a/drivers/net/wireless/realtek/rtlwifi/pci.c b/drivers/net/wireless/realtek/rtlwifi/pci.c -index a52230377e2c..c48b7e8ee0d6 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/pci.c -+++ b/drivers/net/wireless/realtek/rtlwifi/pci.c -@@ -2269,7 +2269,7 @@ int rtl_pci_probe(struct pci_dev *pdev, - /* find adapter */ - if (!_rtl_pci_find_adapter(pdev, hw)) { - err = -ENODEV; -- goto fail3; -+ goto fail2; - } - - /* Init IO handler */ -@@ -2339,10 +2339,10 @@ fail3: - pci_set_drvdata(pdev, NULL); - rtl_deinit_core(hw); - -+fail2: - if (rtlpriv->io.pci_mem_start != 0) - pci_iounmap(pdev, (void __iomem *)rtlpriv->io.pci_mem_start); - --fail2: - pci_release_regions(pdev); - complete(&rtlpriv->firmware_loading_complete); - -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 8a9e139e2853..71325972e503 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1254,6 +1254,7 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) - unsigned long req_sz, len, sa; - Sg_scatter_hold *rsv_schp; - int k, length; -+ int ret = 0; - - if ((!filp) || (!vma) || (!(sfp = (Sg_fd *) filp->private_data))) - return -ENXIO; -@@ -1264,8 +1265,11 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) - if (vma->vm_pgoff) - return -EINVAL; /* want no offset */ - rsv_schp = &sfp->reserve; -- if (req_sz > rsv_schp->bufflen) -- return -ENOMEM; /* cannot map more than reserved buffer */ -+ mutex_lock(&sfp->f_mutex); -+ if (req_sz > rsv_schp->bufflen) { -+ ret = -ENOMEM; /* cannot map more than reserved buffer */ -+ goto out; -+ } - - sa = vma->vm_start; - length = 1 << (PAGE_SHIFT + rsv_schp->page_order); -@@ -1279,7 +1283,9 @@ sg_mmap(struct file *filp, struct vm_area_struct *vma) - vma->vm_flags |= VM_IO | VM_DONTEXPAND | VM_DONTDUMP; - vma->vm_private_data = sfp; - vma->vm_ops = &sg_mmap_vm_ops; -- return 0; -+out: -+ mutex_unlock(&sfp->f_mutex); -+ return ret; - } - - static void -@@ -1751,9 +1757,12 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) - !sfp->res_in_use) { - sfp->res_in_use = 1; - sg_link_reserve(sfp, srp, dxfer_len); -- } else if ((hp->flags & SG_FLAG_MMAP_IO) && sfp->res_in_use) { -+ } else if (hp->flags & SG_FLAG_MMAP_IO) { -+ res = -EBUSY; /* sfp->res_in_use == 1 */ -+ if (dxfer_len > rsv_schp->bufflen) -+ res = -ENOMEM; - mutex_unlock(&sfp->f_mutex); -- return -EBUSY; -+ return res; - } else { - res = sg_build_indirect(req_schp, sfp, dxfer_len); - if (res) { -diff --git a/drivers/staging/rts5208/rtsx_scsi.c b/drivers/staging/rts5208/rtsx_scsi.c -index 60871f3022b1..12a3893b98fd 100644 ---- a/drivers/staging/rts5208/rtsx_scsi.c -+++ b/drivers/staging/rts5208/rtsx_scsi.c -@@ -414,7 +414,7 @@ void set_sense_data(struct rtsx_chip *chip, unsigned int lun, u8 err_code, - sense->ascq = ascq; - if (sns_key_info0 != 0) { - sense->sns_key_info[0] = SKSV | sns_key_info0; -- sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 8; -+ sense->sns_key_info[1] = (sns_key_info1 & 0xf0) >> 4; - sense->sns_key_info[2] = sns_key_info1 & 0x0f; - } - } -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 54d2d6b604c0..873ba02d59e6 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -519,6 +519,8 @@ static void async_completed(struct urb *urb) - if (as->status < 0 && as->bulk_addr && as->status != -ECONNRESET && - as->status != -ENOENT) - cancel_bulk_urbs(ps, as->bulk_addr); -+ -+ wake_up(&ps->wait); - spin_unlock(&ps->lock); - - if (signr) { -@@ -526,8 +528,6 @@ static void async_completed(struct urb *urb) - put_pid(pid); - put_cred(cred); - } -- -- wake_up(&ps->wait); - } - - static void destroy_async(struct usb_dev_state *ps, struct list_head *list) -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 574da2b4529c..82806e311202 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -57,8 +57,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Microsoft LifeCam-VX700 v2.0 */ - { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, - -- /* Logitech HD Pro Webcams C920 and C930e */ -+ /* Logitech HD Pro Webcams C920, C920-C and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, -+ { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, - - /* Logitech ConferenceCam CC3000e */ -@@ -217,6 +218,9 @@ static const struct usb_device_id usb_quirk_list[] = { - { USB_DEVICE(0x1a0a, 0x0200), .driver_info = - USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL }, - -+ /* Corsair Strafe RGB */ -+ { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* Acer C120 LED Projector */ - { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index 03b9a372636f..1fc6f478a02c 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -133,29 +133,30 @@ static int amd_chipset_sb_type_init(struct amd_chipset_info *pinfo) - pinfo->sb_type.gen = AMD_CHIPSET_SB700; - else if (rev >= 0x40 && rev <= 0x4f) - pinfo->sb_type.gen = AMD_CHIPSET_SB800; -- } -- pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, -- 0x145c, NULL); -- if (pinfo->smbus_dev) { -- pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; - } else { - pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, - PCI_DEVICE_ID_AMD_HUDSON2_SMBUS, NULL); - -- if (!pinfo->smbus_dev) { -- pinfo->sb_type.gen = NOT_AMD_CHIPSET; -- return 0; -+ if (pinfo->smbus_dev) { -+ rev = pinfo->smbus_dev->revision; -+ if (rev >= 0x11 && rev <= 0x14) -+ pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2; -+ else if (rev >= 0x15 && rev <= 0x18) -+ pinfo->sb_type.gen = AMD_CHIPSET_BOLTON; -+ else if (rev >= 0x39 && rev <= 0x3a) -+ pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE; -+ } else { -+ pinfo->smbus_dev = pci_get_device(PCI_VENDOR_ID_AMD, -+ 0x145c, NULL); -+ if (pinfo->smbus_dev) { -+ rev = pinfo->smbus_dev->revision; -+ pinfo->sb_type.gen = AMD_CHIPSET_TAISHAN; -+ } else { -+ pinfo->sb_type.gen = NOT_AMD_CHIPSET; -+ return 0; -+ } - } -- -- rev = pinfo->smbus_dev->revision; -- if (rev >= 0x11 && rev <= 0x14) -- pinfo->sb_type.gen = AMD_CHIPSET_HUDSON2; -- else if (rev >= 0x15 && rev <= 0x18) -- pinfo->sb_type.gen = AMD_CHIPSET_BOLTON; -- else if (rev >= 0x39 && rev <= 0x3a) -- pinfo->sb_type.gen = AMD_CHIPSET_YANGTZE; - } -- - pinfo->sb_type.rev = rev; - return 1; - } -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index fe123153b1a5..2a9944326210 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2023,6 +2023,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x02, 0x01) }, - { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d04, 0xff) }, /* D-Link DWM-158 */ -+ { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7d0e, 0xff) }, /* D-Link DWM-157 C1 */ - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e19, 0xff), /* D-Link DWM-221 B1 */ - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE_INTERFACE_CLASS(0x2001, 0x7e35, 0xff), /* D-Link DWM-222 */ -diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c -index 5d34a062ca4f..3bd2233737ac 100644 ---- a/fs/btrfs/super.c -+++ b/fs/btrfs/super.c -@@ -1727,6 +1727,8 @@ static int btrfs_remount(struct super_block *sb, int *flags, char *data) - goto restore; - } - -+ btrfs_qgroup_rescan_resume(fs_info); -+ - if (!fs_info->uuid_root) { - btrfs_info(fs_info, "creating UUID tree"); - ret = btrfs_create_uuid_tree(fs_info); -diff --git a/fs/dlm/user.c b/fs/dlm/user.c -index 173b3873a4f4..e40c440a4555 100644 ---- a/fs/dlm/user.c -+++ b/fs/dlm/user.c -@@ -355,6 +355,10 @@ static int dlm_device_register(struct dlm_ls *ls, char *name) - error = misc_register(&ls->ls_device); - if (error) { - kfree(ls->ls_device.name); -+ /* this has to be set to NULL -+ * to avoid a double-free in dlm_device_deregister -+ */ -+ ls->ls_device.name = NULL; - } - fail: - return error; -diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h -index 9dea85f7f918..578350fd96e1 100644 ---- a/fs/nfs/internal.h -+++ b/fs/nfs/internal.h -@@ -243,7 +243,6 @@ int nfs_iocounter_wait(struct nfs_io_counter *c); - extern const struct nfs_pageio_ops nfs_pgio_rw_ops; - struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *); - void nfs_pgio_header_free(struct nfs_pgio_header *); --void nfs_pgio_data_destroy(struct nfs_pgio_header *); - int nfs_generic_pgio(struct nfs_pageio_descriptor *, struct nfs_pgio_header *); - int nfs_initiate_pgio(struct rpc_clnt *clnt, struct nfs_pgio_header *hdr, - struct rpc_cred *cred, const struct nfs_rpc_ops *rpc_ops, -diff --git a/fs/nfs/pagelist.c b/fs/nfs/pagelist.c -index 452a011ba0d8..8ebfdd00044b 100644 ---- a/fs/nfs/pagelist.c -+++ b/fs/nfs/pagelist.c -@@ -528,16 +528,6 @@ struct nfs_pgio_header *nfs_pgio_header_alloc(const struct nfs_rw_ops *ops) - } - EXPORT_SYMBOL_GPL(nfs_pgio_header_alloc); - --/* -- * nfs_pgio_header_free - Free a read or write header -- * @hdr: The header to free -- */ --void nfs_pgio_header_free(struct nfs_pgio_header *hdr) --{ -- hdr->rw_ops->rw_free_header(hdr); --} --EXPORT_SYMBOL_GPL(nfs_pgio_header_free); -- - /** - * nfs_pgio_data_destroy - make @hdr suitable for reuse - * -@@ -546,14 +536,24 @@ EXPORT_SYMBOL_GPL(nfs_pgio_header_free); - * - * @hdr: A header that has had nfs_generic_pgio called - */ --void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) -+static void nfs_pgio_data_destroy(struct nfs_pgio_header *hdr) - { - if (hdr->args.context) - put_nfs_open_context(hdr->args.context); - if (hdr->page_array.pagevec != hdr->page_array.page_array) - kfree(hdr->page_array.pagevec); - } --EXPORT_SYMBOL_GPL(nfs_pgio_data_destroy); -+ -+/* -+ * nfs_pgio_header_free - Free a read or write header -+ * @hdr: The header to free -+ */ -+void nfs_pgio_header_free(struct nfs_pgio_header *hdr) -+{ -+ nfs_pgio_data_destroy(hdr); -+ hdr->rw_ops->rw_free_header(hdr); -+} -+EXPORT_SYMBOL_GPL(nfs_pgio_header_free); - - /** - * nfs_pgio_rpcsetup - Set up arguments for a pageio call -@@ -671,7 +671,6 @@ static int nfs_pgio_error(struct nfs_pageio_descriptor *desc, - u32 midx; - - set_bit(NFS_IOHDR_REDO, &hdr->flags); -- nfs_pgio_data_destroy(hdr); - hdr->completion_ops->completion(hdr); - /* TODO: Make sure it's right to clean up all mirrors here - * and not just hdr->pgio_mirror_idx */ -@@ -689,7 +688,6 @@ static int nfs_pgio_error(struct nfs_pageio_descriptor *desc, - static void nfs_pgio_release(void *calldata) - { - struct nfs_pgio_header *hdr = calldata; -- nfs_pgio_data_destroy(hdr); - hdr->completion_ops->completion(hdr); - } - -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 3cae0726c1b1..7af7bedd7c02 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1943,7 +1943,6 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc, - nfs_pageio_reset_write_mds(desc); - mirror->pg_recoalesce = 1; - } -- nfs_pgio_data_destroy(hdr); - hdr->release(hdr); - } - -@@ -2059,7 +2058,6 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc, - nfs_pageio_reset_read_mds(desc); - mirror->pg_recoalesce = 1; - } -- nfs_pgio_data_destroy(hdr); - hdr->release(hdr); - } - -diff --git a/fs/xfs/xfs_linux.h b/fs/xfs/xfs_linux.h -index ec0e239a0fa9..201aae0b2662 100644 ---- a/fs/xfs/xfs_linux.h -+++ b/fs/xfs/xfs_linux.h -@@ -369,7 +369,14 @@ static inline __uint64_t howmany_64(__uint64_t x, __uint32_t y) - #endif /* DEBUG */ - - #ifdef CONFIG_XFS_RT --#define XFS_IS_REALTIME_INODE(ip) ((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME) -+ -+/* -+ * make sure we ignore the inode flag if the filesystem doesn't have a -+ * configured realtime device. -+ */ -+#define XFS_IS_REALTIME_INODE(ip) \ -+ (((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME) && \ -+ (ip)->i_mount->m_rtdev_targp) - #else - #define XFS_IS_REALTIME_INODE(ip) (0) - #endif -diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h -index 37f05cb1dfd6..1af616138d1d 100644 ---- a/include/linux/pci_ids.h -+++ b/include/linux/pci_ids.h -@@ -573,6 +573,7 @@ - #define PCI_DEVICE_ID_AMD_CS5536_EHC 0x2095 - #define PCI_DEVICE_ID_AMD_CS5536_UDC 0x2096 - #define PCI_DEVICE_ID_AMD_CS5536_UOC 0x2097 -+#define PCI_DEVICE_ID_AMD_CS5536_DEV_IDE 0x2092 - #define PCI_DEVICE_ID_AMD_CS5536_IDE 0x209A - #define PCI_DEVICE_ID_AMD_LX_VIDEO 0x2081 - #define PCI_DEVICE_ID_AMD_LX_AES 0x2082 -diff --git a/include/linux/workqueue.h b/include/linux/workqueue.h -index 262d5c95dfc8..217abe56e711 100644 ---- a/include/linux/workqueue.h -+++ b/include/linux/workqueue.h -@@ -311,7 +311,7 @@ enum { - - __WQ_DRAINING = 1 << 16, /* internal: workqueue is draining */ - __WQ_ORDERED = 1 << 17, /* internal: workqueue is ordered */ -- __WQ_ORDERED_EXPLICIT = 1 << 18, /* internal: alloc_ordered_workqueue() */ -+ __WQ_ORDERED_EXPLICIT = 1 << 19, /* internal: alloc_ordered_workqueue() */ - - WQ_MAX_ACTIVE = 512, /* I like 512, better ideas? */ - WQ_MAX_UNBOUND_PER_CPU = 4, /* 4 * #cpus for unbound wq */ -diff --git a/kernel/locking/locktorture.c b/kernel/locking/locktorture.c -index 8ef1919d63b2..d580b7d6ee6d 100644 ---- a/kernel/locking/locktorture.c -+++ b/kernel/locking/locktorture.c -@@ -776,6 +776,8 @@ static void lock_torture_cleanup(void) - else - lock_torture_print_module_parms(cxt.cur_ops, - "End of test: SUCCESS"); -+ kfree(cxt.lwsa); -+ kfree(cxt.lrsa); - torture_cleanup_end(); - } - -@@ -917,6 +919,8 @@ static int __init lock_torture_init(void) - GFP_KERNEL); - if (reader_tasks == NULL) { - VERBOSE_TOROUT_ERRSTRING("reader_tasks: Out of memory"); -+ kfree(writer_tasks); -+ writer_tasks = NULL; - firsterr = -ENOMEM; - goto unwind; - } -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 66e8b6ee19a5..357bcd34cf1f 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -57,7 +57,7 @@ static struct sk_buff *l2cap_build_cmd(struct l2cap_conn *conn, - u8 code, u8 ident, u16 dlen, void *data); - static void l2cap_send_cmd(struct l2cap_conn *conn, u8 ident, u8 code, u16 len, - void *data); --static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data); -+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size); - static void l2cap_send_disconn_req(struct l2cap_chan *chan, int err); - - static void l2cap_tx(struct l2cap_chan *chan, struct l2cap_ctrl *control, -@@ -1462,7 +1462,7 @@ static void l2cap_conn_start(struct l2cap_conn *conn) - - set_bit(CONF_REQ_SENT, &chan->conf_state); - l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), buf); -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); - chan->num_conf_req++; - } - -@@ -2966,12 +2966,15 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, - return len; - } - --static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) -+static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val, size_t size) - { - struct l2cap_conf_opt *opt = *ptr; - - BT_DBG("type 0x%2.2x len %u val 0x%lx", type, len, val); - -+ if (size < L2CAP_CONF_OPT_SIZE + len) -+ return; -+ - opt->type = type; - opt->len = len; - -@@ -2996,7 +2999,7 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val) - *ptr += L2CAP_CONF_OPT_SIZE + len; - } - --static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) -+static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan, size_t size) - { - struct l2cap_conf_efs efs; - -@@ -3024,7 +3027,7 @@ static void l2cap_add_opt_efs(void **ptr, struct l2cap_chan *chan) - } - - l2cap_add_conf_opt(ptr, L2CAP_CONF_EFS, sizeof(efs), -- (unsigned long) &efs); -+ (unsigned long) &efs, size); - } - - static void l2cap_ack_timeout(struct work_struct *work) -@@ -3170,11 +3173,12 @@ static inline void l2cap_txwin_setup(struct l2cap_chan *chan) - chan->ack_win = chan->tx_win; - } - --static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) -+static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) - { - struct l2cap_conf_req *req = data; - struct l2cap_conf_rfc rfc = { .mode = chan->mode }; - void *ptr = req->data; -+ void *endptr = data + data_size; - u16 size; - - BT_DBG("chan %p", chan); -@@ -3199,7 +3203,7 @@ static int l2cap_build_conf_req(struct l2cap_chan *chan, void *data) - - done: - if (chan->imtu != L2CAP_DEFAULT_MTU) -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); - - switch (chan->mode) { - case L2CAP_MODE_BASIC: -@@ -3218,7 +3222,7 @@ done: - rfc.max_pdu_size = 0; - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -- (unsigned long) &rfc); -+ (unsigned long) &rfc, endptr - ptr); - break; - - case L2CAP_MODE_ERTM: -@@ -3238,21 +3242,21 @@ done: - L2CAP_DEFAULT_TX_WINDOW); - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -- (unsigned long) &rfc); -+ (unsigned long) &rfc, endptr - ptr); - - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) -- l2cap_add_opt_efs(&ptr, chan); -+ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); - - if (test_bit(FLAG_EXT_CTRL, &chan->flags)) - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, -- chan->tx_win); -+ chan->tx_win, endptr - ptr); - - if (chan->conn->feat_mask & L2CAP_FEAT_FCS) - if (chan->fcs == L2CAP_FCS_NONE || - test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { - chan->fcs = L2CAP_FCS_NONE; - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, -- chan->fcs); -+ chan->fcs, endptr - ptr); - } - break; - -@@ -3270,17 +3274,17 @@ done: - rfc.max_pdu_size = cpu_to_le16(size); - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -- (unsigned long) &rfc); -+ (unsigned long) &rfc, endptr - ptr); - - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) -- l2cap_add_opt_efs(&ptr, chan); -+ l2cap_add_opt_efs(&ptr, chan, endptr - ptr); - - if (chan->conn->feat_mask & L2CAP_FEAT_FCS) - if (chan->fcs == L2CAP_FCS_NONE || - test_bit(CONF_RECV_NO_FCS, &chan->conf_state)) { - chan->fcs = L2CAP_FCS_NONE; - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FCS, 1, -- chan->fcs); -+ chan->fcs, endptr - ptr); - } - break; - } -@@ -3291,10 +3295,11 @@ done: - return ptr - data; - } - --static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data) -+static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data_size) - { - struct l2cap_conf_rsp *rsp = data; - void *ptr = rsp->data; -+ void *endptr = data + data_size; - void *req = chan->conf_req; - int len = chan->conf_len; - int type, hint, olen; -@@ -3396,7 +3401,7 @@ done: - return -ECONNREFUSED; - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -- (unsigned long) &rfc); -+ (unsigned long) &rfc, endptr - ptr); - } - - if (result == L2CAP_CONF_SUCCESS) { -@@ -3409,7 +3414,7 @@ done: - chan->omtu = mtu; - set_bit(CONF_MTU_DONE, &chan->conf_state); - } -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->omtu, endptr - ptr); - - if (remote_efs) { - if (chan->local_stype != L2CAP_SERV_NOTRAFIC && -@@ -3423,7 +3428,7 @@ done: - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, - sizeof(efs), -- (unsigned long) &efs); -+ (unsigned long) &efs, endptr - ptr); - } else { - /* Send PENDING Conf Rsp */ - result = L2CAP_CONF_PENDING; -@@ -3456,7 +3461,7 @@ done: - set_bit(CONF_MODE_DONE, &chan->conf_state); - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, -- sizeof(rfc), (unsigned long) &rfc); -+ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - - if (test_bit(FLAG_EFS_ENABLE, &chan->flags)) { - chan->remote_id = efs.id; -@@ -3470,7 +3475,7 @@ done: - le32_to_cpu(efs.sdu_itime); - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, - sizeof(efs), -- (unsigned long) &efs); -+ (unsigned long) &efs, endptr - ptr); - } - break; - -@@ -3484,7 +3489,7 @@ done: - set_bit(CONF_MODE_DONE, &chan->conf_state); - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, sizeof(rfc), -- (unsigned long) &rfc); -+ (unsigned long) &rfc, endptr - ptr); - - break; - -@@ -3506,10 +3511,11 @@ done: - } - - static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, -- void *data, u16 *result) -+ void *data, size_t size, u16 *result) - { - struct l2cap_conf_req *req = data; - void *ptr = req->data; -+ void *endptr = data + size; - int type, olen; - unsigned long val; - struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC }; -@@ -3527,13 +3533,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - chan->imtu = L2CAP_DEFAULT_MIN_MTU; - } else - chan->imtu = val; -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_MTU, 2, chan->imtu, endptr - ptr); - break; - - case L2CAP_CONF_FLUSH_TO: - chan->flush_to = val; - l2cap_add_conf_opt(&ptr, L2CAP_CONF_FLUSH_TO, -- 2, chan->flush_to); -+ 2, chan->flush_to, endptr - ptr); - break; - - case L2CAP_CONF_RFC: -@@ -3547,13 +3553,13 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - chan->fcs = 0; - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC, -- sizeof(rfc), (unsigned long) &rfc); -+ sizeof(rfc), (unsigned long) &rfc, endptr - ptr); - break; - - case L2CAP_CONF_EWS: - chan->ack_win = min_t(u16, val, chan->ack_win); - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EWS, 2, -- chan->tx_win); -+ chan->tx_win, endptr - ptr); - break; - - case L2CAP_CONF_EFS: -@@ -3566,7 +3572,7 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - return -ECONNREFUSED; - - l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), -- (unsigned long) &efs); -+ (unsigned long) &efs, endptr - ptr); - break; - - case L2CAP_CONF_FCS: -@@ -3671,7 +3677,7 @@ void __l2cap_connect_rsp_defer(struct l2cap_chan *chan) - return; - - l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), buf); -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); - chan->num_conf_req++; - } - -@@ -3879,7 +3885,7 @@ sendresp: - u8 buf[128]; - set_bit(CONF_REQ_SENT, &chan->conf_state); - l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), buf); -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); - chan->num_conf_req++; - } - -@@ -3957,7 +3963,7 @@ static int l2cap_connect_create_rsp(struct l2cap_conn *conn, - break; - - l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, req), req); -+ l2cap_build_conf_req(chan, req, sizeof(req)), req); - chan->num_conf_req++; - break; - -@@ -4069,7 +4075,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, - } - - /* Complete config. */ -- len = l2cap_parse_conf_req(chan, rsp); -+ len = l2cap_parse_conf_req(chan, rsp, sizeof(rsp)); - if (len < 0) { - l2cap_send_disconn_req(chan, ECONNRESET); - goto unlock; -@@ -4103,7 +4109,7 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, - if (!test_and_set_bit(CONF_REQ_SENT, &chan->conf_state)) { - u8 buf[64]; - l2cap_send_cmd(conn, l2cap_get_ident(conn), L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), buf); -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); - chan->num_conf_req++; - } - -@@ -4163,7 +4169,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, - char buf[64]; - - len = l2cap_parse_conf_rsp(chan, rsp->data, len, -- buf, &result); -+ buf, sizeof(buf), &result); - if (len < 0) { - l2cap_send_disconn_req(chan, ECONNRESET); - goto done; -@@ -4193,7 +4199,7 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, - /* throw out any old stored conf requests */ - result = L2CAP_CONF_SUCCESS; - len = l2cap_parse_conf_rsp(chan, rsp->data, len, -- req, &result); -+ req, sizeof(req), &result); - if (len < 0) { - l2cap_send_disconn_req(chan, ECONNRESET); - goto done; -@@ -4770,7 +4776,7 @@ static void l2cap_do_create(struct l2cap_chan *chan, int result, - set_bit(CONF_REQ_SENT, &chan->conf_state); - l2cap_send_cmd(chan->conn, l2cap_get_ident(chan->conn), - L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), buf); -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), buf); - chan->num_conf_req++; - } - } -@@ -7442,7 +7448,7 @@ static void l2cap_security_cfm(struct hci_conn *hcon, u8 status, u8 encrypt) - set_bit(CONF_REQ_SENT, &chan->conf_state); - l2cap_send_cmd(conn, l2cap_get_ident(conn), - L2CAP_CONF_REQ, -- l2cap_build_conf_req(chan, buf), -+ l2cap_build_conf_req(chan, buf, sizeof(buf)), - buf); - chan->num_conf_req++; - } -diff --git a/sound/isa/msnd/msnd_midi.c b/sound/isa/msnd/msnd_midi.c -index ffc67fd80c23..58e59cd3c95c 100644 ---- a/sound/isa/msnd/msnd_midi.c -+++ b/sound/isa/msnd/msnd_midi.c -@@ -120,24 +120,24 @@ void snd_msndmidi_input_read(void *mpuv) - unsigned long flags; - struct snd_msndmidi *mpu = mpuv; - void *pwMIDQData = mpu->dev->mappedbase + MIDQ_DATA_BUFF; -+ u16 head, tail, size; - - spin_lock_irqsave(&mpu->input_lock, flags); -- while (readw(mpu->dev->MIDQ + JQS_wTail) != -- readw(mpu->dev->MIDQ + JQS_wHead)) { -- u16 wTmp, val; -- val = readw(pwMIDQData + 2 * readw(mpu->dev->MIDQ + JQS_wHead)); -- -- if (test_bit(MSNDMIDI_MODE_BIT_INPUT_TRIGGER, -- &mpu->mode)) -- snd_rawmidi_receive(mpu->substream_input, -- (unsigned char *)&val, 1); -- -- wTmp = readw(mpu->dev->MIDQ + JQS_wHead) + 1; -- if (wTmp > readw(mpu->dev->MIDQ + JQS_wSize)) -- writew(0, mpu->dev->MIDQ + JQS_wHead); -- else -- writew(wTmp, mpu->dev->MIDQ + JQS_wHead); -+ head = readw(mpu->dev->MIDQ + JQS_wHead); -+ tail = readw(mpu->dev->MIDQ + JQS_wTail); -+ size = readw(mpu->dev->MIDQ + JQS_wSize); -+ if (head > size || tail > size) -+ goto out; -+ while (head != tail) { -+ unsigned char val = readw(pwMIDQData + 2 * head); -+ -+ if (test_bit(MSNDMIDI_MODE_BIT_INPUT_TRIGGER, &mpu->mode)) -+ snd_rawmidi_receive(mpu->substream_input, &val, 1); -+ if (++head > size) -+ head = 0; -+ writew(head, mpu->dev->MIDQ + JQS_wHead); - } -+ out: - spin_unlock_irqrestore(&mpu->input_lock, flags); - } - EXPORT_SYMBOL(snd_msndmidi_input_read); -diff --git a/sound/isa/msnd/msnd_pinnacle.c b/sound/isa/msnd/msnd_pinnacle.c -index 4c072666115d..a31ea6c22d19 100644 ---- a/sound/isa/msnd/msnd_pinnacle.c -+++ b/sound/isa/msnd/msnd_pinnacle.c -@@ -170,23 +170,24 @@ static irqreturn_t snd_msnd_interrupt(int irq, void *dev_id) - { - struct snd_msnd *chip = dev_id; - void *pwDSPQData = chip->mappedbase + DSPQ_DATA_BUFF; -+ u16 head, tail, size; - - /* Send ack to DSP */ - /* inb(chip->io + HP_RXL); */ - - /* Evaluate queued DSP messages */ -- while (readw(chip->DSPQ + JQS_wTail) != readw(chip->DSPQ + JQS_wHead)) { -- u16 wTmp; -- -- snd_msnd_eval_dsp_msg(chip, -- readw(pwDSPQData + 2 * readw(chip->DSPQ + JQS_wHead))); -- -- wTmp = readw(chip->DSPQ + JQS_wHead) + 1; -- if (wTmp > readw(chip->DSPQ + JQS_wSize)) -- writew(0, chip->DSPQ + JQS_wHead); -- else -- writew(wTmp, chip->DSPQ + JQS_wHead); -+ head = readw(chip->DSPQ + JQS_wHead); -+ tail = readw(chip->DSPQ + JQS_wTail); -+ size = readw(chip->DSPQ + JQS_wSize); -+ if (head > size || tail > size) -+ goto out; -+ while (head != tail) { -+ snd_msnd_eval_dsp_msg(chip, readw(pwDSPQData + 2 * head)); -+ if (++head > size) -+ head = 0; -+ writew(head, chip->DSPQ + JQS_wHead); - } -+ out: - /* Send ack to DSP */ - inb(chip->io + HP_RXL); - return IRQ_HANDLED; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.88-89.patch b/patch/kernel/mvebu64-default/03-patch-4.4.88-89.patch deleted file mode 100644 index 28665fb4f77d..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.88-89.patch +++ /dev/null @@ -1,2770 +0,0 @@ -diff --git a/Makefile b/Makefile -index 788d90a0051b..7e4c46b375b3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 88 -+SUBLEVEL = 89 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/entry.S b/arch/arc/kernel/entry.S -index 2efb0625331d..db1eee5fe502 100644 ---- a/arch/arc/kernel/entry.S -+++ b/arch/arc/kernel/entry.S -@@ -104,6 +104,12 @@ ENTRY(EV_MachineCheck) - lr r0, [efa] - mov r1, sp - -+ ; hardware auto-disables MMU, re-enable it to allow kernel vaddr -+ ; access for say stack unwinding of modules for crash dumps -+ lr r3, [ARC_REG_PID] -+ or r3, r3, MMU_ENABLE -+ sr r3, [ARC_REG_PID] -+ - lsr r3, r2, 8 - bmsk r3, r3, 7 - brne r3, ECR_C_MCHK_DUP_TLB, 1f -diff --git a/arch/arc/mm/tlb.c b/arch/arc/mm/tlb.c -index daf2bf52b984..97e9582dcf99 100644 ---- a/arch/arc/mm/tlb.c -+++ b/arch/arc/mm/tlb.c -@@ -885,9 +885,6 @@ void do_tlb_overlap_fault(unsigned long cause, unsigned long address, - - local_irq_save(flags); - -- /* re-enable the MMU */ -- write_aux_reg(ARC_REG_PID, MMU_ENABLE | read_aux_reg(ARC_REG_PID)); -- - /* loop thru all sets of TLB */ - for (set = 0; set < mmu->sets; set++) { - -diff --git a/arch/mips/math-emu/dp_fmax.c b/arch/mips/math-emu/dp_fmax.c -index fd71b8daaaf2..5bec64f2884e 100644 ---- a/arch/mips/math-emu/dp_fmax.c -+++ b/arch/mips/math-emu/dp_fmax.c -@@ -47,14 +47,26 @@ union ieee754dp ieee754dp_fmax(union ieee754dp x, union ieee754dp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754dp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -80,9 +92,7 @@ union ieee754dp ieee754dp_fmax(union ieee754dp x, union ieee754dp y) - return ys ? x : y; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754dp_zero(1); -+ return ieee754dp_zero(xs & ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - DPDNORMX; -@@ -106,16 +116,32 @@ union ieee754dp ieee754dp_fmax(union ieee754dp x, union ieee754dp y) - else if (xs < ys) - return x; - -- /* Compare exponent */ -- if (xe > ye) -- return x; -- else if (xe < ye) -- return y; -+ /* Signs of inputs are equal, let's compare exponents */ -+ if (xs == 0) { -+ /* Inputs are both positive */ -+ if (xe > ye) -+ return x; -+ else if (xe < ye) -+ return y; -+ } else { -+ /* Inputs are both negative */ -+ if (xe > ye) -+ return y; -+ else if (xe < ye) -+ return x; -+ } - -- /* Compare mantissa */ -+ /* Signs and exponents of inputs are equal, let's compare mantissas */ -+ if (xs == 0) { -+ /* Inputs are both positive, with equal signs and exponents */ -+ if (xm <= ym) -+ return y; -+ return x; -+ } -+ /* Inputs are both negative, with equal signs and exponents */ - if (xm <= ym) -- return y; -- return x; -+ return x; -+ return y; - } - - union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) -@@ -147,14 +173,26 @@ union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754dp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -164,6 +202,9 @@ union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) - /* - * Infinity and zero handling - */ -+ case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): -+ return ieee754dp_inf(xs & ys); -+ - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_DNORM): -@@ -171,7 +212,6 @@ union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_ZERO): - return x; - -- case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_INF): -@@ -180,9 +220,7 @@ union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) - return y; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754dp_zero(1); -+ return ieee754dp_zero(xs & ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - DPDNORMX; -@@ -207,7 +245,11 @@ union ieee754dp ieee754dp_fmaxa(union ieee754dp x, union ieee754dp y) - return y; - - /* Compare mantissa */ -- if (xm <= ym) -+ if (xm < ym) - return y; -- return x; -+ else if (xm > ym) -+ return x; -+ else if (xs == 0) -+ return x; -+ return y; - } -diff --git a/arch/mips/math-emu/dp_fmin.c b/arch/mips/math-emu/dp_fmin.c -index c1072b0dfb95..a287b23818d8 100644 ---- a/arch/mips/math-emu/dp_fmin.c -+++ b/arch/mips/math-emu/dp_fmin.c -@@ -47,14 +47,26 @@ union ieee754dp ieee754dp_fmin(union ieee754dp x, union ieee754dp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754dp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -80,9 +92,7 @@ union ieee754dp ieee754dp_fmin(union ieee754dp x, union ieee754dp y) - return ys ? y : x; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754dp_zero(1); -+ return ieee754dp_zero(xs | ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - DPDNORMX; -@@ -106,16 +116,32 @@ union ieee754dp ieee754dp_fmin(union ieee754dp x, union ieee754dp y) - else if (xs < ys) - return y; - -- /* Compare exponent */ -- if (xe > ye) -- return y; -- else if (xe < ye) -- return x; -+ /* Signs of inputs are the same, let's compare exponents */ -+ if (xs == 0) { -+ /* Inputs are both positive */ -+ if (xe > ye) -+ return y; -+ else if (xe < ye) -+ return x; -+ } else { -+ /* Inputs are both negative */ -+ if (xe > ye) -+ return x; -+ else if (xe < ye) -+ return y; -+ } - -- /* Compare mantissa */ -+ /* Signs and exponents of inputs are equal, let's compare mantissas */ -+ if (xs == 0) { -+ /* Inputs are both positive, with equal signs and exponents */ -+ if (xm <= ym) -+ return x; -+ return y; -+ } -+ /* Inputs are both negative, with equal signs and exponents */ - if (xm <= ym) -- return x; -- return y; -+ return y; -+ return x; - } - - union ieee754dp ieee754dp_fmina(union ieee754dp x, union ieee754dp y) -@@ -147,14 +173,26 @@ union ieee754dp ieee754dp_fmina(union ieee754dp x, union ieee754dp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754dp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -164,25 +202,25 @@ union ieee754dp ieee754dp_fmina(union ieee754dp x, union ieee754dp y) - /* - * Infinity and zero handling - */ -+ case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): -+ return ieee754dp_inf(xs | ys); -+ - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_DNORM): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_ZERO): -- return x; -+ return y; - -- case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_DNORM): -- return y; -+ return x; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754dp_zero(1); -+ return ieee754dp_zero(xs | ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - DPDNORMX; -@@ -207,7 +245,11 @@ union ieee754dp ieee754dp_fmina(union ieee754dp x, union ieee754dp y) - return x; - - /* Compare mantissa */ -- if (xm <= ym) -+ if (xm < ym) -+ return x; -+ else if (xm > ym) -+ return y; -+ else if (xs == 1) - return x; - return y; - } -diff --git a/arch/mips/math-emu/sp_fmax.c b/arch/mips/math-emu/sp_fmax.c -index 4d000844e48e..74a5a00d2f22 100644 ---- a/arch/mips/math-emu/sp_fmax.c -+++ b/arch/mips/math-emu/sp_fmax.c -@@ -47,14 +47,26 @@ union ieee754sp ieee754sp_fmax(union ieee754sp x, union ieee754sp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754sp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -80,9 +92,7 @@ union ieee754sp ieee754sp_fmax(union ieee754sp x, union ieee754sp y) - return ys ? x : y; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754sp_zero(1); -+ return ieee754sp_zero(xs & ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - SPDNORMX; -@@ -106,16 +116,32 @@ union ieee754sp ieee754sp_fmax(union ieee754sp x, union ieee754sp y) - else if (xs < ys) - return x; - -- /* Compare exponent */ -- if (xe > ye) -- return x; -- else if (xe < ye) -- return y; -+ /* Signs of inputs are equal, let's compare exponents */ -+ if (xs == 0) { -+ /* Inputs are both positive */ -+ if (xe > ye) -+ return x; -+ else if (xe < ye) -+ return y; -+ } else { -+ /* Inputs are both negative */ -+ if (xe > ye) -+ return y; -+ else if (xe < ye) -+ return x; -+ } - -- /* Compare mantissa */ -+ /* Signs and exponents of inputs are equal, let's compare mantissas */ -+ if (xs == 0) { -+ /* Inputs are both positive, with equal signs and exponents */ -+ if (xm <= ym) -+ return y; -+ return x; -+ } -+ /* Inputs are both negative, with equal signs and exponents */ - if (xm <= ym) -- return y; -- return x; -+ return x; -+ return y; - } - - union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) -@@ -147,14 +173,26 @@ union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754sp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -164,6 +202,9 @@ union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) - /* - * Infinity and zero handling - */ -+ case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): -+ return ieee754sp_inf(xs & ys); -+ - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_DNORM): -@@ -171,7 +212,6 @@ union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_ZERO): - return x; - -- case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_INF): -@@ -180,9 +220,7 @@ union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) - return y; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754sp_zero(1); -+ return ieee754sp_zero(xs & ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - SPDNORMX; -@@ -207,7 +245,11 @@ union ieee754sp ieee754sp_fmaxa(union ieee754sp x, union ieee754sp y) - return y; - - /* Compare mantissa */ -- if (xm <= ym) -+ if (xm < ym) - return y; -- return x; -+ else if (xm > ym) -+ return x; -+ else if (xs == 0) -+ return x; -+ return y; - } -diff --git a/arch/mips/math-emu/sp_fmin.c b/arch/mips/math-emu/sp_fmin.c -index 4eb1bb9e9dec..c51385f46b09 100644 ---- a/arch/mips/math-emu/sp_fmin.c -+++ b/arch/mips/math-emu/sp_fmin.c -@@ -47,14 +47,26 @@ union ieee754sp ieee754sp_fmin(union ieee754sp x, union ieee754sp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754sp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -80,9 +92,7 @@ union ieee754sp ieee754sp_fmin(union ieee754sp x, union ieee754sp y) - return ys ? y : x; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754sp_zero(1); -+ return ieee754sp_zero(xs | ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - SPDNORMX; -@@ -106,16 +116,32 @@ union ieee754sp ieee754sp_fmin(union ieee754sp x, union ieee754sp y) - else if (xs < ys) - return y; - -- /* Compare exponent */ -- if (xe > ye) -- return y; -- else if (xe < ye) -- return x; -+ /* Signs of inputs are the same, let's compare exponents */ -+ if (xs == 0) { -+ /* Inputs are both positive */ -+ if (xe > ye) -+ return y; -+ else if (xe < ye) -+ return x; -+ } else { -+ /* Inputs are both negative */ -+ if (xe > ye) -+ return x; -+ else if (xe < ye) -+ return y; -+ } - -- /* Compare mantissa */ -+ /* Signs and exponents of inputs are equal, let's compare mantissas */ -+ if (xs == 0) { -+ /* Inputs are both positive, with equal signs and exponents */ -+ if (xm <= ym) -+ return x; -+ return y; -+ } -+ /* Inputs are both negative, with equal signs and exponents */ - if (xm <= ym) -- return x; -- return y; -+ return y; -+ return x; - } - - union ieee754sp ieee754sp_fmina(union ieee754sp x, union ieee754sp y) -@@ -147,14 +173,26 @@ union ieee754sp ieee754sp_fmina(union ieee754sp x, union ieee754sp y) - case CLPAIR(IEEE754_CLASS_SNAN, IEEE754_CLASS_INF): - return ieee754sp_nanxcpt(x); - -- /* numbers are preferred to NaNs */ -+ /* -+ * Quiet NaN handling -+ */ -+ -+ /* -+ * The case of both inputs quiet NaNs -+ */ -+ case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): -+ return x; -+ -+ /* -+ * The cases of exactly one input quiet NaN (numbers -+ * are here preferred as returned values to NaNs) -+ */ - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_QNAN): - return x; - -- case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_QNAN): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_QNAN, IEEE754_CLASS_DNORM): -@@ -164,25 +202,25 @@ union ieee754sp ieee754sp_fmina(union ieee754sp x, union ieee754sp y) - /* - * Infinity and zero handling - */ -+ case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): -+ return ieee754sp_inf(xs | ys); -+ - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_DNORM): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_ZERO): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_ZERO): -- return x; -+ return y; - -- case CLPAIR(IEEE754_CLASS_INF, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_NORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_INF): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_NORM): - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_DNORM): -- return y; -+ return x; - - case CLPAIR(IEEE754_CLASS_ZERO, IEEE754_CLASS_ZERO): -- if (xs == ys) -- return x; -- return ieee754sp_zero(1); -+ return ieee754sp_zero(xs | ys); - - case CLPAIR(IEEE754_CLASS_DNORM, IEEE754_CLASS_DNORM): - SPDNORMX; -@@ -207,7 +245,11 @@ union ieee754sp ieee754sp_fmina(union ieee754sp x, union ieee754sp y) - return x; - - /* Compare mantissa */ -- if (xm <= ym) -+ if (xm < ym) -+ return x; -+ else if (xm > ym) -+ return y; -+ else if (xs == 1) - return x; - return y; - } -diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c -index 91e5c1758b5c..64e016abb2a5 100644 ---- a/arch/powerpc/kernel/align.c -+++ b/arch/powerpc/kernel/align.c -@@ -236,6 +236,28 @@ static int emulate_dcbz(struct pt_regs *regs, unsigned char __user *addr) - - #define SWIZ_PTR(p) ((unsigned char __user *)((p) ^ swiz)) - -+#define __get_user_or_set_dar(_regs, _dest, _addr) \ -+ ({ \ -+ int rc = 0; \ -+ typeof(_addr) __addr = (_addr); \ -+ if (__get_user_inatomic(_dest, __addr)) { \ -+ _regs->dar = (unsigned long)__addr; \ -+ rc = -EFAULT; \ -+ } \ -+ rc; \ -+ }) -+ -+#define __put_user_or_set_dar(_regs, _src, _addr) \ -+ ({ \ -+ int rc = 0; \ -+ typeof(_addr) __addr = (_addr); \ -+ if (__put_user_inatomic(_src, __addr)) { \ -+ _regs->dar = (unsigned long)__addr; \ -+ rc = -EFAULT; \ -+ } \ -+ rc; \ -+ }) -+ - static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, - unsigned int reg, unsigned int nb, - unsigned int flags, unsigned int instr, -@@ -264,9 +286,10 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, - } else { - unsigned long pc = regs->nip ^ (swiz & 4); - -- if (__get_user_inatomic(instr, -- (unsigned int __user *)pc)) -+ if (__get_user_or_set_dar(regs, instr, -+ (unsigned int __user *)pc)) - return -EFAULT; -+ - if (swiz == 0 && (flags & SW)) - instr = cpu_to_le32(instr); - nb = (instr >> 11) & 0x1f; -@@ -310,31 +333,31 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, - ((nb0 + 3) / 4) * sizeof(unsigned long)); - - for (i = 0; i < nb; ++i, ++p) -- if (__get_user_inatomic(REG_BYTE(rptr, i ^ bswiz), -- SWIZ_PTR(p))) -+ if (__get_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz), -+ SWIZ_PTR(p))) - return -EFAULT; - if (nb0 > 0) { - rptr = ®s->gpr[0]; - addr += nb; - for (i = 0; i < nb0; ++i, ++p) -- if (__get_user_inatomic(REG_BYTE(rptr, -- i ^ bswiz), -- SWIZ_PTR(p))) -+ if (__get_user_or_set_dar(regs, -+ REG_BYTE(rptr, i ^ bswiz), -+ SWIZ_PTR(p))) - return -EFAULT; - } - - } else { - for (i = 0; i < nb; ++i, ++p) -- if (__put_user_inatomic(REG_BYTE(rptr, i ^ bswiz), -- SWIZ_PTR(p))) -+ if (__put_user_or_set_dar(regs, REG_BYTE(rptr, i ^ bswiz), -+ SWIZ_PTR(p))) - return -EFAULT; - if (nb0 > 0) { - rptr = ®s->gpr[0]; - addr += nb; - for (i = 0; i < nb0; ++i, ++p) -- if (__put_user_inatomic(REG_BYTE(rptr, -- i ^ bswiz), -- SWIZ_PTR(p))) -+ if (__put_user_or_set_dar(regs, -+ REG_BYTE(rptr, i ^ bswiz), -+ SWIZ_PTR(p))) - return -EFAULT; - } - } -@@ -346,29 +369,32 @@ static int emulate_multiple(struct pt_regs *regs, unsigned char __user *addr, - * Only POWER6 has these instructions, and it does true little-endian, - * so we don't need the address swizzling. - */ --static int emulate_fp_pair(unsigned char __user *addr, unsigned int reg, -- unsigned int flags) -+static int emulate_fp_pair(struct pt_regs *regs, unsigned char __user *addr, -+ unsigned int reg, unsigned int flags) - { - char *ptr0 = (char *) ¤t->thread.TS_FPR(reg); - char *ptr1 = (char *) ¤t->thread.TS_FPR(reg+1); -- int i, ret, sw = 0; -+ int i, sw = 0; - - if (reg & 1) - return 0; /* invalid form: FRS/FRT must be even */ - if (flags & SW) - sw = 7; -- ret = 0; -+ - for (i = 0; i < 8; ++i) { - if (!(flags & ST)) { -- ret |= __get_user(ptr0[i^sw], addr + i); -- ret |= __get_user(ptr1[i^sw], addr + i + 8); -+ if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i)) -+ return -EFAULT; -+ if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8)) -+ return -EFAULT; - } else { -- ret |= __put_user(ptr0[i^sw], addr + i); -- ret |= __put_user(ptr1[i^sw], addr + i + 8); -+ if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i)) -+ return -EFAULT; -+ if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8)) -+ return -EFAULT; - } - } -- if (ret) -- return -EFAULT; -+ - return 1; /* exception handled and fixed up */ - } - -@@ -378,24 +404,27 @@ static int emulate_lq_stq(struct pt_regs *regs, unsigned char __user *addr, - { - char *ptr0 = (char *)®s->gpr[reg]; - char *ptr1 = (char *)®s->gpr[reg+1]; -- int i, ret, sw = 0; -+ int i, sw = 0; - - if (reg & 1) - return 0; /* invalid form: GPR must be even */ - if (flags & SW) - sw = 7; -- ret = 0; -+ - for (i = 0; i < 8; ++i) { - if (!(flags & ST)) { -- ret |= __get_user(ptr0[i^sw], addr + i); -- ret |= __get_user(ptr1[i^sw], addr + i + 8); -+ if (__get_user_or_set_dar(regs, ptr0[i^sw], addr + i)) -+ return -EFAULT; -+ if (__get_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8)) -+ return -EFAULT; - } else { -- ret |= __put_user(ptr0[i^sw], addr + i); -- ret |= __put_user(ptr1[i^sw], addr + i + 8); -+ if (__put_user_or_set_dar(regs, ptr0[i^sw], addr + i)) -+ return -EFAULT; -+ if (__put_user_or_set_dar(regs, ptr1[i^sw], addr + i + 8)) -+ return -EFAULT; - } - } -- if (ret) -- return -EFAULT; -+ - return 1; /* exception handled and fixed up */ - } - #endif /* CONFIG_PPC64 */ -@@ -688,9 +717,14 @@ static int emulate_vsx(unsigned char __user *addr, unsigned int reg, - for (j = 0; j < length; j += elsize) { - for (i = 0; i < elsize; ++i) { - if (flags & ST) -- ret |= __put_user(ptr[i^sw], addr + i); -+ ret = __put_user_or_set_dar(regs, ptr[i^sw], -+ addr + i); - else -- ret |= __get_user(ptr[i^sw], addr + i); -+ ret = __get_user_or_set_dar(regs, ptr[i^sw], -+ addr + i); -+ -+ if (ret) -+ return ret; - } - ptr += elsize; - #ifdef __LITTLE_ENDIAN__ -@@ -740,7 +774,7 @@ int fix_alignment(struct pt_regs *regs) - unsigned int dsisr; - unsigned char __user *addr; - unsigned long p, swiz; -- int ret, i; -+ int i; - union data { - u64 ll; - double dd; -@@ -923,7 +957,7 @@ int fix_alignment(struct pt_regs *regs) - if (flags & F) { - /* Special case for 16-byte FP loads and stores */ - PPC_WARN_ALIGNMENT(fp_pair, regs); -- return emulate_fp_pair(addr, reg, flags); -+ return emulate_fp_pair(regs, addr, reg, flags); - } else { - #ifdef CONFIG_PPC64 - /* Special case for 16-byte loads and stores */ -@@ -953,15 +987,12 @@ int fix_alignment(struct pt_regs *regs) - } - - data.ll = 0; -- ret = 0; - p = (unsigned long)addr; - - for (i = 0; i < nb; i++) -- ret |= __get_user_inatomic(data.v[start + i], -- SWIZ_PTR(p++)); -- -- if (unlikely(ret)) -- return -EFAULT; -+ if (__get_user_or_set_dar(regs, data.v[start + i], -+ SWIZ_PTR(p++))) -+ return -EFAULT; - - } else if (flags & F) { - data.ll = current->thread.TS_FPR(reg); -@@ -1031,15 +1062,13 @@ int fix_alignment(struct pt_regs *regs) - break; - } - -- ret = 0; - p = (unsigned long)addr; - - for (i = 0; i < nb; i++) -- ret |= __put_user_inatomic(data.v[start + i], -- SWIZ_PTR(p++)); -+ if (__put_user_or_set_dar(regs, data.v[start + i], -+ SWIZ_PTR(p++))) -+ return -EFAULT; - -- if (unlikely(ret)) -- return -EFAULT; - } else if (flags & F) - current->thread.TS_FPR(reg) = data.ll; - else -diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h -index bcd3d6199464..bb16a58cf7e4 100644 ---- a/arch/x86/include/asm/elf.h -+++ b/arch/x86/include/asm/elf.h -@@ -204,6 +204,7 @@ void set_personality_ia32(bool); - - #define ELF_CORE_COPY_REGS(pr_reg, regs) \ - do { \ -+ unsigned long base; \ - unsigned v; \ - (pr_reg)[0] = (regs)->r15; \ - (pr_reg)[1] = (regs)->r14; \ -@@ -226,8 +227,8 @@ do { \ - (pr_reg)[18] = (regs)->flags; \ - (pr_reg)[19] = (regs)->sp; \ - (pr_reg)[20] = (regs)->ss; \ -- (pr_reg)[21] = current->thread.fs; \ -- (pr_reg)[22] = current->thread.gs; \ -+ rdmsrl(MSR_FS_BASE, base); (pr_reg)[21] = base; \ -+ rdmsrl(MSR_KERNEL_GS_BASE, base); (pr_reg)[22] = base; \ - asm("movl %%ds,%0" : "=r" (v)); (pr_reg)[23] = v; \ - asm("movl %%es,%0" : "=r" (v)); (pr_reg)[24] = v; \ - asm("movl %%fs,%0" : "=r" (v)); (pr_reg)[25] = v; \ -diff --git a/block/blk-core.c b/block/blk-core.c -index ef083e7a37c5..119658534dfd 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -233,7 +233,7 @@ EXPORT_SYMBOL(blk_start_queue_async); - **/ - void blk_start_queue(struct request_queue *q) - { -- WARN_ON(!irqs_disabled()); -+ WARN_ON(!in_interrupt() && !irqs_disabled()); - - queue_flag_clear(QUEUE_FLAG_STOPPED, q); - __blk_run_queue(q); -diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c -index b3b0004ea8ac..d12782dc9683 100644 ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -143,8 +143,10 @@ static int skcipher_alloc_sgl(struct sock *sk) - sg_init_table(sgl->sg, MAX_SGL_ENTS + 1); - sgl->cur = 0; - -- if (sg) -+ if (sg) { - sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg); -+ sg_unmark_end(sg + (MAX_SGL_ENTS - 1)); -+ } - - list_add_tail(&sgl->list, &ctx->tsgl); - } -diff --git a/drivers/block/skd_main.c b/drivers/block/skd_main.c -index 586f9168ffa4..47d1e834f3f4 100644 ---- a/drivers/block/skd_main.c -+++ b/drivers/block/skd_main.c -@@ -2214,6 +2214,9 @@ static void skd_send_fitmsg(struct skd_device *skdev, - */ - qcmd |= FIT_QCMD_MSGSIZE_64; - -+ /* Make sure skd_msg_buf is written before the doorbell is triggered. */ -+ smp_wmb(); -+ - SKD_WRITEQ(skdev, qcmd, FIT_Q_COMMAND); - - } -@@ -2260,6 +2263,9 @@ static void skd_send_special_fitmsg(struct skd_device *skdev, - qcmd = skspcl->mb_dma_address; - qcmd |= FIT_QCMD_QID_NORMAL + FIT_QCMD_MSGSIZE_128; - -+ /* Make sure skd_msg_buf is written before the doorbell is triggered. */ -+ smp_wmb(); -+ - SKD_WRITEQ(skdev, qcmd, FIT_Q_COMMAND); - } - -@@ -4679,15 +4685,16 @@ static void skd_free_disk(struct skd_device *skdev) - { - struct gendisk *disk = skdev->disk; - -- if (disk != NULL) { -- struct request_queue *q = disk->queue; -+ if (disk && (disk->flags & GENHD_FL_UP)) -+ del_gendisk(disk); - -- if (disk->flags & GENHD_FL_UP) -- del_gendisk(disk); -- if (q) -- blk_cleanup_queue(q); -- put_disk(disk); -+ if (skdev->queue) { -+ blk_cleanup_queue(skdev->queue); -+ skdev->queue = NULL; -+ disk->queue = NULL; - } -+ -+ put_disk(disk); - skdev->disk = NULL; - } - -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index 5be14ad29d46..dbf09836ff30 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -904,6 +904,13 @@ static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "P34"), - }, - }, -+ { -+ /* Gigabyte P57 - Elantech touchpad */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "P57"), -+ }, -+ }, - { - /* Schenker XMG C504 - Elantech touchpad */ - .matches = { -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index c3ea03c9a1a8..02619cabda8b 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -333,6 +333,7 @@ struct cached_dev { - /* Limit number of writeback bios in flight */ - struct semaphore in_flight; - struct task_struct *writeback_thread; -+ struct workqueue_struct *writeback_write_wq; - - struct keybuf writeback_keys; - -diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c -index 2410df1c2a05..6c4c7caea693 100644 ---- a/drivers/md/bcache/request.c -+++ b/drivers/md/bcache/request.c -@@ -196,12 +196,12 @@ static void bch_data_insert_start(struct closure *cl) - struct data_insert_op *op = container_of(cl, struct data_insert_op, cl); - struct bio *bio = op->bio, *n; - -- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) -- wake_up_gc(op->c); -- - if (op->bypass) - return bch_data_invalidate(cl); - -+ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) -+ wake_up_gc(op->c); -+ - /* - * Journal writes are marked REQ_FLUSH; if the original write was a - * flush, it'll wait on the journal write. -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 7b5880b8874c..c5ceea9222ff 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1023,7 +1023,7 @@ int bch_cached_dev_attach(struct cached_dev *dc, struct cache_set *c) - } - - if (BDEV_STATE(&dc->sb) == BDEV_STATE_DIRTY) { -- bch_sectors_dirty_init(dc); -+ bch_sectors_dirty_init(&dc->disk); - atomic_set(&dc->has_dirty, 1); - atomic_inc(&dc->count); - bch_writeback_queue(dc); -@@ -1056,6 +1056,8 @@ static void cached_dev_free(struct closure *cl) - cancel_delayed_work_sync(&dc->writeback_rate_update); - if (!IS_ERR_OR_NULL(dc->writeback_thread)) - kthread_stop(dc->writeback_thread); -+ if (dc->writeback_write_wq) -+ destroy_workqueue(dc->writeback_write_wq); - - mutex_lock(&bch_register_lock); - -@@ -1227,6 +1229,7 @@ static int flash_dev_run(struct cache_set *c, struct uuid_entry *u) - goto err; - - bcache_device_attach(d, c, u - c->uuids); -+ bch_sectors_dirty_init(d); - bch_flash_dev_request_init(d); - add_disk(d->disk); - -@@ -1959,6 +1962,8 @@ static ssize_t register_bcache(struct kobject *k, struct kobj_attribute *attr, - else - err = "device busy"; - mutex_unlock(&bch_register_lock); -+ if (!IS_ERR(bdev)) -+ bdput(bdev); - if (attr == &ksysfs_register_quiet) - goto out; - } -diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c -index b3ff57d61dde..4fbb5532f24c 100644 ---- a/drivers/md/bcache/sysfs.c -+++ b/drivers/md/bcache/sysfs.c -@@ -191,7 +191,7 @@ STORE(__cached_dev) - { - struct cached_dev *dc = container_of(kobj, struct cached_dev, - disk.kobj); -- unsigned v = size; -+ ssize_t v = size; - struct cache_set *c; - struct kobj_uevent_env *env; - -@@ -226,7 +226,7 @@ STORE(__cached_dev) - bch_cached_dev_run(dc); - - if (attr == &sysfs_cache_mode) { -- ssize_t v = bch_read_string_list(buf, bch_cache_modes + 1); -+ v = bch_read_string_list(buf, bch_cache_modes + 1); - - if (v < 0) - return v; -diff --git a/drivers/md/bcache/util.c b/drivers/md/bcache/util.c -index db3ae4c2b223..6c18e3ec3e48 100644 ---- a/drivers/md/bcache/util.c -+++ b/drivers/md/bcache/util.c -@@ -73,24 +73,44 @@ STRTO_H(strtouint, unsigned int) - STRTO_H(strtoll, long long) - STRTO_H(strtoull, unsigned long long) - -+/** -+ * bch_hprint() - formats @v to human readable string for sysfs. -+ * -+ * @v - signed 64 bit integer -+ * @buf - the (at least 8 byte) buffer to format the result into. -+ * -+ * Returns the number of bytes used by format. -+ */ - ssize_t bch_hprint(char *buf, int64_t v) - { - static const char units[] = "?kMGTPEZY"; -- char dec[4] = ""; -- int u, t = 0; -- -- for (u = 0; v >= 1024 || v <= -1024; u++) { -- t = v & ~(~0 << 10); -- v >>= 10; -- } -- -- if (!u) -- return sprintf(buf, "%llu", v); -- -- if (v < 100 && v > -100) -- snprintf(dec, sizeof(dec), ".%i", t / 100); -- -- return sprintf(buf, "%lli%s%c", v, dec, units[u]); -+ int u = 0, t; -+ -+ uint64_t q; -+ -+ if (v < 0) -+ q = -v; -+ else -+ q = v; -+ -+ /* For as long as the number is more than 3 digits, but at least -+ * once, shift right / divide by 1024. Keep the remainder for -+ * a digit after the decimal point. -+ */ -+ do { -+ u++; -+ -+ t = q & ~(~0 << 10); -+ q >>= 10; -+ } while (q >= 1000); -+ -+ if (v < 0) -+ /* '-', up to 3 digits, '.', 1 digit, 1 character, null; -+ * yields 8 bytes. -+ */ -+ return sprintf(buf, "-%llu.%i%c", q, t * 10 / 1024, units[u]); -+ else -+ return sprintf(buf, "%llu.%i%c", q, t * 10 / 1024, units[u]); - } - - ssize_t bch_snprint_string_list(char *buf, size_t size, const char * const list[], -diff --git a/drivers/md/bcache/writeback.c b/drivers/md/bcache/writeback.c -index b9346cd9cda1..bbb1dc9e1639 100644 ---- a/drivers/md/bcache/writeback.c -+++ b/drivers/md/bcache/writeback.c -@@ -21,7 +21,8 @@ - static void __update_writeback_rate(struct cached_dev *dc) - { - struct cache_set *c = dc->disk.c; -- uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size; -+ uint64_t cache_sectors = c->nbuckets * c->sb.bucket_size - -+ bcache_flash_devs_sectors_dirty(c); - uint64_t cache_dirty_target = - div_u64(cache_sectors * dc->writeback_percent, 100); - -@@ -190,7 +191,7 @@ static void write_dirty(struct closure *cl) - - closure_bio_submit(&io->bio, cl); - -- continue_at(cl, write_dirty_finish, system_wq); -+ continue_at(cl, write_dirty_finish, io->dc->writeback_write_wq); - } - - static void read_dirty_endio(struct bio *bio) -@@ -210,7 +211,7 @@ static void read_dirty_submit(struct closure *cl) - - closure_bio_submit(&io->bio, cl); - -- continue_at(cl, write_dirty, system_wq); -+ continue_at(cl, write_dirty, io->dc->writeback_write_wq); - } - - static void read_dirty(struct cached_dev *dc) -@@ -488,17 +489,17 @@ static int sectors_dirty_init_fn(struct btree_op *_op, struct btree *b, - return MAP_CONTINUE; - } - --void bch_sectors_dirty_init(struct cached_dev *dc) -+void bch_sectors_dirty_init(struct bcache_device *d) - { - struct sectors_dirty_init op; - - bch_btree_op_init(&op.op, -1); -- op.inode = dc->disk.id; -+ op.inode = d->id; - -- bch_btree_map_keys(&op.op, dc->disk.c, &KEY(op.inode, 0, 0), -+ bch_btree_map_keys(&op.op, d->c, &KEY(op.inode, 0, 0), - sectors_dirty_init_fn, 0); - -- dc->disk.sectors_dirty_last = bcache_dev_sectors_dirty(&dc->disk); -+ d->sectors_dirty_last = bcache_dev_sectors_dirty(d); - } - - void bch_cached_dev_writeback_init(struct cached_dev *dc) -@@ -522,6 +523,11 @@ void bch_cached_dev_writeback_init(struct cached_dev *dc) - - int bch_cached_dev_writeback_start(struct cached_dev *dc) - { -+ dc->writeback_write_wq = alloc_workqueue("bcache_writeback_wq", -+ WQ_MEM_RECLAIM, 0); -+ if (!dc->writeback_write_wq) -+ return -ENOMEM; -+ - dc->writeback_thread = kthread_create(bch_writeback_thread, dc, - "bcache_writeback"); - if (IS_ERR(dc->writeback_thread)) -diff --git a/drivers/md/bcache/writeback.h b/drivers/md/bcache/writeback.h -index 073a042aed24..daec4fd782ea 100644 ---- a/drivers/md/bcache/writeback.h -+++ b/drivers/md/bcache/writeback.h -@@ -14,6 +14,25 @@ static inline uint64_t bcache_dev_sectors_dirty(struct bcache_device *d) - return ret; - } - -+static inline uint64_t bcache_flash_devs_sectors_dirty(struct cache_set *c) -+{ -+ uint64_t i, ret = 0; -+ -+ mutex_lock(&bch_register_lock); -+ -+ for (i = 0; i < c->nr_uuids; i++) { -+ struct bcache_device *d = c->devices[i]; -+ -+ if (!d || !UUID_FLASH_ONLY(&c->uuids[i])) -+ continue; -+ ret += bcache_dev_sectors_dirty(d); -+ } -+ -+ mutex_unlock(&bch_register_lock); -+ -+ return ret; -+} -+ - static inline unsigned offset_to_stripe(struct bcache_device *d, - uint64_t offset) - { -@@ -85,7 +104,7 @@ static inline void bch_writeback_add(struct cached_dev *dc) - - void bcache_dev_sectors_dirty_add(struct cache_set *, unsigned, uint64_t, int); - --void bch_sectors_dirty_init(struct cached_dev *dc); -+void bch_sectors_dirty_init(struct bcache_device *); - void bch_cached_dev_writeback_init(struct cached_dev *); - int bch_cached_dev_writeback_start(struct cached_dev *); - -diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 4f22e919787a..7a50728b9389 100644 ---- a/drivers/md/bitmap.c -+++ b/drivers/md/bitmap.c -@@ -1960,6 +1960,11 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks, - long pages; - struct bitmap_page *new_bp; - -+ if (bitmap->storage.file && !init) { -+ pr_info("md: cannot resize file-based bitmap\n"); -+ return -EINVAL; -+ } -+ - if (chunksize == 0) { - /* If there is enough space, leave the chunk size unchanged, - * else increase by factor of two until there is enough space. -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 8f60520c8392..5eac08ffc697 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -5822,6 +5822,8 @@ static void raid5_do_work(struct work_struct *work) - - spin_unlock_irq(&conf->device_lock); - -+ r5l_flush_stripe_to_raid(conf->log); -+ - async_tx_issue_pending_all(); - blk_finish_plug(&plug); - -diff --git a/drivers/media/usb/uvc/uvc_ctrl.c b/drivers/media/usb/uvc/uvc_ctrl.c -index 3e59b288b8a8..618e4e2b4207 100644 ---- a/drivers/media/usb/uvc/uvc_ctrl.c -+++ b/drivers/media/usb/uvc/uvc_ctrl.c -@@ -2001,6 +2001,13 @@ int uvc_ctrl_add_mapping(struct uvc_video_chain *chain, - goto done; - } - -+ /* Validate the user-provided bit-size and offset */ -+ if (mapping->size > 32 || -+ mapping->offset + mapping->size > ctrl->info.size * 8) { -+ ret = -EINVAL; -+ goto done; -+ } -+ - list_for_each_entry(map, &ctrl->info.mappings, list) { - if (mapping->id == map->id) { - uvc_trace(UVC_TRACE_CONTROL, "Can't add mapping '%s', " -diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -index 109f687d1cbd..4379b949bb93 100644 ---- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -@@ -773,7 +773,8 @@ static int put_v4l2_event32(struct v4l2_event *kp, struct v4l2_event32 __user *u - copy_to_user(&up->u, &kp->u, sizeof(kp->u)) || - put_user(kp->pending, &up->pending) || - put_user(kp->sequence, &up->sequence) || -- compat_put_timespec(&kp->timestamp, &up->timestamp) || -+ put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || -+ put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) || - put_user(kp->id, &up->id) || - copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32))) - return -EFAULT; -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 4cd2a7d0124f..7923bfdc9b30 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -3676,7 +3676,7 @@ static noinline void gfar_update_link_state(struct gfar_private *priv) - u32 tempval1 = gfar_read(®s->maccfg1); - u32 tempval = gfar_read(®s->maccfg2); - u32 ecntrl = gfar_read(®s->ecntrl); -- u32 tx_flow_oldval = (tempval & MACCFG1_TX_FLOW); -+ u32 tx_flow_oldval = (tempval1 & MACCFG1_TX_FLOW); - - if (phydev->duplex != priv->oldduplex) { - if (!(phydev->duplex)) -diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c -index 829be21f97b2..be258d90de9e 100644 ---- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c -+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c -@@ -724,7 +724,7 @@ static void ql_build_coredump_seg_header( - seg_hdr->cookie = MPI_COREDUMP_COOKIE; - seg_hdr->segNum = seg_number; - seg_hdr->segSize = seg_size; -- memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1); -+ strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1); - } - - /* -diff --git a/drivers/pci/hotplug/shpchp_hpc.c b/drivers/pci/hotplug/shpchp_hpc.c -index 7d223e9080ef..77dddee2753a 100644 ---- a/drivers/pci/hotplug/shpchp_hpc.c -+++ b/drivers/pci/hotplug/shpchp_hpc.c -@@ -1062,6 +1062,8 @@ int shpc_init(struct controller *ctrl, struct pci_dev *pdev) - if (rc) { - ctrl_info(ctrl, "Can't get msi for the hotplug controller\n"); - ctrl_info(ctrl, "Use INTx for the hotplug controller\n"); -+ } else { -+ pci_set_master(pdev); - } - - rc = request_irq(ctrl->pci_dev->irq, shpc_isr, IRQF_SHARED, -diff --git a/drivers/s390/scsi/zfcp_dbf.c b/drivers/s390/scsi/zfcp_dbf.c -index d5bf36ec8a75..34367d172961 100644 ---- a/drivers/s390/scsi/zfcp_dbf.c -+++ b/drivers/s390/scsi/zfcp_dbf.c -@@ -3,7 +3,7 @@ - * - * Debug traces for zfcp. - * -- * Copyright IBM Corp. 2002, 2016 -+ * Copyright IBM Corp. 2002, 2017 - */ - - #define KMSG_COMPONENT "zfcp" -@@ -447,6 +447,7 @@ static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag, - struct fc_ct_hdr *reqh = sg_virt(ct_els->req); - struct fc_ns_gid_ft *reqn = (struct fc_ns_gid_ft *)(reqh + 1); - struct scatterlist *resp_entry = ct_els->resp; -+ struct fc_ct_hdr *resph; - struct fc_gpn_ft_resp *acc; - int max_entries, x, last = 0; - -@@ -473,6 +474,13 @@ static u16 zfcp_dbf_san_res_cap_len_if_gpn_ft(char *tag, - return len; /* not GPN_FT response so do not cap */ - - acc = sg_virt(resp_entry); -+ -+ /* cap all but accept CT responses to at least the CT header */ -+ resph = (struct fc_ct_hdr *)acc; -+ if ((ct_els->status) || -+ (resph->ct_cmd != cpu_to_be16(FC_FS_ACC))) -+ return max(FC_CT_HDR_LEN, ZFCP_DBF_SAN_MAX_PAYLOAD); -+ - max_entries = (reqh->ct_mr_size * 4 / sizeof(struct fc_gpn_ft_resp)) - + 1 /* zfcp_fc_scan_ports: bytes correct, entries off-by-one - * to account for header as 1st pseudo "entry" */; -@@ -555,8 +563,8 @@ void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc, - rec->scsi_retries = sc->retries; - rec->scsi_allowed = sc->allowed; - rec->scsi_id = sc->device->id; -- /* struct zfcp_dbf_scsi needs to be updated to handle 64bit LUNs */ - rec->scsi_lun = (u32)sc->device->lun; -+ rec->scsi_lun_64_hi = (u32)(sc->device->lun >> 32); - rec->host_scribble = (unsigned long)sc->host_scribble; - - memcpy(rec->scsi_opcode, sc->cmnd, -@@ -564,19 +572,32 @@ void zfcp_dbf_scsi(char *tag, int level, struct scsi_cmnd *sc, - - if (fsf) { - rec->fsf_req_id = fsf->req_id; -+ rec->pl_len = FCP_RESP_WITH_EXT; - fcp_rsp = (struct fcp_resp_with_ext *) - &(fsf->qtcb->bottom.io.fcp_rsp); -+ /* mandatory parts of FCP_RSP IU in this SCSI record */ - memcpy(&rec->fcp_rsp, fcp_rsp, FCP_RESP_WITH_EXT); - if (fcp_rsp->resp.fr_flags & FCP_RSP_LEN_VAL) { - fcp_rsp_info = (struct fcp_resp_rsp_info *) &fcp_rsp[1]; - rec->fcp_rsp_info = fcp_rsp_info->rsp_code; -+ rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_rsp_len); - } - if (fcp_rsp->resp.fr_flags & FCP_SNS_LEN_VAL) { -- rec->pl_len = min((u16)SCSI_SENSE_BUFFERSIZE, -- (u16)ZFCP_DBF_PAY_MAX_REC); -- zfcp_dbf_pl_write(dbf, sc->sense_buffer, rec->pl_len, -- "fcp_sns", fsf->req_id); -+ rec->pl_len += be32_to_cpu(fcp_rsp->ext.fr_sns_len); - } -+ /* complete FCP_RSP IU in associated PAYload record -+ * but only if there are optional parts -+ */ -+ if (fcp_rsp->resp.fr_flags != 0) -+ zfcp_dbf_pl_write( -+ dbf, fcp_rsp, -+ /* at least one full PAY record -+ * but not beyond hardware response field -+ */ -+ min_t(u16, max_t(u16, rec->pl_len, -+ ZFCP_DBF_PAY_MAX_REC), -+ FSF_FCP_RSP_SIZE), -+ "fcp_riu", fsf->req_id); - } - - debug_event(dbf->scsi, level, rec, sizeof(*rec)); -diff --git a/drivers/s390/scsi/zfcp_dbf.h b/drivers/s390/scsi/zfcp_dbf.h -index db186d44cfaf..b60667c145fd 100644 ---- a/drivers/s390/scsi/zfcp_dbf.h -+++ b/drivers/s390/scsi/zfcp_dbf.h -@@ -2,7 +2,7 @@ - * zfcp device driver - * debug feature declarations - * -- * Copyright IBM Corp. 2008, 2016 -+ * Copyright IBM Corp. 2008, 2017 - */ - - #ifndef ZFCP_DBF_H -@@ -204,7 +204,7 @@ enum zfcp_dbf_scsi_id { - * @id: unique number of recovery record type - * @tag: identifier string specifying the location of initiation - * @scsi_id: scsi device id -- * @scsi_lun: scsi device logical unit number -+ * @scsi_lun: scsi device logical unit number, low part of 64 bit, old 32 bit - * @scsi_result: scsi result - * @scsi_retries: current retry number of scsi request - * @scsi_allowed: allowed retries -@@ -214,6 +214,7 @@ enum zfcp_dbf_scsi_id { - * @host_scribble: LLD specific data attached to SCSI request - * @pl_len: length of paload stored as zfcp_dbf_pay - * @fsf_rsp: response for fsf request -+ * @scsi_lun_64_hi: scsi device logical unit number, high part of 64 bit - */ - struct zfcp_dbf_scsi { - u8 id; -@@ -230,6 +231,7 @@ struct zfcp_dbf_scsi { - u64 host_scribble; - u16 pl_len; - struct fcp_resp_with_ext fcp_rsp; -+ u32 scsi_lun_64_hi; - } __packed; - - /** -@@ -323,7 +325,11 @@ void zfcp_dbf_hba_fsf_response(struct zfcp_fsf_req *req) - { - struct fsf_qtcb *qtcb = req->qtcb; - -- if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) && -+ if (unlikely(req->status & (ZFCP_STATUS_FSFREQ_DISMISSED | -+ ZFCP_STATUS_FSFREQ_ERROR))) { -+ zfcp_dbf_hba_fsf_resp("fs_rerr", 3, req); -+ -+ } else if ((qtcb->prefix.prot_status != FSF_PROT_GOOD) && - (qtcb->prefix.prot_status != FSF_PROT_FSF_STATUS_PRESENTED)) { - zfcp_dbf_hba_fsf_resp("fs_perr", 1, req); - -@@ -401,7 +407,8 @@ void zfcp_dbf_scsi_abort(char *tag, struct scsi_cmnd *scmd, - * @flag: indicates type of reset (Target Reset, Logical Unit Reset) - */ - static inline --void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag) -+void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag, -+ struct zfcp_fsf_req *fsf_req) - { - char tmp_tag[ZFCP_DBF_TAG_LEN]; - -@@ -411,7 +418,7 @@ void zfcp_dbf_scsi_devreset(char *tag, struct scsi_cmnd *scmnd, u8 flag) - memcpy(tmp_tag, "lr_", 3); - - memcpy(&tmp_tag[3], tag, 4); -- _zfcp_dbf_scsi(tmp_tag, 1, scmnd, NULL); -+ _zfcp_dbf_scsi(tmp_tag, 1, scmnd, fsf_req); - } - - /** -diff --git a/drivers/s390/scsi/zfcp_fc.h b/drivers/s390/scsi/zfcp_fc.h -index df2b541c8287..a2275825186f 100644 ---- a/drivers/s390/scsi/zfcp_fc.h -+++ b/drivers/s390/scsi/zfcp_fc.h -@@ -4,7 +4,7 @@ - * Fibre Channel related definitions and inline functions for the zfcp - * device driver - * -- * Copyright IBM Corp. 2009 -+ * Copyright IBM Corp. 2009, 2017 - */ - - #ifndef ZFCP_FC_H -@@ -279,6 +279,10 @@ void zfcp_fc_eval_fcp_rsp(struct fcp_resp_with_ext *fcp_rsp, - !(rsp_flags & FCP_SNS_LEN_VAL) && - fcp_rsp->resp.fr_status == SAM_STAT_GOOD) - set_host_byte(scsi, DID_ERROR); -+ } else if (unlikely(rsp_flags & FCP_RESID_OVER)) { -+ /* FCP_DL was not sufficient for SCSI data length */ -+ if (fcp_rsp->resp.fr_status == SAM_STAT_GOOD) -+ set_host_byte(scsi, DID_ERROR); - } - } - -diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c -index 27ff38f839fc..1964391db904 100644 ---- a/drivers/s390/scsi/zfcp_fsf.c -+++ b/drivers/s390/scsi/zfcp_fsf.c -@@ -928,8 +928,8 @@ static void zfcp_fsf_send_ct_handler(struct zfcp_fsf_req *req) - - switch (header->fsf_status) { - case FSF_GOOD: -- zfcp_dbf_san_res("fsscth2", req); - ct->status = 0; -+ zfcp_dbf_san_res("fsscth2", req); - break; - case FSF_SERVICE_CLASS_NOT_SUPPORTED: - zfcp_fsf_class_not_supp(req); -@@ -1109,8 +1109,8 @@ static void zfcp_fsf_send_els_handler(struct zfcp_fsf_req *req) - - switch (header->fsf_status) { - case FSF_GOOD: -- zfcp_dbf_san_res("fsselh1", req); - send_els->status = 0; -+ zfcp_dbf_san_res("fsselh1", req); - break; - case FSF_SERVICE_CLASS_NOT_SUPPORTED: - zfcp_fsf_class_not_supp(req); -@@ -2258,7 +2258,8 @@ int zfcp_fsf_fcp_cmnd(struct scsi_cmnd *scsi_cmnd) - fcp_cmnd = (struct fcp_cmnd *) &req->qtcb->bottom.io.fcp_cmnd; - zfcp_fc_scsi_to_fcp(fcp_cmnd, scsi_cmnd, 0); - -- if (scsi_prot_sg_count(scsi_cmnd)) { -+ if ((scsi_get_prot_op(scsi_cmnd) != SCSI_PROT_NORMAL) && -+ scsi_prot_sg_count(scsi_cmnd)) { - zfcp_qdio_set_data_div(qdio, &req->qdio_req, - scsi_prot_sg_count(scsi_cmnd)); - retval = zfcp_qdio_sbals_from_sg(qdio, &req->qdio_req, -diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c -index 07ffdbb5107f..9bd9b9a29dfc 100644 ---- a/drivers/s390/scsi/zfcp_scsi.c -+++ b/drivers/s390/scsi/zfcp_scsi.c -@@ -3,7 +3,7 @@ - * - * Interface to Linux SCSI midlayer. - * -- * Copyright IBM Corp. 2002, 2016 -+ * Copyright IBM Corp. 2002, 2017 - */ - - #define KMSG_COMPONENT "zfcp" -@@ -273,25 +273,29 @@ static int zfcp_task_mgmt_function(struct scsi_cmnd *scpnt, u8 tm_flags) - - zfcp_erp_wait(adapter); - ret = fc_block_scsi_eh(scpnt); -- if (ret) -+ if (ret) { -+ zfcp_dbf_scsi_devreset("fiof", scpnt, tm_flags, NULL); - return ret; -+ } - - if (!(atomic_read(&adapter->status) & - ZFCP_STATUS_COMMON_RUNNING)) { -- zfcp_dbf_scsi_devreset("nres", scpnt, tm_flags); -+ zfcp_dbf_scsi_devreset("nres", scpnt, tm_flags, NULL); - return SUCCESS; - } - } -- if (!fsf_req) -+ if (!fsf_req) { -+ zfcp_dbf_scsi_devreset("reqf", scpnt, tm_flags, NULL); - return FAILED; -+ } - - wait_for_completion(&fsf_req->completion); - - if (fsf_req->status & ZFCP_STATUS_FSFREQ_TMFUNCFAILED) { -- zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags); -+ zfcp_dbf_scsi_devreset("fail", scpnt, tm_flags, fsf_req); - retval = FAILED; - } else { -- zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags); -+ zfcp_dbf_scsi_devreset("okay", scpnt, tm_flags, fsf_req); - zfcp_scsi_forget_cmnds(zfcp_sdev, tm_flags); - } - -diff --git a/drivers/scsi/megaraid/megaraid_sas_base.c b/drivers/scsi/megaraid/megaraid_sas_base.c -index 17c440b9d086..6835bae33ec4 100644 ---- a/drivers/scsi/megaraid/megaraid_sas_base.c -+++ b/drivers/scsi/megaraid/megaraid_sas_base.c -@@ -1824,9 +1824,12 @@ static void megasas_complete_outstanding_ioctls(struct megasas_instance *instanc - if (cmd_fusion->sync_cmd_idx != (u32)ULONG_MAX) { - cmd_mfi = instance->cmd_list[cmd_fusion->sync_cmd_idx]; - if (cmd_mfi->sync_cmd && -- cmd_mfi->frame->hdr.cmd != MFI_CMD_ABORT) -+ (cmd_mfi->frame->hdr.cmd != MFI_CMD_ABORT)) { -+ cmd_mfi->frame->hdr.cmd_status = -+ MFI_STAT_WRONG_STATE; - megasas_complete_cmd(instance, - cmd_mfi, DID_OK); -+ } - } - } - } else { -@@ -5094,6 +5097,14 @@ megasas_register_aen(struct megasas_instance *instance, u32 seq_num, - prev_aen.word = - le32_to_cpu(instance->aen_cmd->frame->dcmd.mbox.w[1]); - -+ if ((curr_aen.members.class < MFI_EVT_CLASS_DEBUG) || -+ (curr_aen.members.class > MFI_EVT_CLASS_DEAD)) { -+ dev_info(&instance->pdev->dev, -+ "%s %d out of range class %d send by application\n", -+ __func__, __LINE__, curr_aen.members.class); -+ return 0; -+ } -+ - /* - * A class whose enum value is smaller is inclusive of all - * higher values. If a PROGRESS (= -1) was previously -diff --git a/drivers/scsi/qla2xxx/qla_attr.c b/drivers/scsi/qla2xxx/qla_attr.c -index 1ed85dfc008d..ac12ee844bfc 100644 ---- a/drivers/scsi/qla2xxx/qla_attr.c -+++ b/drivers/scsi/qla2xxx/qla_attr.c -@@ -404,6 +404,8 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj, - return -EINVAL; - if (start > ha->optrom_size) - return -EINVAL; -+ if (size > ha->optrom_size - start) -+ size = ha->optrom_size - start; - - mutex_lock(&ha->optrom_mutex); - switch (val) { -@@ -429,8 +431,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj, - } - - ha->optrom_region_start = start; -- ha->optrom_region_size = start + size > ha->optrom_size ? -- ha->optrom_size - start : size; -+ ha->optrom_region_size = start + size; - - ha->optrom_state = QLA_SREADING; - ha->optrom_buffer = vmalloc(ha->optrom_region_size); -@@ -503,8 +504,7 @@ qla2x00_sysfs_write_optrom_ctl(struct file *filp, struct kobject *kobj, - } - - ha->optrom_region_start = start; -- ha->optrom_region_size = start + size > ha->optrom_size ? -- ha->optrom_size - start : size; -+ ha->optrom_region_size = start + size; - - ha->optrom_state = QLA_SWRITING; - ha->optrom_buffer = vmalloc(ha->optrom_region_size); -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 71325972e503..39e8b5dc23fa 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -133,7 +133,7 @@ struct sg_device; /* forward declarations */ - struct sg_fd; - - typedef struct sg_request { /* SG_MAX_QUEUE requests outstanding per file */ -- struct sg_request *nextrp; /* NULL -> tail request (slist) */ -+ struct list_head entry; /* list entry */ - struct sg_fd *parentfp; /* NULL -> not in use */ - Sg_scatter_hold data; /* hold buffer, perhaps scatter list */ - sg_io_hdr_t header; /* scsi command+info, see */ -@@ -157,8 +157,7 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ - int timeout; /* defaults to SG_DEFAULT_TIMEOUT */ - int timeout_user; /* defaults to SG_DEFAULT_TIMEOUT_USER */ - Sg_scatter_hold reserve; /* buffer held for this file descriptor */ -- unsigned save_scat_len; /* original length of trunc. scat. element */ -- Sg_request *headrp; /* head of request slist, NULL->empty */ -+ struct list_head rq_list; /* head of request list */ - struct fasync_struct *async_qp; /* used by asynchronous notification */ - Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */ - char low_dma; /* as in parent but possibly overridden to 1 */ -@@ -840,6 +839,39 @@ static int max_sectors_bytes(struct request_queue *q) - return max_sectors << 9; - } - -+static void -+sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo) -+{ -+ Sg_request *srp; -+ int val; -+ unsigned int ms; -+ -+ val = 0; -+ list_for_each_entry(srp, &sfp->rq_list, entry) { -+ if (val > SG_MAX_QUEUE) -+ break; -+ rinfo[val].req_state = srp->done + 1; -+ rinfo[val].problem = -+ srp->header.masked_status & -+ srp->header.host_status & -+ srp->header.driver_status; -+ if (srp->done) -+ rinfo[val].duration = -+ srp->header.duration; -+ else { -+ ms = jiffies_to_msecs(jiffies); -+ rinfo[val].duration = -+ (ms > srp->header.duration) ? -+ (ms - srp->header.duration) : 0; -+ } -+ rinfo[val].orphan = srp->orphan; -+ rinfo[val].sg_io_owned = srp->sg_io_owned; -+ rinfo[val].pack_id = srp->header.pack_id; -+ rinfo[val].usr_ptr = srp->header.usr_ptr; -+ val++; -+ } -+} -+ - static long - sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - { -@@ -951,7 +983,7 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - if (!access_ok(VERIFY_WRITE, ip, sizeof (int))) - return -EFAULT; - read_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (srp = sfp->headrp; srp; srp = srp->nextrp) { -+ list_for_each_entry(srp, &sfp->rq_list, entry) { - if ((1 == srp->done) && (!srp->sg_io_owned)) { - read_unlock_irqrestore(&sfp->rq_list_lock, - iflags); -@@ -964,7 +996,8 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - return 0; - case SG_GET_NUM_WAITING: - read_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (val = 0, srp = sfp->headrp; srp; srp = srp->nextrp) { -+ val = 0; -+ list_for_each_entry(srp, &sfp->rq_list, entry) { - if ((1 == srp->done) && (!srp->sg_io_owned)) - ++val; - } -@@ -1032,42 +1065,15 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - return -EFAULT; - else { - sg_req_info_t *rinfo; -- unsigned int ms; - -- rinfo = kmalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, -- GFP_KERNEL); -+ rinfo = kzalloc(SZ_SG_REQ_INFO * SG_MAX_QUEUE, -+ GFP_KERNEL); - if (!rinfo) - return -ENOMEM; - read_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (srp = sfp->headrp, val = 0; val < SG_MAX_QUEUE; -- ++val, srp = srp ? srp->nextrp : srp) { -- memset(&rinfo[val], 0, SZ_SG_REQ_INFO); -- if (srp) { -- rinfo[val].req_state = srp->done + 1; -- rinfo[val].problem = -- srp->header.masked_status & -- srp->header.host_status & -- srp->header.driver_status; -- if (srp->done) -- rinfo[val].duration = -- srp->header.duration; -- else { -- ms = jiffies_to_msecs(jiffies); -- rinfo[val].duration = -- (ms > srp->header.duration) ? -- (ms - srp->header.duration) : 0; -- } -- rinfo[val].orphan = srp->orphan; -- rinfo[val].sg_io_owned = -- srp->sg_io_owned; -- rinfo[val].pack_id = -- srp->header.pack_id; -- rinfo[val].usr_ptr = -- srp->header.usr_ptr; -- } -- } -+ sg_fill_request_table(sfp, rinfo); - read_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- result = __copy_to_user(p, rinfo, -+ result = __copy_to_user(p, rinfo, - SZ_SG_REQ_INFO * SG_MAX_QUEUE); - result = result ? -EFAULT : 0; - kfree(rinfo); -@@ -1173,7 +1179,7 @@ sg_poll(struct file *filp, poll_table * wait) - return POLLERR; - poll_wait(filp, &sfp->read_wait, wait); - read_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (srp = sfp->headrp; srp; srp = srp->nextrp) { -+ list_for_each_entry(srp, &sfp->rq_list, entry) { - /* if any read waiting, flag it */ - if ((0 == res) && (1 == srp->done) && (!srp->sg_io_owned)) - res = POLLIN | POLLRDNORM; -@@ -2059,7 +2065,6 @@ sg_unlink_reserve(Sg_fd * sfp, Sg_request * srp) - req_schp->pages = NULL; - req_schp->page_order = 0; - req_schp->sglist_len = 0; -- sfp->save_scat_len = 0; - srp->res_used = 0; - /* Called without mutex lock to avoid deadlock */ - sfp->res_in_use = 0; -@@ -2072,7 +2077,7 @@ sg_get_rq_mark(Sg_fd * sfp, int pack_id) - unsigned long iflags; - - write_lock_irqsave(&sfp->rq_list_lock, iflags); -- for (resp = sfp->headrp; resp; resp = resp->nextrp) { -+ list_for_each_entry(resp, &sfp->rq_list, entry) { - /* look for requests that are ready + not SG_IO owned */ - if ((1 == resp->done) && (!resp->sg_io_owned) && - ((-1 == pack_id) || (resp->header.pack_id == pack_id))) { -@@ -2090,70 +2095,45 @@ sg_add_request(Sg_fd * sfp) - { - int k; - unsigned long iflags; -- Sg_request *resp; - Sg_request *rp = sfp->req_arr; - - write_lock_irqsave(&sfp->rq_list_lock, iflags); -- resp = sfp->headrp; -- if (!resp) { -- memset(rp, 0, sizeof (Sg_request)); -- rp->parentfp = sfp; -- resp = rp; -- sfp->headrp = resp; -- } else { -- if (0 == sfp->cmd_q) -- resp = NULL; /* command queuing disallowed */ -- else { -- for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) { -- if (!rp->parentfp) -- break; -- } -- if (k < SG_MAX_QUEUE) { -- memset(rp, 0, sizeof (Sg_request)); -- rp->parentfp = sfp; -- while (resp->nextrp) -- resp = resp->nextrp; -- resp->nextrp = rp; -- resp = rp; -- } else -- resp = NULL; -+ if (!list_empty(&sfp->rq_list)) { -+ if (!sfp->cmd_q) -+ goto out_unlock; -+ -+ for (k = 0; k < SG_MAX_QUEUE; ++k, ++rp) { -+ if (!rp->parentfp) -+ break; - } -+ if (k >= SG_MAX_QUEUE) -+ goto out_unlock; - } -- if (resp) { -- resp->nextrp = NULL; -- resp->header.duration = jiffies_to_msecs(jiffies); -- } -+ memset(rp, 0, sizeof (Sg_request)); -+ rp->parentfp = sfp; -+ rp->header.duration = jiffies_to_msecs(jiffies); -+ list_add_tail(&rp->entry, &sfp->rq_list); - write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -- return resp; -+ return rp; -+out_unlock: -+ write_unlock_irqrestore(&sfp->rq_list_lock, iflags); -+ return NULL; - } - - /* Return of 1 for found; 0 for not found */ - static int - sg_remove_request(Sg_fd * sfp, Sg_request * srp) - { -- Sg_request *prev_rp; -- Sg_request *rp; - unsigned long iflags; - int res = 0; - -- if ((!sfp) || (!srp) || (!sfp->headrp)) -+ if (!sfp || !srp || list_empty(&sfp->rq_list)) - return res; - write_lock_irqsave(&sfp->rq_list_lock, iflags); -- prev_rp = sfp->headrp; -- if (srp == prev_rp) { -- sfp->headrp = prev_rp->nextrp; -- prev_rp->parentfp = NULL; -+ if (!list_empty(&srp->entry)) { -+ list_del(&srp->entry); -+ srp->parentfp = NULL; - res = 1; -- } else { -- while ((rp = prev_rp->nextrp)) { -- if (srp == rp) { -- prev_rp->nextrp = rp->nextrp; -- rp->parentfp = NULL; -- res = 1; -- break; -- } -- prev_rp = rp; -- } - } - write_unlock_irqrestore(&sfp->rq_list_lock, iflags); - return res; -@@ -2172,7 +2152,7 @@ sg_add_sfp(Sg_device * sdp) - - init_waitqueue_head(&sfp->read_wait); - rwlock_init(&sfp->rq_list_lock); -- -+ INIT_LIST_HEAD(&sfp->rq_list); - kref_init(&sfp->f_ref); - mutex_init(&sfp->f_mutex); - sfp->timeout = SG_DEFAULT_TIMEOUT; -@@ -2213,10 +2193,13 @@ sg_remove_sfp_usercontext(struct work_struct *work) - { - struct sg_fd *sfp = container_of(work, struct sg_fd, ew.work); - struct sg_device *sdp = sfp->parentdp; -+ Sg_request *srp; - - /* Cleanup any responses which were never read(). */ -- while (sfp->headrp) -- sg_finish_rem_req(sfp->headrp); -+ while (!list_empty(&sfp->rq_list)) { -+ srp = list_first_entry(&sfp->rq_list, Sg_request, entry); -+ sg_finish_rem_req(srp); -+ } - - if (sfp->reserve.bufflen > 0) { - SCSI_LOG_TIMEOUT(6, sg_printk(KERN_INFO, sdp, -@@ -2619,7 +2602,7 @@ static int sg_proc_seq_show_devstrs(struct seq_file *s, void *v) - /* must be called while holding sg_index_lock */ - static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp) - { -- int k, m, new_interface, blen, usg; -+ int k, new_interface, blen, usg; - Sg_request *srp; - Sg_fd *fp; - const sg_io_hdr_t *hp; -@@ -2639,13 +2622,11 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp) - seq_printf(s, " cmd_q=%d f_packid=%d k_orphan=%d closed=0\n", - (int) fp->cmd_q, (int) fp->force_packid, - (int) fp->keep_orphan); -- for (m = 0, srp = fp->headrp; -- srp != NULL; -- ++m, srp = srp->nextrp) { -+ list_for_each_entry(srp, &fp->rq_list, entry) { - hp = &srp->header; - new_interface = (hp->interface_id == '\0') ? 0 : 1; - if (srp->res_used) { -- if (new_interface && -+ if (new_interface && - (SG_FLAG_MMAP_IO & hp->flags)) - cp = " mmap>> "; - else -@@ -2676,7 +2657,7 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp) - seq_printf(s, "ms sgat=%d op=0x%02x\n", usg, - (int) srp->data.cmd_opcode); - } -- if (0 == m) -+ if (list_empty(&fp->rq_list)) - seq_puts(s, " No requests active\n"); - read_unlock(&fp->rq_list_lock); - } -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index cd5c1c060481..6df2841cb7f9 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -1511,6 +1511,8 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd) - ret = storvsc_do_io(dev, cmd_request); - - if (ret == -EAGAIN) { -+ if (payload_sz > sizeof(cmd_request->mpb)) -+ kfree(payload); - /* no more space */ - return SCSI_MLQUEUE_DEVICE_BUSY; - } -diff --git a/drivers/tty/tty_buffer.c b/drivers/tty/tty_buffer.c -index fb31eecb708d..8f3566cde3eb 100644 ---- a/drivers/tty/tty_buffer.c -+++ b/drivers/tty/tty_buffer.c -@@ -361,6 +361,32 @@ int tty_insert_flip_string_flags(struct tty_port *port, - } - EXPORT_SYMBOL(tty_insert_flip_string_flags); - -+/** -+ * __tty_insert_flip_char - Add one character to the tty buffer -+ * @port: tty port -+ * @ch: character -+ * @flag: flag byte -+ * -+ * Queue a single byte to the tty buffering, with an optional flag. -+ * This is the slow path of tty_insert_flip_char. -+ */ -+int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag) -+{ -+ struct tty_buffer *tb; -+ int flags = (flag == TTY_NORMAL) ? TTYB_NORMAL : 0; -+ -+ if (!__tty_buffer_request_room(port, 1, flags)) -+ return 0; -+ -+ tb = port->buf.tail; -+ if (~tb->flags & TTYB_NORMAL) -+ *flag_buf_ptr(tb, tb->used) = flag; -+ *char_buf_ptr(tb, tb->used++) = ch; -+ -+ return 1; -+} -+EXPORT_SYMBOL(__tty_insert_flip_char); -+ - /** - * tty_schedule_flip - push characters to ldisc - * @port: tty port to push from -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 68345a9e59b8..32941cd6d34b 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2205,6 +2205,7 @@ static void ext4_orphan_cleanup(struct super_block *sb, - unsigned int s_flags = sb->s_flags; - int nr_orphans = 0, nr_truncates = 0; - #ifdef CONFIG_QUOTA -+ int quota_update = 0; - int i; - #endif - if (!es->s_last_orphan) { -@@ -2243,14 +2244,32 @@ static void ext4_orphan_cleanup(struct super_block *sb, - #ifdef CONFIG_QUOTA - /* Needed for iput() to work correctly and not trash data */ - sb->s_flags |= MS_ACTIVE; -- /* Turn on quotas so that they are updated correctly */ -+ -+ /* -+ * Turn on quotas which were not enabled for read-only mounts if -+ * filesystem has quota feature, so that they are updated correctly. -+ */ -+ if (ext4_has_feature_quota(sb) && (s_flags & MS_RDONLY)) { -+ int ret = ext4_enable_quotas(sb); -+ -+ if (!ret) -+ quota_update = 1; -+ else -+ ext4_msg(sb, KERN_ERR, -+ "Cannot turn on quotas: error %d", ret); -+ } -+ -+ /* Turn on journaled quotas used for old sytle */ - for (i = 0; i < EXT4_MAXQUOTAS; i++) { - if (EXT4_SB(sb)->s_qf_names[i]) { - int ret = ext4_quota_on_mount(sb, i); -- if (ret < 0) -+ -+ if (!ret) -+ quota_update = 1; -+ else - ext4_msg(sb, KERN_ERR, - "Cannot turn on journaled " -- "quota: error %d", ret); -+ "quota: type %d: error %d", i, ret); - } - } - #endif -@@ -2309,10 +2328,12 @@ static void ext4_orphan_cleanup(struct super_block *sb, - ext4_msg(sb, KERN_INFO, "%d truncate%s cleaned up", - PLURAL(nr_truncates)); - #ifdef CONFIG_QUOTA -- /* Turn quotas off */ -- for (i = 0; i < EXT4_MAXQUOTAS; i++) { -- if (sb_dqopt(sb)->files[i]) -- dquot_quota_off(sb, i); -+ /* Turn off quotas if they were enabled for orphan cleanup */ -+ if (quota_update) { -+ for (i = 0; i < EXT4_MAXQUOTAS; i++) { -+ if (sb_dqopt(sb)->files[i]) -+ dquot_quota_off(sb, i); -+ } - } - #endif - sb->s_flags = s_flags; /* Restore MS_RDONLY status */ -@@ -5120,6 +5141,9 @@ static int ext4_enable_quotas(struct super_block *sb) - err = ext4_quota_enable(sb, type, QFMT_VFS_V1, - DQUOT_USAGE_ENABLED); - if (err) { -+ for (type--; type >= 0; type--) -+ dquot_quota_off(sb, type); -+ - ext4_warning(sb, - "Failed to enable quota tracking " - "(type=%d, err=%d). Please run " -diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c -index cbf74f47cce8..e32f349f341b 100644 ---- a/fs/f2fs/recovery.c -+++ b/fs/f2fs/recovery.c -@@ -276,7 +276,7 @@ static int check_index_in_prev_nodes(struct f2fs_sb_info *sbi, - return 0; - - /* Get the previous summary */ -- for (i = CURSEG_WARM_DATA; i <= CURSEG_COLD_DATA; i++) { -+ for (i = CURSEG_HOT_DATA; i <= CURSEG_COLD_DATA; i++) { - struct curseg_info *curseg = CURSEG_I(sbi, i); - if (curseg->segno == segno) { - sum = curseg->sum_blk->entries[blkoff]; -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index c7f1ce41442a..9e5a6842346e 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -1145,9 +1145,7 @@ static void put_ol_stateid_locked(struct nfs4_ol_stateid *stp, - - static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp) - { -- struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner); -- -- lockdep_assert_held(&oo->oo_owner.so_client->cl_lock); -+ lockdep_assert_held(&stp->st_stid.sc_client->cl_lock); - - list_del_init(&stp->st_locks); - nfs4_unhash_stid(&stp->st_stid); -@@ -1156,12 +1154,12 @@ static bool unhash_lock_stateid(struct nfs4_ol_stateid *stp) - - static void release_lock_stateid(struct nfs4_ol_stateid *stp) - { -- struct nfs4_openowner *oo = openowner(stp->st_openstp->st_stateowner); -+ struct nfs4_client *clp = stp->st_stid.sc_client; - bool unhashed; - -- spin_lock(&oo->oo_owner.so_client->cl_lock); -+ spin_lock(&clp->cl_lock); - unhashed = unhash_lock_stateid(stp); -- spin_unlock(&oo->oo_owner.so_client->cl_lock); -+ spin_unlock(&clp->cl_lock); - if (unhashed) - nfs4_put_stid(&stp->st_stid); - } -diff --git a/include/linux/tty_flip.h b/include/linux/tty_flip.h -index c28dd523f96e..d43837f2ce3a 100644 ---- a/include/linux/tty_flip.h -+++ b/include/linux/tty_flip.h -@@ -12,6 +12,7 @@ extern int tty_prepare_flip_string(struct tty_port *port, - unsigned char **chars, size_t size); - extern void tty_flip_buffer_push(struct tty_port *port); - void tty_schedule_flip(struct tty_port *port); -+int __tty_insert_flip_char(struct tty_port *port, unsigned char ch, char flag); - - static inline int tty_insert_flip_char(struct tty_port *port, - unsigned char ch, char flag) -@@ -26,7 +27,7 @@ static inline int tty_insert_flip_char(struct tty_port *port, - *char_buf_ptr(tb, tb->used++) = ch; - return 1; - } -- return tty_insert_flip_string_flags(port, &ch, &flag, 1); -+ return __tty_insert_flip_char(port, ch, flag); - } - - static inline int tty_insert_flip_string(struct tty_port *port, -diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h -index ac42bbb37b2d..c26a6e4dc306 100644 ---- a/include/net/inet_frag.h -+++ b/include/net/inet_frag.h -@@ -1,14 +1,9 @@ - #ifndef __NET_FRAG_H__ - #define __NET_FRAG_H__ - --#include -- - struct netns_frags { -- /* The percpu_counter "mem" need to be cacheline aligned. -- * mem.count must not share cacheline with other writers -- */ -- struct percpu_counter mem ____cacheline_aligned_in_smp; -- -+ /* Keep atomic mem on separate cachelines in structs that include it */ -+ atomic_t mem ____cacheline_aligned_in_smp; - /* sysctls */ - int timeout; - int high_thresh; -@@ -108,15 +103,10 @@ struct inet_frags { - int inet_frags_init(struct inet_frags *); - void inet_frags_fini(struct inet_frags *); - --static inline int inet_frags_init_net(struct netns_frags *nf) --{ -- return percpu_counter_init(&nf->mem, 0, GFP_KERNEL); --} --static inline void inet_frags_uninit_net(struct netns_frags *nf) -+static inline void inet_frags_init_net(struct netns_frags *nf) - { -- percpu_counter_destroy(&nf->mem); -+ atomic_set(&nf->mem, 0); - } -- - void inet_frags_exit_net(struct netns_frags *nf, struct inet_frags *f); - - void inet_frag_kill(struct inet_frag_queue *q, struct inet_frags *f); -@@ -140,37 +130,24 @@ static inline bool inet_frag_evicting(struct inet_frag_queue *q) - - /* Memory Tracking Functions. */ - --/* The default percpu_counter batch size is not big enough to scale to -- * fragmentation mem acct sizes. -- * The mem size of a 64K fragment is approx: -- * (44 fragments * 2944 truesize) + frag_queue struct(200) = 129736 bytes -- */ --static unsigned int frag_percpu_counter_batch = 130000; -- - static inline int frag_mem_limit(struct netns_frags *nf) - { -- return percpu_counter_read(&nf->mem); -+ return atomic_read(&nf->mem); - } - - static inline void sub_frag_mem_limit(struct netns_frags *nf, int i) - { -- __percpu_counter_add(&nf->mem, -i, frag_percpu_counter_batch); -+ atomic_sub(i, &nf->mem); - } - - static inline void add_frag_mem_limit(struct netns_frags *nf, int i) - { -- __percpu_counter_add(&nf->mem, i, frag_percpu_counter_batch); -+ atomic_add(i, &nf->mem); - } - --static inline unsigned int sum_frag_mem_limit(struct netns_frags *nf) -+static inline int sum_frag_mem_limit(struct netns_frags *nf) - { -- unsigned int res; -- -- local_bh_disable(); -- res = percpu_counter_sum_positive(&nf->mem); -- local_bh_enable(); -- -- return res; -+ return atomic_read(&nf->mem); - } - - /* RFC 3168 support : -diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h -index fb961a576abe..fa5e703a14ed 100644 ---- a/include/net/ip6_fib.h -+++ b/include/net/ip6_fib.h -@@ -68,6 +68,7 @@ struct fib6_node { - __u16 fn_flags; - int fn_sernum; - struct rt6_info *rr_ptr; -+ struct rcu_head rcu; - }; - - #ifndef CONFIG_IPV6_SUBTREES -@@ -102,7 +103,7 @@ struct rt6_info { - * the same cache line. - */ - struct fib6_table *rt6i_table; -- struct fib6_node *rt6i_node; -+ struct fib6_node __rcu *rt6i_node; - - struct in6_addr rt6i_gateway; - -@@ -165,13 +166,40 @@ static inline void rt6_update_expires(struct rt6_info *rt0, int timeout) - rt0->rt6i_flags |= RTF_EXPIRES; - } - -+/* Function to safely get fn->sernum for passed in rt -+ * and store result in passed in cookie. -+ * Return true if we can get cookie safely -+ * Return false if not -+ */ -+static inline bool rt6_get_cookie_safe(const struct rt6_info *rt, -+ u32 *cookie) -+{ -+ struct fib6_node *fn; -+ bool status = false; -+ -+ rcu_read_lock(); -+ fn = rcu_dereference(rt->rt6i_node); -+ -+ if (fn) { -+ *cookie = fn->fn_sernum; -+ status = true; -+ } -+ -+ rcu_read_unlock(); -+ return status; -+} -+ - static inline u32 rt6_get_cookie(const struct rt6_info *rt) - { -+ u32 cookie = 0; -+ - if (rt->rt6i_flags & RTF_PCPU || - (unlikely(rt->dst.flags & DST_NOCACHE) && rt->dst.from)) - rt = (struct rt6_info *)(rt->dst.from); - -- return rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0; -+ rt6_get_cookie_safe(rt, &cookie); -+ -+ return cookie; - } - - static inline void ip6_rt_put(struct rt6_info *rt) -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index eba904bae48c..38d73a6e2857 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -2667,13 +2667,14 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) - - if (!command || !ftrace_enabled) { - /* -- * If these are control ops, they still need their -- * per_cpu field freed. Since, function tracing is -+ * If these are dynamic or control ops, they still -+ * need their data freed. Since, function tracing is - * not currently active, we can just free them - * without synchronizing all CPUs. - */ -- if (ops->flags & FTRACE_OPS_FL_CONTROL) -- control_ops_free(ops); -+ if (ops->flags & (FTRACE_OPS_FL_DYNAMIC | FTRACE_OPS_FL_CONTROL)) -+ goto free_ops; -+ - return 0; - } - -@@ -2728,6 +2729,7 @@ static int ftrace_shutdown(struct ftrace_ops *ops, int command) - if (ops->flags & (FTRACE_OPS_FL_DYNAMIC | FTRACE_OPS_FL_CONTROL)) { - schedule_on_each_cpu(ftrace_sync); - -+ free_ops: - arch_ftrace_trampoline_free(ops); - - if (ops->flags & FTRACE_OPS_FL_CONTROL) -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index d59ebd9d21df..4743066010c4 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -5237,7 +5237,7 @@ static int tracing_set_clock(struct trace_array *tr, const char *clockstr) - tracing_reset_online_cpus(&tr->trace_buffer); - - #ifdef CONFIG_TRACER_MAX_TRACE -- if (tr->flags & TRACE_ARRAY_FL_GLOBAL && tr->max_buffer.buffer) -+ if (tr->max_buffer.buffer) - ring_buffer_set_clock(tr->max_buffer.buffer, trace_clocks[i].func); - tracing_reset_online_cpus(&tr->max_buffer); - #endif -diff --git a/kernel/trace/trace_selftest.c b/kernel/trace/trace_selftest.c -index b0f86ea77881..ca70d11b8aa7 100644 ---- a/kernel/trace/trace_selftest.c -+++ b/kernel/trace/trace_selftest.c -@@ -272,7 +272,7 @@ static int trace_selftest_ops(struct trace_array *tr, int cnt) - goto out_free; - if (cnt > 1) { - if (trace_selftest_test_global_cnt == 0) -- goto out; -+ goto out_free; - } - if (trace_selftest_test_dyn_cnt == 0) - goto out_free; -diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c -index 6b437e8760d3..12e8cf4bda9f 100644 ---- a/net/ieee802154/6lowpan/reassembly.c -+++ b/net/ieee802154/6lowpan/reassembly.c -@@ -580,19 +580,14 @@ static int __net_init lowpan_frags_init_net(struct net *net) - { - struct netns_ieee802154_lowpan *ieee802154_lowpan = - net_ieee802154_lowpan(net); -- int res; - - ieee802154_lowpan->frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - ieee802154_lowpan->frags.low_thresh = IPV6_FRAG_LOW_THRESH; - ieee802154_lowpan->frags.timeout = IPV6_FRAG_TIMEOUT; - -- res = inet_frags_init_net(&ieee802154_lowpan->frags); -- if (res) -- return res; -- res = lowpan_frags_ns_sysctl_register(net); -- if (res) -- inet_frags_uninit_net(&ieee802154_lowpan->frags); -- return res; -+ inet_frags_init_net(&ieee802154_lowpan->frags); -+ -+ return lowpan_frags_ns_sysctl_register(net); - } - - static void __net_exit lowpan_frags_exit_net(struct net *net) -diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c -index fe144dae7372..c5fb2f694ed0 100644 ---- a/net/ipv4/inet_fragment.c -+++ b/net/ipv4/inet_fragment.c -@@ -234,10 +234,8 @@ evict_again: - cond_resched(); - - if (read_seqretry(&f->rnd_seqlock, seq) || -- percpu_counter_sum(&nf->mem)) -+ sum_frag_mem_limit(nf)) - goto evict_again; -- -- percpu_counter_destroy(&nf->mem); - } - EXPORT_SYMBOL(inet_frags_exit_net); - -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index b8a0607dab96..e2e162432aa3 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -840,8 +840,6 @@ static void __init ip4_frags_ctl_register(void) - - static int __net_init ipv4_frags_init_net(struct net *net) - { -- int res; -- - /* Fragment cache limits. - * - * The fragment memory accounting code, (tries to) account for -@@ -865,13 +863,9 @@ static int __net_init ipv4_frags_init_net(struct net *net) - */ - net->ipv4.frags.timeout = IP_FRAG_TIME; - -- res = inet_frags_init_net(&net->ipv4.frags); -- if (res) -- return res; -- res = ip4_frags_ns_ctl_register(net); -- if (res) -- inet_frags_uninit_net(&net->ipv4.frags); -- return res; -+ inet_frags_init_net(&net->ipv4.frags); -+ -+ return ip4_frags_ns_ctl_register(net); - } - - static void __net_exit ipv4_frags_exit_net(struct net *net) -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 0870a86e9d96..5597120c8ffd 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2260,6 +2260,10 @@ int tcp_disconnect(struct sock *sk, int flags) - tcp_set_ca_state(sk, TCP_CA_Open); - tcp_clear_retrans(tp); - inet_csk_delack_init(sk); -+ /* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0 -+ * issue in __tcp_select_window() -+ */ -+ icsk->icsk_ack.rcv_mss = TCP_MIN_MSS; - tcp_init_send_head(sk); - memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); - __sk_dst_reset(sk); -diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c -index 735b22b1b4ea..92174881844d 100644 ---- a/net/ipv6/addrconf.c -+++ b/net/ipv6/addrconf.c -@@ -5152,7 +5152,7 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) - * our DAD process, so we don't need - * to do it again - */ -- if (!(ifp->rt->rt6i_node)) -+ if (!rcu_access_pointer(ifp->rt->rt6i_node)) - ip6_ins_rt(ifp->rt); - if (ifp->idev->cnf.forwarding) - addrconf_join_anycast(ifp); -diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c -index aad8cdf15472..c23e02a7ccb0 100644 ---- a/net/ipv6/ip6_fib.c -+++ b/net/ipv6/ip6_fib.c -@@ -150,11 +150,23 @@ static struct fib6_node *node_alloc(void) - return fn; - } - --static void node_free(struct fib6_node *fn) -+static void node_free_immediate(struct fib6_node *fn) -+{ -+ kmem_cache_free(fib6_node_kmem, fn); -+} -+ -+static void node_free_rcu(struct rcu_head *head) - { -+ struct fib6_node *fn = container_of(head, struct fib6_node, rcu); -+ - kmem_cache_free(fib6_node_kmem, fn); - } - -+static void node_free(struct fib6_node *fn) -+{ -+ call_rcu(&fn->rcu, node_free_rcu); -+} -+ - static void rt6_rcu_free(struct rt6_info *rt) - { - call_rcu(&rt->dst.rcu_head, dst_rcu_free); -@@ -191,6 +203,12 @@ static void rt6_release(struct rt6_info *rt) - } - } - -+static void fib6_free_table(struct fib6_table *table) -+{ -+ inetpeer_invalidate_tree(&table->tb6_peers); -+ kfree(table); -+} -+ - static void fib6_link_table(struct net *net, struct fib6_table *tb) - { - unsigned int h; -@@ -588,9 +606,9 @@ insert_above: - - if (!in || !ln) { - if (in) -- node_free(in); -+ node_free_immediate(in); - if (ln) -- node_free(ln); -+ node_free_immediate(ln); - return ERR_PTR(-ENOMEM); - } - -@@ -857,7 +875,7 @@ add: - - rt->dst.rt6_next = iter; - *ins = rt; -- rt->rt6i_node = fn; -+ rcu_assign_pointer(rt->rt6i_node, fn); - atomic_inc(&rt->rt6i_ref); - inet6_rt_notify(RTM_NEWROUTE, rt, info, 0); - info->nl_net->ipv6.rt6_stats->fib_rt_entries++; -@@ -882,7 +900,7 @@ add: - return err; - - *ins = rt; -- rt->rt6i_node = fn; -+ rcu_assign_pointer(rt->rt6i_node, fn); - rt->dst.rt6_next = iter->dst.rt6_next; - atomic_inc(&rt->rt6i_ref); - inet6_rt_notify(RTM_NEWROUTE, rt, info, NLM_F_REPLACE); -@@ -1015,7 +1033,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, - root, and then (in failure) stale node - in main tree. - */ -- node_free(sfn); -+ node_free_immediate(sfn); - err = PTR_ERR(sn); - goto failure; - } -@@ -1442,8 +1460,9 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp, - - int fib6_del(struct rt6_info *rt, struct nl_info *info) - { -+ struct fib6_node *fn = rcu_dereference_protected(rt->rt6i_node, -+ lockdep_is_held(&rt->rt6i_table->tb6_lock)); - struct net *net = info->nl_net; -- struct fib6_node *fn = rt->rt6i_node; - struct rt6_info **rtp; - - #if RT6_DEBUG >= 2 -@@ -1632,7 +1651,9 @@ static int fib6_clean_node(struct fib6_walker *w) - if (res) { - #if RT6_DEBUG >= 2 - pr_debug("%s: del failed: rt=%p@%p err=%d\n", -- __func__, rt, rt->rt6i_node, res); -+ __func__, rt, -+ rcu_access_pointer(rt->rt6i_node), -+ res); - #endif - continue; - } -@@ -1870,15 +1891,22 @@ out_timer: - - static void fib6_net_exit(struct net *net) - { -+ unsigned int i; -+ - rt6_ifdown(net, NULL); - del_timer_sync(&net->ipv6.ip6_fib_timer); - --#ifdef CONFIG_IPV6_MULTIPLE_TABLES -- inetpeer_invalidate_tree(&net->ipv6.fib6_local_tbl->tb6_peers); -- kfree(net->ipv6.fib6_local_tbl); --#endif -- inetpeer_invalidate_tree(&net->ipv6.fib6_main_tbl->tb6_peers); -- kfree(net->ipv6.fib6_main_tbl); -+ for (i = 0; i < FIB6_TABLE_HASHSZ; i++) { -+ struct hlist_head *head = &net->ipv6.fib_table_hash[i]; -+ struct hlist_node *tmp; -+ struct fib6_table *tb; -+ -+ hlist_for_each_entry_safe(tb, tmp, head, tb6_hlist) { -+ hlist_del(&tb->tb6_hlist); -+ fib6_free_table(tb); -+ } -+ } -+ - kfree(net->ipv6.fib_table_hash); - kfree(net->ipv6.rt6_stats); - } -diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c -index bab4441ed4e4..eb2dc39f7066 100644 ---- a/net/ipv6/netfilter/nf_conntrack_reasm.c -+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c -@@ -649,18 +649,12 @@ EXPORT_SYMBOL_GPL(nf_ct_frag6_consume_orig); - - static int nf_ct_net_init(struct net *net) - { -- int res; -- - net->nf_frag.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - net->nf_frag.frags.low_thresh = IPV6_FRAG_LOW_THRESH; - net->nf_frag.frags.timeout = IPV6_FRAG_TIMEOUT; -- res = inet_frags_init_net(&net->nf_frag.frags); -- if (res) -- return res; -- res = nf_ct_frag6_sysctl_register(net); -- if (res) -- inet_frags_uninit_net(&net->nf_frag.frags); -- return res; -+ inet_frags_init_net(&net->nf_frag.frags); -+ -+ return nf_ct_frag6_sysctl_register(net); - } - - static void nf_ct_net_exit(struct net *net) -diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c -index f9f02581c4ca..f99a04674419 100644 ---- a/net/ipv6/output_core.c -+++ b/net/ipv6/output_core.c -@@ -86,7 +86,6 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - - while (offset <= packet_len) { - struct ipv6_opt_hdr *exthdr; -- unsigned int len; - - switch (**nexthdr) { - -@@ -112,10 +111,9 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr) - - exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) + - offset); -- len = ipv6_optlen(exthdr); -- if (len + offset >= IPV6_MAXPLEN) -+ offset += ipv6_optlen(exthdr); -+ if (offset > IPV6_MAXPLEN) - return -EINVAL; -- offset += len; - *nexthdr = &exthdr->nexthdr; - } - -diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c -index a234552a7e3d..58f2139ebb5e 100644 ---- a/net/ipv6/reassembly.c -+++ b/net/ipv6/reassembly.c -@@ -708,19 +708,13 @@ static void ip6_frags_sysctl_unregister(void) - - static int __net_init ipv6_frags_init_net(struct net *net) - { -- int res; -- - net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH; - net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH; - net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT; - -- res = inet_frags_init_net(&net->ipv6.frags); -- if (res) -- return res; -- res = ip6_frags_ns_sysctl_register(net); -- if (res) -- inet_frags_uninit_net(&net->ipv6.frags); -- return res; -+ inet_frags_init_net(&net->ipv6.frags); -+ -+ return ip6_frags_ns_sysctl_register(net); - } - - static void __net_exit ipv6_frags_exit_net(struct net *net) -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index ef335070e98a..48917437550e 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -1248,7 +1248,9 @@ static void rt6_dst_from_metrics_check(struct rt6_info *rt) - - static struct dst_entry *rt6_check(struct rt6_info *rt, u32 cookie) - { -- if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie)) -+ u32 rt_cookie; -+ -+ if (!rt6_get_cookie_safe(rt, &rt_cookie) || rt_cookie != cookie) - return NULL; - - if (rt6_check_expired(rt)) -@@ -1316,8 +1318,14 @@ static void ip6_link_failure(struct sk_buff *skb) - if (rt->rt6i_flags & RTF_CACHE) { - dst_hold(&rt->dst); - ip6_del_rt(rt); -- } else if (rt->rt6i_node && (rt->rt6i_flags & RTF_DEFAULT)) { -- rt->rt6i_node->fn_sernum = -1; -+ } else { -+ struct fib6_node *fn; -+ -+ rcu_read_lock(); -+ fn = rcu_dereference(rt->rt6i_node); -+ if (fn && (rt->rt6i_flags & RTF_DEFAULT)) -+ fn->fn_sernum = -1; -+ rcu_read_unlock(); - } - } - } -@@ -1334,7 +1342,8 @@ static void rt6_do_update_pmtu(struct rt6_info *rt, u32 mtu) - static bool rt6_cache_allowed_for_pmtu(const struct rt6_info *rt) - { - return !(rt->rt6i_flags & RTF_CACHE) && -- (rt->rt6i_flags & RTF_PCPU || rt->rt6i_node); -+ (rt->rt6i_flags & RTF_PCPU || -+ rcu_access_pointer(rt->rt6i_node)); - } - - static void __ip6_rt_update_pmtu(struct dst_entry *dst, const struct sock *sk, diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.89-90.patch b/patch/kernel/mvebu64-default/03-patch-4.4.89-90.patch deleted file mode 100644 index 658420d3b58c..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.89-90.patch +++ /dev/null @@ -1,1208 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7e4c46b375b3..ca5aaaf4aef7 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 89 -+SUBLEVEL = 90 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/pxa27x.dtsi b/arch/arm/boot/dts/pxa27x.dtsi -index 7f68a1ee7073..210192c38df3 100644 ---- a/arch/arm/boot/dts/pxa27x.dtsi -+++ b/arch/arm/boot/dts/pxa27x.dtsi -@@ -13,6 +13,7 @@ - interrupts = <25>; - #dma-channels = <32>; - #dma-cells = <2>; -+ #dma-requests = <75>; - status = "okay"; - }; - -diff --git a/arch/arm/boot/dts/pxa3xx.dtsi b/arch/arm/boot/dts/pxa3xx.dtsi -index 564341af7e97..fec47bcd8292 100644 ---- a/arch/arm/boot/dts/pxa3xx.dtsi -+++ b/arch/arm/boot/dts/pxa3xx.dtsi -@@ -12,6 +12,7 @@ - interrupts = <25>; - #dma-channels = <32>; - #dma-cells = <2>; -+ #dma-requests = <100>; - status = "okay"; - }; - -diff --git a/arch/arm/mach-pxa/devices.c b/arch/arm/mach-pxa/devices.c -index 2a6e0ae2b920..614e9d8f0a54 100644 ---- a/arch/arm/mach-pxa/devices.c -+++ b/arch/arm/mach-pxa/devices.c -@@ -1203,6 +1203,7 @@ void __init pxa2xx_set_spi_info(unsigned id, struct pxa2xx_spi_master *info) - - static struct mmp_dma_platdata pxa_dma_pdata = { - .dma_channels = 0, -+ .nb_requestors = 0, - }; - - static struct resource pxa_dma_resource[] = { -@@ -1231,8 +1232,9 @@ static struct platform_device pxa2xx_pxa_dma = { - .resource = pxa_dma_resource, - }; - --void __init pxa2xx_set_dmac_info(int nb_channels) -+void __init pxa2xx_set_dmac_info(int nb_channels, int nb_requestors) - { - pxa_dma_pdata.dma_channels = nb_channels; -+ pxa_dma_pdata.nb_requestors = nb_requestors; - pxa_register_device(&pxa2xx_pxa_dma, &pxa_dma_pdata); - } -diff --git a/arch/arm/mach-pxa/pxa25x.c b/arch/arm/mach-pxa/pxa25x.c -index 1dc85ffc3e20..049b9cc22720 100644 ---- a/arch/arm/mach-pxa/pxa25x.c -+++ b/arch/arm/mach-pxa/pxa25x.c -@@ -206,7 +206,7 @@ static int __init pxa25x_init(void) - register_syscore_ops(&pxa_irq_syscore_ops); - register_syscore_ops(&pxa2xx_mfp_syscore_ops); - -- pxa2xx_set_dmac_info(16); -+ pxa2xx_set_dmac_info(16, 40); - pxa_register_device(&pxa25x_device_gpio, &pxa25x_gpio_info); - ret = platform_add_devices(pxa25x_devices, - ARRAY_SIZE(pxa25x_devices)); -diff --git a/arch/arm/mach-pxa/pxa27x.c b/arch/arm/mach-pxa/pxa27x.c -index ffc424028557..2fb6430b7a34 100644 ---- a/arch/arm/mach-pxa/pxa27x.c -+++ b/arch/arm/mach-pxa/pxa27x.c -@@ -309,7 +309,7 @@ static int __init pxa27x_init(void) - if (!of_have_populated_dt()) { - pxa_register_device(&pxa27x_device_gpio, - &pxa27x_gpio_info); -- pxa2xx_set_dmac_info(32); -+ pxa2xx_set_dmac_info(32, 75); - ret = platform_add_devices(devices, - ARRAY_SIZE(devices)); - } -diff --git a/arch/arm/mach-pxa/pxa3xx.c b/arch/arm/mach-pxa/pxa3xx.c -index 20ce2d386f17..ca06f082497c 100644 ---- a/arch/arm/mach-pxa/pxa3xx.c -+++ b/arch/arm/mach-pxa/pxa3xx.c -@@ -450,7 +450,7 @@ static int __init pxa3xx_init(void) - if (of_have_populated_dt()) - return 0; - -- pxa2xx_set_dmac_info(32); -+ pxa2xx_set_dmac_info(32, 100); - ret = platform_add_devices(devices, ARRAY_SIZE(devices)); - if (ret) - return ret; -diff --git a/arch/arm/plat-pxa/include/plat/dma.h b/arch/arm/plat-pxa/include/plat/dma.h -index 28848b344e2d..ceba3e4184fc 100644 ---- a/arch/arm/plat-pxa/include/plat/dma.h -+++ b/arch/arm/plat-pxa/include/plat/dma.h -@@ -95,6 +95,6 @@ static inline int pxad_toggle_reserved_channel(int legacy_channel) - } - #endif - --extern void __init pxa2xx_set_dmac_info(int nb_channels); -+extern void __init pxa2xx_set_dmac_info(int nb_channels, int nb_requestors); - - #endif /* __PLAT_DMA_H */ -diff --git a/arch/arm/xen/mm.c b/arch/arm/xen/mm.c -index c5f9a9e3d1f3..28d83f536e93 100644 ---- a/arch/arm/xen/mm.c -+++ b/arch/arm/xen/mm.c -@@ -199,6 +199,7 @@ static struct dma_map_ops xen_swiotlb_dma_ops = { - .unmap_page = xen_swiotlb_unmap_page, - .dma_supported = xen_swiotlb_dma_supported, - .set_dma_mask = xen_swiotlb_set_dma_mask, -+ .mmap = xen_swiotlb_dma_mmap, - }; - - int __init xen_mm_init(void) -diff --git a/arch/arm64/kernel/head.S b/arch/arm64/kernel/head.S -index 20ceb5edf7b8..d019c3a58cc2 100644 ---- a/arch/arm64/kernel/head.S -+++ b/arch/arm64/kernel/head.S -@@ -446,6 +446,7 @@ ENDPROC(__mmap_switched) - * booted in EL1 or EL2 respectively. - */ - ENTRY(el2_setup) -+ msr SPsel, #1 // We want to use SP_EL{1,2} - mrs x0, CurrentEL - cmp x0, #CurrentEL_EL2 - b.ne 1f -diff --git a/arch/arm64/mm/fault.c b/arch/arm64/mm/fault.c -index 7fabf49f2aeb..86485415c5f0 100644 ---- a/arch/arm64/mm/fault.c -+++ b/arch/arm64/mm/fault.c -@@ -447,7 +447,7 @@ static struct fault_info { - { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 0 translation fault" }, - { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 1 translation fault" }, - { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 2 translation fault" }, -- { do_page_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" }, -+ { do_translation_fault, SIGSEGV, SEGV_MAPERR, "level 3 translation fault" }, - { do_bad, SIGBUS, 0, "unknown 8" }, - { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 1 access flag fault" }, - { do_page_fault, SIGSEGV, SEGV_ACCERR, "level 2 access flag fault" }, -diff --git a/arch/powerpc/kvm/book3s_64_vio.c b/arch/powerpc/kvm/book3s_64_vio.c -index 54cf9bc94dad..3a095670b0c4 100644 ---- a/arch/powerpc/kvm/book3s_64_vio.c -+++ b/arch/powerpc/kvm/book3s_64_vio.c -@@ -101,22 +101,17 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, - struct kvm_create_spapr_tce *args) - { - struct kvmppc_spapr_tce_table *stt = NULL; -+ struct kvmppc_spapr_tce_table *siter; - long npages; - int ret = -ENOMEM; - int i; - -- /* Check this LIOBN hasn't been previously allocated */ -- list_for_each_entry(stt, &kvm->arch.spapr_tce_tables, list) { -- if (stt->liobn == args->liobn) -- return -EBUSY; -- } -- - npages = kvmppc_stt_npages(args->window_size); - - stt = kzalloc(sizeof(*stt) + npages * sizeof(struct page *), - GFP_KERNEL); - if (!stt) -- goto fail; -+ return ret; - - stt->liobn = args->liobn; - stt->window_size = args->window_size; -@@ -128,23 +123,36 @@ long kvm_vm_ioctl_create_spapr_tce(struct kvm *kvm, - goto fail; - } - -- kvm_get_kvm(kvm); -- - mutex_lock(&kvm->lock); -- list_add(&stt->list, &kvm->arch.spapr_tce_tables); -+ -+ /* Check this LIOBN hasn't been previously allocated */ -+ ret = 0; -+ list_for_each_entry(siter, &kvm->arch.spapr_tce_tables, list) { -+ if (siter->liobn == args->liobn) { -+ ret = -EBUSY; -+ break; -+ } -+ } -+ -+ if (!ret) -+ ret = anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, -+ stt, O_RDWR | O_CLOEXEC); -+ -+ if (ret >= 0) { -+ list_add(&stt->list, &kvm->arch.spapr_tce_tables); -+ kvm_get_kvm(kvm); -+ } - - mutex_unlock(&kvm->lock); - -- return anon_inode_getfd("kvm-spapr-tce", &kvm_spapr_tce_fops, -- stt, O_RDWR | O_CLOEXEC); -+ if (ret >= 0) -+ return ret; - --fail: -- if (stt) { -- for (i = 0; i < npages; i++) -- if (stt->pages[i]) -- __free_page(stt->pages[i]); -+ fail: -+ for (i = 0; i < npages; i++) -+ if (stt->pages[i]) -+ __free_page(stt->pages[i]); - -- kfree(stt); -- } -+ kfree(stt); - return ret; - } -diff --git a/arch/powerpc/platforms/pseries/mobility.c b/arch/powerpc/platforms/pseries/mobility.c -index ceb18d349459..8dd0c8edefd6 100644 ---- a/arch/powerpc/platforms/pseries/mobility.c -+++ b/arch/powerpc/platforms/pseries/mobility.c -@@ -225,8 +225,10 @@ static int add_dt_node(__be32 parent_phandle, __be32 drc_index) - return -ENOENT; - - dn = dlpar_configure_connector(drc_index, parent_dn); -- if (!dn) -+ if (!dn) { -+ of_node_put(parent_dn); - return -ENOENT; -+ } - - rc = dlpar_attach_node(dn); - if (rc) -diff --git a/arch/x86/kernel/fpu/regset.c b/arch/x86/kernel/fpu/regset.c -index 0bc3490420c5..72a483c295f2 100644 ---- a/arch/x86/kernel/fpu/regset.c -+++ b/arch/x86/kernel/fpu/regset.c -@@ -116,6 +116,11 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, - xsave = &fpu->state.xsave; - - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, xsave, 0, -1); -+ -+ /* xcomp_bv must be 0 when using uncompacted format */ -+ if (!ret && xsave->header.xcomp_bv) -+ ret = -EINVAL; -+ - /* - * mxcsr reserved bits must be masked to zero for security reasons. - */ -@@ -126,6 +131,12 @@ int xstateregs_set(struct task_struct *target, const struct user_regset *regset, - */ - memset(&xsave->header.reserved, 0, 48); - -+ /* -+ * In case of failure, mark all states as init: -+ */ -+ if (ret) -+ fpstate_init(&fpu->state); -+ - return ret; - } - -diff --git a/arch/x86/kernel/fpu/signal.c b/arch/x86/kernel/fpu/signal.c -index 31c6a60505e6..3de077116218 100644 ---- a/arch/x86/kernel/fpu/signal.c -+++ b/arch/x86/kernel/fpu/signal.c -@@ -309,7 +309,9 @@ static int __fpu__restore_sig(void __user *buf, void __user *buf_fx, int size) - fpu__drop(fpu); - - if (__copy_from_user(&fpu->state.xsave, buf_fx, state_size) || -- __copy_from_user(&env, buf, sizeof(env))) { -+ __copy_from_user(&env, buf, sizeof(env)) || -+ (state_size > offsetof(struct xregs_state, header) && -+ fpu->state.xsave.header.xcomp_bv)) { - fpstate_init(&fpu->state); - err = -1; - } else { -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index b12391119ce8..a018dff00808 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -2029,8 +2029,8 @@ static void vmx_vcpu_pi_load(struct kvm_vcpu *vcpu, int cpu) - - /* Allow posting non-urgent interrupts */ - new.sn = 0; -- } while (cmpxchg(&pi_desc->control, old.control, -- new.control) != old.control); -+ } while (cmpxchg64(&pi_desc->control, old.control, -+ new.control) != old.control); - } - /* - * Switches to specified vcpu, until a matching vcpu_put(), but assumes -@@ -4541,21 +4541,30 @@ static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu) - { - #ifdef CONFIG_SMP - if (vcpu->mode == IN_GUEST_MODE) { -- struct vcpu_vmx *vmx = to_vmx(vcpu); -- - /* -- * Currently, we don't support urgent interrupt, -- * all interrupts are recognized as non-urgent -- * interrupt, so we cannot post interrupts when -- * 'SN' is set. -+ * The vector of interrupt to be delivered to vcpu had -+ * been set in PIR before this function. -+ * -+ * Following cases will be reached in this block, and -+ * we always send a notification event in all cases as -+ * explained below. - * -- * If the vcpu is in guest mode, it means it is -- * running instead of being scheduled out and -- * waiting in the run queue, and that's the only -- * case when 'SN' is set currently, warning if -- * 'SN' is set. -+ * Case 1: vcpu keeps in non-root mode. Sending a -+ * notification event posts the interrupt to vcpu. -+ * -+ * Case 2: vcpu exits to root mode and is still -+ * runnable. PIR will be synced to vIRR before the -+ * next vcpu entry. Sending a notification event in -+ * this case has no effect, as vcpu is not in root -+ * mode. -+ * -+ * Case 3: vcpu exits to root mode and is blocked. -+ * vcpu_block() has already synced PIR to vIRR and -+ * never blocks vcpu if vIRR is not cleared. Therefore, -+ * a blocked vcpu here does not wait for any requested -+ * interrupts in PIR, and sending a notification event -+ * which has no effect is safe here. - */ -- WARN_ON_ONCE(pi_test_sn(&vmx->pi_desc)); - - apic->send_IPI_mask(get_cpu_mask(vcpu->cpu), - POSTED_INTR_VECTOR); -@@ -9683,6 +9692,11 @@ static void prepare_vmcs02(struct kvm_vcpu *vcpu, struct vmcs12 *vmcs12) - vmcs_write64(VIRTUAL_APIC_PAGE_ADDR, - page_to_phys(vmx->nested.virtual_apic_page)); - vmcs_write32(TPR_THRESHOLD, vmcs12->tpr_threshold); -+ } else { -+#ifdef CONFIG_X86_64 -+ exec_control |= CPU_BASED_CR8_LOAD_EXITING | -+ CPU_BASED_CR8_STORE_EXITING; -+#endif - } - - if (cpu_has_vmx_msr_bitmap() && -@@ -10691,8 +10705,8 @@ static int vmx_pre_block(struct kvm_vcpu *vcpu) - - /* set 'NV' to 'wakeup vector' */ - new.nv = POSTED_INTR_WAKEUP_VECTOR; -- } while (cmpxchg(&pi_desc->control, old.control, -- new.control) != old.control); -+ } while (cmpxchg64(&pi_desc->control, old.control, -+ new.control) != old.control); - - return 0; - } -@@ -10723,8 +10737,8 @@ static void vmx_post_block(struct kvm_vcpu *vcpu) - - /* set 'NV' to 'notification vector' */ - new.nv = POSTED_INTR_VECTOR; -- } while (cmpxchg(&pi_desc->control, old.control, -- new.control) != old.control); -+ } while (cmpxchg64(&pi_desc->control, old.control, -+ new.control) != old.control); - - if(vcpu->pre_pcpu != -1) { - spin_lock_irqsave( -@@ -10755,7 +10769,7 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, - struct kvm_lapic_irq irq; - struct kvm_vcpu *vcpu; - struct vcpu_data vcpu_info; -- int idx, ret = -EINVAL; -+ int idx, ret = 0; - - if (!kvm_arch_has_assigned_device(kvm) || - !irq_remapping_cap(IRQ_POSTING_CAP)) -@@ -10763,7 +10777,12 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, - - idx = srcu_read_lock(&kvm->irq_srcu); - irq_rt = srcu_dereference(kvm->irq_routing, &kvm->irq_srcu); -- BUG_ON(guest_irq >= irq_rt->nr_rt_entries); -+ if (guest_irq >= irq_rt->nr_rt_entries || -+ hlist_empty(&irq_rt->map[guest_irq])) { -+ pr_warn_once("no route for guest_irq %u/%u (broken user space?)\n", -+ guest_irq, irq_rt->nr_rt_entries); -+ goto out; -+ } - - hlist_for_each_entry(e, &irq_rt->map[guest_irq], link) { - if (e->type != KVM_IRQ_ROUTING_MSI) -@@ -10793,12 +10812,8 @@ static int vmx_update_pi_irte(struct kvm *kvm, unsigned int host_irq, - - if (set) - ret = irq_set_vcpu_affinity(host_irq, &vcpu_info); -- else { -- /* suppress notification event before unposting */ -- pi_set_sn(vcpu_to_pi_desc(vcpu)); -+ else - ret = irq_set_vcpu_affinity(host_irq, NULL); -- pi_clear_sn(vcpu_to_pi_desc(vcpu)); -- } - - if (ret < 0) { - printk(KERN_INFO "%s: failed to update PI IRTE\n", -diff --git a/block/bsg-lib.c b/block/bsg-lib.c -index 650f427d915b..341b8d858e67 100644 ---- a/block/bsg-lib.c -+++ b/block/bsg-lib.c -@@ -147,7 +147,6 @@ static int bsg_create_job(struct device *dev, struct request *req) - failjob_rls_rqst_payload: - kfree(job->request_payload.sg_list); - failjob_rls_job: -- kfree(job); - return -ENOMEM; - } - -diff --git a/drivers/crypto/talitos.c b/drivers/crypto/talitos.c -index 6a60936b46e0..62ce93568e11 100644 ---- a/drivers/crypto/talitos.c -+++ b/drivers/crypto/talitos.c -@@ -1749,9 +1749,9 @@ static int common_nonsnoop_hash(struct talitos_edesc *edesc, - req_ctx->swinit = 0; - } else { - desc->ptr[1] = zero_entry; -- /* Indicate next op is not the first. */ -- req_ctx->first = 0; - } -+ /* Indicate next op is not the first. */ -+ req_ctx->first = 0; - - /* HMAC key */ - if (ctx->keylen) -@@ -2770,7 +2770,8 @@ static struct talitos_crypto_alg *talitos_alg_alloc(struct device *dev, - t_alg->algt.alg.hash.final = ahash_final; - t_alg->algt.alg.hash.finup = ahash_finup; - t_alg->algt.alg.hash.digest = ahash_digest; -- t_alg->algt.alg.hash.setkey = ahash_setkey; -+ if (!strncmp(alg->cra_name, "hmac", 4)) -+ t_alg->algt.alg.hash.setkey = ahash_setkey; - t_alg->algt.alg.hash.import = ahash_import; - t_alg->algt.alg.hash.export = ahash_export; - -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index 5eac08ffc697..d55bf85b76ce 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -818,6 +818,14 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh - spin_unlock(&head->batch_head->batch_lock); - goto unlock_out; - } -+ /* -+ * We must assign batch_head of this stripe within the -+ * batch_lock, otherwise clear_batch_ready of batch head -+ * stripe could clear BATCH_READY bit of this stripe and -+ * this stripe->batch_head doesn't get assigned, which -+ * could confuse clear_batch_ready for this stripe -+ */ -+ sh->batch_head = head->batch_head; - - /* - * at this point, head's BATCH_READY could be cleared, but we -@@ -825,8 +833,6 @@ static void stripe_add_to_batch_list(struct r5conf *conf, struct stripe_head *sh - */ - list_add(&sh->batch_list, &head->batch_list); - spin_unlock(&head->batch_head->batch_lock); -- -- sh->batch_head = head->batch_head; - } else { - head->batch_head = head; - sh->batch_head = head->batch_head; -@@ -4258,7 +4264,8 @@ static void break_stripe_batch_list(struct stripe_head *head_sh, - - set_mask_bits(&sh->state, ~(STRIPE_EXPAND_SYNC_FLAGS | - (1 << STRIPE_PREREAD_ACTIVE) | -- (1 << STRIPE_DEGRADED)), -+ (1 << STRIPE_DEGRADED) | -+ (1 << STRIPE_ON_UNPLUG_LIST)), - head_sh->state & (1 << STRIPE_INSYNC)); - - sh->check_state = head_sh->check_state; -diff --git a/drivers/misc/cxl/api.c b/drivers/misc/cxl/api.c -index ea3eeb7011e1..690eb1a18caf 100644 ---- a/drivers/misc/cxl/api.c -+++ b/drivers/misc/cxl/api.c -@@ -176,6 +176,10 @@ int cxl_start_context(struct cxl_context *ctx, u64 wed, - kernel = false; - } - -+ /* -+ * Increment driver use count. Enables global TLBIs for hash -+ * and callbacks to handle the segment table -+ */ - cxl_ctx_get(); - - if ((rc = cxl_attach_process(ctx, kernel, wed , 0))) { -diff --git a/drivers/misc/cxl/file.c b/drivers/misc/cxl/file.c -index 10a02934bfc0..013558f4da4f 100644 ---- a/drivers/misc/cxl/file.c -+++ b/drivers/misc/cxl/file.c -@@ -94,7 +94,6 @@ static int __afu_open(struct inode *inode, struct file *file, bool master) - - pr_devel("afu_open pe: %i\n", ctx->pe); - file->private_data = ctx; -- cxl_ctx_get(); - - /* indicate success */ - rc = 0; -@@ -205,11 +204,18 @@ static long afu_ioctl_start_work(struct cxl_context *ctx, - ctx->pid = get_task_pid(current, PIDTYPE_PID); - ctx->glpid = get_task_pid(current->group_leader, PIDTYPE_PID); - -+ /* -+ * Increment driver use count. Enables global TLBIs for hash -+ * and callbacks to handle the segment table -+ */ -+ cxl_ctx_get(); -+ - trace_cxl_attach(ctx, work.work_element_descriptor, work.num_interrupts, amr); - - if ((rc = cxl_attach_process(ctx, false, work.work_element_descriptor, - amr))) { - afu_release_irqs(ctx, ctx); -+ cxl_ctx_put(); - goto out; - } - -diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c -index f8b2b5987ea9..ec91cd17bf34 100644 ---- a/drivers/pci/pci-sysfs.c -+++ b/drivers/pci/pci-sysfs.c -@@ -522,7 +522,7 @@ static ssize_t driver_override_store(struct device *dev, - const char *buf, size_t count) - { - struct pci_dev *pdev = to_pci_dev(dev); -- char *driver_override, *old = pdev->driver_override, *cp; -+ char *driver_override, *old, *cp; - - /* We need to keep extra room for a newline */ - if (count >= (PAGE_SIZE - 1)) -@@ -536,12 +536,15 @@ static ssize_t driver_override_store(struct device *dev, - if (cp) - *cp = '\0'; - -+ device_lock(dev); -+ old = pdev->driver_override; - if (strlen(driver_override)) { - pdev->driver_override = driver_override; - } else { - kfree(driver_override); - pdev->driver_override = NULL; - } -+ device_unlock(dev); - - kfree(old); - -@@ -552,8 +555,12 @@ static ssize_t driver_override_show(struct device *dev, - struct device_attribute *attr, char *buf) - { - struct pci_dev *pdev = to_pci_dev(dev); -+ ssize_t len; - -- return snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override); -+ device_lock(dev); -+ len = snprintf(buf, PAGE_SIZE, "%s\n", pdev->driver_override); -+ device_unlock(dev); -+ return len; - } - static DEVICE_ATTR_RW(driver_override); - -diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c -index e4b3d8f4fd85..bb4ed7b1f5df 100644 ---- a/drivers/scsi/scsi_transport_iscsi.c -+++ b/drivers/scsi/scsi_transport_iscsi.c -@@ -3697,7 +3697,7 @@ iscsi_if_rx(struct sk_buff *skb) - uint32_t group; - - nlh = nlmsg_hdr(skb); -- if (nlh->nlmsg_len < sizeof(*nlh) || -+ if (nlh->nlmsg_len < sizeof(*nlh) + sizeof(*ev) || - skb->len < nlh->nlmsg_len) { - break; - } -diff --git a/drivers/video/fbdev/aty/atyfb_base.c b/drivers/video/fbdev/aty/atyfb_base.c -index f34ed47fcaf8..7f658fa4d22a 100644 ---- a/drivers/video/fbdev/aty/atyfb_base.c -+++ b/drivers/video/fbdev/aty/atyfb_base.c -@@ -1861,7 +1861,7 @@ static int atyfb_ioctl(struct fb_info *info, u_int cmd, u_long arg) - #if defined(DEBUG) && defined(CONFIG_FB_ATY_CT) - case ATYIO_CLKR: - if (M64_HAS(INTEGRATED)) { -- struct atyclk clk; -+ struct atyclk clk = { 0 }; - union aty_pll *pll = &par->pll; - u32 dsp_config = pll->ct.dsp_config; - u32 dsp_on_off = pll->ct.dsp_on_off; -diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c -index 8a58bbc14de2..f7b19c25c3a4 100644 ---- a/drivers/xen/swiotlb-xen.c -+++ b/drivers/xen/swiotlb-xen.c -@@ -680,3 +680,22 @@ xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask) - return 0; - } - EXPORT_SYMBOL_GPL(xen_swiotlb_set_dma_mask); -+ -+/* -+ * Create userspace mapping for the DMA-coherent memory. -+ * This function should be called with the pages from the current domain only, -+ * passing pages mapped from other domains would lead to memory corruption. -+ */ -+int -+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma, -+ void *cpu_addr, dma_addr_t dma_addr, size_t size, -+ struct dma_attrs *attrs) -+{ -+#if defined(CONFIG_ARM) || defined(CONFIG_ARM64) -+ if (__generic_dma_ops(dev)->mmap) -+ return __generic_dma_ops(dev)->mmap(dev, vma, cpu_addr, -+ dma_addr, size, attrs); -+#endif -+ return dma_common_mmap(dev, vma, cpu_addr, dma_addr, size); -+} -+EXPORT_SYMBOL_GPL(xen_swiotlb_dma_mmap); -diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c -index 317b99acdf4b..9c3b9d07f341 100644 ---- a/fs/btrfs/ioctl.c -+++ b/fs/btrfs/ioctl.c -@@ -2984,7 +2984,7 @@ static int btrfs_cmp_data_prepare(struct inode *src, u64 loff, - out: - if (ret) - btrfs_cmp_data_free(cmp); -- return 0; -+ return ret; - } - - static int btrfs_cmp_data(struct inode *src, u64 loff, struct inode *dst, -@@ -4118,6 +4118,10 @@ static long btrfs_ioctl_default_subvol(struct file *file, void __user *argp) - ret = PTR_ERR(new_root); - goto out; - } -+ if (!is_fstree(new_root->objectid)) { -+ ret = -ENOENT; -+ goto out; -+ } - - path = btrfs_alloc_path(); - if (!path) { -diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c -index 8ca9aa92972d..9ebe027cc4b7 100644 ---- a/fs/btrfs/relocation.c -+++ b/fs/btrfs/relocation.c -@@ -2350,11 +2350,11 @@ void free_reloc_roots(struct list_head *list) - while (!list_empty(list)) { - reloc_root = list_entry(list->next, struct btrfs_root, - root_list); -+ __del_reloc_root(reloc_root); - free_extent_buffer(reloc_root->node); - free_extent_buffer(reloc_root->commit_root); - reloc_root->node = NULL; - reloc_root->commit_root = NULL; -- __del_reloc_root(reloc_root); - } - } - -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 53a827c6d8b1..b377aa8f266f 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -4060,6 +4060,14 @@ cifs_setup_session(const unsigned int xid, struct cifs_ses *ses, - cifs_dbg(FYI, "Security Mode: 0x%x Capabilities: 0x%x TimeAdjust: %d\n", - server->sec_mode, server->capabilities, server->timeAdj); - -+ if (ses->auth_key.response) { -+ cifs_dbg(VFS, "Free previous auth_key.response = %p\n", -+ ses->auth_key.response); -+ kfree(ses->auth_key.response); -+ ses->auth_key.response = NULL; -+ ses->auth_key.len = 0; -+ } -+ - if (server->ops->sess_setup) - rc = server->ops->sess_setup(xid, ses, nls_info); - -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index a0c0a49b6620..ec2d07bb9beb 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -224,6 +224,13 @@ cifs_nt_open(char *full_path, struct inode *inode, struct cifs_sb_info *cifs_sb, - if (backup_cred(cifs_sb)) - create_options |= CREATE_OPEN_BACKUP_INTENT; - -+ /* O_SYNC also has bit for O_DSYNC so following check picks up either */ -+ if (f_flags & O_SYNC) -+ create_options |= CREATE_WRITE_THROUGH; -+ -+ if (f_flags & O_DIRECT) -+ create_options |= CREATE_NO_BUFFER; -+ - oparms.tcon = tcon; - oparms.cifs_sb = cifs_sb; - oparms.desired_access = desired_access; -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index 6c484ddf26a9..f2ff60e58ec8 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -361,7 +361,7 @@ assemble_neg_contexts(struct smb2_negotiate_req *req) - build_encrypt_ctxt((struct smb2_encryption_neg_context *)pneg_ctxt); - req->NegotiateContextOffset = cpu_to_le32(OFFSET_OF_NEG_CONTEXT); - req->NegotiateContextCount = cpu_to_le16(2); -- inc_rfc1001_len(req, 4 + sizeof(struct smb2_preauth_neg_context) + 2 -+ inc_rfc1001_len(req, 4 + sizeof(struct smb2_preauth_neg_context) - + sizeof(struct smb2_encryption_neg_context)); /* calculate hash */ - } - #else -@@ -526,15 +526,22 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) - - /* - * validation ioctl must be signed, so no point sending this if we -- * can not sign it. We could eventually change this to selectively -+ * can not sign it (ie are not known user). Even if signing is not -+ * required (enabled but not negotiated), in those cases we selectively - * sign just this, the first and only signed request on a connection. -- * This is good enough for now since a user who wants better security -- * would also enable signing on the mount. Having validation of -- * negotiate info for signed connections helps reduce attack vectors -+ * Having validation of negotiate info helps reduce attack vectors. - */ -- if (tcon->ses->server->sign == false) -+ if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_GUEST) - return 0; /* validation requires signing */ - -+ if (tcon->ses->user_name == NULL) { -+ cifs_dbg(FYI, "Can't validate negotiate: null user mount\n"); -+ return 0; /* validation requires signing */ -+ } -+ -+ if (tcon->ses->session_flags & SMB2_SESSION_FLAG_IS_NULL) -+ cifs_dbg(VFS, "Unexpected null user (anonymous) auth flag sent by server\n"); -+ - vneg_inbuf.Capabilities = - cpu_to_le32(tcon->ses->server->vals->req_capabilities); - memcpy(vneg_inbuf.Guid, tcon->ses->server->client_guid, -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index 070901e76653..ff36f5475d7e 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -1814,13 +1814,10 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos) - { - struct gfs2_glock_iter *gi = seq->private; - loff_t n = *pos; -- int ret; -- -- if (gi->last_pos <= *pos) -- n = (*pos - gi->last_pos); - -- ret = rhashtable_walk_start(&gi->hti); -- if (ret) -+ if (rhashtable_walk_init(&gl_hash_table, &gi->hti) != 0) -+ return NULL; -+ if (rhashtable_walk_start(&gi->hti) != 0) - return NULL; - - do { -@@ -1828,6 +1825,7 @@ static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos) - } while (gi->gl && n--); - - gi->last_pos = *pos; -+ - return gi->gl; - } - -@@ -1839,6 +1837,7 @@ static void *gfs2_glock_seq_next(struct seq_file *seq, void *iter_ptr, - (*pos)++; - gi->last_pos = *pos; - gfs2_glock_iter_next(gi); -+ - return gi->gl; - } - -@@ -1847,7 +1846,10 @@ static void gfs2_glock_seq_stop(struct seq_file *seq, void *iter_ptr) - struct gfs2_glock_iter *gi = seq->private; - - gi->gl = NULL; -- rhashtable_walk_stop(&gi->hti); -+ if (gi->hti.walker) { -+ rhashtable_walk_stop(&gi->hti); -+ rhashtable_walk_exit(&gi->hti); -+ } - } - - static int gfs2_glock_seq_show(struct seq_file *seq, void *iter_ptr) -@@ -1910,12 +1912,10 @@ static int gfs2_glocks_open(struct inode *inode, struct file *file) - struct gfs2_glock_iter *gi = seq->private; - - gi->sdp = inode->i_private; -- gi->last_pos = 0; - seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN); - if (seq->buf) - seq->size = GFS2_SEQ_GOODSIZE; - gi->gl = NULL; -- ret = rhashtable_walk_init(&gl_hash_table, &gi->hti); - } - return ret; - } -@@ -1926,7 +1926,6 @@ static int gfs2_glocks_release(struct inode *inode, struct file *file) - struct gfs2_glock_iter *gi = seq->private; - - gi->gl = NULL; -- rhashtable_walk_exit(&gi->hti); - return seq_release_private(inode, file); - } - -@@ -1938,12 +1937,10 @@ static int gfs2_glstats_open(struct inode *inode, struct file *file) - struct seq_file *seq = file->private_data; - struct gfs2_glock_iter *gi = seq->private; - gi->sdp = inode->i_private; -- gi->last_pos = 0; - seq->buf = kmalloc(GFS2_SEQ_GOODSIZE, GFP_KERNEL | __GFP_NOWARN); - if (seq->buf) - seq->size = GFS2_SEQ_GOODSIZE; - gi->gl = NULL; -- ret = rhashtable_walk_init(&gl_hash_table, &gi->hti); - } - return ret; - } -diff --git a/fs/read_write.c b/fs/read_write.c -index 819ef3faf1bb..bfd1a5dddf6e 100644 ---- a/fs/read_write.c -+++ b/fs/read_write.c -@@ -112,7 +112,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence, - * In the generic case the entire file is data, so as long as - * offset isn't at the end of the file then the offset is data. - */ -- if (offset >= eof) -+ if ((unsigned long long)offset >= eof) - return -ENXIO; - break; - case SEEK_HOLE: -@@ -120,7 +120,7 @@ generic_file_llseek_size(struct file *file, loff_t offset, int whence, - * There is a virtual hole at the end of the file, so as long as - * offset isn't i_size or larger, return i_size. - */ -- if (offset >= eof) -+ if ((unsigned long long)offset >= eof) - return -ENXIO; - offset = eof; - break; -diff --git a/include/linux/key.h b/include/linux/key.h -index 66f705243985..dcc115e8dd03 100644 ---- a/include/linux/key.h -+++ b/include/linux/key.h -@@ -177,6 +177,7 @@ struct key { - #define KEY_FLAG_TRUSTED_ONLY 9 /* set if keyring only accepts links to trusted keys */ - #define KEY_FLAG_BUILTIN 10 /* set if key is builtin */ - #define KEY_FLAG_ROOT_CAN_INVAL 11 /* set if key can be invalidated by root without permission */ -+#define KEY_FLAG_UID_KEYRING 12 /* set if key is a user or user session keyring */ - - /* the key type and key description string - * - the desc is used to match a key against search criteria -@@ -218,6 +219,7 @@ extern struct key *key_alloc(struct key_type *type, - #define KEY_ALLOC_QUOTA_OVERRUN 0x0001 /* add to quota, permit even if overrun */ - #define KEY_ALLOC_NOT_IN_QUOTA 0x0002 /* not in quota */ - #define KEY_ALLOC_TRUSTED 0x0004 /* Key should be flagged as trusted */ -+#define KEY_ALLOC_UID_KEYRING 0x0010 /* allocating a user or user session keyring */ - - extern void key_revoke(struct key *key); - extern void key_invalidate(struct key *key); -diff --git a/include/linux/platform_data/mmp_dma.h b/include/linux/platform_data/mmp_dma.h -index 2a330ec9e2af..d1397c8ed94e 100644 ---- a/include/linux/platform_data/mmp_dma.h -+++ b/include/linux/platform_data/mmp_dma.h -@@ -14,6 +14,7 @@ - - struct mmp_dma_platdata { - int dma_channels; -+ int nb_requestors; - }; - - #endif /* MMP_DMA_H */ -diff --git a/include/xen/swiotlb-xen.h b/include/xen/swiotlb-xen.h -index 8b2eb93ae8ba..4d7fdbf20eff 100644 ---- a/include/xen/swiotlb-xen.h -+++ b/include/xen/swiotlb-xen.h -@@ -58,4 +58,9 @@ xen_swiotlb_dma_supported(struct device *hwdev, u64 mask); - - extern int - xen_swiotlb_set_dma_mask(struct device *dev, u64 dma_mask); -+ -+extern int -+xen_swiotlb_dma_mmap(struct device *dev, struct vm_area_struct *vma, -+ void *cpu_addr, dma_addr_t dma_addr, size_t size, -+ struct dma_attrs *attrs); - #endif /* __LINUX_SWIOTLB_XEN_H */ -diff --git a/kernel/seccomp.c b/kernel/seccomp.c -index 15a1795bbba1..efd384f3f852 100644 ---- a/kernel/seccomp.c -+++ b/kernel/seccomp.c -@@ -457,14 +457,19 @@ static long seccomp_attach_filter(unsigned int flags, - return 0; - } - -+void __get_seccomp_filter(struct seccomp_filter *filter) -+{ -+ /* Reference count is bounded by the number of total processes. */ -+ atomic_inc(&filter->usage); -+} -+ - /* get_seccomp_filter - increments the reference count of the filter on @tsk */ - void get_seccomp_filter(struct task_struct *tsk) - { - struct seccomp_filter *orig = tsk->seccomp.filter; - if (!orig) - return; -- /* Reference count is bounded by the number of total processes. */ -- atomic_inc(&orig->usage); -+ __get_seccomp_filter(orig); - } - - static inline void seccomp_filter_free(struct seccomp_filter *filter) -@@ -475,10 +480,8 @@ static inline void seccomp_filter_free(struct seccomp_filter *filter) - } - } - --/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */ --void put_seccomp_filter(struct task_struct *tsk) -+static void __put_seccomp_filter(struct seccomp_filter *orig) - { -- struct seccomp_filter *orig = tsk->seccomp.filter; - /* Clean up single-reference branches iteratively. */ - while (orig && atomic_dec_and_test(&orig->usage)) { - struct seccomp_filter *freeme = orig; -@@ -487,6 +490,12 @@ void put_seccomp_filter(struct task_struct *tsk) - } - } - -+/* put_seccomp_filter - decrements the ref count of tsk->seccomp.filter */ -+void put_seccomp_filter(struct task_struct *tsk) -+{ -+ __put_seccomp_filter(tsk->seccomp.filter); -+} -+ - /** - * seccomp_send_sigsys - signals the task to allow in-process syscall emulation - * @syscall: syscall number to send to userland -@@ -927,13 +936,13 @@ long seccomp_get_filter(struct task_struct *task, unsigned long filter_off, - if (!data) - goto out; - -- get_seccomp_filter(task); -+ __get_seccomp_filter(filter); - spin_unlock_irq(&task->sighand->siglock); - - if (copy_to_user(data, fprog->filter, bpf_classic_proglen(fprog))) - ret = -EFAULT; - -- put_seccomp_filter(task); -+ __put_seccomp_filter(filter); - return ret; - - out: -diff --git a/kernel/sysctl.c b/kernel/sysctl.c -index 002ec084124b..17c59e78661b 100644 ---- a/kernel/sysctl.c -+++ b/kernel/sysctl.c -@@ -1159,6 +1159,8 @@ static struct ctl_table kern_table[] = { - .maxlen = sizeof(unsigned int), - .mode = 0644, - .proc_handler = timer_migration_handler, -+ .extra1 = &zero, -+ .extra2 = &one, - }, - #endif - #ifdef CONFIG_BPF_SYSCALL -diff --git a/kernel/time/timer.c b/kernel/time/timer.c -index bbc5d1114583..125407144c01 100644 ---- a/kernel/time/timer.c -+++ b/kernel/time/timer.c -@@ -127,7 +127,7 @@ int timer_migration_handler(struct ctl_table *table, int write, - int ret; - - mutex_lock(&mutex); -- ret = proc_dointvec(table, write, buffer, lenp, ppos); -+ ret = proc_dointvec_minmax(table, write, buffer, lenp, ppos); - if (!ret && write) - timers_update_migration(false); - mutex_unlock(&mutex); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 4743066010c4..b64f35afee4e 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3226,11 +3226,17 @@ static int tracing_open(struct inode *inode, struct file *file) - /* If this file was open for write, then erase contents */ - if ((file->f_mode & FMODE_WRITE) && (file->f_flags & O_TRUNC)) { - int cpu = tracing_get_cpu(inode); -+ struct trace_buffer *trace_buf = &tr->trace_buffer; -+ -+#ifdef CONFIG_TRACER_MAX_TRACE -+ if (tr->current_trace->print_max) -+ trace_buf = &tr->max_buffer; -+#endif - - if (cpu == RING_BUFFER_ALL_CPUS) -- tracing_reset_online_cpus(&tr->trace_buffer); -+ tracing_reset_online_cpus(trace_buf); - else -- tracing_reset(&tr->trace_buffer, cpu); -+ tracing_reset(trace_buf, cpu); - } - - if (file->f_mode & FMODE_READ) { -@@ -4701,7 +4707,7 @@ static int tracing_wait_pipe(struct file *filp) - * - * iter->pos will be 0 if we haven't read anything. - */ -- if (!tracing_is_on() && iter->pos) -+ if (!tracer_tracing_is_on(iter->tr) && iter->pos) - break; - - mutex_unlock(&iter->mutex); -diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c -index 04401037140e..b6be51940ead 100644 ---- a/net/mac80211/offchannel.c -+++ b/net/mac80211/offchannel.c -@@ -469,6 +469,8 @@ void ieee80211_roc_purge(struct ieee80211_local *local, - struct ieee80211_roc_work *roc, *tmp; - LIST_HEAD(tmp_list); - -+ flush_work(&local->hw_roc_start); -+ - mutex_lock(&local->mtx); - list_for_each_entry_safe(roc, tmp, &local->roc_list, list) { - if (sdata && roc->sdata != sdata) -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index de10e3c0e2a4..8ece212aa3d2 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -9786,6 +9786,9 @@ static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info) - if (err) - return err; - -+ if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] || -+ !tb[NL80211_REKEY_DATA_KCK]) -+ return -EINVAL; - if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN) - return -ERANGE; - if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN) -diff --git a/security/keys/internal.h b/security/keys/internal.h -index 5105c2c2da75..51ffb9cde073 100644 ---- a/security/keys/internal.h -+++ b/security/keys/internal.h -@@ -136,7 +136,7 @@ extern key_ref_t keyring_search_aux(key_ref_t keyring_ref, - extern key_ref_t search_my_process_keyrings(struct keyring_search_context *ctx); - extern key_ref_t search_process_keyrings(struct keyring_search_context *ctx); - --extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check); -+extern struct key *find_keyring_by_name(const char *name, bool uid_keyring); - - extern int install_user_keyrings(void); - extern int install_thread_keyring_to_cred(struct cred *); -diff --git a/security/keys/key.c b/security/keys/key.c -index 09c10b181881..51d23c623424 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -296,6 +296,8 @@ struct key *key_alloc(struct key_type *type, const char *desc, - key->flags |= 1 << KEY_FLAG_IN_QUOTA; - if (flags & KEY_ALLOC_TRUSTED) - key->flags |= 1 << KEY_FLAG_TRUSTED; -+ if (flags & KEY_ALLOC_UID_KEYRING) -+ key->flags |= 1 << KEY_FLAG_UID_KEYRING; - - #ifdef KEY_DEBUGGING - key->magic = KEY_DEBUG_MAGIC; -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index 671709d8610d..a009dc66eb8f 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -738,6 +738,11 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) - - key = key_ref_to_ptr(key_ref); - -+ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) { -+ ret = -ENOKEY; -+ goto error2; -+ } -+ - /* see if we can read it directly */ - ret = key_permission(key_ref, KEY_NEED_READ); - if (ret == 0) -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index f931ccfeefb0..0c8dd4fbe130 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -416,7 +416,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m) - } - - struct keyring_read_iterator_context { -- size_t qty; -+ size_t buflen; - size_t count; - key_serial_t __user *buffer; - }; -@@ -428,9 +428,9 @@ static int keyring_read_iterator(const void *object, void *data) - int ret; - - kenter("{%s,%d},,{%zu/%zu}", -- key->type->name, key->serial, ctx->count, ctx->qty); -+ key->type->name, key->serial, ctx->count, ctx->buflen); - -- if (ctx->count >= ctx->qty) -+ if (ctx->count >= ctx->buflen) - return 1; - - ret = put_user(key->serial, ctx->buffer); -@@ -465,16 +465,12 @@ static long keyring_read(const struct key *keyring, - return 0; - - /* Calculate how much data we could return */ -- ctx.qty = nr_keys * sizeof(key_serial_t); -- - if (!buffer || !buflen) -- return ctx.qty; -- -- if (buflen > ctx.qty) -- ctx.qty = buflen; -+ return nr_keys * sizeof(key_serial_t); - - /* Copy the IDs of the subscribed keys into the buffer */ - ctx.buffer = (key_serial_t __user *)buffer; -+ ctx.buflen = buflen; - ctx.count = 0; - ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx); - if (ret < 0) { -@@ -965,15 +961,15 @@ found: - /* - * Find a keyring with the specified name. - * -- * All named keyrings in the current user namespace are searched, provided they -- * grant Search permission directly to the caller (unless this check is -- * skipped). Keyrings whose usage points have reached zero or who have been -- * revoked are skipped. -+ * Only keyrings that have nonzero refcount, are not revoked, and are owned by a -+ * user in the current user namespace are considered. If @uid_keyring is %true, -+ * the keyring additionally must have been allocated as a user or user session -+ * keyring; otherwise, it must grant Search permission directly to the caller. - * - * Returns a pointer to the keyring with the keyring's refcount having being - * incremented on success. -ENOKEY is returned if a key could not be found. - */ --struct key *find_keyring_by_name(const char *name, bool skip_perm_check) -+struct key *find_keyring_by_name(const char *name, bool uid_keyring) - { - struct key *keyring; - int bucket; -@@ -1001,10 +997,15 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check) - if (strcmp(keyring->description, name) != 0) - continue; - -- if (!skip_perm_check && -- key_permission(make_key_ref(keyring, 0), -- KEY_NEED_SEARCH) < 0) -- continue; -+ if (uid_keyring) { -+ if (!test_bit(KEY_FLAG_UID_KEYRING, -+ &keyring->flags)) -+ continue; -+ } else { -+ if (key_permission(make_key_ref(keyring, 0), -+ KEY_NEED_SEARCH) < 0) -+ continue; -+ } - - /* we've got a match but we might end up racing with - * key_cleanup() if the keyring is currently 'dead' -diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index 4ed909142956..7dd050f24261 100644 ---- a/security/keys/process_keys.c -+++ b/security/keys/process_keys.c -@@ -76,7 +76,9 @@ int install_user_keyrings(void) - if (IS_ERR(uid_keyring)) { - uid_keyring = keyring_alloc(buf, user->uid, INVALID_GID, - cred, user_keyring_perm, -- KEY_ALLOC_IN_QUOTA, NULL); -+ KEY_ALLOC_UID_KEYRING | -+ KEY_ALLOC_IN_QUOTA, -+ NULL); - if (IS_ERR(uid_keyring)) { - ret = PTR_ERR(uid_keyring); - goto error; -@@ -92,7 +94,9 @@ int install_user_keyrings(void) - session_keyring = - keyring_alloc(buf, user->uid, INVALID_GID, - cred, user_keyring_perm, -- KEY_ALLOC_IN_QUOTA, NULL); -+ KEY_ALLOC_UID_KEYRING | -+ KEY_ALLOC_IN_QUOTA, -+ NULL); - if (IS_ERR(session_keyring)) { - ret = PTR_ERR(session_keyring); - goto error_release; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.90-91.patch b/patch/kernel/mvebu64-default/03-patch-4.4.90-91.patch deleted file mode 100644 index 65a73f3aeff3..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.90-91.patch +++ /dev/null @@ -1,2284 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt -new file mode 100644 -index 000000000000..6ec1a880ac18 ---- /dev/null -+++ b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt -@@ -0,0 +1,46 @@ -+THS8135 Video DAC -+----------------- -+ -+This is the binding for Texas Instruments THS8135 Video DAC bridge. -+ -+Required properties: -+ -+- compatible: Must be "ti,ths8135" -+ -+Required nodes: -+ -+This device has two video ports. Their connections are modelled using the OF -+graph bindings specified in Documentation/devicetree/bindings/graph.txt. -+ -+- Video port 0 for RGB input -+- Video port 1 for VGA output -+ -+Example -+------- -+ -+vga-bridge { -+ compatible = "ti,ths8135"; -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ ports { -+ #address-cells = <1>; -+ #size-cells = <0>; -+ -+ port@0 { -+ reg = <0>; -+ -+ vga_bridge_in: endpoint { -+ remote-endpoint = <&lcdc_out_vga>; -+ }; -+ }; -+ -+ port@1 { -+ reg = <1>; -+ -+ vga_bridge_out: endpoint { -+ remote-endpoint = <&vga_con_in>; -+ }; -+ }; -+ }; -+}; -diff --git a/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt -new file mode 100644 -index 000000000000..b3629405f568 ---- /dev/null -+++ b/Documentation/devicetree/bindings/iio/adc/avia-hx711.txt -@@ -0,0 +1,18 @@ -+* AVIA HX711 ADC chip for weight cells -+ Bit-banging driver -+ -+Required properties: -+ - compatible: Should be "avia,hx711" -+ - sck-gpios: Definition of the GPIO for the clock -+ - dout-gpios: Definition of the GPIO for data-out -+ See Documentation/devicetree/bindings/gpio/gpio.txt -+ - avdd-supply: Definition of the regulator used as analog supply -+ -+Example: -+weight@0 { -+ compatible = "avia,hx711"; -+ sck-gpios = <&gpio3 10 GPIO_ACTIVE_HIGH>; -+ dout-gpios = <&gpio0 7 GPIO_ACTIVE_HIGH>; -+ avdd-suppy = <&avdd>; -+}; -+ -diff --git a/Documentation/devicetree/bindings/vendor-prefixes.txt b/Documentation/devicetree/bindings/vendor-prefixes.txt -index 55df1d444e9f..98dc17507a84 100644 ---- a/Documentation/devicetree/bindings/vendor-prefixes.txt -+++ b/Documentation/devicetree/bindings/vendor-prefixes.txt -@@ -31,6 +31,7 @@ asahi-kasei Asahi Kasei Corp. - atmel Atmel Corporation - auo AU Optronics Corporation - avago Avago Technologies -+avia avia semiconductor - avic Shanghai AVIC Optoelectronics Co., Ltd. - axis Axis Communications AB - bosch Bosch Sensortec GmbH -diff --git a/Makefile b/Makefile -index ca5aaaf4aef7..c1db50ef7fb5 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 90 -+SUBLEVEL = 91 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/Kconfig-nommu b/arch/arm/Kconfig-nommu -index aed66d5df7f1..b7576349528c 100644 ---- a/arch/arm/Kconfig-nommu -+++ b/arch/arm/Kconfig-nommu -@@ -34,8 +34,7 @@ config PROCESSOR_ID - used instead of the auto-probing which utilizes the register. - - config REMAP_VECTORS_TO_RAM -- bool 'Install vectors to the beginning of RAM' if DRAM_BASE -- depends on DRAM_BASE -+ bool 'Install vectors to the beginning of RAM' - help - The kernel needs to change the hardware exception vectors. - In nommu mode, the hardware exception vectors are normally -diff --git a/arch/arm/boot/dts/r8a7790.dtsi b/arch/arm/boot/dts/r8a7790.dtsi -index e07ae5d45e19..7b39d8fae61e 100644 ---- a/arch/arm/boot/dts/r8a7790.dtsi -+++ b/arch/arm/boot/dts/r8a7790.dtsi -@@ -1409,7 +1409,8 @@ - }; - - msiof0: spi@e6e20000 { -- compatible = "renesas,msiof-r8a7790"; -+ compatible = "renesas,msiof-r8a7790", -+ "renesas,rcar-gen2-msiof"; - reg = <0 0xe6e20000 0 0x0064>; - interrupts = <0 156 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&mstp0_clks R8A7790_CLK_MSIOF0>; -@@ -1422,7 +1423,8 @@ - }; - - msiof1: spi@e6e10000 { -- compatible = "renesas,msiof-r8a7790"; -+ compatible = "renesas,msiof-r8a7790", -+ "renesas,rcar-gen2-msiof"; - reg = <0 0xe6e10000 0 0x0064>; - interrupts = <0 157 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&mstp2_clks R8A7790_CLK_MSIOF1>; -@@ -1435,7 +1437,8 @@ - }; - - msiof2: spi@e6e00000 { -- compatible = "renesas,msiof-r8a7790"; -+ compatible = "renesas,msiof-r8a7790", -+ "renesas,rcar-gen2-msiof"; - reg = <0 0xe6e00000 0 0x0064>; - interrupts = <0 158 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&mstp2_clks R8A7790_CLK_MSIOF2>; -@@ -1448,7 +1451,8 @@ - }; - - msiof3: spi@e6c90000 { -- compatible = "renesas,msiof-r8a7790"; -+ compatible = "renesas,msiof-r8a7790", -+ "renesas,rcar-gen2-msiof"; - reg = <0 0xe6c90000 0 0x0064>; - interrupts = <0 159 IRQ_TYPE_LEVEL_HIGH>; - clocks = <&mstp2_clks R8A7790_CLK_MSIOF3>; -diff --git a/arch/arm/mach-at91/pm.c b/arch/arm/mach-at91/pm.c -index d687f860a2da..84eefbc2b4f9 100644 ---- a/arch/arm/mach-at91/pm.c -+++ b/arch/arm/mach-at91/pm.c -@@ -332,7 +332,7 @@ static void at91sam9_sdram_standby(void) - at91_ramc_write(1, AT91_SDRAMC_LPR, saved_lpr1); - } - --static const struct of_device_id const ramc_ids[] __initconst = { -+static const struct of_device_id ramc_ids[] __initconst = { - { .compatible = "atmel,at91rm9200-sdramc", .data = at91rm9200_standby }, - { .compatible = "atmel,at91sam9260-sdramc", .data = at91sam9_sdram_standby }, - { .compatible = "atmel,at91sam9g45-ddramc", .data = at91_ddr_standby }, -diff --git a/arch/arm/mach-bcm/bcm_kona_smc.c b/arch/arm/mach-bcm/bcm_kona_smc.c -index cf3f8658f0e5..a55a7ecf146a 100644 ---- a/arch/arm/mach-bcm/bcm_kona_smc.c -+++ b/arch/arm/mach-bcm/bcm_kona_smc.c -@@ -33,7 +33,7 @@ struct bcm_kona_smc_data { - unsigned result; - }; - --static const struct of_device_id const bcm_kona_smc_ids[] __initconst = { -+static const struct of_device_id bcm_kona_smc_ids[] __initconst = { - {.compatible = "brcm,kona-smc"}, - {.compatible = "bcm,kona-smc"}, /* deprecated name */ - {}, -diff --git a/arch/arm/mach-cns3xxx/core.c b/arch/arm/mach-cns3xxx/core.c -index 9b1dc223d8d3..e17a0e025f62 100644 ---- a/arch/arm/mach-cns3xxx/core.c -+++ b/arch/arm/mach-cns3xxx/core.c -@@ -346,7 +346,7 @@ static struct usb_ohci_pdata cns3xxx_usb_ohci_pdata = { - .power_off = csn3xxx_usb_power_off, - }; - --static const struct of_dev_auxdata const cns3xxx_auxdata[] __initconst = { -+static const struct of_dev_auxdata cns3xxx_auxdata[] __initconst = { - { "intel,usb-ehci", CNS3XXX_USB_BASE, "ehci-platform", &cns3xxx_usb_ehci_pdata }, - { "intel,usb-ohci", CNS3XXX_USB_OHCI_BASE, "ohci-platform", &cns3xxx_usb_ohci_pdata }, - { "cavium,cns3420-ahci", CNS3XXX_SATA2_BASE, "ahci", NULL }, -diff --git a/arch/arm/mach-omap2/prm_common.c b/arch/arm/mach-omap2/prm_common.c -index 3fc2cbe52113..0ce4548ef7f0 100644 ---- a/arch/arm/mach-omap2/prm_common.c -+++ b/arch/arm/mach-omap2/prm_common.c -@@ -706,7 +706,7 @@ static struct omap_prcm_init_data scrm_data __initdata = { - }; - #endif - --static const struct of_device_id const omap_prcm_dt_match_table[] __initconst = { -+static const struct of_device_id omap_prcm_dt_match_table[] __initconst = { - #ifdef CONFIG_SOC_AM33XX - { .compatible = "ti,am3-prcm", .data = &am3_prm_data }, - #endif -diff --git a/arch/arm/mach-omap2/vc.c b/arch/arm/mach-omap2/vc.c -index 2028167fff31..d76b1e5eb8ba 100644 ---- a/arch/arm/mach-omap2/vc.c -+++ b/arch/arm/mach-omap2/vc.c -@@ -559,7 +559,7 @@ struct i2c_init_data { - u8 hsscll_12; - }; - --static const struct i2c_init_data const omap4_i2c_timing_data[] __initconst = { -+static const struct i2c_init_data omap4_i2c_timing_data[] __initconst = { - { - .load = 50, - .loadbits = 0x3, -diff --git a/arch/arm/mach-spear/time.c b/arch/arm/mach-spear/time.c -index 9ccffc1d0f28..aaaa6781b9fe 100644 ---- a/arch/arm/mach-spear/time.c -+++ b/arch/arm/mach-spear/time.c -@@ -204,7 +204,7 @@ static void __init spear_clockevent_init(int irq) - setup_irq(irq, &spear_timer_irq); - } - --static const struct of_device_id const timer_of_match[] __initconst = { -+static const struct of_device_id timer_of_match[] __initconst = { - { .compatible = "st,spear-timer", }, - { }, - }; -diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h -index ebb9efb02502..77edb22f855d 100644 ---- a/arch/mips/include/asm/irq.h -+++ b/arch/mips/include/asm/irq.h -@@ -18,9 +18,24 @@ - #include - - #define IRQ_STACK_SIZE THREAD_SIZE -+#define IRQ_STACK_START (IRQ_STACK_SIZE - sizeof(unsigned long)) - - extern void *irq_stack[NR_CPUS]; - -+/* -+ * The highest address on the IRQ stack contains a dummy frame put down in -+ * genex.S (handle_int & except_vec_vi_handler) which is structured as follows: -+ * -+ * top ------------ -+ * | task sp | <- irq_stack[cpu] + IRQ_STACK_START -+ * ------------ -+ * | | <- First frame of IRQ context -+ * ------------ -+ * -+ * task sp holds a copy of the task stack pointer where the struct pt_regs -+ * from exception entry can be found. -+ */ -+ - static inline bool on_irq_stack(int cpu, unsigned long sp) - { - unsigned long low = (unsigned long)irq_stack[cpu]; -diff --git a/arch/mips/kernel/asm-offsets.c b/arch/mips/kernel/asm-offsets.c -index ec053ce7bb38..7ab8004c1659 100644 ---- a/arch/mips/kernel/asm-offsets.c -+++ b/arch/mips/kernel/asm-offsets.c -@@ -102,6 +102,7 @@ void output_thread_info_defines(void) - DEFINE(_THREAD_SIZE, THREAD_SIZE); - DEFINE(_THREAD_MASK, THREAD_MASK); - DEFINE(_IRQ_STACK_SIZE, IRQ_STACK_SIZE); -+ DEFINE(_IRQ_STACK_START, IRQ_STACK_START); - BLANK(); - } - -diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S -index 619e30e2c4f0..bb72f3ce7e29 100644 ---- a/arch/mips/kernel/genex.S -+++ b/arch/mips/kernel/genex.S -@@ -216,9 +216,11 @@ NESTED(handle_int, PT_SIZE, sp) - beq t0, t1, 2f - - /* Switch to IRQ stack */ -- li t1, _IRQ_STACK_SIZE -+ li t1, _IRQ_STACK_START - PTR_ADD sp, t0, t1 - -+ /* Save task's sp on IRQ stack so that unwinding can follow it */ -+ LONG_S s1, 0(sp) - 2: - jal plat_irq_dispatch - -@@ -326,9 +328,11 @@ NESTED(except_vec_vi_handler, 0, sp) - beq t0, t1, 2f - - /* Switch to IRQ stack */ -- li t1, _IRQ_STACK_SIZE -+ li t1, _IRQ_STACK_START - PTR_ADD sp, t0, t1 - -+ /* Save task's sp on IRQ stack so that unwinding can follow it */ -+ LONG_S s1, 0(sp) - 2: - jalr v0 - -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 8c26ecac930d..477ba026c3e5 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -483,31 +483,52 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page, - unsigned long pc, - unsigned long *ra) - { -+ unsigned long low, high, irq_stack_high; - struct mips_frame_info info; - unsigned long size, ofs; -+ struct pt_regs *regs; - int leaf; -- extern void ret_from_irq(void); -- extern void ret_from_exception(void); - - if (!stack_page) - return 0; - - /* -- * If we reached the bottom of interrupt context, -- * return saved pc in pt_regs. -+ * IRQ stacks start at IRQ_STACK_START -+ * task stacks at THREAD_SIZE - 32 - */ -- if (pc == (unsigned long)ret_from_irq || -- pc == (unsigned long)ret_from_exception) { -- struct pt_regs *regs; -- if (*sp >= stack_page && -- *sp + sizeof(*regs) <= stack_page + THREAD_SIZE - 32) { -- regs = (struct pt_regs *)*sp; -- pc = regs->cp0_epc; -- if (!user_mode(regs) && __kernel_text_address(pc)) { -- *sp = regs->regs[29]; -- *ra = regs->regs[31]; -- return pc; -- } -+ low = stack_page; -+ if (!preemptible() && on_irq_stack(raw_smp_processor_id(), *sp)) { -+ high = stack_page + IRQ_STACK_START; -+ irq_stack_high = high; -+ } else { -+ high = stack_page + THREAD_SIZE - 32; -+ irq_stack_high = 0; -+ } -+ -+ /* -+ * If we reached the top of the interrupt stack, start unwinding -+ * the interrupted task stack. -+ */ -+ if (unlikely(*sp == irq_stack_high)) { -+ unsigned long task_sp = *(unsigned long *)*sp; -+ -+ /* -+ * Check that the pointer saved in the IRQ stack head points to -+ * something within the stack of the current task -+ */ -+ if (!object_is_on_stack((void *)task_sp)) -+ return 0; -+ -+ /* -+ * Follow pointer to tasks kernel stack frame where interrupted -+ * state was saved. -+ */ -+ regs = (struct pt_regs *)task_sp; -+ pc = regs->cp0_epc; -+ if (!user_mode(regs) && __kernel_text_address(pc)) { -+ *sp = regs->regs[29]; -+ *ra = regs->regs[31]; -+ return pc; - } - return 0; - } -@@ -528,8 +549,7 @@ unsigned long notrace unwind_stack_by_address(unsigned long stack_page, - if (leaf < 0) - return 0; - -- if (*sp < stack_page || -- *sp + info.frame_size > stack_page + THREAD_SIZE - 32) -+ if (*sp < low || *sp + info.frame_size > high) - return 0; - - if (leaf) -diff --git a/arch/mips/kernel/vmlinux.lds.S b/arch/mips/kernel/vmlinux.lds.S -index 0a93e83cd014..2026203c41e2 100644 ---- a/arch/mips/kernel/vmlinux.lds.S -+++ b/arch/mips/kernel/vmlinux.lds.S -@@ -159,7 +159,7 @@ SECTIONS - * Force .bss to 64K alignment so that .bss..swapper_pg_dir - * gets that alignment. .sbss should be empty, so there will be - * no holes after __init_end. */ -- BSS_SECTION(0, 0x10000, 0) -+ BSS_SECTION(0, 0x10000, 8) - - _end = . ; - -diff --git a/arch/mips/lantiq/xway/sysctrl.c b/arch/mips/lantiq/xway/sysctrl.c -index daf580ce5ca2..2528181232fd 100644 ---- a/arch/mips/lantiq/xway/sysctrl.c -+++ b/arch/mips/lantiq/xway/sysctrl.c -@@ -469,8 +469,8 @@ void __init ltq_soc_init(void) - panic("Failed to load xbar nodes from devicetree"); - if (of_address_to_resource(np_xbar, 0, &res_xbar)) - panic("Failed to get xbar resources"); -- if (request_mem_region(res_xbar.start, resource_size(&res_xbar), -- res_xbar.name) < 0) -+ if (!request_mem_region(res_xbar.start, resource_size(&res_xbar), -+ res_xbar.name)) - panic("Failed to get xbar resources"); - - ltq_xbar_membase = ioremap_nocache(res_xbar.start, -diff --git a/arch/mips/ralink/rt3883.c b/arch/mips/ralink/rt3883.c -index 3c575093f8f1..f2a6e1b8cce0 100644 ---- a/arch/mips/ralink/rt3883.c -+++ b/arch/mips/ralink/rt3883.c -@@ -144,5 +144,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info) - - rt2880_pinmux_data = rt3883_pinmux_data; - -- ralink_soc == RT3883_SOC; -+ ralink_soc = RT3883_SOC; - } -diff --git a/arch/parisc/kernel/perf.c b/arch/parisc/kernel/perf.c -index 518f4f5f1f43..d63d42533133 100644 ---- a/arch/parisc/kernel/perf.c -+++ b/arch/parisc/kernel/perf.c -@@ -39,7 +39,7 @@ - * the PDC INTRIGUE calls. This is done to eliminate bugs introduced - * in various PDC revisions. The code is much more maintainable - * and reliable this way vs having to debug on every version of PDC -- * on every box. -+ * on every box. - */ - - #include -@@ -195,8 +195,8 @@ static int perf_config(uint32_t *image_ptr); - static int perf_release(struct inode *inode, struct file *file); - static int perf_open(struct inode *inode, struct file *file); - static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t *ppos); --static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, -- loff_t *ppos); -+static ssize_t perf_write(struct file *file, const char __user *buf, -+ size_t count, loff_t *ppos); - static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg); - static void perf_start_counters(void); - static int perf_stop_counters(uint32_t *raddr); -@@ -222,7 +222,7 @@ extern void perf_intrigue_disable_perf_counters (void); - /* - * configure: - * -- * Configure the cpu with a given data image. First turn off the counters, -+ * Configure the cpu with a given data image. First turn off the counters, - * then download the image, then turn the counters back on. - */ - static int perf_config(uint32_t *image_ptr) -@@ -234,7 +234,7 @@ static int perf_config(uint32_t *image_ptr) - error = perf_stop_counters(raddr); - if (error != 0) { - printk("perf_config: perf_stop_counters = %ld\n", error); -- return -EINVAL; -+ return -EINVAL; - } - - printk("Preparing to write image\n"); -@@ -242,7 +242,7 @@ printk("Preparing to write image\n"); - error = perf_write_image((uint64_t *)image_ptr); - if (error != 0) { - printk("perf_config: DOWNLOAD = %ld\n", error); -- return -EINVAL; -+ return -EINVAL; - } - - printk("Preparing to start counters\n"); -@@ -254,7 +254,7 @@ printk("Preparing to start counters\n"); - } - - /* -- * Open the device and initialize all of its memory. The device is only -+ * Open the device and initialize all of its memory. The device is only - * opened once, but can be "queried" by multiple processes that know its - * file descriptor. - */ -@@ -298,8 +298,8 @@ static ssize_t perf_read(struct file *file, char __user *buf, size_t cnt, loff_t - * called on the processor that the download should happen - * on. - */ --static ssize_t perf_write(struct file *file, const char __user *buf, size_t count, -- loff_t *ppos) -+static ssize_t perf_write(struct file *file, const char __user *buf, -+ size_t count, loff_t *ppos) - { - int err; - size_t image_size; -@@ -307,11 +307,11 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun - uint32_t interface_type; - uint32_t test; - -- if (perf_processor_interface == ONYX_INTF) -+ if (perf_processor_interface == ONYX_INTF) - image_size = PCXU_IMAGE_SIZE; -- else if (perf_processor_interface == CUDA_INTF) -+ else if (perf_processor_interface == CUDA_INTF) - image_size = PCXW_IMAGE_SIZE; -- else -+ else - return -EFAULT; - - if (!capable(CAP_SYS_ADMIN)) -@@ -331,22 +331,22 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun - - /* First check the machine type is correct for - the requested image */ -- if (((perf_processor_interface == CUDA_INTF) && -- (interface_type != CUDA_INTF)) || -- ((perf_processor_interface == ONYX_INTF) && -- (interface_type != ONYX_INTF))) -+ if (((perf_processor_interface == CUDA_INTF) && -+ (interface_type != CUDA_INTF)) || -+ ((perf_processor_interface == ONYX_INTF) && -+ (interface_type != ONYX_INTF))) - return -EINVAL; - - /* Next check to make sure the requested image - is valid */ -- if (((interface_type == CUDA_INTF) && -+ if (((interface_type == CUDA_INTF) && - (test >= MAX_CUDA_IMAGES)) || -- ((interface_type == ONYX_INTF) && -- (test >= MAX_ONYX_IMAGES))) -+ ((interface_type == ONYX_INTF) && -+ (test >= MAX_ONYX_IMAGES))) - return -EINVAL; - - /* Copy the image into the processor */ -- if (interface_type == CUDA_INTF) -+ if (interface_type == CUDA_INTF) - return perf_config(cuda_images[test]); - else - return perf_config(onyx_images[test]); -@@ -360,7 +360,7 @@ static ssize_t perf_write(struct file *file, const char __user *buf, size_t coun - static void perf_patch_images(void) - { - #if 0 /* FIXME!! */ --/* -+/* - * NOTE: this routine is VERY specific to the current TLB image. - * If the image is changed, this routine might also need to be changed. - */ -@@ -368,9 +368,9 @@ static void perf_patch_images(void) - extern void $i_dtlb_miss_2_0(); - extern void PA2_0_iva(); - -- /* -+ /* - * We can only use the lower 32-bits, the upper 32-bits should be 0 -- * anyway given this is in the kernel -+ * anyway given this is in the kernel - */ - uint32_t itlb_addr = (uint32_t)&($i_itlb_miss_2_0); - uint32_t dtlb_addr = (uint32_t)&($i_dtlb_miss_2_0); -@@ -378,21 +378,21 @@ static void perf_patch_images(void) - - if (perf_processor_interface == ONYX_INTF) { - /* clear last 2 bytes */ -- onyx_images[TLBMISS][15] &= 0xffffff00; -+ onyx_images[TLBMISS][15] &= 0xffffff00; - /* set 2 bytes */ - onyx_images[TLBMISS][15] |= (0x000000ff&((dtlb_addr) >> 24)); - onyx_images[TLBMISS][16] = (dtlb_addr << 8)&0xffffff00; - onyx_images[TLBMISS][17] = itlb_addr; - - /* clear last 2 bytes */ -- onyx_images[TLBHANDMISS][15] &= 0xffffff00; -+ onyx_images[TLBHANDMISS][15] &= 0xffffff00; - /* set 2 bytes */ - onyx_images[TLBHANDMISS][15] |= (0x000000ff&((dtlb_addr) >> 24)); - onyx_images[TLBHANDMISS][16] = (dtlb_addr << 8)&0xffffff00; - onyx_images[TLBHANDMISS][17] = itlb_addr; - - /* clear last 2 bytes */ -- onyx_images[BIG_CPI][15] &= 0xffffff00; -+ onyx_images[BIG_CPI][15] &= 0xffffff00; - /* set 2 bytes */ - onyx_images[BIG_CPI][15] |= (0x000000ff&((dtlb_addr) >> 24)); - onyx_images[BIG_CPI][16] = (dtlb_addr << 8)&0xffffff00; -@@ -405,24 +405,24 @@ static void perf_patch_images(void) - - } else if (perf_processor_interface == CUDA_INTF) { - /* Cuda interface */ -- cuda_images[TLBMISS][16] = -+ cuda_images[TLBMISS][16] = - (cuda_images[TLBMISS][16]&0xffff0000) | - ((dtlb_addr >> 8)&0x0000ffff); -- cuda_images[TLBMISS][17] = -+ cuda_images[TLBMISS][17] = - ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff); - cuda_images[TLBMISS][18] = (itlb_addr << 16)&0xffff0000; - -- cuda_images[TLBHANDMISS][16] = -+ cuda_images[TLBHANDMISS][16] = - (cuda_images[TLBHANDMISS][16]&0xffff0000) | - ((dtlb_addr >> 8)&0x0000ffff); -- cuda_images[TLBHANDMISS][17] = -+ cuda_images[TLBHANDMISS][17] = - ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff); - cuda_images[TLBHANDMISS][18] = (itlb_addr << 16)&0xffff0000; - -- cuda_images[BIG_CPI][16] = -+ cuda_images[BIG_CPI][16] = - (cuda_images[BIG_CPI][16]&0xffff0000) | - ((dtlb_addr >> 8)&0x0000ffff); -- cuda_images[BIG_CPI][17] = -+ cuda_images[BIG_CPI][17] = - ((dtlb_addr << 24)&0xff000000) | ((itlb_addr >> 16)&0x000000ff); - cuda_images[BIG_CPI][18] = (itlb_addr << 16)&0xffff0000; - } else { -@@ -434,7 +434,7 @@ static void perf_patch_images(void) - - /* - * ioctl routine -- * All routines effect the processor that they are executed on. Thus you -+ * All routines effect the processor that they are executed on. Thus you - * must be running on the processor that you wish to change. - */ - -@@ -460,7 +460,7 @@ static long perf_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - } - - /* copy out the Counters */ -- if (copy_to_user((void __user *)arg, raddr, -+ if (copy_to_user((void __user *)arg, raddr, - sizeof (raddr)) != 0) { - error = -EFAULT; - break; -@@ -488,7 +488,7 @@ static const struct file_operations perf_fops = { - .open = perf_open, - .release = perf_release - }; -- -+ - static struct miscdevice perf_dev = { - MISC_DYNAMIC_MINOR, - PA_PERF_DEV, -@@ -596,7 +596,7 @@ static int perf_stop_counters(uint32_t *raddr) - /* OR sticky2 (bit 1496) to counter2 bit 32 */ - tmp64 |= (userbuf[23] >> 8) & 0x0000000080000000; - raddr[2] = (uint32_t)tmp64; -- -+ - /* Counter3 is bits 1497 to 1528 */ - tmp64 = (userbuf[23] >> 7) & 0x00000000ffffffff; - /* OR sticky3 (bit 1529) to counter3 bit 32 */ -@@ -618,7 +618,7 @@ static int perf_stop_counters(uint32_t *raddr) - userbuf[22] = 0; - userbuf[23] = 0; - -- /* -+ /* - * Write back the zeroed bytes + the image given - * the read was destructive. - */ -@@ -626,13 +626,13 @@ static int perf_stop_counters(uint32_t *raddr) - } else { - - /* -- * Read RDR-15 which contains the counters and sticky bits -+ * Read RDR-15 which contains the counters and sticky bits - */ - if (!perf_rdr_read_ubuf(15, userbuf)) { - return -13; - } - -- /* -+ /* - * Clear out the counters - */ - perf_rdr_clear(15); -@@ -645,7 +645,7 @@ static int perf_stop_counters(uint32_t *raddr) - raddr[2] = (uint32_t)((userbuf[1] >> 32) & 0x00000000ffffffffUL); - raddr[3] = (uint32_t)(userbuf[1] & 0x00000000ffffffffUL); - } -- -+ - return 0; - } - -@@ -683,7 +683,7 @@ static int perf_rdr_read_ubuf(uint32_t rdr_num, uint64_t *buffer) - i = tentry->num_words; - while (i--) { - buffer[i] = 0; -- } -+ } - - /* Check for bits an even number of 64 */ - if ((xbits = width & 0x03f) != 0) { -@@ -809,18 +809,22 @@ static int perf_write_image(uint64_t *memaddr) - } - - runway = ioremap_nocache(cpu_device->hpa.start, 4096); -+ if (!runway) { -+ pr_err("perf_write_image: ioremap failed!\n"); -+ return -ENOMEM; -+ } - - /* Merge intrigue bits into Runway STATUS 0 */ - tmp64 = __raw_readq(runway + RUNWAY_STATUS) & 0xffecfffffffffffful; -- __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul), -+ __raw_writeq(tmp64 | (*memaddr++ & 0x0013000000000000ul), - runway + RUNWAY_STATUS); -- -+ - /* Write RUNWAY DEBUG registers */ - for (i = 0; i < 8; i++) { - __raw_writeq(*memaddr++, runway + RUNWAY_DEBUG); - } - -- return 0; -+ return 0; - } - - /* -@@ -844,7 +848,7 @@ printk("perf_rdr_write\n"); - perf_rdr_shift_out_U(rdr_num, buffer[i]); - } else { - perf_rdr_shift_out_W(rdr_num, buffer[i]); -- } -+ } - } - printk("perf_rdr_write done\n"); - } -diff --git a/block/partitions/efi.c b/block/partitions/efi.c -index 26cb624ace05..d26d0d27f5fd 100644 ---- a/block/partitions/efi.c -+++ b/block/partitions/efi.c -@@ -293,7 +293,7 @@ static gpt_entry *alloc_read_gpt_entries(struct parsed_partitions *state, - if (!gpt) - return NULL; - -- count = le32_to_cpu(gpt->num_partition_entries) * -+ count = (size_t)le32_to_cpu(gpt->num_partition_entries) * - le32_to_cpu(gpt->sizeof_partition_entry); - if (!count) - return NULL; -@@ -352,7 +352,7 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba, - gpt_header **gpt, gpt_entry **ptes) - { - u32 crc, origcrc; -- u64 lastlba; -+ u64 lastlba, pt_size; - - if (!ptes) - return 0; -@@ -434,13 +434,20 @@ static int is_gpt_valid(struct parsed_partitions *state, u64 lba, - goto fail; - } - -+ /* Sanity check partition table size */ -+ pt_size = (u64)le32_to_cpu((*gpt)->num_partition_entries) * -+ le32_to_cpu((*gpt)->sizeof_partition_entry); -+ if (pt_size > KMALLOC_MAX_SIZE) { -+ pr_debug("GUID Partition Table is too large: %llu > %lu bytes\n", -+ (unsigned long long)pt_size, KMALLOC_MAX_SIZE); -+ goto fail; -+ } -+ - if (!(*ptes = alloc_read_gpt_entries(state, *gpt))) - goto fail; - - /* Check the GUID Partition Entry Array CRC */ -- crc = efi_crc32((const unsigned char *) (*ptes), -- le32_to_cpu((*gpt)->num_partition_entries) * -- le32_to_cpu((*gpt)->sizeof_partition_entry)); -+ crc = efi_crc32((const unsigned char *) (*ptes), pt_size); - - if (crc != le32_to_cpu((*gpt)->partition_entry_array_crc32)) { - pr_debug("GUID Partitition Entry Array CRC check failed.\n"); -diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c -index e2d94972962d..7aa10c200ecb 100644 ---- a/drivers/ata/libata-transport.c -+++ b/drivers/ata/libata-transport.c -@@ -224,7 +224,6 @@ static DECLARE_TRANSPORT_CLASS(ata_port_class, - - static void ata_tport_release(struct device *dev) - { -- put_device(dev->parent); - } - - /** -@@ -284,7 +283,7 @@ int ata_tport_add(struct device *parent, - device_initialize(dev); - dev->type = &ata_port_type; - -- dev->parent = get_device(parent); -+ dev->parent = parent; - dev->release = ata_tport_release; - dev_set_name(dev, "ata%d", ap->print_id); - transport_setup_device(dev); -@@ -348,7 +347,6 @@ static DECLARE_TRANSPORT_CLASS(ata_link_class, - - static void ata_tlink_release(struct device *dev) - { -- put_device(dev->parent); - } - - /** -@@ -410,7 +408,7 @@ int ata_tlink_add(struct ata_link *link) - int error; - - device_initialize(dev); -- dev->parent = get_device(&ap->tdev); -+ dev->parent = &ap->tdev; - dev->release = ata_tlink_release; - if (ata_is_host_link(link)) - dev_set_name(dev, "link%d", ap->print_id); -@@ -588,7 +586,6 @@ static DECLARE_TRANSPORT_CLASS(ata_dev_class, - - static void ata_tdev_release(struct device *dev) - { -- put_device(dev->parent); - } - - /** -@@ -661,7 +658,7 @@ static int ata_tdev_add(struct ata_device *ata_dev) - int error; - - device_initialize(dev); -- dev->parent = get_device(&link->tdev); -+ dev->parent = &link->tdev; - dev->release = ata_tdev_release; - if (ata_is_host_link(link)) - dev_set_name(dev, "dev%d.%d", ap->print_id,ata_dev->devno); -diff --git a/drivers/extcon/extcon-axp288.c b/drivers/extcon/extcon-axp288.c -index fd55c2f2080a..6c9d7ccebb8c 100644 ---- a/drivers/extcon/extcon-axp288.c -+++ b/drivers/extcon/extcon-axp288.c -@@ -168,7 +168,7 @@ static int axp288_handle_chrg_det_event(struct axp288_extcon_info *info) - return ret; - } - -- vbus_attach = (pwr_stat & PS_STAT_VBUS_PRESENT); -+ vbus_attach = (pwr_stat & PS_STAT_VBUS_VALID); - if (!vbus_attach) - goto notify_otg; - -diff --git a/drivers/firmware/psci.c b/drivers/firmware/psci.c -index d24f35d74b27..ae70d2485ca1 100644 ---- a/drivers/firmware/psci.c -+++ b/drivers/firmware/psci.c -@@ -424,7 +424,7 @@ out_put_node: - return err; - } - --static const struct of_device_id const psci_of_match[] __initconst = { -+static const struct of_device_id psci_of_match[] __initconst = { - { .compatible = "arm,psci", .data = psci_0_1_init}, - { .compatible = "arm,psci-0.2", .data = psci_0_2_init}, - { .compatible = "arm,psci-1.0", .data = psci_0_2_init}, -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_events.c b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -index b6e28dcaea1d..1fb1daa0b366 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_events.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_events.c -@@ -739,8 +739,10 @@ int kfd_wait_on_events(struct kfd_process *p, - struct kfd_event_data event_data; - - if (copy_from_user(&event_data, &events[i], -- sizeof(struct kfd_event_data))) -+ sizeof(struct kfd_event_data))) { -+ ret = -EFAULT; - goto fail; -+ } - - ret = init_event_waiter(p, &event_waiters[i], - event_data.event_id, i); -diff --git a/drivers/hwmon/gl520sm.c b/drivers/hwmon/gl520sm.c -index dee93ec87d02..84e0994aafdd 100644 ---- a/drivers/hwmon/gl520sm.c -+++ b/drivers/hwmon/gl520sm.c -@@ -208,11 +208,13 @@ static ssize_t get_cpu_vid(struct device *dev, struct device_attribute *attr, - } - static DEVICE_ATTR(cpu0_vid, S_IRUGO, get_cpu_vid, NULL); - --#define VDD_FROM_REG(val) (((val) * 95 + 2) / 4) --#define VDD_TO_REG(val) clamp_val((((val) * 4 + 47) / 95), 0, 255) -+#define VDD_FROM_REG(val) DIV_ROUND_CLOSEST((val) * 95, 4) -+#define VDD_CLAMP(val) clamp_val(val, 0, 255 * 95 / 4) -+#define VDD_TO_REG(val) DIV_ROUND_CLOSEST(VDD_CLAMP(val) * 4, 95) - --#define IN_FROM_REG(val) ((val) * 19) --#define IN_TO_REG(val) clamp_val((((val) + 9) / 19), 0, 255) -+#define IN_FROM_REG(val) ((val) * 19) -+#define IN_CLAMP(val) clamp_val(val, 0, 255 * 19) -+#define IN_TO_REG(val) DIV_ROUND_CLOSEST(IN_CLAMP(val), 19) - - static ssize_t get_in_input(struct device *dev, struct device_attribute *attr, - char *buf) -@@ -349,8 +351,13 @@ static SENSOR_DEVICE_ATTR(in4_max, S_IRUGO | S_IWUSR, - - #define DIV_FROM_REG(val) (1 << (val)) - #define FAN_FROM_REG(val, div) ((val) == 0 ? 0 : (480000 / ((val) << (div)))) --#define FAN_TO_REG(val, div) ((val) <= 0 ? 0 : \ -- clamp_val((480000 + ((val) << ((div)-1))) / ((val) << (div)), 1, 255)) -+ -+#define FAN_BASE(div) (480000 >> (div)) -+#define FAN_CLAMP(val, div) clamp_val(val, FAN_BASE(div) / 255, \ -+ FAN_BASE(div)) -+#define FAN_TO_REG(val, div) ((val) == 0 ? 0 : \ -+ DIV_ROUND_CLOSEST(480000, \ -+ FAN_CLAMP(val, div) << (div))) - - static ssize_t get_fan_input(struct device *dev, struct device_attribute *attr, - char *buf) -@@ -513,9 +520,9 @@ static SENSOR_DEVICE_ATTR(fan2_div, S_IRUGO | S_IWUSR, - static DEVICE_ATTR(fan1_off, S_IRUGO | S_IWUSR, - get_fan_off, set_fan_off); - --#define TEMP_FROM_REG(val) (((val) - 130) * 1000) --#define TEMP_TO_REG(val) clamp_val(((((val) < 0 ? \ -- (val) - 500 : (val) + 500) / 1000) + 130), 0, 255) -+#define TEMP_FROM_REG(val) (((val) - 130) * 1000) -+#define TEMP_CLAMP(val) clamp_val(val, -130000, 125000) -+#define TEMP_TO_REG(val) (DIV_ROUND_CLOSEST(TEMP_CLAMP(val), 1000) + 130) - - static ssize_t get_temp_input(struct device *dev, struct device_attribute *attr, - char *buf) -diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c -index 71d3929adf54..8d65f33af5da 100644 ---- a/drivers/i2c/busses/i2c-meson.c -+++ b/drivers/i2c/busses/i2c-meson.c -@@ -175,7 +175,7 @@ static void meson_i2c_put_data(struct meson_i2c *i2c, char *buf, int len) - wdata1 |= *buf++ << ((i - 4) * 8); - - writel(wdata0, i2c->regs + REG_TOK_WDATA0); -- writel(wdata0, i2c->regs + REG_TOK_WDATA1); -+ writel(wdata1, i2c->regs + REG_TOK_WDATA1); - - dev_dbg(i2c->dev, "%s: data %08x %08x len %d\n", __func__, - wdata0, wdata1, len); -diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c -index 0c904edd6c00..f684fe31f832 100644 ---- a/drivers/iio/adc/axp288_adc.c -+++ b/drivers/iio/adc/axp288_adc.c -@@ -28,8 +28,6 @@ - #include - - #define AXP288_ADC_EN_MASK 0xF1 --#define AXP288_ADC_TS_PIN_GPADC 0xF2 --#define AXP288_ADC_TS_PIN_ON 0xF3 - - enum axp288_adc_id { - AXP288_ADC_TS, -@@ -123,16 +121,6 @@ static int axp288_adc_read_channel(int *val, unsigned long address, - return IIO_VAL_INT; - } - --static int axp288_adc_set_ts(struct regmap *regmap, unsigned int mode, -- unsigned long address) --{ -- /* channels other than GPADC do not need to switch TS pin */ -- if (address != AXP288_GP_ADC_H) -- return 0; -- -- return regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, mode); --} -- - static int axp288_adc_read_raw(struct iio_dev *indio_dev, - struct iio_chan_spec const *chan, - int *val, int *val2, long mask) -@@ -143,16 +131,7 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev, - mutex_lock(&indio_dev->mlock); - switch (mask) { - case IIO_CHAN_INFO_RAW: -- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_GPADC, -- chan->address)) { -- dev_err(&indio_dev->dev, "GPADC mode\n"); -- ret = -EINVAL; -- break; -- } - ret = axp288_adc_read_channel(val, chan->address, info->regmap); -- if (axp288_adc_set_ts(info->regmap, AXP288_ADC_TS_PIN_ON, -- chan->address)) -- dev_err(&indio_dev->dev, "TS pin restore\n"); - break; - default: - ret = -EINVAL; -@@ -162,15 +141,6 @@ static int axp288_adc_read_raw(struct iio_dev *indio_dev, - return ret; - } - --static int axp288_adc_set_state(struct regmap *regmap) --{ -- /* ADC should be always enabled for internal FG to function */ -- if (regmap_write(regmap, AXP288_ADC_TS_PIN_CTRL, AXP288_ADC_TS_PIN_ON)) -- return -EIO; -- -- return regmap_write(regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); --} -- - static const struct iio_info axp288_adc_iio_info = { - .read_raw = &axp288_adc_read_raw, - .driver_module = THIS_MODULE, -@@ -199,7 +169,7 @@ static int axp288_adc_probe(struct platform_device *pdev) - * Set ADC to enabled state at all time, including system suspend. - * otherwise internal fuel gauge functionality may be affected. - */ -- ret = axp288_adc_set_state(axp20x->regmap); -+ ret = regmap_write(info->regmap, AXP20X_ADC_EN1, AXP288_ADC_EN_MASK); - if (ret) { - dev_err(&pdev->dev, "unable to enable ADC device\n"); - return ret; -diff --git a/drivers/infiniband/hw/qib/qib_iba7322.c b/drivers/infiniband/hw/qib/qib_iba7322.c -index 6c8ff10101c0..77cc77ba998f 100644 ---- a/drivers/infiniband/hw/qib/qib_iba7322.c -+++ b/drivers/infiniband/hw/qib/qib_iba7322.c -@@ -7097,7 +7097,7 @@ static void qib_7322_txchk_change(struct qib_devdata *dd, u32 start, - unsigned long flags; - - while (wait) { -- unsigned long shadow; -+ unsigned long shadow = 0; - int cstart, previ = -1; - - /* -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c -index 6699ecd855f0..bad76eed06b3 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_main.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c -@@ -1239,7 +1239,7 @@ static void __ipoib_reap_neigh(struct ipoib_dev_priv *priv) - rcu_dereference_protected(neigh->hnext, - lockdep_is_held(&priv->lock))); - /* remove from path/mc list */ -- list_del(&neigh->list); -+ list_del_init(&neigh->list); - call_rcu(&neigh->rcu, ipoib_neigh_reclaim); - } else { - np = &neigh->hnext; -@@ -1406,7 +1406,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh) - rcu_dereference_protected(neigh->hnext, - lockdep_is_held(&priv->lock))); - /* remove from parent list */ -- list_del(&neigh->list); -+ list_del_init(&neigh->list); - call_rcu(&neigh->rcu, ipoib_neigh_reclaim); - return; - } else { -@@ -1491,7 +1491,7 @@ void ipoib_del_neighs_by_gid(struct net_device *dev, u8 *gid) - rcu_dereference_protected(neigh->hnext, - lockdep_is_held(&priv->lock))); - /* remove from parent list */ -- list_del(&neigh->list); -+ list_del_init(&neigh->list); - call_rcu(&neigh->rcu, ipoib_neigh_reclaim); - } else { - np = &neigh->hnext; -@@ -1533,7 +1533,7 @@ static void ipoib_flush_neighs(struct ipoib_dev_priv *priv) - rcu_dereference_protected(neigh->hnext, - lockdep_is_held(&priv->lock))); - /* remove from path/mc list */ -- list_del(&neigh->list); -+ list_del_init(&neigh->list); - call_rcu(&neigh->rcu, ipoib_neigh_reclaim); - } - } -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -index 57a34f87dedf..9b47a437d6c9 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c -@@ -160,11 +160,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey) - out: - up_write(&ppriv->vlan_rwsem); - -+ rtnl_unlock(); -+ - if (result) - free_netdev(priv->dev); - -- rtnl_unlock(); -- - return result; - } - -@@ -185,7 +185,6 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey) - list_for_each_entry_safe(priv, tpriv, &ppriv->child_intfs, list) { - if (priv->pkey == pkey && - priv->child_type == IPOIB_LEGACY_CHILD) { -- unregister_netdevice(priv->dev); - list_del(&priv->list); - dev = priv->dev; - break; -@@ -193,6 +192,11 @@ int ipoib_vlan_delete(struct net_device *pdev, unsigned short pkey) - } - up_write(&ppriv->vlan_rwsem); - -+ if (dev) { -+ ipoib_dbg(ppriv, "delete child vlan %s\n", dev->name); -+ unregister_netdevice(dev); -+ } -+ - rtnl_unlock(); - - if (dev) { -diff --git a/drivers/iommu/io-pgtable-arm.c b/drivers/iommu/io-pgtable-arm.c -index dad768caa9c5..18751b1dfd3d 100644 ---- a/drivers/iommu/io-pgtable-arm.c -+++ b/drivers/iommu/io-pgtable-arm.c -@@ -335,8 +335,12 @@ static int __arm_lpae_map(struct arm_lpae_io_pgtable *data, unsigned long iova, - if (cfg->quirks & IO_PGTABLE_QUIRK_ARM_NS) - pte |= ARM_LPAE_PTE_NSTABLE; - __arm_lpae_set_pte(ptep, pte, cfg); -- } else { -+ } else if (!iopte_leaf(pte, lvl)) { - cptep = iopte_deref(pte, data); -+ } else { -+ /* We require an unmap first */ -+ WARN_ON(!selftest_running); -+ return -EEXIST; - } - - /* Rinse, repeat */ -diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index e5ee4e9e0ea5..a8a86d450d76 100644 ---- a/drivers/md/raid10.c -+++ b/drivers/md/raid10.c -@@ -1414,11 +1414,24 @@ retry_write: - mbio->bi_private = r10_bio; - - atomic_inc(&r10_bio->remaining); -+ -+ cb = blk_check_plugged(raid10_unplug, mddev, -+ sizeof(*plug)); -+ if (cb) -+ plug = container_of(cb, struct raid10_plug_cb, -+ cb); -+ else -+ plug = NULL; - spin_lock_irqsave(&conf->device_lock, flags); -- bio_list_add(&conf->pending_bio_list, mbio); -- conf->pending_count++; -+ if (plug) { -+ bio_list_add(&plug->pending, mbio); -+ plug->pending_cnt++; -+ } else { -+ bio_list_add(&conf->pending_bio_list, mbio); -+ conf->pending_count++; -+ } - spin_unlock_irqrestore(&conf->device_lock, flags); -- if (!mddev_check_plugged(mddev)) -+ if (!plug) - md_wakeup_thread(mddev->thread); - } - } -diff --git a/drivers/media/pci/ttpci/av7110_hw.c b/drivers/media/pci/ttpci/av7110_hw.c -index 300bd3c94738..0992bb0e207e 100644 ---- a/drivers/media/pci/ttpci/av7110_hw.c -+++ b/drivers/media/pci/ttpci/av7110_hw.c -@@ -56,11 +56,11 @@ - by Nathan Laredo */ - - int av7110_debiwrite(struct av7110 *av7110, u32 config, -- int addr, u32 val, int count) -+ int addr, u32 val, unsigned int count) - { - struct saa7146_dev *dev = av7110->dev; - -- if (count <= 0 || count > 32764) { -+ if (count > 32764) { - printk("%s: invalid count %d\n", __func__, count); - return -1; - } -@@ -78,12 +78,12 @@ int av7110_debiwrite(struct av7110 *av7110, u32 config, - return 0; - } - --u32 av7110_debiread(struct av7110 *av7110, u32 config, int addr, int count) -+u32 av7110_debiread(struct av7110 *av7110, u32 config, int addr, unsigned int count) - { - struct saa7146_dev *dev = av7110->dev; - u32 result = 0; - -- if (count > 32764 || count <= 0) { -+ if (count > 32764) { - printk("%s: invalid count %d\n", __func__, count); - return 0; - } -diff --git a/drivers/media/pci/ttpci/av7110_hw.h b/drivers/media/pci/ttpci/av7110_hw.h -index 1634aba5cb84..ccb148059406 100644 ---- a/drivers/media/pci/ttpci/av7110_hw.h -+++ b/drivers/media/pci/ttpci/av7110_hw.h -@@ -377,14 +377,14 @@ extern int av7110_fw_request(struct av7110 *av7110, u16 *request_buf, - - /* DEBI (saa7146 data extension bus interface) access */ - extern int av7110_debiwrite(struct av7110 *av7110, u32 config, -- int addr, u32 val, int count); -+ int addr, u32 val, unsigned int count); - extern u32 av7110_debiread(struct av7110 *av7110, u32 config, -- int addr, int count); -+ int addr, unsigned int count); - - - /* DEBI during interrupt */ - /* single word writes */ --static inline void iwdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count) -+static inline void iwdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count) - { - av7110_debiwrite(av7110, config, addr, val, count); - } -@@ -397,7 +397,7 @@ static inline void mwdebi(struct av7110 *av7110, u32 config, int addr, - av7110_debiwrite(av7110, config, addr, 0, count); - } - --static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count) -+static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count) - { - u32 res; - -@@ -408,7 +408,7 @@ static inline u32 irdebi(struct av7110 *av7110, u32 config, int addr, u32 val, i - } - - /* DEBI outside interrupts, only for count <= 4! */ --static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count) -+static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count) - { - unsigned long flags; - -@@ -417,7 +417,7 @@ static inline void wdebi(struct av7110 *av7110, u32 config, int addr, u32 val, i - spin_unlock_irqrestore(&av7110->debilock, flags); - } - --static inline u32 rdebi(struct av7110 *av7110, u32 config, int addr, u32 val, int count) -+static inline u32 rdebi(struct av7110 *av7110, u32 config, int addr, u32 val, unsigned int count) - { - unsigned long flags; - u32 res; -diff --git a/drivers/media/platform/exynos-gsc/gsc-core.c b/drivers/media/platform/exynos-gsc/gsc-core.c -index 9b9e423e4fc4..15c543d4b366 100644 ---- a/drivers/media/platform/exynos-gsc/gsc-core.c -+++ b/drivers/media/platform/exynos-gsc/gsc-core.c -@@ -849,9 +849,7 @@ int gsc_prepare_addr(struct gsc_ctx *ctx, struct vb2_buffer *vb, - - if ((frame->fmt->pixelformat == V4L2_PIX_FMT_VYUY) || - (frame->fmt->pixelformat == V4L2_PIX_FMT_YVYU) || -- (frame->fmt->pixelformat == V4L2_PIX_FMT_NV61) || - (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420) || -- (frame->fmt->pixelformat == V4L2_PIX_FMT_NV21) || - (frame->fmt->pixelformat == V4L2_PIX_FMT_YVU420M)) - swap(addr->cb, addr->cr); - -diff --git a/drivers/mmc/core/sdio_bus.c b/drivers/mmc/core/sdio_bus.c -index 7e327a6dd53d..c23bc4f331bd 100644 ---- a/drivers/mmc/core/sdio_bus.c -+++ b/drivers/mmc/core/sdio_bus.c -@@ -266,7 +266,7 @@ static void sdio_release_func(struct device *dev) - sdio_free_func_cis(func); - - kfree(func->info); -- -+ kfree(func->tmpbuf); - kfree(func); - } - -@@ -281,6 +281,16 @@ struct sdio_func *sdio_alloc_func(struct mmc_card *card) - if (!func) - return ERR_PTR(-ENOMEM); - -+ /* -+ * allocate buffer separately to make sure it's properly aligned for -+ * DMA usage (incl. 64 bit DMA) -+ */ -+ func->tmpbuf = kmalloc(4, GFP_KERNEL); -+ if (!func->tmpbuf) { -+ kfree(func); -+ return ERR_PTR(-ENOMEM); -+ } -+ - func->card = card; - - device_initialize(&func->dev); -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index fa3b4cbea23b..a481ea64e287 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -7658,6 +7658,11 @@ static pci_ers_result_t igb_io_slot_reset(struct pci_dev *pdev) - pci_enable_wake(pdev, PCI_D3hot, 0); - pci_enable_wake(pdev, PCI_D3cold, 0); - -+ /* In case of PCI error, adapter lose its HW address -+ * so we should re-assign it here. -+ */ -+ hw->hw_addr = adapter->io_addr; -+ - igb_reset(adapter); - wr32(E1000_WUS, ~0); - result = PCI_ERS_RESULT_RECOVERED; -diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h -index 72fcfc924589..0d18be0fed8e 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.h -+++ b/drivers/net/ethernet/renesas/sh_eth.h -@@ -339,7 +339,7 @@ enum FELIC_MODE_BIT { - ECMR_DPAD = 0x00200000, ECMR_RZPF = 0x00100000, - ECMR_ZPF = 0x00080000, ECMR_PFR = 0x00040000, ECMR_RXF = 0x00020000, - ECMR_TXF = 0x00010000, ECMR_MCT = 0x00002000, ECMR_PRCEF = 0x00001000, -- ECMR_PMDE = 0x00000200, ECMR_RE = 0x00000040, ECMR_TE = 0x00000020, -+ ECMR_MPDE = 0x00000200, ECMR_RE = 0x00000040, ECMR_TE = 0x00000020, - ECMR_RTM = 0x00000010, ECMR_ILB = 0x00000008, ECMR_ELB = 0x00000004, - ECMR_DM = 0x00000002, ECMR_PRM = 0x00000001, - }; -diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c -index a5f392ae30d5..61cd53838360 100644 ---- a/drivers/net/team/team.c -+++ b/drivers/net/team/team.c -@@ -2343,8 +2343,10 @@ start_again: - - hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI, - TEAM_CMD_OPTIONS_GET); -- if (!hdr) -+ if (!hdr) { -+ nlmsg_free(skb); - return -EMSGSIZE; -+ } - - if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex)) - goto nla_put_failure; -@@ -2611,8 +2613,10 @@ start_again: - - hdr = genlmsg_put(skb, portid, seq, &team_nl_family, flags | NLM_F_MULTI, - TEAM_CMD_PORT_LIST_GET); -- if (!hdr) -+ if (!hdr) { -+ nlmsg_free(skb); - return -EMSGSIZE; -+ } - - if (nla_put_u32(skb, TEAM_ATTR_TEAM_IFINDEX, team->dev->ifindex)) - goto nla_put_failure; -diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig -index 7f83504dfa69..1f6893ebce16 100644 ---- a/drivers/net/usb/Kconfig -+++ b/drivers/net/usb/Kconfig -@@ -364,7 +364,7 @@ config USB_NET_NET1080 - optionally with LEDs that indicate traffic - - config USB_NET_PLUSB -- tristate "Prolific PL-2301/2302/25A1 based cables" -+ tristate "Prolific PL-2301/2302/25A1/27A1 based cables" - # if the handshake/init/reset problems, from original 'plusb', - # are ever resolved ... then remove "experimental" - depends on USB_USBNET -diff --git a/drivers/net/usb/plusb.c b/drivers/net/usb/plusb.c -index 1bfe0fcaccf5..7c02231c1a1b 100644 ---- a/drivers/net/usb/plusb.c -+++ b/drivers/net/usb/plusb.c -@@ -102,7 +102,7 @@ static int pl_reset(struct usbnet *dev) - } - - static const struct driver_info prolific_info = { -- .description = "Prolific PL-2301/PL-2302/PL-25A1", -+ .description = "Prolific PL-2301/PL-2302/PL-25A1/PL-27A1", - .flags = FLAG_POINTTOPOINT | FLAG_NO_SETINT, - /* some PL-2302 versions seem to fail usb_set_interface() */ - .reset = pl_reset, -@@ -139,6 +139,17 @@ static const struct usb_device_id products [] = { - * Host-to-Host Cable - */ - .driver_info = (unsigned long) &prolific_info, -+ -+}, -+ -+/* super speed cables */ -+{ -+ USB_DEVICE(0x067b, 0x27a1), /* PL-27A1, no eeprom -+ * also: goobay Active USB 3.0 -+ * Data Link, -+ * Unitek Y-3501 -+ */ -+ .driver_info = (unsigned long) &prolific_info, - }, - - { }, // END -@@ -158,5 +169,5 @@ static struct usb_driver plusb_driver = { - module_usb_driver(plusb_driver); - - MODULE_AUTHOR("David Brownell"); --MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1 USB Host to Host Link Driver"); -+MODULE_DESCRIPTION("Prolific PL-2301/2302/25A1/27A1 USB Host to Host Link Driver"); - MODULE_LICENSE("GPL"); -diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c -index 0f82c0b146f6..e04b57f79df8 100644 ---- a/drivers/tty/goldfish.c -+++ b/drivers/tty/goldfish.c -@@ -293,7 +293,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) - return 0; - - err_tty_register_device_failed: -- free_irq(irq, pdev); -+ free_irq(irq, qtty); - err_request_irq_failed: - goldfish_tty_current_line_count--; - if (goldfish_tty_current_line_count == 0) -diff --git a/drivers/usb/chipidea/otg.c b/drivers/usb/chipidea/otg.c -index 0cf149edddd8..f36a1ac3bfbd 100644 ---- a/drivers/usb/chipidea/otg.c -+++ b/drivers/usb/chipidea/otg.c -@@ -134,9 +134,9 @@ void ci_handle_vbus_change(struct ci_hdrc *ci) - if (!ci->is_otg) - return; - -- if (hw_read_otgsc(ci, OTGSC_BSV)) -+ if (hw_read_otgsc(ci, OTGSC_BSV) && !ci->vbus_active) - usb_gadget_vbus_connect(&ci->gadget); -- else -+ else if (!hw_read_otgsc(ci, OTGSC_BSV) && ci->vbus_active) - usb_gadget_vbus_disconnect(&ci->gadget); - } - -@@ -175,14 +175,21 @@ static void ci_handle_id_switch(struct ci_hdrc *ci) - - ci_role_stop(ci); - -- if (role == CI_ROLE_GADGET) -+ if (role == CI_ROLE_GADGET && -+ IS_ERR(ci->platdata->vbus_extcon.edev)) - /* -- * wait vbus lower than OTGSC_BSV before connecting -- * to host -+ * Wait vbus lower than OTGSC_BSV before connecting -+ * to host. If connecting status is from an external -+ * connector instead of register, we don't need to -+ * care vbus on the board, since it will not affect -+ * external connector status. - */ - hw_wait_vbus_lower_bsv(ci); - - ci_role_start(ci, role); -+ /* vbus change may have already occurred */ -+ if (role == CI_ROLE_GADGET) -+ ci_handle_vbus_change(ci); - } - } - /** -diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c -index e56cdb436de3..4581fa1dec98 100644 ---- a/drivers/usb/serial/mos7720.c -+++ b/drivers/usb/serial/mos7720.c -@@ -234,11 +234,16 @@ static int read_mos_reg(struct usb_serial *serial, unsigned int serial_portnum, - - status = usb_control_msg(usbdev, pipe, request, requesttype, value, - index, buf, 1, MOS_WDR_TIMEOUT); -- if (status == 1) -+ if (status == 1) { - *data = *buf; -- else if (status < 0) -+ } else { - dev_err(&usbdev->dev, - "mos7720: usb_control_msg() failed: %d\n", status); -+ if (status >= 0) -+ status = -EIO; -+ *data = 0; -+ } -+ - kfree(buf); - - return status; -diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c -index d17685cc00c9..ed883a7ad533 100644 ---- a/drivers/usb/serial/mos7840.c -+++ b/drivers/usb/serial/mos7840.c -@@ -285,9 +285,15 @@ static int mos7840_get_reg_sync(struct usb_serial_port *port, __u16 reg, - ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, - MCS_RD_RTYPE, 0, reg, buf, VENDOR_READ_LENGTH, - MOS_WDR_TIMEOUT); -+ if (ret < VENDOR_READ_LENGTH) { -+ if (ret >= 0) -+ ret = -EIO; -+ goto out; -+ } -+ - *val = buf[0]; - dev_dbg(&port->dev, "%s offset is %x, return val %x\n", __func__, reg, *val); -- -+out: - kfree(buf); - return ret; - } -@@ -353,8 +359,13 @@ static int mos7840_get_uart_reg(struct usb_serial_port *port, __u16 reg, - ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), MCS_RDREQ, - MCS_RD_RTYPE, Wval, reg, buf, VENDOR_READ_LENGTH, - MOS_WDR_TIMEOUT); -+ if (ret < VENDOR_READ_LENGTH) { -+ if (ret >= 0) -+ ret = -EIO; -+ goto out; -+ } - *val = buf[0]; -- -+out: - kfree(buf); - return ret; - } -@@ -1490,10 +1501,10 @@ static int mos7840_tiocmget(struct tty_struct *tty) - return -ENODEV; - - status = mos7840_get_uart_reg(port, MODEM_STATUS_REGISTER, &msr); -- if (status != 1) -+ if (status < 0) - return -EIO; - status = mos7840_get_uart_reg(port, MODEM_CONTROL_REGISTER, &mcr); -- if (status != 1) -+ if (status < 0) - return -EIO; - result = ((mcr & MCR_DTR) ? TIOCM_DTR : 0) - | ((mcr & MCR_RTS) ? TIOCM_RTS : 0) -diff --git a/fs/gfs2/glock.c b/fs/gfs2/glock.c -index ff36f5475d7e..09a0cf5f3dd8 100644 ---- a/fs/gfs2/glock.c -+++ b/fs/gfs2/glock.c -@@ -1798,16 +1798,18 @@ void gfs2_glock_exit(void) - - static void gfs2_glock_iter_next(struct gfs2_glock_iter *gi) - { -- do { -- gi->gl = rhashtable_walk_next(&gi->hti); -+ while ((gi->gl = rhashtable_walk_next(&gi->hti))) { - if (IS_ERR(gi->gl)) { - if (PTR_ERR(gi->gl) == -EAGAIN) - continue; - gi->gl = NULL; -+ return; - } -- /* Skip entries for other sb and dead entries */ -- } while ((gi->gl) && ((gi->sdp != gi->gl->gl_name.ln_sbd) || -- __lockref_is_dead(&gi->gl->gl_lockref))); -+ /* Skip entries for other sb and dead entries */ -+ if (gi->sdp == gi->gl->gl_name.ln_sbd && -+ !__lockref_is_dead(&gi->gl->gl_lockref)) -+ return; -+ } - } - - static void *gfs2_glock_seq_start(struct seq_file *seq, loff_t *pos) -diff --git a/fs/xfs/kmem.c b/fs/xfs/kmem.c -index 686ba6fb20dd..8067364c602f 100644 ---- a/fs/xfs/kmem.c -+++ b/fs/xfs/kmem.c -@@ -24,24 +24,6 @@ - #include "kmem.h" - #include "xfs_message.h" - --/* -- * Greedy allocation. May fail and may return vmalloced memory. -- */ --void * --kmem_zalloc_greedy(size_t *size, size_t minsize, size_t maxsize) --{ -- void *ptr; -- size_t kmsize = maxsize; -- -- while (!(ptr = vzalloc(kmsize))) { -- if ((kmsize >>= 1) <= minsize) -- kmsize = minsize; -- } -- if (ptr) -- *size = kmsize; -- return ptr; --} -- - void * - kmem_alloc(size_t size, xfs_km_flags_t flags) - { -diff --git a/fs/xfs/kmem.h b/fs/xfs/kmem.h -index cc6b768fc068..ae45f77ce33b 100644 ---- a/fs/xfs/kmem.h -+++ b/fs/xfs/kmem.h -@@ -69,8 +69,6 @@ static inline void kmem_free(const void *ptr) - } - - --extern void *kmem_zalloc_greedy(size_t *, size_t, size_t); -- - static inline void * - kmem_zalloc(size_t size, xfs_km_flags_t flags) - { -diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c -index 930ebd86beba..99a4891c00ab 100644 ---- a/fs/xfs/xfs_itable.c -+++ b/fs/xfs/xfs_itable.c -@@ -351,7 +351,6 @@ xfs_bulkstat( - xfs_agino_t agino; /* inode # in allocation group */ - xfs_agnumber_t agno; /* allocation group number */ - xfs_btree_cur_t *cur; /* btree cursor for ialloc btree */ -- size_t irbsize; /* size of irec buffer in bytes */ - xfs_inobt_rec_incore_t *irbuf; /* start of irec buffer */ - int nirbuf; /* size of irbuf */ - int ubcount; /* size of user's buffer */ -@@ -378,11 +377,10 @@ xfs_bulkstat( - *ubcountp = 0; - *done = 0; - -- irbuf = kmem_zalloc_greedy(&irbsize, PAGE_SIZE, PAGE_SIZE * 4); -+ irbuf = kmem_zalloc_large(PAGE_SIZE * 4, KM_SLEEP); - if (!irbuf) - return -ENOMEM; -- -- nirbuf = irbsize / sizeof(*irbuf); -+ nirbuf = (PAGE_SIZE * 4) / sizeof(*irbuf); - - /* - * Loop over the allocation groups, starting from the last -diff --git a/include/linux/audit.h b/include/linux/audit.h -index 20eba1eb0a3c..faac391badac 100644 ---- a/include/linux/audit.h -+++ b/include/linux/audit.h -@@ -281,6 +281,20 @@ static inline int audit_socketcall(int nargs, unsigned long *args) - return __audit_socketcall(nargs, args); - return 0; - } -+ -+static inline int audit_socketcall_compat(int nargs, u32 *args) -+{ -+ unsigned long a[AUDITSC_ARGS]; -+ int i; -+ -+ if (audit_dummy_context()) -+ return 0; -+ -+ for (i = 0; i < nargs; i++) -+ a[i] = (unsigned long)args[i]; -+ return __audit_socketcall(nargs, a); -+} -+ - static inline int audit_sockaddr(int len, void *addr) - { - if (unlikely(!audit_dummy_context())) -@@ -407,6 +421,12 @@ static inline int audit_socketcall(int nargs, unsigned long *args) - { - return 0; - } -+ -+static inline int audit_socketcall_compat(int nargs, u32 *args) -+{ -+ return 0; -+} -+ - static inline void audit_fd_pair(int fd1, int fd2) - { } - static inline int audit_sockaddr(int len, void *addr) -diff --git a/include/linux/mmc/sdio_func.h b/include/linux/mmc/sdio_func.h -index aab032a6ae61..97ca105347a6 100644 ---- a/include/linux/mmc/sdio_func.h -+++ b/include/linux/mmc/sdio_func.h -@@ -53,7 +53,7 @@ struct sdio_func { - unsigned int state; /* function state */ - #define SDIO_STATE_PRESENT (1<<0) /* present in sysfs */ - -- u8 tmpbuf[4]; /* DMA:able scratch buffer */ -+ u8 *tmpbuf; /* DMA:able scratch buffer */ - - unsigned num_info; /* number of info strings */ - const char **info; /* info strings */ -diff --git a/include/uapi/drm/drm_fourcc.h b/include/uapi/drm/drm_fourcc.h -index 0b69a7753558..f28f79966e9e 100644 ---- a/include/uapi/drm/drm_fourcc.h -+++ b/include/uapi/drm/drm_fourcc.h -@@ -150,6 +150,7 @@ - - /* Vendor Ids: */ - #define DRM_FORMAT_MOD_NONE 0 -+#define DRM_FORMAT_MOD_VENDOR_NONE 0 - #define DRM_FORMAT_MOD_VENDOR_INTEL 0x01 - #define DRM_FORMAT_MOD_VENDOR_AMD 0x02 - #define DRM_FORMAT_MOD_VENDOR_NV 0x03 -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index ff8bb41d713f..a1f697ec4fc2 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -1073,11 +1073,14 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev, - spin_unlock_bh(&br->lock); - } - -- err = br_changelink(dev, tb, data); -+ err = register_netdevice(dev); - if (err) - return err; - -- return register_netdevice(dev); -+ err = br_changelink(dev, tb, data); -+ if (err) -+ unregister_netdevice(dev); -+ return err; - } - - static size_t br_get_size(const struct net_device *brdev) -diff --git a/net/compat.c b/net/compat.c -index 5cfd26a0006f..0ccf3ecf6bbb 100644 ---- a/net/compat.c -+++ b/net/compat.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -767,14 +768,24 @@ COMPAT_SYSCALL_DEFINE5(recvmmsg, int, fd, struct compat_mmsghdr __user *, mmsg, - - COMPAT_SYSCALL_DEFINE2(socketcall, int, call, u32 __user *, args) - { -- int ret; -- u32 a[6]; -+ u32 a[AUDITSC_ARGS]; -+ unsigned int len; - u32 a0, a1; -+ int ret; - - if (call < SYS_SOCKET || call > SYS_SENDMMSG) - return -EINVAL; -- if (copy_from_user(a, args, nas[call])) -+ len = nas[call]; -+ if (len > sizeof(a)) -+ return -EINVAL; -+ -+ if (copy_from_user(a, args, len)) - return -EFAULT; -+ -+ ret = audit_socketcall_compat(len / sizeof(a[0]), a); -+ if (ret) -+ return ret; -+ - a0 = a[0]; - a1 = a[1]; - -diff --git a/net/core/dev.c b/net/core/dev.c -index 24d243084aab..dac52fa60f25 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2338,6 +2338,9 @@ void __dev_kfree_skb_irq(struct sk_buff *skb, enum skb_free_reason reason) - { - unsigned long flags; - -+ if (unlikely(!skb)) -+ return; -+ - if (likely(atomic_read(&skb->users) == 1)) { - smp_rmb(); - atomic_set(&skb->users, 0); -diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c -index ddb894ac1458..2689c9c4f1a0 100644 ---- a/net/ipv4/netfilter/nf_nat_snmp_basic.c -+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c -@@ -1304,6 +1304,7 @@ static int __init nf_nat_snmp_basic_init(void) - static void __exit nf_nat_snmp_basic_fini(void) - { - RCU_INIT_POINTER(nf_nat_snmp_hook, NULL); -+ synchronize_rcu(); - nf_conntrack_helper_unregister(&snmp_trap_helper); - } - -diff --git a/net/netfilter/nf_conntrack_ecache.c b/net/netfilter/nf_conntrack_ecache.c -index 4e78c57b818f..f3b92ce463b0 100644 ---- a/net/netfilter/nf_conntrack_ecache.c -+++ b/net/netfilter/nf_conntrack_ecache.c -@@ -200,6 +200,7 @@ void nf_conntrack_unregister_notifier(struct net *net, - BUG_ON(notify != new); - RCU_INIT_POINTER(net->ct.nf_conntrack_event_cb, NULL); - mutex_unlock(&nf_ct_ecache_mutex); -+ /* synchronize_rcu() is called from ctnetlink_exit. */ - } - EXPORT_SYMBOL_GPL(nf_conntrack_unregister_notifier); - -@@ -236,6 +237,7 @@ void nf_ct_expect_unregister_notifier(struct net *net, - BUG_ON(notify != new); - RCU_INIT_POINTER(net->ct.nf_expect_event_cb, NULL); - mutex_unlock(&nf_ct_ecache_mutex); -+ /* synchronize_rcu() is called from ctnetlink_exit. */ - } - EXPORT_SYMBOL_GPL(nf_ct_expect_unregister_notifier); - -diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c -index e565b2becb14..660939df7c94 100644 ---- a/net/netfilter/nf_conntrack_netlink.c -+++ b/net/netfilter/nf_conntrack_netlink.c -@@ -3415,6 +3415,7 @@ static void __exit ctnetlink_exit(void) - #ifdef CONFIG_NETFILTER_NETLINK_GLUE_CT - RCU_INIT_POINTER(nfnl_ct_hook, NULL); - #endif -+ synchronize_rcu(); - } - - module_init(ctnetlink_init); -diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c -index 06a9f45771ab..44516c90118a 100644 ---- a/net/netfilter/nf_nat_core.c -+++ b/net/netfilter/nf_nat_core.c -@@ -892,6 +892,8 @@ static void __exit nf_nat_cleanup(void) - #ifdef CONFIG_XFRM - RCU_INIT_POINTER(nf_nat_decode_session_hook, NULL); - #endif -+ synchronize_rcu(); -+ - for (i = 0; i < NFPROTO_NUMPROTO; i++) - kfree(nf_nat_l4protos[i]); - synchronize_net(); -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index 54330fb5efaf..6d10002d23f8 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -161,6 +161,7 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, - int i, ret; - struct nf_conntrack_expect_policy *expect_policy; - struct nlattr *tb[NFCTH_POLICY_SET_MAX+1]; -+ unsigned int class_max; - - ret = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr, - nfnl_cthelper_expect_policy_set); -@@ -170,19 +171,18 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, - if (!tb[NFCTH_POLICY_SET_NUM]) - return -EINVAL; - -- helper->expect_class_max = -- ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); -- -- if (helper->expect_class_max != 0 && -- helper->expect_class_max > NF_CT_MAX_EXPECT_CLASSES) -+ class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); -+ if (class_max == 0) -+ return -EINVAL; -+ if (class_max > NF_CT_MAX_EXPECT_CLASSES) - return -EOVERFLOW; - - expect_policy = kzalloc(sizeof(struct nf_conntrack_expect_policy) * -- helper->expect_class_max, GFP_KERNEL); -+ class_max, GFP_KERNEL); - if (expect_policy == NULL) - return -ENOMEM; - -- for (i=0; iexpect_class_max; i++) { -+ for (i = 0; i < class_max; i++) { - if (!tb[NFCTH_POLICY_SET+i]) - goto err; - -@@ -191,6 +191,8 @@ nfnl_cthelper_parse_expect_policy(struct nf_conntrack_helper *helper, - if (ret < 0) - goto err; - } -+ -+ helper->expect_class_max = class_max - 1; - helper->expect_policy = expect_policy; - return 0; - err: -@@ -377,10 +379,10 @@ nfnl_cthelper_dump_policy(struct sk_buff *skb, - goto nla_put_failure; - - if (nla_put_be32(skb, NFCTH_POLICY_SET_NUM, -- htonl(helper->expect_class_max))) -+ htonl(helper->expect_class_max + 1))) - goto nla_put_failure; - -- for (i=0; iexpect_class_max; i++) { -+ for (i = 0; i < helper->expect_class_max + 1; i++) { - nest_parms2 = nla_nest_start(skb, - (NFCTH_POLICY_SET+i) | NLA_F_NESTED); - if (nest_parms2 == NULL) -diff --git a/net/netfilter/nfnetlink_cttimeout.c b/net/netfilter/nfnetlink_cttimeout.c -index c7a2d0e1c462..ed9153bd7e73 100644 ---- a/net/netfilter/nfnetlink_cttimeout.c -+++ b/net/netfilter/nfnetlink_cttimeout.c -@@ -611,8 +611,8 @@ static void __exit cttimeout_exit(void) - #ifdef CONFIG_NF_CONNTRACK_TIMEOUT - RCU_INIT_POINTER(nf_ct_timeout_find_get_hook, NULL); - RCU_INIT_POINTER(nf_ct_timeout_put_hook, NULL); -+ synchronize_rcu(); - #endif /* CONFIG_NF_CONNTRACK_TIMEOUT */ -- rcu_barrier(); - } - - module_init(cttimeout_init); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 148ec130d99d..b70055fc30cb 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -3802,6 +3802,8 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - case PACKET_HDRLEN: - if (len > sizeof(int)) - len = sizeof(int); -+ if (len < sizeof(int)) -+ return -EINVAL; - if (copy_from_user(&val, optval, len)) - return -EFAULT; - switch (val) { -diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c -index da5a7fb98c77..a6f5b3d21571 100644 ---- a/net/rds/ib_cm.c -+++ b/net/rds/ib_cm.c -@@ -381,7 +381,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - ret = PTR_ERR(ic->i_send_cq); - ic->i_send_cq = NULL; - rdsdebug("ib_create_cq send failed: %d\n", ret); -- goto out; -+ goto rds_ibdev_out; - } - - cq_attr.cqe = ic->i_recv_ring.w_nr; -@@ -392,19 +392,19 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - ret = PTR_ERR(ic->i_recv_cq); - ic->i_recv_cq = NULL; - rdsdebug("ib_create_cq recv failed: %d\n", ret); -- goto out; -+ goto send_cq_out; - } - - ret = ib_req_notify_cq(ic->i_send_cq, IB_CQ_NEXT_COMP); - if (ret) { - rdsdebug("ib_req_notify_cq send failed: %d\n", ret); -- goto out; -+ goto recv_cq_out; - } - - ret = ib_req_notify_cq(ic->i_recv_cq, IB_CQ_SOLICITED); - if (ret) { - rdsdebug("ib_req_notify_cq recv failed: %d\n", ret); -- goto out; -+ goto recv_cq_out; - } - - /* XXX negotiate max send/recv with remote? */ -@@ -428,7 +428,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - ret = rdma_create_qp(ic->i_cm_id, ic->i_pd, &attr); - if (ret) { - rdsdebug("rdma_create_qp failed: %d\n", ret); -- goto out; -+ goto recv_cq_out; - } - - ic->i_send_hdrs = ib_dma_alloc_coherent(dev, -@@ -438,7 +438,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - if (!ic->i_send_hdrs) { - ret = -ENOMEM; - rdsdebug("ib_dma_alloc_coherent send failed\n"); -- goto out; -+ goto qp_out; - } - - ic->i_recv_hdrs = ib_dma_alloc_coherent(dev, -@@ -448,7 +448,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - if (!ic->i_recv_hdrs) { - ret = -ENOMEM; - rdsdebug("ib_dma_alloc_coherent recv failed\n"); -- goto out; -+ goto send_hdrs_dma_out; - } - - ic->i_ack = ib_dma_alloc_coherent(dev, sizeof(struct rds_header), -@@ -456,7 +456,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - if (!ic->i_ack) { - ret = -ENOMEM; - rdsdebug("ib_dma_alloc_coherent ack failed\n"); -- goto out; -+ goto recv_hdrs_dma_out; - } - - ic->i_sends = vzalloc_node(ic->i_send_ring.w_nr * sizeof(struct rds_ib_send_work), -@@ -464,7 +464,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - if (!ic->i_sends) { - ret = -ENOMEM; - rdsdebug("send allocation failed\n"); -- goto out; -+ goto ack_dma_out; - } - - ic->i_recvs = vzalloc_node(ic->i_recv_ring.w_nr * sizeof(struct rds_ib_recv_work), -@@ -472,7 +472,7 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - if (!ic->i_recvs) { - ret = -ENOMEM; - rdsdebug("recv allocation failed\n"); -- goto out; -+ goto sends_out; - } - - rds_ib_recv_init_ack(ic); -@@ -480,8 +480,33 @@ static int rds_ib_setup_qp(struct rds_connection *conn) - rdsdebug("conn %p pd %p cq %p %p\n", conn, ic->i_pd, - ic->i_send_cq, ic->i_recv_cq); - --out: -+ return ret; -+ -+sends_out: -+ vfree(ic->i_sends); -+ack_dma_out: -+ ib_dma_free_coherent(dev, sizeof(struct rds_header), -+ ic->i_ack, ic->i_ack_dma); -+recv_hdrs_dma_out: -+ ib_dma_free_coherent(dev, ic->i_recv_ring.w_nr * -+ sizeof(struct rds_header), -+ ic->i_recv_hdrs, ic->i_recv_hdrs_dma); -+send_hdrs_dma_out: -+ ib_dma_free_coherent(dev, ic->i_send_ring.w_nr * -+ sizeof(struct rds_header), -+ ic->i_send_hdrs, ic->i_send_hdrs_dma); -+qp_out: -+ rdma_destroy_qp(ic->i_cm_id); -+recv_cq_out: -+ if (!ib_destroy_cq(ic->i_recv_cq)) -+ ic->i_recv_cq = NULL; -+send_cq_out: -+ if (!ib_destroy_cq(ic->i_send_cq)) -+ ic->i_send_cq = NULL; -+rds_ibdev_out: -+ rds_ib_remove_conn(rds_ibdev, conn); - rds_ib_dev_put(rds_ibdev); -+ - return ret; - } - -diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c -index eac30bf486d7..094e2a12860a 100644 ---- a/net/rds/ib_send.c -+++ b/net/rds/ib_send.c -@@ -68,16 +68,6 @@ static void rds_ib_send_complete(struct rds_message *rm, - complete(rm, notify_status); - } - --static void rds_ib_send_unmap_data(struct rds_ib_connection *ic, -- struct rm_data_op *op, -- int wc_status) --{ -- if (op->op_nents) -- ib_dma_unmap_sg(ic->i_cm_id->device, -- op->op_sg, op->op_nents, -- DMA_TO_DEVICE); --} -- - static void rds_ib_send_unmap_rdma(struct rds_ib_connection *ic, - struct rm_rdma_op *op, - int wc_status) -@@ -138,6 +128,21 @@ static void rds_ib_send_unmap_atomic(struct rds_ib_connection *ic, - rds_ib_stats_inc(s_ib_atomic_fadd); - } - -+static void rds_ib_send_unmap_data(struct rds_ib_connection *ic, -+ struct rm_data_op *op, -+ int wc_status) -+{ -+ struct rds_message *rm = container_of(op, struct rds_message, data); -+ -+ if (op->op_nents) -+ ib_dma_unmap_sg(ic->i_cm_id->device, -+ op->op_sg, op->op_nents, -+ DMA_TO_DEVICE); -+ -+ if (rm->rdma.op_active && rm->data.op_notify) -+ rds_ib_send_unmap_rdma(ic, &rm->rdma, wc_status); -+} -+ - /* - * Unmap the resources associated with a struct send_work. - * -diff --git a/net/rds/rdma.c b/net/rds/rdma.c -index 4c93badeabf2..8d3a851a3476 100644 ---- a/net/rds/rdma.c -+++ b/net/rds/rdma.c -@@ -626,6 +626,16 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm, - } - op->op_notifier->n_user_token = args->user_token; - op->op_notifier->n_status = RDS_RDMA_SUCCESS; -+ -+ /* Enable rmda notification on data operation for composite -+ * rds messages and make sure notification is enabled only -+ * for the data operation which follows it so that application -+ * gets notified only after full message gets delivered. -+ */ -+ if (rm->data.op_sg) { -+ rm->rdma.op_notify = 0; -+ rm->data.op_notify = !!(args->flags & RDS_RDMA_NOTIFY_ME); -+ } - } - - /* The cookie contains the R_Key of the remote memory region, and -diff --git a/net/rds/rds.h b/net/rds/rds.h -index 0e2797bdc316..4588860f4c3b 100644 ---- a/net/rds/rds.h -+++ b/net/rds/rds.h -@@ -378,6 +378,7 @@ struct rds_message { - } rdma; - struct rm_data_op { - unsigned int op_active:1; -+ unsigned int op_notify:1; - unsigned int op_nents; - unsigned int op_count; - unsigned int op_dmasg; -diff --git a/net/rds/send.c b/net/rds/send.c -index c9cdb358ea88..6815f03324d7 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -467,12 +467,14 @@ void rds_rdma_send_complete(struct rds_message *rm, int status) - struct rm_rdma_op *ro; - struct rds_notifier *notifier; - unsigned long flags; -+ unsigned int notify = 0; - - spin_lock_irqsave(&rm->m_rs_lock, flags); - -+ notify = rm->rdma.op_notify | rm->data.op_notify; - ro = &rm->rdma; - if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) && -- ro->op_active && ro->op_notify && ro->op_notifier) { -+ ro->op_active && notify && ro->op_notifier) { - notifier = ro->op_notifier; - rs = rm->m_rs; - sock_hold(rds_rs_to_sk(rs)); -diff --git a/sound/pci/au88x0/au88x0_core.c b/sound/pci/au88x0/au88x0_core.c -index d3125c169684..065a69cf6118 100644 ---- a/sound/pci/au88x0/au88x0_core.c -+++ b/sound/pci/au88x0/au88x0_core.c -@@ -2279,6 +2279,9 @@ vortex_adb_allocroute(vortex_t *vortex, int dma, int nr_ch, int dir, - } else { - int src[2], mix[2]; - -+ if (nr_ch < 1) -+ return -EINVAL; -+ - /* Get SRC and MIXER hardware resources. */ - for (i = 0; i < nr_ch; i++) { - if ((mix[i] = -diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c -index b8a256dfed7e..6a438a361592 100644 ---- a/sound/soc/soc-dapm.c -+++ b/sound/soc/soc-dapm.c -@@ -358,6 +358,10 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget, - snd_soc_dapm_new_control_unlocked(widget->dapm, - &template); - kfree(name); -+ if (IS_ERR(data->widget)) { -+ ret = PTR_ERR(data->widget); -+ goto err_data; -+ } - if (!data->widget) { - ret = -ENOMEM; - goto err_data; -@@ -392,6 +396,10 @@ static int dapm_kcontrol_data_alloc(struct snd_soc_dapm_widget *widget, - data->widget = snd_soc_dapm_new_control_unlocked( - widget->dapm, &template); - kfree(name); -+ if (IS_ERR(data->widget)) { -+ ret = PTR_ERR(data->widget); -+ goto err_data; -+ } - if (!data->widget) { - ret = -ENOMEM; - goto err_data; -@@ -3278,11 +3286,22 @@ snd_soc_dapm_new_control(struct snd_soc_dapm_context *dapm, - - mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); - w = snd_soc_dapm_new_control_unlocked(dapm, widget); -+ /* Do not nag about probe deferrals */ -+ if (IS_ERR(w)) { -+ int ret = PTR_ERR(w); -+ -+ if (ret != -EPROBE_DEFER) -+ dev_err(dapm->dev, -+ "ASoC: Failed to create DAPM control %s (%d)\n", -+ widget->name, ret); -+ goto out_unlock; -+ } - if (!w) - dev_err(dapm->dev, - "ASoC: Failed to create DAPM control %s\n", - widget->name); - -+out_unlock: - mutex_unlock(&dapm->card->dapm_mutex); - return w; - } -@@ -3304,6 +3323,8 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm, - w->regulator = devm_regulator_get(dapm->dev, w->name); - if (IS_ERR(w->regulator)) { - ret = PTR_ERR(w->regulator); -+ if (ret == -EPROBE_DEFER) -+ return ERR_PTR(ret); - dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n", - w->name, ret); - return NULL; -@@ -3322,6 +3343,8 @@ snd_soc_dapm_new_control_unlocked(struct snd_soc_dapm_context *dapm, - w->clk = devm_clk_get(dapm->dev, w->name); - if (IS_ERR(w->clk)) { - ret = PTR_ERR(w->clk); -+ if (ret == -EPROBE_DEFER) -+ return ERR_PTR(ret); - dev_err(dapm->dev, "ASoC: Failed to request %s: %d\n", - w->name, ret); - return NULL; -@@ -3435,6 +3458,16 @@ int snd_soc_dapm_new_controls(struct snd_soc_dapm_context *dapm, - mutex_lock_nested(&dapm->card->dapm_mutex, SND_SOC_DAPM_CLASS_INIT); - for (i = 0; i < num; i++) { - w = snd_soc_dapm_new_control_unlocked(dapm, widget); -+ if (IS_ERR(w)) { -+ ret = PTR_ERR(w); -+ /* Do not nag about probe deferrals */ -+ if (ret == -EPROBE_DEFER) -+ break; -+ dev_err(dapm->dev, -+ "ASoC: Failed to create DAPM control %s (%d)\n", -+ widget->name, ret); -+ break; -+ } - if (!w) { - dev_err(dapm->dev, - "ASoC: Failed to create DAPM control %s\n", -@@ -3701,6 +3734,15 @@ int snd_soc_dapm_new_pcm(struct snd_soc_card *card, - dev_dbg(card->dev, "ASoC: adding %s widget\n", link_name); - - w = snd_soc_dapm_new_control_unlocked(&card->dapm, &template); -+ if (IS_ERR(w)) { -+ ret = PTR_ERR(w); -+ /* Do not nag about probe deferrals */ -+ if (ret != -EPROBE_DEFER) -+ dev_err(card->dev, -+ "ASoC: Failed to create %s widget (%d)\n", -+ link_name, ret); -+ goto outfree_kcontrol_news; -+ } - if (!w) { - dev_err(card->dev, "ASoC: Failed to create %s widget\n", - link_name); -@@ -3752,6 +3794,16 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm, - template.name); - - w = snd_soc_dapm_new_control_unlocked(dapm, &template); -+ if (IS_ERR(w)) { -+ int ret = PTR_ERR(w); -+ -+ /* Do not nag about probe deferrals */ -+ if (ret != -EPROBE_DEFER) -+ dev_err(dapm->dev, -+ "ASoC: Failed to create %s widget (%d)\n", -+ dai->driver->playback.stream_name, ret); -+ return ret; -+ } - if (!w) { - dev_err(dapm->dev, "ASoC: Failed to create %s widget\n", - dai->driver->playback.stream_name); -@@ -3771,6 +3823,16 @@ int snd_soc_dapm_new_dai_widgets(struct snd_soc_dapm_context *dapm, - template.name); - - w = snd_soc_dapm_new_control_unlocked(dapm, &template); -+ if (IS_ERR(w)) { -+ int ret = PTR_ERR(w); -+ -+ /* Do not nag about probe deferrals */ -+ if (ret != -EPROBE_DEFER) -+ dev_err(dapm->dev, -+ "ASoC: Failed to create %s widget (%d)\n", -+ dai->driver->playback.stream_name, ret); -+ return ret; -+ } - if (!w) { - dev_err(dapm->dev, "ASoC: Failed to create %s widget\n", - dai->driver->capture.stream_name); -diff --git a/sound/soc/soc-topology.c b/sound/soc/soc-topology.c -index 70396d3f6472..e3f34a86413c 100644 ---- a/sound/soc/soc-topology.c -+++ b/sound/soc/soc-topology.c -@@ -1481,6 +1481,15 @@ widget: - widget = snd_soc_dapm_new_control(dapm, &template); - else - widget = snd_soc_dapm_new_control_unlocked(dapm, &template); -+ if (IS_ERR(widget)) { -+ ret = PTR_ERR(widget); -+ /* Do not nag about probe deferrals */ -+ if (ret != -EPROBE_DEFER) -+ dev_err(tplg->dev, -+ "ASoC: failed to create widget %s controls (%d)\n", -+ w->name, ret); -+ goto hdr_err; -+ } - if (widget == NULL) { - dev_err(tplg->dev, "ASoC: failed to create widget %s controls\n", - w->name); diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.91-92.patch b/patch/kernel/mvebu64-default/03-patch-4.4.91-92.patch deleted file mode 100644 index 3605876f78a5..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.91-92.patch +++ /dev/null @@ -1,1750 +0,0 @@ -diff --git a/Makefile b/Makefile -index c1db50ef7fb5..fab2d640a27e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 91 -+SUBLEVEL = 92 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/base/platform.c b/drivers/base/platform.c -index cb4ad6e98b28..065fcc4be263 100644 ---- a/drivers/base/platform.c -+++ b/drivers/base/platform.c -@@ -809,7 +809,8 @@ static ssize_t driver_override_store(struct device *dev, - struct platform_device *pdev = to_platform_device(dev); - char *driver_override, *old, *cp; - -- if (count > PATH_MAX) -+ /* We need to keep extra room for a newline */ -+ if (count >= (PAGE_SIZE - 1)) - return -EINVAL; - - driver_override = kstrndup(buf, count, GFP_KERNEL); -diff --git a/drivers/gpu/drm/i915/intel_bios.c b/drivers/gpu/drm/i915/intel_bios.c -index d14bdc537587..0a2ac3efd04e 100644 ---- a/drivers/gpu/drm/i915/intel_bios.c -+++ b/drivers/gpu/drm/i915/intel_bios.c -@@ -957,6 +957,13 @@ static void parse_ddi_port(struct drm_i915_private *dev_priv, enum port port, - is_hdmi = is_dvi && (child->common.device_type & DEVICE_TYPE_NOT_HDMI_OUTPUT) == 0; - is_edp = is_dp && (child->common.device_type & DEVICE_TYPE_INTERNAL_CONNECTOR); - -+ if (port == PORT_A && is_dvi) { -+ DRM_DEBUG_KMS("VBT claims port A supports DVI%s, ignoring\n", -+ is_hdmi ? "/HDMI" : ""); -+ is_dvi = false; -+ is_hdmi = false; -+ } -+ - info->supports_dvi = is_dvi; - info->supports_hdmi = is_hdmi; - info->supports_dp = is_dp; -diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c -index d4d655a10df1..312aa1e33fb2 100644 ---- a/drivers/hid/i2c-hid/i2c-hid.c -+++ b/drivers/hid/i2c-hid/i2c-hid.c -@@ -540,7 +540,8 @@ static int i2c_hid_alloc_buffers(struct i2c_hid *ihid, size_t report_size) - { - /* the worst case is computed from the set_report command with a - * reportID > 15 and the maximum report length */ -- int args_len = sizeof(__u8) + /* optional ReportID byte */ -+ int args_len = sizeof(__u8) + /* ReportID */ -+ sizeof(__u8) + /* optional ReportID byte */ - sizeof(__u16) + /* data register */ - sizeof(__u16) + /* size of the report */ - report_size; /* report */ -diff --git a/drivers/hv/hv_fcopy.c b/drivers/hv/hv_fcopy.c -index 1fb02dcbc500..12dcbd8226f2 100644 ---- a/drivers/hv/hv_fcopy.c -+++ b/drivers/hv/hv_fcopy.c -@@ -155,6 +155,10 @@ static void fcopy_send_data(struct work_struct *dummy) - out_src = smsg_out; - break; - -+ case WRITE_TO_FILE: -+ out_src = fcopy_transaction.fcopy_msg; -+ out_len = sizeof(struct hv_do_fcopy); -+ break; - default: - out_src = fcopy_transaction.fcopy_msg; - out_len = fcopy_transaction.recv_len; -diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c -index b6445d9e5453..d2dff159a471 100644 ---- a/drivers/hwtracing/stm/core.c -+++ b/drivers/hwtracing/stm/core.c -@@ -952,7 +952,7 @@ void stm_source_unregister_device(struct stm_source_data *data) - - stm_source_link_drop(src); - -- device_destroy(&stm_source_class, src->dev.devt); -+ device_unregister(&src->dev); - } - EXPORT_SYMBOL_GPL(stm_source_unregister_device); - -diff --git a/drivers/iio/adc/ad7793.c b/drivers/iio/adc/ad7793.c -index 4d960d3b93c0..91d34ed756ea 100644 ---- a/drivers/iio/adc/ad7793.c -+++ b/drivers/iio/adc/ad7793.c -@@ -257,7 +257,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, - unsigned int vref_mv) - { - struct ad7793_state *st = iio_priv(indio_dev); -- int i, ret = -1; -+ int i, ret; - unsigned long long scale_uv; - u32 id; - -@@ -266,7 +266,7 @@ static int ad7793_setup(struct iio_dev *indio_dev, - return ret; - - /* reset the serial interface */ -- ret = spi_write(st->sd.spi, (u8 *)&ret, sizeof(ret)); -+ ret = ad_sd_reset(&st->sd, 32); - if (ret < 0) - goto out; - usleep_range(500, 2000); /* Wait for at least 500us */ -diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c -index d10bd0c97233..22c4c17cd996 100644 ---- a/drivers/iio/adc/ad_sigma_delta.c -+++ b/drivers/iio/adc/ad_sigma_delta.c -@@ -177,6 +177,34 @@ out: - } - EXPORT_SYMBOL_GPL(ad_sd_read_reg); - -+/** -+ * ad_sd_reset() - Reset the serial interface -+ * -+ * @sigma_delta: The sigma delta device -+ * @reset_length: Number of SCLKs with DIN = 1 -+ * -+ * Returns 0 on success, an error code otherwise. -+ **/ -+int ad_sd_reset(struct ad_sigma_delta *sigma_delta, -+ unsigned int reset_length) -+{ -+ uint8_t *buf; -+ unsigned int size; -+ int ret; -+ -+ size = DIV_ROUND_UP(reset_length, 8); -+ buf = kcalloc(size, sizeof(*buf), GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ -+ memset(buf, 0xff, size); -+ ret = spi_write(sigma_delta->spi, buf, size); -+ kfree(buf); -+ -+ return ret; -+} -+EXPORT_SYMBOL_GPL(ad_sd_reset); -+ - static int ad_sd_calibrate(struct ad_sigma_delta *sigma_delta, - unsigned int mode, unsigned int channel) - { -diff --git a/drivers/iio/adc/mcp320x.c b/drivers/iio/adc/mcp320x.c -index 8569c8e1f4b2..ad2681acce9a 100644 ---- a/drivers/iio/adc/mcp320x.c -+++ b/drivers/iio/adc/mcp320x.c -@@ -17,6 +17,8 @@ - * MCP3204 - * MCP3208 - * ------------ -+ * 13 bit converter -+ * MCP3301 - * - * Datasheet can be found here: - * http://ww1.microchip.com/downloads/en/DeviceDoc/21293C.pdf mcp3001 -@@ -96,7 +98,7 @@ static int mcp320x_channel_to_tx_data(int device_index, - } - - static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, -- bool differential, int device_index) -+ bool differential, int device_index, int *val) - { - int ret; - -@@ -117,19 +119,25 @@ static int mcp320x_adc_conversion(struct mcp320x *adc, u8 channel, - - switch (device_index) { - case mcp3001: -- return (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); -+ *val = (adc->rx_buf[0] << 5 | adc->rx_buf[1] >> 3); -+ return 0; - case mcp3002: - case mcp3004: - case mcp3008: -- return (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); -+ *val = (adc->rx_buf[0] << 2 | adc->rx_buf[1] >> 6); -+ return 0; - case mcp3201: -- return (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); -+ *val = (adc->rx_buf[0] << 7 | adc->rx_buf[1] >> 1); -+ return 0; - case mcp3202: - case mcp3204: - case mcp3208: -- return (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); -+ *val = (adc->rx_buf[0] << 4 | adc->rx_buf[1] >> 4); -+ return 0; - case mcp3301: -- return sign_extend32((adc->rx_buf[0] & 0x1f) << 8 | adc->rx_buf[1], 12); -+ *val = sign_extend32((adc->rx_buf[0] & 0x1f) << 8 -+ | adc->rx_buf[1], 12); -+ return 0; - default: - return -EINVAL; - } -@@ -150,12 +158,10 @@ static int mcp320x_read_raw(struct iio_dev *indio_dev, - switch (mask) { - case IIO_CHAN_INFO_RAW: - ret = mcp320x_adc_conversion(adc, channel->address, -- channel->differential, device_index); -- -+ channel->differential, device_index, val); - if (ret < 0) - goto out; - -- *val = ret; - ret = IIO_VAL_INT; - break; - -@@ -304,6 +310,7 @@ static int mcp320x_probe(struct spi_device *spi) - indio_dev->name = spi_get_device_id(spi)->name; - indio_dev->modes = INDIO_DIRECT_MODE; - indio_dev->info = &mcp320x_info; -+ spi_set_drvdata(spi, indio_dev); - - chip_info = &mcp320x_chip_infos[spi_get_device_id(spi)->driver_data]; - indio_dev->channels = chip_info->channels; -diff --git a/drivers/iio/adc/twl4030-madc.c b/drivers/iio/adc/twl4030-madc.c -index 0c74869a540a..7ffc5db4d7ee 100644 ---- a/drivers/iio/adc/twl4030-madc.c -+++ b/drivers/iio/adc/twl4030-madc.c -@@ -866,8 +866,10 @@ static int twl4030_madc_probe(struct platform_device *pdev) - - /* Enable 3v1 bias regulator for MADC[3:6] */ - madc->usb3v1 = devm_regulator_get(madc->dev, "vusb3v1"); -- if (IS_ERR(madc->usb3v1)) -- return -ENODEV; -+ if (IS_ERR(madc->usb3v1)) { -+ ret = -ENODEV; -+ goto err_i2c; -+ } - - ret = regulator_enable(madc->usb3v1); - if (ret) -@@ -876,11 +878,13 @@ static int twl4030_madc_probe(struct platform_device *pdev) - ret = iio_device_register(iio_dev); - if (ret) { - dev_err(&pdev->dev, "could not register iio device\n"); -- goto err_i2c; -+ goto err_usb3v1; - } - - return 0; - -+err_usb3v1: -+ regulator_disable(madc->usb3v1); - err_i2c: - twl4030_madc_set_current_generator(madc, 0, 0); - err_current_generator: -diff --git a/drivers/iio/industrialio-core.c b/drivers/iio/industrialio-core.c -index 131b434af994..e08a3c794120 100644 ---- a/drivers/iio/industrialio-core.c -+++ b/drivers/iio/industrialio-core.c -@@ -221,8 +221,10 @@ static ssize_t iio_debugfs_read_reg(struct file *file, char __user *userbuf, - ret = indio_dev->info->debugfs_reg_access(indio_dev, - indio_dev->cached_reg_addr, - 0, &val); -- if (ret) -+ if (ret) { - dev_err(indio_dev->dev.parent, "%s: read failed\n", __func__); -+ return ret; -+ } - - len = snprintf(buf, sizeof(buf), "0x%X\n", val); - -diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c -index c2ea4e5666fb..9710cf71054a 100644 ---- a/drivers/net/usb/usbnet.c -+++ b/drivers/net/usb/usbnet.c -@@ -1990,6 +1990,10 @@ int cdc_parse_cdc_header(struct usb_cdc_parsed_header *hdr, - elength = 1; - goto next_desc; - } -+ if ((buflen < elength) || (elength < 3)) { -+ dev_err(&intf->dev, "invalid descriptor buffer length\n"); -+ break; -+ } - if (buffer[1] != USB_DT_CS_INTERFACE) { - dev_err(&intf->dev, "skipping garbage\n"); - goto next_desc; -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -index da5826d788d6..f18491cf793c 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -@@ -876,7 +876,7 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, - - eth_broadcast_addr(params_le->bssid); - params_le->bss_type = DOT11_BSSTYPE_ANY; -- params_le->scan_type = 0; -+ params_le->scan_type = BRCMF_SCANTYPE_ACTIVE; - params_le->channel_num = 0; - params_le->nprobes = cpu_to_le32(-1); - params_le->active_time = cpu_to_le32(-1); -@@ -884,12 +884,9 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, - params_le->home_time = cpu_to_le32(-1); - memset(¶ms_le->ssid_le, 0, sizeof(params_le->ssid_le)); - -- /* if request is null exit so it will be all channel broadcast scan */ -- if (!request) -- return; -- - n_ssids = request->n_ssids; - n_channels = request->n_channels; -+ - /* Copy channel array if applicable */ - brcmf_dbg(SCAN, "### List of channelspecs to scan ### %d\n", - n_channels); -@@ -926,16 +923,8 @@ static void brcmf_escan_prep(struct brcmf_cfg80211_info *cfg, - ptr += sizeof(ssid_le); - } - } else { -- brcmf_dbg(SCAN, "Broadcast scan %p\n", request->ssids); -- if ((request->ssids) && request->ssids->ssid_len) { -- brcmf_dbg(SCAN, "SSID %s len=%d\n", -- params_le->ssid_le.SSID, -- request->ssids->ssid_len); -- params_le->ssid_le.SSID_len = -- cpu_to_le32(request->ssids->ssid_len); -- memcpy(¶ms_le->ssid_le.SSID, request->ssids->ssid, -- request->ssids->ssid_len); -- } -+ brcmf_dbg(SCAN, "Performing passive scan\n"); -+ params_le->scan_type = BRCMF_SCANTYPE_PASSIVE; - } - /* Adding mask to channel numbers */ - params_le->channel_num = -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -index daa427b46712..4320c4cae53e 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -+++ b/drivers/net/wireless/brcm80211/brcmfmac/fwil_types.h -@@ -45,6 +45,11 @@ - #define BRCMF_SCAN_PARAMS_COUNT_MASK 0x0000ffff - #define BRCMF_SCAN_PARAMS_NSSID_SHIFT 16 - -+/* scan type definitions */ -+#define BRCMF_SCANTYPE_DEFAULT 0xFF -+#define BRCMF_SCANTYPE_ACTIVE 0 -+#define BRCMF_SCANTYPE_PASSIVE 1 -+ - /* primary (ie tx) key */ - #define BRCMF_PRIMARY_KEY (1 << 1) - #define DOT11_BSSTYPE_ANY 2 -diff --git a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c -index d82984912e04..95b82cc132e6 100644 ---- a/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c -+++ b/drivers/net/wireless/iwlwifi/iwl-nvm-parse.c -@@ -73,6 +73,7 @@ - /* NVM offsets (in words) definitions */ - enum wkp_nvm_offsets { - /* NVM HW-Section offset (in words) definitions */ -+ SUBSYSTEM_ID = 0x0A, - HW_ADDR = 0x15, - - /* NVM SW-Section offset (in words) definitions */ -@@ -257,13 +258,12 @@ static u32 iwl_get_channel_flags(u8 ch_num, int ch_idx, bool is_5ghz, - static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, - struct iwl_nvm_data *data, - const __le16 * const nvm_ch_flags, -- bool lar_supported) -+ bool lar_supported, bool no_wide_in_5ghz) - { - int ch_idx; - int n_channels = 0; - struct ieee80211_channel *channel; - u16 ch_flags; -- bool is_5ghz; - int num_of_ch, num_2ghz_channels; - const u8 *nvm_chan; - -@@ -278,12 +278,20 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, - } - - for (ch_idx = 0; ch_idx < num_of_ch; ch_idx++) { -+ bool is_5ghz = (ch_idx >= num_2ghz_channels); -+ - ch_flags = __le16_to_cpup(nvm_ch_flags + ch_idx); - -- if (ch_idx >= num_2ghz_channels && -- !data->sku_cap_band_52GHz_enable) -+ if (is_5ghz && !data->sku_cap_band_52GHz_enable) - continue; - -+ /* workaround to disable wide channels in 5GHz */ -+ if (no_wide_in_5ghz && is_5ghz) { -+ ch_flags &= ~(NVM_CHANNEL_40MHZ | -+ NVM_CHANNEL_80MHZ | -+ NVM_CHANNEL_160MHZ); -+ } -+ - if (!lar_supported && !(ch_flags & NVM_CHANNEL_VALID)) { - /* - * Channels might become valid later if lar is -@@ -303,8 +311,8 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, - n_channels++; - - channel->hw_value = nvm_chan[ch_idx]; -- channel->band = (ch_idx < num_2ghz_channels) ? -- IEEE80211_BAND_2GHZ : IEEE80211_BAND_5GHZ; -+ channel->band = is_5ghz ? -+ IEEE80211_BAND_5GHZ : IEEE80211_BAND_2GHZ; - channel->center_freq = - ieee80211_channel_to_frequency( - channel->hw_value, channel->band); -@@ -316,7 +324,6 @@ static int iwl_init_channel_map(struct device *dev, const struct iwl_cfg *cfg, - * is not used in mvm, and is used for backwards compatibility - */ - channel->max_power = IWL_DEFAULT_MAX_TX_POWER; -- is_5ghz = channel->band == IEEE80211_BAND_5GHZ; - - /* don't put limitations in case we're using LAR */ - if (!lar_supported) -@@ -405,7 +412,8 @@ static void iwl_init_vht_hw_capab(const struct iwl_cfg *cfg, - static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, - struct iwl_nvm_data *data, - const __le16 *ch_section, -- u8 tx_chains, u8 rx_chains, bool lar_supported) -+ u8 tx_chains, u8 rx_chains, bool lar_supported, -+ bool no_wide_in_5ghz) - { - int n_channels; - int n_used = 0; -@@ -414,12 +422,14 @@ static void iwl_init_sbands(struct device *dev, const struct iwl_cfg *cfg, - if (cfg->device_family != IWL_DEVICE_FAMILY_8000) - n_channels = iwl_init_channel_map( - dev, cfg, data, -- &ch_section[NVM_CHANNELS], lar_supported); -+ &ch_section[NVM_CHANNELS], lar_supported, -+ no_wide_in_5ghz); - else - n_channels = iwl_init_channel_map( - dev, cfg, data, - &ch_section[NVM_CHANNELS_FAMILY_8000], -- lar_supported); -+ lar_supported, -+ no_wide_in_5ghz); - - sband = &data->bands[IEEE80211_BAND_2GHZ]; - sband->band = IEEE80211_BAND_2GHZ; -@@ -582,6 +592,39 @@ static void iwl_set_hw_address_family_8000(struct device *dev, - - #define IWL_4165_DEVICE_ID 0x5501 - -+static bool -+iwl_nvm_no_wide_in_5ghz(struct device *dev, const struct iwl_cfg *cfg, -+ const __le16 *nvm_hw) -+{ -+ /* -+ * Workaround a bug in Indonesia SKUs where the regulatory in -+ * some 7000-family OTPs erroneously allow wide channels in -+ * 5GHz. To check for Indonesia, we take the SKU value from -+ * bits 1-4 in the subsystem ID and check if it is either 5 or -+ * 9. In those cases, we need to force-disable wide channels -+ * in 5GHz otherwise the FW will throw a sysassert when we try -+ * to use them. -+ */ -+ if (cfg->device_family == IWL_DEVICE_FAMILY_7000) { -+ /* -+ * Unlike the other sections in the NVM, the hw -+ * section uses big-endian. -+ */ -+ u16 subsystem_id = be16_to_cpup((const __be16 *)nvm_hw -+ + SUBSYSTEM_ID); -+ u8 sku = (subsystem_id & 0x1e) >> 1; -+ -+ if (sku == 5 || sku == 9) { -+ IWL_DEBUG_EEPROM(dev, -+ "disabling wide channels in 5GHz (0x%0x %d)\n", -+ subsystem_id, sku); -+ return true; -+ } -+ } -+ -+ return false; -+} -+ - struct iwl_nvm_data * - iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, - const __le16 *nvm_hw, const __le16 *nvm_sw, -@@ -591,6 +634,7 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, - u32 mac_addr0, u32 mac_addr1, u32 hw_id) - { - struct iwl_nvm_data *data; -+ bool no_wide_in_5ghz = iwl_nvm_no_wide_in_5ghz(dev, cfg, nvm_hw); - u32 sku; - u32 radio_cfg; - u16 lar_config; -@@ -657,7 +701,8 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, - iwl_set_hw_address(cfg, data, nvm_hw); - - iwl_init_sbands(dev, cfg, data, nvm_sw, -- tx_chains, rx_chains, lar_fw_supported); -+ tx_chains, rx_chains, lar_fw_supported, -+ no_wide_in_5ghz); - } else { - u16 lar_offset = data->nvm_version < 0xE39 ? - NVM_LAR_OFFSET_FAMILY_8000_OLD : -@@ -673,7 +718,8 @@ iwl_parse_nvm_data(struct device *dev, const struct iwl_cfg *cfg, - - iwl_init_sbands(dev, cfg, data, regulatory, - tx_chains, rx_chains, -- lar_fw_supported && data->lar_enabled); -+ lar_fw_supported && data->lar_enabled, -+ no_wide_in_5ghz); - } - - data->calib_version = 255; -diff --git a/drivers/nvme/host/nvme.h b/drivers/nvme/host/nvme.h -index b8a5a8e8f57d..88cf4f5025b0 100644 ---- a/drivers/nvme/host/nvme.h -+++ b/drivers/nvme/host/nvme.h -@@ -14,6 +14,7 @@ - #ifndef _NVME_H - #define _NVME_H - -+#include - #include - #include - #include -@@ -62,6 +63,7 @@ struct nvme_dev { - struct work_struct reset_work; - struct work_struct probe_work; - struct work_struct scan_work; -+ struct mutex shutdown_lock; - char name[12]; - char serial[20]; - char model[40]; -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 4c673d45f1bd..669edbd47602 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -2954,6 +2954,7 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) - - nvme_dev_list_remove(dev); - -+ mutex_lock(&dev->shutdown_lock); - if (pci_is_enabled(to_pci_dev(dev->dev))) { - nvme_freeze_queues(dev); - csts = readl(&dev->bar->csts); -@@ -2972,6 +2973,7 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) - - for (i = dev->queue_count - 1; i >= 0; i--) - nvme_clear_queue(dev->queues[i]); -+ mutex_unlock(&dev->shutdown_lock); - } - - static void nvme_dev_remove(struct nvme_dev *dev) -@@ -3328,6 +3330,7 @@ static int nvme_probe(struct pci_dev *pdev, const struct pci_device_id *id) - - INIT_LIST_HEAD(&dev->namespaces); - INIT_WORK(&dev->reset_work, nvme_reset_work); -+ mutex_init(&dev->shutdown_lock); - dev->dev = get_device(&pdev->dev); - pci_set_drvdata(pdev, dev); - -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 8750c86f95f9..7e1681cf287c 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -2878,8 +2878,6 @@ static int sd_revalidate_disk(struct gendisk *disk) - sd_read_write_same(sdkp, buffer); - } - -- sdkp->first_scan = 0; -- - /* - * We now have all cache related info, determine how we deal - * with flush requests. -@@ -2894,7 +2892,7 @@ static int sd_revalidate_disk(struct gendisk *disk) - q->limits.max_dev_sectors = logical_to_sectors(sdp, dev_max); - - /* -- * Use the device's preferred I/O size for reads and writes -+ * Determine the device's preferred I/O size for reads and writes - * unless the reported value is unreasonably small, large, or - * garbage. - */ -@@ -2908,8 +2906,19 @@ static int sd_revalidate_disk(struct gendisk *disk) - rw_max = min_not_zero(logical_to_sectors(sdp, dev_max), - (sector_t)BLK_DEF_MAX_SECTORS); - -- /* Combine with controller limits */ -- q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q)); -+ /* Do not exceed controller limit */ -+ rw_max = min(rw_max, queue_max_hw_sectors(q)); -+ -+ /* -+ * Only update max_sectors if previously unset or if the current value -+ * exceeds the capabilities of the hardware. -+ */ -+ if (sdkp->first_scan || -+ q->limits.max_sectors > q->limits.max_dev_sectors || -+ q->limits.max_sectors > q->limits.max_hw_sectors) -+ q->limits.max_sectors = rw_max; -+ -+ sdkp->first_scan = 0; - - set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity)); - sd_config_write_same(sdkp); -diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c -index 20314ff08be0..abc66908681d 100644 ---- a/drivers/staging/iio/adc/ad7192.c -+++ b/drivers/staging/iio/adc/ad7192.c -@@ -205,11 +205,9 @@ static int ad7192_setup(struct ad7192_state *st, - struct iio_dev *indio_dev = spi_get_drvdata(st->sd.spi); - unsigned long long scale_uv; - int i, ret, id; -- u8 ones[6]; - - /* reset the serial interface */ -- memset(&ones, 0xFF, 6); -- ret = spi_write(st->sd.spi, &ones, 6); -+ ret = ad_sd_reset(&st->sd, 48); - if (ret < 0) - goto out; - usleep_range(500, 1000); /* Wait for at least 500us */ -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 325cbc9c35d8..d9d048fc9082 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -609,15 +609,23 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, - - } else if (header->bDescriptorType == - USB_DT_INTERFACE_ASSOCIATION) { -+ struct usb_interface_assoc_descriptor *d; -+ -+ d = (struct usb_interface_assoc_descriptor *)header; -+ if (d->bLength < USB_DT_INTERFACE_ASSOCIATION_SIZE) { -+ dev_warn(ddev, -+ "config %d has an invalid interface association descriptor of length %d, skipping\n", -+ cfgno, d->bLength); -+ continue; -+ } -+ - if (iad_num == USB_MAXIADS) { - dev_warn(ddev, "found more Interface " - "Association Descriptors " - "than allocated for in " - "configuration %d\n", cfgno); - } else { -- config->intf_assoc[iad_num] = -- (struct usb_interface_assoc_descriptor -- *)header; -+ config->intf_assoc[iad_num] = d; - iad_num++; - } - -@@ -818,7 +826,7 @@ int usb_get_configuration(struct usb_device *dev) - } - - if (dev->quirks & USB_QUIRK_DELAY_INIT) -- msleep(100); -+ msleep(200); - - result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno, - bigbuffer, length); -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 873ba02d59e6..bd9419213d06 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -1417,7 +1417,11 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - totlen += isopkt[u].length; - } - u *= sizeof(struct usb_iso_packet_descriptor); -- uurb->buffer_length = totlen; -+ if (totlen <= uurb->buffer_length) -+ uurb->buffer_length = totlen; -+ else -+ WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", -+ totlen, uurb->buffer_length); - break; - - default: -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index cdf4be3939f5..51bba58c0c3b 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4761,7 +4761,7 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus, - goto loop; - - if (udev->quirks & USB_QUIRK_DELAY_INIT) -- msleep(1000); -+ msleep(2000); - - /* consecutive bus-powered hubs aren't reliable; they can - * violate the voltage drop budget. if the new child has -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index 43ce2cfcdb4d..b6df47aa25af 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -27,7 +27,7 @@ - #include - #include - #include -- -+#include - #include - #include - -@@ -116,6 +116,7 @@ enum ep0_state { - struct dev_data { - spinlock_t lock; - atomic_t count; -+ int udc_usage; - enum ep0_state state; /* P: lock */ - struct usb_gadgetfs_event event [N_EVENT]; - unsigned ev_next; -@@ -512,9 +513,9 @@ static void ep_aio_complete(struct usb_ep *ep, struct usb_request *req) - INIT_WORK(&priv->work, ep_user_copy_worker); - schedule_work(&priv->work); - } -- spin_unlock(&epdata->dev->lock); - - usb_ep_free_request(ep, req); -+ spin_unlock(&epdata->dev->lock); - put_ep(epdata); - } - -@@ -938,9 +939,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) - struct usb_request *req = dev->req; - - if ((retval = setup_req (ep, req, 0)) == 0) { -+ ++dev->udc_usage; - spin_unlock_irq (&dev->lock); - retval = usb_ep_queue (ep, req, GFP_KERNEL); - spin_lock_irq (&dev->lock); -+ --dev->udc_usage; - } - dev->state = STATE_DEV_CONNECTED; - -@@ -982,11 +985,14 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr) - retval = -EIO; - else { - len = min (len, (size_t)dev->req->actual); --// FIXME don't call this with the spinlock held ... -+ ++dev->udc_usage; -+ spin_unlock_irq(&dev->lock); - if (copy_to_user (buf, dev->req->buf, len)) - retval = -EFAULT; - else - retval = len; -+ spin_lock_irq(&dev->lock); -+ --dev->udc_usage; - clean_req (dev->gadget->ep0, dev->req); - /* NOTE userspace can't yet choose to stall */ - } -@@ -1130,6 +1136,7 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - retval = setup_req (dev->gadget->ep0, dev->req, len); - if (retval == 0) { - dev->state = STATE_DEV_CONNECTED; -+ ++dev->udc_usage; - spin_unlock_irq (&dev->lock); - if (copy_from_user (dev->req->buf, buf, len)) - retval = -EFAULT; -@@ -1140,10 +1147,10 @@ ep0_write (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - dev->gadget->ep0, dev->req, - GFP_KERNEL); - } -+ spin_lock_irq(&dev->lock); -+ --dev->udc_usage; - if (retval < 0) { -- spin_lock_irq (&dev->lock); - clean_req (dev->gadget->ep0, dev->req); -- spin_unlock_irq (&dev->lock); - } else - retval = len; - -@@ -1240,9 +1247,21 @@ static long dev_ioctl (struct file *fd, unsigned code, unsigned long value) - struct usb_gadget *gadget = dev->gadget; - long ret = -ENOTTY; - -- if (gadget->ops->ioctl) -+ spin_lock_irq(&dev->lock); -+ if (dev->state == STATE_DEV_OPENED || -+ dev->state == STATE_DEV_UNBOUND) { -+ /* Not bound to a UDC */ -+ } else if (gadget->ops->ioctl) { -+ ++dev->udc_usage; -+ spin_unlock_irq(&dev->lock); -+ - ret = gadget->ops->ioctl (gadget, code, value); - -+ spin_lock_irq(&dev->lock); -+ --dev->udc_usage; -+ } -+ spin_unlock_irq(&dev->lock); -+ - return ret; - } - -@@ -1460,10 +1479,12 @@ delegate: - if (value < 0) - break; - -+ ++dev->udc_usage; - spin_unlock (&dev->lock); - value = usb_ep_queue (gadget->ep0, dev->req, - GFP_KERNEL); - spin_lock (&dev->lock); -+ --dev->udc_usage; - if (value < 0) { - clean_req (gadget->ep0, dev->req); - break; -@@ -1487,8 +1508,12 @@ delegate: - req->length = value; - req->zero = value < w_length; - -+ ++dev->udc_usage; - spin_unlock (&dev->lock); - value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL); -+ spin_lock(&dev->lock); -+ --dev->udc_usage; -+ spin_unlock(&dev->lock); - if (value < 0) { - DBG (dev, "ep_queue --> %d\n", value); - req->status = 0; -@@ -1515,21 +1540,24 @@ static void destroy_ep_files (struct dev_data *dev) - /* break link to FS */ - ep = list_first_entry (&dev->epfiles, struct ep_data, epfiles); - list_del_init (&ep->epfiles); -+ spin_unlock_irq (&dev->lock); -+ - dentry = ep->dentry; - ep->dentry = NULL; - parent = d_inode(dentry->d_parent); - - /* break link to controller */ -+ mutex_lock(&ep->lock); - if (ep->state == STATE_EP_ENABLED) - (void) usb_ep_disable (ep->ep); - ep->state = STATE_EP_UNBOUND; - usb_ep_free_request (ep->ep, ep->req); - ep->ep = NULL; -+ mutex_unlock(&ep->lock); -+ - wake_up (&ep->wait); - put_ep (ep); - -- spin_unlock_irq (&dev->lock); -- - /* break link to dcache */ - mutex_lock (&parent->i_mutex); - d_delete (dentry); -@@ -1600,6 +1628,11 @@ gadgetfs_unbind (struct usb_gadget *gadget) - - spin_lock_irq (&dev->lock); - dev->state = STATE_DEV_UNBOUND; -+ while (dev->udc_usage > 0) { -+ spin_unlock_irq(&dev->lock); -+ usleep_range(1000, 2000); -+ spin_lock_irq(&dev->lock); -+ } - spin_unlock_irq (&dev->lock); - - destroy_ep_files (dev); -diff --git a/drivers/usb/gadget/udc/atmel_usba_udc.c b/drivers/usb/gadget/udc/atmel_usba_udc.c -index f92f5aff0dd5..585cb8734f50 100644 ---- a/drivers/usb/gadget/udc/atmel_usba_udc.c -+++ b/drivers/usb/gadget/udc/atmel_usba_udc.c -@@ -28,6 +28,8 @@ - #include - - #include "atmel_usba_udc.h" -+#define USBA_VBUS_IRQFLAGS (IRQF_ONESHOT \ -+ | IRQF_TRIGGER_FALLING | IRQF_TRIGGER_RISING) - - #ifdef CONFIG_USB_GADGET_DEBUG_FS - #include -@@ -2185,7 +2187,7 @@ static int usba_udc_probe(struct platform_device *pdev) - IRQ_NOAUTOEN); - ret = devm_request_threaded_irq(&pdev->dev, - gpio_to_irq(udc->vbus_pin), NULL, -- usba_vbus_irq_thread, IRQF_ONESHOT, -+ usba_vbus_irq_thread, USBA_VBUS_IRQFLAGS, - "atmel_usba_udc", udc); - if (ret) { - udc->vbus_pin = -ENODEV; -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index 64f404a1a072..db645c38055d 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -237,6 +237,8 @@ struct dummy_hcd { - - struct usb_device *udev; - struct list_head urbp_list; -+ struct urbp *next_frame_urbp; -+ - u32 stream_en_ep; - u8 num_stream[30 / 2]; - -@@ -253,11 +255,13 @@ struct dummy { - */ - struct dummy_ep ep[DUMMY_ENDPOINTS]; - int address; -+ int callback_usage; - struct usb_gadget gadget; - struct usb_gadget_driver *driver; - struct dummy_request fifo_req; - u8 fifo_buf[FIFO_SIZE]; - u16 devstatus; -+ unsigned ints_enabled:1; - unsigned udc_suspended:1; - unsigned pullup:1; - -@@ -440,18 +444,27 @@ static void set_link_state(struct dummy_hcd *dum_hcd) - (~dum_hcd->old_status) & dum_hcd->port_status; - - /* Report reset and disconnect events to the driver */ -- if (dum->driver && (disconnect || reset)) { -+ if (dum->ints_enabled && (disconnect || reset)) { - stop_activity(dum); -+ ++dum->callback_usage; -+ spin_unlock(&dum->lock); - if (reset) - usb_gadget_udc_reset(&dum->gadget, dum->driver); - else - dum->driver->disconnect(&dum->gadget); -+ spin_lock(&dum->lock); -+ --dum->callback_usage; - } -- } else if (dum_hcd->active != dum_hcd->old_active) { -+ } else if (dum_hcd->active != dum_hcd->old_active && -+ dum->ints_enabled) { -+ ++dum->callback_usage; -+ spin_unlock(&dum->lock); - if (dum_hcd->old_active && dum->driver->suspend) - dum->driver->suspend(&dum->gadget); - else if (!dum_hcd->old_active && dum->driver->resume) - dum->driver->resume(&dum->gadget); -+ spin_lock(&dum->lock); -+ --dum->callback_usage; - } - - dum_hcd->old_status = dum_hcd->port_status; -@@ -967,8 +980,11 @@ static int dummy_udc_start(struct usb_gadget *g, - * can't enumerate without help from the driver we're binding. - */ - -+ spin_lock_irq(&dum->lock); - dum->devstatus = 0; - dum->driver = driver; -+ dum->ints_enabled = 1; -+ spin_unlock_irq(&dum->lock); - - return 0; - } -@@ -979,6 +995,16 @@ static int dummy_udc_stop(struct usb_gadget *g) - struct dummy *dum = dum_hcd->dum; - - spin_lock_irq(&dum->lock); -+ dum->ints_enabled = 0; -+ stop_activity(dum); -+ -+ /* emulate synchronize_irq(): wait for callbacks to finish */ -+ while (dum->callback_usage > 0) { -+ spin_unlock_irq(&dum->lock); -+ usleep_range(1000, 2000); -+ spin_lock_irq(&dum->lock); -+ } -+ - dum->driver = NULL; - spin_unlock_irq(&dum->lock); - -@@ -1032,7 +1058,12 @@ static int dummy_udc_probe(struct platform_device *pdev) - memzero_explicit(&dum->gadget, sizeof(struct usb_gadget)); - dum->gadget.name = gadget_name; - dum->gadget.ops = &dummy_ops; -- dum->gadget.max_speed = USB_SPEED_SUPER; -+ if (mod_data.is_super_speed) -+ dum->gadget.max_speed = USB_SPEED_SUPER; -+ else if (mod_data.is_high_speed) -+ dum->gadget.max_speed = USB_SPEED_HIGH; -+ else -+ dum->gadget.max_speed = USB_SPEED_FULL; - - dum->gadget.dev.parent = &pdev->dev; - init_dummy_udc_hw(dum); -@@ -1241,6 +1272,8 @@ static int dummy_urb_enqueue( - - list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list); - urb->hcpriv = urbp; -+ if (!dum_hcd->next_frame_urbp) -+ dum_hcd->next_frame_urbp = urbp; - if (usb_pipetype(urb->pipe) == PIPE_CONTROL) - urb->error_count = 1; /* mark as a new urb */ - -@@ -1517,6 +1550,8 @@ static struct dummy_ep *find_endpoint(struct dummy *dum, u8 address) - if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ? - dum->ss_hcd : dum->hs_hcd))) - return NULL; -+ if (!dum->ints_enabled) -+ return NULL; - if ((address & ~USB_DIR_IN) == 0) - return &dum->ep[0]; - for (i = 1; i < DUMMY_ENDPOINTS; i++) { -@@ -1758,6 +1793,7 @@ static void dummy_timer(unsigned long _dum_hcd) - spin_unlock_irqrestore(&dum->lock, flags); - return; - } -+ dum_hcd->next_frame_urbp = NULL; - - for (i = 0; i < DUMMY_ENDPOINTS; i++) { - if (!ep_info[i].name) -@@ -1774,6 +1810,10 @@ restart: - int type; - int status = -EINPROGRESS; - -+ /* stop when we reach URBs queued after the timer interrupt */ -+ if (urbp == dum_hcd->next_frame_urbp) -+ break; -+ - urb = urbp->urb; - if (urb->unlinked) - goto return_urb; -@@ -1853,10 +1893,12 @@ restart: - * until setup() returns; no reentrancy issues etc. - */ - if (value > 0) { -+ ++dum->callback_usage; - spin_unlock(&dum->lock); - value = dum->driver->setup(&dum->gadget, - &setup); - spin_lock(&dum->lock); -+ --dum->callback_usage; - - if (value >= 0) { - /* no delays (max 64KB data stage) */ -@@ -2564,8 +2606,6 @@ static struct hc_driver dummy_hcd = { - .product_desc = "Dummy host controller", - .hcd_priv_size = sizeof(struct dummy_hcd), - -- .flags = HCD_USB3 | HCD_SHARED, -- - .reset = dummy_setup, - .start = dummy_start, - .stop = dummy_stop, -@@ -2594,8 +2634,12 @@ static int dummy_hcd_probe(struct platform_device *pdev) - dev_info(&pdev->dev, "%s, driver " DRIVER_VERSION "\n", driver_desc); - dum = *((void **)dev_get_platdata(&pdev->dev)); - -- if (!mod_data.is_super_speed) -+ if (mod_data.is_super_speed) -+ dummy_hcd.flags = HCD_USB3 | HCD_SHARED; -+ else if (mod_data.is_high_speed) - dummy_hcd.flags = HCD_USB2; -+ else -+ dummy_hcd.flags = HCD_USB11; - hs_hcd = usb_create_hcd(&dummy_hcd, &pdev->dev, dev_name(&pdev->dev)); - if (!hs_hcd) - return -ENOMEM; -diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c -index 1fc6f478a02c..89e9494c3245 100644 ---- a/drivers/usb/host/pci-quirks.c -+++ b/drivers/usb/host/pci-quirks.c -@@ -969,7 +969,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports); - * - * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS. - * It signals to the BIOS that the OS wants control of the host controller, -- * and then waits 5 seconds for the BIOS to hand over control. -+ * and then waits 1 second for the BIOS to hand over control. - * If we timeout, assume the BIOS is broken and take control anyway. - */ - static void quirk_usb_handoff_xhci(struct pci_dev *pdev) -@@ -1015,9 +1015,9 @@ static void quirk_usb_handoff_xhci(struct pci_dev *pdev) - if (val & XHCI_HC_BIOS_OWNED) { - writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset); - -- /* Wait for 5 seconds with 10 microsecond polling interval */ -+ /* Wait for 1 second with 10 microsecond polling interval */ - timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED, -- 0, 5000, 10); -+ 0, 1000000, 10); - - /* Assume a buggy BIOS and take HC ownership anyway */ - if (timeout) { -@@ -1046,7 +1046,7 @@ hc_init: - * operational or runtime registers. Wait 5 seconds and no more. - */ - timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0, -- 5000, 10); -+ 5000000, 10); - /* Assume a buggy HC and start HC initialization anyway */ - if (timeout) { - val = readl(op_reg_base + XHCI_STS_OFFSET); -diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h -index fc2ee6c272c4..1715705acc59 100644 ---- a/drivers/usb/host/xhci.h -+++ b/drivers/usb/host/xhci.h -@@ -1490,7 +1490,7 @@ struct xhci_bus_state { - - static inline unsigned int hcd_index(struct usb_hcd *hcd) - { -- if (hcd->speed == HCD_USB3) -+ if (hcd->speed >= HCD_USB3) - return 0; - else - return 1; -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index 36e5b5c530bd..d95cd1a72b66 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -285,11 +285,26 @@ static void usbhsf_fifo_clear(struct usbhs_pipe *pipe, - struct usbhs_fifo *fifo) - { - struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe); -+ int ret = 0; - -- if (!usbhs_pipe_is_dcp(pipe)) -- usbhsf_fifo_barrier(priv, fifo); -+ if (!usbhs_pipe_is_dcp(pipe)) { -+ /* -+ * This driver checks the pipe condition first to avoid -EBUSY -+ * from usbhsf_fifo_barrier() with about 10 msec delay in -+ * the interrupt handler if the pipe is RX direction and empty. -+ */ -+ if (usbhs_pipe_is_dir_in(pipe)) -+ ret = usbhs_pipe_is_accessible(pipe); -+ if (!ret) -+ ret = usbhsf_fifo_barrier(priv, fifo); -+ } - -- usbhs_write(priv, fifo->ctr, BCLR); -+ /* -+ * if non-DCP pipe, this driver should set BCLR when -+ * usbhsf_fifo_barrier() returns 0. -+ */ -+ if (!ret) -+ usbhs_write(priv, fifo->ctr, BCLR); - } - - static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv, -diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h -index f58caa9e6a27..a155cd02bce2 100644 ---- a/drivers/usb/storage/uas-detect.h -+++ b/drivers/usb/storage/uas-detect.h -@@ -9,7 +9,8 @@ static int uas_is_interface(struct usb_host_interface *intf) - intf->desc.bInterfaceProtocol == USB_PR_UAS); - } - --static int uas_find_uas_alt_setting(struct usb_interface *intf) -+static struct usb_host_interface *uas_find_uas_alt_setting( -+ struct usb_interface *intf) - { - int i; - -@@ -17,10 +18,10 @@ static int uas_find_uas_alt_setting(struct usb_interface *intf) - struct usb_host_interface *alt = &intf->altsetting[i]; - - if (uas_is_interface(alt)) -- return alt->desc.bAlternateSetting; -+ return alt; - } - -- return -ENODEV; -+ return NULL; - } - - static int uas_find_endpoints(struct usb_host_interface *alt, -@@ -58,14 +59,14 @@ static int uas_use_uas_driver(struct usb_interface *intf, - struct usb_device *udev = interface_to_usbdev(intf); - struct usb_hcd *hcd = bus_to_hcd(udev->bus); - unsigned long flags = id->driver_info; -- int r, alt; -- -+ struct usb_host_interface *alt; -+ int r; - - alt = uas_find_uas_alt_setting(intf); -- if (alt < 0) -+ if (!alt) - return 0; - -- r = uas_find_endpoints(&intf->altsetting[alt], eps); -+ r = uas_find_endpoints(alt, eps); - if (r < 0) - return 0; - -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index e26e32169a36..f952635ebe5f 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -849,14 +849,14 @@ MODULE_DEVICE_TABLE(usb, uas_usb_ids); - static int uas_switch_interface(struct usb_device *udev, - struct usb_interface *intf) - { -- int alt; -+ struct usb_host_interface *alt; - - alt = uas_find_uas_alt_setting(intf); -- if (alt < 0) -- return alt; -+ if (!alt) -+ return -ENODEV; - -- return usb_set_interface(udev, -- intf->altsetting[0].desc.bInterfaceNumber, alt); -+ return usb_set_interface(udev, alt->desc.bInterfaceNumber, -+ alt->desc.bAlternateSetting); - } - - static int uas_configure_endpoints(struct uas_dev_info *devinfo) -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index 640a2e2ec04d..fb96755550ec 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -1379,6 +1379,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0000, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_SANE_SENSE ), - -+/* Reported by Kris Lindgren */ -+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999, -+ "Seagate", -+ "External", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_NO_WP_DETECT ), -+ - UNUSUAL_DEV( 0x0d49, 0x7310, 0x0000, 0x9999, - "Maxtor", - "USB to SATA", -diff --git a/drivers/uwb/hwa-rc.c b/drivers/uwb/hwa-rc.c -index e75bbe5a10cd..1212b4b3c5a9 100644 ---- a/drivers/uwb/hwa-rc.c -+++ b/drivers/uwb/hwa-rc.c -@@ -827,6 +827,8 @@ static int hwarc_probe(struct usb_interface *iface, - - if (iface->cur_altsetting->desc.bNumEndpoints < 1) - return -ENODEV; -+ if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc)) -+ return -ENODEV; - - result = -ENOMEM; - uwb_rc = uwb_rc_alloc(); -diff --git a/drivers/uwb/uwbd.c b/drivers/uwb/uwbd.c -index bdcb13cc1d54..5c9828370217 100644 ---- a/drivers/uwb/uwbd.c -+++ b/drivers/uwb/uwbd.c -@@ -303,18 +303,22 @@ static int uwbd(void *param) - /** Start the UWB daemon */ - void uwbd_start(struct uwb_rc *rc) - { -- rc->uwbd.task = kthread_run(uwbd, rc, "uwbd"); -- if (rc->uwbd.task == NULL) -+ struct task_struct *task = kthread_run(uwbd, rc, "uwbd"); -+ if (IS_ERR(task)) { -+ rc->uwbd.task = NULL; - printk(KERN_ERR "UWB: Cannot start management daemon; " - "UWB won't work\n"); -- else -+ } else { -+ rc->uwbd.task = task; - rc->uwbd.pid = rc->uwbd.task->pid; -+ } - } - - /* Stop the UWB daemon and free any unprocessed events */ - void uwbd_stop(struct uwb_rc *rc) - { -- kthread_stop(rc->uwbd.task); -+ if (rc->uwbd.task) -+ kthread_stop(rc->uwbd.task); - uwbd_flush(rc); - } - -diff --git a/fs/ext4/acl.c b/fs/ext4/acl.c -index c3fe1e323951..ea2ef0eac0c4 100644 ---- a/fs/ext4/acl.c -+++ b/fs/ext4/acl.c -@@ -195,13 +195,6 @@ __ext4_set_acl(handle_t *handle, struct inode *inode, int type, - switch (type) { - case ACL_TYPE_ACCESS: - name_index = EXT4_XATTR_INDEX_POSIX_ACL_ACCESS; -- if (acl) { -- error = posix_acl_update_mode(inode, &inode->i_mode, &acl); -- if (error) -- return error; -- inode->i_ctime = ext4_current_time(inode); -- ext4_mark_inode_dirty(handle, inode); -- } - break; - - case ACL_TYPE_DEFAULT: -@@ -234,6 +227,8 @@ ext4_set_acl(struct inode *inode, struct posix_acl *acl, int type) - { - handle_t *handle; - int error, retries = 0; -+ umode_t mode = inode->i_mode; -+ int update_mode = 0; - - retry: - handle = ext4_journal_start(inode, EXT4_HT_XATTR, -@@ -241,7 +236,20 @@ retry: - if (IS_ERR(handle)) - return PTR_ERR(handle); - -+ if ((type == ACL_TYPE_ACCESS) && acl) { -+ error = posix_acl_update_mode(inode, &mode, &acl); -+ if (error) -+ goto out_stop; -+ update_mode = 1; -+ } -+ - error = __ext4_set_acl(handle, inode, type, acl); -+ if (!error && update_mode) { -+ inode->i_mode = mode; -+ inode->i_ctime = ext4_current_time(inode); -+ ext4_mark_inode_dirty(handle, inode); -+ } -+out_stop: - ext4_journal_stop(handle); - if (error == -ENOSPC && ext4_should_retry_alloc(inode->i_sb, &retries)) - goto retry; -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 1796d1bd9a1d..194a6baa4283 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -1946,15 +1946,29 @@ static int ext4_writepage(struct page *page, - static int mpage_submit_page(struct mpage_da_data *mpd, struct page *page) - { - int len; -- loff_t size = i_size_read(mpd->inode); -+ loff_t size; - int err; - - BUG_ON(page->index != mpd->first_page); -- if (page->index == size >> PAGE_CACHE_SHIFT) -- len = size & ~PAGE_CACHE_MASK; -- else -- len = PAGE_CACHE_SIZE; - clear_page_dirty_for_io(page); -+ /* -+ * We have to be very careful here! Nothing protects writeback path -+ * against i_size changes and the page can be writeably mapped into -+ * page tables. So an application can be growing i_size and writing -+ * data through mmap while writeback runs. clear_page_dirty_for_io() -+ * write-protects our page in page tables and the page cannot get -+ * written to again until we release page lock. So only after -+ * clear_page_dirty_for_io() we are safe to sample i_size for -+ * ext4_bio_write_page() to zero-out tail of the written page. We rely -+ * on the barrier provided by TestClearPageDirty in -+ * clear_page_dirty_for_io() to make sure i_size is really sampled only -+ * after page tables are updated. -+ */ -+ size = i_size_read(mpd->inode); -+ if (page->index == size >> PAGE_SHIFT) -+ len = size & ~PAGE_MASK; -+ else -+ len = PAGE_SIZE; - err = ext4_bio_write_page(&mpd->io_submit, page, len, mpd->wbc, false); - if (!err) - mpd->wbc->nr_to_write--; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 1d007e853f5c..6445d84266fa 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3506,6 +3506,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, - int credits; - u8 old_file_type; - -+ if ((ext4_encrypted_inode(old_dir) && -+ !ext4_has_encryption_key(old_dir)) || -+ (ext4_encrypted_inode(new_dir) && -+ !ext4_has_encryption_key(new_dir))) -+ return -ENOKEY; -+ - retval = dquot_initialize(old.dir); - if (retval) - return retval; -@@ -3706,6 +3712,12 @@ static int ext4_cross_rename(struct inode *old_dir, struct dentry *old_dentry, - u8 new_file_type; - int retval; - -+ if ((ext4_encrypted_inode(old_dir) && -+ !ext4_has_encryption_key(old_dir)) || -+ (ext4_encrypted_inode(new_dir) && -+ !ext4_has_encryption_key(new_dir))) -+ return -ENOKEY; -+ - if ((ext4_encrypted_inode(old_dir) || - ext4_encrypted_inode(new_dir)) && - (old_dir != new_dir) && -diff --git a/fs/xattr.c b/fs/xattr.c -index f0da9d24e9ca..76f01bf4b048 100644 ---- a/fs/xattr.c -+++ b/fs/xattr.c -@@ -163,7 +163,7 @@ xattr_getsecurity(struct inode *inode, const char *name, void *value, - } - memcpy(value, buffer, len); - out: -- security_release_secctx(buffer, len); -+ kfree(buffer); - out_noalloc: - return len; - } -diff --git a/include/linux/cpuset.h b/include/linux/cpuset.h -index 8397dc235e84..ad98acfbcba8 100644 ---- a/include/linux/cpuset.h -+++ b/include/linux/cpuset.h -@@ -43,7 +43,9 @@ static inline void cpuset_dec(void) - - extern int cpuset_init(void); - extern void cpuset_init_smp(void); -+extern void cpuset_force_rebuild(void); - extern void cpuset_update_active_cpus(bool cpu_online); -+extern void cpuset_wait_for_hotplug(void); - extern void cpuset_cpus_allowed(struct task_struct *p, struct cpumask *mask); - extern void cpuset_cpus_allowed_fallback(struct task_struct *p); - extern nodemask_t cpuset_mems_allowed(struct task_struct *p); -@@ -147,11 +149,15 @@ static inline bool cpusets_enabled(void) { return false; } - static inline int cpuset_init(void) { return 0; } - static inline void cpuset_init_smp(void) {} - -+static inline void cpuset_force_rebuild(void) { } -+ - static inline void cpuset_update_active_cpus(bool cpu_online) - { - partition_sched_domains(1, NULL, NULL); - } - -+static inline void cpuset_wait_for_hotplug(void) { } -+ - static inline void cpuset_cpus_allowed(struct task_struct *p, - struct cpumask *mask) - { -diff --git a/include/linux/iio/adc/ad_sigma_delta.h b/include/linux/iio/adc/ad_sigma_delta.h -index e7fdec4db9da..6cc48ac55fd2 100644 ---- a/include/linux/iio/adc/ad_sigma_delta.h -+++ b/include/linux/iio/adc/ad_sigma_delta.h -@@ -111,6 +111,9 @@ int ad_sd_write_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, - int ad_sd_read_reg(struct ad_sigma_delta *sigma_delta, unsigned int reg, - unsigned int size, unsigned int *val); - -+int ad_sd_reset(struct ad_sigma_delta *sigma_delta, -+ unsigned int reset_length); -+ - int ad_sigma_delta_single_conversion(struct iio_dev *indio_dev, - const struct iio_chan_spec *chan, int *val); - int ad_sd_calibrate_all(struct ad_sigma_delta *sigma_delta, -diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h -index 779a62aafafe..91ab75c1013c 100644 ---- a/include/uapi/linux/usb/ch9.h -+++ b/include/uapi/linux/usb/ch9.h -@@ -717,6 +717,7 @@ struct usb_interface_assoc_descriptor { - __u8 iFunction; - } __attribute__ ((packed)); - -+#define USB_DT_INTERFACE_ASSOCIATION_SIZE 8 - - /*-------------------------------------------------------------------------*/ - -diff --git a/kernel/cpuset.c b/kernel/cpuset.c -index 2924b6faa469..dd3ae6ee064d 100644 ---- a/kernel/cpuset.c -+++ b/kernel/cpuset.c -@@ -2281,6 +2281,13 @@ retry: - mutex_unlock(&cpuset_mutex); - } - -+static bool force_rebuild; -+ -+void cpuset_force_rebuild(void) -+{ -+ force_rebuild = true; -+} -+ - /** - * cpuset_hotplug_workfn - handle CPU/memory hotunplug for a cpuset - * -@@ -2355,8 +2362,10 @@ static void cpuset_hotplug_workfn(struct work_struct *work) - } - - /* rebuild sched domains if cpus_allowed has changed */ -- if (cpus_updated) -+ if (cpus_updated || force_rebuild) { -+ force_rebuild = false; - rebuild_sched_domains(); -+ } - } - - void cpuset_update_active_cpus(bool cpu_online) -@@ -2375,6 +2384,11 @@ void cpuset_update_active_cpus(bool cpu_online) - schedule_work(&cpuset_hotplug_work); - } - -+void cpuset_wait_for_hotplug(void) -+{ -+ flush_work(&cpuset_hotplug_work); -+} -+ - /* - * Keep top_cpuset.mems_allowed tracking node_states[N_MEMORY]. - * Call this routine anytime after node_states[N_MEMORY] changes. -diff --git a/kernel/power/process.c b/kernel/power/process.c -index 564f786df470..ba2029a02259 100644 ---- a/kernel/power/process.c -+++ b/kernel/power/process.c -@@ -18,7 +18,8 @@ - #include - #include -+#include - --/* -+/* - * Timeout for stopping processes - */ - unsigned int __read_mostly freeze_timeout_msecs = 20 * MSEC_PER_SEC; -@@ -198,6 +199,8 @@ void thaw_processes(void) - __usermodehelper_set_disable_depth(UMH_FREEZING); - thaw_workqueues(); - -+ cpuset_wait_for_hotplug(); -+ - read_lock(&tasklist_lock); - for_each_process_thread(g, p) { - /* No other threads should have PF_SUSPEND_TASK set */ -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index dece705b7f8c..b5d372083624 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -7286,17 +7286,16 @@ static int cpuset_cpu_active(struct notifier_block *nfb, unsigned long action, - * operation in the resume sequence, just build a single sched - * domain, ignoring cpusets. - */ -- num_cpus_frozen--; -- if (likely(num_cpus_frozen)) { -- partition_sched_domains(1, NULL, NULL); -+ partition_sched_domains(1, NULL, NULL); -+ if (--num_cpus_frozen) - break; -- } - - /* - * This is the last CPU online operation. So fall through and - * restore the original sched domains by considering the - * cpuset configurations. - */ -+ cpuset_force_rebuild(); - - case CPU_ONLINE: - cpuset_update_active_cpus(true); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index 38d73a6e2857..fc0051fd672d 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -4315,9 +4315,6 @@ static char ftrace_graph_buf[FTRACE_FILTER_SIZE] __initdata; - static char ftrace_graph_notrace_buf[FTRACE_FILTER_SIZE] __initdata; - static int ftrace_set_func(unsigned long *array, int *idx, int size, char *buffer); - --static unsigned long save_global_trampoline; --static unsigned long save_global_flags; -- - static int __init set_graph_function(char *str) - { - strlcpy(ftrace_graph_buf, str, FTRACE_FILTER_SIZE); -@@ -5907,17 +5904,6 @@ void unregister_ftrace_graph(void) - unregister_pm_notifier(&ftrace_suspend_notifier); - unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL); - --#ifdef CONFIG_DYNAMIC_FTRACE -- /* -- * Function graph does not allocate the trampoline, but -- * other global_ops do. We need to reset the ALLOC_TRAMP flag -- * if one was used. -- */ -- global_ops.trampoline = save_global_trampoline; -- if (save_global_flags & FTRACE_OPS_FL_ALLOC_TRAMP) -- global_ops.flags |= FTRACE_OPS_FL_ALLOC_TRAMP; --#endif -- - out: - mutex_unlock(&ftrace_lock); - } -diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c -index 7c57c7fcf5a2..735a1a9386d6 100644 ---- a/security/smack/smack_lsm.c -+++ b/security/smack/smack_lsm.c -@@ -1459,7 +1459,7 @@ static int smack_inode_removexattr(struct dentry *dentry, const char *name) - * @inode: the object - * @name: attribute name - * @buffer: where to put the result -- * @alloc: unused -+ * @alloc: duplicate memory - * - * Returns the size of the attribute or an error code - */ -@@ -1472,43 +1472,38 @@ static int smack_inode_getsecurity(const struct inode *inode, - struct super_block *sbp; - struct inode *ip = (struct inode *)inode; - struct smack_known *isp; -- int ilen; -- int rc = 0; - -- if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) { -+ if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) - isp = smk_of_inode(inode); -- ilen = strlen(isp->smk_known); -- *buffer = isp->smk_known; -- return ilen; -- } -+ else { -+ /* -+ * The rest of the Smack xattrs are only on sockets. -+ */ -+ sbp = ip->i_sb; -+ if (sbp->s_magic != SOCKFS_MAGIC) -+ return -EOPNOTSUPP; - -- /* -- * The rest of the Smack xattrs are only on sockets. -- */ -- sbp = ip->i_sb; -- if (sbp->s_magic != SOCKFS_MAGIC) -- return -EOPNOTSUPP; -+ sock = SOCKET_I(ip); -+ if (sock == NULL || sock->sk == NULL) -+ return -EOPNOTSUPP; - -- sock = SOCKET_I(ip); -- if (sock == NULL || sock->sk == NULL) -- return -EOPNOTSUPP; -- -- ssp = sock->sk->sk_security; -+ ssp = sock->sk->sk_security; - -- if (strcmp(name, XATTR_SMACK_IPIN) == 0) -- isp = ssp->smk_in; -- else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) -- isp = ssp->smk_out; -- else -- return -EOPNOTSUPP; -+ if (strcmp(name, XATTR_SMACK_IPIN) == 0) -+ isp = ssp->smk_in; -+ else if (strcmp(name, XATTR_SMACK_IPOUT) == 0) -+ isp = ssp->smk_out; -+ else -+ return -EOPNOTSUPP; -+ } - -- ilen = strlen(isp->smk_known); -- if (rc == 0) { -- *buffer = isp->smk_known; -- rc = ilen; -+ if (alloc) { -+ *buffer = kstrdup(isp->smk_known, GFP_KERNEL); -+ if (*buffer == NULL) -+ return -ENOMEM; - } - -- return rc; -+ return strlen(isp->smk_known); - } - - -diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c -index b554d7f9e3be..6163bf3e8177 100644 ---- a/sound/core/compress_offload.c -+++ b/sound/core/compress_offload.c -@@ -872,14 +872,13 @@ static const struct file_operations snd_compr_file_ops = { - static int snd_compress_dev_register(struct snd_device *device) - { - int ret = -EINVAL; -- char str[16]; - struct snd_compr *compr; - - if (snd_BUG_ON(!device || !device->device_data)) - return -EBADFD; - compr = device->device_data; - -- pr_debug("reg %s for device %s, direction %d\n", str, compr->name, -+ pr_debug("reg device %s, direction %d\n", compr->name, - compr->direction); - /* register compressed device */ - ret = snd_register_device(SNDRV_DEVICE_TYPE_COMPRESS, -diff --git a/sound/usb/card.c b/sound/usb/card.c -index a1cbaa5f7fc9..83336bb6333e 100644 ---- a/sound/usb/card.c -+++ b/sound/usb/card.c -@@ -217,6 +217,7 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) - struct usb_interface_descriptor *altsd; - void *control_header; - int i, protocol; -+ int rest_bytes; - - /* find audiocontrol interface */ - host_iface = &usb_ifnum_to_if(dev, ctrlif)->altsetting[0]; -@@ -231,6 +232,15 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) - return -EINVAL; - } - -+ rest_bytes = (void *)(host_iface->extra + host_iface->extralen) - -+ control_header; -+ -+ /* just to be sure -- this shouldn't hit at all */ -+ if (rest_bytes <= 0) { -+ dev_err(&dev->dev, "invalid control header\n"); -+ return -EINVAL; -+ } -+ - switch (protocol) { - default: - dev_warn(&dev->dev, -@@ -241,11 +251,21 @@ static int snd_usb_create_streams(struct snd_usb_audio *chip, int ctrlif) - case UAC_VERSION_1: { - struct uac1_ac_header_descriptor *h1 = control_header; - -+ if (rest_bytes < sizeof(*h1)) { -+ dev_err(&dev->dev, "too short v1 buffer descriptor\n"); -+ return -EINVAL; -+ } -+ - if (!h1->bInCollection) { - dev_info(&dev->dev, "skipping empty audio interface (v1)\n"); - return -EINVAL; - } - -+ if (rest_bytes < h1->bLength) { -+ dev_err(&dev->dev, "invalid buffer length (v1)\n"); -+ return -EINVAL; -+ } -+ - if (h1->bLength < sizeof(*h1) + h1->bInCollection) { - dev_err(&dev->dev, "invalid UAC_HEADER (v1)\n"); - return -EINVAL; -diff --git a/sound/usb/usx2y/usb_stream.c b/sound/usb/usx2y/usb_stream.c -index bf618e1500ac..e7b934f4d837 100644 ---- a/sound/usb/usx2y/usb_stream.c -+++ b/sound/usb/usx2y/usb_stream.c -@@ -191,7 +191,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, - } - - pg = get_order(read_size); -- sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); -+ sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| -+ __GFP_NOWARN, pg); - if (!sk->s) { - snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); - goto out; -@@ -211,7 +212,8 @@ struct usb_stream *usb_stream_new(struct usb_stream_kernel *sk, - pg = get_order(write_size); - - sk->write_page = -- (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg); -+ (void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO| -+ __GFP_NOWARN, pg); - if (!sk->write_page) { - snd_printk(KERN_WARNING "couldn't __get_free_pages()\n"); - usb_stream_free(sk); diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.92-93.patch b/patch/kernel/mvebu64-default/03-patch-4.4.92-93.patch deleted file mode 100644 index 08ef2569a414..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.92-93.patch +++ /dev/null @@ -1,933 +0,0 @@ -diff --git a/Makefile b/Makefile -index fab2d640a27e..77a17fb24b6d 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 92 -+SUBLEVEL = 93 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index 6da2e4a6ba39..dd058aa8a3b5 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -2360,7 +2360,6 @@ dcopuop: - break; - default: - /* Reserved R6 ops */ -- pr_err("Reserved MIPS R6 CMP.condn.S operation\n"); - return SIGILL; - } - } -@@ -2434,7 +2433,6 @@ dcopuop: - break; - default: - /* Reserved R6 ops */ -- pr_err("Reserved MIPS R6 CMP.condn.D operation\n"); - return SIGILL; - } - } -diff --git a/arch/x86/include/asm/alternative-asm.h b/arch/x86/include/asm/alternative-asm.h -index e7636bac7372..6c98821fef5e 100644 ---- a/arch/x86/include/asm/alternative-asm.h -+++ b/arch/x86/include/asm/alternative-asm.h -@@ -62,8 +62,10 @@ - #define new_len2 145f-144f - - /* -- * max without conditionals. Idea adapted from: -+ * gas compatible max based on the idea from: - * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax -+ * -+ * The additional "-" is needed because gas uses a "true" value of -1. - */ - #define alt_max_short(a, b) ((a) ^ (((a) ^ (b)) & -(-((a) < (b))))) - -diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h -index 7bfc85bbb8ff..09936e9c8154 100644 ---- a/arch/x86/include/asm/alternative.h -+++ b/arch/x86/include/asm/alternative.h -@@ -102,12 +102,12 @@ static inline int alternatives_text_reserved(void *start, void *end) - alt_end_marker ":\n" - - /* -- * max without conditionals. Idea adapted from: -+ * gas compatible max based on the idea from: - * http://graphics.stanford.edu/~seander/bithacks.html#IntegerMinOrMax - * -- * The additional "-" is needed because gas works with s32s. -+ * The additional "-" is needed because gas uses a "true" value of -1. - */ --#define alt_max_short(a, b) "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") - (" b ")))))" -+#define alt_max_short(a, b) "((" a ") ^ (((" a ") ^ (" b ")) & -(-((" a ") < (" b ")))))" - - /* - * Pad the second replacement alternative with additional NOPs if it is -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index a018dff00808..9114588e3e61 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -10369,7 +10369,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, - * (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask(); - */ - vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK); -- kvm_set_cr4(vcpu, vmcs12->host_cr4); -+ vmx_set_cr4(vcpu, vmcs12->host_cr4); - - nested_ept_uninit_mmu_context(vcpu); - -diff --git a/block/bio.c b/block/bio.c -index 14263fab94d3..68bbc835bacc 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1320,6 +1320,7 @@ struct bio *bio_map_user_iov(struct request_queue *q, - offset = uaddr & ~PAGE_MASK; - for (j = cur_page; j < page_limit; j++) { - unsigned int bytes = PAGE_SIZE - offset; -+ unsigned short prev_bi_vcnt = bio->bi_vcnt; - - if (len <= 0) - break; -@@ -1334,6 +1335,13 @@ struct bio *bio_map_user_iov(struct request_queue *q, - bytes) - break; - -+ /* -+ * check if vector was merged with previous -+ * drop page reference if needed -+ */ -+ if (bio->bi_vcnt == prev_bi_vcnt) -+ put_page(pages[j]); -+ - len -= bytes; - offset = 0; - } -diff --git a/crypto/shash.c b/crypto/shash.c -index 359754591653..b2cd109d9171 100644 ---- a/crypto/shash.c -+++ b/crypto/shash.c -@@ -274,12 +274,14 @@ static int shash_async_finup(struct ahash_request *req) - - int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc) - { -- struct scatterlist *sg = req->src; -- unsigned int offset = sg->offset; - unsigned int nbytes = req->nbytes; -+ struct scatterlist *sg; -+ unsigned int offset; - int err; - -- if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) { -+ if (nbytes && -+ (sg = req->src, offset = sg->offset, -+ nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) { - void *data; - - data = kmap_atomic(sg_page(sg)); -diff --git a/drivers/dma/edma.c b/drivers/dma/edma.c -index 16fe773fb846..85674a8d0436 100644 ---- a/drivers/dma/edma.c -+++ b/drivers/dma/edma.c -@@ -1126,11 +1126,24 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy( - struct edma_desc *edesc; - struct device *dev = chan->device->dev; - struct edma_chan *echan = to_edma_chan(chan); -- unsigned int width, pset_len; -+ unsigned int width, pset_len, array_size; - - if (unlikely(!echan || !len)) - return NULL; - -+ /* Align the array size (acnt block) with the transfer properties */ -+ switch (__ffs((src | dest | len))) { -+ case 0: -+ array_size = SZ_32K - 1; -+ break; -+ case 1: -+ array_size = SZ_32K - 2; -+ break; -+ default: -+ array_size = SZ_32K - 4; -+ break; -+ } -+ - if (len < SZ_64K) { - /* - * Transfer size less than 64K can be handled with one paRAM -@@ -1152,7 +1165,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy( - * When the full_length is multibple of 32767 one slot can be - * used to complete the transfer. - */ -- width = SZ_32K - 1; -+ width = array_size; - pset_len = rounddown(len, width); - /* One slot is enough for lengths multiple of (SZ_32K -1) */ - if (unlikely(pset_len == len)) -@@ -1202,7 +1215,7 @@ static struct dma_async_tx_descriptor *edma_prep_dma_memcpy( - } - dest += pset_len; - src += pset_len; -- pset_len = width = len % (SZ_32K - 1); -+ pset_len = width = len % array_size; - - ret = edma_config_pset(chan, &edesc->pset[1], src, dest, 1, - width, pset_len, DMA_MEM_TO_MEM); -diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c -index 0df32fe0e345..b0eeb5090c91 100644 ---- a/drivers/hid/usbhid/hid-core.c -+++ b/drivers/hid/usbhid/hid-core.c -@@ -971,6 +971,8 @@ static int usbhid_parse(struct hid_device *hid) - unsigned int rsize = 0; - char *rdesc; - int ret, n; -+ int num_descriptors; -+ size_t offset = offsetof(struct hid_descriptor, desc); - - quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor), - le16_to_cpu(dev->descriptor.idProduct)); -@@ -993,10 +995,18 @@ static int usbhid_parse(struct hid_device *hid) - return -ENODEV; - } - -+ if (hdesc->bLength < sizeof(struct hid_descriptor)) { -+ dbg_hid("hid descriptor is too short\n"); -+ return -EINVAL; -+ } -+ - hid->version = le16_to_cpu(hdesc->bcdHID); - hid->country = hdesc->bCountryCode; - -- for (n = 0; n < hdesc->bNumDescriptors; n++) -+ num_descriptors = min_t(int, hdesc->bNumDescriptors, -+ (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor)); -+ -+ for (n = 0; n < num_descriptors; n++) - if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT) - rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength); - -diff --git a/drivers/iommu/amd_iommu.c b/drivers/iommu/amd_iommu.c -index a0ef57483ebb..52c36394dba5 100644 ---- a/drivers/iommu/amd_iommu.c -+++ b/drivers/iommu/amd_iommu.c -@@ -3096,6 +3096,7 @@ static size_t amd_iommu_unmap(struct iommu_domain *dom, unsigned long iova, - mutex_unlock(&domain->api_lock); - - domain_flush_tlb_pde(domain); -+ domain_flush_complete(domain); - - return unmap_size; - } -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -index f18491cf793c..5fecae0ba52e 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -@@ -2903,6 +2903,7 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, - struct brcmf_cfg80211_info *cfg = ifp->drvr->config; - s32 status; - struct brcmf_escan_result_le *escan_result_le; -+ u32 escan_buflen; - struct brcmf_bss_info_le *bss_info_le; - struct brcmf_bss_info_le *bss = NULL; - u32 bi_length; -@@ -2919,11 +2920,23 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, - - if (status == BRCMF_E_STATUS_PARTIAL) { - brcmf_dbg(SCAN, "ESCAN Partial result\n"); -+ if (e->datalen < sizeof(*escan_result_le)) { -+ brcmf_err("invalid event data length\n"); -+ goto exit; -+ } - escan_result_le = (struct brcmf_escan_result_le *) data; - if (!escan_result_le) { - brcmf_err("Invalid escan result (NULL pointer)\n"); - goto exit; - } -+ escan_buflen = le32_to_cpu(escan_result_le->buflen); -+ if (escan_buflen > WL_ESCAN_BUF_SIZE || -+ escan_buflen > e->datalen || -+ escan_buflen < sizeof(*escan_result_le)) { -+ brcmf_err("Invalid escan buffer length: %d\n", -+ escan_buflen); -+ goto exit; -+ } - if (le16_to_cpu(escan_result_le->bss_count) != 1) { - brcmf_err("Invalid bss_count %d: ignoring\n", - escan_result_le->bss_count); -@@ -2940,9 +2953,8 @@ brcmf_cfg80211_escan_handler(struct brcmf_if *ifp, - } - - bi_length = le32_to_cpu(bss_info_le->length); -- if (bi_length != (le32_to_cpu(escan_result_le->buflen) - -- WL_ESCAN_RESULTS_FIXED_SIZE)) { -- brcmf_err("Invalid bss_info length %d: ignoring\n", -+ if (bi_length != escan_buflen - WL_ESCAN_RESULTS_FIXED_SIZE) { -+ brcmf_err("Ignoring invalid bss_info length: %d\n", - bi_length); - goto exit; - } -diff --git a/drivers/net/wireless/iwlwifi/mvm/mac80211.c b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -index 1a8ea775de08..984cd2f05c4a 100644 ---- a/drivers/net/wireless/iwlwifi/mvm/mac80211.c -+++ b/drivers/net/wireless/iwlwifi/mvm/mac80211.c -@@ -1906,6 +1906,11 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, - struct iwl_mvm_mc_iter_data *data = _data; - struct iwl_mvm *mvm = data->mvm; - struct iwl_mcast_filter_cmd *cmd = mvm->mcast_filter_cmd; -+ struct iwl_host_cmd hcmd = { -+ .id = MCAST_FILTER_CMD, -+ .flags = CMD_ASYNC, -+ .dataflags[0] = IWL_HCMD_DFL_NOCOPY, -+ }; - int ret, len; - - /* if we don't have free ports, mcast frames will be dropped */ -@@ -1920,7 +1925,10 @@ static void iwl_mvm_mc_iface_iterator(void *_data, u8 *mac, - memcpy(cmd->bssid, vif->bss_conf.bssid, ETH_ALEN); - len = roundup(sizeof(*cmd) + cmd->count * ETH_ALEN, 4); - -- ret = iwl_mvm_send_cmd_pdu(mvm, MCAST_FILTER_CMD, CMD_ASYNC, len, cmd); -+ hcmd.len[0] = len; -+ hcmd.data[0] = cmd; -+ -+ ret = iwl_mvm_send_cmd(mvm, &hcmd); - if (ret) - IWL_ERR(mvm, "mcast filter cmd error. ret=%d\n", ret); - } -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index e2641d4dfdd6..d186d0282a38 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -1905,6 +1905,8 @@ static DEVICE_ATTR_RO(suspended); - static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver) - { - struct usb_composite_dev *cdev = get_gadget_data(gadget); -+ struct usb_gadget_strings *gstr = cdev->driver->strings[0]; -+ struct usb_string *dev_str = gstr->strings; - - /* composite_disconnect() must already have been called - * by the underlying peripheral controller driver! -@@ -1924,6 +1926,9 @@ static void __composite_unbind(struct usb_gadget *gadget, bool unbind_driver) - - composite_dev_cleanup(cdev); - -+ if (dev_str[USB_GADGET_MANUFACTURER_IDX].s == cdev->def_manufacturer) -+ dev_str[USB_GADGET_MANUFACTURER_IDX].s = ""; -+ - kfree(cdev->def_manufacturer); - kfree(cdev); - set_gadget_data(gadget, NULL); -diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c -index db645c38055d..8080a11947b7 100644 ---- a/drivers/usb/gadget/udc/dummy_hcd.c -+++ b/drivers/usb/gadget/udc/dummy_hcd.c -@@ -420,6 +420,7 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd) - static void set_link_state(struct dummy_hcd *dum_hcd) - { - struct dummy *dum = dum_hcd->dum; -+ unsigned int power_bit; - - dum_hcd->active = 0; - if (dum->pullup) -@@ -430,17 +431,19 @@ static void set_link_state(struct dummy_hcd *dum_hcd) - return; - - set_link_state_by_speed(dum_hcd); -+ power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ? -+ USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER); - - if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 || - dum_hcd->active) - dum_hcd->resuming = 0; - - /* Currently !connected or in reset */ -- if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 || -+ if ((dum_hcd->port_status & power_bit) == 0 || - (dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) { -- unsigned disconnect = USB_PORT_STAT_CONNECTION & -+ unsigned int disconnect = power_bit & - dum_hcd->old_status & (~dum_hcd->port_status); -- unsigned reset = USB_PORT_STAT_RESET & -+ unsigned int reset = USB_PORT_STAT_RESET & - (~dum_hcd->old_status) & dum_hcd->port_status; - - /* Report reset and disconnect events to the driver */ -diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c -index d95cd1a72b66..8bb9367ada45 100644 ---- a/drivers/usb/renesas_usbhs/fifo.c -+++ b/drivers/usb/renesas_usbhs/fifo.c -@@ -858,9 +858,9 @@ static void xfer_work(struct work_struct *work) - fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero); - - usbhs_pipe_running(pipe, 1); -- usbhsf_dma_start(pipe, fifo); - usbhs_pipe_set_trans_count_if_bulk(pipe, pkt->trans); - dma_async_issue_pending(chan); -+ usbhsf_dma_start(pipe, fifo); - usbhs_pipe_enable(pipe); - - xfer_work_end: -diff --git a/drivers/usb/serial/console.c b/drivers/usb/serial/console.c -index 3806e7014199..2938153fe7b1 100644 ---- a/drivers/usb/serial/console.c -+++ b/drivers/usb/serial/console.c -@@ -189,6 +189,7 @@ static int usb_console_setup(struct console *co, char *options) - tty_kref_put(tty); - reset_open_count: - port->port.count = 0; -+ info->port = NULL; - usb_autopm_put_interface(serial->interface); - error_get_interface: - usb_serial_put(serial); -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 41a6513646de..1f5ecf905b7d 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -170,6 +170,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ - { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ -+ { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */ - { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ - { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ - { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index e0385d6c0abb..30344efc123f 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1015,6 +1015,8 @@ static const struct usb_device_id id_table_combined[] = { - { USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) }, - { USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID), - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, -+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, -+ { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index 4fcf1cecb6d7..f9d15bd62785 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -609,6 +609,13 @@ - #define ADI_GNICE_PID 0xF000 - #define ADI_GNICEPLUS_PID 0xF001 - -+/* -+ * Cypress WICED USB UART -+ */ -+#define CYPRESS_VID 0x04B4 -+#define CYPRESS_WICED_BT_USB_PID 0x009B -+#define CYPRESS_WICED_WL_USB_PID 0xF900 -+ - /* - * Microchip Technology, Inc. - * -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 2a9944326210..db3d34c2c82e 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -522,6 +522,7 @@ static void option_instat_callback(struct urb *urb); - - /* TP-LINK Incorporated products */ - #define TPLINK_VENDOR_ID 0x2357 -+#define TPLINK_PRODUCT_LTE 0x000D - #define TPLINK_PRODUCT_MA180 0x0201 - - /* Changhong products */ -@@ -2011,6 +2012,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) }, - { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) }, - { USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) }, /* TP-Link LTE Module */ - { USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(TPLINK_VENDOR_ID, 0x9000), /* TP-Link MA260 */ -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 652b4334b26d..e1c1e329c877 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -174,6 +174,10 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x413c, 0x81b3)}, /* Dell Wireless 5809e Gobi(TM) 4G LTE Mobile Broadband Card (rev3) */ - {DEVICE_SWI(0x413c, 0x81b5)}, /* Dell Wireless 5811e QDL */ - {DEVICE_SWI(0x413c, 0x81b6)}, /* Dell Wireless 5811e QDL */ -+ {DEVICE_SWI(0x413c, 0x81cf)}, /* Dell Wireless 5819 */ -+ {DEVICE_SWI(0x413c, 0x81d0)}, /* Dell Wireless 5819 */ -+ {DEVICE_SWI(0x413c, 0x81d1)}, /* Dell Wireless 5818 */ -+ {DEVICE_SWI(0x413c, 0x81d2)}, /* Dell Wireless 5818 */ - - /* Huawei devices */ - {DEVICE_HWI(0x03f0, 0x581d)}, /* HP lt4112 LTE/HSPA+ Gobi 4G Modem (Huawei me906e) */ -diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h -index e2f6a79e9b01..8225de3c9743 100644 ---- a/fs/cifs/cifsglob.h -+++ b/fs/cifs/cifsglob.h -@@ -351,6 +351,8 @@ struct smb_version_operations { - unsigned int (*calc_smb_size)(void *); - /* check for STATUS_PENDING and process it in a positive case */ - bool (*is_status_pending)(char *, struct TCP_Server_Info *, int); -+ /* check for STATUS_NETWORK_SESSION_EXPIRED */ -+ bool (*is_session_expired)(char *); - /* send oplock break response */ - int (*oplock_response)(struct cifs_tcon *, struct cifs_fid *, - struct cifsInodeInfo *); -diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c -index b60150e5b5ce..0c92af11f4f4 100644 ---- a/fs/cifs/cifssmb.c -+++ b/fs/cifs/cifssmb.c -@@ -1460,6 +1460,13 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid) - return length; - server->total_read += length; - -+ if (server->ops->is_session_expired && -+ server->ops->is_session_expired(buf)) { -+ cifs_reconnect(server); -+ wake_up(&server->response_q); -+ return -1; -+ } -+ - if (server->ops->is_status_pending && - server->ops->is_status_pending(buf, server, 0)) { - discard_remaining_data(server); -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index b377aa8f266f..0a2bf9462637 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -850,6 +850,13 @@ standard_receive3(struct TCP_Server_Info *server, struct mid_q_entry *mid) - cifs_dump_mem("Bad SMB: ", buf, - min_t(unsigned int, server->total_read, 48)); - -+ if (server->ops->is_session_expired && -+ server->ops->is_session_expired(buf)) { -+ cifs_reconnect(server); -+ wake_up(&server->response_q); -+ return -1; -+ } -+ - if (server->ops->is_status_pending && - server->ops->is_status_pending(buf, server, length)) - return -1; -diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c -index 1d125d3d0d89..e6b1795fbf2a 100644 ---- a/fs/cifs/smb2ops.c -+++ b/fs/cifs/smb2ops.c -@@ -963,6 +963,18 @@ smb2_is_status_pending(char *buf, struct TCP_Server_Info *server, int length) - return true; - } - -+static bool -+smb2_is_session_expired(char *buf) -+{ -+ struct smb2_hdr *hdr = (struct smb2_hdr *)buf; -+ -+ if (hdr->Status != STATUS_NETWORK_SESSION_EXPIRED) -+ return false; -+ -+ cifs_dbg(FYI, "Session expired\n"); -+ return true; -+} -+ - static int - smb2_oplock_response(struct cifs_tcon *tcon, struct cifs_fid *fid, - struct cifsInodeInfo *cinode) -@@ -1552,6 +1564,7 @@ struct smb_version_operations smb20_operations = { - .close_dir = smb2_close_dir, - .calc_smb_size = smb2_calc_size, - .is_status_pending = smb2_is_status_pending, -+ .is_session_expired = smb2_is_session_expired, - .oplock_response = smb2_oplock_response, - .queryfs = smb2_queryfs, - .mand_lock = smb2_mand_lock, -@@ -1633,6 +1646,7 @@ struct smb_version_operations smb21_operations = { - .close_dir = smb2_close_dir, - .calc_smb_size = smb2_calc_size, - .is_status_pending = smb2_is_status_pending, -+ .is_session_expired = smb2_is_session_expired, - .oplock_response = smb2_oplock_response, - .queryfs = smb2_queryfs, - .mand_lock = smb2_mand_lock, -@@ -1715,6 +1729,7 @@ struct smb_version_operations smb30_operations = { - .close_dir = smb2_close_dir, - .calc_smb_size = smb2_calc_size, - .is_status_pending = smb2_is_status_pending, -+ .is_session_expired = smb2_is_session_expired, - .oplock_response = smb2_oplock_response, - .queryfs = smb2_queryfs, - .mand_lock = smb2_mand_lock, -@@ -1803,6 +1818,7 @@ struct smb_version_operations smb311_operations = { - .close_dir = smb2_close_dir, - .calc_smb_size = smb2_calc_size, - .is_status_pending = smb2_is_status_pending, -+ .is_session_expired = smb2_is_session_expired, - .oplock_response = smb2_oplock_response, - .queryfs = smb2_queryfs, - .mand_lock = smb2_mand_lock, -diff --git a/fs/direct-io.c b/fs/direct-io.c -index c772fdf36cd9..44f49d86d714 100644 ---- a/fs/direct-io.c -+++ b/fs/direct-io.c -@@ -823,7 +823,8 @@ out: - */ - if (sdio->boundary) { - ret = dio_send_cur_page(dio, sdio, map_bh); -- dio_bio_submit(dio, sdio); -+ if (sdio->bio) -+ dio_bio_submit(dio, sdio); - page_cache_release(sdio->cur_page); - sdio->cur_page = NULL; - } -diff --git a/fs/ext4/file.c b/fs/ext4/file.c -index 45ef9975caec..a8b1749d79a8 100644 ---- a/fs/ext4/file.c -+++ b/fs/ext4/file.c -@@ -559,7 +559,7 @@ static loff_t ext4_seek_data(struct file *file, loff_t offset, loff_t maxsize) - mutex_lock(&inode->i_mutex); - - isize = i_size_read(inode); -- if (offset >= isize) { -+ if (offset < 0 || offset >= isize) { - mutex_unlock(&inode->i_mutex); - return -ENXIO; - } -@@ -632,7 +632,7 @@ static loff_t ext4_seek_hole(struct file *file, loff_t offset, loff_t maxsize) - mutex_lock(&inode->i_mutex); - - isize = i_size_read(inode); -- if (offset >= isize) { -+ if (offset < 0 || offset >= isize) { - mutex_unlock(&inode->i_mutex); - return -ENXIO; - } -diff --git a/include/sound/seq_virmidi.h b/include/sound/seq_virmidi.h -index a03acd0d398a..695257ae64ac 100644 ---- a/include/sound/seq_virmidi.h -+++ b/include/sound/seq_virmidi.h -@@ -60,6 +60,7 @@ struct snd_virmidi_dev { - int port; /* created/attached port */ - unsigned int flags; /* SNDRV_VIRMIDI_* */ - rwlock_t filelist_lock; -+ struct rw_semaphore filelist_sem; - struct list_head filelist; - }; - -diff --git a/kernel/rcu/tree.c b/kernel/rcu/tree.c -index f07343b54fe5..8a62cbfe1f2f 100644 ---- a/kernel/rcu/tree.c -+++ b/kernel/rcu/tree.c -@@ -759,6 +759,12 @@ void rcu_irq_exit(void) - - local_irq_save(flags); - rdtp = this_cpu_ptr(&rcu_dynticks); -+ -+ /* Page faults can happen in NMI handlers, so check... */ -+ if (READ_ONCE(rdtp->dynticks_nmi_nesting)) -+ return; -+ -+ RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_exit() invoked with irqs enabled!!!"); - oldval = rdtp->dynticks_nesting; - rdtp->dynticks_nesting--; - WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && -@@ -887,6 +893,12 @@ void rcu_irq_enter(void) - - local_irq_save(flags); - rdtp = this_cpu_ptr(&rcu_dynticks); -+ -+ /* Page faults can happen in NMI handlers, so check... */ -+ if (READ_ONCE(rdtp->dynticks_nmi_nesting)) -+ return; -+ -+ RCU_LOCKDEP_WARN(!irqs_disabled(), "rcu_irq_enter() invoked with irqs enabled!!!"); - oldval = rdtp->dynticks_nesting; - rdtp->dynticks_nesting++; - WARN_ON_ONCE(IS_ENABLED(CONFIG_RCU_EQS_DEBUG) && -diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c -index 8ece212aa3d2..7950506395a8 100644 ---- a/net/wireless/nl80211.c -+++ b/net/wireless/nl80211.c -@@ -485,6 +485,14 @@ nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = { - [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 }, - }; - -+/* policy for packet pattern attributes */ -+static const struct nla_policy -+nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = { -+ [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, }, -+ [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, }, -+ [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 }, -+}; -+ - static int nl80211_prepare_wdev_dump(struct sk_buff *skb, - struct netlink_callback *cb, - struct cfg80211_registered_device **rdev, -@@ -9410,7 +9418,7 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info) - u8 *mask_pat; - - nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat), -- nla_len(pat), NULL); -+ nla_len(pat), nl80211_packet_pattern_policy); - err = -EINVAL; - if (!pat_tb[NL80211_PKTPAT_MASK] || - !pat_tb[NL80211_PKTPAT_PATTERN]) -@@ -9660,7 +9668,7 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, - u8 *mask_pat; - - nla_parse(pat_tb, MAX_NL80211_PKTPAT, nla_data(pat), -- nla_len(pat), NULL); -+ nla_len(pat), nl80211_packet_pattern_policy); - if (!pat_tb[NL80211_PKTPAT_MASK] || - !pat_tb[NL80211_PKTPAT_PATTERN]) - return -EINVAL; -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index e326c1d80416..e847b9923c19 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1260,6 +1260,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, - struct snd_seq_client_port *port; - struct snd_seq_port_info info; - struct snd_seq_port_callback *callback; -+ int port_idx; - - if (copy_from_user(&info, arg, sizeof(info))) - return -EFAULT; -@@ -1273,7 +1274,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, - return -ENOMEM; - - if (client->type == USER_CLIENT && info.kernel) { -- snd_seq_delete_port(client, port->addr.port); -+ port_idx = port->addr.port; -+ snd_seq_port_unlock(port); -+ snd_seq_delete_port(client, port_idx); - return -EINVAL; - } - if (client->type == KERNEL_CLIENT) { -@@ -1294,6 +1297,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, - - snd_seq_set_port_info(port, &info); - snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port); -+ snd_seq_port_unlock(port); - - if (copy_to_user(arg, &info, sizeof(info))) - return -EFAULT; -diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c -index fe686ee41c6d..f04714d70bf7 100644 ---- a/sound/core/seq/seq_ports.c -+++ b/sound/core/seq/seq_ports.c -@@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp) - } - - --/* create a port, port number is returned (-1 on failure) */ -+/* create a port, port number is returned (-1 on failure); -+ * the caller needs to unref the port via snd_seq_port_unlock() appropriately -+ */ - struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, - int port) - { -@@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, - snd_use_lock_init(&new_port->use_lock); - port_subs_info_init(&new_port->c_src); - port_subs_info_init(&new_port->c_dest); -+ snd_use_lock_use(&new_port->use_lock); - - num = port >= 0 ? port : 0; - mutex_lock(&client->ports_mutex); -@@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client, - list_add_tail(&new_port->list, &p->list); - client->num_ports++; - new_port->addr.port = num; /* store the port number in the port */ -+ sprintf(new_port->name, "port-%d", num); - write_unlock_irqrestore(&client->ports_lock, flags); - mutex_unlock(&client->ports_mutex); -- sprintf(new_port->name, "port-%d", num); - - return new_port; - } -diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c -index 81134e067184..3b126af4a026 100644 ---- a/sound/core/seq/seq_virmidi.c -+++ b/sound/core/seq/seq_virmidi.c -@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi, - * decode input event and put to read buffer of each opened file - */ - static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, -- struct snd_seq_event *ev) -+ struct snd_seq_event *ev, -+ bool atomic) - { - struct snd_virmidi *vmidi; - unsigned char msg[4]; - int len; - -- read_lock(&rdev->filelist_lock); -+ if (atomic) -+ read_lock(&rdev->filelist_lock); -+ else -+ down_read(&rdev->filelist_sem); - list_for_each_entry(vmidi, &rdev->filelist, list) { - if (!vmidi->trigger) - continue; -@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev, - snd_rawmidi_receive(vmidi->substream, msg, len); - } - } -- read_unlock(&rdev->filelist_lock); -+ if (atomic) -+ read_unlock(&rdev->filelist_lock); -+ else -+ up_read(&rdev->filelist_sem); - - return 0; - } -@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmidi *rmidi, struct snd_seq_event *ev) - struct snd_virmidi_dev *rdev; - - rdev = rmidi->private_data; -- return snd_virmidi_dev_receive_event(rdev, ev); -+ return snd_virmidi_dev_receive_event(rdev, ev, true); - } - #endif /* 0 */ - -@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struct snd_seq_event *ev, int direct, - rdev = private_data; - if (!(rdev->flags & SNDRV_VIRMIDI_USE)) - return 0; /* ignored */ -- return snd_virmidi_dev_receive_event(rdev, ev); -+ return snd_virmidi_dev_receive_event(rdev, ev, atomic); - } - - /* -@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream) - struct snd_virmidi_dev *rdev = substream->rmidi->private_data; - struct snd_rawmidi_runtime *runtime = substream->runtime; - struct snd_virmidi *vmidi; -- unsigned long flags; - - vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL); - if (vmidi == NULL) -@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream) - vmidi->client = rdev->client; - vmidi->port = rdev->port; - runtime->private_data = vmidi; -- write_lock_irqsave(&rdev->filelist_lock, flags); -+ down_write(&rdev->filelist_sem); -+ write_lock_irq(&rdev->filelist_lock); - list_add_tail(&vmidi->list, &rdev->filelist); -- write_unlock_irqrestore(&rdev->filelist_lock, flags); -+ write_unlock_irq(&rdev->filelist_lock); -+ up_write(&rdev->filelist_sem); - vmidi->rdev = rdev; - return 0; - } -@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream) - struct snd_virmidi_dev *rdev = substream->rmidi->private_data; - struct snd_virmidi *vmidi = substream->runtime->private_data; - -+ down_write(&rdev->filelist_sem); - write_lock_irq(&rdev->filelist_lock); - list_del(&vmidi->list); - write_unlock_irq(&rdev->filelist_lock); -+ up_write(&rdev->filelist_sem); - snd_midi_event_free(vmidi->parser); - substream->runtime->private_data = NULL; - kfree(vmidi); -@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *card, int device, struct snd_rawmidi **rrmi - rdev->rmidi = rmidi; - rdev->device = device; - rdev->client = -1; -+ init_rwsem(&rdev->filelist_sem); - rwlock_init(&rdev->filelist_lock); - INIT_LIST_HEAD(&rdev->filelist); - rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH; -diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c -index b871ba407e4e..4458190149d1 100644 ---- a/sound/usb/caiaq/device.c -+++ b/sound/usb/caiaq/device.c -@@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev) - - err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); - if (err) -- return err; -+ goto err_kill_urb; - -- if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) -- return -ENODEV; -+ if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) { -+ err = -ENODEV; -+ goto err_kill_urb; -+ } - - usb_string(usb_dev, usb_dev->descriptor.iManufacturer, - cdev->vendor_name, CAIAQ_USB_STR_LEN); -@@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev) - - setup_card(cdev); - return 0; -+ -+ err_kill_urb: -+ usb_kill_urb(&cdev->ep1_in_urb); -+ return err; - } - - static int snd_probe(struct usb_interface *intf, -diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c -index 183311cb849e..be78078a10ba 100644 ---- a/sound/usb/line6/driver.c -+++ b/sound/usb/line6/driver.c -@@ -586,9 +586,10 @@ int line6_probe(struct usb_interface *interface, - return 0; - - error: -- if (line6->disconnect) -- line6->disconnect(line6); -- snd_card_free(card); -+ /* we can call disconnect callback here because no close-sync is -+ * needed yet at this point -+ */ -+ line6_disconnect(interface); - return ret; - } - EXPORT_SYMBOL_GPL(line6_probe); -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 696de5ac69be..a23efc8671d6 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -2161,6 +2161,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid) - - static void snd_usb_mixer_free(struct usb_mixer_interface *mixer) - { -+ /* kill pending URBs */ -+ snd_usb_mixer_disconnect(mixer); -+ - kfree(mixer->id_elems); - if (mixer->urb) { - kfree(mixer->urb->transfer_buffer); -@@ -2504,8 +2507,13 @@ _error: - - void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer) - { -- usb_kill_urb(mixer->urb); -- usb_kill_urb(mixer->rc_urb); -+ if (mixer->disconnected) -+ return; -+ if (mixer->urb) -+ usb_kill_urb(mixer->urb); -+ if (mixer->rc_urb) -+ usb_kill_urb(mixer->rc_urb); -+ mixer->disconnected = true; - } - - #ifdef CONFIG_PM -diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h -index 2b4b067646ab..545d99b09706 100644 ---- a/sound/usb/mixer.h -+++ b/sound/usb/mixer.h -@@ -22,6 +22,8 @@ struct usb_mixer_interface { - struct urb *rc_urb; - struct usb_ctrlrequest *rc_setup_packet; - u8 rc_buffer[6]; -+ -+ bool disconnected; - }; - - #define MAX_CHANNELS 16 /* max logical channels */ diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.93-94.patch b/patch/kernel/mvebu64-default/03-patch-4.4.93-94.patch deleted file mode 100644 index e96b8060259f..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.93-94.patch +++ /dev/null @@ -1,1367 +0,0 @@ -diff --git a/Makefile b/Makefile -index 77a17fb24b6d..ff9d6bbf2210 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 93 -+SUBLEVEL = 94 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h -index 77edb22f855d..5433ccc9d706 100644 ---- a/arch/mips/include/asm/irq.h -+++ b/arch/mips/include/asm/irq.h -@@ -18,7 +18,7 @@ - #include - - #define IRQ_STACK_SIZE THREAD_SIZE --#define IRQ_STACK_START (IRQ_STACK_SIZE - sizeof(unsigned long)) -+#define IRQ_STACK_START (IRQ_STACK_SIZE - 16) - - extern void *irq_stack[NR_CPUS]; - -diff --git a/arch/sparc/include/asm/setup.h b/arch/sparc/include/asm/setup.h -index be0cc1beed41..3fae200dd251 100644 ---- a/arch/sparc/include/asm/setup.h -+++ b/arch/sparc/include/asm/setup.h -@@ -59,8 +59,11 @@ extern atomic_t dcpage_flushes; - extern atomic_t dcpage_flushes_xcall; - - extern int sysctl_tsb_ratio; --#endif - -+#ifdef CONFIG_SERIAL_SUNHV -+void sunhv_migrate_hvcons_irq(int cpu); -+#endif -+#endif - void sun_do_break(void); - extern int stop_a_enabled; - extern int scons_pwroff; -diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c -index 4511caa3b7e9..46866b2097e8 100644 ---- a/arch/sparc/kernel/smp_64.c -+++ b/arch/sparc/kernel/smp_64.c -@@ -1443,8 +1443,12 @@ void smp_send_stop(void) - int cpu; - - if (tlb_type == hypervisor) { -+ int this_cpu = smp_processor_id(); -+#ifdef CONFIG_SERIAL_SUNHV -+ sunhv_migrate_hvcons_irq(this_cpu); -+#endif - for_each_online_cpu(cpu) { -- if (cpu == smp_processor_id()) -+ if (cpu == this_cpu) - continue; - #ifdef CONFIG_SUN_LDOMS - if (ldom_domaining_enabled) { -diff --git a/block/bsg-lib.c b/block/bsg-lib.c -index 341b8d858e67..650f427d915b 100644 ---- a/block/bsg-lib.c -+++ b/block/bsg-lib.c -@@ -147,6 +147,7 @@ static int bsg_create_job(struct device *dev, struct request *req) - failjob_rls_rqst_payload: - kfree(job->request_payload.sg_list); - failjob_rls_job: -+ kfree(job); - return -ENOMEM; - } - -diff --git a/crypto/Kconfig b/crypto/Kconfig -index 7240821137fd..617bf4a7da56 100644 ---- a/crypto/Kconfig -+++ b/crypto/Kconfig -@@ -343,6 +343,7 @@ config CRYPTO_XTS - select CRYPTO_BLKCIPHER - select CRYPTO_MANAGER - select CRYPTO_GF128MUL -+ select CRYPTO_ECB - help - XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain, - key size 256, 384 or 512 bits. This implementation currently -diff --git a/drivers/cpufreq/Kconfig.arm b/drivers/cpufreq/Kconfig.arm -index b1f8a73e5a94..eed1e073d96d 100644 ---- a/drivers/cpufreq/Kconfig.arm -+++ b/drivers/cpufreq/Kconfig.arm -@@ -241,7 +241,7 @@ config ARM_PXA2xx_CPUFREQ - - config ACPI_CPPC_CPUFREQ - tristate "CPUFreq driver based on the ACPI CPPC spec" -- depends on ACPI -+ depends on ACPI_PROCESSOR - select ACPI_CPPC_LIB - default n - help -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 58bf94b69186..273e05a3c933 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -1802,6 +1802,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) - return -EINVAL; - } - req_payload.num_slots = mgr->proposed_vcpis[i]->num_slots; -+ req_payload.vcpi = mgr->proposed_vcpis[i]->vcpi; - } else { - port = NULL; - req_payload.num_slots = 0; -@@ -1817,6 +1818,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) - if (req_payload.num_slots) { - drm_dp_create_payload_step1(mgr, mgr->proposed_vcpis[i]->vcpi, &req_payload); - mgr->payloads[i].num_slots = req_payload.num_slots; -+ mgr->payloads[i].vcpi = req_payload.vcpi; - } else if (mgr->payloads[i].num_slots) { - mgr->payloads[i].num_slots = 0; - drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]); -diff --git a/drivers/i2c/busses/i2c-at91.c b/drivers/i2c/busses/i2c-at91.c -index 10835d1f559b..dee0fc421054 100644 ---- a/drivers/i2c/busses/i2c-at91.c -+++ b/drivers/i2c/busses/i2c-at91.c -@@ -1131,6 +1131,7 @@ static int at91_twi_suspend_noirq(struct device *dev) - - static int at91_twi_resume_noirq(struct device *dev) - { -+ struct at91_twi_dev *twi_dev = dev_get_drvdata(dev); - int ret; - - if (!pm_runtime_status_suspended(dev)) { -@@ -1142,6 +1143,8 @@ static int at91_twi_resume_noirq(struct device *dev) - pm_runtime_mark_last_busy(dev); - pm_request_autosuspend(dev); - -+ at91_init_twi_bus(twi_dev); -+ - return 0; - } - -diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c -index 02e636a1c49a..475c5a74f2d1 100644 ---- a/drivers/iio/adc/xilinx-xadc-core.c -+++ b/drivers/iio/adc/xilinx-xadc-core.c -@@ -1208,7 +1208,7 @@ static int xadc_probe(struct platform_device *pdev) - - ret = xadc->ops->setup(pdev, indio_dev, irq); - if (ret) -- goto err_free_samplerate_trigger; -+ goto err_clk_disable_unprepare; - - ret = request_irq(irq, xadc->ops->interrupt_handler, 0, - dev_name(&pdev->dev), indio_dev); -@@ -1268,6 +1268,8 @@ static int xadc_probe(struct platform_device *pdev) - - err_free_irq: - free_irq(irq, indio_dev); -+err_clk_disable_unprepare: -+ clk_disable_unprepare(xadc->clk); - err_free_samplerate_trigger: - if (xadc->ops->flags & XADC_FLAGS_BUFFERED) - iio_trigger_free(xadc->samplerate_trigger); -@@ -1277,8 +1279,6 @@ err_free_convst_trigger: - err_triggered_buffer_cleanup: - if (xadc->ops->flags & XADC_FLAGS_BUFFERED) - iio_triggered_buffer_cleanup(indio_dev); --err_clk_disable_unprepare: -- clk_disable_unprepare(xadc->clk); - err_device_free: - kfree(indio_dev->channels); - -diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c -index 75573fa431ba..63faee04a008 100644 ---- a/drivers/irqchip/irq-crossbar.c -+++ b/drivers/irqchip/irq-crossbar.c -@@ -198,7 +198,8 @@ static const struct irq_domain_ops crossbar_domain_ops = { - - static int __init crossbar_of_init(struct device_node *node) - { -- int i, size, max = 0, reserved = 0, entry; -+ int i, size, reserved = 0; -+ u32 max = 0, entry; - const __be32 *irqsr; - int ret = -ENOMEM; - -diff --git a/drivers/isdn/i4l/isdn_ppp.c b/drivers/isdn/i4l/isdn_ppp.c -index bf3fbd00a091..64b586458d3d 100644 ---- a/drivers/isdn/i4l/isdn_ppp.c -+++ b/drivers/isdn/i4l/isdn_ppp.c -@@ -828,7 +828,6 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) - isdn_net_local *lp; - struct ippp_struct *is; - int proto; -- unsigned char protobuf[4]; - - is = file->private_data; - -@@ -842,24 +841,28 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) - if (!lp) - printk(KERN_DEBUG "isdn_ppp_write: lp == NULL\n"); - else { -- /* -- * Don't reset huptimer for -- * LCP packets. (Echo requests). -- */ -- if (copy_from_user(protobuf, buf, 4)) -- return -EFAULT; -- proto = PPP_PROTOCOL(protobuf); -- if (proto != PPP_LCP) -- lp->huptimer = 0; -+ if (lp->isdn_device < 0 || lp->isdn_channel < 0) { -+ unsigned char protobuf[4]; -+ /* -+ * Don't reset huptimer for -+ * LCP packets. (Echo requests). -+ */ -+ if (copy_from_user(protobuf, buf, 4)) -+ return -EFAULT; -+ -+ proto = PPP_PROTOCOL(protobuf); -+ if (proto != PPP_LCP) -+ lp->huptimer = 0; - -- if (lp->isdn_device < 0 || lp->isdn_channel < 0) - return 0; -+ } - - if ((dev->drv[lp->isdn_device]->flags & DRV_FLAG_RUNNING) && - lp->dialstate == 0 && - (lp->flags & ISDN_NET_CONNECTED)) { - unsigned short hl; - struct sk_buff *skb; -+ unsigned char *cpy_buf; - /* - * we need to reserve enough space in front of - * sk_buff. old call to dev_alloc_skb only reserved -@@ -872,11 +875,21 @@ isdn_ppp_write(int min, struct file *file, const char __user *buf, int count) - return count; - } - skb_reserve(skb, hl); -- if (copy_from_user(skb_put(skb, count), buf, count)) -+ cpy_buf = skb_put(skb, count); -+ if (copy_from_user(cpy_buf, buf, count)) - { - kfree_skb(skb); - return -EFAULT; - } -+ -+ /* -+ * Don't reset huptimer for -+ * LCP packets. (Echo requests). -+ */ -+ proto = PPP_PROTOCOL(cpy_buf); -+ if (proto != PPP_LCP) -+ lp->huptimer = 0; -+ - if (is->debug & 0x40) { - printk(KERN_DEBUG "ppp xmit: len %d\n", (int) skb->len); - isdn_ppp_frame_log("xmit", skb->data, skb->len, 32, is->unit, lp->ppp_slot); -diff --git a/drivers/md/linear.c b/drivers/md/linear.c -index 6ba3227e29b2..7ffb20ec1a46 100644 ---- a/drivers/md/linear.c -+++ b/drivers/md/linear.c -@@ -223,7 +223,8 @@ static int linear_add(struct mddev *mddev, struct md_rdev *rdev) - * oldconf until no one uses it anymore. - */ - mddev_suspend(mddev); -- oldconf = rcu_dereference(mddev->private); -+ oldconf = rcu_dereference_protected(mddev->private, -+ lockdep_is_held(&mddev->reconfig_mutex)); - mddev->raid_disks++; - WARN_ONCE(mddev->raid_disks != newconf->raid_disks, - "copied raid_disks doesn't match mddev->raid_disks"); -diff --git a/drivers/net/ethernet/ibm/emac/mal.c b/drivers/net/ethernet/ibm/emac/mal.c -index fdb5cdb3cd15..81abe46c9e0d 100644 ---- a/drivers/net/ethernet/ibm/emac/mal.c -+++ b/drivers/net/ethernet/ibm/emac/mal.c -@@ -402,7 +402,7 @@ static int mal_poll(struct napi_struct *napi, int budget) - unsigned long flags; - - MAL_DBG2(mal, "poll(%d)" NL, budget); -- again: -+ - /* Process TX skbs */ - list_for_each(l, &mal->poll_list) { - struct mal_commac *mc = -@@ -451,7 +451,6 @@ static int mal_poll(struct napi_struct *napi, int budget) - spin_lock_irqsave(&mal->lock, flags); - mal_disable_eob_irq(mal); - spin_unlock_irqrestore(&mal->lock, flags); -- goto again; - } - mc->ops->poll_tx(mc->dev); - } -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_clock.c b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -index 1494997c4f7e..4dccf7287f0f 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_clock.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_clock.c -@@ -88,10 +88,17 @@ void mlx4_en_remove_timestamp(struct mlx4_en_dev *mdev) - } - } - -+#define MLX4_EN_WRAP_AROUND_SEC 10UL -+/* By scheduling the overflow check every 5 seconds, we have a reasonably -+ * good chance we wont miss a wrap around. -+ * TOTO: Use a timer instead of a work queue to increase the guarantee. -+ */ -+#define MLX4_EN_OVERFLOW_PERIOD (MLX4_EN_WRAP_AROUND_SEC * HZ / 2) -+ - void mlx4_en_ptp_overflow_check(struct mlx4_en_dev *mdev) - { - bool timeout = time_is_before_jiffies(mdev->last_overflow_check + -- mdev->overflow_period); -+ MLX4_EN_OVERFLOW_PERIOD); - unsigned long flags; - - if (timeout) { -@@ -236,7 +243,6 @@ static const struct ptp_clock_info mlx4_en_ptp_clock_info = { - .enable = mlx4_en_phc_enable, - }; - --#define MLX4_EN_WRAP_AROUND_SEC 10ULL - - /* This function calculates the max shift that enables the user range - * of MLX4_EN_WRAP_AROUND_SEC values in the cycles register. -@@ -258,7 +264,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev) - { - struct mlx4_dev *dev = mdev->dev; - unsigned long flags; -- u64 ns, zero = 0; - - /* mlx4_en_init_timestamp is called for each netdev. - * mdev->ptp_clock is common for all ports, skip initialization if -@@ -282,13 +287,6 @@ void mlx4_en_init_timestamp(struct mlx4_en_dev *mdev) - ktime_to_ns(ktime_get_real())); - write_unlock_irqrestore(&mdev->clock_lock, flags); - -- /* Calculate period in seconds to call the overflow watchdog - to make -- * sure counter is checked at least once every wrap around. -- */ -- ns = cyclecounter_cyc2ns(&mdev->cycles, mdev->cycles.mask, zero, &zero); -- do_div(ns, NSEC_PER_SEC / 2 / HZ); -- mdev->overflow_period = ns; -- - /* Configure the PHC */ - mdev->ptp_clock_info = mlx4_en_ptp_clock_info; - snprintf(mdev->ptp_clock_info.name, 16, "mlx4 ptp"); -diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c -index 31c491e02e69..99361352ed0d 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/main.c -+++ b/drivers/net/ethernet/mellanox/mlx4/main.c -@@ -791,8 +791,6 @@ static int mlx4_slave_cap(struct mlx4_dev *dev) - return -ENOSYS; - } - -- mlx4_log_num_mgm_entry_size = hca_param.log_mc_entry_sz; -- - dev->caps.hca_core_clock = hca_param.hca_core_clock; - - memset(&dev_cap, 0, sizeof(dev_cap)); -diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -index c41f15102ae0..10aa6544cf4d 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -+++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h -@@ -409,7 +409,6 @@ struct mlx4_en_dev { - struct cyclecounter cycles; - struct timecounter clock; - unsigned long last_overflow_check; -- unsigned long overflow_period; - struct ptp_clock *ptp_clock; - struct ptp_clock_info ptp_clock_info; - struct notifier_block nb; -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index c31d8e74f131..cd191f82d816 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1195,11 +1195,13 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - switch (tun->flags & TUN_TYPE_MASK) { - case IFF_TUN: - if (tun->flags & IFF_NO_PI) { -- switch (skb->data[0] & 0xf0) { -- case 0x40: -+ u8 ip_version = skb->len ? (skb->data[0] >> 4) : 0; -+ -+ switch (ip_version) { -+ case 4: - pi.proto = htons(ETH_P_IP); - break; -- case 0x60: -+ case 6: - pi.proto = htons(ETH_P_IPV6); - break; - default: -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 019d7165a045..2a996a68fc2b 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2884,6 +2884,7 @@ static int hwsim_register_received_nl(struct sk_buff *skb_2, - static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) - { - struct hwsim_new_radio_params param = { 0 }; -+ const char *hwname = NULL; - - param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG]; - param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE]; -@@ -2897,8 +2898,14 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) - if (info->attrs[HWSIM_ATTR_NO_VIF]) - param.no_vif = true; - -- if (info->attrs[HWSIM_ATTR_RADIO_NAME]) -- param.hwname = nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]); -+ if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { -+ hwname = kasprintf(GFP_KERNEL, "%.*s", -+ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), -+ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); -+ if (!hwname) -+ return -ENOMEM; -+ param.hwname = hwname; -+ } - - if (info->attrs[HWSIM_ATTR_USE_CHANCTX]) - param.use_chanctx = true; -@@ -2926,11 +2933,15 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) - s64 idx = -1; - const char *hwname = NULL; - -- if (info->attrs[HWSIM_ATTR_RADIO_ID]) -+ if (info->attrs[HWSIM_ATTR_RADIO_ID]) { - idx = nla_get_u32(info->attrs[HWSIM_ATTR_RADIO_ID]); -- else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) -- hwname = (void *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME]); -- else -+ } else if (info->attrs[HWSIM_ATTR_RADIO_NAME]) { -+ hwname = kasprintf(GFP_KERNEL, "%.*s", -+ nla_len(info->attrs[HWSIM_ATTR_RADIO_NAME]), -+ (char *)nla_data(info->attrs[HWSIM_ATTR_RADIO_NAME])); -+ if (!hwname) -+ return -ENOMEM; -+ } else - return -EINVAL; - - spin_lock_bh(&hwsim_radio_lock); -@@ -2939,7 +2950,8 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) - if (data->idx != idx) - continue; - } else { -- if (strcmp(hwname, wiphy_name(data->hw->wiphy))) -+ if (!hwname || -+ strcmp(hwname, wiphy_name(data->hw->wiphy))) - continue; - } - -@@ -2947,10 +2959,12 @@ static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) - spin_unlock_bh(&hwsim_radio_lock); - mac80211_hwsim_del_radio(data, wiphy_name(data->hw->wiphy), - info); -+ kfree(hwname); - return 0; - } - spin_unlock_bh(&hwsim_radio_lock); - -+ kfree(hwname); - return -ENODEV; - } - -diff --git a/drivers/scsi/device_handler/scsi_dh_emc.c b/drivers/scsi/device_handler/scsi_dh_emc.c -index e6fb97cb12f4..7c28dc1cb0dd 100644 ---- a/drivers/scsi/device_handler/scsi_dh_emc.c -+++ b/drivers/scsi/device_handler/scsi_dh_emc.c -@@ -456,7 +456,7 @@ static int clariion_prep_fn(struct scsi_device *sdev, struct request *req) - static int clariion_std_inquiry(struct scsi_device *sdev, - struct clariion_dh_data *csdev) - { -- int err; -+ int err = SCSI_DH_OK; - char *sp_model; - - err = send_inquiry_cmd(sdev, 0, csdev); -diff --git a/drivers/target/iscsi/iscsi_target_erl0.c b/drivers/target/iscsi/iscsi_target_erl0.c -index 6c88fb021444..4eeb82cf79e4 100644 ---- a/drivers/target/iscsi/iscsi_target_erl0.c -+++ b/drivers/target/iscsi/iscsi_target_erl0.c -@@ -44,10 +44,8 @@ void iscsit_set_dataout_sequence_values( - */ - if (cmd->unsolicited_data) { - cmd->seq_start_offset = cmd->write_data_done; -- cmd->seq_end_offset = (cmd->write_data_done + -- ((cmd->se_cmd.data_length > -- conn->sess->sess_ops->FirstBurstLength) ? -- conn->sess->sess_ops->FirstBurstLength : cmd->se_cmd.data_length)); -+ cmd->seq_end_offset = min(cmd->se_cmd.data_length, -+ conn->sess->sess_ops->FirstBurstLength); - return; - } - -diff --git a/drivers/tty/goldfish.c b/drivers/tty/goldfish.c -index e04b57f79df8..0f82c0b146f6 100644 ---- a/drivers/tty/goldfish.c -+++ b/drivers/tty/goldfish.c -@@ -293,7 +293,7 @@ static int goldfish_tty_probe(struct platform_device *pdev) - return 0; - - err_tty_register_device_failed: -- free_irq(irq, qtty); -+ free_irq(irq, pdev); - err_request_irq_failed: - goldfish_tty_current_line_count--; - if (goldfish_tty_current_line_count == 0) -diff --git a/drivers/tty/serial/sunhv.c b/drivers/tty/serial/sunhv.c -index 4e603d060e80..59828d819145 100644 ---- a/drivers/tty/serial/sunhv.c -+++ b/drivers/tty/serial/sunhv.c -@@ -398,6 +398,12 @@ static struct uart_driver sunhv_reg = { - - static struct uart_port *sunhv_port; - -+void sunhv_migrate_hvcons_irq(int cpu) -+{ -+ /* Migrate hvcons irq to param cpu */ -+ irq_force_affinity(sunhv_port->irq, cpumask_of(cpu)); -+} -+ - /* Copy 's' into the con_write_page, decoding "\n" into - * "\r\n" along the way. We have to return two lengths - * because the caller needs to know how much to advance -diff --git a/drivers/watchdog/kempld_wdt.c b/drivers/watchdog/kempld_wdt.c -index 5bf931ce1353..978098f71761 100644 ---- a/drivers/watchdog/kempld_wdt.c -+++ b/drivers/watchdog/kempld_wdt.c -@@ -140,12 +140,19 @@ static int kempld_wdt_set_stage_timeout(struct kempld_wdt_data *wdt_data, - unsigned int timeout) - { - struct kempld_device_data *pld = wdt_data->pld; -- u32 prescaler = kempld_prescaler[PRESCALER_21]; -+ u32 prescaler; - u64 stage_timeout64; - u32 stage_timeout; - u32 remainder; - u8 stage_cfg; - -+#if GCC_VERSION < 40400 -+ /* work around a bug compiling do_div() */ -+ prescaler = READ_ONCE(kempld_prescaler[PRESCALER_21]); -+#else -+ prescaler = kempld_prescaler[PRESCALER_21]; -+#endif -+ - if (!stage) - return -EINVAL; - -diff --git a/fs/btrfs/send.c b/fs/btrfs/send.c -index 63a6152be04b..c5bbb5300658 100644 ---- a/fs/btrfs/send.c -+++ b/fs/btrfs/send.c -@@ -1648,6 +1648,9 @@ static int is_inode_existent(struct send_ctx *sctx, u64 ino, u64 gen) - { - int ret; - -+ if (ino == BTRFS_FIRST_FREE_OBJECTID) -+ return 1; -+ - ret = get_cur_inode_state(sctx, ino, gen); - if (ret < 0) - goto out; -@@ -1833,7 +1836,7 @@ static int will_overwrite_ref(struct send_ctx *sctx, u64 dir, u64 dir_gen, - * not delted and then re-created, if it was then we have no overwrite - * and we can just unlink this entry. - */ -- if (sctx->parent_root) { -+ if (sctx->parent_root && dir != BTRFS_FIRST_FREE_OBJECTID) { - ret = get_inode_info(sctx->parent_root, dir, NULL, &gen, NULL, - NULL, NULL, NULL); - if (ret < 0 && ret != -ENOENT) -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index f54f77037d22..ead89489ae71 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -1845,13 +1845,18 @@ static int build_dentry_path(struct dentry *dentry, - int *pfreepath) - { - char *path; -+ struct inode *dir; - -- if (ceph_snap(d_inode(dentry->d_parent)) == CEPH_NOSNAP) { -- *pino = ceph_ino(d_inode(dentry->d_parent)); -+ rcu_read_lock(); -+ dir = d_inode_rcu(dentry->d_parent); -+ if (dir && ceph_snap(dir) == CEPH_NOSNAP) { -+ *pino = ceph_ino(dir); -+ rcu_read_unlock(); - *ppath = dentry->d_name.name; - *ppathlen = dentry->d_name.len; - return 0; - } -+ rcu_read_unlock(); - path = ceph_mdsc_build_path(dentry, ppathlen, pino, 1); - if (IS_ERR(path)) - return PTR_ERR(path); -diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c -index 972eab7ac071..98b2fc2678ff 100644 ---- a/fs/f2fs/data.c -+++ b/fs/f2fs/data.c -@@ -1416,7 +1416,12 @@ static int f2fs_write_begin(struct file *file, struct address_space *mapping, - goto fail; - } - repeat: -- page = grab_cache_page_write_begin(mapping, index, flags); -+ /* -+ * Do not use grab_cache_page_write_begin() to avoid deadlock due to -+ * wait_for_stable_page. Will wait that below with our IO control. -+ */ -+ page = pagecache_get_page(mapping, index, -+ FGP_LOCK | FGP_WRITE | FGP_CREAT, GFP_NOFS); - if (!page) { - err = -ENOMEM; - goto fail; -diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c -index 15bdc2d48cfe..24ace275160c 100644 ---- a/fs/nfsd/nfs4callback.c -+++ b/fs/nfsd/nfs4callback.c -@@ -696,6 +696,14 @@ int set_callback_cred(void) - return 0; - } - -+void cleanup_callback_cred(void) -+{ -+ if (callback_cred) { -+ put_rpccred(callback_cred); -+ callback_cred = NULL; -+ } -+} -+ - static struct rpc_cred *get_backchannel_cred(struct nfs4_client *clp, struct rpc_clnt *client, struct nfsd4_session *ses) - { - if (clp->cl_minorversion == 0) { -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 9e5a6842346e..ca9ebc3242d3 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -6792,23 +6792,24 @@ nfs4_state_start(void) - - ret = set_callback_cred(); - if (ret) -- return -ENOMEM; -+ return ret; -+ - laundry_wq = alloc_workqueue("%s", WQ_UNBOUND, 0, "nfsd4"); - if (laundry_wq == NULL) { - ret = -ENOMEM; -- goto out_recovery; -+ goto out_cleanup_cred; - } - ret = nfsd4_create_callback_queue(); - if (ret) - goto out_free_laundry; - - set_max_delegations(); -- - return 0; - - out_free_laundry: - destroy_workqueue(laundry_wq); --out_recovery: -+out_cleanup_cred: -+ cleanup_callback_cred(); - return ret; - } - -@@ -6847,6 +6848,7 @@ nfs4_state_shutdown(void) - { - destroy_workqueue(laundry_wq); - nfsd4_destroy_callback_queue(); -+ cleanup_callback_cred(); - } - - static void -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index 5134eedcb16c..86af697c21d3 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -595,6 +595,7 @@ extern struct nfs4_client_reclaim *nfsd4_find_reclaim_client(const char *recdir, - extern __be32 nfs4_check_open_reclaim(clientid_t *clid, - struct nfsd4_compound_state *cstate, struct nfsd_net *nn); - extern int set_callback_cred(void); -+extern void cleanup_callback_cred(void); - extern void nfsd4_probe_callback(struct nfs4_client *clp); - extern void nfsd4_probe_callback_sync(struct nfs4_client *clp); - extern void nfsd4_change_callback(struct nfs4_client *clp, struct nfs4_cb_conn *); -diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c -index 60a5f1548cd9..555b57a16499 100644 ---- a/fs/ocfs2/dlmglue.c -+++ b/fs/ocfs2/dlmglue.c -@@ -531,6 +531,7 @@ void ocfs2_lock_res_init_once(struct ocfs2_lock_res *res) - init_waitqueue_head(&res->l_event); - INIT_LIST_HEAD(&res->l_blocked_list); - INIT_LIST_HEAD(&res->l_mask_waiters); -+ INIT_LIST_HEAD(&res->l_holders); - } - - void ocfs2_inode_lock_res_init(struct ocfs2_lock_res *res, -@@ -748,6 +749,50 @@ void ocfs2_lock_res_free(struct ocfs2_lock_res *res) - res->l_flags = 0UL; - } - -+/* -+ * Keep a list of processes who have interest in a lockres. -+ * Note: this is now only uesed for check recursive cluster locking. -+ */ -+static inline void ocfs2_add_holder(struct ocfs2_lock_res *lockres, -+ struct ocfs2_lock_holder *oh) -+{ -+ INIT_LIST_HEAD(&oh->oh_list); -+ oh->oh_owner_pid = get_pid(task_pid(current)); -+ -+ spin_lock(&lockres->l_lock); -+ list_add_tail(&oh->oh_list, &lockres->l_holders); -+ spin_unlock(&lockres->l_lock); -+} -+ -+static inline void ocfs2_remove_holder(struct ocfs2_lock_res *lockres, -+ struct ocfs2_lock_holder *oh) -+{ -+ spin_lock(&lockres->l_lock); -+ list_del(&oh->oh_list); -+ spin_unlock(&lockres->l_lock); -+ -+ put_pid(oh->oh_owner_pid); -+} -+ -+static inline int ocfs2_is_locked_by_me(struct ocfs2_lock_res *lockres) -+{ -+ struct ocfs2_lock_holder *oh; -+ struct pid *pid; -+ -+ /* look in the list of holders for one with the current task as owner */ -+ spin_lock(&lockres->l_lock); -+ pid = task_pid(current); -+ list_for_each_entry(oh, &lockres->l_holders, oh_list) { -+ if (oh->oh_owner_pid == pid) { -+ spin_unlock(&lockres->l_lock); -+ return 1; -+ } -+ } -+ spin_unlock(&lockres->l_lock); -+ -+ return 0; -+} -+ - static inline void ocfs2_inc_holders(struct ocfs2_lock_res *lockres, - int level) - { -@@ -2343,8 +2388,9 @@ int ocfs2_inode_lock_full_nested(struct inode *inode, - goto getbh; - } - -- if (ocfs2_mount_local(osb)) -- goto local; -+ if ((arg_flags & OCFS2_META_LOCK_GETBH) || -+ ocfs2_mount_local(osb)) -+ goto update; - - if (!(arg_flags & OCFS2_META_LOCK_RECOVERY)) - ocfs2_wait_for_recovery(osb); -@@ -2373,7 +2419,7 @@ int ocfs2_inode_lock_full_nested(struct inode *inode, - if (!(arg_flags & OCFS2_META_LOCK_RECOVERY)) - ocfs2_wait_for_recovery(osb); - --local: -+update: - /* - * We only see this flag if we're being called from - * ocfs2_read_locked_inode(). It means we're locking an inode -@@ -2515,6 +2561,59 @@ void ocfs2_inode_unlock(struct inode *inode, - ocfs2_cluster_unlock(OCFS2_SB(inode->i_sb), lockres, level); - } - -+/* -+ * This _tracker variantes are introduced to deal with the recursive cluster -+ * locking issue. The idea is to keep track of a lock holder on the stack of -+ * the current process. If there's a lock holder on the stack, we know the -+ * task context is already protected by cluster locking. Currently, they're -+ * used in some VFS entry routines. -+ * -+ * return < 0 on error, return == 0 if there's no lock holder on the stack -+ * before this call, return == 1 if this call would be a recursive locking. -+ */ -+int ocfs2_inode_lock_tracker(struct inode *inode, -+ struct buffer_head **ret_bh, -+ int ex, -+ struct ocfs2_lock_holder *oh) -+{ -+ int status; -+ int arg_flags = 0, has_locked; -+ struct ocfs2_lock_res *lockres; -+ -+ lockres = &OCFS2_I(inode)->ip_inode_lockres; -+ has_locked = ocfs2_is_locked_by_me(lockres); -+ /* Just get buffer head if the cluster lock has been taken */ -+ if (has_locked) -+ arg_flags = OCFS2_META_LOCK_GETBH; -+ -+ if (likely(!has_locked || ret_bh)) { -+ status = ocfs2_inode_lock_full(inode, ret_bh, ex, arg_flags); -+ if (status < 0) { -+ if (status != -ENOENT) -+ mlog_errno(status); -+ return status; -+ } -+ } -+ if (!has_locked) -+ ocfs2_add_holder(lockres, oh); -+ -+ return has_locked; -+} -+ -+void ocfs2_inode_unlock_tracker(struct inode *inode, -+ int ex, -+ struct ocfs2_lock_holder *oh, -+ int had_lock) -+{ -+ struct ocfs2_lock_res *lockres; -+ -+ lockres = &OCFS2_I(inode)->ip_inode_lockres; -+ if (!had_lock) { -+ ocfs2_remove_holder(lockres, oh); -+ ocfs2_inode_unlock(inode, ex); -+ } -+} -+ - int ocfs2_orphan_scan_lock(struct ocfs2_super *osb, u32 *seqno) - { - struct ocfs2_lock_res *lockres; -diff --git a/fs/ocfs2/dlmglue.h b/fs/ocfs2/dlmglue.h -index d293a22c32c5..a7fc18ba0dc1 100644 ---- a/fs/ocfs2/dlmglue.h -+++ b/fs/ocfs2/dlmglue.h -@@ -70,6 +70,11 @@ struct ocfs2_orphan_scan_lvb { - __be32 lvb_os_seqno; - }; - -+struct ocfs2_lock_holder { -+ struct list_head oh_list; -+ struct pid *oh_owner_pid; -+}; -+ - /* ocfs2_inode_lock_full() 'arg_flags' flags */ - /* don't wait on recovery. */ - #define OCFS2_META_LOCK_RECOVERY (0x01) -@@ -77,6 +82,8 @@ struct ocfs2_orphan_scan_lvb { - #define OCFS2_META_LOCK_NOQUEUE (0x02) - /* don't block waiting for the downconvert thread, instead return -EAGAIN */ - #define OCFS2_LOCK_NONBLOCK (0x04) -+/* just get back disk inode bh if we've got cluster lock. */ -+#define OCFS2_META_LOCK_GETBH (0x08) - - /* Locking subclasses of inode cluster lock */ - enum { -@@ -170,4 +177,15 @@ void ocfs2_put_dlm_debug(struct ocfs2_dlm_debug *dlm_debug); - - /* To set the locking protocol on module initialization */ - void ocfs2_set_locking_protocol(void); -+ -+/* The _tracker pair is used to avoid cluster recursive locking */ -+int ocfs2_inode_lock_tracker(struct inode *inode, -+ struct buffer_head **ret_bh, -+ int ex, -+ struct ocfs2_lock_holder *oh); -+void ocfs2_inode_unlock_tracker(struct inode *inode, -+ int ex, -+ struct ocfs2_lock_holder *oh, -+ int had_lock); -+ - #endif /* DLMGLUE_H */ -diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h -index 7a0126267847..2495066a9ca3 100644 ---- a/fs/ocfs2/ocfs2.h -+++ b/fs/ocfs2/ocfs2.h -@@ -172,6 +172,7 @@ struct ocfs2_lock_res { - - struct list_head l_blocked_list; - struct list_head l_mask_waiters; -+ struct list_head l_holders; - - unsigned long l_flags; - char l_name[OCFS2_LOCK_ID_MAX_LEN]; -diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h -index 4d9f233c4ba8..7d58ffdacd62 100644 ---- a/include/asm-generic/percpu.h -+++ b/include/asm-generic/percpu.h -@@ -105,15 +105,35 @@ do { \ - (__ret); \ - }) - --#define this_cpu_generic_read(pcp) \ -+#define __this_cpu_generic_read_nopreempt(pcp) \ - ({ \ - typeof(pcp) __ret; \ - preempt_disable(); \ -- __ret = *this_cpu_ptr(&(pcp)); \ -+ __ret = READ_ONCE(*raw_cpu_ptr(&(pcp))); \ - preempt_enable(); \ - __ret; \ - }) - -+#define __this_cpu_generic_read_noirq(pcp) \ -+({ \ -+ typeof(pcp) __ret; \ -+ unsigned long __flags; \ -+ raw_local_irq_save(__flags); \ -+ __ret = *raw_cpu_ptr(&(pcp)); \ -+ raw_local_irq_restore(__flags); \ -+ __ret; \ -+}) -+ -+#define this_cpu_generic_read(pcp) \ -+({ \ -+ typeof(pcp) __ret; \ -+ if (__native_word(pcp)) \ -+ __ret = __this_cpu_generic_read_nopreempt(pcp); \ -+ else \ -+ __ret = __this_cpu_generic_read_noirq(pcp); \ -+ __ret; \ -+}) -+ - #define this_cpu_generic_to_op(pcp, val, op) \ - do { \ - unsigned long __flags; \ -diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h -index 925730bc9fc1..311176f290b2 100644 ---- a/include/linux/trace_events.h -+++ b/include/linux/trace_events.h -@@ -301,6 +301,7 @@ struct trace_event_call { - int perf_refcount; - struct hlist_head __percpu *perf_events; - struct bpf_prog *prog; -+ struct perf_event *bpf_prog_owner; - - int (*perf_perm)(struct trace_event_call *, - struct perf_event *); -diff --git a/include/net/sctp/ulpevent.h b/include/net/sctp/ulpevent.h -index cccdcfd14973..f348c736e6e0 100644 ---- a/include/net/sctp/ulpevent.h -+++ b/include/net/sctp/ulpevent.h -@@ -141,8 +141,12 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event); - static inline int sctp_ulpevent_type_enabled(__u16 sn_type, - struct sctp_event_subscribe *mask) - { -+ int offset = sn_type - SCTP_SN_TYPE_BASE; - char *amask = (char *) mask; -- return amask[sn_type - SCTP_SN_TYPE_BASE]; -+ -+ if (offset >= sizeof(struct sctp_event_subscribe)) -+ return 0; -+ return amask[offset]; - } - - /* Given an event subscription, is this event enabled? */ -diff --git a/include/uapi/linux/mroute6.h b/include/uapi/linux/mroute6.h -index ce91215cf7e6..e0b566dc72ef 100644 ---- a/include/uapi/linux/mroute6.h -+++ b/include/uapi/linux/mroute6.h -@@ -3,6 +3,7 @@ - - #include - #include -+#include /* For struct sockaddr_in6. */ - - /* - * Based on the MROUTING 3.5 defines primarily to keep -diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h -index 0f9265cb2a96..7af20a136429 100644 ---- a/include/uapi/linux/rds.h -+++ b/include/uapi/linux/rds.h -@@ -35,6 +35,7 @@ - #define _LINUX_RDS_H - - #include -+#include /* For __kernel_sockaddr_storage. */ - - #define RDS_IB_ABI_VERSION 0x301 - -@@ -223,7 +224,7 @@ struct rds_get_mr_args { - }; - - struct rds_get_mr_for_dest_args { -- struct sockaddr_storage dest_addr; -+ struct __kernel_sockaddr_storage dest_addr; - struct rds_iovec vec; - uint64_t cookie_addr; - uint64_t flags; -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 863e24f1e62e..70dc6dcf8649 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -1033,7 +1033,8 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn) - } - } else { - if (insn->src_reg != BPF_REG_0 || insn->off != 0 || -- (insn->imm != 16 && insn->imm != 32 && insn->imm != 64)) { -+ (insn->imm != 16 && insn->imm != 32 && insn->imm != 64) || -+ BPF_CLASS(insn->code) == BPF_ALU64) { - verbose("BPF_END uses reserved fields\n"); - return -EINVAL; - } -diff --git a/kernel/events/core.c b/kernel/events/core.c -index 3697063dd09a..8f75386e61a7 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -7108,6 +7108,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd) - } - - event->tp_event->prog = prog; -+ event->tp_event->bpf_prog_owner = event; - - return 0; - } -@@ -7120,7 +7121,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event) - return; - - prog = event->tp_event->prog; -- if (prog) { -+ if (prog && event->tp_event->bpf_prog_owner == event) { - event->tp_event->prog = NULL; - bpf_prog_put_rcu(prog); - } -diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c -index 60ace56618f6..0e2c4911ba61 100644 ---- a/kernel/locking/lockdep.c -+++ b/kernel/locking/lockdep.c -@@ -3128,10 +3128,17 @@ static int __lock_acquire(struct lockdep_map *lock, unsigned int subclass, - if (depth) { - hlock = curr->held_locks + depth - 1; - if (hlock->class_idx == class_idx && nest_lock) { -- if (hlock->references) -+ if (hlock->references) { -+ /* -+ * Check: unsigned int references:12, overflow. -+ */ -+ if (DEBUG_LOCKS_WARN_ON(hlock->references == (1 << 12)-1)) -+ return 0; -+ - hlock->references++; -- else -+ } else { - hlock->references = 2; -+ } - - return 1; - } -diff --git a/mm/slab_common.c b/mm/slab_common.c -index bec2fce9fafc..01e7246de8df 100644 ---- a/mm/slab_common.c -+++ b/mm/slab_common.c -@@ -250,7 +250,7 @@ struct kmem_cache *find_mergeable(size_t size, size_t align, - { - struct kmem_cache *s; - -- if (slab_nomerge || (flags & SLAB_NEVER_MERGE)) -+ if (slab_nomerge) - return NULL; - - if (ctor) -@@ -261,6 +261,9 @@ struct kmem_cache *find_mergeable(size_t size, size_t align, - size = ALIGN(size, align); - flags = kmem_cache_flags(size, flags, name, NULL); - -+ if (flags & SLAB_NEVER_MERGE) -+ return NULL; -+ - list_for_each_entry_reverse(s, &slab_caches, list) { - if (slab_unmergeable(s)) - continue; -diff --git a/net/core/sock.c b/net/core/sock.c -index bd2fad27891e..cd12cb6fe366 100644 ---- a/net/core/sock.c -+++ b/net/core/sock.c -@@ -1516,6 +1516,8 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) - - sock_copy(newsk, sk); - -+ newsk->sk_prot_creator = sk->sk_prot; -+ - /* SANITY */ - if (likely(newsk->sk_net_refcnt)) - get_net(sock_net(newsk)); -diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c -index 65036891e080..a03f834f16d5 100644 ---- a/net/ipv4/ip_vti.c -+++ b/net/ipv4/ip_vti.c -@@ -156,6 +156,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, - struct ip_tunnel_parm *parms = &tunnel->parms; - struct dst_entry *dst = skb_dst(skb); - struct net_device *tdev; /* Device to other host */ -+ int pkt_len = skb->len; - int err; - - if (!dst) { -@@ -199,7 +200,7 @@ static netdev_tx_t vti_xmit(struct sk_buff *skb, struct net_device *dev, - - err = dst_output(tunnel->net, skb->sk, skb); - if (net_xmit_eval(err) == 0) -- err = skb->len; -+ err = pkt_len; - iptunnel_xmit_stats(err, &dev->stats, dev->tstats); - return NETDEV_TX_OK; - -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index e89135828c3d..eab117033b8a 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -1173,24 +1173,25 @@ static int ip6gre_tunnel_change_mtu(struct net_device *dev, int new_mtu) - } - - static int ip6gre_header(struct sk_buff *skb, struct net_device *dev, -- unsigned short type, -- const void *daddr, const void *saddr, unsigned int len) -+ unsigned short type, const void *daddr, -+ const void *saddr, unsigned int len) - { - struct ip6_tnl *t = netdev_priv(dev); -- struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen); -- __be16 *p = (__be16 *)(ipv6h+1); -+ struct ipv6hdr *ipv6h; -+ __be16 *p; - -- ip6_flow_hdr(ipv6h, 0, -- ip6_make_flowlabel(dev_net(dev), skb, -- t->fl.u.ip6.flowlabel, true, -- &t->fl.u.ip6)); -+ ipv6h = (struct ipv6hdr *)skb_push(skb, t->hlen + sizeof(*ipv6h)); -+ ip6_flow_hdr(ipv6h, 0, ip6_make_flowlabel(dev_net(dev), skb, -+ t->fl.u.ip6.flowlabel, -+ true, &t->fl.u.ip6)); - ipv6h->hop_limit = t->parms.hop_limit; - ipv6h->nexthdr = NEXTHDR_GRE; - ipv6h->saddr = t->parms.laddr; - ipv6h->daddr = t->parms.raddr; - -- p[0] = t->parms.o_flags; -- p[1] = htons(type); -+ p = (__be16 *)(ipv6h + 1); -+ p[0] = t->parms.o_flags; -+ p[1] = htons(type); - - /* - * Set the source hardware address. -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index bdcc4d9cedd3..7ebb14def2cb 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -434,6 +434,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - struct dst_entry *dst = skb_dst(skb); - struct net_device *tdev; - struct xfrm_state *x; -+ int pkt_len = skb->len; - int err = -1; - int mtu; - -@@ -487,7 +488,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - struct pcpu_sw_netstats *tstats = this_cpu_ptr(dev->tstats); - - u64_stats_update_begin(&tstats->syncp); -- tstats->tx_bytes += skb->len; -+ tstats->tx_bytes += pkt_len; - tstats->tx_packets++; - u64_stats_update_end(&tstats->syncp); - } else { -diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c -index 6fd4af3b5b79..6eb1e9293b6f 100644 ---- a/net/ipv6/udp.c -+++ b/net/ipv6/udp.c -@@ -1007,6 +1007,7 @@ static void udp6_hwcsum_outgoing(struct sock *sk, struct sk_buff *skb, - */ - offset = skb_transport_offset(skb); - skb->csum = skb_checksum(skb, offset, skb->len - offset, 0); -+ csum = skb->csum; - - skb->ip_summed = CHECKSUM_NONE; - -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index d3dec414fd44..d48281ca9c72 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1321,6 +1321,9 @@ static void l2tp_tunnel_del_work(struct work_struct *work) - struct sock *sk = NULL; - - tunnel = container_of(work, struct l2tp_tunnel, del_work); -+ -+ l2tp_tunnel_closeall(tunnel); -+ - sk = l2tp_tunnel_sock_lookup(tunnel); - if (!sk) - goto out; -@@ -1640,15 +1643,12 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create); - - /* This function is used by the netlink TUNNEL_DELETE command. - */ --int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) -+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel) - { -- l2tp_tunnel_inc_refcount(tunnel); -- l2tp_tunnel_closeall(tunnel); -- if (false == queue_work(l2tp_wq, &tunnel->del_work)) { -- l2tp_tunnel_dec_refcount(tunnel); -- return 1; -+ if (!test_and_set_bit(0, &tunnel->dead)) { -+ l2tp_tunnel_inc_refcount(tunnel); -+ queue_work(l2tp_wq, &tunnel->del_work); - } -- return 0; - } - EXPORT_SYMBOL_GPL(l2tp_tunnel_delete); - -diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h -index 555d962a62d2..9cf546846edb 100644 ---- a/net/l2tp/l2tp_core.h -+++ b/net/l2tp/l2tp_core.h -@@ -169,6 +169,9 @@ struct l2tp_tunnel_cfg { - - struct l2tp_tunnel { - int magic; /* Should be L2TP_TUNNEL_MAGIC */ -+ -+ unsigned long dead; -+ - struct rcu_head rcu; - rwlock_t hlist_lock; /* protect session_hlist */ - struct hlist_head session_hlist[L2TP_HASH_SIZE]; -@@ -253,7 +256,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, - u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg, - struct l2tp_tunnel **tunnelp); - void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel); --int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); -+void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel); - struct l2tp_session *l2tp_session_create(int priv_size, - struct l2tp_tunnel *tunnel, - u32 session_id, u32 peer_session_id, -diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c -index 63ea6cbac5ad..7e7b9ef29d8d 100644 ---- a/net/mac80211/sta_info.c -+++ b/net/mac80211/sta_info.c -@@ -661,7 +661,7 @@ static void __sta_info_recalc_tim(struct sta_info *sta, bool ignore_pending) - } - - /* No need to do anything if the driver does all */ -- if (ieee80211_hw_check(&local->hw, AP_LINK_PS)) -+ if (ieee80211_hw_check(&local->hw, AP_LINK_PS) && !local->ops->set_tim) - return; - - if (sta->dead) -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index acf5c7b3f378..7f16d19d6198 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -395,7 +395,7 @@ static inline int __nf_ct_expect_check(struct nf_conntrack_expect *expect) - struct net *net = nf_ct_exp_net(expect); - struct hlist_node *next; - unsigned int h; -- int ret = 1; -+ int ret = 0; - - if (!master_help) { - ret = -ESHUTDOWN; -@@ -445,7 +445,7 @@ int nf_ct_expect_related_report(struct nf_conntrack_expect *expect, - - spin_lock_bh(&nf_conntrack_expect_lock); - ret = __nf_ct_expect_check(expect); -- if (ret <= 0) -+ if (ret < 0) - goto out; - - ret = nf_ct_expect_insert(expect); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index b70055fc30cb..241f69039a72 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1652,10 +1652,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - - mutex_lock(&fanout_mutex); - -- err = -EINVAL; -- if (!po->running) -- goto out; -- - err = -EALREADY; - if (po->fanout) - goto out; -@@ -1704,7 +1700,10 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - list_add(&match->list, &fanout_list); - } - err = -EINVAL; -- if (match->type == type && -+ -+ spin_lock(&po->bind_lock); -+ if (po->running && -+ match->type == type && - match->prot_hook.type == po->prot_hook.type && - match->prot_hook.dev == po->prot_hook.dev) { - err = -ENOSPC; -@@ -1716,6 +1715,13 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - err = 0; - } - } -+ spin_unlock(&po->bind_lock); -+ -+ if (err && !atomic_read(&match->sk_ref)) { -+ list_del(&match->list); -+ kfree(match); -+ } -+ - out: - if (err && rollover) { - kfree(rollover); -@@ -2650,6 +2656,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - int vnet_hdr_len; - struct packet_sock *po = pkt_sk(sk); - unsigned short gso_type = 0; -+ bool has_vnet_hdr = false; - int hlen, tlen, linear; - int extra_len = 0; - ssize_t n; -@@ -2737,6 +2744,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - goto out_unlock; - - } -+ has_vnet_hdr = true; - } - - if (unlikely(sock_flag(sk, SOCK_NOFCS))) { -@@ -2796,7 +2804,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - - packet_pick_tx_queue(dev, skb); - -- if (po->has_vnet_hdr) { -+ if (has_vnet_hdr) { - if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) { - u16 s = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_start); - u16 o = __virtio16_to_cpu(vio_le(), vnet_hdr.csum_offset); -@@ -2938,13 +2946,15 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, - int ret = 0; - bool unlisted = false; - -- if (po->fanout) -- return -EINVAL; -- - lock_sock(sk); - spin_lock(&po->bind_lock); - rcu_read_lock(); - -+ if (po->fanout) { -+ ret = -EINVAL; -+ goto out_unlock; -+ } -+ - if (name) { - dev = dev_get_by_name_rcu(sock_net(sk), name); - if (!dev) { -diff --git a/net/tipc/msg.c b/net/tipc/msg.c -index 8740930f0787..67bddcb2ff46 100644 ---- a/net/tipc/msg.c -+++ b/net/tipc/msg.c -@@ -541,7 +541,7 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err) - return false; - if (msg_errcode(msg)) - return false; -- *err = -TIPC_ERR_NO_NAME; -+ *err = TIPC_ERR_NO_NAME; - if (skb_linearize(skb)) - return false; - msg = buf_msg(skb); diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.94-95.patch b/patch/kernel/mvebu64-default/03-patch-4.4.94-95.patch deleted file mode 100644 index d5f0692111d3..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.94-95.patch +++ /dev/null @@ -1,1587 +0,0 @@ -diff --git a/Makefile b/Makefile -index ff9d6bbf2210..57e1ea2a189a 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 94 -+SUBLEVEL = 95 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index a86b19fccb63..c6b855f7892c 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -479,11 +479,6 @@ lws_start: - comiclr,>> __NR_lws_entries, %r20, %r0 - b,n lws_exit_nosys - -- /* WARNING: Trashing sr2 and sr3 */ -- mfsp %sr7,%r1 /* get userspace into sr3 */ -- mtsp %r1,%sr3 -- mtsp %r0,%sr2 /* get kernel space into sr2 */ -- - /* Load table start */ - ldil L%lws_table, %r1 - ldo R%lws_table(%r1), %r28 /* Scratch use of r28 */ -@@ -632,9 +627,9 @@ cas_action: - stw %r1, 4(%sr2,%r20) - #endif - /* The load and store could fail */ --1: ldw,ma 0(%sr3,%r26), %r28 -+1: ldw,ma 0(%r26), %r28 - sub,<> %r28, %r25, %r0 --2: stw,ma %r24, 0(%sr3,%r26) -+2: stw,ma %r24, 0(%r26) - /* Free lock */ - stw,ma %r20, 0(%sr2,%r20) - #if ENABLE_LWS_DEBUG -@@ -711,9 +706,9 @@ lws_compare_and_swap_2: - nop - - /* 8bit load */ --4: ldb 0(%sr3,%r25), %r25 -+4: ldb 0(%r25), %r25 - b cas2_lock_start --5: ldb 0(%sr3,%r24), %r24 -+5: ldb 0(%r24), %r24 - nop - nop - nop -@@ -721,9 +716,9 @@ lws_compare_and_swap_2: - nop - - /* 16bit load */ --6: ldh 0(%sr3,%r25), %r25 -+6: ldh 0(%r25), %r25 - b cas2_lock_start --7: ldh 0(%sr3,%r24), %r24 -+7: ldh 0(%r24), %r24 - nop - nop - nop -@@ -731,9 +726,9 @@ lws_compare_and_swap_2: - nop - - /* 32bit load */ --8: ldw 0(%sr3,%r25), %r25 -+8: ldw 0(%r25), %r25 - b cas2_lock_start --9: ldw 0(%sr3,%r24), %r24 -+9: ldw 0(%r24), %r24 - nop - nop - nop -@@ -742,14 +737,14 @@ lws_compare_and_swap_2: - - /* 64bit load */ - #ifdef CONFIG_64BIT --10: ldd 0(%sr3,%r25), %r25 --11: ldd 0(%sr3,%r24), %r24 -+10: ldd 0(%r25), %r25 -+11: ldd 0(%r24), %r24 - #else -- /* Load new value into r22/r23 - high/low */ --10: ldw 0(%sr3,%r25), %r22 --11: ldw 4(%sr3,%r25), %r23 -+ /* Load old value into r22/r23 - high/low */ -+10: ldw 0(%r25), %r22 -+11: ldw 4(%r25), %r23 - /* Load new value into fr4 for atomic store later */ --12: flddx 0(%sr3,%r24), %fr4 -+12: flddx 0(%r24), %fr4 - #endif - - cas2_lock_start: -@@ -799,30 +794,30 @@ cas2_action: - ldo 1(%r0),%r28 - - /* 8bit CAS */ --13: ldb,ma 0(%sr3,%r26), %r29 -+13: ldb,ma 0(%r26), %r29 - sub,= %r29, %r25, %r0 - b,n cas2_end --14: stb,ma %r24, 0(%sr3,%r26) -+14: stb,ma %r24, 0(%r26) - b cas2_end - copy %r0, %r28 - nop - nop - - /* 16bit CAS */ --15: ldh,ma 0(%sr3,%r26), %r29 -+15: ldh,ma 0(%r26), %r29 - sub,= %r29, %r25, %r0 - b,n cas2_end --16: sth,ma %r24, 0(%sr3,%r26) -+16: sth,ma %r24, 0(%r26) - b cas2_end - copy %r0, %r28 - nop - nop - - /* 32bit CAS */ --17: ldw,ma 0(%sr3,%r26), %r29 -+17: ldw,ma 0(%r26), %r29 - sub,= %r29, %r25, %r0 - b,n cas2_end --18: stw,ma %r24, 0(%sr3,%r26) -+18: stw,ma %r24, 0(%r26) - b cas2_end - copy %r0, %r28 - nop -@@ -830,22 +825,22 @@ cas2_action: - - /* 64bit CAS */ - #ifdef CONFIG_64BIT --19: ldd,ma 0(%sr3,%r26), %r29 -+19: ldd,ma 0(%r26), %r29 - sub,*= %r29, %r25, %r0 - b,n cas2_end --20: std,ma %r24, 0(%sr3,%r26) -+20: std,ma %r24, 0(%r26) - copy %r0, %r28 - #else - /* Compare first word */ --19: ldw,ma 0(%sr3,%r26), %r29 -+19: ldw 0(%r26), %r29 - sub,= %r29, %r22, %r0 - b,n cas2_end - /* Compare second word */ --20: ldw,ma 4(%sr3,%r26), %r29 -+20: ldw 4(%r26), %r29 - sub,= %r29, %r23, %r0 - b,n cas2_end - /* Perform the store */ --21: fstdx %fr4, 0(%sr3,%r26) -+21: fstdx %fr4, 0(%r26) - copy %r0, %r28 - #endif - -diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c -index 8f3056cd0399..2516e97c58f1 100644 ---- a/crypto/asymmetric_keys/pkcs7_parser.c -+++ b/crypto/asymmetric_keys/pkcs7_parser.c -@@ -90,6 +90,9 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg) - bool want; - - sinfo = msg->signed_infos; -+ if (!sinfo) -+ goto inconsistent; -+ - if (sinfo->authattrs) { - want = true; - msg->have_authattrs = true; -diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c -index c43c3d2baf73..0d628becf37f 100644 ---- a/drivers/bus/mvebu-mbus.c -+++ b/drivers/bus/mvebu-mbus.c -@@ -720,7 +720,7 @@ mvebu_mbus_default_setup_cpu_target(struct mvebu_mbus_state *mbus) - if (mbus->hw_io_coherency) - w->mbus_attr |= ATTR_HW_COHERENCY; - w->base = base & DDR_BASE_CS_LOW_MASK; -- w->size = (size | ~DDR_SIZE_MASK) + 1; -+ w->size = (u64)(size | ~DDR_SIZE_MASK) + 1; - } - } - mvebu_mbus_dram_info.num_cs = cs; -diff --git a/drivers/clocksource/cs5535-clockevt.c b/drivers/clocksource/cs5535-clockevt.c -index 9a7e37cf56b0..e1d7373e63e0 100644 ---- a/drivers/clocksource/cs5535-clockevt.c -+++ b/drivers/clocksource/cs5535-clockevt.c -@@ -117,7 +117,8 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id) - /* Turn off the clock (and clear the event) */ - disable_timer(cs5535_event_clock); - -- if (clockevent_state_shutdown(&cs5535_clockevent)) -+ if (clockevent_state_detached(&cs5535_clockevent) || -+ clockevent_state_shutdown(&cs5535_clockevent)) - return IRQ_HANDLED; - - /* Clear the counter */ -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c -index 3ef01071f073..103471ff4dc4 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c -@@ -40,5 +40,5 @@ int - g84_bsp_new(struct nvkm_device *device, int index, struct nvkm_engine **pengine) - { - return nvkm_xtensa_new_(&g84_bsp, device, index, -- true, 0x103000, pengine); -+ device->chipset != 0x92, 0x103000, pengine); - } -diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c -index e04a2296ecd0..5bb7f7e0f11f 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c -+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c -@@ -240,6 +240,8 @@ nvkm_vm_unmap_pgt(struct nvkm_vm *vm, int big, u32 fpde, u32 lpde) - mmu->func->map_pgt(vpgd->obj, pde, vpgt->mem); - } - -+ mmu->func->flush(vm); -+ - nvkm_memory_del(&pgt); - } - } -diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c -index 639d1a9c8793..1111cb966a44 100644 ---- a/drivers/i2c/busses/i2c-ismt.c -+++ b/drivers/i2c/busses/i2c-ismt.c -@@ -338,12 +338,15 @@ static int ismt_process_desc(const struct ismt_desc *desc, - data->word = dma_buffer[0] | (dma_buffer[1] << 8); - break; - case I2C_SMBUS_BLOCK_DATA: -- case I2C_SMBUS_I2C_BLOCK_DATA: - if (desc->rxbytes != dma_buffer[0] + 1) - return -EMSGSIZE; - - memcpy(data->block, dma_buffer, desc->rxbytes); - break; -+ case I2C_SMBUS_I2C_BLOCK_DATA: -+ memcpy(&data->block[1], dma_buffer, desc->rxbytes); -+ data->block[0] = desc->rxbytes; -+ break; - } - return 0; - } -diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c -index 113e64fcd73b..4c6707ecc619 100644 ---- a/drivers/net/can/usb/esd_usb2.c -+++ b/drivers/net/can/usb/esd_usb2.c -@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv *priv, - } - - cf->can_id = id & ESD_IDMASK; -- cf->can_dlc = get_can_dlc(msg->msg.rx.dlc); -+ cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR); - - if (id & ESD_EXTID) - cf->can_id |= CAN_EFF_FLAG; -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index ae5709354546..27e2352fcc42 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -356,6 +356,8 @@ static void gs_usb_receive_bulk_callback(struct urb *urb) - - gs_free_tx_context(txc); - -+ atomic_dec(&dev->active_tx_urbs); -+ - netif_wake_queue(netdev); - } - -@@ -444,14 +446,6 @@ static void gs_usb_xmit_callback(struct urb *urb) - urb->transfer_buffer_length, - urb->transfer_buffer, - urb->transfer_dma); -- -- atomic_dec(&dev->active_tx_urbs); -- -- if (!netif_device_present(netdev)) -- return; -- -- if (netif_queue_stopped(netdev)) -- netif_wake_queue(netdev); - } - - static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, struct net_device *netdev) -diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c -index 99dac9b8a082..c75bfd3f8cb3 100644 ---- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c -+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c -@@ -14764,8 +14764,8 @@ static void wlc_phy_ipa_restore_tx_digi_filts_nphy(struct brcms_phy *pi) - } - - static void --wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, u8 *events, u8 *dlys, -- u8 len) -+wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, const u8 *events, -+ const u8 *dlys, u8 len) - { - u32 t1_offset, t2_offset; - u8 ctr; -@@ -15240,16 +15240,16 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev5(struct brcms_phy *pi) - static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi) - { - u16 currband; -- s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 }; -- s8 *lna1_gain_db = NULL; -- s8 *lna1_gain_db_2 = NULL; -- s8 *lna2_gain_db = NULL; -- s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 }; -- s8 *tia_gain_db; -- s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 }; -- s8 *tia_gainbits; -- u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f }; -- u16 *rfseq_init_gain; -+ static const s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 }; -+ const s8 *lna1_gain_db = NULL; -+ const s8 *lna1_gain_db_2 = NULL; -+ const s8 *lna2_gain_db = NULL; -+ static const s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 }; -+ const s8 *tia_gain_db; -+ static const s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 }; -+ const s8 *tia_gainbits; -+ static const u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f }; -+ const u16 *rfseq_init_gain; - u16 init_gaincode; - u16 clip1hi_gaincode; - u16 clip1md_gaincode = 0; -@@ -15310,10 +15310,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi) - - if ((freq <= 5080) || (freq == 5825)) { - -- s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 }; -- s8 lna1A_gain_db_2_rev7[] = { -- 11, 17, 22, 25}; -- s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 }; -+ static const s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 }; -+ static const s8 lna1A_gain_db_2_rev7[] = { 11, 17, 22, 25}; -+ static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 }; - - crsminu_th = 0x3e; - lna1_gain_db = lna1A_gain_db_rev7; -@@ -15321,10 +15320,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi) - lna2_gain_db = lna2A_gain_db_rev7; - } else if ((freq >= 5500) && (freq <= 5700)) { - -- s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 }; -- s8 lna1A_gain_db_2_rev7[] = { -- 12, 18, 22, 26}; -- s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 }; -+ static const s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 }; -+ static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26}; -+ static const s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 }; - - crsminu_th = 0x45; - clip1md_gaincode_B = 0x14; -@@ -15335,10 +15333,9 @@ static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi) - lna2_gain_db = lna2A_gain_db_rev7; - } else { - -- s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 }; -- s8 lna1A_gain_db_2_rev7[] = { -- 12, 18, 22, 26}; -- s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 }; -+ static const s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 }; -+ static const s8 lna1A_gain_db_2_rev7[] = { 12, 18, 22, 26}; -+ static const s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 }; - - crsminu_th = 0x41; - lna1_gain_db = lna1A_gain_db_rev7; -@@ -15450,65 +15447,65 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi) - NPHY_RFSEQ_CMD_CLR_HIQ_DIS, - NPHY_RFSEQ_CMD_SET_HPF_BW - }; -- u8 rfseq_updategainu_dlys[] = { 10, 30, 1 }; -- s8 lna1G_gain_db[] = { 7, 11, 16, 23 }; -- s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 }; -- s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 }; -- s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 }; -- s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 }; -- s8 lna1A_gain_db[] = { 7, 11, 17, 23 }; -- s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 }; -- s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 }; -- s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 }; -- s8 *lna1_gain_db = NULL; -- s8 lna2G_gain_db[] = { -5, 6, 10, 14 }; -- s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 }; -- s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 }; -- s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 }; -- s8 lna2A_gain_db[] = { -6, 2, 6, 10 }; -- s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 }; -- s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 }; -- s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 }; -- s8 *lna2_gain_db = NULL; -- s8 tiaG_gain_db[] = { -+ static const u8 rfseq_updategainu_dlys[] = { 10, 30, 1 }; -+ static const s8 lna1G_gain_db[] = { 7, 11, 16, 23 }; -+ static const s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 }; -+ static const s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 }; -+ static const s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 }; -+ static const s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 }; -+ static const s8 lna1A_gain_db[] = { 7, 11, 17, 23 }; -+ static const s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 }; -+ static const s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 }; -+ static const s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 }; -+ const s8 *lna1_gain_db = NULL; -+ static const s8 lna2G_gain_db[] = { -5, 6, 10, 14 }; -+ static const s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 }; -+ static const s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 }; -+ static const s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 }; -+ static const s8 lna2A_gain_db[] = { -6, 2, 6, 10 }; -+ static const s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 }; -+ static const s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 }; -+ static const s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 }; -+ const s8 *lna2_gain_db = NULL; -+ static const s8 tiaG_gain_db[] = { - 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A }; -- s8 tiaA_gain_db[] = { -+ static const s8 tiaA_gain_db[] = { - 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13 }; -- s8 tiaA_gain_db_rev4[] = { -+ static const s8 tiaA_gain_db_rev4[] = { - 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d }; -- s8 tiaA_gain_db_rev5[] = { -+ static const s8 tiaA_gain_db_rev5[] = { - 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d }; -- s8 tiaA_gain_db_rev6[] = { -+ static const s8 tiaA_gain_db_rev6[] = { - 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d }; -- s8 *tia_gain_db; -- s8 tiaG_gainbits[] = { -+ const s8 *tia_gain_db; -+ static const s8 tiaG_gainbits[] = { - 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03 }; -- s8 tiaA_gainbits[] = { -+ static const s8 tiaA_gainbits[] = { - 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06 }; -- s8 tiaA_gainbits_rev4[] = { -+ static const s8 tiaA_gainbits_rev4[] = { - 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 }; -- s8 tiaA_gainbits_rev5[] = { -+ static const s8 tiaA_gainbits_rev5[] = { - 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 }; -- s8 tiaA_gainbits_rev6[] = { -+ static const s8 tiaA_gainbits_rev6[] = { - 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 }; -- s8 *tia_gainbits; -- s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 }; -- s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 }; -- u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f }; -- u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f }; -- u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f }; -- u16 rfseqG_init_gain_rev5_elna[] = { -+ const s8 *tia_gainbits; -+ static const s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 }; -+ static const s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 }; -+ static const u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f }; -+ static const u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f }; -+ static const u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f }; -+ static const u16 rfseqG_init_gain_rev5_elna[] = { - 0x013f, 0x013f, 0x013f, 0x013f }; -- u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f }; -- u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f }; -- u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f }; -- u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f }; -- u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f }; -- u16 rfseqA_init_gain_rev4_elna[] = { -+ static const u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f }; -+ static const u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f }; -+ static const u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f }; -+ static const u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f }; -+ static const u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f }; -+ static const u16 rfseqA_init_gain_rev4_elna[] = { - 0x314f, 0x314f, 0x314f, 0x314f }; -- u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f }; -- u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f }; -- u16 *rfseq_init_gain; -+ static const u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f }; -+ static const u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f }; -+ const u16 *rfseq_init_gain; - u16 initG_gaincode = 0x627e; - u16 initG_gaincode_rev4 = 0x527e; - u16 initG_gaincode_rev5 = 0x427e; -@@ -15538,10 +15535,10 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi) - u16 clip1mdA_gaincode_rev6 = 0x2084; - u16 clip1md_gaincode = 0; - u16 clip1loG_gaincode = 0x0074; -- u16 clip1loG_gaincode_rev5[] = { -+ static const u16 clip1loG_gaincode_rev5[] = { - 0x0062, 0x0064, 0x006a, 0x106a, 0x106c, 0x1074, 0x107c, 0x207c - }; -- u16 clip1loG_gaincode_rev6[] = { -+ static const u16 clip1loG_gaincode_rev6[] = { - 0x106a, 0x106c, 0x1074, 0x107c, 0x007e, 0x107e, 0x207e, 0x307e - }; - u16 clip1loG_gaincode_rev6_224B0 = 0x1074; -@@ -16066,7 +16063,7 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct brcms_phy *pi) - - static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - { -- u8 rfseq_rx2tx_events[] = { -+ static const u8 rfseq_rx2tx_events[] = { - NPHY_RFSEQ_CMD_NOP, - NPHY_RFSEQ_CMD_RXG_FBW, - NPHY_RFSEQ_CMD_TR_SWITCH, -@@ -16076,7 +16073,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - NPHY_RFSEQ_CMD_EXT_PA - }; - u8 rfseq_rx2tx_dlys[] = { 8, 6, 6, 2, 4, 60, 1 }; -- u8 rfseq_tx2rx_events[] = { -+ static const u8 rfseq_tx2rx_events[] = { - NPHY_RFSEQ_CMD_NOP, - NPHY_RFSEQ_CMD_EXT_PA, - NPHY_RFSEQ_CMD_TX_GAIN, -@@ -16085,8 +16082,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - NPHY_RFSEQ_CMD_RXG_FBW, - NPHY_RFSEQ_CMD_CLR_HIQ_DIS - }; -- u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 }; -- u8 rfseq_tx2rx_events_rev3[] = { -+ static const u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 }; -+ static const u8 rfseq_tx2rx_events_rev3[] = { - NPHY_REV3_RFSEQ_CMD_EXT_PA, - NPHY_REV3_RFSEQ_CMD_INT_PA_PU, - NPHY_REV3_RFSEQ_CMD_TX_GAIN, -@@ -16096,7 +16093,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - NPHY_REV3_RFSEQ_CMD_CLR_HIQ_DIS, - NPHY_REV3_RFSEQ_CMD_END - }; -- u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 }; -+ static const u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 }; - u8 rfseq_rx2tx_events_rev3[] = { - NPHY_REV3_RFSEQ_CMD_NOP, - NPHY_REV3_RFSEQ_CMD_RXG_FBW, -@@ -16110,7 +16107,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - }; - u8 rfseq_rx2tx_dlys_rev3[] = { 8, 6, 6, 4, 4, 18, 42, 1, 1 }; - -- u8 rfseq_rx2tx_events_rev3_ipa[] = { -+ static const u8 rfseq_rx2tx_events_rev3_ipa[] = { - NPHY_REV3_RFSEQ_CMD_NOP, - NPHY_REV3_RFSEQ_CMD_RXG_FBW, - NPHY_REV3_RFSEQ_CMD_TR_SWITCH, -@@ -16121,15 +16118,15 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - NPHY_REV3_RFSEQ_CMD_INT_PA_PU, - NPHY_REV3_RFSEQ_CMD_END - }; -- u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 }; -- u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f }; -+ static const u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 }; -+ static const u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f }; - - s16 alpha0, alpha1, alpha2; - s16 beta0, beta1, beta2; - u32 leg_data_weights, ht_data_weights, nss1_data_weights, - stbc_data_weights; - u8 chan_freq_range = 0; -- u16 dac_control = 0x0002; -+ static const u16 dac_control = 0x0002; - u16 aux_adc_vmid_rev7_core0[] = { 0x8e, 0x96, 0x96, 0x96 }; - u16 aux_adc_vmid_rev7_core1[] = { 0x8f, 0x9f, 0x9f, 0x96 }; - u16 aux_adc_vmid_rev4[] = { 0xa2, 0xb4, 0xb4, 0x89 }; -@@ -16139,8 +16136,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - u16 aux_adc_gain_rev4[] = { 0x02, 0x02, 0x02, 0x00 }; - u16 aux_adc_gain_rev3[] = { 0x02, 0x02, 0x02, 0x00 }; - u16 *aux_adc_gain; -- u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 }; -- u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 }; -+ static const u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 }; -+ static const u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 }; - s32 min_nvar_val = 0x18d; - s32 min_nvar_offset_6mbps = 20; - u8 pdetrange; -@@ -16151,9 +16148,9 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy *pi) - u16 rfseq_rx2tx_lpf_h_hpc_rev7 = 0x77; - u16 rfseq_tx2rx_lpf_h_hpc_rev7 = 0x77; - u16 rfseq_pktgn_lpf_h_hpc_rev7 = 0x77; -- u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 }; -- u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 }; -- u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 }; -+ static const u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 }; -+ static const u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 }; -+ static const u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 }; - u16 ipalvlshift_3p3_war_en = 0; - u16 rccal_bcap_val, rccal_scap_val; - u16 rccal_tx20_11b_bcap = 0; -@@ -24291,13 +24288,13 @@ static void wlc_phy_update_txcal_ladder_nphy(struct brcms_phy *pi, u16 core) - u16 bbmult; - u16 tblentry; - -- struct nphy_txiqcal_ladder ladder_lo[] = { -+ static const struct nphy_txiqcal_ladder ladder_lo[] = { - {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0}, - {25, 0}, {25, 1}, {25, 2}, {25, 3}, {25, 4}, {25, 5}, - {25, 6}, {25, 7}, {35, 7}, {50, 7}, {71, 7}, {100, 7} - }; - -- struct nphy_txiqcal_ladder ladder_iq[] = { -+ static const struct nphy_txiqcal_ladder ladder_iq[] = { - {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0}, - {25, 0}, {35, 0}, {50, 0}, {71, 0}, {100, 0}, {100, 1}, - {100, 2}, {100, 3}, {100, 4}, {100, 5}, {100, 6}, {100, 7} -@@ -25773,67 +25770,67 @@ wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi, struct nphy_txgains target_gain, - u16 cal_gain[2]; - struct nphy_iqcal_params cal_params[2]; - u32 tbl_len; -- void *tbl_ptr; -+ const void *tbl_ptr; - bool ladder_updated[2]; - u8 mphase_cal_lastphase = 0; - int bcmerror = 0; - bool phyhang_avoid_state = false; - -- u16 tbl_tx_iqlo_cal_loft_ladder_20[] = { -+ static const u16 tbl_tx_iqlo_cal_loft_ladder_20[] = { - 0x0300, 0x0500, 0x0700, 0x0900, 0x0d00, 0x1100, 0x1900, 0x1901, - 0x1902, - 0x1903, 0x1904, 0x1905, 0x1906, 0x1907, 0x2407, 0x3207, 0x4607, - 0x6407 - }; - -- u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = { -+ static const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = { - 0x0200, 0x0300, 0x0600, 0x0900, 0x0d00, 0x1100, 0x1900, 0x2400, - 0x3200, - 0x4600, 0x6400, 0x6401, 0x6402, 0x6403, 0x6404, 0x6405, 0x6406, - 0x6407 - }; - -- u16 tbl_tx_iqlo_cal_loft_ladder_40[] = { -+ static const u16 tbl_tx_iqlo_cal_loft_ladder_40[] = { - 0x0200, 0x0300, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1201, - 0x1202, - 0x1203, 0x1204, 0x1205, 0x1206, 0x1207, 0x1907, 0x2307, 0x3207, - 0x4707 - }; - -- u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = { -+ static const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = { - 0x0100, 0x0200, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1900, - 0x2300, - 0x3200, 0x4700, 0x4701, 0x4702, 0x4703, 0x4704, 0x4705, 0x4706, - 0x4707 - }; - -- u16 tbl_tx_iqlo_cal_startcoefs[] = { -+ static const u16 tbl_tx_iqlo_cal_startcoefs[] = { - 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, - 0x0000 - }; - -- u16 tbl_tx_iqlo_cal_cmds_fullcal[] = { -+ static const u16 tbl_tx_iqlo_cal_cmds_fullcal[] = { - 0x8123, 0x8264, 0x8086, 0x8245, 0x8056, - 0x9123, 0x9264, 0x9086, 0x9245, 0x9056 - }; - -- u16 tbl_tx_iqlo_cal_cmds_recal[] = { -+ static const u16 tbl_tx_iqlo_cal_cmds_recal[] = { - 0x8101, 0x8253, 0x8053, 0x8234, 0x8034, - 0x9101, 0x9253, 0x9053, 0x9234, 0x9034 - }; - -- u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = { -+ static const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = { - 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, - 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, - 0x0000 - }; - -- u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = { -+ static const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = { - 0x8434, 0x8334, 0x8084, 0x8267, 0x8056, 0x8234, - 0x9434, 0x9334, 0x9084, 0x9267, 0x9056, 0x9234 - }; - -- u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = { -+ static const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = { - 0x8423, 0x8323, 0x8073, 0x8256, 0x8045, 0x8223, - 0x9423, 0x9323, 0x9073, 0x9256, 0x9045, 0x9223 - }; -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index c2103e7a8132..bbb789f8990b 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) - } - if (0 == tmp) { - read_addr = REG_DBI_RDATA + addr % 4; -- ret = rtl_read_byte(rtlpriv, read_addr); -+ ret = rtl_read_word(rtlpriv, read_addr); - } - return ret; - } -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index df96f5f88c15..3f6bb3fff890 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -1762,6 +1762,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */ - .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ - }, -+ { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */ -+ .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */ -+ }, - - { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */ - .driver_info = CLEAR_HALT_CONDITIONS, -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index d9d048fc9082..5172bec612eb 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -926,10 +926,12 @@ int usb_get_bos_descriptor(struct usb_device *dev) - for (i = 0; i < num; i++) { - buffer += length; - cap = (struct usb_dev_cap_header *)buffer; -- length = cap->bLength; - -- if (total_len < length) -+ if (total_len < sizeof(*cap) || total_len < cap->bLength) { -+ dev->bos->desc->bNumDeviceCaps = i; - break; -+ } -+ length = cap->bLength; - total_len -= length; - - if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index bd9419213d06..873ba02d59e6 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -1417,11 +1417,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - totlen += isopkt[u].length; - } - u *= sizeof(struct usb_iso_packet_descriptor); -- if (totlen <= uurb->buffer_length) -- uurb->buffer_length = totlen; -- else -- WARN_ONCE(1, "uurb->buffer_length is too short %d vs %d", -- totlen, uurb->buffer_length); -+ uurb->buffer_length = totlen; - break; - - default: -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 51bba58c0c3b..22e61786354a 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -2656,13 +2656,16 @@ static int hub_port_wait_reset(struct usb_hub *hub, int port1, - if (!(portstatus & USB_PORT_STAT_CONNECTION)) - return -ENOTCONN; - -- /* bomb out completely if the connection bounced. A USB 3.0 -- * connection may bounce if multiple warm resets were issued, -+ /* Retry if connect change is set but status is still connected. -+ * A USB 3.0 connection may bounce if multiple warm resets were issued, - * but the device may have successfully re-connected. Ignore it. - */ - if (!hub_is_superspeed(hub->hdev) && -- (portchange & USB_PORT_STAT_C_CONNECTION)) -- return -ENOTCONN; -+ (portchange & USB_PORT_STAT_C_CONNECTION)) { -+ usb_clear_port_feature(hub->hdev, port1, -+ USB_PORT_FEAT_C_CONNECTION); -+ return -EAGAIN; -+ } - - if (!(portstatus & USB_PORT_STAT_ENABLE)) - return -EBUSY; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 82806e311202..a6aaf2f193a4 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -221,6 +221,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Corsair Strafe RGB */ - { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, - -+ /* MIDI keyboard WORLDE MINI */ -+ { USB_DEVICE(0x1c75, 0x0204), .driver_info = -+ USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* Acer C120 LED Projector */ - { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c -index 00eed5d66fda..06d83825923a 100644 ---- a/drivers/usb/musb/musb_core.c -+++ b/drivers/usb/musb/musb_core.c -@@ -877,7 +877,7 @@ b_host: - */ - if (int_usb & MUSB_INTR_RESET) { - handled = IRQ_HANDLED; -- if (devctl & MUSB_DEVCTL_HM) { -+ if (is_host_active(musb)) { - /* - * When BABBLE happens what we can depends on which - * platform MUSB is running, because some platforms -@@ -887,9 +887,7 @@ b_host: - * drop the session. - */ - dev_err(musb->controller, "Babble\n"); -- -- if (is_host_active(musb)) -- musb_recover_from_babble(musb); -+ musb_recover_from_babble(musb); - } else { - dev_dbg(musb->controller, "BUS RESET as %s\n", - usb_otg_state_string(musb->xceiv->otg->state)); -diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c -index d9b0dc461439..2d3be66fb563 100644 ---- a/drivers/usb/musb/sunxi.c -+++ b/drivers/usb/musb/sunxi.c -@@ -320,6 +320,8 @@ static int sunxi_musb_exit(struct musb *musb) - if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags)) - sunxi_sram_release(musb->controller->parent); - -+ devm_usb_put_phy(glue->dev, glue->xceiv); -+ - return 0; - } - -diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c -index 39e683096e94..45182c65fa1f 100644 ---- a/drivers/usb/serial/metro-usb.c -+++ b/drivers/usb/serial/metro-usb.c -@@ -45,6 +45,7 @@ struct metrousb_private { - static const struct usb_device_id id_table[] = { - { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) }, - { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) }, -+ { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) }, /* MS7820 */ - { }, /* Terminating entry. */ - }; - MODULE_DEVICE_TABLE(usb, id_table); -diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c -index 505f8afde57c..9a1bc638abce 100644 ---- a/fs/ext4/crypto_key.c -+++ b/fs/ext4/crypto_key.c -@@ -204,6 +204,12 @@ int ext4_get_encryption_info(struct inode *inode) - } - down_read(&keyring_key->sem); - ukp = user_key_payload(keyring_key); -+ if (!ukp) { -+ /* key was revoked before we acquired its semaphore */ -+ res = -EKEYREVOKED; -+ up_read(&keyring_key->sem); -+ goto out; -+ } - if (ukp->datalen != sizeof(struct ext4_encryption_key)) { - res = -EINVAL; - up_read(&keyring_key->sem); -diff --git a/fs/f2fs/crypto.c b/fs/f2fs/crypto.c -index 4a62ef14e932..d879c6c846b7 100644 ---- a/fs/f2fs/crypto.c -+++ b/fs/f2fs/crypto.c -@@ -362,7 +362,6 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx, - else - res = crypto_ablkcipher_encrypt(req); - if (res == -EINPROGRESS || res == -EBUSY) { -- BUG_ON(req->base.data != &ecr); - wait_for_completion(&ecr.completion); - res = ecr.res; - } -diff --git a/fs/f2fs/crypto_fname.c b/fs/f2fs/crypto_fname.c -index 38349ed5ea51..0fce444dd5ae 100644 ---- a/fs/f2fs/crypto_fname.c -+++ b/fs/f2fs/crypto_fname.c -@@ -124,7 +124,6 @@ static int f2fs_fname_encrypt(struct inode *inode, - ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv); - res = crypto_ablkcipher_encrypt(req); - if (res == -EINPROGRESS || res == -EBUSY) { -- BUG_ON(req->base.data != &ecr); - wait_for_completion(&ecr.completion); - res = ecr.res; - } -@@ -180,7 +179,6 @@ static int f2fs_fname_decrypt(struct inode *inode, - ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv); - res = crypto_ablkcipher_decrypt(req); - if (res == -EINPROGRESS || res == -EBUSY) { -- BUG_ON(req->base.data != &ecr); - wait_for_completion(&ecr.completion); - res = ecr.res; - } -diff --git a/fs/f2fs/crypto_key.c b/fs/f2fs/crypto_key.c -index 18595d7a0efc..7e62889a1d3d 100644 ---- a/fs/f2fs/crypto_key.c -+++ b/fs/f2fs/crypto_key.c -@@ -75,7 +75,6 @@ static int f2fs_derive_key_aes(char deriving_key[F2FS_AES_128_ECB_KEY_SIZE], - F2FS_AES_256_XTS_KEY_SIZE, NULL); - res = crypto_ablkcipher_encrypt(req); - if (res == -EINPROGRESS || res == -EBUSY) { -- BUG_ON(req->base.data != &ecr); - wait_for_completion(&ecr.completion); - res = ecr.res; - } -@@ -189,18 +188,38 @@ int f2fs_get_encryption_info(struct inode *inode) - keyring_key = NULL; - goto out; - } -- BUG_ON(keyring_key->type != &key_type_logon); -+ if (keyring_key->type != &key_type_logon) { -+ printk_once(KERN_WARNING "f2fs: key type must be logon\n"); -+ res = -ENOKEY; -+ goto out; -+ } -+ down_read(&keyring_key->sem); - ukp = user_key_payload(keyring_key); -+ if (!ukp) { -+ /* key was revoked before we acquired its semaphore */ -+ res = -EKEYREVOKED; -+ up_read(&keyring_key->sem); -+ goto out; -+ } - if (ukp->datalen != sizeof(struct f2fs_encryption_key)) { - res = -EINVAL; -+ up_read(&keyring_key->sem); - goto out; - } - master_key = (struct f2fs_encryption_key *)ukp->data; - BUILD_BUG_ON(F2FS_AES_128_ECB_KEY_SIZE != - F2FS_KEY_DERIVATION_NONCE_SIZE); -- BUG_ON(master_key->size != F2FS_AES_256_XTS_KEY_SIZE); -+ if (master_key->size != F2FS_AES_256_XTS_KEY_SIZE) { -+ printk_once(KERN_WARNING -+ "f2fs: key size incorrect: %d\n", -+ master_key->size); -+ res = -ENOKEY; -+ up_read(&keyring_key->sem); -+ goto out; -+ } - res = f2fs_derive_key_aes(ctx.nonce, master_key->raw, - raw_key); -+ up_read(&keyring_key->sem); - if (res) - goto out; - -diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c -index 4b449d263333..01eed94b01ea 100644 ---- a/fs/f2fs/file.c -+++ b/fs/f2fs/file.c -@@ -1541,12 +1541,18 @@ static int f2fs_ioc_set_encryption_policy(struct file *filp, unsigned long arg) - sizeof(policy))) - return -EFAULT; - -+ err = mnt_want_write_file(filp); -+ if (err) -+ return err; -+ - mutex_lock(&inode->i_mutex); - - err = f2fs_process_policy(&policy, inode); - - mutex_unlock(&inode->i_mutex); - -+ mnt_drop_write_file(filp); -+ - return err; - #else - return -EOPNOTSUPP; -diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c -index 6b028b7c4250..926580a85153 100644 ---- a/fs/fscache/object-list.c -+++ b/fs/fscache/object-list.c -@@ -330,6 +330,13 @@ static void fscache_objlist_config(struct fscache_objlist_data *data) - rcu_read_lock(); - - confkey = user_key_payload(key); -+ if (!confkey) { -+ /* key was revoked */ -+ rcu_read_unlock(); -+ key_put(key); -+ goto no_config; -+ } -+ - buf = confkey->data; - - for (len = confkey->datalen - 1; len >= 0; len--) { -diff --git a/include/linux/key.h b/include/linux/key.h -index dcc115e8dd03..af071ca73079 100644 ---- a/include/linux/key.h -+++ b/include/linux/key.h -@@ -126,6 +126,11 @@ static inline bool is_key_possessed(const key_ref_t key_ref) - return (unsigned long) key_ref & 1UL; - } - -+enum key_state { -+ KEY_IS_UNINSTANTIATED, -+ KEY_IS_POSITIVE, /* Positively instantiated */ -+}; -+ - /*****************************************************************************/ - /* - * authentication token / access credential / keyring -@@ -157,6 +162,7 @@ struct key { - * - may not match RCU dereferenced payload - * - payload should contain own length - */ -+ short state; /* Key state (+) or rejection error (-) */ - - #ifdef KEY_DEBUGGING - unsigned magic; -@@ -165,19 +171,17 @@ struct key { - #endif - - unsigned long flags; /* status flags (change with bitops) */ --#define KEY_FLAG_INSTANTIATED 0 /* set if key has been instantiated */ --#define KEY_FLAG_DEAD 1 /* set if key type has been deleted */ --#define KEY_FLAG_REVOKED 2 /* set if key had been revoked */ --#define KEY_FLAG_IN_QUOTA 3 /* set if key consumes quota */ --#define KEY_FLAG_USER_CONSTRUCT 4 /* set if key is being constructed in userspace */ --#define KEY_FLAG_NEGATIVE 5 /* set if key is negative */ --#define KEY_FLAG_ROOT_CAN_CLEAR 6 /* set if key can be cleared by root without permission */ --#define KEY_FLAG_INVALIDATED 7 /* set if key has been invalidated */ --#define KEY_FLAG_TRUSTED 8 /* set if key is trusted */ --#define KEY_FLAG_TRUSTED_ONLY 9 /* set if keyring only accepts links to trusted keys */ --#define KEY_FLAG_BUILTIN 10 /* set if key is builtin */ --#define KEY_FLAG_ROOT_CAN_INVAL 11 /* set if key can be invalidated by root without permission */ --#define KEY_FLAG_UID_KEYRING 12 /* set if key is a user or user session keyring */ -+#define KEY_FLAG_DEAD 0 /* set if key type has been deleted */ -+#define KEY_FLAG_REVOKED 1 /* set if key had been revoked */ -+#define KEY_FLAG_IN_QUOTA 2 /* set if key consumes quota */ -+#define KEY_FLAG_USER_CONSTRUCT 3 /* set if key is being constructed in userspace */ -+#define KEY_FLAG_ROOT_CAN_CLEAR 4 /* set if key can be cleared by root without permission */ -+#define KEY_FLAG_INVALIDATED 5 /* set if key has been invalidated */ -+#define KEY_FLAG_TRUSTED 6 /* set if key is trusted */ -+#define KEY_FLAG_TRUSTED_ONLY 7 /* set if keyring only accepts links to trusted keys */ -+#define KEY_FLAG_BUILTIN 8 /* set if key is builtin */ -+#define KEY_FLAG_ROOT_CAN_INVAL 9 /* set if key can be invalidated by root without permission */ -+#define KEY_FLAG_UID_KEYRING 10 /* set if key is a user or user session keyring */ - - /* the key type and key description string - * - the desc is used to match a key against search criteria -@@ -203,7 +207,6 @@ struct key { - struct list_head name_link; - struct assoc_array keys; - }; -- int reject_error; - }; - }; - -@@ -319,17 +322,27 @@ extern void key_set_timeout(struct key *, unsigned); - #define KEY_NEED_SETATTR 0x20 /* Require permission to change attributes */ - #define KEY_NEED_ALL 0x3f /* All the above permissions */ - -+static inline short key_read_state(const struct key *key) -+{ -+ /* Barrier versus mark_key_instantiated(). */ -+ return smp_load_acquire(&key->state); -+} -+ - /** -- * key_is_instantiated - Determine if a key has been positively instantiated -+ * key_is_positive - Determine if a key has been positively instantiated - * @key: The key to check. - * - * Return true if the specified key has been positively instantiated, false - * otherwise. - */ --static inline bool key_is_instantiated(const struct key *key) -+static inline bool key_is_positive(const struct key *key) -+{ -+ return key_read_state(key) == KEY_IS_POSITIVE; -+} -+ -+static inline bool key_is_negative(const struct key *key) - { -- return test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && -- !test_bit(KEY_FLAG_NEGATIVE, &key->flags); -+ return key_read_state(key) < 0; - } - - #define rcu_dereference_key(KEY) \ -diff --git a/include/linux/mbus.h b/include/linux/mbus.h -index 1f7bc630d225..71a5a56b0bba 100644 ---- a/include/linux/mbus.h -+++ b/include/linux/mbus.h -@@ -29,8 +29,8 @@ struct mbus_dram_target_info - struct mbus_dram_window { - u8 cs_index; - u8 mbus_attr; -- u32 base; -- u32 size; -+ u64 base; -+ u64 size; - } cs[4]; - }; - -diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c -index 750ed601ddf7..8620fd01b3d0 100644 ---- a/kernel/sched/auto_group.c -+++ b/kernel/sched/auto_group.c -@@ -111,14 +111,11 @@ bool task_wants_autogroup(struct task_struct *p, struct task_group *tg) - { - if (tg != &root_task_group) - return false; -- - /* -- * We can only assume the task group can't go away on us if -- * autogroup_move_group() can see us on ->thread_group list. -+ * If we race with autogroup_move_group() the caller can use the old -+ * value of signal->autogroup but in this case sched_move_task() will -+ * be called again before autogroup_kref_put(). - */ -- if (p->flags & PF_EXITING) -- return false; -- - return true; - } - -@@ -138,13 +135,17 @@ autogroup_move_group(struct task_struct *p, struct autogroup *ag) - } - - p->signal->autogroup = autogroup_kref_get(ag); -- -- if (!READ_ONCE(sysctl_sched_autogroup_enabled)) -- goto out; -- -+ /* -+ * We can't avoid sched_move_task() after we changed signal->autogroup, -+ * this process can already run with task_group() == prev->tg or we can -+ * race with cgroup code which can read autogroup = prev under rq->lock. -+ * In the latter case for_each_thread() can not miss a migrating thread, -+ * cpu_cgroup_attach() must not be possible after cgroup_exit() and it -+ * can't be removed from thread list, we hold ->siglock. -+ */ - for_each_thread(p, t) - sched_move_task(t); --out: -+ - unlock_task_sighand(p, &flags); - autogroup_kref_put(prev); - } -diff --git a/lib/digsig.c b/lib/digsig.c -index 07be6c1ef4e2..00c5c8179393 100644 ---- a/lib/digsig.c -+++ b/lib/digsig.c -@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key, - down_read(&key->sem); - ukp = user_key_payload(key); - -+ if (!ukp) { -+ /* key was revoked before we acquired its semaphore */ -+ err = -EKEYREVOKED; -+ goto err1; -+ } -+ - if (ukp->datalen < sizeof(*pkh)) - goto err1; - -diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c -index c79b85eb4d4c..6abc5012200b 100644 ---- a/net/dns_resolver/dns_key.c -+++ b/net/dns_resolver/dns_key.c -@@ -224,7 +224,7 @@ static int dns_resolver_match_preparse(struct key_match_data *match_data) - static void dns_resolver_describe(const struct key *key, struct seq_file *m) - { - seq_puts(m, key->description); -- if (key_is_instantiated(key)) { -+ if (key_is_positive(key)) { - int err = PTR_ERR(key->payload.data[dns_key_error]); - - if (err) -diff --git a/security/keys/big_key.c b/security/keys/big_key.c -index 907c1522ee46..08c4cc5c2973 100644 ---- a/security/keys/big_key.c -+++ b/security/keys/big_key.c -@@ -138,7 +138,7 @@ void big_key_revoke(struct key *key) - - /* clear the quota */ - key_payload_reserve(key, 0); -- if (key_is_instantiated(key) && -+ if (key_is_positive(key) && - (size_t)key->payload.data[big_key_len] > BIG_KEY_FILE_THRESHOLD) - vfs_truncate(path, 0); - } -@@ -170,7 +170,7 @@ void big_key_describe(const struct key *key, struct seq_file *m) - - seq_puts(m, key->description); - -- if (key_is_instantiated(key)) -+ if (key_is_positive(key)) - seq_printf(m, ": %zu [%s]", - datalen, - datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff"); -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index 31898856682e..ce295c0c1da0 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -315,6 +315,13 @@ static struct key *request_user_key(const char *master_desc, const u8 **master_k - - down_read(&ukey->sem); - upayload = user_key_payload(ukey); -+ if (!upayload) { -+ /* key was revoked before we acquired its semaphore */ -+ up_read(&ukey->sem); -+ key_put(ukey); -+ ukey = ERR_PTR(-EKEYREVOKED); -+ goto error; -+ } - *master_key = upayload->data; - *master_keylen = upayload->datalen; - error: -@@ -845,7 +852,7 @@ static int encrypted_update(struct key *key, struct key_preparsed_payload *prep) - size_t datalen = prep->datalen; - int ret = 0; - -- if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ if (key_is_negative(key)) - return -ENOKEY; - if (datalen <= 0 || datalen > 32767 || !prep->data) - return -EINVAL; -diff --git a/security/keys/gc.c b/security/keys/gc.c -index 9cb4fe4478a1..1659094d684d 100644 ---- a/security/keys/gc.c -+++ b/security/keys/gc.c -@@ -129,15 +129,15 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - while (!list_empty(keys)) { - struct key *key = - list_entry(keys->next, struct key, graveyard_link); -+ short state = key->state; -+ - list_del(&key->graveyard_link); - - kdebug("- %u", key->serial); - key_check(key); - - /* Throw away the key data if the key is instantiated */ -- if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && -- !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && -- key->type->destroy) -+ if (state == KEY_IS_POSITIVE && key->type->destroy) - key->type->destroy(key); - - security_key_free(key); -@@ -151,7 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head *keys) - } - - atomic_dec(&key->user->nkeys); -- if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) -+ if (state != KEY_IS_UNINSTANTIATED) - atomic_dec(&key->user->nikeys); - - key_user_put(key->user); -diff --git a/security/keys/key.c b/security/keys/key.c -index 51d23c623424..4d971bf88ac3 100644 ---- a/security/keys/key.c -+++ b/security/keys/key.c -@@ -395,6 +395,18 @@ int key_payload_reserve(struct key *key, size_t datalen) - } - EXPORT_SYMBOL(key_payload_reserve); - -+/* -+ * Change the key state to being instantiated. -+ */ -+static void mark_key_instantiated(struct key *key, int reject_error) -+{ -+ /* Commit the payload before setting the state; barrier versus -+ * key_read_state(). -+ */ -+ smp_store_release(&key->state, -+ (reject_error < 0) ? reject_error : KEY_IS_POSITIVE); -+} -+ - /* - * Instantiate a key and link it into the target keyring atomically. Must be - * called with the target keyring's semaphore writelocked. The target key's -@@ -418,14 +430,14 @@ static int __key_instantiate_and_link(struct key *key, - mutex_lock(&key_construction_mutex); - - /* can't instantiate twice */ -- if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) { -+ if (key->state == KEY_IS_UNINSTANTIATED) { - /* instantiate the key */ - ret = key->type->instantiate(key, prep); - - if (ret == 0) { - /* mark the key as being instantiated */ - atomic_inc(&key->user->nikeys); -- set_bit(KEY_FLAG_INSTANTIATED, &key->flags); -+ mark_key_instantiated(key, 0); - - if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) - awaken = 1; -@@ -553,13 +565,10 @@ int key_reject_and_link(struct key *key, - mutex_lock(&key_construction_mutex); - - /* can't instantiate twice */ -- if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) { -+ if (key->state == KEY_IS_UNINSTANTIATED) { - /* mark the key as being negatively instantiated */ - atomic_inc(&key->user->nikeys); -- key->reject_error = -error; -- smp_wmb(); -- set_bit(KEY_FLAG_NEGATIVE, &key->flags); -- set_bit(KEY_FLAG_INSTANTIATED, &key->flags); -+ mark_key_instantiated(key, -error); - now = current_kernel_time(); - key->expiry = now.tv_sec + timeout; - key_schedule_gc(key->expiry + key_gc_delay); -@@ -731,8 +740,8 @@ static inline key_ref_t __key_update(key_ref_t key_ref, - - ret = key->type->update(key, prep); - if (ret == 0) -- /* updating a negative key instantiates it */ -- clear_bit(KEY_FLAG_NEGATIVE, &key->flags); -+ /* Updating a negative key positively instantiates it */ -+ mark_key_instantiated(key, 0); - - up_write(&key->sem); - -@@ -907,6 +916,16 @@ error: - */ - __key_link_end(keyring, &index_key, edit); - -+ key = key_ref_to_ptr(key_ref); -+ if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) { -+ ret = wait_for_key_construction(key, true); -+ if (ret < 0) { -+ key_ref_put(key_ref); -+ key_ref = ERR_PTR(ret); -+ goto error_free_prep; -+ } -+ } -+ - key_ref = __key_update(key_ref, &prep); - goto error_free_prep; - } -@@ -957,8 +976,8 @@ int key_update(key_ref_t key_ref, const void *payload, size_t plen) - - ret = key->type->update(key, &prep); - if (ret == 0) -- /* updating a negative key instantiates it */ -- clear_bit(KEY_FLAG_NEGATIVE, &key->flags); -+ /* Updating a negative key positively instantiates it */ -+ mark_key_instantiated(key, 0); - - up_write(&key->sem); - -diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c -index a009dc66eb8f..2e741e1a8712 100644 ---- a/security/keys/keyctl.c -+++ b/security/keys/keyctl.c -@@ -738,10 +738,9 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) - - key = key_ref_to_ptr(key_ref); - -- if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) { -- ret = -ENOKEY; -- goto error2; -- } -+ ret = key_read_state(key); -+ if (ret < 0) -+ goto error2; /* Negatively instantiated */ - - /* see if we can read it directly */ - ret = key_permission(key_ref, KEY_NEED_READ); -@@ -873,7 +872,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t group) - atomic_dec(&key->user->nkeys); - atomic_inc(&newowner->nkeys); - -- if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) { -+ if (key->state != KEY_IS_UNINSTANTIATED) { - atomic_dec(&key->user->nikeys); - atomic_inc(&newowner->nikeys); - } -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index 0c8dd4fbe130..ef828238cdc0 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -407,7 +407,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m) - else - seq_puts(m, "[anon]"); - -- if (key_is_instantiated(keyring)) { -+ if (key_is_positive(keyring)) { - if (keyring->keys.nr_leaves_on_tree != 0) - seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree); - else -@@ -522,7 +522,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data) - { - struct keyring_search_context *ctx = iterator_data; - const struct key *key = keyring_ptr_to_key(object); -- unsigned long kflags = key->flags; -+ unsigned long kflags = READ_ONCE(key->flags); -+ short state = READ_ONCE(key->state); - - kenter("{%d}", key->serial); - -@@ -566,9 +567,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data) - - if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) { - /* we set a different error code if we pass a negative key */ -- if (kflags & (1 << KEY_FLAG_NEGATIVE)) { -- smp_rmb(); -- ctx->result = ERR_PTR(key->reject_error); -+ if (state < 0) { -+ ctx->result = ERR_PTR(state); - kleave(" = %d [neg]", ctx->skipped_ret); - goto skipped; - } -diff --git a/security/keys/proc.c b/security/keys/proc.c -index b9f531c9e4fa..036128682463 100644 ---- a/security/keys/proc.c -+++ b/security/keys/proc.c -@@ -182,6 +182,7 @@ static int proc_keys_show(struct seq_file *m, void *v) - unsigned long timo; - key_ref_t key_ref, skey_ref; - char xbuf[16]; -+ short state; - int rc; - - struct keyring_search_context ctx = { -@@ -240,17 +241,19 @@ static int proc_keys_show(struct seq_file *m, void *v) - sprintf(xbuf, "%luw", timo / (60*60*24*7)); - } - -+ state = key_read_state(key); -+ - #define showflag(KEY, LETTER, FLAG) \ - (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-') - - seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ", - key->serial, -- showflag(key, 'I', KEY_FLAG_INSTANTIATED), -+ state != KEY_IS_UNINSTANTIATED ? 'I' : '-', - showflag(key, 'R', KEY_FLAG_REVOKED), - showflag(key, 'D', KEY_FLAG_DEAD), - showflag(key, 'Q', KEY_FLAG_IN_QUOTA), - showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT), -- showflag(key, 'N', KEY_FLAG_NEGATIVE), -+ state < 0 ? 'N' : '-', - showflag(key, 'i', KEY_FLAG_INVALIDATED), - atomic_read(&key->usage), - xbuf, -diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c -index 7dd050f24261..ac1d5b2b1626 100644 ---- a/security/keys/process_keys.c -+++ b/security/keys/process_keys.c -@@ -727,7 +727,7 @@ try_again: - - ret = -EIO; - if (!(lflags & KEY_LOOKUP_PARTIAL) && -- !test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) -+ key_read_state(key) == KEY_IS_UNINSTANTIATED) - goto invalid_key; - - /* check the permissions */ -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index c7a117c9a8f3..2ce733342b5a 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -594,10 +594,9 @@ int wait_for_key_construction(struct key *key, bool intr) - intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE); - if (ret) - return -ERESTARTSYS; -- if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) { -- smp_rmb(); -- return key->reject_error; -- } -+ ret = key_read_state(key); -+ if (ret < 0) -+ return ret; - return key_validate(key); - } - EXPORT_SYMBOL(wait_for_key_construction); -diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c -index 4f0f112fe276..217775fcd0f3 100644 ---- a/security/keys/request_key_auth.c -+++ b/security/keys/request_key_auth.c -@@ -73,7 +73,7 @@ static void request_key_auth_describe(const struct key *key, - - seq_puts(m, "key:"); - seq_puts(m, key->description); -- if (key_is_instantiated(key)) -+ if (key_is_positive(key)) - seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len); - } - -diff --git a/security/keys/trusted.c b/security/keys/trusted.c -index 16dec53184b6..509aedcf8310 100644 ---- a/security/keys/trusted.c -+++ b/security/keys/trusted.c -@@ -1014,7 +1014,7 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) - char *datablob; - int ret = 0; - -- if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ if (key_is_negative(key)) - return -ENOKEY; - p = key->payload.data[0]; - if (!p->migratable) -diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c -index 8705d79b2c6f..eba8a516ee9e 100644 ---- a/security/keys/user_defined.c -+++ b/security/keys/user_defined.c -@@ -120,7 +120,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep) - - if (ret == 0) { - /* attach the new data, displacing the old */ -- if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags)) -+ if (key_is_positive(key)) - zap = key->payload.data[0]; - else - zap = NULL; -@@ -174,7 +174,7 @@ EXPORT_SYMBOL_GPL(user_destroy); - void user_describe(const struct key *key, struct seq_file *m) - { - seq_puts(m, key->description); -- if (key_is_instantiated(key)) -+ if (key_is_positive(key)) - seq_printf(m, ": %u", key->datalen); - } - -diff --git a/sound/core/seq/seq_lock.c b/sound/core/seq/seq_lock.c -index 12ba83367b1b..ba5752ee9af3 100644 ---- a/sound/core/seq/seq_lock.c -+++ b/sound/core/seq/seq_lock.c -@@ -23,8 +23,6 @@ - #include - #include "seq_lock.h" - --#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG) -- - /* wait until all locks are released */ - void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line) - { -@@ -42,5 +40,3 @@ void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int line) - } - - EXPORT_SYMBOL(snd_use_lock_sync_helper); -- --#endif -diff --git a/sound/core/seq/seq_lock.h b/sound/core/seq/seq_lock.h -index 54044bc2c9ef..ac38031c370e 100644 ---- a/sound/core/seq/seq_lock.h -+++ b/sound/core/seq/seq_lock.h -@@ -3,8 +3,6 @@ - - #include - --#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG) -- - typedef atomic_t snd_use_lock_t; - - /* initialize lock */ -@@ -20,14 +18,4 @@ typedef atomic_t snd_use_lock_t; - void snd_use_lock_sync_helper(snd_use_lock_t *lock, const char *file, int line); - #define snd_use_lock_sync(lockp) snd_use_lock_sync_helper(lockp, __BASE_FILE__, __LINE__) - --#else /* SMP || CONFIG_SND_DEBUG */ -- --typedef spinlock_t snd_use_lock_t; /* dummy */ --#define snd_use_lock_init(lockp) /**/ --#define snd_use_lock_use(lockp) /**/ --#define snd_use_lock_free(lockp) /**/ --#define snd_use_lock_sync(lockp) /**/ -- --#endif /* SMP || CONFIG_SND_DEBUG */ -- - #endif /* __SND_SEQ_LOCK_H */ -diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c -index 83741887faa1..3324f98c35f6 100644 ---- a/sound/pci/hda/hda_codec.c -+++ b/sound/pci/hda/hda_codec.c -@@ -1755,7 +1755,7 @@ static int get_kctl_0dB_offset(struct hda_codec *codec, - return -1; - if (*step_to_check && *step_to_check != step) { - codec_err(codec, "Mismatching dB step for vmaster slave (%d!=%d)\n", --- *step_to_check, step); -+ *step_to_check, step); - return -1; - } - *step_to_check = step; -diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c -index 1cc20d138dae..9c5368e7ee23 100644 ---- a/sound/usb/quirks.c -+++ b/sound/usb/quirks.c -@@ -1305,6 +1305,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct snd_usb_audio *chip, - case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */ - case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */ - case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */ -+ case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */ - if (fp->altsetting == 2) - return SNDRV_PCM_FMTBIT_DSD_U32_BE; - break; diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.95-96.patch b/patch/kernel/mvebu64-default/03-patch-4.4.95-96.patch deleted file mode 100644 index 51487e92daec..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.95-96.patch +++ /dev/null @@ -1,809 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt b/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt -deleted file mode 100644 -index 6ec1a880ac18..000000000000 ---- a/Documentation/devicetree/bindings/display/bridge/ti,ths8135.txt -+++ /dev/null -@@ -1,46 +0,0 @@ --THS8135 Video DAC ------------------- -- --This is the binding for Texas Instruments THS8135 Video DAC bridge. -- --Required properties: -- --- compatible: Must be "ti,ths8135" -- --Required nodes: -- --This device has two video ports. Their connections are modelled using the OF --graph bindings specified in Documentation/devicetree/bindings/graph.txt. -- --- Video port 0 for RGB input --- Video port 1 for VGA output -- --Example --------- -- --vga-bridge { -- compatible = "ti,ths8135"; -- #address-cells = <1>; -- #size-cells = <0>; -- -- ports { -- #address-cells = <1>; -- #size-cells = <0>; -- -- port@0 { -- reg = <0>; -- -- vga_bridge_in: endpoint { -- remote-endpoint = <&lcdc_out_vga>; -- }; -- }; -- -- port@1 { -- reg = <1>; -- -- vga_bridge_out: endpoint { -- remote-endpoint = <&vga_con_in>; -- }; -- }; -- }; --}; -diff --git a/Makefile b/Makefile -index 57e1ea2a189a..12dfe1dcbaca 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 95 -+SUBLEVEL = 96 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index ac8975a65280..abf581ade8d2 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -990,6 +990,18 @@ static int get_ucode_fw(void *to, const void *from, size_t n) - return 0; - } - -+static bool is_blacklisted(unsigned int cpu) -+{ -+ struct cpuinfo_x86 *c = &cpu_data(cpu); -+ -+ if (c->x86 == 6 && c->x86_model == 79) { -+ pr_err_once("late loading on model 79 is disabled.\n"); -+ return true; -+ } -+ -+ return false; -+} -+ - static enum ucode_state request_microcode_fw(int cpu, struct device *device, - bool refresh_fw) - { -@@ -998,6 +1010,9 @@ static enum ucode_state request_microcode_fw(int cpu, struct device *device, - const struct firmware *firmware; - enum ucode_state ret; - -+ if (is_blacklisted(cpu)) -+ return UCODE_NFOUND; -+ - sprintf(name, "intel-ucode/%02x-%02x-%02x", - c->x86, c->x86_model, c->x86_mask); - -@@ -1022,6 +1037,9 @@ static int get_ucode_user(void *to, const void *from, size_t n) - static enum ucode_state - request_microcode_user(int cpu, const void __user *buf, size_t size) - { -+ if (is_blacklisted(cpu)) -+ return UCODE_NFOUND; -+ - return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user); - } - -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index 681dce15fbc8..b8c50d883b2c 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1240,6 +1240,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0605", 0 }, - { "ELAN0609", 0 }, - { "ELAN060B", 0 }, -+ { "ELAN0611", 0 }, - { "ELAN1000", 0 }, - { } - }; -diff --git a/drivers/input/tablet/gtco.c b/drivers/input/tablet/gtco.c -index 7c18249d6c8e..8b68a210277b 100644 ---- a/drivers/input/tablet/gtco.c -+++ b/drivers/input/tablet/gtco.c -@@ -231,13 +231,17 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, - - /* Walk this report and pull out the info we need */ - while (i < length) { -- prefix = report[i]; -- -- /* Skip over prefix */ -- i++; -+ prefix = report[i++]; - - /* Determine data size and save the data in the proper variable */ -- size = PREF_SIZE(prefix); -+ size = (1U << PREF_SIZE(prefix)) >> 1; -+ if (i + size > length) { -+ dev_err(ddev, -+ "Not enough data (need %d, have %d)\n", -+ i + size, length); -+ break; -+ } -+ - switch (size) { - case 1: - data = report[i]; -@@ -245,8 +249,7 @@ static void parse_hid_report_descriptor(struct gtco *device, char * report, - case 2: - data16 = get_unaligned_le16(&report[i]); - break; -- case 3: -- size = 4; -+ case 4: - data32 = get_unaligned_le32(&report[i]); - break; - } -diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c -index 68ef0a4cd821..b0c80859f746 100644 ---- a/drivers/net/can/sun4i_can.c -+++ b/drivers/net/can/sun4i_can.c -@@ -342,7 +342,7 @@ static int sun4i_can_start(struct net_device *dev) - - /* enter the selected mode */ - mod_reg_val = readl(priv->base + SUN4I_REG_MSEL_ADDR); -- if (priv->can.ctrlmode & CAN_CTRLMODE_PRESUME_ACK) -+ if (priv->can.ctrlmode & CAN_CTRLMODE_LOOPBACK) - mod_reg_val |= SUN4I_MSEL_LOOPBACK_MODE; - else if (priv->can.ctrlmode & CAN_CTRLMODE_LISTENONLY) - mod_reg_val |= SUN4I_MSEL_LISTEN_ONLY_MODE; -@@ -811,7 +811,6 @@ static int sun4ican_probe(struct platform_device *pdev) - priv->can.ctrlmode_supported = CAN_CTRLMODE_BERR_REPORTING | - CAN_CTRLMODE_LISTENONLY | - CAN_CTRLMODE_LOOPBACK | -- CAN_CTRLMODE_PRESUME_ACK | - CAN_CTRLMODE_3_SAMPLES; - priv->base = addr; - priv->clk = clk; -diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index 022bfa13ebfa..c2e2821a3346 100644 ---- a/drivers/net/can/usb/kvaser_usb.c -+++ b/drivers/net/can/usb/kvaser_usb.c -@@ -134,6 +134,7 @@ static inline bool kvaser_is_usbcan(const struct usb_device_id *id) - #define CMD_RESET_ERROR_COUNTER 49 - #define CMD_TX_ACKNOWLEDGE 50 - #define CMD_CAN_ERROR_EVENT 51 -+#define CMD_FLUSH_QUEUE_REPLY 68 - - #define CMD_LEAF_USB_THROTTLE 77 - #define CMD_LEAF_LOG_MESSAGE 106 -@@ -1297,6 +1298,11 @@ static void kvaser_usb_handle_message(const struct kvaser_usb *dev, - goto warn; - break; - -+ case CMD_FLUSH_QUEUE_REPLY: -+ if (dev->family != KVASER_LEAF) -+ goto warn; -+ break; -+ - default: - warn: dev_warn(dev->udev->dev.parent, - "Unhandled message (%d)\n", msg->id); -@@ -1607,7 +1613,8 @@ static int kvaser_usb_close(struct net_device *netdev) - if (err) - netdev_warn(netdev, "Cannot flush queue, error %d\n", err); - -- if (kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel)) -+ err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, priv->channel); -+ if (err) - netdev_warn(netdev, "Cannot reset card, error %d\n", err); - - err = kvaser_usb_stop_chip(priv); -diff --git a/drivers/regulator/fan53555.c b/drivers/regulator/fan53555.c -index 4940e8287df6..c3107358b3fb 100644 ---- a/drivers/regulator/fan53555.c -+++ b/drivers/regulator/fan53555.c -@@ -434,7 +434,10 @@ static const struct i2c_device_id fan53555_id[] = { - .name = "fan53555", - .driver_data = FAN53555_VENDOR_FAIRCHILD - }, { -- .name = "syr82x", -+ .name = "syr827", -+ .driver_data = FAN53555_VENDOR_SILERGY -+ }, { -+ .name = "syr828", - .driver_data = FAN53555_VENDOR_SILERGY - }, - { }, -diff --git a/drivers/s390/scsi/zfcp_aux.c b/drivers/s390/scsi/zfcp_aux.c -index c00ac4650dce..38c8e308d4c8 100644 ---- a/drivers/s390/scsi/zfcp_aux.c -+++ b/drivers/s390/scsi/zfcp_aux.c -@@ -358,6 +358,8 @@ struct zfcp_adapter *zfcp_adapter_enqueue(struct ccw_device *ccw_device) - - adapter->next_port_scan = jiffies; - -+ adapter->erp_action.adapter = adapter; -+ - if (zfcp_qdio_setup(adapter)) - goto failed; - -@@ -514,6 +516,9 @@ struct zfcp_port *zfcp_port_enqueue(struct zfcp_adapter *adapter, u64 wwpn, - port->dev.groups = zfcp_port_attr_groups; - port->dev.release = zfcp_port_release; - -+ port->erp_action.adapter = adapter; -+ port->erp_action.port = port; -+ - if (dev_set_name(&port->dev, "0x%016llx", (unsigned long long)wwpn)) { - kfree(port); - goto err_out; -diff --git a/drivers/s390/scsi/zfcp_erp.c b/drivers/s390/scsi/zfcp_erp.c -index 7ccfce559034..3b23d6754598 100644 ---- a/drivers/s390/scsi/zfcp_erp.c -+++ b/drivers/s390/scsi/zfcp_erp.c -@@ -193,9 +193,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status, - atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, - &zfcp_sdev->status); - erp_action = &zfcp_sdev->erp_action; -- memset(erp_action, 0, sizeof(struct zfcp_erp_action)); -- erp_action->port = port; -- erp_action->sdev = sdev; -+ WARN_ON_ONCE(erp_action->port != port); -+ WARN_ON_ONCE(erp_action->sdev != sdev); - if (!(atomic_read(&zfcp_sdev->status) & - ZFCP_STATUS_COMMON_RUNNING)) - act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY; -@@ -208,8 +207,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status, - zfcp_erp_action_dismiss_port(port); - atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &port->status); - erp_action = &port->erp_action; -- memset(erp_action, 0, sizeof(struct zfcp_erp_action)); -- erp_action->port = port; -+ WARN_ON_ONCE(erp_action->port != port); -+ WARN_ON_ONCE(erp_action->sdev != NULL); - if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_RUNNING)) - act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY; - break; -@@ -219,7 +218,8 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status, - zfcp_erp_action_dismiss_adapter(adapter); - atomic_or(ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status); - erp_action = &adapter->erp_action; -- memset(erp_action, 0, sizeof(struct zfcp_erp_action)); -+ WARN_ON_ONCE(erp_action->port != NULL); -+ WARN_ON_ONCE(erp_action->sdev != NULL); - if (!(atomic_read(&adapter->status) & - ZFCP_STATUS_COMMON_RUNNING)) - act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY; -@@ -229,7 +229,11 @@ static struct zfcp_erp_action *zfcp_erp_setup_act(int need, u32 act_status, - return NULL; - } - -- erp_action->adapter = adapter; -+ WARN_ON_ONCE(erp_action->adapter != adapter); -+ memset(&erp_action->list, 0, sizeof(erp_action->list)); -+ memset(&erp_action->timer, 0, sizeof(erp_action->timer)); -+ erp_action->step = ZFCP_ERP_STEP_UNINITIALIZED; -+ erp_action->fsf_req_id = 0; - erp_action->action = need; - erp_action->status = act_status; - -diff --git a/drivers/s390/scsi/zfcp_scsi.c b/drivers/s390/scsi/zfcp_scsi.c -index 9bd9b9a29dfc..a9b8104b982e 100644 ---- a/drivers/s390/scsi/zfcp_scsi.c -+++ b/drivers/s390/scsi/zfcp_scsi.c -@@ -115,10 +115,15 @@ static int zfcp_scsi_slave_alloc(struct scsi_device *sdev) - struct zfcp_unit *unit; - int npiv = adapter->connection_features & FSF_FEATURE_NPIV_MODE; - -+ zfcp_sdev->erp_action.adapter = adapter; -+ zfcp_sdev->erp_action.sdev = sdev; -+ - port = zfcp_get_port_by_wwpn(adapter, rport->port_name); - if (!port) - return -ENXIO; - -+ zfcp_sdev->erp_action.port = port; -+ - unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev)); - if (unit) - put_device(&unit->dev); -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 39e8b5dc23fa..38f77e127349 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -848,7 +848,7 @@ sg_fill_request_table(Sg_fd *sfp, sg_req_info_t *rinfo) - - val = 0; - list_for_each_entry(srp, &sfp->rq_list, entry) { -- if (val > SG_MAX_QUEUE) -+ if (val >= SG_MAX_QUEUE) - break; - rinfo[val].req_state = srp->done + 1; - rinfo[val].problem = -diff --git a/drivers/usb/host/xhci-hub.c b/drivers/usb/host/xhci-hub.c -index a8a2d5005e6e..9df00101bfe1 100644 ---- a/drivers/usb/host/xhci-hub.c -+++ b/drivers/usb/host/xhci-hub.c -@@ -394,15 +394,25 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) - GFP_NOWAIT); - if (!command) { - spin_unlock_irqrestore(&xhci->lock, flags); -- xhci_free_command(xhci, cmd); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto cmd_cleanup; -+ } - -+ ret = xhci_queue_stop_endpoint(xhci, command, slot_id, -+ i, suspend); -+ if (ret) { -+ spin_unlock_irqrestore(&xhci->lock, flags); -+ xhci_free_command(xhci, command); -+ goto cmd_cleanup; - } -- xhci_queue_stop_endpoint(xhci, command, slot_id, i, -- suspend); - } - } -- xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend); -+ ret = xhci_queue_stop_endpoint(xhci, cmd, slot_id, 0, suspend); -+ if (ret) { -+ spin_unlock_irqrestore(&xhci->lock, flags); -+ goto cmd_cleanup; -+ } -+ - xhci_ring_cmd_db(xhci); - spin_unlock_irqrestore(&xhci->lock, flags); - -@@ -413,6 +423,8 @@ static int xhci_stop_device(struct xhci_hcd *xhci, int slot_id, int suspend) - xhci_warn(xhci, "Timeout while waiting for stop endpoint command\n"); - ret = -ETIME; - } -+ -+cmd_cleanup: - xhci_free_command(xhci, cmd); - return ret; - } -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index 308600adf6e0..a4d749665c9f 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -827,6 +827,7 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - mutex_unlock(&priv->lock); - - if (use_ptemod) { -+ map->pages_vm_start = vma->vm_start; - err = apply_to_page_range(vma->vm_mm, vma->vm_start, - vma->vm_end - vma->vm_start, - find_grant_ptes, map); -@@ -864,7 +865,6 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) - set_grant_ptes_as_special, NULL); - } - #endif -- map->pages_vm_start = vma->vm_start; - } - - return 0; -diff --git a/fs/ceph/caps.c b/fs/ceph/caps.c -index c69e1253b47b..0e3de1bb6500 100644 ---- a/fs/ceph/caps.c -+++ b/fs/ceph/caps.c -@@ -1850,6 +1850,7 @@ static int try_flush_caps(struct inode *inode, u64 *ptid) - retry: - spin_lock(&ci->i_ceph_lock); - if (ci->i_ceph_flags & CEPH_I_NOFLUSH) { -+ spin_unlock(&ci->i_ceph_lock); - dout("try_flush_caps skipping %p I_NOFLUSH set\n", inode); - goto out; - } -@@ -1867,8 +1868,10 @@ retry: - mutex_lock(&session->s_mutex); - goto retry; - } -- if (cap->session->s_state < CEPH_MDS_SESSION_OPEN) -+ if (cap->session->s_state < CEPH_MDS_SESSION_OPEN) { -+ spin_unlock(&ci->i_ceph_lock); - goto out; -+ } - - flushing = __mark_caps_flushing(inode, session, &flush_tid, - &oldest_flush_tid); -diff --git a/fs/ecryptfs/ecryptfs_kernel.h b/fs/ecryptfs/ecryptfs_kernel.h -index 7b39260c7bba..eae9cdb8af46 100644 ---- a/fs/ecryptfs/ecryptfs_kernel.h -+++ b/fs/ecryptfs/ecryptfs_kernel.h -@@ -84,11 +84,16 @@ struct ecryptfs_page_crypt_context { - static inline struct ecryptfs_auth_tok * - ecryptfs_get_encrypted_key_payload_data(struct key *key) - { -- if (key->type == &key_type_encrypted) -- return (struct ecryptfs_auth_tok *) -- (&((struct encrypted_key_payload *)key->payload.data[0])->payload_data); -- else -+ struct encrypted_key_payload *payload; -+ -+ if (key->type != &key_type_encrypted) - return NULL; -+ -+ payload = key->payload.data[0]; -+ if (!payload) -+ return ERR_PTR(-EKEYREVOKED); -+ -+ return (struct ecryptfs_auth_tok *)payload->payload_data; - } - - static inline struct key *ecryptfs_get_encrypted_key(char *sig) -@@ -114,12 +119,17 @@ static inline struct ecryptfs_auth_tok * - ecryptfs_get_key_payload_data(struct key *key) - { - struct ecryptfs_auth_tok *auth_tok; -+ const struct user_key_payload *ukp; - - auth_tok = ecryptfs_get_encrypted_key_payload_data(key); -- if (!auth_tok) -- return (struct ecryptfs_auth_tok *)user_key_payload(key)->data; -- else -+ if (auth_tok) - return auth_tok; -+ -+ ukp = user_key_payload(key); -+ if (!ukp) -+ return ERR_PTR(-EKEYREVOKED); -+ -+ return (struct ecryptfs_auth_tok *)ukp->data; - } - - #define ECRYPTFS_MAX_KEYSET_SIZE 1024 -diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c -index 6bd67e2011f0..20632ee51ae5 100644 ---- a/fs/ecryptfs/keystore.c -+++ b/fs/ecryptfs/keystore.c -@@ -458,7 +458,8 @@ out: - * @auth_tok_key: key containing the authentication token - * @auth_tok: authentication token - * -- * Returns zero on valid auth tok; -EINVAL otherwise -+ * Returns zero on valid auth tok; -EINVAL if the payload is invalid; or -+ * -EKEYREVOKED if the key was revoked before we acquired its semaphore. - */ - static int - ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key, -@@ -467,6 +468,12 @@ ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key, - int rc = 0; - - (*auth_tok) = ecryptfs_get_key_payload_data(auth_tok_key); -+ if (IS_ERR(*auth_tok)) { -+ rc = PTR_ERR(*auth_tok); -+ *auth_tok = NULL; -+ goto out; -+ } -+ - if (ecryptfs_verify_version((*auth_tok)->version)) { - printk(KERN_ERR "Data structure version mismatch. Userspace " - "tools must match eCryptfs kernel module with major " -diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c -index 4b5f2c4e69c8..5068dbf80ff8 100644 ---- a/fs/fuse/dir.c -+++ b/fs/fuse/dir.c -@@ -1295,7 +1295,8 @@ static int parse_dirplusfile(char *buf, size_t nbytes, struct file *file, - */ - over = !dir_emit(ctx, dirent->name, dirent->namelen, - dirent->ino, dirent->type); -- ctx->pos = dirent->off; -+ if (!over) -+ ctx->pos = dirent->off; - } - - buf += reclen; -diff --git a/include/uapi/linux/spi/spidev.h b/include/uapi/linux/spi/spidev.h -index dd5f21e75805..856de39d0b89 100644 ---- a/include/uapi/linux/spi/spidev.h -+++ b/include/uapi/linux/spi/spidev.h -@@ -23,6 +23,7 @@ - #define SPIDEV_H - - #include -+#include - - /* User space versions of kernel symbols for SPI clocking modes, - * matching -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 23231237f2e2..95cc76785a12 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -68,6 +68,7 @@ enum { - * attach_mutex to avoid changing binding state while - * worker_attach_to_pool() is in progress. - */ -+ POOL_MANAGER_ACTIVE = 1 << 0, /* being managed */ - POOL_DISASSOCIATED = 1 << 2, /* cpu can't serve workers */ - - /* worker flags */ -@@ -163,7 +164,6 @@ struct worker_pool { - /* L: hash of busy workers */ - - /* see manage_workers() for details on the two manager mutexes */ -- struct mutex manager_arb; /* manager arbitration */ - struct worker *manager; /* L: purely informational */ - struct mutex attach_mutex; /* attach/detach exclusion */ - struct list_head workers; /* A: attached workers */ -@@ -295,6 +295,7 @@ static struct workqueue_attrs *wq_update_unbound_numa_attrs_buf; - - static DEFINE_MUTEX(wq_pool_mutex); /* protects pools and workqueues list */ - static DEFINE_SPINLOCK(wq_mayday_lock); /* protects wq->maydays list */ -+static DECLARE_WAIT_QUEUE_HEAD(wq_manager_wait); /* wait for manager to go away */ - - static LIST_HEAD(workqueues); /* PR: list of all workqueues */ - static bool workqueue_freezing; /* PL: have wqs started freezing? */ -@@ -808,7 +809,7 @@ static bool need_to_create_worker(struct worker_pool *pool) - /* Do we have too many workers and should some go away? */ - static bool too_many_workers(struct worker_pool *pool) - { -- bool managing = mutex_is_locked(&pool->manager_arb); -+ bool managing = pool->flags & POOL_MANAGER_ACTIVE; - int nr_idle = pool->nr_idle + managing; /* manager is considered idle */ - int nr_busy = pool->nr_workers - nr_idle; - -@@ -1952,24 +1953,17 @@ static bool manage_workers(struct worker *worker) - { - struct worker_pool *pool = worker->pool; - -- /* -- * Anyone who successfully grabs manager_arb wins the arbitration -- * and becomes the manager. mutex_trylock() on pool->manager_arb -- * failure while holding pool->lock reliably indicates that someone -- * else is managing the pool and the worker which failed trylock -- * can proceed to executing work items. This means that anyone -- * grabbing manager_arb is responsible for actually performing -- * manager duties. If manager_arb is grabbed and released without -- * actual management, the pool may stall indefinitely. -- */ -- if (!mutex_trylock(&pool->manager_arb)) -+ if (pool->flags & POOL_MANAGER_ACTIVE) - return false; -+ -+ pool->flags |= POOL_MANAGER_ACTIVE; - pool->manager = worker; - - maybe_create_worker(pool); - - pool->manager = NULL; -- mutex_unlock(&pool->manager_arb); -+ pool->flags &= ~POOL_MANAGER_ACTIVE; -+ wake_up(&wq_manager_wait); - return true; - } - -@@ -3119,7 +3113,6 @@ static int init_worker_pool(struct worker_pool *pool) - setup_timer(&pool->mayday_timer, pool_mayday_timeout, - (unsigned long)pool); - -- mutex_init(&pool->manager_arb); - mutex_init(&pool->attach_mutex); - INIT_LIST_HEAD(&pool->workers); - -@@ -3189,13 +3182,15 @@ static void put_unbound_pool(struct worker_pool *pool) - hash_del(&pool->hash_node); - - /* -- * Become the manager and destroy all workers. Grabbing -- * manager_arb prevents @pool's workers from blocking on -- * attach_mutex. -+ * Become the manager and destroy all workers. This prevents -+ * @pool's workers from blocking on attach_mutex. We're the last -+ * manager and @pool gets freed with the flag set. - */ -- mutex_lock(&pool->manager_arb); -- - spin_lock_irq(&pool->lock); -+ wait_event_lock_irq(wq_manager_wait, -+ !(pool->flags & POOL_MANAGER_ACTIVE), pool->lock); -+ pool->flags |= POOL_MANAGER_ACTIVE; -+ - while ((worker = first_idle_worker(pool))) - destroy_worker(worker); - WARN_ON(pool->nr_workers || pool->nr_idle); -@@ -3209,8 +3204,6 @@ static void put_unbound_pool(struct worker_pool *pool) - if (pool->detach_completion) - wait_for_completion(pool->detach_completion); - -- mutex_unlock(&pool->manager_arb); -- - /* shut down the timers */ - del_timer_sync(&pool->idle_timer); - del_timer_sync(&pool->mayday_timer); -diff --git a/lib/assoc_array.c b/lib/assoc_array.c -index 59fd7c0b119c..5cd093589c5a 100644 ---- a/lib/assoc_array.c -+++ b/lib/assoc_array.c -@@ -598,21 +598,31 @@ static bool assoc_array_insert_into_terminal_node(struct assoc_array_edit *edit, - if ((edit->segment_cache[ASSOC_ARRAY_FAN_OUT] ^ base_seg) == 0) - goto all_leaves_cluster_together; - -- /* Otherwise we can just insert a new node ahead of the old -- * one. -+ /* Otherwise all the old leaves cluster in the same slot, but -+ * the new leaf wants to go into a different slot - so we -+ * create a new node (n0) to hold the new leaf and a pointer to -+ * a new node (n1) holding all the old leaves. -+ * -+ * This can be done by falling through to the node splitting -+ * path. - */ -- goto present_leaves_cluster_but_not_new_leaf; -+ pr_devel("present leaves cluster but not new leaf\n"); - } - - split_node: - pr_devel("split node\n"); - -- /* We need to split the current node; we know that the node doesn't -- * simply contain a full set of leaves that cluster together (it -- * contains meta pointers and/or non-clustering leaves). -+ /* We need to split the current node. The node must contain anything -+ * from a single leaf (in the one leaf case, this leaf will cluster -+ * with the new leaf) and the rest meta-pointers, to all leaves, some -+ * of which may cluster. -+ * -+ * It won't contain the case in which all the current leaves plus the -+ * new leaves want to cluster in the same slot. - * - * We need to expel at least two leaves out of a set consisting of the -- * leaves in the node and the new leaf. -+ * leaves in the node and the new leaf. The current meta pointers can -+ * just be copied as they shouldn't cluster with any of the leaves. - * - * We need a new node (n0) to replace the current one and a new node to - * take the expelled nodes (n1). -@@ -717,33 +727,6 @@ found_slot_for_multiple_occupancy: - pr_devel("<--%s() = ok [split node]\n", __func__); - return true; - --present_leaves_cluster_but_not_new_leaf: -- /* All the old leaves cluster in the same slot, but the new leaf wants -- * to go into a different slot, so we create a new node to hold the new -- * leaf and a pointer to a new node holding all the old leaves. -- */ -- pr_devel("present leaves cluster but not new leaf\n"); -- -- new_n0->back_pointer = node->back_pointer; -- new_n0->parent_slot = node->parent_slot; -- new_n0->nr_leaves_on_branch = node->nr_leaves_on_branch; -- new_n1->back_pointer = assoc_array_node_to_ptr(new_n0); -- new_n1->parent_slot = edit->segment_cache[0]; -- new_n1->nr_leaves_on_branch = node->nr_leaves_on_branch; -- edit->adjust_count_on = new_n0; -- -- for (i = 0; i < ASSOC_ARRAY_FAN_OUT; i++) -- new_n1->slots[i] = node->slots[i]; -- -- new_n0->slots[edit->segment_cache[0]] = assoc_array_node_to_ptr(new_n0); -- edit->leaf_p = &new_n0->slots[edit->segment_cache[ASSOC_ARRAY_FAN_OUT]]; -- -- edit->set[0].ptr = &assoc_array_ptr_to_node(node->back_pointer)->slots[node->parent_slot]; -- edit->set[0].to = assoc_array_node_to_ptr(new_n0); -- edit->excised_meta[0] = assoc_array_node_to_ptr(node); -- pr_devel("<--%s() = ok [insert node before]\n", __func__); -- return true; -- - all_leaves_cluster_together: - /* All the leaves, new and old, want to cluster together in this node - * in the same slot, so we have to replace this node with a shortcut to -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5cab24f52825..a83688f8672e 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -329,6 +329,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0233: -+ case 0x10ec0236: - case 0x10ec0255: - case 0x10ec0256: - case 0x10ec0282: -@@ -909,6 +910,7 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = { - { 0x10ec0275, 0x1028, 0, "ALC3260" }, - { 0x10ec0899, 0x1028, 0, "ALC3861" }, - { 0x10ec0298, 0x1028, 0, "ALC3266" }, -+ { 0x10ec0236, 0x1028, 0, "ALC3204" }, - { 0x10ec0256, 0x1028, 0, "ALC3246" }, - { 0x10ec0225, 0x1028, 0, "ALC3253" }, - { 0x10ec0295, 0x1028, 0, "ALC3254" }, -@@ -3694,6 +3696,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) - alc_process_coef_fw(codec, coef0255_1); - alc_process_coef_fw(codec, coef0255); - break; -+ case 0x10ec0236: - case 0x10ec0256: - alc_process_coef_fw(codec, coef0256); - alc_process_coef_fw(codec, coef0255); -@@ -3774,6 +3777,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin, - - - switch (codec->core.vendor_id) { -+ case 0x10ec0236: - case 0x10ec0255: - case 0x10ec0256: - alc_write_coef_idx(codec, 0x45, 0xc489); -@@ -3879,6 +3883,7 @@ static void alc_headset_mode_default(struct hda_codec *codec) - case 0x10ec0295: - alc_process_coef_fw(codec, coef0225); - break; -+ case 0x10ec0236: - case 0x10ec0255: - case 0x10ec0256: - alc_process_coef_fw(codec, coef0255); -@@ -3962,6 +3967,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec) - case 0x10ec0255: - alc_process_coef_fw(codec, coef0255); - break; -+ case 0x10ec0236: - case 0x10ec0256: - alc_process_coef_fw(codec, coef0256); - break; -@@ -4052,6 +4058,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec) - case 0x10ec0255: - alc_process_coef_fw(codec, coef0255); - break; -+ case 0x10ec0236: - case 0x10ec0256: - alc_process_coef_fw(codec, coef0256); - break; -@@ -4119,6 +4126,7 @@ static void alc_determine_headset_type(struct hda_codec *codec) - }; - - switch (codec->core.vendor_id) { -+ case 0x10ec0236: - case 0x10ec0255: - case 0x10ec0256: - alc_process_coef_fw(codec, coef0255); -@@ -4320,6 +4328,7 @@ static void alc255_set_default_jack_type(struct hda_codec *codec) - case 0x10ec0255: - alc_process_coef_fw(codec, alc255fw); - break; -+ case 0x10ec0236: - case 0x10ec0256: - alc_process_coef_fw(codec, alc256fw); - break; -@@ -5834,6 +5843,14 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - ALC225_STANDARD_PINS, - {0x12, 0xb7a60130}, - {0x1b, 0x90170110}), -+ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0x90a60140}, -+ {0x14, 0x90170110}, -+ {0x21, 0x02211020}), -+ SND_HDA_PIN_QUIRK(0x10ec0236, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0x90a60140}, -+ {0x14, 0x90170150}, -+ {0x21, 0x02211020}), - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE, - {0x14, 0x90170110}, - {0x21, 0x02211020}), -@@ -6208,6 +6225,7 @@ static int patch_alc269(struct hda_codec *codec) - case 0x10ec0255: - spec->codec_variant = ALC269_TYPE_ALC255; - break; -+ case 0x10ec0236: - case 0x10ec0256: - spec->codec_variant = ALC269_TYPE_ALC256; - spec->gen.mixer_nid = 0; /* ALC256 does not have any loopback mixer path */ -@@ -7147,6 +7165,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { - HDA_CODEC_ENTRY(0x10ec0233, "ALC233", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0234, "ALC234", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0235, "ALC233", patch_alc269), -+ HDA_CODEC_ENTRY(0x10ec0236, "ALC236", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0255, "ALC255", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0256, "ALC256", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0260, "ALC260", patch_alc260), diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.96-97.patch b/patch/kernel/mvebu64-default/03-patch-4.4.96-97.patch deleted file mode 100644 index 458b9e310514..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.96-97.patch +++ /dev/null @@ -1,1525 +0,0 @@ -diff --git a/Makefile b/Makefile -index 12dfe1dcbaca..fb1a40d64ba8 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 96 -+SUBLEVEL = 97 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/armada-375.dtsi b/arch/arm/boot/dts/armada-375.dtsi -index cc952cf8ec30..024f1b75b0a3 100644 ---- a/arch/arm/boot/dts/armada-375.dtsi -+++ b/arch/arm/boot/dts/armada-375.dtsi -@@ -176,9 +176,9 @@ - reg = <0x8000 0x1000>; - cache-unified; - cache-level = <2>; -- arm,double-linefill-incr = <1>; -+ arm,double-linefill-incr = <0>; - arm,double-linefill-wrap = <0>; -- arm,double-linefill = <1>; -+ arm,double-linefill = <0>; - prefetch-data = <1>; - }; - -diff --git a/arch/arm/include/asm/Kbuild b/arch/arm/include/asm/Kbuild -index bd425302c97a..628a38a11a70 100644 ---- a/arch/arm/include/asm/Kbuild -+++ b/arch/arm/include/asm/Kbuild -@@ -36,4 +36,3 @@ generic-y += termbits.h - generic-y += termios.h - generic-y += timex.h - generic-y += trace_clock.h --generic-y += unaligned.h -diff --git a/arch/arm/include/asm/unaligned.h b/arch/arm/include/asm/unaligned.h -new file mode 100644 -index 000000000000..ab905ffcf193 ---- /dev/null -+++ b/arch/arm/include/asm/unaligned.h -@@ -0,0 +1,27 @@ -+#ifndef __ASM_ARM_UNALIGNED_H -+#define __ASM_ARM_UNALIGNED_H -+ -+/* -+ * We generally want to set CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS on ARMv6+, -+ * but we don't want to use linux/unaligned/access_ok.h since that can lead -+ * to traps on unaligned stm/ldm or strd/ldrd. -+ */ -+#include -+ -+#if defined(__LITTLE_ENDIAN) -+# include -+# include -+# include -+# define get_unaligned __get_unaligned_le -+# define put_unaligned __put_unaligned_le -+#elif defined(__BIG_ENDIAN) -+# include -+# include -+# include -+# define get_unaligned __get_unaligned_be -+# define put_unaligned __put_unaligned_be -+#else -+# error need to define endianess -+#endif -+ -+#endif /* __ASM_ARM_UNALIGNED_H */ -diff --git a/arch/arm/mach-pxa/balloon3.c b/arch/arm/mach-pxa/balloon3.c -index a727282bfa99..761d7d64d643 100644 ---- a/arch/arm/mach-pxa/balloon3.c -+++ b/arch/arm/mach-pxa/balloon3.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/colibri-pxa270-income.c b/arch/arm/mach-pxa/colibri-pxa270-income.c -index db20d25daaab..1b92a4112bd1 100644 ---- a/arch/arm/mach-pxa/colibri-pxa270-income.c -+++ b/arch/arm/mach-pxa/colibri-pxa270-income.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/corgi.c b/arch/arm/mach-pxa/corgi.c -index 89f790dda93e..d1f12909f740 100644 ---- a/arch/arm/mach-pxa/corgi.c -+++ b/arch/arm/mach-pxa/corgi.c -@@ -18,6 +18,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/trizeps4.c b/arch/arm/mach-pxa/trizeps4.c -index 066e3a250ee0..5e50c53f1f4b 100644 ---- a/arch/arm/mach-pxa/trizeps4.c -+++ b/arch/arm/mach-pxa/trizeps4.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/vpac270.c b/arch/arm/mach-pxa/vpac270.c -index 54122a983ae3..2cce92924068 100644 ---- a/arch/arm/mach-pxa/vpac270.c -+++ b/arch/arm/mach-pxa/vpac270.c -@@ -15,6 +15,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/zeus.c b/arch/arm/mach-pxa/zeus.c -index 30e62a3f0701..d757cfb5f8a6 100644 ---- a/arch/arm/mach-pxa/zeus.c -+++ b/arch/arm/mach-pxa/zeus.c -@@ -13,6 +13,7 @@ - - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm/mach-pxa/zylonite.c b/arch/arm/mach-pxa/zylonite.c -index e20359a7433c..d7f0a7d87ef2 100644 ---- a/arch/arm/mach-pxa/zylonite.c -+++ b/arch/arm/mach-pxa/zylonite.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index ca7f0ac5f708..210826d5bba5 100644 ---- a/arch/arm64/kernel/traps.c -+++ b/arch/arm64/kernel/traps.c -@@ -129,7 +129,7 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) - for (i = -4; i < 1; i++) { - unsigned int val, bad; - -- bad = __get_user(val, &((u32 *)addr)[i]); -+ bad = get_user(val, &((u32 *)addr)[i]); - - if (!bad) - p += sprintf(p, i == 0 ? "(%08x) " : "%08x ", val); -diff --git a/drivers/base/power/wakeirq.c b/drivers/base/power/wakeirq.c -index 404d94c6c8bc..feba1b211898 100644 ---- a/drivers/base/power/wakeirq.c -+++ b/drivers/base/power/wakeirq.c -@@ -141,6 +141,13 @@ static irqreturn_t handle_threaded_wake_irq(int irq, void *_wirq) - struct wake_irq *wirq = _wirq; - int res; - -+ /* Maybe abort suspend? */ -+ if (irqd_is_wakeup_set(irq_get_irq_data(irq))) { -+ pm_wakeup_event(wirq->dev, 0); -+ -+ return IRQ_HANDLED; -+ } -+ - /* We don't want RPM_ASYNC or RPM_NOWAIT here */ - res = pm_runtime_resume(wirq->dev); - if (res < 0) -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -index bb0da76051a1..e5da6f19b9b8 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vce.c -@@ -284,6 +284,10 @@ static void amdgpu_vce_idle_work_handler(struct work_struct *work) - amdgpu_dpm_enable_vce(adev, false); - } else { - amdgpu_asic_set_vce_clocks(adev, 0, 0); -+ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE, -+ AMD_PG_STATE_GATE); -+ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE, -+ AMD_CG_STATE_GATE); - } - } else { - schedule_delayed_work(&adev->vce.idle_work, -@@ -315,6 +319,11 @@ static void amdgpu_vce_note_usage(struct amdgpu_device *adev) - amdgpu_dpm_enable_vce(adev, true); - } else { - amdgpu_asic_set_vce_clocks(adev, 53300, 40000); -+ amdgpu_set_clockgating_state(adev, AMD_IP_BLOCK_TYPE_VCE, -+ AMD_CG_STATE_UNGATE); -+ amdgpu_set_powergating_state(adev, AMD_IP_BLOCK_TYPE_VCE, -+ AMD_PG_STATE_UNGATE); -+ - } - } - } -diff --git a/drivers/gpu/drm/msm/msm_gem_submit.c b/drivers/gpu/drm/msm/msm_gem_submit.c -index fed44d4e5b72..f4eaccb191d4 100644 ---- a/drivers/gpu/drm/msm/msm_gem_submit.c -+++ b/drivers/gpu/drm/msm/msm_gem_submit.c -@@ -34,10 +34,13 @@ static inline void __user *to_user_ptr(u64 address) - } - - static struct msm_gem_submit *submit_create(struct drm_device *dev, -- struct msm_gpu *gpu, int nr) -+ struct msm_gpu *gpu, uint32_t nr) - { - struct msm_gem_submit *submit; -- int sz = sizeof(*submit) + (nr * sizeof(submit->bos[0])); -+ uint64_t sz = sizeof(*submit) + ((u64)nr * sizeof(submit->bos[0])); -+ -+ if (sz > SIZE_MAX) -+ return NULL; - - submit = kmalloc(sz, GFP_TEMPORARY | __GFP_NOWARN | __GFP_NORETRY); - if (submit) { -diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c -index d7e3af671543..d8803c3bbfdc 100644 ---- a/drivers/i2c/busses/i2c-riic.c -+++ b/drivers/i2c/busses/i2c-riic.c -@@ -80,6 +80,7 @@ - #define ICIER_TEIE 0x40 - #define ICIER_RIE 0x20 - #define ICIER_NAKIE 0x10 -+#define ICIER_SPIE 0x08 - - #define ICSR2_NACKF 0x10 - -@@ -216,11 +217,10 @@ static irqreturn_t riic_tend_isr(int irq, void *data) - return IRQ_NONE; - } - -- if (riic->is_last || riic->err) -+ if (riic->is_last || riic->err) { -+ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); - writeb(ICCR2_SP, riic->base + RIIC_ICCR2); -- -- writeb(0, riic->base + RIIC_ICIER); -- complete(&riic->msg_done); -+ } - - return IRQ_HANDLED; - } -@@ -240,13 +240,13 @@ static irqreturn_t riic_rdrf_isr(int irq, void *data) - - if (riic->bytes_left == 1) { - /* STOP must come before we set ACKBT! */ -- if (riic->is_last) -+ if (riic->is_last) { -+ riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); - writeb(ICCR2_SP, riic->base + RIIC_ICCR2); -+ } - - riic_clear_set_bit(riic, 0, ICMR3_ACKBT, RIIC_ICMR3); - -- writeb(0, riic->base + RIIC_ICIER); -- complete(&riic->msg_done); - } else { - riic_clear_set_bit(riic, ICMR3_ACKBT, 0, RIIC_ICMR3); - } -@@ -259,6 +259,21 @@ static irqreturn_t riic_rdrf_isr(int irq, void *data) - return IRQ_HANDLED; - } - -+static irqreturn_t riic_stop_isr(int irq, void *data) -+{ -+ struct riic_dev *riic = data; -+ -+ /* read back registers to confirm writes have fully propagated */ -+ writeb(0, riic->base + RIIC_ICSR2); -+ readb(riic->base + RIIC_ICSR2); -+ writeb(0, riic->base + RIIC_ICIER); -+ readb(riic->base + RIIC_ICIER); -+ -+ complete(&riic->msg_done); -+ -+ return IRQ_HANDLED; -+} -+ - static u32 riic_func(struct i2c_adapter *adap) - { - return I2C_FUNC_I2C | I2C_FUNC_SMBUS_EMUL; -@@ -326,6 +341,7 @@ static struct riic_irq_desc riic_irqs[] = { - { .res_num = 0, .isr = riic_tend_isr, .name = "riic-tend" }, - { .res_num = 1, .isr = riic_rdrf_isr, .name = "riic-rdrf" }, - { .res_num = 2, .isr = riic_tdre_isr, .name = "riic-tdre" }, -+ { .res_num = 3, .isr = riic_stop_isr, .name = "riic-stop" }, - { .res_num = 5, .isr = riic_tend_isr, .name = "riic-nack" }, - }; - -diff --git a/drivers/media/pci/bt8xx/dvb-bt8xx.c b/drivers/media/pci/bt8xx/dvb-bt8xx.c -index d407244fd1bc..bd0f5b195188 100644 ---- a/drivers/media/pci/bt8xx/dvb-bt8xx.c -+++ b/drivers/media/pci/bt8xx/dvb-bt8xx.c -@@ -680,6 +680,7 @@ static void frontend_init(struct dvb_bt8xx_card *card, u32 type) - /* DST is not a frontend, attaching the ASIC */ - if (dvb_attach(dst_attach, state, &card->dvb_adapter) == NULL) { - pr_err("%s: Could not find a Twinhan DST\n", __func__); -+ kfree(state); - break; - } - /* Attach other DST peripherals if any */ -diff --git a/drivers/media/platform/exynos4-is/fimc-is.c b/drivers/media/platform/exynos4-is/fimc-is.c -index 49658ca39e51..a851f20dca23 100644 ---- a/drivers/media/platform/exynos4-is/fimc-is.c -+++ b/drivers/media/platform/exynos4-is/fimc-is.c -@@ -815,12 +815,13 @@ static int fimc_is_probe(struct platform_device *pdev) - is->irq = irq_of_parse_and_map(dev->of_node, 0); - if (!is->irq) { - dev_err(dev, "no irq found\n"); -- return -EINVAL; -+ ret = -EINVAL; -+ goto err_iounmap; - } - - ret = fimc_is_get_clocks(is); - if (ret < 0) -- return ret; -+ goto err_iounmap; - - platform_set_drvdata(pdev, is); - -@@ -880,6 +881,8 @@ err_irq: - free_irq(is->irq, is); - err_clk: - fimc_is_put_clocks(is); -+err_iounmap: -+ iounmap(is->pmu_regs); - return ret; - } - -@@ -935,6 +938,7 @@ static int fimc_is_remove(struct platform_device *pdev) - fimc_is_unregister_subdevs(is); - vb2_dma_contig_cleanup_ctx(is->alloc_ctx); - fimc_is_put_clocks(is); -+ iounmap(is->pmu_regs); - fimc_is_debugfs_remove(is); - release_firmware(is->fw.f_w); - fimc_is_free_cpu_memory(is); -diff --git a/drivers/media/usb/cx231xx/cx231xx-core.c b/drivers/media/usb/cx231xx/cx231xx-core.c -index 19b0293312a0..07670117f922 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-core.c -+++ b/drivers/media/usb/cx231xx/cx231xx-core.c -@@ -356,7 +356,12 @@ int cx231xx_send_vendor_cmd(struct cx231xx *dev, - */ - if ((ven_req->wLength > 4) && ((ven_req->bRequest == 0x4) || - (ven_req->bRequest == 0x5) || -- (ven_req->bRequest == 0x6))) { -+ (ven_req->bRequest == 0x6) || -+ -+ /* Internal Master 3 Bus can send -+ * and receive only 4 bytes per time -+ */ -+ (ven_req->bRequest == 0x2))) { - unsend_size = 0; - pdata = ven_req->pBuff; - -diff --git a/drivers/mfd/ab8500-sysctrl.c b/drivers/mfd/ab8500-sysctrl.c -index 0d1825696153..405ce78c1ef4 100644 ---- a/drivers/mfd/ab8500-sysctrl.c -+++ b/drivers/mfd/ab8500-sysctrl.c -@@ -99,7 +99,7 @@ int ab8500_sysctrl_read(u16 reg, u8 *value) - u8 bank; - - if (sysctrl_dev == NULL) -- return -EINVAL; -+ return -EPROBE_DEFER; - - bank = (reg >> 8); - if (!valid_bank(bank)) -@@ -115,11 +115,13 @@ int ab8500_sysctrl_write(u16 reg, u8 mask, u8 value) - u8 bank; - - if (sysctrl_dev == NULL) -- return -EINVAL; -+ return -EPROBE_DEFER; - - bank = (reg >> 8); -- if (!valid_bank(bank)) -+ if (!valid_bank(bank)) { -+ pr_err("invalid bank\n"); - return -EINVAL; -+ } - - return abx500_mask_and_set_register_interruptible(sysctrl_dev, bank, - (u8)(reg & 0xFF), mask, value); -@@ -180,9 +182,15 @@ static int ab8500_sysctrl_remove(struct platform_device *pdev) - return 0; - } - -+static const struct of_device_id ab8500_sysctrl_match[] = { -+ { .compatible = "stericsson,ab8500-sysctrl", }, -+ {} -+}; -+ - static struct platform_driver ab8500_sysctrl_driver = { - .driver = { - .name = "ab8500-sysctrl", -+ .of_match_table = ab8500_sysctrl_match, - }, - .probe = ab8500_sysctrl_probe, - .remove = ab8500_sysctrl_remove, -diff --git a/drivers/mfd/axp20x.c b/drivers/mfd/axp20x.c -index 9842199e2e6c..89a2dd4d212a 100644 ---- a/drivers/mfd/axp20x.c -+++ b/drivers/mfd/axp20x.c -@@ -164,14 +164,14 @@ static struct resource axp22x_pek_resources[] = { - static struct resource axp288_power_button_resources[] = { - { - .name = "PEK_DBR", -- .start = AXP288_IRQ_POKN, -- .end = AXP288_IRQ_POKN, -+ .start = AXP288_IRQ_POKP, -+ .end = AXP288_IRQ_POKP, - .flags = IORESOURCE_IRQ, - }, - { - .name = "PEK_DBF", -- .start = AXP288_IRQ_POKP, -- .end = AXP288_IRQ_POKP, -+ .start = AXP288_IRQ_POKN, -+ .end = AXP288_IRQ_POKN, - .flags = IORESOURCE_IRQ, - }, - }; -diff --git a/drivers/misc/mei/client.c b/drivers/misc/mei/client.c -index 2ff39fbc70d1..df268365e04e 100644 ---- a/drivers/misc/mei/client.c -+++ b/drivers/misc/mei/client.c -@@ -1300,6 +1300,9 @@ int mei_cl_notify_request(struct mei_cl *cl, struct file *file, u8 request) - return -EOPNOTSUPP; - } - -+ if (!mei_cl_is_connected(cl)) -+ return -ENODEV; -+ - rets = pm_runtime_get(dev->dev); - if (rets < 0 && rets != -EINPROGRESS) { - pm_runtime_put_noidle(dev->dev); -diff --git a/drivers/mmc/host/s3cmci.c b/drivers/mmc/host/s3cmci.c -index 6291d5042ef2..6fed41bd016a 100644 ---- a/drivers/mmc/host/s3cmci.c -+++ b/drivers/mmc/host/s3cmci.c -@@ -21,6 +21,7 @@ - #include - #include - #include -+#include - #include - #include - -diff --git a/drivers/platform/x86/intel_mid_thermal.c b/drivers/platform/x86/intel_mid_thermal.c -index 9f713b832ba3..5c768c4627d3 100644 ---- a/drivers/platform/x86/intel_mid_thermal.c -+++ b/drivers/platform/x86/intel_mid_thermal.c -@@ -550,6 +550,7 @@ static const struct platform_device_id therm_id_table[] = { - { "msic_thermal", 1 }, - { } - }; -+MODULE_DEVICE_TABLE(platform, therm_id_table); - - static struct platform_driver mid_thermal_driver = { - .driver = { -diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c -index 84c13dffa3a8..e7a6f1222642 100644 ---- a/drivers/s390/block/dasd.c -+++ b/drivers/s390/block/dasd.c -@@ -1635,8 +1635,11 @@ void dasd_int_handler(struct ccw_device *cdev, unsigned long intparm, - /* check for for attention message */ - if (scsw_dstat(&irb->scsw) & DEV_STAT_ATTENTION) { - device = dasd_device_from_cdev_locked(cdev); -- device->discipline->check_attention(device, irb->esw.esw1.lpum); -- dasd_put_device(device); -+ if (!IS_ERR(device)) { -+ device->discipline->check_attention(device, -+ irb->esw.esw1.lpum); -+ dasd_put_device(device); -+ } - } - - if (!cqr) -diff --git a/drivers/scsi/aacraid/aachba.c b/drivers/scsi/aacraid/aachba.c -index e4c243748a97..de33801ca31e 100644 ---- a/drivers/scsi/aacraid/aachba.c -+++ b/drivers/scsi/aacraid/aachba.c -@@ -2977,16 +2977,11 @@ static void aac_srb_callback(void *context, struct fib * fibptr) - return; - - BUG_ON(fibptr == NULL); -- dev = fibptr->dev; -- -- scsi_dma_unmap(scsicmd); - -- /* expose physical device if expose_physicald flag is on */ -- if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01) -- && expose_physicals > 0) -- aac_expose_phy_device(scsicmd); -+ dev = fibptr->dev; - - srbreply = (struct aac_srb_reply *) fib_data(fibptr); -+ - scsicmd->sense_buffer[0] = '\0'; /* Initialize sense valid flag to false */ - - if (fibptr->flags & FIB_CONTEXT_FLAG_FASTRESP) { -@@ -2999,158 +2994,176 @@ static void aac_srb_callback(void *context, struct fib * fibptr) - */ - scsi_set_resid(scsicmd, scsi_bufflen(scsicmd) - - le32_to_cpu(srbreply->data_xfer_length)); -- /* -- * First check the fib status -- */ -+ } - -- if (le32_to_cpu(srbreply->status) != ST_OK) { -- int len; - -- printk(KERN_WARNING "aac_srb_callback: srb failed, status = %d\n", le32_to_cpu(srbreply->status)); -- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), -- SCSI_SENSE_BUFFERSIZE); -- scsicmd->result = DID_ERROR << 16 -- | COMMAND_COMPLETE << 8 -- | SAM_STAT_CHECK_CONDITION; -- memcpy(scsicmd->sense_buffer, -- srbreply->sense_data, len); -- } -+ scsi_dma_unmap(scsicmd); - -- /* -- * Next check the srb status -- */ -- switch ((le32_to_cpu(srbreply->srb_status))&0x3f) { -- case SRB_STATUS_ERROR_RECOVERY: -- case SRB_STATUS_PENDING: -- case SRB_STATUS_SUCCESS: -- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; -- break; -- case SRB_STATUS_DATA_OVERRUN: -- switch (scsicmd->cmnd[0]) { -- case READ_6: -- case WRITE_6: -- case READ_10: -- case WRITE_10: -- case READ_12: -- case WRITE_12: -- case READ_16: -- case WRITE_16: -- if (le32_to_cpu(srbreply->data_xfer_length) -- < scsicmd->underflow) -- printk(KERN_WARNING"aacraid: SCSI CMD underflow\n"); -- else -- printk(KERN_WARNING"aacraid: SCSI CMD Data Overrun\n"); -- scsicmd->result = DID_ERROR << 16 -- | COMMAND_COMPLETE << 8; -- break; -- case INQUIRY: { -- scsicmd->result = DID_OK << 16 -- | COMMAND_COMPLETE << 8; -- break; -- } -- default: -- scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; -- break; -- } -- break; -- case SRB_STATUS_ABORTED: -- scsicmd->result = DID_ABORT << 16 | ABORT << 8; -- break; -- case SRB_STATUS_ABORT_FAILED: -- /* -- * Not sure about this one - but assuming the -- * hba was trying to abort for some reason -- */ -- scsicmd->result = DID_ERROR << 16 | ABORT << 8; -- break; -- case SRB_STATUS_PARITY_ERROR: -- scsicmd->result = DID_PARITY << 16 -- | MSG_PARITY_ERROR << 8; -- break; -- case SRB_STATUS_NO_DEVICE: -- case SRB_STATUS_INVALID_PATH_ID: -- case SRB_STATUS_INVALID_TARGET_ID: -- case SRB_STATUS_INVALID_LUN: -- case SRB_STATUS_SELECTION_TIMEOUT: -- scsicmd->result = DID_NO_CONNECT << 16 -- | COMMAND_COMPLETE << 8; -- break; -+ /* expose physical device if expose_physicald flag is on */ -+ if (scsicmd->cmnd[0] == INQUIRY && !(scsicmd->cmnd[1] & 0x01) -+ && expose_physicals > 0) -+ aac_expose_phy_device(scsicmd); - -- case SRB_STATUS_COMMAND_TIMEOUT: -- case SRB_STATUS_TIMEOUT: -- scsicmd->result = DID_TIME_OUT << 16 -- | COMMAND_COMPLETE << 8; -- break; -+ /* -+ * First check the fib status -+ */ - -- case SRB_STATUS_BUSY: -- scsicmd->result = DID_BUS_BUSY << 16 -- | COMMAND_COMPLETE << 8; -- break; -+ if (le32_to_cpu(srbreply->status) != ST_OK) { -+ int len; - -- case SRB_STATUS_BUS_RESET: -- scsicmd->result = DID_RESET << 16 -- | COMMAND_COMPLETE << 8; -- break; -+ pr_warn("aac_srb_callback: srb failed, status = %d\n", -+ le32_to_cpu(srbreply->status)); -+ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), -+ SCSI_SENSE_BUFFERSIZE); -+ scsicmd->result = DID_ERROR << 16 -+ | COMMAND_COMPLETE << 8 -+ | SAM_STAT_CHECK_CONDITION; -+ memcpy(scsicmd->sense_buffer, -+ srbreply->sense_data, len); -+ } - -- case SRB_STATUS_MESSAGE_REJECTED: -+ /* -+ * Next check the srb status -+ */ -+ switch ((le32_to_cpu(srbreply->srb_status))&0x3f) { -+ case SRB_STATUS_ERROR_RECOVERY: -+ case SRB_STATUS_PENDING: -+ case SRB_STATUS_SUCCESS: -+ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; -+ break; -+ case SRB_STATUS_DATA_OVERRUN: -+ switch (scsicmd->cmnd[0]) { -+ case READ_6: -+ case WRITE_6: -+ case READ_10: -+ case WRITE_10: -+ case READ_12: -+ case WRITE_12: -+ case READ_16: -+ case WRITE_16: -+ if (le32_to_cpu(srbreply->data_xfer_length) -+ < scsicmd->underflow) -+ pr_warn("aacraid: SCSI CMD underflow\n"); -+ else -+ pr_warn("aacraid: SCSI CMD Data Overrun\n"); - scsicmd->result = DID_ERROR << 16 -- | MESSAGE_REJECT << 8; -+ | COMMAND_COMPLETE << 8; -+ break; -+ case INQUIRY: -+ scsicmd->result = DID_OK << 16 -+ | COMMAND_COMPLETE << 8; - break; -- case SRB_STATUS_REQUEST_FLUSHED: -- case SRB_STATUS_ERROR: -- case SRB_STATUS_INVALID_REQUEST: -- case SRB_STATUS_REQUEST_SENSE_FAILED: -- case SRB_STATUS_NO_HBA: -- case SRB_STATUS_UNEXPECTED_BUS_FREE: -- case SRB_STATUS_PHASE_SEQUENCE_FAILURE: -- case SRB_STATUS_BAD_SRB_BLOCK_LENGTH: -- case SRB_STATUS_DELAYED_RETRY: -- case SRB_STATUS_BAD_FUNCTION: -- case SRB_STATUS_NOT_STARTED: -- case SRB_STATUS_NOT_IN_USE: -- case SRB_STATUS_FORCE_ABORT: -- case SRB_STATUS_DOMAIN_VALIDATION_FAIL: - default: -+ scsicmd->result = DID_OK << 16 | COMMAND_COMPLETE << 8; -+ break; -+ } -+ break; -+ case SRB_STATUS_ABORTED: -+ scsicmd->result = DID_ABORT << 16 | ABORT << 8; -+ break; -+ case SRB_STATUS_ABORT_FAILED: -+ /* -+ * Not sure about this one - but assuming the -+ * hba was trying to abort for some reason -+ */ -+ scsicmd->result = DID_ERROR << 16 | ABORT << 8; -+ break; -+ case SRB_STATUS_PARITY_ERROR: -+ scsicmd->result = DID_PARITY << 16 -+ | MSG_PARITY_ERROR << 8; -+ break; -+ case SRB_STATUS_NO_DEVICE: -+ case SRB_STATUS_INVALID_PATH_ID: -+ case SRB_STATUS_INVALID_TARGET_ID: -+ case SRB_STATUS_INVALID_LUN: -+ case SRB_STATUS_SELECTION_TIMEOUT: -+ scsicmd->result = DID_NO_CONNECT << 16 -+ | COMMAND_COMPLETE << 8; -+ break; -+ -+ case SRB_STATUS_COMMAND_TIMEOUT: -+ case SRB_STATUS_TIMEOUT: -+ scsicmd->result = DID_TIME_OUT << 16 -+ | COMMAND_COMPLETE << 8; -+ break; -+ -+ case SRB_STATUS_BUSY: -+ scsicmd->result = DID_BUS_BUSY << 16 -+ | COMMAND_COMPLETE << 8; -+ break; -+ -+ case SRB_STATUS_BUS_RESET: -+ scsicmd->result = DID_RESET << 16 -+ | COMMAND_COMPLETE << 8; -+ break; -+ -+ case SRB_STATUS_MESSAGE_REJECTED: -+ scsicmd->result = DID_ERROR << 16 -+ | MESSAGE_REJECT << 8; -+ break; -+ case SRB_STATUS_REQUEST_FLUSHED: -+ case SRB_STATUS_ERROR: -+ case SRB_STATUS_INVALID_REQUEST: -+ case SRB_STATUS_REQUEST_SENSE_FAILED: -+ case SRB_STATUS_NO_HBA: -+ case SRB_STATUS_UNEXPECTED_BUS_FREE: -+ case SRB_STATUS_PHASE_SEQUENCE_FAILURE: -+ case SRB_STATUS_BAD_SRB_BLOCK_LENGTH: -+ case SRB_STATUS_DELAYED_RETRY: -+ case SRB_STATUS_BAD_FUNCTION: -+ case SRB_STATUS_NOT_STARTED: -+ case SRB_STATUS_NOT_IN_USE: -+ case SRB_STATUS_FORCE_ABORT: -+ case SRB_STATUS_DOMAIN_VALIDATION_FAIL: -+ default: - #ifdef AAC_DETAILED_STATUS_INFO -- printk(KERN_INFO "aacraid: SRB ERROR(%u) %s scsi cmd 0x%x - scsi status 0x%x\n", -- le32_to_cpu(srbreply->srb_status) & 0x3F, -- aac_get_status_string( -- le32_to_cpu(srbreply->srb_status) & 0x3F), -- scsicmd->cmnd[0], -- le32_to_cpu(srbreply->scsi_status)); -+ pr_info("aacraid: SRB ERROR(%u) %s scsi cmd 0x%x -scsi status 0x%x\n", -+ le32_to_cpu(srbreply->srb_status) & 0x3F, -+ aac_get_status_string( -+ le32_to_cpu(srbreply->srb_status) & 0x3F), -+ scsicmd->cmnd[0], -+ le32_to_cpu(srbreply->scsi_status)); - #endif -- if ((scsicmd->cmnd[0] == ATA_12) -- || (scsicmd->cmnd[0] == ATA_16)) { -- if (scsicmd->cmnd[2] & (0x01 << 5)) { -- scsicmd->result = DID_OK << 16 -- | COMMAND_COMPLETE << 8; -- break; -- } else { -- scsicmd->result = DID_ERROR << 16 -- | COMMAND_COMPLETE << 8; -- break; -- } -+ /* -+ * When the CC bit is SET by the host in ATA pass thru CDB, -+ * driver is supposed to return DID_OK -+ * -+ * When the CC bit is RESET by the host, driver should -+ * return DID_ERROR -+ */ -+ if ((scsicmd->cmnd[0] == ATA_12) -+ || (scsicmd->cmnd[0] == ATA_16)) { -+ -+ if (scsicmd->cmnd[2] & (0x01 << 5)) { -+ scsicmd->result = DID_OK << 16 -+ | COMMAND_COMPLETE << 8; -+ break; - } else { - scsicmd->result = DID_ERROR << 16 - | COMMAND_COMPLETE << 8; -- break; -+ break; - } -+ } else { -+ scsicmd->result = DID_ERROR << 16 -+ | COMMAND_COMPLETE << 8; -+ break; - } -- if (le32_to_cpu(srbreply->scsi_status) -- == SAM_STAT_CHECK_CONDITION) { -- int len; -+ } -+ if (le32_to_cpu(srbreply->scsi_status) -+ == SAM_STAT_CHECK_CONDITION) { -+ int len; - -- scsicmd->result |= SAM_STAT_CHECK_CONDITION; -- len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), -- SCSI_SENSE_BUFFERSIZE); -+ scsicmd->result |= SAM_STAT_CHECK_CONDITION; -+ len = min_t(u32, le32_to_cpu(srbreply->sense_data_size), -+ SCSI_SENSE_BUFFERSIZE); - #ifdef AAC_DETAILED_STATUS_INFO -- printk(KERN_WARNING "aac_srb_callback: check condition, status = %d len=%d\n", -- le32_to_cpu(srbreply->status), len); -+ pr_warn("aac_srb_callback: check condition, status = %d len=%d\n", -+ le32_to_cpu(srbreply->status), len); - #endif -- memcpy(scsicmd->sense_buffer, -- srbreply->sense_data, len); -- } -+ memcpy(scsicmd->sense_buffer, -+ srbreply->sense_data, len); - } -+ - /* - * OR in the scsi status (already shifted up a bit) - */ -diff --git a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h -index 80f8ec529424..8ed4558238fc 100644 ---- a/drivers/staging/lustre/lustre/include/lustre/lustre_user.h -+++ b/drivers/staging/lustre/lustre/include/lustre/lustre_user.h -@@ -1063,23 +1063,21 @@ struct hsm_action_item { - * \retval buffer - */ - static inline char *hai_dump_data_field(struct hsm_action_item *hai, -- char *buffer, int len) -+ char *buffer, size_t len) - { -- int i, sz, data_len; -+ int i, data_len; - char *ptr; - - ptr = buffer; -- sz = len; - data_len = hai->hai_len - sizeof(*hai); -- for (i = 0 ; (i < data_len) && (sz > 0) ; i++) { -- int cnt; -- -- cnt = snprintf(ptr, sz, "%.2X", -- (unsigned char)hai->hai_data[i]); -- ptr += cnt; -- sz -= cnt; -+ for (i = 0; (i < data_len) && (len > 2); i++) { -+ snprintf(ptr, 3, "%02X", (unsigned char)hai->hai_data[i]); -+ ptr += 2; -+ len -= 2; - } -+ - *ptr = '\0'; -+ - return buffer; - } - -diff --git a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c -index 7f8c70056ffd..040553d6e316 100644 ---- a/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c -+++ b/drivers/staging/lustre/lustre/ldlm/ldlm_lock.c -@@ -550,6 +550,13 @@ struct ldlm_lock *__ldlm_handle2lock(const struct lustre_handle *handle, - if (lock == NULL) - return NULL; - -+ if (lock->l_export && lock->l_export->exp_failed) { -+ CDEBUG(D_INFO, "lock export failed: lock %p, exp %p\n", -+ lock, lock->l_export); -+ LDLM_LOCK_PUT(lock); -+ return NULL; -+ } -+ - /* It's unlikely but possible that someone marked the lock as - * destroyed after we did handle2object on it */ - if (flags == 0 && ((lock->l_flags & LDLM_FL_DESTROYED) == 0)) { -diff --git a/drivers/staging/lustre/lustre/llite/rw26.c b/drivers/staging/lustre/lustre/llite/rw26.c -index 3da4c01e2159..adeefb31cbad 100644 ---- a/drivers/staging/lustre/lustre/llite/rw26.c -+++ b/drivers/staging/lustre/lustre/llite/rw26.c -@@ -376,6 +376,10 @@ static ssize_t ll_direct_IO_26(struct kiocb *iocb, struct iov_iter *iter, - if (!lli->lli_has_smd) - return -EBADF; - -+ /* Check EOF by ourselves */ -+ if (iov_iter_rw(iter) == READ && file_offset >= i_size_read(inode)) -+ return 0; -+ - /* FIXME: io smaller than PAGE_SIZE is broken on ia64 ??? */ - if ((file_offset & ~CFS_PAGE_MASK) || (count & ~CFS_PAGE_MASK)) - return -EINVAL; -diff --git a/drivers/staging/lustre/lustre/ptlrpc/service.c b/drivers/staging/lustre/lustre/ptlrpc/service.c -index f45898f17793..6d3c25ccb297 100644 ---- a/drivers/staging/lustre/lustre/ptlrpc/service.c -+++ b/drivers/staging/lustre/lustre/ptlrpc/service.c -@@ -1240,20 +1240,15 @@ static int ptlrpc_server_hpreq_init(struct ptlrpc_service_part *svcpt, - * it may hit swab race at LU-1044. */ - if (req->rq_ops->hpreq_check) { - rc = req->rq_ops->hpreq_check(req); -- /** -- * XXX: Out of all current -- * ptlrpc_hpreq_ops::hpreq_check(), only -- * ldlm_cancel_hpreq_check() can return an error code; -- * other functions assert in similar places, which seems -- * odd. What also does not seem right is that handlers -- * for those RPCs do not assert on the same checks, but -- * rather handle the error cases. e.g. see -- * ost_rw_hpreq_check(), and ost_brw_read(), -- * ost_brw_write(). -+ if (rc == -ESTALE) { -+ req->rq_status = rc; -+ ptlrpc_error(req); -+ } -+ /** can only return error, -+ * 0 for normal request, -+ * or 1 for high priority request - */ -- if (rc < 0) -- return rc; -- LASSERT(rc == 0 || rc == 1); -+ LASSERT(rc <= 1); - } - - spin_lock_bh(&req->rq_export->exp_rpc_lock); -diff --git a/drivers/staging/rtl8712/ieee80211.h b/drivers/staging/rtl8712/ieee80211.h -index d374824c4f33..7b16c05b5e8b 100644 ---- a/drivers/staging/rtl8712/ieee80211.h -+++ b/drivers/staging/rtl8712/ieee80211.h -@@ -143,52 +143,52 @@ struct ieee_ibss_seq { - }; - - struct ieee80211_hdr { -- u16 frame_ctl; -- u16 duration_id; -+ __le16 frame_ctl; -+ __le16 duration_id; - u8 addr1[ETH_ALEN]; - u8 addr2[ETH_ALEN]; - u8 addr3[ETH_ALEN]; -- u16 seq_ctl; -+ __le16 seq_ctl; - u8 addr4[ETH_ALEN]; --} __packed; -+} __packed __aligned(2); - - struct ieee80211_hdr_3addr { -- u16 frame_ctl; -- u16 duration_id; -+ __le16 frame_ctl; -+ __le16 duration_id; - u8 addr1[ETH_ALEN]; - u8 addr2[ETH_ALEN]; - u8 addr3[ETH_ALEN]; -- u16 seq_ctl; --} __packed; -+ __le16 seq_ctl; -+} __packed __aligned(2); - - - struct ieee80211_hdr_qos { -- u16 frame_ctl; -- u16 duration_id; -+ __le16 frame_ctl; -+ __le16 duration_id; - u8 addr1[ETH_ALEN]; - u8 addr2[ETH_ALEN]; - u8 addr3[ETH_ALEN]; -- u16 seq_ctl; -+ __le16 seq_ctl; - u8 addr4[ETH_ALEN]; -- u16 qc; --} __packed; -+ __le16 qc; -+} __packed __aligned(2); - - struct ieee80211_hdr_3addr_qos { -- u16 frame_ctl; -- u16 duration_id; -+ __le16 frame_ctl; -+ __le16 duration_id; - u8 addr1[ETH_ALEN]; - u8 addr2[ETH_ALEN]; - u8 addr3[ETH_ALEN]; -- u16 seq_ctl; -- u16 qc; -+ __le16 seq_ctl; -+ __le16 qc; - } __packed; - - struct eapol { - u8 snap[6]; -- u16 ethertype; -+ __be16 ethertype; - u8 version; - u8 type; -- u16 length; -+ __le16 length; - } __packed; - - -@@ -528,13 +528,13 @@ struct ieee80211_security { - */ - - struct ieee80211_header_data { -- u16 frame_ctl; -- u16 duration_id; -+ __le16 frame_ctl; -+ __le16 duration_id; - u8 addr1[6]; - u8 addr2[6]; - u8 addr3[6]; -- u16 seq_ctrl; --}; -+ __le16 seq_ctrl; -+} __packed __aligned(2); - - #define BEACON_PROBE_SSID_ID_POSITION 12 - -@@ -566,18 +566,18 @@ struct ieee80211_info_element { - /* - * These are the data types that can make up management packets - * -- u16 auth_algorithm; -- u16 auth_sequence; -- u16 beacon_interval; -- u16 capability; -+ __le16 auth_algorithm; -+ __le16 auth_sequence; -+ __le16 beacon_interval; -+ __le16 capability; - u8 current_ap[ETH_ALEN]; -- u16 listen_interval; -+ __le16 listen_interval; - struct { - u16 association_id:14, reserved:2; - } __packed; -- u32 time_stamp[2]; -- u16 reason; -- u16 status; -+ __le32 time_stamp[2]; -+ __le16 reason; -+ __le16 status; - */ - - #define IEEE80211_DEFAULT_TX_ESSID "Penguin" -@@ -585,16 +585,16 @@ struct ieee80211_info_element { - - struct ieee80211_authentication { - struct ieee80211_header_data header; -- u16 algorithm; -- u16 transaction; -- u16 status; -+ __le16 algorithm; -+ __le16 transaction; -+ __le16 status; - } __packed; - - struct ieee80211_probe_response { - struct ieee80211_header_data header; -- u32 time_stamp[2]; -- u16 beacon_interval; -- u16 capability; -+ __le32 time_stamp[2]; -+ __le16 beacon_interval; -+ __le16 capability; - struct ieee80211_info_element info_element; - } __packed; - -@@ -604,16 +604,16 @@ struct ieee80211_probe_request { - - struct ieee80211_assoc_request_frame { - struct ieee80211_hdr_3addr header; -- u16 capability; -- u16 listen_interval; -+ __le16 capability; -+ __le16 listen_interval; - struct ieee80211_info_element_hdr info_element; - } __packed; - - struct ieee80211_assoc_response_frame { - struct ieee80211_hdr_3addr header; -- u16 capability; -- u16 status; -- u16 aid; -+ __le16 capability; -+ __le16 status; -+ __le16 aid; - } __packed; - - struct ieee80211_txb { -diff --git a/drivers/staging/rtl8712/rtl871x_xmit.c b/drivers/staging/rtl8712/rtl871x_xmit.c -index 68d65d230fe3..d3ad89c7b8af 100644 ---- a/drivers/staging/rtl8712/rtl871x_xmit.c -+++ b/drivers/staging/rtl8712/rtl871x_xmit.c -@@ -339,7 +339,8 @@ sint r8712_update_attrib(struct _adapter *padapter, _pkt *pkt, - /* if in MP_STATE, update pkt_attrib from mp_txcmd, and overwrite - * some settings above.*/ - if (check_fwstate(pmlmepriv, WIFI_MP_STATE)) -- pattrib->priority = (txdesc.txdw1 >> QSEL_SHT) & 0x1f; -+ pattrib->priority = -+ (le32_to_cpu(txdesc.txdw1) >> QSEL_SHT) & 0x1f; - return _SUCCESS; - } - -@@ -479,7 +480,7 @@ static sint make_wlanhdr(struct _adapter *padapter, u8 *hdr, - struct ieee80211_hdr *pwlanhdr = (struct ieee80211_hdr *)hdr; - struct mlme_priv *pmlmepriv = &padapter->mlmepriv; - struct qos_priv *pqospriv = &pmlmepriv->qospriv; -- u16 *fctrl = &pwlanhdr->frame_ctl; -+ __le16 *fctrl = &pwlanhdr->frame_ctl; - - memset(hdr, 0, WLANHDR_OFFSET); - SetFrameSubType(fctrl, pattrib->subtype); -@@ -568,7 +569,7 @@ static sint r8712_put_snap(u8 *data, u16 h_proto) - snap->oui[0] = oui[0]; - snap->oui[1] = oui[1]; - snap->oui[2] = oui[2]; -- *(u16 *)(data + SNAP_SIZE) = htons(h_proto); -+ *(__be16 *)(data + SNAP_SIZE) = htons(h_proto); - return SNAP_SIZE + sizeof(u16); - } - -diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c -index e12bd3635f83..2dd285827169 100644 ---- a/drivers/xen/manage.c -+++ b/drivers/xen/manage.c -@@ -275,8 +275,16 @@ static void sysrq_handler(struct xenbus_watch *watch, const char **vec, - err = xenbus_transaction_start(&xbt); - if (err) - return; -- if (!xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key)) { -- pr_err("Unable to read sysrq code in control/sysrq\n"); -+ err = xenbus_scanf(xbt, "control", "sysrq", "%c", &sysrq_key); -+ if (err < 0) { -+ /* -+ * The Xenstore watch fires directly after registering it and -+ * after a suspend/resume cycle. So ENOENT is no error but -+ * might happen in those cases. -+ */ -+ if (err != -ENOENT) -+ pr_err("Error %d reading sysrq code in control/sysrq\n", -+ err); - xenbus_transaction_end(xbt, 1); - return; - } -diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c -index 297e05c9e2b0..49a0d6b027c1 100644 ---- a/fs/cifs/dir.c -+++ b/fs/cifs/dir.c -@@ -193,7 +193,8 @@ check_name(struct dentry *direntry, struct cifs_tcon *tcon) - struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb); - int i; - -- if (unlikely(direntry->d_name.len > -+ if (unlikely(tcon->fsAttrInfo.MaxPathNameComponentLength && -+ direntry->d_name.len > - le32_to_cpu(tcon->fsAttrInfo.MaxPathNameComponentLength))) - return -ENAMETOOLONG; - -@@ -509,7 +510,7 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, - - rc = check_name(direntry, tcon); - if (rc) -- goto out_free_xid; -+ goto out; - - server = tcon->ses->server; - -diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c -index 84cd77663e1f..1ba82dc5afa3 100644 ---- a/fs/ext4/mballoc.c -+++ b/fs/ext4/mballoc.c -@@ -2136,8 +2136,10 @@ ext4_mb_regular_allocator(struct ext4_allocation_context *ac) - * We search using buddy data only if the order of the request - * is greater than equal to the sbi_s_mb_order2_reqs - * You can tune it via /sys/fs/ext4//mb_order2_req -+ * We also support searching for power-of-two requests only for -+ * requests upto maximum buddy size we have constructed. - */ -- if (i >= sbi->s_mb_order2_reqs) { -+ if (i >= sbi->s_mb_order2_reqs && i <= sb->s_blocksize_bits + 2) { - /* - * This should tell if fe_len is exactly power of 2 - */ -@@ -2207,7 +2209,7 @@ repeat: - } - - ac->ac_groups_scanned++; -- if (cr == 0 && ac->ac_2order < sb->s_blocksize_bits+2) -+ if (cr == 0) - ext4_mb_simple_scan_group(ac, &e4b); - else if (cr == 1 && sbi->s_stripe && - !(ac->ac_g_ex.fe_len % sbi->s_stripe)) -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 32941cd6d34b..8bdb0cc2722f 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -2499,9 +2499,9 @@ static unsigned long ext4_get_stripe_size(struct ext4_sb_info *sbi) - - if (sbi->s_stripe && sbi->s_stripe <= sbi->s_blocks_per_group) - ret = sbi->s_stripe; -- else if (stripe_width <= sbi->s_blocks_per_group) -+ else if (stripe_width && stripe_width <= sbi->s_blocks_per_group) - ret = stripe_width; -- else if (stride <= sbi->s_blocks_per_group) -+ else if (stride && stride <= sbi->s_blocks_per_group) - ret = stride; - else - ret = 0; -diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c -index 86181d6526dc..93e6f029a322 100644 ---- a/fs/ocfs2/alloc.c -+++ b/fs/ocfs2/alloc.c -@@ -7270,13 +7270,24 @@ out: - - static int ocfs2_trim_extent(struct super_block *sb, - struct ocfs2_group_desc *gd, -- u32 start, u32 count) -+ u64 group, u32 start, u32 count) - { - u64 discard, bcount; -+ struct ocfs2_super *osb = OCFS2_SB(sb); - - bcount = ocfs2_clusters_to_blocks(sb, count); -- discard = le64_to_cpu(gd->bg_blkno) + -- ocfs2_clusters_to_blocks(sb, start); -+ discard = ocfs2_clusters_to_blocks(sb, start); -+ -+ /* -+ * For the first cluster group, the gd->bg_blkno is not at the start -+ * of the group, but at an offset from the start. If we add it while -+ * calculating discard for first group, we will wrongly start fstrim a -+ * few blocks after the desried start block and the range can cross -+ * over into the next cluster group. So, add it only if this is not -+ * the first cluster group. -+ */ -+ if (group != osb->first_cluster_group_blkno) -+ discard += le64_to_cpu(gd->bg_blkno); - - trace_ocfs2_trim_extent(sb, (unsigned long long)discard, bcount); - -@@ -7284,7 +7295,7 @@ static int ocfs2_trim_extent(struct super_block *sb, - } - - static int ocfs2_trim_group(struct super_block *sb, -- struct ocfs2_group_desc *gd, -+ struct ocfs2_group_desc *gd, u64 group, - u32 start, u32 max, u32 minbits) - { - int ret = 0, count = 0, next; -@@ -7303,7 +7314,7 @@ static int ocfs2_trim_group(struct super_block *sb, - next = ocfs2_find_next_bit(bitmap, max, start); - - if ((next - start) >= minbits) { -- ret = ocfs2_trim_extent(sb, gd, -+ ret = ocfs2_trim_extent(sb, gd, group, - start, next - start); - if (ret < 0) { - mlog_errno(ret); -@@ -7401,7 +7412,8 @@ int ocfs2_trim_fs(struct super_block *sb, struct fstrim_range *range) - } - - gd = (struct ocfs2_group_desc *)gd_bh->b_data; -- cnt = ocfs2_trim_group(sb, gd, first_bit, last_bit, minlen); -+ cnt = ocfs2_trim_group(sb, gd, group, -+ first_bit, last_bit, minlen); - brelse(gd_bh); - gd_bh = NULL; - if (cnt < 0) { -diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c -index 554522934c44..faa2a3f017f8 100644 ---- a/lib/asn1_decoder.c -+++ b/lib/asn1_decoder.c -@@ -283,6 +283,9 @@ next_op: - if (unlikely(len > datalen - dp)) - goto data_overrun_error; - } -+ } else { -+ if (unlikely(len > datalen - dp)) -+ goto data_overrun_error; - } - - if (flags & FLAG_CONS) { -diff --git a/samples/trace_events/trace-events-sample.c b/samples/trace_events/trace-events-sample.c -index 880a7d1d27d2..4ccff66523c9 100644 ---- a/samples/trace_events/trace-events-sample.c -+++ b/samples/trace_events/trace-events-sample.c -@@ -78,28 +78,36 @@ static int simple_thread_fn(void *arg) - } - - static DEFINE_MUTEX(thread_mutex); -+static int simple_thread_cnt; - - void foo_bar_reg(void) - { -+ mutex_lock(&thread_mutex); -+ if (simple_thread_cnt++) -+ goto out; -+ - pr_info("Starting thread for foo_bar_fn\n"); - /* - * We shouldn't be able to start a trace when the module is - * unloading (there's other locks to prevent that). But - * for consistency sake, we still take the thread_mutex. - */ -- mutex_lock(&thread_mutex); - simple_tsk_fn = kthread_run(simple_thread_fn, NULL, "event-sample-fn"); -+ out: - mutex_unlock(&thread_mutex); - } - - void foo_bar_unreg(void) - { -- pr_info("Killing thread for foo_bar_fn\n"); -- /* protect against module unloading */ - mutex_lock(&thread_mutex); -+ if (--simple_thread_cnt) -+ goto out; -+ -+ pr_info("Killing thread for foo_bar_fn\n"); - if (simple_tsk_fn) - kthread_stop(simple_tsk_fn); - simple_tsk_fn = NULL; -+ out: - mutex_unlock(&thread_mutex); - } - -diff --git a/security/keys/keyring.c b/security/keys/keyring.c -index ef828238cdc0..d5264f950ce1 100644 ---- a/security/keys/keyring.c -+++ b/security/keys/keyring.c -@@ -452,34 +452,33 @@ static long keyring_read(const struct key *keyring, - char __user *buffer, size_t buflen) - { - struct keyring_read_iterator_context ctx; -- unsigned long nr_keys; -- int ret; -+ long ret; - - kenter("{%d},,%zu", key_serial(keyring), buflen); - - if (buflen & (sizeof(key_serial_t) - 1)) - return -EINVAL; - -- nr_keys = keyring->keys.nr_leaves_on_tree; -- if (nr_keys == 0) -- return 0; -- -- /* Calculate how much data we could return */ -- if (!buffer || !buflen) -- return nr_keys * sizeof(key_serial_t); -- -- /* Copy the IDs of the subscribed keys into the buffer */ -- ctx.buffer = (key_serial_t __user *)buffer; -- ctx.buflen = buflen; -- ctx.count = 0; -- ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx); -- if (ret < 0) { -- kleave(" = %d [iterate]", ret); -- return ret; -+ /* Copy as many key IDs as fit into the buffer */ -+ if (buffer && buflen) { -+ ctx.buffer = (key_serial_t __user *)buffer; -+ ctx.buflen = buflen; -+ ctx.count = 0; -+ ret = assoc_array_iterate(&keyring->keys, -+ keyring_read_iterator, &ctx); -+ if (ret < 0) { -+ kleave(" = %ld [iterate]", ret); -+ return ret; -+ } - } - -- kleave(" = %zu [ok]", ctx.count); -- return ctx.count; -+ /* Return the size of the buffer needed */ -+ ret = keyring->keys.nr_leaves_on_tree * sizeof(key_serial_t); -+ if (ret <= buflen) -+ kleave("= %ld [ok]", ret); -+ else -+ kleave("= %ld [buffer too small]", ret); -+ return ret; - } - - /* -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index e847b9923c19..b36de76f24e2 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -676,7 +676,7 @@ static int deliver_to_subscribers(struct snd_seq_client *client, - if (atomic) - read_lock(&grp->list_lock); - else -- down_read(&grp->list_mutex); -+ down_read_nested(&grp->list_mutex, hop); - list_for_each_entry(subs, &grp->list_head, src_list) { - /* both ports ready? */ - if (atomic_read(&subs->ref_count) != 2) -diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c -index 2e908225d754..0b4b028e8e98 100644 ---- a/sound/core/timer_compat.c -+++ b/sound/core/timer_compat.c -@@ -106,7 +106,8 @@ enum { - #endif /* CONFIG_X86_X32 */ - }; - --static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg) -+static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg) - { - void __user *argp = compat_ptr(arg); - -@@ -127,7 +128,7 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns - case SNDRV_TIMER_IOCTL_PAUSE: - case SNDRV_TIMER_IOCTL_PAUSE_OLD: - case SNDRV_TIMER_IOCTL_NEXT_DEVICE: -- return snd_timer_user_ioctl(file, cmd, (unsigned long)argp); -+ return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp); - case SNDRV_TIMER_IOCTL_INFO32: - return snd_timer_user_info_compat(file, argp); - case SNDRV_TIMER_IOCTL_STATUS32: -@@ -139,3 +140,15 @@ static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, uns - } - return -ENOIOCTLCMD; - } -+ -+static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, -+ unsigned long arg) -+{ -+ struct snd_timer_user *tu = file->private_data; -+ long ret; -+ -+ mutex_lock(&tu->ioctl_lock); -+ ret = __snd_timer_user_ioctl_compat(file, cmd, arg); -+ mutex_unlock(&tu->ioctl_lock); -+ return ret; -+} -diff --git a/sound/soc/codecs/adau17x1.c b/sound/soc/codecs/adau17x1.c -index fcf05b254ecd..0b9e13eb0a0a 100644 ---- a/sound/soc/codecs/adau17x1.c -+++ b/sound/soc/codecs/adau17x1.c -@@ -89,6 +89,27 @@ static int adau17x1_pll_event(struct snd_soc_dapm_widget *w, - return 0; - } - -+static int adau17x1_adc_fixup(struct snd_soc_dapm_widget *w, -+ struct snd_kcontrol *kcontrol, int event) -+{ -+ struct snd_soc_codec *codec = snd_soc_dapm_to_codec(w->dapm); -+ struct adau *adau = snd_soc_codec_get_drvdata(codec); -+ -+ /* -+ * If we are capturing, toggle the ADOSR bit in Converter Control 0 to -+ * avoid losing SNR (workaround from ADI). This must be done after -+ * the ADC(s) have been enabled. According to the data sheet, it is -+ * normally illegal to set this bit when the sampling rate is 96 kHz, -+ * but according to ADI it is acceptable for this workaround. -+ */ -+ regmap_update_bits(adau->regmap, ADAU17X1_CONVERTER0, -+ ADAU17X1_CONVERTER0_ADOSR, ADAU17X1_CONVERTER0_ADOSR); -+ regmap_update_bits(adau->regmap, ADAU17X1_CONVERTER0, -+ ADAU17X1_CONVERTER0_ADOSR, 0); -+ -+ return 0; -+} -+ - static const char * const adau17x1_mono_stereo_text[] = { - "Stereo", - "Mono Left Channel (L+R)", -@@ -120,7 +141,8 @@ static const struct snd_soc_dapm_widget adau17x1_dapm_widgets[] = { - SND_SOC_DAPM_MUX("Right DAC Mode Mux", SND_SOC_NOPM, 0, 0, - &adau17x1_dac_mode_mux), - -- SND_SOC_DAPM_ADC("Left Decimator", NULL, ADAU17X1_ADC_CONTROL, 0, 0), -+ SND_SOC_DAPM_ADC_E("Left Decimator", NULL, ADAU17X1_ADC_CONTROL, 0, 0, -+ adau17x1_adc_fixup, SND_SOC_DAPM_POST_PMU), - SND_SOC_DAPM_ADC("Right Decimator", NULL, ADAU17X1_ADC_CONTROL, 1, 0), - SND_SOC_DAPM_DAC("Left DAC", NULL, ADAU17X1_DAC_CONTROL0, 0, 0), - SND_SOC_DAPM_DAC("Right DAC", NULL, ADAU17X1_DAC_CONTROL0, 1, 0), -diff --git a/sound/soc/codecs/adau17x1.h b/sound/soc/codecs/adau17x1.h -index e13583e6ff56..6b46461cdc03 100644 ---- a/sound/soc/codecs/adau17x1.h -+++ b/sound/soc/codecs/adau17x1.h -@@ -123,5 +123,7 @@ bool adau17x1_has_dsp(struct adau *adau); - - #define ADAU17X1_CONVERTER0_CONVSR_MASK 0x7 - -+#define ADAU17X1_CONVERTER0_ADOSR BIT(3) -+ - - #endif -diff --git a/tools/perf/scripts/perl/Perf-Trace-Util/Build b/tools/perf/scripts/perl/Perf-Trace-Util/Build -index 928e110179cb..34faecf774ae 100644 ---- a/tools/perf/scripts/perl/Perf-Trace-Util/Build -+++ b/tools/perf/scripts/perl/Perf-Trace-Util/Build -@@ -1,3 +1,5 @@ - libperf-y += Context.o - --CFLAGS_Context.o += $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -Wno-unused-parameter -Wno-nested-externs -Wno-undef -Wno-switch-default -+CFLAGS_Context.o += $(PERL_EMBED_CCOPTS) -Wno-redundant-decls -Wno-strict-prototypes -+CFLAGS_Context.o += -Wno-unused-parameter -Wno-nested-externs -Wno-undef -+CFLAGS_Context.o += -Wno-switch-default -Wno-shadow -diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c -index 38304b7e4f81..e81dfb2e239c 100644 ---- a/tools/perf/util/parse-events.c -+++ b/tools/perf/util/parse-events.c -@@ -291,10 +291,11 @@ __add_event(struct list_head *list, int *idx, - - event_attr_init(attr); - -- evsel = perf_evsel__new_idx(attr, (*idx)++); -+ evsel = perf_evsel__new_idx(attr, *idx); - if (!evsel) - return NULL; - -+ (*idx)++; - evsel->cpus = cpu_map__get(cpus); - evsel->own_cpus = cpu_map__get(cpus); - diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.97-98.patch b/patch/kernel/mvebu64-default/03-patch-4.4.97-98.patch deleted file mode 100644 index 38d2d5fa5d77..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.97-98.patch +++ /dev/null @@ -1,1881 +0,0 @@ -diff --git a/Makefile b/Makefile -index fb1a40d64ba8..5d62e23347f9 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 97 -+SUBLEVEL = 98 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/configs/omap2plus_defconfig b/arch/arm/configs/omap2plus_defconfig -index c5e1943e5427..09ebd37e01e0 100644 ---- a/arch/arm/configs/omap2plus_defconfig -+++ b/arch/arm/configs/omap2plus_defconfig -@@ -221,6 +221,7 @@ CONFIG_SERIO=m - CONFIG_SERIAL_8250=y - CONFIG_SERIAL_8250_CONSOLE=y - CONFIG_SERIAL_8250_NR_UARTS=32 -+CONFIG_SERIAL_8250_RUNTIME_UARTS=6 - CONFIG_SERIAL_8250_EXTENDED=y - CONFIG_SERIAL_8250_MANY_PORTS=y - CONFIG_SERIAL_8250_SHARE_IRQ=y -diff --git a/arch/arm/kernel/traps.c b/arch/arm/kernel/traps.c -index bc698383e822..c92b535150a0 100644 ---- a/arch/arm/kernel/traps.c -+++ b/arch/arm/kernel/traps.c -@@ -132,30 +132,26 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom, - set_fs(fs); - } - --static void dump_instr(const char *lvl, struct pt_regs *regs) -+static void __dump_instr(const char *lvl, struct pt_regs *regs) - { - unsigned long addr = instruction_pointer(regs); - const int thumb = thumb_mode(regs); - const int width = thumb ? 4 : 8; -- mm_segment_t fs; - char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; - int i; - - /* -- * We need to switch to kernel mode so that we can use __get_user -- * to safely read from kernel space. Note that we now dump the -- * code first, just in case the backtrace kills us. -+ * Note that we now dump the code first, just in case the backtrace -+ * kills us. - */ -- fs = get_fs(); -- set_fs(KERNEL_DS); - - for (i = -4; i < 1 + !!thumb; i++) { - unsigned int val, bad; - - if (thumb) -- bad = __get_user(val, &((u16 *)addr)[i]); -+ bad = get_user(val, &((u16 *)addr)[i]); - else -- bad = __get_user(val, &((u32 *)addr)[i]); -+ bad = get_user(val, &((u32 *)addr)[i]); - - if (!bad) - p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ", -@@ -166,8 +162,20 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) - } - } - printk("%sCode: %s\n", lvl, str); -+} - -- set_fs(fs); -+static void dump_instr(const char *lvl, struct pt_regs *regs) -+{ -+ mm_segment_t fs; -+ -+ if (!user_mode(regs)) { -+ fs = get_fs(); -+ set_fs(KERNEL_DS); -+ __dump_instr(lvl, regs); -+ set_fs(fs); -+ } else { -+ __dump_instr(lvl, regs); -+ } - } - - #ifdef CONFIG_ARM_UNWIND -diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c -index 58fca9ad5fcc..3446b6fb3acb 100644 ---- a/arch/mips/ar7/platform.c -+++ b/arch/mips/ar7/platform.c -@@ -576,6 +576,7 @@ static int __init ar7_register_uarts(void) - uart_port.type = PORT_AR7; - uart_port.uartclk = clk_get_rate(bus_clk) / 2; - uart_port.iotype = UPIO_MEM32; -+ uart_port.flags = UPF_FIXED_TYPE; - uart_port.regshift = 2; - - uart_port.line = 0; -@@ -654,6 +655,10 @@ static int __init ar7_register_devices(void) - u32 val; - int res; - -+ res = ar7_gpio_init(); -+ if (res) -+ pr_warn("unable to register gpios: %d\n", res); -+ - res = ar7_register_uarts(); - if (res) - pr_err("unable to setup uart(s): %d\n", res); -diff --git a/arch/mips/ar7/prom.c b/arch/mips/ar7/prom.c -index a23adc49d50f..36aabee9cba4 100644 ---- a/arch/mips/ar7/prom.c -+++ b/arch/mips/ar7/prom.c -@@ -246,8 +246,6 @@ void __init prom_init(void) - ar7_init_cmdline(fw_arg0, (char **)fw_arg1); - ar7_init_env((struct env_var *)fw_arg2); - console_config(); -- -- ar7_gpio_init(); - } - - #define PORT(offset) (KSEG1ADDR(AR7_REGS_UART0 + (offset * 4))) -diff --git a/arch/mips/include/asm/mips-cm.h b/arch/mips/include/asm/mips-cm.h -index 6516e9da5133..b836ddec82b7 100644 ---- a/arch/mips/include/asm/mips-cm.h -+++ b/arch/mips/include/asm/mips-cm.h -@@ -238,8 +238,8 @@ BUILD_CM_Cx_R_(tcid_8_priority, 0x80) - #define CM_GCR_BASE_GCRBASE_MSK (_ULCAST_(0x1ffff) << 15) - #define CM_GCR_BASE_CMDEFTGT_SHF 0 - #define CM_GCR_BASE_CMDEFTGT_MSK (_ULCAST_(0x3) << 0) --#define CM_GCR_BASE_CMDEFTGT_DISABLED 0 --#define CM_GCR_BASE_CMDEFTGT_MEM 1 -+#define CM_GCR_BASE_CMDEFTGT_MEM 0 -+#define CM_GCR_BASE_CMDEFTGT_RESERVED 1 - #define CM_GCR_BASE_CMDEFTGT_IOCU0 2 - #define CM_GCR_BASE_CMDEFTGT_IOCU1 3 - -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 477ba026c3e5..163b3449a8de 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -49,9 +49,7 @@ - #ifdef CONFIG_HOTPLUG_CPU - void arch_cpu_idle_dead(void) - { -- /* What the heck is this check doing ? */ -- if (!cpumask_test_cpu(smp_processor_id(), &cpu_callin_map)) -- play_dead(); -+ play_dead(); - } - #endif - -diff --git a/arch/mips/kernel/smp.c b/arch/mips/kernel/smp.c -index 7fef02a9eb85..4af08c197177 100644 ---- a/arch/mips/kernel/smp.c -+++ b/arch/mips/kernel/smp.c -@@ -64,6 +64,9 @@ EXPORT_SYMBOL(cpu_sibling_map); - cpumask_t cpu_core_map[NR_CPUS] __read_mostly; - EXPORT_SYMBOL(cpu_core_map); - -+static DECLARE_COMPLETION(cpu_starting); -+static DECLARE_COMPLETION(cpu_running); -+ - /* - * A logcal cpu mask containing only one VPE per core to - * reduce the number of IPIs on large MT systems. -@@ -174,9 +177,12 @@ asmlinkage void start_secondary(void) - cpumask_set_cpu(cpu, &cpu_coherent_mask); - notify_cpu_starting(cpu); - -- cpumask_set_cpu(cpu, &cpu_callin_map); -+ /* Notify boot CPU that we're starting & ready to sync counters */ -+ complete(&cpu_starting); -+ - synchronise_count_slave(cpu); - -+ /* The CPU is running and counters synchronised, now mark it online */ - set_cpu_online(cpu, true); - - set_cpu_sibling_map(cpu); -@@ -184,6 +190,12 @@ asmlinkage void start_secondary(void) - - calculate_cpu_foreign_map(); - -+ /* -+ * Notify boot CPU that we're up & online and it can safely return -+ * from __cpu_up -+ */ -+ complete(&cpu_running); -+ - /* - * irq will be enabled in ->smp_finish(), enabling it too early - * is dangerous. -@@ -242,22 +254,23 @@ void smp_prepare_boot_cpu(void) - { - set_cpu_possible(0, true); - set_cpu_online(0, true); -- cpumask_set_cpu(0, &cpu_callin_map); - } - - int __cpu_up(unsigned int cpu, struct task_struct *tidle) - { - mp_ops->boot_secondary(cpu, tidle); - -- /* -- * Trust is futile. We should really have timeouts ... -- */ -- while (!cpumask_test_cpu(cpu, &cpu_callin_map)) { -- udelay(100); -- schedule(); -+ /* Wait for CPU to start and be ready to sync counters */ -+ if (!wait_for_completion_timeout(&cpu_starting, -+ msecs_to_jiffies(1000))) { -+ pr_crit("CPU%u: failed to start\n", cpu); -+ return -EIO; - } - - synchronise_count_master(cpu); -+ -+ /* Wait for CPU to finish startup & mark itself online before return */ -+ wait_for_completion(&cpu_running); - return 0; - } - -diff --git a/arch/mips/mm/uasm-micromips.c b/arch/mips/mm/uasm-micromips.c -index d78178daea4b..e2fe48dd67b5 100644 ---- a/arch/mips/mm/uasm-micromips.c -+++ b/arch/mips/mm/uasm-micromips.c -@@ -75,7 +75,7 @@ static struct insn insn_table_MM[] = { - { insn_jr, M(mm_pool32a_op, 0, 0, 0, mm_jalr_op, mm_pool32axf_op), RS }, - { insn_lb, M(mm_lb32_op, 0, 0, 0, 0, 0), RT | RS | SIMM }, - { insn_ld, 0, 0 }, -- { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RS | RS | SIMM }, -+ { insn_lh, M(mm_lh32_op, 0, 0, 0, 0, 0), RT | RS | SIMM }, - { insn_ll, M(mm_pool32c_op, 0, 0, (mm_ll_func << 1), 0, 0), RS | RT | SIMM }, - { insn_lld, 0, 0 }, - { insn_lui, M(mm_pool32i_op, mm_lui_op, 0, 0, 0, 0), RS | SIMM }, -diff --git a/arch/powerpc/boot/dts/fsl/kmcoge4.dts b/arch/powerpc/boot/dts/fsl/kmcoge4.dts -index 6858ec9ef295..1a953d9edf1e 100644 ---- a/arch/powerpc/boot/dts/fsl/kmcoge4.dts -+++ b/arch/powerpc/boot/dts/fsl/kmcoge4.dts -@@ -83,6 +83,10 @@ - }; - }; - -+ sdhc@114000 { -+ status = "disabled"; -+ }; -+ - i2c@119000 { - status = "disabled"; - }; -diff --git a/arch/powerpc/kvm/book3s_hv_rm_xics.c b/arch/powerpc/kvm/book3s_hv_rm_xics.c -index 24f58076d49e..1d2bc84338bf 100644 ---- a/arch/powerpc/kvm/book3s_hv_rm_xics.c -+++ b/arch/powerpc/kvm/book3s_hv_rm_xics.c -@@ -280,6 +280,7 @@ static void icp_rm_deliver_irq(struct kvmppc_xics *xics, struct kvmppc_icp *icp, - */ - if (reject && reject != XICS_IPI) { - arch_spin_unlock(&ics->lock); -+ icp->n_reject++; - new_irq = reject; - goto again; - } -@@ -611,10 +612,8 @@ int kvmppc_rm_h_eoi(struct kvm_vcpu *vcpu, unsigned long xirr) - state = &ics->irq_state[src]; - - /* Still asserted, resend it */ -- if (state->asserted) { -- icp->n_reject++; -+ if (state->asserted) - icp_rm_deliver_irq(xics, icp, irq); -- } - - if (!hlist_empty(&vcpu->kvm->irq_ack_notifier_list)) { - icp->rm_action |= XICS_RM_NOTIFY_EOI; -diff --git a/arch/sh/kernel/cpu/sh3/setup-sh770x.c b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -index 538c10db3537..8dc315b212c2 100644 ---- a/arch/sh/kernel/cpu/sh3/setup-sh770x.c -+++ b/arch/sh/kernel/cpu/sh3/setup-sh770x.c -@@ -165,7 +165,6 @@ static struct plat_sci_port scif2_platform_data = { - .scscr = SCSCR_TE | SCSCR_RE, - .type = PORT_IRDA, - .ops = &sh770x_sci_port_ops, -- .regshift = 1, - }; - - static struct resource scif2_resources[] = { -diff --git a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S -index 85c4e1cf7172..e1693457c178 100644 ---- a/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S -+++ b/arch/x86/crypto/sha-mb/sha1_mb_mgr_flush_avx2.S -@@ -174,8 +174,8 @@ LABEL skip_ %I - .endr - - # Find min length -- vmovdqa _lens+0*16(state), %xmm0 -- vmovdqa _lens+1*16(state), %xmm1 -+ vmovdqu _lens+0*16(state), %xmm0 -+ vmovdqu _lens+1*16(state), %xmm1 - - vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A} - vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C} -@@ -195,8 +195,8 @@ LABEL skip_ %I - vpsubd %xmm2, %xmm0, %xmm0 - vpsubd %xmm2, %xmm1, %xmm1 - -- vmovdqa %xmm0, _lens+0*16(state) -- vmovdqa %xmm1, _lens+1*16(state) -+ vmovdqu %xmm0, _lens+0*16(state) -+ vmovdqu %xmm1, _lens+1*16(state) - - # "state" and "args" are the same address, arg1 - # len is arg2 -@@ -260,8 +260,8 @@ ENTRY(sha1_mb_mgr_get_comp_job_avx2) - jc .return_null - - # Find min length -- vmovdqa _lens(state), %xmm0 -- vmovdqa _lens+1*16(state), %xmm1 -+ vmovdqu _lens(state), %xmm0 -+ vmovdqu _lens+1*16(state), %xmm1 - - vpminud %xmm1, %xmm0, %xmm2 # xmm2 has {D,C,B,A} - vpalignr $8, %xmm2, %xmm3, %xmm3 # xmm3 has {x,x,D,C} -diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h -index b8c75f3aade8..d788b0cdc0ad 100644 ---- a/arch/x86/include/asm/uaccess.h -+++ b/arch/x86/include/asm/uaccess.h -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -66,6 +67,12 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un - __chk_range_not_ok((unsigned long __force)(addr), size, limit); \ - }) - -+#ifdef CONFIG_DEBUG_ATOMIC_SLEEP -+# define WARN_ON_IN_IRQ() WARN_ON_ONCE(!in_task()) -+#else -+# define WARN_ON_IN_IRQ() -+#endif -+ - /** - * access_ok: - Checks if a user space pointer is valid - * @type: Type of access: %VERIFY_READ or %VERIFY_WRITE. Note that -@@ -86,8 +93,11 @@ static inline bool __chk_range_not_ok(unsigned long addr, unsigned long size, un - * checks that the pointer is in the user space range - after calling - * this function, memory access functions may still return -EFAULT. - */ --#define access_ok(type, addr, size) \ -- likely(!__range_not_ok(addr, size, user_addr_max())) -+#define access_ok(type, addr, size) \ -+({ \ -+ WARN_ON_IN_IRQ(); \ -+ likely(!__range_not_ok(addr, size, user_addr_max())); \ -+}) - - /* - * The exception table consists of pairs of addresses relative to the -diff --git a/arch/x86/oprofile/op_model_ppro.c b/arch/x86/oprofile/op_model_ppro.c -index d90528ea5412..12c051d19e4b 100644 ---- a/arch/x86/oprofile/op_model_ppro.c -+++ b/arch/x86/oprofile/op_model_ppro.c -@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(void) - eax.full = cpuid_eax(0xa); - - /* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */ -- if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 && -- __this_cpu_read(cpu_info.x86_model) == 15) { -+ if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 && -+ boot_cpu_data.x86_model == 15) { - eax.split.version_id = 2; - eax.split.num_counters = 2; - eax.split.bit_width = 40; -diff --git a/crypto/asymmetric_keys/pkcs7_parser.c b/crypto/asymmetric_keys/pkcs7_parser.c -index 2516e97c58f1..5e5a8adac0ba 100644 ---- a/crypto/asymmetric_keys/pkcs7_parser.c -+++ b/crypto/asymmetric_keys/pkcs7_parser.c -@@ -87,7 +87,7 @@ EXPORT_SYMBOL_GPL(pkcs7_free_message); - static int pkcs7_check_authattrs(struct pkcs7_message *msg) - { - struct pkcs7_signed_info *sinfo; -- bool want; -+ bool want = false; - - sinfo = msg->signed_infos; - if (!sinfo) -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index fbdddd6f94b8..ca3bcc81b623 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -2736,7 +2736,7 @@ static int rbd_img_obj_parent_read_full(struct rbd_obj_request *obj_request) - * from the parent. - */ - page_count = (u32)calc_pages_for(0, length); -- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); -+ pages = ceph_alloc_page_vector(page_count, GFP_NOIO); - if (IS_ERR(pages)) { - result = PTR_ERR(pages); - pages = NULL; -@@ -2863,7 +2863,7 @@ static int rbd_img_obj_exists_submit(struct rbd_obj_request *obj_request) - */ - size = sizeof (__le64) + sizeof (__le32) + sizeof (__le32); - page_count = (u32)calc_pages_for(0, size); -- pages = ceph_alloc_page_vector(page_count, GFP_KERNEL); -+ pages = ceph_alloc_page_vector(page_count, GFP_NOIO); - if (IS_ERR(pages)) - return PTR_ERR(pages); - -diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c -index 72f138985e18..d83ab4bac8b1 100644 ---- a/drivers/crypto/vmx/aes_ctr.c -+++ b/drivers/crypto/vmx/aes_ctr.c -@@ -80,11 +80,13 @@ static int p8_aes_ctr_setkey(struct crypto_tfm *tfm, const u8 *key, - int ret; - struct p8_aes_ctr_ctx *ctx = crypto_tfm_ctx(tfm); - -+ preempt_disable(); - pagefault_disable(); - enable_kernel_altivec(); - enable_kernel_vsx(); - ret = aes_p8_set_encrypt_key(key, keylen * 8, &ctx->enc_key); - pagefault_enable(); -+ preempt_enable(); - - ret += crypto_blkcipher_setkey(ctx->fallback, key, keylen); - return ret; -@@ -99,11 +101,13 @@ static void p8_aes_ctr_final(struct p8_aes_ctr_ctx *ctx, - u8 *dst = walk->dst.virt.addr; - unsigned int nbytes = walk->nbytes; - -+ preempt_disable(); - pagefault_disable(); - enable_kernel_altivec(); - enable_kernel_vsx(); - aes_p8_encrypt(ctrblk, keystream, &ctx->enc_key); - pagefault_enable(); -+ preempt_enable(); - - crypto_xor(keystream, src, nbytes); - memcpy(dst, keystream, nbytes); -@@ -132,6 +136,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc, - blkcipher_walk_init(&walk, dst, src, nbytes); - ret = blkcipher_walk_virt_block(desc, &walk, AES_BLOCK_SIZE); - while ((nbytes = walk.nbytes) >= AES_BLOCK_SIZE) { -+ preempt_disable(); - pagefault_disable(); - enable_kernel_altivec(); - enable_kernel_vsx(); -@@ -143,6 +148,7 @@ static int p8_aes_ctr_crypt(struct blkcipher_desc *desc, - &ctx->enc_key, - walk.iv); - pagefault_enable(); -+ preempt_enable(); - - /* We need to update IV mostly for last bytes/round */ - inc = (nbytes & AES_BLOCK_MASK) / AES_BLOCK_SIZE; -diff --git a/drivers/gpu/drm/drm_drv.c b/drivers/gpu/drm/drm_drv.c -index 7dd6728dd092..ccc2044af831 100644 ---- a/drivers/gpu/drm/drm_drv.c -+++ b/drivers/gpu/drm/drm_drv.c -@@ -312,7 +312,7 @@ static int drm_minor_register(struct drm_device *dev, unsigned int type) - ret = drm_debugfs_init(minor, minor->index, drm_debugfs_root); - if (ret) { - DRM_ERROR("DRM: Failed to initialize /sys/kernel/debug/dri.\n"); -- return ret; -+ goto err_debugfs; - } - - ret = device_add(minor->kdev); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -index f3f31f995878..be3971b22a02 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_drv.c -@@ -708,7 +708,7 @@ static int vmw_driver_load(struct drm_device *dev, unsigned long chipset) - * allocation taken by fbdev - */ - if (!(dev_priv->capabilities & SVGA_CAP_3D)) -- mem_size *= 2; -+ mem_size *= 3; - - dev_priv->max_mob_pages = mem_size * 1024 / PAGE_SIZE; - dev_priv->prim_bb_mem = -diff --git a/drivers/iio/trigger/iio-trig-interrupt.c b/drivers/iio/trigger/iio-trig-interrupt.c -index 572bc6f02ca8..e18f12b74610 100644 ---- a/drivers/iio/trigger/iio-trig-interrupt.c -+++ b/drivers/iio/trigger/iio-trig-interrupt.c -@@ -58,7 +58,7 @@ static int iio_interrupt_trigger_probe(struct platform_device *pdev) - trig_info = kzalloc(sizeof(*trig_info), GFP_KERNEL); - if (!trig_info) { - ret = -ENOMEM; -- goto error_put_trigger; -+ goto error_free_trigger; - } - iio_trigger_set_drvdata(trig, trig_info); - trig_info->irq = irq; -@@ -83,8 +83,8 @@ error_release_irq: - free_irq(irq, trig); - error_free_trig_info: - kfree(trig_info); --error_put_trigger: -- iio_trigger_put(trig); -+error_free_trigger: -+ iio_trigger_free(trig); - error_ret: - return ret; - } -@@ -99,7 +99,7 @@ static int iio_interrupt_trigger_remove(struct platform_device *pdev) - iio_trigger_unregister(trig); - free_irq(trig_info->irq, trig); - kfree(trig_info); -- iio_trigger_put(trig); -+ iio_trigger_free(trig); - - return 0; - } -diff --git a/drivers/iio/trigger/iio-trig-sysfs.c b/drivers/iio/trigger/iio-trig-sysfs.c -index 3dfab2bc6d69..202e8b89caf2 100644 ---- a/drivers/iio/trigger/iio-trig-sysfs.c -+++ b/drivers/iio/trigger/iio-trig-sysfs.c -@@ -174,7 +174,7 @@ static int iio_sysfs_trigger_probe(int id) - return 0; - - out2: -- iio_trigger_put(t->trig); -+ iio_trigger_free(t->trig); - free_t: - kfree(t); - out1: -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -index 2018d24344de..f74b11542603 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c -@@ -1373,7 +1373,7 @@ static void ipoib_cm_tx_reap(struct work_struct *work) - - while (!list_empty(&priv->cm.reap_list)) { - p = list_entry(priv->cm.reap_list.next, typeof(*p), list); -- list_del(&p->list); -+ list_del_init(&p->list); - spin_unlock_irqrestore(&priv->lock, flags); - netif_tx_unlock_bh(dev); - ipoib_cm_tx_destroy(p); -diff --git a/drivers/input/keyboard/mpr121_touchkey.c b/drivers/input/keyboard/mpr121_touchkey.c -index 0fd612dd76ed..aaf43befffaa 100644 ---- a/drivers/input/keyboard/mpr121_touchkey.c -+++ b/drivers/input/keyboard/mpr121_touchkey.c -@@ -87,7 +87,8 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id) - struct mpr121_touchkey *mpr121 = dev_id; - struct i2c_client *client = mpr121->client; - struct input_dev *input = mpr121->input_dev; -- unsigned int key_num, key_val, pressed; -+ unsigned long bit_changed; -+ unsigned int key_num; - int reg; - - reg = i2c_smbus_read_byte_data(client, ELE_TOUCH_STATUS_1_ADDR); -@@ -105,18 +106,22 @@ static irqreturn_t mpr_touchkey_interrupt(int irq, void *dev_id) - - reg &= TOUCH_STATUS_MASK; - /* use old press bit to figure out which bit changed */ -- key_num = ffs(reg ^ mpr121->statusbits) - 1; -- pressed = reg & (1 << key_num); -+ bit_changed = reg ^ mpr121->statusbits; - mpr121->statusbits = reg; -+ for_each_set_bit(key_num, &bit_changed, mpr121->keycount) { -+ unsigned int key_val, pressed; - -- key_val = mpr121->keycodes[key_num]; -+ pressed = reg & BIT(key_num); -+ key_val = mpr121->keycodes[key_num]; - -- input_event(input, EV_MSC, MSC_SCAN, key_num); -- input_report_key(input, key_val, pressed); -- input_sync(input); -+ input_event(input, EV_MSC, MSC_SCAN, key_num); -+ input_report_key(input, key_val, pressed); -+ -+ dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, -+ pressed ? "pressed" : "released"); - -- dev_dbg(&client->dev, "key %d %d %s\n", key_num, key_val, -- pressed ? "pressed" : "released"); -+ } -+ input_sync(input); - - out: - return IRQ_HANDLED; -@@ -231,6 +236,7 @@ static int mpr_touchkey_probe(struct i2c_client *client, - input_dev->id.bustype = BUS_I2C; - input_dev->dev.parent = &client->dev; - input_dev->evbit[0] = BIT_MASK(EV_KEY) | BIT_MASK(EV_REP); -+ input_set_capability(input_dev, EV_MSC, MSC_SCAN); - - input_dev->keycode = mpr121->keycodes; - input_dev->keycodesize = sizeof(mpr121->keycodes[0]); -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index b8c50d883b2c..c9d491bc85e0 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1240,6 +1240,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0605", 0 }, - { "ELAN0609", 0 }, - { "ELAN060B", 0 }, -+ { "ELAN060C", 0 }, - { "ELAN0611", 0 }, - { "ELAN1000", 0 }, - { } -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index 00df3832faab..64f1eb8fdcbc 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -1033,13 +1033,8 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid, - } - } - -- /* Nuke the existing Config, as we're going to rewrite it */ -- val &= ~(STRTAB_STE_0_CFG_MASK << STRTAB_STE_0_CFG_SHIFT); -- -- if (ste->valid) -- val |= STRTAB_STE_0_V; -- else -- val &= ~STRTAB_STE_0_V; -+ /* Nuke the existing STE_0 value, as we're going to rewrite it */ -+ val = ste->valid ? STRTAB_STE_0_V : 0; - - if (ste->bypass) { - val |= disable_bypass ? STRTAB_STE_0_CFG_ABORT -@@ -1068,7 +1063,6 @@ static void arm_smmu_write_strtab_ent(struct arm_smmu_device *smmu, u32 sid, - val |= (ste->s1_cfg->cdptr_dma & STRTAB_STE_0_S1CTXPTR_MASK - << STRTAB_STE_0_S1CTXPTR_SHIFT) | - STRTAB_STE_0_CFG_S1_TRANS; -- - } - - if (ste->s2_cfg) { -diff --git a/drivers/media/i2c/adv7604.c b/drivers/media/i2c/adv7604.c -index 01adcdc52346..a9e2722f5e22 100644 ---- a/drivers/media/i2c/adv7604.c -+++ b/drivers/media/i2c/adv7604.c -@@ -2856,6 +2856,9 @@ static int adv76xx_parse_dt(struct adv76xx_state *state) - state->pdata.alt_data_sat = 1; - state->pdata.op_format_mode_sel = ADV7604_OP_FORMAT_MODE0; - state->pdata.bus_order = ADV7604_BUS_ORDER_RGB; -+ state->pdata.dr_str_data = ADV76XX_DR_STR_MEDIUM_HIGH; -+ state->pdata.dr_str_clk = ADV76XX_DR_STR_MEDIUM_HIGH; -+ state->pdata.dr_str_sync = ADV76XX_DR_STR_MEDIUM_HIGH; - - return 0; - } -diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c -index cf7c18947189..d065c0e2d18e 100644 ---- a/drivers/net/can/c_can/c_can_pci.c -+++ b/drivers/net/can/c_can/c_can_pci.c -@@ -178,7 +178,6 @@ static int c_can_pci_probe(struct pci_dev *pdev, - break; - case BOSCH_D_CAN: - priv->regs = reg_map_d_can; -- priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; - break; - default: - ret = -EINVAL; -diff --git a/drivers/net/can/c_can/c_can_platform.c b/drivers/net/can/c_can/c_can_platform.c -index e36d10520e24..717530eac70c 100644 ---- a/drivers/net/can/c_can/c_can_platform.c -+++ b/drivers/net/can/c_can/c_can_platform.c -@@ -320,7 +320,6 @@ static int c_can_plat_probe(struct platform_device *pdev) - break; - case BOSCH_D_CAN: - priv->regs = reg_map_d_can; -- priv->can.ctrlmode_supported |= CAN_CTRLMODE_3_SAMPLES; - priv->read_reg = c_can_plat_read_reg_aligned_to_16bit; - priv->write_reg = c_can_plat_write_reg_aligned_to_16bit; - priv->read_reg32 = d_can_plat_read_reg32; -diff --git a/drivers/net/can/sun4i_can.c b/drivers/net/can/sun4i_can.c -index b0c80859f746..1ac2090a1721 100644 ---- a/drivers/net/can/sun4i_can.c -+++ b/drivers/net/can/sun4i_can.c -@@ -539,6 +539,13 @@ static int sun4i_can_err(struct net_device *dev, u8 isrc, u8 status) - } - stats->rx_over_errors++; - stats->rx_errors++; -+ -+ /* reset the CAN IP by entering reset mode -+ * ignoring timeout error -+ */ -+ set_reset_mode(dev); -+ set_normal_mode(dev); -+ - /* clear bit */ - sun4i_can_write_cmdreg(priv, SUN4I_CMD_CLEAR_OR_FLAG); - } -@@ -653,8 +660,9 @@ static irqreturn_t sun4i_can_interrupt(int irq, void *dev_id) - netif_wake_queue(dev); - can_led_event(dev, CAN_LED_EVENT_TX); - } -- if (isrc & SUN4I_INT_RBUF_VLD) { -- /* receive interrupt */ -+ if ((isrc & SUN4I_INT_RBUF_VLD) && -+ !(isrc & SUN4I_INT_DATA_OR)) { -+ /* receive interrupt - don't read if overrun occurred */ - while (status & SUN4I_STA_RBUF_RDY) { - /* RX buffer is not empty */ - sun4i_can_rx(dev); -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index e0e94b855bbe..1228d0da4075 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -724,8 +724,10 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - u8 *buf; - int len; - int temp; -+ int err; - u8 iface_no; - struct usb_cdc_parsed_header hdr; -+ u16 curr_ntb_format; - - ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); - if (!ctx) -@@ -823,6 +825,32 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - goto error2; - } - -+ /* -+ * Some Huawei devices have been observed to come out of reset in NDP32 mode. -+ * Let's check if this is the case, and set the device to NDP16 mode again if -+ * needed. -+ */ -+ if (ctx->drvflags & CDC_NCM_FLAG_RESET_NTB16) { -+ err = usbnet_read_cmd(dev, USB_CDC_GET_NTB_FORMAT, -+ USB_TYPE_CLASS | USB_DIR_IN | USB_RECIP_INTERFACE, -+ 0, iface_no, &curr_ntb_format, 2); -+ if (err < 0) { -+ goto error2; -+ } -+ -+ if (curr_ntb_format == USB_CDC_NCM_NTB32_FORMAT) { -+ dev_info(&intf->dev, "resetting NTB format to 16-bit"); -+ err = usbnet_write_cmd(dev, USB_CDC_SET_NTB_FORMAT, -+ USB_TYPE_CLASS | USB_DIR_OUT -+ | USB_RECIP_INTERFACE, -+ USB_CDC_NCM_NTB16_FORMAT, -+ iface_no, NULL, 0); -+ -+ if (err < 0) -+ goto error2; -+ } -+ } -+ - cdc_ncm_find_endpoints(dev, ctx->data); - cdc_ncm_find_endpoints(dev, ctx->control); - if (!dev->in || !dev->out || !dev->status) { -diff --git a/drivers/net/usb/huawei_cdc_ncm.c b/drivers/net/usb/huawei_cdc_ncm.c -index 2680a65cd5e4..63f28908afda 100644 ---- a/drivers/net/usb/huawei_cdc_ncm.c -+++ b/drivers/net/usb/huawei_cdc_ncm.c -@@ -80,6 +80,12 @@ static int huawei_cdc_ncm_bind(struct usbnet *usbnet_dev, - * be at the end of the frame. - */ - drvflags |= CDC_NCM_FLAG_NDP_TO_END; -+ -+ /* Additionally, it has been reported that some Huawei E3372H devices, with -+ * firmware version 21.318.01.00.541, come out of reset in NTB32 format mode, hence -+ * needing to be set to the NTB16 one again. -+ */ -+ drvflags |= CDC_NCM_FLAG_RESET_NTB16; - ret = cdc_ncm_bind_common(usbnet_dev, intf, 1, drvflags); - if (ret) - goto err; -diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c -index 72ee1c305cc4..02db20b26749 100644 ---- a/drivers/net/xen-netback/netback.c -+++ b/drivers/net/xen-netback/netback.c -@@ -67,6 +67,7 @@ module_param(rx_drain_timeout_msecs, uint, 0444); - unsigned int rx_stall_timeout_msecs = 60000; - module_param(rx_stall_timeout_msecs, uint, 0444); - -+#define MAX_QUEUES_DEFAULT 8 - unsigned int xenvif_max_queues; - module_param_named(max_queues, xenvif_max_queues, uint, 0644); - MODULE_PARM_DESC(max_queues, -@@ -2157,11 +2158,12 @@ static int __init netback_init(void) - if (!xen_domain()) - return -ENODEV; - -- /* Allow as many queues as there are CPUs if user has not -+ /* Allow as many queues as there are CPUs but max. 8 if user has not - * specified a value. - */ - if (xenvif_max_queues == 0) -- xenvif_max_queues = num_online_cpus(); -+ xenvif_max_queues = min_t(unsigned int, MAX_QUEUES_DEFAULT, -+ num_online_cpus()); - - if (fatal_skb_slots < XEN_NETBK_LEGACY_SLOTS_MAX) { - pr_info("fatal_skb_slots too small (%d), bump it to XEN_NETBK_LEGACY_SLOTS_MAX (%d)\n", -diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c -index 53b79c5f0559..379d08f76146 100644 ---- a/drivers/pci/host/pci-mvebu.c -+++ b/drivers/pci/host/pci-mvebu.c -@@ -131,6 +131,12 @@ struct mvebu_pcie { - int nports; - }; - -+struct mvebu_pcie_window { -+ phys_addr_t base; -+ phys_addr_t remap; -+ size_t size; -+}; -+ - /* Structure representing one PCIe interface */ - struct mvebu_pcie_port { - char *name; -@@ -148,10 +154,8 @@ struct mvebu_pcie_port { - struct mvebu_sw_pci_bridge bridge; - struct device_node *dn; - struct mvebu_pcie *pcie; -- phys_addr_t memwin_base; -- size_t memwin_size; -- phys_addr_t iowin_base; -- size_t iowin_size; -+ struct mvebu_pcie_window memwin; -+ struct mvebu_pcie_window iowin; - u32 saved_pcie_stat; - }; - -@@ -377,23 +381,45 @@ static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port, - } - } - -+static void mvebu_pcie_set_window(struct mvebu_pcie_port *port, -+ unsigned int target, unsigned int attribute, -+ const struct mvebu_pcie_window *desired, -+ struct mvebu_pcie_window *cur) -+{ -+ if (desired->base == cur->base && desired->remap == cur->remap && -+ desired->size == cur->size) -+ return; -+ -+ if (cur->size != 0) { -+ mvebu_pcie_del_windows(port, cur->base, cur->size); -+ cur->size = 0; -+ cur->base = 0; -+ -+ /* -+ * If something tries to change the window while it is enabled -+ * the change will not be done atomically. That would be -+ * difficult to do in the general case. -+ */ -+ } -+ -+ if (desired->size == 0) -+ return; -+ -+ mvebu_pcie_add_windows(port, target, attribute, desired->base, -+ desired->size, desired->remap); -+ *cur = *desired; -+} -+ - static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) - { -- phys_addr_t iobase; -+ struct mvebu_pcie_window desired = {}; - - /* Are the new iobase/iolimit values invalid? */ - if (port->bridge.iolimit < port->bridge.iobase || - port->bridge.iolimitupper < port->bridge.iobaseupper || - !(port->bridge.command & PCI_COMMAND_IO)) { -- -- /* If a window was configured, remove it */ -- if (port->iowin_base) { -- mvebu_pcie_del_windows(port, port->iowin_base, -- port->iowin_size); -- port->iowin_base = 0; -- port->iowin_size = 0; -- } -- -+ mvebu_pcie_set_window(port, port->io_target, port->io_attr, -+ &desired, &port->iowin); - return; - } - -@@ -410,32 +436,27 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) - * specifications. iobase is the bus address, port->iowin_base - * is the CPU address. - */ -- iobase = ((port->bridge.iobase & 0xF0) << 8) | -- (port->bridge.iobaseupper << 16); -- port->iowin_base = port->pcie->io.start + iobase; -- port->iowin_size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | -- (port->bridge.iolimitupper << 16)) - -- iobase) + 1; -- -- mvebu_pcie_add_windows(port, port->io_target, port->io_attr, -- port->iowin_base, port->iowin_size, -- iobase); -+ desired.remap = ((port->bridge.iobase & 0xF0) << 8) | -+ (port->bridge.iobaseupper << 16); -+ desired.base = port->pcie->io.start + desired.remap; -+ desired.size = ((0xFFF | ((port->bridge.iolimit & 0xF0) << 8) | -+ (port->bridge.iolimitupper << 16)) - -+ desired.remap) + -+ 1; -+ -+ mvebu_pcie_set_window(port, port->io_target, port->io_attr, &desired, -+ &port->iowin); - } - - static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) - { -+ struct mvebu_pcie_window desired = {.remap = MVEBU_MBUS_NO_REMAP}; -+ - /* Are the new membase/memlimit values invalid? */ - if (port->bridge.memlimit < port->bridge.membase || - !(port->bridge.command & PCI_COMMAND_MEMORY)) { -- -- /* If a window was configured, remove it */ -- if (port->memwin_base) { -- mvebu_pcie_del_windows(port, port->memwin_base, -- port->memwin_size); -- port->memwin_base = 0; -- port->memwin_size = 0; -- } -- -+ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, -+ &desired, &port->memwin); - return; - } - -@@ -445,14 +466,12 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) - * window to setup, according to the PCI-to-PCI bridge - * specifications. - */ -- port->memwin_base = ((port->bridge.membase & 0xFFF0) << 16); -- port->memwin_size = -- (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - -- port->memwin_base + 1; -- -- mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr, -- port->memwin_base, port->memwin_size, -- MVEBU_MBUS_NO_REMAP); -+ desired.base = ((port->bridge.membase & 0xFFF0) << 16); -+ desired.size = (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - -+ desired.base + 1; -+ -+ mvebu_pcie_set_window(port, port->mem_target, port->mem_attr, &desired, -+ &port->memwin); - } - - /* -diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c -index af2046c87806..847f75601591 100644 ---- a/drivers/platform/x86/hp-wmi.c -+++ b/drivers/platform/x86/hp-wmi.c -@@ -249,7 +249,7 @@ static int hp_wmi_display_state(void) - int ret = hp_wmi_perform_query(HPWMI_DISPLAY_QUERY, 0, &state, - sizeof(state), sizeof(state)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return state; - } - -@@ -259,7 +259,7 @@ static int hp_wmi_hddtemp_state(void) - int ret = hp_wmi_perform_query(HPWMI_HDDTEMP_QUERY, 0, &state, - sizeof(state), sizeof(state)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return state; - } - -@@ -269,7 +269,7 @@ static int hp_wmi_als_state(void) - int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 0, &state, - sizeof(state), sizeof(state)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return state; - } - -@@ -280,7 +280,7 @@ static int hp_wmi_dock_state(void) - sizeof(state), sizeof(state)); - - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - - return state & 0x1; - } -@@ -291,7 +291,7 @@ static int hp_wmi_tablet_state(void) - int ret = hp_wmi_perform_query(HPWMI_HARDWARE_QUERY, 0, &state, - sizeof(state), sizeof(state)); - if (ret) -- return ret; -+ return ret < 0 ? ret : -EINVAL; - - return (state & 0x4) ? 1 : 0; - } -@@ -324,7 +324,7 @@ static int __init hp_wmi_enable_hotkeys(void) - int ret = hp_wmi_perform_query(HPWMI_BIOS_QUERY, 1, &value, - sizeof(value), 0); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return 0; - } - -@@ -337,7 +337,7 @@ static int hp_wmi_set_block(void *data, bool blocked) - ret = hp_wmi_perform_query(HPWMI_WIRELESS_QUERY, 1, - &query, sizeof(query), 0); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return 0; - } - -@@ -429,7 +429,7 @@ static int hp_wmi_post_code_state(void) - int ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 0, &state, - sizeof(state), sizeof(state)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - return state; - } - -@@ -495,7 +495,7 @@ static ssize_t set_als(struct device *dev, struct device_attribute *attr, - int ret = hp_wmi_perform_query(HPWMI_ALS_QUERY, 1, &tmp, - sizeof(tmp), sizeof(tmp)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - - return count; - } -@@ -516,7 +516,7 @@ static ssize_t set_postcode(struct device *dev, struct device_attribute *attr, - ret = hp_wmi_perform_query(HPWMI_POSTCODEERROR_QUERY, 1, &tmp, - sizeof(tmp), sizeof(tmp)); - if (ret) -- return -EINVAL; -+ return ret < 0 ? ret : -EINVAL; - - return count; - } -@@ -573,10 +573,12 @@ static void hp_wmi_notify(u32 value, void *context) - - switch (event_id) { - case HPWMI_DOCK_EVENT: -- input_report_switch(hp_wmi_input_dev, SW_DOCK, -- hp_wmi_dock_state()); -- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, -- hp_wmi_tablet_state()); -+ if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit)) -+ input_report_switch(hp_wmi_input_dev, SW_DOCK, -+ hp_wmi_dock_state()); -+ if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) -+ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, -+ hp_wmi_tablet_state()); - input_sync(hp_wmi_input_dev); - break; - case HPWMI_PARK_HDD: -@@ -649,6 +651,7 @@ static int __init hp_wmi_input_setup(void) - { - acpi_status status; - int err; -+ int val; - - hp_wmi_input_dev = input_allocate_device(); - if (!hp_wmi_input_dev) -@@ -659,17 +662,26 @@ static int __init hp_wmi_input_setup(void) - hp_wmi_input_dev->id.bustype = BUS_HOST; - - __set_bit(EV_SW, hp_wmi_input_dev->evbit); -- __set_bit(SW_DOCK, hp_wmi_input_dev->swbit); -- __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit); -+ -+ /* Dock */ -+ val = hp_wmi_dock_state(); -+ if (!(val < 0)) { -+ __set_bit(SW_DOCK, hp_wmi_input_dev->swbit); -+ input_report_switch(hp_wmi_input_dev, SW_DOCK, val); -+ } -+ -+ /* Tablet mode */ -+ val = hp_wmi_tablet_state(); -+ if (!(val < 0)) { -+ __set_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit); -+ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, val); -+ } - - err = sparse_keymap_setup(hp_wmi_input_dev, hp_wmi_keymap, NULL); - if (err) - goto err_free_dev; - - /* Set initial hardware state */ -- input_report_switch(hp_wmi_input_dev, SW_DOCK, hp_wmi_dock_state()); -- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, -- hp_wmi_tablet_state()); - input_sync(hp_wmi_input_dev); - - if (!hp_wmi_bios_2009_later() && hp_wmi_bios_2008_later()) -@@ -982,10 +994,12 @@ static int hp_wmi_resume_handler(struct device *device) - * changed. - */ - if (hp_wmi_input_dev) { -- input_report_switch(hp_wmi_input_dev, SW_DOCK, -- hp_wmi_dock_state()); -- input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, -- hp_wmi_tablet_state()); -+ if (test_bit(SW_DOCK, hp_wmi_input_dev->swbit)) -+ input_report_switch(hp_wmi_input_dev, SW_DOCK, -+ hp_wmi_dock_state()); -+ if (test_bit(SW_TABLET_MODE, hp_wmi_input_dev->swbit)) -+ input_report_switch(hp_wmi_input_dev, SW_TABLET_MODE, -+ hp_wmi_tablet_state()); - input_sync(hp_wmi_input_dev); - } - -diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h -index 741f3ee81cfe..5006cb6ce62d 100644 ---- a/drivers/s390/net/qeth_core.h -+++ b/drivers/s390/net/qeth_core.h -@@ -909,7 +909,6 @@ void qeth_clear_thread_running_bit(struct qeth_card *, unsigned long); - int qeth_core_hardsetup_card(struct qeth_card *); - void qeth_print_status_message(struct qeth_card *); - int qeth_init_qdio_queues(struct qeth_card *); --int qeth_send_startlan(struct qeth_card *); - int qeth_send_ipa_cmd(struct qeth_card *, struct qeth_cmd_buffer *, - int (*reply_cb) - (struct qeth_card *, struct qeth_reply *, unsigned long), -diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c -index d10bf3da8e5f..e5b9506698b1 100644 ---- a/drivers/s390/net/qeth_core_main.c -+++ b/drivers/s390/net/qeth_core_main.c -@@ -2955,7 +2955,7 @@ int qeth_send_ipa_cmd(struct qeth_card *card, struct qeth_cmd_buffer *iob, - } - EXPORT_SYMBOL_GPL(qeth_send_ipa_cmd); - --int qeth_send_startlan(struct qeth_card *card) -+static int qeth_send_startlan(struct qeth_card *card) - { - int rc; - struct qeth_cmd_buffer *iob; -@@ -2968,7 +2968,6 @@ int qeth_send_startlan(struct qeth_card *card) - rc = qeth_send_ipa_cmd(card, iob, NULL, NULL); - return rc; - } --EXPORT_SYMBOL_GPL(qeth_send_startlan); - - static int qeth_default_setadapterparms_cb(struct qeth_card *card, - struct qeth_reply *reply, unsigned long data) -@@ -5080,6 +5079,20 @@ retriable: - goto out; - } - -+ rc = qeth_send_startlan(card); -+ if (rc) { -+ QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); -+ if (rc == IPA_RC_LAN_OFFLINE) { -+ dev_warn(&card->gdev->dev, -+ "The LAN is offline\n"); -+ card->lan_online = 0; -+ } else { -+ rc = -ENODEV; -+ goto out; -+ } -+ } else -+ card->lan_online = 1; -+ - card->options.ipa4.supported_funcs = 0; - card->options.ipa6.supported_funcs = 0; - card->options.adp.supported_funcs = 0; -@@ -5091,14 +5104,14 @@ retriable: - if (qeth_is_supported(card, IPA_SETADAPTERPARMS)) { - rc = qeth_query_setadapterparms(card); - if (rc < 0) { -- QETH_DBF_TEXT_(SETUP, 2, "6err%d", rc); -+ QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); - goto out; - } - } - if (qeth_adp_supported(card, IPA_SETADP_SET_DIAG_ASSIST)) { - rc = qeth_query_setdiagass(card); - if (rc < 0) { -- QETH_DBF_TEXT_(SETUP, 2, "7err%d", rc); -+ QETH_DBF_TEXT_(SETUP, 2, "8err%d", rc); - goto out; - } - } -diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c -index bf1e0e39334d..58bcb3c9a86a 100644 ---- a/drivers/s390/net/qeth_l2_main.c -+++ b/drivers/s390/net/qeth_l2_main.c -@@ -1203,21 +1203,6 @@ static int __qeth_l2_set_online(struct ccwgroup_device *gdev, int recovery_mode) - /* softsetup */ - QETH_DBF_TEXT(SETUP, 2, "softsetp"); - -- rc = qeth_send_startlan(card); -- if (rc) { -- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); -- if (rc == 0xe080) { -- dev_warn(&card->gdev->dev, -- "The LAN is offline\n"); -- card->lan_online = 0; -- goto contin; -- } -- rc = -ENODEV; -- goto out_remove; -- } else -- card->lan_online = 1; -- --contin: - if ((card->info.type == QETH_CARD_TYPE_OSD) || - (card->info.type == QETH_CARD_TYPE_OSX)) { - if (qeth_l2_start_ipassists(card)) -diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c -index 285fe0b2c753..bf3c1b2301db 100644 ---- a/drivers/s390/net/qeth_l3_main.c -+++ b/drivers/s390/net/qeth_l3_main.c -@@ -3298,21 +3298,6 @@ static int __qeth_l3_set_online(struct ccwgroup_device *gdev, int recovery_mode) - /* softsetup */ - QETH_DBF_TEXT(SETUP, 2, "softsetp"); - -- rc = qeth_send_startlan(card); -- if (rc) { -- QETH_DBF_TEXT_(SETUP, 2, "1err%d", rc); -- if (rc == 0xe080) { -- dev_warn(&card->gdev->dev, -- "The LAN is offline\n"); -- card->lan_online = 0; -- goto contin; -- } -- rc = -ENODEV; -- goto out_remove; -- } else -- card->lan_online = 1; -- --contin: - rc = qeth_l3_setadapter_parms(card); - if (rc) - QETH_DBF_TEXT_(SETUP, 2, "2err%04x", rc); -diff --git a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c -index 035dd456d7d6..737747354db6 100644 ---- a/drivers/staging/iio/trigger/iio-trig-bfin-timer.c -+++ b/drivers/staging/iio/trigger/iio-trig-bfin-timer.c -@@ -259,7 +259,7 @@ out_free_irq: - out1: - iio_trigger_unregister(st->trig); - out: -- iio_trigger_put(st->trig); -+ iio_trigger_free(st->trig); - return ret; - } - -@@ -272,7 +272,7 @@ static int iio_bfin_tmr_trigger_remove(struct platform_device *pdev) - peripheral_free(st->t->pin); - free_irq(st->irq, st); - iio_trigger_unregister(st->trig); -- iio_trigger_put(st->trig); -+ iio_trigger_free(st->trig); - - return 0; - } -diff --git a/drivers/tty/serial/sh-sci.c b/drivers/tty/serial/sh-sci.c -index 235e150d7b81..80d0ffe7abc1 100644 ---- a/drivers/tty/serial/sh-sci.c -+++ b/drivers/tty/serial/sh-sci.c -@@ -163,18 +163,17 @@ static const struct plat_sci_reg sci_regmap[SCIx_NR_REGTYPES][SCIx_NR_REGS] = { - }, - - /* -- * Common definitions for legacy IrDA ports, dependent on -- * regshift value. -+ * Common definitions for legacy IrDA ports. - */ - [SCIx_IRDA_REGTYPE] = { - [SCSMR] = { 0x00, 8 }, -- [SCBRR] = { 0x01, 8 }, -- [SCSCR] = { 0x02, 8 }, -- [SCxTDR] = { 0x03, 8 }, -- [SCxSR] = { 0x04, 8 }, -- [SCxRDR] = { 0x05, 8 }, -- [SCFCR] = { 0x06, 8 }, -- [SCFDR] = { 0x07, 16 }, -+ [SCBRR] = { 0x02, 8 }, -+ [SCSCR] = { 0x04, 8 }, -+ [SCxTDR] = { 0x06, 8 }, -+ [SCxSR] = { 0x08, 16 }, -+ [SCxRDR] = { 0x0a, 8 }, -+ [SCFCR] = { 0x0c, 8 }, -+ [SCFDR] = { 0x0e, 16 }, - [SCTFDR] = sci_reg_invalid, - [SCRFDR] = sci_reg_invalid, - [SCSPTR] = sci_reg_invalid, -diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c -index 5c0952995280..87a83d925eea 100644 ---- a/drivers/usb/core/hcd.c -+++ b/drivers/usb/core/hcd.c -@@ -2997,6 +2997,7 @@ void usb_remove_hcd(struct usb_hcd *hcd) - } - - usb_put_invalidate_rhdev(hcd); -+ hcd->flags = 0; - } - EXPORT_SYMBOL_GPL(usb_remove_hcd); - -diff --git a/drivers/video/fbdev/pmag-ba-fb.c b/drivers/video/fbdev/pmag-ba-fb.c -index 914a52ba8477..77837665ce89 100644 ---- a/drivers/video/fbdev/pmag-ba-fb.c -+++ b/drivers/video/fbdev/pmag-ba-fb.c -@@ -129,7 +129,7 @@ static struct fb_ops pmagbafb_ops = { - /* - * Turn the hardware cursor off. - */ --static void __init pmagbafb_erase_cursor(struct fb_info *info) -+static void pmagbafb_erase_cursor(struct fb_info *info) - { - struct pmagbafb_par *par = info->par; - -diff --git a/include/linux/phy.h b/include/linux/phy.h -index b64825d6ad26..5bc4b9d563a9 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -136,11 +136,7 @@ static inline const char *phy_modes(phy_interface_t interface) - /* Used when trying to connect to a specific phy (mii bus id:phy device id) */ - #define PHY_ID_FMT "%s:%02x" - --/* -- * Need to be a little smaller than phydev->dev.bus_id to leave room -- * for the ":%02x" -- */ --#define MII_BUS_ID_SIZE (20 - 3) -+#define MII_BUS_ID_SIZE 61 - - /* Or MII_ADDR_C45 into regnum for read/write on mii_bus to enable the 21 bit - IEEE 802.3ae clause 45 addressing mode used by 10GIGE phy chips. */ -@@ -599,7 +595,7 @@ struct phy_driver { - /* A Structure for boards to register fixups with the PHY Lib */ - struct phy_fixup { - struct list_head list; -- char bus_id[20]; -+ char bus_id[MII_BUS_ID_SIZE + 3]; - u32 phy_uid; - u32 phy_uid_mask; - int (*run)(struct phy_device *phydev); -diff --git a/include/linux/preempt.h b/include/linux/preempt.h -index 75e4e30677f1..7eeceac52dea 100644 ---- a/include/linux/preempt.h -+++ b/include/linux/preempt.h -@@ -65,19 +65,24 @@ - - /* - * Are we doing bottom half or hardware interrupt processing? -- * Are we in a softirq context? Interrupt context? -- * in_softirq - Are we currently processing softirq or have bh disabled? -- * in_serving_softirq - Are we currently processing softirq? -+ * -+ * in_irq() - We're in (hard) IRQ context -+ * in_softirq() - We have BH disabled, or are processing softirqs -+ * in_interrupt() - We're in NMI,IRQ,SoftIRQ context or have BH disabled -+ * in_serving_softirq() - We're in softirq context -+ * in_nmi() - We're in NMI context -+ * in_task() - We're in task context -+ * -+ * Note: due to the BH disabled confusion: in_softirq(),in_interrupt() really -+ * should not be used in new code. - */ - #define in_irq() (hardirq_count()) - #define in_softirq() (softirq_count()) - #define in_interrupt() (irq_count()) - #define in_serving_softirq() (softirq_count() & SOFTIRQ_OFFSET) -- --/* -- * Are we in NMI context? -- */ --#define in_nmi() (preempt_count() & NMI_MASK) -+#define in_nmi() (preempt_count() & NMI_MASK) -+#define in_task() (!(preempt_count() & \ -+ (NMI_MASK | HARDIRQ_MASK | SOFTIRQ_OFFSET))) - - /* - * The preempt_count offset after preempt_disable(); -diff --git a/include/linux/usb/cdc_ncm.h b/include/linux/usb/cdc_ncm.h -index 3a375d07d0dc..6670e9b34f20 100644 ---- a/include/linux/usb/cdc_ncm.h -+++ b/include/linux/usb/cdc_ncm.h -@@ -82,6 +82,7 @@ - - /* Driver flags */ - #define CDC_NCM_FLAG_NDP_TO_END 0x02 /* NDP is placed at end of frame */ -+#define CDC_NCM_FLAG_RESET_NTB16 0x08 /* set NDP16 one more time after altsetting switch */ - - #define cdc_ncm_comm_intf_is_mbim(x) ((x)->desc.bInterfaceSubClass == USB_CDC_SUBCLASS_MBIM && \ - (x)->desc.bInterfaceProtocol == USB_CDC_PROTO_NONE) -diff --git a/include/sound/seq_kernel.h b/include/sound/seq_kernel.h -index feb58d455560..4b9ee3009aa0 100644 ---- a/include/sound/seq_kernel.h -+++ b/include/sound/seq_kernel.h -@@ -49,7 +49,8 @@ typedef union snd_seq_timestamp snd_seq_timestamp_t; - #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS 200 - - /* max delivery path length */ --#define SNDRV_SEQ_MAX_HOPS 10 -+/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */ -+#define SNDRV_SEQ_MAX_HOPS 8 - - /* max size of event size */ - #define SNDRV_SEQ_MAX_EVENT_LEN 0x3fffffff -diff --git a/kernel/workqueue_internal.h b/kernel/workqueue_internal.h -index 45215870ac6c..3fa9c146fccb 100644 ---- a/kernel/workqueue_internal.h -+++ b/kernel/workqueue_internal.h -@@ -9,6 +9,7 @@ - - #include - #include -+#include - - struct worker_pool; - -@@ -59,7 +60,7 @@ struct worker { - */ - static inline struct worker *current_wq_worker(void) - { -- if (current->flags & PF_WQ_WORKER) -+ if (in_task() && (current->flags & PF_WQ_WORKER)) - return kthread_data(current); - return NULL; - } -diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c -index faa2a3f017f8..4fa2e54b3f59 100644 ---- a/lib/asn1_decoder.c -+++ b/lib/asn1_decoder.c -@@ -227,7 +227,7 @@ next_op: - hdr = 2; - - /* Extract a tag from the data */ -- if (unlikely(dp >= datalen - 1)) -+ if (unlikely(datalen - dp < 2)) - goto data_overrun_error; - tag = data[dp++]; - if (unlikely((tag & 0x1f) == ASN1_LONG_TAG)) -@@ -273,7 +273,7 @@ next_op: - int n = len - 0x80; - if (unlikely(n > 2)) - goto length_too_long; -- if (unlikely(dp >= datalen - n)) -+ if (unlikely(n > datalen - dp)) - goto data_overrun_error; - hdr += n; - for (len = 0; n > 0; n--) { -diff --git a/lib/test_firmware.c b/lib/test_firmware.c -index 86374c1c49a4..841191061816 100644 ---- a/lib/test_firmware.c -+++ b/lib/test_firmware.c -@@ -65,14 +65,19 @@ static ssize_t trigger_request_store(struct device *dev, - release_firmware(test_firmware); - test_firmware = NULL; - rc = request_firmware(&test_firmware, name, dev); -- if (rc) -+ if (rc) { - pr_info("load of '%s' failed: %d\n", name, rc); -- pr_info("loaded: %zu\n", test_firmware ? test_firmware->size : 0); -+ goto out; -+ } -+ pr_info("loaded: %zu\n", test_firmware->size); -+ rc = count; -+ -+out: - mutex_unlock(&test_fw_mutex); - - kfree(name); - -- return count; -+ return rc; - } - static DEVICE_ATTR_WO(trigger_request); - -diff --git a/net/dsa/Kconfig b/net/dsa/Kconfig -index ff7736f7ff42..fc0c09e770e6 100644 ---- a/net/dsa/Kconfig -+++ b/net/dsa/Kconfig -@@ -1,12 +1,13 @@ - config HAVE_NET_DSA - def_bool y -- depends on NETDEVICES && !S390 -+ depends on INET && NETDEVICES && !S390 - - # Drivers must select NET_DSA and the appropriate tagging format - - config NET_DSA - tristate "Distributed Switch Architecture" -- depends on HAVE_NET_DSA && NET_SWITCHDEV -+ depends on HAVE_NET_DSA -+ select NET_SWITCHDEV - select PHYLIB - ---help--- - Say Y if you want to enable support for the hardware switches supported -diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c -index f2a71025a770..22377c8ff14b 100644 ---- a/net/ipv4/ah4.c -+++ b/net/ipv4/ah4.c -@@ -270,6 +270,9 @@ static void ah_input_done(struct crypto_async_request *base, int err) - int ihl = ip_hdrlen(skb); - int ah_hlen = (ah->hdrlen + 2) << 2; - -+ if (err) -+ goto out; -+ - work_iph = AH_SKB_CB(skb)->tmp; - auth_data = ah_tmp_auth(work_iph, ihl); - icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len); -diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c -index 9dfaf4d55ee0..a97a5bf716be 100644 ---- a/net/netfilter/nft_meta.c -+++ b/net/netfilter/nft_meta.c -@@ -151,8 +151,34 @@ void nft_meta_get_eval(const struct nft_expr *expr, - else - *dest = PACKET_BROADCAST; - break; -+ case NFPROTO_NETDEV: -+ switch (skb->protocol) { -+ case htons(ETH_P_IP): { -+ int noff = skb_network_offset(skb); -+ struct iphdr *iph, _iph; -+ -+ iph = skb_header_pointer(skb, noff, -+ sizeof(_iph), &_iph); -+ if (!iph) -+ goto err; -+ -+ if (ipv4_is_multicast(iph->daddr)) -+ *dest = PACKET_MULTICAST; -+ else -+ *dest = PACKET_BROADCAST; -+ -+ break; -+ } -+ case htons(ETH_P_IPV6): -+ *dest = PACKET_MULTICAST; -+ break; -+ default: -+ WARN_ON_ONCE(1); -+ goto err; -+ } -+ break; - default: -- WARN_ON(1); -+ WARN_ON_ONCE(1); - goto err; - } - break; -diff --git a/security/keys/trusted.c b/security/keys/trusted.c -index 509aedcf8310..214ae2dc7f64 100644 ---- a/security/keys/trusted.c -+++ b/security/keys/trusted.c -@@ -69,7 +69,7 @@ static int TSS_sha1(const unsigned char *data, unsigned int datalen, - } - - ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest); -- kfree(sdesc); -+ kzfree(sdesc); - return ret; - } - -@@ -113,7 +113,7 @@ static int TSS_rawhmac(unsigned char *digest, const unsigned char *key, - if (!ret) - ret = crypto_shash_final(&sdesc->shash, digest); - out: -- kfree(sdesc); -+ kzfree(sdesc); - return ret; - } - -@@ -164,7 +164,7 @@ static int TSS_authhmac(unsigned char *digest, const unsigned char *key, - paramdigest, TPM_NONCE_SIZE, h1, - TPM_NONCE_SIZE, h2, 1, &c, 0, 0); - out: -- kfree(sdesc); -+ kzfree(sdesc); - return ret; - } - -@@ -245,7 +245,7 @@ static int TSS_checkhmac1(unsigned char *buffer, - if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE)) - ret = -EINVAL; - out: -- kfree(sdesc); -+ kzfree(sdesc); - return ret; - } - -@@ -346,7 +346,7 @@ static int TSS_checkhmac2(unsigned char *buffer, - if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE)) - ret = -EINVAL; - out: -- kfree(sdesc); -+ kzfree(sdesc); - return ret; - } - -@@ -563,7 +563,7 @@ static int tpm_seal(struct tpm_buf *tb, uint16_t keytype, - *bloblen = storedsize; - } - out: -- kfree(td); -+ kzfree(td); - return ret; - } - -@@ -677,7 +677,7 @@ static int key_seal(struct trusted_key_payload *p, - if (ret < 0) - pr_info("trusted_key: srkseal failed (%d)\n", ret); - -- kfree(tb); -+ kzfree(tb); - return ret; - } - -@@ -702,7 +702,7 @@ static int key_unseal(struct trusted_key_payload *p, - /* pull migratable flag out of sealed key */ - p->migratable = p->key[--p->key_len]; - -- kfree(tb); -+ kzfree(tb); - return ret; - } - -@@ -984,12 +984,12 @@ static int trusted_instantiate(struct key *key, - if (!ret && options->pcrlock) - ret = pcrlock(options->pcrlock); - out: -- kfree(datablob); -- kfree(options); -+ kzfree(datablob); -+ kzfree(options); - if (!ret) - rcu_assign_keypointer(key, payload); - else -- kfree(payload); -+ kzfree(payload); - return ret; - } - -@@ -998,8 +998,7 @@ static void trusted_rcu_free(struct rcu_head *rcu) - struct trusted_key_payload *p; - - p = container_of(rcu, struct trusted_key_payload, rcu); -- memset(p->key, 0, p->key_len); -- kfree(p); -+ kzfree(p); - } - - /* -@@ -1041,13 +1040,13 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) - ret = datablob_parse(datablob, new_p, new_o); - if (ret != Opt_update) { - ret = -EINVAL; -- kfree(new_p); -+ kzfree(new_p); - goto out; - } - - if (!new_o->keyhandle) { - ret = -EINVAL; -- kfree(new_p); -+ kzfree(new_p); - goto out; - } - -@@ -1061,22 +1060,22 @@ static int trusted_update(struct key *key, struct key_preparsed_payload *prep) - ret = key_seal(new_p, new_o); - if (ret < 0) { - pr_info("trusted_key: key_seal failed (%d)\n", ret); -- kfree(new_p); -+ kzfree(new_p); - goto out; - } - if (new_o->pcrlock) { - ret = pcrlock(new_o->pcrlock); - if (ret < 0) { - pr_info("trusted_key: pcrlock failed (%d)\n", ret); -- kfree(new_p); -+ kzfree(new_p); - goto out; - } - } - rcu_assign_keypointer(key, new_p); - call_rcu(&p->rcu, trusted_rcu_free); - out: -- kfree(datablob); -- kfree(new_o); -+ kzfree(datablob); -+ kzfree(new_o); - return ret; - } - -@@ -1095,34 +1094,30 @@ static long trusted_read(const struct key *key, char __user *buffer, - p = rcu_dereference_key(key); - if (!p) - return -EINVAL; -- if (!buffer || buflen <= 0) -- return 2 * p->blob_len; -- ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); -- if (!ascii_buf) -- return -ENOMEM; - -- bufp = ascii_buf; -- for (i = 0; i < p->blob_len; i++) -- bufp = hex_byte_pack(bufp, p->blob[i]); -- if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) { -- kfree(ascii_buf); -- return -EFAULT; -+ if (buffer && buflen >= 2 * p->blob_len) { -+ ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); -+ if (!ascii_buf) -+ return -ENOMEM; -+ -+ bufp = ascii_buf; -+ for (i = 0; i < p->blob_len; i++) -+ bufp = hex_byte_pack(bufp, p->blob[i]); -+ if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) { -+ kzfree(ascii_buf); -+ return -EFAULT; -+ } -+ kzfree(ascii_buf); - } -- kfree(ascii_buf); - return 2 * p->blob_len; - } - - /* -- * trusted_destroy - before freeing the key, clear the decrypted data -+ * trusted_destroy - clear and free the key's payload - */ - static void trusted_destroy(struct key *key) - { -- struct trusted_key_payload *p = key->payload.data[0]; -- -- if (!p) -- return; -- memset(p->key, 0, p->key_len); -- kfree(key->payload.data[0]); -+ kzfree(key->payload.data[0]); - } - - struct key_type key_type_trusted = { -diff --git a/sound/core/seq/oss/seq_oss_midi.c b/sound/core/seq/oss/seq_oss_midi.c -index aaff9ee32695..b30b2139e3f0 100644 ---- a/sound/core/seq/oss/seq_oss_midi.c -+++ b/sound/core/seq/oss/seq_oss_midi.c -@@ -612,9 +612,7 @@ send_midi_event(struct seq_oss_devinfo *dp, struct snd_seq_event *ev, struct seq - if (!dp->timer->running) - len = snd_seq_oss_timer_start(dp->timer); - if (ev->type == SNDRV_SEQ_EVENT_SYSEX) { -- if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE) -- snd_seq_oss_readq_puts(dp->readq, mdev->seq_device, -- ev->data.ext.ptr, ev->data.ext.len); -+ snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev); - } else { - len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev); - if (len > 0) -diff --git a/sound/core/seq/oss/seq_oss_readq.c b/sound/core/seq/oss/seq_oss_readq.c -index 046cb586fb2f..06b21226b4e7 100644 ---- a/sound/core/seq/oss/seq_oss_readq.c -+++ b/sound/core/seq/oss/seq_oss_readq.c -@@ -117,6 +117,35 @@ snd_seq_oss_readq_puts(struct seq_oss_readq *q, int dev, unsigned char *data, in - return 0; - } - -+/* -+ * put MIDI sysex bytes; the event buffer may be chained, thus it has -+ * to be expanded via snd_seq_dump_var_event(). -+ */ -+struct readq_sysex_ctx { -+ struct seq_oss_readq *readq; -+ int dev; -+}; -+ -+static int readq_dump_sysex(void *ptr, void *buf, int count) -+{ -+ struct readq_sysex_ctx *ctx = ptr; -+ -+ return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count); -+} -+ -+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, -+ struct snd_seq_event *ev) -+{ -+ struct readq_sysex_ctx ctx = { -+ .readq = q, -+ .dev = dev -+ }; -+ -+ if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE) -+ return 0; -+ return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx); -+} -+ - /* - * copy an event to input queue: - * return zero if enqueued -diff --git a/sound/core/seq/oss/seq_oss_readq.h b/sound/core/seq/oss/seq_oss_readq.h -index f1463f1f449e..8d033ca2d23f 100644 ---- a/sound/core/seq/oss/seq_oss_readq.h -+++ b/sound/core/seq/oss/seq_oss_readq.h -@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq_oss_readq *q); - void snd_seq_oss_readq_clear(struct seq_oss_readq *readq); - unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait); - int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len); -+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev, -+ struct snd_seq_event *ev); - int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev); - int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode); - int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec); -diff --git a/tools/testing/selftests/firmware/fw_filesystem.sh b/tools/testing/selftests/firmware/fw_filesystem.sh -index c4366dc74e01..856a1f327b3f 100755 ---- a/tools/testing/selftests/firmware/fw_filesystem.sh -+++ b/tools/testing/selftests/firmware/fw_filesystem.sh -@@ -48,8 +48,16 @@ echo "ABCD0123" >"$FW" - - NAME=$(basename "$FW") - -+if printf '\000' >"$DIR"/trigger_request 2> /dev/null; then -+ echo "$0: empty filename should not succeed" >&2 -+ exit 1 -+fi -+ - # Request a firmware that doesn't exist, it should fail. --echo -n "nope-$NAME" >"$DIR"/trigger_request -+if echo -n "nope-$NAME" >"$DIR"/trigger_request 2> /dev/null; then -+ echo "$0: firmware shouldn't have loaded" >&2 -+ exit 1 -+fi - if diff -q "$FW" /dev/test_firmware >/dev/null ; then - echo "$0: firmware was not expected to match" >&2 - exit 1 -diff --git a/tools/testing/selftests/firmware/fw_userhelper.sh b/tools/testing/selftests/firmware/fw_userhelper.sh -index b9983f8e09f6..01c626a1f226 100755 ---- a/tools/testing/selftests/firmware/fw_userhelper.sh -+++ b/tools/testing/selftests/firmware/fw_userhelper.sh -@@ -64,9 +64,33 @@ trap "test_finish" EXIT - echo "ABCD0123" >"$FW" - NAME=$(basename "$FW") - -+DEVPATH="$DIR"/"nope-$NAME"/loading -+ - # Test failure when doing nothing (timeout works). --echo 1 >/sys/class/firmware/timeout --echo -n "$NAME" >"$DIR"/trigger_request -+echo -n 2 >/sys/class/firmware/timeout -+echo -n "nope-$NAME" >"$DIR"/trigger_request 2>/dev/null & -+ -+# Give the kernel some time to load the loading file, must be less -+# than the timeout above. -+sleep 1 -+if [ ! -f $DEVPATH ]; then -+ echo "$0: fallback mechanism immediately cancelled" -+ echo "" -+ echo "The file never appeared: $DEVPATH" -+ echo "" -+ echo "This might be a distribution udev rule setup by your distribution" -+ echo "to immediately cancel all fallback requests, this must be" -+ echo "removed before running these tests. To confirm look for" -+ echo "a firmware rule like /lib/udev/rules.d/50-firmware.rules" -+ echo "and see if you have something like this:" -+ echo "" -+ echo "SUBSYSTEM==\"firmware\", ACTION==\"add\", ATTR{loading}=\"-1\"" -+ echo "" -+ echo "If you do remove this file or comment out this line before" -+ echo "proceeding with these tests." -+ exit 1 -+fi -+ - if diff -q "$FW" /dev/test_firmware >/dev/null ; then - echo "$0: firmware was not expected to match" >&2 - exit 1 diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.98-99.patch b/patch/kernel/mvebu64-default/03-patch-4.4.98-99.patch deleted file mode 100644 index 0325797f34c4..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.98-99.patch +++ /dev/null @@ -1,1260 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5d62e23347f9..0b5d9e20eee2 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 98 -+SUBLEVEL = 99 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig -index db49e0d796b1..dfb1ee8c3e06 100644 ---- a/arch/powerpc/Kconfig -+++ b/arch/powerpc/Kconfig -@@ -1082,11 +1082,6 @@ source "arch/powerpc/Kconfig.debug" - - source "security/Kconfig" - --config KEYS_COMPAT -- bool -- depends on COMPAT && KEYS -- default y -- - source "crypto/Kconfig" - - config PPC_LIB_RHEAP -diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig -index 3a55f493c7da..5ad7b721b769 100644 ---- a/arch/s390/Kconfig -+++ b/arch/s390/Kconfig -@@ -346,9 +346,6 @@ config COMPAT - config SYSVIPC_COMPAT - def_bool y if COMPAT && SYSVIPC - --config KEYS_COMPAT -- def_bool y if COMPAT && KEYS -- - config SMP - def_bool y - prompt "Symmetric multi-processing support" -diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig -index eb9487470141..94f4ac21761b 100644 ---- a/arch/sparc/Kconfig -+++ b/arch/sparc/Kconfig -@@ -549,9 +549,6 @@ config SYSVIPC_COMPAT - depends on COMPAT && SYSVIPC - default y - --config KEYS_COMPAT -- def_bool y if COMPAT && KEYS -- - endmenu - - source "net/Kconfig" -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 436639a31624..7e40905f6d4c 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -2641,10 +2641,6 @@ config COMPAT_FOR_U64_ALIGNMENT - config SYSVIPC_COMPAT - def_bool y - depends on SYSVIPC -- --config KEYS_COMPAT -- def_bool y -- depends on KEYS - endif - - endmenu -diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c -index f4e8fbec6a94..b5304e264881 100644 ---- a/drivers/input/misc/ims-pcu.c -+++ b/drivers/input/misc/ims-pcu.c -@@ -1635,13 +1635,25 @@ ims_pcu_get_cdc_union_desc(struct usb_interface *intf) - return NULL; - } - -- while (buflen > 0) { -+ while (buflen >= sizeof(*union_desc)) { - union_desc = (struct usb_cdc_union_desc *)buf; - -+ if (union_desc->bLength > buflen) { -+ dev_err(&intf->dev, "Too large descriptor\n"); -+ return NULL; -+ } -+ - if (union_desc->bDescriptorType == USB_DT_CS_INTERFACE && - union_desc->bDescriptorSubType == USB_CDC_UNION_TYPE) { - dev_dbg(&intf->dev, "Found union header\n"); -- return union_desc; -+ -+ if (union_desc->bLength >= sizeof(*union_desc)) -+ return union_desc; -+ -+ dev_err(&intf->dev, -+ "Union descriptor to short (%d vs %zd\n)", -+ union_desc->bLength, sizeof(*union_desc)); -+ return NULL; - } - - buflen -= union_desc->bLength; -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 79de9608ac48..ed96fdefd8e5 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -1117,6 +1117,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd, - case TUNSETSNDBUF: - if (get_user(s, sp)) - return -EFAULT; -+ if (s <= 0) -+ return -EINVAL; - - q->sk.sk_sndbuf = s; - return 0; -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index e5bb870b5461..dc454138d600 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -1110,7 +1110,17 @@ ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64) - static struct lock_class_key ppp_tx_busylock; - static int ppp_dev_init(struct net_device *dev) - { -+ struct ppp *ppp; -+ - dev->qdisc_tx_busylock = &ppp_tx_busylock; -+ -+ ppp = netdev_priv(dev); -+ /* Let the netdevice take a reference on the ppp file. This ensures -+ * that ppp_destroy_interface() won't run before the device gets -+ * unregistered. -+ */ -+ atomic_inc(&ppp->file.refcnt); -+ - return 0; - } - -@@ -1133,6 +1143,15 @@ static void ppp_dev_uninit(struct net_device *dev) - wake_up_interruptible(&ppp->file.rwait); - } - -+static void ppp_dev_priv_destructor(struct net_device *dev) -+{ -+ struct ppp *ppp; -+ -+ ppp = netdev_priv(dev); -+ if (atomic_dec_and_test(&ppp->file.refcnt)) -+ ppp_destroy_interface(ppp); -+} -+ - static const struct net_device_ops ppp_netdev_ops = { - .ndo_init = ppp_dev_init, - .ndo_uninit = ppp_dev_uninit, -@@ -1150,6 +1169,7 @@ static void ppp_setup(struct net_device *dev) - dev->tx_queue_len = 3; - dev->type = ARPHRD_PPP; - dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST; -+ dev->destructor = ppp_dev_priv_destructor; - netif_keep_dst(dev); - } - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index cd191f82d816..50bfded6d7ef 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1684,6 +1684,9 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr) - - if (!dev) - return -ENOMEM; -+ err = dev_get_valid_name(net, dev, name); -+ if (err < 0) -+ goto err_free_dev; - - dev_net_set(dev, net); - dev->rtnl_link_ops = &tun_link_ops; -@@ -2065,6 +2068,10 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd, - ret = -EFAULT; - break; - } -+ if (sndbuf <= 0) { -+ ret = -EINVAL; -+ break; -+ } - - tun->sndbuf = sndbuf; - tun_set_sndbuf(tun); -diff --git a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -index 5fecae0ba52e..83e5aa6a9f28 100644 ---- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -+++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c -@@ -4295,9 +4295,6 @@ static int brcmf_cfg80211_stop_ap(struct wiphy *wiphy, struct net_device *ndev) - err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_AP, 0); - if (err < 0) - brcmf_err("setting AP mode failed %d\n", err); -- err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_INFRA, 0); -- if (err < 0) -- brcmf_err("setting INFRA mode failed %d\n", err); - if (brcmf_feat_is_enabled(ifp, BRCMF_FEAT_MBSS)) - brcmf_fil_iovar_int_set(ifp, "mbss", 0); - err = brcmf_fil_cmd_int_set(ifp, BRCMF_C_SET_REGULATORY, -diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c -index 70b8f4fabfad..e658e11e1829 100644 ---- a/drivers/staging/panel/panel.c -+++ b/drivers/staging/panel/panel.c -@@ -1431,17 +1431,25 @@ static ssize_t lcd_write(struct file *file, - - static int lcd_open(struct inode *inode, struct file *file) - { -+ int ret; -+ -+ ret = -EBUSY; - if (!atomic_dec_and_test(&lcd_available)) -- return -EBUSY; /* open only once at a time */ -+ goto fail; /* open only once at a time */ - -+ ret = -EPERM; - if (file->f_mode & FMODE_READ) /* device is write-only */ -- return -EPERM; -+ goto fail; - - if (lcd.must_clear) { - lcd_clear_display(); - lcd.must_clear = false; - } - return nonseekable_open(inode, file); -+ -+ fail: -+ atomic_inc(&lcd_available); -+ return ret; - } - - static int lcd_release(struct inode *inode, struct file *file) -@@ -1704,14 +1712,21 @@ static ssize_t keypad_read(struct file *file, - - static int keypad_open(struct inode *inode, struct file *file) - { -+ int ret; -+ -+ ret = -EBUSY; - if (!atomic_dec_and_test(&keypad_available)) -- return -EBUSY; /* open only once at a time */ -+ goto fail; /* open only once at a time */ - -+ ret = -EPERM; - if (file->f_mode & FMODE_WRITE) /* device is read-only */ -- return -EPERM; -+ goto fail; - - keypad_buflen = 0; /* flush the buffer on opening */ - return 0; -+ fail: -+ atomic_inc(&keypad_available); -+ return ret; - } - - static int keypad_release(struct inode *inode, struct file *file) -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 1ff1c83e2df5..fd493412b172 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1759,7 +1759,7 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - struct iscsi_tm *hdr; - int out_of_order_cmdsn = 0, ret; - bool sess_ref = false; -- u8 function; -+ u8 function, tcm_function = TMR_UNKNOWN; - - hdr = (struct iscsi_tm *) buf; - hdr->flags &= ~ISCSI_FLAG_CMD_FINAL; -@@ -1805,10 +1805,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - * LIO-Target $FABRIC_MOD - */ - if (function != ISCSI_TM_FUNC_TASK_REASSIGN) { -- -- u8 tcm_function; -- int ret; -- - transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops, - conn->sess->se_sess, 0, DMA_NONE, - TCM_SIMPLE_TAG, cmd->sense_buffer + 2); -@@ -1844,15 +1840,14 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - return iscsit_add_reject_cmd(cmd, - ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); - } -- -- ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req, -- tcm_function, GFP_KERNEL); -- if (ret < 0) -- return iscsit_add_reject_cmd(cmd, -+ } -+ ret = core_tmr_alloc_req(&cmd->se_cmd, cmd->tmr_req, tcm_function, -+ GFP_KERNEL); -+ if (ret < 0) -+ return iscsit_add_reject_cmd(cmd, - ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf); - -- cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req; -- } -+ cmd->tmr_req->se_tmr_req = cmd->se_cmd.se_tmr_req; - - cmd->iscsi_opcode = ISCSI_OP_SCSI_TMFUNC; - cmd->i_state = ISTATE_SEND_TASKMGTRSP; -diff --git a/drivers/target/target_core_tpg.c b/drivers/target/target_core_tpg.c -index f69f4902dc07..ee16a45f1607 100644 ---- a/drivers/target/target_core_tpg.c -+++ b/drivers/target/target_core_tpg.c -@@ -350,7 +350,7 @@ void core_tpg_del_initiator_node_acl(struct se_node_acl *acl) - if (acl->dynamic_node_acl) { - acl->dynamic_node_acl = 0; - } -- list_del(&acl->acl_list); -+ list_del_init(&acl->acl_list); - tpg->num_node_acls--; - mutex_unlock(&tpg->acl_node_mutex); - -@@ -572,7 +572,7 @@ int core_tpg_deregister(struct se_portal_group *se_tpg) - * in transport_deregister_session(). - */ - list_for_each_entry_safe(nacl, nacl_tmp, &node_list, acl_list) { -- list_del(&nacl->acl_list); -+ list_del_init(&nacl->acl_list); - se_tpg->num_node_acls--; - - core_tpg_wait_for_nacl_pr_ref(nacl); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index f71bedea973a..a42054edd427 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -431,7 +431,7 @@ static void target_complete_nacl(struct kref *kref) - } - - mutex_lock(&se_tpg->acl_node_mutex); -- list_del(&nacl->acl_list); -+ list_del_init(&nacl->acl_list); - mutex_unlock(&se_tpg->acl_node_mutex); - - core_tpg_wait_for_nacl_pr_ref(nacl); -@@ -503,7 +503,7 @@ void transport_free_session(struct se_session *se_sess) - spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags); - - if (se_nacl->dynamic_stop) -- list_del(&se_nacl->acl_list); -+ list_del_init(&se_nacl->acl_list); - } - mutex_unlock(&se_tpg->acl_node_mutex); - -diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c -index 2e947dc94e32..bc92a498ec03 100644 ---- a/drivers/usb/misc/usbtest.c -+++ b/drivers/usb/misc/usbtest.c -@@ -185,12 +185,13 @@ found: - return tmp; - } - -- if (in) { -+ if (in) - dev->in_pipe = usb_rcvbulkpipe(udev, - in->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); -+ if (out) - dev->out_pipe = usb_sndbulkpipe(udev, - out->desc.bEndpointAddress & USB_ENDPOINT_NUMBER_MASK); -- } -+ - if (iso_in) { - dev->iso_in = &iso_in->desc; - dev->in_iso_pipe = usb_rcvisocpipe(udev, -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 4035bbe40971..fc54049e8286 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -3469,6 +3469,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, - unsigned char name_assign_type, - void (*setup)(struct net_device *), - unsigned int txqs, unsigned int rxqs); -+int dev_get_valid_name(struct net *net, struct net_device *dev, -+ const char *name); -+ - #define alloc_netdev(sizeof_priv, name, name_assign_type, setup) \ - alloc_netdev_mqs(sizeof_priv, name, name_assign_type, setup, 1, 1) - -diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h -index 625bdf95d673..95aa999f31d7 100644 ---- a/include/net/inet_sock.h -+++ b/include/net/inet_sock.h -@@ -95,7 +95,7 @@ struct inet_request_sock { - kmemcheck_bitfield_end(flags); - u32 ir_mark; - union { -- struct ip_options_rcu *opt; -+ struct ip_options_rcu __rcu *ireq_opt; - struct sk_buff *pktopts; - }; - }; -@@ -113,6 +113,12 @@ static inline u32 inet_request_mark(const struct sock *sk, struct sk_buff *skb) - return sk->sk_mark; - } - -+static inline struct ip_options_rcu *ireq_opt_deref(const struct inet_request_sock *ireq) -+{ -+ return rcu_dereference_check(ireq->ireq_opt, -+ atomic_read(&ireq->req.rsk_refcnt) > 0); -+} -+ - struct inet_cork { - unsigned int flags; - __be32 addr; -diff --git a/include/net/tcp.h b/include/net/tcp.h -index e9d7a8ef9a6d..cecb0e0eff06 100644 ---- a/include/net/tcp.h -+++ b/include/net/tcp.h -@@ -1612,12 +1612,12 @@ static inline void tcp_highest_sack_reset(struct sock *sk) - tcp_sk(sk)->highest_sack = tcp_write_queue_head(sk); - } - --/* Called when old skb is about to be deleted (to be combined with new skb) */ --static inline void tcp_highest_sack_combine(struct sock *sk, -+/* Called when old skb is about to be deleted and replaced by new skb */ -+static inline void tcp_highest_sack_replace(struct sock *sk, - struct sk_buff *old, - struct sk_buff *new) - { -- if (tcp_sk(sk)->sacked_out && (old == tcp_sk(sk)->highest_sack)) -+ if (old == tcp_highest_sack(sk)) - tcp_sk(sk)->highest_sack = new; - } - -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 1adf8739980c..8555321306fb 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -199,6 +199,7 @@ enum tcm_tmreq_table { - TMR_LUN_RESET = 5, - TMR_TARGET_WARM_RESET = 6, - TMR_TARGET_COLD_RESET = 7, -+ TMR_UNKNOWN = 0xff, - }; - - /* fabric independent task management response values */ -diff --git a/net/core/dev.c b/net/core/dev.c -index dac52fa60f25..630704d8d6a2 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1111,9 +1111,8 @@ static int dev_alloc_name_ns(struct net *net, - return ret; - } - --static int dev_get_valid_name(struct net *net, -- struct net_device *dev, -- const char *name) -+int dev_get_valid_name(struct net *net, struct net_device *dev, -+ const char *name) - { - BUG_ON(!net); - -@@ -1129,6 +1128,7 @@ static int dev_get_valid_name(struct net *net, - - return 0; - } -+EXPORT_SYMBOL(dev_get_valid_name); - - /** - * dev_change_name - change name of a device -diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c -index e217f17997a4..6eb2bbf9873b 100644 ---- a/net/dccp/ipv4.c -+++ b/net/dccp/ipv4.c -@@ -414,8 +414,7 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk, - sk_daddr_set(newsk, ireq->ir_rmt_addr); - sk_rcv_saddr_set(newsk, ireq->ir_loc_addr); - newinet->inet_saddr = ireq->ir_loc_addr; -- newinet->inet_opt = ireq->opt; -- ireq->opt = NULL; -+ RCU_INIT_POINTER(newinet->inet_opt, rcu_dereference(ireq->ireq_opt)); - newinet->mc_index = inet_iif(skb); - newinet->mc_ttl = ip_hdr(skb)->ttl; - newinet->inet_id = jiffies; -@@ -430,7 +429,10 @@ struct sock *dccp_v4_request_recv_sock(const struct sock *sk, - if (__inet_inherit_port(sk, newsk) < 0) - goto put_and_exit; - *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -- -+ if (*own_req) -+ ireq->ireq_opt = NULL; -+ else -+ newinet->inet_opt = NULL; - return newsk; - - exit_overflow: -@@ -441,6 +443,7 @@ exit: - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS); - return NULL; - put_and_exit: -+ newinet->inet_opt = NULL; - inet_csk_prepare_forced_close(newsk); - dccp_done(newsk); - goto exit; -@@ -492,7 +495,7 @@ static int dccp_v4_send_response(const struct sock *sk, struct request_sock *req - ireq->ir_rmt_addr); - err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, - ireq->ir_rmt_addr, -- ireq->opt); -+ ireq_opt_deref(ireq)); - err = net_xmit_eval(err); - } - -@@ -546,7 +549,7 @@ out: - static void dccp_v4_reqsk_destructor(struct request_sock *req) - { - dccp_feat_list_purge(&dccp_rsk(req)->dreq_featneg); -- kfree(inet_rsk(req)->opt); -+ kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1)); - } - - void dccp_syn_ack_timeout(const struct request_sock *req) -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index 6cc3e1d602fb..5f3b81941a6f 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -2012,7 +2012,7 @@ int cipso_v4_req_setattr(struct request_sock *req, - buf = NULL; - - req_inet = inet_rsk(req); -- opt = xchg(&req_inet->opt, opt); -+ opt = xchg((__force struct ip_options_rcu **)&req_inet->ireq_opt, opt); - if (opt) - kfree_rcu(opt, rcu); - -@@ -2034,11 +2034,13 @@ req_setattr_failure: - * values on failure. - * - */ --static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr) -+static int cipso_v4_delopt(struct ip_options_rcu __rcu **opt_ptr) - { -+ struct ip_options_rcu *opt = rcu_dereference_protected(*opt_ptr, 1); - int hdr_delta = 0; -- struct ip_options_rcu *opt = *opt_ptr; - -+ if (!opt || opt->opt.cipso == 0) -+ return 0; - if (opt->opt.srr || opt->opt.rr || opt->opt.ts || opt->opt.router_alert) { - u8 cipso_len; - u8 cipso_off; -@@ -2100,14 +2102,10 @@ static int cipso_v4_delopt(struct ip_options_rcu **opt_ptr) - */ - void cipso_v4_sock_delattr(struct sock *sk) - { -- int hdr_delta; -- struct ip_options_rcu *opt; - struct inet_sock *sk_inet; -+ int hdr_delta; - - sk_inet = inet_sk(sk); -- opt = rcu_dereference_protected(sk_inet->inet_opt, 1); -- if (!opt || opt->opt.cipso == 0) -- return; - - hdr_delta = cipso_v4_delopt(&sk_inet->inet_opt); - if (sk_inet->is_icsk && hdr_delta > 0) { -@@ -2127,15 +2125,7 @@ void cipso_v4_sock_delattr(struct sock *sk) - */ - void cipso_v4_req_delattr(struct request_sock *req) - { -- struct ip_options_rcu *opt; -- struct inet_request_sock *req_inet; -- -- req_inet = inet_rsk(req); -- opt = req_inet->opt; -- if (!opt || opt->opt.cipso == 0) -- return; -- -- cipso_v4_delopt(&req_inet->opt); -+ cipso_v4_delopt(&inet_rsk(req)->ireq_opt); - } - - /** -diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c -index 45fa2aaa3d3f..01acb94c4963 100644 ---- a/net/ipv4/inet_connection_sock.c -+++ b/net/ipv4/inet_connection_sock.c -@@ -412,9 +412,11 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk, - { - const struct inet_request_sock *ireq = inet_rsk(req); - struct net *net = read_pnet(&ireq->ireq_net); -- struct ip_options_rcu *opt = ireq->opt; -+ struct ip_options_rcu *opt; - struct rtable *rt; - -+ opt = ireq_opt_deref(ireq); -+ - flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, - RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, - sk->sk_protocol, inet_sk_flowi_flags(sk), -@@ -448,10 +450,9 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, - struct flowi4 *fl4; - struct rtable *rt; - -+ opt = rcu_dereference(ireq->ireq_opt); - fl4 = &newinet->cork.fl.u.ip4; - -- rcu_read_lock(); -- opt = rcu_dereference(newinet->inet_opt); - flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark, - RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE, - sk->sk_protocol, inet_sk_flowi_flags(sk), -@@ -464,13 +465,11 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk, - goto no_route; - if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway) - goto route_err; -- rcu_read_unlock(); - return &rt->dst; - - route_err: - ip_rt_put(rt); - no_route: -- rcu_read_unlock(); - IP_INC_STATS_BH(net, IPSTATS_MIB_OUTNOROUTES); - return NULL; - } -diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c -index a09fb0dec725..486b283a6cd1 100644 ---- a/net/ipv4/ipip.c -+++ b/net/ipv4/ipip.c -@@ -129,42 +129,68 @@ static struct rtnl_link_ops ipip_link_ops __read_mostly; - static int ipip_err(struct sk_buff *skb, u32 info) - { - --/* All the routers (except for Linux) return only -- 8 bytes of packet payload. It means, that precise relaying of -- ICMP in the real Internet is absolutely infeasible. -- */ -+ /* All the routers (except for Linux) return only -+ 8 bytes of packet payload. It means, that precise relaying of -+ ICMP in the real Internet is absolutely infeasible. -+ */ - struct net *net = dev_net(skb->dev); - struct ip_tunnel_net *itn = net_generic(net, ipip_net_id); - const struct iphdr *iph = (const struct iphdr *)skb->data; -- struct ip_tunnel *t; -- int err; - const int type = icmp_hdr(skb)->type; - const int code = icmp_hdr(skb)->code; -+ struct ip_tunnel *t; -+ int err = 0; -+ -+ switch (type) { -+ case ICMP_DEST_UNREACH: -+ switch (code) { -+ case ICMP_SR_FAILED: -+ /* Impossible event. */ -+ goto out; -+ default: -+ /* All others are translated to HOST_UNREACH. -+ * rfc2003 contains "deep thoughts" about NET_UNREACH, -+ * I believe they are just ether pollution. --ANK -+ */ -+ break; -+ } -+ break; -+ -+ case ICMP_TIME_EXCEEDED: -+ if (code != ICMP_EXC_TTL) -+ goto out; -+ break; -+ -+ case ICMP_REDIRECT: -+ break; -+ -+ default: -+ goto out; -+ } - -- err = -ENOENT; - t = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY, - iph->daddr, iph->saddr, 0); -- if (!t) -+ if (!t) { -+ err = -ENOENT; - goto out; -+ } - - if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { -- ipv4_update_pmtu(skb, dev_net(skb->dev), info, -- t->parms.link, 0, IPPROTO_IPIP, 0); -- err = 0; -+ ipv4_update_pmtu(skb, net, info, t->parms.link, 0, -+ iph->protocol, 0); - goto out; - } - - if (type == ICMP_REDIRECT) { -- ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, -- IPPROTO_IPIP, 0); -- err = 0; -+ ipv4_redirect(skb, net, t->parms.link, 0, iph->protocol, 0); - goto out; - } - -- if (t->parms.iph.daddr == 0) -+ if (t->parms.iph.daddr == 0) { -+ err = -ENOENT; - goto out; -+ } - -- err = 0; - if (t->parms.iph.ttl == 0 && type == ICMP_TIME_EXCEEDED) - goto out; - -diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c -index 731b91409625..c22a74374a9c 100644 ---- a/net/ipv4/syncookies.c -+++ b/net/ipv4/syncookies.c -@@ -357,7 +357,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) - /* We throwed the options of the initial SYN away, so we hope - * the ACK carries the same options again (see RFC1122 4.2.3.8) - */ -- ireq->opt = tcp_v4_save_options(skb); -+ RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(skb)); - - if (security_inet_conn_request(sk, skb, req)) { - reqsk_free(req); -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index c4bbf704ff9c..9e8d70160d20 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -6105,7 +6105,7 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops, - struct inet_request_sock *ireq = inet_rsk(req); - - kmemcheck_annotate_bitfield(ireq, flags); -- ireq->opt = NULL; -+ ireq->ireq_opt = NULL; - atomic64_set(&ireq->ir_cookie, 0); - ireq->ireq_state = TCP_NEW_SYN_RECV; - write_pnet(&ireq->ireq_net, sock_net(sk_listener)); -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index 198fc2314c82..a5d790c13ef5 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -856,7 +856,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst, - - err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr, - ireq->ir_rmt_addr, -- ireq->opt); -+ ireq_opt_deref(ireq)); - err = net_xmit_eval(err); - } - -@@ -868,7 +868,7 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst, - */ - static void tcp_v4_reqsk_destructor(struct request_sock *req) - { -- kfree(inet_rsk(req)->opt); -+ kfree(rcu_dereference_protected(inet_rsk(req)->ireq_opt, 1)); - } - - -@@ -1197,7 +1197,7 @@ static void tcp_v4_init_req(struct request_sock *req, - sk_rcv_saddr_set(req_to_sk(req), ip_hdr(skb)->daddr); - sk_daddr_set(req_to_sk(req), ip_hdr(skb)->saddr); - ireq->no_srccheck = inet_sk(sk_listener)->transparent; -- ireq->opt = tcp_v4_save_options(skb); -+ RCU_INIT_POINTER(ireq->ireq_opt, tcp_v4_save_options(skb)); - } - - static struct dst_entry *tcp_v4_route_req(const struct sock *sk, -@@ -1292,10 +1292,9 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - ireq = inet_rsk(req); - sk_daddr_set(newsk, ireq->ir_rmt_addr); - sk_rcv_saddr_set(newsk, ireq->ir_loc_addr); -- newinet->inet_saddr = ireq->ir_loc_addr; -- inet_opt = ireq->opt; -- rcu_assign_pointer(newinet->inet_opt, inet_opt); -- ireq->opt = NULL; -+ newinet->inet_saddr = ireq->ir_loc_addr; -+ inet_opt = rcu_dereference(ireq->ireq_opt); -+ RCU_INIT_POINTER(newinet->inet_opt, inet_opt); - newinet->mc_index = inet_iif(skb); - newinet->mc_ttl = ip_hdr(skb)->ttl; - newinet->rcv_tos = ip_hdr(skb)->tos; -@@ -1343,9 +1342,12 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - if (__inet_inherit_port(sk, newsk) < 0) - goto put_and_exit; - *own_req = inet_ehash_nolisten(newsk, req_to_sk(req_unhash)); -- if (*own_req) -+ if (likely(*own_req)) { - tcp_move_syn(newtp, req); -- -+ ireq->ireq_opt = NULL; -+ } else { -+ newinet->inet_opt = NULL; -+ } - return newsk; - - exit_overflow: -@@ -1356,6 +1358,7 @@ exit: - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS); - return NULL; - put_and_exit: -+ newinet->inet_opt = NULL; - inet_csk_prepare_forced_close(newsk); - tcp_done(newsk); - goto exit; -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 850d1b5bfd81..64c7ce847584 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -1951,6 +1951,7 @@ static int tcp_mtu_probe(struct sock *sk) - nskb->ip_summed = skb->ip_summed; - - tcp_insert_write_queue_before(nskb, skb, sk); -+ tcp_highest_sack_replace(sk, skb, nskb); - - len = 0; - tcp_for_write_queue_from_safe(skb, next, sk) { -@@ -2464,7 +2465,7 @@ static void tcp_collapse_retrans(struct sock *sk, struct sk_buff *skb) - - BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1); - -- tcp_highest_sack_combine(sk, next_skb, skb); -+ tcp_highest_sack_replace(sk, next_skb, skb); - - tcp_unlink_write_queue(next_skb, sk); - -diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c -index dc2db4f7b182..f3a0a9c0f61e 100644 ---- a/net/ipv6/ip6_flowlabel.c -+++ b/net/ipv6/ip6_flowlabel.c -@@ -315,6 +315,7 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space, - } - opt_space->dst1opt = fopt->dst1opt; - opt_space->opt_flen = fopt->opt_flen; -+ opt_space->tot_len = fopt->tot_len; - return opt_space; - } - EXPORT_SYMBOL_GPL(fl6_merge_options); -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index eab117033b8a..c878cbf65485 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -409,13 +409,16 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - case ICMPV6_DEST_UNREACH: - net_dbg_ratelimited("%s: Path to destination invalid or inactive!\n", - t->parms.name); -- break; -+ if (code != ICMPV6_PORT_UNREACH) -+ break; -+ return; - case ICMPV6_TIME_EXCEED: - if (code == ICMPV6_EXC_HOPLIMIT) { - net_dbg_ratelimited("%s: Too small hop limit or routing loop in tunnel!\n", - t->parms.name); -+ break; - } -- break; -+ return; - case ICMPV6_PARAMPROB: - teli = 0; - if (code == ICMPV6_HDR_FIELD) -@@ -431,13 +434,13 @@ static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, - net_dbg_ratelimited("%s: Recipient unable to parse tunneled packet!\n", - t->parms.name); - } -- break; -+ return; - case ICMPV6_PKT_TOOBIG: - mtu = be32_to_cpu(info) - offset; - if (mtu < IPV6_MIN_MTU) - mtu = IPV6_MIN_MTU; - t->dev->mtu = mtu; -- break; -+ return; - } - - if (time_before(jiffies, t->err_time + IP6TUNNEL_ERR_TIMEO)) -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index e22339fad10b..71624cf26832 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1201,11 +1201,11 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, - if (WARN_ON(v6_cork->opt)) - return -EINVAL; - -- v6_cork->opt = kzalloc(opt->tot_len, sk->sk_allocation); -+ v6_cork->opt = kzalloc(sizeof(*opt), sk->sk_allocation); - if (unlikely(!v6_cork->opt)) - return -ENOBUFS; - -- v6_cork->opt->tot_len = opt->tot_len; -+ v6_cork->opt->tot_len = sizeof(*opt); - v6_cork->opt->opt_flen = opt->opt_flen; - v6_cork->opt->opt_nflen = opt->opt_nflen; - -diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c -index 8ab9c5d74416..67f2e72723b2 100644 ---- a/net/l2tp/l2tp_ppp.c -+++ b/net/l2tp/l2tp_ppp.c -@@ -1015,6 +1015,9 @@ static int pppol2tp_session_ioctl(struct l2tp_session *session, - session->name, cmd, arg); - - sk = ps->sock; -+ if (!sk) -+ return -EBADR; -+ - sock_hold(sk); - - switch (cmd) { -diff --git a/net/mac80211/key.c b/net/mac80211/key.c -index 44388d6a1d8e..4a72c0d1e56f 100644 ---- a/net/mac80211/key.c -+++ b/net/mac80211/key.c -@@ -4,6 +4,7 @@ - * Copyright 2006-2007 Jiri Benc - * Copyright 2007-2008 Johannes Berg - * Copyright 2013-2014 Intel Mobile Communications GmbH -+ * Copyright 2017 Intel Deutschland GmbH - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -18,6 +19,7 @@ - #include - #include - #include -+#include - #include - #include "ieee80211_i.h" - #include "driver-ops.h" -@@ -606,6 +608,39 @@ void ieee80211_key_free_unused(struct ieee80211_key *key) - ieee80211_key_free_common(key); - } - -+static bool ieee80211_key_identical(struct ieee80211_sub_if_data *sdata, -+ struct ieee80211_key *old, -+ struct ieee80211_key *new) -+{ -+ u8 tkip_old[WLAN_KEY_LEN_TKIP], tkip_new[WLAN_KEY_LEN_TKIP]; -+ u8 *tk_old, *tk_new; -+ -+ if (!old || new->conf.keylen != old->conf.keylen) -+ return false; -+ -+ tk_old = old->conf.key; -+ tk_new = new->conf.key; -+ -+ /* -+ * In station mode, don't compare the TX MIC key, as it's never used -+ * and offloaded rekeying may not care to send it to the host. This -+ * is the case in iwlwifi, for example. -+ */ -+ if (sdata->vif.type == NL80211_IFTYPE_STATION && -+ new->conf.cipher == WLAN_CIPHER_SUITE_TKIP && -+ new->conf.keylen == WLAN_KEY_LEN_TKIP && -+ !(new->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE)) { -+ memcpy(tkip_old, tk_old, WLAN_KEY_LEN_TKIP); -+ memcpy(tkip_new, tk_new, WLAN_KEY_LEN_TKIP); -+ memset(tkip_old + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8); -+ memset(tkip_new + NL80211_TKIP_DATA_OFFSET_TX_MIC_KEY, 0, 8); -+ tk_old = tkip_old; -+ tk_new = tkip_new; -+ } -+ -+ return !crypto_memneq(tk_old, tk_new, new->conf.keylen); -+} -+ - int ieee80211_key_link(struct ieee80211_key *key, - struct ieee80211_sub_if_data *sdata, - struct sta_info *sta) -@@ -617,9 +652,6 @@ int ieee80211_key_link(struct ieee80211_key *key, - - pairwise = key->conf.flags & IEEE80211_KEY_FLAG_PAIRWISE; - idx = key->conf.keyidx; -- key->local = sdata->local; -- key->sdata = sdata; -- key->sta = sta; - - mutex_lock(&sdata->local->key_mtx); - -@@ -630,6 +662,20 @@ int ieee80211_key_link(struct ieee80211_key *key, - else - old_key = key_mtx_dereference(sdata->local, sdata->keys[idx]); - -+ /* -+ * Silently accept key re-installation without really installing the -+ * new version of the key to avoid nonce reuse or replay issues. -+ */ -+ if (ieee80211_key_identical(sdata, old_key, key)) { -+ ieee80211_key_free_unused(key); -+ ret = 0; -+ goto out; -+ } -+ -+ key->local = sdata->local; -+ key->sdata = sdata; -+ key->sta = sta; -+ - increment_tailroom_need_count(sdata); - - ieee80211_key_replace(sdata, sta, pairwise, old_key, key); -@@ -645,6 +691,7 @@ int ieee80211_key_link(struct ieee80211_key *key, - ret = 0; - } - -+ out: - mutex_unlock(&sdata->local->key_mtx); - - return ret; -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 241f69039a72..1584f89c456a 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1724,7 +1724,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - - out: - if (err && rollover) { -- kfree(rollover); -+ kfree_rcu(rollover, rcu); - po->rollover = NULL; - } - mutex_unlock(&fanout_mutex); -@@ -1751,8 +1751,10 @@ static struct packet_fanout *fanout_release(struct sock *sk) - else - f = NULL; - -- if (po->rollover) -+ if (po->rollover) { - kfree_rcu(po->rollover, rcu); -+ po->rollover = NULL; -+ } - } - mutex_unlock(&fanout_mutex); - -@@ -3769,6 +3771,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - void *data = &val; - union tpacket_stats_u st; - struct tpacket_rollover_stats rstats; -+ struct packet_rollover *rollover; - - if (level != SOL_PACKET) - return -ENOPROTOOPT; -@@ -3847,13 +3850,18 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - 0); - break; - case PACKET_ROLLOVER_STATS: -- if (!po->rollover) -+ rcu_read_lock(); -+ rollover = rcu_dereference(po->rollover); -+ if (rollover) { -+ rstats.tp_all = atomic_long_read(&rollover->num); -+ rstats.tp_huge = atomic_long_read(&rollover->num_huge); -+ rstats.tp_failed = atomic_long_read(&rollover->num_failed); -+ data = &rstats; -+ lv = sizeof(rstats); -+ } -+ rcu_read_unlock(); -+ if (!rollover) - return -EINVAL; -- rstats.tp_all = atomic_long_read(&po->rollover->num); -- rstats.tp_huge = atomic_long_read(&po->rollover->num_huge); -- rstats.tp_failed = atomic_long_read(&po->rollover->num_failed); -- data = &rstats; -- lv = sizeof(rstats); - break; - case PACKET_TX_HAS_OFF: - val = po->tp_tx_has_off; -diff --git a/net/sctp/input.c b/net/sctp/input.c -index 2d7859c03fd2..71c2ef84c5b0 100644 ---- a/net/sctp/input.c -+++ b/net/sctp/input.c -@@ -420,7 +420,7 @@ void sctp_icmp_redirect(struct sock *sk, struct sctp_transport *t, - { - struct dst_entry *dst; - -- if (!t) -+ if (sock_owned_by_user(sk) || !t) - return; - dst = sctp_transport_dst_check(t); - if (dst) -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 3ebf3b652d60..73eec73ff733 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -168,6 +168,36 @@ static inline void sctp_set_owner_w(struct sctp_chunk *chunk) - sk_mem_charge(sk, chunk->skb->truesize); - } - -+static void sctp_clear_owner_w(struct sctp_chunk *chunk) -+{ -+ skb_orphan(chunk->skb); -+} -+ -+static void sctp_for_each_tx_datachunk(struct sctp_association *asoc, -+ void (*cb)(struct sctp_chunk *)) -+ -+{ -+ struct sctp_outq *q = &asoc->outqueue; -+ struct sctp_transport *t; -+ struct sctp_chunk *chunk; -+ -+ list_for_each_entry(t, &asoc->peer.transport_addr_list, transports) -+ list_for_each_entry(chunk, &t->transmitted, transmitted_list) -+ cb(chunk); -+ -+ list_for_each_entry(chunk, &q->retransmit, list) -+ cb(chunk); -+ -+ list_for_each_entry(chunk, &q->sacked, list) -+ cb(chunk); -+ -+ list_for_each_entry(chunk, &q->abandoned, list) -+ cb(chunk); -+ -+ list_for_each_entry(chunk, &q->out_chunk_list, list) -+ cb(chunk); -+} -+ - /* Verify that this is a valid address. */ - static inline int sctp_verify_addr(struct sock *sk, union sctp_addr *addr, - int len) -@@ -7362,7 +7392,9 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, - * paths won't try to lock it and then oldsk. - */ - lock_sock_nested(newsk, SINGLE_DEPTH_NESTING); -+ sctp_for_each_tx_datachunk(assoc, sctp_clear_owner_w); - sctp_assoc_migrate(assoc, newsk); -+ sctp_for_each_tx_datachunk(assoc, sctp_set_owner_w); - - /* If the association on the newsk is already closed before accept() - * is called, set RCV_SHUTDOWN flag. -diff --git a/net/tipc/link.c b/net/tipc/link.c -index 72268eac4ec7..736fffb28ab6 100644 ---- a/net/tipc/link.c -+++ b/net/tipc/link.c -@@ -1084,25 +1084,6 @@ drop: - return rc; - } - --/* -- * Send protocol message to the other endpoint. -- */ --void tipc_link_proto_xmit(struct tipc_link *l, u32 msg_typ, int probe_msg, -- u32 gap, u32 tolerance, u32 priority) --{ -- struct sk_buff *skb = NULL; -- struct sk_buff_head xmitq; -- -- __skb_queue_head_init(&xmitq); -- tipc_link_build_proto_msg(l, msg_typ, probe_msg, gap, -- tolerance, priority, &xmitq); -- skb = __skb_dequeue(&xmitq); -- if (!skb) -- return; -- tipc_bearer_xmit_skb(l->net, l->bearer_id, skb, l->media_addr); -- l->rcv_unacked = 0; --} -- - static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe, - u16 rcvgap, int tolerance, int priority, - struct sk_buff_head *xmitq) -@@ -1636,9 +1617,12 @@ int tipc_nl_link_set(struct sk_buff *skb, struct genl_info *info) - char *name; - struct tipc_link *link; - struct tipc_node *node; -+ struct sk_buff_head xmitq; - struct nlattr *attrs[TIPC_NLA_LINK_MAX + 1]; - struct net *net = sock_net(skb->sk); - -+ __skb_queue_head_init(&xmitq); -+ - if (!info->attrs[TIPC_NLA_LINK]) - return -EINVAL; - -@@ -1683,14 +1667,14 @@ int tipc_nl_link_set(struct sk_buff *skb, struct genl_info *info) - - tol = nla_get_u32(props[TIPC_NLA_PROP_TOL]); - link->tolerance = tol; -- tipc_link_proto_xmit(link, STATE_MSG, 0, 0, tol, 0); -+ tipc_link_build_proto_msg(link, STATE_MSG, 0, 0, tol, 0, &xmitq); - } - if (props[TIPC_NLA_PROP_PRIO]) { - u32 prio; - - prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]); - link->priority = prio; -- tipc_link_proto_xmit(link, STATE_MSG, 0, 0, 0, prio); -+ tipc_link_build_proto_msg(link, STATE_MSG, 0, 0, 0, prio, &xmitq); - } - if (props[TIPC_NLA_PROP_WIN]) { - u32 win; -@@ -1702,7 +1686,7 @@ int tipc_nl_link_set(struct sk_buff *skb, struct genl_info *info) - - out: - tipc_node_unlock(node); -- -+ tipc_bearer_xmit(net, bearer_id, &xmitq, &node->links[bearer_id].maddr); - return res; - } - -diff --git a/net/tipc/link.h b/net/tipc/link.h -index 66d859b66c84..2a0d58671e88 100644 ---- a/net/tipc/link.h -+++ b/net/tipc/link.h -@@ -153,7 +153,6 @@ struct tipc_stats { - struct tipc_link { - u32 addr; - char name[TIPC_MAX_LINK_NAME]; -- struct tipc_media_addr *media_addr; - struct net *net; - - /* Management and link supervision data */ -diff --git a/net/unix/diag.c b/net/unix/diag.c -index 4d9679701a6d..384c84e83462 100644 ---- a/net/unix/diag.c -+++ b/net/unix/diag.c -@@ -257,6 +257,8 @@ static int unix_diag_get_exact(struct sk_buff *in_skb, - err = -ENOENT; - if (sk == NULL) - goto out_nosk; -+ if (!net_eq(sock_net(sk), net)) -+ goto out; - - err = sock_diag_check_cookie(sk, req->udiag_cookie); - if (err) -diff --git a/security/keys/Kconfig b/security/keys/Kconfig -index 72483b8f1be5..1edb37eea81d 100644 ---- a/security/keys/Kconfig -+++ b/security/keys/Kconfig -@@ -20,6 +20,10 @@ config KEYS - - If you are unsure as to whether this is required, answer N. - -+config KEYS_COMPAT -+ def_bool y -+ depends on COMPAT && KEYS -+ - config PERSISTENT_KEYRINGS - bool "Enable register of persistent per-UID keyrings" - depends on KEYS -diff --git a/sound/core/seq/seq_device.c b/sound/core/seq/seq_device.c -index c4acf17e9f5e..e40a2cba5002 100644 ---- a/sound/core/seq/seq_device.c -+++ b/sound/core/seq/seq_device.c -@@ -148,8 +148,10 @@ void snd_seq_device_load_drivers(void) - flush_work(&autoload_work); - } - EXPORT_SYMBOL(snd_seq_device_load_drivers); -+#define cancel_autoload_drivers() cancel_work_sync(&autoload_work) - #else - #define queue_autoload_drivers() /* NOP */ -+#define cancel_autoload_drivers() /* NOP */ - #endif - - /* -@@ -159,6 +161,7 @@ static int snd_seq_device_dev_free(struct snd_device *device) - { - struct snd_seq_device *dev = device->device_data; - -+ cancel_autoload_drivers(); - put_device(&dev->dev); - return 0; - } diff --git a/patch/kernel/mvebu64-default/03-patch-4.4.99-100.patch b/patch/kernel/mvebu64-default/03-patch-4.4.99-100.patch deleted file mode 100644 index e0c456c39210..000000000000 --- a/patch/kernel/mvebu64-default/03-patch-4.4.99-100.patch +++ /dev/null @@ -1,2132 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0b5d9e20eee2..91dd7832f499 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 99 -+SUBLEVEL = 100 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/am33xx.dtsi b/arch/arm/boot/dts/am33xx.dtsi -index d23e2524d694..be9c37e89be1 100644 ---- a/arch/arm/boot/dts/am33xx.dtsi -+++ b/arch/arm/boot/dts/am33xx.dtsi -@@ -142,10 +142,11 @@ - }; - - scm_conf: scm_conf@0 { -- compatible = "syscon"; -+ compatible = "syscon", "simple-bus"; - reg = <0x0 0x800>; - #address-cells = <1>; - #size-cells = <1>; -+ ranges = <0 0 0x800>; - - scm_clocks: clocks { - #address-cells = <1>; -diff --git a/arch/arm/boot/dts/dm814x.dtsi b/arch/arm/boot/dts/dm814x.dtsi -index 7988b42e5764..c226c3d952d8 100644 ---- a/arch/arm/boot/dts/dm814x.dtsi -+++ b/arch/arm/boot/dts/dm814x.dtsi -@@ -138,7 +138,7 @@ - }; - - uart1: uart@20000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart1"; - reg = <0x20000 0x2000>; - clock-frequency = <48000000>; -@@ -148,7 +148,7 @@ - }; - - uart2: uart@22000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart2"; - reg = <0x22000 0x2000>; - clock-frequency = <48000000>; -@@ -158,7 +158,7 @@ - }; - - uart3: uart@24000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart3"; - reg = <0x24000 0x2000>; - clock-frequency = <48000000>; -@@ -189,10 +189,11 @@ - ranges = <0 0x160000 0x16d000>; - - scm_conf: scm_conf@0 { -- compatible = "syscon"; -+ compatible = "syscon", "simple-bus"; - reg = <0x0 0x800>; - #address-cells = <1>; - #size-cells = <1>; -+ ranges = <0 0 0x800>; - - scm_clocks: clocks { - #address-cells = <1>; -diff --git a/arch/arm/boot/dts/dm816x.dtsi b/arch/arm/boot/dts/dm816x.dtsi -index eee636de4cd8..e526928e6e96 100644 ---- a/arch/arm/boot/dts/dm816x.dtsi -+++ b/arch/arm/boot/dts/dm816x.dtsi -@@ -347,7 +347,7 @@ - }; - - uart1: uart@48020000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart1"; - reg = <0x48020000 0x2000>; - clock-frequency = <48000000>; -@@ -357,7 +357,7 @@ - }; - - uart2: uart@48022000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart2"; - reg = <0x48022000 0x2000>; - clock-frequency = <48000000>; -@@ -367,7 +367,7 @@ - }; - - uart3: uart@48024000 { -- compatible = "ti,omap3-uart"; -+ compatible = "ti,am3352-uart", "ti,omap3-uart"; - ti,hwmods = "uart3"; - reg = <0x48024000 0x2000>; - clock-frequency = <48000000>; -diff --git a/arch/arm/crypto/aesbs-glue.c b/arch/arm/crypto/aesbs-glue.c -index 6d685298690e..648d5fac9cbf 100644 ---- a/arch/arm/crypto/aesbs-glue.c -+++ b/arch/arm/crypto/aesbs-glue.c -@@ -357,7 +357,7 @@ static struct crypto_alg aesbs_algs[] = { { - }, { - .cra_name = "cbc(aes)", - .cra_driver_name = "cbc-aes-neonbs", -- .cra_priority = 300, -+ .cra_priority = 250, - .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct async_helper_ctx), -@@ -377,7 +377,7 @@ static struct crypto_alg aesbs_algs[] = { { - }, { - .cra_name = "ctr(aes)", - .cra_driver_name = "ctr-aes-neonbs", -- .cra_priority = 300, -+ .cra_priority = 250, - .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC, - .cra_blocksize = 1, - .cra_ctxsize = sizeof(struct async_helper_ctx), -@@ -397,7 +397,7 @@ static struct crypto_alg aesbs_algs[] = { { - }, { - .cra_name = "xts(aes)", - .cra_driver_name = "xts-aes-neonbs", -- .cra_priority = 300, -+ .cra_priority = 250, - .cra_flags = CRYPTO_ALG_TYPE_ABLKCIPHER|CRYPTO_ALG_ASYNC, - .cra_blocksize = AES_BLOCK_SIZE, - .cra_ctxsize = sizeof(struct async_helper_ctx), -diff --git a/arch/arm/mach-omap2/pdata-quirks.c b/arch/arm/mach-omap2/pdata-quirks.c -index 58144779dec4..1e6e09841707 100644 ---- a/arch/arm/mach-omap2/pdata-quirks.c -+++ b/arch/arm/mach-omap2/pdata-quirks.c -@@ -522,7 +522,6 @@ static void pdata_quirks_check(struct pdata_init *quirks) - if (of_machine_is_compatible(quirks->compatible)) { - if (quirks->fn) - quirks->fn(); -- break; - } - quirks++; - } -diff --git a/arch/arm64/boot/dts/broadcom/ns2.dtsi b/arch/arm64/boot/dts/broadcom/ns2.dtsi -index 3c92d92278e5..a14a6bb31887 100644 ---- a/arch/arm64/boot/dts/broadcom/ns2.dtsi -+++ b/arch/arm64/boot/dts/broadcom/ns2.dtsi -@@ -30,6 +30,8 @@ - * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. - */ - -+/memreserve/ 0x81000000 0x00200000; -+ - #include - - /memreserve/ 0x84b00000 0x00000008; -diff --git a/arch/mips/include/asm/asm.h b/arch/mips/include/asm/asm.h -index 7c26b28bf252..859cf7048347 100644 ---- a/arch/mips/include/asm/asm.h -+++ b/arch/mips/include/asm/asm.h -@@ -54,7 +54,8 @@ - .align 2; \ - .type symbol, @function; \ - .ent symbol, 0; \ --symbol: .frame sp, 0, ra -+symbol: .frame sp, 0, ra; \ -+ .insn - - /* - * NESTED - declare nested routine entry point -@@ -63,8 +64,9 @@ symbol: .frame sp, 0, ra - .globl symbol; \ - .align 2; \ - .type symbol, @function; \ -- .ent symbol, 0; \ --symbol: .frame sp, framesize, rpc -+ .ent symbol, 0; \ -+symbol: .frame sp, framesize, rpc; \ -+ .insn - - /* - * END - mark end of function -@@ -86,7 +88,7 @@ symbol: - #define FEXPORT(symbol) \ - .globl symbol; \ - .type symbol, @function; \ --symbol: -+symbol: .insn - - /* - * ABS - export absolute symbol -diff --git a/arch/mips/kernel/setup.c b/arch/mips/kernel/setup.c -index 8acae316f26b..4f9f1ae49213 100644 ---- a/arch/mips/kernel/setup.c -+++ b/arch/mips/kernel/setup.c -@@ -152,6 +152,35 @@ void __init detect_memory_region(phys_addr_t start, phys_addr_t sz_min, phys_add - add_memory_region(start, size, BOOT_MEM_RAM); - } - -+bool __init memory_region_available(phys_addr_t start, phys_addr_t size) -+{ -+ int i; -+ bool in_ram = false, free = true; -+ -+ for (i = 0; i < boot_mem_map.nr_map; i++) { -+ phys_addr_t start_, end_; -+ -+ start_ = boot_mem_map.map[i].addr; -+ end_ = boot_mem_map.map[i].addr + boot_mem_map.map[i].size; -+ -+ switch (boot_mem_map.map[i].type) { -+ case BOOT_MEM_RAM: -+ if (start >= start_ && start + size <= end_) -+ in_ram = true; -+ break; -+ case BOOT_MEM_RESERVED: -+ if ((start >= start_ && start < end_) || -+ (start < start_ && start + size >= start_)) -+ free = false; -+ break; -+ default: -+ continue; -+ } -+ } -+ -+ return in_ram && free; -+} -+ - static void __init print_memory_map(void) - { - int i; -@@ -300,11 +329,19 @@ static void __init bootmem_init(void) - - #else /* !CONFIG_SGI_IP27 */ - -+static unsigned long __init bootmap_bytes(unsigned long pages) -+{ -+ unsigned long bytes = DIV_ROUND_UP(pages, 8); -+ -+ return ALIGN(bytes, sizeof(long)); -+} -+ - static void __init bootmem_init(void) - { - unsigned long reserved_end; - unsigned long mapstart = ~0UL; - unsigned long bootmap_size; -+ bool bootmap_valid = false; - int i; - - /* -@@ -385,11 +422,42 @@ static void __init bootmem_init(void) - #endif - - /* -- * Initialize the boot-time allocator with low memory only. -+ * check that mapstart doesn't overlap with any of -+ * memory regions that have been reserved through eg. DTB - */ -- bootmap_size = init_bootmem_node(NODE_DATA(0), mapstart, -- min_low_pfn, max_low_pfn); -+ bootmap_size = bootmap_bytes(max_low_pfn - min_low_pfn); -+ -+ bootmap_valid = memory_region_available(PFN_PHYS(mapstart), -+ bootmap_size); -+ for (i = 0; i < boot_mem_map.nr_map && !bootmap_valid; i++) { -+ unsigned long mapstart_addr; -+ -+ switch (boot_mem_map.map[i].type) { -+ case BOOT_MEM_RESERVED: -+ mapstart_addr = PFN_ALIGN(boot_mem_map.map[i].addr + -+ boot_mem_map.map[i].size); -+ if (PHYS_PFN(mapstart_addr) < mapstart) -+ break; -+ -+ bootmap_valid = memory_region_available(mapstart_addr, -+ bootmap_size); -+ if (bootmap_valid) -+ mapstart = PHYS_PFN(mapstart_addr); -+ break; -+ default: -+ break; -+ } -+ } - -+ if (!bootmap_valid) -+ panic("No memory area to place a bootmap bitmap"); -+ -+ /* -+ * Initialize the boot-time allocator with low memory only. -+ */ -+ if (bootmap_size != init_bootmem_node(NODE_DATA(0), mapstart, -+ min_low_pfn, max_low_pfn)) -+ panic("Unexpected memory size required for bootmap"); - - for (i = 0; i < boot_mem_map.nr_map; i++) { - unsigned long start, end; -@@ -438,6 +506,10 @@ static void __init bootmem_init(void) - continue; - default: - /* Not usable memory */ -+ if (start > min_low_pfn && end < max_low_pfn) -+ reserve_bootmem(boot_mem_map.map[i].addr, -+ boot_mem_map.map[i].size, -+ BOOTMEM_DEFAULT); - continue; - } - -diff --git a/arch/mips/netlogic/common/irq.c b/arch/mips/netlogic/common/irq.c -index 3660dc67d544..f4961bc9a61d 100644 ---- a/arch/mips/netlogic/common/irq.c -+++ b/arch/mips/netlogic/common/irq.c -@@ -275,7 +275,7 @@ asmlinkage void plat_irq_dispatch(void) - do_IRQ(nlm_irq_to_xirq(node, i)); - } - --#ifdef CONFIG_OF -+#ifdef CONFIG_CPU_XLP - static const struct irq_domain_ops xlp_pic_irq_domain_ops = { - .xlate = irq_domain_xlate_onetwocell, - }; -@@ -348,7 +348,7 @@ void __init arch_init_irq(void) - #if defined(CONFIG_CPU_XLR) - nlm_setup_fmn_irq(); - #endif --#if defined(CONFIG_OF) -+#ifdef CONFIG_CPU_XLP - of_irq_init(xlp_pic_irq_ids); - #endif - } -diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h -index 19d14ac23ef9..fc3c7e49c8e4 100644 ---- a/arch/x86/include/asm/kvm_emulate.h -+++ b/arch/x86/include/asm/kvm_emulate.h -@@ -296,6 +296,7 @@ struct x86_emulate_ctxt { - - bool perm_ok; /* do not check permissions if true */ - bool ud; /* inject an #UD if host doesn't support insn */ -+ bool tf; /* TF value before instruction (after for syscall/sysret) */ - - bool have_exception; - struct x86_exception exception; -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 04b2f3cad7ba..684edebb4a0c 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2726,6 +2726,7 @@ static int em_syscall(struct x86_emulate_ctxt *ctxt) - ctxt->eflags &= ~(X86_EFLAGS_VM | X86_EFLAGS_IF); - } - -+ ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; - return X86EMUL_CONTINUE; - } - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 8e526c6fd784..3ffd5900da5b 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5095,6 +5095,8 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) - kvm_x86_ops->get_cs_db_l_bits(vcpu, &cs_db, &cs_l); - - ctxt->eflags = kvm_get_rflags(vcpu); -+ ctxt->tf = (ctxt->eflags & X86_EFLAGS_TF) != 0; -+ - ctxt->eip = kvm_rip_read(vcpu); - ctxt->mode = (!is_protmode(vcpu)) ? X86EMUL_MODE_REAL : - (ctxt->eflags & X86_EFLAGS_VM) ? X86EMUL_MODE_VM86 : -@@ -5315,37 +5317,26 @@ static int kvm_vcpu_check_hw_bp(unsigned long addr, u32 type, u32 dr7, - return dr6; - } - --static void kvm_vcpu_check_singlestep(struct kvm_vcpu *vcpu, unsigned long rflags, int *r) -+static void kvm_vcpu_do_singlestep(struct kvm_vcpu *vcpu, int *r) - { - struct kvm_run *kvm_run = vcpu->run; - -- /* -- * rflags is the old, "raw" value of the flags. The new value has -- * not been saved yet. -- * -- * This is correct even for TF set by the guest, because "the -- * processor will not generate this exception after the instruction -- * that sets the TF flag". -- */ -- if (unlikely(rflags & X86_EFLAGS_TF)) { -- if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { -- kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | -- DR6_RTM; -- kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; -- kvm_run->debug.arch.exception = DB_VECTOR; -- kvm_run->exit_reason = KVM_EXIT_DEBUG; -- *r = EMULATE_USER_EXIT; -- } else { -- vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; -- /* -- * "Certain debug exceptions may clear bit 0-3. The -- * remaining contents of the DR6 register are never -- * cleared by the processor". -- */ -- vcpu->arch.dr6 &= ~15; -- vcpu->arch.dr6 |= DR6_BS | DR6_RTM; -- kvm_queue_exception(vcpu, DB_VECTOR); -- } -+ if (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP) { -+ kvm_run->debug.arch.dr6 = DR6_BS | DR6_FIXED_1 | DR6_RTM; -+ kvm_run->debug.arch.pc = vcpu->arch.singlestep_rip; -+ kvm_run->debug.arch.exception = DB_VECTOR; -+ kvm_run->exit_reason = KVM_EXIT_DEBUG; -+ *r = EMULATE_USER_EXIT; -+ } else { -+ vcpu->arch.emulate_ctxt.eflags &= ~X86_EFLAGS_TF; -+ /* -+ * "Certain debug exceptions may clear bit 0-3. The -+ * remaining contents of the DR6 register are never -+ * cleared by the processor". -+ */ -+ vcpu->arch.dr6 &= ~15; -+ vcpu->arch.dr6 |= DR6_BS | DR6_RTM; -+ kvm_queue_exception(vcpu, DB_VECTOR); - } - } - -@@ -5500,8 +5491,9 @@ restart: - toggle_interruptibility(vcpu, ctxt->interruptibility); - vcpu->arch.emulate_regs_need_sync_to_vcpu = false; - kvm_rip_write(vcpu, ctxt->eip); -- if (r == EMULATE_DONE) -- kvm_vcpu_check_singlestep(vcpu, rflags, &r); -+ if (r == EMULATE_DONE && -+ (ctxt->tf || (vcpu->guest_debug & KVM_GUESTDBG_SINGLESTEP))) -+ kvm_vcpu_do_singlestep(vcpu, &r); - if (!ctxt->have_exception || - exception_type(ctxt->exception.vector) == EXCPT_TRAP) - __kvm_set_rflags(vcpu, ctxt->eflags); -diff --git a/crypto/Kconfig b/crypto/Kconfig -index 617bf4a7da56..7240821137fd 100644 ---- a/crypto/Kconfig -+++ b/crypto/Kconfig -@@ -343,7 +343,6 @@ config CRYPTO_XTS - select CRYPTO_BLKCIPHER - select CRYPTO_MANAGER - select CRYPTO_GF128MUL -- select CRYPTO_ECB - help - XTS: IEEE1619/D16 narrow block cipher use with aes-xts-plain, - key size 256, 384 or 512 bits. This implementation currently -diff --git a/drivers/ata/Kconfig b/drivers/ata/Kconfig -index 6aaa3f81755b..c2ba811993d4 100644 ---- a/drivers/ata/Kconfig -+++ b/drivers/ata/Kconfig -@@ -272,6 +272,7 @@ config SATA_SX4 - - config ATA_BMDMA - bool "ATA BMDMA support" -+ depends on HAS_DMA - default y - help - This option adds support for SFF ATA controllers with BMDMA -@@ -318,6 +319,7 @@ config SATA_DWC_VDEBUG - - config SATA_HIGHBANK - tristate "Calxeda Highbank SATA support" -+ depends on HAS_DMA - depends on ARCH_HIGHBANK || COMPILE_TEST - help - This option enables support for the Calxeda Highbank SoC's -@@ -327,6 +329,7 @@ config SATA_HIGHBANK - - config SATA_MV - tristate "Marvell SATA support" -+ depends on HAS_DMA - depends on PCI || ARCH_DOVE || ARCH_MV78XX0 || \ - ARCH_MVEBU || ARCH_ORION5X || COMPILE_TEST - select GENERIC_PHY -diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c -index 33e23a7a691f..a295ad6a1674 100644 ---- a/drivers/block/xen-blkback/blkback.c -+++ b/drivers/block/xen-blkback/blkback.c -@@ -1407,33 +1407,34 @@ static int dispatch_rw_block_io(struct xen_blkif *blkif, - static void make_response(struct xen_blkif *blkif, u64 id, - unsigned short op, int st) - { -- struct blkif_response resp; -+ struct blkif_response *resp; - unsigned long flags; - union blkif_back_rings *blk_rings = &blkif->blk_rings; - int notify; - -- resp.id = id; -- resp.operation = op; -- resp.status = st; -- - spin_lock_irqsave(&blkif->blk_ring_lock, flags); - /* Place on the response ring for the relevant domain. */ - switch (blkif->blk_protocol) { - case BLKIF_PROTOCOL_NATIVE: -- memcpy(RING_GET_RESPONSE(&blk_rings->native, blk_rings->native.rsp_prod_pvt), -- &resp, sizeof(resp)); -+ resp = RING_GET_RESPONSE(&blk_rings->native, -+ blk_rings->native.rsp_prod_pvt); - break; - case BLKIF_PROTOCOL_X86_32: -- memcpy(RING_GET_RESPONSE(&blk_rings->x86_32, blk_rings->x86_32.rsp_prod_pvt), -- &resp, sizeof(resp)); -+ resp = RING_GET_RESPONSE(&blk_rings->x86_32, -+ blk_rings->x86_32.rsp_prod_pvt); - break; - case BLKIF_PROTOCOL_X86_64: -- memcpy(RING_GET_RESPONSE(&blk_rings->x86_64, blk_rings->x86_64.rsp_prod_pvt), -- &resp, sizeof(resp)); -+ resp = RING_GET_RESPONSE(&blk_rings->x86_64, -+ blk_rings->x86_64.rsp_prod_pvt); - break; - default: - BUG(); - } -+ -+ resp->id = id; -+ resp->operation = op; -+ resp->status = st; -+ - blk_rings->common.rsp_prod_pvt++; - RING_PUSH_RESPONSES_AND_CHECK_NOTIFY(&blk_rings->common, notify); - spin_unlock_irqrestore(&blkif->blk_ring_lock, flags); -diff --git a/drivers/block/xen-blkback/common.h b/drivers/block/xen-blkback/common.h -index c929ae22764c..04cfee719334 100644 ---- a/drivers/block/xen-blkback/common.h -+++ b/drivers/block/xen-blkback/common.h -@@ -74,9 +74,8 @@ extern unsigned int xen_blkif_max_ring_order; - struct blkif_common_request { - char dummy; - }; --struct blkif_common_response { -- char dummy; --}; -+ -+/* i386 protocol version */ - - struct blkif_x86_32_request_rw { - uint8_t nr_segments; /* number of segments */ -@@ -128,14 +127,6 @@ struct blkif_x86_32_request { - } u; - } __attribute__((__packed__)); - --/* i386 protocol version */ --#pragma pack(push, 4) --struct blkif_x86_32_response { -- uint64_t id; /* copied from request */ -- uint8_t operation; /* copied from request */ -- int16_t status; /* BLKIF_RSP_??? */ --}; --#pragma pack(pop) - /* x86_64 protocol version */ - - struct blkif_x86_64_request_rw { -@@ -192,18 +183,12 @@ struct blkif_x86_64_request { - } u; - } __attribute__((__packed__)); - --struct blkif_x86_64_response { -- uint64_t __attribute__((__aligned__(8))) id; -- uint8_t operation; /* copied from request */ -- int16_t status; /* BLKIF_RSP_??? */ --}; -- - DEFINE_RING_TYPES(blkif_common, struct blkif_common_request, -- struct blkif_common_response); -+ struct blkif_response); - DEFINE_RING_TYPES(blkif_x86_32, struct blkif_x86_32_request, -- struct blkif_x86_32_response); -+ struct blkif_response __packed); - DEFINE_RING_TYPES(blkif_x86_64, struct blkif_x86_64_request, -- struct blkif_x86_64_response); -+ struct blkif_response); - - union blkif_back_rings { - struct blkif_back_ring native; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 7bb8055bd10c..1ccad79ce77c 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -2969,6 +2969,12 @@ static int btusb_probe(struct usb_interface *intf, - if (id->driver_info & BTUSB_QCA_ROME) { - data->setup_on_usb = btusb_setup_qca; - hdev->set_bdaddr = btusb_set_bdaddr_ath3012; -+ -+ /* QCA Rome devices lose their updated firmware over suspend, -+ * but the USB hub doesn't notice any status change. -+ * Explicitly request a device reset on resume. -+ */ -+ set_bit(BTUSB_RESET_RESUME, &data->flags); - } - - #ifdef CONFIG_BT_HCIBTUSB_RTL -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index b8576fd6bd0e..1c7568c0055a 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -634,6 +634,7 @@ static int dmatest_func(void *data) - * free it this time?" dancing. For now, just - * leave it dangling. - */ -+ WARN(1, "dmatest: Kernel stack may be corrupted!!\n"); - dmaengine_unmap_put(um); - result("test timed out", total_tests, src_off, dst_off, - len, 0); -diff --git a/drivers/extcon/extcon-palmas.c b/drivers/extcon/extcon-palmas.c -index 93c30a885740..aa2f6bb82b32 100644 ---- a/drivers/extcon/extcon-palmas.c -+++ b/drivers/extcon/extcon-palmas.c -@@ -190,6 +190,11 @@ static int palmas_usb_probe(struct platform_device *pdev) - struct palmas_usb *palmas_usb; - int status; - -+ if (!palmas) { -+ dev_err(&pdev->dev, "failed to get valid parent\n"); -+ return -EINVAL; -+ } -+ - palmas_usb = devm_kzalloc(&pdev->dev, sizeof(*palmas_usb), GFP_KERNEL); - if (!palmas_usb) - return -ENOMEM; -diff --git a/drivers/gpu/drm/mgag200/mgag200_main.c b/drivers/gpu/drm/mgag200/mgag200_main.c -index b1a0f5656175..44df959cbadb 100644 ---- a/drivers/gpu/drm/mgag200/mgag200_main.c -+++ b/drivers/gpu/drm/mgag200/mgag200_main.c -@@ -145,6 +145,8 @@ static int mga_vram_init(struct mga_device *mdev) - } - - mem = pci_iomap(mdev->dev->pdev, 0, 0); -+ if (!mem) -+ return -ENOMEM; - - mdev->mc.vram_size = mga_probe_vram(mdev, mem); - -diff --git a/drivers/gpu/drm/sti/sti_vtg.c b/drivers/gpu/drm/sti/sti_vtg.c -index d56630c60039..117a2f52fb4e 100644 ---- a/drivers/gpu/drm/sti/sti_vtg.c -+++ b/drivers/gpu/drm/sti/sti_vtg.c -@@ -346,6 +346,10 @@ static int vtg_probe(struct platform_device *pdev) - return -ENOMEM; - } - vtg->regs = devm_ioremap_nocache(dev, res->start, resource_size(res)); -+ if (!vtg->regs) { -+ DRM_ERROR("failed to remap I/O memory\n"); -+ return -ENOMEM; -+ } - - np = of_parse_phandle(pdev->dev.of_node, "st,slave", 0); - if (np) { -diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c -index eb9e7feb9b13..7a16e9ea041c 100644 ---- a/drivers/media/rc/imon.c -+++ b/drivers/media/rc/imon.c -@@ -2419,6 +2419,11 @@ static int imon_probe(struct usb_interface *interface, - mutex_lock(&driver_lock); - - first_if = usb_ifnum_to_if(usbdev, 0); -+ if (!first_if) { -+ ret = -ENODEV; -+ goto fail; -+ } -+ - first_if_ctx = usb_get_intfdata(first_if); - - if (ifnum == 0) { -diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c -index 7ed49646a699..7df0707a0455 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_devices.c -+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c -@@ -292,7 +292,7 @@ static int stk7700P2_frontend_attach(struct dvb_usb_adapter *adap) - stk7700d_dib7000p_mt2266_config) - != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - } -@@ -326,7 +326,7 @@ static int stk7700d_frontend_attach(struct dvb_usb_adapter *adap) - stk7700d_dib7000p_mt2266_config) - != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - } -@@ -479,7 +479,7 @@ static int stk7700ph_frontend_attach(struct dvb_usb_adapter *adap) - &stk7700ph_dib7700_xc3028_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -1010,7 +1010,7 @@ static int stk7070p_frontend_attach(struct dvb_usb_adapter *adap) - &dib7070p_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -1068,7 +1068,7 @@ static int stk7770p_frontend_attach(struct dvb_usb_adapter *adap) - &dib7770p_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -3036,7 +3036,7 @@ static int nim7090_frontend_attach(struct dvb_usb_adapter *adap) - - if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x10, &nim7090_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, 0x80, &nim7090_dib7000p_config); -@@ -3089,7 +3089,7 @@ static int tfe7090pvr_frontend0_attach(struct dvb_usb_adapter *adap) - /* initialize IC 0 */ - if (state->dib7000p_ops.i2c_enumeration(&adap->dev->i2c_adap, 1, 0x20, &tfe7090pvr_dib7000p_config[0]) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -3119,7 +3119,7 @@ static int tfe7090pvr_frontend1_attach(struct dvb_usb_adapter *adap) - i2c = state->dib7000p_ops.get_i2c_master(adap->dev->adapter[0].fe_adap[0].fe, DIBX000_I2C_INTERFACE_GPIO_6_7, 1); - if (state->dib7000p_ops.i2c_enumeration(i2c, 1, 0x10, &tfe7090pvr_dib7000p_config[1]) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -3194,7 +3194,7 @@ static int tfe7790p_frontend_attach(struct dvb_usb_adapter *adap) - 1, 0x10, &tfe7790p_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - adap->fe_adap[0].fe = state->dib7000p_ops.init(&adap->dev->i2c_adap, -@@ -3289,7 +3289,7 @@ static int stk7070pd_frontend_attach0(struct dvb_usb_adapter *adap) - stk7070pd_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -@@ -3364,7 +3364,7 @@ static int novatd_frontend_attach(struct dvb_usb_adapter *adap) - stk7070pd_dib7000p_config) != 0) { - err("%s: state->dib7000p_ops.i2c_enumeration failed. Cannot continue\n", - __func__); -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - } -@@ -3600,7 +3600,7 @@ static int pctv340e_frontend_attach(struct dvb_usb_adapter *adap) - - if (state->dib7000p_ops.dib7000pc_detection(&adap->dev->i2c_adap) == 0) { - /* Demodulator not found for some reason? */ -- dvb_detach(&state->dib7000p_ops); -+ dvb_detach(state->dib7000p_ops.set_wbd_ref); - return -ENODEV; - } - -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c -index af09a1b272e6..6a2d1454befe 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_mbx.c -@@ -2002,9 +2002,10 @@ static void fm10k_sm_mbx_create_reply(struct fm10k_hw *hw, - * function can also be used to respond to an error as the connection - * resetting would also be a means of dealing with errors. - **/ --static void fm10k_sm_mbx_process_reset(struct fm10k_hw *hw, -- struct fm10k_mbx_info *mbx) -+static s32 fm10k_sm_mbx_process_reset(struct fm10k_hw *hw, -+ struct fm10k_mbx_info *mbx) - { -+ s32 err = 0; - const enum fm10k_mbx_state state = mbx->state; - - switch (state) { -@@ -2017,6 +2018,7 @@ static void fm10k_sm_mbx_process_reset(struct fm10k_hw *hw, - case FM10K_STATE_OPEN: - /* flush any incomplete work */ - fm10k_sm_mbx_connect_reset(mbx); -+ err = FM10K_ERR_RESET_REQUESTED; - break; - case FM10K_STATE_CONNECT: - /* Update remote value to match local value */ -@@ -2026,6 +2028,8 @@ static void fm10k_sm_mbx_process_reset(struct fm10k_hw *hw, - } - - fm10k_sm_mbx_create_reply(hw, mbx, mbx->tail); -+ -+ return err; - } - - /** -@@ -2106,7 +2110,7 @@ static s32 fm10k_sm_mbx_process(struct fm10k_hw *hw, - - switch (FM10K_MSG_HDR_FIELD_GET(mbx->mbx_hdr, SM_VER)) { - case 0: -- fm10k_sm_mbx_process_reset(hw, mbx); -+ err = fm10k_sm_mbx_process_reset(hw, mbx); - break; - case FM10K_SM_MBX_VERSION: - err = fm10k_sm_mbx_process_version_1(hw, mbx); -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c -index 7f3fb51bc37b..06f35700840b 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_pci.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_pci.c -@@ -1072,6 +1072,7 @@ static irqreturn_t fm10k_msix_mbx_pf(int __always_unused irq, void *data) - struct fm10k_hw *hw = &interface->hw; - struct fm10k_mbx_info *mbx = &hw->mbx; - u32 eicr; -+ s32 err = 0; - - /* unmask any set bits related to this interrupt */ - eicr = fm10k_read_reg(hw, FM10K_EICR); -@@ -1087,12 +1088,15 @@ static irqreturn_t fm10k_msix_mbx_pf(int __always_unused irq, void *data) - - /* service mailboxes */ - if (fm10k_mbx_trylock(interface)) { -- mbx->ops.process(hw, mbx); -+ err = mbx->ops.process(hw, mbx); - /* handle VFLRE events */ - fm10k_iov_event(interface); - fm10k_mbx_unlock(interface); - } - -+ if (err == FM10K_ERR_RESET_REQUESTED) -+ interface->flags |= FM10K_FLAG_RESET_REQUESTED; -+ - /* if switch toggled state we should reset GLORTs */ - if (eicr & FM10K_EICR_SWITCHNOTREADY) { - /* force link down for at least 4 seconds */ -diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c -index 97bf0c3d5c69..f3f3b95d5512 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_82575.c -+++ b/drivers/net/ethernet/intel/igb/e1000_82575.c -@@ -223,6 +223,17 @@ static s32 igb_init_phy_params_82575(struct e1000_hw *hw) - hw->bus.func = (rd32(E1000_STATUS) & E1000_STATUS_FUNC_MASK) >> - E1000_STATUS_FUNC_SHIFT; - -+ /* Make sure the PHY is in a good state. Several people have reported -+ * firmware leaving the PHY's page select register set to something -+ * other than the default of zero, which causes the PHY ID read to -+ * access something other than the intended register. -+ */ -+ ret_val = hw->phy.ops.reset(hw); -+ if (ret_val) { -+ hw_dbg("Error resetting the PHY.\n"); -+ goto out; -+ } -+ - /* Set phy->phy_addr and phy->id. */ - ret_val = igb_get_phy_id_82575(hw); - if (ret_val) -diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c -index 29f59c76878a..851225b5dc0f 100644 ---- a/drivers/net/ethernet/intel/igb/e1000_i210.c -+++ b/drivers/net/ethernet/intel/igb/e1000_i210.c -@@ -699,9 +699,9 @@ static s32 igb_update_flash_i210(struct e1000_hw *hw) - - ret_val = igb_pool_flash_update_done_i210(hw); - if (ret_val) -- hw_dbg("Flash update complete\n"); -- else - hw_dbg("Flash update time out\n"); -+ else -+ hw_dbg("Flash update complete\n"); - - out: - return ret_val; -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index a481ea64e287..ff6e57d788eb 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -3172,7 +3172,9 @@ static int __igb_close(struct net_device *netdev, bool suspending) - - static int igb_close(struct net_device *netdev) - { -- return __igb_close(netdev, false); -+ if (netif_device_present(netdev)) -+ return __igb_close(netdev, false); -+ return 0; - } - - /** -@@ -7325,12 +7327,14 @@ static int __igb_shutdown(struct pci_dev *pdev, bool *enable_wake, - int retval = 0; - #endif - -+ rtnl_lock(); - netif_device_detach(netdev); - - if (netif_running(netdev)) - __igb_close(netdev, true); - - igb_clear_interrupt_scheme(adapter); -+ rtnl_unlock(); - - #ifdef CONFIG_PM - retval = pci_save_state(pdev); -@@ -7450,16 +7454,15 @@ static int igb_resume(struct device *dev) - - wr32(E1000_WUS, ~0); - -- if (netdev->flags & IFF_UP) { -- rtnl_lock(); -+ rtnl_lock(); -+ if (!err && netif_running(netdev)) - err = __igb_open(netdev, true); -- rtnl_unlock(); -- if (err) -- return err; -- } - -- netif_device_attach(netdev); -- return 0; -+ if (!err) -+ netif_device_attach(netdev); -+ rtnl_unlock(); -+ -+ return err; - } - - static int igb_runtime_idle(struct device *dev) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c -index f3168bcc7d87..f0de09db8283 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_lib.c -@@ -307,6 +307,7 @@ static void ixgbe_cache_ring_register(struct ixgbe_adapter *adapter) - ixgbe_cache_ring_rss(adapter); - } - -+#define IXGBE_RSS_64Q_MASK 0x3F - #define IXGBE_RSS_16Q_MASK 0xF - #define IXGBE_RSS_8Q_MASK 0x7 - #define IXGBE_RSS_4Q_MASK 0x3 -@@ -602,6 +603,7 @@ static bool ixgbe_set_sriov_queues(struct ixgbe_adapter *adapter) - **/ - static bool ixgbe_set_rss_queues(struct ixgbe_adapter *adapter) - { -+ struct ixgbe_hw *hw = &adapter->hw; - struct ixgbe_ring_feature *f; - u16 rss_i; - -@@ -610,7 +612,11 @@ static bool ixgbe_set_rss_queues(struct ixgbe_adapter *adapter) - rss_i = f->limit; - - f->indices = rss_i; -- f->mask = IXGBE_RSS_16Q_MASK; -+ -+ if (hw->mac.type < ixgbe_mac_X550) -+ f->mask = IXGBE_RSS_16Q_MASK; -+ else -+ f->mask = IXGBE_RSS_64Q_MASK; - - /* disable ATR by default, it will be configured below */ - adapter->flags &= ~IXGBE_FLAG_FDIR_HASH_CAPABLE; -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index cd9b284bc83b..83645d8503d4 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -5878,7 +5878,8 @@ static int ixgbe_close(struct net_device *netdev) - - ixgbe_ptp_stop(adapter); - -- ixgbe_close_suspend(adapter); -+ if (netif_device_present(netdev)) -+ ixgbe_close_suspend(adapter); - - ixgbe_fdir_filter_exit(adapter); - -@@ -5923,14 +5924,12 @@ static int ixgbe_resume(struct pci_dev *pdev) - if (!err && netif_running(netdev)) - err = ixgbe_open(netdev); - -- rtnl_unlock(); -- -- if (err) -- return err; - -- netif_device_attach(netdev); -+ if (!err) -+ netif_device_attach(netdev); -+ rtnl_unlock(); - -- return 0; -+ return err; - } - #endif /* CONFIG_PM */ - -@@ -5945,14 +5944,14 @@ static int __ixgbe_shutdown(struct pci_dev *pdev, bool *enable_wake) - int retval = 0; - #endif - -+ rtnl_lock(); - netif_device_detach(netdev); - -- rtnl_lock(); - if (netif_running(netdev)) - ixgbe_close_suspend(adapter); -- rtnl_unlock(); - - ixgbe_clear_interrupt_scheme(adapter); -+ rtnl_unlock(); - - #ifdef CONFIG_PM - retval = pci_save_state(pdev); -@@ -9221,7 +9220,7 @@ skip_bad_vf_detection: - } - - if (netif_running(netdev)) -- ixgbe_down(adapter); -+ ixgbe_close_suspend(adapter); - - if (!test_and_set_bit(__IXGBE_DISABLED, &adapter->state)) - pci_disable_device(pdev); -@@ -9291,10 +9290,12 @@ static void ixgbe_io_resume(struct pci_dev *pdev) - } - - #endif -+ rtnl_lock(); - if (netif_running(netdev)) -- ixgbe_up(adapter); -+ ixgbe_open(netdev); - - netif_device_attach(netdev); -+ rtnl_unlock(); - } - - static const struct pci_error_handlers ixgbe_err_handler = { -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -index fb8673d63806..48d97cb730d8 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_phy.c -@@ -113,7 +113,7 @@ static s32 ixgbe_read_i2c_combined_generic_int(struct ixgbe_hw *hw, u8 addr, - u16 reg, u16 *val, bool lock) - { - u32 swfw_mask = hw->phy.phy_semaphore_mask; -- int max_retry = 10; -+ int max_retry = 3; - int retry = 0; - u8 csum_byte; - u8 high_bits; -@@ -1764,6 +1764,8 @@ static s32 ixgbe_read_i2c_byte_generic_int(struct ixgbe_hw *hw, u8 byte_offset, - u32 swfw_mask = hw->phy.phy_semaphore_mask; - bool nack = true; - -+ if (hw->mac.type >= ixgbe_mac_X550) -+ max_retry = 3; - if (ixgbe_is_sfp_probe(hw, byte_offset, dev_addr)) - max_retry = IXGBE_SFP_DETECT_RETRIES; - -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index ebe0ac950b14..31f864fb30c1 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -1643,8 +1643,6 @@ static s32 ixgbe_setup_kr_speed_x550em(struct ixgbe_hw *hw, - return status; - - reg_val |= IXGBE_KRM_LINK_CTRL_1_TETH_AN_ENABLE; -- reg_val &= ~(IXGBE_KRM_LINK_CTRL_1_TETH_AN_FEC_REQ | -- IXGBE_KRM_LINK_CTRL_1_TETH_AN_CAP_FEC); - reg_val &= ~(IXGBE_KRM_LINK_CTRL_1_TETH_AN_CAP_KR | - IXGBE_KRM_LINK_CTRL_1_TETH_AN_CAP_KX); - -diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c -index 8c408aa2f208..f9343bee1de3 100644 ---- a/drivers/net/usb/cdc_ether.c -+++ b/drivers/net/usb/cdc_ether.c -@@ -221,7 +221,7 @@ skip: - goto bad_desc; - } - -- if (header.usb_cdc_ether_desc) { -+ if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) { - dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize); - /* because of Zaurus, we may be ignoring the host - * side link address we were given. -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 958af3b1af7f..e325ca3ad565 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -262,7 +262,7 @@ static int qmi_wwan_bind(struct usbnet *dev, struct usb_interface *intf) - } - - /* errors aren't fatal - we can live with the dynamic address */ -- if (cdc_ether) { -+ if (cdc_ether && cdc_ether->wMaxSegmentSize) { - dev->hard_mtu = le16_to_cpu(cdc_ether->wMaxSegmentSize); - usbnet_get_ethernet_addr(dev, cdc_ether->iMACAddress); - } -diff --git a/drivers/scsi/lpfc/lpfc_attr.c b/drivers/scsi/lpfc/lpfc_attr.c -index f6446d759d7f..4639dac64e7f 100644 ---- a/drivers/scsi/lpfc/lpfc_attr.c -+++ b/drivers/scsi/lpfc/lpfc_attr.c -@@ -5147,6 +5147,19 @@ lpfc_free_sysfs_attr(struct lpfc_vport *vport) - * Dynamic FC Host Attributes Support - */ - -+/** -+ * lpfc_get_host_symbolic_name - Copy symbolic name into the scsi host -+ * @shost: kernel scsi host pointer. -+ **/ -+static void -+lpfc_get_host_symbolic_name(struct Scsi_Host *shost) -+{ -+ struct lpfc_vport *vport = (struct lpfc_vport *)shost->hostdata; -+ -+ lpfc_vport_symbolic_node_name(vport, fc_host_symbolic_name(shost), -+ sizeof fc_host_symbolic_name(shost)); -+} -+ - /** - * lpfc_get_host_port_id - Copy the vport DID into the scsi host port id - * @shost: kernel scsi host pointer. -@@ -5684,6 +5697,8 @@ struct fc_function_template lpfc_transport_functions = { - .show_host_supported_fc4s = 1, - .show_host_supported_speeds = 1, - .show_host_maxframe_size = 1, -+ -+ .get_host_symbolic_name = lpfc_get_host_symbolic_name, - .show_host_symbolic_name = 1, - - /* dynamic attributes the driver supports */ -@@ -5751,6 +5766,8 @@ struct fc_function_template lpfc_vport_transport_functions = { - .show_host_supported_fc4s = 1, - .show_host_supported_speeds = 1, - .show_host_maxframe_size = 1, -+ -+ .get_host_symbolic_name = lpfc_get_host_symbolic_name, - .show_host_symbolic_name = 1, - - /* dynamic attributes the driver supports */ -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index c74f74ab981c..d278362448ca 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -1982,6 +1982,9 @@ lpfc_issue_els_plogi(struct lpfc_vport *vport, uint32_t did, uint8_t retry) - if (sp->cmn.fcphHigh < FC_PH3) - sp->cmn.fcphHigh = FC_PH3; - -+ sp->cmn.valid_vendor_ver_level = 0; -+ memset(sp->vendorVersion, 0, sizeof(sp->vendorVersion)); -+ - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_CMD, - "Issue PLOGI: did:x%x", - did, 0, 0); -@@ -3966,6 +3969,9 @@ lpfc_els_rsp_acc(struct lpfc_vport *vport, uint32_t flag, - } else { - memcpy(pcmd, &vport->fc_sparam, - sizeof(struct serv_parm)); -+ -+ sp->cmn.valid_vendor_ver_level = 0; -+ memset(sp->vendorVersion, 0, sizeof(sp->vendorVersion)); - } - - lpfc_debugfs_disc_trc(vport, LPFC_DISC_TRC_ELS_RSP, -diff --git a/drivers/scsi/lpfc/lpfc_hw.h b/drivers/scsi/lpfc/lpfc_hw.h -index 2cce88e967ce..a8ad97300177 100644 ---- a/drivers/scsi/lpfc/lpfc_hw.h -+++ b/drivers/scsi/lpfc/lpfc_hw.h -@@ -360,6 +360,12 @@ struct csp { - * Word 1 Bit 30 in PLOGI request is random offset - */ - #define virtual_fabric_support randomOffset /* Word 1, bit 30 */ -+/* -+ * Word 1 Bit 29 in common service parameter is overloaded. -+ * Word 1 Bit 29 in FLOGI response is multiple NPort assignment -+ * Word 1 Bit 29 in FLOGI/PLOGI request is Valid Vendor Version Level -+ */ -+#define valid_vendor_ver_level response_multiple_NPort /* Word 1, bit 29 */ - #ifdef __BIG_ENDIAN_BITFIELD - uint16_t request_multiple_Nport:1; /* FC Word 1, bit 31 */ - uint16_t randomOffset:1; /* FC Word 1, bit 30 */ -diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c -index 38e90d9c2ced..8379fbbc60db 100644 ---- a/drivers/scsi/lpfc/lpfc_sli.c -+++ b/drivers/scsi/lpfc/lpfc_sli.c -@@ -118,6 +118,8 @@ lpfc_sli4_wq_put(struct lpfc_queue *q, union lpfc_wqe *wqe) - if (q->phba->sli3_options & LPFC_SLI4_PHWQ_ENABLED) - bf_set(wqe_wqid, &wqe->generic.wqe_com, q->queue_id); - lpfc_sli_pcimem_bcopy(wqe, temp_wqe, q->entry_size); -+ /* ensure WQE bcopy flushed before doorbell write */ -+ wmb(); - - /* Update the host index before invoking device */ - host_index = q->host_index; -@@ -9805,6 +9807,7 @@ lpfc_sli_abort_iotag_issue(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - iabt->ulpCommand = CMD_CLOSE_XRI_CN; - - abtsiocbp->iocb_cmpl = lpfc_sli_abort_els_cmpl; -+ abtsiocbp->vport = vport; - - lpfc_printf_vlog(vport, KERN_INFO, LOG_SLI, - "0339 Abort xri x%x, original iotag x%x, " -diff --git a/drivers/scsi/lpfc/lpfc_vport.c b/drivers/scsi/lpfc/lpfc_vport.c -index 769012663a8f..861c57bc4520 100644 ---- a/drivers/scsi/lpfc/lpfc_vport.c -+++ b/drivers/scsi/lpfc/lpfc_vport.c -@@ -528,6 +528,12 @@ enable_vport(struct fc_vport *fc_vport) - - spin_lock_irq(shost->host_lock); - vport->load_flag |= FC_LOADING; -+ if (vport->fc_flag & FC_VPORT_NEEDS_INIT_VPI) { -+ spin_unlock_irq(shost->host_lock); -+ lpfc_issue_init_vpi(vport); -+ goto out; -+ } -+ - vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI; - spin_unlock_irq(shost->host_lock); - -@@ -548,6 +554,8 @@ enable_vport(struct fc_vport *fc_vport) - } else { - lpfc_vport_set_state(vport, FC_VPORT_FAILED); - } -+ -+out: - lpfc_printf_vlog(vport, KERN_ERR, LOG_VPORT, - "1827 Vport Enabled.\n"); - return VPORT_OK; -diff --git a/drivers/scsi/ufs/ufs-qcom.c b/drivers/scsi/ufs/ufs-qcom.c -index 4f38d008bfb4..4b82c3765e01 100644 ---- a/drivers/scsi/ufs/ufs-qcom.c -+++ b/drivers/scsi/ufs/ufs-qcom.c -@@ -1552,6 +1552,7 @@ static const struct of_device_id ufs_qcom_of_match[] = { - { .compatible = "qcom,ufshc"}, - {}, - }; -+MODULE_DEVICE_TABLE(of, ufs_qcom_of_match); - - static const struct dev_pm_ops ufs_qcom_pm_ops = { - .suspend = ufshcd_pltfrm_suspend, -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 85cd2564c157..0c2482ec7d21 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -3340,18 +3340,25 @@ out: - } - - /** -- * ufshcd_force_reset_auto_bkops - force enable of auto bkops -+ * ufshcd_force_reset_auto_bkops - force reset auto bkops state - * @hba: per adapter instance - * - * After a device reset the device may toggle the BKOPS_EN flag - * to default value. The s/w tracking variables should be updated -- * as well. Do this by forcing enable of auto bkops. -+ * as well. This function would change the auto-bkops state based on -+ * UFSHCD_CAP_KEEP_AUTO_BKOPS_ENABLED_EXCEPT_SUSPEND. - */ --static void ufshcd_force_reset_auto_bkops(struct ufs_hba *hba) -+static void ufshcd_force_reset_auto_bkops(struct ufs_hba *hba) - { -- hba->auto_bkops_enabled = false; -- hba->ee_ctrl_mask |= MASK_EE_URGENT_BKOPS; -- ufshcd_enable_auto_bkops(hba); -+ if (ufshcd_keep_autobkops_enabled_except_suspend(hba)) { -+ hba->auto_bkops_enabled = false; -+ hba->ee_ctrl_mask |= MASK_EE_URGENT_BKOPS; -+ ufshcd_enable_auto_bkops(hba); -+ } else { -+ hba->auto_bkops_enabled = true; -+ hba->ee_ctrl_mask &= ~MASK_EE_URGENT_BKOPS; -+ ufshcd_disable_auto_bkops(hba); -+ } - } - - static inline int ufshcd_get_bkops_status(struct ufs_hba *hba, u32 *status) -@@ -5149,11 +5156,15 @@ static int ufshcd_resume(struct ufs_hba *hba, enum ufs_pm_op pm_op) - goto set_old_link_state; - } - -- /* -- * If BKOPs operations are urgently needed at this moment then -- * keep auto-bkops enabled or else disable it. -- */ -- ufshcd_urgent_bkops(hba); -+ if (ufshcd_keep_autobkops_enabled_except_suspend(hba)) -+ ufshcd_enable_auto_bkops(hba); -+ else -+ /* -+ * If BKOPs operations are urgently needed at this moment then -+ * keep auto-bkops enabled or else disable it. -+ */ -+ ufshcd_urgent_bkops(hba); -+ - hba->clk_gating.is_suspended = false; - - if (ufshcd_is_clkscaling_enabled(hba)) -diff --git a/drivers/scsi/ufs/ufshcd.h b/drivers/scsi/ufs/ufshcd.h -index 2570d9477b37..bb02100ab2dc 100644 ---- a/drivers/scsi/ufs/ufshcd.h -+++ b/drivers/scsi/ufs/ufshcd.h -@@ -528,6 +528,14 @@ struct ufs_hba { - * CAUTION: Enabling this might reduce overall UFS throughput. - */ - #define UFSHCD_CAP_INTR_AGGR (1 << 4) -+ /* -+ * This capability allows the device auto-bkops to be always enabled -+ * except during suspend (both runtime and suspend). -+ * Enabling this capability means that device will always be allowed -+ * to do background operation when it's active but it might degrade -+ * the performance of ongoing read/write operations. -+ */ -+#define UFSHCD_CAP_KEEP_AUTO_BKOPS_ENABLED_EXCEPT_SUSPEND (1 << 5) - - struct devfreq *devfreq; - struct ufs_clk_scaling clk_scaling; -@@ -623,6 +631,11 @@ static inline void *ufshcd_get_variant(struct ufs_hba *hba) - BUG_ON(!hba); - return hba->priv; - } -+static inline bool ufshcd_keep_autobkops_enabled_except_suspend( -+ struct ufs_hba *hba) -+{ -+ return hba->caps & UFSHCD_CAP_KEEP_AUTO_BKOPS_ENABLED_EXCEPT_SUSPEND; -+} - - extern int ufshcd_runtime_suspend(struct ufs_hba *hba); - extern int ufshcd_runtime_resume(struct ufs_hba *hba); -diff --git a/drivers/staging/rtl8188eu/include/rtw_debug.h b/drivers/staging/rtl8188eu/include/rtw_debug.h -index 971bf457f32d..e75a386344e4 100644 ---- a/drivers/staging/rtl8188eu/include/rtw_debug.h -+++ b/drivers/staging/rtl8188eu/include/rtw_debug.h -@@ -75,7 +75,7 @@ extern u32 GlobalDebugLevel; - #define DBG_88E_LEVEL(_level, fmt, arg...) \ - do { \ - if (_level <= GlobalDebugLevel) \ -- pr_info(DRIVER_PREFIX"ERROR " fmt, ##arg); \ -+ pr_info(DRIVER_PREFIX fmt, ##arg); \ - } while (0) - - #define DBG_88E(...) \ -diff --git a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -index edfc6805e012..2b348439242f 100644 ---- a/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -+++ b/drivers/staging/rtl8712/rtl871x_ioctl_linux.c -@@ -199,7 +199,7 @@ static inline char *translate_scan(struct _adapter *padapter, - iwe.cmd = SIOCGIWMODE; - memcpy((u8 *)&cap, r8712_get_capability_from_ie(pnetwork->network.IEs), - 2); -- cap = le16_to_cpu(cap); -+ le16_to_cpus(&cap); - if (cap & (WLAN_CAPABILITY_IBSS | WLAN_CAPABILITY_BSS)) { - if (cap & WLAN_CAPABILITY_BSS) - iwe.u.mode = (u32)IW_MODE_MASTER; -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index 873ba02d59e6..f4c3a37e00ba 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -1653,6 +1653,18 @@ static int proc_unlinkurb(struct usb_dev_state *ps, void __user *arg) - return 0; - } - -+static void compute_isochronous_actual_length(struct urb *urb) -+{ -+ unsigned int i; -+ -+ if (urb->number_of_packets > 0) { -+ urb->actual_length = 0; -+ for (i = 0; i < urb->number_of_packets; i++) -+ urb->actual_length += -+ urb->iso_frame_desc[i].actual_length; -+ } -+} -+ - static int processcompl(struct async *as, void __user * __user *arg) - { - struct urb *urb = as->urb; -@@ -1660,6 +1672,7 @@ static int processcompl(struct async *as, void __user * __user *arg) - void __user *addr = as->userurb; - unsigned int i; - -+ compute_isochronous_actual_length(urb); - if (as->userbuffer && urb->actual_length) { - if (copy_urb_data_to_user(as->userbuffer, urb)) - goto err_out; -@@ -1829,6 +1842,7 @@ static int processcompl_compat(struct async *as, void __user * __user *arg) - void __user *addr = as->userurb; - unsigned int i; - -+ compute_isochronous_actual_length(urb); - if (as->userbuffer && urb->actual_length) { - if (copy_urb_data_to_user(as->userbuffer, urb)) - return -EFAULT; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index a6aaf2f193a4..37c418e581fb 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -221,6 +221,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Corsair Strafe RGB */ - { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT }, - -+ /* Corsair K70 LUX */ -+ { USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT }, -+ - /* MIDI keyboard WORLDE MINI */ - { USB_DEVICE(0x1c75, 0x0204), .driver_info = - USB_QUIRK_CONFIG_INTF_STRINGS }, -diff --git a/drivers/usb/serial/garmin_gps.c b/drivers/usb/serial/garmin_gps.c -index 37d0e8cc7af6..2220c1b9df10 100644 ---- a/drivers/usb/serial/garmin_gps.c -+++ b/drivers/usb/serial/garmin_gps.c -@@ -138,6 +138,7 @@ struct garmin_data { - __u8 privpkt[4*6]; - spinlock_t lock; - struct list_head pktlist; -+ struct usb_anchor write_urbs; - }; - - -@@ -906,13 +907,19 @@ static int garmin_init_session(struct usb_serial_port *port) - sizeof(GARMIN_START_SESSION_REQ), 0); - - if (status < 0) -- break; -+ goto err_kill_urbs; - } - - if (status > 0) - status = 0; - } - -+ return status; -+ -+err_kill_urbs: -+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); -+ usb_kill_urb(port->interrupt_in_urb); -+ - return status; - } - -@@ -931,7 +938,6 @@ static int garmin_open(struct tty_struct *tty, struct usb_serial_port *port) - spin_unlock_irqrestore(&garmin_data_p->lock, flags); - - /* shutdown any bulk reads that might be going on */ -- usb_kill_urb(port->write_urb); - usb_kill_urb(port->read_urb); - - if (garmin_data_p->state == STATE_RESET) -@@ -954,7 +960,7 @@ static void garmin_close(struct usb_serial_port *port) - - /* shutdown our urbs */ - usb_kill_urb(port->read_urb); -- usb_kill_urb(port->write_urb); -+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); - - /* keep reset state so we know that we must start a new session */ - if (garmin_data_p->state != STATE_RESET) -@@ -1038,12 +1044,14 @@ static int garmin_write_bulk(struct usb_serial_port *port, - } - - /* send it down the pipe */ -+ usb_anchor_urb(urb, &garmin_data_p->write_urbs); - status = usb_submit_urb(urb, GFP_ATOMIC); - if (status) { - dev_err(&port->dev, - "%s - usb_submit_urb(write bulk) failed with status = %d\n", - __func__, status); - count = status; -+ usb_unanchor_urb(urb); - kfree(buffer); - } - -@@ -1402,9 +1410,16 @@ static int garmin_port_probe(struct usb_serial_port *port) - garmin_data_p->state = 0; - garmin_data_p->flags = 0; - garmin_data_p->count = 0; -+ init_usb_anchor(&garmin_data_p->write_urbs); - usb_set_serial_port_data(port, garmin_data_p); - - status = garmin_init_session(port); -+ if (status) -+ goto err_free; -+ -+ return 0; -+err_free: -+ kfree(garmin_data_p); - - return status; - } -@@ -1414,6 +1429,7 @@ static int garmin_port_remove(struct usb_serial_port *port) - { - struct garmin_data *garmin_data_p = usb_get_serial_port_data(port); - -+ usb_kill_anchored_urbs(&garmin_data_p->write_urbs); - usb_kill_urb(port->interrupt_in_urb); - del_timer_sync(&garmin_data_p->timer); - kfree(garmin_data_p); -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index e1c1e329c877..4516291df1b8 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -148,6 +148,7 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x68a2)}, /* Sierra Wireless MC7710 */ - {DEVICE_SWI(0x1199, 0x68c0)}, /* Sierra Wireless MC7304/MC7354 */ - {DEVICE_SWI(0x1199, 0x901c)}, /* Sierra Wireless EM7700 */ -+ {DEVICE_SWI(0x1199, 0x901e)}, /* Sierra Wireless EM7355 QDL */ - {DEVICE_SWI(0x1199, 0x901f)}, /* Sierra Wireless EM7355 */ - {DEVICE_SWI(0x1199, 0x9040)}, /* Sierra Wireless Modem */ - {DEVICE_SWI(0x1199, 0x9041)}, /* Sierra Wireless MC7305/MC7355 */ -diff --git a/drivers/video/backlight/adp5520_bl.c b/drivers/video/backlight/adp5520_bl.c -index dd88ba1d71ce..35373e2065b2 100644 ---- a/drivers/video/backlight/adp5520_bl.c -+++ b/drivers/video/backlight/adp5520_bl.c -@@ -332,10 +332,18 @@ static int adp5520_bl_probe(struct platform_device *pdev) - } - - platform_set_drvdata(pdev, bl); -- ret |= adp5520_bl_setup(bl); -+ ret = adp5520_bl_setup(bl); -+ if (ret) { -+ dev_err(&pdev->dev, "failed to setup\n"); -+ if (data->pdata->en_ambl_sens) -+ sysfs_remove_group(&bl->dev.kobj, -+ &adp5520_bl_attr_group); -+ return ret; -+ } -+ - backlight_update_status(bl); - -- return ret; -+ return 0; - } - - static int adp5520_bl_remove(struct platform_device *pdev) -diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c -index 7de847df224f..4b40c6a4d441 100644 ---- a/drivers/video/backlight/lcd.c -+++ b/drivers/video/backlight/lcd.c -@@ -226,6 +226,8 @@ struct lcd_device *lcd_device_register(const char *name, struct device *parent, - dev_set_name(&new_ld->dev, "%s", name); - dev_set_drvdata(&new_ld->dev, devdata); - -+ new_ld->ops = ops; -+ - rc = device_register(&new_ld->dev); - if (rc) { - put_device(&new_ld->dev); -@@ -238,8 +240,6 @@ struct lcd_device *lcd_device_register(const char *name, struct device *parent, - return ERR_PTR(rc); - } - -- new_ld->ops = ops; -- - return new_ld; - } - EXPORT_SYMBOL(lcd_device_register); -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 194a6baa4283..4df1cb19a243 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -658,6 +658,20 @@ has_zeroout: - ret = check_block_validity(inode, map); - if (ret != 0) - return ret; -+ -+ /* -+ * Inodes with freshly allocated blocks where contents will be -+ * visible after transaction commit must be on transaction's -+ * ordered data list. -+ */ -+ if (map->m_flags & EXT4_MAP_NEW && -+ !(map->m_flags & EXT4_MAP_UNWRITTEN) && -+ !IS_NOQUOTA(inode) && -+ ext4_should_order_data(inode)) { -+ ret = ext4_jbd2_file_inode(handle, inode); -+ if (ret) -+ return ret; -+ } - } - return retval; - } -@@ -1152,15 +1166,6 @@ static int ext4_write_end(struct file *file, - int i_size_changed = 0; - - trace_ext4_write_end(inode, pos, len, copied); -- if (ext4_test_inode_state(inode, EXT4_STATE_ORDERED_MODE)) { -- ret = ext4_jbd2_file_inode(handle, inode); -- if (ret) { -- unlock_page(page); -- page_cache_release(page); -- goto errout; -- } -- } -- - if (ext4_has_inline_data(inode)) { - ret = ext4_write_inline_data_end(inode, pos, len, - copied, page); -diff --git a/include/asm-generic/memory_model.h b/include/asm-generic/memory_model.h -index 4b4b056a6eb0..5148150cc80b 100644 ---- a/include/asm-generic/memory_model.h -+++ b/include/asm-generic/memory_model.h -@@ -1,6 +1,8 @@ - #ifndef __ASM_MEMORY_MODEL_H - #define __ASM_MEMORY_MODEL_H - -+#include -+ - #ifndef __ASSEMBLY__ - - #if defined(CONFIG_FLATMEM) -@@ -72,7 +74,7 @@ - /* - * Convert a physical address to a Page Frame Number and back - */ --#define __phys_to_pfn(paddr) ((unsigned long)((paddr) >> PAGE_SHIFT)) -+#define __phys_to_pfn(paddr) PHYS_PFN(paddr) - #define __pfn_to_phys(pfn) PFN_PHYS(pfn) - - #define page_to_pfn __page_to_pfn -diff --git a/include/dt-bindings/pinctrl/omap.h b/include/dt-bindings/pinctrl/omap.h -index 13949259705a..0d4fe32b3ae2 100644 ---- a/include/dt-bindings/pinctrl/omap.h -+++ b/include/dt-bindings/pinctrl/omap.h -@@ -45,8 +45,8 @@ - #define PIN_OFF_NONE 0 - #define PIN_OFF_OUTPUT_HIGH (OFF_EN | OFFOUT_EN | OFFOUT_VAL) - #define PIN_OFF_OUTPUT_LOW (OFF_EN | OFFOUT_EN) --#define PIN_OFF_INPUT_PULLUP (OFF_EN | OFF_PULL_EN | OFF_PULL_UP) --#define PIN_OFF_INPUT_PULLDOWN (OFF_EN | OFF_PULL_EN) -+#define PIN_OFF_INPUT_PULLUP (OFF_EN | OFFOUT_EN | OFF_PULL_EN | OFF_PULL_UP) -+#define PIN_OFF_INPUT_PULLDOWN (OFF_EN | OFFOUT_EN | OFF_PULL_EN) - #define PIN_OFF_WAKEUPENABLE WAKEUP_EN - - /* -diff --git a/include/linux/pfn.h b/include/linux/pfn.h -index 7646637221f3..97f3e88aead4 100644 ---- a/include/linux/pfn.h -+++ b/include/linux/pfn.h -@@ -9,5 +9,6 @@ - #define PFN_UP(x) (((x) + PAGE_SIZE-1) >> PAGE_SHIFT) - #define PFN_DOWN(x) ((x) >> PAGE_SHIFT) - #define PFN_PHYS(x) ((phys_addr_t)(x) << PAGE_SHIFT) -+#define PHYS_PFN(x) ((unsigned long)((x) >> PAGE_SHIFT)) - - #endif -diff --git a/include/uapi/linux/rds.h b/include/uapi/linux/rds.h -index 7af20a136429..804c9b2bfce3 100644 ---- a/include/uapi/linux/rds.h -+++ b/include/uapi/linux/rds.h -@@ -104,8 +104,8 @@ - #define RDS_INFO_LAST 10010 - - struct rds_info_counter { -- uint8_t name[32]; -- uint64_t value; -+ __u8 name[32]; -+ __u64 value; - } __attribute__((packed)); - - #define RDS_INFO_CONNECTION_FLAG_SENDING 0x01 -@@ -115,35 +115,35 @@ struct rds_info_counter { - #define TRANSNAMSIZ 16 - - struct rds_info_connection { -- uint64_t next_tx_seq; -- uint64_t next_rx_seq; -+ __u64 next_tx_seq; -+ __u64 next_rx_seq; - __be32 laddr; - __be32 faddr; -- uint8_t transport[TRANSNAMSIZ]; /* null term ascii */ -- uint8_t flags; -+ __u8 transport[TRANSNAMSIZ]; /* null term ascii */ -+ __u8 flags; - } __attribute__((packed)); - - #define RDS_INFO_MESSAGE_FLAG_ACK 0x01 - #define RDS_INFO_MESSAGE_FLAG_FAST_ACK 0x02 - - struct rds_info_message { -- uint64_t seq; -- uint32_t len; -+ __u64 seq; -+ __u32 len; - __be32 laddr; - __be32 faddr; - __be16 lport; - __be16 fport; -- uint8_t flags; -+ __u8 flags; - } __attribute__((packed)); - - struct rds_info_socket { -- uint32_t sndbuf; -+ __u32 sndbuf; - __be32 bound_addr; - __be32 connected_addr; - __be16 bound_port; - __be16 connected_port; -- uint32_t rcvbuf; -- uint64_t inum; -+ __u32 rcvbuf; -+ __u64 inum; - } __attribute__((packed)); - - struct rds_info_tcp_socket { -@@ -151,25 +151,25 @@ struct rds_info_tcp_socket { - __be16 local_port; - __be32 peer_addr; - __be16 peer_port; -- uint64_t hdr_rem; -- uint64_t data_rem; -- uint32_t last_sent_nxt; -- uint32_t last_expected_una; -- uint32_t last_seen_una; -+ __u64 hdr_rem; -+ __u64 data_rem; -+ __u32 last_sent_nxt; -+ __u32 last_expected_una; -+ __u32 last_seen_una; - } __attribute__((packed)); - - #define RDS_IB_GID_LEN 16 - struct rds_info_rdma_connection { - __be32 src_addr; - __be32 dst_addr; -- uint8_t src_gid[RDS_IB_GID_LEN]; -- uint8_t dst_gid[RDS_IB_GID_LEN]; -+ __u8 src_gid[RDS_IB_GID_LEN]; -+ __u8 dst_gid[RDS_IB_GID_LEN]; - -- uint32_t max_send_wr; -- uint32_t max_recv_wr; -- uint32_t max_send_sge; -- uint32_t rdma_mr_max; -- uint32_t rdma_mr_size; -+ __u32 max_send_wr; -+ __u32 max_recv_wr; -+ __u32 max_send_sge; -+ __u32 rdma_mr_max; -+ __u32 rdma_mr_size; - }; - - /* -@@ -210,70 +210,70 @@ struct rds_info_rdma_connection { - * (so that the application does not have to worry about - * alignment). - */ --typedef uint64_t rds_rdma_cookie_t; -+typedef __u64 rds_rdma_cookie_t; - - struct rds_iovec { -- uint64_t addr; -- uint64_t bytes; -+ __u64 addr; -+ __u64 bytes; - }; - - struct rds_get_mr_args { - struct rds_iovec vec; -- uint64_t cookie_addr; -- uint64_t flags; -+ __u64 cookie_addr; -+ __u64 flags; - }; - - struct rds_get_mr_for_dest_args { - struct __kernel_sockaddr_storage dest_addr; - struct rds_iovec vec; -- uint64_t cookie_addr; -- uint64_t flags; -+ __u64 cookie_addr; -+ __u64 flags; - }; - - struct rds_free_mr_args { - rds_rdma_cookie_t cookie; -- uint64_t flags; -+ __u64 flags; - }; - - struct rds_rdma_args { - rds_rdma_cookie_t cookie; - struct rds_iovec remote_vec; -- uint64_t local_vec_addr; -- uint64_t nr_local; -- uint64_t flags; -- uint64_t user_token; -+ __u64 local_vec_addr; -+ __u64 nr_local; -+ __u64 flags; -+ __u64 user_token; - }; - - struct rds_atomic_args { - rds_rdma_cookie_t cookie; -- uint64_t local_addr; -- uint64_t remote_addr; -+ __u64 local_addr; -+ __u64 remote_addr; - union { - struct { -- uint64_t compare; -- uint64_t swap; -+ __u64 compare; -+ __u64 swap; - } cswp; - struct { -- uint64_t add; -+ __u64 add; - } fadd; - struct { -- uint64_t compare; -- uint64_t swap; -- uint64_t compare_mask; -- uint64_t swap_mask; -+ __u64 compare; -+ __u64 swap; -+ __u64 compare_mask; -+ __u64 swap_mask; - } m_cswp; - struct { -- uint64_t add; -- uint64_t nocarry_mask; -+ __u64 add; -+ __u64 nocarry_mask; - } m_fadd; - }; -- uint64_t flags; -- uint64_t user_token; -+ __u64 flags; -+ __u64 user_token; - }; - - struct rds_rdma_notify { -- uint64_t user_token; -- int32_t status; -+ __u64 user_token; -+ __s32 status; - }; - - #define RDS_RDMA_SUCCESS 0 -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 70dc6dcf8649..eb759f5008b8 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -313,7 +313,8 @@ static const char *const bpf_jmp_string[16] = { - [BPF_EXIT >> 4] = "exit", - }; - --static void print_bpf_insn(struct bpf_insn *insn) -+static void print_bpf_insn(const struct verifier_env *env, -+ const struct bpf_insn *insn) - { - u8 class = BPF_CLASS(insn->code); - -@@ -377,9 +378,19 @@ static void print_bpf_insn(struct bpf_insn *insn) - insn->code, - bpf_ldst_string[BPF_SIZE(insn->code) >> 3], - insn->src_reg, insn->imm); -- } else if (BPF_MODE(insn->code) == BPF_IMM) { -- verbose("(%02x) r%d = 0x%x\n", -- insn->code, insn->dst_reg, insn->imm); -+ } else if (BPF_MODE(insn->code) == BPF_IMM && -+ BPF_SIZE(insn->code) == BPF_DW) { -+ /* At this point, we already made sure that the second -+ * part of the ldimm64 insn is accessible. -+ */ -+ u64 imm = ((u64)(insn + 1)->imm << 32) | (u32)insn->imm; -+ bool map_ptr = insn->src_reg == BPF_PSEUDO_MAP_FD; -+ -+ if (map_ptr && !env->allow_ptr_leaks) -+ imm = 0; -+ -+ verbose("(%02x) r%d = 0x%llx\n", insn->code, -+ insn->dst_reg, (unsigned long long)imm); - } else { - verbose("BUG_ld_%02x\n", insn->code); - return; -@@ -1764,7 +1775,7 @@ static int do_check(struct verifier_env *env) - - if (log_level) { - verbose("%d: ", insn_idx); -- print_bpf_insn(insn); -+ print_bpf_insn(env, insn); - } - - if (class == BPF_ALU || class == BPF_ALU64) { -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 73eec73ff733..7f0f689b8d2b 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4453,6 +4453,10 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - struct socket *sock; - int err = 0; - -+ /* Do not peel off from one netns to another one. */ -+ if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) -+ return -EINVAL; -+ - if (!asoc) - return -EINVAL; - -diff --git a/sound/drivers/vx/vx_pcm.c b/sound/drivers/vx/vx_pcm.c -index 11467272089e..ea7b377f0378 100644 ---- a/sound/drivers/vx/vx_pcm.c -+++ b/sound/drivers/vx/vx_pcm.c -@@ -1015,7 +1015,7 @@ static void vx_pcm_capture_update(struct vx_core *chip, struct snd_pcm_substream - int size, space, count; - struct snd_pcm_runtime *runtime = subs->runtime; - -- if (! pipe->prepared || (chip->chip_status & VX_STAT_IS_STALE)) -+ if (!pipe->running || (chip->chip_status & VX_STAT_IS_STALE)) - return; - - size = runtime->buffer_size - snd_pcm_capture_avail(runtime); -@@ -1048,8 +1048,10 @@ static void vx_pcm_capture_update(struct vx_core *chip, struct snd_pcm_substream - /* ok, let's accelerate! */ - int align = pipe->align * 3; - space = (count / align) * align; -- vx_pseudo_dma_read(chip, runtime, pipe, space); -- count -= space; -+ if (space > 0) { -+ vx_pseudo_dma_read(chip, runtime, pipe, space); -+ count -= space; -+ } - } - /* read the rest of bytes */ - while (count > 0) { -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index a83688f8672e..af0962307b7f 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -338,6 +338,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec) - case 0x10ec0288: - case 0x10ec0295: - case 0x10ec0298: -+ case 0x10ec0299: - alc_update_coef_idx(codec, 0x10, 1<<9, 0); - break; - case 0x10ec0285: -@@ -914,6 +915,7 @@ static struct alc_codec_rename_pci_table rename_pci_tbl[] = { - { 0x10ec0256, 0x1028, 0, "ALC3246" }, - { 0x10ec0225, 0x1028, 0, "ALC3253" }, - { 0x10ec0295, 0x1028, 0, "ALC3254" }, -+ { 0x10ec0299, 0x1028, 0, "ALC3271" }, - { 0x10ec0670, 0x1025, 0, "ALC669X" }, - { 0x10ec0676, 0x1025, 0, "ALC679X" }, - { 0x10ec0282, 0x1043, 0, "ALC3229" }, -@@ -3721,6 +3723,7 @@ static void alc_headset_mode_unplugged(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_process_coef_fw(codec, coef0225); - break; - } -@@ -3823,6 +3826,7 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin, - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_update_coef_idx(codec, 0x45, 0x3f<<10, 0x31<<10); - snd_hda_set_pin_ctl_cache(codec, hp_pin, 0); - alc_process_coef_fw(codec, coef0225); -@@ -3881,6 +3885,7 @@ static void alc_headset_mode_default(struct hda_codec *codec) - switch (codec->core.vendor_id) { - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_process_coef_fw(codec, coef0225); - break; - case 0x10ec0236: -@@ -3995,6 +4000,7 @@ static void alc_headset_mode_ctia(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_process_coef_fw(codec, coef0225); - break; - } -@@ -4086,6 +4092,7 @@ static void alc_headset_mode_omtp(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_process_coef_fw(codec, coef0225); - break; - } -@@ -4171,6 +4178,7 @@ static void alc_determine_headset_type(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - alc_process_coef_fw(codec, coef0225); - msleep(800); - val = alc_read_coef_idx(codec, 0x46); -@@ -6233,6 +6241,7 @@ static int patch_alc269(struct hda_codec *codec) - break; - case 0x10ec0225: - case 0x10ec0295: -+ case 0x10ec0299: - spec->codec_variant = ALC269_TYPE_ALC225; - break; - case 0x10ec0234: -@@ -7191,6 +7200,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = { - HDA_CODEC_ENTRY(0x10ec0294, "ALC294", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0295, "ALC295", patch_alc269), - HDA_CODEC_ENTRY(0x10ec0298, "ALC298", patch_alc269), -+ HDA_CODEC_ENTRY(0x10ec0299, "ALC299", patch_alc269), - HDA_CODEC_REV_ENTRY(0x10ec0861, 0x100340, "ALC660", patch_alc861), - HDA_CODEC_ENTRY(0x10ec0660, "ALC660-VD", patch_alc861vd), - HDA_CODEC_ENTRY(0x10ec0861, "ALC861", patch_alc861), -diff --git a/sound/pci/vx222/vx222_ops.c b/sound/pci/vx222/vx222_ops.c -index af83b3b38052..8e457ea27f89 100644 ---- a/sound/pci/vx222/vx222_ops.c -+++ b/sound/pci/vx222/vx222_ops.c -@@ -269,12 +269,12 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, - - /* Transfer using pseudo-dma. - */ -- if (offset + count > pipe->buffer_bytes) { -+ if (offset + count >= pipe->buffer_bytes) { - int length = pipe->buffer_bytes - offset; - count -= length; - length >>= 2; /* in 32bit words */ - /* Transfer using pseudo-dma. */ -- while (length-- > 0) { -+ for (; length > 0; length--) { - outl(cpu_to_le32(*addr), port); - addr++; - } -@@ -284,7 +284,7 @@ static void vx2_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, - pipe->hw_ptr += count; - count >>= 2; /* in 32bit words */ - /* Transfer using pseudo-dma. */ -- while (count-- > 0) { -+ for (; count > 0; count--) { - outl(cpu_to_le32(*addr), port); - addr++; - } -@@ -307,12 +307,12 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, - vx2_setup_pseudo_dma(chip, 0); - /* Transfer using pseudo-dma. - */ -- if (offset + count > pipe->buffer_bytes) { -+ if (offset + count >= pipe->buffer_bytes) { - int length = pipe->buffer_bytes - offset; - count -= length; - length >>= 2; /* in 32bit words */ - /* Transfer using pseudo-dma. */ -- while (length-- > 0) -+ for (; length > 0; length--) - *addr++ = le32_to_cpu(inl(port)); - addr = (u32 *)runtime->dma_area; - pipe->hw_ptr = 0; -@@ -320,7 +320,7 @@ static void vx2_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, - pipe->hw_ptr += count; - count >>= 2; /* in 32bit words */ - /* Transfer using pseudo-dma. */ -- while (count-- > 0) -+ for (; count > 0; count--) - *addr++ = le32_to_cpu(inl(port)); - - vx2_release_pseudo_dma(chip); -diff --git a/sound/pcmcia/vx/vxp_ops.c b/sound/pcmcia/vx/vxp_ops.c -index 281972913c32..56aa1ba73ccc 100644 ---- a/sound/pcmcia/vx/vxp_ops.c -+++ b/sound/pcmcia/vx/vxp_ops.c -@@ -369,12 +369,12 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, - unsigned short *addr = (unsigned short *)(runtime->dma_area + offset); - - vx_setup_pseudo_dma(chip, 1); -- if (offset + count > pipe->buffer_bytes) { -+ if (offset + count >= pipe->buffer_bytes) { - int length = pipe->buffer_bytes - offset; - count -= length; - length >>= 1; /* in 16bit words */ - /* Transfer using pseudo-dma. */ -- while (length-- > 0) { -+ for (; length > 0; length--) { - outw(cpu_to_le16(*addr), port); - addr++; - } -@@ -384,7 +384,7 @@ static void vxp_dma_write(struct vx_core *chip, struct snd_pcm_runtime *runtime, - pipe->hw_ptr += count; - count >>= 1; /* in 16bit words */ - /* Transfer using pseudo-dma. */ -- while (count-- > 0) { -+ for (; count > 0; count--) { - outw(cpu_to_le16(*addr), port); - addr++; - } -@@ -411,12 +411,12 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, - if (snd_BUG_ON(count % 2)) - return; - vx_setup_pseudo_dma(chip, 0); -- if (offset + count > pipe->buffer_bytes) { -+ if (offset + count >= pipe->buffer_bytes) { - int length = pipe->buffer_bytes - offset; - count -= length; - length >>= 1; /* in 16bit words */ - /* Transfer using pseudo-dma. */ -- while (length-- > 0) -+ for (; length > 0; length--) - *addr++ = le16_to_cpu(inw(port)); - addr = (unsigned short *)runtime->dma_area; - pipe->hw_ptr = 0; -@@ -424,7 +424,7 @@ static void vxp_dma_read(struct vx_core *chip, struct snd_pcm_runtime *runtime, - pipe->hw_ptr += count; - count >>= 1; /* in 16bit words */ - /* Transfer using pseudo-dma. */ -- while (count-- > 1) -+ for (; count > 1; count--) - *addr++ = le16_to_cpu(inw(port)); - /* Disable DMA */ - pchip->regDIALOG &= ~VXP_DLG_DMAREAD_SEL_MASK; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.100-101.patch b/patch/kernel/mvebu64-default/04-patch-4.4.100-101.patch deleted file mode 100644 index 2fa1df057793..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.100-101.patch +++ /dev/null @@ -1,718 +0,0 @@ -diff --git a/Makefile b/Makefile -index 91dd7832f499..0d7b050427ed 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 100 -+SUBLEVEL = 101 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/kernel/traps.c b/arch/arm64/kernel/traps.c -index 210826d5bba5..9119722eb347 100644 ---- a/arch/arm64/kernel/traps.c -+++ b/arch/arm64/kernel/traps.c -@@ -64,8 +64,7 @@ static void dump_mem(const char *lvl, const char *str, unsigned long bottom, - - /* - * We need to switch to kernel mode so that we can use __get_user -- * to safely read from kernel space. Note that we now dump the -- * code first, just in case the backtrace kills us. -+ * to safely read from kernel space. - */ - fs = get_fs(); - set_fs(KERNEL_DS); -@@ -111,21 +110,12 @@ static void dump_backtrace_entry(unsigned long where) - print_ip_sym(where); - } - --static void dump_instr(const char *lvl, struct pt_regs *regs) -+static void __dump_instr(const char *lvl, struct pt_regs *regs) - { - unsigned long addr = instruction_pointer(regs); -- mm_segment_t fs; - char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str; - int i; - -- /* -- * We need to switch to kernel mode so that we can use __get_user -- * to safely read from kernel space. Note that we now dump the -- * code first, just in case the backtrace kills us. -- */ -- fs = get_fs(); -- set_fs(KERNEL_DS); -- - for (i = -4; i < 1; i++) { - unsigned int val, bad; - -@@ -139,8 +129,18 @@ static void dump_instr(const char *lvl, struct pt_regs *regs) - } - } - printk("%sCode: %s\n", lvl, str); -+} - -- set_fs(fs); -+static void dump_instr(const char *lvl, struct pt_regs *regs) -+{ -+ if (!user_mode(regs)) { -+ mm_segment_t fs = get_fs(); -+ set_fs(KERNEL_DS); -+ __dump_instr(lvl, regs); -+ set_fs(fs); -+ } else { -+ __dump_instr(lvl, regs); -+ } - } - - static void dump_backtrace(struct pt_regs *regs, struct task_struct *tsk) -diff --git a/drivers/char/ipmi/ipmi_msghandler.c b/drivers/char/ipmi/ipmi_msghandler.c -index 25372dc381d4..5cb5e8ff0224 100644 ---- a/drivers/char/ipmi/ipmi_msghandler.c -+++ b/drivers/char/ipmi/ipmi_msghandler.c -@@ -4029,7 +4029,8 @@ smi_from_recv_msg(ipmi_smi_t intf, struct ipmi_recv_msg *recv_msg, - } - - static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent, -- struct list_head *timeouts, long timeout_period, -+ struct list_head *timeouts, -+ unsigned long timeout_period, - int slot, unsigned long *flags, - unsigned int *waiting_msgs) - { -@@ -4042,8 +4043,8 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent, - if (!ent->inuse) - return; - -- ent->timeout -= timeout_period; -- if (ent->timeout > 0) { -+ if (timeout_period < ent->timeout) { -+ ent->timeout -= timeout_period; - (*waiting_msgs)++; - return; - } -@@ -4109,7 +4110,8 @@ static void check_msg_timeout(ipmi_smi_t intf, struct seq_table *ent, - } - } - --static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, long timeout_period) -+static unsigned int ipmi_timeout_handler(ipmi_smi_t intf, -+ unsigned long timeout_period) - { - struct list_head timeouts; - struct ipmi_recv_msg *msg, *msg2; -diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c -index 5dca77e0ffed..2cb34b0f3856 100644 ---- a/drivers/net/bonding/bond_main.c -+++ b/drivers/net/bonding/bond_main.c -@@ -3166,7 +3166,7 @@ u32 bond_xmit_hash(struct bonding *bond, struct sk_buff *skb) - hash ^= (hash >> 16); - hash ^= (hash >> 8); - -- return hash; -+ return hash >> 1; - } - - /*-------------------------- Device entry points ----------------------------*/ -diff --git a/drivers/net/ethernet/fealnx.c b/drivers/net/ethernet/fealnx.c -index b1b9ebafb354..a3b2e23921bf 100644 ---- a/drivers/net/ethernet/fealnx.c -+++ b/drivers/net/ethernet/fealnx.c -@@ -257,8 +257,8 @@ enum rx_desc_status_bits { - RXFSD = 0x00000800, /* first descriptor */ - RXLSD = 0x00000400, /* last descriptor */ - ErrorSummary = 0x80, /* error summary */ -- RUNT = 0x40, /* runt packet received */ -- LONG = 0x20, /* long packet received */ -+ RUNTPKT = 0x40, /* runt packet received */ -+ LONGPKT = 0x20, /* long packet received */ - FAE = 0x10, /* frame align error */ - CRC = 0x08, /* crc error */ - RXER = 0x04, /* receive error */ -@@ -1633,7 +1633,7 @@ static int netdev_rx(struct net_device *dev) - dev->name, rx_status); - - dev->stats.rx_errors++; /* end of a packet. */ -- if (rx_status & (LONG | RUNT)) -+ if (rx_status & (LONGPKT | RUNTPKT)) - dev->stats.rx_length_errors++; - if (rx_status & RXER) - dev->stats.rx_frame_errors++; -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index 669edbd47602..d6ceb8b91cd6 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -350,8 +350,8 @@ static void async_completion(struct nvme_queue *nvmeq, void *ctx, - struct async_cmd_info *cmdinfo = ctx; - cmdinfo->result = le32_to_cpup(&cqe->result); - cmdinfo->status = le16_to_cpup(&cqe->status) >> 1; -- queue_kthread_work(cmdinfo->worker, &cmdinfo->work); - blk_mq_free_request(cmdinfo->req); -+ queue_kthread_work(cmdinfo->worker, &cmdinfo->work); - } - - static inline struct nvme_cmd_info *get_cmd_from_tag(struct nvme_queue *nvmeq, -diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c -index de1c143b475f..21fc9b3a27cf 100644 ---- a/drivers/tty/serial/omap-serial.c -+++ b/drivers/tty/serial/omap-serial.c -@@ -693,7 +693,7 @@ static void serial_omap_set_mctrl(struct uart_port *port, unsigned int mctrl) - if ((mctrl & TIOCM_RTS) && (port->status & UPSTAT_AUTORTS)) - up->efr |= UART_EFR_RTS; - else -- up->efr &= UART_EFR_RTS; -+ up->efr &= ~UART_EFR_RTS; - serial_out(up, UART_EFR, up->efr); - serial_out(up, UART_LCR, lcr); - -diff --git a/fs/coda/upcall.c b/fs/coda/upcall.c -index f6c6c8adbc01..7289f0a7670b 100644 ---- a/fs/coda/upcall.c -+++ b/fs/coda/upcall.c -@@ -446,8 +446,7 @@ int venus_fsync(struct super_block *sb, struct CodaFid *fid) - UPARG(CODA_FSYNC); - - inp->coda_fsync.VFid = *fid; -- error = coda_upcall(coda_vcp(sb), sizeof(union inputArgs), -- &outsize, inp); -+ error = coda_upcall(coda_vcp(sb), insize, &outsize, inp); - - CODA_FREE(inp, insize); - return error; -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 1d738723a41a..501ecc4a1ac4 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -1166,6 +1166,13 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) - } - size_change = S_ISREG(inode->i_mode) && attr->ia_valid & ATTR_SIZE; - if (size_change) { -+ /* -+ * Here we should wait dio to finish before inode lock -+ * to avoid a deadlock between ocfs2_setattr() and -+ * ocfs2_dio_end_io_write() -+ */ -+ inode_dio_wait(inode); -+ - status = ocfs2_rw_lock(inode, 1); - if (status < 0) { - mlog_errno(status); -@@ -1186,8 +1193,6 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) - if (status) - goto bail_unlock; - -- inode_dio_wait(inode); -- - if (i_size_read(inode) >= attr->ia_size) { - if (ocfs2_should_order_data(inode)) { - status = ocfs2_begin_ordered_truncate(inode, -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index 5b609a3ce3d7..ff88d6189411 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -688,7 +688,8 @@ typedef struct pglist_data { - * is the first PFN that needs to be initialised. - */ - unsigned long first_deferred_pfn; -- unsigned long static_init_size; -+ /* Number of non-deferred pages */ -+ unsigned long static_init_pgcnt; - #endif /* CONFIG_DEFERRED_STRUCT_PAGE_INIT */ - } pg_data_t; - -diff --git a/include/linux/page_idle.h b/include/linux/page_idle.h -index bf268fa92c5b..fec40271339f 100644 ---- a/include/linux/page_idle.h -+++ b/include/linux/page_idle.h -@@ -46,33 +46,62 @@ extern struct page_ext_operations page_idle_ops; - - static inline bool page_is_young(struct page *page) - { -- return test_bit(PAGE_EXT_YOUNG, &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return false; -+ -+ return test_bit(PAGE_EXT_YOUNG, &page_ext->flags); - } - - static inline void set_page_young(struct page *page) - { -- set_bit(PAGE_EXT_YOUNG, &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return; -+ -+ set_bit(PAGE_EXT_YOUNG, &page_ext->flags); - } - - static inline bool test_and_clear_page_young(struct page *page) - { -- return test_and_clear_bit(PAGE_EXT_YOUNG, -- &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return false; -+ -+ return test_and_clear_bit(PAGE_EXT_YOUNG, &page_ext->flags); - } - - static inline bool page_is_idle(struct page *page) - { -- return test_bit(PAGE_EXT_IDLE, &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return false; -+ -+ return test_bit(PAGE_EXT_IDLE, &page_ext->flags); - } - - static inline void set_page_idle(struct page *page) - { -- set_bit(PAGE_EXT_IDLE, &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return; -+ -+ set_bit(PAGE_EXT_IDLE, &page_ext->flags); - } - - static inline void clear_page_idle(struct page *page) - { -- clear_bit(PAGE_EXT_IDLE, &lookup_page_ext(page)->flags); -+ struct page_ext *page_ext = lookup_page_ext(page); -+ -+ if (unlikely(!page_ext)) -+ return; -+ -+ clear_bit(PAGE_EXT_IDLE, &page_ext->flags); - } - #endif /* CONFIG_64BIT */ - -diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h -index 3f61c647fc5c..b5421f6f155a 100644 ---- a/include/linux/skbuff.h -+++ b/include/linux/skbuff.h -@@ -3400,6 +3400,13 @@ static inline void nf_reset_trace(struct sk_buff *skb) - #endif - } - -+static inline void ipvs_reset(struct sk_buff *skb) -+{ -+#if IS_ENABLED(CONFIG_IP_VS) -+ skb->ipvs_property = 0; -+#endif -+} -+ - /* Note: This doesn't put any conntrack and bridge info in dst. */ - static inline void __nf_copy(struct sk_buff *dst, const struct sk_buff *src, - bool copy) -diff --git a/mm/debug-pagealloc.c b/mm/debug-pagealloc.c -index 5bf5906ce13b..fe1c61f7cf26 100644 ---- a/mm/debug-pagealloc.c -+++ b/mm/debug-pagealloc.c -@@ -34,6 +34,8 @@ static inline void set_page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -+ if (page_ext) -+ return; - __set_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } - -@@ -42,6 +44,8 @@ static inline void clear_page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -+ if (page_ext) -+ return; - __clear_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } - -@@ -50,6 +54,8 @@ static inline bool page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -+ if (page_ext) -+ return false; - return test_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } - -diff --git a/mm/page_alloc.c b/mm/page_alloc.c -index 6b5421ae86c6..3c70f03d91ec 100644 ---- a/mm/page_alloc.c -+++ b/mm/page_alloc.c -@@ -267,28 +267,37 @@ EXPORT_SYMBOL(nr_online_nodes); - int page_group_by_mobility_disabled __read_mostly; - - #ifdef CONFIG_DEFERRED_STRUCT_PAGE_INIT -+ -+/* -+ * Determine how many pages need to be initialized durig early boot -+ * (non-deferred initialization). -+ * The value of first_deferred_pfn will be set later, once non-deferred pages -+ * are initialized, but for now set it ULONG_MAX. -+ */ - static inline void reset_deferred_meminit(pg_data_t *pgdat) - { -- unsigned long max_initialise; -- unsigned long reserved_lowmem; -+ phys_addr_t start_addr, end_addr; -+ unsigned long max_pgcnt; -+ unsigned long reserved; - - /* - * Initialise at least 2G of a node but also take into account that - * two large system hashes that can take up 1GB for 0.25TB/node. - */ -- max_initialise = max(2UL << (30 - PAGE_SHIFT), -- (pgdat->node_spanned_pages >> 8)); -+ max_pgcnt = max(2UL << (30 - PAGE_SHIFT), -+ (pgdat->node_spanned_pages >> 8)); - - /* - * Compensate the all the memblock reservations (e.g. crash kernel) - * from the initial estimation to make sure we will initialize enough - * memory to boot. - */ -- reserved_lowmem = memblock_reserved_memory_within(pgdat->node_start_pfn, -- pgdat->node_start_pfn + max_initialise); -- max_initialise += reserved_lowmem; -+ start_addr = PFN_PHYS(pgdat->node_start_pfn); -+ end_addr = PFN_PHYS(pgdat->node_start_pfn + max_pgcnt); -+ reserved = memblock_reserved_memory_within(start_addr, end_addr); -+ max_pgcnt += PHYS_PFN(reserved); - -- pgdat->static_init_size = min(max_initialise, pgdat->node_spanned_pages); -+ pgdat->static_init_pgcnt = min(max_pgcnt, pgdat->node_spanned_pages); - pgdat->first_deferred_pfn = ULONG_MAX; - } - -@@ -324,7 +333,7 @@ static inline bool update_defer_init(pg_data_t *pgdat, - return true; - /* Initialise at least 2G of the highest zone */ - (*nr_initialised)++; -- if ((*nr_initialised > pgdat->static_init_size) && -+ if ((*nr_initialised > pgdat->static_init_pgcnt) && - (pfn & (PAGES_PER_SECTION - 1)) == 0) { - pgdat->first_deferred_pfn = pfn; - return false; -@@ -560,6 +569,9 @@ static inline void set_page_guard(struct zone *zone, struct page *page, - return; - - page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ return; -+ - __set_bit(PAGE_EXT_DEBUG_GUARD, &page_ext->flags); - - INIT_LIST_HEAD(&page->lru); -@@ -577,6 +589,9 @@ static inline void clear_page_guard(struct zone *zone, struct page *page, - return; - - page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ return; -+ - __clear_bit(PAGE_EXT_DEBUG_GUARD, &page_ext->flags); - - set_page_private(page, 0); -diff --git a/mm/page_ext.c b/mm/page_ext.c -index 292ca7b8debd..4d1eac0d4fc5 100644 ---- a/mm/page_ext.c -+++ b/mm/page_ext.c -@@ -106,7 +106,6 @@ struct page_ext *lookup_page_ext(struct page *page) - struct page_ext *base; - - base = NODE_DATA(page_to_nid(page))->node_page_ext; --#ifdef CONFIG_DEBUG_VM - /* - * The sanity checks the page allocator does upon freeing a - * page can reach here before the page_ext arrays are -@@ -115,7 +114,6 @@ struct page_ext *lookup_page_ext(struct page *page) - */ - if (unlikely(!base)) - return NULL; --#endif - offset = pfn - round_down(node_start_pfn(page_to_nid(page)), - MAX_ORDER_NR_PAGES); - return base + offset; -@@ -180,7 +178,6 @@ struct page_ext *lookup_page_ext(struct page *page) - { - unsigned long pfn = page_to_pfn(page); - struct mem_section *section = __pfn_to_section(pfn); --#ifdef CONFIG_DEBUG_VM - /* - * The sanity checks the page allocator does upon freeing a - * page can reach here before the page_ext arrays are -@@ -189,7 +186,6 @@ struct page_ext *lookup_page_ext(struct page *page) - */ - if (!section->page_ext) - return NULL; --#endif - return section->page_ext + pfn; - } - -diff --git a/mm/page_owner.c b/mm/page_owner.c -index 983c3a10fa07..dd6b9cebf981 100644 ---- a/mm/page_owner.c -+++ b/mm/page_owner.c -@@ -53,6 +53,8 @@ void __reset_page_owner(struct page *page, unsigned int order) - - for (i = 0; i < (1 << order); i++) { - page_ext = lookup_page_ext(page + i); -+ if (unlikely(!page_ext)) -+ continue; - __clear_bit(PAGE_EXT_OWNER, &page_ext->flags); - } - } -@@ -60,6 +62,7 @@ void __reset_page_owner(struct page *page, unsigned int order) - void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask) - { - struct page_ext *page_ext = lookup_page_ext(page); -+ - struct stack_trace trace = { - .nr_entries = 0, - .max_entries = ARRAY_SIZE(page_ext->trace_entries), -@@ -67,6 +70,9 @@ void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask) - .skip = 3, - }; - -+ if (unlikely(!page_ext)) -+ return; -+ - save_stack_trace(&trace); - - page_ext->order = order; -@@ -79,6 +85,12 @@ void __set_page_owner(struct page *page, unsigned int order, gfp_t gfp_mask) - gfp_t __get_page_owner_gfp(struct page *page) - { - struct page_ext *page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ /* -+ * The caller just returns 0 if no valid gfp -+ * So return 0 here too. -+ */ -+ return 0; - - return page_ext->gfp_mask; - } -@@ -194,6 +206,8 @@ read_page_owner(struct file *file, char __user *buf, size_t count, loff_t *ppos) - } - - page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ continue; - - /* - * Some pages could be missed by concurrent allocation or free, -@@ -257,6 +271,8 @@ static void init_pages_in_zone(pg_data_t *pgdat, struct zone *zone) - continue; - - page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ continue; - - /* Maybe overraping zone */ - if (test_bit(PAGE_EXT_OWNER, &page_ext->flags)) -diff --git a/mm/pagewalk.c b/mm/pagewalk.c -index 29f2f8b853ae..c2cbd2620169 100644 ---- a/mm/pagewalk.c -+++ b/mm/pagewalk.c -@@ -142,8 +142,12 @@ static int walk_hugetlb_range(unsigned long addr, unsigned long end, - do { - next = hugetlb_entry_end(h, addr, end); - pte = huge_pte_offset(walk->mm, addr & hmask); -- if (pte && walk->hugetlb_entry) -+ -+ if (pte) - err = walk->hugetlb_entry(pte, hmask, addr, next, walk); -+ else if (walk->pte_hole) -+ err = walk->pte_hole(addr, next, walk); -+ - if (err) - break; - } while (addr = next, addr != end); -diff --git a/mm/vmstat.c b/mm/vmstat.c -index c54fd2924f25..c344e3609c53 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1091,6 +1091,8 @@ static void pagetypeinfo_showmixedcount_print(struct seq_file *m, - continue; - - page_ext = lookup_page_ext(page); -+ if (unlikely(!page_ext)) -+ continue; - - if (!test_bit(PAGE_EXT_OWNER, &page_ext->flags)) - continue; -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index 5e4199d5a388..01abb6431fd9 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -376,6 +376,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, - dev->name); - vlan_vid_add(dev, htons(ETH_P_8021Q), 0); - } -+ if (event == NETDEV_DOWN && -+ (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER)) -+ vlan_vid_del(dev, htons(ETH_P_8021Q), 0); - - vlan_info = rtnl_dereference(dev->vlan_info); - if (!vlan_info) -@@ -423,9 +426,6 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event, - struct net_device *tmp; - LIST_HEAD(close_list); - -- if (dev->features & NETIF_F_HW_VLAN_CTAG_FILTER) -- vlan_vid_del(dev, htons(ETH_P_8021Q), 0); -- - /* Put all VLANs for this dev in the down state too. */ - vlan_group_for_each_dev(grp, i, vlandev) { - flgs = vlandev->flags; -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index 73dfd7729bc9..d33609c2f276 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -4229,6 +4229,7 @@ void skb_scrub_packet(struct sk_buff *skb, bool xnet) - if (!xnet) - return; - -+ ipvs_reset(skb); - skb_orphan(skb); - skb->mark = 0; - } -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 64c7ce847584..39c2919fe0d3 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -3018,13 +3018,8 @@ struct sk_buff *tcp_make_synack(const struct sock *sk, struct dst_entry *dst, - tcp_ecn_make_synack(req, th); - th->source = htons(ireq->ir_num); - th->dest = ireq->ir_rmt_port; -- /* Setting of flags are superfluous here for callers (and ECE is -- * not even correctly set) -- */ -- tcp_init_nondata_skb(skb, tcp_rsk(req)->snt_isn, -- TCPHDR_SYN | TCPHDR_ACK); -- -- th->seq = htonl(TCP_SKB_CB(skb)->seq); -+ skb->ip_summed = CHECKSUM_PARTIAL; -+ th->seq = htonl(tcp_rsk(req)->snt_isn); - /* XXX data is queued and acked as is. No buffer/window check */ - th->ack_seq = htonl(tcp_rsk(req)->rcv_nxt); - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index acfb16fdcd55..9ecdd61c6463 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2077,7 +2077,7 @@ static int netlink_dump(struct sock *sk) - struct sk_buff *skb = NULL; - struct nlmsghdr *nlh; - struct module *module; -- int len, err = -ENOBUFS; -+ int err = -ENOBUFS; - int alloc_min_size; - int alloc_size; - -@@ -2125,9 +2125,11 @@ static int netlink_dump(struct sock *sk) - skb_reserve(skb, skb_tailroom(skb) - alloc_size); - netlink_skb_set_owner_r(skb, sk); - -- len = cb->dump(skb, cb); -+ if (nlk->dump_done_errno > 0) -+ nlk->dump_done_errno = cb->dump(skb, cb); - -- if (len > 0) { -+ if (nlk->dump_done_errno > 0 || -+ skb_tailroom(skb) < nlmsg_total_size(sizeof(nlk->dump_done_errno))) { - mutex_unlock(nlk->cb_mutex); - - if (sk_filter(sk, skb)) -@@ -2137,13 +2139,15 @@ static int netlink_dump(struct sock *sk) - return 0; - } - -- nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, sizeof(len), NLM_F_MULTI); -- if (!nlh) -+ nlh = nlmsg_put_answer(skb, cb, NLMSG_DONE, -+ sizeof(nlk->dump_done_errno), NLM_F_MULTI); -+ if (WARN_ON(!nlh)) - goto errout_skb; - - nl_dump_check_consistent(cb, nlh); - -- memcpy(nlmsg_data(nlh), &len, sizeof(len)); -+ memcpy(nlmsg_data(nlh), &nlk->dump_done_errno, -+ sizeof(nlk->dump_done_errno)); - - if (sk_filter(sk, skb)) - kfree_skb(skb); -@@ -2208,6 +2212,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, - cb->skb = skb; - - nlk->cb_running = true; -+ nlk->dump_done_errno = INT_MAX; - - mutex_unlock(nlk->cb_mutex); - -diff --git a/net/netlink/af_netlink.h b/net/netlink/af_netlink.h -index ea4600aea6b0..d987696c0eb4 100644 ---- a/net/netlink/af_netlink.h -+++ b/net/netlink/af_netlink.h -@@ -38,6 +38,7 @@ struct netlink_sock { - wait_queue_head_t wait; - bool bound; - bool cb_running; -+ int dump_done_errno; - struct netlink_callback cb; - struct mutex *cb_mutex; - struct mutex cb_def_mutex; -diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c -index e33e9bd4ed5a..8a61ccc37e12 100644 ---- a/net/sctp/ipv6.c -+++ b/net/sctp/ipv6.c -@@ -806,6 +806,8 @@ static void sctp_inet6_skb_msgname(struct sk_buff *skb, char *msgname, - if (ipv6_addr_type(&addr->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) { - struct sctp_ulpevent *ev = sctp_skb2event(skb); - addr->v6.sin6_scope_id = ev->iif; -+ } else { -+ addr->v6.sin6_scope_id = 0; - } - } - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 7f0f689b8d2b..272edd7748a0 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4453,6 +4453,10 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - struct socket *sock; - int err = 0; - -+ /* Do not peel off from one netns to another one. */ -+ if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) -+ return -EINVAL; -+ - /* Do not peel off from one netns to another one. */ - if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) - return -EINVAL; -diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c -index 9ce9d5003dcc..19014293f927 100644 ---- a/security/integrity/ima/ima_appraise.c -+++ b/security/integrity/ima/ima_appraise.c -@@ -297,6 +297,9 @@ void ima_update_xattr(struct integrity_iint_cache *iint, struct file *file) - if (iint->flags & IMA_DIGSIG) - return; - -+ if (iint->ima_file_status != INTEGRITY_PASS) -+ return; -+ - rc = ima_collect_measurement(iint, file, NULL, NULL); - if (rc < 0) - return; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.101-102.patch b/patch/kernel/mvebu64-default/04-patch-4.4.101-102.patch deleted file mode 100644 index 45e56d171875..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.101-102.patch +++ /dev/null @@ -1,43 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0d7b050427ed..9e036fac9c04 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 101 -+SUBLEVEL = 102 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/mm/debug-pagealloc.c b/mm/debug-pagealloc.c -index fe1c61f7cf26..3b8f1b83610e 100644 ---- a/mm/debug-pagealloc.c -+++ b/mm/debug-pagealloc.c -@@ -34,7 +34,7 @@ static inline void set_page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -- if (page_ext) -+ if (!page_ext) - return; - __set_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } -@@ -44,7 +44,7 @@ static inline void clear_page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -- if (page_ext) -+ if (!page_ext) - return; - __clear_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } -@@ -54,7 +54,7 @@ static inline bool page_poison(struct page *page) - struct page_ext *page_ext; - - page_ext = lookup_page_ext(page); -- if (page_ext) -+ if (!page_ext) - return false; - return test_bit(PAGE_EXT_DEBUG_POISON, &page_ext->flags); - } diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.102-103.patch b/patch/kernel/mvebu64-default/04-patch-4.4.102-103.patch deleted file mode 100644 index 447afae07a86..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.102-103.patch +++ /dev/null @@ -1,3056 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9e036fac9c04..f5a51cd7ca49 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 102 -+SUBLEVEL = 103 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mm/dump.c b/arch/arm/mm/dump.c -index 9fe8e241335c..e1f6f0daa847 100644 ---- a/arch/arm/mm/dump.c -+++ b/arch/arm/mm/dump.c -@@ -126,8 +126,8 @@ static const struct prot_bits section_bits[] = { - .val = PMD_SECT_USER, - .set = "USR", - }, { -- .mask = L_PMD_SECT_RDONLY, -- .val = L_PMD_SECT_RDONLY, -+ .mask = L_PMD_SECT_RDONLY | PMD_SECT_AP2, -+ .val = L_PMD_SECT_RDONLY | PMD_SECT_AP2, - .set = "ro", - .clear = "RW", - #elif __LINUX_ARM_ARCH__ >= 6 -diff --git a/arch/arm/mm/init.c b/arch/arm/mm/init.c -index 7f8cd1b3557f..c29ad610311b 100644 ---- a/arch/arm/mm/init.c -+++ b/arch/arm/mm/init.c -@@ -611,8 +611,8 @@ static struct section_perm ro_perms[] = { - .start = (unsigned long)_stext, - .end = (unsigned long)__init_begin, - #ifdef CONFIG_ARM_LPAE -- .mask = ~L_PMD_SECT_RDONLY, -- .prot = L_PMD_SECT_RDONLY, -+ .mask = ~(L_PMD_SECT_RDONLY | PMD_SECT_AP2), -+ .prot = L_PMD_SECT_RDONLY | PMD_SECT_AP2, - #else - .mask = ~(PMD_SECT_APX | PMD_SECT_AP_WRITE), - .prot = PMD_SECT_APX | PMD_SECT_AP_WRITE, -diff --git a/arch/mips/bcm47xx/leds.c b/arch/mips/bcm47xx/leds.c -index d20ae63eb3c2..46abe9e4e0e0 100644 ---- a/arch/mips/bcm47xx/leds.c -+++ b/arch/mips/bcm47xx/leds.c -@@ -330,7 +330,7 @@ bcm47xx_leds_linksys_wrt54g3gv2[] __initconst = { - /* Verified on: WRT54GS V1.0 */ - static const struct gpio_led - bcm47xx_leds_linksys_wrt54g_type_0101[] __initconst = { -- BCM47XX_GPIO_LED(0, "green", "wlan", 0, LEDS_GPIO_DEFSTATE_OFF), -+ BCM47XX_GPIO_LED(0, "green", "wlan", 1, LEDS_GPIO_DEFSTATE_OFF), - BCM47XX_GPIO_LED(1, "green", "power", 0, LEDS_GPIO_DEFSTATE_ON), - BCM47XX_GPIO_LED(7, "green", "dmz", 1, LEDS_GPIO_DEFSTATE_OFF), - }; -diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c -index 24c115a0721a..a3f38e6b7ea1 100644 ---- a/arch/mips/kernel/ptrace.c -+++ b/arch/mips/kernel/ptrace.c -@@ -650,6 +650,19 @@ static const struct user_regset_view user_mips64_view = { - .n = ARRAY_SIZE(mips64_regsets), - }; - -+#ifdef CONFIG_MIPS32_N32 -+ -+static const struct user_regset_view user_mipsn32_view = { -+ .name = "mipsn32", -+ .e_flags = EF_MIPS_ABI2, -+ .e_machine = ELF_ARCH, -+ .ei_osabi = ELF_OSABI, -+ .regsets = mips64_regsets, -+ .n = ARRAY_SIZE(mips64_regsets), -+}; -+ -+#endif /* CONFIG_MIPS32_N32 */ -+ - #endif /* CONFIG_64BIT */ - - const struct user_regset_view *task_user_regset_view(struct task_struct *task) -@@ -660,6 +673,10 @@ const struct user_regset_view *task_user_regset_view(struct task_struct *task) - #ifdef CONFIG_MIPS32_O32 - if (test_tsk_thread_flag(task, TIF_32BIT_REGS)) - return &user_mips_view; -+#endif -+#ifdef CONFIG_MIPS32_N32 -+ if (test_tsk_thread_flag(task, TIF_32BIT_ADDR)) -+ return &user_mipsn32_view; - #endif - return &user_mips64_view; - #endif -diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c -index 48d6349fd9d7..c5f45fc96c74 100644 ---- a/arch/mips/ralink/mt7620.c -+++ b/arch/mips/ralink/mt7620.c -@@ -141,8 +141,8 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = { - FUNC("i2c", 0, 4, 2), - }; - --static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) }; --static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) }; -+static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("refclk", 0, 37, 1) }; -+static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 36, 1) }; - static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) }; - static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) }; - -diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S -index c6b855f7892c..9f22195b90ed 100644 ---- a/arch/parisc/kernel/syscall.S -+++ b/arch/parisc/kernel/syscall.S -@@ -688,15 +688,15 @@ cas_action: - /* ELF32 Process entry path */ - lws_compare_and_swap_2: - #ifdef CONFIG_64BIT -- /* Clip the input registers */ -+ /* Clip the input registers. We don't need to clip %r23 as we -+ only use it for word operations */ - depdi 0, 31, 32, %r26 - depdi 0, 31, 32, %r25 - depdi 0, 31, 32, %r24 -- depdi 0, 31, 32, %r23 - #endif - - /* Check the validity of the size pointer */ -- subi,>>= 4, %r23, %r0 -+ subi,>>= 3, %r23, %r0 - b,n lws_exit_nosys - - /* Jump to the functions which will load the old and new values into -diff --git a/arch/powerpc/kernel/signal.c b/arch/powerpc/kernel/signal.c -index cf8c7e4e0b21..984a54c85952 100644 ---- a/arch/powerpc/kernel/signal.c -+++ b/arch/powerpc/kernel/signal.c -@@ -102,7 +102,7 @@ static void check_syscall_restart(struct pt_regs *regs, struct k_sigaction *ka, - static void do_signal(struct pt_regs *regs) - { - sigset_t *oldset = sigmask_to_save(); -- struct ksignal ksig; -+ struct ksignal ksig = { .sig = 0 }; - int ret; - int is32 = is_32bit_task(); - -diff --git a/arch/s390/include/asm/asm-prototypes.h b/arch/s390/include/asm/asm-prototypes.h -new file mode 100644 -index 000000000000..2c3413b0ca52 ---- /dev/null -+++ b/arch/s390/include/asm/asm-prototypes.h -@@ -0,0 +1,8 @@ -+#ifndef _ASM_S390_PROTOTYPES_H -+ -+#include -+#include -+#include -+#include -+ -+#endif /* _ASM_S390_PROTOTYPES_H */ -diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h -index 12d45f0cfdd9..dde6b52359c5 100644 ---- a/arch/s390/include/asm/switch_to.h -+++ b/arch/s390/include/asm/switch_to.h -@@ -34,8 +34,8 @@ static inline void restore_access_regs(unsigned int *acrs) - save_access_regs(&prev->thread.acrs[0]); \ - save_ri_cb(prev->thread.ri_cb); \ - } \ -+ update_cr_regs(next); \ - if (next->mm) { \ -- update_cr_regs(next); \ - set_cpu_flag(CIF_FPU); \ - restore_access_regs(&next->thread.acrs[0]); \ - restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb); \ -diff --git a/arch/s390/kernel/dis.c b/arch/s390/kernel/dis.c -index 6e72961608f0..07477ba392b7 100644 ---- a/arch/s390/kernel/dis.c -+++ b/arch/s390/kernel/dis.c -@@ -1549,6 +1549,7 @@ static struct s390_insn opcode_e7[] = { - { "vfsq", 0xce, INSTR_VRR_VV000MM }, - { "vfs", 0xe2, INSTR_VRR_VVV00MM }, - { "vftci", 0x4a, INSTR_VRI_VVIMM }, -+ { "", 0, INSTR_INVALID } - }; - - static struct s390_insn opcode_eb[] = { -@@ -1961,7 +1962,7 @@ void show_code(struct pt_regs *regs) - { - char *mode = user_mode(regs) ? "User" : "Krnl"; - unsigned char code[64]; -- char buffer[64], *ptr; -+ char buffer[128], *ptr; - mm_segment_t old_fs; - unsigned long addr; - int start, end, opsize, hops, i; -@@ -2024,7 +2025,7 @@ void show_code(struct pt_regs *regs) - start += opsize; - printk(buffer); - ptr = buffer; -- ptr += sprintf(ptr, "\n "); -+ ptr += sprintf(ptr, "\n\t "); - hops++; - } - printk("\n"); -diff --git a/arch/s390/kernel/early.c b/arch/s390/kernel/early.c -index 3c31609df959..ee7b8e7ca4f8 100644 ---- a/arch/s390/kernel/early.c -+++ b/arch/s390/kernel/early.c -@@ -325,8 +325,10 @@ static __init void detect_machine_facilities(void) - S390_lowcore.machine_flags |= MACHINE_FLAG_IDTE; - if (test_facility(40)) - S390_lowcore.machine_flags |= MACHINE_FLAG_LPP; -- if (test_facility(50) && test_facility(73)) -+ if (test_facility(50) && test_facility(73)) { - S390_lowcore.machine_flags |= MACHINE_FLAG_TE; -+ __ctl_set_bit(0, 55); -+ } - if (test_facility(51)) - S390_lowcore.machine_flags |= MACHINE_FLAG_TLB_LC; - if (test_facility(129)) { -diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c -index 114ee8b96f17..efa035a31b98 100644 ---- a/arch/s390/kernel/process.c -+++ b/arch/s390/kernel/process.c -@@ -137,6 +137,7 @@ int copy_thread(unsigned long clone_flags, unsigned long new_stackp, - memset(&p->thread.per_user, 0, sizeof(p->thread.per_user)); - memset(&p->thread.per_event, 0, sizeof(p->thread.per_event)); - clear_tsk_thread_flag(p, TIF_SINGLE_STEP); -+ p->thread.per_flags = 0; - /* Initialize per thread user and system timer values */ - ti = task_thread_info(p); - ti->user_timer = 0; -diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c -index fffa0e5462af..70cdb03d4acd 100644 ---- a/arch/s390/kernel/runtime_instr.c -+++ b/arch/s390/kernel/runtime_instr.c -@@ -47,11 +47,13 @@ void exit_thread_runtime_instr(void) - { - struct task_struct *task = current; - -+ preempt_disable(); - if (!task->thread.ri_cb) - return; - disable_runtime_instr(); - kfree(task->thread.ri_cb); - task->thread.ri_cb = NULL; -+ preempt_enable(); - } - - SYSCALL_DEFINE1(s390_runtime_instr, int, command) -@@ -62,9 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command) - return -EOPNOTSUPP; - - if (command == S390_RUNTIME_INSTR_STOP) { -- preempt_disable(); - exit_thread_runtime_instr(); -- preempt_enable(); - return 0; - } - -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 899c40f826dd..4e1b254c3695 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -3114,6 +3114,13 @@ static int svm_set_msr(struct kvm_vcpu *vcpu, struct msr_data *msr) - u32 ecx = msr->index; - u64 data = msr->data; - switch (ecx) { -+ case MSR_IA32_CR_PAT: -+ if (!kvm_mtrr_valid(vcpu, MSR_IA32_CR_PAT, data)) -+ return 1; -+ vcpu->arch.pat = data; -+ svm->vmcb->save.g_pat = data; -+ mark_dirty(svm->vmcb, VMCB_NPT); -+ break; - case MSR_IA32_TSC: - kvm_write_tsc(vcpu, msr); - break; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 9114588e3e61..67ba0d8f87c7 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -10394,6 +10394,8 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu, - vmcs_writel(GUEST_SYSENTER_EIP, vmcs12->host_ia32_sysenter_eip); - vmcs_writel(GUEST_IDTR_BASE, vmcs12->host_idtr_base); - vmcs_writel(GUEST_GDTR_BASE, vmcs12->host_gdtr_base); -+ vmcs_write32(GUEST_IDTR_LIMIT, 0xFFFF); -+ vmcs_write32(GUEST_GDTR_LIMIT, 0xFFFF); - - /* If not VM_EXIT_CLEAR_BNDCFGS, the L2 value propagates to L1. */ - if (vmcs12->vm_exit_controls & VM_EXIT_CLEAR_BNDCFGS) -diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt -index d388de72eaca..ec039f2a0c13 100644 ---- a/arch/x86/lib/x86-opcode-map.txt -+++ b/arch/x86/lib/x86-opcode-map.txt -@@ -833,7 +833,7 @@ EndTable - - GrpTable: Grp3_1 - 0: TEST Eb,Ib --1: -+1: TEST Eb,Ib - 2: NOT Eb - 3: NEG Eb - 4: MUL AL,Eb -diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c -index 91a9e6af2ec4..75cced210b2a 100644 ---- a/drivers/ata/libata-eh.c -+++ b/drivers/ata/libata-eh.c -@@ -2245,8 +2245,8 @@ static void ata_eh_link_autopsy(struct ata_link *link) - if (dev->flags & ATA_DFLAG_DUBIOUS_XFER) - eflags |= ATA_EFLAG_DUBIOUS_XFER; - ehc->i.action |= ata_eh_speed_down(dev, eflags, all_err_mask); -+ trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask); - } -- trace_ata_eh_link_autopsy(dev, ehc->i.action, all_err_mask); - DPRINTK("EXIT\n"); - } - -diff --git a/drivers/base/power/opp/core.c b/drivers/base/power/opp/core.c -index f8580900c273..db6e7e57081c 100644 ---- a/drivers/base/power/opp/core.c -+++ b/drivers/base/power/opp/core.c -@@ -1205,6 +1205,7 @@ static int _of_add_opp_table_v2(struct device *dev, struct device_node *opp_np) - if (ret) { - dev_err(dev, "%s: Failed to add OPP, %d\n", __func__, - ret); -+ of_node_put(np); - goto free_table; - } - } -diff --git a/drivers/clk/ti/clk-dra7-atl.c b/drivers/clk/ti/clk-dra7-atl.c -index 2e14dfb588f4..7d060ffe8975 100644 ---- a/drivers/clk/ti/clk-dra7-atl.c -+++ b/drivers/clk/ti/clk-dra7-atl.c -@@ -265,7 +265,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) - - /* Get configuration for the ATL instances */ - snprintf(prop, sizeof(prop), "atl%u", i); -- cfg_node = of_find_node_by_name(node, prop); -+ cfg_node = of_get_child_by_name(node, prop); - if (cfg_node) { - ret = of_property_read_u32(cfg_node, "bws", - &cdesc->bws); -@@ -278,6 +278,7 @@ static int of_dra7_atl_clk_probe(struct platform_device *pdev) - atl_write(cinfo, DRA7_ATL_AWSMUX_REG(i), - cdesc->aws); - } -+ of_node_put(cfg_node); - } - - cdesc->probed = true; -diff --git a/drivers/dma/zx296702_dma.c b/drivers/dma/zx296702_dma.c -index 245d759d5ffc..6059d81e701a 100644 ---- a/drivers/dma/zx296702_dma.c -+++ b/drivers/dma/zx296702_dma.c -@@ -813,6 +813,7 @@ static int zx_dma_probe(struct platform_device *op) - INIT_LIST_HEAD(&d->slave.channels); - dma_cap_set(DMA_SLAVE, d->slave.cap_mask); - dma_cap_set(DMA_MEMCPY, d->slave.cap_mask); -+ dma_cap_set(DMA_CYCLIC, d->slave.cap_mask); - dma_cap_set(DMA_PRIVATE, d->slave.cap_mask); - d->slave.dev = &op->dev; - d->slave.device_free_chan_resources = zx_dma_free_chan_resources; -diff --git a/drivers/gpu/drm/armada/Makefile b/drivers/gpu/drm/armada/Makefile -index ffd673615772..26412d2f8c98 100644 ---- a/drivers/gpu/drm/armada/Makefile -+++ b/drivers/gpu/drm/armada/Makefile -@@ -4,3 +4,5 @@ armada-y += armada_510.o - armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o - - obj-$(CONFIG_DRM_ARMADA) := armada.o -+ -+CFLAGS_armada_trace.o := -I$(src) -diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c -index 04de6fd88f8c..521b5bddb99c 100644 ---- a/drivers/gpu/drm/drm_mm.c -+++ b/drivers/gpu/drm/drm_mm.c -@@ -262,14 +262,12 @@ static void drm_mm_insert_helper_range(struct drm_mm_node *hole_node, - - BUG_ON(!hole_node->hole_follows || node->allocated); - -- if (adj_start < start) -- adj_start = start; -- if (adj_end > end) -- adj_end = end; -- - if (mm->color_adjust) - mm->color_adjust(hole_node, color, &adj_start, &adj_end); - -+ adj_start = max(adj_start, start); -+ adj_end = min(adj_end, end); -+ - if (flags & DRM_MM_CREATE_TOP) - adj_start = adj_end - size; - -@@ -475,17 +473,15 @@ static struct drm_mm_node *drm_mm_search_free_in_range_generic(const struct drm_ - flags & DRM_MM_SEARCH_BELOW) { - u64 hole_size = adj_end - adj_start; - -- if (adj_start < start) -- adj_start = start; -- if (adj_end > end) -- adj_end = end; -- - if (mm->color_adjust) { - mm->color_adjust(entry, color, &adj_start, &adj_end); - if (adj_end <= adj_start) - continue; - } - -+ adj_start = max(adj_start, start); -+ adj_end = min(adj_end, end); -+ - if (!check_free_hole(adj_start, adj_end, size, alignment)) - continue; - -diff --git a/drivers/iio/light/cm3232.c b/drivers/iio/light/cm3232.c -index fe89b6823217..263e97235ea0 100644 ---- a/drivers/iio/light/cm3232.c -+++ b/drivers/iio/light/cm3232.c -@@ -119,7 +119,7 @@ static int cm3232_reg_init(struct cm3232_chip *chip) - if (ret < 0) - dev_err(&chip->client->dev, "Error writing reg_cmd\n"); - -- return 0; -+ return ret; - } - - /** -diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c -index e397f1b0af09..9a99cee2665a 100644 ---- a/drivers/infiniband/ulp/srp/ib_srp.c -+++ b/drivers/infiniband/ulp/srp/ib_srp.c -@@ -670,12 +670,19 @@ static void srp_path_rec_completion(int status, - static int srp_lookup_path(struct srp_rdma_ch *ch) - { - struct srp_target_port *target = ch->target; -- int ret; -+ int ret = -ENODEV; - - ch->path.numb_path = 1; - - init_completion(&ch->done); - -+ /* -+ * Avoid that the SCSI host can be removed by srp_remove_target() -+ * before srp_path_rec_completion() is called. -+ */ -+ if (!scsi_host_get(target->scsi_host)) -+ goto out; -+ - ch->path_query_id = ib_sa_path_rec_get(&srp_sa_client, - target->srp_host->srp_dev->dev, - target->srp_host->port, -@@ -689,18 +696,24 @@ static int srp_lookup_path(struct srp_rdma_ch *ch) - GFP_KERNEL, - srp_path_rec_completion, - ch, &ch->path_query); -- if (ch->path_query_id < 0) -- return ch->path_query_id; -+ ret = ch->path_query_id; -+ if (ret < 0) -+ goto put; - - ret = wait_for_completion_interruptible(&ch->done); - if (ret < 0) -- return ret; -+ goto put; - -- if (ch->status < 0) -+ ret = ch->status; -+ if (ret < 0) - shost_printk(KERN_WARNING, target->scsi_host, - PFX "Path record query failed\n"); - -- return ch->status; -+put: -+ scsi_host_put(target->scsi_host); -+ -+out: -+ return ret; - } - - static int srp_send_req(struct srp_rdma_ch *ch, bool multich) -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c -index eaabf3125846..c52131233ba7 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.c -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c -@@ -3425,7 +3425,7 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name) - { - const char *p; - unsigned len, count, leading_zero_bytes; -- int ret, rc; -+ int ret; - - p = name; - if (strncasecmp(p, "0x", 2) == 0) -@@ -3437,10 +3437,9 @@ static int srpt_parse_i_port_id(u8 i_port_id[16], const char *name) - count = min(len / 2, 16U); - leading_zero_bytes = 16 - count; - memset(i_port_id, 0, leading_zero_bytes); -- rc = hex2bin(i_port_id + leading_zero_bytes, p, count); -- if (rc < 0) -- pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", rc); -- ret = 0; -+ ret = hex2bin(i_port_id + leading_zero_bytes, p, count); -+ if (ret < 0) -+ pr_debug("hex2bin failed for srpt_parse_i_port_id: %d\n", ret); - out: - return ret; - } -diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c -index 8eeab72b93e2..ea47980949ef 100644 ---- a/drivers/md/bcache/alloc.c -+++ b/drivers/md/bcache/alloc.c -@@ -406,7 +406,8 @@ long bch_bucket_alloc(struct cache *ca, unsigned reserve, bool wait) - - finish_wait(&ca->set->bucket_wait, &w); - out: -- wake_up_process(ca->alloc_thread); -+ if (ca->alloc_thread) -+ wake_up_process(ca->alloc_thread); - - trace_bcache_alloc(ca, reserve); - -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index cdceefd0e57d..2ec7f90e3455 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -928,7 +928,8 @@ static void __get_memory_limit(struct dm_bufio_client *c, - buffers = c->minimum_buffers; - - *limit_buffers = buffers; -- *threshold_buffers = buffers * DM_BUFIO_WRITEBACK_PERCENT / 100; -+ *threshold_buffers = mult_frac(buffers, -+ DM_BUFIO_WRITEBACK_PERCENT, 100); - } - - /* -@@ -1829,19 +1830,15 @@ static int __init dm_bufio_init(void) - memset(&dm_bufio_caches, 0, sizeof dm_bufio_caches); - memset(&dm_bufio_cache_names, 0, sizeof dm_bufio_cache_names); - -- mem = (__u64)((totalram_pages - totalhigh_pages) * -- DM_BUFIO_MEMORY_PERCENT / 100) << PAGE_SHIFT; -+ mem = (__u64)mult_frac(totalram_pages - totalhigh_pages, -+ DM_BUFIO_MEMORY_PERCENT, 100) << PAGE_SHIFT; - - if (mem > ULONG_MAX) - mem = ULONG_MAX; - - #ifdef CONFIG_MMU -- /* -- * Get the size of vmalloc space the same way as VMALLOC_TOTAL -- * in fs/proc/internal.h -- */ -- if (mem > (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100) -- mem = (VMALLOC_END - VMALLOC_START) * DM_BUFIO_VMALLOC_PERCENT / 100; -+ if (mem > mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100)) -+ mem = mult_frac(VMALLOC_TOTAL, DM_BUFIO_VMALLOC_PERCENT, 100); - #endif - - dm_bufio_default_cache_size = mem; -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 320eb3c4bb6b..9ec6948e3b8b 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -3507,11 +3507,15 @@ struct mapped_device *dm_get_from_kobject(struct kobject *kobj) - - md = container_of(kobj, struct mapped_device, kobj_holder.kobj); - -- if (test_bit(DMF_FREEING, &md->flags) || -- dm_deleting_md(md)) -- return NULL; -- -+ spin_lock(&_minor_lock); -+ if (test_bit(DMF_FREEING, &md->flags) || dm_deleting_md(md)) { -+ md = NULL; -+ goto out; -+ } - dm_get(md); -+out: -+ spin_unlock(&_minor_lock); -+ - return md; - } - -diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c -index efc21b1da211..ca107033e429 100644 ---- a/drivers/media/rc/ir-lirc-codec.c -+++ b/drivers/media/rc/ir-lirc-codec.c -@@ -286,11 +286,14 @@ static long ir_lirc_ioctl(struct file *filep, unsigned int cmd, - if (!dev->max_timeout) - return -ENOSYS; - -+ /* Check for multiply overflow */ -+ if (val > U32_MAX / 1000) -+ return -EINVAL; -+ - tmp = val * 1000; - -- if (tmp < dev->min_timeout || -- tmp > dev->max_timeout) -- return -EINVAL; -+ if (tmp < dev->min_timeout || tmp > dev->max_timeout) -+ return -EINVAL; - - dev->timeout = tmp; - break; -diff --git a/drivers/media/usb/as102/as102_fw.c b/drivers/media/usb/as102/as102_fw.c -index 07d08c49f4d4..b2e16bb67572 100644 ---- a/drivers/media/usb/as102/as102_fw.c -+++ b/drivers/media/usb/as102/as102_fw.c -@@ -101,18 +101,23 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap, - unsigned char *cmd, - const struct firmware *firmware) { - -- struct as10x_fw_pkt_t fw_pkt; -+ struct as10x_fw_pkt_t *fw_pkt; - int total_read_bytes = 0, errno = 0; - unsigned char addr_has_changed = 0; - -+ fw_pkt = kmalloc(sizeof(*fw_pkt), GFP_KERNEL); -+ if (!fw_pkt) -+ return -ENOMEM; -+ -+ - for (total_read_bytes = 0; total_read_bytes < firmware->size; ) { - int read_bytes = 0, data_len = 0; - - /* parse intel hex line */ - read_bytes = parse_hex_line( - (u8 *) (firmware->data + total_read_bytes), -- fw_pkt.raw.address, -- fw_pkt.raw.data, -+ fw_pkt->raw.address, -+ fw_pkt->raw.data, - &data_len, - &addr_has_changed); - -@@ -122,28 +127,28 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap, - /* detect the end of file */ - total_read_bytes += read_bytes; - if (total_read_bytes == firmware->size) { -- fw_pkt.u.request[0] = 0x00; -- fw_pkt.u.request[1] = 0x03; -+ fw_pkt->u.request[0] = 0x00; -+ fw_pkt->u.request[1] = 0x03; - - /* send EOF command */ - errno = bus_adap->ops->upload_fw_pkt(bus_adap, - (uint8_t *) -- &fw_pkt, 2, 0); -+ fw_pkt, 2, 0); - if (errno < 0) - goto error; - } else { - if (!addr_has_changed) { - /* prepare command to send */ -- fw_pkt.u.request[0] = 0x00; -- fw_pkt.u.request[1] = 0x01; -+ fw_pkt->u.request[0] = 0x00; -+ fw_pkt->u.request[1] = 0x01; - -- data_len += sizeof(fw_pkt.u.request); -- data_len += sizeof(fw_pkt.raw.address); -+ data_len += sizeof(fw_pkt->u.request); -+ data_len += sizeof(fw_pkt->raw.address); - - /* send cmd to device */ - errno = bus_adap->ops->upload_fw_pkt(bus_adap, - (uint8_t *) -- &fw_pkt, -+ fw_pkt, - data_len, - 0); - if (errno < 0) -@@ -152,6 +157,7 @@ static int as102_firmware_upload(struct as10x_bus_adapter_t *bus_adap, - } - } - error: -+ kfree(fw_pkt); - return (errno == 0) ? total_read_bytes : errno; - } - -diff --git a/drivers/media/usb/cx231xx/cx231xx-cards.c b/drivers/media/usb/cx231xx/cx231xx-cards.c -index 2c5f76d588ac..04ae21278440 100644 ---- a/drivers/media/usb/cx231xx/cx231xx-cards.c -+++ b/drivers/media/usb/cx231xx/cx231xx-cards.c -@@ -1672,7 +1672,7 @@ static int cx231xx_usb_probe(struct usb_interface *interface, - nr = dev->devno; - - assoc_desc = udev->actconfig->intf_assoc[0]; -- if (assoc_desc->bFirstInterface != ifnum) { -+ if (!assoc_desc || assoc_desc->bFirstInterface != ifnum) { - dev_err(d, "Not found matching IAD interface\n"); - retval = -ENODEV; - goto err_if; -diff --git a/drivers/media/v4l2-core/v4l2-ctrls.c b/drivers/media/v4l2-core/v4l2-ctrls.c -index 4a1d9fdd14bb..523758e71fe6 100644 ---- a/drivers/media/v4l2-core/v4l2-ctrls.c -+++ b/drivers/media/v4l2-core/v4l2-ctrls.c -@@ -1200,6 +1200,16 @@ void v4l2_ctrl_fill(u32 id, const char **name, enum v4l2_ctrl_type *type, - } - EXPORT_SYMBOL(v4l2_ctrl_fill); - -+static u32 user_flags(const struct v4l2_ctrl *ctrl) -+{ -+ u32 flags = ctrl->flags; -+ -+ if (ctrl->is_ptr) -+ flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD; -+ -+ return flags; -+} -+ - static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 changes) - { - memset(ev->reserved, 0, sizeof(ev->reserved)); -@@ -1207,7 +1217,7 @@ static void fill_event(struct v4l2_event *ev, struct v4l2_ctrl *ctrl, u32 change - ev->id = ctrl->id; - ev->u.ctrl.changes = changes; - ev->u.ctrl.type = ctrl->type; -- ev->u.ctrl.flags = ctrl->flags; -+ ev->u.ctrl.flags = user_flags(ctrl); - if (ctrl->is_ptr) - ev->u.ctrl.value64 = 0; - else -@@ -2536,10 +2546,8 @@ int v4l2_query_ext_ctrl(struct v4l2_ctrl_handler *hdl, struct v4l2_query_ext_ctr - else - qc->id = ctrl->id; - strlcpy(qc->name, ctrl->name, sizeof(qc->name)); -- qc->flags = ctrl->flags; -+ qc->flags = user_flags(ctrl); - qc->type = ctrl->type; -- if (ctrl->is_ptr) -- qc->flags |= V4L2_CTRL_FLAG_HAS_PAYLOAD; - qc->elem_size = ctrl->elem_size; - qc->elems = ctrl->elems; - qc->nr_of_dims = ctrl->nr_of_dims; -diff --git a/drivers/net/ethernet/3com/typhoon.c b/drivers/net/ethernet/3com/typhoon.c -index 8f8418d2ac4a..a0012c3cb4f6 100644 ---- a/drivers/net/ethernet/3com/typhoon.c -+++ b/drivers/net/ethernet/3com/typhoon.c -@@ -2366,9 +2366,9 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - * 4) Get the hardware address. - * 5) Put the card to sleep. - */ -- if (typhoon_reset(ioaddr, WaitSleep) < 0) { -+ err = typhoon_reset(ioaddr, WaitSleep); -+ if (err < 0) { - err_msg = "could not reset 3XP"; -- err = -EIO; - goto error_out_dma; - } - -@@ -2382,24 +2382,25 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - typhoon_init_interface(tp); - typhoon_init_rings(tp); - -- if(typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST) < 0) { -+ err = typhoon_boot_3XP(tp, TYPHOON_STATUS_WAITING_FOR_HOST); -+ if (err < 0) { - err_msg = "cannot boot 3XP sleep image"; -- err = -EIO; - goto error_out_reset; - } - - INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_MAC_ADDRESS); -- if(typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp) < 0) { -+ err = typhoon_issue_command(tp, 1, &xp_cmd, 1, xp_resp); -+ if (err < 0) { - err_msg = "cannot read MAC address"; -- err = -EIO; - goto error_out_reset; - } - - *(__be16 *)&dev->dev_addr[0] = htons(le16_to_cpu(xp_resp[0].parm1)); - *(__be32 *)&dev->dev_addr[2] = htonl(le32_to_cpu(xp_resp[0].parm2)); - -- if(!is_valid_ether_addr(dev->dev_addr)) { -+ if (!is_valid_ether_addr(dev->dev_addr)) { - err_msg = "Could not obtain valid ethernet address, aborting"; -+ err = -EIO; - goto error_out_reset; - } - -@@ -2407,7 +2408,8 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - * later when we print out the version reported. - */ - INIT_COMMAND_WITH_RESPONSE(&xp_cmd, TYPHOON_CMD_READ_VERSIONS); -- if(typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp) < 0) { -+ err = typhoon_issue_command(tp, 1, &xp_cmd, 3, xp_resp); -+ if (err < 0) { - err_msg = "Could not get Sleep Image version"; - goto error_out_reset; - } -@@ -2424,9 +2426,9 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - if(xp_resp[0].numDesc != 0) - tp->capabilities |= TYPHOON_WAKEUP_NEEDS_RESET; - -- if(typhoon_sleep(tp, PCI_D3hot, 0) < 0) { -+ err = typhoon_sleep(tp, PCI_D3hot, 0); -+ if (err < 0) { - err_msg = "cannot put adapter to sleep"; -- err = -EIO; - goto error_out_reset; - } - -@@ -2449,7 +2451,8 @@ typhoon_init_one(struct pci_dev *pdev, const struct pci_device_id *ent) - dev->features = dev->hw_features | - NETIF_F_HW_VLAN_CTAG_RX | NETIF_F_RXCSUM; - -- if(register_netdev(dev) < 0) { -+ err = register_netdev(dev); -+ if (err < 0) { - err_msg = "unable to register netdev"; - goto error_out_reset; - } -diff --git a/drivers/net/ethernet/intel/e1000e/mac.c b/drivers/net/ethernet/intel/e1000e/mac.c -index e59d7c283cd4..645ace74429e 100644 ---- a/drivers/net/ethernet/intel/e1000e/mac.c -+++ b/drivers/net/ethernet/intel/e1000e/mac.c -@@ -410,6 +410,9 @@ void e1000e_clear_hw_cntrs_base(struct e1000_hw *hw) - * Checks to see of the link status of the hardware has changed. If a - * change in link status has been detected, then we read the PHY registers - * to get the current speed/duplex if link exists. -+ * -+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link -+ * up). - **/ - s32 e1000e_check_for_copper_link(struct e1000_hw *hw) - { -@@ -423,7 +426,7 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) - * Change or Rx Sequence Error interrupt. - */ - if (!mac->get_link_status) -- return 0; -+ return 1; - - /* First we want to see if the MII Status Register reports - * link. If so, then we want to get the current speed/duplex -@@ -461,10 +464,12 @@ s32 e1000e_check_for_copper_link(struct e1000_hw *hw) - * different link partner. - */ - ret_val = e1000e_config_fc_after_link_up(hw); -- if (ret_val) -+ if (ret_val) { - e_dbg("Error configuring flow control\n"); -+ return ret_val; -+ } - -- return ret_val; -+ return 1; - } - - /** -diff --git a/drivers/net/ethernet/intel/e1000e/netdev.c b/drivers/net/ethernet/intel/e1000e/netdev.c -index 80ec587d510e..5205f1ebe381 100644 ---- a/drivers/net/ethernet/intel/e1000e/netdev.c -+++ b/drivers/net/ethernet/intel/e1000e/netdev.c -@@ -5017,7 +5017,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter) - case e1000_media_type_copper: - if (hw->mac.get_link_status) { - ret_val = hw->mac.ops.check_for_link(hw); -- link_active = !hw->mac.get_link_status; -+ link_active = ret_val > 0; - } else { - link_active = true; - } -@@ -5035,7 +5035,7 @@ static bool e1000e_has_link(struct e1000_adapter *adapter) - break; - } - -- if ((ret_val == E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) && -+ if ((ret_val == -E1000_ERR_PHY) && (hw->phy.type == e1000_phy_igp_3) && - (er32(CTRL) & E1000_PHY_CTRL_GBE_DISABLE)) { - /* See e1000_kmrn_lock_loss_workaround_ich8lan() */ - e_info("Gigabit has been disabled, downgrading speed\n"); -diff --git a/drivers/net/ethernet/intel/e1000e/phy.c b/drivers/net/ethernet/intel/e1000e/phy.c -index de13aeacae97..8e674a0988b0 100644 ---- a/drivers/net/ethernet/intel/e1000e/phy.c -+++ b/drivers/net/ethernet/intel/e1000e/phy.c -@@ -1744,6 +1744,7 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations, - s32 ret_val = 0; - u16 i, phy_status; - -+ *success = false; - for (i = 0; i < iterations; i++) { - /* Some PHYs require the MII_BMSR register to be read - * twice due to the link bit being sticky. No harm doing -@@ -1763,16 +1764,16 @@ s32 e1000e_phy_has_link_generic(struct e1000_hw *hw, u32 iterations, - ret_val = e1e_rphy(hw, MII_BMSR, &phy_status); - if (ret_val) - break; -- if (phy_status & BMSR_LSTATUS) -+ if (phy_status & BMSR_LSTATUS) { -+ *success = true; - break; -+ } - if (usec_interval >= 1000) - msleep(usec_interval / 1000); - else - udelay(usec_interval); - } - -- *success = (i < iterations); -- - return ret_val; - } - -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_main.c b/drivers/net/ethernet/intel/fm10k/fm10k_main.c -index 09281558bfbc..c21fa56afd7c 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_main.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_main.c -@@ -1226,7 +1226,7 @@ static bool fm10k_clean_tx_irq(struct fm10k_q_vector *q_vector, - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if DD is not set pending work has not been completed */ - if (!(eop_desc->flags & FM10K_TXD_FLAG_DONE)) -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index 4edbab6ca7ef..b5b228c9a030 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -3595,7 +3595,7 @@ static bool i40e_clean_fdir_tx_irq(struct i40e_ring *tx_ring, int budget) - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if the descriptor isn't done, no work yet to do */ - if (!(eop_desc->cmd_type_offset_bsz & -diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -index 26c55bba4bf3..6dcc3854844d 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c -@@ -663,7 +663,7 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget) - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* we have caught up to head, no work left to do */ - if (tx_head == tx_desc) -diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c -index 39db70a597ed..1ed27fcd5031 100644 ---- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c -+++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c -@@ -172,7 +172,7 @@ static bool i40e_clean_tx_irq(struct i40e_ring *tx_ring, int budget) - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* we have caught up to head, no work left to do */ - if (tx_head == tx_desc) -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index ff6e57d788eb..c55552c3d2f9 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -6433,7 +6433,7 @@ static bool igb_clean_tx_irq(struct igb_q_vector *q_vector) - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if DD is not set pending work has not been completed */ - if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD))) -diff --git a/drivers/net/ethernet/intel/igbvf/netdev.c b/drivers/net/ethernet/intel/igbvf/netdev.c -index 297af801f051..519b72c41888 100644 ---- a/drivers/net/ethernet/intel/igbvf/netdev.c -+++ b/drivers/net/ethernet/intel/igbvf/netdev.c -@@ -809,7 +809,7 @@ static bool igbvf_clean_tx_irq(struct igbvf_ring *tx_ring) - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if DD is not set pending work has not been completed */ - if (!(eop_desc->wb.status & cpu_to_le32(E1000_TXD_STAT_DD))) -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -index 83645d8503d4..a5b443171b8b 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c -@@ -1114,7 +1114,7 @@ static bool ixgbe_clean_tx_irq(struct ixgbe_q_vector *q_vector, - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if DD is not set pending work has not been completed */ - if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD))) -diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -index 592ff237d692..50bbad37d640 100644 ---- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c -@@ -312,7 +312,7 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_q_vector *q_vector, - break; - - /* prevent any other reads prior to eop_desc */ -- read_barrier_depends(); -+ smp_rmb(); - - /* if DD is not set pending work has not been completed */ - if (!(eop_desc->wb.status & cpu_to_le32(IXGBE_TXD_STAT_DD))) -diff --git a/drivers/net/wireless/ath/ath10k/core.c b/drivers/net/wireless/ath/ath10k/core.c -index 05de75360fa4..ee638cb8b48f 100644 ---- a/drivers/net/wireless/ath/ath10k/core.c -+++ b/drivers/net/wireless/ath/ath10k/core.c -@@ -548,8 +548,11 @@ static int ath10k_core_get_board_id_from_otp(struct ath10k *ar) - "boot get otp board id result 0x%08x board_id %d chip_id %d\n", - result, board_id, chip_id); - -- if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0) -+ if ((result & ATH10K_BMI_BOARD_ID_STATUS_MASK) != 0 || -+ (board_id == 0)) { -+ ath10k_warn(ar, "board id is not exist in otp, ignore it\n"); - return -EOPNOTSUPP; -+ } - - ar->id.bmi_ids_valid = true; - ar->id.bmi_board_id = board_id; -diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c -index 6decf4a95ce1..bed8d89fe3a0 100644 ---- a/drivers/net/wireless/ath/ath10k/mac.c -+++ b/drivers/net/wireless/ath/ath10k/mac.c -@@ -1127,6 +1127,36 @@ static int ath10k_monitor_recalc(struct ath10k *ar) - return ath10k_monitor_stop(ar); - } - -+static bool ath10k_mac_can_set_cts_prot(struct ath10k_vif *arvif) -+{ -+ struct ath10k *ar = arvif->ar; -+ -+ lockdep_assert_held(&ar->conf_mutex); -+ -+ if (!arvif->is_started) { -+ ath10k_dbg(ar, ATH10K_DBG_MAC, "defer cts setup, vdev is not ready yet\n"); -+ return false; -+ } -+ -+ return true; -+} -+ -+static int ath10k_mac_set_cts_prot(struct ath10k_vif *arvif) -+{ -+ struct ath10k *ar = arvif->ar; -+ u32 vdev_param; -+ -+ lockdep_assert_held(&ar->conf_mutex); -+ -+ vdev_param = ar->wmi.vdev_param->protection_mode; -+ -+ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_protection %d\n", -+ arvif->vdev_id, arvif->use_cts_prot); -+ -+ return ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, -+ arvif->use_cts_prot ? 1 : 0); -+} -+ - static int ath10k_recalc_rtscts_prot(struct ath10k_vif *arvif) - { - struct ath10k *ar = arvif->ar; -@@ -4180,7 +4210,8 @@ static int ath10k_mac_txpower_recalc(struct ath10k *ar) - lockdep_assert_held(&ar->conf_mutex); - - list_for_each_entry(arvif, &ar->arvifs, list) { -- WARN_ON(arvif->txpower < 0); -+ if (arvif->txpower <= 0) -+ continue; - - if (txpower == -1) - txpower = arvif->txpower; -@@ -4188,8 +4219,8 @@ static int ath10k_mac_txpower_recalc(struct ath10k *ar) - txpower = min(txpower, arvif->txpower); - } - -- if (WARN_ON(txpower == -1)) -- return -EINVAL; -+ if (txpower == -1) -+ return 0; - - ret = ath10k_mac_txpower_setup(ar, txpower); - if (ret) { -@@ -4787,20 +4818,18 @@ static void ath10k_bss_info_changed(struct ieee80211_hw *hw, - - if (changed & BSS_CHANGED_ERP_CTS_PROT) { - arvif->use_cts_prot = info->use_cts_prot; -- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac vdev %d cts_prot %d\n", -- arvif->vdev_id, info->use_cts_prot); - - ret = ath10k_recalc_rtscts_prot(arvif); - if (ret) - ath10k_warn(ar, "failed to recalculate rts/cts prot for vdev %d: %d\n", - arvif->vdev_id, ret); - -- vdev_param = ar->wmi.vdev_param->protection_mode; -- ret = ath10k_wmi_vdev_set_param(ar, arvif->vdev_id, vdev_param, -- info->use_cts_prot ? 1 : 0); -- if (ret) -- ath10k_warn(ar, "failed to set protection mode %d on vdev %i: %d\n", -- info->use_cts_prot, arvif->vdev_id, ret); -+ if (ath10k_mac_can_set_cts_prot(arvif)) { -+ ret = ath10k_mac_set_cts_prot(arvif); -+ if (ret) -+ ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n", -+ arvif->vdev_id, ret); -+ } - } - - if (changed & BSS_CHANGED_ERP_SLOT) { -@@ -6712,6 +6741,13 @@ ath10k_mac_op_assign_vif_chanctx(struct ieee80211_hw *hw, - arvif->is_up = true; - } - -+ if (ath10k_mac_can_set_cts_prot(arvif)) { -+ ret = ath10k_mac_set_cts_prot(arvif); -+ if (ret) -+ ath10k_warn(ar, "failed to set cts protection for vdev %d: %d\n", -+ arvif->vdev_id, ret); -+ } -+ - mutex_unlock(&ar->conf_mutex); - return 0; - -diff --git a/drivers/net/wireless/ath/ath10k/wmi-tlv.c b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -index 6fbd17b69469..02eea3c3b5d3 100644 ---- a/drivers/net/wireless/ath/ath10k/wmi-tlv.c -+++ b/drivers/net/wireless/ath/ath10k/wmi-tlv.c -@@ -1105,8 +1105,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, - struct ath10k_fw_stats_pdev *dst; - - src = data; -- if (data_len < sizeof(*src)) -+ if (data_len < sizeof(*src)) { -+ kfree(tb); - return -EPROTO; -+ } - - data += sizeof(*src); - data_len -= sizeof(*src); -@@ -1126,8 +1128,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, - struct ath10k_fw_stats_vdev *dst; - - src = data; -- if (data_len < sizeof(*src)) -+ if (data_len < sizeof(*src)) { -+ kfree(tb); - return -EPROTO; -+ } - - data += sizeof(*src); - data_len -= sizeof(*src); -@@ -1145,8 +1149,10 @@ static int ath10k_wmi_tlv_op_pull_fw_stats(struct ath10k *ar, - struct ath10k_fw_stats_peer *dst; - - src = data; -- if (data_len < sizeof(*src)) -+ if (data_len < sizeof(*src)) { -+ kfree(tb); - return -EPROTO; -+ } - - data += sizeof(*src); - data_len -= sizeof(*src); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c -index 0708eedd9671..1c69e8140d9d 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8192ee/fw.c -@@ -664,7 +664,7 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished) - struct rtl_priv *rtlpriv = rtl_priv(hw); - struct rtl_mac *mac = rtl_mac(rtl_priv(hw)); - struct sk_buff *skb = NULL; -- -+ bool rtstatus; - u32 totalpacketlen; - u8 u1rsvdpageloc[5] = { 0 }; - bool b_dlok = false; -@@ -727,7 +727,9 @@ void rtl92ee_set_fw_rsvdpagepkt(struct ieee80211_hw *hw, bool b_dl_finished) - memcpy((u8 *)skb_put(skb, totalpacketlen), - &reserved_page_packet, totalpacketlen); - -- b_dlok = true; -+ rtstatus = rtl_cmd_send_packet(hw, skb); -+ if (rtstatus) -+ b_dlok = true; - - if (b_dlok) { - RT_TRACE(rtlpriv, COMP_POWER, DBG_LOUD , -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index bbb789f8990b..738d541a2255 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -1377,6 +1377,7 @@ static void _rtl8821ae_get_wakeup_reason(struct ieee80211_hw *hw) - - ppsc->wakeup_reason = 0; - -+ do_gettimeofday(&ts); - rtlhal->last_suspend_sec = ts.tv_sec; - - switch (fw_reason) { -diff --git a/drivers/nvdimm/label.c b/drivers/nvdimm/label.c -index 96526dcfdd37..ff7b9632ad61 100644 ---- a/drivers/nvdimm/label.c -+++ b/drivers/nvdimm/label.c -@@ -823,7 +823,7 @@ static int init_labels(struct nd_mapping *nd_mapping, int num_labels) - nsindex = to_namespace_index(ndd, 0); - memset(nsindex, 0, ndd->nsarea.config_size); - for (i = 0; i < 2; i++) { -- int rc = nd_label_write_index(ndd, i, i*2, ND_NSINDEX_INIT); -+ int rc = nd_label_write_index(ndd, i, 3 - i, ND_NSINDEX_INIT); - - if (rc) - return rc; -diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c -index aae7379af4e4..c2184104b789 100644 ---- a/drivers/nvdimm/namespace_devs.c -+++ b/drivers/nvdimm/namespace_devs.c -@@ -1305,7 +1305,7 @@ static umode_t namespace_visible(struct kobject *kobj, - if (a == &dev_attr_resource.attr) { - if (is_namespace_blk(dev)) - return 0; -- return a->mode; -+ return 0400; - } - - if (is_namespace_pmem(dev) || is_namespace_blk(dev)) { -diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c -index b83df942794f..193ac13de49b 100644 ---- a/drivers/pci/probe.c -+++ b/drivers/pci/probe.c -@@ -1414,8 +1414,16 @@ static void program_hpp_type0(struct pci_dev *dev, struct hpp_type0 *hpp) - - static void program_hpp_type1(struct pci_dev *dev, struct hpp_type1 *hpp) - { -- if (hpp) -- dev_warn(&dev->dev, "PCI-X settings not supported\n"); -+ int pos; -+ -+ if (!hpp) -+ return; -+ -+ pos = pci_find_capability(dev, PCI_CAP_ID_PCIX); -+ if (!pos) -+ return; -+ -+ dev_warn(&dev->dev, "PCI-X settings not supported\n"); - } - - static bool pcie_root_rcb_set(struct pci_dev *dev) -@@ -1441,6 +1449,9 @@ static void program_hpp_type2(struct pci_dev *dev, struct hpp_type2 *hpp) - if (!hpp) - return; - -+ if (!pci_is_pcie(dev)) -+ return; -+ - if (hpp->revision > 1) { - dev_warn(&dev->dev, "PCIe settings rev %d not supported\n", - hpp->revision); -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index 8b9c2a38d1cc..b0a24dedd1ed 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -315,6 +315,7 @@ config SPI_FSL_SPI - config SPI_FSL_DSPI - tristate "Freescale DSPI controller" - select REGMAP_MMIO -+ depends on HAS_DMA - depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST - help - This enables support for the Freescale DSPI controller in master -diff --git a/drivers/staging/iio/cdc/ad7150.c b/drivers/staging/iio/cdc/ad7150.c -index e8d0ff2d5c9b..808d6ebf6c94 100644 ---- a/drivers/staging/iio/cdc/ad7150.c -+++ b/drivers/staging/iio/cdc/ad7150.c -@@ -272,7 +272,7 @@ static int ad7150_write_event_config(struct iio_dev *indio_dev, - error_ret: - mutex_unlock(&chip->state_lock); - -- return 0; -+ return ret; - } - - static int ad7150_read_event_value(struct iio_dev *indio_dev, -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index fd493412b172..bb73401f5761 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1923,12 +1923,14 @@ attach: - - if (!(hdr->opcode & ISCSI_OP_IMMEDIATE)) { - int cmdsn_ret = iscsit_sequence_cmd(conn, cmd, buf, hdr->cmdsn); -- if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) -+ if (cmdsn_ret == CMDSN_HIGHER_THAN_EXP) { - out_of_order_cmdsn = 1; -- else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) -+ } else if (cmdsn_ret == CMDSN_LOWER_THAN_EXP) { -+ target_put_sess_cmd(&cmd->se_cmd); - return 0; -- else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) -+ } else if (cmdsn_ret == CMDSN_ERROR_CANNOT_RECOVER) { - return -1; -+ } - } - iscsit_ack_from_expstatsn(conn, be32_to_cpu(hdr->exp_statsn)); - -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index a42054edd427..37abf881ca75 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1970,6 +1970,8 @@ static void target_restart_delayed_cmds(struct se_device *dev) - list_del(&cmd->se_delayed_node); - spin_unlock(&dev->delayed_cmd_lock); - -+ cmd->transport_state |= CMD_T_SENT; -+ - __target_execute_cmd(cmd, true); - - if (cmd->sam_task_attr == TCM_ORDERED_TAG) -@@ -2007,6 +2009,8 @@ static void transport_complete_task_attr(struct se_cmd *cmd) - pr_debug("Incremented dev_cur_ordered_id: %u for ORDERED\n", - dev->dev_cur_ordered_id); - } -+ cmd->se_cmd_flags &= ~SCF_TASK_ATTR_SET; -+ - restart: - target_restart_delayed_cmds(dev); - } -diff --git a/drivers/vhost/scsi.c b/drivers/vhost/scsi.c -index e4110d6de0b5..da6cc25baaef 100644 ---- a/drivers/vhost/scsi.c -+++ b/drivers/vhost/scsi.c -@@ -703,6 +703,7 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, - struct scatterlist *sg, int sg_count) - { - size_t off = iter->iov_offset; -+ struct scatterlist *p = sg; - int i, ret; - - for (i = 0; i < iter->nr_segs; i++) { -@@ -711,8 +712,8 @@ vhost_scsi_iov_to_sgl(struct vhost_scsi_cmd *cmd, bool write, - - ret = vhost_scsi_map_to_sgl(cmd, base, len, sg, write); - if (ret < 0) { -- for (i = 0; i < sg_count; i++) { -- struct page *page = sg_page(&sg[i]); -+ while (p < sg) { -+ struct page *page = sg_page(p++); - if (page) - put_page(page); - } -diff --git a/drivers/xen/xenbus/xenbus_dev_frontend.c b/drivers/xen/xenbus/xenbus_dev_frontend.c -index 0e0eb10f82a0..816a0e08ef10 100644 ---- a/drivers/xen/xenbus/xenbus_dev_frontend.c -+++ b/drivers/xen/xenbus/xenbus_dev_frontend.c -@@ -316,7 +316,7 @@ static int xenbus_write_transaction(unsigned msg_type, - rc = -ENOMEM; - goto out; - } -- } else if (msg_type == XS_TRANSACTION_END) { -+ } else if (u->u.msg.tx_id != 0) { - list_for_each_entry(trans, &u->transactions, list) - if (trans->handle.id == u->u.msg.tx_id) - break; -diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c -index 511078586fa1..73f1d1b3a51c 100644 ---- a/fs/9p/vfs_inode.c -+++ b/fs/9p/vfs_inode.c -@@ -483,6 +483,9 @@ static int v9fs_test_inode(struct inode *inode, void *data) - - if (v9inode->qid.type != st->qid.type) - return 0; -+ -+ if (v9inode->qid.path != st->qid.path) -+ return 0; - return 1; - } - -diff --git a/fs/9p/vfs_inode_dotl.c b/fs/9p/vfs_inode_dotl.c -index cb899af1babc..0b88744c6446 100644 ---- a/fs/9p/vfs_inode_dotl.c -+++ b/fs/9p/vfs_inode_dotl.c -@@ -87,6 +87,9 @@ static int v9fs_test_inode_dotl(struct inode *inode, void *data) - - if (v9inode->qid.type != st->qid.type) - return 0; -+ -+ if (v9inode->qid.path != st->qid.path) -+ return 0; - return 1; - } - -diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c -index 35b755e79c2d..fe6e7050fe50 100644 ---- a/fs/autofs4/waitq.c -+++ b/fs/autofs4/waitq.c -@@ -87,7 +87,8 @@ static int autofs4_write(struct autofs_sb_info *sbi, - spin_unlock_irqrestore(¤t->sighand->siglock, flags); - } - -- return (bytes > 0); -+ /* if 'wr' returned 0 (impossible) we assume -EIO (safe) */ -+ return bytes == 0 ? 0 : wr < 0 ? wr : -EIO; - } - - static void autofs4_notify_daemon(struct autofs_sb_info *sbi, -@@ -101,6 +102,7 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - } pkt; - struct file *pipe = NULL; - size_t pktsz; -+ int ret; - - DPRINTK("wait id = 0x%08lx, name = %.*s, type=%d", - (unsigned long) wq->wait_queue_token, wq->name.len, wq->name.name, type); -@@ -173,7 +175,18 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - mutex_unlock(&sbi->wq_mutex); - - if (autofs4_write(sbi, pipe, &pkt, pktsz)) -+ switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) { -+ case 0: -+ break; -+ case -ENOMEM: -+ case -ERESTARTSYS: -+ /* Just fail this one */ -+ autofs4_wait_release(sbi, wq->wait_queue_token, ret); -+ break; -+ default: - autofs4_catatonic_mode(sbi); -+ break; -+ } - fput(pipe); - } - -diff --git a/fs/btrfs/uuid-tree.c b/fs/btrfs/uuid-tree.c -index 778282944530..837a9a8d579e 100644 ---- a/fs/btrfs/uuid-tree.c -+++ b/fs/btrfs/uuid-tree.c -@@ -348,7 +348,5 @@ skip: - - out: - btrfs_free_path(path); -- if (ret) -- btrfs_warn(fs_info, "btrfs_uuid_tree_iterate failed %d", ret); -- return 0; -+ return ret; - } -diff --git a/fs/ecryptfs/messaging.c b/fs/ecryptfs/messaging.c -index 286f10b0363b..4f457d5c4933 100644 ---- a/fs/ecryptfs/messaging.c -+++ b/fs/ecryptfs/messaging.c -@@ -442,15 +442,16 @@ void ecryptfs_release_messaging(void) - } - if (ecryptfs_daemon_hash) { - struct ecryptfs_daemon *daemon; -+ struct hlist_node *n; - int i; - - mutex_lock(&ecryptfs_daemon_hash_mux); - for (i = 0; i < (1 << ecryptfs_hash_bits); i++) { - int rc; - -- hlist_for_each_entry(daemon, -- &ecryptfs_daemon_hash[i], -- euid_chain) { -+ hlist_for_each_entry_safe(daemon, n, -+ &ecryptfs_daemon_hash[i], -+ euid_chain) { - rc = ecryptfs_exorcise_daemon(daemon); - if (rc) - printk(KERN_ERR "%s: Error whilst " -diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c -index 9a1bc638abce..9308fe4b66e6 100644 ---- a/fs/ext4/crypto_key.c -+++ b/fs/ext4/crypto_key.c -@@ -129,11 +129,9 @@ int ext4_get_encryption_info(struct inode *inode) - if (ei->i_crypt_info) - return 0; - -- if (!ext4_read_workqueue) { -- res = ext4_init_crypto(); -- if (res) -- return res; -- } -+ res = ext4_init_crypto(); -+ if (res) -+ return res; - - res = ext4_xattr_get(inode, EXT4_XATTR_INDEX_ENCRYPTION, - EXT4_XATTR_NAME_ENCRYPTION_CONTEXT, -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 61d5bfc7318c..31a3e480d484 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4818,7 +4818,8 @@ static long ext4_zero_range(struct file *file, loff_t offset, - } - - if (!(mode & FALLOC_FL_KEEP_SIZE) && -- offset + len > i_size_read(inode)) { -+ (offset + len > i_size_read(inode) || -+ offset + len > EXT4_I(inode)->i_disksize)) { - new_size = offset + len; - ret = inode_newsize_ok(inode, new_size); - if (ret) -@@ -4994,7 +4995,8 @@ long ext4_fallocate(struct file *file, int mode, loff_t offset, loff_t len) - } - - if (!(mode & FALLOC_FL_KEEP_SIZE) && -- offset + len > i_size_read(inode)) { -+ (offset + len > i_size_read(inode) || -+ offset + len > EXT4_I(inode)->i_disksize)) { - new_size = offset + len; - ret = inode_newsize_ok(inode, new_size); - if (ret) -diff --git a/fs/isofs/isofs.h b/fs/isofs/isofs.h -index 0ac4c1f73fbd..25177e6bd603 100644 ---- a/fs/isofs/isofs.h -+++ b/fs/isofs/isofs.h -@@ -103,7 +103,7 @@ static inline unsigned int isonum_733(char *p) - /* Ignore bigendian datum due to broken mastering programs */ - return get_unaligned_le32(p); - } --extern int iso_date(char *, int); -+extern int iso_date(u8 *, int); - - struct inode; /* To make gcc happy */ - -diff --git a/fs/isofs/rock.h b/fs/isofs/rock.h -index ed09e2b08637..f835976ce033 100644 ---- a/fs/isofs/rock.h -+++ b/fs/isofs/rock.h -@@ -65,7 +65,7 @@ struct RR_PL_s { - }; - - struct stamp { -- char time[7]; -+ __u8 time[7]; /* actually 6 unsigned, 1 signed */ - } __attribute__ ((packed)); - - struct RR_TF_s { -diff --git a/fs/isofs/util.c b/fs/isofs/util.c -index 005a15cfd30a..37860fea364d 100644 ---- a/fs/isofs/util.c -+++ b/fs/isofs/util.c -@@ -15,7 +15,7 @@ - * to GMT. Thus we should always be correct. - */ - --int iso_date(char * p, int flag) -+int iso_date(u8 *p, int flag) - { - int year, month, day, hour, minute, second, tz; - int crtime; -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 8e425f2c5ddd..6fef53f18dcf 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -242,15 +242,12 @@ const u32 nfs4_fsinfo_bitmap[3] = { FATTR4_WORD0_MAXFILESIZE - }; - - const u32 nfs4_fs_locations_bitmap[3] = { -- FATTR4_WORD0_TYPE -- | FATTR4_WORD0_CHANGE -+ FATTR4_WORD0_CHANGE - | FATTR4_WORD0_SIZE - | FATTR4_WORD0_FSID - | FATTR4_WORD0_FILEID - | FATTR4_WORD0_FS_LOCATIONS, -- FATTR4_WORD1_MODE -- | FATTR4_WORD1_NUMLINKS -- | FATTR4_WORD1_OWNER -+ FATTR4_WORD1_OWNER - | FATTR4_WORD1_OWNER_GROUP - | FATTR4_WORD1_RAWDEV - | FATTR4_WORD1_SPACE_USED -@@ -6351,9 +6348,7 @@ static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir, - struct page *page) - { - struct nfs_server *server = NFS_SERVER(dir); -- u32 bitmask[3] = { -- [0] = FATTR4_WORD0_FSID | FATTR4_WORD0_FS_LOCATIONS, -- }; -+ u32 bitmask[3]; - struct nfs4_fs_locations_arg args = { - .dir_fh = NFS_FH(dir), - .name = name, -@@ -6372,12 +6367,15 @@ static int _nfs4_proc_fs_locations(struct rpc_clnt *client, struct inode *dir, - - dprintk("%s: start\n", __func__); - -+ bitmask[0] = nfs4_fattr_bitmap[0] | FATTR4_WORD0_FS_LOCATIONS; -+ bitmask[1] = nfs4_fattr_bitmap[1]; -+ - /* Ask for the fileid of the absent filesystem if mounted_on_fileid - * is not supported */ - if (NFS_SERVER(dir)->attr_bitmask[1] & FATTR4_WORD1_MOUNTED_ON_FILEID) -- bitmask[1] |= FATTR4_WORD1_MOUNTED_ON_FILEID; -+ bitmask[0] &= ~FATTR4_WORD0_FILEID; - else -- bitmask[0] |= FATTR4_WORD0_FILEID; -+ bitmask[1] &= ~FATTR4_WORD1_MOUNTED_ON_FILEID; - - nfs_fattr_init(&fs_locations->fattr); - fs_locations->server = server; -diff --git a/fs/nfs/super.c b/fs/nfs/super.c -index f1268280244e..3149f7e58d6f 100644 ---- a/fs/nfs/super.c -+++ b/fs/nfs/super.c -@@ -1322,7 +1322,7 @@ static int nfs_parse_mount_options(char *raw, - mnt->options |= NFS_OPTION_MIGRATION; - break; - case Opt_nomigration: -- mnt->options &= NFS_OPTION_MIGRATION; -+ mnt->options &= ~NFS_OPTION_MIGRATION; - break; - - /* -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index ca9ebc3242d3..421935f3d909 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -3829,7 +3829,8 @@ static struct nfs4_delegation *find_deleg_stateid(struct nfs4_client *cl, statei - { - struct nfs4_stid *ret; - -- ret = find_stateid_by_type(cl, s, NFS4_DELEG_STID); -+ ret = find_stateid_by_type(cl, s, -+ NFS4_DELEG_STID|NFS4_REVOKED_DELEG_STID); - if (!ret) - return NULL; - return delegstateid(ret); -@@ -3852,6 +3853,12 @@ nfs4_check_deleg(struct nfs4_client *cl, struct nfsd4_open *open, - deleg = find_deleg_stateid(cl, &open->op_delegate_stateid); - if (deleg == NULL) - goto out; -+ if (deleg->dl_stid.sc_type == NFS4_REVOKED_DELEG_STID) { -+ nfs4_put_stid(&deleg->dl_stid); -+ if (cl->cl_minorversion) -+ status = nfserr_deleg_revoked; -+ goto out; -+ } - flags = share_access_to_flags(open->op_share_access); - status = nfs4_check_delegmode(deleg, flags); - if (status) { -@@ -4696,6 +4703,16 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, - struct nfs4_stid **s, struct nfsd_net *nn) - { - __be32 status; -+ bool return_revoked = false; -+ -+ /* -+ * only return revoked delegations if explicitly asked. -+ * otherwise we report revoked or bad_stateid status. -+ */ -+ if (typemask & NFS4_REVOKED_DELEG_STID) -+ return_revoked = true; -+ else if (typemask & NFS4_DELEG_STID) -+ typemask |= NFS4_REVOKED_DELEG_STID; - - if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) - return nfserr_bad_stateid; -@@ -4710,6 +4727,12 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, - *s = find_stateid_by_type(cstate->clp, stateid, typemask); - if (!*s) - return nfserr_bad_stateid; -+ if (((*s)->sc_type == NFS4_REVOKED_DELEG_STID) && !return_revoked) { -+ nfs4_put_stid(*s); -+ if (cstate->minorversion) -+ return nfserr_deleg_revoked; -+ return nfserr_bad_stateid; -+ } - return nfs_ok; - } - -diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c -index 2f27c935bd57..34c22fe4eca0 100644 ---- a/fs/nilfs2/segment.c -+++ b/fs/nilfs2/segment.c -@@ -1945,8 +1945,6 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci, - "failed to get inode block.\n"); - return err; - } -- mark_buffer_dirty(ibh); -- nilfs_mdt_mark_dirty(ifile); - spin_lock(&nilfs->ns_inode_lock); - if (likely(!ii->i_bh)) - ii->i_bh = ibh; -@@ -1955,6 +1953,10 @@ static int nilfs_segctor_collect_dirty_files(struct nilfs_sc_info *sci, - goto retry; - } - -+ // Always redirty the buffer to avoid race condition -+ mark_buffer_dirty(ii->i_bh); -+ nilfs_mdt_mark_dirty(ifile); -+ - clear_bit(NILFS_I_QUEUED, &ii->i_state); - set_bit(NILFS_I_BUSY, &ii->i_state); - list_move_tail(&ii->i_dirty, &sci->sc_dirty_files); -diff --git a/include/trace/events/sunrpc.h b/include/trace/events/sunrpc.h -index 5664ca07c9c7..a01a076ea060 100644 ---- a/include/trace/events/sunrpc.h -+++ b/include/trace/events/sunrpc.h -@@ -455,20 +455,22 @@ TRACE_EVENT(svc_recv, - TP_ARGS(rqst, status), - - TP_STRUCT__entry( -- __field(struct sockaddr *, addr) - __field(__be32, xid) - __field(int, status) - __field(unsigned long, flags) -+ __dynamic_array(unsigned char, addr, rqst->rq_addrlen) - ), - - TP_fast_assign( -- __entry->addr = (struct sockaddr *)&rqst->rq_addr; - __entry->xid = status > 0 ? rqst->rq_xid : 0; - __entry->status = status; - __entry->flags = rqst->rq_flags; -+ memcpy(__get_dynamic_array(addr), -+ &rqst->rq_addr, rqst->rq_addrlen); - ), - -- TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s", __entry->addr, -+ TP_printk("addr=%pIScp xid=0x%x status=%d flags=%s", -+ (struct sockaddr *)__get_dynamic_array(addr), - be32_to_cpu(__entry->xid), __entry->status, - show_rqstp_flags(__entry->flags)) - ); -@@ -480,22 +482,23 @@ DECLARE_EVENT_CLASS(svc_rqst_status, - TP_ARGS(rqst, status), - - TP_STRUCT__entry( -- __field(struct sockaddr *, addr) - __field(__be32, xid) -- __field(int, dropme) - __field(int, status) - __field(unsigned long, flags) -+ __dynamic_array(unsigned char, addr, rqst->rq_addrlen) - ), - - TP_fast_assign( -- __entry->addr = (struct sockaddr *)&rqst->rq_addr; - __entry->xid = rqst->rq_xid; - __entry->status = status; - __entry->flags = rqst->rq_flags; -+ memcpy(__get_dynamic_array(addr), -+ &rqst->rq_addr, rqst->rq_addrlen); - ), - - TP_printk("addr=%pIScp rq_xid=0x%x status=%d flags=%s", -- __entry->addr, be32_to_cpu(__entry->xid), -+ (struct sockaddr *)__get_dynamic_array(addr), -+ be32_to_cpu(__entry->xid), - __entry->status, show_rqstp_flags(__entry->flags)) - ); - -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index b5d372083624..15874a85ebcf 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -600,8 +600,7 @@ void resched_cpu(int cpu) - struct rq *rq = cpu_rq(cpu); - unsigned long flags; - -- if (!raw_spin_trylock_irqsave(&rq->lock, flags)) -- return; -+ raw_spin_lock_irqsave(&rq->lock, flags); - resched_curr(rq); - raw_spin_unlock_irqrestore(&rq->lock, flags); - } -@@ -5908,6 +5907,12 @@ static int init_rootdomain(struct root_domain *rd) - if (!zalloc_cpumask_var(&rd->rto_mask, GFP_KERNEL)) - goto free_dlo_mask; - -+#ifdef HAVE_RT_PUSH_IPI -+ rd->rto_cpu = -1; -+ raw_spin_lock_init(&rd->rto_lock); -+ init_irq_work(&rd->rto_push_work, rto_push_irq_work_func); -+#endif -+ - init_dl_bw(&rd->dl_bw); - if (cpudl_init(&rd->cpudl) != 0) - goto free_dlo_mask; -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 78ae5c1d9412..faa75afcb7fe 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -64,10 +64,6 @@ static void start_rt_bandwidth(struct rt_bandwidth *rt_b) - raw_spin_unlock(&rt_b->rt_runtime_lock); - } - --#if defined(CONFIG_SMP) && defined(HAVE_RT_PUSH_IPI) --static void push_irq_work_func(struct irq_work *work); --#endif -- - void init_rt_rq(struct rt_rq *rt_rq) - { - struct rt_prio_array *array; -@@ -87,13 +83,6 @@ void init_rt_rq(struct rt_rq *rt_rq) - rt_rq->rt_nr_migratory = 0; - rt_rq->overloaded = 0; - plist_head_init(&rt_rq->pushable_tasks); -- --#ifdef HAVE_RT_PUSH_IPI -- rt_rq->push_flags = 0; -- rt_rq->push_cpu = nr_cpu_ids; -- raw_spin_lock_init(&rt_rq->push_lock); -- init_irq_work(&rt_rq->push_work, push_irq_work_func); --#endif - #endif /* CONFIG_SMP */ - /* We start is dequeued state, because no RT tasks are queued */ - rt_rq->rt_queued = 0; -@@ -1802,160 +1791,166 @@ static void push_rt_tasks(struct rq *rq) - } - - #ifdef HAVE_RT_PUSH_IPI -+ - /* -- * The search for the next cpu always starts at rq->cpu and ends -- * when we reach rq->cpu again. It will never return rq->cpu. -- * This returns the next cpu to check, or nr_cpu_ids if the loop -- * is complete. -+ * When a high priority task schedules out from a CPU and a lower priority -+ * task is scheduled in, a check is made to see if there's any RT tasks -+ * on other CPUs that are waiting to run because a higher priority RT task -+ * is currently running on its CPU. In this case, the CPU with multiple RT -+ * tasks queued on it (overloaded) needs to be notified that a CPU has opened -+ * up that may be able to run one of its non-running queued RT tasks. -+ * -+ * All CPUs with overloaded RT tasks need to be notified as there is currently -+ * no way to know which of these CPUs have the highest priority task waiting -+ * to run. Instead of trying to take a spinlock on each of these CPUs, -+ * which has shown to cause large latency when done on machines with many -+ * CPUs, sending an IPI to the CPUs to have them push off the overloaded -+ * RT tasks waiting to run. -+ * -+ * Just sending an IPI to each of the CPUs is also an issue, as on large -+ * count CPU machines, this can cause an IPI storm on a CPU, especially -+ * if its the only CPU with multiple RT tasks queued, and a large number -+ * of CPUs scheduling a lower priority task at the same time. -+ * -+ * Each root domain has its own irq work function that can iterate over -+ * all CPUs with RT overloaded tasks. Since all CPUs with overloaded RT -+ * tassk must be checked if there's one or many CPUs that are lowering -+ * their priority, there's a single irq work iterator that will try to -+ * push off RT tasks that are waiting to run. -+ * -+ * When a CPU schedules a lower priority task, it will kick off the -+ * irq work iterator that will jump to each CPU with overloaded RT tasks. -+ * As it only takes the first CPU that schedules a lower priority task -+ * to start the process, the rto_start variable is incremented and if -+ * the atomic result is one, then that CPU will try to take the rto_lock. -+ * This prevents high contention on the lock as the process handles all -+ * CPUs scheduling lower priority tasks. -+ * -+ * All CPUs that are scheduling a lower priority task will increment the -+ * rt_loop_next variable. This will make sure that the irq work iterator -+ * checks all RT overloaded CPUs whenever a CPU schedules a new lower -+ * priority task, even if the iterator is in the middle of a scan. Incrementing -+ * the rt_loop_next will cause the iterator to perform another scan. - * -- * rq->rt.push_cpu holds the last cpu returned by this function, -- * or if this is the first instance, it must hold rq->cpu. - */ - static int rto_next_cpu(struct rq *rq) - { -- int prev_cpu = rq->rt.push_cpu; -+ struct root_domain *rd = rq->rd; -+ int next; - int cpu; - -- cpu = cpumask_next(prev_cpu, rq->rd->rto_mask); -- - /* -- * If the previous cpu is less than the rq's CPU, then it already -- * passed the end of the mask, and has started from the beginning. -- * We end if the next CPU is greater or equal to rq's CPU. -+ * When starting the IPI RT pushing, the rto_cpu is set to -1, -+ * rt_next_cpu() will simply return the first CPU found in -+ * the rto_mask. -+ * -+ * If rto_next_cpu() is called with rto_cpu is a valid cpu, it -+ * will return the next CPU found in the rto_mask. -+ * -+ * If there are no more CPUs left in the rto_mask, then a check is made -+ * against rto_loop and rto_loop_next. rto_loop is only updated with -+ * the rto_lock held, but any CPU may increment the rto_loop_next -+ * without any locking. - */ -- if (prev_cpu < rq->cpu) { -- if (cpu >= rq->cpu) -- return nr_cpu_ids; -+ for (;;) { - -- } else if (cpu >= nr_cpu_ids) { -- /* -- * We passed the end of the mask, start at the beginning. -- * If the result is greater or equal to the rq's CPU, then -- * the loop is finished. -- */ -- cpu = cpumask_first(rq->rd->rto_mask); -- if (cpu >= rq->cpu) -- return nr_cpu_ids; -- } -- rq->rt.push_cpu = cpu; -+ /* When rto_cpu is -1 this acts like cpumask_first() */ -+ cpu = cpumask_next(rd->rto_cpu, rd->rto_mask); - -- /* Return cpu to let the caller know if the loop is finished or not */ -- return cpu; --} -+ rd->rto_cpu = cpu; - --static int find_next_push_cpu(struct rq *rq) --{ -- struct rq *next_rq; -- int cpu; -+ if (cpu < nr_cpu_ids) -+ return cpu; - -- while (1) { -- cpu = rto_next_cpu(rq); -- if (cpu >= nr_cpu_ids) -- break; -- next_rq = cpu_rq(cpu); -+ rd->rto_cpu = -1; - -- /* Make sure the next rq can push to this rq */ -- if (next_rq->rt.highest_prio.next < rq->rt.highest_prio.curr) -+ /* -+ * ACQUIRE ensures we see the @rto_mask changes -+ * made prior to the @next value observed. -+ * -+ * Matches WMB in rt_set_overload(). -+ */ -+ next = atomic_read_acquire(&rd->rto_loop_next); -+ -+ if (rd->rto_loop == next) - break; -+ -+ rd->rto_loop = next; - } - -- return cpu; -+ return -1; -+} -+ -+static inline bool rto_start_trylock(atomic_t *v) -+{ -+ return !atomic_cmpxchg_acquire(v, 0, 1); - } - --#define RT_PUSH_IPI_EXECUTING 1 --#define RT_PUSH_IPI_RESTART 2 -+static inline void rto_start_unlock(atomic_t *v) -+{ -+ atomic_set_release(v, 0); -+} - - static void tell_cpu_to_push(struct rq *rq) - { -- int cpu; -+ int cpu = -1; - -- if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) { -- raw_spin_lock(&rq->rt.push_lock); -- /* Make sure it's still executing */ -- if (rq->rt.push_flags & RT_PUSH_IPI_EXECUTING) { -- /* -- * Tell the IPI to restart the loop as things have -- * changed since it started. -- */ -- rq->rt.push_flags |= RT_PUSH_IPI_RESTART; -- raw_spin_unlock(&rq->rt.push_lock); -- return; -- } -- raw_spin_unlock(&rq->rt.push_lock); -- } -+ /* Keep the loop going if the IPI is currently active */ -+ atomic_inc(&rq->rd->rto_loop_next); - -- /* When here, there's no IPI going around */ -- -- rq->rt.push_cpu = rq->cpu; -- cpu = find_next_push_cpu(rq); -- if (cpu >= nr_cpu_ids) -+ /* Only one CPU can initiate a loop at a time */ -+ if (!rto_start_trylock(&rq->rd->rto_loop_start)) - return; - -- rq->rt.push_flags = RT_PUSH_IPI_EXECUTING; -+ raw_spin_lock(&rq->rd->rto_lock); -+ -+ /* -+ * The rto_cpu is updated under the lock, if it has a valid cpu -+ * then the IPI is still running and will continue due to the -+ * update to loop_next, and nothing needs to be done here. -+ * Otherwise it is finishing up and an ipi needs to be sent. -+ */ -+ if (rq->rd->rto_cpu < 0) -+ cpu = rto_next_cpu(rq); -+ -+ raw_spin_unlock(&rq->rd->rto_lock); - -- irq_work_queue_on(&rq->rt.push_work, cpu); -+ rto_start_unlock(&rq->rd->rto_loop_start); -+ -+ if (cpu >= 0) -+ irq_work_queue_on(&rq->rd->rto_push_work, cpu); - } - - /* Called from hardirq context */ --static void try_to_push_tasks(void *arg) -+void rto_push_irq_work_func(struct irq_work *work) - { -- struct rt_rq *rt_rq = arg; -- struct rq *rq, *src_rq; -- int this_cpu; -+ struct rq *rq; - int cpu; - -- this_cpu = rt_rq->push_cpu; -+ rq = this_rq(); - -- /* Paranoid check */ -- BUG_ON(this_cpu != smp_processor_id()); -- -- rq = cpu_rq(this_cpu); -- src_rq = rq_of_rt_rq(rt_rq); -- --again: -+ /* -+ * We do not need to grab the lock to check for has_pushable_tasks. -+ * When it gets updated, a check is made if a push is possible. -+ */ - if (has_pushable_tasks(rq)) { - raw_spin_lock(&rq->lock); -- push_rt_task(rq); -+ push_rt_tasks(rq); - raw_spin_unlock(&rq->lock); - } - -- /* Pass the IPI to the next rt overloaded queue */ -- raw_spin_lock(&rt_rq->push_lock); -- /* -- * If the source queue changed since the IPI went out, -- * we need to restart the search from that CPU again. -- */ -- if (rt_rq->push_flags & RT_PUSH_IPI_RESTART) { -- rt_rq->push_flags &= ~RT_PUSH_IPI_RESTART; -- rt_rq->push_cpu = src_rq->cpu; -- } -+ raw_spin_lock(&rq->rd->rto_lock); - -- cpu = find_next_push_cpu(src_rq); -+ /* Pass the IPI to the next rt overloaded queue */ -+ cpu = rto_next_cpu(rq); - -- if (cpu >= nr_cpu_ids) -- rt_rq->push_flags &= ~RT_PUSH_IPI_EXECUTING; -- raw_spin_unlock(&rt_rq->push_lock); -+ raw_spin_unlock(&rq->rd->rto_lock); - -- if (cpu >= nr_cpu_ids) -+ if (cpu < 0) - return; - -- /* -- * It is possible that a restart caused this CPU to be -- * chosen again. Don't bother with an IPI, just see if we -- * have more to push. -- */ -- if (unlikely(cpu == rq->cpu)) -- goto again; -- - /* Try the next RT overloaded CPU */ -- irq_work_queue_on(&rt_rq->push_work, cpu); --} -- --static void push_irq_work_func(struct irq_work *work) --{ -- struct rt_rq *rt_rq = container_of(work, struct rt_rq, push_work); -- -- try_to_push_tasks(rt_rq); -+ irq_work_queue_on(&rq->rd->rto_push_work, cpu); - } - #endif /* HAVE_RT_PUSH_IPI */ - -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 55d92a1ca070..448a8266ceea 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -429,7 +429,7 @@ static inline int rt_bandwidth_enabled(void) - } - - /* RT IPI pull logic requires IRQ_WORK */ --#ifdef CONFIG_IRQ_WORK -+#if defined(CONFIG_IRQ_WORK) && defined(CONFIG_SMP) - # define HAVE_RT_PUSH_IPI - #endif - -@@ -450,12 +450,6 @@ struct rt_rq { - unsigned long rt_nr_total; - int overloaded; - struct plist_head pushable_tasks; --#ifdef HAVE_RT_PUSH_IPI -- int push_flags; -- int push_cpu; -- struct irq_work push_work; -- raw_spinlock_t push_lock; --#endif - #endif /* CONFIG_SMP */ - int rt_queued; - -@@ -537,6 +531,19 @@ struct root_domain { - struct dl_bw dl_bw; - struct cpudl cpudl; - -+#ifdef HAVE_RT_PUSH_IPI -+ /* -+ * For IPI pull requests, loop across the rto_mask. -+ */ -+ struct irq_work rto_push_work; -+ raw_spinlock_t rto_lock; -+ /* These are only updated and read within rto_lock */ -+ int rto_loop; -+ int rto_cpu; -+ /* These atomics are updated outside of a lock */ -+ atomic_t rto_loop_next; -+ atomic_t rto_loop_start; -+#endif - /* - * The "RT overload" flag: it gets set if a CPU has more than - * one runnable RT task. -@@ -547,6 +554,9 @@ struct root_domain { - - extern struct root_domain def_root_domain; - -+#ifdef HAVE_RT_PUSH_IPI -+extern void rto_push_irq_work_func(struct irq_work *work); -+#endif - #endif /* CONFIG_SMP */ - - /* -diff --git a/lib/mpi/mpi-pow.c b/lib/mpi/mpi-pow.c -index e24388a863a7..468fb7cd1221 100644 ---- a/lib/mpi/mpi-pow.c -+++ b/lib/mpi/mpi-pow.c -@@ -26,6 +26,7 @@ - * however I decided to publish this code under the plain GPL. - */ - -+#include - #include - #include "mpi-internal.h" - #include "longlong.h" -@@ -256,6 +257,7 @@ int mpi_powm(MPI res, MPI base, MPI exp, MPI mod) - } - e <<= 1; - c--; -+ cond_resched(); - } - - i--; -diff --git a/net/9p/client.c b/net/9p/client.c -index f5feac4ff4ec..3ff26eb1ea20 100644 ---- a/net/9p/client.c -+++ b/net/9p/client.c -@@ -749,8 +749,7 @@ p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...) - } - again: - /* Wait for the response */ -- err = wait_event_interruptible(*req->wq, -- req->status >= REQ_STATUS_RCVD); -+ err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD); - - /* - * Make sure our req is coherent with regard to updates in other -diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c -index 6e70ddb158b4..2ddeecca5b12 100644 ---- a/net/9p/trans_virtio.c -+++ b/net/9p/trans_virtio.c -@@ -290,8 +290,8 @@ req_retry: - if (err == -ENOSPC) { - chan->ring_bufs_avail = 0; - spin_unlock_irqrestore(&chan->lock, flags); -- err = wait_event_interruptible(*chan->vc_wq, -- chan->ring_bufs_avail); -+ err = wait_event_killable(*chan->vc_wq, -+ chan->ring_bufs_avail); - if (err == -ERESTARTSYS) - return err; - -@@ -331,7 +331,7 @@ static int p9_get_mapped_pages(struct virtio_chan *chan, - * Other zc request to finish here - */ - if (atomic_read(&vp_pinned) >= chan->p9_max_pages) { -- err = wait_event_interruptible(vp_wq, -+ err = wait_event_killable(vp_wq, - (atomic_read(&vp_pinned) < chan->p9_max_pages)); - if (err == -ERESTARTSYS) - return err; -@@ -475,8 +475,8 @@ req_retry_pinned: - if (err == -ENOSPC) { - chan->ring_bufs_avail = 0; - spin_unlock_irqrestore(&chan->lock, flags); -- err = wait_event_interruptible(*chan->vc_wq, -- chan->ring_bufs_avail); -+ err = wait_event_killable(*chan->vc_wq, -+ chan->ring_bufs_avail); - if (err == -ERESTARTSYS) - goto err_out; - -@@ -493,8 +493,7 @@ req_retry_pinned: - virtqueue_kick(chan->vq); - spin_unlock_irqrestore(&chan->lock, flags); - p9_debug(P9_DEBUG_TRANS, "virtio request kicked\n"); -- err = wait_event_interruptible(*req->wq, -- req->status >= REQ_STATUS_RCVD); -+ err = wait_event_killable(*req->wq, req->status >= REQ_STATUS_RCVD); - /* - * Non kernel buffers are pinned, unpin them - */ -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index f300d1cbfa91..097a1243c16c 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -808,6 +808,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, - { - struct ip_mreqn mreq; - struct net_device *dev = NULL; -+ int midx; - - if (sk->sk_type == SOCK_STREAM) - goto e_inval; -@@ -852,11 +853,15 @@ static int do_ip_setsockopt(struct sock *sk, int level, - err = -EADDRNOTAVAIL; - if (!dev) - break; -+ -+ midx = l3mdev_master_ifindex(dev); -+ - dev_put(dev); - - err = -EINVAL; - if (sk->sk_bound_dev_if && -- mreq.imr_ifindex != sk->sk_bound_dev_if) -+ mreq.imr_ifindex != sk->sk_bound_dev_if && -+ (!midx || midx != sk->sk_bound_dev_if)) - break; - - inet->mc_index = mreq.imr_ifindex; -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 4449ad1f8114..a4a30d2ca66f 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -583,16 +583,24 @@ done: - - if (val) { - struct net_device *dev; -+ int midx; - -- if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != val) -- goto e_inval; -+ rcu_read_lock(); - -- dev = dev_get_by_index(net, val); -+ dev = dev_get_by_index_rcu(net, val); - if (!dev) { -+ rcu_read_unlock(); - retv = -ENODEV; - break; - } -- dev_put(dev); -+ midx = l3mdev_master_ifindex_rcu(dev); -+ -+ rcu_read_unlock(); -+ -+ if (sk->sk_bound_dev_if && -+ sk->sk_bound_dev_if != val && -+ (!midx || midx != sk->sk_bound_dev_if)) -+ goto e_inval; - } - np->mcast_oif = val; - retv = 0; -diff --git a/net/ipv6/route.c b/net/ipv6/route.c -index 48917437550e..7336a7311038 100644 ---- a/net/ipv6/route.c -+++ b/net/ipv6/route.c -@@ -3378,7 +3378,11 @@ static int ip6_route_dev_notify(struct notifier_block *this, - net->ipv6.ip6_blk_hole_entry->dst.dev = dev; - net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev); - #endif -- } else if (event == NETDEV_UNREGISTER) { -+ } else if (event == NETDEV_UNREGISTER && -+ dev->reg_state != NETREG_UNREGISTERED) { -+ /* NETDEV_UNREGISTER could be fired for multiple times by -+ * netdev_wait_allrefs(). Make sure we only call this once. -+ */ - in6_dev_put(net->ipv6.ip6_null_entry->rt6i_idev); - #ifdef CONFIG_IPV6_MULTIPLE_TABLES - in6_dev_put(net->ipv6.ip6_prohibit_entry->rt6i_idev); -diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h -index 6837a46ca4a2..7b271f3ded6b 100644 ---- a/net/mac80211/ieee80211_i.h -+++ b/net/mac80211/ieee80211_i.h -@@ -682,7 +682,6 @@ struct ieee80211_if_mesh { - const struct ieee80211_mesh_sync_ops *sync_ops; - s64 sync_offset_clockdrift_max; - spinlock_t sync_offset_lock; -- bool adjusting_tbtt; - /* mesh power save */ - enum nl80211_mesh_power_mode nonpeer_pm; - int ps_peers_light_sleep; -diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c -index 9063e8e736ad..9e1ded80a992 100644 ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -295,8 +295,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata, - /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ - *pos |= ifmsh->ps_peers_deep_sleep ? - IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00; -- *pos++ |= ifmsh->adjusting_tbtt ? -- IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING : 0x00; - *pos++ = 0x00; - - return 0; -@@ -866,7 +864,6 @@ int ieee80211_start_mesh(struct ieee80211_sub_if_data *sdata) - ifmsh->mesh_cc_id = 0; /* Disabled */ - /* register sync ops from extensible synchronization framework */ - ifmsh->sync_ops = ieee80211_mesh_sync_ops_get(ifmsh->mesh_sp_id); -- ifmsh->adjusting_tbtt = false; - ifmsh->sync_offset_clockdrift_max = 0; - set_bit(MESH_WORK_HOUSEKEEPING, &ifmsh->wrkq_flags); - ieee80211_mesh_root_setup(ifmsh); -diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c -index bd3d55eb21d4..9f02e54ad2a5 100644 ---- a/net/mac80211/mesh_plink.c -+++ b/net/mac80211/mesh_plink.c -@@ -495,12 +495,14 @@ mesh_sta_info_alloc(struct ieee80211_sub_if_data *sdata, u8 *addr, - - /* Userspace handles station allocation */ - if (sdata->u.mesh.user_mpm || -- sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) -- cfg80211_notify_new_peer_candidate(sdata->dev, addr, -- elems->ie_start, -- elems->total_len, -- GFP_KERNEL); -- else -+ sdata->u.mesh.security & IEEE80211_MESH_SEC_AUTHED) { -+ if (mesh_peer_accepts_plinks(elems) && -+ mesh_plink_availables(sdata)) -+ cfg80211_notify_new_peer_candidate(sdata->dev, addr, -+ elems->ie_start, -+ elems->total_len, -+ GFP_KERNEL); -+ } else - sta = __mesh_sta_info_alloc(sdata, addr); - - return sta; -diff --git a/net/mac80211/mesh_sync.c b/net/mac80211/mesh_sync.c -index 64bc22ad9496..16ed43fe4841 100644 ---- a/net/mac80211/mesh_sync.c -+++ b/net/mac80211/mesh_sync.c -@@ -119,7 +119,6 @@ static void mesh_sync_offset_rx_bcn_presp(struct ieee80211_sub_if_data *sdata, - */ - - if (elems->mesh_config && mesh_peer_tbtt_adjusting(elems)) { -- clear_sta_flag(sta, WLAN_STA_TOFFSET_KNOWN); - msync_dbg(sdata, "STA %pM : is adjusting TBTT\n", - sta->sta.addr); - goto no_sync; -@@ -168,11 +167,9 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata, - struct beacon_data *beacon) - { - struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; -- u8 cap; - - WARN_ON(ifmsh->mesh_sp_id != IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET); - WARN_ON(!rcu_read_lock_held()); -- cap = beacon->meshconf->meshconf_cap; - - spin_lock_bh(&ifmsh->sync_offset_lock); - -@@ -186,21 +183,13 @@ static void mesh_sync_offset_adjust_tbtt(struct ieee80211_sub_if_data *sdata, - "TBTT : kicking off TBTT adjustment with clockdrift_max=%lld\n", - ifmsh->sync_offset_clockdrift_max); - set_bit(MESH_WORK_DRIFT_ADJUST, &ifmsh->wrkq_flags); -- -- ifmsh->adjusting_tbtt = true; - } else { - msync_dbg(sdata, - "TBTT : max clockdrift=%lld; too small to adjust\n", - (long long)ifmsh->sync_offset_clockdrift_max); - ifmsh->sync_offset_clockdrift_max = 0; -- -- ifmsh->adjusting_tbtt = false; - } - spin_unlock_bh(&ifmsh->sync_offset_lock); -- -- beacon->meshconf->meshconf_cap = ifmsh->adjusting_tbtt ? -- IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING | cap : -- ~IEEE80211_MESHCONF_CAPAB_TBTT_ADJUSTING & cap; - } - - static const struct sync_method sync_methods[] = { -diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c -index 2cb429d34c03..120e9ae04db3 100644 ---- a/net/netfilter/nf_tables_api.c -+++ b/net/netfilter/nf_tables_api.c -@@ -1996,7 +1996,7 @@ static void nf_tables_rule_destroy(const struct nft_ctx *ctx, - * is called on error from nf_tables_newrule(). - */ - expr = nft_expr_first(rule); -- while (expr->ops && expr != nft_expr_last(rule)) { -+ while (expr != nft_expr_last(rule) && expr->ops) { - nf_tables_expr_destroy(ctx, expr); - expr = nft_expr_next(expr); - } -diff --git a/net/netfilter/nft_queue.c b/net/netfilter/nft_queue.c -index 61d216eb7917..5d189c11d208 100644 ---- a/net/netfilter/nft_queue.c -+++ b/net/netfilter/nft_queue.c -@@ -37,7 +37,7 @@ static void nft_queue_eval(const struct nft_expr *expr, - - if (priv->queues_total > 1) { - if (priv->flags & NFT_QUEUE_FLAG_CPU_FANOUT) { -- int cpu = smp_processor_id(); -+ int cpu = raw_smp_processor_id(); - - queue = priv->queuenum + cpu % priv->queues_total; - } else { -diff --git a/net/nfc/core.c b/net/nfc/core.c -index c5a2c7e733b3..1471e4b0aa2c 100644 ---- a/net/nfc/core.c -+++ b/net/nfc/core.c -@@ -1093,7 +1093,7 @@ struct nfc_dev *nfc_allocate_device(struct nfc_ops *ops, - err_free_dev: - kfree(dev); - -- return ERR_PTR(rc); -+ return NULL; - } - EXPORT_SYMBOL(nfc_allocate_device); - -diff --git a/net/rds/send.c b/net/rds/send.c -index 6815f03324d7..1a3c6acdd3f8 100644 ---- a/net/rds/send.c -+++ b/net/rds/send.c -@@ -959,6 +959,11 @@ static int rds_cmsg_send(struct rds_sock *rs, struct rds_message *rm, - ret = rds_cmsg_rdma_map(rs, rm, cmsg); - if (!ret) - *allocated_mr = 1; -+ else if (ret == -ENODEV) -+ /* Accommodate the get_mr() case which can fail -+ * if connection isn't established yet. -+ */ -+ ret = -EAGAIN; - break; - case RDS_CMSG_ATOMIC_CSWP: - case RDS_CMSG_ATOMIC_FADD: -@@ -1072,8 +1077,12 @@ int rds_sendmsg(struct socket *sock, struct msghdr *msg, size_t payload_len) - - /* Parse any control messages the user may have included. */ - ret = rds_cmsg_send(rs, rm, msg, &allocated_mr); -- if (ret) -+ if (ret) { -+ /* Trigger connection so that its ready for the next retry */ -+ if (ret == -EAGAIN) -+ rds_conn_connect_if_down(conn); - goto out; -+ } - - if (rm->rdma.op_active && !conn->c_trans->xmit_rdma) { - printk_ratelimited(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n", -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 272edd7748a0..7f0f689b8d2b 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4453,10 +4453,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - struct socket *sock; - int err = 0; - -- /* Do not peel off from one netns to another one. */ -- if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) -- return -EINVAL; -- - /* Do not peel off from one netns to another one. */ - if (!net_eq(current->nsproxy->net_ns, sock_net(sk))) - return -EINVAL; -diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c -index 9b5bd6d142dc..60324f7c72bd 100644 ---- a/net/vmw_vsock/af_vsock.c -+++ b/net/vmw_vsock/af_vsock.c -@@ -1209,10 +1209,14 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, - - if (signal_pending(current)) { - err = sock_intr_errno(timeout); -- goto out_wait_error; -+ sk->sk_state = SS_UNCONNECTED; -+ sock->state = SS_UNCONNECTED; -+ goto out_wait; - } else if (timeout == 0) { - err = -ETIMEDOUT; -- goto out_wait_error; -+ sk->sk_state = SS_UNCONNECTED; -+ sock->state = SS_UNCONNECTED; -+ goto out_wait; - } - - prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); -@@ -1220,20 +1224,17 @@ static int vsock_stream_connect(struct socket *sock, struct sockaddr *addr, - - if (sk->sk_err) { - err = -sk->sk_err; -- goto out_wait_error; -- } else -+ sk->sk_state = SS_UNCONNECTED; -+ sock->state = SS_UNCONNECTED; -+ } else { - err = 0; -+ } - - out_wait: - finish_wait(sk_sleep(sk), &wait); - out: - release_sock(sk); - return err; -- --out_wait_error: -- sk->sk_state = SS_UNCONNECTED; -- sock->state = SS_UNCONNECTED; -- goto out_wait; - } - - static int vsock_accept(struct socket *sock, struct socket *newsock, int flags) -@@ -1270,18 +1271,20 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags) - listener->sk_err == 0) { - release_sock(listener); - timeout = schedule_timeout(timeout); -+ finish_wait(sk_sleep(listener), &wait); - lock_sock(listener); - - if (signal_pending(current)) { - err = sock_intr_errno(timeout); -- goto out_wait; -+ goto out; - } else if (timeout == 0) { - err = -EAGAIN; -- goto out_wait; -+ goto out; - } - - prepare_to_wait(sk_sleep(listener), &wait, TASK_INTERRUPTIBLE); - } -+ finish_wait(sk_sleep(listener), &wait); - - if (listener->sk_err) - err = -listener->sk_err; -@@ -1301,19 +1304,15 @@ static int vsock_accept(struct socket *sock, struct socket *newsock, int flags) - */ - if (err) { - vconnected->rejected = true; -- release_sock(connected); -- sock_put(connected); -- goto out_wait; -+ } else { -+ newsock->state = SS_CONNECTED; -+ sock_graft(connected, newsock); - } - -- newsock->state = SS_CONNECTED; -- sock_graft(connected, newsock); - release_sock(connected); - sock_put(connected); - } - --out_wait: -- finish_wait(sk_sleep(listener), &wait); - out: - release_sock(listener); - return err; -@@ -1513,8 +1512,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - long timeout; - int err; - struct vsock_transport_send_notify_data send_data; -- -- DEFINE_WAIT(wait); -+ DEFINE_WAIT_FUNC(wait, woken_wake_function); - - sk = sock->sk; - vsk = vsock_sk(sk); -@@ -1557,11 +1555,10 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - if (err < 0) - goto out; - -- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); -- - while (total_written < len) { - ssize_t written; - -+ add_wait_queue(sk_sleep(sk), &wait); - while (vsock_stream_has_space(vsk) == 0 && - sk->sk_err == 0 && - !(sk->sk_shutdown & SEND_SHUTDOWN) && -@@ -1570,27 +1567,30 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - /* Don't wait for non-blocking sockets. */ - if (timeout == 0) { - err = -EAGAIN; -- goto out_wait; -+ remove_wait_queue(sk_sleep(sk), &wait); -+ goto out_err; - } - - err = transport->notify_send_pre_block(vsk, &send_data); -- if (err < 0) -- goto out_wait; -+ if (err < 0) { -+ remove_wait_queue(sk_sleep(sk), &wait); -+ goto out_err; -+ } - - release_sock(sk); -- timeout = schedule_timeout(timeout); -+ timeout = wait_woken(&wait, TASK_INTERRUPTIBLE, timeout); - lock_sock(sk); - if (signal_pending(current)) { - err = sock_intr_errno(timeout); -- goto out_wait; -+ remove_wait_queue(sk_sleep(sk), &wait); -+ goto out_err; - } else if (timeout == 0) { - err = -EAGAIN; -- goto out_wait; -+ remove_wait_queue(sk_sleep(sk), &wait); -+ goto out_err; - } -- -- prepare_to_wait(sk_sleep(sk), &wait, -- TASK_INTERRUPTIBLE); - } -+ remove_wait_queue(sk_sleep(sk), &wait); - - /* These checks occur both as part of and after the loop - * conditional since we need to check before and after -@@ -1598,16 +1598,16 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - */ - if (sk->sk_err) { - err = -sk->sk_err; -- goto out_wait; -+ goto out_err; - } else if ((sk->sk_shutdown & SEND_SHUTDOWN) || - (vsk->peer_shutdown & RCV_SHUTDOWN)) { - err = -EPIPE; -- goto out_wait; -+ goto out_err; - } - - err = transport->notify_send_pre_enqueue(vsk, &send_data); - if (err < 0) -- goto out_wait; -+ goto out_err; - - /* Note that enqueue will only write as many bytes as are free - * in the produce queue, so we don't need to ensure len is -@@ -1620,7 +1620,7 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - len - total_written); - if (written < 0) { - err = -ENOMEM; -- goto out_wait; -+ goto out_err; - } - - total_written += written; -@@ -1628,14 +1628,13 @@ static int vsock_stream_sendmsg(struct socket *sock, struct msghdr *msg, - err = transport->notify_send_post_enqueue( - vsk, written, &send_data); - if (err < 0) -- goto out_wait; -+ goto out_err; - - } - --out_wait: -+out_err: - if (total_written > 0) - err = total_written; -- finish_wait(sk_sleep(sk), &wait); - out: - release_sock(sk); - return err; -@@ -1716,21 +1715,61 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - if (err < 0) - goto out; - -- prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); - - while (1) { -- s64 ready = vsock_stream_has_data(vsk); -+ s64 ready; - -- if (ready < 0) { -- /* Invalid queue pair content. XXX This should be -- * changed to a connection reset in a later change. -- */ -+ prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE); -+ ready = vsock_stream_has_data(vsk); - -- err = -ENOMEM; -- goto out_wait; -- } else if (ready > 0) { -+ if (ready == 0) { -+ if (sk->sk_err != 0 || -+ (sk->sk_shutdown & RCV_SHUTDOWN) || -+ (vsk->peer_shutdown & SEND_SHUTDOWN)) { -+ finish_wait(sk_sleep(sk), &wait); -+ break; -+ } -+ /* Don't wait for non-blocking sockets. */ -+ if (timeout == 0) { -+ err = -EAGAIN; -+ finish_wait(sk_sleep(sk), &wait); -+ break; -+ } -+ -+ err = transport->notify_recv_pre_block( -+ vsk, target, &recv_data); -+ if (err < 0) { -+ finish_wait(sk_sleep(sk), &wait); -+ break; -+ } -+ release_sock(sk); -+ timeout = schedule_timeout(timeout); -+ lock_sock(sk); -+ -+ if (signal_pending(current)) { -+ err = sock_intr_errno(timeout); -+ finish_wait(sk_sleep(sk), &wait); -+ break; -+ } else if (timeout == 0) { -+ err = -EAGAIN; -+ finish_wait(sk_sleep(sk), &wait); -+ break; -+ } -+ } else { - ssize_t read; - -+ finish_wait(sk_sleep(sk), &wait); -+ -+ if (ready < 0) { -+ /* Invalid queue pair content. XXX This should -+ * be changed to a connection reset in a later -+ * change. -+ */ -+ -+ err = -ENOMEM; -+ goto out; -+ } -+ - err = transport->notify_recv_pre_dequeue( - vsk, target, &recv_data); - if (err < 0) -@@ -1750,42 +1789,12 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - vsk, target, read, - !(flags & MSG_PEEK), &recv_data); - if (err < 0) -- goto out_wait; -+ goto out; - - if (read >= target || flags & MSG_PEEK) - break; - - target -= read; -- } else { -- if (sk->sk_err != 0 || (sk->sk_shutdown & RCV_SHUTDOWN) -- || (vsk->peer_shutdown & SEND_SHUTDOWN)) { -- break; -- } -- /* Don't wait for non-blocking sockets. */ -- if (timeout == 0) { -- err = -EAGAIN; -- break; -- } -- -- err = transport->notify_recv_pre_block( -- vsk, target, &recv_data); -- if (err < 0) -- break; -- -- release_sock(sk); -- timeout = schedule_timeout(timeout); -- lock_sock(sk); -- -- if (signal_pending(current)) { -- err = sock_intr_errno(timeout); -- break; -- } else if (timeout == 0) { -- err = -EAGAIN; -- break; -- } -- -- prepare_to_wait(sk_sleep(sk), &wait, -- TASK_INTERRUPTIBLE); - } - } - -@@ -1797,8 +1806,6 @@ vsock_stream_recvmsg(struct socket *sock, struct msghdr *msg, size_t len, - if (copied > 0) - err = copied; - --out_wait: -- finish_wait(sk_sleep(sk), &wait); - out: - release_sock(sk); - return err; -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 0aca39762ed0..cd20f91326fe 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -264,8 +264,10 @@ static void update_audio_tstamp(struct snd_pcm_substream *substream, - runtime->rate); - *audio_tstamp = ns_to_timespec(audio_nsecs); - } -- runtime->status->audio_tstamp = *audio_tstamp; -- runtime->status->tstamp = *curr_tstamp; -+ if (!timespec_equal(&runtime->status->audio_tstamp, audio_tstamp)) { -+ runtime->status->audio_tstamp = *audio_tstamp; -+ runtime->status->tstamp = *curr_tstamp; -+ } - - /* - * re-take a driver timestamp to let apps detect if the reference tstamp -diff --git a/sound/core/timer_compat.c b/sound/core/timer_compat.c -index 0b4b028e8e98..de9155eed727 100644 ---- a/sound/core/timer_compat.c -+++ b/sound/core/timer_compat.c -@@ -40,11 +40,11 @@ static int snd_timer_user_info_compat(struct file *file, - struct snd_timer *t; - - tu = file->private_data; -- if (snd_BUG_ON(!tu->timeri)) -- return -ENXIO; -+ if (!tu->timeri) -+ return -EBADFD; - t = tu->timeri->timer; -- if (snd_BUG_ON(!t)) -- return -ENXIO; -+ if (!t) -+ return -EBADFD; - memset(&info, 0, sizeof(info)); - info.card = t->card ? t->card->number : -1; - if (t->hw.flags & SNDRV_TIMER_HW_SLAVE) -@@ -73,8 +73,8 @@ static int snd_timer_user_status_compat(struct file *file, - struct snd_timer_status32 status; - - tu = file->private_data; -- if (snd_BUG_ON(!tu->timeri)) -- return -ENXIO; -+ if (!tu->timeri) -+ return -EBADFD; - memset(&status, 0, sizeof(status)); - status.tstamp.tv_sec = tu->tstamp.tv_sec; - status.tstamp.tv_nsec = tu->tstamp.tv_nsec; -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index e6de496bffbe..e2e08fc73b50 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2316,6 +2316,9 @@ static const struct pci_device_id azx_ids[] = { - /* AMD Hudson */ - { PCI_DEVICE(0x1022, 0x780d), - .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, -+ /* AMD Raven */ -+ { PCI_DEVICE(0x1022, 0x15e3), -+ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, - /* ATI HDMI */ - { PCI_DEVICE(0x1002, 0x0002), - .driver_data = AZX_DRIVER_ATIHDMI_NS | AZX_DCAPS_PRESET_ATI_HDMI_NS }, -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index af0962307b7f..e5730a7d0480 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4404,7 +4404,7 @@ static void alc_no_shutup(struct hda_codec *codec) - static void alc_fixup_no_shutup(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -- if (action == HDA_FIXUP_ACT_PRE_PROBE) { -+ if (action == HDA_FIXUP_ACT_PROBE) { - struct alc_spec *spec = codec->spec; - spec->shutup = alc_no_shutup; - } -@@ -6254,7 +6254,7 @@ static int patch_alc269(struct hda_codec *codec) - case 0x10ec0703: - spec->codec_variant = ALC269_TYPE_ALC700; - spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */ -- alc_update_coef_idx(codec, 0x4a, 0, 1 << 15); /* Combo jack auto trigger control */ -+ alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */ - break; - - } -diff --git a/sound/soc/codecs/wm_adsp.c b/sound/soc/codecs/wm_adsp.c -index 0bb415a28723..f1f990b325ad 100644 ---- a/sound/soc/codecs/wm_adsp.c -+++ b/sound/soc/codecs/wm_adsp.c -@@ -1060,7 +1060,7 @@ static int wm_adsp_load(struct wm_adsp *dsp) - const struct wmfw_region *region; - const struct wm_adsp_region *mem; - const char *region_name; -- char *file, *text; -+ char *file, *text = NULL; - struct wm_adsp_buf *buf; - unsigned int reg; - int regions = 0; -@@ -1221,10 +1221,21 @@ static int wm_adsp_load(struct wm_adsp *dsp) - regions, le32_to_cpu(region->len), offset, - region_name); - -+ if ((pos + le32_to_cpu(region->len) + sizeof(*region)) > -+ firmware->size) { -+ adsp_err(dsp, -+ "%s.%d: %s region len %d bytes exceeds file length %zu\n", -+ file, regions, region_name, -+ le32_to_cpu(region->len), firmware->size); -+ ret = -EINVAL; -+ goto out_fw; -+ } -+ - if (text) { - memcpy(text, region->data, le32_to_cpu(region->len)); - adsp_info(dsp, "%s: %s\n", file, text); - kfree(text); -+ text = NULL; - } - - if (reg) { -@@ -1269,6 +1280,7 @@ out_fw: - regmap_async_complete(regmap); - wm_adsp_buf_free(&buf_list); - release_firmware(firmware); -+ kfree(text); - out: - kfree(file); - -@@ -1730,6 +1742,17 @@ static int wm_adsp_load_coeff(struct wm_adsp *dsp) - } - - if (reg) { -+ if ((pos + le32_to_cpu(blk->len) + sizeof(*blk)) > -+ firmware->size) { -+ adsp_err(dsp, -+ "%s.%d: %s region len %d bytes exceeds file length %zu\n", -+ file, blocks, region_name, -+ le32_to_cpu(blk->len), -+ firmware->size); -+ ret = -EINVAL; -+ goto out_fw; -+ } -+ - buf = wm_adsp_buf_alloc(blk->data, - le32_to_cpu(blk->len), - &buf_list); -diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c -index 362446c36c9e..e00dfbec22c5 100644 ---- a/sound/soc/sh/rcar/core.c -+++ b/sound/soc/sh/rcar/core.c -@@ -1049,10 +1049,8 @@ static int __rsnd_kctrl_new(struct rsnd_mod *mod, - return -ENOMEM; - - ret = snd_ctl_add(card, kctrl); -- if (ret < 0) { -- snd_ctl_free_one(kctrl); -+ if (ret < 0) - return ret; -- } - - cfg->update = update; - cfg->card = card; -diff --git a/sound/usb/clock.c b/sound/usb/clock.c -index 7ccbcaf6a147..66294eb64501 100644 ---- a/sound/usb/clock.c -+++ b/sound/usb/clock.c -@@ -43,7 +43,7 @@ static struct uac_clock_source_descriptor * - while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra, - ctrl_iface->extralen, - cs, UAC2_CLOCK_SOURCE))) { -- if (cs->bClockID == clock_id) -+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) - return cs; - } - -@@ -59,8 +59,11 @@ static struct uac_clock_selector_descriptor * - while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra, - ctrl_iface->extralen, - cs, UAC2_CLOCK_SELECTOR))) { -- if (cs->bClockID == clock_id) -+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) { -+ if (cs->bLength < 5 + cs->bNrInPins) -+ return NULL; - return cs; -+ } - } - - return NULL; -@@ -75,7 +78,7 @@ static struct uac_clock_multiplier_descriptor * - while ((cs = snd_usb_find_csint_desc(ctrl_iface->extra, - ctrl_iface->extralen, - cs, UAC2_CLOCK_MULTIPLIER))) { -- if (cs->bClockID == clock_id) -+ if (cs->bLength >= sizeof(*cs) && cs->bClockID == clock_id) - return cs; - } - -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index a23efc8671d6..1050008d7719 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -1397,6 +1397,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, - __u8 *bmaControls; - - if (state->mixer->protocol == UAC_VERSION_1) { -+ if (hdr->bLength < 7) { -+ usb_audio_err(state->chip, -+ "unit %u: invalid UAC_FEATURE_UNIT descriptor\n", -+ unitid); -+ return -EINVAL; -+ } - csize = hdr->bControlSize; - if (!csize) { - usb_audio_dbg(state->chip, -@@ -1414,6 +1420,12 @@ static int parse_audio_feature_unit(struct mixer_build *state, int unitid, - } - } else { - struct uac2_feature_unit_descriptor *ftr = _ftr; -+ if (hdr->bLength < 6) { -+ usb_audio_err(state->chip, -+ "unit %u: invalid UAC_FEATURE_UNIT descriptor\n", -+ unitid); -+ return -EINVAL; -+ } - csize = 4; - channels = (hdr->bLength - 6) / 4 - 1; - bmaControls = ftr->bmaControls; -@@ -2014,7 +2026,8 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, - const struct usbmix_name_map *map; - char **namelist; - -- if (!desc->bNrInPins || desc->bLength < 5 + desc->bNrInPins) { -+ if (desc->bLength < 5 || !desc->bNrInPins || -+ desc->bLength < 5 + desc->bNrInPins) { - usb_audio_err(state->chip, - "invalid SELECTOR UNIT descriptor %d\n", unitid); - return -EINVAL; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.103-104.patch b/patch/kernel/mvebu64-default/04-patch-4.4.103-104.patch deleted file mode 100644 index 49bb49fa6c77..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.103-104.patch +++ /dev/null @@ -1,1469 +0,0 @@ -diff --git a/Makefile b/Makefile -index f5a51cd7ca49..55500e023f61 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 103 -+SUBLEVEL = 104 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts -index 5b0430041ec6..fec92cd36ae3 100644 ---- a/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts -+++ b/arch/arm/boot/dts/logicpd-torpedo-37xx-devkit.dts -@@ -88,7 +88,7 @@ - interrupts-extended = <&intc 83 &omap3_pmx_core 0x11a>; - pinctrl-names = "default"; - pinctrl-0 = <&mmc1_pins &mmc1_cd>; -- cd-gpios = <&gpio4 31 IRQ_TYPE_LEVEL_LOW>; /* gpio127 */ -+ cd-gpios = <&gpio4 31 GPIO_ACTIVE_LOW>; /* gpio127 */ - vmmc-supply = <&vmmc1>; - bus-width = <4>; - cap-power-off-card; -diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h -index 0010c78c4998..8fd9e637629a 100644 ---- a/arch/x86/include/asm/efi.h -+++ b/arch/x86/include/asm/efi.h -@@ -3,6 +3,7 @@ - - #include - #include -+#include - - /* - * We map the EFI regions needed for runtime services non-contiguously, -@@ -64,6 +65,17 @@ extern u64 asmlinkage efi_call(void *fp, ...); - - #define efi_call_phys(f, args...) efi_call((f), args) - -+/* -+ * Scratch space used for switching the pagetable in the EFI stub -+ */ -+struct efi_scratch { -+ u64 r15; -+ u64 prev_cr3; -+ pgd_t *efi_pgt; -+ bool use_pgd; -+ u64 phys_stack; -+} __packed; -+ - #define efi_call_virt(f, ...) \ - ({ \ - efi_status_t __s; \ -@@ -71,7 +83,20 @@ extern u64 asmlinkage efi_call(void *fp, ...); - efi_sync_low_kernel_mappings(); \ - preempt_disable(); \ - __kernel_fpu_begin(); \ -+ \ -+ if (efi_scratch.use_pgd) { \ -+ efi_scratch.prev_cr3 = read_cr3(); \ -+ write_cr3((unsigned long)efi_scratch.efi_pgt); \ -+ __flush_tlb_all(); \ -+ } \ -+ \ - __s = efi_call((void *)efi.systab->runtime->f, __VA_ARGS__); \ -+ \ -+ if (efi_scratch.use_pgd) { \ -+ write_cr3(efi_scratch.prev_cr3); \ -+ __flush_tlb_all(); \ -+ } \ -+ \ - __kernel_fpu_end(); \ - preempt_enable(); \ - __s; \ -@@ -111,6 +136,7 @@ extern void __init efi_memory_uc(u64 addr, unsigned long size); - extern void __init efi_map_region(efi_memory_desc_t *md); - extern void __init efi_map_region_fixed(efi_memory_desc_t *md); - extern void efi_sync_low_kernel_mappings(void); -+extern int __init efi_alloc_page_tables(void); - extern int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages); - extern void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages); - extern void __init old_map_region(efi_memory_desc_t *md); -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 4e1b254c3695..4b1152e57340 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -1696,6 +1696,8 @@ static int ud_interception(struct vcpu_svm *svm) - int er; - - er = emulate_instruction(&svm->vcpu, EMULTYPE_TRAP_UD); -+ if (er == EMULATE_USER_EXIT) -+ return 0; - if (er != EMULATE_DONE) - kvm_queue_exception(&svm->vcpu, UD_VECTOR); - return 1; -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 67ba0d8f87c7..253a8c8207bb 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -5267,6 +5267,8 @@ static int handle_exception(struct kvm_vcpu *vcpu) - return 1; - } - er = emulate_instruction(vcpu, EMULTYPE_TRAP_UD); -+ if (er == EMULATE_USER_EXIT) -+ return 0; - if (er != EMULATE_DONE) - kvm_queue_exception(vcpu, UD_VECTOR); - return 1; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 3ffd5900da5b..df81717a92f3 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -1812,6 +1812,9 @@ static int kvm_guest_time_update(struct kvm_vcpu *v) - */ - BUILD_BUG_ON(offsetof(struct pvclock_vcpu_time_info, version) != 0); - -+ if (guest_hv_clock.version & 1) -+ ++guest_hv_clock.version; /* first time write, random junk */ -+ - vcpu->hv_clock.version = guest_hv_clock.version + 1; - kvm_write_guest_cached(v->kvm, &vcpu->pv_time, - &vcpu->hv_clock, -@@ -5426,6 +5429,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, - if (reexecute_instruction(vcpu, cr2, write_fault_to_spt, - emulation_type)) - return EMULATE_DONE; -+ if (ctxt->have_exception && inject_emulated_exception(vcpu)) -+ return EMULATE_DONE; - if (emulation_type & EMULTYPE_SKIP) - return EMULATE_FAIL; - return handle_emulation_failure(vcpu); -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index b599a780a5a9..a0fe62e3f4a3 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -911,15 +911,10 @@ static void populate_pte(struct cpa_data *cpa, - pte = pte_offset_kernel(pmd, start); - - while (num_pages-- && start < end) { -- -- /* deal with the NX bit */ -- if (!(pgprot_val(pgprot) & _PAGE_NX)) -- cpa->pfn &= ~_PAGE_NX; -- -- set_pte(pte, pfn_pte(cpa->pfn >> PAGE_SHIFT, pgprot)); -+ set_pte(pte, pfn_pte(cpa->pfn, pgprot)); - - start += PAGE_SIZE; -- cpa->pfn += PAGE_SIZE; -+ cpa->pfn++; - pte++; - } - } -@@ -975,11 +970,11 @@ static int populate_pmd(struct cpa_data *cpa, - - pmd = pmd_offset(pud, start); - -- set_pmd(pmd, __pmd(cpa->pfn | _PAGE_PSE | -+ set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | - massage_pgprot(pmd_pgprot))); - - start += PMD_SIZE; -- cpa->pfn += PMD_SIZE; -+ cpa->pfn += PMD_SIZE >> PAGE_SHIFT; - cur_pages += PMD_SIZE >> PAGE_SHIFT; - } - -@@ -1048,11 +1043,11 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, - * Map everything starting from the Gb boundary, possibly with 1G pages - */ - while (end - start >= PUD_SIZE) { -- set_pud(pud, __pud(cpa->pfn | _PAGE_PSE | -+ set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | - massage_pgprot(pud_pgprot))); - - start += PUD_SIZE; -- cpa->pfn += PUD_SIZE; -+ cpa->pfn += PUD_SIZE >> PAGE_SHIFT; - cur_pages += PUD_SIZE >> PAGE_SHIFT; - pud++; - } -diff --git a/arch/x86/platform/efi/efi-bgrt.c b/arch/x86/platform/efi/efi-bgrt.c -index ea48449b2e63..64fbc7e33226 100644 ---- a/arch/x86/platform/efi/efi-bgrt.c -+++ b/arch/x86/platform/efi/efi-bgrt.c -@@ -28,8 +28,7 @@ struct bmp_header { - void __init efi_bgrt_init(void) - { - acpi_status status; -- void __iomem *image; -- bool ioremapped = false; -+ void *image; - struct bmp_header bmp_header; - - if (acpi_disabled) -@@ -70,20 +69,14 @@ void __init efi_bgrt_init(void) - return; - } - -- image = efi_lookup_mapped_addr(bgrt_tab->image_address); -+ image = memremap(bgrt_tab->image_address, sizeof(bmp_header), MEMREMAP_WB); - if (!image) { -- image = early_ioremap(bgrt_tab->image_address, -- sizeof(bmp_header)); -- ioremapped = true; -- if (!image) { -- pr_err("Ignoring BGRT: failed to map image header memory\n"); -- return; -- } -+ pr_err("Ignoring BGRT: failed to map image header memory\n"); -+ return; - } - -- memcpy_fromio(&bmp_header, image, sizeof(bmp_header)); -- if (ioremapped) -- early_iounmap(image, sizeof(bmp_header)); -+ memcpy(&bmp_header, image, sizeof(bmp_header)); -+ memunmap(image); - bgrt_image_size = bmp_header.size; - - bgrt_image = kmalloc(bgrt_image_size, GFP_KERNEL | __GFP_NOWARN); -@@ -93,18 +86,14 @@ void __init efi_bgrt_init(void) - return; - } - -- if (ioremapped) { -- image = early_ioremap(bgrt_tab->image_address, -- bmp_header.size); -- if (!image) { -- pr_err("Ignoring BGRT: failed to map image memory\n"); -- kfree(bgrt_image); -- bgrt_image = NULL; -- return; -- } -+ image = memremap(bgrt_tab->image_address, bmp_header.size, MEMREMAP_WB); -+ if (!image) { -+ pr_err("Ignoring BGRT: failed to map image memory\n"); -+ kfree(bgrt_image); -+ bgrt_image = NULL; -+ return; - } - -- memcpy_fromio(bgrt_image, image, bgrt_image_size); -- if (ioremapped) -- early_iounmap(image, bmp_header.size); -+ memcpy(bgrt_image, image, bgrt_image_size); -+ memunmap(image); - } -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index ad285404ea7f..3c1f3cd7b2ba 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -869,7 +869,7 @@ static void __init kexec_enter_virtual_mode(void) - * This function will switch the EFI runtime services to virtual mode. - * Essentially, we look through the EFI memmap and map every region that - * has the runtime attribute bit set in its memory descriptor into the -- * ->trampoline_pgd page table using a top-down VA allocation scheme. -+ * efi_pgd page table. - * - * The old method which used to update that memory descriptor with the - * virtual address obtained from ioremap() is still supported when the -@@ -879,8 +879,8 @@ static void __init kexec_enter_virtual_mode(void) - * - * The new method does a pagetable switch in a preemption-safe manner - * so that we're in a different address space when calling a runtime -- * function. For function arguments passing we do copy the PGDs of the -- * kernel page table into ->trampoline_pgd prior to each call. -+ * function. For function arguments passing we do copy the PUDs of the -+ * kernel page table into efi_pgd prior to each call. - * - * Specially for kexec boot, efi runtime maps in previous kernel should - * be passed in via setup_data. In that case runtime ranges will be mapped -@@ -895,6 +895,12 @@ static void __init __efi_enter_virtual_mode(void) - - efi.systab = NULL; - -+ if (efi_alloc_page_tables()) { -+ pr_err("Failed to allocate EFI page tables\n"); -+ clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); -+ return; -+ } -+ - efi_merge_regions(); - new_memmap = efi_map_regions(&count, &pg_shift); - if (!new_memmap) { -@@ -954,28 +960,11 @@ static void __init __efi_enter_virtual_mode(void) - efi_runtime_mkexec(); - - /* -- * We mapped the descriptor array into the EFI pagetable above but we're -- * not unmapping it here. Here's why: -- * -- * We're copying select PGDs from the kernel page table to the EFI page -- * table and when we do so and make changes to those PGDs like unmapping -- * stuff from them, those changes appear in the kernel page table and we -- * go boom. -- * -- * From setup_real_mode(): -- * -- * ... -- * trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd; -- * -- * In this particular case, our allocation is in PGD 0 of the EFI page -- * table but we've copied that PGD from PGD[272] of the EFI page table: -- * -- * pgd_index(__PAGE_OFFSET = 0xffff880000000000) = 272 -- * -- * where the direct memory mapping in kernel space is. -- * -- * new_memmap's VA comes from that direct mapping and thus clearing it, -- * it would get cleared in the kernel page table too. -+ * We mapped the descriptor array into the EFI pagetable above -+ * but we're not unmapping it here because if we're running in -+ * EFI mixed mode we need all of memory to be accessible when -+ * we pass parameters to the EFI runtime services in the -+ * thunking code. - * - * efi_cleanup_page_tables(__pa(new_memmap), 1 << pg_shift); - */ -diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c -index ed5b67338294..58d669bc8250 100644 ---- a/arch/x86/platform/efi/efi_32.c -+++ b/arch/x86/platform/efi/efi_32.c -@@ -38,6 +38,11 @@ - * say 0 - 3G. - */ - -+int __init efi_alloc_page_tables(void) -+{ -+ return 0; -+} -+ - void efi_sync_low_kernel_mappings(void) {} - void __init efi_dump_pagetable(void) {} - int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) -diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c -index a0ac0f9c307f..18dfaad71c99 100644 ---- a/arch/x86/platform/efi/efi_64.c -+++ b/arch/x86/platform/efi/efi_64.c -@@ -40,6 +40,7 @@ - #include - #include - #include -+#include - - /* - * We allocate runtime services regions bottom-up, starting from -4G, i.e. -@@ -47,16 +48,7 @@ - */ - static u64 efi_va = EFI_VA_START; - --/* -- * Scratch space used for switching the pagetable in the EFI stub -- */ --struct efi_scratch { -- u64 r15; -- u64 prev_cr3; -- pgd_t *efi_pgt; -- bool use_pgd; -- u64 phys_stack; --} __packed; -+struct efi_scratch efi_scratch; - - static void __init early_code_mapping_set_exec(int executable) - { -@@ -83,8 +75,11 @@ pgd_t * __init efi_call_phys_prolog(void) - int pgd; - int n_pgds; - -- if (!efi_enabled(EFI_OLD_MEMMAP)) -- return NULL; -+ if (!efi_enabled(EFI_OLD_MEMMAP)) { -+ save_pgd = (pgd_t *)read_cr3(); -+ write_cr3((unsigned long)efi_scratch.efi_pgt); -+ goto out; -+ } - - early_code_mapping_set_exec(1); - -@@ -96,6 +91,7 @@ pgd_t * __init efi_call_phys_prolog(void) - vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); - set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); - } -+out: - __flush_tlb_all(); - - return save_pgd; -@@ -109,8 +105,11 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd) - int pgd_idx; - int nr_pgds; - -- if (!save_pgd) -+ if (!efi_enabled(EFI_OLD_MEMMAP)) { -+ write_cr3((unsigned long)save_pgd); -+ __flush_tlb_all(); - return; -+ } - - nr_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE); - -@@ -123,27 +122,97 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd) - early_code_mapping_set_exec(0); - } - -+static pgd_t *efi_pgd; -+ -+/* -+ * We need our own copy of the higher levels of the page tables -+ * because we want to avoid inserting EFI region mappings (EFI_VA_END -+ * to EFI_VA_START) into the standard kernel page tables. Everything -+ * else can be shared, see efi_sync_low_kernel_mappings(). -+ */ -+int __init efi_alloc_page_tables(void) -+{ -+ pgd_t *pgd; -+ pud_t *pud; -+ gfp_t gfp_mask; -+ -+ if (efi_enabled(EFI_OLD_MEMMAP)) -+ return 0; -+ -+ gfp_mask = GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO; -+ efi_pgd = (pgd_t *)__get_free_page(gfp_mask); -+ if (!efi_pgd) -+ return -ENOMEM; -+ -+ pgd = efi_pgd + pgd_index(EFI_VA_END); -+ -+ pud = pud_alloc_one(NULL, 0); -+ if (!pud) { -+ free_page((unsigned long)efi_pgd); -+ return -ENOMEM; -+ } -+ -+ pgd_populate(NULL, pgd, pud); -+ -+ return 0; -+} -+ - /* - * Add low kernel mappings for passing arguments to EFI functions. - */ - void efi_sync_low_kernel_mappings(void) - { -- unsigned num_pgds; -- pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -+ unsigned num_entries; -+ pgd_t *pgd_k, *pgd_efi; -+ pud_t *pud_k, *pud_efi; - - if (efi_enabled(EFI_OLD_MEMMAP)) - return; - -- num_pgds = pgd_index(MODULES_END - 1) - pgd_index(PAGE_OFFSET); -+ /* -+ * We can share all PGD entries apart from the one entry that -+ * covers the EFI runtime mapping space. -+ * -+ * Make sure the EFI runtime region mappings are guaranteed to -+ * only span a single PGD entry and that the entry also maps -+ * other important kernel regions. -+ */ -+ BUILD_BUG_ON(pgd_index(EFI_VA_END) != pgd_index(MODULES_END)); -+ BUILD_BUG_ON((EFI_VA_START & PGDIR_MASK) != -+ (EFI_VA_END & PGDIR_MASK)); -+ -+ pgd_efi = efi_pgd + pgd_index(PAGE_OFFSET); -+ pgd_k = pgd_offset_k(PAGE_OFFSET); - -- memcpy(pgd + pgd_index(PAGE_OFFSET), -- init_mm.pgd + pgd_index(PAGE_OFFSET), -- sizeof(pgd_t) * num_pgds); -+ num_entries = pgd_index(EFI_VA_END) - pgd_index(PAGE_OFFSET); -+ memcpy(pgd_efi, pgd_k, sizeof(pgd_t) * num_entries); -+ -+ /* -+ * We share all the PUD entries apart from those that map the -+ * EFI regions. Copy around them. -+ */ -+ BUILD_BUG_ON((EFI_VA_START & ~PUD_MASK) != 0); -+ BUILD_BUG_ON((EFI_VA_END & ~PUD_MASK) != 0); -+ -+ pgd_efi = efi_pgd + pgd_index(EFI_VA_END); -+ pud_efi = pud_offset(pgd_efi, 0); -+ -+ pgd_k = pgd_offset_k(EFI_VA_END); -+ pud_k = pud_offset(pgd_k, 0); -+ -+ num_entries = pud_index(EFI_VA_END); -+ memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries); -+ -+ pud_efi = pud_offset(pgd_efi, EFI_VA_START); -+ pud_k = pud_offset(pgd_k, EFI_VA_START); -+ -+ num_entries = PTRS_PER_PUD - pud_index(EFI_VA_START); -+ memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries); - } - - int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - { -- unsigned long text; -+ unsigned long pfn, text; - struct page *page; - unsigned npages; - pgd_t *pgd; -@@ -151,8 +220,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - if (efi_enabled(EFI_OLD_MEMMAP)) - return 0; - -- efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd; -- pgd = __va(efi_scratch.efi_pgt); -+ efi_scratch.efi_pgt = (pgd_t *)__pa(efi_pgd); -+ pgd = efi_pgd; - - /* - * It can happen that the physical address of new_memmap lands in memory -@@ -160,7 +229,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - * and ident-map those pages containing the map before calling - * phys_efi_set_virtual_address_map(). - */ -- if (kernel_map_pages_in_pgd(pgd, pa_memmap, pa_memmap, num_pages, _PAGE_NX)) { -+ pfn = pa_memmap >> PAGE_SHIFT; -+ if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, _PAGE_NX)) { - pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap); - return 1; - } -@@ -185,8 +255,9 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - - npages = (_end - _text) >> PAGE_SHIFT; - text = __pa(_text); -+ pfn = text >> PAGE_SHIFT; - -- if (kernel_map_pages_in_pgd(pgd, text >> PAGE_SHIFT, text, npages, 0)) { -+ if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, 0)) { - pr_err("Failed to map kernel text 1:1\n"); - return 1; - } -@@ -196,20 +267,20 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - - void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages) - { -- pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -- -- kernel_unmap_pages_in_pgd(pgd, pa_memmap, num_pages); -+ kernel_unmap_pages_in_pgd(efi_pgd, pa_memmap, num_pages); - } - - static void __init __map_region(efi_memory_desc_t *md, u64 va) - { -- pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -- unsigned long pf = 0; -+ unsigned long flags = 0; -+ unsigned long pfn; -+ pgd_t *pgd = efi_pgd; - - if (!(md->attribute & EFI_MEMORY_WB)) -- pf |= _PAGE_PCD; -+ flags |= _PAGE_PCD; - -- if (kernel_map_pages_in_pgd(pgd, md->phys_addr, va, md->num_pages, pf)) -+ pfn = md->phys_addr >> PAGE_SHIFT; -+ if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags)) - pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n", - md->phys_addr, va); - } -@@ -312,9 +383,7 @@ void __init efi_runtime_mkexec(void) - void __init efi_dump_pagetable(void) - { - #ifdef CONFIG_EFI_PGT_DUMP -- pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -- -- ptdump_walk_pgd_level(NULL, pgd); -+ ptdump_walk_pgd_level(NULL, efi_pgd); - #endif - } - -diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S -index 86d0f9e08dd9..32020cb8bb08 100644 ---- a/arch/x86/platform/efi/efi_stub_64.S -+++ b/arch/x86/platform/efi/efi_stub_64.S -@@ -38,41 +38,6 @@ - mov %rsi, %cr0; \ - mov (%rsp), %rsp - -- /* stolen from gcc */ -- .macro FLUSH_TLB_ALL -- movq %r15, efi_scratch(%rip) -- movq %r14, efi_scratch+8(%rip) -- movq %cr4, %r15 -- movq %r15, %r14 -- andb $0x7f, %r14b -- movq %r14, %cr4 -- movq %r15, %cr4 -- movq efi_scratch+8(%rip), %r14 -- movq efi_scratch(%rip), %r15 -- .endm -- -- .macro SWITCH_PGT -- cmpb $0, efi_scratch+24(%rip) -- je 1f -- movq %r15, efi_scratch(%rip) # r15 -- # save previous CR3 -- movq %cr3, %r15 -- movq %r15, efi_scratch+8(%rip) # prev_cr3 -- movq efi_scratch+16(%rip), %r15 # EFI pgt -- movq %r15, %cr3 -- 1: -- .endm -- -- .macro RESTORE_PGT -- cmpb $0, efi_scratch+24(%rip) -- je 2f -- movq efi_scratch+8(%rip), %r15 -- movq %r15, %cr3 -- movq efi_scratch(%rip), %r15 -- FLUSH_TLB_ALL -- 2: -- .endm -- - ENTRY(efi_call) - SAVE_XMM - mov (%rsp), %rax -@@ -83,16 +48,8 @@ ENTRY(efi_call) - mov %r8, %r9 - mov %rcx, %r8 - mov %rsi, %rcx -- SWITCH_PGT - call *%rdi -- RESTORE_PGT - addq $48, %rsp - RESTORE_XMM - ret - ENDPROC(efi_call) -- -- .data --ENTRY(efi_scratch) -- .fill 3,8,0 -- .byte 0 -- .quad 0 -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 3b52677f459a..0cd8f039602e 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -325,38 +325,6 @@ u64 __init efi_mem_desc_end(efi_memory_desc_t *md) - return end; - } - --/* -- * We can't ioremap data in EFI boot services RAM, because we've already mapped -- * it as RAM. So, look it up in the existing EFI memory map instead. Only -- * callable after efi_enter_virtual_mode and before efi_free_boot_services. -- */ --void __iomem *efi_lookup_mapped_addr(u64 phys_addr) --{ -- struct efi_memory_map *map; -- void *p; -- map = efi.memmap; -- if (!map) -- return NULL; -- if (WARN_ON(!map->map)) -- return NULL; -- for (p = map->map; p < map->map_end; p += map->desc_size) { -- efi_memory_desc_t *md = p; -- u64 size = md->num_pages << EFI_PAGE_SHIFT; -- u64 end = md->phys_addr + size; -- if (!(md->attribute & EFI_MEMORY_RUNTIME) && -- md->type != EFI_BOOT_SERVICES_CODE && -- md->type != EFI_BOOT_SERVICES_DATA) -- continue; -- if (!md->virt_addr) -- continue; -- if (phys_addr >= md->phys_addr && phys_addr < end) { -- phys_addr += md->virt_addr - md->phys_addr; -- return (__force void __iomem *)(unsigned long)phys_addr; -- } -- } -- return NULL; --} -- - static __initdata efi_config_table_type_t common_tables[] = { - {ACPI_20_TABLE_GUID, "ACPI 2.0", &efi.acpi20}, - {ACPI_TABLE_GUID, "ACPI", &efi.acpi}, -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -index f4cae5357e40..3e90ddcbb24a 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c -@@ -1575,34 +1575,32 @@ void amdgpu_atombios_scratch_regs_restore(struct amdgpu_device *adev) - WREG32(mmBIOS_SCRATCH_0 + i, adev->bios_scratch[i]); - } - --/* Atom needs data in little endian format -- * so swap as appropriate when copying data to -- * or from atom. Note that atom operates on -- * dw units. -+/* Atom needs data in little endian format so swap as appropriate when copying -+ * data to or from atom. Note that atom operates on dw units. -+ * -+ * Use to_le=true when sending data to atom and provide at least -+ * ALIGN(num_bytes,4) bytes in the dst buffer. -+ * -+ * Use to_le=false when receiving data from atom and provide ALIGN(num_bytes,4) -+ * byes in the src buffer. - */ - void amdgpu_atombios_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) - { - #ifdef __BIG_ENDIAN -- u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */ -- u32 *dst32, *src32; -+ u32 src_tmp[5], dst_tmp[5]; - int i; -+ u8 align_num_bytes = ALIGN(num_bytes, 4); - -- memcpy(src_tmp, src, num_bytes); -- src32 = (u32 *)src_tmp; -- dst32 = (u32 *)dst_tmp; - if (to_le) { -- for (i = 0; i < ((num_bytes + 3) / 4); i++) -- dst32[i] = cpu_to_le32(src32[i]); -- memcpy(dst, dst_tmp, num_bytes); -+ memcpy(src_tmp, src, num_bytes); -+ for (i = 0; i < align_num_bytes / 4; i++) -+ dst_tmp[i] = cpu_to_le32(src_tmp[i]); -+ memcpy(dst, dst_tmp, align_num_bytes); - } else { -- u8 dws = num_bytes & ~3; -- for (i = 0; i < ((num_bytes + 3) / 4); i++) -- dst32[i] = le32_to_cpu(src32[i]); -- memcpy(dst, dst_tmp, dws); -- if (num_bytes % 4) { -- for (i = 0; i < (num_bytes % 4); i++) -- dst[dws+i] = dst_tmp[dws+i]; -- } -+ memcpy(src_tmp, src, align_num_bytes); -+ for (i = 0; i < align_num_bytes / 4; i++) -+ dst_tmp[i] = le32_to_cpu(src_tmp[i]); -+ memcpy(dst, dst_tmp, num_bytes); - } - #else - memcpy(dst, src, num_bytes); -diff --git a/drivers/gpu/drm/i915/intel_i2c.c b/drivers/gpu/drm/i915/intel_i2c.c -index f3bee54c414f..cb4313c68f71 100644 ---- a/drivers/gpu/drm/i915/intel_i2c.c -+++ b/drivers/gpu/drm/i915/intel_i2c.c -@@ -440,7 +440,9 @@ static bool - gmbus_is_index_read(struct i2c_msg *msgs, int i, int num) - { - return (i + 1 < num && -- !(msgs[i].flags & I2C_M_RD) && msgs[i].len <= 2 && -+ msgs[i].addr == msgs[i + 1].addr && -+ !(msgs[i].flags & I2C_M_RD) && -+ (msgs[i].len == 1 || msgs[i].len == 2) && - (msgs[i + 1].flags & I2C_M_RD)); - } - -diff --git a/drivers/gpu/drm/panel/panel-simple.c b/drivers/gpu/drm/panel/panel-simple.c -index f97b73ec4713..f418c002d323 100644 ---- a/drivers/gpu/drm/panel/panel-simple.c -+++ b/drivers/gpu/drm/panel/panel-simple.c -@@ -352,6 +352,7 @@ static int panel_simple_remove(struct device *dev) - drm_panel_remove(&panel->base); - - panel_simple_disable(&panel->base); -+ panel_simple_unprepare(&panel->base); - - if (panel->ddc) - put_device(&panel->ddc->dev); -@@ -367,6 +368,7 @@ static void panel_simple_shutdown(struct device *dev) - struct panel_simple *panel = dev_get_drvdata(dev); - - panel_simple_disable(&panel->base); -+ panel_simple_unprepare(&panel->base); - } - - static const struct drm_display_mode ampire_am800480r3tmqwa1h_mode = { -diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c -index b5760851195c..0c6216a6ee9e 100644 ---- a/drivers/gpu/drm/radeon/atombios_dp.c -+++ b/drivers/gpu/drm/radeon/atombios_dp.c -@@ -45,34 +45,32 @@ static char *pre_emph_names[] = { - - /***** radeon AUX functions *****/ - --/* Atom needs data in little endian format -- * so swap as appropriate when copying data to -- * or from atom. Note that atom operates on -- * dw units. -+/* Atom needs data in little endian format so swap as appropriate when copying -+ * data to or from atom. Note that atom operates on dw units. -+ * -+ * Use to_le=true when sending data to atom and provide at least -+ * ALIGN(num_bytes,4) bytes in the dst buffer. -+ * -+ * Use to_le=false when receiving data from atom and provide ALIGN(num_bytes,4) -+ * byes in the src buffer. - */ - void radeon_atom_copy_swap(u8 *dst, u8 *src, u8 num_bytes, bool to_le) - { - #ifdef __BIG_ENDIAN -- u8 src_tmp[20], dst_tmp[20]; /* used for byteswapping */ -- u32 *dst32, *src32; -+ u32 src_tmp[5], dst_tmp[5]; - int i; -+ u8 align_num_bytes = ALIGN(num_bytes, 4); - -- memcpy(src_tmp, src, num_bytes); -- src32 = (u32 *)src_tmp; -- dst32 = (u32 *)dst_tmp; - if (to_le) { -- for (i = 0; i < ((num_bytes + 3) / 4); i++) -- dst32[i] = cpu_to_le32(src32[i]); -- memcpy(dst, dst_tmp, num_bytes); -+ memcpy(src_tmp, src, num_bytes); -+ for (i = 0; i < align_num_bytes / 4; i++) -+ dst_tmp[i] = cpu_to_le32(src_tmp[i]); -+ memcpy(dst, dst_tmp, align_num_bytes); - } else { -- u8 dws = num_bytes & ~3; -- for (i = 0; i < ((num_bytes + 3) / 4); i++) -- dst32[i] = le32_to_cpu(src32[i]); -- memcpy(dst, dst_tmp, dws); -- if (num_bytes % 4) { -- for (i = 0; i < (num_bytes % 4); i++) -- dst[dws+i] = dst_tmp[dws+i]; -- } -+ memcpy(src_tmp, src, align_num_bytes); -+ for (i = 0; i < align_num_bytes / 4; i++) -+ dst_tmp[i] = le32_to_cpu(src_tmp[i]); -+ memcpy(dst, dst_tmp, num_bytes); - } - #else - memcpy(dst, src, num_bytes); -diff --git a/drivers/gpu/drm/radeon/radeon_fb.c b/drivers/gpu/drm/radeon/radeon_fb.c -index 26da2f4d7b4f..a2937a693591 100644 ---- a/drivers/gpu/drm/radeon/radeon_fb.c -+++ b/drivers/gpu/drm/radeon/radeon_fb.c -@@ -226,7 +226,6 @@ static int radeonfb_create(struct drm_fb_helper *helper, - } - - info->par = rfbdev; -- info->skip_vt_switch = true; - - ret = radeon_framebuffer_init(rdev->ddev, &rfbdev->rfb, &mode_cmd, gobj); - if (ret) { -diff --git a/drivers/md/bcache/alloc.c b/drivers/md/bcache/alloc.c -index ea47980949ef..4d46f2ce606f 100644 ---- a/drivers/md/bcache/alloc.c -+++ b/drivers/md/bcache/alloc.c -@@ -479,7 +479,7 @@ int __bch_bucket_alloc_set(struct cache_set *c, unsigned reserve, - if (b == -1) - goto err; - -- k->ptr[i] = PTR(ca->buckets[b].gen, -+ k->ptr[i] = MAKE_PTR(ca->buckets[b].gen, - bucket_to_sector(c, b), - ca->sb.nr_this_dev); - -diff --git a/drivers/md/bcache/extents.c b/drivers/md/bcache/extents.c -index 243de0bf15cd..4bf15182c4da 100644 ---- a/drivers/md/bcache/extents.c -+++ b/drivers/md/bcache/extents.c -@@ -584,7 +584,7 @@ static bool bch_extent_merge(struct btree_keys *bk, struct bkey *l, struct bkey - return false; - - for (i = 0; i < KEY_PTRS(l); i++) -- if (l->ptr[i] + PTR(0, KEY_SIZE(l), 0) != r->ptr[i] || -+ if (l->ptr[i] + MAKE_PTR(0, KEY_SIZE(l), 0) != r->ptr[i] || - PTR_BUCKET_NR(b->c, l, i) != PTR_BUCKET_NR(b->c, r, i)) - return false; - -diff --git a/drivers/md/bcache/journal.c b/drivers/md/bcache/journal.c -index 29eba7219b01..6ed066a0e7c0 100644 ---- a/drivers/md/bcache/journal.c -+++ b/drivers/md/bcache/journal.c -@@ -508,7 +508,7 @@ static void journal_reclaim(struct cache_set *c) - continue; - - ja->cur_idx = next; -- k->ptr[n++] = PTR(0, -+ k->ptr[n++] = MAKE_PTR(0, - bucket_to_sector(c, ca->sb.d[ja->cur_idx]), - ca->sb.nr_this_dev); - } -diff --git a/drivers/misc/eeprom/at24.c b/drivers/misc/eeprom/at24.c -index 5d7c0900fa1b..f112c5bc082a 100644 ---- a/drivers/misc/eeprom/at24.c -+++ b/drivers/misc/eeprom/at24.c -@@ -257,6 +257,9 @@ static ssize_t at24_read(struct at24_data *at24, - if (unlikely(!count)) - return count; - -+ if (off + count > at24->chip.byte_len) -+ return -EINVAL; -+ - /* - * Read data from chip, protecting against concurrent updates - * from this host, but not from other I2C masters. -@@ -311,6 +314,9 @@ static ssize_t at24_eeprom_write(struct at24_data *at24, const char *buf, - unsigned long timeout, write_time; - unsigned next_page; - -+ if (offset + count > at24->chip.byte_len) -+ return -EINVAL; -+ - /* Get corresponding I2C address and adjust offset */ - client = at24_translate_offset(at24, &offset); - -diff --git a/drivers/mmc/core/bus.c b/drivers/mmc/core/bus.c -index 972ff844cf5a..cf7c7bc1e940 100644 ---- a/drivers/mmc/core/bus.c -+++ b/drivers/mmc/core/bus.c -@@ -155,6 +155,9 @@ static int mmc_bus_suspend(struct device *dev) - return ret; - - ret = host->bus_ops->suspend(host); -+ if (ret) -+ pm_generic_resume(dev); -+ - return ret; - } - -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 54ab48827258..7ba109e8cf88 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -2663,15 +2663,18 @@ static int panic_nand_write(struct mtd_info *mtd, loff_t to, size_t len, - size_t *retlen, const uint8_t *buf) - { - struct nand_chip *chip = mtd->priv; -+ int chipnr = (int)(to >> chip->chip_shift); - struct mtd_oob_ops ops; - int ret; - -- /* Wait for the device to get ready */ -- panic_nand_wait(mtd, chip, 400); -- - /* Grab the device */ - panic_nand_get_device(chip, mtd, FL_WRITING); - -+ chip->select_chip(mtd, chipnr); -+ -+ /* Wait for the device to get ready */ -+ panic_nand_wait(mtd, chip, 400); -+ - memset(&ops, 0, sizeof(ops)); - ops.len = len; - ops.datbuf = (uint8_t *)buf; -diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c -index c36a03fa7678..260f94b019c9 100644 ---- a/fs/btrfs/extent-tree.c -+++ b/fs/btrfs/extent-tree.c -@@ -3361,13 +3361,6 @@ again: - goto again; - } - -- /* We've already setup this transaction, go ahead and exit */ -- if (block_group->cache_generation == trans->transid && -- i_size_read(inode)) { -- dcs = BTRFS_DC_SETUP; -- goto out_put; -- } -- - /* - * We want to set the generation to 0, that way if anything goes wrong - * from here on out we know not to trust this cache when we load up next -@@ -3391,6 +3384,13 @@ again: - } - WARN_ON(ret); - -+ /* We've already setup this transaction, go ahead and exit */ -+ if (block_group->cache_generation == trans->transid && -+ i_size_read(inode)) { -+ dcs = BTRFS_DC_SETUP; -+ goto out_put; -+ } -+ - if (i_size_read(inode) > 0) { - ret = btrfs_check_trunc_cache_free_space(root, - &root->fs_info->global_block_rsv); -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 348e0a05bd18..44e09483d2cd 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -1260,7 +1260,7 @@ static int nfs_weak_revalidate(struct dentry *dentry, unsigned int flags) - return 0; - } - -- error = nfs_revalidate_inode(NFS_SERVER(inode), inode); -+ error = nfs_lookup_verify_inode(inode, flags); - dfprintk(LOOKUPCACHE, "NFS: %s: inode %lu is %s\n", - __func__, inode->i_ino, error ? "invalid" : "valid"); - return !error; -@@ -1420,6 +1420,7 @@ static int nfs4_lookup_revalidate(struct dentry *, unsigned int); - - const struct dentry_operations nfs4_dentry_operations = { - .d_revalidate = nfs4_lookup_revalidate, -+ .d_weak_revalidate = nfs_weak_revalidate, - .d_delete = nfs_dentry_delete, - .d_iput = nfs_dentry_iput, - .d_automount = nfs_d_automount, -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 421935f3d909..11c67e8b939d 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -3379,7 +3379,9 @@ nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open) - /* ignore lock owners */ - if (local->st_stateowner->so_is_open_owner == 0) - continue; -- if (local->st_stateowner == &oo->oo_owner) { -+ if (local->st_stateowner != &oo->oo_owner) -+ continue; -+ if (local->st_stid.sc_type == NFS4_OPEN_STID) { - ret = local; - atomic_inc(&ret->st_stid.sc_count); - break; -@@ -3388,6 +3390,52 @@ nfsd4_find_existing_open(struct nfs4_file *fp, struct nfsd4_open *open) - return ret; - } - -+static __be32 -+nfsd4_verify_open_stid(struct nfs4_stid *s) -+{ -+ __be32 ret = nfs_ok; -+ -+ switch (s->sc_type) { -+ default: -+ break; -+ case NFS4_CLOSED_STID: -+ case NFS4_CLOSED_DELEG_STID: -+ ret = nfserr_bad_stateid; -+ break; -+ case NFS4_REVOKED_DELEG_STID: -+ ret = nfserr_deleg_revoked; -+ } -+ return ret; -+} -+ -+/* Lock the stateid st_mutex, and deal with races with CLOSE */ -+static __be32 -+nfsd4_lock_ol_stateid(struct nfs4_ol_stateid *stp) -+{ -+ __be32 ret; -+ -+ mutex_lock(&stp->st_mutex); -+ ret = nfsd4_verify_open_stid(&stp->st_stid); -+ if (ret != nfs_ok) -+ mutex_unlock(&stp->st_mutex); -+ return ret; -+} -+ -+static struct nfs4_ol_stateid * -+nfsd4_find_and_lock_existing_open(struct nfs4_file *fp, struct nfsd4_open *open) -+{ -+ struct nfs4_ol_stateid *stp; -+ for (;;) { -+ spin_lock(&fp->fi_lock); -+ stp = nfsd4_find_existing_open(fp, open); -+ spin_unlock(&fp->fi_lock); -+ if (!stp || nfsd4_lock_ol_stateid(stp) == nfs_ok) -+ break; -+ nfs4_put_stid(&stp->st_stid); -+ } -+ return stp; -+} -+ - static struct nfs4_openowner * - alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open, - struct nfsd4_compound_state *cstate) -@@ -3420,23 +3468,27 @@ alloc_init_open_stateowner(unsigned int strhashval, struct nfsd4_open *open, - } - - static struct nfs4_ol_stateid * --init_open_stateid(struct nfs4_ol_stateid *stp, struct nfs4_file *fp, -- struct nfsd4_open *open) -+init_open_stateid(struct nfs4_file *fp, struct nfsd4_open *open) - { - - struct nfs4_openowner *oo = open->op_openowner; - struct nfs4_ol_stateid *retstp = NULL; -+ struct nfs4_ol_stateid *stp; - -+ stp = open->op_stp; - /* We are moving these outside of the spinlocks to avoid the warnings */ - mutex_init(&stp->st_mutex); - mutex_lock(&stp->st_mutex); - -+retry: - spin_lock(&oo->oo_owner.so_client->cl_lock); - spin_lock(&fp->fi_lock); - - retstp = nfsd4_find_existing_open(fp, open); - if (retstp) - goto out_unlock; -+ -+ open->op_stp = NULL; - atomic_inc(&stp->st_stid.sc_count); - stp->st_stid.sc_type = NFS4_OPEN_STID; - INIT_LIST_HEAD(&stp->st_locks); -@@ -3453,11 +3505,16 @@ out_unlock: - spin_unlock(&fp->fi_lock); - spin_unlock(&oo->oo_owner.so_client->cl_lock); - if (retstp) { -- mutex_lock(&retstp->st_mutex); -- /* Not that we need to, just for neatness */ -+ /* Handle races with CLOSE */ -+ if (nfsd4_lock_ol_stateid(retstp) != nfs_ok) { -+ nfs4_put_stid(&retstp->st_stid); -+ goto retry; -+ } -+ /* To keep mutex tracking happy */ - mutex_unlock(&stp->st_mutex); -+ stp = retstp; - } -- return retstp; -+ return stp; - } - - /* -@@ -4260,9 +4317,9 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf - struct nfs4_client *cl = open->op_openowner->oo_owner.so_client; - struct nfs4_file *fp = NULL; - struct nfs4_ol_stateid *stp = NULL; -- struct nfs4_ol_stateid *swapstp = NULL; - struct nfs4_delegation *dp = NULL; - __be32 status; -+ bool new_stp = false; - - /* - * Lookup file; if found, lookup stateid and check open request, -@@ -4274,9 +4331,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf - status = nfs4_check_deleg(cl, open, &dp); - if (status) - goto out; -- spin_lock(&fp->fi_lock); -- stp = nfsd4_find_existing_open(fp, open); -- spin_unlock(&fp->fi_lock); -+ stp = nfsd4_find_and_lock_existing_open(fp, open); - } else { - open->op_file = NULL; - status = nfserr_bad_stateid; -@@ -4284,41 +4339,31 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf - goto out; - } - -+ if (!stp) { -+ stp = init_open_stateid(fp, open); -+ if (!open->op_stp) -+ new_stp = true; -+ } -+ - /* - * OPEN the file, or upgrade an existing OPEN. - * If truncate fails, the OPEN fails. -+ * -+ * stp is already locked. - */ -- if (stp) { -+ if (!new_stp) { - /* Stateid was found, this is an OPEN upgrade */ -- mutex_lock(&stp->st_mutex); - status = nfs4_upgrade_open(rqstp, fp, current_fh, stp, open); - if (status) { - mutex_unlock(&stp->st_mutex); - goto out; - } - } else { -- stp = open->op_stp; -- open->op_stp = NULL; -- /* -- * init_open_stateid() either returns a locked stateid -- * it found, or initializes and locks the new one we passed in -- */ -- swapstp = init_open_stateid(stp, fp, open); -- if (swapstp) { -- nfs4_put_stid(&stp->st_stid); -- stp = swapstp; -- status = nfs4_upgrade_open(rqstp, fp, current_fh, -- stp, open); -- if (status) { -- mutex_unlock(&stp->st_mutex); -- goto out; -- } -- goto upgrade_out; -- } - status = nfs4_get_vfs_file(rqstp, fp, current_fh, stp, open); - if (status) { -- mutex_unlock(&stp->st_mutex); -+ stp->st_stid.sc_type = NFS4_CLOSED_STID; - release_open_stateid(stp); -+ mutex_unlock(&stp->st_mutex); - goto out; - } - -@@ -4327,7 +4372,7 @@ nfsd4_process_open2(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nf - if (stp->st_clnt_odstate == open->op_odstate) - open->op_odstate = NULL; - } --upgrade_out: -+ - nfs4_inc_and_copy_stateid(&open->op_stateid, &stp->st_stid); - mutex_unlock(&stp->st_mutex); - -@@ -5153,7 +5198,6 @@ static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s) - bool unhashed; - LIST_HEAD(reaplist); - -- s->st_stid.sc_type = NFS4_CLOSED_STID; - spin_lock(&clp->cl_lock); - unhashed = unhash_open_stateid(s, &reaplist); - -@@ -5192,10 +5236,12 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - nfsd4_bump_seqid(cstate, status); - if (status) - goto out; -+ -+ stp->st_stid.sc_type = NFS4_CLOSED_STID; - nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid); -- mutex_unlock(&stp->st_mutex); - - nfsd4_close_open_stateid(stp); -+ mutex_unlock(&stp->st_mutex); - - /* put reference from nfs4_preprocess_seqid_op */ - nfs4_put_stid(&stp->st_stid); -diff --git a/include/linux/netlink.h b/include/linux/netlink.h -index 639e9b8b0e4d..0b41959aab9f 100644 ---- a/include/linux/netlink.h -+++ b/include/linux/netlink.h -@@ -131,6 +131,7 @@ netlink_skb_clone(struct sk_buff *skb, gfp_t gfp_mask) - struct netlink_callback { - struct sk_buff *skb; - const struct nlmsghdr *nlh; -+ int (*start)(struct netlink_callback *); - int (*dump)(struct sk_buff * skb, - struct netlink_callback *cb); - int (*done)(struct netlink_callback *cb); -@@ -153,6 +154,7 @@ struct nlmsghdr * - __nlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, int type, int len, int flags); - - struct netlink_dump_control { -+ int (*start)(struct netlink_callback *); - int (*dump)(struct sk_buff *skb, struct netlink_callback *); - int (*done)(struct netlink_callback *); - void *data; -diff --git a/include/net/genetlink.h b/include/net/genetlink.h -index 1b6b6dcb018d..43c0e771f417 100644 ---- a/include/net/genetlink.h -+++ b/include/net/genetlink.h -@@ -114,6 +114,7 @@ static inline void genl_info_net_set(struct genl_info *info, struct net *net) - * @flags: flags - * @policy: attribute validation policy - * @doit: standard command callback -+ * @start: start callback for dumps - * @dumpit: callback for dumpers - * @done: completion callback for dumps - * @ops_list: operations list -@@ -122,6 +123,7 @@ struct genl_ops { - const struct nla_policy *policy; - int (*doit)(struct sk_buff *skb, - struct genl_info *info); -+ int (*start)(struct netlink_callback *cb); - int (*dumpit)(struct sk_buff *skb, - struct netlink_callback *cb); - int (*done)(struct netlink_callback *cb); -diff --git a/include/uapi/linux/bcache.h b/include/uapi/linux/bcache.h -index 22b6ad31c706..8562b1cb776b 100644 ---- a/include/uapi/linux/bcache.h -+++ b/include/uapi/linux/bcache.h -@@ -90,7 +90,7 @@ PTR_FIELD(PTR_GEN, 0, 8) - - #define PTR_CHECK_DEV ((1 << PTR_DEV_BITS) - 1) - --#define PTR(gen, offset, dev) \ -+#define MAKE_PTR(gen, offset, dev) \ - ((((__u64) dev) << 51) | ((__u64) offset) << 8 | gen) - - /* Bkey utility code */ -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 6c6f5ccfcda1..8f3769ec8575 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1304,17 +1304,11 @@ struct page *follow_trans_huge_pmd(struct vm_area_struct *vma, - VM_BUG_ON_PAGE(!PageHead(page), page); - if (flags & FOLL_TOUCH) { - pmd_t _pmd; -- /* -- * We should set the dirty bit only for FOLL_WRITE but -- * for now the dirty bit in the pmd is meaningless. -- * And if the dirty bit will become meaningful and -- * we'll only set it with FOLL_WRITE, an atomic -- * set_bit will be required on the pmd to set the -- * young bit, instead of the current set_pmd_at. -- */ -- _pmd = pmd_mkyoung(pmd_mkdirty(*pmd)); -+ _pmd = pmd_mkyoung(*pmd); -+ if (flags & FOLL_WRITE) -+ _pmd = pmd_mkdirty(_pmd); - if (pmdp_set_access_flags(vma, addr & HPAGE_PMD_MASK, -- pmd, _pmd, 1)) -+ pmd, _pmd, flags & FOLL_WRITE)) - update_mmu_cache_pmd(vma, addr, pmd); - } - if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) { -diff --git a/mm/madvise.c b/mm/madvise.c -index c889fcbb530e..2a0f9a4504f1 100644 ---- a/mm/madvise.c -+++ b/mm/madvise.c -@@ -223,15 +223,14 @@ static long madvise_willneed(struct vm_area_struct *vma, - { - struct file *file = vma->vm_file; - -+ *prev = vma; - #ifdef CONFIG_SWAP - if (!file) { -- *prev = vma; - force_swapin_readahead(vma, start, end); - return 0; - } - - if (shmem_mapping(file->f_mapping)) { -- *prev = vma; - force_shm_swapin_readahead(vma, start, end, - file->f_mapping); - return 0; -@@ -246,7 +245,6 @@ static long madvise_willneed(struct vm_area_struct *vma, - return 0; - } - -- *prev = vma; - start = ((start - vma->vm_start) >> PAGE_SHIFT) + vma->vm_pgoff; - if (end > vma->vm_end) - end = vma->vm_end; -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 9ecdd61c6463..a87afc4f3c91 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -2203,6 +2203,7 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, - - cb = &nlk->cb; - memset(cb, 0, sizeof(*cb)); -+ cb->start = control->start; - cb->dump = control->dump; - cb->done = control->done; - cb->nlh = nlh; -@@ -2216,6 +2217,9 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb, - - mutex_unlock(nlk->cb_mutex); - -+ if (cb->start) -+ cb->start(cb); -+ - ret = netlink_dump(sk); - sock_put(sk); - -diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c -index bc0e504f33a6..8e63662c6fb0 100644 ---- a/net/netlink/genetlink.c -+++ b/net/netlink/genetlink.c -@@ -513,6 +513,20 @@ void *genlmsg_put(struct sk_buff *skb, u32 portid, u32 seq, - } - EXPORT_SYMBOL(genlmsg_put); - -+static int genl_lock_start(struct netlink_callback *cb) -+{ -+ /* our ops are always const - netlink API doesn't propagate that */ -+ const struct genl_ops *ops = cb->data; -+ int rc = 0; -+ -+ if (ops->start) { -+ genl_lock(); -+ rc = ops->start(cb); -+ genl_unlock(); -+ } -+ return rc; -+} -+ - static int genl_lock_dumpit(struct sk_buff *skb, struct netlink_callback *cb) - { - /* our ops are always const - netlink API doesn't propagate that */ -@@ -577,6 +591,7 @@ static int genl_family_rcv_msg(struct genl_family *family, - .module = family->module, - /* we have const, but the netlink API doesn't */ - .data = (void *)ops, -+ .start = genl_lock_start, - .dump = genl_lock_dumpit, - .done = genl_lock_done, - }; -@@ -588,6 +603,7 @@ static int genl_family_rcv_msg(struct genl_family *family, - } else { - struct netlink_dump_control c = { - .module = family->module, -+ .start = ops->start, - .dump = ops->dumpit, - .done = ops->done, - }; -diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c -index 7a5a64e70b4d..76944a4839a5 100644 ---- a/net/xfrm/xfrm_user.c -+++ b/net/xfrm/xfrm_user.c -@@ -1652,32 +1652,34 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr - - static int xfrm_dump_policy_done(struct netlink_callback *cb) - { -- struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; -+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; - struct net *net = sock_net(cb->skb->sk); - - xfrm_policy_walk_done(walk, net); - return 0; - } - -+static int xfrm_dump_policy_start(struct netlink_callback *cb) -+{ -+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; -+ -+ BUILD_BUG_ON(sizeof(*walk) > sizeof(cb->args)); -+ -+ xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); -+ return 0; -+} -+ - static int xfrm_dump_policy(struct sk_buff *skb, struct netlink_callback *cb) - { - struct net *net = sock_net(skb->sk); -- struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1]; -+ struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *)cb->args; - struct xfrm_dump_info info; - -- BUILD_BUG_ON(sizeof(struct xfrm_policy_walk) > -- sizeof(cb->args) - sizeof(cb->args[0])); -- - info.in_skb = cb->skb; - info.out_skb = skb; - info.nlmsg_seq = cb->nlh->nlmsg_seq; - info.nlmsg_flags = NLM_F_MULTI; - -- if (!cb->args[0]) { -- cb->args[0] = 1; -- xfrm_policy_walk_init(walk, XFRM_POLICY_TYPE_ANY); -- } -- - (void) xfrm_policy_walk(net, walk, dump_one_policy, &info); - - return skb->len; -@@ -2415,6 +2417,7 @@ static const struct nla_policy xfrma_spd_policy[XFRMA_SPD_MAX+1] = { - - static const struct xfrm_link { - int (*doit)(struct sk_buff *, struct nlmsghdr *, struct nlattr **); -+ int (*start)(struct netlink_callback *); - int (*dump)(struct sk_buff *, struct netlink_callback *); - int (*done)(struct netlink_callback *); - const struct nla_policy *nla_pol; -@@ -2428,6 +2431,7 @@ static const struct xfrm_link { - [XFRM_MSG_NEWPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_add_policy }, - [XFRM_MSG_DELPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy }, - [XFRM_MSG_GETPOLICY - XFRM_MSG_BASE] = { .doit = xfrm_get_policy, -+ .start = xfrm_dump_policy_start, - .dump = xfrm_dump_policy, - .done = xfrm_dump_policy_done }, - [XFRM_MSG_ALLOCSPI - XFRM_MSG_BASE] = { .doit = xfrm_alloc_userspi }, -@@ -2479,6 +2483,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) - - { - struct netlink_dump_control c = { -+ .start = link->start, - .dump = link->dump, - .done = link->done, - }; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.104-105.patch b/patch/kernel/mvebu64-default/04-patch-4.4.104-105.patch deleted file mode 100644 index f4aab7628ba4..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.104-105.patch +++ /dev/null @@ -1,1339 +0,0 @@ -diff --git a/Makefile b/Makefile -index 55500e023f61..69f4ace70276 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 104 -+SUBLEVEL = 105 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/mach-omap1/dma.c b/arch/arm/mach-omap1/dma.c -index 7b02ed218a42..0c120b2ea2f9 100644 ---- a/arch/arm/mach-omap1/dma.c -+++ b/arch/arm/mach-omap1/dma.c -@@ -31,7 +31,6 @@ - #include "soc.h" - - #define OMAP1_DMA_BASE (0xfffed800) --#define OMAP1_LOGICAL_DMA_CH_COUNT 17 - - static u32 enable_1510_mode; - -@@ -311,8 +310,6 @@ static int __init omap1_system_dma_init(void) - goto exit_iounmap; - } - -- d->lch_count = OMAP1_LOGICAL_DMA_CH_COUNT; -- - /* Valid attributes for omap1 plus processors */ - if (cpu_is_omap15xx()) - d->dev_caps = ENABLE_1510_MODE; -@@ -329,13 +326,14 @@ static int __init omap1_system_dma_init(void) - d->dev_caps |= CLEAR_CSR_ON_READ; - d->dev_caps |= IS_WORD_16; - -- if (cpu_is_omap15xx()) -- d->chan_count = 9; -- else if (cpu_is_omap16xx() || cpu_is_omap7xx()) { -- if (!(d->dev_caps & ENABLE_1510_MODE)) -- d->chan_count = 16; -+ /* available logical channels */ -+ if (cpu_is_omap15xx()) { -+ d->lch_count = 9; -+ } else { -+ if (d->dev_caps & ENABLE_1510_MODE) -+ d->lch_count = 9; - else -- d->chan_count = 9; -+ d->lch_count = 16; - } - - p = dma_plat_info; -diff --git a/arch/s390/include/asm/pci_insn.h b/arch/s390/include/asm/pci_insn.h -index 649eb62c52b3..9e02cb7955c1 100644 ---- a/arch/s390/include/asm/pci_insn.h -+++ b/arch/s390/include/asm/pci_insn.h -@@ -81,6 +81,6 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range); - int zpci_load(u64 *data, u64 req, u64 offset); - int zpci_store(u64 data, u64 req, u64 offset); - int zpci_store_block(const u64 *data, u64 req, u64 offset); --void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc); -+int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc); - - #endif -diff --git a/arch/s390/include/asm/runtime_instr.h b/arch/s390/include/asm/runtime_instr.h -index 402ad6df4897..c54a9310d814 100644 ---- a/arch/s390/include/asm/runtime_instr.h -+++ b/arch/s390/include/asm/runtime_instr.h -@@ -85,6 +85,8 @@ static inline void restore_ri_cb(struct runtime_instr_cb *cb_next, - load_runtime_instr_cb(&runtime_instr_empty_cb); - } - --void exit_thread_runtime_instr(void); -+struct task_struct; -+ -+void runtime_instr_release(struct task_struct *tsk); - - #endif /* _RUNTIME_INSTR_H */ -diff --git a/arch/s390/kernel/process.c b/arch/s390/kernel/process.c -index efa035a31b98..7bc4e4c5d5b8 100644 ---- a/arch/s390/kernel/process.c -+++ b/arch/s390/kernel/process.c -@@ -72,7 +72,6 @@ extern void kernel_thread_starter(void); - */ - void exit_thread(void) - { -- exit_thread_runtime_instr(); - } - - void flush_thread(void) -@@ -87,6 +86,7 @@ void arch_release_task_struct(struct task_struct *tsk) - { - /* Free either the floating-point or the vector register save area */ - kfree(tsk->thread.fpu.regs); -+ runtime_instr_release(tsk); - } - - int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src) -diff --git a/arch/s390/kernel/runtime_instr.c b/arch/s390/kernel/runtime_instr.c -index 70cdb03d4acd..fd03a7569e10 100644 ---- a/arch/s390/kernel/runtime_instr.c -+++ b/arch/s390/kernel/runtime_instr.c -@@ -18,11 +18,24 @@ - /* empty control block to disable RI by loading it */ - struct runtime_instr_cb runtime_instr_empty_cb; - -+void runtime_instr_release(struct task_struct *tsk) -+{ -+ kfree(tsk->thread.ri_cb); -+} -+ - static void disable_runtime_instr(void) - { -- struct pt_regs *regs = task_pt_regs(current); -+ struct task_struct *task = current; -+ struct pt_regs *regs; - -+ if (!task->thread.ri_cb) -+ return; -+ regs = task_pt_regs(task); -+ preempt_disable(); - load_runtime_instr_cb(&runtime_instr_empty_cb); -+ kfree(task->thread.ri_cb); -+ task->thread.ri_cb = NULL; -+ preempt_enable(); - - /* - * Make sure the RI bit is deleted from the PSW. If the user did not -@@ -43,19 +56,6 @@ static void init_runtime_instr_cb(struct runtime_instr_cb *cb) - cb->valid = 1; - } - --void exit_thread_runtime_instr(void) --{ -- struct task_struct *task = current; -- -- preempt_disable(); -- if (!task->thread.ri_cb) -- return; -- disable_runtime_instr(); -- kfree(task->thread.ri_cb); -- task->thread.ri_cb = NULL; -- preempt_enable(); --} -- - SYSCALL_DEFINE1(s390_runtime_instr, int, command) - { - struct runtime_instr_cb *cb; -@@ -64,7 +64,7 @@ SYSCALL_DEFINE1(s390_runtime_instr, int, command) - return -EOPNOTSUPP; - - if (command == S390_RUNTIME_INSTR_STOP) { -- exit_thread_runtime_instr(); -+ disable_runtime_instr(); - return 0; - } - -diff --git a/arch/s390/pci/pci.c b/arch/s390/pci/pci.c -index f2f6720a3331..ef0499b76c50 100644 ---- a/arch/s390/pci/pci.c -+++ b/arch/s390/pci/pci.c -@@ -359,7 +359,8 @@ static void zpci_irq_handler(struct airq_struct *airq) - /* End of second scan with interrupts on. */ - break; - /* First scan complete, reenable interrupts. */ -- zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC); -+ if (zpci_set_irq_ctrl(SIC_IRQ_MODE_SINGLE, NULL, PCI_ISC)) -+ break; - si = 0; - continue; - } -@@ -921,7 +922,7 @@ static int __init pci_base_init(void) - if (!s390_pci_probe) - return 0; - -- if (!test_facility(69) || !test_facility(71) || !test_facility(72)) -+ if (!test_facility(69) || !test_facility(71)) - return 0; - - rc = zpci_debug_init(); -diff --git a/arch/s390/pci/pci_insn.c b/arch/s390/pci/pci_insn.c -index 10ca15dcab11..bc065392f7ab 100644 ---- a/arch/s390/pci/pci_insn.c -+++ b/arch/s390/pci/pci_insn.c -@@ -7,6 +7,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -91,11 +92,14 @@ int zpci_refresh_trans(u64 fn, u64 addr, u64 range) - } - - /* Set Interruption Controls */ --void zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc) -+int zpci_set_irq_ctrl(u16 ctl, char *unused, u8 isc) - { -+ if (!test_facility(72)) -+ return -EIO; - asm volatile ( - " .insn rsy,0xeb00000000d1,%[ctl],%[isc],%[u]\n" - : : [ctl] "d" (ctl), [isc] "d" (isc << 27), [u] "Q" (*unused)); -+ return 0; - } - - /* PCI Load */ -diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h -index 91dfcafe27a6..bad25bb80679 100644 ---- a/arch/x86/include/asm/syscalls.h -+++ b/arch/x86/include/asm/syscalls.h -@@ -21,7 +21,7 @@ asmlinkage long sys_ioperm(unsigned long, unsigned long, int); - asmlinkage long sys_iopl(unsigned int); - - /* kernel/ldt.c */ --asmlinkage int sys_modify_ldt(int, void __user *, unsigned long); -+asmlinkage long sys_modify_ldt(int, void __user *, unsigned long); - - /* kernel/signal.c */ - asmlinkage long sys_rt_sigreturn(void); -diff --git a/arch/x86/kernel/kprobes/ftrace.c b/arch/x86/kernel/kprobes/ftrace.c -index 5f8f0b3cc674..2c0b0b645a74 100644 ---- a/arch/x86/kernel/kprobes/ftrace.c -+++ b/arch/x86/kernel/kprobes/ftrace.c -@@ -26,7 +26,7 @@ - #include "common.h" - - static nokprobe_inline --int __skip_singlestep(struct kprobe *p, struct pt_regs *regs, -+void __skip_singlestep(struct kprobe *p, struct pt_regs *regs, - struct kprobe_ctlblk *kcb, unsigned long orig_ip) - { - /* -@@ -41,20 +41,21 @@ int __skip_singlestep(struct kprobe *p, struct pt_regs *regs, - __this_cpu_write(current_kprobe, NULL); - if (orig_ip) - regs->ip = orig_ip; -- return 1; - } - - int skip_singlestep(struct kprobe *p, struct pt_regs *regs, - struct kprobe_ctlblk *kcb) - { -- if (kprobe_ftrace(p)) -- return __skip_singlestep(p, regs, kcb, 0); -- else -- return 0; -+ if (kprobe_ftrace(p)) { -+ __skip_singlestep(p, regs, kcb, 0); -+ preempt_enable_no_resched(); -+ return 1; -+ } -+ return 0; - } - NOKPROBE_SYMBOL(skip_singlestep); - --/* Ftrace callback handler for kprobes */ -+/* Ftrace callback handler for kprobes -- called under preepmt disabed */ - void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, - struct ftrace_ops *ops, struct pt_regs *regs) - { -@@ -77,13 +78,17 @@ void kprobe_ftrace_handler(unsigned long ip, unsigned long parent_ip, - /* Kprobe handler expects regs->ip = ip + 1 as breakpoint hit */ - regs->ip = ip + sizeof(kprobe_opcode_t); - -+ /* To emulate trap based kprobes, preempt_disable here */ -+ preempt_disable(); - __this_cpu_write(current_kprobe, p); - kcb->kprobe_status = KPROBE_HIT_ACTIVE; -- if (!p->pre_handler || !p->pre_handler(p, regs)) -+ if (!p->pre_handler || !p->pre_handler(p, regs)) { - __skip_singlestep(p, regs, kcb, orig_ip); -+ preempt_enable_no_resched(); -+ } - /* - * If pre_handler returns !0, it sets regs->ip and -- * resets current kprobe. -+ * resets current kprobe, and keep preempt count +1. - */ - } - end: -diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c -index 6acc9dd91f36..d6279593bcdd 100644 ---- a/arch/x86/kernel/ldt.c -+++ b/arch/x86/kernel/ldt.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -271,8 +272,8 @@ out: - return error; - } - --asmlinkage int sys_modify_ldt(int func, void __user *ptr, -- unsigned long bytecount) -+SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr , -+ unsigned long , bytecount) - { - int ret = -ENOSYS; - -@@ -290,5 +291,14 @@ asmlinkage int sys_modify_ldt(int func, void __user *ptr, - ret = write_ldt(ptr, bytecount, 0); - break; - } -- return ret; -+ /* -+ * The SYSCALL_DEFINE() macros give us an 'unsigned long' -+ * return type, but tht ABI for sys_modify_ldt() expects -+ * 'int'. This cast gives us an int-sized value in %rax -+ * for the return code. The 'unsigned' is necessary so -+ * the compiler does not try to sign-extend the negative -+ * return codes into the high half of the register when -+ * taking the value from int->long. -+ */ -+ return (unsigned int)ret; - } -diff --git a/arch/x86/um/ldt.c b/arch/x86/um/ldt.c -index 836a1eb5df43..3ee234b6234d 100644 ---- a/arch/x86/um/ldt.c -+++ b/arch/x86/um/ldt.c -@@ -6,6 +6,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -369,7 +370,9 @@ void free_ldt(struct mm_context *mm) - mm->arch.ldt.entry_count = 0; - } - --int sys_modify_ldt(int func, void __user *ptr, unsigned long bytecount) -+SYSCALL_DEFINE3(modify_ldt, int , func , void __user * , ptr , -+ unsigned long , bytecount) - { -- return do_modify_ldt_skas(func, ptr, bytecount); -+ /* See non-um modify_ldt() for why we do this cast */ -+ return (unsigned int)do_modify_ldt_skas(func, ptr, bytecount); - } -diff --git a/drivers/dma/pl330.c b/drivers/dma/pl330.c -index 8250950aab8b..66d84bcf9bbf 100644 ---- a/drivers/dma/pl330.c -+++ b/drivers/dma/pl330.c -@@ -1657,7 +1657,6 @@ static bool _chan_ns(const struct pl330_dmac *pl330, int i) - static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) - { - struct pl330_thread *thrd = NULL; -- unsigned long flags; - int chans, i; - - if (pl330->state == DYING) -@@ -1665,8 +1664,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) - - chans = pl330->pcfg.num_chan; - -- spin_lock_irqsave(&pl330->lock, flags); -- - for (i = 0; i < chans; i++) { - thrd = &pl330->channels[i]; - if ((thrd->free) && (!_manager_ns(thrd) || -@@ -1684,8 +1681,6 @@ static struct pl330_thread *pl330_request_channel(struct pl330_dmac *pl330) - thrd = NULL; - } - -- spin_unlock_irqrestore(&pl330->lock, flags); -- - return thrd; - } - -@@ -1703,7 +1698,6 @@ static inline void _free_event(struct pl330_thread *thrd, int ev) - static void pl330_release_channel(struct pl330_thread *thrd) - { - struct pl330_dmac *pl330; -- unsigned long flags; - - if (!thrd || thrd->free) - return; -@@ -1715,10 +1709,8 @@ static void pl330_release_channel(struct pl330_thread *thrd) - - pl330 = thrd->dmac; - -- spin_lock_irqsave(&pl330->lock, flags); - _free_event(thrd, thrd->ev); - thrd->free = true; -- spin_unlock_irqrestore(&pl330->lock, flags); - } - - /* Initialize the structure for PL330 configuration, that can be used -@@ -2085,20 +2077,20 @@ static int pl330_alloc_chan_resources(struct dma_chan *chan) - struct pl330_dmac *pl330 = pch->dmac; - unsigned long flags; - -- spin_lock_irqsave(&pch->lock, flags); -+ spin_lock_irqsave(&pl330->lock, flags); - - dma_cookie_init(chan); - pch->cyclic = false; - - pch->thread = pl330_request_channel(pl330); - if (!pch->thread) { -- spin_unlock_irqrestore(&pch->lock, flags); -+ spin_unlock_irqrestore(&pl330->lock, flags); - return -ENOMEM; - } - - tasklet_init(&pch->task, pl330_tasklet, (unsigned long) pch); - -- spin_unlock_irqrestore(&pch->lock, flags); -+ spin_unlock_irqrestore(&pl330->lock, flags); - - return 1; - } -@@ -2201,12 +2193,13 @@ static int pl330_pause(struct dma_chan *chan) - static void pl330_free_chan_resources(struct dma_chan *chan) - { - struct dma_pl330_chan *pch = to_pchan(chan); -+ struct pl330_dmac *pl330 = pch->dmac; - unsigned long flags; - - tasklet_kill(&pch->task); - - pm_runtime_get_sync(pch->dmac->ddma.dev); -- spin_lock_irqsave(&pch->lock, flags); -+ spin_lock_irqsave(&pl330->lock, flags); - - pl330_release_channel(pch->thread); - pch->thread = NULL; -@@ -2214,7 +2207,7 @@ static void pl330_free_chan_resources(struct dma_chan *chan) - if (pch->cyclic) - list_splice_tail_init(&pch->work_list, &pch->dmac->desc_pool); - -- spin_unlock_irqrestore(&pch->lock, flags); -+ spin_unlock_irqrestore(&pl330->lock, flags); - pm_runtime_mark_last_busy(pch->dmac->ddma.dev); - pm_runtime_put_autosuspend(pch->dmac->ddma.dev); - } -diff --git a/drivers/edac/sb_edac.c b/drivers/edac/sb_edac.c -index ca64b174f8a3..a4e1f6939c39 100644 ---- a/drivers/edac/sb_edac.c -+++ b/drivers/edac/sb_edac.c -@@ -1773,6 +1773,7 @@ static int ibridge_mci_bind_devs(struct mem_ctl_info *mci, - break; - case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_TA: - pvt->pci_ta = pdev; -+ break; - case PCI_DEVICE_ID_INTEL_IBRIDGE_IMC_HA0_RAS: - pvt->pci_ras = pdev; - break; -diff --git a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -index fbe1b3174f75..34cebcdc2fc4 100644 ---- a/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -+++ b/drivers/gpu/drm/exynos/exynos5433_drm_decon.c -@@ -180,6 +180,8 @@ static void decon_commit(struct exynos_drm_crtc *crtc) - - /* enable output and display signal */ - decon_set_bits(ctx, DECON_VIDCON0, VIDCON0_ENVID | VIDCON0_ENVID_F, ~0); -+ -+ decon_set_bits(ctx, DECON_UPDATE, STANDALONE_UPDATE_F, ~0); - } - - static void decon_win_set_pixfmt(struct decon_context *ctx, unsigned int win, -diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c -index 6c4c7caea693..525ce56524ba 100644 ---- a/drivers/md/bcache/request.c -+++ b/drivers/md/bcache/request.c -@@ -708,7 +708,14 @@ static void cached_dev_read_error(struct closure *cl) - struct search *s = container_of(cl, struct search, cl); - struct bio *bio = &s->bio.bio; - -- if (s->recoverable) { -+ /* -+ * If read request hit dirty data (s->read_dirty_data is true), -+ * then recovery a failed read request from cached device may -+ * get a stale data back. So read failure recovery is only -+ * permitted when read request hit clean data in cache device, -+ * or when cache read race happened. -+ */ -+ if (s->recoverable && !s->read_dirty_data) { - /* Retry from the backing device: */ - trace_bcache_read_retry(s->orig_bio); - -diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c -index e90c6a7333d7..2e4649655181 100644 ---- a/drivers/net/appletalk/ipddp.c -+++ b/drivers/net/appletalk/ipddp.c -@@ -191,7 +191,7 @@ static netdev_tx_t ipddp_xmit(struct sk_buff *skb, struct net_device *dev) - */ - static int ipddp_create(struct ipddp_route *new_rt) - { -- struct ipddp_route *rt = kmalloc(sizeof(*rt), GFP_KERNEL); -+ struct ipddp_route *rt = kzalloc(sizeof(*rt), GFP_KERNEL); - - if (rt == NULL) - return -ENOMEM; -diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c -index 8860e74aa28f..027705117086 100644 ---- a/drivers/net/ethernet/broadcom/bcmsysport.c -+++ b/drivers/net/ethernet/broadcom/bcmsysport.c -@@ -1045,15 +1045,6 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, - goto out; - } - -- /* Insert TSB and checksum infos */ -- if (priv->tsb_en) { -- skb = bcm_sysport_insert_tsb(skb, dev); -- if (!skb) { -- ret = NETDEV_TX_OK; -- goto out; -- } -- } -- - /* The Ethernet switch we are interfaced with needs packets to be at - * least 64 bytes (including FCS) otherwise they will be discarded when - * they enter the switch port logic. When Broadcom tags are enabled, we -@@ -1061,13 +1052,21 @@ static netdev_tx_t bcm_sysport_xmit(struct sk_buff *skb, - * (including FCS and tag) because the length verification is done after - * the Broadcom tag is stripped off the ingress packet. - */ -- if (skb_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) { -+ if (skb_put_padto(skb, ETH_ZLEN + ENET_BRCM_TAG_LEN)) { - ret = NETDEV_TX_OK; - goto out; - } - -- skb_len = skb->len < ETH_ZLEN + ENET_BRCM_TAG_LEN ? -- ETH_ZLEN + ENET_BRCM_TAG_LEN : skb->len; -+ /* Insert TSB and checksum infos */ -+ if (priv->tsb_en) { -+ skb = bcm_sysport_insert_tsb(skb, dev); -+ if (!skb) { -+ ret = NETDEV_TX_OK; -+ goto out; -+ } -+ } -+ -+ skb_len = skb->len; - - mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE); - if (dma_mapping_error(kdev, mapping)) { -diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c -index ab716042bdd2..458e2d97d096 100644 ---- a/drivers/net/ethernet/freescale/fec_main.c -+++ b/drivers/net/ethernet/freescale/fec_main.c -@@ -2968,6 +2968,7 @@ static void set_multicast_list(struct net_device *ndev) - struct netdev_hw_addr *ha; - unsigned int i, bit, data, crc, tmp; - unsigned char hash; -+ unsigned int hash_high = 0, hash_low = 0; - - if (ndev->flags & IFF_PROMISC) { - tmp = readl(fep->hwp + FEC_R_CNTRL); -@@ -2990,11 +2991,7 @@ static void set_multicast_list(struct net_device *ndev) - return; - } - -- /* Clear filter and add the addresses in hash register -- */ -- writel(0, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); -- writel(0, fep->hwp + FEC_GRP_HASH_TABLE_LOW); -- -+ /* Add the addresses in hash register */ - netdev_for_each_mc_addr(ha, ndev) { - /* calculate crc32 value of mac address */ - crc = 0xffffffff; -@@ -3012,16 +3009,14 @@ static void set_multicast_list(struct net_device *ndev) - */ - hash = (crc >> (32 - HASH_BITS)) & 0x3f; - -- if (hash > 31) { -- tmp = readl(fep->hwp + FEC_GRP_HASH_TABLE_HIGH); -- tmp |= 1 << (hash - 32); -- writel(tmp, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); -- } else { -- tmp = readl(fep->hwp + FEC_GRP_HASH_TABLE_LOW); -- tmp |= 1 << hash; -- writel(tmp, fep->hwp + FEC_GRP_HASH_TABLE_LOW); -- } -+ if (hash > 31) -+ hash_high |= 1 << (hash - 32); -+ else -+ hash_low |= 1 << hash; - } -+ -+ writel(hash_high, fep->hwp + FEC_GRP_HASH_TABLE_HIGH); -+ writel(hash_low, fep->hwp + FEC_GRP_HASH_TABLE_LOW); - } - - /* Set a MAC change in hardware. */ -diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c -index 585e90f8341d..f735dfcb64ae 100644 ---- a/drivers/net/ethernet/renesas/ravb_main.c -+++ b/drivers/net/ethernet/renesas/ravb_main.c -@@ -831,14 +831,10 @@ static int ravb_poll(struct napi_struct *napi, int budget) - /* Receive error message handling */ - priv->rx_over_errors = priv->stats[RAVB_BE].rx_over_errors; - priv->rx_over_errors += priv->stats[RAVB_NC].rx_over_errors; -- if (priv->rx_over_errors != ndev->stats.rx_over_errors) { -+ if (priv->rx_over_errors != ndev->stats.rx_over_errors) - ndev->stats.rx_over_errors = priv->rx_over_errors; -- netif_err(priv, rx_err, ndev, "Receive Descriptor Empty\n"); -- } -- if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors) { -+ if (priv->rx_fifo_errors != ndev->stats.rx_fifo_errors) - ndev->stats.rx_fifo_errors = priv->rx_fifo_errors; -- netif_err(priv, rx_err, ndev, "Receive FIFO Overflow\n"); -- } - out: - return budget - quota; - } -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index 34a062ccb11d..fd221cc4cb79 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -1840,27 +1840,19 @@ static int talk_to_netback(struct xenbus_device *dev, - xennet_destroy_queues(info); - - err = xennet_create_queues(info, &num_queues); -- if (err < 0) -- goto destroy_ring; -+ if (err < 0) { -+ xenbus_dev_fatal(dev, err, "creating queues"); -+ kfree(info->queues); -+ info->queues = NULL; -+ goto out; -+ } - - /* Create shared ring, alloc event channel -- for each queue */ - for (i = 0; i < num_queues; ++i) { - queue = &info->queues[i]; - err = setup_netfront(dev, queue, feature_split_evtchn); -- if (err) { -- /* setup_netfront() will tidy up the current -- * queue on error, but we need to clean up -- * those already allocated. -- */ -- if (i > 0) { -- rtnl_lock(); -- netif_set_real_num_tx_queues(info->netdev, i); -- rtnl_unlock(); -- goto destroy_ring; -- } else { -- goto out; -- } -- } -+ if (err) -+ goto destroy_ring; - } - - again: -@@ -1950,9 +1942,9 @@ abort_transaction_no_dev_fatal: - xenbus_transaction_end(xbt, 1); - destroy_ring: - xennet_disconnect_backend(info); -- kfree(info->queues); -- info->queues = NULL; -+ xennet_destroy_queues(info); - out: -+ device_unregister(&dev->dev); - return err; - } - -diff --git a/drivers/spi/spi-sh-msiof.c b/drivers/spi/spi-sh-msiof.c -index d22de4c8c399..3de39bd794b6 100644 ---- a/drivers/spi/spi-sh-msiof.c -+++ b/drivers/spi/spi-sh-msiof.c -@@ -863,7 +863,7 @@ static int sh_msiof_transfer_one(struct spi_master *master, - break; - copy32 = copy_bswap32; - } else if (bits <= 16) { -- if (l & 1) -+ if (l & 3) - break; - copy32 = copy_wswap32; - } else { -diff --git a/drivers/staging/lustre/lustre/llite/llite_mmap.c b/drivers/staging/lustre/lustre/llite/llite_mmap.c -index 7df978371c9a..44fffbd1bc74 100644 ---- a/drivers/staging/lustre/lustre/llite/llite_mmap.c -+++ b/drivers/staging/lustre/lustre/llite/llite_mmap.c -@@ -402,15 +402,13 @@ static int ll_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf) - result = VM_FAULT_LOCKED; - break; - case -ENODATA: -+ case -EAGAIN: - case -EFAULT: - result = VM_FAULT_NOPAGE; - break; - case -ENOMEM: - result = VM_FAULT_OOM; - break; -- case -EAGAIN: -- result = VM_FAULT_RETRY; -- break; - default: - result = VM_FAULT_SIGBUS; - break; -diff --git a/drivers/tty/serial/8250/8250_fintek.c b/drivers/tty/serial/8250/8250_fintek.c -index 89474399ab89..1d5a9e5fb069 100644 ---- a/drivers/tty/serial/8250/8250_fintek.c -+++ b/drivers/tty/serial/8250/8250_fintek.c -@@ -117,7 +117,7 @@ static int fintek_8250_rs485_config(struct uart_port *port, - - if ((!!(rs485->flags & SER_RS485_RTS_ON_SEND)) == - (!!(rs485->flags & SER_RS485_RTS_AFTER_SEND))) -- rs485->flags &= SER_RS485_ENABLED; -+ rs485->flags &= ~SER_RS485_ENABLED; - else - config |= RS485_URA; - -diff --git a/drivers/tty/serial/8250/8250_pci.c b/drivers/tty/serial/8250/8250_pci.c -index cf3da51a3536..7025f47fa284 100644 ---- a/drivers/tty/serial/8250/8250_pci.c -+++ b/drivers/tty/serial/8250/8250_pci.c -@@ -5797,6 +5797,9 @@ static struct pci_device_id serial_pci_tbl[] = { - { PCI_DEVICE(0x1601, 0x0800), .driver_data = pbn_b0_4_1250000 }, - { PCI_DEVICE(0x1601, 0xa801), .driver_data = pbn_b0_4_1250000 }, - -+ /* Amazon PCI serial device */ -+ { PCI_DEVICE(0x1d0f, 0x8250), .driver_data = pbn_b0_1_115200 }, -+ - /* - * These entries match devices with class COMMUNICATION_SERIAL, - * COMMUNICATION_MODEM or COMMUNICATION_MULTISERIAL -diff --git a/drivers/tty/serial/8250/8250_port.c b/drivers/tty/serial/8250/8250_port.c -index 56ccbcefdd85..d42d66b72d5a 100644 ---- a/drivers/tty/serial/8250/8250_port.c -+++ b/drivers/tty/serial/8250/8250_port.c -@@ -2223,8 +2223,11 @@ static void serial8250_set_divisor(struct uart_port *port, unsigned int baud, - serial_dl_write(up, quot); - - /* XR17V35x UARTs have an extra fractional divisor register (DLD) */ -- if (up->port.type == PORT_XR17V35X) -+ if (up->port.type == PORT_XR17V35X) { -+ /* Preserve bits not related to baudrate; DLD[7:4]. */ -+ quot_frac |= serial_port_in(port, 0x2) & 0xf0; - serial_port_out(port, 0x2, quot_frac); -+ } - } - - static unsigned int -diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index 1fa4128eb88e..b07f864f68e8 100644 ---- a/drivers/tty/sysrq.c -+++ b/drivers/tty/sysrq.c -@@ -237,8 +237,10 @@ static void sysrq_handle_showallcpus(int key) - * architecture has no support for it: - */ - if (!trigger_all_cpu_backtrace()) { -- struct pt_regs *regs = get_irq_regs(); -+ struct pt_regs *regs = NULL; - -+ if (in_irq()) -+ regs = get_irq_regs(); - if (regs) { - pr_info("CPU%d:\n", smp_processor_id()); - show_regs(regs); -@@ -257,7 +259,10 @@ static struct sysrq_key_op sysrq_showallcpus_op = { - - static void sysrq_handle_showregs(int key) - { -- struct pt_regs *regs = get_irq_regs(); -+ struct pt_regs *regs = NULL; -+ -+ if (in_irq()) -+ regs = get_irq_regs(); - if (regs) - show_regs(regs); - perf_event_print_debug(); -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index 5172bec612eb..b1ece1f618c8 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -871,14 +871,25 @@ void usb_release_bos_descriptor(struct usb_device *dev) - } - } - -+static const __u8 bos_desc_len[256] = { -+ [USB_CAP_TYPE_WIRELESS_USB] = USB_DT_USB_WIRELESS_CAP_SIZE, -+ [USB_CAP_TYPE_EXT] = USB_DT_USB_EXT_CAP_SIZE, -+ [USB_SS_CAP_TYPE] = USB_DT_USB_SS_CAP_SIZE, -+ [USB_SSP_CAP_TYPE] = USB_DT_USB_SSP_CAP_SIZE(1), -+ [CONTAINER_ID_TYPE] = USB_DT_USB_SS_CONTN_ID_SIZE, -+ [USB_PTM_CAP_TYPE] = USB_DT_USB_PTM_ID_SIZE, -+}; -+ - /* Get BOS descriptor set */ - int usb_get_bos_descriptor(struct usb_device *dev) - { - struct device *ddev = &dev->dev; - struct usb_bos_descriptor *bos; - struct usb_dev_cap_header *cap; -+ struct usb_ssp_cap_descriptor *ssp_cap; - unsigned char *buffer; -- int length, total_len, num, i; -+ int length, total_len, num, i, ssac; -+ __u8 cap_type; - int ret; - - bos = kzalloc(sizeof(struct usb_bos_descriptor), GFP_KERNEL); -@@ -931,7 +942,13 @@ int usb_get_bos_descriptor(struct usb_device *dev) - dev->bos->desc->bNumDeviceCaps = i; - break; - } -+ cap_type = cap->bDevCapabilityType; - length = cap->bLength; -+ if (bos_desc_len[cap_type] && length < bos_desc_len[cap_type]) { -+ dev->bos->desc->bNumDeviceCaps = i; -+ break; -+ } -+ - total_len -= length; - - if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) { -@@ -939,7 +956,7 @@ int usb_get_bos_descriptor(struct usb_device *dev) - continue; - } - -- switch (cap->bDevCapabilityType) { -+ switch (cap_type) { - case USB_CAP_TYPE_WIRELESS_USB: - /* Wireless USB cap descriptor is handled by wusb */ - break; -@@ -952,13 +969,19 @@ int usb_get_bos_descriptor(struct usb_device *dev) - (struct usb_ss_cap_descriptor *)buffer; - break; - case USB_SSP_CAP_TYPE: -- dev->bos->ssp_cap = -- (struct usb_ssp_cap_descriptor *)buffer; -+ ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; -+ ssac = (le32_to_cpu(ssp_cap->bmAttributes) & -+ USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1; -+ if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) -+ dev->bos->ssp_cap = ssp_cap; - break; - case CONTAINER_ID_TYPE: - dev->bos->ss_id = - (struct usb_ss_container_id_descriptor *)buffer; - break; -+ case USB_PTM_CAP_TYPE: -+ dev->bos->ptm_cap = -+ (struct usb_ptm_cap_descriptor *)buffer; - default: - break; - } -diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c -index f4c3a37e00ba..ad2e6d235c30 100644 ---- a/drivers/usb/core/devio.c -+++ b/drivers/usb/core/devio.c -@@ -113,42 +113,38 @@ enum snoop_when { - #define USB_DEVICE_DEV MKDEV(USB_DEVICE_MAJOR, 0) - - /* Limit on the total amount of memory we can allocate for transfers */ --static unsigned usbfs_memory_mb = 16; -+static u32 usbfs_memory_mb = 16; - module_param(usbfs_memory_mb, uint, 0644); - MODULE_PARM_DESC(usbfs_memory_mb, - "maximum MB allowed for usbfs buffers (0 = no limit)"); - - /* Hard limit, necessary to avoid arithmetic overflow */ --#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) -+#define USBFS_XFER_MAX (UINT_MAX / 2 - 1000000) - --static atomic_t usbfs_memory_usage; /* Total memory currently allocated */ -+static atomic64_t usbfs_memory_usage; /* Total memory currently allocated */ - - /* Check whether it's okay to allocate more memory for a transfer */ --static int usbfs_increase_memory_usage(unsigned amount) -+static int usbfs_increase_memory_usage(u64 amount) - { -- unsigned lim; -+ u64 lim; - -- /* -- * Convert usbfs_memory_mb to bytes, avoiding overflows. -- * 0 means use the hard limit (effectively unlimited). -- */ - lim = ACCESS_ONCE(usbfs_memory_mb); -- if (lim == 0 || lim > (USBFS_XFER_MAX >> 20)) -- lim = USBFS_XFER_MAX; -- else -- lim <<= 20; -+ lim <<= 20; - -- atomic_add(amount, &usbfs_memory_usage); -- if (atomic_read(&usbfs_memory_usage) <= lim) -- return 0; -- atomic_sub(amount, &usbfs_memory_usage); -- return -ENOMEM; -+ atomic64_add(amount, &usbfs_memory_usage); -+ -+ if (lim > 0 && atomic64_read(&usbfs_memory_usage) > lim) { -+ atomic64_sub(amount, &usbfs_memory_usage); -+ return -ENOMEM; -+ } -+ -+ return 0; - } - - /* Memory for a transfer is being deallocated */ --static void usbfs_decrease_memory_usage(unsigned amount) -+static void usbfs_decrease_memory_usage(u64 amount) - { -- atomic_sub(amount, &usbfs_memory_usage); -+ atomic64_sub(amount, &usbfs_memory_usage); - } - - static int connected(struct usb_dev_state *ps) -@@ -1077,7 +1073,7 @@ static int proc_bulk(struct usb_dev_state *ps, void __user *arg) - if (!usb_maxpacket(dev, pipe, !(bulk.ep & USB_DIR_IN))) - return -EINVAL; - len1 = bulk.len; -- if (len1 >= USBFS_XFER_MAX) -+ if (len1 >= (INT_MAX - sizeof(struct urb))) - return -EINVAL; - ret = usbfs_increase_memory_usage(len1 + sizeof(struct urb)); - if (ret) -@@ -1297,13 +1293,19 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - int number_of_packets = 0; - unsigned int stream_id = 0; - void *buf; -- -- if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP | -- USBDEVFS_URB_SHORT_NOT_OK | -+ unsigned long mask = USBDEVFS_URB_SHORT_NOT_OK | - USBDEVFS_URB_BULK_CONTINUATION | - USBDEVFS_URB_NO_FSBR | - USBDEVFS_URB_ZERO_PACKET | -- USBDEVFS_URB_NO_INTERRUPT)) -+ USBDEVFS_URB_NO_INTERRUPT; -+ /* USBDEVFS_URB_ISO_ASAP is a special case */ -+ if (uurb->type == USBDEVFS_URB_TYPE_ISO) -+ mask |= USBDEVFS_URB_ISO_ASAP; -+ -+ if (uurb->flags & ~mask) -+ return -EINVAL; -+ -+ if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX) - return -EINVAL; - if (uurb->buffer_length > 0 && !uurb->buffer) - return -EINVAL; -@@ -1424,10 +1426,6 @@ static int proc_do_submiturb(struct usb_dev_state *ps, struct usbdevfs_urb *uurb - return -EINVAL; - } - -- if (uurb->buffer_length >= USBFS_XFER_MAX) { -- ret = -EINVAL; -- goto error; -- } - if (uurb->buffer_length > 0 && - !access_ok(is_in ? VERIFY_WRITE : VERIFY_READ, - uurb->buffer, uurb->buffer_length)) { -diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c -index 22e61786354a..0f38f577c047 100644 ---- a/drivers/usb/core/hub.c -+++ b/drivers/usb/core/hub.c -@@ -4858,6 +4858,15 @@ loop: - usb_put_dev(udev); - if ((status == -ENOTCONN) || (status == -ENOTSUPP)) - break; -+ -+ /* When halfway through our retry count, power-cycle the port */ -+ if (i == (SET_CONFIG_TRIES / 2) - 1) { -+ dev_info(&port_dev->dev, "attempt power cycle\n"); -+ usb_hub_set_port_power(hdev, hub, port1, false); -+ msleep(2 * hub_power_on_good_delay(hub)); -+ usb_hub_set_port_power(hdev, hub, port1, true); -+ msleep(hub_power_on_good_delay(hub)); -+ } - } - if (hub->hdev->parent || - !hcd->driver->port_handed_over || -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 37c418e581fb..50010282c010 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -151,6 +151,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* appletouch */ - { USB_DEVICE(0x05ac, 0x021a), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */ -+ { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM }, -+ - /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ - { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/host/ehci-dbg.c b/drivers/usb/host/ehci-dbg.c -index b26b96e25a13..8e0b9377644b 100644 ---- a/drivers/usb/host/ehci-dbg.c -+++ b/drivers/usb/host/ehci-dbg.c -@@ -851,7 +851,7 @@ static ssize_t fill_registers_buffer(struct debug_buffer *buf) - default: /* unknown */ - break; - } -- temp = (cap >> 8) & 0xff; -+ offset = (cap >> 8) & 0xff; - } - } - #endif -diff --git a/drivers/usb/phy/phy-tahvo.c b/drivers/usb/phy/phy-tahvo.c -index ab5d364f6e8c..335a1ef35224 100644 ---- a/drivers/usb/phy/phy-tahvo.c -+++ b/drivers/usb/phy/phy-tahvo.c -@@ -368,7 +368,8 @@ static int tahvo_usb_probe(struct platform_device *pdev) - tu->extcon = devm_extcon_dev_allocate(&pdev->dev, tahvo_cable); - if (IS_ERR(tu->extcon)) { - dev_err(&pdev->dev, "failed to allocate memory for extcon\n"); -- return -ENOMEM; -+ ret = PTR_ERR(tu->extcon); -+ goto err_disable_clk; - } - - ret = devm_extcon_dev_register(&pdev->dev, tu->extcon); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index db3d34c2c82e..ffa8ec917ff5 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -241,6 +241,7 @@ static void option_instat_callback(struct urb *urb); - /* These Quectel products use Quectel's vendor ID */ - #define QUECTEL_PRODUCT_EC21 0x0121 - #define QUECTEL_PRODUCT_EC25 0x0125 -+#define QUECTEL_PRODUCT_BG96 0x0296 - - #define CMOTECH_VENDOR_ID 0x16d8 - #define CMOTECH_PRODUCT_6001 0x6001 -@@ -1185,6 +1186,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC25), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), -+ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) }, - { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003), -diff --git a/drivers/usb/storage/uas-detect.h b/drivers/usb/storage/uas-detect.h -index a155cd02bce2..ecc83c405a8b 100644 ---- a/drivers/usb/storage/uas-detect.h -+++ b/drivers/usb/storage/uas-detect.h -@@ -111,6 +111,10 @@ static int uas_use_uas_driver(struct usb_interface *intf, - } - } - -+ /* All Seagate disk enclosures have broken ATA pass-through support */ -+ if (le16_to_cpu(udev->descriptor.idVendor) == 0x0bc2) -+ flags |= US_FL_NO_ATA_1X; -+ - usb_stor_adjust_quirks(udev, &flags); - - if (flags & US_FL_IGNORE_UAS) { -diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c -index 6fef53f18dcf..8ef6f70c9e25 100644 ---- a/fs/nfs/nfs4proc.c -+++ b/fs/nfs/nfs4proc.c -@@ -38,7 +38,6 @@ - #include - #include - #include --#include - #include - #include - #include -@@ -5738,7 +5737,6 @@ static struct nfs4_lockdata *nfs4_alloc_lockdata(struct file_lock *fl, - p->server = server; - atomic_inc(&lsp->ls_count); - p->ctx = get_nfs_open_context(ctx); -- get_file(fl->fl_file); - memcpy(&p->fl, fl, sizeof(p->fl)); - return p; - out_free_seqid: -@@ -5851,7 +5849,6 @@ static void nfs4_lock_release(void *calldata) - nfs_free_seqid(data->arg.lock_seqid); - nfs4_put_lock_state(data->lsp); - put_nfs_open_context(data->ctx); -- fput(data->fl.fl_file); - kfree(data); - dprintk("%s: done!\n", __func__); - } -diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c -index e8d1d6c5000c..9a0b219ff74d 100644 ---- a/fs/nfs/nfs4state.c -+++ b/fs/nfs/nfs4state.c -@@ -1680,7 +1680,6 @@ static int nfs4_recovery_handle_error(struct nfs_client *clp, int error) - break; - case -NFS4ERR_STALE_CLIENTID: - set_bit(NFS4CLNT_LEASE_EXPIRED, &clp->cl_state); -- nfs4_state_clear_reclaim_reboot(clp); - nfs4_state_start_reclaim_reboot(clp); - break; - case -NFS4ERR_EXPIRED: -diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c -index 501ecc4a1ac4..1d738723a41a 100644 ---- a/fs/ocfs2/file.c -+++ b/fs/ocfs2/file.c -@@ -1166,13 +1166,6 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) - } - size_change = S_ISREG(inode->i_mode) && attr->ia_valid & ATTR_SIZE; - if (size_change) { -- /* -- * Here we should wait dio to finish before inode lock -- * to avoid a deadlock between ocfs2_setattr() and -- * ocfs2_dio_end_io_write() -- */ -- inode_dio_wait(inode); -- - status = ocfs2_rw_lock(inode, 1); - if (status < 0) { - mlog_errno(status); -@@ -1193,6 +1186,8 @@ int ocfs2_setattr(struct dentry *dentry, struct iattr *attr) - if (status) - goto bail_unlock; - -+ inode_dio_wait(inode); -+ - if (i_size_read(inode) >= attr->ia_size) { - if (ocfs2_should_order_data(inode)) { - status = ocfs2_begin_ordered_truncate(inode, -diff --git a/include/linux/buffer_head.h b/include/linux/buffer_head.h -index 89d9aa9e79bf..6fe974dbe741 100644 ---- a/include/linux/buffer_head.h -+++ b/include/linux/buffer_head.h -@@ -234,12 +234,10 @@ static inline int block_page_mkwrite_return(int err) - { - if (err == 0) - return VM_FAULT_LOCKED; -- if (err == -EFAULT) -+ if (err == -EFAULT || err == -EAGAIN) - return VM_FAULT_NOPAGE; - if (err == -ENOMEM) - return VM_FAULT_OOM; -- if (err == -EAGAIN) -- return VM_FAULT_RETRY; - /* -ENOSPC, -EDQUOT, -EIO ... */ - return VM_FAULT_SIGBUS; - } -diff --git a/include/linux/usb.h b/include/linux/usb.h -index 8c75af6b7d5b..092b5658b9c3 100644 ---- a/include/linux/usb.h -+++ b/include/linux/usb.h -@@ -330,6 +330,7 @@ struct usb_host_bos { - struct usb_ss_cap_descriptor *ss_cap; - struct usb_ssp_cap_descriptor *ssp_cap; - struct usb_ss_container_id_descriptor *ss_id; -+ struct usb_ptm_cap_descriptor *ptm_cap; - }; - - int __usb_get_extra_descriptor(char *buffer, unsigned size, -diff --git a/include/uapi/linux/usb/ch9.h b/include/uapi/linux/usb/ch9.h -index 91ab75c1013c..ec6c8543732f 100644 ---- a/include/uapi/linux/usb/ch9.h -+++ b/include/uapi/linux/usb/ch9.h -@@ -812,6 +812,8 @@ struct usb_wireless_cap_descriptor { /* Ultra Wide Band */ - __u8 bReserved; - } __attribute__((packed)); - -+#define USB_DT_USB_WIRELESS_CAP_SIZE 11 -+ - /* USB 2.0 Extension descriptor */ - #define USB_CAP_TYPE_EXT 2 - -@@ -895,6 +897,22 @@ struct usb_ssp_cap_descriptor { - #define USB_SSP_SUBLINK_SPEED_LSM (0xff << 16) /* Lanespeed mantissa */ - } __attribute__((packed)); - -+/* -+ * Precision time measurement capability descriptor: advertised by devices and -+ * hubs that support PTM -+ */ -+#define USB_PTM_CAP_TYPE 0xb -+struct usb_ptm_cap_descriptor { -+ __u8 bLength; -+ __u8 bDescriptorType; -+ __u8 bDevCapabilityType; -+} __attribute__((packed)); -+ -+/* -+ * The size of the descriptor for the Sublink Speed Attribute Count -+ * (SSAC) specified in bmAttributes[4:0]. -+ */ -+#define USB_DT_USB_SSP_CAP_SIZE(ssac) (16 + ssac * 4) - - /*-------------------------------------------------------------------------*/ - -@@ -991,6 +1009,7 @@ enum usb3_link_state { - USB3_LPM_U3 - }; - -+#define USB_DT_USB_PTM_ID_SIZE 3 - /* - * A U1 timeout of 0x0 means the parent hub will reject any transitions to U1. - * 0xff means the parent hub will accept transitions to U1, but will not -diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c -index 9e8d70160d20..71290fb7d500 100644 ---- a/net/ipv4/tcp_input.c -+++ b/net/ipv4/tcp_input.c -@@ -4942,7 +4942,7 @@ static void tcp_check_space(struct sock *sk) - if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { - sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); - /* pairs with tcp_poll() */ -- smp_mb__after_atomic(); -+ smp_mb(); - if (sk->sk_socket && - test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) - tcp_new_space(sk); -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index 7ebb14def2cb..f58ad70f693e 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -189,12 +189,12 @@ static int vti6_tnl_create2(struct net_device *dev) - struct vti6_net *ip6n = net_generic(net, vti6_net_id); - int err; - -+ dev->rtnl_link_ops = &vti6_link_ops; - err = register_netdevice(dev); - if (err < 0) - goto out; - - strcpy(t->parms.name, dev->name); -- dev->rtnl_link_ops = &vti6_link_ops; - - dev_hold(dev); - vti6_tnl_link(ip6n, t); -diff --git a/net/sctp/debug.c b/net/sctp/debug.c -index 95d7b15dad21..e371a0d90068 100644 ---- a/net/sctp/debug.c -+++ b/net/sctp/debug.c -@@ -166,7 +166,7 @@ static const char *const sctp_timer_tbl[] = { - /* Lookup timer debug name. */ - const char *sctp_tname(const sctp_subtype_t id) - { -- if (id.timeout <= SCTP_EVENT_TIMEOUT_MAX) -+ if (id.timeout < ARRAY_SIZE(sctp_timer_tbl)) - return sctp_timer_tbl[id.timeout]; - return "unknown_timer"; - } -diff --git a/net/tipc/server.c b/net/tipc/server.c -index 50f5b0ca7b3c..c416e5184a3f 100644 ---- a/net/tipc/server.c -+++ b/net/tipc/server.c -@@ -618,14 +618,12 @@ int tipc_server_start(struct tipc_server *s) - void tipc_server_stop(struct tipc_server *s) - { - struct tipc_conn *con; -- int total = 0; - int id; - - spin_lock_bh(&s->idr_lock); -- for (id = 0; total < s->idr_in_use; id++) { -+ for (id = 0; s->idr_in_use; id++) { - con = idr_find(&s->conn_idr, id); - if (con) { -- total++; - spin_unlock_bh(&s->idr_lock); - tipc_close_conn(con); - spin_lock_bh(&s->idr_lock); -diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c -index c21f09bf8b99..98289ba2a2e6 100644 ---- a/security/integrity/ima/ima_main.c -+++ b/security/integrity/ima/ima_main.c -@@ -52,6 +52,8 @@ static int __init hash_setup(char *str) - ima_hash_algo = HASH_ALGO_SHA1; - else if (strncmp(str, "md5", 3) == 0) - ima_hash_algo = HASH_ALGO_MD5; -+ else -+ return 1; - goto out; - } - -@@ -61,6 +63,8 @@ static int __init hash_setup(char *str) - break; - } - } -+ if (i == HASH_ALGO__LAST) -+ return 1; - out: - hash_setup_done = 1; - return 1; -diff --git a/tools/perf/tests/attr.c b/tools/perf/tests/attr.c -index 638875a0960a..79547c225c14 100644 ---- a/tools/perf/tests/attr.c -+++ b/tools/perf/tests/attr.c -@@ -150,7 +150,7 @@ static int run_dir(const char *d, const char *perf) - snprintf(cmd, 3*PATH_MAX, PYTHON " %s/attr.py -d %s/attr/ -p %s %.*s", - d, d, perf, vcnt, v); - -- return system(cmd); -+ return system(cmd) ? TEST_FAIL : TEST_OK; - } - - int test__attr(void) -diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c -index 923e59eb82c7..412b845412d2 100644 ---- a/tools/testing/selftests/x86/ldt_gdt.c -+++ b/tools/testing/selftests/x86/ldt_gdt.c -@@ -351,9 +351,24 @@ static void do_simple_tests(void) - install_invalid(&desc, false); - - desc.seg_not_present = 0; -- desc.read_exec_only = 0; - desc.seg_32bit = 1; -+ desc.read_exec_only = 0; -+ desc.limit = 0xfffff; -+ - install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB); -+ -+ desc.limit_in_pages = 1; -+ -+ install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA | AR_S | AR_P | AR_DB | AR_G); -+ desc.read_exec_only = 1; -+ install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA | AR_S | AR_P | AR_DB | AR_G); -+ desc.contents = 1; -+ desc.read_exec_only = 0; -+ install_valid(&desc, AR_DPL3 | AR_TYPE_RWDATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); -+ desc.read_exec_only = 1; -+ install_valid(&desc, AR_DPL3 | AR_TYPE_RODATA_EXPDOWN | AR_S | AR_P | AR_DB | AR_G); -+ -+ desc.limit = 0; - install_invalid(&desc, true); - } - -diff --git a/virt/kvm/arm/arch_timer.c b/virt/kvm/arm/arch_timer.c -index a7b9022b5c8f..7f38db2a46c8 100644 ---- a/virt/kvm/arm/arch_timer.c -+++ b/virt/kvm/arm/arch_timer.c -@@ -84,9 +84,6 @@ static void kvm_timer_inject_irq_work(struct work_struct *work) - struct kvm_vcpu *vcpu; - - vcpu = container_of(work, struct kvm_vcpu, arch.timer_cpu.expired); -- vcpu->arch.timer_cpu.armed = false; -- -- WARN_ON(!kvm_timer_should_fire(vcpu)); - - /* - * If the vcpu is blocked we want to wake it up so that it will see diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.105-106.patch b/patch/kernel/mvebu64-default/04-patch-4.4.105-106.patch deleted file mode 100644 index 081827a8b1d3..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.105-106.patch +++ /dev/null @@ -1,3409 +0,0 @@ -diff --git a/Makefile b/Makefile -index 69f4ace70276..8225da6b520f 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 105 -+SUBLEVEL = 106 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/include/asm/assembler.h b/arch/arm/include/asm/assembler.h -index b2bc8e11471d..2c16d9e7c03c 100644 ---- a/arch/arm/include/asm/assembler.h -+++ b/arch/arm/include/asm/assembler.h -@@ -512,4 +512,22 @@ THUMB( orr \reg , \reg , #PSR_T_BIT ) - #endif - .endm - -+ .macro bug, msg, line -+#ifdef CONFIG_THUMB2_KERNEL -+1: .inst 0xde02 -+#else -+1: .inst 0xe7f001f2 -+#endif -+#ifdef CONFIG_DEBUG_BUGVERBOSE -+ .pushsection .rodata.str, "aMS", %progbits, 1 -+2: .asciz "\msg" -+ .popsection -+ .pushsection __bug_table, "aw" -+ .align 2 -+ .word 1b, 2b -+ .hword \line -+ .popsection -+#endif -+ .endm -+ - #endif /* __ASM_ASSEMBLER_H__ */ -diff --git a/arch/arm/include/asm/kvm_arm.h b/arch/arm/include/asm/kvm_arm.h -index dc641ddf0784..14602e883509 100644 ---- a/arch/arm/include/asm/kvm_arm.h -+++ b/arch/arm/include/asm/kvm_arm.h -@@ -161,8 +161,7 @@ - #else - #define VTTBR_X (5 - KVM_T0SZ) - #endif --#define VTTBR_BADDR_SHIFT (VTTBR_X - 1) --#define VTTBR_BADDR_MASK (((1LLU << (40 - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT) -+#define VTTBR_BADDR_MASK (((1LLU << (40 - VTTBR_X)) - 1) << VTTBR_X) - #define VTTBR_VMID_SHIFT (48LLU) - #define VTTBR_VMID_MASK (0xffLLU << VTTBR_VMID_SHIFT) - -@@ -209,6 +208,7 @@ - #define HSR_EC_IABT_HYP (0x21) - #define HSR_EC_DABT (0x24) - #define HSR_EC_DABT_HYP (0x25) -+#define HSR_EC_MAX (0x3f) - - #define HSR_WFI_IS_WFE (1U << 0) - -diff --git a/arch/arm/kernel/entry-header.S b/arch/arm/kernel/entry-header.S -index 0d22ad206d52..6d243e830516 100644 ---- a/arch/arm/kernel/entry-header.S -+++ b/arch/arm/kernel/entry-header.S -@@ -295,6 +295,8 @@ - mov r2, sp - ldr r1, [r2, #\offset + S_PSR] @ get calling cpsr - ldr lr, [r2, #\offset + S_PC]! @ get pc -+ tst r1, #PSR_I_BIT | 0x0f -+ bne 1f - msr spsr_cxsf, r1 @ save in spsr_svc - #if defined(CONFIG_CPU_V6) || defined(CONFIG_CPU_32v6K) - @ We must avoid clrex due to Cortex-A15 erratum #830321 -@@ -309,6 +311,7 @@ - @ after ldm {}^ - add sp, sp, #\offset + S_FRAME_SIZE - movs pc, lr @ return & move spsr_svc into cpsr -+1: bug "Returning to usermode but unexpected PSR bits set?", \@ - #elif defined(CONFIG_CPU_V7M) - @ V7M restore. - @ Note that we don't need to do clrex here as clearing the local -@@ -324,6 +327,8 @@ - ldr r1, [sp, #\offset + S_PSR] @ get calling cpsr - ldr lr, [sp, #\offset + S_PC] @ get pc - add sp, sp, #\offset + S_SP -+ tst r1, #PSR_I_BIT | 0x0f -+ bne 1f - msr spsr_cxsf, r1 @ save in spsr_svc - - @ We must avoid clrex due to Cortex-A15 erratum #830321 -@@ -336,6 +341,7 @@ - .endif - add sp, sp, #S_FRAME_SIZE - S_SP - movs pc, lr @ return & move spsr_svc into cpsr -+1: bug "Returning to usermode but unexpected PSR bits set?", \@ - #endif /* !CONFIG_THUMB2_KERNEL */ - .endm - -diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c -index 95f12b2ccdcb..f36b5b1acd1f 100644 ---- a/arch/arm/kvm/handle_exit.c -+++ b/arch/arm/kvm/handle_exit.c -@@ -100,7 +100,19 @@ static int kvm_handle_wfx(struct kvm_vcpu *vcpu, struct kvm_run *run) - return 1; - } - -+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run) -+{ -+ u32 hsr = kvm_vcpu_get_hsr(vcpu); -+ -+ kvm_pr_unimpl("Unknown exception class: hsr: %#08x\n", -+ hsr); -+ -+ kvm_inject_undefined(vcpu); -+ return 1; -+} -+ - static exit_handle_fn arm_exit_handlers[] = { -+ [0 ... HSR_EC_MAX] = kvm_handle_unknown_ec, - [HSR_EC_WFI] = kvm_handle_wfx, - [HSR_EC_CP15_32] = kvm_handle_cp15_32, - [HSR_EC_CP15_64] = kvm_handle_cp15_64, -@@ -122,13 +134,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) - { - u8 hsr_ec = kvm_vcpu_trap_get_class(vcpu); - -- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) || -- !arm_exit_handlers[hsr_ec]) { -- kvm_err("Unknown exception class: hsr: %#08x\n", -- (unsigned int)kvm_vcpu_get_hsr(vcpu)); -- BUG(); -- } -- - return arm_exit_handlers[hsr_ec]; - } - -diff --git a/arch/arm/mach-omap2/gpmc-onenand.c b/arch/arm/mach-omap2/gpmc-onenand.c -index 8633c703546a..2944af820558 100644 ---- a/arch/arm/mach-omap2/gpmc-onenand.c -+++ b/arch/arm/mach-omap2/gpmc-onenand.c -@@ -367,7 +367,7 @@ static int gpmc_onenand_setup(void __iomem *onenand_base, int *freq_ptr) - return ret; - } - --void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) -+int gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) - { - int err; - struct device *dev = &gpmc_onenand_device.dev; -@@ -393,15 +393,17 @@ void gpmc_onenand_init(struct omap_onenand_platform_data *_onenand_data) - if (err < 0) { - dev_err(dev, "Cannot request GPMC CS %d, error %d\n", - gpmc_onenand_data->cs, err); -- return; -+ return err; - } - - gpmc_onenand_resource.end = gpmc_onenand_resource.start + - ONENAND_IO_SIZE - 1; - -- if (platform_device_register(&gpmc_onenand_device) < 0) { -+ err = platform_device_register(&gpmc_onenand_device); -+ if (err) { - dev_err(dev, "Unable to register OneNAND device\n"); - gpmc_cs_free(gpmc_onenand_data->cs); -- return; - } -+ -+ return err; - } -diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c -index 131f8967589b..13e22a4a5a20 100644 ---- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c -+++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c -@@ -3885,16 +3885,20 @@ static struct omap_hwmod_ocp_if *omap3xxx_dss_hwmod_ocp_ifs[] __initdata = { - * Return: 0 if device named @dev_name is not likely to be accessible, - * or 1 if it is likely to be accessible. - */ --static int __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus, -- const char *dev_name) -+static bool __init omap3xxx_hwmod_is_hs_ip_block_usable(struct device_node *bus, -+ const char *dev_name) - { -+ struct device_node *node; -+ bool available; -+ - if (!bus) -- return (omap_type() == OMAP2_DEVICE_TYPE_GP) ? 1 : 0; -+ return omap_type() == OMAP2_DEVICE_TYPE_GP; - -- if (of_device_is_available(of_find_node_by_name(bus, dev_name))) -- return 1; -+ node = of_get_child_by_name(bus, dev_name); -+ available = of_device_is_available(node); -+ of_node_put(node); - -- return 0; -+ return available; - } - - int __init omap3xxx_hwmod_init(void) -@@ -3963,15 +3967,20 @@ int __init omap3xxx_hwmod_init(void) - - if (h_sham && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "sham")) { - r = omap_hwmod_register_links(h_sham); -- if (r < 0) -+ if (r < 0) { -+ of_node_put(bus); - return r; -+ } - } - - if (h_aes && omap3xxx_hwmod_is_hs_ip_block_usable(bus, "aes")) { - r = omap_hwmod_register_links(h_aes); -- if (r < 0) -+ if (r < 0) { -+ of_node_put(bus); - return r; -+ } - } -+ of_node_put(bus); - - /* - * Register hwmod links specific to certain ES levels of a -diff --git a/arch/arm64/include/asm/kvm_arm.h b/arch/arm64/include/asm/kvm_arm.h -index 2d960f8588b0..ef8e13d379cb 100644 ---- a/arch/arm64/include/asm/kvm_arm.h -+++ b/arch/arm64/include/asm/kvm_arm.h -@@ -164,8 +164,7 @@ - #define VTTBR_X (37 - VTCR_EL2_T0SZ_40B) - #endif - --#define VTTBR_BADDR_SHIFT (VTTBR_X - 1) --#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_BADDR_SHIFT) -+#define VTTBR_BADDR_MASK (((UL(1) << (PHYS_MASK_SHIFT - VTTBR_X)) - 1) << VTTBR_X) - #define VTTBR_VMID_SHIFT (UL(48)) - #define VTTBR_VMID_MASK (UL(0xFF) << VTTBR_VMID_SHIFT) - -diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c -index f75b540bc3b4..10d6627673cb 100644 ---- a/arch/arm64/kernel/process.c -+++ b/arch/arm64/kernel/process.c -@@ -251,6 +251,15 @@ int copy_thread(unsigned long clone_flags, unsigned long stack_start, - - memset(&p->thread.cpu_context, 0, sizeof(struct cpu_context)); - -+ /* -+ * In case p was allocated the same task_struct pointer as some -+ * other recently-exited task, make sure p is disassociated from -+ * any cpu that may have run that now-exited task recently. -+ * Otherwise we could erroneously skip reloading the FPSIMD -+ * registers for p. -+ */ -+ fpsimd_flush_task_state(p); -+ - if (likely(!(p->flags & PF_KTHREAD))) { - *childregs = *current_pt_regs(); - childregs->regs[0] = 0; -diff --git a/arch/arm64/kvm/handle_exit.c b/arch/arm64/kvm/handle_exit.c -index 15f0477b0d2a..ba93a09eb536 100644 ---- a/arch/arm64/kvm/handle_exit.c -+++ b/arch/arm64/kvm/handle_exit.c -@@ -121,7 +121,19 @@ static int kvm_handle_guest_debug(struct kvm_vcpu *vcpu, struct kvm_run *run) - return ret; - } - -+static int kvm_handle_unknown_ec(struct kvm_vcpu *vcpu, struct kvm_run *run) -+{ -+ u32 hsr = kvm_vcpu_get_hsr(vcpu); -+ -+ kvm_pr_unimpl("Unknown exception class: hsr: %#08x -- %s\n", -+ hsr, esr_get_class_string(hsr)); -+ -+ kvm_inject_undefined(vcpu); -+ return 1; -+} -+ - static exit_handle_fn arm_exit_handlers[] = { -+ [0 ... ESR_ELx_EC_MAX] = kvm_handle_unknown_ec, - [ESR_ELx_EC_WFx] = kvm_handle_wfx, - [ESR_ELx_EC_CP15_32] = kvm_handle_cp15_32, - [ESR_ELx_EC_CP15_64] = kvm_handle_cp15_64, -@@ -147,13 +159,6 @@ static exit_handle_fn kvm_get_exit_handler(struct kvm_vcpu *vcpu) - u32 hsr = kvm_vcpu_get_hsr(vcpu); - u8 hsr_ec = hsr >> ESR_ELx_EC_SHIFT; - -- if (hsr_ec >= ARRAY_SIZE(arm_exit_handlers) || -- !arm_exit_handlers[hsr_ec]) { -- kvm_err("Unknown exception class: hsr: %#08x -- %s\n", -- hsr, esr_get_class_string(hsr)); -- BUG(); -- } -- - return arm_exit_handlers[hsr_ec]; - } - -diff --git a/arch/powerpc/platforms/powernv/pci-ioda.c b/arch/powerpc/platforms/powernv/pci-ioda.c -index e40d0714679e..ecb7f3220355 100644 ---- a/arch/powerpc/platforms/powernv/pci-ioda.c -+++ b/arch/powerpc/platforms/powernv/pci-ioda.c -@@ -2270,6 +2270,9 @@ static long pnv_pci_ioda2_table_alloc_pages(int nid, __u64 bus_offset, - level_shift = entries_shift + 3; - level_shift = max_t(unsigned, level_shift, PAGE_SHIFT); - -+ if ((level_shift - 3) * levels + page_shift >= 60) -+ return -EINVAL; -+ - /* Allocate TCE table */ - addr = pnv_pci_ioda2_table_do_alloc_pages(nid, level_shift, - levels, tce_table_size, &offset, &total_allocated); -diff --git a/arch/powerpc/sysdev/axonram.c b/arch/powerpc/sysdev/axonram.c -index 7a399b4d60a0..566e8fc341f3 100644 ---- a/arch/powerpc/sysdev/axonram.c -+++ b/arch/powerpc/sysdev/axonram.c -@@ -276,7 +276,9 @@ failed: - if (bank->disk->major > 0) - unregister_blkdev(bank->disk->major, - bank->disk->disk_name); -- del_gendisk(bank->disk); -+ if (bank->disk->flags & GENHD_FL_UP) -+ del_gendisk(bank->disk); -+ put_disk(bank->disk); - } - device->dev.platform_data = NULL; - if (bank->io_addr != 0) -@@ -301,6 +303,7 @@ axon_ram_remove(struct platform_device *device) - device_remove_file(&device->dev, &dev_attr_ecc); - free_irq(bank->irq_id, device); - del_gendisk(bank->disk); -+ put_disk(bank->disk); - iounmap((void __iomem *) bank->io_addr); - kfree(bank); - -diff --git a/arch/s390/include/asm/asm-prototypes.h b/arch/s390/include/asm/asm-prototypes.h -deleted file mode 100644 -index 2c3413b0ca52..000000000000 ---- a/arch/s390/include/asm/asm-prototypes.h -+++ /dev/null -@@ -1,8 +0,0 @@ --#ifndef _ASM_S390_PROTOTYPES_H -- --#include --#include --#include --#include -- --#endif /* _ASM_S390_PROTOTYPES_H */ -diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h -index dde6b52359c5..ff2fbdafe689 100644 ---- a/arch/s390/include/asm/switch_to.h -+++ b/arch/s390/include/asm/switch_to.h -@@ -29,17 +29,16 @@ static inline void restore_access_regs(unsigned int *acrs) - } - - #define switch_to(prev,next,last) do { \ -- if (prev->mm) { \ -- save_fpu_regs(); \ -- save_access_regs(&prev->thread.acrs[0]); \ -- save_ri_cb(prev->thread.ri_cb); \ -- } \ -+ /* save_fpu_regs() sets the CIF_FPU flag, which enforces \ -+ * a restore of the floating point / vector registers as \ -+ * soon as the next task returns to user space \ -+ */ \ -+ save_fpu_regs(); \ -+ save_access_regs(&prev->thread.acrs[0]); \ -+ save_ri_cb(prev->thread.ri_cb); \ - update_cr_regs(next); \ -- if (next->mm) { \ -- set_cpu_flag(CIF_FPU); \ -- restore_access_regs(&next->thread.acrs[0]); \ -- restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb); \ -- } \ -+ restore_access_regs(&next->thread.acrs[0]); \ -+ restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb); \ - prev = __switch_to(prev,next); \ - } while (0) - -diff --git a/arch/s390/kernel/syscalls.S b/arch/s390/kernel/syscalls.S -index 5378c3ea1b98..a1eeaa0db8b7 100644 ---- a/arch/s390/kernel/syscalls.S -+++ b/arch/s390/kernel/syscalls.S -@@ -369,10 +369,10 @@ SYSCALL(sys_recvmmsg,compat_sys_recvmmsg) - SYSCALL(sys_sendmmsg,compat_sys_sendmmsg) - SYSCALL(sys_socket,sys_socket) - SYSCALL(sys_socketpair,compat_sys_socketpair) /* 360 */ --SYSCALL(sys_bind,sys_bind) --SYSCALL(sys_connect,sys_connect) -+SYSCALL(sys_bind,compat_sys_bind) -+SYSCALL(sys_connect,compat_sys_connect) - SYSCALL(sys_listen,sys_listen) --SYSCALL(sys_accept4,sys_accept4) -+SYSCALL(sys_accept4,compat_sys_accept4) - SYSCALL(sys_getsockopt,compat_sys_getsockopt) /* 365 */ - SYSCALL(sys_setsockopt,compat_sys_setsockopt) - SYSCALL(sys_getsockname,compat_sys_getsockname) -diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c -index 384aba109d7c..c2f376ce443b 100644 ---- a/arch/sparc/mm/init_64.c -+++ b/arch/sparc/mm/init_64.c -@@ -2402,9 +2402,16 @@ void __init mem_init(void) - { - high_memory = __va(last_valid_pfn << PAGE_SHIFT); - -- register_page_bootmem_info(); - free_all_bootmem(); - -+ /* -+ * Must be done after boot memory is put on freelist, because here we -+ * might set fields in deferred struct pages that have not yet been -+ * initialized, and free_all_bootmem() initializes all the reserved -+ * deferred pages for us. -+ */ -+ register_page_bootmem_info(); -+ - /* - * Set up the zero page, mark it reserved, so that page count - * is not manipulated when freeing the page from user ptes. -diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h -index 8fd9e637629a..0010c78c4998 100644 ---- a/arch/x86/include/asm/efi.h -+++ b/arch/x86/include/asm/efi.h -@@ -3,7 +3,6 @@ - - #include - #include --#include - - /* - * We map the EFI regions needed for runtime services non-contiguously, -@@ -65,17 +64,6 @@ extern u64 asmlinkage efi_call(void *fp, ...); - - #define efi_call_phys(f, args...) efi_call((f), args) - --/* -- * Scratch space used for switching the pagetable in the EFI stub -- */ --struct efi_scratch { -- u64 r15; -- u64 prev_cr3; -- pgd_t *efi_pgt; -- bool use_pgd; -- u64 phys_stack; --} __packed; -- - #define efi_call_virt(f, ...) \ - ({ \ - efi_status_t __s; \ -@@ -83,20 +71,7 @@ struct efi_scratch { - efi_sync_low_kernel_mappings(); \ - preempt_disable(); \ - __kernel_fpu_begin(); \ -- \ -- if (efi_scratch.use_pgd) { \ -- efi_scratch.prev_cr3 = read_cr3(); \ -- write_cr3((unsigned long)efi_scratch.efi_pgt); \ -- __flush_tlb_all(); \ -- } \ -- \ - __s = efi_call((void *)efi.systab->runtime->f, __VA_ARGS__); \ -- \ -- if (efi_scratch.use_pgd) { \ -- write_cr3(efi_scratch.prev_cr3); \ -- __flush_tlb_all(); \ -- } \ -- \ - __kernel_fpu_end(); \ - preempt_enable(); \ - __s; \ -@@ -136,7 +111,6 @@ extern void __init efi_memory_uc(u64 addr, unsigned long size); - extern void __init efi_map_region(efi_memory_desc_t *md); - extern void __init efi_map_region_fixed(efi_memory_desc_t *md); - extern void efi_sync_low_kernel_mappings(void); --extern int __init efi_alloc_page_tables(void); - extern int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages); - extern void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages); - extern void __init old_map_region(efi_memory_desc_t *md); -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index acc9b8f19ca8..f48eb8eeefe2 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -353,7 +353,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer) - - irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq)); - irq_domain_activate_irq(irq_get_irq_data(hdev->irq)); -- disable_irq(hdev->irq); -+ disable_hardirq(hdev->irq); - irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu)); - enable_irq(hdev->irq); - } -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 253a8c8207bb..dcbafe53e2d4 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -6182,12 +6182,7 @@ static __init int hardware_setup(void) - memset(vmx_vmread_bitmap, 0xff, PAGE_SIZE); - memset(vmx_vmwrite_bitmap, 0xff, PAGE_SIZE); - -- /* -- * Allow direct access to the PC debug port (it is often used for I/O -- * delays, but the vmexits simply slow things down). -- */ - memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE); -- clear_bit(0x80, vmx_io_bitmap_a); - - memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE); - -@@ -6929,9 +6924,8 @@ static int handle_vmoff(struct kvm_vcpu *vcpu) - static int handle_vmclear(struct kvm_vcpu *vcpu) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); -+ u32 zero = 0; - gpa_t vmptr; -- struct vmcs12 *vmcs12; -- struct page *page; - - if (!nested_vmx_check_permission(vcpu)) - return 1; -@@ -6942,22 +6936,9 @@ static int handle_vmclear(struct kvm_vcpu *vcpu) - if (vmptr == vmx->nested.current_vmptr) - nested_release_vmcs12(vmx); - -- page = nested_get_page(vcpu, vmptr); -- if (page == NULL) { -- /* -- * For accurate processor emulation, VMCLEAR beyond available -- * physical memory should do nothing at all. However, it is -- * possible that a nested vmx bug, not a guest hypervisor bug, -- * resulted in this case, so let's shut down before doing any -- * more damage: -- */ -- kvm_make_request(KVM_REQ_TRIPLE_FAULT, vcpu); -- return 1; -- } -- vmcs12 = kmap(page); -- vmcs12->launch_state = 0; -- kunmap(page); -- nested_release_page(page); -+ kvm_vcpu_write_guest(vcpu, -+ vmptr + offsetof(struct vmcs12, launch_state), -+ &zero, sizeof(zero)); - - nested_free_vmcs02(vmx, vmptr); - -@@ -10574,8 +10555,10 @@ static void nested_vmx_vmexit(struct kvm_vcpu *vcpu, u32 exit_reason, - */ - static void vmx_leave_nested(struct kvm_vcpu *vcpu) - { -- if (is_guest_mode(vcpu)) -+ if (is_guest_mode(vcpu)) { -+ to_vmx(vcpu)->nested.nested_run_pending = 0; - nested_vmx_vmexit(vcpu, -1, 0, 0); -+ } - free_nested(to_vmx(vcpu)); - } - -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index a0fe62e3f4a3..b599a780a5a9 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -911,10 +911,15 @@ static void populate_pte(struct cpa_data *cpa, - pte = pte_offset_kernel(pmd, start); - - while (num_pages-- && start < end) { -- set_pte(pte, pfn_pte(cpa->pfn, pgprot)); -+ -+ /* deal with the NX bit */ -+ if (!(pgprot_val(pgprot) & _PAGE_NX)) -+ cpa->pfn &= ~_PAGE_NX; -+ -+ set_pte(pte, pfn_pte(cpa->pfn >> PAGE_SHIFT, pgprot)); - - start += PAGE_SIZE; -- cpa->pfn++; -+ cpa->pfn += PAGE_SIZE; - pte++; - } - } -@@ -970,11 +975,11 @@ static int populate_pmd(struct cpa_data *cpa, - - pmd = pmd_offset(pud, start); - -- set_pmd(pmd, __pmd(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | -+ set_pmd(pmd, __pmd(cpa->pfn | _PAGE_PSE | - massage_pgprot(pmd_pgprot))); - - start += PMD_SIZE; -- cpa->pfn += PMD_SIZE >> PAGE_SHIFT; -+ cpa->pfn += PMD_SIZE; - cur_pages += PMD_SIZE >> PAGE_SHIFT; - } - -@@ -1043,11 +1048,11 @@ static int populate_pud(struct cpa_data *cpa, unsigned long start, pgd_t *pgd, - * Map everything starting from the Gb boundary, possibly with 1G pages - */ - while (end - start >= PUD_SIZE) { -- set_pud(pud, __pud(cpa->pfn << PAGE_SHIFT | _PAGE_PSE | -+ set_pud(pud, __pud(cpa->pfn | _PAGE_PSE | - massage_pgprot(pud_pgprot))); - - start += PUD_SIZE; -- cpa->pfn += PUD_SIZE >> PAGE_SHIFT; -+ cpa->pfn += PUD_SIZE; - cur_pages += PUD_SIZE >> PAGE_SHIFT; - pud++; - } -diff --git a/arch/x86/pci/broadcom_bus.c b/arch/x86/pci/broadcom_bus.c -index bb461cfd01ab..526536c81ddc 100644 ---- a/arch/x86/pci/broadcom_bus.c -+++ b/arch/x86/pci/broadcom_bus.c -@@ -97,7 +97,7 @@ static int __init broadcom_postcore_init(void) - * We should get host bridge information from ACPI unless the BIOS - * doesn't support it. - */ -- if (acpi_os_get_root_pointer()) -+ if (!acpi_disabled && acpi_os_get_root_pointer()) - return 0; - #endif - -diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c -index 3c1f3cd7b2ba..ad285404ea7f 100644 ---- a/arch/x86/platform/efi/efi.c -+++ b/arch/x86/platform/efi/efi.c -@@ -869,7 +869,7 @@ static void __init kexec_enter_virtual_mode(void) - * This function will switch the EFI runtime services to virtual mode. - * Essentially, we look through the EFI memmap and map every region that - * has the runtime attribute bit set in its memory descriptor into the -- * efi_pgd page table. -+ * ->trampoline_pgd page table using a top-down VA allocation scheme. - * - * The old method which used to update that memory descriptor with the - * virtual address obtained from ioremap() is still supported when the -@@ -879,8 +879,8 @@ static void __init kexec_enter_virtual_mode(void) - * - * The new method does a pagetable switch in a preemption-safe manner - * so that we're in a different address space when calling a runtime -- * function. For function arguments passing we do copy the PUDs of the -- * kernel page table into efi_pgd prior to each call. -+ * function. For function arguments passing we do copy the PGDs of the -+ * kernel page table into ->trampoline_pgd prior to each call. - * - * Specially for kexec boot, efi runtime maps in previous kernel should - * be passed in via setup_data. In that case runtime ranges will be mapped -@@ -895,12 +895,6 @@ static void __init __efi_enter_virtual_mode(void) - - efi.systab = NULL; - -- if (efi_alloc_page_tables()) { -- pr_err("Failed to allocate EFI page tables\n"); -- clear_bit(EFI_RUNTIME_SERVICES, &efi.flags); -- return; -- } -- - efi_merge_regions(); - new_memmap = efi_map_regions(&count, &pg_shift); - if (!new_memmap) { -@@ -960,11 +954,28 @@ static void __init __efi_enter_virtual_mode(void) - efi_runtime_mkexec(); - - /* -- * We mapped the descriptor array into the EFI pagetable above -- * but we're not unmapping it here because if we're running in -- * EFI mixed mode we need all of memory to be accessible when -- * we pass parameters to the EFI runtime services in the -- * thunking code. -+ * We mapped the descriptor array into the EFI pagetable above but we're -+ * not unmapping it here. Here's why: -+ * -+ * We're copying select PGDs from the kernel page table to the EFI page -+ * table and when we do so and make changes to those PGDs like unmapping -+ * stuff from them, those changes appear in the kernel page table and we -+ * go boom. -+ * -+ * From setup_real_mode(): -+ * -+ * ... -+ * trampoline_pgd[0] = init_level4_pgt[pgd_index(__PAGE_OFFSET)].pgd; -+ * -+ * In this particular case, our allocation is in PGD 0 of the EFI page -+ * table but we've copied that PGD from PGD[272] of the EFI page table: -+ * -+ * pgd_index(__PAGE_OFFSET = 0xffff880000000000) = 272 -+ * -+ * where the direct memory mapping in kernel space is. -+ * -+ * new_memmap's VA comes from that direct mapping and thus clearing it, -+ * it would get cleared in the kernel page table too. - * - * efi_cleanup_page_tables(__pa(new_memmap), 1 << pg_shift); - */ -diff --git a/arch/x86/platform/efi/efi_32.c b/arch/x86/platform/efi/efi_32.c -index 58d669bc8250..ed5b67338294 100644 ---- a/arch/x86/platform/efi/efi_32.c -+++ b/arch/x86/platform/efi/efi_32.c -@@ -38,11 +38,6 @@ - * say 0 - 3G. - */ - --int __init efi_alloc_page_tables(void) --{ -- return 0; --} -- - void efi_sync_low_kernel_mappings(void) {} - void __init efi_dump_pagetable(void) {} - int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) -diff --git a/arch/x86/platform/efi/efi_64.c b/arch/x86/platform/efi/efi_64.c -index 18dfaad71c99..a0ac0f9c307f 100644 ---- a/arch/x86/platform/efi/efi_64.c -+++ b/arch/x86/platform/efi/efi_64.c -@@ -40,7 +40,6 @@ - #include - #include - #include --#include - - /* - * We allocate runtime services regions bottom-up, starting from -4G, i.e. -@@ -48,7 +47,16 @@ - */ - static u64 efi_va = EFI_VA_START; - --struct efi_scratch efi_scratch; -+/* -+ * Scratch space used for switching the pagetable in the EFI stub -+ */ -+struct efi_scratch { -+ u64 r15; -+ u64 prev_cr3; -+ pgd_t *efi_pgt; -+ bool use_pgd; -+ u64 phys_stack; -+} __packed; - - static void __init early_code_mapping_set_exec(int executable) - { -@@ -75,11 +83,8 @@ pgd_t * __init efi_call_phys_prolog(void) - int pgd; - int n_pgds; - -- if (!efi_enabled(EFI_OLD_MEMMAP)) { -- save_pgd = (pgd_t *)read_cr3(); -- write_cr3((unsigned long)efi_scratch.efi_pgt); -- goto out; -- } -+ if (!efi_enabled(EFI_OLD_MEMMAP)) -+ return NULL; - - early_code_mapping_set_exec(1); - -@@ -91,7 +96,6 @@ pgd_t * __init efi_call_phys_prolog(void) - vaddress = (unsigned long)__va(pgd * PGDIR_SIZE); - set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), *pgd_offset_k(vaddress)); - } --out: - __flush_tlb_all(); - - return save_pgd; -@@ -105,11 +109,8 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd) - int pgd_idx; - int nr_pgds; - -- if (!efi_enabled(EFI_OLD_MEMMAP)) { -- write_cr3((unsigned long)save_pgd); -- __flush_tlb_all(); -+ if (!save_pgd) - return; -- } - - nr_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT) , PGDIR_SIZE); - -@@ -122,97 +123,27 @@ void __init efi_call_phys_epilog(pgd_t *save_pgd) - early_code_mapping_set_exec(0); - } - --static pgd_t *efi_pgd; -- --/* -- * We need our own copy of the higher levels of the page tables -- * because we want to avoid inserting EFI region mappings (EFI_VA_END -- * to EFI_VA_START) into the standard kernel page tables. Everything -- * else can be shared, see efi_sync_low_kernel_mappings(). -- */ --int __init efi_alloc_page_tables(void) --{ -- pgd_t *pgd; -- pud_t *pud; -- gfp_t gfp_mask; -- -- if (efi_enabled(EFI_OLD_MEMMAP)) -- return 0; -- -- gfp_mask = GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO; -- efi_pgd = (pgd_t *)__get_free_page(gfp_mask); -- if (!efi_pgd) -- return -ENOMEM; -- -- pgd = efi_pgd + pgd_index(EFI_VA_END); -- -- pud = pud_alloc_one(NULL, 0); -- if (!pud) { -- free_page((unsigned long)efi_pgd); -- return -ENOMEM; -- } -- -- pgd_populate(NULL, pgd, pud); -- -- return 0; --} -- - /* - * Add low kernel mappings for passing arguments to EFI functions. - */ - void efi_sync_low_kernel_mappings(void) - { -- unsigned num_entries; -- pgd_t *pgd_k, *pgd_efi; -- pud_t *pud_k, *pud_efi; -+ unsigned num_pgds; -+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); - - if (efi_enabled(EFI_OLD_MEMMAP)) - return; - -- /* -- * We can share all PGD entries apart from the one entry that -- * covers the EFI runtime mapping space. -- * -- * Make sure the EFI runtime region mappings are guaranteed to -- * only span a single PGD entry and that the entry also maps -- * other important kernel regions. -- */ -- BUILD_BUG_ON(pgd_index(EFI_VA_END) != pgd_index(MODULES_END)); -- BUILD_BUG_ON((EFI_VA_START & PGDIR_MASK) != -- (EFI_VA_END & PGDIR_MASK)); -- -- pgd_efi = efi_pgd + pgd_index(PAGE_OFFSET); -- pgd_k = pgd_offset_k(PAGE_OFFSET); -+ num_pgds = pgd_index(MODULES_END - 1) - pgd_index(PAGE_OFFSET); - -- num_entries = pgd_index(EFI_VA_END) - pgd_index(PAGE_OFFSET); -- memcpy(pgd_efi, pgd_k, sizeof(pgd_t) * num_entries); -- -- /* -- * We share all the PUD entries apart from those that map the -- * EFI regions. Copy around them. -- */ -- BUILD_BUG_ON((EFI_VA_START & ~PUD_MASK) != 0); -- BUILD_BUG_ON((EFI_VA_END & ~PUD_MASK) != 0); -- -- pgd_efi = efi_pgd + pgd_index(EFI_VA_END); -- pud_efi = pud_offset(pgd_efi, 0); -- -- pgd_k = pgd_offset_k(EFI_VA_END); -- pud_k = pud_offset(pgd_k, 0); -- -- num_entries = pud_index(EFI_VA_END); -- memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries); -- -- pud_efi = pud_offset(pgd_efi, EFI_VA_START); -- pud_k = pud_offset(pgd_k, EFI_VA_START); -- -- num_entries = PTRS_PER_PUD - pud_index(EFI_VA_START); -- memcpy(pud_efi, pud_k, sizeof(pud_t) * num_entries); -+ memcpy(pgd + pgd_index(PAGE_OFFSET), -+ init_mm.pgd + pgd_index(PAGE_OFFSET), -+ sizeof(pgd_t) * num_pgds); - } - - int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - { -- unsigned long pfn, text; -+ unsigned long text; - struct page *page; - unsigned npages; - pgd_t *pgd; -@@ -220,8 +151,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - if (efi_enabled(EFI_OLD_MEMMAP)) - return 0; - -- efi_scratch.efi_pgt = (pgd_t *)__pa(efi_pgd); -- pgd = efi_pgd; -+ efi_scratch.efi_pgt = (pgd_t *)(unsigned long)real_mode_header->trampoline_pgd; -+ pgd = __va(efi_scratch.efi_pgt); - - /* - * It can happen that the physical address of new_memmap lands in memory -@@ -229,8 +160,7 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - * and ident-map those pages containing the map before calling - * phys_efi_set_virtual_address_map(). - */ -- pfn = pa_memmap >> PAGE_SHIFT; -- if (kernel_map_pages_in_pgd(pgd, pfn, pa_memmap, num_pages, _PAGE_NX)) { -+ if (kernel_map_pages_in_pgd(pgd, pa_memmap, pa_memmap, num_pages, _PAGE_NX)) { - pr_err("Error ident-mapping new memmap (0x%lx)!\n", pa_memmap); - return 1; - } -@@ -255,9 +185,8 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - - npages = (_end - _text) >> PAGE_SHIFT; - text = __pa(_text); -- pfn = text >> PAGE_SHIFT; - -- if (kernel_map_pages_in_pgd(pgd, pfn, text, npages, 0)) { -+ if (kernel_map_pages_in_pgd(pgd, text >> PAGE_SHIFT, text, npages, 0)) { - pr_err("Failed to map kernel text 1:1\n"); - return 1; - } -@@ -267,20 +196,20 @@ int __init efi_setup_page_tables(unsigned long pa_memmap, unsigned num_pages) - - void __init efi_cleanup_page_tables(unsigned long pa_memmap, unsigned num_pages) - { -- kernel_unmap_pages_in_pgd(efi_pgd, pa_memmap, num_pages); -+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -+ -+ kernel_unmap_pages_in_pgd(pgd, pa_memmap, num_pages); - } - - static void __init __map_region(efi_memory_desc_t *md, u64 va) - { -- unsigned long flags = 0; -- unsigned long pfn; -- pgd_t *pgd = efi_pgd; -+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -+ unsigned long pf = 0; - - if (!(md->attribute & EFI_MEMORY_WB)) -- flags |= _PAGE_PCD; -+ pf |= _PAGE_PCD; - -- pfn = md->phys_addr >> PAGE_SHIFT; -- if (kernel_map_pages_in_pgd(pgd, pfn, va, md->num_pages, flags)) -+ if (kernel_map_pages_in_pgd(pgd, md->phys_addr, va, md->num_pages, pf)) - pr_warn("Error mapping PA 0x%llx -> VA 0x%llx!\n", - md->phys_addr, va); - } -@@ -383,7 +312,9 @@ void __init efi_runtime_mkexec(void) - void __init efi_dump_pagetable(void) - { - #ifdef CONFIG_EFI_PGT_DUMP -- ptdump_walk_pgd_level(NULL, efi_pgd); -+ pgd_t *pgd = (pgd_t *)__va(real_mode_header->trampoline_pgd); -+ -+ ptdump_walk_pgd_level(NULL, pgd); - #endif - } - -diff --git a/arch/x86/platform/efi/efi_stub_64.S b/arch/x86/platform/efi/efi_stub_64.S -index 32020cb8bb08..86d0f9e08dd9 100644 ---- a/arch/x86/platform/efi/efi_stub_64.S -+++ b/arch/x86/platform/efi/efi_stub_64.S -@@ -38,6 +38,41 @@ - mov %rsi, %cr0; \ - mov (%rsp), %rsp - -+ /* stolen from gcc */ -+ .macro FLUSH_TLB_ALL -+ movq %r15, efi_scratch(%rip) -+ movq %r14, efi_scratch+8(%rip) -+ movq %cr4, %r15 -+ movq %r15, %r14 -+ andb $0x7f, %r14b -+ movq %r14, %cr4 -+ movq %r15, %cr4 -+ movq efi_scratch+8(%rip), %r14 -+ movq efi_scratch(%rip), %r15 -+ .endm -+ -+ .macro SWITCH_PGT -+ cmpb $0, efi_scratch+24(%rip) -+ je 1f -+ movq %r15, efi_scratch(%rip) # r15 -+ # save previous CR3 -+ movq %cr3, %r15 -+ movq %r15, efi_scratch+8(%rip) # prev_cr3 -+ movq efi_scratch+16(%rip), %r15 # EFI pgt -+ movq %r15, %cr3 -+ 1: -+ .endm -+ -+ .macro RESTORE_PGT -+ cmpb $0, efi_scratch+24(%rip) -+ je 2f -+ movq efi_scratch+8(%rip), %r15 -+ movq %r15, %cr3 -+ movq efi_scratch(%rip), %r15 -+ FLUSH_TLB_ALL -+ 2: -+ .endm -+ - ENTRY(efi_call) - SAVE_XMM - mov (%rsp), %rax -@@ -48,8 +83,16 @@ ENTRY(efi_call) - mov %r8, %r9 - mov %rcx, %r8 - mov %rsi, %rcx -+ SWITCH_PGT - call *%rdi -+ RESTORE_PGT - addq $48, %rsp - RESTORE_XMM - ret - ENDPROC(efi_call) -+ -+ .data -+ENTRY(efi_scratch) -+ .fill 3,8,0 -+ .byte 0 -+ .quad 0 -diff --git a/block/bio.c b/block/bio.c -index 68bbc835bacc..63363a689922 100644 ---- a/block/bio.c -+++ b/block/bio.c -@@ -1268,6 +1268,7 @@ struct bio *bio_map_user_iov(struct request_queue *q, - int ret, offset; - struct iov_iter i; - struct iovec iov; -+ struct bio_vec *bvec; - - iov_for_each(iov, i, *iter) { - unsigned long uaddr = (unsigned long) iov.iov_base; -@@ -1312,7 +1313,12 @@ struct bio *bio_map_user_iov(struct request_queue *q, - ret = get_user_pages_fast(uaddr, local_nr_pages, - (iter->type & WRITE) != WRITE, - &pages[cur_page]); -- if (ret < local_nr_pages) { -+ if (unlikely(ret < local_nr_pages)) { -+ for (j = cur_page; j < page_limit; j++) { -+ if (!pages[j]) -+ break; -+ put_page(pages[j]); -+ } - ret = -EFAULT; - goto out_unmap; - } -@@ -1374,10 +1380,8 @@ struct bio *bio_map_user_iov(struct request_queue *q, - return bio; - - out_unmap: -- for (j = 0; j < nr_pages; j++) { -- if (!pages[j]) -- break; -- page_cache_release(pages[j]); -+ bio_for_each_segment_all(bvec, bio, j) { -+ put_page(bvec->bv_page); - } - out: - kfree(pages); -diff --git a/block/blk-core.c b/block/blk-core.c -index 119658534dfd..f5f1a55703ae 100644 ---- a/block/blk-core.c -+++ b/block/blk-core.c -@@ -526,8 +526,8 @@ void blk_set_queue_dying(struct request_queue *q) - - blk_queue_for_each_rl(rl, q) { - if (rl->rq_pool) { -- wake_up(&rl->wait[BLK_RW_SYNC]); -- wake_up(&rl->wait[BLK_RW_ASYNC]); -+ wake_up_all(&rl->wait[BLK_RW_SYNC]); -+ wake_up_all(&rl->wait[BLK_RW_ASYNC]); - } - } - } -diff --git a/crypto/asymmetric_keys/x509_cert_parser.c b/crypto/asymmetric_keys/x509_cert_parser.c -index 13c4e5a5fe8c..4471e7ed8c12 100644 ---- a/crypto/asymmetric_keys/x509_cert_parser.c -+++ b/crypto/asymmetric_keys/x509_cert_parser.c -@@ -399,6 +399,8 @@ int x509_extract_key_data(void *context, size_t hdrlen, - ctx->cert->pub->pkey_algo = PKEY_ALGO_RSA; - - /* Discard the BIT STRING metadata */ -+ if (vlen < 1 || *(const u8 *)value != 0) -+ return -EBADMSG; - ctx->key = value + 1; - ctx->key_size = vlen - 1; - return 0; -diff --git a/drivers/ata/libata-sff.c b/drivers/ata/libata-sff.c -index 7dbba387d12a..18de4c457068 100644 ---- a/drivers/ata/libata-sff.c -+++ b/drivers/ata/libata-sff.c -@@ -1480,7 +1480,6 @@ unsigned int ata_sff_qc_issue(struct ata_queued_cmd *qc) - break; - - default: -- WARN_ON_ONCE(1); - return AC_ERR_SYSTEM; - } - -diff --git a/drivers/atm/horizon.c b/drivers/atm/horizon.c -index 527bbd595e37..d9b762a62e25 100644 ---- a/drivers/atm/horizon.c -+++ b/drivers/atm/horizon.c -@@ -2804,7 +2804,7 @@ out: - return err; - - out_free_irq: -- free_irq(dev->irq, dev); -+ free_irq(irq, dev); - out_free: - kfree(dev); - out_release: -diff --git a/drivers/base/isa.c b/drivers/base/isa.c -index 91dba65d7264..901d8185309e 100644 ---- a/drivers/base/isa.c -+++ b/drivers/base/isa.c -@@ -39,7 +39,7 @@ static int isa_bus_probe(struct device *dev) - { - struct isa_driver *isa_driver = dev->platform_data; - -- if (isa_driver->probe) -+ if (isa_driver && isa_driver->probe) - return isa_driver->probe(dev, to_isa_dev(dev)->id); - - return 0; -@@ -49,7 +49,7 @@ static int isa_bus_remove(struct device *dev) - { - struct isa_driver *isa_driver = dev->platform_data; - -- if (isa_driver->remove) -+ if (isa_driver && isa_driver->remove) - return isa_driver->remove(dev, to_isa_dev(dev)->id); - - return 0; -@@ -59,7 +59,7 @@ static void isa_bus_shutdown(struct device *dev) - { - struct isa_driver *isa_driver = dev->platform_data; - -- if (isa_driver->shutdown) -+ if (isa_driver && isa_driver->shutdown) - isa_driver->shutdown(dev, to_isa_dev(dev)->id); - } - -@@ -67,7 +67,7 @@ static int isa_bus_suspend(struct device *dev, pm_message_t state) - { - struct isa_driver *isa_driver = dev->platform_data; - -- if (isa_driver->suspend) -+ if (isa_driver && isa_driver->suspend) - return isa_driver->suspend(dev, to_isa_dev(dev)->id, state); - - return 0; -@@ -77,7 +77,7 @@ static int isa_bus_resume(struct device *dev) - { - struct isa_driver *isa_driver = dev->platform_data; - -- if (isa_driver->resume) -+ if (isa_driver && isa_driver->resume) - return isa_driver->resume(dev, to_isa_dev(dev)->id); - - return 0; -diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c -index 62a93b685c54..502406c9e6e1 100644 ---- a/drivers/block/zram/zram_drv.c -+++ b/drivers/block/zram/zram_drv.c -@@ -1247,6 +1247,8 @@ static int zram_add(void) - blk_queue_io_min(zram->disk->queue, PAGE_SIZE); - blk_queue_io_opt(zram->disk->queue, PAGE_SIZE); - zram->disk->queue->limits.discard_granularity = PAGE_SIZE; -+ zram->disk->queue->limits.max_sectors = SECTORS_PER_PAGE; -+ zram->disk->queue->limits.chunk_sectors = 0; - blk_queue_max_discard_sectors(zram->disk->queue, UINT_MAX); - /* - * zram_bio_discard() will clear all logical blocks if logical block -diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c -index 4cc72fa017c7..2f9abe0d04dc 100644 ---- a/drivers/char/ipmi/ipmi_si_intf.c -+++ b/drivers/char/ipmi/ipmi_si_intf.c -@@ -239,6 +239,9 @@ struct smi_info { - /* The timer for this si. */ - struct timer_list si_timer; - -+ /* This flag is set, if the timer can be set */ -+ bool timer_can_start; -+ - /* This flag is set, if the timer is running (timer_pending() isn't enough) */ - bool timer_running; - -@@ -414,6 +417,8 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info) - - static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val) - { -+ if (!smi_info->timer_can_start) -+ return; - smi_info->last_timeout_jiffies = jiffies; - mod_timer(&smi_info->si_timer, new_val); - smi_info->timer_running = true; -@@ -433,21 +438,18 @@ static void start_new_msg(struct smi_info *smi_info, unsigned char *msg, - smi_info->handlers->start_transaction(smi_info->si_sm, msg, size); - } - --static void start_check_enables(struct smi_info *smi_info, bool start_timer) -+static void start_check_enables(struct smi_info *smi_info) - { - unsigned char msg[2]; - - msg[0] = (IPMI_NETFN_APP_REQUEST << 2); - msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD; - -- if (start_timer) -- start_new_msg(smi_info, msg, 2); -- else -- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2); -+ start_new_msg(smi_info, msg, 2); - smi_info->si_state = SI_CHECKING_ENABLES; - } - --static void start_clear_flags(struct smi_info *smi_info, bool start_timer) -+static void start_clear_flags(struct smi_info *smi_info) - { - unsigned char msg[3]; - -@@ -456,10 +458,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer) - msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD; - msg[2] = WDT_PRE_TIMEOUT_INT; - -- if (start_timer) -- start_new_msg(smi_info, msg, 3); -- else -- smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3); -+ start_new_msg(smi_info, msg, 3); - smi_info->si_state = SI_CLEARING_FLAGS; - } - -@@ -494,11 +493,11 @@ static void start_getting_events(struct smi_info *smi_info) - * Note that we cannot just use disable_irq(), since the interrupt may - * be shared. - */ --static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer) -+static inline bool disable_si_irq(struct smi_info *smi_info) - { - if ((smi_info->irq) && (!smi_info->interrupt_disabled)) { - smi_info->interrupt_disabled = true; -- start_check_enables(smi_info, start_timer); -+ start_check_enables(smi_info); - return true; - } - return false; -@@ -508,7 +507,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info) - { - if ((smi_info->irq) && (smi_info->interrupt_disabled)) { - smi_info->interrupt_disabled = false; -- start_check_enables(smi_info, true); -+ start_check_enables(smi_info); - return true; - } - return false; -@@ -526,7 +525,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info) - - msg = ipmi_alloc_smi_msg(); - if (!msg) { -- if (!disable_si_irq(smi_info, true)) -+ if (!disable_si_irq(smi_info)) - smi_info->si_state = SI_NORMAL; - } else if (enable_si_irq(smi_info)) { - ipmi_free_smi_msg(msg); -@@ -542,7 +541,7 @@ static void handle_flags(struct smi_info *smi_info) - /* Watchdog pre-timeout */ - smi_inc_stat(smi_info, watchdog_pretimeouts); - -- start_clear_flags(smi_info, true); -+ start_clear_flags(smi_info); - smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT; - if (smi_info->intf) - ipmi_smi_watchdog_pretimeout(smi_info->intf); -@@ -925,7 +924,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info, - * disable and messages disabled. - */ - if (smi_info->supports_event_msg_buff || smi_info->irq) { -- start_check_enables(smi_info, true); -+ start_check_enables(smi_info); - } else { - smi_info->curr_msg = alloc_msg_handle_irq(smi_info); - if (!smi_info->curr_msg) -@@ -1232,6 +1231,7 @@ static int smi_start_processing(void *send_info, - - /* Set up the timer that drives the interface. */ - setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi); -+ new_smi->timer_can_start = true; - smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES); - - /* Try to claim any interrupts. */ -@@ -3434,10 +3434,12 @@ static void check_for_broken_irqs(struct smi_info *smi_info) - check_set_rcv_irq(smi_info); - } - --static inline void wait_for_timer_and_thread(struct smi_info *smi_info) -+static inline void stop_timer_and_thread(struct smi_info *smi_info) - { - if (smi_info->thread != NULL) - kthread_stop(smi_info->thread); -+ -+ smi_info->timer_can_start = false; - if (smi_info->timer_running) - del_timer_sync(&smi_info->si_timer); - } -@@ -3635,7 +3637,7 @@ static int try_smi_init(struct smi_info *new_smi) - * Start clearing the flags before we enable interrupts or the - * timer to avoid racing with the timer. - */ -- start_clear_flags(new_smi, false); -+ start_clear_flags(new_smi); - - /* - * IRQ is defined to be set when non-zero. req_events will -@@ -3713,7 +3715,7 @@ static int try_smi_init(struct smi_info *new_smi) - return 0; - - out_err_stop_timer: -- wait_for_timer_and_thread(new_smi); -+ stop_timer_and_thread(new_smi); - - out_err: - new_smi->interrupt_disabled = true; -@@ -3919,7 +3921,7 @@ static void cleanup_one_si(struct smi_info *to_clean) - */ - if (to_clean->irq_cleanup) - to_clean->irq_cleanup(to_clean); -- wait_for_timer_and_thread(to_clean); -+ stop_timer_and_thread(to_clean); - - /* - * Timeouts are stopped, now make sure the interrupts are off -@@ -3930,7 +3932,7 @@ static void cleanup_one_si(struct smi_info *to_clean) - poll(to_clean); - schedule_timeout_uninterruptible(1); - } -- disable_si_irq(to_clean, false); -+ disable_si_irq(to_clean); - while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) { - poll(to_clean); - schedule_timeout_uninterruptible(1); -diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c -index f214a8755827..fd39893079d5 100644 ---- a/drivers/crypto/s5p-sss.c -+++ b/drivers/crypto/s5p-sss.c -@@ -664,8 +664,9 @@ static int s5p_aes_probe(struct platform_device *pdev) - dev_warn(dev, "feed control interrupt is not available.\n"); - goto err_irq; - } -- err = devm_request_irq(dev, pdata->irq_fc, s5p_aes_interrupt, -- IRQF_SHARED, pdev->name, pdev); -+ err = devm_request_threaded_irq(dev, pdata->irq_fc, NULL, -+ s5p_aes_interrupt, IRQF_ONESHOT, -+ pdev->name, pdev); - if (err < 0) { - dev_warn(dev, "feed control interrupt is not available.\n"); - goto err_irq; -diff --git a/drivers/edac/i5000_edac.c b/drivers/edac/i5000_edac.c -index 72e07e3cf718..16e0eb523439 100644 ---- a/drivers/edac/i5000_edac.c -+++ b/drivers/edac/i5000_edac.c -@@ -227,7 +227,7 @@ - #define NREC_RDWR(x) (((x)>>11) & 1) - #define NREC_RANK(x) (((x)>>8) & 0x7) - #define NRECMEMB 0xC0 --#define NREC_CAS(x) (((x)>>16) & 0xFFFFFF) -+#define NREC_CAS(x) (((x)>>16) & 0xFFF) - #define NREC_RAS(x) ((x) & 0x7FFF) - #define NRECFGLOG 0xC4 - #define NREEECFBDA 0xC8 -@@ -371,7 +371,7 @@ struct i5000_error_info { - /* These registers are input ONLY if there was a - * Non-Recoverable Error */ - u16 nrecmema; /* Non-Recoverable Mem log A */ -- u16 nrecmemb; /* Non-Recoverable Mem log B */ -+ u32 nrecmemb; /* Non-Recoverable Mem log B */ - - }; - -@@ -407,7 +407,7 @@ static void i5000_get_error_info(struct mem_ctl_info *mci, - NERR_FAT_FBD, &info->nerr_fat_fbd); - pci_read_config_word(pvt->branchmap_werrors, - NRECMEMA, &info->nrecmema); -- pci_read_config_word(pvt->branchmap_werrors, -+ pci_read_config_dword(pvt->branchmap_werrors, - NRECMEMB, &info->nrecmemb); - - /* Clear the error bits, by writing them back */ -@@ -1293,7 +1293,7 @@ static int i5000_init_csrows(struct mem_ctl_info *mci) - dimm->mtype = MEM_FB_DDR2; - - /* ask what device type on this row */ -- if (MTR_DRAM_WIDTH(mtr)) -+ if (MTR_DRAM_WIDTH(mtr) == 8) - dimm->dtype = DEV_X8; - else - dimm->dtype = DEV_X4; -diff --git a/drivers/edac/i5400_edac.c b/drivers/edac/i5400_edac.c -index 6ef6ad1ba16e..2ea2f32e608b 100644 ---- a/drivers/edac/i5400_edac.c -+++ b/drivers/edac/i5400_edac.c -@@ -368,7 +368,7 @@ struct i5400_error_info { - - /* These registers are input ONLY if there was a Non-Rec Error */ - u16 nrecmema; /* Non-Recoverable Mem log A */ -- u16 nrecmemb; /* Non-Recoverable Mem log B */ -+ u32 nrecmemb; /* Non-Recoverable Mem log B */ - - }; - -@@ -458,7 +458,7 @@ static void i5400_get_error_info(struct mem_ctl_info *mci, - NERR_FAT_FBD, &info->nerr_fat_fbd); - pci_read_config_word(pvt->branchmap_werrors, - NRECMEMA, &info->nrecmema); -- pci_read_config_word(pvt->branchmap_werrors, -+ pci_read_config_dword(pvt->branchmap_werrors, - NRECMEMB, &info->nrecmemb); - - /* Clear the error bits, by writing them back */ -@@ -1207,13 +1207,14 @@ static int i5400_init_dimms(struct mem_ctl_info *mci) - - dimm->nr_pages = size_mb << 8; - dimm->grain = 8; -- dimm->dtype = MTR_DRAM_WIDTH(mtr) ? DEV_X8 : DEV_X4; -+ dimm->dtype = MTR_DRAM_WIDTH(mtr) == 8 ? -+ DEV_X8 : DEV_X4; - dimm->mtype = MEM_FB_DDR2; - /* - * The eccc mechanism is SDDC (aka SECC), with - * is similar to Chipkill. - */ -- dimm->edac_mode = MTR_DRAM_WIDTH(mtr) ? -+ dimm->edac_mode = MTR_DRAM_WIDTH(mtr) == 8 ? - EDAC_S8ECD8ED : EDAC_S4ECD4ED; - ndimms++; - } -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 0cd8f039602e..78fe416126d1 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -113,8 +113,7 @@ static ssize_t systab_show(struct kobject *kobj, - return str - buf; - } - --static struct kobj_attribute efi_attr_systab = -- __ATTR(systab, 0400, systab_show, NULL); -+static struct kobj_attribute efi_attr_systab = __ATTR_RO_MODE(systab, 0400); - - #define EFI_FIELD(var) efi.var - -diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c -index 22c5285f7705..0ca4c34f9441 100644 ---- a/drivers/firmware/efi/esrt.c -+++ b/drivers/firmware/efi/esrt.c -@@ -105,7 +105,7 @@ static const struct sysfs_ops esre_attr_ops = { - }; - - /* Generic ESRT Entry ("ESRE") support. */ --static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf) -+static ssize_t fw_class_show(struct esre_entry *entry, char *buf) - { - char *str = buf; - -@@ -116,18 +116,16 @@ static ssize_t esre_fw_class_show(struct esre_entry *entry, char *buf) - return str - buf; - } - --static struct esre_attribute esre_fw_class = __ATTR(fw_class, 0400, -- esre_fw_class_show, NULL); -+static struct esre_attribute esre_fw_class = __ATTR_RO_MODE(fw_class, 0400); - - #define esre_attr_decl(name, size, fmt) \ --static ssize_t esre_##name##_show(struct esre_entry *entry, char *buf) \ -+static ssize_t name##_show(struct esre_entry *entry, char *buf) \ - { \ - return sprintf(buf, fmt "\n", \ - le##size##_to_cpu(entry->esre.esre1->name)); \ - } \ - \ --static struct esre_attribute esre_##name = __ATTR(name, 0400, \ -- esre_##name##_show, NULL) -+static struct esre_attribute esre_##name = __ATTR_RO_MODE(name, 0400) - - esre_attr_decl(fw_type, 32, "%u"); - esre_attr_decl(fw_version, 32, "%u"); -@@ -195,14 +193,13 @@ static int esre_create_sysfs_entry(void *esre, int entry_num) - - /* support for displaying ESRT fields at the top level */ - #define esrt_attr_decl(name, size, fmt) \ --static ssize_t esrt_##name##_show(struct kobject *kobj, \ -+static ssize_t name##_show(struct kobject *kobj, \ - struct kobj_attribute *attr, char *buf)\ - { \ - return sprintf(buf, fmt "\n", le##size##_to_cpu(esrt->name)); \ - } \ - \ --static struct kobj_attribute esrt_##name = __ATTR(name, 0400, \ -- esrt_##name##_show, NULL) -+static struct kobj_attribute esrt_##name = __ATTR_RO_MODE(name, 0400) - - esrt_attr_decl(fw_resource_count, 32, "%u"); - esrt_attr_decl(fw_resource_count_max, 32, "%u"); -diff --git a/drivers/firmware/efi/runtime-map.c b/drivers/firmware/efi/runtime-map.c -index 5c55227a34c8..2400b3e1d840 100644 ---- a/drivers/firmware/efi/runtime-map.c -+++ b/drivers/firmware/efi/runtime-map.c -@@ -67,11 +67,11 @@ static ssize_t map_attr_show(struct kobject *kobj, struct attribute *attr, - return map_attr->show(entry, buf); - } - --static struct map_attribute map_type_attr = __ATTR_RO(type); --static struct map_attribute map_phys_addr_attr = __ATTR_RO(phys_addr); --static struct map_attribute map_virt_addr_attr = __ATTR_RO(virt_addr); --static struct map_attribute map_num_pages_attr = __ATTR_RO(num_pages); --static struct map_attribute map_attribute_attr = __ATTR_RO(attribute); -+static struct map_attribute map_type_attr = __ATTR_RO_MODE(type, 0400); -+static struct map_attribute map_phys_addr_attr = __ATTR_RO_MODE(phys_addr, 0400); -+static struct map_attribute map_virt_addr_attr = __ATTR_RO_MODE(virt_addr, 0400); -+static struct map_attribute map_num_pages_attr = __ATTR_RO_MODE(num_pages, 0400); -+static struct map_attribute map_attribute_attr = __ATTR_RO_MODE(attribute, 0400); - - /* - * These are default attributes that are added for every memmap entry. -diff --git a/drivers/gpio/gpio-altera.c b/drivers/gpio/gpio-altera.c -index 3e6661bab54a..ddf9cd3ad974 100644 ---- a/drivers/gpio/gpio-altera.c -+++ b/drivers/gpio/gpio-altera.c -@@ -94,21 +94,18 @@ static int altera_gpio_irq_set_type(struct irq_data *d, - - altera_gc = to_altera(irq_data_get_irq_chip_data(d)); - -- if (type == IRQ_TYPE_NONE) -+ if (type == IRQ_TYPE_NONE) { -+ irq_set_handler_locked(d, handle_bad_irq); - return 0; -- if (type == IRQ_TYPE_LEVEL_HIGH && -- altera_gc->interrupt_trigger == IRQ_TYPE_LEVEL_HIGH) -- return 0; -- if (type == IRQ_TYPE_EDGE_RISING && -- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_RISING) -- return 0; -- if (type == IRQ_TYPE_EDGE_FALLING && -- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_FALLING) -- return 0; -- if (type == IRQ_TYPE_EDGE_BOTH && -- altera_gc->interrupt_trigger == IRQ_TYPE_EDGE_BOTH) -+ } -+ if (type == altera_gc->interrupt_trigger) { -+ if (type == IRQ_TYPE_LEVEL_HIGH) -+ irq_set_handler_locked(d, handle_level_irq); -+ else -+ irq_set_handler_locked(d, handle_simple_irq); - return 0; -- -+ } -+ irq_set_handler_locked(d, handle_bad_irq); - return -EINVAL; - } - -@@ -234,7 +231,6 @@ static void altera_gpio_irq_edge_handler(struct irq_desc *desc) - chained_irq_exit(chip, desc); - } - -- - static void altera_gpio_irq_leveL_high_handler(struct irq_desc *desc) - { - struct altera_gpio_chip *altera_gc; -@@ -314,7 +310,7 @@ static int altera_gpio_probe(struct platform_device *pdev) - altera_gc->interrupt_trigger = reg; - - ret = gpiochip_irqchip_add(&altera_gc->mmchip.gc, &altera_irq_chip, 0, -- handle_simple_irq, IRQ_TYPE_NONE); -+ handle_bad_irq, IRQ_TYPE_NONE); - - if (ret) { - dev_info(&pdev->dev, "could not add irqchip\n"); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -index 16302f7d59f6..fc9f14747f70 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_device.c -@@ -1760,8 +1760,11 @@ int amdgpu_resume_kms(struct drm_device *dev, bool resume, bool fbcon) - } - - r = amdgpu_late_init(adev); -- if (r) -+ if (r) { -+ if (fbcon) -+ console_unlock(); - return r; -+ } - - /* pin cursors */ - list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { -diff --git a/drivers/gpu/drm/armada/Makefile b/drivers/gpu/drm/armada/Makefile -index 26412d2f8c98..ffd673615772 100644 ---- a/drivers/gpu/drm/armada/Makefile -+++ b/drivers/gpu/drm/armada/Makefile -@@ -4,5 +4,3 @@ armada-y += armada_510.o - armada-$(CONFIG_DEBUG_FS) += armada_debugfs.o - - obj-$(CONFIG_DRM_ARMADA) := armada.o -- --CFLAGS_armada_trace.o := -I$(src) -diff --git a/drivers/gpu/drm/exynos/exynos_drm_gem.c b/drivers/gpu/drm/exynos/exynos_drm_gem.c -index 252eb301470c..c147043af1ca 100644 ---- a/drivers/gpu/drm/exynos/exynos_drm_gem.c -+++ b/drivers/gpu/drm/exynos/exynos_drm_gem.c -@@ -245,6 +245,15 @@ struct exynos_drm_gem *exynos_drm_gem_create(struct drm_device *dev, - if (IS_ERR(exynos_gem)) - return exynos_gem; - -+ if (!is_drm_iommu_supported(dev) && (flags & EXYNOS_BO_NONCONTIG)) { -+ /* -+ * when no IOMMU is available, all allocated buffers are -+ * contiguous anyway, so drop EXYNOS_BO_NONCONTIG flag -+ */ -+ flags &= ~EXYNOS_BO_NONCONTIG; -+ DRM_WARN("Non-contiguous allocation is not supported without IOMMU, falling back to contiguous buffer\n"); -+ } -+ - /* set memory type and cache attribute from user side. */ - exynos_gem->flags = flags; - -diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig -index 513a16cc6e18..2729ab3557bb 100644 ---- a/drivers/hid/Kconfig -+++ b/drivers/hid/Kconfig -@@ -165,11 +165,11 @@ config HID_CHERRY - Support for Cherry Cymotion keyboard. - - config HID_CHICONY -- tristate "Chicony Tactical pad" -+ tristate "Chicony devices" - depends on HID - default !EXPERT - ---help--- -- Support for Chicony Tactical pad. -+ Support for Chicony Tactical pad and special keys on Chicony keyboards. - - config HID_CORSAIR - tristate "Corsair devices" -diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c -index bc3cec199fee..f04ed9aabc3f 100644 ---- a/drivers/hid/hid-chicony.c -+++ b/drivers/hid/hid-chicony.c -@@ -86,6 +86,7 @@ static const struct hid_device_id ch_devices[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) }, - { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) }, - { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) }, - { } - }; - MODULE_DEVICE_TABLE(hid, ch_devices); -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 11a051bd8a8b..1a1fc8351289 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -1867,6 +1867,7 @@ static const struct hid_device_id hid_have_special_driver[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A081) }, - { HID_USB_DEVICE(USB_VENDOR_ID_HOLTEK_ALT, USB_DEVICE_ID_HOLTEK_ALT_MOUSE_A0C2) }, - { HID_USB_DEVICE(USB_VENDOR_ID_HUION, USB_DEVICE_ID_HUION_TABLET) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_JESS, USB_DEVICE_ID_JESS_ZEN_AIO_KBD) }, - { HID_USB_DEVICE(USB_VENDOR_ID_JESS2, USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD) }, - { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ION, USB_DEVICE_ID_ICADE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_KENSINGTON, USB_DEVICE_ID_KS_SLIMBLADE) }, -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 37cbc2ecfc5f..6937086060a6 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -523,6 +523,7 @@ - - #define USB_VENDOR_ID_JESS 0x0c45 - #define USB_DEVICE_ID_JESS_YUREX 0x1010 -+#define USB_DEVICE_ID_JESS_ZEN_AIO_KBD 0x5112 - - #define USB_VENDOR_ID_JESS2 0x0f30 - #define USB_DEVICE_ID_JESS2_COLOR_RUMBLE_PAD 0x0111 -diff --git a/drivers/i2c/busses/i2c-riic.c b/drivers/i2c/busses/i2c-riic.c -index d8803c3bbfdc..16833365475f 100644 ---- a/drivers/i2c/busses/i2c-riic.c -+++ b/drivers/i2c/busses/i2c-riic.c -@@ -218,8 +218,12 @@ static irqreturn_t riic_tend_isr(int irq, void *data) - } - - if (riic->is_last || riic->err) { -- riic_clear_set_bit(riic, 0, ICIER_SPIE, RIIC_ICIER); -+ riic_clear_set_bit(riic, ICIER_TEIE, ICIER_SPIE, RIIC_ICIER); - writeb(ICCR2_SP, riic->base + RIIC_ICCR2); -+ } else { -+ /* Transfer is complete, but do not send STOP */ -+ riic_clear_set_bit(riic, ICIER_TEIE, 0, RIIC_ICIER); -+ complete(&riic->msg_done); - } - - return IRQ_HANDLED; -diff --git a/drivers/infiniband/hw/mlx4/qp.c b/drivers/infiniband/hw/mlx4/qp.c -index 1c8b7c22c822..348828271cb0 100644 ---- a/drivers/infiniband/hw/mlx4/qp.c -+++ b/drivers/infiniband/hw/mlx4/qp.c -@@ -1564,7 +1564,7 @@ static int __mlx4_ib_modify_qp(struct ib_qp *ibqp, - context->mtu_msgmax = (IB_MTU_4096 << 5) | - ilog2(dev->dev->caps.max_gso_sz); - else -- context->mtu_msgmax = (IB_MTU_4096 << 5) | 12; -+ context->mtu_msgmax = (IB_MTU_4096 << 5) | 13; - } else if (attr_mask & IB_QP_PATH_MTU) { - if (attr->path_mtu < IB_MTU_256 || attr->path_mtu > IB_MTU_4096) { - pr_err("path MTU (%u) is invalid\n", -diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c -index 2a1fdcaa3044..dbd5adc62c3f 100644 ---- a/drivers/infiniband/hw/mlx5/main.c -+++ b/drivers/infiniband/hw/mlx5/main.c -@@ -1123,6 +1123,8 @@ static int create_umr_res(struct mlx5_ib_dev *dev) - qp->real_qp = qp; - qp->uobject = NULL; - qp->qp_type = MLX5_IB_QPT_REG_UMR; -+ qp->send_cq = init_attr->send_cq; -+ qp->recv_cq = init_attr->recv_cq; - - attr->qp_state = IB_QPS_INIT; - attr->port_num = 1; -diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c -index f9711aceef54..4efec2db4ee2 100644 ---- a/drivers/iommu/intel-iommu.c -+++ b/drivers/iommu/intel-iommu.c -@@ -2201,10 +2201,12 @@ static int __domain_mapping(struct dmar_domain *domain, unsigned long iov_pfn, - uint64_t tmp; - - if (!sg_res) { -+ unsigned int pgoff = sg->offset & ~PAGE_MASK; -+ - sg_res = aligned_nrpages(sg->offset, sg->length); -- sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + sg->offset; -+ sg->dma_address = ((dma_addr_t)iov_pfn << VTD_PAGE_SHIFT) + pgoff; - sg->dma_length = sg->length; -- pteval = page_to_phys(sg_page(sg)) | prot; -+ pteval = (sg_phys(sg) - pgoff) | prot; - phys_pfn = pteval >> VTD_PAGE_SHIFT; - } - -@@ -3757,7 +3759,7 @@ static int intel_nontranslate_map_sg(struct device *hddev, - - for_each_sg(sglist, sg, nelems, i) { - BUG_ON(!sg_page(sg)); -- sg->dma_address = page_to_phys(sg_page(sg)) + sg->offset; -+ sg->dma_address = sg_phys(sg); - sg->dma_length = sg->length; - } - return nelems; -diff --git a/drivers/irqchip/irq-crossbar.c b/drivers/irqchip/irq-crossbar.c -index 63faee04a008..636187a4c1a3 100644 ---- a/drivers/irqchip/irq-crossbar.c -+++ b/drivers/irqchip/irq-crossbar.c -@@ -199,7 +199,7 @@ static const struct irq_domain_ops crossbar_domain_ops = { - static int __init crossbar_of_init(struct device_node *node) - { - int i, size, reserved = 0; -- u32 max = 0, entry; -+ u32 max = 0, entry, reg_size; - const __be32 *irqsr; - int ret = -ENOMEM; - -@@ -276,9 +276,9 @@ static int __init crossbar_of_init(struct device_node *node) - if (!cb->register_offsets) - goto err_irq_map; - -- of_property_read_u32(node, "ti,reg-size", &size); -+ of_property_read_u32(node, "ti,reg-size", ®_size); - -- switch (size) { -+ switch (reg_size) { - case 1: - cb->write = crossbar_writeb; - break; -@@ -304,7 +304,7 @@ static int __init crossbar_of_init(struct device_node *node) - continue; - - cb->register_offsets[i] = reserved; -- reserved += size; -+ reserved += reg_size; - } - - of_property_read_u32(node, "ti,irqs-safe-map", &cb->safe_map); -diff --git a/drivers/media/usb/dvb-usb/dibusb-common.c b/drivers/media/usb/dvb-usb/dibusb-common.c -index ef3a8f75f82e..7b15aea2723d 100644 ---- a/drivers/media/usb/dvb-usb/dibusb-common.c -+++ b/drivers/media/usb/dvb-usb/dibusb-common.c -@@ -179,8 +179,20 @@ EXPORT_SYMBOL(dibusb_i2c_algo); - - int dibusb_read_eeprom_byte(struct dvb_usb_device *d, u8 offs, u8 *val) - { -- u8 wbuf[1] = { offs }; -- return dibusb_i2c_msg(d, 0x50, wbuf, 1, val, 1); -+ u8 *buf; -+ int rc; -+ -+ buf = kmalloc(2, GFP_KERNEL); -+ if (!buf) -+ return -ENOMEM; -+ -+ buf[0] = offs; -+ -+ rc = dibusb_i2c_msg(d, 0x50, &buf[0], 1, &buf[1], 1); -+ *val = buf[1]; -+ kfree(buf); -+ -+ return rc; - } - EXPORT_SYMBOL(dibusb_read_eeprom_byte); - -diff --git a/drivers/memory/omap-gpmc.c b/drivers/memory/omap-gpmc.c -index 55cba89dbdb8..49691a8c74ee 100644 ---- a/drivers/memory/omap-gpmc.c -+++ b/drivers/memory/omap-gpmc.c -@@ -1890,9 +1890,7 @@ static int gpmc_probe_onenand_child(struct platform_device *pdev, - if (!of_property_read_u32(child, "dma-channel", &val)) - gpmc_onenand_data->dma_channel = val; - -- gpmc_onenand_init(gpmc_onenand_data); -- -- return 0; -+ return gpmc_onenand_init(gpmc_onenand_data); - } - #else - static int gpmc_probe_onenand_child(struct platform_device *pdev, -diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c -index 6749b1829469..4d01d7bc24ef 100644 ---- a/drivers/net/can/ti_hecc.c -+++ b/drivers/net/can/ti_hecc.c -@@ -652,6 +652,9 @@ static int ti_hecc_rx_poll(struct napi_struct *napi, int quota) - mbx_mask = hecc_read(priv, HECC_CANMIM); - mbx_mask |= HECC_TX_MBOX_MASK; - hecc_write(priv, HECC_CANMIM, mbx_mask); -+ } else { -+ /* repoll is done only if whole budget is used */ -+ num_pkts = quota; - } - - return num_pkts; -diff --git a/drivers/net/can/usb/ems_usb.c b/drivers/net/can/usb/ems_usb.c -index eb7192fab593..357c9e89fdf9 100644 ---- a/drivers/net/can/usb/ems_usb.c -+++ b/drivers/net/can/usb/ems_usb.c -@@ -290,6 +290,8 @@ static void ems_usb_read_interrupt_callback(struct urb *urb) - - case -ECONNRESET: /* unlink */ - case -ENOENT: -+ case -EPIPE: -+ case -EPROTO: - case -ESHUTDOWN: - return; - -diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c -index 4c6707ecc619..afa5b4a7a4a2 100644 ---- a/drivers/net/can/usb/esd_usb2.c -+++ b/drivers/net/can/usb/esd_usb2.c -@@ -393,6 +393,8 @@ static void esd_usb2_read_bulk_callback(struct urb *urb) - break; - - case -ENOENT: -+ case -EPIPE: -+ case -EPROTO: - case -ESHUTDOWN: - return; - -diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c -index c2e2821a3346..db1855b0e08f 100644 ---- a/drivers/net/can/usb/kvaser_usb.c -+++ b/drivers/net/can/usb/kvaser_usb.c -@@ -603,8 +603,8 @@ static int kvaser_usb_wait_msg(const struct kvaser_usb *dev, u8 id, - } - - if (pos + tmp->len > actual_len) { -- dev_err(dev->udev->dev.parent, -- "Format error\n"); -+ dev_err_ratelimited(dev->udev->dev.parent, -+ "Format error\n"); - break; - } - -@@ -809,6 +809,7 @@ static int kvaser_usb_simple_msg_async(struct kvaser_usb_net_priv *priv, - if (err) { - netdev_err(netdev, "Error transmitting URB\n"); - usb_unanchor_urb(urb); -+ kfree(buf); - usb_free_urb(urb); - return err; - } -@@ -1321,6 +1322,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) - case 0: - break; - case -ENOENT: -+ case -EPIPE: -+ case -EPROTO: - case -ESHUTDOWN: - return; - default: -@@ -1329,7 +1332,7 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) - goto resubmit_urb; - } - -- while (pos <= urb->actual_length - MSG_HEADER_LEN) { -+ while (pos <= (int)(urb->actual_length - MSG_HEADER_LEN)) { - msg = urb->transfer_buffer + pos; - - /* The Kvaser firmware can only read and write messages that -@@ -1348,7 +1351,8 @@ static void kvaser_usb_read_bulk_callback(struct urb *urb) - } - - if (pos + msg->len > urb->actual_length) { -- dev_err(dev->udev->dev.parent, "Format error\n"); -+ dev_err_ratelimited(dev->udev->dev.parent, -+ "Format error\n"); - break; - } - -@@ -1767,6 +1771,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb, - spin_unlock_irqrestore(&priv->tx_contexts_lock, flags); - - usb_unanchor_urb(urb); -+ kfree(buf); - - stats->tx_dropped++; - -diff --git a/drivers/net/can/usb/usb_8dev.c b/drivers/net/can/usb/usb_8dev.c -index 449b2a47f9a8..522286cc0f9c 100644 ---- a/drivers/net/can/usb/usb_8dev.c -+++ b/drivers/net/can/usb/usb_8dev.c -@@ -524,6 +524,8 @@ static void usb_8dev_read_bulk_callback(struct urb *urb) - break; - - case -ENOENT: -+ case -EPIPE: -+ case -EPROTO: - case -ESHUTDOWN: - return; - -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -index 1c8123816745..abb3ff6498dc 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c -@@ -13646,7 +13646,7 @@ static int bnx2x_ptp_adjfreq(struct ptp_clock_info *ptp, s32 ppb) - if (!netif_running(bp->dev)) { - DP(BNX2X_MSG_PTP, - "PTP adjfreq called while the interface is down\n"); -- return -EFAULT; -+ return -ENETDOWN; - } - - if (ppb < 0) { -@@ -13705,6 +13705,12 @@ static int bnx2x_ptp_adjtime(struct ptp_clock_info *ptp, s64 delta) - { - struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); - -+ if (!netif_running(bp->dev)) { -+ DP(BNX2X_MSG_PTP, -+ "PTP adjtime called while the interface is down\n"); -+ return -ENETDOWN; -+ } -+ - DP(BNX2X_MSG_PTP, "PTP adjtime called, delta = %llx\n", delta); - - timecounter_adjtime(&bp->timecounter, delta); -@@ -13717,6 +13723,12 @@ static int bnx2x_ptp_gettime(struct ptp_clock_info *ptp, struct timespec64 *ts) - struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); - u64 ns; - -+ if (!netif_running(bp->dev)) { -+ DP(BNX2X_MSG_PTP, -+ "PTP gettime called while the interface is down\n"); -+ return -ENETDOWN; -+ } -+ - ns = timecounter_read(&bp->timecounter); - - DP(BNX2X_MSG_PTP, "PTP gettime called, ns = %llu\n", ns); -@@ -13732,6 +13744,12 @@ static int bnx2x_ptp_settime(struct ptp_clock_info *ptp, - struct bnx2x *bp = container_of(ptp, struct bnx2x, ptp_clock_info); - u64 ns; - -+ if (!netif_running(bp->dev)) { -+ DP(BNX2X_MSG_PTP, -+ "PTP settime called while the interface is down\n"); -+ return -ENETDOWN; -+ } -+ - ns = timespec64_to_ns(ts); - - DP(BNX2X_MSG_PTP, "PTP settime called, ns = %llu\n", ns); -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -index 9d027348cd09..5780830f78ad 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.c -@@ -434,7 +434,9 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp, - - /* Add/Remove the filter */ - rc = bnx2x_config_vlan_mac(bp, &ramrod); -- if (rc && rc != -EEXIST) { -+ if (rc == -EEXIST) -+ return 0; -+ if (rc) { - BNX2X_ERR("Failed to %s %s\n", - filter->add ? "add" : "delete", - (filter->type == BNX2X_VF_FILTER_VLAN_MAC) ? -@@ -444,6 +446,8 @@ static int bnx2x_vf_mac_vlan_config(struct bnx2x *bp, - return rc; - } - -+ filter->applied = true; -+ - return 0; - } - -@@ -471,6 +475,8 @@ int bnx2x_vf_mac_vlan_config_list(struct bnx2x *bp, struct bnx2x_virtf *vf, - BNX2X_ERR("Managed only %d/%d filters - rolling back\n", - i, filters->count + 1); - while (--i >= 0) { -+ if (!filters->filters[i].applied) -+ continue; - filters->filters[i].add = !filters->filters[i].add; - bnx2x_vf_mac_vlan_config(bp, vf, qid, - &filters->filters[i], -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -index 670a581ffabc..6f6f13dc2be3 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sriov.h -@@ -114,6 +114,7 @@ struct bnx2x_vf_mac_vlan_filter { - (BNX2X_VF_FILTER_MAC | BNX2X_VF_FILTER_VLAN) /*shortcut*/ - - bool add; -+ bool applied; - u8 *mac; - u16 vid; - }; -diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -index 1374e5394a79..a12a4236b143 100644 ---- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -+++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_vfpf.c -@@ -868,7 +868,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) - struct bnx2x *bp = netdev_priv(dev); - struct vfpf_set_q_filters_tlv *req = &bp->vf2pf_mbox->req.set_q_filters; - struct pfvf_general_resp_tlv *resp = &bp->vf2pf_mbox->resp.general_resp; -- int rc, i = 0; -+ int rc = 0, i = 0; - struct netdev_hw_addr *ha; - - if (bp->state != BNX2X_STATE_OPEN) { -@@ -883,6 +883,15 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) - /* Get Rx mode requested */ - DP(NETIF_MSG_IFUP, "dev->flags = %x\n", dev->flags); - -+ /* We support PFVF_MAX_MULTICAST_PER_VF mcast addresses tops */ -+ if (netdev_mc_count(dev) > PFVF_MAX_MULTICAST_PER_VF) { -+ DP(NETIF_MSG_IFUP, -+ "VF supports not more than %d multicast MAC addresses\n", -+ PFVF_MAX_MULTICAST_PER_VF); -+ rc = -EINVAL; -+ goto out; -+ } -+ - netdev_for_each_mc_addr(ha, dev) { - DP(NETIF_MSG_IFUP, "Adding mcast MAC: %pM\n", - bnx2x_mc_addr(ha)); -@@ -890,16 +899,6 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) - i++; - } - -- /* We support four PFVF_MAX_MULTICAST_PER_VF mcast -- * addresses tops -- */ -- if (i >= PFVF_MAX_MULTICAST_PER_VF) { -- DP(NETIF_MSG_IFUP, -- "VF supports not more than %d multicast MAC addresses\n", -- PFVF_MAX_MULTICAST_PER_VF); -- return -EINVAL; -- } -- - req->n_multicast = i; - req->flags |= VFPF_SET_Q_FILTERS_MULTICAST_CHANGED; - req->vf_qid = 0; -@@ -924,7 +923,7 @@ int bnx2x_vfpf_set_mcast(struct net_device *dev) - out: - bnx2x_vfpf_finalize(bp, &req->first_tlv); - -- return 0; -+ return rc; - } - - /* request pf to add a vlan for the vf */ -diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c -index 8c48bb2a94ea..af827faec7fe 100644 ---- a/drivers/net/ipvlan/ipvlan_core.c -+++ b/drivers/net/ipvlan/ipvlan_core.c -@@ -388,7 +388,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb) - struct dst_entry *dst; - int err, ret = NET_XMIT_DROP; - struct flowi6 fl6 = { -- .flowi6_iif = dev->ifindex, -+ .flowi6_oif = dev->ifindex, - .daddr = ip6h->daddr, - .saddr = ip6h->saddr, - .flowi6_flags = FLOWI_FLAG_ANYSRC, -diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c -index c72c42206850..21d22f86134e 100644 ---- a/drivers/net/phy/spi_ks8995.c -+++ b/drivers/net/phy/spi_ks8995.c -@@ -310,6 +310,7 @@ static int ks8995_probe(struct spi_device *spi) - if (err) - return err; - -+ sysfs_attr_init(&ks->regs_attr.attr); - err = sysfs_create_bin_file(&spi->dev.kobj, &ks->regs_attr); - if (err) { - dev_err(&spi->dev, "unable to create sysfs file, err=%d\n", -diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c -index 2a996a68fc2b..f877fbc7d7af 100644 ---- a/drivers/net/wireless/mac80211_hwsim.c -+++ b/drivers/net/wireless/mac80211_hwsim.c -@@ -2885,6 +2885,7 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) - { - struct hwsim_new_radio_params param = { 0 }; - const char *hwname = NULL; -+ int ret; - - param.reg_strict = info->attrs[HWSIM_ATTR_REG_STRICT_REG]; - param.p2p_device = info->attrs[HWSIM_ATTR_SUPPORT_P2P_DEVICE]; -@@ -2924,7 +2925,9 @@ static int hwsim_new_radio_nl(struct sk_buff *msg, struct genl_info *info) - param.regd = hwsim_world_regdom_custom[idx]; - } - -- return mac80211_hwsim_new_radio(info, ¶m); -+ ret = mac80211_hwsim_new_radio(info, ¶m); -+ kfree(hwname); -+ return ret; - } - - static int hwsim_del_radio_nl(struct sk_buff *msg, struct genl_info *info) -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index d278362448ca..fc8f9b446556 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -7887,11 +7887,17 @@ lpfc_cmpl_reg_new_vport(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb) - spin_lock_irq(shost->host_lock); - vport->fc_flag |= FC_VPORT_NEEDS_REG_VPI; - spin_unlock_irq(shost->host_lock); -- if (vport->port_type == LPFC_PHYSICAL_PORT -- && !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) -- lpfc_issue_init_vfi(vport); -- else -+ if (mb->mbxStatus == MBX_NOT_FINISHED) -+ break; -+ if ((vport->port_type == LPFC_PHYSICAL_PORT) && -+ !(vport->fc_flag & FC_LOGO_RCVD_DID_CHNG)) { -+ if (phba->sli_rev == LPFC_SLI_REV4) -+ lpfc_issue_init_vfi(vport); -+ else -+ lpfc_initial_flogi(vport); -+ } else { - lpfc_initial_fdisc(vport); -+ } - break; - } - } else { -diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c -index 6df2841cb7f9..5e4e1ba96f10 100644 ---- a/drivers/scsi/storvsc_drv.c -+++ b/drivers/scsi/storvsc_drv.c -@@ -379,8 +379,6 @@ MODULE_PARM_DESC(vcpus_per_sub_channel, "Ratio of VCPUs to subchannels"); - */ - static int storvsc_timeout = 180; - --static int msft_blist_flags = BLIST_TRY_VPD_PAGES; -- - - static void storvsc_on_channel_callback(void *context); - -@@ -1241,6 +1239,22 @@ static int storvsc_do_io(struct hv_device *device, - return ret; - } - -+static int storvsc_device_alloc(struct scsi_device *sdevice) -+{ -+ /* -+ * Set blist flag to permit the reading of the VPD pages even when -+ * the target may claim SPC-2 compliance. MSFT targets currently -+ * claim SPC-2 compliance while they implement post SPC-2 features. -+ * With this flag we can correctly handle WRITE_SAME_16 issues. -+ * -+ * Hypervisor reports SCSI_UNKNOWN type for DVD ROM device but -+ * still supports REPORT LUN. -+ */ -+ sdevice->sdev_bflags = BLIST_REPORTLUN2 | BLIST_TRY_VPD_PAGES; -+ -+ return 0; -+} -+ - static int storvsc_device_configure(struct scsi_device *sdevice) - { - -@@ -1255,14 +1269,6 @@ static int storvsc_device_configure(struct scsi_device *sdevice) - - sdevice->no_write_same = 1; - -- /* -- * Add blist flags to permit the reading of the VPD pages even when -- * the target may claim SPC-2 compliance. MSFT targets currently -- * claim SPC-2 compliance while they implement post SPC-2 features. -- * With this patch we can correctly handle WRITE_SAME_16 issues. -- */ -- sdevice->sdev_bflags |= msft_blist_flags; -- - /* - * If the host is WIN8 or WIN8 R2, claim conformance to SPC-3 - * if the device is a MSFT virtual device. If the host is -@@ -1529,6 +1535,7 @@ static struct scsi_host_template scsi_driver = { - .eh_host_reset_handler = storvsc_host_reset_handler, - .proc_name = "storvsc_host", - .eh_timed_out = storvsc_eh_timed_out, -+ .slave_alloc = storvsc_device_alloc, - .slave_configure = storvsc_device_configure, - .cmd_per_lun = 255, - .this_id = -1, -diff --git a/drivers/spi/Kconfig b/drivers/spi/Kconfig -index b0a24dedd1ed..8b9c2a38d1cc 100644 ---- a/drivers/spi/Kconfig -+++ b/drivers/spi/Kconfig -@@ -315,7 +315,6 @@ config SPI_FSL_SPI - config SPI_FSL_DSPI - tristate "Freescale DSPI controller" - select REGMAP_MMIO -- depends on HAS_DMA - depends on SOC_VF610 || SOC_LS1021A || ARCH_LAYERSCAPE || COMPILE_TEST - help - This enables support for the Freescale DSPI controller in master -diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c -index 163d305e1200..6abb6a10ee82 100644 ---- a/drivers/usb/gadget/configfs.c -+++ b/drivers/usb/gadget/configfs.c -@@ -270,6 +270,7 @@ static ssize_t gadget_dev_desc_UDC_store(struct config_item *item, - ret = unregister_gadget(gi); - if (ret) - goto err; -+ kfree(name); - } else { - if (gi->udc_name) { - ret = -EBUSY; -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 732e6ed5d7b4..39bb65265bff 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -791,7 +791,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data) - } - - if (io_data->aio) { -- req = usb_ep_alloc_request(ep->ep, GFP_KERNEL); -+ req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC); - if (unlikely(!req)) - goto error_lock; - -diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c -index b6df47aa25af..81f3c9cb333c 100644 ---- a/drivers/usb/gadget/legacy/inode.c -+++ b/drivers/usb/gadget/legacy/inode.c -@@ -1837,8 +1837,10 @@ dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr) - - spin_lock_irq (&dev->lock); - value = -EINVAL; -- if (dev->buf) -+ if (dev->buf) { -+ kfree(kbuf); - goto fail; -+ } - dev->buf = kbuf; - - /* full or low speed config */ -diff --git a/drivers/virtio/virtio.c b/drivers/virtio/virtio.c -index 7062bb0975a5..462e183609b6 100644 ---- a/drivers/virtio/virtio.c -+++ b/drivers/virtio/virtio.c -@@ -323,6 +323,8 @@ int register_virtio_device(struct virtio_device *dev) - /* device_register() causes the bus infrastructure to look for a - * matching driver. */ - err = device_register(&dev->dev); -+ if (err) -+ ida_simple_remove(&virtio_index_ida, dev->index); - out: - if (err) - add_status(dev, VIRTIO_CONFIG_S_FAILED); -diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c -index 4b0eff6da674..83a8a33a0d73 100644 ---- a/fs/afs/cmservice.c -+++ b/fs/afs/cmservice.c -@@ -115,6 +115,9 @@ bool afs_cm_incoming_call(struct afs_call *call) - case CBProbe: - call->type = &afs_SRXCBProbe; - return true; -+ case CBProbeUuid: -+ call->type = &afs_SRXCBProbeUuid; -+ return true; - case CBTellMeAboutYourself: - call->type = &afs_SRXCBTellMeAboutYourself; - return true; -diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c -index 44e09483d2cd..c690a1c0c4e5 100644 ---- a/fs/nfs/dir.c -+++ b/fs/nfs/dir.c -@@ -2051,7 +2051,7 @@ out: - if (new_inode != NULL) - nfs_drop_nlink(new_inode); - d_move(old_dentry, new_dentry); -- nfs_set_verifier(new_dentry, -+ nfs_set_verifier(old_dentry, - nfs_save_change_attribute(new_dir)); - } else if (error == -ENOENT) - nfs_dentry_handle_enoent(old_dentry); -diff --git a/include/drm/drmP.h b/include/drm/drmP.h -index a31976c860f6..a5d506b93daf 100644 ---- a/include/drm/drmP.h -+++ b/include/drm/drmP.h -@@ -158,6 +158,26 @@ void drm_err(const char *format, ...); - /** \name Macros to make printk easier */ - /*@{*/ - -+#define _DRM_PRINTK(once, level, fmt, ...) \ -+ do { \ -+ printk##once(KERN_##level "[" DRM_NAME "] " fmt, \ -+ ##__VA_ARGS__); \ -+ } while (0) -+ -+#define DRM_INFO(fmt, ...) \ -+ _DRM_PRINTK(, INFO, fmt, ##__VA_ARGS__) -+#define DRM_NOTE(fmt, ...) \ -+ _DRM_PRINTK(, NOTICE, fmt, ##__VA_ARGS__) -+#define DRM_WARN(fmt, ...) \ -+ _DRM_PRINTK(, WARNING, fmt, ##__VA_ARGS__) -+ -+#define DRM_INFO_ONCE(fmt, ...) \ -+ _DRM_PRINTK(_once, INFO, fmt, ##__VA_ARGS__) -+#define DRM_NOTE_ONCE(fmt, ...) \ -+ _DRM_PRINTK(_once, NOTICE, fmt, ##__VA_ARGS__) -+#define DRM_WARN_ONCE(fmt, ...) \ -+ _DRM_PRINTK(_once, WARNING, fmt, ##__VA_ARGS__) -+ - /** - * Error output. - * -@@ -183,12 +203,6 @@ void drm_err(const char *format, ...); - drm_err(fmt, ##__VA_ARGS__); \ - }) - --#define DRM_INFO(fmt, ...) \ -- printk(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__) -- --#define DRM_INFO_ONCE(fmt, ...) \ -- printk_once(KERN_INFO "[" DRM_NAME "] " fmt, ##__VA_ARGS__) -- - /** - * Debug output. - * -diff --git a/include/linux/genalloc.h b/include/linux/genalloc.h -index 7ff168d06967..46156ff5b01d 100644 ---- a/include/linux/genalloc.h -+++ b/include/linux/genalloc.h -@@ -31,6 +31,7 @@ - #define __GENALLOC_H__ - - #include -+#include - - struct device; - struct device_node; -@@ -68,7 +69,7 @@ struct gen_pool { - */ - struct gen_pool_chunk { - struct list_head next_chunk; /* next chunk in pool */ -- atomic_t avail; -+ atomic_long_t avail; - phys_addr_t phys_addr; /* physical starting address of memory chunk */ - unsigned long start_addr; /* start address of memory chunk */ - unsigned long end_addr; /* end address of memory chunk (inclusive) */ -diff --git a/include/linux/mmu_notifier.h b/include/linux/mmu_notifier.h -index a1a210d59961..38c5eb21883e 100644 ---- a/include/linux/mmu_notifier.h -+++ b/include/linux/mmu_notifier.h -@@ -381,18 +381,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm) - ___pmd; \ - }) - --#define pmdp_huge_get_and_clear_notify(__mm, __haddr, __pmd) \ --({ \ -- unsigned long ___haddr = __haddr & HPAGE_PMD_MASK; \ -- pmd_t ___pmd; \ -- \ -- ___pmd = pmdp_huge_get_and_clear(__mm, __haddr, __pmd); \ -- mmu_notifier_invalidate_range(__mm, ___haddr, \ -- ___haddr + HPAGE_PMD_SIZE); \ -- \ -- ___pmd; \ --}) -- - /* - * set_pte_at_notify() sets the pte _after_ running the notifier. - * This is safe to start by updating the secondary MMUs, because the primary MMU -@@ -475,7 +463,6 @@ static inline void mmu_notifier_mm_destroy(struct mm_struct *mm) - #define pmdp_clear_young_notify pmdp_test_and_clear_young - #define ptep_clear_flush_notify ptep_clear_flush - #define pmdp_huge_clear_flush_notify pmdp_huge_clear_flush --#define pmdp_huge_get_and_clear_notify pmdp_huge_get_and_clear - #define set_pte_at_notify set_pte_at - - #endif /* CONFIG_MMU_NOTIFIER */ -diff --git a/include/linux/omap-gpmc.h b/include/linux/omap-gpmc.h -index 7dee00143afd..c201e31e9d7e 100644 ---- a/include/linux/omap-gpmc.h -+++ b/include/linux/omap-gpmc.h -@@ -191,10 +191,11 @@ static inline int gpmc_nand_init(struct omap_nand_platform_data *d, - #endif - - #if IS_ENABLED(CONFIG_MTD_ONENAND_OMAP2) --extern void gpmc_onenand_init(struct omap_onenand_platform_data *d); -+extern int gpmc_onenand_init(struct omap_onenand_platform_data *d); - #else - #define board_onenand_data NULL --static inline void gpmc_onenand_init(struct omap_onenand_platform_data *d) -+static inline int gpmc_onenand_init(struct omap_onenand_platform_data *d) - { -+ return 0; - } - #endif -diff --git a/include/linux/sysfs.h b/include/linux/sysfs.h -index c6f0f0d0e17e..00a1f330f93a 100644 ---- a/include/linux/sysfs.h -+++ b/include/linux/sysfs.h -@@ -116,6 +116,12 @@ struct attribute_group { - .show = _name##_show, \ - } - -+#define __ATTR_RO_MODE(_name, _mode) { \ -+ .attr = { .name = __stringify(_name), \ -+ .mode = VERIFY_OCTAL_PERMISSIONS(_mode) }, \ -+ .show = _name##_show, \ -+} -+ - #define __ATTR_WO(_name) { \ - .attr = { .name = __stringify(_name), .mode = S_IWUSR }, \ - .store = _name##_store, \ -diff --git a/include/scsi/libsas.h b/include/scsi/libsas.h -index dae99d7d2bc0..706a7017885c 100644 ---- a/include/scsi/libsas.h -+++ b/include/scsi/libsas.h -@@ -165,11 +165,11 @@ struct expander_device { - - struct sata_device { - unsigned int class; -- struct smp_resp rps_resp; /* report_phy_sata_resp */ - u8 port_no; /* port number, if this is a PM (Port) */ - - struct ata_port *ap; - struct ata_host ata_host; -+ struct smp_resp rps_resp ____cacheline_aligned; /* report_phy_sata_resp */ - u8 fis[ATA_RESP_FIS_SIZE]; - }; - -diff --git a/kernel/audit.c b/kernel/audit.c -index 5ffcbd354a52..41f9a38bb800 100644 ---- a/kernel/audit.c -+++ b/kernel/audit.c -@@ -80,13 +80,13 @@ static int audit_initialized; - #define AUDIT_OFF 0 - #define AUDIT_ON 1 - #define AUDIT_LOCKED 2 --u32 audit_enabled; --u32 audit_ever_enabled; -+u32 audit_enabled = AUDIT_OFF; -+u32 audit_ever_enabled = !!AUDIT_OFF; - - EXPORT_SYMBOL_GPL(audit_enabled); - - /* Default state when kernel boots without any parameters. */ --static u32 audit_default; -+static u32 audit_default = AUDIT_OFF; - - /* If auditing cannot proceed, audit_failure selects what happens. */ - static u32 audit_failure = AUDIT_FAIL_PRINTK; -@@ -1179,8 +1179,6 @@ static int __init audit_init(void) - skb_queue_head_init(&audit_skb_queue); - skb_queue_head_init(&audit_skb_hold_queue); - audit_initialized = AUDIT_INITIALIZED; -- audit_enabled = audit_default; -- audit_ever_enabled |= !!audit_default; - - audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized"); - -@@ -1197,6 +1195,8 @@ static int __init audit_enable(char *str) - audit_default = !!simple_strtol(str, NULL, 0); - if (!audit_default) - audit_initialized = AUDIT_DISABLED; -+ audit_enabled = audit_default; -+ audit_ever_enabled = !!audit_enabled; - - pr_info("%s\n", audit_default ? - "enabled (after initialization)" : "disabled (until reboot)"); -diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c -index fc1ef736253c..77777d918676 100644 ---- a/kernel/debug/kdb/kdb_io.c -+++ b/kernel/debug/kdb/kdb_io.c -@@ -349,7 +349,7 @@ poll_again: - } - kdb_printf("\n"); - for (i = 0; i < count; i++) { -- if (kallsyms_symbol_next(p_tmp, i) < 0) -+ if (WARN_ON(!kallsyms_symbol_next(p_tmp, i))) - break; - kdb_printf("%s ", p_tmp); - *(p_tmp + len) = '\0'; -diff --git a/kernel/jump_label.c b/kernel/jump_label.c -index 453ec4232852..e863b2339174 100644 ---- a/kernel/jump_label.c -+++ b/kernel/jump_label.c -@@ -553,7 +553,7 @@ static __init int jump_label_test(void) - - return 0; - } --late_initcall(jump_label_test); -+early_initcall(jump_label_test); - #endif /* STATIC_KEYS_SELFTEST */ - - #endif /* HAVE_JUMP_LABEL */ -diff --git a/kernel/workqueue.c b/kernel/workqueue.c -index 95cc76785a12..85555eb4d3cb 100644 ---- a/kernel/workqueue.c -+++ b/kernel/workqueue.c -@@ -1479,6 +1479,7 @@ static void __queue_delayed_work(int cpu, struct workqueue_struct *wq, - struct timer_list *timer = &dwork->timer; - struct work_struct *work = &dwork->work; - -+ WARN_ON_ONCE(!wq); - WARN_ON_ONCE(timer->function != delayed_work_timer_fn || - timer->data != (unsigned long)dwork); - WARN_ON_ONCE(timer_pending(timer)); -diff --git a/lib/asn1_decoder.c b/lib/asn1_decoder.c -index 4fa2e54b3f59..76d110301251 100644 ---- a/lib/asn1_decoder.c -+++ b/lib/asn1_decoder.c -@@ -312,42 +312,47 @@ next_op: - - /* Decide how to handle the operation */ - switch (op) { -- case ASN1_OP_MATCH_ANY_ACT: -- case ASN1_OP_MATCH_ANY_ACT_OR_SKIP: -- case ASN1_OP_COND_MATCH_ANY_ACT: -- case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP: -- ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len); -- if (ret < 0) -- return ret; -- goto skip_data; -- -- case ASN1_OP_MATCH_ACT: -- case ASN1_OP_MATCH_ACT_OR_SKIP: -- case ASN1_OP_COND_MATCH_ACT_OR_SKIP: -- ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len); -- if (ret < 0) -- return ret; -- goto skip_data; -- - case ASN1_OP_MATCH: - case ASN1_OP_MATCH_OR_SKIP: -+ case ASN1_OP_MATCH_ACT: -+ case ASN1_OP_MATCH_ACT_OR_SKIP: - case ASN1_OP_MATCH_ANY: - case ASN1_OP_MATCH_ANY_OR_SKIP: -+ case ASN1_OP_MATCH_ANY_ACT: -+ case ASN1_OP_MATCH_ANY_ACT_OR_SKIP: - case ASN1_OP_COND_MATCH_OR_SKIP: -+ case ASN1_OP_COND_MATCH_ACT_OR_SKIP: - case ASN1_OP_COND_MATCH_ANY: - case ASN1_OP_COND_MATCH_ANY_OR_SKIP: -- skip_data: -+ case ASN1_OP_COND_MATCH_ANY_ACT: -+ case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP: -+ - if (!(flags & FLAG_CONS)) { - if (flags & FLAG_INDEFINITE_LENGTH) { -+ size_t tmp = dp; -+ - ret = asn1_find_indefinite_length( -- data, datalen, &dp, &len, &errmsg); -+ data, datalen, &tmp, &len, &errmsg); - if (ret < 0) - goto error; -- } else { -- dp += len; - } - pr_debug("- LEAF: %zu\n", len); - } -+ -+ if (op & ASN1_OP_MATCH__ACT) { -+ unsigned char act; -+ -+ if (op & ASN1_OP_MATCH__ANY) -+ act = machine[pc + 1]; -+ else -+ act = machine[pc + 2]; -+ ret = actions[act](context, hdr, tag, data + dp, len); -+ if (ret < 0) -+ return ret; -+ } -+ -+ if (!(flags & FLAG_CONS)) -+ dp += len; - pc += asn1_op_lengths[op]; - goto next_op; - -@@ -433,6 +438,8 @@ next_op: - else - act = machine[pc + 1]; - ret = actions[act](context, hdr, 0, data + tdp, len); -+ if (ret < 0) -+ return ret; - } - pc += asn1_op_lengths[op]; - goto next_op; -diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c -index e3952e9c8ec0..c6368ae93fe6 100644 ---- a/lib/dynamic_debug.c -+++ b/lib/dynamic_debug.c -@@ -353,6 +353,10 @@ static int ddebug_parse_query(char *words[], int nwords, - if (parse_lineno(last, &query->last_lineno) < 0) - return -EINVAL; - -+ /* special case for last lineno not specified */ -+ if (query->last_lineno == 0) -+ query->last_lineno = UINT_MAX; -+ - if (query->last_lineno < query->first_lineno) { - pr_err("last-line:%d < 1st-line:%d\n", - query->last_lineno, -diff --git a/lib/genalloc.c b/lib/genalloc.c -index 27aa9c629d13..e4303fb2a7b2 100644 ---- a/lib/genalloc.c -+++ b/lib/genalloc.c -@@ -194,7 +194,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy - chunk->phys_addr = phys; - chunk->start_addr = virt; - chunk->end_addr = virt + size - 1; -- atomic_set(&chunk->avail, size); -+ atomic_long_set(&chunk->avail, size); - - spin_lock(&pool->lock); - list_add_rcu(&chunk->next_chunk, &pool->chunks); -@@ -285,7 +285,7 @@ unsigned long gen_pool_alloc(struct gen_pool *pool, size_t size) - nbits = (size + (1UL << order) - 1) >> order; - rcu_read_lock(); - list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) { -- if (size > atomic_read(&chunk->avail)) -+ if (size > atomic_long_read(&chunk->avail)) - continue; - - start_bit = 0; -@@ -305,7 +305,7 @@ retry: - - addr = chunk->start_addr + ((unsigned long)start_bit << order); - size = nbits << order; -- atomic_sub(size, &chunk->avail); -+ atomic_long_sub(size, &chunk->avail); - break; - } - rcu_read_unlock(); -@@ -371,7 +371,7 @@ void gen_pool_free(struct gen_pool *pool, unsigned long addr, size_t size) - remain = bitmap_clear_ll(chunk->bits, start_bit, nbits); - BUG_ON(remain); - size = nbits << order; -- atomic_add(size, &chunk->avail); -+ atomic_long_add(size, &chunk->avail); - rcu_read_unlock(); - return; - } -@@ -445,7 +445,7 @@ size_t gen_pool_avail(struct gen_pool *pool) - - rcu_read_lock(); - list_for_each_entry_rcu(chunk, &pool->chunks, next_chunk) -- avail += atomic_read(&chunk->avail); -+ avail += atomic_long_read(&chunk->avail); - rcu_read_unlock(); - return avail; - } -diff --git a/mm/huge_memory.c b/mm/huge_memory.c -index 8f3769ec8575..0127b788272f 100644 ---- a/mm/huge_memory.c -+++ b/mm/huge_memory.c -@@ -1566,35 +1566,69 @@ int change_huge_pmd(struct vm_area_struct *vma, pmd_t *pmd, - { - struct mm_struct *mm = vma->vm_mm; - spinlock_t *ptl; -+ pmd_t entry; -+ bool preserve_write; -+ - int ret = 0; - -- if (__pmd_trans_huge_lock(pmd, vma, &ptl) == 1) { -- pmd_t entry; -- bool preserve_write = prot_numa && pmd_write(*pmd); -- ret = 1; -+ if (__pmd_trans_huge_lock(pmd, vma, &ptl) != 1) -+ return 0; - -- /* -- * Avoid trapping faults against the zero page. The read-only -- * data is likely to be read-cached on the local CPU and -- * local/remote hits to the zero page are not interesting. -- */ -- if (prot_numa && is_huge_zero_pmd(*pmd)) { -- spin_unlock(ptl); -- return ret; -- } -+ preserve_write = prot_numa && pmd_write(*pmd); -+ ret = 1; - -- if (!prot_numa || !pmd_protnone(*pmd)) { -- entry = pmdp_huge_get_and_clear_notify(mm, addr, pmd); -- entry = pmd_modify(entry, newprot); -- if (preserve_write) -- entry = pmd_mkwrite(entry); -- ret = HPAGE_PMD_NR; -- set_pmd_at(mm, addr, pmd, entry); -- BUG_ON(!preserve_write && pmd_write(entry)); -- } -- spin_unlock(ptl); -- } -+ /* -+ * Avoid trapping faults against the zero page. The read-only -+ * data is likely to be read-cached on the local CPU and -+ * local/remote hits to the zero page are not interesting. -+ */ -+ if (prot_numa && is_huge_zero_pmd(*pmd)) -+ goto unlock; - -+ if (prot_numa && pmd_protnone(*pmd)) -+ goto unlock; -+ -+ /* -+ * In case prot_numa, we are under down_read(mmap_sem). It's critical -+ * to not clear pmd intermittently to avoid race with MADV_DONTNEED -+ * which is also under down_read(mmap_sem): -+ * -+ * CPU0: CPU1: -+ * change_huge_pmd(prot_numa=1) -+ * pmdp_huge_get_and_clear_notify() -+ * madvise_dontneed() -+ * zap_pmd_range() -+ * pmd_trans_huge(*pmd) == 0 (without ptl) -+ * // skip the pmd -+ * set_pmd_at(); -+ * // pmd is re-established -+ * -+ * The race makes MADV_DONTNEED miss the huge pmd and don't clear it -+ * which may break userspace. -+ * -+ * pmdp_invalidate() is required to make sure we don't miss -+ * dirty/young flags set by hardware. -+ */ -+ entry = *pmd; -+ pmdp_invalidate(vma, addr, pmd); -+ -+ /* -+ * Recover dirty/young flags. It relies on pmdp_invalidate to not -+ * corrupt them. -+ */ -+ if (pmd_dirty(*pmd)) -+ entry = pmd_mkdirty(entry); -+ if (pmd_young(*pmd)) -+ entry = pmd_mkyoung(entry); -+ -+ entry = pmd_modify(entry, newprot); -+ if (preserve_write) -+ entry = pmd_mkwrite(entry); -+ ret = HPAGE_PMD_NR; -+ set_pmd_at(mm, addr, pmd, entry); -+ BUG_ON(!preserve_write && pmd_write(entry)); -+unlock: -+ spin_unlock(ptl); - return ret; - } - -diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c -index 461ca926fd39..6a20195a3a2a 100644 ---- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c -+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c -@@ -158,6 +158,10 @@ static unsigned int ipv4_conntrack_local(void *priv, - if (skb->len < sizeof(struct iphdr) || - ip_hdrlen(skb) < sizeof(struct iphdr)) - return NF_ACCEPT; -+ -+ if (ip_is_fragment(ip_hdr(skb))) /* IP_NODEFRAG setsockopt set */ -+ return NF_ACCEPT; -+ - return nf_conntrack_in(state->net, PF_INET, state->hook, skb); - } - -diff --git a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c -index 5075b7ecd26d..98a56077f604 100644 ---- a/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c -+++ b/net/ipv4/netfilter/nf_nat_l3proto_ipv4.c -@@ -268,11 +268,6 @@ nf_nat_ipv4_fn(void *priv, struct sk_buff *skb, - /* maniptype == SRC for postrouting. */ - enum nf_nat_manip_type maniptype = HOOK2MANIP(state->hook); - -- /* We never see fragments: conntrack defrags on pre-routing -- * and local-out, and nf_nat_out protects post-routing. -- */ -- NF_CT_ASSERT(!ip_is_fragment(ip_hdr(skb))); -- - ct = nf_ct_get(skb, &ctinfo); - /* Can't track? It's not due to stress, or conntrack would - * have dropped it. Hence it's the user's responsibilty to -diff --git a/net/ipv4/route.c b/net/ipv4/route.c -index 0294f7c99c85..52d718e3f077 100644 ---- a/net/ipv4/route.c -+++ b/net/ipv4/route.c -@@ -624,9 +624,12 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, - struct fnhe_hash_bucket *hash; - struct fib_nh_exception *fnhe; - struct rtable *rt; -+ u32 genid, hval; - unsigned int i; - int depth; -- u32 hval = fnhe_hashfun(daddr); -+ -+ genid = fnhe_genid(dev_net(nh->nh_dev)); -+ hval = fnhe_hashfun(daddr); - - spin_lock_bh(&fnhe_lock); - -@@ -649,12 +652,13 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, - } - - if (fnhe) { -+ if (fnhe->fnhe_genid != genid) -+ fnhe->fnhe_genid = genid; - if (gw) - fnhe->fnhe_gw = gw; -- if (pmtu) { -+ if (pmtu) - fnhe->fnhe_pmtu = pmtu; -- fnhe->fnhe_expires = max(1UL, expires); -- } -+ fnhe->fnhe_expires = max(1UL, expires); - /* Update all cached dsts too */ - rt = rcu_dereference(fnhe->fnhe_rth_input); - if (rt) -@@ -673,7 +677,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, - fnhe->fnhe_next = hash->chain; - rcu_assign_pointer(hash->chain, fnhe); - } -- fnhe->fnhe_genid = fnhe_genid(dev_net(nh->nh_dev)); -+ fnhe->fnhe_genid = genid; - fnhe->fnhe_daddr = daddr; - fnhe->fnhe_gw = gw; - fnhe->fnhe_pmtu = pmtu; -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 9f5137cd604e..83ec6639b04d 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -893,12 +893,12 @@ static int __init inet6_init(void) - err = register_pernet_subsys(&inet6_net_ops); - if (err) - goto register_pernet_fail; -- err = icmpv6_init(); -- if (err) -- goto icmp_fail; - err = ip6_mr_init(); - if (err) - goto ipmr_fail; -+ err = icmpv6_init(); -+ if (err) -+ goto icmp_fail; - err = ndisc_init(); - if (err) - goto ndisc_fail; -@@ -1016,10 +1016,10 @@ igmp_fail: - ndisc_cleanup(); - ndisc_fail: - ip6_mr_cleanup(); --ipmr_fail: -- icmpv6_cleanup(); - icmp_fail: - unregister_pernet_subsys(&inet6_net_ops); -+ipmr_fail: -+ icmpv6_cleanup(); - register_pernet_fail: - sock_unregister(PF_INET6); - rtnl_unregister_all(PF_INET6); -diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c -index f58ad70f693e..24dfc2de0165 100644 ---- a/net/ipv6/ip6_vti.c -+++ b/net/ipv6/ip6_vti.c -@@ -474,11 +474,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl) - if (!skb->ignore_df && skb->len > mtu) { - skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu); - -- if (skb->protocol == htons(ETH_P_IPV6)) -+ if (skb->protocol == htons(ETH_P_IPV6)) { -+ if (mtu < IPV6_MIN_MTU) -+ mtu = IPV6_MIN_MTU; -+ - icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu); -- else -+ } else { - icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, - htonl(mtu)); -+ } - - return -EMSGSIZE; - } -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 184f0fe35dc6..b7ea5eaa4fd1 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1093,6 +1093,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p) - ipip6_tunnel_link(sitn, t); - t->parms.iph.ttl = p->iph.ttl; - t->parms.iph.tos = p->iph.tos; -+ t->parms.iph.frag_off = p->iph.frag_off; - if (t->parms.link != p->link) { - t->parms.link = p->link; - ipip6_tunnel_bind_dev(t->dev); -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index 1584f89c456a..92ca3e106c2b 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -1665,7 +1665,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - atomic_long_set(&rollover->num, 0); - atomic_long_set(&rollover->num_huge, 0); - atomic_long_set(&rollover->num_failed, 0); -- po->rollover = rollover; - } - - match = NULL; -@@ -1710,6 +1709,8 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - if (atomic_read(&match->sk_ref) < PACKET_FANOUT_MAX) { - __dev_remove_pack(&po->prot_hook); - po->fanout = match; -+ po->rollover = rollover; -+ rollover = NULL; - atomic_inc(&match->sk_ref); - __fanout_link(sk, po); - err = 0; -@@ -1723,10 +1724,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) - } - - out: -- if (err && rollover) { -- kfree_rcu(rollover, rcu); -- po->rollover = NULL; -- } -+ kfree(rollover); - mutex_unlock(&fanout_mutex); - return err; - } -@@ -1750,11 +1748,6 @@ static struct packet_fanout *fanout_release(struct sock *sk) - list_del(&f->list); - else - f = NULL; -- -- if (po->rollover) { -- kfree_rcu(po->rollover, rcu); -- po->rollover = NULL; -- } - } - mutex_unlock(&fanout_mutex); - -@@ -2914,6 +2907,7 @@ static int packet_release(struct socket *sock) - synchronize_net(); - - if (f) { -+ kfree(po->rollover); - fanout_release_data(f); - kfree(f); - } -@@ -2982,6 +2976,10 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, - if (need_rehook) { - if (po->running) { - rcu_read_unlock(); -+ /* prevents packet_notifier() from calling -+ * register_prot_hook() -+ */ -+ po->num = 0; - __unregister_prot_hook(sk, true); - rcu_read_lock(); - dev_curr = po->prot_hook.dev; -@@ -2990,6 +2988,7 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex, - dev->ifindex); - } - -+ BUG_ON(po->running); - po->num = proto; - po->prot_hook.type = proto; - -@@ -3771,7 +3770,6 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - void *data = &val; - union tpacket_stats_u st; - struct tpacket_rollover_stats rstats; -- struct packet_rollover *rollover; - - if (level != SOL_PACKET) - return -ENOPROTOOPT; -@@ -3850,18 +3848,13 @@ static int packet_getsockopt(struct socket *sock, int level, int optname, - 0); - break; - case PACKET_ROLLOVER_STATS: -- rcu_read_lock(); -- rollover = rcu_dereference(po->rollover); -- if (rollover) { -- rstats.tp_all = atomic_long_read(&rollover->num); -- rstats.tp_huge = atomic_long_read(&rollover->num_huge); -- rstats.tp_failed = atomic_long_read(&rollover->num_failed); -- data = &rstats; -- lv = sizeof(rstats); -- } -- rcu_read_unlock(); -- if (!rollover) -+ if (!po->rollover) - return -EINVAL; -+ rstats.tp_all = atomic_long_read(&po->rollover->num); -+ rstats.tp_huge = atomic_long_read(&po->rollover->num_huge); -+ rstats.tp_failed = atomic_long_read(&po->rollover->num_failed); -+ data = &rstats; -+ lv = sizeof(rstats); - break; - case PACKET_TX_HAS_OFF: - val = po->tp_tx_has_off; -diff --git a/net/packet/internal.h b/net/packet/internal.h -index 9ee46314b7d7..d55bfc34d6b3 100644 ---- a/net/packet/internal.h -+++ b/net/packet/internal.h -@@ -92,7 +92,6 @@ struct packet_fanout { - - struct packet_rollover { - int sock; -- struct rcu_head rcu; - atomic_long_t num; - atomic_long_t num_huge; - atomic_long_t num_failed; -diff --git a/net/rds/rdma.c b/net/rds/rdma.c -index 8d3a851a3476..bdf151c6307d 100644 ---- a/net/rds/rdma.c -+++ b/net/rds/rdma.c -@@ -184,7 +184,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args, - long i; - int ret; - -- if (rs->rs_bound_addr == 0) { -+ if (rs->rs_bound_addr == 0 || !rs->rs_transport) { - ret = -ENOTCONN; /* XXX not a great errno */ - goto out; - } -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 7f0f689b8d2b..61189c576963 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -82,8 +82,8 @@ - /* Forward declarations for internal helper functions. */ - static int sctp_writeable(struct sock *sk); - static void sctp_wfree(struct sk_buff *skb); --static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p, -- size_t msg_len); -+static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -+ size_t msg_len, struct sock **orig_sk); - static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); - static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); - static int sctp_wait_for_accept(struct sock *sk, long timeo); -@@ -1953,9 +1953,16 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) - - timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); - if (!sctp_wspace(asoc)) { -- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); -- if (err) -+ /* sk can be changed by peel off when waiting for buf. */ -+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); -+ if (err) { -+ if (err == -ESRCH) { -+ /* asoc is already dead. */ -+ new_asoc = NULL; -+ err = -EPIPE; -+ } - goto out_free; -+ } - } - - /* If an address is passed with the sendto/sendmsg call, it is used -@@ -4460,12 +4467,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) - if (!asoc) - return -EINVAL; - -- /* If there is a thread waiting on more sndbuf space for -- * sending on this asoc, it cannot be peeled. -- */ -- if (waitqueue_active(&asoc->wait)) -- return -EBUSY; -- - /* An association cannot be branched off from an already peeled-off - * socket, nor is this supported for tcp style sockets. - */ -@@ -6975,7 +6976,7 @@ void sctp_sock_rfree(struct sk_buff *skb) - - /* Helper function to wait for space in the sndbuf. */ - static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -- size_t msg_len) -+ size_t msg_len, struct sock **orig_sk) - { - struct sock *sk = asoc->base.sk; - int err = 0; -@@ -6992,10 +6993,11 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - for (;;) { - prepare_to_wait_exclusive(&asoc->wait, &wait, - TASK_INTERRUPTIBLE); -+ if (asoc->base.dead) -+ goto do_dead; - if (!*timeo_p) - goto do_nonblock; -- if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING || -- asoc->base.dead) -+ if (sk->sk_err || asoc->state >= SCTP_STATE_SHUTDOWN_PENDING) - goto do_error; - if (signal_pending(current)) - goto do_interrupted; -@@ -7008,11 +7010,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - release_sock(sk); - current_timeo = schedule_timeout(current_timeo); - lock_sock(sk); -+ if (sk != asoc->base.sk) { -+ release_sock(sk); -+ sk = asoc->base.sk; -+ lock_sock(sk); -+ } - - *timeo_p = current_timeo; - } - - out: -+ *orig_sk = sk; - finish_wait(&asoc->wait, &wait); - - /* Release the association's refcnt. */ -@@ -7020,6 +7028,10 @@ out: - - return err; - -+do_dead: -+ err = -ESRCH; -+ goto out; -+ - do_error: - err = -EPIPE; - goto out; -diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c -index 73ad57a59989..1cb35c753dcd 100644 ---- a/net/sunrpc/sched.c -+++ b/net/sunrpc/sched.c -@@ -273,10 +273,9 @@ static inline void rpc_task_set_debuginfo(struct rpc_task *task) - - static void rpc_set_active(struct rpc_task *task) - { -- trace_rpc_task_begin(task->tk_client, task, NULL); -- - rpc_task_set_debuginfo(task); - set_bit(RPC_TASK_ACTIVE, &task->tk_runstate); -+ trace_rpc_task_begin(task->tk_client, task, NULL); - } - - /* -diff --git a/net/tipc/server.c b/net/tipc/server.c -index c416e5184a3f..f351863076c2 100644 ---- a/net/tipc/server.c -+++ b/net/tipc/server.c -@@ -311,6 +311,7 @@ static int tipc_accept_from_sock(struct tipc_conn *con) - newcon->usr_data = s->tipc_conn_new(newcon->conid); - if (!newcon->usr_data) { - sock_release(newsock); -+ conn_put(newcon); - return -ENOMEM; - } - -diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c -index 0e01250f2072..22df3b51e905 100644 ---- a/net/xfrm/xfrm_policy.c -+++ b/net/xfrm/xfrm_policy.c -@@ -1361,6 +1361,7 @@ static struct xfrm_policy *clone_policy(const struct xfrm_policy *old, int dir) - newp->xfrm_nr = old->xfrm_nr; - newp->index = old->index; - newp->type = old->type; -+ newp->family = old->family; - memcpy(newp->xfrm_vec, old->xfrm_vec, - newp->xfrm_nr*sizeof(struct xfrm_tmpl)); - write_lock_bh(&net->xfrm.xfrm_policy_lock); -diff --git a/scripts/module-common.lds b/scripts/module-common.lds -index 73a2c7da0e55..53234e85192a 100644 ---- a/scripts/module-common.lds -+++ b/scripts/module-common.lds -@@ -19,4 +19,6 @@ SECTIONS { - - . = ALIGN(8); - .init_array 0 : { *(SORT(.init_array.*)) *(.init_array) } -+ -+ __jump_table 0 : ALIGN(8) { KEEP(*(__jump_table)) } - } -diff --git a/scripts/package/Makefile b/scripts/package/Makefile -index 493e226356ca..52917fb8e0c5 100644 ---- a/scripts/package/Makefile -+++ b/scripts/package/Makefile -@@ -39,10 +39,9 @@ if test "$(objtree)" != "$(srctree)"; then \ - false; \ - fi ; \ - $(srctree)/scripts/setlocalversion --save-scmversion; \ --ln -sf $(srctree) $(2); \ - tar -cz $(RCS_TAR_IGNORE) -f $(2).tar.gz \ -- $(addprefix $(2)/,$(TAR_CONTENT) $(3)); \ --rm -f $(2) $(objtree)/.scmversion -+ --transform 's:^:$(2)/:S' $(TAR_CONTENT) $(3); \ -+rm -f $(objtree)/.scmversion - - # rpm-pkg - # --------------------------------------------------------------------------- -diff --git a/sound/core/pcm.c b/sound/core/pcm.c -index 8e980aa678d0..074363b63cc4 100644 ---- a/sound/core/pcm.c -+++ b/sound/core/pcm.c -@@ -149,7 +149,9 @@ static int snd_pcm_control_ioctl(struct snd_card *card, - err = -ENXIO; - goto _error; - } -+ mutex_lock(&pcm->open_mutex); - err = snd_pcm_info_user(substream, info); -+ mutex_unlock(&pcm->open_mutex); - _error: - mutex_unlock(®ister_mutex); - return err; -diff --git a/sound/core/seq/seq_timer.c b/sound/core/seq/seq_timer.c -index 293104926098..3be67560ead5 100644 ---- a/sound/core/seq/seq_timer.c -+++ b/sound/core/seq/seq_timer.c -@@ -355,7 +355,7 @@ static int initialize_timer(struct snd_seq_timer *tmr) - unsigned long freq; - - t = tmr->timeri->timer; -- if (snd_BUG_ON(!t)) -+ if (!t) - return -EINVAL; - - freq = tmr->preferred_resolution; -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 1050008d7719..0ed9ae030ce1 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -203,6 +203,10 @@ static int snd_usb_copy_string_desc(struct mixer_build *state, - int index, char *buf, int maxlen) - { - int len = usb_string(state->chip->dev, index, buf, maxlen - 1); -+ -+ if (len < 0) -+ return 0; -+ - buf[len] = 0; - return len; - } -@@ -2102,13 +2106,14 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, - if (len) - ; - else if (nameid) -- snd_usb_copy_string_desc(state, nameid, kctl->id.name, -+ len = snd_usb_copy_string_desc(state, nameid, kctl->id.name, - sizeof(kctl->id.name)); -- else { -+ else - len = get_term_name(state, &state->oterm, - kctl->id.name, sizeof(kctl->id.name), 0); -- if (!len) -- strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); -+ -+ if (!len) { -+ strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); - - if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) - append_ctl_name(kctl, " Clock Source"); -diff --git a/tools/hv/hv_kvp_daemon.c b/tools/hv/hv_kvp_daemon.c -index bc7adb84e679..60a94b3e532e 100644 ---- a/tools/hv/hv_kvp_daemon.c -+++ b/tools/hv/hv_kvp_daemon.c -@@ -193,11 +193,14 @@ static void kvp_update_mem_state(int pool) - for (;;) { - readp = &record[records_read]; - records_read += fread(readp, sizeof(struct kvp_record), -- ENTRIES_PER_BLOCK * num_blocks, -- filep); -+ ENTRIES_PER_BLOCK * num_blocks - records_read, -+ filep); - - if (ferror(filep)) { -- syslog(LOG_ERR, "Failed to read file, pool: %d", pool); -+ syslog(LOG_ERR, -+ "Failed to read file, pool: %d; error: %d %s", -+ pool, errno, strerror(errno)); -+ kvp_release_lock(pool); - exit(EXIT_FAILURE); - } - -@@ -210,6 +213,7 @@ static void kvp_update_mem_state(int pool) - - if (record == NULL) { - syslog(LOG_ERR, "malloc failed"); -+ kvp_release_lock(pool); - exit(EXIT_FAILURE); - } - continue; -@@ -224,15 +228,11 @@ static void kvp_update_mem_state(int pool) - fclose(filep); - kvp_release_lock(pool); - } -+ - static int kvp_file_init(void) - { - int fd; -- FILE *filep; -- size_t records_read; - char *fname; -- struct kvp_record *record; -- struct kvp_record *readp; -- int num_blocks; - int i; - int alloc_unit = sizeof(struct kvp_record) * ENTRIES_PER_BLOCK; - -@@ -246,61 +246,19 @@ static int kvp_file_init(void) - - for (i = 0; i < KVP_POOL_COUNT; i++) { - fname = kvp_file_info[i].fname; -- records_read = 0; -- num_blocks = 1; - sprintf(fname, "%s/.kvp_pool_%d", KVP_CONFIG_LOC, i); - fd = open(fname, O_RDWR | O_CREAT | O_CLOEXEC, 0644 /* rw-r--r-- */); - - if (fd == -1) - return 1; - -- -- filep = fopen(fname, "re"); -- if (!filep) { -- close(fd); -- return 1; -- } -- -- record = malloc(alloc_unit * num_blocks); -- if (record == NULL) { -- fclose(filep); -- close(fd); -- return 1; -- } -- for (;;) { -- readp = &record[records_read]; -- records_read += fread(readp, sizeof(struct kvp_record), -- ENTRIES_PER_BLOCK, -- filep); -- -- if (ferror(filep)) { -- syslog(LOG_ERR, "Failed to read file, pool: %d", -- i); -- exit(EXIT_FAILURE); -- } -- -- if (!feof(filep)) { -- /* -- * We have more data to read. -- */ -- num_blocks++; -- record = realloc(record, alloc_unit * -- num_blocks); -- if (record == NULL) { -- fclose(filep); -- close(fd); -- return 1; -- } -- continue; -- } -- break; -- } - kvp_file_info[i].fd = fd; -- kvp_file_info[i].num_blocks = num_blocks; -- kvp_file_info[i].records = record; -- kvp_file_info[i].num_records = records_read; -- fclose(filep); -- -+ kvp_file_info[i].num_blocks = 1; -+ kvp_file_info[i].records = malloc(alloc_unit); -+ if (kvp_file_info[i].records == NULL) -+ return 1; -+ kvp_file_info[i].num_records = 0; -+ kvp_update_mem_state(i); - } - - return 0; -diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c -index f7997affd143..f45cee80c58b 100644 ---- a/tools/testing/selftests/powerpc/harness.c -+++ b/tools/testing/selftests/powerpc/harness.c -@@ -109,9 +109,11 @@ int test_harness(int (test_function)(void), char *name) - - rc = run_test(test_function, name); - -- if (rc == MAGIC_SKIP_RETURN_VALUE) -+ if (rc == MAGIC_SKIP_RETURN_VALUE) { - test_skip(name); -- else -+ /* so that skipped test is not marked as failed */ -+ rc = 0; -+ } else - test_finish(name, rc); - - return rc; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.106-107.patch b/patch/kernel/mvebu64-default/04-patch-4.4.106-107.patch deleted file mode 100644 index 8d997ccb7c91..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.106-107.patch +++ /dev/null @@ -1,3188 +0,0 @@ -diff --git a/Makefile b/Makefile -index 8225da6b520f..f7997b15d055 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 106 -+SUBLEVEL = 107 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig -index af76634f8d98..934573cc1134 100644 ---- a/arch/blackfin/Kconfig -+++ b/arch/blackfin/Kconfig -@@ -318,11 +318,14 @@ config BF53x - - config GPIO_ADI - def_bool y -+ depends on !PINCTRL - depends on (BF51x || BF52x || BF53x || BF538 || BF539 || BF561) - --config PINCTRL -+config PINCTRL_BLACKFIN_ADI2 - def_bool y -- depends on BF54x || BF60x -+ depends on (BF54x || BF60x) -+ select PINCTRL -+ select PINCTRL_ADI2 - - config MEM_MT48LC64M4A2FB_7E - bool -diff --git a/arch/blackfin/Kconfig.debug b/arch/blackfin/Kconfig.debug -index f3337ee03621..a93cf06a4d6f 100644 ---- a/arch/blackfin/Kconfig.debug -+++ b/arch/blackfin/Kconfig.debug -@@ -17,6 +17,7 @@ config DEBUG_VERBOSE - - config DEBUG_MMRS - tristate "Generate Blackfin MMR tree" -+ depends on !PINCTRL - select DEBUG_FS - help - Create a tree of Blackfin MMRs via the debugfs tree. If -diff --git a/arch/openrisc/include/asm/uaccess.h b/arch/openrisc/include/asm/uaccess.h -index 5cc6b4f1b795..1a836afb636d 100644 ---- a/arch/openrisc/include/asm/uaccess.h -+++ b/arch/openrisc/include/asm/uaccess.h -@@ -215,7 +215,7 @@ do { \ - case 1: __get_user_asm(x, ptr, retval, "l.lbz"); break; \ - case 2: __get_user_asm(x, ptr, retval, "l.lhz"); break; \ - case 4: __get_user_asm(x, ptr, retval, "l.lwz"); break; \ -- case 8: __get_user_asm2(x, ptr, retval); \ -+ case 8: __get_user_asm2(x, ptr, retval); break; \ - default: (x) = __get_user_bad(); \ - } \ - } while (0) -diff --git a/arch/powerpc/perf/hv-24x7.c b/arch/powerpc/perf/hv-24x7.c -index 9f9dfda9ed2c..e8ca0fad2e69 100644 ---- a/arch/powerpc/perf/hv-24x7.c -+++ b/arch/powerpc/perf/hv-24x7.c -@@ -514,7 +514,7 @@ static int memord(const void *d1, size_t s1, const void *d2, size_t s2) - { - if (s1 < s2) - return 1; -- if (s2 > s1) -+ if (s1 > s2) - return -1; - - return memcmp(d1, d2, s1); -diff --git a/arch/powerpc/platforms/powernv/opal-async.c b/arch/powerpc/platforms/powernv/opal-async.c -index bdc8c0c71d15..4c00b37b09bc 100644 ---- a/arch/powerpc/platforms/powernv/opal-async.c -+++ b/arch/powerpc/platforms/powernv/opal-async.c -@@ -39,18 +39,18 @@ int __opal_async_get_token(void) - int token; - - spin_lock_irqsave(&opal_async_comp_lock, flags); -- token = find_first_bit(opal_async_complete_map, opal_max_async_tokens); -+ token = find_first_zero_bit(opal_async_token_map, opal_max_async_tokens); - if (token >= opal_max_async_tokens) { - token = -EBUSY; - goto out; - } - -- if (__test_and_set_bit(token, opal_async_token_map)) { -+ if (!__test_and_clear_bit(token, opal_async_complete_map)) { - token = -EBUSY; - goto out; - } - -- __clear_bit(token, opal_async_complete_map); -+ __set_bit(token, opal_async_token_map); - - out: - spin_unlock_irqrestore(&opal_async_comp_lock, flags); -diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c -index a9a8fa37a555..f48afc06ba14 100644 ---- a/arch/powerpc/platforms/powernv/setup.c -+++ b/arch/powerpc/platforms/powernv/setup.c -@@ -295,7 +295,7 @@ static unsigned long pnv_get_proc_freq(unsigned int cpu) - { - unsigned long ret_freq; - -- ret_freq = cpufreq_quick_get(cpu) * 1000ul; -+ ret_freq = cpufreq_get(cpu) * 1000ul; - - /* - * If the backend cpufreq driver does not exist, -diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c -index f76ee39cb337..800a591695c0 100644 ---- a/arch/powerpc/sysdev/ipic.c -+++ b/arch/powerpc/sysdev/ipic.c -@@ -845,12 +845,12 @@ void ipic_disable_mcp(enum ipic_mcp_irq mcp_irq) - - u32 ipic_get_mcp_status(void) - { -- return ipic_read(primary_ipic->regs, IPIC_SERMR); -+ return ipic_read(primary_ipic->regs, IPIC_SERSR); - } - - void ipic_clear_mcp_status(u32 mask) - { -- ipic_write(primary_ipic->regs, IPIC_SERMR, mask); -+ ipic_write(primary_ipic->regs, IPIC_SERSR, mask); - } - - /* Return an interrupt vector or NO_IRQ if no interrupt is pending. */ -diff --git a/arch/x86/crypto/salsa20_glue.c b/arch/x86/crypto/salsa20_glue.c -index 399a29d067d6..cb91a64a99e7 100644 ---- a/arch/x86/crypto/salsa20_glue.c -+++ b/arch/x86/crypto/salsa20_glue.c -@@ -59,13 +59,6 @@ static int encrypt(struct blkcipher_desc *desc, - - salsa20_ivsetup(ctx, walk.iv); - -- if (likely(walk.nbytes == nbytes)) -- { -- salsa20_encrypt_bytes(ctx, walk.src.virt.addr, -- walk.dst.virt.addr, nbytes); -- return blkcipher_walk_done(desc, &walk, 0); -- } -- - while (walk.nbytes >= 64) { - salsa20_encrypt_bytes(ctx, walk.src.virt.addr, - walk.dst.virt.addr, -diff --git a/crypto/hmac.c b/crypto/hmac.c -index 72e38c098bb3..ba07fb6221ae 100644 ---- a/crypto/hmac.c -+++ b/crypto/hmac.c -@@ -194,11 +194,15 @@ static int hmac_create(struct crypto_template *tmpl, struct rtattr **tb) - salg = shash_attr_alg(tb[1], 0, 0); - if (IS_ERR(salg)) - return PTR_ERR(salg); -+ alg = &salg->base; - -+ /* The underlying hash algorithm must be unkeyed */ - err = -EINVAL; -+ if (crypto_shash_alg_has_setkey(salg)) -+ goto out_put_alg; -+ - ds = salg->digestsize; - ss = salg->statesize; -- alg = &salg->base; - if (ds > alg->cra_blocksize || - ss < alg->cra_blocksize) - goto out_put_alg; -diff --git a/crypto/salsa20_generic.c b/crypto/salsa20_generic.c -index f550b5d94630..d7da0eea5622 100644 ---- a/crypto/salsa20_generic.c -+++ b/crypto/salsa20_generic.c -@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc *desc, - - salsa20_ivsetup(ctx, walk.iv); - -- if (likely(walk.nbytes == nbytes)) -- { -- salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, -- walk.src.virt.addr, nbytes); -- return blkcipher_walk_done(desc, &walk, 0); -- } -- - while (walk.nbytes >= 64) { - salsa20_encrypt_bytes(ctx, walk.dst.virt.addr, - walk.src.virt.addr, -diff --git a/crypto/shash.c b/crypto/shash.c -index b2cd109d9171..5444b429e35d 100644 ---- a/crypto/shash.c -+++ b/crypto/shash.c -@@ -24,11 +24,12 @@ - - static const struct crypto_type crypto_shash_type; - --static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, -- unsigned int keylen) -+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, -+ unsigned int keylen) - { - return -ENOSYS; - } -+EXPORT_SYMBOL_GPL(shash_no_setkey); - - static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key, - unsigned int keylen) -diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c -index 46a4a757d478..f522828d45c9 100644 ---- a/crypto/tcrypt.c -+++ b/crypto/tcrypt.c -@@ -410,7 +410,7 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, - } - - sg_init_aead(sg, xbuf, -- *b_size + (enc ? authsize : 0)); -+ *b_size + (enc ? 0 : authsize)); - - sg_init_aead(sgout, xoutbuf, - *b_size + (enc ? authsize : 0)); -@@ -418,7 +418,9 @@ static void test_aead_speed(const char *algo, int enc, unsigned int secs, - sg_set_buf(&sg[0], assoc, aad_size); - sg_set_buf(&sgout[0], assoc, aad_size); - -- aead_request_set_crypt(req, sg, sgout, *b_size, iv); -+ aead_request_set_crypt(req, sg, sgout, -+ *b_size + (enc ? 0 : authsize), -+ iv); - aead_request_set_ad(req, aad_size); - - if (secs) -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 1ccad79ce77c..ce120fbe229e 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -1050,6 +1050,10 @@ static int btusb_open(struct hci_dev *hdev) - return err; - - data->intf->needs_remote_wakeup = 1; -+ /* device specific wakeup source enabled and required for USB -+ * remote wakeup while host is suspended -+ */ -+ device_wakeup_enable(&data->udev->dev); - - if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) - goto done; -@@ -1113,6 +1117,7 @@ static int btusb_close(struct hci_dev *hdev) - goto failed; - - data->intf->needs_remote_wakeup = 0; -+ device_wakeup_disable(&data->udev->dev); - usb_autopm_put_interface(data->intf); - - failed: -diff --git a/drivers/bus/arm-ccn.c b/drivers/bus/arm-ccn.c -index 0f54cb7ddcbb..e764e8ebb86b 100644 ---- a/drivers/bus/arm-ccn.c -+++ b/drivers/bus/arm-ccn.c -@@ -1260,6 +1260,7 @@ static int arm_ccn_pmu_init(struct arm_ccn *ccn) - - /* Perf driver registration */ - ccn->dt.pmu = (struct pmu) { -+ .module = THIS_MODULE, - .attr_groups = arm_ccn_pmu_attr_groups, - .task_ctx_nr = perf_invalid_context, - .event_init = arm_ccn_pmu_event_init, -diff --git a/drivers/clk/imx/clk-imx6q.c b/drivers/clk/imx/clk-imx6q.c -index aab64205d866..a0df83e6b84b 100644 ---- a/drivers/clk/imx/clk-imx6q.c -+++ b/drivers/clk/imx/clk-imx6q.c -@@ -419,7 +419,7 @@ static void __init imx6q_clocks_init(struct device_node *ccm_node) - clk[IMX6QDL_CLK_GPU2D_CORE] = imx_clk_gate2("gpu2d_core", "gpu2d_core_podf", base + 0x6c, 24); - clk[IMX6QDL_CLK_GPU3D_CORE] = imx_clk_gate2("gpu3d_core", "gpu3d_core_podf", base + 0x6c, 26); - clk[IMX6QDL_CLK_HDMI_IAHB] = imx_clk_gate2("hdmi_iahb", "ahb", base + 0x70, 0); -- clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "video_27m", base + 0x70, 4); -+ clk[IMX6QDL_CLK_HDMI_ISFR] = imx_clk_gate2("hdmi_isfr", "mipi_core_cfg", base + 0x70, 4); - clk[IMX6QDL_CLK_I2C1] = imx_clk_gate2("i2c1", "ipg_per", base + 0x70, 6); - clk[IMX6QDL_CLK_I2C2] = imx_clk_gate2("i2c2", "ipg_per", base + 0x70, 8); - clk[IMX6QDL_CLK_I2C3] = imx_clk_gate2("i2c3", "ipg_per", base + 0x70, 10); -diff --git a/drivers/clk/mediatek/clk-mtk.h b/drivers/clk/mediatek/clk-mtk.h -index 32d2e455eb3f..8e501c219946 100644 ---- a/drivers/clk/mediatek/clk-mtk.h -+++ b/drivers/clk/mediatek/clk-mtk.h -@@ -174,6 +174,7 @@ struct mtk_pll_data { - uint32_t pcw_reg; - int pcw_shift; - const struct mtk_pll_div_table *div_table; -+ const char *parent_name; - }; - - void mtk_clk_register_plls(struct device_node *node, -diff --git a/drivers/clk/mediatek/clk-pll.c b/drivers/clk/mediatek/clk-pll.c -index 966cab1348da..1c5b081ad5a1 100644 ---- a/drivers/clk/mediatek/clk-pll.c -+++ b/drivers/clk/mediatek/clk-pll.c -@@ -302,7 +302,10 @@ static struct clk *mtk_clk_register_pll(const struct mtk_pll_data *data, - - init.name = data->name; - init.ops = &mtk_pll_ops; -- init.parent_names = &parent_name; -+ if (data->parent_name) -+ init.parent_names = &data->parent_name; -+ else -+ init.parent_names = &parent_name; - init.num_parents = 1; - - clk = clk_register(NULL, &pll->hw); -diff --git a/drivers/clk/tegra/clk-tegra30.c b/drivers/clk/tegra/clk-tegra30.c -index b90db615c29e..8c41c6fcb9ee 100644 ---- a/drivers/clk/tegra/clk-tegra30.c -+++ b/drivers/clk/tegra/clk-tegra30.c -@@ -1063,7 +1063,7 @@ static void __init tegra30_super_clk_init(void) - * U71 divider of cclk_lp. - */ - clk = tegra_clk_register_divider("pll_p_out3_cclklp", "pll_p_out3", -- clk_base + SUPER_CCLKG_DIVIDER, 0, -+ clk_base + SUPER_CCLKLP_DIVIDER, 0, - TEGRA_DIVIDER_INT, 16, 8, 1, NULL); - clk_register_clkdev(clk, "pll_p_out3_cclklp", NULL); - -diff --git a/drivers/dma/dmaengine.c b/drivers/dma/dmaengine.c -index 3ecec1445adf..8b9e28f1e3f5 100644 ---- a/drivers/dma/dmaengine.c -+++ b/drivers/dma/dmaengine.c -@@ -1023,12 +1023,14 @@ static struct dmaengine_unmap_pool *__get_unmap_pool(int nr) - switch (order) { - case 0 ... 1: - return &unmap_pool[0]; -+#if IS_ENABLED(CONFIG_DMA_ENGINE_RAID) - case 2 ... 4: - return &unmap_pool[1]; - case 5 ... 7: - return &unmap_pool[2]; - case 8: - return &unmap_pool[3]; -+#endif - default: - BUG(); - return NULL; -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index 1c7568c0055a..7254c20007f8 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -148,6 +148,12 @@ MODULE_PARM_DESC(run, "Run the test (default: false)"); - #define PATTERN_OVERWRITE 0x20 - #define PATTERN_COUNT_MASK 0x1f - -+/* poor man's completion - we want to use wait_event_freezable() on it */ -+struct dmatest_done { -+ bool done; -+ wait_queue_head_t *wait; -+}; -+ - struct dmatest_thread { - struct list_head node; - struct dmatest_info *info; -@@ -156,6 +162,8 @@ struct dmatest_thread { - u8 **srcs; - u8 **dsts; - enum dma_transaction_type type; -+ wait_queue_head_t done_wait; -+ struct dmatest_done test_done; - bool done; - }; - -@@ -347,19 +347,23 @@ static unsigned int dmatest_verify(u8 **bufs, unsigned int start, - return error_count; - } - --/* poor man's completion - we want to use wait_event_freezable() on it */ --struct dmatest_done { -- bool done; -- wait_queue_head_t *wait; --}; -- - static void dmatest_callback(void *arg) - { - struct dmatest_done *done = arg; -- -- if (done) { -+ struct dmatest_thread *thread = -+ container_of(arg, struct dmatest_thread, done_wait); -+ if (!thread->done) { - done->done = true; - wake_up_all(done->wait); -+ } else { -+ /* -+ * If thread->done, it means that this callback occurred -+ * after the parent thread has cleaned up. This can -+ * happen in the case that driver doesn't implement -+ * the terminate_all() functionality and a dma operation -+ * did not occur within the timeout period -+ */ -+ WARN(1, "dmatest: Kernel memory may be corrupted!!\n"); - } - } - -@@ -398,9 +413,8 @@ static unsigned long long dmatest_KBs(s64 runtime, unsigned long long len) - */ - static int dmatest_func(void *data) - { -- DECLARE_WAIT_QUEUE_HEAD_ONSTACK(done_wait); - struct dmatest_thread *thread = data; -- struct dmatest_done done = { .wait = &done_wait }; -+ struct dmatest_done *done = &thread->test_done; - struct dmatest_info *info; - struct dmatest_params *params; - struct dma_chan *chan; -@@ -605,9 +619,9 @@ static int dmatest_func(void *data) - continue; - } - -- done.done = false; -+ done->done = false; - tx->callback = dmatest_callback; -- tx->callback_param = &done; -+ tx->callback_param = done; - cookie = tx->tx_submit(tx); - - if (dma_submit_error(cookie)) { -@@ -620,21 +634,12 @@ static int dmatest_func(void *data) - } - dma_async_issue_pending(chan); - -- wait_event_freezable_timeout(done_wait, done.done, -+ wait_event_freezable_timeout(thread->done_wait, done->done, - msecs_to_jiffies(params->timeout)); - - status = dma_async_is_tx_complete(chan, cookie, NULL, NULL); - -- if (!done.done) { -- /* -- * We're leaving the timed out dma operation with -- * dangling pointer to done_wait. To make this -- * correct, we'll need to allocate wait_done for -- * each test iteration and perform "who's gonna -- * free it this time?" dancing. For now, just -- * leave it dangling. -- */ -- WARN(1, "dmatest: Kernel stack may be corrupted!!\n"); -+ if (!done->done) { - dmaengine_unmap_put(um); - result("test timed out", total_tests, src_off, dst_off, - len, 0); -@@ -708,7 +713,7 @@ err_thread_type: - dmatest_KBs(runtime, total_len), ret); - - /* terminate all transfers on specified channels */ -- if (ret) -+ if (ret || failed_tests) - dmaengine_terminate_all(chan); - - thread->done = true; -@@ -766,6 +771,8 @@ static int dmatest_add_threads(struct dmatest_info *info, - thread->info = info; - thread->chan = dtc->chan; - thread->type = type; -+ thread->test_done.wait = &thread->done_wait; -+ init_waitqueue_head(&thread->done_wait); - smp_wmb(); - thread->task = kthread_create(dmatest_func, thread, "%s-%s%u", - dma_chan_name(chan), op, i); -diff --git a/drivers/dma/ti-dma-crossbar.c b/drivers/dma/ti-dma-crossbar.c -index 149ec2bd9bc6..8100ede095d5 100644 ---- a/drivers/dma/ti-dma-crossbar.c -+++ b/drivers/dma/ti-dma-crossbar.c -@@ -46,12 +46,12 @@ struct ti_am335x_xbar_data { - - struct ti_am335x_xbar_map { - u16 dma_line; -- u16 mux_val; -+ u8 mux_val; - }; - --static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u16 val) -+static inline void ti_am335x_xbar_write(void __iomem *iomem, int event, u8 val) - { -- writeb_relaxed(val & 0x1f, iomem + event); -+ writeb_relaxed(val, iomem + event); - } - - static void ti_am335x_xbar_free(struct device *dev, void *route_data) -@@ -102,7 +102,7 @@ static void *ti_am335x_xbar_route_allocate(struct of_phandle_args *dma_spec, - } - - map->dma_line = (u16)dma_spec->args[0]; -- map->mux_val = (u16)dma_spec->args[2]; -+ map->mux_val = (u8)dma_spec->args[2]; - - dma_spec->args[2] = 0; - dma_spec->args_count = 2; -diff --git a/drivers/firmware/efi/efi.c b/drivers/firmware/efi/efi.c -index 78fe416126d1..ef467ae6dc40 100644 ---- a/drivers/firmware/efi/efi.c -+++ b/drivers/firmware/efi/efi.c -@@ -310,7 +310,6 @@ int __init efi_mem_desc_lookup(u64 phys_addr, efi_memory_desc_t *out_md) - - early_memunmap(md, sizeof (*md)); - } -- pr_err_once("requested map not found.\n"); - return -ENOENT; - } - -diff --git a/drivers/firmware/efi/esrt.c b/drivers/firmware/efi/esrt.c -index 0ca4c34f9441..341b8c686ec7 100644 ---- a/drivers/firmware/efi/esrt.c -+++ b/drivers/firmware/efi/esrt.c -@@ -253,7 +253,7 @@ void __init efi_esrt_init(void) - - rc = efi_mem_desc_lookup(efi.esrt, &md); - if (rc < 0) { -- pr_err("ESRT header is not in the memory map.\n"); -+ pr_warn("ESRT header is not in the memory map.\n"); - return; - } - -diff --git a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c -index 27c297672076..d2d1c9a34da1 100644 ---- a/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c -+++ b/drivers/gpu/drm/omapdrm/omap_gem_dmabuf.c -@@ -142,9 +142,6 @@ static int omap_gem_dmabuf_mmap(struct dma_buf *buffer, - struct drm_gem_object *obj = buffer->priv; - int ret = 0; - -- if (WARN_ON(!obj->filp)) -- return -EINVAL; -- - ret = drm_gem_mmap_obj(obj, omap_gem_mmap_size(obj), vma); - if (ret < 0) - return ret; -diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c -index b6f16804e73b..d9007cc37be1 100644 ---- a/drivers/gpu/drm/radeon/si_dpm.c -+++ b/drivers/gpu/drm/radeon/si_dpm.c -@@ -3029,6 +3029,16 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, - max_sclk = 75000; - max_mclk = 80000; - } -+ } else if (rdev->family == CHIP_OLAND) { -+ if ((rdev->pdev->revision == 0xC7) || -+ (rdev->pdev->revision == 0x80) || -+ (rdev->pdev->revision == 0x81) || -+ (rdev->pdev->revision == 0x83) || -+ (rdev->pdev->revision == 0x87) || -+ (rdev->pdev->device == 0x6604) || -+ (rdev->pdev->device == 0x6605)) { -+ max_sclk = 75000; -+ } - } - /* Apply dpm quirks */ - while (p && p->chip_device != 0) { -diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c -index 32c6a40a408f..ea85330603b2 100644 ---- a/drivers/hwtracing/intel_th/pci.c -+++ b/drivers/hwtracing/intel_th/pci.c -@@ -82,6 +82,11 @@ static const struct pci_device_id intel_th_pci_id_table[] = { - PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x9da6), - .driver_data = (kernel_ulong_t)0, - }, -+ { -+ /* Gemini Lake */ -+ PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x318e), -+ .driver_data = (kernel_ulong_t)0, -+ }, - { 0 }, - }; - -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index 43d5166db4c6..e354358db77b 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -1353,7 +1353,7 @@ static struct rdma_id_private *cma_id_from_event(struct ib_cm_id *cm_id, - return id_priv; - } - --static inline int cma_user_data_offset(struct rdma_id_private *id_priv) -+static inline u8 cma_user_data_offset(struct rdma_id_private *id_priv) - { - return cma_family(id_priv) == AF_IB ? 0 : sizeof(struct cma_hdr); - } -@@ -1731,7 +1731,8 @@ static int cma_req_handler(struct ib_cm_id *cm_id, struct ib_cm_event *ib_event) - struct rdma_id_private *listen_id, *conn_id; - struct rdma_cm_event event; - struct net_device *net_dev; -- int offset, ret; -+ u8 offset; -+ int ret; - - listen_id = cma_id_from_event(cm_id, ib_event, &net_dev); - if (IS_ERR(listen_id)) -@@ -3118,7 +3119,8 @@ static int cma_resolve_ib_udp(struct rdma_id_private *id_priv, - struct ib_cm_sidr_req_param req; - struct ib_cm_id *id; - void *private_data; -- int offset, ret; -+ u8 offset; -+ int ret; - - memset(&req, 0, sizeof req); - offset = cma_user_data_offset(id_priv); -@@ -3175,7 +3177,8 @@ static int cma_connect_ib(struct rdma_id_private *id_priv, - struct rdma_route *route; - void *private_data; - struct ib_cm_id *id; -- int offset, ret; -+ u8 offset; -+ int ret; - - memset(&req, 0, sizeof req); - offset = cma_user_data_offset(id_priv); -diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c -index 8f8c3af9f4e8..d3f0a384faad 100644 ---- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c -+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c -@@ -1044,10 +1044,15 @@ static void __ipoib_ib_dev_flush(struct ipoib_dev_priv *priv, - ipoib_ib_dev_down(dev); - - if (level == IPOIB_FLUSH_HEAVY) { -+ rtnl_lock(); - if (test_bit(IPOIB_FLAG_INITIALIZED, &priv->flags)) - ipoib_ib_dev_stop(dev); -- if (ipoib_ib_dev_open(dev) != 0) -+ -+ result = ipoib_ib_dev_open(dev); -+ rtnl_unlock(); -+ if (result) - return; -+ - if (netif_queue_stopped(dev)) - netif_start_queue(dev); - } -diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h -index dbf09836ff30..d1051e3ce819 100644 ---- a/drivers/input/serio/i8042-x86ia64io.h -+++ b/drivers/input/serio/i8042-x86ia64io.h -@@ -520,6 +520,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = { - DMI_MATCH(DMI_PRODUCT_NAME, "IC4I"), - }, - }, -+ { -+ /* TUXEDO BU1406 */ -+ .matches = { -+ DMI_MATCH(DMI_SYS_VENDOR, "Notebook"), -+ DMI_MATCH(DMI_PRODUCT_NAME, "N24_25BU"), -+ }, -+ }, - { } - }; - -diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c -index 525ce56524ba..e73aeb0e892c 100644 ---- a/drivers/md/bcache/request.c -+++ b/drivers/md/bcache/request.c -@@ -468,6 +468,7 @@ struct search { - unsigned recoverable:1; - unsigned write:1; - unsigned read_dirty_data:1; -+ unsigned cache_missed:1; - - unsigned long start_time; - -@@ -653,6 +654,7 @@ static inline struct search *search_alloc(struct bio *bio, - - s->orig_bio = bio; - s->cache_miss = NULL; -+ s->cache_missed = 0; - s->d = d; - s->recoverable = 1; - s->write = (bio->bi_rw & REQ_WRITE) != 0; -@@ -776,7 +778,7 @@ static void cached_dev_read_done_bh(struct closure *cl) - struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); - - bch_mark_cache_accounting(s->iop.c, s->d, -- !s->cache_miss, s->iop.bypass); -+ !s->cache_missed, s->iop.bypass); - trace_bcache_read(s->orig_bio, !s->cache_miss, s->iop.bypass); - - if (s->iop.error) -@@ -795,6 +797,8 @@ static int cached_dev_cache_miss(struct btree *b, struct search *s, - struct cached_dev *dc = container_of(s->d, struct cached_dev, disk); - struct bio *miss, *cache_bio; - -+ s->cache_missed = 1; -+ - if (s->cache_miss || s->iop.bypass) { - miss = bio_next_split(bio, sectors, GFP_NOIO, s->d->bio_split); - ret = miss == bio ? MAP_DONE : MAP_CONTINUE; -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index c5ceea9222ff..8eaadd9869bc 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -2083,6 +2083,7 @@ static void bcache_exit(void) - if (bcache_major) - unregister_blkdev(bcache_major, "bcache"); - unregister_reboot_notifier(&reboot); -+ mutex_destroy(&bch_register_lock); - } - - static int __init bcache_init(void) -@@ -2101,14 +2102,15 @@ static int __init bcache_init(void) - bcache_major = register_blkdev(0, "bcache"); - if (bcache_major < 0) { - unregister_reboot_notifier(&reboot); -+ mutex_destroy(&bch_register_lock); - return bcache_major; - } - - if (!(bcache_wq = create_workqueue("bcache")) || - !(bcache_kobj = kobject_create_and_add("bcache", fs_kobj)) || -- sysfs_create_files(bcache_kobj, files) || - bch_request_init() || -- bch_debug_init(bcache_kobj)) -+ bch_debug_init(bcache_kobj) || -+ sysfs_create_files(bcache_kobj, files)) - goto err; - - return 0; -diff --git a/drivers/md/md-cluster.c b/drivers/md/md-cluster.c -index d6a1126d85ce..494d01d0e92a 100644 ---- a/drivers/md/md-cluster.c -+++ b/drivers/md/md-cluster.c -@@ -821,6 +821,7 @@ static int leave(struct mddev *mddev) - lockres_free(cinfo->no_new_dev_lockres); - lockres_free(cinfo->bitmap_lockres); - dlm_release_lockspace(cinfo->lockspace, 2); -+ kfree(cinfo); - return 0; - } - -diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c -index d55bf85b76ce..86ab6d14d782 100644 ---- a/drivers/md/raid5.c -+++ b/drivers/md/raid5.c -@@ -1681,8 +1681,11 @@ static void ops_complete_reconstruct(void *stripe_head_ref) - struct r5dev *dev = &sh->dev[i]; - - if (dev->written || i == pd_idx || i == qd_idx) { -- if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) -+ if (!discard && !test_bit(R5_SkipCopy, &dev->flags)) { - set_bit(R5_UPTODATE, &dev->flags); -+ if (test_bit(STRIPE_EXPAND_READY, &sh->state)) -+ set_bit(R5_Expanded, &dev->flags); -+ } - if (fua) - set_bit(R5_WantFUA, &dev->flags); - if (sync) -diff --git a/drivers/mmc/host/mtk-sd.c b/drivers/mmc/host/mtk-sd.c -index 33dfd7e72516..0bf0d0e9dbdb 100644 ---- a/drivers/mmc/host/mtk-sd.c -+++ b/drivers/mmc/host/mtk-sd.c -@@ -570,7 +570,7 @@ static void msdc_set_mclk(struct msdc_host *host, unsigned char timing, u32 hz) - } - } - sdr_set_field(host->base + MSDC_CFG, MSDC_CFG_CKMOD | MSDC_CFG_CKDIV, -- (mode << 8) | (div % 0xff)); -+ (mode << 8) | div); - sdr_set_bits(host->base + MSDC_CFG, MSDC_CFG_CKPDN); - while (!(readl(host->base + MSDC_CFG) & MSDC_CFG_CKSTB)) - cpu_relax(); -@@ -1540,7 +1540,7 @@ static int msdc_drv_probe(struct platform_device *pdev) - host->src_clk_freq = clk_get_rate(host->src_clk); - /* Set host parameters to mmc */ - mmc->ops = &mt_msdc_ops; -- mmc->f_min = host->src_clk_freq / (4 * 255); -+ mmc->f_min = DIV_ROUND_UP(host->src_clk_freq, 4 * 255); - - mmc->caps |= MMC_CAP_ERASE | MMC_CAP_CMD23; - mmc->caps |= MMC_CAP_RUNTIME_RESUME; -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -index f971d92f7b41..74dd48f2bd89 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c -@@ -1,7 +1,7 @@ - /* - * Broadcom GENET (Gigabit Ethernet) controller driver - * -- * Copyright (c) 2014 Broadcom Corporation -+ * Copyright (c) 2014-2017 Broadcom - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -778,8 +778,9 @@ static const struct bcmgenet_stats bcmgenet_gstrings_stats[] = { - STAT_GENET_RUNT("rx_runt_bytes", mib.rx_runt_bytes), - /* Misc UniMAC counters */ - STAT_GENET_MISC("rbuf_ovflow_cnt", mib.rbuf_ovflow_cnt, -- UMAC_RBUF_OVFL_CNT), -- STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, UMAC_RBUF_ERR_CNT), -+ UMAC_RBUF_OVFL_CNT_V1), -+ STAT_GENET_MISC("rbuf_err_cnt", mib.rbuf_err_cnt, -+ UMAC_RBUF_ERR_CNT_V1), - STAT_GENET_MISC("mdf_err_cnt", mib.mdf_err_cnt, UMAC_MDF_ERR_CNT), - STAT_GENET_SOFT_MIB("alloc_rx_buff_failed", mib.alloc_rx_buff_failed), - STAT_GENET_SOFT_MIB("rx_dma_failed", mib.rx_dma_failed), -@@ -821,6 +822,45 @@ static void bcmgenet_get_strings(struct net_device *dev, u32 stringset, - } - } - -+static u32 bcmgenet_update_stat_misc(struct bcmgenet_priv *priv, u16 offset) -+{ -+ u16 new_offset; -+ u32 val; -+ -+ switch (offset) { -+ case UMAC_RBUF_OVFL_CNT_V1: -+ if (GENET_IS_V2(priv)) -+ new_offset = RBUF_OVFL_CNT_V2; -+ else -+ new_offset = RBUF_OVFL_CNT_V3PLUS; -+ -+ val = bcmgenet_rbuf_readl(priv, new_offset); -+ /* clear if overflowed */ -+ if (val == ~0) -+ bcmgenet_rbuf_writel(priv, 0, new_offset); -+ break; -+ case UMAC_RBUF_ERR_CNT_V1: -+ if (GENET_IS_V2(priv)) -+ new_offset = RBUF_ERR_CNT_V2; -+ else -+ new_offset = RBUF_ERR_CNT_V3PLUS; -+ -+ val = bcmgenet_rbuf_readl(priv, new_offset); -+ /* clear if overflowed */ -+ if (val == ~0) -+ bcmgenet_rbuf_writel(priv, 0, new_offset); -+ break; -+ default: -+ val = bcmgenet_umac_readl(priv, offset); -+ /* clear if overflowed */ -+ if (val == ~0) -+ bcmgenet_umac_writel(priv, 0, offset); -+ break; -+ } -+ -+ return val; -+} -+ - static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) - { - int i, j = 0; -@@ -836,19 +876,28 @@ static void bcmgenet_update_mib_counters(struct bcmgenet_priv *priv) - case BCMGENET_STAT_NETDEV: - case BCMGENET_STAT_SOFT: - continue; -- case BCMGENET_STAT_MIB_RX: -- case BCMGENET_STAT_MIB_TX: - case BCMGENET_STAT_RUNT: -- if (s->type != BCMGENET_STAT_MIB_RX) -- offset = BCMGENET_STAT_OFFSET; -+ offset += BCMGENET_STAT_OFFSET; -+ /* fall through */ -+ case BCMGENET_STAT_MIB_TX: -+ offset += BCMGENET_STAT_OFFSET; -+ /* fall through */ -+ case BCMGENET_STAT_MIB_RX: - val = bcmgenet_umac_readl(priv, - UMAC_MIB_START + j + offset); -+ offset = 0; /* Reset Offset */ - break; - case BCMGENET_STAT_MISC: -- val = bcmgenet_umac_readl(priv, s->reg_offset); -- /* clear if overflowed */ -- if (val == ~0) -- bcmgenet_umac_writel(priv, 0, s->reg_offset); -+ if (GENET_IS_V1(priv)) { -+ val = bcmgenet_umac_readl(priv, s->reg_offset); -+ /* clear if overflowed */ -+ if (val == ~0) -+ bcmgenet_umac_writel(priv, 0, -+ s->reg_offset); -+ } else { -+ val = bcmgenet_update_stat_misc(priv, -+ s->reg_offset); -+ } - break; - } - -@@ -2901,6 +2950,8 @@ err_irq0: - err_fini_dma: - bcmgenet_fini_dma(priv); - err_clk_disable: -+ if (priv->internal_phy) -+ bcmgenet_power_down(priv, GENET_POWER_PASSIVE); - clk_disable_unprepare(priv->clk); - return ret; - } -@@ -3277,6 +3328,12 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) - */ - gphy_rev = reg & 0xffff; - -+ /* This is reserved so should require special treatment */ -+ if (gphy_rev == 0 || gphy_rev == 0x01ff) { -+ pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); -+ return; -+ } -+ - /* This is the good old scheme, just GPHY major, no minor nor patch */ - if ((gphy_rev & 0xf0) != 0) - priv->gphy_rev = gphy_rev << 8; -@@ -3285,12 +3342,6 @@ static void bcmgenet_set_hw_params(struct bcmgenet_priv *priv) - else if ((gphy_rev & 0xff00) != 0) - priv->gphy_rev = gphy_rev; - -- /* This is reserved so should require special treatment */ -- else if (gphy_rev == 0 || gphy_rev == 0x01ff) { -- pr_warn("Invalid GPHY revision detected: 0x%04x\n", gphy_rev); -- return; -- } -- - #ifdef CONFIG_PHYS_ADDR_T_64BIT - if (!(params->flags & GENET_HAS_40BITS)) - pr_warn("GENET does not support 40-bits PA\n"); -@@ -3333,6 +3384,7 @@ static int bcmgenet_probe(struct platform_device *pdev) - const void *macaddr; - struct resource *r; - int err = -EIO; -+ const char *phy_mode_str; - - /* Up to GENET_MAX_MQ_CNT + 1 TX queues and RX queues */ - dev = alloc_etherdev_mqs(sizeof(*priv), GENET_MAX_MQ_CNT + 1, -@@ -3438,6 +3490,13 @@ static int bcmgenet_probe(struct platform_device *pdev) - priv->clk_eee = NULL; - } - -+ /* If this is an internal GPHY, power it on now, before UniMAC is -+ * brought out of reset as absolutely no UniMAC activity is allowed -+ */ -+ if (dn && !of_property_read_string(dn, "phy-mode", &phy_mode_str) && -+ !strcasecmp(phy_mode_str, "internal")) -+ bcmgenet_power_up(priv, GENET_POWER_PASSIVE); -+ - err = reset_umac(priv); - if (err) - goto err_clk_disable; -@@ -3604,6 +3663,8 @@ static int bcmgenet_resume(struct device *d) - return 0; - - out_clk_disable: -+ if (priv->internal_phy) -+ bcmgenet_power_down(priv, GENET_POWER_PASSIVE); - clk_disable_unprepare(priv->clk); - return ret; - } -diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -index 967367557309..cef53f2d9854 100644 ---- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h -+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h -@@ -1,5 +1,5 @@ - /* -- * Copyright (c) 2014 Broadcom Corporation -+ * Copyright (c) 2014-2017 Broadcom - * - * This program is free software; you can redistribute it and/or modify - * it under the terms of the GNU General Public License version 2 as -@@ -214,7 +214,9 @@ struct bcmgenet_mib_counters { - #define MDIO_REG_SHIFT 16 - #define MDIO_REG_MASK 0x1F - --#define UMAC_RBUF_OVFL_CNT 0x61C -+#define UMAC_RBUF_OVFL_CNT_V1 0x61C -+#define RBUF_OVFL_CNT_V2 0x80 -+#define RBUF_OVFL_CNT_V3PLUS 0x94 - - #define UMAC_MPD_CTRL 0x620 - #define MPD_EN (1 << 0) -@@ -224,7 +226,9 @@ struct bcmgenet_mib_counters { - - #define UMAC_MPD_PW_MS 0x624 - #define UMAC_MPD_PW_LS 0x628 --#define UMAC_RBUF_ERR_CNT 0x634 -+#define UMAC_RBUF_ERR_CNT_V1 0x634 -+#define RBUF_ERR_CNT_V2 0x84 -+#define RBUF_ERR_CNT_V3PLUS 0x98 - #define UMAC_MDF_ERR_CNT 0x638 - #define UMAC_MDF_CTRL 0x650 - #define UMAC_MDF_ADDR 0x654 -diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c -index d48d5793407d..fc222df47aa9 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/cmd.c -+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c -@@ -2278,6 +2278,17 @@ static int sync_toggles(struct mlx4_dev *dev) - rd_toggle = swab32(readl(&priv->mfunc.comm->slave_read)); - if (wr_toggle == 0xffffffff || rd_toggle == 0xffffffff) { - /* PCI might be offline */ -+ -+ /* If device removal has been requested, -+ * do not continue retrying. -+ */ -+ if (dev->persist->interface_state & -+ MLX4_INTERFACE_STATE_NOWAIT) { -+ mlx4_warn(dev, -+ "communication channel is offline\n"); -+ return -EIO; -+ } -+ - msleep(100); - wr_toggle = swab32(readl(&priv->mfunc.comm-> - slave_write)); -diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c -index 99361352ed0d..a7d3144c2388 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/main.c -+++ b/drivers/net/ethernet/mellanox/mlx4/main.c -@@ -1763,6 +1763,14 @@ static int mlx4_comm_check_offline(struct mlx4_dev *dev) - (u32)(1 << COMM_CHAN_OFFLINE_OFFSET)); - if (!offline_bit) - return 0; -+ -+ /* If device removal has been requested, -+ * do not continue retrying. -+ */ -+ if (dev->persist->interface_state & -+ MLX4_INTERFACE_STATE_NOWAIT) -+ break; -+ - /* There are cases as part of AER/Reset flow that PF needs - * around 100 msec to load. We therefore sleep for 100 msec - * to allow other tasks to make use of that CPU during this -@@ -3690,6 +3698,9 @@ static void mlx4_remove_one(struct pci_dev *pdev) - struct mlx4_priv *priv = mlx4_priv(dev); - int active_vfs = 0; - -+ if (mlx4_is_slave(dev)) -+ persist->interface_state |= MLX4_INTERFACE_STATE_NOWAIT; -+ - mutex_lock(&persist->interface_state_mutex); - persist->interface_state |= MLX4_INTERFACE_STATE_DELETION; - mutex_unlock(&persist->interface_state_mutex); -diff --git a/drivers/net/ethernet/mellanox/mlxsw/reg.h b/drivers/net/ethernet/mellanox/mlxsw/reg.h -index 236fb5d2ad69..c7fe61f1f89f 100644 ---- a/drivers/net/ethernet/mellanox/mlxsw/reg.h -+++ b/drivers/net/ethernet/mellanox/mlxsw/reg.h -@@ -599,7 +599,7 @@ static inline void mlxsw_reg_spvid_pack(char *payload, u8 local_port, u16 pvid) - #define MLXSW_REG_SPVM_ID 0x200F - #define MLXSW_REG_SPVM_BASE_LEN 0x04 /* base length, without records */ - #define MLXSW_REG_SPVM_REC_LEN 0x04 /* record length */ --#define MLXSW_REG_SPVM_REC_MAX_COUNT 256 -+#define MLXSW_REG_SPVM_REC_MAX_COUNT 255 - #define MLXSW_REG_SPVM_LEN (MLXSW_REG_SPVM_BASE_LEN + \ - MLXSW_REG_SPVM_REC_LEN * MLXSW_REG_SPVM_REC_MAX_COUNT) - -@@ -1139,7 +1139,7 @@ static inline void mlxsw_reg_sfmr_pack(char *payload, - #define MLXSW_REG_SPVMLR_ID 0x2020 - #define MLXSW_REG_SPVMLR_BASE_LEN 0x04 /* base length, without records */ - #define MLXSW_REG_SPVMLR_REC_LEN 0x04 /* record length */ --#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 256 -+#define MLXSW_REG_SPVMLR_REC_MAX_COUNT 255 - #define MLXSW_REG_SPVMLR_LEN (MLXSW_REG_SPVMLR_BASE_LEN + \ - MLXSW_REG_SPVMLR_REC_LEN * \ - MLXSW_REG_SPVMLR_REC_MAX_COUNT) -diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c -index cbe9a330117a..063aca17e698 100644 ---- a/drivers/net/ethernet/sfc/ef10.c -+++ b/drivers/net/ethernet/sfc/ef10.c -@@ -4307,7 +4307,7 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx) - * MCFW do not support VFs. - */ - rc = efx_ef10_vport_set_mac_address(efx); -- } else { -+ } else if (rc) { - efx_mcdi_display_error(efx, MC_CMD_VADAPTOR_SET_MAC, - sizeof(inbuf), NULL, 0, rc); - } -diff --git a/drivers/net/fjes/fjes_main.c b/drivers/net/fjes/fjes_main.c -index 0ddb54fe3d91..a539e831b4b1 100644 ---- a/drivers/net/fjes/fjes_main.c -+++ b/drivers/net/fjes/fjes_main.c -@@ -1205,7 +1205,7 @@ static void fjes_netdev_setup(struct net_device *netdev) - fjes_set_ethtool_ops(netdev); - netdev->mtu = fjes_support_mtu[0]; - netdev->flags |= IFF_BROADCAST; -- netdev->features |= NETIF_F_HW_CSUM | NETIF_F_HW_VLAN_CTAG_FILTER; -+ netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; - } - - static void fjes_irq_watch_task(struct work_struct *work) -diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c -index 40cd86614677..9897cabec371 100644 ---- a/drivers/net/macvlan.c -+++ b/drivers/net/macvlan.c -@@ -441,7 +441,7 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb) - struct macvlan_dev, list); - else - vlan = macvlan_hash_lookup(port, eth->h_dest); -- if (vlan == NULL) -+ if (!vlan || vlan->mode == MACVLAN_MODE_SOURCE) - return RX_HANDLER_PASS; - - dev = vlan->dev; -diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c -index dc454138d600..e2decf71c6d1 100644 ---- a/drivers/net/ppp/ppp_generic.c -+++ b/drivers/net/ppp/ppp_generic.c -@@ -942,6 +942,7 @@ static __net_exit void ppp_exit_net(struct net *net) - unregister_netdevice_many(&list); - rtnl_unlock(); - -+ mutex_destroy(&pn->all_ppp_mutex); - idr_destroy(&pn->units_idr); - } - -diff --git a/drivers/net/wimax/i2400m/usb.c b/drivers/net/wimax/i2400m/usb.c -index e7f5910a6519..f8eb66ef2944 100644 ---- a/drivers/net/wimax/i2400m/usb.c -+++ b/drivers/net/wimax/i2400m/usb.c -@@ -467,6 +467,9 @@ int i2400mu_probe(struct usb_interface *iface, - struct i2400mu *i2400mu; - struct usb_device *usb_dev = interface_to_usbdev(iface); - -+ if (iface->cur_altsetting->desc.bNumEndpoints < 4) -+ return -ENODEV; -+ - if (usb_dev->speed != USB_SPEED_HIGH) - dev_err(dev, "device not connected as high speed\n"); - -diff --git a/drivers/net/wireless/ath/ath9k/tx99.c b/drivers/net/wireless/ath/ath9k/tx99.c -index b4e6304afd40..7ee1a3183a06 100644 ---- a/drivers/net/wireless/ath/ath9k/tx99.c -+++ b/drivers/net/wireless/ath/ath9k/tx99.c -@@ -180,6 +180,9 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, - ssize_t len; - int r; - -+ if (count < 1) -+ return -EINVAL; -+ - if (sc->cur_chan->nvifs > 1) - return -EOPNOTSUPP; - -@@ -187,6 +190,8 @@ static ssize_t write_file_tx99(struct file *file, const char __user *user_buf, - if (copy_from_user(buf, user_buf, len)) - return -EFAULT; - -+ buf[len] = '\0'; -+ - if (strtobool(buf, &start)) - return -EINVAL; - -diff --git a/drivers/pci/pcie/pme.c b/drivers/pci/pcie/pme.c -index 63fc63911295..deb903112974 100644 ---- a/drivers/pci/pcie/pme.c -+++ b/drivers/pci/pcie/pme.c -@@ -233,6 +233,9 @@ static void pcie_pme_work_fn(struct work_struct *work) - break; - - pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); -+ if (rtsta == (u32) ~0) -+ break; -+ - if (rtsta & PCI_EXP_RTSTA_PME) { - /* - * Clear PME status of the port. If there are other -@@ -280,7 +283,7 @@ static irqreturn_t pcie_pme_irq(int irq, void *context) - spin_lock_irqsave(&data->lock, flags); - pcie_capability_read_dword(port, PCI_EXP_RTSTA, &rtsta); - -- if (!(rtsta & PCI_EXP_RTSTA_PME)) { -+ if (rtsta == (u32) ~0 || !(rtsta & PCI_EXP_RTSTA_PME)) { - spin_unlock_irqrestore(&data->lock, flags); - return IRQ_NONE; - } -diff --git a/drivers/pci/remove.c b/drivers/pci/remove.c -index 8a280e9c2ad1..7e67af2bb366 100644 ---- a/drivers/pci/remove.c -+++ b/drivers/pci/remove.c -@@ -20,9 +20,9 @@ static void pci_stop_dev(struct pci_dev *dev) - pci_pme_active(dev, false); - - if (dev->is_added) { -+ device_release_driver(&dev->dev); - pci_proc_detach_device(dev); - pci_remove_sysfs_dev_files(dev); -- device_release_driver(&dev->dev); - dev->is_added = 0; - } - -diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig -index 312c78b27a32..073b6d1e5efa 100644 ---- a/drivers/pinctrl/Kconfig -+++ b/drivers/pinctrl/Kconfig -@@ -26,7 +26,8 @@ config DEBUG_PINCTRL - - config PINCTRL_ADI2 - bool "ADI pin controller driver" -- depends on BLACKFIN -+ depends on (BF54x || BF60x) -+ depends on !GPIO_ADI - select PINMUX - select IRQ_DOMAIN - help -diff --git a/drivers/rtc/rtc-pcf8563.c b/drivers/rtc/rtc-pcf8563.c -index c8f95b8e463a..45b5a3d47ccf 100644 ---- a/drivers/rtc/rtc-pcf8563.c -+++ b/drivers/rtc/rtc-pcf8563.c -@@ -427,7 +427,7 @@ static unsigned long pcf8563_clkout_recalc_rate(struct clk_hw *hw, - return 0; - - buf &= PCF8563_REG_CLKO_F_MASK; -- return clkout_rates[ret]; -+ return clkout_rates[buf]; - } - - static long pcf8563_clkout_round_rate(struct clk_hw *hw, unsigned long rate, -diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c -index 74a307c0a240..8f1c58d4d5b5 100644 ---- a/drivers/scsi/bfa/bfad_debugfs.c -+++ b/drivers/scsi/bfa/bfad_debugfs.c -@@ -254,7 +254,8 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, - struct bfad_s *bfad = port->bfad; - struct bfa_s *bfa = &bfad->bfa; - struct bfa_ioc_s *ioc = &bfa->ioc; -- int addr, len, rc, i; -+ int addr, rc, i; -+ u32 len; - u32 *regbuf; - void __iomem *rb, *reg_addr; - unsigned long flags; -@@ -265,7 +266,7 @@ bfad_debugfs_write_regrd(struct file *file, const char __user *buf, - return PTR_ERR(kern_buf); - - rc = sscanf(kern_buf, "%x:%x", &addr, &len); -- if (rc < 2) { -+ if (rc < 2 || len > (UINT_MAX >> 2)) { - printk(KERN_INFO - "bfad[%d]: %s failed to read user buf\n", - bfad->inst_no, __func__); -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index e9ce74afd13f..0c87f341fed4 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -3466,7 +3466,7 @@ exit_failed: - * # (integer code indicating one of several NOT READY states - * describing why a volume is to be kept offline) - */ --static int hpsa_volume_offline(struct ctlr_info *h, -+static unsigned char hpsa_volume_offline(struct ctlr_info *h, - unsigned char scsi3addr[]) - { - struct CommandList *c; -@@ -3486,7 +3486,7 @@ static int hpsa_volume_offline(struct ctlr_info *h, - rc = hpsa_scsi_do_simple_cmd(h, c, DEFAULT_REPLY_QUEUE, NO_TIMEOUT); - if (rc) { - cmd_free(h, c); -- return 0; -+ return HPSA_VPD_LV_STATUS_UNSUPPORTED; - } - sense = c->err_info->SenseInfo; - if (c->err_info->SenseLen > sizeof(c->err_info->SenseInfo)) -@@ -3497,19 +3497,13 @@ static int hpsa_volume_offline(struct ctlr_info *h, - cmd_status = c->err_info->CommandStatus; - scsi_status = c->err_info->ScsiStatus; - cmd_free(h, c); -- /* Is the volume 'not ready'? */ -- if (cmd_status != CMD_TARGET_STATUS || -- scsi_status != SAM_STAT_CHECK_CONDITION || -- sense_key != NOT_READY || -- asc != ASC_LUN_NOT_READY) { -- return 0; -- } - - /* Determine the reason for not ready state */ - ldstat = hpsa_get_volume_status(h, scsi3addr); - - /* Keep volume offline in certain cases: */ - switch (ldstat) { -+ case HPSA_LV_FAILED: - case HPSA_LV_UNDERGOING_ERASE: - case HPSA_LV_NOT_AVAILABLE: - case HPSA_LV_UNDERGOING_RPI: -@@ -3531,7 +3525,7 @@ static int hpsa_volume_offline(struct ctlr_info *h, - default: - break; - } -- return 0; -+ return HPSA_LV_OK; - } - - /* -@@ -3615,10 +3609,10 @@ static int hpsa_update_device_info(struct ctlr_info *h, - /* Do an inquiry to the device to see what it is. */ - if (hpsa_scsi_do_inquiry(h, scsi3addr, 0, inq_buff, - (unsigned char) OBDR_TAPE_INQ_SIZE) != 0) { -- /* Inquiry failed (msg printed already) */ - dev_err(&h->pdev->dev, -- "hpsa_update_device_info: inquiry failed\n"); -- rc = -EIO; -+ "%s: inquiry failed, device will be skipped.\n", -+ __func__); -+ rc = HPSA_INQUIRY_FAILED; - goto bail_out; - } - -@@ -3638,15 +3632,19 @@ static int hpsa_update_device_info(struct ctlr_info *h, - - if (this_device->devtype == TYPE_DISK && - is_logical_dev_addr_mode(scsi3addr)) { -- int volume_offline; -+ unsigned char volume_offline; - - hpsa_get_raid_level(h, scsi3addr, &this_device->raid_level); - if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC) - hpsa_get_ioaccel_status(h, scsi3addr, this_device); - volume_offline = hpsa_volume_offline(h, scsi3addr); -- if (volume_offline < 0 || volume_offline > 0xff) -- volume_offline = HPSA_VPD_LV_STATUS_UNSUPPORTED; -- this_device->volume_offline = volume_offline & 0xff; -+ if (volume_offline == HPSA_LV_FAILED) { -+ rc = HPSA_LV_FAILED; -+ dev_err(&h->pdev->dev, -+ "%s: LV failed, device will be skipped.\n", -+ __func__); -+ goto bail_out; -+ } - } else { - this_device->raid_level = RAID_UNKNOWN; - this_device->offload_config = 0; -@@ -4115,8 +4113,7 @@ static void hpsa_update_scsi_devices(struct ctlr_info *h) - goto out; - } - if (rc) { -- dev_warn(&h->pdev->dev, -- "Inquiry failed, skipping device.\n"); -+ h->drv_req_rescan = 1; - continue; - } - -@@ -5257,7 +5254,7 @@ static void hpsa_scan_complete(struct ctlr_info *h) - - spin_lock_irqsave(&h->scan_lock, flags); - h->scan_finished = 1; -- wake_up_all(&h->scan_wait_queue); -+ wake_up(&h->scan_wait_queue); - spin_unlock_irqrestore(&h->scan_lock, flags); - } - -@@ -5275,11 +5272,23 @@ static void hpsa_scan_start(struct Scsi_Host *sh) - if (unlikely(lockup_detected(h))) - return hpsa_scan_complete(h); - -+ /* -+ * If a scan is already waiting to run, no need to add another -+ */ -+ spin_lock_irqsave(&h->scan_lock, flags); -+ if (h->scan_waiting) { -+ spin_unlock_irqrestore(&h->scan_lock, flags); -+ return; -+ } -+ -+ spin_unlock_irqrestore(&h->scan_lock, flags); -+ - /* wait until any scan already in progress is finished. */ - while (1) { - spin_lock_irqsave(&h->scan_lock, flags); - if (h->scan_finished) - break; -+ h->scan_waiting = 1; - spin_unlock_irqrestore(&h->scan_lock, flags); - wait_event(h->scan_wait_queue, h->scan_finished); - /* Note: We don't need to worry about a race between this -@@ -5289,6 +5298,7 @@ static void hpsa_scan_start(struct Scsi_Host *sh) - */ - } - h->scan_finished = 0; /* mark scan as in progress */ -+ h->scan_waiting = 0; - spin_unlock_irqrestore(&h->scan_lock, flags); - - if (unlikely(lockup_detected(h))) -@@ -8505,6 +8515,7 @@ reinit_after_soft_reset: - init_waitqueue_head(&h->event_sync_wait_queue); - mutex_init(&h->reset_mutex); - h->scan_finished = 1; /* no scan currently in progress */ -+ h->scan_waiting = 0; - - pci_set_drvdata(pdev, h); - h->ndevices = 0; -@@ -8797,6 +8808,8 @@ static void hpsa_remove_one(struct pci_dev *pdev) - destroy_workqueue(h->rescan_ctlr_wq); - destroy_workqueue(h->resubmit_wq); - -+ hpsa_delete_sas_host(h); -+ - /* - * Call before disabling interrupts. - * scsi_remove_host can trigger I/O operations especially -@@ -8831,8 +8844,6 @@ static void hpsa_remove_one(struct pci_dev *pdev) - h->lockup_detected = NULL; /* init_one 2 */ - /* (void) pci_disable_pcie_error_reporting(pdev); */ /* init_one 1 */ - -- hpsa_delete_sas_host(h); -- - kfree(h); /* init_one 1 */ - } - -@@ -9324,9 +9335,9 @@ static void hpsa_free_sas_phy(struct hpsa_sas_phy *hpsa_sas_phy) - struct sas_phy *phy = hpsa_sas_phy->phy; - - sas_port_delete_phy(hpsa_sas_phy->parent_port->port, phy); -- sas_phy_free(phy); - if (hpsa_sas_phy->added_to_port) - list_del(&hpsa_sas_phy->phy_list_entry); -+ sas_phy_delete(phy); - kfree(hpsa_sas_phy); - } - -diff --git a/drivers/scsi/hpsa.h b/drivers/scsi/hpsa.h -index ae5beda1bdb5..0e602750487a 100644 ---- a/drivers/scsi/hpsa.h -+++ b/drivers/scsi/hpsa.h -@@ -200,6 +200,7 @@ struct ctlr_info { - dma_addr_t errinfo_pool_dhandle; - unsigned long *cmd_pool_bits; - int scan_finished; -+ u8 scan_waiting : 1; - spinlock_t scan_lock; - wait_queue_head_t scan_wait_queue; - -diff --git a/drivers/scsi/hpsa_cmd.h b/drivers/scsi/hpsa_cmd.h -index d92ef0d352b5..26488e2a7f02 100644 ---- a/drivers/scsi/hpsa_cmd.h -+++ b/drivers/scsi/hpsa_cmd.h -@@ -155,6 +155,7 @@ - #define CFGTBL_BusType_Fibre2G 0x00000200l - - /* VPD Inquiry types */ -+#define HPSA_INQUIRY_FAILED 0x02 - #define HPSA_VPD_SUPPORTED_PAGES 0x00 - #define HPSA_VPD_LV_DEVICE_GEOMETRY 0xC1 - #define HPSA_VPD_LV_IOACCEL_STATUS 0xC2 -@@ -164,6 +165,7 @@ - /* Logical volume states */ - #define HPSA_VPD_LV_STATUS_UNSUPPORTED 0xff - #define HPSA_LV_OK 0x0 -+#define HPSA_LV_FAILED 0x01 - #define HPSA_LV_NOT_AVAILABLE 0x0b - #define HPSA_LV_UNDERGOING_ERASE 0x0F - #define HPSA_LV_UNDERGOING_RPI 0x12 -diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c -index 11cdb172cfaf..60720e5b1ebc 100644 ---- a/drivers/scsi/scsi_devinfo.c -+++ b/drivers/scsi/scsi_devinfo.c -@@ -160,7 +160,7 @@ static struct { - {"DGC", "RAID", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, storage on LUN 0 */ - {"DGC", "DISK", NULL, BLIST_SPARSELUN}, /* Dell PV 650F, no storage on LUN 0 */ - {"EMC", "Invista", "*", BLIST_SPARSELUN | BLIST_LARGELUN}, -- {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_FORCELUN}, -+ {"EMC", "SYMMETRIX", NULL, BLIST_SPARSELUN | BLIST_LARGELUN | BLIST_REPORTLUN2}, - {"EMULEX", "MD21/S2 ESDI", NULL, BLIST_SINGLELUN}, - {"easyRAID", "16P", NULL, BLIST_NOREPORTLUN}, - {"easyRAID", "X6P", NULL, BLIST_NOREPORTLUN}, -diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c -index 7e1681cf287c..dd72205ba298 100644 ---- a/drivers/scsi/sd.c -+++ b/drivers/scsi/sd.c -@@ -233,11 +233,15 @@ manage_start_stop_store(struct device *dev, struct device_attribute *attr, - { - struct scsi_disk *sdkp = to_scsi_disk(dev); - struct scsi_device *sdp = sdkp->device; -+ bool v; - - if (!capable(CAP_SYS_ADMIN)) - return -EACCES; - -- sdp->manage_start_stop = simple_strtoul(buf, NULL, 10); -+ if (kstrtobool(buf, &v)) -+ return -EINVAL; -+ -+ sdp->manage_start_stop = v; - - return count; - } -@@ -255,6 +259,7 @@ static ssize_t - allow_restart_store(struct device *dev, struct device_attribute *attr, - const char *buf, size_t count) - { -+ bool v; - struct scsi_disk *sdkp = to_scsi_disk(dev); - struct scsi_device *sdp = sdkp->device; - -@@ -264,7 +269,10 @@ allow_restart_store(struct device *dev, struct device_attribute *attr, - if (sdp->type != TYPE_DISK) - return -EINVAL; - -- sdp->allow_restart = simple_strtoul(buf, NULL, 10); -+ if (kstrtobool(buf, &v)) -+ return -EINVAL; -+ -+ sdp->allow_restart = v; - - return count; - } -diff --git a/drivers/staging/vt6655/device_main.c b/drivers/staging/vt6655/device_main.c -index fefbf826c622..8fd8f3a2d1bf 100644 ---- a/drivers/staging/vt6655/device_main.c -+++ b/drivers/staging/vt6655/device_main.c -@@ -1693,10 +1693,11 @@ static int vt6655_suspend(struct pci_dev *pcid, pm_message_t state) - MACbShutdown(priv->PortOffset); - - pci_disable_device(pcid); -- pci_set_power_state(pcid, pci_choose_state(pcid, state)); - - spin_unlock_irqrestore(&priv->lock, flags); - -+ pci_set_power_state(pcid, pci_choose_state(pcid, state)); -+ - return 0; - } - -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index bb73401f5761..8a4092cd97ee 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -674,6 +674,7 @@ static int iscsit_add_reject_from_cmd( - unsigned char *buf) - { - struct iscsi_conn *conn; -+ const bool do_put = cmd->se_cmd.se_tfo != NULL; - - if (!cmd->conn) { - pr_err("cmd->conn is NULL for ITT: 0x%08x\n", -@@ -704,7 +705,7 @@ static int iscsit_add_reject_from_cmd( - * Perform the kref_put now if se_cmd has already been setup by - * scsit_setup_scsi_cmd() - */ -- if (cmd->se_cmd.se_tfo != NULL) { -+ if (do_put) { - pr_debug("iscsi reject: calling target_put_sess_cmd >>>>>>\n"); - target_put_sess_cmd(&cmd->se_cmd); - } -diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c -index 634ad3662ed6..8c49bc3dcc8c 100644 ---- a/drivers/target/iscsi/iscsi_target_configfs.c -+++ b/drivers/target/iscsi/iscsi_target_configfs.c -@@ -1210,7 +1210,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( - - ret = core_tpg_register(wwn, &tpg->tpg_se_tpg, SCSI_PROTOCOL_ISCSI); - if (ret < 0) -- return NULL; -+ goto free_out; - - ret = iscsit_tpg_add_portal_group(tiqn, tpg); - if (ret != 0) -@@ -1222,6 +1222,7 @@ static struct se_portal_group *lio_target_tiqn_addtpg( - return &tpg->tpg_se_tpg; - out: - core_tpg_deregister(&tpg->tpg_se_tpg); -+free_out: - kfree(tpg); - return NULL; - } -diff --git a/drivers/target/target_core_alua.c b/drivers/target/target_core_alua.c -index 49aba4a31747..1fe782f9ee81 100644 ---- a/drivers/target/target_core_alua.c -+++ b/drivers/target/target_core_alua.c -@@ -1010,7 +1010,7 @@ static void core_alua_queue_state_change_ua(struct t10_alua_tg_pt_gp *tg_pt_gp) - static void core_alua_do_transition_tg_pt_work(struct work_struct *work) - { - struct t10_alua_tg_pt_gp *tg_pt_gp = container_of(work, -- struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work.work); -+ struct t10_alua_tg_pt_gp, tg_pt_gp_transition_work); - struct se_device *dev = tg_pt_gp->tg_pt_gp_dev; - bool explicit = (tg_pt_gp->tg_pt_gp_alua_access_status == - ALUA_STATUS_ALTERED_BY_EXPLICIT_STPG); -@@ -1073,17 +1073,8 @@ static int core_alua_do_transition_tg_pt( - /* - * Flush any pending transitions - */ -- if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs && -- atomic_read(&tg_pt_gp->tg_pt_gp_alua_access_state) == -- ALUA_ACCESS_STATE_TRANSITION) { -- /* Just in case */ -- tg_pt_gp->tg_pt_gp_alua_pending_state = new_state; -- tg_pt_gp->tg_pt_gp_transition_complete = &wait; -- flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work); -- wait_for_completion(&wait); -- tg_pt_gp->tg_pt_gp_transition_complete = NULL; -- return 0; -- } -+ if (!explicit) -+ flush_work(&tg_pt_gp->tg_pt_gp_transition_work); - - /* - * Save the old primary ALUA access state, and set the current state -@@ -1114,17 +1105,9 @@ static int core_alua_do_transition_tg_pt( - atomic_inc(&tg_pt_gp->tg_pt_gp_ref_cnt); - spin_unlock(&dev->t10_alua.tg_pt_gps_lock); - -- if (!explicit && tg_pt_gp->tg_pt_gp_implicit_trans_secs) { -- unsigned long transition_tmo; -- -- transition_tmo = tg_pt_gp->tg_pt_gp_implicit_trans_secs * HZ; -- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, -- &tg_pt_gp->tg_pt_gp_transition_work, -- transition_tmo); -- } else { -+ schedule_work(&tg_pt_gp->tg_pt_gp_transition_work); -+ if (explicit) { - tg_pt_gp->tg_pt_gp_transition_complete = &wait; -- queue_delayed_work(tg_pt_gp->tg_pt_gp_dev->tmr_wq, -- &tg_pt_gp->tg_pt_gp_transition_work, 0); - wait_for_completion(&wait); - tg_pt_gp->tg_pt_gp_transition_complete = NULL; - } -@@ -1692,8 +1675,8 @@ struct t10_alua_tg_pt_gp *core_alua_allocate_tg_pt_gp(struct se_device *dev, - mutex_init(&tg_pt_gp->tg_pt_gp_md_mutex); - spin_lock_init(&tg_pt_gp->tg_pt_gp_lock); - atomic_set(&tg_pt_gp->tg_pt_gp_ref_cnt, 0); -- INIT_DELAYED_WORK(&tg_pt_gp->tg_pt_gp_transition_work, -- core_alua_do_transition_tg_pt_work); -+ INIT_WORK(&tg_pt_gp->tg_pt_gp_transition_work, -+ core_alua_do_transition_tg_pt_work); - tg_pt_gp->tg_pt_gp_dev = dev; - atomic_set(&tg_pt_gp->tg_pt_gp_alua_access_state, - ALUA_ACCESS_STATE_ACTIVE_OPTIMIZED); -@@ -1801,7 +1784,7 @@ void core_alua_free_tg_pt_gp( - dev->t10_alua.alua_tg_pt_gps_counter--; - spin_unlock(&dev->t10_alua.tg_pt_gps_lock); - -- flush_delayed_work(&tg_pt_gp->tg_pt_gp_transition_work); -+ flush_work(&tg_pt_gp->tg_pt_gp_transition_work); - - /* - * Allow a struct t10_alua_tg_pt_gp_member * referenced by -diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c -index 041a56987845..2e35db7f4aac 100644 ---- a/drivers/target/target_core_file.c -+++ b/drivers/target/target_core_file.c -@@ -466,6 +466,10 @@ fd_execute_unmap(struct se_cmd *cmd, sector_t lba, sector_t nolb) - struct inode *inode = file->f_mapping->host; - int ret; - -+ if (!nolb) { -+ return 0; -+ } -+ - if (cmd->se_dev->dev_attrib.pi_prot_type) { - ret = fd_do_prot_unmap(cmd, lba, nolb); - if (ret) -diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c -index e7933115087a..e38b4582d43e 100644 ---- a/drivers/target/target_core_pr.c -+++ b/drivers/target/target_core_pr.c -@@ -56,8 +56,10 @@ void core_pr_dump_initiator_port( - char *buf, - u32 size) - { -- if (!pr_reg->isid_present_at_reg) -+ if (!pr_reg->isid_present_at_reg) { - buf[0] = '\0'; -+ return; -+ } - - snprintf(buf, size, ",i,0x%s", pr_reg->pr_reg_isid); - } -diff --git a/drivers/thermal/step_wise.c b/drivers/thermal/step_wise.c -index ea9366ad3e6b..7814d18e8940 100644 ---- a/drivers/thermal/step_wise.c -+++ b/drivers/thermal/step_wise.c -@@ -31,8 +31,7 @@ - * If the temperature is higher than a trip point, - * a. if the trend is THERMAL_TREND_RAISING, use higher cooling - * state for this trip point -- * b. if the trend is THERMAL_TREND_DROPPING, use lower cooling -- * state for this trip point -+ * b. if the trend is THERMAL_TREND_DROPPING, do nothing - * c. if the trend is THERMAL_TREND_RAISE_FULL, use upper limit - * for this trip point - * d. if the trend is THERMAL_TREND_DROP_FULL, use lower limit -@@ -94,9 +93,11 @@ static unsigned long get_target_state(struct thermal_instance *instance, - if (!throttle) - next_target = THERMAL_NO_TARGET; - } else { -- next_target = cur_state - 1; -- if (next_target > instance->upper) -- next_target = instance->upper; -+ if (!throttle) { -+ next_target = cur_state - 1; -+ if (next_target > instance->upper) -+ next_target = instance->upper; -+ } - } - break; - case THERMAL_TREND_DROP_FULL: -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index b1ece1f618c8..f6fde903fcad 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -521,6 +521,9 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, - unsigned iad_num = 0; - - memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); -+ nintf = nintf_orig = config->desc.bNumInterfaces; -+ config->desc.bNumInterfaces = 0; // Adjusted later -+ - if (config->desc.bDescriptorType != USB_DT_CONFIG || - config->desc.bLength < USB_DT_CONFIG_SIZE || - config->desc.bLength > size) { -@@ -534,7 +537,6 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, - buffer += config->desc.bLength; - size -= config->desc.bLength; - -- nintf = nintf_orig = config->desc.bNumInterfaces; - if (nintf > USB_MAXINTERFACES) { - dev_warn(ddev, "config %d has too many interfaces: %d, " - "using maximum allowed: %d\n", -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index 6a07570a90e6..f7481c4e2bc9 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1017,10 +1017,9 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, - return 0; - } - -- xhci->devs[slot_id] = kzalloc(sizeof(*xhci->devs[slot_id]), flags); -- if (!xhci->devs[slot_id]) -+ dev = kzalloc(sizeof(*dev), flags); -+ if (!dev) - return 0; -- dev = xhci->devs[slot_id]; - - /* Allocate the (output) device context that will be used in the HC. */ - dev->out_ctx = xhci_alloc_container_ctx(xhci, XHCI_CTX_TYPE_DEVICE, flags); -@@ -1068,9 +1067,17 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, - &xhci->dcbaa->dev_context_ptrs[slot_id], - le64_to_cpu(xhci->dcbaa->dev_context_ptrs[slot_id])); - -+ xhci->devs[slot_id] = dev; -+ - return 1; - fail: -- xhci_free_virt_device(xhci, slot_id); -+ -+ if (dev->in_ctx) -+ xhci_free_container_ctx(xhci, dev->in_ctx); -+ if (dev->out_ctx) -+ xhci_free_container_ctx(xhci, dev->out_ctx); -+ kfree(dev); -+ - return 0; - } - -diff --git a/drivers/usb/musb/da8xx.c b/drivers/usb/musb/da8xx.c -index 9a9c82a4d35d..d6a8e325950c 100644 ---- a/drivers/usb/musb/da8xx.c -+++ b/drivers/usb/musb/da8xx.c -@@ -350,7 +350,15 @@ static irqreturn_t da8xx_musb_interrupt(int irq, void *hci) - musb->xceiv->otg->state = OTG_STATE_A_WAIT_VRISE; - portstate(musb->port1_status |= USB_PORT_STAT_POWER); - del_timer(&otg_workaround); -- } else { -+ } else if (!(musb->int_usb & MUSB_INTR_BABBLE)){ -+ /* -+ * When babble condition happens, drvvbus interrupt -+ * is also generated. Ignore this drvvbus interrupt -+ * and let babble interrupt handler recovers the -+ * controller; otherwise, the host-mode flag is lost -+ * due to the MUSB_DEV_MODE() call below and babble -+ * recovery logic will not called. -+ */ - musb->is_active = 0; - MUSB_DEV_MODE(musb); - otg->default_a = 0; -diff --git a/drivers/usb/phy/phy-isp1301.c b/drivers/usb/phy/phy-isp1301.c -index db68156568e6..b3b33cf7ddf6 100644 ---- a/drivers/usb/phy/phy-isp1301.c -+++ b/drivers/usb/phy/phy-isp1301.c -@@ -33,6 +33,12 @@ static const struct i2c_device_id isp1301_id[] = { - }; - MODULE_DEVICE_TABLE(i2c, isp1301_id); - -+static const struct of_device_id isp1301_of_match[] = { -+ {.compatible = "nxp,isp1301" }, -+ { }, -+}; -+MODULE_DEVICE_TABLE(of, isp1301_of_match); -+ - static struct i2c_client *isp1301_i2c_client; - - static int __isp1301_write(struct isp1301 *isp, u8 reg, u8 value, u8 clear) -@@ -130,6 +136,7 @@ static int isp1301_remove(struct i2c_client *client) - static struct i2c_driver isp1301_driver = { - .driver = { - .name = DRV_NAME, -+ .of_match_table = of_match_ptr(isp1301_of_match), - }, - .probe = isp1301_probe, - .remove = isp1301_remove, -diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h -index fb96755550ec..c10eceb76c39 100644 ---- a/drivers/usb/storage/unusual_devs.h -+++ b/drivers/usb/storage/unusual_devs.h -@@ -2149,6 +2149,13 @@ UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_REPORT_OPCODES), - -+/* Reported by David Kozub */ -+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, -+ "JMicron", -+ "JMS567", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_BROKEN_FUA), -+ - /* - * Patch by Constantin Baranov - * Report by Andreas Koenecke. -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index a37ed1e59e99..2f80163ffb94 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -141,6 +141,13 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES), - -+/* Reported-by: David Kozub */ -+UNUSUAL_DEV(0x152d, 0x0578, 0x0000, 0x9999, -+ "JMicron", -+ "JMS567", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_BROKEN_FUA), -+ - /* Reported-by: Hans de Goede */ - UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, - "VIA", -diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c -index 021003c4de53..af858d52608a 100644 ---- a/drivers/usb/usbip/stub_tx.c -+++ b/drivers/usb/usbip/stub_tx.c -@@ -178,6 +178,13 @@ static int stub_send_ret_submit(struct stub_device *sdev) - memset(&pdu_header, 0, sizeof(pdu_header)); - memset(&msg, 0, sizeof(msg)); - -+ if (urb->actual_length > 0 && !urb->transfer_buffer) { -+ dev_err(&sdev->udev->dev, -+ "urb: actual_length %d transfer_buffer null\n", -+ urb->actual_length); -+ return -1; -+ } -+ - if (usb_pipetype(urb->pipe) == PIPE_ISOCHRONOUS) - iovnum = 2 + urb->number_of_packets; - else -diff --git a/drivers/video/fbdev/au1200fb.c b/drivers/video/fbdev/au1200fb.c -index f9507b1894df..789d3f16ff9f 100644 ---- a/drivers/video/fbdev/au1200fb.c -+++ b/drivers/video/fbdev/au1200fb.c -@@ -1680,8 +1680,10 @@ static int au1200fb_drv_probe(struct platform_device *dev) - - fbi = framebuffer_alloc(sizeof(struct au1200fb_device), - &dev->dev); -- if (!fbi) -+ if (!fbi) { -+ ret = -ENOMEM; - goto failed; -+ } - - _au1200fb_infos[plane] = fbi; - fbdev = fbi->par; -@@ -1699,7 +1701,8 @@ static int au1200fb_drv_probe(struct platform_device *dev) - if (!fbdev->fb_mem) { - print_err("fail to allocate frambuffer (size: %dK))", - fbdev->fb_len / 1024); -- return -ENOMEM; -+ ret = -ENOMEM; -+ goto failed; - } - - /* -diff --git a/drivers/video/fbdev/controlfb.h b/drivers/video/fbdev/controlfb.h -index 6026c60fc100..261522fabdac 100644 ---- a/drivers/video/fbdev/controlfb.h -+++ b/drivers/video/fbdev/controlfb.h -@@ -141,5 +141,7 @@ static struct max_cmodes control_mac_modes[] = { - {{ 1, 2}}, /* 1152x870, 75Hz */ - {{ 0, 1}}, /* 1280x960, 75Hz */ - {{ 0, 1}}, /* 1280x1024, 75Hz */ -+ {{ 1, 2}}, /* 1152x768, 60Hz */ -+ {{ 0, 1}}, /* 1600x1024, 60Hz */ - }; - -diff --git a/drivers/video/fbdev/udlfb.c b/drivers/video/fbdev/udlfb.c -index e9c2f7ba3c8e..53326badfb61 100644 ---- a/drivers/video/fbdev/udlfb.c -+++ b/drivers/video/fbdev/udlfb.c -@@ -769,11 +769,11 @@ static int dlfb_get_edid(struct dlfb_data *dev, char *edid, int len) - - for (i = 0; i < len; i++) { - ret = usb_control_msg(dev->udev, -- usb_rcvctrlpipe(dev->udev, 0), (0x02), -- (0x80 | (0x02 << 5)), i << 8, 0xA1, rbuf, 2, -- HZ); -- if (ret < 1) { -- pr_err("Read EDID byte %d failed err %x\n", i, ret); -+ usb_rcvctrlpipe(dev->udev, 0), 0x02, -+ (0x80 | (0x02 << 5)), i << 8, 0xA1, -+ rbuf, 2, USB_CTRL_GET_TIMEOUT); -+ if (ret < 2) { -+ pr_err("Read EDID byte %d failed: %d\n", i, ret); - i--; - break; - } -diff --git a/fs/afs/callback.c b/fs/afs/callback.c -index 7ef637d7f3a5..7d54efd73519 100644 ---- a/fs/afs/callback.c -+++ b/fs/afs/callback.c -@@ -362,7 +362,7 @@ static void afs_callback_updater(struct work_struct *work) - { - struct afs_server *server; - struct afs_vnode *vnode, *xvnode; -- time_t now; -+ time64_t now; - long timeout; - int ret; - -@@ -370,7 +370,7 @@ static void afs_callback_updater(struct work_struct *work) - - _enter(""); - -- now = get_seconds(); -+ now = ktime_get_real_seconds(); - - /* find the first vnode to update */ - spin_lock(&server->cb_lock); -@@ -424,7 +424,8 @@ static void afs_callback_updater(struct work_struct *work) - - /* and then reschedule */ - _debug("reschedule"); -- vnode->update_at = get_seconds() + afs_vnode_update_timeout; -+ vnode->update_at = ktime_get_real_seconds() + -+ afs_vnode_update_timeout; - - spin_lock(&server->cb_lock); - -diff --git a/fs/afs/file.c b/fs/afs/file.c -index 999bc3caec92..cf8a07e282a6 100644 ---- a/fs/afs/file.c -+++ b/fs/afs/file.c -@@ -29,6 +29,7 @@ static int afs_readpages(struct file *filp, struct address_space *mapping, - - const struct file_operations afs_file_operations = { - .open = afs_open, -+ .flush = afs_flush, - .release = afs_release, - .llseek = generic_file_llseek, - .read_iter = generic_file_read_iter, -diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c -index c2e930ec2888..10ce44214005 100644 ---- a/fs/afs/fsclient.c -+++ b/fs/afs/fsclient.c -@@ -105,7 +105,7 @@ static void xdr_decode_AFSFetchStatus(const __be32 **_bp, - vnode->vfs_inode.i_mode = mode; - } - -- vnode->vfs_inode.i_ctime.tv_sec = status->mtime_server; -+ vnode->vfs_inode.i_ctime.tv_sec = status->mtime_client; - vnode->vfs_inode.i_mtime = vnode->vfs_inode.i_ctime; - vnode->vfs_inode.i_atime = vnode->vfs_inode.i_ctime; - vnode->vfs_inode.i_version = data_version; -@@ -139,7 +139,7 @@ static void xdr_decode_AFSCallBack(const __be32 **_bp, struct afs_vnode *vnode) - vnode->cb_version = ntohl(*bp++); - vnode->cb_expiry = ntohl(*bp++); - vnode->cb_type = ntohl(*bp++); -- vnode->cb_expires = vnode->cb_expiry + get_seconds(); -+ vnode->cb_expires = vnode->cb_expiry + ktime_get_real_seconds(); - *_bp = bp; - } - -@@ -703,8 +703,8 @@ int afs_fs_create(struct afs_server *server, - memset(bp, 0, padsz); - bp = (void *) bp + padsz; - } -- *bp++ = htonl(AFS_SET_MODE); -- *bp++ = 0; /* mtime */ -+ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); -+ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ - *bp++ = 0; /* owner */ - *bp++ = 0; /* group */ - *bp++ = htonl(mode & S_IALLUGO); /* unix mode */ -@@ -981,8 +981,8 @@ int afs_fs_symlink(struct afs_server *server, - memset(bp, 0, c_padsz); - bp = (void *) bp + c_padsz; - } -- *bp++ = htonl(AFS_SET_MODE); -- *bp++ = 0; /* mtime */ -+ *bp++ = htonl(AFS_SET_MODE | AFS_SET_MTIME); -+ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ - *bp++ = 0; /* owner */ - *bp++ = 0; /* group */ - *bp++ = htonl(S_IRWXUGO); /* unix mode */ -@@ -1192,8 +1192,8 @@ static int afs_fs_store_data64(struct afs_server *server, - *bp++ = htonl(vnode->fid.vnode); - *bp++ = htonl(vnode->fid.unique); - -- *bp++ = 0; /* mask */ -- *bp++ = 0; /* mtime */ -+ *bp++ = htonl(AFS_SET_MTIME); /* mask */ -+ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ - *bp++ = 0; /* owner */ - *bp++ = 0; /* group */ - *bp++ = 0; /* unix mode */ -@@ -1225,7 +1225,7 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, - _enter(",%x,{%x:%u},,", - key_serial(wb->key), vnode->fid.vid, vnode->fid.vnode); - -- size = to - offset; -+ size = (loff_t)to - (loff_t)offset; - if (first != last) - size += (loff_t)(last - first) << PAGE_SHIFT; - pos = (loff_t)first << PAGE_SHIFT; -@@ -1269,8 +1269,8 @@ int afs_fs_store_data(struct afs_server *server, struct afs_writeback *wb, - *bp++ = htonl(vnode->fid.vnode); - *bp++ = htonl(vnode->fid.unique); - -- *bp++ = 0; /* mask */ -- *bp++ = 0; /* mtime */ -+ *bp++ = htonl(AFS_SET_MTIME); /* mask */ -+ *bp++ = htonl(vnode->vfs_inode.i_mtime.tv_sec); /* mtime */ - *bp++ = 0; /* owner */ - *bp++ = 0; /* group */ - *bp++ = 0; /* unix mode */ -diff --git a/fs/afs/inode.c b/fs/afs/inode.c -index e06f5a23352a..f8fa92b1d43c 100644 ---- a/fs/afs/inode.c -+++ b/fs/afs/inode.c -@@ -69,9 +69,9 @@ static int afs_inode_map_status(struct afs_vnode *vnode, struct key *key) - - set_nlink(inode, vnode->status.nlink); - inode->i_uid = vnode->status.owner; -- inode->i_gid = GLOBAL_ROOT_GID; -+ inode->i_gid = vnode->status.group; - inode->i_size = vnode->status.size; -- inode->i_ctime.tv_sec = vnode->status.mtime_server; -+ inode->i_ctime.tv_sec = vnode->status.mtime_client; - inode->i_ctime.tv_nsec = 0; - inode->i_atime = inode->i_mtime = inode->i_ctime; - inode->i_blocks = 0; -@@ -244,12 +244,13 @@ struct inode *afs_iget(struct super_block *sb, struct key *key, - vnode->cb_version = 0; - vnode->cb_expiry = 0; - vnode->cb_type = 0; -- vnode->cb_expires = get_seconds(); -+ vnode->cb_expires = ktime_get_real_seconds(); - } else { - vnode->cb_version = cb->version; - vnode->cb_expiry = cb->expiry; - vnode->cb_type = cb->type; -- vnode->cb_expires = vnode->cb_expiry + get_seconds(); -+ vnode->cb_expires = vnode->cb_expiry + -+ ktime_get_real_seconds(); - } - } - -@@ -322,7 +323,7 @@ int afs_validate(struct afs_vnode *vnode, struct key *key) - !test_bit(AFS_VNODE_CB_BROKEN, &vnode->flags) && - !test_bit(AFS_VNODE_MODIFIED, &vnode->flags) && - !test_bit(AFS_VNODE_ZAP_DATA, &vnode->flags)) { -- if (vnode->cb_expires < get_seconds() + 10) { -+ if (vnode->cb_expires < ktime_get_real_seconds() + 10) { - _debug("callback expired"); - set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags); - } else { -diff --git a/fs/afs/internal.h b/fs/afs/internal.h -index 71d5982312f3..1330b2a695ff 100644 ---- a/fs/afs/internal.h -+++ b/fs/afs/internal.h -@@ -11,6 +11,7 @@ - - #include - #include -+#include - #include - #include - #include -@@ -247,7 +248,7 @@ struct afs_cache_vhash { - */ - struct afs_vlocation { - atomic_t usage; -- time_t time_of_death; /* time at which put reduced usage to 0 */ -+ time64_t time_of_death; /* time at which put reduced usage to 0 */ - struct list_head link; /* link in cell volume location list */ - struct list_head grave; /* link in master graveyard list */ - struct list_head update; /* link in master update list */ -@@ -258,7 +259,7 @@ struct afs_vlocation { - struct afs_cache_vlocation vldb; /* volume information DB record */ - struct afs_volume *vols[3]; /* volume access record pointer (index by type) */ - wait_queue_head_t waitq; /* status change waitqueue */ -- time_t update_at; /* time at which record should be updated */ -+ time64_t update_at; /* time at which record should be updated */ - spinlock_t lock; /* access lock */ - afs_vlocation_state_t state; /* volume location state */ - unsigned short upd_rej_cnt; /* ENOMEDIUM count during update */ -@@ -271,7 +272,7 @@ struct afs_vlocation { - */ - struct afs_server { - atomic_t usage; -- time_t time_of_death; /* time at which put reduced usage to 0 */ -+ time64_t time_of_death; /* time at which put reduced usage to 0 */ - struct in_addr addr; /* server address */ - struct afs_cell *cell; /* cell in which server resides */ - struct list_head link; /* link in cell's server list */ -@@ -374,8 +375,8 @@ struct afs_vnode { - struct rb_node server_rb; /* link in server->fs_vnodes */ - struct rb_node cb_promise; /* link in server->cb_promises */ - struct work_struct cb_broken_work; /* work to be done on callback break */ -- time_t cb_expires; /* time at which callback expires */ -- time_t cb_expires_at; /* time used to order cb_promise */ -+ time64_t cb_expires; /* time at which callback expires */ -+ time64_t cb_expires_at; /* time used to order cb_promise */ - unsigned cb_version; /* callback version */ - unsigned cb_expiry; /* callback expiry time */ - afs_callback_type_t cb_type; /* type of callback */ -@@ -749,6 +750,7 @@ extern int afs_writepages(struct address_space *, struct writeback_control *); - extern void afs_pages_written_back(struct afs_vnode *, struct afs_call *); - extern ssize_t afs_file_write(struct kiocb *, struct iov_iter *); - extern int afs_writeback_all(struct afs_vnode *); -+extern int afs_flush(struct file *, fl_owner_t); - extern int afs_fsync(struct file *, loff_t, loff_t, int); - - -diff --git a/fs/afs/security.c b/fs/afs/security.c -index 8d010422dc89..bfa9d3428383 100644 ---- a/fs/afs/security.c -+++ b/fs/afs/security.c -@@ -340,17 +340,22 @@ int afs_permission(struct inode *inode, int mask) - } else { - if (!(access & AFS_ACE_LOOKUP)) - goto permission_denied; -+ if ((mask & MAY_EXEC) && !(inode->i_mode & S_IXUSR)) -+ goto permission_denied; - if (mask & (MAY_EXEC | MAY_READ)) { - if (!(access & AFS_ACE_READ)) - goto permission_denied; -+ if (!(inode->i_mode & S_IRUSR)) -+ goto permission_denied; - } else if (mask & MAY_WRITE) { - if (!(access & AFS_ACE_WRITE)) - goto permission_denied; -+ if (!(inode->i_mode & S_IWUSR)) -+ goto permission_denied; - } - } - - key_put(key); -- ret = generic_permission(inode, mask); - _leave(" = %d", ret); - return ret; - -diff --git a/fs/afs/server.c b/fs/afs/server.c -index f342acf3547d..3bc1a46f0bd6 100644 ---- a/fs/afs/server.c -+++ b/fs/afs/server.c -@@ -237,7 +237,7 @@ void afs_put_server(struct afs_server *server) - spin_lock(&afs_server_graveyard_lock); - if (atomic_read(&server->usage) == 0) { - list_move_tail(&server->grave, &afs_server_graveyard); -- server->time_of_death = get_seconds(); -+ server->time_of_death = ktime_get_real_seconds(); - queue_delayed_work(afs_wq, &afs_server_reaper, - afs_server_timeout * HZ); - } -@@ -272,9 +272,9 @@ static void afs_reap_server(struct work_struct *work) - LIST_HEAD(corpses); - struct afs_server *server; - unsigned long delay, expiry; -- time_t now; -+ time64_t now; - -- now = get_seconds(); -+ now = ktime_get_real_seconds(); - spin_lock(&afs_server_graveyard_lock); - - while (!list_empty(&afs_server_graveyard)) { -diff --git a/fs/afs/vlocation.c b/fs/afs/vlocation.c -index 52976785a32c..ee9015c0db5a 100644 ---- a/fs/afs/vlocation.c -+++ b/fs/afs/vlocation.c -@@ -340,7 +340,8 @@ static void afs_vlocation_queue_for_updates(struct afs_vlocation *vl) - struct afs_vlocation *xvl; - - /* wait at least 10 minutes before updating... */ -- vl->update_at = get_seconds() + afs_vlocation_update_timeout; -+ vl->update_at = ktime_get_real_seconds() + -+ afs_vlocation_update_timeout; - - spin_lock(&afs_vlocation_updates_lock); - -@@ -506,7 +507,7 @@ void afs_put_vlocation(struct afs_vlocation *vl) - if (atomic_read(&vl->usage) == 0) { - _debug("buried"); - list_move_tail(&vl->grave, &afs_vlocation_graveyard); -- vl->time_of_death = get_seconds(); -+ vl->time_of_death = ktime_get_real_seconds(); - queue_delayed_work(afs_wq, &afs_vlocation_reap, - afs_vlocation_timeout * HZ); - -@@ -543,11 +544,11 @@ static void afs_vlocation_reaper(struct work_struct *work) - LIST_HEAD(corpses); - struct afs_vlocation *vl; - unsigned long delay, expiry; -- time_t now; -+ time64_t now; - - _enter(""); - -- now = get_seconds(); -+ now = ktime_get_real_seconds(); - spin_lock(&afs_vlocation_graveyard_lock); - - while (!list_empty(&afs_vlocation_graveyard)) { -@@ -622,13 +623,13 @@ static void afs_vlocation_updater(struct work_struct *work) - { - struct afs_cache_vlocation vldb; - struct afs_vlocation *vl, *xvl; -- time_t now; -+ time64_t now; - long timeout; - int ret; - - _enter(""); - -- now = get_seconds(); -+ now = ktime_get_real_seconds(); - - /* find a record to update */ - spin_lock(&afs_vlocation_updates_lock); -@@ -684,7 +685,8 @@ static void afs_vlocation_updater(struct work_struct *work) - - /* and then reschedule */ - _debug("reschedule"); -- vl->update_at = get_seconds() + afs_vlocation_update_timeout; -+ vl->update_at = ktime_get_real_seconds() + -+ afs_vlocation_update_timeout; - - spin_lock(&afs_vlocation_updates_lock); - -diff --git a/fs/afs/write.c b/fs/afs/write.c -index 0714abcd7f32..5cfc05ca184c 100644 ---- a/fs/afs/write.c -+++ b/fs/afs/write.c -@@ -148,12 +148,12 @@ int afs_write_begin(struct file *file, struct address_space *mapping, - kfree(candidate); - return -ENOMEM; - } -- *pagep = page; -- /* page won't leak in error case: it eventually gets cleaned off LRU */ - - if (!PageUptodate(page) && len != PAGE_CACHE_SIZE) { - ret = afs_fill_page(vnode, key, index << PAGE_CACHE_SHIFT, page); - if (ret < 0) { -+ unlock_page(page); -+ put_page(page); - kfree(candidate); - _leave(" = %d [prep]", ret); - return ret; -@@ -161,6 +161,9 @@ int afs_write_begin(struct file *file, struct address_space *mapping, - SetPageUptodate(page); - } - -+ /* page won't leak in error case: it eventually gets cleaned off LRU */ -+ *pagep = page; -+ - try_again: - spin_lock(&vnode->writeback_lock); - -@@ -296,10 +299,14 @@ static void afs_kill_pages(struct afs_vnode *vnode, bool error, - ASSERTCMP(pv.nr, ==, count); - - for (loop = 0; loop < count; loop++) { -- ClearPageUptodate(pv.pages[loop]); -+ struct page *page = pv.pages[loop]; -+ ClearPageUptodate(page); - if (error) -- SetPageError(pv.pages[loop]); -- end_page_writeback(pv.pages[loop]); -+ SetPageError(page); -+ if (PageWriteback(page)) -+ end_page_writeback(page); -+ if (page->index >= first) -+ first = page->index + 1; - } - - __pagevec_release(&pv); -@@ -503,6 +510,7 @@ static int afs_writepages_region(struct address_space *mapping, - - if (PageWriteback(page) || !PageDirty(page)) { - unlock_page(page); -+ put_page(page); - continue; - } - -@@ -739,6 +747,20 @@ out: - return ret; - } - -+/* -+ * Flush out all outstanding writes on a file opened for writing when it is -+ * closed. -+ */ -+int afs_flush(struct file *file, fl_owner_t id) -+{ -+ _enter(""); -+ -+ if ((file->f_mode & FMODE_WRITE) == 0) -+ return 0; -+ -+ return vfs_fsync(file, 0); -+} -+ - /* - * notification that a previously read-only page is about to become writable - * - if it returns an error, the caller will deliver a bus error signal -diff --git a/fs/autofs4/waitq.c b/fs/autofs4/waitq.c -index fe6e7050fe50..98198c57370b 100644 ---- a/fs/autofs4/waitq.c -+++ b/fs/autofs4/waitq.c -@@ -174,7 +174,6 @@ static void autofs4_notify_daemon(struct autofs_sb_info *sbi, - - mutex_unlock(&sbi->wq_mutex); - -- if (autofs4_write(sbi, pipe, &pkt, pktsz)) - switch (ret = autofs4_write(sbi, pipe, &pkt, pktsz)) { - case 0: - break; -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index bebd6517355d..af1da85da509 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -6735,6 +6735,20 @@ static noinline int uncompress_inline(struct btrfs_path *path, - max_size = min_t(unsigned long, PAGE_CACHE_SIZE, max_size); - ret = btrfs_decompress(compress_type, tmp, page, - extent_offset, inline_size, max_size); -+ -+ /* -+ * decompression code contains a memset to fill in any space between the end -+ * of the uncompressed data and the end of max_size in case the decompressed -+ * data ends up shorter than ram_bytes. That doesn't cover the hole between -+ * the end of an inline extent and the beginning of the next block, so we -+ * cover that region here. -+ */ -+ -+ if (max_size + pg_offset < PAGE_SIZE) { -+ char *map = kmap(page); -+ memset(map + pg_offset + max_size, 0, PAGE_SIZE - max_size - pg_offset); -+ kunmap(page); -+ } - kfree(tmp); - return ret; - } -diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c -index ead89489ae71..35e6e0b2cf34 100644 ---- a/fs/ceph/mds_client.c -+++ b/fs/ceph/mds_client.c -@@ -1400,6 +1400,29 @@ static int __close_session(struct ceph_mds_client *mdsc, - return request_close_session(mdsc, session); - } - -+static bool drop_negative_children(struct dentry *dentry) -+{ -+ struct dentry *child; -+ bool all_negative = true; -+ -+ if (!d_is_dir(dentry)) -+ goto out; -+ -+ spin_lock(&dentry->d_lock); -+ list_for_each_entry(child, &dentry->d_subdirs, d_child) { -+ if (d_really_is_positive(child)) { -+ all_negative = false; -+ break; -+ } -+ } -+ spin_unlock(&dentry->d_lock); -+ -+ if (all_negative) -+ shrink_dcache_parent(dentry); -+out: -+ return all_negative; -+} -+ - /* - * Trim old(er) caps. - * -@@ -1445,16 +1468,27 @@ static int trim_caps_cb(struct inode *inode, struct ceph_cap *cap, void *arg) - if ((used | wanted) & ~oissued & mine) - goto out; /* we need these caps */ - -- session->s_trim_caps--; - if (oissued) { - /* we aren't the only cap.. just remove us */ - __ceph_remove_cap(cap, true); -+ session->s_trim_caps--; - } else { -+ struct dentry *dentry; - /* try dropping referring dentries */ - spin_unlock(&ci->i_ceph_lock); -- d_prune_aliases(inode); -- dout("trim_caps_cb %p cap %p pruned, count now %d\n", -- inode, cap, atomic_read(&inode->i_count)); -+ dentry = d_find_any_alias(inode); -+ if (dentry && drop_negative_children(dentry)) { -+ int count; -+ dput(dentry); -+ d_prune_aliases(inode); -+ count = atomic_read(&inode->i_count); -+ if (count == 1) -+ session->s_trim_caps--; -+ dout("trim_caps_cb %p cap %p pruned, count now %d\n", -+ inode, cap, count); -+ } else { -+ dput(dentry); -+ } - return 0; - } - -diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c -index 31a3e480d484..403c4bae3e18 100644 ---- a/fs/ext4/extents.c -+++ b/fs/ext4/extents.c -@@ -4746,6 +4746,7 @@ retry: - EXT4_INODE_EOFBLOCKS); - } - ext4_mark_inode_dirty(handle, inode); -+ ext4_update_inode_fsync_trans(handle, inode, 1); - ret2 = ext4_journal_stop(handle); - if (ret2) - break; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 6445d84266fa..4c36dca486cc 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -1403,6 +1403,10 @@ static struct buffer_head * ext4_find_entry (struct inode *dir, - "falling back\n")); - } - nblocks = dir->i_size >> EXT4_BLOCK_SIZE_BITS(sb); -+ if (!nblocks) { -+ ret = NULL; -+ goto cleanup_and_exit; -+ } - start = EXT4_I(dir)->i_dir_start_lookup; - if (start >= nblocks) - start = 0; -diff --git a/fs/fs-writeback.c b/fs/fs-writeback.c -index 60d6fc2e0e4b..22b30249fbcb 100644 ---- a/fs/fs-writeback.c -+++ b/fs/fs-writeback.c -@@ -173,19 +173,33 @@ static void wb_wakeup(struct bdi_writeback *wb) - spin_unlock_bh(&wb->work_lock); - } - -+static void finish_writeback_work(struct bdi_writeback *wb, -+ struct wb_writeback_work *work) -+{ -+ struct wb_completion *done = work->done; -+ -+ if (work->auto_free) -+ kfree(work); -+ if (done && atomic_dec_and_test(&done->cnt)) -+ wake_up_all(&wb->bdi->wb_waitq); -+} -+ - static void wb_queue_work(struct bdi_writeback *wb, - struct wb_writeback_work *work) - { - trace_writeback_queue(wb, work); - -- spin_lock_bh(&wb->work_lock); -- if (!test_bit(WB_registered, &wb->state)) -- goto out_unlock; - if (work->done) - atomic_inc(&work->done->cnt); -- list_add_tail(&work->list, &wb->work_list); -- mod_delayed_work(bdi_wq, &wb->dwork, 0); --out_unlock: -+ -+ spin_lock_bh(&wb->work_lock); -+ -+ if (test_bit(WB_registered, &wb->state)) { -+ list_add_tail(&work->list, &wb->work_list); -+ mod_delayed_work(bdi_wq, &wb->dwork, 0); -+ } else -+ finish_writeback_work(wb, work); -+ - spin_unlock_bh(&wb->work_lock); - } - -@@ -1839,16 +1853,9 @@ static long wb_do_writeback(struct bdi_writeback *wb) - - set_bit(WB_writeback_running, &wb->state); - while ((work = get_next_work_item(wb)) != NULL) { -- struct wb_completion *done = work->done; -- - trace_writeback_exec(wb, work); -- - wrote += wb_writeback(wb, work); -- -- if (work->auto_free) -- kfree(work); -- if (done && atomic_dec_and_test(&done->cnt)) -- wake_up_all(&wb->bdi->wb_waitq); -+ finish_writeback_work(wb, work); - } - - /* -diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c -index 5e425469f0c2..1543aa1b2a93 100644 ---- a/fs/gfs2/file.c -+++ b/fs/gfs2/file.c -@@ -255,7 +255,7 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) - goto out; - } - if ((flags ^ new_flags) & GFS2_DIF_JDATA) { -- if (flags & GFS2_DIF_JDATA) -+ if (new_flags & GFS2_DIF_JDATA) - gfs2_log_flush(sdp, ip->i_gl, NORMAL_FLUSH); - error = filemap_fdatawrite(inode->i_mapping); - if (error) -@@ -263,6 +263,8 @@ static int do_gfs2_set_flags(struct file *filp, u32 reqflags, u32 mask) - error = filemap_fdatawait(inode->i_mapping); - if (error) - goto out; -+ if (new_flags & GFS2_DIF_JDATA) -+ gfs2_ordered_del_inode(ip); - } - error = gfs2_trans_begin(sdp, RES_DINODE, 0); - if (error) -diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c -index 10410e8b5853..63498e1a542a 100644 ---- a/fs/nfs/nfs4client.c -+++ b/fs/nfs/nfs4client.c -@@ -895,9 +895,9 @@ static void nfs4_session_set_rwsize(struct nfs_server *server) - server_resp_sz = sess->fc_attrs.max_resp_sz - nfs41_maxread_overhead; - server_rqst_sz = sess->fc_attrs.max_rqst_sz - nfs41_maxwrite_overhead; - -- if (server->rsize > server_resp_sz) -+ if (!server->rsize || server->rsize > server_resp_sz) - server->rsize = server_resp_sz; -- if (server->wsize > server_rqst_sz) -+ if (!server->wsize || server->wsize > server_rqst_sz) - server->wsize = server_rqst_sz; - #endif /* CONFIG_NFS_V4_1 */ - } -diff --git a/fs/nfsd/nfssvc.c b/fs/nfsd/nfssvc.c -index 5be1fa6b676d..b6eb56d18568 100644 ---- a/fs/nfsd/nfssvc.c -+++ b/fs/nfsd/nfssvc.c -@@ -151,7 +151,8 @@ int nfsd_vers(int vers, enum vers_op change) - - int nfsd_minorversion(u32 minorversion, enum vers_op change) - { -- if (minorversion > NFSD_SUPPORTED_MINOR_VERSION) -+ if (minorversion > NFSD_SUPPORTED_MINOR_VERSION && -+ change != NFSD_AVAIL) - return -1; - switch(change) { - case NFSD_SET: -@@ -329,23 +330,20 @@ static void nfsd_last_thread(struct svc_serv *serv, struct net *net) - - void nfsd_reset_versions(void) - { -- int found_one = 0; - int i; - -- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) { -- if (nfsd_program.pg_vers[i]) -- found_one = 1; -- } -- -- if (!found_one) { -- for (i = NFSD_MINVERS; i < NFSD_NRVERS; i++) -- nfsd_program.pg_vers[i] = nfsd_version[i]; --#if defined(CONFIG_NFSD_V2_ACL) || defined(CONFIG_NFSD_V3_ACL) -- for (i = NFSD_ACL_MINVERS; i < NFSD_ACL_NRVERS; i++) -- nfsd_acl_program.pg_vers[i] = -- nfsd_acl_version[i]; --#endif -- } -+ for (i = 0; i < NFSD_NRVERS; i++) -+ if (nfsd_vers(i, NFSD_TEST)) -+ return; -+ -+ for (i = 0; i < NFSD_NRVERS; i++) -+ if (i != 4) -+ nfsd_vers(i, NFSD_SET); -+ else { -+ int minor = 0; -+ while (nfsd_minorversion(minor, NFSD_SET) >= 0) -+ minor++; -+ } - } - - /* -diff --git a/fs/proc/proc_tty.c b/fs/proc/proc_tty.c -index 15f327bed8c6..7340c36978a3 100644 ---- a/fs/proc/proc_tty.c -+++ b/fs/proc/proc_tty.c -@@ -14,6 +14,7 @@ - #include - #include - #include -+#include "internal.h" - - /* - * The /proc/tty directory inodes... -@@ -164,7 +165,7 @@ void proc_tty_unregister_driver(struct tty_driver *driver) - if (!ent) - return; - -- remove_proc_entry(driver->driver_name, proc_tty_driver); -+ remove_proc_entry(ent->name, proc_tty_driver); - - driver->proc_entry = NULL; - } -diff --git a/fs/udf/super.c b/fs/udf/super.c -index 81155b9b445b..ee09c97f3ab2 100644 ---- a/fs/udf/super.c -+++ b/fs/udf/super.c -@@ -705,7 +705,7 @@ static loff_t udf_check_vsd(struct super_block *sb) - else - sectorsize = sb->s_blocksize; - -- sector += (sbi->s_session << sb->s_blocksize_bits); -+ sector += (((loff_t)sbi->s_session) << sb->s_blocksize_bits); - - udf_debug("Starting at sector %u (%ld byte sectors)\n", - (unsigned int)(sector >> sb->s_blocksize_bits), -diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c -index 66cdb44616d5..59d58bdad7d3 100644 ---- a/fs/userfaultfd.c -+++ b/fs/userfaultfd.c -@@ -386,7 +386,7 @@ int handle_userfault(struct vm_area_struct *vma, unsigned long address, - * in such case. - */ - down_read(&mm->mmap_sem); -- ret = 0; -+ ret = VM_FAULT_NOPAGE; - } - } - -diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c -index 75884aecf920..d98ba57ef01a 100644 ---- a/fs/xfs/libxfs/xfs_bmap.c -+++ b/fs/xfs/libxfs/xfs_bmap.c -@@ -2670,7 +2670,7 @@ xfs_bmap_add_extent_unwritten_real( - &i))) - goto done; - XFS_WANT_CORRUPTED_GOTO(mp, i == 0, done); -- cur->bc_rec.b.br_state = XFS_EXT_NORM; -+ cur->bc_rec.b.br_state = new->br_state; - if ((error = xfs_btree_insert(cur, &i))) - goto done; - XFS_WANT_CORRUPTED_GOTO(mp, i == 1, done); -diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c -index 8cab78eeb0c2..b34d1685936d 100644 ---- a/fs/xfs/xfs_log_recover.c -+++ b/fs/xfs/xfs_log_recover.c -@@ -738,7 +738,7 @@ xlog_find_head( - * in the in-core log. The following number can be made tighter if - * we actually look at the block size of the filesystem. - */ -- num_scan_bblks = XLOG_TOTAL_REC_SHIFT(log); -+ num_scan_bblks = min_t(int, log_bbnum, XLOG_TOTAL_REC_SHIFT(log)); - if (head_blk >= num_scan_bblks) { - /* - * We are guaranteed that the entire check can be performed -diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h -index a25414ce2898..9779c35f8454 100644 ---- a/include/crypto/internal/hash.h -+++ b/include/crypto/internal/hash.h -@@ -83,6 +83,14 @@ int ahash_register_instance(struct crypto_template *tmpl, - struct ahash_instance *inst); - void ahash_free_instance(struct crypto_instance *inst); - -+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key, -+ unsigned int keylen); -+ -+static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) -+{ -+ return alg->setkey != shash_no_setkey; -+} -+ - int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn, - struct hash_alg_common *alg, - struct crypto_instance *inst); -diff --git a/include/linux/mlx4/device.h b/include/linux/mlx4/device.h -index d3133be12d92..7fde8af9b87e 100644 ---- a/include/linux/mlx4/device.h -+++ b/include/linux/mlx4/device.h -@@ -460,6 +460,7 @@ enum { - enum { - MLX4_INTERFACE_STATE_UP = 1 << 0, - MLX4_INTERFACE_STATE_DELETION = 1 << 1, -+ MLX4_INTERFACE_STATE_NOWAIT = 1 << 2, - }; - - #define MSTR_SM_CHANGE_MASK (MLX4_EQ_PORT_INFO_MSTR_SM_SL_CHANGE_MASK | \ -diff --git a/include/linux/mman.h b/include/linux/mman.h -index 16373c8f5f57..369bc3405a6d 100644 ---- a/include/linux/mman.h -+++ b/include/linux/mman.h -@@ -63,8 +63,9 @@ static inline int arch_validate_prot(unsigned long prot) - * ("bit1" and "bit2" must be single bits) - */ - #define _calc_vm_trans(x, bit1, bit2) \ -+ ((!(bit1) || !(bit2)) ? 0 : \ - ((bit1) <= (bit2) ? ((x) & (bit1)) * ((bit2) / (bit1)) \ -- : ((x) & (bit1)) / ((bit1) / (bit2))) -+ : ((x) & (bit1)) / ((bit1) / (bit2)))) - - /* - * Combine the mmap "prot" argument into "vm_flags" used internally. -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 8555321306fb..9982a2bcb880 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -299,7 +299,7 @@ struct t10_alua_tg_pt_gp { - struct list_head tg_pt_gp_lun_list; - struct se_lun *tg_pt_gp_alua_lun; - struct se_node_acl *tg_pt_gp_alua_nacl; -- struct delayed_work tg_pt_gp_transition_work; -+ struct work_struct tg_pt_gp_transition_work; - struct completion *tg_pt_gp_transition_complete; - }; - -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index e984f059e5fc..a996f7356216 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -441,13 +441,13 @@ static void replenish_dl_entity(struct sched_dl_entity *dl_se, - * - * This function returns true if: - * -- * runtime / (deadline - t) > dl_runtime / dl_period , -+ * runtime / (deadline - t) > dl_runtime / dl_deadline , - * - * IOW we can't recycle current parameters. - * -- * Notice that the bandwidth check is done against the period. For -+ * Notice that the bandwidth check is done against the deadline. For - * task with deadline equal to period this is the same of using -- * dl_deadline instead of dl_period in the equation above. -+ * dl_period instead of dl_deadline in the equation above. - */ - static bool dl_entity_overflow(struct sched_dl_entity *dl_se, - struct sched_dl_entity *pi_se, u64 t) -@@ -472,7 +472,7 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se, - * of anything below microseconds resolution is actually fiction - * (but still we want to give the user that illusion >;). - */ -- left = (pi_se->dl_period >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); -+ left = (pi_se->dl_deadline >> DL_SCALE) * (dl_se->runtime >> DL_SCALE); - right = ((dl_se->deadline - t) >> DL_SCALE) * - (pi_se->dl_runtime >> DL_SCALE); - -@@ -510,10 +510,15 @@ static void update_dl_entity(struct sched_dl_entity *dl_se, - } - } - -+static inline u64 dl_next_period(struct sched_dl_entity *dl_se) -+{ -+ return dl_se->deadline - dl_se->dl_deadline + dl_se->dl_period; -+} -+ - /* - * If the entity depleted all its runtime, and if we want it to sleep - * while waiting for some new execution time to become available, we -- * set the bandwidth enforcement timer to the replenishment instant -+ * set the bandwidth replenishment timer to the replenishment instant - * and try to activate it. - * - * Notice that it is important for the caller to know if the timer -@@ -535,7 +540,7 @@ static int start_dl_timer(struct task_struct *p) - * that it is actually coming from rq->clock and not from - * hrtimer's time base reading. - */ -- act = ns_to_ktime(dl_se->deadline); -+ act = ns_to_ktime(dl_next_period(dl_se)); - now = hrtimer_cb_get_time(timer); - delta = ktime_to_ns(now) - rq_clock(rq); - act = ktime_add_ns(act, delta); -@@ -699,6 +704,37 @@ void init_dl_task_timer(struct sched_dl_entity *dl_se) - timer->function = dl_task_timer; - } - -+/* -+ * During the activation, CBS checks if it can reuse the current task's -+ * runtime and period. If the deadline of the task is in the past, CBS -+ * cannot use the runtime, and so it replenishes the task. This rule -+ * works fine for implicit deadline tasks (deadline == period), and the -+ * CBS was designed for implicit deadline tasks. However, a task with -+ * constrained deadline (deadine < period) might be awakened after the -+ * deadline, but before the next period. In this case, replenishing the -+ * task would allow it to run for runtime / deadline. As in this case -+ * deadline < period, CBS enables a task to run for more than the -+ * runtime / period. In a very loaded system, this can cause a domino -+ * effect, making other tasks miss their deadlines. -+ * -+ * To avoid this problem, in the activation of a constrained deadline -+ * task after the deadline but before the next period, throttle the -+ * task and set the replenishing timer to the begin of the next period, -+ * unless it is boosted. -+ */ -+static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se) -+{ -+ struct task_struct *p = dl_task_of(dl_se); -+ struct rq *rq = rq_of_dl_rq(dl_rq_of_se(dl_se)); -+ -+ if (dl_time_before(dl_se->deadline, rq_clock(rq)) && -+ dl_time_before(rq_clock(rq), dl_next_period(dl_se))) { -+ if (unlikely(dl_se->dl_boosted || !start_dl_timer(p))) -+ return; -+ dl_se->dl_throttled = 1; -+ } -+} -+ - static - int dl_runtime_exceeded(struct sched_dl_entity *dl_se) - { -@@ -953,6 +989,11 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se) - __dequeue_dl_entity(dl_se); - } - -+static inline bool dl_is_constrained(struct sched_dl_entity *dl_se) -+{ -+ return dl_se->dl_deadline < dl_se->dl_period; -+} -+ - static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) - { - struct task_struct *pi_task = rt_mutex_get_top_task(p); -@@ -978,6 +1019,15 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) - return; - } - -+ /* -+ * Check if a constrained deadline task was activated -+ * after the deadline but before the next period. -+ * If that is the case, the task will be throttled and -+ * the replenishment timer will be set to the next period. -+ */ -+ if (!p->dl.dl_throttled && dl_is_constrained(&p->dl)) -+ dl_check_constrained_dl(&p->dl); -+ - /* - * If p is throttled, we do nothing. In fact, if it exhausted - * its budget it needs a replenishment and, since it now is on -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index faa75afcb7fe..95fefb364dab 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -1960,8 +1960,9 @@ static void pull_rt_task(struct rq *this_rq) - bool resched = false; - struct task_struct *p; - struct rq *src_rq; -+ int rt_overload_count = rt_overloaded(this_rq); - -- if (likely(!rt_overloaded(this_rq))) -+ if (likely(!rt_overload_count)) - return; - - /* -@@ -1970,6 +1971,11 @@ static void pull_rt_task(struct rq *this_rq) - */ - smp_rmb(); - -+ /* If we are the only overloaded CPU do nothing */ -+ if (rt_overload_count == 1 && -+ cpumask_test_cpu(this_rq->cpu, this_rq->rd->rto_mask)) -+ return; -+ - #ifdef HAVE_RT_PUSH_IPI - if (sched_feat(RT_PUSH_IPI)) { - tell_cpu_to_push(this_rq); -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index b64f35afee4e..61d0960559c8 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -3384,37 +3384,30 @@ static const struct file_operations show_traces_fops = { - .llseek = seq_lseek, - }; - --/* -- * The tracer itself will not take this lock, but still we want -- * to provide a consistent cpumask to user-space: -- */ --static DEFINE_MUTEX(tracing_cpumask_update_lock); -- --/* -- * Temporary storage for the character representation of the -- * CPU bitmask (and one more byte for the newline): -- */ --static char mask_str[NR_CPUS + 1]; -- - static ssize_t - tracing_cpumask_read(struct file *filp, char __user *ubuf, - size_t count, loff_t *ppos) - { - struct trace_array *tr = file_inode(filp)->i_private; -+ char *mask_str; - int len; - -- mutex_lock(&tracing_cpumask_update_lock); -+ len = snprintf(NULL, 0, "%*pb\n", -+ cpumask_pr_args(tr->tracing_cpumask)) + 1; -+ mask_str = kmalloc(len, GFP_KERNEL); -+ if (!mask_str) -+ return -ENOMEM; - -- len = snprintf(mask_str, count, "%*pb\n", -+ len = snprintf(mask_str, len, "%*pb\n", - cpumask_pr_args(tr->tracing_cpumask)); - if (len >= count) { - count = -EINVAL; - goto out_err; - } -- count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1); -+ count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len); - - out_err: -- mutex_unlock(&tracing_cpumask_update_lock); -+ kfree(mask_str); - - return count; - } -@@ -3434,8 +3427,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, - if (err) - goto err_unlock; - -- mutex_lock(&tracing_cpumask_update_lock); -- - local_irq_disable(); - arch_spin_lock(&tr->max_lock); - for_each_tracing_cpu(cpu) { -@@ -3458,8 +3449,6 @@ tracing_cpumask_write(struct file *filp, const char __user *ubuf, - local_irq_enable(); - - cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new); -- -- mutex_unlock(&tracing_cpumask_update_lock); - free_cpumask_var(tracing_cpumask_new); - - return count; -diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c -index 97fc19f001bf..55dcb2b20b59 100644 ---- a/net/bridge/br_netfilter_hooks.c -+++ b/net/bridge/br_netfilter_hooks.c -@@ -701,18 +701,20 @@ static unsigned int nf_bridge_mtu_reduction(const struct sk_buff *skb) - - static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff *skb) - { -- struct nf_bridge_info *nf_bridge; -- unsigned int mtu_reserved; -+ struct nf_bridge_info *nf_bridge = nf_bridge_info_get(skb); -+ unsigned int mtu, mtu_reserved; - - mtu_reserved = nf_bridge_mtu_reduction(skb); -+ mtu = skb->dev->mtu; -+ -+ if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) -+ mtu = nf_bridge->frag_max_size; - -- if (skb_is_gso(skb) || skb->len + mtu_reserved <= skb->dev->mtu) { -+ if (skb_is_gso(skb) || skb->len + mtu_reserved <= mtu) { - nf_bridge_info_free(skb); - return br_dev_queue_push_xmit(net, sk, skb); - } - -- nf_bridge = nf_bridge_info_get(skb); -- - /* This is wrong! We should preserve the original fragment - * boundaries by preserving frag_list rather than refragmenting. - */ -diff --git a/net/core/dev.c b/net/core/dev.c -index 630704d8d6a2..3b67c1e5756f 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1300,6 +1300,7 @@ void netdev_notify_peers(struct net_device *dev) - { - rtnl_lock(); - call_netdevice_notifiers(NETDEV_NOTIFY_PEERS, dev); -+ call_netdevice_notifiers(NETDEV_RESEND_IGMP, dev); - rtnl_unlock(); - } - EXPORT_SYMBOL(netdev_notify_peers); -diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c -index d48281ca9c72..ec8f6a6485e3 100644 ---- a/net/l2tp/l2tp_core.c -+++ b/net/l2tp/l2tp_core.c -@@ -1856,7 +1856,7 @@ static __net_exit void l2tp_exit_net(struct net *net) - - rcu_read_lock_bh(); - list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) { -- (void)l2tp_tunnel_delete(tunnel); -+ l2tp_tunnel_delete(tunnel); - } - rcu_read_unlock_bh(); - } -diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c -index 665cc74df5c5..fb3248ff8b48 100644 ---- a/net/l2tp/l2tp_netlink.c -+++ b/net/l2tp/l2tp_netlink.c -@@ -285,7 +285,7 @@ static int l2tp_nl_cmd_tunnel_delete(struct sk_buff *skb, struct genl_info *info - l2tp_tunnel_notify(&l2tp_nl_family, info, - tunnel, L2TP_CMD_TUNNEL_DELETE); - -- (void) l2tp_tunnel_delete(tunnel); -+ l2tp_tunnel_delete(tunnel); - - out: - return ret; -diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c -index 9e1ded80a992..1cbc7bd26de3 100644 ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -295,8 +295,6 @@ int mesh_add_meshconf_ie(struct ieee80211_sub_if_data *sdata, - /* Mesh PS mode. See IEEE802.11-2012 8.4.2.100.8 */ - *pos |= ifmsh->ps_peers_deep_sleep ? - IEEE80211_MESHCONF_CAPAB_POWER_SAVE_LEVEL : 0x00; -- *pos++ = 0x00; -- - return 0; - } - -diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c -index e7c1b052c2a3..2c937c16dc27 100644 ---- a/net/netfilter/ipvs/ip_vs_ctl.c -+++ b/net/netfilter/ipvs/ip_vs_ctl.c -@@ -1999,12 +1999,16 @@ static int ip_vs_info_seq_show(struct seq_file *seq, void *v) - seq_puts(seq, - " -> RemoteAddress:Port Forward Weight ActiveConn InActConn\n"); - } else { -+ struct net *net = seq_file_net(seq); -+ struct netns_ipvs *ipvs = net_ipvs(net); - const struct ip_vs_service *svc = v; - const struct ip_vs_iter *iter = seq->private; - const struct ip_vs_dest *dest; - struct ip_vs_scheduler *sched = rcu_dereference(svc->scheduler); - char *sched_name = sched ? sched->name : "none"; - -+ if (svc->ipvs != ipvs) -+ return 0; - if (iter->table == ip_vs_svc_table) { - #ifdef CONFIG_IP_VS_IPV6 - if (svc->af == AF_INET6) -diff --git a/net/socket.c b/net/socket.c -index fbfa9d2492cf..2cf4f25f5c2b 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -1697,6 +1697,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size, - /* We assume all kernel code knows the size of sockaddr_storage */ - msg.msg_namelen = 0; - msg.msg_iocb = NULL; -+ msg.msg_flags = 0; - if (sock->file->f_flags & O_NONBLOCK) - flags |= MSG_DONTWAIT; - err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags); -diff --git a/security/keys/request_key.c b/security/keys/request_key.c -index 2ce733342b5a..3ae3acf473c8 100644 ---- a/security/keys/request_key.c -+++ b/security/keys/request_key.c -@@ -250,11 +250,12 @@ static int construct_key(struct key *key, const void *callout_info, - * The keyring selected is returned with an extra reference upon it which the - * caller must release. - */ --static void construct_get_dest_keyring(struct key **_dest_keyring) -+static int construct_get_dest_keyring(struct key **_dest_keyring) - { - struct request_key_auth *rka; - const struct cred *cred = current_cred(); - struct key *dest_keyring = *_dest_keyring, *authkey; -+ int ret; - - kenter("%p", dest_keyring); - -@@ -263,6 +264,8 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) - /* the caller supplied one */ - key_get(dest_keyring); - } else { -+ bool do_perm_check = true; -+ - /* use a default keyring; falling through the cases until we - * find one that we actually have */ - switch (cred->jit_keyring) { -@@ -277,8 +280,10 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) - dest_keyring = - key_get(rka->dest_keyring); - up_read(&authkey->sem); -- if (dest_keyring) -+ if (dest_keyring) { -+ do_perm_check = false; - break; -+ } - } - - case KEY_REQKEY_DEFL_THREAD_KEYRING: -@@ -313,11 +318,29 @@ static void construct_get_dest_keyring(struct key **_dest_keyring) - default: - BUG(); - } -+ -+ /* -+ * Require Write permission on the keyring. This is essential -+ * because the default keyring may be the session keyring, and -+ * joining a keyring only requires Search permission. -+ * -+ * However, this check is skipped for the "requestor keyring" so -+ * that /sbin/request-key can itself use request_key() to add -+ * keys to the original requestor's destination keyring. -+ */ -+ if (dest_keyring && do_perm_check) { -+ ret = key_permission(make_key_ref(dest_keyring, 1), -+ KEY_NEED_WRITE); -+ if (ret) { -+ key_put(dest_keyring); -+ return ret; -+ } -+ } - } - - *_dest_keyring = dest_keyring; - kleave(" [dk %d]", key_serial(dest_keyring)); -- return; -+ return 0; - } - - /* -@@ -442,12 +465,16 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, - - if (ctx->index_key.type == &key_type_keyring) - return ERR_PTR(-EPERM); -- -- user = key_user_lookup(current_fsuid()); -- if (!user) -- return ERR_PTR(-ENOMEM); - -- construct_get_dest_keyring(&dest_keyring); -+ ret = construct_get_dest_keyring(&dest_keyring); -+ if (ret) -+ goto error; -+ -+ user = key_user_lookup(current_fsuid()); -+ if (!user) { -+ ret = -ENOMEM; -+ goto error_put_dest_keyring; -+ } - - ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key); - key_user_put(user); -@@ -462,7 +489,7 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, - } else if (ret == -EINPROGRESS) { - ret = 0; - } else { -- goto couldnt_alloc_key; -+ goto error_put_dest_keyring; - } - - key_put(dest_keyring); -@@ -472,8 +499,9 @@ static struct key *construct_key_and_link(struct keyring_search_context *ctx, - construction_failed: - key_negate_and_link(key, key_negative_timeout, NULL, NULL); - key_put(key); --couldnt_alloc_key: -+error_put_dest_keyring: - key_put(dest_keyring); -+error: - kleave(" = %d", ret); - return ERR_PTR(ret); - } -diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c -index 520a32a12f8a..415be561fad3 100644 ---- a/tools/perf/util/symbol.c -+++ b/tools/perf/util/symbol.c -@@ -200,7 +200,7 @@ void symbols__fixup_end(struct rb_root *symbols) - - /* Last entry */ - if (curr->end == curr->start) -- curr->end = roundup(curr->start, 4096); -+ curr->end = roundup(curr->start, 4096) + 4096; - } - - void __map_groups__fixup_end(struct map_groups *mg, enum map_type type) -diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile -index e4bb1de1d526..b5f08e8cab33 100644 ---- a/tools/testing/selftests/vm/Makefile -+++ b/tools/testing/selftests/vm/Makefile -@@ -1,5 +1,9 @@ - # Makefile for vm selftests - -+ifndef OUTPUT -+ OUTPUT := $(shell pwd) -+endif -+ - CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS) - BINARIES = compaction_test - BINARIES += hugepage-mmap diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.107-108.patch b/patch/kernel/mvebu64-default/04-patch-4.4.107-108.patch deleted file mode 100644 index 074c45465b92..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.107-108.patch +++ /dev/null @@ -1,2623 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 7c77d7edb851..5d593ecadb90 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2519,6 +2519,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nointroute [IA-64] - -+ noinvpcid [X86] Disable the INVPCID cpu feature. -+ - nojitter [IA-64] Disables jitter checking for ITC timers. - - no-kvmclock [X86,KVM] Disable paravirtualized KVM clock driver -diff --git a/Makefile b/Makefile -index f7997b15d055..99f9834c4ba6 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 107 -+SUBLEVEL = 108 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/include/asm/mmu_context.h b/arch/alpha/include/asm/mmu_context.h -index 4c51c05333c6..4cafffa80e2c 100644 ---- a/arch/alpha/include/asm/mmu_context.h -+++ b/arch/alpha/include/asm/mmu_context.h -@@ -7,6 +7,7 @@ - * Copyright (C) 1996, Linus Torvalds - */ - -+#include - #include - #include - #include -diff --git a/arch/arm/boot/dts/am335x-evmsk.dts b/arch/arm/boot/dts/am335x-evmsk.dts -index 89442e98a837..3af570517903 100644 ---- a/arch/arm/boot/dts/am335x-evmsk.dts -+++ b/arch/arm/boot/dts/am335x-evmsk.dts -@@ -668,6 +668,7 @@ - ti,non-removable; - bus-width = <4>; - cap-power-off-card; -+ keep-power-in-suspend; - pinctrl-names = "default"; - pinctrl-0 = <&mmc2_pins>; - -diff --git a/arch/arm/boot/dts/dra7.dtsi b/arch/arm/boot/dts/dra7.dtsi -index c2a03c740e79..02bd6312d1d9 100644 ---- a/arch/arm/boot/dts/dra7.dtsi -+++ b/arch/arm/boot/dts/dra7.dtsi -@@ -227,6 +227,7 @@ - device_type = "pci"; - ranges = <0x81000000 0 0 0x03000 0 0x00010000 - 0x82000000 0 0x20013000 0x13000 0 0xffed000>; -+ bus-range = <0x00 0xff>; - #interrupt-cells = <1>; - num-lanes = <1>; - ti,hwmods = "pcie1"; -@@ -262,6 +263,7 @@ - device_type = "pci"; - ranges = <0x81000000 0 0 0x03000 0 0x00010000 - 0x82000000 0 0x30013000 0x13000 0 0xffed000>; -+ bus-range = <0x00 0xff>; - #interrupt-cells = <1>; - num-lanes = <1>; - ti,hwmods = "pcie2"; -diff --git a/arch/arm/include/asm/mmu_context.h b/arch/arm/include/asm/mmu_context.h -index 9b32f76bb0dd..10f662498eb7 100644 ---- a/arch/arm/include/asm/mmu_context.h -+++ b/arch/arm/include/asm/mmu_context.h -@@ -61,6 +61,7 @@ static inline void check_and_switch_context(struct mm_struct *mm, - cpu_switch_mm(mm->pgd, mm); - } - -+#ifndef MODULE - #define finish_arch_post_lock_switch \ - finish_arch_post_lock_switch - static inline void finish_arch_post_lock_switch(void) -@@ -82,6 +83,7 @@ static inline void finish_arch_post_lock_switch(void) - preempt_enable_no_resched(); - } - } -+#endif /* !MODULE */ - - #endif /* CONFIG_MMU */ - -diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c -index 534a60ae282e..613c1d06316a 100644 ---- a/arch/arm/mm/dma-mapping.c -+++ b/arch/arm/mm/dma-mapping.c -@@ -774,13 +774,31 @@ static void arm_coherent_dma_free(struct device *dev, size_t size, void *cpu_add - __arm_dma_free(dev, size, cpu_addr, handle, attrs, true); - } - -+/* -+ * The whole dma_get_sgtable() idea is fundamentally unsafe - it seems -+ * that the intention is to allow exporting memory allocated via the -+ * coherent DMA APIs through the dma_buf API, which only accepts a -+ * scattertable. This presents a couple of problems: -+ * 1. Not all memory allocated via the coherent DMA APIs is backed by -+ * a struct page -+ * 2. Passing coherent DMA memory into the streaming APIs is not allowed -+ * as we will try to flush the memory through a different alias to that -+ * actually being used (and the flushes are redundant.) -+ */ - int arm_dma_get_sgtable(struct device *dev, struct sg_table *sgt, - void *cpu_addr, dma_addr_t handle, size_t size, - struct dma_attrs *attrs) - { -- struct page *page = pfn_to_page(dma_to_pfn(dev, handle)); -+ unsigned long pfn = dma_to_pfn(dev, handle); -+ struct page *page; - int ret; - -+ /* If the PFN is not valid, we do not have a struct page */ -+ if (!pfn_valid(pfn)) -+ return -ENXIO; -+ -+ page = pfn_to_page(pfn); -+ - ret = sg_alloc_table(sgt, 1, GFP_KERNEL); - if (unlikely(ret)) - return ret; -diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c -index a4ec240ee7ba..3eb018fa1a1f 100644 ---- a/arch/arm/probes/kprobes/core.c -+++ b/arch/arm/probes/kprobes/core.c -@@ -433,6 +433,7 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs) - struct hlist_node *tmp; - unsigned long flags, orig_ret_address = 0; - unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline; -+ kprobe_opcode_t *correct_ret_addr = NULL; - - INIT_HLIST_HEAD(&empty_rp); - kretprobe_hash_lock(current, &head, &flags); -@@ -455,14 +456,34 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs) - /* another task is sharing our hash bucket */ - continue; - -+ orig_ret_address = (unsigned long)ri->ret_addr; -+ -+ if (orig_ret_address != trampoline_address) -+ /* -+ * This is the real return address. Any other -+ * instances associated with this task are for -+ * other calls deeper on the call stack -+ */ -+ break; -+ } -+ -+ kretprobe_assert(ri, orig_ret_address, trampoline_address); -+ -+ correct_ret_addr = ri->ret_addr; -+ hlist_for_each_entry_safe(ri, tmp, head, hlist) { -+ if (ri->task != current) -+ /* another task is sharing our hash bucket */ -+ continue; -+ -+ orig_ret_address = (unsigned long)ri->ret_addr; - if (ri->rp && ri->rp->handler) { - __this_cpu_write(current_kprobe, &ri->rp->kp); - get_kprobe_ctlblk()->kprobe_status = KPROBE_HIT_ACTIVE; -+ ri->ret_addr = correct_ret_addr; - ri->rp->handler(ri, regs); - __this_cpu_write(current_kprobe, NULL); - } - -- orig_ret_address = (unsigned long)ri->ret_addr; - recycle_rp_inst(ri, &empty_rp); - - if (orig_ret_address != trampoline_address) -@@ -474,7 +495,6 @@ static __used __kprobes void *trampoline_handler(struct pt_regs *regs) - break; - } - -- kretprobe_assert(ri, orig_ret_address, trampoline_address); - kretprobe_hash_unlock(current, &flags); - - hlist_for_each_entry_safe(ri, tmp, &empty_rp, hlist) { -diff --git a/arch/arm/probes/kprobes/test-core.c b/arch/arm/probes/kprobes/test-core.c -index 9775de22e2ff..a48354de1aa1 100644 ---- a/arch/arm/probes/kprobes/test-core.c -+++ b/arch/arm/probes/kprobes/test-core.c -@@ -976,7 +976,10 @@ static void coverage_end(void) - void __naked __kprobes_test_case_start(void) - { - __asm__ __volatile__ ( -- "stmdb sp!, {r4-r11} \n\t" -+ "mov r2, sp \n\t" -+ "bic r3, r2, #7 \n\t" -+ "mov sp, r3 \n\t" -+ "stmdb sp!, {r2-r11} \n\t" - "sub sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" - "bic r0, lr, #1 @ r0 = inline data \n\t" - "mov r1, sp \n\t" -@@ -996,7 +999,8 @@ void __naked __kprobes_test_case_end_32(void) - "movne pc, r0 \n\t" - "mov r0, r4 \n\t" - "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" -- "ldmia sp!, {r4-r11} \n\t" -+ "ldmia sp!, {r2-r11} \n\t" -+ "mov sp, r2 \n\t" - "mov pc, r0 \n\t" - ); - } -@@ -1012,7 +1016,8 @@ void __naked __kprobes_test_case_end_16(void) - "bxne r0 \n\t" - "mov r0, r4 \n\t" - "add sp, sp, #"__stringify(TEST_MEMORY_SIZE)"\n\t" -- "ldmia sp!, {r4-r11} \n\t" -+ "ldmia sp!, {r2-r11} \n\t" -+ "mov sp, r2 \n\t" - "bx r0 \n\t" - ); - } -diff --git a/arch/arm64/mm/init.c b/arch/arm64/mm/init.c -index 4cb98aa8c27b..efd89ce4533d 100644 ---- a/arch/arm64/mm/init.c -+++ b/arch/arm64/mm/init.c -@@ -178,6 +178,7 @@ void __init arm64_memblock_init(void) - arm64_dma_phys_limit = max_zone_dma_phys(); - else - arm64_dma_phys_limit = PHYS_MASK + 1; -+ high_memory = __va(memblock_end_of_DRAM() - 1) + 1; - dma_contiguous_reserve(arm64_dma_phys_limit); - - memblock_allow_resize(); -@@ -202,7 +203,6 @@ void __init bootmem_init(void) - sparse_init(); - zone_sizes_init(min, max); - -- high_memory = __va((max << PAGE_SHIFT) - 1) + 1; - max_pfn = max_low_pfn = max; - } - -diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c -index dd058aa8a3b5..89d05de8040a 100644 ---- a/arch/mips/math-emu/cp1emu.c -+++ b/arch/mips/math-emu/cp1emu.c -@@ -1777,7 +1777,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(fs, MIPSInst_FS(ir)); - SPFROMREG(fd, MIPSInst_FD(ir)); - rv.s = ieee754sp_maddf(fd, fs, ft); -- break; -+ goto copcsr; - } - - case fmsubf_op: { -@@ -1790,7 +1790,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(fs, MIPSInst_FS(ir)); - SPFROMREG(fd, MIPSInst_FD(ir)); - rv.s = ieee754sp_msubf(fd, fs, ft); -- break; -+ goto copcsr; - } - - case frint_op: { -@@ -1814,7 +1814,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(fs, MIPSInst_FS(ir)); - rv.w = ieee754sp_2008class(fs); - rfmt = w_fmt; -- break; -+ goto copcsr; - } - - case fmin_op: { -@@ -1826,7 +1826,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(ft, MIPSInst_FT(ir)); - SPFROMREG(fs, MIPSInst_FS(ir)); - rv.s = ieee754sp_fmin(fs, ft); -- break; -+ goto copcsr; - } - - case fmina_op: { -@@ -1838,7 +1838,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(ft, MIPSInst_FT(ir)); - SPFROMREG(fs, MIPSInst_FS(ir)); - rv.s = ieee754sp_fmina(fs, ft); -- break; -+ goto copcsr; - } - - case fmax_op: { -@@ -1850,7 +1850,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(ft, MIPSInst_FT(ir)); - SPFROMREG(fs, MIPSInst_FS(ir)); - rv.s = ieee754sp_fmax(fs, ft); -- break; -+ goto copcsr; - } - - case fmaxa_op: { -@@ -1862,7 +1862,7 @@ static int fpu_emu(struct pt_regs *xcp, struct mips_fpu_struct *ctx, - SPFROMREG(ft, MIPSInst_FT(ir)); - SPFROMREG(fs, MIPSInst_FS(ir)); - rv.s = ieee754sp_fmaxa(fs, ft); -- break; -+ goto copcsr; - } - - case fabs_op: -@@ -2095,7 +2095,7 @@ copcsr: - DPFROMREG(fs, MIPSInst_FS(ir)); - DPFROMREG(fd, MIPSInst_FD(ir)); - rv.d = ieee754dp_maddf(fd, fs, ft); -- break; -+ goto copcsr; - } - - case fmsubf_op: { -@@ -2108,7 +2108,7 @@ copcsr: - DPFROMREG(fs, MIPSInst_FS(ir)); - DPFROMREG(fd, MIPSInst_FD(ir)); - rv.d = ieee754dp_msubf(fd, fs, ft); -- break; -+ goto copcsr; - } - - case frint_op: { -@@ -2132,7 +2132,7 @@ copcsr: - DPFROMREG(fs, MIPSInst_FS(ir)); - rv.w = ieee754dp_2008class(fs); - rfmt = w_fmt; -- break; -+ goto copcsr; - } - - case fmin_op: { -@@ -2144,7 +2144,7 @@ copcsr: - DPFROMREG(ft, MIPSInst_FT(ir)); - DPFROMREG(fs, MIPSInst_FS(ir)); - rv.d = ieee754dp_fmin(fs, ft); -- break; -+ goto copcsr; - } - - case fmina_op: { -@@ -2156,7 +2156,7 @@ copcsr: - DPFROMREG(ft, MIPSInst_FT(ir)); - DPFROMREG(fs, MIPSInst_FS(ir)); - rv.d = ieee754dp_fmina(fs, ft); -- break; -+ goto copcsr; - } - - case fmax_op: { -@@ -2168,7 +2168,7 @@ copcsr: - DPFROMREG(ft, MIPSInst_FT(ir)); - DPFROMREG(fs, MIPSInst_FS(ir)); - rv.d = ieee754dp_fmax(fs, ft); -- break; -+ goto copcsr; - } - - case fmaxa_op: { -@@ -2180,7 +2180,7 @@ copcsr: - DPFROMREG(ft, MIPSInst_FT(ir)); - DPFROMREG(fs, MIPSInst_FS(ir)); - rv.d = ieee754dp_fmaxa(fs, ft); -- break; -+ goto copcsr; - } - - case fabs_op: -diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h -index 7178043b0e1d..59405a248fc2 100644 ---- a/arch/x86/include/asm/hardirq.h -+++ b/arch/x86/include/asm/hardirq.h -@@ -22,10 +22,6 @@ typedef struct { - #ifdef CONFIG_SMP - unsigned int irq_resched_count; - unsigned int irq_call_count; -- /* -- * irq_tlb_count is double-counted in irq_call_count, so it must be -- * subtracted from irq_call_count when displaying irq_call_count -- */ - unsigned int irq_tlb_count; - #endif - #ifdef CONFIG_X86_THERMAL_VECTOR -diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h -index bfd9b2a35a0b..44fc93987869 100644 ---- a/arch/x86/include/asm/mmu_context.h -+++ b/arch/x86/include/asm/mmu_context.h -@@ -104,103 +104,12 @@ static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) - #endif - } - --static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next, -- struct task_struct *tsk) --{ -- unsigned cpu = smp_processor_id(); -- -- if (likely(prev != next)) { --#ifdef CONFIG_SMP -- this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); -- this_cpu_write(cpu_tlbstate.active_mm, next); --#endif -- cpumask_set_cpu(cpu, mm_cpumask(next)); -- -- /* -- * Re-load page tables. -- * -- * This logic has an ordering constraint: -- * -- * CPU 0: Write to a PTE for 'next' -- * CPU 0: load bit 1 in mm_cpumask. if nonzero, send IPI. -- * CPU 1: set bit 1 in next's mm_cpumask -- * CPU 1: load from the PTE that CPU 0 writes (implicit) -- * -- * We need to prevent an outcome in which CPU 1 observes -- * the new PTE value and CPU 0 observes bit 1 clear in -- * mm_cpumask. (If that occurs, then the IPI will never -- * be sent, and CPU 0's TLB will contain a stale entry.) -- * -- * The bad outcome can occur if either CPU's load is -- * reordered before that CPU's store, so both CPUs must -- * execute full barriers to prevent this from happening. -- * -- * Thus, switch_mm needs a full barrier between the -- * store to mm_cpumask and any operation that could load -- * from next->pgd. TLB fills are special and can happen -- * due to instruction fetches or for no reason at all, -- * and neither LOCK nor MFENCE orders them. -- * Fortunately, load_cr3() is serializing and gives the -- * ordering guarantee we need. -- * -- */ -- load_cr3(next->pgd); -- -- trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); -- -- /* Stop flush ipis for the previous mm */ -- cpumask_clear_cpu(cpu, mm_cpumask(prev)); -- -- /* Load per-mm CR4 state */ -- load_mm_cr4(next); -+extern void switch_mm(struct mm_struct *prev, struct mm_struct *next, -+ struct task_struct *tsk); - --#ifdef CONFIG_MODIFY_LDT_SYSCALL -- /* -- * Load the LDT, if the LDT is different. -- * -- * It's possible that prev->context.ldt doesn't match -- * the LDT register. This can happen if leave_mm(prev) -- * was called and then modify_ldt changed -- * prev->context.ldt but suppressed an IPI to this CPU. -- * In this case, prev->context.ldt != NULL, because we -- * never set context.ldt to NULL while the mm still -- * exists. That means that next->context.ldt != -- * prev->context.ldt, because mms never share an LDT. -- */ -- if (unlikely(prev->context.ldt != next->context.ldt)) -- load_mm_ldt(next); --#endif -- } --#ifdef CONFIG_SMP -- else { -- this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); -- BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); -- -- if (!cpumask_test_cpu(cpu, mm_cpumask(next))) { -- /* -- * On established mms, the mm_cpumask is only changed -- * from irq context, from ptep_clear_flush() while in -- * lazy tlb mode, and here. Irqs are blocked during -- * schedule, protecting us from simultaneous changes. -- */ -- cpumask_set_cpu(cpu, mm_cpumask(next)); -- -- /* -- * We were in lazy tlb mode and leave_mm disabled -- * tlb flush IPI delivery. We must reload CR3 -- * to make sure to use no freed page tables. -- * -- * As above, load_cr3() is serializing and orders TLB -- * fills with respect to the mm_cpumask write. -- */ -- load_cr3(next->pgd); -- trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); -- load_mm_cr4(next); -- load_mm_ldt(next); -- } -- } --#endif --} -+extern void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, -+ struct task_struct *tsk); -+#define switch_mm_irqs_off switch_mm_irqs_off - - #define activate_mm(prev, next) \ - do { \ -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 6433e28dc9c8..4dc534175b5e 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -7,6 +7,54 @@ - #include - #include - -+static inline void __invpcid(unsigned long pcid, unsigned long addr, -+ unsigned long type) -+{ -+ struct { u64 d[2]; } desc = { { pcid, addr } }; -+ -+ /* -+ * The memory clobber is because the whole point is to invalidate -+ * stale TLB entries and, especially if we're flushing global -+ * mappings, we don't want the compiler to reorder any subsequent -+ * memory accesses before the TLB flush. -+ * -+ * The hex opcode is invpcid (%ecx), %eax in 32-bit mode and -+ * invpcid (%rcx), %rax in long mode. -+ */ -+ asm volatile (".byte 0x66, 0x0f, 0x38, 0x82, 0x01" -+ : : "m" (desc), "a" (type), "c" (&desc) : "memory"); -+} -+ -+#define INVPCID_TYPE_INDIV_ADDR 0 -+#define INVPCID_TYPE_SINGLE_CTXT 1 -+#define INVPCID_TYPE_ALL_INCL_GLOBAL 2 -+#define INVPCID_TYPE_ALL_NON_GLOBAL 3 -+ -+/* Flush all mappings for a given pcid and addr, not including globals. */ -+static inline void invpcid_flush_one(unsigned long pcid, -+ unsigned long addr) -+{ -+ __invpcid(pcid, addr, INVPCID_TYPE_INDIV_ADDR); -+} -+ -+/* Flush all mappings for a given PCID, not including globals. */ -+static inline void invpcid_flush_single_context(unsigned long pcid) -+{ -+ __invpcid(pcid, 0, INVPCID_TYPE_SINGLE_CTXT); -+} -+ -+/* Flush all mappings, including globals, for all PCIDs. */ -+static inline void invpcid_flush_all(void) -+{ -+ __invpcid(0, 0, INVPCID_TYPE_ALL_INCL_GLOBAL); -+} -+ -+/* Flush all mappings for all PCIDs except globals. */ -+static inline void invpcid_flush_all_nonglobals(void) -+{ -+ __invpcid(0, 0, INVPCID_TYPE_ALL_NON_GLOBAL); -+} -+ - #ifdef CONFIG_PARAVIRT - #include - #else -@@ -111,6 +159,15 @@ static inline void __native_flush_tlb_global(void) - { - unsigned long flags; - -+ if (static_cpu_has(X86_FEATURE_INVPCID)) { -+ /* -+ * Using INVPCID is considerably faster than a pair of writes -+ * to CR4 sandwiched inside an IRQ flag save/restore. -+ */ -+ invpcid_flush_all(); -+ return; -+ } -+ - /* - * Read-modify-write to CR4 - protect it from preemption and - * from interrupts. (Use the raw variant because this code can -@@ -268,12 +325,6 @@ static inline void reset_lazy_tlbstate(void) - - #endif /* SMP */ - --/* Not inlined due to inc_irq_stat not being defined yet */ --#define flush_tlb_local() { \ -- inc_irq_stat(irq_tlb_count); \ -- local_flush_tlb(); \ --} -- - #ifndef CONFIG_PARAVIRT - #define flush_tlb_others(mask, mm, start, end) \ - native_flush_tlb_others(mask, mm, start, end) -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index 637ca414d431..c84b62956e8d 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -162,6 +162,22 @@ static int __init x86_mpx_setup(char *s) - } - __setup("nompx", x86_mpx_setup); - -+static int __init x86_noinvpcid_setup(char *s) -+{ -+ /* noinvpcid doesn't accept parameters */ -+ if (s) -+ return -EINVAL; -+ -+ /* do not emit a message if the feature is not present */ -+ if (!boot_cpu_has(X86_FEATURE_INVPCID)) -+ return 0; -+ -+ setup_clear_cpu_cap(X86_FEATURE_INVPCID); -+ pr_info("noinvpcid: INVPCID feature disabled\n"); -+ return 0; -+} -+early_param("noinvpcid", x86_noinvpcid_setup); -+ - #ifdef CONFIG_X86_32 - static int cachesize_override = -1; - static int disable_x86_serial_nr = 1; -diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c -index 61521dc19c10..9f669fdd2010 100644 ---- a/arch/x86/kernel/irq.c -+++ b/arch/x86/kernel/irq.c -@@ -102,8 +102,7 @@ int arch_show_interrupts(struct seq_file *p, int prec) - seq_puts(p, " Rescheduling interrupts\n"); - seq_printf(p, "%*s: ", prec, "CAL"); - for_each_online_cpu(j) -- seq_printf(p, "%10u ", irq_stats(j)->irq_call_count - -- irq_stats(j)->irq_tlb_count); -+ seq_printf(p, "%10u ", irq_stats(j)->irq_call_count); - seq_puts(p, " Function call interrupts\n"); - seq_printf(p, "%*s: ", prec, "TLB"); - for_each_online_cpu(j) -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index dcbafe53e2d4..d915185ada05 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -1107,6 +1107,11 @@ static inline bool cpu_has_vmx_invvpid_global(void) - return vmx_capability.vpid & VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT; - } - -+static inline bool cpu_has_vmx_invvpid(void) -+{ -+ return vmx_capability.vpid & VMX_VPID_INVVPID_BIT; -+} -+ - static inline bool cpu_has_vmx_ept(void) - { - return vmcs_config.cpu_based_2nd_exec_ctrl & -@@ -6199,8 +6204,10 @@ static __init int hardware_setup(void) - if (boot_cpu_has(X86_FEATURE_NX)) - kvm_enable_efer_bits(EFER_NX); - -- if (!cpu_has_vmx_vpid()) -+ if (!cpu_has_vmx_vpid() || !cpu_has_vmx_invvpid() || -+ !(cpu_has_vmx_invvpid_single() || cpu_has_vmx_invvpid_global())) - enable_vpid = 0; -+ - if (!cpu_has_vmx_shadow_vmcs()) - enable_shadow_vmcs = 0; - if (enable_shadow_vmcs) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index df81717a92f3..e5f44f33de89 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -8230,11 +8230,11 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu, - { - struct x86_exception fault; - -- trace_kvm_async_pf_ready(work->arch.token, work->gva); - if (work->wakeup_all) - work->arch.token = ~0; /* broadcast wakeup */ - else - kvm_del_async_pf_gfn(vcpu, work->arch.gfn); -+ trace_kvm_async_pf_ready(work->arch.token, work->gva); - - if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) && - !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) { -diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile -index 65c47fda26fc..1ae7c141f778 100644 ---- a/arch/x86/mm/Makefile -+++ b/arch/x86/mm/Makefile -@@ -1,5 +1,5 @@ - obj-y := init.o init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \ -- pat.o pgtable.o physaddr.o gup.o setup_nx.o -+ pat.o pgtable.o physaddr.o gup.o setup_nx.o tlb.o - - # Make sure __phys_addr has no stackprotector - nostackp := $(call cc-option, -fno-stack-protector) -@@ -9,7 +9,6 @@ CFLAGS_setup_nx.o := $(nostackp) - CFLAGS_fault.o := -I$(src)/../include/asm/trace - - obj-$(CONFIG_X86_PAT) += pat_rbtree.o --obj-$(CONFIG_SMP) += tlb.o - - obj-$(CONFIG_X86_32) += pgtable_32.o iomap_32.o - -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 5a760fd66bec..45ba87466e6a 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -28,6 +28,8 @@ - * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi - */ - -+#ifdef CONFIG_SMP -+ - struct flush_tlb_info { - struct mm_struct *flush_mm; - unsigned long flush_start; -@@ -57,6 +59,118 @@ void leave_mm(int cpu) - } - EXPORT_SYMBOL_GPL(leave_mm); - -+#endif /* CONFIG_SMP */ -+ -+void switch_mm(struct mm_struct *prev, struct mm_struct *next, -+ struct task_struct *tsk) -+{ -+ unsigned long flags; -+ -+ local_irq_save(flags); -+ switch_mm_irqs_off(prev, next, tsk); -+ local_irq_restore(flags); -+} -+ -+void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, -+ struct task_struct *tsk) -+{ -+ unsigned cpu = smp_processor_id(); -+ -+ if (likely(prev != next)) { -+#ifdef CONFIG_SMP -+ this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); -+ this_cpu_write(cpu_tlbstate.active_mm, next); -+#endif -+ cpumask_set_cpu(cpu, mm_cpumask(next)); -+ -+ /* -+ * Re-load page tables. -+ * -+ * This logic has an ordering constraint: -+ * -+ * CPU 0: Write to a PTE for 'next' -+ * CPU 0: load bit 1 in mm_cpumask. if nonzero, send IPI. -+ * CPU 1: set bit 1 in next's mm_cpumask -+ * CPU 1: load from the PTE that CPU 0 writes (implicit) -+ * -+ * We need to prevent an outcome in which CPU 1 observes -+ * the new PTE value and CPU 0 observes bit 1 clear in -+ * mm_cpumask. (If that occurs, then the IPI will never -+ * be sent, and CPU 0's TLB will contain a stale entry.) -+ * -+ * The bad outcome can occur if either CPU's load is -+ * reordered before that CPU's store, so both CPUs must -+ * execute full barriers to prevent this from happening. -+ * -+ * Thus, switch_mm needs a full barrier between the -+ * store to mm_cpumask and any operation that could load -+ * from next->pgd. TLB fills are special and can happen -+ * due to instruction fetches or for no reason at all, -+ * and neither LOCK nor MFENCE orders them. -+ * Fortunately, load_cr3() is serializing and gives the -+ * ordering guarantee we need. -+ * -+ */ -+ load_cr3(next->pgd); -+ -+ trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); -+ -+ /* Stop flush ipis for the previous mm */ -+ cpumask_clear_cpu(cpu, mm_cpumask(prev)); -+ -+ /* Load per-mm CR4 state */ -+ load_mm_cr4(next); -+ -+#ifdef CONFIG_MODIFY_LDT_SYSCALL -+ /* -+ * Load the LDT, if the LDT is different. -+ * -+ * It's possible that prev->context.ldt doesn't match -+ * the LDT register. This can happen if leave_mm(prev) -+ * was called and then modify_ldt changed -+ * prev->context.ldt but suppressed an IPI to this CPU. -+ * In this case, prev->context.ldt != NULL, because we -+ * never set context.ldt to NULL while the mm still -+ * exists. That means that next->context.ldt != -+ * prev->context.ldt, because mms never share an LDT. -+ */ -+ if (unlikely(prev->context.ldt != next->context.ldt)) -+ load_mm_ldt(next); -+#endif -+ } -+#ifdef CONFIG_SMP -+ else { -+ this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); -+ BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); -+ -+ if (!cpumask_test_cpu(cpu, mm_cpumask(next))) { -+ /* -+ * On established mms, the mm_cpumask is only changed -+ * from irq context, from ptep_clear_flush() while in -+ * lazy tlb mode, and here. Irqs are blocked during -+ * schedule, protecting us from simultaneous changes. -+ */ -+ cpumask_set_cpu(cpu, mm_cpumask(next)); -+ -+ /* -+ * We were in lazy tlb mode and leave_mm disabled -+ * tlb flush IPI delivery. We must reload CR3 -+ * to make sure to use no freed page tables. -+ * -+ * As above, load_cr3() is serializing and orders TLB -+ * fills with respect to the mm_cpumask write. -+ */ -+ load_cr3(next->pgd); -+ trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); -+ load_mm_cr4(next); -+ load_mm_ldt(next); -+ } -+ } -+#endif -+} -+ -+#ifdef CONFIG_SMP -+ - /* - * The flush IPI assumes that a thread switch happens in this order: - * [cpu0: the cpu that switches] -@@ -104,7 +218,7 @@ static void flush_tlb_func(void *info) - - inc_irq_stat(irq_tlb_count); - -- if (f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm)) -+ if (f->flush_mm && f->flush_mm != this_cpu_read(cpu_tlbstate.active_mm)) - return; - - count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); -@@ -351,3 +465,5 @@ static int __init create_tlb_single_page_flush_ceiling(void) - return 0; - } - late_initcall(create_tlb_single_page_flush_ceiling); -+ -+#endif /* CONFIG_SMP */ -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index ce120fbe229e..1ccad79ce77c 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -1050,10 +1050,6 @@ static int btusb_open(struct hci_dev *hdev) - return err; - - data->intf->needs_remote_wakeup = 1; -- /* device specific wakeup source enabled and required for USB -- * remote wakeup while host is suspended -- */ -- device_wakeup_enable(&data->udev->dev); - - if (test_and_set_bit(BTUSB_INTR_RUNNING, &data->flags)) - goto done; -@@ -1117,7 +1113,6 @@ static int btusb_close(struct hci_dev *hdev) - goto failed; - - data->intf->needs_remote_wakeup = 0; -- device_wakeup_disable(&data->udev->dev); - usb_autopm_put_interface(data->intf); - - failed: -diff --git a/drivers/cpuidle/cpuidle-powernv.c b/drivers/cpuidle/cpuidle-powernv.c -index 845bafcfa792..d5c5a476360f 100644 ---- a/drivers/cpuidle/cpuidle-powernv.c -+++ b/drivers/cpuidle/cpuidle-powernv.c -@@ -160,6 +160,24 @@ static int powernv_cpuidle_driver_init(void) - drv->state_count += 1; - } - -+ /* -+ * On the PowerNV platform cpu_present may be less than cpu_possible in -+ * cases when firmware detects the CPU, but it is not available to the -+ * OS. If CONFIG_HOTPLUG_CPU=n, then such CPUs are not hotplugable at -+ * run time and hence cpu_devices are not created for those CPUs by the -+ * generic topology_init(). -+ * -+ * drv->cpumask defaults to cpu_possible_mask in -+ * __cpuidle_driver_init(). This breaks cpuidle on PowerNV where -+ * cpu_devices are not created for CPUs in cpu_possible_mask that -+ * cannot be hot-added later at run time. -+ * -+ * Trying cpuidle_register_device() on a CPU without a cpu_device is -+ * incorrect, so pass a correct CPU mask to the generic cpuidle driver. -+ */ -+ -+ drv->cpumask = (struct cpumask *)cpu_present_mask; -+ - return 0; - } - -diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c -index d40b2c077746..f1dd0f73820d 100644 ---- a/drivers/cpuidle/cpuidle.c -+++ b/drivers/cpuidle/cpuidle.c -@@ -189,6 +189,7 @@ int cpuidle_enter_state(struct cpuidle_device *dev, struct cpuidle_driver *drv, - return -EBUSY; - } - target_state = &drv->states[index]; -+ broadcast = false; - } - - /* Take note of the planned idle state. */ -diff --git a/drivers/cpuidle/sysfs.c b/drivers/cpuidle/sysfs.c -index 832a2c3f01ff..9e98a5fbbc1d 100644 ---- a/drivers/cpuidle/sysfs.c -+++ b/drivers/cpuidle/sysfs.c -@@ -613,6 +613,18 @@ int cpuidle_add_sysfs(struct cpuidle_device *dev) - struct device *cpu_dev = get_cpu_device((unsigned long)dev->cpu); - int error; - -+ /* -+ * Return if cpu_device is not setup for this CPU. -+ * -+ * This could happen if the arch did not set up cpu_device -+ * since this CPU is not in cpu_present mask and the -+ * driver did not send a correct CPU mask during registration. -+ * Without this check we would end up passing bogus -+ * value for &cpu_dev->kobj in kobject_init_and_add() -+ */ -+ if (!cpu_dev) -+ return -ENODEV; -+ - kdev = kzalloc(sizeof(*kdev), GFP_KERNEL); - if (!kdev) - return -ENOMEM; -diff --git a/drivers/crypto/amcc/crypto4xx_core.h b/drivers/crypto/amcc/crypto4xx_core.h -index bac0bdeb4b5f..b6529b9fcbe2 100644 ---- a/drivers/crypto/amcc/crypto4xx_core.h -+++ b/drivers/crypto/amcc/crypto4xx_core.h -@@ -32,12 +32,12 @@ - #define PPC405EX_CE_RESET 0x00000008 - - #define CRYPTO4XX_CRYPTO_PRIORITY 300 --#define PPC4XX_LAST_PD 63 --#define PPC4XX_NUM_PD 64 --#define PPC4XX_LAST_GD 1023 -+#define PPC4XX_NUM_PD 256 -+#define PPC4XX_LAST_PD (PPC4XX_NUM_PD - 1) - #define PPC4XX_NUM_GD 1024 --#define PPC4XX_LAST_SD 63 --#define PPC4XX_NUM_SD 64 -+#define PPC4XX_LAST_GD (PPC4XX_NUM_GD - 1) -+#define PPC4XX_NUM_SD 256 -+#define PPC4XX_LAST_SD (PPC4XX_NUM_SD - 1) - #define PPC4XX_SD_BUFFER_SIZE 2048 - - #define PD_ENTRY_INUSE 1 -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 1a1fc8351289..3ba486d0ec6f 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -2053,6 +2053,7 @@ static const struct hid_device_id hid_have_special_driver[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SIRIUS_BATTERY_FREE_TABLET) }, - { HID_USB_DEVICE(USB_VENDOR_ID_X_TENSIONS, USB_DEVICE_ID_SPEEDLINK_VAD_CEZANNE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0005) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ZEROPLUS, 0x0030) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ZYDACRON, USB_DEVICE_ID_ZYDACRON_REMOTE_CONTROL) }, -diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h -index 6937086060a6..b554d17c9156 100644 ---- a/drivers/hid/hid-ids.h -+++ b/drivers/hid/hid-ids.h -@@ -1021,6 +1021,7 @@ - - #define USB_VENDOR_ID_XIN_MO 0x16c0 - #define USB_DEVICE_ID_XIN_MO_DUAL_ARCADE 0x05e1 -+#define USB_DEVICE_ID_THT_2P_ARCADE 0x75e1 - - #define USB_VENDOR_ID_XIROKU 0x1477 - #define USB_DEVICE_ID_XIROKU_SPX 0x1006 -diff --git a/drivers/hid/hid-xinmo.c b/drivers/hid/hid-xinmo.c -index 7df5227a7e61..9ad7731d2e10 100644 ---- a/drivers/hid/hid-xinmo.c -+++ b/drivers/hid/hid-xinmo.c -@@ -46,6 +46,7 @@ static int xinmo_event(struct hid_device *hdev, struct hid_field *field, - - static const struct hid_device_id xinmo_devices[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_XIN_MO_DUAL_ARCADE) }, -+ { HID_USB_DEVICE(USB_VENDOR_ID_XIN_MO, USB_DEVICE_ID_THT_2P_ARCADE) }, - { } - }; - -diff --git a/drivers/hwmon/asus_atk0110.c b/drivers/hwmon/asus_atk0110.c -index cccef87963e0..975c43d446f8 100644 ---- a/drivers/hwmon/asus_atk0110.c -+++ b/drivers/hwmon/asus_atk0110.c -@@ -646,6 +646,9 @@ static int atk_read_value(struct atk_sensor_data *sensor, u64 *value) - else - err = atk_read_value_new(sensor, value); - -+ if (err) -+ return err; -+ - sensor->is_valid = true; - sensor->last_updated = jiffies; - sensor->cached_value = *value; -diff --git a/drivers/infiniband/ulp/iser/iscsi_iser.h b/drivers/infiniband/ulp/iser/iscsi_iser.h -index 8a5998e6a407..88f97ea6b366 100644 ---- a/drivers/infiniband/ulp/iser/iscsi_iser.h -+++ b/drivers/infiniband/ulp/iser/iscsi_iser.h -@@ -450,6 +450,7 @@ struct iser_fr_desc { - struct list_head list; - struct iser_reg_resources rsc; - struct iser_pi_context *pi_ctx; -+ struct list_head all_list; - }; - - /** -@@ -463,6 +464,7 @@ struct iser_fr_pool { - struct list_head list; - spinlock_t lock; - int size; -+ struct list_head all_list; - }; - - /** -diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c -index 42f4da620f2e..0cbc7ceb9a55 100644 ---- a/drivers/infiniband/ulp/iser/iser_verbs.c -+++ b/drivers/infiniband/ulp/iser/iser_verbs.c -@@ -405,6 +405,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn, - int i, ret; - - INIT_LIST_HEAD(&fr_pool->list); -+ INIT_LIST_HEAD(&fr_pool->all_list); - spin_lock_init(&fr_pool->lock); - fr_pool->size = 0; - for (i = 0; i < cmds_max; i++) { -@@ -416,6 +417,7 @@ int iser_alloc_fastreg_pool(struct ib_conn *ib_conn, - } - - list_add_tail(&desc->list, &fr_pool->list); -+ list_add_tail(&desc->all_list, &fr_pool->all_list); - fr_pool->size++; - } - -@@ -435,13 +437,13 @@ void iser_free_fastreg_pool(struct ib_conn *ib_conn) - struct iser_fr_desc *desc, *tmp; - int i = 0; - -- if (list_empty(&fr_pool->list)) -+ if (list_empty(&fr_pool->all_list)) - return; - - iser_info("freeing conn %p fr pool\n", ib_conn); - -- list_for_each_entry_safe(desc, tmp, &fr_pool->list, list) { -- list_del(&desc->list); -+ list_for_each_entry_safe(desc, tmp, &fr_pool->all_list, all_list) { -+ list_del(&desc->all_list); - iser_free_reg_res(&desc->rsc); - if (desc->pi_ctx) - iser_free_pi_ctx(desc->pi_ctx); -diff --git a/drivers/isdn/capi/kcapi.c b/drivers/isdn/capi/kcapi.c -index 823f6985b260..dd7e38ac29bd 100644 ---- a/drivers/isdn/capi/kcapi.c -+++ b/drivers/isdn/capi/kcapi.c -@@ -1032,6 +1032,7 @@ static int old_capi_manufacturer(unsigned int cmd, void __user *data) - sizeof(avmb1_carddef)))) - return -EFAULT; - cdef.cardtype = AVM_CARDTYPE_B1; -+ cdef.cardnr = 0; - } else { - if ((retval = copy_from_user(&cdef, data, - sizeof(avmb1_extcarddef)))) -diff --git a/drivers/misc/cxl/pci.c b/drivers/misc/cxl/pci.c -index 0c6c17a1c59e..ba2f6d1d7db7 100644 ---- a/drivers/misc/cxl/pci.c -+++ b/drivers/misc/cxl/pci.c -@@ -1329,6 +1329,9 @@ static pci_ers_result_t cxl_vphb_error_detected(struct cxl_afu *afu, - /* There should only be one entry, but go through the list - * anyway - */ -+ if (afu->phb == NULL) -+ return result; -+ - list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) { - if (!afu_dev->driver) - continue; -@@ -1369,6 +1372,10 @@ static pci_ers_result_t cxl_pci_error_detected(struct pci_dev *pdev, - */ - for (i = 0; i < adapter->slices; i++) { - afu = adapter->afu[i]; -+ /* -+ * Tell the AFU drivers; but we don't care what they -+ * say, we're going away. -+ */ - cxl_vphb_error_detected(afu, state); - } - return PCI_ERS_RESULT_DISCONNECT; -@@ -1492,6 +1499,9 @@ static pci_ers_result_t cxl_pci_slot_reset(struct pci_dev *pdev) - if (cxl_afu_select_best_mode(afu)) - goto err; - -+ if (afu->phb == NULL) -+ continue; -+ - cxl_pci_vphb_reconfigure(afu); - - list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) { -@@ -1556,6 +1566,9 @@ static void cxl_pci_resume(struct pci_dev *pdev) - for (i = 0; i < adapter->slices; i++) { - afu = adapter->afu[i]; - -+ if (afu->phb == NULL) -+ continue; -+ - list_for_each_entry(afu_dev, &afu->phb->bus->devices, bus_list) { - if (afu_dev->driver && afu_dev->driver->err_handler && - afu_dev->driver->err_handler->resume) -diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -index 4744919440e0..a38a9cb3d544 100644 ---- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c -+++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c -@@ -2014,6 +2014,18 @@ static int bnxt_init_one_rx_ring(struct bnxt *bp, int ring_nr) - return 0; - } - -+static void bnxt_init_cp_rings(struct bnxt *bp) -+{ -+ int i; -+ -+ for (i = 0; i < bp->cp_nr_rings; i++) { -+ struct bnxt_cp_ring_info *cpr = &bp->bnapi[i]->cp_ring; -+ struct bnxt_ring_struct *ring = &cpr->cp_ring_struct; -+ -+ ring->fw_ring_id = INVALID_HW_RING_ID; -+ } -+} -+ - static int bnxt_init_rx_rings(struct bnxt *bp) - { - int i, rc = 0; -@@ -3977,6 +3989,7 @@ static int bnxt_shutdown_nic(struct bnxt *bp, bool irq_re_init) - - static int bnxt_init_nic(struct bnxt *bp, bool irq_re_init) - { -+ bnxt_init_cp_rings(bp); - bnxt_init_rx_rings(bp); - bnxt_init_tx_rings(bp); - bnxt_init_ring_grps(bp, irq_re_init); -diff --git a/drivers/net/ethernet/brocade/bna/bfa_ioc.c b/drivers/net/ethernet/brocade/bna/bfa_ioc.c -index 9e59663a6ead..0f6811860ad5 100644 ---- a/drivers/net/ethernet/brocade/bna/bfa_ioc.c -+++ b/drivers/net/ethernet/brocade/bna/bfa_ioc.c -@@ -1930,13 +1930,13 @@ static void - bfa_ioc_send_enable(struct bfa_ioc *ioc) - { - struct bfi_ioc_ctrl_req enable_req; -- struct timeval tv; - - bfi_h2i_set(enable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_ENABLE_REQ, - bfa_ioc_portid(ioc)); - enable_req.clscode = htons(ioc->clscode); -- do_gettimeofday(&tv); -- enable_req.tv_sec = ntohl(tv.tv_sec); -+ enable_req.rsvd = htons(0); -+ /* overflow in 2106 */ -+ enable_req.tv_sec = ntohl(ktime_get_real_seconds()); - bfa_ioc_mbox_send(ioc, &enable_req, sizeof(struct bfi_ioc_ctrl_req)); - } - -@@ -1947,6 +1947,10 @@ bfa_ioc_send_disable(struct bfa_ioc *ioc) - - bfi_h2i_set(disable_req.mh, BFI_MC_IOC, BFI_IOC_H2I_DISABLE_REQ, - bfa_ioc_portid(ioc)); -+ disable_req.clscode = htons(ioc->clscode); -+ disable_req.rsvd = htons(0); -+ /* overflow in 2106 */ -+ disable_req.tv_sec = ntohl(ktime_get_real_seconds()); - bfa_ioc_mbox_send(ioc, &disable_req, sizeof(struct bfi_ioc_ctrl_req)); - } - -diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c -index 8fc246ea1fb8..a4ad782007ce 100644 ---- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c -+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c -@@ -324,7 +324,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf, - return PTR_ERR(kern_buf); - - rc = sscanf(kern_buf, "%x:%x", &addr, &len); -- if (rc < 2) { -+ if (rc < 2 || len > UINT_MAX >> 2) { - netdev_warn(bnad->netdev, "failed to read user buffer\n"); - kfree(kern_buf); - return -EINVAL; -diff --git a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c -index acfb8b1f88a7..a8f9d0012d82 100644 ---- a/drivers/net/ethernet/intel/fm10k/fm10k_iov.c -+++ b/drivers/net/ethernet/intel/fm10k/fm10k_iov.c -@@ -126,6 +126,9 @@ process_mbx: - struct fm10k_mbx_info *mbx = &vf_info->mbx; - u16 glort = vf_info->glort; - -+ /* process the SM mailbox first to drain outgoing messages */ -+ hw->mbx.ops.process(hw, &hw->mbx); -+ - /* verify port mapping is valid, if not reset port */ - if (vf_info->vf_flags && !fm10k_glort_valid_pf(hw, glort)) - hw->iov.ops.reset_lport(hw, vf_info); -diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c -index b5b228c9a030..06b38f50980c 100644 ---- a/drivers/net/ethernet/intel/i40e/i40e_main.c -+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c -@@ -4201,8 +4201,12 @@ static void i40e_napi_enable_all(struct i40e_vsi *vsi) - if (!vsi->netdev) - return; - -- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) -- napi_enable(&vsi->q_vectors[q_idx]->napi); -+ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) { -+ struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx]; -+ -+ if (q_vector->rx.ring || q_vector->tx.ring) -+ napi_enable(&q_vector->napi); -+ } - } - - /** -@@ -4216,8 +4220,12 @@ static void i40e_napi_disable_all(struct i40e_vsi *vsi) - if (!vsi->netdev) - return; - -- for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) -- napi_disable(&vsi->q_vectors[q_idx]->napi); -+ for (q_idx = 0; q_idx < vsi->num_q_vectors; q_idx++) { -+ struct i40e_q_vector *q_vector = vsi->q_vectors[q_idx]; -+ -+ if (q_vector->rx.ring || q_vector->tx.ring) -+ napi_disable(&q_vector->napi); -+ } - } - - /** -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index c55552c3d2f9..53803fd6350c 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -3005,6 +3005,8 @@ static int igb_sw_init(struct igb_adapter *adapter) - /* Setup and initialize a copy of the hw vlan table array */ - adapter->shadow_vfta = kcalloc(E1000_VLAN_FILTER_TBL_SIZE, sizeof(u32), - GFP_ATOMIC); -+ if (!adapter->shadow_vfta) -+ return -ENOMEM; - - /* This call may decrease the number of queues */ - if (igb_init_interrupt_scheme(adapter, true)) { -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -index ce61b36b94f1..105dd00ddc1a 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c -@@ -3620,10 +3620,10 @@ s32 ixgbe_set_fw_drv_ver_generic(struct ixgbe_hw *hw, u8 maj, u8 min, - fw_cmd.ver_build = build; - fw_cmd.ver_sub = sub; - fw_cmd.hdr.checksum = 0; -- fw_cmd.hdr.checksum = ixgbe_calculate_checksum((u8 *)&fw_cmd, -- (FW_CEM_HDR_LEN + fw_cmd.hdr.buf_len)); - fw_cmd.pad = 0; - fw_cmd.pad2 = 0; -+ fw_cmd.hdr.checksum = ixgbe_calculate_checksum((u8 *)&fw_cmd, -+ (FW_CEM_HDR_LEN + fw_cmd.hdr.buf_len)); - - for (i = 0; i <= FW_CEM_MAX_RETRIES; i++) { - ret_val = ixgbe_host_interface_command(hw, (u32 *)&fw_cmd, -diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -index 31f864fb30c1..a75f2e3ce86f 100644 ---- a/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_x550.c -@@ -564,6 +564,8 @@ static s32 ixgbe_read_ee_hostif_buffer_X550(struct ixgbe_hw *hw, - /* convert offset from words to bytes */ - buffer.address = cpu_to_be32((offset + current_word) * 2); - buffer.length = cpu_to_be16(words_to_read * 2); -+ buffer.pad2 = 0; -+ buffer.pad3 = 0; - - status = ixgbe_host_interface_command(hw, (u32 *)&buffer, - sizeof(buffer), -diff --git a/drivers/net/irda/vlsi_ir.c b/drivers/net/irda/vlsi_ir.c -index a0849f49bbec..c0192f97ecc8 100644 ---- a/drivers/net/irda/vlsi_ir.c -+++ b/drivers/net/irda/vlsi_ir.c -@@ -418,8 +418,9 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr - memset(rd, 0, sizeof(*rd)); - rd->hw = hwmap + i; - rd->buf = kmalloc(len, GFP_KERNEL|GFP_DMA); -- if (rd->buf == NULL || -- !(busaddr = pci_map_single(pdev, rd->buf, len, dir))) { -+ if (rd->buf) -+ busaddr = pci_map_single(pdev, rd->buf, len, dir); -+ if (rd->buf == NULL || pci_dma_mapping_error(pdev, busaddr)) { - if (rd->buf) { - net_err_ratelimited("%s: failed to create PCI-MAP for %p\n", - __func__, rd->buf); -@@ -430,8 +431,7 @@ static struct vlsi_ring *vlsi_alloc_ring(struct pci_dev *pdev, struct ring_descr - rd = r->rd + j; - busaddr = rd_get_addr(rd); - rd_set_addr_status(rd, 0, 0); -- if (busaddr) -- pci_unmap_single(pdev, busaddr, len, dir); -+ pci_unmap_single(pdev, busaddr, len, dir); - kfree(rd->buf); - rd->buf = NULL; - } -diff --git a/drivers/net/phy/at803x.c b/drivers/net/phy/at803x.c -index 2d020a3ec0b5..37333d38b576 100644 ---- a/drivers/net/phy/at803x.c -+++ b/drivers/net/phy/at803x.c -@@ -105,7 +105,7 @@ static int at803x_set_wol(struct phy_device *phydev, - mac = (const u8 *) ndev->dev_addr; - - if (!is_valid_ether_addr(mac)) -- return -EFAULT; -+ return -EINVAL; - - for (i = 0; i < 3; i++) { - phy_write(phydev, AT803X_MMD_ACCESS_CONTROL, -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index e325ca3ad565..2cbecbda1ae3 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -410,6 +410,10 @@ static const struct usb_device_id products[] = { - USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 0x01, 0x69), - .driver_info = (unsigned long)&qmi_wwan_info, - }, -+ { /* Motorola Mapphone devices with MDM6600 */ -+ USB_VENDOR_AND_INTERFACE_INFO(0x22b8, USB_CLASS_VENDOR_SPEC, 0xfb, 0xff), -+ .driver_info = (unsigned long)&qmi_wwan_info, -+ }, - - /* 2. Combined interface devices matching on class+protocol */ - { /* Huawei E367 and possibly others in "Windows mode" */ -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 1c27e6fb99f9..304ec25eaf95 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -1207,6 +1207,7 @@ static void intr_callback(struct urb *urb) - } - } else { - if (netif_carrier_ok(tp->netdev)) { -+ netif_stop_queue(tp->netdev); - set_bit(RTL8152_LINK_CHG, &tp->flags); - schedule_delayed_work(&tp->schedule, 0); - } -@@ -1277,6 +1278,7 @@ static int alloc_all_mem(struct r8152 *tp) - spin_lock_init(&tp->rx_lock); - spin_lock_init(&tp->tx_lock); - INIT_LIST_HEAD(&tp->tx_free); -+ INIT_LIST_HEAD(&tp->rx_done); - skb_queue_head_init(&tp->tx_queue); - skb_queue_head_init(&tp->rx_queue); - -@@ -3000,6 +3002,9 @@ static void set_carrier(struct r8152 *tp) - napi_enable(&tp->napi); - netif_wake_queue(netdev); - netif_info(tp, link, netdev, "carrier on\n"); -+ } else if (netif_queue_stopped(netdev) && -+ skb_queue_len(&tp->tx_queue) < tp->tx_qlen) { -+ netif_wake_queue(netdev); - } - } else { - if (netif_carrier_ok(netdev)) { -@@ -3560,8 +3565,18 @@ static int rtl8152_resume(struct usb_interface *intf) - clear_bit(SELECTIVE_SUSPEND, &tp->flags); - napi_disable(&tp->napi); - set_bit(WORK_ENABLE, &tp->flags); -- if (netif_carrier_ok(tp->netdev)) -- rtl_start_rx(tp); -+ -+ if (netif_carrier_ok(tp->netdev)) { -+ if (rtl8152_get_speed(tp) & LINK_STATUS) { -+ rtl_start_rx(tp); -+ } else { -+ netif_carrier_off(tp->netdev); -+ tp->rtl_ops.disable(tp); -+ netif_info(tp, link, tp->netdev, -+ "linking down\n"); -+ } -+ } -+ - napi_enable(&tp->napi); - } else { - tp->rtl_ops.up(tp); -diff --git a/drivers/pci/iov.c b/drivers/pci/iov.c -index 357527712539..7680fc0349fc 100644 ---- a/drivers/pci/iov.c -+++ b/drivers/pci/iov.c -@@ -161,7 +161,6 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset) - pci_device_add(virtfn, virtfn->bus); - mutex_unlock(&iov->dev->sriov->lock); - -- pci_bus_add_device(virtfn); - sprintf(buf, "virtfn%u", id); - rc = sysfs_create_link(&dev->dev.kobj, &virtfn->dev.kobj, buf); - if (rc) -@@ -172,6 +171,8 @@ static int virtfn_add(struct pci_dev *dev, int id, int reset) - - kobject_uevent(&virtfn->dev.kobj, KOBJ_CHANGE); - -+ pci_bus_add_device(virtfn); -+ - return 0; - - failed2: -diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c -index 1a14ca8965e6..295bf1472d02 100644 ---- a/drivers/pci/pci.c -+++ b/drivers/pci/pci.c -@@ -3850,6 +3850,10 @@ static bool pci_bus_resetable(struct pci_bus *bus) - { - struct pci_dev *dev; - -+ -+ if (bus->self && (bus->self->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET)) -+ return false; -+ - list_for_each_entry(dev, &bus->devices, bus_list) { - if (dev->dev_flags & PCI_DEV_FLAGS_NO_BUS_RESET || - (dev->subordinate && !pci_bus_resetable(dev->subordinate))) -diff --git a/drivers/pci/pcie/aer/aerdrv_core.c b/drivers/pci/pcie/aer/aerdrv_core.c -index 4e14de0f0f98..ca5dbf03e388 100644 ---- a/drivers/pci/pcie/aer/aerdrv_core.c -+++ b/drivers/pci/pcie/aer/aerdrv_core.c -@@ -388,7 +388,14 @@ static pci_ers_result_t broadcast_error_message(struct pci_dev *dev, - * If the error is reported by an end point, we think this - * error is related to the upstream link of the end point. - */ -- pci_walk_bus(dev->bus, cb, &result_data); -+ if (state == pci_channel_io_normal) -+ /* -+ * the error is non fatal so the bus is ok, just invoke -+ * the callback for the function that logged the error. -+ */ -+ cb(dev, &result_data); -+ else -+ pci_walk_bus(dev->bus, cb, &result_data); - } - - return result_data.result; -diff --git a/drivers/pinctrl/pinctrl-st.c b/drivers/pinctrl/pinctrl-st.c -index b58d3f29148a..6908b6ce2074 100644 ---- a/drivers/pinctrl/pinctrl-st.c -+++ b/drivers/pinctrl/pinctrl-st.c -@@ -1338,6 +1338,22 @@ static void st_gpio_irq_unmask(struct irq_data *d) - writel(BIT(d->hwirq), bank->base + REG_PIO_SET_PMASK); - } - -+static int st_gpio_irq_request_resources(struct irq_data *d) -+{ -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); -+ -+ st_gpio_direction_input(gc, d->hwirq); -+ -+ return gpiochip_lock_as_irq(gc, d->hwirq); -+} -+ -+static void st_gpio_irq_release_resources(struct irq_data *d) -+{ -+ struct gpio_chip *gc = irq_data_get_irq_chip_data(d); -+ -+ gpiochip_unlock_as_irq(gc, d->hwirq); -+} -+ - static int st_gpio_irq_set_type(struct irq_data *d, unsigned type) - { - struct gpio_chip *gc = irq_data_get_irq_chip_data(d); -@@ -1493,12 +1509,14 @@ static struct gpio_chip st_gpio_template = { - }; - - static struct irq_chip st_gpio_irqchip = { -- .name = "GPIO", -- .irq_disable = st_gpio_irq_mask, -- .irq_mask = st_gpio_irq_mask, -- .irq_unmask = st_gpio_irq_unmask, -- .irq_set_type = st_gpio_irq_set_type, -- .flags = IRQCHIP_SKIP_SET_WAKE, -+ .name = "GPIO", -+ .irq_request_resources = st_gpio_irq_request_resources, -+ .irq_release_resources = st_gpio_irq_release_resources, -+ .irq_disable = st_gpio_irq_mask, -+ .irq_mask = st_gpio_irq_mask, -+ .irq_unmask = st_gpio_irq_unmask, -+ .irq_set_type = st_gpio_irq_set_type, -+ .flags = IRQCHIP_SKIP_SET_WAKE, - }; - - static int st_gpiolib_register_bank(struct st_pinctrl *info, -diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c -index 9bb934ed2a7a..dcfd3655ef0a 100644 ---- a/drivers/rtc/interface.c -+++ b/drivers/rtc/interface.c -@@ -764,7 +764,7 @@ static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) - } - - timerqueue_add(&rtc->timerqueue, &timer->node); -- if (!next) { -+ if (!next || ktime_before(timer->node.expires, next->expires)) { - struct rtc_wkalrm alarm; - int err; - alarm.time = rtc_ktime_to_tm(timer->node.expires); -diff --git a/drivers/rtc/rtc-pl031.c b/drivers/rtc/rtc-pl031.c -index e1687e19c59f..a30f24cb6c83 100644 ---- a/drivers/rtc/rtc-pl031.c -+++ b/drivers/rtc/rtc-pl031.c -@@ -308,7 +308,8 @@ static int pl031_remove(struct amba_device *adev) - - dev_pm_clear_wake_irq(&adev->dev); - device_init_wakeup(&adev->dev, false); -- free_irq(adev->irq[0], ldata); -+ if (adev->irq[0]) -+ free_irq(adev->irq[0], ldata); - rtc_device_unregister(ldata->rtc); - iounmap(ldata->base); - kfree(ldata); -@@ -381,12 +382,13 @@ static int pl031_probe(struct amba_device *adev, const struct amba_id *id) - goto out_no_rtc; - } - -- if (request_irq(adev->irq[0], pl031_interrupt, -- vendor->irqflags, "rtc-pl031", ldata)) { -- ret = -EIO; -- goto out_no_irq; -+ if (adev->irq[0]) { -+ ret = request_irq(adev->irq[0], pl031_interrupt, -+ vendor->irqflags, "rtc-pl031", ldata); -+ if (ret) -+ goto out_no_irq; -+ dev_pm_set_wake_irq(&adev->dev, adev->irq[0]); - } -- dev_pm_set_wake_irq(&adev->dev, adev->irq[0]); - return 0; - - out_no_irq: -diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c -index bf3c1b2301db..0d6888cbd96e 100644 ---- a/drivers/s390/net/qeth_l3_main.c -+++ b/drivers/s390/net/qeth_l3_main.c -@@ -2680,17 +2680,13 @@ static void qeth_l3_fill_af_iucv_hdr(struct qeth_card *card, - char daddr[16]; - struct af_iucv_trans_hdr *iucv_hdr; - -- skb_pull(skb, 14); -- card->dev->header_ops->create(skb, card->dev, 0, -- card->dev->dev_addr, card->dev->dev_addr, -- card->dev->addr_len); -- skb_pull(skb, 14); -- iucv_hdr = (struct af_iucv_trans_hdr *)skb->data; - memset(hdr, 0, sizeof(struct qeth_hdr)); - hdr->hdr.l3.id = QETH_HEADER_TYPE_LAYER3; - hdr->hdr.l3.ext_flags = 0; -- hdr->hdr.l3.length = skb->len; -+ hdr->hdr.l3.length = skb->len - ETH_HLEN; - hdr->hdr.l3.flags = QETH_HDR_IPV6 | QETH_CAST_UNICAST; -+ -+ iucv_hdr = (struct af_iucv_trans_hdr *) (skb->data + ETH_HLEN); - memset(daddr, 0, sizeof(daddr)); - daddr[0] = 0xfe; - daddr[1] = 0x80; -@@ -2873,10 +2869,7 @@ static int qeth_l3_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) - if ((card->info.type == QETH_CARD_TYPE_IQD) && (!large_send) && - (skb_shinfo(skb)->nr_frags == 0)) { - new_skb = skb; -- if (new_skb->protocol == ETH_P_AF_IUCV) -- data_offset = 0; -- else -- data_offset = ETH_HLEN; -+ data_offset = ETH_HLEN; - hdr = kmem_cache_alloc(qeth_core_header_cache, GFP_ATOMIC); - if (!hdr) - goto tx_drop; -diff --git a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c -index 804806e1cbb4..7a48905b8195 100644 ---- a/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c -+++ b/drivers/scsi/cxgbi/cxgb4i/cxgb4i.c -@@ -1339,6 +1339,7 @@ static void release_offload_resources(struct cxgbi_sock *csk) - csk, csk->state, csk->flags, csk->tid); - - cxgbi_sock_free_cpl_skbs(csk); -+ cxgbi_sock_purge_write_queue(csk); - if (csk->wr_cred != csk->wr_max_cred) { - cxgbi_sock_purge_wr_queue(csk); - cxgbi_sock_reset_wr_list(csk); -diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c -index fc8f9b446556..fd8fe1202dbe 100644 ---- a/drivers/scsi/lpfc/lpfc_els.c -+++ b/drivers/scsi/lpfc/lpfc_els.c -@@ -7491,7 +7491,8 @@ lpfc_els_unsol_buffer(struct lpfc_hba *phba, struct lpfc_sli_ring *pring, - did, vport->port_state, ndlp->nlp_flag); - - phba->fc_stat.elsRcvPRLI++; -- if (vport->port_state < LPFC_DISC_AUTH) { -+ if ((vport->port_state < LPFC_DISC_AUTH) && -+ (vport->fc_flag & FC_FABRIC)) { - rjt_err = LSRJT_UNABLE_TPC; - rjt_exp = LSEXP_NOTHING_MORE; - break; -diff --git a/drivers/scsi/lpfc/lpfc_hbadisc.c b/drivers/scsi/lpfc/lpfc_hbadisc.c -index d3668aa555d5..be901f6db6d3 100644 ---- a/drivers/scsi/lpfc/lpfc_hbadisc.c -+++ b/drivers/scsi/lpfc/lpfc_hbadisc.c -@@ -4777,7 +4777,8 @@ lpfc_nlp_remove(struct lpfc_vport *vport, struct lpfc_nodelist *ndlp) - lpfc_cancel_retry_delay_tmo(vport, ndlp); - if ((ndlp->nlp_flag & NLP_DEFER_RM) && - !(ndlp->nlp_flag & NLP_REG_LOGIN_SEND) && -- !(ndlp->nlp_flag & NLP_RPI_REGISTERED)) { -+ !(ndlp->nlp_flag & NLP_RPI_REGISTERED) && -+ phba->sli_rev != LPFC_SLI_REV4) { - /* For this case we need to cleanup the default rpi - * allocated by the firmware. - */ -diff --git a/drivers/scsi/lpfc/lpfc_hw4.h b/drivers/scsi/lpfc/lpfc_hw4.h -index f224cdb2fce4..507869bc0673 100644 ---- a/drivers/scsi/lpfc/lpfc_hw4.h -+++ b/drivers/scsi/lpfc/lpfc_hw4.h -@@ -3180,7 +3180,7 @@ struct lpfc_mbx_get_port_name { - #define MB_CEQ_STATUS_QUEUE_FLUSHING 0x4 - #define MB_CQE_STATUS_DMA_FAILED 0x5 - --#define LPFC_MBX_WR_CONFIG_MAX_BDE 8 -+#define LPFC_MBX_WR_CONFIG_MAX_BDE 1 - struct lpfc_mbx_wr_object { - struct mbox_header header; - union { -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index e333029e4b6c..e111c3d8c5d6 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -4588,6 +4588,11 @@ _scsih_io_done(struct MPT3SAS_ADAPTER *ioc, u16 smid, u8 msix_index, u32 reply) - } else if (log_info == VIRTUAL_IO_FAILED_RETRY) { - scmd->result = DID_RESET << 16; - break; -+ } else if ((scmd->device->channel == RAID_CHANNEL) && -+ (scsi_state == (MPI2_SCSI_STATE_TERMINATED | -+ MPI2_SCSI_STATE_NO_SCSI_STATUS))) { -+ scmd->result = DID_RESET << 16; -+ break; - } - scmd->result = DID_SOFT_ERROR << 16; - break; -diff --git a/drivers/thermal/hisi_thermal.c b/drivers/thermal/hisi_thermal.c -index 36d07295f8e3..a56f6cac6fc5 100644 ---- a/drivers/thermal/hisi_thermal.c -+++ b/drivers/thermal/hisi_thermal.c -@@ -389,8 +389,11 @@ static int hisi_thermal_suspend(struct device *dev) - static int hisi_thermal_resume(struct device *dev) - { - struct hisi_thermal_data *data = dev_get_drvdata(dev); -+ int ret; - -- clk_prepare_enable(data->clk); -+ ret = clk_prepare_enable(data->clk); -+ if (ret) -+ return ret; - - data->irq_enabled = true; - hisi_thermal_enable_bind_irq_sensor(data); -diff --git a/drivers/usb/gadget/function/f_uvc.c b/drivers/usb/gadget/function/f_uvc.c -index c7689d05356c..f8a1881609a2 100644 ---- a/drivers/usb/gadget/function/f_uvc.c -+++ b/drivers/usb/gadget/function/f_uvc.c -@@ -594,6 +594,14 @@ uvc_function_bind(struct usb_configuration *c, struct usb_function *f) - opts->streaming_maxpacket = clamp(opts->streaming_maxpacket, 1U, 3072U); - opts->streaming_maxburst = min(opts->streaming_maxburst, 15U); - -+ /* For SS, wMaxPacketSize has to be 1024 if bMaxBurst is not 0 */ -+ if (opts->streaming_maxburst && -+ (opts->streaming_maxpacket % 1024) != 0) { -+ opts->streaming_maxpacket = roundup(opts->streaming_maxpacket, 1024); -+ INFO(cdev, "overriding streaming_maxpacket to %d\n", -+ opts->streaming_maxpacket); -+ } -+ - /* Fill in the FS/HS/SS Video Streaming specific descriptors from the - * module parameters. - * -diff --git a/drivers/usb/gadget/udc/pch_udc.c b/drivers/usb/gadget/udc/pch_udc.c -index 7a04157ff579..2806457b4748 100644 ---- a/drivers/usb/gadget/udc/pch_udc.c -+++ b/drivers/usb/gadget/udc/pch_udc.c -@@ -1534,7 +1534,6 @@ static void pch_udc_free_dma_chain(struct pch_udc_dev *dev, - td = phys_to_virt(addr); - addr2 = (dma_addr_t)td->next; - pci_pool_free(dev->data_requests, td, addr); -- td->next = 0x00; - addr = addr2; - } - req->chain_len = 1; -diff --git a/drivers/video/backlight/pwm_bl.c b/drivers/video/backlight/pwm_bl.c -index ae3c6b6fd5db..d0c79153081d 100644 ---- a/drivers/video/backlight/pwm_bl.c -+++ b/drivers/video/backlight/pwm_bl.c -@@ -79,14 +79,17 @@ static void pwm_backlight_power_off(struct pwm_bl_data *pb) - static int compute_duty_cycle(struct pwm_bl_data *pb, int brightness) - { - unsigned int lth = pb->lth_brightness; -- int duty_cycle; -+ u64 duty_cycle; - - if (pb->levels) - duty_cycle = pb->levels[brightness]; - else - duty_cycle = brightness; - -- return (duty_cycle * (pb->period - lth) / pb->scale) + lth; -+ duty_cycle *= pb->period - lth; -+ do_div(duty_cycle, pb->scale); -+ -+ return duty_cycle + lth; - } - - static int pwm_backlight_update_status(struct backlight_device *bl) -diff --git a/include/linux/mmu_context.h b/include/linux/mmu_context.h -index 70fffeba7495..a4441784503b 100644 ---- a/include/linux/mmu_context.h -+++ b/include/linux/mmu_context.h -@@ -1,9 +1,16 @@ - #ifndef _LINUX_MMU_CONTEXT_H - #define _LINUX_MMU_CONTEXT_H - -+#include -+ - struct mm_struct; - - void use_mm(struct mm_struct *mm); - void unuse_mm(struct mm_struct *mm); - -+/* Architectures that care about IRQ state in switch_mm can override this. */ -+#ifndef switch_mm_irqs_off -+# define switch_mm_irqs_off switch_mm -+#endif -+ - #endif -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 15874a85ebcf..9d6b3d869592 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -32,7 +32,7 @@ - #include - #include - #include --#include -+#include - #include - #include - #include -@@ -2708,7 +2708,7 @@ context_switch(struct rq *rq, struct task_struct *prev, - atomic_inc(&oldmm->mm_count); - enter_lazy_tlb(oldmm, next); - } else -- switch_mm(oldmm, mm, next); -+ switch_mm_irqs_off(oldmm, mm, next); - - if (!prev->mm) { - prev->active_mm = NULL; -diff --git a/mm/mmu_context.c b/mm/mmu_context.c -index f802c2d216a7..6f4d27c5bb32 100644 ---- a/mm/mmu_context.c -+++ b/mm/mmu_context.c -@@ -4,9 +4,9 @@ - */ - - #include -+#include - #include - #include --#include - - #include - -diff --git a/mm/rmap.c b/mm/rmap.c -index ede183c32f45..1bceb49aa214 100644 ---- a/mm/rmap.c -+++ b/mm/rmap.c -@@ -587,19 +587,6 @@ vma_address(struct page *page, struct vm_area_struct *vma) - } - - #ifdef CONFIG_ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH --static void percpu_flush_tlb_batch_pages(void *data) --{ -- /* -- * All TLB entries are flushed on the assumption that it is -- * cheaper to flush all TLBs and let them be refilled than -- * flushing individual PFNs. Note that we do not track mm's -- * to flush as that might simply be multiple full TLB flushes -- * for no gain. -- */ -- count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); -- flush_tlb_local(); --} -- - /* - * Flush TLB entries for recently unmapped pages from remote CPUs. It is - * important if a PTE was dirty when it was unmapped that it's flushed -@@ -616,15 +603,14 @@ void try_to_unmap_flush(void) - - cpu = get_cpu(); - -- trace_tlb_flush(TLB_REMOTE_SHOOTDOWN, -1UL); -- -- if (cpumask_test_cpu(cpu, &tlb_ubc->cpumask)) -- percpu_flush_tlb_batch_pages(&tlb_ubc->cpumask); -- -- if (cpumask_any_but(&tlb_ubc->cpumask, cpu) < nr_cpu_ids) { -- smp_call_function_many(&tlb_ubc->cpumask, -- percpu_flush_tlb_batch_pages, (void *)tlb_ubc, true); -+ if (cpumask_test_cpu(cpu, &tlb_ubc->cpumask)) { -+ count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); -+ local_flush_tlb(); -+ trace_tlb_flush(TLB_LOCAL_SHOOTDOWN, TLB_FLUSH_ALL); - } -+ -+ if (cpumask_any_but(&tlb_ubc->cpumask, cpu) < nr_cpu_ids) -+ flush_tlb_others(&tlb_ubc->cpumask, NULL, 0, TLB_FLUSH_ALL); - cpumask_clear(&tlb_ubc->cpumask); - tlb_ubc->flush_required = false; - tlb_ubc->writable = false; -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index a6beb7b6ae55..f5ef2115871f 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -360,14 +360,16 @@ static struct ctl_table net_core_table[] = { - .data = &sysctl_net_busy_poll, - .maxlen = sizeof(unsigned int), - .mode = 0644, -- .proc_handler = proc_dointvec -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &zero, - }, - { - .procname = "busy_read", - .data = &sysctl_net_busy_read, - .maxlen = sizeof(unsigned int), - .mode = 0644, -- .proc_handler = proc_dointvec -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &zero, - }, - #endif - #ifdef CONFIG_NET_SCHED -diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c -index e2e162432aa3..7057a1b09b5e 100644 ---- a/net/ipv4/ip_fragment.c -+++ b/net/ipv4/ip_fragment.c -@@ -200,6 +200,7 @@ static void ip_expire(unsigned long arg) - qp = container_of((struct inet_frag_queue *) arg, struct ipq, q); - net = container_of(qp->q.net, struct net, ipv4.frags); - -+ rcu_read_lock(); - spin_lock(&qp->q.lock); - - if (qp->q.flags & INET_FRAG_COMPLETE) -@@ -209,7 +210,7 @@ static void ip_expire(unsigned long arg) - IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS); - - if (!inet_frag_evicting(&qp->q)) { -- struct sk_buff *head = qp->q.fragments; -+ struct sk_buff *clone, *head = qp->q.fragments; - const struct iphdr *iph; - int err; - -@@ -218,32 +219,40 @@ static void ip_expire(unsigned long arg) - if (!(qp->q.flags & INET_FRAG_FIRST_IN) || !qp->q.fragments) - goto out; - -- rcu_read_lock(); - head->dev = dev_get_by_index_rcu(net, qp->iif); - if (!head->dev) -- goto out_rcu_unlock; -+ goto out; -+ - - /* skb has no dst, perform route lookup again */ - iph = ip_hdr(head); - err = ip_route_input_noref(head, iph->daddr, iph->saddr, - iph->tos, head->dev); - if (err) -- goto out_rcu_unlock; -+ goto out; - - /* Only an end host needs to send an ICMP - * "Fragment Reassembly Timeout" message, per RFC792. - */ - if (frag_expire_skip_icmp(qp->user) && - (skb_rtable(head)->rt_type != RTN_LOCAL)) -- goto out_rcu_unlock; -+ goto out; -+ -+ clone = skb_clone(head, GFP_ATOMIC); - - /* Send an ICMP "Fragment Reassembly Timeout" message. */ -- icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0); --out_rcu_unlock: -- rcu_read_unlock(); -+ if (clone) { -+ spin_unlock(&qp->q.lock); -+ icmp_send(clone, ICMP_TIME_EXCEEDED, -+ ICMP_EXC_FRAGTIME, 0); -+ consume_skb(clone); -+ goto out_rcu_unlock; -+ } - } - out: - spin_unlock(&qp->q.lock); -+out_rcu_unlock: -+ rcu_read_unlock(); - ipq_put(qp); - } - -diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic.c b/net/ipv4/netfilter/nf_nat_snmp_basic.c -index 2689c9c4f1a0..182eb878633d 100644 ---- a/net/ipv4/netfilter/nf_nat_snmp_basic.c -+++ b/net/ipv4/netfilter/nf_nat_snmp_basic.c -@@ -1260,16 +1260,6 @@ static const struct nf_conntrack_expect_policy snmp_exp_policy = { - .timeout = 180, - }; - --static struct nf_conntrack_helper snmp_helper __read_mostly = { -- .me = THIS_MODULE, -- .help = help, -- .expect_policy = &snmp_exp_policy, -- .name = "snmp", -- .tuple.src.l3num = AF_INET, -- .tuple.src.u.udp.port = cpu_to_be16(SNMP_PORT), -- .tuple.dst.protonum = IPPROTO_UDP, --}; -- - static struct nf_conntrack_helper snmp_trap_helper __read_mostly = { - .me = THIS_MODULE, - .help = help, -@@ -1288,17 +1278,10 @@ static struct nf_conntrack_helper snmp_trap_helper __read_mostly = { - - static int __init nf_nat_snmp_basic_init(void) - { -- int ret = 0; -- - BUG_ON(nf_nat_snmp_hook != NULL); - RCU_INIT_POINTER(nf_nat_snmp_hook, help); - -- ret = nf_conntrack_helper_register(&snmp_trap_helper); -- if (ret < 0) { -- nf_conntrack_helper_unregister(&snmp_helper); -- return ret; -- } -- return ret; -+ return nf_conntrack_helper_register(&snmp_trap_helper); - } - - static void __exit nf_nat_snmp_basic_fini(void) -diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c -index 13951c4087d4..b9fac0522be6 100644 ---- a/net/ipv4/tcp_vegas.c -+++ b/net/ipv4/tcp_vegas.c -@@ -158,7 +158,7 @@ EXPORT_SYMBOL_GPL(tcp_vegas_cwnd_event); - - static inline u32 tcp_vegas_ssthresh(struct tcp_sock *tp) - { -- return min(tp->snd_ssthresh, tp->snd_cwnd-1); -+ return min(tp->snd_ssthresh, tp->snd_cwnd); - } - - static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked) -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index 6d10002d23f8..8d34a488efc0 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -32,6 +32,13 @@ MODULE_LICENSE("GPL"); - MODULE_AUTHOR("Pablo Neira Ayuso "); - MODULE_DESCRIPTION("nfnl_cthelper: User-space connection tracking helpers"); - -+struct nfnl_cthelper { -+ struct list_head list; -+ struct nf_conntrack_helper helper; -+}; -+ -+static LIST_HEAD(nfnl_cthelper_list); -+ - static int - nfnl_userspace_cthelper(struct sk_buff *skb, unsigned int protoff, - struct nf_conn *ct, enum ip_conntrack_info ctinfo) -@@ -205,18 +212,20 @@ nfnl_cthelper_create(const struct nlattr * const tb[], - struct nf_conntrack_tuple *tuple) - { - struct nf_conntrack_helper *helper; -+ struct nfnl_cthelper *nfcth; - int ret; - - if (!tb[NFCTH_TUPLE] || !tb[NFCTH_POLICY] || !tb[NFCTH_PRIV_DATA_LEN]) - return -EINVAL; - -- helper = kzalloc(sizeof(struct nf_conntrack_helper), GFP_KERNEL); -- if (helper == NULL) -+ nfcth = kzalloc(sizeof(*nfcth), GFP_KERNEL); -+ if (nfcth == NULL) - return -ENOMEM; -+ helper = &nfcth->helper; - - ret = nfnl_cthelper_parse_expect_policy(helper, tb[NFCTH_POLICY]); - if (ret < 0) -- goto err; -+ goto err1; - - strncpy(helper->name, nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN); - helper->data_len = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN])); -@@ -247,14 +256,100 @@ nfnl_cthelper_create(const struct nlattr * const tb[], - - ret = nf_conntrack_helper_register(helper); - if (ret < 0) -- goto err; -+ goto err2; - -+ list_add_tail(&nfcth->list, &nfnl_cthelper_list); - return 0; --err: -- kfree(helper); -+err2: -+ kfree(helper->expect_policy); -+err1: -+ kfree(nfcth); - return ret; - } - -+static int -+nfnl_cthelper_update_policy_one(const struct nf_conntrack_expect_policy *policy, -+ struct nf_conntrack_expect_policy *new_policy, -+ const struct nlattr *attr) -+{ -+ struct nlattr *tb[NFCTH_POLICY_MAX + 1]; -+ int err; -+ -+ err = nla_parse_nested(tb, NFCTH_POLICY_MAX, attr, -+ nfnl_cthelper_expect_pol); -+ if (err < 0) -+ return err; -+ -+ if (!tb[NFCTH_POLICY_NAME] || -+ !tb[NFCTH_POLICY_EXPECT_MAX] || -+ !tb[NFCTH_POLICY_EXPECT_TIMEOUT]) -+ return -EINVAL; -+ -+ if (nla_strcmp(tb[NFCTH_POLICY_NAME], policy->name)) -+ return -EBUSY; -+ -+ new_policy->max_expected = -+ ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX])); -+ new_policy->timeout = -+ ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_TIMEOUT])); -+ -+ return 0; -+} -+ -+static int nfnl_cthelper_update_policy_all(struct nlattr *tb[], -+ struct nf_conntrack_helper *helper) -+{ -+ struct nf_conntrack_expect_policy new_policy[helper->expect_class_max + 1]; -+ struct nf_conntrack_expect_policy *policy; -+ int i, err; -+ -+ /* Check first that all policy attributes are well-formed, so we don't -+ * leave things in inconsistent state on errors. -+ */ -+ for (i = 0; i < helper->expect_class_max + 1; i++) { -+ -+ if (!tb[NFCTH_POLICY_SET + i]) -+ return -EINVAL; -+ -+ err = nfnl_cthelper_update_policy_one(&helper->expect_policy[i], -+ &new_policy[i], -+ tb[NFCTH_POLICY_SET + i]); -+ if (err < 0) -+ return err; -+ } -+ /* Now we can safely update them. */ -+ for (i = 0; i < helper->expect_class_max + 1; i++) { -+ policy = (struct nf_conntrack_expect_policy *) -+ &helper->expect_policy[i]; -+ policy->max_expected = new_policy->max_expected; -+ policy->timeout = new_policy->timeout; -+ } -+ -+ return 0; -+} -+ -+static int nfnl_cthelper_update_policy(struct nf_conntrack_helper *helper, -+ const struct nlattr *attr) -+{ -+ struct nlattr *tb[NFCTH_POLICY_SET_MAX + 1]; -+ unsigned int class_max; -+ int err; -+ -+ err = nla_parse_nested(tb, NFCTH_POLICY_SET_MAX, attr, -+ nfnl_cthelper_expect_policy_set); -+ if (err < 0) -+ return err; -+ -+ if (!tb[NFCTH_POLICY_SET_NUM]) -+ return -EINVAL; -+ -+ class_max = ntohl(nla_get_be32(tb[NFCTH_POLICY_SET_NUM])); -+ if (helper->expect_class_max + 1 != class_max) -+ return -EBUSY; -+ -+ return nfnl_cthelper_update_policy_all(tb, helper); -+} -+ - static int - nfnl_cthelper_update(const struct nlattr * const tb[], - struct nf_conntrack_helper *helper) -@@ -265,8 +360,7 @@ nfnl_cthelper_update(const struct nlattr * const tb[], - return -EBUSY; - - if (tb[NFCTH_POLICY]) { -- ret = nfnl_cthelper_parse_expect_policy(helper, -- tb[NFCTH_POLICY]); -+ ret = nfnl_cthelper_update_policy(helper, tb[NFCTH_POLICY]); - if (ret < 0) - return ret; - } -@@ -295,7 +389,8 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb, - const char *helper_name; - struct nf_conntrack_helper *cur, *helper = NULL; - struct nf_conntrack_tuple tuple; -- int ret = 0, i; -+ struct nfnl_cthelper *nlcth; -+ int ret = 0; - - if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) - return -EINVAL; -@@ -306,31 +401,22 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb, - if (ret < 0) - return ret; - -- rcu_read_lock(); -- for (i = 0; i < nf_ct_helper_hsize && !helper; i++) { -- hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) { -+ list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { -+ cur = &nlcth->helper; - -- /* skip non-userspace conntrack helpers. */ -- if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) -- continue; -+ if (strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) -+ continue; - -- if (strncmp(cur->name, helper_name, -- NF_CT_HELPER_NAME_LEN) != 0) -- continue; -+ if ((tuple.src.l3num != cur->tuple.src.l3num || -+ tuple.dst.protonum != cur->tuple.dst.protonum)) -+ continue; - -- if ((tuple.src.l3num != cur->tuple.src.l3num || -- tuple.dst.protonum != cur->tuple.dst.protonum)) -- continue; -+ if (nlh->nlmsg_flags & NLM_F_EXCL) -+ return -EEXIST; - -- if (nlh->nlmsg_flags & NLM_F_EXCL) { -- ret = -EEXIST; -- goto err; -- } -- helper = cur; -- break; -- } -+ helper = cur; -+ break; - } -- rcu_read_unlock(); - - if (helper == NULL) - ret = nfnl_cthelper_create(tb, &tuple); -@@ -338,9 +424,6 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb, - ret = nfnl_cthelper_update(tb, helper); - - return ret; --err: -- rcu_read_unlock(); -- return ret; - } - - static int -@@ -504,11 +587,12 @@ static int - nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb, - const struct nlmsghdr *nlh, const struct nlattr * const tb[]) - { -- int ret = -ENOENT, i; -+ int ret = -ENOENT; - struct nf_conntrack_helper *cur; - struct sk_buff *skb2; - char *helper_name = NULL; - struct nf_conntrack_tuple tuple; -+ struct nfnl_cthelper *nlcth; - bool tuple_set = false; - - if (nlh->nlmsg_flags & NLM_F_DUMP) { -@@ -529,45 +613,39 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb, - tuple_set = true; - } - -- for (i = 0; i < nf_ct_helper_hsize; i++) { -- hlist_for_each_entry_rcu(cur, &nf_ct_helper_hash[i], hnode) { -+ list_for_each_entry(nlcth, &nfnl_cthelper_list, list) { -+ cur = &nlcth->helper; -+ if (helper_name && -+ strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) -+ continue; - -- /* skip non-userspace conntrack helpers. */ -- if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) -- continue; -+ if (tuple_set && -+ (tuple.src.l3num != cur->tuple.src.l3num || -+ tuple.dst.protonum != cur->tuple.dst.protonum)) -+ continue; - -- if (helper_name && strncmp(cur->name, helper_name, -- NF_CT_HELPER_NAME_LEN) != 0) { -- continue; -- } -- if (tuple_set && -- (tuple.src.l3num != cur->tuple.src.l3num || -- tuple.dst.protonum != cur->tuple.dst.protonum)) -- continue; -- -- skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -- if (skb2 == NULL) { -- ret = -ENOMEM; -- break; -- } -+ skb2 = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); -+ if (skb2 == NULL) { -+ ret = -ENOMEM; -+ break; -+ } - -- ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid, -- nlh->nlmsg_seq, -- NFNL_MSG_TYPE(nlh->nlmsg_type), -- NFNL_MSG_CTHELPER_NEW, cur); -- if (ret <= 0) { -- kfree_skb(skb2); -- break; -- } -+ ret = nfnl_cthelper_fill_info(skb2, NETLINK_CB(skb).portid, -+ nlh->nlmsg_seq, -+ NFNL_MSG_TYPE(nlh->nlmsg_type), -+ NFNL_MSG_CTHELPER_NEW, cur); -+ if (ret <= 0) { -+ kfree_skb(skb2); -+ break; -+ } - -- ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid, -- MSG_DONTWAIT); -- if (ret > 0) -- ret = 0; -+ ret = netlink_unicast(nfnl, skb2, NETLINK_CB(skb).portid, -+ MSG_DONTWAIT); -+ if (ret > 0) -+ ret = 0; - -- /* this avoids a loop in nfnetlink. */ -- return ret == -EAGAIN ? -ENOBUFS : ret; -- } -+ /* this avoids a loop in nfnetlink. */ -+ return ret == -EAGAIN ? -ENOBUFS : ret; - } - return ret; - } -@@ -578,10 +656,10 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb, - { - char *helper_name = NULL; - struct nf_conntrack_helper *cur; -- struct hlist_node *tmp; - struct nf_conntrack_tuple tuple; - bool tuple_set = false, found = false; -- int i, j = 0, ret; -+ struct nfnl_cthelper *nlcth, *n; -+ int j = 0, ret; - - if (tb[NFCTH_NAME]) - helper_name = nla_data(tb[NFCTH_NAME]); -@@ -594,28 +672,27 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb, - tuple_set = true; - } - -- for (i = 0; i < nf_ct_helper_hsize; i++) { -- hlist_for_each_entry_safe(cur, tmp, &nf_ct_helper_hash[i], -- hnode) { -- /* skip non-userspace conntrack helpers. */ -- if (!(cur->flags & NF_CT_HELPER_F_USERSPACE)) -- continue; -+ list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { -+ cur = &nlcth->helper; -+ j++; - -- j++; -+ if (helper_name && -+ strncmp(cur->name, helper_name, NF_CT_HELPER_NAME_LEN)) -+ continue; - -- if (helper_name && strncmp(cur->name, helper_name, -- NF_CT_HELPER_NAME_LEN) != 0) { -- continue; -- } -- if (tuple_set && -- (tuple.src.l3num != cur->tuple.src.l3num || -- tuple.dst.protonum != cur->tuple.dst.protonum)) -- continue; -+ if (tuple_set && -+ (tuple.src.l3num != cur->tuple.src.l3num || -+ tuple.dst.protonum != cur->tuple.dst.protonum)) -+ continue; - -- found = true; -- nf_conntrack_helper_unregister(cur); -- } -+ found = true; -+ nf_conntrack_helper_unregister(cur); -+ kfree(cur->expect_policy); -+ -+ list_del(&nlcth->list); -+ kfree(nlcth); - } -+ - /* Make sure we return success if we flush and there is no helpers */ - return (found || j == 0) ? 0 : -ENOENT; - } -@@ -664,20 +741,16 @@ err_out: - static void __exit nfnl_cthelper_exit(void) - { - struct nf_conntrack_helper *cur; -- struct hlist_node *tmp; -- int i; -+ struct nfnl_cthelper *nlcth, *n; - - nfnetlink_subsys_unregister(&nfnl_cthelper_subsys); - -- for (i=0; iflags & NF_CT_HELPER_F_USERSPACE)) -- continue; -+ list_for_each_entry_safe(nlcth, n, &nfnl_cthelper_list, list) { -+ cur = &nlcth->helper; - -- nf_conntrack_helper_unregister(cur); -- } -+ nf_conntrack_helper_unregister(cur); -+ kfree(cur->expect_policy); -+ kfree(nlcth); - } - } - -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index 861c6615253b..f6837f9b6d6c 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -390,7 +390,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - GFP_ATOMIC); - if (!skb) { - skb_tx_error(entskb); -- return NULL; -+ goto nlmsg_failure; - } - - nlh = nlmsg_put(skb, 0, 0, -@@ -399,7 +399,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - if (!nlh) { - skb_tx_error(entskb); - kfree_skb(skb); -- return NULL; -+ goto nlmsg_failure; - } - nfmsg = nlmsg_data(nlh); - nfmsg->nfgen_family = entry->state.pf; -@@ -542,12 +542,17 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, - } - - nlh->nlmsg_len = skb->len; -+ if (seclen) -+ security_release_secctx(secdata, seclen); - return skb; - - nla_put_failure: - skb_tx_error(entskb); - kfree_skb(skb); - net_err_ratelimited("nf_queue: error creating packet message\n"); -+nlmsg_failure: -+ if (seclen) -+ security_release_secctx(secdata, seclen); - return NULL; - } - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index a87afc4f3c91..5fabe68e20dd 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -96,6 +96,44 @@ EXPORT_SYMBOL_GPL(nl_table); - - static DECLARE_WAIT_QUEUE_HEAD(nl_table_wait); - -+static struct lock_class_key nlk_cb_mutex_keys[MAX_LINKS]; -+ -+static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = { -+ "nlk_cb_mutex-ROUTE", -+ "nlk_cb_mutex-1", -+ "nlk_cb_mutex-USERSOCK", -+ "nlk_cb_mutex-FIREWALL", -+ "nlk_cb_mutex-SOCK_DIAG", -+ "nlk_cb_mutex-NFLOG", -+ "nlk_cb_mutex-XFRM", -+ "nlk_cb_mutex-SELINUX", -+ "nlk_cb_mutex-ISCSI", -+ "nlk_cb_mutex-AUDIT", -+ "nlk_cb_mutex-FIB_LOOKUP", -+ "nlk_cb_mutex-CONNECTOR", -+ "nlk_cb_mutex-NETFILTER", -+ "nlk_cb_mutex-IP6_FW", -+ "nlk_cb_mutex-DNRTMSG", -+ "nlk_cb_mutex-KOBJECT_UEVENT", -+ "nlk_cb_mutex-GENERIC", -+ "nlk_cb_mutex-17", -+ "nlk_cb_mutex-SCSITRANSPORT", -+ "nlk_cb_mutex-ECRYPTFS", -+ "nlk_cb_mutex-RDMA", -+ "nlk_cb_mutex-CRYPTO", -+ "nlk_cb_mutex-SMC", -+ "nlk_cb_mutex-23", -+ "nlk_cb_mutex-24", -+ "nlk_cb_mutex-25", -+ "nlk_cb_mutex-26", -+ "nlk_cb_mutex-27", -+ "nlk_cb_mutex-28", -+ "nlk_cb_mutex-29", -+ "nlk_cb_mutex-30", -+ "nlk_cb_mutex-31", -+ "nlk_cb_mutex-MAX_LINKS" -+}; -+ - static int netlink_dump(struct sock *sk); - static void netlink_skb_destructor(struct sk_buff *skb); - -@@ -585,6 +623,9 @@ static int __netlink_create(struct net *net, struct socket *sock, - } else { - nlk->cb_mutex = &nlk->cb_def_mutex; - mutex_init(nlk->cb_mutex); -+ lockdep_set_class_and_name(nlk->cb_mutex, -+ nlk_cb_mutex_keys + protocol, -+ nlk_cb_mutex_key_strings[protocol]); - } - init_waitqueue_head(&nlk->wait); - -diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c -index d0dff0cd8186..cce4e6ada7fa 100644 ---- a/net/sched/sch_dsmark.c -+++ b/net/sched/sch_dsmark.c -@@ -199,9 +199,13 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch) - pr_debug("%s(skb %p,sch %p,[qdisc %p])\n", __func__, skb, sch, p); - - if (p->set_tc_index) { -+ int wlen = skb_network_offset(skb); -+ - switch (tc_skb_protocol(skb)) { - case htons(ETH_P_IP): -- if (skb_cow_head(skb, sizeof(struct iphdr))) -+ wlen += sizeof(struct iphdr); -+ if (!pskb_may_pull(skb, wlen) || -+ skb_try_make_writable(skb, wlen)) - goto drop; - - skb->tc_index = ipv4_get_dsfield(ip_hdr(skb)) -@@ -209,7 +213,9 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch) - break; - - case htons(ETH_P_IPV6): -- if (skb_cow_head(skb, sizeof(struct ipv6hdr))) -+ wlen += sizeof(struct ipv6hdr); -+ if (!pskb_may_pull(skb, wlen) || -+ skb_try_make_writable(skb, wlen)) - goto drop; - - skb->tc_index = ipv6_get_dsfield(ipv6_hdr(skb)) -diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c -index 8fef1b8d1fd8..cce9ae5ec93b 100644 ---- a/sound/hda/hdac_i915.c -+++ b/sound/hda/hdac_i915.c -@@ -240,7 +240,8 @@ out_master_del: - out_err: - kfree(acomp); - bus->audio_component = NULL; -- dev_err(dev, "failed to add i915 component master (%d)\n", ret); -+ hdac_acomp = NULL; -+ dev_info(dev, "failed to add i915 component master (%d)\n", ret); - - return ret; - } -@@ -273,6 +274,7 @@ int snd_hdac_i915_exit(struct hdac_bus *bus) - - kfree(acomp); - bus->audio_component = NULL; -+ hdac_acomp = NULL; - - return 0; - } -diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c -index e2e08fc73b50..20512fe32a97 100644 ---- a/sound/pci/hda/hda_intel.c -+++ b/sound/pci/hda/hda_intel.c -@@ -2088,9 +2088,11 @@ static int azx_probe_continue(struct azx *chip) - * for other chips, still continue probing as other - * codecs can be on the same link. - */ -- if (CONTROLLER_IN_GPU(pci)) -+ if (CONTROLLER_IN_GPU(pci)) { -+ dev_err(chip->card->dev, -+ "HSW/BDW HD-audio HDMI/DP requires binding with gfx driver\n"); - goto out_free; -- else -+ } else - goto skip_i915; - } - -diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c -index ac5de4365e15..c92b7ba344ef 100644 ---- a/sound/pci/hda/patch_conexant.c -+++ b/sound/pci/hda/patch_conexant.c -@@ -261,6 +261,7 @@ enum { - CXT_FIXUP_HP_530, - CXT_FIXUP_CAP_MIX_AMP_5047, - CXT_FIXUP_MUTE_LED_EAPD, -+ CXT_FIXUP_HP_DOCK, - CXT_FIXUP_HP_SPECTRE, - CXT_FIXUP_HP_GATE_MIC, - }; -@@ -778,6 +779,14 @@ static const struct hda_fixup cxt_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = cxt_fixup_mute_led_eapd, - }, -+ [CXT_FIXUP_HP_DOCK] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x16, 0x21011020 }, /* line-out */ -+ { 0x18, 0x2181103f }, /* line-in */ -+ { } -+ } -+ }, - [CXT_FIXUP_HP_SPECTRE] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -839,6 +848,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = { - SND_PCI_QUIRK(0x1025, 0x0543, "Acer Aspire One 522", CXT_FIXUP_STEREO_DMIC), - SND_PCI_QUIRK(0x1025, 0x054c, "Acer Aspire 3830TG", CXT_FIXUP_ASPIRE_DMIC), - SND_PCI_QUIRK(0x1025, 0x054f, "Acer Aspire 4830T", CXT_FIXUP_ASPIRE_DMIC), -+ SND_PCI_QUIRK(0x103c, 0x8079, "HP EliteBook 840 G3", CXT_FIXUP_HP_DOCK), - SND_PCI_QUIRK(0x103c, 0x8174, "HP Spectre x360", CXT_FIXUP_HP_SPECTRE), - SND_PCI_QUIRK(0x103c, 0x8115, "HP Z1 Gen3", CXT_FIXUP_HP_GATE_MIC), - SND_PCI_QUIRK(0x1043, 0x138d, "Asus", CXT_FIXUP_HEADPHONE_MIC_PIN), -@@ -872,6 +882,7 @@ static const struct hda_model_fixup cxt5066_fixup_models[] = { - { .id = CXT_PINCFG_LEMOTE_A1205, .name = "lemote-a1205" }, - { .id = CXT_FIXUP_OLPC_XO, .name = "olpc-xo" }, - { .id = CXT_FIXUP_MUTE_LED_EAPD, .name = "mute-led-eapd" }, -+ { .id = CXT_FIXUP_HP_DOCK, .name = "hp-dock" }, - {} - }; - -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index e5730a7d0480..2159b18f76bf 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -4839,6 +4839,7 @@ enum { - ALC286_FIXUP_HP_GPIO_LED, - ALC280_FIXUP_HP_GPIO2_MIC_HOTKEY, - ALC280_FIXUP_HP_DOCK_PINS, -+ ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, - ALC280_FIXUP_HP_9480M, - ALC288_FIXUP_DELL_HEADSET_MODE, - ALC288_FIXUP_DELL1_MIC_NO_PRESENCE, -@@ -5377,6 +5378,16 @@ static const struct hda_fixup alc269_fixups[] = { - .chained = true, - .chain_id = ALC280_FIXUP_HP_GPIO4 - }, -+ [ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED] = { -+ .type = HDA_FIXUP_PINS, -+ .v.pins = (const struct hda_pintbl[]) { -+ { 0x1b, 0x21011020 }, /* line-out */ -+ { 0x18, 0x2181103f }, /* line-in */ -+ { }, -+ }, -+ .chained = true, -+ .chain_id = ALC269_FIXUP_HP_GPIO_MIC1_LED -+ }, - [ALC280_FIXUP_HP_9480M] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc280_fixup_hp_9480m, -@@ -5629,7 +5640,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x103c, 0x2256, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2257, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2259, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -- SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_GPIO_MIC1_LED), -+ SND_PCI_QUIRK(0x103c, 0x225a, "HP", ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED), - SND_PCI_QUIRK(0x103c, 0x2260, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x2263, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), - SND_PCI_QUIRK(0x103c, 0x2264, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), -@@ -5794,6 +5805,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = { - {.id = ALC269_FIXUP_HEADSET_MODE_NO_HP_MIC, .name = "headset-mode-no-hp-mic"}, - {.id = ALC269_FIXUP_LENOVO_DOCK, .name = "lenovo-dock"}, - {.id = ALC269_FIXUP_HP_GPIO_LED, .name = "hp-gpio-led"}, -+ {.id = ALC269_FIXUP_HP_DOCK_GPIO_MIC1_LED, .name = "hp-dock-gpio-mic1-led"}, - {.id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE, .name = "dell-headset-multi"}, - {.id = ALC269_FIXUP_DELL2_MIC_NO_PRESENCE, .name = "dell-headset-dock"}, - {.id = ALC283_FIXUP_CHROME_BOOK, .name = "alc283-dac-wcaps"}, -diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c -index cb092bd9965b..d080f06fd8d9 100644 ---- a/virt/kvm/kvm_main.c -+++ b/virt/kvm/kvm_main.c -@@ -986,7 +986,7 @@ int __kvm_set_memory_region(struct kvm *kvm, - * changes) is disallowed above, so any other attribute changes getting - * here can be skipped. - */ -- if ((change == KVM_MR_CREATE) || (change == KVM_MR_MOVE)) { -+ if (as_id == 0 && (change == KVM_MR_CREATE || change == KVM_MR_MOVE)) { - r = kvm_iommu_map_pages(kvm, &new); - return r; - } diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.108-109.patch b/patch/kernel/mvebu64-default/04-patch-4.4.108-109.patch deleted file mode 100644 index c8ade742e1d1..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.108-109.patch +++ /dev/null @@ -1,2275 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 5d593ecadb90..b4a83a490212 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2555,6 +2555,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - nopat [X86] Disable PAT (page attribute table extension of - pagetables) support. - -+ nopcid [X86-64] Disable the PCID cpu feature. -+ - norandmaps Don't use address space randomization. Equivalent to - echo 0 > /proc/sys/kernel/randomize_va_space - -diff --git a/Makefile b/Makefile -index 99f9834c4ba6..5d67056e24dd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 108 -+SUBLEVEL = 109 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -782,6 +782,9 @@ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) - # disable invalid "can't wrap" optimizations for signed / pointers - KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) - -+# Make sure -fstack-check isn't enabled (like gentoo apparently did) -+KBUILD_CFLAGS += $(call cc-option,-fno-stack-check,) -+ - # conserve stack if available - KBUILD_CFLAGS += $(call cc-option,-fconserve-stack) - -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index d1e65ce545b3..b2ab164a8094 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -401,8 +401,12 @@ static __u64 power_pmu_bhrb_to(u64 addr) - int ret; - __u64 target; - -- if (is_kernel_addr(addr)) -- return branch_target((unsigned int *)addr); -+ if (is_kernel_addr(addr)) { -+ if (probe_kernel_read(&instr, (void *)addr, sizeof(instr))) -+ return 0; -+ -+ return branch_target(&instr); -+ } - - /* Userspace: need copy instruction here then translate it */ - pagefault_disable(); -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 7e40905f6d4c..39d2dc66faa5 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -42,7 +42,7 @@ config X86 - select ARCH_USE_CMPXCHG_LOCKREF if X86_64 - select ARCH_USE_QUEUED_RWLOCKS - select ARCH_USE_QUEUED_SPINLOCKS -- select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH if SMP -+ select ARCH_WANT_BATCHED_UNMAP_TLB_FLUSH - select ARCH_WANTS_DYNAMIC_TASK_STRUCT - select ARCH_WANT_FRAME_POINTERS - select ARCH_WANT_IPC_PARSE_VERSION if X86_32 -diff --git a/arch/x86/include/asm/disabled-features.h b/arch/x86/include/asm/disabled-features.h -index f226df064660..8b17c2ad1048 100644 ---- a/arch/x86/include/asm/disabled-features.h -+++ b/arch/x86/include/asm/disabled-features.h -@@ -21,11 +21,13 @@ - # define DISABLE_K6_MTRR (1<<(X86_FEATURE_K6_MTRR & 31)) - # define DISABLE_CYRIX_ARR (1<<(X86_FEATURE_CYRIX_ARR & 31)) - # define DISABLE_CENTAUR_MCR (1<<(X86_FEATURE_CENTAUR_MCR & 31)) -+# define DISABLE_PCID 0 - #else - # define DISABLE_VME 0 - # define DISABLE_K6_MTRR 0 - # define DISABLE_CYRIX_ARR 0 - # define DISABLE_CENTAUR_MCR 0 -+# define DISABLE_PCID (1<<(X86_FEATURE_PCID & 31)) - #endif /* CONFIG_X86_64 */ - - /* -@@ -35,7 +37,7 @@ - #define DISABLED_MASK1 0 - #define DISABLED_MASK2 0 - #define DISABLED_MASK3 (DISABLE_CYRIX_ARR|DISABLE_CENTAUR_MCR|DISABLE_K6_MTRR) --#define DISABLED_MASK4 0 -+#define DISABLED_MASK4 (DISABLE_PCID) - #define DISABLED_MASK5 0 - #define DISABLED_MASK6 0 - #define DISABLED_MASK7 0 -diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h -index 59405a248fc2..9b76cd331990 100644 ---- a/arch/x86/include/asm/hardirq.h -+++ b/arch/x86/include/asm/hardirq.h -@@ -22,8 +22,8 @@ typedef struct { - #ifdef CONFIG_SMP - unsigned int irq_resched_count; - unsigned int irq_call_count; -- unsigned int irq_tlb_count; - #endif -+ unsigned int irq_tlb_count; - #ifdef CONFIG_X86_THERMAL_VECTOR - unsigned int irq_thermal_count; - #endif -diff --git a/arch/x86/include/asm/mmu.h b/arch/x86/include/asm/mmu.h -index 55234d5e7160..7680b76adafc 100644 ---- a/arch/x86/include/asm/mmu.h -+++ b/arch/x86/include/asm/mmu.h -@@ -24,12 +24,6 @@ typedef struct { - atomic_t perf_rdpmc_allowed; /* nonzero if rdpmc is allowed */ - } mm_context_t; - --#ifdef CONFIG_SMP - void leave_mm(int cpu); --#else --static inline void leave_mm(int cpu) --{ --} --#endif - - #endif /* _ASM_X86_MMU_H */ -diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h -index 44fc93987869..9bfc5fd77015 100644 ---- a/arch/x86/include/asm/mmu_context.h -+++ b/arch/x86/include/asm/mmu_context.h -@@ -98,10 +98,8 @@ static inline void load_mm_ldt(struct mm_struct *mm) - - static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk) - { --#ifdef CONFIG_SMP - if (this_cpu_read(cpu_tlbstate.state) == TLBSTATE_OK) - this_cpu_write(cpu_tlbstate.state, TLBSTATE_LAZY); --#endif - } - - extern void switch_mm(struct mm_struct *prev, struct mm_struct *next, -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 4dc534175b5e..9fc5968da820 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -6,6 +6,7 @@ - - #include - #include -+#include - - static inline void __invpcid(unsigned long pcid, unsigned long addr, - unsigned long type) -@@ -64,10 +65,8 @@ static inline void invpcid_flush_all_nonglobals(void) - #endif - - struct tlb_state { --#ifdef CONFIG_SMP - struct mm_struct *active_mm; - int state; --#endif - - /* - * Access to this CR4 shadow and to H/W CR4 is protected by -@@ -191,6 +190,14 @@ static inline void __flush_tlb_all(void) - __flush_tlb_global(); - else - __flush_tlb(); -+ -+ /* -+ * Note: if we somehow had PCID but not PGE, then this wouldn't work -- -+ * we'd end up flushing kernel translations for the current ASID but -+ * we might fail to flush kernel translations for other cached ASIDs. -+ * -+ * To avoid this issue, we force PCID off if PGE is off. -+ */ - } - - static inline void __flush_tlb_one(unsigned long addr) -@@ -204,7 +211,6 @@ static inline void __flush_tlb_one(unsigned long addr) - /* - * TLB flushing: - * -- * - flush_tlb() flushes the current mm struct TLBs - * - flush_tlb_all() flushes all processes TLBs - * - flush_tlb_mm(mm) flushes the specified mm context TLB's - * - flush_tlb_page(vma, vmaddr) flushes one page -@@ -216,84 +222,6 @@ static inline void __flush_tlb_one(unsigned long addr) - * and page-granular flushes are available only on i486 and up. - */ - --#ifndef CONFIG_SMP -- --/* "_up" is for UniProcessor. -- * -- * This is a helper for other header functions. *Not* intended to be called -- * directly. All global TLB flushes need to either call this, or to bump the -- * vm statistics themselves. -- */ --static inline void __flush_tlb_up(void) --{ -- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); -- __flush_tlb(); --} -- --static inline void flush_tlb_all(void) --{ -- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); -- __flush_tlb_all(); --} -- --static inline void flush_tlb(void) --{ -- __flush_tlb_up(); --} -- --static inline void local_flush_tlb(void) --{ -- __flush_tlb_up(); --} -- --static inline void flush_tlb_mm(struct mm_struct *mm) --{ -- if (mm == current->active_mm) -- __flush_tlb_up(); --} -- --static inline void flush_tlb_page(struct vm_area_struct *vma, -- unsigned long addr) --{ -- if (vma->vm_mm == current->active_mm) -- __flush_tlb_one(addr); --} -- --static inline void flush_tlb_range(struct vm_area_struct *vma, -- unsigned long start, unsigned long end) --{ -- if (vma->vm_mm == current->active_mm) -- __flush_tlb_up(); --} -- --static inline void flush_tlb_mm_range(struct mm_struct *mm, -- unsigned long start, unsigned long end, unsigned long vmflag) --{ -- if (mm == current->active_mm) -- __flush_tlb_up(); --} -- --static inline void native_flush_tlb_others(const struct cpumask *cpumask, -- struct mm_struct *mm, -- unsigned long start, -- unsigned long end) --{ --} -- --static inline void reset_lazy_tlbstate(void) --{ --} -- --static inline void flush_tlb_kernel_range(unsigned long start, -- unsigned long end) --{ -- flush_tlb_all(); --} -- --#else /* SMP */ -- --#include -- - #define local_flush_tlb() __flush_tlb() - - #define flush_tlb_mm(mm) flush_tlb_mm_range(mm, 0UL, TLB_FLUSH_ALL, 0UL) -@@ -302,13 +230,14 @@ static inline void flush_tlb_kernel_range(unsigned long start, - flush_tlb_mm_range(vma->vm_mm, start, end, vma->vm_flags) - - extern void flush_tlb_all(void); --extern void flush_tlb_current_task(void); --extern void flush_tlb_page(struct vm_area_struct *, unsigned long); - extern void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, - unsigned long end, unsigned long vmflag); - extern void flush_tlb_kernel_range(unsigned long start, unsigned long end); - --#define flush_tlb() flush_tlb_current_task() -+static inline void flush_tlb_page(struct vm_area_struct *vma, unsigned long a) -+{ -+ flush_tlb_mm_range(vma->vm_mm, a, a + PAGE_SIZE, VM_NONE); -+} - - void native_flush_tlb_others(const struct cpumask *cpumask, - struct mm_struct *mm, -@@ -323,8 +252,6 @@ static inline void reset_lazy_tlbstate(void) - this_cpu_write(cpu_tlbstate.active_mm, &init_mm); - } - --#endif /* SMP */ -- - #ifndef CONFIG_PARAVIRT - #define flush_tlb_others(mask, mm, start, end) \ - native_flush_tlb_others(mask, mm, start, end) -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index bd17db15a2c1..0b6124315441 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -19,6 +19,14 @@ - - void __init check_bugs(void) - { -+#ifdef CONFIG_X86_32 -+ /* -+ * Regardless of whether PCID is enumerated, the SDM says -+ * that it can't be enabled in 32-bit mode. -+ */ -+ setup_clear_cpu_cap(X86_FEATURE_PCID); -+#endif -+ - identify_boot_cpu(); - #ifndef CONFIG_SMP - pr_info("CPU: "); -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index c84b62956e8d..aa1e7246b06b 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -162,6 +162,24 @@ static int __init x86_mpx_setup(char *s) - } - __setup("nompx", x86_mpx_setup); - -+#ifdef CONFIG_X86_64 -+static int __init x86_pcid_setup(char *s) -+{ -+ /* require an exact match without trailing characters */ -+ if (strlen(s)) -+ return 0; -+ -+ /* do not emit a message if the feature is not present */ -+ if (!boot_cpu_has(X86_FEATURE_PCID)) -+ return 1; -+ -+ setup_clear_cpu_cap(X86_FEATURE_PCID); -+ pr_info("nopcid: PCID feature disabled\n"); -+ return 1; -+} -+__setup("nopcid", x86_pcid_setup); -+#endif -+ - static int __init x86_noinvpcid_setup(char *s) - { - /* noinvpcid doesn't accept parameters */ -@@ -303,6 +321,25 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) - } - } - -+static void setup_pcid(struct cpuinfo_x86 *c) -+{ -+ if (cpu_has(c, X86_FEATURE_PCID)) { -+ if (cpu_has(c, X86_FEATURE_PGE)) { -+ cr4_set_bits(X86_CR4_PCIDE); -+ } else { -+ /* -+ * flush_tlb_all(), as currently implemented, won't -+ * work if PCID is on but PGE is not. Since that -+ * combination doesn't exist on real hardware, there's -+ * no reason to try to fully support it, but it's -+ * polite to avoid corrupting data if we're on -+ * an improperly configured VM. -+ */ -+ clear_cpu_cap(c, X86_FEATURE_PCID); -+ } -+ } -+} -+ - /* - * Some CPU features depend on higher CPUID levels, which may not always - * be available due to CPUID level capping or broken virtualization -@@ -934,6 +971,9 @@ static void identify_cpu(struct cpuinfo_x86 *c) - setup_smep(c); - setup_smap(c); - -+ /* Set up PCID */ -+ setup_pcid(c); -+ - /* - * The vendor-specific functions might have changed features. - * Now we do "generic changes." -diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c -index f660d63f40fe..9a16932c7258 100644 ---- a/arch/x86/kernel/reboot.c -+++ b/arch/x86/kernel/reboot.c -@@ -93,6 +93,10 @@ void __noreturn machine_real_restart(unsigned int type) - load_cr3(initial_page_table); - #else - write_cr3(real_mode_header->trampoline_pgd); -+ -+ /* Exiting long mode will fail if CR4.PCIDE is set. */ -+ if (static_cpu_has(X86_FEATURE_PCID)) -+ cr4_clear_bits(X86_CR4_PCIDE); - #endif - - /* Jump to the identity-mapped low memory code */ -diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c -index fbabe4fcc7fb..fe89f938e0f0 100644 ---- a/arch/x86/kernel/smpboot.c -+++ b/arch/x86/kernel/smpboot.c -@@ -104,25 +104,16 @@ static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip) - spin_lock_irqsave(&rtc_lock, flags); - CMOS_WRITE(0xa, 0xf); - spin_unlock_irqrestore(&rtc_lock, flags); -- local_flush_tlb(); -- pr_debug("1.\n"); - *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) = - start_eip >> 4; -- pr_debug("2.\n"); - *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) = - start_eip & 0xf; -- pr_debug("3.\n"); - } - - static inline void smpboot_restore_warm_reset_vector(void) - { - unsigned long flags; - -- /* -- * Install writable page 0 entry to set BIOS data area. -- */ -- local_flush_tlb(); -- - /* - * Paranoid: Set warm reset code and vector here back - * to default values. -diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c -index 524619351961..510e80da7de4 100644 ---- a/arch/x86/kernel/vm86_32.c -+++ b/arch/x86/kernel/vm86_32.c -@@ -187,7 +187,7 @@ static void mark_screen_rdonly(struct mm_struct *mm) - pte_unmap_unlock(pte, ptl); - out: - up_write(&mm->mmap_sem); -- flush_tlb(); -+ flush_tlb_mm_range(mm, 0xA0000, 0xA0000 + 32*PAGE_SIZE, 0UL); - } - - -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 684edebb4a0c..00045499f6c2 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -2383,9 +2383,21 @@ static int rsm_load_seg_64(struct x86_emulate_ctxt *ctxt, u64 smbase, int n) - } - - static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt, -- u64 cr0, u64 cr4) -+ u64 cr0, u64 cr3, u64 cr4) - { - int bad; -+ u64 pcid; -+ -+ /* In order to later set CR4.PCIDE, CR3[11:0] must be zero. */ -+ pcid = 0; -+ if (cr4 & X86_CR4_PCIDE) { -+ pcid = cr3 & 0xfff; -+ cr3 &= ~0xfff; -+ } -+ -+ bad = ctxt->ops->set_cr(ctxt, 3, cr3); -+ if (bad) -+ return X86EMUL_UNHANDLEABLE; - - /* - * First enable PAE, long mode needs it before CR0.PG = 1 is set. -@@ -2404,6 +2416,12 @@ static int rsm_enter_protected_mode(struct x86_emulate_ctxt *ctxt, - bad = ctxt->ops->set_cr(ctxt, 4, cr4); - if (bad) - return X86EMUL_UNHANDLEABLE; -+ if (pcid) { -+ bad = ctxt->ops->set_cr(ctxt, 3, cr3 | pcid); -+ if (bad) -+ return X86EMUL_UNHANDLEABLE; -+ } -+ - } - - return X86EMUL_CONTINUE; -@@ -2414,11 +2432,11 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase) - struct desc_struct desc; - struct desc_ptr dt; - u16 selector; -- u32 val, cr0, cr4; -+ u32 val, cr0, cr3, cr4; - int i; - - cr0 = GET_SMSTATE(u32, smbase, 0x7ffc); -- ctxt->ops->set_cr(ctxt, 3, GET_SMSTATE(u32, smbase, 0x7ff8)); -+ cr3 = GET_SMSTATE(u32, smbase, 0x7ff8); - ctxt->eflags = GET_SMSTATE(u32, smbase, 0x7ff4) | X86_EFLAGS_FIXED; - ctxt->_eip = GET_SMSTATE(u32, smbase, 0x7ff0); - -@@ -2460,14 +2478,14 @@ static int rsm_load_state_32(struct x86_emulate_ctxt *ctxt, u64 smbase) - - ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7ef8)); - -- return rsm_enter_protected_mode(ctxt, cr0, cr4); -+ return rsm_enter_protected_mode(ctxt, cr0, cr3, cr4); - } - - static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase) - { - struct desc_struct desc; - struct desc_ptr dt; -- u64 val, cr0, cr4; -+ u64 val, cr0, cr3, cr4; - u32 base3; - u16 selector; - int i, r; -@@ -2484,7 +2502,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase) - ctxt->ops->set_dr(ctxt, 7, (val & DR7_VOLATILE) | DR7_FIXED_1); - - cr0 = GET_SMSTATE(u64, smbase, 0x7f58); -- ctxt->ops->set_cr(ctxt, 3, GET_SMSTATE(u64, smbase, 0x7f50)); -+ cr3 = GET_SMSTATE(u64, smbase, 0x7f50); - cr4 = GET_SMSTATE(u64, smbase, 0x7f48); - ctxt->ops->set_smbase(ctxt, GET_SMSTATE(u32, smbase, 0x7f00)); - val = GET_SMSTATE(u64, smbase, 0x7ed0); -@@ -2512,7 +2530,7 @@ static int rsm_load_state_64(struct x86_emulate_ctxt *ctxt, u64 smbase) - dt.address = GET_SMSTATE(u64, smbase, 0x7e68); - ctxt->ops->set_gdt(ctxt, &dt); - -- r = rsm_enter_protected_mode(ctxt, cr0, cr4); -+ r = rsm_enter_protected_mode(ctxt, cr0, cr3, cr4); - if (r != X86EMUL_CONTINUE) - return r; - -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index e5f44f33de89..796f1ec67469 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -6941,7 +6941,7 @@ int kvm_arch_vcpu_ioctl_set_regs(struct kvm_vcpu *vcpu, struct kvm_regs *regs) - #endif - - kvm_rip_write(vcpu, regs->rip); -- kvm_set_rflags(vcpu, regs->rflags); -+ kvm_set_rflags(vcpu, regs->rflags | X86_EFLAGS_FIXED); - - vcpu->arch.exception.pending = false; - -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 3aebbd6c6f5f..ed4b372860e4 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -753,10 +753,8 @@ void __init zone_sizes_init(void) - } - - DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = { --#ifdef CONFIG_SMP - .active_mm = &init_mm, - .state = 0, --#endif - .cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */ - }; - EXPORT_SYMBOL_GPL(cpu_tlbstate); -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 45ba87466e6a..7a4cdb632508 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -15,7 +15,7 @@ - #include - - /* -- * Smarter SMP flushing macros. -+ * TLB flushing, formerly SMP-only - * c/o Linus Torvalds. - * - * These mean you can really definitely utterly forget about -@@ -28,8 +28,6 @@ - * Implement flush IPI by CALL_FUNCTION_VECTOR, Alex Shi - */ - --#ifdef CONFIG_SMP -- - struct flush_tlb_info { - struct mm_struct *flush_mm; - unsigned long flush_start; -@@ -59,8 +57,6 @@ void leave_mm(int cpu) - } - EXPORT_SYMBOL_GPL(leave_mm); - --#endif /* CONFIG_SMP */ -- - void switch_mm(struct mm_struct *prev, struct mm_struct *next, - struct task_struct *tsk) - { -@@ -77,10 +73,8 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - unsigned cpu = smp_processor_id(); - - if (likely(prev != next)) { --#ifdef CONFIG_SMP - this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); - this_cpu_write(cpu_tlbstate.active_mm, next); --#endif - cpumask_set_cpu(cpu, mm_cpumask(next)); - - /* -@@ -137,9 +131,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - if (unlikely(prev->context.ldt != next->context.ldt)) - load_mm_ldt(next); - #endif -- } --#ifdef CONFIG_SMP -- else { -+ } else { - this_cpu_write(cpu_tlbstate.state, TLBSTATE_OK); - BUG_ON(this_cpu_read(cpu_tlbstate.active_mm) != next); - -@@ -166,11 +158,8 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - load_mm_ldt(next); - } - } --#endif - } - --#ifdef CONFIG_SMP -- - /* - * The flush IPI assumes that a thread switch happens in this order: - * [cpu0: the cpu that switches] -@@ -272,23 +261,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask, - smp_call_function_many(cpumask, flush_tlb_func, &info, 1); - } - --void flush_tlb_current_task(void) --{ -- struct mm_struct *mm = current->mm; -- -- preempt_disable(); -- -- count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); -- -- /* This is an implicit full barrier that synchronizes with switch_mm. */ -- local_flush_tlb(); -- -- trace_tlb_flush(TLB_LOCAL_SHOOTDOWN, TLB_FLUSH_ALL); -- if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) -- flush_tlb_others(mm_cpumask(mm), mm, 0UL, TLB_FLUSH_ALL); -- preempt_enable(); --} -- - /* - * See Documentation/x86/tlb.txt for details. We choose 33 - * because it is large enough to cover the vast majority (at -@@ -309,6 +281,12 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, - unsigned long base_pages_to_flush = TLB_FLUSH_ALL; - - preempt_disable(); -+ -+ if ((end != TLB_FLUSH_ALL) && !(vmflag & VM_HUGETLB)) -+ base_pages_to_flush = (end - start) >> PAGE_SHIFT; -+ if (base_pages_to_flush > tlb_single_page_flush_ceiling) -+ base_pages_to_flush = TLB_FLUSH_ALL; -+ - if (current->active_mm != mm) { - /* Synchronize with switch_mm. */ - smp_mb(); -@@ -325,15 +303,11 @@ void flush_tlb_mm_range(struct mm_struct *mm, unsigned long start, - goto out; - } - -- if ((end != TLB_FLUSH_ALL) && !(vmflag & VM_HUGETLB)) -- base_pages_to_flush = (end - start) >> PAGE_SHIFT; -- - /* - * Both branches below are implicit full barriers (MOV to CR or - * INVLPG) that synchronize with switch_mm. - */ -- if (base_pages_to_flush > tlb_single_page_flush_ceiling) { -- base_pages_to_flush = TLB_FLUSH_ALL; -+ if (base_pages_to_flush == TLB_FLUSH_ALL) { - count_vm_tlb_event(NR_TLB_LOCAL_FLUSH_ALL); - local_flush_tlb(); - } else { -@@ -354,33 +328,6 @@ out: - preempt_enable(); - } - --void flush_tlb_page(struct vm_area_struct *vma, unsigned long start) --{ -- struct mm_struct *mm = vma->vm_mm; -- -- preempt_disable(); -- -- if (current->active_mm == mm) { -- if (current->mm) { -- /* -- * Implicit full barrier (INVLPG) that synchronizes -- * with switch_mm. -- */ -- __flush_tlb_one(start); -- } else { -- leave_mm(smp_processor_id()); -- -- /* Synchronize with switch_mm. */ -- smp_mb(); -- } -- } -- -- if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) -- flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE); -- -- preempt_enable(); --} -- - static void do_flush_tlb_all(void *info) - { - count_vm_tlb_event(NR_TLB_REMOTE_FLUSH_RECEIVED); -@@ -465,5 +412,3 @@ static int __init create_tlb_single_page_flush_ceiling(void) - return 0; - } - late_initcall(create_tlb_single_page_flush_ceiling); -- --#endif /* CONFIG_SMP */ -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index ffa41591bff9..cbef64b508e1 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -433,6 +433,12 @@ static void __init xen_init_cpuid_mask(void) - ~((1 << X86_FEATURE_MTRR) | /* disable MTRR */ - (1 << X86_FEATURE_ACC)); /* thermal monitoring */ - -+ /* -+ * Xen PV would need some work to support PCID: CR3 handling as well -+ * as xen_flush_tlb_others() would need updating. -+ */ -+ cpuid_leaf1_ecx_mask &= ~(1 << (X86_FEATURE_PCID % 32)); /* disable PCID */ -+ - if (!xen_initial_domain()) - cpuid_leaf1_edx_mask &= - ~((1 << X86_FEATURE_ACPI)); /* disable ACPI */ -diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c -index b4f3930266b1..f620fe09d20a 100644 ---- a/crypto/mcryptd.c -+++ b/crypto/mcryptd.c -@@ -80,6 +80,7 @@ static int mcryptd_init_queue(struct mcryptd_queue *queue, - pr_debug("cpu_queue #%d %p\n", cpu, queue->cpu_queue); - crypto_init_queue(&cpu_queue->queue, max_cpu_qlen); - INIT_WORK(&cpu_queue->work, mcryptd_queue_worker); -+ spin_lock_init(&cpu_queue->q_lock); - } - return 0; - } -@@ -103,15 +104,16 @@ static int mcryptd_enqueue_request(struct mcryptd_queue *queue, - int cpu, err; - struct mcryptd_cpu_queue *cpu_queue; - -- cpu = get_cpu(); -- cpu_queue = this_cpu_ptr(queue->cpu_queue); -- rctx->tag.cpu = cpu; -+ cpu_queue = raw_cpu_ptr(queue->cpu_queue); -+ spin_lock(&cpu_queue->q_lock); -+ cpu = smp_processor_id(); -+ rctx->tag.cpu = smp_processor_id(); - - err = crypto_enqueue_request(&cpu_queue->queue, request); - pr_debug("enqueue request: cpu %d cpu_queue %p request %p\n", - cpu, cpu_queue, request); -+ spin_unlock(&cpu_queue->q_lock); - queue_work_on(cpu, kcrypto_wq, &cpu_queue->work); -- put_cpu(); - - return err; - } -@@ -164,16 +166,11 @@ static void mcryptd_queue_worker(struct work_struct *work) - cpu_queue = container_of(work, struct mcryptd_cpu_queue, work); - i = 0; - while (i < MCRYPTD_BATCH || single_task_running()) { -- /* -- * preempt_disable/enable is used to prevent -- * being preempted by mcryptd_enqueue_request() -- */ -- local_bh_disable(); -- preempt_disable(); -+ -+ spin_lock_bh(&cpu_queue->q_lock); - backlog = crypto_get_backlog(&cpu_queue->queue); - req = crypto_dequeue_request(&cpu_queue->queue); -- preempt_enable(); -- local_bh_enable(); -+ spin_unlock_bh(&cpu_queue->q_lock); - - if (!req) { - mcryptd_opportunistic_flush(); -@@ -188,7 +185,7 @@ static void mcryptd_queue_worker(struct work_struct *work) - ++i; - } - if (cpu_queue->queue.qlen) -- queue_work(kcrypto_wq, &cpu_queue->work); -+ queue_work_on(smp_processor_id(), kcrypto_wq, &cpu_queue->work); - } - - void mcryptd_flusher(struct work_struct *__work) -diff --git a/drivers/acpi/apei/erst.c b/drivers/acpi/apei/erst.c -index 6682c5daf742..4c9be45ea328 100644 ---- a/drivers/acpi/apei/erst.c -+++ b/drivers/acpi/apei/erst.c -@@ -1020,7 +1020,7 @@ skip: - /* The record may be cleared by others, try read next record */ - if (len == -ENOENT) - goto skip; -- else if (len < sizeof(*rcd)) { -+ else if (len < 0 || len < sizeof(*rcd)) { - rc = -EIO; - goto out; - } -diff --git a/drivers/infiniband/hw/cxgb4/cq.c b/drivers/infiniband/hw/cxgb4/cq.c -index bc147582bed9..6d62b69c898e 100644 ---- a/drivers/infiniband/hw/cxgb4/cq.c -+++ b/drivers/infiniband/hw/cxgb4/cq.c -@@ -579,10 +579,10 @@ static int poll_cq(struct t4_wq *wq, struct t4_cq *cq, struct t4_cqe *cqe, - ret = -EAGAIN; - goto skip_cqe; - } -- if (unlikely((CQE_WRID_MSN(hw_cqe) != (wq->rq.msn)))) { -+ if (unlikely(!CQE_STATUS(hw_cqe) && -+ CQE_WRID_MSN(hw_cqe) != wq->rq.msn)) { - t4_set_wq_in_error(wq); -- hw_cqe->header |= htonl(CQE_STATUS_V(T4_ERR_MSN)); -- goto proc_cqe; -+ hw_cqe->header |= cpu_to_be32(CQE_STATUS_V(T4_ERR_MSN)); - } - goto proc_cqe; - } -diff --git a/drivers/mfd/cros_ec_spi.c b/drivers/mfd/cros_ec_spi.c -index 6a0f6ec67c6b..ee7847a1ca06 100644 ---- a/drivers/mfd/cros_ec_spi.c -+++ b/drivers/mfd/cros_ec_spi.c -@@ -660,6 +660,7 @@ static int cros_ec_spi_probe(struct spi_device *spi) - sizeof(struct ec_response_get_protocol_info); - ec_dev->dout_size = sizeof(struct ec_host_request); - -+ ec_spi->last_transfer_ns = ktime_get_ns(); - - err = cros_ec_register(ec_dev); - if (err) { -diff --git a/drivers/mfd/twl4030-audio.c b/drivers/mfd/twl4030-audio.c -index 0a1606480023..cc832d309599 100644 ---- a/drivers/mfd/twl4030-audio.c -+++ b/drivers/mfd/twl4030-audio.c -@@ -159,13 +159,18 @@ unsigned int twl4030_audio_get_mclk(void) - EXPORT_SYMBOL_GPL(twl4030_audio_get_mclk); - - static bool twl4030_audio_has_codec(struct twl4030_audio_data *pdata, -- struct device_node *node) -+ struct device_node *parent) - { -+ struct device_node *node; -+ - if (pdata && pdata->codec) - return true; - -- if (of_find_node_by_name(node, "codec")) -+ node = of_get_child_by_name(parent, "codec"); -+ if (node) { -+ of_node_put(node); - return true; -+ } - - return false; - } -diff --git a/drivers/mfd/twl6040.c b/drivers/mfd/twl6040.c -index 08a693cd38cc..72aab60ae846 100644 ---- a/drivers/mfd/twl6040.c -+++ b/drivers/mfd/twl6040.c -@@ -97,12 +97,16 @@ static struct reg_sequence twl6040_patch[] = { - }; - - --static bool twl6040_has_vibra(struct device_node *node) -+static bool twl6040_has_vibra(struct device_node *parent) - { --#ifdef CONFIG_OF -- if (of_find_node_by_name(node, "vibra")) -+ struct device_node *node; -+ -+ node = of_get_child_by_name(parent, "vibra"); -+ if (node) { -+ of_node_put(node); - return true; --#endif -+ } -+ - return false; - } - -diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c -index 3613469dc5c6..ab53e0cfb4dc 100644 ---- a/drivers/net/ethernet/broadcom/tg3.c -+++ b/drivers/net/ethernet/broadcom/tg3.c -@@ -14228,7 +14228,9 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) - /* Reset PHY, otherwise the read DMA engine will be in a mode that - * breaks all requests to 256 bytes. - */ -- if (tg3_asic_rev(tp) == ASIC_REV_57766) -+ if (tg3_asic_rev(tp) == ASIC_REV_57766 || -+ tg3_asic_rev(tp) == ASIC_REV_5717 || -+ tg3_asic_rev(tp) == ASIC_REV_5719) - reset_phy = true; - - err = tg3_restart_hw(tp, reset_phy); -diff --git a/drivers/net/ethernet/marvell/mvmdio.c b/drivers/net/ethernet/marvell/mvmdio.c -index fc2fb25343f4..c122b3b99cd8 100644 ---- a/drivers/net/ethernet/marvell/mvmdio.c -+++ b/drivers/net/ethernet/marvell/mvmdio.c -@@ -241,7 +241,8 @@ static int orion_mdio_probe(struct platform_device *pdev) - dev->regs + MVMDIO_ERR_INT_MASK); - - } else if (dev->err_interrupt == -EPROBE_DEFER) { -- return -EPROBE_DEFER; -+ ret = -EPROBE_DEFER; -+ goto out_mdio; - } - - mutex_init(&dev->lock); -diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c -index c8b85f1069ff..920391165f18 100644 ---- a/drivers/net/phy/micrel.c -+++ b/drivers/net/phy/micrel.c -@@ -541,6 +541,7 @@ static int ksz9031_read_status(struct phy_device *phydev) - phydev->link = 0; - if (phydev->drv->config_intr && phy_interrupt_is_valid(phydev)) - phydev->drv->config_intr(phydev); -+ return genphy_config_aneg(phydev); - } - - return 0; -diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c -index 2cbecbda1ae3..b0ea8dee5f06 100644 ---- a/drivers/net/usb/qmi_wwan.c -+++ b/drivers/net/usb/qmi_wwan.c -@@ -737,6 +737,7 @@ static const struct usb_device_id products[] = { - {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ - {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ - {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */ -+ {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ - {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ - {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ - {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ -diff --git a/drivers/parisc/lba_pci.c b/drivers/parisc/lba_pci.c -index d0c2759076a2..312cb5b74dec 100644 ---- a/drivers/parisc/lba_pci.c -+++ b/drivers/parisc/lba_pci.c -@@ -1654,3 +1654,36 @@ void lba_set_iregs(struct parisc_device *lba, u32 ibase, u32 imask) - iounmap(base_addr); - } - -+ -+/* -+ * The design of the Diva management card in rp34x0 machines (rp3410, rp3440) -+ * seems rushed, so that many built-in components simply don't work. -+ * The following quirks disable the serial AUX port and the built-in ATI RV100 -+ * Radeon 7000 graphics card which both don't have any external connectors and -+ * thus are useless, and even worse, e.g. the AUX port occupies ttyS0 and as -+ * such makes those machines the only PARISC machines on which we can't use -+ * ttyS0 as boot console. -+ */ -+static void quirk_diva_ati_card(struct pci_dev *dev) -+{ -+ if (dev->subsystem_vendor != PCI_VENDOR_ID_HP || -+ dev->subsystem_device != 0x1292) -+ return; -+ -+ dev_info(&dev->dev, "Hiding Diva built-in ATI card"); -+ dev->device = 0; -+} -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATI, PCI_DEVICE_ID_ATI_RADEON_QY, -+ quirk_diva_ati_card); -+ -+static void quirk_diva_aux_disable(struct pci_dev *dev) -+{ -+ if (dev->subsystem_vendor != PCI_VENDOR_ID_HP || -+ dev->subsystem_device != 0x1291) -+ return; -+ -+ dev_info(&dev->dev, "Hiding Diva built-in AUX serial device"); -+ dev->device = 0; -+} -+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_DIVA_AUX, -+ quirk_diva_aux_disable); -diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c -index fca925543fae..32bd8ab79d53 100644 ---- a/drivers/pci/pci-driver.c -+++ b/drivers/pci/pci-driver.c -@@ -944,7 +944,12 @@ static int pci_pm_thaw_noirq(struct device *dev) - if (pci_has_legacy_pm_support(pci_dev)) - return pci_legacy_resume_early(dev); - -- pci_update_current_state(pci_dev, PCI_D0); -+ /* -+ * pci_restore_state() requires the device to be in D0 (because of MSI -+ * restoration among other things), so force it into D0 in case the -+ * driver's "freeze" callbacks put it into a low-power state directly. -+ */ -+ pci_set_power_state(pci_dev, PCI_D0); - pci_restore_state(pci_dev); - - if (drv && drv->pm && drv->pm->thaw_noirq) -diff --git a/drivers/spi/spi-xilinx.c b/drivers/spi/spi-xilinx.c -index 3009121173cd..3c6ea5c3ddd2 100644 ---- a/drivers/spi/spi-xilinx.c -+++ b/drivers/spi/spi-xilinx.c -@@ -271,6 +271,7 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) - while (remaining_words) { - int n_words, tx_words, rx_words; - u32 sr; -+ int stalled; - - n_words = min(remaining_words, xspi->buffer_size); - -@@ -299,7 +300,17 @@ static int xilinx_spi_txrx_bufs(struct spi_device *spi, struct spi_transfer *t) - - /* Read out all the data from the Rx FIFO */ - rx_words = n_words; -+ stalled = 10; - while (rx_words) { -+ if (rx_words == n_words && !(stalled--) && -+ !(sr & XSPI_SR_TX_EMPTY_MASK) && -+ (sr & XSPI_SR_RX_EMPTY_MASK)) { -+ dev_err(&spi->dev, -+ "Detected stall. Check C_SPI_MODE and C_SPI_MEMORY\n"); -+ xspi_init_hw(xspi); -+ return -EIO; -+ } -+ - if ((sr & XSPI_SR_TX_EMPTY_MASK) && (rx_words > 1)) { - xilinx_spi_rx(xspi); - rx_words--; -diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c -index 84e71bd19082..41dda25da049 100644 ---- a/drivers/tty/n_tty.c -+++ b/drivers/tty/n_tty.c -@@ -1801,7 +1801,7 @@ static void n_tty_set_termios(struct tty_struct *tty, struct ktermios *old) - { - struct n_tty_data *ldata = tty->disc_data; - -- if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) { -+ if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) { - bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE); - ldata->line_start = ldata->read_tail; - if (!L_ICANON(tty) || !read_cnt(ldata)) { -@@ -2493,7 +2493,7 @@ static int n_tty_ioctl(struct tty_struct *tty, struct file *file, - return put_user(tty_chars_in_buffer(tty), (int __user *) arg); - case TIOCINQ: - down_write(&tty->termios_rwsem); -- if (L_ICANON(tty)) -+ if (L_ICANON(tty) && !L_EXTPROC(tty)) - retval = inq_canon(ldata); - else - retval = read_cnt(ldata); -diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c -index f6fde903fcad..22dcccf2d286 100644 ---- a/drivers/usb/core/config.c -+++ b/drivers/usb/core/config.c -@@ -973,7 +973,7 @@ int usb_get_bos_descriptor(struct usb_device *dev) - case USB_SSP_CAP_TYPE: - ssp_cap = (struct usb_ssp_cap_descriptor *)buffer; - ssac = (le32_to_cpu(ssp_cap->bmAttributes) & -- USB_SSP_SUBLINK_SPEED_ATTRIBS) + 1; -+ USB_SSP_SUBLINK_SPEED_ATTRIBS); - if (length >= USB_DT_USB_SSP_CAP_SIZE(ssac)) - dev->bos->ssp_cap = ssp_cap; - break; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index 50010282c010..c05c4f877750 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -57,10 +57,11 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Microsoft LifeCam-VX700 v2.0 */ - { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, - -- /* Logitech HD Pro Webcams C920, C920-C and C930e */ -+ /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ - { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, - { USB_DEVICE(0x046d, 0x0843), .driver_info = USB_QUIRK_DELAY_INIT }, -+ { USB_DEVICE(0x046d, 0x085b), .driver_info = USB_QUIRK_DELAY_INIT }, - - /* Logitech ConferenceCam CC3000e */ - { USB_DEVICE(0x046d, 0x0847), .driver_info = USB_QUIRK_DELAY_INIT }, -@@ -154,6 +155,9 @@ static const struct usb_device_id usb_quirk_list[] = { - /* Genesys Logic hub, internally used by KY-688 USB 3.1 Type-C Hub */ - { USB_DEVICE(0x05e3, 0x0612), .driver_info = USB_QUIRK_NO_LPM }, - -+ /* ELSA MicroLink 56K */ -+ { USB_DEVICE(0x05cc, 0x2267), .driver_info = USB_QUIRK_RESET_RESUME }, -+ - /* Genesys Logic hub, internally used by Moshi USB to Ethernet Adapter */ - { USB_DEVICE(0x05e3, 0x0616), .driver_info = USB_QUIRK_NO_LPM }, - -diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c -index e8f990642281..cbf3be66f89c 100644 ---- a/drivers/usb/host/xhci-pci.c -+++ b/drivers/usb/host/xhci-pci.c -@@ -184,6 +184,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) - xhci->quirks |= XHCI_TRUST_TX_LENGTH; - xhci->quirks |= XHCI_BROKEN_STREAMS; - } -+ if (pdev->vendor == PCI_VENDOR_ID_RENESAS && -+ pdev->device == 0x0014) -+ xhci->quirks |= XHCI_TRUST_TX_LENGTH; - if (pdev->vendor == PCI_VENDOR_ID_RENESAS && - pdev->device == 0x0015) - xhci->quirks |= XHCI_RESET_ON_RESUME; -diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c -index 30344efc123f..64fe9dc25ed4 100644 ---- a/drivers/usb/serial/ftdi_sio.c -+++ b/drivers/usb/serial/ftdi_sio.c -@@ -1017,6 +1017,7 @@ static const struct usb_device_id id_table_combined[] = { - .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk }, - { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) }, - { USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) }, -+ { USB_DEVICE(AIRBUS_DS_VID, AIRBUS_DS_P8GR) }, - { } /* Terminating entry */ - }; - -diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h -index f9d15bd62785..543d2801632b 100644 ---- a/drivers/usb/serial/ftdi_sio_ids.h -+++ b/drivers/usb/serial/ftdi_sio_ids.h -@@ -913,6 +913,12 @@ - #define ICPDAS_I7561U_PID 0x0104 - #define ICPDAS_I7563U_PID 0x0105 - -+/* -+ * Airbus Defence and Space -+ */ -+#define AIRBUS_DS_VID 0x1e8e /* Vendor ID */ -+#define AIRBUS_DS_P8GR 0x6001 /* Tetra P8GR */ -+ - /* - * RT Systems programming cables for various ham radios - */ -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index ffa8ec917ff5..a818c43a02ec 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -236,6 +236,8 @@ static void option_instat_callback(struct urb *urb); - /* These Quectel products use Qualcomm's vendor ID */ - #define QUECTEL_PRODUCT_UC20 0x9003 - #define QUECTEL_PRODUCT_UC15 0x9090 -+/* These Yuga products use Qualcomm's vendor ID */ -+#define YUGA_PRODUCT_CLM920_NC5 0x9625 - - #define QUECTEL_VENDOR_ID 0x2c7c - /* These Quectel products use Quectel's vendor ID */ -@@ -283,6 +285,7 @@ static void option_instat_callback(struct urb *urb); - #define TELIT_PRODUCT_LE922_USBCFG3 0x1043 - #define TELIT_PRODUCT_LE922_USBCFG5 0x1045 - #define TELIT_PRODUCT_ME910 0x1100 -+#define TELIT_PRODUCT_ME910_DUAL_MODEM 0x1101 - #define TELIT_PRODUCT_LE920 0x1200 - #define TELIT_PRODUCT_LE910 0x1201 - #define TELIT_PRODUCT_LE910_USBCFG4 0x1206 -@@ -648,6 +651,11 @@ static const struct option_blacklist_info telit_me910_blacklist = { - .reserved = BIT(1) | BIT(3), - }; - -+static const struct option_blacklist_info telit_me910_dual_modem_blacklist = { -+ .sendsetup = BIT(0), -+ .reserved = BIT(3), -+}; -+ - static const struct option_blacklist_info telit_le910_blacklist = { - .sendsetup = BIT(0), - .reserved = BIT(1) | BIT(2), -@@ -677,6 +685,10 @@ static const struct option_blacklist_info cinterion_rmnet2_blacklist = { - .reserved = BIT(4) | BIT(5), - }; - -+static const struct option_blacklist_info yuga_clm920_nc5_blacklist = { -+ .reserved = BIT(1) | BIT(4), -+}; -+ - static const struct usb_device_id option_ids[] = { - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, - { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, -@@ -1181,6 +1193,9 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC15)}, - { USB_DEVICE(QUALCOMM_VENDOR_ID, QUECTEL_PRODUCT_UC20), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -+ /* Yuga products use Qualcomm vendor ID */ -+ { USB_DEVICE(QUALCOMM_VENDOR_ID, YUGA_PRODUCT_CLM920_NC5), -+ .driver_info = (kernel_ulong_t)&yuga_clm920_nc5_blacklist }, - /* Quectel products using Quectel vendor ID */ - { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EC21), - .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, -@@ -1247,6 +1262,8 @@ static const struct usb_device_id option_ids[] = { - .driver_info = (kernel_ulong_t)&telit_le922_blacklist_usbcfg0 }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), - .driver_info = (kernel_ulong_t)&telit_me910_blacklist }, -+ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), -+ .driver_info = (kernel_ulong_t)&telit_me910_dual_modem_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910), - .driver_info = (kernel_ulong_t)&telit_le910_blacklist }, - { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE910_USBCFG4), -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 4516291df1b8..fb6dc16c754a 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -166,6 +166,8 @@ static const struct usb_device_id id_table[] = { - {DEVICE_SWI(0x1199, 0x9079)}, /* Sierra Wireless EM74xx */ - {DEVICE_SWI(0x1199, 0x907a)}, /* Sierra Wireless EM74xx QDL */ - {DEVICE_SWI(0x1199, 0x907b)}, /* Sierra Wireless EM74xx */ -+ {DEVICE_SWI(0x1199, 0x9090)}, /* Sierra Wireless EM7565 QDL */ -+ {DEVICE_SWI(0x1199, 0x9091)}, /* Sierra Wireless EM7565 */ - {DEVICE_SWI(0x413c, 0x81a2)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a3)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */ - {DEVICE_SWI(0x413c, 0x81a4)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */ -@@ -346,6 +348,7 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) - break; - case 2: - dev_dbg(dev, "NMEA GPS interface found\n"); -+ sendsetup = true; - break; - case 3: - dev_dbg(dev, "Modem port found\n"); -diff --git a/drivers/usb/usbip/stub_main.c b/drivers/usb/usbip/stub_main.c -index af10f7b131a4..325b4c05acdd 100644 ---- a/drivers/usb/usbip/stub_main.c -+++ b/drivers/usb/usbip/stub_main.c -@@ -252,11 +252,12 @@ void stub_device_cleanup_urbs(struct stub_device *sdev) - struct stub_priv *priv; - struct urb *urb; - -- dev_dbg(&sdev->udev->dev, "free sdev %p\n", sdev); -+ dev_dbg(&sdev->udev->dev, "Stub device cleaning up urbs\n"); - - while ((priv = stub_priv_pop(sdev))) { - urb = priv->urb; -- dev_dbg(&sdev->udev->dev, "free urb %p\n", urb); -+ dev_dbg(&sdev->udev->dev, "free urb seqnum %lu\n", -+ priv->seqnum); - usb_kill_urb(urb); - - kmem_cache_free(stub_priv_cache, priv); -diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c -index 00e475c51a12..7de54a66044f 100644 ---- a/drivers/usb/usbip/stub_rx.c -+++ b/drivers/usb/usbip/stub_rx.c -@@ -230,9 +230,6 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev, - if (priv->seqnum != pdu->u.cmd_unlink.seqnum) - continue; - -- dev_info(&priv->urb->dev->dev, "unlink urb %p\n", -- priv->urb); -- - /* - * This matched urb is not completed yet (i.e., be in - * flight in usb hcd hardware/driver). Now we are -@@ -271,8 +268,8 @@ static int stub_recv_cmd_unlink(struct stub_device *sdev, - ret = usb_unlink_urb(priv->urb); - if (ret != -EINPROGRESS) - dev_err(&priv->urb->dev->dev, -- "failed to unlink a urb %p, ret %d\n", -- priv->urb, ret); -+ "failed to unlink a urb # %lu, ret %d\n", -+ priv->seqnum, ret); - - return 0; - } -diff --git a/drivers/usb/usbip/stub_tx.c b/drivers/usb/usbip/stub_tx.c -index af858d52608a..f4dd30c56f36 100644 ---- a/drivers/usb/usbip/stub_tx.c -+++ b/drivers/usb/usbip/stub_tx.c -@@ -201,8 +201,8 @@ static int stub_send_ret_submit(struct stub_device *sdev) - - /* 1. setup usbip_header */ - setup_ret_submit_pdu(&pdu_header, urb); -- usbip_dbg_stub_tx("setup txdata seqnum: %d urb: %p\n", -- pdu_header.base.seqnum, urb); -+ usbip_dbg_stub_tx("setup txdata seqnum: %d\n", -+ pdu_header.base.seqnum); - usbip_header_correct_endian(&pdu_header, 1); - - iov[iovnum].iov_base = &pdu_header; -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 81b2b9f808b5..f9af04d7f02f 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -467,9 +467,6 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, - int ret = 0; - struct vhci_device *vdev; - -- usbip_dbg_vhci_hc("enter, usb_hcd %p urb %p mem_flags %d\n", -- hcd, urb, mem_flags); -- - /* patch to usb_sg_init() is in 2.5.60 */ - BUG_ON(!urb->transfer_buffer && urb->transfer_buffer_length); - -@@ -627,8 +624,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - struct vhci_priv *priv; - struct vhci_device *vdev; - -- pr_info("dequeue a urb %p\n", urb); -- - spin_lock(&the_controller->lock); - - priv = urb->hcpriv; -@@ -656,7 +651,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - /* tcp connection is closed */ - spin_lock(&vdev->priv_lock); - -- pr_info("device %p seems to be disconnected\n", vdev); - list_del(&priv->list); - kfree(priv); - urb->hcpriv = NULL; -@@ -668,8 +662,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - * vhci_rx will receive RET_UNLINK and give back the URB. - * Otherwise, we give back it here. - */ -- pr_info("gives back urb %p\n", urb); -- - usb_hcd_unlink_urb_from_ep(hcd, urb); - - spin_unlock(&the_controller->lock); -@@ -698,8 +690,6 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - - unlink->unlink_seqnum = priv->seqnum; - -- pr_info("device %p seems to be still connected\n", vdev); -- - /* send cmd_unlink and try to cancel the pending URB in the - * peer */ - list_add_tail(&unlink->list, &vdev->unlink_tx); -diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c -index 00e4a54308e4..bc4eb0855314 100644 ---- a/drivers/usb/usbip/vhci_rx.c -+++ b/drivers/usb/usbip/vhci_rx.c -@@ -37,24 +37,23 @@ struct urb *pickup_urb_and_free_priv(struct vhci_device *vdev, __u32 seqnum) - urb = priv->urb; - status = urb->status; - -- usbip_dbg_vhci_rx("find urb %p vurb %p seqnum %u\n", -- urb, priv, seqnum); -+ usbip_dbg_vhci_rx("find urb seqnum %u\n", seqnum); - - switch (status) { - case -ENOENT: - /* fall through */ - case -ECONNRESET: -- dev_info(&urb->dev->dev, -- "urb %p was unlinked %ssynchronuously.\n", urb, -- status == -ENOENT ? "" : "a"); -+ dev_dbg(&urb->dev->dev, -+ "urb seq# %u was unlinked %ssynchronuously\n", -+ seqnum, status == -ENOENT ? "" : "a"); - break; - case -EINPROGRESS: - /* no info output */ - break; - default: -- dev_info(&urb->dev->dev, -- "urb %p may be in a error, status %d\n", urb, -- status); -+ dev_dbg(&urb->dev->dev, -+ "urb seq# %u may be in a error, status %d\n", -+ seqnum, status); - } - - list_del(&priv->list); -@@ -78,8 +77,8 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, - spin_unlock(&vdev->priv_lock); - - if (!urb) { -- pr_err("cannot find a urb of seqnum %u\n", pdu->base.seqnum); -- pr_info("max seqnum %d\n", -+ pr_err("cannot find a urb of seqnum %u max seqnum %d\n", -+ pdu->base.seqnum, - atomic_read(&the_controller->seqnum)); - usbip_event_add(ud, VDEV_EVENT_ERROR_TCP); - return; -@@ -102,7 +101,7 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, - if (usbip_dbg_flag_vhci_rx) - usbip_dump_urb(urb); - -- usbip_dbg_vhci_rx("now giveback urb %p\n", urb); -+ usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum); - - spin_lock(&the_controller->lock); - usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); -@@ -165,7 +164,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, - pr_info("the urb (seqnum %d) was already given back\n", - pdu->base.seqnum); - } else { -- usbip_dbg_vhci_rx("now giveback urb %p\n", urb); -+ usbip_dbg_vhci_rx("now giveback urb %d\n", pdu->base.seqnum); - - /* If unlink is successful, status is -ECONNRESET */ - urb->status = pdu->u.ret_unlink.status; -diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c -index 409fd99f3257..3c5796c8633a 100644 ---- a/drivers/usb/usbip/vhci_tx.c -+++ b/drivers/usb/usbip/vhci_tx.c -@@ -82,7 +82,8 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) - memset(&msg, 0, sizeof(msg)); - memset(&iov, 0, sizeof(iov)); - -- usbip_dbg_vhci_tx("setup txdata urb %p\n", urb); -+ usbip_dbg_vhci_tx("setup txdata urb seqnum %lu\n", -+ priv->seqnum); - - /* 1. setup usbip_header */ - setup_cmd_submit_pdu(&pdu_header, urb); -diff --git a/include/crypto/mcryptd.h b/include/crypto/mcryptd.h -index c23ee1f7ee80..c2ff077168d3 100644 ---- a/include/crypto/mcryptd.h -+++ b/include/crypto/mcryptd.h -@@ -26,6 +26,7 @@ static inline struct mcryptd_ahash *__mcryptd_ahash_cast( - - struct mcryptd_cpu_queue { - struct crypto_queue queue; -+ spinlock_t q_lock; - struct work_struct work; - }; - -diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h -index 402753bccafa..7b8e3afcc291 100644 ---- a/include/linux/ipv6.h -+++ b/include/linux/ipv6.h -@@ -215,7 +215,8 @@ struct ipv6_pinfo { - * 100: prefer care-of address - */ - dontfrag:1, -- autoflowlabel:1; -+ autoflowlabel:1, -+ autoflowlabel_set:1; - __u8 min_hopcount; - __u8 tclass; - __be32 rcv_flowinfo; -diff --git a/include/linux/vm_event_item.h b/include/linux/vm_event_item.h -index e623d392db0c..8ef3a61fdc74 100644 ---- a/include/linux/vm_event_item.h -+++ b/include/linux/vm_event_item.h -@@ -80,10 +80,8 @@ enum vm_event_item { PGPGIN, PGPGOUT, PSWPIN, PSWPOUT, - #endif - #endif - #ifdef CONFIG_DEBUG_TLBFLUSH --#ifdef CONFIG_SMP - NR_TLB_REMOTE_FLUSH, /* cpu tried to flush others' tlbs */ - NR_TLB_REMOTE_FLUSH_RECEIVED,/* cpu received ipi for flush */ --#endif /* CONFIG_SMP */ - NR_TLB_LOCAL_FLUSH_ALL, - NR_TLB_LOCAL_FLUSH_ONE, - #endif /* CONFIG_DEBUG_TLBFLUSH */ -diff --git a/include/net/ip.h b/include/net/ip.h -index 7476bb10ff37..639398af273b 100644 ---- a/include/net/ip.h -+++ b/include/net/ip.h -@@ -33,6 +33,8 @@ - #include - #include - -+#define IPV4_MIN_MTU 68 /* RFC 791 */ -+ - struct sock; - - struct inet_skb_parm { -diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c -index 22c57e191a23..e5d228f7224c 100644 ---- a/kernel/time/tick-sched.c -+++ b/kernel/time/tick-sched.c -@@ -568,6 +568,11 @@ static void tick_nohz_restart(struct tick_sched *ts, ktime_t now) - tick_program_event(hrtimer_get_expires(&ts->sched_timer), 1); - } - -+static inline bool local_timer_softirq_pending(void) -+{ -+ return local_softirq_pending() & TIMER_SOFTIRQ; -+} -+ - static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, - ktime_t now, int cpu) - { -@@ -584,8 +589,18 @@ static ktime_t tick_nohz_stop_sched_tick(struct tick_sched *ts, - } while (read_seqretry(&jiffies_lock, seq)); - ts->last_jiffies = basejiff; - -- if (rcu_needs_cpu(basemono, &next_rcu) || -- arch_needs_cpu() || irq_work_needs_cpu()) { -+ /* -+ * Keep the periodic tick, when RCU, architecture or irq_work -+ * requests it. -+ * Aside of that check whether the local timer softirq is -+ * pending. If so its a bad idea to call get_next_timer_interrupt() -+ * because there is an already expired timer, so it will request -+ * immeditate expiry, which rearms the hardware timer with a -+ * minimal delta which brings us back to this place -+ * immediately. Lather, rinse and repeat... -+ */ -+ if (rcu_needs_cpu(basemono, &next_rcu) || arch_needs_cpu() || -+ irq_work_needs_cpu() || local_timer_softirq_pending()) { - next_tick = basemono + TICK_NSEC; - } else { - /* -diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c -index 1275175b0946..d9cd6191760b 100644 ---- a/kernel/trace/ring_buffer.c -+++ b/kernel/trace/ring_buffer.c -@@ -280,6 +280,8 @@ EXPORT_SYMBOL_GPL(ring_buffer_event_data); - /* Missed count stored at end */ - #define RB_MISSED_STORED (1 << 30) - -+#define RB_MISSED_FLAGS (RB_MISSED_EVENTS|RB_MISSED_STORED) -+ - struct buffer_data_page { - u64 time_stamp; /* page time stamp */ - local_t commit; /* write committed index */ -@@ -331,7 +333,9 @@ static void rb_init_page(struct buffer_data_page *bpage) - */ - size_t ring_buffer_page_len(void *page) - { -- return local_read(&((struct buffer_data_page *)page)->commit) -+ struct buffer_data_page *bpage = page; -+ -+ return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS) - + BUF_PAGE_HDR_SIZE; - } - -diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c -index 61d0960559c8..8aef4e63ac57 100644 ---- a/kernel/trace/trace.c -+++ b/kernel/trace/trace.c -@@ -5754,7 +5754,7 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, - .spd_release = buffer_spd_release, - }; - struct buffer_ref *ref; -- int entries, size, i; -+ int entries, i; - ssize_t ret = 0; - - #ifdef CONFIG_TRACER_MAX_TRACE -@@ -5805,14 +5805,6 @@ tracing_buffers_splice_read(struct file *file, loff_t *ppos, - break; - } - -- /* -- * zero out any left over data, this is going to -- * user land. -- */ -- size = ring_buffer_page_len(ref->page); -- if (size < PAGE_SIZE) -- memset(ref->page + size, 0, PAGE_SIZE - size); -- - page = virt_to_page(ref->page); - - spd.pages[i] = page; -@@ -6539,6 +6531,7 @@ allocate_trace_buffer(struct trace_array *tr, struct trace_buffer *buf, int size - buf->data = alloc_percpu(struct trace_array_cpu); - if (!buf->data) { - ring_buffer_free(buf->buffer); -+ buf->buffer = NULL; - return -ENOMEM; - } - -@@ -6562,7 +6555,9 @@ static int allocate_trace_buffers(struct trace_array *tr, int size) - allocate_snapshot ? size : 1); - if (WARN_ON(ret)) { - ring_buffer_free(tr->trace_buffer.buffer); -+ tr->trace_buffer.buffer = NULL; - free_percpu(tr->trace_buffer.data); -+ tr->trace_buffer.data = NULL; - return -ENOMEM; - } - tr->allocated_snapshot = allocate_snapshot; -diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c -index a1f697ec4fc2..0ce26a0f7913 100644 ---- a/net/bridge/br_netlink.c -+++ b/net/bridge/br_netlink.c -@@ -1067,19 +1067,20 @@ static int br_dev_newlink(struct net *src_net, struct net_device *dev, - struct net_bridge *br = netdev_priv(dev); - int err; - -+ err = register_netdevice(dev); -+ if (err) -+ return err; -+ - if (tb[IFLA_ADDRESS]) { - spin_lock_bh(&br->lock); - br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS])); - spin_unlock_bh(&br->lock); - } - -- err = register_netdevice(dev); -- if (err) -- return err; -- - err = br_changelink(dev, tb, data); - if (err) -- unregister_netdevice(dev); -+ br_dev_delete(dev, NULL); -+ - return err; - } - -diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c -index 2e9a1c2818c7..b5c351d2830b 100644 ---- a/net/core/net_namespace.c -+++ b/net/core/net_namespace.c -@@ -261,7 +261,7 @@ struct net *get_net_ns_by_id(struct net *net, int id) - spin_lock_irqsave(&net->nsid_lock, flags); - peer = idr_find(&net->netns_ids, id); - if (peer) -- get_net(peer); -+ peer = maybe_get_net(peer); - spin_unlock_irqrestore(&net->nsid_lock, flags); - rcu_read_unlock(); - -diff --git a/net/core/skbuff.c b/net/core/skbuff.c -index d33609c2f276..86b619501350 100644 ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -3676,7 +3676,7 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, - struct sock *sk = skb->sk; - - if (!skb_may_tx_timestamp(sk, false)) -- return; -+ goto err; - - /* Take a reference to prevent skb_orphan() from freeing the socket, - * but only if the socket refcount is not zero. -@@ -3685,7 +3685,11 @@ void skb_complete_tx_timestamp(struct sk_buff *skb, - *skb_hwtstamps(skb) = *hwtstamps; - __skb_complete_tx_timestamp(skb, sk, SCM_TSTAMP_SND); - sock_put(sk); -+ return; - } -+ -+err: -+ kfree_skb(skb); - } - EXPORT_SYMBOL_GPL(skb_complete_tx_timestamp); - -diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c -index 0212591b0077..63f99e9a821b 100644 ---- a/net/ipv4/devinet.c -+++ b/net/ipv4/devinet.c -@@ -1358,7 +1358,7 @@ skip: - - static bool inetdev_valid_mtu(unsigned int mtu) - { -- return mtu >= 68; -+ return mtu >= IPV4_MIN_MTU; - } - - static void inetdev_send_gratuitous_arp(struct net_device *dev, -diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c -index 0cb240c749bf..c9e68ff48a72 100644 ---- a/net/ipv4/fib_frontend.c -+++ b/net/ipv4/fib_frontend.c -@@ -1252,7 +1252,7 @@ fail: - - static void ip_fib_net_exit(struct net *net) - { -- unsigned int i; -+ int i; - - rtnl_lock(); - #ifdef CONFIG_IP_MULTIPLE_TABLES -@@ -1260,7 +1260,12 @@ static void ip_fib_net_exit(struct net *net) - RCU_INIT_POINTER(net->ipv4.fib_main, NULL); - RCU_INIT_POINTER(net->ipv4.fib_default, NULL); - #endif -- for (i = 0; i < FIB_TABLE_HASHSZ; i++) { -+ /* Destroy the tables in reverse order to guarantee that the -+ * local table, ID 255, is destroyed before the main table, ID -+ * 254. This is necessary as the local table may contain -+ * references to data contained in the main table. -+ */ -+ for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) { - struct hlist_head *head = &net->ipv4.fib_table_hash[i]; - struct hlist_node *tmp; - struct fib_table *tb; -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index 3809d523d012..b60106d34346 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -89,6 +89,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -327,6 +328,23 @@ igmp_scount(struct ip_mc_list *pmc, int type, int gdeleted, int sdeleted) - return scount; - } - -+/* source address selection per RFC 3376 section 4.2.13 */ -+static __be32 igmpv3_get_srcaddr(struct net_device *dev, -+ const struct flowi4 *fl4) -+{ -+ struct in_device *in_dev = __in_dev_get_rcu(dev); -+ -+ if (!in_dev) -+ return htonl(INADDR_ANY); -+ -+ for_ifa(in_dev) { -+ if (inet_ifa_match(fl4->saddr, ifa)) -+ return fl4->saddr; -+ } endfor_ifa(in_dev); -+ -+ return htonl(INADDR_ANY); -+} -+ - static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) - { - struct sk_buff *skb; -@@ -374,7 +392,7 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) - pip->frag_off = htons(IP_DF); - pip->ttl = 1; - pip->daddr = fl4.daddr; -- pip->saddr = fl4.saddr; -+ pip->saddr = igmpv3_get_srcaddr(dev, &fl4); - pip->protocol = IPPROTO_IGMP; - pip->tot_len = 0; /* filled in later */ - ip_select_ident(net, skb, NULL); -@@ -410,16 +428,17 @@ static int grec_size(struct ip_mc_list *pmc, int type, int gdel, int sdel) - } - - static struct sk_buff *add_grhead(struct sk_buff *skb, struct ip_mc_list *pmc, -- int type, struct igmpv3_grec **ppgr) -+ int type, struct igmpv3_grec **ppgr, unsigned int mtu) - { - struct net_device *dev = pmc->interface->dev; - struct igmpv3_report *pih; - struct igmpv3_grec *pgr; - -- if (!skb) -- skb = igmpv3_newpack(dev, dev->mtu); -- if (!skb) -- return NULL; -+ if (!skb) { -+ skb = igmpv3_newpack(dev, mtu); -+ if (!skb) -+ return NULL; -+ } - pgr = (struct igmpv3_grec *)skb_put(skb, sizeof(struct igmpv3_grec)); - pgr->grec_type = type; - pgr->grec_auxwords = 0; -@@ -441,12 +460,17 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, - struct igmpv3_grec *pgr = NULL; - struct ip_sf_list *psf, *psf_next, *psf_prev, **psf_list; - int scount, stotal, first, isquery, truncate; -+ unsigned int mtu; - - if (pmc->multiaddr == IGMP_ALL_HOSTS) - return skb; - if (ipv4_is_local_multicast(pmc->multiaddr) && !sysctl_igmp_llm_reports) - return skb; - -+ mtu = READ_ONCE(dev->mtu); -+ if (mtu < IPV4_MIN_MTU) -+ return skb; -+ - isquery = type == IGMPV3_MODE_IS_INCLUDE || - type == IGMPV3_MODE_IS_EXCLUDE; - truncate = type == IGMPV3_MODE_IS_EXCLUDE || -@@ -467,7 +491,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, - AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) { - if (skb) - igmpv3_sendpack(skb); -- skb = igmpv3_newpack(dev, dev->mtu); -+ skb = igmpv3_newpack(dev, mtu); - } - } - first = 1; -@@ -494,12 +518,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ip_mc_list *pmc, - pgr->grec_nsrcs = htons(scount); - if (skb) - igmpv3_sendpack(skb); -- skb = igmpv3_newpack(dev, dev->mtu); -+ skb = igmpv3_newpack(dev, mtu); - first = 1; - scount = 0; - } - if (first) { -- skb = add_grhead(skb, pmc, type, &pgr); -+ skb = add_grhead(skb, pmc, type, &pgr, mtu); - first = 0; - } - if (!skb) -@@ -533,7 +557,7 @@ empty_source: - igmpv3_sendpack(skb); - skb = NULL; /* add_grhead will get a new one */ - } -- skb = add_grhead(skb, pmc, type, &pgr); -+ skb = add_grhead(skb, pmc, type, &pgr, mtu); - } - } - if (pgr) -diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c -index 3310ac75e3f3..c18245e05d26 100644 ---- a/net/ipv4/ip_tunnel.c -+++ b/net/ipv4/ip_tunnel.c -@@ -400,8 +400,8 @@ static int ip_tunnel_bind_dev(struct net_device *dev) - dev->needed_headroom = t_hlen + hlen; - mtu -= (dev->hard_header_len + t_hlen); - -- if (mtu < 68) -- mtu = 68; -+ if (mtu < IPV4_MIN_MTU) -+ mtu = IPV4_MIN_MTU; - - return mtu; - } -diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c -index 8f2cd7d09720..4d3d4291c82f 100644 ---- a/net/ipv4/raw.c -+++ b/net/ipv4/raw.c -@@ -500,11 +500,16 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - int err; - struct ip_options_data opt_copy; - struct raw_frag_vec rfv; -+ int hdrincl; - - err = -EMSGSIZE; - if (len > 0xFFFF) - goto out; - -+ /* hdrincl should be READ_ONCE(inet->hdrincl) -+ * but READ_ONCE() doesn't work with bit fields -+ */ -+ hdrincl = inet->hdrincl; - /* - * Check the flags. - */ -@@ -579,7 +584,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - /* Linux does not mangle headers on raw sockets, - * so that IP options + IP_HDRINCL is non-sense. - */ -- if (inet->hdrincl) -+ if (hdrincl) - goto done; - if (ipc.opt->opt.srr) { - if (!daddr) -@@ -601,9 +606,9 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - - flowi4_init_output(&fl4, ipc.oif, sk->sk_mark, tos, - RT_SCOPE_UNIVERSE, -- inet->hdrincl ? IPPROTO_RAW : sk->sk_protocol, -+ hdrincl ? IPPROTO_RAW : sk->sk_protocol, - inet_sk_flowi_flags(sk) | -- (inet->hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), -+ (hdrincl ? FLOWI_FLAG_KNOWN_NH : 0), - daddr, saddr, 0, 0); - - if (!saddr && ipc.oif) { -@@ -612,7 +617,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - goto done; - } - -- if (!inet->hdrincl) { -+ if (!hdrincl) { - rfv.msg = msg; - rfv.hlen = 0; - -@@ -637,7 +642,7 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) - goto do_confirm; - back_from_confirm: - -- if (inet->hdrincl) -+ if (hdrincl) - err = raw_send_hdrinc(sk, &fl4, msg, len, - &rt, msg->msg_flags); - -diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index a5d790c13ef5..61c93a93f228 100644 ---- a/net/ipv4/tcp_ipv4.c -+++ b/net/ipv4/tcp_ipv4.c -@@ -823,7 +823,7 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, - tcp_time_stamp, - req->ts_recent, - 0, -- tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->daddr, -+ tcp_md5_do_lookup(sk, (union tcp_md5_addr *)&ip_hdr(skb)->saddr, - AF_INET), - inet_rsk(req)->no_srccheck ? IP_REPLY_ARG_NOSRCCHECK : 0, - ip_hdr(skb)->tos); -diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c -index 83ec6639b04d..637a0e41b0aa 100644 ---- a/net/ipv6/af_inet6.c -+++ b/net/ipv6/af_inet6.c -@@ -200,7 +200,6 @@ lookup_protocol: - np->mcast_hops = IPV6_DEFAULT_MCASTHOPS; - np->mc_loop = 1; - np->pmtudisc = IPV6_PMTUDISC_WANT; -- np->autoflowlabel = ip6_default_np_autolabel(sock_net(sk)); - sk->sk_ipv6only = net->ipv6.sysctl.bindv6only; - - /* Init the ipv4 part of the socket since we can have sockets -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 71624cf26832..1b4f5f2d2929 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -148,6 +148,14 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) - !(IP6CB(skb)->flags & IP6SKB_REROUTED)); - } - -+static bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) -+{ -+ if (!np->autoflowlabel_set) -+ return ip6_default_np_autolabel(net); -+ else -+ return np->autoflowlabel; -+} -+ - /* - * xmit an sk_buff (used by TCP, SCTP and DCCP) - * Note : socket lock is not held for SYNACK packets, but might be modified -@@ -211,7 +219,7 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, - hlimit = ip6_dst_hoplimit(dst); - - ip6_flow_hdr(hdr, tclass, ip6_make_flowlabel(net, skb, fl6->flowlabel, -- np->autoflowlabel, fl6)); -+ ip6_autoflowlabel(net, np), fl6)); - - hdr->payload_len = htons(seg_len); - hdr->nexthdr = proto; -@@ -1675,7 +1683,7 @@ struct sk_buff *__ip6_make_skb(struct sock *sk, - - ip6_flow_hdr(hdr, v6_cork->tclass, - ip6_make_flowlabel(net, skb, fl6->flowlabel, -- np->autoflowlabel, fl6)); -+ ip6_autoflowlabel(net, np), fl6)); - hdr->hop_limit = v6_cork->hop_limit; - hdr->nexthdr = proto; - hdr->saddr = fl6->saddr; -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index a4a30d2ca66f..435e26210587 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -872,6 +872,7 @@ pref_skip_coa: - break; - case IPV6_AUTOFLOWLABEL: - np->autoflowlabel = valbool; -+ np->autoflowlabel_set = 1; - retv = 0; - break; - } -diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c -index d64ee7e83664..06640685ff43 100644 ---- a/net/ipv6/mcast.c -+++ b/net/ipv6/mcast.c -@@ -1668,16 +1668,16 @@ static int grec_size(struct ifmcaddr6 *pmc, int type, int gdel, int sdel) - } - - static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc, -- int type, struct mld2_grec **ppgr) -+ int type, struct mld2_grec **ppgr, unsigned int mtu) - { -- struct net_device *dev = pmc->idev->dev; - struct mld2_report *pmr; - struct mld2_grec *pgr; - -- if (!skb) -- skb = mld_newpack(pmc->idev, dev->mtu); -- if (!skb) -- return NULL; -+ if (!skb) { -+ skb = mld_newpack(pmc->idev, mtu); -+ if (!skb) -+ return NULL; -+ } - pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec)); - pgr->grec_type = type; - pgr->grec_auxwords = 0; -@@ -1700,10 +1700,15 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, - struct mld2_grec *pgr = NULL; - struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list; - int scount, stotal, first, isquery, truncate; -+ unsigned int mtu; - - if (pmc->mca_flags & MAF_NOREPORT) - return skb; - -+ mtu = READ_ONCE(dev->mtu); -+ if (mtu < IPV6_MIN_MTU) -+ return skb; -+ - isquery = type == MLD2_MODE_IS_INCLUDE || - type == MLD2_MODE_IS_EXCLUDE; - truncate = type == MLD2_MODE_IS_EXCLUDE || -@@ -1724,7 +1729,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, - AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) { - if (skb) - mld_sendpack(skb); -- skb = mld_newpack(idev, dev->mtu); -+ skb = mld_newpack(idev, mtu); - } - } - first = 1; -@@ -1751,12 +1756,12 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc, - pgr->grec_nsrcs = htons(scount); - if (skb) - mld_sendpack(skb); -- skb = mld_newpack(idev, dev->mtu); -+ skb = mld_newpack(idev, mtu); - first = 1; - scount = 0; - } - if (first) { -- skb = add_grhead(skb, pmc, type, &pgr); -+ skb = add_grhead(skb, pmc, type, &pgr, mtu); - first = 0; - } - if (!skb) -@@ -1790,7 +1795,7 @@ empty_source: - mld_sendpack(skb); - skb = NULL; /* add_grhead will get a new one */ - } -- skb = add_grhead(skb, pmc, type, &pgr); -+ skb = add_grhead(skb, pmc, type, &pgr, mtu); - } - } - if (pgr) -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 59c908ff251a..74cbcc4b399c 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -949,7 +949,7 @@ static void tcp_v6_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb, - tcp_rsk(req)->rcv_nxt, - req->rsk_rcv_wnd >> inet_rsk(req)->rcv_wscale, - tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if, -- tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr), -+ tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr), - 0, 0); - } - -diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c -index 5fabe68e20dd..48e1608414e6 100644 ---- a/net/netlink/af_netlink.c -+++ b/net/netlink/af_netlink.c -@@ -261,6 +261,9 @@ static int __netlink_deliver_tap_skb(struct sk_buff *skb, - struct sock *sk = skb->sk; - int ret = -ENOMEM; - -+ if (!net_eq(dev_net(dev), sock_net(sk))) -+ return 0; -+ - dev_hold(dev); - - if (is_vmalloc_addr(skb->head)) -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index 61189c576963..a870d27ca778 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -4153,7 +4153,7 @@ static int sctp_init_sock(struct sock *sk) - SCTP_DBG_OBJCNT_INC(sock); - - local_bh_disable(); -- percpu_counter_inc(&sctp_sockets_allocated); -+ sk_sockets_allocated_inc(sk); - sock_prot_inuse_add(net, sk->sk_prot, 1); - - /* Nothing can fail after this block, otherwise -@@ -4197,7 +4197,7 @@ static void sctp_destroy_sock(struct sock *sk) - } - sctp_endpoint_free(sp->ep); - local_bh_disable(); -- percpu_counter_dec(&sctp_sockets_allocated); -+ sk_sockets_allocated_dec(sk); - sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1); - local_bh_enable(); - } -diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c -index b450a27588c8..16f8124b1150 100644 ---- a/sound/core/rawmidi.c -+++ b/sound/core/rawmidi.c -@@ -579,15 +579,14 @@ static int snd_rawmidi_info_user(struct snd_rawmidi_substream *substream, - return 0; - } - --int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) -+static int __snd_rawmidi_info_select(struct snd_card *card, -+ struct snd_rawmidi_info *info) - { - struct snd_rawmidi *rmidi; - struct snd_rawmidi_str *pstr; - struct snd_rawmidi_substream *substream; - -- mutex_lock(®ister_mutex); - rmidi = snd_rawmidi_search(card, info->device); -- mutex_unlock(®ister_mutex); - if (!rmidi) - return -ENXIO; - if (info->stream < 0 || info->stream > 1) -@@ -603,6 +602,16 @@ int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info - } - return -ENXIO; - } -+ -+int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info) -+{ -+ int ret; -+ -+ mutex_lock(®ister_mutex); -+ ret = __snd_rawmidi_info_select(card, info); -+ mutex_unlock(®ister_mutex); -+ return ret; -+} - EXPORT_SYMBOL(snd_rawmidi_info_select); - - static int snd_rawmidi_info_select_user(struct snd_card *card, -diff --git a/sound/hda/hdac_i915.c b/sound/hda/hdac_i915.c -index cce9ae5ec93b..bd7bcf428bcf 100644 ---- a/sound/hda/hdac_i915.c -+++ b/sound/hda/hdac_i915.c -@@ -183,7 +183,7 @@ static int hdac_component_master_match(struct device *dev, void *data) - */ - int snd_hdac_i915_register_notifier(const struct i915_audio_component_audio_ops *aops) - { -- if (WARN_ON(!hdac_acomp)) -+ if (!hdac_acomp) - return -ENODEV; - - hdac_acomp->audio_ops = aops; -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 2159b18f76bf..5875a08d555e 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5953,6 +5953,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - {0x1b, 0x01011020}, - {0x21, 0x02211010}), -+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0x90a60130}, -+ {0x14, 0x90170110}, -+ {0x1b, 0x01011020}, -+ {0x21, 0x0221101f}), - SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - {0x12, 0x90a60160}, - {0x14, 0x90170120}, -diff --git a/sound/soc/codecs/twl4030.c b/sound/soc/codecs/twl4030.c -index a5a4e9f75c57..a06395507225 100644 ---- a/sound/soc/codecs/twl4030.c -+++ b/sound/soc/codecs/twl4030.c -@@ -232,7 +232,7 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec) - struct twl4030_codec_data *pdata = dev_get_platdata(codec->dev); - struct device_node *twl4030_codec_node = NULL; - -- twl4030_codec_node = of_find_node_by_name(codec->dev->parent->of_node, -+ twl4030_codec_node = of_get_child_by_name(codec->dev->parent->of_node, - "codec"); - - if (!pdata && twl4030_codec_node) { -@@ -241,9 +241,11 @@ static struct twl4030_codec_data *twl4030_get_pdata(struct snd_soc_codec *codec) - GFP_KERNEL); - if (!pdata) { - dev_err(codec->dev, "Can not allocate memory\n"); -+ of_node_put(twl4030_codec_node); - return NULL; - } - twl4030_setup_pdata_of(pdata, twl4030_codec_node); -+ of_node_put(twl4030_codec_node); - } - - return pdata; -diff --git a/sound/soc/fsl/fsl_ssi.c b/sound/soc/fsl/fsl_ssi.c -index 95d2392303eb..7ca67613e0d4 100644 ---- a/sound/soc/fsl/fsl_ssi.c -+++ b/sound/soc/fsl/fsl_ssi.c -@@ -1408,12 +1408,6 @@ static int fsl_ssi_probe(struct platform_device *pdev) - sizeof(fsl_ssi_ac97_dai)); - - fsl_ac97_data = ssi_private; -- -- ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev); -- if (ret) { -- dev_err(&pdev->dev, "could not set AC'97 ops\n"); -- return ret; -- } - } else { - /* Initialize this copy of the CPU DAI driver structure */ - memcpy(&ssi_private->cpu_dai_drv, &fsl_ssi_dai_template, -@@ -1473,6 +1467,14 @@ static int fsl_ssi_probe(struct platform_device *pdev) - return ret; - } - -+ if (fsl_ssi_is_ac97(ssi_private)) { -+ ret = snd_soc_set_ac97_ops_of_reset(&fsl_ssi_ac97_ops, pdev); -+ if (ret) { -+ dev_err(&pdev->dev, "could not set AC'97 ops\n"); -+ goto error_ac97_ops; -+ } -+ } -+ - ret = devm_snd_soc_register_component(&pdev->dev, &fsl_ssi_component, - &ssi_private->cpu_dai_drv, 1); - if (ret) { -@@ -1556,6 +1558,10 @@ error_sound_card: - fsl_ssi_debugfs_remove(&ssi_private->dbg_stats); - - error_asoc_register: -+ if (fsl_ssi_is_ac97(ssi_private)) -+ snd_soc_set_ac97_ops(NULL); -+ -+error_ac97_ops: - if (ssi_private->soc->imx) - fsl_ssi_imx_clean(pdev, ssi_private); - -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index 0ed9ae030ce1..c9ae29068c7c 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -2101,20 +2101,25 @@ static int parse_audio_selector_unit(struct mixer_build *state, int unitid, - kctl->private_value = (unsigned long)namelist; - kctl->private_free = usb_mixer_selector_elem_free; - -- nameid = uac_selector_unit_iSelector(desc); -+ /* check the static mapping table at first */ - len = check_mapped_name(map, kctl->id.name, sizeof(kctl->id.name)); -- if (len) -- ; -- else if (nameid) -- len = snd_usb_copy_string_desc(state, nameid, kctl->id.name, -- sizeof(kctl->id.name)); -- else -- len = get_term_name(state, &state->oterm, -- kctl->id.name, sizeof(kctl->id.name), 0); -- - if (!len) { -- strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); -+ /* no mapping ? */ -+ /* if iSelector is given, use it */ -+ nameid = uac_selector_unit_iSelector(desc); -+ if (nameid) -+ len = snd_usb_copy_string_desc(state, nameid, -+ kctl->id.name, -+ sizeof(kctl->id.name)); -+ /* ... or pick up the terminal name at next */ -+ if (!len) -+ len = get_term_name(state, &state->oterm, -+ kctl->id.name, sizeof(kctl->id.name), 0); -+ /* ... or use the fixed string "USB" as the last resort */ -+ if (!len) -+ strlcpy(kctl->id.name, "USB", sizeof(kctl->id.name)); - -+ /* and add the proper suffix */ - if (desc->bDescriptorSubtype == UAC2_CLOCK_SELECTOR) - append_ctl_name(kctl, " Clock Source"); - else if ((state->oterm.type & 0xff00) == 0x0100) -diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c -index 2b3d6d235015..3d7b42e77299 100644 ---- a/tools/usb/usbip/src/utils.c -+++ b/tools/usb/usbip/src/utils.c -@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add) - char command[SYSFS_BUS_ID_SIZE + 4]; - char match_busid_attr_path[SYSFS_PATH_MAX]; - int rc; -+ int cmd_size; - - snprintf(match_busid_attr_path, sizeof(match_busid_attr_path), - "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME, -@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add) - attr_name); - - if (add) -- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid); -+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", -+ busid); - else -- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid); -+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", -+ busid); - - rc = write_sysfs_attribute(match_busid_attr_path, command, -- sizeof(command)); -+ cmd_size); - if (rc < 0) { - dbg("failed to write match_busid: %s", strerror(errno)); - return -1; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.109-110.patch b/patch/kernel/mvebu64-default/04-patch-4.4.109-110.patch deleted file mode 100644 index 1c226ed323ec..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.109-110.patch +++ /dev/null @@ -1,2814 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index b4a83a490212..5977c4d71356 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2523,6 +2523,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nojitter [IA-64] Disables jitter checking for ITC timers. - -+ nopti [X86-64] Disable KAISER isolation of kernel from user. -+ - no-kvmclock [X86,KVM] Disable paravirtualized KVM clock driver - - no-kvmapf [X86,KVM] Disable paravirtualized asynchronous page -@@ -3054,6 +3056,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - pt. [PARIDE] - See Documentation/blockdev/paride.txt. - -+ pti= [X86_64] -+ Control KAISER user/kernel address space isolation: -+ on - enable -+ off - disable -+ auto - default setting -+ - pty.legacy_count= - [KNL] Number of legacy pty's. Overwrites compiled-in - default number. -diff --git a/Makefile b/Makefile -index 5d67056e24dd..b028c106535b 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 109 -+SUBLEVEL = 110 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/x86/boot/compressed/misc.h b/arch/x86/boot/compressed/misc.h -index 3783dc3e10b3..4abb284a5b9c 100644 ---- a/arch/x86/boot/compressed/misc.h -+++ b/arch/x86/boot/compressed/misc.h -@@ -9,6 +9,7 @@ - */ - #undef CONFIG_PARAVIRT - #undef CONFIG_PARAVIRT_SPINLOCKS -+#undef CONFIG_PAGE_TABLE_ISOLATION - #undef CONFIG_KASAN - - #include -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index cc0f2f5da19b..952b23b5d4e9 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - #include - - /* Avoid __ASSEMBLER__'ifying just for this. */ -@@ -135,6 +136,7 @@ ENTRY(entry_SYSCALL_64) - * it is too small to ever cause noticeable irq latency. - */ - SWAPGS_UNSAFE_STACK -+ SWITCH_KERNEL_CR3_NO_STACK - /* - * A hypervisor implementation might want to use a label - * after the swapgs, so that it can do the swapgs -@@ -207,9 +209,17 @@ entry_SYSCALL_64_fastpath: - testl $_TIF_ALLWORK_MASK, ASM_THREAD_INFO(TI_flags, %rsp, SIZEOF_PTREGS) - jnz int_ret_from_sys_call_irqs_off /* Go to the slow path */ - -- RESTORE_C_REGS_EXCEPT_RCX_R11 - movq RIP(%rsp), %rcx - movq EFLAGS(%rsp), %r11 -+ RESTORE_C_REGS_EXCEPT_RCX_R11 -+ /* -+ * This opens a window where we have a user CR3, but are -+ * running in the kernel. This makes using the CS -+ * register useless for telling whether or not we need to -+ * switch CR3 in NMIs. Normal interrupts are OK because -+ * they are off here. -+ */ -+ SWITCH_USER_CR3 - movq RSP(%rsp), %rsp - /* - * 64-bit SYSRET restores rip from rcx, -@@ -347,10 +357,26 @@ GLOBAL(int_ret_from_sys_call) - syscall_return_via_sysret: - /* rcx and r11 are already restored (see code above) */ - RESTORE_C_REGS_EXCEPT_RCX_R11 -+ /* -+ * This opens a window where we have a user CR3, but are -+ * running in the kernel. This makes using the CS -+ * register useless for telling whether or not we need to -+ * switch CR3 in NMIs. Normal interrupts are OK because -+ * they are off here. -+ */ -+ SWITCH_USER_CR3 - movq RSP(%rsp), %rsp - USERGS_SYSRET64 - - opportunistic_sysret_failed: -+ /* -+ * This opens a window where we have a user CR3, but are -+ * running in the kernel. This makes using the CS -+ * register useless for telling whether or not we need to -+ * switch CR3 in NMIs. Normal interrupts are OK because -+ * they are off here. -+ */ -+ SWITCH_USER_CR3 - SWAPGS - jmp restore_c_regs_and_iret - END(entry_SYSCALL_64) -@@ -509,6 +535,7 @@ END(irq_entries_start) - * tracking that we're in kernel mode. - */ - SWAPGS -+ SWITCH_KERNEL_CR3 - - /* - * We need to tell lockdep that IRQs are off. We can't do this until -@@ -568,6 +595,7 @@ GLOBAL(retint_user) - mov %rsp,%rdi - call prepare_exit_to_usermode - TRACE_IRQS_IRETQ -+ SWITCH_USER_CR3 - SWAPGS - jmp restore_regs_and_iret - -@@ -625,6 +653,7 @@ native_irq_return_ldt: - pushq %rax - pushq %rdi - SWAPGS -+ SWITCH_KERNEL_CR3 - movq PER_CPU_VAR(espfix_waddr), %rdi - movq %rax, (0*8)(%rdi) /* RAX */ - movq (2*8)(%rsp), %rax /* RIP */ -@@ -640,6 +669,7 @@ native_irq_return_ldt: - andl $0xffff0000, %eax - popq %rdi - orq PER_CPU_VAR(espfix_stack), %rax -+ SWITCH_USER_CR3 - SWAPGS - movq %rax, %rsp - popq %rax -@@ -995,7 +1025,11 @@ idtentry machine_check has_error_code=0 paranoid=1 do_sym=*machine_check_vec - /* - * Save all registers in pt_regs, and switch gs if needed. - * Use slow, but surefire "are we in kernel?" check. -- * Return: ebx=0: need swapgs on exit, ebx=1: otherwise -+ * -+ * Return: ebx=0: needs swapgs but not SWITCH_USER_CR3 in paranoid_exit -+ * ebx=1: needs neither swapgs nor SWITCH_USER_CR3 in paranoid_exit -+ * ebx=2: needs both swapgs and SWITCH_USER_CR3 in paranoid_exit -+ * ebx=3: needs SWITCH_USER_CR3 but not swapgs in paranoid_exit - */ - ENTRY(paranoid_entry) - cld -@@ -1008,7 +1042,26 @@ ENTRY(paranoid_entry) - js 1f /* negative -> in kernel */ - SWAPGS - xorl %ebx, %ebx --1: ret -+1: -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* -+ * We might have come in between a swapgs and a SWITCH_KERNEL_CR3 -+ * on entry, or between a SWITCH_USER_CR3 and a swapgs on exit. -+ * Do a conditional SWITCH_KERNEL_CR3: this could safely be done -+ * unconditionally, but we need to find out whether the reverse -+ * should be done on return (conveyed to paranoid_exit in %ebx). -+ */ -+ ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER -+ testl $KAISER_SHADOW_PGD_OFFSET, %eax -+ jz 2f -+ orl $2, %ebx -+ andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax -+ /* If PCID enabled, set X86_CR3_PCID_NOFLUSH_BIT */ -+ ALTERNATIVE "", "bts $63, %rax", X86_FEATURE_PCID -+ movq %rax, %cr3 -+2: -+#endif -+ ret - END(paranoid_entry) - - /* -@@ -1021,19 +1074,26 @@ END(paranoid_entry) - * be complicated. Fortunately, we there's no good reason - * to try to handle preemption here. - * -- * On entry, ebx is "no swapgs" flag (1: don't need swapgs, 0: need it) -+ * On entry: ebx=0: needs swapgs but not SWITCH_USER_CR3 -+ * ebx=1: needs neither swapgs nor SWITCH_USER_CR3 -+ * ebx=2: needs both swapgs and SWITCH_USER_CR3 -+ * ebx=3: needs SWITCH_USER_CR3 but not swapgs - */ - ENTRY(paranoid_exit) - DISABLE_INTERRUPTS(CLBR_NONE) - TRACE_IRQS_OFF_DEBUG -- testl %ebx, %ebx /* swapgs needed? */ -+ TRACE_IRQS_IRETQ_DEBUG -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* No ALTERNATIVE for X86_FEATURE_KAISER: paranoid_entry sets %ebx */ -+ testl $2, %ebx /* SWITCH_USER_CR3 needed? */ -+ jz paranoid_exit_no_switch -+ SWITCH_USER_CR3 -+paranoid_exit_no_switch: -+#endif -+ testl $1, %ebx /* swapgs needed? */ - jnz paranoid_exit_no_swapgs -- TRACE_IRQS_IRETQ - SWAPGS_UNSAFE_STACK -- jmp paranoid_exit_restore - paranoid_exit_no_swapgs: -- TRACE_IRQS_IRETQ_DEBUG --paranoid_exit_restore: - RESTORE_EXTRA_REGS - RESTORE_C_REGS - REMOVE_PT_GPREGS_FROM_STACK 8 -@@ -1048,6 +1108,13 @@ ENTRY(error_entry) - cld - SAVE_C_REGS 8 - SAVE_EXTRA_REGS 8 -+ /* -+ * error_entry() always returns with a kernel gsbase and -+ * CR3. We must also have a kernel CR3/gsbase before -+ * calling TRACE_IRQS_*. Just unconditionally switch to -+ * the kernel CR3 here. -+ */ -+ SWITCH_KERNEL_CR3 - xorl %ebx, %ebx - testb $3, CS+8(%rsp) - jz .Lerror_kernelspace -@@ -1210,6 +1277,10 @@ ENTRY(nmi) - */ - - SWAPGS_UNSAFE_STACK -+ /* -+ * percpu variables are mapped with user CR3, so no need -+ * to switch CR3 here. -+ */ - cld - movq %rsp, %rdx - movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp -@@ -1243,12 +1314,34 @@ ENTRY(nmi) - - movq %rsp, %rdi - movq $-1, %rsi -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* Unconditionally use kernel CR3 for do_nmi() */ -+ /* %rax is saved above, so OK to clobber here */ -+ ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER -+ /* If PCID enabled, NOFLUSH now and NOFLUSH on return */ -+ ALTERNATIVE "", "bts $63, %rax", X86_FEATURE_PCID -+ pushq %rax -+ /* mask off "user" bit of pgd address and 12 PCID bits: */ -+ andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax -+ movq %rax, %cr3 -+2: -+#endif - call do_nmi - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* -+ * Unconditionally restore CR3. I know we return to -+ * kernel code that needs user CR3, but do we ever return -+ * to "user mode" where we need the kernel CR3? -+ */ -+ ALTERNATIVE "", "popq %rax; movq %rax, %cr3", X86_FEATURE_KAISER -+#endif -+ - /* - * Return back to user mode. We must *not* do the normal exit -- * work, because we don't want to enable interrupts. Fortunately, -- * do_nmi doesn't modify pt_regs. -+ * work, because we don't want to enable interrupts. Do not -+ * switch to user CR3: we might be going back to kernel code -+ * that had a user CR3 set. - */ - SWAPGS - jmp restore_c_regs_and_iret -@@ -1445,22 +1538,55 @@ end_repeat_nmi: - ALLOC_PT_GPREGS_ON_STACK - - /* -- * Use paranoid_entry to handle SWAPGS, but no need to use paranoid_exit -- * as we should not be calling schedule in NMI context. -- * Even with normal interrupts enabled. An NMI should not be -- * setting NEED_RESCHED or anything that normal interrupts and -- * exceptions might do. -+ * Use the same approach as paranoid_entry to handle SWAPGS, but -+ * without CR3 handling since we do that differently in NMIs. No -+ * need to use paranoid_exit as we should not be calling schedule -+ * in NMI context. Even with normal interrupts enabled. An NMI -+ * should not be setting NEED_RESCHED or anything that normal -+ * interrupts and exceptions might do. - */ -- call paranoid_entry -- -- /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ -+ cld -+ SAVE_C_REGS -+ SAVE_EXTRA_REGS -+ movl $1, %ebx -+ movl $MSR_GS_BASE, %ecx -+ rdmsr -+ testl %edx, %edx -+ js 1f /* negative -> in kernel */ -+ SWAPGS -+ xorl %ebx, %ebx -+1: - movq %rsp, %rdi - movq $-1, %rsi -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* Unconditionally use kernel CR3 for do_nmi() */ -+ /* %rax is saved above, so OK to clobber here */ -+ ALTERNATIVE "jmp 2f", "movq %cr3, %rax", X86_FEATURE_KAISER -+ /* If PCID enabled, NOFLUSH now and NOFLUSH on return */ -+ ALTERNATIVE "", "bts $63, %rax", X86_FEATURE_PCID -+ pushq %rax -+ /* mask off "user" bit of pgd address and 12 PCID bits: */ -+ andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), %rax -+ movq %rax, %cr3 -+2: -+#endif -+ -+ /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */ - call do_nmi - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ /* -+ * Unconditionally restore CR3. We might be returning to -+ * kernel code that needs user CR3, like just just before -+ * a sysret. -+ */ -+ ALTERNATIVE "", "popq %rax; movq %rax, %cr3", X86_FEATURE_KAISER -+#endif -+ - testl %ebx, %ebx /* swapgs needed? */ - jnz nmi_restore - nmi_swapgs: -+ /* We fixed up CR3 above, so no need to switch it here */ - SWAPGS_UNSAFE_STACK - nmi_restore: - RESTORE_EXTRA_REGS -diff --git a/arch/x86/entry/entry_64_compat.S b/arch/x86/entry/entry_64_compat.S -index 15cfebaa7688..d03bf0e28b8b 100644 ---- a/arch/x86/entry/entry_64_compat.S -+++ b/arch/x86/entry/entry_64_compat.S -@@ -13,6 +13,8 @@ - #include - #include - #include -+#include -+#include - #include - #include - -@@ -50,6 +52,7 @@ ENDPROC(native_usergs_sysret32) - ENTRY(entry_SYSENTER_compat) - /* Interrupts are off on entry. */ - SWAPGS_UNSAFE_STACK -+ SWITCH_KERNEL_CR3_NO_STACK - movq PER_CPU_VAR(cpu_current_top_of_stack), %rsp - - /* -@@ -161,6 +164,7 @@ ENDPROC(entry_SYSENTER_compat) - ENTRY(entry_SYSCALL_compat) - /* Interrupts are off on entry. */ - SWAPGS_UNSAFE_STACK -+ SWITCH_KERNEL_CR3_NO_STACK - - /* Stash user ESP and switch to the kernel stack. */ - movl %esp, %r8d -@@ -208,6 +212,7 @@ ENTRY(entry_SYSCALL_compat) - /* Opportunistic SYSRET */ - sysret32_from_system_call: - TRACE_IRQS_ON /* User mode traces as IRQs on. */ -+ SWITCH_USER_CR3 - movq RBX(%rsp), %rbx /* pt_regs->rbx */ - movq RBP(%rsp), %rbp /* pt_regs->rbp */ - movq EFLAGS(%rsp), %r11 /* pt_regs->flags (in r11) */ -@@ -269,6 +274,7 @@ ENTRY(entry_INT80_compat) - PARAVIRT_ADJUST_EXCEPTION_FRAME - ASM_CLAC /* Do this early to minimize exposure */ - SWAPGS -+ SWITCH_KERNEL_CR3_NO_STACK - - /* - * User tracing code (ptrace or signal handlers) might assume that -@@ -311,6 +317,7 @@ ENTRY(entry_INT80_compat) - - /* Go back to user mode. */ - TRACE_IRQS_ON -+ SWITCH_USER_CR3 - SWAPGS - jmp restore_regs_and_iret - END(entry_INT80_compat) -diff --git a/arch/x86/entry/vdso/vclock_gettime.c b/arch/x86/entry/vdso/vclock_gettime.c -index ca94fa649251..5dd363d54348 100644 ---- a/arch/x86/entry/vdso/vclock_gettime.c -+++ b/arch/x86/entry/vdso/vclock_gettime.c -@@ -36,6 +36,11 @@ static notrace cycle_t vread_hpet(void) - } - #endif - -+#ifdef CONFIG_PARAVIRT_CLOCK -+extern u8 pvclock_page -+ __attribute__((visibility("hidden"))); -+#endif -+ - #ifndef BUILD_VDSO32 - - #include -@@ -62,63 +67,65 @@ notrace static long vdso_fallback_gtod(struct timeval *tv, struct timezone *tz) - - #ifdef CONFIG_PARAVIRT_CLOCK - --static notrace const struct pvclock_vsyscall_time_info *get_pvti(int cpu) -+static notrace const struct pvclock_vsyscall_time_info *get_pvti0(void) - { -- const struct pvclock_vsyscall_time_info *pvti_base; -- int idx = cpu / (PAGE_SIZE/PVTI_SIZE); -- int offset = cpu % (PAGE_SIZE/PVTI_SIZE); -- -- BUG_ON(PVCLOCK_FIXMAP_BEGIN + idx > PVCLOCK_FIXMAP_END); -- -- pvti_base = (struct pvclock_vsyscall_time_info *) -- __fix_to_virt(PVCLOCK_FIXMAP_BEGIN+idx); -- -- return &pvti_base[offset]; -+ return (const struct pvclock_vsyscall_time_info *)&pvclock_page; - } - - static notrace cycle_t vread_pvclock(int *mode) - { -- const struct pvclock_vsyscall_time_info *pvti; -+ const struct pvclock_vcpu_time_info *pvti = &get_pvti0()->pvti; - cycle_t ret; -- u64 last; -- u32 version; -- u8 flags; -- unsigned cpu, cpu1; -- -+ u64 tsc, pvti_tsc; -+ u64 last, delta, pvti_system_time; -+ u32 version, pvti_tsc_to_system_mul, pvti_tsc_shift; - - /* -- * Note: hypervisor must guarantee that: -- * 1. cpu ID number maps 1:1 to per-CPU pvclock time info. -- * 2. that per-CPU pvclock time info is updated if the -- * underlying CPU changes. -- * 3. that version is increased whenever underlying CPU -- * changes. -+ * Note: The kernel and hypervisor must guarantee that cpu ID -+ * number maps 1:1 to per-CPU pvclock time info. -+ * -+ * Because the hypervisor is entirely unaware of guest userspace -+ * preemption, it cannot guarantee that per-CPU pvclock time -+ * info is updated if the underlying CPU changes or that that -+ * version is increased whenever underlying CPU changes. - * -+ * On KVM, we are guaranteed that pvti updates for any vCPU are -+ * atomic as seen by *all* vCPUs. This is an even stronger -+ * guarantee than we get with a normal seqlock. -+ * -+ * On Xen, we don't appear to have that guarantee, but Xen still -+ * supplies a valid seqlock using the version field. -+ -+ * We only do pvclock vdso timing at all if -+ * PVCLOCK_TSC_STABLE_BIT is set, and we interpret that bit to -+ * mean that all vCPUs have matching pvti and that the TSC is -+ * synced, so we can just look at vCPU 0's pvti. - */ -- do { -- cpu = __getcpu() & VGETCPU_CPU_MASK; -- /* TODO: We can put vcpu id into higher bits of pvti.version. -- * This will save a couple of cycles by getting rid of -- * __getcpu() calls (Gleb). -- */ -- -- pvti = get_pvti(cpu); -- -- version = __pvclock_read_cycles(&pvti->pvti, &ret, &flags); -- -- /* -- * Test we're still on the cpu as well as the version. -- * We could have been migrated just after the first -- * vgetcpu but before fetching the version, so we -- * wouldn't notice a version change. -- */ -- cpu1 = __getcpu() & VGETCPU_CPU_MASK; -- } while (unlikely(cpu != cpu1 || -- (pvti->pvti.version & 1) || -- pvti->pvti.version != version)); -- -- if (unlikely(!(flags & PVCLOCK_TSC_STABLE_BIT))) -+ -+ if (unlikely(!(pvti->flags & PVCLOCK_TSC_STABLE_BIT))) { - *mode = VCLOCK_NONE; -+ return 0; -+ } -+ -+ do { -+ version = pvti->version; -+ -+ /* This is also a read barrier, so we'll read version first. */ -+ tsc = rdtsc_ordered(); -+ -+ pvti_tsc_to_system_mul = pvti->tsc_to_system_mul; -+ pvti_tsc_shift = pvti->tsc_shift; -+ pvti_system_time = pvti->system_time; -+ pvti_tsc = pvti->tsc_timestamp; -+ -+ /* Make sure that the version double-check is last. */ -+ smp_rmb(); -+ } while (unlikely((version & 1) || version != pvti->version)); -+ -+ delta = tsc - pvti_tsc; -+ ret = pvti_system_time + -+ pvclock_scale_delta(delta, pvti_tsc_to_system_mul, -+ pvti_tsc_shift); - - /* refer to tsc.c read_tsc() comment for rationale */ - last = gtod->cycle_last; -diff --git a/arch/x86/entry/vdso/vdso-layout.lds.S b/arch/x86/entry/vdso/vdso-layout.lds.S -index de2c921025f5..4158acc17df0 100644 ---- a/arch/x86/entry/vdso/vdso-layout.lds.S -+++ b/arch/x86/entry/vdso/vdso-layout.lds.S -@@ -25,7 +25,7 @@ SECTIONS - * segment. - */ - -- vvar_start = . - 2 * PAGE_SIZE; -+ vvar_start = . - 3 * PAGE_SIZE; - vvar_page = vvar_start; - - /* Place all vvars at the offsets in asm/vvar.h. */ -@@ -36,6 +36,7 @@ SECTIONS - #undef EMIT_VVAR - - hpet_page = vvar_start + PAGE_SIZE; -+ pvclock_page = vvar_start + 2 * PAGE_SIZE; - - . = SIZEOF_HEADERS; - -diff --git a/arch/x86/entry/vdso/vdso2c.c b/arch/x86/entry/vdso/vdso2c.c -index 785d9922b106..491020b2826d 100644 ---- a/arch/x86/entry/vdso/vdso2c.c -+++ b/arch/x86/entry/vdso/vdso2c.c -@@ -73,6 +73,7 @@ enum { - sym_vvar_start, - sym_vvar_page, - sym_hpet_page, -+ sym_pvclock_page, - sym_VDSO_FAKE_SECTION_TABLE_START, - sym_VDSO_FAKE_SECTION_TABLE_END, - }; -@@ -80,6 +81,7 @@ enum { - const int special_pages[] = { - sym_vvar_page, - sym_hpet_page, -+ sym_pvclock_page, - }; - - struct vdso_sym { -@@ -91,6 +93,7 @@ struct vdso_sym required_syms[] = { - [sym_vvar_start] = {"vvar_start", true}, - [sym_vvar_page] = {"vvar_page", true}, - [sym_hpet_page] = {"hpet_page", true}, -+ [sym_pvclock_page] = {"pvclock_page", true}, - [sym_VDSO_FAKE_SECTION_TABLE_START] = { - "VDSO_FAKE_SECTION_TABLE_START", false - }, -diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c -index 64df47148160..aa828191c654 100644 ---- a/arch/x86/entry/vdso/vma.c -+++ b/arch/x86/entry/vdso/vma.c -@@ -100,6 +100,7 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr) - .name = "[vvar]", - .pages = no_pages, - }; -+ struct pvclock_vsyscall_time_info *pvti; - - if (calculate_addr) { - addr = vdso_addr(current->mm->start_stack, -@@ -169,6 +170,18 @@ static int map_vdso(const struct vdso_image *image, bool calculate_addr) - } - #endif - -+ pvti = pvclock_pvti_cpu0_va(); -+ if (pvti && image->sym_pvclock_page) { -+ ret = remap_pfn_range(vma, -+ text_start + image->sym_pvclock_page, -+ __pa(pvti) >> PAGE_SHIFT, -+ PAGE_SIZE, -+ PAGE_READONLY); -+ -+ if (ret) -+ goto up_fail; -+ } -+ - up_fail: - if (ret) - current->mm->context.vdso = NULL; -diff --git a/arch/x86/include/asm/cmdline.h b/arch/x86/include/asm/cmdline.h -index e01f7f7ccb0c..84ae170bc3d0 100644 ---- a/arch/x86/include/asm/cmdline.h -+++ b/arch/x86/include/asm/cmdline.h -@@ -2,5 +2,7 @@ - #define _ASM_X86_CMDLINE_H - - int cmdline_find_option_bool(const char *cmdline_ptr, const char *option); -+int cmdline_find_option(const char *cmdline_ptr, const char *option, -+ char *buffer, int bufsize); - - #endif /* _ASM_X86_CMDLINE_H */ -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index f7ba9fbf12ee..f6605712ca90 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -187,6 +187,7 @@ - #define X86_FEATURE_ARAT ( 7*32+ 1) /* Always Running APIC Timer */ - #define X86_FEATURE_CPB ( 7*32+ 2) /* AMD Core Performance Boost */ - #define X86_FEATURE_EPB ( 7*32+ 3) /* IA32_ENERGY_PERF_BIAS support */ -+#define X86_FEATURE_INVPCID_SINGLE ( 7*32+ 4) /* Effectively INVPCID && CR4.PCIDE=1 */ - #define X86_FEATURE_PLN ( 7*32+ 5) /* Intel Power Limit Notification */ - #define X86_FEATURE_PTS ( 7*32+ 6) /* Intel Package Thermal Status */ - #define X86_FEATURE_DTHERM ( 7*32+ 7) /* Digital Thermal Sensor */ -@@ -199,6 +200,9 @@ - #define X86_FEATURE_HWP_PKG_REQ ( 7*32+14) /* Intel HWP_PKG_REQ */ - #define X86_FEATURE_INTEL_PT ( 7*32+15) /* Intel Processor Trace */ - -+/* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */ -+#define X86_FEATURE_KAISER ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */ -+ - /* Virtualization flags: Linux defined, word 8 */ - #define X86_FEATURE_TPR_SHADOW ( 8*32+ 0) /* Intel TPR Shadow */ - #define X86_FEATURE_VNMI ( 8*32+ 1) /* Intel Virtual NMI */ -diff --git a/arch/x86/include/asm/desc.h b/arch/x86/include/asm/desc.h -index 4e10d73cf018..880db91d9457 100644 ---- a/arch/x86/include/asm/desc.h -+++ b/arch/x86/include/asm/desc.h -@@ -43,7 +43,7 @@ struct gdt_page { - struct desc_struct gdt[GDT_ENTRIES]; - } __attribute__((aligned(PAGE_SIZE))); - --DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page); -+DECLARE_PER_CPU_PAGE_ALIGNED_USER_MAPPED(struct gdt_page, gdt_page); - - static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu) - { -diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h -index 59caa55fb9b5..ee52ff858699 100644 ---- a/arch/x86/include/asm/hw_irq.h -+++ b/arch/x86/include/asm/hw_irq.h -@@ -187,7 +187,7 @@ extern char irq_entries_start[]; - #define VECTOR_RETRIGGERED ((void *)~0UL) - - typedef struct irq_desc* vector_irq_t[NR_VECTORS]; --DECLARE_PER_CPU(vector_irq_t, vector_irq); -+DECLARE_PER_CPU_USER_MAPPED(vector_irq_t, vector_irq); - - #endif /* !ASSEMBLY_ */ - -diff --git a/arch/x86/include/asm/kaiser.h b/arch/x86/include/asm/kaiser.h -new file mode 100644 -index 000000000000..802bbbdfe143 ---- /dev/null -+++ b/arch/x86/include/asm/kaiser.h -@@ -0,0 +1,141 @@ -+#ifndef _ASM_X86_KAISER_H -+#define _ASM_X86_KAISER_H -+ -+#include /* For PCID constants */ -+ -+/* -+ * This file includes the definitions for the KAISER feature. -+ * KAISER is a counter measure against x86_64 side channel attacks on -+ * the kernel virtual memory. It has a shadow pgd for every process: the -+ * shadow pgd has a minimalistic kernel-set mapped, but includes the whole -+ * user memory. Within a kernel context switch, or when an interrupt is handled, -+ * the pgd is switched to the normal one. When the system switches to user mode, -+ * the shadow pgd is enabled. By this, the virtual memory caches are freed, -+ * and the user may not attack the whole kernel memory. -+ * -+ * A minimalistic kernel mapping holds the parts needed to be mapped in user -+ * mode, such as the entry/exit functions of the user space, or the stacks. -+ */ -+ -+#define KAISER_SHADOW_PGD_OFFSET 0x1000 -+ -+#ifdef __ASSEMBLY__ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ -+.macro _SWITCH_TO_KERNEL_CR3 reg -+movq %cr3, \reg -+andq $(~(X86_CR3_PCID_ASID_MASK | KAISER_SHADOW_PGD_OFFSET)), \reg -+/* If PCID enabled, set X86_CR3_PCID_NOFLUSH_BIT */ -+ALTERNATIVE "", "bts $63, \reg", X86_FEATURE_PCID -+movq \reg, %cr3 -+.endm -+ -+.macro _SWITCH_TO_USER_CR3 reg regb -+/* -+ * regb must be the low byte portion of reg: because we have arranged -+ * for the low byte of the user PCID to serve as the high byte of NOFLUSH -+ * (0x80 for each when PCID is enabled, or 0x00 when PCID and NOFLUSH are -+ * not enabled): so that the one register can update both memory and cr3. -+ */ -+movq %cr3, \reg -+orq PER_CPU_VAR(x86_cr3_pcid_user), \reg -+js 9f -+/* If PCID enabled, FLUSH this time, reset to NOFLUSH for next time */ -+movb \regb, PER_CPU_VAR(x86_cr3_pcid_user+7) -+9: -+movq \reg, %cr3 -+.endm -+ -+.macro SWITCH_KERNEL_CR3 -+ALTERNATIVE "jmp 8f", "pushq %rax", X86_FEATURE_KAISER -+_SWITCH_TO_KERNEL_CR3 %rax -+popq %rax -+8: -+.endm -+ -+.macro SWITCH_USER_CR3 -+ALTERNATIVE "jmp 8f", "pushq %rax", X86_FEATURE_KAISER -+_SWITCH_TO_USER_CR3 %rax %al -+popq %rax -+8: -+.endm -+ -+.macro SWITCH_KERNEL_CR3_NO_STACK -+ALTERNATIVE "jmp 8f", \ -+ __stringify(movq %rax, PER_CPU_VAR(unsafe_stack_register_backup)), \ -+ X86_FEATURE_KAISER -+_SWITCH_TO_KERNEL_CR3 %rax -+movq PER_CPU_VAR(unsafe_stack_register_backup), %rax -+8: -+.endm -+ -+#else /* CONFIG_PAGE_TABLE_ISOLATION */ -+ -+.macro SWITCH_KERNEL_CR3 -+.endm -+.macro SWITCH_USER_CR3 -+.endm -+.macro SWITCH_KERNEL_CR3_NO_STACK -+.endm -+ -+#endif /* CONFIG_PAGE_TABLE_ISOLATION */ -+ -+#else /* __ASSEMBLY__ */ -+ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+/* -+ * Upon kernel/user mode switch, it may happen that the address -+ * space has to be switched before the registers have been -+ * stored. To change the address space, another register is -+ * needed. A register therefore has to be stored/restored. -+*/ -+DECLARE_PER_CPU_USER_MAPPED(unsigned long, unsafe_stack_register_backup); -+ -+DECLARE_PER_CPU(unsigned long, x86_cr3_pcid_user); -+ -+extern char __per_cpu_user_mapped_start[], __per_cpu_user_mapped_end[]; -+ -+extern int kaiser_enabled; -+extern void __init kaiser_check_boottime_disable(void); -+#else -+#define kaiser_enabled 0 -+static inline void __init kaiser_check_boottime_disable(void) {} -+#endif /* CONFIG_PAGE_TABLE_ISOLATION */ -+ -+/* -+ * Kaiser function prototypes are needed even when CONFIG_PAGE_TABLE_ISOLATION is not set, -+ * so as to build with tests on kaiser_enabled instead of #ifdefs. -+ */ -+ -+/** -+ * kaiser_add_mapping - map a virtual memory part to the shadow (user) mapping -+ * @addr: the start address of the range -+ * @size: the size of the range -+ * @flags: The mapping flags of the pages -+ * -+ * The mapping is done on a global scope, so no bigger -+ * synchronization has to be done. the pages have to be -+ * manually unmapped again when they are not needed any longer. -+ */ -+extern int kaiser_add_mapping(unsigned long addr, unsigned long size, unsigned long flags); -+ -+/** -+ * kaiser_remove_mapping - unmap a virtual memory part of the shadow mapping -+ * @addr: the start address of the range -+ * @size: the size of the range -+ */ -+extern void kaiser_remove_mapping(unsigned long start, unsigned long size); -+ -+/** -+ * kaiser_init - Initialize the shadow mapping -+ * -+ * Most parts of the shadow mapping can be mapped upon boot -+ * time. Only per-process things like the thread stacks -+ * or a new LDT have to be mapped at runtime. These boot- -+ * time mappings are permanent and never unmapped. -+ */ -+extern void kaiser_init(void); -+ -+#endif /* __ASSEMBLY */ -+ -+#endif /* _ASM_X86_KAISER_H */ -diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h -index 6ec0c8b2e9df..84c62d950023 100644 ---- a/arch/x86/include/asm/pgtable.h -+++ b/arch/x86/include/asm/pgtable.h -@@ -18,6 +18,12 @@ - #ifndef __ASSEMBLY__ - #include - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+extern int kaiser_enabled; -+#else -+#define kaiser_enabled 0 -+#endif -+ - void ptdump_walk_pgd_level(struct seq_file *m, pgd_t *pgd); - void ptdump_walk_pgd_level_checkwx(void); - -@@ -653,7 +659,17 @@ static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address) - - static inline int pgd_bad(pgd_t pgd) - { -- return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE; -+ pgdval_t ignore_flags = _PAGE_USER; -+ /* -+ * We set NX on KAISER pgds that map userspace memory so -+ * that userspace can not meaningfully use the kernel -+ * page table by accident; it will fault on the first -+ * instruction it tries to run. See native_set_pgd(). -+ */ -+ if (kaiser_enabled) -+ ignore_flags |= _PAGE_NX; -+ -+ return (pgd_flags(pgd) & ~ignore_flags) != _KERNPG_TABLE; - } - - static inline int pgd_none(pgd_t pgd) -@@ -855,7 +871,15 @@ static inline void pmdp_set_wrprotect(struct mm_struct *mm, - */ - static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count) - { -- memcpy(dst, src, count * sizeof(pgd_t)); -+ memcpy(dst, src, count * sizeof(pgd_t)); -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ if (kaiser_enabled) { -+ /* Clone the shadow pgd part as well */ -+ memcpy(native_get_shadow_pgd(dst), -+ native_get_shadow_pgd(src), -+ count * sizeof(pgd_t)); -+ } -+#endif - } - - #define PTE_SHIFT ilog2(PTRS_PER_PTE) -diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h -index 2ee781114d34..c810226e741a 100644 ---- a/arch/x86/include/asm/pgtable_64.h -+++ b/arch/x86/include/asm/pgtable_64.h -@@ -106,9 +106,32 @@ static inline void native_pud_clear(pud_t *pud) - native_set_pud(pud, native_make_pud(0)); - } - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+extern pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd); -+ -+static inline pgd_t *native_get_shadow_pgd(pgd_t *pgdp) -+{ -+#ifdef CONFIG_DEBUG_VM -+ /* linux/mmdebug.h may not have been included at this point */ -+ BUG_ON(!kaiser_enabled); -+#endif -+ return (pgd_t *)((unsigned long)pgdp | (unsigned long)PAGE_SIZE); -+} -+#else -+static inline pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd) -+{ -+ return pgd; -+} -+static inline pgd_t *native_get_shadow_pgd(pgd_t *pgdp) -+{ -+ BUILD_BUG_ON(1); -+ return NULL; -+} -+#endif /* CONFIG_PAGE_TABLE_ISOLATION */ -+ - static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd) - { -- *pgdp = pgd; -+ *pgdp = kaiser_set_shadow_pgd(pgdp, pgd); - } - - static inline void native_pgd_clear(pgd_t *pgd) -diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h -index 79c91853e50e..8dba273da25a 100644 ---- a/arch/x86/include/asm/pgtable_types.h -+++ b/arch/x86/include/asm/pgtable_types.h -@@ -89,7 +89,7 @@ - #define _PAGE_NX (_AT(pteval_t, 0)) - #endif - --#define _PAGE_PROTNONE (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE) -+#define _PAGE_PROTNONE (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE) - - #define _PAGE_TABLE (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | \ - _PAGE_ACCESSED | _PAGE_DIRTY) -@@ -102,6 +102,33 @@ - _PAGE_SOFT_DIRTY) - #define _HPAGE_CHG_MASK (_PAGE_CHG_MASK | _PAGE_PSE) - -+/* The ASID is the lower 12 bits of CR3 */ -+#define X86_CR3_PCID_ASID_MASK (_AC((1<<12)-1,UL)) -+ -+/* Mask for all the PCID-related bits in CR3: */ -+#define X86_CR3_PCID_MASK (X86_CR3_PCID_NOFLUSH | X86_CR3_PCID_ASID_MASK) -+#define X86_CR3_PCID_ASID_KERN (_AC(0x0,UL)) -+ -+#if defined(CONFIG_PAGE_TABLE_ISOLATION) && defined(CONFIG_X86_64) -+/* Let X86_CR3_PCID_ASID_USER be usable for the X86_CR3_PCID_NOFLUSH bit */ -+#define X86_CR3_PCID_ASID_USER (_AC(0x80,UL)) -+ -+#define X86_CR3_PCID_KERN_FLUSH (X86_CR3_PCID_ASID_KERN) -+#define X86_CR3_PCID_USER_FLUSH (X86_CR3_PCID_ASID_USER) -+#define X86_CR3_PCID_KERN_NOFLUSH (X86_CR3_PCID_NOFLUSH | X86_CR3_PCID_ASID_KERN) -+#define X86_CR3_PCID_USER_NOFLUSH (X86_CR3_PCID_NOFLUSH | X86_CR3_PCID_ASID_USER) -+#else -+#define X86_CR3_PCID_ASID_USER (_AC(0x0,UL)) -+/* -+ * PCIDs are unsupported on 32-bit and none of these bits can be -+ * set in CR3: -+ */ -+#define X86_CR3_PCID_KERN_FLUSH (0) -+#define X86_CR3_PCID_USER_FLUSH (0) -+#define X86_CR3_PCID_KERN_NOFLUSH (0) -+#define X86_CR3_PCID_USER_NOFLUSH (0) -+#endif -+ - /* - * The cache modes defined here are used to translate between pure SW usage - * and the HW defined cache mode bits and/or PAT entries. -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 2d5a50cb61a2..f3bdaed0188f 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -305,7 +305,7 @@ struct tss_struct { - - } ____cacheline_aligned; - --DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss); -+DECLARE_PER_CPU_SHARED_ALIGNED_USER_MAPPED(struct tss_struct, cpu_tss); - - #ifdef CONFIG_X86_32 - DECLARE_PER_CPU(unsigned long, cpu_current_top_of_stack); -diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h -index baad72e4c100..6045cef376c2 100644 ---- a/arch/x86/include/asm/pvclock.h -+++ b/arch/x86/include/asm/pvclock.h -@@ -4,6 +4,15 @@ - #include - #include - -+#ifdef CONFIG_PARAVIRT_CLOCK -+extern struct pvclock_vsyscall_time_info *pvclock_pvti_cpu0_va(void); -+#else -+static inline struct pvclock_vsyscall_time_info *pvclock_pvti_cpu0_va(void) -+{ -+ return NULL; -+} -+#endif -+ - /* some helper functions for xen and kvm pv clock sources */ - cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src); - u8 pvclock_read_flags(struct pvclock_vcpu_time_info *src); -diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h -index 9fc5968da820..a691b66cc40a 100644 ---- a/arch/x86/include/asm/tlbflush.h -+++ b/arch/x86/include/asm/tlbflush.h -@@ -131,6 +131,24 @@ static inline void cr4_set_bits_and_update_boot(unsigned long mask) - cr4_set_bits(mask); - } - -+/* -+ * Declare a couple of kaiser interfaces here for convenience, -+ * to avoid the need for asm/kaiser.h in unexpected places. -+ */ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+extern int kaiser_enabled; -+extern void kaiser_setup_pcid(void); -+extern void kaiser_flush_tlb_on_return_to_user(void); -+#else -+#define kaiser_enabled 0 -+static inline void kaiser_setup_pcid(void) -+{ -+} -+static inline void kaiser_flush_tlb_on_return_to_user(void) -+{ -+} -+#endif -+ - static inline void __native_flush_tlb(void) - { - /* -@@ -139,6 +157,8 @@ static inline void __native_flush_tlb(void) - * back: - */ - preempt_disable(); -+ if (kaiser_enabled) -+ kaiser_flush_tlb_on_return_to_user(); - native_write_cr3(native_read_cr3()); - preempt_enable(); - } -@@ -148,20 +168,27 @@ static inline void __native_flush_tlb_global_irq_disabled(void) - unsigned long cr4; - - cr4 = this_cpu_read(cpu_tlbstate.cr4); -- /* clear PGE */ -- native_write_cr4(cr4 & ~X86_CR4_PGE); -- /* write old PGE again and flush TLBs */ -- native_write_cr4(cr4); -+ if (cr4 & X86_CR4_PGE) { -+ /* clear PGE and flush TLB of all entries */ -+ native_write_cr4(cr4 & ~X86_CR4_PGE); -+ /* restore PGE as it was before */ -+ native_write_cr4(cr4); -+ } else { -+ /* do it with cr3, letting kaiser flush user PCID */ -+ __native_flush_tlb(); -+ } - } - - static inline void __native_flush_tlb_global(void) - { - unsigned long flags; - -- if (static_cpu_has(X86_FEATURE_INVPCID)) { -+ if (this_cpu_has(X86_FEATURE_INVPCID)) { - /* - * Using INVPCID is considerably faster than a pair of writes - * to CR4 sandwiched inside an IRQ flag save/restore. -+ * -+ * Note, this works with CR4.PCIDE=0 or 1. - */ - invpcid_flush_all(); - return; -@@ -173,24 +200,45 @@ static inline void __native_flush_tlb_global(void) - * be called from deep inside debugging code.) - */ - raw_local_irq_save(flags); -- - __native_flush_tlb_global_irq_disabled(); -- - raw_local_irq_restore(flags); - } - - static inline void __native_flush_tlb_single(unsigned long addr) - { -- asm volatile("invlpg (%0)" ::"r" (addr) : "memory"); -+ /* -+ * SIMICS #GP's if you run INVPCID with type 2/3 -+ * and X86_CR4_PCIDE clear. Shame! -+ * -+ * The ASIDs used below are hard-coded. But, we must not -+ * call invpcid(type=1/2) before CR4.PCIDE=1. Just call -+ * invlpg in the case we are called early. -+ */ -+ -+ if (!this_cpu_has(X86_FEATURE_INVPCID_SINGLE)) { -+ if (kaiser_enabled) -+ kaiser_flush_tlb_on_return_to_user(); -+ asm volatile("invlpg (%0)" ::"r" (addr) : "memory"); -+ return; -+ } -+ /* Flush the address out of both PCIDs. */ -+ /* -+ * An optimization here might be to determine addresses -+ * that are only kernel-mapped and only flush the kernel -+ * ASID. But, userspace flushes are probably much more -+ * important performance-wise. -+ * -+ * Make sure to do only a single invpcid when KAISER is -+ * disabled and we have only a single ASID. -+ */ -+ if (kaiser_enabled) -+ invpcid_flush_one(X86_CR3_PCID_ASID_USER, addr); -+ invpcid_flush_one(X86_CR3_PCID_ASID_KERN, addr); - } - - static inline void __flush_tlb_all(void) - { -- if (cpu_has_pge) -- __flush_tlb_global(); -- else -- __flush_tlb(); -- -+ __flush_tlb_global(); - /* - * Note: if we somehow had PCID but not PGE, then this wouldn't work -- - * we'd end up flushing kernel translations for the current ASID but -diff --git a/arch/x86/include/asm/vdso.h b/arch/x86/include/asm/vdso.h -index 756de9190aec..deabaf9759b6 100644 ---- a/arch/x86/include/asm/vdso.h -+++ b/arch/x86/include/asm/vdso.h -@@ -22,6 +22,7 @@ struct vdso_image { - - long sym_vvar_page; - long sym_hpet_page; -+ long sym_pvclock_page; - long sym_VDSO32_NOTE_MASK; - long sym___kernel_sigreturn; - long sym___kernel_rt_sigreturn; -diff --git a/arch/x86/include/uapi/asm/processor-flags.h b/arch/x86/include/uapi/asm/processor-flags.h -index 79887abcb5e1..1361779f44fe 100644 ---- a/arch/x86/include/uapi/asm/processor-flags.h -+++ b/arch/x86/include/uapi/asm/processor-flags.h -@@ -77,7 +77,8 @@ - #define X86_CR3_PWT _BITUL(X86_CR3_PWT_BIT) - #define X86_CR3_PCD_BIT 4 /* Page Cache Disable */ - #define X86_CR3_PCD _BITUL(X86_CR3_PCD_BIT) --#define X86_CR3_PCID_MASK _AC(0x00000fff,UL) /* PCID Mask */ -+#define X86_CR3_PCID_NOFLUSH_BIT 63 /* Preserve old PCID */ -+#define X86_CR3_PCID_NOFLUSH _BITULL(X86_CR3_PCID_NOFLUSH_BIT) - - /* - * Intel CPU features in CR4 -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index aa1e7246b06b..cc154ac64f00 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -92,7 +92,7 @@ static const struct cpu_dev default_cpu = { - - static const struct cpu_dev *this_cpu = &default_cpu; - --DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = { -+DEFINE_PER_CPU_PAGE_ALIGNED_USER_MAPPED(struct gdt_page, gdt_page) = { .gdt = { - #ifdef CONFIG_X86_64 - /* - * We need valid kernel segments for data and code in long mode too -@@ -324,8 +324,21 @@ static __always_inline void setup_smap(struct cpuinfo_x86 *c) - static void setup_pcid(struct cpuinfo_x86 *c) - { - if (cpu_has(c, X86_FEATURE_PCID)) { -- if (cpu_has(c, X86_FEATURE_PGE)) { -+ if (cpu_has(c, X86_FEATURE_PGE) || kaiser_enabled) { - cr4_set_bits(X86_CR4_PCIDE); -+ /* -+ * INVPCID has two "groups" of types: -+ * 1/2: Invalidate an individual address -+ * 3/4: Invalidate all contexts -+ * -+ * 1/2 take a PCID, but 3/4 do not. So, 3/4 -+ * ignore the PCID argument in the descriptor. -+ * But, we have to be careful not to call 1/2 -+ * with an actual non-zero PCID in them before -+ * we do the above cr4_set_bits(). -+ */ -+ if (cpu_has(c, X86_FEATURE_INVPCID)) -+ set_cpu_cap(c, X86_FEATURE_INVPCID_SINGLE); - } else { - /* - * flush_tlb_all(), as currently implemented, won't -@@ -338,6 +351,7 @@ static void setup_pcid(struct cpuinfo_x86 *c) - clear_cpu_cap(c, X86_FEATURE_PCID); - } - } -+ kaiser_setup_pcid(); - } - - /* -@@ -1229,7 +1243,7 @@ static const unsigned int exception_stack_sizes[N_EXCEPTION_STACKS] = { - [DEBUG_STACK - 1] = DEBUG_STKSZ - }; - --static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks -+DEFINE_PER_CPU_PAGE_ALIGNED_USER_MAPPED(char, exception_stacks - [(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ]); - - /* May not be marked __init: used by software suspend */ -@@ -1392,6 +1406,14 @@ void cpu_init(void) - * try to read it. - */ - cr4_init_shadow(); -+ if (!kaiser_enabled) { -+ /* -+ * secondary_startup_64() deferred setting PGE in cr4: -+ * probe_page_size_mask() sets it on the boot cpu, -+ * but it needs to be set on each secondary cpu. -+ */ -+ cr4_set_bits(X86_CR4_PGE); -+ } - - /* - * Load microcode on this cpu if a valid microcode is available. -diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c -index 1e7de3cefc9c..f01b3a12dce0 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_ds.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c -@@ -2,11 +2,15 @@ - #include - #include - -+#include - #include - #include - - #include "perf_event.h" - -+static -+DEFINE_PER_CPU_SHARED_ALIGNED_USER_MAPPED(struct debug_store, cpu_debug_store); -+ - /* The size of a BTS record in bytes: */ - #define BTS_RECORD_SIZE 24 - -@@ -268,6 +272,39 @@ void fini_debug_store_on_cpu(int cpu) - - static DEFINE_PER_CPU(void *, insn_buffer); - -+static void *dsalloc(size_t size, gfp_t flags, int node) -+{ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ unsigned int order = get_order(size); -+ struct page *page; -+ unsigned long addr; -+ -+ page = __alloc_pages_node(node, flags | __GFP_ZERO, order); -+ if (!page) -+ return NULL; -+ addr = (unsigned long)page_address(page); -+ if (kaiser_add_mapping(addr, size, __PAGE_KERNEL) < 0) { -+ __free_pages(page, order); -+ addr = 0; -+ } -+ return (void *)addr; -+#else -+ return kmalloc_node(size, flags | __GFP_ZERO, node); -+#endif -+} -+ -+static void dsfree(const void *buffer, size_t size) -+{ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ if (!buffer) -+ return; -+ kaiser_remove_mapping((unsigned long)buffer, size); -+ free_pages((unsigned long)buffer, get_order(size)); -+#else -+ kfree(buffer); -+#endif -+} -+ - static int alloc_pebs_buffer(int cpu) - { - struct debug_store *ds = per_cpu(cpu_hw_events, cpu).ds; -@@ -278,7 +315,7 @@ static int alloc_pebs_buffer(int cpu) - if (!x86_pmu.pebs) - return 0; - -- buffer = kzalloc_node(x86_pmu.pebs_buffer_size, GFP_KERNEL, node); -+ buffer = dsalloc(x86_pmu.pebs_buffer_size, GFP_KERNEL, node); - if (unlikely(!buffer)) - return -ENOMEM; - -@@ -289,7 +326,7 @@ static int alloc_pebs_buffer(int cpu) - if (x86_pmu.intel_cap.pebs_format < 2) { - ibuffer = kzalloc_node(PEBS_FIXUP_SIZE, GFP_KERNEL, node); - if (!ibuffer) { -- kfree(buffer); -+ dsfree(buffer, x86_pmu.pebs_buffer_size); - return -ENOMEM; - } - per_cpu(insn_buffer, cpu) = ibuffer; -@@ -315,7 +352,8 @@ static void release_pebs_buffer(int cpu) - kfree(per_cpu(insn_buffer, cpu)); - per_cpu(insn_buffer, cpu) = NULL; - -- kfree((void *)(unsigned long)ds->pebs_buffer_base); -+ dsfree((void *)(unsigned long)ds->pebs_buffer_base, -+ x86_pmu.pebs_buffer_size); - ds->pebs_buffer_base = 0; - } - -@@ -329,7 +367,7 @@ static int alloc_bts_buffer(int cpu) - if (!x86_pmu.bts) - return 0; - -- buffer = kzalloc_node(BTS_BUFFER_SIZE, GFP_KERNEL | __GFP_NOWARN, node); -+ buffer = dsalloc(BTS_BUFFER_SIZE, GFP_KERNEL | __GFP_NOWARN, node); - if (unlikely(!buffer)) { - WARN_ONCE(1, "%s: BTS buffer allocation failure\n", __func__); - return -ENOMEM; -@@ -355,19 +393,15 @@ static void release_bts_buffer(int cpu) - if (!ds || !x86_pmu.bts) - return; - -- kfree((void *)(unsigned long)ds->bts_buffer_base); -+ dsfree((void *)(unsigned long)ds->bts_buffer_base, BTS_BUFFER_SIZE); - ds->bts_buffer_base = 0; - } - - static int alloc_ds_buffer(int cpu) - { -- int node = cpu_to_node(cpu); -- struct debug_store *ds; -- -- ds = kzalloc_node(sizeof(*ds), GFP_KERNEL, node); -- if (unlikely(!ds)) -- return -ENOMEM; -+ struct debug_store *ds = per_cpu_ptr(&cpu_debug_store, cpu); - -+ memset(ds, 0, sizeof(*ds)); - per_cpu(cpu_hw_events, cpu).ds = ds; - - return 0; -@@ -381,7 +415,6 @@ static void release_ds_buffer(int cpu) - return; - - per_cpu(cpu_hw_events, cpu).ds = NULL; -- kfree(ds); - } - - void release_ds_buffers(void) -diff --git a/arch/x86/kernel/espfix_64.c b/arch/x86/kernel/espfix_64.c -index 4d38416e2a7f..b02cb2ec6726 100644 ---- a/arch/x86/kernel/espfix_64.c -+++ b/arch/x86/kernel/espfix_64.c -@@ -41,6 +41,7 @@ - #include - #include - #include -+#include - - /* - * Note: we only need 6*8 = 48 bytes for the espfix stack, but round -@@ -126,6 +127,15 @@ void __init init_espfix_bsp(void) - /* Install the espfix pud into the kernel page directory */ - pgd_p = &init_level4_pgt[pgd_index(ESPFIX_BASE_ADDR)]; - pgd_populate(&init_mm, pgd_p, (pud_t *)espfix_pud_page); -+ /* -+ * Just copy the top-level PGD that is mapping the espfix -+ * area to ensure it is mapped into the shadow user page -+ * tables. -+ */ -+ if (kaiser_enabled) { -+ set_pgd(native_get_shadow_pgd(pgd_p), -+ __pgd(_KERNPG_TABLE | __pa((pud_t *)espfix_pud_page))); -+ } - - /* Randomize the locations */ - init_espfix_random(); -diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S -index ffdc0e860390..4034e905741a 100644 ---- a/arch/x86/kernel/head_64.S -+++ b/arch/x86/kernel/head_64.S -@@ -183,8 +183,8 @@ ENTRY(secondary_startup_64) - movq $(init_level4_pgt - __START_KERNEL_map), %rax - 1: - -- /* Enable PAE mode and PGE */ -- movl $(X86_CR4_PAE | X86_CR4_PGE), %ecx -+ /* Enable PAE and PSE, but defer PGE until kaiser_enabled is decided */ -+ movl $(X86_CR4_PAE | X86_CR4_PSE), %ecx - movq %rcx, %cr4 - - /* Setup early boot stage 4 level pagetables. */ -@@ -441,6 +441,27 @@ early_idt_ripmsg: - .balign PAGE_SIZE; \ - GLOBAL(name) - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+/* -+ * Each PGD needs to be 8k long and 8k aligned. We do not -+ * ever go out to userspace with these, so we do not -+ * strictly *need* the second page, but this allows us to -+ * have a single set_pgd() implementation that does not -+ * need to worry about whether it has 4k or 8k to work -+ * with. -+ * -+ * This ensures PGDs are 8k long: -+ */ -+#define KAISER_USER_PGD_FILL 512 -+/* This ensures they are 8k-aligned: */ -+#define NEXT_PGD_PAGE(name) \ -+ .balign 2 * PAGE_SIZE; \ -+GLOBAL(name) -+#else -+#define NEXT_PGD_PAGE(name) NEXT_PAGE(name) -+#define KAISER_USER_PGD_FILL 0 -+#endif -+ - /* Automate the creation of 1 to 1 mapping pmd entries */ - #define PMDS(START, PERM, COUNT) \ - i = 0 ; \ -@@ -450,9 +471,10 @@ GLOBAL(name) - .endr - - __INITDATA --NEXT_PAGE(early_level4_pgt) -+NEXT_PGD_PAGE(early_level4_pgt) - .fill 511,8,0 - .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE -+ .fill KAISER_USER_PGD_FILL,8,0 - - NEXT_PAGE(early_dynamic_pgts) - .fill 512*EARLY_DYNAMIC_PAGE_TABLES,8,0 -@@ -460,16 +482,18 @@ NEXT_PAGE(early_dynamic_pgts) - .data - - #ifndef CONFIG_XEN --NEXT_PAGE(init_level4_pgt) -+NEXT_PGD_PAGE(init_level4_pgt) - .fill 512,8,0 -+ .fill KAISER_USER_PGD_FILL,8,0 - #else --NEXT_PAGE(init_level4_pgt) -+NEXT_PGD_PAGE(init_level4_pgt) - .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE - .org init_level4_pgt + L4_PAGE_OFFSET*8, 0 - .quad level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE - .org init_level4_pgt + L4_START_KERNEL*8, 0 - /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */ - .quad level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE -+ .fill KAISER_USER_PGD_FILL,8,0 - - NEXT_PAGE(level3_ident_pgt) - .quad level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE -@@ -480,6 +504,7 @@ NEXT_PAGE(level2_ident_pgt) - */ - PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD) - #endif -+ .fill KAISER_USER_PGD_FILL,8,0 - - NEXT_PAGE(level3_kernel_pgt) - .fill L3_START_KERNEL,8,0 -diff --git a/arch/x86/kernel/irqinit.c b/arch/x86/kernel/irqinit.c -index 1423ab1b0312..f480b38a03c3 100644 ---- a/arch/x86/kernel/irqinit.c -+++ b/arch/x86/kernel/irqinit.c -@@ -51,7 +51,7 @@ static struct irqaction irq2 = { - .flags = IRQF_NO_THREAD, - }; - --DEFINE_PER_CPU(vector_irq_t, vector_irq) = { -+DEFINE_PER_CPU_USER_MAPPED(vector_irq_t, vector_irq) = { - [0 ... NR_VECTORS - 1] = VECTOR_UNUSED, - }; - -diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c -index 2bd81e302427..ec1b06dc82d2 100644 ---- a/arch/x86/kernel/kvmclock.c -+++ b/arch/x86/kernel/kvmclock.c -@@ -45,6 +45,11 @@ early_param("no-kvmclock", parse_no_kvmclock); - static struct pvclock_vsyscall_time_info *hv_clock; - static struct pvclock_wall_clock wall_clock; - -+struct pvclock_vsyscall_time_info *pvclock_pvti_cpu0_va(void) -+{ -+ return hv_clock; -+} -+ - /* - * The wallclock is the time of day when we booted. Since then, some time may - * have elapsed since the hypervisor wrote the data. So we try to account for -diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c -index d6279593bcdd..bc429365b72a 100644 ---- a/arch/x86/kernel/ldt.c -+++ b/arch/x86/kernel/ldt.c -@@ -16,6 +16,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -34,11 +35,21 @@ static void flush_ldt(void *current_mm) - set_ldt(pc->ldt->entries, pc->ldt->size); - } - -+static void __free_ldt_struct(struct ldt_struct *ldt) -+{ -+ if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE) -+ vfree(ldt->entries); -+ else -+ free_page((unsigned long)ldt->entries); -+ kfree(ldt); -+} -+ - /* The caller must call finalize_ldt_struct on the result. LDT starts zeroed. */ - static struct ldt_struct *alloc_ldt_struct(int size) - { - struct ldt_struct *new_ldt; - int alloc_size; -+ int ret; - - if (size > LDT_ENTRIES) - return NULL; -@@ -66,7 +77,13 @@ static struct ldt_struct *alloc_ldt_struct(int size) - return NULL; - } - -+ ret = kaiser_add_mapping((unsigned long)new_ldt->entries, alloc_size, -+ __PAGE_KERNEL); - new_ldt->size = size; -+ if (ret) { -+ __free_ldt_struct(new_ldt); -+ return NULL; -+ } - return new_ldt; - } - -@@ -92,12 +109,10 @@ static void free_ldt_struct(struct ldt_struct *ldt) - if (likely(!ldt)) - return; - -+ kaiser_remove_mapping((unsigned long)ldt->entries, -+ ldt->size * LDT_ENTRY_SIZE); - paravirt_free_ldt(ldt->entries, ldt->size); -- if (ldt->size * LDT_ENTRY_SIZE > PAGE_SIZE) -- vfree(ldt->entries); -- else -- free_page((unsigned long)ldt->entries); -- kfree(ldt); -+ __free_ldt_struct(ldt); - } - - /* -diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c -index 8aa05583bc42..0677bf8d3a42 100644 ---- a/arch/x86/kernel/paravirt_patch_64.c -+++ b/arch/x86/kernel/paravirt_patch_64.c -@@ -9,7 +9,6 @@ DEF_NATIVE(pv_irq_ops, save_fl, "pushfq; popq %rax"); - DEF_NATIVE(pv_mmu_ops, read_cr2, "movq %cr2, %rax"); - DEF_NATIVE(pv_mmu_ops, read_cr3, "movq %cr3, %rax"); - DEF_NATIVE(pv_mmu_ops, write_cr3, "movq %rdi, %cr3"); --DEF_NATIVE(pv_mmu_ops, flush_tlb_single, "invlpg (%rdi)"); - DEF_NATIVE(pv_cpu_ops, clts, "clts"); - DEF_NATIVE(pv_cpu_ops, wbinvd, "wbinvd"); - -@@ -62,7 +61,6 @@ unsigned native_patch(u8 type, u16 clobbers, void *ibuf, - PATCH_SITE(pv_mmu_ops, read_cr3); - PATCH_SITE(pv_mmu_ops, write_cr3); - PATCH_SITE(pv_cpu_ops, clts); -- PATCH_SITE(pv_mmu_ops, flush_tlb_single); - PATCH_SITE(pv_cpu_ops, wbinvd); - #if defined(CONFIG_PARAVIRT_SPINLOCKS) && defined(CONFIG_QUEUED_SPINLOCKS) - case PARAVIRT_PATCH(pv_lock_ops.queued_spin_unlock): -diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c -index 9f7c21c22477..7c5c5dc90ffa 100644 ---- a/arch/x86/kernel/process.c -+++ b/arch/x86/kernel/process.c -@@ -39,7 +39,7 @@ - * section. Since TSS's are completely CPU-local, we want them - * on exact cacheline boundaries, to eliminate cacheline ping-pong. - */ --__visible DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, cpu_tss) = { -+__visible DEFINE_PER_CPU_SHARED_ALIGNED_USER_MAPPED(struct tss_struct, cpu_tss) = { - .x86_tss = { - .sp0 = TOP_OF_INIT_STACK, - #ifdef CONFIG_X86_32 -diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index e67b834279b2..bbaae4cf9e8e 100644 ---- a/arch/x86/kernel/setup.c -+++ b/arch/x86/kernel/setup.c -@@ -112,6 +112,7 @@ - #include - #include - #include -+#include - - /* - * max_low_pfn_mapped: highest direct mapped pfn under 4GB -@@ -1016,6 +1017,12 @@ void __init setup_arch(char **cmdline_p) - */ - init_hypervisor_platform(); - -+ /* -+ * This needs to happen right after XENPV is set on xen and -+ * kaiser_enabled is checked below in cleanup_highmap(). -+ */ -+ kaiser_check_boottime_disable(); -+ - x86_init.resources.probe_roms(); - - /* after parse_early_param, so could debug it */ -diff --git a/arch/x86/kernel/tracepoint.c b/arch/x86/kernel/tracepoint.c -index 1c113db9ed57..2bb5ee464df3 100644 ---- a/arch/x86/kernel/tracepoint.c -+++ b/arch/x86/kernel/tracepoint.c -@@ -9,10 +9,12 @@ - #include - - atomic_t trace_idt_ctr = ATOMIC_INIT(0); -+__aligned(PAGE_SIZE) - struct desc_ptr trace_idt_descr = { NR_VECTORS * 16 - 1, - (unsigned long) trace_idt_table }; - - /* No need to be aligned, but done to keep all IDTs defined the same way. */ -+__aligned(PAGE_SIZE) - gate_desc trace_idt_table[NR_VECTORS] __page_aligned_bss; - - static int trace_irq_vector_refcount; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 796f1ec67469..ccf17dbfea09 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -759,7 +759,8 @@ int kvm_set_cr4(struct kvm_vcpu *vcpu, unsigned long cr4) - return 1; - - /* PCID can not be enabled when cr3[11:0]!=000H or EFER.LMA=0 */ -- if ((kvm_read_cr3(vcpu) & X86_CR3_PCID_MASK) || !is_long_mode(vcpu)) -+ if ((kvm_read_cr3(vcpu) & X86_CR3_PCID_ASID_MASK) || -+ !is_long_mode(vcpu)) - return 1; - } - -diff --git a/arch/x86/lib/cmdline.c b/arch/x86/lib/cmdline.c -index 422db000d727..a744506856b1 100644 ---- a/arch/x86/lib/cmdline.c -+++ b/arch/x86/lib/cmdline.c -@@ -82,3 +82,108 @@ int cmdline_find_option_bool(const char *cmdline, const char *option) - - return 0; /* Buffer overrun */ - } -+ -+/* -+ * Find a non-boolean option (i.e. option=argument). In accordance with -+ * standard Linux practice, if this option is repeated, this returns the -+ * last instance on the command line. -+ * -+ * @cmdline: the cmdline string -+ * @max_cmdline_size: the maximum size of cmdline -+ * @option: option string to look for -+ * @buffer: memory buffer to return the option argument -+ * @bufsize: size of the supplied memory buffer -+ * -+ * Returns the length of the argument (regardless of if it was -+ * truncated to fit in the buffer), or -1 on not found. -+ */ -+static int -+__cmdline_find_option(const char *cmdline, int max_cmdline_size, -+ const char *option, char *buffer, int bufsize) -+{ -+ char c; -+ int pos = 0, len = -1; -+ const char *opptr = NULL; -+ char *bufptr = buffer; -+ enum { -+ st_wordstart = 0, /* Start of word/after whitespace */ -+ st_wordcmp, /* Comparing this word */ -+ st_wordskip, /* Miscompare, skip */ -+ st_bufcpy, /* Copying this to buffer */ -+ } state = st_wordstart; -+ -+ if (!cmdline) -+ return -1; /* No command line */ -+ -+ /* -+ * This 'pos' check ensures we do not overrun -+ * a non-NULL-terminated 'cmdline' -+ */ -+ while (pos++ < max_cmdline_size) { -+ c = *(char *)cmdline++; -+ if (!c) -+ break; -+ -+ switch (state) { -+ case st_wordstart: -+ if (myisspace(c)) -+ break; -+ -+ state = st_wordcmp; -+ opptr = option; -+ /* fall through */ -+ -+ case st_wordcmp: -+ if ((c == '=') && !*opptr) { -+ /* -+ * We matched all the way to the end of the -+ * option we were looking for, prepare to -+ * copy the argument. -+ */ -+ len = 0; -+ bufptr = buffer; -+ state = st_bufcpy; -+ break; -+ } else if (c == *opptr++) { -+ /* -+ * We are currently matching, so continue -+ * to the next character on the cmdline. -+ */ -+ break; -+ } -+ state = st_wordskip; -+ /* fall through */ -+ -+ case st_wordskip: -+ if (myisspace(c)) -+ state = st_wordstart; -+ break; -+ -+ case st_bufcpy: -+ if (myisspace(c)) { -+ state = st_wordstart; -+ } else { -+ /* -+ * Increment len, but don't overrun the -+ * supplied buffer and leave room for the -+ * NULL terminator. -+ */ -+ if (++len < bufsize) -+ *bufptr++ = c; -+ } -+ break; -+ } -+ } -+ -+ if (bufsize) -+ *bufptr = '\0'; -+ -+ return len; -+} -+ -+int cmdline_find_option(const char *cmdline, const char *option, char *buffer, -+ int bufsize) -+{ -+ return __cmdline_find_option(cmdline, COMMAND_LINE_SIZE, option, -+ buffer, bufsize); -+} -diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile -index 1ae7c141f778..61e6cead9c4a 100644 ---- a/arch/x86/mm/Makefile -+++ b/arch/x86/mm/Makefile -@@ -32,3 +32,4 @@ obj-$(CONFIG_ACPI_NUMA) += srat.o - obj-$(CONFIG_NUMA_EMU) += numa_emulation.o - - obj-$(CONFIG_X86_INTEL_MPX) += mpx.o -+obj-$(CONFIG_PAGE_TABLE_ISOLATION) += kaiser.o -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index ed4b372860e4..2bd45ae91eb3 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -165,7 +165,7 @@ static void __init probe_page_size_mask(void) - cr4_set_bits_and_update_boot(X86_CR4_PSE); - - /* Enable PGE if available */ -- if (cpu_has_pge) { -+ if (cpu_has_pge && !kaiser_enabled) { - cr4_set_bits_and_update_boot(X86_CR4_PGE); - __supported_pte_mask |= _PAGE_GLOBAL; - } else -diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index ec081fe0ce2c..d76ec9348cff 100644 ---- a/arch/x86/mm/init_64.c -+++ b/arch/x86/mm/init_64.c -@@ -395,6 +395,16 @@ void __init cleanup_highmap(void) - continue; - if (vaddr < (unsigned long) _text || vaddr > end) - set_pmd(pmd, __pmd(0)); -+ else if (kaiser_enabled) { -+ /* -+ * level2_kernel_pgt is initialized with _PAGE_GLOBAL: -+ * clear that now. This is not important, so long as -+ * CR4.PGE remains clear, but it removes an anomaly. -+ * Physical mapping setup below avoids _PAGE_GLOBAL -+ * by use of massage_pgprot() inside pfn_pte() etc. -+ */ -+ set_pmd(pmd, pmd_clear_flags(*pmd, _PAGE_GLOBAL)); -+ } - } - } - -diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c -new file mode 100644 -index 000000000000..b0b3a69f1c7f ---- /dev/null -+++ b/arch/x86/mm/kaiser.c -@@ -0,0 +1,456 @@ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#undef pr_fmt -+#define pr_fmt(fmt) "Kernel/User page tables isolation: " fmt -+ -+#include -+#include /* to verify its kaiser declarations */ -+#include -+#include -+#include -+#include -+ -+int kaiser_enabled __read_mostly = 1; -+EXPORT_SYMBOL(kaiser_enabled); /* for inlined TLB flush functions */ -+ -+__visible -+DEFINE_PER_CPU_USER_MAPPED(unsigned long, unsafe_stack_register_backup); -+ -+/* -+ * These can have bit 63 set, so we can not just use a plain "or" -+ * instruction to get their value or'd into CR3. It would take -+ * another register. So, we use a memory reference to these instead. -+ * -+ * This is also handy because systems that do not support PCIDs -+ * just end up or'ing a 0 into their CR3, which does no harm. -+ */ -+DEFINE_PER_CPU(unsigned long, x86_cr3_pcid_user); -+ -+/* -+ * At runtime, the only things we map are some things for CPU -+ * hotplug, and stacks for new processes. No two CPUs will ever -+ * be populating the same addresses, so we only need to ensure -+ * that we protect between two CPUs trying to allocate and -+ * populate the same page table page. -+ * -+ * Only take this lock when doing a set_p[4um]d(), but it is not -+ * needed for doing a set_pte(). We assume that only the *owner* -+ * of a given allocation will be doing this for _their_ -+ * allocation. -+ * -+ * This ensures that once a system has been running for a while -+ * and there have been stacks all over and these page tables -+ * are fully populated, there will be no further acquisitions of -+ * this lock. -+ */ -+static DEFINE_SPINLOCK(shadow_table_allocation_lock); -+ -+/* -+ * Returns -1 on error. -+ */ -+static inline unsigned long get_pa_from_mapping(unsigned long vaddr) -+{ -+ pgd_t *pgd; -+ pud_t *pud; -+ pmd_t *pmd; -+ pte_t *pte; -+ -+ pgd = pgd_offset_k(vaddr); -+ /* -+ * We made all the kernel PGDs present in kaiser_init(). -+ * We expect them to stay that way. -+ */ -+ BUG_ON(pgd_none(*pgd)); -+ /* -+ * PGDs are either 512GB or 128TB on all x86_64 -+ * configurations. We don't handle these. -+ */ -+ BUG_ON(pgd_large(*pgd)); -+ -+ pud = pud_offset(pgd, vaddr); -+ if (pud_none(*pud)) { -+ WARN_ON_ONCE(1); -+ return -1; -+ } -+ -+ if (pud_large(*pud)) -+ return (pud_pfn(*pud) << PAGE_SHIFT) | (vaddr & ~PUD_PAGE_MASK); -+ -+ pmd = pmd_offset(pud, vaddr); -+ if (pmd_none(*pmd)) { -+ WARN_ON_ONCE(1); -+ return -1; -+ } -+ -+ if (pmd_large(*pmd)) -+ return (pmd_pfn(*pmd) << PAGE_SHIFT) | (vaddr & ~PMD_PAGE_MASK); -+ -+ pte = pte_offset_kernel(pmd, vaddr); -+ if (pte_none(*pte)) { -+ WARN_ON_ONCE(1); -+ return -1; -+ } -+ -+ return (pte_pfn(*pte) << PAGE_SHIFT) | (vaddr & ~PAGE_MASK); -+} -+ -+/* -+ * This is a relatively normal page table walk, except that it -+ * also tries to allocate page tables pages along the way. -+ * -+ * Returns a pointer to a PTE on success, or NULL on failure. -+ */ -+static pte_t *kaiser_pagetable_walk(unsigned long address) -+{ -+ pmd_t *pmd; -+ pud_t *pud; -+ pgd_t *pgd = native_get_shadow_pgd(pgd_offset_k(address)); -+ gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); -+ -+ if (pgd_none(*pgd)) { -+ WARN_ONCE(1, "All shadow pgds should have been populated"); -+ return NULL; -+ } -+ BUILD_BUG_ON(pgd_large(*pgd) != 0); -+ -+ pud = pud_offset(pgd, address); -+ /* The shadow page tables do not use large mappings: */ -+ if (pud_large(*pud)) { -+ WARN_ON(1); -+ return NULL; -+ } -+ if (pud_none(*pud)) { -+ unsigned long new_pmd_page = __get_free_page(gfp); -+ if (!new_pmd_page) -+ return NULL; -+ spin_lock(&shadow_table_allocation_lock); -+ if (pud_none(*pud)) { -+ set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); -+ __inc_zone_page_state(virt_to_page((void *) -+ new_pmd_page), NR_KAISERTABLE); -+ } else -+ free_page(new_pmd_page); -+ spin_unlock(&shadow_table_allocation_lock); -+ } -+ -+ pmd = pmd_offset(pud, address); -+ /* The shadow page tables do not use large mappings: */ -+ if (pmd_large(*pmd)) { -+ WARN_ON(1); -+ return NULL; -+ } -+ if (pmd_none(*pmd)) { -+ unsigned long new_pte_page = __get_free_page(gfp); -+ if (!new_pte_page) -+ return NULL; -+ spin_lock(&shadow_table_allocation_lock); -+ if (pmd_none(*pmd)) { -+ set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); -+ __inc_zone_page_state(virt_to_page((void *) -+ new_pte_page), NR_KAISERTABLE); -+ } else -+ free_page(new_pte_page); -+ spin_unlock(&shadow_table_allocation_lock); -+ } -+ -+ return pte_offset_kernel(pmd, address); -+} -+ -+static int kaiser_add_user_map(const void *__start_addr, unsigned long size, -+ unsigned long flags) -+{ -+ int ret = 0; -+ pte_t *pte; -+ unsigned long start_addr = (unsigned long )__start_addr; -+ unsigned long address = start_addr & PAGE_MASK; -+ unsigned long end_addr = PAGE_ALIGN(start_addr + size); -+ unsigned long target_address; -+ -+ /* -+ * It is convenient for callers to pass in __PAGE_KERNEL etc, -+ * and there is no actual harm from setting _PAGE_GLOBAL, so -+ * long as CR4.PGE is not set. But it is nonetheless troubling -+ * to see Kaiser itself setting _PAGE_GLOBAL (now that "nokaiser" -+ * requires that not to be #defined to 0): so mask it off here. -+ */ -+ flags &= ~_PAGE_GLOBAL; -+ -+ for (; address < end_addr; address += PAGE_SIZE) { -+ target_address = get_pa_from_mapping(address); -+ if (target_address == -1) { -+ ret = -EIO; -+ break; -+ } -+ pte = kaiser_pagetable_walk(address); -+ if (!pte) { -+ ret = -ENOMEM; -+ break; -+ } -+ if (pte_none(*pte)) { -+ set_pte(pte, __pte(flags | target_address)); -+ } else { -+ pte_t tmp; -+ set_pte(&tmp, __pte(flags | target_address)); -+ WARN_ON_ONCE(!pte_same(*pte, tmp)); -+ } -+ } -+ return ret; -+} -+ -+static int kaiser_add_user_map_ptrs(const void *start, const void *end, unsigned long flags) -+{ -+ unsigned long size = end - start; -+ -+ return kaiser_add_user_map(start, size, flags); -+} -+ -+/* -+ * Ensure that the top level of the (shadow) page tables are -+ * entirely populated. This ensures that all processes that get -+ * forked have the same entries. This way, we do not have to -+ * ever go set up new entries in older processes. -+ * -+ * Note: we never free these, so there are no updates to them -+ * after this. -+ */ -+static void __init kaiser_init_all_pgds(void) -+{ -+ pgd_t *pgd; -+ int i = 0; -+ -+ pgd = native_get_shadow_pgd(pgd_offset_k((unsigned long )0)); -+ for (i = PTRS_PER_PGD / 2; i < PTRS_PER_PGD; i++) { -+ pgd_t new_pgd; -+ pud_t *pud = pud_alloc_one(&init_mm, -+ PAGE_OFFSET + i * PGDIR_SIZE); -+ if (!pud) { -+ WARN_ON(1); -+ break; -+ } -+ inc_zone_page_state(virt_to_page(pud), NR_KAISERTABLE); -+ new_pgd = __pgd(_KERNPG_TABLE |__pa(pud)); -+ /* -+ * Make sure not to stomp on some other pgd entry. -+ */ -+ if (!pgd_none(pgd[i])) { -+ WARN_ON(1); -+ continue; -+ } -+ set_pgd(pgd + i, new_pgd); -+ } -+} -+ -+#define kaiser_add_user_map_early(start, size, flags) do { \ -+ int __ret = kaiser_add_user_map(start, size, flags); \ -+ WARN_ON(__ret); \ -+} while (0) -+ -+#define kaiser_add_user_map_ptrs_early(start, end, flags) do { \ -+ int __ret = kaiser_add_user_map_ptrs(start, end, flags); \ -+ WARN_ON(__ret); \ -+} while (0) -+ -+void __init kaiser_check_boottime_disable(void) -+{ -+ bool enable = true; -+ char arg[5]; -+ int ret; -+ -+ if (boot_cpu_has(X86_FEATURE_XENPV)) -+ goto silent_disable; -+ -+ ret = cmdline_find_option(boot_command_line, "pti", arg, sizeof(arg)); -+ if (ret > 0) { -+ if (!strncmp(arg, "on", 2)) -+ goto enable; -+ -+ if (!strncmp(arg, "off", 3)) -+ goto disable; -+ -+ if (!strncmp(arg, "auto", 4)) -+ goto skip; -+ } -+ -+ if (cmdline_find_option_bool(boot_command_line, "nopti")) -+ goto disable; -+ -+skip: -+ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) -+ goto disable; -+ -+enable: -+ if (enable) -+ setup_force_cpu_cap(X86_FEATURE_KAISER); -+ -+ return; -+ -+disable: -+ pr_info("disabled\n"); -+ -+silent_disable: -+ kaiser_enabled = 0; -+ setup_clear_cpu_cap(X86_FEATURE_KAISER); -+} -+ -+/* -+ * If anything in here fails, we will likely die on one of the -+ * first kernel->user transitions and init will die. But, we -+ * will have most of the kernel up by then and should be able to -+ * get a clean warning out of it. If we BUG_ON() here, we run -+ * the risk of being before we have good console output. -+ */ -+void __init kaiser_init(void) -+{ -+ int cpu; -+ -+ if (!kaiser_enabled) -+ return; -+ -+ kaiser_init_all_pgds(); -+ -+ for_each_possible_cpu(cpu) { -+ void *percpu_vaddr = __per_cpu_user_mapped_start + -+ per_cpu_offset(cpu); -+ unsigned long percpu_sz = __per_cpu_user_mapped_end - -+ __per_cpu_user_mapped_start; -+ kaiser_add_user_map_early(percpu_vaddr, percpu_sz, -+ __PAGE_KERNEL); -+ } -+ -+ /* -+ * Map the entry/exit text section, which is needed at -+ * switches from user to and from kernel. -+ */ -+ kaiser_add_user_map_ptrs_early(__entry_text_start, __entry_text_end, -+ __PAGE_KERNEL_RX); -+ -+#if defined(CONFIG_FUNCTION_GRAPH_TRACER) || defined(CONFIG_KASAN) -+ kaiser_add_user_map_ptrs_early(__irqentry_text_start, -+ __irqentry_text_end, -+ __PAGE_KERNEL_RX); -+#endif -+ kaiser_add_user_map_early((void *)idt_descr.address, -+ sizeof(gate_desc) * NR_VECTORS, -+ __PAGE_KERNEL_RO); -+#ifdef CONFIG_TRACING -+ kaiser_add_user_map_early(&trace_idt_descr, -+ sizeof(trace_idt_descr), -+ __PAGE_KERNEL); -+ kaiser_add_user_map_early(&trace_idt_table, -+ sizeof(gate_desc) * NR_VECTORS, -+ __PAGE_KERNEL); -+#endif -+ kaiser_add_user_map_early(&debug_idt_descr, sizeof(debug_idt_descr), -+ __PAGE_KERNEL); -+ kaiser_add_user_map_early(&debug_idt_table, -+ sizeof(gate_desc) * NR_VECTORS, -+ __PAGE_KERNEL); -+ -+ pr_info("enabled\n"); -+} -+ -+/* Add a mapping to the shadow mapping, and synchronize the mappings */ -+int kaiser_add_mapping(unsigned long addr, unsigned long size, unsigned long flags) -+{ -+ if (!kaiser_enabled) -+ return 0; -+ return kaiser_add_user_map((const void *)addr, size, flags); -+} -+ -+void kaiser_remove_mapping(unsigned long start, unsigned long size) -+{ -+ extern void unmap_pud_range_nofree(pgd_t *pgd, -+ unsigned long start, unsigned long end); -+ unsigned long end = start + size; -+ unsigned long addr, next; -+ pgd_t *pgd; -+ -+ if (!kaiser_enabled) -+ return; -+ pgd = native_get_shadow_pgd(pgd_offset_k(start)); -+ for (addr = start; addr < end; pgd++, addr = next) { -+ next = pgd_addr_end(addr, end); -+ unmap_pud_range_nofree(pgd, addr, next); -+ } -+} -+ -+/* -+ * Page table pages are page-aligned. The lower half of the top -+ * level is used for userspace and the top half for the kernel. -+ * This returns true for user pages that need to get copied into -+ * both the user and kernel copies of the page tables, and false -+ * for kernel pages that should only be in the kernel copy. -+ */ -+static inline bool is_userspace_pgd(pgd_t *pgdp) -+{ -+ return ((unsigned long)pgdp % PAGE_SIZE) < (PAGE_SIZE / 2); -+} -+ -+pgd_t kaiser_set_shadow_pgd(pgd_t *pgdp, pgd_t pgd) -+{ -+ if (!kaiser_enabled) -+ return pgd; -+ /* -+ * Do we need to also populate the shadow pgd? Check _PAGE_USER to -+ * skip cases like kexec and EFI which make temporary low mappings. -+ */ -+ if (pgd.pgd & _PAGE_USER) { -+ if (is_userspace_pgd(pgdp)) { -+ native_get_shadow_pgd(pgdp)->pgd = pgd.pgd; -+ /* -+ * Even if the entry is *mapping* userspace, ensure -+ * that userspace can not use it. This way, if we -+ * get out to userspace running on the kernel CR3, -+ * userspace will crash instead of running. -+ */ -+ if (__supported_pte_mask & _PAGE_NX) -+ pgd.pgd |= _PAGE_NX; -+ } -+ } else if (!pgd.pgd) { -+ /* -+ * pgd_clear() cannot check _PAGE_USER, and is even used to -+ * clear corrupted pgd entries: so just rely on cases like -+ * kexec and EFI never to be using pgd_clear(). -+ */ -+ if (!WARN_ON_ONCE((unsigned long)pgdp & PAGE_SIZE) && -+ is_userspace_pgd(pgdp)) -+ native_get_shadow_pgd(pgdp)->pgd = pgd.pgd; -+ } -+ return pgd; -+} -+ -+void kaiser_setup_pcid(void) -+{ -+ unsigned long user_cr3 = KAISER_SHADOW_PGD_OFFSET; -+ -+ if (this_cpu_has(X86_FEATURE_PCID)) -+ user_cr3 |= X86_CR3_PCID_USER_NOFLUSH; -+ /* -+ * These variables are used by the entry/exit -+ * code to change PCID and pgd and TLB flushing. -+ */ -+ this_cpu_write(x86_cr3_pcid_user, user_cr3); -+} -+ -+/* -+ * Make a note that this cpu will need to flush USER tlb on return to user. -+ * If cpu does not have PCID, then the NOFLUSH bit will never have been set. -+ */ -+void kaiser_flush_tlb_on_return_to_user(void) -+{ -+ if (this_cpu_has(X86_FEATURE_PCID)) -+ this_cpu_write(x86_cr3_pcid_user, -+ X86_CR3_PCID_USER_FLUSH | KAISER_SHADOW_PGD_OFFSET); -+} -+EXPORT_SYMBOL(kaiser_flush_tlb_on_return_to_user); -diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c -index 4e5ac46adc9d..81ec7c02f968 100644 ---- a/arch/x86/mm/kasan_init_64.c -+++ b/arch/x86/mm/kasan_init_64.c -@@ -121,11 +121,16 @@ void __init kasan_init(void) - kasan_populate_zero_shadow(kasan_mem_to_shadow((void *)MODULES_END), - (void *)KASAN_SHADOW_END); - -- memset(kasan_zero_page, 0, PAGE_SIZE); -- - load_cr3(init_level4_pgt); - __flush_tlb_all(); -- init_task.kasan_depth = 0; - -+ /* -+ * kasan_zero_page has been used as early shadow memory, thus it may -+ * contain some garbage. Now we can clear it, since after the TLB flush -+ * no one should write to it. -+ */ -+ memset(kasan_zero_page, 0, PAGE_SIZE); -+ -+ init_task.kasan_depth = 0; - pr_info("KernelAddressSanitizer initialized\n"); - } -diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c -index b599a780a5a9..79377e2a7bcd 100644 ---- a/arch/x86/mm/pageattr.c -+++ b/arch/x86/mm/pageattr.c -@@ -52,6 +52,7 @@ static DEFINE_SPINLOCK(cpa_lock); - #define CPA_FLUSHTLB 1 - #define CPA_ARRAY 2 - #define CPA_PAGES_ARRAY 4 -+#define CPA_FREE_PAGETABLES 8 - - #ifdef CONFIG_PROC_FS - static unsigned long direct_pages_count[PG_LEVEL_NUM]; -@@ -723,10 +724,13 @@ static int split_large_page(struct cpa_data *cpa, pte_t *kpte, - return 0; - } - --static bool try_to_free_pte_page(pte_t *pte) -+static bool try_to_free_pte_page(struct cpa_data *cpa, pte_t *pte) - { - int i; - -+ if (!(cpa->flags & CPA_FREE_PAGETABLES)) -+ return false; -+ - for (i = 0; i < PTRS_PER_PTE; i++) - if (!pte_none(pte[i])) - return false; -@@ -735,10 +739,13 @@ static bool try_to_free_pte_page(pte_t *pte) - return true; - } - --static bool try_to_free_pmd_page(pmd_t *pmd) -+static bool try_to_free_pmd_page(struct cpa_data *cpa, pmd_t *pmd) - { - int i; - -+ if (!(cpa->flags & CPA_FREE_PAGETABLES)) -+ return false; -+ - for (i = 0; i < PTRS_PER_PMD; i++) - if (!pmd_none(pmd[i])) - return false; -@@ -759,7 +766,9 @@ static bool try_to_free_pud_page(pud_t *pud) - return true; - } - --static bool unmap_pte_range(pmd_t *pmd, unsigned long start, unsigned long end) -+static bool unmap_pte_range(struct cpa_data *cpa, pmd_t *pmd, -+ unsigned long start, -+ unsigned long end) - { - pte_t *pte = pte_offset_kernel(pmd, start); - -@@ -770,22 +779,23 @@ static bool unmap_pte_range(pmd_t *pmd, unsigned long start, unsigned long end) - pte++; - } - -- if (try_to_free_pte_page((pte_t *)pmd_page_vaddr(*pmd))) { -+ if (try_to_free_pte_page(cpa, (pte_t *)pmd_page_vaddr(*pmd))) { - pmd_clear(pmd); - return true; - } - return false; - } - --static void __unmap_pmd_range(pud_t *pud, pmd_t *pmd, -+static void __unmap_pmd_range(struct cpa_data *cpa, pud_t *pud, pmd_t *pmd, - unsigned long start, unsigned long end) - { -- if (unmap_pte_range(pmd, start, end)) -- if (try_to_free_pmd_page((pmd_t *)pud_page_vaddr(*pud))) -+ if (unmap_pte_range(cpa, pmd, start, end)) -+ if (try_to_free_pmd_page(cpa, (pmd_t *)pud_page_vaddr(*pud))) - pud_clear(pud); - } - --static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end) -+static void unmap_pmd_range(struct cpa_data *cpa, pud_t *pud, -+ unsigned long start, unsigned long end) - { - pmd_t *pmd = pmd_offset(pud, start); - -@@ -796,7 +806,7 @@ static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end) - unsigned long next_page = (start + PMD_SIZE) & PMD_MASK; - unsigned long pre_end = min_t(unsigned long, end, next_page); - -- __unmap_pmd_range(pud, pmd, start, pre_end); -+ __unmap_pmd_range(cpa, pud, pmd, start, pre_end); - - start = pre_end; - pmd++; -@@ -809,7 +819,8 @@ static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end) - if (pmd_large(*pmd)) - pmd_clear(pmd); - else -- __unmap_pmd_range(pud, pmd, start, start + PMD_SIZE); -+ __unmap_pmd_range(cpa, pud, pmd, -+ start, start + PMD_SIZE); - - start += PMD_SIZE; - pmd++; -@@ -819,17 +830,19 @@ static void unmap_pmd_range(pud_t *pud, unsigned long start, unsigned long end) - * 4K leftovers? - */ - if (start < end) -- return __unmap_pmd_range(pud, pmd, start, end); -+ return __unmap_pmd_range(cpa, pud, pmd, start, end); - - /* - * Try again to free the PMD page if haven't succeeded above. - */ - if (!pud_none(*pud)) -- if (try_to_free_pmd_page((pmd_t *)pud_page_vaddr(*pud))) -+ if (try_to_free_pmd_page(cpa, (pmd_t *)pud_page_vaddr(*pud))) - pud_clear(pud); - } - --static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) -+static void __unmap_pud_range(struct cpa_data *cpa, pgd_t *pgd, -+ unsigned long start, -+ unsigned long end) - { - pud_t *pud = pud_offset(pgd, start); - -@@ -840,7 +853,7 @@ static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) - unsigned long next_page = (start + PUD_SIZE) & PUD_MASK; - unsigned long pre_end = min_t(unsigned long, end, next_page); - -- unmap_pmd_range(pud, start, pre_end); -+ unmap_pmd_range(cpa, pud, start, pre_end); - - start = pre_end; - pud++; -@@ -854,7 +867,7 @@ static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) - if (pud_large(*pud)) - pud_clear(pud); - else -- unmap_pmd_range(pud, start, start + PUD_SIZE); -+ unmap_pmd_range(cpa, pud, start, start + PUD_SIZE); - - start += PUD_SIZE; - pud++; -@@ -864,7 +877,7 @@ static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) - * 2M leftovers? - */ - if (start < end) -- unmap_pmd_range(pud, start, end); -+ unmap_pmd_range(cpa, pud, start, end); - - /* - * No need to try to free the PUD page because we'll free it in -@@ -872,6 +885,24 @@ static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) - */ - } - -+static void unmap_pud_range(pgd_t *pgd, unsigned long start, unsigned long end) -+{ -+ struct cpa_data cpa = { -+ .flags = CPA_FREE_PAGETABLES, -+ }; -+ -+ __unmap_pud_range(&cpa, pgd, start, end); -+} -+ -+void unmap_pud_range_nofree(pgd_t *pgd, unsigned long start, unsigned long end) -+{ -+ struct cpa_data cpa = { -+ .flags = 0, -+ }; -+ -+ __unmap_pud_range(&cpa, pgd, start, end); -+} -+ - static void unmap_pgd_range(pgd_t *root, unsigned long addr, unsigned long end) - { - pgd_t *pgd_entry = root + pgd_index(addr); -diff --git a/arch/x86/mm/pgtable.c b/arch/x86/mm/pgtable.c -index fb0a9dd1d6e4..dbc27a2b4ad5 100644 ---- a/arch/x86/mm/pgtable.c -+++ b/arch/x86/mm/pgtable.c -@@ -6,7 +6,7 @@ - #include - #include - --#define PGALLOC_GFP GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO -+#define PGALLOC_GFP (GFP_KERNEL | __GFP_NOTRACK | __GFP_REPEAT | __GFP_ZERO) - - #ifdef CONFIG_HIGHPTE - #define PGALLOC_USER_GFP __GFP_HIGHMEM -@@ -340,14 +340,24 @@ static inline void _pgd_free(pgd_t *pgd) - kmem_cache_free(pgd_cache, pgd); - } - #else -+ -+/* -+ * Instead of one pgd, Kaiser acquires two pgds. Being order-1, it is -+ * both 8k in size and 8k-aligned. That lets us just flip bit 12 -+ * in a pointer to swap between the two 4k halves. -+ */ -+#define PGD_ALLOCATION_ORDER kaiser_enabled -+ - static inline pgd_t *_pgd_alloc(void) - { -- return (pgd_t *)__get_free_page(PGALLOC_GFP); -+ /* No __GFP_REPEAT: to avoid page allocation stalls in order-1 case */ -+ return (pgd_t *)__get_free_pages(PGALLOC_GFP & ~__GFP_REPEAT, -+ PGD_ALLOCATION_ORDER); - } - - static inline void _pgd_free(pgd_t *pgd) - { -- free_page((unsigned long)pgd); -+ free_pages((unsigned long)pgd, PGD_ALLOCATION_ORDER); - } - #endif /* CONFIG_X86_PAE */ - -diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c -index 7a4cdb632508..7cad01af6dcd 100644 ---- a/arch/x86/mm/tlb.c -+++ b/arch/x86/mm/tlb.c -@@ -6,13 +6,14 @@ - #include - #include - #include -+#include - - #include - #include - #include - #include - #include --#include -+#include - - /* - * TLB flushing, formerly SMP-only -@@ -34,6 +35,36 @@ struct flush_tlb_info { - unsigned long flush_end; - }; - -+static void load_new_mm_cr3(pgd_t *pgdir) -+{ -+ unsigned long new_mm_cr3 = __pa(pgdir); -+ -+ if (kaiser_enabled) { -+ /* -+ * We reuse the same PCID for different tasks, so we must -+ * flush all the entries for the PCID out when we change tasks. -+ * Flush KERN below, flush USER when returning to userspace in -+ * kaiser's SWITCH_USER_CR3 (_SWITCH_TO_USER_CR3) macro. -+ * -+ * invpcid_flush_single_context(X86_CR3_PCID_ASID_USER) could -+ * do it here, but can only be used if X86_FEATURE_INVPCID is -+ * available - and many machines support pcid without invpcid. -+ * -+ * If X86_CR3_PCID_KERN_FLUSH actually added something, then it -+ * would be needed in the write_cr3() below - if PCIDs enabled. -+ */ -+ BUILD_BUG_ON(X86_CR3_PCID_KERN_FLUSH); -+ kaiser_flush_tlb_on_return_to_user(); -+ } -+ -+ /* -+ * Caution: many callers of this function expect -+ * that load_cr3() is serializing and orders TLB -+ * fills with respect to the mm_cpumask writes. -+ */ -+ write_cr3(new_mm_cr3); -+} -+ - /* - * We cannot call mmdrop() because we are in interrupt context, - * instead update mm->cpu_vm_mask. -@@ -45,7 +76,7 @@ void leave_mm(int cpu) - BUG(); - if (cpumask_test_cpu(cpu, mm_cpumask(active_mm))) { - cpumask_clear_cpu(cpu, mm_cpumask(active_mm)); -- load_cr3(swapper_pg_dir); -+ load_new_mm_cr3(swapper_pg_dir); - /* - * This gets called in the idle path where RCU - * functions differently. Tracing normally -@@ -105,7 +136,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - * ordering guarantee we need. - * - */ -- load_cr3(next->pgd); -+ load_new_mm_cr3(next->pgd); - - trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); - -@@ -152,7 +183,7 @@ void switch_mm_irqs_off(struct mm_struct *prev, struct mm_struct *next, - * As above, load_cr3() is serializing and orders TLB - * fills with respect to the mm_cpumask write. - */ -- load_cr3(next->pgd); -+ load_new_mm_cr3(next->pgd); - trace_tlb_flush(TLB_FLUSH_ON_TASK_SWITCH, TLB_FLUSH_ALL); - load_mm_cr4(next); - load_mm_ldt(next); -diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h -index ef2e8c97e183..a461b6604fd9 100644 ---- a/include/asm-generic/vmlinux.lds.h -+++ b/include/asm-generic/vmlinux.lds.h -@@ -725,7 +725,14 @@ - */ - #define PERCPU_INPUT(cacheline) \ - VMLINUX_SYMBOL(__per_cpu_start) = .; \ -+ VMLINUX_SYMBOL(__per_cpu_user_mapped_start) = .; \ - *(.data..percpu..first) \ -+ . = ALIGN(cacheline); \ -+ *(.data..percpu..user_mapped) \ -+ *(.data..percpu..user_mapped..shared_aligned) \ -+ . = ALIGN(PAGE_SIZE); \ -+ *(.data..percpu..user_mapped..page_aligned) \ -+ VMLINUX_SYMBOL(__per_cpu_user_mapped_end) = .; \ - . = ALIGN(PAGE_SIZE); \ - *(.data..percpu..page_aligned) \ - . = ALIGN(cacheline); \ -diff --git a/include/linux/kaiser.h b/include/linux/kaiser.h -new file mode 100644 -index 000000000000..58c55b1589d0 ---- /dev/null -+++ b/include/linux/kaiser.h -@@ -0,0 +1,52 @@ -+#ifndef _LINUX_KAISER_H -+#define _LINUX_KAISER_H -+ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+#include -+ -+static inline int kaiser_map_thread_stack(void *stack) -+{ -+ /* -+ * Map that page of kernel stack on which we enter from user context. -+ */ -+ return kaiser_add_mapping((unsigned long)stack + -+ THREAD_SIZE - PAGE_SIZE, PAGE_SIZE, __PAGE_KERNEL); -+} -+ -+static inline void kaiser_unmap_thread_stack(void *stack) -+{ -+ /* -+ * Note: may be called even when kaiser_map_thread_stack() failed. -+ */ -+ kaiser_remove_mapping((unsigned long)stack + -+ THREAD_SIZE - PAGE_SIZE, PAGE_SIZE); -+} -+#else -+ -+/* -+ * These stubs are used whenever CONFIG_PAGE_TABLE_ISOLATION is off, which -+ * includes architectures that support KAISER, but have it disabled. -+ */ -+ -+static inline void kaiser_init(void) -+{ -+} -+static inline int kaiser_add_mapping(unsigned long addr, -+ unsigned long size, unsigned long flags) -+{ -+ return 0; -+} -+static inline void kaiser_remove_mapping(unsigned long start, -+ unsigned long size) -+{ -+} -+static inline int kaiser_map_thread_stack(void *stack) -+{ -+ return 0; -+} -+static inline void kaiser_unmap_thread_stack(void *stack) -+{ -+} -+ -+#endif /* !CONFIG_PAGE_TABLE_ISOLATION */ -+#endif /* _LINUX_KAISER_H */ -diff --git a/include/linux/mmzone.h b/include/linux/mmzone.h -index ff88d6189411..b93b578cfa42 100644 ---- a/include/linux/mmzone.h -+++ b/include/linux/mmzone.h -@@ -131,8 +131,9 @@ enum zone_stat_item { - NR_SLAB_RECLAIMABLE, - NR_SLAB_UNRECLAIMABLE, - NR_PAGETABLE, /* used for pagetables */ -- NR_KERNEL_STACK, - /* Second 128 byte cacheline */ -+ NR_KERNEL_STACK, -+ NR_KAISERTABLE, - NR_UNSTABLE_NFS, /* NFS unstable pages */ - NR_BOUNCE, - NR_VMSCAN_WRITE, -diff --git a/include/linux/percpu-defs.h b/include/linux/percpu-defs.h -index 8f16299ca068..8902f23bb770 100644 ---- a/include/linux/percpu-defs.h -+++ b/include/linux/percpu-defs.h -@@ -35,6 +35,12 @@ - - #endif - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+#define USER_MAPPED_SECTION "..user_mapped" -+#else -+#define USER_MAPPED_SECTION "" -+#endif -+ - /* - * Base implementations of per-CPU variable declarations and definitions, where - * the section in which the variable is to be placed is provided by the -@@ -115,6 +121,12 @@ - #define DEFINE_PER_CPU(type, name) \ - DEFINE_PER_CPU_SECTION(type, name, "") - -+#define DECLARE_PER_CPU_USER_MAPPED(type, name) \ -+ DECLARE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION) -+ -+#define DEFINE_PER_CPU_USER_MAPPED(type, name) \ -+ DEFINE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION) -+ - /* - * Declaration/definition used for per-CPU variables that must come first in - * the set of variables. -@@ -144,6 +156,14 @@ - DEFINE_PER_CPU_SECTION(type, name, PER_CPU_SHARED_ALIGNED_SECTION) \ - ____cacheline_aligned_in_smp - -+#define DECLARE_PER_CPU_SHARED_ALIGNED_USER_MAPPED(type, name) \ -+ DECLARE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION PER_CPU_SHARED_ALIGNED_SECTION) \ -+ ____cacheline_aligned_in_smp -+ -+#define DEFINE_PER_CPU_SHARED_ALIGNED_USER_MAPPED(type, name) \ -+ DEFINE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION PER_CPU_SHARED_ALIGNED_SECTION) \ -+ ____cacheline_aligned_in_smp -+ - #define DECLARE_PER_CPU_ALIGNED(type, name) \ - DECLARE_PER_CPU_SECTION(type, name, PER_CPU_ALIGNED_SECTION) \ - ____cacheline_aligned -@@ -162,11 +182,21 @@ - #define DEFINE_PER_CPU_PAGE_ALIGNED(type, name) \ - DEFINE_PER_CPU_SECTION(type, name, "..page_aligned") \ - __aligned(PAGE_SIZE) -+/* -+ * Declaration/definition used for per-CPU variables that must be page aligned and need to be mapped in user mode. -+ */ -+#define DECLARE_PER_CPU_PAGE_ALIGNED_USER_MAPPED(type, name) \ -+ DECLARE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION"..page_aligned") \ -+ __aligned(PAGE_SIZE) -+ -+#define DEFINE_PER_CPU_PAGE_ALIGNED_USER_MAPPED(type, name) \ -+ DEFINE_PER_CPU_SECTION(type, name, USER_MAPPED_SECTION"..page_aligned") \ -+ __aligned(PAGE_SIZE) - - /* - * Declaration/definition used for per-CPU variables that must be read mostly. - */ --#define DECLARE_PER_CPU_READ_MOSTLY(type, name) \ -+#define DECLARE_PER_CPU_READ_MOSTLY(type, name) \ - DECLARE_PER_CPU_SECTION(type, name, "..read_mostly") - - #define DEFINE_PER_CPU_READ_MOSTLY(type, name) \ -diff --git a/init/main.c b/init/main.c -index 9e64d7097f1a..49926d95442f 100644 ---- a/init/main.c -+++ b/init/main.c -@@ -81,6 +81,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -492,6 +493,7 @@ static void __init mm_init(void) - pgtable_init(); - vmalloc_init(); - ioremap_huge_init(); -+ kaiser_init(); - } - - asmlinkage __visible void __init start_kernel(void) -diff --git a/kernel/fork.c b/kernel/fork.c -index 68cfda1c1800..ac00f14208b7 100644 ---- a/kernel/fork.c -+++ b/kernel/fork.c -@@ -58,6 +58,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -169,6 +170,7 @@ static struct thread_info *alloc_thread_info_node(struct task_struct *tsk, - - static inline void free_thread_info(struct thread_info *ti) - { -+ kaiser_unmap_thread_stack(ti); - free_kmem_pages((unsigned long)ti, THREAD_SIZE_ORDER); - } - # else -@@ -352,6 +354,10 @@ static struct task_struct *dup_task_struct(struct task_struct *orig, int node) - goto free_ti; - - tsk->stack = ti; -+ -+ err = kaiser_map_thread_stack(tsk->stack); -+ if (err) -+ goto free_ti; - #ifdef CONFIG_SECCOMP - /* - * We must handle setting up seccomp filters once we're under -diff --git a/mm/vmstat.c b/mm/vmstat.c -index c344e3609c53..324b7e90b4c5 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -736,6 +736,7 @@ const char * const vmstat_text[] = { - "nr_slab_unreclaimable", - "nr_page_table_pages", - "nr_kernel_stack", -+ "nr_overhead", - "nr_unstable", - "nr_bounce", - "nr_vmscan_write", -diff --git a/security/Kconfig b/security/Kconfig -index e45237897b43..a3ebb6ee5bd5 100644 ---- a/security/Kconfig -+++ b/security/Kconfig -@@ -31,6 +31,16 @@ config SECURITY - - If you are unsure how to answer this question, answer N. - -+config PAGE_TABLE_ISOLATION -+ bool "Remove the kernel mapping in user mode" -+ default y -+ depends on X86_64 && SMP -+ help -+ This enforces a strict kernel and user space isolation, in order -+ to close hardware side channels on kernel address information. -+ -+ If you are unsure how to answer this question, answer Y. -+ - config SECURITYFS - bool "Enable the securityfs filesystem" - help diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.110-111.patch b/patch/kernel/mvebu64-default/04-patch-4.4.110-111.patch deleted file mode 100644 index 66b7f8e038e9..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.110-111.patch +++ /dev/null @@ -1,772 +0,0 @@ -diff --git a/Makefile b/Makefile -index b028c106535b..4779517d9bf0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 110 -+SUBLEVEL = 111 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/include/asm/uaccess.h b/arch/arc/include/asm/uaccess.h -index d4d8df706efa..57387b567f34 100644 ---- a/arch/arc/include/asm/uaccess.h -+++ b/arch/arc/include/asm/uaccess.h -@@ -673,6 +673,7 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) - return 0; - - __asm__ __volatile__( -+ " mov lp_count, %5 \n" - " lp 3f \n" - "1: ldb.ab %3, [%2, 1] \n" - " breq.d %3, 0, 3f \n" -@@ -689,8 +690,8 @@ __arc_strncpy_from_user(char *dst, const char __user *src, long count) - " .word 1b, 4b \n" - " .previous \n" - : "+r"(res), "+r"(dst), "+r"(src), "=r"(val) -- : "g"(-EFAULT), "l"(count) -- : "memory"); -+ : "g"(-EFAULT), "r"(count) -+ : "lp_count", "lp_start", "lp_end", "memory"); - - return res; - } -diff --git a/arch/parisc/include/asm/ldcw.h b/arch/parisc/include/asm/ldcw.h -index 8121aa6db2ff..51bb6b8eade6 100644 ---- a/arch/parisc/include/asm/ldcw.h -+++ b/arch/parisc/include/asm/ldcw.h -@@ -11,6 +11,7 @@ - for the semaphore. */ - - #define __PA_LDCW_ALIGNMENT 16 -+#define __PA_LDCW_ALIGN_ORDER 4 - #define __ldcw_align(a) ({ \ - unsigned long __ret = (unsigned long) &(a)->lock[0]; \ - __ret = (__ret + __PA_LDCW_ALIGNMENT - 1) \ -@@ -28,6 +29,7 @@ - ldcd). */ - - #define __PA_LDCW_ALIGNMENT 4 -+#define __PA_LDCW_ALIGN_ORDER 2 - #define __ldcw_align(a) (&(a)->slock) - #define __LDCW "ldcw,co" - -diff --git a/arch/parisc/kernel/entry.S b/arch/parisc/kernel/entry.S -index 623496c11756..5dc831955de5 100644 ---- a/arch/parisc/kernel/entry.S -+++ b/arch/parisc/kernel/entry.S -@@ -35,6 +35,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -46,6 +47,14 @@ - #endif - - .import pa_tlb_lock,data -+ .macro load_pa_tlb_lock reg -+#if __PA_LDCW_ALIGNMENT > 4 -+ load32 PA(pa_tlb_lock) + __PA_LDCW_ALIGNMENT-1, \reg -+ depi 0,31,__PA_LDCW_ALIGN_ORDER, \reg -+#else -+ load32 PA(pa_tlb_lock), \reg -+#endif -+ .endm - - /* space_to_prot macro creates a prot id from a space id */ - -@@ -457,7 +466,7 @@ - .macro tlb_lock spc,ptp,pte,tmp,tmp1,fault - #ifdef CONFIG_SMP - cmpib,COND(=),n 0,\spc,2f -- load32 PA(pa_tlb_lock),\tmp -+ load_pa_tlb_lock \tmp - 1: LDCW 0(\tmp),\tmp1 - cmpib,COND(=) 0,\tmp1,1b - nop -@@ -480,7 +489,7 @@ - /* Release pa_tlb_lock lock. */ - .macro tlb_unlock1 spc,tmp - #ifdef CONFIG_SMP -- load32 PA(pa_tlb_lock),\tmp -+ load_pa_tlb_lock \tmp - tlb_unlock0 \spc,\tmp - #endif - .endm -diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S -index a4761b772406..16073f472118 100644 ---- a/arch/parisc/kernel/pacache.S -+++ b/arch/parisc/kernel/pacache.S -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - #include - - .text -@@ -333,8 +334,12 @@ ENDPROC(flush_data_cache_local) - - .macro tlb_lock la,flags,tmp - #ifdef CONFIG_SMP -- ldil L%pa_tlb_lock,%r1 -- ldo R%pa_tlb_lock(%r1),\la -+#if __PA_LDCW_ALIGNMENT > 4 -+ load32 pa_tlb_lock + __PA_LDCW_ALIGNMENT-1, \la -+ depi 0,31,__PA_LDCW_ALIGN_ORDER, \la -+#else -+ load32 pa_tlb_lock, \la -+#endif - rsm PSW_SM_I,\flags - 1: LDCW 0(\la),\tmp - cmpib,<>,n 0,\tmp,3f -diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c -index 437e61159279..0176ebc97bfd 100644 ---- a/arch/s390/kernel/compat_linux.c -+++ b/arch/s390/kernel/compat_linux.c -@@ -263,6 +263,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setgroups16, int, gidsetsize, u16 __user *, grouplis - return retval; - } - -+ groups_sort(group_info); - retval = set_current_groups(group_info); - put_group_info(group_info); - -diff --git a/arch/x86/entry/vdso/vma.c b/arch/x86/entry/vdso/vma.c -index aa828191c654..b8f69e264ac4 100644 ---- a/arch/x86/entry/vdso/vma.c -+++ b/arch/x86/entry/vdso/vma.c -@@ -12,6 +12,7 @@ - #include - #include - #include -+#include - #include - #include - #include -diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c -index 174c2549939d..112178b401a1 100644 ---- a/arch/x86/entry/vsyscall/vsyscall_64.c -+++ b/arch/x86/entry/vsyscall/vsyscall_64.c -@@ -66,6 +66,11 @@ static int __init vsyscall_setup(char *str) - } - early_param("vsyscall", vsyscall_setup); - -+bool vsyscall_enabled(void) -+{ -+ return vsyscall_mode != NONE; -+} -+ - static void warn_bad_vsyscall(const char *level, struct pt_regs *regs, - const char *message) - { -diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h -index 6ba66ee79710..4865e10dbb55 100644 ---- a/arch/x86/include/asm/vsyscall.h -+++ b/arch/x86/include/asm/vsyscall.h -@@ -12,12 +12,14 @@ extern void map_vsyscall(void); - * Returns true if handled. - */ - extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address); -+extern bool vsyscall_enabled(void); - #else - static inline void map_vsyscall(void) {} - static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) - { - return false; - } -+static inline bool vsyscall_enabled(void) { return false; } - #endif - - #endif /* _ASM_X86_VSYSCALL_H */ -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 2233f8a76615..2a0f44d225fe 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -580,6 +580,7 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size, - #define F14H_MPB_MAX_SIZE 1824 - #define F15H_MPB_MAX_SIZE 4096 - #define F16H_MPB_MAX_SIZE 3458 -+#define F17H_MPB_MAX_SIZE 3200 - - switch (family) { - case 0x14: -@@ -591,6 +592,9 @@ static unsigned int verify_patch_size(u8 family, u32 patch_size, - case 0x16: - max_size = F16H_MPB_MAX_SIZE; - break; -+ case 0x17: -+ max_size = F17H_MPB_MAX_SIZE; -+ break; - default: - max_size = F1XH_MPB_MAX_SIZE; - break; -diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index 2bd45ae91eb3..151fd33e9043 100644 ---- a/arch/x86/mm/init.c -+++ b/arch/x86/mm/init.c -@@ -757,7 +757,7 @@ DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate) = { - .state = 0, - .cr4 = ~0UL, /* fail hard if we screw up cr4 shadow initialization */ - }; --EXPORT_SYMBOL_GPL(cpu_tlbstate); -+EXPORT_PER_CPU_SYMBOL(cpu_tlbstate); - - void update_cache_mode_entry(unsigned entry, enum page_cache_mode cache) - { -diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c -index b0b3a69f1c7f..6a7a77929a8c 100644 ---- a/arch/x86/mm/kaiser.c -+++ b/arch/x86/mm/kaiser.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - int kaiser_enabled __read_mostly = 1; - EXPORT_SYMBOL(kaiser_enabled); /* for inlined TLB flush functions */ -@@ -111,12 +112,13 @@ static inline unsigned long get_pa_from_mapping(unsigned long vaddr) - * - * Returns a pointer to a PTE on success, or NULL on failure. - */ --static pte_t *kaiser_pagetable_walk(unsigned long address) -+static pte_t *kaiser_pagetable_walk(unsigned long address, bool user) - { - pmd_t *pmd; - pud_t *pud; - pgd_t *pgd = native_get_shadow_pgd(pgd_offset_k(address)); - gfp_t gfp = (GFP_KERNEL | __GFP_NOTRACK | __GFP_ZERO); -+ unsigned long prot = _KERNPG_TABLE; - - if (pgd_none(*pgd)) { - WARN_ONCE(1, "All shadow pgds should have been populated"); -@@ -124,6 +126,17 @@ static pte_t *kaiser_pagetable_walk(unsigned long address) - } - BUILD_BUG_ON(pgd_large(*pgd) != 0); - -+ if (user) { -+ /* -+ * The vsyscall page is the only page that will have -+ * _PAGE_USER set. Catch everything else. -+ */ -+ BUG_ON(address != VSYSCALL_ADDR); -+ -+ set_pgd(pgd, __pgd(pgd_val(*pgd) | _PAGE_USER)); -+ prot = _PAGE_TABLE; -+ } -+ - pud = pud_offset(pgd, address); - /* The shadow page tables do not use large mappings: */ - if (pud_large(*pud)) { -@@ -136,7 +149,7 @@ static pte_t *kaiser_pagetable_walk(unsigned long address) - return NULL; - spin_lock(&shadow_table_allocation_lock); - if (pud_none(*pud)) { -- set_pud(pud, __pud(_KERNPG_TABLE | __pa(new_pmd_page))); -+ set_pud(pud, __pud(prot | __pa(new_pmd_page))); - __inc_zone_page_state(virt_to_page((void *) - new_pmd_page), NR_KAISERTABLE); - } else -@@ -156,7 +169,7 @@ static pte_t *kaiser_pagetable_walk(unsigned long address) - return NULL; - spin_lock(&shadow_table_allocation_lock); - if (pmd_none(*pmd)) { -- set_pmd(pmd, __pmd(_KERNPG_TABLE | __pa(new_pte_page))); -+ set_pmd(pmd, __pmd(prot | __pa(new_pte_page))); - __inc_zone_page_state(virt_to_page((void *) - new_pte_page), NR_KAISERTABLE); - } else -@@ -192,7 +205,7 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size, - ret = -EIO; - break; - } -- pte = kaiser_pagetable_walk(address); -+ pte = kaiser_pagetable_walk(address, flags & _PAGE_USER); - if (!pte) { - ret = -ENOMEM; - break; -@@ -319,6 +332,19 @@ void __init kaiser_init(void) - - kaiser_init_all_pgds(); - -+ /* -+ * Note that this sets _PAGE_USER and it needs to happen when the -+ * pagetable hierarchy gets created, i.e., early. Otherwise -+ * kaiser_pagetable_walk() will encounter initialized PTEs in the -+ * hierarchy and not set the proper permissions, leading to the -+ * pagefaults with page-protection violations when trying to read the -+ * vsyscall page. For example. -+ */ -+ if (vsyscall_enabled()) -+ kaiser_add_user_map_early((void *)VSYSCALL_ADDR, -+ PAGE_SIZE, -+ __PAGE_KERNEL_VSYSCALL); -+ - for_each_possible_cpu(cpu) { - void *percpu_vaddr = __per_cpu_user_mapped_start + - per_cpu_offset(cpu); -diff --git a/arch/x86/mm/kasan_init_64.c b/arch/x86/mm/kasan_init_64.c -index 81ec7c02f968..fdfa25c83119 100644 ---- a/arch/x86/mm/kasan_init_64.c -+++ b/arch/x86/mm/kasan_init_64.c -@@ -126,10 +126,16 @@ void __init kasan_init(void) - - /* - * kasan_zero_page has been used as early shadow memory, thus it may -- * contain some garbage. Now we can clear it, since after the TLB flush -- * no one should write to it. -+ * contain some garbage. Now we can clear and write protect it, since -+ * after the TLB flush no one should write to it. - */ - memset(kasan_zero_page, 0, PAGE_SIZE); -+ for (i = 0; i < PTRS_PER_PTE; i++) { -+ pte_t pte = __pte(__pa(kasan_zero_page) | __PAGE_KERNEL_RO); -+ set_pte(&kasan_zero_pte[i], pte); -+ } -+ /* Flush TLBs again to be sure that write protection applied. */ -+ __flush_tlb_all(); - - init_task.kasan_depth = 0; - pr_info("KernelAddressSanitizer initialized\n"); -diff --git a/crypto/chacha20poly1305.c b/crypto/chacha20poly1305.c -index 99c3cce01290..0214600ba071 100644 ---- a/crypto/chacha20poly1305.c -+++ b/crypto/chacha20poly1305.c -@@ -600,6 +600,11 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, - CRYPTO_ALG_TYPE_AHASH_MASK); - if (IS_ERR(poly)) - return PTR_ERR(poly); -+ poly_hash = __crypto_hash_alg_common(poly); -+ -+ err = -EINVAL; -+ if (poly_hash->digestsize != POLY1305_DIGEST_SIZE) -+ goto out_put_poly; - - err = -ENOMEM; - inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL); -@@ -608,7 +613,6 @@ static int chachapoly_create(struct crypto_template *tmpl, struct rtattr **tb, - - ctx = aead_instance_ctx(inst); - ctx->saltlen = CHACHAPOLY_IV_SIZE - ivsize; -- poly_hash = __crypto_hash_alg_common(poly); - err = crypto_init_ahash_spawn(&ctx->poly, poly_hash, - aead_crypto_instance(inst)); - if (err) -diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c -index ee9cfb99fe25..f8ec3d4ba4a8 100644 ---- a/crypto/pcrypt.c -+++ b/crypto/pcrypt.c -@@ -254,6 +254,14 @@ static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm) - crypto_free_aead(ctx->child); - } - -+static void pcrypt_free(struct aead_instance *inst) -+{ -+ struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst); -+ -+ crypto_drop_aead(&ctx->spawn); -+ kfree(inst); -+} -+ - static int pcrypt_init_instance(struct crypto_instance *inst, - struct crypto_alg *alg) - { -@@ -319,6 +327,8 @@ static int pcrypt_create_aead(struct crypto_template *tmpl, struct rtattr **tb, - inst->alg.encrypt = pcrypt_aead_encrypt; - inst->alg.decrypt = pcrypt_aead_decrypt; - -+ inst->free = pcrypt_free; -+ - err = aead_register_instance(tmpl, inst); - if (err) - goto out_drop_aead; -@@ -349,14 +359,6 @@ static int pcrypt_create(struct crypto_template *tmpl, struct rtattr **tb) - return -EINVAL; - } - --static void pcrypt_free(struct crypto_instance *inst) --{ -- struct pcrypt_instance_ctx *ctx = crypto_instance_ctx(inst); -- -- crypto_drop_aead(&ctx->spawn); -- kfree(inst); --} -- - static int pcrypt_cpumask_change_notify(struct notifier_block *self, - unsigned long val, void *data) - { -@@ -469,7 +471,6 @@ static void pcrypt_fini_padata(struct padata_pcrypt *pcrypt) - static struct crypto_template pcrypt_tmpl = { - .name = "pcrypt", - .create = pcrypt_create, -- .free = pcrypt_free, - .module = THIS_MODULE, - }; - -diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c -index 25996e256110..0ffb247b42d6 100644 ---- a/drivers/bus/sunxi-rsb.c -+++ b/drivers/bus/sunxi-rsb.c -@@ -178,6 +178,7 @@ static struct bus_type sunxi_rsb_bus = { - .match = sunxi_rsb_device_match, - .probe = sunxi_rsb_device_probe, - .remove = sunxi_rsb_device_remove, -+ .uevent = of_device_uevent_modalias, - }; - - static void sunxi_rsb_dev_release(struct device *dev) -diff --git a/drivers/crypto/n2_core.c b/drivers/crypto/n2_core.c -index 5450880abb7b..5a9083021fa0 100644 ---- a/drivers/crypto/n2_core.c -+++ b/drivers/crypto/n2_core.c -@@ -1641,6 +1641,7 @@ static int queue_cache_init(void) - CWQ_ENTRY_SIZE, 0, NULL); - if (!queue_cache[HV_NCS_QTYPE_CWQ - 1]) { - kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_MAU - 1]); -+ queue_cache[HV_NCS_QTYPE_MAU - 1] = NULL; - return -ENOMEM; - } - return 0; -@@ -1650,6 +1651,8 @@ static void queue_cache_destroy(void) - { - kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_MAU - 1]); - kmem_cache_destroy(queue_cache[HV_NCS_QTYPE_CWQ - 1]); -+ queue_cache[HV_NCS_QTYPE_MAU - 1] = NULL; -+ queue_cache[HV_NCS_QTYPE_CWQ - 1] = NULL; - } - - static int spu_queue_register(struct spu_queue *p, unsigned long q_type) -diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c -index 6f4dc0fd2ca3..51b96e9bf793 100644 ---- a/drivers/input/mouse/elantech.c -+++ b/drivers/input/mouse/elantech.c -@@ -1613,7 +1613,7 @@ static int elantech_set_properties(struct elantech_data *etd) - case 5: - etd->hw_version = 3; - break; -- case 6 ... 14: -+ case 6 ... 15: - etd->hw_version = 4; - break; - default: -diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c -index 9d46a0bdd9f9..a260060042ad 100644 ---- a/fs/nfsd/auth.c -+++ b/fs/nfsd/auth.c -@@ -59,6 +59,9 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp) - GROUP_AT(gi, i) = exp->ex_anon_gid; - else - GROUP_AT(gi, i) = GROUP_AT(rqgi, i); -+ -+ /* Each thread allocates its own gi, no race */ -+ groups_sort(gi); - } - } else { - gi = get_group_info(rqgi); -diff --git a/include/linux/cred.h b/include/linux/cred.h -index 257db64562e5..9e120c92551b 100644 ---- a/include/linux/cred.h -+++ b/include/linux/cred.h -@@ -87,6 +87,7 @@ extern int set_current_groups(struct group_info *); - extern void set_groups(struct cred *, struct group_info *); - extern int groups_search(const struct group_info *, kgid_t); - extern bool may_setgroups(void); -+extern void groups_sort(struct group_info *); - - /* access the groups "array" with this macro */ - #define GROUP_AT(gi, i) \ -diff --git a/include/linux/fscache.h b/include/linux/fscache.h -index 115bb81912cc..94a8aae8f9e2 100644 ---- a/include/linux/fscache.h -+++ b/include/linux/fscache.h -@@ -764,7 +764,7 @@ bool fscache_maybe_release_page(struct fscache_cookie *cookie, - { - if (fscache_cookie_valid(cookie) && PageFsCache(page)) - return __fscache_maybe_release_page(cookie, page, gfp); -- return false; -+ return true; - } - - /** -diff --git a/kernel/acct.c b/kernel/acct.c -index 74963d192c5d..37f1dc696fbd 100644 ---- a/kernel/acct.c -+++ b/kernel/acct.c -@@ -99,7 +99,7 @@ static int check_free_space(struct bsd_acct_struct *acct) - { - struct kstatfs sbuf; - -- if (time_is_before_jiffies(acct->needcheck)) -+ if (time_is_after_jiffies(acct->needcheck)) - goto out; - - /* May block */ -diff --git a/kernel/groups.c b/kernel/groups.c -index 74d431d25251..5ea9847f172f 100644 ---- a/kernel/groups.c -+++ b/kernel/groups.c -@@ -101,7 +101,7 @@ static int groups_from_user(struct group_info *group_info, - } - - /* a simple Shell sort */ --static void groups_sort(struct group_info *group_info) -+void groups_sort(struct group_info *group_info) - { - int base, max, stride; - int gidsetsize = group_info->ngroups; -@@ -128,6 +128,7 @@ static void groups_sort(struct group_info *group_info) - stride /= 3; - } - } -+EXPORT_SYMBOL(groups_sort); - - /* a simple bsearch */ - int groups_search(const struct group_info *group_info, kgid_t grp) -@@ -159,7 +160,6 @@ int groups_search(const struct group_info *group_info, kgid_t grp) - void set_groups(struct cred *new, struct group_info *group_info) - { - put_group_info(new->group_info); -- groups_sort(group_info); - get_group_info(group_info); - new->group_info = group_info; - } -@@ -243,6 +243,7 @@ SYSCALL_DEFINE2(setgroups, int, gidsetsize, gid_t __user *, grouplist) - return retval; - } - -+ groups_sort(group_info); - retval = set_current_groups(group_info); - put_group_info(group_info); - -diff --git a/kernel/module.c b/kernel/module.c -index b14a4f31221f..0a56098d3738 100644 ---- a/kernel/module.c -+++ b/kernel/module.c -@@ -2404,7 +2404,7 @@ static char elf_type(const Elf_Sym *sym, const struct load_info *info) - } - if (sym->st_shndx == SHN_UNDEF) - return 'U'; -- if (sym->st_shndx == SHN_ABS) -+ if (sym->st_shndx == SHN_ABS || sym->st_shndx == info->index.pcpu) - return 'a'; - if (sym->st_shndx >= SHN_LORESERVE) - return '?'; -@@ -2433,7 +2433,7 @@ static char elf_type(const Elf_Sym *sym, const struct load_info *info) - } - - static bool is_core_symbol(const Elf_Sym *src, const Elf_Shdr *sechdrs, -- unsigned int shnum) -+ unsigned int shnum, unsigned int pcpundx) - { - const Elf_Shdr *sec; - -@@ -2442,6 +2442,11 @@ static bool is_core_symbol(const Elf_Sym *src, const Elf_Shdr *sechdrs, - || !src->st_name) - return false; - -+#ifdef CONFIG_KALLSYMS_ALL -+ if (src->st_shndx == pcpundx) -+ return true; -+#endif -+ - sec = sechdrs + src->st_shndx; - if (!(sec->sh_flags & SHF_ALLOC) - #ifndef CONFIG_KALLSYMS_ALL -@@ -2479,7 +2484,8 @@ static void layout_symtab(struct module *mod, struct load_info *info) - /* Compute total space required for the core symbols' strtab. */ - for (ndst = i = 0; i < nsrc; i++) { - if (i == 0 || -- is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { -+ is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum, -+ info->index.pcpu)) { - strtab_size += strlen(&info->strtab[src[i].st_name])+1; - ndst++; - } -@@ -2537,7 +2543,8 @@ static void add_kallsyms(struct module *mod, const struct load_info *info) - src = mod->kallsyms->symtab; - for (ndst = i = 0; i < mod->kallsyms->num_symtab; i++) { - if (i == 0 || -- is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum)) { -+ is_core_symbol(src+i, info->sechdrs, info->hdr->e_shnum, -+ info->index.pcpu)) { - dst[ndst] = src[i]; - dst[ndst++].st_name = s - mod->core_kallsyms.strtab; - s += strlcpy(s, &mod->kallsyms->strtab[src[i].st_name], -@@ -2881,8 +2888,12 @@ static int check_modinfo(struct module *mod, struct load_info *info, int flags) - return -ENOEXEC; - } - -- if (!get_modinfo(info, "intree")) -+ if (!get_modinfo(info, "intree")) { -+ if (!test_taint(TAINT_OOT_MODULE)) -+ pr_warn("%s: loading out-of-tree module taints kernel.\n", -+ mod->name); - add_taint_module(mod, TAINT_OOT_MODULE, LOCKDEP_STILL_OK); -+ } - - if (get_modinfo(info, "staging")) { - add_taint_module(mod, TAINT_CRAP, LOCKDEP_STILL_OK); -@@ -3047,6 +3058,8 @@ static int move_module(struct module *mod, struct load_info *info) - - static int check_module_license_and_versions(struct module *mod) - { -+ int prev_taint = test_taint(TAINT_PROPRIETARY_MODULE); -+ - /* - * ndiswrapper is under GPL by itself, but loads proprietary modules. - * Don't use add_taint_module(), as it would prevent ndiswrapper from -@@ -3065,6 +3078,9 @@ static int check_module_license_and_versions(struct module *mod) - add_taint_module(mod, TAINT_PROPRIETARY_MODULE, - LOCKDEP_NOW_UNRELIABLE); - -+ if (!prev_taint && test_taint(TAINT_PROPRIETARY_MODULE)) -+ pr_warn("%s: module license taints kernel.\n", mod->name); -+ - #ifdef CONFIG_MODVERSIONS - if ((mod->num_syms && !mod->crcs) - || (mod->num_gpl_syms && !mod->gpl_crcs) -diff --git a/kernel/signal.c b/kernel/signal.c -index 5d50ea899b6d..4a548c6a4118 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -72,7 +72,7 @@ static int sig_task_ignored(struct task_struct *t, int sig, bool force) - handler = sig_handler(t, sig); - - if (unlikely(t->signal->flags & SIGNAL_UNKILLABLE) && -- handler == SIG_DFL && !force) -+ handler == SIG_DFL && !(force && sig_kernel_only(sig))) - return 1; - - return sig_handler_ignored(handler, sig); -@@ -88,13 +88,15 @@ static int sig_ignored(struct task_struct *t, int sig, bool force) - if (sigismember(&t->blocked, sig) || sigismember(&t->real_blocked, sig)) - return 0; - -- if (!sig_task_ignored(t, sig, force)) -- return 0; -- - /* -- * Tracers may want to know about even ignored signals. -+ * Tracers may want to know about even ignored signal unless it -+ * is SIGKILL which can't be reported anyway but can be ignored -+ * by SIGNAL_UNKILLABLE task. - */ -- return !t->ptrace; -+ if (t->ptrace && sig != SIGKILL) -+ return 0; -+ -+ return sig_task_ignored(t, sig, force); - } - - /* -@@ -917,9 +919,9 @@ static void complete_signal(int sig, struct task_struct *p, int group) - * then start taking the whole group down immediately. - */ - if (sig_fatal(p, sig) && -- !(signal->flags & (SIGNAL_UNKILLABLE | SIGNAL_GROUP_EXIT)) && -+ !(signal->flags & SIGNAL_GROUP_EXIT) && - !sigismember(&t->real_blocked, sig) && -- (sig == SIGKILL || !t->ptrace)) { -+ (sig == SIGKILL || !p->ptrace)) { - /* - * This signal will be fatal to the whole group. - */ -diff --git a/kernel/uid16.c b/kernel/uid16.c -index d58cc4d8f0d1..651aaa5221ec 100644 ---- a/kernel/uid16.c -+++ b/kernel/uid16.c -@@ -190,6 +190,7 @@ SYSCALL_DEFINE2(setgroups16, int, gidsetsize, old_gid_t __user *, grouplist) - return retval; - } - -+ groups_sort(group_info); - retval = set_current_groups(group_info); - put_group_info(group_info); - -diff --git a/mm/vmstat.c b/mm/vmstat.c -index 324b7e90b4c5..5712cdaae964 100644 ---- a/mm/vmstat.c -+++ b/mm/vmstat.c -@@ -1351,7 +1351,9 @@ static int vmstat_show(struct seq_file *m, void *arg) - unsigned long *l = arg; - unsigned long off = l - (unsigned long *)m->private; - -- seq_printf(m, "%s %lu\n", vmstat_text[off], *l); -+ seq_puts(m, vmstat_text[off]); -+ seq_put_decimal_ull(m, ' ', *l); -+ seq_putc(m, '\n'); - return 0; - } - -diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c -index 2410d557ae39..89731c9023f0 100644 ---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c -+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c -@@ -231,6 +231,7 @@ static int gssx_dec_linux_creds(struct xdr_stream *xdr, - goto out_free_groups; - GROUP_AT(creds->cr_group_info, i) = kgid; - } -+ groups_sort(creds->cr_group_info); - - return 0; - out_free_groups: -diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c -index 033fec307528..036bbf2b44c1 100644 ---- a/net/sunrpc/auth_gss/svcauth_gss.c -+++ b/net/sunrpc/auth_gss/svcauth_gss.c -@@ -481,6 +481,7 @@ static int rsc_parse(struct cache_detail *cd, - goto out; - GROUP_AT(rsci.cred.cr_group_info, i) = kgid; - } -+ groups_sort(rsci.cred.cr_group_info); - - /* mech name */ - len = qword_get(&mesg, buf, mlen); -diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c -index 621ca7b4a155..98db1715cb17 100644 ---- a/net/sunrpc/svcauth_unix.c -+++ b/net/sunrpc/svcauth_unix.c -@@ -520,6 +520,7 @@ static int unix_gid_parse(struct cache_detail *cd, - GROUP_AT(ug.gi, i) = kgid; - } - -+ groups_sort(ug.gi); - ugp = unix_gid_lookup(cd, uid); - if (ugp) { - struct cache_head *ch; -@@ -827,6 +828,7 @@ svcauth_unix_accept(struct svc_rqst *rqstp, __be32 *authp) - kgid_t kgid = make_kgid(&init_user_ns, svc_getnl(argv)); - GROUP_AT(cred->cr_group_info, i) = kgid; - } -+ groups_sort(cred->cr_group_info); - if (svc_getu32(argv) != htonl(RPC_AUTH_NULL) || svc_getu32(argv) != 0) { - *authp = rpc_autherr_badverf; - return SVC_DENIED; -diff --git a/scripts/genksyms/genksyms.c b/scripts/genksyms/genksyms.c -index 88632df4381b..dafaf96e0a34 100644 ---- a/scripts/genksyms/genksyms.c -+++ b/scripts/genksyms/genksyms.c -@@ -423,13 +423,15 @@ static struct string_list *read_node(FILE *f) - struct string_list node = { - .string = buffer, - .tag = SYM_NORMAL }; -- int c; -+ int c, in_string = 0; - - while ((c = fgetc(f)) != EOF) { -- if (c == ' ') { -+ if (!in_string && c == ' ') { - if (node.string == buffer) - continue; - break; -+ } else if (c == '"') { -+ in_string = !in_string; - } else if (c == '\n') { - if (node.string == buffer) - return NULL; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.111-112.patch b/patch/kernel/mvebu64-default/04-patch-4.4.111-112.patch deleted file mode 100644 index 17195b830234..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.111-112.patch +++ /dev/null @@ -1,4343 +0,0 @@ -diff --git a/Documentation/ABI/testing/sysfs-devices-system-cpu b/Documentation/ABI/testing/sysfs-devices-system-cpu -index b683e8ee69ec..ea6a043f5beb 100644 ---- a/Documentation/ABI/testing/sysfs-devices-system-cpu -+++ b/Documentation/ABI/testing/sysfs-devices-system-cpu -@@ -271,3 +271,19 @@ Description: Parameters for the CPU cache attributes - - WriteBack: data is written only to the cache line and - the modified cache line is written to main - memory only when it is replaced -+ -+What: /sys/devices/system/cpu/vulnerabilities -+ /sys/devices/system/cpu/vulnerabilities/meltdown -+ /sys/devices/system/cpu/vulnerabilities/spectre_v1 -+ /sys/devices/system/cpu/vulnerabilities/spectre_v2 -+Date: January 2018 -+Contact: Linux kernel mailing list -+Description: Information about CPU vulnerabilities -+ -+ The files are named after the code names of CPU -+ vulnerabilities. The output of those files reflects the -+ state of the CPUs in the system. Possible output values: -+ -+ "Not affected" CPU is not affected by the vulnerability -+ "Vulnerable" CPU is affected and no mitigation in effect -+ "Mitigation: $M" CPU is affected and mitigation $M is in effect -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 5977c4d71356..39280b72f27a 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2523,8 +2523,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nojitter [IA-64] Disables jitter checking for ITC timers. - -- nopti [X86-64] Disable KAISER isolation of kernel from user. -- - no-kvmclock [X86,KVM] Disable paravirtualized KVM clock driver - - no-kvmapf [X86,KVM] Disable paravirtualized asynchronous page -@@ -3056,11 +3054,20 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - pt. [PARIDE] - See Documentation/blockdev/paride.txt. - -- pti= [X86_64] -- Control KAISER user/kernel address space isolation: -- on - enable -- off - disable -- auto - default setting -+ pti= [X86_64] Control Page Table Isolation of user and -+ kernel address spaces. Disabling this feature -+ removes hardening, but improves performance of -+ system calls and interrupts. -+ -+ on - unconditionally enable -+ off - unconditionally disable -+ auto - kernel detects whether your CPU model is -+ vulnerable to issues that PTI mitigates -+ -+ Not specifying this option is equivalent to pti=auto. -+ -+ nopti [X86_64] -+ Equivalent to pti=off - - pty.legacy_count= - [KNL] Number of legacy pty's. Overwrites compiled-in -diff --git a/Documentation/x86/pti.txt b/Documentation/x86/pti.txt -new file mode 100644 -index 000000000000..d11eff61fc9a ---- /dev/null -+++ b/Documentation/x86/pti.txt -@@ -0,0 +1,186 @@ -+Overview -+======== -+ -+Page Table Isolation (pti, previously known as KAISER[1]) is a -+countermeasure against attacks on the shared user/kernel address -+space such as the "Meltdown" approach[2]. -+ -+To mitigate this class of attacks, we create an independent set of -+page tables for use only when running userspace applications. When -+the kernel is entered via syscalls, interrupts or exceptions, the -+page tables are switched to the full "kernel" copy. When the system -+switches back to user mode, the user copy is used again. -+ -+The userspace page tables contain only a minimal amount of kernel -+data: only what is needed to enter/exit the kernel such as the -+entry/exit functions themselves and the interrupt descriptor table -+(IDT). There are a few strictly unnecessary things that get mapped -+such as the first C function when entering an interrupt (see -+comments in pti.c). -+ -+This approach helps to ensure that side-channel attacks leveraging -+the paging structures do not function when PTI is enabled. It can be -+enabled by setting CONFIG_PAGE_TABLE_ISOLATION=y at compile time. -+Once enabled at compile-time, it can be disabled at boot with the -+'nopti' or 'pti=' kernel parameters (see kernel-parameters.txt). -+ -+Page Table Management -+===================== -+ -+When PTI is enabled, the kernel manages two sets of page tables. -+The first set is very similar to the single set which is present in -+kernels without PTI. This includes a complete mapping of userspace -+that the kernel can use for things like copy_to_user(). -+ -+Although _complete_, the user portion of the kernel page tables is -+crippled by setting the NX bit in the top level. This ensures -+that any missed kernel->user CR3 switch will immediately crash -+userspace upon executing its first instruction. -+ -+The userspace page tables map only the kernel data needed to enter -+and exit the kernel. This data is entirely contained in the 'struct -+cpu_entry_area' structure which is placed in the fixmap which gives -+each CPU's copy of the area a compile-time-fixed virtual address. -+ -+For new userspace mappings, the kernel makes the entries in its -+page tables like normal. The only difference is when the kernel -+makes entries in the top (PGD) level. In addition to setting the -+entry in the main kernel PGD, a copy of the entry is made in the -+userspace page tables' PGD. -+ -+This sharing at the PGD level also inherently shares all the lower -+layers of the page tables. This leaves a single, shared set of -+userspace page tables to manage. One PTE to lock, one set of -+accessed bits, dirty bits, etc... -+ -+Overhead -+======== -+ -+Protection against side-channel attacks is important. But, -+this protection comes at a cost: -+ -+1. Increased Memory Use -+ a. Each process now needs an order-1 PGD instead of order-0. -+ (Consumes an additional 4k per process). -+ b. The 'cpu_entry_area' structure must be 2MB in size and 2MB -+ aligned so that it can be mapped by setting a single PMD -+ entry. This consumes nearly 2MB of RAM once the kernel -+ is decompressed, but no space in the kernel image itself. -+ -+2. Runtime Cost -+ a. CR3 manipulation to switch between the page table copies -+ must be done at interrupt, syscall, and exception entry -+ and exit (it can be skipped when the kernel is interrupted, -+ though.) Moves to CR3 are on the order of a hundred -+ cycles, and are required at every entry and exit. -+ b. A "trampoline" must be used for SYSCALL entry. This -+ trampoline depends on a smaller set of resources than the -+ non-PTI SYSCALL entry code, so requires mapping fewer -+ things into the userspace page tables. The downside is -+ that stacks must be switched at entry time. -+ d. Global pages are disabled for all kernel structures not -+ mapped into both kernel and userspace page tables. This -+ feature of the MMU allows different processes to share TLB -+ entries mapping the kernel. Losing the feature means more -+ TLB misses after a context switch. The actual loss of -+ performance is very small, however, never exceeding 1%. -+ d. Process Context IDentifiers (PCID) is a CPU feature that -+ allows us to skip flushing the entire TLB when switching page -+ tables by setting a special bit in CR3 when the page tables -+ are changed. This makes switching the page tables (at context -+ switch, or kernel entry/exit) cheaper. But, on systems with -+ PCID support, the context switch code must flush both the user -+ and kernel entries out of the TLB. The user PCID TLB flush is -+ deferred until the exit to userspace, minimizing the cost. -+ See intel.com/sdm for the gory PCID/INVPCID details. -+ e. The userspace page tables must be populated for each new -+ process. Even without PTI, the shared kernel mappings -+ are created by copying top-level (PGD) entries into each -+ new process. But, with PTI, there are now *two* kernel -+ mappings: one in the kernel page tables that maps everything -+ and one for the entry/exit structures. At fork(), we need to -+ copy both. -+ f. In addition to the fork()-time copying, there must also -+ be an update to the userspace PGD any time a set_pgd() is done -+ on a PGD used to map userspace. This ensures that the kernel -+ and userspace copies always map the same userspace -+ memory. -+ g. On systems without PCID support, each CR3 write flushes -+ the entire TLB. That means that each syscall, interrupt -+ or exception flushes the TLB. -+ h. INVPCID is a TLB-flushing instruction which allows flushing -+ of TLB entries for non-current PCIDs. Some systems support -+ PCIDs, but do not support INVPCID. On these systems, addresses -+ can only be flushed from the TLB for the current PCID. When -+ flushing a kernel address, we need to flush all PCIDs, so a -+ single kernel address flush will require a TLB-flushing CR3 -+ write upon the next use of every PCID. -+ -+Possible Future Work -+==================== -+1. We can be more careful about not actually writing to CR3 -+ unless its value is actually changed. -+2. Allow PTI to be enabled/disabled at runtime in addition to the -+ boot-time switching. -+ -+Testing -+======== -+ -+To test stability of PTI, the following test procedure is recommended, -+ideally doing all of these in parallel: -+ -+1. Set CONFIG_DEBUG_ENTRY=y -+2. Run several copies of all of the tools/testing/selftests/x86/ tests -+ (excluding MPX and protection_keys) in a loop on multiple CPUs for -+ several minutes. These tests frequently uncover corner cases in the -+ kernel entry code. In general, old kernels might cause these tests -+ themselves to crash, but they should never crash the kernel. -+3. Run the 'perf' tool in a mode (top or record) that generates many -+ frequent performance monitoring non-maskable interrupts (see "NMI" -+ in /proc/interrupts). This exercises the NMI entry/exit code which -+ is known to trigger bugs in code paths that did not expect to be -+ interrupted, including nested NMIs. Using "-c" boosts the rate of -+ NMIs, and using two -c with separate counters encourages nested NMIs -+ and less deterministic behavior. -+ -+ while true; do perf record -c 10000 -e instructions,cycles -a sleep 10; done -+ -+4. Launch a KVM virtual machine. -+5. Run 32-bit binaries on systems supporting the SYSCALL instruction. -+ This has been a lightly-tested code path and needs extra scrutiny. -+ -+Debugging -+========= -+ -+Bugs in PTI cause a few different signatures of crashes -+that are worth noting here. -+ -+ * Failures of the selftests/x86 code. Usually a bug in one of the -+ more obscure corners of entry_64.S -+ * Crashes in early boot, especially around CPU bringup. Bugs -+ in the trampoline code or mappings cause these. -+ * Crashes at the first interrupt. Caused by bugs in entry_64.S, -+ like screwing up a page table switch. Also caused by -+ incorrectly mapping the IRQ handler entry code. -+ * Crashes at the first NMI. The NMI code is separate from main -+ interrupt handlers and can have bugs that do not affect -+ normal interrupts. Also caused by incorrectly mapping NMI -+ code. NMIs that interrupt the entry code must be very -+ careful and can be the cause of crashes that show up when -+ running perf. -+ * Kernel crashes at the first exit to userspace. entry_64.S -+ bugs, or failing to map some of the exit code. -+ * Crashes at first interrupt that interrupts userspace. The paths -+ in entry_64.S that return to userspace are sometimes separate -+ from the ones that return to the kernel. -+ * Double faults: overflowing the kernel stack because of page -+ faults upon page faults. Caused by touching non-pti-mapped -+ data in the entry code, or forgetting to switch to kernel -+ CR3 before calling into C functions which are not pti-mapped. -+ * Userspace segfaults early in boot, sometimes manifesting -+ as mount(8) failing to mount the rootfs. These have -+ tended to be TLB invalidation issues. Usually invalidating -+ the wrong PCID, or otherwise missing an invalidation. -+ -+1. https://gruss.cc/files/kaiser.pdf -+2. https://meltdownattack.com/meltdown.pdf -diff --git a/Makefile b/Makefile -index 4779517d9bf0..07070a1e6292 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 111 -+SUBLEVEL = 112 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/kvm/mmio.c b/arch/arm/kvm/mmio.c -index 3a10c9f1d0a4..387ee2a11e36 100644 ---- a/arch/arm/kvm/mmio.c -+++ b/arch/arm/kvm/mmio.c -@@ -113,7 +113,7 @@ int kvm_handle_mmio_return(struct kvm_vcpu *vcpu, struct kvm_run *run) - } - - trace_kvm_mmio(KVM_TRACE_MMIO_READ, len, run->mmio.phys_addr, -- data); -+ &data); - data = vcpu_data_host_to_guest(vcpu, data, len); - vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data); - } -@@ -189,14 +189,14 @@ int io_mem_abort(struct kvm_vcpu *vcpu, struct kvm_run *run, - data = vcpu_data_guest_to_host(vcpu, vcpu_get_reg(vcpu, rt), - len); - -- trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, data); -+ trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, &data); - mmio_write_buf(data_buf, len, data); - - ret = kvm_io_bus_write(vcpu, KVM_MMIO_BUS, fault_ipa, len, - data_buf); - } else { - trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, len, -- fault_ipa, 0); -+ fault_ipa, NULL); - - ret = kvm_io_bus_read(vcpu, KVM_MMIO_BUS, fault_ipa, len, - data_buf); -diff --git a/arch/mips/kernel/process.c b/arch/mips/kernel/process.c -index 163b3449a8de..fcbc4e57d765 100644 ---- a/arch/mips/kernel/process.c -+++ b/arch/mips/kernel/process.c -@@ -664,6 +664,18 @@ int mips_set_process_fp_mode(struct task_struct *task, unsigned int value) - unsigned long switch_count; - struct task_struct *t; - -+ /* If nothing to change, return right away, successfully. */ -+ if (value == mips_get_process_fp_mode(task)) -+ return 0; -+ -+ /* Only accept a mode change if 64-bit FP enabled for o32. */ -+ if (!IS_ENABLED(CONFIG_MIPS_O32_FP64_SUPPORT)) -+ return -EOPNOTSUPP; -+ -+ /* And only for o32 tasks. */ -+ if (IS_ENABLED(CONFIG_64BIT) && !test_thread_flag(TIF_32BIT_REGS)) -+ return -EOPNOTSUPP; -+ - /* Check the value is valid */ - if (value & ~known_bits) - return -EOPNOTSUPP; -diff --git a/arch/mips/kernel/ptrace.c b/arch/mips/kernel/ptrace.c -index a3f38e6b7ea1..c3d2d2c05fdb 100644 ---- a/arch/mips/kernel/ptrace.c -+++ b/arch/mips/kernel/ptrace.c -@@ -439,63 +439,160 @@ static int gpr64_set(struct task_struct *target, - - #endif /* CONFIG_64BIT */ - -+/* -+ * Copy the floating-point context to the supplied NT_PRFPREG buffer, -+ * !CONFIG_CPU_HAS_MSA variant. FP context's general register slots -+ * correspond 1:1 to buffer slots. Only general registers are copied. -+ */ -+static int fpr_get_fpa(struct task_struct *target, -+ unsigned int *pos, unsigned int *count, -+ void **kbuf, void __user **ubuf) -+{ -+ return user_regset_copyout(pos, count, kbuf, ubuf, -+ &target->thread.fpu, -+ 0, NUM_FPU_REGS * sizeof(elf_fpreg_t)); -+} -+ -+/* -+ * Copy the floating-point context to the supplied NT_PRFPREG buffer, -+ * CONFIG_CPU_HAS_MSA variant. Only lower 64 bits of FP context's -+ * general register slots are copied to buffer slots. Only general -+ * registers are copied. -+ */ -+static int fpr_get_msa(struct task_struct *target, -+ unsigned int *pos, unsigned int *count, -+ void **kbuf, void __user **ubuf) -+{ -+ unsigned int i; -+ u64 fpr_val; -+ int err; -+ -+ BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); -+ for (i = 0; i < NUM_FPU_REGS; i++) { -+ fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0); -+ err = user_regset_copyout(pos, count, kbuf, ubuf, -+ &fpr_val, i * sizeof(elf_fpreg_t), -+ (i + 1) * sizeof(elf_fpreg_t)); -+ if (err) -+ return err; -+ } -+ -+ return 0; -+} -+ -+/* -+ * Copy the floating-point context to the supplied NT_PRFPREG buffer. -+ * Choose the appropriate helper for general registers, and then copy -+ * the FCSR register separately. -+ */ - static int fpr_get(struct task_struct *target, - const struct user_regset *regset, - unsigned int pos, unsigned int count, - void *kbuf, void __user *ubuf) - { -- unsigned i; -+ const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t); - int err; -- u64 fpr_val; - -- /* XXX fcr31 */ -+ if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t)) -+ err = fpr_get_fpa(target, &pos, &count, &kbuf, &ubuf); -+ else -+ err = fpr_get_msa(target, &pos, &count, &kbuf, &ubuf); -+ if (err) -+ return err; - -- if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t)) -- return user_regset_copyout(&pos, &count, &kbuf, &ubuf, -- &target->thread.fpu, -- 0, sizeof(elf_fpregset_t)); -+ err = user_regset_copyout(&pos, &count, &kbuf, &ubuf, -+ &target->thread.fpu.fcr31, -+ fcr31_pos, fcr31_pos + sizeof(u32)); - -- for (i = 0; i < NUM_FPU_REGS; i++) { -- fpr_val = get_fpr64(&target->thread.fpu.fpr[i], 0); -- err = user_regset_copyout(&pos, &count, &kbuf, &ubuf, -- &fpr_val, i * sizeof(elf_fpreg_t), -- (i + 1) * sizeof(elf_fpreg_t)); -+ return err; -+} -+ -+/* -+ * Copy the supplied NT_PRFPREG buffer to the floating-point context, -+ * !CONFIG_CPU_HAS_MSA variant. Buffer slots correspond 1:1 to FP -+ * context's general register slots. Only general registers are copied. -+ */ -+static int fpr_set_fpa(struct task_struct *target, -+ unsigned int *pos, unsigned int *count, -+ const void **kbuf, const void __user **ubuf) -+{ -+ return user_regset_copyin(pos, count, kbuf, ubuf, -+ &target->thread.fpu, -+ 0, NUM_FPU_REGS * sizeof(elf_fpreg_t)); -+} -+ -+/* -+ * Copy the supplied NT_PRFPREG buffer to the floating-point context, -+ * CONFIG_CPU_HAS_MSA variant. Buffer slots are copied to lower 64 -+ * bits only of FP context's general register slots. Only general -+ * registers are copied. -+ */ -+static int fpr_set_msa(struct task_struct *target, -+ unsigned int *pos, unsigned int *count, -+ const void **kbuf, const void __user **ubuf) -+{ -+ unsigned int i; -+ u64 fpr_val; -+ int err; -+ -+ BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); -+ for (i = 0; i < NUM_FPU_REGS && *count > 0; i++) { -+ err = user_regset_copyin(pos, count, kbuf, ubuf, -+ &fpr_val, i * sizeof(elf_fpreg_t), -+ (i + 1) * sizeof(elf_fpreg_t)); - if (err) - return err; -+ set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val); - } - - return 0; - } - -+/* -+ * Copy the supplied NT_PRFPREG buffer to the floating-point context. -+ * Choose the appropriate helper for general registers, and then copy -+ * the FCSR register separately. -+ * -+ * We optimize for the case where `count % sizeof(elf_fpreg_t) == 0', -+ * which is supposed to have been guaranteed by the kernel before -+ * calling us, e.g. in `ptrace_regset'. We enforce that requirement, -+ * so that we can safely avoid preinitializing temporaries for -+ * partial register writes. -+ */ - static int fpr_set(struct task_struct *target, - const struct user_regset *regset, - unsigned int pos, unsigned int count, - const void *kbuf, const void __user *ubuf) - { -- unsigned i; -+ const int fcr31_pos = NUM_FPU_REGS * sizeof(elf_fpreg_t); -+ u32 fcr31; - int err; -- u64 fpr_val; - -- /* XXX fcr31 */ -+ BUG_ON(count % sizeof(elf_fpreg_t)); -+ -+ if (pos + count > sizeof(elf_fpregset_t)) -+ return -EIO; - - init_fp_ctx(target); - -- if (sizeof(target->thread.fpu.fpr[i]) == sizeof(elf_fpreg_t)) -- return user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- &target->thread.fpu, -- 0, sizeof(elf_fpregset_t)); -+ if (sizeof(target->thread.fpu.fpr[0]) == sizeof(elf_fpreg_t)) -+ err = fpr_set_fpa(target, &pos, &count, &kbuf, &ubuf); -+ else -+ err = fpr_set_msa(target, &pos, &count, &kbuf, &ubuf); -+ if (err) -+ return err; - -- BUILD_BUG_ON(sizeof(fpr_val) != sizeof(elf_fpreg_t)); -- for (i = 0; i < NUM_FPU_REGS && count >= sizeof(elf_fpreg_t); i++) { -+ if (count > 0) { - err = user_regset_copyin(&pos, &count, &kbuf, &ubuf, -- &fpr_val, i * sizeof(elf_fpreg_t), -- (i + 1) * sizeof(elf_fpreg_t)); -+ &fcr31, -+ fcr31_pos, fcr31_pos + sizeof(u32)); - if (err) - return err; -- set_fpr64(&target->thread.fpu.fpr[i], 0, fpr_val); -+ -+ ptrace_setfcr31(target, fcr31); - } - -- return 0; -+ return err; - } - - enum mips_regset { -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 39d2dc66faa5..0ef2cdd11616 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -62,6 +62,7 @@ config X86 - select GENERIC_CLOCKEVENTS_MIN_ADJUST - select GENERIC_CMOS_UPDATE - select GENERIC_CPU_AUTOPROBE -+ select GENERIC_CPU_VULNERABILITIES - select GENERIC_EARLY_IOREMAP - select GENERIC_FIND_FIRST_BIT - select GENERIC_IOMAP -diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h -index 09936e9c8154..d1cf17173b1b 100644 ---- a/arch/x86/include/asm/alternative.h -+++ b/arch/x86/include/asm/alternative.h -@@ -138,7 +138,7 @@ static inline int alternatives_text_reserved(void *start, void *end) - ".popsection\n" \ - ".pushsection .altinstr_replacement, \"ax\"\n" \ - ALTINSTR_REPLACEMENT(newinstr, feature, 1) \ -- ".popsection" -+ ".popsection\n" - - #define ALTERNATIVE_2(oldinstr, newinstr1, feature1, newinstr2, feature2)\ - OLDINSTR_2(oldinstr, 1, 2) \ -@@ -149,7 +149,7 @@ static inline int alternatives_text_reserved(void *start, void *end) - ".pushsection .altinstr_replacement, \"ax\"\n" \ - ALTINSTR_REPLACEMENT(newinstr1, feature1, 1) \ - ALTINSTR_REPLACEMENT(newinstr2, feature2, 2) \ -- ".popsection" -+ ".popsection\n" - - /* - * This must be included *after* the definition of ALTERNATIVE due to -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index f6605712ca90..142028afd049 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -277,6 +277,9 @@ - #define X86_BUG_FXSAVE_LEAK X86_BUG(6) /* FXSAVE leaks FOP/FIP/FOP */ - #define X86_BUG_CLFLUSH_MONITOR X86_BUG(7) /* AAI65, CLFLUSH required before MONITOR */ - #define X86_BUG_SYSRET_SS_ATTRS X86_BUG(8) /* SYSRET doesn't fix up SS attrs */ -+#define X86_BUG_CPU_MELTDOWN X86_BUG(14) /* CPU is affected by meltdown attack and needs kernel page table isolation */ -+#define X86_BUG_SPECTRE_V1 X86_BUG(15) /* CPU is affected by Spectre variant 1 attack with conditional branches */ -+#define X86_BUG_SPECTRE_V2 X86_BUG(16) /* CPU is affected by Spectre variant 2 attack with indirect branches */ - - #if defined(__KERNEL__) && !defined(__ASSEMBLY__) - -@@ -359,6 +362,8 @@ extern const char * const x86_bug_flags[NBUGINTS*32]; - set_bit(bit, (unsigned long *)cpu_caps_set); \ - } while (0) - -+#define setup_force_cpu_bug(bit) setup_force_cpu_cap(bit) -+ - #define cpu_has_fpu boot_cpu_has(X86_FEATURE_FPU) - #define cpu_has_de boot_cpu_has(X86_FEATURE_DE) - #define cpu_has_pse boot_cpu_has(X86_FEATURE_PSE) -diff --git a/arch/x86/include/asm/kaiser.h b/arch/x86/include/asm/kaiser.h -index 802bbbdfe143..48c791a411ab 100644 ---- a/arch/x86/include/asm/kaiser.h -+++ b/arch/x86/include/asm/kaiser.h -@@ -19,6 +19,16 @@ - - #define KAISER_SHADOW_PGD_OFFSET 0x1000 - -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+/* -+ * A page table address must have this alignment to stay the same when -+ * KAISER_SHADOW_PGD_OFFSET mask is applied -+ */ -+#define KAISER_KERNEL_PGD_ALIGNMENT (KAISER_SHADOW_PGD_OFFSET << 1) -+#else -+#define KAISER_KERNEL_PGD_ALIGNMENT PAGE_SIZE -+#endif -+ - #ifdef __ASSEMBLY__ - #ifdef CONFIG_PAGE_TABLE_ISOLATION - -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index f3bdaed0188f..c124d6ab4bf9 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -156,8 +156,8 @@ extern struct cpuinfo_x86 boot_cpu_data; - extern struct cpuinfo_x86 new_cpu_data; - - extern struct tss_struct doublefault_tss; --extern __u32 cpu_caps_cleared[NCAPINTS]; --extern __u32 cpu_caps_set[NCAPINTS]; -+extern __u32 cpu_caps_cleared[NCAPINTS + NBUGINTS]; -+extern __u32 cpu_caps_set[NCAPINTS + NBUGINTS]; - - #ifdef CONFIG_SMP - DECLARE_PER_CPU_READ_MOSTLY(struct cpuinfo_x86, cpu_info); -diff --git a/arch/x86/include/asm/pvclock.h b/arch/x86/include/asm/pvclock.h -index 6045cef376c2..c926255745e1 100644 ---- a/arch/x86/include/asm/pvclock.h -+++ b/arch/x86/include/asm/pvclock.h -@@ -4,7 +4,7 @@ - #include - #include - --#ifdef CONFIG_PARAVIRT_CLOCK -+#ifdef CONFIG_KVM_GUEST - extern struct pvclock_vsyscall_time_info *pvclock_pvti_cpu0_va(void); - #else - static inline struct pvclock_vsyscall_time_info *pvclock_pvti_cpu0_va(void) -diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c -index 1e5eb9f2ff5f..a1e4a6c3f394 100644 ---- a/arch/x86/kernel/acpi/boot.c -+++ b/arch/x86/kernel/acpi/boot.c -@@ -321,13 +321,12 @@ acpi_parse_lapic_nmi(struct acpi_subtable_header * header, const unsigned long e - #ifdef CONFIG_X86_IO_APIC - #define MP_ISA_BUS 0 - -+static int __init mp_register_ioapic_irq(u8 bus_irq, u8 polarity, -+ u8 trigger, u32 gsi); -+ - static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, - u32 gsi) - { -- int ioapic; -- int pin; -- struct mpc_intsrc mp_irq; -- - /* - * Check bus_irq boundary. - */ -@@ -336,14 +335,6 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, - return; - } - -- /* -- * Convert 'gsi' to 'ioapic.pin'. -- */ -- ioapic = mp_find_ioapic(gsi); -- if (ioapic < 0) -- return; -- pin = mp_find_ioapic_pin(ioapic, gsi); -- - /* - * TBD: This check is for faulty timer entries, where the override - * erroneously sets the trigger to level, resulting in a HUGE -@@ -352,16 +343,8 @@ static void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, - if ((bus_irq == 0) && (trigger == 3)) - trigger = 1; - -- mp_irq.type = MP_INTSRC; -- mp_irq.irqtype = mp_INT; -- mp_irq.irqflag = (trigger << 2) | polarity; -- mp_irq.srcbus = MP_ISA_BUS; -- mp_irq.srcbusirq = bus_irq; /* IRQ */ -- mp_irq.dstapic = mpc_ioapic_id(ioapic); /* APIC ID */ -- mp_irq.dstirq = pin; /* INTIN# */ -- -- mp_save_irq(&mp_irq); -- -+ if (mp_register_ioapic_irq(bus_irq, polarity, trigger, gsi) < 0) -+ return; - /* - * Reset default identity mapping if gsi is also an legacy IRQ, - * otherwise there will be more than one entry with the same GSI -@@ -408,6 +391,34 @@ static int mp_config_acpi_gsi(struct device *dev, u32 gsi, int trigger, - return 0; - } - -+static int __init mp_register_ioapic_irq(u8 bus_irq, u8 polarity, -+ u8 trigger, u32 gsi) -+{ -+ struct mpc_intsrc mp_irq; -+ int ioapic, pin; -+ -+ /* Convert 'gsi' to 'ioapic.pin'(INTIN#) */ -+ ioapic = mp_find_ioapic(gsi); -+ if (ioapic < 0) { -+ pr_warn("Failed to find ioapic for gsi : %u\n", gsi); -+ return ioapic; -+ } -+ -+ pin = mp_find_ioapic_pin(ioapic, gsi); -+ -+ mp_irq.type = MP_INTSRC; -+ mp_irq.irqtype = mp_INT; -+ mp_irq.irqflag = (trigger << 2) | polarity; -+ mp_irq.srcbus = MP_ISA_BUS; -+ mp_irq.srcbusirq = bus_irq; -+ mp_irq.dstapic = mpc_ioapic_id(ioapic); -+ mp_irq.dstirq = pin; -+ -+ mp_save_irq(&mp_irq); -+ -+ return 0; -+} -+ - static int __init - acpi_parse_ioapic(struct acpi_subtable_header * header, const unsigned long end) - { -@@ -452,7 +463,11 @@ static void __init acpi_sci_ioapic_setup(u8 bus_irq, u16 polarity, u16 trigger, - if (acpi_sci_flags & ACPI_MADT_POLARITY_MASK) - polarity = acpi_sci_flags & ACPI_MADT_POLARITY_MASK; - -- mp_override_legacy_irq(bus_irq, polarity, trigger, gsi); -+ if (bus_irq < NR_IRQS_LEGACY) -+ mp_override_legacy_irq(bus_irq, polarity, trigger, gsi); -+ else -+ mp_register_ioapic_irq(bus_irq, polarity, trigger, gsi); -+ - acpi_penalize_sci_irq(bus_irq, trigger, polarity); - - /* -diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c -index 25f909362b7a..d6f375f1b928 100644 ---- a/arch/x86/kernel/alternative.c -+++ b/arch/x86/kernel/alternative.c -@@ -339,9 +339,12 @@ done: - static void __init_or_module optimize_nops(struct alt_instr *a, u8 *instr) - { - unsigned long flags; -+ int i; - -- if (instr[0] != 0x90) -- return; -+ for (i = 0; i < a->padlen; i++) { -+ if (instr[i] != 0x90) -+ return; -+ } - - local_irq_save(flags); - add_nops(instr + (a->instrlen - a->padlen), a->padlen); -diff --git a/arch/x86/kernel/cpu/Makefile b/arch/x86/kernel/cpu/Makefile -index 58031303e304..8f184615053b 100644 ---- a/arch/x86/kernel/cpu/Makefile -+++ b/arch/x86/kernel/cpu/Makefile -@@ -16,13 +16,11 @@ obj-y := intel_cacheinfo.o scattered.o topology.o - obj-y += common.o - obj-y += rdrand.o - obj-y += match.o -+obj-y += bugs.o - - obj-$(CONFIG_PROC_FS) += proc.o - obj-$(CONFIG_X86_FEATURE_NAMES) += capflags.o powerflags.o - --obj-$(CONFIG_X86_32) += bugs.o --obj-$(CONFIG_X86_64) += bugs_64.o -- - obj-$(CONFIG_CPU_SUP_INTEL) += intel.o - obj-$(CONFIG_CPU_SUP_AMD) += amd.o - obj-$(CONFIG_CPU_SUP_CYRIX_32) += cyrix.o -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 0b6124315441..cd46f9039119 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -9,6 +9,7 @@ - */ - #include - #include -+#include - #include - #include - #include -@@ -16,6 +17,8 @@ - #include - #include - #include -+#include -+#include - - void __init check_bugs(void) - { -@@ -28,11 +31,13 @@ void __init check_bugs(void) - #endif - - identify_boot_cpu(); --#ifndef CONFIG_SMP -- pr_info("CPU: "); -- print_cpu_info(&boot_cpu_data); --#endif - -+ if (!IS_ENABLED(CONFIG_SMP)) { -+ pr_info("CPU: "); -+ print_cpu_info(&boot_cpu_data); -+ } -+ -+#ifdef CONFIG_X86_32 - /* - * Check whether we are able to run this kernel safely on SMP. - * -@@ -48,4 +53,46 @@ void __init check_bugs(void) - alternative_instructions(); - - fpu__init_check_bugs(); -+#else /* CONFIG_X86_64 */ -+ alternative_instructions(); -+ -+ /* -+ * Make sure the first 2MB area is not mapped by huge pages -+ * There are typically fixed size MTRRs in there and overlapping -+ * MTRRs into large pages causes slow downs. -+ * -+ * Right now we don't do that with gbpages because there seems -+ * very little benefit for that case. -+ */ -+ if (!direct_gbpages) -+ set_memory_4k((unsigned long)__va(0), 1); -+#endif - } -+ -+#ifdef CONFIG_SYSFS -+ssize_t cpu_show_meltdown(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ if (!boot_cpu_has_bug(X86_BUG_CPU_MELTDOWN)) -+ return sprintf(buf, "Not affected\n"); -+ if (boot_cpu_has(X86_FEATURE_KAISER)) -+ return sprintf(buf, "Mitigation: PTI\n"); -+ return sprintf(buf, "Vulnerable\n"); -+} -+ -+ssize_t cpu_show_spectre_v1(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1)) -+ return sprintf(buf, "Not affected\n"); -+ return sprintf(buf, "Vulnerable\n"); -+} -+ -+ssize_t cpu_show_spectre_v2(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) -+ return sprintf(buf, "Not affected\n"); -+ return sprintf(buf, "Vulnerable\n"); -+} -+#endif -diff --git a/arch/x86/kernel/cpu/bugs_64.c b/arch/x86/kernel/cpu/bugs_64.c -deleted file mode 100644 -index 04f0fe5af83e..000000000000 ---- a/arch/x86/kernel/cpu/bugs_64.c -+++ /dev/null -@@ -1,33 +0,0 @@ --/* -- * Copyright (C) 1994 Linus Torvalds -- * Copyright (C) 2000 SuSE -- */ -- --#include --#include --#include --#include --#include --#include --#include -- --void __init check_bugs(void) --{ -- identify_boot_cpu(); --#if !defined(CONFIG_SMP) -- printk(KERN_INFO "CPU: "); -- print_cpu_info(&boot_cpu_data); --#endif -- alternative_instructions(); -- -- /* -- * Make sure the first 2MB area is not mapped by huge pages -- * There are typically fixed size MTRRs in there and overlapping -- * MTRRs into large pages causes slow downs. -- * -- * Right now we don't do that with gbpages because there seems -- * very little benefit for that case. -- */ -- if (!direct_gbpages) -- set_memory_4k((unsigned long)__va(0), 1); --} -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index cc154ac64f00..dc4dfad66a70 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -432,8 +432,8 @@ static const char *table_lookup_model(struct cpuinfo_x86 *c) - return NULL; /* Not found */ - } - --__u32 cpu_caps_cleared[NCAPINTS]; --__u32 cpu_caps_set[NCAPINTS]; -+__u32 cpu_caps_cleared[NCAPINTS + NBUGINTS]; -+__u32 cpu_caps_set[NCAPINTS + NBUGINTS]; - - void load_percpu_segment(int cpu) - { -@@ -664,6 +664,16 @@ void cpu_detect(struct cpuinfo_x86 *c) - } - } - -+static void apply_forced_caps(struct cpuinfo_x86 *c) -+{ -+ int i; -+ -+ for (i = 0; i < NCAPINTS + NBUGINTS; i++) { -+ c->x86_capability[i] &= ~cpu_caps_cleared[i]; -+ c->x86_capability[i] |= cpu_caps_set[i]; -+ } -+} -+ - void get_cpu_cap(struct cpuinfo_x86 *c) - { - u32 tfms, xlvl; -@@ -820,6 +830,13 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) - } - - setup_force_cpu_cap(X86_FEATURE_ALWAYS); -+ -+ /* Assume for now that ALL x86 CPUs are insecure */ -+ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); -+ -+ setup_force_cpu_bug(X86_BUG_SPECTRE_V1); -+ setup_force_cpu_bug(X86_BUG_SPECTRE_V2); -+ - fpu__init_system(c); - } - -@@ -955,11 +972,8 @@ static void identify_cpu(struct cpuinfo_x86 *c) - if (this_cpu->c_identify) - this_cpu->c_identify(c); - -- /* Clear/Set all flags overriden by options, after probe */ -- for (i = 0; i < NCAPINTS; i++) { -- c->x86_capability[i] &= ~cpu_caps_cleared[i]; -- c->x86_capability[i] |= cpu_caps_set[i]; -- } -+ /* Clear/Set all flags overridden by options, after probe */ -+ apply_forced_caps(c); - - #ifdef CONFIG_X86_64 - c->apicid = apic->phys_pkg_id(c->initial_apicid, 0); -@@ -1020,10 +1034,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) - * Clear/Set all flags overriden by options, need do it - * before following smp all cpus cap AND. - */ -- for (i = 0; i < NCAPINTS; i++) { -- c->x86_capability[i] &= ~cpu_caps_cleared[i]; -- c->x86_capability[i] |= cpu_caps_set[i]; -- } -+ apply_forced_caps(c); - - /* - * On SMP, boot_cpu_data holds the common feature set between -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index abf581ade8d2..b428a8174be1 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -994,9 +994,17 @@ static bool is_blacklisted(unsigned int cpu) - { - struct cpuinfo_x86 *c = &cpu_data(cpu); - -- if (c->x86 == 6 && c->x86_model == 79) { -- pr_err_once("late loading on model 79 is disabled.\n"); -- return true; -+ /* -+ * Late loading on model 79 with microcode revision less than 0x0b000021 -+ * may result in a system hang. This behavior is documented in item -+ * BDF90, #334165 (Intel Xeon Processor E7-8800/4800 v4 Product Family). -+ */ -+ if (c->x86 == 6 && -+ c->x86_model == 79 && -+ c->x86_mask == 0x01 && -+ c->microcode < 0x0b000021) { -+ pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode); -+ pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); - } - - return false; -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 4b1152e57340..900ffb6c28b5 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -3855,6 +3855,25 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) - "mov %%r13, %c[r13](%[svm]) \n\t" - "mov %%r14, %c[r14](%[svm]) \n\t" - "mov %%r15, %c[r15](%[svm]) \n\t" -+#endif -+ /* -+ * Clear host registers marked as clobbered to prevent -+ * speculative use. -+ */ -+ "xor %%" _ASM_BX ", %%" _ASM_BX " \n\t" -+ "xor %%" _ASM_CX ", %%" _ASM_CX " \n\t" -+ "xor %%" _ASM_DX ", %%" _ASM_DX " \n\t" -+ "xor %%" _ASM_SI ", %%" _ASM_SI " \n\t" -+ "xor %%" _ASM_DI ", %%" _ASM_DI " \n\t" -+#ifdef CONFIG_X86_64 -+ "xor %%r8, %%r8 \n\t" -+ "xor %%r9, %%r9 \n\t" -+ "xor %%r10, %%r10 \n\t" -+ "xor %%r11, %%r11 \n\t" -+ "xor %%r12, %%r12 \n\t" -+ "xor %%r13, %%r13 \n\t" -+ "xor %%r14, %%r14 \n\t" -+ "xor %%r15, %%r15 \n\t" - #endif - "pop %%" _ASM_BP - : -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index d915185ada05..c26255f19603 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -828,8 +828,16 @@ static inline short vmcs_field_to_offset(unsigned long field) - { - BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX); - -- if (field >= ARRAY_SIZE(vmcs_field_to_offset_table) || -- vmcs_field_to_offset_table[field] == 0) -+ if (field >= ARRAY_SIZE(vmcs_field_to_offset_table)) -+ return -ENOENT; -+ -+ /* -+ * FIXME: Mitigation for CVE-2017-5753. To be replaced with a -+ * generic mechanism. -+ */ -+ asm("lfence"); -+ -+ if (vmcs_field_to_offset_table[field] == 0) - return -ENOENT; - - return vmcs_field_to_offset_table[field]; -@@ -8623,6 +8631,7 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - /* Save guest registers, load host registers, keep flags */ - "mov %0, %c[wordsize](%%" _ASM_SP ") \n\t" - "pop %0 \n\t" -+ "setbe %c[fail](%0)\n\t" - "mov %%" _ASM_AX ", %c[rax](%0) \n\t" - "mov %%" _ASM_BX ", %c[rbx](%0) \n\t" - __ASM_SIZE(pop) " %c[rcx](%0) \n\t" -@@ -8639,12 +8648,23 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - "mov %%r13, %c[r13](%0) \n\t" - "mov %%r14, %c[r14](%0) \n\t" - "mov %%r15, %c[r15](%0) \n\t" -+ "xor %%r8d, %%r8d \n\t" -+ "xor %%r9d, %%r9d \n\t" -+ "xor %%r10d, %%r10d \n\t" -+ "xor %%r11d, %%r11d \n\t" -+ "xor %%r12d, %%r12d \n\t" -+ "xor %%r13d, %%r13d \n\t" -+ "xor %%r14d, %%r14d \n\t" -+ "xor %%r15d, %%r15d \n\t" - #endif - "mov %%cr2, %%" _ASM_AX " \n\t" - "mov %%" _ASM_AX ", %c[cr2](%0) \n\t" - -+ "xor %%eax, %%eax \n\t" -+ "xor %%ebx, %%ebx \n\t" -+ "xor %%esi, %%esi \n\t" -+ "xor %%edi, %%edi \n\t" - "pop %%" _ASM_BP "; pop %%" _ASM_DX " \n\t" -- "setbe %c[fail](%0) \n\t" - ".pushsection .rodata \n\t" - ".global vmx_return \n\t" - "vmx_return: " _ASM_PTR " 2b \n\t" -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index ccf17dbfea09..f973cfa8ff4f 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -4114,7 +4114,7 @@ static int vcpu_mmio_read(struct kvm_vcpu *vcpu, gpa_t addr, int len, void *v) - addr, n, v)) - && kvm_io_bus_read(vcpu, KVM_MMIO_BUS, addr, n, v)) - break; -- trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, *(u64 *)v); -+ trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, v); - handled += n; - addr += n; - len -= n; -@@ -4362,7 +4362,7 @@ static int read_prepare(struct kvm_vcpu *vcpu, void *val, int bytes) - { - if (vcpu->mmio_read_completed) { - trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes, -- vcpu->mmio_fragments[0].gpa, *(u64 *)val); -+ vcpu->mmio_fragments[0].gpa, val); - vcpu->mmio_read_completed = 0; - return 1; - } -@@ -4384,14 +4384,14 @@ static int write_emulate(struct kvm_vcpu *vcpu, gpa_t gpa, - - static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val) - { -- trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val); -+ trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, val); - return vcpu_mmio_write(vcpu, gpa, bytes, val); - } - - static int read_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, - void *val, int bytes) - { -- trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, 0); -+ trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, NULL); - return X86EMUL_IO_NEEDED; - } - -diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c -index 6a7a77929a8c..8af98513d36c 100644 ---- a/arch/x86/mm/kaiser.c -+++ b/arch/x86/mm/kaiser.c -@@ -198,6 +198,8 @@ static int kaiser_add_user_map(const void *__start_addr, unsigned long size, - * requires that not to be #defined to 0): so mask it off here. - */ - flags &= ~_PAGE_GLOBAL; -+ if (!(__supported_pte_mask & _PAGE_NX)) -+ flags &= ~_PAGE_NX; - - for (; address < end_addr; address += PAGE_SIZE) { - target_address = get_pa_from_mapping(address); -diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c -index 3f1bb4f93a5a..3146b1da6d72 100644 ---- a/arch/x86/mm/pat.c -+++ b/arch/x86/mm/pat.c -@@ -750,11 +750,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size) - return 1; - - while (cursor < to) { -- if (!devmem_is_allowed(pfn)) { -- pr_info("x86/PAT: Program %s tried to access /dev/mem between [mem %#010Lx-%#010Lx], PAT prevents it\n", -- current->comm, from, to - 1); -+ if (!devmem_is_allowed(pfn)) - return 0; -- } - cursor += PAGE_SIZE; - pfn++; - } -diff --git a/arch/x86/realmode/init.c b/arch/x86/realmode/init.c -index 0b7a63d98440..805a3271a137 100644 ---- a/arch/x86/realmode/init.c -+++ b/arch/x86/realmode/init.c -@@ -4,6 +4,7 @@ - #include - #include - #include -+#include - - struct real_mode_header *real_mode_header; - u32 *trampoline_cr4_features; -@@ -15,7 +16,8 @@ void __init reserve_real_mode(void) - size_t size = PAGE_ALIGN(real_mode_blob_end - real_mode_blob); - - /* Has to be under 1M so we can execute real-mode AP code. */ -- mem = memblock_find_in_range(0, 1<<20, size, PAGE_SIZE); -+ mem = memblock_find_in_range(0, 1 << 20, size, -+ KAISER_KERNEL_PGD_ALIGNMENT); - if (!mem) - panic("Cannot allocate trampoline\n"); - -diff --git a/arch/x86/realmode/rm/trampoline_64.S b/arch/x86/realmode/rm/trampoline_64.S -index dac7b20d2f9d..781cca63f795 100644 ---- a/arch/x86/realmode/rm/trampoline_64.S -+++ b/arch/x86/realmode/rm/trampoline_64.S -@@ -30,6 +30,7 @@ - #include - #include - #include -+#include - #include "realmode.h" - - .text -@@ -139,7 +140,7 @@ tr_gdt: - tr_gdt_end: - - .bss -- .balign PAGE_SIZE -+ .balign KAISER_KERNEL_PGD_ALIGNMENT - GLOBAL(trampoline_pgd) .space PAGE_SIZE - - .balign 8 -diff --git a/crypto/algapi.c b/crypto/algapi.c -index 43f5bdb6b570..eb58b73ca925 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -168,6 +168,18 @@ void crypto_remove_spawns(struct crypto_alg *alg, struct list_head *list, - - spawn->alg = NULL; - spawns = &inst->alg.cra_users; -+ -+ /* -+ * We may encounter an unregistered instance here, since -+ * an instance's spawns are set up prior to the instance -+ * being registered. An unregistered instance will have -+ * NULL ->cra_users.next, since ->cra_users isn't -+ * properly initialized until registration. But an -+ * unregistered instance cannot have any users, so treat -+ * it the same as ->cra_users being empty. -+ */ -+ if (spawns->next == NULL) -+ break; - } - } while ((spawns = crypto_more_spawns(alg, &stack, &top, - &secondary_spawns))); -diff --git a/drivers/base/Kconfig b/drivers/base/Kconfig -index 98504ec99c7d..59992788966c 100644 ---- a/drivers/base/Kconfig -+++ b/drivers/base/Kconfig -@@ -223,6 +223,9 @@ config GENERIC_CPU_DEVICES - config GENERIC_CPU_AUTOPROBE - bool - -+config GENERIC_CPU_VULNERABILITIES -+ bool -+ - config SOC_BUS - bool - -diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c -index 91bbb1959d8d..3db71afbba93 100644 ---- a/drivers/base/cpu.c -+++ b/drivers/base/cpu.c -@@ -498,10 +498,58 @@ static void __init cpu_dev_register_generic(void) - #endif - } - -+#ifdef CONFIG_GENERIC_CPU_VULNERABILITIES -+ -+ssize_t __weak cpu_show_meltdown(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ -+ssize_t __weak cpu_show_spectre_v1(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ -+ssize_t __weak cpu_show_spectre_v2(struct device *dev, -+ struct device_attribute *attr, char *buf) -+{ -+ return sprintf(buf, "Not affected\n"); -+} -+ -+static DEVICE_ATTR(meltdown, 0444, cpu_show_meltdown, NULL); -+static DEVICE_ATTR(spectre_v1, 0444, cpu_show_spectre_v1, NULL); -+static DEVICE_ATTR(spectre_v2, 0444, cpu_show_spectre_v2, NULL); -+ -+static struct attribute *cpu_root_vulnerabilities_attrs[] = { -+ &dev_attr_meltdown.attr, -+ &dev_attr_spectre_v1.attr, -+ &dev_attr_spectre_v2.attr, -+ NULL -+}; -+ -+static const struct attribute_group cpu_root_vulnerabilities_group = { -+ .name = "vulnerabilities", -+ .attrs = cpu_root_vulnerabilities_attrs, -+}; -+ -+static void __init cpu_register_vulnerabilities(void) -+{ -+ if (sysfs_create_group(&cpu_subsys.dev_root->kobj, -+ &cpu_root_vulnerabilities_group)) -+ pr_err("Unable to register CPU vulnerabilities\n"); -+} -+ -+#else -+static inline void cpu_register_vulnerabilities(void) { } -+#endif -+ - void __init cpu_dev_init(void) - { - if (subsys_system_register(&cpu_subsys, cpu_root_attr_groups)) - panic("Failed to register CPU subsystem"); - - cpu_dev_register_generic(); -+ cpu_register_vulnerabilities(); - } -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index ca3bcc81b623..e0699a20859f 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -3767,7 +3767,7 @@ static int rbd_init_disk(struct rbd_device *rbd_dev) - segment_size = rbd_obj_bytes(&rbd_dev->header); - blk_queue_max_hw_sectors(q, segment_size / SECTOR_SIZE); - q->limits.max_sectors = queue_max_hw_sectors(q); -- blk_queue_max_segments(q, segment_size / SECTOR_SIZE); -+ blk_queue_max_segments(q, USHRT_MAX); - blk_queue_max_segment_size(q, segment_size); - blk_queue_io_min(q, segment_size); - blk_queue_io_opt(q, segment_size); -diff --git a/drivers/char/hw_random/core.c b/drivers/char/hw_random/core.c -index cf25020576fa..340f96e44642 100644 ---- a/drivers/char/hw_random/core.c -+++ b/drivers/char/hw_random/core.c -@@ -238,7 +238,10 @@ static ssize_t rng_dev_read(struct file *filp, char __user *buf, - goto out; - } - -- mutex_lock(&reading_mutex); -+ if (mutex_lock_interruptible(&reading_mutex)) { -+ err = -ERESTARTSYS; -+ goto out_put; -+ } - if (!data_avail) { - bytes_read = rng_get_data(rng, rng_buffer, - rng_buffer_size(), -@@ -288,6 +291,7 @@ out: - - out_unlock_reading: - mutex_unlock(&reading_mutex); -+out_put: - put_rng(rng); - goto out; - } -diff --git a/drivers/char/mem.c b/drivers/char/mem.c -index 2898d19fadf5..23f52a897283 100644 ---- a/drivers/char/mem.c -+++ b/drivers/char/mem.c -@@ -70,12 +70,8 @@ static inline int range_is_allowed(unsigned long pfn, unsigned long size) - u64 cursor = from; - - while (cursor < to) { -- if (!devmem_is_allowed(pfn)) { -- printk(KERN_INFO -- "Program %s tried to access /dev/mem between %Lx->%Lx.\n", -- current->comm, from, to); -+ if (!devmem_is_allowed(pfn)) - return 0; -- } - cursor += PAGE_SIZE; - pfn++; - } -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -index 04fd0f2b6af0..fda8e85dd5a2 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c -@@ -2678,6 +2678,8 @@ static int vmw_cmd_dx_view_define(struct vmw_private *dev_priv, - } - - view_type = vmw_view_cmd_to_type(header->id); -+ if (view_type == vmw_view_max) -+ return -EINVAL; - cmd = container_of(header, typeof(*cmd), header); - ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface, - user_surface_converter, -diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c -index c52131233ba7..a73874508c3a 100644 ---- a/drivers/infiniband/ulp/srpt/ib_srpt.c -+++ b/drivers/infiniband/ulp/srpt/ib_srpt.c -@@ -957,8 +957,7 @@ static int srpt_init_ch_qp(struct srpt_rdma_ch *ch, struct ib_qp *qp) - return -ENOMEM; - - attr->qp_state = IB_QPS_INIT; -- attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE | IB_ACCESS_REMOTE_READ | -- IB_ACCESS_REMOTE_WRITE; -+ attr->qp_access_flags = IB_ACCESS_LOCAL_WRITE; - attr->port_num = ch->sport->port; - attr->pkey_index = 0; - -diff --git a/drivers/iommu/arm-smmu-v3.c b/drivers/iommu/arm-smmu-v3.c -index 64f1eb8fdcbc..347aaaa5a7ea 100644 ---- a/drivers/iommu/arm-smmu-v3.c -+++ b/drivers/iommu/arm-smmu-v3.c -@@ -1541,13 +1541,15 @@ static int arm_smmu_domain_finalise(struct iommu_domain *domain) - return -ENOMEM; - - arm_smmu_ops.pgsize_bitmap = pgtbl_cfg.pgsize_bitmap; -- smmu_domain->pgtbl_ops = pgtbl_ops; - - ret = finalise_stage_fn(smmu_domain, &pgtbl_cfg); -- if (IS_ERR_VALUE(ret)) -+ if (IS_ERR_VALUE(ret)) { - free_io_pgtable_ops(pgtbl_ops); -+ return ret; -+ } - -- return ret; -+ smmu_domain->pgtbl_ops = pgtbl_ops; -+ return 0; - } - - static struct arm_smmu_group *arm_smmu_group_get(struct device *dev) -diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c -index 2ec7f90e3455..969c815c90b6 100644 ---- a/drivers/md/dm-bufio.c -+++ b/drivers/md/dm-bufio.c -@@ -1527,7 +1527,8 @@ static unsigned long __scan(struct dm_bufio_client *c, unsigned long nr_to_scan, - int l; - struct dm_buffer *b, *tmp; - unsigned long freed = 0; -- unsigned long count = nr_to_scan; -+ unsigned long count = c->n_buffers[LIST_CLEAN] + -+ c->n_buffers[LIST_DIRTY]; - unsigned long retain_target = get_retain_buffers(c); - - for (l = 0; l < LIST_SIZE; l++) { -@@ -1564,6 +1565,7 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc) - { - struct dm_bufio_client *c; - unsigned long count; -+ unsigned long retain_target; - - c = container_of(shrink, struct dm_bufio_client, shrinker); - if (sc->gfp_mask & __GFP_FS) -@@ -1572,8 +1574,9 @@ dm_bufio_shrink_count(struct shrinker *shrink, struct shrink_control *sc) - return 0; - - count = c->n_buffers[LIST_CLEAN] + c->n_buffers[LIST_DIRTY]; -+ retain_target = get_retain_buffers(c); - dm_bufio_unlock(c); -- return count; -+ return (count < retain_target) ? 0 : (count - retain_target); - } - - /* -diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c -index 91d709efef7a..cafc34938a79 100644 ---- a/drivers/media/usb/usbvision/usbvision-video.c -+++ b/drivers/media/usb/usbvision/usbvision-video.c -@@ -1461,6 +1461,13 @@ static int usbvision_probe(struct usb_interface *intf, - printk(KERN_INFO "%s: %s found\n", __func__, - usbvision_device_data[model].model_string); - -+ /* -+ * this is a security check. -+ * an exploit using an incorrect bInterfaceNumber is known -+ */ -+ if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) -+ return -ENODEV; -+ - if (usbvision_device_data[model].interface >= 0) - interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; - else if (ifnum < dev->actconfig->desc.bNumInterfaces) -diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c -index 27e2352fcc42..b227f81e4a7e 100644 ---- a/drivers/net/can/usb/gs_usb.c -+++ b/drivers/net/can/usb/gs_usb.c -@@ -430,7 +430,7 @@ static int gs_usb_set_bittiming(struct net_device *netdev) - dev_err(netdev->dev.parent, "Couldn't set bittimings (err=%d)", - rc); - -- return rc; -+ return (rc > 0) ? 0 : rc; - } - - static void gs_usb_xmit_callback(struct urb *urb) -diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c -index 91a5a0ae9cd7..1908a38e7f31 100644 ---- a/drivers/net/ethernet/intel/e1000e/ich8lan.c -+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c -@@ -1362,6 +1362,9 @@ out: - * Checks to see of the link status of the hardware has changed. If a - * change in link status has been detected, then we read the PHY registers - * to get the current speed/duplex if link exists. -+ * -+ * Returns a negative error code (-E1000_ERR_*) or 0 (link down) or 1 (link -+ * up). - **/ - static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) - { -@@ -1377,7 +1380,7 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) - * Change or Rx Sequence Error interrupt. - */ - if (!mac->get_link_status) -- return 0; -+ return 1; - - /* First we want to see if the MII Status Register reports - * link. If so, then we want to get the current speed/duplex -@@ -1585,10 +1588,12 @@ static s32 e1000_check_for_copper_link_ich8lan(struct e1000_hw *hw) - * different link partner. - */ - ret_val = e1000e_config_fc_after_link_up(hw); -- if (ret_val) -+ if (ret_val) { - e_dbg("Error configuring flow control\n"); -+ return ret_val; -+ } - -- return ret_val; -+ return 1; - } - - static s32 e1000_get_variants_ich8lan(struct e1000_adapter *adapter) -diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c -index 479af106aaeb..424d1dee55c9 100644 ---- a/drivers/net/ethernet/renesas/sh_eth.c -+++ b/drivers/net/ethernet/renesas/sh_eth.c -@@ -3176,18 +3176,37 @@ static int sh_eth_drv_probe(struct platform_device *pdev) - /* ioremap the TSU registers */ - if (mdp->cd->tsu) { - struct resource *rtsu; -+ - rtsu = platform_get_resource(pdev, IORESOURCE_MEM, 1); -- mdp->tsu_addr = devm_ioremap_resource(&pdev->dev, rtsu); -- if (IS_ERR(mdp->tsu_addr)) { -- ret = PTR_ERR(mdp->tsu_addr); -+ if (!rtsu) { -+ dev_err(&pdev->dev, "no TSU resource\n"); -+ ret = -ENODEV; -+ goto out_release; -+ } -+ /* We can only request the TSU region for the first port -+ * of the two sharing this TSU for the probe to succeed... -+ */ -+ if (devno % 2 == 0 && -+ !devm_request_mem_region(&pdev->dev, rtsu->start, -+ resource_size(rtsu), -+ dev_name(&pdev->dev))) { -+ dev_err(&pdev->dev, "can't request TSU resource.\n"); -+ ret = -EBUSY; -+ goto out_release; -+ } -+ mdp->tsu_addr = devm_ioremap(&pdev->dev, rtsu->start, -+ resource_size(rtsu)); -+ if (!mdp->tsu_addr) { -+ dev_err(&pdev->dev, "TSU region ioremap() failed.\n"); -+ ret = -ENOMEM; - goto out_release; - } - mdp->port = devno % 2; - ndev->features = NETIF_F_HW_VLAN_CTAG_FILTER; - } - -- /* initialize first or needed device */ -- if (!devno || pd->needs_init) { -+ /* Need to init only the first port of the two sharing a TSU */ -+ if (devno % 2 == 0) { - if (mdp->cd->chip_reset) - mdp->cd->chip_reset(ndev); - -diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -index 4b100ef4af9f..5adaf537513b 100644 ---- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c -@@ -272,8 +272,14 @@ bool stmmac_eee_init(struct stmmac_priv *priv) - { - char *phy_bus_name = priv->plat->phy_bus_name; - unsigned long flags; -+ int interface = priv->plat->interface; - bool ret = false; - -+ if ((interface != PHY_INTERFACE_MODE_MII) && -+ (interface != PHY_INTERFACE_MODE_GMII) && -+ !phy_interface_mode_is_rgmii(interface)) -+ goto out; -+ - /* Using PCS we cannot dial with the phy registers at this stage - * so we do not support extra feature like EEE. - */ -diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c -index e221bfcee76b..947bea81d924 100644 ---- a/drivers/net/usb/cx82310_eth.c -+++ b/drivers/net/usb/cx82310_eth.c -@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb, - { - int len = skb->len; - -- if (skb_headroom(skb) < 2) { -- struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags); -+ if (skb_cow_head(skb, 2)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - skb_push(skb, 2); - -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 226668ead0d8..41e9ebd7d0a6 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -2050,14 +2050,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev, - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - if (lan78xx_linearize(skb) < 0) -diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c -index 304ec25eaf95..89950f5cea71 100644 ---- a/drivers/net/usb/r8152.c -+++ b/drivers/net/usb/r8152.c -@@ -25,12 +25,13 @@ - #include - #include - #include -+#include - - /* Information for net-next */ - #define NETNEXT_VERSION "08" - - /* Information for net */ --#define NET_VERSION "2" -+#define NET_VERSION "3" - - #define DRIVER_VERSION "v1." NETNEXT_VERSION "." NET_VERSION - #define DRIVER_AUTHOR "Realtek linux nic maintainers " -@@ -604,6 +605,9 @@ struct r8152 { - struct delayed_work schedule; - struct mii_if_info mii; - struct mutex control; /* use for hw setting */ -+#ifdef CONFIG_PM_SLEEP -+ struct notifier_block pm_notifier; -+#endif - - struct rtl_ops { - void (*init)(struct r8152 *); -@@ -1943,7 +1947,6 @@ static void _rtl8152_set_rx_mode(struct net_device *netdev) - __le32 tmp[2]; - u32 ocp_data; - -- clear_bit(RTL8152_SET_RX_MODE, &tp->flags); - netif_stop_queue(netdev); - ocp_data = ocp_read_dword(tp, MCU_TYPE_PLA, PLA_RCR); - ocp_data &= ~RCR_ACPT_ALL; -@@ -2429,8 +2432,6 @@ static void rtl_phy_reset(struct r8152 *tp) - u16 data; - int i; - -- clear_bit(PHY_RESET, &tp->flags); -- - data = r8152_mdio_read(tp, MII_BMCR); - - /* don't reset again before the previous one complete */ -@@ -2460,23 +2461,23 @@ static void r8153_teredo_off(struct r8152 *tp) - ocp_write_dword(tp, MCU_TYPE_PLA, PLA_TEREDO_TIMER, 0); - } - --static void r8152b_disable_aldps(struct r8152 *tp) -+static void r8152_aldps_en(struct r8152 *tp, bool enable) - { -- ocp_reg_write(tp, OCP_ALDPS_CONFIG, ENPDNPS | LINKENA | DIS_SDSAVE); -- msleep(20); --} -- --static inline void r8152b_enable_aldps(struct r8152 *tp) --{ -- ocp_reg_write(tp, OCP_ALDPS_CONFIG, ENPWRSAVE | ENPDNPS | -- LINKENA | DIS_SDSAVE); -+ if (enable) { -+ ocp_reg_write(tp, OCP_ALDPS_CONFIG, ENPWRSAVE | ENPDNPS | -+ LINKENA | DIS_SDSAVE); -+ } else { -+ ocp_reg_write(tp, OCP_ALDPS_CONFIG, ENPDNPS | LINKENA | -+ DIS_SDSAVE); -+ msleep(20); -+ } - } - - static void rtl8152_disable(struct r8152 *tp) - { -- r8152b_disable_aldps(tp); -+ r8152_aldps_en(tp, false); - rtl_disable(tp); -- r8152b_enable_aldps(tp); -+ r8152_aldps_en(tp, true); - } - - static void r8152b_hw_phy_cfg(struct r8152 *tp) -@@ -2788,30 +2789,26 @@ static void r8153_enter_oob(struct r8152 *tp) - ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data); - } - --static void r8153_disable_aldps(struct r8152 *tp) --{ -- u16 data; -- -- data = ocp_reg_read(tp, OCP_POWER_CFG); -- data &= ~EN_ALDPS; -- ocp_reg_write(tp, OCP_POWER_CFG, data); -- msleep(20); --} -- --static void r8153_enable_aldps(struct r8152 *tp) -+static void r8153_aldps_en(struct r8152 *tp, bool enable) - { - u16 data; - - data = ocp_reg_read(tp, OCP_POWER_CFG); -- data |= EN_ALDPS; -- ocp_reg_write(tp, OCP_POWER_CFG, data); -+ if (enable) { -+ data |= EN_ALDPS; -+ ocp_reg_write(tp, OCP_POWER_CFG, data); -+ } else { -+ data &= ~EN_ALDPS; -+ ocp_reg_write(tp, OCP_POWER_CFG, data); -+ msleep(20); -+ } - } - - static void rtl8153_disable(struct r8152 *tp) - { -- r8153_disable_aldps(tp); -+ r8153_aldps_en(tp, false); - rtl_disable(tp); -- r8153_enable_aldps(tp); -+ r8153_aldps_en(tp, true); - usb_enable_lpm(tp->udev); - } - -@@ -2889,10 +2886,9 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u16 speed, u8 duplex) - r8152_mdio_write(tp, MII_ADVERTISE, anar); - r8152_mdio_write(tp, MII_BMCR, bmcr); - -- if (test_bit(PHY_RESET, &tp->flags)) { -+ if (test_and_clear_bit(PHY_RESET, &tp->flags)) { - int i; - -- clear_bit(PHY_RESET, &tp->flags); - for (i = 0; i < 50; i++) { - msleep(20); - if ((r8152_mdio_read(tp, MII_BMCR) & BMCR_RESET) == 0) -@@ -2901,7 +2897,6 @@ static int rtl8152_set_speed(struct r8152 *tp, u8 autoneg, u16 speed, u8 duplex) - } - - out: -- - return ret; - } - -@@ -2910,9 +2905,9 @@ static void rtl8152_up(struct r8152 *tp) - if (test_bit(RTL8152_UNPLUG, &tp->flags)) - return; - -- r8152b_disable_aldps(tp); -+ r8152_aldps_en(tp, false); - r8152b_exit_oob(tp); -- r8152b_enable_aldps(tp); -+ r8152_aldps_en(tp, true); - } - - static void rtl8152_down(struct r8152 *tp) -@@ -2923,9 +2918,9 @@ static void rtl8152_down(struct r8152 *tp) - } - - r8152_power_cut_en(tp, false); -- r8152b_disable_aldps(tp); -+ r8152_aldps_en(tp, false); - r8152b_enter_oob(tp); -- r8152b_enable_aldps(tp); -+ r8152_aldps_en(tp, true); - } - - static void rtl8153_up(struct r8152 *tp) -@@ -2934,9 +2929,9 @@ static void rtl8153_up(struct r8152 *tp) - return; - - r8153_u1u2en(tp, false); -- r8153_disable_aldps(tp); -+ r8153_aldps_en(tp, false); - r8153_first_init(tp); -- r8153_enable_aldps(tp); -+ r8153_aldps_en(tp, true); - r8153_u2p3en(tp, true); - r8153_u1u2en(tp, true); - usb_enable_lpm(tp->udev); -@@ -2952,9 +2947,9 @@ static void rtl8153_down(struct r8152 *tp) - r8153_u1u2en(tp, false); - r8153_u2p3en(tp, false); - r8153_power_cut_en(tp, false); -- r8153_disable_aldps(tp); -+ r8153_aldps_en(tp, false); - r8153_enter_oob(tp); -- r8153_enable_aldps(tp); -+ r8153_aldps_en(tp, true); - } - - static bool rtl8152_in_nway(struct r8152 *tp) -@@ -2988,7 +2983,6 @@ static void set_carrier(struct r8152 *tp) - struct net_device *netdev = tp->netdev; - u8 speed; - -- clear_bit(RTL8152_LINK_CHG, &tp->flags); - speed = rtl8152_get_speed(tp); - - if (speed & LINK_STATUS) { -@@ -3038,20 +3032,18 @@ static void rtl_work_func_t(struct work_struct *work) - goto out1; - } - -- if (test_bit(RTL8152_LINK_CHG, &tp->flags)) -+ if (test_and_clear_bit(RTL8152_LINK_CHG, &tp->flags)) - set_carrier(tp); - -- if (test_bit(RTL8152_SET_RX_MODE, &tp->flags)) -+ if (test_and_clear_bit(RTL8152_SET_RX_MODE, &tp->flags)) - _rtl8152_set_rx_mode(tp->netdev); - - /* don't schedule napi before linking */ -- if (test_bit(SCHEDULE_NAPI, &tp->flags) && -- netif_carrier_ok(tp->netdev)) { -- clear_bit(SCHEDULE_NAPI, &tp->flags); -+ if (test_and_clear_bit(SCHEDULE_NAPI, &tp->flags) && -+ netif_carrier_ok(tp->netdev)) - napi_schedule(&tp->napi); -- } - -- if (test_bit(PHY_RESET, &tp->flags)) -+ if (test_and_clear_bit(PHY_RESET, &tp->flags)) - rtl_phy_reset(tp); - - mutex_unlock(&tp->control); -@@ -3060,6 +3052,33 @@ out1: - usb_autopm_put_interface(tp->intf); - } - -+#ifdef CONFIG_PM_SLEEP -+static int rtl_notifier(struct notifier_block *nb, unsigned long action, -+ void *data) -+{ -+ struct r8152 *tp = container_of(nb, struct r8152, pm_notifier); -+ -+ switch (action) { -+ case PM_HIBERNATION_PREPARE: -+ case PM_SUSPEND_PREPARE: -+ usb_autopm_get_interface(tp->intf); -+ break; -+ -+ case PM_POST_HIBERNATION: -+ case PM_POST_SUSPEND: -+ usb_autopm_put_interface(tp->intf); -+ break; -+ -+ case PM_POST_RESTORE: -+ case PM_RESTORE_PREPARE: -+ default: -+ break; -+ } -+ -+ return NOTIFY_DONE; -+} -+#endif -+ - static int rtl8152_open(struct net_device *netdev) - { - struct r8152 *tp = netdev_priv(netdev); -@@ -3102,6 +3121,10 @@ static int rtl8152_open(struct net_device *netdev) - mutex_unlock(&tp->control); - - usb_autopm_put_interface(tp->intf); -+#ifdef CONFIG_PM_SLEEP -+ tp->pm_notifier.notifier_call = rtl_notifier; -+ register_pm_notifier(&tp->pm_notifier); -+#endif - - out: - return res; -@@ -3112,6 +3135,9 @@ static int rtl8152_close(struct net_device *netdev) - struct r8152 *tp = netdev_priv(netdev); - int res = 0; - -+#ifdef CONFIG_PM_SLEEP -+ unregister_pm_notifier(&tp->pm_notifier); -+#endif - napi_disable(&tp->napi); - clear_bit(WORK_ENABLE, &tp->flags); - usb_kill_urb(tp->intr_urb); -@@ -3250,7 +3276,7 @@ static void r8152b_init(struct r8152 *tp) - if (test_bit(RTL8152_UNPLUG, &tp->flags)) - return; - -- r8152b_disable_aldps(tp); -+ r8152_aldps_en(tp, false); - - if (tp->version == RTL_VER_01) { - ocp_data = ocp_read_word(tp, MCU_TYPE_PLA, PLA_LED_FEATURE); -@@ -3272,7 +3298,7 @@ static void r8152b_init(struct r8152 *tp) - ocp_write_word(tp, MCU_TYPE_PLA, PLA_GPHY_INTR_IMR, ocp_data); - - r8152b_enable_eee(tp); -- r8152b_enable_aldps(tp); -+ r8152_aldps_en(tp, true); - r8152b_enable_fc(tp); - rtl_tally_reset(tp); - -@@ -3290,7 +3316,7 @@ static void r8153_init(struct r8152 *tp) - if (test_bit(RTL8152_UNPLUG, &tp->flags)) - return; - -- r8153_disable_aldps(tp); -+ r8153_aldps_en(tp, false); - r8153_u1u2en(tp, false); - - for (i = 0; i < 500; i++) { -@@ -3379,7 +3405,7 @@ static void r8153_init(struct r8152 *tp) - EEE_SPDWN_EN); - - r8153_enable_eee(tp); -- r8153_enable_aldps(tp); -+ r8153_aldps_en(tp, true); - r8152b_enable_fc(tp); - rtl_tally_reset(tp); - r8153_u2p3en(tp, true); -diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c -index 30033dbe6662..c5f375befd2f 100644 ---- a/drivers/net/usb/smsc75xx.c -+++ b/drivers/net/usb/smsc75xx.c -@@ -2193,13 +2193,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev, - { - u32 tx_cmd_a, tx_cmd_b; - -- if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) { -- struct sk_buff *skb2 = -- skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS; -diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c -index 4a1e9c489f1f..aadfe1d1c37e 100644 ---- a/drivers/net/usb/sr9700.c -+++ b/drivers/net/usb/sr9700.c -@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb, - - len = skb->len; - -- if (skb_headroom(skb) < SR_TX_OVERHEAD) { -- struct sk_buff *skb2; -- -- skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags); -+ if (skb_cow_head(skb, SR_TX_OVERHEAD)) { - dev_kfree_skb_any(skb); -- skb = skb2; -- if (!skb) -- return NULL; -+ return NULL; - } - - __skb_push(skb, SR_TX_OVERHEAD); -diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c -index 9c6357c03905..b64327722660 100644 ---- a/drivers/staging/android/ashmem.c -+++ b/drivers/staging/android/ashmem.c -@@ -759,10 +759,12 @@ static long ashmem_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - break; - case ASHMEM_SET_SIZE: - ret = -EINVAL; -+ mutex_lock(&ashmem_mutex); - if (!asma->file) { - ret = 0; - asma->size = (size_t)arg; - } -+ mutex_unlock(&ashmem_mutex); - break; - case ASHMEM_GET_SIZE: - ret = asma->size; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 8a4092cd97ee..58fe27705b96 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -1759,7 +1759,6 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - struct iscsi_tmr_req *tmr_req; - struct iscsi_tm *hdr; - int out_of_order_cmdsn = 0, ret; -- bool sess_ref = false; - u8 function, tcm_function = TMR_UNKNOWN; - - hdr = (struct iscsi_tm *) buf; -@@ -1801,18 +1800,17 @@ iscsit_handle_task_mgt_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd, - buf); - } - -+ transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops, -+ conn->sess->se_sess, 0, DMA_NONE, -+ TCM_SIMPLE_TAG, cmd->sense_buffer + 2); -+ -+ target_get_sess_cmd(&cmd->se_cmd, true); -+ - /* - * TASK_REASSIGN for ERL=2 / connection stays inside of - * LIO-Target $FABRIC_MOD - */ - if (function != ISCSI_TM_FUNC_TASK_REASSIGN) { -- transport_init_se_cmd(&cmd->se_cmd, &iscsi_ops, -- conn->sess->se_sess, 0, DMA_NONE, -- TCM_SIMPLE_TAG, cmd->sense_buffer + 2); -- -- target_get_sess_cmd(&cmd->se_cmd, true); -- sess_ref = true; -- - switch (function) { - case ISCSI_TM_FUNC_ABORT_TASK: - tcm_function = TMR_ABORT_TASK; -@@ -1951,12 +1949,8 @@ attach: - * For connection recovery, this is also the default action for - * TMR TASK_REASSIGN. - */ -- if (sess_ref) { -- pr_debug("Handle TMR, using sess_ref=true check\n"); -- target_put_sess_cmd(&cmd->se_cmd); -- } -- - iscsit_add_cmd_to_response_queue(cmd, conn, cmd->i_state); -+ target_put_sess_cmd(&cmd->se_cmd); - return 0; - } - EXPORT_SYMBOL(iscsit_handle_task_mgt_cmd); -diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c -index c9be953496ec..e926dd52b6b5 100644 ---- a/drivers/target/target_core_tmr.c -+++ b/drivers/target/target_core_tmr.c -@@ -133,6 +133,15 @@ static bool __target_check_io_state(struct se_cmd *se_cmd, - spin_unlock(&se_cmd->t_state_lock); - return false; - } -+ if (se_cmd->transport_state & CMD_T_PRE_EXECUTE) { -+ if (se_cmd->scsi_status) { -+ pr_debug("Attempted to abort io tag: %llu early failure" -+ " status: 0x%02x\n", se_cmd->tag, -+ se_cmd->scsi_status); -+ spin_unlock(&se_cmd->t_state_lock); -+ return false; -+ } -+ } - if (sess->sess_tearing_down || se_cmd->cmd_wait_set) { - pr_debug("Attempted to abort io tag: %llu already shutdown," - " skipping\n", se_cmd->tag); -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 37abf881ca75..21f888ac550e 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -1933,6 +1933,7 @@ void target_execute_cmd(struct se_cmd *cmd) - } - - cmd->t_state = TRANSPORT_PROCESSING; -+ cmd->transport_state &= ~CMD_T_PRE_EXECUTE; - cmd->transport_state |= CMD_T_ACTIVE|CMD_T_BUSY|CMD_T_SENT; - spin_unlock_irq(&cmd->t_state_lock); - -@@ -2572,6 +2573,7 @@ int target_get_sess_cmd(struct se_cmd *se_cmd, bool ack_kref) - ret = -ESHUTDOWN; - goto out; - } -+ se_cmd->transport_state |= CMD_T_PRE_EXECUTE; - list_add_tail(&se_cmd->se_cmd_list, &se_sess->sess_cmd_list); - out: - spin_unlock_irqrestore(&se_sess->sess_cmd_lock, flags); -diff --git a/drivers/tty/sysrq.c b/drivers/tty/sysrq.c -index b07f864f68e8..ed27fda13387 100644 ---- a/drivers/tty/sysrq.c -+++ b/drivers/tty/sysrq.c -@@ -133,6 +133,12 @@ static void sysrq_handle_crash(int key) - { - char *killer = NULL; - -+ /* we need to release the RCU read lock here, -+ * otherwise we get an annoying -+ * 'BUG: sleeping function called from invalid context' -+ * complaint from the kernel before the panic. -+ */ -+ rcu_read_unlock(); - panic_on_oops = 1; /* force panic */ - wmb(); - *killer = 1; -diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c -index f7481c4e2bc9..d9363713b7f1 100644 ---- a/drivers/usb/host/xhci-mem.c -+++ b/drivers/usb/host/xhci-mem.c -@@ -1071,7 +1071,8 @@ int xhci_alloc_virt_device(struct xhci_hcd *xhci, int slot_id, - - return 1; - fail: -- -+ if (dev->eps[0].ring) -+ xhci_ring_free(xhci, dev->eps[0].ring); - if (dev->in_ctx) - xhci_free_container_ctx(xhci, dev->in_ctx); - if (dev->out_ctx) -diff --git a/drivers/usb/misc/usb3503.c b/drivers/usb/misc/usb3503.c -index b45cb77c0744..9e8789877763 100644 ---- a/drivers/usb/misc/usb3503.c -+++ b/drivers/usb/misc/usb3503.c -@@ -292,6 +292,8 @@ static int usb3503_probe(struct usb3503 *hub) - if (gpio_is_valid(hub->gpio_reset)) { - err = devm_gpio_request_one(dev, hub->gpio_reset, - GPIOF_OUT_INIT_LOW, "usb3503 reset"); -+ /* Datasheet defines a hardware reset to be at least 100us */ -+ usleep_range(100, 10000); - if (err) { - dev_err(dev, - "unable to request GPIO %d as reset pin (%d)\n", -diff --git a/drivers/usb/mon/mon_bin.c b/drivers/usb/mon/mon_bin.c -index 3598f1a62673..251d123d9046 100644 ---- a/drivers/usb/mon/mon_bin.c -+++ b/drivers/usb/mon/mon_bin.c -@@ -1001,7 +1001,9 @@ static long mon_bin_ioctl(struct file *file, unsigned int cmd, unsigned long arg - break; - - case MON_IOCQ_RING_SIZE: -+ mutex_lock(&rp->fetch_lock); - ret = rp->b_size; -+ mutex_unlock(&rp->fetch_lock); - break; - - case MON_IOCT_RING_SIZE: -@@ -1228,12 +1230,16 @@ static int mon_bin_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf) - unsigned long offset, chunk_idx; - struct page *pageptr; - -+ mutex_lock(&rp->fetch_lock); - offset = vmf->pgoff << PAGE_SHIFT; -- if (offset >= rp->b_size) -+ if (offset >= rp->b_size) { -+ mutex_unlock(&rp->fetch_lock); - return VM_FAULT_SIGBUS; -+ } - chunk_idx = offset / CHUNK_SIZE; - pageptr = rp->b_vec[chunk_idx].pg; - get_page(pageptr); -+ mutex_unlock(&rp->fetch_lock); - vmf->page = pageptr; - return 0; - } -diff --git a/drivers/usb/musb/ux500.c b/drivers/usb/musb/ux500.c -index b2685e75a683..3eaa4ba6867d 100644 ---- a/drivers/usb/musb/ux500.c -+++ b/drivers/usb/musb/ux500.c -@@ -348,7 +348,9 @@ static int ux500_suspend(struct device *dev) - struct ux500_glue *glue = dev_get_drvdata(dev); - struct musb *musb = glue_to_musb(glue); - -- usb_phy_set_suspend(musb->xceiv, 1); -+ if (musb) -+ usb_phy_set_suspend(musb->xceiv, 1); -+ - clk_disable_unprepare(glue->clk); - - return 0; -@@ -366,7 +368,8 @@ static int ux500_resume(struct device *dev) - return ret; - } - -- usb_phy_set_suspend(musb->xceiv, 0); -+ if (musb) -+ usb_phy_set_suspend(musb->xceiv, 0); - - return 0; - } -diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c -index 1f5ecf905b7d..a4ab4fdf5ba3 100644 ---- a/drivers/usb/serial/cp210x.c -+++ b/drivers/usb/serial/cp210x.c -@@ -120,6 +120,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x10C4, 0x8470) }, /* Juniper Networks BX Series System Console */ - { USB_DEVICE(0x10C4, 0x8477) }, /* Balluff RFID */ - { USB_DEVICE(0x10C4, 0x84B6) }, /* Starizona Hyperion */ -+ { USB_DEVICE(0x10C4, 0x85A7) }, /* LifeScan OneTouch Verio IQ */ - { USB_DEVICE(0x10C4, 0x85EA) }, /* AC-Services IBUS-IF */ - { USB_DEVICE(0x10C4, 0x85EB) }, /* AC-Services CIS-IBUS */ - { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */ -@@ -170,6 +171,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */ - { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */ - { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */ -+ { USB_DEVICE(0x18EF, 0xE030) }, /* ELV ALC 8xxx Battery Charger */ - { USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */ - { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ - { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ -diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h -index 2f80163ffb94..8ed80f28416f 100644 ---- a/drivers/usb/storage/unusual_uas.h -+++ b/drivers/usb/storage/unusual_uas.h -@@ -155,6 +155,13 @@ UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999, - USB_SC_DEVICE, USB_PR_DEVICE, NULL, - US_FL_NO_ATA_1X), - -+/* Reported-by: Icenowy Zheng */ -+UNUSUAL_DEV(0x2537, 0x1068, 0x0000, 0x9999, -+ "Norelsys", -+ "NS1068X", -+ USB_SC_DEVICE, USB_PR_DEVICE, NULL, -+ US_FL_IGNORE_UAS), -+ - /* Reported-by: Takeo Nakayama */ - UNUSUAL_DEV(0x357d, 0x7788, 0x0000, 0x9999, - "JMicron", -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index e40da7759a0e..9752b93f754e 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -103,7 +103,7 @@ static void usbip_dump_usb_device(struct usb_device *udev) - dev_dbg(dev, " devnum(%d) devpath(%s) usb speed(%s)", - udev->devnum, udev->devpath, usb_speed_string(udev->speed)); - -- pr_debug("tt %p, ttport %d\n", udev->tt, udev->ttport); -+ pr_debug("tt hub ttport %d\n", udev->ttport); - - dev_dbg(dev, " "); - for (i = 0; i < 16; i++) -@@ -136,12 +136,8 @@ static void usbip_dump_usb_device(struct usb_device *udev) - } - pr_debug("\n"); - -- dev_dbg(dev, "parent %p, bus %p\n", udev->parent, udev->bus); -- -- dev_dbg(dev, -- "descriptor %p, config %p, actconfig %p, rawdescriptors %p\n", -- &udev->descriptor, udev->config, -- udev->actconfig, udev->rawdescriptors); -+ dev_dbg(dev, "parent %s, bus %s\n", dev_name(&udev->parent->dev), -+ udev->bus->bus_name); - - dev_dbg(dev, "have_langid %d, string_langid %d\n", - udev->have_langid, udev->string_langid); -@@ -249,9 +245,6 @@ void usbip_dump_urb(struct urb *urb) - - dev = &urb->dev->dev; - -- dev_dbg(dev, " urb :%p\n", urb); -- dev_dbg(dev, " dev :%p\n", urb->dev); -- - usbip_dump_usb_device(urb->dev); - - dev_dbg(dev, " pipe :%08x ", urb->pipe); -@@ -260,11 +253,9 @@ void usbip_dump_urb(struct urb *urb) - - dev_dbg(dev, " status :%d\n", urb->status); - dev_dbg(dev, " transfer_flags :%08X\n", urb->transfer_flags); -- dev_dbg(dev, " transfer_buffer :%p\n", urb->transfer_buffer); - dev_dbg(dev, " transfer_buffer_length:%d\n", - urb->transfer_buffer_length); - dev_dbg(dev, " actual_length :%d\n", urb->actual_length); -- dev_dbg(dev, " setup_packet :%p\n", urb->setup_packet); - - if (urb->setup_packet && usb_pipetype(urb->pipe) == PIPE_CONTROL) - usbip_dump_usb_ctrlrequest( -@@ -274,8 +265,6 @@ void usbip_dump_urb(struct urb *urb) - dev_dbg(dev, " number_of_packets :%d\n", urb->number_of_packets); - dev_dbg(dev, " interval :%d\n", urb->interval); - dev_dbg(dev, " error_count :%d\n", urb->error_count); -- dev_dbg(dev, " context :%p\n", urb->context); -- dev_dbg(dev, " complete :%p\n", urb->complete); - } - EXPORT_SYMBOL_GPL(usbip_dump_urb); - -diff --git a/fs/locks.c b/fs/locks.c -index 8eddae23e10b..b515e65f1376 100644 ---- a/fs/locks.c -+++ b/fs/locks.c -@@ -2220,10 +2220,12 @@ int fcntl_setlk(unsigned int fd, struct file *filp, unsigned int cmd, - error = do_lock_file_wait(filp, cmd, file_lock); - - /* -- * Attempt to detect a close/fcntl race and recover by -- * releasing the lock that was just acquired. -+ * Attempt to detect a close/fcntl race and recover by releasing the -+ * lock that was just acquired. There is no need to do that when we're -+ * unlocking though, or for OFD locks. - */ -- if (!error && file_lock->fl_type != F_UNLCK) { -+ if (!error && file_lock->fl_type != F_UNLCK && -+ !(file_lock->fl_flags & FL_OFDLCK)) { - /* - * We need that spin_lock here - it prevents reordering between - * update of i_flctx->flc_posix and check for it done in -@@ -2362,10 +2364,12 @@ int fcntl_setlk64(unsigned int fd, struct file *filp, unsigned int cmd, - error = do_lock_file_wait(filp, cmd, file_lock); - - /* -- * Attempt to detect a close/fcntl race and recover by -- * releasing the lock that was just acquired. -+ * Attempt to detect a close/fcntl race and recover by releasing the -+ * lock that was just acquired. There is no need to do that when we're -+ * unlocking though, or for OFD locks. - */ -- if (!error && file_lock->fl_type != F_UNLCK) { -+ if (!error && file_lock->fl_type != F_UNLCK && -+ !(file_lock->fl_flags & FL_OFDLCK)) { - /* - * We need that spin_lock here - it prevents reordering between - * update of i_flctx->flc_posix and check for it done in -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index 4f6d29c8e3d8..f2157159b26f 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -37,6 +37,7 @@ struct bpf_map { - u32 value_size; - u32 max_entries; - u32 pages; -+ bool unpriv_array; - struct user_struct *user; - const struct bpf_map_ops *ops; - struct work_struct work; -@@ -141,6 +142,7 @@ struct bpf_prog_aux { - struct bpf_array { - struct bpf_map map; - u32 elem_size; -+ u32 index_mask; - /* 'ownership' of prog_array is claimed by the first program that - * is going to use this map or by the first program which FD is stored - * in the map to make sure that all callers and callees have the same -diff --git a/include/linux/cpu.h b/include/linux/cpu.h -index 3ea9aae2387d..7e04bcd9af8e 100644 ---- a/include/linux/cpu.h -+++ b/include/linux/cpu.h -@@ -40,6 +40,13 @@ extern void cpu_remove_dev_attr(struct device_attribute *attr); - extern int cpu_add_dev_attr_group(struct attribute_group *attrs); - extern void cpu_remove_dev_attr_group(struct attribute_group *attrs); - -+extern ssize_t cpu_show_meltdown(struct device *dev, -+ struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_spectre_v1(struct device *dev, -+ struct device_attribute *attr, char *buf); -+extern ssize_t cpu_show_spectre_v2(struct device *dev, -+ struct device_attribute *attr, char *buf); -+ - extern __printf(4, 5) - struct device *cpu_device_create(struct device *parent, void *drvdata, - const struct attribute_group **groups, -diff --git a/include/linux/filter.h b/include/linux/filter.h -index ccb98b459c59..677fa3b42194 100644 ---- a/include/linux/filter.h -+++ b/include/linux/filter.h -@@ -466,6 +466,9 @@ u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5); - void bpf_int_jit_compile(struct bpf_prog *fp); - bool bpf_helper_changes_skb_data(void *func); - -+struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, -+ const struct bpf_insn *patch, u32 len); -+ - #ifdef CONFIG_BPF_JIT - typedef void (*bpf_jit_fill_hole_t)(void *area, unsigned int size); - -diff --git a/include/linux/phy.h b/include/linux/phy.h -index 5bc4b9d563a9..dbfd5ce9350f 100644 ---- a/include/linux/phy.h -+++ b/include/linux/phy.h -@@ -682,6 +682,17 @@ static inline bool phy_is_internal(struct phy_device *phydev) - return phydev->is_internal; - } - -+/** -+ * phy_interface_mode_is_rgmii - Convenience function for testing if a -+ * PHY interface mode is RGMII (all variants) -+ * @mode: the phy_interface_t enum -+ */ -+static inline bool phy_interface_mode_is_rgmii(phy_interface_t mode) -+{ -+ return mode >= PHY_INTERFACE_MODE_RGMII && -+ mode <= PHY_INTERFACE_MODE_RGMII_TXID; -+}; -+ - /** - * phy_interface_is_rgmii - Convenience function for testing if a PHY interface - * is RGMII (all variants) -diff --git a/include/linux/sh_eth.h b/include/linux/sh_eth.h -index 8c9131db2b25..b050ef51e27e 100644 ---- a/include/linux/sh_eth.h -+++ b/include/linux/sh_eth.h -@@ -16,7 +16,6 @@ struct sh_eth_plat_data { - unsigned char mac_addr[ETH_ALEN]; - unsigned no_ether_link:1; - unsigned ether_link_active_low:1; -- unsigned needs_init:1; - }; - - #endif -diff --git a/include/target/target_core_base.h b/include/target/target_core_base.h -index 9982a2bcb880..0eed9fd79ea5 100644 ---- a/include/target/target_core_base.h -+++ b/include/target/target_core_base.h -@@ -496,6 +496,7 @@ struct se_cmd { - #define CMD_T_BUSY (1 << 9) - #define CMD_T_TAS (1 << 10) - #define CMD_T_FABRIC_STOP (1 << 11) -+#define CMD_T_PRE_EXECUTE (1 << 12) - spinlock_t t_state_lock; - struct kref cmd_kref; - struct completion t_transport_stop_comp; -diff --git a/include/trace/events/kvm.h b/include/trace/events/kvm.h -index d6f83222a6a1..67ff6555967f 100644 ---- a/include/trace/events/kvm.h -+++ b/include/trace/events/kvm.h -@@ -204,7 +204,7 @@ TRACE_EVENT(kvm_ack_irq, - { KVM_TRACE_MMIO_WRITE, "write" } - - TRACE_EVENT(kvm_mmio, -- TP_PROTO(int type, int len, u64 gpa, u64 val), -+ TP_PROTO(int type, int len, u64 gpa, void *val), - TP_ARGS(type, len, gpa, val), - - TP_STRUCT__entry( -@@ -218,7 +218,10 @@ TRACE_EVENT(kvm_mmio, - __entry->type = type; - __entry->len = len; - __entry->gpa = gpa; -- __entry->val = val; -+ __entry->val = 0; -+ if (val) -+ memcpy(&__entry->val, val, -+ min_t(u32, sizeof(__entry->val), len)); - ), - - TP_printk("mmio %s len %u gpa 0x%llx val 0x%llx", -diff --git a/kernel/bpf/arraymap.c b/kernel/bpf/arraymap.c -index b0799bced518..3608fa1aec8a 100644 ---- a/kernel/bpf/arraymap.c -+++ b/kernel/bpf/arraymap.c -@@ -20,8 +20,10 @@ - /* Called from syscall */ - static struct bpf_map *array_map_alloc(union bpf_attr *attr) - { -+ u32 elem_size, array_size, index_mask, max_entries; -+ bool unpriv = !capable(CAP_SYS_ADMIN); - struct bpf_array *array; -- u32 elem_size, array_size; -+ u64 mask64; - - /* check sanity of attributes */ - if (attr->max_entries == 0 || attr->key_size != 4 || -@@ -36,12 +38,33 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) - - elem_size = round_up(attr->value_size, 8); - -+ max_entries = attr->max_entries; -+ -+ /* On 32 bit archs roundup_pow_of_two() with max_entries that has -+ * upper most bit set in u32 space is undefined behavior due to -+ * resulting 1U << 32, so do it manually here in u64 space. -+ */ -+ mask64 = fls_long(max_entries - 1); -+ mask64 = 1ULL << mask64; -+ mask64 -= 1; -+ -+ index_mask = mask64; -+ if (unpriv) { -+ /* round up array size to nearest power of 2, -+ * since cpu will speculate within index_mask limits -+ */ -+ max_entries = index_mask + 1; -+ /* Check for overflows. */ -+ if (max_entries < attr->max_entries) -+ return ERR_PTR(-E2BIG); -+ } -+ - /* check round_up into zero and u32 overflow */ - if (elem_size == 0 || -- attr->max_entries > (U32_MAX - PAGE_SIZE - sizeof(*array)) / elem_size) -+ max_entries > (U32_MAX - PAGE_SIZE - sizeof(*array)) / elem_size) - return ERR_PTR(-ENOMEM); - -- array_size = sizeof(*array) + attr->max_entries * elem_size; -+ array_size = sizeof(*array) + max_entries * elem_size; - - /* allocate all map elements and zero-initialize them */ - array = kzalloc(array_size, GFP_USER | __GFP_NOWARN); -@@ -50,6 +73,8 @@ static struct bpf_map *array_map_alloc(union bpf_attr *attr) - if (!array) - return ERR_PTR(-ENOMEM); - } -+ array->index_mask = index_mask; -+ array->map.unpriv_array = unpriv; - - /* copy mandatory map attributes */ - array->map.key_size = attr->key_size; -@@ -70,7 +95,7 @@ static void *array_map_lookup_elem(struct bpf_map *map, void *key) - if (index >= array->map.max_entries) - return NULL; - -- return array->value + array->elem_size * index; -+ return array->value + array->elem_size * (index & array->index_mask); - } - - /* Called from syscall */ -@@ -111,7 +136,9 @@ static int array_map_update_elem(struct bpf_map *map, void *key, void *value, - /* all elements already exist */ - return -EEXIST; - -- memcpy(array->value + array->elem_size * index, value, map->value_size); -+ memcpy(array->value + -+ array->elem_size * (index & array->index_mask), -+ value, map->value_size); - return 0; - } - -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 334b1bdd572c..3fd76cf0c21e 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -137,6 +137,77 @@ void __bpf_prog_free(struct bpf_prog *fp) - } - EXPORT_SYMBOL_GPL(__bpf_prog_free); - -+static bool bpf_is_jmp_and_has_target(const struct bpf_insn *insn) -+{ -+ return BPF_CLASS(insn->code) == BPF_JMP && -+ /* Call and Exit are both special jumps with no -+ * target inside the BPF instruction image. -+ */ -+ BPF_OP(insn->code) != BPF_CALL && -+ BPF_OP(insn->code) != BPF_EXIT; -+} -+ -+static void bpf_adj_branches(struct bpf_prog *prog, u32 pos, u32 delta) -+{ -+ struct bpf_insn *insn = prog->insnsi; -+ u32 i, insn_cnt = prog->len; -+ -+ for (i = 0; i < insn_cnt; i++, insn++) { -+ if (!bpf_is_jmp_and_has_target(insn)) -+ continue; -+ -+ /* Adjust offset of jmps if we cross boundaries. */ -+ if (i < pos && i + insn->off + 1 > pos) -+ insn->off += delta; -+ else if (i > pos + delta && i + insn->off + 1 <= pos + delta) -+ insn->off -= delta; -+ } -+} -+ -+struct bpf_prog *bpf_patch_insn_single(struct bpf_prog *prog, u32 off, -+ const struct bpf_insn *patch, u32 len) -+{ -+ u32 insn_adj_cnt, insn_rest, insn_delta = len - 1; -+ struct bpf_prog *prog_adj; -+ -+ /* Since our patchlet doesn't expand the image, we're done. */ -+ if (insn_delta == 0) { -+ memcpy(prog->insnsi + off, patch, sizeof(*patch)); -+ return prog; -+ } -+ -+ insn_adj_cnt = prog->len + insn_delta; -+ -+ /* Several new instructions need to be inserted. Make room -+ * for them. Likely, there's no need for a new allocation as -+ * last page could have large enough tailroom. -+ */ -+ prog_adj = bpf_prog_realloc(prog, bpf_prog_size(insn_adj_cnt), -+ GFP_USER); -+ if (!prog_adj) -+ return NULL; -+ -+ prog_adj->len = insn_adj_cnt; -+ -+ /* Patching happens in 3 steps: -+ * -+ * 1) Move over tail of insnsi from next instruction onwards, -+ * so we can patch the single target insn with one or more -+ * new ones (patching is always from 1 to n insns, n > 0). -+ * 2) Inject new instructions at the target location. -+ * 3) Adjust branch offsets if necessary. -+ */ -+ insn_rest = insn_adj_cnt - off - len; -+ -+ memmove(prog_adj->insnsi + off + len, prog_adj->insnsi + off + 1, -+ sizeof(*patch) * insn_rest); -+ memcpy(prog_adj->insnsi + off, patch, sizeof(*patch) * len); -+ -+ bpf_adj_branches(prog_adj, off, insn_delta); -+ -+ return prog_adj; -+} -+ - #ifdef CONFIG_BPF_JIT - struct bpf_binary_header * - bpf_jit_binary_alloc(unsigned int proglen, u8 **image_ptr, -diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c -index 4e32cc94edd9..424accd20c2d 100644 ---- a/kernel/bpf/syscall.c -+++ b/kernel/bpf/syscall.c -@@ -447,57 +447,6 @@ void bpf_register_prog_type(struct bpf_prog_type_list *tl) - list_add(&tl->list_node, &bpf_prog_types); - } - --/* fixup insn->imm field of bpf_call instructions: -- * if (insn->imm == BPF_FUNC_map_lookup_elem) -- * insn->imm = bpf_map_lookup_elem - __bpf_call_base; -- * else if (insn->imm == BPF_FUNC_map_update_elem) -- * insn->imm = bpf_map_update_elem - __bpf_call_base; -- * else ... -- * -- * this function is called after eBPF program passed verification -- */ --static void fixup_bpf_calls(struct bpf_prog *prog) --{ -- const struct bpf_func_proto *fn; -- int i; -- -- for (i = 0; i < prog->len; i++) { -- struct bpf_insn *insn = &prog->insnsi[i]; -- -- if (insn->code == (BPF_JMP | BPF_CALL)) { -- /* we reach here when program has bpf_call instructions -- * and it passed bpf_check(), means that -- * ops->get_func_proto must have been supplied, check it -- */ -- BUG_ON(!prog->aux->ops->get_func_proto); -- -- if (insn->imm == BPF_FUNC_get_route_realm) -- prog->dst_needed = 1; -- if (insn->imm == BPF_FUNC_get_prandom_u32) -- bpf_user_rnd_init_once(); -- if (insn->imm == BPF_FUNC_tail_call) { -- /* mark bpf_tail_call as different opcode -- * to avoid conditional branch in -- * interpeter for every normal call -- * and to prevent accidental JITing by -- * JIT compiler that doesn't support -- * bpf_tail_call yet -- */ -- insn->imm = 0; -- insn->code |= BPF_X; -- continue; -- } -- -- fn = prog->aux->ops->get_func_proto(insn->imm); -- /* all functions that have prototype and verifier allowed -- * programs to call them, must be real in-kernel functions -- */ -- BUG_ON(!fn->func); -- insn->imm = fn->func - __bpf_call_base; -- } -- } --} -- - /* drop refcnt on maps used by eBPF program and free auxilary data */ - static void free_used_maps(struct bpf_prog_aux *aux) - { -@@ -680,9 +629,6 @@ static int bpf_prog_load(union bpf_attr *attr) - if (err < 0) - goto free_used_maps; - -- /* fixup BPF_CALL->imm field */ -- fixup_bpf_calls(prog); -- - /* eBPF program is ready to be JITed */ - err = bpf_prog_select_runtime(prog); - if (err < 0) -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index eb759f5008b8..014c2d759916 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -186,6 +186,13 @@ struct verifier_stack_elem { - struct verifier_stack_elem *next; - }; - -+struct bpf_insn_aux_data { -+ union { -+ enum bpf_reg_type ptr_type; /* pointer type for load/store insns */ -+ struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */ -+ }; -+}; -+ - #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */ - - /* single container for all structs -@@ -200,6 +207,7 @@ struct verifier_env { - struct bpf_map *used_maps[MAX_USED_MAPS]; /* array of map's used by eBPF program */ - u32 used_map_cnt; /* number of used maps */ - bool allow_ptr_leaks; -+ struct bpf_insn_aux_data *insn_aux_data; /* array of per-insn state */ - }; - - /* verbose verifier prints what it's seeing -@@ -945,7 +953,7 @@ error: - return -EINVAL; - } - --static int check_call(struct verifier_env *env, int func_id) -+static int check_call(struct verifier_env *env, int func_id, int insn_idx) - { - struct verifier_state *state = &env->cur_state; - const struct bpf_func_proto *fn = NULL; -@@ -981,6 +989,13 @@ static int check_call(struct verifier_env *env, int func_id) - err = check_func_arg(env, BPF_REG_2, fn->arg2_type, &map); - if (err) - return err; -+ if (func_id == BPF_FUNC_tail_call) { -+ if (map == NULL) { -+ verbose("verifier bug\n"); -+ return -EINVAL; -+ } -+ env->insn_aux_data[insn_idx].map_ptr = map; -+ } - err = check_func_arg(env, BPF_REG_3, fn->arg3_type, &map); - if (err) - return err; -@@ -1784,7 +1799,7 @@ static int do_check(struct verifier_env *env) - return err; - - } else if (class == BPF_LDX) { -- enum bpf_reg_type src_reg_type; -+ enum bpf_reg_type *prev_src_type, src_reg_type; - - /* check for reserved fields is already done */ - -@@ -1813,16 +1828,18 @@ static int do_check(struct verifier_env *env) - continue; - } - -- if (insn->imm == 0) { -+ prev_src_type = &env->insn_aux_data[insn_idx].ptr_type; -+ -+ if (*prev_src_type == NOT_INIT) { - /* saw a valid insn - * dst_reg = *(u32 *)(src_reg + off) -- * use reserved 'imm' field to mark this insn -+ * save type to validate intersecting paths - */ -- insn->imm = src_reg_type; -+ *prev_src_type = src_reg_type; - -- } else if (src_reg_type != insn->imm && -+ } else if (src_reg_type != *prev_src_type && - (src_reg_type == PTR_TO_CTX || -- insn->imm == PTR_TO_CTX)) { -+ *prev_src_type == PTR_TO_CTX)) { - /* ABuser program is trying to use the same insn - * dst_reg = *(u32*) (src_reg + off) - * with different pointer types: -@@ -1835,7 +1852,7 @@ static int do_check(struct verifier_env *env) - } - - } else if (class == BPF_STX) { -- enum bpf_reg_type dst_reg_type; -+ enum bpf_reg_type *prev_dst_type, dst_reg_type; - - if (BPF_MODE(insn->code) == BPF_XADD) { - err = check_xadd(env, insn); -@@ -1863,11 +1880,13 @@ static int do_check(struct verifier_env *env) - if (err) - return err; - -- if (insn->imm == 0) { -- insn->imm = dst_reg_type; -- } else if (dst_reg_type != insn->imm && -+ prev_dst_type = &env->insn_aux_data[insn_idx].ptr_type; -+ -+ if (*prev_dst_type == NOT_INIT) { -+ *prev_dst_type = dst_reg_type; -+ } else if (dst_reg_type != *prev_dst_type && - (dst_reg_type == PTR_TO_CTX || -- insn->imm == PTR_TO_CTX)) { -+ *prev_dst_type == PTR_TO_CTX)) { - verbose("same insn cannot be used with different pointers\n"); - return -EINVAL; - } -@@ -1902,7 +1921,7 @@ static int do_check(struct verifier_env *env) - return -EINVAL; - } - -- err = check_call(env, insn->imm); -+ err = check_call(env, insn->imm, insn_idx); - if (err) - return err; - -@@ -2098,24 +2117,39 @@ static void convert_pseudo_ld_imm64(struct verifier_env *env) - insn->src_reg = 0; - } - --static void adjust_branches(struct bpf_prog *prog, int pos, int delta) -+/* single env->prog->insni[off] instruction was replaced with the range -+ * insni[off, off + cnt). Adjust corresponding insn_aux_data by copying -+ * [0, off) and [off, end) to new locations, so the patched range stays zero -+ */ -+static int adjust_insn_aux_data(struct verifier_env *env, u32 prog_len, -+ u32 off, u32 cnt) - { -- struct bpf_insn *insn = prog->insnsi; -- int insn_cnt = prog->len; -- int i; -+ struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data; - -- for (i = 0; i < insn_cnt; i++, insn++) { -- if (BPF_CLASS(insn->code) != BPF_JMP || -- BPF_OP(insn->code) == BPF_CALL || -- BPF_OP(insn->code) == BPF_EXIT) -- continue; -+ if (cnt == 1) -+ return 0; -+ new_data = vzalloc(sizeof(struct bpf_insn_aux_data) * prog_len); -+ if (!new_data) -+ return -ENOMEM; -+ memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off); -+ memcpy(new_data + off + cnt - 1, old_data + off, -+ sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1)); -+ env->insn_aux_data = new_data; -+ vfree(old_data); -+ return 0; -+} - -- /* adjust offset of jmps if necessary */ -- if (i < pos && i + insn->off + 1 > pos) -- insn->off += delta; -- else if (i > pos + delta && i + insn->off + 1 <= pos + delta) -- insn->off -= delta; -- } -+static struct bpf_prog *bpf_patch_insn_data(struct verifier_env *env, u32 off, -+ const struct bpf_insn *patch, u32 len) -+{ -+ struct bpf_prog *new_prog; -+ -+ new_prog = bpf_patch_insn_single(env->prog, off, patch, len); -+ if (!new_prog) -+ return NULL; -+ if (adjust_insn_aux_data(env, new_prog->len, off, len)) -+ return NULL; -+ return new_prog; - } - - /* convert load instructions that access fields of 'struct __sk_buff' -@@ -2124,17 +2158,18 @@ static void adjust_branches(struct bpf_prog *prog, int pos, int delta) - static int convert_ctx_accesses(struct verifier_env *env) - { - struct bpf_insn *insn = env->prog->insnsi; -- int insn_cnt = env->prog->len; -+ const int insn_cnt = env->prog->len; - struct bpf_insn insn_buf[16]; - struct bpf_prog *new_prog; -- u32 cnt; -- int i; - enum bpf_access_type type; -+ int i, delta = 0; - - if (!env->prog->aux->ops->convert_ctx_access) - return 0; - - for (i = 0; i < insn_cnt; i++, insn++) { -+ u32 cnt; -+ - if (insn->code == (BPF_LDX | BPF_MEM | BPF_W)) - type = BPF_READ; - else if (insn->code == (BPF_STX | BPF_MEM | BPF_W)) -@@ -2142,11 +2177,8 @@ static int convert_ctx_accesses(struct verifier_env *env) - else - continue; - -- if (insn->imm != PTR_TO_CTX) { -- /* clear internal mark */ -- insn->imm = 0; -+ if (env->insn_aux_data[i + delta].ptr_type != PTR_TO_CTX) - continue; -- } - - cnt = env->prog->aux->ops-> - convert_ctx_access(type, insn->dst_reg, insn->src_reg, -@@ -2156,34 +2188,89 @@ static int convert_ctx_accesses(struct verifier_env *env) - return -EINVAL; - } - -- if (cnt == 1) { -- memcpy(insn, insn_buf, sizeof(*insn)); -- continue; -- } -- -- /* several new insns need to be inserted. Make room for them */ -- insn_cnt += cnt - 1; -- new_prog = bpf_prog_realloc(env->prog, -- bpf_prog_size(insn_cnt), -- GFP_USER); -+ new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); - if (!new_prog) - return -ENOMEM; - -- new_prog->len = insn_cnt; -+ delta += cnt - 1; -+ -+ /* keep walking new program and skip insns we just inserted */ -+ env->prog = new_prog; -+ insn = new_prog->insnsi + i + delta; -+ } - -- memmove(new_prog->insnsi + i + cnt, new_prog->insns + i + 1, -- sizeof(*insn) * (insn_cnt - i - cnt)); -+ return 0; -+} - -- /* copy substitute insns in place of load instruction */ -- memcpy(new_prog->insnsi + i, insn_buf, sizeof(*insn) * cnt); -+/* fixup insn->imm field of bpf_call instructions -+ * -+ * this function is called after eBPF program passed verification -+ */ -+static int fixup_bpf_calls(struct verifier_env *env) -+{ -+ struct bpf_prog *prog = env->prog; -+ struct bpf_insn *insn = prog->insnsi; -+ const struct bpf_func_proto *fn; -+ const int insn_cnt = prog->len; -+ struct bpf_insn insn_buf[16]; -+ struct bpf_prog *new_prog; -+ struct bpf_map *map_ptr; -+ int i, cnt, delta = 0; - -- /* adjust branches in the whole program */ -- adjust_branches(new_prog, i, cnt - 1); -+ for (i = 0; i < insn_cnt; i++, insn++) { -+ if (insn->code != (BPF_JMP | BPF_CALL)) -+ continue; - -- /* keep walking new program and skip insns we just inserted */ -- env->prog = new_prog; -- insn = new_prog->insnsi + i + cnt - 1; -- i += cnt - 1; -+ if (insn->imm == BPF_FUNC_get_route_realm) -+ prog->dst_needed = 1; -+ if (insn->imm == BPF_FUNC_get_prandom_u32) -+ bpf_user_rnd_init_once(); -+ if (insn->imm == BPF_FUNC_tail_call) { -+ /* mark bpf_tail_call as different opcode to avoid -+ * conditional branch in the interpeter for every normal -+ * call and to prevent accidental JITing by JIT compiler -+ * that doesn't support bpf_tail_call yet -+ */ -+ insn->imm = 0; -+ insn->code |= BPF_X; -+ -+ /* instead of changing every JIT dealing with tail_call -+ * emit two extra insns: -+ * if (index >= max_entries) goto out; -+ * index &= array->index_mask; -+ * to avoid out-of-bounds cpu speculation -+ */ -+ map_ptr = env->insn_aux_data[i + delta].map_ptr; -+ if (!map_ptr->unpriv_array) -+ continue; -+ insn_buf[0] = BPF_JMP_IMM(BPF_JGE, BPF_REG_3, -+ map_ptr->max_entries, 2); -+ insn_buf[1] = BPF_ALU32_IMM(BPF_AND, BPF_REG_3, -+ container_of(map_ptr, -+ struct bpf_array, -+ map)->index_mask); -+ insn_buf[2] = *insn; -+ cnt = 3; -+ new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); -+ if (!new_prog) -+ return -ENOMEM; -+ -+ delta += cnt - 1; -+ env->prog = prog = new_prog; -+ insn = new_prog->insnsi + i + delta; -+ continue; -+ } -+ -+ fn = prog->aux->ops->get_func_proto(insn->imm); -+ /* all functions that have prototype and verifier allowed -+ * programs to call them, must be real in-kernel functions -+ */ -+ if (!fn->func) { -+ verbose("kernel subsystem misconfigured func %d\n", -+ insn->imm); -+ return -EFAULT; -+ } -+ insn->imm = fn->func - __bpf_call_base; - } - - return 0; -@@ -2227,6 +2314,11 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr) - if (!env) - return -ENOMEM; - -+ env->insn_aux_data = vzalloc(sizeof(struct bpf_insn_aux_data) * -+ (*prog)->len); -+ ret = -ENOMEM; -+ if (!env->insn_aux_data) -+ goto err_free_env; - env->prog = *prog; - - /* grab the mutex to protect few globals used by verifier */ -@@ -2245,12 +2337,12 @@ int bpf_check(struct bpf_prog **prog, union bpf_attr *attr) - /* log_* values have to be sane */ - if (log_size < 128 || log_size > UINT_MAX >> 8 || - log_level == 0 || log_ubuf == NULL) -- goto free_env; -+ goto err_unlock; - - ret = -ENOMEM; - log_buf = vmalloc(log_size); - if (!log_buf) -- goto free_env; -+ goto err_unlock; - } else { - log_level = 0; - } -@@ -2282,6 +2374,9 @@ skip_full_check: - /* program is valid, convert *(u32*)(ctx + off) accesses */ - ret = convert_ctx_accesses(env); - -+ if (ret == 0) -+ ret = fixup_bpf_calls(env); -+ - if (log_level && log_len >= log_size - 1) { - BUG_ON(log_len >= log_size); - /* verifier log exceeded user supplied buffer */ -@@ -2319,14 +2414,16 @@ skip_full_check: - free_log_buf: - if (log_level) - vfree(log_buf); --free_env: - if (!env->prog->aux->used_maps) - /* if we didn't copy map pointers into bpf_prog_info, release - * them now. Otherwise free_bpf_prog_info() will release them. - */ - release_maps(env); - *prog = env->prog; -- kfree(env); -+err_unlock: - mutex_unlock(&bpf_verifier_lock); -+ vfree(env->insn_aux_data); -+err_free_env: -+ kfree(env); - return ret; - } -diff --git a/kernel/futex.c b/kernel/futex.c -index 3057dabf726f..fc68462801de 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -1939,8 +1939,12 @@ static int unqueue_me(struct futex_q *q) - - /* In the common case we don't take the spinlock, which is nice. */ - retry: -- lock_ptr = q->lock_ptr; -- barrier(); -+ /* -+ * q->lock_ptr can change between this read and the following spin_lock. -+ * Use READ_ONCE to forbid the compiler from reloading q->lock_ptr and -+ * optimizing lock_ptr out of the logic below. -+ */ -+ lock_ptr = READ_ONCE(q->lock_ptr); - if (lock_ptr != NULL) { - spin_lock(lock_ptr); - /* -diff --git a/kernel/locking/mutex.c b/kernel/locking/mutex.c -index 89350f924c85..79d2d765a75f 100644 ---- a/kernel/locking/mutex.c -+++ b/kernel/locking/mutex.c -@@ -719,6 +719,7 @@ static inline void - __mutex_unlock_common_slowpath(struct mutex *lock, int nested) - { - unsigned long flags; -+ WAKE_Q(wake_q); - - /* - * As a performance measurement, release the lock before doing other -@@ -746,11 +747,11 @@ __mutex_unlock_common_slowpath(struct mutex *lock, int nested) - struct mutex_waiter, list); - - debug_mutex_wake_waiter(lock, waiter); -- -- wake_up_process(waiter->task); -+ wake_q_add(&wake_q, waiter->task); - } - - spin_unlock_mutex(&lock->wait_lock, flags); -+ wake_up_q(&wake_q); - } - - /* -diff --git a/mm/compaction.c b/mm/compaction.c -index dba02dec7195..b6f145ed7ae1 100644 ---- a/mm/compaction.c -+++ b/mm/compaction.c -@@ -200,7 +200,8 @@ static void reset_cached_positions(struct zone *zone) - { - zone->compact_cached_migrate_pfn[0] = zone->zone_start_pfn; - zone->compact_cached_migrate_pfn[1] = zone->zone_start_pfn; -- zone->compact_cached_free_pfn = zone_end_pfn(zone); -+ zone->compact_cached_free_pfn = -+ round_down(zone_end_pfn(zone) - 1, pageblock_nr_pages); - } - - /* -@@ -552,13 +553,17 @@ unsigned long - isolate_freepages_range(struct compact_control *cc, - unsigned long start_pfn, unsigned long end_pfn) - { -- unsigned long isolated, pfn, block_end_pfn; -+ unsigned long isolated, pfn, block_start_pfn, block_end_pfn; - LIST_HEAD(freelist); - - pfn = start_pfn; -+ block_start_pfn = pfn & ~(pageblock_nr_pages - 1); -+ if (block_start_pfn < cc->zone->zone_start_pfn) -+ block_start_pfn = cc->zone->zone_start_pfn; - block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages); - - for (; pfn < end_pfn; pfn += isolated, -+ block_start_pfn = block_end_pfn, - block_end_pfn += pageblock_nr_pages) { - /* Protect pfn from changing by isolate_freepages_block */ - unsigned long isolate_start_pfn = pfn; -@@ -571,11 +576,13 @@ isolate_freepages_range(struct compact_control *cc, - * scanning range to right one. - */ - if (pfn >= block_end_pfn) { -+ block_start_pfn = pfn & ~(pageblock_nr_pages - 1); - block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages); - block_end_pfn = min(block_end_pfn, end_pfn); - } - -- if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone)) -+ if (!pageblock_pfn_to_page(block_start_pfn, -+ block_end_pfn, cc->zone)) - break; - - isolated = isolate_freepages_block(cc, &isolate_start_pfn, -@@ -861,18 +868,23 @@ unsigned long - isolate_migratepages_range(struct compact_control *cc, unsigned long start_pfn, - unsigned long end_pfn) - { -- unsigned long pfn, block_end_pfn; -+ unsigned long pfn, block_start_pfn, block_end_pfn; - - /* Scan block by block. First and last block may be incomplete */ - pfn = start_pfn; -+ block_start_pfn = pfn & ~(pageblock_nr_pages - 1); -+ if (block_start_pfn < cc->zone->zone_start_pfn) -+ block_start_pfn = cc->zone->zone_start_pfn; - block_end_pfn = ALIGN(pfn + 1, pageblock_nr_pages); - - for (; pfn < end_pfn; pfn = block_end_pfn, -+ block_start_pfn = block_end_pfn, - block_end_pfn += pageblock_nr_pages) { - - block_end_pfn = min(block_end_pfn, end_pfn); - -- if (!pageblock_pfn_to_page(pfn, block_end_pfn, cc->zone)) -+ if (!pageblock_pfn_to_page(block_start_pfn, -+ block_end_pfn, cc->zone)) - continue; - - pfn = isolate_migratepages_block(cc, pfn, block_end_pfn, -@@ -1090,7 +1102,9 @@ int sysctl_compact_unevictable_allowed __read_mostly = 1; - static isolate_migrate_t isolate_migratepages(struct zone *zone, - struct compact_control *cc) - { -- unsigned long low_pfn, end_pfn; -+ unsigned long block_start_pfn; -+ unsigned long block_end_pfn; -+ unsigned long low_pfn; - unsigned long isolate_start_pfn; - struct page *page; - const isolate_mode_t isolate_mode = -@@ -1102,16 +1116,21 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone, - * initialized by compact_zone() - */ - low_pfn = cc->migrate_pfn; -+ block_start_pfn = cc->migrate_pfn & ~(pageblock_nr_pages - 1); -+ if (block_start_pfn < zone->zone_start_pfn) -+ block_start_pfn = zone->zone_start_pfn; - - /* Only scan within a pageblock boundary */ -- end_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages); -+ block_end_pfn = ALIGN(low_pfn + 1, pageblock_nr_pages); - - /* - * Iterate over whole pageblocks until we find the first suitable. - * Do not cross the free scanner. - */ -- for (; end_pfn <= cc->free_pfn; -- low_pfn = end_pfn, end_pfn += pageblock_nr_pages) { -+ for (; block_end_pfn <= cc->free_pfn; -+ low_pfn = block_end_pfn, -+ block_start_pfn = block_end_pfn, -+ block_end_pfn += pageblock_nr_pages) { - - /* - * This can potentially iterate a massively long zone with -@@ -1122,7 +1141,8 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone, - && compact_should_abort(cc)) - break; - -- page = pageblock_pfn_to_page(low_pfn, end_pfn, zone); -+ page = pageblock_pfn_to_page(block_start_pfn, block_end_pfn, -+ zone); - if (!page) - continue; - -@@ -1141,8 +1161,8 @@ static isolate_migrate_t isolate_migratepages(struct zone *zone, - - /* Perform the isolation */ - isolate_start_pfn = low_pfn; -- low_pfn = isolate_migratepages_block(cc, low_pfn, end_pfn, -- isolate_mode); -+ low_pfn = isolate_migratepages_block(cc, low_pfn, -+ block_end_pfn, isolate_mode); - - if (!low_pfn || cc->contended) { - acct_isolated(zone, cc); -@@ -1358,11 +1378,11 @@ static int compact_zone(struct zone *zone, struct compact_control *cc) - */ - cc->migrate_pfn = zone->compact_cached_migrate_pfn[sync]; - cc->free_pfn = zone->compact_cached_free_pfn; -- if (cc->free_pfn < start_pfn || cc->free_pfn > end_pfn) { -- cc->free_pfn = end_pfn & ~(pageblock_nr_pages-1); -+ if (cc->free_pfn < start_pfn || cc->free_pfn >= end_pfn) { -+ cc->free_pfn = round_down(end_pfn - 1, pageblock_nr_pages); - zone->compact_cached_free_pfn = cc->free_pfn; - } -- if (cc->migrate_pfn < start_pfn || cc->migrate_pfn > end_pfn) { -+ if (cc->migrate_pfn < start_pfn || cc->migrate_pfn >= end_pfn) { - cc->migrate_pfn = start_pfn; - zone->compact_cached_migrate_pfn[0] = cc->migrate_pfn; - zone->compact_cached_migrate_pfn[1] = cc->migrate_pfn; -diff --git a/mm/page-writeback.c b/mm/page-writeback.c -index fd51ebfc423f..6d0dbde4503b 100644 ---- a/mm/page-writeback.c -+++ b/mm/page-writeback.c -@@ -1162,6 +1162,7 @@ static void wb_update_dirty_ratelimit(struct dirty_throttle_control *dtc, - unsigned long balanced_dirty_ratelimit; - unsigned long step; - unsigned long x; -+ unsigned long shift; - - /* - * The dirty rate will match the writeout rate in long term, except -@@ -1286,11 +1287,11 @@ static void wb_update_dirty_ratelimit(struct dirty_throttle_control *dtc, - * rate itself is constantly fluctuating. So decrease the track speed - * when it gets close to the target. Helps eliminate pointless tremors. - */ -- step >>= dirty_ratelimit / (2 * step + 1); -- /* -- * Limit the tracking speed to avoid overshooting. -- */ -- step = (step + 7) / 8; -+ shift = dirty_ratelimit / (2 * step + 1); -+ if (shift < BITS_PER_LONG) -+ step = DIV_ROUND_UP(step >> shift, 8); -+ else -+ step = 0; - - if (dirty_ratelimit < balanced_dirty_ratelimit) - dirty_ratelimit += step; -diff --git a/mm/zswap.c b/mm/zswap.c -index 45476f429789..568015e2fe7a 100644 ---- a/mm/zswap.c -+++ b/mm/zswap.c -@@ -123,7 +123,7 @@ struct zswap_pool { - struct crypto_comp * __percpu *tfm; - struct kref kref; - struct list_head list; -- struct rcu_head rcu_head; -+ struct work_struct work; - struct notifier_block notifier; - char tfm_name[CRYPTO_MAX_ALG_NAME]; - }; -@@ -667,9 +667,11 @@ static int __must_check zswap_pool_get(struct zswap_pool *pool) - return kref_get_unless_zero(&pool->kref); - } - --static void __zswap_pool_release(struct rcu_head *head) -+static void __zswap_pool_release(struct work_struct *work) - { -- struct zswap_pool *pool = container_of(head, typeof(*pool), rcu_head); -+ struct zswap_pool *pool = container_of(work, typeof(*pool), work); -+ -+ synchronize_rcu(); - - /* nobody should have been able to get a kref... */ - WARN_ON(kref_get_unless_zero(&pool->kref)); -@@ -689,7 +691,9 @@ static void __zswap_pool_empty(struct kref *kref) - WARN_ON(pool == zswap_pool_current()); - - list_del_rcu(&pool->list); -- call_rcu(&pool->rcu_head, __zswap_pool_release); -+ -+ INIT_WORK(&pool->work, __zswap_pool_release); -+ schedule_work(&pool->work); - - spin_unlock(&zswap_pools_lock); - } -@@ -748,18 +752,22 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp, - pool = zswap_pool_find_get(type, compressor); - if (pool) { - zswap_pool_debug("using existing", pool); -+ WARN_ON(pool == zswap_pool_current()); - list_del_rcu(&pool->list); -- } else { -- spin_unlock(&zswap_pools_lock); -- pool = zswap_pool_create(type, compressor); -- spin_lock(&zswap_pools_lock); - } - -+ spin_unlock(&zswap_pools_lock); -+ -+ if (!pool) -+ pool = zswap_pool_create(type, compressor); -+ - if (pool) - ret = param_set_charp(s, kp); - else - ret = -EINVAL; - -+ spin_lock(&zswap_pools_lock); -+ - if (!ret) { - put_pool = zswap_pool_current(); - list_add_rcu(&pool->list, &zswap_pools); -diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c -index 01abb6431fd9..e2713b0794ae 100644 ---- a/net/8021q/vlan.c -+++ b/net/8021q/vlan.c -@@ -111,12 +111,7 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head) - vlan_gvrp_uninit_applicant(real_dev); - } - -- /* Take it out of our own structures, but be sure to interlock with -- * HW accelerating devices or SW vlan input packet processing if -- * VLAN is not 0 (leave it there for 802.1p). -- */ -- if (vlan_id) -- vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id); -+ vlan_vid_del(real_dev, vlan->vlan_proto, vlan_id); - - /* Get rid of the vlan's reference to real_dev */ - dev_put(real_dev); -diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c -index 357bcd34cf1f..af68674690af 100644 ---- a/net/bluetooth/l2cap_core.c -+++ b/net/bluetooth/l2cap_core.c -@@ -3342,9 +3342,10 @@ static int l2cap_parse_conf_req(struct l2cap_chan *chan, void *data, size_t data - break; - - case L2CAP_CONF_EFS: -- remote_efs = 1; -- if (olen == sizeof(efs)) -+ if (olen == sizeof(efs)) { -+ remote_efs = 1; - memcpy(&efs, (void *) val, olen); -+ } - break; - - case L2CAP_CONF_EWS: -@@ -3563,16 +3564,17 @@ static int l2cap_parse_conf_rsp(struct l2cap_chan *chan, void *rsp, int len, - break; - - case L2CAP_CONF_EFS: -- if (olen == sizeof(efs)) -+ if (olen == sizeof(efs)) { - memcpy(&efs, (void *)val, olen); - -- if (chan->local_stype != L2CAP_SERV_NOTRAFIC && -- efs.stype != L2CAP_SERV_NOTRAFIC && -- efs.stype != chan->local_stype) -- return -ECONNREFUSED; -+ if (chan->local_stype != L2CAP_SERV_NOTRAFIC && -+ efs.stype != L2CAP_SERV_NOTRAFIC && -+ efs.stype != chan->local_stype) -+ return -ECONNREFUSED; - -- l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), -- (unsigned long) &efs, endptr - ptr); -+ l2cap_add_conf_opt(&ptr, L2CAP_CONF_EFS, sizeof(efs), -+ (unsigned long) &efs, endptr - ptr); -+ } - break; - - case L2CAP_CONF_FCS: -diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c -index 0c1d58d43f67..a47f693f9f14 100644 ---- a/net/core/sock_diag.c -+++ b/net/core/sock_diag.c -@@ -289,7 +289,7 @@ static int sock_diag_bind(struct net *net, int group) - case SKNLGRP_INET6_UDP_DESTROY: - if (!sock_diag_handlers[AF_INET6]) - request_module("net-pf-%d-proto-%d-type-%d", PF_NETLINK, -- NETLINK_SOCK_DIAG, AF_INET); -+ NETLINK_SOCK_DIAG, AF_INET6); - break; - } - return 0; -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index 1b4f5f2d2929..b809958f7388 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -1785,8 +1785,10 @@ struct sk_buff *ip6_make_skb(struct sock *sk, - cork.base.opt = NULL; - v6_cork.opt = NULL; - err = ip6_setup_cork(sk, &cork, &v6_cork, hlimit, tclass, opt, rt, fl6); -- if (err) -+ if (err) { -+ ip6_cork_release(&cork, &v6_cork); - return ERR_PTR(err); -+ } - - if (dontfrag < 0) - dontfrag = inet6_sk(sk)->dontfrag; -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 97cb02dc5f02..a7170a23ab0b 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -1083,10 +1083,11 @@ static int ip6_tnl_xmit2(struct sk_buff *skb, - memcpy(&fl6->daddr, addr6, sizeof(fl6->daddr)); - neigh_release(neigh); - } -- } else if (!(t->parms.flags & -- (IP6_TNL_F_USE_ORIG_TCLASS | IP6_TNL_F_USE_ORIG_FWMARK))) { -- /* enable the cache only only if the routing decision does -- * not depend on the current inner header value -+ } else if (t->parms.proto != 0 && !(t->parms.flags & -+ (IP6_TNL_F_USE_ORIG_TCLASS | -+ IP6_TNL_F_USE_ORIG_FWMARK))) { -+ /* enable the cache only if neither the outer protocol nor the -+ * routing decision depends on the current inner header value - */ - use_cache = true; - } -diff --git a/net/mac80211/debugfs.c b/net/mac80211/debugfs.c -index 4d2aaebd4f97..e546a987a9d3 100644 ---- a/net/mac80211/debugfs.c -+++ b/net/mac80211/debugfs.c -@@ -91,7 +91,7 @@ static const struct file_operations reset_ops = { - }; - #endif - --static const char *hw_flag_names[NUM_IEEE80211_HW_FLAGS + 1] = { -+static const char *hw_flag_names[] = { - #define FLAG(F) [IEEE80211_HW_##F] = #F - FLAG(HAS_RATE_CONTROL), - FLAG(RX_INCLUDES_FCS), -@@ -125,9 +125,6 @@ static const char *hw_flag_names[NUM_IEEE80211_HW_FLAGS + 1] = { - FLAG(TDLS_WIDER_BW), - FLAG(SUPPORTS_AMSDU_IN_AMPDU), - FLAG(BEACON_TX_STATUS), -- -- /* keep last for the build bug below */ -- (void *)0x1 - #undef FLAG - }; - -@@ -147,7 +144,7 @@ static ssize_t hwflags_read(struct file *file, char __user *user_buf, - /* fail compilation if somebody adds or removes - * a flag without updating the name array above - */ -- BUILD_BUG_ON(hw_flag_names[NUM_IEEE80211_HW_FLAGS] != (void *)0x1); -+ BUILD_BUG_ON(ARRAY_SIZE(hw_flag_names) != NUM_IEEE80211_HW_FLAGS); - - for (i = 0; i < NUM_IEEE80211_HW_FLAGS; i++) { - if (test_bit(i, local->hw.flags)) -diff --git a/net/rds/rdma.c b/net/rds/rdma.c -index bdf151c6307d..bdfc395d1be2 100644 ---- a/net/rds/rdma.c -+++ b/net/rds/rdma.c -@@ -517,6 +517,9 @@ int rds_rdma_extra_size(struct rds_rdma_args *args) - - local_vec = (struct rds_iovec __user *)(unsigned long) args->local_vec_addr; - -+ if (args->nr_local == 0) -+ return -EINVAL; -+ - /* figure out the number of pages in the vector */ - for (i = 0; i < args->nr_local; i++) { - if (copy_from_user(&vec, &local_vec[i], -@@ -866,6 +869,7 @@ int rds_cmsg_atomic(struct rds_sock *rs, struct rds_message *rm, - err: - if (page) - put_page(page); -+ rm->atomic.op_active = 0; - kfree(rm->atomic.op_notifier); - - return ret; -diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c -index 33e72c809e50..494b7b533366 100644 ---- a/sound/core/oss/pcm_oss.c -+++ b/sound/core/oss/pcm_oss.c -@@ -465,7 +465,6 @@ static int snd_pcm_hw_param_near(struct snd_pcm_substream *pcm, - v = snd_pcm_hw_param_last(pcm, params, var, dir); - else - v = snd_pcm_hw_param_first(pcm, params, var, dir); -- snd_BUG_ON(v < 0); - return v; - } - -@@ -1370,8 +1369,11 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha - - if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) - return tmp; -- mutex_lock(&runtime->oss.params_lock); - while (bytes > 0) { -+ if (mutex_lock_interruptible(&runtime->oss.params_lock)) { -+ tmp = -ERESTARTSYS; -+ break; -+ } - if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { - tmp = bytes; - if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes) -@@ -1415,14 +1417,18 @@ static ssize_t snd_pcm_oss_write1(struct snd_pcm_substream *substream, const cha - xfer += tmp; - if ((substream->f_flags & O_NONBLOCK) != 0 && - tmp != runtime->oss.period_bytes) -- break; -+ tmp = -EAGAIN; - } -- } -- mutex_unlock(&runtime->oss.params_lock); -- return xfer; -- - err: -- mutex_unlock(&runtime->oss.params_lock); -+ mutex_unlock(&runtime->oss.params_lock); -+ if (tmp < 0) -+ break; -+ if (signal_pending(current)) { -+ tmp = -ERESTARTSYS; -+ break; -+ } -+ tmp = 0; -+ } - return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; - } - -@@ -1470,8 +1476,11 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use - - if ((tmp = snd_pcm_oss_make_ready(substream)) < 0) - return tmp; -- mutex_lock(&runtime->oss.params_lock); - while (bytes > 0) { -+ if (mutex_lock_interruptible(&runtime->oss.params_lock)) { -+ tmp = -ERESTARTSYS; -+ break; -+ } - if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) { - if (runtime->oss.buffer_used == 0) { - tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1); -@@ -1502,12 +1511,16 @@ static ssize_t snd_pcm_oss_read1(struct snd_pcm_substream *substream, char __use - bytes -= tmp; - xfer += tmp; - } -- } -- mutex_unlock(&runtime->oss.params_lock); -- return xfer; -- - err: -- mutex_unlock(&runtime->oss.params_lock); -+ mutex_unlock(&runtime->oss.params_lock); -+ if (tmp < 0) -+ break; -+ if (signal_pending(current)) { -+ tmp = -ERESTARTSYS; -+ break; -+ } -+ tmp = 0; -+ } - return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp; - } - -diff --git a/sound/core/oss/pcm_plugin.c b/sound/core/oss/pcm_plugin.c -index 727ac44d39f4..a84a1d3d23e5 100644 ---- a/sound/core/oss/pcm_plugin.c -+++ b/sound/core/oss/pcm_plugin.c -@@ -591,18 +591,26 @@ snd_pcm_sframes_t snd_pcm_plug_write_transfer(struct snd_pcm_substream *plug, st - snd_pcm_sframes_t frames = size; - - plugin = snd_pcm_plug_first(plug); -- while (plugin && frames > 0) { -+ while (plugin) { -+ if (frames <= 0) -+ return frames; - if ((next = plugin->next) != NULL) { - snd_pcm_sframes_t frames1 = frames; -- if (plugin->dst_frames) -+ if (plugin->dst_frames) { - frames1 = plugin->dst_frames(plugin, frames); -+ if (frames1 <= 0) -+ return frames1; -+ } - if ((err = next->client_channels(next, frames1, &dst_channels)) < 0) { - return err; - } - if (err != frames1) { - frames = err; -- if (plugin->src_frames) -+ if (plugin->src_frames) { - frames = plugin->src_frames(plugin, frames1); -+ if (frames <= 0) -+ return frames; -+ } - } - } else - dst_channels = NULL; -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index cd20f91326fe..7b805766306e 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -1664,7 +1664,7 @@ int snd_pcm_hw_param_first(struct snd_pcm_substream *pcm, - return changed; - if (params->rmask) { - int err = snd_pcm_hw_refine(pcm, params); -- if (snd_BUG_ON(err < 0)) -+ if (err < 0) - return err; - } - return snd_pcm_hw_param_value(params, var, dir); -@@ -1711,7 +1711,7 @@ int snd_pcm_hw_param_last(struct snd_pcm_substream *pcm, - return changed; - if (params->rmask) { - int err = snd_pcm_hw_refine(pcm, params); -- if (snd_BUG_ON(err < 0)) -+ if (err < 0) - return err; - } - return snd_pcm_hw_param_value(params, var, dir); -diff --git a/sound/drivers/aloop.c b/sound/drivers/aloop.c -index 54f348a4fb78..cbd20cb8ca11 100644 ---- a/sound/drivers/aloop.c -+++ b/sound/drivers/aloop.c -@@ -39,6 +39,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -305,19 +306,6 @@ static int loopback_trigger(struct snd_pcm_substream *substream, int cmd) - return 0; - } - --static void params_change_substream(struct loopback_pcm *dpcm, -- struct snd_pcm_runtime *runtime) --{ -- struct snd_pcm_runtime *dst_runtime; -- -- if (dpcm == NULL || dpcm->substream == NULL) -- return; -- dst_runtime = dpcm->substream->runtime; -- if (dst_runtime == NULL) -- return; -- dst_runtime->hw = dpcm->cable->hw; --} -- - static void params_change(struct snd_pcm_substream *substream) - { - struct snd_pcm_runtime *runtime = substream->runtime; -@@ -329,10 +317,6 @@ static void params_change(struct snd_pcm_substream *substream) - cable->hw.rate_max = runtime->rate; - cable->hw.channels_min = runtime->channels; - cable->hw.channels_max = runtime->channels; -- params_change_substream(cable->streams[SNDRV_PCM_STREAM_PLAYBACK], -- runtime); -- params_change_substream(cable->streams[SNDRV_PCM_STREAM_CAPTURE], -- runtime); - } - - static int loopback_prepare(struct snd_pcm_substream *substream) -@@ -620,26 +604,29 @@ static unsigned int get_cable_index(struct snd_pcm_substream *substream) - static int rule_format(struct snd_pcm_hw_params *params, - struct snd_pcm_hw_rule *rule) - { -+ struct loopback_pcm *dpcm = rule->private; -+ struct loopback_cable *cable = dpcm->cable; -+ struct snd_mask m; - -- struct snd_pcm_hardware *hw = rule->private; -- struct snd_mask *maskp = hw_param_mask(params, rule->var); -- -- maskp->bits[0] &= (u_int32_t)hw->formats; -- maskp->bits[1] &= (u_int32_t)(hw->formats >> 32); -- memset(maskp->bits + 2, 0, (SNDRV_MASK_MAX-64) / 8); /* clear rest */ -- if (! maskp->bits[0] && ! maskp->bits[1]) -- return -EINVAL; -- return 0; -+ snd_mask_none(&m); -+ mutex_lock(&dpcm->loopback->cable_lock); -+ m.bits[0] = (u_int32_t)cable->hw.formats; -+ m.bits[1] = (u_int32_t)(cable->hw.formats >> 32); -+ mutex_unlock(&dpcm->loopback->cable_lock); -+ return snd_mask_refine(hw_param_mask(params, rule->var), &m); - } - - static int rule_rate(struct snd_pcm_hw_params *params, - struct snd_pcm_hw_rule *rule) - { -- struct snd_pcm_hardware *hw = rule->private; -+ struct loopback_pcm *dpcm = rule->private; -+ struct loopback_cable *cable = dpcm->cable; - struct snd_interval t; - -- t.min = hw->rate_min; -- t.max = hw->rate_max; -+ mutex_lock(&dpcm->loopback->cable_lock); -+ t.min = cable->hw.rate_min; -+ t.max = cable->hw.rate_max; -+ mutex_unlock(&dpcm->loopback->cable_lock); - t.openmin = t.openmax = 0; - t.integer = 0; - return snd_interval_refine(hw_param_interval(params, rule->var), &t); -@@ -648,22 +635,44 @@ static int rule_rate(struct snd_pcm_hw_params *params, - static int rule_channels(struct snd_pcm_hw_params *params, - struct snd_pcm_hw_rule *rule) - { -- struct snd_pcm_hardware *hw = rule->private; -+ struct loopback_pcm *dpcm = rule->private; -+ struct loopback_cable *cable = dpcm->cable; - struct snd_interval t; - -- t.min = hw->channels_min; -- t.max = hw->channels_max; -+ mutex_lock(&dpcm->loopback->cable_lock); -+ t.min = cable->hw.channels_min; -+ t.max = cable->hw.channels_max; -+ mutex_unlock(&dpcm->loopback->cable_lock); - t.openmin = t.openmax = 0; - t.integer = 0; - return snd_interval_refine(hw_param_interval(params, rule->var), &t); - } - -+static void free_cable(struct snd_pcm_substream *substream) -+{ -+ struct loopback *loopback = substream->private_data; -+ int dev = get_cable_index(substream); -+ struct loopback_cable *cable; -+ -+ cable = loopback->cables[substream->number][dev]; -+ if (!cable) -+ return; -+ if (cable->streams[!substream->stream]) { -+ /* other stream is still alive */ -+ cable->streams[substream->stream] = NULL; -+ } else { -+ /* free the cable */ -+ loopback->cables[substream->number][dev] = NULL; -+ kfree(cable); -+ } -+} -+ - static int loopback_open(struct snd_pcm_substream *substream) - { - struct snd_pcm_runtime *runtime = substream->runtime; - struct loopback *loopback = substream->private_data; - struct loopback_pcm *dpcm; -- struct loopback_cable *cable; -+ struct loopback_cable *cable = NULL; - int err = 0; - int dev = get_cable_index(substream); - -@@ -682,7 +691,6 @@ static int loopback_open(struct snd_pcm_substream *substream) - if (!cable) { - cable = kzalloc(sizeof(*cable), GFP_KERNEL); - if (!cable) { -- kfree(dpcm); - err = -ENOMEM; - goto unlock; - } -@@ -700,19 +708,19 @@ static int loopback_open(struct snd_pcm_substream *substream) - /* are cached -> they do not reflect the actual state */ - err = snd_pcm_hw_rule_add(runtime, 0, - SNDRV_PCM_HW_PARAM_FORMAT, -- rule_format, &runtime->hw, -+ rule_format, dpcm, - SNDRV_PCM_HW_PARAM_FORMAT, -1); - if (err < 0) - goto unlock; - err = snd_pcm_hw_rule_add(runtime, 0, - SNDRV_PCM_HW_PARAM_RATE, -- rule_rate, &runtime->hw, -+ rule_rate, dpcm, - SNDRV_PCM_HW_PARAM_RATE, -1); - if (err < 0) - goto unlock; - err = snd_pcm_hw_rule_add(runtime, 0, - SNDRV_PCM_HW_PARAM_CHANNELS, -- rule_channels, &runtime->hw, -+ rule_channels, dpcm, - SNDRV_PCM_HW_PARAM_CHANNELS, -1); - if (err < 0) - goto unlock; -@@ -724,6 +732,10 @@ static int loopback_open(struct snd_pcm_substream *substream) - else - runtime->hw = cable->hw; - unlock: -+ if (err < 0) { -+ free_cable(substream); -+ kfree(dpcm); -+ } - mutex_unlock(&loopback->cable_lock); - return err; - } -@@ -732,20 +744,10 @@ static int loopback_close(struct snd_pcm_substream *substream) - { - struct loopback *loopback = substream->private_data; - struct loopback_pcm *dpcm = substream->runtime->private_data; -- struct loopback_cable *cable; -- int dev = get_cable_index(substream); - - loopback_timer_stop(dpcm); - mutex_lock(&loopback->cable_lock); -- cable = loopback->cables[substream->number][dev]; -- if (cable->streams[!substream->stream]) { -- /* other stream is still alive */ -- cable->streams[substream->stream] = NULL; -- } else { -- /* free the cable */ -- loopback->cables[substream->number][dev] = NULL; -- kfree(cable); -- } -+ free_cable(substream); - mutex_unlock(&loopback->cable_lock); - return 0; - } -diff --git a/tools/testing/selftests/vm/Makefile b/tools/testing/selftests/vm/Makefile -index b5f08e8cab33..e4bb1de1d526 100644 ---- a/tools/testing/selftests/vm/Makefile -+++ b/tools/testing/selftests/vm/Makefile -@@ -1,9 +1,5 @@ - # Makefile for vm selftests - --ifndef OUTPUT -- OUTPUT := $(shell pwd) --endif -- - CFLAGS = -Wall -I ../../../../usr/include $(EXTRA_CFLAGS) - BINARIES = compaction_test - BINARIES += hugepage-mmap -diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile -index eabcff411984..92d7eff2827a 100644 ---- a/tools/testing/selftests/x86/Makefile -+++ b/tools/testing/selftests/x86/Makefile -@@ -4,7 +4,8 @@ include ../lib.mk - - .PHONY: all all_32 all_64 warn_32bit_failure clean - --TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt ptrace_syscall -+TARGETS_C_BOTHBITS := single_step_syscall sysret_ss_attrs ldt_gdt syscall_nt ptrace_syscall \ -+ test_vsyscall - TARGETS_C_32BIT_ONLY := entry_from_vm86 syscall_arg_fault sigreturn test_syscall_vdso unwind_vdso \ - test_FCMOV test_FCOMI test_FISTTP - -diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c -new file mode 100644 -index 000000000000..6e0bd52ad53d ---- /dev/null -+++ b/tools/testing/selftests/x86/test_vsyscall.c -@@ -0,0 +1,500 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+ -+#define _GNU_SOURCE -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+#ifdef __x86_64__ -+# define VSYS(x) (x) -+#else -+# define VSYS(x) 0 -+#endif -+ -+#ifndef SYS_getcpu -+# ifdef __x86_64__ -+# define SYS_getcpu 309 -+# else -+# define SYS_getcpu 318 -+# endif -+#endif -+ -+static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *), -+ int flags) -+{ -+ struct sigaction sa; -+ memset(&sa, 0, sizeof(sa)); -+ sa.sa_sigaction = handler; -+ sa.sa_flags = SA_SIGINFO | flags; -+ sigemptyset(&sa.sa_mask); -+ if (sigaction(sig, &sa, 0)) -+ err(1, "sigaction"); -+} -+ -+/* vsyscalls and vDSO */ -+bool should_read_vsyscall = false; -+ -+typedef long (*gtod_t)(struct timeval *tv, struct timezone *tz); -+gtod_t vgtod = (gtod_t)VSYS(0xffffffffff600000); -+gtod_t vdso_gtod; -+ -+typedef int (*vgettime_t)(clockid_t, struct timespec *); -+vgettime_t vdso_gettime; -+ -+typedef long (*time_func_t)(time_t *t); -+time_func_t vtime = (time_func_t)VSYS(0xffffffffff600400); -+time_func_t vdso_time; -+ -+typedef long (*getcpu_t)(unsigned *, unsigned *, void *); -+getcpu_t vgetcpu = (getcpu_t)VSYS(0xffffffffff600800); -+getcpu_t vdso_getcpu; -+ -+static void init_vdso(void) -+{ -+ void *vdso = dlopen("linux-vdso.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD); -+ if (!vdso) -+ vdso = dlopen("linux-gate.so.1", RTLD_LAZY | RTLD_LOCAL | RTLD_NOLOAD); -+ if (!vdso) { -+ printf("[WARN]\tfailed to find vDSO\n"); -+ return; -+ } -+ -+ vdso_gtod = (gtod_t)dlsym(vdso, "__vdso_gettimeofday"); -+ if (!vdso_gtod) -+ printf("[WARN]\tfailed to find gettimeofday in vDSO\n"); -+ -+ vdso_gettime = (vgettime_t)dlsym(vdso, "__vdso_clock_gettime"); -+ if (!vdso_gettime) -+ printf("[WARN]\tfailed to find clock_gettime in vDSO\n"); -+ -+ vdso_time = (time_func_t)dlsym(vdso, "__vdso_time"); -+ if (!vdso_time) -+ printf("[WARN]\tfailed to find time in vDSO\n"); -+ -+ vdso_getcpu = (getcpu_t)dlsym(vdso, "__vdso_getcpu"); -+ if (!vdso_getcpu) { -+ /* getcpu() was never wired up in the 32-bit vDSO. */ -+ printf("[%s]\tfailed to find getcpu in vDSO\n", -+ sizeof(long) == 8 ? "WARN" : "NOTE"); -+ } -+} -+ -+static int init_vsys(void) -+{ -+#ifdef __x86_64__ -+ int nerrs = 0; -+ FILE *maps; -+ char line[128]; -+ bool found = false; -+ -+ maps = fopen("/proc/self/maps", "r"); -+ if (!maps) { -+ printf("[WARN]\tCould not open /proc/self/maps -- assuming vsyscall is r-x\n"); -+ should_read_vsyscall = true; -+ return 0; -+ } -+ -+ while (fgets(line, sizeof(line), maps)) { -+ char r, x; -+ void *start, *end; -+ char name[128]; -+ if (sscanf(line, "%p-%p %c-%cp %*x %*x:%*x %*u %s", -+ &start, &end, &r, &x, name) != 5) -+ continue; -+ -+ if (strcmp(name, "[vsyscall]")) -+ continue; -+ -+ printf("\tvsyscall map: %s", line); -+ -+ if (start != (void *)0xffffffffff600000 || -+ end != (void *)0xffffffffff601000) { -+ printf("[FAIL]\taddress range is nonsense\n"); -+ nerrs++; -+ } -+ -+ printf("\tvsyscall permissions are %c-%c\n", r, x); -+ should_read_vsyscall = (r == 'r'); -+ if (x != 'x') { -+ vgtod = NULL; -+ vtime = NULL; -+ vgetcpu = NULL; -+ } -+ -+ found = true; -+ break; -+ } -+ -+ fclose(maps); -+ -+ if (!found) { -+ printf("\tno vsyscall map in /proc/self/maps\n"); -+ should_read_vsyscall = false; -+ vgtod = NULL; -+ vtime = NULL; -+ vgetcpu = NULL; -+ } -+ -+ return nerrs; -+#else -+ return 0; -+#endif -+} -+ -+/* syscalls */ -+static inline long sys_gtod(struct timeval *tv, struct timezone *tz) -+{ -+ return syscall(SYS_gettimeofday, tv, tz); -+} -+ -+static inline int sys_clock_gettime(clockid_t id, struct timespec *ts) -+{ -+ return syscall(SYS_clock_gettime, id, ts); -+} -+ -+static inline long sys_time(time_t *t) -+{ -+ return syscall(SYS_time, t); -+} -+ -+static inline long sys_getcpu(unsigned * cpu, unsigned * node, -+ void* cache) -+{ -+ return syscall(SYS_getcpu, cpu, node, cache); -+} -+ -+static jmp_buf jmpbuf; -+ -+static void sigsegv(int sig, siginfo_t *info, void *ctx_void) -+{ -+ siglongjmp(jmpbuf, 1); -+} -+ -+static double tv_diff(const struct timeval *a, const struct timeval *b) -+{ -+ return (double)(a->tv_sec - b->tv_sec) + -+ (double)((int)a->tv_usec - (int)b->tv_usec) * 1e-6; -+} -+ -+static int check_gtod(const struct timeval *tv_sys1, -+ const struct timeval *tv_sys2, -+ const struct timezone *tz_sys, -+ const char *which, -+ const struct timeval *tv_other, -+ const struct timezone *tz_other) -+{ -+ int nerrs = 0; -+ double d1, d2; -+ -+ if (tz_other && (tz_sys->tz_minuteswest != tz_other->tz_minuteswest || tz_sys->tz_dsttime != tz_other->tz_dsttime)) { -+ printf("[FAIL] %s tz mismatch\n", which); -+ nerrs++; -+ } -+ -+ d1 = tv_diff(tv_other, tv_sys1); -+ d2 = tv_diff(tv_sys2, tv_other); -+ printf("\t%s time offsets: %lf %lf\n", which, d1, d2); -+ -+ if (d1 < 0 || d2 < 0) { -+ printf("[FAIL]\t%s time was inconsistent with the syscall\n", which); -+ nerrs++; -+ } else { -+ printf("[OK]\t%s gettimeofday()'s timeval was okay\n", which); -+ } -+ -+ return nerrs; -+} -+ -+static int test_gtod(void) -+{ -+ struct timeval tv_sys1, tv_sys2, tv_vdso, tv_vsys; -+ struct timezone tz_sys, tz_vdso, tz_vsys; -+ long ret_vdso = -1; -+ long ret_vsys = -1; -+ int nerrs = 0; -+ -+ printf("[RUN]\ttest gettimeofday()\n"); -+ -+ if (sys_gtod(&tv_sys1, &tz_sys) != 0) -+ err(1, "syscall gettimeofday"); -+ if (vdso_gtod) -+ ret_vdso = vdso_gtod(&tv_vdso, &tz_vdso); -+ if (vgtod) -+ ret_vsys = vgtod(&tv_vsys, &tz_vsys); -+ if (sys_gtod(&tv_sys2, &tz_sys) != 0) -+ err(1, "syscall gettimeofday"); -+ -+ if (vdso_gtod) { -+ if (ret_vdso == 0) { -+ nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vDSO", &tv_vdso, &tz_vdso); -+ } else { -+ printf("[FAIL]\tvDSO gettimeofday() failed: %ld\n", ret_vdso); -+ nerrs++; -+ } -+ } -+ -+ if (vgtod) { -+ if (ret_vsys == 0) { -+ nerrs += check_gtod(&tv_sys1, &tv_sys2, &tz_sys, "vsyscall", &tv_vsys, &tz_vsys); -+ } else { -+ printf("[FAIL]\tvsys gettimeofday() failed: %ld\n", ret_vsys); -+ nerrs++; -+ } -+ } -+ -+ return nerrs; -+} -+ -+static int test_time(void) { -+ int nerrs = 0; -+ -+ printf("[RUN]\ttest time()\n"); -+ long t_sys1, t_sys2, t_vdso = 0, t_vsys = 0; -+ long t2_sys1 = -1, t2_sys2 = -1, t2_vdso = -1, t2_vsys = -1; -+ t_sys1 = sys_time(&t2_sys1); -+ if (vdso_time) -+ t_vdso = vdso_time(&t2_vdso); -+ if (vtime) -+ t_vsys = vtime(&t2_vsys); -+ t_sys2 = sys_time(&t2_sys2); -+ if (t_sys1 < 0 || t_sys1 != t2_sys1 || t_sys2 < 0 || t_sys2 != t2_sys2) { -+ printf("[FAIL]\tsyscall failed (ret1:%ld output1:%ld ret2:%ld output2:%ld)\n", t_sys1, t2_sys1, t_sys2, t2_sys2); -+ nerrs++; -+ return nerrs; -+ } -+ -+ if (vdso_time) { -+ if (t_vdso < 0 || t_vdso != t2_vdso) { -+ printf("[FAIL]\tvDSO failed (ret:%ld output:%ld)\n", t_vdso, t2_vdso); -+ nerrs++; -+ } else if (t_vdso < t_sys1 || t_vdso > t_sys2) { -+ printf("[FAIL]\tvDSO returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vdso, t_sys2); -+ nerrs++; -+ } else { -+ printf("[OK]\tvDSO time() is okay\n"); -+ } -+ } -+ -+ if (vtime) { -+ if (t_vsys < 0 || t_vsys != t2_vsys) { -+ printf("[FAIL]\tvsyscall failed (ret:%ld output:%ld)\n", t_vsys, t2_vsys); -+ nerrs++; -+ } else if (t_vsys < t_sys1 || t_vsys > t_sys2) { -+ printf("[FAIL]\tvsyscall returned the wrong time (%ld %ld %ld)\n", t_sys1, t_vsys, t_sys2); -+ nerrs++; -+ } else { -+ printf("[OK]\tvsyscall time() is okay\n"); -+ } -+ } -+ -+ return nerrs; -+} -+ -+static int test_getcpu(int cpu) -+{ -+ int nerrs = 0; -+ long ret_sys, ret_vdso = -1, ret_vsys = -1; -+ -+ printf("[RUN]\tgetcpu() on CPU %d\n", cpu); -+ -+ cpu_set_t cpuset; -+ CPU_ZERO(&cpuset); -+ CPU_SET(cpu, &cpuset); -+ if (sched_setaffinity(0, sizeof(cpuset), &cpuset) != 0) { -+ printf("[SKIP]\tfailed to force CPU %d\n", cpu); -+ return nerrs; -+ } -+ -+ unsigned cpu_sys, cpu_vdso, cpu_vsys, node_sys, node_vdso, node_vsys; -+ unsigned node = 0; -+ bool have_node = false; -+ ret_sys = sys_getcpu(&cpu_sys, &node_sys, 0); -+ if (vdso_getcpu) -+ ret_vdso = vdso_getcpu(&cpu_vdso, &node_vdso, 0); -+ if (vgetcpu) -+ ret_vsys = vgetcpu(&cpu_vsys, &node_vsys, 0); -+ -+ if (ret_sys == 0) { -+ if (cpu_sys != cpu) { -+ printf("[FAIL]\tsyscall reported CPU %hu but should be %d\n", cpu_sys, cpu); -+ nerrs++; -+ } -+ -+ have_node = true; -+ node = node_sys; -+ } -+ -+ if (vdso_getcpu) { -+ if (ret_vdso) { -+ printf("[FAIL]\tvDSO getcpu() failed\n"); -+ nerrs++; -+ } else { -+ if (!have_node) { -+ have_node = true; -+ node = node_vdso; -+ } -+ -+ if (cpu_vdso != cpu) { -+ printf("[FAIL]\tvDSO reported CPU %hu but should be %d\n", cpu_vdso, cpu); -+ nerrs++; -+ } else { -+ printf("[OK]\tvDSO reported correct CPU\n"); -+ } -+ -+ if (node_vdso != node) { -+ printf("[FAIL]\tvDSO reported node %hu but should be %hu\n", node_vdso, node); -+ nerrs++; -+ } else { -+ printf("[OK]\tvDSO reported correct node\n"); -+ } -+ } -+ } -+ -+ if (vgetcpu) { -+ if (ret_vsys) { -+ printf("[FAIL]\tvsyscall getcpu() failed\n"); -+ nerrs++; -+ } else { -+ if (!have_node) { -+ have_node = true; -+ node = node_vsys; -+ } -+ -+ if (cpu_vsys != cpu) { -+ printf("[FAIL]\tvsyscall reported CPU %hu but should be %d\n", cpu_vsys, cpu); -+ nerrs++; -+ } else { -+ printf("[OK]\tvsyscall reported correct CPU\n"); -+ } -+ -+ if (node_vsys != node) { -+ printf("[FAIL]\tvsyscall reported node %hu but should be %hu\n", node_vsys, node); -+ nerrs++; -+ } else { -+ printf("[OK]\tvsyscall reported correct node\n"); -+ } -+ } -+ } -+ -+ return nerrs; -+} -+ -+static int test_vsys_r(void) -+{ -+#ifdef __x86_64__ -+ printf("[RUN]\tChecking read access to the vsyscall page\n"); -+ bool can_read; -+ if (sigsetjmp(jmpbuf, 1) == 0) { -+ *(volatile int *)0xffffffffff600000; -+ can_read = true; -+ } else { -+ can_read = false; -+ } -+ -+ if (can_read && !should_read_vsyscall) { -+ printf("[FAIL]\tWe have read access, but we shouldn't\n"); -+ return 1; -+ } else if (!can_read && should_read_vsyscall) { -+ printf("[FAIL]\tWe don't have read access, but we should\n"); -+ return 1; -+ } else { -+ printf("[OK]\tgot expected result\n"); -+ } -+#endif -+ -+ return 0; -+} -+ -+ -+#ifdef __x86_64__ -+#define X86_EFLAGS_TF (1UL << 8) -+static volatile sig_atomic_t num_vsyscall_traps; -+ -+static unsigned long get_eflags(void) -+{ -+ unsigned long eflags; -+ asm volatile ("pushfq\n\tpopq %0" : "=rm" (eflags)); -+ return eflags; -+} -+ -+static void set_eflags(unsigned long eflags) -+{ -+ asm volatile ("pushq %0\n\tpopfq" : : "rm" (eflags) : "flags"); -+} -+ -+static void sigtrap(int sig, siginfo_t *info, void *ctx_void) -+{ -+ ucontext_t *ctx = (ucontext_t *)ctx_void; -+ unsigned long ip = ctx->uc_mcontext.gregs[REG_RIP]; -+ -+ if (((ip ^ 0xffffffffff600000UL) & ~0xfffUL) == 0) -+ num_vsyscall_traps++; -+} -+ -+static int test_native_vsyscall(void) -+{ -+ time_t tmp; -+ bool is_native; -+ -+ if (!vtime) -+ return 0; -+ -+ printf("[RUN]\tchecking for native vsyscall\n"); -+ sethandler(SIGTRAP, sigtrap, 0); -+ set_eflags(get_eflags() | X86_EFLAGS_TF); -+ vtime(&tmp); -+ set_eflags(get_eflags() & ~X86_EFLAGS_TF); -+ -+ /* -+ * If vsyscalls are emulated, we expect a single trap in the -+ * vsyscall page -- the call instruction will trap with RIP -+ * pointing to the entry point before emulation takes over. -+ * In native mode, we expect two traps, since whatever code -+ * the vsyscall page contains will be more than just a ret -+ * instruction. -+ */ -+ is_native = (num_vsyscall_traps > 1); -+ -+ printf("\tvsyscalls are %s (%d instructions in vsyscall page)\n", -+ (is_native ? "native" : "emulated"), -+ (int)num_vsyscall_traps); -+ -+ return 0; -+} -+#endif -+ -+int main(int argc, char **argv) -+{ -+ int nerrs = 0; -+ -+ init_vdso(); -+ nerrs += init_vsys(); -+ -+ nerrs += test_gtod(); -+ nerrs += test_time(); -+ nerrs += test_getcpu(0); -+ nerrs += test_getcpu(1); -+ -+ sethandler(SIGSEGV, sigsegv, 0); -+ nerrs += test_vsys_r(); -+ -+#ifdef __x86_64__ -+ nerrs += test_native_vsyscall(); -+#endif -+ -+ return nerrs ? 1 : 0; -+} diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.112-113.patch b/patch/kernel/mvebu64-default/04-patch-4.4.112-113.patch deleted file mode 100644 index 8153f8092fd5..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.112-113.patch +++ /dev/null @@ -1,2220 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 39280b72f27a..22a4688dc0c8 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2452,6 +2452,11 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - - nohugeiomap [KNL,x86] Disable kernel huge I/O mappings. - -+ nospectre_v2 [X86] Disable all mitigations for the Spectre variant 2 -+ (indirect branch prediction) vulnerability. System may -+ allow data leaks with this option, which is equivalent -+ to spectre_v2=off. -+ - noxsave [BUGS=X86] Disables x86 extended register state save - and restore using xsave. The kernel will fallback to - enabling legacy floating-point and sse state. -@@ -3594,6 +3599,29 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - sonypi.*= [HW] Sony Programmable I/O Control Device driver - See Documentation/laptops/sonypi.txt - -+ spectre_v2= [X86] Control mitigation of Spectre variant 2 -+ (indirect branch speculation) vulnerability. -+ -+ on - unconditionally enable -+ off - unconditionally disable -+ auto - kernel detects whether your CPU model is -+ vulnerable -+ -+ Selecting 'on' will, and 'auto' may, choose a -+ mitigation method at run time according to the -+ CPU, the available microcode, the setting of the -+ CONFIG_RETPOLINE configuration option, and the -+ compiler with which the kernel was built. -+ -+ Specific mitigations can also be selected manually: -+ -+ retpoline - replace indirect branches -+ retpoline,generic - google's original retpoline -+ retpoline,amd - AMD-specific minimal thunk -+ -+ Not specifying this option is equivalent to -+ spectre_v2=auto. -+ - spia_io_base= [HW,MTD] - spia_fio_base= - spia_pedr= -diff --git a/Documentation/x86/pti.txt b/Documentation/x86/pti.txt -index d11eff61fc9a..5cd58439ad2d 100644 ---- a/Documentation/x86/pti.txt -+++ b/Documentation/x86/pti.txt -@@ -78,7 +78,7 @@ this protection comes at a cost: - non-PTI SYSCALL entry code, so requires mapping fewer - things into the userspace page tables. The downside is - that stacks must be switched at entry time. -- d. Global pages are disabled for all kernel structures not -+ c. Global pages are disabled for all kernel structures not - mapped into both kernel and userspace page tables. This - feature of the MMU allows different processes to share TLB - entries mapping the kernel. Losing the feature means more -diff --git a/Makefile b/Makefile -index 07070a1e6292..39019c9d205c 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 112 -+SUBLEVEL = 113 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts -index d5e3bc518968..d57f48543f76 100644 ---- a/arch/arm/boot/dts/kirkwood-openblocks_a7.dts -+++ b/arch/arm/boot/dts/kirkwood-openblocks_a7.dts -@@ -53,7 +53,8 @@ - }; - - pinctrl: pin-controller@10000 { -- pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header>; -+ pinctrl-0 = <&pmx_dip_switches &pmx_gpio_header -+ &pmx_gpio_header_gpo>; - pinctrl-names = "default"; - - pmx_uart0: pmx-uart0 { -@@ -85,11 +86,16 @@ - * ground. - */ - pmx_gpio_header: pmx-gpio-header { -- marvell,pins = "mpp17", "mpp7", "mpp29", "mpp28", -+ marvell,pins = "mpp17", "mpp29", "mpp28", - "mpp35", "mpp34", "mpp40"; - marvell,function = "gpio"; - }; - -+ pmx_gpio_header_gpo: pxm-gpio-header-gpo { -+ marvell,pins = "mpp7"; -+ marvell,function = "gpo"; -+ }; -+ - pmx_gpio_init: pmx-init { - marvell,pins = "mpp38"; - marvell,function = "gpio"; -diff --git a/arch/mips/ar7/platform.c b/arch/mips/ar7/platform.c -index 3446b6fb3acb..9da4e2292fc7 100644 ---- a/arch/mips/ar7/platform.c -+++ b/arch/mips/ar7/platform.c -@@ -576,7 +576,7 @@ static int __init ar7_register_uarts(void) - uart_port.type = PORT_AR7; - uart_port.uartclk = clk_get_rate(bus_clk) / 2; - uart_port.iotype = UPIO_MEM32; -- uart_port.flags = UPF_FIXED_TYPE; -+ uart_port.flags = UPF_FIXED_TYPE | UPF_BOOT_AUTOCONF; - uart_port.regshift = 2; - - uart_port.line = 0; -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 0ef2cdd11616..75d0053b495a 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -379,6 +379,19 @@ config GOLDFISH - def_bool y - depends on X86_GOLDFISH - -+config RETPOLINE -+ bool "Avoid speculative indirect branches in kernel" -+ default y -+ ---help--- -+ Compile kernel with the retpoline compiler options to guard against -+ kernel-to-user data leaks by avoiding speculative indirect -+ branches. Requires a compiler with -mindirect-branch=thunk-extern -+ support for full protection. The kernel may run slower. -+ -+ Without compiler support, at least indirect branches in assembler -+ code are eliminated. Since this includes the syscall entry path, -+ it is not entirely pointless. -+ - if X86_32 - config X86_EXTENDED_PLATFORM - bool "Support for extended (non-PC) x86 platforms" -diff --git a/arch/x86/Makefile b/arch/x86/Makefile -index 4086abca0b32..1f9caa041bf7 100644 ---- a/arch/x86/Makefile -+++ b/arch/x86/Makefile -@@ -189,6 +189,14 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables - KBUILD_CFLAGS += $(mflags-y) - KBUILD_AFLAGS += $(mflags-y) - -+# Avoid indirect branches in kernel to deal with Spectre -+ifdef CONFIG_RETPOLINE -+ RETPOLINE_CFLAGS += $(call cc-option,-mindirect-branch=thunk-extern -mindirect-branch-register) -+ ifneq ($(RETPOLINE_CFLAGS),) -+ KBUILD_CFLAGS += $(RETPOLINE_CFLAGS) -DRETPOLINE -+ endif -+endif -+ - archscripts: scripts_basic - $(Q)$(MAKE) $(build)=arch/x86/tools relocs - -diff --git a/arch/x86/crypto/aesni-intel_asm.S b/arch/x86/crypto/aesni-intel_asm.S -index 6bd2c6c95373..3f93dedb5a4d 100644 ---- a/arch/x86/crypto/aesni-intel_asm.S -+++ b/arch/x86/crypto/aesni-intel_asm.S -@@ -31,6 +31,7 @@ - - #include - #include -+#include - - /* - * The following macros are used to move an (un)aligned 16 byte value to/from -@@ -2714,7 +2715,7 @@ ENTRY(aesni_xts_crypt8) - pxor INC, STATE4 - movdqu IV, 0x30(OUTP) - -- call *%r11 -+ CALL_NOSPEC %r11 - - movdqu 0x00(OUTP), INC - pxor INC, STATE1 -@@ -2759,7 +2760,7 @@ ENTRY(aesni_xts_crypt8) - _aesni_gf128mul_x_ble() - movups IV, (IVP) - -- call *%r11 -+ CALL_NOSPEC %r11 - - movdqu 0x40(OUTP), INC - pxor INC, STATE1 -diff --git a/arch/x86/crypto/camellia-aesni-avx-asm_64.S b/arch/x86/crypto/camellia-aesni-avx-asm_64.S -index ce71f9212409..5881756f78a2 100644 ---- a/arch/x86/crypto/camellia-aesni-avx-asm_64.S -+++ b/arch/x86/crypto/camellia-aesni-avx-asm_64.S -@@ -16,6 +16,7 @@ - */ - - #include -+#include - - #define CAMELLIA_TABLE_BYTE_LEN 272 - -@@ -1210,7 +1211,7 @@ camellia_xts_crypt_16way: - vpxor 14 * 16(%rax), %xmm15, %xmm14; - vpxor 15 * 16(%rax), %xmm15, %xmm15; - -- call *%r9; -+ CALL_NOSPEC %r9; - - addq $(16 * 16), %rsp; - -diff --git a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S -index 0e0b8863a34b..0d45b04b490a 100644 ---- a/arch/x86/crypto/camellia-aesni-avx2-asm_64.S -+++ b/arch/x86/crypto/camellia-aesni-avx2-asm_64.S -@@ -11,6 +11,7 @@ - */ - - #include -+#include - - #define CAMELLIA_TABLE_BYTE_LEN 272 - -@@ -1323,7 +1324,7 @@ camellia_xts_crypt_32way: - vpxor 14 * 32(%rax), %ymm15, %ymm14; - vpxor 15 * 32(%rax), %ymm15, %ymm15; - -- call *%r9; -+ CALL_NOSPEC %r9; - - addq $(16 * 32), %rsp; - -diff --git a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S -index 4fe27e074194..48767520cbe0 100644 ---- a/arch/x86/crypto/crc32c-pcl-intel-asm_64.S -+++ b/arch/x86/crypto/crc32c-pcl-intel-asm_64.S -@@ -45,6 +45,7 @@ - - #include - #include -+#include - - ## ISCSI CRC 32 Implementation with crc32 and pclmulqdq Instruction - -@@ -172,7 +173,7 @@ continue_block: - movzxw (bufp, %rax, 2), len - offset=crc_array-jump_table - lea offset(bufp, len, 1), bufp -- jmp *bufp -+ JMP_NOSPEC bufp - - ################################################################ - ## 2a) PROCESS FULL BLOCKS: -diff --git a/arch/x86/entry/entry_32.S b/arch/x86/entry/entry_32.S -index ae678ad128a9..d437f3871e53 100644 ---- a/arch/x86/entry/entry_32.S -+++ b/arch/x86/entry/entry_32.S -@@ -44,6 +44,7 @@ - #include - #include - #include -+#include - - .section .entry.text, "ax" - -@@ -226,7 +227,8 @@ ENTRY(ret_from_kernel_thread) - pushl $0x0202 # Reset kernel eflags - popfl - movl PT_EBP(%esp), %eax -- call *PT_EBX(%esp) -+ movl PT_EBX(%esp), %edx -+ CALL_NOSPEC %edx - movl $0, PT_EAX(%esp) - - /* -@@ -861,7 +863,8 @@ trace: - movl 0x4(%ebp), %edx - subl $MCOUNT_INSN_SIZE, %eax - -- call *ftrace_trace_function -+ movl ftrace_trace_function, %ecx -+ CALL_NOSPEC %ecx - - popl %edx - popl %ecx -@@ -896,7 +899,7 @@ return_to_handler: - movl %eax, %ecx - popl %edx - popl %eax -- jmp *%ecx -+ JMP_NOSPEC %ecx - #endif - - #ifdef CONFIG_TRACING -@@ -938,7 +941,7 @@ error_code: - movl %ecx, %es - TRACE_IRQS_OFF - movl %esp, %eax # pt_regs pointer -- call *%edi -+ CALL_NOSPEC %edi - jmp ret_from_exception - END(page_fault) - -diff --git a/arch/x86/entry/entry_64.S b/arch/x86/entry/entry_64.S -index 952b23b5d4e9..a03b22c615d9 100644 ---- a/arch/x86/entry/entry_64.S -+++ b/arch/x86/entry/entry_64.S -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - #include - - /* Avoid __ASSEMBLER__'ifying just for this. */ -@@ -184,7 +185,13 @@ entry_SYSCALL_64_fastpath: - #endif - ja 1f /* return -ENOSYS (already in pt_regs->ax) */ - movq %r10, %rcx -+#ifdef CONFIG_RETPOLINE -+ movq sys_call_table(, %rax, 8), %rax -+ call __x86_indirect_thunk_rax -+#else - call *sys_call_table(, %rax, 8) -+#endif -+ - movq %rax, RAX(%rsp) - 1: - /* -@@ -276,7 +283,12 @@ tracesys_phase2: - #endif - ja 1f /* return -ENOSYS (already in pt_regs->ax) */ - movq %r10, %rcx /* fixup for C */ -+#ifdef CONFIG_RETPOLINE -+ movq sys_call_table(, %rax, 8), %rax -+ call __x86_indirect_thunk_rax -+#else - call *sys_call_table(, %rax, 8) -+#endif - movq %rax, RAX(%rsp) - 1: - /* Use IRET because user could have changed pt_regs->foo */ -@@ -491,7 +503,7 @@ ENTRY(ret_from_fork) - * nb: we depend on RESTORE_EXTRA_REGS above - */ - movq %rbp, %rdi -- call *%rbx -+ CALL_NOSPEC %rbx - movl $0, RAX(%rsp) - RESTORE_EXTRA_REGS - jmp int_ret_from_sys_call -@@ -1019,7 +1031,7 @@ idtentry async_page_fault do_async_page_fault has_error_code=1 - #endif - - #ifdef CONFIG_X86_MCE --idtentry machine_check has_error_code=0 paranoid=1 do_sym=*machine_check_vector(%rip) -+idtentry machine_check do_mce has_error_code=0 paranoid=1 - #endif - - /* -diff --git a/arch/x86/include/asm/alternative.h b/arch/x86/include/asm/alternative.h -index d1cf17173b1b..215ea9214215 100644 ---- a/arch/x86/include/asm/alternative.h -+++ b/arch/x86/include/asm/alternative.h -@@ -1,6 +1,8 @@ - #ifndef _ASM_X86_ALTERNATIVE_H - #define _ASM_X86_ALTERNATIVE_H - -+#ifndef __ASSEMBLY__ -+ - #include - #include - #include -@@ -271,4 +273,6 @@ extern void *text_poke(void *addr, const void *opcode, size_t len); - extern int poke_int3_handler(struct pt_regs *regs); - extern void *text_poke_bp(void *addr, const void *opcode, size_t len, void *handler); - -+#endif /* __ASSEMBLY__ */ -+ - #endif /* _ASM_X86_ALTERNATIVE_H */ -diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h -new file mode 100644 -index 000000000000..b15aa4083dfd ---- /dev/null -+++ b/arch/x86/include/asm/asm-prototypes.h -@@ -0,0 +1,41 @@ -+#include -+#include -+#include -+#include -+#include -+ -+#include -+ -+#include -+#include -+#include -+#include -+#include -+ -+#ifndef CONFIG_X86_CMPXCHG64 -+extern void cmpxchg8b_emu(void); -+#endif -+ -+#ifdef CONFIG_RETPOLINE -+#ifdef CONFIG_X86_32 -+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_e ## reg(void); -+#else -+#define INDIRECT_THUNK(reg) extern asmlinkage void __x86_indirect_thunk_r ## reg(void); -+INDIRECT_THUNK(8) -+INDIRECT_THUNK(9) -+INDIRECT_THUNK(10) -+INDIRECT_THUNK(11) -+INDIRECT_THUNK(12) -+INDIRECT_THUNK(13) -+INDIRECT_THUNK(14) -+INDIRECT_THUNK(15) -+#endif -+INDIRECT_THUNK(ax) -+INDIRECT_THUNK(bx) -+INDIRECT_THUNK(cx) -+INDIRECT_THUNK(dx) -+INDIRECT_THUNK(si) -+INDIRECT_THUNK(di) -+INDIRECT_THUNK(bp) -+INDIRECT_THUNK(sp) -+#endif /* CONFIG_RETPOLINE */ -diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h -index 189679aba703..b9c6c7a6f5a6 100644 ---- a/arch/x86/include/asm/asm.h -+++ b/arch/x86/include/asm/asm.h -@@ -105,4 +105,15 @@ - /* For C file, we already have NOKPROBE_SYMBOL macro */ - #endif - -+#ifndef __ASSEMBLY__ -+/* -+ * This output constraint should be used for any inline asm which has a "call" -+ * instruction. Otherwise the asm may be inserted before the frame pointer -+ * gets set up by the containing function. If you forget to do this, objtool -+ * may print a "call without frame pointer save/setup" warning. -+ */ -+register unsigned long current_stack_pointer asm(_ASM_SP); -+#define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer) -+#endif -+ - #endif /* _ASM_X86_ASM_H */ -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index 142028afd049..0fbc98568018 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -200,6 +200,8 @@ - #define X86_FEATURE_HWP_PKG_REQ ( 7*32+14) /* Intel HWP_PKG_REQ */ - #define X86_FEATURE_INTEL_PT ( 7*32+15) /* Intel Processor Trace */ - -+#define X86_FEATURE_RETPOLINE ( 7*32+29) /* Generic Retpoline mitigation for Spectre variant 2 */ -+#define X86_FEATURE_RETPOLINE_AMD ( 7*32+30) /* AMD Retpoline mitigation for Spectre variant 2 */ - /* Because the ALTERNATIVE scheme is for members of the X86_FEATURE club... */ - #define X86_FEATURE_KAISER ( 7*32+31) /* CONFIG_PAGE_TABLE_ISOLATION w/o nokaiser */ - -diff --git a/arch/x86/include/asm/msr-index.h b/arch/x86/include/asm/msr-index.h -index 37db36fddc88..b8911aecf035 100644 ---- a/arch/x86/include/asm/msr-index.h -+++ b/arch/x86/include/asm/msr-index.h -@@ -330,6 +330,9 @@ - #define FAM10H_MMIO_CONF_BASE_MASK 0xfffffffULL - #define FAM10H_MMIO_CONF_BASE_SHIFT 20 - #define MSR_FAM10H_NODE_ID 0xc001100c -+#define MSR_F10H_DECFG 0xc0011029 -+#define MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT 1 -+#define MSR_F10H_DECFG_LFENCE_SERIALIZE BIT_ULL(MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT) - - /* K8 MSRs */ - #define MSR_K8_TOP_MEM1 0xc001001a -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -new file mode 100644 -index 000000000000..492370b9b35b ---- /dev/null -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -0,0 +1,198 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+ -+#ifndef __NOSPEC_BRANCH_H__ -+#define __NOSPEC_BRANCH_H__ -+ -+#include -+#include -+#include -+ -+/* -+ * Fill the CPU return stack buffer. -+ * -+ * Each entry in the RSB, if used for a speculative 'ret', contains an -+ * infinite 'pause; lfence; jmp' loop to capture speculative execution. -+ * -+ * This is required in various cases for retpoline and IBRS-based -+ * mitigations for the Spectre variant 2 vulnerability. Sometimes to -+ * eliminate potentially bogus entries from the RSB, and sometimes -+ * purely to ensure that it doesn't get empty, which on some CPUs would -+ * allow predictions from other (unwanted!) sources to be used. -+ * -+ * We define a CPP macro such that it can be used from both .S files and -+ * inline assembly. It's possible to do a .macro and then include that -+ * from C via asm(".include ") but let's not go there. -+ */ -+ -+#define RSB_CLEAR_LOOPS 32 /* To forcibly overwrite all entries */ -+#define RSB_FILL_LOOPS 16 /* To avoid underflow */ -+ -+/* -+ * Google experimented with loop-unrolling and this turned out to be -+ * the optimal version — two calls, each with their own speculation -+ * trap should their return address end up getting used, in a loop. -+ */ -+#define __FILL_RETURN_BUFFER(reg, nr, sp) \ -+ mov $(nr/2), reg; \ -+771: \ -+ call 772f; \ -+773: /* speculation trap */ \ -+ pause; \ -+ lfence; \ -+ jmp 773b; \ -+772: \ -+ call 774f; \ -+775: /* speculation trap */ \ -+ pause; \ -+ lfence; \ -+ jmp 775b; \ -+774: \ -+ dec reg; \ -+ jnz 771b; \ -+ add $(BITS_PER_LONG/8) * nr, sp; -+ -+#ifdef __ASSEMBLY__ -+ -+/* -+ * These are the bare retpoline primitives for indirect jmp and call. -+ * Do not use these directly; they only exist to make the ALTERNATIVE -+ * invocation below less ugly. -+ */ -+.macro RETPOLINE_JMP reg:req -+ call .Ldo_rop_\@ -+.Lspec_trap_\@: -+ pause -+ lfence -+ jmp .Lspec_trap_\@ -+.Ldo_rop_\@: -+ mov \reg, (%_ASM_SP) -+ ret -+.endm -+ -+/* -+ * This is a wrapper around RETPOLINE_JMP so the called function in reg -+ * returns to the instruction after the macro. -+ */ -+.macro RETPOLINE_CALL reg:req -+ jmp .Ldo_call_\@ -+.Ldo_retpoline_jmp_\@: -+ RETPOLINE_JMP \reg -+.Ldo_call_\@: -+ call .Ldo_retpoline_jmp_\@ -+.endm -+ -+/* -+ * JMP_NOSPEC and CALL_NOSPEC macros can be used instead of a simple -+ * indirect jmp/call which may be susceptible to the Spectre variant 2 -+ * attack. -+ */ -+.macro JMP_NOSPEC reg:req -+#ifdef CONFIG_RETPOLINE -+ ALTERNATIVE_2 __stringify(jmp *\reg), \ -+ __stringify(RETPOLINE_JMP \reg), X86_FEATURE_RETPOLINE, \ -+ __stringify(lfence; jmp *\reg), X86_FEATURE_RETPOLINE_AMD -+#else -+ jmp *\reg -+#endif -+.endm -+ -+.macro CALL_NOSPEC reg:req -+#ifdef CONFIG_RETPOLINE -+ ALTERNATIVE_2 __stringify(call *\reg), \ -+ __stringify(RETPOLINE_CALL \reg), X86_FEATURE_RETPOLINE,\ -+ __stringify(lfence; call *\reg), X86_FEATURE_RETPOLINE_AMD -+#else -+ call *\reg -+#endif -+.endm -+ -+ /* -+ * A simpler FILL_RETURN_BUFFER macro. Don't make people use the CPP -+ * monstrosity above, manually. -+ */ -+.macro FILL_RETURN_BUFFER reg:req nr:req ftr:req -+#ifdef CONFIG_RETPOLINE -+ ALTERNATIVE "jmp .Lskip_rsb_\@", \ -+ __stringify(__FILL_RETURN_BUFFER(\reg,\nr,%_ASM_SP)) \ -+ \ftr -+.Lskip_rsb_\@: -+#endif -+.endm -+ -+#else /* __ASSEMBLY__ */ -+ -+#if defined(CONFIG_X86_64) && defined(RETPOLINE) -+ -+/* -+ * Since the inline asm uses the %V modifier which is only in newer GCC, -+ * the 64-bit one is dependent on RETPOLINE not CONFIG_RETPOLINE. -+ */ -+# define CALL_NOSPEC \ -+ ALTERNATIVE( \ -+ "call *%[thunk_target]\n", \ -+ "call __x86_indirect_thunk_%V[thunk_target]\n", \ -+ X86_FEATURE_RETPOLINE) -+# define THUNK_TARGET(addr) [thunk_target] "r" (addr) -+ -+#elif defined(CONFIG_X86_32) && defined(CONFIG_RETPOLINE) -+/* -+ * For i386 we use the original ret-equivalent retpoline, because -+ * otherwise we'll run out of registers. We don't care about CET -+ * here, anyway. -+ */ -+# define CALL_NOSPEC ALTERNATIVE("call *%[thunk_target]\n", \ -+ " jmp 904f;\n" \ -+ " .align 16\n" \ -+ "901: call 903f;\n" \ -+ "902: pause;\n" \ -+ " lfence;\n" \ -+ " jmp 902b;\n" \ -+ " .align 16\n" \ -+ "903: addl $4, %%esp;\n" \ -+ " pushl %[thunk_target];\n" \ -+ " ret;\n" \ -+ " .align 16\n" \ -+ "904: call 901b;\n", \ -+ X86_FEATURE_RETPOLINE) -+ -+# define THUNK_TARGET(addr) [thunk_target] "rm" (addr) -+#else /* No retpoline for C / inline asm */ -+# define CALL_NOSPEC "call *%[thunk_target]\n" -+# define THUNK_TARGET(addr) [thunk_target] "rm" (addr) -+#endif -+ -+/* The Spectre V2 mitigation variants */ -+enum spectre_v2_mitigation { -+ SPECTRE_V2_NONE, -+ SPECTRE_V2_RETPOLINE_MINIMAL, -+ SPECTRE_V2_RETPOLINE_MINIMAL_AMD, -+ SPECTRE_V2_RETPOLINE_GENERIC, -+ SPECTRE_V2_RETPOLINE_AMD, -+ SPECTRE_V2_IBRS, -+}; -+ -+extern char __indirect_thunk_start[]; -+extern char __indirect_thunk_end[]; -+ -+/* -+ * On VMEXIT we must ensure that no RSB predictions learned in the guest -+ * can be followed in the host, by overwriting the RSB completely. Both -+ * retpoline and IBRS mitigations for Spectre v2 need this; only on future -+ * CPUs with IBRS_ATT *might* it be avoided. -+ */ -+static inline void vmexit_fill_RSB(void) -+{ -+#ifdef CONFIG_RETPOLINE -+ unsigned long loops; -+ -+ asm volatile (ALTERNATIVE("jmp 910f", -+ __stringify(__FILL_RETURN_BUFFER(%0, RSB_CLEAR_LOOPS, %1)), -+ X86_FEATURE_RETPOLINE) -+ "910:" -+ : "=r" (loops), ASM_CALL_CONSTRAINT -+ : : "memory" ); -+#endif -+} -+ -+#endif /* __ASSEMBLY__ */ -+#endif /* __NOSPEC_BRANCH_H__ */ -diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h -index c7b551028740..9b028204685d 100644 ---- a/arch/x86/include/asm/thread_info.h -+++ b/arch/x86/include/asm/thread_info.h -@@ -166,17 +166,6 @@ static inline struct thread_info *current_thread_info(void) - return (struct thread_info *)(current_top_of_stack() - THREAD_SIZE); - } - --static inline unsigned long current_stack_pointer(void) --{ -- unsigned long sp; --#ifdef CONFIG_X86_64 -- asm("mov %%rsp,%0" : "=g" (sp)); --#else -- asm("mov %%esp,%0" : "=g" (sp)); --#endif -- return sp; --} -- - #else /* !__ASSEMBLY__ */ - - #ifdef CONFIG_X86_64 -diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h -index c3496619740a..156959ca49ce 100644 ---- a/arch/x86/include/asm/traps.h -+++ b/arch/x86/include/asm/traps.h -@@ -92,6 +92,7 @@ dotraplinkage void do_simd_coprocessor_error(struct pt_regs *, long); - #ifdef CONFIG_X86_32 - dotraplinkage void do_iret_error(struct pt_regs *, long); - #endif -+dotraplinkage void do_mce(struct pt_regs *, long); - - static inline int get_si_code(unsigned long condition) - { -diff --git a/arch/x86/include/asm/xen/hypercall.h b/arch/x86/include/asm/xen/hypercall.h -index 85133b2b8e99..0977e7607046 100644 ---- a/arch/x86/include/asm/xen/hypercall.h -+++ b/arch/x86/include/asm/xen/hypercall.h -@@ -44,6 +44,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -215,9 +216,9 @@ privcmd_call(unsigned call, - __HYPERCALL_5ARG(a1, a2, a3, a4, a5); - - stac(); -- asm volatile("call *%[call]" -+ asm volatile(CALL_NOSPEC - : __HYPERCALL_5PARAM -- : [call] "a" (&hypercall_page[call]) -+ : [thunk_target] "a" (&hypercall_page[call]) - : __HYPERCALL_CLOBBER5); - clac(); - -diff --git a/arch/x86/kernel/apic/vector.c b/arch/x86/kernel/apic/vector.c -index 0988e204f1e3..a41e523536a2 100644 ---- a/arch/x86/kernel/apic/vector.c -+++ b/arch/x86/kernel/apic/vector.c -@@ -359,14 +359,17 @@ static int x86_vector_alloc_irqs(struct irq_domain *domain, unsigned int virq, - irq_data->chip_data = data; - irq_data->hwirq = virq + i; - err = assign_irq_vector_policy(virq + i, node, data, info); -- if (err) -+ if (err) { -+ irq_data->chip_data = NULL; -+ free_apic_chip_data(data); - goto error; -+ } - } - - return 0; - - error: -- x86_vector_free_irqs(domain, virq, i + 1); -+ x86_vector_free_irqs(domain, virq, i); - return err; - } - -diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c -index e2defc7593a4..4bf9e77f3e05 100644 ---- a/arch/x86/kernel/cpu/amd.c -+++ b/arch/x86/kernel/cpu/amd.c -@@ -746,8 +746,32 @@ static void init_amd(struct cpuinfo_x86 *c) - set_cpu_cap(c, X86_FEATURE_K8); - - if (cpu_has_xmm2) { -- /* MFENCE stops RDTSC speculation */ -- set_cpu_cap(c, X86_FEATURE_MFENCE_RDTSC); -+ unsigned long long val; -+ int ret; -+ -+ /* -+ * A serializing LFENCE has less overhead than MFENCE, so -+ * use it for execution serialization. On families which -+ * don't have that MSR, LFENCE is already serializing. -+ * msr_set_bit() uses the safe accessors, too, even if the MSR -+ * is not present. -+ */ -+ msr_set_bit(MSR_F10H_DECFG, -+ MSR_F10H_DECFG_LFENCE_SERIALIZE_BIT); -+ -+ /* -+ * Verify that the MSR write was successful (could be running -+ * under a hypervisor) and only then assume that LFENCE is -+ * serializing. -+ */ -+ ret = rdmsrl_safe(MSR_F10H_DECFG, &val); -+ if (!ret && (val & MSR_F10H_DECFG_LFENCE_SERIALIZE)) { -+ /* A serializing LFENCE stops RDTSC speculation */ -+ set_cpu_cap(c, X86_FEATURE_LFENCE_RDTSC); -+ } else { -+ /* MFENCE stops RDTSC speculation */ -+ set_cpu_cap(c, X86_FEATURE_MFENCE_RDTSC); -+ } - } - - /* -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index cd46f9039119..49d25ddf0e9f 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -10,6 +10,9 @@ - #include - #include - #include -+ -+#include -+#include - #include - #include - #include -@@ -20,16 +23,10 @@ - #include - #include - -+static void __init spectre_v2_select_mitigation(void); -+ - void __init check_bugs(void) - { --#ifdef CONFIG_X86_32 -- /* -- * Regardless of whether PCID is enumerated, the SDM says -- * that it can't be enabled in 32-bit mode. -- */ -- setup_clear_cpu_cap(X86_FEATURE_PCID); --#endif -- - identify_boot_cpu(); - - if (!IS_ENABLED(CONFIG_SMP)) { -@@ -37,6 +34,9 @@ void __init check_bugs(void) - print_cpu_info(&boot_cpu_data); - } - -+ /* Select the proper spectre mitigation before patching alternatives */ -+ spectre_v2_select_mitigation(); -+ - #ifdef CONFIG_X86_32 - /* - * Check whether we are able to run this kernel safely on SMP. -@@ -69,6 +69,153 @@ void __init check_bugs(void) - #endif - } - -+/* The kernel command line selection */ -+enum spectre_v2_mitigation_cmd { -+ SPECTRE_V2_CMD_NONE, -+ SPECTRE_V2_CMD_AUTO, -+ SPECTRE_V2_CMD_FORCE, -+ SPECTRE_V2_CMD_RETPOLINE, -+ SPECTRE_V2_CMD_RETPOLINE_GENERIC, -+ SPECTRE_V2_CMD_RETPOLINE_AMD, -+}; -+ -+static const char *spectre_v2_strings[] = { -+ [SPECTRE_V2_NONE] = "Vulnerable", -+ [SPECTRE_V2_RETPOLINE_MINIMAL] = "Vulnerable: Minimal generic ASM retpoline", -+ [SPECTRE_V2_RETPOLINE_MINIMAL_AMD] = "Vulnerable: Minimal AMD ASM retpoline", -+ [SPECTRE_V2_RETPOLINE_GENERIC] = "Mitigation: Full generic retpoline", -+ [SPECTRE_V2_RETPOLINE_AMD] = "Mitigation: Full AMD retpoline", -+}; -+ -+#undef pr_fmt -+#define pr_fmt(fmt) "Spectre V2 mitigation: " fmt -+ -+static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; -+ -+static void __init spec2_print_if_insecure(const char *reason) -+{ -+ if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) -+ pr_info("%s\n", reason); -+} -+ -+static void __init spec2_print_if_secure(const char *reason) -+{ -+ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) -+ pr_info("%s\n", reason); -+} -+ -+static inline bool retp_compiler(void) -+{ -+ return __is_defined(RETPOLINE); -+} -+ -+static inline bool match_option(const char *arg, int arglen, const char *opt) -+{ -+ int len = strlen(opt); -+ -+ return len == arglen && !strncmp(arg, opt, len); -+} -+ -+static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) -+{ -+ char arg[20]; -+ int ret; -+ -+ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, -+ sizeof(arg)); -+ if (ret > 0) { -+ if (match_option(arg, ret, "off")) { -+ goto disable; -+ } else if (match_option(arg, ret, "on")) { -+ spec2_print_if_secure("force enabled on command line."); -+ return SPECTRE_V2_CMD_FORCE; -+ } else if (match_option(arg, ret, "retpoline")) { -+ spec2_print_if_insecure("retpoline selected on command line."); -+ return SPECTRE_V2_CMD_RETPOLINE; -+ } else if (match_option(arg, ret, "retpoline,amd")) { -+ if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { -+ pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); -+ return SPECTRE_V2_CMD_AUTO; -+ } -+ spec2_print_if_insecure("AMD retpoline selected on command line."); -+ return SPECTRE_V2_CMD_RETPOLINE_AMD; -+ } else if (match_option(arg, ret, "retpoline,generic")) { -+ spec2_print_if_insecure("generic retpoline selected on command line."); -+ return SPECTRE_V2_CMD_RETPOLINE_GENERIC; -+ } else if (match_option(arg, ret, "auto")) { -+ return SPECTRE_V2_CMD_AUTO; -+ } -+ } -+ -+ if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2")) -+ return SPECTRE_V2_CMD_AUTO; -+disable: -+ spec2_print_if_insecure("disabled on command line."); -+ return SPECTRE_V2_CMD_NONE; -+} -+ -+static void __init spectre_v2_select_mitigation(void) -+{ -+ enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); -+ enum spectre_v2_mitigation mode = SPECTRE_V2_NONE; -+ -+ /* -+ * If the CPU is not affected and the command line mode is NONE or AUTO -+ * then nothing to do. -+ */ -+ if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2) && -+ (cmd == SPECTRE_V2_CMD_NONE || cmd == SPECTRE_V2_CMD_AUTO)) -+ return; -+ -+ switch (cmd) { -+ case SPECTRE_V2_CMD_NONE: -+ return; -+ -+ case SPECTRE_V2_CMD_FORCE: -+ /* FALLTRHU */ -+ case SPECTRE_V2_CMD_AUTO: -+ goto retpoline_auto; -+ -+ case SPECTRE_V2_CMD_RETPOLINE_AMD: -+ if (IS_ENABLED(CONFIG_RETPOLINE)) -+ goto retpoline_amd; -+ break; -+ case SPECTRE_V2_CMD_RETPOLINE_GENERIC: -+ if (IS_ENABLED(CONFIG_RETPOLINE)) -+ goto retpoline_generic; -+ break; -+ case SPECTRE_V2_CMD_RETPOLINE: -+ if (IS_ENABLED(CONFIG_RETPOLINE)) -+ goto retpoline_auto; -+ break; -+ } -+ pr_err("kernel not compiled with retpoline; no mitigation available!"); -+ return; -+ -+retpoline_auto: -+ if (boot_cpu_data.x86_vendor == X86_VENDOR_AMD) { -+ retpoline_amd: -+ if (!boot_cpu_has(X86_FEATURE_LFENCE_RDTSC)) { -+ pr_err("LFENCE not serializing. Switching to generic retpoline\n"); -+ goto retpoline_generic; -+ } -+ mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_AMD : -+ SPECTRE_V2_RETPOLINE_MINIMAL_AMD; -+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE_AMD); -+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE); -+ } else { -+ retpoline_generic: -+ mode = retp_compiler() ? SPECTRE_V2_RETPOLINE_GENERIC : -+ SPECTRE_V2_RETPOLINE_MINIMAL; -+ setup_force_cpu_cap(X86_FEATURE_RETPOLINE); -+ } -+ -+ spectre_v2_enabled = mode; -+ pr_info("%s\n", spectre_v2_strings[mode]); -+} -+ -+#undef pr_fmt -+ - #ifdef CONFIG_SYSFS - ssize_t cpu_show_meltdown(struct device *dev, - struct device_attribute *attr, char *buf) -@@ -93,6 +240,7 @@ ssize_t cpu_show_spectre_v2(struct device *dev, - { - if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) - return sprintf(buf, "Not affected\n"); -- return sprintf(buf, "Vulnerable\n"); -+ -+ return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]); - } - #endif -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index dc4dfad66a70..f7f2ad3687ee 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -831,13 +831,21 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c) - - setup_force_cpu_cap(X86_FEATURE_ALWAYS); - -- /* Assume for now that ALL x86 CPUs are insecure */ -- setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); -+ if (c->x86_vendor != X86_VENDOR_AMD) -+ setup_force_cpu_bug(X86_BUG_CPU_MELTDOWN); - - setup_force_cpu_bug(X86_BUG_SPECTRE_V1); - setup_force_cpu_bug(X86_BUG_SPECTRE_V2); - - fpu__init_system(c); -+ -+#ifdef CONFIG_X86_32 -+ /* -+ * Regardless of whether PCID is enumerated, the SDM says -+ * that it can't be enabled in 32-bit mode. -+ */ -+ setup_clear_cpu_cap(X86_FEATURE_PCID); -+#endif - } - - void __init early_cpu_init(void) -diff --git a/arch/x86/kernel/cpu/mcheck/mce.c b/arch/x86/kernel/cpu/mcheck/mce.c -index 7e8a736d09db..364fbad72e60 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce.c -+++ b/arch/x86/kernel/cpu/mcheck/mce.c -@@ -1672,6 +1672,11 @@ static void unexpected_machine_check(struct pt_regs *regs, long error_code) - void (*machine_check_vector)(struct pt_regs *, long error_code) = - unexpected_machine_check; - -+dotraplinkage void do_mce(struct pt_regs *regs, long error_code) -+{ -+ machine_check_vector(regs, error_code); -+} -+ - /* - * Called for each booted CPU to set up machine checks. - * Must be called with preempt off: -diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c -index 38da8f29a9c8..528b7aa1780d 100644 ---- a/arch/x86/kernel/irq_32.c -+++ b/arch/x86/kernel/irq_32.c -@@ -20,6 +20,7 @@ - #include - - #include -+#include - - #ifdef CONFIG_DEBUG_STACKOVERFLOW - -@@ -55,17 +56,17 @@ DEFINE_PER_CPU(struct irq_stack *, softirq_stack); - static void call_on_stack(void *func, void *stack) - { - asm volatile("xchgl %%ebx,%%esp \n" -- "call *%%edi \n" -+ CALL_NOSPEC - "movl %%ebx,%%esp \n" - : "=b" (stack) - : "0" (stack), -- "D"(func) -+ [thunk_target] "D"(func) - : "memory", "cc", "edx", "ecx", "eax"); - } - - static inline void *current_stack(void) - { -- return (void *)(current_stack_pointer() & ~(THREAD_SIZE - 1)); -+ return (void *)(current_stack_pointer & ~(THREAD_SIZE - 1)); - } - - static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc) -@@ -89,17 +90,17 @@ static inline int execute_on_irq_stack(int overflow, struct irq_desc *desc) - - /* Save the next esp at the bottom of the stack */ - prev_esp = (u32 *)irqstk; -- *prev_esp = current_stack_pointer(); -+ *prev_esp = current_stack_pointer; - - if (unlikely(overflow)) - call_on_stack(print_stack_overflow, isp); - - asm volatile("xchgl %%ebx,%%esp \n" -- "call *%%edi \n" -+ CALL_NOSPEC - "movl %%ebx,%%esp \n" - : "=a" (arg1), "=b" (isp) - : "0" (desc), "1" (isp), -- "D" (desc->handle_irq) -+ [thunk_target] "D" (desc->handle_irq) - : "memory", "cc", "ecx"); - return 1; - } -@@ -142,7 +143,7 @@ void do_softirq_own_stack(void) - - /* Push the previous esp onto the stack */ - prev_esp = (u32 *)irqstk; -- *prev_esp = current_stack_pointer(); -+ *prev_esp = current_stack_pointer; - - call_on_stack(__do_softirq, isp); - } -diff --git a/arch/x86/kernel/kprobes/opt.c b/arch/x86/kernel/kprobes/opt.c -index c9d488f3e4cd..ea8e2b846101 100644 ---- a/arch/x86/kernel/kprobes/opt.c -+++ b/arch/x86/kernel/kprobes/opt.c -@@ -36,6 +36,7 @@ - #include - #include - #include -+#include - - #include "common.h" - -@@ -191,7 +192,7 @@ static int copy_optimized_instructions(u8 *dest, u8 *src) - } - - /* Check whether insn is indirect jump */ --static int insn_is_indirect_jump(struct insn *insn) -+static int __insn_is_indirect_jump(struct insn *insn) - { - return ((insn->opcode.bytes[0] == 0xff && - (X86_MODRM_REG(insn->modrm.value) & 6) == 4) || /* Jump */ -@@ -225,6 +226,26 @@ static int insn_jump_into_range(struct insn *insn, unsigned long start, int len) - return (start <= target && target <= start + len); - } - -+static int insn_is_indirect_jump(struct insn *insn) -+{ -+ int ret = __insn_is_indirect_jump(insn); -+ -+#ifdef CONFIG_RETPOLINE -+ /* -+ * Jump to x86_indirect_thunk_* is treated as an indirect jump. -+ * Note that even with CONFIG_RETPOLINE=y, the kernel compiled with -+ * older gcc may use indirect jump. So we add this check instead of -+ * replace indirect-jump check. -+ */ -+ if (!ret) -+ ret = insn_jump_into_range(insn, -+ (unsigned long)__indirect_thunk_start, -+ (unsigned long)__indirect_thunk_end - -+ (unsigned long)__indirect_thunk_start); -+#endif -+ return ret; -+} -+ - /* Decode whole function to ensure any instructions don't jump into target */ - static int can_optimize(unsigned long paddr) - { -diff --git a/arch/x86/kernel/mcount_64.S b/arch/x86/kernel/mcount_64.S -index 5d9afbcb6074..09284cfab86f 100644 ---- a/arch/x86/kernel/mcount_64.S -+++ b/arch/x86/kernel/mcount_64.S -@@ -7,7 +7,7 @@ - #include - #include - #include -- -+#include - - .code64 - .section .entry.text, "ax" -@@ -285,8 +285,9 @@ trace: - * ip and parent ip are used and the list function is called when - * function tracing is enabled. - */ -- call *ftrace_trace_function - -+ movq ftrace_trace_function, %r8 -+ CALL_NOSPEC %r8 - restore_mcount_regs - - jmp fgraph_trace -@@ -329,5 +330,5 @@ GLOBAL(return_to_handler) - movq 8(%rsp), %rdx - movq (%rsp), %rax - addq $24, %rsp -- jmp *%rdi -+ JMP_NOSPEC %rdi - #endif -diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c -index 679302c312f8..22b81f35c500 100644 ---- a/arch/x86/kernel/traps.c -+++ b/arch/x86/kernel/traps.c -@@ -166,7 +166,7 @@ void ist_begin_non_atomic(struct pt_regs *regs) - * from double_fault. - */ - BUG_ON((unsigned long)(current_top_of_stack() - -- current_stack_pointer()) >= THREAD_SIZE); -+ current_stack_pointer) >= THREAD_SIZE); - - preempt_enable_no_resched(); - } -diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S -index 74e4bf11f562..e065065a4dfb 100644 ---- a/arch/x86/kernel/vmlinux.lds.S -+++ b/arch/x86/kernel/vmlinux.lds.S -@@ -104,6 +104,13 @@ SECTIONS - IRQENTRY_TEXT - *(.fixup) - *(.gnu.warning) -+ -+#ifdef CONFIG_RETPOLINE -+ __indirect_thunk_start = .; -+ *(.text.__x86.indirect_thunk) -+ __indirect_thunk_end = .; -+#endif -+ - /* End of text section */ - _etext = .; - } :text = 0x9090 -diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c -index 900ffb6c28b5..2038e5bacce6 100644 ---- a/arch/x86/kvm/svm.c -+++ b/arch/x86/kvm/svm.c -@@ -37,6 +37,7 @@ - #include - #include - #include -+#include - - #include - #include "trace.h" -@@ -3904,6 +3905,9 @@ static void svm_vcpu_run(struct kvm_vcpu *vcpu) - #endif - ); - -+ /* Eliminate branch target predictions from guest mode */ -+ vmexit_fill_RSB(); -+ - #ifdef CONFIG_X86_64 - wrmsrl(MSR_GS_BASE, svm->host.gs_base); - #else -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index c26255f19603..75d60e40c389 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -47,6 +47,7 @@ - #include - #include - #include -+#include - - #include "trace.h" - #include "pmu.h" -@@ -8701,6 +8702,9 @@ static void __noclone vmx_vcpu_run(struct kvm_vcpu *vcpu) - #endif - ); - -+ /* Eliminate branch target predictions from guest mode */ -+ vmexit_fill_RSB(); -+ - /* MSR_IA32_DEBUGCTLMSR is zeroed on vmexit. Restore it if needed */ - if (debugctlmsr) - update_debugctlmsr(debugctlmsr); -diff --git a/arch/x86/lib/Makefile b/arch/x86/lib/Makefile -index f2587888d987..12a34d15b648 100644 ---- a/arch/x86/lib/Makefile -+++ b/arch/x86/lib/Makefile -@@ -21,6 +21,7 @@ lib-y += usercopy_$(BITS).o usercopy.o getuser.o putuser.o - lib-y += memcpy_$(BITS).o - lib-$(CONFIG_RWSEM_XCHGADD_ALGORITHM) += rwsem.o - lib-$(CONFIG_INSTRUCTION_DECODER) += insn.o inat.o -+lib-$(CONFIG_RETPOLINE) += retpoline.o - - obj-y += msr.o msr-reg.o msr-reg-export.o - -diff --git a/arch/x86/lib/checksum_32.S b/arch/x86/lib/checksum_32.S -index c1e623209853..90353a26ed95 100644 ---- a/arch/x86/lib/checksum_32.S -+++ b/arch/x86/lib/checksum_32.S -@@ -28,7 +28,8 @@ - #include - #include - #include -- -+#include -+ - /* - * computes a partial checksum, e.g. for TCP/UDP fragments - */ -@@ -155,7 +156,7 @@ ENTRY(csum_partial) - negl %ebx - lea 45f(%ebx,%ebx,2), %ebx - testl %esi, %esi -- jmp *%ebx -+ JMP_NOSPEC %ebx - - # Handle 2-byte-aligned regions - 20: addw (%esi), %ax -@@ -437,7 +438,7 @@ ENTRY(csum_partial_copy_generic) - andl $-32,%edx - lea 3f(%ebx,%ebx), %ebx - testl %esi, %esi -- jmp *%ebx -+ JMP_NOSPEC %ebx - 1: addl $64,%esi - addl $64,%edi - SRC(movb -32(%edx),%bl) ; SRC(movb (%edx),%bl) -diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S -new file mode 100644 -index 000000000000..e611a124c442 ---- /dev/null -+++ b/arch/x86/lib/retpoline.S -@@ -0,0 +1,49 @@ -+/* SPDX-License-Identifier: GPL-2.0 */ -+ -+#include -+#include -+#include -+#include -+#include -+#include -+#include -+ -+.macro THUNK reg -+ .section .text.__x86.indirect_thunk -+ -+ENTRY(__x86_indirect_thunk_\reg) -+ CFI_STARTPROC -+ JMP_NOSPEC %\reg -+ CFI_ENDPROC -+ENDPROC(__x86_indirect_thunk_\reg) -+.endm -+ -+/* -+ * Despite being an assembler file we can't just use .irp here -+ * because __KSYM_DEPS__ only uses the C preprocessor and would -+ * only see one instance of "__x86_indirect_thunk_\reg" rather -+ * than one per register with the correct names. So we do it -+ * the simple and nasty way... -+ */ -+#define __EXPORT_THUNK(sym) _ASM_NOKPROBE(sym); EXPORT_SYMBOL(sym) -+#define EXPORT_THUNK(reg) __EXPORT_THUNK(__x86_indirect_thunk_ ## reg) -+#define GENERATE_THUNK(reg) THUNK reg ; EXPORT_THUNK(reg) -+ -+GENERATE_THUNK(_ASM_AX) -+GENERATE_THUNK(_ASM_BX) -+GENERATE_THUNK(_ASM_CX) -+GENERATE_THUNK(_ASM_DX) -+GENERATE_THUNK(_ASM_SI) -+GENERATE_THUNK(_ASM_DI) -+GENERATE_THUNK(_ASM_BP) -+GENERATE_THUNK(_ASM_SP) -+#ifdef CONFIG_64BIT -+GENERATE_THUNK(r8) -+GENERATE_THUNK(r9) -+GENERATE_THUNK(r10) -+GENERATE_THUNK(r11) -+GENERATE_THUNK(r12) -+GENERATE_THUNK(r13) -+GENERATE_THUNK(r14) -+GENERATE_THUNK(r15) -+#endif -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index b0b77b61c40c..69ec1c5d7152 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4143,6 +4143,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - * https://bugzilla.kernel.org/show_bug.cgi?id=121671 - */ - { "LITEON CX1-JB*-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 }, -+ { "LITEON EP1-*", NULL, ATA_HORKAGE_MAX_SEC_1024 }, - - /* Devices we expect to fail diagnostics */ - -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index 8ce1f2e22912..d415a804fd26 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -31,6 +31,7 @@ - #include - #include - #include -+#include - #include "hyperv_vmbus.h" - - /* The one and only */ -@@ -103,9 +104,10 @@ static u64 do_hypercall(u64 control, void *input, void *output) - return (u64)ULLONG_MAX; - - __asm__ __volatile__("mov %0, %%r8" : : "r" (output_address) : "r8"); -- __asm__ __volatile__("call *%3" : "=a" (hv_status) : -+ __asm__ __volatile__(CALL_NOSPEC : -+ "=a" (hv_status) : - "c" (control), "d" (input_address), -- "m" (hypercall_page)); -+ THUNK_TARGET(hypercall_page)); - - return hv_status; - -@@ -123,11 +125,12 @@ static u64 do_hypercall(u64 control, void *input, void *output) - if (!hypercall_page) - return (u64)ULLONG_MAX; - -- __asm__ __volatile__ ("call *%8" : "=d"(hv_status_hi), -+ __asm__ __volatile__ (CALL_NOSPEC : "=d"(hv_status_hi), - "=a"(hv_status_lo) : "d" (control_hi), - "a" (control_lo), "b" (input_address_hi), - "c" (input_address_lo), "D"(output_address_hi), -- "S"(output_address_lo), "m" (hypercall_page)); -+ "S"(output_address_lo), -+ THUNK_TARGET(hypercall_page)); - - return hv_status_lo | ((u64)hv_status_hi << 32); - #endif /* !x86_64 */ -diff --git a/drivers/input/misc/twl4030-vibra.c b/drivers/input/misc/twl4030-vibra.c -index 10c4e3d462f1..7233db002588 100644 ---- a/drivers/input/misc/twl4030-vibra.c -+++ b/drivers/input/misc/twl4030-vibra.c -@@ -178,12 +178,14 @@ static SIMPLE_DEV_PM_OPS(twl4030_vibra_pm_ops, - twl4030_vibra_suspend, twl4030_vibra_resume); - - static bool twl4030_vibra_check_coexist(struct twl4030_vibra_data *pdata, -- struct device_node *node) -+ struct device_node *parent) - { -+ struct device_node *node; -+ - if (pdata && pdata->coexist) - return true; - -- node = of_find_node_by_name(node, "codec"); -+ node = of_get_child_by_name(parent, "codec"); - if (node) { - of_node_put(node); - return true; -diff --git a/drivers/input/misc/twl6040-vibra.c b/drivers/input/misc/twl6040-vibra.c -index ea63fad48de6..1e968ae37f60 100644 ---- a/drivers/input/misc/twl6040-vibra.c -+++ b/drivers/input/misc/twl6040-vibra.c -@@ -262,7 +262,7 @@ static int twl6040_vibra_probe(struct platform_device *pdev) - int vddvibr_uV = 0; - int error; - -- twl6040_core_node = of_find_node_by_name(twl6040_core_dev->of_node, -+ twl6040_core_node = of_get_child_by_name(twl6040_core_dev->of_node, - "vibra"); - if (!twl6040_core_node) { - dev_err(&pdev->dev, "parent of node is missing?\n"); -diff --git a/drivers/input/touchscreen/88pm860x-ts.c b/drivers/input/touchscreen/88pm860x-ts.c -index 251ff2aa0633..7a0dbce4dae9 100644 ---- a/drivers/input/touchscreen/88pm860x-ts.c -+++ b/drivers/input/touchscreen/88pm860x-ts.c -@@ -126,7 +126,7 @@ static int pm860x_touch_dt_init(struct platform_device *pdev, - int data, n, ret; - if (!np) - return -ENODEV; -- np = of_find_node_by_name(np, "touch"); -+ np = of_get_child_by_name(np, "touch"); - if (!np) { - dev_err(&pdev->dev, "Can't find touch node\n"); - return -EINVAL; -@@ -144,13 +144,13 @@ static int pm860x_touch_dt_init(struct platform_device *pdev, - if (data) { - ret = pm860x_reg_write(i2c, PM8607_GPADC_MISC1, data); - if (ret < 0) -- return -EINVAL; -+ goto err_put_node; - } - /* set tsi prebias time */ - if (!of_property_read_u32(np, "marvell,88pm860x-tsi-prebias", &data)) { - ret = pm860x_reg_write(i2c, PM8607_TSI_PREBIAS, data); - if (ret < 0) -- return -EINVAL; -+ goto err_put_node; - } - /* set prebias & prechg time of pen detect */ - data = 0; -@@ -161,10 +161,18 @@ static int pm860x_touch_dt_init(struct platform_device *pdev, - if (data) { - ret = pm860x_reg_write(i2c, PM8607_PD_PREBIAS, data); - if (ret < 0) -- return -EINVAL; -+ goto err_put_node; - } - of_property_read_u32(np, "marvell,88pm860x-resistor-X", res_x); -+ -+ of_node_put(np); -+ - return 0; -+ -+err_put_node: -+ of_node_put(np); -+ -+ return -EINVAL; - } - #else - #define pm860x_touch_dt_init(x, y, z) (-1) -diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c -index 3b67afda430b..e339f4288e8f 100644 ---- a/drivers/md/dm-thin-metadata.c -+++ b/drivers/md/dm-thin-metadata.c -@@ -81,10 +81,14 @@ - #define SECTOR_TO_BLOCK_SHIFT 3 - - /* -+ * For btree insert: - * 3 for btree insert + - * 2 for btree lookup used within space map -+ * For btree remove: -+ * 2 for shadow spine + -+ * 4 for rebalance 3 child node - */ --#define THIN_MAX_CONCURRENT_LOCKS 5 -+#define THIN_MAX_CONCURRENT_LOCKS 6 - - /* This should be plenty */ - #define SPACE_MAP_ROOT_SIZE 128 -diff --git a/drivers/md/persistent-data/dm-btree.c b/drivers/md/persistent-data/dm-btree.c -index a1a68209bd36..880b7dee9c52 100644 ---- a/drivers/md/persistent-data/dm-btree.c -+++ b/drivers/md/persistent-data/dm-btree.c -@@ -671,23 +671,8 @@ static int btree_split_beneath(struct shadow_spine *s, uint64_t key) - pn->keys[1] = rn->keys[0]; - memcpy_disk(value_ptr(pn, 1), &val, sizeof(__le64)); - -- /* -- * rejig the spine. This is ugly, since it knows too -- * much about the spine -- */ -- if (s->nodes[0] != new_parent) { -- unlock_block(s->info, s->nodes[0]); -- s->nodes[0] = new_parent; -- } -- if (key < le64_to_cpu(rn->keys[0])) { -- unlock_block(s->info, right); -- s->nodes[1] = left; -- } else { -- unlock_block(s->info, left); -- s->nodes[1] = right; -- } -- s->count = 2; -- -+ unlock_block(s->info, left); -+ unlock_block(s->info, right); - return 0; - } - -diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -index ce44a033f63b..64cc86a82b2d 100644 ---- a/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -+++ b/drivers/net/can/usb/peak_usb/pcan_usb_fd.c -@@ -184,7 +184,7 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail) - void *cmd_head = pcan_usb_fd_cmd_buffer(dev); - int err = 0; - u8 *packet_ptr; -- int i, n = 1, packet_len; -+ int packet_len; - ptrdiff_t cmd_len; - - /* usb device unregistered? */ -@@ -201,17 +201,13 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail) - } - - packet_ptr = cmd_head; -+ packet_len = cmd_len; - - /* firmware is not able to re-assemble 512 bytes buffer in full-speed */ -- if ((dev->udev->speed != USB_SPEED_HIGH) && -- (cmd_len > PCAN_UFD_LOSPD_PKT_SIZE)) { -- packet_len = PCAN_UFD_LOSPD_PKT_SIZE; -- n += cmd_len / packet_len; -- } else { -- packet_len = cmd_len; -- } -+ if (unlikely(dev->udev->speed != USB_SPEED_HIGH)) -+ packet_len = min(packet_len, PCAN_UFD_LOSPD_PKT_SIZE); - -- for (i = 0; i < n; i++) { -+ do { - err = usb_bulk_msg(dev->udev, - usb_sndbulkpipe(dev->udev, - PCAN_USBPRO_EP_CMDOUT), -@@ -224,7 +220,12 @@ static int pcan_usb_fd_send_cmd(struct peak_usb_device *dev, void *cmd_tail) - } - - packet_ptr += packet_len; -- } -+ cmd_len -= packet_len; -+ -+ if (cmd_len < PCAN_UFD_LOSPD_PKT_SIZE) -+ packet_len = cmd_len; -+ -+ } while (packet_len > 0); - - return err; - } -diff --git a/drivers/phy/phy-core.c b/drivers/phy/phy-core.c -index e7e574dc667a..be1f0276ab23 100644 ---- a/drivers/phy/phy-core.c -+++ b/drivers/phy/phy-core.c -@@ -365,6 +365,10 @@ static struct phy *_of_phy_get(struct device_node *np, int index) - if (ret) - return ERR_PTR(-ENODEV); - -+ /* This phy type handled by the usb-phy subsystem for now */ -+ if (of_device_is_compatible(args.np, "usb-nop-xceiv")) -+ return ERR_PTR(-ENODEV); -+ - mutex_lock(&phy_provider_mutex); - phy_provider = of_phy_provider_lookup(args.np); - if (IS_ERR(phy_provider) || !try_module_get(phy_provider->owner)) { -diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c -index 0c87f341fed4..910b795fc5eb 100644 ---- a/drivers/scsi/hpsa.c -+++ b/drivers/scsi/hpsa.c -@@ -3638,6 +3638,7 @@ static int hpsa_update_device_info(struct ctlr_info *h, - if (h->fw_support & MISC_FW_RAID_OFFLOAD_BASIC) - hpsa_get_ioaccel_status(h, scsi3addr, this_device); - volume_offline = hpsa_volume_offline(h, scsi3addr); -+ this_device->volume_offline = volume_offline; - if (volume_offline == HPSA_LV_FAILED) { - rc = HPSA_LV_FAILED; - dev_err(&h->pdev->dev, -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index 38f77e127349..0f0ff75755e0 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -160,7 +160,6 @@ typedef struct sg_fd { /* holds the state of a file descriptor */ - struct list_head rq_list; /* head of request list */ - struct fasync_struct *async_qp; /* used by asynchronous notification */ - Sg_request req_arr[SG_MAX_QUEUE]; /* used as singly-linked list */ -- char low_dma; /* as in parent but possibly overridden to 1 */ - char force_packid; /* 1 -> pack_id input to read(), 0 -> ignored */ - char cmd_q; /* 1 -> allow command queuing, 0 -> don't */ - unsigned char next_cmd_len; /* 0: automatic, >0: use on next write() */ -@@ -932,24 +931,14 @@ sg_ioctl(struct file *filp, unsigned int cmd_in, unsigned long arg) - /* strange ..., for backward compatibility */ - return sfp->timeout_user; - case SG_SET_FORCE_LOW_DMA: -- result = get_user(val, ip); -- if (result) -- return result; -- if (val) { -- sfp->low_dma = 1; -- if ((0 == sfp->low_dma) && !sfp->res_in_use) { -- val = (int) sfp->reserve.bufflen; -- sg_remove_scat(sfp, &sfp->reserve); -- sg_build_reserve(sfp, val); -- } -- } else { -- if (atomic_read(&sdp->detaching)) -- return -ENODEV; -- sfp->low_dma = sdp->device->host->unchecked_isa_dma; -- } -+ /* -+ * N.B. This ioctl never worked properly, but failed to -+ * return an error value. So returning '0' to keep compability -+ * with legacy applications. -+ */ - return 0; - case SG_GET_LOW_DMA: -- return put_user((int) sfp->low_dma, ip); -+ return put_user((int) sdp->device->host->unchecked_isa_dma, ip); - case SG_GET_SCSI_ID: - if (!access_ok(VERIFY_WRITE, p, sizeof (sg_scsi_id_t))) - return -EFAULT; -@@ -1870,6 +1859,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) - int sg_tablesize = sfp->parentdp->sg_tablesize; - int blk_size = buff_size, order; - gfp_t gfp_mask = GFP_ATOMIC | __GFP_COMP | __GFP_NOWARN; -+ struct sg_device *sdp = sfp->parentdp; - - if (blk_size < 0) - return -EFAULT; -@@ -1895,7 +1885,7 @@ sg_build_indirect(Sg_scatter_hold * schp, Sg_fd * sfp, int buff_size) - scatter_elem_sz_prev = num; - } - -- if (sfp->low_dma) -+ if (sdp->device->host->unchecked_isa_dma) - gfp_mask |= GFP_DMA; - - if (!capable(CAP_SYS_ADMIN) || !capable(CAP_SYS_RAWIO)) -@@ -2158,8 +2148,6 @@ sg_add_sfp(Sg_device * sdp) - sfp->timeout = SG_DEFAULT_TIMEOUT; - sfp->timeout_user = SG_DEFAULT_TIMEOUT_USER; - sfp->force_packid = SG_DEF_FORCE_PACK_ID; -- sfp->low_dma = (SG_DEF_FORCE_LOW_DMA == 0) ? -- sdp->device->host->unchecked_isa_dma : 1; - sfp->cmd_q = SG_DEF_COMMAND_Q; - sfp->keep_orphan = SG_DEF_KEEP_ORPHAN; - sfp->parentdp = sdp; -@@ -2618,7 +2606,7 @@ static void sg_proc_debug_helper(struct seq_file *s, Sg_device * sdp) - jiffies_to_msecs(fp->timeout), - fp->reserve.bufflen, - (int) fp->reserve.k_use_sg, -- (int) fp->low_dma); -+ (int) sdp->device->host->unchecked_isa_dma); - seq_printf(s, " cmd_q=%d f_packid=%d k_orphan=%d closed=0\n", - (int) fp->cmd_q, (int) fp->force_packid, - (int) fp->keep_orphan); -diff --git a/fs/pipe.c b/fs/pipe.c -index ab8dad3ccb6a..39eff9a67253 100644 ---- a/fs/pipe.c -+++ b/fs/pipe.c -@@ -1001,6 +1001,9 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) - { - struct pipe_buffer *bufs; - -+ if (!nr_pages) -+ return -EINVAL; -+ - /* - * We can shrink the pipe, if arg >= pipe->nrbufs. Since we don't - * expect a lot of shrink+grow operations, just free and allocate -@@ -1045,13 +1048,19 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages) - - /* - * Currently we rely on the pipe array holding a power-of-2 number -- * of pages. -+ * of pages. Returns 0 on error. - */ - static inline unsigned int round_pipe_size(unsigned int size) - { - unsigned long nr_pages; - -+ if (size < pipe_min_size) -+ size = pipe_min_size; -+ - nr_pages = (size + PAGE_SIZE - 1) >> PAGE_SHIFT; -+ if (nr_pages == 0) -+ return 0; -+ - return roundup_pow_of_two(nr_pages) << PAGE_SHIFT; - } - -@@ -1062,13 +1071,18 @@ static inline unsigned int round_pipe_size(unsigned int size) - int pipe_proc_fn(struct ctl_table *table, int write, void __user *buf, - size_t *lenp, loff_t *ppos) - { -+ unsigned int rounded_pipe_max_size; - int ret; - - ret = proc_dointvec_minmax(table, write, buf, lenp, ppos); - if (ret < 0 || !write) - return ret; - -- pipe_max_size = round_pipe_size(pipe_max_size); -+ rounded_pipe_max_size = round_pipe_size(pipe_max_size); -+ if (rounded_pipe_max_size == 0) -+ return -EINVAL; -+ -+ pipe_max_size = rounded_pipe_max_size; - return ret; - } - -diff --git a/include/asm-generic/asm-prototypes.h b/include/asm-generic/asm-prototypes.h -new file mode 100644 -index 000000000000..df13637e4017 ---- /dev/null -+++ b/include/asm-generic/asm-prototypes.h -@@ -0,0 +1,7 @@ -+#include -+extern void *__memset(void *, int, __kernel_size_t); -+extern void *__memcpy(void *, const void *, __kernel_size_t); -+extern void *__memmove(void *, const void *, __kernel_size_t); -+extern void *memset(void *, int, __kernel_size_t); -+extern void *memcpy(void *, const void *, __kernel_size_t); -+extern void *memmove(void *, const void *, __kernel_size_t); -diff --git a/include/asm-generic/export.h b/include/asm-generic/export.h -new file mode 100644 -index 000000000000..43199a049da5 ---- /dev/null -+++ b/include/asm-generic/export.h -@@ -0,0 +1,94 @@ -+#ifndef __ASM_GENERIC_EXPORT_H -+#define __ASM_GENERIC_EXPORT_H -+ -+#ifndef KSYM_FUNC -+#define KSYM_FUNC(x) x -+#endif -+#ifdef CONFIG_64BIT -+#define __put .quad -+#ifndef KSYM_ALIGN -+#define KSYM_ALIGN 8 -+#endif -+#ifndef KCRC_ALIGN -+#define KCRC_ALIGN 8 -+#endif -+#else -+#define __put .long -+#ifndef KSYM_ALIGN -+#define KSYM_ALIGN 4 -+#endif -+#ifndef KCRC_ALIGN -+#define KCRC_ALIGN 4 -+#endif -+#endif -+ -+#ifdef CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX -+#define KSYM(name) _##name -+#else -+#define KSYM(name) name -+#endif -+ -+/* -+ * note on .section use: @progbits vs %progbits nastiness doesn't matter, -+ * since we immediately emit into those sections anyway. -+ */ -+.macro ___EXPORT_SYMBOL name,val,sec -+#ifdef CONFIG_MODULES -+ .globl KSYM(__ksymtab_\name) -+ .section ___ksymtab\sec+\name,"a" -+ .balign KSYM_ALIGN -+KSYM(__ksymtab_\name): -+ __put \val, KSYM(__kstrtab_\name) -+ .previous -+ .section __ksymtab_strings,"a" -+KSYM(__kstrtab_\name): -+#ifdef CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX -+ .asciz "_\name" -+#else -+ .asciz "\name" -+#endif -+ .previous -+#ifdef CONFIG_MODVERSIONS -+ .section ___kcrctab\sec+\name,"a" -+ .balign KCRC_ALIGN -+KSYM(__kcrctab_\name): -+ __put KSYM(__crc_\name) -+ .weak KSYM(__crc_\name) -+ .previous -+#endif -+#endif -+.endm -+#undef __put -+ -+#if defined(__KSYM_DEPS__) -+ -+#define __EXPORT_SYMBOL(sym, val, sec) === __KSYM_##sym === -+ -+#elif defined(CONFIG_TRIM_UNUSED_KSYMS) -+ -+#include -+#include -+ -+#define __EXPORT_SYMBOL(sym, val, sec) \ -+ __cond_export_sym(sym, val, sec, config_enabled(__KSYM_##sym)) -+#define __cond_export_sym(sym, val, sec, conf) \ -+ ___cond_export_sym(sym, val, sec, conf) -+#define ___cond_export_sym(sym, val, sec, enabled) \ -+ __cond_export_sym_##enabled(sym, val, sec) -+#define __cond_export_sym_1(sym, val, sec) ___EXPORT_SYMBOL sym, val, sec -+#define __cond_export_sym_0(sym, val, sec) /* nothing */ -+ -+#else -+#define __EXPORT_SYMBOL(sym, val, sec) ___EXPORT_SYMBOL sym, val, sec -+#endif -+ -+#define EXPORT_SYMBOL(name) \ -+ __EXPORT_SYMBOL(name, KSYM_FUNC(KSYM(name)),) -+#define EXPORT_SYMBOL_GPL(name) \ -+ __EXPORT_SYMBOL(name, KSYM_FUNC(KSYM(name)), _gpl) -+#define EXPORT_DATA_SYMBOL(name) \ -+ __EXPORT_SYMBOL(name, KSYM(name),) -+#define EXPORT_DATA_SYMBOL_GPL(name) \ -+ __EXPORT_SYMBOL(name, KSYM(name),_gpl) -+ -+#endif -diff --git a/include/linux/kconfig.h b/include/linux/kconfig.h -index b33c7797eb57..a94b5bf57f51 100644 ---- a/include/linux/kconfig.h -+++ b/include/linux/kconfig.h -@@ -17,10 +17,11 @@ - * the last step cherry picks the 2nd arg, we get a zero. - */ - #define __ARG_PLACEHOLDER_1 0, --#define config_enabled(cfg) _config_enabled(cfg) --#define _config_enabled(value) __config_enabled(__ARG_PLACEHOLDER_##value) --#define __config_enabled(arg1_or_junk) ___config_enabled(arg1_or_junk 1, 0) --#define ___config_enabled(__ignored, val, ...) val -+#define config_enabled(cfg) ___is_defined(cfg) -+#define __is_defined(x) ___is_defined(x) -+#define ___is_defined(val) ____is_defined(__ARG_PLACEHOLDER_##val) -+#define ____is_defined(arg1_or_junk) __take_second_arg(arg1_or_junk 1, 0) -+#define __take_second_arg(__ignored, val, ...) val - - /* - * IS_BUILTIN(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'y', 0 -@@ -42,7 +43,7 @@ - * built-in code when CONFIG_FOO is set to 'm'. - */ - #define IS_REACHABLE(option) (config_enabled(option) || \ -- (config_enabled(option##_MODULE) && config_enabled(MODULE))) -+ (config_enabled(option##_MODULE) && __is_defined(MODULE))) - - /* - * IS_ENABLED(CONFIG_FOO) evaluates to 1 if CONFIG_FOO is set to 'y' or 'm', -diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h -index 6f8fbcf10dfb..a3d04934aa96 100644 ---- a/include/linux/vermagic.h -+++ b/include/linux/vermagic.h -@@ -24,10 +24,16 @@ - #ifndef MODULE_ARCH_VERMAGIC - #define MODULE_ARCH_VERMAGIC "" - #endif -+#ifdef RETPOLINE -+#define MODULE_VERMAGIC_RETPOLINE "retpoline " -+#else -+#define MODULE_VERMAGIC_RETPOLINE "" -+#endif - - #define VERMAGIC_STRING \ - UTS_RELEASE " " \ - MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \ - MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \ -- MODULE_ARCH_VERMAGIC -+ MODULE_ARCH_VERMAGIC \ -+ MODULE_VERMAGIC_RETPOLINE - -diff --git a/include/scsi/sg.h b/include/scsi/sg.h -index 3afec7032448..20bc71c3e0b8 100644 ---- a/include/scsi/sg.h -+++ b/include/scsi/sg.h -@@ -197,7 +197,6 @@ typedef struct sg_req_info { /* used by SG_GET_REQUEST_TABLE ioctl() */ - #define SG_DEFAULT_RETRIES 0 - - /* Defaults, commented if they differ from original sg driver */ --#define SG_DEF_FORCE_LOW_DMA 0 /* was 1 -> memory below 16MB on i386 */ - #define SG_DEF_FORCE_PACK_ID 0 - #define SG_DEF_KEEP_ORPHAN 0 - #define SG_DEF_RESERVED_SIZE SG_SCATTER_SZ /* load time option */ -diff --git a/kernel/futex.c b/kernel/futex.c -index fc68462801de..1fce19fc824c 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -1621,6 +1621,9 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags, - struct futex_q *this, *next; - WAKE_Q(wake_q); - -+ if (nr_wake < 0 || nr_requeue < 0) -+ return -EINVAL; -+ - if (requeue_pi) { - /* - * Requeue PI only works on two distinct uaddrs. This -diff --git a/kernel/gcov/Kconfig b/kernel/gcov/Kconfig -index c92e44855ddd..1276aabaab55 100644 ---- a/kernel/gcov/Kconfig -+++ b/kernel/gcov/Kconfig -@@ -37,6 +37,7 @@ config ARCH_HAS_GCOV_PROFILE_ALL - - config GCOV_PROFILE_ALL - bool "Profile entire Kernel" -+ depends on !COMPILE_TEST - depends on GCOV_KERNEL - depends on ARCH_HAS_GCOV_PROFILE_ALL - default n -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index a996f7356216..6be2afd9bfd6 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -732,6 +732,8 @@ static inline void dl_check_constrained_dl(struct sched_dl_entity *dl_se) - if (unlikely(dl_se->dl_boosted || !start_dl_timer(p))) - return; - dl_se->dl_throttled = 1; -+ if (dl_se->runtime > 0) -+ dl_se->runtime = 0; - } - } - -diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c -index 996f0fd34312..ba5392807912 100644 ---- a/kernel/trace/trace_events.c -+++ b/kernel/trace/trace_events.c -@@ -2300,6 +2300,7 @@ void trace_event_enum_update(struct trace_enum_map **map, int len) - { - struct trace_event_call *call, *p; - const char *last_system = NULL; -+ bool first = false; - int last_i; - int i; - -@@ -2307,15 +2308,28 @@ void trace_event_enum_update(struct trace_enum_map **map, int len) - list_for_each_entry_safe(call, p, &ftrace_events, list) { - /* events are usually grouped together with systems */ - if (!last_system || call->class->system != last_system) { -+ first = true; - last_i = 0; - last_system = call->class->system; - } - -+ /* -+ * Since calls are grouped by systems, the likelyhood that the -+ * next call in the iteration belongs to the same system as the -+ * previous call is high. As an optimization, we skip seaching -+ * for a map[] that matches the call's system if the last call -+ * was from the same system. That's what last_i is for. If the -+ * call has the same system as the previous call, then last_i -+ * will be the index of the first map[] that has a matching -+ * system. -+ */ - for (i = last_i; i < len; i++) { - if (call->class->system == map[i]->system) { - /* Save the first system if need be */ -- if (!last_i) -+ if (first) { - last_i = i; -+ first = false; -+ } - update_event_printk(call, map[i]); - } - } -diff --git a/net/key/af_key.c b/net/key/af_key.c -index 94bf810ad242..6482b001f19a 100644 ---- a/net/key/af_key.c -+++ b/net/key/af_key.c -@@ -401,6 +401,11 @@ static int verify_address_len(const void *p) - #endif - int len; - -+ if (sp->sadb_address_len < -+ DIV_ROUND_UP(sizeof(*sp) + offsetofend(typeof(*addr), sa_family), -+ sizeof(uint64_t))) -+ return -EINVAL; -+ - switch (addr->sa_family) { - case AF_INET: - len = DIV_ROUND_UP(sizeof(*sp) + sizeof(*sin), sizeof(uint64_t)); -@@ -511,6 +516,9 @@ static int parse_exthdrs(struct sk_buff *skb, const struct sadb_msg *hdr, void * - uint16_t ext_type; - int ext_len; - -+ if (len < sizeof(*ehdr)) -+ return -EINVAL; -+ - ext_len = ehdr->sadb_ext_len; - ext_len *= sizeof(uint64_t); - ext_type = ehdr->sadb_ext_type; -diff --git a/scripts/Makefile.build b/scripts/Makefile.build -index 01df30af4d4a..18209917e379 100644 ---- a/scripts/Makefile.build -+++ b/scripts/Makefile.build -@@ -158,7 +158,8 @@ cmd_cc_i_c = $(CPP) $(c_flags) -o $@ $< - $(obj)/%.i: $(src)/%.c FORCE - $(call if_changed_dep,cc_i_c) - --cmd_gensymtypes = \ -+# These mirror gensymtypes_S and co below, keep them in synch. -+cmd_gensymtypes_c = \ - $(CPP) -D__GENKSYMS__ $(c_flags) $< | \ - $(GENKSYMS) $(if $(1), -T $(2)) \ - $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX)) \ -@@ -168,7 +169,7 @@ cmd_gensymtypes = \ - quiet_cmd_cc_symtypes_c = SYM $(quiet_modtag) $@ - cmd_cc_symtypes_c = \ - set -e; \ -- $(call cmd_gensymtypes,true,$@) >/dev/null; \ -+ $(call cmd_gensymtypes_c,true,$@) >/dev/null; \ - test -s $@ || rm -f $@ - - $(obj)/%.symtypes : $(src)/%.c FORCE -@@ -197,9 +198,10 @@ else - # the actual value of the checksum generated by genksyms - - cmd_cc_o_c = $(CC) $(c_flags) -c -o $(@D)/.tmp_$(@F) $< --cmd_modversions = \ -+ -+cmd_modversions_c = \ - if $(OBJDUMP) -h $(@D)/.tmp_$(@F) | grep -q __ksymtab; then \ -- $(call cmd_gensymtypes,$(KBUILD_SYMTYPES),$(@:.o=.symtypes)) \ -+ $(call cmd_gensymtypes_c,$(KBUILD_SYMTYPES),$(@:.o=.symtypes)) \ - > $(@D)/.tmp_$(@F:.o=.ver); \ - \ - $(LD) $(LDFLAGS) -r -o $@ $(@D)/.tmp_$(@F) \ -@@ -244,7 +246,7 @@ endif - define rule_cc_o_c - $(call echo-cmd,checksrc) $(cmd_checksrc) \ - $(call echo-cmd,cc_o_c) $(cmd_cc_o_c); \ -- $(cmd_modversions) \ -+ $(cmd_modversions_c) \ - $(call echo-cmd,record_mcount) \ - $(cmd_record_mcount) \ - scripts/basic/fixdep $(depfile) $@ '$(call make-cmd,cc_o_c)' > \ -@@ -253,6 +255,15 @@ define rule_cc_o_c - mv -f $(dot-target).tmp $(dot-target).cmd - endef - -+define rule_as_o_S -+ $(call echo-cmd,as_o_S) $(cmd_as_o_S); \ -+ scripts/basic/fixdep $(depfile) $@ '$(call make-cmd,as_o_S)' > \ -+ $(dot-target).tmp; \ -+ $(cmd_modversions_S) \ -+ rm -f $(depfile); \ -+ mv -f $(dot-target).tmp $(dot-target).cmd -+endef -+ - # Built-in and composite module parts - $(obj)/%.o: $(src)/%.c $(recordmcount_source) FORCE - $(call cmd,force_checksrc) -@@ -281,6 +292,38 @@ modkern_aflags := $(KBUILD_AFLAGS_KERNEL) $(AFLAGS_KERNEL) - $(real-objs-m) : modkern_aflags := $(KBUILD_AFLAGS_MODULE) $(AFLAGS_MODULE) - $(real-objs-m:.o=.s): modkern_aflags := $(KBUILD_AFLAGS_MODULE) $(AFLAGS_MODULE) - -+# .S file exports must have their C prototypes defined in asm/asm-prototypes.h -+# or a file that it includes, in order to get versioned symbols. We build a -+# dummy C file that includes asm-prototypes and the EXPORT_SYMBOL lines from -+# the .S file (with trailing ';'), and run genksyms on that, to extract vers. -+# -+# This is convoluted. The .S file must first be preprocessed to run guards and -+# expand names, then the resulting exports must be constructed into plain -+# EXPORT_SYMBOL(symbol); to build our dummy C file, and that gets preprocessed -+# to make the genksyms input. -+# -+# These mirror gensymtypes_c and co above, keep them in synch. -+cmd_gensymtypes_S = \ -+ (echo "\#include " ; \ -+ echo "\#include " ; \ -+ $(CPP) $(a_flags) $< | \ -+ grep "\<___EXPORT_SYMBOL\>" | \ -+ sed 's/.*___EXPORT_SYMBOL[[:space:]]*\([a-zA-Z0-9_]*\)[[:space:]]*,.*/EXPORT_SYMBOL(\1);/' ) | \ -+ $(CPP) -D__GENKSYMS__ $(c_flags) -xc - | \ -+ $(GENKSYMS) $(if $(1), -T $(2)) \ -+ $(patsubst y,-s _,$(CONFIG_HAVE_UNDERSCORE_SYMBOL_PREFIX)) \ -+ $(if $(KBUILD_PRESERVE),-p) \ -+ -r $(firstword $(wildcard $(2:.symtypes=.symref) /dev/null)) -+ -+quiet_cmd_cc_symtypes_S = SYM $(quiet_modtag) $@ -+cmd_cc_symtypes_S = \ -+ set -e; \ -+ $(call cmd_gensymtypes_S,true,$@) >/dev/null; \ -+ test -s $@ || rm -f $@ -+ -+$(obj)/%.symtypes : $(src)/%.S FORCE -+ $(call cmd,cc_symtypes_S) -+ - quiet_cmd_as_s_S = CPP $(quiet_modtag) $@ - cmd_as_s_S = $(CPP) $(a_flags) -o $@ $< - -@@ -288,10 +331,40 @@ $(obj)/%.s: $(src)/%.S FORCE - $(call if_changed_dep,as_s_S) - - quiet_cmd_as_o_S = AS $(quiet_modtag) $@ --cmd_as_o_S = $(CC) $(a_flags) -c -o $@ $< -+ -+ifndef CONFIG_MODVERSIONS -+cmd_as_o_S = $(CC) $(a_flags) -c -o $@ $< -+ -+else -+ -+ASM_PROTOTYPES := $(wildcard $(srctree)/arch/$(SRCARCH)/include/asm/asm-prototypes.h) -+ -+ifeq ($(ASM_PROTOTYPES),) -+cmd_as_o_S = $(CC) $(a_flags) -c -o $@ $< -+ -+else -+ -+# versioning matches the C process described above, with difference that -+# we parse asm-prototypes.h C header to get function definitions. -+ -+cmd_as_o_S = $(CC) $(a_flags) -c -o $(@D)/.tmp_$(@F) $< -+ -+cmd_modversions_S = \ -+ if $(OBJDUMP) -h $(@D)/.tmp_$(@F) | grep -q __ksymtab; then \ -+ $(call cmd_gensymtypes_S,$(KBUILD_SYMTYPES),$(@:.o=.symtypes)) \ -+ > $(@D)/.tmp_$(@F:.o=.ver); \ -+ \ -+ $(LD) $(LDFLAGS) -r -o $@ $(@D)/.tmp_$(@F) \ -+ -T $(@D)/.tmp_$(@F:.o=.ver); \ -+ rm -f $(@D)/.tmp_$(@F) $(@D)/.tmp_$(@F:.o=.ver); \ -+ else \ -+ mv -f $(@D)/.tmp_$(@F) $@; \ -+ fi; -+endif -+endif - - $(obj)/%.o: $(src)/%.S FORCE -- $(call if_changed_dep,as_o_S) -+ $(call if_changed_rule,as_o_S) - - targets += $(real-objs-y) $(real-objs-m) $(lib-y) - targets += $(extra-y) $(MAKECMDGOALS) $(always) -diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c -index 7b805766306e..4c145d6bccd4 100644 ---- a/sound/core/pcm_lib.c -+++ b/sound/core/pcm_lib.c -@@ -578,7 +578,6 @@ static inline unsigned int muldiv32(unsigned int a, unsigned int b, - { - u_int64_t n = (u_int64_t) a * b; - if (c == 0) { -- snd_BUG_ON(!n); - *r = 0; - return UINT_MAX; - } -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index 80bbadc83721..d6e079f4ec09 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -408,6 +408,7 @@ static const struct snd_pci_quirk cs420x_fixup_tbl[] = { - /*SND_PCI_QUIRK(0x8086, 0x7270, "IMac 27 Inch", CS420X_IMAC27),*/ - - /* codec SSID */ -+ SND_PCI_QUIRK(0x106b, 0x0600, "iMac 14,1", CS420X_IMAC27_122), - SND_PCI_QUIRK(0x106b, 0x1c00, "MacBookPro 8,1", CS420X_MBP81), - SND_PCI_QUIRK(0x106b, 0x2000, "iMac 12,2", CS420X_IMAC27_122), - SND_PCI_QUIRK(0x106b, 0x2800, "MacBookPro 10,1", CS420X_MBP101), -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index 5875a08d555e..f14c1f288443 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -5600,6 +5600,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME), - SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER), -+ SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE), - SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE), - SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2), diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.113-114.patch b/patch/kernel/mvebu64-default/04-patch-4.4.113-114.patch deleted file mode 100644 index 610b70467a6e..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.113-114.patch +++ /dev/null @@ -1,3477 +0,0 @@ -diff --git a/Makefile b/Makefile -index 39019c9d205c..153440b1bbb0 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 113 -+SUBLEVEL = 114 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/um/Makefile b/arch/um/Makefile -index e3abe6f3156d..9ccf462131c4 100644 ---- a/arch/um/Makefile -+++ b/arch/um/Makefile -@@ -117,7 +117,7 @@ archheaders: - archprepare: include/generated/user_constants.h - - LINK-$(CONFIG_LD_SCRIPT_STATIC) += -static --LINK-$(CONFIG_LD_SCRIPT_DYN) += -Wl,-rpath,/lib -+LINK-$(CONFIG_LD_SCRIPT_DYN) += -Wl,-rpath,/lib $(call cc-option, -no-pie) - - CFLAGS_NO_HARDENING := $(call cc-option, -fno-PIC,) $(call cc-option, -fno-pic,) \ - $(call cc-option, -fno-stack-protector,) \ -diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c -index 112178b401a1..2d359991a273 100644 ---- a/arch/x86/entry/vsyscall/vsyscall_64.c -+++ b/arch/x86/entry/vsyscall/vsyscall_64.c -@@ -46,6 +46,7 @@ static enum { EMULATE, NATIVE, NONE } vsyscall_mode = - #else - EMULATE; - #endif -+unsigned long vsyscall_pgprot = __PAGE_KERNEL_VSYSCALL; - - static int __init vsyscall_setup(char *str) - { -@@ -336,11 +337,11 @@ void __init map_vsyscall(void) - extern char __vsyscall_page; - unsigned long physaddr_vsyscall = __pa_symbol(&__vsyscall_page); - -+ if (vsyscall_mode != NATIVE) -+ vsyscall_pgprot = __PAGE_KERNEL_VVAR; - if (vsyscall_mode != NONE) - __set_fixmap(VSYSCALL_PAGE, physaddr_vsyscall, -- vsyscall_mode == NATIVE -- ? PAGE_KERNEL_VSYSCALL -- : PAGE_KERNEL_VVAR); -+ __pgprot(vsyscall_pgprot)); - - BUILD_BUG_ON((unsigned long)__fix_to_virt(VSYSCALL_PAGE) != - (unsigned long)VSYSCALL_ADDR); -diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h -index 0fbc98568018..641f0f2c2982 100644 ---- a/arch/x86/include/asm/cpufeature.h -+++ b/arch/x86/include/asm/cpufeature.h -@@ -199,6 +199,7 @@ - #define X86_FEATURE_HWP_EPP ( 7*32+13) /* Intel HWP_EPP */ - #define X86_FEATURE_HWP_PKG_REQ ( 7*32+14) /* Intel HWP_PKG_REQ */ - #define X86_FEATURE_INTEL_PT ( 7*32+15) /* Intel Processor Trace */ -+#define X86_FEATURE_RSB_CTXSW ( 7*32+19) /* Fill RSB on context switches */ - - #define X86_FEATURE_RETPOLINE ( 7*32+29) /* Generic Retpoline mitigation for Spectre variant 2 */ - #define X86_FEATURE_RETPOLINE_AMD ( 7*32+30) /* AMD Retpoline mitigation for Spectre variant 2 */ -diff --git a/arch/x86/include/asm/intel-family.h b/arch/x86/include/asm/intel-family.h -new file mode 100644 -index 000000000000..6999f7d01a0d ---- /dev/null -+++ b/arch/x86/include/asm/intel-family.h -@@ -0,0 +1,68 @@ -+#ifndef _ASM_X86_INTEL_FAMILY_H -+#define _ASM_X86_INTEL_FAMILY_H -+ -+/* -+ * "Big Core" Processors (Branded as Core, Xeon, etc...) -+ * -+ * The "_X" parts are generally the EP and EX Xeons, or the -+ * "Extreme" ones, like Broadwell-E. -+ * -+ * Things ending in "2" are usually because we have no better -+ * name for them. There's no processor called "WESTMERE2". -+ */ -+ -+#define INTEL_FAM6_CORE_YONAH 0x0E -+#define INTEL_FAM6_CORE2_MEROM 0x0F -+#define INTEL_FAM6_CORE2_MEROM_L 0x16 -+#define INTEL_FAM6_CORE2_PENRYN 0x17 -+#define INTEL_FAM6_CORE2_DUNNINGTON 0x1D -+ -+#define INTEL_FAM6_NEHALEM 0x1E -+#define INTEL_FAM6_NEHALEM_EP 0x1A -+#define INTEL_FAM6_NEHALEM_EX 0x2E -+#define INTEL_FAM6_WESTMERE 0x25 -+#define INTEL_FAM6_WESTMERE2 0x1F -+#define INTEL_FAM6_WESTMERE_EP 0x2C -+#define INTEL_FAM6_WESTMERE_EX 0x2F -+ -+#define INTEL_FAM6_SANDYBRIDGE 0x2A -+#define INTEL_FAM6_SANDYBRIDGE_X 0x2D -+#define INTEL_FAM6_IVYBRIDGE 0x3A -+#define INTEL_FAM6_IVYBRIDGE_X 0x3E -+ -+#define INTEL_FAM6_HASWELL_CORE 0x3C -+#define INTEL_FAM6_HASWELL_X 0x3F -+#define INTEL_FAM6_HASWELL_ULT 0x45 -+#define INTEL_FAM6_HASWELL_GT3E 0x46 -+ -+#define INTEL_FAM6_BROADWELL_CORE 0x3D -+#define INTEL_FAM6_BROADWELL_XEON_D 0x56 -+#define INTEL_FAM6_BROADWELL_GT3E 0x47 -+#define INTEL_FAM6_BROADWELL_X 0x4F -+ -+#define INTEL_FAM6_SKYLAKE_MOBILE 0x4E -+#define INTEL_FAM6_SKYLAKE_DESKTOP 0x5E -+#define INTEL_FAM6_SKYLAKE_X 0x55 -+#define INTEL_FAM6_KABYLAKE_MOBILE 0x8E -+#define INTEL_FAM6_KABYLAKE_DESKTOP 0x9E -+ -+/* "Small Core" Processors (Atom) */ -+ -+#define INTEL_FAM6_ATOM_PINEVIEW 0x1C -+#define INTEL_FAM6_ATOM_LINCROFT 0x26 -+#define INTEL_FAM6_ATOM_PENWELL 0x27 -+#define INTEL_FAM6_ATOM_CLOVERVIEW 0x35 -+#define INTEL_FAM6_ATOM_CEDARVIEW 0x36 -+#define INTEL_FAM6_ATOM_SILVERMONT1 0x37 /* BayTrail/BYT / Valleyview */ -+#define INTEL_FAM6_ATOM_SILVERMONT2 0x4D /* Avaton/Rangely */ -+#define INTEL_FAM6_ATOM_AIRMONT 0x4C /* CherryTrail / Braswell */ -+#define INTEL_FAM6_ATOM_MERRIFIELD1 0x4A /* Tangier */ -+#define INTEL_FAM6_ATOM_MERRIFIELD2 0x5A /* Annidale */ -+#define INTEL_FAM6_ATOM_GOLDMONT 0x5C -+#define INTEL_FAM6_ATOM_DENVERTON 0x5F /* Goldmont Microserver */ -+ -+/* Xeon Phi */ -+ -+#define INTEL_FAM6_XEON_PHI_KNL 0x57 /* Knights Landing */ -+ -+#endif /* _ASM_X86_INTEL_FAMILY_H */ -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index c124d6ab4bf9..86bccb4bd4dc 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -574,7 +574,7 @@ static inline void sync_core(void) - { - int tmp; - --#ifdef CONFIG_M486 -+#ifdef CONFIG_X86_32 - /* - * Do a CPUID if available, otherwise do a jump. The jump - * can conveniently enough be the jump around CPUID. -diff --git a/arch/x86/include/asm/switch_to.h b/arch/x86/include/asm/switch_to.h -index 751bf4b7bf11..025ecfaba9c9 100644 ---- a/arch/x86/include/asm/switch_to.h -+++ b/arch/x86/include/asm/switch_to.h -@@ -1,6 +1,8 @@ - #ifndef _ASM_X86_SWITCH_TO_H - #define _ASM_X86_SWITCH_TO_H - -+#include -+ - struct task_struct; /* one of the stranger aspects of C forward declarations */ - __visible struct task_struct *__switch_to(struct task_struct *prev, - struct task_struct *next); -@@ -24,6 +26,23 @@ void __switch_to_xtra(struct task_struct *prev_p, struct task_struct *next_p, - #define __switch_canary_iparam - #endif /* CC_STACKPROTECTOR */ - -+#ifdef CONFIG_RETPOLINE -+ /* -+ * When switching from a shallower to a deeper call stack -+ * the RSB may either underflow or use entries populated -+ * with userspace addresses. On CPUs where those concerns -+ * exist, overwrite the RSB with entries which capture -+ * speculative execution to prevent attack. -+ */ -+#define __retpoline_fill_return_buffer \ -+ ALTERNATIVE("jmp 910f", \ -+ __stringify(__FILL_RETURN_BUFFER(%%ebx, RSB_CLEAR_LOOPS, %%esp)),\ -+ X86_FEATURE_RSB_CTXSW) \ -+ "910:\n\t" -+#else -+#define __retpoline_fill_return_buffer -+#endif -+ - /* - * Saving eflags is important. It switches not only IOPL between tasks, - * it also protects other tasks from NT leaking through sysenter etc. -@@ -46,6 +65,7 @@ do { \ - "movl $1f,%[prev_ip]\n\t" /* save EIP */ \ - "pushl %[next_ip]\n\t" /* restore EIP */ \ - __switch_canary \ -+ __retpoline_fill_return_buffer \ - "jmp __switch_to\n" /* regparm call */ \ - "1:\t" \ - "popl %%ebp\n\t" /* restore EBP */ \ -@@ -100,6 +120,23 @@ do { \ - #define __switch_canary_iparam - #endif /* CC_STACKPROTECTOR */ - -+#ifdef CONFIG_RETPOLINE -+ /* -+ * When switching from a shallower to a deeper call stack -+ * the RSB may either underflow or use entries populated -+ * with userspace addresses. On CPUs where those concerns -+ * exist, overwrite the RSB with entries which capture -+ * speculative execution to prevent attack. -+ */ -+#define __retpoline_fill_return_buffer \ -+ ALTERNATIVE("jmp 910f", \ -+ __stringify(__FILL_RETURN_BUFFER(%%r12, RSB_CLEAR_LOOPS, %%rsp)),\ -+ X86_FEATURE_RSB_CTXSW) \ -+ "910:\n\t" -+#else -+#define __retpoline_fill_return_buffer -+#endif -+ - /* - * There is no need to save or restore flags, because flags are always - * clean in kernel mode, with the possible exception of IOPL. Kernel IOPL -@@ -112,6 +149,7 @@ do { \ - "call __switch_to\n\t" \ - "movq "__percpu_arg([current_task])",%%rsi\n\t" \ - __switch_canary \ -+ __retpoline_fill_return_buffer \ - "movq %P[thread_info](%%rsi),%%r8\n\t" \ - "movq %%rax,%%rdi\n\t" \ - "testl %[_tif_fork],%P[ti_flags](%%r8)\n\t" \ -diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h -index 4865e10dbb55..9ee85066f407 100644 ---- a/arch/x86/include/asm/vsyscall.h -+++ b/arch/x86/include/asm/vsyscall.h -@@ -13,6 +13,7 @@ extern void map_vsyscall(void); - */ - extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address); - extern bool vsyscall_enabled(void); -+extern unsigned long vsyscall_pgprot; - #else - static inline void map_vsyscall(void) {} - static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index fc91c98bee01..fd945099fc95 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2592,8 +2592,8 @@ static struct resource * __init ioapic_setup_resources(void) - res[num].flags = IORESOURCE_MEM | IORESOURCE_BUSY; - snprintf(mem, IOAPIC_RESOURCE_NAME_SIZE, "IOAPIC %u", i); - mem += IOAPIC_RESOURCE_NAME_SIZE; -+ ioapics[i].iomem_res = &res[num]; - num++; -- ioapics[i].iomem_res = res; - } - - ioapic_resources = res; -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 49d25ddf0e9f..8cacf62ec458 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - static void __init spectre_v2_select_mitigation(void); - -@@ -154,6 +155,23 @@ disable: - return SPECTRE_V2_CMD_NONE; - } - -+/* Check for Skylake-like CPUs (for RSB handling) */ -+static bool __init is_skylake_era(void) -+{ -+ if (boot_cpu_data.x86_vendor == X86_VENDOR_INTEL && -+ boot_cpu_data.x86 == 6) { -+ switch (boot_cpu_data.x86_model) { -+ case INTEL_FAM6_SKYLAKE_MOBILE: -+ case INTEL_FAM6_SKYLAKE_DESKTOP: -+ case INTEL_FAM6_SKYLAKE_X: -+ case INTEL_FAM6_KABYLAKE_MOBILE: -+ case INTEL_FAM6_KABYLAKE_DESKTOP: -+ return true; -+ } -+ } -+ return false; -+} -+ - static void __init spectre_v2_select_mitigation(void) - { - enum spectre_v2_mitigation_cmd cmd = spectre_v2_parse_cmdline(); -@@ -212,6 +230,24 @@ retpoline_auto: - - spectre_v2_enabled = mode; - pr_info("%s\n", spectre_v2_strings[mode]); -+ -+ /* -+ * If neither SMEP or KPTI are available, there is a risk of -+ * hitting userspace addresses in the RSB after a context switch -+ * from a shallow call stack to a deeper one. To prevent this fill -+ * the entire RSB, even when using IBRS. -+ * -+ * Skylake era CPUs have a separate issue with *underflow* of the -+ * RSB, when they will predict 'ret' targets from the generic BTB. -+ * The proper mitigation for this is IBRS. If IBRS is not supported -+ * or deactivated in favour of retpolines the RSB fill on context -+ * switch is required. -+ */ -+ if ((!boot_cpu_has(X86_FEATURE_KAISER) && -+ !boot_cpu_has(X86_FEATURE_SMEP)) || is_skylake_era()) { -+ setup_force_cpu_cap(X86_FEATURE_RSB_CTXSW); -+ pr_info("Filling RSB on context switch\n"); -+ } - } - - #undef pr_fmt -diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c -index e38d338a6447..b4ca91cf55b0 100644 ---- a/arch/x86/kernel/cpu/intel_cacheinfo.c -+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c -@@ -934,6 +934,8 @@ static int __populate_cache_leaves(unsigned int cpu) - ci_leaf_init(this_leaf++, &id4_regs); - __cache_cpumap_setup(cpu, idx, &id4_regs); - } -+ this_cpu_ci->cpu_map_populated = true; -+ - return 0; - } - -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index b428a8174be1..2c76a1801393 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -39,6 +39,9 @@ - #include - #include - -+/* last level cache size per core */ -+static int llc_size_per_core; -+ - static unsigned long mc_saved_in_initrd[MAX_UCODE_COUNT]; - static struct mc_saved_data { - unsigned int mc_saved_count; -@@ -996,15 +999,18 @@ static bool is_blacklisted(unsigned int cpu) - - /* - * Late loading on model 79 with microcode revision less than 0x0b000021 -- * may result in a system hang. This behavior is documented in item -- * BDF90, #334165 (Intel Xeon Processor E7-8800/4800 v4 Product Family). -+ * and LLC size per core bigger than 2.5MB may result in a system hang. -+ * This behavior is documented in item BDF90, #334165 (Intel Xeon -+ * Processor E7-8800/4800 v4 Product Family). - */ - if (c->x86 == 6 && - c->x86_model == 79 && - c->x86_mask == 0x01 && -+ llc_size_per_core > 2621440 && - c->microcode < 0x0b000021) { - pr_err_once("Erratum BDF90: late loading with revision < 0x0b000021 (0x%x) disabled.\n", c->microcode); - pr_err_once("Please consider either early loading through initrd/built-in or a potential BIOS update.\n"); -+ return true; - } - - return false; -@@ -1067,6 +1073,15 @@ static struct microcode_ops microcode_intel_ops = { - .microcode_fini_cpu = microcode_fini_cpu, - }; - -+static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c) -+{ -+ u64 llc_size = c->x86_cache_size * 1024; -+ -+ do_div(llc_size, c->x86_max_cores); -+ -+ return (int)llc_size; -+} -+ - struct microcode_ops * __init init_intel_microcode(void) - { - struct cpuinfo_x86 *c = &boot_cpu_data; -@@ -1077,6 +1092,8 @@ struct microcode_ops * __init init_intel_microcode(void) - return NULL; - } - -+ llc_size_per_core = calc_llc_size_per_core(c); -+ - return µcode_intel_ops; - } - -diff --git a/arch/x86/lib/delay.c b/arch/x86/lib/delay.c -index e912b2f6d36e..45772560aceb 100644 ---- a/arch/x86/lib/delay.c -+++ b/arch/x86/lib/delay.c -@@ -93,6 +93,13 @@ static void delay_mwaitx(unsigned long __loops) - { - u64 start, end, delay, loops = __loops; - -+ /* -+ * Timer value of 0 causes MWAITX to wait indefinitely, unless there -+ * is a store on the memory monitored by MONITORX. -+ */ -+ if (loops == 0) -+ return; -+ - start = rdtsc_ordered(); - - for (;;) { -diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c -index 8af98513d36c..2298434f7bdb 100644 ---- a/arch/x86/mm/kaiser.c -+++ b/arch/x86/mm/kaiser.c -@@ -345,7 +345,7 @@ void __init kaiser_init(void) - if (vsyscall_enabled()) - kaiser_add_user_map_early((void *)VSYSCALL_ADDR, - PAGE_SIZE, -- __PAGE_KERNEL_VSYSCALL); -+ vsyscall_pgprot); - - for_each_possible_cpu(cpu) { - void *percpu_vaddr = __per_cpu_user_mapped_start + -diff --git a/drivers/acpi/acpi_processor.c b/drivers/acpi/acpi_processor.c -index 9f77943653fb..b63a173786d5 100644 ---- a/drivers/acpi/acpi_processor.c -+++ b/drivers/acpi/acpi_processor.c -@@ -331,15 +331,6 @@ static int acpi_processor_get_info(struct acpi_device *device) - pr->throttling.duty_width = acpi_gbl_FADT.duty_width; - - pr->pblk = object.processor.pblk_address; -- -- /* -- * We don't care about error returns - we just try to mark -- * these reserved so that nobody else is confused into thinking -- * that this region might be unused.. -- * -- * (In particular, allocating the IO range for Cardbus) -- */ -- request_region(pr->throttling.address, 6, "ACPI CPU throttle"); - } - - /* -diff --git a/drivers/acpi/acpica/nsutils.c b/drivers/acpi/acpica/nsutils.c -index de325ae04ce1..3b3c5b90bd20 100644 ---- a/drivers/acpi/acpica/nsutils.c -+++ b/drivers/acpi/acpica/nsutils.c -@@ -593,25 +593,20 @@ struct acpi_namespace_node *acpi_ns_validate_handle(acpi_handle handle) - void acpi_ns_terminate(void) - { - acpi_status status; -+ union acpi_operand_object *prev; -+ union acpi_operand_object *next; - - ACPI_FUNCTION_TRACE(ns_terminate); - --#ifdef ACPI_EXEC_APP -- { -- union acpi_operand_object *prev; -- union acpi_operand_object *next; -+ /* Delete any module-level code blocks */ - -- /* Delete any module-level code blocks */ -- -- next = acpi_gbl_module_code_list; -- while (next) { -- prev = next; -- next = next->method.mutex; -- prev->method.mutex = NULL; /* Clear the Mutex (cheated) field */ -- acpi_ut_remove_reference(prev); -- } -+ next = acpi_gbl_module_code_list; -+ while (next) { -+ prev = next; -+ next = next->method.mutex; -+ prev->method.mutex = NULL; /* Clear the Mutex (cheated) field */ -+ acpi_ut_remove_reference(prev); - } --#endif - - /* - * Free the entire namespace -- all nodes and all objects -diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c -index 73c9c7fa9001..f06317d6fc38 100644 ---- a/drivers/acpi/glue.c -+++ b/drivers/acpi/glue.c -@@ -99,13 +99,13 @@ static int find_child_checks(struct acpi_device *adev, bool check_children) - return -ENODEV; - - /* -- * If the device has a _HID (or _CID) returning a valid ACPI/PNP -- * device ID, it is better to make it look less attractive here, so that -- * the other device with the same _ADR value (that may not have a valid -- * device ID) can be matched going forward. [This means a second spec -- * violation in a row, so whatever we do here is best effort anyway.] -+ * If the device has a _HID returning a valid ACPI/PNP device ID, it is -+ * better to make it look less attractive here, so that the other device -+ * with the same _ADR value (that may not have a valid device ID) can be -+ * matched going forward. [This means a second spec violation in a row, -+ * so whatever we do here is best effort anyway.] - */ -- return sta_present && list_empty(&adev->pnp.ids) ? -+ return sta_present && !adev->pnp.type.platform_id ? - FIND_CHILD_MAX_SCORE : FIND_CHILD_MIN_SCORE; - } - -diff --git a/drivers/acpi/processor_throttling.c b/drivers/acpi/processor_throttling.c -index f170d746336d..c72e64893d03 100644 ---- a/drivers/acpi/processor_throttling.c -+++ b/drivers/acpi/processor_throttling.c -@@ -676,6 +676,15 @@ static int acpi_processor_get_throttling_fadt(struct acpi_processor *pr) - if (!pr->flags.throttling) - return -ENODEV; - -+ /* -+ * We don't care about error returns - we just try to mark -+ * these reserved so that nobody else is confused into thinking -+ * that this region might be unused.. -+ * -+ * (In particular, allocating the IO range for Cardbus) -+ */ -+ request_region(pr->throttling.address, 6, "ACPI CPU throttle"); -+ - pr->throttling.state = 0; - - duty_mask = pr->throttling.state_count - 1; -diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c -index e9fd32e91668..70e13cf06ed0 100644 ---- a/drivers/base/cacheinfo.c -+++ b/drivers/base/cacheinfo.c -@@ -16,6 +16,7 @@ - * You should have received a copy of the GNU General Public License - * along with this program. If not, see . - */ -+#include - #include - #include - #include -@@ -104,9 +105,16 @@ static int cache_shared_cpu_map_setup(unsigned int cpu) - struct cpu_cacheinfo *this_cpu_ci = get_cpu_cacheinfo(cpu); - struct cacheinfo *this_leaf, *sib_leaf; - unsigned int index; -- int ret; -+ int ret = 0; -+ -+ if (this_cpu_ci->cpu_map_populated) -+ return 0; - -- ret = cache_setup_of_node(cpu); -+ if (of_have_populated_dt()) -+ ret = cache_setup_of_node(cpu); -+ else if (!acpi_disabled) -+ /* No cache property/hierarchy support yet in ACPI */ -+ ret = -ENOTSUPP; - if (ret) - return ret; - -@@ -203,8 +211,7 @@ static int detect_cache_attributes(unsigned int cpu) - */ - ret = cache_shared_cpu_map_setup(cpu); - if (ret) { -- pr_warn("Unable to detect cache hierarchy from DT for CPU %d\n", -- cpu); -+ pr_warn("Unable to detect cache hierarchy for CPU %d\n", cpu); - goto free_ci; - } - return 0; -diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c -index a311cfa4c5bd..a6975795e7f3 100644 ---- a/drivers/base/power/trace.c -+++ b/drivers/base/power/trace.c -@@ -166,14 +166,14 @@ void generate_pm_trace(const void *tracedata, unsigned int user) - } - EXPORT_SYMBOL(generate_pm_trace); - --extern char __tracedata_start, __tracedata_end; -+extern char __tracedata_start[], __tracedata_end[]; - static int show_file_hash(unsigned int value) - { - int match; - char *tracedata; - - match = 0; -- for (tracedata = &__tracedata_start ; tracedata < &__tracedata_end ; -+ for (tracedata = __tracedata_start ; tracedata < __tracedata_end ; - tracedata += 2 + sizeof(unsigned long)) { - unsigned short lineno = *(unsigned short *)tracedata; - const char *file = *(const char **)(tracedata + 2); -diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c -index 7e2dc5e56632..0b49f29bf0da 100644 ---- a/drivers/input/mouse/trackpoint.c -+++ b/drivers/input/mouse/trackpoint.c -@@ -383,6 +383,9 @@ int trackpoint_detect(struct psmouse *psmouse, bool set_properties) - if (trackpoint_read(&psmouse->ps2dev, TP_EXT_BTN, &button_info)) { - psmouse_warn(psmouse, "failed to get extended button data, assuming 3 buttons\n"); - button_info = 0x33; -+ } else if (!button_info) { -+ psmouse_warn(psmouse, "got 0 in extended button data, assuming 3 buttons\n"); -+ button_info = 0x33; - } - - psmouse->private = kzalloc(sizeof(struct trackpoint_data), GFP_KERNEL); -diff --git a/drivers/mmc/host/sdhci-of-esdhc.c b/drivers/mmc/host/sdhci-of-esdhc.c -index 90e94a028a49..83b1226471c1 100644 ---- a/drivers/mmc/host/sdhci-of-esdhc.c -+++ b/drivers/mmc/host/sdhci-of-esdhc.c -@@ -584,6 +584,8 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) - { - struct sdhci_host *host; - struct device_node *np; -+ struct sdhci_pltfm_host *pltfm_host; -+ struct sdhci_esdhc *esdhc; - int ret; - - np = pdev->dev.of_node; -@@ -600,6 +602,14 @@ static int sdhci_esdhc_probe(struct platform_device *pdev) - - sdhci_get_of_property(pdev); - -+ pltfm_host = sdhci_priv(host); -+ esdhc = pltfm_host->priv; -+ if (esdhc->vendor_ver == VENDOR_V_22) -+ host->quirks2 |= SDHCI_QUIRK2_HOST_NO_CMD23; -+ -+ if (esdhc->vendor_ver > VENDOR_V_22) -+ host->quirks &= ~SDHCI_QUIRK_NO_BUSY_IRQ; -+ - if (of_device_is_compatible(np, "fsl,p5040-esdhc") || - of_device_is_compatible(np, "fsl,p5020-esdhc") || - of_device_is_compatible(np, "fsl,p4080-esdhc") || -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index c5ea1018cb47..24155380e43c 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -2205,19 +2205,14 @@ static bool rtl8169_do_counters(struct net_device *dev, u32 counter_cmd) - void __iomem *ioaddr = tp->mmio_addr; - dma_addr_t paddr = tp->counters_phys_addr; - u32 cmd; -- bool ret; - - RTL_W32(CounterAddrHigh, (u64)paddr >> 32); -+ RTL_R32(CounterAddrHigh); - cmd = (u64)paddr & DMA_BIT_MASK(32); - RTL_W32(CounterAddrLow, cmd); - RTL_W32(CounterAddrLow, cmd | counter_cmd); - -- ret = rtl_udelay_loop_wait_low(tp, &rtl_counters_cond, 10, 1000); -- -- RTL_W32(CounterAddrLow, 0); -- RTL_W32(CounterAddrHigh, 0); -- -- return ret; -+ return rtl_udelay_loop_wait_low(tp, &rtl_counters_cond, 10, 1000); - } - - static bool rtl8169_reset_counters(struct net_device *dev) -diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c -index 4e0068e775f9..b7b859c3a0c7 100644 ---- a/drivers/net/ppp/pppoe.c -+++ b/drivers/net/ppp/pppoe.c -@@ -860,6 +860,7 @@ static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, - struct pppoe_hdr *ph; - struct net_device *dev; - char *start; -+ int hlen; - - lock_sock(sk); - if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED)) { -@@ -878,16 +879,16 @@ static int pppoe_sendmsg(struct socket *sock, struct msghdr *m, - if (total_len > (dev->mtu + dev->hard_header_len)) - goto end; - -- -- skb = sock_wmalloc(sk, total_len + dev->hard_header_len + 32, -- 0, GFP_KERNEL); -+ hlen = LL_RESERVED_SPACE(dev); -+ skb = sock_wmalloc(sk, hlen + sizeof(*ph) + total_len + -+ dev->needed_tailroom, 0, GFP_KERNEL); - if (!skb) { - error = -ENOMEM; - goto end; - } - - /* Reserve space for headers. */ -- skb_reserve(skb, dev->hard_header_len); -+ skb_reserve(skb, hlen); - skb_reset_network_header(skb); - - skb->dev = dev; -@@ -948,7 +949,7 @@ static int __pppoe_xmit(struct sock *sk, struct sk_buff *skb) - /* Copy the data if there is no space for the header or if it's - * read-only. - */ -- if (skb_cow_head(skb, sizeof(*ph) + dev->hard_header_len)) -+ if (skb_cow_head(skb, LL_RESERVED_SPACE(dev) + sizeof(*ph))) - goto abort; - - __skb_push(skb, sizeof(*ph)); -diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c -index 41e9ebd7d0a6..ebdee8f01f65 100644 ---- a/drivers/net/usb/lan78xx.c -+++ b/drivers/net/usb/lan78xx.c -@@ -1859,6 +1859,7 @@ static int lan78xx_reset(struct lan78xx_net *dev) - buf = DEFAULT_BURST_CAP_SIZE / FS_USB_PKT_SIZE; - dev->rx_urb_size = DEFAULT_BURST_CAP_SIZE; - dev->rx_qlen = 4; -+ dev->tx_qlen = 4; - } - - ret = lan78xx_write_reg(dev, BURST_CAP, buf); -diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c -index 0cbf520cea77..82bf85ae5d08 100644 ---- a/drivers/net/vmxnet3/vmxnet3_drv.c -+++ b/drivers/net/vmxnet3/vmxnet3_drv.c -@@ -1563,7 +1563,6 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq, - rq->rx_ring[i].basePA); - rq->rx_ring[i].base = NULL; - } -- rq->buf_info[i] = NULL; - } - - if (rq->comp_ring.base) { -@@ -1578,6 +1577,7 @@ static void vmxnet3_rq_destroy(struct vmxnet3_rx_queue *rq, - (rq->rx_ring[0].size + rq->rx_ring[1].size); - dma_free_coherent(&adapter->pdev->dev, sz, rq->buf_info[0], - rq->buf_info_pa); -+ rq->buf_info[0] = rq->buf_info[1] = NULL; - } - } - -diff --git a/drivers/pci/host/pci-layerscape.c b/drivers/pci/host/pci-layerscape.c -index 3923bed93c7e..a21e229d95e0 100644 ---- a/drivers/pci/host/pci-layerscape.c -+++ b/drivers/pci/host/pci-layerscape.c -@@ -77,6 +77,16 @@ static void ls_pcie_fix_class(struct ls_pcie *pcie) - iowrite16(PCI_CLASS_BRIDGE_PCI, pcie->dbi + PCI_CLASS_DEVICE); - } - -+/* Drop MSG TLP except for Vendor MSG */ -+static void ls_pcie_drop_msg_tlp(struct ls_pcie *pcie) -+{ -+ u32 val; -+ -+ val = ioread32(pcie->dbi + PCIE_STRFMR1); -+ val &= 0xDFFFFFFF; -+ iowrite32(val, pcie->dbi + PCIE_STRFMR1); -+} -+ - static int ls1021_pcie_link_up(struct pcie_port *pp) - { - u32 state; -@@ -97,7 +107,7 @@ static int ls1021_pcie_link_up(struct pcie_port *pp) - static void ls1021_pcie_host_init(struct pcie_port *pp) - { - struct ls_pcie *pcie = to_ls_pcie(pp); -- u32 val, index[2]; -+ u32 index[2]; - - pcie->scfg = syscon_regmap_lookup_by_phandle(pp->dev->of_node, - "fsl,pcie-scfg"); -@@ -116,13 +126,7 @@ static void ls1021_pcie_host_init(struct pcie_port *pp) - - dw_pcie_setup_rc(pp); - -- /* -- * LS1021A Workaround for internal TKT228622 -- * to fix the INTx hang issue -- */ -- val = ioread32(pcie->dbi + PCIE_STRFMR1); -- val &= 0xffff; -- iowrite32(val, pcie->dbi + PCIE_STRFMR1); -+ ls_pcie_drop_msg_tlp(pcie); - } - - static int ls_pcie_link_up(struct pcie_port *pp) -@@ -147,6 +151,7 @@ static void ls_pcie_host_init(struct pcie_port *pp) - iowrite32(1, pcie->dbi + PCIE_DBI_RO_WR_EN); - ls_pcie_fix_class(pcie); - ls_pcie_clear_multifunction(pcie); -+ ls_pcie_drop_msg_tlp(pcie); - iowrite32(0, pcie->dbi + PCIE_DBI_RO_WR_EN); - } - -@@ -203,6 +208,7 @@ static const struct of_device_id ls_pcie_of_match[] = { - { .compatible = "fsl,ls1021a-pcie", .data = &ls1021_drvdata }, - { .compatible = "fsl,ls1043a-pcie", .data = &ls1043_drvdata }, - { .compatible = "fsl,ls2080a-pcie", .data = &ls2080_drvdata }, -+ { .compatible = "fsl,ls2085a-pcie", .data = &ls2080_drvdata }, - { }, - }; - MODULE_DEVICE_TABLE(of, ls_pcie_of_match); -diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c -index c1ccf1ee99ea..efce04df2109 100644 ---- a/drivers/scsi/libiscsi.c -+++ b/drivers/scsi/libiscsi.c -@@ -1727,7 +1727,7 @@ int iscsi_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *sc) - - if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) { - reason = FAILURE_SESSION_IN_RECOVERY; -- sc->result = DID_REQUEUE; -+ sc->result = DID_REQUEUE << 16; - goto fault; - } - -diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c -index a3ec49bdc1e6..ec38370ffcab 100644 ---- a/drivers/usb/usbip/stub_dev.c -+++ b/drivers/usb/usbip/stub_dev.c -@@ -163,8 +163,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) - * step 1? - */ - if (ud->tcp_socket) { -- dev_dbg(&sdev->udev->dev, "shutdown tcp_socket %p\n", -- ud->tcp_socket); -+ dev_dbg(&sdev->udev->dev, "shutdown sockfd %d\n", ud->sockfd); - kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR); - } - -diff --git a/drivers/usb/usbip/stub_rx.c b/drivers/usb/usbip/stub_rx.c -index 7de54a66044f..56cacb68040c 100644 ---- a/drivers/usb/usbip/stub_rx.c -+++ b/drivers/usb/usbip/stub_rx.c -@@ -338,23 +338,26 @@ static struct stub_priv *stub_priv_alloc(struct stub_device *sdev, - return priv; - } - --static int get_pipe(struct stub_device *sdev, int epnum, int dir) -+static int get_pipe(struct stub_device *sdev, struct usbip_header *pdu) - { - struct usb_device *udev = sdev->udev; - struct usb_host_endpoint *ep; - struct usb_endpoint_descriptor *epd = NULL; -+ int epnum = pdu->base.ep; -+ int dir = pdu->base.direction; -+ -+ if (epnum < 0 || epnum > 15) -+ goto err_ret; - - if (dir == USBIP_DIR_IN) - ep = udev->ep_in[epnum & 0x7f]; - else - ep = udev->ep_out[epnum & 0x7f]; -- if (!ep) { -- dev_err(&sdev->interface->dev, "no such endpoint?, %d\n", -- epnum); -- BUG(); -- } -+ if (!ep) -+ goto err_ret; - - epd = &ep->desc; -+ - if (usb_endpoint_xfer_control(epd)) { - if (dir == USBIP_DIR_OUT) - return usb_sndctrlpipe(udev, epnum); -@@ -377,15 +380,37 @@ static int get_pipe(struct stub_device *sdev, int epnum, int dir) - } - - if (usb_endpoint_xfer_isoc(epd)) { -+ /* validate packet size and number of packets */ -+ unsigned int maxp, packets, bytes; -+ -+#define USB_EP_MAXP_MULT_SHIFT 11 -+#define USB_EP_MAXP_MULT_MASK (3 << USB_EP_MAXP_MULT_SHIFT) -+#define USB_EP_MAXP_MULT(m) \ -+ (((m) & USB_EP_MAXP_MULT_MASK) >> USB_EP_MAXP_MULT_SHIFT) -+ -+ maxp = usb_endpoint_maxp(epd); -+ maxp *= (USB_EP_MAXP_MULT( -+ __le16_to_cpu(epd->wMaxPacketSize)) + 1); -+ bytes = pdu->u.cmd_submit.transfer_buffer_length; -+ packets = DIV_ROUND_UP(bytes, maxp); -+ -+ if (pdu->u.cmd_submit.number_of_packets < 0 || -+ pdu->u.cmd_submit.number_of_packets > packets) { -+ dev_err(&sdev->udev->dev, -+ "CMD_SUBMIT: isoc invalid num packets %d\n", -+ pdu->u.cmd_submit.number_of_packets); -+ return -1; -+ } - if (dir == USBIP_DIR_OUT) - return usb_sndisocpipe(udev, epnum); - else - return usb_rcvisocpipe(udev, epnum); - } - -+err_ret: - /* NOT REACHED */ -- dev_err(&sdev->interface->dev, "get pipe, epnum %d\n", epnum); -- return 0; -+ dev_err(&sdev->udev->dev, "CMD_SUBMIT: invalid epnum %d\n", epnum); -+ return -1; - } - - static void masking_bogus_flags(struct urb *urb) -@@ -449,7 +474,10 @@ static void stub_recv_cmd_submit(struct stub_device *sdev, - struct stub_priv *priv; - struct usbip_device *ud = &sdev->ud; - struct usb_device *udev = sdev->udev; -- int pipe = get_pipe(sdev, pdu->base.ep, pdu->base.direction); -+ int pipe = get_pipe(sdev, pdu); -+ -+ if (pipe == -1) -+ return; - - priv = stub_priv_alloc(sdev, pdu); - if (!priv) -diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c -index 9752b93f754e..1838f1b2c2fa 100644 ---- a/drivers/usb/usbip/usbip_common.c -+++ b/drivers/usb/usbip/usbip_common.c -@@ -317,18 +317,14 @@ int usbip_recv(struct socket *sock, void *buf, int size) - struct msghdr msg; - struct kvec iov; - int total = 0; -- - /* for blocks of if (usbip_dbg_flag_xmit) */ - char *bp = buf; - int osize = size; - -- usbip_dbg_xmit("enter\n"); -- -- if (!sock || !buf || !size) { -- pr_err("invalid arg, sock %p buff %p size %d\n", sock, buf, -- size); -+ if (!sock || !buf || !size) - return -EINVAL; -- } -+ -+ usbip_dbg_xmit("enter\n"); - - do { - sock->sk->sk_allocation = GFP_NOIO; -@@ -341,11 +337,8 @@ int usbip_recv(struct socket *sock, void *buf, int size) - msg.msg_flags = MSG_NOSIGNAL; - - result = kernel_recvmsg(sock, &msg, &iov, 1, size, MSG_WAITALL); -- if (result <= 0) { -- pr_debug("receive sock %p buf %p size %u ret %d total %d\n", -- sock, buf, size, result, total); -+ if (result <= 0) - goto err; -- } - - size -= result; - buf += result; -diff --git a/drivers/usb/usbip/usbip_common.h b/drivers/usb/usbip/usbip_common.h -index 86b08475c254..f875ccaa55f9 100644 ---- a/drivers/usb/usbip/usbip_common.h -+++ b/drivers/usb/usbip/usbip_common.h -@@ -261,6 +261,7 @@ struct usbip_device { - /* lock for status */ - spinlock_t lock; - -+ int sockfd; - struct socket *tcp_socket; - - struct task_struct *tcp_rx; -diff --git a/drivers/usb/usbip/usbip_event.c b/drivers/usb/usbip/usbip_event.c -index 64933b993d7a..2580a32bcdff 100644 ---- a/drivers/usb/usbip/usbip_event.c -+++ b/drivers/usb/usbip/usbip_event.c -@@ -117,11 +117,12 @@ EXPORT_SYMBOL_GPL(usbip_event_add); - int usbip_event_happened(struct usbip_device *ud) - { - int happened = 0; -+ unsigned long flags; - -- spin_lock(&ud->lock); -+ spin_lock_irqsave(&ud->lock, flags); - if (ud->event != 0) - happened = 1; -- spin_unlock(&ud->lock); -+ spin_unlock_irqrestore(&ud->lock, flags); - - return happened; - } -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index f9af04d7f02f..00d68945548e 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -121,9 +121,11 @@ static void dump_port_status_diff(u32 prev_status, u32 new_status) - - void rh_port_connect(int rhport, enum usb_device_speed speed) - { -+ unsigned long flags; -+ - usbip_dbg_vhci_rh("rh_port_connect %d\n", rhport); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - the_controller->port_status[rhport] |= USB_PORT_STAT_CONNECTION - | (1 << USB_PORT_FEAT_C_CONNECTION); -@@ -139,22 +141,24 @@ void rh_port_connect(int rhport, enum usb_device_speed speed) - break; - } - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usb_hcd_poll_rh_status(vhci_to_hcd(the_controller)); - } - - static void rh_port_disconnect(int rhport) - { -+ unsigned long flags; -+ - usbip_dbg_vhci_rh("rh_port_disconnect %d\n", rhport); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - the_controller->port_status[rhport] &= ~USB_PORT_STAT_CONNECTION; - the_controller->port_status[rhport] |= - (1 << USB_PORT_FEAT_C_CONNECTION); - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - usb_hcd_poll_rh_status(vhci_to_hcd(the_controller)); - } - -@@ -182,13 +186,14 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf) - int retval; - int rhport; - int changed = 0; -+ unsigned long flags; - - retval = DIV_ROUND_UP(VHCI_NPORTS + 1, 8); - memset(buf, 0, retval); - - vhci = hcd_to_vhci(hcd); - -- spin_lock(&vhci->lock); -+ spin_lock_irqsave(&vhci->lock, flags); - if (!HCD_HW_ACCESSIBLE(hcd)) { - usbip_dbg_vhci_rh("hw accessible flag not on?\n"); - goto done; -@@ -209,7 +214,7 @@ static int vhci_hub_status(struct usb_hcd *hcd, char *buf) - usb_hcd_resume_root_hub(hcd); - - done: -- spin_unlock(&vhci->lock); -+ spin_unlock_irqrestore(&vhci->lock, flags); - return changed ? retval : 0; - } - -@@ -236,6 +241,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - struct vhci_hcd *dum; - int retval = 0; - int rhport; -+ unsigned long flags; - - u32 prev_port_status[VHCI_NPORTS]; - -@@ -254,7 +260,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - - dum = hcd_to_vhci(hcd); - -- spin_lock(&dum->lock); -+ spin_lock_irqsave(&dum->lock, flags); - - /* store old status and compare now and old later */ - if (usbip_dbg_flag_vhci_rh) { -@@ -408,7 +414,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - } - usbip_dbg_vhci_rh(" bye\n"); - -- spin_unlock(&dum->lock); -+ spin_unlock_irqrestore(&dum->lock, flags); - - return retval; - } -@@ -431,6 +437,7 @@ static void vhci_tx_urb(struct urb *urb) - { - struct vhci_device *vdev = get_vdev(urb->dev); - struct vhci_priv *priv; -+ unsigned long flags; - - if (!vdev) { - pr_err("could not get virtual device"); -@@ -443,7 +450,7 @@ static void vhci_tx_urb(struct urb *urb) - return; - } - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - - priv->seqnum = atomic_inc_return(&the_controller->seqnum); - if (priv->seqnum == 0xffff) -@@ -457,7 +464,7 @@ static void vhci_tx_urb(struct urb *urb) - list_add_tail(&priv->list, &vdev->priv_tx); - - wake_up(&vdev->waitq_tx); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - } - - static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, -@@ -466,15 +473,16 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, - struct device *dev = &urb->dev->dev; - int ret = 0; - struct vhci_device *vdev; -+ unsigned long flags; - - /* patch to usb_sg_init() is in 2.5.60 */ - BUG_ON(!urb->transfer_buffer && urb->transfer_buffer_length); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - if (urb->status != -EINPROGRESS) { - dev_err(dev, "URB already unlinked!, status %d\n", urb->status); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - return urb->status; - } - -@@ -486,7 +494,7 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, - vdev->ud.status == VDEV_ST_ERROR) { - dev_err(dev, "enqueue for inactive port %d\n", vdev->rhport); - spin_unlock(&vdev->ud.lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - return -ENODEV; - } - spin_unlock(&vdev->ud.lock); -@@ -559,14 +567,14 @@ static int vhci_urb_enqueue(struct usb_hcd *hcd, struct urb *urb, - - out: - vhci_tx_urb(urb); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - return 0; - - no_need_xmit: - usb_hcd_unlink_urb_from_ep(hcd, urb); - no_need_unlink: -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - if (!ret) - usb_hcd_giveback_urb(vhci_to_hcd(the_controller), - urb, urb->status); -@@ -623,14 +631,15 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - { - struct vhci_priv *priv; - struct vhci_device *vdev; -+ unsigned long flags; - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - priv = urb->hcpriv; - if (!priv) { - /* URB was never linked! or will be soon given back by - * vhci_rx. */ -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - return -EIDRM; - } - -@@ -639,7 +648,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - - ret = usb_hcd_check_unlink_urb(hcd, urb, status); - if (ret) { -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - return ret; - } - } -@@ -664,10 +673,10 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - */ - usb_hcd_unlink_urb_from_ep(hcd, urb); - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, - urb->status); -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - } else { - /* tcp connection is alive */ -@@ -679,7 +688,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - unlink = kzalloc(sizeof(struct vhci_unlink), GFP_ATOMIC); - if (!unlink) { - spin_unlock(&vdev->priv_lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - usbip_event_add(&vdev->ud, VDEV_EVENT_ERROR_MALLOC); - return -ENOMEM; - } -@@ -698,7 +707,7 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - spin_unlock(&vdev->priv_lock); - } - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usbip_dbg_vhci_hc("leave\n"); - return 0; -@@ -707,8 +716,9 @@ static int vhci_urb_dequeue(struct usb_hcd *hcd, struct urb *urb, int status) - static void vhci_device_unlink_cleanup(struct vhci_device *vdev) - { - struct vhci_unlink *unlink, *tmp; -+ unsigned long flags; - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - spin_lock(&vdev->priv_lock); - - list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) { -@@ -742,19 +752,19 @@ static void vhci_device_unlink_cleanup(struct vhci_device *vdev) - list_del(&unlink->list); - - spin_unlock(&vdev->priv_lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, - urb->status); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - spin_lock(&vdev->priv_lock); - - kfree(unlink); - } - - spin_unlock(&vdev->priv_lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - } - - /* -@@ -768,7 +778,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) - - /* need this? see stub_dev.c */ - if (ud->tcp_socket) { -- pr_debug("shutdown tcp_socket %p\n", ud->tcp_socket); -+ pr_debug("shutdown sockfd %d\n", ud->sockfd); - kernel_sock_shutdown(ud->tcp_socket, SHUT_RDWR); - } - -@@ -821,8 +831,9 @@ static void vhci_shutdown_connection(struct usbip_device *ud) - static void vhci_device_reset(struct usbip_device *ud) - { - struct vhci_device *vdev = container_of(ud, struct vhci_device, ud); -+ unsigned long flags; - -- spin_lock(&ud->lock); -+ spin_lock_irqsave(&ud->lock, flags); - - vdev->speed = 0; - vdev->devid = 0; -@@ -836,14 +847,16 @@ static void vhci_device_reset(struct usbip_device *ud) - } - ud->status = VDEV_ST_NULL; - -- spin_unlock(&ud->lock); -+ spin_unlock_irqrestore(&ud->lock, flags); - } - - static void vhci_device_unusable(struct usbip_device *ud) - { -- spin_lock(&ud->lock); -+ unsigned long flags; -+ -+ spin_lock_irqsave(&ud->lock, flags); - ud->status = VDEV_ST_ERROR; -- spin_unlock(&ud->lock); -+ spin_unlock_irqrestore(&ud->lock, flags); - } - - static void vhci_device_init(struct vhci_device *vdev) -@@ -933,12 +946,13 @@ static int vhci_get_frame_number(struct usb_hcd *hcd) - static int vhci_bus_suspend(struct usb_hcd *hcd) - { - struct vhci_hcd *vhci = hcd_to_vhci(hcd); -+ unsigned long flags; - - dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__); - -- spin_lock(&vhci->lock); -+ spin_lock_irqsave(&vhci->lock, flags); - hcd->state = HC_STATE_SUSPENDED; -- spin_unlock(&vhci->lock); -+ spin_unlock_irqrestore(&vhci->lock, flags); - - return 0; - } -@@ -947,15 +961,16 @@ static int vhci_bus_resume(struct usb_hcd *hcd) - { - struct vhci_hcd *vhci = hcd_to_vhci(hcd); - int rc = 0; -+ unsigned long flags; - - dev_dbg(&hcd->self.root_hub->dev, "%s\n", __func__); - -- spin_lock(&vhci->lock); -+ spin_lock_irqsave(&vhci->lock, flags); - if (!HCD_HW_ACCESSIBLE(hcd)) - rc = -ESHUTDOWN; - else - hcd->state = HC_STATE_RUNNING; -- spin_unlock(&vhci->lock); -+ spin_unlock_irqrestore(&vhci->lock, flags); - - return rc; - } -@@ -1053,17 +1068,18 @@ static int vhci_hcd_suspend(struct platform_device *pdev, pm_message_t state) - int rhport = 0; - int connected = 0; - int ret = 0; -+ unsigned long flags; - - hcd = platform_get_drvdata(pdev); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - for (rhport = 0; rhport < VHCI_NPORTS; rhport++) - if (the_controller->port_status[rhport] & - USB_PORT_STAT_CONNECTION) - connected += 1; - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - if (connected > 0) { - dev_info(&pdev->dev, -diff --git a/drivers/usb/usbip/vhci_rx.c b/drivers/usb/usbip/vhci_rx.c -index bc4eb0855314..323aa7789989 100644 ---- a/drivers/usb/usbip/vhci_rx.c -+++ b/drivers/usb/usbip/vhci_rx.c -@@ -71,10 +71,11 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, - { - struct usbip_device *ud = &vdev->ud; - struct urb *urb; -+ unsigned long flags; - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - urb = pickup_urb_and_free_priv(vdev, pdu->base.seqnum); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - if (!urb) { - pr_err("cannot find a urb of seqnum %u max seqnum %d\n", -@@ -103,9 +104,9 @@ static void vhci_recv_ret_submit(struct vhci_device *vdev, - - usbip_dbg_vhci_rx("now giveback urb %u\n", pdu->base.seqnum); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, urb->status); - -@@ -116,8 +117,9 @@ static struct vhci_unlink *dequeue_pending_unlink(struct vhci_device *vdev, - struct usbip_header *pdu) - { - struct vhci_unlink *unlink, *tmp; -+ unsigned long flags; - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - - list_for_each_entry_safe(unlink, tmp, &vdev->unlink_rx, list) { - pr_info("unlink->seqnum %lu\n", unlink->seqnum); -@@ -126,12 +128,12 @@ static struct vhci_unlink *dequeue_pending_unlink(struct vhci_device *vdev, - unlink->seqnum); - list_del(&unlink->list); - -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - return unlink; - } - } - -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - return NULL; - } -@@ -141,6 +143,7 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, - { - struct vhci_unlink *unlink; - struct urb *urb; -+ unsigned long flags; - - usbip_dump_header(pdu); - -@@ -151,9 +154,9 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, - return; - } - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - urb = pickup_urb_and_free_priv(vdev, unlink->unlink_seqnum); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - if (!urb) { - /* -@@ -170,9 +173,9 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, - urb->status = pdu->u.ret_unlink.status; - pr_info("urb->status %d\n", urb->status); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - usb_hcd_unlink_urb_from_ep(vhci_to_hcd(the_controller), urb); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usb_hcd_giveback_urb(vhci_to_hcd(the_controller), urb, - urb->status); -@@ -184,10 +187,11 @@ static void vhci_recv_ret_unlink(struct vhci_device *vdev, - static int vhci_priv_tx_empty(struct vhci_device *vdev) - { - int empty = 0; -+ unsigned long flags; - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - empty = list_empty(&vdev->priv_rx); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - return empty; - } -diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c -index 211f43f67ea2..1c7f41a65565 100644 ---- a/drivers/usb/usbip/vhci_sysfs.c -+++ b/drivers/usb/usbip/vhci_sysfs.c -@@ -32,23 +32,28 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, - { - char *s = out; - int i = 0; -+ unsigned long flags; - - BUG_ON(!the_controller || !out); - -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - /* - * output example: -- * prt sta spd dev socket local_busid -- * 000 004 000 000 c5a7bb80 1-2.3 -- * 001 004 000 000 d8cee980 2-3.4 -+ * port sta spd dev sockfd local_busid -+ * 0000 004 000 00000000 000003 1-2.3 -+ * 0001 004 000 00000000 000004 2-3.4 - * -- * IP address can be retrieved from a socket pointer address by looking -- * up /proc/net/{tcp,tcp6}. Also, a userland program may remember a -- * port number and its peer IP address. -+ * Output includes socket fd instead of socket pointer address to -+ * avoid leaking kernel memory address in: -+ * /sys/devices/platform/vhci_hcd.0/status and in debug output. -+ * The socket pointer address is not used at the moment and it was -+ * made visible as a convenient way to find IP address from socket -+ * pointer address by looking up /proc/net/{tcp,tcp6}. As this opens -+ * a security hole, the change is made to use sockfd instead. - */ - out += sprintf(out, -- "prt sta spd bus dev socket local_busid\n"); -+ "prt sta spd bus dev sockfd local_busid\n"); - - for (i = 0; i < VHCI_NPORTS; i++) { - struct vhci_device *vdev = port_to_vdev(i); -@@ -60,17 +65,17 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, - out += sprintf(out, "%03u %08x ", - vdev->speed, vdev->devid); - out += sprintf(out, "%16p ", vdev->ud.tcp_socket); -+ out += sprintf(out, "%06u", vdev->ud.sockfd); - out += sprintf(out, "%s", dev_name(&vdev->udev->dev)); - -- } else { -- out += sprintf(out, "000 000 000 0000000000000000 0-0"); -- } -+ } else -+ out += sprintf(out, "000 000 000 000000 0-0"); - - out += sprintf(out, "\n"); - spin_unlock(&vdev->ud.lock); - } - -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - return out - s; - } -@@ -80,11 +85,12 @@ static DEVICE_ATTR_RO(status); - static int vhci_port_disconnect(__u32 rhport) - { - struct vhci_device *vdev; -+ unsigned long flags; - - usbip_dbg_vhci_sysfs("enter\n"); - - /* lock */ -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - - vdev = port_to_vdev(rhport); - -@@ -94,14 +100,14 @@ static int vhci_port_disconnect(__u32 rhport) - - /* unlock */ - spin_unlock(&vdev->ud.lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - return -EINVAL; - } - - /* unlock */ - spin_unlock(&vdev->ud.lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - usbip_event_add(&vdev->ud, VDEV_EVENT_DOWN); - -@@ -177,6 +183,7 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr, - int sockfd = 0; - __u32 rhport = 0, devid = 0, speed = 0; - int err; -+ unsigned long flags; - - /* - * @rhport: port number of vhci_hcd -@@ -202,14 +209,14 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr, - /* now need lock until setting vdev status as used */ - - /* begin a lock */ -- spin_lock(&the_controller->lock); -+ spin_lock_irqsave(&the_controller->lock, flags); - vdev = port_to_vdev(rhport); - spin_lock(&vdev->ud.lock); - - if (vdev->ud.status != VDEV_ST_NULL) { - /* end of the lock */ - spin_unlock(&vdev->ud.lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - - sockfd_put(socket); - -@@ -223,11 +230,12 @@ static ssize_t store_attach(struct device *dev, struct device_attribute *attr, - - vdev->devid = devid; - vdev->speed = speed; -+ vdev->ud.sockfd = sockfd; - vdev->ud.tcp_socket = socket; - vdev->ud.status = VDEV_ST_NOTASSIGNED; - - spin_unlock(&vdev->ud.lock); -- spin_unlock(&the_controller->lock); -+ spin_unlock_irqrestore(&the_controller->lock, flags); - /* end the lock */ - - vdev->ud.tcp_rx = kthread_get_run(vhci_rx_loop, &vdev->ud, "vhci_rx"); -diff --git a/drivers/usb/usbip/vhci_tx.c b/drivers/usb/usbip/vhci_tx.c -index 3c5796c8633a..a9a663a578b6 100644 ---- a/drivers/usb/usbip/vhci_tx.c -+++ b/drivers/usb/usbip/vhci_tx.c -@@ -47,16 +47,17 @@ static void setup_cmd_submit_pdu(struct usbip_header *pdup, struct urb *urb) - static struct vhci_priv *dequeue_from_priv_tx(struct vhci_device *vdev) - { - struct vhci_priv *priv, *tmp; -+ unsigned long flags; - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - - list_for_each_entry_safe(priv, tmp, &vdev->priv_tx, list) { - list_move_tail(&priv->list, &vdev->priv_rx); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - return priv; - } - -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - return NULL; - } -@@ -137,16 +138,17 @@ static int vhci_send_cmd_submit(struct vhci_device *vdev) - static struct vhci_unlink *dequeue_from_unlink_tx(struct vhci_device *vdev) - { - struct vhci_unlink *unlink, *tmp; -+ unsigned long flags; - -- spin_lock(&vdev->priv_lock); -+ spin_lock_irqsave(&vdev->priv_lock, flags); - - list_for_each_entry_safe(unlink, tmp, &vdev->unlink_tx, list) { - list_move_tail(&unlink->list, &vdev->unlink_rx); -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - return unlink; - } - -- spin_unlock(&vdev->priv_lock); -+ spin_unlock_irqrestore(&vdev->priv_lock, flags); - - return NULL; - } -diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c -index d6aeb84e90b6..d882d873c5a3 100644 ---- a/fs/ext2/acl.c -+++ b/fs/ext2/acl.c -@@ -178,11 +178,8 @@ ext2_get_acl(struct inode *inode, int type) - return acl; - } - --/* -- * inode->i_mutex: down -- */ --int --ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type) -+static int -+__ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type) - { - int name_index; - void *value = NULL; -@@ -192,13 +189,6 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type) - switch(type) { - case ACL_TYPE_ACCESS: - name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; -- if (acl) { -- error = posix_acl_update_mode(inode, &inode->i_mode, &acl); -- if (error) -- return error; -- inode->i_ctime = CURRENT_TIME_SEC; -- mark_inode_dirty(inode); -- } - break; - - case ACL_TYPE_DEFAULT: -@@ -224,6 +214,24 @@ ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type) - return error; - } - -+/* -+ * inode->i_mutex: down -+ */ -+int -+ext2_set_acl(struct inode *inode, struct posix_acl *acl, int type) -+{ -+ int error; -+ -+ if (type == ACL_TYPE_ACCESS && acl) { -+ error = posix_acl_update_mode(inode, &inode->i_mode, &acl); -+ if (error) -+ return error; -+ inode->i_ctime = CURRENT_TIME_SEC; -+ mark_inode_dirty(inode); -+ } -+ return __ext2_set_acl(inode, acl, type); -+} -+ - /* - * Initialize the ACLs of a new inode. Called from ext2_new_inode. - * -@@ -241,12 +249,12 @@ ext2_init_acl(struct inode *inode, struct inode *dir) - return error; - - if (default_acl) { -- error = ext2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT); -+ error = __ext2_set_acl(inode, default_acl, ACL_TYPE_DEFAULT); - posix_acl_release(default_acl); - } - if (acl) { - if (!error) -- error = ext2_set_acl(inode, acl, ACL_TYPE_ACCESS); -+ error = __ext2_set_acl(inode, acl, ACL_TYPE_ACCESS); - posix_acl_release(acl); - } - return error; -diff --git a/fs/fcntl.c b/fs/fcntl.c -index 62376451bbce..5df914943d96 100644 ---- a/fs/fcntl.c -+++ b/fs/fcntl.c -@@ -113,6 +113,10 @@ void f_setown(struct file *filp, unsigned long arg, int force) - int who = arg; - type = PIDTYPE_PID; - if (who < 0) { -+ /* avoid overflow below */ -+ if (who == INT_MIN) -+ return; -+ - type = PIDTYPE_PGID; - who = -who; - } -diff --git a/fs/nfsd/auth.c b/fs/nfsd/auth.c -index a260060042ad..67eb154af881 100644 ---- a/fs/nfsd/auth.c -+++ b/fs/nfsd/auth.c -@@ -60,9 +60,10 @@ int nfsd_setuser(struct svc_rqst *rqstp, struct svc_export *exp) - else - GROUP_AT(gi, i) = GROUP_AT(rqgi, i); - -- /* Each thread allocates its own gi, no race */ -- groups_sort(gi); - } -+ -+ /* Each thread allocates its own gi, no race */ -+ groups_sort(gi); - } else { - gi = get_group_info(rqgi); - } -diff --git a/fs/reiserfs/bitmap.c b/fs/reiserfs/bitmap.c -index dc198bc64c61..edc8ef78b63f 100644 ---- a/fs/reiserfs/bitmap.c -+++ b/fs/reiserfs/bitmap.c -@@ -513,9 +513,17 @@ static void __discard_prealloc(struct reiserfs_transaction_handle *th, - "inode has negative prealloc blocks count."); - #endif - while (ei->i_prealloc_count > 0) { -- reiserfs_free_prealloc_block(th, inode, ei->i_prealloc_block); -- ei->i_prealloc_block++; -+ b_blocknr_t block_to_free; -+ -+ /* -+ * reiserfs_free_prealloc_block can drop the write lock, -+ * which could allow another caller to free the same block. -+ * We can protect against it by modifying the prealloc -+ * state before calling it. -+ */ -+ block_to_free = ei->i_prealloc_block++; - ei->i_prealloc_count--; -+ reiserfs_free_prealloc_block(th, inode, block_to_free); - dirty = 1; - } - if (dirty) -@@ -1128,7 +1136,7 @@ static int determine_prealloc_size(reiserfs_blocknr_hint_t * hint) - hint->prealloc_size = 0; - - if (!hint->formatted_node && hint->preallocate) { -- if (S_ISREG(hint->inode->i_mode) -+ if (S_ISREG(hint->inode->i_mode) && !IS_PRIVATE(hint->inode) - && hint->inode->i_size >= - REISERFS_SB(hint->th->t_super)->s_alloc_options. - preallocmin * hint->inode->i_sb->s_blocksize) -diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c -index 9b1824f35501..91b036902a17 100644 ---- a/fs/reiserfs/xattr_acl.c -+++ b/fs/reiserfs/xattr_acl.c -@@ -37,7 +37,14 @@ reiserfs_set_acl(struct inode *inode, struct posix_acl *acl, int type) - error = journal_begin(&th, inode->i_sb, jcreate_blocks); - reiserfs_write_unlock(inode->i_sb); - if (error == 0) { -+ if (type == ACL_TYPE_ACCESS && acl) { -+ error = posix_acl_update_mode(inode, &inode->i_mode, -+ &acl); -+ if (error) -+ goto unlock; -+ } - error = __reiserfs_set_acl(&th, inode, type, acl); -+unlock: - reiserfs_write_lock(inode->i_sb); - error2 = journal_end(&th); - reiserfs_write_unlock(inode->i_sb); -@@ -245,11 +252,6 @@ __reiserfs_set_acl(struct reiserfs_transaction_handle *th, struct inode *inode, - switch (type) { - case ACL_TYPE_ACCESS: - name = POSIX_ACL_XATTR_ACCESS; -- if (acl) { -- error = posix_acl_update_mode(inode, &inode->i_mode, &acl); -- if (error) -- return error; -- } - break; - case ACL_TYPE_DEFAULT: - name = POSIX_ACL_XATTR_DEFAULT; -diff --git a/fs/select.c b/fs/select.c -index 015547330e88..f4dd55fc638c 100644 ---- a/fs/select.c -+++ b/fs/select.c -@@ -29,6 +29,7 @@ - #include - #include - #include -+#include - - #include - -@@ -550,7 +551,7 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp, - fd_set_bits fds; - void *bits; - int ret, max_fds; -- unsigned int size; -+ size_t size, alloc_size; - struct fdtable *fdt; - /* Allocate small arguments on the stack to save memory and be faster */ - long stack_fds[SELECT_STACK_ALLOC/sizeof(long)]; -@@ -577,7 +578,14 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp, - if (size > sizeof(stack_fds) / 6) { - /* Not enough space in on-stack array; must use kmalloc */ - ret = -ENOMEM; -- bits = kmalloc(6 * size, GFP_KERNEL); -+ if (size > (SIZE_MAX / 6)) -+ goto out_nofds; -+ -+ alloc_size = 6 * size; -+ bits = kmalloc(alloc_size, GFP_KERNEL|__GFP_NOWARN); -+ if (!bits && alloc_size > PAGE_SIZE) -+ bits = vmalloc(alloc_size); -+ - if (!bits) - goto out_nofds; - } -@@ -614,7 +622,7 @@ int core_sys_select(int n, fd_set __user *inp, fd_set __user *outp, - - out: - if (bits != stack_fds) -- kfree(bits); -+ kvfree(bits); - out_nofds: - return ret; - } -diff --git a/include/linux/cacheinfo.h b/include/linux/cacheinfo.h -index 2189935075b4..a951fd10aaaa 100644 ---- a/include/linux/cacheinfo.h -+++ b/include/linux/cacheinfo.h -@@ -71,6 +71,7 @@ struct cpu_cacheinfo { - struct cacheinfo *info_list; - unsigned int num_levels; - unsigned int num_leaves; -+ bool cpu_map_populated; - }; - - /* -diff --git a/include/linux/ktime.h b/include/linux/ktime.h -index 2b6a204bd8d4..3ffc69ebe967 100644 ---- a/include/linux/ktime.h -+++ b/include/linux/ktime.h -@@ -63,6 +63,13 @@ static inline ktime_t ktime_set(const s64 secs, const unsigned long nsecs) - #define ktime_add(lhs, rhs) \ - ({ (ktime_t){ .tv64 = (lhs).tv64 + (rhs).tv64 }; }) - -+/* -+ * Same as ktime_add(), but avoids undefined behaviour on overflow; however, -+ * this means that you must check the result for overflow yourself. -+ */ -+#define ktime_add_unsafe(lhs, rhs) \ -+ ({ (ktime_t){ .tv64 = (u64) (lhs).tv64 + (rhs).tv64 }; }) -+ - /* - * Add a ktime_t variable and a scalar nanosecond value. - * res = kt + nsval: -diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h -index 04078e8a4803..d6c53fce006b 100644 ---- a/include/linux/netfilter/x_tables.h -+++ b/include/linux/netfilter/x_tables.h -@@ -243,6 +243,10 @@ int xt_check_entry_offsets(const void *base, const char *elems, - unsigned int target_offset, - unsigned int next_offset); - -+unsigned int *xt_alloc_entry_offsets(unsigned int size); -+bool xt_find_jump_offset(const unsigned int *offsets, -+ unsigned int target, unsigned int size); -+ - int xt_check_match(struct xt_mtchk_param *, unsigned int size, u_int8_t proto, - bool inv_proto); - int xt_check_target(struct xt_tgchk_param *, unsigned int size, u_int8_t proto, -@@ -377,16 +381,16 @@ static inline unsigned long ifname_compare_aligned(const char *_a, - * allows us to return 0 for single core systems without forcing - * callers to deal with SMP vs. NONSMP issues. - */ --static inline u64 xt_percpu_counter_alloc(void) -+static inline unsigned long xt_percpu_counter_alloc(void) - { - if (nr_cpu_ids > 1) { - void __percpu *res = __alloc_percpu(sizeof(struct xt_counters), - sizeof(struct xt_counters)); - - if (res == NULL) -- return (u64) -ENOMEM; -+ return -ENOMEM; - -- return (u64) (__force unsigned long) res; -+ return (__force unsigned long) res; - } - - return 0; -diff --git a/include/linux/sched.h b/include/linux/sched.h -index e887c8d6f395..90bea398e5e0 100644 ---- a/include/linux/sched.h -+++ b/include/linux/sched.h -@@ -1313,6 +1313,7 @@ struct sched_dl_entity { - u64 dl_deadline; /* relative deadline of each instance */ - u64 dl_period; /* separation of two instances (period) */ - u64 dl_bw; /* dl_runtime / dl_deadline */ -+ u64 dl_density; /* dl_runtime / dl_deadline */ - - /* - * Actual scheduling parameters. Initialized with the values above, -diff --git a/include/linux/tcp.h b/include/linux/tcp.h -index 318c24612458..2260f92f1492 100644 ---- a/include/linux/tcp.h -+++ b/include/linux/tcp.h -@@ -29,9 +29,14 @@ static inline struct tcphdr *tcp_hdr(const struct sk_buff *skb) - return (struct tcphdr *)skb_transport_header(skb); - } - -+static inline unsigned int __tcp_hdrlen(const struct tcphdr *th) -+{ -+ return th->doff * 4; -+} -+ - static inline unsigned int tcp_hdrlen(const struct sk_buff *skb) - { -- return tcp_hdr(skb)->doff * 4; -+ return __tcp_hdrlen(tcp_hdr(skb)); - } - - static inline struct tcphdr *inner_tcp_hdr(const struct sk_buff *skb) -diff --git a/include/linux/vermagic.h b/include/linux/vermagic.h -index a3d04934aa96..6f8fbcf10dfb 100644 ---- a/include/linux/vermagic.h -+++ b/include/linux/vermagic.h -@@ -24,16 +24,10 @@ - #ifndef MODULE_ARCH_VERMAGIC - #define MODULE_ARCH_VERMAGIC "" - #endif --#ifdef RETPOLINE --#define MODULE_VERMAGIC_RETPOLINE "retpoline " --#else --#define MODULE_VERMAGIC_RETPOLINE "" --#endif - - #define VERMAGIC_STRING \ - UTS_RELEASE " " \ - MODULE_VERMAGIC_SMP MODULE_VERMAGIC_PREEMPT \ - MODULE_VERMAGIC_MODULE_UNLOAD MODULE_VERMAGIC_MODVERSIONS \ -- MODULE_ARCH_VERMAGIC \ -- MODULE_VERMAGIC_RETPOLINE -+ MODULE_ARCH_VERMAGIC - -diff --git a/include/net/arp.h b/include/net/arp.h -index 5e0f891d476c..1b3f86981757 100644 ---- a/include/net/arp.h -+++ b/include/net/arp.h -@@ -19,6 +19,9 @@ static inline u32 arp_hashfn(const void *pkey, const struct net_device *dev, u32 - - static inline struct neighbour *__ipv4_neigh_lookup_noref(struct net_device *dev, u32 key) - { -+ if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT)) -+ key = INADDR_ANY; -+ - return ___neigh_lookup_noref(&arp_tbl, neigh_key_eq32, arp_hashfn, &key, dev); - } - -diff --git a/include/net/ipv6.h b/include/net/ipv6.h -index 7a8066b90289..84f0d0602433 100644 ---- a/include/net/ipv6.h -+++ b/include/net/ipv6.h -@@ -281,6 +281,7 @@ int ipv6_flowlabel_opt_get(struct sock *sk, struct in6_flowlabel_req *freq, - int flags); - int ip6_flowlabel_init(void); - void ip6_flowlabel_cleanup(void); -+bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np); - - static inline void fl6_sock_release(struct ip6_flowlabel *fl) - { -diff --git a/include/net/net_namespace.h b/include/net/net_namespace.h -index 2dcea635ecce..93328c61934a 100644 ---- a/include/net/net_namespace.h -+++ b/include/net/net_namespace.h -@@ -209,6 +209,11 @@ int net_eq(const struct net *net1, const struct net *net2) - return net1 == net2; - } - -+static inline int check_net(const struct net *net) -+{ -+ return atomic_read(&net->count) != 0; -+} -+ - void net_drop_ns(void *); - - #else -@@ -233,6 +238,11 @@ int net_eq(const struct net *net1, const struct net *net2) - return 1; - } - -+static inline int check_net(const struct net *net) -+{ -+ return 1; -+} -+ - #define net_drop_ns NULL - #endif - -diff --git a/include/uapi/linux/eventpoll.h b/include/uapi/linux/eventpoll.h -index bc81fb2e1f0e..6f04cb419115 100644 ---- a/include/uapi/linux/eventpoll.h -+++ b/include/uapi/linux/eventpoll.h -@@ -26,6 +26,19 @@ - #define EPOLL_CTL_DEL 2 - #define EPOLL_CTL_MOD 3 - -+/* Epoll event masks */ -+#define EPOLLIN 0x00000001 -+#define EPOLLPRI 0x00000002 -+#define EPOLLOUT 0x00000004 -+#define EPOLLERR 0x00000008 -+#define EPOLLHUP 0x00000010 -+#define EPOLLRDNORM 0x00000040 -+#define EPOLLRDBAND 0x00000080 -+#define EPOLLWRNORM 0x00000100 -+#define EPOLLWRBAND 0x00000200 -+#define EPOLLMSG 0x00000400 -+#define EPOLLRDHUP 0x00002000 -+ - /* - * Request the handling of system wakeup events so as to prevent system suspends - * from happening while those events are being processed. -diff --git a/ipc/msg.c b/ipc/msg.c -index c6521c205cb4..f993f441f852 100644 ---- a/ipc/msg.c -+++ b/ipc/msg.c -@@ -742,7 +742,10 @@ static inline int convert_mode(long *msgtyp, int msgflg) - if (*msgtyp == 0) - return SEARCH_ANY; - if (*msgtyp < 0) { -- *msgtyp = -*msgtyp; -+ if (*msgtyp == LONG_MIN) /* -LONG_MIN is undefined */ -+ *msgtyp = LONG_MAX; -+ else -+ *msgtyp = -*msgtyp; - return SEARCH_LESSEQUAL; - } - if (msgflg & MSG_EXCEPT) -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index 9d6b3d869592..e6d1173a2046 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -2109,6 +2109,7 @@ void __dl_clear_params(struct task_struct *p) - dl_se->dl_period = 0; - dl_se->flags = 0; - dl_se->dl_bw = 0; -+ dl_se->dl_density = 0; - - dl_se->dl_throttled = 0; - dl_se->dl_new = 1; -@@ -3647,6 +3648,7 @@ __setparam_dl(struct task_struct *p, const struct sched_attr *attr) - dl_se->dl_period = attr->sched_period ?: dl_se->dl_deadline; - dl_se->flags = attr->sched_flags; - dl_se->dl_bw = to_ratio(dl_se->dl_period, dl_se->dl_runtime); -+ dl_se->dl_density = to_ratio(dl_se->dl_deadline, dl_se->dl_runtime); - - /* - * Changing the parameters of a task is 'tricky' and we're not doing -diff --git a/kernel/sched/deadline.c b/kernel/sched/deadline.c -index 6be2afd9bfd6..e12b0a4df891 100644 ---- a/kernel/sched/deadline.c -+++ b/kernel/sched/deadline.c -@@ -480,13 +480,84 @@ static bool dl_entity_overflow(struct sched_dl_entity *dl_se, - } - - /* -- * When a -deadline entity is queued back on the runqueue, its runtime and -- * deadline might need updating. -+ * Revised wakeup rule [1]: For self-suspending tasks, rather then -+ * re-initializing task's runtime and deadline, the revised wakeup -+ * rule adjusts the task's runtime to avoid the task to overrun its -+ * density. - * -- * The policy here is that we update the deadline of the entity only if: -- * - the current deadline is in the past, -- * - using the remaining runtime with the current deadline would make -- * the entity exceed its bandwidth. -+ * Reasoning: a task may overrun the density if: -+ * runtime / (deadline - t) > dl_runtime / dl_deadline -+ * -+ * Therefore, runtime can be adjusted to: -+ * runtime = (dl_runtime / dl_deadline) * (deadline - t) -+ * -+ * In such way that runtime will be equal to the maximum density -+ * the task can use without breaking any rule. -+ * -+ * [1] Luca Abeni, Giuseppe Lipari, and Juri Lelli. 2015. Constant -+ * bandwidth server revisited. SIGBED Rev. 11, 4 (January 2015), 19-24. -+ */ -+static void -+update_dl_revised_wakeup(struct sched_dl_entity *dl_se, struct rq *rq) -+{ -+ u64 laxity = dl_se->deadline - rq_clock(rq); -+ -+ /* -+ * If the task has deadline < period, and the deadline is in the past, -+ * it should already be throttled before this check. -+ * -+ * See update_dl_entity() comments for further details. -+ */ -+ WARN_ON(dl_time_before(dl_se->deadline, rq_clock(rq))); -+ -+ dl_se->runtime = (dl_se->dl_density * laxity) >> 20; -+} -+ -+/* -+ * Regarding the deadline, a task with implicit deadline has a relative -+ * deadline == relative period. A task with constrained deadline has a -+ * relative deadline <= relative period. -+ * -+ * We support constrained deadline tasks. However, there are some restrictions -+ * applied only for tasks which do not have an implicit deadline. See -+ * update_dl_entity() to know more about such restrictions. -+ * -+ * The dl_is_implicit() returns true if the task has an implicit deadline. -+ */ -+static inline bool dl_is_implicit(struct sched_dl_entity *dl_se) -+{ -+ return dl_se->dl_deadline == dl_se->dl_period; -+} -+ -+/* -+ * When a deadline entity is placed in the runqueue, its runtime and deadline -+ * might need to be updated. This is done by a CBS wake up rule. There are two -+ * different rules: 1) the original CBS; and 2) the Revisited CBS. -+ * -+ * When the task is starting a new period, the Original CBS is used. In this -+ * case, the runtime is replenished and a new absolute deadline is set. -+ * -+ * When a task is queued before the begin of the next period, using the -+ * remaining runtime and deadline could make the entity to overflow, see -+ * dl_entity_overflow() to find more about runtime overflow. When such case -+ * is detected, the runtime and deadline need to be updated. -+ * -+ * If the task has an implicit deadline, i.e., deadline == period, the Original -+ * CBS is applied. the runtime is replenished and a new absolute deadline is -+ * set, as in the previous cases. -+ * -+ * However, the Original CBS does not work properly for tasks with -+ * deadline < period, which are said to have a constrained deadline. By -+ * applying the Original CBS, a constrained deadline task would be able to run -+ * runtime/deadline in a period. With deadline < period, the task would -+ * overrun the runtime/period allowed bandwidth, breaking the admission test. -+ * -+ * In order to prevent this misbehave, the Revisited CBS is used for -+ * constrained deadline tasks when a runtime overflow is detected. In the -+ * Revisited CBS, rather than replenishing & setting a new absolute deadline, -+ * the remaining runtime of the task is reduced to avoid runtime overflow. -+ * Please refer to the comments update_dl_revised_wakeup() function to find -+ * more about the Revised CBS rule. - */ - static void update_dl_entity(struct sched_dl_entity *dl_se, - struct sched_dl_entity *pi_se) -@@ -505,6 +576,14 @@ static void update_dl_entity(struct sched_dl_entity *dl_se, - - if (dl_time_before(dl_se->deadline, rq_clock(rq)) || - dl_entity_overflow(dl_se, pi_se, rq_clock(rq))) { -+ -+ if (unlikely(!dl_is_implicit(dl_se) && -+ !dl_time_before(dl_se->deadline, rq_clock(rq)) && -+ !dl_se->dl_boosted)){ -+ update_dl_revised_wakeup(dl_se, rq); -+ return; -+ } -+ - dl_se->deadline = rq_clock(rq) + pi_se->dl_deadline; - dl_se->runtime = pi_se->dl_runtime; - } -@@ -991,11 +1070,6 @@ static void dequeue_dl_entity(struct sched_dl_entity *dl_se) - __dequeue_dl_entity(dl_se); - } - --static inline bool dl_is_constrained(struct sched_dl_entity *dl_se) --{ -- return dl_se->dl_deadline < dl_se->dl_period; --} -- - static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) - { - struct task_struct *pi_task = rt_mutex_get_top_task(p); -@@ -1027,7 +1101,7 @@ static void enqueue_task_dl(struct rq *rq, struct task_struct *p, int flags) - * If that is the case, the task will be throttled and - * the replenishment timer will be set to the next period. - */ -- if (!p->dl.dl_throttled && dl_is_constrained(&p->dl)) -+ if (!p->dl.dl_throttled && !dl_is_implicit(&p->dl)) - dl_check_constrained_dl(&p->dl); - - /* -diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c -index 17f7bcff1e02..323282e63865 100644 ---- a/kernel/time/hrtimer.c -+++ b/kernel/time/hrtimer.c -@@ -312,7 +312,7 @@ EXPORT_SYMBOL_GPL(__ktime_divns); - */ - ktime_t ktime_add_safe(const ktime_t lhs, const ktime_t rhs) - { -- ktime_t res = ktime_add(lhs, rhs); -+ ktime_t res = ktime_add_unsafe(lhs, rhs); - - /* - * We use KTIME_SEC_MAX here, the maximum timeout which we can -@@ -669,7 +669,9 @@ static void hrtimer_reprogram(struct hrtimer *timer, - static inline void hrtimer_init_hres(struct hrtimer_cpu_base *base) - { - base->expires_next.tv64 = KTIME_MAX; -+ base->hang_detected = 0; - base->hres_active = 0; -+ base->next_timer = NULL; - } - - /* -@@ -1615,6 +1617,7 @@ static void init_hrtimers_cpu(int cpu) - timerqueue_init_head(&cpu_base->clock_base[i].active); - } - -+ cpu_base->active_bases = 0; - cpu_base->cpu = cpu; - hrtimer_init_hres(cpu_base); - } -diff --git a/kernel/time/timer.c b/kernel/time/timer.c -index 125407144c01..3d7588a2e97c 100644 ---- a/kernel/time/timer.c -+++ b/kernel/time/timer.c -@@ -764,8 +764,15 @@ static struct tvec_base *lock_timer_base(struct timer_list *timer, - __acquires(timer->base->lock) - { - for (;;) { -- u32 tf = timer->flags; - struct tvec_base *base; -+ u32 tf; -+ -+ /* -+ * We need to use READ_ONCE() here, otherwise the compiler -+ * might re-read @tf between the check for TIMER_MIGRATING -+ * and spin_lock(). -+ */ -+ tf = READ_ONCE(timer->flags); - - if (!(tf & TIMER_MIGRATING)) { - base = per_cpu_ptr(&tvec_bases, tf & TIMER_CPUMASK); -diff --git a/mm/cma.c b/mm/cma.c -index bd0e1412475e..43f4a122e969 100644 ---- a/mm/cma.c -+++ b/mm/cma.c -@@ -54,7 +54,7 @@ unsigned long cma_get_size(const struct cma *cma) - } - - static unsigned long cma_bitmap_aligned_mask(const struct cma *cma, -- int align_order) -+ unsigned int align_order) - { - if (align_order <= cma->order_per_bit) - return 0; -@@ -62,17 +62,14 @@ static unsigned long cma_bitmap_aligned_mask(const struct cma *cma, - } - - /* -- * Find a PFN aligned to the specified order and return an offset represented in -- * order_per_bits. -+ * Find the offset of the base PFN from the specified align_order. -+ * The value returned is represented in order_per_bits. - */ - static unsigned long cma_bitmap_aligned_offset(const struct cma *cma, -- int align_order) -+ unsigned int align_order) - { -- if (align_order <= cma->order_per_bit) -- return 0; -- -- return (ALIGN(cma->base_pfn, (1UL << align_order)) -- - cma->base_pfn) >> cma->order_per_bit; -+ return (cma->base_pfn & ((1UL << align_order) - 1)) -+ >> cma->order_per_bit; - } - - static unsigned long cma_bitmap_pages_to_bits(const struct cma *cma, -diff --git a/mm/memcontrol.c b/mm/memcontrol.c -index e25b93a4267d..55a9facb8e8d 100644 ---- a/mm/memcontrol.c -+++ b/mm/memcontrol.c -@@ -5576,7 +5576,7 @@ static void uncharge_list(struct list_head *page_list) - next = page->lru.next; - - VM_BUG_ON_PAGE(PageLRU(page), page); -- VM_BUG_ON_PAGE(page_count(page), page); -+ VM_BUG_ON_PAGE(!PageHWPoison(page) && page_count(page), page); - - if (!page->mem_cgroup) - continue; -diff --git a/mm/memory-failure.c b/mm/memory-failure.c -index 091fe9b06663..92a647957f91 100644 ---- a/mm/memory-failure.c -+++ b/mm/memory-failure.c -@@ -539,6 +539,13 @@ static int delete_from_lru_cache(struct page *p) - */ - ClearPageActive(p); - ClearPageUnevictable(p); -+ -+ /* -+ * Poisoned page might never drop its ref count to 0 so we have -+ * to uncharge it manually from its memcg. -+ */ -+ mem_cgroup_uncharge(p); -+ - /* - * drop the page count elevated by isolate_lru_page() - */ -diff --git a/mm/mmap.c b/mm/mmap.c -index eaa460ddcaf9..cc84b97ca250 100644 ---- a/mm/mmap.c -+++ b/mm/mmap.c -@@ -2188,7 +2188,8 @@ int expand_upwards(struct vm_area_struct *vma, unsigned long address) - gap_addr = TASK_SIZE; - - next = vma->vm_next; -- if (next && next->vm_start < gap_addr) { -+ if (next && next->vm_start < gap_addr && -+ (next->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { - if (!(next->vm_flags & VM_GROWSUP)) - return -ENOMEM; - /* Check that both stack segments have the same anon_vma? */ -@@ -2273,7 +2274,8 @@ int expand_downwards(struct vm_area_struct *vma, - if (gap_addr > address) - return -ENOMEM; - prev = vma->vm_prev; -- if (prev && prev->vm_end > gap_addr) { -+ if (prev && prev->vm_end > gap_addr && -+ (prev->vm_flags & (VM_WRITE|VM_READ|VM_EXEC))) { - if (!(prev->vm_flags & VM_GROWSDOWN)) - return -ENOMEM; - /* Check that both stack segments have the same anon_vma? */ -diff --git a/net/can/af_can.c b/net/can/af_can.c -index 928f58064098..c866e761651a 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -722,13 +722,12 @@ static int can_rcv(struct sk_buff *skb, struct net_device *dev, - if (unlikely(!net_eq(dev_net(dev), &init_net))) - goto drop; - -- if (WARN_ONCE(dev->type != ARPHRD_CAN || -- skb->len != CAN_MTU || -- cfd->len > CAN_MAX_DLEN, -- "PF_CAN: dropped non conform CAN skbuf: " -- "dev type %d, len %d, datalen %d\n", -- dev->type, skb->len, cfd->len)) -+ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CAN_MTU || -+ cfd->len > CAN_MAX_DLEN)) { -+ pr_warn_once("PF_CAN: dropped non conform CAN skbuf: dev type %d, len %d, datalen %d\n", -+ dev->type, skb->len, cfd->len); - goto drop; -+ } - - can_receive(skb, dev); - return NET_RX_SUCCESS; -@@ -746,13 +745,12 @@ static int canfd_rcv(struct sk_buff *skb, struct net_device *dev, - if (unlikely(!net_eq(dev_net(dev), &init_net))) - goto drop; - -- if (WARN_ONCE(dev->type != ARPHRD_CAN || -- skb->len != CANFD_MTU || -- cfd->len > CANFD_MAX_DLEN, -- "PF_CAN: dropped non conform CAN FD skbuf: " -- "dev type %d, len %d, datalen %d\n", -- dev->type, skb->len, cfd->len)) -+ if (unlikely(dev->type != ARPHRD_CAN || skb->len != CANFD_MTU || -+ cfd->len > CANFD_MAX_DLEN)) { -+ pr_warn_once("PF_CAN: dropped non conform CAN FD skbuf: dev type %d, len %d, datalen %d\n", -+ dev->type, skb->len, cfd->len); - goto drop; -+ } - - can_receive(skb, dev); - return NET_RX_SUCCESS; -diff --git a/net/core/dev.c b/net/core/dev.c -index 3b67c1e5756f..cb58ba15d51e 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -2889,10 +2889,21 @@ static void qdisc_pkt_len_init(struct sk_buff *skb) - hdr_len = skb_transport_header(skb) - skb_mac_header(skb); - - /* + transport layer */ -- if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) -- hdr_len += tcp_hdrlen(skb); -- else -- hdr_len += sizeof(struct udphdr); -+ if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) { -+ const struct tcphdr *th; -+ struct tcphdr _tcphdr; -+ -+ th = skb_header_pointer(skb, skb_transport_offset(skb), -+ sizeof(_tcphdr), &_tcphdr); -+ if (likely(th)) -+ hdr_len += __tcp_hdrlen(th); -+ } else { -+ struct udphdr _udphdr; -+ -+ if (skb_header_pointer(skb, skb_transport_offset(skb), -+ sizeof(_udphdr), &_udphdr)) -+ hdr_len += sizeof(struct udphdr); -+ } - - if (shinfo->gso_type & SKB_GSO_DODGY) - gso_segs = DIV_ROUND_UP(skb->len - hdr_len, -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index ee9082792530..4d14908afaec 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -492,8 +492,8 @@ ip_proto_again: - out_good: - ret = true; - -- key_control->thoff = (u16)nhoff; - out: -+ key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); - key_basic->n_proto = proto; - key_basic->ip_proto = ip_proto; - -@@ -501,7 +501,6 @@ out: - - out_bad: - ret = false; -- key_control->thoff = min_t(u16, nhoff, skb ? skb->len : hlen); - goto out; - } - EXPORT_SYMBOL(__skb_flow_dissect); -diff --git a/net/core/neighbour.c b/net/core/neighbour.c -index ae92131c4f89..253c86b78ff0 100644 ---- a/net/core/neighbour.c -+++ b/net/core/neighbour.c -@@ -496,7 +496,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey, - if (atomic_read(&tbl->entries) > (1 << nht->hash_shift)) - nht = neigh_hash_grow(tbl, nht->hash_shift + 1); - -- hash_val = tbl->hash(pkey, dev, nht->hash_rnd) >> (32 - nht->hash_shift); -+ hash_val = tbl->hash(n->primary_key, dev, nht->hash_rnd) >> (32 - nht->hash_shift); - - if (n->parms->dead) { - rc = ERR_PTR(-EINVAL); -@@ -508,7 +508,7 @@ struct neighbour *__neigh_create(struct neigh_table *tbl, const void *pkey, - n1 != NULL; - n1 = rcu_dereference_protected(n1->next, - lockdep_is_held(&tbl->lock))) { -- if (dev == n1->dev && !memcmp(n1->primary_key, pkey, key_len)) { -+ if (dev == n1->dev && !memcmp(n1->primary_key, n->primary_key, key_len)) { - if (want_ref) - neigh_hold(n1); - rc = n1; -diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c -index 5e3a7302f774..7753681195c1 100644 ---- a/net/dccp/ccids/ccid2.c -+++ b/net/dccp/ccids/ccid2.c -@@ -140,6 +140,9 @@ static void ccid2_hc_tx_rto_expire(unsigned long data) - - ccid2_pr_debug("RTO_EXPIRE\n"); - -+ if (sk->sk_state == DCCP_CLOSED) -+ goto out; -+ - /* back-off timer */ - hc->tx_rto <<= 1; - if (hc->tx_rto > DCCP_RTO_MAX) -diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c -index 711b4dfa17c3..cb5eb649ad5f 100644 ---- a/net/ipv4/arp.c -+++ b/net/ipv4/arp.c -@@ -223,11 +223,16 @@ static bool arp_key_eq(const struct neighbour *neigh, const void *pkey) - - static int arp_constructor(struct neighbour *neigh) - { -- __be32 addr = *(__be32 *)neigh->primary_key; -+ __be32 addr; - struct net_device *dev = neigh->dev; - struct in_device *in_dev; - struct neigh_parms *parms; -+ u32 inaddr_any = INADDR_ANY; - -+ if (dev->flags & (IFF_LOOPBACK | IFF_POINTOPOINT)) -+ memcpy(neigh->primary_key, &inaddr_any, arp_tbl.key_len); -+ -+ addr = *(__be32 *)neigh->primary_key; - rcu_read_lock(); - in_dev = __in_dev_get_rcu(dev); - if (!in_dev) { -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index b60106d34346..8212ed80da48 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -338,7 +338,7 @@ static __be32 igmpv3_get_srcaddr(struct net_device *dev, - return htonl(INADDR_ANY); - - for_ifa(in_dev) { -- if (inet_ifa_match(fl4->saddr, ifa)) -+ if (fl4->saddr == ifa->ifa_local) - return fl4->saddr; - } endfor_ifa(in_dev); - -diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c -index 6e3e0e8b1ce3..4cfcc22f7430 100644 ---- a/net/ipv4/netfilter/arp_tables.c -+++ b/net/ipv4/netfilter/arp_tables.c -@@ -367,23 +367,12 @@ static inline bool unconditional(const struct arpt_entry *e) - memcmp(&e->arp, &uncond, sizeof(uncond)) == 0; - } - --static bool find_jump_target(const struct xt_table_info *t, -- const struct arpt_entry *target) --{ -- struct arpt_entry *iter; -- -- xt_entry_foreach(iter, t->entries, t->size) { -- if (iter == target) -- return true; -- } -- return false; --} -- - /* Figures out from what hook each rule can be called: returns 0 if - * there are loops. Puts hook bitmask in comefrom. - */ - static int mark_source_chains(const struct xt_table_info *newinfo, -- unsigned int valid_hooks, void *entry0) -+ unsigned int valid_hooks, void *entry0, -+ unsigned int *offsets) - { - unsigned int hook; - -@@ -472,10 +461,11 @@ static int mark_source_chains(const struct xt_table_info *newinfo, - /* This a jump; chase it. */ - duprintf("Jump rule %u -> %u\n", - pos, newpos); -+ if (!xt_find_jump_offset(offsets, newpos, -+ newinfo->number)) -+ return 0; - e = (struct arpt_entry *) - (entry0 + newpos); -- if (!find_jump_target(newinfo, e)) -- return 0; - } else { - /* ... this is a fallthru */ - newpos = pos + e->next_offset; -@@ -521,11 +511,13 @@ find_check_entry(struct arpt_entry *e, const char *name, unsigned int size) - { - struct xt_entry_target *t; - struct xt_target *target; -+ unsigned long pcnt; - int ret; - -- e->counters.pcnt = xt_percpu_counter_alloc(); -- if (IS_ERR_VALUE(e->counters.pcnt)) -+ pcnt = xt_percpu_counter_alloc(); -+ if (IS_ERR_VALUE(pcnt)) - return -ENOMEM; -+ e->counters.pcnt = pcnt; - - t = arpt_get_target(e); - target = xt_request_find_target(NFPROTO_ARP, t->u.user.name, -@@ -642,6 +634,7 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - const struct arpt_replace *repl) - { - struct arpt_entry *iter; -+ unsigned int *offsets; - unsigned int i; - int ret = 0; - -@@ -655,6 +648,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - } - - duprintf("translate_table: size %u\n", newinfo->size); -+ offsets = xt_alloc_entry_offsets(newinfo->number); -+ if (!offsets) -+ return -ENOMEM; - i = 0; - - /* Walk through entries, checking offsets. */ -@@ -665,7 +661,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - repl->underflow, - repl->valid_hooks); - if (ret != 0) -- break; -+ goto out_free; -+ if (i < repl->num_entries) -+ offsets[i] = (void *)iter - entry0; - ++i; - if (strcmp(arpt_get_target(iter)->u.user.name, - XT_ERROR_TARGET) == 0) -@@ -673,12 +671,13 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - } - duprintf("translate_table: ARPT_ENTRY_ITERATE gives %d\n", ret); - if (ret != 0) -- return ret; -+ goto out_free; - -+ ret = -EINVAL; - if (i != repl->num_entries) { - duprintf("translate_table: %u not %u entries\n", - i, repl->num_entries); -- return -EINVAL; -+ goto out_free; - } - - /* Check hooks all assigned */ -@@ -689,17 +688,20 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - if (newinfo->hook_entry[i] == 0xFFFFFFFF) { - duprintf("Invalid hook entry %u %u\n", - i, repl->hook_entry[i]); -- return -EINVAL; -+ goto out_free; - } - if (newinfo->underflow[i] == 0xFFFFFFFF) { - duprintf("Invalid underflow %u %u\n", - i, repl->underflow[i]); -- return -EINVAL; -+ goto out_free; - } - } - -- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) -- return -ELOOP; -+ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) { -+ ret = -ELOOP; -+ goto out_free; -+ } -+ kvfree(offsets); - - /* Finally, each sanity check must pass */ - i = 0; -@@ -719,6 +721,9 @@ static int translate_table(struct xt_table_info *newinfo, void *entry0, - return ret; - } - -+ return ret; -+ out_free: -+ kvfree(offsets); - return ret; - } - -@@ -1336,8 +1341,8 @@ static int translate_compat_table(struct xt_table_info **pinfo, - - newinfo->number = compatr->num_entries; - for (i = 0; i < NF_ARP_NUMHOOKS; i++) { -- newinfo->hook_entry[i] = info->hook_entry[i]; -- newinfo->underflow[i] = info->underflow[i]; -+ newinfo->hook_entry[i] = compatr->hook_entry[i]; -+ newinfo->underflow[i] = compatr->underflow[i]; - } - entry1 = newinfo->entries; - pos = entry1; -diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c -index a399c5419622..a98173d1ea97 100644 ---- a/net/ipv4/netfilter/ip_tables.c -+++ b/net/ipv4/netfilter/ip_tables.c -@@ -443,23 +443,12 @@ ipt_do_table(struct sk_buff *skb, - #endif - } - --static bool find_jump_target(const struct xt_table_info *t, -- const struct ipt_entry *target) --{ -- struct ipt_entry *iter; -- -- xt_entry_foreach(iter, t->entries, t->size) { -- if (iter == target) -- return true; -- } -- return false; --} -- - /* Figures out from what hook each rule can be called: returns 0 if - there are loops. Puts hook bitmask in comefrom. */ - static int - mark_source_chains(const struct xt_table_info *newinfo, -- unsigned int valid_hooks, void *entry0) -+ unsigned int valid_hooks, void *entry0, -+ unsigned int *offsets) - { - unsigned int hook; - -@@ -552,10 +541,11 @@ mark_source_chains(const struct xt_table_info *newinfo, - /* This a jump; chase it. */ - duprintf("Jump rule %u -> %u\n", - pos, newpos); -+ if (!xt_find_jump_offset(offsets, newpos, -+ newinfo->number)) -+ return 0; - e = (struct ipt_entry *) - (entry0 + newpos); -- if (!find_jump_target(newinfo, e)) -- return 0; - } else { - /* ... this is a fallthru */ - newpos = pos + e->next_offset; -@@ -663,10 +653,12 @@ find_check_entry(struct ipt_entry *e, struct net *net, const char *name, - unsigned int j; - struct xt_mtchk_param mtpar; - struct xt_entry_match *ematch; -+ unsigned long pcnt; - -- e->counters.pcnt = xt_percpu_counter_alloc(); -- if (IS_ERR_VALUE(e->counters.pcnt)) -+ pcnt = xt_percpu_counter_alloc(); -+ if (IS_ERR_VALUE(pcnt)) - return -ENOMEM; -+ e->counters.pcnt = pcnt; - - j = 0; - mtpar.net = net; -@@ -811,6 +803,7 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - const struct ipt_replace *repl) - { - struct ipt_entry *iter; -+ unsigned int *offsets; - unsigned int i; - int ret = 0; - -@@ -824,6 +817,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - } - - duprintf("translate_table: size %u\n", newinfo->size); -+ offsets = xt_alloc_entry_offsets(newinfo->number); -+ if (!offsets) -+ return -ENOMEM; - i = 0; - /* Walk through entries, checking offsets. */ - xt_entry_foreach(iter, entry0, newinfo->size) { -@@ -833,17 +829,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - repl->underflow, - repl->valid_hooks); - if (ret != 0) -- return ret; -+ goto out_free; -+ if (i < repl->num_entries) -+ offsets[i] = (void *)iter - entry0; - ++i; - if (strcmp(ipt_get_target(iter)->u.user.name, - XT_ERROR_TARGET) == 0) - ++newinfo->stacksize; - } - -+ ret = -EINVAL; - if (i != repl->num_entries) { - duprintf("translate_table: %u not %u entries\n", - i, repl->num_entries); -- return -EINVAL; -+ goto out_free; - } - - /* Check hooks all assigned */ -@@ -854,17 +853,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - if (newinfo->hook_entry[i] == 0xFFFFFFFF) { - duprintf("Invalid hook entry %u %u\n", - i, repl->hook_entry[i]); -- return -EINVAL; -+ goto out_free; - } - if (newinfo->underflow[i] == 0xFFFFFFFF) { - duprintf("Invalid underflow %u %u\n", - i, repl->underflow[i]); -- return -EINVAL; -+ goto out_free; - } - } - -- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) -- return -ELOOP; -+ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) { -+ ret = -ELOOP; -+ goto out_free; -+ } -+ kvfree(offsets); - - /* Finally, each sanity check must pass */ - i = 0; -@@ -884,6 +886,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - return ret; - } - -+ return ret; -+ out_free: -+ kvfree(offsets); - return ret; - } - -diff --git a/net/ipv4/netfilter/nf_reject_ipv4.c b/net/ipv4/netfilter/nf_reject_ipv4.c -index c747b2d9eb77..d4acf38b60fd 100644 ---- a/net/ipv4/netfilter/nf_reject_ipv4.c -+++ b/net/ipv4/netfilter/nf_reject_ipv4.c -@@ -124,6 +124,8 @@ void nf_send_reset(struct net *net, struct sk_buff *oldskb, int hook) - /* ip_route_me_harder expects skb->dst to be set */ - skb_dst_set_noref(nskb, skb_dst(oldskb)); - -+ nskb->mark = IP4_REPLY_MARK(net, oldskb->mark); -+ - skb_reserve(nskb, LL_MAX_HEADER); - niph = nf_reject_iphdr_put(nskb, oldskb, IPPROTO_TCP, - ip4_dst_hoplimit(skb_dst(nskb))); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 5597120c8ffd..37e8966a457b 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2176,6 +2176,9 @@ adjudge_to_death: - tcp_send_active_reset(sk, GFP_ATOMIC); - NET_INC_STATS_BH(sock_net(sk), - LINUX_MIB_TCPABORTONMEMORY); -+ } else if (!check_net(sock_net(sk))) { -+ /* Not possible to send reset; just close */ -+ tcp_set_state(sk, TCP_CLOSE); - } - } - -diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c -index 1ec12a4f327e..35f638cfc675 100644 ---- a/net/ipv4/tcp_timer.c -+++ b/net/ipv4/tcp_timer.c -@@ -46,11 +46,19 @@ static void tcp_write_err(struct sock *sk) - * to prevent DoS attacks. It is called when a retransmission timeout - * or zero probe timeout occurs on orphaned socket. - * -+ * Also close if our net namespace is exiting; in that case there is no -+ * hope of ever communicating again since all netns interfaces are already -+ * down (or about to be down), and we need to release our dst references, -+ * which have been moved to the netns loopback interface, so the namespace -+ * can finish exiting. This condition is only possible if we are a kernel -+ * socket, as those do not hold references to the namespace. -+ * - * Criteria is still not confirmed experimentally and may change. - * We kill the socket, if: - * 1. If number of orphaned sockets exceeds an administratively configured - * limit. - * 2. If we have strong memory pressure. -+ * 3. If our net namespace is exiting. - */ - static int tcp_out_of_resources(struct sock *sk, bool do_reset) - { -@@ -79,6 +87,13 @@ static int tcp_out_of_resources(struct sock *sk, bool do_reset) - NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPABORTONMEMORY); - return 1; - } -+ -+ if (!check_net(sock_net(sk))) { -+ /* Not possible to send reset; just close */ -+ tcp_done(sk); -+ return 1; -+ } -+ - return 0; - } - -diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c -index b809958f7388..3ef81c387923 100644 ---- a/net/ipv6/ip6_output.c -+++ b/net/ipv6/ip6_output.c -@@ -148,7 +148,7 @@ int ip6_output(struct net *net, struct sock *sk, struct sk_buff *skb) - !(IP6CB(skb)->flags & IP6SKB_REROUTED)); - } - --static bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) -+bool ip6_autoflowlabel(struct net *net, const struct ipv6_pinfo *np) - { - if (!np->autoflowlabel_set) - return ip6_default_np_autolabel(net); -@@ -1246,14 +1246,16 @@ static int ip6_setup_cork(struct sock *sk, struct inet_cork_full *cork, - v6_cork->tclass = tclass; - if (rt->dst.flags & DST_XFRM_TUNNEL) - mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? -- rt->dst.dev->mtu : dst_mtu(&rt->dst); -+ READ_ONCE(rt->dst.dev->mtu) : dst_mtu(&rt->dst); - else - mtu = np->pmtudisc >= IPV6_PMTUDISC_PROBE ? -- rt->dst.dev->mtu : dst_mtu(rt->dst.path); -+ READ_ONCE(rt->dst.dev->mtu) : dst_mtu(rt->dst.path); - if (np->frag_size < mtu) { - if (np->frag_size) - mtu = np->frag_size; - } -+ if (mtu < IPV6_MIN_MTU) -+ return -EINVAL; - cork->base.fragsize = mtu; - if (dst_allfrag(rt->dst.path)) - cork->base.flags |= IPCORK_ALLFRAG; -@@ -1783,6 +1785,7 @@ struct sk_buff *ip6_make_skb(struct sock *sk, - cork.base.flags = 0; - cork.base.addr = 0; - cork.base.opt = NULL; -+ cork.base.dst = NULL; - v6_cork.opt = NULL; - err = ip6_setup_cork(sk, &cork, &v6_cork, hlimit, tclass, opt, rt, fl6); - if (err) { -diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c -index 435e26210587..9011176c8387 100644 ---- a/net/ipv6/ipv6_sockglue.c -+++ b/net/ipv6/ipv6_sockglue.c -@@ -1313,7 +1313,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname, - break; - - case IPV6_AUTOFLOWLABEL: -- val = np->autoflowlabel; -+ val = ip6_autoflowlabel(sock_net(sk), np); - break; - - default: -diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c -index 22f39e00bef3..bb1b5453a7a1 100644 ---- a/net/ipv6/netfilter/ip6_tables.c -+++ b/net/ipv6/netfilter/ip6_tables.c -@@ -455,23 +455,12 @@ ip6t_do_table(struct sk_buff *skb, - #endif - } - --static bool find_jump_target(const struct xt_table_info *t, -- const struct ip6t_entry *target) --{ -- struct ip6t_entry *iter; -- -- xt_entry_foreach(iter, t->entries, t->size) { -- if (iter == target) -- return true; -- } -- return false; --} -- - /* Figures out from what hook each rule can be called: returns 0 if - there are loops. Puts hook bitmask in comefrom. */ - static int - mark_source_chains(const struct xt_table_info *newinfo, -- unsigned int valid_hooks, void *entry0) -+ unsigned int valid_hooks, void *entry0, -+ unsigned int *offsets) - { - unsigned int hook; - -@@ -564,10 +553,11 @@ mark_source_chains(const struct xt_table_info *newinfo, - /* This a jump; chase it. */ - duprintf("Jump rule %u -> %u\n", - pos, newpos); -+ if (!xt_find_jump_offset(offsets, newpos, -+ newinfo->number)) -+ return 0; - e = (struct ip6t_entry *) - (entry0 + newpos); -- if (!find_jump_target(newinfo, e)) -- return 0; - } else { - /* ... this is a fallthru */ - newpos = pos + e->next_offset; -@@ -676,10 +666,12 @@ find_check_entry(struct ip6t_entry *e, struct net *net, const char *name, - unsigned int j; - struct xt_mtchk_param mtpar; - struct xt_entry_match *ematch; -+ unsigned long pcnt; - -- e->counters.pcnt = xt_percpu_counter_alloc(); -- if (IS_ERR_VALUE(e->counters.pcnt)) -+ pcnt = xt_percpu_counter_alloc(); -+ if (IS_ERR_VALUE(pcnt)) - return -ENOMEM; -+ e->counters.pcnt = pcnt; - - j = 0; - mtpar.net = net; -@@ -823,6 +815,7 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - const struct ip6t_replace *repl) - { - struct ip6t_entry *iter; -+ unsigned int *offsets; - unsigned int i; - int ret = 0; - -@@ -836,6 +829,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - } - - duprintf("translate_table: size %u\n", newinfo->size); -+ offsets = xt_alloc_entry_offsets(newinfo->number); -+ if (!offsets) -+ return -ENOMEM; - i = 0; - /* Walk through entries, checking offsets. */ - xt_entry_foreach(iter, entry0, newinfo->size) { -@@ -845,17 +841,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - repl->underflow, - repl->valid_hooks); - if (ret != 0) -- return ret; -+ goto out_free; -+ if (i < repl->num_entries) -+ offsets[i] = (void *)iter - entry0; - ++i; - if (strcmp(ip6t_get_target(iter)->u.user.name, - XT_ERROR_TARGET) == 0) - ++newinfo->stacksize; - } - -+ ret = -EINVAL; - if (i != repl->num_entries) { - duprintf("translate_table: %u not %u entries\n", - i, repl->num_entries); -- return -EINVAL; -+ goto out_free; - } - - /* Check hooks all assigned */ -@@ -866,17 +865,20 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - if (newinfo->hook_entry[i] == 0xFFFFFFFF) { - duprintf("Invalid hook entry %u %u\n", - i, repl->hook_entry[i]); -- return -EINVAL; -+ goto out_free; - } - if (newinfo->underflow[i] == 0xFFFFFFFF) { - duprintf("Invalid underflow %u %u\n", - i, repl->underflow[i]); -- return -EINVAL; -+ goto out_free; - } - } - -- if (!mark_source_chains(newinfo, repl->valid_hooks, entry0)) -- return -ELOOP; -+ if (!mark_source_chains(newinfo, repl->valid_hooks, entry0, offsets)) { -+ ret = -ELOOP; -+ goto out_free; -+ } -+ kvfree(offsets); - - /* Finally, each sanity check must pass */ - i = 0; -@@ -896,6 +898,9 @@ translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0, - return ret; - } - -+ return ret; -+ out_free: -+ kvfree(offsets); - return ret; - } - -diff --git a/net/ipv6/netfilter/nf_dup_ipv6.c b/net/ipv6/netfilter/nf_dup_ipv6.c -index 6989c70ae29f..4a84b5ad9ecb 100644 ---- a/net/ipv6/netfilter/nf_dup_ipv6.c -+++ b/net/ipv6/netfilter/nf_dup_ipv6.c -@@ -33,6 +33,7 @@ static bool nf_dup_ipv6_route(struct net *net, struct sk_buff *skb, - fl6.daddr = *gw; - fl6.flowlabel = (__force __be32)(((iph->flow_lbl[0] & 0xF) << 16) | - (iph->flow_lbl[1] << 8) | iph->flow_lbl[2]); -+ fl6.flowi6_flags = FLOWI_FLAG_KNOWN_NH; - dst = ip6_route_output(net, NULL, &fl6); - if (dst->error) { - dst_release(dst); -diff --git a/net/ipv6/netfilter/nf_reject_ipv6.c b/net/ipv6/netfilter/nf_reject_ipv6.c -index e0f922b777e3..7117e5bef412 100644 ---- a/net/ipv6/netfilter/nf_reject_ipv6.c -+++ b/net/ipv6/netfilter/nf_reject_ipv6.c -@@ -157,6 +157,7 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) - fl6.daddr = oip6h->saddr; - fl6.fl6_sport = otcph->dest; - fl6.fl6_dport = otcph->source; -+ fl6.flowi6_mark = IP6_REPLY_MARK(net, oldskb->mark); - security_skb_classify_flow(oldskb, flowi6_to_flowi(&fl6)); - dst = ip6_route_output(net, NULL, &fl6); - if (dst == NULL || dst->error) { -@@ -180,6 +181,8 @@ void nf_send_reset6(struct net *net, struct sk_buff *oldskb, int hook) - - skb_dst_set(nskb, dst); - -+ nskb->mark = fl6.flowi6_mark; -+ - skb_reserve(nskb, hh_len + dst->header_len); - ip6h = nf_reject_ip6hdr_put(nskb, oldskb, IPPROTO_TCP, - ip6_dst_hoplimit(dst)); -diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 86a3c6f0c871..5f747089024f 100644 ---- a/net/netfilter/nf_conntrack_core.c -+++ b/net/netfilter/nf_conntrack_core.c -@@ -719,6 +719,7 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, - * least once for the stats anyway. - */ - rcu_read_lock_bh(); -+ begin: - hlist_nulls_for_each_entry_rcu(h, n, &net->ct.hash[hash], hnnode) { - ct = nf_ct_tuplehash_to_ctrack(h); - if (ct != ignored_conntrack && -@@ -730,6 +731,12 @@ nf_conntrack_tuple_taken(const struct nf_conntrack_tuple *tuple, - } - NF_CT_STAT_INC(net, searched); - } -+ -+ if (get_nulls_value(n) != hash) { -+ NF_CT_STAT_INC(net, search_restart); -+ goto begin; -+ } -+ - rcu_read_unlock_bh(); - - return 0; -diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c -index 7f16d19d6198..a91f8bd51d05 100644 ---- a/net/netfilter/nf_conntrack_expect.c -+++ b/net/netfilter/nf_conntrack_expect.c -@@ -560,7 +560,7 @@ static int exp_seq_show(struct seq_file *s, void *v) - helper = rcu_dereference(nfct_help(expect->master)->helper); - if (helper) { - seq_printf(s, "%s%s", expect->flags ? " " : "", helper->name); -- if (helper->expect_policy[expect->class].name) -+ if (helper->expect_policy[expect->class].name[0]) - seq_printf(s, "/%s", - helper->expect_policy[expect->class].name); - } -diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c -index 885b4aba3695..1665c2159e4b 100644 ---- a/net/netfilter/nf_conntrack_sip.c -+++ b/net/netfilter/nf_conntrack_sip.c -@@ -1434,9 +1434,12 @@ static int process_sip_request(struct sk_buff *skb, unsigned int protoff, - handler = &sip_handlers[i]; - if (handler->request == NULL) - continue; -- if (*datalen < handler->len || -+ if (*datalen < handler->len + 2 || - strncasecmp(*dptr, handler->method, handler->len)) - continue; -+ if ((*dptr)[handler->len] != ' ' || -+ !isalpha((*dptr)[handler->len+1])) -+ continue; - - if (ct_sip_get_header(ct, *dptr, 0, *datalen, SIP_HDR_CSEQ, - &matchoff, &matchlen) <= 0) { -diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c -index 8d34a488efc0..ac143ae4f7b6 100644 ---- a/net/netfilter/nfnetlink_cthelper.c -+++ b/net/netfilter/nfnetlink_cthelper.c -@@ -17,6 +17,7 @@ - #include - #include - #include -+#include - #include - #include - -@@ -392,6 +393,9 @@ nfnl_cthelper_new(struct sock *nfnl, struct sk_buff *skb, - struct nfnl_cthelper *nlcth; - int ret = 0; - -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ - if (!tb[NFCTH_NAME] || !tb[NFCTH_TUPLE]) - return -EINVAL; - -@@ -595,6 +599,9 @@ nfnl_cthelper_get(struct sock *nfnl, struct sk_buff *skb, - struct nfnl_cthelper *nlcth; - bool tuple_set = false; - -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ - if (nlh->nlmsg_flags & NLM_F_DUMP) { - struct netlink_dump_control c = { - .dump = nfnl_cthelper_dump_table, -@@ -661,6 +668,9 @@ nfnl_cthelper_del(struct sock *nfnl, struct sk_buff *skb, - struct nfnl_cthelper *nlcth, *n; - int j = 0, ret; - -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ - if (tb[NFCTH_NAME]) - helper_name = nla_data(tb[NFCTH_NAME]); - -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index f6837f9b6d6c..c14d2e8eaec3 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -1053,10 +1053,8 @@ nfqnl_recv_verdict(struct sock *ctnl, struct sk_buff *skb, - struct net *net = sock_net(ctnl); - struct nfnl_queue_net *q = nfnl_queue_pernet(net); - -- queue = instance_lookup(q, queue_num); -- if (!queue) -- queue = verdict_instance_lookup(q, queue_num, -- NETLINK_CB(skb).portid); -+ queue = verdict_instance_lookup(q, queue_num, -+ NETLINK_CB(skb).portid); - if (IS_ERR(queue)) - return PTR_ERR(queue); - -diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c -index 2fc6ca9d1286..7b42b0ad3f9b 100644 ---- a/net/netfilter/x_tables.c -+++ b/net/netfilter/x_tables.c -@@ -701,6 +701,56 @@ int xt_check_entry_offsets(const void *base, - } - EXPORT_SYMBOL(xt_check_entry_offsets); - -+/** -+ * xt_alloc_entry_offsets - allocate array to store rule head offsets -+ * -+ * @size: number of entries -+ * -+ * Return: NULL or kmalloc'd or vmalloc'd array -+ */ -+unsigned int *xt_alloc_entry_offsets(unsigned int size) -+{ -+ unsigned int *off; -+ -+ off = kcalloc(size, sizeof(unsigned int), GFP_KERNEL | __GFP_NOWARN); -+ -+ if (off) -+ return off; -+ -+ if (size < (SIZE_MAX / sizeof(unsigned int))) -+ off = vmalloc(size * sizeof(unsigned int)); -+ -+ return off; -+} -+EXPORT_SYMBOL(xt_alloc_entry_offsets); -+ -+/** -+ * xt_find_jump_offset - check if target is a valid jump offset -+ * -+ * @offsets: array containing all valid rule start offsets of a rule blob -+ * @target: the jump target to search for -+ * @size: entries in @offset -+ */ -+bool xt_find_jump_offset(const unsigned int *offsets, -+ unsigned int target, unsigned int size) -+{ -+ int m, low = 0, hi = size; -+ -+ while (hi > low) { -+ m = (low + hi) / 2u; -+ -+ if (offsets[m] > target) -+ hi = m; -+ else if (offsets[m] < target) -+ low = m + 1; -+ else -+ return true; -+ } -+ -+ return false; -+} -+EXPORT_SYMBOL(xt_find_jump_offset); -+ - int xt_check_target(struct xt_tgchk_param *par, - unsigned int size, u_int8_t proto, bool inv_proto) - { -diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c -index df8801e02a32..7eae0d0af89a 100644 ---- a/net/netfilter/xt_osf.c -+++ b/net/netfilter/xt_osf.c -@@ -19,6 +19,7 @@ - #include - #include - -+#include - #include - #include - #include -@@ -69,6 +70,9 @@ static int xt_osf_add_callback(struct sock *ctnl, struct sk_buff *skb, - struct xt_osf_finger *kf = NULL, *sf; - int err = 0; - -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ - if (!osf_attrs[OSF_ATTR_FINGER]) - return -EINVAL; - -@@ -112,6 +116,9 @@ static int xt_osf_remove_callback(struct sock *ctnl, struct sk_buff *skb, - struct xt_osf_finger *sf; - int err = -ENOENT; - -+ if (!capable(CAP_NET_ADMIN)) -+ return -EPERM; -+ - if (!osf_attrs[OSF_ATTR_FINGER]) - return -EINVAL; - -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index a870d27ca778..e9851198a850 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -83,7 +83,7 @@ - static int sctp_writeable(struct sock *sk); - static void sctp_wfree(struct sk_buff *skb); - static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -- size_t msg_len, struct sock **orig_sk); -+ size_t msg_len); - static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p); - static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p); - static int sctp_wait_for_accept(struct sock *sk, long timeo); -@@ -332,16 +332,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, - if (len < sizeof (struct sockaddr)) - return NULL; - -+ if (!opt->pf->af_supported(addr->sa.sa_family, opt)) -+ return NULL; -+ - /* V4 mapped address are really of AF_INET family */ - if (addr->sa.sa_family == AF_INET6 && -- ipv6_addr_v4mapped(&addr->v6.sin6_addr)) { -- if (!opt->pf->af_supported(AF_INET, opt)) -- return NULL; -- } else { -- /* Does this PF support this AF? */ -- if (!opt->pf->af_supported(addr->sa.sa_family, opt)) -- return NULL; -- } -+ ipv6_addr_v4mapped(&addr->v6.sin6_addr) && -+ !opt->pf->af_supported(AF_INET, opt)) -+ return NULL; - - /* If we get this far, af is valid. */ - af = sctp_get_af_specific(addr->sa.sa_family); -@@ -1954,7 +1952,7 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) - timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT); - if (!sctp_wspace(asoc)) { - /* sk can be changed by peel off when waiting for buf. */ -- err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk); -+ err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len); - if (err) { - if (err == -ESRCH) { - /* asoc is already dead. */ -@@ -6976,12 +6974,12 @@ void sctp_sock_rfree(struct sk_buff *skb) - - /* Helper function to wait for space in the sndbuf. */ - static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, -- size_t msg_len, struct sock **orig_sk) -+ size_t msg_len) - { - struct sock *sk = asoc->base.sk; -- int err = 0; - long current_timeo = *timeo_p; - DEFINE_WAIT(wait); -+ int err = 0; - - pr_debug("%s: asoc:%p, timeo:%ld, msg_len:%zu\n", __func__, asoc, - *timeo_p, msg_len); -@@ -7010,17 +7008,13 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - release_sock(sk); - current_timeo = schedule_timeout(current_timeo); - lock_sock(sk); -- if (sk != asoc->base.sk) { -- release_sock(sk); -- sk = asoc->base.sk; -- lock_sock(sk); -- } -+ if (sk != asoc->base.sk) -+ goto do_error; - - *timeo_p = current_timeo; - } - - out: -- *orig_sk = sk; - finish_wait(&asoc->wait, &wait); - - /* Release the association's refcnt. */ -diff --git a/tools/usb/usbip/libsrc/usbip_common.c b/tools/usb/usbip/libsrc/usbip_common.c -index ac73710473de..8000445ff884 100644 ---- a/tools/usb/usbip/libsrc/usbip_common.c -+++ b/tools/usb/usbip/libsrc/usbip_common.c -@@ -215,9 +215,16 @@ int read_usb_interface(struct usbip_usb_device *udev, int i, - struct usbip_usb_interface *uinf) - { - char busid[SYSFS_BUS_ID_SIZE]; -+ int size; - struct udev_device *sif; - -- sprintf(busid, "%s:%d.%d", udev->busid, udev->bConfigurationValue, i); -+ size = snprintf(busid, sizeof(busid), "%s:%d.%d", -+ udev->busid, udev->bConfigurationValue, i); -+ if (size < 0 || (unsigned int)size >= sizeof(busid)) { -+ err("busid length %i >= %lu or < 0", size, -+ (unsigned long)sizeof(busid)); -+ return -1; -+ } - - sif = udev_device_new_from_subsystem_sysname(udev_context, "usb", busid); - if (!sif) { -diff --git a/tools/usb/usbip/libsrc/usbip_host_driver.c b/tools/usb/usbip/libsrc/usbip_host_driver.c -index bef08d5c44e8..071b9ce99420 100644 ---- a/tools/usb/usbip/libsrc/usbip_host_driver.c -+++ b/tools/usb/usbip/libsrc/usbip_host_driver.c -@@ -39,13 +39,19 @@ struct udev *udev_context; - static int32_t read_attr_usbip_status(struct usbip_usb_device *udev) - { - char status_attr_path[SYSFS_PATH_MAX]; -+ int size; - int fd; - int length; - char status; - int value = 0; - -- snprintf(status_attr_path, SYSFS_PATH_MAX, "%s/usbip_status", -- udev->path); -+ size = snprintf(status_attr_path, SYSFS_PATH_MAX, "%s/usbip_status", -+ udev->path); -+ if (size < 0 || (unsigned int)size >= sizeof(status_attr_path)) { -+ err("usbip_status path length %i >= %lu or < 0", size, -+ (unsigned long)sizeof(status_attr_path)); -+ return -1; -+ } - - fd = open(status_attr_path, O_RDONLY); - if (fd < 0) { -@@ -225,6 +231,7 @@ int usbip_host_export_device(struct usbip_exported_device *edev, int sockfd) - { - char attr_name[] = "usbip_sockfd"; - char sockfd_attr_path[SYSFS_PATH_MAX]; -+ int size; - char sockfd_buff[30]; - int ret; - -@@ -244,10 +251,20 @@ int usbip_host_export_device(struct usbip_exported_device *edev, int sockfd) - } - - /* only the first interface is true */ -- snprintf(sockfd_attr_path, sizeof(sockfd_attr_path), "%s/%s", -- edev->udev.path, attr_name); -+ size = snprintf(sockfd_attr_path, sizeof(sockfd_attr_path), "%s/%s", -+ edev->udev.path, attr_name); -+ if (size < 0 || (unsigned int)size >= sizeof(sockfd_attr_path)) { -+ err("exported device path length %i >= %lu or < 0", size, -+ (unsigned long)sizeof(sockfd_attr_path)); -+ return -1; -+ } - -- snprintf(sockfd_buff, sizeof(sockfd_buff), "%d\n", sockfd); -+ size = snprintf(sockfd_buff, sizeof(sockfd_buff), "%d\n", sockfd); -+ if (size < 0 || (unsigned int)size >= sizeof(sockfd_buff)) { -+ err("socket length %i >= %lu or < 0", size, -+ (unsigned long)sizeof(sockfd_buff)); -+ return -1; -+ } - - ret = write_sysfs_attribute(sockfd_attr_path, sockfd_buff, - strlen(sockfd_buff)); -diff --git a/tools/usb/usbip/libsrc/vhci_driver.c b/tools/usb/usbip/libsrc/vhci_driver.c -index ad9204773533..1274f326242c 100644 ---- a/tools/usb/usbip/libsrc/vhci_driver.c -+++ b/tools/usb/usbip/libsrc/vhci_driver.c -@@ -55,12 +55,12 @@ static int parse_status(const char *value) - - while (*c != '\0') { - int port, status, speed, devid; -- unsigned long socket; -+ int sockfd; - char lbusid[SYSFS_BUS_ID_SIZE]; - -- ret = sscanf(c, "%d %d %d %x %lx %31s\n", -+ ret = sscanf(c, "%d %d %d %x %u %31s\n", - &port, &status, &speed, -- &devid, &socket, lbusid); -+ &devid, &sockfd, lbusid); - - if (ret < 5) { - dbg("sscanf failed: %d", ret); -@@ -69,7 +69,7 @@ static int parse_status(const char *value) - - dbg("port %d status %d speed %d devid %x", - port, status, speed, devid); -- dbg("socket %lx lbusid %s", socket, lbusid); -+ dbg("sockfd %u lbusid %s", sockfd, lbusid); - - - /* if a device is connected, look at it */ -diff --git a/tools/usb/usbip/src/usbip.c b/tools/usb/usbip/src/usbip.c -index d7599d943529..73d8eee8130b 100644 ---- a/tools/usb/usbip/src/usbip.c -+++ b/tools/usb/usbip/src/usbip.c -@@ -176,6 +176,8 @@ int main(int argc, char *argv[]) - break; - case '?': - printf("usbip: invalid option\n"); -+ /* Terminate after printing error */ -+ /* FALLTHRU */ - default: - usbip_usage(); - goto out; diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.114-115.patch b/patch/kernel/mvebu64-default/04-patch-4.4.114-115.patch deleted file mode 100644 index 998f06247c57..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.114-115.patch +++ /dev/null @@ -1,1942 +0,0 @@ -diff --git a/Makefile b/Makefile -index 153440b1bbb0..9c60120dd9fd 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 114 -+SUBLEVEL = 115 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 14cdc6dea493..83af36d9439f 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -54,6 +54,7 @@ config ARM64 - select HAVE_ARCH_SECCOMP_FILTER - select HAVE_ARCH_TRACEHOOK - select HAVE_BPF_JIT -+ select HAVE_EBPF_JIT - select HAVE_C_RECORDMCOUNT - select HAVE_CC_STACKPROTECTOR - select HAVE_CMPXCHG_DOUBLE -diff --git a/arch/s390/Kconfig b/arch/s390/Kconfig -index 5ad7b721b769..2ee95ece0498 100644 ---- a/arch/s390/Kconfig -+++ b/arch/s390/Kconfig -@@ -123,6 +123,7 @@ config S390 - select HAVE_ARCH_TRACEHOOK - select HAVE_ARCH_TRANSPARENT_HUGEPAGE - select HAVE_BPF_JIT if PACK_STACK && HAVE_MARCH_Z196_FEATURES -+ select HAVE_EBPF_JIT if PACK_STACK && HAVE_MARCH_Z196_FEATURES - select HAVE_CMPXCHG_DOUBLE - select HAVE_CMPXCHG_LOCAL - select HAVE_DEBUG_KMEMLEAK -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 75d0053b495a..2db93042f2f3 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -88,6 +88,7 @@ config X86 - select HAVE_ARCH_TRACEHOOK - select HAVE_ARCH_TRANSPARENT_HUGEPAGE - select HAVE_BPF_JIT if X86_64 -+ select HAVE_EBPF_JIT if X86_64 - select HAVE_CC_STACKPROTECTOR - select HAVE_CMPXCHG_DOUBLE - select HAVE_CMPXCHG_LOCAL -diff --git a/arch/x86/crypto/aesni-intel_glue.c b/arch/x86/crypto/aesni-intel_glue.c -index 3633ad6145c5..c18806b5db2a 100644 ---- a/arch/x86/crypto/aesni-intel_glue.c -+++ b/arch/x86/crypto/aesni-intel_glue.c -@@ -965,7 +965,7 @@ static int helper_rfc4106_encrypt(struct aead_request *req) - - if (sg_is_last(req->src) && - req->src->offset + req->src->length <= PAGE_SIZE && -- sg_is_last(req->dst) && -+ sg_is_last(req->dst) && req->dst->length && - req->dst->offset + req->dst->length <= PAGE_SIZE) { - one_entry_in_sg = 1; - scatterwalk_start(&src_sg_walk, req->src); -diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h -index 9d2abb2a41d2..74fda1a453bd 100644 ---- a/arch/x86/include/asm/kvm_host.h -+++ b/arch/x86/include/asm/kvm_host.h -@@ -998,7 +998,8 @@ int x86_emulate_instruction(struct kvm_vcpu *vcpu, unsigned long cr2, - static inline int emulate_instruction(struct kvm_vcpu *vcpu, - int emulation_type) - { -- return x86_emulate_instruction(vcpu, 0, emulation_type, NULL, 0); -+ return x86_emulate_instruction(vcpu, 0, -+ emulation_type | EMULTYPE_NO_REEXECUTE, NULL, 0); - } - - void kvm_enable_efer_bits(u64); -diff --git a/arch/x86/kernel/cpu/perf_event_intel_bts.c b/arch/x86/kernel/cpu/perf_event_intel_bts.c -index 2cad71d1b14c..5af11c46d0b9 100644 ---- a/arch/x86/kernel/cpu/perf_event_intel_bts.c -+++ b/arch/x86/kernel/cpu/perf_event_intel_bts.c -@@ -22,6 +22,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -67,6 +68,23 @@ static size_t buf_size(struct page *page) - return 1 << (PAGE_SHIFT + page_private(page)); - } - -+static void bts_buffer_free_aux(void *data) -+{ -+#ifdef CONFIG_PAGE_TABLE_ISOLATION -+ struct bts_buffer *buf = data; -+ int nbuf; -+ -+ for (nbuf = 0; nbuf < buf->nr_bufs; nbuf++) { -+ struct page *page = buf->buf[nbuf].page; -+ void *kaddr = page_address(page); -+ size_t page_size = buf_size(page); -+ -+ kaiser_remove_mapping((unsigned long)kaddr, page_size); -+ } -+#endif -+ kfree(data); -+} -+ - static void * - bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite) - { -@@ -103,29 +121,33 @@ bts_buffer_setup_aux(int cpu, void **pages, int nr_pages, bool overwrite) - buf->real_size = size - size % BTS_RECORD_SIZE; - - for (pg = 0, nbuf = 0, offset = 0, pad = 0; nbuf < buf->nr_bufs; nbuf++) { -- unsigned int __nr_pages; -+ void *kaddr = pages[pg]; -+ size_t page_size; -+ -+ page = virt_to_page(kaddr); -+ page_size = buf_size(page); -+ -+ if (kaiser_add_mapping((unsigned long)kaddr, -+ page_size, __PAGE_KERNEL) < 0) { -+ buf->nr_bufs = nbuf; -+ bts_buffer_free_aux(buf); -+ return NULL; -+ } - -- page = virt_to_page(pages[pg]); -- __nr_pages = PagePrivate(page) ? 1 << page_private(page) : 1; - buf->buf[nbuf].page = page; - buf->buf[nbuf].offset = offset; - buf->buf[nbuf].displacement = (pad ? BTS_RECORD_SIZE - pad : 0); -- buf->buf[nbuf].size = buf_size(page) - buf->buf[nbuf].displacement; -+ buf->buf[nbuf].size = page_size - buf->buf[nbuf].displacement; - pad = buf->buf[nbuf].size % BTS_RECORD_SIZE; - buf->buf[nbuf].size -= pad; - -- pg += __nr_pages; -- offset += __nr_pages << PAGE_SHIFT; -+ pg += page_size >> PAGE_SHIFT; -+ offset += page_size; - } - - return buf; - } - --static void bts_buffer_free_aux(void *data) --{ -- kfree(data); --} -- - static unsigned long bts_buffer_offset(struct bts_buffer *buf, unsigned int idx) - { - return buf->buf[idx].offset + buf->buf[idx].displacement; -diff --git a/arch/x86/kernel/tboot.c b/arch/x86/kernel/tboot.c -index 91a4496db434..c77ab1f51fbe 100644 ---- a/arch/x86/kernel/tboot.c -+++ b/arch/x86/kernel/tboot.c -@@ -140,6 +140,16 @@ static int map_tboot_page(unsigned long vaddr, unsigned long pfn, - return -1; - set_pte_at(&tboot_mm, vaddr, pte, pfn_pte(pfn, prot)); - pte_unmap(pte); -+ -+ /* -+ * PTI poisons low addresses in the kernel page tables in the -+ * name of making them unusable for userspace. To execute -+ * code at such a low address, the poison must be cleared. -+ * -+ * Note: 'pgd' actually gets set in pud_alloc(). -+ */ -+ pgd->pgd &= ~_PAGE_NX; -+ - return 0; - } - -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index 00045499f6c2..e4eb1d2bf849 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -4978,6 +4978,8 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) - bool op_prefix = false; - bool has_seg_override = false; - struct opcode opcode; -+ u16 dummy; -+ struct desc_struct desc; - - ctxt->memop.type = OP_NONE; - ctxt->memopp = NULL; -@@ -4996,6 +4998,11 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) - switch (mode) { - case X86EMUL_MODE_REAL: - case X86EMUL_MODE_VM86: -+ def_op_bytes = def_ad_bytes = 2; -+ ctxt->ops->get_segment(ctxt, &dummy, &desc, NULL, VCPU_SREG_CS); -+ if (desc.d) -+ def_op_bytes = def_ad_bytes = 4; -+ break; - case X86EMUL_MODE_PROT16: - def_op_bytes = def_ad_bytes = 2; - break; -diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c -index 3aab53f8cad2..d380111351c0 100644 ---- a/arch/x86/kvm/ioapic.c -+++ b/arch/x86/kvm/ioapic.c -@@ -247,8 +247,7 @@ void kvm_ioapic_scan_entry(struct kvm_vcpu *vcpu, u64 *eoi_exit_bitmap) - index == RTC_GSI) { - if (kvm_apic_match_dest(vcpu, NULL, 0, - e->fields.dest_id, e->fields.dest_mode) || -- (e->fields.trig_mode == IOAPIC_EDGE_TRIG && -- kvm_apic_pending_eoi(vcpu, e->fields.vector))) -+ kvm_apic_pending_eoi(vcpu, e->fields.vector)) - __set_bit(e->fields.vector, - (unsigned long *)eoi_exit_bitmap); - } -@@ -269,6 +268,7 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val) - { - unsigned index; - bool mask_before, mask_after; -+ int old_remote_irr, old_delivery_status; - union kvm_ioapic_redirect_entry *e; - - switch (ioapic->ioregsel) { -@@ -291,14 +291,28 @@ static void ioapic_write_indirect(struct kvm_ioapic *ioapic, u32 val) - return; - e = &ioapic->redirtbl[index]; - mask_before = e->fields.mask; -+ /* Preserve read-only fields */ -+ old_remote_irr = e->fields.remote_irr; -+ old_delivery_status = e->fields.delivery_status; - if (ioapic->ioregsel & 1) { - e->bits &= 0xffffffff; - e->bits |= (u64) val << 32; - } else { - e->bits &= ~0xffffffffULL; - e->bits |= (u32) val; -- e->fields.remote_irr = 0; - } -+ e->fields.remote_irr = old_remote_irr; -+ e->fields.delivery_status = old_delivery_status; -+ -+ /* -+ * Some OSes (Linux, Xen) assume that Remote IRR bit will -+ * be cleared by IOAPIC hardware when the entry is configured -+ * as edge-triggered. This behavior is used to simulate an -+ * explicit EOI on IOAPICs that don't have the EOI register. -+ */ -+ if (e->fields.trig_mode == IOAPIC_EDGE_TRIG) -+ e->fields.remote_irr = 0; -+ - mask_after = e->fields.mask; - if (mask_before != mask_after) - kvm_fire_mask_notifiers(ioapic->kvm, KVM_IRQCHIP_IOAPIC, index, mask_after); -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 75d60e40c389..f8d785aa2e96 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -4954,7 +4954,7 @@ static void vmx_vcpu_reset(struct kvm_vcpu *vcpu, bool init_event) - vmcs_write64(GUEST_IA32_DEBUGCTL, 0); - } - -- vmcs_writel(GUEST_RFLAGS, 0x02); -+ kvm_set_rflags(vcpu, X86_EFLAGS_FIXED); - kvm_rip_write(vcpu, 0xfff0); - - vmcs_writel(GUEST_GDTR_BASE, 0); -@@ -6023,7 +6023,7 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu) - if (test_bit(KVM_REQ_EVENT, &vcpu->requests)) - return 1; - -- err = emulate_instruction(vcpu, EMULTYPE_NO_REEXECUTE); -+ err = emulate_instruction(vcpu, 0); - - if (err == EMULATE_USER_EXIT) { - ++vcpu->stat.mmio_exits; -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index f973cfa8ff4f..3900d34980de 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -5153,7 +5153,7 @@ static int handle_emulation_failure(struct kvm_vcpu *vcpu) - vcpu->run->exit_reason = KVM_EXIT_INTERNAL_ERROR; - vcpu->run->internal.suberror = KVM_INTERNAL_ERROR_EMULATION; - vcpu->run->internal.ndata = 0; -- r = EMULATE_FAIL; -+ r = EMULATE_USER_EXIT; - } - kvm_queue_exception(vcpu, UD_VECTOR); - -diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c -index 75991979f667..33c42b826791 100644 ---- a/arch/x86/net/bpf_jit_comp.c -+++ b/arch/x86/net/bpf_jit_comp.c -@@ -266,10 +266,10 @@ static void emit_bpf_tail_call(u8 **pprog) - /* if (index >= array->map.max_entries) - * goto out; - */ -- EMIT4(0x48, 0x8B, 0x46, /* mov rax, qword ptr [rsi + 16] */ -+ EMIT2(0x89, 0xD2); /* mov edx, edx */ -+ EMIT3(0x39, 0x56, /* cmp dword ptr [rsi + 16], edx */ - offsetof(struct bpf_array, map.max_entries)); -- EMIT3(0x48, 0x39, 0xD0); /* cmp rax, rdx */ --#define OFFSET1 47 /* number of bytes to jump */ -+#define OFFSET1 43 /* number of bytes to jump */ - EMIT2(X86_JBE, OFFSET1); /* jbe out */ - label1 = cnt; - -@@ -278,21 +278,20 @@ static void emit_bpf_tail_call(u8 **pprog) - */ - EMIT2_off32(0x8B, 0x85, -STACKSIZE + 36); /* mov eax, dword ptr [rbp - 516] */ - EMIT3(0x83, 0xF8, MAX_TAIL_CALL_CNT); /* cmp eax, MAX_TAIL_CALL_CNT */ --#define OFFSET2 36 -+#define OFFSET2 32 - EMIT2(X86_JA, OFFSET2); /* ja out */ - label2 = cnt; - EMIT3(0x83, 0xC0, 0x01); /* add eax, 1 */ - EMIT2_off32(0x89, 0x85, -STACKSIZE + 36); /* mov dword ptr [rbp - 516], eax */ - - /* prog = array->ptrs[index]; */ -- EMIT4_off32(0x48, 0x8D, 0x84, 0xD6, /* lea rax, [rsi + rdx * 8 + offsetof(...)] */ -+ EMIT4_off32(0x48, 0x8B, 0x84, 0xD6, /* mov rax, [rsi + rdx * 8 + offsetof(...)] */ - offsetof(struct bpf_array, ptrs)); -- EMIT3(0x48, 0x8B, 0x00); /* mov rax, qword ptr [rax] */ - - /* if (prog == NULL) - * goto out; - */ -- EMIT4(0x48, 0x83, 0xF8, 0x00); /* cmp rax, 0 */ -+ EMIT3(0x48, 0x85, 0xC0); /* test rax,rax */ - #define OFFSET3 10 - EMIT2(X86_JE, OFFSET3); /* je out */ - label3 = cnt; -diff --git a/crypto/af_alg.c b/crypto/af_alg.c -index f5e18c2a4852..ca50eeb13097 100644 ---- a/crypto/af_alg.c -+++ b/crypto/af_alg.c -@@ -149,7 +149,7 @@ EXPORT_SYMBOL_GPL(af_alg_release_parent); - - static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - { -- const u32 forbidden = CRYPTO_ALG_INTERNAL; -+ const u32 allowed = CRYPTO_ALG_KERN_DRIVER_ONLY; - struct sock *sk = sock->sk; - struct alg_sock *ask = alg_sk(sk); - struct sockaddr_alg *sa = (void *)uaddr; -@@ -157,6 +157,10 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - void *private; - int err; - -+ /* If caller uses non-allowed flag, return error. */ -+ if ((sa->salg_feat & ~allowed) || (sa->salg_mask & ~allowed)) -+ return -EINVAL; -+ - if (sock->state == SS_CONNECTED) - return -EINVAL; - -@@ -175,9 +179,7 @@ static int alg_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) - if (IS_ERR(type)) - return PTR_ERR(type); - -- private = type->bind(sa->salg_name, -- sa->salg_feat & ~forbidden, -- sa->salg_mask & ~forbidden); -+ private = type->bind(sa->salg_name, sa->salg_feat, sa->salg_mask); - if (IS_ERR(private)) { - module_put(type->owner); - return PTR_ERR(private); -diff --git a/drivers/acpi/device_sysfs.c b/drivers/acpi/device_sysfs.c -index b9afb47db7ed..1521d9a41d25 100644 ---- a/drivers/acpi/device_sysfs.c -+++ b/drivers/acpi/device_sysfs.c -@@ -146,6 +146,10 @@ static int create_pnp_modalias(struct acpi_device *acpi_dev, char *modalias, - int count; - struct acpi_hardware_id *id; - -+ /* Avoid unnecessarily loading modules for non present devices. */ -+ if (!acpi_device_is_present(acpi_dev)) -+ return 0; -+ - /* - * Since we skip ACPI_DT_NAMESPACE_HID from the modalias below, 0 should - * be returned if ACPI_DT_NAMESPACE_HID is the only ACPI/PNP ID in the -diff --git a/drivers/block/loop.c b/drivers/block/loop.c -index cec36d5c24f5..1c36de9719e5 100644 ---- a/drivers/block/loop.c -+++ b/drivers/block/loop.c -@@ -1569,9 +1569,8 @@ out: - return err; - } - --static void lo_release(struct gendisk *disk, fmode_t mode) -+static void __lo_release(struct loop_device *lo) - { -- struct loop_device *lo = disk->private_data; - int err; - - if (atomic_dec_return(&lo->lo_refcnt)) -@@ -1597,6 +1596,13 @@ static void lo_release(struct gendisk *disk, fmode_t mode) - mutex_unlock(&lo->lo_ctl_mutex); - } - -+static void lo_release(struct gendisk *disk, fmode_t mode) -+{ -+ mutex_lock(&loop_index_mutex); -+ __lo_release(disk->private_data); -+ mutex_unlock(&loop_index_mutex); -+} -+ - static const struct block_device_operations lo_fops = { - .owner = THIS_MODULE, - .open = lo_open, -diff --git a/drivers/cpufreq/Kconfig b/drivers/cpufreq/Kconfig -index 659879a56dba..949610360b14 100644 ---- a/drivers/cpufreq/Kconfig -+++ b/drivers/cpufreq/Kconfig -@@ -236,6 +236,7 @@ endif - if MIPS - config LOONGSON2_CPUFREQ - tristate "Loongson2 CPUFreq Driver" -+ depends on LEMOTE_MACH2F - help - This option adds a CPUFreq driver for loongson processors which - support software configurable cpu frequency. -@@ -248,6 +249,7 @@ config LOONGSON2_CPUFREQ - - config LOONGSON1_CPUFREQ - tristate "Loongson1 CPUFreq Driver" -+ depends on LOONGSON1_LS1B - help - This option adds a CPUFreq driver for loongson1 processors which - support software configurable cpu frequency. -diff --git a/drivers/gpio/gpio-ath79.c b/drivers/gpio/gpio-ath79.c -index 5eaea8b812cf..089a78983b39 100644 ---- a/drivers/gpio/gpio-ath79.c -+++ b/drivers/gpio/gpio-ath79.c -@@ -203,3 +203,6 @@ static struct platform_driver ath79_gpio_driver = { - }; - - module_platform_driver(ath79_gpio_driver); -+ -+MODULE_DESCRIPTION("Atheros AR71XX/AR724X/AR913X GPIO API support"); -+MODULE_LICENSE("GPL v2"); -diff --git a/drivers/gpio/gpio-iop.c b/drivers/gpio/gpio-iop.c -index 2ed0237a8baf..304e68633d29 100644 ---- a/drivers/gpio/gpio-iop.c -+++ b/drivers/gpio/gpio-iop.c -@@ -129,3 +129,7 @@ static int __init iop3xx_gpio_init(void) - return platform_driver_register(&iop3xx_gpio_driver); - } - arch_initcall(iop3xx_gpio_init); -+ -+MODULE_DESCRIPTION("GPIO handling for Intel IOP3xx processors"); -+MODULE_AUTHOR("Lennert Buytenhek "); -+MODULE_LICENSE("GPL"); -diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -index 0e1376317683..b233cf8436b0 100644 ---- a/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_amdkfd_gfx_v7.c -@@ -367,29 +367,50 @@ static int kgd_hqd_sdma_load(struct kgd_dev *kgd, void *mqd) - { - struct amdgpu_device *adev = get_amdgpu_device(kgd); - struct cik_sdma_rlc_registers *m; -+ unsigned long end_jiffies; - uint32_t sdma_base_addr; -+ uint32_t data; - - m = get_sdma_mqd(mqd); - sdma_base_addr = get_sdma_base_addr(m); - -- WREG32(sdma_base_addr + mmSDMA0_RLC0_VIRTUAL_ADDR, -- m->sdma_rlc_virtual_addr); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_CNTL, -+ m->sdma_rlc_rb_cntl & (~SDMA0_RLC0_RB_CNTL__RB_ENABLE_MASK)); - -- WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_BASE, -- m->sdma_rlc_rb_base); -+ end_jiffies = msecs_to_jiffies(2000) + jiffies; -+ while (true) { -+ data = RREG32(sdma_base_addr + mmSDMA0_RLC0_CONTEXT_STATUS); -+ if (data & SDMA0_RLC0_CONTEXT_STATUS__IDLE_MASK) -+ break; -+ if (time_after(jiffies, end_jiffies)) -+ return -ETIME; -+ usleep_range(500, 1000); -+ } -+ if (m->sdma_engine_id) { -+ data = RREG32(mmSDMA1_GFX_CONTEXT_CNTL); -+ data = REG_SET_FIELD(data, SDMA1_GFX_CONTEXT_CNTL, -+ RESUME_CTX, 0); -+ WREG32(mmSDMA1_GFX_CONTEXT_CNTL, data); -+ } else { -+ data = RREG32(mmSDMA0_GFX_CONTEXT_CNTL); -+ data = REG_SET_FIELD(data, SDMA0_GFX_CONTEXT_CNTL, -+ RESUME_CTX, 0); -+ WREG32(mmSDMA0_GFX_CONTEXT_CNTL, data); -+ } - -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_DOORBELL, -+ m->sdma_rlc_doorbell); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_RPTR, 0); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_WPTR, 0); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_VIRTUAL_ADDR, -+ m->sdma_rlc_virtual_addr); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_BASE, m->sdma_rlc_rb_base); - WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_BASE_HI, - m->sdma_rlc_rb_base_hi); -- - WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_RPTR_ADDR_LO, - m->sdma_rlc_rb_rptr_addr_lo); -- - WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_RPTR_ADDR_HI, - m->sdma_rlc_rb_rptr_addr_hi); -- -- WREG32(sdma_base_addr + mmSDMA0_RLC0_DOORBELL, -- m->sdma_rlc_doorbell); -- - WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_CNTL, - m->sdma_rlc_rb_cntl); - -@@ -492,9 +513,9 @@ static int kgd_hqd_sdma_destroy(struct kgd_dev *kgd, void *mqd, - } - - WREG32(sdma_base_addr + mmSDMA0_RLC0_DOORBELL, 0); -- WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_RPTR, 0); -- WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_WPTR, 0); -- WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_BASE, 0); -+ WREG32(sdma_base_addr + mmSDMA0_RLC0_RB_CNTL, -+ RREG32(sdma_base_addr + mmSDMA0_RLC0_RB_CNTL) | -+ SDMA0_RLC0_RB_CNTL__RB_ENABLE_MASK); - - return 0; - } -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c -index d83de985e88c..8577a563600f 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_mqd_manager_cik.c -@@ -215,8 +215,8 @@ static int update_mqd_sdma(struct mqd_manager *mm, void *mqd, - BUG_ON(!mm || !mqd || !q); - - m = get_sdma_mqd(mqd); -- m->sdma_rlc_rb_cntl = ffs(q->queue_size / sizeof(unsigned int)) << -- SDMA0_RLC0_RB_CNTL__RB_SIZE__SHIFT | -+ m->sdma_rlc_rb_cntl = (ffs(q->queue_size / sizeof(unsigned int)) - 1) -+ << SDMA0_RLC0_RB_CNTL__RB_SIZE__SHIFT | - q->vmid << SDMA0_RLC0_RB_CNTL__RB_VMID__SHIFT | - 1 << SDMA0_RLC0_RB_CNTL__RPTR_WRITEBACK_ENABLE__SHIFT | - 6 << SDMA0_RLC0_RB_CNTL__RPTR_WRITEBACK_TIMER__SHIFT; -diff --git a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -index 7b69070f7ecc..aa41b840048f 100644 ---- a/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -+++ b/drivers/gpu/drm/amd/amdkfd/kfd_process_queue_manager.c -@@ -205,6 +205,24 @@ int pqm_create_queue(struct process_queue_manager *pqm, - - switch (type) { - case KFD_QUEUE_TYPE_SDMA: -+ if (dev->dqm->queue_count >= -+ CIK_SDMA_QUEUES_PER_ENGINE * CIK_SDMA_ENGINE_NUM) { -+ pr_err("Over-subscription is not allowed for SDMA.\n"); -+ retval = -EPERM; -+ goto err_create_queue; -+ } -+ -+ retval = create_cp_queue(pqm, dev, &q, properties, f, *qid); -+ if (retval != 0) -+ goto err_create_queue; -+ pqn->q = q; -+ pqn->kq = NULL; -+ retval = dev->dqm->ops.create_queue(dev->dqm, q, &pdd->qpd, -+ &q->properties.vmid); -+ pr_debug("DQM returned %d for create_queue\n", retval); -+ print_queue(q); -+ break; -+ - case KFD_QUEUE_TYPE_COMPUTE: - /* check if there is over subscription */ - if ((sched_policy == KFD_SCHED_POLICY_HWS_NO_OVERSUBSCRIPTION) && -diff --git a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -index 7841970de48d..f516b5891932 100644 ---- a/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -+++ b/drivers/gpu/drm/omapdrm/omap_dmm_tiler.c -@@ -611,7 +611,8 @@ static int omap_dmm_probe(struct platform_device *dev) - match = of_match_node(dmm_of_match, dev->dev.of_node); - if (!match) { - dev_err(&dev->dev, "failed to find matching device node\n"); -- return -ENODEV; -+ ret = -ENODEV; -+ goto fail; - } - - omap_dmm->plat_data = match->data; -diff --git a/drivers/hwmon/pmbus/pmbus_core.c b/drivers/hwmon/pmbus/pmbus_core.c -index ba59eaef2e07..d013acf3f83a 100644 ---- a/drivers/hwmon/pmbus/pmbus_core.c -+++ b/drivers/hwmon/pmbus/pmbus_core.c -@@ -20,6 +20,7 @@ - */ - - #include -+#include - #include - #include - #include -@@ -476,8 +477,8 @@ static long pmbus_reg2data_linear(struct pmbus_data *data, - static long pmbus_reg2data_direct(struct pmbus_data *data, - struct pmbus_sensor *sensor) - { -- long val = (s16) sensor->data; -- long m, b, R; -+ s64 b, val = (s16)sensor->data; -+ s32 m, R; - - m = data->info->m[sensor->class]; - b = data->info->b[sensor->class]; -@@ -505,11 +506,12 @@ static long pmbus_reg2data_direct(struct pmbus_data *data, - R--; - } - while (R < 0) { -- val = DIV_ROUND_CLOSEST(val, 10); -+ val = div_s64(val + 5LL, 10L); /* round closest */ - R++; - } - -- return (val - b) / m; -+ val = div_s64(val - b, m); -+ return clamp_val(val, LONG_MIN, LONG_MAX); - } - - /* -@@ -629,7 +631,8 @@ static u16 pmbus_data2reg_linear(struct pmbus_data *data, - static u16 pmbus_data2reg_direct(struct pmbus_data *data, - struct pmbus_sensor *sensor, long val) - { -- long m, b, R; -+ s64 b, val64 = val; -+ s32 m, R; - - m = data->info->m[sensor->class]; - b = data->info->b[sensor->class]; -@@ -646,18 +649,18 @@ static u16 pmbus_data2reg_direct(struct pmbus_data *data, - R -= 3; /* Adjust R and b for data in milli-units */ - b *= 1000; - } -- val = val * m + b; -+ val64 = val64 * m + b; - - while (R > 0) { -- val *= 10; -+ val64 *= 10; - R--; - } - while (R < 0) { -- val = DIV_ROUND_CLOSEST(val, 10); -+ val64 = div_s64(val64 + 5LL, 10L); /* round closest */ - R++; - } - -- return val; -+ return (u16)clamp_val(val64, S16_MIN, S16_MAX); - } - - static u16 pmbus_data2reg_vid(struct pmbus_data *data, -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 5b815e64c1c9..a5a6909280fe 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -808,7 +808,10 @@ int bch_btree_cache_alloc(struct cache_set *c) - c->shrink.scan_objects = bch_mca_scan; - c->shrink.seeks = 4; - c->shrink.batch = c->btree_pages * 2; -- register_shrinker(&c->shrink); -+ -+ if (register_shrinker(&c->shrink)) -+ pr_warn("bcache: %s: could not register shrinker", -+ __func__); - - return 0; - } -diff --git a/drivers/media/usb/usbtv/usbtv-core.c b/drivers/media/usb/usbtv/usbtv-core.c -index 29428bef272c..3bbc77aa6a33 100644 ---- a/drivers/media/usb/usbtv/usbtv-core.c -+++ b/drivers/media/usb/usbtv/usbtv-core.c -@@ -127,6 +127,7 @@ static void usbtv_disconnect(struct usb_interface *intf) - - static struct usb_device_id usbtv_id_table[] = { - { USB_DEVICE(0x1b71, 0x3002) }, -+ { USB_DEVICE(0x1f71, 0x3301) }, - {} - }; - MODULE_DEVICE_TABLE(usb, usbtv_id_table); -diff --git a/drivers/mtd/nand/denali_pci.c b/drivers/mtd/nand/denali_pci.c -index de31514df282..d38527e0a2f2 100644 ---- a/drivers/mtd/nand/denali_pci.c -+++ b/drivers/mtd/nand/denali_pci.c -@@ -119,3 +119,7 @@ static struct pci_driver denali_pci_driver = { - }; - - module_pci_driver(denali_pci_driver); -+ -+MODULE_DESCRIPTION("PCI driver for Denali NAND controller"); -+MODULE_AUTHOR("Intel Corporation and its suppliers"); -+MODULE_LICENSE("GPL v2"); -diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c -index 53803fd6350c..02b23f6277fb 100644 ---- a/drivers/net/ethernet/intel/igb/igb_main.c -+++ b/drivers/net/ethernet/intel/igb/igb_main.c -@@ -3174,7 +3174,7 @@ static int __igb_close(struct net_device *netdev, bool suspending) - - static int igb_close(struct net_device *netdev) - { -- if (netif_device_present(netdev)) -+ if (netif_device_present(netdev) || netdev->dismantle) - return __igb_close(netdev, false); - return 0; - } -diff --git a/drivers/net/ethernet/xilinx/Kconfig b/drivers/net/ethernet/xilinx/Kconfig -index 4f5c024c6192..5d5c0c433f3e 100644 ---- a/drivers/net/ethernet/xilinx/Kconfig -+++ b/drivers/net/ethernet/xilinx/Kconfig -@@ -34,6 +34,7 @@ config XILINX_AXI_EMAC - config XILINX_LL_TEMAC - tristate "Xilinx LL TEMAC (LocalLink Tri-mode Ethernet MAC) driver" - depends on (PPC || MICROBLAZE) -+ depends on !64BIT || BROKEN - select PHYLIB - ---help--- - This driver supports the Xilinx 10/100/1000 LocalLink TEMAC -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index fd221cc4cb79..eb7a9e62371c 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -86,6 +86,8 @@ struct netfront_cb { - /* IRQ name is queue name with "-tx" or "-rx" appended */ - #define IRQ_NAME_SIZE (QUEUE_NAME_SIZE + 3) - -+static DECLARE_WAIT_QUEUE_HEAD(module_unload_q); -+ - struct netfront_stats { - u64 packets; - u64 bytes; -@@ -2037,10 +2039,12 @@ static void netback_changed(struct xenbus_device *dev, - break; - - case XenbusStateClosed: -+ wake_up_all(&module_unload_q); - if (dev->state == XenbusStateClosed) - break; - /* Missed the backend's CLOSING state -- fallthrough */ - case XenbusStateClosing: -+ wake_up_all(&module_unload_q); - xenbus_frontend_closed(dev); - break; - } -@@ -2146,6 +2150,20 @@ static int xennet_remove(struct xenbus_device *dev) - - dev_dbg(&dev->dev, "%s\n", dev->nodename); - -+ if (xenbus_read_driver_state(dev->otherend) != XenbusStateClosed) { -+ xenbus_switch_state(dev, XenbusStateClosing); -+ wait_event(module_unload_q, -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateClosing); -+ -+ xenbus_switch_state(dev, XenbusStateClosed); -+ wait_event(module_unload_q, -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateClosed || -+ xenbus_read_driver_state(dev->otherend) == -+ XenbusStateUnknown); -+ } -+ - xennet_disconnect_backend(info); - - unregister_netdev(info->netdev); -diff --git a/drivers/power/reset/zx-reboot.c b/drivers/power/reset/zx-reboot.c -index a5b009673d0e..5eb719e73e9e 100644 ---- a/drivers/power/reset/zx-reboot.c -+++ b/drivers/power/reset/zx-reboot.c -@@ -78,3 +78,7 @@ static struct platform_driver zx_reboot_driver = { - }, - }; - module_platform_driver(zx_reboot_driver); -+ -+MODULE_DESCRIPTION("ZTE SoCs reset driver"); -+MODULE_AUTHOR("Jun Nie "); -+MODULE_LICENSE("GPL v2"); -diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c -index 8c758c36fc70..766a9176b4ad 100644 ---- a/drivers/scsi/aacraid/commsup.c -+++ b/drivers/scsi/aacraid/commsup.c -@@ -1363,13 +1363,13 @@ static int _aac_reset_adapter(struct aac_dev *aac, int forced) - * will ensure that i/o is queisced and the card is flushed in that - * case. - */ -+ aac_free_irq(aac); - aac_fib_map_free(aac); - pci_free_consistent(aac->pdev, aac->comm_size, aac->comm_addr, aac->comm_phys); - aac->comm_addr = NULL; - aac->comm_phys = 0; - kfree(aac->queues); - aac->queues = NULL; -- aac_free_irq(aac); - kfree(aac->fsa_dev); - aac->fsa_dev = NULL; - quirks = aac_get_driver_ident(index)->quirks; -diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c -index 0c2482ec7d21..096c867069e9 100644 ---- a/drivers/scsi/ufs/ufshcd.c -+++ b/drivers/scsi/ufs/ufshcd.c -@@ -4392,12 +4392,15 @@ static int ufshcd_config_vreg(struct device *dev, - struct ufs_vreg *vreg, bool on) - { - int ret = 0; -- struct regulator *reg = vreg->reg; -- const char *name = vreg->name; -+ struct regulator *reg; -+ const char *name; - int min_uV, uA_load; - - BUG_ON(!vreg); - -+ reg = vreg->reg; -+ name = vreg->name; -+ - if (regulator_count_voltages(reg) > 0) { - min_uV = on ? vreg->min_uV : 0; - ret = regulator_set_voltage(reg, min_uV, vreg->max_uV); -diff --git a/drivers/spi/spi-imx.c b/drivers/spi/spi-imx.c -index 0e5723ab47f0..d17ec6775718 100644 ---- a/drivers/spi/spi-imx.c -+++ b/drivers/spi/spi-imx.c -@@ -1228,12 +1228,23 @@ static int spi_imx_remove(struct platform_device *pdev) - { - struct spi_master *master = platform_get_drvdata(pdev); - struct spi_imx_data *spi_imx = spi_master_get_devdata(master); -+ int ret; - - spi_bitbang_stop(&spi_imx->bitbang); - -+ ret = clk_enable(spi_imx->clk_per); -+ if (ret) -+ return ret; -+ -+ ret = clk_enable(spi_imx->clk_ipg); -+ if (ret) { -+ clk_disable(spi_imx->clk_per); -+ return ret; -+ } -+ - writel(0, spi_imx->base + MXC_CSPICTRL); -- clk_unprepare(spi_imx->clk_ipg); -- clk_unprepare(spi_imx->clk_per); -+ clk_disable_unprepare(spi_imx->clk_ipg); -+ clk_disable_unprepare(spi_imx->clk_per); - spi_imx_sdma_exit(spi_imx); - spi_master_put(master); - -diff --git a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -index a076ede50b22..ec90f2781085 100644 ---- a/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -+++ b/drivers/staging/rtl8188eu/os_dep/ioctl_linux.c -@@ -1399,19 +1399,13 @@ static int rtw_wx_get_essid(struct net_device *dev, - if ((check_fwstate(pmlmepriv, _FW_LINKED)) || - (check_fwstate(pmlmepriv, WIFI_ADHOC_MASTER_STATE))) { - len = pcur_bss->Ssid.SsidLength; -- -- wrqu->essid.length = len; -- - memcpy(extra, pcur_bss->Ssid.Ssid, len); -- -- wrqu->essid.flags = 1; - } else { -- ret = -1; -- goto exit; -+ len = 0; -+ *extra = 0; - } -- --exit: -- -+ wrqu->essid.length = len; -+ wrqu->essid.flags = 1; - - return ret; - } -diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c -index 016e4be05cec..98176d12b3e1 100644 ---- a/drivers/tty/serial/imx.c -+++ b/drivers/tty/serial/imx.c -@@ -2057,12 +2057,14 @@ static void serial_imx_enable_wakeup(struct imx_port *sport, bool on) - val &= ~UCR3_AWAKEN; - writel(val, sport->port.membase + UCR3); - -- val = readl(sport->port.membase + UCR1); -- if (on) -- val |= UCR1_RTSDEN; -- else -- val &= ~UCR1_RTSDEN; -- writel(val, sport->port.membase + UCR1); -+ if (sport->have_rtscts) { -+ val = readl(sport->port.membase + UCR1); -+ if (on) -+ val |= UCR1_RTSDEN; -+ else -+ val &= ~UCR1_RTSDEN; -+ writel(val, sport->port.membase + UCR1); -+ } - } - - static int imx_serial_port_suspend_noirq(struct device *dev) -diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c -index 3f6bb3fff890..edd8ef4ee502 100644 ---- a/drivers/usb/class/cdc-acm.c -+++ b/drivers/usb/class/cdc-acm.c -@@ -377,7 +377,7 @@ static int acm_submit_read_urb(struct acm *acm, int index, gfp_t mem_flags) - - res = usb_submit_urb(acm->read_urbs[index], mem_flags); - if (res) { -- if (res != -EPERM) { -+ if (res != -EPERM && res != -ENODEV) { - dev_err(&acm->data->dev, - "%s - usb_submit_urb failed: %d\n", - __func__, res); -@@ -1695,6 +1695,9 @@ static const struct usb_device_id acm_ids[] = { - { USB_DEVICE(0x0ace, 0x1611), /* ZyDAS 56K USB MODEM - new version */ - .driver_info = SINGLE_RX_URB, /* firmware bug */ - }, -+ { USB_DEVICE(0x11ca, 0x0201), /* VeriFone Mx870 Gadget Serial */ -+ .driver_info = SINGLE_RX_URB, -+ }, - { USB_DEVICE(0x22b8, 0x7000), /* Motorola Q Phone */ - .driver_info = NO_UNION_NORMAL, /* has no union descriptor */ - }, -diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c -index d186d0282a38..f70dd3dd4393 100644 ---- a/drivers/usb/gadget/composite.c -+++ b/drivers/usb/gadget/composite.c -@@ -104,7 +104,6 @@ int config_ep_by_speed(struct usb_gadget *g, - struct usb_function *f, - struct usb_ep *_ep) - { -- struct usb_composite_dev *cdev = get_gadget_data(g); - struct usb_endpoint_descriptor *chosen_desc = NULL; - struct usb_descriptor_header **speed_desc = NULL; - -@@ -176,8 +175,12 @@ ep_found: - _ep->maxburst = comp_desc->bMaxBurst + 1; - break; - default: -- if (comp_desc->bMaxBurst != 0) -+ if (comp_desc->bMaxBurst != 0) { -+ struct usb_composite_dev *cdev; -+ -+ cdev = get_gadget_data(g); - ERROR(cdev, "ep0 bMaxBurst must be 0\n"); -+ } - _ep->maxburst = 1; - break; - } -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 39bb65265bff..eb298daf49c7 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -3490,7 +3490,8 @@ static void ffs_closed(struct ffs_data *ffs) - ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; - ffs_dev_unlock(); - -- unregister_gadget_item(ci); -+ if (test_bit(FFS_FL_BOUND, &ffs->flags)) -+ unregister_gadget_item(ci); - return; - done: - ffs_dev_unlock(); -diff --git a/drivers/usb/serial/Kconfig b/drivers/usb/serial/Kconfig -index 56ecb8b5115d..584ae8cbaf1c 100644 ---- a/drivers/usb/serial/Kconfig -+++ b/drivers/usb/serial/Kconfig -@@ -63,6 +63,7 @@ config USB_SERIAL_SIMPLE - - Google USB serial devices - - HP4x calculators - - a number of Motorola phones -+ - Motorola Tetra devices - - Novatel Wireless GPS receivers - - Siemens USB/MPI adapter. - - ViVOtech ViVOpay USB device. -diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c -index 749e1b674145..6947985ccfb0 100644 ---- a/drivers/usb/serial/io_edgeport.c -+++ b/drivers/usb/serial/io_edgeport.c -@@ -2219,7 +2219,6 @@ static int write_cmd_usb(struct edgeport_port *edge_port, - /* something went wrong */ - dev_err(dev, "%s - usb_submit_urb(write command) failed, status = %d\n", - __func__, status); -- usb_kill_urb(urb); - usb_free_urb(urb); - atomic_dec(&CmdUrbs); - return status; -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index a818c43a02ec..1799aa058a5b 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -383,6 +383,9 @@ static void option_instat_callback(struct urb *urb); - #define FOUR_G_SYSTEMS_PRODUCT_W14 0x9603 - #define FOUR_G_SYSTEMS_PRODUCT_W100 0x9b01 - -+/* Fujisoft products */ -+#define FUJISOFT_PRODUCT_FS040U 0x9b02 -+ - /* iBall 3.5G connect wireless modem */ - #define IBALL_3_5G_CONNECT 0x9605 - -@@ -1897,6 +1900,8 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W100), - .driver_info = (kernel_ulong_t)&four_g_w100_blacklist - }, -+ {USB_DEVICE(LONGCHEER_VENDOR_ID, FUJISOFT_PRODUCT_FS040U), -+ .driver_info = (kernel_ulong_t)&net_intf3_blacklist}, - { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, SPEEDUP_PRODUCT_SU9800, 0xff) }, - { USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9801, 0xff), - .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index a51b28379850..3da25ad267a2 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -39,6 +39,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ2) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_DCU11) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_RSAQ3) }, -+ { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_CHILITAG) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_PHAROS) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_ALDIGA) }, - { USB_DEVICE(PL2303_VENDOR_ID, PL2303_PRODUCT_ID_MMX) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index 3b5a15d1dc0d..123289085ee2 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -17,6 +17,7 @@ - #define PL2303_PRODUCT_ID_DCU11 0x1234 - #define PL2303_PRODUCT_ID_PHAROS 0xaaa0 - #define PL2303_PRODUCT_ID_RSAQ3 0xaaa2 -+#define PL2303_PRODUCT_ID_CHILITAG 0xaaa8 - #define PL2303_PRODUCT_ID_ALDIGA 0x0611 - #define PL2303_PRODUCT_ID_MMX 0x0612 - #define PL2303_PRODUCT_ID_GPRS 0x0609 -diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c -index e98b6e57b703..6aa7ff2c1cf7 100644 ---- a/drivers/usb/serial/usb-serial-simple.c -+++ b/drivers/usb/serial/usb-serial-simple.c -@@ -80,6 +80,11 @@ DEVICE(vivopay, VIVOPAY_IDS); - { USB_DEVICE(0x22b8, 0x2c64) } /* Motorola V950 phone */ - DEVICE(moto_modem, MOTO_IDS); - -+/* Motorola Tetra driver */ -+#define MOTOROLA_TETRA_IDS() \ -+ { USB_DEVICE(0x0cad, 0x9011) } /* Motorola Solutions TETRA PEI */ -+DEVICE(motorola_tetra, MOTOROLA_TETRA_IDS); -+ - /* Novatel Wireless GPS driver */ - #define NOVATEL_IDS() \ - { USB_DEVICE(0x09d7, 0x0100) } /* NovAtel FlexPack GPS */ -@@ -110,6 +115,7 @@ static struct usb_serial_driver * const serial_drivers[] = { - &google_device, - &vivopay_device, - &moto_modem_device, -+ &motorola_tetra_device, - &novatel_gps_device, - &hp4x_device, - &suunto_device, -@@ -125,6 +131,7 @@ static const struct usb_device_id id_table[] = { - GOOGLE_IDS(), - VIVOPAY_IDS(), - MOTO_IDS(), -+ MOTOROLA_TETRA_IDS(), - NOVATEL_IDS(), - HP4X_IDS(), - SUUNTO_IDS(), -diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c -index f952635ebe5f..de7214ae4fed 100644 ---- a/drivers/usb/storage/uas.c -+++ b/drivers/usb/storage/uas.c -@@ -1052,20 +1052,19 @@ static int uas_post_reset(struct usb_interface *intf) - return 0; - - err = uas_configure_endpoints(devinfo); -- if (err) { -+ if (err && err != ENODEV) - shost_printk(KERN_ERR, shost, - "%s: alloc streams error %d after reset", - __func__, err); -- return 1; -- } - -+ /* we must unblock the host in every case lest we deadlock */ - spin_lock_irqsave(shost->host_lock, flags); - scsi_report_bus_reset(shost, 0); - spin_unlock_irqrestore(shost->host_lock, flags); - - scsi_unblock_requests(shost); - -- return 0; -+ return err ? 1 : 0; - } - - static int uas_suspend(struct usb_interface *intf, pm_message_t message) -diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c -index cfe99bec49de..45934deacfd7 100644 ---- a/fs/btrfs/free-space-cache.c -+++ b/fs/btrfs/free-space-cache.c -@@ -1258,7 +1258,7 @@ static int __btrfs_write_out_cache(struct btrfs_root *root, struct inode *inode, - /* Lock all pages first so we can lock the extent safely. */ - ret = io_ctl_prepare_pages(io_ctl, inode, 0); - if (ret) -- goto out; -+ goto out_unlock; - - lock_extent_bits(&BTRFS_I(inode)->io_tree, 0, i_size_read(inode) - 1, - 0, &cached_state); -@@ -1351,6 +1351,7 @@ out_nospc_locked: - out_nospc: - cleanup_write_cache_enospc(inode, io_ctl, &cached_state, &bitmap_list); - -+out_unlock: - if (block_group && (block_group->flags & BTRFS_BLOCK_GROUP_DATA)) - up_write(&block_group->data_rwsem); - -diff --git a/fs/nfs_common/grace.c b/fs/nfs_common/grace.c -index fd8c9a5bcac4..77d136ac8909 100644 ---- a/fs/nfs_common/grace.c -+++ b/fs/nfs_common/grace.c -@@ -30,7 +30,11 @@ locks_start_grace(struct net *net, struct lock_manager *lm) - struct list_head *grace_list = net_generic(net, grace_net_id); - - spin_lock(&grace_lock); -- list_add(&lm->list, grace_list); -+ if (list_empty(&lm->list)) -+ list_add(&lm->list, grace_list); -+ else -+ WARN(1, "double list_add attempt detected in net %x %s\n", -+ net->ns.inum, (net == &init_net) ? "(init_net)" : ""); - spin_unlock(&grace_lock); - } - EXPORT_SYMBOL_GPL(locks_start_grace); -@@ -104,7 +108,9 @@ grace_exit_net(struct net *net) - { - struct list_head *grace_list = net_generic(net, grace_net_id); - -- BUG_ON(!list_empty(grace_list)); -+ WARN_ONCE(!list_empty(grace_list), -+ "net %x %s: grace_list is not empty\n", -+ net->ns.inum, __func__); - } - - static struct pernet_operations grace_net_ops = { -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 11c67e8b939d..ba27a5ff8677 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -63,12 +63,16 @@ static const stateid_t zero_stateid = { - static const stateid_t currentstateid = { - .si_generation = 1, - }; -+static const stateid_t close_stateid = { -+ .si_generation = 0xffffffffU, -+}; - - static u64 current_sessionid = 1; - - #define ZERO_STATEID(stateid) (!memcmp((stateid), &zero_stateid, sizeof(stateid_t))) - #define ONE_STATEID(stateid) (!memcmp((stateid), &one_stateid, sizeof(stateid_t))) - #define CURRENT_STATEID(stateid) (!memcmp((stateid), ¤tstateid, sizeof(stateid_t))) -+#define CLOSE_STATEID(stateid) (!memcmp((stateid), &close_stateid, sizeof(stateid_t))) - - /* forward declarations */ - static bool check_for_locks(struct nfs4_file *fp, struct nfs4_lockowner *lowner); -@@ -4701,7 +4705,8 @@ static __be32 nfsd4_validate_stateid(struct nfs4_client *cl, stateid_t *stateid) - struct nfs4_stid *s; - __be32 status = nfserr_bad_stateid; - -- if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) -+ if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || -+ CLOSE_STATEID(stateid)) - return status; - /* Client debugging aid. */ - if (!same_clid(&stateid->si_opaque.so_clid, &cl->cl_clientid)) { -@@ -4759,7 +4764,8 @@ nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, - else if (typemask & NFS4_DELEG_STID) - typemask |= NFS4_REVOKED_DELEG_STID; - -- if (ZERO_STATEID(stateid) || ONE_STATEID(stateid)) -+ if (ZERO_STATEID(stateid) || ONE_STATEID(stateid) || -+ CLOSE_STATEID(stateid)) - return nfserr_bad_stateid; - status = lookup_clientid(&stateid->si_opaque.so_clid, cstate, nn); - if (status == nfserr_stale_clientid) { -@@ -5011,15 +5017,9 @@ static __be32 nfs4_seqid_op_checks(struct nfsd4_compound_state *cstate, stateid_ - status = nfsd4_check_seqid(cstate, sop, seqid); - if (status) - return status; -- if (stp->st_stid.sc_type == NFS4_CLOSED_STID -- || stp->st_stid.sc_type == NFS4_REVOKED_DELEG_STID) -- /* -- * "Closed" stateid's exist *only* to return -- * nfserr_replay_me from the previous step, and -- * revoked delegations are kept only for free_stateid. -- */ -- return nfserr_bad_stateid; -- mutex_lock(&stp->st_mutex); -+ status = nfsd4_lock_ol_stateid(stp); -+ if (status != nfs_ok) -+ return status; - status = check_stateid_generation(stateid, &stp->st_stid.sc_stateid, nfsd4_has_session(cstate)); - if (status == nfs_ok) - status = nfs4_check_fh(current_fh, &stp->st_stid); -@@ -5243,6 +5243,11 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, - nfsd4_close_open_stateid(stp); - mutex_unlock(&stp->st_mutex); - -+ /* See RFC5661 sectionm 18.2.4 */ -+ if (stp->st_stid.sc_client->cl_minorversion) -+ memcpy(&close->cl_stateid, &close_stateid, -+ sizeof(close->cl_stateid)); -+ - /* put reference from nfs4_preprocess_seqid_op */ - nfs4_put_stid(&stp->st_stid); - out: -@@ -6787,6 +6792,10 @@ static int nfs4_state_create_net(struct net *net) - INIT_LIST_HEAD(&nn->sessionid_hashtbl[i]); - nn->conf_name_tree = RB_ROOT; - nn->unconf_name_tree = RB_ROOT; -+ nn->boot_time = get_seconds(); -+ nn->grace_ended = false; -+ nn->nfsd4_manager.block_opens = true; -+ INIT_LIST_HEAD(&nn->nfsd4_manager.list); - INIT_LIST_HEAD(&nn->client_lru); - INIT_LIST_HEAD(&nn->close_lru); - INIT_LIST_HEAD(&nn->del_recall_lru); -@@ -6841,9 +6850,6 @@ nfs4_state_start_net(struct net *net) - ret = nfs4_state_create_net(net); - if (ret) - return ret; -- nn->boot_time = get_seconds(); -- nn->grace_ended = false; -- nn->nfsd4_manager.block_opens = true; - locks_start_grace(net, &nn->nfsd4_manager); - nfsd4_client_tracking_init(net); - printk(KERN_INFO "NFSD: starting %ld-second grace period (net %p)\n", -diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c -index 353ff31dcee1..1cb1d02c5937 100644 ---- a/fs/quota/dquot.c -+++ b/fs/quota/dquot.c -@@ -2919,7 +2919,8 @@ static int __init dquot_init(void) - pr_info("VFS: Dquot-cache hash table entries: %ld (order %ld," - " %ld bytes)\n", nr_hash, order, (PAGE_SIZE << order)); - -- register_shrinker(&dqcache_shrinker); -+ if (register_shrinker(&dqcache_shrinker)) -+ panic("Cannot register dquot shrinker"); - - return 0; - } -diff --git a/fs/xfs/xfs_aops.c b/fs/xfs/xfs_aops.c -index a9063ac50c4e..da72090b9ce7 100644 ---- a/fs/xfs/xfs_aops.c -+++ b/fs/xfs/xfs_aops.c -@@ -310,7 +310,7 @@ xfs_map_blocks( - (ip->i_df.if_flags & XFS_IFEXTENTS)); - ASSERT(offset <= mp->m_super->s_maxbytes); - -- if (offset + count > mp->m_super->s_maxbytes) -+ if ((xfs_ufsize_t)offset + count > mp->m_super->s_maxbytes) - count = mp->m_super->s_maxbytes - offset; - end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + count); - offset_fsb = XFS_B_TO_FSBT(mp, offset); -@@ -1360,7 +1360,7 @@ xfs_map_trim_size( - if (mapping_size > size) - mapping_size = size; - if (offset < i_size_read(inode) && -- offset + mapping_size >= i_size_read(inode)) { -+ (xfs_ufsize_t)offset + mapping_size >= i_size_read(inode)) { - /* limit mapping to block that spans EOF */ - mapping_size = roundup_64(i_size_read(inode) - offset, - i_blocksize(inode)); -@@ -1416,7 +1416,7 @@ __xfs_get_blocks( - } - - ASSERT(offset <= mp->m_super->s_maxbytes); -- if (offset + size > mp->m_super->s_maxbytes) -+ if ((xfs_ufsize_t)offset + size > mp->m_super->s_maxbytes) - size = mp->m_super->s_maxbytes - offset; - end_fsb = XFS_B_TO_FSB(mp, (xfs_ufsize_t)offset + size); - offset_fsb = XFS_B_TO_FSBT(mp, offset); -diff --git a/include/linux/bpf.h b/include/linux/bpf.h -index f2157159b26f..132585a7fbd8 100644 ---- a/include/linux/bpf.h -+++ b/include/linux/bpf.h -@@ -31,17 +31,25 @@ struct bpf_map_ops { - }; - - struct bpf_map { -- atomic_t refcnt; -+ /* 1st cacheline with read-mostly members of which some -+ * are also accessed in fast-path (e.g. ops, max_entries). -+ */ -+ const struct bpf_map_ops *ops ____cacheline_aligned; - enum bpf_map_type map_type; - u32 key_size; - u32 value_size; - u32 max_entries; - u32 pages; - bool unpriv_array; -- struct user_struct *user; -- const struct bpf_map_ops *ops; -- struct work_struct work; -+ /* 7 bytes hole */ -+ -+ /* 2nd cacheline with misc members to avoid false sharing -+ * particularly with refcounting. -+ */ -+ struct user_struct *user ____cacheline_aligned; -+ atomic_t refcnt; - atomic_t usercnt; -+ struct work_struct work; - }; - - struct bpf_map_type_list { -diff --git a/init/Kconfig b/init/Kconfig -index 235c7a2c0d20..ef2f97dc6010 100644 ---- a/init/Kconfig -+++ b/init/Kconfig -@@ -1556,6 +1556,13 @@ config BPF_SYSCALL - Enable the bpf() system call that allows to manipulate eBPF - programs and maps via file descriptors. - -+config BPF_JIT_ALWAYS_ON -+ bool "Permanently enable BPF JIT and remove BPF interpreter" -+ depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT -+ help -+ Enables BPF JIT and removes BPF interpreter to avoid -+ speculative execution of BPF instructions by the interpreter -+ - config SHMEM - bool "Use full shmem filesystem" if EXPERT - default y -diff --git a/kernel/bpf/core.c b/kernel/bpf/core.c -index 3fd76cf0c21e..eb52d11fdaa7 100644 ---- a/kernel/bpf/core.c -+++ b/kernel/bpf/core.c -@@ -256,6 +256,7 @@ noinline u64 __bpf_call_base(u64 r1, u64 r2, u64 r3, u64 r4, u64 r5) - } - EXPORT_SYMBOL_GPL(__bpf_call_base); - -+#ifndef CONFIG_BPF_JIT_ALWAYS_ON - /** - * __bpf_prog_run - run eBPF program on a given context - * @ctx: is the data we are operating on -@@ -443,7 +444,7 @@ select_insn: - DST = tmp; - CONT; - ALU_MOD_X: -- if (unlikely(SRC == 0)) -+ if (unlikely((u32)SRC == 0)) - return 0; - tmp = (u32) DST; - DST = do_div(tmp, (u32) SRC); -@@ -462,7 +463,7 @@ select_insn: - DST = div64_u64(DST, SRC); - CONT; - ALU_DIV_X: -- if (unlikely(SRC == 0)) -+ if (unlikely((u32)SRC == 0)) - return 0; - tmp = (u32) DST; - do_div(tmp, (u32) SRC); -@@ -517,7 +518,7 @@ select_insn: - struct bpf_map *map = (struct bpf_map *) (unsigned long) BPF_R2; - struct bpf_array *array = container_of(map, struct bpf_array, map); - struct bpf_prog *prog; -- u64 index = BPF_R3; -+ u32 index = BPF_R3; - - if (unlikely(index >= array->map.max_entries)) - goto out; -@@ -725,6 +726,13 @@ load_byte: - return 0; - } - -+#else -+static unsigned int __bpf_prog_ret0(void *ctx, const struct bpf_insn *insn) -+{ -+ return 0; -+} -+#endif -+ - bool bpf_prog_array_compatible(struct bpf_array *array, - const struct bpf_prog *fp) - { -@@ -771,9 +779,23 @@ static int bpf_check_tail_call(const struct bpf_prog *fp) - */ - int bpf_prog_select_runtime(struct bpf_prog *fp) - { -+#ifndef CONFIG_BPF_JIT_ALWAYS_ON - fp->bpf_func = (void *) __bpf_prog_run; -- -+#else -+ fp->bpf_func = (void *) __bpf_prog_ret0; -+#endif -+ -+ /* eBPF JITs can rewrite the program in case constant -+ * blinding is active. However, in case of error during -+ * blinding, bpf_int_jit_compile() must always return a -+ * valid program, which in this case would simply not -+ * be JITed, but falls back to the interpreter. -+ */ - bpf_int_jit_compile(fp); -+#ifdef CONFIG_BPF_JIT_ALWAYS_ON -+ if (!fp->jited) -+ return -ENOTSUPP; -+#endif - bpf_prog_lock_ro(fp); - - /* The tail call compatibility check can only be done at -diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c -index 014c2d759916..c14003840bc5 100644 ---- a/kernel/bpf/verifier.c -+++ b/kernel/bpf/verifier.c -@@ -191,6 +191,7 @@ struct bpf_insn_aux_data { - enum bpf_reg_type ptr_type; /* pointer type for load/store insns */ - struct bpf_map *map_ptr; /* pointer for call insn into lookup_elem */ - }; -+ bool seen; /* this insn was processed by the verifier */ - }; - - #define MAX_USED_MAPS 64 /* max number of maps accessed by one eBPF program */ -@@ -682,6 +683,13 @@ static bool is_pointer_value(struct verifier_env *env, int regno) - } - } - -+static bool is_ctx_reg(struct verifier_env *env, int regno) -+{ -+ const struct reg_state *reg = &env->cur_state.regs[regno]; -+ -+ return reg->type == PTR_TO_CTX; -+} -+ - /* check whether memory at (regno + off) is accessible for t = (read | write) - * if t==write, value_regno is a register which value is stored into memory - * if t==read, value_regno is a register which will receive the value from memory -@@ -778,6 +786,12 @@ static int check_xadd(struct verifier_env *env, struct bpf_insn *insn) - return -EACCES; - } - -+ if (is_ctx_reg(env, insn->dst_reg)) { -+ verbose("BPF_XADD stores into R%d context is not allowed\n", -+ insn->dst_reg); -+ return -EACCES; -+ } -+ - /* check whether atomic_add can read the memory */ - err = check_mem_access(env, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_READ, -1); -@@ -1164,6 +1178,11 @@ static int check_alu_op(struct verifier_env *env, struct bpf_insn *insn) - return -EINVAL; - } - -+ if (opcode == BPF_ARSH && BPF_CLASS(insn->code) != BPF_ALU64) { -+ verbose("BPF_ARSH not supported for 32 bit ALU\n"); -+ return -EINVAL; -+ } -+ - if ((opcode == BPF_LSH || opcode == BPF_RSH || - opcode == BPF_ARSH) && BPF_SRC(insn->code) == BPF_K) { - int size = BPF_CLASS(insn->code) == BPF_ALU64 ? 64 : 32; -@@ -1793,6 +1812,7 @@ static int do_check(struct verifier_env *env) - print_bpf_insn(env, insn); - } - -+ env->insn_aux_data[insn_idx].seen = true; - if (class == BPF_ALU || class == BPF_ALU64) { - err = check_alu_op(env, insn); - if (err) -@@ -1902,6 +1922,12 @@ static int do_check(struct verifier_env *env) - if (err) - return err; - -+ if (is_ctx_reg(env, insn->dst_reg)) { -+ verbose("BPF_ST stores into R%d context is not allowed\n", -+ insn->dst_reg); -+ return -EACCES; -+ } -+ - /* check that memory (dst_reg + off) is writeable */ - err = check_mem_access(env, insn->dst_reg, insn->off, - BPF_SIZE(insn->code), BPF_WRITE, -@@ -1988,6 +2014,7 @@ process_bpf_exit: - return err; - - insn_idx++; -+ env->insn_aux_data[insn_idx].seen = true; - } else { - verbose("invalid BPF_LD mode\n"); - return -EINVAL; -@@ -2125,6 +2152,7 @@ static int adjust_insn_aux_data(struct verifier_env *env, u32 prog_len, - u32 off, u32 cnt) - { - struct bpf_insn_aux_data *new_data, *old_data = env->insn_aux_data; -+ int i; - - if (cnt == 1) - return 0; -@@ -2134,6 +2162,8 @@ static int adjust_insn_aux_data(struct verifier_env *env, u32 prog_len, - memcpy(new_data, old_data, sizeof(struct bpf_insn_aux_data) * off); - memcpy(new_data + off + cnt - 1, old_data + off, - sizeof(struct bpf_insn_aux_data) * (prog_len - off - cnt + 1)); -+ for (i = off; i < off + cnt - 1; i++) -+ new_data[i].seen = true; - env->insn_aux_data = new_data; - vfree(old_data); - return 0; -@@ -2152,6 +2182,25 @@ static struct bpf_prog *bpf_patch_insn_data(struct verifier_env *env, u32 off, - return new_prog; - } - -+/* The verifier does more data flow analysis than llvm and will not explore -+ * branches that are dead at run time. Malicious programs can have dead code -+ * too. Therefore replace all dead at-run-time code with nops. -+ */ -+static void sanitize_dead_code(struct verifier_env *env) -+{ -+ struct bpf_insn_aux_data *aux_data = env->insn_aux_data; -+ struct bpf_insn nop = BPF_MOV64_REG(BPF_REG_0, BPF_REG_0); -+ struct bpf_insn *insn = env->prog->insnsi; -+ const int insn_cnt = env->prog->len; -+ int i; -+ -+ for (i = 0; i < insn_cnt; i++) { -+ if (aux_data[i].seen) -+ continue; -+ memcpy(insn + i, &nop, sizeof(nop)); -+ } -+} -+ - /* convert load instructions that access fields of 'struct __sk_buff' - * into sequence of instructions that access fields of 'struct sk_buff' - */ -@@ -2218,6 +2267,24 @@ static int fixup_bpf_calls(struct verifier_env *env) - int i, cnt, delta = 0; - - for (i = 0; i < insn_cnt; i++, insn++) { -+ if (insn->code == (BPF_ALU | BPF_MOD | BPF_X) || -+ insn->code == (BPF_ALU | BPF_DIV | BPF_X)) { -+ /* due to JIT bugs clear upper 32-bits of src register -+ * before div/mod operation -+ */ -+ insn_buf[0] = BPF_MOV32_REG(insn->src_reg, insn->src_reg); -+ insn_buf[1] = *insn; -+ cnt = 2; -+ new_prog = bpf_patch_insn_data(env, i + delta, insn_buf, cnt); -+ if (!new_prog) -+ return -ENOMEM; -+ -+ delta += cnt - 1; -+ env->prog = prog = new_prog; -+ insn = new_prog->insnsi + i + delta; -+ continue; -+ } -+ - if (insn->code != (BPF_JMP | BPF_CALL)) - continue; - -@@ -2370,6 +2437,9 @@ skip_full_check: - while (pop_stack(env, NULL) >= 0); - free_states(env); - -+ if (ret == 0) -+ sanitize_dead_code(env); -+ - if (ret == 0) - /* program is valid, convert *(u32*)(ctx + off) accesses */ - ret = convert_ctx_accesses(env); -diff --git a/lib/test_bpf.c b/lib/test_bpf.c -index 7e26aea3e404..b7908d949a5f 100644 ---- a/lib/test_bpf.c -+++ b/lib/test_bpf.c -@@ -5304,9 +5304,8 @@ static struct bpf_prog *generate_filter(int which, int *err) - return NULL; - } - } -- /* We don't expect to fail. */ - if (*err) { -- pr_cont("FAIL to attach err=%d len=%d\n", -+ pr_cont("FAIL to prog_create err=%d len=%d\n", - *err, fprog.len); - return NULL; - } -@@ -5325,7 +5324,11 @@ static struct bpf_prog *generate_filter(int which, int *err) - fp->type = BPF_PROG_TYPE_SOCKET_FILTER; - memcpy(fp->insnsi, fptr, fp->len * sizeof(struct bpf_insn)); - -- bpf_prog_select_runtime(fp); -+ *err = bpf_prog_select_runtime(fp); -+ if (*err) { -+ pr_cont("FAIL to select_runtime err=%d\n", *err); -+ return NULL; -+ } - break; - } - -@@ -5511,8 +5514,8 @@ static __init int test_bpf(void) - pass_cnt++; - continue; - } -- -- return err; -+ err_cnt++; -+ continue; - } - - pr_cont("jited:%u ", fp->jited); -diff --git a/mm/kmemleak.c b/mm/kmemleak.c -index 19423a45d7d7..1914ab9009d9 100644 ---- a/mm/kmemleak.c -+++ b/mm/kmemleak.c -@@ -1394,6 +1394,8 @@ static void kmemleak_scan(void) - if (page_count(page) == 0) - continue; - scan_block(page, page + 1, NULL); -+ if (!(pfn % (MAX_SCAN_SIZE / sizeof(*page)))) -+ cond_resched(); - } - } - put_online_mems(); -diff --git a/net/Kconfig b/net/Kconfig -index 127da94ae25e..6d94140beacc 100644 ---- a/net/Kconfig -+++ b/net/Kconfig -@@ -388,3 +388,6 @@ endif # if NET - # Used by archs to tell that they support BPF_JIT - config HAVE_BPF_JIT - bool -+ -+config HAVE_EBPF_JIT -+ bool -diff --git a/net/core/filter.c b/net/core/filter.c -index e94355452166..1a9ded6af138 100644 ---- a/net/core/filter.c -+++ b/net/core/filter.c -@@ -430,6 +430,10 @@ do_pass: - convert_bpf_extensions(fp, &insn)) - break; - -+ if (fp->code == (BPF_ALU | BPF_DIV | BPF_X) || -+ fp->code == (BPF_ALU | BPF_MOD | BPF_X)) -+ *insn++ = BPF_MOV32_REG(BPF_REG_X, BPF_REG_X); -+ - *insn = BPF_RAW_INSN(fp->code, BPF_REG_A, BPF_REG_X, 0, fp->k); - break; - -@@ -984,7 +988,9 @@ static struct bpf_prog *bpf_migrate_filter(struct bpf_prog *fp) - */ - goto out_err_free; - -- bpf_prog_select_runtime(fp); -+ err = bpf_prog_select_runtime(fp); -+ if (err) -+ goto out_err_free; - - kfree(old_prog); - return fp; -diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c -index f5ef2115871f..6578a0a2f708 100644 ---- a/net/core/sysctl_net_core.c -+++ b/net/core/sysctl_net_core.c -@@ -292,7 +292,13 @@ static struct ctl_table net_core_table[] = { - .data = &bpf_jit_enable, - .maxlen = sizeof(int), - .mode = 0644, -+#ifndef CONFIG_BPF_JIT_ALWAYS_ON - .proc_handler = proc_dointvec -+#else -+ .proc_handler = proc_dointvec_minmax, -+ .extra1 = &one, -+ .extra2 = &one, -+#endif - }, - #endif - { -diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c -index c6be0b4f4058..e68a409fc351 100644 ---- a/net/mac80211/mesh_hwmp.c -+++ b/net/mac80211/mesh_hwmp.c -@@ -776,7 +776,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - struct mesh_path *mpath; - u8 ttl, flags, hopcount; - const u8 *orig_addr; -- u32 orig_sn, metric, metric_txsta, interval; -+ u32 orig_sn, new_metric, orig_metric, last_hop_metric, interval; - bool root_is_gate; - - ttl = rann->rann_ttl; -@@ -787,7 +787,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - interval = le32_to_cpu(rann->rann_interval); - hopcount = rann->rann_hopcount; - hopcount++; -- metric = le32_to_cpu(rann->rann_metric); -+ orig_metric = le32_to_cpu(rann->rann_metric); - - /* Ignore our own RANNs */ - if (ether_addr_equal(orig_addr, sdata->vif.addr)) -@@ -804,7 +804,10 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - return; - } - -- metric_txsta = airtime_link_metric_get(local, sta); -+ last_hop_metric = airtime_link_metric_get(local, sta); -+ new_metric = orig_metric + last_hop_metric; -+ if (new_metric < orig_metric) -+ new_metric = MAX_METRIC; - - mpath = mesh_path_lookup(sdata, orig_addr); - if (!mpath) { -@@ -817,7 +820,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - } - - if (!(SN_LT(mpath->sn, orig_sn)) && -- !(mpath->sn == orig_sn && metric < mpath->rann_metric)) { -+ !(mpath->sn == orig_sn && new_metric < mpath->rann_metric)) { - rcu_read_unlock(); - return; - } -@@ -835,7 +838,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - } - - mpath->sn = orig_sn; -- mpath->rann_metric = metric + metric_txsta; -+ mpath->rann_metric = new_metric; - mpath->is_root = true; - /* Recording RANNs sender address to send individually - * addressed PREQs destined for root mesh STA */ -@@ -855,7 +858,7 @@ static void hwmp_rann_frame_process(struct ieee80211_sub_if_data *sdata, - mesh_path_sel_frame_tx(MPATH_RANN, flags, orig_addr, - orig_sn, 0, NULL, 0, broadcast_addr, - hopcount, ttl, interval, -- metric + metric_txsta, 0, sdata); -+ new_metric, 0, sdata); - } - - rcu_read_unlock(); -diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c -index d26b28def310..21e4d339217e 100644 ---- a/net/openvswitch/flow_netlink.c -+++ b/net/openvswitch/flow_netlink.c -@@ -1672,14 +1672,11 @@ int ovs_nla_put_mask(const struct sw_flow *flow, struct sk_buff *skb) - - #define MAX_ACTIONS_BUFSIZE (32 * 1024) - --static struct sw_flow_actions *nla_alloc_flow_actions(int size, bool log) -+static struct sw_flow_actions *nla_alloc_flow_actions(int size) - { - struct sw_flow_actions *sfa; - -- if (size > MAX_ACTIONS_BUFSIZE) { -- OVS_NLERR(log, "Flow action size %u bytes exceeds max", size); -- return ERR_PTR(-EINVAL); -- } -+ WARN_ON_ONCE(size > MAX_ACTIONS_BUFSIZE); - - sfa = kmalloc(sizeof(*sfa) + size, GFP_KERNEL); - if (!sfa) -@@ -1752,12 +1749,15 @@ static struct nlattr *reserve_sfa_size(struct sw_flow_actions **sfa, - new_acts_size = ksize(*sfa) * 2; - - if (new_acts_size > MAX_ACTIONS_BUFSIZE) { -- if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) -+ if ((MAX_ACTIONS_BUFSIZE - next_offset) < req_size) { -+ OVS_NLERR(log, "Flow action size exceeds max %u", -+ MAX_ACTIONS_BUFSIZE); - return ERR_PTR(-EMSGSIZE); -+ } - new_acts_size = MAX_ACTIONS_BUFSIZE; - } - -- acts = nla_alloc_flow_actions(new_acts_size, log); -+ acts = nla_alloc_flow_actions(new_acts_size); - if (IS_ERR(acts)) - return (void *)acts; - -@@ -2369,7 +2369,7 @@ int ovs_nla_copy_actions(struct net *net, const struct nlattr *attr, - { - int err; - -- *sfa = nla_alloc_flow_actions(nla_len(attr), log); -+ *sfa = nla_alloc_flow_actions(min(nla_len(attr), MAX_ACTIONS_BUFSIZE)); - if (IS_ERR(*sfa)) - return PTR_ERR(*sfa); - -diff --git a/net/socket.c b/net/socket.c -index 2cf4f25f5c2b..5b31e5baf3b5 100644 ---- a/net/socket.c -+++ b/net/socket.c -@@ -2534,6 +2534,15 @@ out_fs: - - core_initcall(sock_init); /* early initcall */ - -+static int __init jit_init(void) -+{ -+#ifdef CONFIG_BPF_JIT_ALWAYS_ON -+ bpf_jit_enable = 1; -+#endif -+ return 0; -+} -+pure_initcall(jit_init); -+ - #ifdef CONFIG_PROC_FS - void socket_seq_show(struct seq_file *seq) - { -diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c -index 27b6f55fa43a..728d65fbab0c 100644 ---- a/net/sunrpc/xprtsock.c -+++ b/net/sunrpc/xprtsock.c -@@ -2360,6 +2360,7 @@ static void xs_tcp_setup_socket(struct work_struct *work) - case -ECONNREFUSED: - case -ECONNRESET: - case -ENETUNREACH: -+ case -EHOSTUNREACH: - case -EADDRINUSE: - case -ENOBUFS: - /* retry with existing socket, after a delay */ -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index 4b56c3b6c25f..3f370eb494d1 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -4032,6 +4032,8 @@ static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms) - struct lsm_network_audit net = {0,}; - u32 tsid = task_sid(task); - -+ if (!sksec) -+ return -EFAULT; - if (sksec->sid == SECINITSID_KERNEL) - return 0; - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index b36de76f24e2..7bb9fe7a2c8e 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -236,6 +236,7 @@ static struct snd_seq_client *seq_create_client1(int client_index, int poolsize) - rwlock_init(&client->ports_lock); - mutex_init(&client->ports_mutex); - INIT_LIST_HEAD(&client->ports_list_head); -+ mutex_init(&client->ioctl_mutex); - - /* find free slot in the client table */ - spin_lock_irqsave(&clients_lock, flags); -@@ -2195,6 +2196,7 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, - void __user *arg) - { - struct seq_ioctl_table *p; -+ int ret; - - switch (cmd) { - case SNDRV_SEQ_IOCTL_PVERSION: -@@ -2208,8 +2210,12 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, - if (! arg) - return -EFAULT; - for (p = ioctl_tables; p->cmd; p++) { -- if (p->cmd == cmd) -- return p->func(client, arg); -+ if (p->cmd == cmd) { -+ mutex_lock(&client->ioctl_mutex); -+ ret = p->func(client, arg); -+ mutex_unlock(&client->ioctl_mutex); -+ return ret; -+ } - } - pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", - cmd, _IOC_TYPE(cmd), _IOC_NR(cmd)); -diff --git a/sound/core/seq/seq_clientmgr.h b/sound/core/seq/seq_clientmgr.h -index 20f0a725ec7d..91f8f165bfdc 100644 ---- a/sound/core/seq/seq_clientmgr.h -+++ b/sound/core/seq/seq_clientmgr.h -@@ -59,6 +59,7 @@ struct snd_seq_client { - struct list_head ports_list_head; - rwlock_t ports_lock; - struct mutex ports_mutex; -+ struct mutex ioctl_mutex; - int convert32; /* convert 32->64bit */ - - /* output pool */ -diff --git a/tools/usb/usbip/src/usbip_bind.c b/tools/usb/usbip/src/usbip_bind.c -index fa46141ae68b..e121cfb1746a 100644 ---- a/tools/usb/usbip/src/usbip_bind.c -+++ b/tools/usb/usbip/src/usbip_bind.c -@@ -144,6 +144,7 @@ static int bind_device(char *busid) - int rc; - struct udev *udev; - struct udev_device *dev; -+ const char *devpath; - - /* Check whether the device with this bus ID exists. */ - udev = udev_new(); -@@ -152,8 +153,16 @@ static int bind_device(char *busid) - err("device with the specified bus ID does not exist"); - return -1; - } -+ devpath = udev_device_get_devpath(dev); - udev_unref(udev); - -+ /* If the device is already attached to vhci_hcd - bail out */ -+ if (strstr(devpath, USBIP_VHCI_DRV_NAME)) { -+ err("bind loop detected: device: %s is attached to %s\n", -+ devpath, USBIP_VHCI_DRV_NAME); -+ return -1; -+ } -+ - rc = unbind_other(busid); - if (rc == UNBIND_ST_FAILED) { - err("could not unbind driver from device on busid %s", busid); -diff --git a/tools/usb/usbip/src/usbip_list.c b/tools/usb/usbip/src/usbip_list.c -index d5ce34a410e7..ac6081c3db82 100644 ---- a/tools/usb/usbip/src/usbip_list.c -+++ b/tools/usb/usbip/src/usbip_list.c -@@ -180,6 +180,7 @@ static int list_devices(bool parsable) - const char *busid; - char product_name[128]; - int ret = -1; -+ const char *devpath; - - /* Create libudev context. */ - udev = udev_new(); -@@ -202,6 +203,14 @@ static int list_devices(bool parsable) - path = udev_list_entry_get_name(dev_list_entry); - dev = udev_device_new_from_syspath(udev, path); - -+ /* Ignore devices attached to vhci_hcd */ -+ devpath = udev_device_get_devpath(dev); -+ if (strstr(devpath, USBIP_VHCI_DRV_NAME)) { -+ dbg("Skip the device %s already attached to %s\n", -+ devpath, USBIP_VHCI_DRV_NAME); -+ continue; -+ } -+ - /* Get device information. */ - idVendor = udev_device_get_sysattr_value(dev, "idVendor"); - idProduct = udev_device_get_sysattr_value(dev, "idProduct"); diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.115-116.patch b/patch/kernel/mvebu64-default/04-patch-4.4.115-116.patch deleted file mode 100644 index e3d5b51dd071..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.115-116.patch +++ /dev/null @@ -1,5357 +0,0 @@ -diff --git a/Makefile b/Makefile -index 9c60120dd9fd..71acaecd7899 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 115 -+SUBLEVEL = 116 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/alpha/kernel/pci_impl.h b/arch/alpha/kernel/pci_impl.h -index 2b0ac429f5eb..412bb3c24f36 100644 ---- a/arch/alpha/kernel/pci_impl.h -+++ b/arch/alpha/kernel/pci_impl.h -@@ -143,7 +143,8 @@ struct pci_iommu_arena - }; - - #if defined(CONFIG_ALPHA_SRM) && \ -- (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA)) -+ (defined(CONFIG_ALPHA_CIA) || defined(CONFIG_ALPHA_LCA) || \ -+ defined(CONFIG_ALPHA_AVANTI)) - # define NEED_SRM_SAVE_RESTORE - #else - # undef NEED_SRM_SAVE_RESTORE -diff --git a/arch/alpha/kernel/process.c b/arch/alpha/kernel/process.c -index 84d13263ce46..8095fb2c5c94 100644 ---- a/arch/alpha/kernel/process.c -+++ b/arch/alpha/kernel/process.c -@@ -273,12 +273,13 @@ copy_thread(unsigned long clone_flags, unsigned long usp, - application calling fork. */ - if (clone_flags & CLONE_SETTLS) - childti->pcb.unique = regs->r20; -+ else -+ regs->r20 = 0; /* OSF/1 has some strange fork() semantics. */ - childti->pcb.usp = usp ?: rdusp(); - *childregs = *regs; - childregs->r0 = 0; - childregs->r19 = 0; - childregs->r20 = 1; /* OSF/1 has some strange fork() semantics. */ -- regs->r20 = 0; - stack = ((struct switch_stack *) regs) - 1; - *childstack = *stack; - childstack->r26 = (unsigned long) ret_from_fork; -diff --git a/arch/arm/kvm/handle_exit.c b/arch/arm/kvm/handle_exit.c -index f36b5b1acd1f..05b2f8294968 100644 ---- a/arch/arm/kvm/handle_exit.c -+++ b/arch/arm/kvm/handle_exit.c -@@ -45,7 +45,7 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) - - ret = kvm_psci_call(vcpu); - if (ret < 0) { -- kvm_inject_undefined(vcpu); -+ vcpu_set_reg(vcpu, 0, ~0UL); - return 1; - } - -@@ -54,7 +54,16 @@ static int handle_hvc(struct kvm_vcpu *vcpu, struct kvm_run *run) - - static int handle_smc(struct kvm_vcpu *vcpu, struct kvm_run *run) - { -- kvm_inject_undefined(vcpu); -+ /* -+ * "If an SMC instruction executed at Non-secure EL1 is -+ * trapped to EL2 because HCR_EL2.TSC is 1, the exception is a -+ * Trap exception, not a Secure Monitor Call exception [...]" -+ * -+ * We need to advance the PC after the trap, as it would -+ * otherwise return to the same address... -+ */ -+ vcpu_set_reg(vcpu, 0, ~0UL); -+ kvm_skip_instr(vcpu, kvm_vcpu_trap_il_is32bit(vcpu)); - return 1; - } - -diff --git a/arch/mn10300/mm/misalignment.c b/arch/mn10300/mm/misalignment.c -index b9920b1edd5a..70cef54dc40f 100644 ---- a/arch/mn10300/mm/misalignment.c -+++ b/arch/mn10300/mm/misalignment.c -@@ -437,7 +437,7 @@ transfer_failed: - - info.si_signo = SIGSEGV; - info.si_errno = 0; -- info.si_code = 0; -+ info.si_code = SEGV_MAPERR; - info.si_addr = (void *) regs->pc; - force_sig_info(SIGSEGV, &info, current); - return; -diff --git a/arch/openrisc/kernel/traps.c b/arch/openrisc/kernel/traps.c -index 3d3f6062f49c..605a284922fb 100644 ---- a/arch/openrisc/kernel/traps.c -+++ b/arch/openrisc/kernel/traps.c -@@ -302,12 +302,12 @@ asmlinkage void do_unaligned_access(struct pt_regs *regs, unsigned long address) - siginfo_t info; - - if (user_mode(regs)) { -- /* Send a SIGSEGV */ -- info.si_signo = SIGSEGV; -+ /* Send a SIGBUS */ -+ info.si_signo = SIGBUS; - info.si_errno = 0; -- /* info.si_code has been set above */ -- info.si_addr = (void *)address; -- force_sig_info(SIGSEGV, &info, current); -+ info.si_code = BUS_ADRALN; -+ info.si_addr = (void __user *)address; -+ force_sig_info(SIGBUS, &info, current); - } else { - printk("KERNEL: Unaligned Access 0x%.8lx\n", address); - show_registers(regs); -diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig -index dfb1ee8c3e06..58a1fa979655 100644 ---- a/arch/powerpc/Kconfig -+++ b/arch/powerpc/Kconfig -@@ -129,13 +129,14 @@ config PPC - select IRQ_FORCED_THREADING - select HAVE_RCU_TABLE_FREE if SMP - select HAVE_SYSCALL_TRACEPOINTS -- select HAVE_BPF_JIT -+ select HAVE_BPF_JIT if CPU_BIG_ENDIAN - select HAVE_ARCH_JUMP_LABEL - select ARCH_HAVE_NMI_SAFE_CMPXCHG - select ARCH_HAS_GCOV_PROFILE_ALL - select GENERIC_SMP_IDLE_THREAD - select GENERIC_CMOS_UPDATE - select GENERIC_TIME_VSYSCALL_OLD -+ select GENERIC_CPU_VULNERABILITIES if PPC_BOOK3S_64 - select GENERIC_CLOCKEVENTS - select GENERIC_CLOCKEVENTS_BROADCAST if SMP - select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST -diff --git a/arch/powerpc/include/asm/exception-64e.h b/arch/powerpc/include/asm/exception-64e.h -index a703452d67b6..555e22d5e07f 100644 ---- a/arch/powerpc/include/asm/exception-64e.h -+++ b/arch/powerpc/include/asm/exception-64e.h -@@ -209,5 +209,11 @@ exc_##label##_book3e: - ori r3,r3,vector_offset@l; \ - mtspr SPRN_IVOR##vector_number,r3; - -+#define RFI_TO_KERNEL \ -+ rfi -+ -+#define RFI_TO_USER \ -+ rfi -+ - #endif /* _ASM_POWERPC_EXCEPTION_64E_H */ - -diff --git a/arch/powerpc/include/asm/exception-64s.h b/arch/powerpc/include/asm/exception-64s.h -index 77f52b26dad6..9bddbec441b8 100644 ---- a/arch/powerpc/include/asm/exception-64s.h -+++ b/arch/powerpc/include/asm/exception-64s.h -@@ -50,6 +50,59 @@ - #define EX_PPR 88 /* SMT thread status register (priority) */ - #define EX_CTR 96 - -+/* -+ * Macros for annotating the expected destination of (h)rfid -+ * -+ * The nop instructions allow us to insert one or more instructions to flush the -+ * L1-D cache when returning to userspace or a guest. -+ */ -+#define RFI_FLUSH_SLOT \ -+ RFI_FLUSH_FIXUP_SECTION; \ -+ nop; \ -+ nop; \ -+ nop -+ -+#define RFI_TO_KERNEL \ -+ rfid -+ -+#define RFI_TO_USER \ -+ RFI_FLUSH_SLOT; \ -+ rfid; \ -+ b rfi_flush_fallback -+ -+#define RFI_TO_USER_OR_KERNEL \ -+ RFI_FLUSH_SLOT; \ -+ rfid; \ -+ b rfi_flush_fallback -+ -+#define RFI_TO_GUEST \ -+ RFI_FLUSH_SLOT; \ -+ rfid; \ -+ b rfi_flush_fallback -+ -+#define HRFI_TO_KERNEL \ -+ hrfid -+ -+#define HRFI_TO_USER \ -+ RFI_FLUSH_SLOT; \ -+ hrfid; \ -+ b hrfi_flush_fallback -+ -+#define HRFI_TO_USER_OR_KERNEL \ -+ RFI_FLUSH_SLOT; \ -+ hrfid; \ -+ b hrfi_flush_fallback -+ -+#define HRFI_TO_GUEST \ -+ RFI_FLUSH_SLOT; \ -+ hrfid; \ -+ b hrfi_flush_fallback -+ -+#define HRFI_TO_UNKNOWN \ -+ RFI_FLUSH_SLOT; \ -+ hrfid; \ -+ b hrfi_flush_fallback -+ - #ifdef CONFIG_RELOCATABLE - #define __EXCEPTION_RELON_PROLOG_PSERIES_1(label, h) \ - ld r12,PACAKBASE(r13); /* get high part of &label */ \ -@@ -191,7 +244,7 @@ END_FTR_SECTION_NESTED(ftr,ftr,943) - mtspr SPRN_##h##SRR0,r12; \ - mfspr r12,SPRN_##h##SRR1; /* and SRR1 */ \ - mtspr SPRN_##h##SRR1,r10; \ -- h##rfid; \ -+ h##RFI_TO_KERNEL; \ - b . /* prevent speculative execution */ - #define EXCEPTION_PROLOG_PSERIES_1(label, h) \ - __EXCEPTION_PROLOG_PSERIES_1(label, h) -diff --git a/arch/powerpc/include/asm/feature-fixups.h b/arch/powerpc/include/asm/feature-fixups.h -index 9a67a38bf7b9..7068bafbb2d6 100644 ---- a/arch/powerpc/include/asm/feature-fixups.h -+++ b/arch/powerpc/include/asm/feature-fixups.h -@@ -184,4 +184,19 @@ label##3: \ - FTR_ENTRY_OFFSET label##1b-label##3b; \ - .popsection; - -+#define RFI_FLUSH_FIXUP_SECTION \ -+951: \ -+ .pushsection __rfi_flush_fixup,"a"; \ -+ .align 2; \ -+952: \ -+ FTR_ENTRY_OFFSET 951b-952b; \ -+ .popsection; -+ -+ -+#ifndef __ASSEMBLY__ -+ -+extern long __start___rfi_flush_fixup, __stop___rfi_flush_fixup; -+ -+#endif -+ - #endif /* __ASM_POWERPC_FEATURE_FIXUPS_H */ -diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h -index 85bc8c0d257b..449bbb87c257 100644 ---- a/arch/powerpc/include/asm/hvcall.h -+++ b/arch/powerpc/include/asm/hvcall.h -@@ -239,6 +239,7 @@ - #define H_GET_HCA_INFO 0x1B8 - #define H_GET_PERF_COUNT 0x1BC - #define H_MANAGE_TRACE 0x1C0 -+#define H_GET_CPU_CHARACTERISTICS 0x1C8 - #define H_FREE_LOGICAL_LAN_BUFFER 0x1D4 - #define H_QUERY_INT_STATE 0x1E4 - #define H_POLL_PENDING 0x1D8 -@@ -285,7 +286,19 @@ - #define H_SET_MODE_RESOURCE_ADDR_TRANS_MODE 3 - #define H_SET_MODE_RESOURCE_LE 4 - -+/* H_GET_CPU_CHARACTERISTICS return values */ -+#define H_CPU_CHAR_SPEC_BAR_ORI31 (1ull << 63) // IBM bit 0 -+#define H_CPU_CHAR_BCCTRL_SERIALISED (1ull << 62) // IBM bit 1 -+#define H_CPU_CHAR_L1D_FLUSH_ORI30 (1ull << 61) // IBM bit 2 -+#define H_CPU_CHAR_L1D_FLUSH_TRIG2 (1ull << 60) // IBM bit 3 -+#define H_CPU_CHAR_L1D_THREAD_PRIV (1ull << 59) // IBM bit 4 -+ -+#define H_CPU_BEHAV_FAVOUR_SECURITY (1ull << 63) // IBM bit 0 -+#define H_CPU_BEHAV_L1D_FLUSH_PR (1ull << 62) // IBM bit 1 -+#define H_CPU_BEHAV_BNDS_CHK_SPEC_BAR (1ull << 61) // IBM bit 2 -+ - #ifndef __ASSEMBLY__ -+#include - - /** - * plpar_hcall_norets: - Make a pseries hypervisor call with no return arguments -@@ -423,6 +436,11 @@ extern long pseries_big_endian_exceptions(void); - - #endif /* CONFIG_PPC_PSERIES */ - -+struct h_cpu_char_result { -+ u64 character; -+ u64 behaviour; -+}; -+ - #endif /* __ASSEMBLY__ */ - #endif /* __KERNEL__ */ - #endif /* _ASM_POWERPC_HVCALL_H */ -diff --git a/arch/powerpc/include/asm/paca.h b/arch/powerpc/include/asm/paca.h -index 70bd4381f8e6..45e2aefece16 100644 ---- a/arch/powerpc/include/asm/paca.h -+++ b/arch/powerpc/include/asm/paca.h -@@ -192,6 +192,16 @@ struct paca_struct { - #endif - struct kvmppc_host_state kvm_hstate; - #endif -+#ifdef CONFIG_PPC_BOOK3S_64 -+ /* -+ * rfi fallback flush must be in its own cacheline to prevent -+ * other paca data leaking into the L1d -+ */ -+ u64 exrfi[13] __aligned(0x80); -+ void *rfi_flush_fallback_area; -+ u64 l1d_flush_congruence; -+ u64 l1d_flush_sets; -+#endif - }; - - extern struct paca_struct *paca; -diff --git a/arch/powerpc/include/asm/plpar_wrappers.h b/arch/powerpc/include/asm/plpar_wrappers.h -index 67859edbf8fd..6e05cb397a5c 100644 ---- a/arch/powerpc/include/asm/plpar_wrappers.h -+++ b/arch/powerpc/include/asm/plpar_wrappers.h -@@ -323,4 +323,18 @@ static inline long plapr_set_watchpoint0(unsigned long dawr0, unsigned long dawr - return plpar_set_mode(0, H_SET_MODE_RESOURCE_SET_DAWR, dawr0, dawrx0); - } - -+static inline long plpar_get_cpu_characteristics(struct h_cpu_char_result *p) -+{ -+ unsigned long retbuf[PLPAR_HCALL_BUFSIZE]; -+ long rc; -+ -+ rc = plpar_hcall(H_GET_CPU_CHARACTERISTICS, retbuf); -+ if (rc == H_SUCCESS) { -+ p->character = retbuf[0]; -+ p->behaviour = retbuf[1]; -+ } -+ -+ return rc; -+} -+ - #endif /* _ASM_POWERPC_PLPAR_WRAPPERS_H */ -diff --git a/arch/powerpc/include/asm/ppc_asm.h b/arch/powerpc/include/asm/ppc_asm.h -index dd0fc18d8103..160bb2311bbb 100644 ---- a/arch/powerpc/include/asm/ppc_asm.h -+++ b/arch/powerpc/include/asm/ppc_asm.h -@@ -224,6 +224,16 @@ name: \ - .globl name; \ - name: - -+#define _KPROBE_TOC(name) \ -+ .section ".kprobes.text","a"; \ -+ .align 2 ; \ -+ .type name,@function; \ -+ .globl name; \ -+name: \ -+0: addis r2,r12,(.TOC.-0b)@ha; \ -+ addi r2,r2,(.TOC.-0b)@l; \ -+ .localentry name,.-name -+ - #define DOTSYM(a) a - - #else -@@ -261,6 +271,8 @@ name: \ - .type GLUE(.,name),@function; \ - GLUE(.,name): - -+#define _KPROBE_TOC(n) _KPROBE(n) -+ - #define DOTSYM(a) GLUE(.,a) - - #endif -diff --git a/arch/powerpc/include/asm/setup.h b/arch/powerpc/include/asm/setup.h -index e9d384cbd021..7916b56f2e60 100644 ---- a/arch/powerpc/include/asm/setup.h -+++ b/arch/powerpc/include/asm/setup.h -@@ -26,6 +26,19 @@ void initmem_init(void); - void setup_panic(void); - #define ARCH_PANIC_TIMEOUT 180 - -+void rfi_flush_enable(bool enable); -+ -+/* These are bit flags */ -+enum l1d_flush_type { -+ L1D_FLUSH_NONE = 0x1, -+ L1D_FLUSH_FALLBACK = 0x2, -+ L1D_FLUSH_ORI = 0x4, -+ L1D_FLUSH_MTTRIG = 0x8, -+}; -+ -+void __init setup_rfi_flush(enum l1d_flush_type, bool enable); -+void do_rfi_flush_fixups(enum l1d_flush_type types); -+ - #endif /* !__ASSEMBLY__ */ - - #endif /* _ASM_POWERPC_SETUP_H */ -diff --git a/arch/powerpc/kernel/asm-offsets.c b/arch/powerpc/kernel/asm-offsets.c -index 40da69163d51..d92705e3a0c1 100644 ---- a/arch/powerpc/kernel/asm-offsets.c -+++ b/arch/powerpc/kernel/asm-offsets.c -@@ -243,6 +243,10 @@ int main(void) - #ifdef CONFIG_PPC_BOOK3S_64 - DEFINE(PACAMCEMERGSP, offsetof(struct paca_struct, mc_emergency_sp)); - DEFINE(PACA_IN_MCE, offsetof(struct paca_struct, in_mce)); -+ DEFINE(PACA_RFI_FLUSH_FALLBACK_AREA, offsetof(struct paca_struct, rfi_flush_fallback_area)); -+ DEFINE(PACA_EXRFI, offsetof(struct paca_struct, exrfi)); -+ DEFINE(PACA_L1D_FLUSH_CONGRUENCE, offsetof(struct paca_struct, l1d_flush_congruence)); -+ DEFINE(PACA_L1D_FLUSH_SETS, offsetof(struct paca_struct, l1d_flush_sets)); - #endif - DEFINE(PACAHWCPUID, offsetof(struct paca_struct, hw_cpu_id)); - DEFINE(PACAKEXECSTATE, offsetof(struct paca_struct, kexec_state)); -diff --git a/arch/powerpc/kernel/entry_64.S b/arch/powerpc/kernel/entry_64.S -index f6fd0332c3a2..2837232bbffb 100644 ---- a/arch/powerpc/kernel/entry_64.S -+++ b/arch/powerpc/kernel/entry_64.S -@@ -36,6 +36,11 @@ - #include - #include - #include -+#ifdef CONFIG_PPC_BOOK3S -+#include -+#else -+#include -+#endif - - /* - * System calls. -@@ -225,13 +230,23 @@ END_FTR_SECTION_IFCLR(CPU_FTR_STCX_CHECKS_ADDRESS) - ACCOUNT_CPU_USER_EXIT(r11, r12) - HMT_MEDIUM_LOW_HAS_PPR - ld r13,GPR13(r1) /* only restore r13 if returning to usermode */ -+ ld r2,GPR2(r1) -+ ld r1,GPR1(r1) -+ mtlr r4 -+ mtcr r5 -+ mtspr SPRN_SRR0,r7 -+ mtspr SPRN_SRR1,r8 -+ RFI_TO_USER -+ b . /* prevent speculative execution */ -+ -+ /* exit to kernel */ - 1: ld r2,GPR2(r1) - ld r1,GPR1(r1) - mtlr r4 - mtcr r5 - mtspr SPRN_SRR0,r7 - mtspr SPRN_SRR1,r8 -- RFI -+ RFI_TO_KERNEL - b . /* prevent speculative execution */ - - syscall_error: -@@ -353,8 +368,7 @@ tabort_syscall: - mtmsrd r10, 1 - mtspr SPRN_SRR0, r11 - mtspr SPRN_SRR1, r12 -- -- rfid -+ RFI_TO_USER - b . /* prevent speculative execution */ - #endif - -@@ -887,7 +901,7 @@ BEGIN_FTR_SECTION - END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) - ACCOUNT_CPU_USER_EXIT(r2, r4) - REST_GPR(13, r1) --1: -+ - mtspr SPRN_SRR1,r3 - - ld r2,_CCR(r1) -@@ -900,8 +914,22 @@ END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) - ld r3,GPR3(r1) - ld r4,GPR4(r1) - ld r1,GPR1(r1) -+ RFI_TO_USER -+ b . /* prevent speculative execution */ - -- rfid -+1: mtspr SPRN_SRR1,r3 -+ -+ ld r2,_CCR(r1) -+ mtcrf 0xFF,r2 -+ ld r2,_NIP(r1) -+ mtspr SPRN_SRR0,r2 -+ -+ ld r0,GPR0(r1) -+ ld r2,GPR2(r1) -+ ld r3,GPR3(r1) -+ ld r4,GPR4(r1) -+ ld r1,GPR1(r1) -+ RFI_TO_KERNEL - b . /* prevent speculative execution */ - - #endif /* CONFIG_PPC_BOOK3E */ -@@ -1077,7 +1105,7 @@ _GLOBAL(enter_rtas) - - mtspr SPRN_SRR0,r5 - mtspr SPRN_SRR1,r6 -- rfid -+ RFI_TO_KERNEL - b . /* prevent speculative execution */ - - rtas_return_loc: -@@ -1102,7 +1130,7 @@ rtas_return_loc: - - mtspr SPRN_SRR0,r3 - mtspr SPRN_SRR1,r4 -- rfid -+ RFI_TO_KERNEL - b . /* prevent speculative execution */ - - .align 3 -@@ -1173,7 +1201,7 @@ _GLOBAL(enter_prom) - LOAD_REG_IMMEDIATE(r12, MSR_SF | MSR_ISF | MSR_LE) - andc r11,r11,r12 - mtsrr1 r11 -- rfid -+ RFI_TO_KERNEL - #endif /* CONFIG_PPC_BOOK3E */ - - 1: /* Return from OF */ -diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S -index b81ccc5fb32d..938a30fef031 100644 ---- a/arch/powerpc/kernel/exceptions-64s.S -+++ b/arch/powerpc/kernel/exceptions-64s.S -@@ -46,7 +46,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE) \ - mtspr SPRN_SRR0,r10 ; \ - ld r10,PACAKMSR(r13) ; \ - mtspr SPRN_SRR1,r10 ; \ -- rfid ; \ -+ RFI_TO_KERNEL ; \ - b . ; /* prevent speculative execution */ - - #define SYSCALL_PSERIES_3 \ -@@ -54,7 +54,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_REAL_LE) \ - 1: mfspr r12,SPRN_SRR1 ; \ - xori r12,r12,MSR_LE ; \ - mtspr SPRN_SRR1,r12 ; \ -- rfid ; /* return to userspace */ \ -+ RFI_TO_USER ; /* return to userspace */ \ - b . ; /* prevent speculative execution */ - - #if defined(CONFIG_RELOCATABLE) -@@ -507,7 +507,7 @@ BEGIN_FTR_SECTION - LOAD_HANDLER(r12, machine_check_handle_early) - 1: mtspr SPRN_SRR0,r12 - mtspr SPRN_SRR1,r11 -- rfid -+ RFI_TO_KERNEL - b . /* prevent speculative execution */ - 2: - /* Stack overflow. Stay on emergency stack and panic. -@@ -601,7 +601,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_CFAR) - ld r11,PACA_EXGEN+EX_R11(r13) - ld r12,PACA_EXGEN+EX_R12(r13) - ld r13,PACA_EXGEN+EX_R13(r13) -- HRFID -+ HRFI_TO_UNKNOWN - b . - #endif - -@@ -666,7 +666,7 @@ masked_##_H##interrupt: \ - ld r10,PACA_EXGEN+EX_R10(r13); \ - ld r11,PACA_EXGEN+EX_R11(r13); \ - GET_SCRATCH0(r13); \ -- ##_H##rfid; \ -+ ##_H##RFI_TO_KERNEL; \ - b . - - MASKED_INTERRUPT() -@@ -756,7 +756,7 @@ kvmppc_skip_interrupt: - addi r13, r13, 4 - mtspr SPRN_SRR0, r13 - GET_SCRATCH0(r13) -- rfid -+ RFI_TO_KERNEL - b . - - kvmppc_skip_Hinterrupt: -@@ -768,7 +768,7 @@ kvmppc_skip_Hinterrupt: - addi r13, r13, 4 - mtspr SPRN_HSRR0, r13 - GET_SCRATCH0(r13) -- hrfid -+ HRFI_TO_KERNEL - b . - #endif - -@@ -1439,7 +1439,7 @@ machine_check_handle_early: - li r3,MSR_ME - andc r10,r10,r3 /* Turn off MSR_ME */ - mtspr SPRN_SRR1,r10 -- rfid -+ RFI_TO_KERNEL - b . - 2: - /* -@@ -1457,7 +1457,7 @@ machine_check_handle_early: - */ - bl machine_check_queue_event - MACHINE_CHECK_HANDLER_WINDUP -- rfid -+ RFI_TO_USER_OR_KERNEL - 9: - /* Deliver the machine check to host kernel in V mode. */ - MACHINE_CHECK_HANDLER_WINDUP -@@ -1503,6 +1503,8 @@ slb_miss_realmode: - - andi. r10,r12,MSR_RI /* check for unrecoverable exception */ - beq- 2f -+ andi. r10,r12,MSR_PR /* check for user mode (PR != 0) */ -+ bne 1f - - .machine push - .machine "power4" -@@ -1516,7 +1518,23 @@ slb_miss_realmode: - ld r11,PACA_EXSLB+EX_R11(r13) - ld r12,PACA_EXSLB+EX_R12(r13) - ld r13,PACA_EXSLB+EX_R13(r13) -- rfid -+ RFI_TO_KERNEL -+ b . /* prevent speculative execution */ -+ -+1: -+.machine push -+.machine "power4" -+ mtcrf 0x80,r9 -+ mtcrf 0x01,r9 /* slb_allocate uses cr0 and cr7 */ -+.machine pop -+ -+ RESTORE_PPR_PACA(PACA_EXSLB, r9) -+ ld r9,PACA_EXSLB+EX_R9(r13) -+ ld r10,PACA_EXSLB+EX_R10(r13) -+ ld r11,PACA_EXSLB+EX_R11(r13) -+ ld r12,PACA_EXSLB+EX_R12(r13) -+ ld r13,PACA_EXSLB+EX_R13(r13) -+ RFI_TO_USER - b . /* prevent speculative execution */ - - 2: mfspr r11,SPRN_SRR0 -@@ -1525,7 +1543,7 @@ slb_miss_realmode: - mtspr SPRN_SRR0,r10 - ld r10,PACAKMSR(r13) - mtspr SPRN_SRR1,r10 -- rfid -+ RFI_TO_KERNEL - b . - - unrecov_slb: -@@ -1546,6 +1564,92 @@ power4_fixup_nap: - blr - #endif - -+ .globl rfi_flush_fallback -+rfi_flush_fallback: -+ SET_SCRATCH0(r13); -+ GET_PACA(r13); -+ std r9,PACA_EXRFI+EX_R9(r13) -+ std r10,PACA_EXRFI+EX_R10(r13) -+ std r11,PACA_EXRFI+EX_R11(r13) -+ std r12,PACA_EXRFI+EX_R12(r13) -+ std r8,PACA_EXRFI+EX_R13(r13) -+ mfctr r9 -+ ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) -+ ld r11,PACA_L1D_FLUSH_SETS(r13) -+ ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) -+ /* -+ * The load adresses are at staggered offsets within cachelines, -+ * which suits some pipelines better (on others it should not -+ * hurt). -+ */ -+ addi r12,r12,8 -+ mtctr r11 -+ DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ -+ -+ /* order ld/st prior to dcbt stop all streams with flushing */ -+ sync -+1: li r8,0 -+ .rept 8 /* 8-way set associative */ -+ ldx r11,r10,r8 -+ add r8,r8,r12 -+ xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not -+ add r8,r8,r11 // Add 0, this creates a dependency on the ldx -+ .endr -+ addi r10,r10,128 /* 128 byte cache line */ -+ bdnz 1b -+ -+ mtctr r9 -+ ld r9,PACA_EXRFI+EX_R9(r13) -+ ld r10,PACA_EXRFI+EX_R10(r13) -+ ld r11,PACA_EXRFI+EX_R11(r13) -+ ld r12,PACA_EXRFI+EX_R12(r13) -+ ld r8,PACA_EXRFI+EX_R13(r13) -+ GET_SCRATCH0(r13); -+ rfid -+ -+ .globl hrfi_flush_fallback -+hrfi_flush_fallback: -+ SET_SCRATCH0(r13); -+ GET_PACA(r13); -+ std r9,PACA_EXRFI+EX_R9(r13) -+ std r10,PACA_EXRFI+EX_R10(r13) -+ std r11,PACA_EXRFI+EX_R11(r13) -+ std r12,PACA_EXRFI+EX_R12(r13) -+ std r8,PACA_EXRFI+EX_R13(r13) -+ mfctr r9 -+ ld r10,PACA_RFI_FLUSH_FALLBACK_AREA(r13) -+ ld r11,PACA_L1D_FLUSH_SETS(r13) -+ ld r12,PACA_L1D_FLUSH_CONGRUENCE(r13) -+ /* -+ * The load adresses are at staggered offsets within cachelines, -+ * which suits some pipelines better (on others it should not -+ * hurt). -+ */ -+ addi r12,r12,8 -+ mtctr r11 -+ DCBT_STOP_ALL_STREAM_IDS(r11) /* Stop prefetch streams */ -+ -+ /* order ld/st prior to dcbt stop all streams with flushing */ -+ sync -+1: li r8,0 -+ .rept 8 /* 8-way set associative */ -+ ldx r11,r10,r8 -+ add r8,r8,r12 -+ xor r11,r11,r11 // Ensure r11 is 0 even if fallback area is not -+ add r8,r8,r11 // Add 0, this creates a dependency on the ldx -+ .endr -+ addi r10,r10,128 /* 128 byte cache line */ -+ bdnz 1b -+ -+ mtctr r9 -+ ld r9,PACA_EXRFI+EX_R9(r13) -+ ld r10,PACA_EXRFI+EX_R10(r13) -+ ld r11,PACA_EXRFI+EX_R11(r13) -+ ld r12,PACA_EXRFI+EX_R12(r13) -+ ld r8,PACA_EXRFI+EX_R13(r13) -+ GET_SCRATCH0(r13); -+ hrfid -+ - /* - * Hash table stuff - */ -diff --git a/arch/powerpc/kernel/misc_64.S b/arch/powerpc/kernel/misc_64.S -index db475d41b57a..107588295b39 100644 ---- a/arch/powerpc/kernel/misc_64.S -+++ b/arch/powerpc/kernel/misc_64.S -@@ -66,7 +66,7 @@ PPC64_CACHES: - * flush all bytes from start through stop-1 inclusive - */ - --_KPROBE(flush_icache_range) -+_KPROBE_TOC(flush_icache_range) - BEGIN_FTR_SECTION - PURGE_PREFETCHED_INS - blr -@@ -117,7 +117,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_COHERENT_ICACHE) - * - * flush all bytes from start to stop-1 inclusive - */ --_GLOBAL(flush_dcache_range) -+_GLOBAL_TOC(flush_dcache_range) - - /* - * Flush the data cache to memory -@@ -701,31 +701,3 @@ _GLOBAL(kexec_sequence) - li r5,0 - blr /* image->start(physid, image->start, 0); */ - #endif /* CONFIG_KEXEC */ -- --#ifdef CONFIG_MODULES --#if defined(_CALL_ELF) && _CALL_ELF == 2 -- --#ifdef CONFIG_MODVERSIONS --.weak __crc_TOC. --.section "___kcrctab+TOC.","a" --.globl __kcrctab_TOC. --__kcrctab_TOC.: -- .llong __crc_TOC. --#endif -- --/* -- * Export a fake .TOC. since both modpost and depmod will complain otherwise. -- * Both modpost and depmod strip the leading . so we do the same here. -- */ --.section "__ksymtab_strings","a" --__kstrtab_TOC.: -- .asciz "TOC." -- --.section "___ksymtab+TOC.","a" --/* This symbol name is important: it's used by modpost to find exported syms */ --.globl __ksymtab_TOC. --__ksymtab_TOC.: -- .llong 0 /* .value */ -- .llong __kstrtab_TOC. --#endif /* ELFv2 */ --#endif /* MODULES */ -diff --git a/arch/powerpc/kernel/module_64.c b/arch/powerpc/kernel/module_64.c -index e4f7d4eed20c..08b7a40de5f8 100644 ---- a/arch/powerpc/kernel/module_64.c -+++ b/arch/powerpc/kernel/module_64.c -@@ -326,7 +326,10 @@ static void dedotify_versions(struct modversion_info *vers, - } - } - --/* Undefined symbols which refer to .funcname, hack to funcname (or .TOC.) */ -+/* -+ * Undefined symbols which refer to .funcname, hack to funcname. Make .TOC. -+ * seem to be defined (value set later). -+ */ - static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) - { - unsigned int i; -@@ -334,8 +337,11 @@ static void dedotify(Elf64_Sym *syms, unsigned int numsyms, char *strtab) - for (i = 1; i < numsyms; i++) { - if (syms[i].st_shndx == SHN_UNDEF) { - char *name = strtab + syms[i].st_name; -- if (name[0] == '.') -+ if (name[0] == '.') { -+ if (strcmp(name+1, "TOC.") == 0) -+ syms[i].st_shndx = SHN_ABS; - syms[i].st_name++; -+ } - } - } - } -@@ -351,7 +357,7 @@ static Elf64_Sym *find_dot_toc(Elf64_Shdr *sechdrs, - numsyms = sechdrs[symindex].sh_size / sizeof(Elf64_Sym); - - for (i = 1; i < numsyms; i++) { -- if (syms[i].st_shndx == SHN_UNDEF -+ if (syms[i].st_shndx == SHN_ABS - && strcmp(strtab + syms[i].st_name, "TOC.") == 0) - return &syms[i]; - } -diff --git a/arch/powerpc/kernel/process.c b/arch/powerpc/kernel/process.c -index cf788d7d7e56..a9b10812cbfd 100644 ---- a/arch/powerpc/kernel/process.c -+++ b/arch/powerpc/kernel/process.c -@@ -209,7 +209,8 @@ void enable_kernel_vsx(void) - WARN_ON(preemptible()); - - #ifdef CONFIG_SMP -- if (current->thread.regs && (current->thread.regs->msr & MSR_VSX)) -+ if (current->thread.regs && -+ (current->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP))) - giveup_vsx(current); - else - giveup_vsx(NULL); /* just enable vsx for kernel - force */ -@@ -231,7 +232,7 @@ void flush_vsx_to_thread(struct task_struct *tsk) - { - if (tsk->thread.regs) { - preempt_disable(); -- if (tsk->thread.regs->msr & MSR_VSX) { -+ if (tsk->thread.regs->msr & (MSR_VSX|MSR_VEC|MSR_FP)) { - #ifdef CONFIG_SMP - BUG_ON(tsk != current); - #endif -diff --git a/arch/powerpc/kernel/setup_64.c b/arch/powerpc/kernel/setup_64.c -index a20823210ac0..df4a87eb8da4 100644 ---- a/arch/powerpc/kernel/setup_64.c -+++ b/arch/powerpc/kernel/setup_64.c -@@ -38,6 +38,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -834,4 +835,142 @@ static int __init disable_hardlockup_detector(void) - return 0; - } - early_initcall(disable_hardlockup_detector); -+ -+#ifdef CONFIG_PPC_BOOK3S_64 -+static enum l1d_flush_type enabled_flush_types; -+static void *l1d_flush_fallback_area; -+static bool no_rfi_flush; -+bool rfi_flush; -+ -+static int __init handle_no_rfi_flush(char *p) -+{ -+ pr_info("rfi-flush: disabled on command line."); -+ no_rfi_flush = true; -+ return 0; -+} -+early_param("no_rfi_flush", handle_no_rfi_flush); -+ -+/* -+ * The RFI flush is not KPTI, but because users will see doco that says to use -+ * nopti we hijack that option here to also disable the RFI flush. -+ */ -+static int __init handle_no_pti(char *p) -+{ -+ pr_info("rfi-flush: disabling due to 'nopti' on command line.\n"); -+ handle_no_rfi_flush(NULL); -+ return 0; -+} -+early_param("nopti", handle_no_pti); -+ -+static void do_nothing(void *unused) -+{ -+ /* -+ * We don't need to do the flush explicitly, just enter+exit kernel is -+ * sufficient, the RFI exit handlers will do the right thing. -+ */ -+} -+ -+void rfi_flush_enable(bool enable) -+{ -+ if (rfi_flush == enable) -+ return; -+ -+ if (enable) { -+ do_rfi_flush_fixups(enabled_flush_types); -+ on_each_cpu(do_nothing, NULL, 1); -+ } else -+ do_rfi_flush_fixups(L1D_FLUSH_NONE); -+ -+ rfi_flush = enable; -+} -+ -+static void init_fallback_flush(void) -+{ -+ u64 l1d_size, limit; -+ int cpu; -+ -+ l1d_size = ppc64_caches.dsize; -+ limit = min(safe_stack_limit(), ppc64_rma_size); -+ -+ /* -+ * Align to L1d size, and size it at 2x L1d size, to catch possible -+ * hardware prefetch runoff. We don't have a recipe for load patterns to -+ * reliably avoid the prefetcher. -+ */ -+ l1d_flush_fallback_area = __va(memblock_alloc_base(l1d_size * 2, l1d_size, limit)); -+ memset(l1d_flush_fallback_area, 0, l1d_size * 2); -+ -+ for_each_possible_cpu(cpu) { -+ /* -+ * The fallback flush is currently coded for 8-way -+ * associativity. Different associativity is possible, but it -+ * will be treated as 8-way and may not evict the lines as -+ * effectively. -+ * -+ * 128 byte lines are mandatory. -+ */ -+ u64 c = l1d_size / 8; -+ -+ paca[cpu].rfi_flush_fallback_area = l1d_flush_fallback_area; -+ paca[cpu].l1d_flush_congruence = c; -+ paca[cpu].l1d_flush_sets = c / 128; -+ } -+} -+ -+void __init setup_rfi_flush(enum l1d_flush_type types, bool enable) -+{ -+ if (types & L1D_FLUSH_FALLBACK) { -+ pr_info("rfi-flush: Using fallback displacement flush\n"); -+ init_fallback_flush(); -+ } -+ -+ if (types & L1D_FLUSH_ORI) -+ pr_info("rfi-flush: Using ori type flush\n"); -+ -+ if (types & L1D_FLUSH_MTTRIG) -+ pr_info("rfi-flush: Using mttrig type flush\n"); -+ -+ enabled_flush_types = types; -+ -+ if (!no_rfi_flush) -+ rfi_flush_enable(enable); -+} -+ -+#ifdef CONFIG_DEBUG_FS -+static int rfi_flush_set(void *data, u64 val) -+{ -+ if (val == 1) -+ rfi_flush_enable(true); -+ else if (val == 0) -+ rfi_flush_enable(false); -+ else -+ return -EINVAL; -+ -+ return 0; -+} -+ -+static int rfi_flush_get(void *data, u64 *val) -+{ -+ *val = rfi_flush ? 1 : 0; -+ return 0; -+} -+ -+DEFINE_SIMPLE_ATTRIBUTE(fops_rfi_flush, rfi_flush_get, rfi_flush_set, "%llu\n"); -+ -+static __init int rfi_flush_debugfs_init(void) -+{ -+ debugfs_create_file("rfi_flush", 0600, powerpc_debugfs_root, NULL, &fops_rfi_flush); -+ return 0; -+} -+device_initcall(rfi_flush_debugfs_init); -+#endif -+ -+ssize_t cpu_show_meltdown(struct device *dev, struct device_attribute *attr, char *buf) -+{ -+ if (rfi_flush) -+ return sprintf(buf, "Mitigation: RFI Flush\n"); -+ -+ return sprintf(buf, "Vulnerable\n"); -+} -+#endif /* CONFIG_PPC_BOOK3S_64 */ - #endif -diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S -index d41fd0af8980..072a23a17350 100644 ---- a/arch/powerpc/kernel/vmlinux.lds.S -+++ b/arch/powerpc/kernel/vmlinux.lds.S -@@ -72,6 +72,15 @@ SECTIONS - /* Read-only data */ - RODATA - -+#ifdef CONFIG_PPC64 -+ . = ALIGN(8); -+ __rfi_flush_fixup : AT(ADDR(__rfi_flush_fixup) - LOAD_OFFSET) { -+ __start___rfi_flush_fixup = .; -+ *(__rfi_flush_fixup) -+ __stop___rfi_flush_fixup = .; -+ } -+#endif -+ - EXCEPTION_TABLE(0) - - NOTES :kernel :notes -diff --git a/arch/powerpc/kvm/book3s_hv_rmhandlers.S b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -index ffab9269bfe4..4463718ae614 100644 ---- a/arch/powerpc/kvm/book3s_hv_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_hv_rmhandlers.S -@@ -64,7 +64,7 @@ _GLOBAL_TOC(kvmppc_hv_entry_trampoline) - mtmsrd r0,1 /* clear RI in MSR */ - mtsrr0 r5 - mtsrr1 r6 -- RFI -+ RFI_TO_KERNEL - - kvmppc_call_hv_entry: - ld r4, HSTATE_KVM_VCPU(r13) -@@ -170,7 +170,7 @@ END_FTR_SECTION_IFSET(CPU_FTR_ARCH_207S) - mtsrr0 r8 - mtsrr1 r7 - beq cr1, 13f /* machine check */ -- RFI -+ RFI_TO_KERNEL - - /* On POWER7, we have external interrupts set to use HSRR0/1 */ - 11: mtspr SPRN_HSRR0, r8 -@@ -965,8 +965,7 @@ BEGIN_FTR_SECTION - END_FTR_SECTION_IFSET(CPU_FTR_HAS_PPR) - ld r0, VCPU_GPR(R0)(r4) - ld r4, VCPU_GPR(R4)(r4) -- -- hrfid -+ HRFI_TO_GUEST - b . - - secondary_too_late: -diff --git a/arch/powerpc/kvm/book3s_rmhandlers.S b/arch/powerpc/kvm/book3s_rmhandlers.S -index 16c4d88ba27d..a328f99a887c 100644 ---- a/arch/powerpc/kvm/book3s_rmhandlers.S -+++ b/arch/powerpc/kvm/book3s_rmhandlers.S -@@ -46,6 +46,9 @@ - - #define FUNC(name) name - -+#define RFI_TO_KERNEL RFI -+#define RFI_TO_GUEST RFI -+ - .macro INTERRUPT_TRAMPOLINE intno - - .global kvmppc_trampoline_\intno -@@ -141,7 +144,7 @@ kvmppc_handler_skip_ins: - GET_SCRATCH0(r13) - - /* And get back into the code */ -- RFI -+ RFI_TO_KERNEL - #endif - - /* -@@ -164,6 +167,6 @@ _GLOBAL_TOC(kvmppc_entry_trampoline) - ori r5, r5, MSR_EE - mtsrr0 r7 - mtsrr1 r6 -- RFI -+ RFI_TO_KERNEL - - #include "book3s_segment.S" -diff --git a/arch/powerpc/kvm/book3s_segment.S b/arch/powerpc/kvm/book3s_segment.S -index ca8f174289bb..7c982956d709 100644 ---- a/arch/powerpc/kvm/book3s_segment.S -+++ b/arch/powerpc/kvm/book3s_segment.S -@@ -156,7 +156,7 @@ no_dcbz32_on: - PPC_LL r9, SVCPU_R9(r3) - PPC_LL r3, (SVCPU_R3)(r3) - -- RFI -+ RFI_TO_GUEST - kvmppc_handler_trampoline_enter_end: - - -@@ -389,5 +389,5 @@ END_FTR_SECTION_IFSET(CPU_FTR_HVMODE) - cmpwi r12, BOOK3S_INTERRUPT_DOORBELL - beqa BOOK3S_INTERRUPT_DOORBELL - -- RFI -+ RFI_TO_KERNEL - kvmppc_handler_trampoline_exit_end: -diff --git a/arch/powerpc/lib/feature-fixups.c b/arch/powerpc/lib/feature-fixups.c -index 7ce3870d7ddd..a18d648d31a6 100644 ---- a/arch/powerpc/lib/feature-fixups.c -+++ b/arch/powerpc/lib/feature-fixups.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - - - struct fixup_entry { -@@ -113,6 +114,47 @@ void do_feature_fixups(unsigned long value, void *fixup_start, void *fixup_end) - } - } - -+#ifdef CONFIG_PPC_BOOK3S_64 -+void do_rfi_flush_fixups(enum l1d_flush_type types) -+{ -+ unsigned int instrs[3], *dest; -+ long *start, *end; -+ int i; -+ -+ start = PTRRELOC(&__start___rfi_flush_fixup), -+ end = PTRRELOC(&__stop___rfi_flush_fixup); -+ -+ instrs[0] = 0x60000000; /* nop */ -+ instrs[1] = 0x60000000; /* nop */ -+ instrs[2] = 0x60000000; /* nop */ -+ -+ if (types & L1D_FLUSH_FALLBACK) -+ /* b .+16 to fallback flush */ -+ instrs[0] = 0x48000010; -+ -+ i = 0; -+ if (types & L1D_FLUSH_ORI) { -+ instrs[i++] = 0x63ff0000; /* ori 31,31,0 speculation barrier */ -+ instrs[i++] = 0x63de0000; /* ori 30,30,0 L1d flush*/ -+ } -+ -+ if (types & L1D_FLUSH_MTTRIG) -+ instrs[i++] = 0x7c12dba6; /* mtspr TRIG2,r0 (SPR #882) */ -+ -+ for (i = 0; start < end; start++, i++) { -+ dest = (void *)start + *start; -+ -+ pr_devel("patching dest %lx\n", (unsigned long)dest); -+ -+ patch_instruction(dest, instrs[0]); -+ patch_instruction(dest + 1, instrs[1]); -+ patch_instruction(dest + 2, instrs[2]); -+ } -+ -+ printk(KERN_DEBUG "rfi-flush: patched %d locations\n", i); -+} -+#endif /* CONFIG_PPC_BOOK3S_64 */ -+ - void do_lwsync_fixups(unsigned long value, void *fixup_start, void *fixup_end) - { - long *start, *end; -diff --git a/arch/powerpc/platforms/powernv/setup.c b/arch/powerpc/platforms/powernv/setup.c -index f48afc06ba14..30c6b3b7be90 100644 ---- a/arch/powerpc/platforms/powernv/setup.c -+++ b/arch/powerpc/platforms/powernv/setup.c -@@ -35,13 +35,63 @@ - #include - #include - #include -+#include -+#include - - #include "powernv.h" - -+static void pnv_setup_rfi_flush(void) -+{ -+ struct device_node *np, *fw_features; -+ enum l1d_flush_type type; -+ int enable; -+ -+ /* Default to fallback in case fw-features are not available */ -+ type = L1D_FLUSH_FALLBACK; -+ enable = 1; -+ -+ np = of_find_node_by_name(NULL, "ibm,opal"); -+ fw_features = of_get_child_by_name(np, "fw-features"); -+ of_node_put(np); -+ -+ if (fw_features) { -+ np = of_get_child_by_name(fw_features, "inst-l1d-flush-trig2"); -+ if (np && of_property_read_bool(np, "enabled")) -+ type = L1D_FLUSH_MTTRIG; -+ -+ of_node_put(np); -+ -+ np = of_get_child_by_name(fw_features, "inst-l1d-flush-ori30,30,0"); -+ if (np && of_property_read_bool(np, "enabled")) -+ type = L1D_FLUSH_ORI; -+ -+ of_node_put(np); -+ -+ /* Enable unless firmware says NOT to */ -+ enable = 2; -+ np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-hv-1-to-0"); -+ if (np && of_property_read_bool(np, "disabled")) -+ enable--; -+ -+ of_node_put(np); -+ -+ np = of_get_child_by_name(fw_features, "needs-l1d-flush-msr-pr-0-to-1"); -+ if (np && of_property_read_bool(np, "disabled")) -+ enable--; -+ -+ of_node_put(np); -+ of_node_put(fw_features); -+ } -+ -+ setup_rfi_flush(type, enable > 0); -+} -+ - static void __init pnv_setup_arch(void) - { - set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT); - -+ pnv_setup_rfi_flush(); -+ - /* Initialize SMP */ - pnv_smp_init(); - -diff --git a/arch/powerpc/platforms/pseries/setup.c b/arch/powerpc/platforms/pseries/setup.c -index 36df46eaba24..dd2545fc9947 100644 ---- a/arch/powerpc/platforms/pseries/setup.c -+++ b/arch/powerpc/platforms/pseries/setup.c -@@ -499,6 +499,39 @@ static void __init find_and_init_phbs(void) - of_pci_check_probe_only(); - } - -+static void pseries_setup_rfi_flush(void) -+{ -+ struct h_cpu_char_result result; -+ enum l1d_flush_type types; -+ bool enable; -+ long rc; -+ -+ /* Enable by default */ -+ enable = true; -+ -+ rc = plpar_get_cpu_characteristics(&result); -+ if (rc == H_SUCCESS) { -+ types = L1D_FLUSH_NONE; -+ -+ if (result.character & H_CPU_CHAR_L1D_FLUSH_TRIG2) -+ types |= L1D_FLUSH_MTTRIG; -+ if (result.character & H_CPU_CHAR_L1D_FLUSH_ORI30) -+ types |= L1D_FLUSH_ORI; -+ -+ /* Use fallback if nothing set in hcall */ -+ if (types == L1D_FLUSH_NONE) -+ types = L1D_FLUSH_FALLBACK; -+ -+ if (!(result.behaviour & H_CPU_BEHAV_L1D_FLUSH_PR)) -+ enable = false; -+ } else { -+ /* Default to fallback if case hcall is not available */ -+ types = L1D_FLUSH_FALLBACK; -+ } -+ -+ setup_rfi_flush(types, enable); -+} -+ - static void __init pSeries_setup_arch(void) - { - set_arch_panic_timeout(10, ARCH_PANIC_TIMEOUT); -@@ -515,7 +548,9 @@ static void __init pSeries_setup_arch(void) - - fwnmi_init(); - -- /* By default, only probe PCI (can be overriden by rtas_pci) */ -+ pseries_setup_rfi_flush(); -+ -+ /* By default, only probe PCI (can be overridden by rtas_pci) */ - pci_add_flags(PCI_PROBE_ONLY); - - /* Find and initialize PCI host bridges */ -diff --git a/arch/sh/kernel/traps_32.c b/arch/sh/kernel/traps_32.c -index ff639342a8be..c5b997757988 100644 ---- a/arch/sh/kernel/traps_32.c -+++ b/arch/sh/kernel/traps_32.c -@@ -607,7 +607,8 @@ asmlinkage void do_divide_error(unsigned long r4) - break; - } - -- force_sig_info(SIGFPE, &info, current); -+ info.si_signo = SIGFPE; -+ force_sig_info(info.si_signo, &info, current); - } - #endif - -diff --git a/arch/x86/crypto/poly1305_glue.c b/arch/x86/crypto/poly1305_glue.c -index 4264a3d59589..7c064887b783 100644 ---- a/arch/x86/crypto/poly1305_glue.c -+++ b/arch/x86/crypto/poly1305_glue.c -@@ -164,7 +164,6 @@ static struct shash_alg alg = { - .init = poly1305_simd_init, - .update = poly1305_simd_update, - .final = crypto_poly1305_final, -- .setkey = crypto_poly1305_setkey, - .descsize = sizeof(struct poly1305_simd_desc_ctx), - .base = { - .cra_name = "poly1305", -diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h -index b9c6c7a6f5a6..1c79c8add0eb 100644 ---- a/arch/x86/include/asm/asm.h -+++ b/arch/x86/include/asm/asm.h -@@ -11,10 +11,12 @@ - # define __ASM_FORM_COMMA(x) " " #x "," - #endif - --#ifdef CONFIG_X86_32 -+#ifndef __x86_64__ -+/* 32 bit */ - # define __ASM_SEL(a,b) __ASM_FORM(a) - # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(a) - #else -+/* 64 bit */ - # define __ASM_SEL(a,b) __ASM_FORM(b) - # define __ASM_SEL_RAW(a,b) __ASM_FORM_RAW(b) - #endif -diff --git a/arch/x86/include/asm/vsyscall.h b/arch/x86/include/asm/vsyscall.h -index 9ee85066f407..62210da19a92 100644 ---- a/arch/x86/include/asm/vsyscall.h -+++ b/arch/x86/include/asm/vsyscall.h -@@ -13,7 +13,6 @@ extern void map_vsyscall(void); - */ - extern bool emulate_vsyscall(struct pt_regs *regs, unsigned long address); - extern bool vsyscall_enabled(void); --extern unsigned long vsyscall_pgprot; - #else - static inline void map_vsyscall(void) {} - static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) -@@ -22,5 +21,6 @@ static inline bool emulate_vsyscall(struct pt_regs *regs, unsigned long address) - } - static inline bool vsyscall_enabled(void) { return false; } - #endif -+extern unsigned long vsyscall_pgprot; - - #endif /* _ASM_X86_VSYSCALL_H */ -diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c -index b3e94ef461fd..ce5f8a2e7ae6 100644 ---- a/arch/x86/kernel/cpu/microcode/core.c -+++ b/arch/x86/kernel/cpu/microcode/core.c -@@ -44,7 +44,7 @@ - - static struct microcode_ops *microcode_ops; - --static bool dis_ucode_ldr; -+static bool dis_ucode_ldr = true; - - static int __init disable_loader(char *str) - { -@@ -81,6 +81,7 @@ struct cpu_info_ctx { - - static bool __init check_loader_disabled_bsp(void) - { -+ u32 a, b, c, d; - #ifdef CONFIG_X86_32 - const char *cmdline = (const char *)__pa_nodebug(boot_command_line); - const char *opt = "dis_ucode_ldr"; -@@ -93,8 +94,20 @@ static bool __init check_loader_disabled_bsp(void) - bool *res = &dis_ucode_ldr; - #endif - -- if (cmdline_find_option_bool(cmdline, option)) -- *res = true; -+ a = 1; -+ c = 0; -+ native_cpuid(&a, &b, &c, &d); -+ -+ /* -+ * CPUID(1).ECX[31]: reserved for hypervisor use. This is still not -+ * completely accurate as xen pv guests don't see that CPUID bit set but -+ * that's good enough as they don't land on the BSP path anyway. -+ */ -+ if (c & BIT(31)) -+ return *res; -+ -+ if (cmdline_find_option_bool(cmdline, option) <= 0) -+ *res = false; - - return *res; - } -@@ -122,9 +135,7 @@ void __init load_ucode_bsp(void) - { - int vendor; - unsigned int family; -- -- if (check_loader_disabled_bsp()) -- return; -+ bool intel = true; - - if (!have_cpuid_p()) - return; -@@ -134,16 +145,27 @@ void __init load_ucode_bsp(void) - - switch (vendor) { - case X86_VENDOR_INTEL: -- if (family >= 6) -- load_ucode_intel_bsp(); -+ if (family < 6) -+ return; - break; -+ - case X86_VENDOR_AMD: -- if (family >= 0x10) -- load_ucode_amd_bsp(family); -+ if (family < 0x10) -+ return; -+ intel = false; - break; -+ - default: -- break; -+ return; - } -+ -+ if (check_loader_disabled_bsp()) -+ return; -+ -+ if (intel) -+ load_ucode_intel_bsp(); -+ else -+ load_ucode_amd_bsp(family); - } - - static bool check_loader_disabled_ap(void) -@@ -162,9 +184,6 @@ void load_ucode_ap(void) - if (check_loader_disabled_ap()) - return; - -- if (!have_cpuid_p()) -- return; -- - vendor = x86_vendor(); - family = x86_family(); - -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index f8d785aa2e96..2a1a8737015b 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -4595,14 +4595,15 @@ static int vmx_deliver_nested_posted_interrupt(struct kvm_vcpu *vcpu, - - if (is_guest_mode(vcpu) && - vector == vmx->nested.posted_intr_nv) { -- /* the PIR and ON have been set by L1. */ -- kvm_vcpu_trigger_posted_interrupt(vcpu); - /* - * If a posted intr is not recognized by hardware, - * we will accomplish it in the next vmentry. - */ - vmx->nested.pi_pending = true; - kvm_make_request(KVM_REQ_EVENT, vcpu); -+ /* the PIR and ON have been set by L1. */ -+ if (!kvm_vcpu_trigger_posted_interrupt(vcpu)) -+ kvm_vcpu_kick(vcpu); - return 0; - } - return -1; -diff --git a/arch/x86/mm/kaiser.c b/arch/x86/mm/kaiser.c -index 2298434f7bdb..7a72e32e4806 100644 ---- a/arch/x86/mm/kaiser.c -+++ b/arch/x86/mm/kaiser.c -@@ -363,7 +363,7 @@ void __init kaiser_init(void) - kaiser_add_user_map_ptrs_early(__entry_text_start, __entry_text_end, - __PAGE_KERNEL_RX); - --#if defined(CONFIG_FUNCTION_GRAPH_TRACER) || defined(CONFIG_KASAN) -+#ifdef CONFIG_FUNCTION_GRAPH_TRACER - kaiser_add_user_map_ptrs_early(__irqentry_text_start, - __irqentry_text_end, - __PAGE_KERNEL_RX); -diff --git a/arch/xtensa/include/asm/futex.h b/arch/xtensa/include/asm/futex.h -index b39531babec0..72bfc1cbc2b5 100644 ---- a/arch/xtensa/include/asm/futex.h -+++ b/arch/xtensa/include/asm/futex.h -@@ -109,7 +109,6 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - u32 oldval, u32 newval) - { - int ret = 0; -- u32 prev; - - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))) - return -EFAULT; -@@ -120,26 +119,24 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr, - - __asm__ __volatile__ ( - " # futex_atomic_cmpxchg_inatomic\n" -- "1: l32i %1, %3, 0\n" -- " mov %0, %5\n" -- " wsr %1, scompare1\n" -- "2: s32c1i %0, %3, 0\n" -- "3:\n" -+ " wsr %5, scompare1\n" -+ "1: s32c1i %1, %4, 0\n" -+ " s32i %1, %6, 0\n" -+ "2:\n" - " .section .fixup,\"ax\"\n" - " .align 4\n" -- "4: .long 3b\n" -- "5: l32r %1, 4b\n" -- " movi %0, %6\n" -+ "3: .long 2b\n" -+ "4: l32r %1, 3b\n" -+ " movi %0, %7\n" - " jx %1\n" - " .previous\n" - " .section __ex_table,\"a\"\n" -- " .long 1b,5b,2b,5b\n" -+ " .long 1b,4b\n" - " .previous\n" -- : "+r" (ret), "=&r" (prev), "+m" (*uaddr) -- : "r" (uaddr), "r" (oldval), "r" (newval), "I" (-EFAULT) -+ : "+r" (ret), "+r" (newval), "+m" (*uaddr), "+m" (*uval) -+ : "r" (uaddr), "r" (oldval), "r" (uval), "I" (-EFAULT) - : "memory"); - -- *uval = prev; - return ret; - } - -diff --git a/crypto/ahash.c b/crypto/ahash.c -index f9caf0f74199..7006dbfd39bd 100644 ---- a/crypto/ahash.c -+++ b/crypto/ahash.c -@@ -637,5 +637,16 @@ struct hash_alg_common *ahash_attr_alg(struct rtattr *rta, u32 type, u32 mask) - } - EXPORT_SYMBOL_GPL(ahash_attr_alg); - -+bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg) -+{ -+ struct crypto_alg *alg = &halg->base; -+ -+ if (alg->cra_type != &crypto_ahash_type) -+ return crypto_shash_alg_has_setkey(__crypto_shash_alg(alg)); -+ -+ return __crypto_ahash_alg(alg)->setkey != NULL; -+} -+EXPORT_SYMBOL_GPL(crypto_hash_alg_has_setkey); -+ - MODULE_LICENSE("GPL"); - MODULE_DESCRIPTION("Asynchronous cryptographic hash type"); -diff --git a/crypto/cryptd.c b/crypto/cryptd.c -index 26a504db3f53..10a5a3eb675a 100644 ---- a/crypto/cryptd.c -+++ b/crypto/cryptd.c -@@ -654,7 +654,8 @@ static int cryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb, - inst->alg.finup = cryptd_hash_finup_enqueue; - inst->alg.export = cryptd_hash_export; - inst->alg.import = cryptd_hash_import; -- inst->alg.setkey = cryptd_hash_setkey; -+ if (crypto_shash_alg_has_setkey(salg)) -+ inst->alg.setkey = cryptd_hash_setkey; - inst->alg.digest = cryptd_hash_digest_enqueue; - - err = ahash_register_instance(tmpl, inst); -diff --git a/crypto/poly1305_generic.c b/crypto/poly1305_generic.c -index 2df9835dfbc0..bca99238948f 100644 ---- a/crypto/poly1305_generic.c -+++ b/crypto/poly1305_generic.c -@@ -51,17 +51,6 @@ int crypto_poly1305_init(struct shash_desc *desc) - } - EXPORT_SYMBOL_GPL(crypto_poly1305_init); - --int crypto_poly1305_setkey(struct crypto_shash *tfm, -- const u8 *key, unsigned int keylen) --{ -- /* Poly1305 requires a unique key for each tag, which implies that -- * we can't set it on the tfm that gets accessed by multiple users -- * simultaneously. Instead we expect the key as the first 32 bytes in -- * the update() call. */ -- return -ENOTSUPP; --} --EXPORT_SYMBOL_GPL(crypto_poly1305_setkey); -- - static void poly1305_setrkey(struct poly1305_desc_ctx *dctx, const u8 *key) - { - /* r &= 0xffffffc0ffffffc0ffffffc0fffffff */ -@@ -80,6 +69,11 @@ static void poly1305_setskey(struct poly1305_desc_ctx *dctx, const u8 *key) - dctx->s[3] = le32_to_cpuvp(key + 12); - } - -+/* -+ * Poly1305 requires a unique key for each tag, which implies that we can't set -+ * it on the tfm that gets accessed by multiple users simultaneously. Instead we -+ * expect the key as the first 32 bytes in the update() call. -+ */ - unsigned int crypto_poly1305_setdesckey(struct poly1305_desc_ctx *dctx, - const u8 *src, unsigned int srclen) - { -@@ -285,7 +279,6 @@ static struct shash_alg poly1305_alg = { - .init = crypto_poly1305_init, - .update = crypto_poly1305_update, - .final = crypto_poly1305_final, -- .setkey = crypto_poly1305_setkey, - .descsize = sizeof(struct poly1305_desc_ctx), - .base = { - .cra_name = "poly1305", -diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c -index f522828d45c9..1d92b5d2d6bd 100644 ---- a/crypto/tcrypt.c -+++ b/crypto/tcrypt.c -@@ -291,11 +291,13 @@ static void sg_init_aead(struct scatterlist *sg, char *xbuf[XBUFSIZE], - } - - sg_init_table(sg, np + 1); -- np--; -+ if (rem) -+ np--; - for (k = 0; k < np; k++) - sg_set_buf(&sg[k + 1], xbuf[k], PAGE_SIZE); - -- sg_set_buf(&sg[k + 1], xbuf[k], rem); -+ if (rem) -+ sg_set_buf(&sg[k + 1], xbuf[k], rem); - } - - static void test_aead_speed(const char *algo, int enc, unsigned int secs, -diff --git a/drivers/acpi/sbshc.c b/drivers/acpi/sbshc.c -index 2fa8304171e0..7a3431018e0a 100644 ---- a/drivers/acpi/sbshc.c -+++ b/drivers/acpi/sbshc.c -@@ -275,8 +275,8 @@ static int acpi_smbus_hc_add(struct acpi_device *device) - device->driver_data = hc; - - acpi_ec_add_query_handler(hc->ec, hc->query_bit, NULL, smbus_alarm, hc); -- printk(KERN_INFO PREFIX "SBS HC: EC = 0x%p, offset = 0x%0x, query_bit = 0x%0x\n", -- hc->ec, hc->offset, hc->query_bit); -+ dev_info(&device->dev, "SBS HC: offset = 0x%0x, query_bit = 0x%0x\n", -+ hc->offset, hc->query_bit); - - return 0; - } -diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c -index 60a15831c009..8ddf5d5c94fd 100644 ---- a/drivers/ata/ahci.c -+++ b/drivers/ata/ahci.c -@@ -260,9 +260,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0x3b23), board_ahci }, /* PCH AHCI */ - { PCI_VDEVICE(INTEL, 0x3b24), board_ahci }, /* PCH RAID */ - { PCI_VDEVICE(INTEL, 0x3b25), board_ahci }, /* PCH RAID */ -- { PCI_VDEVICE(INTEL, 0x3b29), board_ahci }, /* PCH AHCI */ -+ { PCI_VDEVICE(INTEL, 0x3b29), board_ahci }, /* PCH M AHCI */ - { PCI_VDEVICE(INTEL, 0x3b2b), board_ahci }, /* PCH RAID */ -- { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH RAID */ -+ { PCI_VDEVICE(INTEL, 0x3b2c), board_ahci }, /* PCH M RAID */ - { PCI_VDEVICE(INTEL, 0x3b2f), board_ahci }, /* PCH AHCI */ - { PCI_VDEVICE(INTEL, 0x19b0), board_ahci }, /* DNV AHCI */ - { PCI_VDEVICE(INTEL, 0x19b1), board_ahci }, /* DNV AHCI */ -@@ -285,9 +285,9 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0x19cE), board_ahci }, /* DNV AHCI */ - { PCI_VDEVICE(INTEL, 0x19cF), board_ahci }, /* DNV AHCI */ - { PCI_VDEVICE(INTEL, 0x1c02), board_ahci }, /* CPT AHCI */ -- { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT AHCI */ -+ { PCI_VDEVICE(INTEL, 0x1c03), board_ahci }, /* CPT M AHCI */ - { PCI_VDEVICE(INTEL, 0x1c04), board_ahci }, /* CPT RAID */ -- { PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT RAID */ -+ { PCI_VDEVICE(INTEL, 0x1c05), board_ahci }, /* CPT M RAID */ - { PCI_VDEVICE(INTEL, 0x1c06), board_ahci }, /* CPT RAID */ - { PCI_VDEVICE(INTEL, 0x1c07), board_ahci }, /* CPT RAID */ - { PCI_VDEVICE(INTEL, 0x1d02), board_ahci }, /* PBG AHCI */ -@@ -296,20 +296,20 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* PBG RAID */ - { PCI_VDEVICE(INTEL, 0x2323), board_ahci }, /* DH89xxCC AHCI */ - { PCI_VDEVICE(INTEL, 0x1e02), board_ahci }, /* Panther Point AHCI */ -- { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point AHCI */ -+ { PCI_VDEVICE(INTEL, 0x1e03), board_ahci }, /* Panther Point M AHCI */ - { PCI_VDEVICE(INTEL, 0x1e04), board_ahci }, /* Panther Point RAID */ - { PCI_VDEVICE(INTEL, 0x1e05), board_ahci }, /* Panther Point RAID */ - { PCI_VDEVICE(INTEL, 0x1e06), board_ahci }, /* Panther Point RAID */ -- { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point RAID */ -+ { PCI_VDEVICE(INTEL, 0x1e07), board_ahci }, /* Panther Point M RAID */ - { PCI_VDEVICE(INTEL, 0x1e0e), board_ahci }, /* Panther Point RAID */ - { PCI_VDEVICE(INTEL, 0x8c02), board_ahci }, /* Lynx Point AHCI */ -- { PCI_VDEVICE(INTEL, 0x8c03), board_ahci }, /* Lynx Point AHCI */ -+ { PCI_VDEVICE(INTEL, 0x8c03), board_ahci }, /* Lynx Point M AHCI */ - { PCI_VDEVICE(INTEL, 0x8c04), board_ahci }, /* Lynx Point RAID */ -- { PCI_VDEVICE(INTEL, 0x8c05), board_ahci }, /* Lynx Point RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c05), board_ahci }, /* Lynx Point M RAID */ - { PCI_VDEVICE(INTEL, 0x8c06), board_ahci }, /* Lynx Point RAID */ -- { PCI_VDEVICE(INTEL, 0x8c07), board_ahci }, /* Lynx Point RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c07), board_ahci }, /* Lynx Point M RAID */ - { PCI_VDEVICE(INTEL, 0x8c0e), board_ahci }, /* Lynx Point RAID */ -- { PCI_VDEVICE(INTEL, 0x8c0f), board_ahci }, /* Lynx Point RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c0f), board_ahci }, /* Lynx Point M RAID */ - { PCI_VDEVICE(INTEL, 0x9c02), board_ahci }, /* Lynx Point-LP AHCI */ - { PCI_VDEVICE(INTEL, 0x9c03), board_ahci }, /* Lynx Point-LP AHCI */ - { PCI_VDEVICE(INTEL, 0x9c04), board_ahci }, /* Lynx Point-LP RAID */ -@@ -350,21 +350,21 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0x9c87), board_ahci }, /* Wildcat Point-LP RAID */ - { PCI_VDEVICE(INTEL, 0x9c8f), board_ahci }, /* Wildcat Point-LP RAID */ - { PCI_VDEVICE(INTEL, 0x8c82), board_ahci }, /* 9 Series AHCI */ -- { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series AHCI */ -+ { PCI_VDEVICE(INTEL, 0x8c83), board_ahci }, /* 9 Series M AHCI */ - { PCI_VDEVICE(INTEL, 0x8c84), board_ahci }, /* 9 Series RAID */ -- { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c85), board_ahci }, /* 9 Series M RAID */ - { PCI_VDEVICE(INTEL, 0x8c86), board_ahci }, /* 9 Series RAID */ -- { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series M RAID */ - { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */ -- { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */ -+ { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series M RAID */ - { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */ - { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */ - { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */ - { PCI_VDEVICE(INTEL, 0xa102), board_ahci }, /* Sunrise Point-H AHCI */ -- { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */ -+ { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H M AHCI */ - { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */ - { PCI_VDEVICE(INTEL, 0xa106), board_ahci }, /* Sunrise Point-H RAID */ -- { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */ -+ { PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H M RAID */ - { PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */ - { PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/ -@@ -382,6 +382,11 @@ static const struct pci_device_id ahci_pci_tbl[] = { - { PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/ - { PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/ -+ { PCI_VDEVICE(INTEL, 0xa356), board_ahci }, /* Cannon Lake PCH-H RAID */ -+ { PCI_VDEVICE(INTEL, 0x0f22), board_ahci }, /* Bay Trail AHCI */ -+ { PCI_VDEVICE(INTEL, 0x0f23), board_ahci }, /* Bay Trail AHCI */ -+ { PCI_VDEVICE(INTEL, 0x22a3), board_ahci }, /* Cherry Trail AHCI */ -+ { PCI_VDEVICE(INTEL, 0x5ae3), board_ahci }, /* Apollo Lake AHCI */ - - /* JMicron 360/1/3/5/6, match class to avoid IDE function */ - { PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, -diff --git a/drivers/block/pktcdvd.c b/drivers/block/pktcdvd.c -index d06c62eccdf0..156968a6655d 100644 ---- a/drivers/block/pktcdvd.c -+++ b/drivers/block/pktcdvd.c -@@ -2779,7 +2779,7 @@ static int pkt_setup_dev(dev_t dev, dev_t* pkt_dev) - pd->pkt_dev = MKDEV(pktdev_major, idx); - ret = pkt_new_dev(pd, dev); - if (ret) -- goto out_new_dev; -+ goto out_mem2; - - /* inherit events of the host device */ - disk->events = pd->bdev->bd_disk->events; -@@ -2797,8 +2797,6 @@ static int pkt_setup_dev(dev_t dev, dev_t* pkt_dev) - mutex_unlock(&ctl_mutex); - return 0; - --out_new_dev: -- blk_cleanup_queue(disk->queue); - out_mem2: - put_disk(disk); - out_mem: -diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c -index 7b624423a7e8..89ccb604045c 100644 ---- a/drivers/bluetooth/btsdio.c -+++ b/drivers/bluetooth/btsdio.c -@@ -31,6 +31,7 @@ - #include - #include - -+#include - #include - #include - -@@ -291,6 +292,14 @@ static int btsdio_probe(struct sdio_func *func, - tuple = tuple->next; - } - -+ /* BCM43341 devices soldered onto the PCB (non-removable) use an -+ * uart connection for bluetooth, ignore the BT SDIO interface. -+ */ -+ if (func->vendor == SDIO_VENDOR_ID_BROADCOM && -+ func->device == SDIO_DEVICE_ID_BROADCOM_43341 && -+ !mmc_card_is_removable(func->card->host)) -+ return -ENODEV; -+ - data = devm_kzalloc(&func->dev, sizeof(*data), GFP_KERNEL); - if (!data) - return -ENOMEM; -diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c -index 1ccad79ce77c..54cef3dc0beb 100644 ---- a/drivers/bluetooth/btusb.c -+++ b/drivers/bluetooth/btusb.c -@@ -23,6 +23,7 @@ - - #include - #include -+#include - #include - #include - -@@ -360,8 +361,8 @@ static const struct usb_device_id blacklist_table[] = { - #define BTUSB_FIRMWARE_LOADED 7 - #define BTUSB_FIRMWARE_FAILED 8 - #define BTUSB_BOOTING 9 --#define BTUSB_RESET_RESUME 10 --#define BTUSB_DIAG_RUNNING 11 -+#define BTUSB_DIAG_RUNNING 10 -+#define BTUSB_OOB_WAKE_ENABLED 11 - - struct btusb_data { - struct hci_dev *hdev; -@@ -2972,9 +2973,9 @@ static int btusb_probe(struct usb_interface *intf, - - /* QCA Rome devices lose their updated firmware over suspend, - * but the USB hub doesn't notice any status change. -- * Explicitly request a device reset on resume. -+ * explicitly request a device reset on resume. - */ -- set_bit(BTUSB_RESET_RESUME, &data->flags); -+ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; - } - - #ifdef CONFIG_BT_HCIBTUSB_RTL -@@ -2985,7 +2986,7 @@ static int btusb_probe(struct usb_interface *intf, - * but the USB hub doesn't notice any status change. - * Explicitly request a device reset on resume. - */ -- set_bit(BTUSB_RESET_RESUME, &data->flags); -+ interface_to_usbdev(intf)->quirks |= USB_QUIRK_RESET_RESUME; - } - #endif - -@@ -3142,14 +3143,6 @@ static int btusb_suspend(struct usb_interface *intf, pm_message_t message) - btusb_stop_traffic(data); - usb_kill_anchored_urbs(&data->tx_anchor); - -- /* Optionally request a device reset on resume, but only when -- * wakeups are disabled. If wakeups are enabled we assume the -- * device will stay powered up throughout suspend. -- */ -- if (test_bit(BTUSB_RESET_RESUME, &data->flags) && -- !device_may_wakeup(&data->udev->dev)) -- data->udev->reset_resume = 1; -- - return 0; - } - -diff --git a/drivers/crypto/caam/ctrl.c b/drivers/crypto/caam/ctrl.c -index 53e61459c69f..ee87eb77095c 100644 ---- a/drivers/crypto/caam/ctrl.c -+++ b/drivers/crypto/caam/ctrl.c -@@ -224,12 +224,16 @@ static int instantiate_rng(struct device *ctrldev, int state_handle_mask, - * without any error (HW optimizations for later - * CAAM eras), then try again. - */ -+ if (ret) -+ break; -+ - rdsta_val = rd_reg32(&ctrl->r4tst[0].rdsta) & RDSTA_IFMASK; - if ((status && status != JRSTA_SSRC_JUMP_HALT_CC) || -- !(rdsta_val & (1 << sh_idx))) -+ !(rdsta_val & (1 << sh_idx))) { - ret = -EAGAIN; -- if (ret) - break; -+ } -+ - dev_info(ctrldev, "Instantiated RNG4 SH%d\n", sh_idx); - /* Clear the contents before recreating the descriptor */ - memset(desc, 0x00, CAAM_CMD_SZ * 7); -diff --git a/drivers/dma/dmatest.c b/drivers/dma/dmatest.c -index 7254c20007f8..6796eb1a8a4c 100644 ---- a/drivers/dma/dmatest.c -+++ b/drivers/dma/dmatest.c -@@ -329,7 +329,7 @@ static void dmatest_callback(void *arg) - { - struct dmatest_done *done = arg; - struct dmatest_thread *thread = -- container_of(arg, struct dmatest_thread, done_wait); -+ container_of(done, struct dmatest_thread, test_done); - if (!thread->done) { - done->done = true; - wake_up_all(done->wait); -diff --git a/drivers/edac/octeon_edac-lmc.c b/drivers/edac/octeon_edac-lmc.c -index cda6dab5067a..6b65a102b49d 100644 ---- a/drivers/edac/octeon_edac-lmc.c -+++ b/drivers/edac/octeon_edac-lmc.c -@@ -79,6 +79,7 @@ static void octeon_lmc_edac_poll_o2(struct mem_ctl_info *mci) - if (!pvt->inject) - int_reg.u64 = cvmx_read_csr(CVMX_LMCX_INT(mci->mc_idx)); - else { -+ int_reg.u64 = 0; - if (pvt->error_type == 1) - int_reg.s.sec_err = 1; - if (pvt->error_type == 2) -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -index 9befd624a5f0..6fab07935d16 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c -@@ -371,6 +371,31 @@ static void rcar_du_crtc_start(struct rcar_du_crtc *rcrtc) - rcrtc->started = true; - } - -+static void rcar_du_crtc_disable_planes(struct rcar_du_crtc *rcrtc) -+{ -+ struct rcar_du_device *rcdu = rcrtc->group->dev; -+ struct drm_crtc *crtc = &rcrtc->crtc; -+ u32 status; -+ /* Make sure vblank interrupts are enabled. */ -+ drm_crtc_vblank_get(crtc); -+ /* -+ * Disable planes and calculate how many vertical blanking interrupts we -+ * have to wait for. If a vertical blanking interrupt has been triggered -+ * but not processed yet, we don't know whether it occurred before or -+ * after the planes got disabled. We thus have to wait for two vblank -+ * interrupts in that case. -+ */ -+ spin_lock_irq(&rcrtc->vblank_lock); -+ rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? DS2PR : DS1PR, 0); -+ status = rcar_du_crtc_read(rcrtc, DSSR); -+ rcrtc->vblank_count = status & DSSR_VBK ? 2 : 1; -+ spin_unlock_irq(&rcrtc->vblank_lock); -+ if (!wait_event_timeout(rcrtc->vblank_wait, rcrtc->vblank_count == 0, -+ msecs_to_jiffies(100))) -+ dev_warn(rcdu->dev, "vertical blanking timeout\n"); -+ drm_crtc_vblank_put(crtc); -+} -+ - static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc) - { - struct drm_crtc *crtc = &rcrtc->crtc; -@@ -379,17 +404,16 @@ static void rcar_du_crtc_stop(struct rcar_du_crtc *rcrtc) - return; - - /* Disable all planes and wait for the change to take effect. This is -- * required as the DSnPR registers are updated on vblank, and no vblank -- * will occur once the CRTC is stopped. Disabling planes when starting -- * the CRTC thus wouldn't be enough as it would start scanning out -- * immediately from old frame buffers until the next vblank. -+ * required as the plane enable registers are updated on vblank, and no -+ * vblank will occur once the CRTC is stopped. Disabling planes when -+ * starting the CRTC thus wouldn't be enough as it would start scanning -+ * out immediately from old frame buffers until the next vblank. - * - * This increases the CRTC stop delay, especially when multiple CRTCs - * are stopped in one operation as we now wait for one vblank per CRTC. - * Whether this can be improved needs to be researched. - */ -- rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? DS2PR : DS1PR, 0); -- drm_crtc_wait_one_vblank(crtc); -+ rcar_du_crtc_disable_planes(rcrtc); - - /* Disable vertical blanking interrupt reporting. We first need to wait - * for page flip completion before stopping the CRTC as userspace -@@ -528,10 +552,26 @@ static irqreturn_t rcar_du_crtc_irq(int irq, void *arg) - irqreturn_t ret = IRQ_NONE; - u32 status; - -+ spin_lock(&rcrtc->vblank_lock); -+ - status = rcar_du_crtc_read(rcrtc, DSSR); - rcar_du_crtc_write(rcrtc, DSRCR, status & DSRCR_MASK); - -- if (status & DSSR_FRM) { -+ if (status & DSSR_VBK) { -+ /* -+ * Wake up the vblank wait if the counter reaches 0. This must -+ * be protected by the vblank_lock to avoid races in -+ * rcar_du_crtc_disable_planes(). -+ */ -+ if (rcrtc->vblank_count) { -+ if (--rcrtc->vblank_count == 0) -+ wake_up(&rcrtc->vblank_wait); -+ } -+ } -+ -+ spin_unlock(&rcrtc->vblank_lock); -+ -+ if (status & DSSR_VBK) { - drm_handle_vblank(rcrtc->crtc.dev, rcrtc->index); - rcar_du_crtc_finish_page_flip(rcrtc); - ret = IRQ_HANDLED; -@@ -585,6 +625,8 @@ int rcar_du_crtc_create(struct rcar_du_group *rgrp, unsigned int index) - } - - init_waitqueue_head(&rcrtc->flip_wait); -+ init_waitqueue_head(&rcrtc->vblank_wait); -+ spin_lock_init(&rcrtc->vblank_lock); - - rcrtc->group = rgrp; - rcrtc->mmio_offset = mmio_offsets[index]; -diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -index 2bbe3f5aab65..be22ce33b70a 100644 ---- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -+++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.h -@@ -15,6 +15,7 @@ - #define __RCAR_DU_CRTC_H__ - - #include -+#include - #include - - #include -@@ -32,6 +33,9 @@ struct rcar_du_group; - * @started: whether the CRTC has been started and is running - * @event: event to post when the pending page flip completes - * @flip_wait: wait queue used to signal page flip completion -+ * @vblank_lock: protects vblank_wait and vblank_count -+ * @vblank_wait: wait queue used to signal vertical blanking -+ * @vblank_count: number of vertical blanking interrupts to wait for - * @outputs: bitmask of the outputs (enum rcar_du_output) driven by this CRTC - * @enabled: whether the CRTC is enabled, used to control system resume - * @group: CRTC group this CRTC belongs to -@@ -48,6 +52,10 @@ struct rcar_du_crtc { - struct drm_pending_vblank_event *event; - wait_queue_head_t flip_wait; - -+ spinlock_t vblank_lock; -+ wait_queue_head_t vblank_wait; -+ unsigned int vblank_count; -+ - unsigned int outputs; - bool enabled; - -diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c -index 3ba486d0ec6f..6861b74e2b61 100644 ---- a/drivers/hid/hid-core.c -+++ b/drivers/hid/hid-core.c -@@ -2308,7 +2308,6 @@ static const struct hid_device_id hid_ignore_list[] = { - { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, 0x0004) }, - { HID_USB_DEVICE(USB_VENDOR_ID_DREAM_CHEEKY, 0x000a) }, - { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0400) }, -- { HID_I2C_DEVICE(USB_VENDOR_ID_ELAN, 0x0401) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ESSENTIAL_REALITY, USB_DEVICE_ID_ESSENTIAL_REALITY_P5) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC5UH) }, - { HID_USB_DEVICE(USB_VENDOR_ID_ETT, USB_DEVICE_ID_TC4UM) }, -@@ -2578,6 +2577,17 @@ bool hid_ignore(struct hid_device *hdev) - strncmp(hdev->name, "www.masterkit.ru MA901", 22) == 0) - return true; - break; -+ case USB_VENDOR_ID_ELAN: -+ /* -+ * Many Elan devices have a product id of 0x0401 and are handled -+ * by the elan_i2c input driver. But the ACPI HID ELAN0800 dev -+ * is not (and cannot be) handled by that driver -> -+ * Ignore all 0x0401 devs except for the ELAN0800 dev. -+ */ -+ if (hdev->product == 0x0401 && -+ strncmp(hdev->name, "ELAN0800", 8) != 0) -+ return true; -+ break; - } - - if (hdev->type == HID_TYPE_USBMOUSE && -diff --git a/drivers/media/dvb-frontends/ts2020.c b/drivers/media/dvb-frontends/ts2020.c -index 7979e5d6498b..7ca359391535 100644 ---- a/drivers/media/dvb-frontends/ts2020.c -+++ b/drivers/media/dvb-frontends/ts2020.c -@@ -369,7 +369,7 @@ static int ts2020_read_tuner_gain(struct dvb_frontend *fe, unsigned v_agc, - gain2 = clamp_t(long, gain2, 0, 13); - v_agc = clamp_t(long, v_agc, 400, 1100); - -- *_gain = -(gain1 * 2330 + -+ *_gain = -((__s64)gain1 * 2330 + - gain2 * 3500 + - v_agc * 24 / 10 * 10 + - 10000); -@@ -387,7 +387,7 @@ static int ts2020_read_tuner_gain(struct dvb_frontend *fe, unsigned v_agc, - gain3 = clamp_t(long, gain3, 0, 6); - v_agc = clamp_t(long, v_agc, 600, 1600); - -- *_gain = -(gain1 * 2650 + -+ *_gain = -((__s64)gain1 * 2650 + - gain2 * 3380 + - gain3 * 2850 + - v_agc * 176 / 100 * 10 - -diff --git a/drivers/media/platform/soc_camera/soc_scale_crop.c b/drivers/media/platform/soc_camera/soc_scale_crop.c -index bda29bc1b933..2f74a5ac0147 100644 ---- a/drivers/media/platform/soc_camera/soc_scale_crop.c -+++ b/drivers/media/platform/soc_camera/soc_scale_crop.c -@@ -405,3 +405,7 @@ void soc_camera_calc_client_output(struct soc_camera_device *icd, - mf->height = soc_camera_shift_scale(rect->height, shift, scale_v); - } - EXPORT_SYMBOL(soc_camera_calc_client_output); -+ -+MODULE_DESCRIPTION("soc-camera scaling-cropping functions"); -+MODULE_AUTHOR("Guennadi Liakhovetski "); -+MODULE_LICENSE("GPL"); -diff --git a/drivers/media/usb/dvb-usb-v2/lmedm04.c b/drivers/media/usb/dvb-usb-v2/lmedm04.c -index 3721ee63b8fb..09c97847bf95 100644 ---- a/drivers/media/usb/dvb-usb-v2/lmedm04.c -+++ b/drivers/media/usb/dvb-usb-v2/lmedm04.c -@@ -503,18 +503,23 @@ static int lme2510_pid_filter(struct dvb_usb_adapter *adap, int index, u16 pid, - - static int lme2510_return_status(struct dvb_usb_device *d) - { -- int ret = 0; -+ int ret; - u8 *data; - -- data = kzalloc(10, GFP_KERNEL); -+ data = kzalloc(6, GFP_KERNEL); - if (!data) - return -ENOMEM; - -- ret |= usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), -- 0x06, 0x80, 0x0302, 0x00, data, 0x0006, 200); -- info("Firmware Status: %x (%x)", ret , data[2]); -+ ret = usb_control_msg(d->udev, usb_rcvctrlpipe(d->udev, 0), -+ 0x06, 0x80, 0x0302, 0x00, -+ data, 0x6, 200); -+ if (ret != 6) -+ ret = -EINVAL; -+ else -+ ret = data[2]; -+ -+ info("Firmware Status: %6ph", data); - -- ret = (ret < 0) ? -ENODEV : data[2]; - kfree(data); - return ret; - } -@@ -1078,8 +1083,6 @@ static int dm04_lme2510_frontend_attach(struct dvb_usb_adapter *adap) - - if (adap->fe[0]) { - info("FE Found M88RS2000"); -- dvb_attach(ts2020_attach, adap->fe[0], &ts2020_config, -- &d->i2c_adap); - st->i2c_tuner_gate_w = 5; - st->i2c_tuner_gate_r = 5; - st->i2c_tuner_addr = 0x60; -@@ -1145,17 +1148,18 @@ static int dm04_lme2510_tuner(struct dvb_usb_adapter *adap) - ret = st->tuner_config; - break; - case TUNER_RS2000: -- ret = st->tuner_config; -+ if (dvb_attach(ts2020_attach, adap->fe[0], -+ &ts2020_config, &d->i2c_adap)) -+ ret = st->tuner_config; - break; - default: - break; - } - -- if (ret) -+ if (ret) { - info("TUN Found %s tuner", tun_msg[ret]); -- else { -- info("TUN No tuner found --- resetting device"); -- lme_coldreset(d); -+ } else { -+ info("TUN No tuner found"); - return -ENODEV; - } - -@@ -1199,6 +1203,7 @@ static int lme2510_get_adapter_count(struct dvb_usb_device *d) - static int lme2510_identify_state(struct dvb_usb_device *d, const char **name) - { - struct lme2510_state *st = d->priv; -+ int status; - - usb_reset_configuration(d->udev); - -@@ -1207,12 +1212,16 @@ static int lme2510_identify_state(struct dvb_usb_device *d, const char **name) - - st->dvb_usb_lme2510_firmware = dvb_usb_lme2510_firmware; - -- if (lme2510_return_status(d) == 0x44) { -+ status = lme2510_return_status(d); -+ if (status == 0x44) { - *name = lme_firmware_switch(d, 0); - return COLD; - } - -- return 0; -+ if (status != 0x47) -+ return -EINVAL; -+ -+ return WARM; - } - - static int lme2510_get_stream_config(struct dvb_frontend *fe, u8 *ts_type, -diff --git a/drivers/media/usb/dvb-usb/cxusb.c b/drivers/media/usb/dvb-usb/cxusb.c -index ab7151181728..d00b27ed73a6 100644 ---- a/drivers/media/usb/dvb-usb/cxusb.c -+++ b/drivers/media/usb/dvb-usb/cxusb.c -@@ -818,6 +818,8 @@ static int dvico_bluebird_xc2028_callback(void *ptr, int component, - case XC2028_RESET_CLK: - deb_info("%s: XC2028_RESET_CLK %d\n", __func__, arg); - break; -+ case XC2028_I2C_FLUSH: -+ break; - default: - deb_info("%s: unknown command %d, arg %d\n", __func__, - command, arg); -diff --git a/drivers/media/usb/dvb-usb/dib0700_devices.c b/drivers/media/usb/dvb-usb/dib0700_devices.c -index 7df0707a0455..38c03283a441 100644 ---- a/drivers/media/usb/dvb-usb/dib0700_devices.c -+++ b/drivers/media/usb/dvb-usb/dib0700_devices.c -@@ -431,6 +431,7 @@ static int stk7700ph_xc3028_callback(void *ptr, int component, - state->dib7000p_ops.set_gpio(adap->fe_adap[0].fe, 8, 0, 1); - break; - case XC2028_RESET_CLK: -+ case XC2028_I2C_FLUSH: - break; - default: - err("%s: unknown command %d, arg %d\n", __func__, -diff --git a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -index 4379b949bb93..943f90e392a7 100644 ---- a/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -+++ b/drivers/media/v4l2-core/v4l2-compat-ioctl32.c -@@ -18,8 +18,18 @@ - #include - #include - #include -+#include -+#include - #include - -+/* Use the same argument order as copy_in_user */ -+#define assign_in_user(to, from) \ -+({ \ -+ typeof(*from) __assign_tmp; \ -+ \ -+ get_user(__assign_tmp, from) || put_user(__assign_tmp, to); \ -+}) -+ - static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { - long ret = -ENOIOCTLCMD; -@@ -33,131 +43,88 @@ static long native_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - - struct v4l2_clip32 { - struct v4l2_rect c; -- compat_caddr_t next; -+ compat_caddr_t next; - }; - - struct v4l2_window32 { - struct v4l2_rect w; -- __u32 field; /* enum v4l2_field */ -+ __u32 field; /* enum v4l2_field */ - __u32 chromakey; - compat_caddr_t clips; /* actually struct v4l2_clip32 * */ - __u32 clipcount; - compat_caddr_t bitmap; -+ __u8 global_alpha; - }; - --static int get_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) --{ -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_window32)) || -- copy_from_user(&kp->w, &up->w, sizeof(up->w)) || -- get_user(kp->field, &up->field) || -- get_user(kp->chromakey, &up->chromakey) || -- get_user(kp->clipcount, &up->clipcount)) -- return -EFAULT; -- if (kp->clipcount > 2048) -- return -EINVAL; -- if (kp->clipcount) { -- struct v4l2_clip32 __user *uclips; -- struct v4l2_clip __user *kclips; -- int n = kp->clipcount; -- compat_caddr_t p; -- -- if (get_user(p, &up->clips)) -- return -EFAULT; -- uclips = compat_ptr(p); -- kclips = compat_alloc_user_space(n * sizeof(struct v4l2_clip)); -- kp->clips = kclips; -- while (--n >= 0) { -- if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) -- return -EFAULT; -- if (put_user(n ? kclips + 1 : NULL, &kclips->next)) -- return -EFAULT; -- uclips += 1; -- kclips += 1; -- } -- } else -- kp->clips = NULL; -- return 0; --} -- --static int put_v4l2_window32(struct v4l2_window *kp, struct v4l2_window32 __user *up) --{ -- if (copy_to_user(&up->w, &kp->w, sizeof(kp->w)) || -- put_user(kp->field, &up->field) || -- put_user(kp->chromakey, &up->chromakey) || -- put_user(kp->clipcount, &up->clipcount)) -- return -EFAULT; -- return 0; --} -- --static inline int get_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up) --{ -- if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format))) -- return -EFAULT; -- return 0; --} -- --static inline int get_v4l2_pix_format_mplane(struct v4l2_pix_format_mplane *kp, -- struct v4l2_pix_format_mplane __user *up) --{ -- if (copy_from_user(kp, up, sizeof(struct v4l2_pix_format_mplane))) -- return -EFAULT; -- return 0; --} -- --static inline int put_v4l2_pix_format(struct v4l2_pix_format *kp, struct v4l2_pix_format __user *up) --{ -- if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format))) -- return -EFAULT; -- return 0; --} -- --static inline int put_v4l2_pix_format_mplane(struct v4l2_pix_format_mplane *kp, -- struct v4l2_pix_format_mplane __user *up) -+static int get_v4l2_window32(struct v4l2_window __user *kp, -+ struct v4l2_window32 __user *up, -+ void __user *aux_buf, u32 aux_space) - { -- if (copy_to_user(up, kp, sizeof(struct v4l2_pix_format_mplane))) -+ struct v4l2_clip32 __user *uclips; -+ struct v4l2_clip __user *kclips; -+ compat_caddr_t p; -+ u32 clipcount; -+ -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ copy_in_user(&kp->w, &up->w, sizeof(up->w)) || -+ assign_in_user(&kp->field, &up->field) || -+ assign_in_user(&kp->chromakey, &up->chromakey) || -+ assign_in_user(&kp->global_alpha, &up->global_alpha) || -+ get_user(clipcount, &up->clipcount) || -+ put_user(clipcount, &kp->clipcount)) - return -EFAULT; -- return 0; --} -+ if (clipcount > 2048) -+ return -EINVAL; -+ if (!clipcount) -+ return put_user(NULL, &kp->clips); - --static inline int get_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up) --{ -- if (copy_from_user(kp, up, sizeof(struct v4l2_vbi_format))) -+ if (get_user(p, &up->clips)) - return -EFAULT; -- return 0; --} -- --static inline int put_v4l2_vbi_format(struct v4l2_vbi_format *kp, struct v4l2_vbi_format __user *up) --{ -- if (copy_to_user(up, kp, sizeof(struct v4l2_vbi_format))) -+ uclips = compat_ptr(p); -+ if (aux_space < clipcount * sizeof(*kclips)) - return -EFAULT; -- return 0; --} -- --static inline int get_v4l2_sliced_vbi_format(struct v4l2_sliced_vbi_format *kp, struct v4l2_sliced_vbi_format __user *up) --{ -- if (copy_from_user(kp, up, sizeof(struct v4l2_sliced_vbi_format))) -+ kclips = aux_buf; -+ if (put_user(kclips, &kp->clips)) - return -EFAULT; -- return 0; --} - --static inline int put_v4l2_sliced_vbi_format(struct v4l2_sliced_vbi_format *kp, struct v4l2_sliced_vbi_format __user *up) --{ -- if (copy_to_user(up, kp, sizeof(struct v4l2_sliced_vbi_format))) -- return -EFAULT; -+ while (clipcount--) { -+ if (copy_in_user(&kclips->c, &uclips->c, sizeof(uclips->c))) -+ return -EFAULT; -+ if (put_user(clipcount ? kclips + 1 : NULL, &kclips->next)) -+ return -EFAULT; -+ uclips++; -+ kclips++; -+ } - return 0; - } - --static inline int get_v4l2_sdr_format(struct v4l2_sdr_format *kp, struct v4l2_sdr_format __user *up) -+static int put_v4l2_window32(struct v4l2_window __user *kp, -+ struct v4l2_window32 __user *up) - { -- if (copy_from_user(kp, up, sizeof(struct v4l2_sdr_format))) -+ struct v4l2_clip __user *kclips = kp->clips; -+ struct v4l2_clip32 __user *uclips; -+ compat_caddr_t p; -+ u32 clipcount; -+ -+ if (copy_in_user(&up->w, &kp->w, sizeof(kp->w)) || -+ assign_in_user(&up->field, &kp->field) || -+ assign_in_user(&up->chromakey, &kp->chromakey) || -+ assign_in_user(&up->global_alpha, &kp->global_alpha) || -+ get_user(clipcount, &kp->clipcount) || -+ put_user(clipcount, &up->clipcount)) - return -EFAULT; -- return 0; --} -+ if (!clipcount) -+ return 0; - --static inline int put_v4l2_sdr_format(struct v4l2_sdr_format *kp, struct v4l2_sdr_format __user *up) --{ -- if (copy_to_user(up, kp, sizeof(struct v4l2_sdr_format))) -+ if (get_user(p, &up->clips)) - return -EFAULT; -+ uclips = compat_ptr(p); -+ while (clipcount--) { -+ if (copy_in_user(&uclips->c, &kclips->c, sizeof(uclips->c))) -+ return -EFAULT; -+ uclips++; -+ kclips++; -+ } - return 0; - } - -@@ -191,97 +158,158 @@ struct v4l2_create_buffers32 { - __u32 reserved[8]; - }; - --static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) -+static int __bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size) -+{ -+ u32 type; -+ -+ if (get_user(type, &up->type)) -+ return -EFAULT; -+ -+ switch (type) { -+ case V4L2_BUF_TYPE_VIDEO_OVERLAY: -+ case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: { -+ u32 clipcount; -+ -+ if (get_user(clipcount, &up->fmt.win.clipcount)) -+ return -EFAULT; -+ if (clipcount > 2048) -+ return -EINVAL; -+ *size = clipcount * sizeof(struct v4l2_clip); -+ return 0; -+ } -+ default: -+ *size = 0; -+ return 0; -+ } -+} -+ -+static int bufsize_v4l2_format(struct v4l2_format32 __user *up, u32 *size) - { -- if (get_user(kp->type, &up->type)) -+ if (!access_ok(VERIFY_READ, up, sizeof(*up))) - return -EFAULT; -+ return __bufsize_v4l2_format(up, size); -+} - -- switch (kp->type) { -+static int __get_v4l2_format32(struct v4l2_format __user *kp, -+ struct v4l2_format32 __user *up, -+ void __user *aux_buf, u32 aux_space) -+{ -+ u32 type; -+ -+ if (get_user(type, &up->type) || put_user(type, &kp->type)) -+ return -EFAULT; -+ -+ switch (type) { - case V4L2_BUF_TYPE_VIDEO_CAPTURE: - case V4L2_BUF_TYPE_VIDEO_OUTPUT: -- return get_v4l2_pix_format(&kp->fmt.pix, &up->fmt.pix); -+ return copy_in_user(&kp->fmt.pix, &up->fmt.pix, -+ sizeof(kp->fmt.pix)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: - case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE: -- return get_v4l2_pix_format_mplane(&kp->fmt.pix_mp, -- &up->fmt.pix_mp); -+ return copy_in_user(&kp->fmt.pix_mp, &up->fmt.pix_mp, -+ sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_VIDEO_OVERLAY: - case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: -- return get_v4l2_window32(&kp->fmt.win, &up->fmt.win); -+ return get_v4l2_window32(&kp->fmt.win, &up->fmt.win, -+ aux_buf, aux_space); - case V4L2_BUF_TYPE_VBI_CAPTURE: - case V4L2_BUF_TYPE_VBI_OUTPUT: -- return get_v4l2_vbi_format(&kp->fmt.vbi, &up->fmt.vbi); -+ return copy_in_user(&kp->fmt.vbi, &up->fmt.vbi, -+ sizeof(kp->fmt.vbi)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE: - case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT: -- return get_v4l2_sliced_vbi_format(&kp->fmt.sliced, &up->fmt.sliced); -+ return copy_in_user(&kp->fmt.sliced, &up->fmt.sliced, -+ sizeof(kp->fmt.sliced)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_SDR_CAPTURE: - case V4L2_BUF_TYPE_SDR_OUTPUT: -- return get_v4l2_sdr_format(&kp->fmt.sdr, &up->fmt.sdr); -+ return copy_in_user(&kp->fmt.sdr, &up->fmt.sdr, -+ sizeof(kp->fmt.sdr)) ? -EFAULT : 0; - default: -- pr_info("compat_ioctl32: unexpected VIDIOC_FMT type %d\n", -- kp->type); - return -EINVAL; - } - } - --static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) -+static int get_v4l2_format32(struct v4l2_format __user *kp, -+ struct v4l2_format32 __user *up, -+ void __user *aux_buf, u32 aux_space) - { -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32))) -+ if (!access_ok(VERIFY_READ, up, sizeof(*up))) - return -EFAULT; -- return __get_v4l2_format32(kp, up); -+ return __get_v4l2_format32(kp, up, aux_buf, aux_space); - } - --static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up) -+static int bufsize_v4l2_create(struct v4l2_create_buffers32 __user *up, -+ u32 *size) - { -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) || -- copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format))) -+ if (!access_ok(VERIFY_READ, up, sizeof(*up))) - return -EFAULT; -- return __get_v4l2_format32(&kp->format, &up->format); -+ return __bufsize_v4l2_format(&up->format, size); - } - --static int __put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) -+static int get_v4l2_create32(struct v4l2_create_buffers __user *kp, -+ struct v4l2_create_buffers32 __user *up, -+ void __user *aux_buf, u32 aux_space) - { -- if (put_user(kp->type, &up->type)) -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ copy_in_user(kp, up, -+ offsetof(struct v4l2_create_buffers32, format))) - return -EFAULT; -+ return __get_v4l2_format32(&kp->format, &up->format, -+ aux_buf, aux_space); -+} -+ -+static int __put_v4l2_format32(struct v4l2_format __user *kp, -+ struct v4l2_format32 __user *up) -+{ -+ u32 type; - -- switch (kp->type) { -+ if (get_user(type, &kp->type)) -+ return -EFAULT; -+ -+ switch (type) { - case V4L2_BUF_TYPE_VIDEO_CAPTURE: - case V4L2_BUF_TYPE_VIDEO_OUTPUT: -- return put_v4l2_pix_format(&kp->fmt.pix, &up->fmt.pix); -+ return copy_in_user(&up->fmt.pix, &kp->fmt.pix, -+ sizeof(kp->fmt.pix)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_VIDEO_CAPTURE_MPLANE: - case V4L2_BUF_TYPE_VIDEO_OUTPUT_MPLANE: -- return put_v4l2_pix_format_mplane(&kp->fmt.pix_mp, -- &up->fmt.pix_mp); -+ return copy_in_user(&up->fmt.pix_mp, &kp->fmt.pix_mp, -+ sizeof(kp->fmt.pix_mp)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_VIDEO_OVERLAY: - case V4L2_BUF_TYPE_VIDEO_OUTPUT_OVERLAY: - return put_v4l2_window32(&kp->fmt.win, &up->fmt.win); - case V4L2_BUF_TYPE_VBI_CAPTURE: - case V4L2_BUF_TYPE_VBI_OUTPUT: -- return put_v4l2_vbi_format(&kp->fmt.vbi, &up->fmt.vbi); -+ return copy_in_user(&up->fmt.vbi, &kp->fmt.vbi, -+ sizeof(kp->fmt.vbi)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_SLICED_VBI_CAPTURE: - case V4L2_BUF_TYPE_SLICED_VBI_OUTPUT: -- return put_v4l2_sliced_vbi_format(&kp->fmt.sliced, &up->fmt.sliced); -+ return copy_in_user(&up->fmt.sliced, &kp->fmt.sliced, -+ sizeof(kp->fmt.sliced)) ? -EFAULT : 0; - case V4L2_BUF_TYPE_SDR_CAPTURE: - case V4L2_BUF_TYPE_SDR_OUTPUT: -- return put_v4l2_sdr_format(&kp->fmt.sdr, &up->fmt.sdr); -+ return copy_in_user(&up->fmt.sdr, &kp->fmt.sdr, -+ sizeof(kp->fmt.sdr)) ? -EFAULT : 0; - default: -- pr_info("compat_ioctl32: unexpected VIDIOC_FMT type %d\n", -- kp->type); - return -EINVAL; - } - } - --static int put_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up) -+static int put_v4l2_format32(struct v4l2_format __user *kp, -+ struct v4l2_format32 __user *up) - { -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_format32))) -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up))) - return -EFAULT; - return __put_v4l2_format32(kp, up); - } - --static int put_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up) -+static int put_v4l2_create32(struct v4l2_create_buffers __user *kp, -+ struct v4l2_create_buffers32 __user *up) - { -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_create_buffers32)) || -- copy_to_user(up, kp, offsetof(struct v4l2_create_buffers32, format)) || -- copy_to_user(up->reserved, kp->reserved, sizeof(kp->reserved))) -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ copy_in_user(up, kp, -+ offsetof(struct v4l2_create_buffers32, format)) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(kp->reserved))) - return -EFAULT; - return __put_v4l2_format32(&kp->format, &up->format); - } -@@ -295,25 +323,28 @@ struct v4l2_standard32 { - __u32 reserved[4]; - }; - --static int get_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up) -+static int get_v4l2_standard32(struct v4l2_standard __user *kp, -+ struct v4l2_standard32 __user *up) - { - /* other fields are not set by the user, nor used by the driver */ -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_standard32)) || -- get_user(kp->index, &up->index)) -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ assign_in_user(&kp->index, &up->index)) - return -EFAULT; - return 0; - } - --static int put_v4l2_standard32(struct v4l2_standard *kp, struct v4l2_standard32 __user *up) -+static int put_v4l2_standard32(struct v4l2_standard __user *kp, -+ struct v4l2_standard32 __user *up) - { -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_standard32)) || -- put_user(kp->index, &up->index) || -- put_user(kp->id, &up->id) || -- copy_to_user(up->name, kp->name, 24) || -- copy_to_user(&up->frameperiod, &kp->frameperiod, sizeof(kp->frameperiod)) || -- put_user(kp->framelines, &up->framelines) || -- copy_to_user(up->reserved, kp->reserved, 4 * sizeof(__u32))) -- return -EFAULT; -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->index, &kp->index) || -+ assign_in_user(&up->id, &kp->id) || -+ copy_in_user(up->name, kp->name, sizeof(up->name)) || -+ copy_in_user(&up->frameperiod, &kp->frameperiod, -+ sizeof(up->frameperiod)) || -+ assign_in_user(&up->framelines, &kp->framelines) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) -+ return -EFAULT; - return 0; - } - -@@ -352,134 +383,186 @@ struct v4l2_buffer32 { - __u32 reserved; - }; - --static int get_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32, -- enum v4l2_memory memory) -+static int get_v4l2_plane32(struct v4l2_plane __user *up, -+ struct v4l2_plane32 __user *up32, -+ enum v4l2_memory memory) - { -- void __user *up_pln; -- compat_long_t p; -+ compat_ulong_t p; - - if (copy_in_user(up, up32, 2 * sizeof(__u32)) || -- copy_in_user(&up->data_offset, &up32->data_offset, -- sizeof(__u32))) -+ copy_in_user(&up->data_offset, &up32->data_offset, -+ sizeof(up->data_offset))) - return -EFAULT; - -- if (memory == V4L2_MEMORY_USERPTR) { -- if (get_user(p, &up32->m.userptr)) -- return -EFAULT; -- up_pln = compat_ptr(p); -- if (put_user((unsigned long)up_pln, &up->m.userptr)) -+ switch (memory) { -+ case V4L2_MEMORY_MMAP: -+ case V4L2_MEMORY_OVERLAY: -+ if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, -+ sizeof(up32->m.mem_offset))) - return -EFAULT; -- } else if (memory == V4L2_MEMORY_DMABUF) { -- if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(int))) -+ break; -+ case V4L2_MEMORY_USERPTR: -+ if (get_user(p, &up32->m.userptr) || -+ put_user((unsigned long)compat_ptr(p), &up->m.userptr)) - return -EFAULT; -- } else { -- if (copy_in_user(&up->m.mem_offset, &up32->m.mem_offset, -- sizeof(__u32))) -+ break; -+ case V4L2_MEMORY_DMABUF: -+ if (copy_in_user(&up->m.fd, &up32->m.fd, sizeof(up32->m.fd))) - return -EFAULT; -+ break; - } - - return 0; - } - --static int put_v4l2_plane32(struct v4l2_plane __user *up, struct v4l2_plane32 __user *up32, -- enum v4l2_memory memory) -+static int put_v4l2_plane32(struct v4l2_plane __user *up, -+ struct v4l2_plane32 __user *up32, -+ enum v4l2_memory memory) - { -+ unsigned long p; -+ - if (copy_in_user(up32, up, 2 * sizeof(__u32)) || -- copy_in_user(&up32->data_offset, &up->data_offset, -- sizeof(__u32))) -+ copy_in_user(&up32->data_offset, &up->data_offset, -+ sizeof(up->data_offset))) - return -EFAULT; - -- /* For MMAP, driver might've set up the offset, so copy it back. -- * USERPTR stays the same (was userspace-provided), so no copying. */ -- if (memory == V4L2_MEMORY_MMAP) -+ switch (memory) { -+ case V4L2_MEMORY_MMAP: -+ case V4L2_MEMORY_OVERLAY: - if (copy_in_user(&up32->m.mem_offset, &up->m.mem_offset, -- sizeof(__u32))) -+ sizeof(up->m.mem_offset))) - return -EFAULT; -- /* For DMABUF, driver might've set up the fd, so copy it back. */ -- if (memory == V4L2_MEMORY_DMABUF) -- if (copy_in_user(&up32->m.fd, &up->m.fd, -- sizeof(int))) -+ break; -+ case V4L2_MEMORY_USERPTR: -+ if (get_user(p, &up->m.userptr) || -+ put_user((compat_ulong_t)ptr_to_compat((__force void *)p), -+ &up32->m.userptr)) -+ return -EFAULT; -+ break; -+ case V4L2_MEMORY_DMABUF: -+ if (copy_in_user(&up32->m.fd, &up->m.fd, sizeof(up->m.fd))) - return -EFAULT; -+ break; -+ } - - return 0; - } - --static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user *up) -+static int bufsize_v4l2_buffer(struct v4l2_buffer32 __user *up, u32 *size) - { -+ u32 type; -+ u32 length; -+ -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ get_user(type, &up->type) || -+ get_user(length, &up->length)) -+ return -EFAULT; -+ -+ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { -+ if (length > VIDEO_MAX_PLANES) -+ return -EINVAL; -+ -+ /* -+ * We don't really care if userspace decides to kill itself -+ * by passing a very big length value -+ */ -+ *size = length * sizeof(struct v4l2_plane); -+ } else { -+ *size = 0; -+ } -+ return 0; -+} -+ -+static int get_v4l2_buffer32(struct v4l2_buffer __user *kp, -+ struct v4l2_buffer32 __user *up, -+ void __user *aux_buf, u32 aux_space) -+{ -+ u32 type; -+ u32 length; -+ enum v4l2_memory memory; - struct v4l2_plane32 __user *uplane32; - struct v4l2_plane __user *uplane; - compat_caddr_t p; -- int num_planes; - int ret; - -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_buffer32)) || -- get_user(kp->index, &up->index) || -- get_user(kp->type, &up->type) || -- get_user(kp->flags, &up->flags) || -- get_user(kp->memory, &up->memory) || -- get_user(kp->length, &up->length)) -- return -EFAULT; -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ assign_in_user(&kp->index, &up->index) || -+ get_user(type, &up->type) || -+ put_user(type, &kp->type) || -+ assign_in_user(&kp->flags, &up->flags) || -+ get_user(memory, &up->memory) || -+ put_user(memory, &kp->memory) || -+ get_user(length, &up->length) || -+ put_user(length, &kp->length)) -+ return -EFAULT; - -- if (V4L2_TYPE_IS_OUTPUT(kp->type)) -- if (get_user(kp->bytesused, &up->bytesused) || -- get_user(kp->field, &up->field) || -- get_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || -- get_user(kp->timestamp.tv_usec, -- &up->timestamp.tv_usec)) -+ if (V4L2_TYPE_IS_OUTPUT(type)) -+ if (assign_in_user(&kp->bytesused, &up->bytesused) || -+ assign_in_user(&kp->field, &up->field) || -+ assign_in_user(&kp->timestamp.tv_sec, -+ &up->timestamp.tv_sec) || -+ assign_in_user(&kp->timestamp.tv_usec, -+ &up->timestamp.tv_usec)) - return -EFAULT; - -- if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { -- num_planes = kp->length; -+ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { -+ u32 num_planes = length; -+ - if (num_planes == 0) { -- kp->m.planes = NULL; -- /* num_planes == 0 is legal, e.g. when userspace doesn't -- * need planes array on DQBUF*/ -- return 0; -+ /* -+ * num_planes == 0 is legal, e.g. when userspace doesn't -+ * need planes array on DQBUF -+ */ -+ return put_user(NULL, &kp->m.planes); - } -+ if (num_planes > VIDEO_MAX_PLANES) -+ return -EINVAL; - - if (get_user(p, &up->m.planes)) - return -EFAULT; - - uplane32 = compat_ptr(p); - if (!access_ok(VERIFY_READ, uplane32, -- num_planes * sizeof(struct v4l2_plane32))) -+ num_planes * sizeof(*uplane32))) - return -EFAULT; - -- /* We don't really care if userspace decides to kill itself -- * by passing a very big num_planes value */ -- uplane = compat_alloc_user_space(num_planes * -- sizeof(struct v4l2_plane)); -- kp->m.planes = (__force struct v4l2_plane *)uplane; -+ /* -+ * We don't really care if userspace decides to kill itself -+ * by passing a very big num_planes value -+ */ -+ if (aux_space < num_planes * sizeof(*uplane)) -+ return -EFAULT; -+ -+ uplane = aux_buf; -+ if (put_user((__force struct v4l2_plane *)uplane, -+ &kp->m.planes)) -+ return -EFAULT; - -- while (--num_planes >= 0) { -- ret = get_v4l2_plane32(uplane, uplane32, kp->memory); -+ while (num_planes--) { -+ ret = get_v4l2_plane32(uplane, uplane32, memory); - if (ret) - return ret; -- ++uplane; -- ++uplane32; -+ uplane++; -+ uplane32++; - } - } else { -- switch (kp->memory) { -+ switch (memory) { - case V4L2_MEMORY_MMAP: -- if (get_user(kp->m.offset, &up->m.offset)) -+ case V4L2_MEMORY_OVERLAY: -+ if (assign_in_user(&kp->m.offset, &up->m.offset)) - return -EFAULT; - break; -- case V4L2_MEMORY_USERPTR: -- { -- compat_long_t tmp; -+ case V4L2_MEMORY_USERPTR: { -+ compat_ulong_t userptr; - -- if (get_user(tmp, &up->m.userptr)) -- return -EFAULT; -- -- kp->m.userptr = (unsigned long)compat_ptr(tmp); -- } -- break; -- case V4L2_MEMORY_OVERLAY: -- if (get_user(kp->m.offset, &up->m.offset)) -+ if (get_user(userptr, &up->m.userptr) || -+ put_user((unsigned long)compat_ptr(userptr), -+ &kp->m.userptr)) - return -EFAULT; - break; -+ } - case V4L2_MEMORY_DMABUF: -- if (get_user(kp->m.fd, &up->m.fd)) -+ if (assign_in_user(&kp->m.fd, &up->m.fd)) - return -EFAULT; - break; - } -@@ -488,65 +571,70 @@ static int get_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - return 0; - } - --static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user *up) -+static int put_v4l2_buffer32(struct v4l2_buffer __user *kp, -+ struct v4l2_buffer32 __user *up) - { -+ u32 type; -+ u32 length; -+ enum v4l2_memory memory; - struct v4l2_plane32 __user *uplane32; - struct v4l2_plane __user *uplane; - compat_caddr_t p; -- int num_planes; - int ret; - -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_buffer32)) || -- put_user(kp->index, &up->index) || -- put_user(kp->type, &up->type) || -- put_user(kp->flags, &up->flags) || -- put_user(kp->memory, &up->memory)) -- return -EFAULT; -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->index, &kp->index) || -+ get_user(type, &kp->type) || -+ put_user(type, &up->type) || -+ assign_in_user(&up->flags, &kp->flags) || -+ get_user(memory, &kp->memory) || -+ put_user(memory, &up->memory)) -+ return -EFAULT; - -- if (put_user(kp->bytesused, &up->bytesused) || -- put_user(kp->field, &up->field) || -- put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || -- put_user(kp->timestamp.tv_usec, &up->timestamp.tv_usec) || -- copy_to_user(&up->timecode, &kp->timecode, sizeof(struct v4l2_timecode)) || -- put_user(kp->sequence, &up->sequence) || -- put_user(kp->reserved2, &up->reserved2) || -- put_user(kp->reserved, &up->reserved) || -- put_user(kp->length, &up->length)) -- return -EFAULT; -+ if (assign_in_user(&up->bytesused, &kp->bytesused) || -+ assign_in_user(&up->field, &kp->field) || -+ assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) || -+ assign_in_user(&up->timestamp.tv_usec, &kp->timestamp.tv_usec) || -+ copy_in_user(&up->timecode, &kp->timecode, sizeof(kp->timecode)) || -+ assign_in_user(&up->sequence, &kp->sequence) || -+ assign_in_user(&up->reserved2, &kp->reserved2) || -+ assign_in_user(&up->reserved, &kp->reserved) || -+ get_user(length, &kp->length) || -+ put_user(length, &up->length)) -+ return -EFAULT; -+ -+ if (V4L2_TYPE_IS_MULTIPLANAR(type)) { -+ u32 num_planes = length; - -- if (V4L2_TYPE_IS_MULTIPLANAR(kp->type)) { -- num_planes = kp->length; - if (num_planes == 0) - return 0; - -- uplane = (__force struct v4l2_plane __user *)kp->m.planes; -+ if (get_user(uplane, ((__force struct v4l2_plane __user **)&kp->m.planes))) -+ return -EFAULT; - if (get_user(p, &up->m.planes)) - return -EFAULT; - uplane32 = compat_ptr(p); - -- while (--num_planes >= 0) { -- ret = put_v4l2_plane32(uplane, uplane32, kp->memory); -+ while (num_planes--) { -+ ret = put_v4l2_plane32(uplane, uplane32, memory); - if (ret) - return ret; - ++uplane; - ++uplane32; - } - } else { -- switch (kp->memory) { -+ switch (memory) { - case V4L2_MEMORY_MMAP: -- if (put_user(kp->m.offset, &up->m.offset)) -+ case V4L2_MEMORY_OVERLAY: -+ if (assign_in_user(&up->m.offset, &kp->m.offset)) - return -EFAULT; - break; - case V4L2_MEMORY_USERPTR: -- if (put_user(kp->m.userptr, &up->m.userptr)) -- return -EFAULT; -- break; -- case V4L2_MEMORY_OVERLAY: -- if (put_user(kp->m.offset, &up->m.offset)) -+ if (assign_in_user(&up->m.userptr, &kp->m.userptr)) - return -EFAULT; - break; - case V4L2_MEMORY_DMABUF: -- if (put_user(kp->m.fd, &up->m.fd)) -+ if (assign_in_user(&up->m.fd, &kp->m.fd)) - return -EFAULT; - break; - } -@@ -558,7 +646,7 @@ static int put_v4l2_buffer32(struct v4l2_buffer *kp, struct v4l2_buffer32 __user - struct v4l2_framebuffer32 { - __u32 capability; - __u32 flags; -- compat_caddr_t base; -+ compat_caddr_t base; - struct { - __u32 width; - __u32 height; -@@ -571,30 +659,33 @@ struct v4l2_framebuffer32 { - } fmt; - }; - --static int get_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_framebuffer32 __user *up) -+static int get_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp, -+ struct v4l2_framebuffer32 __user *up) - { -- u32 tmp; -- -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_framebuffer32)) || -- get_user(tmp, &up->base) || -- get_user(kp->capability, &up->capability) || -- get_user(kp->flags, &up->flags) || -- copy_from_user(&kp->fmt, &up->fmt, sizeof(up->fmt))) -- return -EFAULT; -- kp->base = (__force void *)compat_ptr(tmp); -+ compat_caddr_t tmp; -+ -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ get_user(tmp, &up->base) || -+ put_user((__force void *)compat_ptr(tmp), &kp->base) || -+ assign_in_user(&kp->capability, &up->capability) || -+ assign_in_user(&kp->flags, &up->flags) || -+ copy_in_user(&kp->fmt, &up->fmt, sizeof(kp->fmt))) -+ return -EFAULT; - return 0; - } - --static int put_v4l2_framebuffer32(struct v4l2_framebuffer *kp, struct v4l2_framebuffer32 __user *up) -+static int put_v4l2_framebuffer32(struct v4l2_framebuffer __user *kp, -+ struct v4l2_framebuffer32 __user *up) - { -- u32 tmp = (u32)((unsigned long)kp->base); -- -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_framebuffer32)) || -- put_user(tmp, &up->base) || -- put_user(kp->capability, &up->capability) || -- put_user(kp->flags, &up->flags) || -- copy_to_user(&up->fmt, &kp->fmt, sizeof(up->fmt))) -- return -EFAULT; -+ void *base; -+ -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ get_user(base, &kp->base) || -+ put_user(ptr_to_compat(base), &up->base) || -+ assign_in_user(&up->capability, &kp->capability) || -+ assign_in_user(&up->flags, &kp->flags) || -+ copy_in_user(&up->fmt, &kp->fmt, sizeof(kp->fmt))) -+ return -EFAULT; - return 0; - } - -@@ -606,21 +697,26 @@ struct v4l2_input32 { - __u32 tuner; /* Associated tuner */ - compat_u64 std; - __u32 status; -- __u32 reserved[4]; -+ __u32 capabilities; -+ __u32 reserved[3]; - }; - --/* The 64-bit v4l2_input struct has extra padding at the end of the struct. -- Otherwise it is identical to the 32-bit version. */ --static inline int get_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up) -+/* -+ * The 64-bit v4l2_input struct has extra padding at the end of the struct. -+ * Otherwise it is identical to the 32-bit version. -+ */ -+static inline int get_v4l2_input32(struct v4l2_input __user *kp, -+ struct v4l2_input32 __user *up) - { -- if (copy_from_user(kp, up, sizeof(struct v4l2_input32))) -+ if (copy_in_user(kp, up, sizeof(*up))) - return -EFAULT; - return 0; - } - --static inline int put_v4l2_input32(struct v4l2_input *kp, struct v4l2_input32 __user *up) -+static inline int put_v4l2_input32(struct v4l2_input __user *kp, -+ struct v4l2_input32 __user *up) - { -- if (copy_to_user(up, kp, sizeof(struct v4l2_input32))) -+ if (copy_in_user(up, kp, sizeof(*up))) - return -EFAULT; - return 0; - } -@@ -644,58 +740,95 @@ struct v4l2_ext_control32 { - }; - } __attribute__ ((packed)); - --/* The following function really belong in v4l2-common, but that causes -- a circular dependency between modules. We need to think about this, but -- for now this will do. */ -- --/* Return non-zero if this control is a pointer type. Currently only -- type STRING is a pointer type. */ --static inline int ctrl_is_pointer(u32 id) -+/* Return true if this control is a pointer type. */ -+static inline bool ctrl_is_pointer(struct file *file, u32 id) - { -- switch (id) { -- case V4L2_CID_RDS_TX_PS_NAME: -- case V4L2_CID_RDS_TX_RADIO_TEXT: -- return 1; -- default: -- return 0; -+ struct video_device *vdev = video_devdata(file); -+ struct v4l2_fh *fh = NULL; -+ struct v4l2_ctrl_handler *hdl = NULL; -+ struct v4l2_query_ext_ctrl qec = { id }; -+ const struct v4l2_ioctl_ops *ops = vdev->ioctl_ops; -+ -+ if (test_bit(V4L2_FL_USES_V4L2_FH, &vdev->flags)) -+ fh = file->private_data; -+ -+ if (fh && fh->ctrl_handler) -+ hdl = fh->ctrl_handler; -+ else if (vdev->ctrl_handler) -+ hdl = vdev->ctrl_handler; -+ -+ if (hdl) { -+ struct v4l2_ctrl *ctrl = v4l2_ctrl_find(hdl, id); -+ -+ return ctrl && ctrl->is_ptr; - } -+ -+ if (!ops || !ops->vidioc_query_ext_ctrl) -+ return false; -+ -+ return !ops->vidioc_query_ext_ctrl(file, fh, &qec) && -+ (qec.flags & V4L2_CTRL_FLAG_HAS_PAYLOAD); -+} -+ -+static int bufsize_v4l2_ext_controls(struct v4l2_ext_controls32 __user *up, -+ u32 *size) -+{ -+ u32 count; -+ -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ get_user(count, &up->count)) -+ return -EFAULT; -+ if (count > V4L2_CID_MAX_CTRLS) -+ return -EINVAL; -+ *size = count * sizeof(struct v4l2_ext_control); -+ return 0; - } - --static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) -+static int get_v4l2_ext_controls32(struct file *file, -+ struct v4l2_ext_controls __user *kp, -+ struct v4l2_ext_controls32 __user *up, -+ void __user *aux_buf, u32 aux_space) - { - struct v4l2_ext_control32 __user *ucontrols; - struct v4l2_ext_control __user *kcontrols; -- int n; -+ u32 count; -+ u32 n; - compat_caddr_t p; - -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_ext_controls32)) || -- get_user(kp->ctrl_class, &up->ctrl_class) || -- get_user(kp->count, &up->count) || -- get_user(kp->error_idx, &up->error_idx) || -- copy_from_user(kp->reserved, up->reserved, -- sizeof(kp->reserved))) -- return -EFAULT; -- n = kp->count; -- if (n == 0) { -- kp->controls = NULL; -- return 0; -- } -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ assign_in_user(&kp->ctrl_class, &up->ctrl_class) || -+ get_user(count, &up->count) || -+ put_user(count, &kp->count) || -+ assign_in_user(&kp->error_idx, &up->error_idx) || -+ copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved))) -+ return -EFAULT; -+ -+ if (count == 0) -+ return put_user(NULL, &kp->controls); -+ if (count > V4L2_CID_MAX_CTRLS) -+ return -EINVAL; - if (get_user(p, &up->controls)) - return -EFAULT; - ucontrols = compat_ptr(p); -- if (!access_ok(VERIFY_READ, ucontrols, -- n * sizeof(struct v4l2_ext_control32))) -+ if (!access_ok(VERIFY_READ, ucontrols, count * sizeof(*ucontrols))) -+ return -EFAULT; -+ if (aux_space < count * sizeof(*kcontrols)) - return -EFAULT; -- kcontrols = compat_alloc_user_space(n * sizeof(struct v4l2_ext_control)); -- kp->controls = (__force struct v4l2_ext_control *)kcontrols; -- while (--n >= 0) { -+ kcontrols = aux_buf; -+ if (put_user((__force struct v4l2_ext_control *)kcontrols, -+ &kp->controls)) -+ return -EFAULT; -+ -+ for (n = 0; n < count; n++) { - u32 id; - - if (copy_in_user(kcontrols, ucontrols, sizeof(*ucontrols))) - return -EFAULT; -+ - if (get_user(id, &kcontrols->id)) - return -EFAULT; -- if (ctrl_is_pointer(id)) { -+ -+ if (ctrl_is_pointer(file, id)) { - void __user *s; - - if (get_user(p, &ucontrols->string)) -@@ -710,43 +843,55 @@ static int get_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext - return 0; - } - --static int put_v4l2_ext_controls32(struct v4l2_ext_controls *kp, struct v4l2_ext_controls32 __user *up) -+static int put_v4l2_ext_controls32(struct file *file, -+ struct v4l2_ext_controls __user *kp, -+ struct v4l2_ext_controls32 __user *up) - { - struct v4l2_ext_control32 __user *ucontrols; -- struct v4l2_ext_control __user *kcontrols = -- (__force struct v4l2_ext_control __user *)kp->controls; -- int n = kp->count; -+ struct v4l2_ext_control __user *kcontrols; -+ u32 count; -+ u32 n; - compat_caddr_t p; - -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_ext_controls32)) || -- put_user(kp->ctrl_class, &up->ctrl_class) || -- put_user(kp->count, &up->count) || -- put_user(kp->error_idx, &up->error_idx) || -- copy_to_user(up->reserved, kp->reserved, sizeof(up->reserved))) -- return -EFAULT; -- if (!kp->count) -- return 0; -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->ctrl_class, &kp->ctrl_class) || -+ get_user(count, &kp->count) || -+ put_user(count, &up->count) || -+ assign_in_user(&up->error_idx, &kp->error_idx) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved)) || -+ get_user(kcontrols, &kp->controls)) -+ return -EFAULT; - -+ if (!count) -+ return 0; - if (get_user(p, &up->controls)) - return -EFAULT; - ucontrols = compat_ptr(p); -- if (!access_ok(VERIFY_WRITE, ucontrols, -- n * sizeof(struct v4l2_ext_control32))) -+ if (!access_ok(VERIFY_WRITE, ucontrols, count * sizeof(*ucontrols))) - return -EFAULT; - -- while (--n >= 0) { -- unsigned size = sizeof(*ucontrols); -+ for (n = 0; n < count; n++) { -+ unsigned int size = sizeof(*ucontrols); - u32 id; - -- if (get_user(id, &kcontrols->id)) -+ if (get_user(id, &kcontrols->id) || -+ put_user(id, &ucontrols->id) || -+ assign_in_user(&ucontrols->size, &kcontrols->size) || -+ copy_in_user(&ucontrols->reserved2, &kcontrols->reserved2, -+ sizeof(ucontrols->reserved2))) - return -EFAULT; -- /* Do not modify the pointer when copying a pointer control. -- The contents of the pointer was changed, not the pointer -- itself. */ -- if (ctrl_is_pointer(id)) -+ -+ /* -+ * Do not modify the pointer when copying a pointer control. -+ * The contents of the pointer was changed, not the pointer -+ * itself. -+ */ -+ if (ctrl_is_pointer(file, id)) - size -= sizeof(ucontrols->value64); -+ - if (copy_in_user(ucontrols, kcontrols, size)) - return -EFAULT; -+ - ucontrols++; - kcontrols++; - } -@@ -766,18 +911,19 @@ struct v4l2_event32 { - __u32 reserved[8]; - }; - --static int put_v4l2_event32(struct v4l2_event *kp, struct v4l2_event32 __user *up) -+static int put_v4l2_event32(struct v4l2_event __user *kp, -+ struct v4l2_event32 __user *up) - { -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_event32)) || -- put_user(kp->type, &up->type) || -- copy_to_user(&up->u, &kp->u, sizeof(kp->u)) || -- put_user(kp->pending, &up->pending) || -- put_user(kp->sequence, &up->sequence) || -- put_user(kp->timestamp.tv_sec, &up->timestamp.tv_sec) || -- put_user(kp->timestamp.tv_nsec, &up->timestamp.tv_nsec) || -- put_user(kp->id, &up->id) || -- copy_to_user(up->reserved, kp->reserved, 8 * sizeof(__u32))) -- return -EFAULT; -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->type, &kp->type) || -+ copy_in_user(&up->u, &kp->u, sizeof(kp->u)) || -+ assign_in_user(&up->pending, &kp->pending) || -+ assign_in_user(&up->sequence, &kp->sequence) || -+ assign_in_user(&up->timestamp.tv_sec, &kp->timestamp.tv_sec) || -+ assign_in_user(&up->timestamp.tv_nsec, &kp->timestamp.tv_nsec) || -+ assign_in_user(&up->id, &kp->id) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) -+ return -EFAULT; - return 0; - } - -@@ -789,32 +935,35 @@ struct v4l2_edid32 { - compat_caddr_t edid; - }; - --static int get_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) -+static int get_v4l2_edid32(struct v4l2_edid __user *kp, -+ struct v4l2_edid32 __user *up) - { -- u32 tmp; -- -- if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_edid32)) || -- get_user(kp->pad, &up->pad) || -- get_user(kp->start_block, &up->start_block) || -- get_user(kp->blocks, &up->blocks) || -- get_user(tmp, &up->edid) || -- copy_from_user(kp->reserved, up->reserved, sizeof(kp->reserved))) -- return -EFAULT; -- kp->edid = (__force u8 *)compat_ptr(tmp); -+ compat_uptr_t tmp; -+ -+ if (!access_ok(VERIFY_READ, up, sizeof(*up)) || -+ assign_in_user(&kp->pad, &up->pad) || -+ assign_in_user(&kp->start_block, &up->start_block) || -+ assign_in_user(&kp->blocks, &up->blocks) || -+ get_user(tmp, &up->edid) || -+ put_user(compat_ptr(tmp), &kp->edid) || -+ copy_in_user(kp->reserved, up->reserved, sizeof(kp->reserved))) -+ return -EFAULT; - return 0; - } - --static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) -+static int put_v4l2_edid32(struct v4l2_edid __user *kp, -+ struct v4l2_edid32 __user *up) - { -- u32 tmp = (u32)((unsigned long)kp->edid); -- -- if (!access_ok(VERIFY_WRITE, up, sizeof(struct v4l2_edid32)) || -- put_user(kp->pad, &up->pad) || -- put_user(kp->start_block, &up->start_block) || -- put_user(kp->blocks, &up->blocks) || -- put_user(tmp, &up->edid) || -- copy_to_user(up->reserved, kp->reserved, sizeof(up->reserved))) -- return -EFAULT; -+ void *edid; -+ -+ if (!access_ok(VERIFY_WRITE, up, sizeof(*up)) || -+ assign_in_user(&up->pad, &kp->pad) || -+ assign_in_user(&up->start_block, &kp->start_block) || -+ assign_in_user(&up->blocks, &kp->blocks) || -+ get_user(edid, &kp->edid) || -+ put_user(ptr_to_compat(edid), &up->edid) || -+ copy_in_user(up->reserved, kp->reserved, sizeof(up->reserved))) -+ return -EFAULT; - return 0; - } - -@@ -830,7 +979,7 @@ static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) - #define VIDIOC_ENUMINPUT32 _IOWR('V', 26, struct v4l2_input32) - #define VIDIOC_G_EDID32 _IOWR('V', 40, struct v4l2_edid32) - #define VIDIOC_S_EDID32 _IOWR('V', 41, struct v4l2_edid32) --#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32) -+#define VIDIOC_TRY_FMT32 _IOWR('V', 64, struct v4l2_format32) - #define VIDIOC_G_EXT_CTRLS32 _IOWR('V', 71, struct v4l2_ext_controls32) - #define VIDIOC_S_EXT_CTRLS32 _IOWR('V', 72, struct v4l2_ext_controls32) - #define VIDIOC_TRY_EXT_CTRLS32 _IOWR('V', 73, struct v4l2_ext_controls32) -@@ -846,22 +995,23 @@ static int put_v4l2_edid32(struct v4l2_edid *kp, struct v4l2_edid32 __user *up) - #define VIDIOC_G_OUTPUT32 _IOR ('V', 46, s32) - #define VIDIOC_S_OUTPUT32 _IOWR('V', 47, s32) - -+static int alloc_userspace(unsigned int size, u32 aux_space, -+ void __user **up_native) -+{ -+ *up_native = compat_alloc_user_space(size + aux_space); -+ if (!*up_native) -+ return -ENOMEM; -+ if (clear_user(*up_native, size)) -+ return -EFAULT; -+ return 0; -+} -+ - static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { -- union { -- struct v4l2_format v2f; -- struct v4l2_buffer v2b; -- struct v4l2_framebuffer v2fb; -- struct v4l2_input v2i; -- struct v4l2_standard v2s; -- struct v4l2_ext_controls v2ecs; -- struct v4l2_event v2ev; -- struct v4l2_create_buffers v2crt; -- struct v4l2_edid v2edid; -- unsigned long vx; -- int vi; -- } karg; - void __user *up = compat_ptr(arg); -+ void __user *up_native = NULL; -+ void __user *aux_buf; -+ u32 aux_space; - int compatible_arg = 1; - long err = 0; - -@@ -900,30 +1050,52 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar - case VIDIOC_STREAMOFF: - case VIDIOC_S_INPUT: - case VIDIOC_S_OUTPUT: -- err = get_user(karg.vi, (s32 __user *)up); -+ err = alloc_userspace(sizeof(unsigned int), 0, &up_native); -+ if (!err && assign_in_user((unsigned int __user *)up_native, -+ (compat_uint_t __user *)up)) -+ err = -EFAULT; - compatible_arg = 0; - break; - - case VIDIOC_G_INPUT: - case VIDIOC_G_OUTPUT: -+ err = alloc_userspace(sizeof(unsigned int), 0, &up_native); - compatible_arg = 0; - break; - - case VIDIOC_G_EDID: - case VIDIOC_S_EDID: -- err = get_v4l2_edid32(&karg.v2edid, up); -+ err = alloc_userspace(sizeof(struct v4l2_edid), 0, &up_native); -+ if (!err) -+ err = get_v4l2_edid32(up_native, up); - compatible_arg = 0; - break; - - case VIDIOC_G_FMT: - case VIDIOC_S_FMT: - case VIDIOC_TRY_FMT: -- err = get_v4l2_format32(&karg.v2f, up); -+ err = bufsize_v4l2_format(up, &aux_space); -+ if (!err) -+ err = alloc_userspace(sizeof(struct v4l2_format), -+ aux_space, &up_native); -+ if (!err) { -+ aux_buf = up_native + sizeof(struct v4l2_format); -+ err = get_v4l2_format32(up_native, up, -+ aux_buf, aux_space); -+ } - compatible_arg = 0; - break; - - case VIDIOC_CREATE_BUFS: -- err = get_v4l2_create32(&karg.v2crt, up); -+ err = bufsize_v4l2_create(up, &aux_space); -+ if (!err) -+ err = alloc_userspace(sizeof(struct v4l2_create_buffers), -+ aux_space, &up_native); -+ if (!err) { -+ aux_buf = up_native + sizeof(struct v4l2_create_buffers); -+ err = get_v4l2_create32(up_native, up, -+ aux_buf, aux_space); -+ } - compatible_arg = 0; - break; - -@@ -931,36 +1103,63 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar - case VIDIOC_QUERYBUF: - case VIDIOC_QBUF: - case VIDIOC_DQBUF: -- err = get_v4l2_buffer32(&karg.v2b, up); -+ err = bufsize_v4l2_buffer(up, &aux_space); -+ if (!err) -+ err = alloc_userspace(sizeof(struct v4l2_buffer), -+ aux_space, &up_native); -+ if (!err) { -+ aux_buf = up_native + sizeof(struct v4l2_buffer); -+ err = get_v4l2_buffer32(up_native, up, -+ aux_buf, aux_space); -+ } - compatible_arg = 0; - break; - - case VIDIOC_S_FBUF: -- err = get_v4l2_framebuffer32(&karg.v2fb, up); -+ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0, -+ &up_native); -+ if (!err) -+ err = get_v4l2_framebuffer32(up_native, up); - compatible_arg = 0; - break; - - case VIDIOC_G_FBUF: -+ err = alloc_userspace(sizeof(struct v4l2_framebuffer), 0, -+ &up_native); - compatible_arg = 0; - break; - - case VIDIOC_ENUMSTD: -- err = get_v4l2_standard32(&karg.v2s, up); -+ err = alloc_userspace(sizeof(struct v4l2_standard), 0, -+ &up_native); -+ if (!err) -+ err = get_v4l2_standard32(up_native, up); - compatible_arg = 0; - break; - - case VIDIOC_ENUMINPUT: -- err = get_v4l2_input32(&karg.v2i, up); -+ err = alloc_userspace(sizeof(struct v4l2_input), 0, &up_native); -+ if (!err) -+ err = get_v4l2_input32(up_native, up); - compatible_arg = 0; - break; - - case VIDIOC_G_EXT_CTRLS: - case VIDIOC_S_EXT_CTRLS: - case VIDIOC_TRY_EXT_CTRLS: -- err = get_v4l2_ext_controls32(&karg.v2ecs, up); -+ err = bufsize_v4l2_ext_controls(up, &aux_space); -+ if (!err) -+ err = alloc_userspace(sizeof(struct v4l2_ext_controls), -+ aux_space, &up_native); -+ if (!err) { -+ aux_buf = up_native + sizeof(struct v4l2_ext_controls); -+ err = get_v4l2_ext_controls32(file, up_native, up, -+ aux_buf, aux_space); -+ } - compatible_arg = 0; - break; - case VIDIOC_DQEVENT: -+ err = alloc_userspace(sizeof(struct v4l2_event), 0, &up_native); - compatible_arg = 0; - break; - } -@@ -969,22 +1168,26 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar - - if (compatible_arg) - err = native_ioctl(file, cmd, (unsigned long)up); -- else { -- mm_segment_t old_fs = get_fs(); -+ else -+ err = native_ioctl(file, cmd, (unsigned long)up_native); - -- set_fs(KERNEL_DS); -- err = native_ioctl(file, cmd, (unsigned long)&karg); -- set_fs(old_fs); -- } -+ if (err == -ENOTTY) -+ return err; - -- /* Special case: even after an error we need to put the -- results back for these ioctls since the error_idx will -- contain information on which control failed. */ -+ /* -+ * Special case: even after an error we need to put the -+ * results back for these ioctls since the error_idx will -+ * contain information on which control failed. -+ */ - switch (cmd) { - case VIDIOC_G_EXT_CTRLS: - case VIDIOC_S_EXT_CTRLS: - case VIDIOC_TRY_EXT_CTRLS: -- if (put_v4l2_ext_controls32(&karg.v2ecs, up)) -+ if (put_v4l2_ext_controls32(file, up_native, up)) -+ err = -EFAULT; -+ break; -+ case VIDIOC_S_EDID: -+ if (put_v4l2_edid32(up_native, up)) - err = -EFAULT; - break; - } -@@ -996,44 +1199,46 @@ static long do_video_ioctl(struct file *file, unsigned int cmd, unsigned long ar - case VIDIOC_S_OUTPUT: - case VIDIOC_G_INPUT: - case VIDIOC_G_OUTPUT: -- err = put_user(((s32)karg.vi), (s32 __user *)up); -+ if (assign_in_user((compat_uint_t __user *)up, -+ ((unsigned int __user *)up_native))) -+ err = -EFAULT; - break; - - case VIDIOC_G_FBUF: -- err = put_v4l2_framebuffer32(&karg.v2fb, up); -+ err = put_v4l2_framebuffer32(up_native, up); - break; - - case VIDIOC_DQEVENT: -- err = put_v4l2_event32(&karg.v2ev, up); -+ err = put_v4l2_event32(up_native, up); - break; - - case VIDIOC_G_EDID: -- case VIDIOC_S_EDID: -- err = put_v4l2_edid32(&karg.v2edid, up); -+ err = put_v4l2_edid32(up_native, up); - break; - - case VIDIOC_G_FMT: - case VIDIOC_S_FMT: - case VIDIOC_TRY_FMT: -- err = put_v4l2_format32(&karg.v2f, up); -+ err = put_v4l2_format32(up_native, up); - break; - - case VIDIOC_CREATE_BUFS: -- err = put_v4l2_create32(&karg.v2crt, up); -+ err = put_v4l2_create32(up_native, up); - break; - -+ case VIDIOC_PREPARE_BUF: - case VIDIOC_QUERYBUF: - case VIDIOC_QBUF: - case VIDIOC_DQBUF: -- err = put_v4l2_buffer32(&karg.v2b, up); -+ err = put_v4l2_buffer32(up_native, up); - break; - - case VIDIOC_ENUMSTD: -- err = put_v4l2_standard32(&karg.v2s, up); -+ err = put_v4l2_standard32(up_native, up); - break; - - case VIDIOC_ENUMINPUT: -- err = put_v4l2_input32(&karg.v2i, up); -+ err = put_v4l2_input32(up_native, up); - break; - } - return err; -diff --git a/drivers/media/v4l2-core/v4l2-ioctl.c b/drivers/media/v4l2-core/v4l2-ioctl.c -index 7486af2c8ae4..5e2a7e59f578 100644 ---- a/drivers/media/v4l2-core/v4l2-ioctl.c -+++ b/drivers/media/v4l2-core/v4l2-ioctl.c -@@ -2783,8 +2783,11 @@ video_usercopy(struct file *file, unsigned int cmd, unsigned long arg, - - /* Handles IOCTL */ - err = func(file, cmd, parg); -- if (err == -ENOIOCTLCMD) -+ if (err == -ENOTTY || err == -ENOIOCTLCMD) { - err = -ENOTTY; -+ goto out; -+ } -+ - if (err == 0) { - if (cmd == VIDIOC_DQBUF) - trace_v4l2_dqbuf(video_devdata(file)->minor, parg); -diff --git a/drivers/media/v4l2-core/videobuf2-v4l2.c b/drivers/media/v4l2-core/videobuf2-v4l2.c -index 6c441be8f893..bf23234d957e 100644 ---- a/drivers/media/v4l2-core/videobuf2-v4l2.c -+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c -@@ -593,6 +593,12 @@ static int vb2_internal_dqbuf(struct vb2_queue *q, struct v4l2_buffer *b, - b->flags & V4L2_BUF_FLAG_LAST) - q->last_buffer_dequeued = true; - -+ /* -+ * After calling the VIDIOC_DQBUF V4L2_BUF_FLAG_DONE must be -+ * cleared. -+ */ -+ b->flags &= ~V4L2_BUF_FLAG_DONE; -+ - return ret; - } - -diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c -index 4a07ba1195b5..d125d19a35e4 100644 ---- a/drivers/mtd/nand/brcmnand/brcmnand.c -+++ b/drivers/mtd/nand/brcmnand/brcmnand.c -@@ -1922,16 +1922,9 @@ static int brcmnand_setup_dev(struct brcmnand_host *host) - tmp &= ~ACC_CONTROL_PARTIAL_PAGE; - tmp &= ~ACC_CONTROL_RD_ERASED; - tmp &= ~ACC_CONTROL_FAST_PGM_RDIN; -- if (ctrl->features & BRCMNAND_HAS_PREFETCH) { -- /* -- * FIXME: Flash DMA + prefetch may see spurious erased-page ECC -- * errors -- */ -- if (has_flash_dma(ctrl)) -- tmp &= ~ACC_CONTROL_PREFETCH; -- else -- tmp |= ACC_CONTROL_PREFETCH; -- } -+ if (ctrl->features & BRCMNAND_HAS_PREFETCH) -+ tmp &= ~ACC_CONTROL_PREFETCH; -+ - nand_writereg(ctrl, offs, tmp); - - return 0; -diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c -index 7ba109e8cf88..27864c0863ef 100644 ---- a/drivers/mtd/nand/nand_base.c -+++ b/drivers/mtd/nand/nand_base.c -@@ -2023,6 +2023,7 @@ static int nand_write_oob_syndrome(struct mtd_info *mtd, - static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, - struct mtd_oob_ops *ops) - { -+ unsigned int max_bitflips = 0; - int page, realpage, chipnr; - struct nand_chip *chip = mtd->priv; - struct mtd_ecc_stats stats; -@@ -2083,6 +2084,8 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, - nand_wait_ready(mtd); - } - -+ max_bitflips = max_t(unsigned int, max_bitflips, ret); -+ - readlen -= len; - if (!readlen) - break; -@@ -2108,7 +2111,7 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, - if (mtd->ecc_stats.failed - stats.failed) - return -EBADMSG; - -- return mtd->ecc_stats.corrected - stats.corrected ? -EUCLEAN : 0; -+ return max_bitflips; - } - - /** -diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c -index 824711845c44..3bb9b34d9e77 100644 ---- a/drivers/mtd/nand/sunxi_nand.c -+++ b/drivers/mtd/nand/sunxi_nand.c -@@ -1046,8 +1046,14 @@ static int sunxi_nand_hw_common_ecc_ctrl_init(struct mtd_info *mtd, - - /* Add ECC info retrieval from DT */ - for (i = 0; i < ARRAY_SIZE(strengths); i++) { -- if (ecc->strength <= strengths[i]) -+ if (ecc->strength <= strengths[i]) { -+ /* -+ * Update ecc->strength value with the actual strength -+ * that will be used by the ECC engine. -+ */ -+ ecc->strength = strengths[i]; - break; -+ } - } - - if (i >= ARRAY_SIZE(strengths)) { -diff --git a/drivers/mtd/ubi/block.c b/drivers/mtd/ubi/block.c -index ebf46ad2d513..b2fb0528c092 100644 ---- a/drivers/mtd/ubi/block.c -+++ b/drivers/mtd/ubi/block.c -@@ -99,6 +99,8 @@ struct ubiblock { - - /* Linked list of all ubiblock instances */ - static LIST_HEAD(ubiblock_devices); -+static DEFINE_IDR(ubiblock_minor_idr); -+/* Protects ubiblock_devices and ubiblock_minor_idr */ - static DEFINE_MUTEX(devices_mutex); - static int ubiblock_major; - -@@ -354,8 +356,6 @@ static struct blk_mq_ops ubiblock_mq_ops = { - .map_queue = blk_mq_map_queue, - }; - --static DEFINE_IDR(ubiblock_minor_idr); -- - int ubiblock_create(struct ubi_volume_info *vi) - { - struct ubiblock *dev; -@@ -368,14 +368,15 @@ int ubiblock_create(struct ubi_volume_info *vi) - /* Check that the volume isn't already handled */ - mutex_lock(&devices_mutex); - if (find_dev_nolock(vi->ubi_num, vi->vol_id)) { -- mutex_unlock(&devices_mutex); -- return -EEXIST; -+ ret = -EEXIST; -+ goto out_unlock; - } -- mutex_unlock(&devices_mutex); - - dev = kzalloc(sizeof(struct ubiblock), GFP_KERNEL); -- if (!dev) -- return -ENOMEM; -+ if (!dev) { -+ ret = -ENOMEM; -+ goto out_unlock; -+ } - - mutex_init(&dev->dev_mutex); - -@@ -440,14 +441,13 @@ int ubiblock_create(struct ubi_volume_info *vi) - goto out_free_queue; - } - -- mutex_lock(&devices_mutex); - list_add_tail(&dev->list, &ubiblock_devices); -- mutex_unlock(&devices_mutex); - - /* Must be the last step: anyone can call file ops from now on */ - add_disk(dev->gd); - dev_info(disk_to_dev(dev->gd), "created from ubi%d:%d(%s)", - dev->ubi_num, dev->vol_id, vi->name); -+ mutex_unlock(&devices_mutex); - return 0; - - out_free_queue: -@@ -460,6 +460,8 @@ out_put_disk: - put_disk(dev->gd); - out_free_dev: - kfree(dev); -+out_unlock: -+ mutex_unlock(&devices_mutex); - - return ret; - } -@@ -481,30 +483,36 @@ static void ubiblock_cleanup(struct ubiblock *dev) - int ubiblock_remove(struct ubi_volume_info *vi) - { - struct ubiblock *dev; -+ int ret; - - mutex_lock(&devices_mutex); - dev = find_dev_nolock(vi->ubi_num, vi->vol_id); - if (!dev) { -- mutex_unlock(&devices_mutex); -- return -ENODEV; -+ ret = -ENODEV; -+ goto out_unlock; - } - - /* Found a device, let's lock it so we can check if it's busy */ - mutex_lock(&dev->dev_mutex); - if (dev->refcnt > 0) { -- mutex_unlock(&dev->dev_mutex); -- mutex_unlock(&devices_mutex); -- return -EBUSY; -+ ret = -EBUSY; -+ goto out_unlock_dev; - } - - /* Remove from device list */ - list_del(&dev->list); -- mutex_unlock(&devices_mutex); -- - ubiblock_cleanup(dev); - mutex_unlock(&dev->dev_mutex); -+ mutex_unlock(&devices_mutex); -+ - kfree(dev); - return 0; -+ -+out_unlock_dev: -+ mutex_unlock(&dev->dev_mutex); -+out_unlock: -+ mutex_unlock(&devices_mutex); -+ return ret; - } - - static int ubiblock_resize(struct ubi_volume_info *vi) -@@ -633,6 +641,7 @@ static void ubiblock_remove_all(void) - struct ubiblock *next; - struct ubiblock *dev; - -+ mutex_lock(&devices_mutex); - list_for_each_entry_safe(dev, next, &ubiblock_devices, list) { - /* The module is being forcefully removed */ - WARN_ON(dev->desc); -@@ -641,6 +650,7 @@ static void ubiblock_remove_all(void) - ubiblock_cleanup(dev); - kfree(dev); - } -+ mutex_unlock(&devices_mutex); - } - - int __init ubiblock_init(void) -diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -index f9640d5ce6ba..b4f3cb55605e 100644 ---- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c -@@ -3850,7 +3850,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) - struct list_head *head = &mbx->cmd_q; - struct qlcnic_cmd_args *cmd = NULL; - -- spin_lock(&mbx->queue_lock); -+ spin_lock_bh(&mbx->queue_lock); - - while (!list_empty(head)) { - cmd = list_entry(head->next, struct qlcnic_cmd_args, list); -@@ -3861,7 +3861,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) - qlcnic_83xx_notify_cmd_completion(adapter, cmd); - } - -- spin_unlock(&mbx->queue_lock); -+ spin_unlock_bh(&mbx->queue_lock); - } - - static int qlcnic_83xx_check_mbx_status(struct qlcnic_adapter *adapter) -@@ -3897,12 +3897,12 @@ static void qlcnic_83xx_dequeue_mbx_cmd(struct qlcnic_adapter *adapter, - { - struct qlcnic_mailbox *mbx = adapter->ahw->mailbox; - -- spin_lock(&mbx->queue_lock); -+ spin_lock_bh(&mbx->queue_lock); - - list_del(&cmd->list); - mbx->num_cmds--; - -- spin_unlock(&mbx->queue_lock); -+ spin_unlock_bh(&mbx->queue_lock); - - qlcnic_83xx_notify_cmd_completion(adapter, cmd); - } -@@ -3967,7 +3967,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, - init_completion(&cmd->completion); - cmd->rsp_opcode = QLC_83XX_MBX_RESPONSE_UNKNOWN; - -- spin_lock(&mbx->queue_lock); -+ spin_lock_bh(&mbx->queue_lock); - - list_add_tail(&cmd->list, &mbx->cmd_q); - mbx->num_cmds++; -@@ -3975,7 +3975,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, - *timeout = cmd->total_cmds * QLC_83XX_MBX_TIMEOUT; - queue_work(mbx->work_q, &mbx->work); - -- spin_unlock(&mbx->queue_lock); -+ spin_unlock_bh(&mbx->queue_lock); - - return 0; - } -@@ -4071,15 +4071,15 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) - mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; - spin_unlock_irqrestore(&mbx->aen_lock, flags); - -- spin_lock(&mbx->queue_lock); -+ spin_lock_bh(&mbx->queue_lock); - - if (list_empty(head)) { -- spin_unlock(&mbx->queue_lock); -+ spin_unlock_bh(&mbx->queue_lock); - return; - } - cmd = list_entry(head->next, struct qlcnic_cmd_args, list); - -- spin_unlock(&mbx->queue_lock); -+ spin_unlock_bh(&mbx->queue_lock); - - mbx_ops->encode_cmd(adapter, cmd); - mbx_ops->nofity_fw(adapter, QLC_83XX_MBX_REQUEST); -diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c -index 24155380e43c..3783c40f568b 100644 ---- a/drivers/net/ethernet/realtek/r8169.c -+++ b/drivers/net/ethernet/realtek/r8169.c -@@ -1387,7 +1387,7 @@ DECLARE_RTL_COND(rtl_ocp_tx_cond) - { - void __iomem *ioaddr = tp->mmio_addr; - -- return RTL_R8(IBISR0) & 0x02; -+ return RTL_R8(IBISR0) & 0x20; - } - - static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) -@@ -1395,7 +1395,7 @@ static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) - void __iomem *ioaddr = tp->mmio_addr; - - RTL_W8(IBCR2, RTL_R8(IBCR2) & ~0x01); -- rtl_msleep_loop_wait_low(tp, &rtl_ocp_tx_cond, 50, 2000); -+ rtl_msleep_loop_wait_high(tp, &rtl_ocp_tx_cond, 50, 2000); - RTL_W8(IBISR0, RTL_R8(IBISR0) | 0x20); - RTL_W8(IBCR0, RTL_R8(IBCR0) & ~0x01); - } -diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c -index 1228d0da4075..72cb30828a12 100644 ---- a/drivers/net/usb/cdc_ncm.c -+++ b/drivers/net/usb/cdc_ncm.c -@@ -825,6 +825,9 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - goto error2; - } - -+ /* Device-specific flags */ -+ ctx->drvflags = drvflags; -+ - /* - * Some Huawei devices have been observed to come out of reset in NDP32 mode. - * Let's check if this is the case, and set the device to NDP16 mode again if -@@ -873,9 +876,6 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_ - /* finish setting up the device specific data */ - cdc_ncm_setup(dev); - -- /* Device-specific flags */ -- ctx->drvflags = drvflags; -- - /* Allocate the delayed NDP if needed. */ - if (ctx->drvflags & CDC_NCM_FLAG_NDP_TO_END) { - ctx->delayed_ndp16 = kzalloc(ctx->max_ndp_size, GFP_KERNEL); -diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c -index d6ceb8b91cd6..1c8aedf21370 100644 ---- a/drivers/nvme/host/pci.c -+++ b/drivers/nvme/host/pci.c -@@ -2976,10 +2976,16 @@ static void nvme_dev_shutdown(struct nvme_dev *dev) - mutex_unlock(&dev->shutdown_lock); - } - --static void nvme_dev_remove(struct nvme_dev *dev) -+static void nvme_remove_namespaces(struct nvme_dev *dev) - { - struct nvme_ns *ns, *next; - -+ list_for_each_entry_safe(ns, next, &dev->namespaces, list) -+ nvme_ns_remove(ns); -+} -+ -+static void nvme_dev_remove(struct nvme_dev *dev) -+{ - if (nvme_io_incapable(dev)) { - /* - * If the device is not capable of IO (surprise hot-removal, -@@ -2989,8 +2995,7 @@ static void nvme_dev_remove(struct nvme_dev *dev) - */ - nvme_dev_shutdown(dev); - } -- list_for_each_entry_safe(ns, next, &dev->namespaces, list) -- nvme_ns_remove(ns); -+ nvme_remove_namespaces(dev); - } - - static int nvme_setup_prp_pools(struct nvme_dev *dev) -@@ -3174,7 +3179,7 @@ static void nvme_probe_work(struct work_struct *work) - */ - if (dev->online_queues < 2) { - dev_warn(dev->dev, "IO queues not created\n"); -- nvme_dev_remove(dev); -+ nvme_remove_namespaces(dev); - } else { - nvme_unfreeze_queues(dev); - nvme_dev_add(dev); -diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c -index ad8c9b05572d..01656f1c6d65 100644 ---- a/drivers/usb/gadget/function/uvc_configfs.c -+++ b/drivers/usb/gadget/function/uvc_configfs.c -@@ -2202,7 +2202,7 @@ static struct configfs_item_operations uvc_item_ops = { - .release = uvc_attr_release, - }; - --#define UVCG_OPTS_ATTR(cname, conv, str2u, uxx, vnoc, limit) \ -+#define UVCG_OPTS_ATTR(cname, aname, conv, str2u, uxx, vnoc, limit) \ - static ssize_t f_uvc_opts_##cname##_show( \ - struct config_item *item, char *page) \ - { \ -@@ -2245,16 +2245,16 @@ end: \ - return ret; \ - } \ - \ --UVC_ATTR(f_uvc_opts_, cname, aname) -+UVC_ATTR(f_uvc_opts_, cname, cname) - - #define identity_conv(x) (x) - --UVCG_OPTS_ATTR(streaming_interval, identity_conv, kstrtou8, u8, identity_conv, -- 16); --UVCG_OPTS_ATTR(streaming_maxpacket, le16_to_cpu, kstrtou16, u16, le16_to_cpu, -- 3072); --UVCG_OPTS_ATTR(streaming_maxburst, identity_conv, kstrtou8, u8, identity_conv, -- 15); -+UVCG_OPTS_ATTR(streaming_interval, streaming_interval, identity_conv, -+ kstrtou8, u8, identity_conv, 16); -+UVCG_OPTS_ATTR(streaming_maxpacket, streaming_maxpacket, le16_to_cpu, -+ kstrtou16, u16, le16_to_cpu, 3072); -+UVCG_OPTS_ATTR(streaming_maxburst, streaming_maxburst, identity_conv, -+ kstrtou8, u8, identity_conv, 15); - - #undef identity_conv - -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 00d68945548e..2d96bfd34138 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -285,7 +285,7 @@ static int vhci_hub_control(struct usb_hcd *hcd, u16 typeReq, u16 wValue, - case USB_PORT_FEAT_POWER: - usbip_dbg_vhci_rh( - " ClearPortFeature: USB_PORT_FEAT_POWER\n"); -- dum->port_status[rhport] = 0; -+ dum->port_status[rhport] &= ~USB_PORT_STAT_POWER; - dum->resuming = 0; - break; - case USB_PORT_FEAT_C_RESET: -diff --git a/drivers/usb/usbip/vhci_sysfs.c b/drivers/usb/usbip/vhci_sysfs.c -index 1c7f41a65565..b9432fdec775 100644 ---- a/drivers/usb/usbip/vhci_sysfs.c -+++ b/drivers/usb/usbip/vhci_sysfs.c -@@ -53,7 +53,7 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, - * a security hole, the change is made to use sockfd instead. - */ - out += sprintf(out, -- "prt sta spd bus dev sockfd local_busid\n"); -+ "prt sta spd dev sockfd local_busid\n"); - - for (i = 0; i < VHCI_NPORTS; i++) { - struct vhci_device *vdev = port_to_vdev(i); -@@ -64,12 +64,11 @@ static ssize_t status_show(struct device *dev, struct device_attribute *attr, - if (vdev->ud.status == VDEV_ST_USED) { - out += sprintf(out, "%03u %08x ", - vdev->speed, vdev->devid); -- out += sprintf(out, "%16p ", vdev->ud.tcp_socket); -- out += sprintf(out, "%06u", vdev->ud.sockfd); -+ out += sprintf(out, "%06u ", vdev->ud.sockfd); - out += sprintf(out, "%s", dev_name(&vdev->udev->dev)); - - } else -- out += sprintf(out, "000 000 000 000000 0-0"); -+ out += sprintf(out, "000 00000000 000000 0-0"); - - out += sprintf(out, "\n"); - spin_unlock(&vdev->ud.lock); -diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c -index 9eda69e40678..44a5a8777053 100644 ---- a/drivers/vhost/net.c -+++ b/drivers/vhost/net.c -@@ -981,6 +981,7 @@ static long vhost_net_reset_owner(struct vhost_net *n) - } - vhost_net_stop(n, &tx_sock, &rx_sock); - vhost_net_flush(n); -+ vhost_dev_stop(&n->dev); - vhost_dev_reset_owner(&n->dev, memory); - vhost_net_vq_reset(n); - done: -diff --git a/drivers/watchdog/imx2_wdt.c b/drivers/watchdog/imx2_wdt.c -index 29ef719a6a3c..d69ab1e28d7d 100644 ---- a/drivers/watchdog/imx2_wdt.c -+++ b/drivers/watchdog/imx2_wdt.c -@@ -161,15 +161,21 @@ static void imx2_wdt_timer_ping(unsigned long arg) - mod_timer(&wdev->timer, jiffies + wdog->timeout * HZ / 2); - } - --static int imx2_wdt_set_timeout(struct watchdog_device *wdog, -- unsigned int new_timeout) -+static void __imx2_wdt_set_timeout(struct watchdog_device *wdog, -+ unsigned int new_timeout) - { - struct imx2_wdt_device *wdev = watchdog_get_drvdata(wdog); - -- wdog->timeout = new_timeout; -- - regmap_update_bits(wdev->regmap, IMX2_WDT_WCR, IMX2_WDT_WCR_WT, - WDOG_SEC_TO_COUNT(new_timeout)); -+} -+ -+static int imx2_wdt_set_timeout(struct watchdog_device *wdog, -+ unsigned int new_timeout) -+{ -+ __imx2_wdt_set_timeout(wdog, new_timeout); -+ -+ wdog->timeout = new_timeout; - return 0; - } - -@@ -353,7 +359,11 @@ static int imx2_wdt_suspend(struct device *dev) - - /* The watchdog IP block is running */ - if (imx2_wdt_is_running(wdev)) { -- imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME); -+ /* -+ * Don't update wdog->timeout, we'll restore the current value -+ * during resume. -+ */ -+ __imx2_wdt_set_timeout(wdog, IMX2_WDT_MAX_TIME); - imx2_wdt_ping(wdog); - - /* The watchdog is not active */ -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index af1da85da509..86d209fc4992 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -2015,7 +2015,15 @@ again: - goto out; - } - -- btrfs_set_extent_delalloc(inode, page_start, page_end, &cached_state); -+ ret = btrfs_set_extent_delalloc(inode, page_start, page_end, -+ &cached_state); -+ if (ret) { -+ mapping_set_error(page->mapping, ret); -+ end_extent_writepage(page, ret, page_start, page_end); -+ ClearPageChecked(page); -+ goto out; -+ } -+ - ClearPageChecked(page); - set_page_dirty(page); - out: -diff --git a/fs/cifs/cifsencrypt.c b/fs/cifs/cifsencrypt.c -index 4acbc390a7d6..1d707a67f8ac 100644 ---- a/fs/cifs/cifsencrypt.c -+++ b/fs/cifs/cifsencrypt.c -@@ -306,9 +306,8 @@ int calc_lanman_hash(const char *password, const char *cryptkey, bool encrypt, - { - int i; - int rc; -- char password_with_pad[CIFS_ENCPWD_SIZE]; -+ char password_with_pad[CIFS_ENCPWD_SIZE] = {0}; - -- memset(password_with_pad, 0, CIFS_ENCPWD_SIZE); - if (password) - strncpy(password_with_pad, password, CIFS_ENCPWD_SIZE); - -diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c -index 0a2bf9462637..077ad3a06c9a 100644 ---- a/fs/cifs/connect.c -+++ b/fs/cifs/connect.c -@@ -1695,7 +1695,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, - tmp_end++; - if (!(tmp_end < end && tmp_end[1] == delim)) { - /* No it is not. Set the password to NULL */ -- kfree(vol->password); -+ kzfree(vol->password); - vol->password = NULL; - break; - } -@@ -1733,7 +1733,7 @@ cifs_parse_mount_options(const char *mountdata, const char *devname, - options = end; - } - -- kfree(vol->password); -+ kzfree(vol->password); - /* Now build new password string */ - temp_len = strlen(value); - vol->password = kzalloc(temp_len+1, GFP_KERNEL); -@@ -4148,7 +4148,7 @@ cifs_construct_tcon(struct cifs_sb_info *cifs_sb, kuid_t fsuid) - reset_cifs_unix_caps(0, tcon, NULL, vol_info); - out: - kfree(vol_info->username); -- kfree(vol_info->password); -+ kzfree(vol_info->password); - kfree(vol_info); - - return tcon; -diff --git a/fs/cifs/file.c b/fs/cifs/file.c -index ec2d07bb9beb..744be3c146f5 100644 ---- a/fs/cifs/file.c -+++ b/fs/cifs/file.c -@@ -3241,20 +3241,18 @@ static const struct vm_operations_struct cifs_file_vm_ops = { - - int cifs_file_strict_mmap(struct file *file, struct vm_area_struct *vma) - { -- int rc, xid; -+ int xid, rc = 0; - struct inode *inode = file_inode(file); - - xid = get_xid(); - -- if (!CIFS_CACHE_READ(CIFS_I(inode))) { -+ if (!CIFS_CACHE_READ(CIFS_I(inode))) - rc = cifs_zap_mapping(inode); -- if (rc) -- return rc; -- } -- -- rc = generic_file_mmap(file, vma); -- if (rc == 0) -+ if (!rc) -+ rc = generic_file_mmap(file, vma); -+ if (!rc) - vma->vm_ops = &cifs_file_vm_ops; -+ - free_xid(xid); - return rc; - } -@@ -3264,16 +3262,16 @@ int cifs_file_mmap(struct file *file, struct vm_area_struct *vma) - int rc, xid; - - xid = get_xid(); -+ - rc = cifs_revalidate_file(file); -- if (rc) { -+ if (rc) - cifs_dbg(FYI, "Validation prior to mmap failed, error=%d\n", - rc); -- free_xid(xid); -- return rc; -- } -- rc = generic_file_mmap(file, vma); -- if (rc == 0) -+ if (!rc) -+ rc = generic_file_mmap(file, vma); -+ if (!rc) - vma->vm_ops = &cifs_file_vm_ops; -+ - free_xid(xid); - return rc; - } -diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c -index 2396ab099849..0cc699d9b932 100644 ---- a/fs/cifs/misc.c -+++ b/fs/cifs/misc.c -@@ -99,14 +99,11 @@ sesInfoFree(struct cifs_ses *buf_to_free) - kfree(buf_to_free->serverOS); - kfree(buf_to_free->serverDomain); - kfree(buf_to_free->serverNOS); -- if (buf_to_free->password) { -- memset(buf_to_free->password, 0, strlen(buf_to_free->password)); -- kfree(buf_to_free->password); -- } -+ kzfree(buf_to_free->password); - kfree(buf_to_free->user_name); - kfree(buf_to_free->domainName); -- kfree(buf_to_free->auth_key.response); -- kfree(buf_to_free); -+ kzfree(buf_to_free->auth_key.response); -+ kzfree(buf_to_free); - } - - struct cifs_tcon * -@@ -137,10 +134,7 @@ tconInfoFree(struct cifs_tcon *buf_to_free) - } - atomic_dec(&tconInfoAllocCount); - kfree(buf_to_free->nativeFileSystem); -- if (buf_to_free->password) { -- memset(buf_to_free->password, 0, strlen(buf_to_free->password)); -- kfree(buf_to_free->password); -- } -+ kzfree(buf_to_free->password); - kfree(buf_to_free); - } - -diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c -index f2ff60e58ec8..84614a5edb87 100644 ---- a/fs/cifs/smb2pdu.c -+++ b/fs/cifs/smb2pdu.c -@@ -580,8 +580,7 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon) - } - - /* check validate negotiate info response matches what we got earlier */ -- if (pneg_rsp->Dialect != -- cpu_to_le16(tcon->ses->server->vals->protocol_id)) -+ if (pneg_rsp->Dialect != cpu_to_le16(tcon->ses->server->dialect)) - goto vneg_out; - - if (pneg_rsp->SecurityMode != cpu_to_le16(tcon->ses->server->sec_mode)) -diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c -index 4df1cb19a243..f0cabc8c96cb 100644 ---- a/fs/ext4/inode.c -+++ b/fs/ext4/inode.c -@@ -4417,6 +4417,7 @@ struct inode *ext4_iget(struct super_block *sb, unsigned long ino) - inode->i_op = &ext4_symlink_inode_operations; - ext4_set_aops(inode); - } -+ inode_nohighmem(inode); - } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || - S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { - inode->i_op = &ext4_special_inode_operations; -diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c -index 4c36dca486cc..32960b3ecd4f 100644 ---- a/fs/ext4/namei.c -+++ b/fs/ext4/namei.c -@@ -3151,6 +3151,7 @@ static int ext4_symlink(struct inode *dir, - if ((disk_link.len > EXT4_N_BLOCKS * 4)) { - if (!encryption_required) - inode->i_op = &ext4_symlink_inode_operations; -+ inode_nohighmem(inode); - ext4_set_aops(inode); - /* - * We cannot call page_symlink() with transaction started -diff --git a/fs/ext4/symlink.c b/fs/ext4/symlink.c -index e8e7af62ac95..287c3980fa0b 100644 ---- a/fs/ext4/symlink.c -+++ b/fs/ext4/symlink.c -@@ -45,7 +45,7 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook - cpage = read_mapping_page(inode->i_mapping, 0, NULL); - if (IS_ERR(cpage)) - return ERR_CAST(cpage); -- caddr = kmap(cpage); -+ caddr = page_address(cpage); - caddr[size] = 0; - } - -@@ -75,16 +75,12 @@ static const char *ext4_encrypted_follow_link(struct dentry *dentry, void **cook - /* Null-terminate the name */ - if (res <= plen) - paddr[res] = '\0'; -- if (cpage) { -- kunmap(cpage); -+ if (cpage) - page_cache_release(cpage); -- } - return *cookie = paddr; - errout: -- if (cpage) { -- kunmap(cpage); -+ if (cpage) - page_cache_release(cpage); -- } - kfree(paddr); - return ERR_PTR(res); - } -diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c -index 97e20decacb4..5528801a5baf 100644 ---- a/fs/f2fs/inode.c -+++ b/fs/f2fs/inode.c -@@ -202,6 +202,7 @@ make_now: - inode->i_op = &f2fs_encrypted_symlink_inode_operations; - else - inode->i_op = &f2fs_symlink_inode_operations; -+ inode_nohighmem(inode); - inode->i_mapping->a_ops = &f2fs_dblock_aops; - } else if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode) || - S_ISFIFO(inode->i_mode) || S_ISSOCK(inode->i_mode)) { -diff --git a/fs/f2fs/namei.c b/fs/f2fs/namei.c -index 2c32110f9fc0..484df6850747 100644 ---- a/fs/f2fs/namei.c -+++ b/fs/f2fs/namei.c -@@ -351,6 +351,7 @@ static int f2fs_symlink(struct inode *dir, struct dentry *dentry, - inode->i_op = &f2fs_encrypted_symlink_inode_operations; - else - inode->i_op = &f2fs_symlink_inode_operations; -+ inode_nohighmem(inode); - inode->i_mapping->a_ops = &f2fs_dblock_aops; - - f2fs_lock_op(sbi); -@@ -942,7 +943,7 @@ static const char *f2fs_encrypted_follow_link(struct dentry *dentry, void **cook - cpage = read_mapping_page(inode->i_mapping, 0, NULL); - if (IS_ERR(cpage)) - return ERR_CAST(cpage); -- caddr = kmap(cpage); -+ caddr = page_address(cpage); - caddr[size] = 0; - - /* Symlink is encrypted */ -@@ -982,13 +983,11 @@ static const char *f2fs_encrypted_follow_link(struct dentry *dentry, void **cook - /* Null-terminate the name */ - paddr[res] = '\0'; - -- kunmap(cpage); - page_cache_release(cpage); - return *cookie = paddr; - errout: - kfree(cstr.name); - f2fs_fname_crypto_free_buffer(&pstr); -- kunmap(cpage); - page_cache_release(cpage); - return ERR_PTR(res); - } -diff --git a/fs/inode.c b/fs/inode.c -index b0edef500590..b95615f3fc50 100644 ---- a/fs/inode.c -+++ b/fs/inode.c -@@ -2028,3 +2028,9 @@ void inode_set_flags(struct inode *inode, unsigned int flags, - new_flags) != old_flags)); - } - EXPORT_SYMBOL(inode_set_flags); -+ -+void inode_nohighmem(struct inode *inode) -+{ -+ mapping_set_gfp_mask(inode->i_mapping, GFP_USER); -+} -+EXPORT_SYMBOL(inode_nohighmem); -diff --git a/fs/kernfs/file.c b/fs/kernfs/file.c -index 6e9a912d394c..6875bd5d35f6 100644 ---- a/fs/kernfs/file.c -+++ b/fs/kernfs/file.c -@@ -272,7 +272,7 @@ static ssize_t kernfs_fop_write(struct file *file, const char __user *user_buf, - { - struct kernfs_open_file *of = kernfs_of(file); - const struct kernfs_ops *ops; -- size_t len; -+ ssize_t len; - char *buf; - - if (of->atomic_write_len) { -diff --git a/fs/nfs/direct.c b/fs/nfs/direct.c -index 4b1d08f56aba..5fd3cf54b2b3 100644 ---- a/fs/nfs/direct.c -+++ b/fs/nfs/direct.c -@@ -787,10 +787,8 @@ static void nfs_direct_write_completion(struct nfs_pgio_header *hdr) - - spin_lock(&dreq->lock); - -- if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) { -- dreq->flags = 0; -+ if (test_bit(NFS_IOHDR_ERROR, &hdr->flags)) - dreq->error = hdr->error; -- } - if (dreq->error == 0) { - nfs_direct_good_bytes(dreq, hdr); - if (nfs_write_need_commit(hdr)) { -diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c -index 5ba22c6b0ffa..1ee62e62ea76 100644 ---- a/fs/nfs/nfs4idmap.c -+++ b/fs/nfs/nfs4idmap.c -@@ -567,9 +567,13 @@ static int nfs_idmap_legacy_upcall(struct key_construction *cons, - struct idmap_msg *im; - struct idmap *idmap = (struct idmap *)aux; - struct key *key = cons->key; -- int ret = -ENOMEM; -+ int ret = -ENOKEY; -+ -+ if (!aux) -+ goto out1; - - /* msg and im are freed in idmap_pipe_destroy_msg */ -+ ret = -ENOMEM; - data = kzalloc(sizeof(*data), GFP_KERNEL); - if (!data) - goto out1; -diff --git a/fs/nfs/pnfs.c b/fs/nfs/pnfs.c -index 7af7bedd7c02..c8e75e5e6a67 100644 ---- a/fs/nfs/pnfs.c -+++ b/fs/nfs/pnfs.c -@@ -1943,7 +1943,7 @@ pnfs_write_through_mds(struct nfs_pageio_descriptor *desc, - nfs_pageio_reset_write_mds(desc); - mirror->pg_recoalesce = 1; - } -- hdr->release(hdr); -+ hdr->completion_ops->completion(hdr); - } - - static enum pnfs_try_status -@@ -2058,7 +2058,7 @@ pnfs_read_through_mds(struct nfs_pageio_descriptor *desc, - nfs_pageio_reset_read_mds(desc); - mirror->pg_recoalesce = 1; - } -- hdr->release(hdr); -+ hdr->completion_ops->completion(hdr); - } - - /* -diff --git a/fs/nfs/write.c b/fs/nfs/write.c -index 7a9b6e347249..6e81a5b5858e 100644 ---- a/fs/nfs/write.c -+++ b/fs/nfs/write.c -@@ -1746,6 +1746,8 @@ static void nfs_commit_release_pages(struct nfs_commit_data *data) - set_bit(NFS_CONTEXT_RESEND_WRITES, &req->wb_context->flags); - next: - nfs_unlock_and_release_request(req); -+ /* Latency breaker */ -+ cond_resched(); - } - nfss = NFS_SERVER(data->inode); - if (atomic_long_read(&nfss->writeback) < NFS_CONGESTION_OFF_THRESH) -diff --git a/fs/nsfs.c b/fs/nsfs.c -index 8f20d6016e20..914ca6b2794d 100644 ---- a/fs/nsfs.c -+++ b/fs/nsfs.c -@@ -95,6 +95,7 @@ slow: - return ERR_PTR(-ENOMEM); - } - d_instantiate(dentry, inode); -+ dentry->d_flags |= DCACHE_RCUACCESS; - dentry->d_fsdata = (void *)ns_ops; - d = atomic_long_cmpxchg(&ns->stashed, 0, (unsigned long)dentry); - if (d) { -diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c -index adcb1398c481..299a6e1d6b77 100644 ---- a/fs/overlayfs/readdir.c -+++ b/fs/overlayfs/readdir.c -@@ -441,10 +441,14 @@ static int ovl_dir_fsync(struct file *file, loff_t start, loff_t end, - struct dentry *dentry = file->f_path.dentry; - struct file *realfile = od->realfile; - -+ /* Nothing to sync for lower */ -+ if (!OVL_TYPE_UPPER(ovl_path_type(dentry))) -+ return 0; -+ - /* - * Need to check if we started out being a lower dir, but got copied up - */ -- if (!od->is_upper && OVL_TYPE_UPPER(ovl_path_type(dentry))) { -+ if (!od->is_upper) { - struct inode *inode = file_inode(file); - - realfile = lockless_dereference(od->upperfile); -diff --git a/include/crypto/internal/hash.h b/include/crypto/internal/hash.h -index 9779c35f8454..dab9569f22bf 100644 ---- a/include/crypto/internal/hash.h -+++ b/include/crypto/internal/hash.h -@@ -91,6 +91,8 @@ static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg) - return alg->setkey != shash_no_setkey; - } - -+bool crypto_hash_alg_has_setkey(struct hash_alg_common *halg); -+ - int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn, - struct hash_alg_common *alg, - struct crypto_instance *inst); -diff --git a/include/crypto/poly1305.h b/include/crypto/poly1305.h -index 894df59b74e4..d586f741cab5 100644 ---- a/include/crypto/poly1305.h -+++ b/include/crypto/poly1305.h -@@ -30,8 +30,6 @@ struct poly1305_desc_ctx { - }; - - int crypto_poly1305_init(struct shash_desc *desc); --int crypto_poly1305_setkey(struct crypto_shash *tfm, -- const u8 *key, unsigned int keylen); - unsigned int crypto_poly1305_setdesckey(struct poly1305_desc_ctx *dctx, - const u8 *src, unsigned int srclen); - int crypto_poly1305_update(struct shash_desc *desc, -diff --git a/include/linux/fs.h b/include/linux/fs.h -index c8decb7075d6..f746a59fcc88 100644 ---- a/include/linux/fs.h -+++ b/include/linux/fs.h -@@ -3066,5 +3066,6 @@ static inline bool dir_relax(struct inode *inode) - } - - extern bool path_noexec(const struct path *path); -+extern void inode_nohighmem(struct inode *inode); - - #endif /* _LINUX_FS_H */ -diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h -index 806d0ab845e0..676d3d2a1a0a 100644 ---- a/include/linux/mtd/map.h -+++ b/include/linux/mtd/map.h -@@ -265,75 +265,67 @@ void map_destroy(struct mtd_info *mtd); - #define INVALIDATE_CACHED_RANGE(map, from, size) \ - do { if (map->inval_cache) map->inval_cache(map, from, size); } while (0) - -- --static inline int map_word_equal(struct map_info *map, map_word val1, map_word val2) --{ -- int i; -- -- for (i = 0; i < map_words(map); i++) { -- if (val1.x[i] != val2.x[i]) -- return 0; -- } -- -- return 1; --} -- --static inline map_word map_word_and(struct map_info *map, map_word val1, map_word val2) --{ -- map_word r; -- int i; -- -- for (i = 0; i < map_words(map); i++) -- r.x[i] = val1.x[i] & val2.x[i]; -- -- return r; --} -- --static inline map_word map_word_clr(struct map_info *map, map_word val1, map_word val2) --{ -- map_word r; -- int i; -- -- for (i = 0; i < map_words(map); i++) -- r.x[i] = val1.x[i] & ~val2.x[i]; -- -- return r; --} -- --static inline map_word map_word_or(struct map_info *map, map_word val1, map_word val2) --{ -- map_word r; -- int i; -- -- for (i = 0; i < map_words(map); i++) -- r.x[i] = val1.x[i] | val2.x[i]; -- -- return r; --} -- --static inline int map_word_andequal(struct map_info *map, map_word val1, map_word val2, map_word val3) --{ -- int i; -- -- for (i = 0; i < map_words(map); i++) { -- if ((val1.x[i] & val2.x[i]) != val3.x[i]) -- return 0; -- } -- -- return 1; --} -- --static inline int map_word_bitsset(struct map_info *map, map_word val1, map_word val2) --{ -- int i; -- -- for (i = 0; i < map_words(map); i++) { -- if (val1.x[i] & val2.x[i]) -- return 1; -- } -- -- return 0; --} -+#define map_word_equal(map, val1, val2) \ -+({ \ -+ int i, ret = 1; \ -+ for (i = 0; i < map_words(map); i++) \ -+ if ((val1).x[i] != (val2).x[i]) { \ -+ ret = 0; \ -+ break; \ -+ } \ -+ ret; \ -+}) -+ -+#define map_word_and(map, val1, val2) \ -+({ \ -+ map_word r; \ -+ int i; \ -+ for (i = 0; i < map_words(map); i++) \ -+ r.x[i] = (val1).x[i] & (val2).x[i]; \ -+ r; \ -+}) -+ -+#define map_word_clr(map, val1, val2) \ -+({ \ -+ map_word r; \ -+ int i; \ -+ for (i = 0; i < map_words(map); i++) \ -+ r.x[i] = (val1).x[i] & ~(val2).x[i]; \ -+ r; \ -+}) -+ -+#define map_word_or(map, val1, val2) \ -+({ \ -+ map_word r; \ -+ int i; \ -+ for (i = 0; i < map_words(map); i++) \ -+ r.x[i] = (val1).x[i] | (val2).x[i]; \ -+ r; \ -+}) -+ -+#define map_word_andequal(map, val1, val2, val3) \ -+({ \ -+ int i, ret = 1; \ -+ for (i = 0; i < map_words(map); i++) { \ -+ if (((val1).x[i] & (val2).x[i]) != (val2).x[i]) { \ -+ ret = 0; \ -+ break; \ -+ } \ -+ } \ -+ ret; \ -+}) -+ -+#define map_word_bitsset(map, val1, val2) \ -+({ \ -+ int i, ret = 0; \ -+ for (i = 0; i < map_words(map); i++) { \ -+ if ((val1).x[i] & (val2).x[i]) { \ -+ ret = 1; \ -+ break; \ -+ } \ -+ } \ -+ ret; \ -+}) - - static inline map_word map_word_load(struct map_info *map, const void *ptr) - { -diff --git a/include/net/netfilter/nf_queue.h b/include/net/netfilter/nf_queue.h -index 9c5638ad872e..0dbce55437f2 100644 ---- a/include/net/netfilter/nf_queue.h -+++ b/include/net/netfilter/nf_queue.h -@@ -28,8 +28,8 @@ struct nf_queue_handler { - struct nf_hook_ops *ops); - }; - --void nf_register_queue_handler(const struct nf_queue_handler *qh); --void nf_unregister_queue_handler(void); -+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh); -+void nf_unregister_queue_handler(struct net *net); - void nf_reinject(struct nf_queue_entry *entry, unsigned int verdict); - - void nf_queue_entry_get_refs(struct nf_queue_entry *entry); -diff --git a/include/net/netns/netfilter.h b/include/net/netns/netfilter.h -index 38aa4983e2a9..36d723579af2 100644 ---- a/include/net/netns/netfilter.h -+++ b/include/net/netns/netfilter.h -@@ -5,11 +5,13 @@ - - struct proc_dir_entry; - struct nf_logger; -+struct nf_queue_handler; - - struct netns_nf { - #if defined CONFIG_PROC_FS - struct proc_dir_entry *proc_netfilter; - #endif -+ const struct nf_queue_handler __rcu *queue_handler; - const struct nf_logger __rcu *nf_loggers[NFPROTO_NUMPROTO]; - #ifdef CONFIG_SYSCTL - struct ctl_table_header *nf_log_dir_header; -diff --git a/kernel/async.c b/kernel/async.c -index 4c3773c0bf63..f1fd155abff6 100644 ---- a/kernel/async.c -+++ b/kernel/async.c -@@ -84,20 +84,24 @@ static atomic_t entry_count; - - static async_cookie_t lowest_in_progress(struct async_domain *domain) - { -- struct list_head *pending; -+ struct async_entry *first = NULL; - async_cookie_t ret = ASYNC_COOKIE_MAX; - unsigned long flags; - - spin_lock_irqsave(&async_lock, flags); - -- if (domain) -- pending = &domain->pending; -- else -- pending = &async_global_pending; -+ if (domain) { -+ if (!list_empty(&domain->pending)) -+ first = list_first_entry(&domain->pending, -+ struct async_entry, domain_list); -+ } else { -+ if (!list_empty(&async_global_pending)) -+ first = list_first_entry(&async_global_pending, -+ struct async_entry, global_list); -+ } - -- if (!list_empty(pending)) -- ret = list_first_entry(pending, struct async_entry, -- domain_list)->cookie; -+ if (first) -+ ret = first->cookie; - - spin_unlock_irqrestore(&async_lock, flags); - return ret; -diff --git a/kernel/sched/core.c b/kernel/sched/core.c -index e6d1173a2046..c5b1c62623cf 100644 ---- a/kernel/sched/core.c -+++ b/kernel/sched/core.c -@@ -5896,6 +5896,19 @@ static void rq_attach_root(struct rq *rq, struct root_domain *rd) - call_rcu_sched(&old_rd->rcu, free_rootdomain); - } - -+void sched_get_rd(struct root_domain *rd) -+{ -+ atomic_inc(&rd->refcount); -+} -+ -+void sched_put_rd(struct root_domain *rd) -+{ -+ if (!atomic_dec_and_test(&rd->refcount)) -+ return; -+ -+ call_rcu_sched(&rd->rcu, free_rootdomain); -+} -+ - static int init_rootdomain(struct root_domain *rd) - { - memset(rd, 0, sizeof(*rd)); -diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c -index 95fefb364dab..e0b5169aeac4 100644 ---- a/kernel/sched/rt.c -+++ b/kernel/sched/rt.c -@@ -1833,9 +1833,8 @@ static void push_rt_tasks(struct rq *rq) - * the rt_loop_next will cause the iterator to perform another scan. - * - */ --static int rto_next_cpu(struct rq *rq) -+static int rto_next_cpu(struct root_domain *rd) - { -- struct root_domain *rd = rq->rd; - int next; - int cpu; - -@@ -1911,19 +1910,24 @@ static void tell_cpu_to_push(struct rq *rq) - * Otherwise it is finishing up and an ipi needs to be sent. - */ - if (rq->rd->rto_cpu < 0) -- cpu = rto_next_cpu(rq); -+ cpu = rto_next_cpu(rq->rd); - - raw_spin_unlock(&rq->rd->rto_lock); - - rto_start_unlock(&rq->rd->rto_loop_start); - -- if (cpu >= 0) -+ if (cpu >= 0) { -+ /* Make sure the rd does not get freed while pushing */ -+ sched_get_rd(rq->rd); - irq_work_queue_on(&rq->rd->rto_push_work, cpu); -+ } - } - - /* Called from hardirq context */ - void rto_push_irq_work_func(struct irq_work *work) - { -+ struct root_domain *rd = -+ container_of(work, struct root_domain, rto_push_work); - struct rq *rq; - int cpu; - -@@ -1939,18 +1943,20 @@ void rto_push_irq_work_func(struct irq_work *work) - raw_spin_unlock(&rq->lock); - } - -- raw_spin_lock(&rq->rd->rto_lock); -+ raw_spin_lock(&rd->rto_lock); - - /* Pass the IPI to the next rt overloaded queue */ -- cpu = rto_next_cpu(rq); -+ cpu = rto_next_cpu(rd); - -- raw_spin_unlock(&rq->rd->rto_lock); -+ raw_spin_unlock(&rd->rto_lock); - -- if (cpu < 0) -+ if (cpu < 0) { -+ sched_put_rd(rd); - return; -+ } - - /* Try the next RT overloaded CPU */ -- irq_work_queue_on(&rq->rd->rto_push_work, cpu); -+ irq_work_queue_on(&rd->rto_push_work, cpu); - } - #endif /* HAVE_RT_PUSH_IPI */ - -diff --git a/kernel/sched/sched.h b/kernel/sched/sched.h -index 448a8266ceea..0c9ebd82a684 100644 ---- a/kernel/sched/sched.h -+++ b/kernel/sched/sched.h -@@ -553,6 +553,8 @@ struct root_domain { - }; - - extern struct root_domain def_root_domain; -+extern void sched_get_rd(struct root_domain *rd); -+extern void sched_put_rd(struct root_domain *rd); - - #ifdef HAVE_RT_PUSH_IPI - extern void rto_push_irq_work_func(struct irq_work *work); -diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c -index f2826c35e918..fc7c37ad90a0 100644 ---- a/kernel/time/posix-timers.c -+++ b/kernel/time/posix-timers.c -@@ -507,17 +507,22 @@ static struct pid *good_sigevent(sigevent_t * event) - { - struct task_struct *rtn = current->group_leader; - -- if ((event->sigev_notify & SIGEV_THREAD_ID ) && -- (!(rtn = find_task_by_vpid(event->sigev_notify_thread_id)) || -- !same_thread_group(rtn, current) || -- (event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_SIGNAL)) -+ switch (event->sigev_notify) { -+ case SIGEV_SIGNAL | SIGEV_THREAD_ID: -+ rtn = find_task_by_vpid(event->sigev_notify_thread_id); -+ if (!rtn || !same_thread_group(rtn, current)) -+ return NULL; -+ /* FALLTHRU */ -+ case SIGEV_SIGNAL: -+ case SIGEV_THREAD: -+ if (event->sigev_signo <= 0 || event->sigev_signo > SIGRTMAX) -+ return NULL; -+ /* FALLTHRU */ -+ case SIGEV_NONE: -+ return task_pid(rtn); -+ default: - return NULL; -- -- if (((event->sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) && -- ((event->sigev_signo <= 0) || (event->sigev_signo > SIGRTMAX))) -- return NULL; -- -- return task_pid(rtn); -+ } - } - - void posix_timers_register_clock(const clockid_t clock_id, -@@ -745,8 +750,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) - /* interval timer ? */ - if (iv.tv64) - cur_setting->it_interval = ktime_to_timespec(iv); -- else if (!hrtimer_active(timer) && -- (timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) -+ else if (!hrtimer_active(timer) && timr->it_sigev_notify != SIGEV_NONE) - return; - - now = timer->base->get_time(); -@@ -757,7 +761,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) - * expiry is > now. - */ - if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING || -- (timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) -+ timr->it_sigev_notify == SIGEV_NONE)) - timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, iv); - - remaining = __hrtimer_expires_remaining_adjusted(timer, now); -@@ -767,7 +771,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec *cur_setting) - * A single shot SIGEV_NONE timer must return 0, when - * it is expired ! - */ -- if ((timr->it_sigev_notify & ~SIGEV_THREAD_ID) != SIGEV_NONE) -+ if (timr->it_sigev_notify != SIGEV_NONE) - cur_setting->it_value.tv_nsec = 1; - } else - cur_setting->it_value = ktime_to_timespec(remaining); -@@ -865,7 +869,7 @@ common_timer_set(struct k_itimer *timr, int flags, - timr->it.real.interval = timespec_to_ktime(new_setting->it_interval); - - /* SIGEV_NONE timers are not queued ! See common_timer_get */ -- if (((timr->it_sigev_notify & ~SIGEV_THREAD_ID) == SIGEV_NONE)) { -+ if (timr->it_sigev_notify == SIGEV_NONE) { - /* Setup correct expiry time for relative timers */ - if (mode == HRTIMER_MODE_REL) { - hrtimer_add_expires(timer, timer->base->get_time()); -diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c -index fc0051fd672d..ac758a53fcea 100644 ---- a/kernel/trace/ftrace.c -+++ b/kernel/trace/ftrace.c -@@ -3845,7 +3845,6 @@ __unregister_ftrace_function_probe(char *glob, struct ftrace_probe_ops *ops, - func_g.type = filter_parse_regex(glob, strlen(glob), - &func_g.search, ¬); - func_g.len = strlen(func_g.search); -- func_g.search = glob; - - /* we do not support '!' for function probes */ - if (WARN_ON(not)) -diff --git a/net/dccp/proto.c b/net/dccp/proto.c -index b68168fcc06a..9d43c1f40274 100644 ---- a/net/dccp/proto.c -+++ b/net/dccp/proto.c -@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags) - { - struct inet_connection_sock *icsk = inet_csk(sk); - struct inet_sock *inet = inet_sk(sk); -+ struct dccp_sock *dp = dccp_sk(sk); - int err = 0; - const int old_state = sk->sk_state; - -@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags) - sk->sk_err = ECONNRESET; - - dccp_clear_xmit_timers(sk); -+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); -+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); -+ dp->dccps_hc_rx_ccid = NULL; -+ dp->dccps_hc_tx_ccid = NULL; - - __skb_queue_purge(&sk->sk_receive_queue); - __skb_queue_purge(&sk->sk_write_queue); -diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c -index 8212ed80da48..c67efa3e79dd 100644 ---- a/net/ipv4/igmp.c -+++ b/net/ipv4/igmp.c -@@ -392,7 +392,11 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) - pip->frag_off = htons(IP_DF); - pip->ttl = 1; - pip->daddr = fl4.daddr; -+ -+ rcu_read_lock(); - pip->saddr = igmpv3_get_srcaddr(dev, &fl4); -+ rcu_read_unlock(); -+ - pip->protocol = IPPROTO_IGMP; - pip->tot_len = 0; /* filled in later */ - ip_select_ident(net, skb, NULL); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 37e8966a457b..23d77ff1da59 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -2276,6 +2276,12 @@ int tcp_disconnect(struct sock *sk, int flags) - - WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); - -+ if (sk->sk_frag.page) { -+ put_page(sk->sk_frag.page); -+ sk->sk_frag.page = NULL; -+ sk->sk_frag.offset = 0; -+ } -+ - sk->sk_error_report(sk); - return err; - } -diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c -index 8361d73ab653..e5846d1f9b55 100644 ---- a/net/ipv6/ip6mr.c -+++ b/net/ipv6/ip6mr.c -@@ -495,6 +495,7 @@ static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos) - return ERR_PTR(-ENOENT); - - it->mrt = mrt; -+ it->cache = NULL; - return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1) - : SEQ_START_TOKEN; - } -diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c -index 5baa8e24e6ac..b19ad20a705c 100644 ---- a/net/netfilter/nf_queue.c -+++ b/net/netfilter/nf_queue.c -@@ -26,23 +26,21 @@ - * Once the queue is registered it must reinject all packets it - * receives, no matter what. - */ --static const struct nf_queue_handler __rcu *queue_handler __read_mostly; - - /* return EBUSY when somebody else is registered, return EEXIST if the - * same handler is registered, return 0 in case of success. */ --void nf_register_queue_handler(const struct nf_queue_handler *qh) -+void nf_register_queue_handler(struct net *net, const struct nf_queue_handler *qh) - { - /* should never happen, we only have one queueing backend in kernel */ -- WARN_ON(rcu_access_pointer(queue_handler)); -- rcu_assign_pointer(queue_handler, qh); -+ WARN_ON(rcu_access_pointer(net->nf.queue_handler)); -+ rcu_assign_pointer(net->nf.queue_handler, qh); - } - EXPORT_SYMBOL(nf_register_queue_handler); - - /* The caller must flush their queue before this */ --void nf_unregister_queue_handler(void) -+void nf_unregister_queue_handler(struct net *net) - { -- RCU_INIT_POINTER(queue_handler, NULL); -- synchronize_rcu(); -+ RCU_INIT_POINTER(net->nf.queue_handler, NULL); - } - EXPORT_SYMBOL(nf_unregister_queue_handler); - -@@ -103,7 +101,7 @@ void nf_queue_nf_hook_drop(struct net *net, struct nf_hook_ops *ops) - const struct nf_queue_handler *qh; - - rcu_read_lock(); -- qh = rcu_dereference(queue_handler); -+ qh = rcu_dereference(net->nf.queue_handler); - if (qh) - qh->nf_hook_drop(net, ops); - rcu_read_unlock(); -@@ -122,9 +120,10 @@ int nf_queue(struct sk_buff *skb, - struct nf_queue_entry *entry = NULL; - const struct nf_afinfo *afinfo; - const struct nf_queue_handler *qh; -+ struct net *net = state->net; - - /* QUEUE == DROP if no one is waiting, to be safe. */ -- qh = rcu_dereference(queue_handler); -+ qh = rcu_dereference(net->nf.queue_handler); - if (!qh) { - status = -ESRCH; - goto err; -diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c -index c14d2e8eaec3..f853b55bf877 100644 ---- a/net/netfilter/nfnetlink_queue.c -+++ b/net/netfilter/nfnetlink_queue.c -@@ -1382,21 +1382,29 @@ static int __net_init nfnl_queue_net_init(struct net *net) - net->nf.proc_netfilter, &nfqnl_file_ops)) - return -ENOMEM; - #endif -+ nf_register_queue_handler(net, &nfqh); - return 0; - } - - static void __net_exit nfnl_queue_net_exit(struct net *net) - { -+ nf_unregister_queue_handler(net); - #ifdef CONFIG_PROC_FS - remove_proc_entry("nfnetlink_queue", net->nf.proc_netfilter); - #endif - } - -+static void nfnl_queue_net_exit_batch(struct list_head *net_exit_list) -+{ -+ synchronize_rcu(); -+} -+ - static struct pernet_operations nfnl_queue_net_ops = { -- .init = nfnl_queue_net_init, -- .exit = nfnl_queue_net_exit, -- .id = &nfnl_queue_net_id, -- .size = sizeof(struct nfnl_queue_net), -+ .init = nfnl_queue_net_init, -+ .exit = nfnl_queue_net_exit, -+ .exit_batch = nfnl_queue_net_exit_batch, -+ .id = &nfnl_queue_net_id, -+ .size = sizeof(struct nfnl_queue_net), - }; - - static int __init nfnetlink_queue_init(void) -@@ -1417,7 +1425,6 @@ static int __init nfnetlink_queue_init(void) - } - - register_netdevice_notifier(&nfqnl_dev_notifier); -- nf_register_queue_handler(&nfqh); - return status; - - cleanup_netlink_notifier: -@@ -1429,7 +1436,6 @@ out: - - static void __exit nfnetlink_queue_fini(void) - { -- nf_unregister_queue_handler(); - unregister_netdevice_notifier(&nfqnl_dev_notifier); - nfnetlink_subsys_unregister(&nfqnl_subsys); - netlink_unregister_notifier(&nfqnl_rtnl_notifier); -diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c -index e080746e1a6b..48958d3cec9e 100644 ---- a/scripts/mod/modpost.c -+++ b/scripts/mod/modpost.c -@@ -594,7 +594,8 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname) - if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 || - strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0 || - strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 || -- strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0) -+ strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0 || -+ strcmp(symname, ".TOC.") == 0) - return 1; - /* Do not ignore this symbol */ - return 0; -diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c -index ce295c0c1da0..e44e844c8ec4 100644 ---- a/security/keys/encrypted-keys/encrypted.c -+++ b/security/keys/encrypted-keys/encrypted.c -@@ -141,23 +141,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc) - */ - static int valid_master_desc(const char *new_desc, const char *orig_desc) - { -- if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) { -- if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN) -- goto out; -- if (orig_desc) -- if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN)) -- goto out; -- } else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) { -- if (strlen(new_desc) == KEY_USER_PREFIX_LEN) -- goto out; -- if (orig_desc) -- if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN)) -- goto out; -- } else -- goto out; -+ int prefix_len; -+ -+ if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) -+ prefix_len = KEY_TRUSTED_PREFIX_LEN; -+ else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) -+ prefix_len = KEY_USER_PREFIX_LEN; -+ else -+ return -EINVAL; -+ -+ if (!new_desc[prefix_len]) -+ return -EINVAL; -+ -+ if (orig_desc && strncmp(new_desc, orig_desc, prefix_len)) -+ return -EINVAL; -+ - return 0; --out: -- return -EINVAL; - } - - /* -diff --git a/sound/soc/codecs/pcm512x-spi.c b/sound/soc/codecs/pcm512x-spi.c -index 712ed6598c48..ebdf9bd5a64c 100644 ---- a/sound/soc/codecs/pcm512x-spi.c -+++ b/sound/soc/codecs/pcm512x-spi.c -@@ -70,3 +70,7 @@ static struct spi_driver pcm512x_spi_driver = { - }; - - module_spi_driver(pcm512x_spi_driver); -+ -+MODULE_DESCRIPTION("ASoC PCM512x codec driver - SPI"); -+MODULE_AUTHOR("Mark Brown "); -+MODULE_LICENSE("GPL v2"); -diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c -index ff6fcd9f92f7..0b1b6fcb7500 100644 ---- a/sound/soc/generic/simple-card.c -+++ b/sound/soc/generic/simple-card.c -@@ -343,13 +343,19 @@ static int asoc_simple_card_dai_link_of(struct device_node *node, - snprintf(prop, sizeof(prop), "%scpu", prefix); - cpu = of_get_child_by_name(node, prop); - -+ if (!cpu) { -+ ret = -EINVAL; -+ dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop); -+ goto dai_link_of_err; -+ } -+ - snprintf(prop, sizeof(prop), "%splat", prefix); - plat = of_get_child_by_name(node, prop); - - snprintf(prop, sizeof(prop), "%scodec", prefix); - codec = of_get_child_by_name(node, prop); - -- if (!cpu || !codec) { -+ if (!codec) { - ret = -EINVAL; - dev_err(dev, "%s: Can't find %s DT node\n", __func__, prop); - goto dai_link_of_err; -diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h -index 085329878525..5976e3992dd1 100644 ---- a/sound/soc/sh/rcar/rsnd.h -+++ b/sound/soc/sh/rcar/rsnd.h -@@ -235,6 +235,7 @@ enum rsnd_mod_type { - RSND_MOD_MIX, - RSND_MOD_CTU, - RSND_MOD_SRC, -+ RSND_MOD_SSIP, /* SSI parent */ - RSND_MOD_SSI, - RSND_MOD_MAX, - }; -@@ -365,6 +366,7 @@ struct rsnd_dai_stream { - }; - #define rsnd_io_to_mod(io, i) ((i) < RSND_MOD_MAX ? (io)->mod[(i)] : NULL) - #define rsnd_io_to_mod_ssi(io) rsnd_io_to_mod((io), RSND_MOD_SSI) -+#define rsnd_io_to_mod_ssip(io) rsnd_io_to_mod((io), RSND_MOD_SSIP) - #define rsnd_io_to_mod_src(io) rsnd_io_to_mod((io), RSND_MOD_SRC) - #define rsnd_io_to_mod_ctu(io) rsnd_io_to_mod((io), RSND_MOD_CTU) - #define rsnd_io_to_mod_mix(io) rsnd_io_to_mod((io), RSND_MOD_MIX) -diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c -index c62a2947ac14..38aae96267c9 100644 ---- a/sound/soc/sh/rcar/ssi.c -+++ b/sound/soc/sh/rcar/ssi.c -@@ -550,11 +550,16 @@ static int rsnd_ssi_dma_remove(struct rsnd_mod *mod, - struct rsnd_priv *priv) - { - struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); -+ struct rsnd_mod *pure_ssi_mod = rsnd_io_to_mod_ssi(io); - struct device *dev = rsnd_priv_to_dev(priv); - int irq = ssi->info->irq; - - rsnd_dma_quit(io, rsnd_mod_to_dma(mod)); - -+ /* Do nothing if non SSI (= SSI parent, multi SSI) mod */ -+ if (pure_ssi_mod != mod) -+ return 0; -+ - /* PIO will request IRQ again */ - devm_free_irq(dev, irq, mod); - diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.116-117.patch b/patch/kernel/mvebu64-default/04-patch-4.4.116-117.patch deleted file mode 100644 index a48cc7fc3a4b..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.116-117.patch +++ /dev/null @@ -1,929 +0,0 @@ -diff --git a/Documentation/devicetree/bindings/dma/snps-dma.txt b/Documentation/devicetree/bindings/dma/snps-dma.txt -index c261598164a7..17d43ca27f41 100644 ---- a/Documentation/devicetree/bindings/dma/snps-dma.txt -+++ b/Documentation/devicetree/bindings/dma/snps-dma.txt -@@ -58,6 +58,6 @@ Example: - interrupts = <0 35 0x4>; - status = "disabled"; - dmas = <&dmahost 12 0 1>, -- <&dmahost 13 0 1 0>; -+ <&dmahost 13 1 0>; - dma-names = "rx", "rx"; - }; -diff --git a/Documentation/filesystems/ext4.txt b/Documentation/filesystems/ext4.txt -index 6c0108eb0137..2139ea253142 100644 ---- a/Documentation/filesystems/ext4.txt -+++ b/Documentation/filesystems/ext4.txt -@@ -233,7 +233,7 @@ data_err=ignore(*) Just print an error message if an error occurs - data_err=abort Abort the journal if an error occurs in a file - data buffer in ordered mode. - --grpid Give objects the same group ID as their creator. -+grpid New objects have the group ID of their parent. - bsdgroups - - nogrpid (*) New objects have the group ID of their creator. -diff --git a/Makefile b/Makefile -index 71acaecd7899..9f53ba1835ad 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 116 -+SUBLEVEL = 117 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/boot/dts/s5pv210.dtsi b/arch/arm/boot/dts/s5pv210.dtsi -index 8344a0ee2b86..b03fe747b98c 100644 ---- a/arch/arm/boot/dts/s5pv210.dtsi -+++ b/arch/arm/boot/dts/s5pv210.dtsi -@@ -461,6 +461,7 @@ - compatible = "samsung,exynos4210-ohci"; - reg = <0xec300000 0x100>; - interrupts = <23>; -+ interrupt-parent = <&vic1>; - clocks = <&clocks CLK_USB_HOST>; - clock-names = "usbhost"; - #address-cells = <1>; -diff --git a/arch/arm/boot/dts/spear1310-evb.dts b/arch/arm/boot/dts/spear1310-evb.dts -index e48857249ce7..3d83992efd90 100644 ---- a/arch/arm/boot/dts/spear1310-evb.dts -+++ b/arch/arm/boot/dts/spear1310-evb.dts -@@ -349,7 +349,7 @@ - spi0: spi@e0100000 { - status = "okay"; - num-cs = <3>; -- cs-gpios = <&gpio1 7 0>, <&spics 0>, <&spics 1>; -+ cs-gpios = <&gpio1 7 0>, <&spics 0 0>, <&spics 1 0>; - - stmpe610@0 { - compatible = "st,stmpe610"; -diff --git a/arch/arm/boot/dts/spear1340.dtsi b/arch/arm/boot/dts/spear1340.dtsi -index df2232d767ed..6361cbfcbe5e 100644 ---- a/arch/arm/boot/dts/spear1340.dtsi -+++ b/arch/arm/boot/dts/spear1340.dtsi -@@ -141,8 +141,8 @@ - reg = <0xb4100000 0x1000>; - interrupts = <0 105 0x4>; - status = "disabled"; -- dmas = <&dwdma0 0x600 0 0 1>, /* 0xC << 11 */ -- <&dwdma0 0x680 0 1 0>; /* 0xD << 7 */ -+ dmas = <&dwdma0 12 0 1>, -+ <&dwdma0 13 1 0>; - dma-names = "tx", "rx"; - }; - -diff --git a/arch/arm/boot/dts/spear13xx.dtsi b/arch/arm/boot/dts/spear13xx.dtsi -index 14594ce8c18a..8fd8a3328acb 100644 ---- a/arch/arm/boot/dts/spear13xx.dtsi -+++ b/arch/arm/boot/dts/spear13xx.dtsi -@@ -100,7 +100,7 @@ - reg = <0xb2800000 0x1000>; - interrupts = <0 29 0x4>; - status = "disabled"; -- dmas = <&dwdma0 0 0 0 0>; -+ dmas = <&dwdma0 0 0 0>; - dma-names = "data"; - }; - -@@ -288,8 +288,8 @@ - #size-cells = <0>; - interrupts = <0 31 0x4>; - status = "disabled"; -- dmas = <&dwdma0 0x2000 0 0 0>, /* 0x4 << 11 */ -- <&dwdma0 0x0280 0 0 0>; /* 0x5 << 7 */ -+ dmas = <&dwdma0 4 0 0>, -+ <&dwdma0 5 0 0>; - dma-names = "tx", "rx"; - }; - -diff --git a/arch/arm/boot/dts/spear600.dtsi b/arch/arm/boot/dts/spear600.dtsi -index 9f60a7b6a42b..bd379034993c 100644 ---- a/arch/arm/boot/dts/spear600.dtsi -+++ b/arch/arm/boot/dts/spear600.dtsi -@@ -194,6 +194,7 @@ - rtc@fc900000 { - compatible = "st,spear600-rtc"; - reg = <0xfc900000 0x1000>; -+ interrupt-parent = <&vic0>; - interrupts = <10>; - status = "disabled"; - }; -diff --git a/arch/arm/boot/dts/stih407.dtsi b/arch/arm/boot/dts/stih407.dtsi -index d60f0d8add26..e4b508ce38a2 100644 ---- a/arch/arm/boot/dts/stih407.dtsi -+++ b/arch/arm/boot/dts/stih407.dtsi -@@ -8,6 +8,7 @@ - */ - #include "stih407-clock.dtsi" - #include "stih407-family.dtsi" -+#include - / { - soc { - sti-display-subsystem { -@@ -112,7 +113,7 @@ - <&clk_s_d2_quadfs 0>, - <&clk_s_d2_quadfs 1>; - -- hdmi,hpd-gpio = <&pio5 3>; -+ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>; - reset-names = "hdmi"; - resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>; - ddc = <&hdmiddc>; -diff --git a/arch/arm/boot/dts/stih410.dtsi b/arch/arm/boot/dts/stih410.dtsi -index 40318869c733..3c32fb8cdcac 100644 ---- a/arch/arm/boot/dts/stih410.dtsi -+++ b/arch/arm/boot/dts/stih410.dtsi -@@ -9,6 +9,7 @@ - #include "stih410-clock.dtsi" - #include "stih407-family.dtsi" - #include "stih410-pinctrl.dtsi" -+#include - / { - aliases { - bdisp0 = &bdisp0; -@@ -203,7 +204,7 @@ - <&clk_s_d2_quadfs 0>, - <&clk_s_d2_quadfs 1>; - -- hdmi,hpd-gpio = <&pio5 3>; -+ hdmi,hpd-gpio = <&pio5 3 GPIO_ACTIVE_LOW>; - reset-names = "hdmi"; - resets = <&softreset STIH407_HDMI_TX_PHY_SOFTRESET>; - ddc = <&hdmiddc>; -diff --git a/arch/arm/mach-pxa/tosa-bt.c b/arch/arm/mach-pxa/tosa-bt.c -index e0a53208880a..b59a7a2df4e3 100644 ---- a/arch/arm/mach-pxa/tosa-bt.c -+++ b/arch/arm/mach-pxa/tosa-bt.c -@@ -132,3 +132,7 @@ static struct platform_driver tosa_bt_driver = { - }, - }; - module_platform_driver(tosa_bt_driver); -+ -+MODULE_LICENSE("GPL"); -+MODULE_AUTHOR("Dmitry Baryshkov"); -+MODULE_DESCRIPTION("Bluetooth built-in chip control"); -diff --git a/arch/s390/kernel/compat_linux.c b/arch/s390/kernel/compat_linux.c -index 0176ebc97bfd..86f934255eb6 100644 ---- a/arch/s390/kernel/compat_linux.c -+++ b/arch/s390/kernel/compat_linux.c -@@ -110,7 +110,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setregid16, u16, rgid, u16, egid) - - COMPAT_SYSCALL_DEFINE1(s390_setgid16, u16, gid) - { -- return sys_setgid((gid_t)gid); -+ return sys_setgid(low2highgid(gid)); - } - - COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid) -@@ -120,7 +120,7 @@ COMPAT_SYSCALL_DEFINE2(s390_setreuid16, u16, ruid, u16, euid) - - COMPAT_SYSCALL_DEFINE1(s390_setuid16, u16, uid) - { -- return sys_setuid((uid_t)uid); -+ return sys_setuid(low2highuid(uid)); - } - - COMPAT_SYSCALL_DEFINE3(s390_setresuid16, u16, ruid, u16, euid, u16, suid) -@@ -173,12 +173,12 @@ COMPAT_SYSCALL_DEFINE3(s390_getresgid16, u16 __user *, rgidp, - - COMPAT_SYSCALL_DEFINE1(s390_setfsuid16, u16, uid) - { -- return sys_setfsuid((uid_t)uid); -+ return sys_setfsuid(low2highuid(uid)); - } - - COMPAT_SYSCALL_DEFINE1(s390_setfsgid16, u16, gid) - { -- return sys_setfsgid((gid_t)gid); -+ return sys_setfsgid(low2highgid(gid)); - } - - static int groups16_to_user(u16 __user *grouplist, struct group_info *group_info) -diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h -index 86bccb4bd4dc..9e77cea2a8ef 100644 ---- a/arch/x86/include/asm/processor.h -+++ b/arch/x86/include/asm/processor.h -@@ -113,7 +113,7 @@ struct cpuinfo_x86 { - char x86_vendor_id[16]; - char x86_model_id[64]; - /* in KB - valid for CPUS which support this call: */ -- int x86_cache_size; -+ unsigned int x86_cache_size; - int x86_cache_alignment; /* In bytes */ - /* Cache QoS architectural values: */ - int x86_cache_max_rmid; /* max index */ -diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c -index f7f2ad3687ee..8eabbafff213 100644 ---- a/arch/x86/kernel/cpu/common.c -+++ b/arch/x86/kernel/cpu/common.c -@@ -955,7 +955,7 @@ static void identify_cpu(struct cpuinfo_x86 *c) - int i; - - c->loops_per_jiffy = loops_per_jiffy; -- c->x86_cache_size = -1; -+ c->x86_cache_size = 0; - c->x86_vendor = X86_VENDOR_UNKNOWN; - c->x86_model = c->x86_mask = 0; /* So far unknown... */ - c->x86_vendor_id[0] = '\0'; /* Unset */ -diff --git a/arch/x86/kernel/cpu/microcode/intel.c b/arch/x86/kernel/cpu/microcode/intel.c -index 2c76a1801393..2f38a99cdb98 100644 ---- a/arch/x86/kernel/cpu/microcode/intel.c -+++ b/arch/x86/kernel/cpu/microcode/intel.c -@@ -1075,7 +1075,7 @@ static struct microcode_ops microcode_intel_ops = { - - static int __init calc_llc_size_per_core(struct cpuinfo_x86 *c) - { -- u64 llc_size = c->x86_cache_size * 1024; -+ u64 llc_size = c->x86_cache_size * 1024ULL; - - do_div(llc_size, c->x86_max_cores); - -diff --git a/arch/x86/kernel/cpu/proc.c b/arch/x86/kernel/cpu/proc.c -index 18ca99f2798b..935225c0375f 100644 ---- a/arch/x86/kernel/cpu/proc.c -+++ b/arch/x86/kernel/cpu/proc.c -@@ -87,8 +87,8 @@ static int show_cpuinfo(struct seq_file *m, void *v) - } - - /* Cache size */ -- if (c->x86_cache_size >= 0) -- seq_printf(m, "cache size\t: %d KB\n", c->x86_cache_size); -+ if (c->x86_cache_size) -+ seq_printf(m, "cache size\t: %u KB\n", c->x86_cache_size); - - show_cpuinfo_core(m, c, cpu); - show_cpuinfo_misc(m, c); -diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c -index 1049c3c9b877..2b71f2c03b9e 100644 ---- a/arch/x86/kvm/mmu.c -+++ b/arch/x86/kvm/mmu.c -@@ -4503,7 +4503,7 @@ void kvm_mmu_setup(struct kvm_vcpu *vcpu) - typedef bool (*slot_level_handler) (struct kvm *kvm, unsigned long *rmap); - - /* The caller should hold mmu-lock before calling this function. */ --static bool -+static __always_inline bool - slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot, - slot_level_handler fn, int start_level, int end_level, - gfn_t start_gfn, gfn_t end_gfn, bool lock_flush_tlb) -@@ -4533,7 +4533,7 @@ slot_handle_level_range(struct kvm *kvm, struct kvm_memory_slot *memslot, - return flush; - } - --static bool -+static __always_inline bool - slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - slot_level_handler fn, int start_level, int end_level, - bool lock_flush_tlb) -@@ -4544,7 +4544,7 @@ slot_handle_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - lock_flush_tlb); - } - --static bool -+static __always_inline bool - slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - slot_level_handler fn, bool lock_flush_tlb) - { -@@ -4552,7 +4552,7 @@ slot_handle_all_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb); - } - --static bool -+static __always_inline bool - slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - slot_level_handler fn, bool lock_flush_tlb) - { -@@ -4560,7 +4560,7 @@ slot_handle_large_level(struct kvm *kvm, struct kvm_memory_slot *memslot, - PT_MAX_HUGEPAGE_LEVEL, lock_flush_tlb); - } - --static bool -+static __always_inline bool - slot_handle_leaf(struct kvm *kvm, struct kvm_memory_slot *memslot, - slot_level_handler fn, bool lock_flush_tlb) - { -diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c -index ca848cc6a8fd..4f6fc1cfd7da 100644 ---- a/drivers/devfreq/devfreq.c -+++ b/drivers/devfreq/devfreq.c -@@ -583,7 +583,7 @@ struct devfreq *devm_devfreq_add_device(struct device *dev, - devfreq = devfreq_add_device(dev, profile, governor_name, data); - if (IS_ERR(devfreq)) { - devres_free(ptr); -- return ERR_PTR(-ENOMEM); -+ return devfreq; - } - - *ptr = devfreq; -diff --git a/drivers/gpu/drm/radeon/radeon_uvd.c b/drivers/gpu/drm/radeon/radeon_uvd.c -index 6edcb5485092..b35ebabd6a9f 100644 ---- a/drivers/gpu/drm/radeon/radeon_uvd.c -+++ b/drivers/gpu/drm/radeon/radeon_uvd.c -@@ -946,7 +946,7 @@ int radeon_uvd_calc_upll_dividers(struct radeon_device *rdev, - /* calc dclk divider with current vco freq */ - dclk_div = radeon_uvd_calc_upll_post_div(vco_freq, dclk, - pd_min, pd_even); -- if (vclk_div > pd_max) -+ if (dclk_div > pd_max) - break; /* vco is too big, it has to stop */ - - /* calc score with current vco freq */ -diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c -index 8763fb832b01..5a2a0b5db938 100644 ---- a/drivers/infiniband/hw/mlx4/main.c -+++ b/drivers/infiniband/hw/mlx4/main.c -@@ -2483,9 +2483,8 @@ err_steer_free_bitmap: - kfree(ibdev->ib_uc_qpns_bitmap); - - err_steer_qp_release: -- if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) -- mlx4_qp_release_range(dev, ibdev->steer_qpn_base, -- ibdev->steer_qpn_count); -+ mlx4_qp_release_range(dev, ibdev->steer_qpn_base, -+ ibdev->steer_qpn_count); - err_counter: - for (i = 0; i < ibdev->num_ports; ++i) - mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]); -@@ -2586,11 +2585,9 @@ static void mlx4_ib_remove(struct mlx4_dev *dev, void *ibdev_ptr) - ibdev->iboe.nb.notifier_call = NULL; - } - -- if (ibdev->steering_support == MLX4_STEERING_MODE_DEVICE_MANAGED) { -- mlx4_qp_release_range(dev, ibdev->steer_qpn_base, -- ibdev->steer_qpn_count); -- kfree(ibdev->ib_uc_qpns_bitmap); -- } -+ mlx4_qp_release_range(dev, ibdev->steer_qpn_base, -+ ibdev->steer_qpn_count); -+ kfree(ibdev->ib_uc_qpns_bitmap); - - iounmap(ibdev->uar_map); - for (p = 0; p < ibdev->num_ports; ++p) -diff --git a/drivers/md/dm.c b/drivers/md/dm.c -index 9ec6948e3b8b..3d9a80759d95 100644 ---- a/drivers/md/dm.c -+++ b/drivers/md/dm.c -@@ -974,7 +974,8 @@ static void dec_pending(struct dm_io *io, int error) - } else { - /* done with normal IO or empty flush */ - trace_block_bio_complete(md->queue, bio, io_error); -- bio->bi_error = io_error; -+ if (io_error) -+ bio->bi_error = io_error; - bio_endio(bio); - } - } -diff --git a/drivers/media/tuners/r820t.c b/drivers/media/tuners/r820t.c -index a7a8452e99d2..c1ce8d3ce877 100644 ---- a/drivers/media/tuners/r820t.c -+++ b/drivers/media/tuners/r820t.c -@@ -410,9 +410,11 @@ static int r820t_write(struct r820t_priv *priv, u8 reg, const u8 *val, - return 0; - } - --static int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val) -+static inline int r820t_write_reg(struct r820t_priv *priv, u8 reg, u8 val) - { -- return r820t_write(priv, reg, &val, 1); -+ u8 tmp = val; /* work around GCC PR81715 with asan-stack=1 */ -+ -+ return r820t_write(priv, reg, &tmp, 1); - } - - static int r820t_read_cache_reg(struct r820t_priv *priv, int reg) -@@ -425,17 +427,18 @@ static int r820t_read_cache_reg(struct r820t_priv *priv, int reg) - return -EINVAL; - } - --static int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val, -+static inline int r820t_write_reg_mask(struct r820t_priv *priv, u8 reg, u8 val, - u8 bit_mask) - { -+ u8 tmp = val; - int rc = r820t_read_cache_reg(priv, reg); - - if (rc < 0) - return rc; - -- val = (rc & ~bit_mask) | (val & bit_mask); -+ tmp = (rc & ~bit_mask) | (tmp & bit_mask); - -- return r820t_write(priv, reg, &val, 1); -+ return r820t_write(priv, reg, &tmp, 1); - } - - static int r820t_read(struct r820t_priv *priv, u8 reg, u8 *val, int len) -diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c -index 4f34e1b79705..ac92685dd4e5 100644 ---- a/drivers/net/ethernet/marvell/mvpp2.c -+++ b/drivers/net/ethernet/marvell/mvpp2.c -@@ -5666,6 +5666,7 @@ static void mvpp2_set_rx_mode(struct net_device *dev) - int id = port->id; - bool allmulti = dev->flags & IFF_ALLMULTI; - -+retry: - mvpp2_prs_mac_promisc_set(priv, id, dev->flags & IFF_PROMISC); - mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_ALL, allmulti); - mvpp2_prs_mac_multi_set(priv, id, MVPP2_PE_MAC_MC_IP6, allmulti); -@@ -5673,9 +5674,13 @@ static void mvpp2_set_rx_mode(struct net_device *dev) - /* Remove all port->id's mcast enries */ - mvpp2_prs_mcast_del_all(priv, id); - -- if (allmulti && !netdev_mc_empty(dev)) { -- netdev_for_each_mc_addr(ha, dev) -- mvpp2_prs_mac_da_accept(priv, id, ha->addr, true); -+ if (!allmulti) { -+ netdev_for_each_mc_addr(ha, dev) { -+ if (mvpp2_prs_mac_da_accept(priv, id, ha->addr, true)) { -+ allmulti = true; -+ goto retry; -+ } -+ } - } - } - -diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c -index 168823dde79f..d8359ffba026 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/qp.c -+++ b/drivers/net/ethernet/mellanox/mlx4/qp.c -@@ -280,6 +280,9 @@ void mlx4_qp_release_range(struct mlx4_dev *dev, int base_qpn, int cnt) - u64 in_param = 0; - int err; - -+ if (!cnt) -+ return; -+ - if (mlx4_is_mfunc(dev)) { - set_param_l(&in_param, base_qpn); - set_param_h(&in_param, cnt); -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -index 738d541a2255..348ed1b0e58b 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c -@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, u16 addr) - } - if (0 == tmp) { - read_addr = REG_DBI_RDATA + addr % 4; -- ret = rtl_read_word(rtlpriv, read_addr); -+ ret = rtl_read_byte(rtlpriv, read_addr); - } - return ret; - } -@@ -1169,7 +1169,8 @@ static void _rtl8821ae_enable_aspm_back_door(struct ieee80211_hw *hw) - } - - tmp = _rtl8821ae_dbi_read(rtlpriv, 0x70f); -- _rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7)); -+ _rtl8821ae_dbi_write(rtlpriv, 0x70f, tmp | BIT(7) | -+ ASPM_L1_LATENCY << 3); - - tmp = _rtl8821ae_dbi_read(rtlpriv, 0x719); - _rtl8821ae_dbi_write(rtlpriv, 0x719, tmp | BIT(3) | BIT(4)); -diff --git a/drivers/net/wireless/realtek/rtlwifi/wifi.h b/drivers/net/wireless/realtek/rtlwifi/wifi.h -index b6faf624480e..d676d055feda 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/wifi.h -+++ b/drivers/net/wireless/realtek/rtlwifi/wifi.h -@@ -99,6 +99,7 @@ - #define RTL_USB_MAX_RX_COUNT 100 - #define QBSS_LOAD_SIZE 5 - #define MAX_WMMELE_LENGTH 64 -+#define ASPM_L1_LATENCY 7 - - #define TOTAL_CAM_ENTRY 32 - -diff --git a/drivers/rtc/rtc-opal.c b/drivers/rtc/rtc-opal.c -index df39ce02a99d..229dd2fe8f45 100644 ---- a/drivers/rtc/rtc-opal.c -+++ b/drivers/rtc/rtc-opal.c -@@ -58,6 +58,7 @@ static void tm_to_opal(struct rtc_time *tm, u32 *y_m_d, u64 *h_m_s_ms) - static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) - { - long rc = OPAL_BUSY; -+ int retries = 10; - u32 y_m_d; - u64 h_m_s_ms; - __be32 __y_m_d; -@@ -67,8 +68,11 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) - rc = opal_rtc_read(&__y_m_d, &__h_m_s_ms); - if (rc == OPAL_BUSY_EVENT) - opal_poll_events(NULL); -- else -+ else if (retries-- && (rc == OPAL_HARDWARE -+ || rc == OPAL_INTERNAL_ERROR)) - msleep(10); -+ else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) -+ break; - } - - if (rc != OPAL_SUCCESS) -@@ -84,6 +88,7 @@ static int opal_get_rtc_time(struct device *dev, struct rtc_time *tm) - static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm) - { - long rc = OPAL_BUSY; -+ int retries = 10; - u32 y_m_d = 0; - u64 h_m_s_ms = 0; - -@@ -92,8 +97,11 @@ static int opal_set_rtc_time(struct device *dev, struct rtc_time *tm) - rc = opal_rtc_write(y_m_d, h_m_s_ms); - if (rc == OPAL_BUSY_EVENT) - opal_poll_events(NULL); -- else -+ else if (retries-- && (rc == OPAL_HARDWARE -+ || rc == OPAL_INTERNAL_ERROR)) - msleep(10); -+ else if (rc != OPAL_BUSY && rc != OPAL_BUSY_EVENT) -+ break; - } - - return rc == OPAL_SUCCESS ? 0 : -EIO; -diff --git a/drivers/video/console/dummycon.c b/drivers/video/console/dummycon.c -index 0efc52f11ad0..b30e7d87804b 100644 ---- a/drivers/video/console/dummycon.c -+++ b/drivers/video/console/dummycon.c -@@ -68,7 +68,6 @@ const struct consw dummy_con = { - .con_switch = DUMMY, - .con_blank = DUMMY, - .con_font_set = DUMMY, -- .con_font_get = DUMMY, - .con_font_default = DUMMY, - .con_font_copy = DUMMY, - .con_set_palette = DUMMY, -diff --git a/drivers/video/fbdev/atmel_lcdfb.c b/drivers/video/fbdev/atmel_lcdfb.c -index 19eb42b57d87..a6da82648c92 100644 ---- a/drivers/video/fbdev/atmel_lcdfb.c -+++ b/drivers/video/fbdev/atmel_lcdfb.c -@@ -1120,7 +1120,7 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo) - goto put_display_node; - } - -- timings_np = of_find_node_by_name(display_np, "display-timings"); -+ timings_np = of_get_child_by_name(display_np, "display-timings"); - if (!timings_np) { - dev_err(dev, "failed to find display-timings node\n"); - ret = -ENODEV; -@@ -1141,6 +1141,12 @@ static int atmel_lcdfb_of_init(struct atmel_lcdfb_info *sinfo) - fb_add_videomode(&fb_vm, &info->modelist); - } - -+ /* -+ * FIXME: Make sure we are not referencing any fields in display_np -+ * and timings_np and drop our references to them before returning to -+ * avoid leaking the nodes on probe deferral and driver unbind. -+ */ -+ - return 0; - - put_timings_node: -diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c -index 86d209fc4992..81b5a461d94e 100644 ---- a/fs/btrfs/inode.c -+++ b/fs/btrfs/inode.c -@@ -1292,8 +1292,11 @@ next_slot: - leaf = path->nodes[0]; - if (path->slots[0] >= btrfs_header_nritems(leaf)) { - ret = btrfs_next_leaf(root, path); -- if (ret < 0) -+ if (ret < 0) { -+ if (cow_start != (u64)-1) -+ cur_offset = cow_start; - goto error; -+ } - if (ret > 0) - break; - leaf = path->nodes[0]; -diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c -index ee7832e2d39d..d6359af9789d 100644 ---- a/fs/btrfs/tree-log.c -+++ b/fs/btrfs/tree-log.c -@@ -26,6 +26,7 @@ - #include "print-tree.h" - #include "backref.h" - #include "hash.h" -+#include "inode-map.h" - - /* magic values for the inode_only field in btrfs_log_inode: - * -@@ -2445,6 +2446,9 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans, - next); - btrfs_wait_tree_block_writeback(next); - btrfs_tree_unlock(next); -+ } else { -+ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) -+ clear_extent_buffer_dirty(next); - } - - WARN_ON(root_owner != -@@ -2524,6 +2528,9 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans, - next); - btrfs_wait_tree_block_writeback(next); - btrfs_tree_unlock(next); -+ } else { -+ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) -+ clear_extent_buffer_dirty(next); - } - - WARN_ON(root_owner != BTRFS_TREE_LOG_OBJECTID); -@@ -2600,6 +2607,9 @@ static int walk_log_tree(struct btrfs_trans_handle *trans, - clean_tree_block(trans, log->fs_info, next); - btrfs_wait_tree_block_writeback(next); - btrfs_tree_unlock(next); -+ } else { -+ if (test_and_clear_bit(EXTENT_BUFFER_DIRTY, &next->bflags)) -+ clear_extent_buffer_dirty(next); - } - - WARN_ON(log->root_key.objectid != -@@ -5514,6 +5524,23 @@ again: - path); - } - -+ if (!ret && wc.stage == LOG_WALK_REPLAY_ALL) { -+ struct btrfs_root *root = wc.replay_dest; -+ -+ btrfs_release_path(path); -+ -+ /* -+ * We have just replayed everything, and the highest -+ * objectid of fs roots probably has changed in case -+ * some inode_item's got replayed. -+ * -+ * root->objectid_mutex is not acquired as log replay -+ * could only happen during mount. -+ */ -+ ret = btrfs_find_highest_objectid(root, -+ &root->highest_objectid); -+ } -+ - key.offset = found_key.offset - 1; - wc.replay_dest->log_root = NULL; - free_extent_buffer(log->node); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 8bdb0cc2722f..742455292dfe 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -688,6 +688,7 @@ __acquires(bitlock) - } - - ext4_unlock_group(sb, grp); -+ ext4_commit_super(sb, 1); - ext4_handle_error(sb); - /* - * We only get here in the ERRORS_RO case; relocking the group -diff --git a/fs/namei.c b/fs/namei.c -index 3f96ae087488..844da20232b9 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -2000,6 +2000,9 @@ static const char *path_init(struct nameidata *nd, unsigned flags) - int retval = 0; - const char *s = nd->name->name; - -+ if (!*s) -+ flags &= ~LOOKUP_RCU; -+ - nd->last_type = LAST_ROOT; /* if there are only slashes... */ - nd->flags = flags | LOOKUP_JUMPED | LOOKUP_PARENT; - nd->depth = 0; -diff --git a/include/linux/kaiser.h b/include/linux/kaiser.h -index 58c55b1589d0..b56c19010480 100644 ---- a/include/linux/kaiser.h -+++ b/include/linux/kaiser.h -@@ -32,7 +32,7 @@ static inline void kaiser_init(void) - { - } - static inline int kaiser_add_mapping(unsigned long addr, -- unsigned long size, unsigned long flags) -+ unsigned long size, u64 flags) - { - return 0; - } -diff --git a/mm/memory.c b/mm/memory.c -index 9ac55172aa7b..31ca97f7ebbc 100644 ---- a/mm/memory.c -+++ b/mm/memory.c -@@ -72,7 +72,7 @@ - - #include "internal.h" - --#ifdef LAST_CPUPID_NOT_IN_PAGE_FLAGS -+#if defined(LAST_CPUPID_NOT_IN_PAGE_FLAGS) && !defined(CONFIG_COMPILE_TEST) - #warning Unfortunate NUMA and NUMA Balancing config, growing page-frame for last_cpupid. - #endif - -diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c -index 7bb9fe7a2c8e..167b943469ab 100644 ---- a/sound/core/seq/seq_clientmgr.c -+++ b/sound/core/seq/seq_clientmgr.c -@@ -1012,7 +1012,7 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, - { - struct snd_seq_client *client = file->private_data; - int written = 0, len; -- int err = -EINVAL; -+ int err; - struct snd_seq_event event; - - if (!(snd_seq_file_flags(file) & SNDRV_SEQ_LFLG_OUTPUT)) -@@ -1027,11 +1027,15 @@ static ssize_t snd_seq_write(struct file *file, const char __user *buf, - - /* allocate the pool now if the pool is not allocated yet */ - if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) { -- if (snd_seq_pool_init(client->pool) < 0) -+ mutex_lock(&client->ioctl_mutex); -+ err = snd_seq_pool_init(client->pool); -+ mutex_unlock(&client->ioctl_mutex); -+ if (err < 0) - return -ENOMEM; - } - - /* only process whole events */ -+ err = -EINVAL; - while (count >= sizeof(struct snd_seq_event)) { - /* Read in the event header from the user */ - len = sizeof(event); -@@ -2196,7 +2200,6 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, - void __user *arg) - { - struct seq_ioctl_table *p; -- int ret; - - switch (cmd) { - case SNDRV_SEQ_IOCTL_PVERSION: -@@ -2210,12 +2213,8 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, - if (! arg) - return -EFAULT; - for (p = ioctl_tables; p->cmd; p++) { -- if (p->cmd == cmd) { -- mutex_lock(&client->ioctl_mutex); -- ret = p->func(client, arg); -- mutex_unlock(&client->ioctl_mutex); -- return ret; -- } -+ if (p->cmd == cmd) -+ return p->func(client, arg); - } - pr_debug("ALSA: seq unknown ioctl() 0x%x (type='%c', number=0x%02x)\n", - cmd, _IOC_TYPE(cmd), _IOC_NR(cmd)); -@@ -2226,11 +2225,15 @@ static int snd_seq_do_ioctl(struct snd_seq_client *client, unsigned int cmd, - static long snd_seq_ioctl(struct file *file, unsigned int cmd, unsigned long arg) - { - struct snd_seq_client *client = file->private_data; -+ long ret; - - if (snd_BUG_ON(!client)) - return -ENXIO; - -- return snd_seq_do_ioctl(client, cmd, (void __user *) arg); -+ mutex_lock(&client->ioctl_mutex); -+ ret = snd_seq_do_ioctl(client, cmd, (void __user *) arg); -+ mutex_unlock(&client->ioctl_mutex); -+ return ret; - } - - #ifdef CONFIG_COMPAT -diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c -index f14c1f288443..b302d056e5d3 100644 ---- a/sound/pci/hda/patch_realtek.c -+++ b/sound/pci/hda/patch_realtek.c -@@ -3130,6 +3130,19 @@ static void alc269_fixup_pincfg_no_hp_to_lineout(struct hda_codec *codec, - spec->parse_flags = HDA_PINCFG_NO_HP_FIXUP; - } - -+static void alc269_fixup_pincfg_U7x7_headset_mic(struct hda_codec *codec, -+ const struct hda_fixup *fix, -+ int action) -+{ -+ unsigned int cfg_headphone = snd_hda_codec_get_pincfg(codec, 0x21); -+ unsigned int cfg_headset_mic = snd_hda_codec_get_pincfg(codec, 0x19); -+ -+ if (cfg_headphone && cfg_headset_mic == 0x411111f0) -+ snd_hda_codec_set_pincfg(codec, 0x19, -+ (cfg_headphone & ~AC_DEFCFG_DEVICE) | -+ (AC_JACK_MIC_IN << AC_DEFCFG_DEVICE_SHIFT)); -+} -+ - static void alc269_fixup_hweq(struct hda_codec *codec, - const struct hda_fixup *fix, int action) - { -@@ -4782,6 +4795,7 @@ enum { - ALC269_FIXUP_LIFEBOOK_EXTMIC, - ALC269_FIXUP_LIFEBOOK_HP_PIN, - ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT, -+ ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC, - ALC269_FIXUP_AMIC, - ALC269_FIXUP_DMIC, - ALC269VB_FIXUP_AMIC, -@@ -4972,6 +4986,10 @@ static const struct hda_fixup alc269_fixups[] = { - .type = HDA_FIXUP_FUNC, - .v.func = alc269_fixup_pincfg_no_hp_to_lineout, - }, -+ [ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC] = { -+ .type = HDA_FIXUP_FUNC, -+ .v.func = alc269_fixup_pincfg_U7x7_headset_mic, -+ }, - [ALC269_FIXUP_AMIC] = { - .type = HDA_FIXUP_PINS, - .v.pins = (const struct hda_pintbl[]) { -@@ -5687,6 +5705,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { - SND_PCI_QUIRK(0x10cf, 0x159f, "Lifebook E780", ALC269_FIXUP_LIFEBOOK_NO_HP_TO_LINEOUT), - SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN), - SND_PCI_QUIRK(0x10cf, 0x1757, "Lifebook E752", ALC269_FIXUP_LIFEBOOK_HP_PIN), -+ SND_PCI_QUIRK(0x10cf, 0x1629, "Lifebook U7x7", ALC255_FIXUP_LIFEBOOK_U7x7_HEADSET_MIC), - SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), - SND_PCI_QUIRK(0x144d, 0xc109, "Samsung Ativ book 9 (NP900X3G)", ALC269_FIXUP_INV_DMIC), - SND_PCI_QUIRK(0x1458, 0xfa53, "Gigabyte BXBT-2807", ALC283_FIXUP_BXBT2807_MIC), -@@ -5975,6 +5994,11 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - {0x12, 0xb7a60130}, - {0x14, 0x90170110}, - {0x21, 0x02211020}), -+ SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0x90a60130}, -+ {0x14, 0x90170110}, -+ {0x14, 0x01011020}, -+ {0x21, 0x0221101f}), - SND_HDA_PIN_QUIRK(0x10ec0256, 0x1028, "Dell", ALC255_FIXUP_DELL1_MIC_NO_PRESENCE, - ALC256_STANDARD_PINS), - SND_HDA_PIN_QUIRK(0x10ec0280, 0x103c, "HP", ALC280_FIXUP_HP_GPIO4, -@@ -6031,6 +6055,10 @@ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = { - {0x12, 0x90a60120}, - {0x14, 0x90170110}, - {0x21, 0x0321101f}), -+ SND_HDA_PIN_QUIRK(0x10ec0289, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE, -+ {0x12, 0xb7a60130}, -+ {0x14, 0x90170110}, -+ {0x21, 0x04211020}), - SND_HDA_PIN_QUIRK(0x10ec0290, 0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1, - ALC290_STANDARD_PINS, - {0x15, 0x04211040}, -diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c -index c9ae29068c7c..c5447ff078b3 100644 ---- a/sound/usb/mixer.c -+++ b/sound/usb/mixer.c -@@ -343,17 +343,20 @@ static int get_ctl_value_v2(struct usb_mixer_elem_info *cval, int request, - int validx, int *value_ret) - { - struct snd_usb_audio *chip = cval->head.mixer->chip; -- unsigned char buf[4 + 3 * sizeof(__u32)]; /* enough space for one range */ -+ /* enough space for one range */ -+ unsigned char buf[sizeof(__u16) + 3 * sizeof(__u32)]; - unsigned char *val; -- int idx = 0, ret, size; -+ int idx = 0, ret, val_size, size; - __u8 bRequest; - -+ val_size = uac2_ctl_value_size(cval->val_type); -+ - if (request == UAC_GET_CUR) { - bRequest = UAC2_CS_CUR; -- size = uac2_ctl_value_size(cval->val_type); -+ size = val_size; - } else { - bRequest = UAC2_CS_RANGE; -- size = sizeof(buf); -+ size = sizeof(__u16) + 3 * val_size; - } - - memset(buf, 0, sizeof(buf)); -@@ -386,16 +389,17 @@ error: - val = buf + sizeof(__u16); - break; - case UAC_GET_MAX: -- val = buf + sizeof(__u16) * 2; -+ val = buf + sizeof(__u16) + val_size; - break; - case UAC_GET_RES: -- val = buf + sizeof(__u16) * 3; -+ val = buf + sizeof(__u16) + val_size * 2; - break; - default: - return -EINVAL; - } - -- *value_ret = convert_signed_value(cval, snd_usb_combine_bytes(val, sizeof(__u16))); -+ *value_ret = convert_signed_value(cval, -+ snd_usb_combine_bytes(val, val_size)); - - return 0; - } -diff --git a/sound/usb/pcm.c b/sound/usb/pcm.c -index 48afae053c56..8e8db4ddf365 100644 ---- a/sound/usb/pcm.c -+++ b/sound/usb/pcm.c -@@ -343,6 +343,15 @@ static int set_sync_ep_implicit_fb_quirk(struct snd_usb_substream *subs, - ep = 0x81; - iface = usb_ifnum_to_if(dev, 2); - -+ if (!iface || iface->num_altsetting == 0) -+ return -EINVAL; -+ -+ alts = &iface->altsetting[1]; -+ goto add_sync_ep; -+ case USB_ID(0x1397, 0x0002): -+ ep = 0x81; -+ iface = usb_ifnum_to_if(dev, 1); -+ - if (!iface || iface->num_altsetting == 0) - return -EINVAL; - diff --git a/patch/kernel/mvebu64-default/04-patch-4.4.117-118.patch b/patch/kernel/mvebu64-default/04-patch-4.4.117-118.patch deleted file mode 100644 index 04dd322aa75f..000000000000 --- a/patch/kernel/mvebu64-default/04-patch-4.4.117-118.patch +++ /dev/null @@ -1,9662 +0,0 @@ -diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt -index 22a4688dc0c8..f53ef1ac3122 100644 ---- a/Documentation/kernel-parameters.txt -+++ b/Documentation/kernel-parameters.txt -@@ -2565,8 +2565,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted. - norandmaps Don't use address space randomization. Equivalent to - echo 0 > /proc/sys/kernel/randomize_va_space - -- noreplace-paravirt [X86,IA-64,PV_OPS] Don't patch paravirt_ops -- - noreplace-smp [X86-32,SMP] Don't replace SMP instructions - with UP alternatives - -diff --git a/Documentation/speculation.txt b/Documentation/speculation.txt -new file mode 100644 -index 000000000000..e9e6cbae2841 ---- /dev/null -+++ b/Documentation/speculation.txt -@@ -0,0 +1,90 @@ -+This document explains potential effects of speculation, and how undesirable -+effects can be mitigated portably using common APIs. -+ -+=========== -+Speculation -+=========== -+ -+To improve performance and minimize average latencies, many contemporary CPUs -+employ speculative execution techniques such as branch prediction, performing -+work which may be discarded at a later stage. -+ -+Typically speculative execution cannot be observed from architectural state, -+such as the contents of registers. However, in some cases it is possible to -+observe its impact on microarchitectural state, such as the presence or -+absence of data in caches. Such state may form side-channels which can be -+observed to extract secret information. -+ -+For example, in the presence of branch prediction, it is possible for bounds -+checks to be ignored by code which is speculatively executed. Consider the -+following code: -+ -+ int load_array(int *array, unsigned int index) -+ { -+ if (index >= MAX_ARRAY_ELEMS) -+ return 0; -+ else -+ return array[index]; -+ } -+ -+Which, on arm64, may be compiled to an assembly sequence such as: -+ -+ CMP , #MAX_ARRAY_ELEMS -+ B.LT less -+ MOV , #0 -+ RET -+ less: -+ LDR , [, ] -+ RET -+ -+It is possible that a CPU mis-predicts the conditional branch, and -+speculatively loads array[index], even if index >= MAX_ARRAY_ELEMS. This -+value will subsequently be discarded, but the speculated load may affect -+microarchitectural state which can be subsequently measured. -+ -+More complex sequences involving multiple dependent memory accesses may -+result in sensitive information being leaked. Consider the following -+code, building on the prior example: -+ -+ int load_dependent_arrays(int *arr1, int *arr2, int index) -+ { -+ int val1, val2, -+ -+ val1 = load_array(arr1, index); -+ val2 = load_array(arr2, val1); -+ -+ return val2; -+ } -+ -+Under speculation, the first call to load_array() may return the value -+of an out-of-bounds address, while the second call will influence -+microarchitectural state dependent on this value. This may provide an -+arbitrary read primitive. -+ -+==================================== -+Mitigating speculation side-channels -+==================================== -+ -+The kernel provides a generic API to ensure that bounds checks are -+respected even under speculation. Architectures which are affected by -+speculation-based side-channels are expected to implement these -+primitives. -+ -+The array_index_nospec() helper in can be used to -+prevent information from being leaked via side-channels. -+ -+A call to array_index_nospec(index, size) returns a sanitized index -+value that is bounded to [0, size) even under cpu speculation -+conditions. -+ -+This can be used to protect the earlier load_array() example: -+ -+ int load_array(int *array, unsigned int index) -+ { -+ if (index >= MAX_ARRAY_ELEMS) -+ return 0; -+ else { -+ index = array_index_nospec(index, MAX_ARRAY_ELEMS); -+ return array[index]; -+ } -+ } -diff --git a/Makefile b/Makefile -index 9f53ba1835ad..1e01148744f3 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 117 -+SUBLEVEL = 118 - EXTRAVERSION = - NAME = Blurry Fish Butt - -@@ -87,10 +87,12 @@ endif - ifneq ($(filter 4.%,$(MAKE_VERSION)),) # make-4 - ifneq ($(filter %s ,$(firstword x$(MAKEFLAGS))),) - quiet=silent_ -+ tools_silent=s - endif - else # make-3.8x - ifneq ($(filter s% -s%,$(MAKEFLAGS)),) - quiet=silent_ -+ tools_silent=-s - endif - endif - -@@ -1523,11 +1525,11 @@ image_name: - # Clear a bunch of variables before executing the submake - tools/: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ -+ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ - - tools/%: FORCE - $(Q)mkdir -p $(objtree)/tools -- $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ $* -+ $(Q)$(MAKE) LDFLAGS= MAKEFLAGS="$(tools_silent) $(filter --j% -j,$(MAKEFLAGS))" O=$(shell cd $(objtree) && /bin/pwd) subdir=tools -C $(src)/tools/ $* - - # Single targets - # --------------------------------------------------------------------------- -diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi -index de8791a4d131..3ef1d5a26389 100644 ---- a/arch/arm/boot/dts/am4372.dtsi -+++ b/arch/arm/boot/dts/am4372.dtsi -@@ -807,7 +807,8 @@ - reg = <0x48038000 0x2000>, - <0x46000000 0x400000>; - reg-names = "mpu", "dat"; -- interrupts = <80>, <81>; -+ interrupts = , -+ ; - interrupt-names = "tx", "rx"; - status = "disabled"; - dmas = <&edma 8>, -@@ -821,7 +822,8 @@ - reg = <0x4803C000 0x2000>, - <0x46400000 0x400000>; - reg-names = "mpu", "dat"; -- interrupts = <82>, <83>; -+ interrupts = , -+ ; - interrupt-names = "tx", "rx"; - status = "disabled"; - dmas = <&edma 10>, -diff --git a/arch/arm/boot/dts/omap4.dtsi b/arch/arm/boot/dts/omap4.dtsi -index 5a206c100ce2..8a5628c4b135 100644 ---- a/arch/arm/boot/dts/omap4.dtsi -+++ b/arch/arm/boot/dts/omap4.dtsi -@@ -844,14 +844,12 @@ - usbhsohci: ohci@4a064800 { - compatible = "ti,ohci-omap3"; - reg = <0x4a064800 0x400>; -- interrupt-parent = <&gic>; - interrupts = ; - }; - - usbhsehci: ehci@4a064c00 { - compatible = "ti,ehci-omap"; - reg = <0x4a064c00 0x400>; -- interrupt-parent = <&gic>; - interrupts = ; - }; - }; -diff --git a/arch/arm/mach-omap2/omap-secure.c b/arch/arm/mach-omap2/omap-secure.c -index 5ac122e88f67..9ff92050053c 100644 ---- a/arch/arm/mach-omap2/omap-secure.c -+++ b/arch/arm/mach-omap2/omap-secure.c -@@ -73,6 +73,25 @@ phys_addr_t omap_secure_ram_mempool_base(void) - return omap_secure_memblock_base; - } - -+u32 omap3_save_secure_ram(void __iomem *addr, int size) -+{ -+ u32 ret; -+ u32 param[5]; -+ -+ if (size != OMAP3_SAVE_SECURE_RAM_SZ) -+ return OMAP3_SAVE_SECURE_RAM_SZ; -+ -+ param[0] = 4; /* Number of arguments */ -+ param[1] = __pa(addr); /* Physical address for saving */ -+ param[2] = 0; -+ param[3] = 1; -+ param[4] = 1; -+ -+ ret = save_secure_ram_context(__pa(param)); -+ -+ return ret; -+} -+ - /** - * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls - * @idx: The PPA API index -diff --git a/arch/arm/mach-omap2/omap-secure.h b/arch/arm/mach-omap2/omap-secure.h -index af2851fbcdf0..ab6ce2597a88 100644 ---- a/arch/arm/mach-omap2/omap-secure.h -+++ b/arch/arm/mach-omap2/omap-secure.h -@@ -31,6 +31,8 @@ - /* Maximum Secure memory storage size */ - #define OMAP_SECURE_RAM_STORAGE (88 * SZ_1K) - -+#define OMAP3_SAVE_SECURE_RAM_SZ 0x803F -+ - /* Secure low power HAL API index */ - #define OMAP4_HAL_SAVESECURERAM_INDEX 0x1a - #define OMAP4_HAL_SAVEHW_INDEX 0x1b -@@ -64,6 +66,8 @@ extern u32 omap_smc2(u32 id, u32 falg, u32 pargs); - extern u32 omap_smc3(u32 id, u32 process, u32 flag, u32 pargs); - extern phys_addr_t omap_secure_ram_mempool_base(void); - extern int omap_secure_ram_reserve_memblock(void); -+extern u32 save_secure_ram_context(u32 args_pa); -+extern u32 omap3_save_secure_ram(void __iomem *save_regs, int size); - - extern u32 rx51_secure_dispatcher(u32 idx, u32 process, u32 flag, u32 nargs, - u32 arg1, u32 arg2, u32 arg3, u32 arg4); -diff --git a/arch/arm/mach-omap2/pm.h b/arch/arm/mach-omap2/pm.h -index b668719b9b25..8e30772cfe32 100644 ---- a/arch/arm/mach-omap2/pm.h -+++ b/arch/arm/mach-omap2/pm.h -@@ -81,10 +81,6 @@ extern unsigned int omap3_do_wfi_sz; - /* ... and its pointer from SRAM after copy */ - extern void (*omap3_do_wfi_sram)(void); - --/* save_secure_ram_context function pointer and size, for copy to SRAM */ --extern int save_secure_ram_context(u32 *addr); --extern unsigned int save_secure_ram_context_sz; -- - extern void omap3_save_scratchpad_contents(void); - - #define PM_RTA_ERRATUM_i608 (1 << 0) -diff --git a/arch/arm/mach-omap2/pm34xx.c b/arch/arm/mach-omap2/pm34xx.c -index 2dbd3785ee6f..181da202f981 100644 ---- a/arch/arm/mach-omap2/pm34xx.c -+++ b/arch/arm/mach-omap2/pm34xx.c -@@ -48,6 +48,7 @@ - #include "prm3xxx.h" - #include "pm.h" - #include "sdrc.h" -+#include "omap-secure.h" - #include "sram.h" - #include "control.h" - #include "vc.h" -@@ -66,7 +67,6 @@ struct power_state { - - static LIST_HEAD(pwrst_list); - --static int (*_omap_save_secure_sram)(u32 *addr); - void (*omap3_do_wfi_sram)(void); - - static struct powerdomain *mpu_pwrdm, *neon_pwrdm; -@@ -121,8 +121,8 @@ static void omap3_save_secure_ram_context(void) - * will hang the system. - */ - pwrdm_set_next_pwrst(mpu_pwrdm, PWRDM_POWER_ON); -- ret = _omap_save_secure_sram((u32 *)(unsigned long) -- __pa(omap3_secure_ram_storage)); -+ ret = omap3_save_secure_ram(omap3_secure_ram_storage, -+ OMAP3_SAVE_SECURE_RAM_SZ); - pwrdm_set_next_pwrst(mpu_pwrdm, mpu_next_state); - /* Following is for error tracking, it should not happen */ - if (ret) { -@@ -431,15 +431,10 @@ static int __init pwrdms_setup(struct powerdomain *pwrdm, void *unused) - * - * The minimum set of functions is pushed to SRAM for execution: - * - omap3_do_wfi for erratum i581 WA, -- * - save_secure_ram_context for security extensions. - */ - void omap_push_sram_idle(void) - { - omap3_do_wfi_sram = omap_sram_push(omap3_do_wfi, omap3_do_wfi_sz); -- -- if (omap_type() != OMAP2_DEVICE_TYPE_GP) -- _omap_save_secure_sram = omap_sram_push(save_secure_ram_context, -- save_secure_ram_context_sz); - } - - static void __init pm_errata_configure(void) -@@ -551,7 +546,7 @@ int __init omap3_pm_init(void) - clkdm_add_wkdep(neon_clkdm, mpu_clkdm); - if (omap_type() != OMAP2_DEVICE_TYPE_GP) { - omap3_secure_ram_storage = -- kmalloc(0x803F, GFP_KERNEL); -+ kmalloc(OMAP3_SAVE_SECURE_RAM_SZ, GFP_KERNEL); - if (!omap3_secure_ram_storage) - pr_err("Memory allocation failed when allocating for secure sram context\n"); - -diff --git a/arch/arm/mach-omap2/prm33xx.c b/arch/arm/mach-omap2/prm33xx.c -index dcb5001d77da..973bcd754e1c 100644 ---- a/arch/arm/mach-omap2/prm33xx.c -+++ b/arch/arm/mach-omap2/prm33xx.c -@@ -176,17 +176,6 @@ static int am33xx_pwrdm_read_pwrst(struct powerdomain *pwrdm) - return v; - } - --static int am33xx_pwrdm_read_prev_pwrst(struct powerdomain *pwrdm) --{ -- u32 v; -- -- v = am33xx_prm_read_reg(pwrdm->prcm_offs, pwrdm->pwrstst_offs); -- v &= AM33XX_LASTPOWERSTATEENTERED_MASK; -- v >>= AM33XX_LASTPOWERSTATEENTERED_SHIFT; -- -- return v; --} -- - static int am33xx_pwrdm_set_lowpwrstchange(struct powerdomain *pwrdm) - { - am33xx_prm_rmw_reg_bits(AM33XX_LOWPOWERSTATECHANGE_MASK, -@@ -357,7 +346,6 @@ struct pwrdm_ops am33xx_pwrdm_operations = { - .pwrdm_set_next_pwrst = am33xx_pwrdm_set_next_pwrst, - .pwrdm_read_next_pwrst = am33xx_pwrdm_read_next_pwrst, - .pwrdm_read_pwrst = am33xx_pwrdm_read_pwrst, -- .pwrdm_read_prev_pwrst = am33xx_pwrdm_read_prev_pwrst, - .pwrdm_set_logic_retst = am33xx_pwrdm_set_logic_retst, - .pwrdm_read_logic_pwrst = am33xx_pwrdm_read_logic_pwrst, - .pwrdm_read_logic_retst = am33xx_pwrdm_read_logic_retst, -diff --git a/arch/arm/mach-omap2/sleep34xx.S b/arch/arm/mach-omap2/sleep34xx.S -index 1b9f0520dea9..3e0d802c59da 100644 ---- a/arch/arm/mach-omap2/sleep34xx.S -+++ b/arch/arm/mach-omap2/sleep34xx.S -@@ -93,20 +93,13 @@ ENTRY(enable_omap3630_toggle_l2_on_restore) - ENDPROC(enable_omap3630_toggle_l2_on_restore) - - /* -- * Function to call rom code to save secure ram context. This gets -- * relocated to SRAM, so it can be all in .data section. Otherwise -- * we need to initialize api_params separately. -+ * Function to call rom code to save secure ram context. -+ * -+ * r0 = physical address of the parameters - */ -- .data -- .align 3 - ENTRY(save_secure_ram_context) - stmfd sp!, {r4 - r11, lr} @ save registers on stack -- adr r3, api_params @ r3 points to parameters -- str r0, [r3,#0x4] @ r0 has sdram address -- ldr r12, high_mask -- and r3, r3, r12 -- ldr r12, sram_phy_addr_mask -- orr r3, r3, r12 -+ mov r3, r0 @ physical address of parameters - mov r0, #25 @ set service ID for PPA - mov r12, r0 @ copy secure service ID in r12 - mov r1, #0 @ set task id for ROM code in r1 -@@ -120,18 +113,7 @@ ENTRY(save_secure_ram_context) - nop - nop - ldmfd sp!, {r4 - r11, pc} -- .align --sram_phy_addr_mask: -- .word SRAM_BASE_P --high_mask: -- .word 0xffff --api_params: -- .word 0x4, 0x0, 0x0, 0x1, 0x1 - ENDPROC(save_secure_ram_context) --ENTRY(save_secure_ram_context_sz) -- .word . - save_secure_ram_context -- -- .text - - /* - * ====================== -diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig -index 0fa4c5f8b1be..2d43357d4a0a 100644 ---- a/arch/arm/mach-tegra/Kconfig -+++ b/arch/arm/mach-tegra/Kconfig -@@ -12,8 +12,6 @@ menuconfig ARCH_TEGRA - select ARCH_HAS_RESET_CONTROLLER - select RESET_CONTROLLER - select SOC_BUS -- select USB_ULPI if USB_PHY -- select USB_ULPI_VIEWPORT if USB_PHY - help - This enables support for NVIDIA Tegra based systems. - -diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig -index 83af36d9439f..02c08671553e 100644 ---- a/arch/arm64/Kconfig -+++ b/arch/arm64/Kconfig -@@ -785,7 +785,7 @@ source "fs/Kconfig.binfmt" - config COMPAT - bool "Kernel support for 32-bit EL0" - depends on ARM64_4K_PAGES || EXPERT -- select COMPAT_BINFMT_ELF -+ select COMPAT_BINFMT_ELF if BINFMT_ELF - select HAVE_UID16 - select OLD_SIGSUSPEND3 - select COMPAT_OLD_SIGACTION -diff --git a/arch/arm64/Kconfig.platforms b/arch/arm64/Kconfig.platforms -index 4043c35962cc..5edb50772c11 100644 ---- a/arch/arm64/Kconfig.platforms -+++ b/arch/arm64/Kconfig.platforms -@@ -90,8 +90,6 @@ config ARCH_TEGRA_132_SOC - bool "NVIDIA Tegra132 SoC" - depends on ARCH_TEGRA - select PINCTRL_TEGRA124 -- select USB_ULPI if USB_PHY -- select USB_ULPI_VIEWPORT if USB_PHY - help - Enable support for NVIDIA Tegra132 SoC, based on the Denver - ARMv8 CPU. The Tegra132 SoC is similar to the Tegra124 SoC, -diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi -index 4dd5f93d0303..7f42b646d528 100644 ---- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi -+++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi -@@ -54,6 +54,7 @@ - reg = <0x000>; - enable-method = "psci"; - cpu-idle-states = <&CPU_SLEEP_0>; -+ #cooling-cells = <2>; - }; - - cpu1: cpu@1 { -@@ -70,6 +71,7 @@ - reg = <0x100>; - enable-method = "psci"; - cpu-idle-states = <&CPU_SLEEP_0>; -+ #cooling-cells = <2>; - }; - - cpu3: cpu@101 { -diff --git a/arch/arm64/include/asm/bug.h b/arch/arm64/include/asm/bug.h -index 4a748ce9ba1a..ac6382b25add 100644 ---- a/arch/arm64/include/asm/bug.h -+++ b/arch/arm64/include/asm/bug.h -@@ -20,9 +20,6 @@ - - #include - --#ifdef CONFIG_GENERIC_BUG --#define HAVE_ARCH_BUG -- - #ifdef CONFIG_DEBUG_BUGVERBOSE - #define _BUGVERBOSE_LOCATION(file, line) __BUGVERBOSE_LOCATION(file, line) - #define __BUGVERBOSE_LOCATION(file, line) \ -@@ -36,28 +33,36 @@ - #define _BUGVERBOSE_LOCATION(file, line) - #endif - --#define _BUG_FLAGS(flags) __BUG_FLAGS(flags) -+#ifdef CONFIG_GENERIC_BUG - --#define __BUG_FLAGS(flags) asm volatile ( \ -+#define __BUG_ENTRY(flags) \ - ".pushsection __bug_table,\"a\"\n\t" \ - ".align 2\n\t" \ - "0: .long 1f - 0b\n\t" \ - _BUGVERBOSE_LOCATION(__FILE__, __LINE__) \ - ".short " #flags "\n\t" \ - ".popsection\n" \ -- \ -- "1: brk %[imm]" \ -- :: [imm] "i" (BUG_BRK_IMM) \ --) -+ "1: " -+#else -+#define __BUG_ENTRY(flags) "" -+#endif -+ -+#define __BUG_FLAGS(flags) \ -+ asm volatile ( \ -+ __BUG_ENTRY(flags) \ -+ "brk %[imm]" :: [imm] "i" (BUG_BRK_IMM) \ -+ ); - --#define BUG() do { \ -- _BUG_FLAGS(0); \ -- unreachable(); \ -+ -+#define BUG() do { \ -+ __BUG_FLAGS(0); \ -+ unreachable(); \ - } while (0) - --#define __WARN_TAINT(taint) _BUG_FLAGS(BUGFLAG_TAINT(taint)) -+#define __WARN_TAINT(taint) \ -+ __BUG_FLAGS(BUGFLAG_TAINT(taint)) - --#endif /* ! CONFIG_GENERIC_BUG */ -+#define HAVE_ARCH_BUG - - #include - -diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c -index b2ab164a8094..4eba7c00ea1f 100644 ---- a/arch/powerpc/perf/core-book3s.c -+++ b/arch/powerpc/perf/core-book3s.c -@@ -1381,7 +1381,7 @@ static int collect_events(struct perf_event *group, int max_count, - int n = 0; - struct perf_event *event; - -- if (!is_software_event(group)) { -+ if (group->pmu->task_ctx_nr == perf_hw_context) { - if (n >= max_count) - return -1; - ctrs[n] = group; -@@ -1389,7 +1389,7 @@ static int collect_events(struct perf_event *group, int max_count, - events[n++] = group->hw.config; - } - list_for_each_entry(event, &group->sibling_list, group_entry) { -- if (!is_software_event(event) && -+ if (event->pmu->task_ctx_nr == perf_hw_context && - event->state != PERF_EVENT_STATE_OFF) { - if (n >= max_count) - return -1; -diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig -index 2db93042f2f3..bb6aab2fa7f5 100644 ---- a/arch/x86/Kconfig -+++ b/arch/x86/Kconfig -@@ -1009,7 +1009,7 @@ config X86_MCE_THRESHOLD - def_bool y - - config X86_MCE_INJECT -- depends on X86_MCE -+ depends on X86_MCE && X86_LOCAL_APIC - tristate "Machine check injector support" - ---help--- - Provide support for injecting machine checks for testing purposes. -diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug -index 137dfa96aa14..da00fe1f48f4 100644 ---- a/arch/x86/Kconfig.debug -+++ b/arch/x86/Kconfig.debug -@@ -391,6 +391,7 @@ config X86_DEBUG_FPU - - config PUNIT_ATOM_DEBUG - tristate "ATOM Punit debug driver" -+ depends on PCI - select DEBUG_FS - select IOSF_MBI - ---help--- -diff --git a/arch/x86/boot/Makefile b/arch/x86/boot/Makefile -index c0cc2a6be0bf..6da2cd0897f3 100644 ---- a/arch/x86/boot/Makefile -+++ b/arch/x86/boot/Makefile -@@ -64,12 +64,13 @@ GCOV_PROFILE := n - $(obj)/bzImage: asflags-y := $(SVGA_MODE) - - quiet_cmd_image = BUILD $@ -+silent_redirect_image = >/dev/null - cmd_image = $(obj)/tools/build $(obj)/setup.bin $(obj)/vmlinux.bin \ -- $(obj)/zoffset.h $@ -+ $(obj)/zoffset.h $@ $($(quiet)redirect_image) - - $(obj)/bzImage: $(obj)/setup.bin $(obj)/vmlinux.bin $(obj)/tools/build FORCE - $(call if_changed,image) -- @echo 'Kernel: $@ is ready' ' (#'`cat .version`')' -+ @$(kecho) 'Kernel: $@ is ready' ' (#'`cat .version`')' - - OBJCOPYFLAGS_vmlinux.bin := -O binary -R .note -R .comment -S - $(obj)/vmlinux.bin: $(obj)/compressed/vmlinux FORCE -diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S -index 1c3b7ceb36d2..e7273a606a07 100644 ---- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S -+++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S -@@ -55,29 +55,31 @@ - #define RAB1bl %bl - #define RAB2bl %cl - -+#define CD0 0x0(%rsp) -+#define CD1 0x8(%rsp) -+#define CD2 0x10(%rsp) -+ -+# used only before/after all rounds - #define RCD0 %r8 - #define RCD1 %r9 - #define RCD2 %r10 - --#define RCD0d %r8d --#define RCD1d %r9d --#define RCD2d %r10d -- --#define RX0 %rbp --#define RX1 %r11 --#define RX2 %r12 -+# used only during rounds -+#define RX0 %r8 -+#define RX1 %r9 -+#define RX2 %r10 - --#define RX0d %ebp --#define RX1d %r11d --#define RX2d %r12d -+#define RX0d %r8d -+#define RX1d %r9d -+#define RX2d %r10d - --#define RY0 %r13 --#define RY1 %r14 --#define RY2 %r15 -+#define RY0 %r11 -+#define RY1 %r12 -+#define RY2 %r13 - --#define RY0d %r13d --#define RY1d %r14d --#define RY2d %r15d -+#define RY0d %r11d -+#define RY1d %r12d -+#define RY2d %r13d - - #define RT0 %rdx - #define RT1 %rsi -@@ -85,6 +87,8 @@ - #define RT0d %edx - #define RT1d %esi - -+#define RT1bl %sil -+ - #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \ - movzbl ab ## bl, tmp2 ## d; \ - movzbl ab ## bh, tmp1 ## d; \ -@@ -92,6 +96,11 @@ - op1##l T0(CTX, tmp2, 4), dst ## d; \ - op2##l T1(CTX, tmp1, 4), dst ## d; - -+#define swap_ab_with_cd(ab, cd, tmp) \ -+ movq cd, tmp; \ -+ movq ab, cd; \ -+ movq tmp, ab; -+ - /* - * Combined G1 & G2 function. Reordered with help of rotates to have moves - * at begining. -@@ -110,15 +119,15 @@ - /* G1,2 && G2,2 */ \ - do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \ - do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \ -- xchgq cd ## 0, ab ## 0; \ -+ swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \ - \ - do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \ - do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \ -- xchgq cd ## 1, ab ## 1; \ -+ swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \ - \ - do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \ - do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \ -- xchgq cd ## 2, ab ## 2; -+ swap_ab_with_cd(ab ## 2, cd ## 2, RT0); - - #define enc_round_end(ab, x, y, n) \ - addl y ## d, x ## d; \ -@@ -168,6 +177,16 @@ - decrypt_round3(ba, dc, (n*2)+1); \ - decrypt_round3(ba, dc, (n*2)); - -+#define push_cd() \ -+ pushq RCD2; \ -+ pushq RCD1; \ -+ pushq RCD0; -+ -+#define pop_cd() \ -+ popq RCD0; \ -+ popq RCD1; \ -+ popq RCD2; -+ - #define inpack3(in, n, xy, m) \ - movq 4*(n)(in), xy ## 0; \ - xorq w+4*m(CTX), xy ## 0; \ -@@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way) - * %rdx: src, RIO - * %rcx: bool, if true: xor output - */ -- pushq %r15; -- pushq %r14; - pushq %r13; - pushq %r12; -- pushq %rbp; - pushq %rbx; - - pushq %rcx; /* bool xor */ -@@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way) - - inpack_enc3(); - -- encrypt_cycle3(RAB, RCD, 0); -- encrypt_cycle3(RAB, RCD, 1); -- encrypt_cycle3(RAB, RCD, 2); -- encrypt_cycle3(RAB, RCD, 3); -- encrypt_cycle3(RAB, RCD, 4); -- encrypt_cycle3(RAB, RCD, 5); -- encrypt_cycle3(RAB, RCD, 6); -- encrypt_cycle3(RAB, RCD, 7); -+ push_cd(); -+ encrypt_cycle3(RAB, CD, 0); -+ encrypt_cycle3(RAB, CD, 1); -+ encrypt_cycle3(RAB, CD, 2); -+ encrypt_cycle3(RAB, CD, 3); -+ encrypt_cycle3(RAB, CD, 4); -+ encrypt_cycle3(RAB, CD, 5); -+ encrypt_cycle3(RAB, CD, 6); -+ encrypt_cycle3(RAB, CD, 7); -+ pop_cd(); - - popq RIO; /* dst */ -- popq %rbp; /* bool xor */ -+ popq RT1; /* bool xor */ - -- testb %bpl, %bpl; -+ testb RT1bl, RT1bl; - jnz .L__enc_xor3; - - outunpack_enc3(mov); - - popq %rbx; -- popq %rbp; - popq %r12; - popq %r13; -- popq %r14; -- popq %r15; - ret; - - .L__enc_xor3: - outunpack_enc3(xor); - - popq %rbx; -- popq %rbp; - popq %r12; - popq %r13; -- popq %r14; -- popq %r15; - ret; - ENDPROC(__twofish_enc_blk_3way) - -@@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way) - * %rsi: dst - * %rdx: src, RIO - */ -- pushq %r15; -- pushq %r14; - pushq %r13; - pushq %r12; -- pushq %rbp; - pushq %rbx; - - pushq %rsi; /* dst */ - - inpack_dec3(); - -- decrypt_cycle3(RAB, RCD, 7); -- decrypt_cycle3(RAB, RCD, 6); -- decrypt_cycle3(RAB, RCD, 5); -- decrypt_cycle3(RAB, RCD, 4); -- decrypt_cycle3(RAB, RCD, 3); -- decrypt_cycle3(RAB, RCD, 2); -- decrypt_cycle3(RAB, RCD, 1); -- decrypt_cycle3(RAB, RCD, 0); -+ push_cd(); -+ decrypt_cycle3(RAB, CD, 7); -+ decrypt_cycle3(RAB, CD, 6); -+ decrypt_cycle3(RAB, CD, 5); -+ decrypt_cycle3(RAB, CD, 4); -+ decrypt_cycle3(RAB, CD, 3); -+ decrypt_cycle3(RAB, CD, 2); -+ decrypt_cycle3(RAB, CD, 1); -+ decrypt_cycle3(RAB, CD, 0); -+ pop_cd(); - - popq RIO; /* dst */ - - outunpack_dec3(); - - popq %rbx; -- popq %rbp; - popq %r12; - popq %r13; -- popq %r14; -- popq %r15; - ret; - ENDPROC(twofish_dec_blk_3way) -diff --git a/arch/x86/entry/common.c b/arch/x86/entry/common.c -index 1a4477cedc49..b5eb1cca70a0 100644 ---- a/arch/x86/entry/common.c -+++ b/arch/x86/entry/common.c -@@ -20,6 +20,7 @@ - #include - #include - #include -+#include - #include - - #include -@@ -381,6 +382,7 @@ __always_inline void do_syscall_32_irqs_on(struct pt_regs *regs) - } - - if (likely(nr < IA32_NR_syscalls)) { -+ nr = array_index_nospec(nr, IA32_NR_syscalls); - /* - * It's possible that a 32-bit syscall implementation - * takes a 64-bit parameter but nonetheless assumes that -diff --git a/arch/x86/include/asm/asm-prototypes.h b/arch/x86/include/asm/asm-prototypes.h -index b15aa4083dfd..5a25ada75aeb 100644 ---- a/arch/x86/include/asm/asm-prototypes.h -+++ b/arch/x86/include/asm/asm-prototypes.h -@@ -37,5 +37,4 @@ INDIRECT_THUNK(dx) - INDIRECT_THUNK(si) - INDIRECT_THUNK(di) - INDIRECT_THUNK(bp) --INDIRECT_THUNK(sp) - #endif /* CONFIG_RETPOLINE */ -diff --git a/arch/x86/include/asm/barrier.h b/arch/x86/include/asm/barrier.h -index 0681d2532527..814ef83c6720 100644 ---- a/arch/x86/include/asm/barrier.h -+++ b/arch/x86/include/asm/barrier.h -@@ -24,6 +24,34 @@ - #define wmb() asm volatile("sfence" ::: "memory") - #endif - -+/** -+ * array_index_mask_nospec() - generate a mask that is ~0UL when the -+ * bounds check succeeds and 0 otherwise -+ * @index: array element index -+ * @size: number of elements in array -+ * -+ * Returns: -+ * 0 - (index < size) -+ */ -+static inline unsigned long array_index_mask_nospec(unsigned long index, -+ unsigned long size) -+{ -+ unsigned long mask; -+ -+ asm ("cmp %1,%2; sbb %0,%0;" -+ :"=r" (mask) -+ :"r"(size),"r" (index) -+ :"cc"); -+ return mask; -+} -+ -+/* Override the default implementation from linux/nospec.h. */ -+#define array_index_mask_nospec array_index_mask_nospec -+ -+/* Prevent speculative execution past this barrier. */ -+#define barrier_nospec() alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, \ -+ "lfence", X86_FEATURE_LFENCE_RDTSC) -+ - #ifdef CONFIG_X86_PPRO_FENCE - #define dma_rmb() rmb() - #else -diff --git a/arch/x86/include/asm/microcode_amd.h b/arch/x86/include/asm/microcode_amd.h -index adfc847a395e..fb163f02ebb1 100644 ---- a/arch/x86/include/asm/microcode_amd.h -+++ b/arch/x86/include/asm/microcode_amd.h -@@ -59,7 +59,6 @@ static inline u16 find_equiv_id(struct equiv_cpu_entry *equiv_cpu_table, - - extern int __apply_microcode_amd(struct microcode_amd *mc_amd); - extern int apply_microcode_amd(int cpu); --extern enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size); - - #define PATCH_MAX_SIZE PAGE_SIZE - extern u8 amd_ucode_patch[PATCH_MAX_SIZE]; -diff --git a/arch/x86/include/asm/msr.h b/arch/x86/include/asm/msr.h -index 77d8b284e4a7..5a10ac8c131e 100644 ---- a/arch/x86/include/asm/msr.h -+++ b/arch/x86/include/asm/msr.h -@@ -147,8 +147,7 @@ static __always_inline unsigned long long rdtsc_ordered(void) - * that some other imaginary CPU is updating continuously with a - * time stamp. - */ -- alternative_2("", "mfence", X86_FEATURE_MFENCE_RDTSC, -- "lfence", X86_FEATURE_LFENCE_RDTSC); -+ barrier_nospec(); - return rdtsc(); - } - -diff --git a/arch/x86/include/asm/nospec-branch.h b/arch/x86/include/asm/nospec-branch.h -index 492370b9b35b..66094a0473a8 100644 ---- a/arch/x86/include/asm/nospec-branch.h -+++ b/arch/x86/include/asm/nospec-branch.h -@@ -1,7 +1,7 @@ - /* SPDX-License-Identifier: GPL-2.0 */ - --#ifndef __NOSPEC_BRANCH_H__ --#define __NOSPEC_BRANCH_H__ -+#ifndef _ASM_X86_NOSPEC_BRANCH_H_ -+#define _ASM_X86_NOSPEC_BRANCH_H_ - - #include - #include -@@ -178,7 +178,7 @@ extern char __indirect_thunk_end[]; - * On VMEXIT we must ensure that no RSB predictions learned in the guest - * can be followed in the host, by overwriting the RSB completely. Both - * retpoline and IBRS mitigations for Spectre v2 need this; only on future -- * CPUs with IBRS_ATT *might* it be avoided. -+ * CPUs with IBRS_ALL *might* it be avoided. - */ - static inline void vmexit_fill_RSB(void) - { -@@ -195,4 +195,4 @@ static inline void vmexit_fill_RSB(void) - } - - #endif /* __ASSEMBLY__ */ --#endif /* __NOSPEC_BRANCH_H__ */ -+#endif /* _ASM_X86_NOSPEC_BRANCH_H_ */ -diff --git a/arch/x86/include/asm/vmx.h b/arch/x86/include/asm/vmx.h -index 14c63c7e8337..6b6e16d813b9 100644 ---- a/arch/x86/include/asm/vmx.h -+++ b/arch/x86/include/asm/vmx.h -@@ -400,10 +400,11 @@ enum vmcs_field { - #define IDENTITY_PAGETABLE_PRIVATE_MEMSLOT (KVM_USER_MEM_SLOTS + 2) - - #define VMX_NR_VPIDS (1 << 16) -+#define VMX_VPID_EXTENT_INDIVIDUAL_ADDR 0 - #define VMX_VPID_EXTENT_SINGLE_CONTEXT 1 - #define VMX_VPID_EXTENT_ALL_CONTEXT 2 -+#define VMX_VPID_EXTENT_SINGLE_NON_GLOBAL 3 - --#define VMX_EPT_EXTENT_INDIVIDUAL_ADDR 0 - #define VMX_EPT_EXTENT_CONTEXT 1 - #define VMX_EPT_EXTENT_GLOBAL 2 - #define VMX_EPT_EXTENT_SHIFT 24 -@@ -420,8 +421,10 @@ enum vmcs_field { - #define VMX_EPT_EXTENT_GLOBAL_BIT (1ull << 26) - - #define VMX_VPID_INVVPID_BIT (1ull << 0) /* (32 - 32) */ -+#define VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT (1ull << 8) /* (40 - 32) */ - #define VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT (1ull << 9) /* (41 - 32) */ - #define VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT (1ull << 10) /* (42 - 32) */ -+#define VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT (1ull << 11) /* (43 - 32) */ - - #define VMX_EPT_DEFAULT_GAW 3 - #define VMX_EPT_MAX_GAW 0x4 -diff --git a/arch/x86/kernel/alternative.c b/arch/x86/kernel/alternative.c -index d6f375f1b928..89829c3d5a74 100644 ---- a/arch/x86/kernel/alternative.c -+++ b/arch/x86/kernel/alternative.c -@@ -45,17 +45,6 @@ static int __init setup_noreplace_smp(char *str) - } - __setup("noreplace-smp", setup_noreplace_smp); - --#ifdef CONFIG_PARAVIRT --static int __initdata_or_module noreplace_paravirt = 0; -- --static int __init setup_noreplace_paravirt(char *str) --{ -- noreplace_paravirt = 1; -- return 1; --} --__setup("noreplace-paravirt", setup_noreplace_paravirt); --#endif -- - #define DPRINTK(fmt, args...) \ - do { \ - if (debug_alternative) \ -@@ -587,9 +576,6 @@ void __init_or_module apply_paravirt(struct paravirt_patch_site *start, - struct paravirt_patch_site *p; - char insnbuf[MAX_PATCH_LEN]; - -- if (noreplace_paravirt) -- return; -- - for (p = start; p < end; p++) { - unsigned int used; - -diff --git a/arch/x86/kernel/cpu/bugs.c b/arch/x86/kernel/cpu/bugs.c -index 8cacf62ec458..ecaf7c9baf75 100644 ---- a/arch/x86/kernel/cpu/bugs.c -+++ b/arch/x86/kernel/cpu/bugs.c -@@ -10,6 +10,7 @@ - #include - #include - #include -+#include - - #include - #include -@@ -89,20 +90,42 @@ static const char *spectre_v2_strings[] = { - }; - - #undef pr_fmt --#define pr_fmt(fmt) "Spectre V2 mitigation: " fmt -+#define pr_fmt(fmt) "Spectre V2 : " fmt - - static enum spectre_v2_mitigation spectre_v2_enabled = SPECTRE_V2_NONE; - -+ -+#ifdef RETPOLINE -+static bool spectre_v2_bad_module; -+ -+bool retpoline_module_ok(bool has_retpoline) -+{ -+ if (spectre_v2_enabled == SPECTRE_V2_NONE || has_retpoline) -+ return true; -+ -+ pr_err("System may be vulnerable to spectre v2\n"); -+ spectre_v2_bad_module = true; -+ return false; -+} -+ -+static inline const char *spectre_v2_module_string(void) -+{ -+ return spectre_v2_bad_module ? " - vulnerable module loaded" : ""; -+} -+#else -+static inline const char *spectre_v2_module_string(void) { return ""; } -+#endif -+ - static void __init spec2_print_if_insecure(const char *reason) - { - if (boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) -- pr_info("%s\n", reason); -+ pr_info("%s selected on command line.\n", reason); - } - - static void __init spec2_print_if_secure(const char *reason) - { - if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) -- pr_info("%s\n", reason); -+ pr_info("%s selected on command line.\n", reason); - } - - static inline bool retp_compiler(void) -@@ -117,42 +140,68 @@ static inline bool match_option(const char *arg, int arglen, const char *opt) - return len == arglen && !strncmp(arg, opt, len); - } - -+static const struct { -+ const char *option; -+ enum spectre_v2_mitigation_cmd cmd; -+ bool secure; -+} mitigation_options[] = { -+ { "off", SPECTRE_V2_CMD_NONE, false }, -+ { "on", SPECTRE_V2_CMD_FORCE, true }, -+ { "retpoline", SPECTRE_V2_CMD_RETPOLINE, false }, -+ { "retpoline,amd", SPECTRE_V2_CMD_RETPOLINE_AMD, false }, -+ { "retpoline,generic", SPECTRE_V2_CMD_RETPOLINE_GENERIC, false }, -+ { "auto", SPECTRE_V2_CMD_AUTO, false }, -+}; -+ - static enum spectre_v2_mitigation_cmd __init spectre_v2_parse_cmdline(void) - { - char arg[20]; -- int ret; -- -- ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, -- sizeof(arg)); -- if (ret > 0) { -- if (match_option(arg, ret, "off")) { -- goto disable; -- } else if (match_option(arg, ret, "on")) { -- spec2_print_if_secure("force enabled on command line."); -- return SPECTRE_V2_CMD_FORCE; -- } else if (match_option(arg, ret, "retpoline")) { -- spec2_print_if_insecure("retpoline selected on command line."); -- return SPECTRE_V2_CMD_RETPOLINE; -- } else if (match_option(arg, ret, "retpoline,amd")) { -- if (boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { -- pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); -- return SPECTRE_V2_CMD_AUTO; -- } -- spec2_print_if_insecure("AMD retpoline selected on command line."); -- return SPECTRE_V2_CMD_RETPOLINE_AMD; -- } else if (match_option(arg, ret, "retpoline,generic")) { -- spec2_print_if_insecure("generic retpoline selected on command line."); -- return SPECTRE_V2_CMD_RETPOLINE_GENERIC; -- } else if (match_option(arg, ret, "auto")) { -+ int ret, i; -+ enum spectre_v2_mitigation_cmd cmd = SPECTRE_V2_CMD_AUTO; -+ -+ if (cmdline_find_option_bool(boot_command_line, "nospectre_v2")) -+ return SPECTRE_V2_CMD_NONE; -+ else { -+ ret = cmdline_find_option(boot_command_line, "spectre_v2", arg, -+ sizeof(arg)); -+ if (ret < 0) -+ return SPECTRE_V2_CMD_AUTO; -+ -+ for (i = 0; i < ARRAY_SIZE(mitigation_options); i++) { -+ if (!match_option(arg, ret, mitigation_options[i].option)) -+ continue; -+ cmd = mitigation_options[i].cmd; -+ break; -+ } -+ -+ if (i >= ARRAY_SIZE(mitigation_options)) { -+ pr_err("unknown option (%s). Switching to AUTO select\n", -+ mitigation_options[i].option); - return SPECTRE_V2_CMD_AUTO; - } - } - -- if (!cmdline_find_option_bool(boot_command_line, "nospectre_v2")) -+ if ((cmd == SPECTRE_V2_CMD_RETPOLINE || -+ cmd == SPECTRE_V2_CMD_RETPOLINE_AMD || -+ cmd == SPECTRE_V2_CMD_RETPOLINE_GENERIC) && -+ !IS_ENABLED(CONFIG_RETPOLINE)) { -+ pr_err("%s selected but not compiled in. Switching to AUTO select\n", -+ mitigation_options[i].option); - return SPECTRE_V2_CMD_AUTO; --disable: -- spec2_print_if_insecure("disabled on command line."); -- return SPECTRE_V2_CMD_NONE; -+ } -+ -+ if (cmd == SPECTRE_V2_CMD_RETPOLINE_AMD && -+ boot_cpu_data.x86_vendor != X86_VENDOR_AMD) { -+ pr_err("retpoline,amd selected but CPU is not AMD. Switching to AUTO select\n"); -+ return SPECTRE_V2_CMD_AUTO; -+ } -+ -+ if (mitigation_options[i].secure) -+ spec2_print_if_secure(mitigation_options[i].option); -+ else -+ spec2_print_if_insecure(mitigation_options[i].option); -+ -+ return cmd; - } - - /* Check for Skylake-like CPUs (for RSB handling) */ -@@ -190,10 +239,10 @@ static void __init spectre_v2_select_mitigation(void) - return; - - case SPECTRE_V2_CMD_FORCE: -- /* FALLTRHU */ - case SPECTRE_V2_CMD_AUTO: -- goto retpoline_auto; -- -+ if (IS_ENABLED(CONFIG_RETPOLINE)) -+ goto retpoline_auto; -+ break; - case SPECTRE_V2_CMD_RETPOLINE_AMD: - if (IS_ENABLED(CONFIG_RETPOLINE)) - goto retpoline_amd; -@@ -268,7 +317,7 @@ ssize_t cpu_show_spectre_v1(struct device *dev, - { - if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V1)) - return sprintf(buf, "Not affected\n"); -- return sprintf(buf, "Vulnerable\n"); -+ return sprintf(buf, "Mitigation: __user pointer sanitization\n"); - } - - ssize_t cpu_show_spectre_v2(struct device *dev, -@@ -277,6 +326,7 @@ ssize_t cpu_show_spectre_v2(struct device *dev, - if (!boot_cpu_has_bug(X86_BUG_SPECTRE_V2)) - return sprintf(buf, "Not affected\n"); - -- return sprintf(buf, "%s\n", spectre_v2_strings[spectre_v2_enabled]); -+ return sprintf(buf, "%s%s\n", spectre_v2_strings[spectre_v2_enabled], -+ spectre_v2_module_string()); - } - #endif -diff --git a/arch/x86/kernel/cpu/mcheck/mce-inject.c b/arch/x86/kernel/cpu/mcheck/mce-inject.c -index 4cfba4371a71..101bfae369e1 100644 ---- a/arch/x86/kernel/cpu/mcheck/mce-inject.c -+++ b/arch/x86/kernel/cpu/mcheck/mce-inject.c -@@ -152,7 +152,6 @@ static void raise_mce(struct mce *m) - if (context == MCJ_CTX_RANDOM) - return; - --#ifdef CONFIG_X86_LOCAL_APIC - if (m->inject_flags & (MCJ_IRQ_BROADCAST | MCJ_NMI_BROADCAST)) { - unsigned long start; - int cpu; -@@ -193,9 +192,7 @@ static void raise_mce(struct mce *m) - raise_local(); - put_cpu(); - put_online_cpus(); -- } else --#endif -- { -+ } else { - preempt_disable(); - raise_local(); - preempt_enable(); -diff --git a/arch/x86/kernel/cpu/microcode/amd.c b/arch/x86/kernel/cpu/microcode/amd.c -index 2a0f44d225fe..6da6f9cd6d2d 100644 ---- a/arch/x86/kernel/cpu/microcode/amd.c -+++ b/arch/x86/kernel/cpu/microcode/amd.c -@@ -131,6 +131,9 @@ static size_t compute_container_size(u8 *data, u32 total_size) - return size; - } - -+static enum ucode_state -+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size); -+ - /* - * Early load occurs before we can vmalloc(). So we look for the microcode - * patch container file in initrd, traverse equivalent cpu table, look for a -@@ -438,7 +441,7 @@ int __init save_microcode_in_initrd_amd(void) - eax = cpuid_eax(0x00000001); - eax = ((eax >> 8) & 0xf) + ((eax >> 20) & 0xff); - -- ret = load_microcode_amd(smp_processor_id(), eax, container, container_size); -+ ret = load_microcode_amd(true, eax, container, container_size); - if (ret != UCODE_OK) - retval = -EINVAL; - -@@ -854,7 +857,8 @@ static enum ucode_state __load_microcode_amd(u8 family, const u8 *data, - return UCODE_OK; - } - --enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t size) -+static enum ucode_state -+load_microcode_amd(bool save, u8 family, const u8 *data, size_t size) - { - enum ucode_state ret; - -@@ -868,8 +872,8 @@ enum ucode_state load_microcode_amd(int cpu, u8 family, const u8 *data, size_t s - - #ifdef CONFIG_X86_32 - /* save BSP's matching patch for early load */ -- if (cpu_data(cpu).cpu_index == boot_cpu_data.cpu_index) { -- struct ucode_patch *p = find_patch(cpu); -+ if (save) { -+ struct ucode_patch *p = find_patch(0); - if (p) { - memset(amd_ucode_patch, 0, PATCH_MAX_SIZE); - memcpy(amd_ucode_patch, p->data, min_t(u32, ksize(p->data), -@@ -901,11 +905,12 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device, - { - char fw_name[36] = "amd-ucode/microcode_amd.bin"; - struct cpuinfo_x86 *c = &cpu_data(cpu); -+ bool bsp = c->cpu_index == boot_cpu_data.cpu_index; - enum ucode_state ret = UCODE_NFOUND; - const struct firmware *fw; - - /* reload ucode container only on the boot cpu */ -- if (!refresh_fw || c->cpu_index != boot_cpu_data.cpu_index) -+ if (!refresh_fw || !bsp) - return UCODE_OK; - - if (c->x86 >= 0x15) -@@ -922,7 +927,7 @@ static enum ucode_state request_microcode_amd(int cpu, struct device *device, - goto fw_release; - } - -- ret = load_microcode_amd(cpu, c->x86, fw->data, fw->size); -+ ret = load_microcode_amd(bsp, c->x86, fw->data, fw->size); - - fw_release: - release_firmware(fw); -diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c -index 5b2f2306fbcc..b52a8d08ab36 100644 ---- a/arch/x86/kernel/cpu/perf_event.c -+++ b/arch/x86/kernel/cpu/perf_event.c -@@ -188,8 +188,8 @@ static void release_pmc_hardware(void) {} - - static bool check_hw_exists(void) - { -- u64 val, val_fail, val_new= ~0; -- int i, reg, reg_fail, ret = 0; -+ u64 val, val_fail = -1, val_new= ~0; -+ int i, reg, reg_fail = -1, ret = 0; - int bios_fail = 0; - int reg_safe = -1; - -diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S -index 8f1a3f443f7d..70284d38fdc2 100644 ---- a/arch/x86/kernel/head_32.S -+++ b/arch/x86/kernel/head_32.S -@@ -669,14 +669,17 @@ __PAGE_ALIGNED_BSS - initial_pg_pmd: - .fill 1024*KPMDS,4,0 - #else --ENTRY(initial_page_table) -+.globl initial_page_table -+initial_page_table: - .fill 1024,4,0 - #endif - initial_pg_fixmap: - .fill 1024,4,0 --ENTRY(empty_zero_page) -+.globl empty_zero_page -+empty_zero_page: - .fill 4096,1,0 --ENTRY(swapper_pg_dir) -+.globl swapper_pg_dir -+swapper_pg_dir: - .fill 1024,4,0 - - /* -diff --git a/arch/x86/kvm/Kconfig b/arch/x86/kvm/Kconfig -index 639a6e34500c..53b7f53f6207 100644 ---- a/arch/x86/kvm/Kconfig -+++ b/arch/x86/kvm/Kconfig -@@ -22,7 +22,8 @@ config KVM - depends on HAVE_KVM - depends on HIGH_RES_TIMERS - # for TASKSTATS/TASK_DELAY_ACCT: -- depends on NET -+ depends on NET && MULTIUSER -+ depends on X86_LOCAL_APIC - select PREEMPT_NOTIFIERS - select MMU_NOTIFIER - select ANON_INODES -diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c -index e4eb1d2bf849..8864fec63a20 100644 ---- a/arch/x86/kvm/emulate.c -+++ b/arch/x86/kvm/emulate.c -@@ -26,6 +26,7 @@ - #include - #include - #include -+#include - - #include "x86.h" - #include "tss.h" -@@ -1000,8 +1001,8 @@ static u8 test_cc(unsigned int condition, unsigned long flags) - void (*fop)(void) = (void *)em_setcc + 4 * (condition & 0xf); - - flags = (flags & EFLAGS_MASK) | X86_EFLAGS_IF; -- asm("push %[flags]; popf; call *%[fastop]" -- : "=a"(rc) : [fastop]"r"(fop), [flags]"r"(flags)); -+ asm("push %[flags]; popf; " CALL_NOSPEC -+ : "=a"(rc) : [thunk_target]"r"(fop), [flags]"r"(flags)); - return rc; - } - -@@ -5297,9 +5298,9 @@ static int fastop(struct x86_emulate_ctxt *ctxt, void (*fop)(struct fastop *)) - ulong flags = (ctxt->eflags & EFLAGS_MASK) | X86_EFLAGS_IF; - if (!(ctxt->d & ByteOp)) - fop += __ffs(ctxt->dst.bytes) * FASTOP_SIZE; -- asm("push %[flags]; popf; call *%[fastop]; pushf; pop %[flags]\n" -+ asm("push %[flags]; popf; " CALL_NOSPEC "; pushf; pop %[flags]\n" - : "+a"(ctxt->dst.val), "+d"(ctxt->src.val), [flags]"+D"(flags), -- [fastop]"+S"(fop) -+ [thunk_target]"+S"(fop) - : "c"(ctxt->src2.val)); - ctxt->eflags = (ctxt->eflags & ~EFLAGS_MASK) | (flags & EFLAGS_MASK); - if (!fop) /* exception is returned in fop variable */ -diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c -index 2a1a8737015b..849517805eef 100644 ---- a/arch/x86/kvm/vmx.c -+++ b/arch/x86/kvm/vmx.c -@@ -32,6 +32,7 @@ - #include - #include - #include -+#include - #include "kvm_cache_regs.h" - #include "x86.h" - -@@ -125,6 +126,12 @@ module_param_named(pml, enable_pml, bool, S_IRUGO); - - #define VMX_MISC_EMULATED_PREEMPTION_TIMER_RATE 5 - -+#define VMX_VPID_EXTENT_SUPPORTED_MASK \ -+ (VMX_VPID_EXTENT_INDIVIDUAL_ADDR_BIT | \ -+ VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | \ -+ VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT | \ -+ VMX_VPID_EXTENT_SINGLE_NON_GLOBAL_BIT) -+ - /* - * These 2 parameters are used to config the controls for Pause-Loop Exiting: - * ple_gap: upper bound on the amount of time between two successive -@@ -827,21 +834,18 @@ static const unsigned short vmcs_field_to_offset_table[] = { - - static inline short vmcs_field_to_offset(unsigned long field) - { -- BUILD_BUG_ON(ARRAY_SIZE(vmcs_field_to_offset_table) > SHRT_MAX); -+ const size_t size = ARRAY_SIZE(vmcs_field_to_offset_table); -+ unsigned short offset; - -- if (field >= ARRAY_SIZE(vmcs_field_to_offset_table)) -+ BUILD_BUG_ON(size > SHRT_MAX); -+ if (field >= size) - return -ENOENT; - -- /* -- * FIXME: Mitigation for CVE-2017-5753. To be replaced with a -- * generic mechanism. -- */ -- asm("lfence"); -- -- if (vmcs_field_to_offset_table[field] == 0) -+ field = array_index_nospec(field, size); -+ offset = vmcs_field_to_offset_table[field]; -+ if (offset == 0) - return -ENOENT; -- -- return vmcs_field_to_offset_table[field]; -+ return offset; - } - - static inline struct vmcs12 *get_vmcs12(struct kvm_vcpu *vcpu) -@@ -2659,8 +2663,7 @@ static void nested_vmx_setup_ctls_msrs(struct vcpu_vmx *vmx) - */ - if (enable_vpid) - vmx->nested.nested_vmx_vpid_caps = VMX_VPID_INVVPID_BIT | -- VMX_VPID_EXTENT_SINGLE_CONTEXT_BIT | -- VMX_VPID_EXTENT_GLOBAL_CONTEXT_BIT; -+ VMX_VPID_EXTENT_SUPPORTED_MASK; - else - vmx->nested.nested_vmx_vpid_caps = 0; - -@@ -4514,7 +4517,7 @@ static int vmx_cpu_uses_apicv(struct kvm_vcpu *vcpu) - return enable_apicv && lapic_in_kernel(vcpu); - } - --static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) -+static void vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - { - struct vcpu_vmx *vmx = to_vmx(vcpu); - int max_irr; -@@ -4525,19 +4528,15 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - vmx->nested.pi_pending) { - vmx->nested.pi_pending = false; - if (!pi_test_and_clear_on(vmx->nested.pi_desc)) -- return 0; -+ return; - - max_irr = find_last_bit( - (unsigned long *)vmx->nested.pi_desc->pir, 256); - - if (max_irr == 256) -- return 0; -+ return; - - vapic_page = kmap(vmx->nested.virtual_apic_page); -- if (!vapic_page) { -- WARN_ON(1); -- return -ENOMEM; -- } - __kvm_apic_update_irr(vmx->nested.pi_desc->pir, vapic_page); - kunmap(vmx->nested.virtual_apic_page); - -@@ -4548,7 +4547,6 @@ static int vmx_complete_nested_posted_interrupt(struct kvm_vcpu *vcpu) - vmcs_write16(GUEST_INTR_STATUS, status); - } - } -- return 0; - } - - static inline bool kvm_vcpu_trigger_posted_interrupt(struct kvm_vcpu *vcpu) -@@ -7368,7 +7366,7 @@ static int handle_invept(struct kvm_vcpu *vcpu) - - types = (vmx->nested.nested_vmx_ept_caps >> VMX_EPT_EXTENT_SHIFT) & 6; - -- if (!(types & (1UL << type))) { -+ if (type >= 32 || !(types & (1 << type))) { - nested_vmx_failValid(vcpu, - VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); - skip_emulated_instruction(vcpu); -@@ -7425,9 +7423,10 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) - vmx_instruction_info = vmcs_read32(VMX_INSTRUCTION_INFO); - type = kvm_register_readl(vcpu, (vmx_instruction_info >> 28) & 0xf); - -- types = (vmx->nested.nested_vmx_vpid_caps >> 8) & 0x7; -+ types = (vmx->nested.nested_vmx_vpid_caps & -+ VMX_VPID_EXTENT_SUPPORTED_MASK) >> 8; - -- if (!(types & (1UL << type))) { -+ if (type >= 32 || !(types & (1 << type))) { - nested_vmx_failValid(vcpu, - VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); - skip_emulated_instruction(vcpu); -@@ -7447,21 +7446,27 @@ static int handle_invvpid(struct kvm_vcpu *vcpu) - } - - switch (type) { -+ case VMX_VPID_EXTENT_INDIVIDUAL_ADDR: - case VMX_VPID_EXTENT_SINGLE_CONTEXT: -- /* -- * Old versions of KVM use the single-context version so we -- * have to support it; just treat it the same as all-context. -- */ -+ case VMX_VPID_EXTENT_SINGLE_NON_GLOBAL: -+ if (!vpid) { -+ nested_vmx_failValid(vcpu, -+ VMXERR_INVALID_OPERAND_TO_INVEPT_INVVPID); -+ skip_emulated_instruction(vcpu); -+ return 1; -+ } -+ break; - case VMX_VPID_EXTENT_ALL_CONTEXT: -- __vmx_flush_tlb(vcpu, to_vmx(vcpu)->nested.vpid02); -- nested_vmx_succeed(vcpu); - break; - default: -- /* Trap individual address invalidation invvpid calls */ -- BUG_ON(1); -- break; -+ WARN_ON_ONCE(1); -+ skip_emulated_instruction(vcpu); -+ return 1; - } - -+ __vmx_flush_tlb(vcpu, vmx->nested.vpid02); -+ nested_vmx_succeed(vcpu); -+ - skip_emulated_instruction(vcpu); - return 1; - } -@@ -8377,13 +8382,13 @@ static void vmx_handle_external_intr(struct kvm_vcpu *vcpu) - "pushf\n\t" - "orl $0x200, (%%" _ASM_SP ")\n\t" - __ASM_SIZE(push) " $%c[cs]\n\t" -- "call *%[entry]\n\t" -+ CALL_NOSPEC - : - #ifdef CONFIG_X86_64 - [sp]"=&r"(tmp) - #endif - : -- [entry]"r"(entry), -+ THUNK_TARGET(entry), - [ss]"i"(__KERNEL_DS), - [cs]"i"(__KERNEL_CS) - ); -@@ -9240,11 +9245,6 @@ static inline bool nested_vmx_merge_msr_bitmap(struct kvm_vcpu *vcpu, - return false; - } - msr_bitmap = (unsigned long *)kmap(page); -- if (!msr_bitmap) { -- nested_release_page_clean(page); -- WARN_ON(1); -- return false; -- } - - if (nested_cpu_has_virt_x2apic_mode(vmcs12)) { - if (nested_cpu_has_apic_reg_virt(vmcs12)) -@@ -10166,7 +10166,8 @@ static int vmx_check_nested_events(struct kvm_vcpu *vcpu, bool external_intr) - return 0; - } - -- return vmx_complete_nested_posted_interrupt(vcpu); -+ vmx_complete_nested_posted_interrupt(vcpu); -+ return 0; - } - - static u32 vmx_get_preemption_timer_value(struct kvm_vcpu *vcpu) -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 3900d34980de..f37f0c72b22a 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -2755,6 +2755,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu) - kvm_x86_ops->vcpu_put(vcpu); - kvm_put_guest_fpu(vcpu); - vcpu->arch.last_host_tsc = rdtsc(); -+ /* -+ * If userspace has set any breakpoints or watchpoints, dr6 is restored -+ * on every vmexit, but if not, we might have a stale dr6 from the -+ * guest. do_debug expects dr6 to be cleared after it runs, do the same. -+ */ -+ set_debugreg(0, 6); - } - - static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu, -@@ -8204,6 +8210,13 @@ static int apf_put_user(struct kvm_vcpu *vcpu, u32 val) - sizeof(val)); - } - -+static int apf_get_user(struct kvm_vcpu *vcpu, u32 *val) -+{ -+ -+ return kvm_read_guest_cached(vcpu->kvm, &vcpu->arch.apf.data, val, -+ sizeof(u32)); -+} -+ - void kvm_arch_async_page_not_present(struct kvm_vcpu *vcpu, - struct kvm_async_pf *work) - { -@@ -8230,6 +8243,7 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu, - struct kvm_async_pf *work) - { - struct x86_exception fault; -+ u32 val; - - if (work->wakeup_all) - work->arch.token = ~0; /* broadcast wakeup */ -@@ -8237,14 +8251,24 @@ void kvm_arch_async_page_present(struct kvm_vcpu *vcpu, - kvm_del_async_pf_gfn(vcpu, work->arch.gfn); - trace_kvm_async_pf_ready(work->arch.token, work->gva); - -- if ((vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED) && -- !apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) { -- fault.vector = PF_VECTOR; -- fault.error_code_valid = true; -- fault.error_code = 0; -- fault.nested_page_fault = false; -- fault.address = work->arch.token; -- kvm_inject_page_fault(vcpu, &fault); -+ if (vcpu->arch.apf.msr_val & KVM_ASYNC_PF_ENABLED && -+ !apf_get_user(vcpu, &val)) { -+ if (val == KVM_PV_REASON_PAGE_NOT_PRESENT && -+ vcpu->arch.exception.pending && -+ vcpu->arch.exception.nr == PF_VECTOR && -+ !apf_put_user(vcpu, 0)) { -+ vcpu->arch.exception.pending = false; -+ vcpu->arch.exception.nr = 0; -+ vcpu->arch.exception.has_error_code = false; -+ vcpu->arch.exception.error_code = 0; -+ } else if (!apf_put_user(vcpu, KVM_PV_REASON_PAGE_READY)) { -+ fault.vector = PF_VECTOR; -+ fault.error_code_valid = true; -+ fault.error_code = 0; -+ fault.nested_page_fault = false; -+ fault.address = work->arch.token; -+ kvm_inject_page_fault(vcpu, &fault); -+ } - } - vcpu->arch.apf.halted = false; - vcpu->arch.mp_state = KVM_MP_STATE_RUNNABLE; -diff --git a/arch/x86/lib/getuser.S b/arch/x86/lib/getuser.S -index 46668cda4ffd..490b2ee4e4bb 100644 ---- a/arch/x86/lib/getuser.S -+++ b/arch/x86/lib/getuser.S -@@ -38,6 +38,8 @@ ENTRY(__get_user_1) - GET_THREAD_INFO(%_ASM_DX) - cmp TI_addr_limit(%_ASM_DX),%_ASM_AX - jae bad_get_user -+ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ -+ and %_ASM_DX, %_ASM_AX - ASM_STAC - 1: movzbl (%_ASM_AX),%edx - xor %eax,%eax -@@ -51,6 +53,8 @@ ENTRY(__get_user_2) - GET_THREAD_INFO(%_ASM_DX) - cmp TI_addr_limit(%_ASM_DX),%_ASM_AX - jae bad_get_user -+ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ -+ and %_ASM_DX, %_ASM_AX - ASM_STAC - 2: movzwl -1(%_ASM_AX),%edx - xor %eax,%eax -@@ -64,6 +68,8 @@ ENTRY(__get_user_4) - GET_THREAD_INFO(%_ASM_DX) - cmp TI_addr_limit(%_ASM_DX),%_ASM_AX - jae bad_get_user -+ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ -+ and %_ASM_DX, %_ASM_AX - ASM_STAC - 3: movl -3(%_ASM_AX),%edx - xor %eax,%eax -@@ -78,6 +84,8 @@ ENTRY(__get_user_8) - GET_THREAD_INFO(%_ASM_DX) - cmp TI_addr_limit(%_ASM_DX),%_ASM_AX - jae bad_get_user -+ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ -+ and %_ASM_DX, %_ASM_AX - ASM_STAC - 4: movq -7(%_ASM_AX),%rdx - xor %eax,%eax -@@ -89,6 +97,8 @@ ENTRY(__get_user_8) - GET_THREAD_INFO(%_ASM_DX) - cmp TI_addr_limit(%_ASM_DX),%_ASM_AX - jae bad_get_user_8 -+ sbb %_ASM_DX, %_ASM_DX /* array_index_mask_nospec() */ -+ and %_ASM_DX, %_ASM_AX - ASM_STAC - 4: movl -7(%_ASM_AX),%edx - 5: movl -3(%_ASM_AX),%ecx -diff --git a/arch/x86/lib/retpoline.S b/arch/x86/lib/retpoline.S -index e611a124c442..3d06b482ebc7 100644 ---- a/arch/x86/lib/retpoline.S -+++ b/arch/x86/lib/retpoline.S -@@ -36,7 +36,6 @@ GENERATE_THUNK(_ASM_DX) - GENERATE_THUNK(_ASM_SI) - GENERATE_THUNK(_ASM_DI) - GENERATE_THUNK(_ASM_BP) --GENERATE_THUNK(_ASM_SP) - #ifdef CONFIG_64BIT - GENERATE_THUNK(r8) - GENERATE_THUNK(r9) -diff --git a/arch/x86/math-emu/Makefile b/arch/x86/math-emu/Makefile -index 9b0c63b60302..1b2dac174321 100644 ---- a/arch/x86/math-emu/Makefile -+++ b/arch/x86/math-emu/Makefile -@@ -5,8 +5,8 @@ - #DEBUG = -DDEBUGGING - DEBUG = - PARANOID = -DPARANOID --EXTRA_CFLAGS := $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION) --EXTRA_AFLAGS := $(PARANOID) -+ccflags-y += $(PARANOID) $(DEBUG) -fno-builtin $(MATH_EMULATION) -+asflags-y += $(PARANOID) - - # From 'C' language sources: - C_OBJS =fpu_entry.o errors.o \ -diff --git a/arch/x86/math-emu/reg_compare.c b/arch/x86/math-emu/reg_compare.c -index b77360fdbf4a..19b33b50adfa 100644 ---- a/arch/x86/math-emu/reg_compare.c -+++ b/arch/x86/math-emu/reg_compare.c -@@ -168,7 +168,7 @@ static int compare(FPU_REG const *b, int tagb) - /* This function requires that st(0) is not empty */ - int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) - { -- int f = 0, c; -+ int f, c; - - c = compare(loaded_data, loaded_tag); - -@@ -189,12 +189,12 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) - case COMP_No_Comp: - f = SW_C3 | SW_C2 | SW_C0; - break; --#ifdef PARANOID - default: -+#ifdef PARANOID - EXCEPTION(EX_INTERNAL | 0x121); -+#endif /* PARANOID */ - f = SW_C3 | SW_C2 | SW_C0; - break; --#endif /* PARANOID */ - } - setcc(f); - if (c & COMP_Denormal) { -@@ -205,7 +205,7 @@ int FPU_compare_st_data(FPU_REG const *loaded_data, u_char loaded_tag) - - static int compare_st_st(int nr) - { -- int f = 0, c; -+ int f, c; - FPU_REG *st_ptr; - - if (!NOT_EMPTY(0) || !NOT_EMPTY(nr)) { -@@ -235,12 +235,12 @@ static int compare_st_st(int nr) - case COMP_No_Comp: - f = SW_C3 | SW_C2 | SW_C0; - break; --#ifdef PARANOID - default: -+#ifdef PARANOID - EXCEPTION(EX_INTERNAL | 0x122); -+#endif /* PARANOID */ - f = SW_C3 | SW_C2 | SW_C0; - break; --#endif /* PARANOID */ - } - setcc(f); - if (c & COMP_Denormal) { -@@ -283,12 +283,12 @@ static int compare_i_st_st(int nr) - case COMP_No_Comp: - f = X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF; - break; --#ifdef PARANOID - default: -+#ifdef PARANOID - EXCEPTION(EX_INTERNAL | 0x122); -+#endif /* PARANOID */ - f = 0; - break; --#endif /* PARANOID */ - } - FPU_EFLAGS = (FPU_EFLAGS & ~(X86_EFLAGS_ZF | X86_EFLAGS_PF | X86_EFLAGS_CF)) | f; - if (c & COMP_Denormal) { -diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c -index b9c78f3bcd67..53ab3f367472 100644 ---- a/arch/x86/mm/ioremap.c -+++ b/arch/x86/mm/ioremap.c -@@ -348,11 +348,11 @@ void iounmap(volatile void __iomem *addr) - (void __force *)addr < phys_to_virt(ISA_END_ADDRESS)) - return; - -+ mmiotrace_iounmap(addr); -+ - addr = (volatile void __iomem *) - (PAGE_MASK & (unsigned long __force)addr); - -- mmiotrace_iounmap(addr); -- - /* Use the vm area unlocked, assuming the caller - ensures there isn't another iounmap for the same address - in parallel. Reuse of the virtual address is prevented by -diff --git a/arch/x86/mm/kmmio.c b/arch/x86/mm/kmmio.c -index ddb2244b06a1..76604c8a2a48 100644 ---- a/arch/x86/mm/kmmio.c -+++ b/arch/x86/mm/kmmio.c -@@ -434,17 +434,18 @@ int register_kmmio_probe(struct kmmio_probe *p) - unsigned long flags; - int ret = 0; - unsigned long size = 0; -+ unsigned long addr = p->addr & PAGE_MASK; - const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); - unsigned int l; - pte_t *pte; - - spin_lock_irqsave(&kmmio_lock, flags); -- if (get_kmmio_probe(p->addr)) { -+ if (get_kmmio_probe(addr)) { - ret = -EEXIST; - goto out; - } - -- pte = lookup_address(p->addr, &l); -+ pte = lookup_address(addr, &l); - if (!pte) { - ret = -EINVAL; - goto out; -@@ -453,7 +454,7 @@ int register_kmmio_probe(struct kmmio_probe *p) - kmmio_count++; - list_add_rcu(&p->list, &kmmio_probes); - while (size < size_lim) { -- if (add_kmmio_fault_page(p->addr + size)) -+ if (add_kmmio_fault_page(addr + size)) - pr_err("Unable to set page fault.\n"); - size += page_level_size(l); - } -@@ -527,19 +528,20 @@ void unregister_kmmio_probe(struct kmmio_probe *p) - { - unsigned long flags; - unsigned long size = 0; -+ unsigned long addr = p->addr & PAGE_MASK; - const unsigned long size_lim = p->len + (p->addr & ~PAGE_MASK); - struct kmmio_fault_page *release_list = NULL; - struct kmmio_delayed_release *drelease; - unsigned int l; - pte_t *pte; - -- pte = lookup_address(p->addr, &l); -+ pte = lookup_address(addr, &l); - if (!pte) - return; - - spin_lock_irqsave(&kmmio_lock, flags); - while (size < size_lim) { -- release_kmmio_fault_page(p->addr + size, &release_list); -+ release_kmmio_fault_page(addr + size, &release_list); - size += page_level_size(l); - } - list_del_rcu(&p->list); -diff --git a/arch/x86/platform/olpc/olpc-xo15-sci.c b/arch/x86/platform/olpc/olpc-xo15-sci.c -index 55130846ac87..c0533fbc39e3 100644 ---- a/arch/x86/platform/olpc/olpc-xo15-sci.c -+++ b/arch/x86/platform/olpc/olpc-xo15-sci.c -@@ -196,6 +196,7 @@ static int xo15_sci_remove(struct acpi_device *device) - return 0; - } - -+#ifdef CONFIG_PM_SLEEP - static int xo15_sci_resume(struct device *dev) - { - /* Enable all EC events */ -@@ -207,6 +208,7 @@ static int xo15_sci_resume(struct device *dev) - - return 0; - } -+#endif - - static SIMPLE_DEV_PM_OPS(xo15_sci_pm, NULL, xo15_sci_resume); - -diff --git a/certs/Makefile b/certs/Makefile -index 28ac694dd11a..2773c4afa24c 100644 ---- a/certs/Makefile -+++ b/certs/Makefile -@@ -36,29 +36,34 @@ ifndef CONFIG_MODULE_SIG_HASH - $(error Could not determine digest type to use from kernel config) - endif - -+redirect_openssl = 2>&1 -+quiet_redirect_openssl = 2>&1 -+silent_redirect_openssl = 2>/dev/null -+ - # We do it this way rather than having a boolean option for enabling an - # external private key, because 'make randconfig' might enable such a - # boolean option and we unfortunately can't make it depend on !RANDCONFIG. - ifeq ($(CONFIG_MODULE_SIG_KEY),"certs/signing_key.pem") - $(obj)/signing_key.pem: $(obj)/x509.genkey -- @echo "###" -- @echo "### Now generating an X.509 key pair to be used for signing modules." -- @echo "###" -- @echo "### If this takes a long time, you might wish to run rngd in the" -- @echo "### background to keep the supply of entropy topped up. It" -- @echo "### needs to be run as root, and uses a hardware random" -- @echo "### number generator if one is available." -- @echo "###" -- openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ -+ @$(kecho) "###" -+ @$(kecho) "### Now generating an X.509 key pair to be used for signing modules." -+ @$(kecho) "###" -+ @$(kecho) "### If this takes a long time, you might wish to run rngd in the" -+ @$(kecho) "### background to keep the supply of entropy topped up. It" -+ @$(kecho) "### needs to be run as root, and uses a hardware random" -+ @$(kecho) "### number generator if one is available." -+ @$(kecho) "###" -+ $(Q)openssl req -new -nodes -utf8 -$(CONFIG_MODULE_SIG_HASH) -days 36500 \ - -batch -x509 -config $(obj)/x509.genkey \ - -outform PEM -out $(obj)/signing_key.pem \ -- -keyout $(obj)/signing_key.pem 2>&1 -- @echo "###" -- @echo "### Key pair generated." -- @echo "###" -+ -keyout $(obj)/signing_key.pem \ -+ $($(quiet)redirect_openssl) -+ @$(kecho) "###" -+ @$(kecho) "### Key pair generated." -+ @$(kecho) "###" - - $(obj)/x509.genkey: -- @echo Generating X.509 key generation config -+ @$(kecho) Generating X.509 key generation config - @echo >$@ "[ req ]" - @echo >>$@ "default_bits = 4096" - @echo >>$@ "distinguished_name = req_distinguished_name" -diff --git a/drivers/Makefile b/drivers/Makefile -index 098997f2cc3a..f42a74ebc1be 100644 ---- a/drivers/Makefile -+++ b/drivers/Makefile -@@ -96,6 +96,7 @@ obj-$(CONFIG_TC) += tc/ - obj-$(CONFIG_UWB) += uwb/ - obj-$(CONFIG_USB_PHY) += usb/ - obj-$(CONFIG_USB) += usb/ -+obj-$(CONFIG_USB_SUPPORT) += usb/ - obj-$(CONFIG_PCI) += usb/ - obj-$(CONFIG_USB_GADGET) += usb/ - obj-$(CONFIG_OF) += usb/ -diff --git a/drivers/android/binder.c b/drivers/android/binder.c -index 5531f020e561..55613f6f7c0e 100644 ---- a/drivers/android/binder.c -+++ b/drivers/android/binder.c -@@ -2622,6 +2622,8 @@ static unsigned int binder_poll(struct file *filp, - binder_lock(__func__); - - thread = binder_get_thread(proc); -+ if (!thread) -+ return POLLERR; - - wait_for_proc_work = thread->transaction_stack == NULL && - list_empty(&thread->todo) && thread->return_error == BR_OK; -diff --git a/drivers/char/hw_random/exynos-rng.c b/drivers/char/hw_random/exynos-rng.c -index 7845a38b6604..7ba0ae060d61 100644 ---- a/drivers/char/hw_random/exynos-rng.c -+++ b/drivers/char/hw_random/exynos-rng.c -@@ -155,8 +155,7 @@ static int exynos_rng_probe(struct platform_device *pdev) - return ret; - } - --#ifdef CONFIG_PM --static int exynos_rng_runtime_suspend(struct device *dev) -+static int __maybe_unused exynos_rng_runtime_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); -@@ -166,7 +165,7 @@ static int exynos_rng_runtime_suspend(struct device *dev) - return 0; - } - --static int exynos_rng_runtime_resume(struct device *dev) -+static int __maybe_unused exynos_rng_runtime_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); -@@ -174,12 +173,12 @@ static int exynos_rng_runtime_resume(struct device *dev) - return clk_prepare_enable(exynos_rng->clk); - } - --static int exynos_rng_suspend(struct device *dev) -+static int __maybe_unused exynos_rng_suspend(struct device *dev) - { - return pm_runtime_force_suspend(dev); - } - --static int exynos_rng_resume(struct device *dev) -+static int __maybe_unused exynos_rng_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct exynos_rng *exynos_rng = platform_get_drvdata(pdev); -@@ -191,7 +190,6 @@ static int exynos_rng_resume(struct device *dev) - - return exynos_rng_configure(exynos_rng); - } --#endif - - static const struct dev_pm_ops exynos_rng_pm_ops = { - SET_SYSTEM_SLEEP_PM_OPS(exynos_rng_suspend, exynos_rng_resume) -diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c -index fd39893079d5..45ea8957a73a 100644 ---- a/drivers/crypto/s5p-sss.c -+++ b/drivers/crypto/s5p-sss.c -@@ -401,16 +401,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) - uint32_t aes_control; - int err; - unsigned long flags; -+ u8 *iv; - - aes_control = SSS_AES_KEY_CHANGE_MODE; - if (mode & FLAGS_AES_DECRYPT) - aes_control |= SSS_AES_MODE_DECRYPT; - -- if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) -+ if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) { - aes_control |= SSS_AES_CHAIN_MODE_CBC; -- else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) -+ iv = req->info; -+ } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) { - aes_control |= SSS_AES_CHAIN_MODE_CTR; -- -+ iv = req->info; -+ } else { -+ iv = NULL; /* AES_ECB */ -+ } - if (dev->ctx->keylen == AES_KEYSIZE_192) - aes_control |= SSS_AES_KEY_SIZE_192; - else if (dev->ctx->keylen == AES_KEYSIZE_256) -@@ -440,7 +445,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode) - goto outdata_error; - - SSS_AES_WRITE(dev, AES_CONTROL, aes_control); -- s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen); -+ s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen); - - s5p_set_dma_indata(dev, req->src); - s5p_set_dma_outdata(dev, req->dst); -diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c -index 53d22eb73b56..be26f625bb3e 100644 ---- a/drivers/dma/at_hdmac.c -+++ b/drivers/dma/at_hdmac.c -@@ -716,7 +716,7 @@ atc_prep_dma_interleaved(struct dma_chan *chan, - unsigned long flags) - { - struct at_dma_chan *atchan = to_at_dma_chan(chan); -- struct data_chunk *first = xt->sgl; -+ struct data_chunk *first; - struct at_desc *desc = NULL; - size_t xfer_count; - unsigned int dwidth; -@@ -728,6 +728,8 @@ atc_prep_dma_interleaved(struct dma_chan *chan, - if (unlikely(!xt || xt->numf != 1 || !xt->frame_size)) - return NULL; - -+ first = xt->sgl; -+ - dev_info(chan2dev(chan), - "%s: src=%pad, dest=%pad, numf=%d, frame_size=%d, flags=0x%lx\n", - __func__, &xt->src_start, &xt->dst_start, xt->numf, -diff --git a/drivers/dma/dma-jz4740.c b/drivers/dma/dma-jz4740.c -index 7638b24ce8d0..35fc58f4bf4b 100644 ---- a/drivers/dma/dma-jz4740.c -+++ b/drivers/dma/dma-jz4740.c -@@ -557,7 +557,7 @@ static int jz4740_dma_probe(struct platform_device *pdev) - - ret = dma_async_device_register(dd); - if (ret) -- return ret; -+ goto err_clk; - - irq = platform_get_irq(pdev, 0); - ret = request_irq(irq, jz4740_dma_irq, 0, dev_name(&pdev->dev), dmadev); -@@ -570,6 +570,8 @@ static int jz4740_dma_probe(struct platform_device *pdev) - - err_unregister: - dma_async_device_unregister(dd); -+err_clk: -+ clk_disable_unprepare(dmadev->clk); - return ret; - } - -diff --git a/drivers/dma/ioat/init.c b/drivers/dma/ioat/init.c -index abb75ebd65ea..ac8c28968422 100644 ---- a/drivers/dma/ioat/init.c -+++ b/drivers/dma/ioat/init.c -@@ -395,7 +395,7 @@ static int ioat_dma_self_test(struct ioatdma_device *ioat_dma) - if (memcmp(src, dest, IOAT_TEST_SIZE)) { - dev_err(dev, "Self-test copy failed compare, disabling\n"); - err = -ENODEV; -- goto free_resources; -+ goto unmap_dma; - } - - unmap_dma: -diff --git a/drivers/dma/zx296702_dma.c b/drivers/dma/zx296702_dma.c -index 6059d81e701a..8e55403847b2 100644 ---- a/drivers/dma/zx296702_dma.c -+++ b/drivers/dma/zx296702_dma.c -@@ -26,7 +26,7 @@ - - #define DRIVER_NAME "zx-dma" - #define DMA_ALIGN 4 --#define DMA_MAX_SIZE (0x10000 - PAGE_SIZE) -+#define DMA_MAX_SIZE (0x10000 - 512) - #define LLI_BLOCK_SIZE (4 * PAGE_SIZE) - - #define REG_ZX_SRC_ADDR 0x00 -diff --git a/drivers/gpio/gpio-intel-mid.c b/drivers/gpio/gpio-intel-mid.c -index c50e930d97d3..297121acc57d 100644 ---- a/drivers/gpio/gpio-intel-mid.c -+++ b/drivers/gpio/gpio-intel-mid.c -@@ -326,7 +326,7 @@ static void intel_mid_irq_init_hw(struct intel_mid_gpio *priv) - } - } - --static int intel_gpio_runtime_idle(struct device *dev) -+static int __maybe_unused intel_gpio_runtime_idle(struct device *dev) - { - int err = pm_schedule_suspend(dev, 500); - return err ?: -EBUSY; -diff --git a/drivers/gpio/gpio-xgene.c b/drivers/gpio/gpio-xgene.c -index 18a8182d4fec..7f1f32324504 100644 ---- a/drivers/gpio/gpio-xgene.c -+++ b/drivers/gpio/gpio-xgene.c -@@ -42,9 +42,7 @@ struct xgene_gpio { - struct gpio_chip chip; - void __iomem *base; - spinlock_t lock; --#ifdef CONFIG_PM - u32 set_dr_val[XGENE_MAX_GPIO_BANKS]; --#endif - }; - - static inline struct xgene_gpio *to_xgene_gpio(struct gpio_chip *chip) -@@ -132,8 +130,7 @@ static int xgene_gpio_dir_out(struct gpio_chip *gc, - return 0; - } - --#ifdef CONFIG_PM --static int xgene_gpio_suspend(struct device *dev) -+static __maybe_unused int xgene_gpio_suspend(struct device *dev) - { - struct xgene_gpio *gpio = dev_get_drvdata(dev); - unsigned long bank_offset; -@@ -146,7 +143,7 @@ static int xgene_gpio_suspend(struct device *dev) - return 0; - } - --static int xgene_gpio_resume(struct device *dev) -+static __maybe_unused int xgene_gpio_resume(struct device *dev) - { - struct xgene_gpio *gpio = dev_get_drvdata(dev); - unsigned long bank_offset; -@@ -160,10 +157,6 @@ static int xgene_gpio_resume(struct device *dev) - } - - static SIMPLE_DEV_PM_OPS(xgene_gpio_pm, xgene_gpio_suspend, xgene_gpio_resume); --#define XGENE_GPIO_PM_OPS (&xgene_gpio_pm) --#else --#define XGENE_GPIO_PM_OPS NULL --#endif - - static int xgene_gpio_probe(struct platform_device *pdev) - { -@@ -230,7 +223,7 @@ static struct platform_driver xgene_gpio_driver = { - .driver = { - .name = "xgene-gpio", - .of_match_table = xgene_gpio_of_match, -- .pm = XGENE_GPIO_PM_OPS, -+ .pm = &xgene_gpio_pm, - }, - .probe = xgene_gpio_probe, - .remove = xgene_gpio_remove, -diff --git a/drivers/gpu/drm/armada/armada_crtc.c b/drivers/gpu/drm/armada/armada_crtc.c -index cebcab560626..5d68189176cc 100644 ---- a/drivers/gpu/drm/armada/armada_crtc.c -+++ b/drivers/gpu/drm/armada/armada_crtc.c -@@ -1182,17 +1182,13 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, - - ret = devm_request_irq(dev, irq, armada_drm_irq, 0, "armada_drm_crtc", - dcrtc); -- if (ret < 0) { -- kfree(dcrtc); -- return ret; -- } -+ if (ret < 0) -+ goto err_crtc; - - if (dcrtc->variant->init) { - ret = dcrtc->variant->init(dcrtc, dev); -- if (ret) { -- kfree(dcrtc); -- return ret; -- } -+ if (ret) -+ goto err_crtc; - } - - /* Ensure AXI pipeline is enabled */ -@@ -1203,13 +1199,15 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, - dcrtc->crtc.port = port; - - primary = kzalloc(sizeof(*primary), GFP_KERNEL); -- if (!primary) -- return -ENOMEM; -+ if (!primary) { -+ ret = -ENOMEM; -+ goto err_crtc; -+ } - - ret = armada_drm_plane_init(primary); - if (ret) { - kfree(primary); -- return ret; -+ goto err_crtc; - } - - ret = drm_universal_plane_init(drm, &primary->base, 0, -@@ -1219,7 +1217,7 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, - DRM_PLANE_TYPE_PRIMARY); - if (ret) { - kfree(primary); -- return ret; -+ goto err_crtc; - } - - ret = drm_crtc_init_with_planes(drm, &dcrtc->crtc, &primary->base, NULL, -@@ -1238,6 +1236,9 @@ static int armada_drm_crtc_create(struct drm_device *drm, struct device *dev, - - err_crtc_init: - primary->base.funcs->destroy(&primary->base); -+err_crtc: -+ kfree(dcrtc); -+ - return ret; - } - -diff --git a/drivers/gpu/drm/drm_modeset_lock.c b/drivers/gpu/drm/drm_modeset_lock.c -index 6675b1428410..c257de351cfa 100644 ---- a/drivers/gpu/drm/drm_modeset_lock.c -+++ b/drivers/gpu/drm/drm_modeset_lock.c -@@ -69,7 +69,7 @@ void drm_modeset_lock_all(struct drm_device *dev) - struct drm_modeset_acquire_ctx *ctx; - int ret; - -- ctx = kzalloc(sizeof(*ctx), GFP_KERNEL); -+ ctx = kzalloc(sizeof(*ctx), GFP_KERNEL | __GFP_NOFAIL); - if (WARN_ON(!ctx)) - return; - -diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c -index d4813e03f5ee..00275c3856ce 100644 ---- a/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c -+++ b/drivers/gpu/drm/gma500/mdfld_dsi_dpi.c -@@ -821,14 +821,18 @@ void mdfld_dsi_dpi_mode_set(struct drm_encoder *encoder, - struct drm_device *dev = dsi_config->dev; - struct drm_psb_private *dev_priv = dev->dev_private; - int pipe = mdfld_dsi_encoder_get_pipe(dsi_encoder); -- - u32 pipeconf_reg = PIPEACONF; - u32 dspcntr_reg = DSPACNTR; -+ u32 pipeconf, dspcntr; - -- u32 pipeconf = dev_priv->pipeconf[pipe]; -- u32 dspcntr = dev_priv->dspcntr[pipe]; - u32 mipi = MIPI_PORT_EN | PASS_FROM_SPHY_TO_AFE | SEL_FLOPPED_HSTX; - -+ if (WARN_ON(pipe < 0)) -+ return; -+ -+ pipeconf = dev_priv->pipeconf[pipe]; -+ dspcntr = dev_priv->dspcntr[pipe]; -+ - if (pipe) { - pipeconf_reg = PIPECCONF; - dspcntr_reg = DSPCCNTR; -diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_output.c b/drivers/gpu/drm/gma500/mdfld_dsi_output.c -index 89f705c3a5eb..910a2f253990 100644 ---- a/drivers/gpu/drm/gma500/mdfld_dsi_output.c -+++ b/drivers/gpu/drm/gma500/mdfld_dsi_output.c -@@ -382,16 +382,6 @@ static int mdfld_dsi_connector_mode_valid(struct drm_connector *connector, - return MODE_OK; - } - --static void mdfld_dsi_connector_dpms(struct drm_connector *connector, int mode) --{ -- if (mode == connector->dpms) -- return; -- -- /*first, execute dpms*/ -- -- drm_helper_connector_dpms(connector, mode); --} -- - static struct drm_encoder *mdfld_dsi_connector_best_encoder( - struct drm_connector *connector) - { -@@ -404,7 +394,7 @@ static struct drm_encoder *mdfld_dsi_connector_best_encoder( - - /*DSI connector funcs*/ - static const struct drm_connector_funcs mdfld_dsi_connector_funcs = { -- .dpms = /*drm_helper_connector_dpms*/mdfld_dsi_connector_dpms, -+ .dpms = drm_helper_connector_dpms, - .save = mdfld_dsi_connector_save, - .restore = mdfld_dsi_connector_restore, - .detect = mdfld_dsi_connector_detect, -diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c -index a0865c49ec83..495c279da200 100644 ---- a/drivers/gpu/drm/nouveau/nouveau_gem.c -+++ b/drivers/gpu/drm/nouveau/nouveau_gem.c -@@ -370,7 +370,7 @@ validate_init(struct nouveau_channel *chan, struct drm_file *file_priv, - struct nouveau_cli *cli = nouveau_cli(file_priv); - struct drm_device *dev = chan->drm->dev; - int trycnt = 0; -- int ret, i; -+ int ret = -EINVAL, i; - struct nouveau_bo *res_bo = NULL; - LIST_HEAD(gart_list); - LIST_HEAD(vram_list); -diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c -index 67cebb23c940..aa04fb0159a7 100644 ---- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c -+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf.c -@@ -293,13 +293,10 @@ static int vmw_cmdbuf_header_submit(struct vmw_cmdbuf_header *header) - struct vmw_cmdbuf_man *man = header->man; - u32 val; - -- if (sizeof(header->handle) > 4) -- val = (header->handle >> 32); -- else -- val = 0; -+ val = upper_32_bits(header->handle); - vmw_write(man->dev_priv, SVGA_REG_COMMAND_HIGH, val); - -- val = (header->handle & 0xFFFFFFFFULL); -+ val = lower_32_bits(header->handle); - val |= header->cb_context & SVGA_CB_CONTEXT_MASK; - vmw_write(man->dev_priv, SVGA_REG_COMMAND_LOW, val); - -diff --git a/drivers/hv/hv.c b/drivers/hv/hv.c -index d415a804fd26..9a8976a79b29 100644 ---- a/drivers/hv/hv.c -+++ b/drivers/hv/hv.c -@@ -195,9 +195,7 @@ int hv_init(void) - { - int max_leaf; - union hv_x64_msr_hypercall_contents hypercall_msr; -- union hv_x64_msr_hypercall_contents tsc_msr; - void *virtaddr = NULL; -- void *va_tsc = NULL; - - memset(hv_context.synic_event_page, 0, sizeof(void *) * NR_CPUS); - memset(hv_context.synic_message_page, 0, -@@ -243,6 +241,9 @@ int hv_init(void) - - #ifdef CONFIG_X86_64 - if (ms_hyperv.features & HV_X64_MSR_REFERENCE_TSC_AVAILABLE) { -+ union hv_x64_msr_hypercall_contents tsc_msr; -+ void *va_tsc; -+ - va_tsc = __vmalloc(PAGE_SIZE, GFP_KERNEL, PAGE_KERNEL); - if (!va_tsc) - goto cleanup; -diff --git a/drivers/i2c/i2c-boardinfo.c b/drivers/i2c/i2c-boardinfo.c -index 90e322959303..42c25aed671d 100644 ---- a/drivers/i2c/i2c-boardinfo.c -+++ b/drivers/i2c/i2c-boardinfo.c -@@ -56,9 +56,7 @@ EXPORT_SYMBOL_GPL(__i2c_first_dynamic_bus_num); - * The board info passed can safely be __initdata, but be careful of embedded - * pointers (for platform_data, functions, etc) since that won't be copied. - */ --int __init --i2c_register_board_info(int busnum, -- struct i2c_board_info const *info, unsigned len) -+int i2c_register_board_info(int busnum, struct i2c_board_info const *info, unsigned len) - { - int status; - -diff --git a/drivers/idle/Kconfig b/drivers/idle/Kconfig -index 4732dfc15447..331adc509f3a 100644 ---- a/drivers/idle/Kconfig -+++ b/drivers/idle/Kconfig -@@ -17,6 +17,7 @@ config I7300_IDLE_IOAT_CHANNEL - - config I7300_IDLE - tristate "Intel chipset idle memory power saving driver" -+ depends on PCI - select I7300_IDLE_IOAT_CHANNEL - help - Enable memory power savings when idle with certain Intel server -diff --git a/drivers/iio/adc/axp288_adc.c b/drivers/iio/adc/axp288_adc.c -index f684fe31f832..64799ad7ebad 100644 ---- a/drivers/iio/adc/axp288_adc.c -+++ b/drivers/iio/adc/axp288_adc.c -@@ -44,7 +44,7 @@ struct axp288_adc_info { - struct regmap *regmap; - }; - --static const struct iio_chan_spec const axp288_adc_channels[] = { -+static const struct iio_chan_spec axp288_adc_channels[] = { - { - .indexed = 1, - .type = IIO_TEMP, -diff --git a/drivers/infiniband/core/cma.c b/drivers/infiniband/core/cma.c -index e354358db77b..b6c9a370a38b 100644 ---- a/drivers/infiniband/core/cma.c -+++ b/drivers/infiniband/core/cma.c -@@ -626,6 +626,7 @@ struct rdma_cm_id *rdma_create_id(struct net *net, - INIT_LIST_HEAD(&id_priv->mc_list); - get_random_bytes(&id_priv->seq_num, sizeof id_priv->seq_num); - id_priv->id.route.addr.dev_addr.net = get_net(net); -+ id_priv->seq_num &= 0x00ffffff; - - return &id_priv->id; - } -diff --git a/drivers/infiniband/hw/cxgb4/device.c b/drivers/infiniband/hw/cxgb4/device.c -index 58fce1742b8d..337b1a5eb41c 100644 ---- a/drivers/infiniband/hw/cxgb4/device.c -+++ b/drivers/infiniband/hw/cxgb4/device.c -@@ -809,10 +809,9 @@ static int c4iw_rdev_open(struct c4iw_rdev *rdev) - rdev->lldi.vr->qp.size, - rdev->lldi.vr->cq.start, - rdev->lldi.vr->cq.size); -- PDBG("udb len 0x%x udb base %p db_reg %p gts_reg %p " -+ PDBG("udb %pR db_reg %p gts_reg %p " - "qpmask 0x%x cqmask 0x%x\n", -- (unsigned)pci_resource_len(rdev->lldi.pdev, 2), -- (void *)pci_resource_start(rdev->lldi.pdev, 2), -+ &rdev->lldi.pdev->resource[2], - rdev->lldi.db_reg, rdev->lldi.gts_reg, - rdev->qpmask, rdev->cqmask); - -diff --git a/drivers/input/keyboard/tca8418_keypad.c b/drivers/input/keyboard/tca8418_keypad.c -index 9002298698fc..3048ef3e3e16 100644 ---- a/drivers/input/keyboard/tca8418_keypad.c -+++ b/drivers/input/keyboard/tca8418_keypad.c -@@ -164,11 +164,18 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) - int error, col, row; - u8 reg, state, code; - -- /* Initial read of the key event FIFO */ -- error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); -+ do { -+ error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); -+ if (error < 0) { -+ dev_err(&keypad_data->client->dev, -+ "unable to read REG_KEY_EVENT_A\n"); -+ break; -+ } -+ -+ /* Assume that key code 0 signifies empty FIFO */ -+ if (reg <= 0) -+ break; - -- /* Assume that key code 0 signifies empty FIFO */ -- while (error >= 0 && reg > 0) { - state = reg & KEY_EVENT_VALUE; - code = reg & KEY_EVENT_CODE; - -@@ -184,11 +191,7 @@ static void tca8418_read_keypad(struct tca8418_keypad *keypad_data) - - /* Read for next loop */ - error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, ®); -- } -- -- if (error < 0) -- dev_err(&keypad_data->client->dev, -- "unable to read REG_KEY_EVENT_A\n"); -+ } while (1); - - input_sync(input); - } -diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c -index 7b4ddf0a39ec..2d28530b7e82 100644 ---- a/drivers/isdn/hardware/eicon/message.c -+++ b/drivers/isdn/hardware/eicon/message.c -@@ -147,7 +147,7 @@ static word plci_remove_check(PLCI *); - static void listen_check(DIVA_CAPI_ADAPTER *); - static byte AddInfo(byte **, byte **, byte *, byte *); - static byte getChannel(API_PARSE *); --static void IndParse(PLCI *, word *, byte **, byte); -+static void IndParse(PLCI *, const word *, byte **, byte); - static byte ie_compare(byte *, byte *); - static word find_cip(DIVA_CAPI_ADAPTER *, byte *, byte *); - static word CPN_filter_ok(byte *cpn, DIVA_CAPI_ADAPTER *, word); -@@ -4860,7 +4860,7 @@ static void sig_ind(PLCI *plci) - /* included before the ESC_MSGTYPE and MAXPARMSIDS has to be incremented */ - /* SMSG is situated at the end because its 0 (for compatibility reasons */ - /* (see Info_Mask Bit 4, first IE. then the message type) */ -- word parms_id[] = -+ static const word parms_id[] = - {MAXPARMSIDS, CPN, 0xff, DSA, OSA, BC, LLC, HLC, ESC_CAUSE, DSP, DT, CHA, - UUI, CONG_RR, CONG_RNR, ESC_CHI, KEY, CHI, CAU, ESC_LAW, - RDN, RDX, CONN_NR, RIN, NI, CAI, ESC_CR, -@@ -4868,12 +4868,12 @@ static void sig_ind(PLCI *plci) - /* 14 FTY repl by ESC_CHI */ - /* 18 PI repl by ESC_LAW */ - /* removed OAD changed to 0xff for future use, OAD is multiIE now */ -- word multi_fac_id[] = {1, FTY}; -- word multi_pi_id[] = {1, PI}; -- word multi_CiPN_id[] = {1, OAD}; -- word multi_ssext_id[] = {1, ESC_SSEXT}; -+ static const word multi_fac_id[] = {1, FTY}; -+ static const word multi_pi_id[] = {1, PI}; -+ static const word multi_CiPN_id[] = {1, OAD}; -+ static const word multi_ssext_id[] = {1, ESC_SSEXT}; - -- word multi_vswitch_id[] = {1, ESC_VSWITCH}; -+ static const word multi_vswitch_id[] = {1, ESC_VSWITCH}; - - byte *cau; - word ncci; -@@ -8926,7 +8926,7 @@ static void listen_check(DIVA_CAPI_ADAPTER *a) - /* functions for all parameters sent in INDs */ - /*------------------------------------------------------------------*/ - --static void IndParse(PLCI *plci, word *parms_id, byte **parms, byte multiIEsize) -+static void IndParse(PLCI *plci, const word *parms_id, byte **parms, byte multiIEsize) - { - word ploc; /* points to current location within packet */ - byte w; -diff --git a/drivers/isdn/icn/icn.c b/drivers/isdn/icn/icn.c -index 358a574d9e8b..46d957c34be1 100644 ---- a/drivers/isdn/icn/icn.c -+++ b/drivers/isdn/icn/icn.c -@@ -718,7 +718,7 @@ icn_sendbuf(int channel, int ack, struct sk_buff *skb, icn_card *card) - return 0; - if (card->sndcount[channel] > ICN_MAX_SQUEUE) - return 0; --#warning TODO test headroom or use skb->nb to flag ACK -+ /* TODO test headroom or use skb->nb to flag ACK */ - nskb = skb_clone(skb, GFP_ATOMIC); - if (nskb) { - /* Push ACK flag as one -diff --git a/drivers/isdn/sc/init.c b/drivers/isdn/sc/init.c -index 3597ef47b28a..09fc129ef2fa 100644 ---- a/drivers/isdn/sc/init.c -+++ b/drivers/isdn/sc/init.c -@@ -441,6 +441,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) - RspMessage rcvmsg; - ReqMessage sndmsg; - HWConfig_pl hwci; -+ void __iomem *rambase_sig = (void __iomem *)rambase + SIG_OFFSET; - int x; - - pr_debug("Attempting to identify adapter @ 0x%lx io 0x%x\n", -@@ -481,7 +482,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) - */ - outb(PRI_BASEPG_VAL, pgport); - msleep_interruptible(1000); -- sig = readl(rambase + SIG_OFFSET); -+ sig = readl(rambase_sig); - pr_debug("Looking for a signature, got 0x%lx\n", sig); - if (sig == SIGNATURE) - return PRI_BOARD; -@@ -491,7 +492,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) - */ - outb(BRI_BASEPG_VAL, pgport); - msleep_interruptible(1000); -- sig = readl(rambase + SIG_OFFSET); -+ sig = readl(rambase_sig); - pr_debug("Looking for a signature, got 0x%lx\n", sig); - if (sig == SIGNATURE) - return BRI_BOARD; -@@ -501,7 +502,7 @@ static int identify_board(unsigned long rambase, unsigned int iobase) - /* - * Try to spot a card - */ -- sig = readl(rambase + SIG_OFFSET); -+ sig = readl(rambase_sig); - pr_debug("Looking for a signature, got 0x%lx\n", sig); - if (sig != SIGNATURE) - return -1; -diff --git a/drivers/md/md.c b/drivers/md/md.c -index 0a856cb181e9..62c3328e2a1d 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -1028,8 +1028,9 @@ static int super_90_load(struct md_rdev *rdev, struct md_rdev *refdev, int minor - * (not needed for Linear and RAID0 as metadata doesn't - * record this size) - */ -- if (rdev->sectors >= (2ULL << 32) && sb->level >= 1) -- rdev->sectors = (2ULL << 32) - 2; -+ if (IS_ENABLED(CONFIG_LBDAF) && (u64)rdev->sectors >= (2ULL << 32) && -+ sb->level >= 1) -+ rdev->sectors = (sector_t)(2ULL << 32) - 2; - - if (rdev->sectors < ((sector_t)sb->size) * 2 && sb->level >= 1) - /* "this cannot possibly happen" ... */ -@@ -1322,8 +1323,9 @@ super_90_rdev_size_change(struct md_rdev *rdev, sector_t num_sectors) - /* Limit to 4TB as metadata cannot record more than that. - * 4TB == 2^32 KB, or 2*2^32 sectors. - */ -- if (num_sectors >= (2ULL << 32) && rdev->mddev->level >= 1) -- num_sectors = (2ULL << 32) - 2; -+ if (IS_ENABLED(CONFIG_LBDAF) && (u64)num_sectors >= (2ULL << 32) && -+ rdev->mddev->level >= 1) -+ num_sectors = (sector_t)(2ULL << 32) - 2; - md_super_write(rdev->mddev, rdev, rdev->sb_start, rdev->sb_size, - rdev->sb_page); - md_super_wait(rdev->mddev); -diff --git a/drivers/media/common/b2c2/flexcop-fe-tuner.c b/drivers/media/common/b2c2/flexcop-fe-tuner.c -index 9c59f4306883..f5956402fc69 100644 ---- a/drivers/media/common/b2c2/flexcop-fe-tuner.c -+++ b/drivers/media/common/b2c2/flexcop-fe-tuner.c -@@ -38,7 +38,7 @@ static int flexcop_fe_request_firmware(struct dvb_frontend *fe, - #endif - - /* lnb control */ --#if FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299) -+#if (FE_SUPPORTED(MT312) || FE_SUPPORTED(STV0299)) && FE_SUPPORTED(PLL) - static int flexcop_set_voltage(struct dvb_frontend *fe, - enum fe_sec_voltage voltage) - { -@@ -68,7 +68,7 @@ static int flexcop_set_voltage(struct dvb_frontend *fe, - #endif - - #if FE_SUPPORTED(S5H1420) || FE_SUPPORTED(STV0299) || FE_SUPPORTED(MT312) --static int flexcop_sleep(struct dvb_frontend* fe) -+static int __maybe_unused flexcop_sleep(struct dvb_frontend* fe) - { - struct flexcop_device *fc = fe->dvb->priv; - if (fc->fe_sleep) -diff --git a/drivers/media/i2c/s5k6aa.c b/drivers/media/i2c/s5k6aa.c -index d0ad6a25bdab..5ac2babe123b 100644 ---- a/drivers/media/i2c/s5k6aa.c -+++ b/drivers/media/i2c/s5k6aa.c -@@ -421,6 +421,7 @@ static int s5k6aa_set_ahb_address(struct i2c_client *client) - - /** - * s5k6aa_configure_pixel_clock - apply ISP main clock/PLL configuration -+ * @s5k6aa: pointer to &struct s5k6aa describing the device - * - * Configure the internal ISP PLL for the required output frequency. - * Locking: called with s5k6aa.lock mutex held. -@@ -669,6 +670,7 @@ static int s5k6aa_set_input_params(struct s5k6aa *s5k6aa) - - /** - * s5k6aa_configure_video_bus - configure the video output interface -+ * @s5k6aa: pointer to &struct s5k6aa describing the device - * @bus_type: video bus type: parallel or MIPI-CSI - * @nlanes: number of MIPI lanes to be used (MIPI-CSI only) - * -@@ -724,6 +726,8 @@ static int s5k6aa_new_config_sync(struct i2c_client *client, int timeout, - - /** - * s5k6aa_set_prev_config - write user preview register set -+ * @s5k6aa: pointer to &struct s5k6aa describing the device -+ * @preset: s5kaa preset to be applied - * - * Configure output resolution and color fromat, pixel clock - * frequency range, device frame rate type and frame period range. -@@ -777,6 +781,7 @@ static int s5k6aa_set_prev_config(struct s5k6aa *s5k6aa, - - /** - * s5k6aa_initialize_isp - basic ISP MCU initialization -+ * @sd: pointer to V4L2 sub-device descriptor - * - * Configure AHB addresses for registers read/write; configure PLLs for - * required output pixel clock. The ISP power supply needs to be already -diff --git a/drivers/media/i2c/tc358743.c b/drivers/media/i2c/tc358743.c -index 9ef5baaf8646..ea2777e1ee10 100644 ---- a/drivers/media/i2c/tc358743.c -+++ b/drivers/media/i2c/tc358743.c -@@ -197,57 +197,61 @@ static void i2c_wr(struct v4l2_subdev *sd, u16 reg, u8 *values, u32 n) - } - } - --static u8 i2c_rd8(struct v4l2_subdev *sd, u16 reg) -+static noinline u32 i2c_rdreg(struct v4l2_subdev *sd, u16 reg, u32 n) - { -- u8 val; -+ __le32 val = 0; - -- i2c_rd(sd, reg, &val, 1); -+ i2c_rd(sd, reg, (u8 __force *)&val, n); - -- return val; -+ return le32_to_cpu(val); -+} -+ -+static noinline void i2c_wrreg(struct v4l2_subdev *sd, u16 reg, u32 val, u32 n) -+{ -+ __le32 raw = cpu_to_le32(val); -+ -+ i2c_wr(sd, reg, (u8 __force *)&raw, n); -+} -+ -+static u8 i2c_rd8(struct v4l2_subdev *sd, u16 reg) -+{ -+ return i2c_rdreg(sd, reg, 1); - } - - static void i2c_wr8(struct v4l2_subdev *sd, u16 reg, u8 val) - { -- i2c_wr(sd, reg, &val, 1); -+ i2c_wrreg(sd, reg, val, 1); - } - - static void i2c_wr8_and_or(struct v4l2_subdev *sd, u16 reg, - u8 mask, u8 val) - { -- i2c_wr8(sd, reg, (i2c_rd8(sd, reg) & mask) | val); -+ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); - } - - static u16 i2c_rd16(struct v4l2_subdev *sd, u16 reg) - { -- u16 val; -- -- i2c_rd(sd, reg, (u8 *)&val, 2); -- -- return val; -+ return i2c_rdreg(sd, reg, 2); - } - - static void i2c_wr16(struct v4l2_subdev *sd, u16 reg, u16 val) - { -- i2c_wr(sd, reg, (u8 *)&val, 2); -+ i2c_wrreg(sd, reg, val, 2); - } - - static void i2c_wr16_and_or(struct v4l2_subdev *sd, u16 reg, u16 mask, u16 val) - { -- i2c_wr16(sd, reg, (i2c_rd16(sd, reg) & mask) | val); -+ i2c_wrreg(sd, reg, (i2c_rdreg(sd, reg, 2) & mask) | val, 2); - } - - static u32 i2c_rd32(struct v4l2_subdev *sd, u16 reg) - { -- u32 val; -- -- i2c_rd(sd, reg, (u8 *)&val, 4); -- -- return val; -+ return i2c_rdreg(sd, reg, 4); - } - - static void i2c_wr32(struct v4l2_subdev *sd, u16 reg, u32 val) - { -- i2c_wr(sd, reg, (u8 *)&val, 4); -+ i2c_wrreg(sd, reg, val, 4); - } - - /* --------------- STATUS --------------- */ -@@ -1240,7 +1244,7 @@ static int tc358743_g_register(struct v4l2_subdev *sd, - - reg->size = tc358743_get_reg_size(reg->reg); - -- i2c_rd(sd, reg->reg, (u8 *)®->val, reg->size); -+ reg->val = i2c_rdreg(sd, reg->reg, reg->size); - - return 0; - } -@@ -1266,7 +1270,7 @@ static int tc358743_s_register(struct v4l2_subdev *sd, - reg->reg == BCAPS) - return 0; - -- i2c_wr(sd, (u16)reg->reg, (u8 *)®->val, -+ i2c_wrreg(sd, (u16)reg->reg, reg->val, - tc358743_get_reg_size(reg->reg)); - - return 0; -diff --git a/drivers/media/usb/em28xx/Kconfig b/drivers/media/usb/em28xx/Kconfig -index e382210c4ada..75323f5efd0f 100644 ---- a/drivers/media/usb/em28xx/Kconfig -+++ b/drivers/media/usb/em28xx/Kconfig -@@ -11,7 +11,7 @@ config VIDEO_EM28XX_V4L2 - select VIDEO_SAA711X if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_TVP5150 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_MSP3400 if MEDIA_SUBDRV_AUTOSELECT -- select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT -+ select VIDEO_MT9V011 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT - - ---help--- - This is a video4linux driver for Empia 28xx based TV cards. -diff --git a/drivers/media/usb/go7007/Kconfig b/drivers/media/usb/go7007/Kconfig -index 95a3af644a92..af1d02430931 100644 ---- a/drivers/media/usb/go7007/Kconfig -+++ b/drivers/media/usb/go7007/Kconfig -@@ -11,7 +11,7 @@ config VIDEO_GO7007 - select VIDEO_TW2804 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_TW9903 if MEDIA_SUBDRV_AUTOSELECT - select VIDEO_TW9906 if MEDIA_SUBDRV_AUTOSELECT -- select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT -+ select VIDEO_OV7640 if MEDIA_SUBDRV_AUTOSELECT && MEDIA_CAMERA_SUPPORT - select VIDEO_UDA1342 if MEDIA_SUBDRV_AUTOSELECT - ---help--- - This is a video4linux driver for the WIS GO7007 MPEG -diff --git a/drivers/media/usb/hdpvr/hdpvr-core.c b/drivers/media/usb/hdpvr/hdpvr-core.c -index 3fc64197b4e6..08f0ca7aa012 100644 ---- a/drivers/media/usb/hdpvr/hdpvr-core.c -+++ b/drivers/media/usb/hdpvr/hdpvr-core.c -@@ -273,7 +273,9 @@ static int hdpvr_probe(struct usb_interface *interface, - struct hdpvr_device *dev; - struct usb_host_interface *iface_desc; - struct usb_endpoint_descriptor *endpoint; -+#if IS_ENABLED(CONFIG_I2C) - struct i2c_client *client; -+#endif - size_t buffer_size; - int i; - int retval = -ENOMEM; -diff --git a/drivers/media/usb/pwc/pwc-if.c b/drivers/media/usb/pwc/pwc-if.c -index 58f23bcfe94e..299750e56916 100644 ---- a/drivers/media/usb/pwc/pwc-if.c -+++ b/drivers/media/usb/pwc/pwc-if.c -@@ -1119,8 +1119,10 @@ static int usb_pwc_probe(struct usb_interface *intf, const struct usb_device_id - - return 0; - -+#ifdef CONFIG_USB_PWC_INPUT_EVDEV - err_video_unreg: - video_unregister_device(&pdev->vdev); -+#endif - err_unregister_v4l2_dev: - v4l2_device_unregister(&pdev->v4l2_dev); - err_free_controls: -diff --git a/drivers/media/v4l2-core/Kconfig b/drivers/media/v4l2-core/Kconfig -index 9beece00869b..29b3436d0910 100644 ---- a/drivers/media/v4l2-core/Kconfig -+++ b/drivers/media/v4l2-core/Kconfig -@@ -37,7 +37,6 @@ config VIDEO_PCI_SKELETON - # Used by drivers that need tuner.ko - config VIDEO_TUNER - tristate -- depends on MEDIA_TUNER - - # Used by drivers that need v4l2-mem2mem.ko - config V4L2_MEM2MEM_DEV -diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c -index 5dcc0313c38a..207370d68c17 100644 ---- a/drivers/message/fusion/mptbase.c -+++ b/drivers/message/fusion/mptbase.c -@@ -6848,6 +6848,7 @@ mpt_print_ioc_summary(MPT_ADAPTER *ioc, char *buffer, int *size, int len, int sh - *size = y; - } - -+#ifdef CONFIG_PROC_FS - static void seq_mpt_print_ioc_summary(MPT_ADAPTER *ioc, struct seq_file *m, int showlan) - { - char expVer[32]; -@@ -6879,6 +6880,7 @@ static void seq_mpt_print_ioc_summary(MPT_ADAPTER *ioc, struct seq_file *m, int - - seq_putc(m, '\n'); - } -+#endif - - /** - * mpt_set_taskmgmt_in_progress_flag - set flags associated with task management -diff --git a/drivers/mtd/chips/Kconfig b/drivers/mtd/chips/Kconfig -index 8a25adced79f..bbfa1f129266 100644 ---- a/drivers/mtd/chips/Kconfig -+++ b/drivers/mtd/chips/Kconfig -@@ -67,6 +67,10 @@ endchoice - config MTD_CFI_GEOMETRY - bool "Specific CFI Flash geometry selection" - depends on MTD_CFI_ADV_OPTIONS -+ select MTD_MAP_BANK_WIDTH_1 if !(MTD_MAP_BANK_WIDTH_2 || \ -+ MTD_MAP_BANK_WIDTH_4 || MTD_MAP_BANK_WIDTH_8 || \ -+ MTD_MAP_BANK_WIDTH_16 || MTD_MAP_BANK_WIDTH_32) -+ select MTD_CFI_I1 if !(MTD_CFI_I2 || MTD_CFI_I4 || MTD_CFI_I8) - help - This option does not affect the code directly, but will enable - some other configuration options which would allow you to reduce -diff --git a/drivers/mtd/maps/ck804xrom.c b/drivers/mtd/maps/ck804xrom.c -index 0455166f05fa..4f206a99164c 100644 ---- a/drivers/mtd/maps/ck804xrom.c -+++ b/drivers/mtd/maps/ck804xrom.c -@@ -112,8 +112,8 @@ static void ck804xrom_cleanup(struct ck804xrom_window *window) - } - - --static int ck804xrom_init_one(struct pci_dev *pdev, -- const struct pci_device_id *ent) -+static int __init ck804xrom_init_one(struct pci_dev *pdev, -+ const struct pci_device_id *ent) - { - static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; - u8 byte; -diff --git a/drivers/mtd/maps/esb2rom.c b/drivers/mtd/maps/esb2rom.c -index 76ed651b515b..9646b0766ce0 100644 ---- a/drivers/mtd/maps/esb2rom.c -+++ b/drivers/mtd/maps/esb2rom.c -@@ -144,8 +144,8 @@ static void esb2rom_cleanup(struct esb2rom_window *window) - pci_dev_put(window->pdev); - } - --static int esb2rom_init_one(struct pci_dev *pdev, -- const struct pci_device_id *ent) -+static int __init esb2rom_init_one(struct pci_dev *pdev, -+ const struct pci_device_id *ent) - { - static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; - struct esb2rom_window *window = &esb2rom_window; -diff --git a/drivers/mtd/maps/ichxrom.c b/drivers/mtd/maps/ichxrom.c -index 8636bba42200..976d42f63aef 100644 ---- a/drivers/mtd/maps/ichxrom.c -+++ b/drivers/mtd/maps/ichxrom.c -@@ -57,10 +57,12 @@ static void ichxrom_cleanup(struct ichxrom_window *window) - { - struct ichxrom_map_info *map, *scratch; - u16 word; -+ int ret; - - /* Disable writes through the rom window */ -- pci_read_config_word(window->pdev, BIOS_CNTL, &word); -- pci_write_config_word(window->pdev, BIOS_CNTL, word & ~1); -+ ret = pci_read_config_word(window->pdev, BIOS_CNTL, &word); -+ if (!ret) -+ pci_write_config_word(window->pdev, BIOS_CNTL, word & ~1); - pci_dev_put(window->pdev); - - /* Free all of the mtd devices */ -@@ -84,8 +86,8 @@ static void ichxrom_cleanup(struct ichxrom_window *window) - } - - --static int ichxrom_init_one(struct pci_dev *pdev, -- const struct pci_device_id *ent) -+static int __init ichxrom_init_one(struct pci_dev *pdev, -+ const struct pci_device_id *ent) - { - static char *rom_probe_types[] = { "cfi_probe", "jedec_probe", NULL }; - struct ichxrom_window *window = &ichxrom_window; -diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c -index bcba1a924c75..1f2785ee909f 100644 ---- a/drivers/mtd/nand/sh_flctl.c -+++ b/drivers/mtd/nand/sh_flctl.c -@@ -160,7 +160,7 @@ static void flctl_setup_dma(struct sh_flctl *flctl) - - memset(&cfg, 0, sizeof(cfg)); - cfg.direction = DMA_MEM_TO_DEV; -- cfg.dst_addr = (dma_addr_t)FLDTFIFO(flctl); -+ cfg.dst_addr = flctl->fifo; - cfg.src_addr = 0; - ret = dmaengine_slave_config(flctl->chan_fifo0_tx, &cfg); - if (ret < 0) -@@ -176,7 +176,7 @@ static void flctl_setup_dma(struct sh_flctl *flctl) - - cfg.direction = DMA_DEV_TO_MEM; - cfg.dst_addr = 0; -- cfg.src_addr = (dma_addr_t)FLDTFIFO(flctl); -+ cfg.src_addr = flctl->fifo; - ret = dmaengine_slave_config(flctl->chan_fifo0_rx, &cfg); - if (ret < 0) - goto err; -@@ -1096,6 +1096,7 @@ static int flctl_probe(struct platform_device *pdev) - flctl->reg = devm_ioremap_resource(&pdev->dev, res); - if (IS_ERR(flctl->reg)) - return PTR_ERR(flctl->reg); -+ flctl->fifo = res->start + 0x24; /* FLDTFIFO */ - - irq = platform_get_irq(pdev, 0); - if (irq < 0) { -diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig -index f184fb5bd110..5116aec3c174 100644 ---- a/drivers/net/Kconfig -+++ b/drivers/net/Kconfig -@@ -411,6 +411,9 @@ config XEN_NETDEV_BACKEND - config VMXNET3 - tristate "VMware VMXNET3 ethernet driver" - depends on PCI && INET -+ depends on !(PAGE_SIZE_64KB || ARM64_64K_PAGES || \ -+ IA64_PAGE_SIZE_64KB || MICROBLAZE_64K_PAGES || \ -+ PARISC_PAGE_SIZE_64KB || PPC_64K_PAGES) - help - This driver supports VMware's vmxnet3 virtual ethernet NIC. - To compile this driver as a module, choose M here: the -diff --git a/drivers/net/ethernet/3com/3c509.c b/drivers/net/ethernet/3com/3c509.c -index 4547a1b8b958..7677c745fb30 100644 ---- a/drivers/net/ethernet/3com/3c509.c -+++ b/drivers/net/ethernet/3com/3c509.c -@@ -562,7 +562,7 @@ static void el3_common_remove (struct net_device *dev) - } - - #ifdef CONFIG_EISA --static int __init el3_eisa_probe (struct device *device) -+static int el3_eisa_probe(struct device *device) - { - short i; - int ioaddr, irq, if_port; -diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c -index 2839af00f20c..1c5f3b273e6a 100644 ---- a/drivers/net/ethernet/3com/3c59x.c -+++ b/drivers/net/ethernet/3com/3c59x.c -@@ -907,7 +907,7 @@ static struct eisa_device_id vortex_eisa_ids[] = { - }; - MODULE_DEVICE_TABLE(eisa, vortex_eisa_ids); - --static int __init vortex_eisa_probe(struct device *device) -+static int vortex_eisa_probe(struct device *device) - { - void __iomem *ioaddr; - struct eisa_device *edev; -diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c -index 618d952c2984..2ef4b4e884ae 100644 ---- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c -+++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c -@@ -829,7 +829,7 @@ static int xgbe_remove(struct platform_device *pdev) - return 0; - } - --#ifdef CONFIG_PM -+#ifdef CONFIG_PM_SLEEP - static int xgbe_suspend(struct device *dev) - { - struct net_device *netdev = dev_get_drvdata(dev); -@@ -868,7 +868,7 @@ static int xgbe_resume(struct device *dev) - - return ret; - } --#endif /* CONFIG_PM */ -+#endif /* CONFIG_PM_SLEEP */ - - #ifdef CONFIG_ACPI - static const struct acpi_device_id xgbe_acpi_match[] = { -diff --git a/drivers/net/ethernet/dec/tulip/de4x5.c b/drivers/net/ethernet/dec/tulip/de4x5.c -index 8966f3159bb2..3acde3b9b767 100644 ---- a/drivers/net/ethernet/dec/tulip/de4x5.c -+++ b/drivers/net/ethernet/dec/tulip/de4x5.c -@@ -1990,7 +1990,7 @@ SetMulticastFilter(struct net_device *dev) - - static u_char de4x5_irq[] = EISA_ALLOWED_IRQ_LIST; - --static int __init de4x5_eisa_probe (struct device *gendev) -+static int de4x5_eisa_probe(struct device *gendev) - { - struct eisa_device *edev; - u_long iobase; -diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c -index 7923bfdc9b30..901661149b44 100644 ---- a/drivers/net/ethernet/freescale/gianfar.c -+++ b/drivers/net/ethernet/freescale/gianfar.c -@@ -1375,9 +1375,11 @@ static int gfar_probe(struct platform_device *ofdev) - - gfar_init_addr_hash_table(priv); - -- /* Insert receive time stamps into padding alignment bytes */ -+ /* Insert receive time stamps into padding alignment bytes, and -+ * plus 2 bytes padding to ensure the cpu alignment. -+ */ - if (priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) -- priv->padding = 8; -+ priv->padding = 8 + DEFAULT_PADDING; - - if (dev->features & NETIF_F_IP_CSUM || - priv->device_flags & FSL_GIANFAR_DEV_HAS_TIMER) -diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c -index ae6e30d39f0f..3daf2d4a7ca0 100644 ---- a/drivers/net/ethernet/hp/hp100.c -+++ b/drivers/net/ethernet/hp/hp100.c -@@ -194,7 +194,6 @@ static const char *hp100_isa_tbl[] = { - }; - #endif - --#ifdef CONFIG_EISA - static struct eisa_device_id hp100_eisa_tbl[] = { - { "HWPF180" }, /* HP J2577 rev A */ - { "HWP1920" }, /* HP 27248B */ -@@ -205,9 +204,7 @@ static struct eisa_device_id hp100_eisa_tbl[] = { - { "" } /* Mandatory final entry ! */ - }; - MODULE_DEVICE_TABLE(eisa, hp100_eisa_tbl); --#endif - --#ifdef CONFIG_PCI - static const struct pci_device_id hp100_pci_tbl[] = { - {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_J2585A, PCI_ANY_ID, PCI_ANY_ID,}, - {PCI_VENDOR_ID_HP, PCI_DEVICE_ID_HP_J2585B, PCI_ANY_ID, PCI_ANY_ID,}, -@@ -219,7 +216,6 @@ static const struct pci_device_id hp100_pci_tbl[] = { - {} /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(pci, hp100_pci_tbl); --#endif - - static int hp100_rx_ratio = HP100_DEFAULT_RX_RATIO; - static int hp100_priority_tx = HP100_DEFAULT_PRIORITY_TX; -@@ -2842,8 +2838,7 @@ static void cleanup_dev(struct net_device *d) - free_netdev(d); - } - --#ifdef CONFIG_EISA --static int __init hp100_eisa_probe (struct device *gendev) -+static int hp100_eisa_probe(struct device *gendev) - { - struct net_device *dev = alloc_etherdev(sizeof(struct hp100_private)); - struct eisa_device *edev = to_eisa_device(gendev); -@@ -2884,9 +2879,7 @@ static struct eisa_driver hp100_eisa_driver = { - .remove = hp100_eisa_remove, - } - }; --#endif - --#ifdef CONFIG_PCI - static int hp100_pci_probe(struct pci_dev *pdev, - const struct pci_device_id *ent) - { -@@ -2955,7 +2948,6 @@ static struct pci_driver hp100_pci_driver = { - .probe = hp100_pci_probe, - .remove = hp100_pci_remove, - }; --#endif - - /* - * module section -@@ -3032,23 +3024,17 @@ static int __init hp100_module_init(void) - err = hp100_isa_init(); - if (err && err != -ENODEV) - goto out; --#ifdef CONFIG_EISA - err = eisa_driver_register(&hp100_eisa_driver); - if (err && err != -ENODEV) - goto out2; --#endif --#ifdef CONFIG_PCI - err = pci_register_driver(&hp100_pci_driver); - if (err && err != -ENODEV) - goto out3; --#endif - out: - return err; - out3: --#ifdef CONFIG_EISA - eisa_driver_unregister (&hp100_eisa_driver); - out2: --#endif - hp100_isa_cleanup(); - goto out; - } -@@ -3057,12 +3043,8 @@ static int __init hp100_module_init(void) - static void __exit hp100_module_exit(void) - { - hp100_isa_cleanup(); --#ifdef CONFIG_EISA - eisa_driver_unregister (&hp100_eisa_driver); --#endif --#ifdef CONFIG_PCI - pci_unregister_driver (&hp100_pci_driver); --#endif - } - - module_init(hp100_module_init) -diff --git a/drivers/net/ethernet/ti/tlan.c b/drivers/net/ethernet/ti/tlan.c -index a274cd49afe9..399a89f30826 100644 ---- a/drivers/net/ethernet/ti/tlan.c -+++ b/drivers/net/ethernet/ti/tlan.c -@@ -610,8 +610,8 @@ err_out_regions: - #ifdef CONFIG_PCI - if (pdev) - pci_release_regions(pdev); --#endif - err_out: -+#endif - if (pdev) - pci_disable_device(pdev); - return rc; -diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c -index 95c0b45a68fb..313e006f74fe 100644 ---- a/drivers/net/hippi/rrunner.c -+++ b/drivers/net/hippi/rrunner.c -@@ -1381,8 +1381,8 @@ static int rr_close(struct net_device *dev) - rrpriv->info_dma); - rrpriv->info = NULL; - -- free_irq(pdev->irq, dev); - spin_unlock_irqrestore(&rrpriv->lock, flags); -+ free_irq(pdev->irq, dev); - - return 0; - } -diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c -index af827faec7fe..8aecea0d5dbf 100644 ---- a/drivers/net/ipvlan/ipvlan_core.c -+++ b/drivers/net/ipvlan/ipvlan_core.c -@@ -353,6 +353,7 @@ static int ipvlan_process_v4_outbound(struct sk_buff *skb) - .flowi4_oif = dev->ifindex, - .flowi4_tos = RT_TOS(ip4h->tos), - .flowi4_flags = FLOWI_FLAG_ANYSRC, -+ .flowi4_mark = skb->mark, - .daddr = ip4h->daddr, - .saddr = ip4h->saddr, - }; -diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig -index 1f6893ebce16..3a7286256db0 100644 ---- a/drivers/net/usb/Kconfig -+++ b/drivers/net/usb/Kconfig -@@ -395,6 +395,10 @@ config USB_NET_RNDIS_HOST - The protocol specification is incomplete, and is controlled by - (and for) Microsoft; it isn't an "Open" ecosystem or market. - -+config USB_NET_CDC_SUBSET_ENABLE -+ tristate -+ depends on USB_NET_CDC_SUBSET -+ - config USB_NET_CDC_SUBSET - tristate "Simple USB Network Links (CDC Ethernet subset)" - depends on USB_USBNET -@@ -413,6 +417,7 @@ config USB_NET_CDC_SUBSET - config USB_ALI_M5632 - bool "ALi M5632 based 'USB 2.0 Data Link' cables" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - help - Choose this option if you're using a host-to-host cable - based on this design, which supports USB 2.0 high speed. -@@ -420,6 +425,7 @@ config USB_ALI_M5632 - config USB_AN2720 - bool "AnchorChips 2720 based cables (Xircom PGUNET, ...)" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - help - Choose this option if you're using a host-to-host cable - based on this design. Note that AnchorChips is now a -@@ -428,6 +434,7 @@ config USB_AN2720 - config USB_BELKIN - bool "eTEK based host-to-host cables (Advance, Belkin, ...)" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - default y - help - Choose this option if you're using a host-to-host cable -@@ -437,6 +444,7 @@ config USB_BELKIN - config USB_ARMLINUX - bool "Embedded ARM Linux links (iPaq, ...)" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - default y - help - Choose this option to support the "usb-eth" networking driver -@@ -454,6 +462,7 @@ config USB_ARMLINUX - config USB_EPSON2888 - bool "Epson 2888 based firmware (DEVELOPMENT)" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - help - Choose this option to support the usb networking links used - by some sample firmware from Epson. -@@ -461,6 +470,7 @@ config USB_EPSON2888 - config USB_KC2190 - bool "KT Technology KC2190 based cables (InstaNet)" - depends on USB_NET_CDC_SUBSET -+ select USB_NET_CDC_SUBSET_ENABLE - help - Choose this option if you're using a host-to-host cable - with one of these chips. -diff --git a/drivers/net/usb/Makefile b/drivers/net/usb/Makefile -index b5f04068dbe4..37fb46aee341 100644 ---- a/drivers/net/usb/Makefile -+++ b/drivers/net/usb/Makefile -@@ -23,7 +23,7 @@ obj-$(CONFIG_USB_NET_GL620A) += gl620a.o - obj-$(CONFIG_USB_NET_NET1080) += net1080.o - obj-$(CONFIG_USB_NET_PLUSB) += plusb.o - obj-$(CONFIG_USB_NET_RNDIS_HOST) += rndis_host.o --obj-$(CONFIG_USB_NET_CDC_SUBSET) += cdc_subset.o -+obj-$(CONFIG_USB_NET_CDC_SUBSET_ENABLE) += cdc_subset.o - obj-$(CONFIG_USB_NET_ZAURUS) += zaurus.o - obj-$(CONFIG_USB_NET_MCS7830) += mcs7830.o - obj-$(CONFIG_USB_USBNET) += usbnet.o -diff --git a/drivers/net/wireless/cw1200/cw1200_spi.c b/drivers/net/wireless/cw1200/cw1200_spi.c -index a740083634d8..63f95e9c2992 100644 ---- a/drivers/net/wireless/cw1200/cw1200_spi.c -+++ b/drivers/net/wireless/cw1200/cw1200_spi.c -@@ -446,8 +446,7 @@ static int cw1200_spi_disconnect(struct spi_device *func) - return 0; - } - --#ifdef CONFIG_PM --static int cw1200_spi_suspend(struct device *dev) -+static int __maybe_unused cw1200_spi_suspend(struct device *dev) - { - struct hwbus_priv *self = spi_get_drvdata(to_spi_device(dev)); - -@@ -460,16 +459,12 @@ static int cw1200_spi_suspend(struct device *dev) - - static SIMPLE_DEV_PM_OPS(cw1200_pm_ops, cw1200_spi_suspend, NULL); - --#endif -- - static struct spi_driver spi_driver = { - .probe = cw1200_spi_probe, - .remove = cw1200_spi_disconnect, - .driver = { - .name = "cw1200_wlan_spi", --#ifdef CONFIG_PM -- .pm = &cw1200_pm_ops, --#endif -+ .pm = IS_ENABLED(CONFIG_PM) ? &cw1200_pm_ops : NULL, - }, - }; - -diff --git a/drivers/net/wireless/cw1200/pm.h b/drivers/net/wireless/cw1200/pm.h -index 3ed90ff22bb8..534548470ebc 100644 ---- a/drivers/net/wireless/cw1200/pm.h -+++ b/drivers/net/wireless/cw1200/pm.h -@@ -31,13 +31,18 @@ int cw1200_pm_init(struct cw1200_pm_state *pm, - void cw1200_pm_deinit(struct cw1200_pm_state *pm); - int cw1200_wow_suspend(struct ieee80211_hw *hw, - struct cfg80211_wowlan *wowlan); --int cw1200_wow_resume(struct ieee80211_hw *hw); - int cw1200_can_suspend(struct cw1200_common *priv); -+int cw1200_wow_resume(struct ieee80211_hw *hw); - void cw1200_pm_stay_awake(struct cw1200_pm_state *pm, - unsigned long tmo); - #else - static inline void cw1200_pm_stay_awake(struct cw1200_pm_state *pm, -- unsigned long tmo) { -+ unsigned long tmo) -+{ -+} -+static inline int cw1200_can_suspend(struct cw1200_common *priv) -+{ -+ return 0; - } - #endif - #endif -diff --git a/drivers/net/wireless/cw1200/wsm.c b/drivers/net/wireless/cw1200/wsm.c -index 9e0ca3048657..3dd46c78c1cc 100644 ---- a/drivers/net/wireless/cw1200/wsm.c -+++ b/drivers/net/wireless/cw1200/wsm.c -@@ -379,7 +379,6 @@ static int wsm_multi_tx_confirm(struct cw1200_common *priv, - { - int ret; - int count; -- int i; - - count = WSM_GET32(buf); - if (WARN_ON(count <= 0)) -@@ -395,11 +394,10 @@ static int wsm_multi_tx_confirm(struct cw1200_common *priv, - } - - cw1200_debug_txed_multi(priv, count); -- for (i = 0; i < count; ++i) { -+ do { - ret = wsm_tx_confirm(priv, buf, link_id); -- if (ret) -- return ret; -- } -+ } while (!ret && --count); -+ - return ret; - - underflow: -diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c -index b57cfd965196..7b13962ec9da 100644 ---- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c -+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/dm.c -@@ -2488,9 +2488,9 @@ void rtl8821ae_dm_txpower_tracking_callback_thermalmeter( - for (p = RF90_PATH_A; p < MAX_PATH_NUM_8821A; p++) - rtldm->swing_idx_ofdm_base[p] = rtldm->swing_idx_ofdm[p]; - -- RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, -- "pDM_Odm->RFCalibrateInfo.ThermalValue = %d ThermalValue= %d\n", -- rtldm->thermalvalue, thermal_value); -+ RT_TRACE(rtlpriv, COMP_POWER_TRACKING, DBG_LOUD, -+ "pDM_Odm->RFCalibrateInfo.ThermalValue = %d ThermalValue= %d\n", -+ rtldm->thermalvalue, thermal_value); - /*Record last Power Tracking Thermal Value*/ - rtldm->thermalvalue = thermal_value; - } -diff --git a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c -index 1b580ba76453..907d7db3fcee 100644 ---- a/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c -+++ b/drivers/pinctrl/sunxi/pinctrl-sun9i-a80.c -@@ -145,19 +145,19 @@ static const struct sunxi_desc_pin sun9i_a80_pins[] = { - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x3, "mcsi"), /* MCLK */ -- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 14)), /* PB_EINT14 */ -+ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 14)), /* PB_EINT14 */ - SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 15), - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x3, "mcsi"), /* SCK */ - SUNXI_FUNCTION(0x4, "i2c4"), /* SCK */ -- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 15)), /* PB_EINT15 */ -+ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 15)), /* PB_EINT15 */ - SUNXI_PIN(SUNXI_PINCTRL_PIN(B, 16), - SUNXI_FUNCTION(0x0, "gpio_in"), - SUNXI_FUNCTION(0x1, "gpio_out"), - SUNXI_FUNCTION(0x3, "mcsi"), /* SDA */ - SUNXI_FUNCTION(0x4, "i2c4"), /* SDA */ -- SUNXI_FUNCTION_IRQ_BANK(0x6, 0, 16)), /* PB_EINT16 */ -+ SUNXI_FUNCTION_IRQ_BANK(0x6, 1, 16)), /* PB_EINT16 */ - - /* Hole */ - SUNXI_PIN(SUNXI_PINCTRL_PIN(C, 0), -diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig -index 1089eaa02b00..988ebe9a6b90 100644 ---- a/drivers/platform/x86/Kconfig -+++ b/drivers/platform/x86/Kconfig -@@ -95,6 +95,7 @@ config DELL_LAPTOP - tristate "Dell Laptop Extras" - depends on X86 - depends on DCDBAS -+ depends on DMI - depends on BACKLIGHT_CLASS_DEVICE - depends on ACPI_VIDEO || ACPI_VIDEO = n - depends on RFKILL || RFKILL = n -@@ -110,6 +111,7 @@ config DELL_LAPTOP - config DELL_WMI - tristate "Dell WMI extras" - depends on ACPI_WMI -+ depends on DMI - depends on INPUT - depends on ACPI_VIDEO || ACPI_VIDEO = n - select INPUT_SPARSEKMAP -diff --git a/drivers/platform/x86/intel_mid_thermal.c b/drivers/platform/x86/intel_mid_thermal.c -index 5c768c4627d3..78e1bfee698a 100644 ---- a/drivers/platform/x86/intel_mid_thermal.c -+++ b/drivers/platform/x86/intel_mid_thermal.c -@@ -415,6 +415,7 @@ static struct thermal_device_info *initialize_sensor(int index) - return td_info; - } - -+#ifdef CONFIG_PM_SLEEP - /** - * mid_thermal_resume - resume routine - * @dev: device structure -@@ -442,6 +443,7 @@ static int mid_thermal_suspend(struct device *dev) - */ - return configure_adc(0); - } -+#endif - - static SIMPLE_DEV_PM_OPS(mid_thermal_pm, - mid_thermal_suspend, mid_thermal_resume); -diff --git a/drivers/platform/x86/tc1100-wmi.c b/drivers/platform/x86/tc1100-wmi.c -index 89aa976f0ab2..65b0a4845ddd 100644 ---- a/drivers/platform/x86/tc1100-wmi.c -+++ b/drivers/platform/x86/tc1100-wmi.c -@@ -52,7 +52,9 @@ struct tc1100_data { - u32 jogdial; - }; - -+#ifdef CONFIG_PM - static struct tc1100_data suspend_data; -+#endif - - /* -------------------------------------------------------------------------- - Device Management -diff --git a/drivers/power/Kconfig b/drivers/power/Kconfig -index 237d7aa73e8c..9f53fb74ae6f 100644 ---- a/drivers/power/Kconfig -+++ b/drivers/power/Kconfig -@@ -159,6 +159,7 @@ config BATTERY_SBS - - config BATTERY_BQ27XXX - tristate "BQ27xxx battery driver" -+ depends on I2C || I2C=n - help - Say Y here to enable support for batteries with BQ27xxx (I2C/HDQ) chips. - -diff --git a/drivers/power/bq27xxx_battery.c b/drivers/power/bq27xxx_battery.c -index 880233ce9343..6c3a447f378b 100644 ---- a/drivers/power/bq27xxx_battery.c -+++ b/drivers/power/bq27xxx_battery.c -@@ -285,7 +285,7 @@ static u8 bq27421_regs[] = { - 0x18, /* AP */ - }; - --static u8 *bq27xxx_regs[] = { -+static u8 *bq27xxx_regs[] __maybe_unused = { - [BQ27000] = bq27000_regs, - [BQ27010] = bq27010_regs, - [BQ27500] = bq27500_regs, -@@ -991,7 +991,7 @@ static void bq27xxx_external_power_changed(struct power_supply *psy) - schedule_delayed_work(&di->work, 0); - } - --static int bq27xxx_powersupply_init(struct bq27xxx_device_info *di, -+static int __maybe_unused bq27xxx_powersupply_init(struct bq27xxx_device_info *di, - const char *name) - { - int ret; -@@ -1026,7 +1026,7 @@ static int bq27xxx_powersupply_init(struct bq27xxx_device_info *di, - return 0; - } - --static void bq27xxx_powersupply_unregister(struct bq27xxx_device_info *di) -+static void __maybe_unused bq27xxx_powersupply_unregister(struct bq27xxx_device_info *di) - { - /* - * power_supply_unregister call bq27xxx_battery_get_property which -diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c -index 9083247f55a8..21d174e9ebdb 100644 ---- a/drivers/s390/block/dasd_eckd.c -+++ b/drivers/s390/block/dasd_eckd.c -@@ -518,10 +518,12 @@ static int prefix_LRE(struct ccw1 *ccw, struct PFX_eckd_data *pfxdata, - pfxdata->validity.define_extent = 1; - - /* private uid is kept up to date, conf_data may be outdated */ -- if (startpriv->uid.type != UA_BASE_DEVICE) { -+ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) - pfxdata->validity.verify_base = 1; -- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) -- pfxdata->validity.hyper_pav = 1; -+ -+ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { -+ pfxdata->validity.verify_base = 1; -+ pfxdata->validity.hyper_pav = 1; - } - - /* define extend data (mostly)*/ -@@ -3002,10 +3004,12 @@ static int prepare_itcw(struct itcw *itcw, - pfxdata.validity.define_extent = 1; - - /* private uid is kept up to date, conf_data may be outdated */ -- if (startpriv->uid.type != UA_BASE_DEVICE) { -+ if (startpriv->uid.type == UA_BASE_PAV_ALIAS) -+ pfxdata.validity.verify_base = 1; -+ -+ if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) { - pfxdata.validity.verify_base = 1; -- if (startpriv->uid.type == UA_HYPER_PAV_ALIAS) -- pfxdata.validity.hyper_pav = 1; -+ pfxdata.validity.hyper_pav = 1; - } - - switch (cmd) { -diff --git a/drivers/scsi/advansys.c b/drivers/scsi/advansys.c -index febbd83e2ecd..24e57e770432 100644 ---- a/drivers/scsi/advansys.c -+++ b/drivers/scsi/advansys.c -@@ -6291,18 +6291,17 @@ static uchar AscGetSynPeriodIndex(ASC_DVC_VAR *asc_dvc, uchar syn_time) - static uchar - AscMsgOutSDTR(ASC_DVC_VAR *asc_dvc, uchar sdtr_period, uchar sdtr_offset) - { -- EXT_MSG sdtr_buf; -- uchar sdtr_period_index; -- PortAddr iop_base; -- -- iop_base = asc_dvc->iop_base; -- sdtr_buf.msg_type = EXTENDED_MESSAGE; -- sdtr_buf.msg_len = MS_SDTR_LEN; -- sdtr_buf.msg_req = EXTENDED_SDTR; -- sdtr_buf.xfer_period = sdtr_period; -+ PortAddr iop_base = asc_dvc->iop_base; -+ uchar sdtr_period_index = AscGetSynPeriodIndex(asc_dvc, sdtr_period); -+ EXT_MSG sdtr_buf = { -+ .msg_type = EXTENDED_MESSAGE, -+ .msg_len = MS_SDTR_LEN, -+ .msg_req = EXTENDED_SDTR, -+ .xfer_period = sdtr_period, -+ .req_ack_offset = sdtr_offset, -+ }; - sdtr_offset &= ASC_SYN_MAX_OFFSET; -- sdtr_buf.req_ack_offset = sdtr_offset; -- sdtr_period_index = AscGetSynPeriodIndex(asc_dvc, sdtr_period); -+ - if (sdtr_period_index <= asc_dvc->max_sdtr_index) { - AscMemWordCopyPtrToLram(iop_base, ASCV_MSGOUT_BEG, - (uchar *)&sdtr_buf, -@@ -11030,6 +11029,9 @@ static int advansys_board_found(struct Scsi_Host *shost, unsigned int iop, - ASC_DBG(2, "AdvInitGetConfig()\n"); - - ret = AdvInitGetConfig(pdev, shost) ? -ENODEV : 0; -+#else -+ share_irq = 0; -+ ret = -ENODEV; - #endif /* CONFIG_PCI */ - } - -diff --git a/drivers/scsi/dpt_i2o.c b/drivers/scsi/dpt_i2o.c -index d4cda5e9600e..21c8d210c456 100644 ---- a/drivers/scsi/dpt_i2o.c -+++ b/drivers/scsi/dpt_i2o.c -@@ -180,11 +180,14 @@ static u8 adpt_read_blink_led(adpt_hba* host) - *============================================================================ - */ - -+#ifdef MODULE - static struct pci_device_id dptids[] = { - { PCI_DPT_VENDOR_ID, PCI_DPT_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,}, - { PCI_DPT_VENDOR_ID, PCI_DPT_RAPTOR_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID,}, - { 0, } - }; -+#endif -+ - MODULE_DEVICE_TABLE(pci,dptids); - - static int adpt_detect(struct scsi_host_template* sht) -diff --git a/drivers/scsi/fdomain.c b/drivers/scsi/fdomain.c -index eefe14d453db..b87ab38a4530 100644 ---- a/drivers/scsi/fdomain.c -+++ b/drivers/scsi/fdomain.c -@@ -1768,7 +1768,7 @@ struct scsi_host_template fdomain_driver_template = { - }; - - #ifndef PCMCIA --#ifdef CONFIG_PCI -+#if defined(CONFIG_PCI) && defined(MODULE) - - static struct pci_device_id fdomain_pci_tbl[] = { - { PCI_VENDOR_ID_FD, PCI_DEVICE_ID_FD_36C70, -diff --git a/drivers/scsi/g_NCR5380.c b/drivers/scsi/g_NCR5380.c -index f8d2478b11cc..87e081f8a386 100644 ---- a/drivers/scsi/g_NCR5380.c -+++ b/drivers/scsi/g_NCR5380.c -@@ -538,7 +538,10 @@ static inline int NCR5380_pread(struct Scsi_Host *instance, unsigned char *dst, - printk(KERN_ERR "53C400r: Got 53C80_IRQ start=%d, blocks=%d\n", start, blocks); - return -1; - } -- while (NCR5380_read(C400_CONTROL_STATUS_REG) & CSR_HOST_BUF_NOT_RDY); -+ while (NCR5380_read(C400_CONTROL_STATUS_REG) & CSR_HOST_BUF_NOT_RDY) -+ { -+ // FIXME - no timeout -+ } - - #ifndef SCSI_G_NCR5380_MEM - { -diff --git a/drivers/scsi/initio.c b/drivers/scsi/initio.c -index 6a926bae76b2..7a91cf3ff173 100644 ---- a/drivers/scsi/initio.c -+++ b/drivers/scsi/initio.c -@@ -110,11 +110,6 @@ - #define i91u_MAXQUEUE 2 - #define i91u_REVID "Initio INI-9X00U/UW SCSI device driver; Revision: 1.04a" - --#define I950_DEVICE_ID 0x9500 /* Initio's inic-950 product ID */ --#define I940_DEVICE_ID 0x9400 /* Initio's inic-940 product ID */ --#define I935_DEVICE_ID 0x9401 /* Initio's inic-935 product ID */ --#define I920_DEVICE_ID 0x0002 /* Initio's other product ID */ -- - #ifdef DEBUG_i91u - static unsigned int i91u_debug = DEBUG_DEFAULT; - #endif -@@ -127,17 +122,6 @@ static int setup_debug = 0; - - static void i91uSCBPost(u8 * pHcb, u8 * pScb); - --/* PCI Devices supported by this driver */ --static struct pci_device_id i91u_pci_devices[] = { -- { PCI_VENDOR_ID_INIT, I950_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -- { PCI_VENDOR_ID_INIT, I940_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -- { PCI_VENDOR_ID_INIT, I935_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -- { PCI_VENDOR_ID_INIT, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -- { PCI_VENDOR_ID_DOMEX, I920_DEVICE_ID, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, -- { } --}; --MODULE_DEVICE_TABLE(pci, i91u_pci_devices); -- - #define DEBUG_INTERRUPT 0 - #define DEBUG_QUEUE 0 - #define DEBUG_STATE 0 -diff --git a/drivers/scsi/mvumi.c b/drivers/scsi/mvumi.c -index 02360de6b7e0..39285070f3b5 100644 ---- a/drivers/scsi/mvumi.c -+++ b/drivers/scsi/mvumi.c -@@ -2629,7 +2629,7 @@ static void mvumi_shutdown(struct pci_dev *pdev) - mvumi_flush_cache(mhba); - } - --static int mvumi_suspend(struct pci_dev *pdev, pm_message_t state) -+static int __maybe_unused mvumi_suspend(struct pci_dev *pdev, pm_message_t state) - { - struct mvumi_hba *mhba = NULL; - -@@ -2648,7 +2648,7 @@ static int mvumi_suspend(struct pci_dev *pdev, pm_message_t state) - return 0; - } - --static int mvumi_resume(struct pci_dev *pdev) -+static int __maybe_unused mvumi_resume(struct pci_dev *pdev) - { - int ret; - struct mvumi_hba *mhba = NULL; -diff --git a/drivers/scsi/sim710.c b/drivers/scsi/sim710.c -index 3b3b56f4a830..82ed99848378 100644 ---- a/drivers/scsi/sim710.c -+++ b/drivers/scsi/sim710.c -@@ -176,8 +176,7 @@ static struct eisa_device_id sim710_eisa_ids[] = { - }; - MODULE_DEVICE_TABLE(eisa, sim710_eisa_ids); - --static __init int --sim710_eisa_probe(struct device *dev) -+static int sim710_eisa_probe(struct device *dev) - { - struct eisa_device *edev = to_eisa_device(dev); - unsigned long io_addr = edev->base_addr; -diff --git a/drivers/spi/spi-sun4i.c b/drivers/spi/spi-sun4i.c -index 39d7c7c70112..2eea3de5a668 100644 ---- a/drivers/spi/spi-sun4i.c -+++ b/drivers/spi/spi-sun4i.c -@@ -458,7 +458,7 @@ err_free_master: - - static int sun4i_spi_remove(struct platform_device *pdev) - { -- pm_runtime_disable(&pdev->dev); -+ pm_runtime_force_suspend(&pdev->dev); - - return 0; - } -diff --git a/drivers/ssb/main.c b/drivers/ssb/main.c -index 5d1e9a0fc389..e2ff6b5b2094 100644 ---- a/drivers/ssb/main.c -+++ b/drivers/ssb/main.c -@@ -613,9 +613,10 @@ out: - return err; - } - --static int ssb_bus_register(struct ssb_bus *bus, -- ssb_invariants_func_t get_invariants, -- unsigned long baseaddr) -+static int __maybe_unused -+ssb_bus_register(struct ssb_bus *bus, -+ ssb_invariants_func_t get_invariants, -+ unsigned long baseaddr) - { - int err; - -diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c -index b64327722660..ec31b53ae3a5 100644 ---- a/drivers/staging/android/ashmem.c -+++ b/drivers/staging/android/ashmem.c -@@ -704,30 +704,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, - size_t pgstart, pgend; - int ret = -EINVAL; - -+ mutex_lock(&ashmem_mutex); -+ - if (unlikely(!asma->file)) -- return -EINVAL; -+ goto out_unlock; - -- if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) -- return -EFAULT; -+ if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) { -+ ret = -EFAULT; -+ goto out_unlock; -+ } - - /* per custom, you can pass zero for len to mean "everything onward" */ - if (!pin.len) - pin.len = PAGE_ALIGN(asma->size) - pin.offset; - - if (unlikely((pin.offset | pin.len) & ~PAGE_MASK)) -- return -EINVAL; -+ goto out_unlock; - - if (unlikely(((__u32)-1) - pin.offset < pin.len)) -- return -EINVAL; -+ goto out_unlock; - - if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len)) -- return -EINVAL; -+ goto out_unlock; - - pgstart = pin.offset / PAGE_SIZE; - pgend = pgstart + (pin.len / PAGE_SIZE) - 1; - -- mutex_lock(&ashmem_mutex); -- - switch (cmd) { - case ASHMEM_PIN: - ret = ashmem_pin(asma, pgstart, pgend); -@@ -740,6 +742,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd, - break; - } - -+out_unlock: - mutex_unlock(&ashmem_mutex); - - return ret; -diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c -index abc66908681d..6f032009f93f 100644 ---- a/drivers/staging/iio/adc/ad7192.c -+++ b/drivers/staging/iio/adc/ad7192.c -@@ -124,6 +124,8 @@ - #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */ - #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */ - -+#define AD7192_EXT_FREQ_MHZ_MIN 2457600 -+#define AD7192_EXT_FREQ_MHZ_MAX 5120000 - #define AD7192_INT_FREQ_MHZ 4915200 - - /* NOTE: -@@ -199,6 +201,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st) - ARRAY_SIZE(ad7192_calib_arr)); - } - -+static inline bool ad7192_valid_external_frequency(u32 freq) -+{ -+ return (freq >= AD7192_EXT_FREQ_MHZ_MIN && -+ freq <= AD7192_EXT_FREQ_MHZ_MAX); -+} -+ - static int ad7192_setup(struct ad7192_state *st, - const struct ad7192_platform_data *pdata) - { -@@ -224,17 +232,20 @@ static int ad7192_setup(struct ad7192_state *st, - id); - - switch (pdata->clock_source_sel) { -- case AD7192_CLK_EXT_MCLK1_2: -- case AD7192_CLK_EXT_MCLK2: -- st->mclk = AD7192_INT_FREQ_MHZ; -- break; - case AD7192_CLK_INT: - case AD7192_CLK_INT_CO: -- if (pdata->ext_clk_hz) -- st->mclk = pdata->ext_clk_hz; -- else -- st->mclk = AD7192_INT_FREQ_MHZ; -+ st->mclk = AD7192_INT_FREQ_MHZ; - break; -+ case AD7192_CLK_EXT_MCLK1_2: -+ case AD7192_CLK_EXT_MCLK2: -+ if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) { -+ st->mclk = pdata->ext_clk_hz; -+ break; -+ } -+ dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n", -+ pdata->ext_clk_hz); -+ ret = -EINVAL; -+ goto out; - default: - ret = -EINVAL; - goto out; -diff --git a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c -index 824d460911ec..58ccafb97344 100644 ---- a/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c -+++ b/drivers/staging/ste_rmi4/synaptics_i2c_rmi4.c -@@ -1039,7 +1039,6 @@ static int synaptics_rmi4_remove(struct i2c_client *client) - return 0; - } - --#ifdef CONFIG_PM - /** - * synaptics_rmi4_suspend() - suspend the touch screen controller - * @dev: pointer to device structure -@@ -1047,7 +1046,7 @@ static int synaptics_rmi4_remove(struct i2c_client *client) - * This function is used to suspend the - * touch panel controller and returns integer - */ --static int synaptics_rmi4_suspend(struct device *dev) -+static int __maybe_unused synaptics_rmi4_suspend(struct device *dev) - { - /* Touch sleep mode */ - int retval; -@@ -1081,7 +1080,7 @@ static int synaptics_rmi4_suspend(struct device *dev) - * This function is used to resume the touch panel - * controller and returns integer. - */ --static int synaptics_rmi4_resume(struct device *dev) -+static int __maybe_unused synaptics_rmi4_resume(struct device *dev) - { - int retval; - unsigned char intr_status; -@@ -1112,8 +1111,6 @@ static int synaptics_rmi4_resume(struct device *dev) - return 0; - } - --#endif -- - static SIMPLE_DEV_PM_OPS(synaptics_rmi4_dev_pm_ops, synaptics_rmi4_suspend, - synaptics_rmi4_resume); - -diff --git a/drivers/staging/unisys/visorinput/Kconfig b/drivers/staging/unisys/visorinput/Kconfig -index d83deb4137e8..6baba2795ce7 100644 ---- a/drivers/staging/unisys/visorinput/Kconfig -+++ b/drivers/staging/unisys/visorinput/Kconfig -@@ -4,7 +4,7 @@ - - config UNISYS_VISORINPUT - tristate "Unisys visorinput driver" -- depends on UNISYSSPAR && UNISYS_VISORBUS && FB -+ depends on UNISYSSPAR && UNISYS_VISORBUS && FB && INPUT - ---help--- - If you say Y here, you will enable the Unisys visorinput driver. - -diff --git a/drivers/staging/wilc1000/wilc_wlan_if.h b/drivers/staging/wilc1000/wilc_wlan_if.h -index be972afe6e62..bfc3e96d8d25 100644 ---- a/drivers/staging/wilc1000/wilc_wlan_if.h -+++ b/drivers/staging/wilc1000/wilc_wlan_if.h -@@ -12,6 +12,7 @@ - - #include - #include "linux_wlan_common.h" -+#include - - /******************************************** - * -diff --git a/drivers/target/target_core_user.c b/drivers/target/target_core_user.c -index a7d30e894cab..c43c942e1f87 100644 ---- a/drivers/target/target_core_user.c -+++ b/drivers/target/target_core_user.c -@@ -900,7 +900,7 @@ static int tcmu_configure_device(struct se_device *dev) - info->version = __stringify(TCMU_MAILBOX_VERSION); - - info->mem[0].name = "tcm-user command & data buffer"; -- info->mem[0].addr = (phys_addr_t) udev->mb_addr; -+ info->mem[0].addr = (phys_addr_t)(uintptr_t)udev->mb_addr; - info->mem[0].size = TCMU_RING_SIZE; - info->mem[0].memtype = UIO_MEM_VIRTUAL; - -diff --git a/drivers/thermal/Kconfig b/drivers/thermal/Kconfig -index 8cc4ac64a91c..4b660b5beb98 100644 ---- a/drivers/thermal/Kconfig -+++ b/drivers/thermal/Kconfig -@@ -299,7 +299,7 @@ config X86_PKG_TEMP_THERMAL - - config INTEL_SOC_DTS_IOSF_CORE - tristate -- depends on X86 -+ depends on X86 && PCI - select IOSF_MBI - help - This is becoming a common feature for Intel SoCs to expose the additional -@@ -309,7 +309,7 @@ config INTEL_SOC_DTS_IOSF_CORE - - config INTEL_SOC_DTS_THERMAL - tristate "Intel SoCs DTS thermal driver" -- depends on X86 -+ depends on X86 && PCI - select INTEL_SOC_DTS_IOSF_CORE - select THERMAL_WRITABLE_TRIPS - help -diff --git a/drivers/thermal/spear_thermal.c b/drivers/thermal/spear_thermal.c -index 534dd9136662..81b35aace9de 100644 ---- a/drivers/thermal/spear_thermal.c -+++ b/drivers/thermal/spear_thermal.c -@@ -54,8 +54,7 @@ static struct thermal_zone_device_ops ops = { - .get_temp = thermal_get_temp, - }; - --#ifdef CONFIG_PM --static int spear_thermal_suspend(struct device *dev) -+static int __maybe_unused spear_thermal_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev); -@@ -72,7 +71,7 @@ static int spear_thermal_suspend(struct device *dev) - return 0; - } - --static int spear_thermal_resume(struct device *dev) -+static int __maybe_unused spear_thermal_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct thermal_zone_device *spear_thermal = platform_get_drvdata(pdev); -@@ -94,7 +93,6 @@ static int spear_thermal_resume(struct device *dev) - - return 0; - } --#endif - - static SIMPLE_DEV_PM_OPS(spear_thermal_pm_ops, spear_thermal_suspend, - spear_thermal_resume); -diff --git a/drivers/tty/Kconfig b/drivers/tty/Kconfig -index c01f45095877..82c4d2e45319 100644 ---- a/drivers/tty/Kconfig -+++ b/drivers/tty/Kconfig -@@ -226,7 +226,7 @@ config CYCLADES - - config CYZ_INTR - bool "Cyclades-Z interrupt mode operation" -- depends on CYCLADES -+ depends on CYCLADES && PCI - help - The Cyclades-Z family of multiport cards allows 2 (two) driver op - modes: polling and interrupt. In polling mode, the driver will check -diff --git a/drivers/tty/hvc/hvc_xen.c b/drivers/tty/hvc/hvc_xen.c -index fa816b7193b6..11725422dacb 100644 ---- a/drivers/tty/hvc/hvc_xen.c -+++ b/drivers/tty/hvc/hvc_xen.c -@@ -323,6 +323,7 @@ void xen_console_resume(void) - } - } - -+#ifdef CONFIG_HVC_XEN_FRONTEND - static void xencons_disconnect_backend(struct xencons_info *info) - { - if (info->irq > 0) -@@ -363,7 +364,6 @@ static int xen_console_remove(struct xencons_info *info) - return 0; - } - --#ifdef CONFIG_HVC_XEN_FRONTEND - static int xencons_remove(struct xenbus_device *dev) - { - return xen_console_remove(dev_get_drvdata(&dev->dev)); -diff --git a/drivers/tty/serial/8250/Kconfig b/drivers/tty/serial/8250/Kconfig -index 6412f1455beb..6f4c180aadc1 100644 ---- a/drivers/tty/serial/8250/Kconfig -+++ b/drivers/tty/serial/8250/Kconfig -@@ -372,7 +372,7 @@ config SERIAL_8250_MID - tristate "Support for serial ports on Intel MID platforms" - depends on SERIAL_8250 && PCI - select HSU_DMA if SERIAL_8250_DMA -- select HSU_DMA_PCI if X86_INTEL_MID -+ select HSU_DMA_PCI if (HSU_DMA && X86_INTEL_MID) - select RATIONAL - help - Selecting this option will enable handling of the extra features -diff --git a/drivers/usb/host/Kconfig b/drivers/usb/host/Kconfig -index 3bb08870148f..95e72d75e0a0 100644 ---- a/drivers/usb/host/Kconfig -+++ b/drivers/usb/host/Kconfig -@@ -220,6 +220,8 @@ config USB_EHCI_TEGRA - depends on ARCH_TEGRA - select USB_EHCI_ROOT_HUB_TT - select USB_PHY -+ select USB_ULPI -+ select USB_ULPI_VIEWPORT - help - This driver enables support for the internal USB Host Controllers - found in NVIDIA Tegra SoCs. The controllers are EHCI compliant. -diff --git a/drivers/usb/musb/ux500_dma.c b/drivers/usb/musb/ux500_dma.c -index d0b6a1cd7f62..c92a295049ad 100644 ---- a/drivers/usb/musb/ux500_dma.c -+++ b/drivers/usb/musb/ux500_dma.c -@@ -207,9 +207,6 @@ static int ux500_dma_channel_program(struct dma_channel *channel, - BUG_ON(channel->status == MUSB_DMA_STATUS_UNKNOWN || - channel->status == MUSB_DMA_STATUS_BUSY); - -- if (!ux500_dma_is_compatible(channel, packet_sz, (void *)dma_addr, len)) -- return false; -- - channel->status = MUSB_DMA_STATUS_BUSY; - channel->actual_len = 0; - ret = ux500_configure_channel(channel, packet_sz, mode, dma_addr, len); -diff --git a/drivers/usb/phy/Kconfig b/drivers/usb/phy/Kconfig -index 22e8ecb6bfbd..7a72bef35acf 100644 ---- a/drivers/usb/phy/Kconfig -+++ b/drivers/usb/phy/Kconfig -@@ -140,6 +140,7 @@ config USB_MSM_OTG - tristate "Qualcomm on-chip USB OTG controller support" - depends on (USB || USB_GADGET) && (ARCH_QCOM || COMPILE_TEST) - depends on RESET_CONTROLLER -+ depends on REGULATOR - depends on EXTCON - select USB_PHY - help -diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c -index ec38370ffcab..0931f3271119 100644 ---- a/drivers/usb/usbip/stub_dev.c -+++ b/drivers/usb/usbip/stub_dev.c -@@ -87,6 +87,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr, - goto err; - - sdev->ud.tcp_socket = socket; -+ sdev->ud.sockfd = sockfd; - - spin_unlock_irq(&sdev->ud.lock); - -@@ -186,6 +187,7 @@ static void stub_shutdown_connection(struct usbip_device *ud) - if (ud->tcp_socket) { - sockfd_put(ud->tcp_socket); - ud->tcp_socket = NULL; -+ ud->sockfd = -1; - } - - /* 3. free used data */ -@@ -280,6 +282,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev) - sdev->ud.status = SDEV_ST_AVAILABLE; - spin_lock_init(&sdev->ud.lock); - sdev->ud.tcp_socket = NULL; -+ sdev->ud.sockfd = -1; - - INIT_LIST_HEAD(&sdev->priv_init); - INIT_LIST_HEAD(&sdev->priv_tx); -diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c -index 2d96bfd34138..4d68a1e9e878 100644 ---- a/drivers/usb/usbip/vhci_hcd.c -+++ b/drivers/usb/usbip/vhci_hcd.c -@@ -797,6 +797,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud) - if (vdev->ud.tcp_socket) { - sockfd_put(vdev->ud.tcp_socket); - vdev->ud.tcp_socket = NULL; -+ vdev->ud.sockfd = -1; - } - pr_info("release socket\n"); - -@@ -844,6 +845,7 @@ static void vhci_device_reset(struct usbip_device *ud) - if (ud->tcp_socket) { - sockfd_put(ud->tcp_socket); - ud->tcp_socket = NULL; -+ ud->sockfd = -1; - } - ud->status = VDEV_ST_NULL; - -diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig -index f07a0974fda2..3543e3e4cfb5 100644 ---- a/drivers/video/fbdev/Kconfig -+++ b/drivers/video/fbdev/Kconfig -@@ -1506,6 +1506,7 @@ config FB_SIS - select FB_CFB_COPYAREA - select FB_CFB_IMAGEBLIT - select FB_BOOT_VESA_SUPPORT if FB_SIS = y -+ select FB_SIS_300 if !FB_SIS_315 - help - This is the frame buffer device driver for the SiS 300, 315, 330 - and 340 series as well as XGI V3XT, V5, V8, Z7 graphics chipsets. -diff --git a/drivers/video/fbdev/auo_k190x.c b/drivers/video/fbdev/auo_k190x.c -index 8d2499d1cafb..9580374667ba 100644 ---- a/drivers/video/fbdev/auo_k190x.c -+++ b/drivers/video/fbdev/auo_k190x.c -@@ -773,9 +773,7 @@ static void auok190x_recover(struct auok190xfb_par *par) - /* - * Power-management - */ -- --#ifdef CONFIG_PM --static int auok190x_runtime_suspend(struct device *dev) -+static int __maybe_unused auok190x_runtime_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct fb_info *info = platform_get_drvdata(pdev); -@@ -822,7 +820,7 @@ finish: - return 0; - } - --static int auok190x_runtime_resume(struct device *dev) -+static int __maybe_unused auok190x_runtime_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct fb_info *info = platform_get_drvdata(pdev); -@@ -856,7 +854,7 @@ static int auok190x_runtime_resume(struct device *dev) - return 0; - } - --static int auok190x_suspend(struct device *dev) -+static int __maybe_unused auok190x_suspend(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct fb_info *info = platform_get_drvdata(pdev); -@@ -896,7 +894,7 @@ static int auok190x_suspend(struct device *dev) - return 0; - } - --static int auok190x_resume(struct device *dev) -+static int __maybe_unused auok190x_resume(struct device *dev) - { - struct platform_device *pdev = to_platform_device(dev); - struct fb_info *info = platform_get_drvdata(pdev); -@@ -933,7 +931,6 @@ static int auok190x_resume(struct device *dev) - - return 0; - } --#endif - - const struct dev_pm_ops auok190x_pm = { - SET_RUNTIME_PM_OPS(auok190x_runtime_suspend, auok190x_runtime_resume, -diff --git a/drivers/video/fbdev/exynos/s6e8ax0.c b/drivers/video/fbdev/exynos/s6e8ax0.c -index 95873f26e39c..de2f3e793786 100644 ---- a/drivers/video/fbdev/exynos/s6e8ax0.c -+++ b/drivers/video/fbdev/exynos/s6e8ax0.c -@@ -829,8 +829,7 @@ static int s6e8ax0_probe(struct mipi_dsim_lcd_device *dsim_dev) - return 0; - } - --#ifdef CONFIG_PM --static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) -+static int __maybe_unused s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) - { - struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev); - -@@ -843,7 +842,7 @@ static int s6e8ax0_suspend(struct mipi_dsim_lcd_device *dsim_dev) - return 0; - } - --static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) -+static int __maybe_unused s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) - { - struct s6e8ax0 *lcd = dev_get_drvdata(&dsim_dev->dev); - -@@ -855,10 +854,6 @@ static int s6e8ax0_resume(struct mipi_dsim_lcd_device *dsim_dev) - - return 0; - } --#else --#define s6e8ax0_suspend NULL --#define s6e8ax0_resume NULL --#endif - - static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = { - .name = "s6e8ax0", -@@ -867,8 +862,8 @@ static struct mipi_dsim_lcd_driver s6e8ax0_dsim_ddi_driver = { - .power_on = s6e8ax0_power_on, - .set_sequence = s6e8ax0_set_sequence, - .probe = s6e8ax0_probe, -- .suspend = s6e8ax0_suspend, -- .resume = s6e8ax0_resume, -+ .suspend = IS_ENABLED(CONFIG_PM) ? s6e8ax0_suspend : NULL, -+ .resume = IS_ENABLED(CONFIG_PM) ? s6e8ax0_resume : NULL, - }; - - static int s6e8ax0_init(void) -diff --git a/drivers/video/fbdev/intelfb/intelfbdrv.c b/drivers/video/fbdev/intelfb/intelfbdrv.c -index bbec737eef30..bf207444ba0c 100644 ---- a/drivers/video/fbdev/intelfb/intelfbdrv.c -+++ b/drivers/video/fbdev/intelfb/intelfbdrv.c -@@ -302,7 +302,7 @@ static __inline__ int get_opt_int(const char *this_opt, const char *name, - } - - static __inline__ int get_opt_bool(const char *this_opt, const char *name, -- int *ret) -+ bool *ret) - { - if (!ret) - return 0; -diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c -index a0f496049db7..3a6bb6561ba0 100644 ---- a/drivers/video/fbdev/mmp/core.c -+++ b/drivers/video/fbdev/mmp/core.c -@@ -23,6 +23,7 @@ - #include - #include - #include -+#include - #include